From 3c934570215c6718b043b35fdb821f94118e433f Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 1 Jul 2026 13:40:27 +0100
Subject: [PATCH 001/109] Fix rearrange-pages DUPLICATE producing shared page
 nodes (pypdf cyclic-references CI break) (#6851)

---
 .../api/RearrangePagesPDFController.java      | 16 ++++++++--
 .../api/RearrangePagesPDFControllerTest.java  | 31 +++++++++++++++++++
 2 files changed, 45 insertions(+), 2 deletions(-)

diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/RearrangePagesPDFController.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/RearrangePagesPDFController.java
index 6dd7aacd79..12e3a15b89 100644
--- a/app/core/src/main/java/stirling/software/SPDF/controller/api/RearrangePagesPDFController.java
+++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/RearrangePagesPDFController.java
@@ -3,9 +3,12 @@ package stirling.software.SPDF.controller.api;
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.Collections;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Locale;
+import java.util.Set;
 
+import org.apache.pdfbox.cos.COSDictionary;
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.PDPage;
 import org.apache.pdfbox.pdmodel.PDPageTree;
@@ -261,10 +264,19 @@ public class RearrangePagesPDFController {
                 log.info("newPageOrder = {}", newPageOrder);
                 log.info("totalPages = {}", totalPages);
 
-                // Snapshot the desired pages before mutating the source document's page tree.
+                // Snapshot desired pages before mutating the tree; clone repeats (e.g. DUPLICATE)
+                // so each slot is a distinct node, not one PDPage under multiple /Kids.
                 List<PDPage> newPages = new ArrayList<>(newPageOrder.size());
+                Set<Integer> seenIndices = new HashSet<>();
                 for (Integer idx : newPageOrder) {
-                    newPages.add(document.getPage(idx));
+                    PDPage page = document.getPage(idx);
+                    if (!seenIndices.add(idx)) {
+                        // Duplicate index: distinct page node sharing content/resources.
+                        COSDictionary clonedDict = new COSDictionary();
+                        clonedDict.addAll(page.getCOSObject());
+                        page = new PDPage(clonedDict);
+                    }
+                    newPages.add(page);
                 }
 
                 // Rearrange in-place on the source document rather than copying pages into a
diff --git a/app/core/src/test/java/stirling/software/SPDF/controller/api/RearrangePagesPDFControllerTest.java b/app/core/src/test/java/stirling/software/SPDF/controller/api/RearrangePagesPDFControllerTest.java
index a225c3fc52..14b1d9892a 100644
--- a/app/core/src/test/java/stirling/software/SPDF/controller/api/RearrangePagesPDFControllerTest.java
+++ b/app/core/src/test/java/stirling/software/SPDF/controller/api/RearrangePagesPDFControllerTest.java
@@ -9,6 +9,7 @@ import java.io.File;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
 
 import org.apache.pdfbox.Loader;
@@ -302,6 +303,11 @@ class RearrangePagesPDFControllerTest {
             assertNotNull(response);
             // 2 pages * 3 duplicates = 6 final pages
             assertEquals(6, realDoc.getNumberOfPages());
+            // Each duplicate must be a distinct page node in the saved output; a shared
+            // node under multiple /Kids is an invalid tree readers reject as cyclic.
+            List<Object> savedPages = reloadAndSnapshot(response);
+            assertEquals(6, savedPages.size());
+            assertEquals(6, new HashSet<>(savedPages).size());
         }
     }
 
@@ -323,4 +329,29 @@ class RearrangePagesPDFControllerTest {
             assertEquals(4, realDoc.getNumberOfPages());
         }
     }
+
+    @Test
+    void testRearrangePages_SideStitchBooklet_RepeatedPaddingPagesAreDistinctNodes()
+            throws IOException {
+        MockMultipartFile file = createMockPdf();
+        RearrangePagesRequest request = new RearrangePagesRequest();
+        request.setFileInput(file);
+        request.setPageNumbers("");
+        request.setCustomMode("SIDE_STITCH_BOOKLET_SORT");
+
+        // 6 pages is not a multiple of 4, so booklet padding repeats the last page index
+        // several times; each repeat must be a distinct page node, not one shared node.
+        try (PDDocument realDoc = buildRealPdf(6)) {
+            when(pdfDocumentFactory.load(file)).thenReturn(realDoc);
+
+            ResponseEntity<Resource> response = controller.rearrangePages(request);
+
+            assertNotNull(response);
+            assertEquals(200, response.getStatusCode().value());
+            assertEquals(8, realDoc.getNumberOfPages());
+            List<Object> savedPages = reloadAndSnapshot(response);
+            assertEquals(8, savedPages.size());
+            assertEquals(8, new HashSet<>(savedPages).size());
+        }
+    }
 }

From 8e4b2e2fc685380c2366308295a5820439e5f2a9 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Fri, 3 Jul 2026 09:55:07 +0100
Subject: [PATCH 002/109] Disable update check and notification in SaaS mode
 (#6863)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Description of Changes

In SaaS mode the self-hosted "Update Available" notification could still
appear and the update-check code (external call to
`supabase.stirling.com/functions/v1/updates`) still ran, even though the
cloud owns app versioning. The web `UpdateStartupPopup` was already
SaaS-gated via a null override, but two other paths were not:

- **Desktop app in SaaS connection mode** - `useDesktopUpdatePopup()`
ran its startup check and rendered the `UpdateModal` regardless of
connection mode, so a self-hosted update popup appeared while connected
to SaaS.
- **Settings → General** - the core `GeneralSection` fired
`checkForUpdate()` on mount unconditionally, even when the update
section was hidden (as SaaS does), so the external call still ran.

**What changed**

- `useDesktopUpdatePopup.ts` - the startup timer now bails out
immediately when `connectionModeService.getCurrentMode() === "saas"`. No
mode lookup, no external fetch, no modal.
- `core/GeneralSection.tsx` - the mount `checkForUpdate()` now returns
early when `hideUpdateSection` is set, so hiding the section (web SaaS,
managed-disabled desktop) also stops the external call.
- `desktop/GeneralSection.tsx` - passes `hideUpdateSection` when
`useSaaSMode()` is true, which (via the above) suppresses the settings
check in desktop-SaaS too.

**Why** - in SaaS the update check should never be called and no update
notification should be shown; the cloud handles versioning.

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [x] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../config/configSections/GeneralSection.tsx  |  6 +++--
 .../config/configSections/GeneralSection.tsx  |  7 ++++-
 .../hooks/useDesktopUpdatePopup.test.ts       | 26 ++++++++++++++++++-
 .../desktop/hooks/useDesktopUpdatePopup.ts    |  5 ++++
 4 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
index e5fdacea79..598b705347 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
@@ -112,12 +112,14 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
   // falling back to the backend version
   const currentVersion = appVersion ?? config?.appVersion ?? null;
 
-  // Check for updates on mount
+  // Check for updates on mount — skipped when the update UI is hidden (SaaS
+  // build, managed-disabled desktop) so no external update call ever fires.
   useEffect(() => {
+    if (hideUpdateSection) return;
     if (currentVersion) {
       checkForUpdate();
     }
-  }, [currentVersion, config?.machineType]);
+  }, [currentVersion, config?.machineType, hideUpdateSection]);
 
   const checkForUpdate = async () => {
     if (!currentVersion) return;
diff --git a/frontend/editor/src/desktop/components/shared/config/configSections/GeneralSection.tsx b/frontend/editor/src/desktop/components/shared/config/configSections/GeneralSection.tsx
index abe37d10b8..98c4455ce0 100644
--- a/frontend/editor/src/desktop/components/shared/config/configSections/GeneralSection.tsx
+++ b/frontend/editor/src/desktop/components/shared/config/configSections/GeneralSection.tsx
@@ -4,6 +4,7 @@ import { useTranslation } from "react-i18next";
 import CoreGeneralSection from "@core/components/shared/config/configSections/GeneralSection";
 import { DefaultAppSettings } from "@app/components/shared/config/configSections/DefaultAppSettings";
 import { useDesktopInstall } from "@app/hooks/useDesktopInstall";
+import { useSaaSMode } from "@app/hooks/useSaaSMode";
 import {
   desktopUpdateService,
   type UpdateMode,
@@ -22,6 +23,9 @@ import {
 const GeneralSection: React.FC = () => {
   const { t } = useTranslation();
   const install = useDesktopInstall();
+  // In SaaS connection mode the cloud owns app versioning — hide the update
+  // section (which also stops the core auto-check from firing).
+  const isSaaSMode = useSaaSMode();
   const [updateModeInfo, setUpdateModeInfo] = useState<UpdateModeInfo>({
     mode: "prompt",
     locked: false,
@@ -93,7 +97,8 @@ const GeneralSection: React.FC = () => {
       )}
       <CoreGeneralSection
         hideUpdateSection={
-          updateModeInfo.mode === "disabled" && updateModeInfo.locked
+          isSaaSMode ||
+          (updateModeInfo.mode === "disabled" && updateModeInfo.locked)
         }
         desktopInstall={{
           state: install.state,
diff --git a/frontend/editor/src/desktop/hooks/useDesktopUpdatePopup.test.ts b/frontend/editor/src/desktop/hooks/useDesktopUpdatePopup.test.ts
index d26a20a982..241edbeee4 100644
--- a/frontend/editor/src/desktop/hooks/useDesktopUpdatePopup.test.ts
+++ b/frontend/editor/src/desktop/hooks/useDesktopUpdatePopup.test.ts
@@ -9,6 +9,7 @@ const getVersionMock = vi.fn();
 const getUpdateModeMock = vi.fn();
 const canInstallUpdatesMock = vi.fn();
 const getUpdateSummaryMock = vi.fn();
+const getCurrentModeMock = vi.fn();
 
 vi.mock("@tauri-apps/api/core", () => ({
   invoke: (cmd: string, args?: unknown) => invokeMock(cmd, args),
@@ -36,6 +37,12 @@ vi.mock("@app/services/desktopUpdateService", () => ({
   },
 }));
 
+vi.mock("@app/services/connectionModeService", () => ({
+  connectionModeService: {
+    getCurrentMode: () => getCurrentModeMock(),
+  },
+}));
+
 import { useDesktopUpdatePopup } from "@app/hooks/useDesktopUpdatePopup";
 
 /** Flush pending microtasks so awaited promises settle. */
@@ -74,8 +81,11 @@ describe("useDesktopUpdatePopup — auto mode", () => {
     getUpdateModeMock.mockReset();
     canInstallUpdatesMock.mockReset();
     getUpdateSummaryMock.mockReset();
+    getCurrentModeMock.mockReset();
 
-    // Defaults: auto mode, update available, install permitted.
+    // Defaults: local (non-SaaS) connection, auto mode, update available,
+    // install permitted.
+    getCurrentModeMock.mockResolvedValue("local");
     getUpdateModeMock.mockResolvedValue("auto");
     getVersionMock.mockResolvedValue("1.0.0");
     getUpdateSummaryMock.mockResolvedValue({ latest_version: "2.0.0" });
@@ -189,4 +199,18 @@ describe("useDesktopUpdatePopup — auto mode", () => {
     expect(invocations).toContain("download_and_install_update");
     expect(invocations).toContain("restart_app");
   });
+
+  it("skips the update check entirely in SaaS connection mode", async () => {
+    // In SaaS mode the cloud owns versioning — the self-hosted update check
+    // must never run: no mode lookup, no external summary fetch, no install.
+    getCurrentModeMock.mockResolvedValue("saas");
+
+    await runStartup();
+
+    expect(getUpdateModeMock).not.toHaveBeenCalled();
+    expect(getUpdateSummaryMock).not.toHaveBeenCalled();
+    const invocations = invokeMock.mock.calls.map((c) => c[0]);
+    expect(invocations).not.toContain("download_and_install_update");
+    expect(invocations).not.toContain("restart_app");
+  });
 });
diff --git a/frontend/editor/src/desktop/hooks/useDesktopUpdatePopup.ts b/frontend/editor/src/desktop/hooks/useDesktopUpdatePopup.ts
index 6a2df77914..0cd0fcd003 100644
--- a/frontend/editor/src/desktop/hooks/useDesktopUpdatePopup.ts
+++ b/frontend/editor/src/desktop/hooks/useDesktopUpdatePopup.ts
@@ -6,6 +6,7 @@ import {
   desktopUpdateService,
   type CanInstallResult,
 } from "@app/services/desktopUpdateService";
+import { connectionModeService } from "@app/services/connectionModeService";
 
 const SNOOZE_KEY = "stirling-pdf-updater:snoozedUntil";
 const STARTUP_DELAY_MS = 15_000;
@@ -72,6 +73,10 @@ export function useDesktopUpdatePopup() {
     hasChecked.current = true;
 
     const timer = setTimeout(async () => {
+      // In SaaS connection mode the cloud owns app versioning — the self-hosted
+      // update check + popup must never run (no external call, no modal).
+      if ((await connectionModeService.getCurrentMode()) === "saas") return;
+
       let mode: Awaited<ReturnType<typeof desktopUpdateService.getUpdateMode>> =
         "prompt";
       try {

From 67a0ca6110c11ed58d5912a6d7b8068761cf57e3 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 6 Jul 2026 11:21:09 +0200
Subject: [PATCH 003/109] fix(frontend): respect analytics config before
 initializing PostHog (#6812)

# Description of Changes

Please provide a summary of the changes, including:

- What was changed
- Moved PostHog startup out of `index.tsx` and into a config-aware
initializer inside `AppProviders`.
- Added a dedicated `usePosthogTracking` hook that only initializes
PostHog when `enableAnalytics` is explicitly `true` and `enablePosthog`
is not disabled.
- Kept cookie-consent handling in the same flow so consent is applied
only after PostHog is actually initialized.
- Removed the unconditional `PostHogProvider` and `posthog.init(...)`
bootstrap from the app entrypoint.
- Added targeted frontend tests covering analytics-disabled and
analytics-enabled startup behavior.

- Why the change was made
- The previous frontend bootstrap initialized PostHog before app config
was loaded, so disabling analytics in the UI or via environment settings
did not prevent PostHog network activity.
- This change makes analytics behavior follow the server-provided config
instead of always connecting on page load.

Closes #6358

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [x] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [x] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../src/core/components/AppProviders.tsx      |  7 ++
 .../core/hooks/usePosthogTracking.test.tsx    | 76 +++++++++++++++++
 .../src/core/hooks/usePosthogTracking.ts      | 83 +++++++++++++++++++
 frontend/editor/src/index.tsx                 | 37 +--------
 4 files changed, 169 insertions(+), 34 deletions(-)
 create mode 100644 frontend/editor/src/core/hooks/usePosthogTracking.test.tsx
 create mode 100644 frontend/editor/src/core/hooks/usePosthogTracking.ts

diff --git a/frontend/editor/src/core/components/AppProviders.tsx b/frontend/editor/src/core/components/AppProviders.tsx
index ede9ed266a..f050ae7f9b 100644
--- a/frontend/editor/src/core/components/AppProviders.tsx
+++ b/frontend/editor/src/core/components/AppProviders.tsx
@@ -27,6 +27,7 @@ import { AdminTourOrchestrationProvider } from "@app/contexts/AdminTourOrchestra
 import { PageEditorProvider } from "@app/contexts/PageEditorContext";
 import { BannerProvider } from "@app/contexts/BannerContext";
 import ErrorBoundary from "@app/components/shared/ErrorBoundary";
+import { usePosthogTracking } from "@app/hooks/usePosthogTracking";
 import { useScarfTracking } from "@app/hooks/useScarfTracking";
 import { useAppInitialization } from "@app/hooks/useAppInitialization";
 import { useLogoAssets } from "@app/hooks/useLogoAssets";
@@ -43,6 +44,11 @@ function ScarfTrackingInitializer() {
   return null;
 }
 
+function PosthogTrackingInitializer() {
+  usePosthogTracking();
+  return null;
+}
+
 // Component to run app-level initialization (must be inside AppProviders for context access)
 function AppInitializer() {
   useAppInitialization();
@@ -122,6 +128,7 @@ export function AppProviders({
               retryOptions={appConfigRetryOptions}
               {...appConfigProviderProps}
             >
+              <PosthogTrackingInitializer />
               <ScarfTrackingInitializer />
               <AppConfigLoader />
               <ServerDefaultsSync />
diff --git a/frontend/editor/src/core/hooks/usePosthogTracking.test.tsx b/frontend/editor/src/core/hooks/usePosthogTracking.test.tsx
new file mode 100644
index 0000000000..41f5fad7dc
--- /dev/null
+++ b/frontend/editor/src/core/hooks/usePosthogTracking.test.tsx
@@ -0,0 +1,76 @@
+import { ReactNode } from "react";
+import { renderHook, waitFor } from "@testing-library/react";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+
+const posthogState = vi.hoisted(() => ({ loaded: false }));
+const posthogMock = vi.hoisted(() => ({
+  get __loaded() {
+    return posthogState.loaded;
+  },
+  init: vi.fn(() => {
+    posthogState.loaded = true;
+  }),
+  opt_out_capturing: vi.fn(),
+  opt_in_capturing: vi.fn(),
+  set_config: vi.fn(),
+  has_opted_in_capturing: vi.fn(() => false),
+}));
+
+vi.mock("posthog-js", () => ({
+  default: posthogMock,
+}));
+
+import { usePosthogTracking } from "@app/hooks/usePosthogTracking";
+
+describe("usePosthogTracking", () => {
+  beforeEach(() => {
+    posthogState.loaded = false;
+    posthogMock.init.mockClear();
+    posthogMock.opt_out_capturing.mockClear();
+    posthogMock.opt_in_capturing.mockClear();
+    posthogMock.set_config.mockClear();
+    vi.stubEnv("VITE_PUBLIC_POSTHOG_KEY", "test-key");
+    vi.stubEnv("VITE_PUBLIC_POSTHOG_HOST", "https://eu.i.posthog.com");
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("does not initialize PostHog when analytics is disabled", async () => {
+    const wrapper = ({ children }: { children: ReactNode }) => (
+      <AppConfigProvider
+        initialConfig={{ enableAnalytics: false }}
+        bootstrapMode="non-blocking"
+        autoFetch={false}
+      >
+        {children}
+      </AppConfigProvider>
+    );
+
+    renderHook(() => usePosthogTracking(), { wrapper });
+
+    await waitFor(() => {
+      expect(posthogMock.init).not.toHaveBeenCalled();
+    });
+  });
+
+  it("initializes PostHog when analytics is enabled", async () => {
+    const wrapper = ({ children }: { children: ReactNode }) => (
+      <AppConfigProvider
+        initialConfig={{ enableAnalytics: true }}
+        bootstrapMode="non-blocking"
+        autoFetch={false}
+      >
+        {children}
+      </AppConfigProvider>
+    );
+
+    renderHook(() => usePosthogTracking(), { wrapper });
+
+    await waitFor(() => {
+      expect(posthogMock.init).toHaveBeenCalledTimes(1);
+    });
+  });
+});
diff --git a/frontend/editor/src/core/hooks/usePosthogTracking.ts b/frontend/editor/src/core/hooks/usePosthogTracking.ts
new file mode 100644
index 0000000000..a8037ec4a7
--- /dev/null
+++ b/frontend/editor/src/core/hooks/usePosthogTracking.ts
@@ -0,0 +1,83 @@
+import { useEffect } from "react";
+import posthog from "posthog-js";
+import { useAppConfig } from "@app/contexts/AppConfigContext";
+
+function applyPosthogConsent(): void {
+  if (typeof window === "undefined" || !posthog.__loaded) {
+    return;
+  }
+
+  const optedIn =
+    window.CookieConsent?.acceptedService?.("posthog", "analytics") || false;
+
+  if (optedIn) {
+    posthog.set_config({ persistence: "localStorage+cookie" });
+    posthog.opt_in_capturing();
+    return;
+  }
+
+  posthog.opt_out_capturing();
+  posthog.set_config({ persistence: "memory" });
+}
+
+function ensurePosthogInitialized(): boolean {
+  if (typeof window === "undefined") {
+    return false;
+  }
+
+  const posthogKey = import.meta.env.VITE_PUBLIC_POSTHOG_KEY;
+  const posthogHost = import.meta.env.VITE_PUBLIC_POSTHOG_HOST;
+
+  if (!posthogKey || !posthogHost) {
+    return false;
+  }
+
+  if (!posthog.__loaded) {
+    posthog.init(posthogKey, {
+      api_host: posthogHost,
+      defaults: "2025-05-24",
+      capture_exceptions: true,
+      debug: false,
+      opt_out_capturing_by_default: true,
+      persistence: "memory",
+      cross_subdomain_cookie: false,
+    });
+  }
+
+  return true;
+}
+
+export function usePosthogTracking(): void {
+  const { config } = useAppConfig();
+
+  useEffect(() => {
+    const analyticsEnabled = config?.enableAnalytics === true;
+    const posthogEnabled = analyticsEnabled && config?.enablePosthog !== false;
+
+    if (!posthogEnabled) {
+      if (posthog.__loaded) {
+        posthog.opt_out_capturing();
+        posthog.set_config({ persistence: "memory" });
+      }
+      return;
+    }
+
+    if (!ensurePosthogInitialized()) {
+      return;
+    }
+
+    applyPosthogConsent();
+
+    const handleConsentChange = () => {
+      applyPosthogConsent();
+    };
+
+    window.addEventListener("cc:onConsent", handleConsentChange);
+    window.addEventListener("cc:onChange", handleConsentChange);
+
+    return () => {
+      window.removeEventListener("cc:onConsent", handleConsentChange);
+      window.removeEventListener("cc:onChange", handleConsentChange);
+    };
+  }, [config?.enableAnalytics, config?.enablePosthog]);
+}
diff --git a/frontend/editor/src/index.tsx b/frontend/editor/src/index.tsx
index 017138cebc..d776918bd1 100644
--- a/frontend/editor/src/index.tsx
+++ b/frontend/editor/src/index.tsx
@@ -13,8 +13,6 @@ import { ColorSchemeScript } from "@mantine/core";
 import { BrowserRouter } from "react-router-dom";
 import App from "@app/App";
 import "@app/i18n"; // Initialize i18next
-import posthog from "posthog-js";
-import { PostHogProvider } from "@posthog/react";
 import { BASE_PATH } from "@app/constants/app";
 
 import { startEagerWasmCompilation } from "@app/services/wasmPrecompiler";
@@ -35,33 +33,6 @@ if (typeof window !== "undefined") {
   }
 }
 
-posthog.init(import.meta.env.VITE_PUBLIC_POSTHOG_KEY, {
-  api_host: import.meta.env.VITE_PUBLIC_POSTHOG_HOST,
-  defaults: "2025-05-24",
-  capture_exceptions: true, // This enables capturing exceptions using Error Tracking, set to false if you don't want this
-  debug: false,
-  opt_out_capturing_by_default: true, // Opt-out by default, controlled by cookie consent
-  persistence: "memory", // No cookies/localStorage written until user opts in
-  cross_subdomain_cookie: false,
-});
-
-function updatePosthogConsent() {
-  if (!posthog.__loaded) return;
-  const optIn =
-    window.CookieConsent?.acceptedService?.("posthog", "analytics") || false;
-  if (optIn) {
-    posthog.set_config({ persistence: "localStorage+cookie" });
-    posthog.opt_in_capturing();
-  } else {
-    posthog.opt_out_capturing();
-    posthog.set_config({ persistence: "memory" });
-  }
-  console.log("Updated PostHog consent: ", optIn ? "opted in" : "opted out");
-}
-
-window.addEventListener("cc:onConsent", updatePosthogConsent);
-window.addEventListener("cc:onChange", updatePosthogConsent);
-
 const container = document.getElementById("root");
 if (!container) {
   throw new Error("Root container missing in index.html");
@@ -71,10 +42,8 @@ const root = ReactDOM.createRoot(container); // Finds the root DOM element
 root.render(
   <React.StrictMode>
     <ColorSchemeScript />
-    <PostHogProvider client={posthog}>
-      <BrowserRouter basename={BASE_PATH}>
-        <App />
-      </BrowserRouter>
-    </PostHogProvider>
+    <BrowserRouter basename={BASE_PATH}>
+      <App />
+    </BrowserRouter>
   </React.StrictMode>,
 );

From 1b7ffcdbac721b754414d8a7ee390327d2058a9e Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Mon, 6 Jul 2026 10:22:41 +0100
Subject: [PATCH 004/109] Fix tooltip positioning on Add Page Numbers (#6885)

# Description of Changes
## Before

<img width="483" height="227" alt="image"
src="https://github.com/user-attachments/assets/4bf86eec-a9cc-4f63-84f0-4eb2bd535bab"
/>

## After

<img width="732" height="235" alt="image"
src="https://github.com/user-attachments/assets/101d2ea4-36e8-4e8f-990a-d72b33fa0ac2"
/>
---
 .../addPageNumbers/AddPageNumbersAppearanceSettings.tsx      | 5 +++++
 .../tools/addPageNumbers/AddPageNumbersPositionSettings.tsx  | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersAppearanceSettings.tsx b/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersAppearanceSettings.tsx
index 627f7c1b9e..11ca767bca 100644
--- a/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersAppearanceSettings.tsx
+++ b/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersAppearanceSettings.tsx
@@ -27,6 +27,7 @@ const AddPageNumbersAppearanceSettings = ({
   return (
     <Stack gap="md">
       <Tooltip
+        position="left"
         content={t(
           "marginTooltip",
           "Distance between the page number and the edge of the page.",
@@ -56,6 +57,7 @@ const AddPageNumbersAppearanceSettings = ({
       </Tooltip>
 
       <Tooltip
+        position="left"
         content={t(
           "fontSizeTooltip",
           "Size of the page number text in points. Larger numbers create bigger text.",
@@ -73,6 +75,7 @@ const AddPageNumbersAppearanceSettings = ({
       </Tooltip>
 
       <Tooltip
+        position="left"
         content={t(
           "addPageNumbers.zeroPadTooltip",
           "Zero-pad (Bates Stamp) page numbers to this width (e.g. 3 => 001). Set 0 to disable.",
@@ -90,6 +93,7 @@ const AddPageNumbersAppearanceSettings = ({
       </Tooltip>
 
       <Tooltip
+        position="left"
         content={t(
           "fontTypeTooltip",
           "Font family for the page numbers. Choose based on your document style.",
@@ -118,6 +122,7 @@ const AddPageNumbersAppearanceSettings = ({
       </Tooltip>
 
       <Tooltip
+        position="left"
         content={t(
           "customTextTooltip",
           'Optional custom format for page numbers. Use {n} as placeholder for the number. Example: "Page {n}" will show "Page 1", "Page 2", etc.',
diff --git a/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersPositionSettings.tsx b/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersPositionSettings.tsx
index 735eda3e1c..b4b08e49c9 100644
--- a/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersPositionSettings.tsx
+++ b/frontend/editor/src/core/components/tools/addPageNumbers/AddPageNumbersPositionSettings.tsx
@@ -49,6 +49,7 @@ const AddPageNumbersPositionSettings = ({
         </Text>
 
         <Tooltip
+          position="left"
           content={t(
             "pageSelectionPrompt",
             "Custom Page Selection (Enter a comma-separated list of page numbers 1,5,6 or Functions like 2n+1)",
@@ -69,6 +70,7 @@ const AddPageNumbersPositionSettings = ({
         </Tooltip>
 
         <Tooltip
+          position="left"
           content={t(
             "startingNumberTooltip",
             "The first number to display. Subsequent pages will increment from this number.",

From cca3f426236f53cb8f3d823add957b9b4783ed04 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Tue, 7 Jul 2026 10:37:35 +0100
Subject: [PATCH 005/109] Set App version to v2.14.1 (#6891)

Upped version in build.gradle then ran build so version falls through
---
 .github/aur/stirling-pdf-desktop/PKGBUILD                       | 2 +-
 .github/aur/stirling-pdf-server-bin/PKGBUILD                    | 2 +-
 build.gradle                                                    | 2 +-
 frontend/editor/src-tauri/tauri.conf.json                       | 2 +-
 frontend/editor/src/core/testing/serverExperienceSimulations.ts | 2 +-
 .../src/proprietary/testing/serverExperienceSimulations.ts      | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/aur/stirling-pdf-desktop/PKGBUILD b/.github/aur/stirling-pdf-desktop/PKGBUILD
index c02bde345e..5d92425b19 100644
--- a/.github/aur/stirling-pdf-desktop/PKGBUILD
+++ b/.github/aur/stirling-pdf-desktop/PKGBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.14.0
+pkgver=2.14.1
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')
diff --git a/.github/aur/stirling-pdf-server-bin/PKGBUILD b/.github/aur/stirling-pdf-server-bin/PKGBUILD
index c73b1c5087..f5a2bf3c6c 100644
--- a/.github/aur/stirling-pdf-server-bin/PKGBUILD
+++ b/.github/aur/stirling-pdf-server-bin/PKGBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.14.0
+pkgver=2.14.1
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')
diff --git a/build.gradle b/build.gradle
index 3946b32449..5c89fd7af2 100644
--- a/build.gradle
+++ b/build.gradle
@@ -91,7 +91,7 @@ springBoot {
 
 allprojects {
     group = 'stirling.software'
-    version = '2.14.0'
+    version = '2.14.1'
 
     configurations.configureEach {
         exclude group: "org.springframework.boot", module: "spring-boot-starter-tomcat"
diff --git a/frontend/editor/src-tauri/tauri.conf.json b/frontend/editor/src-tauri/tauri.conf.json
index 87f3a48a1d..6cfe33cbe6 100644
--- a/frontend/editor/src-tauri/tauri.conf.json
+++ b/frontend/editor/src-tauri/tauri.conf.json
@@ -2,7 +2,7 @@
   "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
   "productName": "Stirling PDF",
   "mainBinaryName": "Stirling-PDF",
-  "version": "2.14.0",
+  "version": "2.14.1",
   "identifier": "stirling.pdf.dev",
   "build": {
     "frontendDist": "../dist",
diff --git a/frontend/editor/src/core/testing/serverExperienceSimulations.ts b/frontend/editor/src/core/testing/serverExperienceSimulations.ts
index 09344f9234..cd7ed8f2ba 100644
--- a/frontend/editor/src/core/testing/serverExperienceSimulations.ts
+++ b/frontend/editor/src/core/testing/serverExperienceSimulations.ts
@@ -38,7 +38,7 @@ const FREE_LICENSE_INFO: LicenseInfo = {
 
 const BASE_NO_LOGIN_CONFIG: AppConfig = {
   enableAnalytics: true,
-  appVersion: "2.14.0",
+  appVersion: "2.14.1",
   serverCertificateEnabled: false,
   enableAlphaFunctionality: false,
   serverPort: 8080,
diff --git a/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts b/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts
index 50bf5eb230..1aaabfeb33 100644
--- a/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts
+++ b/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts
@@ -48,7 +48,7 @@ const FREE_LICENSE_INFO: LicenseInfo = {
 
 const BASE_NO_LOGIN_CONFIG: AppConfig = {
   enableAnalytics: true,
-  appVersion: "2.14.0",
+  appVersion: "2.14.1",
   serverCertificateEnabled: false,
   enableAlphaFunctionality: false,
   enableDesktopInstallSlide: true,

From 8535c7e9aced4e050d3f660edd13319eba1a06a4 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:57:34 +0200
Subject: [PATCH 006/109] feat(ui): add dedicated third-party license sections
 to settings (#6820)

---
 .../public/locales/en-US/translation.toml     |  15 +
 frontend/editor/public/og-metadata.json       |  12 +
 .../editor/src/assets/3rdPartyLicenses.json   | 347 ++++++++++++++----
 .../shared/config/configNavSections.tsx       |  16 +
 .../ThirdPartyLicensesSection.tsx             | 235 ++++++++++++
 .../core/components/shared/config/types.ts    |   2 +
 6 files changed, 555 insertions(+), 72 deletions(-)
 create mode 100644 frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 7f81e56f3b..bd5b20bcf6 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6934,6 +6934,21 @@ manage = "Manage"
 description = "Policies and legal information for this service."
 title = "Legal Documents"
 
+[settings.licenses]
+backendDescription = "Licenses for backend dependencies bundled with this server."
+backendLabel = "Backend Licenses"
+backendTitle = "Backend 3rd Party Licenses"
+empty = "No dependencies found."
+frontendDescription = "Licenses for frontend dependencies bundled into the release build."
+frontendLabel = "Frontend Licenses"
+frontendTitle = "Frontend 3rd Party Licenses"
+license = "License"
+listDescription = "The list is shown directly in the UI from the release bundle or backend endpoint."
+listTitle = "Bundled dependencies"
+loadError = "Failed to load third-party licenses"
+module = "Module"
+version = "Version"
+
 [settings.licensingAnalytics]
 audit = "Audit"
 plan = "Plan"
diff --git a/frontend/editor/public/og-metadata.json b/frontend/editor/public/og-metadata.json
index e8aded59d2..65f1da789c 100644
--- a/frontend/editor/public/og-metadata.json
+++ b/frontend/editor/public/og-metadata.json
@@ -485,6 +485,16 @@
       "title": "Legal Settings - Stirling PDF",
       "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
     },
+    "/settings/backendThirdPartyLicenses": {
+      "image": "/og_images/home.png",
+      "title": "Backend Third Party Licenses Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/frontendThirdPartyLicenses": {
+      "image": "/og_images/home.png",
+      "title": "Frontend Third Party Licenses Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
     "/settings/payg": {
       "image": "/og_images/home.png",
       "title": "Payg Settings - Stirling PDF",
@@ -641,6 +651,8 @@
     "/settings/adminMcp": "/settings/adminMcp",
     "/settings/help": "/settings/help",
     "/settings/legal": "/settings/legal",
+    "/settings/backendThirdPartyLicenses": "/settings/backendThirdPartyLicenses",
+    "/settings/frontendThirdPartyLicenses": "/settings/frontendThirdPartyLicenses",
     "/settings/payg": "/settings/payg"
   }
 }
diff --git a/frontend/editor/src/assets/3rdPartyLicenses.json b/frontend/editor/src/assets/3rdPartyLicenses.json
index baf60879b6..3b606376de 100644
--- a/frontend/editor/src/assets/3rdPartyLicenses.json
+++ b/frontend/editor/src/assets/3rdPartyLicenses.json
@@ -3,133 +3,182 @@
     {
       "moduleName": "@atlaskit/pragmatic-drag-and-drop",
       "moduleUrl": "git+https://github.com/atlassian/pragmatic-drag-and-drop.git",
-      "moduleVersion": "1.7.7",
+      "moduleVersion": "1.7.9",
       "moduleLicense": "Apache-2.0",
       "moduleLicenseUrl": "git+https://github.com/atlassian/pragmatic-drag-and-drop.git"
     },
     {
-      "moduleName": "@embedpdf/core",
-      "moduleUrl": "https://registry.npmjs.org/@embedpdf/core/-/core-1.3.1.tgz",
-      "moduleVersion": "1.3.0",
+      "moduleName": "@cantoo/pdf-lib",
+      "moduleUrl": "git+https://github.com/cantoo-scribe/pdf-lib.git",
+      "moduleVersion": "2.6.5",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "https://registry.npmjs.org/@embedpdf/core/-/core-1.3.1.tgz"
+      "moduleLicenseUrl": "git+https://github.com/cantoo-scribe/pdf-lib.git"
+    },
+    {
+      "moduleName": "@dnd-kit/core",
+      "moduleUrl": "git+https://github.com/clauderic/dnd-kit.git",
+      "moduleVersion": "6.3.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/clauderic/dnd-kit.git"
+    },
+    {
+      "moduleName": "@embedpdf/core",
+      "moduleUrl": "https://registry.npmjs.org/@embedpdf/core/-/core-2.14.4.tgz",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://registry.npmjs.org/@embedpdf/core/-/core-2.14.4.tgz"
     },
     {
       "moduleName": "@embedpdf/engines",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/models",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-annotation",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/plugin-attachment",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/plugin-bookmark",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/plugin-document-manager",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-export",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-history",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-interaction-manager",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
-      "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
-    },
-    {
-      "moduleName": "@embedpdf/plugin-loader",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-pan",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/plugin-print",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+    },
+    {
+      "moduleName": "@embedpdf/plugin-redaction",
+      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-render",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-rotate",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-scroll",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-search",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-selection",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-spread",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-thumbnail",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-tiling",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-viewport",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
     {
       "moduleName": "@embedpdf/plugin-zoom",
       "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
-      "moduleVersion": "1.3.0",
+      "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
     },
@@ -157,94 +206,185 @@
     {
       "moduleName": "@mantine/core",
       "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
-      "moduleVersion": "8.3.1",
+      "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
     },
     {
       "moduleName": "@mantine/dates",
       "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
-      "moduleVersion": "8.3.1",
+      "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
     },
     {
       "moduleName": "@mantine/dropzone",
       "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
-      "moduleVersion": "8.3.1",
+      "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
     },
     {
       "moduleName": "@mantine/hooks",
       "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
-      "moduleVersion": "8.3.1",
+      "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
     },
     {
       "moduleName": "@mui/icons-material",
       "moduleUrl": "git+https://github.com/mui/material-ui.git",
-      "moduleVersion": "7.3.2",
+      "moduleVersion": "9.0.0",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mui/material-ui.git"
     },
     {
       "moduleName": "@mui/material",
       "moduleUrl": "git+https://github.com/mui/material-ui.git",
-      "moduleVersion": "7.3.2",
+      "moduleVersion": "9.0.0",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/mui/material-ui.git"
     },
     {
-      "moduleName": "@tailwindcss/postcss",
-      "moduleUrl": "git+https://github.com/tailwindlabs/tailwindcss.git",
-      "moduleVersion": "4.1.13",
+      "moduleName": "@posthog/react",
+      "moduleUrl": "git+https://github.com/PostHog/posthog-js.git",
+      "moduleVersion": "1.8.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/tailwindlabs/tailwindcss.git"
+      "moduleLicenseUrl": "git+https://github.com/PostHog/posthog-js.git"
+    },
+    {
+      "moduleName": "@reactour/tour",
+      "moduleUrl": "git+https://github.com/elrumordelaluz/reactour.git",
+      "moduleVersion": "3.8.0",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/elrumordelaluz/reactour.git"
+    },
+    {
+      "moduleName": "@stripe/react-stripe-js",
+      "moduleUrl": "https://github.com/stripe/react-stripe-js.git",
+      "moduleVersion": "4.0.2",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://github.com/stripe/react-stripe-js.git"
+    },
+    {
+      "moduleName": "@stripe/stripe-js",
+      "moduleUrl": "https://github.com/stripe/stripe-js.git",
+      "moduleVersion": "7.9.0",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://github.com/stripe/stripe-js.git"
+    },
+    {
+      "moduleName": "@supabase/supabase-js",
+      "moduleUrl": "https://github.com/supabase/supabase-js.git",
+      "moduleVersion": "2.100.0",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://github.com/supabase/supabase-js.git"
+    },
+    {
+      "moduleName": "@tailwindcss/postcss",
+      "moduleUrl": "https://github.com/tailwindlabs/tailwindcss.git",
+      "moduleVersion": "4.2.2",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://github.com/tailwindlabs/tailwindcss.git"
     },
     {
       "moduleName": "@tanstack/react-virtual",
       "moduleUrl": "git+https://github.com/TanStack/virtual.git",
-      "moduleVersion": "3.13.12",
+      "moduleVersion": "3.13.23",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/TanStack/virtual.git"
     },
+    {
+      "moduleName": "@tauri-apps/api",
+      "moduleUrl": "git+https://github.com/tauri-apps/tauri.git",
+      "moduleVersion": "2.10.1",
+      "moduleLicense": "Apache-2.0 OR MIT",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/tauri.git"
+    },
+    {
+      "moduleName": "@tauri-apps/plugin-dialog",
+      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleVersion": "2.7.0",
+      "moduleLicense": "MIT OR Apache-2.0",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+    },
+    {
+      "moduleName": "@tauri-apps/plugin-fs",
+      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleVersion": "2.5.0",
+      "moduleLicense": "MIT OR Apache-2.0",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+    },
+    {
+      "moduleName": "@tauri-apps/plugin-http",
+      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleVersion": "2.5.7",
+      "moduleLicense": "MIT OR Apache-2.0",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+    },
+    {
+      "moduleName": "@tauri-apps/plugin-notification",
+      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleVersion": "2.3.3",
+      "moduleLicense": "MIT OR Apache-2.0",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+    },
+    {
+      "moduleName": "@tauri-apps/plugin-shell",
+      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleVersion": "2.3.5",
+      "moduleLicense": "MIT OR Apache-2.0",
+      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+    },
+    {
+      "moduleName": "@userback/widget",
+      "moduleUrl": "git+https://github.com/userback/widget-js.git",
+      "moduleVersion": "0.3.12",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/userback/widget-js.git"
+    },
     {
       "moduleName": "autoprefixer",
       "moduleUrl": "git+https://github.com/postcss/autoprefixer.git",
-      "moduleVersion": "10.4.21",
+      "moduleVersion": "10.4.27",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/postcss/autoprefixer.git"
     },
     {
       "moduleName": "axios",
       "moduleUrl": "git+https://github.com/axios/axios.git",
-      "moduleVersion": "1.12.2",
+      "moduleVersion": "1.15.0",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/axios/axios.git"
     },
+    {
+      "moduleName": "d3",
+      "moduleUrl": "git+https://github.com/d3/d3.git",
+      "moduleVersion": "7.9.0",
+      "moduleLicense": "ISC",
+      "moduleLicenseUrl": "git+https://github.com/d3/d3.git"
+    },
+    {
+      "moduleName": "globals",
+      "moduleUrl": "git+https://github.com/sindresorhus/globals.git",
+      "moduleVersion": "17.5.0",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/sindresorhus/globals.git"
+    },
     {
       "moduleName": "i18next",
       "moduleUrl": "git+https://github.com/i18next/i18next.git",
-      "moduleVersion": "25.5.2",
+      "moduleVersion": "25.10.10",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/i18next/i18next.git"
     },
     {
       "moduleName": "i18next-browser-languagedetector",
       "moduleUrl": "git+https://github.com/i18next/i18next-browser-languageDetector.git",
-      "moduleVersion": "8.2.0",
+      "moduleVersion": "8.2.1",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/i18next/i18next-browser-languageDetector.git"
     },
-    {
-      "moduleName": "i18next-http-backend",
-      "moduleUrl": "git+ssh://git@github.com/i18next/i18next-http-backend.git",
-      "moduleVersion": "3.0.2",
-      "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+ssh://git@github.com/i18next/i18next-http-backend.git"
-    },
     {
       "moduleName": "jszip",
       "moduleUrl": "git+https://github.com/Stuk/jszip.git",
@@ -254,66 +394,129 @@
     },
     {
       "moduleName": "license-report",
-      "moduleUrl": "git+https://github.com/kessler/license-report.git",
-      "moduleVersion": "6.8.0",
+      "moduleUrl": "git+https://github.com/bepo65/license-report.git",
+      "moduleVersion": "6.8.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/kessler/license-report.git"
-    },
-    {
-      "moduleName": "pdf-lib",
-      "moduleUrl": "git+https://github.com/Hopding/pdf-lib.git",
-      "moduleVersion": "1.17.1",
-      "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/Hopding/pdf-lib.git"
+      "moduleLicenseUrl": "git+https://github.com/bepo65/license-report.git"
     },
     {
       "moduleName": "pdfjs-dist",
       "moduleUrl": "git+https://github.com/mozilla/pdf.js.git",
-      "moduleVersion": "5.4.149",
+      "moduleVersion": "5.5.207",
       "moduleLicense": "Apache-2.0",
       "moduleLicenseUrl": "git+https://github.com/mozilla/pdf.js.git"
     },
+    {
+      "moduleName": "peerjs",
+      "moduleUrl": "git+https://github.com/peers/peerjs.git",
+      "moduleVersion": "1.5.5",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/peers/peerjs.git"
+    },
+    {
+      "moduleName": "pixelmatch",
+      "moduleUrl": "git+https://github.com/mapbox/pixelmatch.git",
+      "moduleVersion": "7.1.0",
+      "moduleLicense": "ISC",
+      "moduleLicenseUrl": "git+https://github.com/mapbox/pixelmatch.git"
+    },
     {
       "moduleName": "posthog-js",
-      "moduleUrl": "git+https://github.com/PostHog/posthog-js.git",
-      "moduleVersion": "1.268.0",
+      "moduleUrl": "https://github.com/PostHog/posthog-js",
+      "moduleVersion": "1.363.3",
       "moduleLicense": "SEE LICENSE IN LICENSE https://github.com/PostHog/posthog-js/blob/main/LICENSE",
-      "moduleLicenseUrl": "git+https://github.com/PostHog/posthog-js.git"
+      "moduleLicenseUrl": "https://github.com/PostHog/posthog-js"
+    },
+    {
+      "moduleName": "qrcode.react",
+      "moduleUrl": "git+https://github.com/zpao/qrcode.react.git",
+      "moduleVersion": "4.2.0",
+      "moduleLicense": "ISC",
+      "moduleLicenseUrl": "git+https://github.com/zpao/qrcode.react.git"
     },
     {
       "moduleName": "react",
       "moduleUrl": "git+https://github.com/facebook/react.git",
-      "moduleVersion": "19.1.1",
+      "moduleVersion": "19.2.4",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/facebook/react.git"
     },
     {
       "moduleName": "react-dom",
       "moduleUrl": "git+https://github.com/facebook/react.git",
-      "moduleVersion": "19.1.1",
+      "moduleVersion": "19.2.4",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/facebook/react.git"
     },
+    {
+      "moduleName": "react-easy-crop",
+      "moduleUrl": "git+https://github.com/ValentinH/react-easy-crop.git",
+      "moduleVersion": "5.5.6",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/ValentinH/react-easy-crop.git"
+    },
     {
       "moduleName": "react-i18next",
       "moduleUrl": "git+https://github.com/i18next/react-i18next.git",
-      "moduleVersion": "15.7.3",
+      "moduleVersion": "16.6.6",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/i18next/react-i18next.git"
     },
+    {
+      "moduleName": "react-markdown",
+      "moduleUrl": "git+https://github.com/remarkjs/react-markdown.git",
+      "moduleVersion": "9.1.0",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/remarkjs/react-markdown.git"
+    },
+    {
+      "moduleName": "react-rnd",
+      "moduleUrl": "git+https://github.com/bokuweb/react-rnd.git",
+      "moduleVersion": "10.5.3",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/bokuweb/react-rnd.git"
+    },
     {
       "moduleName": "react-router-dom",
       "moduleUrl": "git+https://github.com/remix-run/react-router.git",
-      "moduleVersion": "7.9.1",
+      "moduleVersion": "7.13.2",
       "moduleLicense": "MIT",
       "moduleLicenseUrl": "git+https://github.com/remix-run/react-router.git"
     },
     {
-      "moduleName": "tailwindcss",
-      "moduleUrl": "git+https://github.com/tailwindlabs/tailwindcss.git",
-      "moduleVersion": "4.1.13",
+      "moduleName": "recharts",
+      "moduleUrl": "git+https://github.com/recharts/recharts.git",
+      "moduleVersion": "3.8.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/tailwindlabs/tailwindcss.git"
+      "moduleLicenseUrl": "git+https://github.com/recharts/recharts.git"
+    },
+    {
+      "moduleName": "remark-gfm",
+      "moduleUrl": "git+https://github.com/remarkjs/remark-gfm.git",
+      "moduleVersion": "4.0.1",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/remarkjs/remark-gfm.git"
+    },
+    {
+      "moduleName": "signature_pad",
+      "moduleUrl": "git+https://github.com/szimek/signature_pad.git",
+      "moduleVersion": "5.1.3",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "git+https://github.com/szimek/signature_pad.git"
+    },
+    {
+      "moduleName": "smol-toml",
+      "moduleUrl": "github:squirrelchat/smol-toml",
+      "moduleVersion": "1.6.1",
+      "moduleLicense": "BSD-3-Clause",
+      "moduleLicenseUrl": "github:squirrelchat/smol-toml"
+    },
+    {
+      "moduleName": "tailwindcss",
+      "moduleUrl": "https://github.com/tailwindlabs/tailwindcss.git",
+      "moduleVersion": "4.2.2",
+      "moduleLicense": "MIT",
+      "moduleLicenseUrl": "https://github.com/tailwindlabs/tailwindcss.git"
     },
     {
       "moduleName": "web-vitals",
diff --git a/frontend/editor/src/core/components/shared/config/configNavSections.tsx b/frontend/editor/src/core/components/shared/config/configNavSections.tsx
index 260cbe970a..db02ad8458 100644
--- a/frontend/editor/src/core/components/shared/config/configNavSections.tsx
+++ b/frontend/editor/src/core/components/shared/config/configNavSections.tsx
@@ -5,6 +5,10 @@ import HotkeysSection from "@app/components/shared/config/configSections/Hotkeys
 import GeneralSection from "@app/components/shared/config/configSections/GeneralSection";
 import HelpSection from "@app/components/shared/config/configSections/HelpSection";
 import LegalSection from "@app/components/shared/config/configSections/LegalSection";
+import {
+  BackendThirdPartyLicensesSection,
+  FrontendThirdPartyLicensesSection,
+} from "@app/components/shared/config/configSections/ThirdPartyLicensesSection";
 
 export interface ConfigNavItem {
   key: NavKey;
@@ -80,6 +84,18 @@ export const useConfigNavSections = (
           icon: "gavel-rounded",
           component: <LegalSection />,
         },
+        {
+          key: "backendThirdPartyLicenses",
+          label: t("settings.licenses.backendLabel", "Backend Licenses"),
+          icon: "article-rounded",
+          component: <BackendThirdPartyLicensesSection />,
+        },
+        {
+          key: "frontendThirdPartyLicenses",
+          label: t("settings.licenses.frontendLabel", "Frontend Licenses"),
+          icon: "code-rounded",
+          component: <FrontendThirdPartyLicensesSection />,
+        },
       ],
     },
   ];
diff --git a/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx
new file mode 100644
index 0000000000..5d0de982fc
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx
@@ -0,0 +1,235 @@
+import { useEffect, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+  Alert,
+  Anchor,
+  Group,
+  Loader,
+  Paper,
+  Stack,
+  Table,
+  Text,
+} from "@mantine/core";
+import { isAxiosError } from "axios";
+import apiClient from "@app/services/apiClient";
+import frontendLicenses from "../../../../../assets/3rdPartyLicenses.json"; // eslint-disable-line no-restricted-imports -- asset lives outside @app alias root
+
+interface Dependency {
+  moduleName?: string;
+  moduleUrl?: string;
+  moduleVersion?: string;
+  moduleLicense?: string;
+  moduleLicenseUrl?: string;
+}
+
+interface LicensesResponse {
+  dependencies?: Dependency[];
+}
+
+interface LicensesSectionBodyProps {
+  title: string;
+  description: string;
+  dependencies: Dependency[];
+}
+
+function LicensesSectionBody({
+  title,
+  description,
+  dependencies,
+}: LicensesSectionBodyProps) {
+  const { t } = useTranslation();
+  const sortedDependencies = useMemo(
+    () =>
+      [...dependencies].sort((a, b) =>
+        (a.moduleName || "").localeCompare(b.moduleName || ""),
+      ),
+    [dependencies],
+  );
+
+  const getDependencyKey = (dependency: Dependency) =>
+    [
+      dependency.moduleName ?? "module",
+      dependency.moduleVersion ?? "version",
+      dependency.moduleUrl ?? "url",
+    ].join(":");
+
+  return (
+    <Stack gap="lg">
+      <Paper withBorder p="md" radius="md">
+        <Stack gap="md">
+          <div>
+            <Text fw={600} size="sm">
+              {title}
+            </Text>
+            <Text size="xs" c="dimmed" mt={4}>
+              {description}
+            </Text>
+          </div>
+
+          <Group justify="space-between" align="center">
+            <div>
+              <Text fw={600} size="sm">
+                {t("settings.licenses.listTitle", "Bundled dependencies")}
+              </Text>
+              <Text size="xs" c="dimmed" mt={4}>
+                {t(
+                  "settings.licenses.listDescription",
+                  "The list is shown directly in the UI from the release bundle or backend endpoint.",
+                )}
+              </Text>
+            </div>
+          </Group>
+
+          <Table
+            highlightOnHover
+            withRowBorders
+            verticalSpacing="sm"
+            horizontalSpacing="md"
+          >
+            <Table.Thead>
+              <Table.Tr>
+                <Table.Th>{t("settings.licenses.module", "Module")}</Table.Th>
+                <Table.Th>{t("settings.licenses.version", "Version")}</Table.Th>
+                <Table.Th>{t("settings.licenses.license", "License")}</Table.Th>
+              </Table.Tr>
+            </Table.Thead>
+            <Table.Tbody>
+              {sortedDependencies.length === 0 ? (
+                <Table.Tr>
+                  <Table.Td colSpan={3}>
+                    <Text ta="center" c="dimmed" py="xl">
+                      {t("settings.licenses.empty", "No dependencies found.")}
+                    </Text>
+                  </Table.Td>
+                </Table.Tr>
+              ) : (
+                sortedDependencies.map((dependency) => (
+                  <Table.Tr key={getDependencyKey(dependency)}>
+                    <Table.Td>
+                      {dependency.moduleUrl ? (
+                        <Anchor
+                          href={dependency.moduleUrl}
+                          target="_blank"
+                          rel="noopener noreferrer"
+                        >
+                          {dependency.moduleName || "-"}
+                        </Anchor>
+                      ) : (
+                        <Text size="sm">{dependency.moduleName || "-"}</Text>
+                      )}
+                    </Table.Td>
+                    <Table.Td>
+                      <Text size="sm" c="dimmed">
+                        {dependency.moduleVersion || "-"}
+                      </Text>
+                    </Table.Td>
+                    <Table.Td>
+                      {dependency.moduleLicenseUrl ? (
+                        <Anchor
+                          href={dependency.moduleLicenseUrl}
+                          target="_blank"
+                          rel="noopener noreferrer"
+                        >
+                          {dependency.moduleLicense || "-"}
+                        </Anchor>
+                      ) : (
+                        <Text size="sm">{dependency.moduleLicense || "-"}</Text>
+                      )}
+                    </Table.Td>
+                  </Table.Tr>
+                ))
+              )}
+            </Table.Tbody>
+          </Table>
+        </Stack>
+      </Paper>
+    </Stack>
+  );
+}
+
+export function BackendThirdPartyLicensesSection() {
+  const { t } = useTranslation();
+  const [dependencies, setDependencies] = useState<Dependency[]>([]);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    const loadLicenses = async () => {
+      try {
+        setLoading(true);
+        setError(null);
+        const response = await apiClient.get<LicensesResponse>(
+          "/api/v1/ui-data/licenses",
+          { suppressErrorToast: true },
+        );
+        setDependencies(response.data?.dependencies ?? []);
+      } catch (err: unknown) {
+        setError(
+          isAxiosError(err)
+            ? err.response?.data?.message || err.message
+            : t(
+                "settings.licenses.loadError",
+                "Failed to load third-party licenses",
+              ),
+        );
+      } finally {
+        setLoading(false);
+      }
+    };
+
+    void loadLicenses();
+  }, [t]);
+
+  if (loading) {
+    return (
+      <Stack align="center" justify="center" h={200}>
+        <Loader size="lg" />
+      </Stack>
+    );
+  }
+
+  if (error) {
+    return (
+      <Stack gap="lg">
+        <Alert color="red" title={t("admin.error", "Error")}>
+          {error}
+        </Alert>
+      </Stack>
+    );
+  }
+
+  return (
+    <LicensesSectionBody
+      title={t("settings.licenses.backendTitle", "Backend 3rd Party Licenses")}
+      description={t(
+        "settings.licenses.backendDescription",
+        "Licenses for backend dependencies bundled with this server.",
+      )}
+      dependencies={dependencies}
+    />
+  );
+}
+
+export function FrontendThirdPartyLicensesSection() {
+  const { t } = useTranslation();
+  const dependencies =
+    (frontendLicenses as LicensesResponse).dependencies ?? [];
+
+  return (
+    <LicensesSectionBody
+      title={t(
+        "settings.licenses.frontendTitle",
+        "Frontend 3rd Party Licenses",
+      )}
+      description={t(
+        "settings.licenses.frontendDescription",
+        "Licenses for frontend dependencies bundled into the release build.",
+      )}
+      dependencies={dependencies}
+    />
+  );
+}
+
+export default function ThirdPartyLicensesSection() {
+  return <BackendThirdPartyLicensesSection />;
+}
diff --git a/frontend/editor/src/core/components/shared/config/types.ts b/frontend/editor/src/core/components/shared/config/types.ts
index a71866d0c1..9fa87fe915 100644
--- a/frontend/editor/src/core/components/shared/config/types.ts
+++ b/frontend/editor/src/core/components/shared/config/types.ts
@@ -32,6 +32,8 @@ export const VALID_NAV_KEYS = [
   "adminMcp",
   "help",
   "legal",
+  "backendThirdPartyLicenses",
+  "frontendThirdPartyLicenses",
   "payg",
 ] as const;
 

From 01a1ef8c44448a08f67fa31231175af0df4194ee Mon Sep 17 00:00:00 2001
From: LFdev <146497073+LFd3v@users.noreply.github.com>
Date: Tue, 7 Jul 2026 17:58:21 -0300
Subject: [PATCH 007/109] Fix missing app icon on Linux/Wayland (#6875)

Co-authored-by: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Co-authored-by: Ludy <Ludy87@users.noreply.github.com>
---
 frontend/editor/src-tauri/stirling-pdf.desktop | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/frontend/editor/src-tauri/stirling-pdf.desktop b/frontend/editor/src-tauri/stirling-pdf.desktop
index e9e26a39c1..13da1b88c6 100644
--- a/frontend/editor/src-tauri/stirling-pdf.desktop
+++ b/frontend/editor/src-tauri/stirling-pdf.desktop
@@ -10,7 +10,8 @@ Terminal=false
 MimeType=application/pdf;
 Categories=Office;Graphics;Utility;
 Actions=open-file;
+StartupWMClass=Stirling-PDF
 
 [Desktop Action open-file]
 Name=Open PDF File
-Exec={{exec}} %F
\ No newline at end of file
+Exec={{exec}} %F

From 5fba2720f0a350fb395f3aa9741c828562aee2b8 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Tue, 7 Jul 2026 22:39:57 +0100
Subject: [PATCH 008/109] Fix cert sign not showing under certain instances
 (#6908)

---
 .../tests/stubbed/cert-sign-wizard.spec.ts    | 24 ++++++++++++++-----
 frontend/editor/src/core/tools/CertSign.tsx   | 22 +++++++++++++++++
 2 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts b/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
index 807e4231d4..17f9070a78 100644
--- a/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
+++ b/frontend/editor/src/core/tests/stubbed/cert-sign-wizard.spec.ts
@@ -59,7 +59,7 @@ async function mockHardwareEndpoints(page: Page) {
 }
 
 test.describe("CertSign tool - certificate source model", () => {
-  test("renders, accepts a PDF, and exposes the Upload source", async ({
+  test("skips the redundant source step and goes straight to certificate format when Upload is the only source", async ({
     page,
   }) => {
     await page.route("**/api/v1/security/cert-sign", (route) =>
@@ -76,10 +76,21 @@ test.describe("CertSign tool - certificate source model", () => {
     await uploadFiles(page, SAMPLE_PDF);
 
     await expect(page).toHaveURL(/\/cert-sign/);
-    // Source step always offers "Upload" (the former "Manual" mode).
+    // With no server cert or hardware token there is nothing to choose, so the
+    // whole "Certificate source" step is hidden and the format picker shows directly.
     await expect(
-      page.getByRole("button", { name: /^upload$/i }).first(),
-    ).toBeAttached({ timeout: 10_000 });
+      page.getByRole("button", { name: /pkcs12/i }).first(),
+    ).toBeVisible({ timeout: 10_000 });
+    await expect(page.getByText(/certificate source/i)).toHaveCount(0);
+    await expect(
+      page.getByText(/no other certificate sources are available/i),
+    ).toHaveCount(0);
+    await expect(
+      page.getByRole("button", { name: /this device/i }),
+    ).toHaveCount(0);
+    await expect(page.getByRole("button", { name: /^server$/i })).toHaveCount(
+      0,
+    );
   });
 
   test("does NOT offer 'This device' when not running as desktop", async ({
@@ -89,9 +100,10 @@ test.describe("CertSign tool - certificate source model", () => {
     await page.waitForLoadState("domcontentloaded");
     await uploadFiles(page, SAMPLE_PDF);
 
+    // No alternative sources: the source step is hidden, and hardware is never offered.
     await expect(
-      page.getByRole("button", { name: /^upload$/i }).first(),
-    ).toBeAttached({ timeout: 10_000 });
+      page.getByRole("button", { name: /pkcs12/i }).first(),
+    ).toBeVisible({ timeout: 10_000 });
     await expect(
       page.getByRole("button", { name: /this device/i }),
     ).toHaveCount(0);
diff --git a/frontend/editor/src/core/tools/CertSign.tsx b/frontend/editor/src/core/tools/CertSign.tsx
index dd0668a491..4f5173b174 100644
--- a/frontend/editor/src/core/tools/CertSign.tsx
+++ b/frontend/editor/src/core/tools/CertSign.tsx
@@ -1,5 +1,7 @@
+import { useEffect } from "react";
 import { useTranslation } from "react-i18next";
 import { createToolFlow } from "@app/components/tools/shared/createToolFlow";
+import { useAppConfig } from "@app/contexts/AppConfigContext";
 import CertificateTypeSettings from "@app/components/tools/certSign/CertificateTypeSettings";
 import CertificateFormatSettings from "@app/components/tools/certSign/CertificateFormatSettings";
 import CertificateFilesSettings from "@app/components/tools/certSign/CertificateFilesSettings";
@@ -23,6 +25,25 @@ const CertSign = (props: BaseToolProps) => {
     props,
   );
 
+  const { config } = useAppConfig();
+  // "Upload" is always available; the source chooser is only meaningful when a
+  // server certificate or a hardware token gives the user an actual alternative.
+  const hasCertSourceChoice =
+    (config?.serverCertificateEnabled ?? false) ||
+    (config?.hardwareSigningAvailable ?? false);
+
+  // With Upload as the only source, keep signMode on MANUAL even if a saved
+  // automation set AUTO/DEVICE, so the hidden source step can't strand the flow.
+  useEffect(() => {
+    if (!hasCertSourceChoice && base.params.parameters.signMode !== "MANUAL") {
+      base.params.updateParameter("signMode", "MANUAL");
+    }
+  }, [
+    hasCertSourceChoice,
+    base.params.parameters.signMode,
+    base.params.updateParameter,
+  ]);
+
   const certTypeTips = useCertificateTypeTips();
   const appearanceTips = useSignatureAppearanceTips();
   const signModeTips = useSignModeTips();
@@ -63,6 +84,7 @@ const CertSign = (props: BaseToolProps) => {
     steps: [
       {
         title: t("certSign.source.stepTitle", "Certificate source"),
+        isVisible: hasCertSourceChoice,
         isCollapsed: base.settingsCollapsed,
         onCollapsedClick: base.settingsCollapsed
           ? base.handleSettingsReset

From 72729e99c1294e41dda5ddaf9cf72bd975337d89 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 1 Jul 2026 01:02:38 +0100
Subject: [PATCH 009/109] fix(release): stop msiexec hang in Windows signature
 verify; don't force latest or regen release notes

---
 .github/workflows/multiOSReleases.yml | 29 +++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml
index f5fb743a3f..3a76708460 100644
--- a/.github/workflows/multiOSReleases.yml
+++ b/.github/workflows/multiOSReleases.yml
@@ -510,6 +510,7 @@ jobs:
       # cargo output unsigned, so checking it produces false negatives.
       - name: Verify Windows Code Signature
         if: ${{ matrix.platform == 'windows-latest' && env.SM_API_KEY != '' && (github.event_name == 'release' || (github.event_name == 'workflow_dispatch' && github.event.inputs.sign != 'false') || github.ref == 'refs/heads/V2-master') }}
+        timeout-minutes: 15
         shell: pwsh
         run: |
           $allSigned = $true
@@ -531,11 +532,26 @@ jobs:
 
           # Extract MSI and verify the inner exe (the file that actually gets installed).
           # This is the critical check - AV flags the installed exe at runtime.
+          # Use lessmsi, not `msiexec /a`: msiexec serializes on the global
+          # _MSIExecute mutex and hangs forever on hosted runners when another
+          # installer is busy. lessmsi reads MSI tables directly - no mutex, no service.
           $msi = $msiFiles[0].FullName
           $extractDir = Join-Path $env:RUNNER_TEMP "msi-verify"
           if (Test-Path $extractDir) { Remove-Item $extractDir -Recurse -Force }
-          $proc = Start-Process msiexec.exe -ArgumentList '/a', $msi, '/qn', "TARGETDIR=$extractDir" -Wait -PassThru -NoNewWindow
-          if ($proc.ExitCode -eq 0) {
+          New-Item -ItemType Directory -Force -Path $extractDir | Out-Null
+
+          choco install lessmsi -y --no-progress --limit-output | Out-Null
+
+          # Bound the extraction and kill on hang (defence in depth over timeout-minutes).
+          $proc = Start-Process lessmsi -ArgumentList 'x', "`"$msi`"", "`"$extractDir\`"" -PassThru -NoNewWindow
+          if (-not $proc.WaitForExit(120000)) {
+            try { $proc.Kill() } catch {}
+            Write-Host "[ERROR] MSI extraction timed out after 120s"
+            $allSigned = $false
+          } elseif ($proc.ExitCode -ne 0) {
+            Write-Host "[ERROR] Failed to extract MSI for verification (exit code: $($proc.ExitCode))"
+            $allSigned = $false
+          } else {
             $innerExe = Get-ChildItem -Path $extractDir -Filter "stirling-pdf.exe" -Recurse -File | Select-Object -First 1
             if ($innerExe) {
               $sig = Get-AuthenticodeSignature -FilePath $innerExe.FullName
@@ -548,9 +564,6 @@ jobs:
               Write-Host "[ERROR] Could not find stirling-pdf.exe inside MSI"
               $allSigned = $false
             }
-          } else {
-            Write-Host "[ERROR] Failed to extract MSI for verification (exit code: $($proc.ExitCode))"
-            $allSigned = $false
           }
 
           if (-not $allSigned) {
@@ -800,7 +813,11 @@ jobs:
         uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           tag_name: v${{ needs.determine-matrix.outputs.version }}
-          generate_release_notes: true
+          # Don't regenerate/append notes on re-runs, and don't force this into the
+          # "Latest" slot - leave the release body and latest marker as they are.
+          generate_release_notes: false
+          append_body: false
+          make_latest: false
           fail_on_unmatched_files: true
           # Installers + updater payloads + manifest. .sig contents are embedded
           # in latest.json so the .sig files themselves are not uploaded.

From a7307ff393f05733281f9521db12af2fd073dc05 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 8 Jul 2026 10:50:36 +0100
Subject: [PATCH 010/109] Fix Postgres user settings for some users

---
 .../java/stirling/software/proprietary/security/model/User.java  | 1 -
 1 file changed, 1 deletion(-)

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java
index 2b2d22cfc7..eeeda1823b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java
@@ -103,7 +103,6 @@ public class User implements UserDetails, Serializable {
 
     @ElementCollection
     @MapKeyColumn(name = "setting_key")
-    @Lob
     @Column(name = "setting_value", columnDefinition = "text")
     @CollectionTable(name = "user_settings", joinColumns = @JoinColumn(name = "user_id"))
     @JsonIgnore

From 38ccea074cefe98235b1f67a5c4d0eabcc55c523 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 8 Jul 2026 10:50:37 +0100
Subject: [PATCH 011/109] Version bump

---
 .github/aur/stirling-pdf-desktop/PKGBUILD                       | 2 +-
 .github/aur/stirling-pdf-server-bin/PKGBUILD                    | 2 +-
 build.gradle                                                    | 2 +-
 frontend/editor/src-tauri/tauri.conf.json                       | 2 +-
 frontend/editor/src/core/testing/serverExperienceSimulations.ts | 2 +-
 .../src/proprietary/testing/serverExperienceSimulations.ts      | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/aur/stirling-pdf-desktop/PKGBUILD b/.github/aur/stirling-pdf-desktop/PKGBUILD
index 5d92425b19..fb6a99cfca 100644
--- a/.github/aur/stirling-pdf-desktop/PKGBUILD
+++ b/.github/aur/stirling-pdf-desktop/PKGBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-desktop
-pkgver=2.14.1
+pkgver=2.14.2
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (Tauri desktop app, official Stirling PDF Inc build)"
 arch=('x86_64')
diff --git a/.github/aur/stirling-pdf-server-bin/PKGBUILD b/.github/aur/stirling-pdf-server-bin/PKGBUILD
index f5a2bf3c6c..70bcee0423 100644
--- a/.github/aur/stirling-pdf-server-bin/PKGBUILD
+++ b/.github/aur/stirling-pdf-server-bin/PKGBUILD
@@ -1,6 +1,6 @@
 # Maintainer: Stirling PDF Inc <contact@stirlingpdf.com>
 pkgname=stirling-pdf-server-bin
-pkgver=2.14.1
+pkgver=2.14.2
 pkgrel=1
 pkgdesc="Locally hosted, web-based PDF manipulation tool (server JAR, prebuilt)"
 arch=('any')
diff --git a/build.gradle b/build.gradle
index 5c89fd7af2..073bccc654 100644
--- a/build.gradle
+++ b/build.gradle
@@ -91,7 +91,7 @@ springBoot {
 
 allprojects {
     group = 'stirling.software'
-    version = '2.14.1'
+    version = '2.14.2'
 
     configurations.configureEach {
         exclude group: "org.springframework.boot", module: "spring-boot-starter-tomcat"
diff --git a/frontend/editor/src-tauri/tauri.conf.json b/frontend/editor/src-tauri/tauri.conf.json
index 6cfe33cbe6..dee2cc7023 100644
--- a/frontend/editor/src-tauri/tauri.conf.json
+++ b/frontend/editor/src-tauri/tauri.conf.json
@@ -2,7 +2,7 @@
   "$schema": "../node_modules/@tauri-apps/cli/config.schema.json",
   "productName": "Stirling PDF",
   "mainBinaryName": "Stirling-PDF",
-  "version": "2.14.1",
+  "version": "2.14.2",
   "identifier": "stirling.pdf.dev",
   "build": {
     "frontendDist": "../dist",
diff --git a/frontend/editor/src/core/testing/serverExperienceSimulations.ts b/frontend/editor/src/core/testing/serverExperienceSimulations.ts
index cd7ed8f2ba..97da95c730 100644
--- a/frontend/editor/src/core/testing/serverExperienceSimulations.ts
+++ b/frontend/editor/src/core/testing/serverExperienceSimulations.ts
@@ -38,7 +38,7 @@ const FREE_LICENSE_INFO: LicenseInfo = {
 
 const BASE_NO_LOGIN_CONFIG: AppConfig = {
   enableAnalytics: true,
-  appVersion: "2.14.1",
+  appVersion: "2.14.2",
   serverCertificateEnabled: false,
   enableAlphaFunctionality: false,
   serverPort: 8080,
diff --git a/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts b/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts
index 1aaabfeb33..d92cf8fdf9 100644
--- a/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts
+++ b/frontend/editor/src/proprietary/testing/serverExperienceSimulations.ts
@@ -48,7 +48,7 @@ const FREE_LICENSE_INFO: LicenseInfo = {
 
 const BASE_NO_LOGIN_CONFIG: AppConfig = {
   enableAnalytics: true,
-  appVersion: "2.14.1",
+  appVersion: "2.14.2",
   serverCertificateEnabled: false,
   enableAlphaFunctionality: false,
   enableDesktopInstallSlide: true,

From b019f9b570a78e20ac4cacece82199d9fe9d0c00 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Mon, 13 Jul 2026 13:55:36 +0100
Subject: [PATCH 012/109] Fix missing and broken translations in Processor
 (#7016)

# Description of Changes
<img width="385" height="92" alt="image"
src="https://github.com/user-attachments/assets/7f4b1921-72e8-4c18-a4de-4b9736a5a2f1"
/>

Started from trying to fix this, but became a larger piece of work to
find missing/broken translations in the Processor and fix as many as I
could.
---
 .../public/locales/en-US/translation.toml     | 29 +++++++++++++++++--
 frontend/editor/src/portal/api/agents.ts      |  5 ++++
 frontend/editor/src/portal/api/policies.ts    | 19 ++++++++++--
 frontend/editor/src/portal/api/users.ts       | 23 +++++++++------
 .../components/ProcessingStatusStrip.tsx      |  2 +-
 .../agent-builder/AgentBuilderPanel.tsx       |  8 +++--
 .../agent-builder/AgentSelector.tsx           |  8 +++--
 .../agent-builder/VersionsPanel.tsx           |  8 +++--
 .../catalogue/ComponentDetailModal.tsx        |  8 +++--
 .../components/infrastructure/ApiKeyCard.tsx  |  2 +-
 .../components/procurement/DocumentLedger.tsx |  2 +-
 .../components/users/PendingInvitations.tsx   | 12 ++++----
 .../src/portal/contexts/TierContext.tsx       | 12 +++++---
 .../editor/src/portal/mocks/procurement.ts    | 10 +++----
 frontend/editor/src/portal/views/Policies.tsx |  4 +--
 15 files changed, 111 insertions(+), 41 deletions(-)

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 9663478000..cc65a78ce8 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6240,6 +6240,10 @@ muted = "muted"
 nameLabel = "Name"
 namePlaceholder = "e.g. Compliance escalation"
 
+[portal.agentBuilder.status]
+draft = "Draft"
+published = "Published"
+
 [portal.agentBuilder.tabs]
 evals = "Evals"
 scenarios = "Scenarios"
@@ -6463,7 +6467,7 @@ install = "Install"
 usage = "Usage"
 
 [portal.catalogue.detail.locked]
-description = "{{name}} is included from the {{tier}} plan. Upgrade to embed it."
+description = "{{name}} is included from the {{plan}}. Upgrade to embed it."
 title = "Not available on your plan"
 
 [portal.catalogue.detail.preview]
@@ -7415,6 +7419,7 @@ manual = "Manual"
 schedule = "Scheduled"
 
 [portal.policies]
+defaultName = "{{category}} Policy"
 subtitle = "Standing automations that enforce a tool pipeline on every document. Each policy fires on upload or export, runs its tool chain, and saves the enforced version alongside the original."
 title = "Policies"
 
@@ -8125,6 +8130,11 @@ chooseType = "Choose type"
 configure = "Configure"
 review = "Review & connect"
 
+[portal.tier]
+enterprise = "Enterprise plan"
+free = "Editor plan"
+pro = "Processor plan"
+
 [portal.usage]
 managePayment = "Manage Payment"
 subtitle = "Consumption, invoices, and plan management for every PDF Stirling has billed, in one console."
@@ -10139,6 +10149,19 @@ resetPw = "Reset password"
 suspend = "Suspend"
 unlock = "Unlock account"
 
+[users.activity]
+daysAgo = "{{count}}d ago"
+hoursAgo = "{{count}}h ago"
+justNow = "Just now"
+minutesAgo = "{{count}}m ago"
+monthsAgo_one = "{{count}} month ago"
+monthsAgo_other = "{{count}} months ago"
+never = "Never"
+weeksAgo_one = "{{count}} week ago"
+weeksAgo_other = "{{count}} weeks ago"
+yearsAgo_one = "{{count}} year ago"
+yearsAgo_other = "{{count}} years ago"
+
 [users.cap]
 addProcessor = "+ Processor"
 approver = "Approves policy"
@@ -10209,7 +10232,9 @@ by = "Invited by {{who}}"
 cancel = "Cancel"
 count = "{{count}} pending"
 desc = "Invited people who haven't joined yet. They hold a seat until they accept."
-expires = "Expires"
+expiresInDays_one = "Expires in {{count}} day"
+expiresInDays_other = "Expires in {{count}} days"
+expiresToday = "Expires today"
 title = "Pending invitations"
 
 [users.loadError]
diff --git a/frontend/editor/src/portal/api/agents.ts b/frontend/editor/src/portal/api/agents.ts
index 61a9e75906..7a0cd49464 100644
--- a/frontend/editor/src/portal/api/agents.ts
+++ b/frontend/editor/src/portal/api/agents.ts
@@ -99,6 +99,11 @@ export const AGENT_STATUS_TONE: Record<AgentStatus, "success" | "neutral"> = {
   draft: "neutral",
 };
 
+export const AGENT_STATUS_LABEL: Record<AgentStatus, string> = {
+  published: "portal.agentBuilder.status.published",
+  draft: "portal.agentBuilder.status.draft",
+};
+
 /**
  * Catalogue of tools an agent can be granted or denied. Surfaced as the chip
  * palette in restricted mode so the deny list is picked from a known set
diff --git a/frontend/editor/src/portal/api/policies.ts b/frontend/editor/src/portal/api/policies.ts
index 5c3c33a75a..78f8b07667 100644
--- a/frontend/editor/src/portal/api/policies.ts
+++ b/frontend/editor/src/portal/api/policies.ts
@@ -9,6 +9,7 @@
  * approach the editor uses for its own catalogue view.
  */
 
+import type { TFunction } from "i18next";
 import { apiClient } from "@portal/api/http";
 import { fromWirePolicy, toWirePolicy } from "@app/policies/codec";
 import { runsToActivity, runsToStats } from "@app/policies/runs";
@@ -556,17 +557,30 @@ const DEFAULT_RETRY_DELAY = 5;
 // POST /api/v1/policies endpoint. The real backend ignores unknown fields.
 type CatalogueWireBody = WirePolicy & { categoryId: string };
 
+/**
+ * The persisted policy name derived from its category, e.g. "Security Policy".
+ * `category.label` is an i18n key, so translate it before building the name;
+ * otherwise the raw key is persisted and surfaces in the UI (e.g. the Sources
+ * "Used by" pill).
+ */
+function policyDisplayName(entry: CatalogueEntry, t: TFunction): string {
+  return t("portal.policies.defaultName", {
+    category: t(entry.category.label),
+  });
+}
+
 /** Build a wire policy from a setup wizard result. */
 export function buildWireFromSetup(
   entry: CatalogueEntry,
   result: PolicySetupResult,
+  t: TFunction,
   enabled = true,
 ): CatalogueWireBody {
   return {
     categoryId: entry.category.id,
     ...toWirePolicy({
       id: entry.policy?.state.backendId ?? "",
-      name: `${entry.category.label} Policy`,
+      name: policyDisplayName(entry, t),
       enabled,
       categoryId: entry.category.id,
       sources: result.sources,
@@ -589,13 +603,14 @@ export function buildWireFromState(
   entry: CatalogueEntry,
   policy: DecoratedPolicy,
   enabled: boolean,
+  t: TFunction,
 ): CatalogueWireBody {
   const s = policy.state;
   return {
     categoryId: entry.category.id,
     ...toWirePolicy({
       id: s.backendId ?? "",
-      name: `${entry.category.label} Policy`,
+      name: policyDisplayName(entry, t),
       enabled,
       categoryId: entry.category.id,
       sources: s.sources,
diff --git a/frontend/editor/src/portal/api/users.ts b/frontend/editor/src/portal/api/users.ts
index 3505238927..19a686cf8c 100644
--- a/frontend/editor/src/portal/api/users.ts
+++ b/frontend/editor/src/portal/api/users.ts
@@ -1,3 +1,7 @@
+// The bare i18next singleton (the same instance @app/i18n initializes at
+// startup), imported directly so this data module doesn't pull i18n's
+// init side effects into unit tests that mock react-i18next.
+import i18n from "i18next";
 import { apiClient } from "@portal/api/http";
 import type { Tier } from "@portal/contexts/TierContext";
 
@@ -269,22 +273,23 @@ function roleIdFor(u: AdminUserSummaryDto): RoleId {
 
 /** A member's last-seen time as plain language; "Never" when no session is tracked. */
 function relativeTime(value: number | string | undefined): string {
-  if (value === undefined || value === null) return "Never";
+  if (value === undefined || value === null)
+    return i18n.t("users.activity.never");
   const ts = typeof value === "string" ? Date.parse(value) : value;
-  if (!Number.isFinite(ts) || ts <= 0) return "Never";
+  if (!Number.isFinite(ts) || ts <= 0) return i18n.t("users.activity.never");
   const mins = Math.max(0, Math.round((Date.now() - ts) / 60000));
-  if (mins < 1) return "Just now";
-  if (mins < 60) return `${mins}m ago`;
+  if (mins < 1) return i18n.t("users.activity.justNow");
+  if (mins < 60) return i18n.t("users.activity.minutesAgo", { count: mins });
   const hours = Math.round(mins / 60);
-  if (hours < 24) return `${hours}h ago`;
+  if (hours < 24) return i18n.t("users.activity.hoursAgo", { count: hours });
   const days = Math.round(hours / 24);
-  if (days < 7) return `${days}d ago`;
+  if (days < 7) return i18n.t("users.activity.daysAgo", { count: days });
   const weeks = Math.round(days / 7);
-  if (weeks < 5) return weeks === 1 ? "1 week ago" : `${weeks} weeks ago`;
+  if (weeks < 5) return i18n.t("users.activity.weeksAgo", { count: weeks });
   const months = Math.round(days / 30);
-  if (months < 12) return months <= 1 ? "1 month ago" : `${months} months ago`;
+  if (months < 12) return i18n.t("users.activity.monthsAgo", { count: months });
   const years = Math.round(days / 365);
-  return years <= 1 ? "1 year ago" : `${years} years ago`;
+  return i18n.t("users.activity.yearsAgo", { count: years });
 }
 
 /** 0 / huge sentinel license values mean "no seat limit". */
diff --git a/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx b/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx
index af198d488f..2f4602b11d 100644
--- a/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx
+++ b/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx
@@ -26,7 +26,7 @@ export function ProcessingStatusStrip() {
           style={{ background: TIER_INFO[tier].dotColor }}
           aria-hidden
         />
-        {TIER_INFO[tier].label}
+        {t(TIER_INFO[tier].labelKey)}
       </span>
       <span className="portal-statusstrip__sep" aria-hidden>
         ·
diff --git a/frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.tsx b/frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.tsx
index 20cbcab89c..a411f7f680 100644
--- a/frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.tsx
+++ b/frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.tsx
@@ -1,7 +1,11 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
 import { StatusBadge, Tabs, type TabItem } from "@app/ui";
-import { type Agent, AGENT_STATUS_TONE } from "@portal/api/agents";
+import {
+  type Agent,
+  AGENT_STATUS_LABEL,
+  AGENT_STATUS_TONE,
+} from "@portal/api/agents";
 import { ScenariosPanel } from "@portal/components/agent-builder/ScenariosPanel";
 import { ToolsPanel } from "@portal/components/agent-builder/ToolsPanel";
 import { EvalsPanel } from "@portal/components/agent-builder/EvalsPanel";
@@ -52,7 +56,7 @@ export function AgentBuilderPanel({
         </div>
         <div className="portal-agents__builder-meta">
           <StatusBadge tone={AGENT_STATUS_TONE[agent.status]} size="sm">
-            {agent.status}
+            {t(AGENT_STATUS_LABEL[agent.status])}
           </StatusBadge>
           <code className="portal-agents__builder-version">
             {agent.version}
diff --git a/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx b/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx
index 9891c10d03..bb01bf914b 100644
--- a/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx
+++ b/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx
@@ -1,5 +1,9 @@
 import { useTranslation } from "react-i18next";
-import { type Agent, AGENT_STATUS_TONE } from "@portal/api/agents";
+import {
+  type Agent,
+  AGENT_STATUS_LABEL,
+  AGENT_STATUS_TONE,
+} from "@portal/api/agents";
 import { Button, StatusBadge } from "@app/ui";
 import "@portal/views/AgentBuilder.css";
 
@@ -40,7 +44,7 @@ export function AgentSelector({
           </span>
           <span className="portal-agents__selector-meta">
             <StatusBadge tone={AGENT_STATUS_TONE[a.status]} size="sm">
-              {a.status}
+              {t(AGENT_STATUS_LABEL[a.status])}
             </StatusBadge>
             <code className="portal-agents__selector-version">{a.version}</code>
           </span>
diff --git a/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx b/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx
index 20d71dbfbc..3b63fe3045 100644
--- a/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx
+++ b/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx
@@ -1,6 +1,10 @@
 import { useTranslation } from "react-i18next";
 import { Button, StatusBadge } from "@app/ui";
-import { type Agent, AGENT_STATUS_TONE } from "@portal/api/agents";
+import {
+  type Agent,
+  AGENT_STATUS_LABEL,
+  AGENT_STATUS_TONE,
+} from "@portal/api/agents";
 import "@portal/views/AgentBuilder.css";
 
 interface VersionsPanelProps {
@@ -52,7 +56,7 @@ export function VersionsPanel({ agent, historyUnlocked }: VersionsPanelProps) {
                     {v.version}
                   </code>
                   <StatusBadge tone={AGENT_STATUS_TONE[v.status]} size="sm">
-                    {v.status}
+                    {t(AGENT_STATUS_LABEL[v.status])}
                   </StatusBadge>
                   {isCurrent && (
                     <StatusBadge tone="info" size="sm" showDot={false}>
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx b/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx
index 337cfc6119..0599d80d72 100644
--- a/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx
+++ b/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx
@@ -12,9 +12,11 @@ import {
 } from "@app/ui";
 import {
   type SdkComponent,
+  BILLING_UNIT_LABEL,
   MATURITY_META,
   formatPrice,
 } from "@portal/api/sdkComponents";
+import { TIER_INFO } from "@portal/contexts/TierContext";
 import { ComponentPropsTable } from "@portal/components/catalogue/ComponentPropsTable";
 import "@portal/views/Components.css";
 
@@ -113,7 +115,7 @@ export function ComponentDetailModal({
           title={t("portal.catalogue.detail.locked.title")}
           description={t("portal.catalogue.detail.locked.description", {
             name: component.name,
-            tier: component.minTier,
+            plan: t(TIER_INFO[component.minTier].labelKey),
           })}
         />
       )}
@@ -205,7 +207,7 @@ export function ComponentDetailModal({
               />
               <StatTile
                 label={t("portal.catalogue.detail.stats.billedOn")}
-                value={component.pricing.unit}
+                value={t(BILLING_UNIT_LABEL[component.pricing.unit])}
               />
               <StatTile
                 label={t("portal.catalogue.detail.stats.freeQuota")}
@@ -220,7 +222,7 @@ export function ComponentDetailModal({
             </div>
             <p className="portal-components__pricing-note">
               {t("portal.catalogue.detail.pricing.note", {
-                unit: component.pricing.unit,
+                unit: t(BILLING_UNIT_LABEL[component.pricing.unit]),
               })}
             </p>
           </div>
diff --git a/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx b/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx
index ce78ded6fa..69e23cb406 100644
--- a/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx
@@ -23,7 +23,7 @@ export function ApiKeyCard({ apiKey }: { apiKey: ApiKey }) {
         rightSection={
           <span className="portal-infra__key-head-right">
             <StatusBadge tone={KEY_TONE[apiKey.status]} size="sm">
-              {KEY_LABEL[apiKey.status]}
+              {t(KEY_LABEL[apiKey.status])}
             </StatusBadge>
             <span
               className={"portal-infra__chevron" + (open ? " is-open" : "")}
diff --git a/frontend/editor/src/portal/components/procurement/DocumentLedger.tsx b/frontend/editor/src/portal/components/procurement/DocumentLedger.tsx
index 72ab22a341..aa9e6ae8ce 100644
--- a/frontend/editor/src/portal/components/procurement/DocumentLedger.tsx
+++ b/frontend/editor/src/portal/components/procurement/DocumentLedger.tsx
@@ -75,7 +75,7 @@ export function DocumentLedger({
                     className="portal-proc__stage-label"
                     data-current={cur || undefined}
                   >
-                    {group.label}
+                    {t(group.label)}
                   </span>
                   {blurb && (
                     <span className="portal-proc__stage-hint">
diff --git a/frontend/editor/src/portal/components/users/PendingInvitations.tsx b/frontend/editor/src/portal/components/users/PendingInvitations.tsx
index acf9f96386..5c6fd65b5a 100644
--- a/frontend/editor/src/portal/components/users/PendingInvitations.tsx
+++ b/frontend/editor/src/portal/components/users/PendingInvitations.tsx
@@ -1,4 +1,5 @@
 import { useTranslation } from "react-i18next";
+import type { TFunction } from "i18next";
 import { Avatar, Button } from "@app/ui";
 import type { PendingInvitation } from "@portal/api/users";
 import "@portal/views/Users.css";
@@ -11,13 +12,15 @@ interface PendingInvitationsProps {
 
 /** Human "Expires in 3 days" from an ISO expiry; empty when absent, unparseable,
  *  or already past (the adapter filters expired invites, so no "expired" state). */
-function expiryLabel(iso: string | undefined, expiresWord: string): string {
+function expiryLabel(iso: string | undefined, t: TFunction): string {
   if (!iso) return "";
   const ts = Date.parse(iso);
   if (!Number.isFinite(ts) || ts <= Date.now()) return "";
   const days = Math.round((ts - Date.now()) / 86400000);
-  if (days === 0) return `${expiresWord} today`;
-  return `${expiresWord} in ${days === 1 ? "1 day" : `${days} days`}`;
+  if (days === 0) return t("users.invites.expiresToday", "Expires today");
+  return t("users.invites.expiresInDays", "Expires in {{count}} days", {
+    count: days,
+  });
 }
 
 /**
@@ -30,7 +33,6 @@ export function PendingInvitations({
   onCancel,
 }: PendingInvitationsProps) {
   const { t } = useTranslation();
-  const expiresWord = t("users.invites.expires", "Expires");
   return (
     <section className="portal-users__group">
       <header className="portal-users__group-head">
@@ -50,7 +52,7 @@ export function PendingInvitations({
         </span>
       </header>
       {invitations.map((inv) => {
-        const expires = expiryLabel(inv.expiresAt, expiresWord);
+        const expires = expiryLabel(inv.expiresAt, t);
         return (
           <div className="portal-users__row" key={inv.id}>
             <div className="portal-users__row-main">
diff --git a/frontend/editor/src/portal/contexts/TierContext.tsx b/frontend/editor/src/portal/contexts/TierContext.tsx
index cb8a730640..152e1f7a0b 100644
--- a/frontend/editor/src/portal/contexts/TierContext.tsx
+++ b/frontend/editor/src/portal/contexts/TierContext.tsx
@@ -10,16 +10,20 @@ import { usePlanTier } from "@portal/contexts/usePlanTier";
 export type Tier = "free" | "pro" | "enterprise";
 
 export interface TierInfo {
-  label: string;
+  /** i18n key for the plan label; resolve with `t()` at the call site. */
+  labelKey: string;
   dotColor: string;
 }
 
 export const TIER_INFO: Record<Tier, TierInfo> = {
   // Matches SaaS branding (editor/cloud Payg + PaygFree): the always-free
   // manual-tools tier is "Editor plan"; the metered tier is "Processor plan".
-  free: { label: "Editor plan", dotColor: "var(--color-text-4)" },
-  pro: { label: "Processor plan", dotColor: "var(--color-blue)" },
-  enterprise: { label: "Enterprise plan", dotColor: "var(--color-purple)" },
+  free: { labelKey: "portal.tier.free", dotColor: "var(--color-text-4)" },
+  pro: { labelKey: "portal.tier.pro", dotColor: "var(--color-blue)" },
+  enterprise: {
+    labelKey: "portal.tier.enterprise",
+    dotColor: "var(--color-purple)",
+  },
 };
 
 interface TierContextValue {
diff --git a/frontend/editor/src/portal/mocks/procurement.ts b/frontend/editor/src/portal/mocks/procurement.ts
index 1f3f5a1934..6976601d7b 100644
--- a/frontend/editor/src/portal/mocks/procurement.ts
+++ b/frontend/editor/src/portal/mocks/procurement.ts
@@ -51,7 +51,7 @@ const ENTERPRISE_DEAL: Deal = {
 const ENTERPRISE_LEDGER: LedgerGroup[] = [
   {
     stage: "trial",
-    label: "Trial",
+    label: "portal.procurement.journeySteps.trial.label",
     docs: [
       {
         id: "doc-trial-quickstart",
@@ -71,7 +71,7 @@ const ENTERPRISE_LEDGER: LedgerGroup[] = [
   },
   {
     stage: "quote",
-    label: "Quote",
+    label: "portal.procurement.journeySteps.quote.label",
     docs: [
       {
         id: "doc-quote-formal",
@@ -84,7 +84,7 @@ const ENTERPRISE_LEDGER: LedgerGroup[] = [
   },
   {
     stage: "security",
-    label: "Agreement",
+    label: "portal.procurement.journeySteps.agreement.label",
     docs: [
       {
         id: "doc-agreement-enterprise",
@@ -97,7 +97,7 @@ const ENTERPRISE_LEDGER: LedgerGroup[] = [
   },
   {
     stage: "procurement",
-    label: "Payment",
+    label: "portal.procurement.journeySteps.payment.label",
     docs: [
       {
         id: "doc-pay-online",
@@ -124,7 +124,7 @@ const ENTERPRISE_LEDGER: LedgerGroup[] = [
   },
   {
     stage: "active",
-    label: "Implementation",
+    label: "portal.procurement.journeySteps.implementation.label",
     docs: [
       {
         id: "doc-active-playbook",
diff --git a/frontend/editor/src/portal/views/Policies.tsx b/frontend/editor/src/portal/views/Policies.tsx
index 0795cef0f0..8d58ed0e79 100644
--- a/frontend/editor/src/portal/views/Policies.tsx
+++ b/frontend/editor/src/portal/views/Policies.tsx
@@ -67,7 +67,7 @@ export function Policies() {
   ) {
     setPageError(null);
     try {
-      await savePolicy(buildWireFromSetup(entry, result));
+      await savePolicy(buildWireFromSetup(entry, result, t));
       setWizard(null);
       setDetail(null);
       refetch();
@@ -97,7 +97,7 @@ export function Policies() {
     if (!entry || !policy?.state.backendId) return;
     const enabled = policy.state.status === "paused";
     void runLifecycle(() =>
-      savePolicy(buildWireFromState(entry, policy, enabled)),
+      savePolicy(buildWireFromState(entry, policy, enabled, t)),
     );
   }
 

From 8bfcf6eb7e2103a24bc912ab1746525a598d84ea Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Mon, 13 Jul 2026 14:26:00 +0100
Subject: [PATCH 013/109] Portal: theme-aware code blocks and hero-navy token
 (#7003)

# Description of Changes

Makes the code-snippet boxes theme-aware (a light palette in light mode)
and moves the hero navy into a design token without changing the colour
itself.

Part of a portal (processor) UI-consistency pass, split into small
focused PRs.

## Before / after

<img width="2136" height="272" alt="after-codeblock-light"
src="https://github.com/user-attachments/assets/ebdd4a7d-2d1a-429a-971b-0b04e93854fe"
/>
<img width="1800" height="740" alt="before-codeblock-light"
src="https://github.com/user-attachments/assets/6819231a-10d5-4730-9b7d-3c36dc1c8170"
/>

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [x] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 frontend/editor/src/core/tokens/tokens.css    | 31 +++++++++++++++++--
 frontend/editor/src/core/ui/CodeBlock.css     |  3 +-
 .../portal/components/EditorStatusCard.css    |  4 +--
 .../src/portal/components/WelcomeBanner.css   |  4 +--
 4 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/frontend/editor/src/core/tokens/tokens.css b/frontend/editor/src/core/tokens/tokens.css
index 247cd22a4e..f667a93851 100644
--- a/frontend/editor/src/core/tokens/tokens.css
+++ b/frontend/editor/src/core/tokens/tokens.css
@@ -270,8 +270,29 @@
   --grad-banner: linear-gradient(135deg, #0f172a 0%, #111827 50%, #1a1535 100%);
 }
 
-/* Always-dark code palette. Not theme-switched. */
-:root {
+/* Code palette — theme-aware: a light GitHub-style box in light mode, the dark
+   terminal palette in dark mode. (CodeBlock renders plain text, so only the
+   base colours are load-bearing; the syntax slots are kept for future Shiki. */
+:root,
+[data-theme="light"] {
+  --code-bg: #f6f8fa;
+  --code-bg-alt: #eef1f4;
+  --code-bg-header: #eaeef2;
+  --code-text: #1f2328;
+  --code-dim: #656d76;
+  --code-muted: #8c959f;
+  --code-keyword: #cf222e;
+  --code-string: #0a3069;
+  --code-number: #0550ae;
+  --code-fn: #8250df;
+  --code-type: #953800;
+  --code-property: #0550ae;
+  --code-comment: #6e7781;
+  --code-border: #d0d7de;
+  /* Window-chrome traffic-light dots in the code-block header. */
+  --code-dot: #d0d7de;
+}
+[data-theme="dark"] {
   --code-bg: #0f172a;
   --code-bg-alt: #1e293b;
   --code-bg-header: #1a2332;
@@ -286,12 +307,16 @@
   --code-property: #93c5fd;
   --code-comment: #475569;
   --code-border: #1e293b;
-  /* Window-chrome traffic-light dots in the code-block header. */
   --code-dot: #475569;
 }
 
 /* Radii / typography / motion / spacing / z-index — theme-stable */
 :root {
+  /* Home hero strip navy. Theme-stable by design — the hero keeps this deep
+     navy in both light and dark (it's a branded surface, like the assistant
+     header), so it's defined once here rather than in the light/dark blocks. */
+  --color-hero-navy: #16213e;
+
   --radius-xs: 0.1875rem;
   --radius-sm: 0.25rem;
   --radius-md: 0.375rem;
diff --git a/frontend/editor/src/core/ui/CodeBlock.css b/frontend/editor/src/core/ui/CodeBlock.css
index b74a03c67f..76ebea940c 100644
--- a/frontend/editor/src/core/ui/CodeBlock.css
+++ b/frontend/editor/src/core/ui/CodeBlock.css
@@ -51,7 +51,8 @@
   transition: background var(--motion-fast);
 }
 .sui-code__copy:hover {
-  background: rgba(255, 255, 255, 0.05);
+  /* Subtle tint that reads on both the light and dark code surfaces. */
+  background: color-mix(in srgb, var(--code-text) 8%, transparent);
 }
 .sui-code__pre {
   margin: 0;
diff --git a/frontend/editor/src/portal/components/EditorStatusCard.css b/frontend/editor/src/portal/components/EditorStatusCard.css
index 83426bae91..9732ec2fb0 100644
--- a/frontend/editor/src/portal/components/EditorStatusCard.css
+++ b/frontend/editor/src/portal/components/EditorStatusCard.css
@@ -15,7 +15,7 @@
   align-items: center;
   gap: 1.25rem;
   padding: 1rem 1.25rem;
-  background: #16213e;
+  background: var(--color-hero-navy);
 }
 
 .portal-editor-hero__logo {
@@ -123,7 +123,7 @@
 .portal-editor-hero__action .portal-editor-hero__cta.sui-btn {
   background: #ffffff;
   border-color: #ffffff;
-  color: #16213e;
+  color: var(--color-hero-navy);
 }
 .portal-editor-hero__action .portal-editor-hero__cta.sui-btn:hover {
   background: rgba(255, 255, 255, 0.88);
diff --git a/frontend/editor/src/portal/components/WelcomeBanner.css b/frontend/editor/src/portal/components/WelcomeBanner.css
index 5c63462754..57f54846eb 100644
--- a/frontend/editor/src/portal/components/WelcomeBanner.css
+++ b/frontend/editor/src/portal/components/WelcomeBanner.css
@@ -18,7 +18,7 @@
   gap: 1rem;
   flex-wrap: wrap;
   padding: 0.875rem 1.25rem;
-  background: #16213e;
+  background: var(--color-hero-navy);
 }
 
 .portal-welcome__brand {
@@ -90,7 +90,7 @@
 .portal-welcome__header .portal-welcome__cta.sui-btn {
   background: #ffffff;
   border-color: #ffffff;
-  color: #16213e;
+  color: var(--color-hero-navy);
 }
 .portal-welcome__header .portal-welcome__cta.sui-btn:hover {
   background: rgba(255, 255, 255, 0.88);

From b5d0c4a5ed740fc9de9c76ff1d6e91902a981ac0 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Mon, 13 Jul 2026 14:26:07 +0100
Subject: [PATCH 014/109] Portal Home: SVG quick-action icons (#6998)

# Description of Changes

Replaces the ASCII quick-action glyphs on the Home hero with crisp
stroke SVG icons.

Part of a portal (processor) UI-consistency pass, split into small
focused PRs.

## Before / after
<img width="2880" height="2726" alt="after-home-dark"
src="https://github.com/user-attachments/assets/ab4c3611-25a6-4b2c-a993-99ce2f7b7558"
/>
<img width="2880" height="2726" alt="after-home-light"
src="https://github.com/user-attachments/assets/b0b342b9-4436-4791-b0a6-92837c3ec355"
/>
<img width="2880" height="2726" alt="before-home-dark"
src="https://github.com/user-attachments/assets/93d73393-5a81-4f34-a483-90671a6ae79e"
/>
<img width="2880" height="2726" alt="before-home-light"
src="https://github.com/user-attachments/assets/119389cc-78ef-4a43-9f9a-d551b03c9733"
/>


---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [x] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 frontend/editor/src/portal/views/Home.css | 13 +++++--
 frontend/editor/src/portal/views/Home.tsx | 42 +++++++++++++++++++----
 2 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/frontend/editor/src/portal/views/Home.css b/frontend/editor/src/portal/views/Home.css
index e1af68b768..3027dfa1bc 100644
--- a/frontend/editor/src/portal/views/Home.css
+++ b/frontend/editor/src/portal/views/Home.css
@@ -93,8 +93,11 @@
   width: 1.75rem;
   height: 1.75rem;
   border-radius: var(--radius-md);
-  font-size: 0.875rem;
-  font-weight: 600;
+  flex-shrink: 0;
+}
+.portal-home__quick-icon svg {
+  width: 1.05rem;
+  height: 1.05rem;
 }
 
 .portal-home__quick-text {
@@ -116,9 +119,13 @@
 }
 
 .portal-home__quick-arrow {
-  font-size: 0.875rem;
+  display: inline-flex;
   color: var(--color-text-5);
 }
+.portal-home__quick-arrow svg {
+  width: 1rem;
+  height: 1rem;
+}
 
 .portal-home__quick-row:hover .portal-home__quick-arrow {
   color: var(--color-blue);
diff --git a/frontend/editor/src/portal/views/Home.tsx b/frontend/editor/src/portal/views/Home.tsx
index a1829d5476..2f8f812581 100644
--- a/frontend/editor/src/portal/views/Home.tsx
+++ b/frontend/editor/src/portal/views/Home.tsx
@@ -13,31 +13,52 @@ import "@portal/views/Home.css";
 /*  Quick actions card                                                       */
 /* ──────────────────────────────────────────────────────────────────────── */
 
+/** A stroke icon used inside the quick-action badge (replaces the old text
+    glyphs ⌃ ⇢ ⚙, which rendered off-style vs the portal's icon set). */
+function QuickIcon({ d }: { d: string }) {
+  return (
+    <svg
+      viewBox="0 0 24 24"
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="1.7"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+      aria-hidden
+    >
+      <path d={d} />
+    </svg>
+  );
+}
+
 /** Rows for the Quick Actions list. Each `view` navigates the portal. */
 const QUICK_ACTIONS: Array<{
   key: string;
-  glyph: string;
+  iconD: string;
   bg: string;
   fg: string;
   view: ViewId;
 }> = [
   {
     key: "buildPipeline",
-    glyph: "⌃",
+    iconD:
+      "M6 4a2 2 0 100 4 2 2 0 000-4zM18 16a2 2 0 100 4 2 2 0 000-4zM6 8v6a4 4 0 004 4h4",
     bg: "var(--color-purple-light)",
     fg: "var(--color-purple)",
     view: "pipelines",
   },
   {
     key: "connectSource",
-    glyph: "⇢",
+    iconD:
+      "M10 13a5 5 0 007 0l3-3a5 5 0 00-7-7l-1 1M14 11a5 5 0 00-7 0l-3 3a5 5 0 007 7l1-1",
     bg: "var(--color-green-light)",
     fg: "var(--color-green-dark)",
     view: "sources",
   },
   {
     key: "issueApiKey",
-    glyph: "⚙",
+    iconD:
+      "M2.6 17.4A2 2 0 002 18.8V21a1 1 0 001 1h3a1 1 0 001-1v-1a1 1 0 011-1h1a1 1 0 001-1v-1a1 1 0 011-1h.2a2 2 0 001.4-.6l.8-.8a6.5 6.5 0 10-4-4z M16.5 7.5 h.01",
     bg: "var(--color-amber-light)",
     fg: "var(--color-amber-dark)",
     view: "infrastructure",
@@ -75,12 +96,21 @@ function QuickActions() {
                 style={{ background: action.bg, color: action.fg }}
                 aria-hidden
               >
-                {action.glyph}
+                <QuickIcon d={action.iconD} />
               </span>
             }
             rightSection={
               <span className="portal-home__quick-arrow" aria-hidden>
-                →
+                <svg
+                  viewBox="0 0 24 24"
+                  fill="none"
+                  stroke="currentColor"
+                  strokeWidth="2"
+                  strokeLinecap="round"
+                  strokeLinejoin="round"
+                >
+                  <path d="M9 6l6 6-6 6" />
+                </svg>
               </span>
             }
           >

From 76549288a9403c78b29406f32f74d52adc43e6d9 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Mon, 13 Jul 2026 15:44:41 +0100
Subject: [PATCH 015/109] Redesign S3 connections to use connection resolver
 (#6965)

# Description of Changes
Redesign S3 connections based on feedback from #6948. Also redesigns the
UI for Sources to make them more like the Pipelines page which improves
UX quite a bit. There's still plenty more UI/UX work for Sources and S3
but moving in the right direction.
---
 .../service/IntegrationConfigService.java     |  44 ++-
 .../service/IntegrationConfigUsageCheck.java  |  15 +
 .../service/IntegrationConfigValidator.java   |  23 ++
 .../policy/controller/PolicyController.java   |  20 ++
 .../policy/engine/PolicyValidator.java        |  14 +-
 .../policy/input/S3InputSource.java           |  27 +-
 .../policy/output/S3OutputSink.java           |  12 +-
 .../s3/EmbeddedS3CredentialMigration.java     | 212 ++++++++++++
 .../s3/PolicyS3ConnectionUsageCheck.java      |  56 +++
 .../proprietary/policy/s3/S3Config.java       |  10 +-
 .../policy/s3/S3ConnectionResolver.java       | 151 ++++++++
 .../policy/s3/S3IntegrationValidator.java     |  51 +++
 .../service/IntegrationConfigServiceTest.java |  55 ++-
 .../controller/PolicyControllerTest.java      |  24 ++
 .../policy/engine/PolicyValidatorTest.java    |  22 ++
 .../policy/input/S3InputSourceMinioTest.java  |   9 +-
 .../policy/input/S3InputSourceTest.java       |   4 +-
 .../policy/output/S3OutputSinkMinioTest.java  |   5 +-
 .../policy/output/S3OutputSinkTest.java       |   2 +
 .../s3/EmbeddedS3CredentialMigrationTest.java | 212 ++++++++++++
 .../s3/PolicyS3ConnectionUsageCheckTest.java  |  52 +++
 .../policy/s3/S3ConnectionResolverTest.java   | 149 ++++++++
 .../policy/s3/S3IntegrationValidatorTest.java |  71 ++++
 .../policy/s3/S3TestConnections.java          |  24 ++
 .../public/locales/en-US/translation.toml     |  81 +++--
 frontend/editor/src/core/ui/Table.tsx         |  73 ++--
 frontend/editor/src/portal/ViewRouter.tsx     |   9 +
 .../editor/src/portal/api/integrations.ts     |  74 ++++
 .../components/documents/ReviewQueue.tsx      |   2 +-
 .../sources/ConnectWizard.stories.tsx         |  16 -
 .../components/sources/ConnectWizard.test.tsx | 192 -----------
 .../components/sources/ConnectWizard.tsx      | 298 ----------------
 .../sources/ConnectionsTab.test.tsx           |  82 +++++
 .../components/sources/ConnectionsTab.tsx     | 186 ++++++++++
 .../components/sources/S3ConnectionForm.tsx   | 116 +++++++
 .../sources/S3ConnectionModal.test.tsx        | 131 +++++++
 .../components/sources/S3ConnectionModal.tsx  | 127 +++++++
 .../sources/S3ConnectionPicker.test.tsx       |  72 ++++
 .../components/sources/S3ConnectionPicker.tsx |  71 ++++
 .../sources/SourceDetailCard.stories.tsx      |  63 ----
 .../components/sources/SourceDetailCard.tsx   | 100 ------
 .../sources/SourceDetailPanel.stories.tsx     |  59 ----
 .../components/sources/SourceDetailPanel.tsx  |  91 -----
 .../sources/SourcesTable.stories.tsx          |   7 +-
 .../components/sources/SourcesTable.tsx       |  45 ++-
 .../components/sources/Sparkline.test.tsx     |  48 ---
 .../portal/components/sources/Sparkline.tsx   |  53 ---
 .../portal/components/sources/sourceTypes.ts  |  36 +-
 .../src/portal/views/PipelineBuilder.css      |  24 --
 .../src/portal/views/PipelineBuilder.test.tsx |  84 +++--
 .../src/portal/views/PipelineBuilder.tsx      | 149 ++------
 .../editor/src/portal/views/Pipelines.tsx     |   2 +-
 .../editor/src/portal/views/SourceBuilder.css |  87 +++++
 .../src/portal/views/SourceBuilder.test.tsx   | 158 +++++++++
 .../editor/src/portal/views/SourceBuilder.tsx | 326 ++++++++++++++++++
 frontend/editor/src/portal/views/Sources.css  |  98 ++++++
 .../editor/src/portal/views/Sources.test.tsx  | 207 ++++-------
 frontend/editor/src/portal/views/Sources.tsx  | 273 ++++-----------
 58 files changed, 3127 insertions(+), 1577 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigUsageCheck.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigValidator.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheck.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionResolver.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3IntegrationValidator.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigrationTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheckTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3ConnectionResolverTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3IntegrationValidatorTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3TestConnections.java
 create mode 100644 frontend/editor/src/portal/api/integrations.ts
 delete mode 100644 frontend/editor/src/portal/components/sources/ConnectWizard.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/ConnectWizard.test.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/ConnectWizard.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionsTab.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/S3ConnectionForm.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/S3ConnectionModal.test.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/S3ConnectionModal.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/SourceDetailCard.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/SourceDetailCard.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/SourceDetailPanel.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/SourceDetailPanel.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/Sparkline.test.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/Sparkline.tsx
 create mode 100644 frontend/editor/src/portal/views/SourceBuilder.css
 create mode 100644 frontend/editor/src/portal/views/SourceBuilder.test.tsx
 create mode 100644 frontend/editor/src/portal/views/SourceBuilder.tsx

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigService.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigService.java
index 9e44b35523..a7ef7d4512 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigService.java
@@ -43,6 +43,10 @@ public class IntegrationConfigService {
     private final OwnershipService ownership;
     private final SecretMasker secretMasker;
     private final ResourceGrantRepository grantRepository;
+    // Bean-discovered extension points: features that understand a type contribute its config
+    // schema and report what still references a config, without this module depending on them.
+    private final List<IntegrationConfigValidator> validators;
+    private final List<IntegrationConfigUsageCheck> usageChecks;
 
     // ---- commands ----
 
@@ -66,13 +70,21 @@ public class IntegrationConfigService {
                         ? DefaultAccessPolicy.EXPLICIT_ONLY
                         : request.defaultAccess());
 
+        // TEAM scope may omit the team id: default to the caller's own team so clients (the
+        // portal) need not know it. assignOwnership still enforces admin-or-leader of that team.
+        Long ownerTeamId = request.ownerTeamId();
+        if (ownerTeamId == null && scope == OwnerScope.TEAM && currentUser.getTeam() != null) {
+            ownerTeamId = currentUser.getTeam().getId();
+        }
         ownership.assignOwnership(
                 cfg,
                 scope,
-                request.ownerTeamId(),
+                ownerTeamId,
                 currentUser,
                 () -> lockedServerExists(cfg.getIntegrationType()));
-        cfg.setConfig(writeJson(secretMasker.sanitize(request.config())));
+        Map<String, Object> config = secretMasker.sanitize(request.config());
+        validateConfig(cfg.getIntegrationType(), config);
+        cfg.setConfig(writeJson(config));
         return repository.save(cfg);
     }
 
@@ -101,8 +113,10 @@ public class IntegrationConfigService {
             cfg.setDefaultAccess(request.defaultAccess());
         }
         if (request.config() != null) {
-            cfg.setConfig(
-                    writeJson(secretMasker.merge(readJson(cfg.getConfig()), request.config())));
+            Map<String, Object> merged =
+                    secretMasker.merge(readJson(cfg.getConfig()), request.config());
+            validateConfig(cfg.getIntegrationType(), merged);
+            cfg.setConfig(writeJson(merged));
         }
         return repository.save(cfg);
     }
@@ -113,6 +127,15 @@ public class IntegrationConfigService {
         if (!ownership.canManage(TYPE, cfg, currentUser)) {
             throw forbidden("You cannot manage this integration");
         }
+        // Refuse to pull a connection out from under whatever still references it.
+        List<String> usages =
+                usageChecks.stream()
+                        .flatMap(check -> check.usagesOf(cfg.getId()).stream())
+                        .toList();
+        if (!usages.isEmpty()) {
+            throw new ResponseStatusException(
+                    HttpStatus.CONFLICT, "Integration is in use by: " + String.join(", ", usages));
+        }
         // Drop grants sharing this config so they do not dangle as dead rows.
         grantRepository.deleteByResourceTypeAndResourceId(TYPE, String.valueOf(cfg.getId()));
         repository.delete(cfg);
@@ -188,6 +211,19 @@ public class IntegrationConfigService {
 
     // ---- integration-specific glue ----
 
+    /** Runs every registered validator for the type; unknown types save free-form. */
+    private void validateConfig(IntegrationType type, Map<String, Object> config) {
+        for (IntegrationConfigValidator validator : validators) {
+            if (validator.type() == type) {
+                try {
+                    validator.validate(config == null ? Map.of() : config);
+                } catch (IllegalArgumentException e) {
+                    throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());
+                }
+            }
+        }
+    }
+
     /** A non-admin can't create a personal config of a type an admin has locked at server scope. */
     private boolean lockedServerExists(IntegrationType type) {
         return repository.findByScope(OwnerScope.SERVER).stream()
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigUsageCheck.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigUsageCheck.java
new file mode 100644
index 0000000000..6d703baeda
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigUsageCheck.java
@@ -0,0 +1,15 @@
+package stirling.software.proprietary.integration.service;
+
+import java.util.List;
+
+/**
+ * Reports what still references an integration config, so deletion can be refused instead of
+ * pulling a connection out from under a live consumer. Implementations are beans discovered by
+ * {@link IntegrationConfigService} (e.g. the policy subsystem reporting sources and pipelines that
+ * reference a connection).
+ */
+public interface IntegrationConfigUsageCheck {
+
+    /** Human-readable labels of everything still using the config; empty when unreferenced. */
+    List<String> usagesOf(long configId);
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigValidator.java
new file mode 100644
index 0000000000..05857d2714
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigValidator.java
@@ -0,0 +1,23 @@
+package stirling.software.proprietary.integration.service;
+
+import java.util.Map;
+
+import stirling.software.proprietary.integration.model.IntegrationType;
+
+/**
+ * Validates one integration type's config map at save time. Implementations are beans discovered by
+ * {@link IntegrationConfigService}, so the feature that understands a type (e.g. the policy S3
+ * backend) owns its schema without the integration module depending on it. Types with no registered
+ * validator save free-form.
+ */
+public interface IntegrationConfigValidator {
+
+    /** The type this validator understands. */
+    IntegrationType type();
+
+    /**
+     * Validates the config as it will be stored (secrets already sanitized/merged, so values are
+     * real, never the redaction mask). Throws {@link IllegalArgumentException} on bad config.
+     */
+    void validate(Map<String, Object> config);
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
index e2c89f6a54..95fde9304a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
@@ -120,6 +120,7 @@ public class PolicyController {
             throws IOException {
         stampPolicyAudit(definition);
         requireRunnable(definition);
+        validateAdHocOutput(definition);
         PolicyInputs inputs = toInputs(files);
         PolicyRunHandle handle =
                 policyRunner.runAdHoc(definition, inputs, PolicyProgressListener.NOOP);
@@ -140,6 +141,7 @@ public class PolicyController {
             throws IOException {
         stampPolicyAudit(definition);
         requireRunnable(definition);
+        validateAdHocOutput(definition);
         PolicyInputs inputs = toInputs(files);
 
         SseEmitter emitter =
@@ -530,6 +532,24 @@ public class PolicyController {
         }
     }
 
+    /**
+     * Authorization-check an ad-hoc run's output while the caller's principal is present (this
+     * request thread). The worker thread that later delivers carries no security context, so an S3
+     * output's connection-access check would be skipped there; without this gate a caller could
+     * reference another tenant's connection by id and write to it (confused deputy). Stored
+     * policies are covered by save-time {@link PolicyValidator#validate} instead.
+     */
+    private void validateAdHocOutput(PipelineDefinition definition) {
+        if (definition.output() == null) {
+            return;
+        }
+        try {
+            policyValidator.validateOutput(definition.output());
+        } catch (IllegalArgumentException e) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());
+        }
+    }
+
     /**
      * Ad-hoc runs (AI / one-off pipelines) are still editor activity, so their supplied documents
      * feed the same virtual editor source as stored editor policies, counted against the caller's
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java
index c08d2dd857..92c4cf95d9 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java
@@ -52,7 +52,19 @@ public class PolicyValidator {
             InputSpec spec = source.toInputSpec();
             inputSourceFor(spec).validate(spec);
         }
-        outputSinkFor(policy.output()).validate(policy.output());
+        validateOutput(policy.output());
+    }
+
+    /**
+     * Validate an output spec against its sink. Must be called on a request thread (caller's
+     * principal present) so an S3 output's connection is authorization-checked against the caller -
+     * ad-hoc runs are never persisted and so never hit {@link #validate(Policy)}, and the worker
+     * thread that later delivers has no principal, so this is their only access gate.
+     *
+     * @throws IllegalArgumentException if the type is unknown or the config is invalid/inaccessible
+     */
+    public void validateOutput(OutputSpec output) {
+        outputSinkFor(output).validate(output);
     }
 
     private PolicyTrigger triggerFor(TriggerConfig config) {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/S3InputSource.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/S3InputSource.java
index 99e189f326..fbbcfc4549 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/S3InputSource.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/S3InputSource.java
@@ -18,6 +18,7 @@ import stirling.software.proprietary.policy.model.InputSpec;
 import stirling.software.proprietary.policy.model.PolicyInputs;
 import stirling.software.proprietary.policy.s3.S3Config;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
+import stirling.software.proprietary.policy.s3.S3ConnectionResolver;
 import stirling.software.proprietary.policy.s3.S3Identities;
 
 import software.amazon.awssdk.core.exception.SdkException;
@@ -36,15 +37,14 @@ import software.amazon.awssdk.services.s3.model.S3Object;
  * Reads input files from an Amazon S3 (or S3-compatible) bucket; each listed object is its own unit
  * of work, claimed through the {@link ResolveContext} ledger and tracked in place. Identity and
  * version gate come from {@link S3Identities}, so the steady-state sweep never downloads content.
- * Options (see {@link S3Config}): "bucket" (required), "region" (default us-east-1), "prefix" (only
- * keys starting with it are read), "endpoint" (S3-compatible stores such as MinIO; path-style
- * addressing is used automatically), "accessKeyId" and "secretAccessKey" (required; requests are
- * never signed with the server's own AWS identity), and "mode" which is "consume" (default: a
- * processed object is deleted once every policy that claimed it has settled successfully and it is
- * still the version that ran; failures stay in place and are not retried until they change) or
- * "snapshot" (stateless, every run sees the full set). Keys ending in "/" (folder placeholders) and
- * keys with a dot-prefixed path segment are never picked up, mirroring the folder source's
- * hidden-file rule.
+ * Options: "connectionId" references the stored S3 connection (an {@code IntegrationConfig} owning
+ * bucket, region, endpoint, and credentials - resolved by {@link S3ConnectionResolver}); "prefix"
+ * (only keys starting with it are read) and "mode" are per-source, where mode is "consume"
+ * (default: a processed object is deleted once every policy that claimed it has settled
+ * successfully and it is still the version that ran; failures stay in place and are not retried
+ * until they change) or "snapshot" (stateless, every run sees the full set). Keys ending in "/"
+ * (folder placeholders) and keys with a dot-prefixed path segment are never picked up, mirroring
+ * the folder source's hidden-file rule.
  */
 @Slf4j
 @Service
@@ -55,6 +55,7 @@ public class S3InputSource implements InputSource {
     private static final String TYPE = "s3";
 
     private final S3ConnectionPool connectionPool;
+    private final S3ConnectionResolver connectionResolver;
 
     @Override
     public String type() {
@@ -67,12 +68,12 @@ public class S3InputSource implements InputSource {
     }
 
     /**
-     * Fails fast at save time: bad config shape, a private endpoint without the operator opt-in, or
-     * a bucket the supplied credentials cannot list.
+     * Fails fast at save time: an unknown/disabled/unusable connection, bad config shape, a private
+     * endpoint without the operator opt-in, or a bucket the connection cannot list.
      */
     @Override
     public void validate(InputSpec spec) {
-        S3Config config = S3Config.from(spec.options());
+        S3Config config = connectionResolver.resolve(spec.options());
         try {
             connectionPool.clientFor(config).listObjectsV2(listRequest(config).maxKeys(1).build());
         } catch (SdkException e) {
@@ -89,7 +90,7 @@ public class S3InputSource implements InputSource {
 
     @Override
     public List<ResolvedInput> resolve(InputSpec spec, ResolveContext ctx) throws IOException {
-        S3Config config = S3Config.from(spec.options());
+        S3Config config = connectionResolver.resolve(spec.options());
         S3Client client = connectionPool.clientFor(config);
         // A listing failure propagates so the sweep reads it as "could not list" (which vetoes
         // presence cleanup), never as "verifiably no objects".
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/S3OutputSink.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/S3OutputSink.java
index c7d740868a..fb590b3c2e 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/S3OutputSink.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/S3OutputSink.java
@@ -27,6 +27,7 @@ import stirling.software.proprietary.policy.ledger.ProcessedLedger;
 import stirling.software.proprietary.policy.model.OutputSpec;
 import stirling.software.proprietary.policy.s3.S3Config;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
+import stirling.software.proprietary.policy.s3.S3ConnectionResolver;
 import stirling.software.proprietary.policy.s3.S3Identities;
 
 import software.amazon.awssdk.core.exception.SdkException;
@@ -59,6 +60,7 @@ public class S3OutputSink implements PolicyOutputSink {
     private static final String TYPE = "s3";
 
     private final S3ConnectionPool connectionPool;
+    private final S3ConnectionResolver connectionResolver;
     private final ProcessedLedger processedLedger;
 
     @Override
@@ -72,19 +74,19 @@ public class S3OutputSink implements PolicyOutputSink {
     }
 
     /**
-     * Config shape and endpoint guard only - no network probe, since write-only credentials
-     * (s3:PutObject without s3:ListBucket) are a legitimate setup for an output bucket and a
-     * listing probe would wrongly reject them.
+     * Connection resolution (including the saving user's right to use it) and endpoint guard only -
+     * no network probe, since write-only credentials (s3:PutObject without s3:ListBucket) are a
+     * legitimate setup for an output bucket and a listing probe would wrongly reject them.
      */
     @Override
     public void validate(OutputSpec spec) {
-        connectionPool.clientFor(S3Config.from(spec.options()));
+        connectionPool.clientFor(connectionResolver.resolve(spec.options()));
     }
 
     @Override
     public List<ResultFile> deliver(
             OutputDelivery delivery, List<Resource> outputs, OutputSpec spec) throws IOException {
-        S3Config config = S3Config.from(spec.options());
+        S3Config config = connectionResolver.resolve(spec.options());
         S3Client client = connectionPool.clientFor(config);
 
         List<ResultFile> results = new ArrayList<>();
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
new file mode 100644
index 0000000000..5aa82a8e66
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
@@ -0,0 +1,212 @@
+package stirling.software.proprietary.policy.s3;
+
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.event.EventListener;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Transactional;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.access.model.DefaultAccessPolicy;
+import stirling.software.proprietary.access.model.OwnerScope;
+import stirling.software.proprietary.integration.model.IntegrationConfig;
+import stirling.software.proprietary.integration.model.IntegrationType;
+import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.store.PolicyStore;
+import stirling.software.proprietary.security.repository.TeamRepository;
+
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * One-time, idempotent extraction of legacy embedded S3 credentials into stored connections:
+ * sources and policy outputs written before connections shipped carry bucket/credentials in their
+ * own options; this rewrites each to reference a (deduplicated) S3 {@link IntegrationConfig} and
+ * keeps only per-use options (prefix, mode). MUST be programmatic - the option JSON is encrypted at
+ * the application layer, so no SQL migration can read it.
+ *
+ * <p>Idempotent by construction: rewritten rows no longer embed credentials, so re-runs find
+ * nothing to do. Connections are deduplicated against both this run's extractions and existing S3
+ * connections; a concurrent multi-node boot can at worst create a redundant connection row, never
+ * corrupt a source. Ownership follows the owning row: team-scoped when the source/policy has a
+ * team, server-scoped otherwise (single-operator self-hosted).
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+@ConditionalOnBooleanProperty(name = "policies.enabled")
+public class EmbeddedS3CredentialMigration {
+
+    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+    private static final List<String> CONNECTION_OPTIONS =
+            List.of("bucket", "region", "endpoint", "accessKeyId", "secretAccessKey");
+    // Field separator for the dedup key: a unit-separator control char that cannot appear in a
+    // bucket/region/endpoint/credential, so distinct field sets can never collide.
+    private static final char DELIMITER = '\u001f';
+
+    private final SourceStore sourceStore;
+    private final PolicyStore policyStore;
+    private final IntegrationConfigRepository connections;
+    private final TeamRepository teamRepository;
+
+    @EventListener(ApplicationReadyEvent.class)
+    @Transactional
+    public void migrate() {
+        Map<String, IntegrationConfig> byCredentialKey = indexExistingConnections();
+        int migrated = 0;
+        for (Source source : sourceStore.all()) {
+            if (!"s3".equals(source.type()) || !embedsCredentials(source.options())) {
+                continue;
+            }
+            IntegrationConfig connection =
+                    connectionFor(source.options(), source.teamId(), byCredentialKey);
+            sourceStore.save(withOptions(source, referencing(connection, source.options(), true)));
+            migrated++;
+        }
+        for (Policy policy : policyStore.all()) {
+            OutputSpec output = policy.output();
+            if (!"s3".equals(output.type()) || !embedsCredentials(output.options())) {
+                continue;
+            }
+            IntegrationConfig connection =
+                    connectionFor(output.options(), policy.teamId(), byCredentialKey);
+            policyStore.save(
+                    withOutput(
+                            policy,
+                            new OutputSpec(
+                                    output.type(),
+                                    referencing(connection, output.options(), false))));
+            migrated++;
+        }
+        if (migrated > 0) {
+            log.info("Extracted embedded S3 credentials from {} row(s) into connections", migrated);
+        }
+    }
+
+    private static boolean embedsCredentials(Map<String, Object> options) {
+        return options.get("accessKeyId") != null;
+    }
+
+    /** Reuses an existing connection with identical coordinates+credentials, else creates one. */
+    private IntegrationConfig connectionFor(
+            Map<String, Object> options, Long teamId, Map<String, IntegrationConfig> byKey) {
+        String key = credentialKey(options);
+        IntegrationConfig existing = byKey.get(key);
+        if (existing != null) {
+            return existing;
+        }
+        IntegrationConfig connection = new IntegrationConfig();
+        connection.setIntegrationType(IntegrationType.S3);
+        connection.setName(connectionName(options, byKey));
+        connection.setEnabled(true);
+        connection.setLocked(false);
+        connection.setDefaultAccess(DefaultAccessPolicy.EXPLICIT_ONLY);
+        Team team = teamId == null ? null : teamRepository.findById(teamId).orElse(null);
+        if (team != null) {
+            connection.setScope(OwnerScope.TEAM);
+            connection.setOwnerTeam(team);
+        } else {
+            // No team (teamless self-hosted, or a source whose team was since deleted): server
+            // scope, i.e. admin-owned. An orphaned-team source's non-admin editor would then need
+            // an admin to re-share the connection - acceptable for the narrow orphaned case.
+            connection.setScope(OwnerScope.SERVER);
+        }
+        Map<String, Object> config = new LinkedHashMap<>();
+        for (String option : CONNECTION_OPTIONS) {
+            Object value = options.get(option);
+            if (value != null && !value.toString().isBlank()) {
+                config.put(option, value);
+            }
+        }
+        connection.setConfig(OBJECT_MAPPER.writeValueAsString(config));
+        IntegrationConfig saved = connections.save(connection);
+        byKey.put(key, saved);
+        return saved;
+    }
+
+    /** The rewritten options: the connection reference plus per-use settings only. */
+    private static Map<String, Object> referencing(
+            IntegrationConfig connection, Map<String, Object> legacy, boolean keepMode) {
+        Map<String, Object> options = new LinkedHashMap<>();
+        options.put(S3ConnectionResolver.CONNECTION_ID_OPTION, connection.getId());
+        Object prefix = legacy.get("prefix");
+        if (prefix != null && !prefix.toString().isBlank()) {
+            options.put("prefix", prefix);
+        }
+        Object mode = legacy.get("mode");
+        if (keepMode && mode != null && !mode.toString().isBlank()) {
+            options.put("mode", mode);
+        }
+        return options;
+    }
+
+    private Map<String, IntegrationConfig> indexExistingConnections() {
+        Map<String, IntegrationConfig> byKey = new LinkedHashMap<>();
+        for (IntegrationConfig connection : connections.findAll()) {
+            if (connection.getIntegrationType() != IntegrationType.S3) {
+                continue;
+            }
+            try {
+                Map<String, Object> config =
+                        OBJECT_MAPPER.readValue(connection.getConfig(), Map.class);
+                byKey.putIfAbsent(credentialKey(config), connection);
+            } catch (Exception e) {
+                log.debug(
+                        "Skipping unreadable S3 connection {} while indexing: {}",
+                        connection.getId(),
+                        e.getMessage());
+            }
+        }
+        return byKey;
+    }
+
+    private static String credentialKey(Map<String, Object> options) {
+        StringBuilder key = new StringBuilder();
+        for (String option : CONNECTION_OPTIONS) {
+            Object value = options.get(option);
+            key.append(value == null ? "" : value.toString().trim()).append(DELIMITER);
+        }
+        return key.toString();
+    }
+
+    private static String connectionName(
+            Map<String, Object> options, Map<String, IntegrationConfig> byKey) {
+        String base = "S3: " + options.getOrDefault("bucket", "bucket");
+        long sameName = byKey.values().stream().filter(c -> c.getName().startsWith(base)).count();
+        return sameName == 0 ? base : base + " (" + (sameName + 1) + ")";
+    }
+
+    private static Source withOptions(Source source, Map<String, Object> options) {
+        return new Source(
+                source.id(),
+                source.name(),
+                source.type(),
+                options,
+                source.enabled(),
+                source.owner(),
+                source.teamId());
+    }
+
+    private static Policy withOutput(Policy policy, OutputSpec output) {
+        return new Policy(
+                policy.id(),
+                policy.name(),
+                policy.owner(),
+                policy.enabled(),
+                policy.trigger(),
+                policy.sourceIds(),
+                policy.steps(),
+                output,
+                policy.teamId());
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheck.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheck.java
new file mode 100644
index 0000000000..00d1b28e6c
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheck.java
@@ -0,0 +1,56 @@
+package stirling.software.proprietary.policy.s3;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
+import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.integration.service.IntegrationConfigUsageCheck;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.store.PolicyStore;
+
+/**
+ * Reports the policy sources and pipeline outputs referencing an S3 connection, so the connection
+ * cannot be deleted out from under them (mirrors {@code SourceController}'s referenced-source
+ * delete guard). Scans in memory - fine at admin-dashboard scale, always consistent with the live
+ * stores.
+ */
+@Component
+@RequiredArgsConstructor
+@ConditionalOnBooleanProperty(name = "policies.enabled")
+public class PolicyS3ConnectionUsageCheck implements IntegrationConfigUsageCheck {
+
+    private final SourceStore sourceStore;
+    private final PolicyStore policyStore;
+
+    @Override
+    public List<String> usagesOf(long configId) {
+        List<String> usages = new ArrayList<>();
+        for (Source source : sourceStore.all()) {
+            if (references(source.options(), configId)) {
+                usages.add("source '" + source.name() + "'");
+            }
+        }
+        for (Policy policy : policyStore.all()) {
+            if (references(policy.output().options(), configId)) {
+                usages.add("pipeline '" + policy.name() + "'");
+            }
+        }
+        return usages;
+    }
+
+    private static boolean references(Map<String, Object> options, long configId) {
+        try {
+            Long reference = S3ConnectionResolver.connectionId(options);
+            return reference != null && reference == configId;
+        } catch (IllegalArgumentException unparseable) {
+            return false;
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3Config.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3Config.java
index 152a6de4cf..c9d3eabd83 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3Config.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3Config.java
@@ -5,10 +5,12 @@ import java.net.URISyntaxException;
 import java.util.Map;
 
 /**
- * Connection settings shared by the S3 input source and output sink, parsed from a spec's options
- * map. Credentials are required: there is deliberately no fallback to the server's own AWS
- * credential chain, so user-supplied config can never borrow the host's identity. {@code snapshot}
- * is input-only and ignored by the sink.
+ * The fully resolved connection settings the S3 input source and output sink run with - normally
+ * produced by {@link S3ConnectionResolver} merging a stored connection (bucket, region, endpoint,
+ * credentials) with per-use options (prefix, mode), or parsed directly from legacy options that
+ * still embed credentials. Credentials are required: there is deliberately no fallback to the
+ * server's own AWS credential chain, so user-supplied config can never borrow the host's identity.
+ * {@code snapshot} is input-only and ignored by the sink.
  */
 public record S3Config(
         String bucket,
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionResolver.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionResolver.java
new file mode 100644
index 0000000000..d15839aebe
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionResolver.java
@@ -0,0 +1,151 @@
+package stirling.software.proprietary.policy.s3;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.access.model.ResourceType;
+import stirling.software.proprietary.access.service.OwnershipService;
+import stirling.software.proprietary.integration.model.IntegrationConfig;
+import stirling.software.proprietary.integration.model.IntegrationType;
+import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.service.UserService;
+
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * Turns a source's or output's options into a full {@link S3Config} by dereferencing its {@code
+ * connectionId} to a stored S3 {@link IntegrationConfig} (the connection owns bucket, region,
+ * endpoint, and credentials; the options own per-use settings such as prefix and mode). Options
+ * with no {@code connectionId} fall back to legacy embedded credentials, so rows written before
+ * connections shipped keep working until {@link EmbeddedS3CredentialMigration} rewrites them.
+ *
+ * <p>When an authenticated caller is present (save-time validation), they must be allowed to use
+ * the connection. Background sweeps and deliveries run with no caller and skip that check: the
+ * referencing source or policy was access-checked when it was saved.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+@Transactional(readOnly = true)
+@ConditionalOnBooleanProperty(name = "policies.enabled")
+public class S3ConnectionResolver {
+
+    static final String CONNECTION_ID_OPTION = "connectionId";
+    private static final String PREFIX_OPTION = "prefix";
+    private static final String MODE_OPTION = "mode";
+    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+
+    private final IntegrationConfigRepository connections;
+    private final OwnershipService ownership;
+    private final UserService userService;
+
+    public S3Config resolve(Map<String, Object> options) {
+        Long connectionId = connectionId(options);
+        if (connectionId == null) {
+            // Legacy embedded credentials, pending migration.
+            return S3Config.from(options);
+        }
+        IntegrationConfig connection =
+                connections
+                        .findById(connectionId)
+                        .filter(cfg -> cfg.getIntegrationType() == IntegrationType.S3)
+                        .filter(this::usableByCurrentUser)
+                        // Existence and access collapse into one error: a caller must not be able
+                        // to tell "no such connection" from "someone else's connection" and
+                        // enumerate ids. The id/name are never echoed.
+                        .orElseThrow(
+                                () ->
+                                        new IllegalArgumentException(
+                                                "unknown or inaccessible s3 connection"));
+        if (!connection.isEnabled()) {
+            throw new IllegalArgumentException("s3 connection is disabled");
+        }
+        Map<String, Object> merged = new LinkedHashMap<>(connectionConfig(connection));
+        copyPerUseOption(options, merged, PREFIX_OPTION);
+        copyPerUseOption(options, merged, MODE_OPTION);
+        return S3Config.from(merged);
+    }
+
+    /** The {@code connectionId} option as a long, or null when the options are legacy-embedded. */
+    static Long connectionId(Map<String, Object> options) {
+        Object reference = options.get(CONNECTION_ID_OPTION);
+        if (reference == null || (reference instanceof String s && s.isBlank())) {
+            return null;
+        }
+        if (reference instanceof Number number) {
+            return number.longValue();
+        }
+        try {
+            return Long.valueOf(reference.toString().trim());
+        } catch (NumberFormatException e) {
+            throw new IllegalArgumentException(
+                    "s3 'connectionId' is not a valid connection reference: " + reference);
+        }
+    }
+
+    /**
+     * Whether the current caller may use this connection. With no principal - a background sweep or
+     * delivery on a worker thread that carries no {@code SecurityContext} - access is treated as
+     * already established: stored policies are validated with the caller present at save time, and
+     * ad-hoc runs are validated on the request thread before dispatch (see {@code
+     * PolicyValidator#validateOutput}). A missing principal must therefore never be the ONLY thing
+     * standing between a caller and a connection, or the check becomes a confused deputy.
+     */
+    private boolean usableByCurrentUser(IntegrationConfig connection) {
+        User user = currentUser();
+        return user == null || ownership.canUse(ResourceType.INTEGRATION_CONFIG, connection, user);
+    }
+
+    // Mirrors ResourceAccessSecurity's principal resolution; null when unauthenticated.
+    private User currentUser() {
+        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+        if (auth == null || !auth.isAuthenticated()) {
+            return null;
+        }
+        Object principal = auth.getPrincipal();
+        if (principal instanceof User user) {
+            return user;
+        }
+        if (principal instanceof UserDetails userDetails) {
+            return userService.findByUsername(userDetails.getUsername()).orElse(null);
+        }
+        if (principal instanceof String username && !"anonymousUser".equals(username)) {
+            return userService.findByUsername(username).orElse(null);
+        }
+        return null;
+    }
+
+    private static Map<String, Object> connectionConfig(IntegrationConfig connection) {
+        String json = connection.getConfig();
+        if (json == null || json.isBlank()) {
+            return Map.of();
+        }
+        try {
+            return OBJECT_MAPPER.readValue(
+                    json, new TypeReference<LinkedHashMap<String, Object>>() {});
+        } catch (Exception e) {
+            throw new IllegalArgumentException(
+                    "s3 connection '" + connection.getName() + "' has unreadable config", e);
+        }
+    }
+
+    private static void copyPerUseOption(
+            Map<String, Object> options, Map<String, Object> merged, String key) {
+        Object value = options.get(key);
+        if (value != null && !value.toString().isBlank()) {
+            merged.put(key, value);
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3IntegrationValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3IntegrationValidator.java
new file mode 100644
index 0000000000..ee36ba5693
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3IntegrationValidator.java
@@ -0,0 +1,51 @@
+package stirling.software.proprietary.policy.s3;
+
+import java.net.URI;
+import java.util.Map;
+
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
+import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.cluster.s3.S3Clients;
+import stirling.software.proprietary.integration.model.IntegrationType;
+import stirling.software.proprietary.integration.service.IntegrationConfigValidator;
+
+/**
+ * The S3 connection schema, enforced when an S3 {@link IntegrationType} config is saved: bucket and
+ * credentials required, endpoint an http(s) URL that must not reach private addresses without the
+ * operator opt-in - the same rules {@link S3ConnectionPool} enforces before signing, moved to save
+ * time so a bad connection fails in the form rather than in a sweep.
+ */
+@Component
+@RequiredArgsConstructor
+@ConditionalOnBooleanProperty(name = "policies.enabled")
+public class S3IntegrationValidator implements IntegrationConfigValidator {
+
+    private final ApplicationProperties applicationProperties;
+
+    @Override
+    public IntegrationType type() {
+        return IntegrationType.S3;
+    }
+
+    @Override
+    public void validate(Map<String, Object> config) {
+        S3Config parsed = S3Config.from(config);
+        if (parsed.endpoint() == null) {
+            return;
+        }
+        try {
+            S3Clients.validateEndpointHost(
+                    URI.create(parsed.endpoint()),
+                    applicationProperties.getPolicies().isAllowPrivateS3Endpoints(),
+                    "S3 connection endpoint",
+                    "set policies.allowPrivateS3Endpoints=true to opt in (e.g. for a local"
+                            + " MinIO).");
+        } catch (IllegalStateException e) {
+            throw new IllegalArgumentException(e.getMessage(), e);
+        }
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/service/IntegrationConfigServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/service/IntegrationConfigServiceTest.java
index 8e0ef200bb..fbfef15721 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/integration/service/IntegrationConfigServiceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/service/IntegrationConfigServiceTest.java
@@ -13,9 +13,9 @@ import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.http.HttpStatus;
@@ -52,7 +52,58 @@ class IntegrationConfigServiceTest {
     @Mock
     private stirling.software.proprietary.access.repository.ResourceGrantRepository grantRepository;
 
-    @InjectMocks private IntegrationConfigService service;
+    @Mock private IntegrationConfigValidator validator;
+    @Mock private IntegrationConfigUsageCheck usageCheck;
+
+    private IntegrationConfigService service;
+
+    @BeforeEach
+    void setUp() {
+        service =
+                new IntegrationConfigService(
+                        repository,
+                        ownership,
+                        secretMasker,
+                        grantRepository,
+                        List.of(validator),
+                        List.of(usageCheck));
+    }
+
+    @Test
+    void createRejectsAConfigItsTypeValidatorRefuses() {
+        when(secretMasker.sanitize(any())).thenReturn(Map.of());
+        when(validator.type()).thenReturn(IntegrationType.API);
+        org.mockito.Mockito.doThrow(new IllegalArgumentException("api config needs a 'url'"))
+                .when(validator)
+                .validate(any());
+
+        assertThatThrownBy(
+                        () ->
+                                service.create(
+                                        request(IntegrationType.API, OwnerScope.USER, null),
+                                        user(7)))
+                .isInstanceOf(ResponseStatusException.class)
+                .satisfies(
+                        e ->
+                                assertThat(((ResponseStatusException) e).getStatusCode())
+                                        .isEqualTo(HttpStatus.BAD_REQUEST));
+    }
+
+    @Test
+    void deleteRefusedWhileAnythingStillReferencesTheConfig() {
+        IntegrationConfig cfg = config(9L);
+        when(repository.findById(9L)).thenReturn(Optional.of(cfg));
+        when(ownership.canManage(any(), eq(cfg), any())).thenReturn(true);
+        when(usageCheck.usagesOf(9L)).thenReturn(List.of("source 'Claims intake'"));
+
+        assertThatThrownBy(() -> service.delete(9L, user(7)))
+                .isInstanceOf(ResponseStatusException.class)
+                .satisfies(
+                        e ->
+                                assertThat(((ResponseStatusException) e).getStatusCode())
+                                        .isEqualTo(HttpStatus.CONFLICT));
+        verify(repository, org.mockito.Mockito.never()).delete(any(IntegrationConfig.class));
+    }
 
     @Test
     void createDelegatesOwnershipAndSanitizesConfig() {
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
index c02945fdad..8258622e28 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
@@ -4,6 +4,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -194,6 +195,29 @@ class PolicyControllerTest {
                                     assertThat(((ResponseStatusException) e).getStatusCode())
                                             .isEqualTo(HttpStatus.BAD_REQUEST));
         }
+
+        @Test
+        @DisplayName("rejects an ad-hoc output the caller cannot use, on the request thread")
+        void rejectsUnauthorizedAdHocOutput() {
+            // The confused-deputy guard: an S3 output referencing a connection the caller may not
+            // use is validated here (principal present) and refused before any worker dispatch.
+            PipelineDefinition definition =
+                    new PipelineDefinition(
+                            "pipe",
+                            List.of(new PipelineStep("/api/v1/misc/compress-pdf", null)),
+                            new OutputSpec("s3", Map.of("connectionId", 999)));
+            doThrow(new IllegalArgumentException("unknown or inaccessible s3 connection"))
+                    .when(policyValidator)
+                    .validateOutput(any());
+
+            assertThatThrownBy(() -> controller.run(definition, new PolicyRunFiles()))
+                    .isInstanceOf(ResponseStatusException.class)
+                    .satisfies(
+                            e ->
+                                    assertThat(((ResponseStatusException) e).getStatusCode())
+                                            .isEqualTo(HttpStatus.BAD_REQUEST));
+            verify(policyRunner, never()).runAdHoc(any(), any(), any());
+        }
     }
 
     @Nested
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyValidatorTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyValidatorTest.java
index 8cdb1b45a3..21a9f3e42e 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyValidatorTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyValidatorTest.java
@@ -82,6 +82,28 @@ class PolicyValidatorTest {
         assertTrue(ex.getMessage().contains("schedule"));
     }
 
+    @Test
+    void validateOutputDelegatesToTheSink() {
+        when(outputSink.supports(any())).thenReturn(true);
+        OutputSpec output = new OutputSpec("s3", Map.of("connectionId", 1));
+
+        validator.validateOutput(output);
+
+        verify(outputSink).validate(output);
+    }
+
+    @Test
+    void validateOutputSurfacesAnInaccessibleConnection() {
+        when(outputSink.supports(any())).thenReturn(true);
+        doThrow(new IllegalArgumentException("unknown or inaccessible s3 connection"))
+                .when(outputSink)
+                .validate(any());
+
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> validator.validateOutput(new OutputSpec("s3", Map.of("connectionId", 1))));
+    }
+
     @Test
     void rejectsAnUnknownTriggerType() {
         when(trigger.type()).thenReturn("schedule");
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/S3InputSourceMinioTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/S3InputSourceMinioTest.java
index 4e1e1fc305..47de8f6092 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/S3InputSourceMinioTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/S3InputSourceMinioTest.java
@@ -23,6 +23,7 @@ import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
 import stirling.software.proprietary.policy.model.InputSpec;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
+import stirling.software.proprietary.policy.s3.S3TestConnections;
 
 import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
 import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
@@ -82,7 +83,9 @@ class S3InputSourceMinioTest {
         // The MinIO endpoint resolves to loopback, so the operator opt-in must be on.
         ApplicationProperties properties = new ApplicationProperties();
         properties.getPolicies().setAllowPrivateS3Endpoints(true);
-        source = new S3InputSource(new S3ConnectionPool(properties));
+        source =
+                new S3InputSource(
+                        new S3ConnectionPool(properties), S3TestConnections.legacyResolver());
         ledger = new InProcessProcessedLedger();
         ctx = new RecordingContext();
     }
@@ -161,7 +164,9 @@ class S3InputSourceMinioTest {
     @Test
     void aPrivateEndpointIsRejectedWithoutTheOperatorOptIn() {
         S3InputSource guarded =
-                new S3InputSource(new S3ConnectionPool(new ApplicationProperties()));
+                new S3InputSource(
+                        new S3ConnectionPool(new ApplicationProperties()),
+                        S3TestConnections.legacyResolver());
 
         assertThatThrownBy(() -> guarded.validate(spec(Map.of())))
                 .isInstanceOf(IllegalArgumentException.class)
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/S3InputSourceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/S3InputSourceTest.java
index 73995248dd..9054b4f304 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/S3InputSourceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/S3InputSourceTest.java
@@ -29,6 +29,7 @@ import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
 import stirling.software.proprietary.policy.model.InputSpec;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
+import stirling.software.proprietary.policy.s3.S3TestConnections;
 
 import software.amazon.awssdk.core.ResponseInputStream;
 import software.amazon.awssdk.core.exception.SdkClientException;
@@ -64,7 +65,8 @@ class S3InputSourceTest {
     void setUp() {
         source =
                 new S3InputSource(
-                        new S3ConnectionPool(new ApplicationProperties(), config -> s3Client));
+                        new S3ConnectionPool(new ApplicationProperties(), config -> s3Client),
+                        S3TestConnections.legacyResolver());
         ledger = new InProcessProcessedLedger();
         ctx = new RecordingContext();
     }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/S3OutputSinkMinioTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/S3OutputSinkMinioTest.java
index a2a5a41ca0..153e6e1508 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/S3OutputSinkMinioTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/S3OutputSinkMinioTest.java
@@ -28,6 +28,7 @@ import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
 import stirling.software.proprietary.policy.model.InputSpec;
 import stirling.software.proprietary.policy.model.OutputSpec;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
+import stirling.software.proprietary.policy.s3.S3TestConnections;
 
 import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
 import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
@@ -90,8 +91,8 @@ class S3OutputSinkMinioTest {
         properties.getPolicies().setAllowPrivateS3Endpoints(true);
         S3ConnectionPool pool = new S3ConnectionPool(properties);
         ledger = new InProcessProcessedLedger();
-        sink = new S3OutputSink(pool, ledger);
-        source = new S3InputSource(pool);
+        sink = new S3OutputSink(pool, S3TestConnections.legacyResolver(), ledger);
+        source = new S3InputSource(pool, S3TestConnections.legacyResolver());
     }
 
     @Test
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/S3OutputSinkTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/S3OutputSinkTest.java
index 8240bcc4e1..a5a3327c51 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/S3OutputSinkTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/S3OutputSinkTest.java
@@ -32,6 +32,7 @@ import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
 import stirling.software.proprietary.policy.ledger.ProcessedFileStatus;
 import stirling.software.proprietary.policy.model.OutputSpec;
 import stirling.software.proprietary.policy.s3.S3ConnectionPool;
+import stirling.software.proprietary.policy.s3.S3TestConnections;
 
 import software.amazon.awssdk.awscore.exception.AwsServiceException;
 import software.amazon.awssdk.core.exception.SdkClientException;
@@ -66,6 +67,7 @@ class S3OutputSinkTest {
         sink =
                 new S3OutputSink(
                         new S3ConnectionPool(new ApplicationProperties(), config -> s3Client),
+                        S3TestConnections.legacyResolver(),
                         ledger);
     }
 
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigrationTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigrationTest.java
new file mode 100644
index 0000000000..ff14d8cf81
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigrationTest.java
@@ -0,0 +1,212 @@
+package stirling.software.proprietary.policy.s3;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.atomic.AtomicLong;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import stirling.software.proprietary.access.model.OwnerScope;
+import stirling.software.proprietary.integration.model.IntegrationConfig;
+import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.PipelineStep;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.store.InProcessPolicyStore;
+import stirling.software.proprietary.security.repository.TeamRepository;
+
+/**
+ * Tests for {@link EmbeddedS3CredentialMigration}: legacy embedded credentials become deduplicated
+ * team-scoped connections, rewritten rows keep only per-use options, and re-runs are no-ops.
+ */
+@ExtendWith(MockitoExtension.class)
+class EmbeddedS3CredentialMigrationTest {
+
+    @Mock private IntegrationConfigRepository connections;
+    @Mock private TeamRepository teamRepository;
+
+    private final InProcessSourceStore sourceStore = new InProcessSourceStore();
+    private final InProcessPolicyStore policyStore = new InProcessPolicyStore();
+    private EmbeddedS3CredentialMigration migration;
+
+    @BeforeEach
+    void setUp() {
+        migration =
+                new EmbeddedS3CredentialMigration(
+                        sourceStore, policyStore, connections, teamRepository);
+        AtomicLong ids = new AtomicLong(100);
+        // Lenient: the nothing-to-migrate cases never create a connection.
+        lenient().when(connections.findAll()).thenReturn(List.of());
+        lenient()
+                .when(connections.save(any()))
+                .thenAnswer(
+                        invocation -> {
+                            IntegrationConfig saved = invocation.getArgument(0);
+                            if (saved.getId() == null) {
+                                saved.setId(ids.incrementAndGet());
+                            }
+                            return saved;
+                        });
+    }
+
+    @Test
+    void extractsSharedCredentialsIntoOneTeamScopedConnection() {
+        Team team = new Team();
+        team.setId(7L);
+        when(teamRepository.findById(7L)).thenReturn(Optional.of(team));
+        Source source =
+                sourceStore.save(
+                        new Source(
+                                null,
+                                "Claims intake",
+                                "s3",
+                                Map.of(
+                                        "bucket", "inbox",
+                                        "prefix", "incoming/",
+                                        "mode", "snapshot",
+                                        "accessKeyId", "AKIAEXAMPLE",
+                                        "secretAccessKey", "shh"),
+                                true,
+                                "alice",
+                                7L));
+        Policy policy =
+                policyStore.save(
+                        new Policy(
+                                null,
+                                "Rotate",
+                                "alice",
+                                true,
+                                null,
+                                List.of(source.id()),
+                                List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
+                                new OutputSpec(
+                                        "s3",
+                                        Map.of(
+                                                "bucket", "inbox",
+                                                "prefix", "processed/",
+                                                "accessKeyId", "AKIAEXAMPLE",
+                                                "secretAccessKey", "shh")),
+                                7L));
+
+        migration.migrate();
+
+        // Same bucket + credentials on both rows: exactly one connection extracted.
+        verify(connections, times(1)).save(any());
+        Map<String, Object> sourceOptions = sourceStore.get(source.id()).orElseThrow().options();
+        assertEquals(101L, sourceOptions.get("connectionId"));
+        assertEquals("incoming/", sourceOptions.get("prefix"));
+        assertEquals("snapshot", sourceOptions.get("mode"));
+        assertNull(sourceOptions.get("accessKeyId"));
+        assertNull(sourceOptions.get("secretAccessKey"));
+        assertNull(sourceOptions.get("bucket"));
+
+        Map<String, Object> outputOptions =
+                policyStore.get(policy.id()).orElseThrow().output().options();
+        assertEquals(101L, outputOptions.get("connectionId"));
+        assertEquals("processed/", outputOptions.get("prefix"));
+        assertNull(outputOptions.get("secretAccessKey"));
+    }
+
+    @Test
+    void connectionOwnershipFollowsTheSourceTeam() {
+        Team team = new Team();
+        team.setId(7L);
+        when(teamRepository.findById(7L)).thenReturn(Optional.of(team));
+        sourceStore.save(s3Source("teamed", 7L));
+
+        migration.migrate();
+
+        verify(connections)
+                .save(
+                        org.mockito.ArgumentMatchers.argThat(
+                                connection ->
+                                        connection.getScope() == OwnerScope.TEAM
+                                                && connection.getOwnerTeam() == team));
+    }
+
+    @Test
+    void teamlessRowsBecomeServerScopedConnections() {
+        sourceStore.save(s3Source("solo", null));
+
+        migration.migrate();
+
+        verify(connections)
+                .save(
+                        org.mockito.ArgumentMatchers.argThat(
+                                connection -> connection.getScope() == OwnerScope.SERVER));
+    }
+
+    @Test
+    void aSecondRunFindsNothingToDo() {
+        sourceStore.save(s3Source("once", null));
+
+        migration.migrate();
+        migration.migrate();
+
+        // One connection from the first run; the rewritten source no longer embeds credentials.
+        verify(connections, times(1)).save(any());
+    }
+
+    @Test
+    void nonS3AndAlreadyMigratedRowsAreUntouched() {
+        Source folder =
+                sourceStore.save(
+                        new Source(
+                                null,
+                                "Folder",
+                                "folder",
+                                Map.of("directory", "/in"),
+                                true,
+                                "alice",
+                                null));
+        Source migrated =
+                sourceStore.save(
+                        new Source(
+                                null,
+                                "Done already",
+                                "s3",
+                                Map.of("connectionId", 55L, "prefix", "in/"),
+                                true,
+                                "alice",
+                                null));
+
+        migration.migrate();
+
+        verify(connections, times(0)).save(any());
+        assertEquals(
+                Map.of("directory", "/in"), sourceStore.get(folder.id()).orElseThrow().options());
+        assertEquals(
+                Map.of("connectionId", 55L, "prefix", "in/"),
+                sourceStore.get(migrated.id()).orElseThrow().options());
+    }
+
+    private static Source s3Source(String name, Long teamId) {
+        return new Source(
+                null,
+                name,
+                "s3",
+                Map.of(
+                        "bucket", "inbox",
+                        "accessKeyId", "AKIAEXAMPLE",
+                        "secretAccessKey", "shh"),
+                true,
+                "alice",
+                teamId);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheckTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheckTest.java
new file mode 100644
index 0000000000..847a553ba6
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheckTest.java
@@ -0,0 +1,52 @@
+package stirling.software.proprietary.policy.s3;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.PipelineStep;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.store.InProcessPolicyStore;
+
+/** Tests for {@link PolicyS3ConnectionUsageCheck}'s reference scan across sources and outputs. */
+class PolicyS3ConnectionUsageCheckTest {
+
+    private final InProcessSourceStore sourceStore = new InProcessSourceStore();
+    private final InProcessPolicyStore policyStore = new InProcessPolicyStore();
+    private final PolicyS3ConnectionUsageCheck check =
+            new PolicyS3ConnectionUsageCheck(sourceStore, policyStore);
+
+    @Test
+    void reportsSourcesAndOutputsReferencingTheConnection() {
+        sourceStore.save(
+                new Source(
+                        null,
+                        "Claims intake",
+                        "s3",
+                        Map.of("connectionId", 5L, "prefix", "in/"),
+                        true,
+                        "alice",
+                        null));
+        policyStore.save(
+                new Policy(
+                        null,
+                        "Rotate",
+                        "alice",
+                        true,
+                        null,
+                        List.of(),
+                        List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
+                        new OutputSpec("s3", Map.of("connectionId", "5")),
+                        null));
+
+        assertThat(check.usagesOf(5))
+                .containsExactlyInAnyOrder("source 'Claims intake'", "pipeline 'Rotate'");
+        assertThat(check.usagesOf(6)).isEmpty();
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3ConnectionResolverTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3ConnectionResolverTest.java
new file mode 100644
index 0000000000..6a480842c9
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3ConnectionResolverTest.java
@@ -0,0 +1,149 @@
+package stirling.software.proprietary.policy.s3;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+
+import java.util.Map;
+import java.util.Optional;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+import stirling.software.proprietary.access.service.OwnershipService;
+import stirling.software.proprietary.integration.model.IntegrationConfig;
+import stirling.software.proprietary.integration.model.IntegrationType;
+import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.service.UserService;
+
+/**
+ * Tests for {@link S3ConnectionResolver}: connection dereferencing with per-use overrides, the
+ * legacy embedded fallback, and the save-time access check that background sweeps skip.
+ */
+@ExtendWith(MockitoExtension.class)
+class S3ConnectionResolverTest {
+
+    @Mock private IntegrationConfigRepository connections;
+    @Mock private OwnershipService ownership;
+    @Mock private UserService userService;
+
+    @AfterEach
+    void clearSecurityContext() {
+        SecurityContextHolder.clearContext();
+    }
+
+    @Test
+    void resolvesAConnectionAndMergesPerUseOptions() {
+        when(connections.findById(9L)).thenReturn(Optional.of(s3Connection(9L, true)));
+
+        S3Config config =
+                resolver()
+                        .resolve(
+                                Map.of(
+                                        "connectionId", 9L,
+                                        "prefix", "incoming/",
+                                        "mode", "snapshot"));
+
+        assertEquals("inbox", config.bucket());
+        assertEquals("AKIAEXAMPLE", config.accessKeyId());
+        assertEquals("incoming/", config.prefix());
+        assertTrue(config.snapshot());
+    }
+
+    @Test
+    void acceptsAStringConnectionReference() {
+        when(connections.findById(9L)).thenReturn(Optional.of(s3Connection(9L, true)));
+
+        assertEquals("inbox", resolver().resolve(Map.of("connectionId", "9")).bucket());
+    }
+
+    @Test
+    void fallsBackToLegacyEmbeddedCredentials() {
+        S3Config config =
+                resolver()
+                        .resolve(
+                                Map.of(
+                                        "bucket", "legacy",
+                                        "accessKeyId", "AKIAEXAMPLE",
+                                        "secretAccessKey", "shh"));
+
+        assertEquals("legacy", config.bucket());
+    }
+
+    @Test
+    void rejectsUnknownDisabledOrWrongTypeConnections() {
+        when(connections.findById(1L)).thenReturn(Optional.empty());
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> resolver().resolve(Map.of("connectionId", 1L)));
+
+        when(connections.findById(2L)).thenReturn(Optional.of(s3Connection(2L, false)));
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> resolver().resolve(Map.of("connectionId", 2L)));
+
+        IntegrationConfig mcp = s3Connection(3L, true);
+        mcp.setIntegrationType(IntegrationType.MCP);
+        when(connections.findById(3L)).thenReturn(Optional.of(mcp));
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> resolver().resolve(Map.of("connectionId", 3L)));
+    }
+
+    @Test
+    void anAuthenticatedSaverMustBeAllowedToUseTheConnection() {
+        when(connections.findById(9L)).thenReturn(Optional.of(s3Connection(9L, true)));
+        User saver = new User();
+        saver.setUsername("alice");
+        SecurityContextHolder.getContext()
+                .setAuthentication(
+                        new UsernamePasswordAuthenticationToken(saver, null, java.util.List.of()));
+        when(ownership.canUse(any(), any(IntegrationConfig.class), eq(saver))).thenReturn(false);
+
+        // Denied reads the same as unknown and never echoes the connection name, so ids can't be
+        // enumerated by probing.
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> resolver().resolve(Map.of("connectionId", 9L)));
+        try {
+            resolver().resolve(Map.of("connectionId", 9L));
+        } catch (IllegalArgumentException e) {
+            org.junit.jupiter.api.Assertions.assertFalse(
+                    e.getMessage().contains("Claims bucket"),
+                    "access-denied error must not leak the connection name");
+        }
+    }
+
+    @Test
+    void backgroundSweepsWithNoUserSkipTheAccessCheck() {
+        when(connections.findById(9L)).thenReturn(Optional.of(s3Connection(9L, true)));
+
+        // No authentication in the context: resolution succeeds without consulting ownership.
+        assertEquals("inbox", resolver().resolve(Map.of("connectionId", 9L)).bucket());
+    }
+
+    private S3ConnectionResolver resolver() {
+        return new S3ConnectionResolver(connections, ownership, userService);
+    }
+
+    private static IntegrationConfig s3Connection(long id, boolean enabled) {
+        IntegrationConfig connection = new IntegrationConfig();
+        connection.setId(id);
+        connection.setIntegrationType(IntegrationType.S3);
+        connection.setName("Claims bucket");
+        connection.setEnabled(enabled);
+        connection.setConfig(
+                "{\"bucket\":\"inbox\",\"accessKeyId\":\"AKIAEXAMPLE\","
+                        + "\"secretAccessKey\":\"shh\"}");
+        return connection;
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3IntegrationValidatorTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3IntegrationValidatorTest.java
new file mode 100644
index 0000000000..4c07968807
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3IntegrationValidatorTest.java
@@ -0,0 +1,71 @@
+package stirling.software.proprietary.policy.s3;
+
+import static org.assertj.core.api.Assertions.assertThatCode;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.integration.model.IntegrationType;
+
+/**
+ * Tests for {@link S3IntegrationValidator}: the S3 connection schema fails at save time - missing
+ * credentials, bad endpoints, and private endpoints without the operator opt-in.
+ */
+class S3IntegrationValidatorTest {
+
+    @Test
+    void acceptsACompleteConnection() {
+        assertThatCode(
+                        () ->
+                                validator(false)
+                                        .validate(
+                                                Map.of(
+                                                        "bucket", "inbox",
+                                                        "accessKeyId", "AKIAEXAMPLE",
+                                                        "secretAccessKey", "shh")))
+                .doesNotThrowAnyException();
+    }
+
+    @Test
+    void rejectsMissingCredentialsOrBucket() {
+        assertThatThrownBy(() -> validator(false).validate(Map.of("bucket", "inbox")))
+                .isInstanceOf(IllegalArgumentException.class);
+        assertThatThrownBy(
+                        () ->
+                                validator(false)
+                                        .validate(
+                                                Map.of(
+                                                        "accessKeyId", "AKIAEXAMPLE",
+                                                        "secretAccessKey", "shh")))
+                .isInstanceOf(IllegalArgumentException.class);
+    }
+
+    @Test
+    void rejectsAPrivateEndpointWithoutTheOperatorOptIn() {
+        Map<String, Object> config =
+                Map.of(
+                        "bucket", "inbox",
+                        "accessKeyId", "AKIAEXAMPLE",
+                        "secretAccessKey", "shh",
+                        "endpoint", "http://localhost:9000");
+
+        assertThatThrownBy(() -> validator(false).validate(config))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("allowPrivateS3Endpoints");
+        assertThatCode(() -> validator(true).validate(config)).doesNotThrowAnyException();
+    }
+
+    @Test
+    void itOnlyClaimsTheS3Type() {
+        org.junit.jupiter.api.Assertions.assertEquals(IntegrationType.S3, validator(false).type());
+    }
+
+    private static S3IntegrationValidator validator(boolean allowPrivateEndpoints) {
+        ApplicationProperties properties = new ApplicationProperties();
+        properties.getPolicies().setAllowPrivateS3Endpoints(allowPrivateEndpoints);
+        return new S3IntegrationValidator(properties);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3TestConnections.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3TestConnections.java
new file mode 100644
index 0000000000..7649831d2a
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/S3TestConnections.java
@@ -0,0 +1,24 @@
+package stirling.software.proprietary.policy.s3;
+
+import static org.mockito.Mockito.mock;
+
+import stirling.software.proprietary.access.service.OwnershipService;
+import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
+import stirling.software.proprietary.security.service.UserService;
+
+/** Test fixtures for S3 connection plumbing shared across the policy S3 tests. */
+public final class S3TestConnections {
+
+    private S3TestConnections() {}
+
+    /**
+     * A resolver for tests whose options embed credentials directly (the legacy pass-through path),
+     * so its collaborators are never touched.
+     */
+    public static S3ConnectionResolver legacyResolver() {
+        return new S3ConnectionResolver(
+                mock(IntegrationConfigRepository.class),
+                mock(OwnershipService.class),
+                mock(UserService.class));
+    }
+}
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index cc65a78ce8..c182ce2b89 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6534,6 +6534,35 @@ title = "No components available"
 description = "GA components are available on Pay-as-you-go; a few Beta components are enterprise-only. Locked cards show an upgrade nudge."
 title = "Some components need a paid plan"
 
+[portal.connections]
+createTitle = "New S3 connection"
+delete = "Delete"
+edit = "Edit"
+editTitle = "Edit S3 connection"
+subtitle = "Reusable S3 credentials that sources and pipeline outputs connect to."
+
+[portal.connections.actions]
+new = "New connection"
+
+[portal.connections.empty]
+description = "Add an S3 connection to reuse the same bucket and credentials across sources and pipeline outputs."
+title = "No connections yet"
+
+[portal.connections.picker]
+cancel = "Cancel"
+createNew = "New connection..."
+placeholder = "Select a connection"
+save = "Save connection"
+
+[portal.connections.s3.fields]
+name = "Connection name"
+namePlaceholder = "e.g. Claims bucket"
+
+[portal.connections.table]
+bucket = "Bucket"
+name = "Name"
+region = "Region"
+
 [portal.docs.authentication]
 codeCaption = "every request"
 eyebrow = "GETTING STARTED"
@@ -7345,10 +7374,6 @@ operations_one = "Operation ({{count}})"
 operations_other = "Operations ({{count}})"
 output = "Output"
 removeStep = "Remove operation"
-s3Configure = "Configure"
-s3Done = "Done"
-s3ModalTitle = "Amazon S3 output"
-s3NotConfigured = "Not configured"
 s3PrefixHelp = "Outputs are uploaded under this key prefix."
 save = "Save changes"
 scheduleEvery = "Run every"
@@ -7991,34 +8016,29 @@ primaryNav = "Primary navigation"
 switchApp = "Switch app"
 
 [portal.sources]
-subtitle = "Reusable input connections that feed documents into Stirling. Configure a connection once, then reference it from any number of policies. Click a row for its config and which policies use it."
+subtitle = "Reusable input connections that feed documents into Stirling. Configure a source once, then reference it from any number of pipelines."
 title = "Sources"
 
 [portal.sources.actions]
 agentBuilder = "Agent Builder"
 connectSource = "Connect source"
 
+[portal.sources.builder]
+back = "Back to sources"
+cancel = "Cancel"
+create = "Create source"
+createTitle = "Connect a source"
+delete = "Delete"
+editTitle = "Edit source"
+enabled = "Enabled"
+save = "Save changes"
+
 [portal.sources.delete]
 body = "Delete \"{{name}}\"? This can't be undone. Policies that reference it would need to be updated."
 cancel = "Cancel"
 confirm = "Delete"
 title = "Delete source?"
 
-[portal.sources.detail]
-closeAriaLabel = "Close detail"
-delete = "Delete source"
-docs24h = "Last 24h"
-docs30d = "Last 30 days"
-docsTotal = "Total seen"
-docsTrend = "Documents over the last 30 days"
-documents = "Documents"
-edit = "Edit"
-notReferenced = "Not referenced by any policy, so it's safe to delete."
-pause = "Pause"
-resume = "Resume"
-subtitle = "{{type}} · {{status}}"
-usedBy = "Used by"
-
 [portal.sources.empty]
 description = "Connect a folder (and, soon, cloud storage) so your policies have somewhere to pull documents from."
 title = "No sources connected yet"
@@ -8034,10 +8054,15 @@ disabled = "Disabled"
 unused = "Unused"
 
 [portal.sources.table]
+documents = "Documents"
 source = "Source"
 status = "Status"
 usedBy = "Policies"
 
+[portal.sources.tabs]
+connections = "Connections"
+sources = "Sources"
+
 [portal.sources.types.editor]
 description = "Documents your team has processed in the editor, across policy and AI runs."
 label = "Editor"
@@ -8085,6 +8110,10 @@ label = "Access key ID"
 label = "Bucket"
 placeholder = "my-company-inbox"
 
+[portal.sources.types.s3.fields.connection]
+helperText = "The stored connection holding the bucket and credentials. Reused by every source and pipeline output that references it."
+label = "Connection"
+
 [portal.sources.types.s3.fields.endpoint]
 helperText = "Leave blank for Amazon S3. Set to use an S3-compatible service such as MinIO."
 label = "Custom endpoint"
@@ -8114,22 +8143,10 @@ label = "Secret access key"
 label = "Source"
 
 [portal.sources.wizard]
-back = "Back"
-cancel = "Cancel"
-continue = "Continue"
-editTitle = "Edit source"
 name = "Name"
 namePlaceholder = "e.g. Claims intake"
-save = "Save changes"
-subtitle = "Step {{current}} of {{total}} · {{label}}"
-title = "Connect a source"
 type = "Type"
 
-[portal.sources.wizard.steps]
-chooseType = "Choose type"
-configure = "Configure"
-review = "Review & connect"
-
 [portal.tier]
 enterprise = "Enterprise plan"
 free = "Editor plan"
diff --git a/frontend/editor/src/core/ui/Table.tsx b/frontend/editor/src/core/ui/Table.tsx
index 0a07315a3d..fcd50e5fd6 100644
--- a/frontend/editor/src/core/ui/Table.tsx
+++ b/frontend/editor/src/core/ui/Table.tsx
@@ -19,6 +19,12 @@ export interface TableProps<T> {
   rowKey: (row: T) => string;
   /** Makes rows interactive (hover + click + keyboard). */
   onRowClick?: (row: T) => void;
+  /**
+   * Per-row gate for interactivity, checked only when {@link onRowClick} is set. A row for which
+   * this returns false is inert: no click/keyboard, and not announced as a button. Defaults to
+   * all rows interactive.
+   */
+  isRowInteractive?: (row: T) => boolean;
   /** Rendered in place of the body when there are no rows. */
   empty?: ReactNode;
   className?: string;
@@ -35,6 +41,7 @@ export function Table<T>({
   rows,
   rowKey,
   onRowClick,
+  isRowInteractive,
   empty,
   className,
 }: TableProps<T>) {
@@ -66,38 +73,42 @@ export function Table<T>({
               </td>
             </tr>
           ) : (
-            rows.map((row) => (
-              <tr
-                key={rowKey(row)}
-                className={
-                  interactive
-                    ? "sui-table__row sui-table__row--interactive"
-                    : "sui-table__row"
-                }
-                onClick={onRowClick ? () => onRowClick(row) : undefined}
-                tabIndex={interactive ? 0 : undefined}
-                role={interactive ? "button" : undefined}
-                onKeyDown={
-                  interactive
-                    ? (e) => {
-                        if (e.key === "Enter" || e.key === " ") {
-                          e.preventDefault();
-                          onRowClick?.(row);
+            rows.map((row) => {
+              const rowInteractive =
+                interactive && (isRowInteractive?.(row) ?? true);
+              return (
+                <tr
+                  key={rowKey(row)}
+                  className={
+                    rowInteractive
+                      ? "sui-table__row sui-table__row--interactive"
+                      : "sui-table__row"
+                  }
+                  onClick={rowInteractive ? () => onRowClick?.(row) : undefined}
+                  tabIndex={rowInteractive ? 0 : undefined}
+                  role={rowInteractive ? "button" : undefined}
+                  onKeyDown={
+                    rowInteractive
+                      ? (e) => {
+                          if (e.key === "Enter" || e.key === " ") {
+                            e.preventDefault();
+                            onRowClick?.(row);
+                          }
                         }
-                      }
-                    : undefined
-                }
-              >
-                {columns.map((c) => (
-                  <td
-                    key={c.key}
-                    className={`sui-table__td sui-table__td--${c.align ?? "left"}`}
-                  >
-                    {c.render(row)}
-                  </td>
-                ))}
-              </tr>
-            ))
+                      : undefined
+                  }
+                >
+                  {columns.map((c) => (
+                    <td
+                      key={c.key}
+                      className={`sui-table__td sui-table__td--${c.align ?? "left"}`}
+                    >
+                      {c.render(row)}
+                    </td>
+                  ))}
+                </tr>
+              );
+            })
           )}
         </tbody>
       </table>
diff --git a/frontend/editor/src/portal/ViewRouter.tsx b/frontend/editor/src/portal/ViewRouter.tsx
index 5e6af09e38..4419455a4c 100644
--- a/frontend/editor/src/portal/ViewRouter.tsx
+++ b/frontend/editor/src/portal/ViewRouter.tsx
@@ -5,6 +5,7 @@ import { Documents } from "@portal/views/Documents";
 import { Pipelines } from "@portal/views/Pipelines";
 import { PipelineBuilder } from "@portal/views/PipelineBuilder";
 import { Sources } from "@portal/views/Sources";
+import { SourceBuilder } from "@portal/views/SourceBuilder";
 import { AgentBuilder } from "@portal/views/AgentBuilder";
 import { Policies } from "@portal/views/Policies";
 import { Components } from "@portal/views/Components";
@@ -36,6 +37,14 @@ export function ViewRouter() {
         element={<PipelineBuilder />}
       />
       <Route path={rel(VIEW_PATHS.sources)} element={<Sources />} />
+      <Route
+        path={`${rel(VIEW_PATHS.sources)}/new`}
+        element={<SourceBuilder />}
+      />
+      <Route
+        path={`${rel(VIEW_PATHS.sources)}/:id`}
+        element={<SourceBuilder />}
+      />
       <Route
         path={rel(VIEW_PATHS["agent-builder"])}
         element={<AgentBuilder />}
diff --git a/frontend/editor/src/portal/api/integrations.ts b/frontend/editor/src/portal/api/integrations.ts
new file mode 100644
index 0000000000..19f88fea29
--- /dev/null
+++ b/frontend/editor/src/portal/api/integrations.ts
@@ -0,0 +1,74 @@
+/**
+ * Integrations service layer: stored connections (S3 today; MCP/API later) that
+ * policy sources and pipeline outputs reference by id instead of embedding
+ * credentials. Secrets are write-only - reads return them masked, and sending
+ * the mask back on update keeps the stored value.
+ */
+import { apiClient } from "@portal/api/http";
+
+export type IntegrationType = "S3" | "MCP" | "API";
+export type OwnerScope = "USER" | "TEAM" | "SERVER";
+
+/** Mirrors the backend IntegrationConfigResponse; `config` values are masked. */
+export interface IntegrationConfig {
+  id: number;
+  integrationType: IntegrationType;
+  name: string;
+  scope: OwnerScope;
+  ownerUserId: number | null;
+  ownerTeamId: number | null;
+  enabled: boolean;
+  locked: boolean;
+  defaultAccess: string;
+  config: Record<string, unknown>;
+  canManage: boolean;
+  createdAt: string;
+  updatedAt: string;
+}
+
+/** Create/update body; omitted fields keep their stored values on update. */
+export interface IntegrationConfigRequest {
+  integrationType?: IntegrationType;
+  name?: string;
+  scope?: OwnerScope;
+  ownerTeamId?: number | null;
+  enabled?: boolean;
+  config?: Record<string, unknown>;
+}
+
+export async function fetchIntegrations(): Promise<IntegrationConfig[]> {
+  return apiClient.local.json<IntegrationConfig[]>("/api/v1/integrations");
+}
+
+/** The S3 connections the caller may use, for source/output pickers. */
+export async function fetchS3Connections(): Promise<IntegrationConfig[]> {
+  return (await fetchIntegrations()).filter(
+    (integration) => integration.integrationType === "S3",
+  );
+}
+
+export async function createIntegration(
+  body: IntegrationConfigRequest,
+): Promise<IntegrationConfig> {
+  return apiClient.local.json<IntegrationConfig>("/api/v1/integrations", {
+    method: "POST",
+    body,
+  });
+}
+
+export async function updateIntegration(
+  id: number,
+  body: IntegrationConfigRequest,
+): Promise<IntegrationConfig> {
+  return apiClient.local.json<IntegrationConfig>(
+    `/api/v1/integrations/${encodeURIComponent(id)}`,
+    { method: "PUT", body },
+  );
+}
+
+export async function deleteIntegration(id: number): Promise<void> {
+  await apiClient.local.json<void>(
+    `/api/v1/integrations/${encodeURIComponent(id)}`,
+    { method: "DELETE" },
+  );
+}
diff --git a/frontend/editor/src/portal/components/documents/ReviewQueue.tsx b/frontend/editor/src/portal/components/documents/ReviewQueue.tsx
index 240d61f782..2200237cf6 100644
--- a/frontend/editor/src/portal/components/documents/ReviewQueue.tsx
+++ b/frontend/editor/src/portal/components/documents/ReviewQueue.tsx
@@ -157,7 +157,7 @@ export function ReviewQueue({ documents, loading }: ReviewQueueProps) {
               <Button
                 variant="secondary"
                 onClick={() =>
-                  navigate(`${toPortalPath(VIEW_PATHS.sources)}?new`)
+                  navigate(`${toPortalPath(VIEW_PATHS.sources)}/new`)
                 }
               >
                 {t("portal.documents.queue.empty.connectSource")}
diff --git a/frontend/editor/src/portal/components/sources/ConnectWizard.stories.tsx b/frontend/editor/src/portal/components/sources/ConnectWizard.stories.tsx
deleted file mode 100644
index db647689b9..0000000000
--- a/frontend/editor/src/portal/components/sources/ConnectWizard.stories.tsx
+++ /dev/null
@@ -1,16 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { ConnectWizard } from "@portal/components/sources/ConnectWizard";
-
-const meta: Meta<typeof ConnectWizard> = {
-  title: "Portal/Sources/ConnectWizard",
-  component: ConnectWizard,
-  parameters: { layout: "fullscreen" },
-  args: { open: true, onClose: () => {}, onCreated: () => {} },
-};
-export default meta;
-type Story = StoryObj<typeof ConnectWizard>;
-
-/** Opens on the type-picker step; Continue/Back walk through the three steps. */
-export const Open: Story = {};
-
-export const Closed: Story = { args: { open: false } };
diff --git a/frontend/editor/src/portal/components/sources/ConnectWizard.test.tsx b/frontend/editor/src/portal/components/sources/ConnectWizard.test.tsx
deleted file mode 100644
index 7723b447ca..0000000000
--- a/frontend/editor/src/portal/components/sources/ConnectWizard.test.tsx
+++ /dev/null
@@ -1,192 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { fireEvent, render, screen, waitFor } from "@testing-library/react";
-import { MantineProvider } from "@mantine/core";
-import { HttpError } from "@portal/api/http";
-import { ConnectWizard } from "@portal/components/sources/ConnectWizard";
-
-function renderWithMantine(ui: React.ReactElement) {
-  return render(<MantineProvider>{ui}</MantineProvider>);
-}
-
-// Deterministic i18n: keys come back verbatim so the test never waits on the
-// async TOML backend.
-vi.mock("react-i18next", () => ({
-  useTranslation: () => ({
-    t: (key: string) => key,
-    i18n: { changeLanguage: vi.fn() },
-  }),
-}));
-
-// Mock the service layer so no real fetch is issued.
-const createSource = vi.fn();
-vi.mock("@portal/api/sources", () => ({
-  createSource: (...args: unknown[]) => createSource(...args),
-}));
-
-/** Step through the folder-source flow: choose type -> configure -> review. */
-function stepToReview() {
-  // Step 0: folder is the default-selected type. Continue.
-  fireEvent.click(screen.getByText("portal.sources.wizard.continue"));
-
-  // Step 1: fill the required name + directory fields.
-  const inputs = screen.getAllByRole("textbox");
-  // First textbox is the name field, second is the folder's directory field.
-  fireEvent.change(inputs[0], { target: { value: "Claims intake" } });
-  fireEvent.change(inputs[1], { target: { value: "/data/incoming" } });
-  fireEvent.click(screen.getByText("portal.sources.wizard.continue"));
-}
-
-describe("ConnectWizard", () => {
-  beforeEach(() => {
-    createSource.mockReset();
-  });
-
-  it("creates a folder source with the configured options", async () => {
-    createSource.mockResolvedValue({ id: "src-1" });
-    const onCreated = vi.fn();
-    const onClose = vi.fn();
-
-    renderWithMantine(
-      <ConnectWizard open onClose={onClose} onCreated={onCreated} />,
-    );
-
-    stepToReview();
-
-    // Step 2: submit via the final "connect source" action.
-    fireEvent.click(screen.getByText("portal.sources.actions.connectSource"));
-
-    await waitFor(() => {
-      expect(createSource).toHaveBeenCalledTimes(1);
-    });
-    expect(createSource).toHaveBeenCalledWith({
-      name: "Claims intake",
-      type: "folder",
-      options: {
-        directory: "/data/incoming",
-        mode: "consume",
-        recursive: "false",
-        identity: "stat",
-      },
-      enabled: true,
-    });
-    await waitFor(() => {
-      expect(onCreated).toHaveBeenCalledTimes(1);
-    });
-  });
-
-  it("creates an s3 source with a masked secret in review", async () => {
-    createSource.mockResolvedValue({ id: "src-2" });
-
-    renderWithMantine(
-      <ConnectWizard open onClose={vi.fn()} onCreated={vi.fn()} />,
-    );
-
-    // Step 0: pick the S3 type card.
-    fireEvent.click(screen.getByText("portal.sources.types.s3.label"));
-    fireEvent.click(screen.getByText("portal.sources.wizard.continue"));
-
-    // Step 1: name, bucket, credentials. The secret renders as a password
-    // input, so it is not part of the textbox roles.
-    const inputs = screen.getAllByRole("textbox") as HTMLInputElement[];
-    fireEvent.change(inputs[0], { target: { value: "Claims bucket" } });
-    fireEvent.change(inputs[1], { target: { value: "claims-inbox" } });
-    fireEvent.change(inputs[4], { target: { value: "AKIAEXAMPLE" } });
-    const secret = document.querySelector(
-      'input[type="password"]',
-    ) as HTMLInputElement;
-    fireEvent.change(secret, { target: { value: "shh-secret" } });
-    fireEvent.click(screen.getByText("portal.sources.wizard.continue"));
-
-    // Step 2: the secret is masked in review, never echoed.
-    expect(screen.queryByText("shh-secret")).not.toBeInTheDocument();
-    expect(screen.getByText("********")).toBeInTheDocument();
-
-    fireEvent.click(screen.getByText("portal.sources.actions.connectSource"));
-    await waitFor(() => {
-      expect(createSource).toHaveBeenCalledTimes(1);
-    });
-    expect(createSource).toHaveBeenCalledWith({
-      name: "Claims bucket",
-      type: "s3",
-      options: {
-        bucket: "claims-inbox",
-        region: "us-east-1",
-        prefix: "",
-        accessKeyId: "AKIAEXAMPLE",
-        secretAccessKey: "shh-secret",
-        endpoint: "",
-        mode: "consume",
-      },
-      enabled: true,
-    });
-  });
-
-  it("edits an existing source: prefilled, skips type, submits with its id", async () => {
-    createSource.mockResolvedValue({ id: "s1" });
-    const onCreated = vi.fn();
-
-    renderWithMantine(
-      <ConnectWizard
-        open
-        source={{
-          id: "s1",
-          name: "James",
-          type: "folder",
-          options: { directory: "'/data/in'", mode: "consume" },
-          enabled: true,
-        }}
-        onClose={vi.fn()}
-        onCreated={onCreated}
-      />,
-    );
-
-    // Edit opens on the configure step with name + directory prefilled.
-    const inputs = screen.getAllByRole("textbox") as HTMLInputElement[];
-    expect(inputs[0].value).toBe("James");
-    expect(inputs[1].value).toBe("'/data/in'");
-
-    // Fix the stray quotes, continue to review, save.
-    fireEvent.change(inputs[1], { target: { value: "/data/in" } });
-    fireEvent.click(screen.getByText("portal.sources.wizard.continue"));
-    fireEvent.click(screen.getByText("portal.sources.wizard.save"));
-
-    await waitFor(() => {
-      expect(createSource).toHaveBeenCalledTimes(1);
-    });
-    // Options absent from the stored source are submitted at their defaults.
-    expect(createSource).toHaveBeenCalledWith({
-      id: "s1",
-      name: "James",
-      type: "folder",
-      options: {
-        directory: "/data/in",
-        mode: "consume",
-        recursive: "false",
-        identity: "stat",
-      },
-      enabled: true,
-    });
-    await waitFor(() => {
-      expect(onCreated).toHaveBeenCalledTimes(1);
-    });
-  });
-
-  it("renders the inline error message when create fails", async () => {
-    createSource.mockRejectedValue(
-      new HttpError(400, "Bad Request", {
-        detail: "Directory is not readable",
-      }),
-    );
-
-    renderWithMantine(
-      <ConnectWizard open onClose={vi.fn()} onCreated={vi.fn()} />,
-    );
-
-    stepToReview();
-    fireEvent.click(screen.getByText("portal.sources.actions.connectSource"));
-
-    expect(
-      await screen.findByText("Directory is not readable"),
-    ).toBeInTheDocument();
-  });
-});
diff --git a/frontend/editor/src/portal/components/sources/ConnectWizard.tsx b/frontend/editor/src/portal/components/sources/ConnectWizard.tsx
deleted file mode 100644
index c284c24655..0000000000
--- a/frontend/editor/src/portal/components/sources/ConnectWizard.tsx
+++ /dev/null
@@ -1,298 +0,0 @@
-import { useEffect, useState } from "react";
-import { useTranslation } from "react-i18next";
-import {
-  Banner,
-  Button,
-  FormField,
-  Input,
-  Modal,
-  Select,
-  StatTile,
-} from "@app/ui";
-import { errorMessage } from "@portal/api/http";
-import { createSource, type Source } from "@portal/api/sources";
-import { creatableSourceTypes } from "@portal/components/sources/creatableSourceTypes";
-import {
-  defaultOptions,
-  sourceTypeMeta,
-  type CreatableSourceType,
-} from "@portal/components/sources/sourceTypes";
-import "@portal/views/Sources.css";
-
-const OFFERED_TYPES = creatableSourceTypes();
-const DEFAULT_TYPE = OFFERED_TYPES[0];
-
-/** Wizard steps. Editing skips type selection (the type is fixed once created). */
-type StepId = "type" | "configure" | "review";
-const CREATE_STEPS: StepId[] = ["type", "configure", "review"];
-const EDIT_STEPS: StepId[] = ["configure", "review"];
-
-interface ConnectWizardProps {
-  open: boolean;
-  onClose: () => void;
-  /** Called after a source is created or updated so the page can refetch. */
-  onCreated: () => void;
-  /** When set, the wizard edits this existing source instead of creating one. */
-  source?: Source;
-}
-
-/** The creatable-type metadata for a source's stored type, falling back to the first offered. */
-function typeFor(type: string | undefined): CreatableSourceType {
-  return OFFERED_TYPES.find((t) => t.type === type) ?? DEFAULT_TYPE;
-}
-
-/** Source options coerced to strings for the form, defaulted from the type's fields. */
-function optionsFor(
-  type: CreatableSourceType,
-  options: Record<string, unknown> | undefined,
-): Record<string, string> {
-  const out = defaultOptions(type);
-  for (const [key, value] of Object.entries(options ?? {})) {
-    out[key] = value == null ? "" : String(value);
-  }
-  return out;
-}
-
-/**
- * Guided flow for connecting a source (choose type -> configure -> review) or
- * editing an existing one (configure -> review, type fixed). On submit a blank
- * id creates and a set id updates, matching the backend's POST contract.
- */
-export function ConnectWizard({
-  open,
-  onClose,
-  onCreated,
-  source,
-}: ConnectWizardProps) {
-  const { t } = useTranslation();
-  const isEdit = source !== undefined;
-  const steps = isEdit ? EDIT_STEPS : CREATE_STEPS;
-
-  const [stepIndex, setStepIndex] = useState(0);
-  const [type, setType] = useState<CreatableSourceType>(() =>
-    typeFor(source?.type),
-  );
-  const [name, setName] = useState(source?.name ?? "");
-  const [options, setOptions] = useState<Record<string, string>>(() =>
-    optionsFor(typeFor(source?.type), source?.options),
-  );
-  const [submitting, setSubmitting] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  // Re-seed the form whenever the wizard opens (or its target source changes) so
-  // editing prefills the current config and a reopened create starts clean.
-  useEffect(() => {
-    if (!open) return;
-    const ct = typeFor(source?.type);
-    setStepIndex(0);
-    setType(ct);
-    setName(source?.name ?? "");
-    setOptions(optionsFor(ct, source?.options));
-    setSubmitting(false);
-    setError(null);
-  }, [open, source]);
-
-  const stepId = steps[stepIndex];
-  const isLast = stepIndex === steps.length - 1;
-
-  function chooseType(next: CreatableSourceType) {
-    setType(next);
-    setOptions(defaultOptions(next));
-  }
-
-  const requiredFilled = type.fields.every(
-    (f) => !f.required || (options[f.key] ?? "").trim() !== "",
-  );
-  const canContinue =
-    stepId === "configure" ? name.trim() !== "" && requiredFilled : true;
-
-  async function advance() {
-    if (!isLast) {
-      setStepIndex((i) => i + 1);
-      return;
-    }
-    setSubmitting(true);
-    setError(null);
-    try {
-      const fields = {
-        name: name.trim(),
-        type: type.type,
-        options,
-        enabled: source?.enabled ?? true,
-      };
-      await createSource(isEdit ? { ...fields, id: source.id } : fields);
-      onCreated();
-      onClose();
-    } catch (e) {
-      setError(errorMessage(e));
-    } finally {
-      setSubmitting(false);
-    }
-  }
-
-  const stepLabels: Record<StepId, string> = {
-    type: t("portal.sources.wizard.steps.chooseType"),
-    configure: t("portal.sources.wizard.steps.configure"),
-    review: t("portal.sources.wizard.steps.review"),
-  };
-
-  return (
-    <Modal
-      open={open}
-      onClose={onClose}
-      width="lg"
-      title={
-        isEdit
-          ? t("portal.sources.wizard.editTitle")
-          : t("portal.sources.wizard.title")
-      }
-      subtitle={t("portal.sources.wizard.subtitle", {
-        current: stepIndex + 1,
-        total: steps.length,
-        label: stepLabels[stepId],
-      })}
-      footer={
-        <div className="portal-sources__wizard-footer">
-          <Button
-            variant="tertiary"
-            size="sm"
-            disabled={submitting}
-            onClick={() =>
-              stepIndex === 0 ? onClose() : setStepIndex((i) => i - 1)
-            }
-          >
-            {stepIndex === 0
-              ? t("portal.sources.wizard.cancel")
-              : t("portal.sources.wizard.back")}
-          </Button>
-          <Button
-            size="sm"
-            onClick={advance}
-            loading={submitting}
-            disabled={!canContinue}
-            rightSection={!isLast ? <span aria-hidden>→</span> : undefined}
-          >
-            {!isLast
-              ? t("portal.sources.wizard.continue")
-              : isEdit
-                ? t("portal.sources.wizard.save")
-                : t("portal.sources.actions.connectSource")}
-          </Button>
-        </div>
-      }
-    >
-      <ol className="portal-sources__steps" aria-hidden>
-        {steps.map((id, i) => (
-          <li
-            key={id}
-            className={
-              "portal-sources__step" +
-              (i === stepIndex ? " is-active" : i < stepIndex ? " is-done" : "")
-            }
-          >
-            <span className="portal-sources__step-mark">
-              {i < stepIndex ? "✓" : i + 1}
-            </span>
-            {stepLabels[id]}
-          </li>
-        ))}
-      </ol>
-
-      {stepId === "type" && (
-        <div className="portal-sources__type-grid">
-          {OFFERED_TYPES.map((ct) => (
-            <Button
-              key={ct.type}
-              variant="tertiary"
-              className={
-                "portal-sources__type-card" +
-                (type.type === ct.type ? " is-selected" : "")
-              }
-              onClick={() => chooseType(ct)}
-            >
-              <span className="portal-sources__type-icon" aria-hidden>
-                {sourceTypeMeta(ct.type).icon}
-              </span>
-              <span className="portal-sources__type-name">
-                {t(ct.labelKey)}
-              </span>
-            </Button>
-          ))}
-        </div>
-      )}
-
-      {stepId === "configure" && (
-        <div className="portal-sources__wizard-body">
-          <FormField label={t("portal.sources.wizard.name")} required>
-            <Input
-              value={name}
-              placeholder={t("portal.sources.wizard.namePlaceholder")}
-              onChange={(e) => setName(e.target.value)}
-            />
-          </FormField>
-          {type.fields.map((field) => (
-            <FormField
-              key={field.key}
-              label={t(field.labelKey)}
-              helperText={
-                field.helperTextKey ? t(field.helperTextKey) : undefined
-              }
-              required={field.required}
-            >
-              {field.control === "select" ? (
-                <Select
-                  value={options[field.key] ?? ""}
-                  options={(field.options ?? []).map((o) => ({
-                    value: o.value,
-                    label: t(o.labelKey),
-                  }))}
-                  onChange={(value) =>
-                    setOptions((o) => ({ ...o, [field.key]: value ?? "" }))
-                  }
-                />
-              ) : (
-                <Input
-                  type={field.control === "password" ? "password" : undefined}
-                  value={options[field.key] ?? ""}
-                  placeholder={
-                    field.placeholderKey ? t(field.placeholderKey) : undefined
-                  }
-                  onChange={(e) =>
-                    setOptions((o) => ({ ...o, [field.key]: e.target.value }))
-                  }
-                />
-              )}
-            </FormField>
-          ))}
-        </div>
-      )}
-
-      {stepId === "review" && (
-        <div className="portal-sources__wizard-body">
-          <div className="portal-sources__stat-grid">
-            <StatTile
-              label={t("portal.sources.wizard.name")}
-              value={name || "—"}
-            />
-            <StatTile
-              label={t("portal.sources.wizard.type")}
-              value={t(type.labelKey)}
-            />
-            {type.fields.map((field) => (
-              <StatTile
-                key={field.key}
-                label={t(field.labelKey)}
-                value={
-                  field.control === "password" && options[field.key]
-                    ? "********"
-                    : options[field.key] || "—"
-                }
-              />
-            ))}
-          </div>
-          {error && <Banner tone="danger" description={error} />}
-        </div>
-      )}
-    </Modal>
-  );
-}
diff --git a/frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx b/frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx
new file mode 100644
index 0000000000..938dfa832b
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx
@@ -0,0 +1,82 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { HttpError } from "@portal/api/http";
+import { ConnectionsTab } from "@portal/components/sources/ConnectionsTab";
+import type { IntegrationConfig } from "@portal/api/integrations";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: MantineProvider });
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+const fetchS3Connections = vi.fn();
+const deleteIntegration = vi.fn();
+vi.mock("@portal/api/integrations", () => ({
+  fetchS3Connections: () => fetchS3Connections(),
+  deleteIntegration: (id: number) => deleteIntegration(id),
+  createIntegration: vi.fn(),
+  updateIntegration: vi.fn(),
+}));
+
+const CONNECTION = {
+  id: 5,
+  integrationType: "S3",
+  name: "Claims bucket",
+  config: { bucket: "inbox", region: "us-east-1" },
+  canManage: true,
+} as unknown as IntegrationConfig;
+
+describe("ConnectionsTab", () => {
+  beforeEach(() => {
+    fetchS3Connections.mockReset();
+    deleteIntegration.mockReset();
+    deleteIntegration.mockResolvedValue(undefined);
+  });
+
+  it("shows the empty state when there are no connections", async () => {
+    fetchS3Connections.mockResolvedValue([]);
+    render(<ConnectionsTab />);
+    expect(
+      await screen.findByText("portal.connections.empty.title"),
+    ).toBeInTheDocument();
+  });
+
+  it("lists connections and deletes one", async () => {
+    fetchS3Connections.mockResolvedValueOnce([CONNECTION]);
+    fetchS3Connections.mockResolvedValueOnce([]);
+    render(<ConnectionsTab />);
+
+    expect(await screen.findByText("Claims bucket")).toBeInTheDocument();
+    fireEvent.click(screen.getByText("portal.connections.delete"));
+    await waitFor(() => expect(deleteIntegration).toHaveBeenCalledWith(5));
+  });
+
+  it("surfaces the 409 when deleting a connection still in use", async () => {
+    fetchS3Connections.mockResolvedValue([CONNECTION]);
+    deleteIntegration.mockRejectedValue(
+      new HttpError(409, "Conflict", {
+        detail: "Integration is in use by: source 'Claims intake'",
+      }),
+    );
+    render(<ConnectionsTab />);
+
+    await screen.findByText("Claims bucket");
+    fireEvent.click(screen.getByText("portal.connections.delete"));
+    expect(
+      await screen.findByText(
+        "Integration is in use by: source 'Claims intake'",
+      ),
+    ).toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/components/sources/ConnectionsTab.tsx b/frontend/editor/src/portal/components/sources/ConnectionsTab.tsx
new file mode 100644
index 0000000000..136f557032
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionsTab.tsx
@@ -0,0 +1,186 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import AddRoundedIcon from "@mui/icons-material/AddRounded";
+import {
+  Banner,
+  Button,
+  EmptyState,
+  Skeleton,
+  Table,
+  type TableColumn,
+} from "@app/ui";
+import { errorMessage } from "@portal/api/http";
+import {
+  deleteIntegration,
+  fetchS3Connections,
+  type IntegrationConfig,
+} from "@portal/api/integrations";
+import { SourcesIcon } from "@portal/components/icons";
+import { S3ConnectionModal } from "@portal/components/sources/S3ConnectionModal";
+
+/**
+ * The Connections tab of the Sources page: stored S3 connections that sources
+ * and pipeline outputs reference by id. Create/edit go through the shared
+ * {@link S3ConnectionModal}; deleting one the backend still references returns a
+ * 409, surfaced inline.
+ */
+export function ConnectionsTab() {
+  const { t } = useTranslation();
+  const [connections, setConnections] = useState<IntegrationConfig[] | null>(
+    null,
+  );
+  const [modalOpen, setModalOpen] = useState(false);
+  const [editing, setEditing] = useState<IntegrationConfig | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const refresh = useCallback(async () => {
+    try {
+      setConnections(await fetchS3Connections());
+    } catch (e) {
+      setError(errorMessage(e));
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  function openCreate() {
+    setEditing(null);
+    setModalOpen(true);
+  }
+
+  function openEdit(connection: IntegrationConfig) {
+    setEditing(connection);
+    setModalOpen(true);
+  }
+
+  async function remove(connection: IntegrationConfig) {
+    if (busy) return;
+    setBusy(true);
+    setError(null);
+    try {
+      await deleteIntegration(connection.id);
+      await refresh();
+    } catch (e) {
+      setError(errorMessage(e));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  const columns = useMemo<TableColumn<IntegrationConfig>[]>(
+    () => [
+      {
+        key: "name",
+        header: t("portal.connections.table.name"),
+        render: (c) => <strong>{c.name}</strong>,
+      },
+      {
+        key: "bucket",
+        header: t("portal.connections.table.bucket"),
+        render: (c) => (
+          <span className="portal-sources__connections-bucket">
+            {String(c.config?.bucket ?? "")}
+          </span>
+        ),
+      },
+      {
+        key: "region",
+        header: t("portal.connections.table.region"),
+        render: (c) => String(c.config?.region ?? ""),
+      },
+      {
+        key: "actions",
+        header: "",
+        align: "right",
+        render: (c) =>
+          c.canManage ? (
+            <span className="portal-sources__connections-actions">
+              <Button
+                variant="tertiary"
+                size="sm"
+                disabled={busy}
+                onClick={() => openEdit(c)}
+              >
+                {t("portal.connections.edit")}
+              </Button>
+              <Button
+                variant="tertiary"
+                size="sm"
+                accent="danger"
+                disabled={busy}
+                onClick={() => void remove(c)}
+              >
+                {t("portal.connections.delete")}
+              </Button>
+            </span>
+          ) : null,
+      },
+    ],
+    // remove/openEdit are stable enough for this admin surface; busy gates them.
+    [t, busy],
+  );
+
+  const isLoading = connections === null;
+  const isEmpty = connections !== null && connections.length === 0;
+
+  return (
+    <section className="portal-sources__connections">
+      <div className="portal-sources__connections-head">
+        <p className="portal-sources__connections-sub">
+          {t("portal.connections.subtitle")}
+        </p>
+        <Button
+          onClick={openCreate}
+          leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
+        >
+          {t("portal.connections.actions.new")}
+        </Button>
+      </div>
+
+      {error && <Banner tone="danger" description={error} />}
+
+      {isLoading && (
+        <div className="portal-sources__table-skeleton" aria-hidden>
+          {Array.from({ length: 3 }).map((_, i) => (
+            <Skeleton key={i} height="3rem" />
+          ))}
+        </div>
+      )}
+
+      {isEmpty && (
+        <EmptyState
+          icon={<SourcesIcon size={28} />}
+          title={t("portal.connections.empty.title")}
+          description={t("portal.connections.empty.description")}
+          actions={
+            <Button
+              onClick={openCreate}
+              leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
+            >
+              {t("portal.connections.actions.new")}
+            </Button>
+          }
+        />
+      )}
+
+      {connections !== null && connections.length > 0 && (
+        <Table<IntegrationConfig>
+          className="portal-sources__connections-table"
+          columns={columns}
+          rows={connections}
+          rowKey={(c) => String(c.id)}
+        />
+      )}
+
+      <S3ConnectionModal
+        open={modalOpen}
+        connection={editing}
+        onClose={() => setModalOpen(false)}
+        onSaved={() => void refresh()}
+      />
+    </section>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionForm.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionForm.tsx
new file mode 100644
index 0000000000..0158025d83
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/S3ConnectionForm.tsx
@@ -0,0 +1,116 @@
+import { useTranslation } from "react-i18next";
+import { FormField, Input } from "@app/ui";
+
+/**
+ * The connection-level S3 fields (per-use settings like prefix/mode live on the
+ * source or output referencing the connection). Secrets are write-only: when
+ * editing, the backend returns them masked and keeps the stored value if the
+ * mask is sent back unchanged.
+ */
+export interface S3ConnectionFormValues {
+  name: string;
+  bucket: string;
+  region: string;
+  endpoint: string;
+  accessKeyId: string;
+  secretAccessKey: string;
+}
+
+export const EMPTY_S3_CONNECTION: S3ConnectionFormValues = {
+  name: "",
+  bucket: "",
+  region: "us-east-1",
+  endpoint: "",
+  accessKeyId: "",
+  secretAccessKey: "",
+};
+
+export function s3ConnectionRequestConfig(
+  values: S3ConnectionFormValues,
+): Record<string, unknown> {
+  return {
+    bucket: values.bucket.trim(),
+    region: values.region.trim(),
+    endpoint: values.endpoint.trim(),
+    accessKeyId: values.accessKeyId.trim(),
+    secretAccessKey: values.secretAccessKey,
+  };
+}
+
+export function s3ConnectionFormValid(values: S3ConnectionFormValues): boolean {
+  return (
+    values.name.trim() !== "" &&
+    values.bucket.trim() !== "" &&
+    values.accessKeyId.trim() !== "" &&
+    values.secretAccessKey.trim() !== ""
+  );
+}
+
+interface S3ConnectionFormProps {
+  values: S3ConnectionFormValues;
+  onChange: (values: S3ConnectionFormValues) => void;
+}
+
+export function S3ConnectionForm({ values, onChange }: S3ConnectionFormProps) {
+  const { t } = useTranslation();
+  const set = (key: keyof S3ConnectionFormValues, value: string) =>
+    onChange({ ...values, [key]: value });
+
+  return (
+    <div className="portal-sources__connection-form">
+      <FormField label={t("portal.connections.s3.fields.name")} required>
+        <Input
+          value={values.name}
+          placeholder={t("portal.connections.s3.fields.namePlaceholder")}
+          onChange={(e) => set("name", e.target.value)}
+        />
+      </FormField>
+      <FormField
+        label={t("portal.sources.types.s3.fields.bucket.label")}
+        required
+      >
+        <Input
+          value={values.bucket}
+          placeholder="my-company-inbox"
+          onChange={(e) => set("bucket", e.target.value)}
+        />
+      </FormField>
+      <FormField label={t("portal.sources.types.s3.fields.region.label")}>
+        <Input
+          value={values.region}
+          placeholder="us-east-1"
+          onChange={(e) => set("region", e.target.value)}
+        />
+      </FormField>
+      <FormField
+        label={t("portal.sources.types.s3.fields.accessKeyId.label")}
+        required
+      >
+        <Input
+          value={values.accessKeyId}
+          onChange={(e) => set("accessKeyId", e.target.value)}
+        />
+      </FormField>
+      <FormField
+        label={t("portal.sources.types.s3.fields.secretAccessKey.label")}
+        required
+      >
+        <Input
+          type="password"
+          value={values.secretAccessKey}
+          onChange={(e) => set("secretAccessKey", e.target.value)}
+        />
+      </FormField>
+      <FormField
+        label={t("portal.sources.types.s3.fields.endpoint.label")}
+        helperText={t("portal.sources.types.s3.fields.endpoint.helperText")}
+      >
+        <Input
+          value={values.endpoint}
+          placeholder="https://s3.example.com"
+          onChange={(e) => set("endpoint", e.target.value)}
+        />
+      </FormField>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionModal.test.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionModal.test.tsx
new file mode 100644
index 0000000000..e052243fe9
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/S3ConnectionModal.test.tsx
@@ -0,0 +1,131 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { S3ConnectionModal } from "@portal/components/sources/S3ConnectionModal";
+import type { IntegrationConfig } from "@portal/api/integrations";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: MantineProvider });
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+const createIntegration = vi.fn();
+const updateIntegration = vi.fn();
+vi.mock("@portal/api/integrations", () => ({
+  createIntegration: (...a: unknown[]) => createIntegration(...a),
+  updateIntegration: (...a: unknown[]) => updateIntegration(...a),
+}));
+
+function setField(labelPattern: RegExp, value: string) {
+  fireEvent.change(screen.getByLabelText(labelPattern), { target: { value } });
+}
+
+describe("S3ConnectionModal", () => {
+  beforeEach(() => {
+    createIntegration.mockReset();
+    updateIntegration.mockReset();
+  });
+
+  it("creates a team-scoped connection from the entered fields", async () => {
+    createIntegration.mockResolvedValue({ id: 5, name: "Claims bucket" });
+    const onSaved = vi.fn();
+    const onClose = vi.fn();
+    render(<S3ConnectionModal open onClose={onClose} onSaved={onSaved} />);
+
+    setField(/portal\.connections\.s3\.fields\.name/, "Claims bucket");
+    setField(/portal\.sources\.types\.s3\.fields\.bucket\.label/, "inbox");
+    setField(/portal\.sources\.types\.s3\.fields\.accessKeyId\.label/, "AKIA");
+    setField(
+      /portal\.sources\.types\.s3\.fields\.secretAccessKey\.label/,
+      "shh",
+    );
+    fireEvent.click(screen.getByText("portal.connections.picker.save"));
+
+    await waitFor(() => expect(createIntegration).toHaveBeenCalledTimes(1));
+    expect(createIntegration).toHaveBeenCalledWith({
+      integrationType: "S3",
+      name: "Claims bucket",
+      scope: "TEAM",
+      config: {
+        bucket: "inbox",
+        region: "us-east-1",
+        endpoint: "",
+        accessKeyId: "AKIA",
+        secretAccessKey: "shh",
+      },
+    });
+    await waitFor(() => expect(onSaved).toHaveBeenCalledTimes(1));
+    expect(onClose).toHaveBeenCalled();
+  });
+
+  it("round-trips a masked secret unchanged on edit (keeps the stored value)", async () => {
+    updateIntegration.mockResolvedValue({ id: 5, name: "Claims bucket" });
+    // The API returns secrets masked; the modal must resend the sentinel verbatim
+    // so the backend keeps the stored secret rather than overwriting it.
+    const connection = {
+      id: 5,
+      integrationType: "S3",
+      name: "Claims bucket",
+      config: {
+        bucket: "inbox",
+        region: "us-east-1",
+        accessKeyId: "AKIA",
+        secretAccessKey: "********",
+      },
+      canManage: true,
+    } as unknown as IntegrationConfig;
+
+    render(
+      <S3ConnectionModal
+        open
+        connection={connection}
+        onClose={vi.fn()}
+        onSaved={vi.fn()}
+      />,
+    );
+
+    const secret = screen.getByLabelText(
+      /portal\.sources\.types\.s3\.fields\.secretAccessKey\.label/,
+    ) as HTMLInputElement;
+    expect(secret.value).toBe("********");
+    // Change only the name; leave the masked secret untouched.
+    setField(/portal\.connections\.s3\.fields\.name/, "Renamed bucket");
+    fireEvent.click(screen.getByText("portal.connections.picker.save"));
+
+    await waitFor(() => expect(updateIntegration).toHaveBeenCalledTimes(1));
+    expect(updateIntegration).toHaveBeenCalledWith(
+      5,
+      expect.objectContaining({
+        name: "Renamed bucket",
+        config: expect.objectContaining({ secretAccessKey: "********" }),
+      }),
+    );
+  });
+
+  it("keeps save disabled until the required fields are present", () => {
+    render(<S3ConnectionModal open onClose={vi.fn()} onSaved={vi.fn()} />);
+    const save = () =>
+      screen.getByText("portal.connections.picker.save").closest("button");
+
+    expect(save()).toBeDisabled();
+    setField(/portal\.connections\.s3\.fields\.name/, "Only a name");
+    expect(save()).toBeDisabled();
+    setField(/portal\.sources\.types\.s3\.fields\.bucket\.label/, "inbox");
+    setField(/portal\.sources\.types\.s3\.fields\.accessKeyId\.label/, "AKIA");
+    setField(
+      /portal\.sources\.types\.s3\.fields\.secretAccessKey\.label/,
+      "shh",
+    );
+    expect(save()).not.toBeDisabled();
+  });
+});
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionModal.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionModal.tsx
new file mode 100644
index 0000000000..c4e649df4e
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/S3ConnectionModal.tsx
@@ -0,0 +1,127 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Banner, Button, Modal } from "@app/ui";
+import { errorMessage } from "@portal/api/http";
+import {
+  createIntegration,
+  updateIntegration,
+  type IntegrationConfig,
+} from "@portal/api/integrations";
+import {
+  EMPTY_S3_CONNECTION,
+  S3ConnectionForm,
+  s3ConnectionFormValid,
+  s3ConnectionRequestConfig,
+  type S3ConnectionFormValues,
+} from "@portal/components/sources/S3ConnectionForm";
+
+/**
+ * The one place S3 connections are created and edited. Launched from the
+ * Connections tab, the source builder's connection picker, and the pipeline
+ * builder output - so connection setup is always a modal, never inline splat.
+ * Saving validates backend-side (schema, SSRF, credentials); on edit the secret
+ * arrives masked and round-trips unchanged to keep the stored value.
+ */
+interface S3ConnectionModalProps {
+  open: boolean;
+  /** When set, edit this connection; otherwise create a new one. */
+  connection?: IntegrationConfig | null;
+  onClose: () => void;
+  /** The saved connection, so callers can select or refresh it. */
+  onSaved: (connection: IntegrationConfig) => void;
+}
+
+export function S3ConnectionModal({
+  open,
+  connection,
+  onClose,
+  onSaved,
+}: S3ConnectionModalProps) {
+  const { t } = useTranslation();
+  const [form, setForm] = useState<S3ConnectionFormValues>(EMPTY_S3_CONNECTION);
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const isEdit = Boolean(connection);
+
+  // Seed the form each time the modal opens (or its target changes).
+  useEffect(() => {
+    if (!open) return;
+    if (connection) {
+      const config = connection.config ?? {};
+      setForm({
+        name: connection.name,
+        bucket: String(config.bucket ?? ""),
+        region: String(config.region ?? "us-east-1"),
+        endpoint: String(config.endpoint ?? ""),
+        accessKeyId: String(config.accessKeyId ?? ""),
+        secretAccessKey: String(config.secretAccessKey ?? ""),
+      });
+    } else {
+      setForm(EMPTY_S3_CONNECTION);
+    }
+    setError(null);
+  }, [open, connection]);
+
+  async function save() {
+    if (saving || !s3ConnectionFormValid(form)) return;
+    setSaving(true);
+    setError(null);
+    try {
+      const saved = connection
+        ? await updateIntegration(connection.id, {
+            name: form.name.trim(),
+            config: s3ConnectionRequestConfig(form),
+          })
+        : // TEAM scope suits the team-based portal (the backend defaults the team to the
+          // caller's own). A teamless single-operator self-hosted deployment would need a
+          // USER/SERVER scope choice here - follow-up if the portal ships there.
+          await createIntegration({
+            integrationType: "S3",
+            name: form.name.trim(),
+            scope: "TEAM",
+            config: s3ConnectionRequestConfig(form),
+          });
+      onSaved(saved);
+      onClose();
+    } catch (e) {
+      setError(errorMessage(e));
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  return (
+    <Modal
+      open={open}
+      onClose={onClose}
+      title={t(
+        isEdit
+          ? "portal.connections.editTitle"
+          : "portal.connections.createTitle",
+      )}
+      footer={
+        <div className="portal-sources__connection-create-actions">
+          <Button
+            variant="tertiary"
+            size="sm"
+            disabled={saving}
+            onClick={onClose}
+          >
+            {t("portal.connections.picker.cancel")}
+          </Button>
+          <Button
+            size="sm"
+            loading={saving}
+            disabled={!s3ConnectionFormValid(form)}
+            onClick={() => void save()}
+          >
+            {t("portal.connections.picker.save")}
+          </Button>
+        </div>
+      }
+    >
+      <S3ConnectionForm values={form} onChange={setForm} />
+      {error && <Banner tone="danger" description={error} />}
+    </Modal>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx
new file mode 100644
index 0000000000..8800fdfd15
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx
@@ -0,0 +1,72 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { S3ConnectionPicker } from "@portal/components/sources/S3ConnectionPicker";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: MantineProvider });
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+const fetchS3Connections = vi.fn();
+const createIntegration = vi.fn();
+vi.mock("@portal/api/integrations", () => ({
+  fetchS3Connections: () => fetchS3Connections(),
+  createIntegration: (...a: unknown[]) => createIntegration(...a),
+  updateIntegration: vi.fn(),
+}));
+
+describe("S3ConnectionPicker", () => {
+  beforeEach(() => {
+    fetchS3Connections.mockReset();
+    fetchS3Connections.mockResolvedValue([]);
+    createIntegration.mockReset();
+  });
+
+  it("creates a connection inline and selects it", async () => {
+    createIntegration.mockResolvedValue({ id: 7, name: "New bucket" });
+    const onChange = vi.fn();
+    render(<S3ConnectionPicker value="" onChange={onChange} />);
+
+    fireEvent.click(
+      await screen.findByText("portal.connections.picker.createNew"),
+    );
+    fireEvent.change(
+      screen.getByLabelText(/portal\.connections\.s3\.fields\.name/),
+      { target: { value: "New bucket" } },
+    );
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.sources\.types\.s3\.fields\.bucket\.label/,
+      ),
+      { target: { value: "inbox" } },
+    );
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.sources\.types\.s3\.fields\.accessKeyId\.label/,
+      ),
+      { target: { value: "AKIA" } },
+    );
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.sources\.types\.s3\.fields\.secretAccessKey\.label/,
+      ),
+      { target: { value: "shh" } },
+    );
+    fireEvent.click(screen.getByText("portal.connections.picker.save"));
+
+    await waitFor(() => expect(createIntegration).toHaveBeenCalledTimes(1));
+    // The newly created connection's id is selected in the parent.
+    await waitFor(() => expect(onChange).toHaveBeenCalledWith("7"));
+  });
+});
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx
new file mode 100644
index 0000000000..58b559e23b
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx
@@ -0,0 +1,71 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Banner, Button, Select } from "@app/ui";
+import { errorMessage } from "@portal/api/http";
+import {
+  fetchS3Connections,
+  type IntegrationConfig,
+} from "@portal/api/integrations";
+import { S3ConnectionModal } from "@portal/components/sources/S3ConnectionModal";
+
+/**
+ * Selects a stored S3 connection by id. Creating a new one opens the shared
+ * connection modal (saved immediately and validated backend-side), so the
+ * parent only ever sees a real connection id.
+ */
+interface S3ConnectionPickerProps {
+  value: string;
+  onChange: (connectionId: string) => void;
+}
+
+export function S3ConnectionPicker({
+  value,
+  onChange,
+}: S3ConnectionPickerProps) {
+  const { t } = useTranslation();
+  const [connections, setConnections] = useState<IntegrationConfig[] | null>(
+    null,
+  );
+  const [modalOpen, setModalOpen] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    let mounted = true;
+    fetchS3Connections()
+      .then((list) => {
+        if (mounted) setConnections(list);
+      })
+      .catch((e) => {
+        if (mounted) setError(errorMessage(e));
+      });
+    return () => {
+      mounted = false;
+    };
+  }, []);
+
+  return (
+    <div className="portal-sources__connection-picker">
+      <Select
+        value={value || null}
+        placeholder={t("portal.connections.picker.placeholder")}
+        options={(connections ?? []).map((connection) => ({
+          value: String(connection.id),
+          label: connection.name,
+        }))}
+        onChange={(selected) => onChange(selected ?? "")}
+      />
+      <Button variant="tertiary" size="sm" onClick={() => setModalOpen(true)}>
+        {t("portal.connections.picker.createNew")}
+      </Button>
+      {error && <Banner tone="danger" description={error} />}
+      <S3ConnectionModal
+        open={modalOpen}
+        onClose={() => setModalOpen(false)}
+        onSaved={(created) => {
+          setConnections((list) => [...(list ?? []), created]);
+          onChange(String(created.id));
+        }}
+      />
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sources/SourceDetailCard.stories.tsx b/frontend/editor/src/portal/components/sources/SourceDetailCard.stories.tsx
deleted file mode 100644
index 118c084d14..0000000000
--- a/frontend/editor/src/portal/components/sources/SourceDetailCard.stories.tsx
+++ /dev/null
@@ -1,63 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import type { SourceView } from "@portal/api/sources";
-import { SourceDetailCard } from "@portal/components/sources/SourceDetailCard";
-import { sampleDailySeries } from "@portal/mocks/sampleDailySeries";
-
-const SAMPLE_SERIES = sampleDailySeries(330);
-
-const IN_USE: SourceView = {
-  id: "src-claims",
-  name: "Claims intake",
-  type: "folder",
-  status: "active",
-  referenceCount: 2,
-  referencingPolicies: [
-    { id: "a", name: "Security Policy" },
-    { id: "b", name: "Redaction Policy" },
-  ],
-  config: [
-    { label: "Directory", value: "/data/claims-intake" },
-    { label: "Mode", value: "consume" },
-  ],
-  docsTotal: 45230,
-  docs24h: 312,
-  docs30d: 9870,
-};
-
-const ORPHANED: SourceView = {
-  id: "src-archive",
-  name: "Archive reprocess",
-  type: "folder",
-  status: "unused",
-  referenceCount: 0,
-  referencingPolicies: [],
-  config: [{ label: "Directory", value: "/data/archive" }],
-  docsTotal: 45230,
-  docs24h: 312,
-  docs30d: 9870,
-};
-
-const meta: Meta<typeof SourceDetailCard> = {
-  title: "Portal/Sources/SourceDetailCard",
-  component: SourceDetailCard,
-  parameters: { layout: "padded" },
-  args: {
-    docSeries: SAMPLE_SERIES,
-    onClose: () => {},
-    onEdit: () => {},
-    onTogglePause: () => {},
-    onDelete: () => {},
-  },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "56rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof SourceDetailCard>;
-
-export const InUse: Story = { args: { source: IN_USE } };
-export const Orphaned: Story = { args: { source: ORPHANED } };
diff --git a/frontend/editor/src/portal/components/sources/SourceDetailCard.tsx b/frontend/editor/src/portal/components/sources/SourceDetailCard.tsx
deleted file mode 100644
index 889a129295..0000000000
--- a/frontend/editor/src/portal/components/sources/SourceDetailCard.tsx
+++ /dev/null
@@ -1,100 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { ActionIcon, Button } from "@app/ui";
-import type { SourceView } from "@portal/api/sources";
-import { SourceDetailPanel } from "@portal/components/sources/SourceDetailPanel";
-import {
-  EDITOR_SOURCE_TYPE,
-  sourceTypeMeta,
-} from "@portal/components/sources/sourceTypes";
-import "@portal/views/Sources.css";
-import CloseIcon from "@mui/icons-material/Close";
-
-interface SourceDetailCardProps {
-  source: SourceView;
-  docSeries: number[];
-  onClose: () => void;
-  onEdit: (source: SourceView) => void;
-  onTogglePause: (source: SourceView) => void;
-  onDelete: (source: SourceView) => void;
-  /** Disables the actions while a mutation is in flight. */
-  busy?: boolean;
-}
-
-/** Expanded detail for the selected source row, with edit/pause/delete actions. */
-export function SourceDetailCard({
-  source,
-  docSeries,
-  onClose,
-  onEdit,
-  onTogglePause,
-  onDelete,
-  busy = false,
-}: SourceDetailCardProps) {
-  const { t } = useTranslation();
-  const meta = sourceTypeMeta(source.type);
-  const paused = source.status === "disabled";
-  // The editor is a built-in source: it has no instance name and can't be edited/paused/deleted.
-  const isEditor = source.type === EDITOR_SOURCE_TYPE;
-  return (
-    <section className="portal-sources__expanded">
-      <header className="portal-sources__expanded-head">
-        <span
-          className={`portal-sources__type-dot portal-sources__type-dot--${meta.accent}`}
-          aria-hidden
-        >
-          {meta.icon}
-        </span>
-        <div>
-          <h2 className="portal-sources__expanded-title">
-            {isEditor ? t(meta.labelKey) : source.name}
-          </h2>
-          <span className="portal-sources__expanded-sub">
-            {t("portal.sources.detail.subtitle", {
-              type: t(meta.labelKey),
-              status: t(`portal.sources.status.${source.status}`),
-            })}
-          </span>
-        </div>
-        <ActionIcon
-          variant="tertiary"
-          className="portal-sources__expanded-close"
-          onClick={onClose}
-          aria-label={t("portal.sources.detail.closeAriaLabel")}
-        >
-          <CloseIcon />
-        </ActionIcon>
-      </header>
-
-      <SourceDetailPanel source={source} docSeries={docSeries} />
-
-      {!isEditor && (
-        <div className="portal-sources__detail-actions">
-          <Button
-            variant="secondary"
-            disabled={busy}
-            onClick={() => onEdit(source)}
-          >
-            {t("portal.sources.detail.edit")}
-          </Button>
-          <Button
-            variant="secondary"
-            disabled={busy}
-            onClick={() => onTogglePause(source)}
-          >
-            {paused
-              ? t("portal.sources.detail.resume")
-              : t("portal.sources.detail.pause")}
-          </Button>
-          <Button
-            accent="danger"
-            variant="secondary"
-            disabled={busy}
-            onClick={() => onDelete(source)}
-          >
-            {t("portal.sources.detail.delete")}
-          </Button>
-        </div>
-      )}
-    </section>
-  );
-}
diff --git a/frontend/editor/src/portal/components/sources/SourceDetailPanel.stories.tsx b/frontend/editor/src/portal/components/sources/SourceDetailPanel.stories.tsx
deleted file mode 100644
index 6118ca5730..0000000000
--- a/frontend/editor/src/portal/components/sources/SourceDetailPanel.stories.tsx
+++ /dev/null
@@ -1,59 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import type { SourceView } from "@portal/api/sources";
-import { SourceDetailPanel } from "@portal/components/sources/SourceDetailPanel";
-import { sampleDailySeries } from "@portal/mocks/sampleDailySeries";
-
-const SAMPLE_SERIES = sampleDailySeries(330);
-
-const IN_USE: SourceView = {
-  id: "src-claims",
-  name: "Claims intake",
-  type: "folder",
-  status: "active",
-  referenceCount: 2,
-  referencingPolicies: [
-    { id: "a", name: "Security Policy" },
-    { id: "b", name: "Redaction Policy" },
-  ],
-  config: [
-    { label: "Directory", value: "/data/claims-intake" },
-    { label: "Mode", value: "consume" },
-  ],
-  docsTotal: 45230,
-  docs24h: 312,
-  docs30d: 9870,
-};
-
-const ORPHANED: SourceView = {
-  id: "src-archive",
-  name: "Archive reprocess",
-  type: "folder",
-  status: "unused",
-  referenceCount: 0,
-  referencingPolicies: [],
-  config: [{ label: "Directory", value: "/data/archive" }],
-  docsTotal: 1180,
-  docs24h: 0,
-  docs30d: 0,
-};
-
-const meta: Meta<typeof SourceDetailPanel> = {
-  title: "Portal/Sources/SourceDetailPanel",
-  component: SourceDetailPanel,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "48rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof SourceDetailPanel>;
-
-export const InUse: Story = {
-  args: { source: IN_USE, docSeries: SAMPLE_SERIES },
-};
-/** A source no policy references is called out as safe to delete. */
-export const Orphaned: Story = { args: { source: ORPHANED, docSeries: [] } };
diff --git a/frontend/editor/src/portal/components/sources/SourceDetailPanel.tsx b/frontend/editor/src/portal/components/sources/SourceDetailPanel.tsx
deleted file mode 100644
index 82fd8a5b1b..0000000000
--- a/frontend/editor/src/portal/components/sources/SourceDetailPanel.tsx
+++ /dev/null
@@ -1,91 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { Chip, StatTile } from "@app/ui";
-import type { SourceView } from "@portal/api/sources";
-import { Sparkline } from "@portal/components/sources/Sparkline";
-import { EDITOR_SOURCE_TYPE } from "@portal/components/sources/sourceTypes";
-import "@portal/views/Sources.css";
-
-interface SourceDetailPanelProps {
-  source: SourceView;
-  /** The 30-day daily series for the sparkline, fetched per source when expanded. */
-  docSeries: number[];
-}
-
-/**
- * Expanded detail for a source row: its config (key/value), the documents it has
- * fed into runs, and which policies reference it (a 0-reference source is called
- * out as safe to delete).
- */
-export function SourceDetailPanel({
-  source,
-  docSeries,
-}: SourceDetailPanelProps) {
-  const { t } = useTranslation();
-  const isEditor = source.type === EDITOR_SOURCE_TYPE;
-  return (
-    <div className="portal-sources__detail">
-      {isEditor && (
-        <p className="portal-sources__muted">
-          {t("portal.sources.types.editor.description")}
-        </p>
-      )}
-
-      {source.config.length > 0 && (
-        <div className="portal-sources__stat-grid">
-          {source.config.map((row) => (
-            <StatTile key={row.label} label={row.label} value={row.value} />
-          ))}
-        </div>
-      )}
-
-      <div className="portal-sources__detail-section">
-        <span className="portal-sources__detail-heading">
-          {t("portal.sources.detail.usedBy")}
-        </span>
-        {source.referencingPolicies.length === 0 ? (
-          <p className="portal-sources__muted">
-            {t(
-              isEditor
-                ? "portal.sources.types.editor.noPolicies"
-                : "portal.sources.detail.notReferenced",
-            )}
-          </p>
-        ) : (
-          <div className="portal-sources__chips">
-            {source.referencingPolicies.map((policy) => (
-              <Chip key={policy.id} size="sm">
-                {policy.name}
-              </Chip>
-            ))}
-          </div>
-        )}
-      </div>
-
-      <div className="portal-sources__detail-section">
-        <span className="portal-sources__detail-heading">
-          {t("portal.sources.detail.documents")}
-        </span>
-        <div className="portal-sources__stat-grid">
-          <StatTile
-            label={t("portal.sources.detail.docsTotal")}
-            value={source.docsTotal.toLocaleString()}
-          />
-          <StatTile
-            label={t("portal.sources.detail.docs24h")}
-            value={source.docs24h.toLocaleString()}
-          />
-          <StatTile
-            label={t("portal.sources.detail.docs30d")}
-            value={source.docs30d.toLocaleString()}
-          />
-        </div>
-        {docSeries.length > 0 && (
-          <Sparkline
-            data={docSeries}
-            ariaLabel={t("portal.sources.detail.docsTrend")}
-          />
-        )}
-      </div>
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/sources/SourcesTable.stories.tsx b/frontend/editor/src/portal/components/sources/SourcesTable.stories.tsx
index 0a556ca63b..9fb025c7e1 100644
--- a/frontend/editor/src/portal/components/sources/SourcesTable.stories.tsx
+++ b/frontend/editor/src/portal/components/sources/SourcesTable.stories.tsx
@@ -51,14 +51,9 @@ const meta: Meta<typeof SourcesTable> = {
   title: "Portal/Sources/SourcesTable",
   component: SourcesTable,
   parameters: { layout: "padded" },
-  args: { sources: SOURCES, expandedId: null, onRowClick: () => {} },
+  args: { sources: SOURCES, onRowClick: () => {} },
 };
 export default meta;
 type Story = StoryObj<typeof SourcesTable>;
 
 export const Default: Story = {};
-
-/** A row with an open detail panel rotates its caret. */
-export const RowExpanded: Story = {
-  args: { expandedId: SOURCES[0].id },
-};
diff --git a/frontend/editor/src/portal/components/sources/SourcesTable.tsx b/frontend/editor/src/portal/components/sources/SourcesTable.tsx
index dc6daf16aa..2c4a1e826a 100644
--- a/frontend/editor/src/portal/components/sources/SourcesTable.tsx
+++ b/frontend/editor/src/portal/components/sources/SourcesTable.tsx
@@ -1,5 +1,6 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
+import ChevronRightRoundedIcon from "@mui/icons-material/ChevronRightRounded";
 import {
   Chip,
   StatusBadge,
@@ -22,16 +23,11 @@ const STATUS_TONE: Record<SourceStatus, StatusTone> = {
 
 interface SourcesTableProps {
   sources: SourceView[];
-  /** Id of the row whose detail panel is open, drives the caret state. */
-  expandedId: string | null;
+  /** Opens a source's own page. Not called for the virtual editor row. */
   onRowClick: (source: SourceView) => void;
 }
 
-export function SourcesTable({
-  sources,
-  expandedId,
-  onRowClick,
-}: SourcesTableProps) {
+export function SourcesTable({ sources, onRowClick }: SourcesTableProps) {
   const { t } = useTranslation();
   const columns = useMemo<TableColumn<SourceView>[]>(
     () => [
@@ -76,6 +72,18 @@ export function SourcesTable({
           </StatusBadge>
         ),
       },
+      {
+        key: "docs",
+        header: t("portal.sources.table.documents"),
+        align: "right",
+        render: (s) => (
+          <span
+            className={s.docsTotal === 0 ? "portal-sources__muted" : undefined}
+          >
+            {s.docsTotal.toLocaleString()}
+          </span>
+        ),
+      },
       {
         key: "referenceCount",
         header: t("portal.sources.table.usedBy"),
@@ -91,23 +99,20 @@ export function SourcesTable({
         ),
       },
       {
-        key: "expand",
+        key: "open",
         header: "",
         align: "right",
         width: "2.5rem",
-        render: (s) => (
-          <span
-            className={
-              "portal-sources__caret" + (expandedId === s.id ? " is-open" : "")
-            }
-            aria-hidden
-          >
-            ▸
-          </span>
-        ),
+        // The editor source has no page to open, so it shows no chevron.
+        render: (s) =>
+          s.type === EDITOR_SOURCE_TYPE ? null : (
+            <span className="portal-sources__caret" aria-hidden>
+              <ChevronRightRoundedIcon style={{ fontSize: "1.25rem" }} />
+            </span>
+          ),
       },
     ],
-    [expandedId, t],
+    [t],
   );
 
   return (
@@ -117,6 +122,8 @@ export function SourcesTable({
       rows={sources}
       rowKey={(s) => s.id}
       onRowClick={onRowClick}
+      // The virtual editor row has no page to open, so it's inert - not a fake button.
+      isRowInteractive={(s) => s.type !== EDITOR_SOURCE_TYPE}
     />
   );
 }
diff --git a/frontend/editor/src/portal/components/sources/Sparkline.test.tsx b/frontend/editor/src/portal/components/sources/Sparkline.test.tsx
deleted file mode 100644
index 45db5eca44..0000000000
--- a/frontend/editor/src/portal/components/sources/Sparkline.test.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { render } from "@testing-library/react";
-import { Sparkline } from "@portal/components/sources/Sparkline";
-
-function pointsOf(container: HTMLElement): string[] {
-  const poly = container.querySelector("polyline");
-  return (poly?.getAttribute("points") ?? "")
-    .trim()
-    .split(/\s+/)
-    .filter(Boolean);
-}
-
-describe("Sparkline", () => {
-  it("draws one point per value", () => {
-    const { container } = render(<Sparkline data={[1, 5, 2, 8, 3]} />);
-    expect(pointsOf(container)).toHaveLength(5);
-  });
-
-  it("renders nothing for an empty series", () => {
-    const { container } = render(<Sparkline data={[]} />);
-    expect(container.querySelector("svg")).toBeNull();
-  });
-
-  it("renders a flat finite line for an all-zero series (no divide-by-zero)", () => {
-    const { container } = render(<Sparkline data={[0, 0, 0, 0]} />);
-    const ys = pointsOf(container).map((p) => Number(p.split(",")[1]));
-    expect(ys).toHaveLength(4);
-    expect(ys.every(Number.isFinite)).toBe(true);
-    // All equal: a zero series is a single horizontal line, not NaN-laden.
-    expect(new Set(ys).size).toBe(1);
-  });
-
-  it("puts the peak value at the top of the band", () => {
-    const { container } = render(<Sparkline data={[0, 10]} height={36} />);
-    const ys = pointsOf(container).map((p) => Number(p.split(",")[1]));
-    // y grows downward in SVG, so the larger value (10) sits at the smaller y.
-    expect(ys[1]).toBeLessThan(ys[0]);
-  });
-
-  it("exposes its aria-label", () => {
-    const { container } = render(
-      <Sparkline data={[1, 2]} ariaLabel="Docs trend" />,
-    );
-    expect(container.querySelector("svg")?.getAttribute("aria-label")).toBe(
-      "Docs trend",
-    );
-  });
-});
diff --git a/frontend/editor/src/portal/components/sources/Sparkline.tsx b/frontend/editor/src/portal/components/sources/Sparkline.tsx
deleted file mode 100644
index 7877d21fd4..0000000000
--- a/frontend/editor/src/portal/components/sources/Sparkline.tsx
+++ /dev/null
@@ -1,53 +0,0 @@
-import "@portal/views/Sources.css";
-
-interface SparklineProps {
-  /** Series values, oldest first. */
-  data: number[];
-  /** Drawing height in px; the width fills the container. */
-  height?: number;
-  ariaLabel?: string;
-}
-
-/**
- * A tiny dependency-free trend line: normalises {@code data} to its own peak and draws a single
- * polyline. The viewBox is fixed while the rendered width fills the container (the stroke stays
- * crisp via non-scaling-stroke), so it adapts to any column without distorting the line weight.
- */
-export function Sparkline({ data, height = 36, ariaLabel }: SparklineProps) {
-  if (data.length === 0) {
-    return null;
-  }
-  const width = 240;
-  const pad = 3;
-  const max = Math.max(...data, 1);
-  const stepX = data.length > 1 ? width / (data.length - 1) : 0;
-  const points = data
-    .map((value, i) => {
-      const x = i * stepX;
-      const y = pad + (1 - value / max) * (height - 2 * pad);
-      return `${x.toFixed(1)},${y.toFixed(1)}`;
-    })
-    .join(" ");
-
-  return (
-    <svg
-      className="portal-sparkline"
-      width="100%"
-      height={height}
-      viewBox={`0 0 ${width} ${height}`}
-      preserveAspectRatio="none"
-      role="img"
-      aria-label={ariaLabel}
-    >
-      <polyline
-        points={points}
-        fill="none"
-        stroke="currentColor"
-        strokeWidth="1.5"
-        strokeLinejoin="round"
-        strokeLinecap="round"
-        vectorEffect="non-scaling-stroke"
-      />
-    </svg>
-  );
-}
diff --git a/frontend/editor/src/portal/components/sources/sourceTypes.ts b/frontend/editor/src/portal/components/sources/sourceTypes.ts
index a3f19b6b36..c1f6049188 100644
--- a/frontend/editor/src/portal/components/sources/sourceTypes.ts
+++ b/frontend/editor/src/portal/components/sources/sourceTypes.ts
@@ -54,7 +54,7 @@ export function sourceTypeMeta(type: string): SourceTypeMeta {
 export interface SourceFieldDef {
   key: string;
   labelKey: string;
-  control: "text" | "password" | "select";
+  control: "text" | "password" | "select" | "s3Connection";
   required?: boolean;
   placeholderKey?: string;
   helperTextKey?: string;
@@ -148,18 +148,11 @@ export const CREATABLE_SOURCE_TYPES: CreatableSourceType[] = [
     descriptionKey: "portal.sources.types.s3.description",
     fields: [
       {
-        key: "bucket",
-        labelKey: "portal.sources.types.s3.fields.bucket.label",
-        control: "text",
+        key: "connectionId",
+        labelKey: "portal.sources.types.s3.fields.connection.label",
+        control: "s3Connection",
         required: true,
-        placeholderKey: "portal.sources.types.s3.fields.bucket.placeholder",
-      },
-      {
-        key: "region",
-        labelKey: "portal.sources.types.s3.fields.region.label",
-        control: "text",
-        defaultValue: "us-east-1",
-        placeholderKey: "portal.sources.types.s3.fields.region.placeholder",
+        helperTextKey: "portal.sources.types.s3.fields.connection.helperText",
       },
       {
         key: "prefix",
@@ -168,25 +161,6 @@ export const CREATABLE_SOURCE_TYPES: CreatableSourceType[] = [
         placeholderKey: "portal.sources.types.s3.fields.prefix.placeholder",
         helperTextKey: "portal.sources.types.s3.fields.prefix.helperText",
       },
-      {
-        key: "accessKeyId",
-        labelKey: "portal.sources.types.s3.fields.accessKeyId.label",
-        control: "text",
-        required: true,
-      },
-      {
-        key: "secretAccessKey",
-        labelKey: "portal.sources.types.s3.fields.secretAccessKey.label",
-        control: "password",
-        required: true,
-      },
-      {
-        key: "endpoint",
-        labelKey: "portal.sources.types.s3.fields.endpoint.label",
-        control: "text",
-        placeholderKey: "portal.sources.types.s3.fields.endpoint.placeholder",
-        helperTextKey: "portal.sources.types.s3.fields.endpoint.helperText",
-      },
       {
         key: "mode",
         labelKey: "portal.sources.types.s3.fields.mode.label",
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.css b/frontend/editor/src/portal/views/PipelineBuilder.css
index 8fb8095b32..cef65d6e75 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.css
+++ b/frontend/editor/src/portal/views/PipelineBuilder.css
@@ -392,27 +392,3 @@
   min-width: 1.5rem;
   min-height: 1.5rem;
 }
-
-.portal-builder__s3-output {
-  display: flex;
-  align-items: center;
-  gap: 0.625rem;
-}
-
-.portal-builder__s3-summary {
-  font-size: 0.8125rem;
-  color: var(--color-text-1);
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.portal-builder__s3-summary.is-unset {
-  color: var(--color-text-4);
-}
-
-.portal-builder__s3-fields {
-  display: flex;
-  flex-direction: column;
-  gap: 0.75rem;
-}
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
index f47df5c5ca..a9a8aab0f7 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
@@ -50,6 +50,13 @@ vi.mock("@portal/api/policies", () => ({
   clearProcessedHistory: (id: string) => clearProcessedHistory(id),
 }));
 
+const fetchS3Connections = vi.fn();
+const createIntegration = vi.fn();
+vi.mock("@portal/api/integrations", () => ({
+  fetchS3Connections: () => fetchS3Connections(),
+  createIntegration: (...args: unknown[]) => createIntegration(...args),
+}));
+
 // One editable tool, Compress, so the picker and step settings have something to render.
 vi.mock("@app/contexts/ToolRegistryContext", () => {
   const compress = {
@@ -149,6 +156,9 @@ describe("PipelineBuilder", () => {
     fetchRun.mockResolvedValue({ status: "COMPLETED" });
     clearProcessedHistory.mockReset();
     clearProcessedHistory.mockResolvedValue(undefined);
+    fetchS3Connections.mockReset();
+    fetchS3Connections.mockResolvedValue([]);
+    createIntegration.mockReset();
   });
 
   it("builds a new pipeline: name it, add a tool, and save", async () => {
@@ -177,7 +187,8 @@ describe("PipelineBuilder", () => {
     expect(await screen.findByText("pipelines list")).toBeInTheDocument();
   });
 
-  it("saves an s3 output with its connection options", async () => {
+  it("saves an s3 output referencing an inline-created connection", async () => {
+    createIntegration.mockResolvedValue({ id: 12, name: "Claims bucket" });
     renderBuilder("/processor/pipelines/new");
 
     fireEvent.change(await screen.findByRole("textbox"), {
@@ -185,32 +196,55 @@ describe("PipelineBuilder", () => {
     });
     fireEvent.click(screen.getByLabelText("portal.pipelines.output.s3"));
 
-    // With s3 selected but no bucket, saving is blocked and the summary reads
-    // unconfigured; the connection fields live behind the Configure modal.
+    // With s3 selected but no connection chosen, saving is blocked. The
+    // connection picker + prefix are inline (no modal), like the folder output.
     expect(
       screen.getByText("portal.pipelines.composer.create").closest("button"),
     ).toBeDisabled();
-    expect(
-      screen.getByText("portal.pipelines.composer.s3NotConfigured"),
-    ).toBeInTheDocument();
-    fireEvent.click(screen.getByText("portal.pipelines.composer.s3Configure"));
 
-    // Textboxes: name, then the modal's bucket, region, prefix, access key id,
-    // endpoint; the secret renders as a password input outside the textbox role.
-    const inputs = screen.getAllByRole("textbox") as HTMLInputElement[];
-    fireEvent.change(inputs[1], { target: { value: "claims-processed" } });
-    fireEvent.change(inputs[3], { target: { value: "processed/" } });
-    fireEvent.change(inputs[4], { target: { value: "AKIAEXAMPLE" } });
-    const secret = document.querySelector(
-      'input[type="password"]',
-    ) as HTMLInputElement;
-    fireEvent.change(secret, { target: { value: "shh-secret" } });
-    fireEvent.click(screen.getByText("portal.pipelines.composer.s3Done"));
+    // No connections exist: create one inline from the picker. Target fields by
+    // label, not position - the picker's Mantine Select also carries an input
+    // role and would shift index-based queries.
+    fireEvent.click(
+      await screen.findByText("portal.connections.picker.createNew"),
+    );
+    fireEvent.change(
+      screen.getByLabelText(/portal\.connections\.s3\.fields\.name/),
+      { target: { value: "Claims bucket" } },
+    );
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.sources\.types\.s3\.fields\.bucket\.label/,
+      ),
+      { target: { value: "claims-processed" } },
+    );
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.sources\.types\.s3\.fields\.accessKeyId\.label/,
+      ),
+      { target: { value: "AKIAEXAMPLE" } },
+    );
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.sources\.types\.s3\.fields\.secretAccessKey\.label/,
+      ),
+      { target: { value: "shh-secret" } },
+    );
+    fireEvent.click(screen.getByText("portal.connections.picker.save"));
+    await waitFor(() => expect(createIntegration).toHaveBeenCalledTimes(1));
+    // The connection modal closes once saved and the connection is selected.
+    await waitFor(() =>
+      expect(
+        screen.queryByText("portal.connections.picker.save"),
+      ).not.toBeInTheDocument(),
+    );
 
-    // The summary now shows the configured destination.
-    expect(
-      screen.getByText("s3://claims-processed/processed/"),
-    ).toBeInTheDocument();
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.sources\.types\.s3\.fields\.prefix\.label/,
+      ),
+      { target: { value: "processed/" } },
+    );
     fireEvent.click(screen.getByText("portal.pipelines.composer.create"));
 
     await waitFor(() => expect(savePipeline).toHaveBeenCalledTimes(1));
@@ -219,12 +253,8 @@ describe("PipelineBuilder", () => {
         output: {
           type: "s3",
           options: {
-            bucket: "claims-processed",
-            region: "us-east-1",
+            connectionId: "12",
             prefix: "processed/",
-            endpoint: "",
-            accessKeyId: "AKIAEXAMPLE",
-            secretAccessKey: "shh-secret",
           },
         },
       }),
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.tsx b/frontend/editor/src/portal/views/PipelineBuilder.tsx
index 3b4c7d421d..28e040bcce 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.tsx
@@ -50,6 +50,7 @@ import {
 } from "@portal/api/pipelines";
 import { clearProcessedHistory } from "@portal/api/policies";
 import { availableOutputModes } from "@portal/components/pipelines/outputModes";
+import { S3ConnectionPicker } from "@portal/components/sources/S3ConnectionPicker";
 import { fetchSources, type SourceView } from "@portal/api/sources";
 import { EDITOR_SOURCE_TYPE } from "@portal/components/sources/sourceTypes";
 import { useAsync } from "@portal/hooks/useAsync";
@@ -64,23 +65,15 @@ type OutputMode = PipelineOutputMode;
 /** New pipelines (and specs of unoffered types) start on the first offered destination. */
 const DEFAULT_OUTPUT_MODE = availableOutputModes()[0];
 
-/** The s3 output's connection fields, mirrored from the OutputSpec options. */
+/** The s3 output's options: a stored connection reference plus the per-use prefix. */
 interface S3OutputOptions {
-  bucket: string;
-  region: string;
+  connectionId: string;
   prefix: string;
-  endpoint: string;
-  accessKeyId: string;
-  secretAccessKey: string;
 }
 
 const EMPTY_S3_OUTPUT: S3OutputOptions = {
-  bucket: "",
-  region: "us-east-1",
+  connectionId: "",
   prefix: "",
-  endpoint: "",
-  accessKeyId: "",
-  secretAccessKey: "",
 };
 type ScheduleUnit = "MINUTES" | "HOURS" | "DAYS";
 
@@ -133,18 +126,12 @@ function parseOutput(output: OutputSpec | undefined): {
     };
   }
   if (output?.type === "s3") {
-    const option = (key: keyof S3OutputOptions, fallback = "") =>
-      String(output.options?.[key] ?? fallback);
     return {
       mode: "s3",
       directory: "",
       s3: {
-        bucket: option("bucket"),
-        region: option("region", "us-east-1"),
-        prefix: option("prefix"),
-        endpoint: option("endpoint"),
-        accessKeyId: option("accessKeyId"),
-        secretAccessKey: option("secretAccessKey"),
+        connectionId: String(output.options?.connectionId ?? ""),
+        prefix: String(output.options?.prefix ?? ""),
       },
     };
   }
@@ -203,7 +190,6 @@ export function PipelineBuilder() {
   const [outputMode, setOutputMode] = useState<OutputMode>(DEFAULT_OUTPUT_MODE);
   const [outputDirectory, setOutputDirectory] = useState("");
   const [outputS3, setOutputS3] = useState<S3OutputOptions>(EMPTY_S3_OUTPUT);
-  const [s3ConfigOpen, setS3ConfigOpen] = useState(false);
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [seeded, setSeeded] = useState(false);
@@ -277,10 +263,6 @@ export function PipelineBuilder() {
     if (selected && !triggerAvailable(selected)) setTriggerType(MANUAL);
   }, [triggerType, triggers, triggerAvailable]);
 
-  function setS3Field(key: keyof S3OutputOptions, value: string) {
-    setOutputS3((current) => ({ ...current, [key]: value }));
-  }
-
   function toggleSource(sourceId: string, checked: boolean) {
     setSourceIds((ids) =>
       checked
@@ -356,10 +338,7 @@ export function PipelineBuilder() {
   const scheduleCountValid =
     triggerType !== "schedule" || Number(scheduleCount) > 0;
   const s3OutputValid =
-    outputMode !== "s3" ||
-    (outputS3.bucket.trim() !== "" &&
-      outputS3.accessKeyId.trim() !== "" &&
-      outputS3.secretAccessKey.trim() !== "");
+    outputMode !== "s3" || outputS3.connectionId.trim() !== "";
   const outputValid =
     (outputMode !== "folder" || outputDirectory.trim() !== "") && s3OutputValid;
   const canSave =
@@ -398,7 +377,7 @@ export function PipelineBuilder() {
   }
 
   const listPath = toPortalPath(VIEW_PATHS.pipelines);
-  const sourcesPath = `${toPortalPath(VIEW_PATHS.sources)}?new=1`;
+  const sourcesPath = `${toPortalPath(VIEW_PATHS.sources)}/new`;
 
   function close() {
     navigate(listPath);
@@ -774,25 +753,31 @@ export function PipelineBuilder() {
               </FormField>
             )}
             {outputMode === "s3" && (
-              <div className="portal-builder__s3-output">
-                <span
-                  className={
-                    "portal-builder__s3-summary" +
-                    (outputS3.bucket ? "" : " is-unset")
-                  }
+              <>
+                <FormField
+                  label={t("portal.sources.types.s3.fields.connection.label")}
+                  required
                 >
-                  {outputS3.bucket
-                    ? `s3://${outputS3.bucket}/${outputS3.prefix}`
-                    : t("portal.pipelines.composer.s3NotConfigured")}
-                </span>
-                <Button
-                  variant="secondary"
-                  size="sm"
-                  onClick={() => setS3ConfigOpen(true)}
+                  <S3ConnectionPicker
+                    value={outputS3.connectionId}
+                    onChange={(connectionId) =>
+                      setOutputS3((s) => ({ ...s, connectionId }))
+                    }
+                  />
+                </FormField>
+                <FormField
+                  label={t("portal.sources.types.s3.fields.prefix.label")}
+                  helperText={t("portal.pipelines.composer.s3PrefixHelp")}
                 >
-                  {t("portal.pipelines.composer.s3Configure")}
-                </Button>
-              </div>
+                  <Input
+                    value={outputS3.prefix}
+                    placeholder="processed/"
+                    onChange={(e) =>
+                      setOutputS3((s) => ({ ...s, prefix: e.target.value }))
+                    }
+                  />
+                </FormField>
+              </>
             )}
           </div>
         </div>
@@ -1006,78 +991,6 @@ export function PipelineBuilder() {
       >
         <p>{t("portal.pipelines.builder.unsavedBody")}</p>
       </Modal>
-
-      <Modal
-        open={s3ConfigOpen}
-        onClose={() => setS3ConfigOpen(false)}
-        title={t("portal.pipelines.composer.s3ModalTitle")}
-        footer={
-          <div className="portal-pipelines__composer-footer">
-            <Button size="sm" onClick={() => setS3ConfigOpen(false)}>
-              {t("portal.pipelines.composer.s3Done")}
-            </Button>
-          </div>
-        }
-      >
-        <div className="portal-builder__s3-fields">
-          <FormField
-            label={t("portal.sources.types.s3.fields.bucket.label")}
-            required
-          >
-            <Input
-              value={outputS3.bucket}
-              placeholder="my-company-inbox"
-              onChange={(e) => setS3Field("bucket", e.target.value)}
-            />
-          </FormField>
-          <FormField label={t("portal.sources.types.s3.fields.region.label")}>
-            <Input
-              value={outputS3.region}
-              placeholder="us-east-1"
-              onChange={(e) => setS3Field("region", e.target.value)}
-            />
-          </FormField>
-          <FormField
-            label={t("portal.sources.types.s3.fields.prefix.label")}
-            helperText={t("portal.pipelines.composer.s3PrefixHelp")}
-          >
-            <Input
-              value={outputS3.prefix}
-              placeholder="processed/"
-              onChange={(e) => setS3Field("prefix", e.target.value)}
-            />
-          </FormField>
-          <FormField
-            label={t("portal.sources.types.s3.fields.accessKeyId.label")}
-            required
-          >
-            <Input
-              value={outputS3.accessKeyId}
-              onChange={(e) => setS3Field("accessKeyId", e.target.value)}
-            />
-          </FormField>
-          <FormField
-            label={t("portal.sources.types.s3.fields.secretAccessKey.label")}
-            required
-          >
-            <Input
-              type="password"
-              value={outputS3.secretAccessKey}
-              onChange={(e) => setS3Field("secretAccessKey", e.target.value)}
-            />
-          </FormField>
-          <FormField
-            label={t("portal.sources.types.s3.fields.endpoint.label")}
-            helperText={t("portal.sources.types.s3.fields.endpoint.helperText")}
-          >
-            <Input
-              value={outputS3.endpoint}
-              placeholder="https://s3.example.com"
-              onChange={(e) => setS3Field("endpoint", e.target.value)}
-            />
-          </FormField>
-        </div>
-      </Modal>
     </div>
   );
 }
diff --git a/frontend/editor/src/portal/views/Pipelines.tsx b/frontend/editor/src/portal/views/Pipelines.tsx
index e2345f62a6..23a8da75da 100644
--- a/frontend/editor/src/portal/views/Pipelines.tsx
+++ b/frontend/editor/src/portal/views/Pipelines.tsx
@@ -30,7 +30,7 @@ export function Pipelines() {
   const openCreate = () =>
     navigate(`${toPortalPath(VIEW_PATHS.pipelines)}/new`);
   const connectSource = () =>
-    navigate(`${toPortalPath(VIEW_PATHS.sources)}?new`);
+    navigate(`${toPortalPath(VIEW_PATHS.sources)}/new`);
   // A row opens that pipeline's own page (view / edit / run / delete live there).
   const openPipeline = (pipeline: PipelineView) =>
     navigate(`${toPortalPath(VIEW_PATHS.pipelines)}/${pipeline.id}`);
diff --git a/frontend/editor/src/portal/views/SourceBuilder.css b/frontend/editor/src/portal/views/SourceBuilder.css
new file mode 100644
index 0000000000..985332046d
--- /dev/null
+++ b/frontend/editor/src/portal/views/SourceBuilder.css
@@ -0,0 +1,87 @@
+.portal-source-builder {
+  display: flex;
+  flex-direction: column;
+  gap: 1.25rem;
+  padding: 1.5rem;
+  max-width: 84rem;
+  margin: 0 auto;
+}
+
+.portal-source-builder__loading {
+  display: flex;
+  justify-content: center;
+  padding: 4rem 0;
+}
+
+.portal-source-builder__head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 1rem;
+  flex-wrap: wrap;
+}
+
+.portal-source-builder__head-main {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  align-items: flex-start;
+}
+
+.portal-source-builder__title {
+  font-size: 1.375rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+  margin: 0;
+}
+
+.portal-source-builder__head-actions {
+  display: flex;
+  align-items: center;
+  gap: 0.625rem;
+}
+
+.portal-source-builder__body {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+  max-width: 32rem;
+}
+
+.portal-source-builder__type-grid {
+  display: flex;
+  gap: 0.625rem;
+  flex-wrap: wrap;
+}
+
+.portal-source-builder__type-card {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 0.375rem;
+  min-width: 6rem;
+  padding: 0.875rem 1rem;
+  border: 1px solid var(--color-border-2);
+  border-radius: 0.5rem;
+}
+
+.portal-source-builder__type-card.is-selected {
+  border-color: var(--color-accent, var(--color-brand));
+  background: var(--color-bg-hover);
+}
+
+.portal-source-builder__type-icon {
+  font-size: 1.5rem;
+  line-height: 1;
+}
+
+.portal-source-builder__type-name {
+  font-size: 0.8125rem;
+  font-weight: 500;
+}
+
+.portal-source-builder__delete-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 0.5rem;
+}
diff --git a/frontend/editor/src/portal/views/SourceBuilder.test.tsx b/frontend/editor/src/portal/views/SourceBuilder.test.tsx
new file mode 100644
index 0000000000..1f9b3341f8
--- /dev/null
+++ b/frontend/editor/src/portal/views/SourceBuilder.test.tsx
@@ -0,0 +1,158 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { MemoryRouter, Route, Routes } from "react-router-dom";
+import { SourceBuilder } from "@portal/views/SourceBuilder";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: MantineProvider });
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+const createSource = vi.fn();
+const fetchSource = vi.fn();
+const deleteSource = vi.fn();
+vi.mock("@portal/api/sources", () => ({
+  createSource: (s: unknown) => createSource(s),
+  fetchSource: (id: string) => fetchSource(id),
+  deleteSource: (id: string) => deleteSource(id),
+}));
+
+const fetchS3Connections = vi.fn();
+vi.mock("@portal/api/integrations", () => ({
+  fetchS3Connections: () => fetchS3Connections(),
+  createIntegration: vi.fn(),
+}));
+
+function renderBuilder(initial: string) {
+  return render(
+    <MemoryRouter initialEntries={[initial]}>
+      <Routes>
+        <Route path="/processor/sources" element={<div>sources list</div>} />
+        <Route path="/processor/sources/new" element={<SourceBuilder />} />
+        <Route path="/processor/sources/:id" element={<SourceBuilder />} />
+      </Routes>
+    </MemoryRouter>,
+  );
+}
+
+describe("SourceBuilder", () => {
+  beforeEach(() => {
+    createSource.mockReset();
+    createSource.mockResolvedValue({ id: "src-1" });
+    fetchSource.mockReset();
+    deleteSource.mockReset();
+    deleteSource.mockResolvedValue(undefined);
+    fetchS3Connections.mockReset();
+    fetchS3Connections.mockResolvedValue([]);
+  });
+
+  it("creates a folder source and returns to the list", async () => {
+    renderBuilder("/processor/sources/new");
+
+    // Folder is the first offered type; fill name + directory.
+    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+      target: { value: "Claims intake" },
+    });
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.sources\.types\.folder\.fields\.directory\.label/,
+      ),
+      { target: { value: "/data/incoming" } },
+    );
+    fireEvent.click(screen.getByText("portal.sources.builder.create"));
+
+    await waitFor(() => expect(createSource).toHaveBeenCalledTimes(1));
+    expect(createSource).toHaveBeenCalledWith(
+      expect.objectContaining({
+        name: "Claims intake",
+        type: "folder",
+        options: expect.objectContaining({ directory: "/data/incoming" }),
+        enabled: true,
+      }),
+    );
+    expect(await screen.findByText("sources list")).toBeInTheDocument();
+  });
+
+  it("gates the s3 type on a chosen connection", async () => {
+    renderBuilder("/processor/sources/new");
+    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+      target: { value: "Bucket source" },
+    });
+    // Switch to the S3 type: the connection field appears and Create stays
+    // disabled until a connection is chosen (connectionId is required).
+    fireEvent.click(screen.getByText("portal.sources.types.s3.label"));
+    expect(
+      await screen.findByText(
+        "portal.sources.types.s3.fields.connection.label",
+      ),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("portal.sources.builder.create").closest("button"),
+    ).toBeDisabled();
+  });
+
+  it("blocks create until required fields are filled", async () => {
+    renderBuilder("/processor/sources/new");
+    // Name given but directory (required) still blank -> Create disabled.
+    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+      target: { value: "Nameonly" },
+    });
+    expect(
+      screen.getByText("portal.sources.builder.create").closest("button"),
+    ).toBeDisabled();
+  });
+
+  it("edits an existing source prefilled and saves with its id", async () => {
+    fetchSource.mockResolvedValue({
+      id: "src-9",
+      name: "Existing",
+      type: "folder",
+      options: { directory: "/old", mode: "consume" },
+      enabled: true,
+    });
+    renderBuilder("/processor/sources/src-9");
+
+    const directory = await screen.findByLabelText(
+      /portal\.sources\.types\.folder\.fields\.directory\.label/,
+    );
+    expect((directory as HTMLInputElement).value).toBe("/old");
+    fireEvent.change(directory, { target: { value: "/new" } });
+    fireEvent.click(screen.getByText("portal.sources.builder.save"));
+
+    await waitFor(() => expect(createSource).toHaveBeenCalledTimes(1));
+    expect(createSource).toHaveBeenCalledWith(
+      expect.objectContaining({
+        id: "src-9",
+        options: expect.objectContaining({ directory: "/new" }),
+      }),
+    );
+  });
+
+  it("deletes an existing source after confirmation", async () => {
+    fetchSource.mockResolvedValue({
+      id: "src-9",
+      name: "Existing",
+      type: "folder",
+      options: { directory: "/old" },
+      enabled: true,
+    });
+    renderBuilder("/processor/sources/src-9");
+
+    fireEvent.click(await screen.findByText("portal.sources.builder.delete"));
+    fireEvent.click(await screen.findByText("portal.sources.delete.confirm"));
+
+    await waitFor(() => expect(deleteSource).toHaveBeenCalledWith("src-9"));
+    expect(await screen.findByText("sources list")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/views/SourceBuilder.tsx b/frontend/editor/src/portal/views/SourceBuilder.tsx
new file mode 100644
index 0000000000..31b8550354
--- /dev/null
+++ b/frontend/editor/src/portal/views/SourceBuilder.tsx
@@ -0,0 +1,326 @@
+import { useEffect, useState } from "react";
+import { useNavigate, useParams } from "react-router-dom";
+import { useTranslation } from "react-i18next";
+import ArrowBackRoundedIcon from "@mui/icons-material/ArrowBackRounded";
+import DeleteOutlineRoundedIcon from "@mui/icons-material/DeleteOutlineRounded";
+import {
+  Banner,
+  Button,
+  Checkbox,
+  FormField,
+  Input,
+  Modal,
+  Select,
+  Spinner,
+} from "@app/ui";
+import { errorMessage } from "@portal/api/http";
+import {
+  createSource,
+  deleteSource,
+  fetchSource,
+  type Source,
+} from "@portal/api/sources";
+import { useAsync } from "@portal/hooks/useAsync";
+import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
+import { creatableSourceTypes } from "@portal/components/sources/creatableSourceTypes";
+import {
+  CREATABLE_SOURCE_TYPES,
+  defaultOptions,
+  sourceTypeMeta,
+  type CreatableSourceType,
+} from "@portal/components/sources/sourceTypes";
+import { S3ConnectionPicker } from "@portal/components/sources/S3ConnectionPicker";
+import "@portal/views/SourceBuilder.css";
+
+const OFFERED_TYPES = creatableSourceTypes();
+
+/** A source's stored type resolved to its create-form metadata (edit falls back to any type). */
+function typeFor(type: string | undefined): CreatableSourceType {
+  return (
+    CREATABLE_SOURCE_TYPES.find((t) => t.type === type) ??
+    OFFERED_TYPES[0] ??
+    CREATABLE_SOURCE_TYPES[0]
+  );
+}
+
+/** Stored options coerced to form strings, defaulted from the type's fields. */
+function optionsFor(
+  type: CreatableSourceType,
+  options: Record<string, unknown> | undefined,
+): Record<string, string> {
+  const out = defaultOptions(type);
+  for (const [key, value] of Object.entries(options ?? {})) {
+    out[key] = value == null ? "" : String(value);
+  }
+  return out;
+}
+
+/**
+ * Full-page create/edit for a source, mirroring the pipeline builder: new lands
+ * on /sources/new (with a type picker), a row opens /sources/:id prefilled.
+ * Save and delete navigate back to the Sources list. The virtual editor source
+ * is never routed here (the list row is not a link).
+ */
+export function SourceBuilder() {
+  const { t } = useTranslation();
+  const navigate = useNavigate();
+  const { id } = useParams();
+  const isEdit = Boolean(id);
+  const listPath = toPortalPath(VIEW_PATHS.sources);
+
+  const sourceState = useAsync<Source | null>(
+    async () => (id ? await fetchSource(id) : null),
+    [id],
+  );
+
+  const [type, setType] = useState<CreatableSourceType>(OFFERED_TYPES[0]);
+  const [name, setName] = useState("");
+  const [options, setOptions] = useState<Record<string, string>>(() =>
+    defaultOptions(OFFERED_TYPES[0]),
+  );
+  const [enabled, setEnabled] = useState(true);
+  const [seeded, setSeeded] = useState(false);
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [pendingDelete, setPendingDelete] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+
+  // Seed once: immediately for a new source, or after the record loads for edit.
+  useEffect(() => {
+    if (seeded) return;
+    if (isEdit && !sourceState.data) return;
+    const source = sourceState.data ?? undefined;
+    const resolved = typeFor(source?.type);
+    setType(resolved);
+    setName(source?.name ?? "");
+    setOptions(optionsFor(resolved, source?.options));
+    setEnabled(source?.enabled ?? true);
+    setSeeded(true);
+  }, [isEdit, sourceState.data, seeded]);
+
+  function chooseType(next: CreatableSourceType) {
+    setType(next);
+    setOptions(defaultOptions(next));
+  }
+
+  function setOption(key: string, value: string) {
+    setOptions((current) => ({ ...current, [key]: value }));
+  }
+
+  const requiredComplete = type.fields.every(
+    (field) => !field.required || (options[field.key] ?? "").trim() !== "",
+  );
+  const canSave = name.trim() !== "" && requiredComplete && !submitting;
+
+  async function save() {
+    if (!canSave) return;
+    setSubmitting(true);
+    setError(null);
+    try {
+      await createSource({
+        id: isEdit ? id : undefined,
+        name: name.trim(),
+        type: type.type,
+        options,
+        enabled,
+      });
+      navigate(listPath);
+    } catch (e) {
+      setError(errorMessage(e));
+      setSubmitting(false);
+    }
+  }
+
+  async function confirmDelete() {
+    if (!id || deleting) return;
+    setDeleting(true);
+    try {
+      await deleteSource(id);
+      navigate(listPath);
+    } catch (e) {
+      setError(errorMessage(e));
+      setDeleting(false);
+      setPendingDelete(false);
+    }
+  }
+
+  if (isEdit && sourceState.error) {
+    return (
+      <div className="portal-source-builder">
+        <Banner tone="danger" description={errorMessage(sourceState.error)} />
+        <Button variant="tertiary" onClick={() => navigate(listPath)}>
+          {t("portal.sources.builder.back")}
+        </Button>
+      </div>
+    );
+  }
+
+  if (isEdit && !seeded) {
+    return (
+      <div className="portal-source-builder__loading">
+        <Spinner />
+      </div>
+    );
+  }
+
+  return (
+    <div className="portal-source-builder">
+      <header className="portal-source-builder__head">
+        <div className="portal-source-builder__head-main">
+          <Button
+            variant="quiet"
+            size="sm"
+            onClick={() => navigate(listPath)}
+            leftSection={
+              <ArrowBackRoundedIcon style={{ fontSize: "1.125rem" }} />
+            }
+          >
+            {t("portal.sources.builder.back")}
+          </Button>
+          <h1 className="portal-source-builder__title">
+            {isEdit
+              ? name || t("portal.sources.builder.editTitle")
+              : t("portal.sources.builder.createTitle")}
+          </h1>
+        </div>
+        <div className="portal-source-builder__head-actions">
+          <Checkbox
+            checked={enabled}
+            onChange={(e) => setEnabled(e.target.checked)}
+            label={t("portal.sources.builder.enabled")}
+          />
+          {isEdit && (
+            <Button
+              variant="secondary"
+              size="sm"
+              accent="danger"
+              onClick={() => setPendingDelete(true)}
+              leftSection={
+                <DeleteOutlineRoundedIcon style={{ fontSize: "1.125rem" }} />
+              }
+            >
+              {t("portal.sources.builder.delete")}
+            </Button>
+          )}
+          <Button
+            variant="tertiary"
+            size="sm"
+            onClick={() => navigate(listPath)}
+          >
+            {t("portal.sources.builder.cancel")}
+          </Button>
+          <Button size="sm" disabled={!canSave} onClick={() => void save()}>
+            {isEdit
+              ? t("portal.sources.builder.save")
+              : t("portal.sources.builder.create")}
+          </Button>
+        </div>
+      </header>
+
+      <div className="portal-source-builder__body">
+        <FormField label={t("portal.sources.wizard.name")} required>
+          <Input
+            value={name}
+            placeholder={t("portal.sources.wizard.namePlaceholder")}
+            onChange={(e) => setName(e.target.value)}
+          />
+        </FormField>
+
+        {!isEdit && OFFERED_TYPES.length > 1 && (
+          <FormField label={t("portal.sources.wizard.type")}>
+            <div className="portal-source-builder__type-grid">
+              {OFFERED_TYPES.map((ct) => (
+                <Button
+                  key={ct.type}
+                  variant="tertiary"
+                  className={
+                    "portal-source-builder__type-card" +
+                    (type.type === ct.type ? " is-selected" : "")
+                  }
+                  onClick={() => chooseType(ct)}
+                >
+                  <span
+                    className="portal-source-builder__type-icon"
+                    aria-hidden
+                  >
+                    {sourceTypeMeta(ct.type).icon}
+                  </span>
+                  <span className="portal-source-builder__type-name">
+                    {t(ct.labelKey)}
+                  </span>
+                </Button>
+              ))}
+            </div>
+          </FormField>
+        )}
+
+        {type.fields.map((field) => (
+          <FormField
+            key={field.key}
+            label={t(field.labelKey)}
+            helperText={
+              field.helperTextKey ? t(field.helperTextKey) : undefined
+            }
+            required={field.required}
+          >
+            {field.control === "s3Connection" ? (
+              <S3ConnectionPicker
+                value={options[field.key] ?? ""}
+                onChange={(connectionId) => setOption(field.key, connectionId)}
+              />
+            ) : field.control === "select" ? (
+              <Select
+                value={options[field.key] ?? ""}
+                options={(field.options ?? []).map((o) => ({
+                  value: o.value,
+                  label: t(o.labelKey),
+                }))}
+                onChange={(value) => setOption(field.key, value ?? "")}
+              />
+            ) : (
+              <Input
+                type={field.control === "password" ? "password" : undefined}
+                value={options[field.key] ?? ""}
+                placeholder={
+                  field.placeholderKey ? t(field.placeholderKey) : undefined
+                }
+                onChange={(e) => setOption(field.key, e.target.value)}
+              />
+            )}
+          </FormField>
+        ))}
+
+        {error && <Banner tone="danger" description={error} />}
+      </div>
+
+      <Modal
+        open={pendingDelete}
+        onClose={() => !deleting && setPendingDelete(false)}
+        width="sm"
+        title={t("portal.sources.delete.title")}
+        footer={
+          <div className="portal-source-builder__delete-actions">
+            <Button
+              variant="tertiary"
+              size="sm"
+              disabled={deleting}
+              onClick={() => setPendingDelete(false)}
+            >
+              {t("portal.sources.delete.cancel")}
+            </Button>
+            <Button
+              size="sm"
+              accent="danger"
+              loading={deleting}
+              onClick={() => void confirmDelete()}
+            >
+              {t("portal.sources.delete.confirm")}
+            </Button>
+          </div>
+        }
+      >
+        <p>{t("portal.sources.delete.body", { name })}</p>
+      </Modal>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index d8cc6897af..54d8906be9 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -438,3 +438,101 @@
   gap: 0.5rem;
   width: 100%;
 }
+
+.portal-sources__connection-picker {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  align-items: flex-start;
+}
+
+.portal-sources__connection-picker .sui-select,
+.portal-sources__connection-picker > div:first-child {
+  align-self: stretch;
+}
+
+.portal-sources__connection-create {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+  padding: 0.75rem;
+  border: 1px solid var(--color-border-2);
+  border-radius: 0.5rem;
+  align-self: stretch;
+}
+
+.portal-sources__connection-create-actions {
+  display: flex;
+  justify-content: flex-end;
+  gap: 0.5rem;
+}
+
+.portal-sources__connection-form {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+.portal-sources__connections {
+  margin-top: 1.5rem;
+}
+
+.portal-sources__connections-title {
+  font-size: 0.875rem;
+  font-weight: 600;
+  color: var(--color-text-2);
+  margin: 0 0 0.5rem;
+}
+
+.portal-sources__connections-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.portal-sources__connections-row {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  padding: 0.375rem 0;
+  border-bottom: 1px solid var(--color-border-2);
+}
+
+.portal-sources__connections-name {
+  font-weight: 500;
+  color: var(--color-text-1);
+}
+
+.portal-sources__connections-bucket {
+  color: var(--color-text-4);
+  font-size: 0.8125rem;
+}
+
+.portal-sources__connections-actions {
+  margin-left: auto;
+  display: flex;
+  gap: 0.25rem;
+}
+
+.portal-sources__connections-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  margin-bottom: 0.5rem;
+}
+
+.portal-sources__connections-sub {
+  color: var(--color-text-4);
+  font-size: 0.875rem;
+  margin: 0;
+}
+
+.portal-sources__connections-actions {
+  display: inline-flex;
+  gap: 0.25rem;
+  justify-content: flex-end;
+}
diff --git a/frontend/editor/src/portal/views/Sources.test.tsx b/frontend/editor/src/portal/views/Sources.test.tsx
index 5e281d5604..a006cbe4a2 100644
--- a/frontend/editor/src/portal/views/Sources.test.tsx
+++ b/frontend/editor/src/portal/views/Sources.test.tsx
@@ -3,21 +3,16 @@ import {
   fireEvent,
   render as baseRender,
   screen,
-  waitFor,
 } from "@testing-library/react";
 import { MantineProvider } from "@mantine/core";
-import { MemoryRouter } from "react-router-dom";
-import { HttpError } from "@portal/api/http";
-
-const render = (
-  ui: Parameters<typeof baseRender>[0],
-  options?: Parameters<typeof baseRender>[1],
-) => baseRender(ui, { wrapper: MantineProvider, ...options });
+import { MemoryRouter, Route, Routes } from "react-router-dom";
 import type { SourcesResponse } from "@portal/api/sources";
 import { Sources } from "@portal/views/Sources";
 
-// Deterministic i18n: keys returned verbatim, so assertions are stable without
-// the async TOML backend.
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: MantineProvider });
+
+// Deterministic i18n: keys returned verbatim.
 vi.mock("react-i18next", () => ({
   useTranslation: () => ({
     t: (key: string) => key,
@@ -26,48 +21,48 @@ vi.mock("react-i18next", () => ({
 }));
 
 const fetchSources = vi.fn();
-const fetchSource = vi.fn();
-const fetchSourceDocCounts = vi.fn();
-const createSource = vi.fn();
-const deleteSource = vi.fn();
 vi.mock("@portal/api/sources", () => ({
   fetchSources: () => fetchSources(),
-  fetchSource: (id: string) => fetchSource(id),
-  fetchSourceDocCounts: (id: string) => fetchSourceDocCounts(id),
-  createSource: (source: unknown) => createSource(source),
-  deleteSource: (id: string) => deleteSource(id),
+}));
+
+const fetchS3Connections = vi.fn();
+vi.mock("@portal/api/integrations", () => ({
+  fetchS3Connections: () => fetchS3Connections(),
+  deleteIntegration: vi.fn(),
+}));
+
+// The Agent Builder header action is a flavor seam; stub it to keep the test focused.
+vi.mock("@portal/components/sources/AgentBuilderAction", () => ({
+  AgentBuilderAction: () => null,
 }));
 
 const RESPONSE: SourcesResponse = {
   kpis: [
-    { value: 2, description: "" },
     { value: 1, description: "" },
     { value: 1, description: "" },
+    { value: 0, description: "" },
   ],
   sources: [
     {
-      id: "src-referenced",
+      id: "editor",
+      name: "Editor",
+      type: "editor",
+      status: "active",
+      referenceCount: 0,
+      referencingPolicies: [],
+      config: [],
+      docsTotal: 5,
+      docs24h: 0,
+      docs30d: 5,
+    },
+    {
+      id: "src-1",
       name: "Claims intake",
       type: "folder",
       status: "active",
       referenceCount: 2,
-      referencingPolicies: [
-        { id: "pol-1", name: "Redaction" },
-        { id: "pol-2", name: "Classification" },
-      ],
-      config: [{ label: "Directory", value: "/data/incoming" }],
-      docsTotal: 1240,
-      docs24h: 18,
-      docs30d: 540,
-    },
-    {
-      id: "src-orphan",
-      name: "Scratch folder",
-      type: "folder",
-      status: "unused",
-      referenceCount: 0,
       referencingPolicies: [],
-      config: [{ label: "Directory", value: "/tmp/scratch" }],
+      config: [{ label: "Directory", value: "/in" }],
       docsTotal: 1240,
       docs24h: 18,
       docs30d: 540,
@@ -75,10 +70,20 @@ const RESPONSE: SourcesResponse = {
   ],
 };
 
-function renderView() {
+function renderView(initial = "/processor/sources") {
   return render(
-    <MemoryRouter>
-      <Sources />
+    <MemoryRouter initialEntries={[initial]}>
+      <Routes>
+        <Route path="/processor/sources" element={<Sources />} />
+        <Route
+          path="/processor/sources/new"
+          element={<div>source builder: new</div>}
+        />
+        <Route
+          path="/processor/sources/:id"
+          element={<div>source builder: edit</div>}
+        />
+      </Routes>
     </MemoryRouter>,
   );
 }
@@ -86,122 +91,54 @@ function renderView() {
 describe("Sources view", () => {
   beforeEach(() => {
     fetchSources.mockReset();
-    fetchSource.mockReset();
-    fetchSourceDocCounts.mockReset();
-    fetchSourceDocCounts.mockResolvedValue([]);
-    createSource.mockReset();
-    deleteSource.mockReset();
-  });
-
-  it("surfaces the inline 409 message when deleting a referenced source", async () => {
     fetchSources.mockResolvedValue(RESPONSE);
-    deleteSource.mockRejectedValue(
-      new HttpError(409, "Conflict", {
-        detail: "Source is referenced by 2 policies",
-      }),
-    );
-
-    renderView();
-
-    // Wait for the row to render after the async fetch resolves.
-    const row = await screen.findByText("Claims intake");
-    fireEvent.click(row);
-
-    // Detail card opens with its delete action.
-    fireEvent.click(await screen.findByText("portal.sources.detail.delete"));
-
-    // Confirm in the dialog.
-    fireEvent.click(await screen.findByText("portal.sources.delete.confirm"));
-
-    await waitFor(() => {
-      expect(deleteSource).toHaveBeenCalledWith("src-referenced");
-    });
-
-    expect(
-      await screen.findByText("Source is referenced by 2 policies"),
-    ).toBeInTheDocument();
+    fetchS3Connections.mockReset();
+    fetchS3Connections.mockResolvedValue([]);
   });
 
-  it("shows the editor as a built-in source with no edit, pause, or delete actions", async () => {
-    fetchSources.mockResolvedValue({
-      kpis: [],
-      sources: [
-        {
-          id: "editor",
-          name: "Editor",
-          type: "editor",
-          status: "active",
-          referenceCount: 1,
-          referencingPolicies: [{ id: "pol-1", name: "Redaction" }],
-          config: [],
-          docsTotal: 8230,
-          docs24h: 42,
-          docs30d: 1680,
-        },
-      ],
-    } satisfies SourcesResponse);
-
+  it("opens a source's own page on row click", async () => {
     renderView();
+    fireEvent.click(await screen.findByText("Claims intake"));
+    expect(await screen.findByText("source builder: edit")).toBeInTheDocument();
+  });
 
-    // The editor row is labelled from its type (i18n keys are returned verbatim here).
+  it("navigates to the create page from the connect button", async () => {
+    renderView();
+    await screen.findByText("Claims intake");
+    fireEvent.click(screen.getByText("portal.sources.actions.connectSource"));
+    expect(await screen.findByText("source builder: new")).toBeInTheDocument();
+  });
+
+  it("does not navigate when the virtual editor row is clicked", async () => {
+    renderView();
     fireEvent.click(
       await screen.findByText("portal.sources.types.editor.label"),
     );
-
-    // Detail opens, but none of the mutate actions are offered for the built-in source.
-    await screen.findByText("portal.sources.detail.documents");
-    expect(screen.queryByText("portal.sources.detail.edit")).toBeNull();
-    expect(screen.queryByText("portal.sources.detail.pause")).toBeNull();
-    expect(screen.queryByText("portal.sources.detail.delete")).toBeNull();
+    // Still on the list: the builder stub never rendered.
+    expect(screen.queryByText("source builder: edit")).not.toBeInTheDocument();
+    expect(screen.getByText("Claims intake")).toBeInTheDocument();
   });
 
-  it("pauses a source by re-saving it with enabled flipped off", async () => {
-    fetchSources.mockResolvedValue(RESPONSE);
-    fetchSource.mockResolvedValue({
-      id: "src-referenced",
-      name: "Claims intake",
-      type: "folder",
-      options: { directory: "/data/incoming", mode: "consume" },
-      enabled: true,
-    });
-    createSource.mockResolvedValue({});
-
-    renderView();
-
-    fireEvent.click(await screen.findByText("Claims intake"));
-    fireEvent.click(await screen.findByText("portal.sources.detail.pause"));
-
-    await waitFor(() => {
-      expect(createSource).toHaveBeenCalledTimes(1);
-    });
-    expect(fetchSource).toHaveBeenCalledWith("src-referenced");
-    expect(createSource).toHaveBeenCalledWith(
-      expect.objectContaining({ id: "src-referenced", enabled: false }),
-    );
-  });
-
-  it("shows the KPI stat boxes when sources exist", async () => {
-    fetchSources.mockResolvedValue(RESPONSE);
+  it("shows the connections surface on the Connections tab", async () => {
     renderView();
     await screen.findByText("Claims intake");
-    expect(screen.getByText("portal.sources.kpi.total")).toBeInTheDocument();
+    fireEvent.click(screen.getByText("portal.sources.tabs.connections"));
+    // Empty connections list -> the connections empty state.
+    expect(
+      await screen.findByText("portal.connections.empty.title"),
+    ).toBeInTheDocument();
+    expect(fetchS3Connections).toHaveBeenCalled();
   });
 
-  it("hides the stat boxes and shows the connect CTA when empty", async () => {
+  it("hides the KPI strip and shows the empty state when only the editor exists", async () => {
     fetchSources.mockResolvedValue({
-      kpis: [
-        { value: 0, description: "" },
-        { value: 0, description: "" },
-        { value: 0, description: "" },
-      ],
-      sources: [],
+      kpis: RESPONSE.kpis,
+      sources: [RESPONSE.sources[0]],
     });
     renderView();
-    // The empty-state panel renders.
     expect(
       await screen.findByText("portal.sources.empty.title"),
     ).toBeInTheDocument();
-    // The KPI strip is gone: no stat-box labels over an empty page.
     expect(
       screen.queryByText("portal.sources.kpi.total"),
     ).not.toBeInTheDocument();
diff --git a/frontend/editor/src/portal/views/Sources.tsx b/frontend/editor/src/portal/views/Sources.tsx
index 60f9d628f9..fb0b14ccf5 100644
--- a/frontend/editor/src/portal/views/Sources.tsx
+++ b/frontend/editor/src/portal/views/Sources.tsx
@@ -1,137 +1,49 @@
-import { useCallback, useEffect, useState } from "react";
-import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
-import { Banner, Button, EmptyState, Modal, Skeleton } from "@app/ui";
+import { useNavigate, useSearchParams } from "react-router-dom";
+import AddRoundedIcon from "@mui/icons-material/AddRounded";
+import { Button, EmptyState, Skeleton, Tabs } from "@app/ui";
 import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
 import { SourcesIcon } from "@portal/components/icons";
-import { errorMessage } from "@portal/api/http";
 import {
-  createSource,
-  deleteSource,
-  fetchSource,
-  fetchSourceDocCounts,
   fetchSources,
-  type Source,
   type SourcesResponse,
   type SourceView,
 } from "@portal/api/sources";
+import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { AgentBuilderAction } from "@portal/components/sources/AgentBuilderAction";
 import { KpiStrip } from "@portal/components/sources/KpiStrip";
 import { SourcesTable } from "@portal/components/sources/SourcesTable";
-import { SourceDetailCard } from "@portal/components/sources/SourceDetailCard";
-import { ConnectWizard } from "@portal/components/sources/ConnectWizard";
+import { ConnectionsTab } from "@portal/components/sources/ConnectionsTab";
 import "@portal/views/Sources.css";
 
+type SourcesTab = "sources" | "connections";
+
 export function Sources() {
   const { t } = useTranslation();
+  const navigate = useNavigate();
   const [searchParams, setSearchParams] = useSearchParams();
-  // Refetch after every mutation by bumping this counter, so the table reflects
-  // the in-memory store the handlers maintain (mirrors the Policies view).
-  const [version, setVersion] = useState(0);
-  const state = useAsync<SourcesResponse>(() => fetchSources(), [version]);
+  const activeTab: SourcesTab =
+    searchParams.get("tab") === "connections" ? "connections" : "sources";
+
+  const state = useAsync<SourcesResponse>(() => fetchSources(), []);
   const { data, loading } = state;
   const { isLoading } = useSectionFlags(state);
-  const refetch = useCallback(() => setVersion((v) => v + 1), []);
-
-  const [expandedId, setExpandedId] = useState<string | null>(null);
-  const [wizardOpen, setWizardOpen] = useState(false);
-  const [editingSource, setEditingSource] = useState<Source | null>(null);
-  const [mutating, setMutating] = useState(false);
-  const [pageError, setPageError] = useState<string | null>(null);
-  const [pendingDelete, setPendingDelete] = useState<SourceView | null>(null);
-  const [deleting, setDeleting] = useState(false);
-  const [deleteError, setDeleteError] = useState<string | null>(null);
 
   const sources = data?.sources ?? [];
-  const expanded = sources.find((s) => s.id === expandedId) ?? null;
-  // Empty once the fetch settles with no sources (or fails → no data). Gates
-  // both the KPI strip and the empty panel so no placeholder stat boxes sit
-  // above an empty page.
-  const showEmpty = !isLoading && sources.length === 0;
+  // The editor is a virtual row that's always present, so "empty" means no
+  // configured sources beyond it. Gates the KPI strip and empty panel.
+  const configuredCount = sources.filter((s) => s.type !== "editor").length;
+  const showEmpty = !isLoading && configuredCount === 0;
 
-  // The 30-day sparkline series lives off the list endpoint; fetch it for the one
-  // expanded row only (empty while collapsed, so no request fires).
-  const docSeriesState = useAsync<{ id: string; series: number[] }>(
-    () =>
-      expandedId
-        ? fetchSourceDocCounts(expandedId).then((series) => ({
-            id: expandedId,
-            series,
-          }))
-        : Promise.resolve({ id: "", series: [] }),
-    [expandedId],
-  );
-  const docSeries =
-    docSeriesState.data?.id === expandedId ? docSeriesState.data.series : [];
+  const openCreate = () => navigate(`${toPortalPath(VIEW_PATHS.sources)}/new`);
+  const openSource = (source: SourceView) =>
+    navigate(`${toPortalPath(VIEW_PATHS.sources)}/${source.id}`);
 
-  function openCreate() {
-    setEditingSource(null);
-    setWizardOpen(true);
-  }
-
-  // Arriving with ?new (e.g. from the pipeline builder's "connect a source" link) opens the
-  // create wizard straight away, then strips the flag so a refresh doesn't reopen it.
-  useEffect(() => {
-    if (searchParams.get("new") === null) return;
-    setEditingSource(null);
-    setWizardOpen(true);
+  function selectTab(tab: SourcesTab) {
     const next = new URLSearchParams(searchParams);
-    next.delete("new");
+    if (tab === "sources") next.delete("tab");
+    else next.set("tab", tab);
     setSearchParams(next, { replace: true });
-  }, [searchParams, setSearchParams]);
-
-  // Editing needs the raw source (config options), which the overview rows don't
-  // carry, so fetch it before opening the wizard prefilled.
-  async function openEdit(source: SourceView) {
-    if (mutating) return;
-    setPageError(null);
-    setMutating(true);
-    try {
-      setEditingSource(await fetchSource(source.id));
-      setWizardOpen(true);
-    } catch (e) {
-      setPageError(errorMessage(e));
-    } finally {
-      setMutating(false);
-    }
-  }
-
-  // Pause/resume: re-save the source with enabled flipped (same POST contract as
-  // edit). Fetch the raw record first so the full config round-trips intact.
-  async function togglePause(source: SourceView) {
-    if (mutating) return;
-    setPageError(null);
-    setMutating(true);
-    try {
-      const raw = await fetchSource(source.id);
-      await createSource({ ...raw, enabled: !raw.enabled });
-      refetch();
-    } catch (e) {
-      setPageError(errorMessage(e));
-    } finally {
-      setMutating(false);
-    }
-  }
-
-  function requestDelete(source: SourceView) {
-    setDeleteError(null);
-    setPendingDelete(source);
-  }
-
-  async function confirmDelete() {
-    if (!pendingDelete || deleting) return;
-    setDeleting(true);
-    setDeleteError(null);
-    try {
-      await deleteSource(pendingDelete.id);
-      setPendingDelete(null);
-      setExpandedId(null);
-      refetch();
-    } catch (e) {
-      setDeleteError(errorMessage(e));
-    } finally {
-      setDeleting(false);
-    }
   }
 
   return (
@@ -141,102 +53,67 @@ export function Sources() {
           <h1 className="portal-sources__title">{t("portal.sources.title")}</h1>
           <p className="portal-sources__sub">{t("portal.sources.subtitle")}</p>
         </div>
-        <div className="portal-sources__actions">
-          <AgentBuilderAction />
-          <Button onClick={openCreate} leftSection={<span aria-hidden>+</span>}>
-            {t("portal.sources.actions.connectSource")}
-          </Button>
-        </div>
-      </header>
-
-      {pageError && <Banner tone="danger" description={pageError} />}
-
-      {!showEmpty && <KpiStrip data={data} loading={loading} />}
-
-      {isLoading && (
-        <div className="portal-sources__table-skeleton" aria-hidden>
-          {Array.from({ length: 5 }).map((_, i) => (
-            <Skeleton key={i} height="3rem" />
-          ))}
-        </div>
-      )}
-
-      {showEmpty && (
-        <EmptyState
-          icon={<SourcesIcon size={28} />}
-          title={t("portal.sources.empty.title")}
-          description={t("portal.sources.empty.description")}
-          actions={
+        {activeTab === "sources" && (
+          <div className="portal-sources__actions">
+            <AgentBuilderAction />
             <Button
               onClick={openCreate}
-              leftSection={<span aria-hidden>+</span>}
+              leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
             >
               {t("portal.sources.actions.connectSource")}
             </Button>
-          }
-        />
-      )}
+          </div>
+        )}
+      </header>
 
-      {!isLoading && sources.length > 0 && (
-        <SourcesTable
-          sources={sources}
-          expandedId={expandedId}
-          onRowClick={(s) =>
-            setExpandedId((cur) => (cur === s.id ? null : s.id))
-          }
-        />
-      )}
-
-      {expanded && (
-        <SourceDetailCard
-          source={expanded}
-          docSeries={docSeries}
-          onClose={() => setExpandedId(null)}
-          onEdit={openEdit}
-          onTogglePause={togglePause}
-          onDelete={requestDelete}
-          busy={mutating}
-        />
-      )}
-
-      <ConnectWizard
-        open={wizardOpen}
-        source={editingSource ?? undefined}
-        onClose={() => setWizardOpen(false)}
-        onCreated={refetch}
+      <Tabs<SourcesTab>
+        variant="underline"
+        ariaLabel={t("portal.sources.title")}
+        activeKey={activeTab}
+        onChange={selectTab}
+        items={[
+          { key: "sources", label: t("portal.sources.tabs.sources") },
+          { key: "connections", label: t("portal.sources.tabs.connections") },
+        ]}
       />
 
-      <Modal
-        open={pendingDelete !== null}
-        onClose={() => !deleting && setPendingDelete(null)}
-        width="sm"
-        title={t("portal.sources.delete.title")}
-        footer={
-          <div className="portal-sources__wizard-footer">
-            <Button
-              variant="tertiary"
-              size="sm"
-              disabled={deleting}
-              onClick={() => setPendingDelete(null)}
-            >
-              {t("portal.sources.delete.cancel")}
-            </Button>
-            <Button
-              size="sm"
-              accent="danger"
-              loading={deleting}
-              onClick={confirmDelete}
-            >
-              {t("portal.sources.delete.confirm")}
-            </Button>
-          </div>
-        }
-      >
-        <p>
-          {t("portal.sources.delete.body", { name: pendingDelete?.name ?? "" })}
-        </p>
-        {deleteError && <Banner tone="danger" description={deleteError} />}
-      </Modal>
+      {activeTab === "connections" ? (
+        <ConnectionsTab />
+      ) : (
+        <>
+          {!showEmpty && <KpiStrip data={data} loading={loading} />}
+
+          {isLoading && (
+            <div className="portal-sources__table-skeleton" aria-hidden>
+              {Array.from({ length: 5 }).map((_, i) => (
+                <Skeleton key={i} height="3rem" />
+              ))}
+            </div>
+          )}
+
+          {showEmpty && (
+            <EmptyState
+              icon={<SourcesIcon size={28} />}
+              title={t("portal.sources.empty.title")}
+              description={t("portal.sources.empty.description")}
+              actions={
+                <Button
+                  onClick={openCreate}
+                  leftSection={
+                    <AddRoundedIcon style={{ fontSize: "1.125rem" }} />
+                  }
+                >
+                  {t("portal.sources.actions.connectSource")}
+                </Button>
+              }
+            />
+          )}
+
+          {!isLoading && sources.length > 0 && (
+            <SourcesTable sources={sources} onRowClick={openSource} />
+          )}
+        </>
+      )}
     </div>
   );
 }

From a1b15e0570db4826cd3db4a4df12613e4a53707c Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Mon, 13 Jul 2026 16:00:01 +0100
Subject: [PATCH 016/109] Portal: dark disabled buttons and role column width
 (#7004)

# Description of Changes

Fixes disabled buttons rendering as plain grey in dark mode, and widens
the Users role column so "Organisation Owner" no longer clips.

Part of a portal (processor) UI-consistency pass, split into small
focused PRs.

## Before / after

<!-- paste before / after screenshots here -->

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [x] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 frontend/editor/src/core/ui/Button.css     | 15 +++++++++------
 frontend/editor/src/portal/views/Users.css |  2 +-
 2 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/frontend/editor/src/core/ui/Button.css b/frontend/editor/src/core/ui/Button.css
index e80bf13222..6ec23ca9ea 100644
--- a/frontend/editor/src/core/ui/Button.css
+++ b/frontend/editor/src/core/ui/Button.css
@@ -61,11 +61,14 @@
   background: var(--button-bg, transparent) !important;
 }
 
+/* Disabled buttons in dark read as a muted surface (not a dimmed accent that
+   still looks clickable, and not an invisible transparent pill). Covers every
+   variant so a disabled primary and a disabled secondary look alike. */
+[data-theme="dark"] .sui-btn.mantine-Button-root:disabled:not([data-loading]),
 [data-theme="dark"]
-  .sui-btn--primary.mantine-Button-root:disabled:not([data-loading]),
-[data-theme="dark"]
-  .sui-btn--primary.mantine-Button-root[data-disabled]:not([data-loading]) {
-  background: var(--button-bg);
-  color: var(--button-color);
-  opacity: 0.55;
+  .sui-btn.mantine-Button-root[data-disabled]:not([data-loading]) {
+  background: var(--color-bg-muted);
+  color: var(--color-text-5);
+  border-color: transparent;
+  opacity: 1;
 }
diff --git a/frontend/editor/src/portal/views/Users.css b/frontend/editor/src/portal/views/Users.css
index f351ebeaa3..dfaa9284a6 100644
--- a/frontend/editor/src/portal/views/Users.css
+++ b/frontend/editor/src/portal/views/Users.css
@@ -396,7 +396,7 @@
   white-space: nowrap;
 }
 .portal-users__row-role {
-  width: 148px;
+  width: 12.5rem;
   flex-shrink: 0;
 }
 

From 4d4e99456283ff6f4806b5d9834da638110aa6d6 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Tue, 14 Jul 2026 10:09:23 +0100
Subject: [PATCH 017/109] Fix crash in Processor when loading tool settings
 with tooltips (#7015)

# Description of Changes
Some of the tool settings make use of editor preferences indirectly, but
the Processor never gets that provider, so it crashes when trying to
load them.
---
 .../pipelines/PipelineStepSettings.test.tsx   | 52 +++++++++++++++++++
 .../pipelines/PipelineStepSettings.tsx        | 24 +++++----
 2 files changed, 67 insertions(+), 9 deletions(-)
 create mode 100644 frontend/editor/src/portal/components/pipelines/PipelineStepSettings.test.tsx

diff --git a/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.test.tsx b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.test.tsx
new file mode 100644
index 0000000000..698fb0028a
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.test.tsx
@@ -0,0 +1,52 @@
+import { describe, expect, it, vi } from "vitest";
+import { render, screen } from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { Tooltip } from "@app/components/shared/Tooltip";
+import type { ToolRegistry } from "@app/data/toolsTaxonomy";
+import type { WorkingToolStep } from "@app/hooks/tools/shared/toolAutomation";
+import { PipelineStepSettings } from "@portal/components/pipelines/PipelineStepSettings";
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string, fallback?: string) => fallback ?? key,
+  }),
+}));
+
+// A stand-in tool-settings UI that uses the shared editor Tooltip. The Tooltip
+// pulls in the Preferences + Sidebar contexts, which the portal does not mount
+// app-wide — so this reproduces the "usePreferences must be used within a
+// PreferencesProvider" crash unless PipelineStepSettings supplies them.
+function TooltipSettings() {
+  return (
+    <Tooltip content="help">
+      <button type="button">field</button>
+    </Tooltip>
+  );
+}
+
+const step = {
+  support: "editable",
+  toolId: "compress",
+  params: {},
+} as unknown as WorkingToolStep;
+
+const registry = {
+  compress: { automationSettings: TooltipSettings },
+} as unknown as Partial<ToolRegistry>;
+
+describe("PipelineStepSettings", () => {
+  it("renders reused editor tool settings (which use the shared Tooltip) without app-wide Preferences/Sidebar providers", () => {
+    expect(() =>
+      render(
+        <MantineProvider>
+          <PipelineStepSettings
+            step={step}
+            registry={registry}
+            onChange={() => {}}
+          />
+        </MantineProvider>,
+      ),
+    ).not.toThrow();
+    expect(screen.getByText("field")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx
index fe2ee9dd2a..672383ecd3 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx
+++ b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx
@@ -1,6 +1,8 @@
 import { Suspense } from "react";
 import { useTranslation } from "react-i18next";
 import { Banner } from "@app/ui";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { SidebarProvider } from "@app/contexts/SidebarContext";
 import { type ToolRegistry } from "@app/data/toolsTaxonomy";
 import { type ErasedToolParams } from "@app/hooks/tools/shared/toolOperationTypes";
 import { type WorkingToolStep } from "@app/hooks/tools/shared/toolAutomation";
@@ -46,14 +48,18 @@ export function PipelineStepSettings({
   }
 
   return (
-    <Suspense fallback={null}>
-      <Settings
-        parameters={step.params}
-        onParameterChange={(key, value) =>
-          onChange({ ...step.params, [key]: value })
-        }
-        disabled={false}
-      />
-    </Suspense>
+    <PreferencesProvider>
+      <SidebarProvider>
+        <Suspense fallback={null}>
+          <Settings
+            parameters={step.params}
+            onParameterChange={(key, value) =>
+              onChange({ ...step.params, [key]: value })
+            }
+            disabled={false}
+          />
+        </Suspense>
+      </SidebarProvider>
+    </PreferencesProvider>
   );
 }

From 41b1b89fcb680ec4976215c3430eab14eb4a63da Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Tue, 14 Jul 2026 10:43:07 +0100
Subject: [PATCH 018/109] Fix Policies page showing the Editor as a source
 twice (#7022)

# Description of Changes
The Policies page currently hard-codes the Editor to be available as a
source, but we now also have a virtual Editor source on the backend,
which the Policies page also renders. This removes the now-unnecessary
hard-coded Editor source.

## Before

<img width="842" height="640" alt="image"
src="https://github.com/user-attachments/assets/d78b33a3-fed4-4bb0-a02f-489ca2ae0614"
/>

## After

<img width="785" height="586" alt="image"
src="https://github.com/user-attachments/assets/37aa664f-74f2-41c7-b89a-9b483bffc3a2"
/>
---
 .../components/policies/PolicySetupWizard.tsx | 26 +++++--------------
 1 file changed, 7 insertions(+), 19 deletions(-)

diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
index 9dada09290..9dce344b89 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
@@ -213,22 +213,11 @@ function PolicySetupWizardBody({
   );
 
   const sourcesAsync = useAsync(() => fetchSources(), []);
-  const availableSources = useMemo(() => {
-    const backendSources = (sourcesAsync.data?.sources ?? []).filter(
-      (s) => s.status !== "disabled",
-    );
-    const editorSource = {
-      id: "editor",
-      name: t("portal.sources.types.editor.label"),
-      type: "editor",
-      status: "active" as const,
-      referenceCount: 0,
-      referencingPolicies: [],
-      config: [],
-      docsTotal: null,
-    };
-    return [editorSource, ...backendSources];
-  }, [sourcesAsync.data, t]);
+  const availableSources = useMemo(
+    () =>
+      (sourcesAsync.data?.sources ?? []).filter((s) => s.status !== "disabled"),
+    [sourcesAsync.data],
+  );
   // Document-type scoping has no UI; preserve any saved scope on edit and
   // default new policies to all document types.
   const [scopeTypes] = useState<string[]>(policy?.state.scopeTypes ?? []);
@@ -475,9 +464,8 @@ function PolicySetupWizardBody({
               {t("portal.policies.wizard.sources.loading")}
             </p>
           ) : (
-            // The editor is always an available source (unconditionally prepended
-            // to availableSources), so the list is never empty — no "no sources"
-            // state exists.
+            // The backend always returns the editor as a virtual source, so the
+            // loaded list is never empty - no "no sources" state exists.
             <div className="portal-policies__sources">
               {availableSources.map((src) => (
                 // A selectable multi-line tile (icon + name + type + check).

From 776749277cfb64bc39e95420e526f84649c588e1 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Tue, 14 Jul 2026 10:58:04 +0100
Subject: [PATCH 019/109] Redesign policies to use typed mappings properly
 (#7017)

# Description of Changes
The Policies page and all the frontend logic for running Policies is not
making use of the bidirectional type mappings that we now have to safely
convert from frontend to backend param models and vice versa. This
changes the way we track the types throughout so we use the mappings
properly.

Because of this, the Add Watermark settings in Policies now actually
pre-populate with the defaults instead of with nothing like they
previously did.

<img width="791" height="725" alt="image"
src="https://github.com/user-attachments/assets/cbdf4ae0-35af-4792-bf64-89216e48d304"
/>
---
 .../hooks/tools/shared/toolAutomation.test.ts |  36 -----
 .../core/hooks/tools/shared/toolAutomation.ts |  25 ----
 .../shared/toolOperationDescriptor.test.ts    |  37 +++++
 .../tools/shared/toolOperationDescriptor.ts   |  59 ++++++++
 frontend/editor/src/portal/api/policies.ts    |  72 +++-------
 .../policies/PolicySetupWizard.test.tsx       | 134 +++++++++++++++++
 .../components/policies/PolicySetupWizard.tsx | 135 ++++++++----------
 frontend/editor/src/portal/mocks/policies.ts  |  26 +++-
 .../components/policies/PolicyPiiField.tsx    |   9 +-
 .../policies/PolicyRedactConfig.tsx           |   5 +-
 .../policies/PolicyWatermarkConfig.tsx        |   8 +-
 .../proprietary/policies/operations.test.ts   | 112 +++++++++++++++
 .../src/proprietary/policies/operations.ts    | 131 +++++++++++++++++
 13 files changed, 587 insertions(+), 202 deletions(-)
 create mode 100644 frontend/editor/src/core/hooks/tools/shared/toolOperationDescriptor.test.ts
 create mode 100644 frontend/editor/src/core/hooks/tools/shared/toolOperationDescriptor.ts
 create mode 100644 frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx
 create mode 100644 frontend/editor/src/proprietary/policies/operations.test.ts
 create mode 100644 frontend/editor/src/proprietary/policies/operations.ts

diff --git a/frontend/editor/src/core/hooks/tools/shared/toolAutomation.test.ts b/frontend/editor/src/core/hooks/tools/shared/toolAutomation.test.ts
index 7caf6ee120..03b85798d8 100644
--- a/frontend/editor/src/core/hooks/tools/shared/toolAutomation.test.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/toolAutomation.test.ts
@@ -13,7 +13,6 @@ import {
 import {
   deserializeToolStep,
   getExecutableTools,
-  serializeStepFromEndpoint,
   serializeToolStep,
   stepRequiresUpload,
   type WorkingToolStep,
@@ -199,41 +198,6 @@ describe("serialize/deserialize round-trip", () => {
   });
 });
 
-describe("serializeStepFromEndpoint", () => {
-  test("maps a wizard step's UI params to the backend contract, filling defaults", () => {
-    // The shape the policy setup wizard holds: an endpoint plus UI-shaped params
-    // (redact's `wordsToRedact`), with several fields left to their defaults.
-    const api = serializeStepFromEndpoint(
-      "/api/v1/security/auto-redact",
-      { mode: "automatic", useRegex: true, wordsToRedact: ["ssn", "card"] },
-      dynamicRegistry,
-    );
-
-    expect(api.operation).toBe("/api/v1/security/auto-redact");
-    // wordsToRedact -> listOfText (the field the backend actually reads), and the
-    // frontend-only `mode` is dropped.
-    expect(api.parameters).toMatchObject({ listOfText: "ssn\ncard" });
-    expect(api.parameters).not.toHaveProperty("wordsToRedact");
-    expect(api.parameters).not.toHaveProperty("mode");
-    // Fields the wizard never set still get their defaults so the body is complete.
-    expect(api.parameters).toHaveProperty("wholeWordSearch");
-    expect(api.parameters).toHaveProperty("customPadding");
-  });
-
-  test("passes an unmapped endpoint's params through unchanged", () => {
-    expect(
-      serializeStepFromEndpoint(
-        "/api/v1/unknown/thing",
-        { keep: true },
-        dynamicRegistry,
-      ),
-    ).toEqual({
-      operation: "/api/v1/unknown/thing",
-      parameters: { keep: true },
-    });
-  });
-});
-
 describe("stepRequiresUpload", () => {
   const step = (params: Record<string, unknown>): WorkingToolStep => ({
     toolId: "compress" as ToolId,
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolAutomation.ts b/frontend/editor/src/core/hooks/tools/shared/toolAutomation.ts
index 2685881bf4..d567a1dad1 100644
--- a/frontend/editor/src/core/hooks/tools/shared/toolAutomation.ts
+++ b/frontend/editor/src/core/hooks/tools/shared/toolAutomation.ts
@@ -197,31 +197,6 @@ export function serializeToolStep(
   return { operation, parameters };
 }
 
-/**
- * Serialize a step held as an endpoint path plus frontend-shaped params - the form the policy setup
- * wizard keeps, where params match the tool's UI shape (e.g. redact's `wordsToRedact`) rather than
- * the backend contract - into the backend step contract, mapping params through the tool's
- * `toApiParams` (merged over its defaults, so fields the wizard never set still get their defaults).
- * The endpoint maps to a tool by path, so this works for dynamic-endpoint tools whose config
- * endpoint is a function. Endpoints that map to no known tool pass through unchanged.
- */
-export function serializeStepFromEndpoint(
-  operation: string,
-  params: ErasedToolParams,
-  registry: Partial<ToolRegistry>,
-): ToolApiStep {
-  const match = findToolByEndpoint({ operation, parameters: params }, registry);
-  const config = match?.[1].operationConfig;
-  if (!config) return { operation, parameters: params };
-  const merged = { ...(config.defaultParameters ?? {}), ...params };
-  return {
-    operation: resolveEndpoint(config, merged) ?? operation,
-    parameters: config.toApiParams
-      ? (config.toApiParams(merged) as Record<string, unknown>)
-      : {},
-  };
-}
-
 /**
  * Find the registry tool for a stored step's endpoint: exact match for static endpoints, else
  * membership in a dynamic tool's declared `endpoints` set (replaying its function can't recover a
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolOperationDescriptor.test.ts b/frontend/editor/src/core/hooks/tools/shared/toolOperationDescriptor.test.ts
new file mode 100644
index 0000000000..18bb5e282e
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/shared/toolOperationDescriptor.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, test } from "vitest";
+import { describeToolOperation } from "@app/hooks/tools/shared/toolOperationDescriptor";
+
+interface Params {
+  a: number;
+}
+
+// A minimal config that type-checks against the flatten endpoint's model.
+const CONFIG = {
+  endpoint: "/api/v1/misc/flatten" as const,
+  defaultParameters: { a: 1 } satisfies Params,
+  toApiParams: (p: Params) => ({ renderDpi: p.a }),
+  fromApiParams: (api: { renderDpi?: number }) => ({ a: api.renderDpi ?? 0 }),
+};
+
+describe("describeToolOperation", () => {
+  test("wraps the config's mappers and endpoint into a descriptor", () => {
+    const d = describeToolOperation("/api/v1/misc/flatten", CONFIG);
+    expect(d.endpoint).toBe("/api/v1/misc/flatten");
+    expect(d.toApi({ a: 200 })).toEqual({ renderDpi: 200 });
+  });
+
+  test("fromApi merges the mapped values over the defaults", () => {
+    const d = describeToolOperation("/api/v1/misc/flatten", CONFIG);
+    expect(d.fromApi({ renderDpi: 72 })).toEqual({ a: 72 });
+  });
+
+  test("throws when the config lacks a mapper", () => {
+    expect(() =>
+      describeToolOperation("/api/v1/misc/flatten", {
+        endpoint: "/api/v1/misc/flatten" as const,
+        defaultParameters: { a: 1 },
+        toApiParams: (p: Params) => ({ renderDpi: p.a }),
+      }),
+    ).toThrow(/mappers/);
+  });
+});
diff --git a/frontend/editor/src/core/hooks/tools/shared/toolOperationDescriptor.ts b/frontend/editor/src/core/hooks/tools/shared/toolOperationDescriptor.ts
new file mode 100644
index 0000000000..3c8f78d1b8
--- /dev/null
+++ b/frontend/editor/src/core/hooks/tools/shared/toolOperationDescriptor.ts
@@ -0,0 +1,59 @@
+/**
+ * Typed wrapper over a tool's `toApiParams`/`fromApiParams` mappers, binding one endpoint to safe
+ * frontend<->backend parameter conversion.
+ */
+
+import type { ToolApiParams, ToolEndpoint } from "@app/types/toolApiTypes";
+
+export interface ToolOperationDescriptor<E extends ToolEndpoint, TParams> {
+  readonly endpoint: E;
+  readonly defaultParameters: TParams;
+  toApi(params: TParams): ToolApiParams[E];
+  /** Backend model -> full frontend params (defaults merged under the mapped values). */
+  fromApi(api: ToolApiParams[E]): TParams;
+}
+
+/**
+ * Structural subset of a tool's config. `CE` is the config's declared endpoint type, inferred from
+ * the `endpoint` field: the literal for static tools, or the whole `ToolEndpoint` union for
+ * dynamic-endpoint tools (whose endpoint is a function typed against the union).
+ */
+export interface BidirectionalToolConfig<TParams, CE extends ToolEndpoint> {
+  endpoint: CE | null | ((params: TParams) => CE | null);
+  defaultParameters?: TParams;
+  toApiParams?(params: TParams): ToolApiParams[CE];
+  fromApiParams?(api: ToolApiParams[CE]): Partial<TParams>;
+}
+
+/**
+ * Pin a config to `endpoint` (passed explicitly, since dynamic-endpoint tools declare `endpoint` as
+ * a function). `E extends CE` rejects pairing a static tool's config with the wrong endpoint, while
+ * allowing a dynamic tool whose `CE` is the full union. Throws when mappers or defaults are missing.
+ */
+export function describeToolOperation<
+  E extends CE,
+  CE extends ToolEndpoint,
+  TParams,
+>(
+  endpoint: E,
+  config: BidirectionalToolConfig<TParams, CE>,
+): ToolOperationDescriptor<E, TParams> {
+  const { toApiParams, fromApiParams, defaultParameters } = config;
+  if (!toApiParams || !fromApiParams || defaultParameters === undefined) {
+    throw new Error(
+      `describeToolOperation: "${endpoint}" is missing mappers or defaults`,
+    );
+  }
+  return {
+    endpoint,
+    defaultParameters,
+    // A dynamic tool's mapper is typed against the union; narrow to this endpoint (sound - the
+    // runtime mapper produces this endpoint's model).
+    toApi: (params) => toApiParams(params) as ToolApiParams[E],
+    fromApi: (api) =>
+      ({
+        ...defaultParameters,
+        ...fromApiParams(api as ToolApiParams[CE]),
+      }) as TParams,
+  };
+}
diff --git a/frontend/editor/src/portal/api/policies.ts b/frontend/editor/src/portal/api/policies.ts
index 78f8b07667..bf6e4b395c 100644
--- a/frontend/editor/src/portal/api/policies.ts
+++ b/frontend/editor/src/portal/api/policies.ts
@@ -13,6 +13,8 @@ import type { TFunction } from "i18next";
 import { apiClient } from "@portal/api/http";
 import { fromWirePolicy, toWirePolicy } from "@app/policies/codec";
 import { runsToActivity, runsToStats } from "@app/policies/runs";
+import { policyStep, type PolicyToolStep } from "@app/policies/operations";
+import type { ToolEndpoint } from "@app/types/toolApiTypes";
 import type {
   PolicyDecodedState,
   PolicyRunView,
@@ -66,7 +68,7 @@ export interface PolicyConfigDef {
   rules: string[];
   scopeLabel: string;
   fields: PolicyField[];
-  defaultOperations: WirePipelineStep[];
+  defaultOperations: PolicyToolStep[];
 }
 
 export interface PolicyState {
@@ -128,20 +130,11 @@ export interface CatalogueEntry {
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
-/*  Tool → endpoint registry                                                  */
+/*  Endpoint display labels                                                   */
 /* ──────────────────────────────────────────────────────────────────────── */
 
-export const TOOL_ENDPOINTS: Record<string, string> = {
-  redact: "/api/v1/security/auto-redact",
-  sanitize: "/api/v1/security/sanitize-pdf",
-  watermark: "/api/v1/security/add-watermark",
-  ocr: "/api/v1/misc/ocr-pdf",
-  flatten: "/api/v1/misc/flatten",
-  compress: "/api/v1/misc/compress-pdf",
-};
-
-/** Values are i18n keys — render with t(). */
-export const ENDPOINT_LABELS: Record<string, string> = {
+/** i18n keys keyed by {@link ToolEndpoint}; labels stored steps in the detail view. */
+export const ENDPOINT_LABELS: Partial<Record<ToolEndpoint, string>> = {
   "/api/v1/security/auto-redact": "portal.policies.endpoints.autoRedact",
   "/api/v1/security/sanitize-pdf": "portal.policies.endpoints.sanitizePdf",
   "/api/v1/security/add-watermark": "portal.policies.endpoints.addWatermark",
@@ -154,7 +147,8 @@ export function humanizeEndpoint(
   path: string,
   t: (key: string) => string,
 ): string {
-  if (ENDPOINT_LABELS[path]) return t(ENDPOINT_LABELS[path]);
+  const label = ENDPOINT_LABELS[path as ToolEndpoint];
+  if (label) return t(label);
   const last = path.split("/").filter(Boolean).pop() ?? path;
   return last
     .replace(/-/g, " ")
@@ -230,10 +224,7 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
       "portal.policies.config.ingestion.rules.3",
     ],
     scopeLabel: "portal.policies.config.scopeAll",
-    defaultOperations: [
-      { operation: TOOL_ENDPOINTS.ocr, parameters: {} },
-      { operation: TOOL_ENDPOINTS.flatten, parameters: {} },
-    ],
+    defaultOperations: [policyStep("ocr"), policyStep("flatten")],
     fields: [
       {
         label: "portal.policies.config.ingestion.fields.minConfidence",
@@ -260,32 +251,16 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
     ],
     scopeLabel: "portal.policies.config.scopeAll",
     defaultOperations: [
-      {
-        operation: TOOL_ENDPOINTS.redact,
-        parameters: {
-          mode: "automatic",
-          useRegex: true,
-          convertPDFToImage: true,
-          wordsToRedact: DEFAULT_PII_PATTERNS,
-        },
-      },
-      {
-        operation: TOOL_ENDPOINTS.sanitize,
-        parameters: {
-          removeJavaScript: true,
-          removeEmbeddedFiles: false,
-          removeMetadata: false,
-          removeLinks: false,
-          removeFonts: false,
-        },
-      },
-      {
-        operation: TOOL_ENDPOINTS.watermark,
-        // convertPDFToImage bakes the watermark in so it can't be stripped
-        parameters: {
-          convertPDFToImage: true,
-        },
-      },
+      // Flatten to image so redactions can't be lifted off.
+      policyStep("redact", {
+        useRegex: true,
+        convertPDFToImage: true,
+        wordsToRedact: DEFAULT_PII_PATTERNS,
+      }),
+      // JavaScript removal only; the tool enables removeEmbeddedFiles by default, so turn it off.
+      policyStep("sanitize", { removeEmbeddedFiles: false }),
+      // Bake in via image so it can't be stripped.
+      policyStep("watermark", { convertPDFToImage: true }),
     ],
     fields: [],
   },
@@ -297,10 +272,7 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
       "portal.policies.config.compliance.rules.2",
     ],
     scopeLabel: "portal.policies.config.scopeAll",
-    defaultOperations: [
-      { operation: TOOL_ENDPOINTS.sanitize, parameters: {} },
-      { operation: TOOL_ENDPOINTS.flatten, parameters: {} },
-    ],
+    defaultOperations: [policyStep("sanitize"), policyStep("flatten")],
     fields: [
       {
         label: "portal.policies.config.compliance.fields.frameworks",
@@ -343,7 +315,7 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
       "portal.policies.config.routing.rules.2",
     ],
     scopeLabel: "portal.policies.config.scopeAll",
-    defaultOperations: [{ operation: TOOL_ENDPOINTS.compress, parameters: {} }],
+    defaultOperations: [policyStep("compress")],
     fields: [
       {
         label: "portal.policies.config.routing.fields.destination",
@@ -374,7 +346,7 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
       "portal.policies.config.retention.rules.2",
     ],
     scopeLabel: "portal.policies.config.scopeAll",
-    defaultOperations: [{ operation: TOOL_ENDPOINTS.compress, parameters: {} }],
+    defaultOperations: [policyStep("compress")],
     fields: [
       {
         label: "portal.policies.config.retention.fields.keepFor",
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx
new file mode 100644
index 0000000000..91765fe0e7
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx
@@ -0,0 +1,134 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { PolicySetupWizard } from "@portal/components/policies/PolicySetupWizard";
+import {
+  POLICY_CATEGORIES,
+  POLICY_CONFIG,
+  type CatalogueEntry,
+  type DecoratedPolicy,
+  type PolicySetupResult,
+  type PipelineStep,
+} from "@portal/api/policies";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: MantineProvider });
+
+// Deterministic i18n: return the fallback when given, else the key. initReactI18next is stubbed
+// because the import graph pulls core/i18n.ts, which registers it as a plugin.
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    // Second arg is a string fallback in some call sites and an interpolation object in others;
+    // only treat a string as the fallback.
+    t: (key: string, fallback?: unknown) =>
+      typeof fallback === "string" ? fallback : key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+  initReactI18next: { type: "3rdParty", init: vi.fn() },
+}));
+
+const fetchSources = vi.fn();
+vi.mock("@portal/api/sources", () => ({
+  fetchSources: () => fetchSources(),
+}));
+
+const CONTINUE = "portal.policies.wizard.actions.continue";
+const SAVE_CHANGES = "portal.policies.wizard.actions.saveChanges";
+const ENABLE = "portal.policies.wizard.actions.enablePolicy";
+
+const security = POLICY_CATEGORIES.find((c) => c.id === "security")!;
+const securityConfig = POLICY_CONFIG.security;
+
+function editEntry(steps: PipelineStep[]): CatalogueEntry {
+  const policy: DecoratedPolicy = {
+    category: security,
+    config: securityConfig,
+    state: {
+      configured: true,
+      status: "active",
+      sources: ["editor"],
+      scopeTypes: [],
+      reviewerEmail: "",
+      fieldValues: {},
+      runOn: "upload",
+      outputMode: "new_version",
+      outputName: "",
+      outputNamePosition: "suffix",
+      maxRetries: 0,
+      retryDelayMinutes: 0,
+      backendId: "pol-1",
+      isDefault: true,
+    },
+    steps,
+    stats: { enforced: 0, dataProcessed: "-", activeFor: "-" },
+    activity: [],
+  };
+  return { category: security, config: securityConfig, policy };
+}
+
+/** Advance the wizard from the workflow tab to the settings tab and submit. */
+async function submitWizard(saveLabel: string) {
+  fireEvent.click(await screen.findByRole("button", { name: CONTINUE }));
+  fireEvent.click(await screen.findByRole("button", { name: saveLabel }));
+}
+
+describe("PolicySetupWizard", () => {
+  beforeEach(() => {
+    fetchSources.mockResolvedValue({ sources: [] });
+  });
+
+  it("round-trips a saved step's backend params on edit", async () => {
+    const onSubmit = vi.fn().mockResolvedValue(undefined);
+    const entry = editEntry([
+      {
+        operation: "/api/v1/security/auto-redact",
+        parameters: { listOfText: "foo\nbar", useRegex: true },
+      },
+    ]);
+
+    render(
+      <PolicySetupWizard entry={entry} onClose={vi.fn()} onSubmit={onSubmit} />,
+    );
+    await submitWizard(SAVE_CHANGES);
+
+    await waitFor(() => expect(onSubmit).toHaveBeenCalled());
+    const result = onSubmit.mock.calls[0][1] as PolicySetupResult;
+    // Only the saved tool is enabled on edit, and its patterns survive the wire -> UI -> wire trip.
+    expect(result.steps).toEqual([
+      expect.objectContaining({
+        operation: "/api/v1/security/auto-redact",
+        parameters: expect.objectContaining({ listOfText: "foo\nbar" }),
+      }),
+    ]);
+  });
+
+  it("seeds the preset chain for a new policy (redact + sanitize on, watermark off)", async () => {
+    const onSubmit = vi.fn().mockResolvedValue(undefined);
+    const entry: CatalogueEntry = {
+      category: security,
+      config: securityConfig,
+      policy: null,
+    };
+
+    render(
+      <PolicySetupWizard entry={entry} onClose={vi.fn()} onSubmit={onSubmit} />,
+    );
+    await submitWizard(ENABLE);
+
+    await waitFor(() => expect(onSubmit).toHaveBeenCalled());
+    const result = onSubmit.mock.calls[0][1] as PolicySetupResult;
+    const endpoints = result.steps.map((s) => s.operation);
+    expect(endpoints).toEqual([
+      "/api/v1/security/auto-redact",
+      "/api/v1/security/sanitize-pdf",
+    ]);
+    // Redact carries the preset PII patterns as the backend's listOfText.
+    const redact = result.steps[0].parameters as { listOfText?: string };
+    expect(redact.listOfText).toBeTruthy();
+  });
+});
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
index 9dce344b89..43be7ca17c 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
@@ -13,23 +13,24 @@ import {
 } from "@app/ui";
 import { SettingsRow } from "@app/ui/SettingsRow";
 import {
-  TOOL_ENDPOINTS,
   humanizeEndpoint,
   type CatalogueEntry,
   type PipelineStep,
   type PolicySetupResult,
 } from "@portal/api/policies";
-import type { ToolRegistry, ToolRegistryEntry } from "@app/data/toolsTaxonomy";
 import {
-  deserializeToolStep,
-  serializeStepFromEndpoint,
-} from "@app/hooks/tools/shared/toolAutomation";
+  policyEndpoint,
+  policyStepFromWire,
+  policyStepToWire,
+  type PolicyParams,
+  type PolicyToolId,
+  type PolicyToolStep,
+} from "@app/policies/operations";
 import { fetchSources } from "@portal/api/sources";
 import { useAsync } from "@portal/hooks/useAsync";
 import { PolicyFieldRow } from "@portal/components/policies/PolicyFieldRow";
 import { policyIcon } from "@portal/components/policies/policyIcons";
 import { sourceTypeMeta } from "@portal/components/sources/sourceTypes";
-import { useToolRegistry } from "@app/contexts/ToolRegistryContext";
 import { PolicyRedactConfig } from "@app/components/policies/PolicyRedactConfig";
 import { PolicyWatermarkConfig } from "@app/components/policies/PolicyWatermarkConfig";
 import "@portal/views/Policies.css";
@@ -47,12 +48,8 @@ interface PolicySetupWizardProps {
 
 type Step = "workflow" | "settings";
 
-/** A configurable tool in the workflow step: whether it runs + its params. */
-interface ToolState {
-  operation: string;
-  enabled: boolean;
-  parameters: Record<string, unknown>;
-}
+/** A policy step plus whether it runs. */
+type ToolState = PolicyToolStep & { enabled: boolean };
 
 /** Resolve each field's effective value: saved override, else definition default. */
 function resolveFieldValues(
@@ -69,9 +66,8 @@ function resolveFieldValues(
  * round-trips); otherwise the category preset's default chain. Each preset step
  * starts enabled — the user toggles tools off in the workflow.
  */
-// Temporary: tracks which tools start disabled until the tool registry lands in
-// the portal and can drive this via registry metadata or a defaultEnabled flag.
-const DISABLED_BY_DEFAULT = new Set(["/api/v1/security/add-watermark"]);
+// Temporary until the catalogue carries a defaultEnabled flag.
+const DISABLED_BY_DEFAULT = new Set<PolicyToolId>(["watermark"]);
 
 /**
  * Policy-facing framing for each capability a policy can include. Labels and
@@ -81,43 +77,43 @@ const DISABLED_BY_DEFAULT = new Set(["/api/v1/security/add-watermark"]);
  * the humanised endpoint name with no description.
  */
 const CAPABILITY_META: Record<
-  string,
+  PolicyToolId,
   { labelKey: string; labelEn: string; descKey: string; descEn: string }
 > = {
-  [TOOL_ENDPOINTS.redact]: {
+  redact: {
     labelKey: "portal.policies.wizard.capability.redact.label",
     labelEn: "Redact sensitive information",
     descKey: "portal.policies.wizard.capability.redact.desc",
     descEn:
       "Finds and blacks out sensitive details — like Social Security and card numbers — so they can't be read.",
   },
-  [TOOL_ENDPOINTS.sanitize]: {
+  sanitize: {
     labelKey: "portal.policies.wizard.capability.sanitize.label",
     labelEn: "Strip active content",
     descKey: "portal.policies.wizard.capability.sanitize.desc",
     descEn:
       "Removes hidden JavaScript so nothing can run automatically when the document is opened.",
   },
-  [TOOL_ENDPOINTS.watermark]: {
+  watermark: {
     labelKey: "portal.policies.wizard.capability.watermark.label",
     labelEn: "Apply a watermark",
     descKey: "portal.policies.wizard.capability.watermark.desc",
     descEn: "Stamps a visible mark (e.g. “Confidential”) across every page.",
   },
-  [TOOL_ENDPOINTS.ocr]: {
+  ocr: {
     labelKey: "portal.policies.wizard.capability.ocr.label",
     labelEn: "Make text searchable",
     descKey: "portal.policies.wizard.capability.ocr.desc",
     descEn: "Runs OCR so scanned pages become selectable, searchable text.",
   },
-  [TOOL_ENDPOINTS.flatten]: {
+  flatten: {
     labelKey: "portal.policies.wizard.capability.flatten.label",
     labelEn: "Flatten the document",
     descKey: "portal.policies.wizard.capability.flatten.desc",
     descEn:
       "Merges form fields and annotations into the page so they can't be edited.",
   },
-  [TOOL_ENDPOINTS.compress]: {
+  compress: {
     labelKey: "portal.policies.wizard.capability.compress.label",
     labelEn: "Reduce file size",
     descKey: "portal.policies.wizard.capability.compress.desc",
@@ -125,29 +121,24 @@ const CAPABILITY_META: Record<
   },
 };
 
-function seedTools(
-  entry: CatalogueEntry,
-  registry: Partial<ToolRegistry>,
-): ToolState[] {
+function seedTools(entry: CatalogueEntry): ToolState[] {
   const savedSteps = entry.policy?.steps ?? [];
-  const savedByOp = new Map(savedSteps.map((s) => [s.operation, s]));
-  // Always use defaultOperations as the canonical list so tools added after a
-  // policy was first saved still appear when editing.
-  return entry.config.defaultOperations.map((s) => {
-    const saved = savedByOp.get(s.operation);
+  const savedByTool = new Map<PolicyToolId, PolicyToolStep>();
+  for (const wire of savedSteps) {
+    const step = policyStepFromWire(wire);
+    if (step) savedByTool.set(step.toolId, step);
+  }
+  // defaultOperations is the canonical list (so tools added later still show on edit); a saved
+  // step's params win over the preset.
+  return entry.config.defaultOperations.map((preset) => {
+    const saved = savedByTool.get(preset.toolId);
     return {
-      operation: s.operation,
+      ...(saved ?? preset),
       enabled: saved
         ? true
         : savedSteps.length > 0
           ? false
-          : !DISABLED_BY_DEFAULT.has(s.operation),
-      // Saved steps are in the backend contract shape; map them back to the UI
-      // shape the config controls edit (e.g. `listOfText` -> `wordsToRedact`).
-      // Presets are already authored in the UI shape, so use them as-is.
-      parameters: saved
-        ? deserializeToolStep(saved, registry).params
-        : s.parameters,
+          : !DISABLED_BY_DEFAULT.has(preset.toolId),
     };
   });
 }
@@ -185,26 +176,12 @@ function PolicySetupWizardBody({
   onSubmit: (entry: CatalogueEntry, result: PolicySetupResult) => Promise<void>;
 }) {
   const { t } = useTranslation();
-  const { allTools: toolRegistry } = useToolRegistry();
-
-  // Portal tool operations are endpoint paths (/api/v1/…), not short registry IDs.
-  // Build a reverse map so we can look up icons and display names by endpoint.
-  const registryByEndpoint = useMemo(() => {
-    const map = new Map<string, ToolRegistryEntry>();
-    for (const entry of Object.values(toolRegistry)) {
-      const ep = (entry as ToolRegistryEntry).operationConfig?.endpoint;
-      if (typeof ep === "string") map.set(ep, entry as ToolRegistryEntry);
-    }
-    return map;
-  }, [toolRegistry]);
 
   const { category, config, policy } = entry;
   const isEdit = policy != null;
 
   const [step, setStep] = useState<Step>("workflow");
-  const [tools, setTools] = useState<ToolState[]>(() =>
-    seedTools(entry, toolRegistry),
-  );
+  const [tools, setTools] = useState<ToolState[]>(() => seedTools(entry));
   const [fieldValues, setFieldValues] = useState(() =>
     resolveFieldValues(entry),
   );
@@ -245,9 +222,20 @@ function PolicySetupWizardBody({
 
   const enabledTools = useMemo(() => tools.filter((tl) => tl.enabled), [tools]);
 
-  function patchTool(operation: string, patch: Partial<ToolState>) {
+  function setToolEnabled(toolId: PolicyToolId, enabled: boolean) {
     setTools((prev) =>
-      prev.map((tl) => (tl.operation === operation ? { ...tl, ...patch } : tl)),
+      prev.map((tl) => (tl.toolId === toolId ? { ...tl, enabled } : tl)),
+    );
+  }
+
+  function setToolParams<Id extends PolicyToolId>(
+    toolId: Id,
+    params: PolicyParams<Id>,
+  ) {
+    setTools((prev) =>
+      prev.map((tl) =>
+        tl.toolId === toolId ? ({ ...tl, params } as ToolState) : tl,
+      ),
     );
   }
 
@@ -266,11 +254,8 @@ function PolicySetupWizardBody({
     }
     setError(null);
     setSubmitting(true);
-    // Map each tool's UI-shaped params (e.g. redact's `wordsToRedact`) into the
-    // backend step contract (e.g. `listOfText`) via its `toApiParams`; saving the
-    // UI shape verbatim would drop those fields and the step would run with none.
     const steps: PipelineStep[] = enabledTools.map((tl) =>
-      serializeStepFromEndpoint(tl.operation, tl.parameters, toolRegistry),
+      policyStepToWire(tl),
     );
     try {
       await onSubmit(entry, {
@@ -375,20 +360,16 @@ function PolicySetupWizardBody({
           <Card padding="none">
             <div className="portal-policies__capabilities">
               {tools.map((tl) => {
-                const meta = CAPABILITY_META[tl.operation];
+                const meta = CAPABILITY_META[tl.toolId];
                 const label = meta
                   ? t(meta.labelKey, meta.labelEn)
-                  : (registryByEndpoint.get(tl.operation)?.name ??
-                    humanizeEndpoint(tl.operation, t));
+                  : humanizeEndpoint(policyEndpoint(tl.toolId), t);
                 const description = meta
                   ? t(meta.descKey, meta.descEn)
                   : undefined;
-                const hasConfig =
-                  tl.operation === TOOL_ENDPOINTS.redact ||
-                  tl.operation === TOOL_ENDPOINTS.watermark;
                 return (
                   <div
-                    key={tl.operation}
+                    key={tl.toolId}
                     className="portal-policies__capability"
                     data-on={tl.enabled || undefined}
                   >
@@ -400,27 +381,27 @@ function PolicySetupWizardBody({
                           size="sm"
                           checked={tl.enabled}
                           onChange={(checked) =>
-                            patchTool(tl.operation, { enabled: checked })
+                            setToolEnabled(tl.toolId, checked)
                           }
                           label=""
                         />
                       }
                     />
-                    {tl.enabled && hasConfig && (
+                    {tl.enabled && (
                       <div className="portal-policies__capability-config">
-                        {tl.operation === TOOL_ENDPOINTS.redact && (
+                        {tl.toolId === "redact" && (
                           <PolicyRedactConfig
-                            parameters={tl.parameters}
-                            onChange={(parameters) =>
-                              patchTool(tl.operation, { parameters })
+                            parameters={tl.params}
+                            onChange={(params) =>
+                              setToolParams("redact", params)
                             }
                           />
                         )}
-                        {tl.operation === TOOL_ENDPOINTS.watermark && (
+                        {tl.toolId === "watermark" && (
                           <PolicyWatermarkConfig
-                            parameters={tl.parameters}
-                            onChange={(parameters) =>
-                              patchTool(tl.operation, { parameters })
+                            parameters={tl.params}
+                            onChange={(params) =>
+                              setToolParams("watermark", params)
                             }
                           />
                         )}
diff --git a/frontend/editor/src/portal/mocks/policies.ts b/frontend/editor/src/portal/mocks/policies.ts
index 27d5dfeadb..64a9b2ed19 100644
--- a/frontend/editor/src/portal/mocks/policies.ts
+++ b/frontend/editor/src/portal/mocks/policies.ts
@@ -4,13 +4,33 @@
  * only builds seed data for the MSW handlers and tests.
  */
 
-import type { PolicyRunView, WirePolicy } from "@app/policies/types";
-import { POLICY_CONFIG } from "@portal/api/policies";
+import type {
+  PolicyRunView,
+  WirePipelineStep,
+  WirePolicy,
+} from "@app/policies/types";
 
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  Seed data — real backend wire format                                      */
 /* ──────────────────────────────────────────────────────────────────────── */
 
+// Literal wire steps (not derived from the catalogue) so this fixtures module stays independent of
+// @portal/api/policies and its heavy tool-operation import graph.
+const SECURITY_STEPS: WirePipelineStep[] = [
+  {
+    operation: "/api/v1/security/auto-redact",
+    parameters: {
+      listOfText: "",
+      useRegex: true,
+      convertPDFToImage: true,
+    },
+  },
+  {
+    operation: "/api/v1/security/sanitize-pdf",
+    parameters: { removeJavaScript: true },
+  },
+];
+
 export function seedPolicies(): WirePolicy[] {
   return [
     {
@@ -19,7 +39,7 @@ export function seedPolicies(): WirePolicy[] {
       owner: "security@acme.com",
       enabled: true,
       trigger: null,
-      steps: POLICY_CONFIG.security.defaultOperations,
+      steps: SECURITY_STEPS,
       output: {
         type: "inline",
         options: {
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyPiiField.tsx b/frontend/editor/src/proprietary/components/policies/PolicyPiiField.tsx
index 59fe76c021..e464109567 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicyPiiField.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicyPiiField.tsx
@@ -1,6 +1,7 @@
 import { MultiSelect } from "@app/ui/MultiSelect";
 import { useTranslation } from "react-i18next";
 import { PII_PRESETS } from "@app/data/policyDefinitions";
+import type { RedactParameters } from "@app/hooks/tools/redact/useRedactParameters";
 
 /** The set of preset regexes — used to separate preset words from custom ones. */
 export const PRESET_PATTERNS = new Set(PII_PRESETS.map((p) => p.pattern));
@@ -8,8 +9,8 @@ const PATTERN_BY_VALUE = new Map(PII_PRESETS.map((p) => [p.value, p.pattern]));
 const VALUE_BY_PATTERN = new Map(PII_PRESETS.map((p) => [p.pattern, p.value]));
 
 interface PolicyPiiFieldProps {
-  parameters: Record<string, unknown>;
-  onChange: (parameters: Record<string, unknown>) => void;
+  parameters: RedactParameters;
+  onChange: (parameters: RedactParameters) => void;
   disabled?: boolean;
 }
 
@@ -26,9 +27,7 @@ export function PolicyPiiField({
   disabled,
 }: PolicyPiiFieldProps) {
   const { t } = useTranslation();
-  const words = Array.isArray(parameters.wordsToRedact)
-    ? (parameters.wordsToRedact as string[])
-    : [];
+  const words = parameters.wordsToRedact;
   const selected = words
     .map((w) => VALUE_BY_PATTERN.get(w))
     .filter((v): v is string => Boolean(v));
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyRedactConfig.tsx b/frontend/editor/src/proprietary/components/policies/PolicyRedactConfig.tsx
index 0823c59e0b..9d5e01e49f 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicyRedactConfig.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicyRedactConfig.tsx
@@ -1,9 +1,10 @@
 import { useEffect } from "react";
 import { PolicyPiiField } from "@app/components/policies/PolicyPiiField";
+import type { RedactParameters } from "@app/hooks/tools/redact/useRedactParameters";
 
 interface PolicyRedactConfigProps {
-  parameters: Record<string, unknown>;
-  onChange: (parameters: Record<string, unknown>) => void;
+  parameters: RedactParameters;
+  onChange: (parameters: RedactParameters) => void;
   disabled?: boolean;
 }
 
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyWatermarkConfig.tsx b/frontend/editor/src/proprietary/components/policies/PolicyWatermarkConfig.tsx
index 8697c9d030..ad62c4f890 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicyWatermarkConfig.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicyWatermarkConfig.tsx
@@ -3,8 +3,8 @@ import AddWatermarkSingleStepSettings from "@app/components/tools/addWatermark/A
 import type { AddWatermarkParameters } from "@app/hooks/tools/addWatermark/useAddWatermarkParameters";
 
 interface PolicyWatermarkConfigProps {
-  parameters: Record<string, unknown>;
-  onChange: (parameters: Record<string, unknown>) => void;
+  parameters: AddWatermarkParameters;
+  onChange: (parameters: AddWatermarkParameters) => void;
   disabled?: boolean;
 }
 
@@ -20,7 +20,7 @@ export function PolicyWatermarkConfig({
   disabled,
 }: PolicyWatermarkConfigProps) {
   useEffect(() => {
-    const patch: Record<string, unknown> = {};
+    const patch: Partial<AddWatermarkParameters> = {};
     if (parameters.convertPDFToImage !== true) patch.convertPDFToImage = true;
     // Policies only support text watermarks.
     if (parameters.watermarkType !== "text") patch.watermarkType = "text";
@@ -29,7 +29,7 @@ export function PolicyWatermarkConfig({
 
   return (
     <AddWatermarkSingleStepSettings
-      parameters={parameters as unknown as AddWatermarkParameters}
+      parameters={parameters}
       onParameterChange={(key, value) =>
         onChange({ ...parameters, [key]: value })
       }
diff --git a/frontend/editor/src/proprietary/policies/operations.test.ts b/frontend/editor/src/proprietary/policies/operations.test.ts
new file mode 100644
index 0000000000..491a15aa59
--- /dev/null
+++ b/frontend/editor/src/proprietary/policies/operations.test.ts
@@ -0,0 +1,112 @@
+import { describe, expect, test } from "vitest";
+import {
+  POLICY_OPERATIONS,
+  policyEndpoint,
+  policyStep,
+  policyStepFromWire,
+  policyStepToWire,
+  policyToolIdForEndpoint,
+  type PolicyToolId,
+} from "@app/policies/operations";
+
+const ALL_TOOL_IDS = Object.keys(POLICY_OPERATIONS) as PolicyToolId[];
+
+describe("POLICY_OPERATIONS", () => {
+  test("every category operation is a typed descriptor with a known endpoint", () => {
+    // The catalogue uses these six across all categories; each must be wired.
+    expect(ALL_TOOL_IDS.sort()).toEqual([
+      "compress",
+      "flatten",
+      "ocr",
+      "redact",
+      "sanitize",
+      "watermark",
+    ]);
+    for (const id of ALL_TOOL_IDS) {
+      expect(POLICY_OPERATIONS[id].endpoint).toBe(policyEndpoint(id));
+      expect(typeof POLICY_OPERATIONS[id].toApi).toBe("function");
+      expect(typeof POLICY_OPERATIONS[id].fromApi).toBe("function");
+    }
+  });
+
+  test("policyEndpoint returns the pinned endpoint literal", () => {
+    expect(policyEndpoint("redact")).toBe("/api/v1/security/auto-redact");
+    expect(policyEndpoint("sanitize")).toBe("/api/v1/security/sanitize-pdf");
+    expect(policyEndpoint("watermark")).toBe("/api/v1/security/add-watermark");
+    expect(policyEndpoint("ocr")).toBe("/api/v1/misc/ocr-pdf");
+    expect(policyEndpoint("flatten")).toBe("/api/v1/misc/flatten");
+    expect(policyEndpoint("compress")).toBe("/api/v1/misc/compress-pdf");
+  });
+
+  test("policyToolIdForEndpoint maps endpoints back, and rejects non-policy ones", () => {
+    for (const id of ALL_TOOL_IDS) {
+      expect(policyToolIdForEndpoint(policyEndpoint(id))).toBe(id);
+    }
+    expect(policyToolIdForEndpoint("/api/v1/misc/repair")).toBeNull();
+    expect(policyToolIdForEndpoint("not-an-endpoint")).toBeNull();
+  });
+});
+
+describe("policyStep", () => {
+  test("merges partial params over the tool's defaults", () => {
+    const step = policyStep("redact", {
+      useRegex: true,
+      wordsToRedact: ["ssn", "card"],
+    });
+    expect(step.toolId).toBe("redact");
+    // Overrides applied...
+    expect(step.params.useRegex).toBe(true);
+    expect(step.params.wordsToRedact).toEqual(["ssn", "card"]);
+    // ...and untouched fields fall back to the tool's defaults.
+    expect(step.params.mode).toBe("automatic");
+    expect(step.params.redactColor).toBe("#000000");
+  });
+});
+
+describe("wire conversion", () => {
+  test("redact maps frontend params to the backend request model (wordsToRedact -> listOfText)", () => {
+    const wire = policyStepToWire(
+      policyStep("redact", {
+        useRegex: true,
+        convertPDFToImage: true,
+        wordsToRedact: ["ssn", "card"],
+      }),
+    );
+    expect(wire.operation).toBe("/api/v1/security/auto-redact");
+    // The backend field the endpoint actually reads, and no frontend-only `mode`/`wordsToRedact`.
+    expect(wire.parameters).toMatchObject({
+      listOfText: "ssn\ncard",
+      useRegex: true,
+      convertPDFToImage: true,
+    });
+    expect(wire.parameters).not.toHaveProperty("wordsToRedact");
+    expect(wire.parameters).not.toHaveProperty("mode");
+  });
+
+  test("every policy operation round-trips through wire and back", () => {
+    for (const id of ALL_TOOL_IDS) {
+      const step = policyStep(id);
+      const back = policyStepFromWire(policyStepToWire(step));
+      expect(back?.toolId).toBe(id);
+    }
+  });
+
+  test("redact round-trip preserves the configured patterns", () => {
+    const step = policyStep("redact", {
+      useRegex: true,
+      wordsToRedact: ["ssn", "card"],
+    });
+    const back = policyStepFromWire(policyStepToWire(step));
+    expect(back?.toolId).toBe("redact");
+    if (back?.toolId === "redact") {
+      expect(back.params.wordsToRedact).toEqual(["ssn", "card"]);
+      expect(back.params.useRegex).toBe(true);
+    }
+  });
+
+  test("a non-policy endpoint decodes to null", () => {
+    expect(
+      policyStepFromWire({ operation: "/api/v1/misc/repair", parameters: {} }),
+    ).toBeNull();
+  });
+});
diff --git a/frontend/editor/src/proprietary/policies/operations.ts b/frontend/editor/src/proprietary/policies/operations.ts
new file mode 100644
index 0000000000..66e92c448a
--- /dev/null
+++ b/frontend/editor/src/proprietary/policies/operations.ts
@@ -0,0 +1,131 @@
+/**
+ * The tool operations the Policies feature can run, each a typed {@link ToolOperationDescriptor}.
+ * Source of truth for the catalogue, wizard, and wire conversion. Add a tool here to use it in a
+ * policy - the catalogue can't reference an untyped operation.
+ */
+
+import { describeToolOperation } from "@app/hooks/tools/shared/toolOperationDescriptor";
+import { redactOperationConfig } from "@app/hooks/tools/redact/useRedactOperation";
+import { sanitizeOperationConfig } from "@app/hooks/tools/sanitize/useSanitizeOperation";
+import { addWatermarkOperationConfig } from "@app/hooks/tools/addWatermark/useAddWatermarkOperation";
+import { ocrOperationConfig } from "@app/hooks/tools/ocr/useOCROperation";
+import { flattenOperationConfig } from "@app/hooks/tools/flatten/useFlattenOperation";
+import { compressOperationConfig } from "@app/hooks/tools/compress/useCompressOperation";
+import type { ToolOperationDescriptor } from "@app/hooks/tools/shared/toolOperationDescriptor";
+import type { ToolApiParams, ToolEndpoint } from "@app/types/toolApiTypes";
+import type { WirePipelineStep } from "@app/policies/types";
+
+export const POLICY_OPERATIONS = {
+  redact: describeToolOperation(
+    "/api/v1/security/auto-redact",
+    redactOperationConfig,
+  ),
+  sanitize: describeToolOperation(
+    "/api/v1/security/sanitize-pdf",
+    sanitizeOperationConfig,
+  ),
+  watermark: describeToolOperation(
+    "/api/v1/security/add-watermark",
+    addWatermarkOperationConfig,
+  ),
+  ocr: describeToolOperation("/api/v1/misc/ocr-pdf", ocrOperationConfig),
+  flatten: describeToolOperation(
+    "/api/v1/misc/flatten",
+    flattenOperationConfig,
+  ),
+  compress: describeToolOperation(
+    "/api/v1/misc/compress-pdf",
+    compressOperationConfig,
+  ),
+} as const;
+
+export type PolicyToolId = keyof typeof POLICY_OPERATIONS;
+
+export type PolicyParams<Id extends PolicyToolId> =
+  (typeof POLICY_OPERATIONS)[Id] extends ToolOperationDescriptor<
+    ToolEndpoint,
+    infer P
+  >
+    ? P
+    : never;
+
+/** Discriminated on `toolId` so `params` matches the tool. */
+export type PolicyToolStep = {
+  [Id in PolicyToolId]: { toolId: Id; params: PolicyParams<Id> };
+}[PolicyToolId];
+
+export type PolicyToolStepOf<Id extends PolicyToolId> = Extract<
+  PolicyToolStep,
+  { toolId: Id }
+>;
+
+const POLICY_TOOL_IDS = Object.keys(POLICY_OPERATIONS) as PolicyToolId[];
+
+const TOOL_ID_BY_ENDPOINT = new Map<string, PolicyToolId>(
+  POLICY_TOOL_IDS.map((id) => [POLICY_OPERATIONS[id].endpoint, id]),
+);
+
+export function policyEndpoint(toolId: PolicyToolId): ToolEndpoint {
+  return POLICY_OPERATIONS[toolId].endpoint;
+}
+
+/** Tool id for an endpoint path, or null if it isn't a policy tool. */
+export function policyToolIdForEndpoint(endpoint: string): PolicyToolId | null {
+  return TOOL_ID_BY_ENDPOINT.get(endpoint) ?? null;
+}
+
+/** A step for `toolId`, partial params merged over the tool's defaults. */
+export function policyStep<Id extends PolicyToolId>(
+  toolId: Id,
+  params: Partial<PolicyParams<Id>> = {},
+): PolicyToolStepOf<Id> {
+  const defaults = POLICY_OPERATIONS[toolId].defaultParameters as object;
+  return {
+    toolId,
+    params: { ...defaults, ...(params as object) },
+  } as PolicyToolStepOf<Id>;
+}
+
+export function policyStepToWire(step: PolicyToolStep): WirePipelineStep {
+  return serializeStep(step);
+}
+
+// Generic over the id so `params` stays correlated with the descriptor; TS can't do that through
+// the union, so `op` is widened here (a contained cast at the wire boundary).
+function serializeStep<Id extends PolicyToolId>(step: {
+  toolId: Id;
+  params: PolicyParams<Id>;
+}): WirePipelineStep {
+  const op = POLICY_OPERATIONS[step.toolId] as ToolOperationDescriptor<
+    ToolEndpoint,
+    PolicyParams<Id>
+  >;
+  return {
+    operation: op.endpoint,
+    parameters: op.toApi(step.params) as Record<string, unknown>,
+  };
+}
+
+/** Wire step -> typed policy step, or null if the endpoint isn't a policy tool. */
+export function policyStepFromWire(
+  wire: WirePipelineStep,
+): PolicyToolStep | null {
+  const toolId = policyToolIdForEndpoint(wire.operation);
+  if (!toolId) return null;
+  return deserializeStep(toolId, wire.parameters);
+}
+
+function deserializeStep<Id extends PolicyToolId>(
+  toolId: Id,
+  parameters: Record<string, unknown>,
+): PolicyToolStepOf<Id> {
+  const op = POLICY_OPERATIONS[toolId] as ToolOperationDescriptor<
+    ToolEndpoint,
+    PolicyParams<Id>
+  >;
+  // Wire params are untyped JSON; this is the one point they enter the typed model.
+  const params = op.fromApi(
+    parameters as unknown as ToolApiParams[ToolEndpoint],
+  );
+  return { toolId, params } as unknown as PolicyToolStepOf<Id>;
+}

From 0570c4c4d9e7bf4786a02ab770ef75f116ac3719 Mon Sep 17 00:00:00 2001
From: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Date: Tue, 14 Jul 2026 13:30:33 +0100
Subject: [PATCH 020/109] Create-PDF engine: render from a structured document
 (#7018)

---
 app/allowed-licenses.json                     |  12 ++
 app/proprietary/build.gradle                  |  14 ++
 .../api/CreatePdfAgentController.java         |  55 ++++--
 .../model/api/ai/create/AiDocument.java       |  35 ++++
 .../service/AiDocumentHtmlRenderer.java       | 135 +++++++++++++
 .../templates/ai/create}/document.html.jinja2 |  40 ++--
 .../policy/engine/PolicyExecutorTest.java     |   4 +-
 .../service/AiDocumentHtmlRendererTest.java   | 139 ++++++++++++++
 build.gradle                                  |   9 +
 engine/pyproject.toml                         |   1 -
 .../src/stirling/agents/pdf_create/agent.py   |  41 ++--
 engine/src/stirling/contracts/pdf_create.py   |  14 +-
 .../src/stirling/models/agent_tool_models.py  |   2 +-
 engine/tests/agents/test_pdf_create.py        | 177 +++---------------
 engine/uv.lock                                |   2 -
 15 files changed, 453 insertions(+), 227 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/ai/create/AiDocument.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/service/AiDocumentHtmlRenderer.java
 rename {engine/src/stirling/agents/pdf_create/templates => app/proprietary/src/main/resources/templates/ai/create}/document.html.jinja2 (87%)
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/service/AiDocumentHtmlRendererTest.java

diff --git a/app/allowed-licenses.json b/app/allowed-licenses.json
index 9f1ff96359..88ed8ba4d5 100644
--- a/app/allowed-licenses.json
+++ b/app/allowed-licenses.json
@@ -208,6 +208,18 @@
       "moduleName": ".*",
       "moduleLicense": "The W3C License"
     },
+    {
+      "moduleName": "com.google.re2j:re2j",
+      "moduleLicense": "Go License"
+    },
+    {
+      "moduleName": "com.hubspot:algebra",
+      "moduleLicense": null
+    },
+    {
+      "moduleName": "com.hubspot.immutables:immutables-exceptions",
+      "moduleLicense": null
+    },
     {
       "moduleName": ".*",
       "moduleLicense": "UnRar License"
diff --git a/app/proprietary/build.gradle b/app/proprietary/build.gradle
index fb21ed0d0c..1e51b820ae 100644
--- a/app/proprietary/build.gradle
+++ b/app/proprietary/build.gradle
@@ -66,6 +66,20 @@ dependencies {
 
     implementation "com.google.code.gson:gson:${gsonVersion}"
 
+    // jinjava/jjwt transitively request older Jackson 2 versions; declare the current
+    // version directly so it is selected consistently (root build.gradle pins are the fallback).
+    runtimeOnly "com.fasterxml.jackson.core:jackson-core:${jackson2Version}"
+    runtimeOnly "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}"
+
+    implementation("com.hubspot.jinjava:jinjava:${jinjavaVersion}") {
+        // Compile-time-only annotation artifacts (class-retention annotations, not needed at
+        // runtime) whose declared licences (LGPL / none) fail the licence compatibility check.
+        exclude group: 'com.google.code.findbugs', module: 'annotations'
+        exclude group: 'org.derive4j', module: 'derive4j-annotation'
+        exclude group: 'com.hubspot.immutables', module: 'hubspot-style'
+        exclude group: 'com.hubspot.immutables', module: 'immutable-collection-encodings'
+    }
+
     api 'io.micrometer:micrometer-registry-prometheus'
 
     api "io.jsonwebtoken:jjwt-api:${jwtVersion}"
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/CreatePdfAgentController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/CreatePdfAgentController.java
index 15b7982dec..5e2298937a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/CreatePdfAgentController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/CreatePdfAgentController.java
@@ -8,12 +8,14 @@ import java.util.List;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.springframework.core.io.Resource;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
 
 import io.github.pixee.security.Filenames;
 import io.swagger.v3.oas.annotations.Hidden;
@@ -24,18 +26,24 @@ import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.configuration.RuntimePathConfig;
+import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.util.ProcessExecutor;
 import stirling.software.common.util.TempFile;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
+import stirling.software.proprietary.model.api.ai.create.AiDocument;
+import stirling.software.proprietary.service.AiDocumentHtmlRenderer;
+
+import tools.jackson.core.JacksonException;
+import tools.jackson.databind.ObjectMapper;
 
 /**
- * Dispatchable tool that converts an AI-generated HTML string to a PDF via WeasyPrint.
+ * Dispatchable tool that converts an AI-generated document model to a PDF via WeasyPrint.
  *
  * <p>Called by {@link stirling.software.proprietary.service.AiWorkflowService} when the engine
- * emits a {@code CREATE_PDF_FROM_HTML_AGENT} plan step. The HTML comes from a trusted Jinja
- * template so sanitization is intentionally skipped.
+ * emits a {@code CREATE_PDF_FROM_HTML_AGENT} plan step. The engine supplies the document as
+ * structured fields; the HTML is built here from a fixed template.
  */
 @Slf4j
 @Hidden
@@ -48,6 +56,9 @@ public class CreatePdfAgentController {
     private final TempFileManager tempFileManager;
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final RuntimePathConfig runtimePathConfig;
+    private final ApplicationProperties applicationProperties;
+    private final ObjectMapper objectMapper;
+    private final AiDocumentHtmlRenderer htmlRenderer;
 
     /**
      * Returns true only when WeasyPrint is definitively unavailable — either the binary could not
@@ -74,32 +85,42 @@ public class CreatePdfAgentController {
             value = "/create-pdf-from-html-agent",
             consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @Operation(
-            summary = "Convert AI-generated HTML to a PDF",
+            summary = "Convert an AI-generated document to a PDF",
             description =
-                    "Accepts an HTML document as a plain-text parameter and returns a PDF."
-                            + " This endpoint is dispatched by the AI workflow orchestrator as a"
-                            + " plan step; it is not intended for direct client use.")
-    public ResponseEntity<Resource> createPdfFromHtml(
-            @RequestParam("htmlContent") String htmlContent,
-            @RequestParam("filename") String filename)
+                    "Accepts a structured document as a JSON parameter and returns a PDF. This"
+                            + " endpoint is dispatched by the AI workflow orchestrator as a plan"
+                            + " step; it is not intended for direct client use.")
+    public ResponseEntity<Resource> createPdf(
+            @RequestParam("document") String document, @RequestParam("filename") String filename)
             throws Exception {
 
+        if (!applicationProperties.getAiEngine().isEnabled()) {
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND);
+        }
+
+        AiDocument model;
+        try {
+            model = objectMapper.readValue(document, AiDocument.class);
+        } catch (JacksonException e) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST);
+        }
+
+        String html = htmlRenderer.render(model);
+
         log.info(
-                "[create-pdf-agent] converting HTML to PDF via WeasyPrint — html_bytes={}",
-                htmlContent.length());
+                "[create-pdf-agent] converting document to PDF via WeasyPrint — html_bytes={}",
+                html.length());
 
         try (TempFile htmlFile = tempFileManager.createManagedTempFile(".html");
                 TempFile pdfFile = tempFileManager.createManagedTempFile(".pdf")) {
 
-            Files.writeString(htmlFile.getPath(), htmlContent, StandardCharsets.UTF_8);
+            Files.writeString(htmlFile.getPath(), html, StandardCharsets.UTF_8);
 
             List<String> command = new ArrayList<>();
             command.add(runtimePathConfig.getWeasyPrintPath());
             command.add("-e");
             command.add("utf-8");
             command.add("-v");
-            // SSRF: the HTML is self-contained and the engine validates style colours, so no
-            // external url() reaches WeasyPrint. For full isolation, run it network-isolated.
             command.add(htmlFile.getAbsolutePath());
             command.add(pdfFile.getAbsolutePath());
 
@@ -126,8 +147,8 @@ public class CreatePdfAgentController {
             // avoids materialising the whole document as a byte[] twice (read-all + re-serialise),
             // which matters for large generated documents.
             TempFile tempOut = tempFileManager.createManagedTempFile(".pdf");
-            try (PDDocument document = pdfDocumentFactory.load(pdfFile.getPath())) {
-                document.save(tempOut.getPath().toFile());
+            try (PDDocument pdDocument = pdfDocumentFactory.load(pdfFile.getPath())) {
+                pdDocument.save(tempOut.getPath().toFile());
             } catch (Exception e) {
                 tempOut.close();
                 throw e;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/ai/create/AiDocument.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/ai/create/AiDocument.java
new file mode 100644
index 0000000000..6fd95728c2
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/ai/create/AiDocument.java
@@ -0,0 +1,35 @@
+package stirling.software.proprietary.model.api.ai.create;
+
+import java.util.List;
+
+import lombok.Data;
+
+@Data
+public class AiDocument {
+
+    private String title;
+    private String subtitle;
+    private String referenceNumber;
+    private Style style;
+    private List<Section> sections;
+
+    @Data
+    public static class Style {
+        private String primaryColor;
+        private String backgroundColor;
+        private String bodyTextColor;
+    }
+
+    @Data
+    public static class Section {
+        private String type;
+        private String heading;
+        private String body;
+        private List<List<String>> pairs;
+        private List<String> columns;
+        private List<List<String>> rows;
+        private List<String> totalRow;
+        private List<String> items;
+        private List<String> signatories;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/AiDocumentHtmlRenderer.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiDocumentHtmlRenderer.java
new file mode 100644
index 0000000000..26eff3113c
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiDocumentHtmlRenderer.java
@@ -0,0 +1,135 @@
+package stirling.software.proprietary.service;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.regex.Pattern;
+
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.stereotype.Component;
+
+import com.hubspot.jinjava.Jinjava;
+import com.hubspot.jinjava.JinjavaConfig;
+
+import stirling.software.proprietary.model.api.ai.create.AiDocument;
+
+/** Renders an {@link AiDocument} to HTML using a Jinja template loaded from the classpath. */
+@Component
+public class AiDocumentHtmlRenderer {
+
+    private static final String TEMPLATE_PATH = "templates/ai/create/document.html.jinja2";
+
+    private static final Pattern SAFE_COLOR = Pattern.compile("^#[0-9a-fA-F]{6}$");
+
+    private final Jinjava jinjava;
+    private final String template;
+
+    public AiDocumentHtmlRenderer() {
+        JinjavaConfig config =
+                JinjavaConfig.newBuilder().withNestedInterpretationEnabled(false).build();
+        this.jinjava = new Jinjava(config);
+        this.template = loadTemplate();
+    }
+
+    public String render(AiDocument doc) {
+        return jinjava.render(template, buildContext(doc));
+    }
+
+    private static Map<String, Object> buildContext(AiDocument doc) {
+        Map<String, Object> context = new LinkedHashMap<>();
+        context.put("title", doc.getTitle());
+        context.put("subtitle", doc.getSubtitle());
+        context.put("reference_number", doc.getReferenceNumber());
+
+        AiDocument.Style style = doc.getStyle();
+        if (style != null) {
+            context.put("style_primary", safeColor(style.getPrimaryColor()));
+            context.put("style_background", safeColor(style.getBackgroundColor()));
+            context.put("style_body", safeColor(style.getBodyTextColor()));
+        }
+
+        List<Map<String, Object>> sections = new ArrayList<>();
+        if (doc.getSections() != null) {
+            for (AiDocument.Section section : doc.getSections()) {
+                if (section != null && section.getType() != null) {
+                    sections.add(buildSection(section));
+                }
+            }
+        }
+        context.put("sections", sections);
+        return context;
+    }
+
+    private static Map<String, Object> buildSection(AiDocument.Section section) {
+        Map<String, Object> node = new LinkedHashMap<>();
+        node.put("type", section.getType());
+        node.put("heading", section.getHeading());
+        switch (section.getType()) {
+            case "text" -> node.put("paragraphs", paragraphs(section.getBody()));
+            case "key_value" -> node.put("pairs", pairs(section.getPairs()));
+            case "line_items" -> {
+                node.put("columns", orEmpty(section.getColumns()));
+                node.put("rows", orEmptyRows(section.getRows()));
+                node.put("total_row", emptyToNull(section.getTotalRow()));
+            }
+            case "bullet_list" -> node.put("items", orEmpty(section.getItems()));
+            case "signature" -> node.put("signatories", orEmpty(section.getSignatories()));
+            default -> {}
+        }
+        return node;
+    }
+
+    private static List<String> paragraphs(String body) {
+        String text = body == null ? "" : body;
+        List<String> out = new ArrayList<>();
+        for (String paragraph : text.split("\n\n")) {
+            out.add(paragraph.replace("\n", " "));
+        }
+        return out;
+    }
+
+    private static List<Map<String, String>> pairs(List<List<String>> pairs) {
+        List<Map<String, String>> out = new ArrayList<>();
+        if (pairs != null) {
+            for (List<String> pair : pairs) {
+                Map<String, String> node = new LinkedHashMap<>();
+                node.put("label", pair.isEmpty() ? "" : pair.get(0));
+                node.put("value", pair.size() < 2 ? "" : pair.get(1));
+                out.add(node);
+            }
+        }
+        return out;
+    }
+
+    private static List<String> orEmpty(List<String> values) {
+        return values == null ? List.of() : values;
+    }
+
+    private static List<List<String>> orEmptyRows(List<List<String>> rows) {
+        return rows == null ? List.of() : rows;
+    }
+
+    private static List<String> emptyToNull(List<String> values) {
+        return values == null || values.isEmpty() ? null : values;
+    }
+
+    private static String safeColor(String value) {
+        if (value == null) {
+            return null;
+        }
+        String trimmed = value.trim();
+        return SAFE_COLOR.matcher(trimmed).matches() ? trimmed : null;
+    }
+
+    private static String loadTemplate() {
+        try {
+            return new ClassPathResource(TEMPLATE_PATH).getContentAsString(StandardCharsets.UTF_8);
+        } catch (IOException e) {
+            throw new UncheckedIOException(e);
+        }
+    }
+}
diff --git a/engine/src/stirling/agents/pdf_create/templates/document.html.jinja2 b/app/proprietary/src/main/resources/templates/ai/create/document.html.jinja2
similarity index 87%
rename from engine/src/stirling/agents/pdf_create/templates/document.html.jinja2
rename to app/proprietary/src/main/resources/templates/ai/create/document.html.jinja2
index b969458f5e..0a4a2cfc20 100644
--- a/engine/src/stirling/agents/pdf_create/templates/document.html.jinja2
+++ b/app/proprietary/src/main/resources/templates/ai/create/document.html.jinja2
@@ -1,3 +1,4 @@
+{%- autoescape true -%}
 <!DOCTYPE html>
 <html lang="en">
 <head>
@@ -175,18 +176,18 @@
     color: var(--color-label);
   }
 </style>
-{%- if doc.style %}
+{%- if style_primary or style_background or style_body %}
 <style>
   :root {
-    {%- if doc.style.primary_color %}
-    --color-primary: {{ doc.style.primary_color }};
+    {%- if style_primary %}
+    --color-primary: {{ style_primary }};
     {%- endif %}
-    {%- if doc.style.background_color %}
-    --color-bg: {{ doc.style.background_color }};
+    {%- if style_background %}
+    --color-bg: {{ style_background }};
     {%- endif %}
-    {%- if doc.style.body_text_color %}
-    --color-body: {{ doc.style.body_text_color }};
-    --color-label: {{ doc.style.body_text_color }};
+    {%- if style_body %}
+    --color-body: {{ style_body }};
+    --color-label: {{ style_body }};
     {%- endif %}
   }
 </style>
@@ -195,16 +196,16 @@
 <body>
 
 <div class="doc-header">
-  <div class="doc-title">{{ doc.title }}</div>
-  {%- if doc.subtitle %}
-  <div class="doc-subtitle">{{ doc.subtitle }}</div>
+  <div class="doc-title">{{ title }}</div>
+  {%- if subtitle %}
+  <div class="doc-subtitle">{{ subtitle }}</div>
   {%- endif %}
-  {%- if doc.reference_number %}
-  <div class="doc-reference">{{ doc.reference_number }}</div>
+  {%- if reference_number %}
+  <div class="doc-reference">{{ reference_number }}</div>
   {%- endif %}
 </div>
 
-{%- for section in doc.sections %}
+{%- for section in sections %}
 
 {%- if section.type == "text" %}
 <section>
@@ -212,8 +213,8 @@
   <h2>{{ section.heading }}</h2>
   {%- endif %}
   <div class="text-body">
-    {%- for para in section.body.split('\n\n') %}
-    <p>{{ para | replace('\n', ' ') }}</p>
+    {%- for para in section.paragraphs %}
+    <p>{{ para }}</p>
     {%- endfor %}
   </div>
 </section>
@@ -225,10 +226,10 @@
   {%- endif %}
   <table class="kv-table">
     <tbody>
-      {%- for label, value in section.pairs %}
+      {%- for pair in section.pairs %}
       <tr>
-        <td class="kv-label">{{ label }}</td>
-        <td class="kv-value">{{ value }}</td>
+        <td class="kv-label">{{ pair.label }}</td>
+        <td class="kv-value">{{ pair.value }}</td>
       </tr>
       {%- endfor %}
     </tbody>
@@ -299,3 +300,4 @@
 
 </body>
 </html>
+{%- endautoescape %}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyExecutorTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyExecutorTest.java
index 9b10d9090e..4d9ea1deb7 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyExecutorTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyExecutorTest.java
@@ -166,8 +166,8 @@ class PolicyExecutorTest {
                                 new PipelineStep(
                                         createPdf,
                                         Map.of(
-                                                "htmlContent",
-                                                "<p>hi</p>",
+                                                "document",
+                                                "{\"title\":\"PO\",\"sections\":[]}",
                                                 "filename",
                                                 "purchase-order.pdf"))),
                         PolicyInputs.of(List.of()),
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/service/AiDocumentHtmlRendererTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiDocumentHtmlRendererTest.java
new file mode 100644
index 0000000000..7b491c3539
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiDocumentHtmlRendererTest.java
@@ -0,0 +1,139 @@
+package stirling.software.proprietary.service;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.util.List;
+
+import org.junit.jupiter.api.Test;
+
+import stirling.software.proprietary.model.api.ai.create.AiDocument;
+
+class AiDocumentHtmlRendererTest {
+
+    private final AiDocumentHtmlRenderer renderer = new AiDocumentHtmlRenderer();
+
+    private static AiDocument.Section section(String type) {
+        AiDocument.Section s = new AiDocument.Section();
+        s.setType(type);
+        return s;
+    }
+
+    private static AiDocument document(String title, List<AiDocument.Section> sections) {
+        AiDocument doc = new AiDocument();
+        doc.setTitle(title);
+        doc.setSections(sections);
+        return doc;
+    }
+
+    @Test
+    void rendersAllSectionTypes() {
+        AiDocument.Section text = section("text");
+        text.setBody("Some prose text.");
+        AiDocument.Section kv = section("key_value");
+        kv.setPairs(List.of(List.of("Key", "Value")));
+        AiDocument.Section items = section("line_items");
+        items.setColumns(List.of("A", "B"));
+        items.setRows(List.of(List.of("1", "2")));
+        AiDocument.Section bullets = section("bullet_list");
+        bullets.setItems(List.of("item one"));
+        AiDocument.Section sign = section("signature");
+        sign.setSignatories(List.of("Alice"));
+
+        String html = renderer.render(document("All", List.of(text, kv, items, bullets, sign)));
+
+        assertTrue(html.contains("<!DOCTYPE html>"));
+        assertTrue(html.contains("Some prose text."));
+        assertTrue(html.contains("Key") && html.contains("Value"));
+        assertTrue(html.contains("<th>"));
+        assertTrue(html.contains("item one"));
+        assertTrue(html.contains("Alice"));
+    }
+
+    @Test
+    void rendersMarkupCharactersAsText() {
+        AiDocument.Section text = section("text");
+        text.setBody("a <b>x</b> & y");
+
+        String html = renderer.render(document("Doc", List.of(text)));
+
+        assertFalse(html.contains("<b>"));
+        assertTrue(html.contains("&lt;b&gt;"));
+    }
+
+    @Test
+    void totalRowRenderedWhenPresent() {
+        AiDocument.Section items = section("line_items");
+        items.setColumns(List.of("Item", "Total"));
+        items.setRows(List.of(List.of("Widget", "$10")));
+        items.setTotalRow(List.of("Total", "$10"));
+
+        assertTrue(
+                renderer.render(document("Table", List.of(items)))
+                        .contains("<tr class=\"total-row\">"));
+    }
+
+    @Test
+    void totalRowAbsentWhenNotProvided() {
+        AiDocument.Section items = section("line_items");
+        items.setColumns(List.of("Item"));
+        items.setRows(List.of(List.of("Widget")));
+
+        assertFalse(
+                renderer.render(document("Table", List.of(items)))
+                        .contains("<tr class=\"total-row\">"));
+    }
+
+    @Test
+    void rendersSubtitleAndReference() {
+        AiDocument doc = document("My Doc", List.of());
+        doc.setSubtitle("Subtitle Here");
+        doc.setReferenceNumber("REF-42");
+
+        String html = renderer.render(doc);
+
+        assertTrue(html.contains("Subtitle Here"));
+        assertTrue(html.contains("REF-42"));
+    }
+
+    @Test
+    void appliesHexColourOverride() {
+        AiDocument doc = document("Styled", List.of());
+        AiDocument.Style style = new AiDocument.Style();
+        style.setPrimaryColor("#ff00ff");
+        style.setBackgroundColor("#111111");
+        doc.setStyle(style);
+
+        String html = renderer.render(doc);
+
+        assertTrue(html.contains("--color-primary: #ff00ff"));
+        assertTrue(html.contains("--color-bg: #111111"));
+    }
+
+    @Test
+    void ignoresColourWithDisallowedCharacters() {
+        AiDocument doc = document("Styled", List.of());
+        AiDocument.Style style = new AiDocument.Style();
+        style.setPrimaryColor("rgb(255, 0, 0)");
+        doc.setStyle(style);
+
+        String html = renderer.render(doc);
+
+        assertFalse(html.contains("rgb("));
+        assertTrue(html.contains("<!DOCTYPE html>"));
+    }
+
+    @Test
+    void ignoresNonHexColour() {
+        AiDocument doc = document("Styled", List.of());
+        AiDocument.Style style = new AiDocument.Style();
+        style.setPrimaryColor("magenta");
+        style.setBackgroundColor("#fff");
+        doc.setStyle(style);
+
+        String html = renderer.render(doc);
+
+        assertFalse(html.contains("--color-primary: magenta"));
+        assertFalse(html.contains("--color-bg: #fff;"));
+    }
+}
diff --git a/build.gradle b/build.gradle
index 073bccc654..e2f47e26fb 100644
--- a/build.gradle
+++ b/build.gradle
@@ -36,6 +36,8 @@ ext {
     okhttpBomVersion = "5.3.2"
     gsonVersion = "2.14.0"
     guavaVersion = "33.6.0-jre"
+    jinjavaVersion = "2.8.3"
+    jackson2Version = "2.21.2"
     bucket4jVersion = "8.19.0"
     archunitVersion = "1.4.2"
     batikVersion = "1.19"
@@ -222,6 +224,13 @@ subprojects {
         resolutionStrategy.force "org.apache.commons:commons-lang3:${commonsLang3}"
         // CVE-2024-47554: commons-io DoS prevention
         resolutionStrategy.force "commons-io:commons-io:${commonsIoVersion}"
+        // Jackson 2 is transitive-only here (jinjava, opensaml, jjwt request older versions);
+        // pin the family to a current release and keep modules aligned.
+        resolutionStrategy.force "com.fasterxml.jackson.core:jackson-core:${jackson2Version}"
+        resolutionStrategy.force "com.fasterxml.jackson.core:jackson-databind:${jackson2Version}"
+        resolutionStrategy.force "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:${jackson2Version}"
+        resolutionStrategy.force "com.fasterxml.jackson.datatype:jackson-datatype-jdk8:${jackson2Version}"
+        resolutionStrategy.force "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:${jackson2Version}"
         // Keep BouncyCastle modules aligned to avoid runtime linkage errors
         resolutionStrategy.force "org.bouncycastle:bcprov-jdk18on:${bouncycastleVersion}"
         resolutionStrategy.force "org.bouncycastle:bcpkix-jdk18on:${bouncycastleVersion}"
diff --git a/engine/pyproject.toml b/engine/pyproject.toml
index fa972c8495..7bd2fa7bea 100644
--- a/engine/pyproject.toml
+++ b/engine/pyproject.toml
@@ -5,7 +5,6 @@ description = "AI Document Engine"
 requires-python = ">=3.13"
 dependencies = [
     "fastapi>=0.116.0",
-    "jinja2>=3.1.0",
     "pgvector>=0.3.6",
     "psycopg[binary,pool]>=3.2",
     "pydantic>=2.0.0",
diff --git a/engine/src/stirling/agents/pdf_create/agent.py b/engine/src/stirling/agents/pdf_create/agent.py
index bd159060df..671d4867ca 100644
--- a/engine/src/stirling/agents/pdf_create/agent.py
+++ b/engine/src/stirling/agents/pdf_create/agent.py
@@ -10,7 +10,7 @@ Flow:
   4. SectionWriterAgents (smart_model) run in parallel via asyncio.gather.
      Each returns a WrittenSections with fully populated DocumentSection objects.
   5. The assembler collects sections in plan order → GeneratedDocument.
-  6. Jinja renders the document to HTML. The LLM never writes HTML.
+  6. The assembled document is emitted as structured fields. The LLM never writes HTML.
 
 The planner is split into two calls (meta then sections) so each LLM output schema
 stays small enough for grammar compilation on all model tiers including Haiku.
@@ -22,9 +22,7 @@ import asyncio
 import logging
 import re
 from dataclasses import dataclass
-from pathlib import Path
 
-from jinja2 import Environment, FileSystemLoader
 from pydantic_ai import Agent
 from pydantic_ai.output import NativeOutput
 
@@ -51,8 +49,6 @@ from stirling.services import AppRuntime
 
 logger = logging.getLogger(__name__)
 
-_TEMPLATES_DIR = Path(__file__).parent / "templates"
-
 # ── Token budget ──────────────────────────────────────────────────────────────────────────────────
 
 # Conservative per-section token estimates mapped from planner-assigned depth.
@@ -166,10 +162,13 @@ Analyse the user's request and produce a DocumentMeta with:
   document, if the user provides one. Leave empty if the user provides no such context.
 
 - style_primary_color: accent and heading colour. Set ONLY when the user explicitly names a
-  colour or colour scheme (e.g. "make it red", "use navy blue"). Use CSS named colours
-  (e.g. "magenta", "navy", "crimson") or hex values. Leave null if no colour is stated.
-- style_background_color: page background colour. Set only if explicitly requested.
-- style_body_text_color: body text colour. Set only if explicitly requested.
+  colour or colour scheme (e.g. "make it red", "use navy blue"). Express it as a 6-digit hex
+  code in #RRGGBB format (map any named colour to its hex value yourself, e.g. "navy" →
+  "#000080"). No other format is accepted. Leave null if no colour is stated.
+- style_background_color: page background colour, same #RRGGBB format. Set only if explicitly
+  requested.
+- style_body_text_color: body text colour, same #RRGGBB format. Set only if explicitly
+  requested.
 
 - cannot_do_reason: set this ONLY when the request is not asking to create a document at all
   (e.g. a question, a greeting, an edit request to an existing document). Never set it
@@ -299,15 +298,6 @@ def _build_writer_prompt(plan: DocumentPlan, chunk: _Chunk) -> str:
 # ── Helpers ───────────────────────────────────────────────────────────────────────────────────────
 
 
-def _build_jinja_env() -> Environment:
-    return Environment(
-        loader=FileSystemLoader(str(_TEMPLATES_DIR)),
-        autoescape=True,
-        trim_blocks=True,
-        lstrip_blocks=True,
-    )
-
-
 def _safe_filename(title: str) -> str:
     slug = re.sub(r"[^\w\s-]", "", title.lower())
     slug = re.sub(r"[\s_-]+", "-", slug).strip("-")
@@ -320,7 +310,6 @@ def _safe_filename(title: str) -> str:
 class PdfCreateAgent:
     def __init__(self, runtime: AppRuntime) -> None:
         self.runtime = runtime
-        self._jinja_env = _build_jinja_env()
 
         self._meta_planner: Agent[None, DocumentMeta] = Agent(
             model=runtime.smart_model,
@@ -401,14 +390,12 @@ class PdfCreateAgent:
             sections=all_sections,
         )
 
-        # ── Phase 6: render ────────────────────────────────────────────────────
-        logger.info("[pdf-create] phase 6/6: rendering HTML")
-        html = self._render(doc)
+        # ── Phase 6: emit ──────────────────────────────────────────────────────
         filename = _safe_filename(plan.title)
         logger.info(
-            "[pdf-create] done — filename=%r html_bytes=%d",
+            "[pdf-create] done — filename=%r sections=%d",
             filename,
-            len(html),
+            len(all_sections),
         )
 
         return EditPlanResponse(
@@ -417,7 +404,7 @@ class PdfCreateAgent:
                 ToolOperationStep(
                     tool=AgentToolId.CREATE_PDF_FROM_HTML_AGENT,
                     parameters=CreatePdfFromHtmlAgentParams(
-                        html_content=html,
+                        document=doc.model_dump_json(),
                         filename=filename,
                     ),
                 )
@@ -437,7 +424,3 @@ class PdfCreateAgent:
             len(result.output.sections),
         )
         return result.output
-
-    def _render(self, doc: GeneratedDocument) -> str:
-        template = self._jinja_env.get_template("document.html.jinja2")
-        return template.render(doc=doc)
diff --git a/engine/src/stirling/contracts/pdf_create.py b/engine/src/stirling/contracts/pdf_create.py
index 761a192dd1..00d5eb4091 100644
--- a/engine/src/stirling/contracts/pdf_create.py
+++ b/engine/src/stirling/contracts/pdf_create.py
@@ -1,14 +1,14 @@
 """Contracts for the PDF Create Agent.
 
 The agent accepts a natural-language prompt and returns a single
-CREATE_PDF_FROM_HTML_AGENT plan step carrying the rendered HTML.
+CREATE_PDF_FROM_HTML_AGENT plan step carrying the assembled document.
 
 Pipeline:
   1. PlannerAgent (smart_model) → DocumentPlan: structured skeleton, no body text.
   2. Python chunks the plan by token budget.
   3. SectionWriterAgents (smart_model, parallel) → WrittenSections per chunk.
   4. Assembler collects sections in plan order → GeneratedDocument.
-  5. Jinja renders GeneratedDocument → HTML. The LLM never writes HTML.
+  5. The document is emitted as structured fields. The LLM never writes HTML.
 """
 
 from __future__ import annotations
@@ -81,14 +81,12 @@ type DocumentSection = Annotated[
 ]
 
 
-# Named colour or hex only — anything else is dropped so a colour can't inject CSS into the
-# <style> block (which would let WeasyPrint fetch an attacker-controlled url() → SSRF).
-_SAFE_COLOR_RE = re.compile(r"^#[0-9a-fA-F]{3,8}$|^[a-zA-Z]{1,30}$")
+# Colours must be a 6-digit hex code (#RRGGBB); anything else is dropped to None.
+_SAFE_COLOR_RE = re.compile(r"^#[0-9a-fA-F]{6}$")
 
 
 class DocumentStyle(ApiModel):
-    """Document colours, inferred by the meta planner and rendered into the engine's Jinja
-    template (never sent to Java). Unsafe colours are dropped to ``None``."""
+    """Document colours, inferred by the meta planner. Non-hex values are dropped to ``None``."""
 
     primary_color: str | None = Field(default=None)
     background_color: str | None = Field(default=None)
@@ -103,7 +101,7 @@ class DocumentStyle(ApiModel):
 
 
 class GeneratedDocument(ApiModel):
-    """The full document model passed to Jinja for HTML rendering."""
+    """The full document model emitted for rendering."""
 
     title: str
     subtitle: str | None = None
diff --git a/engine/src/stirling/models/agent_tool_models.py b/engine/src/stirling/models/agent_tool_models.py
index 7585632c6b..6f9132dc12 100644
--- a/engine/src/stirling/models/agent_tool_models.py
+++ b/engine/src/stirling/models/agent_tool_models.py
@@ -29,7 +29,7 @@ class PdfCommentAgentParams(ApiModel):
 
 
 class CreatePdfFromHtmlAgentParams(ApiModel):
-    html_content: str
+    document: str
     filename: str = Field(pattern=r"^.+\.pdf$")
 
 
diff --git a/engine/tests/agents/test_pdf_create.py b/engine/tests/agents/test_pdf_create.py
index 86d9af9050..67fc5abfec 100644
--- a/engine/tests/agents/test_pdf_create.py
+++ b/engine/tests/agents/test_pdf_create.py
@@ -2,7 +2,7 @@
 
 Coverage:
 1. Section model validation (each section type round-trips correctly)
-2. Jinja rendering (_render produces valid HTML for each section type)
+2. orchestrate() emits the assembled document as structured JSON
 3. _safe_filename produces clean slugs
 4. _make_chunks groups sections correctly by token budget
 5. orchestrate() produces the correct EditPlanResponse via planner + writer mocks
@@ -12,6 +12,8 @@ Coverage:
 
 from __future__ import annotations
 
+import json
+
 import pytest
 from conftest import build_app_settings
 from pydantic_ai.models.test import TestModel
@@ -64,37 +66,6 @@ def agent(runtime: AppRuntime) -> PdfCreateAgent:
 # ── Helpers ───────────────────────────────────────────────────────────────────────────────────────
 
 
-def _invoice_doc() -> GeneratedDocument:
-    return GeneratedDocument(
-        title="Invoice",
-        subtitle="Acme Corp",
-        reference_number="Invoice #INV-001",
-        sections=[
-            KeyValueSection(
-                heading="Details",
-                pairs=[("Date", "2026-05-06"), ("Due", "2026-06-06"), ("Currency", "USD")],
-            ),
-            LineItemsSection(
-                heading="Line Items",
-                columns=["Description", "Qty", "Unit Price", "Total"],
-                rows=[
-                    ["Consulting services", "10", "$500.00", "$5,000.00"],
-                    ["Expenses", "1", "$200.00", "$200.00"],
-                ],
-                total_row=["Total", "", "", "$5,200.00"],
-            ),
-            TextSection(
-                heading="Payment Terms",
-                body="Payment is due within 30 days.\n\nPlease reference the invoice number.",
-            ),
-            SignatureSection(
-                heading="Authorised By",
-                signatories=["Jane Smith, CEO", "Bob Jones, CFO"],
-            ),
-        ],
-    )
-
-
 def _simple_meta() -> DocumentMeta:
     return DocumentMeta(
         title="Invoice",
@@ -199,82 +170,6 @@ def test_generated_document_optional_fields() -> None:
     assert doc.reference_number is None
 
 
-# ── Jinja rendering ───────────────────────────────────────────────────────────────────────────────
-
-
-def test_render_produces_html(agent: PdfCreateAgent) -> None:
-    doc = _invoice_doc()
-    html = agent._render(doc)
-    assert "<!DOCTYPE html>" in html
-    assert "Invoice" in html
-    assert "INV-001" in html
-
-
-def test_render_includes_all_section_types(agent: PdfCreateAgent) -> None:
-    doc = GeneratedDocument(
-        title="All Sections",
-        sections=[
-            TextSection(body="Some prose text."),
-            KeyValueSection(pairs=[("Key", "Value")]),
-            LineItemsSection(columns=["A", "B"], rows=[["1", "2"]]),
-            BulletListSection(items=["item one"]),
-            SignatureSection(signatories=["Alice"]),
-        ],
-    )
-    html = agent._render(doc)
-    assert "Some prose text." in html
-    assert "Key" in html and "Value" in html
-    assert "<th>" in html
-    assert "item one" in html
-    assert "Alice" in html
-
-
-def test_render_escapes_html_in_content(agent: PdfCreateAgent) -> None:
-    doc = GeneratedDocument(
-        title="XSS Test",
-        sections=[TextSection(body="<script>alert('xss')</script>")],
-    )
-    html = agent._render(doc)
-    assert "<script>" not in html
-    assert "&lt;script&gt;" in html
-
-
-def test_render_total_row_present(agent: PdfCreateAgent) -> None:
-    doc = GeneratedDocument(
-        title="Table",
-        sections=[
-            LineItemsSection(
-                columns=["Item", "Total"],
-                rows=[["Widget", "$10"]],
-                total_row=["Total", "$10"],
-            )
-        ],
-    )
-    html = agent._render(doc)
-    assert "total-row" in html
-
-
-def test_render_no_total_row_skips_tfoot(agent: PdfCreateAgent) -> None:
-    doc = GeneratedDocument(
-        title="Table",
-        sections=[LineItemsSection(columns=["Item"], rows=[["Widget"]])],
-    )
-    html = agent._render(doc)
-    assert "<tfoot>" not in html
-
-
-def test_render_subtitle_and_reference(agent: PdfCreateAgent) -> None:
-    doc = GeneratedDocument(
-        title="My Doc",
-        subtitle="Subtitle Here",
-        reference_number="REF-42",
-        sections=[TextSection(body="Content.")],
-    )
-    html = agent._render(doc)
-    assert "Subtitle Here" in html
-    assert "REF-42" in html
-
-
 # ── _safe_filename ────────────────────────────────────────────────────────────────────────────────
 
 
@@ -396,8 +291,9 @@ async def test_orchestrate_returns_plan_step(agent: PdfCreateAgent) -> None:
     assert step.tool == AgentToolId.CREATE_PDF_FROM_HTML_AGENT
     assert isinstance(step.parameters, CreatePdfFromHtmlAgentParams)
     assert step.parameters.filename.endswith(".pdf")
-    assert "<!DOCTYPE html>" in step.parameters.html_content
-    assert "Invoice" in step.parameters.html_content
+    parsed = json.loads(step.parameters.document)
+    assert parsed["title"] == "Invoice"
+    assert parsed["sections"]
 
 
 @pytest.mark.anyio
@@ -468,9 +364,9 @@ async def test_orchestrate_assembles_multiple_chunks(agent: PdfCreateAgent) -> N
         result = await agent.orchestrate(_orchestrator_request("Create a multi-chunk doc"))
 
     assert isinstance(result, EditPlanResponse)
-    html = result.steps[0].parameters.html_content  # type: ignore[union-attr]
-    assert "Introduction text." in html
-    assert "Details" in html
+    document = result.steps[0].parameters.document  # type: ignore[union-attr]
+    assert "Introduction text." in document
+    assert "Details" in document
 
 
 # ── Style inference ───────────────────────────────────────────────────────────────────────────────
@@ -482,7 +378,7 @@ async def test_orchestrate_applies_planner_inferred_style(agent: PdfCreateAgent)
     meta = DocumentMeta(
         title="Styled Doc",
         tone_brief="Professional.",
-        style_primary_color="magenta",
+        style_primary_color="#ff00ff",
     )
     sections = _simple_sections()
     written = _written_sections()
@@ -499,50 +395,35 @@ async def test_orchestrate_applies_planner_inferred_style(agent: PdfCreateAgent)
         result = await agent.orchestrate(_orchestrator_request("Make an invoice, magenta styling"))
 
     assert isinstance(result, EditPlanResponse)
-    html = result.steps[0].parameters.html_content  # type: ignore[union-attr]
-    assert "magenta" in html
+    document = result.steps[0].parameters.document  # type: ignore[union-attr]
+    assert json.loads(document)["style"]["primaryColor"] == "#ff00ff"
 
 
-def test_render_applies_style(agent: PdfCreateAgent) -> None:
-    """DocumentStyle fields are injected as CSS custom properties in the rendered HTML."""
-    doc = GeneratedDocument(
-        title="Styled",
-        sections=[TextSection(body="Content.")],
-        style=DocumentStyle(primary_color="magenta", background_color="#111111"),
-    )
-    html = agent._render(doc)
-    assert "--color-primary: magenta" in html
-    assert "--color-bg: #111111" in html
-
-
-def test_document_style_drops_unsafe_colors() -> None:
-    """Unsafe colours (not named/hex) are dropped, closing the <style> url() injection."""
-    safe = DocumentStyle(primary_color="navy", background_color="#1e3a5f", body_text_color="#fff")
+def test_document_style_keeps_only_six_digit_hex() -> None:
+    """Only #RRGGBB hex is kept; named colours and other formats drop to None."""
+    safe = DocumentStyle(primary_color="#1e3a5f", background_color="#ffffff", body_text_color="#1A1A1A")
     assert (safe.primary_color, safe.background_color, safe.body_text_color) == (
-        "navy",
         "#1e3a5f",
-        "#fff",
+        "#ffffff",
+        "#1A1A1A",
     )
 
-    unsafe = DocumentStyle(
-        primary_color="red; background: url(http://evil.test/steal)",
-        background_color="expression(alert(1))",
-        body_text_color="navy; }",
-    )
-    assert unsafe.primary_color is None
-    assert unsafe.background_color is None
-    assert unsafe.body_text_color is None
+    assert DocumentStyle(primary_color="navy").primary_color is None
+    assert DocumentStyle(primary_color="#fff").primary_color is None
+    assert DocumentStyle(primary_color="#1e3a5f00").primary_color is None
+    assert DocumentStyle(primary_color="rgb(255, 0, 0)").primary_color is None
+    assert DocumentStyle(background_color="teal darken-2").background_color is None
     # A trailing newline must not slip a value through (fullmatch, not $-before-newline).
-    assert DocumentStyle(primary_color="navy\n").primary_color is None
+    assert DocumentStyle(primary_color="#1e3a5f\n").primary_color is None
 
 
 @pytest.mark.anyio
-async def test_orchestrate_drops_unsafe_planner_color(agent: PdfCreateAgent) -> None:
-    """An unsafe colour inferred by the meta planner never reaches the rendered HTML."""
+async def test_orchestrate_drops_non_hex_planner_colour(agent: PdfCreateAgent) -> None:
+    """A non-hex colour inferred by the meta planner is dropped before the document is emitted."""
     meta = DocumentMeta(
         title="Doc",
         tone_brief="Professional.",
-        style_primary_color="blue; background: url(http://evil.test/)",
+        style_primary_color="rgb(0, 0, 255)",
     )
     sections = _simple_sections()
     written = _written_sections()
@@ -559,6 +440,6 @@ async def test_orchestrate_drops_unsafe_planner_color(agent: PdfCreateAgent) ->
         result = await agent.orchestrate(_orchestrator_request("make it blue"))
 
     assert isinstance(result, EditPlanResponse)
-    html = result.steps[0].parameters.html_content  # type: ignore[union-attr]
-    assert "evil.test" not in html
-    assert "url(" not in html
+    document = result.steps[0].parameters.document  # type: ignore[union-attr]
+    assert "rgb(" not in document
+    assert json.loads(document)["style"]["primaryColor"] is None
diff --git a/engine/uv.lock b/engine/uv.lock
index bac51cb3c9..00a8345c13 100644
--- a/engine/uv.lock
+++ b/engine/uv.lock
@@ -604,7 +604,6 @@ version = "0.1.0"
 source = { editable = "." }
 dependencies = [
     { name = "fastapi" },
-    { name = "jinja2" },
     { name = "opentelemetry-sdk" },
     { name = "pgvector" },
     { name = "posthog" },
@@ -631,7 +630,6 @@ dev = [
 [package.metadata]
 requires-dist = [
     { name = "fastapi", specifier = ">=0.116.0" },
-    { name = "jinja2", specifier = ">=3.1.0" },
     { name = "opentelemetry-sdk", specifier = ">=1.39.0" },
     { name = "pgvector", specifier = ">=0.3.6" },
     { name = "posthog", specifier = ">=3.0.0" },

From 7f01bcdc44526cbf1aa0f79a66ecf1021919be51 Mon Sep 17 00:00:00 2001
From: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Date: Wed, 15 Jul 2026 12:04:30 +0100
Subject: [PATCH 021/109] Classifier setup as a processor policy (#7012)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Overview

Adds a **Classification policy** to the processor's policy catalogue,
set up the same way as the Security policy. This moves classifier
configuration out of the editor (where the labels UI landed in #6898 and
was then removed with the rest of the editor's policy-management surface
in #6932) and into the processor, which is now the single place policies
are configured.

## What it does

- **Classification card** in the processor policy catalogue. Always
shown, but **setup is locked until the backend reports the AI engine is
on** — so admins can see the capability they're missing rather than it
being hidden entirely.
- **Setup wizard** mirrors Security: the workflow step shows the team's
**classification label editor** (reused
`LabelsEditor`/`LabelsEditorModal` — add box, chip grid, per-label icon
picker, import/export, reset) instead of tool toggles, since classify is
a single non-configurable step.
- On enable, the team's label vocabulary is **seeded with the 268
built-in defaults** (clobber-safe: only when the team has none). On
upload the document is classified against the team's labels and tagged;
on SaaS with the engine on, files group by category in the editor
sidebar.

## Reuse & consolidation

- Reuses the existing labels table, `labelsFile` helpers, and default
vocabulary. Labels read/write through the processor's own
`apiClient.local` (not the editor's axios client) so auth/base routing
stays explicit; the wire shape is shared.
- Consolidates policy-category icons into a shared, **id-keyed**
`policyCategoryIcon` util (outline glyphs) used by both the editor and
the processor, replacing the processor's emoji-glyph map (and the stray
`schedule` key that rendered a bare dot).

## Testing

- `task frontend:typecheck:{core,proprietary,portal}`,
`frontend:lint:eslint`, `frontend:test` (156 files / 1305 tests) — all
green.
- Verified in Storybook: the Classification card renders, the setup
wizard shows the label editor (268 defaults), and the full labels editor
opens with icons/import/export/reset. Added an MSW handler for the
app-config + labels endpoints and a `Classification` wizard story.

## Notes for reviewers

- The AI-engine gate reads the public `/api/v1/config/app-config`;
classification labels use `/api/v1/classification/labels` (team-scoped,
team-lead/admin-gated, `policies.enabled`); the classify step hits
`/api/v1/ai/tools/classify-and-label` — all pre-existing backend from
#6898.
- Known parity behavior (matches the editor hook): a transient failure
loading team labels falls back to showing the defaults; not changed here
to avoid diverging the two hooks.
---
 .../ClassificationLabelProvider.java          |   61 +
 .../ClassificationLabelsController.java       |  136 --
 .../model/ClassificationLabels.java           |    8 +-
 .../classification/model/LabelsValidator.java |   71 -
 .../store/ClassificationLabelStore.java       |   22 -
 .../InProcessClassificationLabelStore.java    |   36 -
 .../store/JpaClassificationLabelStore.java    |   76 -
 .../store/TeamLabelsEntity.java               |   47 -
 .../store/TeamLabelsRepository.java           |    7 -
 .../api/ClassifyLabelController.java          |   46 +-
 .../configuration/DatabaseConfig.java         |    6 +-
 .../classification/classification-labels.json | 1344 +++++++++++++++++
 .../ClassificationLabelsControllerTest.java   |  133 --
 .../model/LabelsValidatorTest.java            |  146 --
 .../api/ClassifyLabelControllerTest.java      |   49 +-
 .../saas/V39__drop_classification_labels.sql  |   10 +
 .../stirling/agents/document_classifier.py    |    4 +-
 .../public/locales/en-US/translation.toml     |   66 +-
 .../policies/policyCategoryIcon.tsx           |   36 +
 frontend/editor/src/core/ui/LabelChip.css     |   57 -
 .../editor/src/core/ui/LabelChip.stories.tsx  |   52 -
 frontend/editor/src/core/ui/LabelChip.tsx     |   60 -
 frontend/editor/src/portal/api/policies.ts    |   36 +-
 .../src/portal/components/PolicySummary.tsx   |    4 +-
 .../policies/ClassificationLabelsSection.css  |   53 +
 .../policies/ClassificationLabelsSection.tsx  |   97 ++
 .../policies/PolicyCategoryCard.tsx           |   23 +-
 .../policies/PolicySetupWizard.stories.tsx    |   14 +
 .../components/policies/PolicySetupWizard.tsx |  145 +-
 .../portal/components/policies/policyIcons.ts |   25 -
 .../src/portal/hooks/useAiEngineEnabled.ts    |   26 +
 .../portal/mocks/handlers/classification.ts   |   10 +
 .../editor/src/portal/mocks/handlers/index.ts |    2 +
 frontend/editor/src/portal/views/Policies.css |  107 +-
 frontend/editor/src/portal/views/Policies.tsx |   20 +
 .../ClassificationCategoryManager.css         |   37 +
 .../ClassificationCategoryManager.stories.tsx |   46 +
 .../ClassificationCategoryManager.tsx         |   68 +
 .../policies/ClassificationLabelsSection.tsx  |  176 ---
 .../components/policies/LabelIconPicker.tsx   |   92 --
 .../components/policies/LabelsEditor.css      |  183 ---
 .../components/policies/LabelsEditor.tsx      |  258 ----
 .../components/policies/LabelsEditorModal.tsx |  175 ---
 .../components/policies/policyToolChains.ts   |   19 -
 .../data/classificationLabels.drift.test.ts   |   54 +
 .../proprietary/data/classificationLabels.ts  |   20 +-
 .../editor/src/proprietary/data/labelIcons.ts |   28 +-
 .../proprietary/data/policyDefinitions.tsx    |   19 +-
 .../hooks/useClassificationLabels.ts          |   85 --
 .../src/proprietary/hooks/usePolicies.ts      |   15 -
 .../proprietary/policies/operations.test.ts   |    3 +-
 .../src/proprietary/policies/operations.ts    |   69 +-
 .../services/fileSidebarCategories.ts         |  191 +--
 .../services/labelsBackend.test.ts            |  108 --
 .../src/proprietary/services/labelsBackend.ts |   99 --
 .../src/proprietary/services/labelsFile.ts    |  107 --
 .../shared/FileSidebarGroupControls.css       |  121 +-
 .../shared/FileSidebarGroupControls.tsx       |  340 +----
 .../shared/fileSidebarGrouping.test.ts        |   28 +-
 .../components/shared/fileSidebarGrouping.tsx |    8 +-
 .../shared/fileSidebarGroupingLogic.ts        |   41 +-
 61 files changed, 2269 insertions(+), 3156 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationLabelProvider.java
 delete mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationLabelsController.java
 delete mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/classification/model/LabelsValidator.java
 delete mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/classification/store/ClassificationLabelStore.java
 delete mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/classification/store/InProcessClassificationLabelStore.java
 delete mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/classification/store/JpaClassificationLabelStore.java
 delete mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/classification/store/TeamLabelsEntity.java
 delete mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/classification/store/TeamLabelsRepository.java
 create mode 100644 app/proprietary/src/main/resources/classification/classification-labels.json
 delete mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/classification/ClassificationLabelsControllerTest.java
 delete mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/classification/model/LabelsValidatorTest.java
 create mode 100644 app/saas/src/main/resources/db/migration/saas/V39__drop_classification_labels.sql
 create mode 100644 frontend/editor/src/core/components/policies/policyCategoryIcon.tsx
 delete mode 100644 frontend/editor/src/core/ui/LabelChip.css
 delete mode 100644 frontend/editor/src/core/ui/LabelChip.stories.tsx
 delete mode 100644 frontend/editor/src/core/ui/LabelChip.tsx
 create mode 100644 frontend/editor/src/portal/components/policies/ClassificationLabelsSection.css
 create mode 100644 frontend/editor/src/portal/components/policies/ClassificationLabelsSection.tsx
 delete mode 100644 frontend/editor/src/portal/components/policies/policyIcons.ts
 create mode 100644 frontend/editor/src/portal/hooks/useAiEngineEnabled.ts
 create mode 100644 frontend/editor/src/portal/mocks/handlers/classification.ts
 create mode 100644 frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.css
 create mode 100644 frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.tsx
 delete mode 100644 frontend/editor/src/proprietary/components/policies/ClassificationLabelsSection.tsx
 delete mode 100644 frontend/editor/src/proprietary/components/policies/LabelIconPicker.tsx
 delete mode 100644 frontend/editor/src/proprietary/components/policies/LabelsEditor.css
 delete mode 100644 frontend/editor/src/proprietary/components/policies/LabelsEditor.tsx
 delete mode 100644 frontend/editor/src/proprietary/components/policies/LabelsEditorModal.tsx
 delete mode 100644 frontend/editor/src/proprietary/components/policies/policyToolChains.ts
 create mode 100644 frontend/editor/src/proprietary/data/classificationLabels.drift.test.ts
 delete mode 100644 frontend/editor/src/proprietary/hooks/useClassificationLabels.ts
 delete mode 100644 frontend/editor/src/proprietary/services/labelsBackend.test.ts
 delete mode 100644 frontend/editor/src/proprietary/services/labelsBackend.ts
 delete mode 100644 frontend/editor/src/proprietary/services/labelsFile.ts

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationLabelProvider.java b/app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationLabelProvider.java
new file mode 100644
index 0000000000..480eaecf76
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationLabelProvider.java
@@ -0,0 +1,61 @@
+package stirling.software.proprietary.classification;
+
+import java.io.InputStream;
+import java.util.List;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.stereotype.Component;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.classification.model.ClassificationLabel;
+import stirling.software.proprietary.classification.model.ClassificationLabels;
+
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * Supplies the classification vocabulary the classify tool sends to the AI engine. The set is a
+ * fixed, built-in list bundled with the application ({@code
+ * classification/classification-labels.json}) and shared by everyone — there is no per-team
+ * customization or database. Loaded once at startup.
+ */
+@Slf4j
+@Component
+public class ClassificationLabelProvider {
+
+    private static final String RESOURCE = "classification/classification-labels.json";
+
+    private final List<ClassificationLabel> labels;
+
+    // Explicit @Autowired: the class has a second (private) constructor for tests, so Spring
+    // can't infer which to use without it.
+    @Autowired
+    public ClassificationLabelProvider(ObjectMapper objectMapper) {
+        this(load(objectMapper));
+    }
+
+    private ClassificationLabelProvider(List<ClassificationLabel> labels) {
+        this.labels = List.copyOf(labels);
+    }
+
+    /** Build a provider with an explicit label set (tests). */
+    public static ClassificationLabelProvider withLabels(List<ClassificationLabel> labels) {
+        return new ClassificationLabelProvider(labels);
+    }
+
+    /** The built-in vocabulary, in file order. */
+    public List<ClassificationLabel> labels() {
+        return labels;
+    }
+
+    private static List<ClassificationLabel> load(ObjectMapper objectMapper) {
+        try (InputStream in = new ClassPathResource(RESOURCE).getInputStream()) {
+            ClassificationLabels parsed = objectMapper.readValue(in, ClassificationLabels.class);
+            return parsed.labels();
+        } catch (Exception e) {
+            log.error("Failed to load classification labels from {}", RESOURCE, e);
+            return List.of();
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationLabelsController.java b/app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationLabelsController.java
deleted file mode 100644
index 6dcd19e724..0000000000
--- a/app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationLabelsController.java
+++ /dev/null
@@ -1,136 +0,0 @@
-package stirling.software.proprietary.classification;
-
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.MediaType;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.bind.annotation.DeleteMapping;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.PutMapping;
-import org.springframework.web.bind.annotation.RequestBody;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-import org.springframework.web.server.ResponseStatusException;
-
-import io.swagger.v3.oas.annotations.Hidden;
-import io.swagger.v3.oas.annotations.Operation;
-import io.swagger.v3.oas.annotations.tags.Tag;
-
-import lombok.RequiredArgsConstructor;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.service.UserServiceInterface;
-import stirling.software.proprietary.classification.model.ClassificationLabels;
-import stirling.software.proprietary.classification.model.LabelsValidator;
-import stirling.software.proprietary.classification.store.ClassificationLabelStore;
-import stirling.software.proprietary.classification.store.TeamLabelsEntity;
-import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
-
-/**
- * Read/write the team's classification label set — the flat vocabulary the document classifier runs
- * against. Shared and team-scoped exactly like policies: every user reads their own team's labels,
- * and only a user who may edit policies (a team leader on SaaS, the global admin self-hosted; see
- * {@link PolicyManagementAuthority}) may change it — gated only when login is enabled, since
- * single-user deployments trust the local operator. A team with no stored labels reads as {@code
- * 204}; that team has no vocabulary, so its documents are not classified (there is no built-in
- * default on the backend or the engine — the label data lives only in the frontend).
- */
-@RestController
-@RequestMapping("/api/v1/classification/labels")
-@Hidden
-@RequiredArgsConstructor
-@Tag(name = "Classification", description = "Team-scoped document-classification labels")
-@ConditionalOnBooleanProperty(name = "policies.enabled")
-public class ClassificationLabelsController {
-
-    private final ClassificationLabelStore labelStore;
-    private final PolicyManagementAuthority policyManagementAuthority;
-    private final ApplicationProperties applicationProperties;
-    private final UserServiceInterface userService;
-
-    @GetMapping
-    @Operation(
-            summary = "Get the team's classification labels",
-            description =
-                    "Returns the caller's team label set, or 204 when the team has none (its"
-                            + " documents are then not classified).")
-    public ResponseEntity<ClassificationLabels> getTeamLabels() {
-        return labelStore
-                .findByTeam(currentTeamId())
-                .map(ResponseEntity::ok)
-                .orElseGet(() -> ResponseEntity.noContent().build());
-    }
-
-    @PutMapping(consumes = MediaType.APPLICATION_JSON_VALUE)
-    @Operation(
-            summary = "Save the team's classification labels",
-            description =
-                    "Validates and stores the label set for the caller's team, shared by everyone"
-                            + " on the team. Requires the policy-editor role for the team.")
-    public ResponseEntity<ClassificationLabels> saveTeamLabels(
-            @RequestBody ClassificationLabels labels) {
-        requireEditingAllowed();
-        validate(labels);
-        ClassificationLabels saved = labelStore.save(currentTeamId(), labels, currentUsername());
-        return ResponseEntity.ok(saved);
-    }
-
-    @DeleteMapping
-    @Operation(
-            summary = "Reset the team's classification labels",
-            description =
-                    "Removes the team's stored label set; its documents are then not classified"
-                            + " until labels are saved again. Requires the policy-editor role for the"
-                            + " team.")
-    public ResponseEntity<Void> resetTeamLabels() {
-        requireEditingAllowed();
-        labelStore.deleteByTeam(currentTeamId());
-        return ResponseEntity.noContent().build();
-    }
-
-    private static void validate(ClassificationLabels labels) {
-        try {
-            LabelsValidator.validate(labels);
-        } catch (IllegalArgumentException e) {
-            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());
-        }
-    }
-
-    /**
-     * Editing the team labels requires the editor role for the caller's team — the same gate
-     * policies use (team leader on SaaS, global admin self-hosted). Single-user deployments (login
-     * disabled) have no such role, so they trust the local operator.
-     */
-    private void requireEditingAllowed() {
-        if (!applicationProperties.getSecurity().isEnableLogin()) {
-            return;
-        }
-        if (!policyManagementAuthority.canEditPolicies()) {
-            throw new ResponseStatusException(
-                    HttpStatus.FORBIDDEN,
-                    "The team classification labels may only be changed by a team leader");
-        }
-    }
-
-    /**
-     * The caller's team key. With login disabled the single operator owns the {@link
-     * TeamLabelsEntity#NO_TEAM} sentinel row; with login enabled a caller with no resolvable team
-     * is an error rather than being dropped into the shared sentinel bucket (which would let
-     * unteamed users read and overwrite each other's "team" labels).
-     */
-    private Long currentTeamId() {
-        Long teamId = policyManagementAuthority.currentUserTeamId();
-        if (teamId != null) {
-            return teamId;
-        }
-        if (!applicationProperties.getSecurity().isEnableLogin()) {
-            return TeamLabelsEntity.NO_TEAM;
-        }
-        throw new ResponseStatusException(
-                HttpStatus.UNAUTHORIZED, "Could not resolve the current user's team");
-    }
-
-    private String currentUsername() {
-        return userService == null ? null : userService.getCurrentUsername();
-    }
-}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/classification/model/ClassificationLabels.java b/app/proprietary/src/main/java/stirling/software/proprietary/classification/model/ClassificationLabels.java
index ea7a1269f0..7ac73c92de 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/classification/model/ClassificationLabels.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/classification/model/ClassificationLabels.java
@@ -3,10 +3,10 @@ package stirling.software.proprietary.classification.model;
 import java.util.List;
 
 /**
- * A flat multi-label classification vocabulary — the set of labels a document may be assigned.
- * Stored per team (admin-edited, shared by everyone on the team); the classifier runs against these
- * label names. A team with no stored set has no vocabulary, so its documents are not classified —
- * neither the backend nor the engine holds a default of its own.
+ * A flat multi-label classification vocabulary — the set of labels a document may be assigned. The
+ * classifier runs against these label names. The vocabulary is a fixed, built-in set shared by
+ * everyone (see {@link stirling.software.proprietary.classification.ClassificationLabelProvider});
+ * this record is the JSON parse target for that bundled resource.
  */
 public record ClassificationLabels(List<ClassificationLabel> labels) {
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/classification/model/LabelsValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/classification/model/LabelsValidator.java
deleted file mode 100644
index 722e8b417b..0000000000
--- a/app/proprietary/src/main/java/stirling/software/proprietary/classification/model/LabelsValidator.java
+++ /dev/null
@@ -1,71 +0,0 @@
-package stirling.software.proprietary.classification.model;
-
-import java.util.HashSet;
-import java.util.Locale;
-import java.util.Set;
-import java.util.regex.Pattern;
-
-/**
- * Structural validation for a user- or admin-supplied label set, run before it is stored so a
- * malformed vocabulary can never reach the classifier. Mirrors the invariants the engine relies on:
- * non-blank ids and names, each unique within the set (ids exactly, names case-insensitively).
- */
-public final class LabelsValidator {
-
-    private LabelsValidator() {}
-
-    // Generous upper bounds so a legitimate label set is never blocked, but a single team or user
-    // can't store an unbounded blob that would bloat the row, balloon the classifier prompt, or
-    // exhaust memory on deserialize.
-    static final int MAX_LABELS = 500;
-    static final int MAX_TEXT_LENGTH = 128;
-
-    // Icon is a Material Symbols key (lowercase, digits, hyphens). Enforce the SHAPE server-side —
-    // the exact allowlist lives in the frontend — so a client bypassing the UI can't store
-    // arbitrary
-    // text that would render as garbage (or worse) in every teammate's sidebar.
-    private static final Pattern ICON_KEY = Pattern.compile("^[a-z0-9-]+$");
-
-    /**
-     * @throws IllegalArgumentException with a human-readable message when the label set is invalid.
-     */
-    public static void validate(ClassificationLabels labels) {
-        if (labels == null || labels.labels() == null) {
-            throw new IllegalArgumentException("Labels are required");
-        }
-        if (labels.labels().size() > MAX_LABELS) {
-            throw new IllegalArgumentException("Too many labels (max " + MAX_LABELS + ")");
-        }
-        Set<String> ids = new HashSet<>();
-        Set<String> names = new HashSet<>();
-        for (ClassificationLabel label : labels.labels()) {
-            requireText(label.id(), "Label id");
-            requireText(label.name(), "Label name");
-            if (label.icon() != null && !label.icon().isEmpty()) {
-                if (label.icon().length() > MAX_TEXT_LENGTH) {
-                    throw new IllegalArgumentException(
-                            "Label icon is too long (max " + MAX_TEXT_LENGTH + " characters)");
-                }
-                if (!ICON_KEY.matcher(label.icon()).matches()) {
-                    throw new IllegalArgumentException("Invalid label icon: " + label.icon());
-                }
-            }
-            if (!ids.add(label.id().trim())) {
-                throw new IllegalArgumentException("Duplicate label id: " + label.id());
-            }
-            if (!names.add(label.name().trim().toLowerCase(Locale.ROOT))) {
-                throw new IllegalArgumentException("Duplicate label name: " + label.name());
-            }
-        }
-    }
-
-    private static void requireText(String value, String field) {
-        if (value == null || value.isBlank()) {
-            throw new IllegalArgumentException(field + " must not be blank");
-        }
-        if (value.trim().length() > MAX_TEXT_LENGTH) {
-            throw new IllegalArgumentException(
-                    field + " is too long (max " + MAX_TEXT_LENGTH + " characters)");
-        }
-    }
-}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/ClassificationLabelStore.java b/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/ClassificationLabelStore.java
deleted file mode 100644
index a604854c60..0000000000
--- a/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/ClassificationLabelStore.java
+++ /dev/null
@@ -1,22 +0,0 @@
-package stirling.software.proprietary.classification.store;
-
-import java.util.Optional;
-
-import stirling.software.proprietary.classification.model.ClassificationLabels;
-
-/**
- * Stores one {@link ClassificationLabels} set per team. A {@code null} teamId addresses the
- * unteamed set (login disabled / no resolvable team), mirroring how the policy store treats a null
- * team.
- */
-public interface ClassificationLabelStore {
-
-    /** The team's stored labels, or empty when it has none (callers then skip classification). */
-    Optional<ClassificationLabels> findByTeam(Long teamId);
-
-    /** Create or replace the team's labels. Returns the stored value. */
-    ClassificationLabels save(Long teamId, ClassificationLabels labels, String updatedBy);
-
-    /** Remove the team's labels (reset to default). Returns whether a set existed. */
-    boolean deleteByTeam(Long teamId);
-}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/InProcessClassificationLabelStore.java b/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/InProcessClassificationLabelStore.java
deleted file mode 100644
index 6846902eab..0000000000
--- a/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/InProcessClassificationLabelStore.java
+++ /dev/null
@@ -1,36 +0,0 @@
-package stirling.software.proprietary.classification.store;
-
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.ConcurrentHashMap;
-
-import stirling.software.proprietary.classification.model.ClassificationLabels;
-
-/**
- * In-memory {@link ClassificationLabelStore} for tests and any future no-database mode. {@link
- * JpaClassificationLabelStore} is the runtime bean.
- */
-public class InProcessClassificationLabelStore implements ClassificationLabelStore {
-
-    private final Map<Long, ClassificationLabels> byTeam = new ConcurrentHashMap<>();
-
-    @Override
-    public Optional<ClassificationLabels> findByTeam(Long teamId) {
-        return Optional.ofNullable(byTeam.get(key(teamId)));
-    }
-
-    @Override
-    public ClassificationLabels save(Long teamId, ClassificationLabels labels, String updatedBy) {
-        byTeam.put(key(teamId), labels);
-        return labels;
-    }
-
-    @Override
-    public boolean deleteByTeam(Long teamId) {
-        return byTeam.remove(key(teamId)) != null;
-    }
-
-    private static long key(Long teamId) {
-        return teamId == null ? TeamLabelsEntity.NO_TEAM : teamId;
-    }
-}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/JpaClassificationLabelStore.java b/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/JpaClassificationLabelStore.java
deleted file mode 100644
index 724e335fc4..0000000000
--- a/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/JpaClassificationLabelStore.java
+++ /dev/null
@@ -1,76 +0,0 @@
-package stirling.software.proprietary.classification.store;
-
-import java.time.Instant;
-import java.util.Optional;
-
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
-import org.springframework.stereotype.Service;
-
-import lombok.RequiredArgsConstructor;
-import lombok.extern.slf4j.Slf4j;
-
-import stirling.software.proprietary.classification.model.ClassificationLabels;
-
-import tools.jackson.core.JacksonException;
-import tools.jackson.databind.ObjectMapper;
-
-/**
- * Durable {@link ClassificationLabelStore} backed by JPA; the runtime store. Gated on {@code
- * policies.enabled} — stored labels only matter when the Classification policy can run — so it
- * shares the policy subsystem's on/off switch. Each label set is persisted as JSON via {@link
- * TeamLabelsEntity}.
- */
-@Slf4j
-@Service
-@RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
-public class JpaClassificationLabelStore implements ClassificationLabelStore {
-
-    private final TeamLabelsRepository teamRepository;
-    private final ObjectMapper objectMapper;
-
-    @Override
-    public Optional<ClassificationLabels> findByTeam(Long teamId) {
-        return teamRepository
-                .findById(key(teamId))
-                .flatMap(entity -> parse(entity.getLabelsJson(), "team " + teamId));
-    }
-
-    @Override
-    public ClassificationLabels save(Long teamId, ClassificationLabels labels, String updatedBy) {
-        TeamLabelsEntity entity = new TeamLabelsEntity();
-        entity.setTeamId(key(teamId));
-        entity.setLabelsJson(objectMapper.writeValueAsString(labels));
-        entity.setUpdatedAt(Instant.now());
-        entity.setUpdatedBy(updatedBy);
-        teamRepository.save(entity);
-        return labels;
-    }
-
-    @Override
-    public boolean deleteByTeam(Long teamId) {
-        long id = key(teamId);
-        if (!teamRepository.existsById(id)) {
-            return false;
-        }
-        teamRepository.deleteById(id);
-        return true;
-    }
-
-    private Optional<ClassificationLabels> parse(String json, String owner) {
-        try {
-            return Optional.of(objectMapper.readValue(json, ClassificationLabels.class));
-        } catch (JacksonException e) {
-            // A stored label set that no longer parses (corruption / manual DB edit) must not break
-            // classification: drop it so the caller treats the team as having no labels (and skips
-            // classification) rather than surfacing a 500 on every upload.
-            log.warn("Discarding unparseable stored labels for {}: {}", owner, e.getMessage());
-            return Optional.empty();
-        }
-    }
-
-    /** Map the nullable team id onto the entity's non-null key (sentinel for the unteamed case). */
-    private static long key(Long teamId) {
-        return teamId == null ? TeamLabelsEntity.NO_TEAM : teamId;
-    }
-}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/TeamLabelsEntity.java b/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/TeamLabelsEntity.java
deleted file mode 100644
index 25f2e5b259..0000000000
--- a/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/TeamLabelsEntity.java
+++ /dev/null
@@ -1,47 +0,0 @@
-package stirling.software.proprietary.classification.store;
-
-import java.io.Serializable;
-import java.time.Instant;
-
-import jakarta.persistence.Column;
-import jakarta.persistence.Entity;
-import jakarta.persistence.Id;
-import jakarta.persistence.Table;
-
-import lombok.Getter;
-import lombok.NoArgsConstructor;
-import lombok.Setter;
-
-/**
- * JPA row for a team's classification labels — one row per team. The label set lives as JSON in
- * {@code labelsJson} (authoritative on read). {@code teamId} is the natural key; the sentinel
- * {@link #NO_TEAM} stands in for the unteamed (login-disabled / self-hosted single-team) case,
- * since a primary key can't be null (policies store a nullable {@code team_id}, but this table is
- * keyed one-per-team). Kept decoupled from the security entities — {@code teamId} is a plain value,
- * not a foreign key — so classification can be enabled or disabled without touching them.
- */
-@Entity
-@Table(name = "classification_labels")
-@NoArgsConstructor
-@Getter
-@Setter
-public class TeamLabelsEntity implements Serializable {
-
-    private static final long serialVersionUID = 1L;
-
-    /** Sentinel key for the unteamed label set (login disabled / no resolvable team). */
-    public static final long NO_TEAM = 0L;
-
-    @Id
-    @Column(name = "team_id")
-    private long teamId;
-
-    @Column(name = "labels_json", columnDefinition = "text")
-    private String labelsJson;
-
-    @Column(name = "updated_at")
-    private Instant updatedAt;
-
-    @Column(name = "updated_by")
-    private String updatedBy;
-}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/TeamLabelsRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/TeamLabelsRepository.java
deleted file mode 100644
index 7fc9589c39..0000000000
--- a/app/proprietary/src/main/java/stirling/software/proprietary/classification/store/TeamLabelsRepository.java
+++ /dev/null
@@ -1,7 +0,0 @@
-package stirling.software.proprietary.classification.store;
-
-import org.springframework.data.jpa.repository.JpaRepository;
-import org.springframework.stereotype.Repository;
-
-@Repository
-public interface TeamLabelsRepository extends JpaRepository<TeamLabelsEntity, Long> {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ClassifyLabelController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ClassifyLabelController.java
index 629a377cf3..3b7f36037b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ClassifyLabelController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ClassifyLabelController.java
@@ -31,10 +31,9 @@ import stirling.software.common.service.PdfMetadataService;
 import stirling.software.common.service.UserServiceInterface;
 import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
+import stirling.software.proprietary.classification.ClassificationLabelProvider;
 import stirling.software.proprietary.classification.model.ClassificationLabel;
-import stirling.software.proprietary.classification.store.ClassificationLabelStore;
 import stirling.software.proprietary.model.api.ai.AiPageText;
-import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
 import stirling.software.proprietary.service.AiEngineClient;
 import stirling.software.proprietary.service.PdfContentExtractor;
 
@@ -46,7 +45,7 @@ import tools.jackson.databind.node.ObjectNode;
  * Dispatchable tool that classifies a PDF and writes the result into its metadata.
  *
  * <p>Runs as a Classification-policy pipeline step: it reads a bounded page window, asks the AI
- * engine to classify the document against the caller's team label set, and stores the engine's JSON
+ * engine to classify the document against the built-in label set, and stores the engine's JSON
  * answer — minus the transport-only {@code outcome} field — in the custom Info-dictionary key
  * {@link PdfMetadataService#CLASSIFICATION_KEY}. Returns the labelled PDF. Not intended for direct
  * client use.
@@ -72,13 +71,9 @@ public class ClassifyLabelController {
     private final UserServiceInterface userService;
 
     /**
-     * Present only when the policy subsystem is enabled ({@code policies.enabled}); the store and
-     * team authority are gated on it. Null otherwise, in which case there are no team labels to
-     * classify against and the document is passed through unlabelled.
+     * The fixed, built-in vocabulary shared by everyone — see {@link ClassificationLabelProvider}.
      */
-    private final ClassificationLabelStore labelStore;
-
-    private final PolicyManagementAuthority policyManagementAuthority;
+    private final ClassificationLabelProvider labelProvider;
 
     public ClassifyLabelController(
             CustomPDFDocumentFactory pdfDocumentFactory,
@@ -87,18 +82,16 @@ public class ClassifyLabelController {
             PdfMetadataService pdfMetadataService,
             AiEngineClient aiEngineClient,
             ObjectMapper objectMapper,
-            @Autowired(required = false) UserServiceInterface userService,
-            @Autowired(required = false) ClassificationLabelStore labelStore,
-            @Autowired(required = false) PolicyManagementAuthority policyManagementAuthority) {
+            ClassificationLabelProvider labelProvider,
+            @Autowired(required = false) UserServiceInterface userService) {
         this.pdfDocumentFactory = pdfDocumentFactory;
         this.tempFileManager = tempFileManager;
         this.pdfContentExtractor = pdfContentExtractor;
         this.pdfMetadataService = pdfMetadataService;
         this.aiEngineClient = aiEngineClient;
         this.objectMapper = objectMapper;
+        this.labelProvider = labelProvider;
         this.userService = userService;
-        this.labelStore = labelStore;
-        this.policyManagementAuthority = policyManagementAuthority;
     }
 
     @PostMapping(value = "/classify-and-label", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
@@ -116,9 +109,9 @@ public class ClassifyLabelController {
 
             List<EngineLabel> allowed = resolveAllowedLabels();
             if (allowed.isEmpty()) {
-                // No vocabulary to classify against (the team stored no labels): pass the file
-                // through unlabelled rather than ask the engine to classify against nothing.
-                log.debug("[classify-and-label] {} has no team labels; skipping", fileName);
+                // No vocabulary to classify against: pass the file through unlabelled rather than
+                // ask the engine to classify against nothing.
+                log.debug("[classify-and-label] {} has no labels; skipping", fileName);
                 return WebResponseUtils.pdfDocToWebResponse(document, fileName, tempFileManager);
             }
 
@@ -175,24 +168,13 @@ public class ClassifyLabelController {
     }
 
     /**
-     * The allowed labels for the caller's team as {@code {id, name}} pairs, de-duplicated by id.
-     * The engine shows the model the names and returns the ids (icons are presentational and never
-     * sent). Returns an empty list — the caller then skips classification — when the policy
-     * subsystem is disabled (no store) or the team has no stored labels. The engine holds no
-     * default vocabulary of its own, so a team's stored labels are the only source.
+     * The built-in vocabulary as {@code {id, name}} pairs, de-duplicated by id. The engine shows
+     * the model the names and returns the ids (icons are presentational and never sent). The engine
+     * holds no default vocabulary of its own, so this bundled set is the only source.
      */
     private List<EngineLabel> resolveAllowedLabels() {
-        if (labelStore == null) {
-            return List.of();
-        }
-        Long teamId =
-                policyManagementAuthority == null
-                        ? null
-                        : policyManagementAuthority.currentUserTeamId();
-
         Map<String, EngineLabel> byId = new LinkedHashMap<>();
-        labelStore.findByTeam(teamId).ifPresent(labels -> collectLabels(labels.labels(), byId));
-
+        collectLabels(labelProvider.labels(), byId);
         return List.copyOf(byId.values());
     }
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java
index 2e9c4d3e5b..a9c567885f 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java
@@ -37,8 +37,7 @@ import stirling.software.common.model.exception.UnsupportedProviderException;
             "stirling.software.proprietary.policy.ledger",
             "stirling.software.proprietary.accountlink",
             "stirling.software.proprietary.access.repository",
-            "stirling.software.proprietary.integration.repository",
-            "stirling.software.proprietary.classification.store"
+            "stirling.software.proprietary.integration.repository"
         })
 @EntityScan({
     "stirling.software.proprietary.security.model",
@@ -50,8 +49,7 @@ import stirling.software.common.model.exception.UnsupportedProviderException;
     "stirling.software.proprietary.policy.ledger",
     "stirling.software.proprietary.accountlink",
     "stirling.software.proprietary.access.model",
-    "stirling.software.proprietary.integration.model",
-    "stirling.software.proprietary.classification.store"
+    "stirling.software.proprietary.integration.model"
 })
 public class DatabaseConfig {
 
diff --git a/app/proprietary/src/main/resources/classification/classification-labels.json b/app/proprietary/src/main/resources/classification/classification-labels.json
new file mode 100644
index 0000000000..72f09c3aea
--- /dev/null
+++ b/app/proprietary/src/main/resources/classification/classification-labels.json
@@ -0,0 +1,1344 @@
+{
+  "labels": [
+    {
+      "id": "invoice",
+      "name": "Invoice",
+      "icon": "receipt-long"
+    },
+    {
+      "id": "receipt",
+      "name": "Receipt",
+      "icon": "receipt"
+    },
+    {
+      "id": "credit-note",
+      "name": "Credit note",
+      "icon": "currency-exchange"
+    },
+    {
+      "id": "debit-note",
+      "name": "Debit note",
+      "icon": "attach-money"
+    },
+    {
+      "id": "purchase-order",
+      "name": "Purchase order",
+      "icon": "shopping-cart"
+    },
+    {
+      "id": "order-confirmation",
+      "name": "Order confirmation",
+      "icon": "shopping-cart"
+    },
+    {
+      "id": "quote",
+      "name": "Quote",
+      "icon": "request-quote"
+    },
+    {
+      "id": "estimate",
+      "name": "Estimate",
+      "icon": "price-check"
+    },
+    {
+      "id": "proforma-invoice",
+      "name": "Proforma invoice",
+      "icon": "paid"
+    },
+    {
+      "id": "bank-statement",
+      "name": "Bank statement",
+      "icon": "account-balance"
+    },
+    {
+      "id": "financial-statement",
+      "name": "Financial statement",
+      "icon": "account-balance-wallet"
+    },
+    {
+      "id": "balance-sheet",
+      "name": "Balance sheet",
+      "icon": "table-chart"
+    },
+    {
+      "id": "income-statement",
+      "name": "Income statement",
+      "icon": "functions"
+    },
+    {
+      "id": "cash-flow-statement",
+      "name": "Cash flow statement",
+      "icon": "query-stats"
+    },
+    {
+      "id": "expense-report",
+      "name": "Expense report",
+      "icon": "credit-card"
+    },
+    {
+      "id": "budget",
+      "name": "Budget",
+      "icon": "savings"
+    },
+    {
+      "id": "financial-forecast",
+      "name": "Financial forecast",
+      "icon": "insights"
+    },
+    {
+      "id": "payslip",
+      "name": "Payslip",
+      "icon": "payments"
+    },
+    {
+      "id": "payroll-document",
+      "name": "Payroll document",
+      "icon": "wallet"
+    },
+    {
+      "id": "tax-form",
+      "name": "Tax form",
+      "icon": "calculate"
+    },
+    {
+      "id": "tax-return",
+      "name": "Tax return",
+      "icon": "percent"
+    },
+    {
+      "id": "tax-statement",
+      "name": "Tax statement",
+      "icon": "calculate"
+    },
+    {
+      "id": "remittance-advice",
+      "name": "Remittance advice",
+      "icon": "send"
+    },
+    {
+      "id": "payment-reminder",
+      "name": "Payment reminder",
+      "icon": "schedule"
+    },
+    {
+      "id": "statement-of-account",
+      "name": "Statement of account",
+      "icon": "inbox"
+    },
+    {
+      "id": "dunning-letter",
+      "name": "Dunning letter",
+      "icon": "mail"
+    },
+    {
+      "id": "audit-report",
+      "name": "Audit report",
+      "icon": "fact-check"
+    },
+    {
+      "id": "annual-report",
+      "name": "Annual report",
+      "icon": "leaderboard"
+    },
+    {
+      "id": "quarterly-report",
+      "name": "Quarterly report",
+      "icon": "bar-chart"
+    },
+    {
+      "id": "pricing-sheet",
+      "name": "Pricing sheet",
+      "icon": "sell"
+    },
+    {
+      "id": "price-list",
+      "name": "Price list",
+      "icon": "format-list-bulleted"
+    },
+    {
+      "id": "loan-document",
+      "name": "Loan document",
+      "icon": "assured-workload"
+    },
+    {
+      "id": "mortgage-document",
+      "name": "Mortgage document",
+      "icon": "home"
+    },
+    {
+      "id": "investment-summary",
+      "name": "Investment summary",
+      "icon": "trending-up"
+    },
+    {
+      "id": "donation-receipt",
+      "name": "Donation receipt",
+      "icon": "volunteer-activism"
+    },
+    {
+      "id": "contract",
+      "name": "Contract",
+      "icon": "handshake"
+    },
+    {
+      "id": "nda",
+      "name": "NDA",
+      "icon": "lock"
+    },
+    {
+      "id": "service-agreement",
+      "name": "Service agreement",
+      "icon": "handshake"
+    },
+    {
+      "id": "employment-contract",
+      "name": "Employment contract",
+      "icon": "work"
+    },
+    {
+      "id": "lease-agreement",
+      "name": "Lease agreement",
+      "icon": "home-work"
+    },
+    {
+      "id": "rental-agreement",
+      "name": "Rental agreement",
+      "icon": "home-work"
+    },
+    {
+      "id": "license-agreement",
+      "name": "License agreement",
+      "icon": "verified"
+    },
+    {
+      "id": "purchase-agreement",
+      "name": "Purchase agreement",
+      "icon": "shopping-cart"
+    },
+    {
+      "id": "partnership-agreement",
+      "name": "Partnership agreement",
+      "icon": "diversity-3"
+    },
+    {
+      "id": "loan-agreement",
+      "name": "Loan agreement",
+      "icon": "account-balance"
+    },
+    {
+      "id": "settlement-agreement",
+      "name": "Settlement agreement",
+      "icon": "balance"
+    },
+    {
+      "id": "vendor-agreement",
+      "name": "Vendor agreement",
+      "icon": "storefront"
+    },
+    {
+      "id": "franchise-agreement",
+      "name": "Franchise agreement",
+      "icon": "business-center"
+    },
+    {
+      "id": "non-compete-agreement",
+      "name": "Non-compete agreement",
+      "icon": "gavel"
+    },
+    {
+      "id": "amendment",
+      "name": "Amendment",
+      "icon": "edit-document"
+    },
+    {
+      "id": "addendum",
+      "name": "Addendum",
+      "icon": "edit-document"
+    },
+    {
+      "id": "terms-and-conditions",
+      "name": "Terms and conditions",
+      "icon": "gavel"
+    },
+    {
+      "id": "terms-of-service",
+      "name": "Terms of service",
+      "icon": "gavel"
+    },
+    {
+      "id": "privacy-policy",
+      "name": "Privacy policy",
+      "icon": "privacy-tip"
+    },
+    {
+      "id": "power-of-attorney",
+      "name": "Power of attorney",
+      "icon": "gavel"
+    },
+    {
+      "id": "affidavit",
+      "name": "Affidavit",
+      "icon": "gavel"
+    },
+    {
+      "id": "will",
+      "name": "Will",
+      "icon": "history-edu"
+    },
+    {
+      "id": "trust-document",
+      "name": "Trust document",
+      "icon": "shield"
+    },
+    {
+      "id": "deed",
+      "name": "Deed",
+      "icon": "home-work"
+    },
+    {
+      "id": "court-filing",
+      "name": "Court filing",
+      "icon": "balance"
+    },
+    {
+      "id": "legal-brief",
+      "name": "Legal brief",
+      "icon": "balance"
+    },
+    {
+      "id": "legal-opinion",
+      "name": "Legal opinion",
+      "icon": "balance"
+    },
+    {
+      "id": "legal-notice",
+      "name": "Legal notice",
+      "icon": "gavel"
+    },
+    {
+      "id": "subpoena",
+      "name": "Subpoena",
+      "icon": "gavel"
+    },
+    {
+      "id": "cease-and-desist",
+      "name": "Cease and desist",
+      "icon": "gavel"
+    },
+    {
+      "id": "compliance-document",
+      "name": "Compliance document",
+      "icon": "rule"
+    },
+    {
+      "id": "regulatory-filing",
+      "name": "Regulatory filing",
+      "icon": "rule"
+    },
+    {
+      "id": "consent-form",
+      "name": "Consent form",
+      "icon": "fact-check"
+    },
+    {
+      "id": "waiver",
+      "name": "Waiver",
+      "icon": "fact-check"
+    },
+    {
+      "id": "memorandum-of-understanding",
+      "name": "Memorandum of understanding",
+      "icon": "handshake"
+    },
+    {
+      "id": "letter-of-intent",
+      "name": "Letter of intent",
+      "icon": "draft"
+    },
+    {
+      "id": "articles-of-incorporation",
+      "name": "Articles of incorporation",
+      "icon": "business-center"
+    },
+    {
+      "id": "bylaws",
+      "name": "Bylaws",
+      "icon": "rule"
+    },
+    {
+      "id": "shareholder-agreement",
+      "name": "Shareholder agreement",
+      "icon": "handshake"
+    },
+    {
+      "id": "board-resolution",
+      "name": "Board resolution",
+      "icon": "groups"
+    },
+    {
+      "id": "resume",
+      "name": "Resume",
+      "icon": "person"
+    },
+    {
+      "id": "cv",
+      "name": "CV",
+      "icon": "person"
+    },
+    {
+      "id": "cover-letter",
+      "name": "Cover letter",
+      "icon": "mail"
+    },
+    {
+      "id": "job-description",
+      "name": "Job description",
+      "icon": "topic"
+    },
+    {
+      "id": "job-application",
+      "name": "Job application",
+      "icon": "note-add"
+    },
+    {
+      "id": "offer-letter",
+      "name": "Offer letter",
+      "icon": "work"
+    },
+    {
+      "id": "onboarding-document",
+      "name": "Onboarding document",
+      "icon": "badge"
+    },
+    {
+      "id": "employee-handbook",
+      "name": "Employee handbook",
+      "icon": "menu-book"
+    },
+    {
+      "id": "hr-policy",
+      "name": "HR policy",
+      "icon": "policy"
+    },
+    {
+      "id": "performance-review",
+      "name": "Performance review",
+      "icon": "monitoring"
+    },
+    {
+      "id": "timesheet",
+      "name": "Timesheet",
+      "icon": "schedule"
+    },
+    {
+      "id": "leave-request",
+      "name": "Leave request",
+      "icon": "event"
+    },
+    {
+      "id": "resignation-letter",
+      "name": "Resignation letter",
+      "icon": "mail"
+    },
+    {
+      "id": "termination-letter",
+      "name": "Termination letter",
+      "icon": "send"
+    },
+    {
+      "id": "reference-letter",
+      "name": "Reference letter",
+      "icon": "contact-page"
+    },
+    {
+      "id": "recommendation-letter",
+      "name": "Recommendation letter",
+      "icon": "how-to-reg"
+    },
+    {
+      "id": "training-material",
+      "name": "Training material",
+      "icon": "school"
+    },
+    {
+      "id": "organization-chart",
+      "name": "Organization chart",
+      "icon": "supervisor-account"
+    },
+    {
+      "id": "benefits-summary",
+      "name": "Benefits summary",
+      "icon": "health-and-safety"
+    },
+    {
+      "id": "hr-memo",
+      "name": "HR memo",
+      "icon": "sticky-note-2"
+    },
+    {
+      "id": "letter",
+      "name": "Letter",
+      "icon": "mail"
+    },
+    {
+      "id": "email-thread",
+      "name": "Email thread",
+      "icon": "alternate-email"
+    },
+    {
+      "id": "memo",
+      "name": "Memo",
+      "icon": "sticky-note-2"
+    },
+    {
+      "id": "meeting-minutes",
+      "name": "Meeting minutes",
+      "icon": "groups"
+    },
+    {
+      "id": "meeting-agenda",
+      "name": "Meeting agenda",
+      "icon": "checklist"
+    },
+    {
+      "id": "newsletter",
+      "name": "Newsletter",
+      "icon": "newspaper"
+    },
+    {
+      "id": "announcement",
+      "name": "Announcement",
+      "icon": "campaign"
+    },
+    {
+      "id": "notice",
+      "name": "Notice",
+      "icon": "campaign"
+    },
+    {
+      "id": "public-notice",
+      "name": "Public notice",
+      "icon": "public"
+    },
+    {
+      "id": "press-release",
+      "name": "Press release",
+      "icon": "campaign"
+    },
+    {
+      "id": "complaint-letter",
+      "name": "Complaint letter",
+      "icon": "forum"
+    },
+    {
+      "id": "demand-letter",
+      "name": "Demand letter",
+      "icon": "mail"
+    },
+    {
+      "id": "confirmation-letter",
+      "name": "Confirmation letter",
+      "icon": "mail"
+    },
+    {
+      "id": "report",
+      "name": "Report",
+      "icon": "bar-chart"
+    },
+    {
+      "id": "progress-report",
+      "name": "Progress report",
+      "icon": "timeline"
+    },
+    {
+      "id": "status-report",
+      "name": "Status report",
+      "icon": "monitoring"
+    },
+    {
+      "id": "incident-report",
+      "name": "Incident report",
+      "icon": "emergency"
+    },
+    {
+      "id": "inspection-report",
+      "name": "Inspection report",
+      "icon": "fact-check"
+    },
+    {
+      "id": "survey-results",
+      "name": "Survey results",
+      "icon": "pie-chart"
+    },
+    {
+      "id": "market-research",
+      "name": "Market research",
+      "icon": "insights"
+    },
+    {
+      "id": "case-study",
+      "name": "Case study",
+      "icon": "article"
+    },
+    {
+      "id": "white-paper",
+      "name": "White paper",
+      "icon": "library-books"
+    },
+    {
+      "id": "research-paper",
+      "name": "Research paper",
+      "icon": "science"
+    },
+    {
+      "id": "research-abstract",
+      "name": "Research abstract",
+      "icon": "text-snippet"
+    },
+    {
+      "id": "feasibility-study",
+      "name": "Feasibility study",
+      "icon": "architecture"
+    },
+    {
+      "id": "risk-assessment",
+      "name": "Risk assessment",
+      "icon": "security"
+    },
+    {
+      "id": "analytics-report",
+      "name": "Analytics report",
+      "icon": "analytics"
+    },
+    {
+      "id": "sales-report",
+      "name": "Sales report",
+      "icon": "trending-up"
+    },
+    {
+      "id": "expense-summary",
+      "name": "Expense summary",
+      "icon": "pie-chart"
+    },
+    {
+      "id": "board-report",
+      "name": "Board report",
+      "icon": "groups"
+    },
+    {
+      "id": "sustainability-report",
+      "name": "Sustainability report",
+      "icon": "eco"
+    },
+    {
+      "id": "standard-operating-procedure",
+      "name": "Standard operating procedure",
+      "icon": "rule"
+    },
+    {
+      "id": "work-instruction",
+      "name": "Work instruction",
+      "icon": "checklist"
+    },
+    {
+      "id": "manual",
+      "name": "Manual",
+      "icon": "menu-book"
+    },
+    {
+      "id": "user-guide",
+      "name": "User guide",
+      "icon": "auto-stories"
+    },
+    {
+      "id": "quick-start-guide",
+      "name": "Quick start guide",
+      "icon": "menu-book"
+    },
+    {
+      "id": "checklist",
+      "name": "Checklist",
+      "icon": "checklist"
+    },
+    {
+      "id": "inventory-list",
+      "name": "Inventory list",
+      "icon": "inventory-2"
+    },
+    {
+      "id": "stock-report",
+      "name": "Stock report",
+      "icon": "warehouse"
+    },
+    {
+      "id": "packing-slip",
+      "name": "Packing slip",
+      "icon": "package-2"
+    },
+    {
+      "id": "delivery-note",
+      "name": "Delivery note",
+      "icon": "local-shipping"
+    },
+    {
+      "id": "bill-of-lading",
+      "name": "Bill of lading",
+      "icon": "pallet"
+    },
+    {
+      "id": "waybill",
+      "name": "Waybill",
+      "icon": "map"
+    },
+    {
+      "id": "customs-declaration",
+      "name": "Customs declaration",
+      "icon": "flight"
+    },
+    {
+      "id": "customs-form",
+      "name": "Customs form",
+      "icon": "assignment"
+    },
+    {
+      "id": "freight-document",
+      "name": "Freight document",
+      "icon": "forklift"
+    },
+    {
+      "id": "shipping-confirmation",
+      "name": "Shipping confirmation",
+      "icon": "send"
+    },
+    {
+      "id": "supply-order",
+      "name": "Supply order",
+      "icon": "shopping-cart"
+    },
+    {
+      "id": "work-order",
+      "name": "Work order",
+      "icon": "task"
+    },
+    {
+      "id": "maintenance-log",
+      "name": "Maintenance log",
+      "icon": "build"
+    },
+    {
+      "id": "service-report",
+      "name": "Service report",
+      "icon": "engineering"
+    },
+    {
+      "id": "quality-report",
+      "name": "Quality report",
+      "icon": "verified"
+    },
+    {
+      "id": "safety-data-sheet",
+      "name": "Safety data sheet",
+      "icon": "health-and-safety"
+    },
+    {
+      "id": "safety-procedure",
+      "name": "Safety procedure",
+      "icon": "health-and-safety"
+    },
+    {
+      "id": "warehouse-receipt",
+      "name": "Warehouse receipt",
+      "icon": "inventory-2"
+    },
+    {
+      "id": "return-authorization",
+      "name": "Return authorization",
+      "icon": "redeem"
+    },
+    {
+      "id": "proposal",
+      "name": "Proposal",
+      "icon": "slideshow"
+    },
+    {
+      "id": "business-proposal",
+      "name": "Business proposal",
+      "icon": "business-center"
+    },
+    {
+      "id": "sales-proposal",
+      "name": "Sales proposal",
+      "icon": "trending-up"
+    },
+    {
+      "id": "pitch-deck",
+      "name": "Pitch deck",
+      "icon": "leaderboard"
+    },
+    {
+      "id": "presentation",
+      "name": "Presentation",
+      "icon": "slideshow"
+    },
+    {
+      "id": "brochure",
+      "name": "Brochure",
+      "icon": "image"
+    },
+    {
+      "id": "flyer",
+      "name": "Flyer",
+      "icon": "palette"
+    },
+    {
+      "id": "catalog",
+      "name": "Catalog",
+      "icon": "menu-book"
+    },
+    {
+      "id": "product-sheet",
+      "name": "Product sheet",
+      "icon": "description"
+    },
+    {
+      "id": "marketing-plan",
+      "name": "Marketing plan",
+      "icon": "campaign"
+    },
+    {
+      "id": "campaign-brief",
+      "name": "Campaign brief",
+      "icon": "campaign"
+    },
+    {
+      "id": "media-kit",
+      "name": "Media kit",
+      "icon": "photo-camera"
+    },
+    {
+      "id": "promotional-material",
+      "name": "Promotional material",
+      "icon": "celebration"
+    },
+    {
+      "id": "advertisement",
+      "name": "Advertisement",
+      "icon": "campaign"
+    },
+    {
+      "id": "request-for-proposal",
+      "name": "Request for proposal",
+      "icon": "assignment"
+    },
+    {
+      "id": "request-for-quotation",
+      "name": "Request for quotation",
+      "icon": "request-quote"
+    },
+    {
+      "id": "tender-document",
+      "name": "Tender document",
+      "icon": "assignment"
+    },
+    {
+      "id": "statement-of-work",
+      "name": "Statement of work",
+      "icon": "task"
+    },
+    {
+      "id": "scope-of-work",
+      "name": "Scope of work",
+      "icon": "task"
+    },
+    {
+      "id": "specification",
+      "name": "Specification",
+      "icon": "engineering"
+    },
+    {
+      "id": "technical-specification",
+      "name": "Technical specification",
+      "icon": "code"
+    },
+    {
+      "id": "requirements-document",
+      "name": "Requirements document",
+      "icon": "checklist"
+    },
+    {
+      "id": "design-document",
+      "name": "Design document",
+      "icon": "design-services"
+    },
+    {
+      "id": "architecture-document",
+      "name": "Architecture document",
+      "icon": "architecture"
+    },
+    {
+      "id": "datasheet",
+      "name": "Datasheet",
+      "icon": "table-chart"
+    },
+    {
+      "id": "schematic",
+      "name": "Schematic",
+      "icon": "bolt"
+    },
+    {
+      "id": "blueprint",
+      "name": "Blueprint",
+      "icon": "construction"
+    },
+    {
+      "id": "technical-drawing",
+      "name": "Technical drawing",
+      "icon": "engineering"
+    },
+    {
+      "id": "floor-plan",
+      "name": "Floor plan",
+      "icon": "apartment"
+    },
+    {
+      "id": "patent",
+      "name": "Patent",
+      "icon": "copyright"
+    },
+    {
+      "id": "test-plan",
+      "name": "Test plan",
+      "icon": "checklist"
+    },
+    {
+      "id": "test-report",
+      "name": "Test report",
+      "icon": "fact-check"
+    },
+    {
+      "id": "release-notes",
+      "name": "Release notes",
+      "icon": "article"
+    },
+    {
+      "id": "change-log",
+      "name": "Change log",
+      "icon": "edit-document"
+    },
+    {
+      "id": "api-documentation",
+      "name": "API documentation",
+      "icon": "api"
+    },
+    {
+      "id": "bill-of-materials",
+      "name": "Bill of materials",
+      "icon": "inventory-2"
+    },
+    {
+      "id": "business-plan",
+      "name": "Business plan",
+      "icon": "business-center"
+    },
+    {
+      "id": "project-plan",
+      "name": "Project plan",
+      "icon": "task"
+    },
+    {
+      "id": "project-charter",
+      "name": "Project charter",
+      "icon": "task"
+    },
+    {
+      "id": "roadmap",
+      "name": "Roadmap",
+      "icon": "trending-up"
+    },
+    {
+      "id": "timeline",
+      "name": "Timeline",
+      "icon": "timeline"
+    },
+    {
+      "id": "meeting-notes",
+      "name": "Meeting notes",
+      "icon": "sticky-note-2"
+    },
+    {
+      "id": "action-plan",
+      "name": "Action plan",
+      "icon": "checklist"
+    },
+    {
+      "id": "retrospective",
+      "name": "Retrospective",
+      "icon": "psychology"
+    },
+    {
+      "id": "transcript",
+      "name": "Transcript",
+      "icon": "school"
+    },
+    {
+      "id": "diploma",
+      "name": "Diploma",
+      "icon": "history-edu"
+    },
+    {
+      "id": "certificate",
+      "name": "Certificate",
+      "icon": "verified"
+    },
+    {
+      "id": "certificate-of-completion",
+      "name": "Certificate of completion",
+      "icon": "verified"
+    },
+    {
+      "id": "course-syllabus",
+      "name": "Course syllabus",
+      "icon": "menu-book"
+    },
+    {
+      "id": "lesson-plan",
+      "name": "Lesson plan",
+      "icon": "school"
+    },
+    {
+      "id": "assignment-brief",
+      "name": "Assignment brief",
+      "icon": "assignment"
+    },
+    {
+      "id": "exam-paper",
+      "name": "Exam paper",
+      "icon": "assignment"
+    },
+    {
+      "id": "grade-report",
+      "name": "Grade report",
+      "icon": "school"
+    },
+    {
+      "id": "thesis",
+      "name": "Thesis",
+      "icon": "science"
+    },
+    {
+      "id": "dissertation",
+      "name": "Dissertation",
+      "icon": "science"
+    },
+    {
+      "id": "study-guide",
+      "name": "Study guide",
+      "icon": "menu-book"
+    },
+    {
+      "id": "academic-record",
+      "name": "Academic record",
+      "icon": "school"
+    },
+    {
+      "id": "medical-report",
+      "name": "Medical report",
+      "icon": "medical-services"
+    },
+    {
+      "id": "lab-report",
+      "name": "Lab report",
+      "icon": "science"
+    },
+    {
+      "id": "radiology-report",
+      "name": "Radiology report",
+      "icon": "monitor-heart"
+    },
+    {
+      "id": "pathology-report",
+      "name": "Pathology report",
+      "icon": "medical-information"
+    },
+    {
+      "id": "prescription",
+      "name": "Prescription",
+      "icon": "medication"
+    },
+    {
+      "id": "referral-letter",
+      "name": "Referral letter",
+      "icon": "stethoscope"
+    },
+    {
+      "id": "discharge-summary",
+      "name": "Discharge summary",
+      "icon": "medical-services"
+    },
+    {
+      "id": "immunization-record",
+      "name": "Immunization record",
+      "icon": "vaccines"
+    },
+    {
+      "id": "medical-invoice",
+      "name": "Medical invoice",
+      "icon": "receipt-long"
+    },
+    {
+      "id": "insurance-policy",
+      "name": "Insurance policy",
+      "icon": "shield"
+    },
+    {
+      "id": "insurance-claim",
+      "name": "Insurance claim",
+      "icon": "security"
+    },
+    {
+      "id": "insurance-certificate",
+      "name": "Insurance certificate",
+      "icon": "approval"
+    },
+    {
+      "id": "explanation-of-benefits",
+      "name": "Explanation of benefits",
+      "icon": "medical-information"
+    },
+    {
+      "id": "property-listing",
+      "name": "Property listing",
+      "icon": "real-estate-agent"
+    },
+    {
+      "id": "appraisal-report",
+      "name": "Appraisal report",
+      "icon": "real-estate-agent"
+    },
+    {
+      "id": "home-inspection-report",
+      "name": "Home inspection report",
+      "icon": "home"
+    },
+    {
+      "id": "title-document",
+      "name": "Title document",
+      "icon": "home-work"
+    },
+    {
+      "id": "closing-statement",
+      "name": "Closing statement",
+      "icon": "real-estate-agent"
+    },
+    {
+      "id": "tenancy-agreement",
+      "name": "Tenancy agreement",
+      "icon": "home-work"
+    },
+    {
+      "id": "eviction-notice",
+      "name": "Eviction notice",
+      "icon": "gavel"
+    },
+    {
+      "id": "hoa-document",
+      "name": "HOA document",
+      "icon": "home-work"
+    },
+    {
+      "id": "utility-bill",
+      "name": "Utility bill",
+      "icon": "bolt"
+    },
+    {
+      "id": "permit",
+      "name": "Permit",
+      "icon": "approval"
+    },
+    {
+      "id": "license",
+      "name": "License",
+      "icon": "verified"
+    },
+    {
+      "id": "registration-form",
+      "name": "Registration form",
+      "icon": "how-to-reg"
+    },
+    {
+      "id": "application-form",
+      "name": "Application form",
+      "icon": "assignment"
+    },
+    {
+      "id": "government-notice",
+      "name": "Government notice",
+      "icon": "campaign"
+    },
+    {
+      "id": "grant-application",
+      "name": "Grant application",
+      "icon": "assignment"
+    },
+    {
+      "id": "grant-agreement",
+      "name": "Grant agreement",
+      "icon": "handshake"
+    },
+    {
+      "id": "visa-document",
+      "name": "Visa document",
+      "icon": "public"
+    },
+    {
+      "id": "immigration-document",
+      "name": "Immigration document",
+      "icon": "badge"
+    },
+    {
+      "id": "legal-filing",
+      "name": "Legal filing",
+      "icon": "balance"
+    },
+    {
+      "id": "itinerary",
+      "name": "Itinerary",
+      "icon": "map"
+    },
+    {
+      "id": "travel-itinerary",
+      "name": "Travel itinerary",
+      "icon": "flight"
+    },
+    {
+      "id": "booking-confirmation",
+      "name": "Booking confirmation",
+      "icon": "hotel"
+    },
+    {
+      "id": "reservation",
+      "name": "Reservation",
+      "icon": "restaurant"
+    },
+    {
+      "id": "ticket",
+      "name": "Ticket",
+      "icon": "confirmation-number"
+    },
+    {
+      "id": "event-agenda",
+      "name": "Event agenda",
+      "icon": "calendar-month"
+    },
+    {
+      "id": "event-program",
+      "name": "Event program",
+      "icon": "calendar-month"
+    },
+    {
+      "id": "invitation",
+      "name": "Invitation",
+      "icon": "mail"
+    },
+    {
+      "id": "registration-confirmation",
+      "name": "Registration confirmation",
+      "icon": "fact-check"
+    },
+    {
+      "id": "form",
+      "name": "Form",
+      "icon": "assignment"
+    },
+    {
+      "id": "questionnaire",
+      "name": "Questionnaire",
+      "icon": "assignment"
+    },
+    {
+      "id": "survey-form",
+      "name": "Survey form",
+      "icon": "checklist"
+    },
+    {
+      "id": "feedback-form",
+      "name": "Feedback form",
+      "icon": "forum"
+    },
+    {
+      "id": "intake-form",
+      "name": "Intake form",
+      "icon": "assignment"
+    },
+    {
+      "id": "order-form",
+      "name": "Order form",
+      "icon": "shopping-cart"
+    },
+    {
+      "id": "claim-form",
+      "name": "Claim form",
+      "icon": "assignment"
+    },
+    {
+      "id": "warranty-document",
+      "name": "Warranty document",
+      "icon": "assured-workload"
+    },
+    {
+      "id": "membership-document",
+      "name": "Membership document",
+      "icon": "badge"
+    },
+    {
+      "id": "subscription-confirmation",
+      "name": "Subscription confirmation",
+      "icon": "fact-check"
+    },
+    {
+      "id": "gift-certificate",
+      "name": "Gift certificate",
+      "icon": "redeem"
+    },
+    {
+      "id": "sponsorship-agreement",
+      "name": "Sponsorship agreement",
+      "icon": "handshake"
+    },
+    {
+      "id": "petition",
+      "name": "Petition",
+      "icon": "history-edu"
+    },
+    {
+      "id": "agenda",
+      "name": "Agenda",
+      "icon": "checklist"
+    },
+    {
+      "id": "fact-sheet",
+      "name": "Fact sheet",
+      "icon": "summarize"
+    },
+    {
+      "id": "faq-document",
+      "name": "FAQ document",
+      "icon": "chat"
+    },
+    {
+      "id": "glossary",
+      "name": "Glossary",
+      "icon": "menu-book"
+    },
+    {
+      "id": "index",
+      "name": "Index",
+      "icon": "format-list-bulleted"
+    },
+    {
+      "id": "table-of-contents",
+      "name": "Table of contents",
+      "icon": "topic"
+    }
+  ]
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/classification/ClassificationLabelsControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/classification/ClassificationLabelsControllerTest.java
deleted file mode 100644
index 221d567c31..0000000000
--- a/app/proprietary/src/test/java/stirling/software/proprietary/classification/ClassificationLabelsControllerTest.java
+++ /dev/null
@@ -1,133 +0,0 @@
-package stirling.software.proprietary.classification;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.mockito.Mockito.when;
-
-import java.util.List;
-
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.extension.ExtendWith;
-import org.mockito.Mock;
-import org.mockito.junit.jupiter.MockitoExtension;
-import org.springframework.http.HttpStatus;
-import org.springframework.http.ResponseEntity;
-import org.springframework.web.server.ResponseStatusException;
-
-import stirling.software.common.model.ApplicationProperties;
-import stirling.software.common.service.UserServiceInterface;
-import stirling.software.proprietary.classification.model.ClassificationLabel;
-import stirling.software.proprietary.classification.model.ClassificationLabels;
-import stirling.software.proprietary.classification.store.ClassificationLabelStore;
-import stirling.software.proprietary.classification.store.InProcessClassificationLabelStore;
-import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
-
-@ExtendWith(MockitoExtension.class)
-@DisplayName("ClassificationLabelsController")
-class ClassificationLabelsControllerTest {
-
-    private static final Long TEAM = 7L;
-
-    @Mock private PolicyManagementAuthority policyManagementAuthority;
-    @Mock private UserServiceInterface userService;
-
-    private ClassificationLabelStore store;
-    private ApplicationProperties applicationProperties;
-    private ClassificationLabelsController controller;
-
-    @BeforeEach
-    void setUp() {
-        store = new InProcessClassificationLabelStore();
-        applicationProperties = new ApplicationProperties();
-        controller =
-                new ClassificationLabelsController(
-                        store, policyManagementAuthority, applicationProperties, userService);
-    }
-
-    private static ClassificationLabels sample() {
-        return new ClassificationLabels(
-                List.of(
-                        new ClassificationLabel("invoice", "Invoice", "receipt-long"),
-                        new ClassificationLabel("contract", "Contract", null)));
-    }
-
-    private void loginEnabled(boolean enabled) {
-        applicationProperties.getSecurity().setEnableLogin(enabled);
-    }
-
-    @Test
-    @DisplayName("GET returns 204 when the team has no labels")
-    void getEmpty() {
-        when(policyManagementAuthority.currentUserTeamId()).thenReturn(TEAM);
-        ResponseEntity<ClassificationLabels> response = controller.getTeamLabels();
-        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
-    }
-
-    @Test
-    @DisplayName("PUT then GET round-trips the team's labels (login disabled)")
-    void saveThenGet() {
-        loginEnabled(false);
-        when(policyManagementAuthority.currentUserTeamId()).thenReturn(TEAM);
-
-        controller.saveTeamLabels(sample());
-        ResponseEntity<ClassificationLabels> got = controller.getTeamLabels();
-
-        assertThat(got.getStatusCode()).isEqualTo(HttpStatus.OK);
-        assertThat(got.getBody()).isNotNull();
-        assertThat(got.getBody().labels()).hasSize(2);
-        assertThat(got.getBody().labels().getFirst().name()).isEqualTo("Invoice");
-        assertThat(got.getBody().labels().getFirst().icon()).isEqualTo("receipt-long");
-    }
-
-    @Test
-    @DisplayName("PUT is scoped per team")
-    void perTeam() {
-        loginEnabled(false);
-        when(policyManagementAuthority.currentUserTeamId()).thenReturn(TEAM);
-        controller.saveTeamLabels(sample());
-
-        when(policyManagementAuthority.currentUserTeamId()).thenReturn(99L);
-        assertThat(controller.getTeamLabels().getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
-    }
-
-    @Test
-    @DisplayName("PUT is rejected for a non-editor when login is enabled")
-    void putForbiddenForNonEditor() {
-        loginEnabled(true);
-        when(policyManagementAuthority.canEditPolicies()).thenReturn(false);
-
-        assertThatThrownBy(() -> controller.saveTeamLabels(sample()))
-                .isInstanceOf(ResponseStatusException.class)
-                .hasFieldOrPropertyWithValue("statusCode", HttpStatus.FORBIDDEN);
-    }
-
-    @Test
-    @DisplayName("PUT rejects an invalid label set with 400")
-    void putInvalid() {
-        loginEnabled(false);
-        ClassificationLabels duplicate =
-                new ClassificationLabels(
-                        List.of(
-                                new ClassificationLabel("invoice", "Invoice", null),
-                                new ClassificationLabel("invoice", "Invoice", null)));
-
-        assertThatThrownBy(() -> controller.saveTeamLabels(duplicate))
-                .isInstanceOf(ResponseStatusException.class)
-                .hasFieldOrPropertyWithValue("statusCode", HttpStatus.BAD_REQUEST);
-    }
-
-    @Test
-    @DisplayName("DELETE resets the team back to no stored labels")
-    void deleteResets() {
-        loginEnabled(false);
-        when(policyManagementAuthority.currentUserTeamId()).thenReturn(TEAM);
-        controller.saveTeamLabels(sample());
-
-        ResponseEntity<Void> response = controller.resetTeamLabels();
-
-        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
-        assertThat(controller.getTeamLabels().getStatusCode()).isEqualTo(HttpStatus.NO_CONTENT);
-    }
-}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/classification/model/LabelsValidatorTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/classification/model/LabelsValidatorTest.java
deleted file mode 100644
index b9730370c7..0000000000
--- a/app/proprietary/src/test/java/stirling/software/proprietary/classification/model/LabelsValidatorTest.java
+++ /dev/null
@@ -1,146 +0,0 @@
-package stirling.software.proprietary.classification.model;
-
-import static org.assertj.core.api.Assertions.assertThatCode;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-
-import java.util.List;
-import java.util.Locale;
-import java.util.stream.IntStream;
-
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-
-@DisplayName("LabelsValidator")
-class LabelsValidatorTest {
-
-    private static ClassificationLabels labels(ClassificationLabel... labels) {
-        return new ClassificationLabels(List.of(labels));
-    }
-
-    private static ClassificationLabel label(String name) {
-        return new ClassificationLabel(slug(name), name, null);
-    }
-
-    private static String slug(String name) {
-        return name.trim()
-                .toLowerCase(Locale.ROOT)
-                .replaceAll("[^a-z0-9]+", "-")
-                .replaceAll("(^-|-$)", "");
-    }
-
-    @Test
-    @DisplayName("accepts a well-formed label set")
-    void acceptsValid() {
-        ClassificationLabels set =
-                labels(
-                        new ClassificationLabel("invoice", "Invoice", "receipt-long"),
-                        label("Contract"));
-        assertThatCode(() -> LabelsValidator.validate(set)).doesNotThrowAnyException();
-    }
-
-    @Test
-    @DisplayName("accepts an empty label set (reads as: use the default)")
-    void acceptsEmpty() {
-        assertThatCode(() -> LabelsValidator.validate(labels())).doesNotThrowAnyException();
-    }
-
-    @Test
-    @DisplayName("rejects a null label set")
-    void rejectsNull() {
-        assertThatThrownBy(() -> LabelsValidator.validate(null))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("Labels are required");
-    }
-
-    @Test
-    @DisplayName("rejects duplicate names (distinct ids)")
-    void rejectsDuplicateNames() {
-        ClassificationLabels set =
-                labels(
-                        new ClassificationLabel("invoice-a", "Invoice", null),
-                        new ClassificationLabel("invoice-b", "Invoice", null));
-        assertThatThrownBy(() -> LabelsValidator.validate(set))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("Duplicate label name");
-    }
-
-    @Test
-    @DisplayName("rejects duplicate names differing only by case")
-    void rejectsDuplicateNamesCaseInsensitive() {
-        ClassificationLabels set =
-                labels(
-                        new ClassificationLabel("invoice-a", "Invoice", null),
-                        new ClassificationLabel("invoice-b", "INVOICE", null));
-        assertThatThrownBy(() -> LabelsValidator.validate(set))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("Duplicate label name");
-    }
-
-    @Test
-    @DisplayName("rejects duplicate ids")
-    void rejectsDuplicateIds() {
-        ClassificationLabels set =
-                labels(
-                        new ClassificationLabel("invoice", "Invoice", null),
-                        new ClassificationLabel("invoice", "Sales invoice", null));
-        assertThatThrownBy(() -> LabelsValidator.validate(set))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("Duplicate label id");
-    }
-
-    @Test
-    @DisplayName("rejects a blank name")
-    void rejectsBlankName() {
-        ClassificationLabels set = labels(new ClassificationLabel("blank", " ", null));
-        assertThatThrownBy(() -> LabelsValidator.validate(set))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("Label name must not be blank");
-    }
-
-    @Test
-    @DisplayName("rejects a blank id")
-    void rejectsBlankId() {
-        ClassificationLabels set = labels(new ClassificationLabel(" ", "Invoice", null));
-        assertThatThrownBy(() -> LabelsValidator.validate(set))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("Label id must not be blank");
-    }
-
-    @Test
-    @DisplayName("rejects an over-long name")
-    void rejectsOverLongName() {
-        ClassificationLabels set =
-                labels(
-                        new ClassificationLabel(
-                                "x", "x".repeat(LabelsValidator.MAX_TEXT_LENGTH + 1), null));
-        assertThatThrownBy(() -> LabelsValidator.validate(set))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("too long");
-    }
-
-    @Test
-    @DisplayName("rejects an over-long icon (a null icon is fine)")
-    void rejectsOverLongIcon() {
-        ClassificationLabels set =
-                labels(
-                        new ClassificationLabel(
-                                "invoice",
-                                "Invoice",
-                                "x".repeat(LabelsValidator.MAX_TEXT_LENGTH + 1)));
-        assertThatThrownBy(() -> LabelsValidator.validate(set))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("icon is too long");
-    }
-
-    @Test
-    @DisplayName("rejects more labels than the cap")
-    void rejectsTooManyLabels() {
-        List<ClassificationLabel> tooMany =
-                IntStream.rangeClosed(0, LabelsValidator.MAX_LABELS)
-                        .mapToObj(i -> label("label" + i))
-                        .toList();
-        assertThatThrownBy(() -> LabelsValidator.validate(new ClassificationLabels(tooMany)))
-                .isInstanceOf(IllegalArgumentException.class)
-                .hasMessageContaining("Too many labels");
-    }
-}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ClassifyLabelControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ClassifyLabelControllerTest.java
index c5ee39be14..2773ed7965 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ClassifyLabelControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ClassifyLabelControllerTest.java
@@ -14,7 +14,6 @@ import static org.mockito.Mockito.when;
 import java.util.List;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
-import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.mockito.ArgumentCaptor;
@@ -27,10 +26,8 @@ import org.springframework.web.multipart.MultipartFile;
 import stirling.software.common.service.CustomPDFDocumentFactory;
 import stirling.software.common.service.PdfMetadataService;
 import stirling.software.common.util.TempFileManager;
+import stirling.software.proprietary.classification.ClassificationLabelProvider;
 import stirling.software.proprietary.classification.model.ClassificationLabel;
-import stirling.software.proprietary.classification.model.ClassificationLabels;
-import stirling.software.proprietary.classification.store.InProcessClassificationLabelStore;
-import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
 import stirling.software.proprietary.service.AiEngineClient;
 import stirling.software.proprietary.service.PdfContentExtractor;
 
@@ -42,22 +39,16 @@ import tools.jackson.databind.json.JsonMapper;
 @MockitoSettings(strictness = Strictness.LENIENT)
 class ClassifyLabelControllerTest {
 
-    private static final Long TEAM = 7L;
-
     @Mock private CustomPDFDocumentFactory pdfDocumentFactory;
     @Mock private TempFileManager tempFileManager;
     @Mock private PdfContentExtractor pdfContentExtractor;
     @Mock private PdfMetadataService pdfMetadataService;
     @Mock private AiEngineClient aiEngineClient;
-    @Mock private PolicyManagementAuthority policyManagementAuthority;
 
     private final ObjectMapper objectMapper = JsonMapper.builder().build();
-    private InProcessClassificationLabelStore labelStore;
     private ClassifyLabelController controller;
 
-    @BeforeEach
-    void setUp() {
-        labelStore = new InProcessClassificationLabelStore();
+    private void withLabels(List<ClassificationLabel> labels) {
         controller =
                 new ClassifyLabelController(
                         pdfDocumentFactory,
@@ -66,9 +57,8 @@ class ClassifyLabelControllerTest {
                         pdfMetadataService,
                         aiEngineClient,
                         objectMapper,
-                        null,
-                        labelStore,
-                        policyManagementAuthority);
+                        ClassificationLabelProvider.withLabels(labels),
+                        null);
     }
 
     private void stubSinglePageDocument() throws Exception {
@@ -98,12 +88,7 @@ class ClassifyLabelControllerTest {
 
     @Test
     void classifyAndLabel_writesClassificationWithoutOutcome() throws Exception {
-        when(policyManagementAuthority.currentUserTeamId()).thenReturn(TEAM);
-        labelStore.save(
-                TEAM,
-                new ClassificationLabels(
-                        List.of(new ClassificationLabel("invoice", "Invoice", null))),
-                "admin");
+        withLabels(List.of(new ClassificationLabel("invoice", "Invoice", null)));
 
         stubSinglePageDocument();
 
@@ -118,16 +103,12 @@ class ClassifyLabelControllerTest {
     }
 
     @Test
-    void classifyAndLabel_sendsTeamLabelIdsAndNames() throws Exception {
-        when(policyManagementAuthority.currentUserTeamId()).thenReturn(TEAM);
-        labelStore.save(
-                TEAM,
-                new ClassificationLabels(
-                        List.of(
-                                new ClassificationLabel("invoice", "Invoice", "receipt-long"),
-                                new ClassificationLabel("contract", "Contract", null),
-                                new ClassificationLabel("timesheet", "Timesheet", null))),
-                "admin");
+    void classifyAndLabel_sendsLabelIdsAndNames() throws Exception {
+        withLabels(
+                List.of(
+                        new ClassificationLabel("invoice", "Invoice", "receipt-long"),
+                        new ClassificationLabel("contract", "Contract", null),
+                        new ClassificationLabel("timesheet", "Timesheet", null)));
 
         stubSinglePageDocument();
 
@@ -152,13 +133,13 @@ class ClassifyLabelControllerTest {
     }
 
     @Test
-    void classifyAndLabel_skipsClassificationWhenNothingStored() throws Exception {
-        when(policyManagementAuthority.currentUserTeamId()).thenReturn(TEAM);
+    void classifyAndLabel_skipsClassificationWhenNoLabels() throws Exception {
+        withLabels(List.of());
 
         stubSinglePageDocument();
 
-        // No team labels stored, and the engine holds no default of its own, so the file is passed
-        // through unlabelled: neither the engine nor the metadata write is invoked.
+        // No vocabulary, and the engine holds no default of its own, so the file is passed through
+        // unlabelled: neither the engine nor the metadata write is invoked.
         verify(aiEngineClient, never()).post(anyString(), anyString(), any());
         verify(pdfMetadataService, never())
                 .setClassificationMetadata(any(PDDocument.class), anyString());
diff --git a/app/saas/src/main/resources/db/migration/saas/V39__drop_classification_labels.sql b/app/saas/src/main/resources/db/migration/saas/V39__drop_classification_labels.sql
new file mode 100644
index 0000000000..9ef97f9f99
--- /dev/null
+++ b/app/saas/src/main/resources/db/migration/saas/V39__drop_classification_labels.sql
@@ -0,0 +1,10 @@
+-- Classification labels are now a fixed, built-in set bundled with the app and sent to the engine
+-- per request (see ClassificationLabelProvider); the per-team classification_labels table (created
+-- in V30) is no longer read or written. Drop it.
+--
+-- Forward migration: V30 is kept so any DB that already applied it still validates. This runs after
+-- V30 in every case, so it drops the table whether V30 just created it (fresh DB) or it was created
+-- and populated on an earlier deploy. IF EXISTS only guards the edge case where the table is already
+-- absent, keeping the migration safe to apply regardless of prior state.
+
+DROP TABLE IF EXISTS classification_labels;
diff --git a/engine/src/stirling/agents/document_classifier.py b/engine/src/stirling/agents/document_classifier.py
index bb4ab5ef00..73d97595ed 100644
--- a/engine/src/stirling/agents/document_classifier.py
+++ b/engine/src/stirling/agents/document_classifier.py
@@ -116,8 +116,8 @@ class DocumentClassifierAgent:
         )
 
     async def classify(self, request: ClassifyDocumentRequest) -> ClassifyDocumentResponse:
-        # The caller (the backend) always supplies the allowed vocabulary — the
-        # team's stored labels — so the engine holds no vocabulary of its own.
+        # The caller (the backend) always supplies the allowed vocabulary — its
+        # fixed built-in label set — so the engine holds no vocabulary of its own.
         allowed = request.labels
         window = select_window(request.pages)
         prompt = self._build_prompt(request.file_name, allowed, window)
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index c182ce2b89..cb8b4d6fb7 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -3734,20 +3734,9 @@ uploadToServer = "Upload to server"
 versionHistory = "Version history"
 
 [fileSidebar.groupsModal]
-add = "Add"
-addLabel = "Add a label…"
-categoryIconAria = "Choose an icon for {{name}}"
-createCategory = "Create category"
-delete = "Delete category"
 done = "Done"
-hide = "Hide category"
-newCategory = "New category name…"
-removeLabel = "Remove {{name}}"
-rename = "Rename"
-reset = "Reset to defaults"
-search = "Search labels…"
-show = "Show category"
-subtitle = "Group your files into parent categories. Add existing or new labels to a category, rename it, or create your own. Files in none of your categories appear under “Other”."
+reset = "Show all"
+subtitle = "Show or hide categories in the files sidebar."
 title = "Sidebar categories"
 
 [filesPage]
@@ -6014,31 +6003,11 @@ summaryMore = "{{first}}, {{second}} and {{more}} more"
 summaryTwo = "{{first}} and {{second}}"
 
 [policies.labels]
-add = "Add"
-addPlaceholder = "Add a label…"
-customNote = "Customized for your team."
-defaultNote = "Using the built-in default, shared with your team."
-duplicate = "\"{{name}}\" already exists."
-edit = "Edit labels"
-empty = "No labels yet."
-export = "Export JSON"
-iconAria = "Choose an icon for {{name}}"
-import = "Import JSON"
-importError = "Couldn't import that file."
-managedNote = "Team labels are managed by your team leader."
-modalSubtitle = "Shared with your whole team. The classifier picks the labels that fit each document."
-modalTitle = "Classification labels"
-pickIcon = "Use {{label}} icon"
-removeAria = "Remove {{name}}"
-resetToDefault = "Reset to default"
-saveForTeam = "Save for team"
-saving = "Saving…"
-sectionLabel = "Classification labels"
-startFromScratch = "Start from scratch"
-teamCount = "team labels"
-tooLong = "Labels can be at most {{max}} characters."
-ungrouped = "Ungrouped"
-view = "View labels"
+categoryCount = "categories"
+hideCategory = "Hide category"
+labelCount = "labels"
+sharedNote = "These labels are built in and shared across your whole team."
+showCategory = "Show category"
 
 [policies.pii]
 account = "Account numbers (labelled)"
@@ -7451,6 +7420,11 @@ title = "Policies"
 [portal.policies.card]
 comingSoon = "Upgrade to Enterprise"
 notSetUp = "Not set up"
+requiresAiEngine = "Requires AI engine"
+
+[portal.policies.categories.classification]
+desc = "Identify each document's type on upload and tag its metadata for filing and search."
+label = "Classification"
 
 [portal.policies.categories.compliance]
 desc = "Enforce HIPAA, GDPR, SOC 2, or FedRAMP requirements on every document."
@@ -7475,6 +7449,13 @@ label = "Security"
 [portal.policies.config]
 scopeAll = "All documents"
 
+[portal.policies.config.classification]
+summary = "Classifies every uploaded document against your team's labels and tags its metadata."
+
+[portal.policies.config.classification.rules]
+0 = "Classify"
+1 = "Tag metadata"
+
 [portal.policies.config.compliance]
 summary = "Validates documents against regulatory frameworks before they leave the system."
 
@@ -7569,6 +7550,7 @@ title = "No activity yet"
 [portal.policies.endpoints]
 addWatermark = "Watermark"
 autoRedact = "Redact PII"
+classifyAndLabel = "Classify"
 compressPdf = "Compress"
 flatten = "Flatten"
 ocrPdf = "OCR"
@@ -7611,6 +7593,10 @@ continue = "Continue"
 enablePolicy = "Enable policy"
 saveChanges = "Save changes"
 
+[portal.policies.wizard.capability.classify]
+desc = "Identifies the document's type from your team's labels and tags it, so it files and searches by category."
+label = "Classify the document"
+
 [portal.policies.wizard.capability.compress]
 desc = "Compresses the document to a smaller file size."
 label = "Reduce file size"
@@ -7635,6 +7621,10 @@ label = "Strip active content"
 desc = "Stamps a visible mark (e.g. “Confidential”) across every page."
 label = "Apply a watermark"
 
+[portal.policies.wizard.classification]
+description = "Every uploaded document is classified against the built-in labels and tagged with the types that fit. The label set is shared across your whole team."
+labelsHeading = "Classification labels"
+
 [portal.policies.wizard.errors]
 noTools = "Enable at least one tool in the workflow first."
 saveFailed = "Couldn't save the policy. Please try again."
diff --git a/frontend/editor/src/core/components/policies/policyCategoryIcon.tsx b/frontend/editor/src/core/components/policies/policyCategoryIcon.tsx
new file mode 100644
index 0000000000..bf50c76037
--- /dev/null
+++ b/frontend/editor/src/core/components/policies/policyCategoryIcon.tsx
@@ -0,0 +1,36 @@
+// Shared source of truth for a policy category's outline icon, keyed by category
+// id (not a parallel icon-name vocabulary). Used by the editor's policy
+// definitions and the portal's catalogue cards, summaries, and setup wizard.
+
+import type { ReactNode } from "react";
+import type { SxProps, Theme } from "@mui/material";
+import LayersOutlinedIcon from "@mui/icons-material/LayersOutlined";
+import ShieldOutlinedIcon from "@mui/icons-material/ShieldOutlined";
+import LabelOutlinedIcon from "@mui/icons-material/LabelOutlined";
+import CheckCircleOutlinedIcon from "@mui/icons-material/CheckCircleOutlined";
+import AltRouteOutlinedIcon from "@mui/icons-material/AltRouteOutlined";
+import ScheduleOutlinedIcon from "@mui/icons-material/ScheduleOutlined";
+
+type MuiIcon = React.ComponentType<{ sx?: SxProps<Theme>; className?: string }>;
+
+/** Policy category id → outline glyph. */
+const POLICY_CATEGORY_ICONS: Record<string, MuiIcon> = {
+  ingestion: LayersOutlinedIcon,
+  security: ShieldOutlinedIcon,
+  classification: LabelOutlinedIcon,
+  compliance: CheckCircleOutlinedIcon,
+  routing: AltRouteOutlinedIcon,
+  retention: ScheduleOutlinedIcon,
+};
+
+const FALLBACK_ICON = LabelOutlinedIcon;
+
+// Defaults to inheriting the surrounding font-size so a wrapping box controls size.
+export function policyCategoryIcon(
+  categoryId: string,
+  sx: SxProps<Theme> = { fontSize: "inherit" },
+  className?: string,
+): ReactNode {
+  const Icon = POLICY_CATEGORY_ICONS[categoryId] ?? FALLBACK_ICON;
+  return <Icon sx={sx} className={className} />;
+}
diff --git a/frontend/editor/src/core/ui/LabelChip.css b/frontend/editor/src/core/ui/LabelChip.css
deleted file mode 100644
index 6be1332b0a..0000000000
--- a/frontend/editor/src/core/ui/LabelChip.css
+++ /dev/null
@@ -1,57 +0,0 @@
-/* Shared classification-label pill (team labels editor + sidebar category manager). */
-
-.sui-labelchip {
-  display: inline-flex;
-  align-items: center;
-  gap: var(--space-1);
-  padding: 0.2rem 0.3rem 0.2rem 0.25rem;
-  border: 1px solid var(--border-default);
-  border-radius: var(--radius-lg);
-  background: var(--color-surface);
-  max-width: 16rem;
-}
-
-.sui-labelchip-icon {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 1.5rem;
-  height: 1.5rem;
-  color: var(--color-text-2);
-}
-
-.sui-labelchip-name {
-  font-size: 0.8125rem;
-  color: var(--color-text-1);
-  white-space: nowrap;
-  overflow: hidden;
-  text-overflow: ellipsis;
-}
-
-.sui-labelchip-count {
-  font-size: 0.6875rem;
-  font-weight: 500;
-  color: var(--color-text-3);
-  padding-left: 0.1rem;
-}
-
-.sui-labelchip-remove {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 1.25rem;
-  height: 1.25rem;
-  border: none;
-  border-radius: 999px;
-  background: transparent;
-  color: var(--color-text-3);
-  cursor: pointer;
-  transition:
-    background var(--motion-fast),
-    color var(--motion-fast);
-}
-
-.sui-labelchip-remove:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-red);
-}
diff --git a/frontend/editor/src/core/ui/LabelChip.stories.tsx b/frontend/editor/src/core/ui/LabelChip.stories.tsx
deleted file mode 100644
index 79fc9b1be3..0000000000
--- a/frontend/editor/src/core/ui/LabelChip.stories.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { LabelChip } from "@app/ui/LabelChip";
-
-const meta: Meta<typeof LabelChip> = {
-  title: "Primitives/LabelChip",
-  component: LabelChip,
-  tags: ["autodocs"],
-  parameters: { layout: "centered" },
-  args: { label: "Invoice", icon: "receipt-long" },
-  argTypes: {
-    label: { control: "text" },
-    icon: { control: "text" },
-    count: { control: "number" },
-    onRemove: { action: "removed" },
-  },
-};
-export default meta;
-type Story = StoryObj<typeof LabelChip>;
-
-/** The classification-label pill shared by the labels editor and the sidebar category manager. */
-export const Playground: Story = {};
-
-/** With a file count, as shown in the sidebar category manager. */
-export const WithCount: Story = {
-  args: { label: "Contract", icon: "handshake", count: 12 },
-};
-
-/** Removable — the trailing × appears when `onRemove` is set. */
-export const Removable: Story = {
-  args: { label: "NDA", icon: "lock", onRemove: () => {} },
-};
-
-/** Falls back to the default "sell" icon when none is given. */
-export const DefaultIcon: Story = {
-  args: { label: "Uncategorised label", icon: undefined },
-};
-
-/** Long names truncate rather than overflow the pill. */
-export const LongName: Story = {
-  args: { label: "Memorandum of understanding and mutual agreement", count: 3 },
-};
-
-export const Row: Story = {
-  render: () => (
-    <div style={{ display: "flex", gap: 8, flexWrap: "wrap", maxWidth: 420 }}>
-      <LabelChip label="Invoice" icon="receipt-long" count={12} />
-      <LabelChip label="Contract" icon="handshake" onRemove={() => {}} />
-      <LabelChip label="Lab report" icon="science" count={2} />
-      <LabelChip label="Payslip" icon="payments" />
-    </div>
-  ),
-};
diff --git a/frontend/editor/src/core/ui/LabelChip.tsx b/frontend/editor/src/core/ui/LabelChip.tsx
deleted file mode 100644
index 7e45bc4a2a..0000000000
--- a/frontend/editor/src/core/ui/LabelChip.tsx
+++ /dev/null
@@ -1,60 +0,0 @@
-import type { ReactNode } from "react";
-import CloseIcon from "@mui/icons-material/Close";
-import { LocalIcon } from "@app/components/shared/LocalIcon";
-import "@app/ui/LabelChip.css";
-
-export interface LabelChipProps {
-  /** The label text. */
-  label: string;
-  /** Material Symbols key for a leading icon; ignored when `leading` is given. */
-  icon?: string;
-  /** Custom leading node (e.g. an icon picker), overriding `icon`. */
-  leading?: ReactNode;
-  /** Optional trailing count (e.g. how many files carry this label). */
-  count?: number;
-  /** Show a trailing `×`; called on click. */
-  onRemove?: () => void;
-  /** Accessible name for the remove button. */
-  removeAriaLabel?: string;
-}
-
-/**
- * A classification-label pill: leading icon (or a custom control like an icon
- * picker) + name, with an optional count and remove button. The shared look for
- * every place labels are shown as chips — the team labels editor and the
- * sidebar category manager both render this so they stay visually identical.
- */
-export function LabelChip({
-  label,
-  icon,
-  leading,
-  count,
-  onRemove,
-  removeAriaLabel,
-}: LabelChipProps) {
-  return (
-    <span className="sui-labelchip" role="listitem">
-      {leading ?? (
-        <span className="sui-labelchip-icon">
-          <LocalIcon icon={icon || "sell"} width="1rem" />
-        </span>
-      )}
-      <span className="sui-labelchip-name" title={label}>
-        {label}
-      </span>
-      {count != null && count > 0 && (
-        <span className="sui-labelchip-count">{count}</span>
-      )}
-      {onRemove && (
-        <button
-          type="button"
-          className="sui-labelchip-remove"
-          onClick={onRemove}
-          aria-label={removeAriaLabel ?? `Remove ${label}`}
-        >
-          <CloseIcon sx={{ fontSize: "0.85rem" }} />
-        </button>
-      )}
-    </span>
-  );
-}
diff --git a/frontend/editor/src/portal/api/policies.ts b/frontend/editor/src/portal/api/policies.ts
index bf6e4b395c..1e2087537c 100644
--- a/frontend/editor/src/portal/api/policies.ts
+++ b/frontend/editor/src/portal/api/policies.ts
@@ -56,11 +56,11 @@ export interface PolicyField {
 export interface PolicyCategory {
   id: string;
   label: string;
-  icon: string;
   tone: "neutral" | "blue" | "purple" | "green" | "amber" | "red";
   desc: string;
   providesClassification?: boolean;
   comingSoon?: boolean;
+  requiresAiEngine?: boolean;
 }
 
 export interface PolicyConfigDef {
@@ -133,14 +133,21 @@ export interface CatalogueEntry {
 /*  Endpoint display labels                                                   */
 /* ──────────────────────────────────────────────────────────────────────── */
 
-/** i18n keys keyed by {@link ToolEndpoint}; labels stored steps in the detail view. */
-export const ENDPOINT_LABELS: Partial<Record<ToolEndpoint, string>> = {
+/**
+ * i18n keys keyed by endpoint; labels stored steps in the detail view. Mostly
+ * {@link ToolEndpoint}s, plus the AI classify endpoint, which isn't part of the generated union.
+ */
+export const ENDPOINT_LABELS: Partial<
+  Record<ToolEndpoint | "/api/v1/ai/tools/classify-and-label", string>
+> = {
   "/api/v1/security/auto-redact": "portal.policies.endpoints.autoRedact",
   "/api/v1/security/sanitize-pdf": "portal.policies.endpoints.sanitizePdf",
   "/api/v1/security/add-watermark": "portal.policies.endpoints.addWatermark",
   "/api/v1/misc/ocr-pdf": "portal.policies.endpoints.ocrPdf",
   "/api/v1/misc/flatten": "portal.policies.endpoints.flatten",
   "/api/v1/misc/compress-pdf": "portal.policies.endpoints.compressPdf",
+  "/api/v1/ai/tools/classify-and-label":
+    "portal.policies.endpoints.classifyAndLabel",
 };
 
 export function humanizeEndpoint(
@@ -170,7 +177,6 @@ export const POLICY_CATEGORIES: PolicyCategory[] = [
   {
     id: "ingestion",
     label: "portal.policies.categories.ingestion.label",
-    icon: "layers",
     tone: "blue",
     desc: "portal.policies.categories.ingestion.desc",
     providesClassification: true,
@@ -179,14 +185,20 @@ export const POLICY_CATEGORIES: PolicyCategory[] = [
   {
     id: "security",
     label: "portal.policies.categories.security.label",
-    icon: "shield",
     tone: "purple",
     desc: "portal.policies.categories.security.desc",
   },
+  {
+    id: "classification",
+    label: "portal.policies.categories.classification.label",
+    tone: "blue",
+    desc: "portal.policies.categories.classification.desc",
+    providesClassification: true,
+    requiresAiEngine: true,
+  },
   {
     id: "compliance",
     label: "portal.policies.categories.compliance.label",
-    icon: "check",
     tone: "amber",
     desc: "portal.policies.categories.compliance.desc",
     comingSoon: true,
@@ -194,7 +206,6 @@ export const POLICY_CATEGORIES: PolicyCategory[] = [
   {
     id: "routing",
     label: "portal.policies.categories.routing.label",
-    icon: "route",
     tone: "green",
     desc: "portal.policies.categories.routing.desc",
     comingSoon: true,
@@ -202,7 +213,6 @@ export const POLICY_CATEGORIES: PolicyCategory[] = [
   {
     id: "retention",
     label: "portal.policies.categories.retention.label",
-    icon: "schedule",
     tone: "neutral",
     desc: "portal.policies.categories.retention.desc",
     comingSoon: true,
@@ -264,6 +274,16 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
     ],
     fields: [],
   },
+  classification: {
+    summary: "portal.policies.config.classification.summary",
+    rules: [
+      "portal.policies.config.classification.rules.0",
+      "portal.policies.config.classification.rules.1",
+    ],
+    scopeLabel: "portal.policies.config.scopeAll",
+    defaultOperations: [policyStep("classify")],
+    fields: [],
+  },
   compliance: {
     summary: "portal.policies.config.compliance.summary",
     rules: [
diff --git a/frontend/editor/src/portal/components/PolicySummary.tsx b/frontend/editor/src/portal/components/PolicySummary.tsx
index cffb822387..9be6ff49cf 100644
--- a/frontend/editor/src/portal/components/PolicySummary.tsx
+++ b/frontend/editor/src/portal/components/PolicySummary.tsx
@@ -15,7 +15,7 @@ import {
   type CatalogueEntry,
   type PoliciesResponse,
 } from "@portal/api/policies";
-import { policyIcon } from "@portal/components/policies/policyIcons";
+import { policyCategoryIcon } from "@app/components/policies/policyCategoryIcon";
 import "@portal/components/PolicySummary.css";
 
 /**
@@ -64,7 +64,7 @@ export function PolicySummary() {
       render: ({ entry }) => (
         <div className="portal-policysum__cat">
           <span className="portal-policysum__icon" aria-hidden>
-            {policyIcon(entry.category.icon)}
+            {policyCategoryIcon(entry.category.id)}
           </span>
           <div className="portal-policysum__cat-text">
             <strong>{t(entry.category.label)}</strong>
diff --git a/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.css b/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.css
new file mode 100644
index 0000000000..02f7bfdbf5
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.css
@@ -0,0 +1,53 @@
+/* Read-only classification-vocabulary viewer in the policy wizard. */
+.classification-summary {
+  display: flex;
+  flex-direction: column;
+  gap: var(--space-2);
+}
+.classification-summary-stats {
+  display: flex;
+  gap: var(--space-3);
+  font-size: 0.8125rem;
+  color: var(--color-text-2);
+}
+.classification-summary-note {
+  font-size: 0.75rem;
+  color: var(--color-text-3);
+}
+
+/* Expandable category → labels list. */
+.classification-categories {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+}
+.classification-category {
+  border-top: 1px solid var(--border-default);
+}
+.classification-category:last-child {
+  border-bottom: 1px solid var(--border-default);
+}
+.classification-category-header {
+  min-height: 2.5rem;
+}
+.classification-category-lead {
+  display: inline-flex;
+  align-items: center;
+  gap: var(--space-2);
+}
+.classification-category-name {
+  font-weight: 600;
+  font-size: 0.875rem;
+}
+.classification-category-count {
+  font-size: 0.75rem;
+  color: var(--color-text-3);
+}
+.classification-category-labels {
+  display: flex;
+  flex-wrap: wrap;
+  gap: var(--space-1_5);
+  padding: 0 var(--space-2) var(--space-2) 2rem;
+}
diff --git a/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.tsx b/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.tsx
new file mode 100644
index 0000000000..7a21cae2b7
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.tsx
@@ -0,0 +1,97 @@
+// Read-only view of the classification vocabulary shown in the policy wizard. The labels and their
+// categories are a fixed, built-in set shared across the whole team — there's nothing to edit, but
+// the full vocabulary is browsable: expand a category to see the labels it groups.
+
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown";
+import KeyboardArrowRightIcon from "@mui/icons-material/KeyboardArrowRight";
+import { Button, Card, Chip } from "@app/ui";
+import { LocalIcon } from "@app/components/shared/LocalIcon";
+import {
+  DEFAULT_CLASSIFICATION_LABELS,
+  LABEL_FAMILIES,
+} from "@app/data/classificationLabels";
+import "@portal/components/policies/ClassificationLabelsSection.css";
+
+export function ClassificationLabelsSection() {
+  const { t } = useTranslation();
+  const [expanded, setExpanded] = useState<ReadonlySet<string>>(new Set());
+
+  const toggle = (id: string) =>
+    setExpanded((prev) => {
+      const next = new Set(prev);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+
+  return (
+    <Card>
+      <div className="classification-summary">
+        <div className="classification-summary-stats">
+          <span>
+            <strong>{DEFAULT_CLASSIFICATION_LABELS.length}</strong>{" "}
+            {t("policies.labels.labelCount", "labels")}
+          </span>
+          <span>
+            <strong>{LABEL_FAMILIES.length}</strong>{" "}
+            {t("policies.labels.categoryCount", "categories")}
+          </span>
+        </div>
+
+        <ul className="classification-categories">
+          {LABEL_FAMILIES.map((family) => {
+            const open = expanded.has(family.id);
+            return (
+              <li key={family.id} className="classification-category">
+                <Button
+                  variant="quiet"
+                  fullWidth
+                  justify="between"
+                  className="classification-category-header"
+                  aria-expanded={open}
+                  onClick={() => toggle(family.id)}
+                  leftSection={
+                    <span className="classification-category-lead">
+                      {open ? (
+                        <KeyboardArrowDownIcon sx={{ fontSize: "1.1rem" }} />
+                      ) : (
+                        <KeyboardArrowRightIcon sx={{ fontSize: "1.1rem" }} />
+                      )}
+                      <LocalIcon icon={family.icon} width="1.1rem" />
+                      <span className="classification-category-name">
+                        {family.name}
+                      </span>
+                    </span>
+                  }
+                  rightSection={
+                    <span className="classification-category-count">
+                      {family.labels.length}
+                    </span>
+                  }
+                />
+                {open && (
+                  <div className="classification-category-labels">
+                    {family.labels.map((label) => (
+                      <Chip key={label.id} accent="neutral" size="sm">
+                        {t(`classification.labels.${label.id}`, label.name)}
+                      </Chip>
+                    ))}
+                  </div>
+                )}
+              </li>
+            );
+          })}
+        </ul>
+
+        <span className="classification-summary-note">
+          {t(
+            "policies.labels.sharedNote",
+            "These labels are built in and shared across your whole team.",
+          )}
+        </span>
+      </div>
+    </Card>
+  );
+}
diff --git a/frontend/editor/src/portal/components/policies/PolicyCategoryCard.tsx b/frontend/editor/src/portal/components/policies/PolicyCategoryCard.tsx
index 91abcd3f75..c5169217dd 100644
--- a/frontend/editor/src/portal/components/policies/PolicyCategoryCard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicyCategoryCard.tsx
@@ -1,19 +1,28 @@
 import { useTranslation } from "react-i18next";
 import { Card, Chip, StatusBadge } from "@app/ui";
 import type { CatalogueEntry } from "@portal/api/policies";
-import { policyIcon } from "@portal/components/policies/policyIcons";
+import { policyCategoryIcon } from "@app/components/policies/policyCategoryIcon";
 import "@portal/views/Policies.css";
 
 interface PolicyCategoryCardProps {
   entry: CatalogueEntry;
   onOpen: (entry: CatalogueEntry) => void;
+  /** Setup is unavailable (e.g. the AI engine is off): shown, but not openable. */
+  locked?: boolean;
+  /** Chip text explaining why setup is locked (e.g. "Requires AI engine"). */
+  lockedLabel?: string;
 }
 
-export function PolicyCategoryCard({ entry, onOpen }: PolicyCategoryCardProps) {
+export function PolicyCategoryCard({
+  entry,
+  onOpen,
+  locked = false,
+  lockedLabel,
+}: PolicyCategoryCardProps) {
   const { t } = useTranslation();
   const { category, config, policy } = entry;
   const comingSoon = category.comingSoon === true;
-  const openable = !comingSoon;
+  const openable = !comingSoon && !locked;
   const status = policy?.state.status;
   const enforces = config.rules.map((r) => t(r)).join(" · ");
 
@@ -21,7 +30,7 @@ export function PolicyCategoryCard({ entry, onOpen }: PolicyCategoryCardProps) {
     <Card
       className={
         "portal-policies__card" +
-        (comingSoon ? " portal-policies__card--locked" : "")
+        (comingSoon || locked ? " portal-policies__card--locked" : "")
       }
       interactive={openable}
       onClick={openable ? () => onOpen(entry) : undefined}
@@ -39,7 +48,7 @@ export function PolicyCategoryCard({ entry, onOpen }: PolicyCategoryCardProps) {
       }
     >
       <span className="portal-policies__cat-icon" aria-hidden>
-        {policyIcon(category.icon)}
+        {policyCategoryIcon(category.id)}
       </span>
 
       <div className="portal-policies__card-identity">
@@ -53,6 +62,10 @@ export function PolicyCategoryCard({ entry, onOpen }: PolicyCategoryCardProps) {
         <Chip accent="neutral" size="sm">
           {t("portal.policies.card.comingSoon")}
         </Chip>
+      ) : locked ? (
+        <Chip accent="neutral" size="sm">
+          {lockedLabel ?? t("portal.policies.card.requiresAiEngine")}
+        </Chip>
       ) : policy ? (
         <div className="portal-policies__card-meta">
           <span className="portal-policies__card-statpair">
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.stories.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.stories.tsx
index 01aaad2fc6..bf68a1ffe1 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.stories.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.stories.tsx
@@ -8,6 +8,9 @@ import {
 import { PolicySetupWizard } from "@portal/components/policies/PolicySetupWizard";
 
 const security = POLICY_CATEGORIES.find((c) => c.id === "security")!;
+const classification = POLICY_CATEGORIES.find(
+  (c) => c.id === "classification",
+)!;
 
 const meta: Meta<typeof PolicySetupWizard> = {
   title: "Portal/Policies/PolicySetupWizard",
@@ -47,3 +50,14 @@ export const Edit: Story = {
     },
   },
 };
+
+/** Classification: the workflow step shows the team label editor, not tool toggles. */
+export const Classification: Story = {
+  args: {
+    entry: {
+      category: classification,
+      config: POLICY_CONFIG.classification,
+      policy: null,
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
index 43be7ca17c..632e3f610c 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
@@ -1,5 +1,10 @@
-import { useMemo, useState } from "react";
+import { useMemo, useState, type ReactNode } from "react";
 import { useTranslation } from "react-i18next";
+import CheckIcon from "@mui/icons-material/Check";
+import EditOutlinedIcon from "@mui/icons-material/EditOutlined";
+import FolderOutlinedIcon from "@mui/icons-material/FolderOutlined";
+import CloudOutlinedIcon from "@mui/icons-material/CloudOutlined";
+import StorageOutlinedIcon from "@mui/icons-material/StorageOutlined";
 import {
   Banner,
   Button,
@@ -29,12 +34,27 @@ import {
 import { fetchSources } from "@portal/api/sources";
 import { useAsync } from "@portal/hooks/useAsync";
 import { PolicyFieldRow } from "@portal/components/policies/PolicyFieldRow";
-import { policyIcon } from "@portal/components/policies/policyIcons";
-import { sourceTypeMeta } from "@portal/components/sources/sourceTypes";
+import { policyCategoryIcon } from "@app/components/policies/policyCategoryIcon";
 import { PolicyRedactConfig } from "@app/components/policies/PolicyRedactConfig";
 import { PolicyWatermarkConfig } from "@app/components/policies/PolicyWatermarkConfig";
+import { ClassificationLabelsSection } from "@portal/components/policies/ClassificationLabelsSection";
 import "@portal/views/Policies.css";
 
+/** Outline icon for a source tile, keyed by the backend source `type`. */
+function sourceIcon(type: string): ReactNode {
+  const sx = { fontSize: "1.1rem" } as const;
+  switch (type) {
+    case "editor":
+      return <EditOutlinedIcon sx={sx} />;
+    case "folder":
+      return <FolderOutlinedIcon sx={sx} />;
+    case "s3":
+      return <CloudOutlinedIcon sx={sx} />;
+    default:
+      return <StorageOutlinedIcon sx={sx} />;
+  }
+}
+
 interface PolicySetupWizardProps {
   /** The category being configured, or null when closed. */
   entry: CatalogueEntry | null;
@@ -119,6 +139,13 @@ const CAPABILITY_META: Record<
     descKey: "portal.policies.wizard.capability.compress.desc",
     descEn: "Compresses the document to a smaller file size.",
   },
+  classify: {
+    labelKey: "portal.policies.wizard.capability.classify.label",
+    labelEn: "Classify the document",
+    descKey: "portal.policies.wizard.capability.classify.desc",
+    descEn:
+      "Identifies the document's type from your team's labels and tags it, so it files and searches by category.",
+  },
 };
 
 function seedTools(entry: CatalogueEntry): ToolState[] {
@@ -179,9 +206,18 @@ function PolicySetupWizardBody({
 
   const { category, config, policy } = entry;
   const isEdit = policy != null;
+  const isClassification = category.id === "classification";
 
   const [step, setStep] = useState<Step>("workflow");
-  const [tools, setTools] = useState<ToolState[]>(() => seedTools(entry));
+  const [tools, setTools] = useState<ToolState[]>(() => {
+    const seeded = seedTools(entry);
+    // Classification's single tool has no toggle in the workflow step, so keep it
+    // enabled unconditionally — otherwise editing a policy whose saved steps
+    // somehow lack it would strand submit with no way to re-enable it.
+    return isClassification
+      ? seeded.map((t) => ({ ...t, enabled: true }))
+      : seeded;
+  });
   const [fieldValues, setFieldValues] = useState(() =>
     resolveFieldValues(entry),
   );
@@ -190,11 +226,25 @@ function PolicySetupWizardBody({
   );
 
   const sourcesAsync = useAsync(() => fetchSources(), []);
-  const availableSources = useMemo(
-    () =>
-      (sourcesAsync.data?.sources ?? []).filter((s) => s.status !== "disabled"),
-    [sourcesAsync.data],
-  );
+  const availableSources = useMemo(() => {
+    const backendSources = (sourcesAsync.data?.sources ?? []).filter(
+      (s) => s.status !== "disabled",
+    );
+    // The editor is always an available source. The backend now returns it as a
+    // virtual source too, so take that when present (avoids a duplicate tile) and
+    // otherwise fall back to a synthetic one; keep it first, selected by default.
+    const editorSource = backendSources.find((s) => s.id === "editor") ?? {
+      id: "editor",
+      name: t("portal.sources.types.editor.label"),
+      type: "editor",
+      status: "active" as const,
+      referenceCount: 0,
+      referencingPolicies: [],
+      config: [],
+      docsTotal: null,
+    };
+    return [editorSource, ...backendSources.filter((s) => s.id !== "editor")];
+  }, [sourcesAsync.data, t]);
   // Document-type scoping has no UI; preserve any saved scope on edit and
   // default new policies to all document types.
   const [scopeTypes] = useState<string[]>(policy?.state.scopeTypes ?? []);
@@ -285,7 +335,7 @@ function PolicySetupWizardBody({
       title={
         <span className="portal-policies__wizard-title">
           <span className="portal-policies__cat-icon" aria-hidden>
-            {policyIcon(category.icon)}
+            {policyCategoryIcon(category.id)}
           </span>
           {isEdit
             ? t("portal.policies.wizard.title.edit", {
@@ -349,7 +399,25 @@ function PolicySetupWizardBody({
         />
       )}
 
-      {step === "workflow" && (
+      {step === "workflow" && isClassification && (
+        <div className="portal-policies__wizard-section">
+          <p className="portal-policies__wizard-desc">
+            {t(
+              "portal.policies.wizard.classification.description",
+              "Every uploaded document is classified against the built-in labels and tagged with the types that fit. The label set is shared across your whole team.",
+            )}
+          </p>
+          <h3 className="portal-policies__wizard-heading">
+            {t(
+              "portal.policies.wizard.classification.labelsHeading",
+              "Classification labels",
+            )}
+          </h3>
+          <ClassificationLabelsSection />
+        </div>
+      )}
+
+      {step === "workflow" && !isClassification && (
         <div className="portal-policies__wizard-section">
           <p className="portal-policies__wizard-desc">
             {t(
@@ -448,35 +516,38 @@ function PolicySetupWizardBody({
             // The backend always returns the editor as a virtual source, so the
             // loaded list is never empty - no "no sources" state exists.
             <div className="portal-policies__sources">
-              {availableSources.map((src) => (
-                // A selectable multi-line tile (icon + name + type + check).
-                // Uses the shared Button (raw <button> is lint-banned); the tile
-                // CSS overrides the Button's fixed height for the two-line layout.
-                <Button
-                  key={src.id}
-                  variant="quiet"
-                  justify="start"
-                  className={
-                    "portal-policies__source" +
-                    (sources.includes(src.id)
-                      ? " portal-policies__source--on"
-                      : "")
-                  }
-                  onClick={() => toggleSource(src.id)}
-                >
-                  <span className="portal-policies__source-icon" aria-hidden>
-                    {sourceTypeMeta(src.type).icon}
-                  </span>
-                  <span className="portal-policies__source-text">
+              {availableSources.map((src) => {
+                const on = sources.includes(src.id);
+                return (
+                  <Button
+                    key={src.id}
+                    variant={on ? "secondary" : "quiet"}
+                    justify="between"
+                    fullWidth
+                    className={
+                      "portal-policies__source" +
+                      (on ? " portal-policies__source--on" : "")
+                    }
+                    // The check keeps its slot when unselected (hidden) so the
+                    // icon + name stay put whether or not the tile is selected.
+                    rightSection={
+                      <CheckIcon
+                        sx={{
+                          fontSize: "1.1rem",
+                          visibility: on ? "visible" : "hidden",
+                        }}
+                      />
+                    }
+                    onClick={() => toggleSource(src.id)}
+                    aria-pressed={on}
+                  >
                     <span className="portal-policies__source-label">
+                      {sourceIcon(src.type)}
                       {src.name}
                     </span>
-                    <span className="portal-policies__source-desc">
-                      {src.type}
-                    </span>
-                  </span>
-                </Button>
-              ))}
+                  </Button>
+                );
+              })}
             </div>
           )}
 
diff --git a/frontend/editor/src/portal/components/policies/policyIcons.ts b/frontend/editor/src/portal/components/policies/policyIcons.ts
deleted file mode 100644
index 5ab6113b49..0000000000
--- a/frontend/editor/src/portal/components/policies/policyIcons.ts
+++ /dev/null
@@ -1,25 +0,0 @@
-/**
- * Glyphs for the policy catalogue's string icon keys. The catalogue model
- * carries semantic keys (e.g. "shield", "layers") rather than React nodes so
- * the data stays portable; the portal owns the rendering and maps each key to a
- * glyph here.
- */
-export const POLICY_ICON_GLYPHS: Record<string, string> = {
-  layers: "▤",
-  shield: "🛡",
-  check: "✓",
-  route: "⇉",
-  clock: "⏲",
-  // Source icons.
-  file: "▢",
-  device: "▣",
-  globe: "◍",
-  cloud: "☁",
-  mail: "✉",
-  folder: "▤",
-};
-
-/** Resolve an icon key to its glyph, falling back to a neutral dot. */
-export function policyIcon(key: string): string {
-  return POLICY_ICON_GLYPHS[key] ?? "•";
-}
diff --git a/frontend/editor/src/portal/hooks/useAiEngineEnabled.ts b/frontend/editor/src/portal/hooks/useAiEngineEnabled.ts
new file mode 100644
index 0000000000..9fe76a19fa
--- /dev/null
+++ b/frontend/editor/src/portal/hooks/useAiEngineEnabled.ts
@@ -0,0 +1,26 @@
+// AI-engine flag from the backend's public app-config. Gates Classification
+// setup: the card always shows but can't be enabled until the engine is on.
+// `loading` lets callers hold the decision rather than flash a locked card.
+
+import { apiClient } from "@portal/api/http";
+import { useAsync } from "@portal/hooks/useAsync";
+
+interface AppConfigShape {
+  aiEngineEnabled?: boolean;
+}
+
+export interface AiEngineState {
+  enabled: boolean;
+  loading: boolean;
+}
+
+export function useAiEngineEnabled(): AiEngineState {
+  const state = useAsync<AppConfigShape>(
+    () => apiClient.local.json<AppConfigShape>("/api/v1/config/app-config"),
+    [],
+  );
+  return {
+    enabled: Boolean(state.data?.aiEngineEnabled),
+    loading: state.loading && state.data === null,
+  };
+}
diff --git a/frontend/editor/src/portal/mocks/handlers/classification.ts b/frontend/editor/src/portal/mocks/handlers/classification.ts
new file mode 100644
index 0000000000..c41ae9a254
--- /dev/null
+++ b/frontend/editor/src/portal/mocks/handlers/classification.ts
@@ -0,0 +1,10 @@
+import { http, HttpResponse } from "msw";
+
+// The Classification policy only needs the app-config `aiEngineEnabled` flag to be
+// on; its label vocabulary is a fixed built-in set (no team endpoint anymore).
+
+export const classificationHandlers = [
+  http.get("/api/v1/config/app-config", () =>
+    HttpResponse.json({ aiEngineEnabled: true }),
+  ),
+];
diff --git a/frontend/editor/src/portal/mocks/handlers/index.ts b/frontend/editor/src/portal/mocks/handlers/index.ts
index 52e8ab75b9..2e50a14eb1 100644
--- a/frontend/editor/src/portal/mocks/handlers/index.ts
+++ b/frontend/editor/src/portal/mocks/handlers/index.ts
@@ -12,6 +12,7 @@ import { usersHandlers } from "@portal/mocks/handlers/users";
 import { teamSaasHandlers } from "@portal/mocks/handlers/teamSaas";
 import { agentsHandlers } from "@portal/mocks/handlers/agents";
 import { policiesHandlers } from "@portal/mocks/handlers/policies";
+import { classificationHandlers } from "@portal/mocks/handlers/classification";
 import { documentsHandlers } from "@portal/mocks/handlers/documents";
 import { sdkComponentsHandlers } from "@portal/mocks/handlers/sdkComponents";
 import { editorDeployHandlers } from "@portal/mocks/handlers/editorDeploy";
@@ -32,6 +33,7 @@ export const handlers = [
   ...teamSaasHandlers,
   ...agentsHandlers,
   ...policiesHandlers,
+  ...classificationHandlers,
   ...documentsHandlers,
   ...sdkComponentsHandlers,
   ...editorDeployHandlers,
diff --git a/frontend/editor/src/portal/views/Policies.css b/frontend/editor/src/portal/views/Policies.css
index 75adbc6a85..021e48d76c 100644
--- a/frontend/editor/src/portal/views/Policies.css
+++ b/frontend/editor/src/portal/views/Policies.css
@@ -266,116 +266,23 @@
 }
 
 /* Sources picker */
+/* Selectable source tiles: a vertical stack of full-width shared Buttons
+   (icon · name · check). Layout is the Button's own leftSection/label/
+   rightSection — only the selected border/tint is added here. */
 .portal-policies__sources {
-  display: grid;
-  grid-template-columns: repeat(2, 1fr);
-  gap: 0.5rem;
-}
-
-@media (max-width: 40rem) {
-  .portal-policies__sources {
-    grid-template-columns: 1fr;
-  }
-}
-
-.portal-policies__source {
   display: flex;
-  align-items: center;
+  flex-direction: column;
   gap: 0.5rem;
-  padding: 0.625rem;
-  text-align: left;
-  background: var(--color-surface);
-  border: 1.5px solid var(--color-border);
-  border-radius: var(--radius-md);
-  cursor: pointer;
-  /* Shared Button pins a fixed control height and natural width; this tile is a
-     full-width, two-line card, so fill the grid cell and grow to fit content. */
-  width: 100%;
-  height: auto;
-  font-weight: inherit;
-  transition:
-    border-color var(--motion-fast),
-    background var(--motion-fast);
-}
-
-/* The shared Button wraps children in an inner/label node. Let the inner grow
-   (so the ::after check sits at the far right) and the label carry the
-   icon + two-line-text row. */
-.portal-policies__source .mantine-Button-inner {
-  flex: 1;
-  min-width: 0;
-}
-
-.portal-policies__source .mantine-Button-label {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-  width: 100%;
-  white-space: normal;
-}
-
-.portal-policies__source::after {
-  content: "";
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  flex-shrink: 0;
-  margin-left: auto;
-  width: 1rem;
-  height: 1rem;
-  border-radius: var(--radius-sm);
-  border: 1.5px solid var(--color-border-strong);
-  transition:
-    border-color var(--motion-fast),
-    background var(--motion-fast);
-}
-
-.portal-policies__source:hover {
-  background: var(--color-bg-hover);
 }
 
 .portal-policies__source--on {
   border-color: var(--color-blue);
-  background: var(--color-blue-light);
-}
-
-.portal-policies__source--on::after {
-  content: "✓";
-  font-size: 0.6875rem;
-  font-weight: 700;
-  color: #fff;
-  border-color: var(--color-blue);
-  background: var(--color-blue);
-}
-
-.portal-policies__source-icon {
-  font-size: 1rem;
-  line-height: 1.2;
-  flex-shrink: 0;
-  color: var(--color-text-3);
-}
-
-.portal-policies__source--on .portal-policies__source-icon {
-  color: var(--color-blue);
-}
-
-.portal-policies__source-text {
-  display: flex;
-  flex-direction: column;
-  gap: 0.0625rem;
-  min-width: 0;
 }
 
 .portal-policies__source-label {
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-policies__source-desc {
-  font-size: 0.6875rem;
-  color: var(--color-text-4);
-  line-height: 1.4;
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5rem;
 }
 
 .portal-policies__link {
diff --git a/frontend/editor/src/portal/views/Policies.tsx b/frontend/editor/src/portal/views/Policies.tsx
index 8d58ed0e79..a4ffcf1067 100644
--- a/frontend/editor/src/portal/views/Policies.tsx
+++ b/frontend/editor/src/portal/views/Policies.tsx
@@ -20,6 +20,7 @@ import { CatalogueSummary } from "@portal/components/policies/CatalogueSummary";
 import { PolicyCategoryCard } from "@portal/components/policies/PolicyCategoryCard";
 import { PolicyDetailPanel } from "@portal/components/policies/PolicyDetailPanel";
 import { PolicySetupWizard } from "@portal/components/policies/PolicySetupWizard";
+import { useAiEngineEnabled } from "@portal/hooks/useAiEngineEnabled";
 import "@portal/views/Policies.css";
 
 export function Policies() {
@@ -34,6 +35,18 @@ export function Policies() {
   const [busy, setBusy] = useState(false);
   const [pageError, setPageError] = useState<string | null>(null);
 
+  const { enabled: aiEngineEnabled, loading: aiEngineLoading } =
+    useAiEngineEnabled();
+
+  function isLocked(entry: CatalogueEntry): boolean {
+    return (
+      entry.category.requiresAiEngine === true &&
+      !aiEngineEnabled &&
+      !aiEngineLoading &&
+      !entry.policy
+    );
+  }
+
   const catalogue = data?.catalogue ?? [];
   const refetch = useCallback(() => setVersion((v) => v + 1), []);
   // The catalogue cards are always shown (they're the "configure a policy" CTAs),
@@ -57,6 +70,11 @@ export function Policies() {
         }));
 
   function openEntry(entry: CatalogueEntry) {
+    // Block setup of an AI-required policy until the engine is confirmed on (so a
+    // click during the app-config load can't open a wizard for a disabled
+    // feature); a configured policy stays openable so it can be paused/deleted.
+    if (entry.category.requiresAiEngine && !aiEngineEnabled && !entry.policy)
+      return;
     if (entry.policy) setDetail(entry);
     else setWizard(entry);
   }
@@ -157,6 +175,8 @@ export function Policies() {
               key={entry.category.id}
               entry={entry}
               onOpen={openEntry}
+              locked={isLocked(entry)}
+              lockedLabel={t("portal.policies.card.requiresAiEngine")}
             />
           ))}
         </div>
diff --git a/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.css b/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.css
new file mode 100644
index 0000000000..b967707164
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.css
@@ -0,0 +1,37 @@
+/* Category show/hide list (Files-sidebar visibility picker). */
+.category-visibility {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+}
+.category-visibility-row {
+  display: flex;
+  align-items: center;
+  gap: var(--space-2);
+  min-height: 2.25rem;
+  padding: 0 var(--space-1);
+}
+.category-visibility-icon {
+  display: inline-flex;
+  align-items: center;
+  flex: none;
+  color: var(--color-text-2);
+}
+.category-visibility-name {
+  flex: 1;
+  min-width: 0;
+  font-size: 0.875rem;
+  color: var(--color-text-1);
+}
+.category-visibility-count {
+  font-size: 0.75rem;
+  color: var(--color-text-3);
+}
+/* Hidden categories read as dimmed until re-shown. */
+.category-visibility-row--hidden .category-visibility-icon,
+.category-visibility-row--hidden .category-visibility-name,
+.category-visibility-row--hidden .category-visibility-count {
+  opacity: 0.5;
+}
diff --git a/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.stories.tsx b/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.stories.tsx
new file mode 100644
index 0000000000..43f8cd5ee2
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.stories.tsx
@@ -0,0 +1,46 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ClassificationCategoryManager } from "@app/components/policies/ClassificationCategoryManager";
+import type { SidebarCategory } from "@app/services/fileSidebarCategories";
+
+const CATEGORIES: SidebarCategory[] = [
+  { id: "finance", name: "Financial", icon: "payments", labelKeys: [] },
+  { id: "legal", name: "Legal", icon: "gavel", labelKeys: [] },
+  { id: "hr", name: "HR", icon: "badge", labelKeys: [] },
+  { id: "reports", name: "Reports", icon: "monitoring", labelKeys: [] },
+];
+
+const COUNTS = new Map<string, number>([
+  ["finance", 12],
+  ["legal", 4],
+  ["reports", 7],
+]);
+
+// The store is device-local; the story holds the hidden state so the toggle is live.
+function Harness() {
+  const [categories, setCategories] = useState(CATEGORIES);
+  return (
+    <div style={{ maxWidth: 420 }}>
+      <ClassificationCategoryManager
+        categories={categories}
+        counts={COUNTS}
+        onToggleHidden={(id, hidden) =>
+          setCategories((prev) =>
+            prev.map((c) => (c.id === id ? { ...c, hidden } : c)),
+          )
+        }
+      />
+    </div>
+  );
+}
+
+const meta: Meta<typeof Harness> = {
+  title: "Policies/ClassificationCategoryManager",
+  component: Harness,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof Harness>;
+
+/** Show/hide the fixed, shared categories in the Files sidebar. */
+export const Default: Story = {};
diff --git a/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.tsx b/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.tsx
new file mode 100644
index 0000000000..143e344f82
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.tsx
@@ -0,0 +1,68 @@
+// Uber-simple category visibility list for the Files sidebar. Categories are the fixed, shared set
+// (the built-in label families) — they can't be created, renamed, re-grouped, or have their labels
+// edited. The only choice is showing or hiding each one in this device's sidebar; a hidden category
+// forms no group, so its files fall to "Other".
+
+import { useTranslation } from "react-i18next";
+import VisibilityIcon from "@mui/icons-material/Visibility";
+import VisibilityOffIcon from "@mui/icons-material/VisibilityOff";
+import { ActionIcon } from "@app/ui/ActionIcon";
+import { LocalIcon } from "@app/components/shared/LocalIcon";
+import type { SidebarCategory } from "@app/services/fileSidebarCategories";
+import "@app/components/policies/ClassificationCategoryManager.css";
+
+interface ClassificationCategoryManagerProps {
+  categories: SidebarCategory[];
+  onToggleHidden: (id: string, hidden: boolean) => void;
+  /** Optional per-category file counts. */
+  counts?: Map<string, number>;
+}
+
+export function ClassificationCategoryManager({
+  categories,
+  onToggleHidden,
+  counts,
+}: ClassificationCategoryManagerProps) {
+  const { t } = useTranslation();
+  return (
+    <ul className="category-visibility">
+      {categories.map((category) => {
+        const count = counts?.get(category.id);
+        return (
+          <li
+            key={category.id}
+            className={
+              category.hidden
+                ? "category-visibility-row category-visibility-row--hidden"
+                : "category-visibility-row"
+            }
+          >
+            <span className="category-visibility-icon">
+              <LocalIcon icon={category.icon} width="1.1rem" />
+            </span>
+            <span className="category-visibility-name">{category.name}</span>
+            {count !== undefined && (
+              <span className="category-visibility-count">{count}</span>
+            )}
+            <ActionIcon
+              variant="quiet"
+              aria-pressed={!category.hidden}
+              aria-label={
+                category.hidden
+                  ? t("policies.labels.showCategory", "Show category")
+                  : t("policies.labels.hideCategory", "Hide category")
+              }
+              onClick={() => onToggleHidden(category.id, !category.hidden)}
+            >
+              {category.hidden ? (
+                <VisibilityOffIcon sx={{ fontSize: "1.1rem" }} />
+              ) : (
+                <VisibilityIcon sx={{ fontSize: "1.1rem" }} />
+              )}
+            </ActionIcon>
+          </li>
+        );
+      })}
+    </ul>
+  );
+}
diff --git a/frontend/editor/src/proprietary/components/policies/ClassificationLabelsSection.tsx b/frontend/editor/src/proprietary/components/policies/ClassificationLabelsSection.tsx
deleted file mode 100644
index 82e1705196..0000000000
--- a/frontend/editor/src/proprietary/components/policies/ClassificationLabelsSection.tsx
+++ /dev/null
@@ -1,176 +0,0 @@
-/**
- * The Classification policy's team-labels control, shown in its Edit-Settings
- * view: a compact summary (count + chips) with an Expand button that opens the
- * fat {@link LabelsEditorModal}. Team-shared; only users who can configure
- * policies may edit it. Owns the editable draft and the load/save/import/export
- * wiring via {@link useClassificationLabels}.
- */
-
-import { useEffect, useMemo, useState } from "react";
-import { useTranslation } from "react-i18next";
-import OpenInFullIcon from "@mui/icons-material/OpenInFull";
-import LockOutlinedIcon from "@mui/icons-material/LockOutlined";
-import { Card } from "@app/ui/Card";
-import { Button } from "@app/ui/Button";
-import { Chip } from "@app/ui/Chip";
-import { Banner } from "@app/ui/Banner";
-import { useClassificationLabels } from "@app/hooks/useClassificationLabels";
-import { LabelsEditorModal } from "@app/components/policies/LabelsEditorModal";
-import {
-  downloadLabels,
-  parseLabelsFile,
-  validateLabels,
-} from "@app/services/labelsFile";
-import {
-  DEFAULT_CLASSIFICATION_LABELS,
-  type ClassificationLabel,
-} from "@app/data/classificationLabels";
-import "@app/components/policies/LabelsEditor.css";
-
-/** Chips shown in the collapsed team summary before it gets noisy. */
-const SUMMARY_CHIP_COUNT = 12;
-
-interface ClassificationLabelsSectionProps {
-  canConfigure: boolean;
-}
-
-export function ClassificationLabelsSection({
-  canConfigure,
-}: ClassificationLabelsSectionProps) {
-  const { t } = useTranslation();
-  const { teamLabels, isCustom, loading, saving, error, saveTeam } =
-    useClassificationLabels(true);
-
-  const [draft, setDraft] = useState<ClassificationLabel[]>(teamLabels);
-  const [open, setOpen] = useState(false);
-  const [localError, setLocalError] = useState<string | null>(null);
-
-  // Sync the draft to server truth whenever it changes (load / save / reset).
-  // Local edits don't change `teamLabels`, so this never clobbers them mid-edit.
-  useEffect(() => setDraft(teamLabels), [teamLabels]);
-
-  const dirty = useMemo(
-    () => JSON.stringify(draft) !== JSON.stringify(teamLabels),
-    [draft, teamLabels],
-  );
-
-  const close = () => {
-    setDraft(teamLabels);
-    setLocalError(null);
-    setOpen(false);
-  };
-
-  const onImportFile = (file: File) => {
-    setLocalError(null);
-    void parseLabelsFile(file)
-      .then(setDraft)
-      .catch((e: unknown) =>
-        setLocalError(
-          e instanceof Error
-            ? e.message
-            : t("policies.labels.importError", "Couldn't import that file."),
-        ),
-      );
-  };
-
-  const onSave = () => {
-    const errors = validateLabels({ labels: draft });
-    if (errors.length > 0) {
-      setLocalError(errors[0]);
-      return;
-    }
-    setLocalError(null);
-    void saveTeam(draft).then(() => setOpen(false));
-  };
-
-  return (
-    <div className="labels-summary">
-      <p className="pol-section-label">
-        {t("policies.labels.sectionLabel", "Classification labels")}
-      </p>
-      <Card>
-        {loading ? (
-          <span className="labels-empty">{t("loading", "Loading…")}</span>
-        ) : (
-          <div className="labels-summary">
-            <div className="labels-summary-stats">
-              <span>
-                <strong>{teamLabels.length}</strong>{" "}
-                {t("policies.labels.teamCount", "team labels")}
-              </span>
-            </div>
-            <div className="labels-chips">
-              {teamLabels.slice(0, SUMMARY_CHIP_COUNT).map((label) => (
-                <Chip key={label.id} accent="neutral" size="sm">
-                  {label.name}
-                </Chip>
-              ))}
-              {teamLabels.length > SUMMARY_CHIP_COUNT && (
-                <Chip accent="neutral" size="sm">
-                  +{teamLabels.length - SUMMARY_CHIP_COUNT}
-                </Chip>
-              )}
-            </div>
-            <span className="labels-summary-note">
-              {isCustom
-                ? t("policies.labels.customNote", "Customized for your team.")
-                : t(
-                    "policies.labels.defaultNote",
-                    "Using the built-in default, shared with your team.",
-                  )}
-            </span>
-            <Button
-              variant="secondary"
-              size="sm"
-              leftSection={<OpenInFullIcon sx={{ fontSize: "1rem" }} />}
-              onClick={() => setOpen(true)}
-              style={{ alignSelf: "flex-start" }}
-            >
-              {canConfigure
-                ? t("policies.labels.edit", "Edit labels")
-                : t("policies.labels.view", "View labels")}
-            </Button>
-          </div>
-        )}
-      </Card>
-
-      {!canConfigure && (
-        <Banner
-          tone="neutral"
-          icon={<LockOutlinedIcon sx={{ fontSize: "1rem" }} />}
-          description={t(
-            "policies.labels.managedNote",
-            "Team labels are managed by your team leader.",
-          )}
-        />
-      )}
-
-      {error && !open && <Banner tone="danger" description={error} />}
-
-      <LabelsEditorModal
-        open={open}
-        onClose={close}
-        draft={draft}
-        onDraftChange={setDraft}
-        onImportFile={onImportFile}
-        onExport={() => downloadLabels(draft)}
-        onReset={() => {
-          // Stage the built-in default into the draft — reversible via Cancel,
-          // only persisted on Save (no immediate destructive server delete).
-          setLocalError(null);
-          setDraft(DEFAULT_CLASSIFICATION_LABELS);
-        }}
-        onClear={() => {
-          // Stage an empty list to build from scratch — also reversible until Save.
-          setLocalError(null);
-          setDraft([]);
-        }}
-        onSave={onSave}
-        dirty={dirty}
-        saving={saving}
-        readOnly={!canConfigure}
-        error={localError ?? error}
-      />
-    </div>
-  );
-}
diff --git a/frontend/editor/src/proprietary/components/policies/LabelIconPicker.tsx b/frontend/editor/src/proprietary/components/policies/LabelIconPicker.tsx
deleted file mode 100644
index a1ee0894d8..0000000000
--- a/frontend/editor/src/proprietary/components/policies/LabelIconPicker.tsx
+++ /dev/null
@@ -1,92 +0,0 @@
-/**
- * Small popover picker for a classification label's icon: a trigger button
- * showing the current icon, opening a grid of the curated
- * {@link LABEL_ICON_OPTIONS}. Icons render via {@link LocalIcon} (Material
- * Symbols). No search yet — the palette is small enough to scan.
- */
-
-import { useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Popover, SimpleGrid, Tooltip } from "@mantine/core";
-import { ActionIcon } from "@app/ui/ActionIcon";
-import { LocalIcon } from "@app/components/shared/LocalIcon";
-import { Z_INDEX_AUTOMATE_DROPDOWN } from "@app/styles/zIndex";
-import { LABEL_ICON_OPTIONS, DEFAULT_LABEL_ICON } from "@app/data/labelIcons";
-
-interface LabelIconPickerProps {
-  /** Current icon key, or undefined to show the default placeholder. */
-  value?: string;
-  onChange: (icon: string) => void;
-  ariaLabel: string;
-}
-
-export function LabelIconPicker({
-  value,
-  onChange,
-  ariaLabel,
-}: LabelIconPickerProps) {
-  const { t } = useTranslation();
-  const [open, setOpen] = useState(false);
-
-  return (
-    <Popover
-      opened={open}
-      onChange={setOpen}
-      onDismiss={() => setOpen(false)}
-      position="bottom-start"
-      withArrow
-      trapFocus
-      withinPortal
-      zIndex={Z_INDEX_AUTOMATE_DROPDOWN}
-    >
-      <Popover.Target>
-        <ActionIcon
-          variant="quiet"
-          className="labels-icon-pick"
-          onClick={() => setOpen((o) => !o)}
-          aria-label={ariaLabel}
-          aria-haspopup="true"
-        >
-          <LocalIcon icon={value || DEFAULT_LABEL_ICON} width="1.15rem" />
-        </ActionIcon>
-      </Popover.Target>
-      <Popover.Dropdown p="xs" style={{ maxHeight: 280, overflowY: "auto" }}>
-        <SimpleGrid cols={10} spacing={4} verticalSpacing={4}>
-          {LABEL_ICON_OPTIONS.map((option) => {
-            const iconLabel = t(
-              `policies.labels.iconName.${option.icon}`,
-              option.label,
-            );
-            return (
-              <Tooltip
-                key={option.icon}
-                label={iconLabel}
-                withArrow
-                openDelay={300}
-              >
-                <ActionIcon
-                  variant="quiet"
-                  className={`labels-icon-option${option.icon === value ? " is-selected" : ""}`}
-                  onClick={() => {
-                    onChange(option.icon);
-                    setOpen(false);
-                  }}
-                  aria-label={t(
-                    "policies.labels.pickIcon",
-                    "Use {{label}} icon",
-                    {
-                      label: iconLabel,
-                    },
-                  )}
-                  aria-pressed={option.icon === value}
-                >
-                  <LocalIcon icon={option.icon} width="1.25rem" />
-                </ActionIcon>
-              </Tooltip>
-            );
-          })}
-        </SimpleGrid>
-      </Popover.Dropdown>
-    </Popover>
-  );
-}
diff --git a/frontend/editor/src/proprietary/components/policies/LabelsEditor.css b/frontend/editor/src/proprietary/components/policies/LabelsEditor.css
deleted file mode 100644
index 20e8cb32cc..0000000000
--- a/frontend/editor/src/proprietary/components/policies/LabelsEditor.css
+++ /dev/null
@@ -1,183 +0,0 @@
-/* Classification-labels editor: add box, chip grid, icon picker, and the
-   summary/modal chrome around them. */
-
-.labels-editor {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-2);
-  min-height: 0;
-}
-
-/* ---- Add box ---- */
-.labels-add {
-  display: flex;
-  align-items: center;
-  gap: var(--space-2);
-}
-.labels-add-input {
-  flex: 1;
-  min-width: 0;
-  padding: 0.4rem 0.6rem;
-  font-size: 0.8125rem;
-  font-family: inherit;
-  color: var(--color-text-1);
-  background: var(--color-surface);
-  border: 1px solid var(--border-default);
-  border-radius: var(--radius-md);
-  outline: none;
-  transition: border-color var(--motion-fast);
-}
-.labels-add-input:focus {
-  border-color: var(--color-blue);
-}
-.labels-add-error {
-  margin: 0;
-  font-size: 0.75rem;
-  color: var(--color-red);
-}
-.labels-empty {
-  margin: 0;
-  font-size: 0.8125rem;
-  color: var(--color-text-3);
-}
-
-/* ---- Chip grid (chips themselves are the shared @app/ui/LabelChip) ---- */
-.labels-chips {
-  display: flex;
-  flex-wrap: wrap;
-  gap: var(--space-1_5);
-  overflow-y: auto;
-  min-height: 0;
-}
-
-/* ---- Icon picker (trigger + popover options) ---- */
-.labels-icon-pick {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  flex: none;
-  width: 1.5rem;
-  height: 1.5rem;
-  border: none;
-  border-radius: var(--radius-md);
-  background: transparent;
-  color: var(--color-text-2);
-  cursor: pointer;
-  transition:
-    background var(--motion-fast),
-    color var(--motion-fast);
-}
-.labels-icon-pick:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
-}
-.labels-icon-option {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 2rem;
-  height: 2rem;
-  border: none;
-  background: transparent;
-  border-radius: var(--radius-md);
-  color: var(--color-text-2);
-  cursor: pointer;
-  transition:
-    background var(--motion-fast),
-    color var(--motion-fast);
-}
-.labels-icon-option:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
-}
-.labels-icon-option.is-selected {
-  background: var(--color-blue-light);
-  color: var(--color-blue);
-}
-
-/* ---- Section summary (Edit-Settings card) ---- */
-.labels-summary {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-2);
-}
-.labels-summary-stats {
-  display: flex;
-  gap: var(--space-3);
-  font-size: 0.8125rem;
-  color: var(--color-text-2);
-}
-.labels-summary-note {
-  font-size: 0.75rem;
-  color: var(--color-text-3);
-}
-
-/* ---- Fat modal ---- */
-.labels-modal {
-  width: min(1100px, 94vw);
-  max-width: min(1100px, 94vw);
-}
-.labels-modal-body {
-  max-height: min(70vh, 640px);
-  overflow-y: auto;
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-3);
-  min-height: 0;
-}
-.labels-toolbar {
-  display: flex;
-  gap: var(--space-2);
-}
-.labels-footer {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: var(--space-2);
-  width: 100%;
-}
-.labels-footer-left,
-.labels-footer-right {
-  display: flex;
-  align-items: center;
-  gap: var(--space-2);
-}
-
-/* ---- Grouped mode: chips under collapsible parent categories ---- */
-.labels-groups {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-3);
-}
-.labels-group {
-  display: flex;
-  flex-direction: column;
-  gap: var(--space-2);
-}
-.labels-group-header {
-  display: flex;
-  align-items: center;
-  gap: var(--space-2);
-  border: none;
-  background: transparent;
-  padding: 0;
-  cursor: pointer;
-  font-size: 0.85rem;
-  font-weight: 600;
-  color: var(--color-text-1, inherit);
-}
-.labels-group-name {
-  flex: 1;
-  text-align: left;
-}
-.labels-group-count {
-  font-size: 0.75rem;
-  font-weight: 500;
-  color: var(--color-text-3, rgba(128, 128, 128, 0.9));
-}
-.labels-group-ungrouped {
-  margin: 0;
-  font-size: 0.85rem;
-  font-weight: 600;
-  color: var(--color-text-2, inherit);
-}
diff --git a/frontend/editor/src/proprietary/components/policies/LabelsEditor.tsx b/frontend/editor/src/proprietary/components/policies/LabelsEditor.tsx
deleted file mode 100644
index 16b04367ff..0000000000
--- a/frontend/editor/src/proprietary/components/policies/LabelsEditor.tsx
+++ /dev/null
@@ -1,258 +0,0 @@
-// Editor for a classification-label list: an add box on top, then the labels as chips (icon picker + remove), duplicate names rejected case-insensitively (optionally also against `reservedNames`). In `grouped` mode the chips are organised under collapsible parent categories (the device-local sidebar categories), matching the sidebar's category picker; labels in no category fall under "Ungrouped". Grouping is presentational — editing still mutates the flat list.
-
-import { useMemo, useState, useSyncExternalStore, type ReactNode } from "react";
-import { useTranslation } from "react-i18next";
-import AddIcon from "@mui/icons-material/Add";
-import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown";
-import KeyboardArrowRightIcon from "@mui/icons-material/KeyboardArrowRight";
-import { Button } from "@app/ui/Button";
-import { LabelChip } from "@app/ui/LabelChip";
-import { LocalIcon } from "@app/components/shared/LocalIcon";
-import { LabelIconPicker } from "@app/components/policies/LabelIconPicker";
-import { DEFAULT_LABEL_ICON } from "@app/data/labelIcons";
-import {
-  getSidebarCategories,
-  subscribeSidebarCategories,
-} from "@app/services/fileSidebarCategories";
-import {
-  labelId,
-  type ClassificationLabel,
-} from "@app/data/classificationLabels";
-
-const MAX_TEXT_LENGTH = 128;
-
-interface LabelsEditorProps {
-  value: ClassificationLabel[];
-  onChange: (next: ClassificationLabel[]) => void;
-  readOnly?: boolean;
-  /** Names that can't be added here because another set already owns them. */
-  reservedNames?: string[];
-  addPlaceholder?: string;
-  emptyText?: string;
-  /** Render chips under collapsible parent categories (like the sidebar picker). */
-  grouped?: boolean;
-}
-
-export function LabelsEditor({
-  value,
-  onChange,
-  readOnly = false,
-  reservedNames,
-  addPlaceholder,
-  emptyText,
-  grouped = false,
-}: LabelsEditorProps) {
-  const { t } = useTranslation();
-  const [pending, setPending] = useState("");
-  const [addError, setAddError] = useState<string | null>(null);
-
-  const add = () => {
-    const name = pending.trim();
-    if (!name) return;
-    if (name.length > MAX_TEXT_LENGTH) {
-      setAddError(
-        t(
-          "policies.labels.tooLong",
-          "Labels can be at most {{max}} characters.",
-          { max: MAX_TEXT_LENGTH },
-        ),
-      );
-      return;
-    }
-    const key = name.toLowerCase();
-    const taken =
-      value.some((label) => label.name.toLowerCase() === key) ||
-      (reservedNames ?? []).some((reserved) => reserved.toLowerCase() === key);
-    if (taken) {
-      setAddError(
-        t("policies.labels.duplicate", '"{{name}}" already exists.', { name }),
-      );
-      return;
-    }
-    setAddError(null);
-    setPending("");
-    onChange([...value, { id: labelId(name), name }]);
-  };
-
-  const removeById = (id: string) =>
-    onChange(value.filter((label) => label.id !== id));
-
-  const setIconById = (id: string, icon: string) =>
-    onChange(
-      value.map((label) => (label.id === id ? { ...label, icon } : label)),
-    );
-
-  const renderChip = (label: ClassificationLabel) => {
-    const key = label.id;
-    return (
-      <LabelChip
-        key={key}
-        label={label.name}
-        leading={
-          readOnly ? (
-            <span className="sui-labelchip-icon">
-              <LocalIcon icon={label.icon || DEFAULT_LABEL_ICON} width="1rem" />
-            </span>
-          ) : (
-            <LabelIconPicker
-              value={label.icon}
-              onChange={(icon) => setIconById(key, icon)}
-              ariaLabel={t(
-                "policies.labels.iconAria",
-                "Choose an icon for {{name}}",
-                { name: label.name },
-              )}
-            />
-          )
-        }
-        onRemove={readOnly ? undefined : () => removeById(key)}
-        removeAriaLabel={t("policies.labels.removeAria", "Remove {{name}}", {
-          name: label.name,
-        })}
-      />
-    );
-  };
-
-  return (
-    <div className="labels-editor">
-      {!readOnly && (
-        <div className="labels-add">
-          <input
-            className="labels-add-input"
-            value={pending}
-            maxLength={MAX_TEXT_LENGTH + 1}
-            placeholder={
-              addPlaceholder ??
-              t("policies.labels.addPlaceholder", "Add a label…")
-            }
-            onChange={(e) => {
-              setPending(e.target.value);
-              if (addError) setAddError(null);
-            }}
-            onKeyDown={(e) => {
-              if (e.key === "Enter") {
-                e.preventDefault();
-                add();
-              }
-            }}
-          />
-          <Button
-            variant="secondary"
-            size="sm"
-            leftSection={<AddIcon sx={{ fontSize: "1rem" }} />}
-            onClick={add}
-            disabled={!pending.trim()}
-          >
-            {t("policies.labels.add", "Add")}
-          </Button>
-        </div>
-      )}
-      {addError && <p className="labels-add-error">{addError}</p>}
-
-      {value.length === 0 ? (
-        <p className="labels-empty">
-          {emptyText ?? t("policies.labels.empty", "No labels yet.")}
-        </p>
-      ) : grouped ? (
-        <GroupedLabels value={value} renderChip={renderChip} />
-      ) : (
-        <div className="labels-chips" role="list">
-          {value.map(renderChip)}
-        </div>
-      )}
-    </div>
-  );
-}
-
-interface GroupedLabelsProps {
-  value: ClassificationLabel[];
-  renderChip: (label: ClassificationLabel) => ReactNode;
-}
-
-/** Chips laid out under collapsible parent categories (device-local structure). */
-function GroupedLabels({ value, renderChip }: GroupedLabelsProps) {
-  const { t } = useTranslation();
-  const categories = useSyncExternalStore(
-    subscribeSidebarCategories,
-    getSidebarCategories,
-  );
-
-  // Category sections that actually contain labels from `value`, plus the leftovers.
-  const { sections, ungrouped } = useMemo(() => {
-    const byId = new Map(value.map((l) => [l.id, l]));
-    const claimed = new Set<string>();
-    const sections = categories
-      .map((category) => {
-        const members = category.labelKeys
-          .map((id) => byId.get(id))
-          .filter((l): l is ClassificationLabel => !!l);
-        members.forEach((m) => claimed.add(m.id));
-        return { category, members };
-      })
-      .filter((s) => s.members.length > 0);
-    const ungrouped = value.filter((l) => !claimed.has(l.id));
-    return { sections, ungrouped };
-  }, [value, categories]);
-
-  // Only the first section starts expanded — a scannable overview.
-  const [expanded, setExpanded] = useState<ReadonlySet<string>>(
-    () => new Set(sections.length > 0 ? [sections[0].category.id] : []),
-  );
-  const toggle = (id: string) =>
-    setExpanded((prev) => {
-      const next = new Set(prev);
-      if (next.has(id)) next.delete(id);
-      else next.add(id);
-      return next;
-    });
-
-  return (
-    <div className="labels-groups">
-      {sections.map(({ category, members }) => {
-        const isOpen = expanded.has(category.id);
-        return (
-          <section key={category.id} className="labels-group">
-            <Button
-              variant="quiet"
-              fullWidth
-              justify="between"
-              className="labels-group-header"
-              aria-expanded={isOpen}
-              onClick={() => toggle(category.id)}
-              leftSection={
-                <>
-                  {isOpen ? (
-                    <KeyboardArrowDownIcon sx={{ fontSize: "1.1rem" }} />
-                  ) : (
-                    <KeyboardArrowRightIcon sx={{ fontSize: "1.1rem" }} />
-                  )}
-                  <LocalIcon icon={category.icon} width="1.05rem" />
-                </>
-              }
-              rightSection={
-                <span className="labels-group-count">{members.length}</span>
-              }
-            >
-              <span className="labels-group-name">{category.name}</span>
-            </Button>
-            {isOpen && (
-              <div className="labels-chips" role="list">
-                {members.map(renderChip)}
-              </div>
-            )}
-          </section>
-        );
-      })}
-      {ungrouped.length > 0 && (
-        <section className="labels-group">
-          <p className="labels-group-ungrouped">
-            {t("policies.labels.ungrouped", "Ungrouped")}
-          </p>
-          <div className="labels-chips" role="list">
-            {ungrouped.map(renderChip)}
-          </div>
-        </section>
-      )}
-    </div>
-  );
-}
diff --git a/frontend/editor/src/proprietary/components/policies/LabelsEditorModal.tsx b/frontend/editor/src/proprietary/components/policies/LabelsEditorModal.tsx
deleted file mode 100644
index 9cafed3aeb..0000000000
--- a/frontend/editor/src/proprietary/components/policies/LabelsEditorModal.tsx
+++ /dev/null
@@ -1,175 +0,0 @@
-/**
- * Full-screen ("fat") editor for the team's classification labels — the roomy
- * view the settings summary's Edit button opens. Hosts the {@link LabelsEditor}
- * chip grid plus an Import/Export toolbar and a footer holding the destructive
- * actions (reset / start-from-scratch) and the Save/Cancel buttons. Editing is
- * staged: nothing is persisted until Save, which stays disabled until the draft
- * actually changes. The draft is owned by the caller so the settings summary
- * reflects saved changes.
- */
-
-import { useRef } from "react";
-import { useTranslation } from "react-i18next";
-import FileDownloadOutlinedIcon from "@mui/icons-material/FileDownloadOutlined";
-import FileUploadOutlinedIcon from "@mui/icons-material/FileUploadOutlined";
-import RestartAltIcon from "@mui/icons-material/RestartAlt";
-import DeleteSweepOutlinedIcon from "@mui/icons-material/DeleteSweepOutlined";
-import InfoOutlinedIcon from "@mui/icons-material/InfoOutlined";
-import { Modal } from "@app/ui/Modal";
-import { Button } from "@app/ui/Button";
-import { Banner } from "@app/ui/Banner";
-import { LabelsEditor } from "@app/components/policies/LabelsEditor";
-import type { ClassificationLabel } from "@app/data/classificationLabels";
-
-interface LabelsEditorModalProps {
-  open: boolean;
-  onClose: () => void;
-  draft: ClassificationLabel[];
-  onDraftChange: (next: ClassificationLabel[]) => void;
-  onImportFile: (file: File) => void;
-  onExport: () => void;
-  /** Stage the built-in default into the draft. */
-  onReset: () => void;
-  /** Stage an empty list into the draft (build from scratch). */
-  onClear: () => void;
-  onSave: () => void;
-  dirty: boolean;
-  saving: boolean;
-  readOnly: boolean;
-  /** Save (server) or import (file) failure to surface, if any. */
-  error: string | null;
-}
-
-export function LabelsEditorModal({
-  open,
-  onClose,
-  draft,
-  onDraftChange,
-  onImportFile,
-  onExport,
-  onReset,
-  onClear,
-  onSave,
-  dirty,
-  saving,
-  readOnly,
-  error,
-}: LabelsEditorModalProps) {
-  const { t } = useTranslation();
-  const fileInput = useRef<HTMLInputElement>(null);
-
-  const handleFile = (e: React.ChangeEvent<HTMLInputElement>) => {
-    const file = e.target.files?.[0];
-    // Reset the input so picking the same file twice still fires onChange.
-    e.target.value = "";
-    if (file) onImportFile(file);
-  };
-
-  return (
-    <Modal
-      open={open}
-      onClose={onClose}
-      width="xl"
-      className="labels-modal"
-      title={t("policies.labels.modalTitle", "Classification labels")}
-      subtitle={t(
-        "policies.labels.modalSubtitle",
-        "Shared with your whole team. The classifier picks the labels that fit each document.",
-      )}
-      footer={
-        <div className="labels-footer">
-          <div className="labels-footer-left">
-            {!readOnly && (
-              <>
-                <Button
-                  variant="tertiary"
-                  accent="danger"
-                  size="sm"
-                  leftSection={
-                    <DeleteSweepOutlinedIcon sx={{ fontSize: "1rem" }} />
-                  }
-                  onClick={onClear}
-                  disabled={saving}
-                >
-                  {t("policies.labels.startFromScratch", "Start from scratch")}
-                </Button>
-                <Button
-                  variant="tertiary"
-                  accent="danger"
-                  size="sm"
-                  leftSection={<RestartAltIcon sx={{ fontSize: "1rem" }} />}
-                  onClick={onReset}
-                  disabled={saving}
-                >
-                  {t("policies.labels.resetToDefault", "Reset to default")}
-                </Button>
-              </>
-            )}
-          </div>
-          <div className="labels-footer-right">
-            <Button variant="tertiary" size="sm" onClick={onClose}>
-              {readOnly ? t("close", "Close") : t("cancel", "Cancel")}
-            </Button>
-            {!readOnly && (
-              <Button
-                variant="primary"
-                size="sm"
-                onClick={onSave}
-                disabled={!dirty || saving}
-              >
-                {saving
-                  ? t("policies.labels.saving", "Saving…")
-                  : t("policies.labels.saveForTeam", "Save for team")}
-              </Button>
-            )}
-          </div>
-        </div>
-      }
-    >
-      <div className="labels-modal-body">
-        {error && (
-          <Banner
-            tone="danger"
-            icon={<InfoOutlinedIcon sx={{ fontSize: "1rem" }} />}
-            description={error}
-          />
-        )}
-        {!readOnly && (
-          <div className="labels-toolbar">
-            <Button
-              variant="secondary"
-              size="sm"
-              leftSection={<FileUploadOutlinedIcon sx={{ fontSize: "1rem" }} />}
-              onClick={() => fileInput.current?.click()}
-            >
-              {t("policies.labels.import", "Import JSON")}
-            </Button>
-            <Button
-              variant="secondary"
-              size="sm"
-              leftSection={
-                <FileDownloadOutlinedIcon sx={{ fontSize: "1rem" }} />
-              }
-              onClick={onExport}
-            >
-              {t("policies.labels.export", "Export JSON")}
-            </Button>
-            <input
-              ref={fileInput}
-              type="file"
-              accept="application/json,.json"
-              hidden
-              onChange={handleFile}
-            />
-          </div>
-        )}
-        <LabelsEditor
-          value={draft}
-          onChange={onDraftChange}
-          readOnly={readOnly}
-          grouped
-        />
-      </div>
-    </Modal>
-  );
-}
diff --git a/frontend/editor/src/proprietary/components/policies/policyToolChains.ts b/frontend/editor/src/proprietary/components/policies/policyToolChains.ts
deleted file mode 100644
index a7c224d1ea..0000000000
--- a/frontend/editor/src/proprietary/components/policies/policyToolChains.ts
+++ /dev/null
@@ -1,19 +0,0 @@
-/**
- * The fixed, configurable tool chain per policy category — the locked set the
- * config page shows (one section per tool). Tools can be configured + toggled
- * on/off, but not added or removed. Each id is a frontend tool-registry key (and
- * maps to that tool's backend endpoint via the registry's operationConfig).
- */
-export const POLICY_TOOL_CHAINS: Record<string, string[]> = {
-  // Security: redact PII + watermark + sanitize (strips JS). Which are enabled
-  // by default comes from the preset's defaultOperations, not this list.
-  security: ["redact", "watermark", "sanitize"],
-  // Classification: a single backend step that classifies the document and
-  // writes the result into its metadata.
-  classification: ["classify"],
-};
-
-/** The configurable tool chain for a category, or null if it has none yet. */
-export function getPolicyToolChain(categoryId: string): string[] | null {
-  return POLICY_TOOL_CHAINS[categoryId] ?? null;
-}
diff --git a/frontend/editor/src/proprietary/data/classificationLabels.drift.test.ts b/frontend/editor/src/proprietary/data/classificationLabels.drift.test.ts
new file mode 100644
index 0000000000..9250169d37
--- /dev/null
+++ b/frontend/editor/src/proprietary/data/classificationLabels.drift.test.ts
@@ -0,0 +1,54 @@
+import fs from "fs";
+import path from "path";
+import { describe, it, expect } from "vitest";
+import { DEFAULT_CLASSIFICATION_LABELS } from "@app/data/classificationLabels";
+
+// The classifier vocabulary is bundled in TWO places that must not drift:
+//  - this frontend JSON (source of truth for sidebar categories + display names)
+//  - a backend copy the classify tool sends to the AI engine per request
+//    (app/proprietary/src/main/resources/classification/classification-labels.json).
+// The backend sends label IDS the engine stores on the document and the frontend
+// then displays, so a divergence means the classifier picks a label the UI can't
+// render (or the UI advertises labels the classifier never uses). This guards it.
+
+const REPO_ROOT = path.resolve(__dirname, "../../../../..");
+const BACKEND_LABELS_FILE = path.join(
+  REPO_ROOT,
+  "app/proprietary/src/main/resources/classification/classification-labels.json",
+);
+
+interface Label {
+  id: string;
+  name: string;
+  icon?: string | null;
+}
+
+function readBackendLabels(): Label[] {
+  const raw = JSON.parse(fs.readFileSync(BACKEND_LABELS_FILE, "utf8")) as {
+    labels: Label[];
+  };
+  return raw.labels;
+}
+
+describe("classification label vocabulary (frontend ↔ backend)", () => {
+  const frontend = DEFAULT_CLASSIFICATION_LABELS;
+  const backend = readBackendLabels();
+
+  it("has the identical set of label ids on both sides", () => {
+    const frontendIds = [...new Set(frontend.map((l) => l.id))].sort();
+    const backendIds = [...new Set(backend.map((l) => l.id))].sort();
+    expect(backendIds).toEqual(frontendIds);
+  });
+
+  it("has matching name and icon per id on both sides", () => {
+    const backendById = new Map(backend.map((l) => [l.id, l]));
+    for (const label of frontend) {
+      const other = backendById.get(label.id);
+      expect(other, `backend missing label "${label.id}"`).toBeDefined();
+      expect({ name: other!.name, icon: other!.icon ?? null }).toEqual({
+        name: label.name,
+        icon: label.icon ?? null,
+      });
+    }
+  });
+});
diff --git a/frontend/editor/src/proprietary/data/classificationLabels.ts b/frontend/editor/src/proprietary/data/classificationLabels.ts
index 3695255c4e..900a1b09af 100644
--- a/frontend/editor/src/proprietary/data/classificationLabels.ts
+++ b/frontend/editor/src/proprietary/data/classificationLabels.ts
@@ -1,14 +1,14 @@
-// Default classification labels. The SOURCE OF TRUTH is the co-located static
-// JSON (`classificationLabels.json`), imported here and shaped into typed
-// objects — edit THAT file, not this one. This is the ONLY copy of the label
-// data: it seeds a team's editable set and drives the sidebar's grouping,
-// icons, and display names. Neither the backend nor the engine keeps a copy.
+// Classification labels. The SOURCE OF TRUTH is the co-located static JSON
+// (`classificationLabels.json`), imported here and shaped into typed objects —
+// edit THAT file, not this one. It's a fixed, built-in vocabulary shared by
+// everyone (no per-team customization); it drives the sidebar's grouping, icons,
+// and display names.
 //
-// NOTE: this is only the built-in default vocabulary. A team's own
-// (admin-editable) labels live in the backend store and are what the backend
-// sends to the engine per classify request — the engine holds no vocabulary of
-// its own. Edits to a team's set reach Python on the next run, independent of
-// this file.
+// The backend keeps a SECOND copy of this list
+// (`app/proprietary/src/main/resources/classification/classification-labels.json`)
+// which it sends to the engine per classify request (the engine holds no
+// vocabulary of its own). The two copies must not drift — `classificationLabels.drift.test.ts`
+// guards that. When you edit the labels here, update the backend copy too.
 //
 // `labels` is the flat set: each has a stable `id` (slug — the value on the wire,
 // in storage and keyed on) and a human `name` (display, translatable via
diff --git a/frontend/editor/src/proprietary/data/labelIcons.ts b/frontend/editor/src/proprietary/data/labelIcons.ts
index c71e7a9da4..66affc07cd 100644
--- a/frontend/editor/src/proprietary/data/labelIcons.ts
+++ b/frontend/editor/src/proprietary/data/labelIcons.ts
@@ -1,22 +1,21 @@
 /**
- * Curated palette of icons a classification label can use, shown in the label
- * icon picker and rendered in the file sidebar's label groups. Keys are
- * Material Symbols names rendered via {@link LocalIcon}.
+ * Curated palette of icons the classification labels use, rendered in the file
+ * sidebar's label/category groups. Keys are Material Symbols names rendered via
+ * {@link LocalIcon}.
  *
- * IMPORTANT: each entry is written as an `icon: "…"` literal so the icon-bundler
- * (`scripts/generate-icons.js`, which regex-scans for icon literals) picks every
- * one up and bundles it — otherwise a picked icon would fall back to the CDN and
- * render blank offline. After adding/removing entries run `task frontend:prepare:icons`.
- *
- * Search is intentionally omitted for now (no synonyms to maintain); the palette
- * is small enough to eyeball.
+ * IMPORTANT — this list is also the icon BUNDLING MANIFEST for classification.
+ * The label/family icons live in `classificationLabels.json`, but the bundler
+ * (`scripts/generate-icons.js`) only regex-scans `.ts/.tsx` for `icon: "…"`
+ * literals, not JSON — so every icon those labels use must appear here as a
+ * literal or it falls back to the CDN and renders blank offline. Do NOT delete
+ * `LABEL_ICON_OPTIONS` as "unused": nothing imports it, but it's load-bearing
+ * for offline icons. After editing, run `task frontend:prepare:icons`.
  */
 
 export interface LabelIconOption {
   /** Material Symbols key (no `material-symbols:` prefix). */
   icon: string;
-  /** Short English name — the en-US default for the icon's tooltip/aria; the
-   *  picker translates it via `policies.labels.iconName.<icon>`. */
+  /** Short English name for the icon (documentation only). */
   label: string;
 }
 
@@ -188,8 +187,3 @@ export const LABEL_ICON_OPTIONS: LabelIconOption[] = [
   { icon: "recycling", label: "Recycling" },
   { icon: "agriculture", label: "Agriculture" },
 ];
-
-/** Set of valid palette keys, for validating a stored/imported icon. */
-export const LABEL_ICON_KEYS: ReadonlySet<string> = new Set(
-  LABEL_ICON_OPTIONS.map((option) => option.icon),
-);
diff --git a/frontend/editor/src/proprietary/data/policyDefinitions.tsx b/frontend/editor/src/proprietary/data/policyDefinitions.tsx
index 3842b1885a..f3377c028e 100644
--- a/frontend/editor/src/proprietary/data/policyDefinitions.tsx
+++ b/frontend/editor/src/proprietary/data/policyDefinitions.tsx
@@ -5,18 +5,13 @@
  * user's real files, not defined here.
  */
 
-import LayersIcon from "@mui/icons-material/Layers";
-import ShieldIcon from "@mui/icons-material/Shield";
-import CheckCircleIcon from "@mui/icons-material/CheckCircle";
-import ArrowForwardIcon from "@mui/icons-material/ArrowForward";
-import StorageIcon from "@mui/icons-material/Storage";
 import DescriptionIcon from "@mui/icons-material/Description";
 import ComputerIcon from "@mui/icons-material/Computer";
 import PublicIcon from "@mui/icons-material/Public";
 import CloudIcon from "@mui/icons-material/Cloud";
 import EmailOutlinedIcon from "@mui/icons-material/EmailOutlined";
 import FolderOpenIcon from "@mui/icons-material/FolderOpen";
-import LabelOutlinedIcon from "@mui/icons-material/LabelOutlined";
+import { policyCategoryIcon } from "@app/components/policies/policyCategoryIcon";
 import type {
   PolicyCategory,
   PolicyConfigDef,
@@ -30,7 +25,7 @@ export const POLICY_CATEGORIES: PolicyCategory[] = [
   {
     id: "ingestion",
     label: "Ingestion",
-    icon: <LayersIcon sx={ICON_SX} />,
+    icon: policyCategoryIcon("ingestion", ICON_SX),
     desc: "Classify documents, extract structured data, enforce naming conventions, and normalize pages.",
     // The classifier the wizard's "Set up Classification" action routes to.
     providesClassification: true,
@@ -40,13 +35,13 @@ export const POLICY_CATEGORIES: PolicyCategory[] = [
   {
     id: "security",
     label: "Security",
-    icon: <ShieldIcon sx={ICON_SX} />,
+    icon: policyCategoryIcon("security", ICON_SX),
     desc: "Detect PII, encrypt, verify authenticity, control access, and certify documents.",
   },
   {
     id: "classification",
     label: "Classification",
-    icon: <LabelOutlinedIcon sx={ICON_SX} />,
+    icon: policyCategoryIcon("classification", ICON_SX),
     desc: "Identify each document's type on upload and tag its metadata for filing and search.",
     // Needs the AI engine to classify; hidden from the policy list when it's off.
     requiresAiEngine: true,
@@ -54,21 +49,21 @@ export const POLICY_CATEGORIES: PolicyCategory[] = [
   {
     id: "compliance",
     label: "Compliance",
-    icon: <CheckCircleIcon sx={ICON_SX} />,
+    icon: policyCategoryIcon("compliance", ICON_SX),
     desc: "Enforce HIPAA, GDPR, SOC 2, or FedRAMP requirements on every document.",
     comingSoon: true,
   },
   {
     id: "routing",
     label: "Routing",
-    icon: <ArrowForwardIcon sx={ICON_SX} />,
+    icon: policyCategoryIcon("routing", ICON_SX),
     desc: "Auto-route documents to the right team, folder, or system.",
     comingSoon: true,
   },
   {
     id: "retention",
     label: "Retention",
-    icon: <StorageIcon sx={ICON_SX} />,
+    icon: policyCategoryIcon("retention", ICON_SX),
     desc: "Set how long documents are kept, when to archive, and when to delete.",
     comingSoon: true,
   },
diff --git a/frontend/editor/src/proprietary/hooks/useClassificationLabels.ts b/frontend/editor/src/proprietary/hooks/useClassificationLabels.ts
deleted file mode 100644
index 5f034ad7fc..0000000000
--- a/frontend/editor/src/proprietary/hooks/useClassificationLabels.ts
+++ /dev/null
@@ -1,85 +0,0 @@
-/**
- * Loads and persists the team's classification labels
- * (`/api/v1/classification/labels`) — one server-truth set shared by the whole
- * team. When the team has none, this shows the built-in default as a starting
- * point for the editor/sidebar; note the classifier itself does NOT use that
- * default — the backend only classifies against a team's saved set (an unsaved
- * team is not classified). Editing is gated to team leaders / admins by the
- * backend — callers pass `canConfigure` (the policy gate) to keep read-only
- * users out of the save path.
- *
- * `teamLabels` is also what the sidebar/editor display uses — the team set, or
- * the built-in default when the team has none.
- */
-
-import { useCallback, useEffect, useState } from "react";
-import {
-  DEFAULT_CLASSIFICATION_LABELS,
-  type ClassificationLabel,
-} from "@app/data/classificationLabels";
-import { fetchTeamLabels, saveTeamLabels } from "@app/services/labelsBackend";
-
-export interface UseClassificationLabels {
-  /** Server-truth team labels (or the built-in default when the team has none). */
-  teamLabels: ClassificationLabel[];
-  /** Whether the team has a stored set (vs. the built-in default). */
-  isCustom: boolean;
-  loading: boolean;
-  saving: boolean;
-  /** Last save failure, cleared on the next attempt. */
-  error: string | null;
-  /** Persist the team set; resolves once server state is updated. */
-  saveTeam: (next: ClassificationLabel[]) => Promise<void>;
-}
-
-export function useClassificationLabels(
-  enabled: boolean,
-): UseClassificationLabels {
-  const [teamLabels, setTeamLabels] = useState<ClassificationLabel[]>(
-    DEFAULT_CLASSIFICATION_LABELS,
-  );
-  const [isCustom, setIsCustom] = useState(false);
-  const [loading, setLoading] = useState(enabled);
-  const [saving, setSaving] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  useEffect(() => {
-    if (!enabled) return;
-    let cancelled = false;
-    setLoading(true);
-    void (async () => {
-      const team = await fetchTeamLabels().catch(() => null);
-      if (cancelled) return;
-      setTeamLabels(team ?? DEFAULT_CLASSIFICATION_LABELS);
-      setIsCustom(team != null);
-      setLoading(false);
-    })();
-    return () => {
-      cancelled = true;
-    };
-  }, [enabled]);
-
-  const saveTeam = useCallback(async (next: ClassificationLabel[]) => {
-    setSaving(true);
-    setError(null);
-    try {
-      const saved = await saveTeamLabels(next);
-      setTeamLabels(saved);
-      setIsCustom(true);
-    } catch (e) {
-      setError(e instanceof Error ? e.message : "Couldn't save the labels.");
-      throw e;
-    } finally {
-      setSaving(false);
-    }
-  }, []);
-
-  return {
-    teamLabels,
-    isCustom,
-    loading,
-    saving,
-    error,
-    saveTeam,
-  };
-}
diff --git a/frontend/editor/src/proprietary/hooks/usePolicies.ts b/frontend/editor/src/proprietary/hooks/usePolicies.ts
index be95079b3a..8043e6b66a 100644
--- a/frontend/editor/src/proprietary/hooks/usePolicies.ts
+++ b/frontend/editor/src/proprietary/hooks/usePolicies.ts
@@ -35,8 +35,6 @@ import {
   removePolicy,
 } from "@app/services/policyBackend";
 import { reorderPolicies as reorderBackendPolicies } from "@app/services/policyApi";
-import { seedTeamLabelsIfEmpty } from "@app/services/labelsBackend";
-import { getPolicyToolChain } from "@app/components/policies/policyToolChains";
 import type { PolicyToStore } from "@app/services/policyPipeline";
 import type {
   PoliciesByCategory,
@@ -139,13 +137,6 @@ export function usePolicies() {
     async (id: string, result: PolicyWizardResult) => {
       const category = loadPolicyCatalog().categories.find((c) => c.id === id);
       if (!category) throw new Error(`Unknown policy category: ${id}`);
-      // A policy whose chain classifies runs against the team's stored label set
-      // (the engine has no default). Seed it with the built-in defaults now so
-      // the very first enforced file has a vocabulary to classify against; no-op
-      // if the team already has a set (never clobbers admin edits).
-      if (getPolicyToolChain(id)?.includes("classify")) {
-        await seedTeamLabelsIfEmpty();
-      }
       // One policy per category, ever: reuse any existing backend record.
       const existingBackendId =
         loadPolicies()[id]?.backendId ??
@@ -225,12 +216,6 @@ export function usePolicies() {
     async (id: string, result: PolicyConfigResult) => {
       const category = loadPolicyCatalog().categories.find((c) => c.id === id);
       if (!category) throw new Error(`Unknown policy category: ${id}`);
-      // Seed the team's default label set on first classification-policy setup
-      // (see enablePolicy) — the engine has no default, so the stored set is the
-      // only vocabulary. No-op once the team has any set.
-      if (getPolicyToolChain(id)?.includes("classify")) {
-        await seedTeamLabelsIfEmpty();
-      }
       const current = loadPolicies()[id];
       // One policy per category, ever: reuse the existing backend record (even
       // if the local link was lost) so a save never creates a duplicate.
diff --git a/frontend/editor/src/proprietary/policies/operations.test.ts b/frontend/editor/src/proprietary/policies/operations.test.ts
index 491a15aa59..253e9ae6bd 100644
--- a/frontend/editor/src/proprietary/policies/operations.test.ts
+++ b/frontend/editor/src/proprietary/policies/operations.test.ts
@@ -13,8 +13,9 @@ const ALL_TOOL_IDS = Object.keys(POLICY_OPERATIONS) as PolicyToolId[];
 
 describe("POLICY_OPERATIONS", () => {
   test("every category operation is a typed descriptor with a known endpoint", () => {
-    // The catalogue uses these six across all categories; each must be wired.
+    // The catalogue uses these across all categories; each must be wired.
     expect(ALL_TOOL_IDS.sort()).toEqual([
+      "classify",
       "compress",
       "flatten",
       "ocr",
diff --git a/frontend/editor/src/proprietary/policies/operations.ts b/frontend/editor/src/proprietary/policies/operations.ts
index 66e92c448a..5d07df1717 100644
--- a/frontend/editor/src/proprietary/policies/operations.ts
+++ b/frontend/editor/src/proprietary/policies/operations.ts
@@ -11,10 +11,39 @@ import { addWatermarkOperationConfig } from "@app/hooks/tools/addWatermark/useAd
 import { ocrOperationConfig } from "@app/hooks/tools/ocr/useOCROperation";
 import { flattenOperationConfig } from "@app/hooks/tools/flatten/useFlattenOperation";
 import { compressOperationConfig } from "@app/hooks/tools/compress/useCompressOperation";
-import type { ToolOperationDescriptor } from "@app/hooks/tools/shared/toolOperationDescriptor";
-import type { ToolApiParams, ToolEndpoint } from "@app/types/toolApiTypes";
+import type { ToolEndpoint } from "@app/types/toolApiTypes";
 import type { WirePipelineStep } from "@app/policies/types";
 
+/**
+ * Endpoints for AI-dispatched policy tools. Intentionally NOT part of the generated
+ * {@link ToolEndpoint} union: the backend controllers are `@Hidden` and `/api/v1/ai/tools/` is
+ * deliberately excluded from tool-model generation, so they can't be typed like standard tools.
+ */
+export type AiPolicyEndpoint = "/api/v1/ai/tools/classify-and-label";
+
+/** An AI tool usable in a policy — the AI-endpoint analogue of a standard tool descriptor. */
+export interface AiToolDescriptor<TParams> {
+  readonly endpoint: AiPolicyEndpoint;
+  readonly defaultParameters: TParams;
+  toApi(params: TParams): Record<string, unknown>;
+  fromApi(api: Record<string, unknown>): TParams;
+}
+
+/**
+ * Describe an AI-dispatched policy tool. AI tools carry no tunable parameters today, so params are
+ * empty and the (de)serializers are identity over an empty object.
+ */
+export function describeAiToolOperation(
+  endpoint: AiPolicyEndpoint,
+): AiToolDescriptor<Record<string, never>> {
+  return {
+    endpoint,
+    defaultParameters: {},
+    toApi: () => ({}),
+    fromApi: () => ({}),
+  };
+}
+
 export const POLICY_OPERATIONS = {
   redact: describeToolOperation(
     "/api/v1/security/auto-redact",
@@ -37,17 +66,13 @@ export const POLICY_OPERATIONS = {
     "/api/v1/misc/compress-pdf",
     compressOperationConfig,
   ),
+  classify: describeAiToolOperation("/api/v1/ai/tools/classify-and-label"),
 } as const;
 
 export type PolicyToolId = keyof typeof POLICY_OPERATIONS;
 
 export type PolicyParams<Id extends PolicyToolId> =
-  (typeof POLICY_OPERATIONS)[Id] extends ToolOperationDescriptor<
-    ToolEndpoint,
-    infer P
-  >
-    ? P
-    : never;
+  (typeof POLICY_OPERATIONS)[Id]["defaultParameters"];
 
 /** Discriminated on `toolId` so `params` matches the tool. */
 export type PolicyToolStep = {
@@ -65,7 +90,10 @@ const TOOL_ID_BY_ENDPOINT = new Map<string, PolicyToolId>(
   POLICY_TOOL_IDS.map((id) => [POLICY_OPERATIONS[id].endpoint, id]),
 );
 
-export function policyEndpoint(toolId: PolicyToolId): ToolEndpoint {
+/** A policy step's endpoint: a standard {@link ToolEndpoint} or an {@link AiPolicyEndpoint}. */
+export type PolicyEndpoint = ToolEndpoint | AiPolicyEndpoint;
+
+export function policyEndpoint(toolId: PolicyToolId): PolicyEndpoint {
   return POLICY_OPERATIONS[toolId].endpoint;
 }
 
@@ -90,19 +118,29 @@ export function policyStepToWire(step: PolicyToolStep): WirePipelineStep {
   return serializeStep(step);
 }
 
+/**
+ * Minimal runtime shape shared by standard tool descriptors and {@link AiToolDescriptor}s — enough
+ * to (de)serialize a step at the wire boundary regardless of how its endpoint is typed.
+ */
+interface PolicyOperation<TParams> {
+  readonly endpoint: string;
+  readonly defaultParameters: TParams;
+  toApi(params: TParams): Record<string, unknown>;
+  fromApi(api: Record<string, unknown>): TParams;
+}
+
 // Generic over the id so `params` stays correlated with the descriptor; TS can't do that through
 // the union, so `op` is widened here (a contained cast at the wire boundary).
 function serializeStep<Id extends PolicyToolId>(step: {
   toolId: Id;
   params: PolicyParams<Id>;
 }): WirePipelineStep {
-  const op = POLICY_OPERATIONS[step.toolId] as ToolOperationDescriptor<
-    ToolEndpoint,
+  const op = POLICY_OPERATIONS[step.toolId] as unknown as PolicyOperation<
     PolicyParams<Id>
   >;
   return {
     operation: op.endpoint,
-    parameters: op.toApi(step.params) as Record<string, unknown>,
+    parameters: op.toApi(step.params),
   };
 }
 
@@ -119,13 +157,10 @@ function deserializeStep<Id extends PolicyToolId>(
   toolId: Id,
   parameters: Record<string, unknown>,
 ): PolicyToolStepOf<Id> {
-  const op = POLICY_OPERATIONS[toolId] as ToolOperationDescriptor<
-    ToolEndpoint,
+  const op = POLICY_OPERATIONS[toolId] as unknown as PolicyOperation<
     PolicyParams<Id>
   >;
   // Wire params are untyped JSON; this is the one point they enter the typed model.
-  const params = op.fromApi(
-    parameters as unknown as ToolApiParams[ToolEndpoint],
-  );
+  const params = op.fromApi(parameters);
   return { toolId, params } as unknown as PolicyToolStepOf<Id>;
 }
diff --git a/frontend/editor/src/proprietary/services/fileSidebarCategories.ts b/frontend/editor/src/proprietary/services/fileSidebarCategories.ts
index 0ae8dac0db..b1b74a5a2f 100644
--- a/frontend/editor/src/proprietary/services/fileSidebarCategories.ts
+++ b/frontend/editor/src/proprietary/services/fileSidebarCategories.ts
@@ -1,97 +1,82 @@
-// Device-local (localStorage) category structure for the Files sidebar: which parent
-// categories exist, their name/icon/order, and which labels roll up into each. It's an editable
-// override of the built-in LABEL_FAMILIES default — until the user customizes it, the default is
-// used verbatim (so the store stays empty and the default can evolve). A label may sit in more
-// than one category (multi-membership); a category with `hidden` set stays defined but isn't shown
-// as a sidebar group. This is presentational only — the classifier never sees categories.
+// The Files-sidebar categories are a fixed, built-in set shared by everyone (derived from
+// LABEL_FAMILIES) — the team can't create, rename, or re-group them. The only per-user choice is
+// which categories to SHOW or HIDE in the sidebar, kept device-local in localStorage. A hidden
+// category isn't rendered as a group; its files fall to "Other". Presentational only — the
+// classifier never sees categories.
 
 import { LABEL_FAMILIES } from "@app/data/classificationLabels";
 
 export interface SidebarCategory {
-  /** Stable id — built-ins reuse their family id; custom ones get `custom:<n>`. */
+  /** Stable id (the label family's id). */
   id: string;
   name: string;
   icon: string;
   /** Label ids in this category (matches a file's stored classification ids). */
   labelKeys: string[];
-  /** Defined but not rendered as a sidebar group. */
+  /** Hidden from the sidebar (device-local, personal). */
   hidden?: boolean;
 }
 
-// v2: labelKeys hold label ids (was lower-cased names in v1); bumping discards
-// stale name-keyed prefs so they don't silently stop matching.
-const STORAGE_KEY = "stirling.fileSidebarCategories.v2";
+const HIDDEN_STORAGE_KEY = "stirling.fileSidebarHiddenCategories.v1";
 
-/** The built-in default, derived from LABEL_FAMILIES. Fresh copy per call (callers may mutate). */
-export function defaultCategories(): SidebarCategory[] {
-  return LABEL_FAMILIES.map((family) => ({
+/** The fixed, shared category set — never mutated. */
+const BASE_CATEGORIES: readonly Omit<SidebarCategory, "hidden">[] =
+  LABEL_FAMILIES.map((family) => ({
     id: family.id,
     name: family.name,
     icon: family.icon,
     labelKeys: family.labels.map((label) => label.id),
   }));
-}
 
-function readStorage(): SidebarCategory[] | null {
+function readHidden(): Set<string> {
   try {
-    const raw = localStorage.getItem(STORAGE_KEY);
-    if (!raw) return null;
+    const raw = localStorage.getItem(HIDDEN_STORAGE_KEY);
+    if (!raw) return new Set();
     const parsed = JSON.parse(raw) as unknown;
-    if (!Array.isArray(parsed)) return null;
-    return parsed
-      .filter((c): c is SidebarCategory => {
-        const cat = c as Partial<SidebarCategory>;
-        return (
-          typeof cat.id === "string" &&
-          typeof cat.name === "string" &&
-          typeof cat.icon === "string" &&
-          Array.isArray(cat.labelKeys)
-        );
-      })
-      .map((c) => ({
-        id: c.id,
-        name: c.name,
-        icon: c.icon,
-        labelKeys: c.labelKeys.filter((k) => typeof k === "string"),
-        hidden: c.hidden === true,
-      }));
+    return Array.isArray(parsed)
+      ? new Set(parsed.filter((id): id is string => typeof id === "string"))
+      : new Set();
   } catch {
-    return null;
+    return new Set();
   }
 }
 
-// null = using the built-in default (not yet customized). Cached so useSyncExternalStore sees a
-// stable reference between writes.
-let stored: SidebarCategory[] | null = readStorage();
+let hiddenIds = readHidden();
 const listeners = new Set<() => void>();
 
-// Effective list, recomputed only on write so its identity is stable for memo/useSyncExternalStore.
-let effective: SidebarCategory[] = stored ?? defaultCategories();
+// Recomputed only on write so its identity is stable for memo/useSyncExternalStore.
+let effective: SidebarCategory[] = compute();
 
-function recompute() {
-  effective = stored ?? defaultCategories();
+function compute(): SidebarCategory[] {
+  return BASE_CATEGORIES.map((c) => ({
+    ...c,
+    labelKeys: [...c.labelKeys],
+    hidden: hiddenIds.has(c.id),
+  }));
 }
 
-function write(next: SidebarCategory[]) {
-  stored = next;
-  recompute();
+function persist() {
   try {
-    localStorage.setItem(STORAGE_KEY, JSON.stringify(next));
+    localStorage.setItem(HIDDEN_STORAGE_KEY, JSON.stringify([...hiddenIds]));
   } catch {
-    // Quota/private-mode failures degrade to session-only categories.
+    // Quota/private-mode failures degrade to session-only visibility.
   }
+  effective = compute();
   for (const listener of listeners) listener();
 }
 
-/** Mutate the current effective list (snapshotting the default on first edit). */
-function mutate(fn: (categories: SidebarCategory[]) => SidebarCategory[]) {
-  write(fn(effective.map((c) => ({ ...c, labelKeys: [...c.labelKeys] }))));
-}
-
+/** The shared categories, each flagged with the user's device-local visibility. */
 export function getSidebarCategories(): SidebarCategory[] {
   return effective;
 }
 
+/** Show or hide a category in this device's sidebar. */
+export function setCategoryHidden(id: string, hidden: boolean) {
+  if (hidden) hiddenIds.add(id);
+  else hiddenIds.delete(id);
+  persist();
+}
+
 export function subscribeSidebarCategories(listener: () => void) {
   listeners.add(listener);
   return () => {
@@ -99,98 +84,8 @@ export function subscribeSidebarCategories(listener: () => void) {
   };
 }
 
-export function isCustomized(): boolean {
-  return stored !== null;
-}
-
-/** Map each label key to the ids of every VISIBLE category it belongs to. */
-export function labelCategoryMap(
-  categories: SidebarCategory[],
-): Map<string, string[]> {
-  const map = new Map<string, string[]>();
-  for (const category of categories) {
-    if (category.hidden) continue;
-    for (const key of category.labelKeys) {
-      const ids = map.get(key);
-      if (ids) ids.push(category.id);
-      else map.set(key, [category.id]);
-    }
-  }
-  return map;
-}
-
-/** Set of every label key that belongs to any category (visible or not). */
-export function categorizedLabelKeys(
-  categories: SidebarCategory[],
-): Set<string> {
-  const keys = new Set<string>();
-  for (const category of categories) {
-    for (const key of category.labelKeys) keys.add(key);
-  }
-  return keys;
-}
-
-// ---- editing ----
-
-/** Create a new empty category; returns its id. */
-export function addCategory(name: string, icon: string): string {
-  const id = `custom:${name.toLowerCase().replace(/[^a-z0-9]+/g, "-")}-${
-    effective.length
-  }`;
-  mutate((categories) => [...categories, { id, name, icon, labelKeys: [] }]);
-  return id;
-}
-
-export function renameCategory(id: string, name: string) {
-  mutate((categories) =>
-    categories.map((c) => (c.id === id ? { ...c, name } : c)),
-  );
-}
-
-export function setCategoryIcon(id: string, icon: string) {
-  mutate((categories) =>
-    categories.map((c) => (c.id === id ? { ...c, icon } : c)),
-  );
-}
-
-export function setCategoryHidden(id: string, hidden: boolean) {
-  mutate((categories) =>
-    categories.map((c) => (c.id === id ? { ...c, hidden } : c)),
-  );
-}
-
-export function deleteCategory(id: string) {
-  mutate((categories) => categories.filter((c) => c.id !== id));
-}
-
-export function addLabelToCategory(id: string, labelId: string) {
-  mutate((categories) =>
-    categories.map((c) =>
-      c.id === id && !c.labelKeys.includes(labelId)
-        ? { ...c, labelKeys: [...c.labelKeys, labelId] }
-        : c,
-    ),
-  );
-}
-
-export function removeLabelFromCategory(id: string, labelId: string) {
-  mutate((categories) =>
-    categories.map((c) =>
-      c.id === id
-        ? { ...c, labelKeys: c.labelKeys.filter((k) => k !== labelId) }
-        : c,
-    ),
-  );
-}
-
-/** Restore the built-in default and clear the customized flag (undoes any prior `mutate`). */
-export function resetSidebarCategories() {
-  stored = null;
-  recompute();
-  try {
-    localStorage.removeItem(STORAGE_KEY);
-  } catch {
-    // Quota/private-mode failures degrade to session-only categories.
-  }
-  for (const listener of listeners) listener();
+/** Show every category again (clear the device-local hidden set). */
+export function resetHiddenCategories() {
+  hiddenIds = new Set();
+  persist();
 }
diff --git a/frontend/editor/src/proprietary/services/labelsBackend.test.ts b/frontend/editor/src/proprietary/services/labelsBackend.test.ts
deleted file mode 100644
index d530364b3a..0000000000
--- a/frontend/editor/src/proprietary/services/labelsBackend.test.ts
+++ /dev/null
@@ -1,108 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
-import apiClient from "@app/services/apiClient";
-import { DEFAULT_CLASSIFICATION_LABELS } from "@app/data/classificationLabels";
-import { seedTeamLabelsIfEmpty } from "@app/services/labelsBackend";
-
-vi.mock("@app/services/apiClient");
-
-const get = vi.mocked(apiClient.get);
-const put = vi.mocked(apiClient.put);
-
-// The service only reads `status`/`data` off the axios response; a partial shape
-// is all these tests need, so cast the mock values through this helper.
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-const res = (value: object): any => value;
-
-// 204 No Content (nothing stored) comes back as an empty body.
-const emptyResponse = res({ status: 204, data: "" });
-const storedResponse = res({
-  status: 200,
-  data: { labels: [{ id: "invoice", name: "Invoice", icon: "receipt" }] },
-});
-const putEcho = res({ data: { labels: DEFAULT_CLASSIFICATION_LABELS } });
-
-describe("seedTeamLabelsIfEmpty", () => {
-  beforeEach(() => {
-    vi.clearAllMocks();
-  });
-
-  afterEach(() => {
-    vi.useRealTimers();
-  });
-
-  it("seeds the built-in defaults when the team has no set", async () => {
-    get.mockResolvedValue(emptyResponse);
-    put.mockResolvedValue(putEcho);
-
-    await seedTeamLabelsIfEmpty();
-
-    expect(put).toHaveBeenCalledTimes(1);
-    expect(put).toHaveBeenCalledWith("/api/v1/classification/labels", {
-      labels: DEFAULT_CLASSIFICATION_LABELS,
-    });
-  });
-
-  it("is a no-op when the team already has a set (never clobbers)", async () => {
-    get.mockResolvedValue(storedResponse);
-
-    await seedTeamLabelsIfEmpty();
-
-    expect(put).not.toHaveBeenCalled();
-  });
-
-  it("rides out a transient fetch failure, then seeds", async () => {
-    vi.useFakeTimers();
-    get
-      .mockRejectedValueOnce(new Error("network blip"))
-      .mockResolvedValueOnce(emptyResponse);
-    put.mockResolvedValue(putEcho);
-
-    const pending = seedTeamLabelsIfEmpty();
-    await vi.runAllTimersAsync();
-    await pending;
-
-    expect(get).toHaveBeenCalledTimes(2);
-    expect(put).toHaveBeenCalledTimes(1);
-  });
-
-  it("rides out a transient write failure, then seeds", async () => {
-    vi.useFakeTimers();
-    get.mockResolvedValue(emptyResponse);
-    put
-      .mockRejectedValueOnce(new Error("network blip"))
-      .mockResolvedValueOnce(putEcho);
-
-    const pending = seedTeamLabelsIfEmpty();
-    await vi.runAllTimersAsync();
-    await pending;
-
-    expect(put).toHaveBeenCalledTimes(2);
-  });
-
-  it("throws after a persistent fetch failure without writing (clobber-safe)", async () => {
-    vi.useFakeTimers();
-    get.mockRejectedValue(new Error("backend down"));
-
-    const pending = seedTeamLabelsIfEmpty();
-    const assertion = expect(pending).rejects.toThrow("backend down");
-    await vi.runAllTimersAsync();
-    await assertion;
-
-    // Never writes when the fetch can't confirm the team has no set.
-    expect(put).not.toHaveBeenCalled();
-    expect(get).toHaveBeenCalledTimes(3);
-  });
-
-  it("throws after a persistent write failure", async () => {
-    vi.useFakeTimers();
-    get.mockResolvedValue(emptyResponse);
-    put.mockRejectedValue(new Error("write failed"));
-
-    const pending = seedTeamLabelsIfEmpty();
-    const assertion = expect(pending).rejects.toThrow("write failed");
-    await vi.runAllTimersAsync();
-    await assertion;
-
-    expect(put).toHaveBeenCalledTimes(3);
-  });
-});
diff --git a/frontend/editor/src/proprietary/services/labelsBackend.ts b/frontend/editor/src/proprietary/services/labelsBackend.ts
deleted file mode 100644
index 8259f124de..0000000000
--- a/frontend/editor/src/proprietary/services/labelsBackend.ts
+++ /dev/null
@@ -1,99 +0,0 @@
-/**
- * Backend layer for the team's classification labels
- * (`/api/v1/classification/labels`) — one shared, server-truth list, editable
- * only by a team leader (SaaS) / admin (self-hosted). A team with none reads as
- * 204 → `null`, and callers fall back to the built-in
- * {@link DEFAULT_CLASSIFICATION_LABELS}.
- */
-
-import apiClient from "@app/services/apiClient";
-import {
-  DEFAULT_CLASSIFICATION_LABELS,
-  type ClassificationLabel,
-} from "@app/data/classificationLabels";
-
-const TEAM_ENDPOINT = "/api/v1/classification/labels";
-
-/** Wire shape shared with the backend: the label list wrapped in an object. */
-interface LabelsPayload {
-  labels: ClassificationLabel[];
-}
-
-async function fetchLabels(
-  endpoint: string,
-): Promise<ClassificationLabel[] | null> {
-  const res = await apiClient.get<LabelsPayload | "">(endpoint, {
-    suppressErrorToast: true,
-  });
-  // 204 No Content (nothing stored) comes back as an empty body. Only an
-  // explicit 204 / empty string means "none"; anything else is a real payload.
-  if (res.status === 204 || res.data === "") return null;
-  return (res.data as LabelsPayload).labels ?? [];
-}
-
-async function saveLabels(
-  endpoint: string,
-  labels: ClassificationLabel[],
-): Promise<ClassificationLabel[]> {
-  const res = await apiClient.put<LabelsPayload>(endpoint, { labels });
-  return res.data.labels ?? [];
-}
-
-/** The team's stored labels, or `null` when it has none (use the default). */
-export function fetchTeamLabels(): Promise<ClassificationLabel[] | null> {
-  return fetchLabels(TEAM_ENDPOINT);
-}
-
-/** Persist the team's labels; returns the stored value. */
-export function saveTeamLabels(
-  labels: ClassificationLabel[],
-): Promise<ClassificationLabel[]> {
-  return saveLabels(TEAM_ENDPOINT, labels);
-}
-
-/** Seed-write retry budget: the seed is a hard prerequisite (see below), so ride
- *  out a transient blip rather than fail setup on the first hiccup. */
-const SEED_MAX_ATTEMPTS = 3;
-const SEED_RETRY_MS = 400;
-
-async function withRetry<T>(op: () => Promise<T>): Promise<T> {
-  let lastError: unknown;
-  for (let attempt = 0; attempt < SEED_MAX_ATTEMPTS; attempt++) {
-    try {
-      return await op();
-    } catch (error) {
-      lastError = error;
-      if (attempt < SEED_MAX_ATTEMPTS - 1) {
-        await new Promise((resolve) =>
-          setTimeout(resolve, SEED_RETRY_MS * (attempt + 1)),
-        );
-      }
-    }
-  }
-  throw lastError;
-}
-
-/**
- * Seed the team's label set with the built-in defaults when it has none yet.
- *
- * The engine holds no default vocabulary, so the backend can only send what the
- * team has stored — a team with an empty set classifies nothing (documents come
- * back unlabelled and don't group). This writes the frontend's single default
- * copy into the team set the first time a classification policy is set up, so
- * classification works out of the box; the backend gates the write to admins.
- *
- * The seed is a hard prerequisite of enabling a classification policy, so it must
- * land or fail loudly — never silently leave an empty set behind a created
- * policy. Both the fetch and the write retry a transient failure; if either
- * ultimately fails this THROWS, and the caller aborts the setup (the admin sees
- * the error and retries) instead of shipping a policy that classifies nothing —
- * the same way a failed policy save already aborts setup. Still clobber-safe: it
- * writes only when the fetch DEFINITIVELY reports no set (204 → null), so it
- * never overwrites a team's real (possibly customised) labels, and it's a no-op
- * once any set exists (later admin edits are the source of truth).
- */
-export async function seedTeamLabelsIfEmpty(): Promise<void> {
-  const existing = await withRetry(fetchTeamLabels);
-  if (existing != null) return;
-  await withRetry(() => saveTeamLabels(DEFAULT_CLASSIFICATION_LABELS));
-}
diff --git a/frontend/editor/src/proprietary/services/labelsFile.ts b/frontend/editor/src/proprietary/services/labelsFile.ts
deleted file mode 100644
index 613b144c1f..0000000000
--- a/frontend/editor/src/proprietary/services/labelsFile.ts
+++ /dev/null
@@ -1,107 +0,0 @@
-/**
- * Client-side import/export + validation for a classification-labels JSON file
- * (`{"labels":[{"id":"invoice","name":"Invoice","icon":"receipt-long"}, …]}`).
- * Sharing a label set between teams is done by exporting the JSON here and
- * importing it on another team. Validation mirrors the backend
- * (`LabelsValidator`) so a malformed file is caught before it's uploaded — the
- * backend re-validates as the authority. A file may omit `id` (e.g. an older
- * export); it is then derived from the name.
- */
-
-import { downloadJsonAsFile } from "@app/utils/downloadUtils";
-import { LABEL_ICON_KEYS } from "@app/data/labelIcons";
-import {
-  labelId,
-  type ClassificationLabel,
-} from "@app/data/classificationLabels";
-
-// Kept in sync with the backend LabelsValidator (the authority); enforced here
-// too so an oversized import is rejected before upload.
-const MAX_LABELS = 500;
-const MAX_TEXT_LENGTH = 128;
-
-interface LabelsFileShape {
-  labels: ClassificationLabel[];
-}
-
-/** A label's effective id: the provided one, else derived from the name. */
-function effectiveId(label: Partial<ClassificationLabel>): string {
-  const provided = typeof label.id === "string" ? label.id.trim() : "";
-  return provided || labelId(label.name?.trim() ?? "");
-}
-
-/** Human-readable problems with a candidate labels file; empty means valid. */
-export function validateLabels(value: unknown): string[] {
-  const errors: string[] = [];
-  if (typeof value !== "object" || value === null) {
-    return ["File is not a labels object."];
-  }
-  const { labels } = value as Partial<LabelsFileShape>;
-  if (!Array.isArray(labels)) {
-    return ['File must have a "labels" list.'];
-  }
-  if (labels.length > MAX_LABELS) {
-    errors.push(`Too many labels (max ${MAX_LABELS}).`);
-  }
-  const seenIds = new Set<string>();
-  for (const label of labels) {
-    if (!isText(label?.name)) {
-      errors.push("Every label needs a non-empty name.");
-      continue;
-    }
-    const name = label.name.trim();
-    if (name.length > MAX_TEXT_LENGTH) {
-      errors.push(`Label "${name}" is over ${MAX_TEXT_LENGTH} characters.`);
-    }
-    const id = effectiveId(label);
-    if (!id) {
-      errors.push(`Label "${name}" has no usable id.`);
-      continue;
-    }
-    if (seenIds.has(id)) errors.push(`Duplicate label: ${name}`);
-    seenIds.add(id);
-  }
-  return errors;
-}
-
-/** Coerce a validated value into a normalized label list (trims, drops extras). */
-export function normalizeLabels(
-  labels: ClassificationLabel[],
-): ClassificationLabel[] {
-  return labels.map((label): ClassificationLabel => {
-    const name = label.name.trim();
-    const id = effectiveId(label);
-    // Keep the icon only if it's a known palette key, so a hand-crafted import
-    // can't set an unbundled key that renders blank.
-    return label.icon && LABEL_ICON_KEYS.has(label.icon)
-      ? { id, name, icon: label.icon }
-      : { id, name };
-  });
-}
-
-/** Parse + validate a picked file, resolving to a normalized label list. */
-export async function parseLabelsFile(
-  file: File,
-): Promise<ClassificationLabel[]> {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(await file.text());
-  } catch {
-    throw new Error("That file isn't valid JSON.");
-  }
-  const errors = validateLabels(parsed);
-  if (errors.length > 0) throw new Error(errors[0]);
-  return normalizeLabels((parsed as LabelsFileShape).labels);
-}
-
-/** Trigger a download of the labels as a pretty-printed JSON file. */
-export function downloadLabels(
-  labels: ClassificationLabel[],
-  fileName = "classification-labels.json",
-): void {
-  downloadJsonAsFile({ labels }, fileName);
-}
-
-function isText(value: unknown): value is string {
-  return typeof value === "string" && value.trim().length > 0;
-}
diff --git a/frontend/editor/src/saas/components/shared/FileSidebarGroupControls.css b/frontend/editor/src/saas/components/shared/FileSidebarGroupControls.css
index de669c7f29..16712e351a 100644
--- a/frontend/editor/src/saas/components/shared/FileSidebarGroupControls.css
+++ b/frontend/editor/src/saas/components/shared/FileSidebarGroupControls.css
@@ -1,10 +1,4 @@
-/* Category-manager modal: editable parent categories with member-label chips.
-   Matches the labels editor's width so the two read as a set. */
-.fsg-modal {
-  width: min(1100px, 94vw);
-  max-width: min(1100px, 94vw);
-}
-
+/* Category show/hide modal (Files-sidebar visibility picker). */
 .fsg-body {
   display: flex;
   flex-direction: column;
@@ -14,119 +8,6 @@
   padding-right: 4px;
 }
 
-.fsg-cat {
-  display: flex;
-  flex-direction: column;
-  gap: 6px;
-}
-
-.fsg-cat-header {
-  display: flex;
-  align-items: center;
-  gap: 6px;
-  font-size: 13px;
-  font-weight: 600;
-  color: var(--text-primary, inherit);
-}
-
-.fsg-cat-toggle {
-  display: inline-flex;
-  border: none;
-  background: transparent;
-  padding: 0;
-  cursor: pointer;
-}
-
-.fsg-chevron {
-  font-size: 1.1rem !important;
-  color: var(--text-muted, rgba(128, 128, 128, 0.9));
-  margin-left: -4px;
-}
-
-.fsg-cat-name {
-  flex: 1;
-  text-align: left;
-  border: none;
-  background: transparent;
-  padding: 2px 4px;
-  border-radius: 4px;
-  font: inherit;
-  color: inherit;
-  cursor: text;
-}
-
-.fsg-cat-name:hover {
-  background: var(--hover-bg, rgba(128, 128, 128, 0.12));
-}
-
-.fsg-rename {
-  flex: 1;
-}
-
-.fsg-cat-action {
-  display: inline-flex;
-  border: none;
-  background: transparent;
-  padding: 2px;
-  border-radius: 4px;
-  cursor: pointer;
-  color: var(--text-muted, rgba(128, 128, 128, 0.9));
-}
-
-.fsg-cat-action:hover {
-  background: var(--hover-bg, rgba(128, 128, 128, 0.12));
-  color: var(--text-primary, inherit);
-}
-
-.fsg-cat-body {
-  display: flex;
-  flex-direction: column;
-  gap: 6px;
-  /* Indent past the chevron so the hierarchy reads at a glance. */
-  padding-left: 24px;
-}
-
-/* Member chips are the shared @app/ui/LabelChip. */
-.fsg-chips {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 4px;
-}
-
-.fsg-count {
-  font-size: 11px;
-  font-weight: 500;
-  color: var(--text-muted, rgba(128, 128, 128, 0.9));
-}
-
-.fsg-add,
-.fsg-new {
-  display: flex;
-  align-items: center;
-  gap: 6px;
-}
-
-.fsg-new {
-  padding-top: 4px;
-  border-top: 1px solid var(--border-subtle, rgba(128, 128, 128, 0.2));
-}
-
-.fsg-add-input {
-  flex: 1;
-  min-width: 0;
-  padding: 4px 8px;
-  font-size: 12px;
-  border: 1px solid var(--border-subtle, rgba(128, 128, 128, 0.35));
-  border-radius: 6px;
-  background: transparent;
-  color: var(--text-primary, inherit);
-}
-
-.fsg-add-input:focus {
-  outline: none;
-  border-color: var(--color-primary, #4f46e5);
-}
-
 .fsg-footer {
   display: flex;
   justify-content: space-between;
diff --git a/frontend/editor/src/saas/components/shared/FileSidebarGroupControls.tsx b/frontend/editor/src/saas/components/shared/FileSidebarGroupControls.tsx
index 12e1430e3c..41d1358594 100644
--- a/frontend/editor/src/saas/components/shared/FileSidebarGroupControls.tsx
+++ b/frontend/editor/src/saas/components/shared/FileSidebarGroupControls.tsx
@@ -1,74 +1,46 @@
-// The Files-sidebar category manager: a "tune" button opening a modal where you shape the parent categories your files group under. Each category (collapsible, busiest first) has an editable name + icon, a hide toggle, delete, and its member-label chips; add existing team labels to a category, create new categories, reset to the built-in defaults. All device-local (grouping only — it never changes the team's label vocabulary); files in no visible category fall back to "Other".
+// The Files-sidebar category picker: a "tune" button opening a modal that lists the fixed, shared
+// categories and lets the user show or hide each one in their own sidebar. Device-local and
+// presentational only — it never changes the shared categories or the label vocabulary; files in a
+// hidden (or no) category fall back to "Other".
 
 import { useMemo, useState, useSyncExternalStore } from "react";
 import { useTranslation } from "react-i18next";
 import TuneIcon from "@mui/icons-material/Tune";
 import RestartAltIcon from "@mui/icons-material/RestartAlt";
-import KeyboardArrowDownIcon from "@mui/icons-material/KeyboardArrowDown";
-import KeyboardArrowRightIcon from "@mui/icons-material/KeyboardArrowRight";
-import DeleteOutlineIcon from "@mui/icons-material/DeleteOutlined";
-import VisibilityIcon from "@mui/icons-material/Visibility";
-import VisibilityOffIcon from "@mui/icons-material/VisibilityOff";
-import AddIcon from "@mui/icons-material/Add";
-import { TextInput } from "@mantine/core";
 import { Modal } from "@app/ui/Modal";
 import { Button } from "@app/ui/Button";
 import { ActionIcon } from "@app/ui/ActionIcon";
-import { LabelChip } from "@app/ui/LabelChip";
-import { LabelIconPicker } from "@app/components/policies/LabelIconPicker";
+import { ClassificationCategoryManager } from "@app/components/policies/ClassificationCategoryManager";
 import { useClassificationEnabled } from "@app/hooks/useClassificationEnabled";
-import { useClassificationLabels } from "@app/hooks/useClassificationLabels";
-import { DEFAULT_LABEL_ICON } from "@app/data/labelIcons";
 import { bucketStubsByLabel } from "@app/components/shared/fileSidebarGroupingLogic";
 import {
-  addCategory,
-  addLabelToCategory,
-  deleteCategory,
   getSidebarCategories,
-  removeLabelFromCategory,
-  renameCategory,
-  resetSidebarCategories,
+  resetHiddenCategories,
   setCategoryHidden,
-  setCategoryIcon,
   subscribeSidebarCategories,
 } from "@app/services/fileSidebarCategories";
 import type { StirlingFileStub } from "@app/types/fileContext";
 import "@app/components/shared/FileSidebarGroupControls.css";
 
 interface FileSidebarGroupControlsProps {
-  /** The files currently listed, for live per-label counts. */
+  /** The files currently listed, for live per-category counts. */
   stubs: StirlingFileStub[];
 }
 
-/** New categories start with a neutral folder icon the user can change. */
-const NEW_CATEGORY_ICON = "folder";
-
 export function FileSidebarGroupControls({
   stubs,
 }: FileSidebarGroupControlsProps) {
   const { t } = useTranslation();
   const enabled = useClassificationEnabled();
   const [open, setOpen] = useState(false);
-  const [query, setQuery] = useState("");
   const categories = useSyncExternalStore(
     subscribeSidebarCategories,
     getSidebarCategories,
   );
-  // Only fetch the team label set while the picker is open.
-  const { teamLabels: labelSet } = useClassificationLabels(open);
 
-  // Bucketed once and reused for both the per-label and per-category counts below.
-  const byLabel = useMemo(() => bucketStubsByLabel(stubs), [stubs]);
-
-  // Per-label file counts from the same bucketing the sidebar groups use.
-  const labelCounts = useMemo(() => {
-    const counts = new Map<string, number>();
-    for (const [key, bucket] of byLabel) counts.set(key, bucket.stubs.length);
-    return counts;
-  }, [byLabel]);
-
-  // Files per category (deduped across its labels).
+  // Files per category (deduped across its labels), from the same bucketing the sidebar groups use.
   const categoryCounts = useMemo(() => {
+    const byLabel = bucketStubsByLabel(stubs);
     const counts = new Map<string, number>();
     for (const category of categories) {
       const ids = new Set<string>();
@@ -80,90 +52,7 @@ export function FileSidebarGroupControls({
       counts.set(category.id, ids.size);
     }
     return counts;
-  }, [byLabel, categories]);
-
-  // Translated display name + icon per label id, plus a name→id lookup for the
-  // add-label input (which matches on the visible/canonical text).
-  const vocab = useMemo(() => {
-    const byId = new Map<string, { display: string; icon?: string }>();
-    const idByName = new Map<string, string>();
-    for (const label of labelSet) {
-      const display = t(`classification.labels.${label.id}`, label.name);
-      byId.set(label.id, { display, icon: label.icon });
-      idByName.set(display.toLowerCase(), label.id);
-      idByName.set(label.name.toLowerCase(), label.id);
-    }
-    return { byId, idByName };
-  }, [labelSet, t]);
-
-  const labelDisplay = (id: string) => vocab.byId.get(id)?.display ?? id;
-  const labelIcon = (id: string) =>
-    vocab.byId.get(id)?.icon ?? DEFAULT_LABEL_ICON;
-
-  const q = query.trim().toLowerCase();
-  const matches = (text: string) => q === "" || text.toLowerCase().includes(q);
-
-  // Busiest categories first (ties keep declaration order).
-  const sortedCategories = useMemo(
-    () =>
-      [...categories].sort(
-        (a, b) =>
-          (categoryCounts.get(b.id) ?? 0) - (categoryCounts.get(a.id) ?? 0),
-      ),
-    [categories, categoryCounts],
-  );
-
-  // Per-category collapse; on open only the busiest starts expanded.
-  const [expanded, setExpanded] = useState<ReadonlySet<string>>(new Set());
-  const toggleExpanded = (id: string) =>
-    setExpanded((prev) => {
-      const next = new Set(prev);
-      if (next.has(id)) next.delete(id);
-      else next.add(id);
-      return next;
-    });
-
-  // Inline rename + add-label drafts, keyed by category id.
-  const [renaming, setRenaming] = useState<string | null>(null);
-  const [renameDraft, setRenameDraft] = useState("");
-  const [addDraft, setAddDraft] = useState<Record<string, string>>({});
-  const [newCategory, setNewCategory] = useState("");
-
-  const openPicker = () => {
-    setQuery("");
-    setRenaming(null);
-    setNewCategory("");
-    setExpanded(
-      new Set(sortedCategories.length > 0 ? [sortedCategories[0].id] : []),
-    );
-    setOpen(true);
-  };
-
-  const commitRename = (id: string) => {
-    const name = renameDraft.trim();
-    if (name) renameCategory(id, name);
-    setRenaming(null);
-  };
-
-  // Add an existing team label to a category (device-local grouping only — categories don't change
-  // the team vocabulary). A name that isn't a known team label is ignored; the input's datalist
-  // steers callers to real ones.
-  const addLabel = (categoryId: string) => {
-    const name = (addDraft[categoryId] ?? "").trim();
-    if (!name) return;
-    const labelId = vocab.idByName.get(name.toLowerCase());
-    if (!labelId) return;
-    addLabelToCategory(categoryId, labelId);
-    setAddDraft((prev) => ({ ...prev, [categoryId]: "" }));
-  };
-
-  const createCategory = () => {
-    const name = newCategory.trim();
-    if (!name) return;
-    const id = addCategory(name, NEW_CATEGORY_ICON);
-    setExpanded((prev) => new Set(prev).add(id));
-    setNewCategory("");
-  };
+  }, [stubs, categories]);
 
   // Classification off (non-AI SaaS tenant) → no "customize groups" affordance,
   // matching the flat, ungrouped list. (All hooks above run unconditionally.)
@@ -175,7 +64,7 @@ export function FileSidebarGroupControls({
       <ActionIcon
         variant="quiet"
         className="file-sidebar-section-btn file-sidebar-section-btn-external"
-        onClick={openPicker}
+        onClick={() => setOpen(true)}
         aria-label={t("fileSidebar.customizeGroups", "Customize groups")}
         data-testid="customize-groups"
       >
@@ -185,12 +74,11 @@ export function FileSidebarGroupControls({
       <Modal
         open={open}
         onClose={() => setOpen(false)}
-        width="xl"
-        className="fsg-modal"
+        width="md"
         title={t("fileSidebar.groupsModal.title", "Sidebar categories")}
         subtitle={t(
           "fileSidebar.groupsModal.subtitle",
-          "Group your files into parent categories. Add existing or new labels to a category, rename it, or create your own. Files in none of your categories appear under “Other”.",
+          "Show or hide categories in the files sidebar.",
         )}
         footer={
           <div className="fsg-footer">
@@ -198,9 +86,9 @@ export function FileSidebarGroupControls({
               variant="tertiary"
               size="sm"
               leftSection={<RestartAltIcon sx={{ fontSize: "1rem" }} />}
-              onClick={resetSidebarCategories}
+              onClick={resetHiddenCategories}
             >
-              {t("fileSidebar.groupsModal.reset", "Reset to defaults")}
+              {t("fileSidebar.groupsModal.reset", "Show all")}
             </Button>
             <Button variant="primary" size="sm" onClick={() => setOpen(false)}>
               {t("fileSidebar.groupsModal.done", "Done")}
@@ -209,201 +97,11 @@ export function FileSidebarGroupControls({
         }
       >
         <div className="fsg-body">
-          <TextInput
-            value={query}
-            onChange={(e) => setQuery(e.currentTarget.value)}
-            placeholder={t("fileSidebar.groupsModal.search", "Search labels…")}
-            size="sm"
-            data-autofocus
+          <ClassificationCategoryManager
+            categories={categories}
+            onToggleHidden={setCategoryHidden}
+            counts={categoryCounts}
           />
-
-          {sortedCategories.map((category) => {
-            const memberKeys = category.labelKeys.filter((key) =>
-              matches(labelDisplay(key)),
-            );
-            // Show the category if its name matches, or any member label matches.
-            if (!matches(category.name) && memberKeys.length === 0) return null;
-            const isExpanded = q !== "" || expanded.has(category.id);
-            const suggestions = [...vocab.byId.keys()]
-              .filter((id) => !category.labelKeys.includes(id))
-              .map((id) => labelDisplay(id));
-            return (
-              <section key={category.id} className="fsg-cat">
-                <div className="fsg-cat-header">
-                  <ActionIcon
-                    variant="quiet"
-                    className="fsg-cat-toggle"
-                    aria-expanded={isExpanded}
-                    aria-label={category.name}
-                    onClick={() => toggleExpanded(category.id)}
-                  >
-                    {isExpanded ? (
-                      <KeyboardArrowDownIcon className="fsg-chevron" />
-                    ) : (
-                      <KeyboardArrowRightIcon className="fsg-chevron" />
-                    )}
-                  </ActionIcon>
-                  <LabelIconPicker
-                    value={category.icon}
-                    onChange={(icon) => setCategoryIcon(category.id, icon)}
-                    ariaLabel={t(
-                      "fileSidebar.groupsModal.categoryIconAria",
-                      "Choose an icon for {{name}}",
-                      { name: category.name },
-                    )}
-                  />
-                  {renaming === category.id ? (
-                    <TextInput
-                      className="fsg-rename"
-                      size="xs"
-                      value={renameDraft}
-                      autoFocus
-                      onChange={(e) => setRenameDraft(e.currentTarget.value)}
-                      onBlur={() => commitRename(category.id)}
-                      onKeyDown={(e) => {
-                        if (e.key === "Enter") commitRename(category.id);
-                        if (e.key === "Escape") setRenaming(null);
-                      }}
-                    />
-                  ) : (
-                    <Button
-                      variant="quiet"
-                      size="sm"
-                      justify="start"
-                      className="fsg-cat-name"
-                      title={t("fileSidebar.groupsModal.rename", "Rename")}
-                      onClick={() => {
-                        setRenaming(category.id);
-                        setRenameDraft(category.name);
-                      }}
-                    >
-                      {category.name}
-                    </Button>
-                  )}
-                  <span className="fsg-count">
-                    {categoryCounts.get(category.id) ?? 0}
-                  </span>
-                  <ActionIcon
-                    variant="quiet"
-                    className="fsg-cat-action"
-                    aria-label={
-                      category.hidden
-                        ? t("fileSidebar.groupsModal.show", "Show category")
-                        : t("fileSidebar.groupsModal.hide", "Hide category")
-                    }
-                    aria-pressed={!category.hidden}
-                    onClick={() =>
-                      setCategoryHidden(category.id, !category.hidden)
-                    }
-                  >
-                    {category.hidden ? (
-                      <VisibilityOffIcon sx={{ fontSize: "1rem" }} />
-                    ) : (
-                      <VisibilityIcon sx={{ fontSize: "1rem" }} />
-                    )}
-                  </ActionIcon>
-                  <ActionIcon
-                    variant="quiet"
-                    className="fsg-cat-action"
-                    aria-label={t(
-                      "fileSidebar.groupsModal.delete",
-                      "Delete category",
-                    )}
-                    onClick={() => deleteCategory(category.id)}
-                  >
-                    <DeleteOutlineIcon sx={{ fontSize: "1rem" }} />
-                  </ActionIcon>
-                </div>
-
-                {isExpanded && (
-                  <div className="fsg-cat-body">
-                    <div className="fsg-chips">
-                      {memberKeys.map((key) => (
-                        <LabelChip
-                          key={key}
-                          label={labelDisplay(key)}
-                          icon={labelIcon(key)}
-                          count={labelCounts.get(key)}
-                          onRemove={() =>
-                            removeLabelFromCategory(category.id, key)
-                          }
-                          removeAriaLabel={t(
-                            "fileSidebar.groupsModal.removeLabel",
-                            "Remove {{name}}",
-                            { name: labelDisplay(key) },
-                          )}
-                        />
-                      ))}
-                    </div>
-                    <div className="fsg-add">
-                      <input
-                        className="fsg-add-input"
-                        list={`fsg-vocab-${category.id}`}
-                        value={addDraft[category.id] ?? ""}
-                        placeholder={t(
-                          "fileSidebar.groupsModal.addLabel",
-                          "Add a label…",
-                        )}
-                        onChange={(e) =>
-                          setAddDraft((prev) => ({
-                            ...prev,
-                            [category.id]: e.target.value,
-                          }))
-                        }
-                        onKeyDown={(e) => {
-                          if (e.key === "Enter") {
-                            e.preventDefault();
-                            addLabel(category.id);
-                          }
-                        }}
-                      />
-                      <datalist id={`fsg-vocab-${category.id}`}>
-                        {suggestions.map((name) => (
-                          <option key={name} value={name} />
-                        ))}
-                      </datalist>
-                      <Button
-                        variant="secondary"
-                        size="sm"
-                        leftSection={<AddIcon sx={{ fontSize: "0.9rem" }} />}
-                        onClick={() => addLabel(category.id)}
-                        disabled={!(addDraft[category.id] ?? "").trim()}
-                      >
-                        {t("fileSidebar.groupsModal.add", "Add")}
-                      </Button>
-                    </div>
-                  </div>
-                )}
-              </section>
-            );
-          })}
-
-          <div className="fsg-new">
-            <input
-              className="fsg-add-input"
-              value={newCategory}
-              placeholder={t(
-                "fileSidebar.groupsModal.newCategory",
-                "New category name…",
-              )}
-              onChange={(e) => setNewCategory(e.target.value)}
-              onKeyDown={(e) => {
-                if (e.key === "Enter") {
-                  e.preventDefault();
-                  createCategory();
-                }
-              }}
-            />
-            <Button
-              variant="secondary"
-              size="sm"
-              leftSection={<AddIcon sx={{ fontSize: "0.9rem" }} />}
-              onClick={createCategory}
-              disabled={!newCategory.trim()}
-            >
-              {t("fileSidebar.groupsModal.createCategory", "Create category")}
-            </Button>
-          </div>
         </div>
       </Modal>
     </>
diff --git a/frontend/editor/src/saas/components/shared/fileSidebarGrouping.test.ts b/frontend/editor/src/saas/components/shared/fileSidebarGrouping.test.ts
index ee55eabb5e..07f9d5c7db 100644
--- a/frontend/editor/src/saas/components/shared/fileSidebarGrouping.test.ts
+++ b/frontend/editor/src/saas/components/shared/fileSidebarGrouping.test.ts
@@ -35,7 +35,6 @@ describe("buildLabelGroups", () => {
         stub("b", ["contract"]),
         stub("c", ["nda", "contract"]),
       ],
-      [],
       t,
       [LEGAL],
     )!;
@@ -44,20 +43,15 @@ describe("buildLabelGroups", () => {
     expect(legal.stubs.map((s) => s.id)).toEqual(["a", "b", "c"]);
   });
 
-  it("gives a label not in any category its own group", () => {
-    const groups = buildLabelGroups(
-      [stub("a", ["weird-one"])],
-      [{ id: "weird-one", name: "Weird one" }],
-      t,
-      [LEGAL],
-    )!;
-    const group = groups.find((g) => g.id === "label:weird-one")!;
-    expect(group.label).toBe("Weird one");
-    expect(group.stubs.map((s) => s.id)).toEqual(["a"]);
+  it("puts a label in no category into Other", () => {
+    const groups = buildLabelGroups([stub("a", ["weird-one"])], t, [LEGAL])!;
+    expect(groups.some((g) => g.id.startsWith("category:"))).toBe(false);
+    expect(groups.at(-1)!.id).toBe("other");
+    expect(groups.at(-1)!.stubs.map((s) => s.id)).toEqual(["a"]);
   });
 
   it("moves a hidden category's files into Other", () => {
-    const groups = buildLabelGroups([stub("a", ["invoice"])], [], t, [
+    const groups = buildLabelGroups([stub("a", ["invoice"])], t, [
       cat("finance", "Financial", ["invoice"], true),
     ])!;
     expect(groups.some((g) => g.id === "category:finance")).toBe(false);
@@ -66,7 +60,7 @@ describe("buildLabelGroups", () => {
   });
 
   it("a file with labels in two categories appears in both", () => {
-    const groups = buildLabelGroups([stub("a", ["nda", "invoice"])], [], t, [
+    const groups = buildLabelGroups([stub("a", ["nda", "invoice"])], t, [
       LEGAL,
       FINANCE,
     ])!;
@@ -82,7 +76,6 @@ describe("buildLabelGroups", () => {
   it("puts unlabelled files in Other at the bottom", () => {
     const groups = buildLabelGroups(
       [stub("a", ["invoice"]), stub("b"), stub("c", [])],
-      [],
       t,
       [FINANCE],
     )!;
@@ -91,7 +84,7 @@ describe("buildLabelGroups", () => {
     expect(other.stubs.map((s) => s.id)).toEqual(["b", "c"]);
   });
 
-  it("orders groups: Recent, groups alphabetically, Other last", () => {
+  it("orders groups: Recent, categories alphabetically, Other last", () => {
     const groups = buildLabelGroups(
       [
         stub("a", ["invoice"]),
@@ -99,20 +92,19 @@ describe("buildLabelGroups", () => {
         stub("c", ["zzz"]),
         stub("d"),
       ],
-      [],
       t,
       [LEGAL, FINANCE],
     )!;
+    // "zzz" is in no category, so its file falls to Other with the unlabelled one.
     expect(groups.map((g) => g.id)).toEqual([
       "recent",
       "category:finance",
       "category:legal",
-      "label:zzz",
       "other",
     ]);
   });
 
   it("returns null for an empty library", () => {
-    expect(buildLabelGroups([], [], t, [LEGAL])).toBeNull();
+    expect(buildLabelGroups([], t, [LEGAL])).toBeNull();
   });
 });
diff --git a/frontend/editor/src/saas/components/shared/fileSidebarGrouping.tsx b/frontend/editor/src/saas/components/shared/fileSidebarGrouping.tsx
index 911b44de26..659efbdf31 100644
--- a/frontend/editor/src/saas/components/shared/fileSidebarGrouping.tsx
+++ b/frontend/editor/src/saas/components/shared/fileSidebarGrouping.tsx
@@ -1,4 +1,4 @@
-// Classification override of the Files-sidebar grouping seam: Recent, one group per VISIBLE category (device-local, editable — default from the built-in label families), a standalone group for any label not yet in a category, then Other for files in none of those. Labels are cached on the stub via a lazy metadata backfill so grouping stays cheap.
+// Classification override of the Files-sidebar grouping seam: Recent, one group per VISIBLE category (the fixed, shared label families; each can be hidden device-local), then Other for files in none of those. Labels are cached on the stub via a lazy metadata backfill so grouping stays cheap.
 
 import {
   useEffect,
@@ -10,7 +10,6 @@ import {
 import { useTranslation } from "react-i18next";
 import { useIndexedDB } from "@app/contexts/IndexedDBContext";
 import { useClassificationEnabled } from "@app/hooks/useClassificationEnabled";
-import { useClassificationLabels } from "@app/hooks/useClassificationLabels";
 import { fileStorage } from "@app/services/fileStorage";
 import { readStubClassificationLabels } from "@app/services/fileClassification";
 import { hasInFlightPolicyRuns } from "@app/components/policies/policyRunStore";
@@ -55,7 +54,6 @@ export function useFileSidebarGroups(
   // like core, and don't fetch team labels or backfill from metadata. Gates the
   // whole feature so an AI-off SaaS tenant sees no Recent/Other/category chrome.
   const enabled = useClassificationEnabled();
-  const { teamLabels: labelSet } = useClassificationLabels(enabled);
   const { bumpRevision } = useIndexedDB();
   // Attempted reads keyed by id+lastModified: a re-classified file (new version bumps lastModified) is re-read and leaves "Other" on its own, while a truly-unlabelled file keeps a stable key and is read once.
   const attempted = useRef<Set<string>>(new Set());
@@ -113,7 +111,7 @@ export function useFileSidebarGroups(
     getSidebarCategories,
   );
   return useMemo(
-    () => (enabled ? buildLabelGroups(stubs, labelSet, t, categories) : null),
-    [enabled, stubs, labelSet, t, categories],
+    () => (enabled ? buildLabelGroups(stubs, t, categories) : null),
+    [enabled, stubs, t, categories],
   );
 }
diff --git a/frontend/editor/src/saas/components/shared/fileSidebarGroupingLogic.ts b/frontend/editor/src/saas/components/shared/fileSidebarGroupingLogic.ts
index 5b61d4a18b..82569a9bd5 100644
--- a/frontend/editor/src/saas/components/shared/fileSidebarGroupingLogic.ts
+++ b/frontend/editor/src/saas/components/shared/fileSidebarGroupingLogic.ts
@@ -2,10 +2,7 @@
 
 import { DEFAULT_LABEL_ICON } from "@app/data/labelIcons";
 import { accentColor, accentCycleColor } from "@app/utils/accentColors";
-import {
-  categorizedLabelKeys,
-  type SidebarCategory,
-} from "@app/services/fileSidebarCategories";
+import type { SidebarCategory } from "@app/services/fileSidebarCategories";
 import type { StirlingFileStub } from "@app/types/fileContext";
 import type { FileSidebarGroup } from "@core/components/shared/fileSidebarGrouping";
 
@@ -30,37 +27,22 @@ export function bucketStubsByLabel(
 }
 
 /**
- * Pure grouping: Recent (top {@link RECENT_COUNT} by lastModified), then visible groups sorted
- * alphabetically, then Other (files in no visible group) last. Visible groups are the non-hidden
- * {@link SidebarCategory} entries with ≥1 file (a file lands in every category it has a label in),
- * plus a standalone group for any label on a file that isn't in a category yet.
+ * Pure grouping: Recent (top {@link RECENT_COUNT} by lastModified), then one group per VISIBLE
+ * category with ≥1 file (a file lands in every category it has a label in), sorted alphabetically,
+ * then Other (files in no visible category) last. Categories are the fixed, shared set; a category
+ * the user has hidden forms no group, so its files fall to Other.
  */
 export function buildLabelGroups(
   stubs: StirlingFileStub[],
-  labelSet: readonly { id: string; name: string; icon?: string }[],
   t: (key: string, fallback: string) => string,
   categories: SidebarCategory[],
 ): FileSidebarGroup[] | null {
   if (stubs.length === 0) return null;
 
-  // Display name + icon per label id from the effective set; ids no longer in the
-  // set still group, resolving to the id text and the default icon.
-  const nameById = new Map<string, string>();
-  const iconById = new Map<string, string | undefined>();
-  for (const label of labelSet) {
-    nameById.set(label.id, label.name);
-    iconById.set(label.id, label.icon);
-  }
-  const labelName = (id: string) =>
-    t(`classification.labels.${id}`, nameById.get(id) ?? id);
-
   const recent = [...stubs]
     .sort((a, b) => (b.lastModified ?? 0) - (a.lastModified ?? 0))
     .slice(0, RECENT_COUNT);
 
-  const byLabel = bucketStubsByLabel(stubs);
-  const inACategory = categorizedLabelKeys(categories);
-
   const visible: Omit<FileSidebarGroup, "color">[] = [];
 
   // One group per visible category: every file carrying any of its labels, in the input's order
@@ -81,19 +63,6 @@ export function buildLabelGroups(
     });
   }
 
-  // A label on a file but not in any category still gets its own group, so nothing is stranded
-  // until the user files it into a category.
-  for (const [labelId, bucket] of byLabel) {
-    if (inACategory.has(labelId)) continue;
-    visible.push({
-      id: `label:${labelId}`,
-      label: labelName(labelId),
-      icon: iconById.get(labelId) ?? DEFAULT_LABEL_ICON,
-      stubs: bucket.stubs,
-      defaultExpanded: false,
-    });
-  }
-
   visible.sort((a, b) =>
     a.label.localeCompare(b.label, undefined, { sensitivity: "base" }),
   );

From b86e963c9d6277f6f8397247d20170c46619dfe4 Mon Sep 17 00:00:00 2001
From: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Date: Wed, 15 Jul 2026 13:11:00 +0100
Subject: [PATCH 022/109] initial colors and theme improvements (#7009)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What this does

Consolidates the frontend's colour/theme system into a small,
well-defined token layer and reworks the theme picker. The goal was a
minimal, scalable set of semantic tokens that the editor **and** the
Processor/portal (and Storybook) all share, plus a theme model that's
easy to reason about.

## Token architecture (`core/theme/`)

A four-file layer, imported once via `index.css`:

| File | Role |
|---|---|
| `primitives.css` | The raw palette — the **only** place literal
colours live (neutral ramps `--p-gray-*`/`--p-zinc-*` + status hues). |
| `colors.css` | ~21 semantic `--c-*` tokens (surfaces, text, borders,
primary, status) mapped from primitives per theme. **Reference these.**
|
| `compat.css` | Legacy names (`--bg-*`, `--text-*`, `--color-*`)
aliased onto `--c-*` via `:root:root` so ~200 existing files keep
working. |
| `dimensions.css` | All non-colour tokens (spacing, radius, z-index,
type, motion) — single source, resolving prior collisions. |

A blocking linter (`scripts/lint/theme-lint.mjs`, run in
`frontend:lint`) enforces "literals only in `primitives.css`" within
`core/theme/`, and has a non-blocking WCAG contrast report. See
`core/theme/README.md`.

## Theme model

- **Mode** (`light` / `dark` / `system`) and **accent** are independent.
Each mode has its own accent (`lightPrimary` / `darkPrimary`).
- The editor is always `data-app-theme="custom"`; `ThemeProvider`
injects the accent as `--user-primary` and sets `data-accent`.
- **Two accent states:**
- A **colour** (preset or custom hex) → tints every surface that hue
(whole-app theming).
- The **`default`** sentinel → neutral surfaces (white/grey light, zinc
black/grey dark) with blue buttons, no tint. (`data-accent="default"`
opts surfaces out of the tint.)
- Accent contrast guardrails (`utils/customPrimary.ts`): lightness
clamps so an accent can't collapse into the base, a contrast-picked
on-primary foreground, and an accent-as-foreground variant so accent
text is never dark-on-dark.

## Theme picker (Settings → General)

- 3×5 grid: a distinct **Default** icon chip (not a colour) + 14 curated
accents, in a dropdown per mode.
- **Custom** colour via the shared `ColorInput`, with a live gamut clamp
(`clampValue`) that refuses white/grey/black — the picker handle sticks
at the boundary and preserves the working hue at achromatic extremes.
- "Restore theme to default" resets both modes.

## Other

- Dark mode is a true neutral zinc (no navy "midnight" tint); the
Mantine dark ramp and Tailwind dark channels were neutralised to match.
- Pre-paint inline script in `index.html` applies theme + accent before
first paint (no FOUC); portal and editor now share the same
`preferences.theme` source of truth.
- High-visibility surfaces migrated to tokens (FAB, landing upload
buttons, portal hero banners); scattered per-component colour swaps were
intentionally **left for a follow-up** to keep this PR focused.

## Testing

- `task frontend:check:all` (typecheck all variants + eslint + prettier
+ colour-lint) green.
- Verified light/dark, default vs tinted accents, and the custom clamp
via computed styles in the dev preview.

> Note: the `prerender-og` build step failing in the e2e/deploy jobs is
unrelated to this diff — it's in `vite.config.ts` (untouched here) and
builds cleanly locally.
---
 .taskfiles/frontend.yml                       |  13 +
 AGENTS.md                                     |   2 +
 frontend/.storybook/main.ts                   |   4 +
 frontend/.storybook/preview.tsx               |  19 +-
 frontend/.storybook/tsconfig.json             |   3 +-
 frontend/editor/index.html                    |  28 +
 .../public/locales/en-US/translation.toml     |  11 +-
 frontend/editor/scripts/lint/theme-lint.mjs   | 329 ++++++++
 .../fileEditor/FileEditor.module.css          |   2 +-
 .../core/components/shared/LandingActions.tsx |  16 +-
 .../core/components/shared/LandingPage.css    |   2 +-
 .../components/shared/LoadingFallback.tsx     |   9 +-
 .../core/components/shared/ThemeProvider.tsx  |  12 +-
 .../config/configSections/GeneralSection.tsx  |  54 +-
 frontend/editor/src/core/constants/theme.ts   |  10 +-
 frontend/editor/src/core/styles/theme.css     | 781 ++++++------------
 frontend/editor/src/core/theme/README.md      |  75 ++
 frontend/editor/src/core/theme/colors.css     | 264 ++++++
 frontend/editor/src/core/theme/compat.css     | 148 ++++
 frontend/editor/src/core/theme/dimensions.css |  65 ++
 frontend/editor/src/core/theme/index.css      |   5 +
 .../editor/src/core/theme/mantineTheme.ts     |  27 +-
 frontend/editor/src/core/theme/primitives.css |  45 +
 .../editor/src/core/tokens/Tokens.stories.tsx |   6 +-
 frontend/editor/src/core/tokens/base.css      |   4 +-
 frontend/editor/src/core/tokens/tokens.css    | 298 ++-----
 frontend/editor/src/core/ui/ChatFABButton.css |   8 +-
 frontend/editor/src/core/ui/accents.css       |   4 +
 .../portal/components/EditorStatusCard.css    |   2 +-
 .../src/portal/components/WelcomeBanner.css   |   2 +-
 .../src/portal/contexts/ThemeContext.tsx      |  54 +-
 .../src/proprietary/auth/ui/auth-theme.css    |  40 +-
 .../editor/src/saas/styles/saas-theme.css     | 196 +++--
 33 files changed, 1611 insertions(+), 927 deletions(-)
 create mode 100644 frontend/editor/scripts/lint/theme-lint.mjs
 create mode 100644 frontend/editor/src/core/theme/README.md
 create mode 100644 frontend/editor/src/core/theme/colors.css
 create mode 100644 frontend/editor/src/core/theme/compat.css
 create mode 100644 frontend/editor/src/core/theme/dimensions.css
 create mode 100644 frontend/editor/src/core/theme/index.css
 create mode 100644 frontend/editor/src/core/theme/primitives.css

diff --git a/.taskfiles/frontend.yml b/.taskfiles/frontend.yml
index b402df7d1b..35b387025a 100644
--- a/.taskfiles/frontend.yml
+++ b/.taskfiles/frontend.yml
@@ -203,6 +203,19 @@ tasks:
     cmds:
       - task: lint:eslint
       - task: lint:dpdm
+      - task: lint:colors
+
+  lint:colors:
+    desc: "Enforce theme tokens — colours in core/theme route through the palette"
+    deps: [install]
+    cmds:
+      - node editor/scripts/lint/theme-lint.mjs
+
+  contrast:
+    desc: "Report low-contrast theme token pairs (warning only, never blocks)"
+    deps: [install]
+    cmds:
+      - node editor/scripts/lint/theme-lint.mjs contrast
 
   lint:eslint:
     desc: "Run ESLint linting"
diff --git a/AGENTS.md b/AGENTS.md
index 7e529e4be9..259729bc04 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -155,6 +155,8 @@ The project structure is defined in `engine/pyproject.toml`. Any new dependencie
 
 For a broader explanation of the frontend layering and override architecture, read @frontend/editor/DeveloperGuide.md
 
+Before touching colours or theming (tokens, dark mode, accent colours), read @frontend/editor/src/core/theme/README.md — it explains the palette/`--c-*` token system and the rule that literal colours live only in `primitives.css`.
+
 ```typescript
 // ✅ CORRECT - Use @app/* for all imports
 import { AppLayout } from "@app/components/AppLayout";
diff --git a/frontend/.storybook/main.ts b/frontend/.storybook/main.ts
index 8547e9092a..be281b9ae3 100644
--- a/frontend/.storybook/main.ts
+++ b/frontend/.storybook/main.ts
@@ -38,6 +38,10 @@ const config: StorybookConfig = {
       // modules (e.g. the auth supabase client that moved into proprietary).
       "@proprietary": resolve(__dirname, "../editor/src/proprietary"),
       "@core": resolve(__dirname, "../editor/src/core"),
+      // Public assets (e.g. the en-US translation TOML loaded ?raw by preview.tsx).
+      // No src alias covers public/, so this lets the config use an alias rather
+      // than a relative path.
+      "@public": resolve(__dirname, "../editor/public"),
     };
     // Editor stories import via @app/* (proprietary→core fallback), @core/* and
     // @proprietary/*. Resolve them exactly the way the editor's own build does —
diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index a0b1549f2a..fd3673ca1a 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -24,11 +24,11 @@ import { initReactI18next } from "react-i18next";
 import { parse as parseToml } from "smol-toml";
 // Load the real English copy so stories render human text, not raw keys. Bundled
 // synchronously via ?raw so it's present on the very first render (no async flash).
-// eslint-disable-next-line no-restricted-imports -- Storybook-only: read the public i18n asset; no @-alias covers editor/public/.
-import enTranslationToml from "../editor/public/locales/en-US/translation.toml?raw";
+import enTranslationToml from "@public/locales/en-US/translation.toml?raw";
 
 import "@mantine/core/styles.css";
 import "@core/tokens/tokens.css";
+import "@core/theme/index.css";
 import "@core/tokens/base.css";
 
 // Storybook-only: init react-i18next with the real English resources parsed from
@@ -124,6 +124,20 @@ function ThemeBridge({
   return <>{children}</>;
 }
 
+/**
+ * Sets the theme attributes colors.css needs — always `data-app-theme="custom"`
+ * with the fixed default accent (data-accent="default"), matching the editor.
+ */
+function SchemeSetup({ scheme }: { scheme: "light" | "dark" }) {
+  useEffect(() => {
+    const root = document.documentElement;
+    root.setAttribute("data-app-theme", "custom");
+    root.setAttribute("data-accent", "default");
+    root.setAttribute("data-mantine-color-scheme", scheme);
+  }, [scheme]);
+  return null;
+}
+
 const withProviders: Decorator = (Story, context) => {
   const tier = (context.globals.tier as Tier) ?? "pro";
   const linkState =
@@ -138,6 +152,7 @@ const withProviders: Decorator = (Story, context) => {
   return (
     <MemoryRouter initialEntries={["/"]}>
       <ThemeProvider>
+        <SchemeSetup scheme={colorScheme} />
         <ThemeBridge theme={colorScheme}>
           <SuiProvider colorScheme={colorScheme}>
             {/* LinkProvider must wrap TierProvider: TierContext derives its tier
diff --git a/frontend/.storybook/tsconfig.json b/frontend/.storybook/tsconfig.json
index 9615d34a22..cb3f958b2a 100644
--- a/frontend/.storybook/tsconfig.json
+++ b/frontend/.storybook/tsconfig.json
@@ -12,7 +12,8 @@
       ],
       "@core/*": ["../editor/src/core/*"],
       "@proprietary/*": ["../editor/src/proprietary/*"],
-      "@portal/*": ["../editor/src/portal/*"]
+      "@portal/*": ["../editor/src/portal/*"],
+      "@public/*": ["../editor/public/*"]
     },
     "resolveJsonModule": true,
     "esModuleInterop": true,
diff --git a/frontend/editor/index.html b/frontend/editor/index.html
index c5599cb3c8..427b6d1449 100644
--- a/frontend/editor/index.html
+++ b/frontend/editor/index.html
@@ -14,6 +14,34 @@
     <link rel="manifest" href="manifest.json" />
 
     <title>Stirling PDF</title>
+
+    <!-- Apply theme before first paint (no FOUC); mirrors ThemeProvider, which then refines it. -->
+    <script>
+      (function () {
+        try {
+          var p = JSON.parse(
+            localStorage.getItem("stirlingpdf_preferences") || "{}",
+          );
+          var mode = p.theme || "system";
+          var scheme =
+            mode === "light"
+              ? "light"
+              : mode === "dark"
+                ? "dark"
+                : window.matchMedia &&
+                    window.matchMedia("(prefers-color-scheme: dark)").matches
+                  ? "dark"
+                  : "light";
+          var r = document.documentElement;
+          r.setAttribute("data-theme", scheme);
+          r.setAttribute("data-app-theme", "custom");
+          r.setAttribute("data-accent", "default");
+          r.setAttribute("data-mantine-color-scheme", scheme);
+        } catch (e) {
+          /* first visit / unavailable storage: ThemeProvider handles it */
+        }
+      })();
+    </script>
   </head>
   <body>
     <noscript>You need to enable JavaScript to run this app.</noscript>
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index cb8b4d6fb7..dfff2e9242 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -8997,9 +8997,18 @@ languageDescription = "Choose the display language"
 logout = "Log out"
 setAsDefault = "Set as Default"
 theme = "Theme"
+themeAccent = "Accent colour"
+themeAccentCustom = "Custom colour"
+themeAccentCustomHint = "Custom (defaults recommended)"
+themeAccentDark = "Dark mode accent colour"
+themeAccentDefault = "Default"
+themeAccentDefaultHint = "Default theme (recommended)"
+themeAccentDescription = "Buttons, links and highlights follow it, and it subtly tints the app. Light and dark each have their own. System uses whichever is active."
+themeAccentLight = "Light mode accent colour"
 themeDark = "Dark"
-themeDescription = "Choose light, dark, or follow your system"
+themeDescription = "Choose light, dark, or follow your system so it switches automatically."
 themeLight = "Light"
+themeReset = "Restore theme to default"
 themeSystem = "System"
 title = "General"
 user = "User"
diff --git a/frontend/editor/scripts/lint/theme-lint.mjs b/frontend/editor/scripts/lint/theme-lint.mjs
new file mode 100644
index 0000000000..b21b18f322
--- /dev/null
+++ b/frontend/editor/scripts/lint/theme-lint.mjs
@@ -0,0 +1,329 @@
+#!/usr/bin/env node
+// Theme colour lint — guards the theme SYSTEM (core/theme/). Two modes:
+//
+//   node theme-lint.mjs            enforce: literal colours live ONLY in
+//                                  primitives.css; colors/compat/dimensions must
+//                                  reference tokens; no duplicate primitives.
+//                                  (blocking)
+//   node theme-lint.mjs contrast   warn-only WCAG contrast report (never blocks)
+//
+// Scope is deliberately just core/theme/ — the palette + token layer this PR
+// owns, which is clean, so no baseline file is needed. Enforcing "no hardcoded
+// colours" across the whole app (260+ existing sites) is a separate migration.
+//
+// Structural black / white / transparent (shadows, scrims) are always allowed.
+
+import { readFileSync, readdirSync } from "node:fs";
+import { relative, resolve, join } from "node:path";
+
+const THEME = resolve(process.cwd(), "editor/src/core/theme");
+const PRIMITIVES = "editor/src/core/theme/primitives.css";
+
+// Fixed list of theme CSS files to check, so every read takes a constant path
+// (no directory-listing feeding into a file read). readdir is used only to fail
+// if a new .css is added without being registered — coverage can't silently
+// lapse — but its output is never passed to readFileSync.
+const THEME_FILES = [
+  "primitives.css",
+  "colors.css",
+  "compat.css",
+  "dimensions.css",
+  "index.css",
+];
+
+// ── colour helpers ─────────────────────────────────────────────────────────
+const HEX_RE = /#[0-9a-fA-F]{3,8}\b/g;
+const FUNC_RE = /\b(?:rgba?|hsla?)\(\s*[^)]*\)/g;
+const NAMED_RE =
+  /\b(?:white|black|red|green|blue|orange|yellow|purple|gray|grey|silver|transparent)\b/g;
+
+function expandHex(hex) {
+  let h = hex.slice(1).toLowerCase();
+  if (h.length === 3) h = [...h].map((c) => c + c).join("");
+  if (h.length === 4) h = [...h].map((c) => c + c).join("");
+  return "#" + h;
+}
+function normalizeColor(raw) {
+  const s = raw.trim().toLowerCase();
+  if (s.startsWith("#")) return expandHex(s);
+  const nums = s.match(/[\d.]+%?/g);
+  if (!nums) return s;
+  return `${s.startsWith("hsl") ? "hsl" : "rgb"}(${nums.join(",")})`;
+}
+function isStructuralColor(norm) {
+  return (
+    norm === "transparent" ||
+    /^#000000(00)?$/.test(norm) ||
+    /^#ffffff(ff)?$/.test(norm) ||
+    /^rgb\(0,0,0[,)]/.test(norm) ||
+    /^rgb\(255,255,255[,)]/.test(norm)
+  );
+}
+function isStructuralName(name) {
+  return /^(?:white|black|transparent)$/i.test(name.trim());
+}
+function stripComments(text) {
+  return text.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " "));
+}
+
+// ── enforce: literals only in primitives.css, no duplicate primitives ────────
+function check() {
+  const violations = [];
+  const primitiveValues = new Map();
+  const lineOf = (text, index) => text.slice(0, index).split("\n").length;
+
+  // Fail if a theme .css exists that isn't registered above (readdir is only
+  // compared here — never used to build a path passed to readFileSync).
+  const known = new Set(THEME_FILES);
+  for (const name of readdirSync(THEME)) {
+    if (name.endsWith(".css") && !known.has(name)) {
+      violations.push({
+        file: relative(process.cwd(), join(THEME, name)),
+        line: 1,
+        msg: `unregistered theme CSS — add "${name}" to THEME_FILES in theme-lint.mjs`,
+      });
+    }
+  }
+
+  for (const name of THEME_FILES) {
+    const rel = relative(process.cwd(), join(THEME, name));
+    const isPrimitives = rel === PRIMITIVES;
+    const text = stripComments(readFileSync(join(THEME, name), "utf8"));
+
+    for (const re of [HEX_RE, FUNC_RE]) {
+      re.lastIndex = 0;
+      let m;
+      while ((m = re.exec(text)) !== null) {
+        const norm = normalizeColor(m[0]);
+        if (isStructuralColor(norm)) continue;
+        if (isPrimitives) {
+          if (primitiveValues.has(norm)) {
+            violations.push({
+              file: rel,
+              line: lineOf(text, m.index),
+              msg: `duplicate primitive value ${norm} (also ${primitiveValues.get(norm)})`,
+            });
+          } else {
+            primitiveValues.set(norm, m[0]);
+          }
+        } else {
+          violations.push({
+            file: rel,
+            line: lineOf(text, m.index),
+            msg: `raw colour ${m[0]} — define it in primitives.css and use var()`,
+          });
+        }
+      }
+    }
+
+    // Named colours, only in value position.
+    if (!isPrimitives) {
+      text.split("\n").forEach((line, i) => {
+        const colon = line.indexOf(":");
+        if (colon < 0 || /[{}]/.test(line)) return;
+        // Property must be a lone identifier — a custom prop (--x) OR a standard
+        // property (color, border) — so `color: red` is checked, not just tokens,
+        // while selectors (`.foo:hover`) with a colon are skipped.
+        if (!/^\s*(?:--)?[a-z][a-z0-9-]*\s*$/i.test(line.slice(0, colon)))
+          return;
+        const value = line
+          .slice(colon + 1)
+          .replace(/--[a-z0-9-]+/gi, " ")
+          .replace(/url\([^)]*\)/g, " ")
+          .replace(/["'][^"']*["']/g, " ");
+        for (const nm of value.match(NAMED_RE) || []) {
+          if (isStructuralName(nm)) continue;
+          violations.push({
+            file: rel,
+            line: i + 1,
+            msg: `named colour "${nm}" — define it in primitives.css and use var()`,
+          });
+        }
+      });
+    }
+  }
+  return violations;
+}
+
+// ── contrast report (warn-only): resolve --c-* per theme, check legibility ───
+function reportContrast() {
+  const primitivesCss = readFileSync(join(THEME, "primitives.css"), "utf8");
+  const colorsCss = readFileSync(join(THEME, "colors.css"), "utf8");
+  const primitives = {};
+  for (const m of primitivesCss.matchAll(
+    /(--p-[a-z0-9-]+)\s*:\s*(#[0-9a-fA-F]{3,8})\s*;/g,
+  ))
+    primitives[m[1]] = m[2];
+  const blocks = [];
+  for (const m of colorsCss.matchAll(/([^{}]+)\{([^}]*)\}/g)) {
+    const decls = {};
+    for (const d of m[2].matchAll(/(--c-[a-z0-9-]+)\s*:\s*([^;]+);/g))
+      decls[d[1]] = d[2].trim();
+    if (Object.keys(decls).length)
+      blocks.push({ selector: m[1].trim(), decls });
+  }
+  // The editor always renders data-app-theme="custom"; the accent (--user-*) is
+  // injected at runtime, so seed the DEFAULT blue to resolve the custom tint
+  // statically. Themes = the ones that actually render: editor custom light/dark
+  // (data-app-theme="custom") and the portal's neutral dark (data-theme="dark").
+  const SEED = {
+    "--user-primary": "#3b82f6",
+    "--user-primary-on": "#ffffff",
+    "--user-accent-fg": "#3b82f6",
+  };
+  const pick = (re) => blocks.filter((b) => re.test(b.selector));
+  const lightBase = pick(/:root/);
+  const customBase = blocks.filter(
+    (b) =>
+      /app-theme="custom"/.test(b.selector) &&
+      !/color-scheme="dark"/.test(b.selector),
+  );
+  const customDark = pick(
+    /app-theme="custom"\]\[data-mantine-color-scheme="dark"/,
+  );
+  const midnight = pick(/data-theme="dark"/);
+  const themes = {
+    "editor light": [...lightBase, ...customBase],
+    "editor dark": [...lightBase, ...customBase, ...customDark],
+    "portal dark": [...lightBase, ...midnight],
+  };
+  const flatten = (list) =>
+    Object.assign({ ...SEED }, ...list.map((b) => b.decls));
+  const hexToRgb = (h) => {
+    h = h.replace("#", "");
+    if (h.length === 3)
+      h = h
+        .split("")
+        .map((c) => c + c)
+        .join("");
+    return {
+      r: parseInt(h.slice(0, 2), 16),
+      g: parseInt(h.slice(2, 4), 16),
+      b: parseInt(h.slice(4, 6), 16),
+      a: 1,
+    };
+  };
+  const over = (f, b) => ({
+    r: f.r * f.a + b.r * (1 - f.a),
+    g: f.g * f.a + b.g * (1 - f.a),
+    b: f.b * f.a + b.b * (1 - f.a),
+    a: 1,
+  });
+  const mix = (a, b, p) => ({
+    r: (a.r * p + b.r * (100 - p)) / 100,
+    g: (a.g * p + b.g * (100 - p)) / 100,
+    b: (a.b * p + b.b * (100 - p)) / 100,
+    a: 1,
+  });
+  // Resolve any token value: hex, rgb(a), var(--x[, fallback]) (--p-* → palette,
+  // else the theme map/seed), or color-mix(in srgb, A n%, B|transparent).
+  function resolveValue(v, t, seen) {
+    if (v == null) return null;
+    v = v.trim();
+    let m;
+    if (v.startsWith("#")) return hexToRgb(v);
+    if ((m = v.match(/^rgba?\(([^)]+)\)$/))) {
+      const n = m[1]
+        .split(/[,/\s]+/)
+        .map(Number)
+        .filter((x) => !Number.isNaN(x));
+      return { r: n[0], g: n[1], b: n[2], a: n[3] ?? 1 };
+    }
+    if ((m = v.match(/^var\(\s*(--[a-z0-9-]+)\s*(?:,\s*([\s\S]+))?\)$/))) {
+      return resolveVar(m[1], m[2], t, seen);
+    }
+    if ((m = v.match(/^color-mix\(in srgb,\s*(.+?)\s+(\d+)%\s*,\s*(.+)\)$/))) {
+      const a = resolveValue(m[1], t, seen);
+      if (!a) return null;
+      if (m[3].trim() === "transparent") return { ...a, a: +m[2] / 100 };
+      const b = resolveValue(m[3].trim(), t, seen);
+      return b ? mix(a, b, +m[2]) : null;
+    }
+    return null;
+  }
+  function resolveVar(name, fallback, t, seen) {
+    if (name.startsWith("--p-")) {
+      return primitives[name]
+        ? hexToRgb(primitives[name])
+        : fallback
+          ? resolveValue(fallback, t, seen)
+          : null;
+    }
+    if (!seen.has(name) && t[name] !== undefined) {
+      const next = new Set(seen).add(name);
+      const r = resolveValue(t[name], t, next);
+      if (r) return r;
+    }
+    return fallback ? resolveValue(fallback, t, seen) : null;
+  }
+  const resolve = (token, t) =>
+    resolveValue(t[token] ?? null, t, new Set([token]));
+  const lum = ({ r, g, b }) => {
+    const f = (v) => {
+      v /= 255;
+      return v <= 0.03928 ? v / 12.92 : ((v + 0.055) / 1.055) ** 2.4;
+    };
+    return 0.2126 * f(r) + 0.7152 * f(g) + 0.0722 * f(b);
+  };
+  const contrast = (t1, t2, t) => {
+    const surface = resolve("--c-surface", t);
+    let a = resolve(t1, t);
+    let b = resolve(t2, t);
+    if (!a || !b || !surface) return null;
+    if (a.a < 1) a = over(a, surface);
+    if (b.a < 1) b = over(b, surface);
+    const [hi, lo] = [lum(a), lum(b)].sort((x, y) => y - x);
+    return (hi + 0.05) / (lo + 0.05);
+  };
+  const PAIRS = [
+    ["--c-text", "--c-surface", 4.5],
+    ["--c-text-muted", "--c-surface", 4.5],
+    ["--c-text-subtle", "--c-surface", 4.5],
+    ["--c-text", "--c-bg", 4.5],
+    ["--c-text-on-primary", "--c-primary", 3.0],
+  ];
+  let warnings = 0;
+  console.log("contrast report (warning-only, default accent):\n");
+  for (const name of Object.keys(themes)) {
+    const t = flatten(themes[name]);
+    console.log(`  ${name}`);
+    for (const [t1, t2, floor] of PAIRS) {
+      const r = contrast(t1, t2, t);
+      if (r == null) {
+        console.log(`    ?     ${t1} on ${t2} (unresolved)`);
+        continue;
+      }
+      if (r < floor) warnings++;
+      console.log(
+        `    ${r < floor ? "⚠ " : "  "}${r.toFixed(2).padStart(5)}  (floor ${floor})  ${t1} on ${t2}`,
+      );
+    }
+    console.log("");
+  }
+  console.log(
+    warnings
+      ? `⚠ ${warnings} pair(s) below floor — review, not blocking.`
+      : "✓ all pairs clear their floor.",
+  );
+}
+
+// ── CLI ──────────────────────────────────────────────────────────────────────
+if (process.argv.includes("contrast")) {
+  reportContrast();
+  process.exit(0); // never blocks
+}
+
+const violations = check();
+if (violations.length) {
+  console.error(
+    `\n✖ theme-lint: ${violations.length} raw/duplicate colour(s) in core/theme/:\n`,
+  );
+  for (const v of violations) console.error(`  ${v.file}:${v.line}  ${v.msg}`);
+  console.error(
+    `\nDefine every colour once in core/theme/primitives.css and reference it with var(--p-…).\n`,
+  );
+  process.exit(1);
+}
+console.log(
+  "✓ theme-lint: core/theme colours all route through the primitive palette",
+);
diff --git a/frontend/editor/src/core/components/fileEditor/FileEditor.module.css b/frontend/editor/src/core/components/fileEditor/FileEditor.module.css
index da407cf261..037eddf742 100644
--- a/frontend/editor/src/core/components/fileEditor/FileEditor.module.css
+++ b/frontend/editor/src/core/components/fileEditor/FileEditor.module.css
@@ -332,7 +332,7 @@
   max-width: 260px;
   height: calc(310px - 0.5rem);
   margin: 0.5rem auto 0;
-  background: var(--file-card-bg);
+  background: var(--c-bg);
   border: 1.5px solid var(--border-default);
   border-radius: 12px;
   box-shadow: var(--shadow-md);
diff --git a/frontend/editor/src/core/components/shared/LandingActions.tsx b/frontend/editor/src/core/components/shared/LandingActions.tsx
index 3d801f82de..ec237b0394 100644
--- a/frontend/editor/src/core/components/shared/LandingActions.tsx
+++ b/frontend/editor/src/core/components/shared/LandingActions.tsx
@@ -34,12 +34,7 @@ export function LandingActions({
         <Button
           className="landing-btn-primary"
           leftSection={
-            <LocalIcon
-              icon={icons.uploadIconName}
-              width="1rem"
-              height="1rem"
-              style={{ color: "white" }}
-            />
+            <LocalIcon icon={icons.uploadIconName} width="1rem" height="1rem" />
           }
           onClick={(e) => {
             e.stopPropagation();
@@ -52,14 +47,7 @@ export function LandingActions({
         <Button
           variant="secondary"
           className="landing-btn-secondary"
-          leftSection={
-            <LocalIcon
-              icon="add"
-              width="1rem"
-              height="1rem"
-              className="text-[var(--accent-interactive)]"
-            />
-          }
+          leftSection={<LocalIcon icon="add" width="1rem" height="1rem" />}
           onClick={(e) => {
             e.stopPropagation();
             openFilesModal();
diff --git a/frontend/editor/src/core/components/shared/LandingPage.css b/frontend/editor/src/core/components/shared/LandingPage.css
index 8ac150b0e5..8762c1368d 100644
--- a/frontend/editor/src/core/components/shared/LandingPage.css
+++ b/frontend/editor/src/core/components/shared/LandingPage.css
@@ -112,7 +112,7 @@
 /* ── Action buttons ──────────────────────────────────────── */
 .landing-btn-primary {
   background: var(--landing-hero-gradient) !important;
-  color: #ffffff !important;
+  color: var(--c-text-on-primary) !important;
   border: none !important;
   border-radius: 0.75rem !important;
   font-weight: 600 !important;
diff --git a/frontend/editor/src/core/components/shared/LoadingFallback.tsx b/frontend/editor/src/core/components/shared/LoadingFallback.tsx
index c861fd04b0..e5e3893ac1 100644
--- a/frontend/editor/src/core/components/shared/LoadingFallback.tsx
+++ b/frontend/editor/src/core/components/shared/LoadingFallback.tsx
@@ -10,9 +10,12 @@ export function LoadingFallback() {
         alignItems: "center",
         height: "100vh",
         fontSize: "18px",
-        // Theme-aware so the splash follows light/dark instead of forcing white.
-        backgroundColor: "var(--mantine-color-body)",
-        color: "var(--mantine-color-text)",
+        // Use our own tokens, not --mantine-color-*: this splash renders inside
+        // Suspense before MantineProvider sets its scheme, so --mantine-color-body
+        // is still Mantine's light default (white flash in dark mode). --c-bg/
+        // --c-text come from the pre-paint attributes on <html>, so they're right.
+        backgroundColor: "var(--c-bg)",
+        color: "var(--c-text)",
       }}
     >
       Loading...
diff --git a/frontend/editor/src/core/components/shared/ThemeProvider.tsx b/frontend/editor/src/core/components/shared/ThemeProvider.tsx
index bf15ce187f..6011d9148d 100644
--- a/frontend/editor/src/core/components/shared/ThemeProvider.tsx
+++ b/frontend/editor/src/core/components/shared/ThemeProvider.tsx
@@ -20,6 +20,7 @@ import {
 } from "@app/constants/theme";
 // SUI shared design-system tokens (used by @app/ui); key on `data-theme`.
 import "@app/tokens/tokens.css";
+import "@app/theme/index.css";
 
 interface ThemeContextType {
   themeMode: ThemeMode;
@@ -68,12 +69,17 @@ export function ThemeProvider({ children }: ThemeProviderProps) {
     return () => media.removeEventListener("change", update);
   }, [themeMode]);
 
-  // The theme preference resolved to a concrete light/dark scheme.
+  // The mode resolved to a concrete light/dark base.
   const colorScheme = resolveColorScheme(themeMode, systemScheme);
 
-  // Mantine drives `data-mantine-color-scheme`; mirror it to `data-theme` for SUI tokens.
+  // Mirror the scheme to <html>. The accent is fixed to the default (neutral
+  // surfaces + blue buttons): data-accent="default" and no --user-* overrides,
+  // so colors.css resolves --c-primary to its static blue fallback.
   useIsomorphicEffect(() => {
-    document.documentElement.setAttribute("data-theme", colorScheme);
+    const root = document.documentElement;
+    root.setAttribute("data-theme", colorScheme);
+    root.setAttribute("data-app-theme", "custom");
+    root.setAttribute("data-accent", "default");
   }, [colorScheme]);
 
   const value = useMemo<ThemeContextType>(
diff --git a/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
index 2ec530a2d5..ba364f540e 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.tsx
@@ -20,11 +20,11 @@ import { usePreferences } from "@app/contexts/PreferencesContext";
 import { useAppConfig } from "@app/contexts/AppConfigContext";
 import { useTheme } from "@app/components/shared/ThemeProvider";
 import LanguageSelector from "@app/components/shared/LanguageSelector";
-import type { ThemeMode } from "@app/constants/theme";
+import { type ThemeMode } from "@app/constants/theme";
 import type { ToolPanelMode } from "@app/constants/toolPanel";
-import type {
-  StartupView,
-  ViewerZoomSetting,
+import {
+  type StartupView,
+  type ViewerZoomSetting,
 } from "@app/services/preferencesService";
 import { Z_INDEX_OVER_CONFIG_MODAL } from "@app/styles/zIndex";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -482,7 +482,7 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
               <Text size="xs" c="dimmed" mt={4}>
                 {t(
                   "settings.general.themeDescription",
-                  "Choose light, dark, or follow your system",
+                  "Choose light, dark, or follow your system so it switches automatically.",
                 )}
               </Text>
             </div>
@@ -505,29 +505,33 @@ const GeneralSection: React.FC<GeneralSectionProps> = ({
               ]}
             />
           </div>
-          <div
-            style={{
-              display: "flex",
-              alignItems: "center",
-              justifyContent: "space-between",
-            }}
-          >
-            <div style={{ flex: 1, minWidth: 0 }}>
-              <Text fw={500} size="sm">
-                {t("settings.general.language", "Language")}
-              </Text>
-              <Text size="xs" c="dimmed" mt={4}>
-                {t(
-                  "settings.general.languageDescription",
-                  "Choose the display language",
-                )}
-              </Text>
-            </div>
-            <LanguageSelector position="bottom-end" offset={6} />
-          </div>
         </Stack>
       </Paper>
 
+      {/* Language */}
+      <Paper withBorder p="md" radius="md">
+        <div
+          style={{
+            display: "flex",
+            alignItems: "center",
+            justifyContent: "space-between",
+          }}
+        >
+          <div style={{ flex: 1, minWidth: 0 }}>
+            <Text fw={500} size="sm">
+              {t("settings.general.language", "Language")}
+            </Text>
+            <Text size="xs" c="dimmed" mt={4}>
+              {t(
+                "settings.general.languageDescription",
+                "Choose the display language",
+              )}
+            </Text>
+          </div>
+          <LanguageSelector position="bottom-end" offset={6} />
+        </div>
+      </Paper>
+
       <Paper withBorder p="md" radius="md">
         <Stack gap="md">
           <div
diff --git a/frontend/editor/src/core/constants/theme.ts b/frontend/editor/src/core/constants/theme.ts
index b9263772c9..71e54c18f8 100644
--- a/frontend/editor/src/core/constants/theme.ts
+++ b/frontend/editor/src/core/constants/theme.ts
@@ -1,9 +1,8 @@
 // Theme constants and utilities
 
-// Stored theme preference. "system" follows the OS.
 export type ThemeMode = "light" | "dark" | "system";
 
-// The concrete scheme applied to the UI.
+// The concrete light/dark base applied to Mantine + the neutral ramp.
 export type ColorScheme = "light" | "dark";
 
 // Detect the OS theme preference. Never throws: if the environment can't be
@@ -24,12 +23,13 @@ export function getSystemTheme(): ColorScheme {
   }
 }
 
-// Resolve a theme preference to a concrete light/dark scheme.
-// Falls back to systemScheme for unrecognised values (e.g. stale "rainbow").
+// Resolve the theme MODE to the concrete light/dark base Mantine uses.
+// "system" follows the OS; anything unrecognised falls back to it too.
 export function resolveColorScheme(
   mode: ThemeMode,
   systemScheme: ColorScheme,
 ): ColorScheme {
-  if (mode === "light" || mode === "dark") return mode;
+  if (mode === "light") return "light";
+  if (mode === "dark") return "dark";
   return systemScheme;
 }
diff --git a/frontend/editor/src/core/styles/theme.css b/frontend/editor/src/core/styles/theme.css
index c02965cf0b..11d4ab217b 100644
--- a/frontend/editor/src/core/styles/theme.css
+++ b/frontend/editor/src/core/styles/theme.css
@@ -1,32 +1,50 @@
 :root {
   /* Compare highlight colors (same in light/dark) */
-  --spdf-compare-removed-bg: rgba(255, 107, 107, 0.45); /* #ff6b6b @ 0.45 */
-  --spdf-compare-added-bg: rgba(81, 207, 102, 0.35); /* #51cf66 @ 0.35 */
+  --spdf-compare-removed-bg: color-mix(
+    in srgb,
+    var(--p-red-400) 45%,
+    transparent
+  ); /* #ff6b6b @ 0.45 */
+  --spdf-compare-added-bg: color-mix(
+    in srgb,
+    var(--p-green-500) 35%,
+    transparent
+  ); /* #51cf66 @ 0.35 */
 
   /* Badge colors for dropdowns */
-  --spdf-compare-removed-badge-bg: rgba(255, 59, 48, 0.15);
-  --spdf-compare-removed-badge-fg: #b91c1c;
-  --spdf-compare-added-badge-bg: rgba(52, 199, 89, 0.18);
-  --spdf-compare-added-badge-fg: #1b5e20;
+  --spdf-compare-removed-badge-bg: color-mix(
+    in srgb,
+    var(--p-red-500) 15%,
+    transparent
+  );
+  --spdf-compare-removed-badge-fg: var(--p-red-600);
+  --spdf-compare-added-badge-bg: color-mix(
+    in srgb,
+    var(--p-green-500) 18%,
+    transparent
+  );
+  --spdf-compare-added-badge-fg: var(--p-green-700);
 
   /* Inline highlights in summary */
-  --spdf-compare-inline-removed-bg: rgba(255, 59, 48, 0.25);
-  --spdf-compare-inline-added-bg: rgba(52, 199, 89, 0.25);
+  --spdf-compare-inline-removed-bg: color-mix(
+    in srgb,
+    var(--p-red-500) 25%,
+    transparent
+  );
+  --spdf-compare-inline-added-bg: color-mix(
+    in srgb,
+    var(--p-green-500) 25%,
+    transparent
+  );
 
   /* File Manager active file colors */
-  --file-active-bg: rgba(
-    59,
-    130,
-    246,
-    0.1
-  ); /* Transparent blue for active file background */
   --file-active-badge-bg: rgba(
     34,
     197,
     94,
     0.15
   ); /* Transparent green for active badge */
-  --file-active-badge-fg: #15803d; /* Green text for active badge */
+  --file-active-badge-fg: var(--p-green-700); /* Green text for active badge */
   --file-active-badge-border: rgba(
     34,
     197,
@@ -42,13 +60,6 @@
   --fullscreen-anim-duration-in: 0.28s;
   --fullscreen-anim-duration-out: 0.22s;
 
-  /* Z-index constants (added in this PR) */
-  --z-over-fullscreen-surface: 1400;
-  --z-fullscreen-surface: 1200;
-  --z-fullscreen-favorite-star: 2;
-  --z-fullscreen-icon-svg: 1;
-  --z-toolpicker-star: 1;
-
   /* Standard gray scale */
   --gray-50: 249 250 251;
   --gray-100: 243 244 246;
@@ -67,108 +78,97 @@
   --border: 229 231 235;
 
   /* Colors for Mantine integration */
-  --color-primary-50: #eff6ff;
-  --color-primary-100: #dbeafe;
-  --color-primary-200: #bfdbfe;
-  --color-primary-300: #93c5fd;
-  --color-primary-400: #60a5fa;
-  --color-primary-500: #3b82f6;
-  --color-primary-600: #2563eb;
-  --color-primary-700: #1d4ed8;
-  --color-primary-800: #1e40af;
-  --color-primary-900: #1e3a8a;
+  --color-primary-50: var(--p-blue-400);
+  --color-primary-100: var(--p-blue-400);
+  --color-primary-200: var(--p-blue-400);
+  --color-primary-300: var(--p-blue-400);
+  --color-primary-400: var(--p-blue-400);
+  --color-primary-500: var(--p-blue-500);
+  --color-primary-600: var(--p-blue-600);
+  --color-primary-700: var(--p-blue-700);
+  --color-primary-800: var(--p-blue-700);
+  --color-primary-900: var(--p-blue-700);
 
   /* Success (green) */
-  --color-green-50: #f0fdf4;
-  --color-green-100: #dcfce7;
-  --color-green-200: #bbf7d0;
-  --color-green-300: #86efac;
-  --color-green-400: #4ade80;
-  --color-green-500: #22c55e;
-  --color-green-600: #16a34a;
-  --color-green-700: #15803d;
-  --color-green-800: #166534;
-  --color-green-900: #14532d;
+  --color-green-50: var(--p-green-500);
+  --color-green-100: var(--p-green-500);
+  --color-green-200: var(--p-green-500);
+  --color-green-300: var(--p-green-500);
+  --color-green-400: var(--p-green-500);
+  --color-green-500: var(--p-green-500);
+  --color-green-600: var(--p-green-600);
+  --color-green-700: var(--p-green-700);
+  --color-green-800: var(--p-green-700);
+  --color-green-900: var(--p-green-700);
 
   /* Warning (yellow) */
-  --color-yellow-50: #fefce8;
-  --color-yellow-100: #fef9c3;
-  --color-yellow-200: #fef08a;
-  --color-yellow-300: #fde047;
-  --color-yellow-400: #facc15;
+  --color-yellow-50: var(--p-amber-400);
+  --color-yellow-100: var(--p-amber-400);
+  --color-yellow-200: var(--p-amber-400);
+  --color-yellow-300: var(--p-amber-400);
+  --color-yellow-400: var(--p-amber-400);
 
   /* Category colors - consistent across light and dark modes */
-  --category-color-removal: #ef4444; /* Red for removal tools */
-  --category-color-security: #f59e0b; /* Orange for security tools */
-  --category-color-formatting: #8b5cf6; /* Purple for formatting tools */
-  --category-color-extraction: #06b6d4; /* Cyan for extraction tools */
-  --category-color-signing: #10b981; /* Green for signing tools */
-  --category-color-general: #3b82f6; /* Blue for general tools */
-  --category-color-verification: #f97316; /* Orange for verification tools */
-  --category-color-automation: #ec4899; /* Pink for automation tools */
-  --category-color-developer: #6b7280; /* Gray for developer tools */
-  --category-color-default: #6b7280; /* Default gray */
+  --category-color-removal: var(--p-red-500); /* Red for removal tools */
+  --category-color-security: var(--p-amber-500); /* Orange for security tools */
+  --category-color-formatting: var(
+    --p-blue-400
+  ); /* Purple for formatting tools */
+  --category-color-extraction: var(
+    --p-blue-500
+  ); /* Cyan for extraction tools */
+  --category-color-signing: var(--p-green-500); /* Green for signing tools */
+  --category-color-general: var(--p-blue-500); /* Blue for general tools */
+  --category-color-verification: var(
+    --p-amber-600
+  ); /* Orange for verification tools */
+  --category-color-automation: var(--p-red-400); /* Pink for automation tools */
+  --category-color-developer: var(--p-gray-500); /* Gray for developer tools */
+  --category-color-default: var(--p-gray-500); /* Default gray */
 
   /* Special section colors - consistent across light and dark modes */
-  --special-color-favorites: #ffc107; /* Yellow/gold for favorites */
-  --special-color-recommended: #1bb1d4; /* Cyan for recommended */
-  --color-yellow-500: #eab308;
-  --color-yellow-600: #ca8a04;
-  --color-yellow-700: #a16207;
-  --color-yellow-800: #854d0e;
-  --color-yellow-900: #713f12;
+  --special-color-favorites: var(--p-amber-400); /* Yellow/gold for favorites */
+  --special-color-recommended: var(--p-blue-500); /* Cyan for recommended */
+  --color-yellow-500: var(--p-amber-500);
+  --color-yellow-600: var(--p-amber-600);
+  --color-yellow-700: var(--p-amber-600);
+  --color-yellow-800: var(--p-amber-600);
+  --color-yellow-900: var(--p-amber-600);
 
-  --color-red-50: #fef2f2;
-  --color-red-100: #fee2e2;
-  --color-red-200: #fecaca;
-  --color-red-300: #fca5a5;
-  --color-red-400: #f87171;
-  --color-red-500: #ef4444;
-  --color-red-600: #dc2626;
-  --color-red-700: #b91c1c;
-  --color-red-800: #991b1b;
-  --color-red-900: #7f1d1d;
+  --color-red-50: var(--p-red-400);
+  --color-red-100: var(--p-red-400);
+  --color-red-200: var(--p-red-400);
+  --color-red-300: var(--p-red-400);
+  --color-red-400: var(--p-red-400);
+  --color-red-500: var(--p-red-500);
+  --color-red-600: var(--p-red-600);
+  --color-red-700: var(--p-red-600);
+  --color-red-800: var(--p-red-600);
+  --color-red-900: var(--p-red-600);
 
-  --color-gray-50: #f9fafb;
-  --color-gray-100: #f3f4f6;
-  --color-gray-200: #e5e7eb;
-  --color-gray-300: #d1d5db;
-  --color-gray-400: #9ca3af;
-  --color-gray-500: #6b7280;
-  --color-gray-600: #4b5563;
-  --color-gray-700: #374151;
-  --color-gray-800: #1f2937;
-  --color-gray-900: #111827;
+  --color-gray-50: var(--p-gray-50);
+  --color-gray-100: var(--p-gray-100);
+  --color-gray-200: var(--p-gray-200);
+  --color-gray-300: var(--p-gray-300);
+  --color-gray-400: var(--p-gray-400);
+  --color-gray-500: var(--p-gray-500);
+  --color-gray-600: var(--p-gray-600);
+  --color-gray-700: var(--p-gray-700);
+  --color-gray-800: var(--p-gray-800);
+  --color-gray-900: var(--p-gray-900);
 
   /* Categorical accents (sidebar groups, file-type icons, badges). One hue per
      token; the dark block overrides each with a LIGHTER shade for contrast on
      dark backgrounds. JS consumers go through utils/accentColors.ts. */
-  --accent-green: #16a34a;
-  --accent-blue: #2563eb;
-  --accent-red: #dc2626;
-  --accent-orange: #ea580c;
-  --accent-purple: #9333ea;
-  --accent-teal: #0d9488;
-  --accent-pink: #db2777;
-  --accent-amber: #d97706;
-  --accent-indigo: #4f46e5;
-  --accent-cyan: #0891b2;
-  --accent-violet: #7c3aed;
-  --accent-gray: #6b7280;
-
-  /* Spacing system */
-  --space-xs: 4px;
-  --space-sm: 8px;
-  --space-md: 16px;
-  --space-lg: 24px;
-  --space-xl: 32px;
-
-  /* Radius system */
-  --radius-xs: 2px;
-  --radius-sm: 4px;
-  --radius-md: 8px;
-  --radius-lg: 12px;
-  --radius-xl: 16px;
+  --accent-orange: var(--p-amber-600);
+  --accent-purple: var(--p-blue-500);
+  --accent-teal: var(--p-blue-700);
+  --accent-pink: var(--p-red-500);
+  --accent-amber: var(--p-amber-600);
+  --accent-indigo: var(--p-blue-600);
+  --accent-cyan: var(--p-blue-600);
+  --accent-violet: var(--p-blue-600);
+  --accent-gray: var(--p-gray-500);
 
   /* Shadow system */
   --shadow-xs: 0 1px 2px rgba(0, 0, 0, 0.05);
@@ -177,201 +177,81 @@
   --shadow-lg: 0 10px 15px rgba(0, 0, 0, 0.1);
   --shadow-xl: 0 20px 25px rgba(0, 0, 0, 0.1);
 
-  /* Font weights */
-  --font-weight-normal: 400;
-  --font-weight-medium: 500;
-  --font-weight-semibold: 600;
-  --font-weight-bold: 700;
-
-  /* Light theme semantic colors */
-  --bg-surface: #ffffff;
-  --bg-raised: #f9fafb;
-  --bg-muted: #f3f4f6;
-  --bg-background: #f9fafb;
-  --bg-toolbar: #ffffff;
-  --bg-file-manager: #f5f6f8;
-  --bg-file-list: #ffffff;
-  --btn-open-file: #0a8bff;
-  --text-primary: #111827;
-  --text-secondary: #4b5563;
-  --text-muted: #6b7280;
   /* Always-dark text (for use on light backgrounds like alerts) - does not change in dark mode */
-  --text-always-dark: #1f2937;
-  --text-always-dark-muted: #6b7280;
-  --border-subtle: #e5e7eb;
-  --border-default: #e2e8f0;
-  --border-strong: #9ca3af;
-  --border-hover: #9ca3af;
-  --hover-bg: #f9fafb;
-  --active-bg: #f3f4f6;
-  --automation-entry-hover-bg: var(--color-gray-100);
+  --text-always-dark: var(--p-gray-800);
+  --text-always-dark-muted: var(--p-gray-500);
 
   /* Icon colors for light mode */
-  --icon-user-bg: #9ca3af;
-  --icon-user-color: #ffffff;
-  --icon-notifications-bg: #9ca3af;
-  --icon-notifications-color: #ffffff;
-  --icon-tools-bg: #1e88e5;
+  --icon-tools-bg: var(--p-blue-500);
   --icon-tools-color: #ffffff;
-  --icon-read-bg: #4caf50;
-  --icon-read-color: #ffffff;
-  --icon-sign-bg: #3ba99c;
-  --icon-sign-color: #ffffff;
-  --icon-automate-bg: #a576e3;
-  --icon-automate-color: #ffffff;
-  --icon-files-bg: #d3e7f7;
-  --icon-files-color: #0a8bff;
-  --icon-activity-bg: #d3e7f7;
-  --icon-activity-color: #0a8bff;
-  --icon-config-bg: #9ca3af;
-  --icon-config-color: #ffffff;
+  --icon-files-color: var(--p-blue-500);
 
   /* Colors for tooltips */
-  --tooltip-title-bg: #dbefff;
-  --tooltip-title-color: #31528e;
-  --tooltip-header-bg: #31528e;
+  --tooltip-header-bg: var(--p-blue-700);
   --tooltip-header-color: white;
   --tooltip-border: var(--border-default);
 
   /* Inactive icon colors for light mode */
-  --icon-inactive-bg: #9ca3af;
+  --icon-inactive-bg: var(--p-gray-400);
   --icon-inactive-color: #ffffff;
 
-  /* New theme colors for text and icons */
-  --tools-text-and-icon-color: var(--text-primary);
-
-  /* Tool picker sticky header variables (light mode) */
-  --tool-header-bg: #dbefff;
-  --tool-header-border: #bee2ff;
-  --tool-header-text: #1e88e5;
-  --tool-header-badge-bg: #c0ddff;
-  --tool-header-badge-text: #004e99;
-
-  /* Subcategory title styling (light mode) */
-  --tool-subcategory-text-color: #9ca3af; /* lighter text */
-  --tool-subcategory-rule-color: #e5e7eb; /* doubly lighter rule line */
-  --accent-interactive: #4a90e2;
-  --text-instruction: #4a90e2;
-  --text-brand: var(--color-gray-700);
-  --text-brand-accent: #dc2626;
+  /* doubly lighter rule line */
+  --text-brand-accent: var(--p-red-600);
 
   /* PDF text selection colors */
-  --pdf-selection-bg: rgba(59, 130, 246, 0.2);
-  --pdf-selection-ring: rgba(59, 130, 246, 0.18);
-
-  /* Placeholder text colors */
-  --search-text-and-icon-color: #6b7382;
-  --input-bg: #ffffff;
-
-  /* Tool panel search bar background colors */
-  --tool-panel-search-bg: #eff1f4;
-  --tool-panel-search-border-bottom: #eff1f4;
+  --pdf-selection-bg: color-mix(in srgb, var(--p-blue-500) 20%, transparent);
+  --pdf-selection-ring: color-mix(in srgb, var(--p-blue-500) 18%, transparent);
 
   /* container */
-  --landing-paper-bg: var(--bg-surface);
-  --landing-inner-paper-bg: #eef8ff;
-  --landing-inner-paper-border: #cdeaff;
   --landing-button-bg: var(--bg-surface);
-  --landing-button-color: var(--icon-tools-bg);
-  --landing-button-border: #e0f2f7;
-  --landing-button-hover-bg: rgb(251, 251, 251);
+  --landing-button-border: var(--p-blue-400);
+  --landing-button-hover-bg: var(--p-gray-50);
 
   /* drop state */
-  --landing-drop-paper-bg: #e3f2fd;
-  --landing-drop-inner-paper-bg: #bbdefb;
-  --landing-drop-inner-paper-border: #90caf9;
+  --landing-drop-inner-paper-bg: var(--p-blue-400);
+  --landing-drop-inner-paper-border: var(--p-blue-400);
 
   /* landing hero & stack */
-  --landing-hero-gradient: linear-gradient(135deg, #4c8bf5 0%, #3a7be8 100%);
+  --landing-hero-gradient: linear-gradient(
+    135deg,
+    var(--p-blue-500) 0%,
+    var(--p-blue-500) 100%
+  );
   --landing-stack-w: 224px;
   --landing-stack-h: 176px;
-  --landing-stack-glow-bg: radial-gradient(
-    circle,
-    rgba(74, 144, 226, 0.18) 0%,
-    transparent 70%
-  );
 
   /* landing doc stack shadows */
   --landing-doc-shadow-back-idle:
     0 4px 20px rgba(0, 0, 0, 0.08), 0 1px 3px rgba(0, 0, 0, 0.04);
-  --landing-doc-shadow-back-hover:
-    0 12px 40px rgba(0, 0, 0, 0.15), 0 4px 12px rgba(0, 0, 0, 0.08);
   --landing-doc-shadow-front-idle:
     0 8px 30px rgba(0, 0, 0, 0.12), 0 4px 12px rgba(0, 0, 0, 0.06),
     0 0 0 1px rgba(0, 0, 0, 0.02);
-  --landing-doc-shadow-front-hover:
-    0 18px 48px rgba(0, 0, 0, 0.18), 0 8px 20px rgba(0, 0, 0, 0.1),
-    0 0 0 1px rgba(0, 0, 0, 0.04);
-
-  /* landing action button shadows */
-  --landing-action-transition:
-    transform 0.28s cubic-bezier(0.4, 0, 0.2, 1),
-    box-shadow 0.32s cubic-bezier(0.4, 0, 0.2, 1);
-  --landing-action-shadow-idle:
-    0 6px 18px rgba(0, 0, 0, 0), 0 2px 6px rgba(0, 0, 0, 0);
-  --landing-action-shadow-hover:
-    0 6px 18px rgba(0, 0, 0, 0.14), 0 2px 6px rgba(0, 0, 0, 0.08);
-  --landing-action-primary-shadow-idle:
-    0 10px 26px rgba(58, 123, 232, 0), 0 4px 12px rgba(0, 0, 0, 0);
-  --landing-action-primary-shadow-hover:
-    0 10px 26px rgba(58, 123, 232, 0.42), 0 4px 12px rgba(0, 0, 0, 0.1);
 
   /* selected file header colors */
-  --header-selected-bg: #1e88e5; /* light mode selected header matches dark */
+  --header-selected-bg: var(
+    --p-blue-500
+  ); /* light mode selected header matches dark */
   --header-selected-fg: #ffffff;
-  --file-card-bg: #ffffff; /* file card background (light/dark paired) */
-  --accordion-item-bg: #e8eaed; /* accordion item background - more distinguishable */
 
-  /* shadows */
-  --drop-shadow-color: rgba(0, 0, 0, 0.08);
-  --drop-shadow-color-strong: rgba(0, 0, 0, 0.04);
-  --drop-shadow-filter: drop-shadow(0 0.2rem 0.4rem rgba(0, 0, 0, 0.08))
-    drop-shadow(0 0.6rem 0.6rem rgba(0, 0, 0, 0.06))
-    drop-shadow(0 1.2rem 1rem rgba(0, 0, 0, 0.04));
+  /* slightly more blue than dark mode header */
 
-  /* Light mode card hover and selection */
-  --header-hover-bg: #3b4b6e; /* same family as selected, a touch muted for hover */
-  --card-selected-border: #3fafff; /* slightly more blue than dark mode header */
-  --checkbox-border: #2f83bf;
-  --checkbox-checked-bg: #3fafff;
-  --checkbox-tick: #ffffff;
-
-  --information-text-bg: #eaeaea;
-  --information-text-color: #5e5e5e;
-  /* Bulk selection panel specific colors (light mode) */
-  --bulk-panel-bg: #ffffff; /* white background for parent container */
-  --bulk-card-bg: #ffffff; /* white background for cards */
-  --bulk-card-border: #e5e7eb; /* light gray border for cards and buttons */
-  --bulk-card-hover-border: #d1d5db; /* slightly darker on hover */
-  --unsupported-bar-bg: #5a616e;
-  --unsupported-bar-border: #6b7280;
+  --information-text-color: var(--p-zinc-400);
+  /* white background for cards */
+  --bulk-card-border: var(
+    --p-gray-200
+  ); /* light gray border for cards and buttons */
+  --bulk-card-hover-border: var(--p-gray-300); /* slightly darker on hover */
 
   /* Config Modal colors (light mode) */
-  --modal-nav-bg: #f5f6f8;
-  --modal-nav-section-title: #6b7280;
-  --modal-nav-item: #374151;
-  --modal-nav-item-active: #0a8bff;
-  --modal-nav-item-active-bg: rgba(10, 139, 255, 0.08);
-  --modal-content-bg: #ffffff;
-  --modal-header-border: rgba(0, 0, 0, 0.06);
+  --modal-nav-item: var(--p-gray-700);
 
   /* API Keys section colors (light mode) */
-  --api-keys-card-bg: #ffffff;
-  --api-keys-card-border: #e0e0e0;
   --api-keys-card-shadow: rgba(0, 0, 0, 0.06);
-  --api-keys-input-bg: #f8f8f8;
-  --api-keys-input-border: #e0e0e0;
 
   /* PDF Report Colors (always light) */
-  --pdf-light-header-bg: 239 246 255;
-  --pdf-light-accent: 59 130 246;
-  --pdf-light-text-primary: 30 41 59;
   --pdf-light-text-muted: 100 116 139;
   --pdf-light-box-bg: 248 250 252;
   --pdf-light-box-border: 226 232 240;
-  --pdf-light-warning: 234 179 8;
-  --pdf-light-danger: 248 113 113;
-  --pdf-light-success: 34 197 94;
   --pdf-light-neutral: 148 163 184;
   --pdf-light-status-valid-bg: 209 250 229;
   --pdf-light-status-valid-text: 6 95 70;
@@ -381,32 +261,20 @@
   --pdf-light-status-invalid-text: 153 27 27;
   --pdf-light-status-neutral-bg: 229 231 235;
   --pdf-light-status-neutral-text: 55 65 81;
-  --pdf-light-report-container-bg: 249 250 251;
-  --pdf-light-simulated-page-bg: 255 255 255;
   --pdf-light-simulated-page-text: 15 23 42;
 
   /* Code token colors (light mode) */
-  --code-kw-color: #1d4ed8; /* blue-700 */
-  --code-str-color: #16a34a; /* green-600 */
-  --code-num-color: #4338ca; /* indigo-700 */
-  --code-com-color: #6b7280; /* gray-500 */
-  /* Compare tool specific colors - only for colors that don't have existing theme pairs */
-  --compare-upload-dropzone-bg: rgba(241, 245, 249, 0.45);
-  --compare-upload-dropzone-border: rgba(148, 163, 184, 0.6);
-  --compare-upload-icon-bg: rgba(148, 163, 184, 0.2);
-  --compare-upload-icon-color: rgba(17, 24, 39, 0.75);
-  --compare-upload-divider: rgba(148, 163, 184, 0.5);
+  --code-kw-color: var(--p-blue-700); /* blue-700 */
+  --code-str-color: var(--p-green-600); /* green-600 */
+  --code-num-color: var(--p-blue-700); /* indigo-700 */
+  --code-com-color: var(--p-gray-500); /* gray-500 */
 
   /* Compare page label chip (light mode): slightly lighter than surrounding rows */
-  --compare-page-label-bg: var(--bg-muted);
   --compare-page-label-fg: var(--text-secondary);
 
   /* Status indicator dot ring shadow */
   --status-dot-ring: 0 0 0 2px rgba(0, 0, 0, 0.08);
 
-  /* Input element styling */
-  --input-bg: #ffffff;
-
   /* Select/dropdown placeholder state */
   --select-placeholder-bg: var(--mantine-color-gray-1);
   --select-placeholder-text: var(--mantine-color-gray-6);
@@ -414,7 +282,6 @@
   /* Grouped format dropdown */
   --dropdown-trigger-bg: var(--mantine-color-white);
   --dropdown-trigger-text: var(--mantine-color-dark-9);
-  --dropdown-trigger-text-disabled: var(--mantine-color-dark-7);
   --dropdown-trigger-icon: var(--mantine-color-gray-6);
   --dropdown-panel-bg: var(--mantine-color-white);
   --dropdown-panel-border: var(--mantine-color-gray-4);
@@ -423,211 +290,146 @@
 
 /* Onboarding (light mode) */
 :root {
-  --onboarding-title: #0a0a0a;
-  --onboarding-body: #4a5565;
-  --onboarding-step-active: #1e2939;
-  --onboarding-step-inactive: #d1d5dc;
+  --onboarding-step-active: var(--p-gray-800);
+  --onboarding-step-inactive: var(--p-gray-300);
 }
 
 [data-mantine-color-scheme="dark"] {
-  /* Dark theme gray scale (inverted) — navy-indigo tinted */
-  --gray-50: 9 11 24;
-  --gray-100: 13 16 32;
-  --gray-200: 19 23 41;
-  --gray-300: 28 35 64;
-  --gray-400: 45 55 96;
-  --gray-500: 90 98 128;
-  --gray-600: 144 153 185;
-  --gray-700: 195 200 230;
-  --gray-800: 218 222 245;
-  --gray-900: 238 241 252;
+  /* Inverted dark gray scale — RGB channels for Tailwind's rgb(var(--gray-N)). */
+  --gray-50: 15 15 16; /* zinc-950 */
+  --gray-100: 16 16 18; /* zinc-900 */
+  --gray-200: 24 24 27; /* zinc-800 */
+  --gray-300: 42 42 46; /* zinc-650 */
+  --gray-400: 63 63 70; /* zinc-500 */
+  --gray-500: 82 82 91; /* zinc-400 */
+  --gray-600: 113 113 122; /* zinc-300 */
+  --gray-700: 161 161 170; /* zinc-200 */
+  --gray-800: 212 212 216;
+  --gray-900: 244 244 245; /* zinc-100 */
 
-  /* Dark semantic colors for Tailwind — aligned with portal tokens.css */
-  --surface: 21 28 46; /* #151c2e — portal --color-surface */
-  --background: 9 12 20; /* #090c14 — portal --color-bg */
-  --border: 40 50 72; /* #283248 — portal --color-border */
+  /* Dark semantic channels for Tailwind. */
+  --surface: 24 24 27; /* zinc-800 */
+  --background: 15 15 16; /* zinc-950 */
+  --border: 42 42 46; /* zinc-650 */
 
   /* Dark theme Mantine colors */
-  --color-red-50: #2d1b1b;
-  --color-red-100: #3a2323;
-  --color-red-200: #4a2d2d;
-  --color-red-300: #5c3535;
-  --color-red-400: #7c4a4a;
-  --color-red-500: #ef4444;
-  --color-red-600: #dc2626;
-  --color-red-700: #b91c1c;
-  --color-red-800: #991b1b;
-  --color-red-900: #7f1d1d;
+  --color-red-50: var(--p-zinc-775);
+  --color-red-100: var(--p-zinc-700);
+  --color-red-200: var(--p-zinc-600);
+  --color-red-300: var(--p-zinc-500);
+  --color-red-400: var(--p-zinc-400);
+  --color-red-500: var(--p-red-500);
+  --color-red-600: var(--p-red-600);
+  --color-red-700: var(--p-red-600);
+  --color-red-800: var(--p-red-600);
+  --color-red-900: var(--p-red-600);
 
-  --color-gray-50: #111827;
-  --color-gray-100: #1f2329;
-  --color-gray-200: #2a2f36;
-  --color-gray-300: #374151;
-  --color-gray-400: #4b5563;
-  --color-gray-500: #6b7280;
-  --color-gray-600: #9ca3af;
-  --color-gray-700: #d1d5db;
-  --color-gray-800: #e5e7eb;
-  --color-gray-900: #f3f4f6;
+  --color-gray-50: var(--p-gray-900);
+  --color-gray-100: var(--p-zinc-775);
+  --color-gray-200: var(--p-zinc-650);
+  --color-gray-300: var(--p-gray-700);
+  --color-gray-400: var(--p-gray-600);
+  --color-gray-500: var(--p-gray-500);
+  --color-gray-600: var(--p-gray-400);
+  --color-gray-700: var(--p-gray-300);
+  --color-gray-800: var(--p-gray-200);
+  --color-gray-900: var(--p-gray-100);
 
   /* Categorical accents: lighter shades of the same hues, for contrast on dark. */
-  --accent-green: #4ade80;
-  --accent-blue: #60a5fa;
-  --accent-red: #f87171;
-  --accent-orange: #fb923c;
-  --accent-purple: #c084fc;
-  --accent-teal: #2dd4bf;
-  --accent-pink: #f472b6;
-  --accent-amber: #fbbf24;
-  --accent-indigo: #818cf8;
-  --accent-cyan: #22d3ee;
-  --accent-violet: #a78bfa;
-  --accent-gray: #9ca3af;
+  --accent-orange: var(--p-amber-500);
+  --accent-purple: var(--p-blue-400);
+  --accent-teal: var(--p-blue-400);
+  --accent-pink: var(--p-red-400);
+  --accent-amber: var(--p-amber-400);
+  --accent-indigo: var(--p-blue-400);
+  --accent-cyan: var(--p-blue-400);
+  --accent-violet: var(--p-blue-400);
+  --accent-gray: var(--p-gray-400);
 
   /* Category colors - same as light mode for consistency */
-  --category-color-removal: #ef4444; /* Red for removal tools */
-  --category-color-security: #f59e0b; /* Orange for security tools */
-  --category-color-formatting: #8b5cf6; /* Purple for formatting tools */
-  --category-color-extraction: #06b6d4; /* Cyan for extraction tools */
-  --category-color-signing: #10b981; /* Green for signing tools */
-  --category-color-general: #3b82f6; /* Blue for general tools */
-  --category-color-verification: #f97316; /* Orange for verification tools */
-  --category-color-automation: #ec4899; /* Pink for automation tools */
-  --category-color-developer: #6b7280; /* Gray for developer tools */
-  --category-color-default: #6b7280; /* Default gray */
+  --category-color-removal: var(--p-red-500); /* Red for removal tools */
+  --category-color-security: var(--p-amber-500); /* Orange for security tools */
+  --category-color-formatting: var(
+    --p-blue-400
+  ); /* Purple for formatting tools */
+  --category-color-extraction: var(
+    --p-blue-500
+  ); /* Cyan for extraction tools */
+  --category-color-signing: var(--p-green-500); /* Green for signing tools */
+  --category-color-general: var(--p-blue-500); /* Blue for general tools */
+  --category-color-verification: var(
+    --p-amber-600
+  ); /* Orange for verification tools */
+  --category-color-automation: var(--p-red-400); /* Pink for automation tools */
+  --category-color-developer: var(--p-gray-500); /* Gray for developer tools */
+  --category-color-default: var(--p-gray-500); /* Default gray */
 
   /* Special section colors - same as light mode for consistency */
-  --special-color-favorites: #ffc107; /* Yellow/gold for favorites */
-  --special-color-recommended: #1bb1d4; /* Cyan for recommended */
+  --special-color-favorites: var(--p-amber-400); /* Yellow/gold for favorites */
+  --special-color-recommended: var(--p-blue-500); /* Cyan for recommended */
 
   /* Success (green) - dark */
-  --color-green-50: #052e16;
-  --color-green-100: #064e3b;
-  --color-green-200: #065f46;
-  --color-green-300: #047857;
-  --color-green-400: #059669;
-  --color-green-500: #22c55e;
-  --color-green-600: #16a34a;
-  --color-green-700: #4ade80;
-  --color-green-800: #86efac;
-  --color-green-900: #bbf7d0;
+  --color-green-50: var(--p-green-700);
+  --color-green-100: var(--p-green-700);
+  --color-green-200: var(--p-green-700);
+  --color-green-300: var(--p-green-700);
+  --color-green-400: var(--p-green-600);
+  --color-green-500: var(--p-green-500);
+  --color-green-600: var(--p-green-600);
+  --color-green-700: var(--p-green-500);
+  --color-green-800: var(--p-green-500);
+  --color-green-900: var(--p-green-500);
 
   /* Warning (yellow) - dark */
-  --color-yellow-50: #451a03;
-  --color-yellow-100: #713f12;
-  --color-yellow-200: #854d0e;
-  --color-yellow-300: #a16207;
-  --color-yellow-400: #ca8a04;
-  --color-yellow-500: #eab308;
-  --color-yellow-600: #facc15;
-  --color-yellow-700: #fde047;
-  --color-yellow-800: #fef08a;
-  --color-yellow-900: #fef9c3;
+  --color-yellow-50: var(--p-amber-600);
+  --color-yellow-100: var(--p-amber-600);
+  --color-yellow-200: var(--p-amber-600);
+  --color-yellow-300: var(--p-amber-600);
+  --color-yellow-400: var(--p-amber-600);
+  --color-yellow-500: var(--p-amber-500);
+  --color-yellow-600: var(--p-amber-400);
+  --color-yellow-700: var(--p-amber-400);
+  --color-yellow-800: var(--p-amber-400);
+  --color-yellow-900: var(--p-amber-400);
 
-  /* Dark theme semantic colors — deep navy/indigo palette, aligned with portal
-     tokens.css so the editor and portal (Processor) dark modes don't drift.
-     Chrome surfaces (--bg-toolbar, --bg-file-manager) sit at the portal's
-     sidebar level (#0d1120) so the left/right sidebars lift off the darker
-     canvas (--bg-background) instead of blending into it. */
-  --bg-surface: #151c2e; /* portal --color-surface */
-  --bg-raised: #0d1120; /* portal --color-bg-alt */
-  --bg-muted: #0d1120;
-  --bg-background: #090c14; /* portal --color-bg */
-  --bg-toolbar: #0d1120; /* portal --color-sidebar-bg — lifted off the canvas */
-  --bg-file-manager: #0d1120; /* portal --color-sidebar-bg */
-  --bg-file-list: #151c2e; /* portal --color-surface */
-  --btn-open-file: #4f8ef5;
-  --text-primary: #e8eaf6;
-  --text-secondary: #9299b0;
-  --text-muted: #5b6280;
+  /* Dark theme semantic colours — the neutral zinc ramp. These legacy
+     `--bg-*`/`--text-*` names are shadowed by compat.css (→ --c-*), so this is
+     kept only for any consumer not yet on the semantic tokens. */
   /* Always-dark text (for use on light backgrounds like alerts) - does not change in dark mode */
-  --text-always-dark: #1f2937;
-  --text-always-dark-muted: #6b7280;
-  --border-subtle: rgba(255, 255, 255, 0.05);
-  --border-default: #1e2840; /* portal --color-border-light */
-  --border-strong: #283248; /* portal --color-border */
-  --border-hover: #3d4f6a; /* portal --color-border-hover */
-  --hover-bg: #1c2640; /* portal --color-bg-hover */
-  --active-bg: #243044; /* portal --color-bg-muted */
-  --automation-entry-hover-bg: var(--color-gray-200);
+  --text-always-dark: var(--p-gray-800);
+  --text-always-dark-muted: var(--p-gray-500);
 
   /* Icon colors for dark mode */
-  --icon-user-bg: #131729;
-  --icon-user-color: #6e7898;
-  --icon-notifications-bg: #131729;
-  --icon-notifications-color: #6e7898;
-  --icon-tools-bg: #1c2340;
-  --icon-tools-color: #e0e3f8;
-  --icon-read-bg: #1c2340;
-  --icon-read-color: #e0e3f8;
-  --icon-sign-bg: #1c2340;
-  --icon-sign-color: #e0e3f8;
-  --icon-automate-bg: #1c2340;
-  --icon-automate-color: #e0e3f8;
-  --icon-files-bg: #1c2340;
-  --icon-files-color: #e0e3f8;
-  --icon-activity-bg: #1c2340;
-  --icon-activity-color: #e0e3f8;
-  --icon-config-bg: #1c2340;
-  --icon-config-color: #e0e3f8;
+  --icon-tools-bg: var(--p-zinc-650);
+  --icon-tools-color: var(--p-blue-400);
+  --icon-files-color: var(--p-blue-400);
 
   /* Inactive icon colors for dark mode */
-  --icon-inactive-bg: #131729;
-  --icon-inactive-color: #6e7898;
+  --icon-inactive-bg: var(--p-zinc-800);
+  --icon-inactive-color: var(--p-gray-500);
 
   /* Dark mode tooltip colors */
-  --tooltip-title-bg: #1c2340;
-  --tooltip-title-color: #e8eaf6;
   --tooltip-header-bg: var(--bg-raised);
   --tooltip-header-color: var(--text-primary);
   --tooltip-border: var(--border-default);
 
-  --accent-interactive: #e8eaf6;
-  --text-instruction: #e8eaf6;
-  --text-brand: var(--color-gray-800);
-  --text-brand-accent: #ef4444;
+  --text-brand-accent: var(--p-red-500);
 
   /* Compare badge text colors (dark mode): lighter for readability */
   --spdf-compare-removed-badge-fg: var(--color-red-500);
   --spdf-compare-added-badge-fg: var(--color-green-500);
 
-  /* container */
-  --landing-paper-bg: #090b18;
-  --landing-inner-paper-bg: var(--bg-raised);
-  --landing-inner-paper-border: #1c2340;
-
   /* landing dark overrides */
-  --landing-stack-glow-bg: radial-gradient(
-    circle,
-    rgba(50, 90, 210, 0.22) 0%,
-    transparent 70%
-  );
   --landing-doc-shadow-back-idle:
     0 4px 20px rgba(0, 0, 0, 0.45), 0 1px 3px rgba(0, 0, 0, 0.35);
-  --landing-doc-shadow-back-hover:
-    0 14px 44px rgba(0, 0, 0, 0.65), 0 6px 16px rgba(0, 0, 0, 0.45);
   --landing-doc-shadow-front-idle:
     0 8px 30px rgba(0, 0, 0, 0.55), 0 4px 12px rgba(0, 0, 0, 0.4),
     0 0 0 1px rgba(255, 255, 255, 0.04);
-  --landing-doc-shadow-front-hover:
-    0 20px 52px rgba(0, 0, 0, 0.7), 0 10px 24px rgba(0, 0, 0, 0.5),
-    0 0 0 1px rgba(255, 255, 255, 0.06);
-  --landing-button-color: #e8eaf6;
   --landing-button-hover-bg: var(--bg-raised);
 
   /* selected file header colors for dark */
-  --header-selected-bg: #2040a0;
+  --header-selected-bg: var(--p-blue-700);
   --header-selected-fg: #ffffff;
-  /* file card background (dark) */
-  --file-card-bg: #0d1120;
-  --accordion-item-bg: #1c2340; /* accordion item background - more distinguishable */
-
-  /* shadows */
-  --drop-shadow-color: rgba(255, 255, 255, 0.05);
-  --drop-shadow-color-strong: rgba(255, 255, 255, 0.03);
-  --drop-shadow-filter: drop-shadow(0 0.2rem 0.4rem rgba(0, 0, 0, 0.3))
-    drop-shadow(0 0.6rem 0.6rem rgba(0, 0, 0, 0.2))
-    drop-shadow(0 1.2rem 1rem rgba(0, 0, 0, 0.15));
 
   /* Adjust shadows for dark mode */
   --shadow-xs: 0 1px 2px rgba(0, 0, 0, 0.4);
@@ -636,87 +438,41 @@
   --shadow-lg: 0 10px 15px rgba(0, 0, 0, 0.5);
   --shadow-xl: 0 20px 25px rgba(0, 0, 0, 0.5);
 
-  --tools-text-and-icon-color: var(--text-primary);
-
-  /* Tool picker sticky header variables (dark mode) */
-  --tool-header-bg: #131729;
-  --tool-header-border: #1c2340;
-  --tool-header-text: #c2c8e0;
-  --tool-header-badge-bg: #1c2340;
-  --tool-header-badge-text: #e8eaf6;
-
-  /* Subcategory title styling (dark mode) */
-  --tool-subcategory-text-color: #5b6280;
-  --tool-subcategory-rule-color: #1c2340;
-
   /* PDF text selection colors (dark mode) */
-  --pdf-selection-bg: rgba(96, 130, 250, 0.25);
-  --pdf-selection-ring: rgba(96, 130, 250, 0.28);
-
-  /* Placeholder text colors (dark mode) */
-  --search-text-and-icon-color: #e8eaf6 !important;
-  --input-bg: #1c2340;
+  --pdf-selection-bg: color-mix(in srgb, var(--p-blue-400) 25%, transparent);
+  --pdf-selection-ring: color-mix(in srgb, var(--p-blue-400) 28%, transparent);
 
   /* Tool panel search bar background colors (dark mode) */
-  --tool-panel-search-bg: #0d1020;
-  --tool-panel-search-border-bottom: #1c2340;
 
-  --information-text-bg: #131729;
-  --information-text-color: #e0e3f8;
+  --information-text-color: var(--p-blue-400);
 
-  /* Bulk selection panel specific colors (dark mode) */
-  --bulk-panel-bg: var(--bg-raised); /* dark background for parent container */
-  --bulk-card-bg: var(--bg-raised); /* dark background for cards */
+  /* dark background for cards */
   --bulk-card-border: var(
     --border-default
   ); /* default border for cards and buttons */
   --bulk-card-hover-border: var(--border-strong); /* stronger border on hover */
-  --unsupported-bar-bg: #0d1020;
-  --unsupported-bar-border: #1c2340;
 
   /* Config Modal colors (dark mode) */
-  --modal-nav-bg: #0d1020;
-  --modal-nav-section-title: #5b6280;
-  --modal-nav-item: #c2c8e0;
-  --modal-nav-item-active: #4f8ef5;
-  --modal-nav-item-active-bg: rgba(79, 142, 245, 0.15);
-  --modal-content-bg: #131729;
-  --modal-header-border: rgba(255, 255, 255, 0.05);
+  --modal-nav-item: var(--p-gray-300);
 
   /* Onboarding (dark mode) */
-  --onboarding-title: #e8eaf6;
-  --onboarding-body: #9299b0;
-  --onboarding-step-active: #d8dcf0;
-  --onboarding-step-inactive: #2d3560;
+  --onboarding-step-active: var(--p-gray-250);
+  --onboarding-step-inactive: var(--p-zinc-500);
   /* API Keys section colors (dark mode) */
-  --api-keys-card-bg: #131729;
-  --api-keys-card-border: #1c2340;
   --api-keys-card-shadow: none;
-  --api-keys-input-bg: #0d1020;
-  --api-keys-input-border: #1c2340;
 
   /* Code token colors (dark mode - Cursor-like) */
-  --code-kw-color: #c792ea; /* purple */
-  --code-str-color: #c3e88d; /* green */
-  --code-num-color: #f78c6c; /* orange */
-  --code-com-color: #697098; /* muted gray-blue */
-  /* Compare tool specific colors (dark mode) - only for colors that don't have existing theme pairs */
-  --compare-upload-dropzone-bg: rgba(9, 11, 24, 0.45);
-  --compare-upload-dropzone-border: rgba(28, 35, 64, 0.6);
-  --compare-upload-icon-bg: rgba(28, 35, 64, 0.2);
-  --compare-upload-icon-color: rgba(232, 234, 246, 0.75);
-  --compare-upload-divider: rgba(28, 35, 64, 0.5);
+  --code-kw-color: var(--p-blue-400); /* purple */
+  --code-str-color: var(--p-green-500); /* green */
+  --code-num-color: var(--p-red-400); /* orange */
+  --code-com-color: var(--p-gray-500); /* muted gray-blue */
 
   /* Compare page label chip (dark mode): slightly darker than surrounding rows */
-  --compare-page-label-bg: #0d1020;
   --compare-page-label-fg: var(--text-secondary);
 
   /* Status indicator dot ring shadow (dark) */
   --status-dot-ring: 0 0 0 2px rgba(255, 255, 255, 0.15);
 
-  /* Input element styling (dark) */
-  --input-bg: #1c2340;
-
   /* Select/dropdown placeholder state (dark) */
   --select-placeholder-bg: var(--mantine-color-dark-5);
   --select-placeholder-text: var(--mantine-color-dark-2);
@@ -724,7 +480,6 @@
   /* Grouped format dropdown (dark) */
   --dropdown-trigger-bg: var(--mantine-color-dark-6);
   --dropdown-trigger-text: var(--mantine-color-dark-0);
-  --dropdown-trigger-text-disabled: var(--mantine-color-dark-1);
   --dropdown-trigger-icon: var(--mantine-color-dark-2);
   --dropdown-panel-bg: var(--mantine-color-dark-7);
   --dropdown-panel-border: var(--mantine-color-dark-4);
@@ -739,7 +494,6 @@
 
 /* Plan section card borders - only override in dark mode */
 [data-mantine-color-scheme="dark"] .plan-card {
-  --paper-border-color: rgb(44, 52, 120) !important;
 }
 
 [data-mantine-color-scheme="dark"] .plan-card [data-size="sm"] {
@@ -809,22 +563,22 @@
   border-radius: 8px;
 }
 
-/* Smooth transitions for theme switching */
+/* Smooth transitions for theme switching. Text `color` is deliberately EXCLUDED:
+   it must swap instantly, never fade white↔black through grey. */
 * {
   transition:
     background-color 0.2s ease,
-    border-color 0.2s ease,
-    color 0.2s ease;
+    border-color 0.2s ease;
 }
 /* ── PDF Link Overlay (viewer) ── */
 :root {
-  --link-hover-bg: rgba(10, 139, 255, 0.1);
-  --link-hover-border: rgba(10, 139, 255, 0.32);
+  --link-hover-bg: color-mix(in srgb, var(--p-blue-500) 10%, transparent);
+  --link-hover-border: color-mix(in srgb, var(--p-blue-500) 32%, transparent);
   --link-hover-shadow:
     inset 0 0 0 1px rgba(255, 255, 255, 0.35),
     0 1px 4px rgba(10, 139, 255, 0.12);
-  --link-focus-ring: rgba(10, 139, 255, 0.25);
-  --link-toolbar-bg: rgba(15, 23, 42, 0.88);
+  --link-focus-ring: color-mix(in srgb, var(--p-blue-500) 25%, transparent);
+  --link-toolbar-bg: color-mix(in srgb, var(--p-blue-700) 88%, transparent);
   --link-toolbar-border: rgba(255, 255, 255, 0.1);
   --link-toolbar-shadow:
     0 12px 40px rgba(0, 0, 0, 0.2), 0 4px 12px rgba(0, 0, 0, 0.16),
@@ -832,12 +586,12 @@
 }
 
 [data-mantine-color-scheme="dark"] {
-  --link-hover-bg: rgba(79, 130, 245, 0.14);
-  --link-hover-border: rgba(79, 130, 245, 0.38);
+  --link-hover-bg: color-mix(in srgb, var(--p-blue-500) 14%, transparent);
+  --link-hover-border: color-mix(in srgb, var(--p-blue-500) 38%, transparent);
   --link-hover-shadow:
     inset 0 0 0 1px rgba(255, 255, 255, 0.1), 0 1px 4px rgba(79, 142, 245, 0.18);
-  --link-focus-ring: rgba(79, 130, 245, 0.3);
-  --link-toolbar-bg: rgba(9, 11, 24, 0.94);
+  --link-focus-ring: color-mix(in srgb, var(--p-blue-500) 30%, transparent);
+  --link-toolbar-bg: color-mix(in srgb, var(--p-blue-700) 94%, transparent);
   --link-toolbar-border: rgba(255, 255, 255, 0.07);
   --link-toolbar-shadow:
     0 12px 40px rgba(0, 0, 0, 0.5), 0 4px 12px rgba(0, 0, 0, 0.35),
@@ -1021,7 +775,7 @@
 }
 
 :root {
-  --shadow-color: rgba(15, 23, 42, 0.55);
+  --shadow-color: color-mix(in srgb, var(--p-blue-700) 55%, transparent);
 }
 
 [data-theme="dark"] {
@@ -1039,9 +793,8 @@
   display: block;
 }
 
-/* Theme-aware image display utilities */
-/* Use .theme-img-light-only for images to show in light mode only */
-/* Use .theme-img-dark-only for images to show in dark mode only */
+/* Theme-aware image display utilities: .theme-img-light-only shows in light
+   mode only, .theme-img-dark-only shows in dark mode only. */
 .theme-img-light-only {
   display: inline;
 }
@@ -1105,8 +858,8 @@
   fill: var(--mantine-color-body);
 }
 
-/* Wordmark muted variant (used in empty/placeholder states) */
-/* Stirling text: 30% opacity in light mode, full opacity in dark */
+/* Wordmark muted variant (empty/placeholder states).
+   Stirling text: 30% opacity in light mode, full opacity in dark. */
 .wordmark__text--muted {
   fill-opacity: 0.3;
 }
diff --git a/frontend/editor/src/core/theme/README.md b/frontend/editor/src/core/theme/README.md
new file mode 100644
index 0000000000..8abc110723
--- /dev/null
+++ b/frontend/editor/src/core/theme/README.md
@@ -0,0 +1,75 @@
+# Theme system (`core/theme/`)
+
+Read this before touching colours or theming anywhere in the frontend.
+
+## TL;DR rules
+
+1. **Never write a raw colour** (`#hex`, `rgb()`, `hsl()`, or a named colour like `red`) in a component, inline style, or stylesheet. Use a token:
+   - `var(--c-…)` — a **semantic** token (preferred: `--c-text`, `--c-surface`, `--c-primary`, …).
+   - `var(--p-…)` — a **palette** primitive, only when no semantic token fits.
+2. **The only file allowed to contain literal colours is `primitives.css`.** If you need a new hue, add it there first, then reference it.
+3. Structural `black` / `white` / `transparent` (shadows, scrims, overlays) are allowed anywhere.
+4. Colours must adapt to light/dark automatically. If you're reaching for a hardcoded colour "just for dark mode", you're doing it wrong — pick the right `--c-*` token.
+5. `task frontend:lint:colors` enforces rules 1–3 **inside `core/theme/`** (see [Linter](#linter)).
+
+## Files
+
+| File | Role |
+|---|---|
+| `primitives.css` | **The palette.** 41 literal colours (`--p-*`) — one neutral ramp (`--p-gray-*` light, `--p-zinc-*` dark) + status hues (blue/green/amber/red). The ONLY place literals live. |
+| `colors.css` | **Semantic tokens** (`--c-*`), mapped from primitives per theme. This is what you should reference. |
+| `compat.css` | **Legacy-name aliases** → `--c-*`. Lets old files keep their `--bg-surface` / `--color-text-1` / etc. names working. Uses `:root:root` so it out-ranks legacy files. |
+| `dimensions.css` | Non-colour tokens: spacing, radius, z-index, type, motion. |
+| `index.css` | Barrel that `@import`s the above. Imported by `ThemeProvider` (and Storybook). |
+| `mantineTheme.ts` | Mantine theme object wiring. |
+
+Two **legacy** colour files still exist outside this folder and are being phased out — prefer `--c-*` over their tokens, and don't add to them:
+`core/styles/theme.css` (editor `--bg-*`/`--text-*` vocab) and `core/tokens/tokens.css` (SUI `--color-*` vocab, gradients, code palette). `compat.css` already overrides their surface/text/border tokens, so most of what they define is dead weight.
+
+## Semantic tokens (`--c-*`)
+
+Reference these, not primitives, wherever possible:
+
+- **Surfaces (elevation):** `--c-bg` (canvas) < `--c-bg-raised` (sidebars/toolbars) < `--c-surface` (cards/modals) < `--c-surface-raised` < `--c-surface-sunken`; plus `--c-input-bg`, `--c-hover`, `--c-active`, `--c-overlay`.
+- **Text:** `--c-text`, `--c-text-muted`, `--c-text-subtle`, `--c-text-on-primary` (foreground on a filled primary).
+- **Borders:** `--c-border`, `--c-border-subtle`, `--c-border-strong`.
+- **Accent:** `--c-primary`, `--c-primary-hover`, `--c-primary-subtle`, and `--c-accent-fg` (see below).
+- **Status:** `--c-success`, `--c-danger`.
+
+## Theme model
+
+The **mode** and the **accent colour** are independent.
+
+- `preferences.theme` is the mode: `light` | `dark` | `system` (System follows the OS). There is no separate "custom" or "midnight" mode any more.
+- Light and dark each have their **own accent**: `preferences.lightPrimary` / `preferences.darkPrimary` (both default `#3b82f6` blue).
+- `ThemeProvider` resolves the mode to a concrete `light`/`dark` base, picks that side's accent, and **always** sets `data-app-theme="custom"` on `<html>`. So the custom-tint blocks in `colors.css` are the only themed blocks that apply — the chosen accent drives every accent **and** a subtle app-wide surface tint. With the default blue the tint is near-neutral.
+- Selection attributes on `<html>`: `data-theme` = `light|dark` (SUI + the tint blocks), `data-mantine-color-scheme` = `light|dark` (Mantine).
+
+### Custom-theme contrast guardrails (`core/utils/customPrimary.ts`)
+
+Because the accent is user-chosen, `deriveAccessiblePrimary(pick, base)` clamps it and injects three vars on `<html>`:
+
+- `--user-primary` → `--c-primary`. Lightness-clamped so it can't collapse into the base (dark floor `L ≥ 0.42`, light ceil `L ≤ 0.6`). Used for **fills**.
+- `--user-primary-on` → `--c-text-on-primary`. White by default; flips to **black only for genuinely light picks** (relative-luminance cutoff `0.62`, so saturated amber/green/cyan keep white text).
+- `--user-accent-fg` → `--c-accent-fg`. The accent tuned as a **foreground** (text/icon on the app surface): forced light on dark bases (`L ≥ 0.62`), dark on light (`L ≤ 0.45`), so accent text never goes dark-on-dark.
+
+**Rule of thumb:** a filled control's background uses `--c-primary` with its label on `--c-text-on-primary`; an accent used **as text/icon on a surface** (nav selection, links, tool-header text) uses `--c-accent-fg`. Because `compat.css` (`:root:root`) wins on specificity, accent-as-text legacy tokens are routed there as `var(--c-accent-fg, var(--c-primary))` — the fallback keeps non-custom builds on the raw primary.
+
+The FAB / logo mark is a deliberate exception: it's pinned to white (`--p-white`), not the on-primary flip — a brand mark, not body text.
+
+## Linter
+
+One file: `editor/scripts/lint/theme-lint.mjs` (no baseline). Run via `task frontend:lint:colors` (part of `task frontend:lint`).
+
+- **Default (blocking):** enforces "literals only in `primitives.css`; everything else in `core/theme/` references tokens; no duplicate primitives." Scope is deliberately just `core/theme/` — the layer this owns, which is clean.
+- **`node theme-lint.mjs contrast`** (task `frontend:contrast`, non-blocking): WCAG contrast report for text-on-surface / on-primary pairs per theme.
+
+App-wide "no hardcoded colours in components" is **not** enforced yet (there are 260+ legacy sites); that's a separate migration. Don't add new hardcoded colours regardless.
+
+## Gotchas
+
+- **`--mantine-*` vars are consumed by Mantine at runtime**, not via our `var()`. A source scan can't see their use — never delete them as "unused", and set them (not raw colours) when overriding Mantine.
+- **`--accent-*` (categorical hues) are used dynamically** via `` `var(--accent-${hue})` `` in `utils/accentColors.ts`. A literal search won't find them — don't treat them as unused.
+- **Tailwind consumes some vars** (`--gray-*`, `--color-*`, `--background`, `--border`) via `editor/tailwind.config.js` using `rgb(var(--x))`. That file is outside the usual scan roots — check it before removing those.
+- **Specificity:** `compat.css` uses `:root:root` (0,2,0) to beat legacy files. If a token you set in `colors.css` (`html[data-app-theme="custom"]`, 0,1,1) isn't winning, a `:root:root` or a `[data-mantine-color-scheme]`-compound block is probably overriding it — set it in `compat.css` or the more specific block.
+- **Adding a colour:** put the literal in `primitives.css`, map it to a `--c-*` in `colors.css` if it's a new semantic role, and reference the `--c-*` (or an existing `compat` alias) from components. Don't skip straight to a `--p-*` in a component unless there's genuinely no semantic fit.
diff --git a/frontend/editor/src/core/theme/colors.css b/frontend/editor/src/core/theme/colors.css
new file mode 100644
index 0000000000..927053f0a1
--- /dev/null
+++ b/frontend/editor/src/core/theme/colors.css
@@ -0,0 +1,264 @@
+/* COLORS — canonical semantic core (~21 --c-* tokens) mapped from primitives.css per theme; compat.css aliases legacy names onto these. Editor: always data-app-theme="custom" + data-mantine-color-scheme=light|dark. Portal/Storybook: data-theme=light|dark → LIGHT/MIDNIGHT. */
+/* Surface elevation: --c-bg (canvas) < --c-bg-raised (sidebars) < --c-surface (cards) < --c-surface-raised < --c-surface-sunken; plus --c-input-bg, --c-hover, --c-active, --c-overlay. */
+
+/* ── LIGHT ───────────────────────────────────────────────────────────────── */
+:root,
+[data-theme="light"],
+html[data-app-theme="light"] {
+  --c-bg: var(--p-gray-50);
+  --c-bg-raised: var(--p-white);
+  --c-surface: var(--p-white);
+  --c-surface-raised: var(--p-white);
+  --c-surface-sunken: var(--p-gray-100);
+  --c-input-bg: var(--p-white);
+  --c-hover: var(--p-gray-50);
+  --c-active: var(--p-gray-100);
+  --c-overlay: rgba(0, 0, 0, 0.5);
+
+  --c-text: var(--p-gray-900);
+  --c-text-muted: var(--p-gray-600);
+  --c-text-subtle: var(--p-gray-500);
+  --c-text-on-primary: var(--p-white);
+
+  --c-border: var(--p-gray-250);
+  --c-border-subtle: var(--p-gray-200);
+  --c-border-strong: var(--p-gray-400);
+
+  --c-primary: var(--p-blue-500);
+  --c-primary-hover: var(--p-blue-600);
+  --c-primary-subtle: color-mix(in srgb, var(--p-blue-500) 10%, transparent);
+
+  --c-success: var(--p-green-600);
+  --c-danger: var(--p-red-600);
+}
+
+/* ── MIDNIGHT (original navy) — also the default portal/Storybook dark ────── */
+[data-theme="dark"],
+html[data-app-theme="midnight"] {
+  --c-bg: var(--p-zinc-900);
+  --c-bg-raised: var(--p-zinc-850);
+  --c-surface: var(--p-zinc-800);
+  --c-surface-raised: var(--p-zinc-650);
+  --c-surface-sunken: var(--p-zinc-850);
+  --c-input-bg: var(--p-zinc-650);
+  --c-hover: var(--p-gray-800);
+  --c-active: var(--p-gray-800);
+  --c-overlay: rgba(0, 0, 0, 0.6);
+
+  --c-text: var(--p-zinc-100);
+  --c-text-muted: var(--p-zinc-200);
+  --c-text-subtle: var(--p-zinc-300);
+  --c-text-on-primary: var(--p-white);
+
+  --c-border: var(--p-zinc-650);
+  --c-border-subtle: rgba(255, 255, 255, 0.05);
+  --c-border-strong: var(--p-zinc-500);
+
+  --c-primary: var(--p-blue-500);
+  --c-primary-hover: var(--p-blue-700);
+  --c-primary-subtle: color-mix(in srgb, var(--p-blue-500) 15%, transparent);
+
+  --c-success: var(--p-green-500);
+  --c-danger: var(--p-red-500);
+}
+
+/* ── Base accent — fixed default (blue buttons); [data-accent="default"] blocks at the end keep surfaces neutral. LIGHT base here, DARK base next. ── */
+html[data-app-theme="custom"] {
+  --c-primary: var(--p-blue-500);
+  --c-primary-hover: color-mix(in srgb, var(--c-primary) 85%, var(--p-black));
+  --c-primary-subtle: color-mix(in srgb, var(--c-primary) 14%, transparent);
+  --c-text-on-primary: var(--p-white);
+  --c-accent-fg: var(--c-primary);
+
+  /* Primary-tinted surfaces (light base). Neutralised by the default override. */
+  --c-bg: color-mix(in srgb, var(--c-primary) 7%, var(--p-gray-50));
+  --c-bg-raised: color-mix(in srgb, var(--c-primary) 4%, var(--p-white));
+  --c-surface: color-mix(in srgb, var(--c-primary) 3%, var(--p-white));
+  --c-surface-raised: color-mix(in srgb, var(--c-primary) 4%, var(--p-white));
+  --c-surface-sunken: color-mix(
+    in srgb,
+    var(--c-primary) 8%,
+    var(--p-gray-100)
+  );
+  --c-input-bg: color-mix(in srgb, var(--c-primary) 2%, var(--p-white));
+  --c-hover: color-mix(in srgb, var(--c-primary) 9%, var(--p-gray-50));
+  --c-active: color-mix(in srgb, var(--c-primary) 13%, var(--p-gray-100));
+  --c-border: color-mix(in srgb, var(--c-primary) 14%, var(--p-gray-250));
+  --c-border-subtle: color-mix(
+    in srgb,
+    var(--c-primary) 10%,
+    var(--p-gray-200)
+  );
+
+  /* Mantine primary ramp (--color-primary-*) derived from --c-primary. */
+  --color-primary-50: color-mix(in srgb, var(--c-primary) 12%, var(--p-white));
+  --color-primary-100: color-mix(in srgb, var(--c-primary) 20%, var(--p-white));
+  --color-primary-200: color-mix(in srgb, var(--c-primary) 35%, var(--p-white));
+  --color-primary-300: color-mix(in srgb, var(--c-primary) 55%, var(--p-white));
+  --color-primary-400: color-mix(in srgb, var(--c-primary) 78%, var(--p-white));
+  --color-primary-500: var(--c-primary);
+  --color-primary-600: color-mix(in srgb, var(--c-primary) 88%, var(--p-black));
+  --color-primary-700: color-mix(in srgb, var(--c-primary) 74%, var(--p-black));
+  --color-primary-800: color-mix(in srgb, var(--c-primary) 60%, var(--p-black));
+  --color-primary-900: color-mix(in srgb, var(--c-primary) 46%, var(--p-black));
+  --mantine-primary-color-filled: var(--c-primary);
+  --mantine-primary-color-filled-hover: var(--c-primary-hover);
+  /* Mantine "light" variant surfaces (chips, subtle buttons, some panels). */
+  --mantine-primary-color-light: color-mix(
+    in srgb,
+    var(--c-primary) 12%,
+    transparent
+  );
+  --mantine-primary-color-light-hover: color-mix(
+    in srgb,
+    var(--c-primary) 18%,
+    transparent
+  );
+  --mantine-primary-color-light-color: var(--c-primary);
+
+  /* Brand-tint family — re-derived from --c-primary so legacy accents harmonise to the chosen hue. */
+
+  /* Fills / borders — text uses --c-text-on-primary. */
+  --btn-open-file: var(--c-primary);
+  --header-selected-bg: var(--c-primary);
+  --header-selected-fg: var(--c-text-on-primary);
+  --checkbox-checked-bg: var(--c-primary);
+  --card-selected-border: var(--c-primary);
+
+  /* Accent-as-text/icon tokens live in compat.css (:root:root wins); only --icon-files-color is owned here. */
+  --icon-files-color: var(--c-accent-fg);
+
+  /* Subtle surface tints (mix with the base surface so they adapt light/dark) */
+  --tool-header-border: color-mix(
+    in srgb,
+    var(--c-primary) 28%,
+    var(--c-surface)
+  );
+  --tool-header-badge-bg: color-mix(
+    in srgb,
+    var(--c-primary) 20%,
+    var(--c-surface)
+  );
+  --tooltip-title-bg: color-mix(
+    in srgb,
+    var(--c-primary) 12%,
+    var(--c-surface)
+  );
+  --landing-inner-paper-bg: color-mix(
+    in srgb,
+    var(--c-primary) 8%,
+    var(--c-surface)
+  );
+  --landing-inner-paper-border: color-mix(
+    in srgb,
+    var(--c-primary) 25%,
+    var(--c-surface)
+  );
+  --landing-button-border: color-mix(
+    in srgb,
+    var(--c-primary) 22%,
+    var(--c-surface)
+  );
+  --landing-hero-gradient: linear-gradient(
+    135deg,
+    var(--c-primary) 0%,
+    var(--c-primary-hover) 100%
+  );
+
+  /* Translucent state tints */
+  --color-nav-active: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  --modal-nav-item-active-bg: color-mix(
+    in srgb,
+    var(--c-primary) 10%,
+    transparent
+  );
+  --pdf-selection-bg: color-mix(in srgb, var(--c-primary) 20%, transparent);
+  --pdf-selection-ring: color-mix(in srgb, var(--c-primary) 28%, transparent);
+  --tool-panel-search-bg: color-mix(
+    in srgb,
+    var(--c-primary) 6%,
+    var(--c-surface)
+  );
+}
+
+/* ── DARK — editor dark theme: neutral text/borders/icons + accent-tinted surfaces (default override opts out). After :root so it wins for dark. ── */
+html[data-app-theme="custom"][data-mantine-color-scheme="dark"] {
+  /* Neutral text / borders / overlay (not accent-tinted). */
+  --c-text: var(--p-zinc-100);
+  --c-text-muted: var(--p-zinc-200);
+  --c-text-subtle: var(--p-zinc-300);
+  --c-border-strong: var(--p-zinc-500);
+  --c-overlay: rgba(0, 0, 0, 0.6);
+
+  /* Accent-tinted surfaces (dark base). Neutralised by the default override. */
+  --c-bg: color-mix(in srgb, var(--c-primary) 8%, var(--p-zinc-950));
+  --c-bg-raised: color-mix(in srgb, var(--c-primary) 9%, var(--p-zinc-850));
+  --c-surface: color-mix(in srgb, var(--c-primary) 8%, var(--p-zinc-800));
+  --c-surface-raised: color-mix(
+    in srgb,
+    var(--c-primary) 9%,
+    var(--p-zinc-775)
+  );
+  --c-surface-sunken: color-mix(
+    in srgb,
+    var(--c-primary) 8%,
+    var(--p-zinc-900)
+  );
+  --c-input-bg: color-mix(in srgb, var(--c-primary) 7%, var(--p-zinc-900));
+  --c-hover: color-mix(in srgb, var(--c-primary) 12%, var(--p-zinc-750));
+  --c-active: color-mix(in srgb, var(--c-primary) 15%, var(--p-zinc-700));
+  --c-border: color-mix(in srgb, var(--c-primary) 14%, var(--p-zinc-650));
+  --c-border-subtle: color-mix(
+    in srgb,
+    var(--c-primary) 10%,
+    var(--p-zinc-700)
+  );
+
+  /* Dark-tuned status shades (lighter than the light-theme :root values). */
+  --c-success: var(--p-green-500);
+  --c-danger: var(--p-red-400);
+
+  /* Category icon chips → neutral. */
+  --icon-tools-bg: var(--c-surface-raised);
+  --icon-inactive-bg: var(--c-surface-raised);
+  --icon-tools-color: var(--c-text-muted);
+  --icon-files-color: var(--c-text-muted);
+  --icon-inactive-color: var(--c-text-muted);
+  --onboarding-step-inactive: var(--c-border-strong);
+
+  /* Point Mantine's dark ramp at the --c-* surfaces so components follow the theme. */
+  --mantine-color-dark-4: var(--c-border);
+  --mantine-color-dark-5: var(--c-surface-raised);
+  --mantine-color-dark-6: var(--c-surface);
+  --mantine-color-dark-7: var(--c-bg);
+  --mantine-color-body: var(--c-bg);
+  --mantine-color-default: var(--c-surface);
+  --mantine-color-default-hover: var(--c-hover);
+}
+
+/* ── DEFAULT (no tint) — surfaces opt out of the accent tint (neutral white/grey light, zinc dark); --c-primary stays for buttons. Extra [data-accent="default"] beats the tinted blocks. ── */
+html[data-app-theme="custom"][data-accent="default"] {
+  --c-bg: var(--p-gray-50);
+  --c-bg-raised: var(--p-white);
+  --c-surface: var(--p-white);
+  --c-surface-raised: var(--p-white);
+  --c-surface-sunken: var(--p-gray-100);
+  --c-input-bg: var(--p-white);
+  --c-hover: var(--p-gray-50);
+  --c-active: var(--p-gray-100);
+  --c-border: var(--p-gray-250);
+  --c-border-subtle: var(--p-gray-200);
+}
+
+html[data-app-theme="custom"][data-accent="default"][data-mantine-color-scheme="dark"] {
+  --c-bg: var(--p-zinc-950);
+  --c-bg-raised: var(--p-zinc-850);
+  --c-surface: var(--p-zinc-800);
+  --c-surface-raised: var(--p-zinc-775);
+  --c-surface-sunken: var(--p-zinc-900);
+  --c-input-bg: var(--p-zinc-900);
+  --c-hover: var(--p-zinc-750);
+  --c-active: var(--p-zinc-700);
+  --c-border: var(--p-zinc-650);
+  --c-border-subtle: var(--p-zinc-700);
+}
diff --git a/frontend/editor/src/core/theme/compat.css b/frontend/editor/src/core/theme/compat.css
new file mode 100644
index 0000000000..a7c6e40759
--- /dev/null
+++ b/frontend/editor/src/core/theme/compat.css
@@ -0,0 +1,148 @@
+/* COMPAT — legacy token names (editor --bg-/--text-, SUI/portal --color-) aliased onto the canonical --c- set so existing files keep working. :root:root (0,2,0) out-ranks the legacy blocks; aliases are theme-agnostic. */
+
+:root:root {
+  /* ── Canvas (darkest / centre) ── */
+  --bg-background: var(--c-bg);
+  --bg-file-manager: var(--c-bg);
+  --color-bg: var(--c-bg);
+
+  /* ── Raised chrome — sidebars, toolbars, headers, side nav. ── */
+  --bg-toolbar: var(--c-bg-raised);
+  --color-sidebar-bg: var(--c-bg-raised);
+  --color-header-bg: var(--c-bg-raised);
+  --modal-nav-bg: var(--c-bg-raised);
+  --unsupported-bar-bg: var(--c-bg-raised);
+
+  /* ── Surfaces — cards, modals, dropdowns, popovers ── */
+  --bg-surface: var(--c-surface);
+  --bg-file-list: var(--c-surface);
+  --modal-content-bg: var(--c-surface);
+  --bulk-panel-bg: var(--c-surface);
+  --bulk-card-bg: var(--c-surface);
+  --api-keys-card-bg: var(--c-surface);
+  --color-surface: var(--c-surface);
+  --color-dropdown-bg: var(--c-surface);
+  --information-text-bg: var(--c-surface);
+
+  --bg-raised: var(--c-surface-raised);
+  --file-card-bg: var(--c-surface-raised);
+  --color-surface-alt: var(--c-surface-raised);
+  --landing-inner-paper-bg: var(--c-surface-raised);
+  --accordion-item-bg: var(--c-surface-raised);
+
+  --bg-muted: var(--c-surface-sunken);
+  --color-bg-muted: var(--c-surface-sunken);
+  --tool-panel-search-bg: var(--c-surface-sunken);
+  --compare-page-label-bg: var(--c-surface-sunken);
+
+  /* ── Inputs ── */
+  --input-bg: var(--c-input-bg);
+  --api-keys-input-bg: var(--c-input-bg);
+
+  /* ── Text ── */
+  --text-primary: var(--c-text);
+  --color-text-1: var(--c-text);
+  --color-header-text: var(--c-text);
+  --color-logo-text: var(--c-text);
+  --tools-text-and-icon-color: var(--c-text);
+
+  --text-secondary: var(--c-text-muted);
+  --color-text-2: var(--c-text-muted);
+  --color-nav-hover-text: var(--c-text-muted);
+
+  --text-muted: var(--c-text-subtle);
+  --color-text-3: var(--c-text-subtle);
+  --color-text-4: var(--c-text-subtle);
+  --color-text-5: var(--c-text-subtle);
+  --color-text-6: var(--c-text-subtle);
+  --color-text-muted: var(--c-text-subtle);
+  --color-nav-text: var(--c-text-subtle);
+  --search-text-and-icon-color: var(--c-text-subtle);
+
+  /* ── Borders ── */
+  --border-default: var(--c-border);
+  --color-border: var(--c-border);
+  --color-border-input: var(--c-border);
+
+  --border-subtle: var(--c-border-subtle);
+  --color-border-light: var(--c-border-subtle);
+  --color-divider: var(--c-border-subtle);
+
+  --border-strong: var(--c-border-strong);
+  --border-hover: var(--c-border-strong);
+  --color-border-hover: var(--c-border-strong);
+
+  /* More borders/dividers that were still navy in neutral dark. */
+  --color-header-border: var(--c-border);
+  --color-sidebar-border: var(--c-border);
+  --color-dropdown-border: var(--c-border);
+  --color-search-border: var(--c-border);
+  --tool-header-border: var(--c-border);
+  --tool-panel-search-border-bottom: var(--c-border);
+  --landing-inner-paper-border: var(--c-border);
+  --unsupported-bar-border: var(--c-border);
+  --api-keys-card-border: var(--c-border);
+  --api-keys-input-border: var(--c-border);
+  --color-usage-track: var(--c-border);
+  --color-sidebar-divider: var(--c-border-subtle);
+  --tool-subcategory-rule-color: var(--c-border-subtle);
+  --modal-header-border: var(--c-border-subtle);
+
+  /* ── More surfaces that were still navy in neutral dark ── */
+  --color-bg-alt: var(--c-bg-raised);
+  --color-search-bg: var(--c-surface-sunken);
+  --color-dropdown-hover: var(--c-hover);
+  --tool-header-badge-bg: var(--c-surface-raised);
+  --color-nav-active: var(--c-primary-subtle);
+  --modal-nav-item-active-bg: var(--c-primary-subtle);
+
+  /* ── More text tokens that were still navy in neutral dark ── */
+  --onboarding-title: var(--c-text);
+  --onboarding-body: var(--c-text-muted);
+  --modal-nav-section-title: var(--c-text-subtle);
+  --tool-subcategory-text-color: var(--c-text-subtle);
+  --dropdown-trigger-text-disabled: var(--c-text-subtle);
+  --tool-header-badge-text: var(--c-accent-fg, var(--c-primary));
+  --tooltip-title-bg: color-mix(
+    in srgb,
+    var(--c-primary) 12%,
+    var(--c-surface)
+  );
+  --tooltip-title-color: var(--c-text);
+
+  /* ── Interaction states ── */
+  --hover-bg: var(--c-hover);
+  --color-bg-hover: var(--c-hover);
+  --color-nav-hover: var(--c-hover);
+  --automation-entry-hover-bg: var(--c-hover);
+  --active-bg: var(--c-active);
+
+  /* ── Primary / accent — fills/borders use raw --c-primary; text/icon-on-surface uses --c-accent-fg (falls back to --c-primary outside the custom theme). ── */
+  --color-blue: var(--c-primary);
+  --accent-blue: var(--c-primary);
+  --accent-interactive: var(--c-primary);
+  --btn-open-file: var(--c-primary);
+  --card-selected-border: var(--c-primary);
+  --checkbox-checked-bg: var(--c-primary);
+  --color-blue-dark: var(--c-primary-hover);
+  --modal-nav-item-active: var(--c-accent-fg, var(--c-primary));
+  --color-nav-active-text: var(--c-accent-fg, var(--c-primary));
+  --tool-header-text: var(--c-accent-fg, var(--c-primary));
+  --text-instruction: var(--c-accent-fg, var(--c-primary));
+  --landing-button-color: var(--c-accent-fg, var(--c-primary));
+  /* SUI "blue" accent border/light (secondary buttons, chips) — derived from the primary. */
+  --color-blue-border: color-mix(
+    in srgb,
+    var(--c-primary) 38%,
+    var(--c-surface)
+  );
+  --color-blue-light: color-mix(
+    in srgb,
+    var(--c-primary) 12%,
+    var(--c-surface)
+  );
+
+  /* ── Status ── */
+  --accent-green: var(--c-success);
+  --accent-red: var(--c-danger);
+}
diff --git a/frontend/editor/src/core/theme/dimensions.css b/frontend/editor/src/core/theme/dimensions.css
new file mode 100644
index 0000000000..8042fcade6
--- /dev/null
+++ b/frontend/editor/src/core/theme/dimensions.css
@@ -0,0 +1,65 @@
+/* DIMENSIONS — single source for every non-colour length (spacing, radius, sizing, borders, z-index, shadow, type, motion). Theme-agnostic. */
+
+:root {
+  /* ── Spacing — 4px grid. Canonical numeric scale + named aliases ── */
+  --space-0: 0;
+  --space-0_5: 0.125rem; /* 2px */
+  --space-1: 0.25rem; /* 4px */
+  --space-1_5: 0.375rem; /* 6px */
+  --space-2: 0.5rem; /* 8px */
+  --space-3: 0.75rem; /* 12px */
+  --space-4: 1rem; /* 16px */
+  --space-5: 1.25rem; /* 20px */
+  --space-6: 1.5rem; /* 24px */
+  --space-8: 2rem; /* 32px */
+
+  /* T-shirt aliases (legacy editor names) → the numeric scale above. */
+  --space-xs: var(--space-1); /* 4px */
+  --space-sm: var(--space-2); /* 8px */
+  --space-md: var(--space-4); /* 16px */
+  --space-lg: var(--space-6); /* 24px */
+  --space-xl: var(--space-8); /* 32px */
+
+  /* ── Radius — one coherent scale (resolves the 8px-vs-6px collision) ── */
+  --radius-xs: 2px;
+  --radius-sm: 4px;
+  --radius-md: 8px;
+  --radius-lg: 12px;
+  --radius-xl: 16px;
+  --radius-pill: 9999px;
+
+  /* ── Layout sizing ── */
+  --footer-height: 2rem;
+  --landing-stack-w: 224px;
+  --landing-stack-h: 176px;
+
+  /* --shadow-* is intentionally NOT defined here: editor (drop shadows) and SUI/portal (inset hairlines) reuse the name with different values. */
+
+  /* ── Typography ── */
+  --font-sans:
+    "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial,
+    sans-serif;
+  --font-mono:
+    "SF Mono", "Fira Code", Menlo, Consolas, "DejaVu Sans Mono", monospace;
+  --font-brand: "Alumni Sans", "Inter", sans-serif;
+
+  --font-weight-medium: 500;
+  --font-weight-semibold: 600;
+
+  /* ── Motion ── */
+  --motion-fast: 0.15s ease;
+  --motion-base: 0.2s cubic-bezier(0.4, 0, 0.2, 1);
+  --motion-slow: 0.3s ease;
+  --motion-enter: 0.22s cubic-bezier(0.4, 0, 0.2, 1);
+  --fullscreen-anim-duration-in: 0.28s;
+  --fullscreen-anim-duration-out: 0.22s;
+
+  /* ── Z-index ladder ── */
+  --z-dropdown: 25;
+  --z-drawer: 50;
+  --z-toast: 200;
+  /* Fullscreen tool-picker surfaces (editor) */
+  --z-fullscreen-icon-svg: 1;
+  --z-toolpicker-star: 1;
+  --z-fullscreen-surface: 1200;
+}
diff --git a/frontend/editor/src/core/theme/index.css b/frontend/editor/src/core/theme/index.css
new file mode 100644
index 0000000000..dc4523c653
--- /dev/null
+++ b/frontend/editor/src/core/theme/index.css
@@ -0,0 +1,5 @@
+/* Consolidated theme entry. Order matters: primitives → dimensions → colors → compat (legacy aliases, :root:root wins). */
+@import "./primitives.css";
+@import "./dimensions.css";
+@import "./colors.css";
+@import "./compat.css";
diff --git a/frontend/editor/src/core/theme/mantineTheme.ts b/frontend/editor/src/core/theme/mantineTheme.ts
index 743142e820..21496939af 100644
--- a/frontend/editor/src/core/theme/mantineTheme.ts
+++ b/frontend/editor/src/core/theme/mantineTheme.ts
@@ -58,21 +58,18 @@ const gray: MantineColorsTuple = [
   "var(--color-gray-900)",
 ];
 
-// Navy-indigo dark scale — replaces Mantine's neutral gray defaults so all
-// dark-mode components (SegmentedControl, inputs, dropdowns, etc.) use the
-// portal palette automatically via --mantine-color-dark-*.
-// dark-0..3 = text/icon shades, dark-4..7 = surface elevations, dark-8..9 = deepest bg.
+// Neutral dark scale (zinc, mirroring --p-zinc-*) replacing Mantine's default gray ramp; colors.css re-points dark-4..7 at the --c-* surfaces. 0..3 text, 4..7 surfaces, 8..9 deepest.
 const dark: MantineColorsTuple = [
-  "#c2c8e0", // dark-0  — primary text on dark bg
-  "#9299b0", // dark-1  — secondary text
-  "#6e7898", // dark-2  — muted text / icons
-  "#4a5282", // dark-3  — subtle text / dividers
-  "#1c2340", // dark-4  — elevated surface / selected bg (e.g. SegmentedControl indicator)
-  "#131729", // dark-5  — card / panel surface
-  "#0d1020", // dark-6  — toolbar / sidebar bg (e.g. SegmentedControl root)
-  "#090b18", // dark-7  — page background (deepest reachable surface)
-  "#07091a", // dark-8
-  "#050714", // dark-9
+  "#f4f4f5", // dark-0  — primary text on dark bg (zinc-100)
+  "#a1a1aa", // dark-1  — secondary text (zinc-200)
+  "#71717a", // dark-2  — muted text / icons (zinc-300)
+  "#52525b", // dark-3  — subtle text / dividers (zinc-400)
+  "#2a2a2e", // dark-4  — elevated surface / selected bg (zinc-650)
+  "#202023", // dark-5  — card / panel surface (zinc-775)
+  "#18181b", // dark-6  — toolbar / sidebar bg (zinc-800)
+  "#0f0f10", // dark-7  — page background (zinc-950)
+  "#070708", // dark-8  — deeper than the reachable surfaces
+  "#050506", // dark-9  — deepest
 ];
 
 export const mantineTheme = createTheme({
@@ -292,7 +289,7 @@ export const mantineTheme = createTheme({
         tooltip: {
           backgroundColor: "var( --tooltip-title-bg)",
           color: "var( --tooltip-title-color)",
-          border: "1px solid var(--tooltip-borderp)",
+          border: "1px solid var(--tooltip-border)",
           fontSize: "0.75rem",
           fontWeight: "500",
           boxShadow: "var(--shadow-md)",
diff --git a/frontend/editor/src/core/theme/primitives.css b/frontend/editor/src/core/theme/primitives.css
new file mode 100644
index 0000000000..901a3dd646
--- /dev/null
+++ b/frontend/editor/src/core/theme/primitives.css
@@ -0,0 +1,45 @@
+/* PRIMITIVES — the raw palette (theme-agnostic). The ONE place literal colours live: neutral ramps (gray=light, zinc=dark) + status hues; colors.css and compat.css reference these. */
+
+:root {
+  --p-white: #ffffff;
+  --p-black: #000000;
+  --p-gray-50: #f9fafb;
+  --p-gray-100: #f3f4f6;
+  --p-gray-150: #eef0f2;
+  --p-gray-200: #e5e7eb;
+  --p-gray-250: #e2e8f0;
+  --p-gray-300: #d1d5db;
+  --p-gray-400: #9ca3af;
+  --p-gray-500: #6b7280;
+  --p-gray-600: #4b5563;
+  --p-gray-700: #374151;
+  --p-gray-800: #1f2937;
+  --p-gray-900: #111827;
+  --p-zinc-950: #0f0f10;
+  --p-zinc-900: #101012;
+  --p-zinc-850: #131315;
+  --p-zinc-800: #18181b;
+  --p-zinc-775: #202023;
+  --p-zinc-750: #1f1f23;
+  --p-zinc-700: #27272a;
+  --p-zinc-650: #2a2a2e;
+  --p-zinc-600: #333338;
+  --p-zinc-500: #3f3f46;
+  --p-zinc-400: #52525b;
+  --p-zinc-300: #71717a;
+  --p-zinc-200: #a1a1aa;
+  --p-zinc-100: #f4f4f5;
+  --p-blue-400: #60a5fa;
+  --p-blue-500: #3b82f6;
+  --p-blue-600: #2563eb;
+  --p-blue-700: #1d4ed8;
+  --p-green-500: #22c55e;
+  --p-green-600: #16a34a;
+  --p-green-700: #15803d;
+  --p-amber-400: #fbbf24;
+  --p-amber-500: #f59e0b;
+  --p-amber-600: #d97706;
+  --p-red-400: #f87171;
+  --p-red-500: #ef4444;
+  --p-red-600: #dc2626;
+}
diff --git a/frontend/editor/src/core/tokens/Tokens.stories.tsx b/frontend/editor/src/core/tokens/Tokens.stories.tsx
index f83c93517c..7543d7d4d6 100644
--- a/frontend/editor/src/core/tokens/Tokens.stories.tsx
+++ b/frontend/editor/src/core/tokens/Tokens.stories.tsx
@@ -92,8 +92,10 @@ export const Colours: Story = {
       <Group
         heading="Brand & status"
         swatches={[
-          { label: "Blue", varName: "--color-blue" },
-          { label: "Blue dark", varName: "--color-blue-dark" },
+          // The accent — follows the custom light/dark theme colour, not a fixed
+          // blue (maps to --c-primary / --c-primary-hover). Will change the name in a future PR to reflect that it's the chosen accent, not a fixed blue.
+          { label: "Primary", varName: "--color-blue" },
+          { label: "Primary hover", varName: "--color-blue-dark" },
           { label: "Purple", varName: "--color-purple" },
           { label: "Green", varName: "--color-green" },
           { label: "Amber", varName: "--color-amber" },
diff --git a/frontend/editor/src/core/tokens/base.css b/frontend/editor/src/core/tokens/base.css
index b9b40e0c2c..581af3f387 100644
--- a/frontend/editor/src/core/tokens/base.css
+++ b/frontend/editor/src/core/tokens/base.css
@@ -16,9 +16,7 @@ body,
   font-family: var(--font-sans);
   -webkit-font-smoothing: antialiased;
   -moz-osx-font-smoothing: grayscale;
-  transition:
-    background var(--motion-slow),
-    color var(--motion-slow);
+  transition: background var(--motion-slow);
 }
 
 button {
diff --git a/frontend/editor/src/core/tokens/tokens.css b/frontend/editor/src/core/tokens/tokens.css
index f667a93851..989fdb7e4b 100644
--- a/frontend/editor/src/core/tokens/tokens.css
+++ b/frontend/editor/src/core/tokens/tokens.css
@@ -13,18 +13,11 @@
 :root,
 [data-theme="light"] {
   /* Text hierarchy */
-  --color-text-1: #0f172a;
-  --color-text-2: #1a202c;
-  --color-text-3: #475569;
-  --color-text-4: #64748b;
   /* text-5 was #94a3b8 (≈2.85:1 on white — fails WCAG AA). Bumped to #64748b
      so meta/timestamp copy at small sizes still passes contrast. The visual
      hierarchy now collapses text-4 and text-5 into the same shade — use weight
      or size to differentiate in components instead. */
-  --color-text-5: #64748b;
-  --color-text-6: #6b7280;
-  --color-text-muted: #8b92a1;
-  --color-text-placeholder: #9ca3af;
+  --color-text-placeholder: var(--p-gray-400);
 
   /* Body text colour for use on coloured / gradient backgrounds (blue buttons,
      assistant header, onboarding "done" badges). Theme-stable: even in dark
@@ -32,105 +25,70 @@
   --color-text-on-accent: #ffffff;
 
   /* Brand / status */
-  --color-blue: #3b82f6;
-  --color-blue-dark: #2563eb;
-  --color-blue-light: #eff6ff;
-  --color-blue-border: #bfdbfe;
-  --color-purple: #8b5cf6;
-  --color-purple-light: #f5f3ff;
-  --color-purple-border: #ddd6fe;
-  --color-purple-dark: #7c3aed;
-  --color-green: #10b981;
-  --color-green-light: #ecfdf5;
-  --color-green-border: #a7f3d0;
-  --color-green-dark: #16a34a;
-  --color-red: #ef4444;
-  --color-red-light: #fee2e2;
-  --color-red-border: #fecaca;
-  --color-red-dark: #dc2626;
-  --color-amber: #f59e0b;
-  --color-amber-light: #fef3c7;
-  --color-amber-border: #fde68a;
-  --color-amber-dark: #92400e;
-  --color-orange: #f97316;
-  --color-orange-light: #fff7ed;
-  --color-orange-border: #fed7aa;
-  --color-orange-dark: #9a3412;
+  --color-purple: var(--p-blue-400);
+  --color-purple-light: var(--p-blue-400);
+  --color-purple-border: var(--p-blue-400);
+  --color-purple-dark: var(--p-blue-600);
+  --color-green: var(--p-green-500);
+  --color-green-light: var(--p-green-500);
+  --color-green-border: var(--p-green-500);
+  --color-green-dark: var(--p-green-600);
+  --color-red: var(--p-red-500);
+  --color-red-light: var(--p-red-400);
+  --color-red-border: var(--p-red-400);
+  --color-red-dark: var(--p-red-600);
+  --color-amber: var(--p-amber-500);
+  --color-amber-light: var(--p-amber-400);
+  --color-amber-border: var(--p-amber-400);
+  --color-amber-dark: var(--p-amber-600);
+  --color-orange: var(--p-amber-600);
+  --color-orange-light: var(--p-amber-400);
+  --color-orange-border: var(--p-amber-400);
+  --color-orange-dark: var(--p-red-600);
 
   /* Category accents (theme-stable) */
-  --color-cat-insurance: #0ea5e9;
-  --color-cat-compliance: #6366f1;
-  --color-cat-finance: #10b981;
-  --color-cat-legal: #3b82f6;
-  --color-cat-healthcare: #8b5cf6;
-  --color-cat-government: #dc2626;
-  --color-cat-operations: #ec4899;
-  --color-cat-hr: #f59e0b;
-  --color-cat-realestate: #84cc16;
-  --color-cat-energy: #f97316;
-  --color-cat-extraction: #14b8a6;
+  --color-cat-insurance: var(--p-blue-500);
+  --color-cat-compliance: var(--p-blue-500);
+  --color-cat-finance: var(--p-green-500);
+  --color-cat-legal: var(--p-blue-500);
+  --color-cat-healthcare: var(--p-blue-400);
+  --color-cat-government: var(--p-red-600);
+  --color-cat-operations: var(--p-red-400);
+  --color-cat-hr: var(--p-amber-500);
+  --color-cat-realestate: var(--p-green-500);
+  --color-cat-energy: var(--p-amber-600);
+  --color-cat-extraction: var(--p-blue-500);
 
   /* Surfaces */
-  --color-bg: #f8f9fb;
-  --color-bg-alt: #f6f8fa;
-  --color-surface: #ffffff;
-  --color-surface-alt: #ffffff;
-  --color-border: #e3e8ee;
-  --color-border-light: #eef0f2;
-  --color-border-input: #e2e8f0;
-  --color-border-hover: #cbd5e1;
-  --color-divider: #f0f0f0;
-  --color-bg-subtle: #f9fafb;
-  --color-bg-hover: #f8fafc;
-  --color-bg-muted: #f3f4f6;
-  --color-bg-code: #f1f5f9;
+  --color-bg-subtle: var(--p-gray-50);
+  --color-bg-code: var(--p-gray-100);
 
   /* Dropdowns / tooltips */
-  --color-dropdown-bg: #ffffff;
-  --color-dropdown-border: #e5e7eb;
-  --color-dropdown-hover: #f9fafb;
-  --color-tooltip-bg: #1e293b;
-  --color-tooltip-text: #f8fafc;
+  --color-tooltip-bg: var(--p-gray-800);
+  --color-tooltip-text: var(--p-gray-50);
 
   /* Navigation */
-  --color-nav-active: #eff6ff;
-  --color-nav-active-text: #3b82f6;
-  --color-nav-text: #4b5563;
-  --color-nav-hover: #f6f8fa;
-  --color-nav-hover-text: #1a202c;
-  --color-section-label: #9ca3af;
-  --color-logo-text: #111827;
+  --color-section-label: var(--p-gray-400);
 
   /* Header */
-  --color-header-bg: #ffffff;
-  --color-header-border: #f0f0f0;
-  --color-header-text: #111827;
-  --color-search-bg: #f9fafb;
-  --color-search-border: #e5e7eb;
-  --color-search-border-hover: #d1d5db;
-  --color-search-text: #9ca3af;
+  --color-search-border-hover: var(--p-gray-300);
+  --color-search-text: var(--p-gray-400);
 
   /* Sidebar */
-  --color-sidebar-bg: #ffffff;
-  --color-sidebar-border: #e5e7eb;
-  --color-sidebar-divider: #f0f0f0;
-  --color-usage-text: #6b7280;
-  --color-usage-value: #374151;
-  --color-usage-track: #f3f4f6;
+  --color-usage-text: var(--p-gray-500);
+  --color-usage-value: var(--p-gray-700);
 
-  --color-toggle-off: #cbd5e1;
-  --color-badge-red: #ef4444;
-
-  /* Segmented control — semantic tokens so dark mode can decouple from blue surfaces */
+  --color-toggle-off: var(--p-gray-300);
+  --color-badge-red: var(--p-red-500);
 
   /* Shadows */
-  --shadow-sm: inset 0 0 0 1px #e3e8ee;
-  --shadow-md: inset 0 0 0 1px #e3e8ee, 0 1px 2px rgba(15, 23, 42, 0.04);
-  --shadow-lg: inset 0 0 0 1px #e3e8ee, 0 4px 12px rgba(15, 23, 42, 0.06);
-  --shadow-blue:
-    0 1px 2px rgba(59, 130, 246, 0.25), inset 0 1px 0 rgba(255, 255, 255, 0.2);
-  --shadow-blue-hover:
-    0 2px 6px rgba(59, 130, 246, 0.3), inset 0 1px 0 rgba(255, 255, 255, 0.25);
+  --shadow-sm: inset 0 0 0 1px var(--p-gray-250);
+  --shadow-md:
+    inset 0 0 0 1px var(--p-gray-250),
+    0 1px 2px color-mix(in srgb, var(--p-blue-700) 4%, transparent);
+  --shadow-lg:
+    inset 0 0 0 1px var(--p-gray-250),
+    0 4px 12px color-mix(in srgb, var(--p-blue-700) 6%, transparent);
 
   /* Gradients */
   --grad-blue-btn: linear-gradient(
@@ -163,103 +121,58 @@
     #ef4444 50%,
     #dc2626 100%
   );
-  --grad-banner: linear-gradient(135deg, #eef2ff 0%, #ddd6fe 50%, #fce7f3 100%);
 }
 
 [data-theme="dark"] {
-  --color-text-1: #f1f5f9;
-  --color-text-2: #e2e8f0;
-  --color-text-3: #94a3b8;
-  --color-text-4: #64748b;
   /* Bumped from #475569 (fails AA) — see light-theme note. */
-  --color-text-5: #7c869a;
-  --color-text-6: #94a3b8;
-  --color-text-muted: #64748b;
-  --color-text-placeholder: #475569;
+  --color-text-placeholder: var(--p-gray-600);
 
-  --color-blue: #60a5fa;
-  --color-blue-dark: #3b82f6;
-  --color-blue-light: #1e293b;
-  --color-blue-border: #1e3a5f;
-  --color-purple: #a78bfa;
-  --color-purple-light: #1e1b2e;
-  --color-purple-border: #2e2650;
-  --color-purple-dark: #8b5cf6;
-  --color-green: #34d399;
-  --color-green-light: #0d2818;
-  --color-green-border: #065f46;
-  --color-green-dark: #22c55e;
-  --color-red: #f87171;
-  --color-red-light: #2d1215;
-  --color-red-border: #7f1d1d;
-  --color-red-dark: #ef4444;
-  --color-amber: #fbbf24;
-  --color-amber-light: #2d2006;
-  --color-amber-border: #78350f;
+  --color-purple: var(--p-blue-400);
+  --color-purple-light: var(--p-zinc-750);
+  --color-purple-border: var(--p-zinc-600);
+  --color-purple-dark: var(--p-blue-400);
+  --color-green: var(--p-green-500);
+  --color-green-light: var(--p-green-700);
+  --color-green-border: var(--p-green-700);
+  --color-green-dark: var(--p-green-500);
+  --color-red: var(--p-red-400);
+  --color-red-light: var(--p-zinc-800);
+  --color-red-border: var(--p-red-600);
+  --color-red-dark: var(--p-red-500);
+  --color-amber: var(--p-amber-400);
+  --color-amber-light: var(--p-amber-600);
+  --color-amber-border: var(--p-amber-600);
   /* Deeper than the base so it stays distinct (hover shade + amber text on
      dark surfaces). ~7.4:1 on --color-amber-light, passes WCAG AA. Was
      #fbbf24 — identical to the base — which left Mantine's amber hover a
      no-op in dark mode. */
-  --color-amber-dark: #f59e0b;
-  --color-orange: #fb923c;
-  --color-orange-light: #2a1408;
-  --color-orange-border: #7c2d12;
-  --color-orange-dark: #fdba74;
+  --color-amber-dark: var(--p-amber-500);
+  --color-orange: var(--p-amber-500);
+  --color-orange-light: var(--p-amber-600);
+  --color-orange-border: var(--p-red-600);
+  --color-orange-dark: var(--p-amber-400);
 
-  --color-bg: #090c14;
-  --color-bg-alt: #0d1120;
-  --color-surface: #151c2e;
-  --color-surface-alt: #1c2640;
-  --color-border: #283248;
-  --color-border-light: #1e2840;
-  --color-border-input: #2e3c55;
-  --color-border-hover: #3d4f6a;
-  --color-divider: #1e2840;
-  --color-bg-subtle: #111827;
-  --color-bg-hover: #1c2640;
-  --color-bg-muted: #243044;
-  --color-bg-code: #0b0f1a;
+  --color-bg-subtle: var(--p-gray-900);
+  --color-bg-code: var(--p-zinc-900);
 
-  --color-dropdown-bg: #151c2e;
-  --color-dropdown-border: #2e3c55;
-  --color-dropdown-hover: #1c2640;
-  --color-tooltip-bg: #e2e8f0;
-  --color-tooltip-text: #0f172a;
+  --color-tooltip-bg: var(--p-gray-250);
+  --color-tooltip-text: var(--p-blue-700);
 
-  --color-nav-active: #172044;
-  --color-nav-active-text: #60a5fa;
-  --color-nav-text: #94a3b8;
-  --color-nav-hover: #1c2640;
-  --color-nav-hover-text: #e2e8f0;
-  --color-section-label: #475569;
-  --color-logo-text: #f1f5f9;
+  --color-section-label: var(--p-gray-600);
 
-  --color-header-bg: #0d1120;
-  --color-header-border: #1e2840;
-  --color-header-text: #f1f5f9;
-  --color-search-bg: #151c2e;
-  --color-search-border: #2e3c55;
-  --color-search-border-hover: #3d4f6a;
-  --color-search-text: #64748b;
+  --color-search-border-hover: var(--p-gray-600);
+  --color-search-text: var(--p-gray-500);
 
-  --color-sidebar-bg: #0d1120;
-  --color-sidebar-border: #1e2840;
-  --color-sidebar-divider: #1e2840;
-  --color-usage-text: #64748b;
-  --color-usage-value: #94a3b8;
-  --color-usage-track: #1e2840;
+  --color-usage-text: var(--p-gray-500);
+  --color-usage-value: var(--p-gray-400);
 
-  --color-toggle-off: #3d4f6a;
+  --color-toggle-off: var(--p-gray-600);
 
   /* Segmented control — blue-toned dark to match app surface colors */
 
-  --shadow-sm: inset 0 0 0 1px #283248;
-  --shadow-md: inset 0 0 0 1px #283248, 0 1px 3px rgba(0, 0, 0, 0.3);
-  --shadow-lg: inset 0 0 0 1px #283248, 0 8px 24px rgba(0, 0, 0, 0.4);
-  --shadow-blue:
-    0 1px 3px rgba(59, 130, 246, 0.35), inset 0 1px 0 rgba(255, 255, 255, 0.1);
-  --shadow-blue-hover:
-    0 2px 8px rgba(59, 130, 246, 0.45), inset 0 1px 0 rgba(255, 255, 255, 0.15);
+  --shadow-sm: inset 0 0 0 1px var(--p-zinc-600);
+  --shadow-md: inset 0 0 0 1px var(--p-zinc-600), 0 1px 3px rgba(0, 0, 0, 0.3);
+  --shadow-lg: inset 0 0 0 1px var(--p-zinc-600), 0 8px 24px rgba(0, 0, 0, 0.4);
 
   --grad-blue-btn: linear-gradient(
     180deg,
@@ -267,7 +180,6 @@
     #2563eb 50%,
     #1d4ed8 100%
   );
-  --grad-banner: linear-gradient(135deg, #0f172a 0%, #111827 50%, #1a1535 100%);
 }
 
 /* Code palette — theme-aware: a light GitHub-style box in light mode, the dark
@@ -312,54 +224,18 @@
 
 /* Radii / typography / motion / spacing / z-index — theme-stable */
 :root {
-  /* Home hero strip navy. Theme-stable by design — the hero keeps this deep
-     navy in both light and dark (it's a branded surface, like the assistant
-     header), so it's defined once here rather than in the light/dark blocks. */
+  /* Home hero strip navy. Theme-stable by design — the white hero CTA keeps
+     this deep navy text in both light and dark (branded surface). The hero
+     background itself is accent-responsive (see EditorStatusCard/WelcomeBanner). */
   --color-hero-navy: #16213e;
 
-  --radius-xs: 0.1875rem;
-  --radius-sm: 0.25rem;
-  --radius-md: 0.375rem;
-  --radius-lg: 0.5rem;
-  --radius-xl: 0.75rem;
-  --radius-pill: 0.625rem;
-
-  --font-sans:
-    "Inter", -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial,
-    sans-serif;
-  --font-mono:
-    "SF Mono", "Fira Code", Menlo, Consolas, "DejaVu Sans Mono", monospace;
-  --font-brand: "Alumni Sans", "Inter", sans-serif;
-
-  --motion-fast: 0.15s ease;
-  --motion-base: 0.2s cubic-bezier(0.4, 0, 0.2, 1);
-  --motion-slow: 0.3s ease;
-  --motion-enter: 0.22s cubic-bezier(0.4, 0, 0.2, 1);
-
   /* 4-px grid spacing scale (rem so it tracks font-size changes). Use these
      in layout primitives + component CSS instead of bare 0.5rem / 0.75rem. */
-  --space-0: 0;
   --space-0_5: 0.125rem;
-  --space-1: 0.25rem;
   --space-1_5: 0.375rem;
-  --space-2: 0.5rem;
-  --space-3: 0.75rem;
-  --space-4: 1rem;
-  --space-5: 1.25rem;
-  --space-6: 1.5rem;
-  --space-8: 2rem;
-  --space-10: 2.5rem;
-  --space-12: 3rem;
 
   /* Z-index hierarchy. Pick the highest tier that still puts you below the
      thing that's supposed to win. Modals beat drawers beat dropdowns. */
-  --z-base: 0;
-  --z-sticky: 10;
-  --z-dropdown: 25;
-  --z-fixed-overlay: 35;
-  --z-drawer: 50;
-  --z-modal: 100;
-  --z-toast: 200;
 }
 
 /* Keyframes used across the app. */
diff --git a/frontend/editor/src/core/ui/ChatFABButton.css b/frontend/editor/src/core/ui/ChatFABButton.css
index 6b85e4c311..657f31a25d 100644
--- a/frontend/editor/src/core/ui/ChatFABButton.css
+++ b/frontend/editor/src/core/ui/ChatFABButton.css
@@ -6,10 +6,10 @@
   height: 56px;
   border-radius: 16px;
   border: none;
-  background: var(--color-blue, #3b82f6);
-  color: #fff;
+  background: var(--c-primary);
+  color: var(--p-white);
   cursor: pointer;
-  box-shadow: 0 4px 16px rgba(59, 130, 246, 0.4);
+  box-shadow: 0 4px 16px color-mix(in srgb, var(--c-primary) 40%, transparent);
   transition:
     transform 180ms cubic-bezier(0.32, 0.72, 0, 1),
     box-shadow 180ms ease;
@@ -20,7 +20,7 @@
 
 .chat-fab-btn:hover {
   transform: scale(1.09);
-  box-shadow: 0 6px 22px rgba(59, 130, 246, 0.52);
+  box-shadow: 0 6px 22px color-mix(in srgb, var(--c-primary) 52%, transparent);
 }
 
 .chat-fab-btn:active {
diff --git a/frontend/editor/src/core/ui/accents.css b/frontend/editor/src/core/ui/accents.css
index 75001f6777..1d47b4ec89 100644
--- a/frontend/editor/src/core/ui/accents.css
+++ b/frontend/editor/src/core/ui/accents.css
@@ -9,6 +9,10 @@
   --_bd: var(--color-blue-border);
   --_tint: color-mix(in srgb, var(--color-blue) 12%, transparent);
 }
+
+html[data-app-theme="custom"] .sui-acc-default {
+  --_on: var(--c-text-on-primary);
+}
 .sui-acc-danger {
   --_solid: var(--color-red);
   --_solid-hover: var(--color-red-dark);
diff --git a/frontend/editor/src/portal/components/EditorStatusCard.css b/frontend/editor/src/portal/components/EditorStatusCard.css
index 9732ec2fb0..10d8a020b4 100644
--- a/frontend/editor/src/portal/components/EditorStatusCard.css
+++ b/frontend/editor/src/portal/components/EditorStatusCard.css
@@ -15,7 +15,7 @@
   align-items: center;
   gap: 1.25rem;
   padding: 1rem 1.25rem;
-  background: var(--color-hero-navy);
+  background: color-mix(in srgb, var(--c-primary) 22%, var(--p-zinc-950));
 }
 
 .portal-editor-hero__logo {
diff --git a/frontend/editor/src/portal/components/WelcomeBanner.css b/frontend/editor/src/portal/components/WelcomeBanner.css
index 57f54846eb..457291eadb 100644
--- a/frontend/editor/src/portal/components/WelcomeBanner.css
+++ b/frontend/editor/src/portal/components/WelcomeBanner.css
@@ -18,7 +18,7 @@
   gap: 1rem;
   flex-wrap: wrap;
   padding: 0.875rem 1.25rem;
-  background: var(--color-hero-navy);
+  background: color-mix(in srgb, var(--c-primary) 22%, var(--p-zinc-950));
 }
 
 .portal-welcome__brand {
diff --git a/frontend/editor/src/portal/contexts/ThemeContext.tsx b/frontend/editor/src/portal/contexts/ThemeContext.tsx
index ad979f5e91..5b0dcf3d31 100644
--- a/frontend/editor/src/portal/contexts/ThemeContext.tsx
+++ b/frontend/editor/src/portal/contexts/ThemeContext.tsx
@@ -6,6 +6,12 @@ import {
   useState,
   type ReactNode,
 } from "react";
+import { preferencesService } from "@app/services/preferencesService";
+import {
+  getSystemTheme,
+  resolveColorScheme,
+  type ThemeMode,
+} from "@app/constants/theme";
 
 export type Theme = "light" | "dark";
 
@@ -17,33 +23,43 @@ interface ThemeContextValue {
 
 const ThemeContext = createContext<ThemeContextValue | null>(null);
 
-const STORAGE_KEY = "stirling.portal.theme";
-
-function readInitialTheme(): Theme {
-  if (typeof window === "undefined") return "light";
-  const stored = window.localStorage.getItem(STORAGE_KEY);
-  if (stored === "light" || stored === "dark") return stored;
-  return window.matchMedia("(prefers-color-scheme: dark)").matches
-    ? "dark"
-    : "light";
-}
-
 export function ThemeProvider({ children }: { children: ReactNode }) {
-  const [theme, setTheme] = useState<Theme>(readInitialTheme);
+  // Mirror the shared theme MODE; re-read on cross-tab storage changes and,
+  // while on "system", on OS scheme changes.
+  const [mode, setMode] = useState<ThemeMode>(() =>
+    preferencesService.getPreference("theme"),
+  );
+  const [systemScheme, setSystemScheme] = useState(getSystemTheme);
+
+  useEffect(() => {
+    const syncMode = () => setMode(preferencesService.getPreference("theme"));
+    window.addEventListener("storage", syncMode);
+    const media = window.matchMedia?.("(prefers-color-scheme: dark)");
+    const syncSystem = () => setSystemScheme(media?.matches ? "dark" : "light");
+    media?.addEventListener("change", syncSystem);
+    return () => {
+      window.removeEventListener("storage", syncMode);
+      media?.removeEventListener("change", syncSystem);
+    };
+  }, []);
+
+  const theme = resolveColorScheme(mode, systemScheme);
 
   useEffect(() => {
     document.documentElement.setAttribute("data-theme", theme);
-    window.localStorage.setItem(STORAGE_KEY, theme);
   }, [theme]);
 
-  const value = useMemo<ThemeContextValue>(
-    () => ({
+  const value = useMemo<ThemeContextValue>(() => {
+    const setTheme = (next: Theme) => {
+      preferencesService.setPreference("theme", next);
+      setMode(next);
+    };
+    return {
       theme,
       setTheme,
-      toggle: () => setTheme((t) => (t === "light" ? "dark" : "light")),
-    }),
-    [theme],
-  );
+      toggle: () => setTheme(theme === "light" ? "dark" : "light"),
+    };
+  }, [theme]);
 
   return (
     <ThemeContext.Provider value={value}>{children}</ThemeContext.Provider>
diff --git a/frontend/editor/src/proprietary/auth/ui/auth-theme.css b/frontend/editor/src/proprietary/auth/ui/auth-theme.css
index f62691f518..1da8ba13e8 100644
--- a/frontend/editor/src/proprietary/auth/ui/auth-theme.css
+++ b/frontend/editor/src/proprietary/auth/ui/auth-theme.css
@@ -2,25 +2,29 @@
 
 :root {
   /* Auth page colors (light mode) */
-  --auth-bg-color-light-only: #f3f4f6;
+  --auth-bg-color-light-only: var(--p-gray-100);
   --auth-card-bg: #ffffff;
   --auth-card-bg-light-only: #ffffff;
-  --auth-label-text-light-only: #374151;
-  --auth-input-border-light-only: #d1d5db;
+  --auth-label-text-light-only: var(--p-gray-700);
+  --auth-input-border-light-only: var(--p-gray-300);
   --auth-input-bg-light-only: #ffffff;
-  --auth-input-text-light-only: #111827;
-  --auth-border-focus-light-only: #3b82f6;
-  --auth-focus-ring-light-only: rgba(59, 130, 246, 0.1);
-  --auth-button-bg-light-only: #af3434;
+  --auth-input-text-light-only: var(--p-gray-900);
+  --auth-border-focus-light-only: var(--p-blue-500);
+  --auth-focus-ring-light-only: color-mix(
+    in srgb,
+    var(--p-blue-500) 10%,
+    transparent
+  );
+  --auth-button-bg-light-only: var(--p-red-600);
   --auth-button-text-light-only: #ffffff;
-  --auth-magic-button-bg-light-only: #e5e7eb;
-  --auth-magic-button-text-light-only: #374151;
-  --auth-text-primary-light-only: #111827;
-  --auth-text-secondary-light-only: #6b7280;
+  --auth-magic-button-bg-light-only: var(--p-gray-200);
+  --auth-magic-button-text-light-only: var(--p-gray-700);
+  --auth-text-primary-light-only: var(--p-gray-900);
+  --auth-text-secondary-light-only: var(--p-gray-500);
   --text-divider-rule-rgb-light: 229, 231, 235;
   --text-divider-label-rgb-light: 156, 163, 175;
-  --tool-subcategory-rule-color-light: #e5e7eb;
-  --tool-subcategory-text-color-light: #9ca3af;
+  --tool-subcategory-rule-color-light: var(--p-gray-200);
+  --tool-subcategory-text-color-light: var(--p-gray-400);
 }
 
 [data-mantine-color-scheme="dark"] {
@@ -31,9 +35,13 @@
   --auth-input-border-light-only: var(--border-default);
   --auth-input-bg-light-only: var(--bg-raised);
   --auth-input-text-light-only: var(--text-primary);
-  --auth-border-focus-light-only: #3b82f6;
-  --auth-focus-ring-light-only: rgba(59, 130, 246, 0.2);
-  --auth-button-bg-light-only: #af3434;
+  --auth-border-focus-light-only: var(--p-blue-500);
+  --auth-focus-ring-light-only: color-mix(
+    in srgb,
+    var(--p-blue-500) 20%,
+    transparent
+  );
+  --auth-button-bg-light-only: var(--p-red-600);
   --auth-button-text-light-only: #ffffff;
   --auth-magic-button-bg-light-only: var(--bg-raised);
   --auth-magic-button-text-light-only: var(--text-primary);
diff --git a/frontend/editor/src/saas/styles/saas-theme.css b/frontend/editor/src/saas/styles/saas-theme.css
index 654fe5fe17..f401f2cf47 100644
--- a/frontend/editor/src/saas/styles/saas-theme.css
+++ b/frontend/editor/src/saas/styles/saas-theme.css
@@ -2,101 +2,125 @@
 
 :root {
   /* Orange scale (used for warning toasts) */
-  --color-orange-50: #fff4ed;
-  --color-orange-100: #ffe1cc;
-  --color-orange-200: #ffb089;
-  --color-orange-300: #ff7a45;
-  --color-orange-400: #d84a1b;
+  --color-orange-50: var(--p-amber-400);
+  --color-orange-100: var(--p-amber-400);
+  --color-orange-200: var(--p-red-400);
+  --color-orange-300: var(--p-red-400);
+  --color-orange-400: var(--p-red-600);
 
   /* Amber scale (trial/warning emphasis) */
-  --color-amber-50: #fffbeb;
-  --color-amber-100: #fef3c7;
-  --color-amber-200: #fde68a;
-  --color-amber-300: #fcd34d;
-  --color-amber-400: #fbbf24;
-  --color-amber-500: #f59e0b;
-  --color-amber-600: #d97706;
-  --color-amber-700: #b45309;
-  --color-amber-800: #92400e;
-  --color-amber-900: #78350f;
+  --color-amber-50: var(--p-amber-400);
+  --color-amber-100: var(--p-amber-400);
+  --color-amber-200: var(--p-amber-400);
+  --color-amber-300: var(--p-amber-400);
+  --color-amber-400: var(--p-amber-400);
+  --color-amber-500: var(--p-amber-500);
+  --color-amber-600: var(--p-amber-600);
+  --color-amber-700: var(--p-amber-600);
+  --color-amber-800: var(--p-amber-600);
+  --color-amber-900: var(--p-amber-600);
 
   /* Subcategory / divider vars (light) */
-  --tool-subcategory-text-color-light: #9ca3af;
-  --tool-subcategory-rule-color-light: #e5e7eb;
-  --text-divider-rule-color: var(--color-gray-200);
-  --text-divider-label-color: var(--color-gray-400);
-  --text-divider-rule-color-light: var(--color-gray-200);
-  --text-divider-label-color-light: var(--color-gray-400);
+  --tool-subcategory-text-color-light: var(--p-gray-400);
+  --tool-subcategory-rule-color-light: var(--p-gray-200);
 
   /* Auth color vars */
-  --auth-input-bg: #f9fafb;
-  --auth-input-border: #e5e7eb;
-  --auth-input-text: #1f2937;
-  --auth-label-text: #2b3230;
-  --auth-button-bg: #af3434;
+  --auth-input-bg: var(--p-gray-50);
+  --auth-input-border: var(--p-gray-200);
+  --auth-input-text: var(--p-gray-800);
+  --auth-label-text: var(--p-zinc-650);
+  --auth-button-bg: var(--p-red-600);
   --auth-button-text: #ffffff;
-  --auth-magic-button-bg: #af3434;
+  --auth-magic-button-bg: var(--p-red-600);
   --auth-magic-button-text: #ffffff;
 
   /* Light-only auth colors (no dark mode equivalents) used for login/signup */
-  --auth-input-bg-light-only: #f9fafb;
-  --auth-input-border-light-only: #e5e7eb;
-  --auth-input-text-light-only: #1f2937;
-  --auth-label-text-light-only: #2b3230;
-  --auth-button-bg-light-only: #af3434;
+  --auth-input-bg-light-only: var(--p-gray-50);
+  --auth-input-border-light-only: var(--p-gray-200);
+  --auth-input-text-light-only: var(--p-gray-800);
+  --auth-label-text-light-only: var(--p-zinc-650);
+  --auth-button-bg-light-only: var(--p-red-600);
   --auth-button-text-light-only: #ffffff;
-  --auth-magic-button-bg-light-only: #af3434;
+  --auth-magic-button-bg-light-only: var(--p-red-600);
   --auth-magic-button-text-light-only: #ffffff;
   --auth-bg-color-light-only: #ffffff;
   --auth-card-bg-light-only: #ffffff;
-  --auth-text-primary-light-only: #2b3230;
-  --auth-text-secondary-light-only: #1f2937;
-  --auth-border-color-light-only: #e5e7eb;
-  --auth-border-focus-light-only: #cbd5e1;
-  --auth-focus-ring-light-only: rgba(59, 130, 246, 0.15);
+  --auth-text-primary-light-only: var(--p-zinc-650);
+  --auth-text-secondary-light-only: var(--p-gray-800);
+  --auth-border-focus-light-only: var(--p-gray-300);
+  --auth-focus-ring-light-only: color-mix(
+    in srgb,
+    var(--p-blue-500) 15%,
+    transparent
+  );
 
   /* App Config Modal colors (light mode) */
-  --modal-nav-bg: #f5f6f8;
-  --modal-nav-section-title: #6b7280;
-  --modal-nav-item: #374151;
-  --modal-nav-item-active: #0a8bff;
-  --modal-nav-item-active-bg: rgba(10, 139, 255, 0.08);
+  --modal-nav-bg: var(--p-gray-100);
+  --modal-nav-section-title: var(--p-gray-500);
+  --modal-nav-item: var(--p-gray-700);
+  --modal-nav-item-active: var(--p-blue-500);
+  --modal-nav-item-active-bg: color-mix(
+    in srgb,
+    var(--p-blue-500) 8%,
+    transparent
+  );
   --modal-content-bg: #ffffff;
   --modal-header-border: rgba(0, 0, 0, 0.06);
 
   /* API usage progress bar colors (light mode) */
-  --usage-weekly-active: #3b82f6;
-  --usage-bought-active: #14b8a6;
-  --usage-total-used: #3b82f6;
-  --usage-inactive: #e5e7eb;
+  --usage-inactive: var(--p-gray-200);
 
   /* API Keys section colors (light mode) */
   --api-keys-card-bg: #ffffff;
-  --api-keys-card-border: #e0e0e0;
+  --api-keys-card-border: var(--p-gray-200);
   --api-keys-card-shadow: rgba(0, 0, 0, 0.06);
-  --api-keys-input-bg: #f8f8f8;
-  --api-keys-input-border: #e0e0e0;
+  --api-keys-input-bg: var(--p-gray-50);
+  --api-keys-input-border: var(--p-gray-200);
 }
 
 [data-mantine-color-scheme="dark"] {
   /* Compare highlight colors (dark mode) */
-  --spdf-compare-removed-bg: rgba(255, 107, 107, 0.45);
-  --spdf-compare-added-bg: rgba(81, 207, 102, 0.35);
-  --spdf-compare-removed-badge-bg: rgba(255, 59, 48, 0.15);
+  --spdf-compare-removed-bg: color-mix(
+    in srgb,
+    var(--p-red-400) 45%,
+    transparent
+  );
+  --spdf-compare-added-bg: color-mix(
+    in srgb,
+    var(--p-green-500) 35%,
+    transparent
+  );
+  --spdf-compare-removed-badge-bg: color-mix(
+    in srgb,
+    var(--p-red-500) 15%,
+    transparent
+  );
   --spdf-compare-removed-badge-fg: var(--color-red-500);
-  --spdf-compare-added-badge-bg: rgba(52, 199, 89, 0.18);
+  --spdf-compare-added-badge-bg: color-mix(
+    in srgb,
+    var(--p-green-500) 18%,
+    transparent
+  );
   --spdf-compare-added-badge-fg: var(--color-green-500);
-  --spdf-compare-inline-removed-bg: rgba(255, 59, 48, 0.25);
-  --spdf-compare-inline-added-bg: rgba(52, 199, 89, 0.25);
-  --compare-page-label-bg: #0d1020;
-  --compare-page-label-fg: #c2c8e0;
+  --spdf-compare-inline-removed-bg: color-mix(
+    in srgb,
+    var(--p-red-500) 25%,
+    transparent
+  );
+  --spdf-compare-inline-added-bg: color-mix(
+    in srgb,
+    var(--p-green-500) 25%,
+    transparent
+  );
+  --compare-page-label-bg: var(--p-zinc-850);
+  --compare-page-label-fg: var(--p-gray-300);
 
   /* Orange scale (dark mode mirrors light values to match UI) */
-  --color-orange-50: #fff4ed;
-  --color-orange-100: #ffe1cc;
-  --color-orange-200: #ffb089;
-  --color-orange-300: #ff7a45;
-  --color-orange-400: #d84a1b;
+  --color-orange-50: var(--p-amber-400);
+  --color-orange-100: var(--p-amber-400);
+  --color-orange-200: var(--p-red-400);
+  --color-orange-300: var(--p-red-400);
+  --color-orange-400: var(--p-red-600);
 
   /* Auth page colors (dark mode) — mirror proprietary so the auth card themes dark */
   --auth-bg-color-light-only: var(--bg-muted);
@@ -106,9 +130,13 @@
   --auth-input-border-light-only: var(--border-default);
   --auth-input-bg-light-only: var(--bg-raised);
   --auth-input-text-light-only: var(--text-primary);
-  --auth-border-focus-light-only: #3b82f6;
-  --auth-focus-ring-light-only: rgba(59, 130, 246, 0.2);
-  --auth-button-bg-light-only: #af3434;
+  --auth-border-focus-light-only: var(--p-blue-500);
+  --auth-focus-ring-light-only: color-mix(
+    in srgb,
+    var(--p-blue-500) 20%,
+    transparent
+  );
+  --auth-button-bg-light-only: var(--p-red-600);
   --auth-button-text-light-only: #ffffff;
   --auth-magic-button-bg-light-only: var(--bg-raised);
   --auth-magic-button-text-light-only: var(--text-primary);
@@ -116,31 +144,29 @@
   --auth-text-secondary-light-only: var(--text-secondary);
   --text-divider-rule-rgb-light: 229, 231, 235;
   --text-divider-label-rgb-light: 156, 163, 175;
-  --tool-subcategory-rule-color-light: #e5e7eb;
-  --tool-subcategory-text-color-light: #9ca3af;
+  --tool-subcategory-rule-color-light: var(--p-gray-200);
+  --tool-subcategory-text-color-light: var(--p-gray-400);
 
   /* API usage progress bar colors (dark mode) */
-  --usage-weekly-active: #4f8ef5;
-  --usage-bought-active: #34d399;
-  --usage-total-used: #e8eaf6;
-  --usage-inactive: #1c2340;
+  --usage-inactive: var(--p-zinc-650);
 
   /* API Keys section colors (dark mode) */
-  --api-keys-card-bg: #131729;
-  --api-keys-card-border: #1c2340;
+  --api-keys-card-bg: var(--p-zinc-800);
+  --api-keys-card-border: var(--p-zinc-650);
   --api-keys-card-shadow: none;
-  --api-keys-input-bg: #0d1020;
-  --api-keys-input-border: #1c2340;
-
-  --text-divider-rule-color: var(--tool-subcategory-rule-color);
-  --text-divider-label-color: var(--text-muted);
+  --api-keys-input-bg: var(--p-zinc-850);
+  --api-keys-input-border: var(--p-zinc-650);
 
   /* App Config Modal colors (dark mode) */
-  --modal-nav-bg: #0d1020;
-  --modal-nav-section-title: #5b6280;
-  --modal-nav-item: #c2c8e0;
-  --modal-nav-item-active: #4f8ef5;
-  --modal-nav-item-active-bg: rgba(79, 142, 245, 0.15);
-  --modal-content-bg: #131729;
+  --modal-nav-bg: var(--p-zinc-850);
+  --modal-nav-section-title: var(--p-zinc-300);
+  --modal-nav-item: var(--p-gray-300);
+  --modal-nav-item-active: var(--p-blue-500);
+  --modal-nav-item-active-bg: color-mix(
+    in srgb,
+    var(--p-blue-500) 15%,
+    transparent
+  );
+  --modal-content-bg: var(--p-zinc-800);
   --modal-header-border: rgba(255, 255, 255, 0.05);
 }

From 663bb32b2c528c7a5a4bd3eec20e5bd5c927ac05 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 15 Jul 2026 13:19:06 +0100
Subject: [PATCH 023/109] Skip unreadable policy source/policy rows instead of
 crashing :) (#7034)

# Description of Changes

Thanks james for the prod issue  :)

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../policy/source/JpaSourceStore.java         | 28 ++++++++++++++---
 .../policy/store/JpaPolicyStore.java          | 31 ++++++++++++++++---
 2 files changed, 49 insertions(+), 10 deletions(-)

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceStore.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceStore.java
index 18bbf5cbdc..69249fb700 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceStore.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceStore.java
@@ -8,6 +8,7 @@ import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProp
 import org.springframework.stereotype.Service;
 
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 
 import tools.jackson.databind.ObjectMapper;
 
@@ -15,6 +16,7 @@ import tools.jackson.databind.ObjectMapper;
  * Durable {@link SourceStore} backed by JPA; the runtime store. Sources are persisted as JSON via
  * {@link SourceEntity}, with scalar columns kept in sync for querying.
  */
+@Slf4j
 @Service
 @RequiredArgsConstructor
 @ConditionalOnBooleanProperty(name = "policies.enabled")
@@ -53,17 +55,20 @@ public class JpaSourceStore implements SourceStore {
 
     @Override
     public Optional<Source> get(String id) {
-        return repository.findById(id).map(this::toSource);
+        return repository.findById(id).flatMap(this::toSource);
     }
 
     @Override
     public List<Source> all() {
-        return repository.findAll().stream().map(this::toSource).toList();
+        return repository.findAll().stream().map(this::toSource).flatMap(Optional::stream).toList();
     }
 
     @Override
     public List<Source> findByTeam(Long teamId) {
-        return repository.findByTeam(teamId).stream().map(this::toSource).toList();
+        return repository.findByTeam(teamId).stream()
+                .map(this::toSource)
+                .flatMap(Optional::stream)
+                .toList();
     }
 
     @Override
@@ -75,7 +80,20 @@ public class JpaSourceStore implements SourceStore {
         return true;
     }
 
-    private Source toSource(SourceEntity entity) {
-        return objectMapper.readValue(entity.getSourceJson(), Source.class);
+    // Skip (don't fail) rows whose JSON can't be read - e.g. written by another app version/key.
+    // One unreadable row must never abort a bulk read or crash startup.
+    private Optional<Source> toSource(SourceEntity entity) {
+        try {
+            return Optional.of(objectMapper.readValue(entity.getSourceJson(), Source.class));
+        } catch (Exception e) {
+            log.error(
+                    "Skipping unreadable policy source id={} name={}: stored JSON could not be"
+                            + " parsed ({}). Likely written by a different app version or"
+                            + " encryption key.",
+                    entity.getId(),
+                    entity.getName(),
+                    e.getMessage());
+            return Optional.empty();
+        }
     }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java
index 5089b8d419..08b2942b14 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java
@@ -10,6 +10,7 @@ import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
 import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.proprietary.policy.model.Policy;
 
@@ -19,6 +20,7 @@ import tools.jackson.databind.ObjectMapper;
  * Durable {@link PolicyStore} backed by JPA; the runtime store. Policies are persisted as JSON via
  * {@link PolicyEntity}, with scalar columns kept in sync for querying.
  */
+@Slf4j
 @Service
 @RequiredArgsConstructor
 @ConditionalOnBooleanProperty(name = "policies.enabled")
@@ -98,23 +100,30 @@ public class JpaPolicyStore implements PolicyStore {
 
     @Override
     public Optional<Policy> get(String id) {
-        return repository.findById(id).map(this::toPolicy);
+        return repository.findById(id).flatMap(this::toPolicy);
     }
 
     @Override
     public List<Policy> all() {
-        return repository.findAllOrdered().stream().map(this::toPolicy).toList();
+        return repository.findAllOrdered().stream()
+                .map(this::toPolicy)
+                .flatMap(Optional::stream)
+                .toList();
     }
 
     @Override
     public List<Policy> findByTeam(Long teamId) {
-        return repository.findByTeam(teamId).stream().map(this::toPolicy).toList();
+        return repository.findByTeam(teamId).stream()
+                .map(this::toPolicy)
+                .flatMap(Optional::stream)
+                .toList();
     }
 
     @Override
     public List<Policy> findByTriggerType(String triggerType) {
         return repository.findByTriggerTypeAndEnabledTrue(triggerType).stream()
                 .map(this::toPolicy)
+                .flatMap(Optional::stream)
                 .toList();
     }
 
@@ -127,7 +136,19 @@ public class JpaPolicyStore implements PolicyStore {
         return true;
     }
 
-    private Policy toPolicy(PolicyEntity entity) {
-        return objectMapper.readValue(entity.getPolicyJson(), Policy.class);
+    // Skip (don't fail) rows whose JSON can't be read - e.g. written by another app version/key.
+    // One unreadable row must never abort a bulk read or crash startup.
+    private Optional<Policy> toPolicy(PolicyEntity entity) {
+        try {
+            return Optional.of(objectMapper.readValue(entity.getPolicyJson(), Policy.class));
+        } catch (Exception e) {
+            log.error(
+                    "Skipping unreadable policy id={} name={}: stored JSON could not be parsed"
+                            + " ({}). Likely written by a different app version or encryption key.",
+                    entity.getId(),
+                    entity.getName(),
+                    e.getMessage());
+            return Optional.empty();
+        }
     }
 }

From 350c0b796e248286f8e71d5f5c3d801ff7b1c638 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Wed, 15 Jul 2026 13:21:34 +0100
Subject: [PATCH 024/109] Upgrade to TS7 official release (#6958)

# Description of Changes
Convert from the TS7 release candidate to the TS7 official release,
keeping TS6 around in [the compatibility mode suggested by
Microsoft](https://devblogs.microsoft.com/typescript/announcing-typescript-7-0/#running-side-by-side-with-typescript-6.0)
so ESLint and our scripts which rely on the TS API still work.
---
 .taskfiles/frontend.yml    |   4 +-
 frontend/package-lock.json | 350 +++++++++++++++++++++++++++++++------
 frontend/package.json      |   4 +-
 3 files changed, 303 insertions(+), 55 deletions(-)

diff --git a/.taskfiles/frontend.yml b/.taskfiles/frontend.yml
index 35b387025a..943caaf81b 100644
--- a/.taskfiles/frontend.yml
+++ b/.taskfiles/frontend.yml
@@ -262,10 +262,8 @@ tasks:
 
   typecheck:_run:
     internal: true
-    env:
-      CI: '{{ .CI | default "false" }}'
     cmds:
-      - '{{ if eq .CI "true" }}npx tsc{{ else }}npx tsgo{{ end }} --noEmit --project {{.PROJECT}}'
+      - 'npx tsc --noEmit --project {{.PROJECT}}'
 
   typecheck:core:
     desc: "Typecheck core build variant"
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index da79c8aa34..ea714979f2 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -109,7 +109,7 @@
         "@types/react-dom": "^19.1.9",
         "@typescript-eslint/eslint-plugin": "^8.61.1",
         "@typescript-eslint/parser": "^8.61.1",
-        "@typescript/native-preview": "7.0.0-dev.20260624.1",
+        "@typescript/native": "npm:typescript@^7.0.2",
         "@vitejs/plugin-react-swc": "^4.1.0",
         "@vitest/coverage-v8": "^3.2.4",
         "dotenv": "^16.4.7",
@@ -130,7 +130,7 @@
         "rollup-plugin-visualizer": "^7.0.1",
         "storybook": "^9.1.20",
         "tsx": "^4.21.0",
-        "typescript": "^6.0.3",
+        "typescript": "npm:@typescript/typescript6@^6.0.2",
         "typescript-eslint": "^8.61.1",
         "vite": "^7.3.2",
         "vite-plugin-compression2": "^2.5.3",
@@ -6062,32 +6062,78 @@
         "url": "https://opencollective.com/eslint"
       }
     },
-    "node_modules/@typescript/native-preview": {
-      "version": "7.0.0-dev.20260624.1",
-      "resolved": "https://registry.npmjs.org/@typescript/native-preview/-/native-preview-7.0.0-dev.20260624.1.tgz",
-      "integrity": "sha512-ogwfNo1xuAutOF8RbTCo3Ut0q/65u2ucOeHizi6O14q+3vnelNS+u8qVC2QWXubMcwtuN5E9cbfPslvGC4kdwA==",
+    "node_modules/@typescript/native": {
+      "name": "typescript",
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-7.0.2.tgz",
+      "integrity": "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
-        "tsgo": "bin/tsgo.js"
+        "tsc": "bin/tsc"
       },
       "engines": {
         "node": ">=16.20.0"
       },
       "optionalDependencies": {
-        "@typescript/native-preview-darwin-arm64": "7.0.0-dev.20260624.1",
-        "@typescript/native-preview-darwin-x64": "7.0.0-dev.20260624.1",
-        "@typescript/native-preview-linux-arm": "7.0.0-dev.20260624.1",
-        "@typescript/native-preview-linux-arm64": "7.0.0-dev.20260624.1",
-        "@typescript/native-preview-linux-x64": "7.0.0-dev.20260624.1",
-        "@typescript/native-preview-win32-arm64": "7.0.0-dev.20260624.1",
-        "@typescript/native-preview-win32-x64": "7.0.0-dev.20260624.1"
+        "@typescript/typescript-aix-ppc64": "7.0.2",
+        "@typescript/typescript-darwin-arm64": "7.0.2",
+        "@typescript/typescript-darwin-x64": "7.0.2",
+        "@typescript/typescript-freebsd-arm64": "7.0.2",
+        "@typescript/typescript-freebsd-x64": "7.0.2",
+        "@typescript/typescript-linux-arm": "7.0.2",
+        "@typescript/typescript-linux-arm64": "7.0.2",
+        "@typescript/typescript-linux-loong64": "7.0.2",
+        "@typescript/typescript-linux-mips64el": "7.0.2",
+        "@typescript/typescript-linux-ppc64": "7.0.2",
+        "@typescript/typescript-linux-riscv64": "7.0.2",
+        "@typescript/typescript-linux-s390x": "7.0.2",
+        "@typescript/typescript-linux-x64": "7.0.2",
+        "@typescript/typescript-netbsd-arm64": "7.0.2",
+        "@typescript/typescript-netbsd-x64": "7.0.2",
+        "@typescript/typescript-openbsd-arm64": "7.0.2",
+        "@typescript/typescript-openbsd-x64": "7.0.2",
+        "@typescript/typescript-sunos-x64": "7.0.2",
+        "@typescript/typescript-win32-arm64": "7.0.2",
+        "@typescript/typescript-win32-x64": "7.0.2"
       }
     },
-    "node_modules/@typescript/native-preview-darwin-arm64": {
-      "version": "7.0.0-dev.20260624.1",
-      "resolved": "https://registry.npmjs.org/@typescript/native-preview-darwin-arm64/-/native-preview-darwin-arm64-7.0.0-dev.20260624.1.tgz",
-      "integrity": "sha512-g8CqDkYCHTCYdhBHXs5cMraBurOS+KrcMFxE0SsaKZoI6Tnp+le1aWvxUBbzNKJYyThHJqb/1mLopzEJxJCuKA==",
+    "node_modules/@typescript/old": {
+      "name": "typescript",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
+      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
+      "devOptional": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/@typescript/typescript-aix-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-aix-ppc64/-/typescript-aix-ppc64-7.0.2.tgz",
+      "integrity": "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-darwin-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-arm64/-/typescript-darwin-arm64-7.0.2.tgz",
+      "integrity": "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA==",
       "cpu": [
         "arm64"
       ],
@@ -6101,10 +6147,10 @@
         "node": ">=16.20.0"
       }
     },
-    "node_modules/@typescript/native-preview-darwin-x64": {
-      "version": "7.0.0-dev.20260624.1",
-      "resolved": "https://registry.npmjs.org/@typescript/native-preview-darwin-x64/-/native-preview-darwin-x64-7.0.0-dev.20260624.1.tgz",
-      "integrity": "sha512-P00JVvSV90eioYDuINAKmOSA8yhFTWLq6RvS5lrCfUuDlcgr2kSOgZAfFHIksHBVz6ZXpAXpa0dHPmc5SJ3Ymw==",
+    "node_modules/@typescript/typescript-darwin-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-darwin-x64/-/typescript-darwin-x64-7.0.2.tgz",
+      "integrity": "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA==",
       "cpu": [
         "x64"
       ],
@@ -6118,10 +6164,44 @@
         "node": ">=16.20.0"
       }
     },
-    "node_modules/@typescript/native-preview-linux-arm": {
-      "version": "7.0.0-dev.20260624.1",
-      "resolved": "https://registry.npmjs.org/@typescript/native-preview-linux-arm/-/native-preview-linux-arm-7.0.0-dev.20260624.1.tgz",
-      "integrity": "sha512-eWHELvfQMkVRjafMd+3ATgM9p9yAergJaM4AOY8AekCNWnHFwUrp/ohh+ryyMUIqque5jjb/kuTiOiGj728I2Q==",
+    "node_modules/@typescript/typescript-freebsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-arm64/-/typescript-freebsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-freebsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-freebsd-x64/-/typescript-freebsd-x64-7.0.2.tgz",
+      "integrity": "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-arm": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm/-/typescript-linux-arm-7.0.2.tgz",
+      "integrity": "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ==",
       "cpu": [
         "arm"
       ],
@@ -6135,10 +6215,10 @@
         "node": ">=16.20.0"
       }
     },
-    "node_modules/@typescript/native-preview-linux-arm64": {
-      "version": "7.0.0-dev.20260624.1",
-      "resolved": "https://registry.npmjs.org/@typescript/native-preview-linux-arm64/-/native-preview-linux-arm64-7.0.0-dev.20260624.1.tgz",
-      "integrity": "sha512-cppM2yTZ/Gd1hOXy8NEJcUBxJ0O0zl9CU3OU1ZWZ/OHWWX/ukEzCCr94SUwJhjIWOylBCpIYkrvYoTwxNa94XQ==",
+    "node_modules/@typescript/typescript-linux-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-arm64/-/typescript-linux-arm64-7.0.2.tgz",
+      "integrity": "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ==",
       "cpu": [
         "arm64"
       ],
@@ -6152,10 +6232,95 @@
         "node": ">=16.20.0"
       }
     },
-    "node_modules/@typescript/native-preview-linux-x64": {
-      "version": "7.0.0-dev.20260624.1",
-      "resolved": "https://registry.npmjs.org/@typescript/native-preview-linux-x64/-/native-preview-linux-x64-7.0.0-dev.20260624.1.tgz",
-      "integrity": "sha512-FaB8rS+rKYz4nDrEsHsF3b4cn7eCKCYroMJReA375OuQ6PHcmCNQ6QlVetA0dfFBxTTgejmoKyfw9xgAA5P4Yw==",
+    "node_modules/@typescript/typescript-linux-loong64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-loong64/-/typescript-linux-loong64-7.0.2.tgz",
+      "integrity": "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-mips64el": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-mips64el/-/typescript-linux-mips64el-7.0.2.tgz",
+      "integrity": "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-ppc64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-ppc64/-/typescript-linux-ppc64-7.0.2.tgz",
+      "integrity": "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-riscv64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-riscv64/-/typescript-linux-riscv64-7.0.2.tgz",
+      "integrity": "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-s390x": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-s390x/-/typescript-linux-s390x-7.0.2.tgz",
+      "integrity": "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-linux-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-linux-x64/-/typescript-linux-x64-7.0.2.tgz",
+      "integrity": "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A==",
       "cpu": [
         "x64"
       ],
@@ -6169,10 +6334,95 @@
         "node": ">=16.20.0"
       }
     },
-    "node_modules/@typescript/native-preview-win32-arm64": {
-      "version": "7.0.0-dev.20260624.1",
-      "resolved": "https://registry.npmjs.org/@typescript/native-preview-win32-arm64/-/native-preview-win32-arm64-7.0.0-dev.20260624.1.tgz",
-      "integrity": "sha512-BgkqbCmSHDb5UxqWaFlFFJ/DHNT3lEUO4W8627ap6+QthJZuXk2imiHAX3PgYXC6en9fLLyR6jjcseAa4CCshg==",
+    "node_modules/@typescript/typescript-netbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-arm64/-/typescript-netbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-netbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-netbsd-x64/-/typescript-netbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-arm64/-/typescript-openbsd-arm64-7.0.2.tgz",
+      "integrity": "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-openbsd-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-openbsd-x64/-/typescript-openbsd-x64-7.0.2.tgz",
+      "integrity": "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-sunos-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-sunos-x64/-/typescript-sunos-x64-7.0.2.tgz",
+      "integrity": "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "Apache-2.0",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=16.20.0"
+      }
+    },
+    "node_modules/@typescript/typescript-win32-arm64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-arm64/-/typescript-win32-arm64-7.0.2.tgz",
+      "integrity": "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ==",
       "cpu": [
         "arm64"
       ],
@@ -6186,10 +6436,10 @@
         "node": ">=16.20.0"
       }
     },
-    "node_modules/@typescript/native-preview-win32-x64": {
-      "version": "7.0.0-dev.20260624.1",
-      "resolved": "https://registry.npmjs.org/@typescript/native-preview-win32-x64/-/native-preview-win32-x64-7.0.0-dev.20260624.1.tgz",
-      "integrity": "sha512-WaZ+ue63NgB2j/lqjirfevh/TqcsCxSqnKhGGiRnlxHyYIBcoq+x7KngyEnyGIaywJE1PcFeXA+2EMSIPlSEiQ==",
+    "node_modules/@typescript/typescript-win32-x64": {
+      "version": "7.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript-win32-x64/-/typescript-win32-x64-7.0.2.tgz",
+      "integrity": "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g==",
       "cpu": [
         "x64"
       ],
@@ -16380,17 +16630,17 @@
       "license": "MIT"
     },
     "node_modules/typescript": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-6.0.3.tgz",
-      "integrity": "sha512-y2TvuxSZPDyQakkFRPZHKFm+KKVqIisdg9/CZwm9ftvKXLP8NRWj38/ODjNbr43SsoXqNuAisEf1GdCxqWcdBw==",
+      "name": "@typescript/typescript6",
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/@typescript/typescript6/-/typescript6-6.0.2.tgz",
+      "integrity": "sha512-mbCddXd+jm7hfx7w2YU64/Av4/NqqeG3GoRZgxPcgoTxYjhrcfJRw9ULch71SS4G+Q3bOXFhRvPqjguN0Hyp5w==",
       "devOptional": true,
       "license": "Apache-2.0",
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
+      "dependencies": {
+        "@typescript/old": "npm:typescript@^6"
       },
-      "engines": {
-        "node": ">=14.17"
+      "bin": {
+        "tsc6": "bin/tsc6"
       }
     },
     "node_modules/typescript-eslint": {
diff --git a/frontend/package.json b/frontend/package.json
index f9f035fa0d..be45f0215e 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -130,7 +130,7 @@
     "@types/react-dom": "^19.1.9",
     "@typescript-eslint/eslint-plugin": "^8.61.1",
     "@typescript-eslint/parser": "^8.61.1",
-    "@typescript/native-preview": "7.0.0-dev.20260624.1",
+    "@typescript/native": "npm:typescript@^7.0.2",
     "@vitejs/plugin-react-swc": "^4.1.0",
     "@vitest/coverage-v8": "^3.2.4",
     "dotenv": "^16.4.7",
@@ -151,7 +151,7 @@
     "rollup-plugin-visualizer": "^7.0.1",
     "storybook": "^9.1.20",
     "tsx": "^4.21.0",
-    "typescript": "^6.0.3",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-eslint": "^8.61.1",
     "vite": "^7.3.2",
     "vite-plugin-compression2": "^2.5.3",

From 4ee54243f3e49a3f78f201989d2f9665363422f2 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Wed, 15 Jul 2026 13:28:29 +0100
Subject: [PATCH 025/109] Remove encryption from stored policies JSON (#7035)

# Description of Changes
The policies stored in the DB are currently encrypted at rest, because
one version in the past included S3 keys. These are now stored properly
in the credentials system and I've manually removed the only policy that
used S3 (it was very recently released). Since there's no S3 (or other)
credentials in the policies stored JSON now, we might as well just
decrypt them. This PR pairs with #7034 to fix the issues - #7034 makes
it resilient to crashing when attempting to load encrypted JSON that's
been encrypted with the wrong key, and this makes it so if it does load
any encrypted policies, they'll be re-saved decrypted, so we should have
a vanishingly small number of encrypted policies over time.
---
 .../crypto/LegacyDecryptStringConverter.java  | 35 +++++++++++++
 .../LenientEncryptedStringConverter.java      | 31 -----------
 .../s3/EmbeddedS3CredentialMigration.java     |  4 +-
 .../policy/source/SourceEntity.java           |  8 +--
 .../policy/store/PolicyEntity.java            |  8 +--
 .../LegacyDecryptStringConverterTest.java     | 51 +++++++++++++++++++
 .../LenientEncryptedStringConverterTest.java  | 45 ----------------
 7 files changed, 96 insertions(+), 86 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/LegacyDecryptStringConverter.java
 delete mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/LenientEncryptedStringConverter.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/crypto/LegacyDecryptStringConverterTest.java
 delete mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/crypto/LenientEncryptedStringConverterTest.java

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/LegacyDecryptStringConverter.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/LegacyDecryptStringConverter.java
new file mode 100644
index 0000000000..118608b925
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/LegacyDecryptStringConverter.java
@@ -0,0 +1,35 @@
+package stirling.software.proprietary.integration.crypto;
+
+import jakarta.persistence.AttributeConverter;
+import jakarta.persistence.Converter;
+
+/**
+ * For columns that were once whole-blob encrypted but no longer hold secrets.
+ *
+ * <p>Writes plaintext, so the value is readable by any instance regardless of the per-installation
+ * encryption key. Any value that isn't our ciphertext (already-plaintext JSON, or ciphertext from a
+ * key we don't hold) is returned as-is; the latter is the caller's to reject.
+ */
+@Converter
+public class LegacyDecryptStringConverter implements AttributeConverter<String, String> {
+
+    @Override
+    public String convertToDatabaseColumn(String attribute) {
+        return attribute;
+    }
+
+    @Override
+    public String convertToEntityAttribute(String dbData) {
+        // Plaintext JSON can never be our Base64 ciphertext ('{' is not in the Base64 alphabet), so
+        // skip the decrypt attempt for it.
+        if (dbData == null || dbData.stripLeading().startsWith("{")) {
+            return dbData;
+        }
+        try {
+            return CredentialEncryption.decrypt(dbData);
+        } catch (IllegalArgumentException | IllegalStateException e) {
+            // Legacy ciphertext we can't read (key we don't hold) - the caller's to reject.
+            return dbData;
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/LenientEncryptedStringConverter.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/LenientEncryptedStringConverter.java
deleted file mode 100644
index 7bb6190220..0000000000
--- a/app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/LenientEncryptedStringConverter.java
+++ /dev/null
@@ -1,31 +0,0 @@
-package stirling.software.proprietary.integration.crypto;
-
-import jakarta.persistence.AttributeConverter;
-import jakarta.persistence.Converter;
-
-/**
- * {@link EncryptedStringConverter} for columns that held plaintext before encryption shipped:
- * writes are always encrypted, but a stored value that is not valid ciphertext is returned as-is,
- * so pre-encryption rows keep loading and become encrypted on their next save. The discrimination
- * is exact for JSON payloads, which can never be mistaken for ciphertext ('{' is not in the Base64
- * alphabet). The trade-off is that a genuinely corrupted ciphertext surfaces as garbage to the
- * caller's parser instead of failing here.
- */
-@Converter
-public class LenientEncryptedStringConverter implements AttributeConverter<String, String> {
-
-    @Override
-    public String convertToDatabaseColumn(String attribute) {
-        return CredentialEncryption.encrypt(attribute);
-    }
-
-    @Override
-    public String convertToEntityAttribute(String dbData) {
-        try {
-            return CredentialEncryption.decrypt(dbData);
-        } catch (IllegalArgumentException | IllegalStateException e) {
-            // Not ciphertext: legacy plaintext from before encryption shipped.
-            return dbData;
-        }
-    }
-}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
index 5aa82a8e66..398b2bd709 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
@@ -32,8 +32,8 @@ import tools.jackson.databind.ObjectMapper;
  * One-time, idempotent extraction of legacy embedded S3 credentials into stored connections:
  * sources and policy outputs written before connections shipped carry bucket/credentials in their
  * own options; this rewrites each to reference a (deduplicated) S3 {@link IntegrationConfig} and
- * keeps only per-use options (prefix, mode). MUST be programmatic - the option JSON is encrypted at
- * the application layer, so no SQL migration can read it.
+ * keeps only per-use options (prefix, mode). MUST be programmatic - it parses and rewrites the
+ * option JSON (and decrypts any legacy ciphertext row on read), which no SQL migration can do.
  *
  * <p>Idempotent by construction: rewritten rows no longer embed credentials, so re-runs find
  * nothing to do. Connections are deduplicated against both this run's extractions and existing S3
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceEntity.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceEntity.java
index c94e4cb079..728612742e 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceEntity.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceEntity.java
@@ -12,7 +12,7 @@ import lombok.Getter;
 import lombok.NoArgsConstructor;
 import lombok.Setter;
 
-import stirling.software.proprietary.integration.crypto.LenientEncryptedStringConverter;
+import stirling.software.proprietary.integration.crypto.LegacyDecryptStringConverter;
 
 /**
  * JPA row for a {@link Source}. The whole source lives as JSON in {@code sourceJson} (authoritative
@@ -48,9 +48,9 @@ public class SourceEntity implements Serializable {
     @Column(name = "enabled")
     private boolean enabled;
 
-    // Encrypted at rest: source options carry user-supplied credentials (e.g. an S3 secret
-    // access key). Lenient so rows written before encryption shipped still load.
-    @Convert(converter = LenientEncryptedStringConverter.class)
+    // Plaintext at rest: the S3 credentials that used to live here now sit in a referenced
+    // IntegrationConfig connection (still encrypted). Decrypts legacy ciphertext on read.
+    @Convert(converter = LegacyDecryptStringConverter.class)
     @Column(name = "source_json", columnDefinition = "text")
     private String sourceJson;
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/PolicyEntity.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/PolicyEntity.java
index e393e47833..c871267bc4 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/PolicyEntity.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/PolicyEntity.java
@@ -12,7 +12,7 @@ import lombok.Getter;
 import lombok.NoArgsConstructor;
 import lombok.Setter;
 
-import stirling.software.proprietary.integration.crypto.LenientEncryptedStringConverter;
+import stirling.software.proprietary.integration.crypto.LegacyDecryptStringConverter;
 
 /**
  * JPA row for a {@link stirling.software.proprietary.policy.model.Policy}. The whole policy lives
@@ -58,9 +58,9 @@ public class PolicyEntity implements Serializable {
     @Column(name = "sort_order")
     private Integer sortOrder;
 
-    // Encrypted at rest: output options carry user-supplied credentials (e.g. an S3 secret
-    // access key). Lenient so rows written before encryption shipped still load.
-    @Convert(converter = LenientEncryptedStringConverter.class)
+    // Plaintext at rest: the S3 credentials that used to live here now sit in a referenced
+    // IntegrationConfig connection (still encrypted). Decrypts legacy ciphertext on read.
+    @Convert(converter = LegacyDecryptStringConverter.class)
     @Column(name = "policy_json", columnDefinition = "text")
     private String policyJson;
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/crypto/LegacyDecryptStringConverterTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/crypto/LegacyDecryptStringConverterTest.java
new file mode 100644
index 0000000000..11b913e9d7
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/crypto/LegacyDecryptStringConverterTest.java
@@ -0,0 +1,51 @@
+package stirling.software.proprietary.integration.crypto;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import javax.crypto.KeyGenerator;
+import javax.crypto.SecretKey;
+
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+
+class LegacyDecryptStringConverterTest {
+
+    private final LegacyDecryptStringConverter converter = new LegacyDecryptStringConverter();
+
+    @BeforeAll
+    static void initKey() throws Exception {
+        KeyGenerator generator = KeyGenerator.getInstance("AES");
+        generator.init(256);
+        SecretKey key = generator.generateKey();
+        CredentialEncryption.initialiseForTesting(key);
+    }
+
+    @Test
+    void writesPlaintext() {
+        String json = "{\"bucket\":\"inbox\",\"mode\":\"consume\"}";
+
+        assertThat(converter.convertToDatabaseColumn(json)).isEqualTo(json);
+    }
+
+    @Test
+    void decryptsLegacyCiphertextOnRead() {
+        String json = "{\"bucket\":\"inbox\"}";
+        String legacyCiphertext = CredentialEncryption.encrypt(json);
+
+        assertThat(legacyCiphertext).isNotEqualTo(json);
+        assertThat(converter.convertToEntityAttribute(legacyCiphertext)).isEqualTo(json);
+    }
+
+    @Test
+    void passesPlaintextThroughOnRead() {
+        String json = "{\"bucket\":\"inbox\",\"mode\":\"consume\"}";
+
+        assertThat(converter.convertToEntityAttribute(json)).isEqualTo(json);
+    }
+
+    @Test
+    void nullsPassThrough() {
+        assertThat(converter.convertToDatabaseColumn(null)).isNull();
+        assertThat(converter.convertToEntityAttribute(null)).isNull();
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/crypto/LenientEncryptedStringConverterTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/crypto/LenientEncryptedStringConverterTest.java
deleted file mode 100644
index b61ded9708..0000000000
--- a/app/proprietary/src/test/java/stirling/software/proprietary/integration/crypto/LenientEncryptedStringConverterTest.java
+++ /dev/null
@@ -1,45 +0,0 @@
-package stirling.software.proprietary.integration.crypto;
-
-import static org.assertj.core.api.Assertions.assertThat;
-
-import javax.crypto.KeyGenerator;
-import javax.crypto.SecretKey;
-
-import org.junit.jupiter.api.BeforeAll;
-import org.junit.jupiter.api.Test;
-
-class LenientEncryptedStringConverterTest {
-
-    private final LenientEncryptedStringConverter converter = new LenientEncryptedStringConverter();
-
-    @BeforeAll
-    static void initKey() throws Exception {
-        KeyGenerator generator = KeyGenerator.getInstance("AES");
-        generator.init(256);
-        SecretKey key = generator.generateKey();
-        CredentialEncryption.initialiseForTesting(key);
-    }
-
-    @Test
-    void roundTripsThroughCiphertext() {
-        String json = "{\"bucket\":\"inbox\",\"secretAccessKey\":\"shh\"}";
-
-        String stored = converter.convertToDatabaseColumn(json);
-
-        assertThat(stored).isNotEqualTo(json).doesNotContain("shh");
-        assertThat(converter.convertToEntityAttribute(stored)).isEqualTo(json);
-    }
-
-    @Test
-    void legacyPlaintextRowsPassThroughOnRead() {
-        String legacy = "{\"bucket\":\"inbox\",\"mode\":\"consume\"}";
-
-        assertThat(converter.convertToEntityAttribute(legacy)).isEqualTo(legacy);
-    }
-
-    @Test
-    void nullsPassThrough() {
-        assertThat(converter.convertToDatabaseColumn(null)).isNull();
-        assertThat(converter.convertToEntityAttribute(null)).isNull();
-    }
-}

From ed58d90ab873d51593d7f1eca797fb05ed4435e3 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Wed, 15 Jul 2026 15:25:25 +0100
Subject: [PATCH 026/109] Remove policies feature flag (#7031)

# Description of Changes
Removes the feature flags for enabling policies on both the backend and
frontend. We shouldn't be releasing another self-hosted release that
doesn't include policies, so it makes sense to do this now. Builds that
don't have the Processor will just not run policies because they won't
have any. Beyond that, the API should always be available, but checks
whether the user actually has the entitlements to run policies (whether
they have credits/a payment method available)
---
 .github/workflows/PR-Auto-Deploy-V2.yml       |   1 -
 .taskfiles/backend.yml                        |   6 +-
 Taskfile.yml                                  |   1 -
 .../common/model/ApplicationProperties.java   |   5 -
 .../InstanceEntitlementInterceptor.java       |   9 +-
 .../policy/config/FolderAccessGuard.java      |   2 -
 .../policy/config/PolicyAccessGuard.java      |   2 -
 .../policy/controller/PolicyController.java   |   2 -
 .../policy/controller/PolicyRunRoutes.java    |  85 ++++++++++++
 .../policy/engine/PolicyEngine.java           |   2 -
 .../policy/engine/PolicyRunRegistry.java      |   2 -
 .../policy/engine/PolicyRunner.java           |   2 -
 .../policy/engine/PolicyValidator.java        |   2 -
 .../policy/input/FolderInputSource.java       |   2 -
 .../policy/input/S3InputSource.java           |   2 -
 .../policy/ledger/JpaProcessedLedger.java     |   2 -
 .../policy/output/FolderOutputSink.java       |   2 -
 .../policy/output/InlineOutputSink.java       |   2 -
 .../policy/output/S3OutputSink.java           |   2 -
 .../overview/PolicyOverviewService.java       |   2 -
 .../s3/EmbeddedS3CredentialMigration.java     |   2 -
 .../s3/PolicyS3ConnectionUsageCheck.java      |   2 -
 .../policy/s3/S3ConnectionPool.java           |   2 -
 .../policy/s3/S3ConnectionResolver.java       |   2 -
 .../policy/s3/S3IntegrationValidator.java     |   2 -
 .../policy/source/JpaSourceDocCounter.java    |   2 -
 .../policy/source/JpaSourceStore.java         |   2 -
 .../policy/source/SourceAccessGuard.java      |   2 -
 .../policy/source/SourceController.java       |   2 -
 .../policy/source/SourceOverviewService.java  |   2 -
 .../policy/store/JpaPolicyStore.java          |   2 -
 .../policy/trigger/FolderWatchTrigger.java    |   2 -
 .../policy/trigger/PolicyTriggerManager.java  |   2 -
 .../policy/trigger/ScheduleTrigger.java       |   2 -
 .../InstanceEntitlementInterceptorTest.java   |  37 +++++
 .../controller/PolicyRunRoutesTest.java       | 127 ++++++++++++++++++
 .../payg/entitlement/EntitlementGuard.java    |  20 ++-
 .../resources/application-saas.properties     |   4 -
 .../saas/V22__policy_engine_tables.sql        |   2 +-
 .../saas/V23__policy_source_doc_counts.sql    |   4 +-
 .../saas/V30__classification_labels.sql       |   2 +-
 .../saas/V32__policy_processed_files.sql      |   4 +-
 .../entitlement/EntitlementGuardTest.java     |  91 +++++++++++++
 .../editor/src/core/constants/featureFlags.ts |   8 --
 .../components/policies/usePoliciesEnabled.ts |  16 +--
 .../src/desktop/constants/featureFlags.ts     |  10 --
 .../proprietary/components/policies/README.md |   7 +-
 .../components/policies/usePoliciesEnabled.ts |   9 +-
 .../policies/usePolicyAutoRun.batch.test.tsx  |   1 -
 .../policies/usePolicyAutoRun.chain.test.tsx  |   1 -
 .../policies/usePolicyAutoRun.import.test.tsx |   1 -
 .../policies/usePolicyAutoRun.retry.test.tsx  |   1 -
 .../components/policies/usePolicyAutoRun.ts   |   7 +-
 .../src/proprietary/constants/featureFlags.ts |   8 --
 .../src/proprietary/services/policyExport.ts  |   2 -
 .../editor/src/saas/constants/featureFlags.ts |   9 --
 56 files changed, 378 insertions(+), 156 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyRunRoutes.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyRunRoutesTest.java
 delete mode 100644 frontend/editor/src/desktop/constants/featureFlags.ts
 delete mode 100644 frontend/editor/src/saas/constants/featureFlags.ts

diff --git a/.github/workflows/PR-Auto-Deploy-V2.yml b/.github/workflows/PR-Auto-Deploy-V2.yml
index a3573a49df..8f1aab7977 100644
--- a/.github/workflows/PR-Auto-Deploy-V2.yml
+++ b/.github/workflows/PR-Auto-Deploy-V2.yml
@@ -297,7 +297,6 @@ jobs:
                 - /stirling/V2-PR-${{ needs.check-pr.outputs.pr_number }}/storage:/storage:rw
               environment:
                 DISABLE_ADDITIONAL_FEATURES: "false"
-                POLICIES_ENABLED: "true"
                 STIRLING_BILLING_ACCOUNT_LINK_ENABLED: "true"
                 SECURITY_ENABLELOGIN: "true"
                 SECURITY_INITIALLOGIN_USERNAME: "${{ secrets.TEST_LOGIN_USERNAME }}"
diff --git a/.taskfiles/backend.yml b/.taskfiles/backend.yml
index 77c9645476..dde75433a8 100644
--- a/.taskfiles/backend.yml
+++ b/.taskfiles/backend.yml
@@ -26,7 +26,6 @@ tasks:
           AIENGINE_ENABLED: '{{.AIENGINE_ENABLED}}'
           AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS}}'
           SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN}}'
-          POLICIES_ENABLED: '{{.POLICIES_ENABLED}}'
 
   dev:proprietary:
     desc: "Start backend dev server in proprietary mode"
@@ -41,13 +40,12 @@ tasks:
       AIENGINE_ENABLED: '{{.AIENGINE_ENABLED | default "false"}}'
       AIENGINE_TIMEOUTSECONDS: '{{.AIENGINE_TIMEOUTSECONDS | default "120"}}'
       SECURITY_ENABLELOGIN: '{{.SECURITY_ENABLELOGIN | default ""}}'
-      POLICIES_ENABLED: '{{.POLICIES_ENABLED | default ""}}'
     env:
       SERVER_PORT: '{{.PORT}}'
     cmds:
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}{{if .POLICIES_ENABLED}}POLICIES_ENABLED={{.POLICIES_ENABLED}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}cmd /c ".\gradlew.bat :stirling-pdf:bootRun"'
         platforms: [windows]
-      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}{{if .POLICIES_ENABLED}}POLICIES_ENABLED={{.POLICIES_ENABLED}} {{end}}./gradlew :stirling-pdf:bootRun'
+      - cmd: '{{if .AIENGINE_URL}}AIENGINE_URL={{.AIENGINE_URL}} AIENGINE_ENABLED={{.AIENGINE_ENABLED}} AIENGINE_TIMEOUTSECONDS={{.AIENGINE_TIMEOUTSECONDS}} {{end}}{{if .SECURITY_ENABLELOGIN}}SECURITY_ENABLELOGIN={{.SECURITY_ENABLELOGIN}} {{end}}./gradlew :stirling-pdf:bootRun'
         platforms: [linux, darwin]
 
   dev:bundled:
diff --git a/Taskfile.yml b/Taskfile.yml
index 705ad4a1db..75183bd4f9 100644
--- a/Taskfile.yml
+++ b/Taskfile.yml
@@ -90,7 +90,6 @@ tasks:
         vars:
           PORT: '{{.BACKEND_PORT}}'
           SECURITY_ENABLELOGIN: "true"
-          POLICIES_ENABLED: "true"
       - task: frontend:dev:proprietary
         vars:
           PORT: '{{.EDITOR_PORT}}'
diff --git a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
index d2f0472510..9714f7a1dd 100644
--- a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
+++ b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
@@ -206,11 +206,6 @@ public class ApplicationProperties {
 
     @Data
     public static class Policies {
-        /**
-         * Master switch for the policy + sources subsystem (the PAYG-metered automation surface).
-         */
-        private boolean enabled = false;
-
         /**
          * Absolute directories that policy folder input sources and output sinks may read from or
          * write to. Empty (the default) disables folder access entirely, so a policy can never be
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptor.java b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptor.java
index 285943ee49..0cd71c9bda 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptor.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptor.java
@@ -35,6 +35,7 @@ import stirling.software.proprietary.billing.ContentHasher;
 import stirling.software.proprietary.billing.DocumentUnitCalculator;
 import stirling.software.proprietary.billing.DocumentUnitCalculator.FileSize;
 import stirling.software.proprietary.billing.UnitCalcPolicy;
+import stirling.software.proprietary.policy.controller.PolicyRunRoutes;
 import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 
 /**
@@ -84,7 +85,13 @@ public class InstanceEntitlementInterceptor implements HandlerInterceptor {
                             instanceof ApiKeyAuthenticationToken;
             BillingCategory category = BillableOperationClassifier.categorize(request, apiKey);
             request.setAttribute(ATTR_CATEGORY, category);
-            decision = gate.evaluate(category != BillingCategory.BYPASSED);
+            // A policy run kicks off billable automation, so block it up front when unentitled
+            // rather than after its first tool. It carries no automation header itself (category
+            // BYPASSED), so it's gated here but metered only via its dispatched sub-steps - keeping
+            // the BYPASSED meter category avoids double-counting.
+            boolean billable =
+                    category != BillingCategory.BYPASSED || PolicyRunRoutes.matches(request);
+            decision = gate.evaluate(billable);
         } catch (RuntimeException e) {
             // Fail open: an inability to resolve entitlement (e.g. a DB or SaaS blip) must never
             // turn into a hard block on billable work.
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java
index d61a006cd9..5c83e0cde3 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java
@@ -6,7 +6,6 @@ import java.util.Arrays;
 import java.util.List;
 import java.util.Optional;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.core.env.Environment;
 import org.springframework.stereotype.Component;
 
@@ -30,7 +29,6 @@ import stirling.software.proprietary.policy.source.SourceStore;
  * defended: an operator who roots an allowlist on a symlink to a sensitive location is trusted.
  */
 @Component
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class FolderAccessGuard {
 
     public static final String FOLDER_TYPE = "folder";
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/PolicyAccessGuard.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/PolicyAccessGuard.java
index 061c788052..4fa90cc04b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/PolicyAccessGuard.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/PolicyAccessGuard.java
@@ -3,7 +3,6 @@ package stirling.software.proprietary.policy.config;
 import java.util.List;
 import java.util.Objects;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Component;
 
 import lombok.RequiredArgsConstructor;
@@ -23,7 +22,6 @@ import stirling.software.proprietary.policy.store.PolicyStore;
  */
 @Component
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class PolicyAccessGuard {
 
     private final UserServiceInterface userService;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
index 95fde9304a..71e5b93c4e 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
@@ -7,7 +7,6 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.core.io.FileSystemResource;
 import org.springframework.core.io.Resource;
 import org.springframework.http.HttpStatus;
@@ -85,7 +84,6 @@ import stirling.software.proprietary.util.SecretMasker;
 @Hidden
 @RequiredArgsConstructor
 @Tag(name = "Policies", description = "Run tool pipelines on the backend")
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class PolicyController {
 
     private final PolicyRunner policyRunner;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyRunRoutes.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyRunRoutes.java
new file mode 100644
index 0000000000..4c8b5f40a5
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyRunRoutes.java
@@ -0,0 +1,85 @@
+package stirling.software.proprietary.policy.controller;
+
+import org.springframework.web.servlet.HandlerMapping;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+/**
+ * Policy execute-route namespace under {@code /api/v1/policies} - the paths that actually run an
+ * automation ({@code /run}, {@code /run/stream}, {@code /{id}/run}, {@code /{id}/trigger}).
+ *
+ * <p>Single source of truth for both PAYG entitlement gates, so a caller without billing is blocked
+ * at the start of a run rather than partway through: the saas {@code EntitlementGuard} gates these
+ * on {@code FeatureGate.AUTOMATION}, and the self-hosted account-link {@code
+ * InstanceEntitlementInterceptor} treats them as billable. Read/list policy endpoints are
+ * deliberately excluded so the UI can still show policies and prompt on use.
+ *
+ * <p>This is the sole gate between an unentitled caller and a billable run, so the match is exact
+ * (not a loose suffix) and segment-anchored. {@code PolicyRunRoutesTest} asserts it against every
+ * mapping on {@code PolicyController}, so a new execute route that isn't classified here fails the
+ * build rather than silently running for free.
+ */
+public final class PolicyRunRoutes {
+
+    private static final String BASE = "/api/v1/policies";
+
+    private PolicyRunRoutes() {}
+
+    /**
+     * True when the request resolved to a policy execute endpoint. Prefers the matched route
+     * pattern (context-path independent, set by Spring MVC) and falls back to the raw request URI.
+     */
+    public static boolean matches(HttpServletRequest request) {
+        Object pattern = request.getAttribute(HandlerMapping.BEST_MATCHING_PATTERN_ATTRIBUTE);
+        String path = pattern instanceof String s ? s : request.getRequestURI();
+        String rel = relativeToBase(path);
+        return rel != null && isExecuteRoute(rel);
+    }
+
+    /**
+     * The path relative to {@code /api/v1/policies}, or null if the request isn't under that base.
+     * Segment-anchored (the char after the base must be {@code /} or end-of-string) so a sibling
+     * like {@code /api/v1/policies-x/...} never matches; tolerates a leading context path.
+     */
+    private static String relativeToBase(String path) {
+        if (path == null) {
+            return null;
+        }
+        int base = path.indexOf(BASE);
+        if (base < 0) {
+            return null;
+        }
+        int end = base + BASE.length();
+        if (end < path.length() && path.charAt(end) != '/') {
+            return null;
+        }
+        return path.substring(end);
+    }
+
+    /**
+     * The execute routes only: {@code /run}, {@code /run/stream}, and the single-segment {@code
+     * /{id}/run} / {@code /{id}/trigger} (template or concrete id). Read/list/CRUD routes - {@code
+     * /run/{runId}}, {@code /runs}, {@code /overview}, {@code /triggers}, {@code /{id}}, {@code
+     * /order}, {@code /{id}/processed-history}, the base list/create - are all excluded.
+     */
+    private static boolean isExecuteRoute(String rel) {
+        return rel.equals("/run")
+                || rel.equals("/run/stream")
+                || isSingleIdRoute(rel, "run")
+                || isSingleIdRoute(rel, "trigger");
+    }
+
+    /**
+     * True for exactly {@code /{oneSegment}/<verb>} (the id being a template or a concrete value).
+     */
+    private static boolean isSingleIdRoute(String rel, String verb) {
+        String suffix = "/" + verb;
+        if (!rel.endsWith(suffix)) {
+            return false;
+        }
+        String idSegment = rel.substring(0, rel.length() - suffix.length());
+        return idSegment.length() > 1
+                && idSegment.charAt(0) == '/'
+                && idSegment.indexOf('/', 1) < 0;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
index d54caedd14..2ceabae656 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
@@ -9,7 +9,6 @@ import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ExecutorService;
 
 import org.slf4j.MDC;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.core.io.Resource;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.core.Authentication;
@@ -57,7 +56,6 @@ import stirling.software.proprietary.service.DownstreamEntitlementError;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class PolicyEngine {
 
     // Admission weight for one run. Weighted heavy: a run chains many tools and holds intermediate
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunRegistry.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunRegistry.java
index f0a0a9d6b0..edc906461e 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunRegistry.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunRegistry.java
@@ -9,7 +9,6 @@ import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Service;
 
 import jakarta.annotation.PreDestroy;
@@ -29,7 +28,6 @@ import stirling.software.proprietary.policy.model.PolicyRun;
  */
 @Slf4j
 @Service
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class PolicyRunRegistry {
 
     private final Map<String, PolicyRun> runs = new ConcurrentHashMap<>();
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunner.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunner.java
index 8575e95e61..866fe0910d 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunner.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyRunner.java
@@ -5,7 +5,6 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.function.Consumer;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Service;
 
 import lombok.RequiredArgsConstructor;
@@ -35,7 +34,6 @@ import stirling.software.proprietary.policy.source.SourceStore;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class PolicyRunner {
 
     private final PolicyEngine policyEngine;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java
index 92c4cf95d9..cac05765a0 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java
@@ -2,7 +2,6 @@ package stirling.software.proprietary.policy.engine;
 
 import java.util.List;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Service;
 
 import lombok.RequiredArgsConstructor;
@@ -25,7 +24,6 @@ import stirling.software.proprietary.policy.trigger.PolicyTrigger;
  */
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class PolicyValidator {
 
     private final List<PolicyTrigger> triggers;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/FolderInputSource.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/FolderInputSource.java
index 9270cc0c1b..4f02d13c82 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/FolderInputSource.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/FolderInputSource.java
@@ -14,7 +14,6 @@ import java.util.Map;
 import java.util.function.Supplier;
 import java.util.stream.Stream;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.core.io.FileSystemResource;
 import org.springframework.core.io.Resource;
 import org.springframework.stereotype.Service;
@@ -42,7 +41,6 @@ import stirling.software.proprietary.policy.model.PolicyInputs;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class FolderInputSource implements InputSource {
 
     private static final String TYPE = FolderAccessGuard.FOLDER_TYPE;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/S3InputSource.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/S3InputSource.java
index fbbcfc4549..34576b47b9 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/S3InputSource.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/S3InputSource.java
@@ -6,7 +6,6 @@ import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.List;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.core.io.AbstractResource;
 import org.springframework.core.io.Resource;
 import org.springframework.stereotype.Service;
@@ -49,7 +48,6 @@ import software.amazon.awssdk.services.s3.model.S3Object;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class S3InputSource implements InputSource {
 
     private static final String TYPE = "s3";
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/ledger/JpaProcessedLedger.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/ledger/JpaProcessedLedger.java
index 43f0e6795d..02fce08763 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/ledger/JpaProcessedLedger.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/ledger/JpaProcessedLedger.java
@@ -7,7 +7,6 @@ import java.util.Map;
 import java.util.function.Supplier;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.boot.context.event.ApplicationReadyEvent;
 import org.springframework.context.event.EventListener;
 import org.springframework.dao.DataIntegrityViolationException;
@@ -24,7 +23,6 @@ import lombok.extern.slf4j.Slf4j;
  */
 @Slf4j
 @Service
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class JpaProcessedLedger implements ProcessedLedger {
 
     private static final int STAMP_CHUNK = 500;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/FolderOutputSink.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/FolderOutputSink.java
index 52da21208a..c06f18a846 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/FolderOutputSink.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/FolderOutputSink.java
@@ -15,7 +15,6 @@ import java.util.List;
 import java.util.UUID;
 import java.util.stream.Stream;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.MediaTypeFactory;
@@ -41,7 +40,6 @@ import stirling.software.proprietary.policy.model.OutputSpec;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class FolderOutputSink implements PolicyOutputSink {
 
     static final String TYPE = FolderAccessGuard.FOLDER_TYPE;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/InlineOutputSink.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/InlineOutputSink.java
index 904eb20523..78531eaa9c 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/InlineOutputSink.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/InlineOutputSink.java
@@ -5,7 +5,6 @@ import java.io.InputStream;
 import java.util.ArrayList;
 import java.util.List;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.MediaTypeFactory;
@@ -23,7 +22,6 @@ import stirling.software.proprietary.policy.model.OutputSpec;
  */
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class InlineOutputSink implements PolicyOutputSink {
 
     private static final String TYPE = "inline";
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/S3OutputSink.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/S3OutputSink.java
index fb590b3c2e..b0bd210e10 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/S3OutputSink.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/S3OutputSink.java
@@ -13,7 +13,6 @@ import java.util.HexFormat;
 import java.util.List;
 import java.util.UUID;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.core.io.Resource;
 import org.springframework.http.MediaType;
 import org.springframework.http.MediaTypeFactory;
@@ -54,7 +53,6 @@ import software.amazon.awssdk.services.s3.model.S3Exception;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class S3OutputSink implements PolicyOutputSink {
 
     private static final String TYPE = "s3";
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java
index 5ba7856606..117d78de40 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java
@@ -5,7 +5,6 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Service;
 
 import lombok.RequiredArgsConstructor;
@@ -29,7 +28,6 @@ import stirling.software.proprietary.policy.store.PolicyStore;
  */
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class PolicyOverviewService {
 
     private final PolicyStore policyStore;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
index 398b2bd709..e324cda525 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
@@ -4,7 +4,6 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.boot.context.event.ApplicationReadyEvent;
 import org.springframework.context.event.EventListener;
 import org.springframework.stereotype.Component;
@@ -44,7 +43,6 @@ import tools.jackson.databind.ObjectMapper;
 @Slf4j
 @Component
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class EmbeddedS3CredentialMigration {
 
     private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheck.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheck.java
index 00d1b28e6c..276ca1b002 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheck.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/PolicyS3ConnectionUsageCheck.java
@@ -4,7 +4,6 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Component;
 
 import lombok.RequiredArgsConstructor;
@@ -23,7 +22,6 @@ import stirling.software.proprietary.policy.store.PolicyStore;
  */
 @Component
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class PolicyS3ConnectionUsageCheck implements IntegrationConfigUsageCheck {
 
     private final SourceStore sourceStore;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionPool.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionPool.java
index 4118557dbd..145295d462 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionPool.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionPool.java
@@ -6,7 +6,6 @@ import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.Function;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Service;
 
 import jakarta.annotation.PreDestroy;
@@ -32,7 +31,6 @@ import software.amazon.awssdk.services.s3.S3Configuration;
  * users rather than the operator.
  */
 @Service
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class S3ConnectionPool {
 
     private final ApplicationProperties applicationProperties;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionResolver.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionResolver.java
index d15839aebe..f8b39b6e36 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionResolver.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3ConnectionResolver.java
@@ -3,7 +3,6 @@ package stirling.software.proprietary.policy.s3;
 import java.util.LinkedHashMap;
 import java.util.Map;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.userdetails.UserDetails;
@@ -39,7 +38,6 @@ import tools.jackson.databind.ObjectMapper;
 @Service
 @RequiredArgsConstructor
 @Transactional(readOnly = true)
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class S3ConnectionResolver {
 
     static final String CONNECTION_ID_OPTION = "connectionId";
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3IntegrationValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3IntegrationValidator.java
index ee36ba5693..026c3f2377 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3IntegrationValidator.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/S3IntegrationValidator.java
@@ -3,7 +3,6 @@ package stirling.software.proprietary.policy.s3;
 import java.net.URI;
 import java.util.Map;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Component;
 
 import lombok.RequiredArgsConstructor;
@@ -21,7 +20,6 @@ import stirling.software.proprietary.integration.service.IntegrationConfigValida
  */
 @Component
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class S3IntegrationValidator implements IntegrationConfigValidator {
 
     private final ApplicationProperties applicationProperties;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceDocCounter.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceDocCounter.java
index af67953d77..11a82187c9 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceDocCounter.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceDocCounter.java
@@ -10,7 +10,6 @@ import java.util.function.IntSupplier;
 import java.util.function.Supplier;
 
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.dao.DataIntegrityViolationException;
 import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Service;
@@ -24,7 +23,6 @@ import org.springframework.stereotype.Service;
  * table stays bounded (~one row per source per active hour, for at most 30 days).
  */
 @Service
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class JpaSourceDocCounter implements SourceDocCounter {
 
     private final SourceDocCountRepository countRepository;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceStore.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceStore.java
index 69249fb700..259159a9db 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceStore.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/JpaSourceStore.java
@@ -4,7 +4,6 @@ import java.util.List;
 import java.util.Optional;
 import java.util.UUID;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Service;
 
 import lombok.RequiredArgsConstructor;
@@ -19,7 +18,6 @@ import tools.jackson.databind.ObjectMapper;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class JpaSourceStore implements SourceStore {
 
     private final SourceRepository repository;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceAccessGuard.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceAccessGuard.java
index f5a14282c9..72ff59e914 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceAccessGuard.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceAccessGuard.java
@@ -3,7 +3,6 @@ package stirling.software.proprietary.policy.source;
 import java.util.List;
 import java.util.Objects;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Component;
 
 import lombok.RequiredArgsConstructor;
@@ -20,7 +19,6 @@ import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
  */
 @Component
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class SourceAccessGuard {
 
     private final UserServiceInterface userService;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
index 524b8c369c..b9a19e9d2f 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
@@ -3,7 +3,6 @@ package stirling.software.proprietary.policy.source;
 import java.util.List;
 import java.util.Map;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -43,7 +42,6 @@ import stirling.software.proprietary.util.SecretMasker;
 @Hidden
 @RequiredArgsConstructor
 @Tag(name = "Sources", description = "Reusable policy input connections")
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class SourceController {
 
     private final SourceStore sourceStore;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java
index f202a30e23..1f5eb18174 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java
@@ -6,7 +6,6 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Service;
 
 import lombok.RequiredArgsConstructor;
@@ -24,7 +23,6 @@ import stirling.software.proprietary.util.SecretMasker;
  */
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class SourceOverviewService {
 
     private final SourceStore sourceStore;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java
index 08b2942b14..41da23c734 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java
@@ -5,7 +5,6 @@ import java.util.Objects;
 import java.util.Optional;
 import java.util.UUID;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 
@@ -23,7 +22,6 @@ import tools.jackson.databind.ObjectMapper;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class JpaPolicyStore implements PolicyStore {
 
     private final PolicyRepository repository;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/FolderWatchTrigger.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/FolderWatchTrigger.java
index dee78e8488..a4470a418b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/FolderWatchTrigger.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/FolderWatchTrigger.java
@@ -20,7 +20,6 @@ import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Service;
 
 import lombok.RequiredArgsConstructor;
@@ -50,7 +49,6 @@ import stirling.software.proprietary.policy.store.PolicyStore;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class FolderWatchTrigger implements PolicyTrigger {
 
     private static final String TYPE = "folder-watch";
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/PolicyTriggerManager.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/PolicyTriggerManager.java
index 7971e6b490..cf63853be9 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/PolicyTriggerManager.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/PolicyTriggerManager.java
@@ -2,7 +2,6 @@ package stirling.software.proprietary.policy.trigger;
 
 import java.util.List;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.context.SmartLifecycle;
 import org.springframework.stereotype.Service;
 
@@ -13,7 +12,6 @@ import lombok.extern.slf4j.Slf4j;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class PolicyTriggerManager implements SmartLifecycle {
 
     private final List<PolicyTrigger> triggers;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/ScheduleTrigger.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/ScheduleTrigger.java
index 32ba4ec77d..2018ffd126 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/ScheduleTrigger.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/ScheduleTrigger.java
@@ -10,7 +10,6 @@ import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBooleanProperty;
 import org.springframework.stereotype.Service;
 
 import lombok.RequiredArgsConstructor;
@@ -32,7 +31,6 @@ import tools.jackson.databind.ObjectMapper;
 @Slf4j
 @Service
 @RequiredArgsConstructor
-@ConditionalOnBooleanProperty(name = "policies.enabled")
 public class ScheduleTrigger implements PolicyTrigger {
 
     private static final String TYPE = "schedule";
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptorTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptorTest.java
index 13a2606105..082da85fd7 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptorTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/accountlink/InstanceEntitlementInterceptorTest.java
@@ -155,6 +155,43 @@ class InstanceEntitlementInterceptorTest {
         verifyNoInteractions(entitlementCache);
     }
 
+    @Test
+    void gatesPolicyRunUpFrontEvenWithoutAutomationHeader() throws Exception {
+        // The policy /run call carries no automation header, but must be blocked up front (not
+        // after its first tool) when the instance is unlinked.
+        when(gate.evaluate(anyBoolean()))
+                .thenReturn(GateDecision.block(GateDecision.Reason.NOT_LINKED));
+
+        InstanceEntitlementInterceptor interceptor = interceptor();
+        MockHttpServletRequest req =
+                new MockHttpServletRequest("POST", "/api/v1/policies/pol-1/run");
+        MockHttpServletResponse resp = new MockHttpServletResponse();
+
+        assertFalse(interceptor.preHandle(req, resp, new Object()));
+        assertEquals(HttpStatus.PAYMENT_REQUIRED.value(), resp.getStatus());
+        assertTrue(resp.getContentAsString().contains("ACCOUNT_LINK_REQUIRED"));
+        verify(gate).evaluate(true); // gated as billable despite no automation header
+    }
+
+    @Test
+    void doesNotMeterThePolicyRunEndpointItself() throws Exception {
+        // Gated up front, but metered only via its dispatched tool sub-steps (category BYPASSED
+        // here), so the /run request itself never accrues usage.
+        when(gate.evaluate(anyBoolean()))
+                .thenReturn(GateDecision.allow(GateDecision.Reason.ENTITLED));
+        UsageMeterService meter = mock(UsageMeterService.class);
+        when(meterProvider.getIfAvailable()).thenReturn(meter);
+
+        InstanceEntitlementInterceptor interceptor = interceptor();
+        MockHttpServletRequest req =
+                new MockHttpServletRequest("POST", "/api/v1/policies/pol-1/run");
+        MockHttpServletResponse resp = new MockHttpServletResponse();
+        interceptor.preHandle(req, resp, new Object());
+        interceptor.afterCompletion(req, resp, new Object(), null);
+
+        verifyNoInteractions(meter);
+    }
+
     private static InstanceEntitlement entitled(UnitCalcPolicy policy, LocalDateTime period) {
         return new InstanceEntitlement(
                 true, 0, 0, 100L, EntitlementState.OK, policy, period, period.plusMonths(1));
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyRunRoutesTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyRunRoutesTest.java
new file mode 100644
index 0000000000..f1be12ae1d
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyRunRoutesTest.java
@@ -0,0 +1,127 @@
+package stirling.software.proprietary.policy.controller;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.util.Arrays;
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.core.annotation.AnnotatedElementUtils;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.servlet.HandlerMapping;
+
+class PolicyRunRoutesTest {
+
+    private static boolean matchesUri(String uri) {
+        MockHttpServletRequest req = new MockHttpServletRequest();
+        req.setRequestURI(uri);
+        return PolicyRunRoutes.matches(req);
+    }
+
+    private static boolean matchesPattern(String pattern) {
+        MockHttpServletRequest req = new MockHttpServletRequest();
+        req.setAttribute(HandlerMapping.BEST_MATCHING_PATTERN_ATTRIBUTE, pattern);
+        return PolicyRunRoutes.matches(req);
+    }
+
+    @Test
+    void matchesTheFourExecuteRoutes() {
+        assertThat(matchesUri("/api/v1/policies/run")).isTrue();
+        assertThat(matchesUri("/api/v1/policies/run/stream")).isTrue();
+        assertThat(matchesUri("/api/v1/policies/pol-123/run")).isTrue();
+        assertThat(matchesUri("/api/v1/policies/pol-123/trigger")).isTrue();
+    }
+
+    @Test
+    void excludesReadListAndCrudRoutes() {
+        assertThat(matchesUri("/api/v1/policies")).isFalse(); // list + create
+        assertThat(matchesUri("/api/v1/policies/runs")).isFalse();
+        assertThat(matchesUri("/api/v1/policies/run/abc-run-id")).isFalse(); // GET /run/{runId}
+        assertThat(matchesUri("/api/v1/policies/overview")).isFalse();
+        assertThat(matchesUri("/api/v1/policies/triggers")).isFalse(); // NB: not "/trigger"
+        assertThat(matchesUri("/api/v1/policies/order")).isFalse();
+        assertThat(matchesUri("/api/v1/policies/pol-123")).isFalse();
+        assertThat(matchesUri("/api/v1/policies/pol-123/processed-history")).isFalse();
+    }
+
+    @Test
+    void isSegmentAnchoredAndContextPathTolerant() {
+        assertThat(matchesUri("/stirling/api/v1/policies/pol-123/run")).isTrue();
+        assertThat(matchesUri("/api/v1/policies-x/pol-123/run"))
+                .isFalse(); // sibling, not the segment
+        assertThat(matchesUri("/api/v1/sources/pol/run")).isFalse();
+        assertThat(matchesUri("/api/v1/misc/compress-pdf")).isFalse();
+    }
+
+    /** Every request mapping on PolicyController, and whether it executes an automation. */
+    private static final Map<String, Boolean> EXPECTED =
+            Map.of(
+                    "/api/v1/policies", false, // base: list (GET) + create (POST)
+                    "/api/v1/policies/run", true,
+                    "/api/v1/policies/run/stream", true,
+                    "/api/v1/policies/run/{runId}", false,
+                    "/api/v1/policies/runs", false,
+                    "/api/v1/policies/order", false,
+                    "/api/v1/policies/overview", false,
+                    "/api/v1/policies/triggers", false,
+                    "/api/v1/policies/{policyId}", false, // GET + DELETE
+                    "/api/v1/policies/{policyId}/processed-history", false);
+
+    // Split out because Map.of caps at 10 entries; the execute {id} routes live here.
+    private static final Map<String, Boolean> EXPECTED_ID_EXECUTES =
+            Map.of(
+                    "/api/v1/policies/{policyId}/run", true,
+                    "/api/v1/policies/{policyId}/trigger", true);
+
+    /**
+     * Fail-safe: this matcher is the sole billing gate, so an unmatched execute route would run
+     * automations for free. Reconstruct every mapping on PolicyController and assert its
+     * classification is declared above - a new/renamed route lands as "unclassified" and fails the
+     * build until someone decides whether it executes an automation.
+     */
+    @Test
+    void everyControllerMappingIsClassified() {
+        String base = classMapping();
+        Arrays.stream(PolicyController.class.getDeclaredMethods())
+                .filter(m -> AnnotatedElementUtils.hasAnnotation(m, RequestMapping.class))
+                .forEach(
+                        m -> {
+                            String pattern = base + methodMapping(m);
+                            Boolean expected = expectedFor(pattern);
+                            assertThat(expected)
+                                    .as(
+                                            "unclassified PolicyController route %s - add it to"
+                                                    + " PolicyRunRoutesTest.EXPECTED",
+                                            pattern)
+                                    .isNotNull();
+                            assertThat(matchesPattern(pattern))
+                                    .as("PolicyRunRoutes classification of %s", pattern)
+                                    .isEqualTo(expected);
+                        });
+    }
+
+    private static Boolean expectedFor(String pattern) {
+        if (EXPECTED.containsKey(pattern)) {
+            return EXPECTED.get(pattern);
+        }
+        return EXPECTED_ID_EXECUTES.get(pattern);
+    }
+
+    private static String classMapping() {
+        RequestMapping rm =
+                AnnotatedElementUtils.getMergedAnnotation(
+                        PolicyController.class, RequestMapping.class);
+        return rm == null ? "" : firstOrEmpty(rm);
+    }
+
+    private static String methodMapping(java.lang.reflect.Method m) {
+        RequestMapping rm = AnnotatedElementUtils.getMergedAnnotation(m, RequestMapping.class);
+        return rm == null ? "" : firstOrEmpty(rm);
+    }
+
+    private static String firstOrEmpty(RequestMapping rm) {
+        String[] paths = rm.path().length > 0 ? rm.path() : rm.value();
+        return paths.length > 0 ? paths[0] : "";
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/entitlement/EntitlementGuard.java b/app/saas/src/main/java/stirling/software/saas/payg/entitlement/EntitlementGuard.java
index 54ebd24c04..ae8474fa42 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/entitlement/EntitlementGuard.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/entitlement/EntitlementGuard.java
@@ -31,6 +31,7 @@ import jakarta.servlet.http.HttpServletResponse;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.annotations.AutoJobPostMapping;
+import stirling.software.proprietary.policy.controller.PolicyRunRoutes;
 import stirling.software.proprietary.security.database.repository.UserRepository;
 import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.User;
@@ -46,9 +47,11 @@ import stirling.software.saas.util.AuthenticationUtils;
  *
  * <p>Scope: routes whose handler method (or bean type) carries either {@link AutoJobPostMapping}
  * (multipart tool POSTs) or {@link RequiresFeature} (AI controllers, future non-multipart gated
- * routes). Admin / info / config endpoints are excluded by the path-pattern in {@code
- * PaygWebMvcConfig} and are additionally skipped here when they carry neither annotation, so non-
- * billable infra never trips the guard.
+ * routes), plus two proprietary route families recognised by path since they can't carry the
+ * annotation: AI document tools ({@link AiToolRoutes} gated on AI_SUPPORT) and policy execute
+ * endpoints ({@link PolicyRunRoutes} gated on AUTOMATION). Admin / info / config endpoints are
+ * excluded by the path-pattern in {@code PaygWebMvcConfig} and are additionally skipped here when
+ * they carry no annotation and match no such family, so non-billable infra never trips the guard.
  *
  * <p>Decision matrix:
  *
@@ -137,13 +140,20 @@ public class EntitlementGuard implements HandlerInterceptor {
         // @RequiresFeature; recognise them by path so they're gated on AI_SUPPORT — see
         // AiToolRoutes and PaygChargeInterceptor, which classify the same routes as AI.
         boolean aiToolRoute = AiToolRoutes.matches(request);
-        if (!hasAutoJobPostMapping && !hasRequiresFeature && !aiToolRoute) {
+        // Policy execute routes (/api/v1/policies/**/run etc.) are proprietary and can't carry
+        // @RequiresFeature; recognise them by path and gate on AUTOMATION (mirrors aiToolRoute).
+        boolean policyRunRoute = PolicyRunRoutes.matches(request);
+        if (!hasAutoJobPostMapping && !hasRequiresFeature && !aiToolRoute && !policyRunRoute) {
             skippedNoAnnotationCounter.increment();
             return true;
         }
 
         FeatureGate[] required =
-                aiToolRoute ? new FeatureGate[] {FeatureGate.AI_SUPPORT} : resolveRequiredGates(hm);
+                aiToolRoute
+                        ? new FeatureGate[] {FeatureGate.AI_SUPPORT}
+                        : policyRunRoute
+                                ? new FeatureGate[] {FeatureGate.AUTOMATION}
+                                : resolveRequiredGates(hm);
         Authentication auth = SecurityContextHolder.getContext().getAuthentication();
 
         boolean anonymous = isAnonymous(auth);
diff --git a/app/saas/src/main/resources/application-saas.properties b/app/saas/src/main/resources/application-saas.properties
index 49798d64cd..a6b594dd96 100644
--- a/app/saas/src/main/resources/application-saas.properties
+++ b/app/saas/src/main/resources/application-saas.properties
@@ -74,10 +74,6 @@ supabase.url=https://${app.supabase.project-ref}.supabase.co
 spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://${app.supabase.project-ref}.supabase.co/auth/v1/.well-known/jwks.json
 spring.security.oauth2.resourceserver.jwt.audiences=${app.supabase.expected-aud}
 
-# ---------- Policies ----------
-# Exposes the /api/v1/policies and /api/v1/sources controllers, engine, stores, and triggers.
-policies.enabled=true
-
 # ---------- Multi-tenant scoping ----------
 # Restrict the signing user picker to the caller's team; SaaS must be 'team'
 # or unrelated tenants leak emails to each other.
diff --git a/app/saas/src/main/resources/db/migration/saas/V22__policy_engine_tables.sql b/app/saas/src/main/resources/db/migration/saas/V22__policy_engine_tables.sql
index babdaef562..b07ad1cebf 100644
--- a/app/saas/src/main/resources/db/migration/saas/V22__policy_engine_tables.sql
+++ b/app/saas/src/main/resources/db/migration/saas/V22__policy_engine_tables.sql
@@ -1,4 +1,4 @@
--- Policy engine schema (gated by policies.enabled): persisted policies and the reusable input
+-- Policy engine schema: persisted policies and the reusable input
 -- connections ("sources") they reference by id. The whole policy/source lives as JSON in the
 -- *_json column (authoritative on read); the scalar columns are denormalized copies for querying,
 -- notably team_id so a caller's team can be loaded without scanning every team's rows. owner and
diff --git a/app/saas/src/main/resources/db/migration/saas/V23__policy_source_doc_counts.sql b/app/saas/src/main/resources/db/migration/saas/V23__policy_source_doc_counts.sql
index 7dcbaf1c0e..bf50191893 100644
--- a/app/saas/src/main/resources/db/migration/saas/V23__policy_source_doc_counts.sql
+++ b/app/saas/src/main/resources/db/migration/saas/V23__policy_source_doc_counts.sql
@@ -9,8 +9,8 @@
 --                             instead of scanning a source's whole bucket history - and so the
 --                             hourly buckets can be pruned without losing it.
 --
--- Gated by policies.enabled like the rest of the subsystem; Hibernate ddl-auto would also create
--- these, but the migration keeps the schema explicit for the Flyway-managed deployments.
+-- Hibernate ddl-auto would also create these, but the migration keeps the schema explicit for the
+-- Flyway-managed deployments.
 
 CREATE TABLE IF NOT EXISTS policy_source_doc_counts (
     source_id   VARCHAR(255) NOT NULL,
diff --git a/app/saas/src/main/resources/db/migration/saas/V30__classification_labels.sql b/app/saas/src/main/resources/db/migration/saas/V30__classification_labels.sql
index 0719d73fb1..6ad5ce7cc5 100644
--- a/app/saas/src/main/resources/db/migration/saas/V30__classification_labels.sql
+++ b/app/saas/src/main/resources/db/migration/saas/V30__classification_labels.sql
@@ -1,4 +1,4 @@
--- Classification labels (gated by policies.enabled): the flat multi-label vocabulary the document
+-- Classification labels: the flat multi-label vocabulary the document
 -- classifier runs against. One admin-editable row per team. The whole label set lives as JSON in
 -- labels_json (authoritative on read). team_id is a natural key and a plain value (not a foreign
 -- key) to stay decoupled from the security entities, so classification can be enabled or disabled
diff --git a/app/saas/src/main/resources/db/migration/saas/V32__policy_processed_files.sql b/app/saas/src/main/resources/db/migration/saas/V32__policy_processed_files.sql
index 4be3fa07d8..3a3e136437 100644
--- a/app/saas/src/main/resources/db/migration/saas/V32__policy_processed_files.sql
+++ b/app/saas/src/main/resources/db/migration/saas/V32__policy_processed_files.sql
@@ -10,8 +10,8 @@
 --                           the policy's sources, so the table stays near the set of files
 --                           currently present.
 --
--- Gated by policies.enabled like the rest of the subsystem; Hibernate ddl-auto would also create
--- this, but the migration keeps the schema explicit for the Flyway-managed deployments.
+-- Hibernate ddl-auto would also create this, but the migration keeps the schema explicit for the
+-- Flyway-managed deployments.
 
 CREATE TABLE IF NOT EXISTS policy_processed_files (
     policy_id     VARCHAR(255)  NOT NULL,
diff --git a/app/saas/src/test/java/stirling/software/saas/payg/entitlement/EntitlementGuardTest.java b/app/saas/src/test/java/stirling/software/saas/payg/entitlement/EntitlementGuardTest.java
index d66e4b17fe..0a77de3e7e 100644
--- a/app/saas/src/test/java/stirling/software/saas/payg/entitlement/EntitlementGuardTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/payg/entitlement/EntitlementGuardTest.java
@@ -198,6 +198,97 @@ class EntitlementGuardTest {
         assertThat(body.get("category").asText()).isEqualTo("AI");
     }
 
+    // ---------------------------------------------------------------------------------------
+    // Policy execute routes (proprietary; recognised by path, gated on AUTOMATION)
+    // ---------------------------------------------------------------------------------------
+
+    @Test
+    void policyRunRoute_noAnnotation_isInScopeAndGatedOnAutomation() throws Exception {
+        UUID supabaseId = UUID.randomUUID();
+        SecurityContextHolder.getContext().setAuthentication(jwtAuth(supabaseId));
+        when(userRepository.findBySupabaseId(supabaseId))
+                .thenReturn(Optional.of(userWithTeam(7L, 42L)));
+        when(entitlementService.getSnapshot(42L)).thenReturn(degradedSnapshot());
+
+        HandlerMethod hm = handlerFor("plainEndpoint"); // no annotations
+        MockHttpServletRequest req = new MockHttpServletRequest();
+        req.setRequestURI("/api/v1/policies/pol-123/run");
+        MockHttpServletResponse res = new MockHttpServletResponse();
+
+        boolean proceed = guard.preHandle(req, res, hm);
+
+        assertThat(proceed).isFalse();
+        assertThat(res.getStatus()).isEqualTo(402);
+        JsonNode body = json.readTree(res.getContentAsByteArray());
+        assertThat(body.get("error").asText()).isEqualTo("FEATURE_DEGRADED");
+        assertThat(body.get("missingGates").get(0).asText()).isEqualTo("AUTOMATION");
+        verify(entitlementService).getSnapshot(42L);
+    }
+
+    @Test
+    void policyRunRoute_anonymous_returns401WithAutomationCategory() throws Exception {
+        SecurityContextHolder.getContext()
+                .setAuthentication(
+                        new AnonymousAuthenticationToken(
+                                "key",
+                                "anonymousUser",
+                                List.of(new SimpleGrantedAuthority("ROLE_ANONYMOUS"))));
+
+        HandlerMethod hm = handlerFor("plainEndpoint");
+        MockHttpServletRequest req = new MockHttpServletRequest();
+        req.setRequestURI("/api/v1/policies/pol-123/trigger");
+        MockHttpServletResponse res = new MockHttpServletResponse();
+
+        boolean proceed = guard.preHandle(req, res, hm);
+
+        assertThat(proceed).isFalse();
+        assertThat(res.getStatus()).isEqualTo(401);
+        JsonNode body = json.readTree(res.getContentAsByteArray());
+        assertThat(body.get("error").asText()).isEqualTo("SIGNUP_REQUIRED");
+        assertThat(body.get("category").asText()).isEqualTo("AUTOMATION");
+    }
+
+    @Test
+    void policyRunRoute_authenticatedFull_passesThrough() throws Exception {
+        UUID supabaseId = UUID.randomUUID();
+        SecurityContextHolder.getContext().setAuthentication(jwtAuth(supabaseId));
+        when(userRepository.findBySupabaseId(supabaseId))
+                .thenReturn(Optional.of(userWithTeam(7L, 42L)));
+        when(entitlementService.getSnapshot(42L)).thenReturn(fullSnapshot());
+
+        HandlerMethod hm = handlerFor("plainEndpoint");
+        MockHttpServletRequest req = new MockHttpServletRequest();
+        req.setRequestURI("/api/v1/policies/run");
+        MockHttpServletResponse res = new MockHttpServletResponse();
+
+        boolean proceed = guard.preHandle(req, res, hm);
+
+        assertThat(proceed).isTrue();
+        assertThat(res.getStatus()).isEqualTo(200);
+    }
+
+    @Test
+    void policyReadRoute_notGated_passesThroughEvenDegraded() throws Exception {
+        // Listing policies must stay ungated so the UI can show them and prompt on use.
+        SecurityContextHolder.getContext()
+                .setAuthentication(
+                        new AnonymousAuthenticationToken(
+                                "key",
+                                "anonymousUser",
+                                List.of(new SimpleGrantedAuthority("ROLE_ANONYMOUS"))));
+
+        HandlerMethod hm = handlerFor("plainEndpoint");
+        MockHttpServletRequest req = new MockHttpServletRequest();
+        req.setRequestURI("/api/v1/policies");
+        MockHttpServletResponse res = new MockHttpServletResponse();
+
+        boolean proceed = guard.preHandle(req, res, hm);
+
+        assertThat(proceed).isTrue();
+        assertThat(res.getStatus()).isEqualTo(200);
+        Mockito.verifyNoInteractions(entitlementService);
+    }
+
     // ---------------------------------------------------------------------------------------
     // Anonymous user
     // ---------------------------------------------------------------------------------------
diff --git a/frontend/editor/src/core/constants/featureFlags.ts b/frontend/editor/src/core/constants/featureFlags.ts
index 0ada1cc673..a60770ac3a 100644
--- a/frontend/editor/src/core/constants/featureFlags.ts
+++ b/frontend/editor/src/core/constants/featureFlags.ts
@@ -11,11 +11,3 @@
 // Annotated as `boolean` (not the literal `false`) so call sites aren't treated
 // as constant/unreachable conditions by the type checker and linter.
 export const WATCHED_FOLDERS_ENABLED: boolean = false;
-
-/**
- * Policies — a proprietary, automation-backed feature (like Watched Folders but
- * backend-driven, with non-folder triggers). The implementation lives under
- * `proprietary/`; this core value stays `false` so the shared sidebar entry
- * never appears in the open-source build.
- */
-export const POLICIES_ENABLED: boolean = false;
diff --git a/frontend/editor/src/desktop/components/policies/usePoliciesEnabled.ts b/frontend/editor/src/desktop/components/policies/usePoliciesEnabled.ts
index efc8f33fa7..e04859a45e 100644
--- a/frontend/editor/src/desktop/components/policies/usePoliciesEnabled.ts
+++ b/frontend/editor/src/desktop/components/policies/usePoliciesEnabled.ts
@@ -1,19 +1,5 @@
-import { POLICIES_ENABLED } from "@app/constants/featureFlags";
 import { useConfirmedSaaSMode } from "@app/hooks/useConfirmedSaaSMode";
 
-/**
- * Desktop shadow: policy runs execute + bill via the cloud (POST
- * /api/v1/policies/.../run hits the SaaS backend), so the feature must stay
- * off in local ("disconnected") and self-hosted modes — otherwise the
- * auto-run controller would fire policy runs against a backend that doesn't
- * serve them.
- *
- * Pessimistic SaaS-mode check (starts false): this gate controls whether
- * PolicyAutoRunController mounts, and that fires GET /api/v1/policies on
- * mount. useSaaSMode()'s optimistic-true default would leak that request
- * against the local/self-hosted backend on cold start before the mode
- * resolves.
- */
 export function usePoliciesEnabled(): boolean {
-  return POLICIES_ENABLED && useConfirmedSaaSMode();
+  return useConfirmedSaaSMode();
 }
diff --git a/frontend/editor/src/desktop/constants/featureFlags.ts b/frontend/editor/src/desktop/constants/featureFlags.ts
deleted file mode 100644
index d003b3e642..0000000000
--- a/frontend/editor/src/desktop/constants/featureFlags.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * Desktop-build feature gates. Shadows `proprietary/constants/featureFlags.ts`
- * (the desktop `@app/*` alias has no saas layer). Re-exports the proprietary
- * flags and re-enables Policies: the desktop Policies gate additionally requires
- * an active SaaS connection (see the desktop `usePoliciesEnabled` shadow), so
- * the flag must be on for that runtime check to ever apply.
- */
-export * from "@proprietary/constants/featureFlags";
-
-export const POLICIES_ENABLED: boolean = true;
diff --git a/frontend/editor/src/proprietary/components/policies/README.md b/frontend/editor/src/proprietary/components/policies/README.md
index a08fc01452..19e2b8567e 100644
--- a/frontend/editor/src/proprietary/components/policies/README.md
+++ b/frontend/editor/src/proprietary/components/policies/README.md
@@ -4,9 +4,10 @@ Automation-backed document-enforcement policies. The editor side is
 **enforcement only**: policies are configured in the admin portal
 (`src/portal/views/Policies.tsx`); the editor runs enabled policies on
 uploaded files, blocks the file's exit points while a run is in flight, and
-badges files a policy has produced. It ships behind the `POLICIES_ENABLED`
-feature flag (SaaS build = on; proprietary and core builds = off; desktop
-additionally requires an active SaaS connection).
+badges files a policy has produced. Always on in the proprietary/SaaS builds;
+the core (OSS) build has no implementation (`usePoliciesEnabled` stub = false),
+and desktop additionally requires an active SaaS connection (runs bill through
+the cloud). The single gate is `components/policies/usePoliciesEnabled.ts`.
 
 ## Layout
 
diff --git a/frontend/editor/src/proprietary/components/policies/usePoliciesEnabled.ts b/frontend/editor/src/proprietary/components/policies/usePoliciesEnabled.ts
index 48cb41e99b..957913c2af 100644
--- a/frontend/editor/src/proprietary/components/policies/usePoliciesEnabled.ts
+++ b/frontend/editor/src/proprietary/components/policies/usePoliciesEnabled.ts
@@ -1,10 +1,3 @@
-import { POLICIES_ENABLED } from "@app/constants/featureFlags";
-
-/**
- * Whether policy enforcement is active for this build. Gates mounting the
- * headless PolicyAutoRunController. Shadows the core stub; the desktop build
- * shadows this again to additionally require an active SaaS connection.
- */
 export function usePoliciesEnabled(): boolean {
-  return POLICIES_ENABLED;
+  return true;
 }
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.batch.test.tsx b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.batch.test.tsx
index 1d1bec13e6..e936d97d00 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.batch.test.tsx
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.batch.test.tsx
@@ -47,7 +47,6 @@ const mocks = vi.hoisted(() => ({
   consumeFiles: vi.fn(),
 }));
 
-vi.mock("@app/constants/featureFlags", () => ({ POLICIES_ENABLED: true }));
 vi.mock("@app/contexts/FileContext", () => ({
   useAllFiles: () => ({ fileStubs: mocks.workspace }),
   useFileManagement: () => ({
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.chain.test.tsx b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.chain.test.tsx
index 638c821669..b2c2d6f5dc 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.chain.test.tsx
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.chain.test.tsx
@@ -4,7 +4,6 @@ import { renderHook, act } from "@testing-library/react";
 // Two active upload policies, so the auto-run should CHAIN them: fire the first on
 // the upload, then the second on the first's output. Stub the contexts + network so
 // we can drive the dispatch against the REAL run store.
-vi.mock("@app/constants/featureFlags", () => ({ POLICIES_ENABLED: true }));
 const fileStubs: { id: string; name: string; derivedFromTool?: boolean }[] = [];
 vi.mock("@app/contexts/FileContext", () => ({
   useAllFiles: () => ({ fileStubs }),
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.import.test.tsx b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.import.test.tsx
index b6e91186fd..b2193cda55 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.import.test.tsx
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.import.test.tsx
@@ -21,7 +21,6 @@ const mocks = vi.hoisted(() => ({
   createStirlingFilesAndStubs: vi.fn(),
 }));
 
-vi.mock("@app/constants/featureFlags", () => ({ POLICIES_ENABLED: true }));
 vi.mock("@app/contexts/FileContext", () => ({
   useAllFiles: () => ({ fileStubs: mocks.fileStubs }),
   useFileManagement: () => ({
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.retry.test.tsx b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.retry.test.tsx
index 7acc1ae2bb..c25f80ce65 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.retry.test.tsx
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.retry.test.tsx
@@ -3,7 +3,6 @@ import { renderHook, act } from "@testing-library/react";
 
 // The auto-run hook reaches into several contexts + the network; stub those so we can drive just
 // the queue-rejection retry path against the REAL run store.
-vi.mock("@app/constants/featureFlags", () => ({ POLICIES_ENABLED: true }));
 vi.mock("@app/contexts/FileContext", () => ({
   useAllFiles: () => ({ fileStubs: [] }),
   useFileManagement: () => ({ addFiles: vi.fn() }),
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
index 78e170d0d6..a876a785ff 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
@@ -23,7 +23,6 @@ import {
 } from "@app/contexts/FileContext";
 import { fileStorage } from "@app/services/fileStorage";
 import { useIndexedDB } from "@app/contexts/IndexedDBContext";
-import { POLICIES_ENABLED } from "@app/constants/featureFlags";
 import i18n from "@app/i18n";
 import {
   runStoredPolicy,
@@ -247,7 +246,6 @@ export function usePolicyAutoRun(): void {
   // of the chain is dispatched by the chaining effect below, each on the previous
   // policy's output, so the policies apply cumulatively in order.
   useEffect(() => {
-    if (!POLICIES_ENABLED) return;
     const firstCategory = orderedUploadCategories[0];
     if (!firstCategory) return;
     const backendId = policies[firstCategory]?.backendId;
@@ -281,7 +279,6 @@ export function usePolicyAutoRun(): void {
   // next upload policy on that output. Only chains on success (a failed run has no
   // output), and only once per run. isDispatched guards re-dispatch across reloads.
   useEffect(() => {
-    if (!POLICIES_ENABLED) return;
     for (const run of runs) {
       if (run.status !== "COMPLETED" || !run.imported) continue;
       if (chained.current.has(run.runId)) continue;
@@ -315,7 +312,6 @@ export function usePolicyAutoRun(): void {
 
   // Poll each in-flight run to a terminal state.
   useEffect(() => {
-    if (!POLICIES_ENABLED) return;
     for (const run of runs) {
       if (isTerminal(run.status) || polling.current.has(run.runId)) continue;
       polling.current.add(run.runId);
@@ -328,7 +324,6 @@ export function usePolicyAutoRun(): void {
   // Import each completed run's outputs into the workspace (each output once),
   // so the enforced file appears in the app rather than only on the backend.
   useEffect(() => {
-    if (!POLICIES_ENABLED) return;
     for (const run of runs) {
       if (
         run.status !== "COMPLETED" ||
@@ -377,7 +372,7 @@ export function usePolicyAutoRun(): void {
   // than leaving them orphaned. Waits until policies are known so server runs can be
   // attributed to their category.
   useEffect(() => {
-    if (!POLICIES_ENABLED || reconciled.current) return;
+    if (reconciled.current) return;
     if (Object.keys(policies).length === 0) return;
     reconciled.current = true;
     void reconcileServerRuns(policies);
diff --git a/frontend/editor/src/proprietary/constants/featureFlags.ts b/frontend/editor/src/proprietary/constants/featureFlags.ts
index 599ee4ebce..e432b34599 100644
--- a/frontend/editor/src/proprietary/constants/featureFlags.ts
+++ b/frontend/editor/src/proprietary/constants/featureFlags.ts
@@ -13,11 +13,3 @@
  * Watched Folders implementation to navigate to).
  */
 export const WATCHED_FOLDERS_ENABLED: boolean = false;
-
-/**
- * Policies — automation-backed policy enforcement. A SaaS-only feature: runs
- * execute and bill through the cloud backend, so it's enabled only in the saas
- * build (which overrides this to `true`) and on desktop when connected to SaaS.
- * The self-hosted proprietary build and the core build keep it `false`.
- */
-export const POLICIES_ENABLED: boolean = false;
diff --git a/frontend/editor/src/proprietary/services/policyExport.ts b/frontend/editor/src/proprietary/services/policyExport.ts
index 6294c914ff..78b747182b 100644
--- a/frontend/editor/src/proprietary/services/policyExport.ts
+++ b/frontend/editor/src/proprietary/services/policyExport.ts
@@ -29,7 +29,6 @@ import {
 } from "@app/components/policies/enforcementQueue";
 import { ROW_ACCENT } from "@app/components/policies/policyStatus";
 import { alert, updateToast, dismissToast } from "@app/components/toast";
-import { POLICIES_ENABLED } from "@app/constants/featureFlags";
 import i18n from "@app/i18n";
 
 /** Poll cadence + cap for a single export run (≈2.5 min worst case). */
@@ -60,7 +59,6 @@ interface PolicyRunResult {
 
 /** Configured, active policies set to enforce on export (read from the cache). */
 function activeExportPolicies(): ExportPolicy[] {
-  if (!POLICIES_ENABLED) return [];
   const labels = new Map(
     loadPolicyCatalog().categories.map((c) => [c.id, c.label]),
   );
diff --git a/frontend/editor/src/saas/constants/featureFlags.ts b/frontend/editor/src/saas/constants/featureFlags.ts
deleted file mode 100644
index 4627295798..0000000000
--- a/frontend/editor/src/saas/constants/featureFlags.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-/**
- * SaaS-build feature gates. Shadows `proprietary/constants/featureFlags.ts` in
- * the saas build (via the `@app/*` alias). Re-exports the proprietary flags and
- * overrides only those that differ for the hosted SaaS product.
- */
-export * from "@proprietary/constants/featureFlags";
-
-/** Policies are a SaaS-only feature — enabled here, off in proprietary/core. */
-export const POLICIES_ENABLED: boolean = true;

From 83e531966193cb9fbd820e668596eed8651d0fcb Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:49:06 +0100
Subject: [PATCH 027/109] Reduce CI cost: disable Depot, gate arm64/Tauri PR
 builds, self-testing CI routing (#7028)

## What

CI cost/routing cleanup. Four changes, each reversible with no code
deleted.

### 1. Disable Depot repo-wide (reversible)
Depot ran on trusted (non-fork) triggers via the `is_fork` output of
`_runner-pick.yml`, driving both the `depot-*` runner selection and the
Depot docker build actions. It's now disabled everywhere behind a single
kill-switch:

- `_runner-pick.yml` gains a dedicated `use_depot` output, forced
`false` via `DEPOT_ENABLED=false`. `is_fork` stays truthful for trust
gating (e.g. `build-enterprise` skipping on forks).
- All `runs-on:` and `USE_DEPOT:` expressions now key off `use_depot`,
so every job falls back to `ubuntu-latest` + buildx.
- `settings.gradle` Depot remote build cache (`cache.depot.dev`) gated
behind `depotCacheEnabled = false`.

**Switch back on:** set `DEPOT_ENABLED=true` in `_runner-pick.yml` (and
`depotCacheEnabled = true` in `settings.gradle`). Depot then reactivates
on trusted triggers exactly as before.

### 2. arm64 PR docker build only on Dockerfile changes
`test-build-docker.yml` was building `linux/amd64,linux/arm64/v8` on
every PR matching the broad `project` filter. With Depot off, the arm64
leg runs under slow QEMU emulation on every code PR. New `dockerfiles`
path filter (`docker/**/Dockerfile*`) gates the arm64 leg: normal code
PRs build amd64 only; PRs that touch a Dockerfile still build amd64 +
arm64. arm64 is still fully exercised on the base-image publish and on
release.

### 3. Tauri PR build -> Linux only, unsigned, deb-only
The PR path built the full 3-OS matrix (Windows + macOS-universal +
Linux), plus the flaky Linux AppImage pass (#6127). PRs now build Linux
only (fastest + cheapest to compile) via a new `minimal` input on
`tauri-build.yml`: Linux deb only, no rpm, no AppImage. The full signed
multi-OS matrix still runs on release, and nightly still warms the Rust
cache with all-OS defaults (unchanged).

Tradeoff: Windows/macOS desktop build breaks are caught by nightly
(all-OS) rather than the introducing PR.

### 4. CI self-testing routing
Editing `build.yml` only matched the `project` filter, so a change to
how e2e / enterprise / tauri / engine jobs are dispatched didn't
actually run those jobs. Added a `ci` anchor (`build.yml` +
`.github/config/.files.yaml`) that every job-gating area filter now
includes, so editing the router or the filter config runs every job.
Also added the orphaned reusable workflows (`e2e-*`,
`frontend-validation`, `docker-compose-tests`, `test-build-docker`,
`check-openapi`, `check-licence`) to their area filters so editing a
reusable workflow self-tests.

## Validation
- All workflow YAML + `.files.yaml` parse; anchor resolution verified
(every job-gating filter resolves to include the `ci` paths).
- Gradle evaluates `settings.gradle` cleanly; `spotlessGradleCheck`
passes.
---
 .github/config/.files.yaml                    | 32 +++++++++-
 .github/workflows/PR-Auto-Deploy-V2.yml       |  8 +--
 .../workflows/PR-Demo-Comment-with-react.yml  |  8 +--
 .github/workflows/_runner-pick.yml            | 58 +++++++++++++------
 .github/workflows/backend-build.yml           |  2 +-
 .github/workflows/build-enterprise.yml        |  2 +-
 .github/workflows/build.yml                   |  9 +++
 .github/workflows/check-openapi.yml           |  2 +-
 .github/workflows/coverage-aggregate.yml      |  2 +-
 .github/workflows/db-migration-test.yml       |  2 +-
 .github/workflows/deploy-on-v2-commit.yml     |  4 +-
 .github/workflows/docker-compose-tests.yml    |  2 +-
 .github/workflows/e2e-live.yml                |  2 +-
 .github/workflows/e2e-stubbed.yml             |  2 +-
 .../frontend-backend-licenses-update.yml      |  6 +-
 .github/workflows/frontend-validation.yml     |  2 +-
 .github/workflows/multiOSReleases.yml         |  6 +-
 .github/workflows/nightly.yml                 |  2 +-
 .github/workflows/swagger.yml                 |  2 +-
 .github/workflows/tauri-build.yml             | 29 +++++++---
 .github/workflows/test-build-docker.yml       | 24 ++++++--
 .github/workflows/testdriver.yml              | 10 ++--
 settings.gradle                               | 10 ++--
 23 files changed, 156 insertions(+), 70 deletions(-)

diff --git a/.github/config/.files.yaml b/.github/config/.files.yaml
index 905f2feed9..2894464831 100644
--- a/.github/config/.files.yaml
+++ b/.github/config/.files.yaml
@@ -1,16 +1,34 @@
+# CI routing infra. Editing the top-level router (build.yml) or this filter
+# config re-runs every area's jobs, so every job-gating filter below includes
+# *ci. That makes a change to how jobs are dispatched actually exercise those
+# jobs (self-testing), instead of a router edit only matching the project filter.
+ci: &ci
+  - .github/workflows/build.yml
+  - .github/config/.files.yaml
+
 build: &build
+  - *ci
   - build.gradle
   - app/(common|core|proprietary|saas)/build.gradle
   - Taskfile.yml
   - .taskfiles/backend.yml
+  - .github/workflows/check-licence.yml
 
 openapi: &openapi
+  - *ci
   - *build
   - app/(common|core|proprietary|saas)/src/main/java/**
+  - .github/workflows/check-openapi.yml
 
 docker-base: &docker-base
   - docker/base/Dockerfile
 
+# Dockerfiles only (base + embedded + unoserver). Gates the slow multi-arch
+# (arm64) leg of the PR docker test build: arm64 is only rebuilt when a
+# Dockerfile itself changes, not on every code PR.
+dockerfiles: &dockerfiles
+  - docker/**/Dockerfile*
+
 docker: &docker
   - docker/embedded/Dockerfile
   - docker/embedded/Dockerfile.fat
@@ -23,13 +41,11 @@ docker: &docker
   - *docker-base
 
 project: &project
+  - *ci
   - app/(common|core|proprietary|saas)/src/(main|test)/java/**
   - *build
   - "app/(common|core|proprietary|saas)/src/(main|test)/resources/**/!(messages_*.properties|*.md)*"
   - exampleYmlFiles/**
-  - gradle/**
-  - libs/**
-  - "testing/**/!(requirements*.txt|requirements*.in)*"
   - *docker
   - *docker-base
   - gradle.properties
@@ -45,8 +61,11 @@ project: &project
   - .taskfiles/docker.yml
   - scripts/db-migration/**
   - .github/workflows/db-migration-test.yml
+  - .github/workflows/docker-compose-tests.yml
+  - .github/workflows/test-build-docker.yml
 
 frontend: &frontend
+  - *ci
   - frontend/**
   - .github/workflows/testdriver.yml
   - testing/**
@@ -63,10 +82,14 @@ frontend: &frontend
   - Taskfile.yml
   - .taskfiles/frontend.yml
   - .taskfiles/e2e.yml
+  - .github/workflows/frontend-validation.yml
+  - .github/workflows/e2e-stubbed.yml
+  - .github/workflows/e2e-live.yml
 
 # Files that affect the Tauri desktop bundle. Gate the multi-OS Tauri build
 # job on changes to any of these.
 tauri: &tauri
+  - *ci
   - frontend/editor/src-tauri/**
   - frontend/editor/src/desktop/**
   - frontend/editor/tsconfig.desktop.vite.json
@@ -81,6 +104,7 @@ tauri: &tauri
 # the engine validation job on changes to engine sources or to the Java
 # tool surfaces it generates models from.
 engine: &engine
+  - *ci
   - engine/**
   - app/(common|core|proprietary|saas)/src/main/java/**
   - .github/workflows/ai-engine.yml
@@ -93,6 +117,7 @@ engine: &engine
 # tasks that drive generation. Deliberately excludes the broad frontend/docker/
 # testing globs, so a CSS-only PR does not boot the backend to rebuild the spec.
 generated-models: &generated-models
+  - *ci
   - *openapi
   - frontend/editor/scripts/generate-tool-api-types.mts
   - frontend/editor/src/core/types/toolApiTypes.ts
@@ -115,6 +140,7 @@ licenses-backend: &licenses-backend
 # Files that can affect premium / enterprise behaviour. Gate the enterprise
 # Playwright job on changes to any of these on PRs.
 proprietary: &proprietary
+  - *ci
   - app/proprietary/**
   - frontend/editor/src/proprietary/**
   - frontend/editor/src/core/tests/enterprise/**
diff --git a/.github/workflows/PR-Auto-Deploy-V2.yml b/.github/workflows/PR-Auto-Deploy-V2.yml
index 8f1aab7977..172d72ee5c 100644
--- a/.github/workflows/PR-Auto-Deploy-V2.yml
+++ b/.github/workflows/PR-Auto-Deploy-V2.yml
@@ -29,7 +29,7 @@ jobs:
   check-pr:
     if: (github.event_name == 'pull_request' && github.event.action != 'closed') || github.event_name == 'workflow_dispatch'
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     outputs:
       should_deploy: ${{ steps.decide.outputs.should_deploy }}
       is_fork: ${{ steps.resolve.outputs.is_fork }}
@@ -102,7 +102,7 @@ jobs:
 
   deploy-v2-pr:
     needs: [pick, check-pr]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     if: needs.check-pr.outputs.should_deploy == 'true' && (needs.check-pr.outputs.is_fork == 'false' || needs.check-pr.outputs.allow_fork == 'true')
     # Concurrency control - only one deployment per PR at a time
     concurrency:
@@ -114,7 +114,7 @@ jobs:
       pull-requests: write
       id-token: write
     env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
+      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' }}
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
       # Single source of truth for whether this preview embeds the admin portal:
       # drives the image build-arg and the deployment comment.
@@ -475,7 +475,7 @@ jobs:
   cleanup-v2-deployment:
     if: github.event.action == 'closed'
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/PR-Demo-Comment-with-react.yml b/.github/workflows/PR-Demo-Comment-with-react.yml
index 5a4ea8deef..2a780e5d98 100644
--- a/.github/workflows/PR-Demo-Comment-with-react.yml
+++ b/.github/workflows/PR-Demo-Comment-with-react.yml
@@ -39,7 +39,7 @@ jobs:
 
   check-comment:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     permissions:
       issues: write
     if: |
@@ -180,13 +180,13 @@ jobs:
 
   deploy-pr:
     needs: [pick, check-comment]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     permissions:
       issues: write
       pull-requests: write
       id-token: write
     env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
+      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' }}
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
 
     steps:
@@ -511,7 +511,7 @@ jobs:
   handle-label-commands:
     if: ${{ github.event.issue.pull_request != null }}
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/_runner-pick.yml b/.github/workflows/_runner-pick.yml
index 023325d383..09959f3353 100644
--- a/.github/workflows/_runner-pick.yml
+++ b/.github/workflows/_runner-pick.yml
@@ -5,6 +5,11 @@ name: _runner-pick
 # can pick a runner class without each one duplicating the 200-char gate
 # expression in their own `runs-on:`.
 #
+# It also owns the single Depot kill-switch (use_depot). Depot is currently
+# disabled repo-wide; downstream jobs gate their Depot runner/build usage on
+# use_depot so nothing has to be deleted to turn Depot off. Flip DEPOT_ENABLED
+# in the decide step to switch Depot back on.
+#
 # Caller pattern:
 #
 #   jobs:
@@ -13,12 +18,15 @@ name: _runner-pick
 #
 #     real-work:
 #       needs: pick
-#       runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
+#       runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-8' || 'ubuntu-latest' }}
 #       steps: [...]
 #
-# Output:
-#   is_fork: "true" when the trigger is a pull_request from a fork or an
-#            untrusted author_association, "false" otherwise.
+# Outputs:
+#   is_fork:   "true" when the trigger is a pull_request from a fork or an
+#              untrusted author_association, "false" otherwise. Use this for
+#              trust gating (skipping secret-dependent jobs on forks).
+#   use_depot: "true" when downstream jobs should use Depot runners/builders.
+#              Currently forced "false" (Depot disabled repo-wide).
 
 on:
   workflow_call:
@@ -26,6 +34,9 @@ on:
       is_fork:
         description: '"true" if the trigger is an untrusted fork PR.'
         value: ${{ jobs.pick.outputs.is_fork }}
+      use_depot:
+        description: '"true" when downstream jobs should use Depot. Currently forced off.'
+        value: ${{ jobs.pick.outputs.use_depot }}
 
 permissions:
   contents: read
@@ -36,6 +47,7 @@ jobs:
     timeout-minutes: 1
     outputs:
       is_fork: ${{ steps.decide.outputs.is_fork }}
+      use_depot: ${{ steps.decide.outputs.use_depot }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -50,21 +62,33 @@ jobs:
           AUTHOR_ASSOC: ${{ github.event.pull_request.author_association }}
         run: |
           set -eu
+
+          # Depot kill-switch. Depot is disabled repo-wide: no job uses Depot
+          # runners or the Depot build actions while this is false. All the
+          # Depot wiring is left in place - set DEPOT_ENABLED=true to switch it
+          # back on (it then activates on trusted, non-fork triggers as before).
+          DEPOT_ENABLED=false
+
           if [ -z "${PR_NUMBER:-}" ]; then
             # Not a pull_request event at all (push, schedule, workflow_dispatch,
             # workflow_call from a non-PR trigger) -> trusted by default.
-            echo "is_fork=false" >> "$GITHUB_OUTPUT"
-            exit 0
+            is_fork=false
+          elif [ "${HEAD_REPO_FORK}" = "true" ]; then
+            is_fork=true
+          else
+            case "${AUTHOR_ASSOC}" in
+              OWNER|MEMBER|COLLABORATOR) is_fork=false ;;
+              *) is_fork=true ;;
+            esac
           fi
-          if [ "${HEAD_REPO_FORK}" = "true" ]; then
-            echo "is_fork=true" >> "$GITHUB_OUTPUT"
-            exit 0
+
+          # Depot only ever ran on trusted triggers, so gate it on both the
+          # kill-switch and is_fork.
+          if [ "${DEPOT_ENABLED}" = "true" ] && [ "${is_fork}" = "false" ]; then
+            use_depot=true
+          else
+            use_depot=false
           fi
-          case "${AUTHOR_ASSOC}" in
-            OWNER|MEMBER|COLLABORATOR)
-              echo "is_fork=false" >> "$GITHUB_OUTPUT"
-              ;;
-            *)
-              echo "is_fork=true" >> "$GITHUB_OUTPUT"
-              ;;
-          esac
+
+          echo "is_fork=${is_fork}" >> "$GITHUB_OUTPUT"
+          echo "use_depot=${use_depot}" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml
index ef0dd20aba..e8e68968f2 100644
--- a/.github/workflows/backend-build.yml
+++ b/.github/workflows/backend-build.yml
@@ -24,7 +24,7 @@ jobs:
 
   build:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-8' || 'ubuntu-latest' }}
     env:
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     strategy:
diff --git a/.github/workflows/build-enterprise.yml b/.github/workflows/build-enterprise.yml
index 9e1a4efb83..5aab6529b4 100644
--- a/.github/workflows/build-enterprise.yml
+++ b/.github/workflows/build-enterprise.yml
@@ -54,7 +54,7 @@ jobs:
     # (nor DEPOT_TOKEN), so the suite can't boot premium and would fail. See the
     # header comment. GitHub reports the skipped reusable workflow as success.
     if: needs.pick.outputs.is_fork != 'true'
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') || 'ubuntu-latest' }}
     timeout-minutes: 45
     env:
       PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8142c37fca..5689afe532 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -41,6 +41,7 @@ jobs:
       openapi: ${{ steps.changes.outputs.openapi }}
       frontend: ${{ steps.changes.outputs.frontend }}
       docker-base: ${{ steps.changes.outputs.docker-base }}
+      dockerfiles: ${{ steps.changes.outputs.dockerfiles }}
       tauri: ${{ steps.changes.outputs.tauri }}
       engine: ${{ steps.changes.outputs.engine }}
       generated-models: ${{ steps.changes.outputs.generated-models }}
@@ -153,6 +154,7 @@ jobs:
     secrets: inherit
     with:
       docker-base-changed: ${{ needs.files-changed.outputs.docker-base }}
+      dockerfiles-changed: ${{ needs.files-changed.outputs.dockerfiles }}
 
   tauri-build:
     if: needs.files-changed.outputs.tauri == 'true'
@@ -162,6 +164,13 @@ jobs:
       pull-requests: write
     uses: ./.github/workflows/tauri-build.yml
     secrets: inherit
+    # PR smoke build: Linux only (fastest + cheapest to compile), unsigned,
+    # deb-only, no AppImage. The full signed multi-OS matrix runs on release;
+    # nightly still warms the Rust cache with all-OS defaults.
+    with:
+      platform: linux
+      sign: false
+      minimal: true
 
   ai-engine:
     if: needs.files-changed.outputs.engine == 'true'
diff --git a/.github/workflows/check-openapi.yml b/.github/workflows/check-openapi.yml
index a27ea4ec02..bf51140181 100644
--- a/.github/workflows/check-openapi.yml
+++ b/.github/workflows/check-openapi.yml
@@ -15,7 +15,7 @@ jobs:
 
   check-generate-openapi-docs:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     env:
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
diff --git a/.github/workflows/coverage-aggregate.yml b/.github/workflows/coverage-aggregate.yml
index 18772fe819..277350da93 100644
--- a/.github/workflows/coverage-aggregate.yml
+++ b/.github/workflows/coverage-aggregate.yml
@@ -34,7 +34,7 @@ jobs:
 
   aggregate:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     timeout-minutes: 15
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/db-migration-test.yml b/.github/workflows/db-migration-test.yml
index 9e8eeb8c8c..f6c93db3d0 100644
--- a/.github/workflows/db-migration-test.yml
+++ b/.github/workflows/db-migration-test.yml
@@ -17,7 +17,7 @@ jobs:
 
   migration-test:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-8' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-8' || 'ubuntu-latest' }}
     timeout-minutes: 30
     env:
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
diff --git a/.github/workflows/deploy-on-v2-commit.yml b/.github/workflows/deploy-on-v2-commit.yml
index 0a4f502166..a932581840 100644
--- a/.github/workflows/deploy-on-v2-commit.yml
+++ b/.github/workflows/deploy-on-v2-commit.yml
@@ -15,7 +15,7 @@ jobs:
 
   deploy-v2-on-push:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     concurrency:
       group: deploy-v2-push-V2
       cancel-in-progress: true
@@ -23,7 +23,7 @@ jobs:
       contents: read
       id-token: write
     env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
+      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' }}
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
 
     steps:
diff --git a/.github/workflows/docker-compose-tests.yml b/.github/workflows/docker-compose-tests.yml
index 945f4883cb..1a1c53bc25 100644
--- a/.github/workflows/docker-compose-tests.yml
+++ b/.github/workflows/docker-compose-tests.yml
@@ -26,7 +26,7 @@ jobs:
 
   docker-compose-tests:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '4') }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '4') || 'ubuntu-latest' }}
     permissions:
       actions: write
       contents: read
diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index 57a4357dad..f2904220b9 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -21,7 +21,7 @@ jobs:
 
   playwright-e2e-live:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') || 'ubuntu-latest' }}
     timeout-minutes: 30
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/e2e-stubbed.yml b/.github/workflows/e2e-stubbed.yml
index ccfdf0052f..b16e538114 100644
--- a/.github/workflows/e2e-stubbed.yml
+++ b/.github/workflows/e2e-stubbed.yml
@@ -21,7 +21,7 @@ jobs:
 
   playwright-e2e:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') || 'ubuntu-latest' }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/frontend-backend-licenses-update.yml b/.github/workflows/frontend-backend-licenses-update.yml
index cc9aa023e3..2bc36fb0c9 100644
--- a/.github/workflows/frontend-backend-licenses-update.yml
+++ b/.github/workflows/frontend-backend-licenses-update.yml
@@ -25,7 +25,7 @@ jobs:
   files-changed:
     name: detect what files changed
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     timeout-minutes: 3
     outputs:
       licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
@@ -49,7 +49,7 @@ jobs:
     if: needs.files-changed.outputs.licenses-frontend == 'true'
     name: Generate Frontend License Report
     needs: [pick, files-changed]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     permissions:
       contents: write
       pull-requests: write
@@ -320,7 +320,7 @@ jobs:
     if: needs.files-changed.outputs.licenses-backend == 'true'
     needs: [pick, files-changed]
     name: Generate Backend License Report
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/frontend-validation.yml b/.github/workflows/frontend-validation.yml
index 70187df412..ad689149db 100644
--- a/.github/workflows/frontend-validation.yml
+++ b/.github/workflows/frontend-validation.yml
@@ -16,7 +16,7 @@ jobs:
 
   frontend-validation:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml
index 7df9a49b46..88e38c5c97 100644
--- a/.github/workflows/multiOSReleases.yml
+++ b/.github/workflows/multiOSReleases.yml
@@ -42,7 +42,7 @@ jobs:
   determine-matrix:
     if: ${{ vars.CI_PROFILE != 'lite' }}
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
@@ -113,7 +113,7 @@ jobs:
 
   build-jars:
     needs: [pick, determine-matrix]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     env:
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     strategy:
@@ -639,7 +639,7 @@ jobs:
 
   collect-and-release:
     needs: [pick, determine-matrix, build, build-jars]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 1801876bcd..eca963c060 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -19,7 +19,7 @@ jobs:
   playwright-all-browsers:
     name: Playwright (chromium + firefox + webkit)
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/swagger.yml b/.github/workflows/swagger.yml
index 9696aa419c..d6d9640f06 100644
--- a/.github/workflows/swagger.yml
+++ b/.github/workflows/swagger.yml
@@ -28,7 +28,7 @@ jobs:
   push:
     if: ${{ vars.CI_PROFILE != 'lite' }}
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     env:
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml
index 0a017d6273..ca00af04bc 100644
--- a/.github/workflows/tauri-build.yml
+++ b/.github/workflows/tauri-build.yml
@@ -21,6 +21,11 @@ on:
         required: false
         type: boolean
         default: true
+      minimal:
+        description: "Fast smoke build: Linux deb only, skip rpm and the flaky AppImage pass. Used by PR builds."
+        required: false
+        type: boolean
+        default: false
   workflow_dispatch:
     inputs:
       platform:
@@ -38,6 +43,11 @@ on:
         required: false
         default: true
         type: boolean
+      minimal:
+        description: "Fast smoke build: Linux deb only, skip rpm and the flaky AppImage pass."
+        required: false
+        default: false
+        type: boolean
 
 permissions:
   contents: read
@@ -386,10 +396,10 @@ jobs:
         with:
           projectPath: ./frontend/editor
           tauriScript: npx tauri
-          # Linux: build deb+rpm only here. AppImage runs in its own
-          # continue-on-error step below so its persistent linuxdeploy
-          # failure (#6127 onwards) does not tank deb/rpm uploads.
-          args: ${{ matrix.platform == 'ubuntu-22.04' && '--bundles deb,rpm' || matrix.args }}
+          # Linux: build deb+rpm only here (deb-only on minimal smoke builds).
+          # AppImage runs in its own continue-on-error step below so its
+          # persistent linuxdeploy failure (#6127 onwards) does not tank uploads.
+          args: ${{ matrix.platform == 'ubuntu-22.04' && (inputs.minimal && '--bundles deb' || '--bundles deb,rpm') || matrix.args }}
 
       - name: Build Tauri app (unsigned)
         if: ${{ !inputs.sign }}
@@ -406,15 +416,16 @@ jobs:
         with:
           projectPath: ./frontend/editor
           tauriScript: npx tauri
-          # Linux: build deb+rpm only here. AppImage runs in its own
-          # continue-on-error step below so its persistent linuxdeploy
-          # failure (#6127 onwards) does not tank deb/rpm uploads.
-          args: ${{ matrix.platform == 'ubuntu-22.04' && '--bundles deb,rpm' || matrix.args }}
+          # Linux: build deb+rpm only here (deb-only on minimal smoke builds).
+          # AppImage runs in its own continue-on-error step below so its
+          # persistent linuxdeploy failure (#6127 onwards) does not tank uploads.
+          args: ${{ matrix.platform == 'ubuntu-22.04' && (inputs.minimal && '--bundles deb' || '--bundles deb,rpm') || matrix.args }}
 
       # AppImage is decoupled so its linuxdeploy run gets a fresh process
       # (rpm scratch state torn down) and its failure can't tank deb/rpm.
+      # Skipped on minimal smoke builds (flaky + slow, deb is enough to verify).
       - name: Build Tauri app (Linux AppImage)
-        if: matrix.platform == 'ubuntu-22.04'
+        if: matrix.platform == 'ubuntu-22.04' && !inputs.minimal
         continue-on-error: true
         uses: tauri-apps/tauri-action@84b9d35b5fc46c1e45415bdb6144030364f7ebc5 # v0.6.2
         env:
diff --git a/.github/workflows/test-build-docker.yml b/.github/workflows/test-build-docker.yml
index c91ea0435a..ff7ac0637b 100644
--- a/.github/workflows/test-build-docker.yml
+++ b/.github/workflows/test-build-docker.yml
@@ -12,6 +12,11 @@ on:
         required: false
         type: string
         default: "false"
+      dockerfiles-changed:
+        description: "Whether any Dockerfile changed (forwarded from files-changed). Gates the slow arm64 build leg."
+        required: false
+        type: string
+        default: "false"
       depot_cores:
         description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
         required: false
@@ -41,12 +46,12 @@ jobs:
   # `task backend:build:ci` produce equivalent JARs (verify before wiring).
   test-build-docker-images:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') || 'ubuntu-latest' }}
     permissions:
       contents: read
       id-token: write
     env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
+      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' && inputs.docker-base-changed != 'true' }}
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     strategy:
       fail-fast: false
@@ -146,13 +151,22 @@ jobs:
         # GITHUB_EVENT_NAME is already provided by the runner.
         env:
           DOCKER_BASE_CHANGED: ${{ inputs.docker-base-changed }}
+          DOCKERFILES_CHANGED: ${{ inputs.dockerfiles-changed }}
         run: |
           if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && [ "$DOCKER_BASE_CHANGED" = "true" ]; then
+            # Base Dockerfile changed: build against the locally-built base,
+            # which only exists for amd64.
             echo "base_image=stirling-pdf-base:pr-test" >> "$GITHUB_OUTPUT"
             echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT"
-          else
+          elif [ "$DOCKERFILES_CHANGED" = "true" ]; then
+            # A Dockerfile changed: also verify the arm64 build (slow QEMU leg).
             echo "base_image=stirlingtools/stirling-pdf-base:latest" >> "$GITHUB_OUTPUT"
             echo "platforms=linux/amd64,linux/arm64/v8" >> "$GITHUB_OUTPUT"
+          else
+            # No Dockerfile change: amd64 only. arm64 is exercised on the base
+            # image publish and on release, not on every code PR.
+            echo "base_image=stirlingtools/stirling-pdf-base:latest" >> "$GITHUB_OUTPUT"
+            echo "platforms=linux/amd64" >> "$GITHUB_OUTPUT"
           fi
 
       # Base-changed PRs build the embedded image with the local docker driver
@@ -214,12 +228,12 @@ jobs:
 
   test-build-unoserver-image:
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') || 'ubuntu-latest' }}
     permissions:
       contents: read
       id-token: write
     env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' && inputs.docker-base-changed != 'true' }}
+      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' && inputs.docker-base-changed != 'true' }}
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/testdriver.yml b/.github/workflows/testdriver.yml
index ec9b658326..7e87fc6d92 100644
--- a/.github/workflows/testdriver.yml
+++ b/.github/workflows/testdriver.yml
@@ -26,12 +26,12 @@ jobs:
   deploy:
     if: ${{ vars.CI_PROFILE != 'lite' }}
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     permissions:
       contents: read
       id-token: write
     env:
-      USE_DEPOT: ${{ needs.pick.outputs.is_fork != 'true' }}
+      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' }}
       DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - name: Harden Runner
@@ -154,7 +154,7 @@ jobs:
     if: always()
     name: detect what files changed
     needs: pick
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     timeout-minutes: 3
     outputs:
       frontend: ${{ steps.changes.outputs.frontend }}
@@ -175,7 +175,7 @@ jobs:
   test:
     if: needs.files-changed.outputs.frontend == 'true'
     needs: [pick, deploy, files-changed]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -209,7 +209,7 @@ jobs:
 
   cleanup:
     needs: [pick, deploy, test]
-    runs-on: ${{ needs.pick.outputs.is_fork == 'true' && 'ubuntu-latest' || 'depot-ubuntu-24.04-4' }}
+    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
     if: always()
 
     steps:
diff --git a/settings.gradle b/settings.gradle
index c712f672a1..aa90b41375 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -23,15 +23,17 @@ plugins {
     id 'org.gradle.toolchains.foojay-resolver-convention' version '1.0.0'
 }
 
-// Depot remote build cache. Silently no-ops when DEPOT_TOKEN is absent
-// (local dev without depot login, and fork PRs where GitHub hides secrets),
-// so contributors without Depot access still build fine on local cache only.
+// Depot remote build cache. Disabled repo-wide via depotCacheEnabled below;
+// flip it back to true to re-enable. Even when enabled it silently no-ops
+// without DEPOT_TOKEN (local dev without depot login, and fork PRs where
+// GitHub hides secrets), so contributors build fine on local cache only.
 buildCache {
+    def depotCacheEnabled = false
     def depotToken = System.getenv('DEPOT_TOKEN')
     local {
         enabled = true
     }
-    if (depotToken) {
+    if (depotCacheEnabled && depotToken) {
         remote(HttpBuildCache) {
             url = 'https://cache.depot.dev'
             enabled = true

From 5cb5a866ca5e63576249adb80e7793e6597877fc Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:49:13 +0100
Subject: [PATCH 028/109] Portal: remove unused Components section (#7005)

# Description of Changes

Deletes the unused Components catalogue section (view, cards, SDK mocks)
along with its sidebar entry and route.

Part of a portal (processor) UI-consistency pass, split into small
focused PRs.

## Before / after

<!-- paste before / after screenshots here -->

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [x] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../public/locales/ar-AR/translation.toml     |  69 ---
 .../public/locales/az-AZ/translation.toml     |  69 ---
 .../public/locales/bg-BG/translation.toml     |  69 ---
 .../public/locales/ca-CA/translation.toml     |  69 ---
 .../public/locales/cs-CZ/translation.toml     |  69 ---
 .../public/locales/da-DK/translation.toml     |  69 ---
 .../public/locales/de-DE/translation.toml     |  69 ---
 .../public/locales/el-GR/translation.toml     |  69 ---
 .../public/locales/en-GB/translation.toml     |  69 ---
 .../public/locales/en-US/translation.toml     |  69 ---
 .../public/locales/es-ES/translation.toml     |  69 ---
 .../public/locales/eu-ES/translation.toml     |  69 ---
 .../public/locales/fa-IR/translation.toml     |  69 ---
 .../public/locales/fr-FR/translation.toml     |  69 ---
 .../public/locales/ga-IE/translation.toml     |  69 ---
 .../public/locales/hi-IN/translation.toml     |  69 ---
 .../public/locales/hr-HR/translation.toml     |  69 ---
 .../public/locales/hu-HU/translation.toml     |  69 ---
 .../public/locales/id-ID/translation.toml     |  69 ---
 .../public/locales/it-IT/translation.toml     |  69 ---
 .../public/locales/ja-JP/translation.toml     |  69 ---
 .../public/locales/ko-KR/translation.toml     |  69 ---
 .../public/locales/ml-ML/translation.toml     |  69 ---
 .../public/locales/nl-NL/translation.toml     |  69 ---
 .../public/locales/no-NB/translation.toml     |  69 ---
 .../public/locales/pl-PL/translation.toml     |  69 ---
 .../public/locales/pt-BR/translation.toml     |  69 ---
 .../public/locales/pt-PT/translation.toml     |  69 ---
 .../public/locales/ro-RO/translation.toml     |  69 ---
 .../public/locales/ru-RU/translation.toml     |  69 ---
 .../public/locales/sk-SK/translation.toml     |  69 ---
 .../public/locales/sl-SI/translation.toml     |  69 ---
 .../locales/sr-LATN-RS/translation.toml       |  69 ---
 .../public/locales/sv-SE/translation.toml     |  69 ---
 .../public/locales/th-TH/translation.toml     |  69 ---
 .../public/locales/tr-TR/translation.toml     |  69 ---
 .../public/locales/uk-UA/translation.toml     |  69 ---
 .../public/locales/vi-VN/translation.toml     |  69 ---
 .../public/locales/zh-BO/translation.toml     |  69 ---
 .../public/locales/zh-CN/translation.toml     |  69 ---
 .../public/locales/zh-TW/translation.toml     |  69 ---
 .../portal-saas/components/sidebarGroups.tsx  |  15 +-
 frontend/editor/src/portal/ViewRouter.tsx     |   2 -
 .../editor/src/portal/api/sdkComponents.ts    | 138 ------
 .../catalogue/ComponentCard.stories.tsx       |  27 --
 .../components/catalogue/ComponentCard.tsx    |  79 ----
 .../ComponentDetailModal.stories.tsx          |  27 --
 .../catalogue/ComponentDetailModal.tsx        | 233 ----------
 .../catalogue/ComponentGrid.stories.tsx       |  24 -
 .../components/catalogue/ComponentGrid.tsx    |  30 --
 .../catalogue/ComponentPropsTable.stories.tsx |  16 -
 .../catalogue/ComponentPropsTable.tsx         |  62 ---
 .../catalogue/ComponentsSummaryStrip.tsx      |  42 --
 .../editor/src/portal/components/icons.tsx    |  11 -
 .../src/portal/components/sidebarGroups.tsx   |   2 -
 .../src/portal/contexts/ViewContext.tsx       |   3 -
 .../editor/src/portal/mocks/handlers/index.ts |   2 -
 .../portal/mocks/handlers/sdkComponents.ts    |  12 -
 .../editor/src/portal/mocks/sdkComponents.ts  | 413 ------------------
 .../editor/src/portal/views/Components.css    | 244 -----------
 .../editor/src/portal/views/Components.tsx    |  90 ----
 61 files changed, 4 insertions(+), 4297 deletions(-)
 delete mode 100644 frontend/editor/src/portal/api/sdkComponents.ts
 delete mode 100644 frontend/editor/src/portal/components/catalogue/ComponentCard.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/catalogue/ComponentCard.tsx
 delete mode 100644 frontend/editor/src/portal/components/catalogue/ComponentDetailModal.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx
 delete mode 100644 frontend/editor/src/portal/components/catalogue/ComponentGrid.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/catalogue/ComponentGrid.tsx
 delete mode 100644 frontend/editor/src/portal/components/catalogue/ComponentPropsTable.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/catalogue/ComponentPropsTable.tsx
 delete mode 100644 frontend/editor/src/portal/components/catalogue/ComponentsSummaryStrip.tsx
 delete mode 100644 frontend/editor/src/portal/mocks/handlers/sdkComponents.ts
 delete mode 100644 frontend/editor/src/portal/mocks/sdkComponents.ts
 delete mode 100644 frontend/editor/src/portal/views/Components.css
 delete mode 100644 frontend/editor/src/portal/views/Components.tsx

diff --git a/frontend/editor/public/locales/ar-AR/translation.toml b/frontend/editor/public/locales/ar-AR/translation.toml
index 287cd284d5..8705955223 100644
--- a/frontend/editor/public/locales/ar-AR/translation.toml
+++ b/frontend/editor/public/locales/ar-AR/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "عالِج {{allowance}} ملفات PDF مجانًا"
 titleWithRate_one = "عالِج {{allowance}} ملف PDF مجانًا، ثم {{rate}}/PDF"
 titleWithRate_other = "عالِج {{allowance}} ملفات PDF مجانًا، ثم {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "مقفل"
-openAriaLabel = "فتح مكون {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "إضافة إلى المشروع"
-ariaLabel = "تفاصيل المكون"
-tabsAriaLabel = "أقسام تفاصيل المكون"
-upgradeToUnlock = "الترقية لإلغاء القفل"
-
-[portal.catalogue.detail.code]
-install = "تثبيت"
-usage = "الاستخدام"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} مضمن بدءًا من خطة {{tier}}. قم بالترقية لتضمينه."
-title = "غير متاح في خطتك"
-
-[portal.catalogue.detail.preview]
-badge = "معاينة مباشرة"
-note = "يتم عرض صندوق الرمل التفاعلي هنا"
-
-[portal.catalogue.detail.pricing]
-note = "مقاس لكل {{unit}}. تتم فوترة الاستخدام بعد الحصة الشهرية المجانية على حسابك ويُفصّل ضمن الاستخدام والفوترة."
-
-[portal.catalogue.detail.stats]
-billedOn = "تتم الفوترة على"
-embeds30d = "التضمينات (30 يومًا)"
-freeQuota = "الحصة المجانية"
-freeQuotaValue = "{{amount}} / شهر"
-maturity = "النضج"
-none = "لا شيء"
-perAction = "لكل إجراء"
-price = "السعر"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "نظرة عامة"
-pricing = "التسعير"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "اختياري"
-required = "مطلوب"
-
-[portal.catalogue.props.columns]
-description = "الوصف"
-name = "Prop"
-required = "مطلوب"
-type = "النوع"
-
-[portal.catalogue.summary]
-componentsGa = "مكونات GA"
-componentSpendMtd = "إنفاق المكونات (MTD)"
-embedsThisMonth = "التضمينات هذا الشهر"
-inBeta = "في Beta"
-
 [portal.components.billingUnit]
 approval = "موافقة"
 check = "فحص"
@@ -6591,18 +6534,6 @@ signature = "توقيع"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "ودجات SDK قابلة للتضمين تضعها في تطبيقك — عارض، وتدفق توقيع إلكتروني، ولوحة مراجعة AI. كل منها مقاس لكل إجراء. انقر على بطاقة للتثبيت والاستخدام وprops."
-title = "المكونات"
-
-[portal.componentsView.empty]
-description = "تعذر تحميل كتالوج المكونات. حاول مرة أخرى قريبًا."
-title = "لا توجد مكونات متاحة"
-
-[portal.componentsView.lockedBanner]
-description = "مكونات GA متاحة على Pay-as-you-go؛ وبعض مكونات Beta مخصصة للمؤسسات فقط. تعرض البطاقات المقفلة تلميحًا للترقية."
-title = "تحتاج بعض المكونات إلى خطة مدفوعة"
-
 [portal.docs.authentication]
 codeCaption = "كل طلب"
 eyebrow = "البدء"
diff --git a/frontend/editor/public/locales/az-AZ/translation.toml b/frontend/editor/public/locales/az-AZ/translation.toml
index f27f1ff0d1..0add38451a 100644
--- a/frontend/editor/public/locales/az-AZ/translation.toml
+++ b/frontend/editor/public/locales/az-AZ/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "{{allowance}} PDF-i pulsuz emal edin"
 titleWithRate_one = "{{allowance}} PDF-i pulsuz emal edin, sonra {{rate}}/PDF"
 titleWithRate_other = "{{allowance}} PDF-i pulsuz emal edin, sonra {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Kilidli"
-openAriaLabel = "{{name}} komponentini aç"
-
-[portal.catalogue.detail]
-addToProject = "Layihəyə əlavə et"
-ariaLabel = "Komponent təfərrüatı"
-tabsAriaLabel = "Komponent təfərrüatı bölmələri"
-upgradeToUnlock = "Kilidi açmaq üçün yüksəldin"
-
-[portal.catalogue.detail.code]
-install = "Quraşdır"
-usage = "İstifadə"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} {{tier}} planından başlayaraq daxildir. Onu daxil etmək üçün yüksəldin."
-title = "Planınızda mövcud deyil"
-
-[portal.catalogue.detail.preview]
-badge = "Canlı önizləmə"
-note = "İnteraktiv sandbox burada render olunur"
-
-[portal.catalogue.detail.pricing]
-note = "{{unit}} başına ölçülür. Aylıq pulsuz kvotadan artıq istifadə hesabınıza yazılır və Usage & Billing altında maddələnir."
-
-[portal.catalogue.detail.stats]
-billedOn = "Hesablanma üzrə"
-embeds30d = "Daxiletmələr (30g)"
-freeQuota = "Pulsuz kvota"
-freeQuotaValue = "{{amount}} / ay"
-maturity = "Yetkinlik"
-none = "Yoxdur"
-perAction = "Hər hərəkət üçün"
-price = "Qiymət"
-
-[portal.catalogue.detail.tabs]
-code = "Kod"
-overview = "İcmal"
-pricing = "Qiymətləndirmə"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "istəyə bağlı"
-required = "tələb olunur"
-
-[portal.catalogue.props.columns]
-description = "Təsvir"
-name = "Prop"
-required = "Tələb olunur"
-type = "Tip"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "Komponent xərci (MTD)"
-embedsThisMonth = "Bu ay daxiletmələr"
-inBeta = "Beta-da"
-
 [portal.components.billingUnit]
 approval = "təsdiq"
 check = "yoxlama"
@@ -6591,18 +6534,6 @@ signature = "imza"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Öz tətbiqinizə yerləşdirə biləcəyiniz daxil edilə bilən SDK vidcetləri — görüntüləyici, e-imza axını, AI baxış paneli. Hər biri hərəkət üzrə ölçülür. Quraşdırma, istifadə və props üçün karta klikləyin."
-title = "Komponentlər"
-
-[portal.componentsView.empty]
-description = "Komponent kataloqu yüklənə bilmədi. Bir az sonra yenidən cəhd edin."
-title = "Mövcud komponent yoxdur"
-
-[portal.componentsView.lockedBanner]
-description = "GA komponentləri Pay-as-you-go planında mövcuddur; bəzi Beta komponentləri yalnız enterprise üçündür. Kilidli kartlar yüksəltmə təklifi göstərir."
-title = "Bəzi komponentlər üçün ödənişli plan lazımdır"
-
 [portal.docs.authentication]
 codeCaption = "hər sorğu"
 eyebrow = "BAŞLANĞIC"
diff --git a/frontend/editor/public/locales/bg-BG/translation.toml b/frontend/editor/public/locales/bg-BG/translation.toml
index b967c4b7c8..ea0e46cd1d 100644
--- a/frontend/editor/public/locales/bg-BG/translation.toml
+++ b/frontend/editor/public/locales/bg-BG/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Обработете {{allowance}} PDF безплатно"
 titleWithRate_one = "Обработете {{allowance}} PDF безплатно, после {{rate}}/PDF"
 titleWithRate_other = "Обработете {{allowance}} PDF безплатно, после {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Заключено"
-openAriaLabel = "Отвори компонент {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Добави към проект"
-ariaLabel = "Детайли за компонента"
-tabsAriaLabel = "Секции с детайли за компонента"
-upgradeToUnlock = "Надстройте, за да отключите"
-
-[portal.catalogue.detail.code]
-install = "Инсталиране"
-usage = "Употреба"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} е включен от план {{tier}}. Надстройте, за да го вградите."
-title = "Не е налично във вашия план"
-
-[portal.catalogue.detail.preview]
-badge = "Live preview"
-note = "Интерактивният sandbox се рендира тук"
-
-[portal.catalogue.detail.pricing]
-note = "Измерва се на {{unit}}. Използването над месечната безплатна квота се таксува към вашия акаунт и се детайлизира в Usage & Billing."
-
-[portal.catalogue.detail.stats]
-billedOn = "Таксува се по"
-embeds30d = "Вграждания (30 дни)"
-freeQuota = "Безплатна квота"
-freeQuotaValue = "{{amount}} / мес"
-maturity = "Зрялост"
-none = "Няма"
-perAction = "На действие"
-price = "Цена"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Общ преглед"
-pricing = "Ценообразуване"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "по избор"
-required = "задължително"
-
-[portal.catalogue.props.columns]
-description = "Описание"
-name = "Prop"
-required = "Задължително"
-type = "Тип"
-
-[portal.catalogue.summary]
-componentsGa = "Компоненти GA"
-componentSpendMtd = "Разход за компоненти (MTD)"
-embedsThisMonth = "Вграждания този месец"
-inBeta = "В beta"
-
 [portal.components.billingUnit]
 approval = "одобрение"
 check = "проверка"
@@ -6591,18 +6534,6 @@ signature = "подпис"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Вградими SDK widgets, които поставяте в собственото си приложение — viewer, e-sign поток, AI панел за преглед. Всеки се измерва на действие. Щракнете върху карта за инсталиране, употреба и props."
-title = "Компоненти"
-
-[portal.componentsView.empty]
-description = "Каталогът с компоненти не можа да бъде зареден. Опитайте отново след малко."
-title = "Няма налични компоненти"
-
-[portal.componentsView.lockedBanner]
-description = "GA компонентите са налични при Pay-as-you-go; няколко Beta компонента са само за enterprise. Заключените карти показват подкана за надстройване."
-title = "Някои компоненти изискват платен план"
-
 [portal.docs.authentication]
 codeCaption = "всяка заявка"
 eyebrow = "GETTING STARTED"
diff --git a/frontend/editor/public/locales/ca-CA/translation.toml b/frontend/editor/public/locales/ca-CA/translation.toml
index 7f748e20b2..6efadcd4ec 100644
--- a/frontend/editor/public/locales/ca-CA/translation.toml
+++ b/frontend/editor/public/locales/ca-CA/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Processa {{allowance}} PDF de franc"
 titleWithRate_one = "Processa {{allowance}} PDF de franc, després {{rate}}/PDF"
 titleWithRate_other = "Processa {{allowance}} PDF de franc, després {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Bloquejat"
-openAriaLabel = "Obre el component {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Afegeix al projecte"
-ariaLabel = "Detall del component"
-tabsAriaLabel = "Seccions de detall del component"
-upgradeToUnlock = "Actualitza per desbloquejar"
-
-[portal.catalogue.detail.code]
-install = "Instal·la"
-usage = "Ús"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} s'inclou a partir del pla {{tier}}. Actualitza per incrustar-lo."
-title = "No disponible al teu pla"
-
-[portal.catalogue.detail.preview]
-badge = "Previsualització en directe"
-note = "El sandbox interactiu es renderitza aquí"
-
-[portal.catalogue.detail.pricing]
-note = "Mesurat per {{unit}}. L'ús més enllà de la quota gratuïta mensual es factura al teu compte i es detalla a Ús i facturació."
-
-[portal.catalogue.detail.stats]
-billedOn = "Facturat per"
-embeds30d = "Incrustacions (30 d)"
-freeQuota = "Quota gratuïta"
-freeQuotaValue = "{{amount}} / mes"
-maturity = "Maduresa"
-none = "Cap"
-perAction = "Per acció"
-price = "Preu"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Resum"
-pricing = "Preus"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "opcional"
-required = "obligatori"
-
-[portal.catalogue.props.columns]
-description = "Descripció"
-name = "Prop"
-required = "Obligatori"
-type = "Tipus"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "Despesa en components (MTD)"
-embedsThisMonth = "Incrustacions aquest mes"
-inBeta = "En beta"
-
 [portal.components.billingUnit]
 approval = "aprovació"
 check = "comprovació"
@@ -6591,18 +6534,6 @@ signature = "signatura"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Widgets SDK incrustables que deixes anar a la teva pròpia aplicació: un visor, un flux de signatura electrònica, un panell de revisió d'AI. Cadascun es mesura per acció. Fes clic en una targeta per veure instal·lació, ús i props."
-title = "Components"
-
-[portal.componentsView.empty]
-description = "No s'ha pogut carregar el catàleg de components. Torna-ho a provar d'aquí a poc."
-title = "No hi ha components disponibles"
-
-[portal.componentsView.lockedBanner]
-description = "Els components GA estan disponibles amb pagament per ús; alguns components Beta són només per a empreses. Les targetes bloquejades mostren una invitació a actualitzar."
-title = "Alguns components necessiten un pla de pagament"
-
 [portal.docs.authentication]
 codeCaption = "cada sol·licitud"
 eyebrow = "PRIMERS PASSOS"
diff --git a/frontend/editor/public/locales/cs-CZ/translation.toml b/frontend/editor/public/locales/cs-CZ/translation.toml
index cd6f7c4315..7ff170eff4 100644
--- a/frontend/editor/public/locales/cs-CZ/translation.toml
+++ b/frontend/editor/public/locales/cs-CZ/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Zpracujte {{allowance}} PDFs zdarma"
 titleWithRate_one = "Zpracujte {{allowance}} PDFs zdarma, poté {{rate}}/PDF"
 titleWithRate_other = "Zpracujte {{allowance}} PDFs zdarma, poté {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Zamčeno"
-openAriaLabel = "Otevřít komponentu {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Přidat do projektu"
-ariaLabel = "Detail komponenty"
-tabsAriaLabel = "Sekce detailu komponenty"
-upgradeToUnlock = "Upgradujte pro odemknutí"
-
-[portal.catalogue.detail.code]
-install = "Instalace"
-usage = "Použití"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} je zahrnuto od plánu {{tier}}. Upgradujte, abyste ji mohli vložit."
-title = "Není dostupné ve vašem plánu"
-
-[portal.catalogue.detail.preview]
-badge = "Živý náhled"
-note = "Interaktivní sandbox se vykreslí zde"
-
-[portal.catalogue.detail.pricing]
-note = "Měřeno za {{unit}}. Využití nad měsíční bezplatnou kvótu je účtováno vašemu účtu a rozepsáno v části Využití a fakturace."
-
-[portal.catalogue.detail.stats]
-billedOn = "Účtováno za"
-embeds30d = "Vložení (30 dní)"
-freeQuota = "Bezplatná kvóta"
-freeQuotaValue = "{{amount}} / měs."
-maturity = "Vyspělost"
-none = "Žádné"
-perAction = "Za akci"
-price = "Cena"
-
-[portal.catalogue.detail.tabs]
-code = "Kód"
-overview = "Přehled"
-pricing = "Ceník"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "volitelné"
-required = "povinné"
-
-[portal.catalogue.props.columns]
-description = "Popis"
-name = "Prop"
-required = "Povinné"
-type = "Typ"
-
-[portal.catalogue.summary]
-componentsGa = "Komponenty GA"
-componentSpendMtd = "Výdaje za komponenty (MTD)"
-embedsThisMonth = "Vložení tento měsíc"
-inBeta = "V beta verzi"
-
 [portal.components.billingUnit]
 approval = "schválení"
 check = "kontrola"
@@ -6591,18 +6534,6 @@ signature = "podpis"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Vložitelné SDK widgety, které vložíte do své aplikace — prohlížeč, tok e-podpisu, panel AI kontroly. Každý je měřen za akci. Kliknutím na kartu zobrazíte instalaci, použití a props."
-title = "Komponenty"
-
-[portal.componentsView.empty]
-description = "Katalog komponent se nepodařilo načíst. Zkuste to brzy znovu."
-title = "Žádné dostupné komponenty"
-
-[portal.componentsView.lockedBanner]
-description = "Komponenty GA jsou dostupné v režimu Pay-as-you-go; několik komponent Beta je pouze pro enterprise. Zamčené karty zobrazují výzvu k upgradu."
-title = "Některé komponenty vyžadují placený plán"
-
 [portal.docs.authentication]
 codeCaption = "každý požadavek"
 eyebrow = "ZAČÍNÁME"
diff --git a/frontend/editor/public/locales/da-DK/translation.toml b/frontend/editor/public/locales/da-DK/translation.toml
index 665eaeece6..e758a10c5f 100644
--- a/frontend/editor/public/locales/da-DK/translation.toml
+++ b/frontend/editor/public/locales/da-DK/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Behandl {{allowance}} PDFs gratis"
 titleWithRate_one = "Behandl {{allowance}} PDFs gratis, derefter {{rate}}/PDF"
 titleWithRate_other = "Behandl {{allowance}} PDFs gratis, derefter {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Låst"
-openAriaLabel = "Åbn {{name}}-komponent"
-
-[portal.catalogue.detail]
-addToProject = "Føj til projekt"
-ariaLabel = "Komponentdetalje"
-tabsAriaLabel = "Komponentdetaljesektioner"
-upgradeToUnlock = "Opgrader for at låse op"
-
-[portal.catalogue.detail.code]
-install = "Installér"
-usage = "Brug"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} er inkluderet fra {{tier}}-planen. Opgrader for at indlejre den."
-title = "Ikke tilgængelig på din plan"
-
-[portal.catalogue.detail.preview]
-badge = "Live preview"
-note = "Interaktiv sandbox renderes her"
-
-[portal.catalogue.detail.pricing]
-note = "Måles pr. {{unit}}. Brug ud over den månedlige gratis kvote faktureres til din konto og specificeres under Brug og fakturering."
-
-[portal.catalogue.detail.stats]
-billedOn = "Faktureres på"
-embeds30d = "Indlejringer (30d)"
-freeQuota = "Gratis kvote"
-freeQuotaValue = "{{amount}} / md."
-maturity = "Modenhed"
-none = "Ingen"
-perAction = "Pr. handling"
-price = "Pris"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Oversigt"
-pricing = "Priser"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "valgfri"
-required = "påkrævet"
-
-[portal.catalogue.props.columns]
-description = "Beskrivelse"
-name = "Prop"
-required = "Påkrævet"
-type = "Type"
-
-[portal.catalogue.summary]
-componentsGa = "Komponenter GA"
-componentSpendMtd = "Komponentforbrug (MTD)"
-embedsThisMonth = "Indlejringer denne måned"
-inBeta = "I beta"
-
 [portal.components.billingUnit]
 approval = "godkendelse"
 check = "kontrol"
@@ -6591,18 +6534,6 @@ signature = "signatur"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Indlejrbare SDK-widgets, du kan lægge ind i din egen app — en viewer, et e-sign-flow, et AI-gennemgangspanel. Hver måles pr. handling. Klik på et kort for installation, brug og props."
-title = "Komponenter"
-
-[portal.componentsView.empty]
-description = "Komponentkataloget kunne ikke indlæses. Prøv igen om lidt."
-title = "Ingen komponenter tilgængelige"
-
-[portal.componentsView.lockedBanner]
-description = "GA-komponenter er tilgængelige på Pay-as-you-go; nogle få Beta-komponenter er kun til enterprise. Låste kort viser en opgraderingsopfordring."
-title = "Nogle komponenter kræver en betalt plan"
-
 [portal.docs.authentication]
 codeCaption = "hver forespørgsel"
 eyebrow = "KOM GODT I GANG"
diff --git a/frontend/editor/public/locales/de-DE/translation.toml b/frontend/editor/public/locales/de-DE/translation.toml
index 29efeca137..3736b2adae 100644
--- a/frontend/editor/public/locales/de-DE/translation.toml
+++ b/frontend/editor/public/locales/de-DE/translation.toml
@@ -6553,63 +6553,6 @@ title_other = "{{allowance}} PDFs kostenlos verarbeiten"
 titleWithRate_one = "{{allowance}} PDFs kostenlos verarbeiten, danach {{rate}}/PDF"
 titleWithRate_other = "{{allowance}} PDFs kostenlos verarbeiten, danach {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Gesperrt"
-openAriaLabel = "Komponente {{name}} öffnen"
-
-[portal.catalogue.detail]
-addToProject = "Zum Projekt hinzufügen"
-ariaLabel = "Komponentendetail"
-tabsAriaLabel = "Komponentendetail-Abschnitte"
-upgradeToUnlock = "Upgrade zum Entsperren"
-
-[portal.catalogue.detail.code]
-install = "Installieren"
-usage = "Usage"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} ist ab dem {{tier}}-Tarif enthalten. Führen Sie ein Upgrade durch, um es einzubetten."
-title = "In Ihrem Tarif nicht verfügbar"
-
-[portal.catalogue.detail.preview]
-badge = "Live-Vorschau"
-note = "Interaktive Sandbox wird hier gerendert"
-
-[portal.catalogue.detail.pricing]
-note = "Nutzungsbasiert pro {{unit}}. Nutzung über das monatliche Freikontingent hinaus wird Ihrem Konto berechnet und unter Nutzung & Abrechnung einzeln aufgeführt."
-
-[portal.catalogue.detail.stats]
-billedOn = "Abgerechnet nach"
-embeds30d = "Einbettungen (30T)"
-freeQuota = "Freikontingent"
-freeQuotaValue = "{{amount}} / Mon."
-maturity = "Reifegrad"
-none = "Keine"
-perAction = "Pro Aktion"
-price = "Preis"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Übersicht"
-pricing = "Preise"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "optional"
-required = "erforderlich"
-
-[portal.catalogue.props.columns]
-description = "Beschreibung"
-name = "Prop"
-required = "Erforderlich"
-type = "Typ"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "Komponentenausgaben (MTD)"
-embedsThisMonth = "Einbettungen diesen Monat"
-inBeta = "In Beta"
-
 [portal.components.billingUnit]
 approval = "Genehmigung"
 check = "Prüfung"
@@ -6623,18 +6566,6 @@ signature = "Signatur"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Einbettbare SDK-Widgets, die Sie in Ihre eigene App einfügen — ein Viewer, ein E-Sign-Flow, ein KI-Review-Panel. Jedes wird pro Aktion nutzungsbasiert abgerechnet. Klicken Sie auf eine Karte für Installation, Nutzung und Props."
-title = "Komponenten"
-
-[portal.componentsView.empty]
-description = "Der Komponentenkatalog konnte nicht geladen werden. Versuchen Sie es in Kürze erneut."
-title = "Keine Komponenten verfügbar"
-
-[portal.componentsView.lockedBanner]
-description = "GA-Komponenten sind mit Pay-as-you-go verfügbar; einige Beta-Komponenten sind nur für Enterprise. Gesperrte Karten zeigen einen Upgrade-Hinweis."
-title = "Einige Komponenten benötigen einen kostenpflichtigen Tarif"
-
 [portal.docs.authentication]
 codeCaption = "jede Anfrage"
 eyebrow = "ERSTE SCHRITTE"
diff --git a/frontend/editor/public/locales/el-GR/translation.toml b/frontend/editor/public/locales/el-GR/translation.toml
index 677b255d82..06c35bc059 100644
--- a/frontend/editor/public/locales/el-GR/translation.toml
+++ b/frontend/editor/public/locales/el-GR/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Επεξεργαστείτε {{allowance}} PDFs δωρεάν"
 titleWithRate_one = "Επεξεργαστείτε {{allowance}} PDFs δωρεάν και μετά {{rate}}/PDF"
 titleWithRate_other = "Επεξεργαστείτε {{allowance}} PDFs δωρεάν και μετά {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Κλειδωμένο"
-openAriaLabel = "Άνοιγμα στοιχείου {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Προσθήκη στο έργο"
-ariaLabel = "Λεπτομέρειες στοιχείου"
-tabsAriaLabel = "Ενότητες λεπτομερειών στοιχείου"
-upgradeToUnlock = "Αναβαθμίστε για ξεκλείδωμα"
-
-[portal.catalogue.detail.code]
-install = "Εγκατάσταση"
-usage = "Χρήση"
-
-[portal.catalogue.detail.locked]
-description = "Το {{name}} περιλαμβάνεται από το πλάνο {{tier}}. Αναβαθμίστε για να το ενσωματώσετε."
-title = "Δεν είναι διαθέσιμο στο πλάνο σας"
-
-[portal.catalogue.detail.preview]
-badge = "Ζωντανή προεπισκόπηση"
-note = "Το διαδραστικό sandbox αποδίδεται εδώ"
-
-[portal.catalogue.detail.pricing]
-note = "Μετρημένο ανά {{unit}}. Η χρήση πέρα από τη μηνιαία δωρεάν ποσόστωση χρεώνεται στον λογαριασμό σας και αναλύεται στην ενότητα Χρήση & Χρέωση."
-
-[portal.catalogue.detail.stats]
-billedOn = "Χρεώνεται σε"
-embeds30d = "Ενσωματώσεις (30ημ.)"
-freeQuota = "Δωρεάν ποσόστωση"
-freeQuotaValue = "{{amount}} / μήνα"
-maturity = "Ωριμότητα"
-none = "Καμία"
-perAction = "Ανά ενέργεια"
-price = "Τιμή"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Επισκόπηση"
-pricing = "Τιμολόγηση"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "προαιρετικό"
-required = "απαιτείται"
-
-[portal.catalogue.props.columns]
-description = "Περιγραφή"
-name = "Prop"
-required = "Απαιτείται"
-type = "Τύπος"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "Δαπάνη components (MTD)"
-embedsThisMonth = "Ενσωματώσεις αυτόν τον μήνα"
-inBeta = "Σε beta"
-
 [portal.components.billingUnit]
 approval = "έγκριση"
 check = "έλεγχος"
@@ -6591,18 +6534,6 @@ signature = "υπογραφή"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Ενσωματώσιμα SDK widgets που τοποθετείτε στη δική σας εφαρμογή — ένας viewer, μια ροή e-sign, ένα πάνελ ελέγχου AI. Κάθε ένα μετριέται ανά ενέργεια. Κάντε κλικ σε μια κάρτα για εγκατάσταση, χρήση και props."
-title = "Components"
-
-[portal.componentsView.empty]
-description = "Δεν ήταν δυνατή η φόρτωση του καταλόγου components. Δοκιμάστε ξανά σύντομα."
-title = "Δεν υπάρχουν διαθέσιμα components"
-
-[portal.componentsView.lockedBanner]
-description = "Τα GA components είναι διαθέσιμα στο Pay-as-you-go. Μερικά Beta components είναι μόνο για enterprise. Οι κλειδωμένες κάρτες εμφανίζουν προτροπή αναβάθμισης."
-title = "Ορισμένα components χρειάζονται πληρωμένο πλάνο"
-
 [portal.docs.authentication]
 codeCaption = "κάθε αίτημα"
 eyebrow = "ΞΕΚΙΝΩΝΤΑΣ"
diff --git a/frontend/editor/public/locales/en-GB/translation.toml b/frontend/editor/public/locales/en-GB/translation.toml
index bdc49c4258..ff3a30a66c 100644
--- a/frontend/editor/public/locales/en-GB/translation.toml
+++ b/frontend/editor/public/locales/en-GB/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Process {{allowance}} PDFs free"
 titleWithRate_one = "Process {{allowance}} PDFs free, then {{rate}}/PDF"
 titleWithRate_other = "Process {{allowance}} PDFs free, then {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Locked"
-openAriaLabel = "Open {{name}} component"
-
-[portal.catalogue.detail]
-addToProject = "Add to project"
-ariaLabel = "Component detail"
-tabsAriaLabel = "Component detail sections"
-upgradeToUnlock = "Upgrade to unlock"
-
-[portal.catalogue.detail.code]
-install = "Install"
-usage = "Usage"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} is included from the {{tier}} plan. Upgrade to embed it."
-title = "Not available on your plan"
-
-[portal.catalogue.detail.preview]
-badge = "Live preview"
-note = "Interactive sandbox renders here"
-
-[portal.catalogue.detail.pricing]
-note = "Metered per {{unit}}. Usage beyond the monthly free quota is billed to your account and itemised under Usage & Billing."
-
-[portal.catalogue.detail.stats]
-billedOn = "Billed on"
-embeds30d = "Embeds (30d)"
-freeQuota = "Free quota"
-freeQuotaValue = "{{amount}} / mo"
-maturity = "Maturity"
-none = "None"
-perAction = "Per action"
-price = "Price"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Overview"
-pricing = "Pricing"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "optional"
-required = "required"
-
-[portal.catalogue.props.columns]
-description = "Description"
-name = "Prop"
-required = "Required"
-type = "Type"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "Component spend (MTD)"
-embedsThisMonth = "Embeds this month"
-inBeta = "In beta"
-
 [portal.components.billingUnit]
 approval = "approval"
 check = "check"
@@ -6591,18 +6534,6 @@ signature = "signature"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Embeddable SDK widgets you drop into your own app — a viewer, an e-sign flow, an AI review panel. Each is metered per action. Click a card for install, usage and props."
-title = "Components"
-
-[portal.componentsView.empty]
-description = "The component catalogue could not be loaded. Try again shortly."
-title = "No components available"
-
-[portal.componentsView.lockedBanner]
-description = "GA components are available on Pay-as-you-go; a few Beta components are enterprise-only. Locked cards show an upgrade nudge."
-title = "Some components need a paid plan"
-
 [portal.docs.authentication]
 codeCaption = "every request"
 eyebrow = "GETTING STARTED"
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index dfff2e9242..9745842c52 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6421,63 +6421,6 @@ title_other = "Process {{allowance}} PDFs free"
 titleWithRate_one = "Process {{allowance}} PDFs free, then {{rate}}/PDF"
 titleWithRate_other = "Process {{allowance}} PDFs free, then {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Locked"
-openAriaLabel = "Open {{name}} component"
-
-[portal.catalogue.detail]
-addToProject = "Add to project"
-ariaLabel = "Component detail"
-tabsAriaLabel = "Component detail sections"
-upgradeToUnlock = "Upgrade to unlock"
-
-[portal.catalogue.detail.code]
-install = "Install"
-usage = "Usage"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} is included from the {{plan}}. Upgrade to embed it."
-title = "Not available on your plan"
-
-[portal.catalogue.detail.preview]
-badge = "Live preview"
-note = "Interactive sandbox renders here"
-
-[portal.catalogue.detail.pricing]
-note = "Metered per {{unit}}. Usage beyond the monthly free quota is billed to your account and itemised under Usage & Billing."
-
-[portal.catalogue.detail.stats]
-billedOn = "Billed on"
-embeds30d = "Embeds (30d)"
-freeQuota = "Free quota"
-freeQuotaValue = "{{amount}} / mo"
-maturity = "Maturity"
-none = "None"
-perAction = "Per action"
-price = "Price"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Overview"
-pricing = "Pricing"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "optional"
-required = "required"
-
-[portal.catalogue.props.columns]
-description = "Description"
-name = "Prop"
-required = "Required"
-type = "Type"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "Component spend (MTD)"
-embedsThisMonth = "Embeds this month"
-inBeta = "In beta"
-
 [portal.components.billingUnit]
 approval = "approval"
 check = "check"
@@ -6491,18 +6434,6 @@ signature = "signature"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Embeddable SDK widgets you drop into your own app — a viewer, an e-sign flow, an AI review panel. Each is metered per action. Click a card for install, usage and props."
-title = "Components"
-
-[portal.componentsView.empty]
-description = "The component catalogue could not be loaded. Try again shortly."
-title = "No components available"
-
-[portal.componentsView.lockedBanner]
-description = "GA components are available on Pay-as-you-go; a few Beta components are enterprise-only. Locked cards show an upgrade nudge."
-title = "Some components need a paid plan"
-
 [portal.connections]
 createTitle = "New S3 connection"
 delete = "Delete"
diff --git a/frontend/editor/public/locales/es-ES/translation.toml b/frontend/editor/public/locales/es-ES/translation.toml
index 78d48ef9a0..19d4cd6fcd 100644
--- a/frontend/editor/public/locales/es-ES/translation.toml
+++ b/frontend/editor/public/locales/es-ES/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Procesa {{allowance}} PDFs gratis"
 titleWithRate_one = "Procesa {{allowance}} PDFs gratis, luego {{rate}}/PDF"
 titleWithRate_other = "Procesa {{allowance}} PDFs gratis, luego {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Bloqueado"
-openAriaLabel = "Abrir componente {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Añadir al proyecto"
-ariaLabel = "Detalle del componente"
-tabsAriaLabel = "Secciones de detalle del componente"
-upgradeToUnlock = "Actualiza para desbloquear"
-
-[portal.catalogue.detail.code]
-install = "Instalar"
-usage = "Uso"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} está incluido desde el plan {{tier}}. Actualiza para incrustarlo."
-title = "No disponible en tu plan"
-
-[portal.catalogue.detail.preview]
-badge = "Vista previa en vivo"
-note = "El sandbox interactivo se renderiza aquí"
-
-[portal.catalogue.detail.pricing]
-note = "Medido por {{unit}}. El uso que supere la cuota gratuita mensual se factura a tu cuenta y se detalla en Uso y facturación."
-
-[portal.catalogue.detail.stats]
-billedOn = "Facturado por"
-embeds30d = "Incrustaciones (30 d)"
-freeQuota = "Cuota gratuita"
-freeQuotaValue = "{{amount}} / mes"
-maturity = "Madurez"
-none = "Ninguna"
-perAction = "Por acción"
-price = "Precio"
-
-[portal.catalogue.detail.tabs]
-code = "Código"
-overview = "Resumen"
-pricing = "Precios"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "opcional"
-required = "obligatorio"
-
-[portal.catalogue.props.columns]
-description = "Descripción"
-name = "Prop"
-required = "Obligatorio"
-type = "Tipo"
-
-[portal.catalogue.summary]
-componentsGa = "Componentes GA"
-componentSpendMtd = "Gasto en componentes (MTD)"
-embedsThisMonth = "Incrustaciones este mes"
-inBeta = "En beta"
-
 [portal.components.billingUnit]
 approval = "aprobación"
 check = "comprobación"
@@ -6591,18 +6534,6 @@ signature = "firma"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Widgets SDK incrustables que colocas en tu propia app: un visor, un flujo de firma electrónica, un panel de revisión de IA. Cada uno se mide por acción. Haz clic en una tarjeta para instalación, uso y props."
-title = "Componentes"
-
-[portal.componentsView.empty]
-description = "No se ha podido cargar el catálogo de componentes. Inténtalo de nuevo en breve."
-title = "No hay componentes disponibles"
-
-[portal.componentsView.lockedBanner]
-description = "Los componentes GA están disponibles en pago por uso; algunos componentes Beta son solo para empresas. Las tarjetas bloqueadas muestran un aviso para actualizar."
-title = "Algunos componentes necesitan un plan de pago"
-
 [portal.docs.authentication]
 codeCaption = "cada solicitud"
 eyebrow = "PRIMEROS PASOS"
diff --git a/frontend/editor/public/locales/eu-ES/translation.toml b/frontend/editor/public/locales/eu-ES/translation.toml
index 666886a8c7..704f1fb43c 100644
--- a/frontend/editor/public/locales/eu-ES/translation.toml
+++ b/frontend/editor/public/locales/eu-ES/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Prozesatu {{allowance}} PDF doan"
 titleWithRate_one = "Prozesatu {{allowance}} PDF doan, gero {{rate}}/PDF"
 titleWithRate_other = "Prozesatu {{allowance}} PDF doan, gero {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Blokeatuta"
-openAriaLabel = "Ireki {{name}} osagaia"
-
-[portal.catalogue.detail]
-addToProject = "Gehitu proiektuari"
-ariaLabel = "Osagaiaren xehetasuna"
-tabsAriaLabel = "Osagaiaren xehetasun-atalak"
-upgradeToUnlock = "Eguneratu desblokeatzeko"
-
-[portal.catalogue.detail.code]
-install = "Instalatu"
-usage = "Erabilera"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} {{tier}} planetik aurrera dago barne. Eguneratu plana txertatzeko."
-title = "Ez dago erabilgarri zure planean"
-
-[portal.catalogue.detail.preview]
-badge = "Zuzeneko aurrebista"
-note = "Sandbox interaktiboa hemen errendatuko da"
-
-[portal.catalogue.detail.pricing]
-note = "{{unit}} bakoitzeko neurtua. Hileko doako kuotatik gorako erabilera zure kontuan fakturatzen da eta Erabilera eta fakturazioa atalean xehatzen da."
-
-[portal.catalogue.detail.stats]
-billedOn = "Honetan fakturatua"
-embeds30d = "Txertaketak (30 egun)"
-freeQuota = "Doako kuota"
-freeQuotaValue = "{{amount}} / hil"
-maturity = "Heldutasuna"
-none = "Bat ere ez"
-perAction = "Ekintza bakoitzeko"
-price = "Prezioa"
-
-[portal.catalogue.detail.tabs]
-code = "Kodea"
-overview = "Ikuspegi orokorra"
-pricing = "Prezioak"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "aukerakoa"
-required = "beharrezkoa"
-
-[portal.catalogue.props.columns]
-description = "Deskribapena"
-name = "Prop"
-required = "Beharrezkoa"
-type = "Mota"
-
-[portal.catalogue.summary]
-componentsGa = "GA osagaiak"
-componentSpendMtd = "Osagaien gastua (MTD)"
-embedsThisMonth = "Txertaketak hilabete honetan"
-inBeta = "Beta-n"
-
 [portal.components.billingUnit]
 approval = "onarpena"
 check = "egiaztapena"
@@ -6591,18 +6534,6 @@ signature = "sinadura"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Zure aplikazioan txertatzeko SDK widgetak — bistaratzailea, sinadura elektronikoaren fluxua, AI berrikuspen-panela. Bakoitza ekintza bakoitzeko neurtzen da. Egin klik txartel batean instalazioa, erabilera eta props ikusteko."
-title = "Osagaiak"
-
-[portal.componentsView.empty]
-description = "Ezin izan da osagaien katalogoa kargatu. Saiatu berriro laster."
-title = "Ez dago osagairik erabilgarri"
-
-[portal.componentsView.lockedBanner]
-description = "GA osagaiak Pay-as-you-go planean daude erabilgarri; Beta osagai batzuk Enterprise-rako soilik dira. Blokeatutako txartelek eguneratzeko iradokizuna erakusten dute."
-title = "Osagai batzuek ordainpeko plana behar dute"
-
 [portal.docs.authentication]
 codeCaption = "eskaera bakoitza"
 eyebrow = "HASTEN"
diff --git a/frontend/editor/public/locales/fa-IR/translation.toml b/frontend/editor/public/locales/fa-IR/translation.toml
index b6e4d4903d..b7519bc879 100644
--- a/frontend/editor/public/locales/fa-IR/translation.toml
+++ b/frontend/editor/public/locales/fa-IR/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "{{allowance}} PDF را رایگان پردازش کنید"
 titleWithRate_one = "{{allowance}} PDF را رایگان پردازش کنید، سپس {{rate}}/PDF"
 titleWithRate_other = "{{allowance}} PDF را رایگان پردازش کنید، سپس {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "قفل‌شده"
-openAriaLabel = "باز کردن مؤلفه {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "افزودن به پروژه"
-ariaLabel = "جزئیات مؤلفه"
-tabsAriaLabel = "بخش‌های جزئیات مؤلفه"
-upgradeToUnlock = "برای باز کردن قفل ارتقا دهید"
-
-[portal.catalogue.detail.code]
-install = "نصب"
-usage = "استفاده"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} از طرح {{tier}} شامل می‌شود. برای جاسازی آن ارتقا دهید."
-title = "در طرح شما در دسترس نیست"
-
-[portal.catalogue.detail.preview]
-badge = "پیش‌نمایش زنده"
-note = "sandbox تعاملی اینجا رندر می‌شود"
-
-[portal.catalogue.detail.pricing]
-note = "بر اساس {{unit}} اندازه‌گیری می‌شود. استفاده فراتر از سهمیه رایگان ماهانه به حساب شما صورت‌حساب می‌شود و زیر Usage & Billing به‌صورت موردی نمایش داده می‌شود."
-
-[portal.catalogue.detail.stats]
-billedOn = "صورت‌حساب بر اساس"
-embeds30d = "جاسازی‌ها (30 روز)"
-freeQuota = "سهمیه رایگان"
-freeQuotaValue = "{{amount}} / ماه"
-maturity = "بلوغ"
-none = "هیچ‌کدام"
-perAction = "به‌ازای هر اقدام"
-price = "قیمت"
-
-[portal.catalogue.detail.tabs]
-code = "کد"
-overview = "نمای کلی"
-pricing = "قیمت‌گذاری"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "اختیاری"
-required = "الزامی"
-
-[portal.catalogue.props.columns]
-description = "توضیحات"
-name = "Prop"
-required = "الزامی"
-type = "نوع"
-
-[portal.catalogue.summary]
-componentsGa = "مؤلفه‌های GA"
-componentSpendMtd = "هزینه مؤلفه (MTD)"
-embedsThisMonth = "جاسازی‌ها در این ماه"
-inBeta = "در Beta"
-
 [portal.components.billingUnit]
 approval = "تأیید"
 check = "بررسی"
@@ -6591,18 +6534,6 @@ signature = "امضا"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "ویجت‌های SDK قابل جاسازی که در برنامه خودتان قرار می‌دهید — یک نمایشگر، جریان e-sign، پنل بازبینی AI. هرکدام به‌ازای هر اقدام اندازه‌گیری می‌شود. برای نصب، استفاده و props روی کارت کلیک کنید."
-title = "مؤلفه‌ها"
-
-[portal.componentsView.empty]
-description = "کاتالوگ مؤلفه‌ها بارگیری نشد. کمی بعد دوباره تلاش کنید."
-title = "هیچ مؤلفه‌ای در دسترس نیست"
-
-[portal.componentsView.lockedBanner]
-description = "مؤلفه‌های GA در Pay-as-you-go در دسترس هستند؛ چند مؤلفه Beta فقط برای enterprise هستند. کارت‌های قفل‌شده یک پیشنهاد ارتقا نشان می‌دهند."
-title = "برخی مؤلفه‌ها به طرح پولی نیاز دارند"
-
 [portal.docs.authentication]
 codeCaption = "هر درخواست"
 eyebrow = "شروع به کار"
diff --git a/frontend/editor/public/locales/fr-FR/translation.toml b/frontend/editor/public/locales/fr-FR/translation.toml
index 9292811eac..0c17c3b375 100644
--- a/frontend/editor/public/locales/fr-FR/translation.toml
+++ b/frontend/editor/public/locales/fr-FR/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Traitez {{allowance}} PDF gratuitement"
 titleWithRate_one = "Traitez {{allowance}} PDF gratuitement, puis {{rate}}/PDF"
 titleWithRate_other = "Traitez {{allowance}} PDF gratuitement, puis {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Verrouillé"
-openAriaLabel = "Ouvrir le composant {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Ajouter au projet"
-ariaLabel = "Détail du composant"
-tabsAriaLabel = "Sections de détail du composant"
-upgradeToUnlock = "Passer à un niveau supérieur pour déverrouiller"
-
-[portal.catalogue.detail.code]
-install = "Installer"
-usage = "Utilisation"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} est inclus à partir du plan {{tier}}. Passez à un niveau supérieur pour l’intégrer."
-title = "Non disponible avec votre plan"
-
-[portal.catalogue.detail.preview]
-badge = "Aperçu en direct"
-note = "Le bac à sable interactif s’affiche ici"
-
-[portal.catalogue.detail.pricing]
-note = "Mesuré par {{unit}}. L’utilisation au-delà du quota mensuel gratuit est facturée à votre compte et détaillée sous Utilisation et facturation."
-
-[portal.catalogue.detail.stats]
-billedOn = "Facturé sur"
-embeds30d = "Intégrations (30 j)"
-freeQuota = "Quota gratuit"
-freeQuotaValue = "{{amount}} / mois"
-maturity = "Maturité"
-none = "Aucun"
-perAction = "Par action"
-price = "Prix"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Vue d’ensemble"
-pricing = "Tarification"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "facultatif"
-required = "obligatoire"
-
-[portal.catalogue.props.columns]
-description = "Description"
-name = "Prop"
-required = "Obligatoire"
-type = "Type"
-
-[portal.catalogue.summary]
-componentsGa = "Composants GA"
-componentSpendMtd = "Dépenses des composants (MTD)"
-embedsThisMonth = "Intégrations ce mois-ci"
-inBeta = "En beta"
-
 [portal.components.billingUnit]
 approval = "approbation"
 check = "vérification"
@@ -6591,18 +6534,6 @@ signature = "signature"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Widgets SDK intégrables que vous ajoutez à votre propre application — une visionneuse, un flux de signature électronique, un panneau d’examen AI. Chacun est mesuré par action. Cliquez sur une carte pour l’installation, l’utilisation et les props."
-title = "Composants"
-
-[portal.componentsView.empty]
-description = "Le catalogue des composants n’a pas pu être chargé. Réessayez bientôt."
-title = "Aucun composant disponible"
-
-[portal.componentsView.lockedBanner]
-description = "Les composants GA sont disponibles en paiement à l’usage ; quelques composants Beta sont réservés à Enterprise. Les cartes verrouillées affichent une invitation à passer à un niveau supérieur."
-title = "Certains composants nécessitent un plan payant"
-
 [portal.docs.authentication]
 codeCaption = "chaque requête"
 eyebrow = "BIEN DÉMARRER"
diff --git a/frontend/editor/public/locales/ga-IE/translation.toml b/frontend/editor/public/locales/ga-IE/translation.toml
index 39370baa7e..24d4de5d37 100644
--- a/frontend/editor/public/locales/ga-IE/translation.toml
+++ b/frontend/editor/public/locales/ga-IE/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Próiseáil {{allowance}} PDFs saor in aisce"
 titleWithRate_one = "Próiseáil {{allowance}} PDF saor in aisce, ansin {{rate}}/PDF"
 titleWithRate_other = "Próiseáil {{allowance}} PDFs saor in aisce, ansin {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Faoi ghlas"
-openAriaLabel = "Oscail comhpháirt {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Cuir le tionscadal"
-ariaLabel = "Sonraí comhpháirte"
-tabsAriaLabel = "Rannáin shonraí comhpháirte"
-upgradeToUnlock = "Uasghrádaigh chun díghlasáil"
-
-[portal.catalogue.detail.code]
-install = "Suiteáil"
-usage = "Úsáid"
-
-[portal.catalogue.detail.locked]
-description = "Tá {{name}} san áireamh ón bplean {{tier}} ar aghaidh. Uasghrádaigh chun é a leabú."
-title = "Níl sé ar fáil ar do phlean"
-
-[portal.catalogue.detail.preview]
-badge = "Réamhamharc beo"
-note = "Rindreálfar bosca gainimh idirghníomhach anseo"
-
-[portal.catalogue.detail.pricing]
-note = "Méadraithe in aghaidh {{unit}}. Billeáiltear úsáid thar an gcuóta míosúil saor in aisce ar do chuntas agus mírítear í faoi Úsáid & Billeáil."
-
-[portal.catalogue.detail.stats]
-billedOn = "Billeáilte ar"
-embeds30d = "Leabuithe (30l)"
-freeQuota = "Cuóta saor in aisce"
-freeQuotaValue = "{{amount}} / mí"
-maturity = "Aibíocht"
-none = "Dada"
-perAction = "In aghaidh gnímh"
-price = "Praghas"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Forbhreathnú"
-pricing = "Praghsáil"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "roghnach"
-required = "riachtanach"
-
-[portal.catalogue.props.columns]
-description = "Cur síos"
-name = "Prop"
-required = "Riachtanach"
-type = "Cineál"
-
-[portal.catalogue.summary]
-componentsGa = "Comhpháirteanna GA"
-componentSpendMtd = "Caiteachas comhpháirte (MTD)"
-embedsThisMonth = "Leabuithe an mhí seo"
-inBeta = "I mBeta"
-
 [portal.components.billingUnit]
 approval = "faomhadh"
 check = "seiceáil"
@@ -6591,18 +6534,6 @@ signature = "síniú"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Giuirléidí SDK inleabaithe a chuireann tú isteach i d’aip féin — breathnóir, sreabhadh e-sign, painéal athbhreithnithe AI. Méadraítear gach ceann in aghaidh gnímh. Cliceáil cárta le haghaidh suiteála, úsáide agus props."
-title = "Comhpháirteanna"
-
-[portal.componentsView.empty]
-description = "Níorbh fhéidir catalóg na gcomhpháirteanna a luchtú. Bain triail eile as gan mhoill."
-title = "Níl aon chomhpháirteanna ar fáil"
-
-[portal.componentsView.lockedBanner]
-description = "Tá comhpháirteanna GA ar fáil ar Pay-as-you-go; tá cúpla comhpháirt Beta don fhiontar amháin. Taispeánann cártaí faoi ghlas leid uasghrádaithe."
-title = "Teastaíonn plean íoctha ó roinnt comhpháirteanna"
-
 [portal.docs.authentication]
 codeCaption = "gach iarratas"
 eyebrow = "AG TOSÚ"
diff --git a/frontend/editor/public/locales/hi-IN/translation.toml b/frontend/editor/public/locales/hi-IN/translation.toml
index 769ceacdb4..6f19aa1c0b 100644
--- a/frontend/editor/public/locales/hi-IN/translation.toml
+++ b/frontend/editor/public/locales/hi-IN/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "{{allowance}} PDFs मुफ़्त process करें"
 titleWithRate_one = "{{allowance}} PDFs मुफ़्त process करें, फिर {{rate}}/PDF"
 titleWithRate_other = "{{allowance}} PDFs मुफ़्त process करें, फिर {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Locked"
-openAriaLabel = "{{name}} component खोलें"
-
-[portal.catalogue.detail]
-addToProject = "project में जोड़ें"
-ariaLabel = "Component detail"
-tabsAriaLabel = "Component detail sections"
-upgradeToUnlock = "अनलॉक करने के लिए upgrade करें"
-
-[portal.catalogue.detail.code]
-install = "Install"
-usage = "Usage"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} {{tier}} प्लान से शामिल है। इसे embed करने के लिए upgrade करें।"
-title = "आपके प्लान पर उपलब्ध नहीं"
-
-[portal.catalogue.detail.preview]
-badge = "Live preview"
-note = "Interactive sandbox यहाँ render होता है"
-
-[portal.catalogue.detail.pricing]
-note = "प्रति {{unit}} metered। मासिक free quota से अधिक usage का बिल आपके account से लिया जाता है और Usage & Billing के अंतर्गत itemise किया जाता है।"
-
-[portal.catalogue.detail.stats]
-billedOn = "Billed on"
-embeds30d = "Embeds (30d)"
-freeQuota = "Free quota"
-freeQuotaValue = "{{amount}} / mo"
-maturity = "Maturity"
-none = "कोई नहीं"
-perAction = "Per action"
-price = "Price"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Overview"
-pricing = "Pricing"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "optional"
-required = "required"
-
-[portal.catalogue.props.columns]
-description = "विवरण"
-name = "Prop"
-required = "Required"
-type = "Type"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "Component spend (MTD)"
-embedsThisMonth = "इस माह embeds"
-inBeta = "Beta में"
-
 [portal.components.billingUnit]
 approval = "approval"
 check = "check"
@@ -6591,18 +6534,6 @@ signature = "signature"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Embeddable SDK widgets जिन्हें आप अपने app में डालते हैं — viewer, e-sign flow, AI review panel। हर action पर metered। install, usage और props के लिए card पर क्लिक करें।"
-title = "Components"
-
-[portal.componentsView.empty]
-description = "component catalogue लोड नहीं किया जा सका। थोड़ी देर में फिर कोशिश करें।"
-title = "कोई components उपलब्ध नहीं"
-
-[portal.componentsView.lockedBanner]
-description = "GA components Pay-as-you-go पर उपलब्ध हैं; कुछ Beta components केवल enterprise के लिए हैं। Locked cards upgrade nudge दिखाते हैं।"
-title = "कुछ components के लिए paid plan चाहिए"
-
 [portal.docs.authentication]
 codeCaption = "हर request"
 eyebrow = "शुरुआत करें"
diff --git a/frontend/editor/public/locales/hr-HR/translation.toml b/frontend/editor/public/locales/hr-HR/translation.toml
index 75df8b6e28..82f488b577 100644
--- a/frontend/editor/public/locales/hr-HR/translation.toml
+++ b/frontend/editor/public/locales/hr-HR/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Obradite {{allowance}} PDF-ova besplatno"
 titleWithRate_one = "Obradite {{allowance}} PDF-ova besplatno, zatim {{rate}}/PDF"
 titleWithRate_other = "Obradite {{allowance}} PDF-ova besplatno, zatim {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Zaključano"
-openAriaLabel = "Otvori komponentu {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Dodaj u projekt"
-ariaLabel = "Detalji komponente"
-tabsAriaLabel = "Odjeljci detalja komponente"
-upgradeToUnlock = "Nadogradite za otključavanje"
-
-[portal.catalogue.detail.code]
-install = "Instalacija"
-usage = "Upotreba"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} je uključeno od plana {{tier}}. Nadogradite da biste ga ugradili."
-title = "Nije dostupno na vašem planu"
-
-[portal.catalogue.detail.preview]
-badge = "Pregled uživo"
-note = "Interaktivni sandbox prikazuje se ovdje"
-
-[portal.catalogue.detail.pricing]
-note = "Mjereno po {{unit}}. Upotreba iznad mjesečne besplatne kvote naplaćuje se vašem računu i prikazuje po stavkama u odjeljku Upotreba i naplata."
-
-[portal.catalogue.detail.stats]
-billedOn = "Naplaćuje se po"
-embeds30d = "Ugradnje (30 d)"
-freeQuota = "Besplatna kvota"
-freeQuotaValue = "{{amount}} / mj."
-maturity = "Zrelost"
-none = "Ništa"
-perAction = "Po radnji"
-price = "Cijena"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Pregled"
-pricing = "Cijene"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "neobavezno"
-required = "obavezno"
-
-[portal.catalogue.props.columns]
-description = "Opis"
-name = "Prop"
-required = "Obavezno"
-type = "Vrsta"
-
-[portal.catalogue.summary]
-componentsGa = "Komponente GA"
-componentSpendMtd = "Potrošnja komponenti (MTD)"
-embedsThisMonth = "Ugradnje ovog mjeseca"
-inBeta = "U beta verziji"
-
 [portal.components.billingUnit]
 approval = "odobrenje"
 check = "provjera"
@@ -6591,18 +6534,6 @@ signature = "potpis"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Ugradivi SDK widgeti koje ubacujete u vlastitu aplikaciju — preglednik, tijek e-potpisa, AI panel za pregled. Svaki se mjeri po radnji. Kliknite karticu za instalaciju, upotrebu i props."
-title = "Komponente"
-
-[portal.componentsView.empty]
-description = "Katalog komponenti nije moguće učitati. Pokušajte ponovno uskoro."
-title = "Nema dostupnih komponenti"
-
-[portal.componentsView.lockedBanner]
-description = "GA komponente dostupne su na planu Pay-as-you-go; nekoliko Beta komponenti dostupno je samo za Enterprise. Zaključane kartice prikazuju poticaj za nadogradnju."
-title = "Neke komponente zahtijevaju plaćeni plan"
-
 [portal.docs.authentication]
 codeCaption = "svaki zahtjev"
 eyebrow = "POČETAK RADA"
diff --git a/frontend/editor/public/locales/hu-HU/translation.toml b/frontend/editor/public/locales/hu-HU/translation.toml
index de318db739..26e7835c1b 100644
--- a/frontend/editor/public/locales/hu-HU/translation.toml
+++ b/frontend/editor/public/locales/hu-HU/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Dolgozzon fel {{allowance}} PDF-et ingyen"
 titleWithRate_one = "Dolgozzon fel {{allowance}} PDF-et ingyen, utána {{rate}}/PDF"
 titleWithRate_other = "Dolgozzon fel {{allowance}} PDF-et ingyen, utána {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Zárolva"
-openAriaLabel = "{{name}} komponens megnyitása"
-
-[portal.catalogue.detail]
-addToProject = "Hozzáadás a projekthez"
-ariaLabel = "Komponens részletei"
-tabsAriaLabel = "Komponens részleteinek szakaszai"
-upgradeToUnlock = "Váltson magasabb csomagra a feloldáshoz"
-
-[portal.catalogue.detail.code]
-install = "Telepítés"
-usage = "Használat"
-
-[portal.catalogue.detail.locked]
-description = "A(z) {{name}} a(z) {{tier}} csomagtól érhető el. Váltson magasabb csomagra a beágyazásához."
-title = "Nem érhető el az Ön csomagjában"
-
-[portal.catalogue.detail.preview]
-badge = "Élő előnézet"
-note = "Az interaktív sandbox itt jelenik meg"
-
-[portal.catalogue.detail.pricing]
-note = "Mérés {{unit}} alapján. A havi ingyenes kvótán túli használatot a fiókjára számlázzuk, és a Használat és számlázás alatt tételesen megjelenik."
-
-[portal.catalogue.detail.stats]
-billedOn = "Számlázás alapja"
-embeds30d = "Beágyazások (30 nap)"
-freeQuota = "Ingyenes kvóta"
-freeQuotaValue = "{{amount}} / hó"
-maturity = "Érettség"
-none = "Nincs"
-perAction = "Műveletenként"
-price = "Ár"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Áttekintés"
-pricing = "Árazás"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "opcionális"
-required = "kötelező"
-
-[portal.catalogue.props.columns]
-description = "Leírás"
-name = "Prop"
-required = "Kötelező"
-type = "Típus"
-
-[portal.catalogue.summary]
-componentsGa = "GA komponensek"
-componentSpendMtd = "Komponensköltés (MTD)"
-embedsThisMonth = "Beágyazások ebben a hónapban"
-inBeta = "Beta állapotban"
-
 [portal.components.billingUnit]
 approval = "jóváhagyás"
 check = "ellenőrzés"
@@ -6591,18 +6534,6 @@ signature = "aláírás"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Beágyazható SDK widgetek, amelyeket a saját alkalmazásába illeszthet — megjelenítő, e-aláírási folyamat, AI felülvizsgálati panel. Mindegyik műveletenként mért. Kattintson egy kártyára a telepítéshez, használathoz és props megtekintéséhez."
-title = "Komponensek"
-
-[portal.componentsView.empty]
-description = "A komponenskatalógust nem sikerült betölteni. Próbálja újra rövidesen."
-title = "Nincsenek elérhető komponensek"
-
-[portal.componentsView.lockedBanner]
-description = "A GA komponensek Pay-as-you-go csomagban érhetők el; néhány Beta komponens csak vállalati csomagban. A zárolt kártyák frissítési javaslatot mutatnak."
-title = "Egyes komponensekhez fizetős csomag szükséges"
-
 [portal.docs.authentication]
 codeCaption = "minden kérés"
 eyebrow = "ELSŐ LÉPÉSEK"
diff --git a/frontend/editor/public/locales/id-ID/translation.toml b/frontend/editor/public/locales/id-ID/translation.toml
index d25a0eb816..6b3ed7d7e5 100644
--- a/frontend/editor/public/locales/id-ID/translation.toml
+++ b/frontend/editor/public/locales/id-ID/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Proses {{allowance}} PDF gratis"
 titleWithRate_one = "Proses {{allowance}} PDF gratis, lalu {{rate}}/PDF"
 titleWithRate_other = "Proses {{allowance}} PDF gratis, lalu {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Terkunci"
-openAriaLabel = "Buka komponen {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Tambahkan ke proyek"
-ariaLabel = "Detail komponen"
-tabsAriaLabel = "Bagian detail komponen"
-upgradeToUnlock = "Upgrade untuk membuka akses"
-
-[portal.catalogue.detail.code]
-install = "Instal"
-usage = "Penggunaan"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} disertakan mulai paket {{tier}}. Upgrade untuk menyematkannya."
-title = "Tidak tersedia pada paket Anda"
-
-[portal.catalogue.detail.preview]
-badge = "Pratinjau langsung"
-note = "Sandbox interaktif dirender di sini"
-
-[portal.catalogue.detail.pricing]
-note = "Bermeter per {{unit}}. Penggunaan di luar kuota gratis bulanan ditagihkan ke akun Anda dan dirinci di Penggunaan & Penagihan."
-
-[portal.catalogue.detail.stats]
-billedOn = "Ditagih pada"
-embeds30d = "Embed (30h)"
-freeQuota = "Kuota gratis"
-freeQuotaValue = "{{amount}} / bln"
-maturity = "Kematangan"
-none = "Tidak ada"
-perAction = "Per tindakan"
-price = "Harga"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Ikhtisar"
-pricing = "Harga"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "opsional"
-required = "wajib"
-
-[portal.catalogue.props.columns]
-description = "Deskripsi"
-name = "Prop"
-required = "Wajib"
-type = "Tipe"
-
-[portal.catalogue.summary]
-componentsGa = "Komponen GA"
-componentSpendMtd = "Pengeluaran komponen (MTD)"
-embedsThisMonth = "Embed bulan ini"
-inBeta = "Dalam beta"
-
 [portal.components.billingUnit]
 approval = "persetujuan"
 check = "pemeriksaan"
@@ -6591,18 +6534,6 @@ signature = "tanda tangan"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Widget SDK yang dapat disematkan dan Anda letakkan di aplikasi sendiri — viewer, alur e-sign, panel tinjauan AI. Masing-masing bermeter per tindakan. Klik kartu untuk instalasi, penggunaan, dan props."
-title = "Komponen"
-
-[portal.componentsView.empty]
-description = "Katalog komponen tidak dapat dimuat. Coba lagi sebentar lagi."
-title = "Tidak ada komponen tersedia"
-
-[portal.componentsView.lockedBanner]
-description = "Komponen GA tersedia pada Bayar sesuai pemakaian; beberapa komponen Beta hanya untuk enterprise. Kartu terkunci menampilkan dorongan upgrade."
-title = "Beberapa komponen memerlukan paket berbayar"
-
 [portal.docs.authentication]
 codeCaption = "setiap permintaan"
 eyebrow = "MEMULAI"
diff --git a/frontend/editor/public/locales/it-IT/translation.toml b/frontend/editor/public/locales/it-IT/translation.toml
index 4806e5c5e2..9c476ecdab 100644
--- a/frontend/editor/public/locales/it-IT/translation.toml
+++ b/frontend/editor/public/locales/it-IT/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Elabora {{allowance}} PDF gratuitamente"
 titleWithRate_one = "Elabora {{allowance}} PDF gratuitamente, poi {{rate}}/PDF"
 titleWithRate_other = "Elabora {{allowance}} PDF gratuitamente, poi {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Bloccato"
-openAriaLabel = "Apri componente {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Aggiungi al progetto"
-ariaLabel = "Dettaglio componente"
-tabsAriaLabel = "Sezioni dettaglio componente"
-upgradeToUnlock = "Esegui l'upgrade per sbloccare"
-
-[portal.catalogue.detail.code]
-install = "Installazione"
-usage = "Uso"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} è incluso dal piano {{tier}}. Esegui l'upgrade per incorporarlo."
-title = "Non disponibile nel tuo piano"
-
-[portal.catalogue.detail.preview]
-badge = "Anteprima live"
-note = "La sandbox interattiva viene renderizzata qui"
-
-[portal.catalogue.detail.pricing]
-note = "Misurato per {{unit}}. L'uso oltre la quota gratuita mensile viene addebitato al tuo account e dettagliato in Uso e fatturazione."
-
-[portal.catalogue.detail.stats]
-billedOn = "Fatturato su"
-embeds30d = "Incorporamenti (30g)"
-freeQuota = "Quota gratuita"
-freeQuotaValue = "{{amount}} / mese"
-maturity = "Maturità"
-none = "Nessuno"
-perAction = "Per azione"
-price = "Prezzo"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Panoramica"
-pricing = "Prezzi"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "facoltativo"
-required = "obbligatorio"
-
-[portal.catalogue.props.columns]
-description = "Descrizione"
-name = "Prop"
-required = "Obbligatorio"
-type = "Tipo"
-
-[portal.catalogue.summary]
-componentsGa = "Componenti GA"
-componentSpendMtd = "Spesa componenti (MTD)"
-embedsThisMonth = "Incorporamenti questo mese"
-inBeta = "In beta"
-
 [portal.components.billingUnit]
 approval = "approvazione"
 check = "controllo"
@@ -6591,18 +6534,6 @@ signature = "firma"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Widget SDK incorporabili che inserisci nella tua app — un visualizzatore, un flusso di firma elettronica, un pannello di revisione AI. Ognuno è misurato per azione. Fai clic su una scheda per installazione, uso e props."
-title = "Componenti"
-
-[portal.componentsView.empty]
-description = "Impossibile caricare il catalogo dei componenti. Riprova tra poco."
-title = "Nessun componente disponibile"
-
-[portal.componentsView.lockedBanner]
-description = "I componenti GA sono disponibili con Pay-as-you-go; alcuni componenti Beta sono solo enterprise. Le schede bloccate mostrano un invito all'upgrade."
-title = "Alcuni componenti richiedono un piano a pagamento"
-
 [portal.docs.authentication]
 codeCaption = "ogni richiesta"
 eyebrow = "PER INIZIARE"
diff --git a/frontend/editor/public/locales/ja-JP/translation.toml b/frontend/editor/public/locales/ja-JP/translation.toml
index 843f2c055c..40b1ef6da7 100644
--- a/frontend/editor/public/locales/ja-JP/translation.toml
+++ b/frontend/editor/public/locales/ja-JP/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "{{allowance}} 件のPDFを無料で処理"
 titleWithRate_one = "{{allowance}} 件のPDFを無料で処理、その後 {{rate}}/PDF"
 titleWithRate_other = "{{allowance}} 件のPDFを無料で処理、その後 {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "ロック中"
-openAriaLabel = "{{name}} コンポーネントを開く"
-
-[portal.catalogue.detail]
-addToProject = "プロジェクトに追加"
-ariaLabel = "コンポーネント詳細"
-tabsAriaLabel = "コンポーネント詳細セクション"
-upgradeToUnlock = "アップグレードしてロック解除"
-
-[portal.catalogue.detail.code]
-install = "インストール"
-usage = "使用方法"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} は {{tier}} プランから含まれます。埋め込むにはアップグレードしてください。"
-title = "ご利用のプランでは利用できません"
-
-[portal.catalogue.detail.preview]
-badge = "ライブプレビュー"
-note = "インタラクティブなサンドボックスがここにレンダリングされます"
-
-[portal.catalogue.detail.pricing]
-note = "{{unit}} ごとに従量課金されます。月間無料枠を超えた使用量はアカウントに請求され、Usage & Billing に明細表示されます。"
-
-[portal.catalogue.detail.stats]
-billedOn = "請求単位"
-embeds30d = "埋め込み（30日）"
-freeQuota = "無料枠"
-freeQuotaValue = "{{amount}} / 月"
-maturity = "成熟度"
-none = "なし"
-perAction = "アクションごと"
-price = "価格"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "概要"
-pricing = "料金"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "任意"
-required = "必須"
-
-[portal.catalogue.props.columns]
-description = "説明"
-name = "Prop"
-required = "必須"
-type = "タイプ"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "コンポーネント利用額（MTD）"
-embedsThisMonth = "今月の埋め込み数"
-inBeta = "Beta 中"
-
 [portal.components.billingUnit]
 approval = "承認"
 check = "チェック"
@@ -6591,18 +6534,6 @@ signature = "署名"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "自分のアプリに組み込める SDK ウィジェット — ビューア、電子署名フロー、AI レビューパネル。各項目はアクションごとの従量課金です。カードをクリックすると、インストール、使用方法、props を確認できます。"
-title = "コンポーネント"
-
-[portal.componentsView.empty]
-description = "コンポーネントカタログを読み込めませんでした。しばらくしてからもう一度お試しください。"
-title = "利用可能なコンポーネントはありません"
-
-[portal.componentsView.lockedBanner]
-description = "GA コンポーネントは従量課金で利用できます。一部の Beta コンポーネントは Enterprise 専用です。ロックされたカードにはアップグレード案内が表示されます。"
-title = "一部のコンポーネントには有料プランが必要です"
-
 [portal.docs.authentication]
 codeCaption = "すべてのリクエスト"
 eyebrow = "はじめに"
diff --git a/frontend/editor/public/locales/ko-KR/translation.toml b/frontend/editor/public/locales/ko-KR/translation.toml
index 8eeebf1f47..89fd87a954 100644
--- a/frontend/editor/public/locales/ko-KR/translation.toml
+++ b/frontend/editor/public/locales/ko-KR/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "PDF {{allowance}}개 무료 처리"
 titleWithRate_one = "PDF {{allowance}}개 무료 처리 후 {{rate}}/PDF"
 titleWithRate_other = "PDF {{allowance}}개 무료 처리 후 {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "잠김"
-openAriaLabel = "{{name}} 구성 요소 열기"
-
-[portal.catalogue.detail]
-addToProject = "프로젝트에 추가"
-ariaLabel = "구성 요소 상세"
-tabsAriaLabel = "구성 요소 상세 섹션"
-upgradeToUnlock = "업그레이드하여 잠금 해제"
-
-[portal.catalogue.detail.code]
-install = "설치"
-usage = "사용법"
-
-[portal.catalogue.detail.locked]
-description = "{{name}}은(는) {{tier}} 플랜부터 포함됩니다. 임베드하려면 업그레이드하세요."
-title = "현재 플랜에서 사용할 수 없음"
-
-[portal.catalogue.detail.preview]
-badge = "라이브 미리보기"
-note = "Interactive sandbox가 여기에 렌더링됩니다"
-
-[portal.catalogue.detail.pricing]
-note = "{{unit}}당 종량제입니다. 월별 무료 할당량을 초과한 사용량은 계정에 청구되며 Usage & Billing에 항목별로 표시됩니다."
-
-[portal.catalogue.detail.stats]
-billedOn = "청구 기준"
-embeds30d = "임베드(30일)"
-freeQuota = "무료 할당량"
-freeQuotaValue = "{{amount}} / 월"
-maturity = "성숙도"
-none = "없음"
-perAction = "작업당"
-price = "가격"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "개요"
-pricing = "가격"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "선택 사항"
-required = "필수"
-
-[portal.catalogue.props.columns]
-description = "설명"
-name = "Prop"
-required = "필수"
-type = "유형"
-
-[portal.catalogue.summary]
-componentsGa = "구성 요소 GA"
-componentSpendMtd = "구성 요소 지출(MTD)"
-embedsThisMonth = "이번 달 임베드"
-inBeta = "Beta 중"
-
 [portal.components.billingUnit]
 approval = "승인"
 check = "확인"
@@ -6591,18 +6534,6 @@ signature = "서명"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "자체 앱에 넣을 수 있는 임베드 가능한 SDK 위젯 — viewer, e-sign 흐름, AI 검토 패널. 각 항목은 작업당 종량제입니다. 설치, 사용법, props를 보려면 카드를 클릭하세요."
-title = "구성 요소"
-
-[portal.componentsView.empty]
-description = "구성 요소 카탈로그를 불러올 수 없습니다. 잠시 후 다시 시도하세요."
-title = "사용 가능한 구성 요소 없음"
-
-[portal.componentsView.lockedBanner]
-description = "GA 구성 요소는 Pay-as-you-go에서 사용할 수 있으며, 일부 Beta 구성 요소는 enterprise 전용입니다. 잠긴 카드에는 업그레이드 안내가 표시됩니다."
-title = "일부 구성 요소에는 유료 플랜이 필요합니다"
-
 [portal.docs.authentication]
 codeCaption = "모든 요청"
 eyebrow = "시작하기"
diff --git a/frontend/editor/public/locales/ml-ML/translation.toml b/frontend/editor/public/locales/ml-ML/translation.toml
index a9b9bab959..8dcb039c88 100644
--- a/frontend/editor/public/locales/ml-ML/translation.toml
+++ b/frontend/editor/public/locales/ml-ML/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "{{allowance}} PDFs സൗജന്യമായി പ്രോസ
 titleWithRate_one = "{{allowance}} PDFs സൗജന്യമായി പ്രോസസ് ചെയ്യുക, തുടർന്ന് {{rate}}/PDF"
 titleWithRate_other = "{{allowance}} PDFs സൗജന്യമായി പ്രോസസ് ചെയ്യുക, തുടർന്ന് {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "ലോക്ക് ചെയ്തിരിക്കുന്നു"
-openAriaLabel = "{{name}} component തുറക്കുക"
-
-[portal.catalogue.detail]
-addToProject = "Project-ിലേക്ക് ചേർക്കുക"
-ariaLabel = "Component detail"
-tabsAriaLabel = "Component detail വിഭാഗങ്ങൾ"
-upgradeToUnlock = "അൺലോക്ക് ചെയ്യാൻ upgrade ചെയ്യുക"
-
-[portal.catalogue.detail.code]
-install = "Install"
-usage = "Usage"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} {{tier}} plan മുതൽ ഉൾപ്പെടുത്തിയിരിക്കുന്നു. Embed ചെയ്യാൻ upgrade ചെയ്യുക."
-title = "നിങ്ങളുടെ plan-ൽ ലഭ്യമല്ല"
-
-[portal.catalogue.detail.preview]
-badge = "Live preview"
-note = "Interactive sandbox ഇവിടെ render ചെയ്യും"
-
-[portal.catalogue.detail.pricing]
-note = "{{unit}} ഓരോന്നിനും metered. Monthly free quota-യെ കടക്കുന്ന usage നിങ്ങളുടെ അക്കൗണ്ടിൽ ബിൽ ചെയ്ത് Usage & Billing-ൽ itemise ചെയ്യും."
-
-[portal.catalogue.detail.stats]
-billedOn = "ബിൽ ചെയ്യുന്നത്"
-embeds30d = "Embeds (30d)"
-freeQuota = "Free quota"
-freeQuotaValue = "{{amount}} / mo"
-maturity = "Maturity"
-none = "ഒന്നുമില്ല"
-perAction = "ഓരോ action-നും"
-price = "വില"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Overview"
-pricing = "Pricing"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "ഐച്ഛികം"
-required = "ആവശ്യമാണ്"
-
-[portal.catalogue.props.columns]
-description = "വിവരണം"
-name = "Prop"
-required = "ആവശ്യമാണ്"
-type = "Type"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "Component spend (MTD)"
-embedsThisMonth = "ഈ മാസത്തെ embeds"
-inBeta = "Beta-യിൽ"
-
 [portal.components.billingUnit]
 approval = "approval"
 check = "check"
@@ -6591,18 +6534,6 @@ signature = "signature"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "നിങ്ങളുടെ സ്വന്തം app-ിലേക്ക് drop ചെയ്യാവുന്ന embeddable SDK widgets — viewer, e-sign flow, AI review panel. ഓരോന്നും action അനുസരിച്ച് metered ആണ്. Install, usage, props കാണാൻ card click ചെയ്യുക."
-title = "Components"
-
-[portal.componentsView.empty]
-description = "Component catalogue ലോഡ് ചെയ്യാനായില്ല. കുറച്ച് കഴിഞ്ഞ് വീണ്ടും ശ്രമിക്കുക."
-title = "ലഭ്യമായ components ഇല്ല"
-
-[portal.componentsView.lockedBanner]
-description = "GA components Pay-as-you-go-യിൽ ലഭ്യമാണ്; ചില Beta components enterprise-only ആണ്. Locked cards upgrade nudge കാണിക്കും."
-title = "ചില components-ന് paid plan വേണം"
-
 [portal.docs.authentication]
 codeCaption = "ഓരോ request-വും"
 eyebrow = "GETTING STARTED"
diff --git a/frontend/editor/public/locales/nl-NL/translation.toml b/frontend/editor/public/locales/nl-NL/translation.toml
index 6a364ede3f..62f935c195 100644
--- a/frontend/editor/public/locales/nl-NL/translation.toml
+++ b/frontend/editor/public/locales/nl-NL/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Verwerk {{allowance}} PDF's gratis"
 titleWithRate_one = "Verwerk {{allowance}} PDF's gratis, daarna {{rate}}/PDF"
 titleWithRate_other = "Verwerk {{allowance}} PDF's gratis, daarna {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Vergrendeld"
-openAriaLabel = "Component {{name}} openen"
-
-[portal.catalogue.detail]
-addToProject = "Toevoegen aan project"
-ariaLabel = "Componentdetail"
-tabsAriaLabel = "Componentdetailsecties"
-upgradeToUnlock = "Upgrade om te ontgrendelen"
-
-[portal.catalogue.detail.code]
-install = "Installeren"
-usage = "Gebruik"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} is inbegrepen vanaf het {{tier}}-abonnement. Upgrade om het in te sluiten."
-title = "Niet beschikbaar in je abonnement"
-
-[portal.catalogue.detail.preview]
-badge = "Live preview"
-note = "Interactieve sandbox wordt hier weergegeven"
-
-[portal.catalogue.detail.pricing]
-note = "Verbruiksgemeten per {{unit}}. Gebruik boven het maandelijkse gratis quotum wordt gefactureerd aan je account en gespecificeerd onder Gebruik en facturering."
-
-[portal.catalogue.detail.stats]
-billedOn = "Gefactureerd op"
-embeds30d = "Embeds (30d)"
-freeQuota = "Gratis quotum"
-freeQuotaValue = "{{amount}} / mnd"
-maturity = "Volwassenheid"
-none = "Geen"
-perAction = "Per actie"
-price = "Prijs"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Overzicht"
-pricing = "Prijzen"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "optioneel"
-required = "vereist"
-
-[portal.catalogue.props.columns]
-description = "Beschrijving"
-name = "Prop"
-required = "Vereist"
-type = "Type"
-
-[portal.catalogue.summary]
-componentsGa = "Componenten GA"
-componentSpendMtd = "Componentuitgaven (MTD)"
-embedsThisMonth = "Embeds deze maand"
-inBeta = "In beta"
-
 [portal.components.billingUnit]
 approval = "goedkeuring"
 check = "controle"
@@ -6591,18 +6534,6 @@ signature = "handtekening"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Insluitbare SDK-widgets die je in je eigen app plaatst — een viewer, een e-sign-flow, een AI-beoordelingspaneel. Elk wordt per actie gemeten. Klik op een kaart voor installatie, gebruik en props."
-title = "Componenten"
-
-[portal.componentsView.empty]
-description = "De componentencatalogus kon niet worden geladen. Probeer het binnenkort opnieuw."
-title = "Geen componenten beschikbaar"
-
-[portal.componentsView.lockedBanner]
-description = "GA-componenten zijn beschikbaar met Pay-as-you-go; enkele Beta-componenten zijn alleen voor enterprise. Vergrendelde kaarten tonen een upgrade-aanmoediging."
-title = "Sommige componenten hebben een betaald abonnement nodig"
-
 [portal.docs.authentication]
 codeCaption = "elk verzoek"
 eyebrow = "AAN DE SLAG"
diff --git a/frontend/editor/public/locales/no-NB/translation.toml b/frontend/editor/public/locales/no-NB/translation.toml
index 1fd68531a2..ecd7abf2b2 100644
--- a/frontend/editor/public/locales/no-NB/translation.toml
+++ b/frontend/editor/public/locales/no-NB/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Behandle {{allowance}} PDF-er gratis"
 titleWithRate_one = "Behandle {{allowance}} PDF-er gratis, deretter {{rate}}/PDF"
 titleWithRate_other = "Behandle {{allowance}} PDF-er gratis, deretter {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Låst"
-openAriaLabel = "Åpne {{name}}-komponent"
-
-[portal.catalogue.detail]
-addToProject = "Legg til i prosjekt"
-ariaLabel = "Komponentdetalj"
-tabsAriaLabel = "Komponentdetaljseksjoner"
-upgradeToUnlock = "Oppgrader for å låse opp"
-
-[portal.catalogue.detail.code]
-install = "Installer"
-usage = "Bruk"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} er inkludert fra {{tier}}-planen. Oppgrader for å bygge den inn."
-title = "Ikke tilgjengelig i planen din"
-
-[portal.catalogue.detail.preview]
-badge = "Live-forhåndsvisning"
-note = "Interaktiv sandbox gjengis her"
-
-[portal.catalogue.detail.pricing]
-note = "Målt per {{unit}}. Bruk utover den månedlige gratiskvoten faktureres kontoen din og spesifiseres under Bruk og fakturering."
-
-[portal.catalogue.detail.stats]
-billedOn = "Faktureres på"
-embeds30d = "Innbygginger (30 d)"
-freeQuota = "Gratiskvote"
-freeQuotaValue = "{{amount}} / mnd"
-maturity = "Modenhet"
-none = "Ingen"
-perAction = "Per handling"
-price = "Pris"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Oversikt"
-pricing = "Priser"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "valgfritt"
-required = "påkrevd"
-
-[portal.catalogue.props.columns]
-description = "Beskrivelse"
-name = "Prop"
-required = "Påkrevd"
-type = "Type"
-
-[portal.catalogue.summary]
-componentsGa = "Komponenter GA"
-componentSpendMtd = "Komponentforbruk (MTD)"
-embedsThisMonth = "Innbygginger denne måneden"
-inBeta = "I beta"
-
 [portal.components.billingUnit]
 approval = "godkjenning"
 check = "sjekk"
@@ -6591,18 +6534,6 @@ signature = "signatur"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Innbyggbare SDK-widgets du slipper inn i din egen app — en viser, en e-sign-flyt, et AI-gjennomgangspanel. Hver måles per handling. Klikk på et kort for installasjon, bruk og props."
-title = "Komponenter"
-
-[portal.componentsView.empty]
-description = "Komponentkatalogen kunne ikke lastes. Prøv igjen om kort tid."
-title = "Ingen komponenter tilgjengelig"
-
-[portal.componentsView.lockedBanner]
-description = "GA-komponenter er tilgjengelige med betal etter bruk; noen få Beta-komponenter er kun for Enterprise. Låste kort viser en oppgraderingsoppfordring."
-title = "Noen komponenter trenger en betalt plan"
-
 [portal.docs.authentication]
 codeCaption = "hver forespørsel"
 eyebrow = "KOM I GANG"
diff --git a/frontend/editor/public/locales/pl-PL/translation.toml b/frontend/editor/public/locales/pl-PL/translation.toml
index 2309dd6966..2fc22fffff 100644
--- a/frontend/editor/public/locales/pl-PL/translation.toml
+++ b/frontend/editor/public/locales/pl-PL/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Przetwórz {{allowance}} PDF bezpłatnie"
 titleWithRate_one = "Przetwórz {{allowance}} PDF bezpłatnie, potem {{rate}}/PDF"
 titleWithRate_other = "Przetwórz {{allowance}} PDF bezpłatnie, potem {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Zablokowane"
-openAriaLabel = "Otwórz komponent {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Dodaj do projektu"
-ariaLabel = "Szczegóły komponentu"
-tabsAriaLabel = "Sekcje szczegółów komponentu"
-upgradeToUnlock = "Przejdź na wyższy plan, aby odblokować"
-
-[portal.catalogue.detail.code]
-install = "Instalacja"
-usage = "Użycie"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} jest dostępny od planu {{tier}}. Przejdź na wyższy plan, aby go osadzić."
-title = "Niedostępne w Twoim planie"
-
-[portal.catalogue.detail.preview]
-badge = "Podgląd na żywo"
-note = "Interaktywna piaskownica renderuje tutaj"
-
-[portal.catalogue.detail.pricing]
-note = "Rozliczane wg użycia za {{unit}}. Użycie ponad miesięczny bezpłatny limit jest rozliczane na Twoim koncie i wyszczególnione w sekcji Użycie i rozliczenia."
-
-[portal.catalogue.detail.stats]
-billedOn = "Rozliczane za"
-embeds30d = "Osadzenia (30 dni)"
-freeQuota = "Bezpłatny limit"
-freeQuotaValue = "{{amount}} / mies."
-maturity = "Dojrzałość"
-none = "Brak"
-perAction = "Za akcję"
-price = "Cena"
-
-[portal.catalogue.detail.tabs]
-code = "Kod"
-overview = "Przegląd"
-pricing = "Cennik"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "opcjonalne"
-required = "wymagane"
-
-[portal.catalogue.props.columns]
-description = "Opis"
-name = "Prop"
-required = "Wymagane"
-type = "Typ"
-
-[portal.catalogue.summary]
-componentsGa = "Komponenty GA"
-componentSpendMtd = "Wydatki na komponenty (MTD)"
-embedsThisMonth = "Osadzenia w tym miesiącu"
-inBeta = "W beta"
-
 [portal.components.billingUnit]
 approval = "zatwierdzenie"
 check = "sprawdzenie"
@@ -6591,18 +6534,6 @@ signature = "podpis"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Osadzalne widżety SDK, które dodajesz do własnej aplikacji — przeglądarka, przepływ e-podpisu, panel przeglądu AI. Każdy jest rozliczany wg użycia za akcję. Kliknij kartę, aby zobaczyć instalację, użycie i props."
-title = "Komponenty"
-
-[portal.componentsView.empty]
-description = "Nie udało się wczytać katalogu komponentów. Spróbuj ponownie za chwilę."
-title = "Brak dostępnych komponentów"
-
-[portal.componentsView.lockedBanner]
-description = "Komponenty GA są dostępne w modelu Pay-as-you-go; kilka komponentów Beta jest tylko dla Enterprise. Zablokowane karty pokazują zachętę do przejścia na wyższy plan."
-title = "Niektóre komponenty wymagają płatnego planu"
-
 [portal.docs.authentication]
 codeCaption = "każde żądanie"
 eyebrow = "PIERWSZE KROKI"
diff --git a/frontend/editor/public/locales/pt-BR/translation.toml b/frontend/editor/public/locales/pt-BR/translation.toml
index df95886da7..6fbc440d20 100644
--- a/frontend/editor/public/locales/pt-BR/translation.toml
+++ b/frontend/editor/public/locales/pt-BR/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Processe {{allowance}} PDFs grátis"
 titleWithRate_one = "Processe {{allowance}} PDFs grátis, depois {{rate}}/PDF"
 titleWithRate_other = "Processe {{allowance}} PDFs grátis, depois {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Bloqueado"
-openAriaLabel = "Abrir componente {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Adicionar ao projeto"
-ariaLabel = "Detalhes do componente"
-tabsAriaLabel = "Seções de detalhes do componente"
-upgradeToUnlock = "Faça upgrade para desbloquear"
-
-[portal.catalogue.detail.code]
-install = "Instalação"
-usage = "Uso"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} está incluído a partir do plano {{tier}}. Faça upgrade para incorporá-lo."
-title = "Não disponível no seu plano"
-
-[portal.catalogue.detail.preview]
-badge = "Prévia ao vivo"
-note = "Sandbox interativo renderiza aqui"
-
-[portal.catalogue.detail.pricing]
-note = "Medido por {{unit}}. O uso além da cota gratuita mensal é cobrado da sua conta e detalhado em Uso e cobrança."
-
-[portal.catalogue.detail.stats]
-billedOn = "Cobrado por"
-embeds30d = "Incorporações (30d)"
-freeQuota = "Cota gratuita"
-freeQuotaValue = "{{amount}} / mês"
-maturity = "Maturidade"
-none = "Nenhum"
-perAction = "Por ação"
-price = "Preço"
-
-[portal.catalogue.detail.tabs]
-code = "Código"
-overview = "Visão geral"
-pricing = "Preços"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "opcional"
-required = "obrigatório"
-
-[portal.catalogue.props.columns]
-description = "Descrição"
-name = "Prop"
-required = "Obrigatório"
-type = "Tipo"
-
-[portal.catalogue.summary]
-componentsGa = "Componentes GA"
-componentSpendMtd = "Gasto com componentes (MTD)"
-embedsThisMonth = "Incorporações este mês"
-inBeta = "Em beta"
-
 [portal.components.billingUnit]
 approval = "aprovação"
 check = "verificação"
@@ -6591,18 +6534,6 @@ signature = "assinatura"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Widgets SDK incorporáveis que você coloca no seu próprio app — um visualizador, um fluxo de assinatura eletrônica, um painel de revisão de IA. Cada um é medido por ação. Clique em um cartão para instalação, uso e props."
-title = "Componentes"
-
-[portal.componentsView.empty]
-description = "Não foi possível carregar o catálogo de componentes. Tente novamente em breve."
-title = "Nenhum componente disponível"
-
-[portal.componentsView.lockedBanner]
-description = "Componentes GA estão disponíveis no pagamento conforme o uso; alguns componentes Beta são exclusivos para empresas. Cartões bloqueados mostram um incentivo de upgrade."
-title = "Alguns componentes precisam de um plano pago"
-
 [portal.docs.authentication]
 codeCaption = "cada solicitação"
 eyebrow = "INTRODUÇÃO"
diff --git a/frontend/editor/public/locales/pt-PT/translation.toml b/frontend/editor/public/locales/pt-PT/translation.toml
index c7b1a45ee9..565fe39088 100644
--- a/frontend/editor/public/locales/pt-PT/translation.toml
+++ b/frontend/editor/public/locales/pt-PT/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Processe {{allowance}} PDF gratuitamente"
 titleWithRate_one = "Processe {{allowance}} PDF gratuitamente, depois {{rate}}/PDF"
 titleWithRate_other = "Processe {{allowance}} PDF gratuitamente, depois {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Bloqueado"
-openAriaLabel = "Abrir componente {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Adicionar ao projeto"
-ariaLabel = "Detalhe do componente"
-tabsAriaLabel = "Secções de detalhe do componente"
-upgradeToUnlock = "Atualizar para desbloquear"
-
-[portal.catalogue.detail.code]
-install = "Instalar"
-usage = "Utilização"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} está incluído a partir do plano {{tier}}. Atualize para o incorporar."
-title = "Não disponível no seu plano"
-
-[portal.catalogue.detail.preview]
-badge = "Pré-visualização em direto"
-note = "A sandbox interativa é renderizada aqui"
-
-[portal.catalogue.detail.pricing]
-note = "Medido por {{unit}}. A utilização para além da quota gratuita mensal é faturada na sua conta e discriminada em Utilização e faturação."
-
-[portal.catalogue.detail.stats]
-billedOn = "Faturado em"
-embeds30d = "Incorporações (30 d)"
-freeQuota = "Quota gratuita"
-freeQuotaValue = "{{amount}} / mês"
-maturity = "Maturidade"
-none = "Nenhum"
-perAction = "Por ação"
-price = "Preço"
-
-[portal.catalogue.detail.tabs]
-code = "Código"
-overview = "Visão geral"
-pricing = "Preços"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "opcional"
-required = "obrigatório"
-
-[portal.catalogue.props.columns]
-description = "Descrição"
-name = "Prop"
-required = "Obrigatório"
-type = "Tipo"
-
-[portal.catalogue.summary]
-componentsGa = "Componentes GA"
-componentSpendMtd = "Gasto com componentes (MTD)"
-embedsThisMonth = "Incorporações este mês"
-inBeta = "Em beta"
-
 [portal.components.billingUnit]
 approval = "aprovação"
 check = "verificação"
@@ -6591,18 +6534,6 @@ signature = "assinatura"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Widgets SDK incorporáveis que coloca na sua própria aplicação — um visualizador, um fluxo de assinatura eletrónica, um painel de revisão por IA. Cada um é medido por ação. Clique num cartão para instalação, utilização e props."
-title = "Componentes"
-
-[portal.componentsView.empty]
-description = "Não foi possível carregar o catálogo de componentes. Tente novamente em breve."
-title = "Nenhum componente disponível"
-
-[portal.componentsView.lockedBanner]
-description = "Os componentes GA estão disponíveis em Pay-as-you-go; alguns componentes Beta são exclusivos para enterprise. Os cartões bloqueados mostram um incentivo à atualização."
-title = "Alguns componentes precisam de um plano pago"
-
 [portal.docs.authentication]
 codeCaption = "cada pedido"
 eyebrow = "INTRODUÇÃO"
diff --git a/frontend/editor/public/locales/ro-RO/translation.toml b/frontend/editor/public/locales/ro-RO/translation.toml
index 00c9a155ae..507215aaea 100644
--- a/frontend/editor/public/locales/ro-RO/translation.toml
+++ b/frontend/editor/public/locales/ro-RO/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Procesează gratuit {{allowance}} PDF-uri"
 titleWithRate_one = "Procesează gratuit {{allowance}} PDF, apoi {{rate}}/PDF"
 titleWithRate_other = "Procesează gratuit {{allowance}} PDF-uri, apoi {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Blocat"
-openAriaLabel = "Deschide componenta {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Adaugă la proiect"
-ariaLabel = "Detalii componentă"
-tabsAriaLabel = "Secțiuni detalii componentă"
-upgradeToUnlock = "Fă upgrade pentru a debloca"
-
-[portal.catalogue.detail.code]
-install = "Instalare"
-usage = "Utilizare"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} este inclus începând cu planul {{tier}}. Fă upgrade pentru a-l încorpora."
-title = "Nu este disponibil în planul tău"
-
-[portal.catalogue.detail.preview]
-badge = "Previzualizare live"
-note = "Sandbox-ul interactiv se redă aici"
-
-[portal.catalogue.detail.pricing]
-note = "Contorizat per {{unit}}. Utilizarea peste cota gratuită lunară este facturată în contul tău și detaliată la Utilizare și facturare."
-
-[portal.catalogue.detail.stats]
-billedOn = "Facturat la"
-embeds30d = "Încorporări (30z)"
-freeQuota = "Cotă gratuită"
-freeQuotaValue = "{{amount}} / lună"
-maturity = "Maturitate"
-none = "Niciuna"
-perAction = "Per acțiune"
-price = "Preț"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Prezentare generală"
-pricing = "Prețuri"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "opțional"
-required = "obligatoriu"
-
-[portal.catalogue.props.columns]
-description = "Descriere"
-name = "Prop"
-required = "Obligatoriu"
-type = "Tip"
-
-[portal.catalogue.summary]
-componentsGa = "Componente GA"
-componentSpendMtd = "Cheltuieli componente (MTD)"
-embedsThisMonth = "Încorporări luna aceasta"
-inBeta = "În Beta"
-
 [portal.components.billingUnit]
 approval = "aprobare"
 check = "verificare"
@@ -6591,18 +6534,6 @@ signature = "semnătură"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Widgeturi SDK încorporabile pe care le introduci în propria aplicație — un viewer, un flux de semnare electronică, un panou de revizuire AI. Fiecare este contorizat per acțiune. Apasă pe un card pentru instalare, utilizare și props."
-title = "Componente"
-
-[portal.componentsView.empty]
-description = "Catalogul de componente nu a putut fi încărcat. Încearcă din nou în curând."
-title = "Nu există componente disponibile"
-
-[portal.componentsView.lockedBanner]
-description = "Componentele GA sunt disponibile pe Pay-as-you-go; câteva componente Beta sunt doar pentru enterprise. Cardurile blocate afișează un îndemn de upgrade."
-title = "Unele componente necesită un plan plătit"
-
 [portal.docs.authentication]
 codeCaption = "fiecare solicitare"
 eyebrow = "ÎNCEPUT"
diff --git a/frontend/editor/public/locales/ru-RU/translation.toml b/frontend/editor/public/locales/ru-RU/translation.toml
index c4ceb3281e..289e93e965 100644
--- a/frontend/editor/public/locales/ru-RU/translation.toml
+++ b/frontend/editor/public/locales/ru-RU/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Обработайте {{allowance}} PDF бесплатно"
 titleWithRate_one = "Обработайте {{allowance}} PDF бесплатно, затем {{rate}}/PDF"
 titleWithRate_other = "Обработайте {{allowance}} PDF бесплатно, затем {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Заблокировано"
-openAriaLabel = "Открыть компонент {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Добавить в проект"
-ariaLabel = "Сведения о компоненте"
-tabsAriaLabel = "Разделы сведений о компоненте"
-upgradeToUnlock = "Обновите план, чтобы разблокировать"
-
-[portal.catalogue.detail.code]
-install = "Установка"
-usage = "Использование"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} включён начиная с плана {{tier}}. Обновите план, чтобы встроить его."
-title = "Недоступно на вашем плане"
-
-[portal.catalogue.detail.preview]
-badge = "Live preview"
-note = "Здесь отображается интерактивная песочница"
-
-[portal.catalogue.detail.pricing]
-note = "Тарифицируется за {{unit}}. Использование сверх месячной бесплатной квоты списывается с вашего аккаунта и деталлизируется в разделе Usage & Billing."
-
-[portal.catalogue.detail.stats]
-billedOn = "Тарифицируется по"
-embeds30d = "Встраивания (30 дн.)"
-freeQuota = "Бесплатная квота"
-freeQuotaValue = "{{amount}} / мес."
-maturity = "Зрелость"
-none = "Нет"
-perAction = "За действие"
-price = "Цена"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Обзор"
-pricing = "Цены"
-props = "Свойства / API"
-
-[portal.catalogue.props]
-optional = "необязательно"
-required = "обязательно"
-
-[portal.catalogue.props.columns]
-description = "Описание"
-name = "Свойство"
-required = "Обязательно"
-type = "Тип"
-
-[portal.catalogue.summary]
-componentsGa = "Компоненты GA"
-componentSpendMtd = "Расходы на компоненты (MTD)"
-embedsThisMonth = "Встраивания в этом месяце"
-inBeta = "В Beta"
-
 [portal.components.billingUnit]
 approval = "утверждение"
 check = "проверка"
@@ -6591,18 +6534,6 @@ signature = "подпись"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Встраиваемые виджеты SDK, которые можно добавить в ваше приложение — просмотрщик, поток e-sign, панель AI-проверки. Каждый тарифицируется за действие. Нажмите карточку, чтобы увидеть установку, использование и свойства."
-title = "Компоненты"
-
-[portal.componentsView.empty]
-description = "Не удалось загрузить каталог компонентов. Попробуйте снова чуть позже."
-title = "Нет доступных компонентов"
-
-[portal.componentsView.lockedBanner]
-description = "Компоненты GA доступны на Pay-as-you-go; некоторые компоненты Beta доступны только для enterprise. Заблокированные карточки показывают подсказку об обновлении."
-title = "Для некоторых компонентов нужен платный план"
-
 [portal.docs.authentication]
 codeCaption = "каждый запрос"
 eyebrow = "GETTING STARTED"
diff --git a/frontend/editor/public/locales/sk-SK/translation.toml b/frontend/editor/public/locales/sk-SK/translation.toml
index 1ab3fe48ee..1da4a88095 100644
--- a/frontend/editor/public/locales/sk-SK/translation.toml
+++ b/frontend/editor/public/locales/sk-SK/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Spracujte {{allowance}} PDF zadarmo"
 titleWithRate_one = "Spracujte {{allowance}} PDF zadarmo, potom {{rate}}/PDF"
 titleWithRate_other = "Spracujte {{allowance}} PDF zadarmo, potom {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Zamknuté"
-openAriaLabel = "Otvoriť komponent {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Pridať do projektu"
-ariaLabel = "Detail komponentu"
-tabsAriaLabel = "Sekcie detailu komponentu"
-upgradeToUnlock = "Prejdite na vyšší plán na odomknutie"
-
-[portal.catalogue.detail.code]
-install = "Inštalácia"
-usage = "Použitie"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} je zahrnuté od plánu {{tier}}. Prejdite na vyšší plán, aby ste ho mohli vložiť."
-title = "Nie je dostupné vo vašom pláne"
-
-[portal.catalogue.detail.preview]
-badge = "Živý náhľad"
-note = "Interaktívny sandbox sa vykreslí tu"
-
-[portal.catalogue.detail.pricing]
-note = "Merané za {{unit}}. Použitie nad mesačnú bezplatnú kvótu sa účtuje na váš účet a je rozpísané v časti Použitie a fakturácia."
-
-[portal.catalogue.detail.stats]
-billedOn = "Účtované podľa"
-embeds30d = "Vloženia (30 d)"
-freeQuota = "Bezplatná kvóta"
-freeQuotaValue = "{{amount}} / mes."
-maturity = "Vyspelosť"
-none = "Žiadne"
-perAction = "Za akciu"
-price = "Cena"
-
-[portal.catalogue.detail.tabs]
-code = "Kód"
-overview = "Prehľad"
-pricing = "Ceny"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "voliteľné"
-required = "povinné"
-
-[portal.catalogue.props.columns]
-description = "Popis"
-name = "Prop"
-required = "Povinné"
-type = "Typ"
-
-[portal.catalogue.summary]
-componentsGa = "Komponenty GA"
-componentSpendMtd = "Výdavky na komponenty (MTD)"
-embedsThisMonth = "Vloženia tento mesiac"
-inBeta = "V beta"
-
 [portal.components.billingUnit]
 approval = "schválenie"
 check = "kontrola"
@@ -6591,18 +6534,6 @@ signature = "podpis"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Vložiteľné SDK widgety, ktoré pridáte do vlastnej aplikácie — prehliadač, tok e-podpisu, panel AI kontroly. Každý je meraný za akciu. Kliknite na kartu pre inštaláciu, použitie a props."
-title = "Komponenty"
-
-[portal.componentsView.empty]
-description = "Katalóg komponentov sa nepodarilo načítať. Skúste to čoskoro znova."
-title = "Nie sú dostupné žiadne komponenty"
-
-[portal.componentsView.lockedBanner]
-description = "Komponenty GA sú dostupné v režime Pay-as-you-go; niekoľko komponentov Beta je iba pre Enterprise. Zamknuté karty zobrazujú výzvu na upgrade."
-title = "Niektoré komponenty vyžadujú platený plán"
-
 [portal.docs.authentication]
 codeCaption = "každá požiadavka"
 eyebrow = "ZAČÍNAME"
diff --git a/frontend/editor/public/locales/sl-SI/translation.toml b/frontend/editor/public/locales/sl-SI/translation.toml
index dd7bfc7292..18e194a4d4 100644
--- a/frontend/editor/public/locales/sl-SI/translation.toml
+++ b/frontend/editor/public/locales/sl-SI/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Obdelajte {{allowance}} PDF-jev brezplačno"
 titleWithRate_one = "Obdelajte {{allowance}} PDF-jev brezplačno, nato {{rate}}/PDF"
 titleWithRate_other = "Obdelajte {{allowance}} PDF-jev brezplačno, nato {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Zaklenjeno"
-openAriaLabel = "Odpri komponento {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Dodaj v projekt"
-ariaLabel = "Podrobnosti komponente"
-tabsAriaLabel = "Razdelki podrobnosti komponente"
-upgradeToUnlock = "Nadgradite za odklepanje"
-
-[portal.catalogue.detail.code]
-install = "Namesti"
-usage = "Uporaba"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} je vključeno od paketa {{tier}} naprej. Nadgradite za vdelavo."
-title = "Ni na voljo v vašem paketu"
-
-[portal.catalogue.detail.preview]
-badge = "Predogled v živo"
-note = "Interaktivni sandbox se prikaže tukaj"
-
-[portal.catalogue.detail.pricing]
-note = "Merjeno na {{unit}}. Uporaba nad mesečno brezplačno kvoto se zaračuna vašemu računu in je razčlenjena pod Uporaba in obračun."
-
-[portal.catalogue.detail.stats]
-billedOn = "Obračunano po"
-embeds30d = "Vdelave (30 d)"
-freeQuota = "Brezplačna kvota"
-freeQuotaValue = "{{amount}} / mesec"
-maturity = "Zrelost"
-none = "Brez"
-perAction = "Na dejanje"
-price = "Cena"
-
-[portal.catalogue.detail.tabs]
-code = "Koda"
-overview = "Pregled"
-pricing = "Cene"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "neobvezno"
-required = "obvezno"
-
-[portal.catalogue.props.columns]
-description = "Opis"
-name = "Prop"
-required = "Obvezno"
-type = "Vrsta"
-
-[portal.catalogue.summary]
-componentsGa = "Komponente GA"
-componentSpendMtd = "Poraba komponent (MTD)"
-embedsThisMonth = "Vdelave ta mesec"
-inBeta = "V Beta"
-
 [portal.components.billingUnit]
 approval = "odobritev"
 check = "preverjanje"
@@ -6591,18 +6534,6 @@ signature = "podpis"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Vdeljivi SDK gradniki, ki jih spustite v svojo aplikacijo — pregledovalnik, tok e-podpisa, plošča za AI pregled. Vsak je merjen na dejanje. Kliknite kartico za namestitev, uporabo in props."
-title = "Komponente"
-
-[portal.componentsView.empty]
-description = "Kataloga komponent ni bilo mogoče naložiti. Poskusite znova kmalu."
-title = "Ni razpoložljivih komponent"
-
-[portal.componentsView.lockedBanner]
-description = "Komponente GA so na voljo pri plačilu po porabi; nekaj komponent Beta je samo za Enterprise. Zaklenjene kartice prikazujejo poziv za nadgradnjo."
-title = "Nekatere komponente zahtevajo plačljiv paket"
-
 [portal.docs.authentication]
 codeCaption = "vsaka zahteva"
 eyebrow = "ZAČETEK"
diff --git a/frontend/editor/public/locales/sr-LATN-RS/translation.toml b/frontend/editor/public/locales/sr-LATN-RS/translation.toml
index 2ddd6060b0..1c13814719 100644
--- a/frontend/editor/public/locales/sr-LATN-RS/translation.toml
+++ b/frontend/editor/public/locales/sr-LATN-RS/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Obradite {{allowance}} PDF dokumenata besplatno"
 titleWithRate_one = "Obradite {{allowance}} PDF dokumenata besplatno, zatim {{rate}}/PDF"
 titleWithRate_other = "Obradite {{allowance}} PDF dokumenata besplatno, zatim {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Zaključano"
-openAriaLabel = "Otvori komponentu {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Dodaj u projekat"
-ariaLabel = "Detalji komponente"
-tabsAriaLabel = "Odeljci detalja komponente"
-upgradeToUnlock = "Nadogradite za otključavanje"
-
-[portal.catalogue.detail.code]
-install = "Instalacija"
-usage = "Upotreba"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} je uključeno od {{tier}} plana. Nadogradite da biste ga ugradili."
-title = "Nije dostupno na vašem planu"
-
-[portal.catalogue.detail.preview]
-badge = "Live preview"
-note = "Interaktivni sandbox se prikazuje ovde"
-
-[portal.catalogue.detail.pricing]
-note = "Mereno po {{unit}}. Korišćenje preko mesečne besplatne kvote naplaćuje se vašem nalogu i stavlja pod Usage & Billing."
-
-[portal.catalogue.detail.stats]
-billedOn = "Naplaćuje se po"
-embeds30d = "Ugradnje (30d)"
-freeQuota = "Besplatna kvota"
-freeQuotaValue = "{{amount}} / mes"
-maturity = "Zrelost"
-none = "Nema"
-perAction = "Po radnji"
-price = "Cena"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Pregled"
-pricing = "Cene"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "opciono"
-required = "obavezno"
-
-[portal.catalogue.props.columns]
-description = "Opis"
-name = "Prop"
-required = "Obavezno"
-type = "Tip"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "Potrošnja komponente (MTD)"
-embedsThisMonth = "Ugradnje ovog meseca"
-inBeta = "U beta verziji"
-
 [portal.components.billingUnit]
 approval = "odobrenje"
 check = "provera"
@@ -6591,18 +6534,6 @@ signature = "potpis"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Ugradivi SDK widget-i koje ubacujete u svoju aplikaciju — viewer, tok e-potpisa, AI panel za pregled. Svaki se meri po radnji. Kliknite karticu za instalaciju, upotrebu i props."
-title = "Komponente"
-
-[portal.componentsView.empty]
-description = "Katalog komponenti nije moguće učitati. Pokušajte ponovo uskoro."
-title = "Nema dostupnih komponenti"
-
-[portal.componentsView.lockedBanner]
-description = "GA komponente su dostupne na Pay-as-you-go; nekoliko Beta komponenti je samo za Enterprise. Zaključane kartice prikazuju podsticaj za nadogradnju."
-title = "Neke komponente zahtevaju plaćeni plan"
-
 [portal.docs.authentication]
 codeCaption = "svaki zahtev"
 eyebrow = "POČETAK"
diff --git a/frontend/editor/public/locales/sv-SE/translation.toml b/frontend/editor/public/locales/sv-SE/translation.toml
index 841cce5277..c8ae1fed37 100644
--- a/frontend/editor/public/locales/sv-SE/translation.toml
+++ b/frontend/editor/public/locales/sv-SE/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Bearbeta {{allowance}} PDF:er gratis"
 titleWithRate_one = "Bearbeta {{allowance}} PDF:er gratis, sedan {{rate}}/PDF"
 titleWithRate_other = "Bearbeta {{allowance}} PDF:er gratis, sedan {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Låst"
-openAriaLabel = "Öppna komponenten {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Lägg till i projekt"
-ariaLabel = "Komponentdetalj"
-tabsAriaLabel = "Sektioner för komponentdetalj"
-upgradeToUnlock = "Uppgradera för att låsa upp"
-
-[portal.catalogue.detail.code]
-install = "Installera"
-usage = "Användning"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} ingår från {{tier}}-planen. Uppgradera för att bädda in den."
-title = "Inte tillgängligt i din plan"
-
-[portal.catalogue.detail.preview]
-badge = "Liveförhandsvisning"
-note = "Interaktiv sandbox renderas här"
-
-[portal.catalogue.detail.pricing]
-note = "Mätt per {{unit}}. Användning utöver den månatliga gratiskvoten faktureras ditt konto och specificeras under Användning och fakturering."
-
-[portal.catalogue.detail.stats]
-billedOn = "Faktureras på"
-embeds30d = "Inbäddningar (30 d)"
-freeQuota = "Gratiskvot"
-freeQuotaValue = "{{amount}} / mån"
-maturity = "Mognad"
-none = "Ingen"
-perAction = "Per åtgärd"
-price = "Pris"
-
-[portal.catalogue.detail.tabs]
-code = "Kod"
-overview = "Översikt"
-pricing = "Prissättning"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "valfritt"
-required = "obligatoriskt"
-
-[portal.catalogue.props.columns]
-description = "Beskrivning"
-name = "Prop"
-required = "Obligatoriskt"
-type = "Typ"
-
-[portal.catalogue.summary]
-componentsGa = "Komponenter GA"
-componentSpendMtd = "Komponentutgifter (MTD)"
-embedsThisMonth = "Inbäddningar denna månad"
-inBeta = "I beta"
-
 [portal.components.billingUnit]
 approval = "godkännande"
 check = "kontroll"
@@ -6591,18 +6534,6 @@ signature = "signatur"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Inbäddningsbara SDK-widgets som du släpper in i din egen app — en visare, ett e-sign-flöde, en AI-granskningspanel. Varje mäts per åtgärd. Klicka på ett kort för installation, användning och props."
-title = "Komponenter"
-
-[portal.componentsView.empty]
-description = "Komponentkatalogen kunde inte läsas in. Försök igen snart."
-title = "Inga komponenter tillgängliga"
-
-[portal.componentsView.lockedBanner]
-description = "GA-komponenter är tillgängliga med Pay-as-you-go; några Beta-komponenter är endast för enterprise. Låsta kort visar en uppgraderingsuppmaning."
-title = "Vissa komponenter kräver en betald plan"
-
 [portal.docs.authentication]
 codeCaption = "varje förfrågan"
 eyebrow = "KOM IGÅNG"
diff --git a/frontend/editor/public/locales/th-TH/translation.toml b/frontend/editor/public/locales/th-TH/translation.toml
index 55f27a8467..936411b021 100644
--- a/frontend/editor/public/locales/th-TH/translation.toml
+++ b/frontend/editor/public/locales/th-TH/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "ประมวลผล {{allowance}} PDFs ฟรี"
 titleWithRate_one = "ประมวลผล {{allowance}} PDFs ฟรี จากนั้น {{rate}}/PDF"
 titleWithRate_other = "ประมวลผล {{allowance}} PDFs ฟรี จากนั้น {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "ถูกล็อก"
-openAriaLabel = "เปิดคอมโพเนนต์ {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "เพิ่มไปยังโปรเจกต์"
-ariaLabel = "รายละเอียดคอมโพเนนต์"
-tabsAriaLabel = "ส่วนรายละเอียดคอมโพเนนต์"
-upgradeToUnlock = "อัปเกรดเพื่อปลดล็อก"
-
-[portal.catalogue.detail.code]
-install = "ติดตั้ง"
-usage = "การใช้งาน"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} รวมอยู่ตั้งแต่แผน {{tier}} อัปเกรดเพื่อฝังใช้งาน"
-title = "ไม่มีในแผนของคุณ"
-
-[portal.catalogue.detail.preview]
-badge = "ตัวอย่างสด"
-note = "แซนด์บ็อกซ์แบบโต้ตอบจะแสดงที่นี่"
-
-[portal.catalogue.detail.pricing]
-note = "คิดตามปริมาณต่อ {{unit}} การใช้งานเกินโควต้าฟรีรายเดือนจะถูกเรียกเก็บเงินไปยังบัญชีของคุณและแยกรายการใต้ Usage & Billing"
-
-[portal.catalogue.detail.stats]
-billedOn = "เรียกเก็บเงินตาม"
-embeds30d = "การฝัง (30d)"
-freeQuota = "โควต้าฟรี"
-freeQuotaValue = "{{amount}} / เดือน"
-maturity = "ระดับความพร้อม"
-none = "ไม่มี"
-perAction = "ต่อการดำเนินการ"
-price = "ราคา"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "ภาพรวม"
-pricing = "ราคา"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "ไม่บังคับ"
-required = "จำเป็น"
-
-[portal.catalogue.props.columns]
-description = "คำอธิบาย"
-name = "Prop"
-required = "จำเป็น"
-type = "ประเภท"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "ค่าใช้จ่ายคอมโพเนนต์ (MTD)"
-embedsThisMonth = "การฝังในเดือนนี้"
-inBeta = "อยู่ใน Beta"
-
 [portal.components.billingUnit]
 approval = "การอนุมัติ"
 check = "การตรวจสอบ"
@@ -6591,18 +6534,6 @@ signature = "ลายเซ็น"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "วิดเจ็ต SDK ที่ฝังได้ซึ่งคุณวางในแอปของคุณเอง — viewer, โฟลว์ e-sign, แผงรีวิว AI แต่ละรายการคิดตามปริมาณต่อการดำเนินการ คลิกการ์ดเพื่อดูการติดตั้ง การใช้งาน และ props"
-title = "คอมโพเนนต์"
-
-[portal.componentsView.empty]
-description = "ไม่สามารถโหลดแค็ตตาล็อกคอมโพเนนต์ได้ ลองอีกครั้งในไม่ช้า"
-title = "ไม่มีคอมโพเนนต์พร้อมใช้งาน"
-
-[portal.componentsView.lockedBanner]
-description = "คอมโพเนนต์ GA พร้อมใช้งานในแบบจ่ายตามการใช้งาน; คอมโพเนนต์ Beta บางรายการสำหรับ enterprise เท่านั้น การ์ดที่ถูกล็อกจะแสดงคำแนะนำให้อัปเกรด"
-title = "คอมโพเนนต์บางรายการต้องใช้แผนแบบชำระเงิน"
-
 [portal.docs.authentication]
 codeCaption = "ทุกคำขอ"
 eyebrow = "เริ่มต้นใช้งาน"
diff --git a/frontend/editor/public/locales/tr-TR/translation.toml b/frontend/editor/public/locales/tr-TR/translation.toml
index 4577a23154..6c9031be44 100644
--- a/frontend/editor/public/locales/tr-TR/translation.toml
+++ b/frontend/editor/public/locales/tr-TR/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "{{allowance}} PDF'yi ücretsiz işleyin"
 titleWithRate_one = "{{allowance}} PDF'yi ücretsiz işleyin, sonra PDF başına {{rate}}"
 titleWithRate_other = "{{allowance}} PDF'yi ücretsiz işleyin, sonra PDF başına {{rate}}"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Kilitli"
-openAriaLabel = "{{name}} bileşenini aç"
-
-[portal.catalogue.detail]
-addToProject = "Projeye ekle"
-ariaLabel = "Bileşen ayrıntısı"
-tabsAriaLabel = "Bileşen ayrıntı bölümleri"
-upgradeToUnlock = "Kilidi açmak için yükselt"
-
-[portal.catalogue.detail.code]
-install = "Kurulum"
-usage = "Kullanım"
-
-[portal.catalogue.detail.locked]
-description = "{{name}}, {{tier}} planından itibaren dahildir. Gömülü kullanmak için yükseltin."
-title = "Planınızda mevcut değil"
-
-[portal.catalogue.detail.preview]
-badge = "Canlı önizleme"
-note = "Etkileşimli sandbox burada oluşturulur"
-
-[portal.catalogue.detail.pricing]
-note = "{{unit}} başına ölçümlenir. Aylık ücretsiz kotanın üzerindeki kullanım hesabınıza faturalandırılır ve Kullanım ve Faturalandırma altında kalemlendirilir."
-
-[portal.catalogue.detail.stats]
-billedOn = "Faturalandırma ölçütü"
-embeds30d = "Embed'ler (30g)"
-freeQuota = "Ücretsiz kota"
-freeQuotaValue = "{{amount}} / ay"
-maturity = "Olgunluk"
-none = "Yok"
-perAction = "Eylem başına"
-price = "Fiyat"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Genel bakış"
-pricing = "Fiyatlandırma"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "isteğe bağlı"
-required = "gerekli"
-
-[portal.catalogue.props.columns]
-description = "Açıklama"
-name = "Prop"
-required = "Gerekli"
-type = "Tür"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "Bileşen harcaması (MTD)"
-embedsThisMonth = "Bu ayki embed'ler"
-inBeta = "Beta'da"
-
 [portal.components.billingUnit]
 approval = "onay"
 check = "kontrol"
@@ -6591,18 +6534,6 @@ signature = "imza"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Kendi uygulamanıza ekleyebileceğiniz gömülebilir SDK widget'ları — bir görüntüleyici, e-imza akışı, AI inceleme paneli. Her biri eylem başına ölçümlenir. Kurulum, kullanım ve props için bir karta tıklayın."
-title = "Bileşenler"
-
-[portal.componentsView.empty]
-description = "Bileşen kataloğu yüklenemedi. Kısa süre sonra tekrar deneyin."
-title = "Kullanılabilir bileşen yok"
-
-[portal.componentsView.lockedBanner]
-description = "GA bileşenleri Pay-as-you-go planında mevcuttur; birkaç Beta bileşeni yalnızca enterprise içindir. Kilitli kartlar yükseltme önerisi gösterir."
-title = "Bazı bileşenler ücretli plan gerektirir"
-
 [portal.docs.authentication]
 codeCaption = "her istek"
 eyebrow = "BAŞLANGIÇ"
diff --git a/frontend/editor/public/locales/uk-UA/translation.toml b/frontend/editor/public/locales/uk-UA/translation.toml
index d0cdcc91d5..c4e274255b 100644
--- a/frontend/editor/public/locales/uk-UA/translation.toml
+++ b/frontend/editor/public/locales/uk-UA/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Обробіть {{allowance}} PDF безкоштовно"
 titleWithRate_one = "Обробіть {{allowance}} PDF безкоштовно, потім {{rate}}/PDF"
 titleWithRate_other = "Обробіть {{allowance}} PDF безкоштовно, потім {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Заблоковано"
-openAriaLabel = "Відкрити компонент {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Додати до проєкту"
-ariaLabel = "Відомості про компонент"
-tabsAriaLabel = "Розділи відомостей про компонент"
-upgradeToUnlock = "Оновіть план, щоб розблокувати"
-
-[portal.catalogue.detail.code]
-install = "Встановлення"
-usage = "Використання"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} включено з плану {{tier}}. Оновіть план, щоб вбудувати його."
-title = "Недоступно у вашому плані"
-
-[portal.catalogue.detail.preview]
-badge = "Live preview"
-note = "Інтерактивна sandbox відображається тут"
-
-[portal.catalogue.detail.pricing]
-note = "За лічильником за {{unit}}. Використання понад щомісячну безкоштовну квоту виставляється на ваш обліковий запис і деталізується в Usage & Billing."
-
-[portal.catalogue.detail.stats]
-billedOn = "Оплачується за"
-embeds30d = "Вбудовування (30 дн.)"
-freeQuota = "Безкоштовна квота"
-freeQuotaValue = "{{amount}} / міс."
-maturity = "Зрілість"
-none = "Немає"
-perAction = "За дію"
-price = "Ціна"
-
-[portal.catalogue.detail.tabs]
-code = "Код"
-overview = "Огляд"
-pricing = "Ціни"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "необов’язково"
-required = "обов’язково"
-
-[portal.catalogue.props.columns]
-description = "Опис"
-name = "Prop"
-required = "Обов’язково"
-type = "Тип"
-
-[portal.catalogue.summary]
-componentsGa = "Компоненти GA"
-componentSpendMtd = "Витрати на компоненти (MTD)"
-embedsThisMonth = "Вбудовувань цього місяця"
-inBeta = "У beta"
-
 [portal.components.billingUnit]
 approval = "схвалення"
 check = "перевірка"
@@ -6591,18 +6534,6 @@ signature = "підпис"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Вбудовувані SDK-віджети, які ви додаєте у власний застосунок — переглядач, процес e-sign, панель AI-перевірки. Кожен оплачується за дію. Натисніть картку, щоб переглянути встановлення, використання та props."
-title = "Компоненти"
-
-[portal.componentsView.empty]
-description = "Не вдалося завантажити каталог компонентів. Спробуйте ще раз незабаром."
-title = "Немає доступних компонентів"
-
-[portal.componentsView.lockedBanner]
-description = "Компоненти GA доступні на Pay-as-you-go; кілька компонентів Beta доступні лише для Enterprise. Заблоковані картки показують пропозицію оновлення."
-title = "Деяким компонентам потрібен платний план"
-
 [portal.docs.authentication]
 codeCaption = "кожен запит"
 eyebrow = "ПОЧАТОК РОБОТИ"
diff --git a/frontend/editor/public/locales/vi-VN/translation.toml b/frontend/editor/public/locales/vi-VN/translation.toml
index 18afcd310f..9f6861ecbe 100644
--- a/frontend/editor/public/locales/vi-VN/translation.toml
+++ b/frontend/editor/public/locales/vi-VN/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "Xử lý {{allowance}} PDF miễn phí"
 titleWithRate_one = "Xử lý {{allowance}} PDF miễn phí, sau đó {{rate}}/PDF"
 titleWithRate_other = "Xử lý {{allowance}} PDF miễn phí, sau đó {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "Đã khóa"
-openAriaLabel = "Mở thành phần {{name}}"
-
-[portal.catalogue.detail]
-addToProject = "Thêm vào dự án"
-ariaLabel = "Chi tiết thành phần"
-tabsAriaLabel = "Các phần chi tiết thành phần"
-upgradeToUnlock = "Nâng cấp để mở khóa"
-
-[portal.catalogue.detail.code]
-install = "Cài đặt"
-usage = "Cách dùng"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} được bao gồm từ gói {{tier}}. Nâng cấp để nhúng nó."
-title = "Không khả dụng trên gói của bạn"
-
-[portal.catalogue.detail.preview]
-badge = "Xem trước trực tiếp"
-note = "Sandbox tương tác hiển thị tại đây"
-
-[portal.catalogue.detail.pricing]
-note = "Tính theo mức sử dụng mỗi {{unit}}. Mức sử dụng vượt quá hạn mức miễn phí hàng tháng sẽ được tính phí vào tài khoản của bạn và liệt kê chi tiết trong Sử dụng & Thanh toán."
-
-[portal.catalogue.detail.stats]
-billedOn = "Tính phí theo"
-embeds30d = "Lượt nhúng (30 ngày)"
-freeQuota = "Hạn mức miễn phí"
-freeQuotaValue = "{{amount}} / tháng"
-maturity = "Mức độ trưởng thành"
-none = "Không có"
-perAction = "Mỗi hành động"
-price = "Giá"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "Tổng quan"
-pricing = "Giá"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "tùy chọn"
-required = "bắt buộc"
-
-[portal.catalogue.props.columns]
-description = "Mô tả"
-name = "Prop"
-required = "Bắt buộc"
-type = "Loại"
-
-[portal.catalogue.summary]
-componentsGa = "Thành phần GA"
-componentSpendMtd = "Chi tiêu thành phần (MTD)"
-embedsThisMonth = "Lượt nhúng tháng này"
-inBeta = "Đang beta"
-
 [portal.components.billingUnit]
 approval = "phê duyệt"
 check = "kiểm tra"
@@ -6591,18 +6534,6 @@ signature = "chữ ký"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "Các widget SDK có thể nhúng mà bạn thả vào ứng dụng của mình — trình xem, luồng e-sign, bảng xem xét AI. Mỗi widget được tính theo mức sử dụng mỗi hành động. Nhấp vào thẻ để xem cài đặt, cách dùng và props."
-title = "Thành phần"
-
-[portal.componentsView.empty]
-description = "Không thể tải catalogue thành phần. Hãy thử lại sau ít phút."
-title = "Không có thành phần nào khả dụng"
-
-[portal.componentsView.lockedBanner]
-description = "Các thành phần GA có sẵn trên Pay-as-you-go; một số thành phần Beta chỉ dành cho doanh nghiệp. Thẻ bị khóa hiển thị lời nhắc nâng cấp."
-title = "Một số thành phần cần gói trả phí"
-
 [portal.docs.authentication]
 codeCaption = "mọi yêu cầu"
 eyebrow = "BẮT ĐẦU"
diff --git a/frontend/editor/public/locales/zh-BO/translation.toml b/frontend/editor/public/locales/zh-BO/translation.toml
index 836971b555..603011afd5 100644
--- a/frontend/editor/public/locales/zh-BO/translation.toml
+++ b/frontend/editor/public/locales/zh-BO/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "免费处理 {{allowance}} 个 PDFs"
 titleWithRate_one = "免费处理 {{allowance}} 个 PDFs，之后 {{rate}}/PDF"
 titleWithRate_other = "免费处理 {{allowance}} 个 PDFs，之后 {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "已锁定"
-openAriaLabel = "打开 {{name}} 组件"
-
-[portal.catalogue.detail]
-addToProject = "添加到项目"
-ariaLabel = "组件详情"
-tabsAriaLabel = "组件详情部分"
-upgradeToUnlock = "升级以解锁"
-
-[portal.catalogue.detail.code]
-install = "安装"
-usage = "用法"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} 从 {{tier}} 方案开始包含。升级以嵌入它。"
-title = "您的方案不可用"
-
-[portal.catalogue.detail.preview]
-badge = "实时预览"
-note = "交互式沙盒将在此处渲染"
-
-[portal.catalogue.detail.pricing]
-note = "按 {{unit}} 计量。超出每月免费额度的使用量会计入您的账户，并在使用情况和账单中逐项列出。"
-
-[portal.catalogue.detail.stats]
-billedOn = "计费依据"
-embeds30d = "嵌入次数（30 天）"
-freeQuota = "免费额度"
-freeQuotaValue = "{{amount}} / 月"
-maturity = "成熟度"
-none = "无"
-perAction = "按操作"
-price = "价格"
-
-[portal.catalogue.detail.tabs]
-code = "代码"
-overview = "概览"
-pricing = "定价"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "可选"
-required = "必需"
-
-[portal.catalogue.props.columns]
-description = "描述"
-name = "Prop"
-required = "必需"
-type = "类型"
-
-[portal.catalogue.summary]
-componentsGa = "组件 GA"
-componentSpendMtd = "组件支出（MTD）"
-embedsThisMonth = "本月嵌入次数"
-inBeta = "Beta 中"
-
 [portal.components.billingUnit]
 approval = "批准"
 check = "检查"
@@ -6591,18 +6534,6 @@ signature = "签名"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "可嵌入的 SDK 小组件，可放入您自己的应用——查看器、电子签流程、AI 审核面板。每个都按操作计量。点击卡片查看安装、用法和 props。"
-title = "组件"
-
-[portal.componentsView.empty]
-description = "无法加载组件目录。请稍后重试。"
-title = "没有可用组件"
-
-[portal.componentsView.lockedBanner]
-description = "GA 组件在按量付费中可用；少数 Beta 组件仅限企业使用。锁定卡片会显示升级提示。"
-title = "部分组件需要付费方案"
-
 [portal.docs.authentication]
 codeCaption = "每个请求"
 eyebrow = "入门"
diff --git a/frontend/editor/public/locales/zh-CN/translation.toml b/frontend/editor/public/locales/zh-CN/translation.toml
index ef6ff55a7b..a391627a4b 100644
--- a/frontend/editor/public/locales/zh-CN/translation.toml
+++ b/frontend/editor/public/locales/zh-CN/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "免费处理 {{allowance}} 个 PDFs"
 titleWithRate_one = "免费处理 {{allowance}} 个 PDFs，之后 {{rate}}/PDF"
 titleWithRate_other = "免费处理 {{allowance}} 个 PDFs，之后 {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "已锁定"
-openAriaLabel = "打开 {{name}} 组件"
-
-[portal.catalogue.detail]
-addToProject = "添加到项目"
-ariaLabel = "组件详情"
-tabsAriaLabel = "组件详情部分"
-upgradeToUnlock = "升级以解锁"
-
-[portal.catalogue.detail.code]
-install = "安装"
-usage = "用法"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} 自 {{tier}} 计划起包含。升级后可嵌入它。"
-title = "您的计划不可用"
-
-[portal.catalogue.detail.preview]
-badge = "实时预览"
-note = "交互式沙盒将在此处渲染"
-
-[portal.catalogue.detail.pricing]
-note = "按每 {{unit}} 计量。超出每月免费额度的使用量会计入您的账户，并在使用与账单中逐项列出。"
-
-[portal.catalogue.detail.stats]
-billedOn = "计费依据"
-embeds30d = "嵌入次数（30 天）"
-freeQuota = "免费额度"
-freeQuotaValue = "{{amount}} / 月"
-maturity = "成熟度"
-none = "无"
-perAction = "按操作"
-price = "价格"
-
-[portal.catalogue.detail.tabs]
-code = "代码"
-overview = "概览"
-pricing = "定价"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "可选"
-required = "必填"
-
-[portal.catalogue.props.columns]
-description = "描述"
-name = "Prop"
-required = "必填"
-type = "类型"
-
-[portal.catalogue.summary]
-componentsGa = "组件 GA"
-componentSpendMtd = "组件支出（MTD）"
-embedsThisMonth = "本月嵌入次数"
-inBeta = "Beta 中"
-
 [portal.components.billingUnit]
 approval = "审批"
 check = "检查"
@@ -6591,18 +6534,6 @@ signature = "签名"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "可嵌入的 SDK 小部件，可放入您自己的应用——查看器、电子签流程、AI 审核面板。每个都按操作计量。点击卡片查看安装、用法和 props。"
-title = "组件"
-
-[portal.componentsView.empty]
-description = "无法加载组件目录。请稍后重试。"
-title = "没有可用组件"
-
-[portal.componentsView.lockedBanner]
-description = "GA 组件在按量付费计划中可用；少数 Beta 组件仅限企业版。锁定的卡片会显示升级提示。"
-title = "部分组件需要付费计划"
-
 [portal.docs.authentication]
 codeCaption = "每个请求"
 eyebrow = "入门"
diff --git a/frontend/editor/public/locales/zh-TW/translation.toml b/frontend/editor/public/locales/zh-TW/translation.toml
index c0f9e5fe18..c6684c234e 100644
--- a/frontend/editor/public/locales/zh-TW/translation.toml
+++ b/frontend/editor/public/locales/zh-TW/translation.toml
@@ -6521,63 +6521,6 @@ title_other = "免費處理 {{allowance}} 個 PDFs"
 titleWithRate_one = "免費處理 {{allowance}} 個 PDFs，之後 {{rate}}/PDF"
 titleWithRate_other = "免費處理 {{allowance}} 個 PDFs，之後 {{rate}}/PDF"
 
-[portal.catalogue.card]
-lockedAriaLabel = "已鎖定"
-openAriaLabel = "開啟 {{name}} 元件"
-
-[portal.catalogue.detail]
-addToProject = "新增至專案"
-ariaLabel = "元件詳細資料"
-tabsAriaLabel = "元件詳細資料區段"
-upgradeToUnlock = "升級以解鎖"
-
-[portal.catalogue.detail.code]
-install = "安裝"
-usage = "使用方式"
-
-[portal.catalogue.detail.locked]
-description = "{{name}} 自 {{tier}} 方案起包含。升級以嵌入它。"
-title = "您的方案不提供"
-
-[portal.catalogue.detail.preview]
-badge = "即時預覽"
-note = "互動式 sandbox 會在此呈現"
-
-[portal.catalogue.detail.pricing]
-note = "依每 {{unit}} 計量。超過每月免費額度的使用量會向您的帳戶收費，並列於 Usage & Billing 下。"
-
-[portal.catalogue.detail.stats]
-billedOn = "計費依據"
-embeds30d = "嵌入（30 天）"
-freeQuota = "免費額度"
-freeQuotaValue = "{{amount}} / 月"
-maturity = "成熟度"
-none = "無"
-perAction = "每次動作"
-price = "價格"
-
-[portal.catalogue.detail.tabs]
-code = "Code"
-overview = "概觀"
-pricing = "價格"
-props = "Props / API"
-
-[portal.catalogue.props]
-optional = "選填"
-required = "必填"
-
-[portal.catalogue.props.columns]
-description = "描述"
-name = "Prop"
-required = "必填"
-type = "類型"
-
-[portal.catalogue.summary]
-componentsGa = "Components GA"
-componentSpendMtd = "元件支出（MTD）"
-embedsThisMonth = "本月嵌入"
-inBeta = "Beta 中"
-
 [portal.components.billingUnit]
 approval = "核准"
 check = "檢查"
@@ -6591,18 +6534,6 @@ signature = "簽章"
 beta = "Beta"
 ga = "GA"
 
-[portal.componentsView]
-subtitle = "可嵌入的 SDK 小工具，可放入您自己的應用程式 — 檢視器、電子簽流程、AI 審查面板。每個都依動作計量。點選卡片以查看安裝、使用方式和 props。"
-title = "元件"
-
-[portal.componentsView.empty]
-description = "無法載入元件目錄。請稍後再試。"
-title = "沒有可用元件"
-
-[portal.componentsView.lockedBanner]
-description = "GA 元件可在 Pay-as-you-go 使用；少數 Beta 元件僅限企業使用。鎖定的卡片會顯示升級提示。"
-title = "部分元件需要付費方案"
-
 [portal.docs.authentication]
 codeCaption = "每個請求"
 eyebrow = "開始使用"
diff --git a/frontend/editor/src/portal-saas/components/sidebarGroups.tsx b/frontend/editor/src/portal-saas/components/sidebarGroups.tsx
index 1503d6a1e3..3301f567d5 100644
--- a/frontend/editor/src/portal-saas/components/sidebarGroups.tsx
+++ b/frontend/editor/src/portal-saas/components/sidebarGroups.tsx
@@ -1,18 +1,11 @@
 import {
   GROUP_PRIMARY,
-  GROUP_OPERATIONAL as BASE_OPERATIONAL,
+  GROUP_OPERATIONAL,
   GROUP_PLATFORM,
   type NavEntry,
 } from "@portal-proprietary/components/sidebarGroups";
 
-export { GROUP_PRIMARY, GROUP_PLATFORM };
+// SaaS shadows the base nav groups so sections not yet shipped there can be
+// dropped. Nothing is currently removed, so the base groups pass through as-is.
+export { GROUP_PRIMARY, GROUP_OPERATIONAL, GROUP_PLATFORM };
 export type { NavEntry };
-
-/**
- * SaaS pre-release: the Components section isn't shipped there yet, so drop it
- * from the operational nav. Everything else is inherited from the base groups, so
- * new nav items appear in SaaS automatically — only Components is removed here.
- */
-export const GROUP_OPERATIONAL: NavEntry[] = BASE_OPERATIONAL.filter(
-  (entry) => entry.id !== "components",
-);
diff --git a/frontend/editor/src/portal/ViewRouter.tsx b/frontend/editor/src/portal/ViewRouter.tsx
index 4419455a4c..44d370ff49 100644
--- a/frontend/editor/src/portal/ViewRouter.tsx
+++ b/frontend/editor/src/portal/ViewRouter.tsx
@@ -8,7 +8,6 @@ import { Sources } from "@portal/views/Sources";
 import { SourceBuilder } from "@portal/views/SourceBuilder";
 import { AgentBuilder } from "@portal/views/AgentBuilder";
 import { Policies } from "@portal/views/Policies";
-import { Components } from "@portal/views/Components";
 import { EditorAdmin } from "@portal/views/EditorAdmin";
 import { Infrastructure } from "@portal/views/Infrastructure";
 import { PortalBillingGate } from "@portal/components/billing/PortalBillingGate";
@@ -51,7 +50,6 @@ export function ViewRouter() {
       />
       <Route path={rel(VIEW_PATHS.policies)} element={<Policies />} />
       <Route path={rel(VIEW_PATHS.documents)} element={<Documents />} />
-      <Route path={rel(VIEW_PATHS.components)} element={<Components />} />
       <Route path={rel(VIEW_PATHS.editor)} element={<EditorAdmin />} />
       <Route
         path={rel(VIEW_PATHS.infrastructure)}
diff --git a/frontend/editor/src/portal/api/sdkComponents.ts b/frontend/editor/src/portal/api/sdkComponents.ts
deleted file mode 100644
index 99b3b547ef..0000000000
--- a/frontend/editor/src/portal/api/sdkComponents.ts
+++ /dev/null
@@ -1,138 +0,0 @@
-import { apiClient } from "@portal/api/http";
-import type { Tier } from "@portal/contexts/TierContext";
-
-/*
- * "Components" are embeddable React/Vue/Vanilla SDK widgets a developer drops
- * into their own product — a PDF Viewer, an E-Sign flow, an AI Review panel —
- * each metered per action (per render, per review, per signature). Every
- * component carries its npm package, maturity, supported frameworks, per-action
- * price, an install/usage snippet, and its key props.
- */
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Types                                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-export type ComponentMaturity = "ga" | "beta";
-
-export type Framework = "React" | "Vue" | "Vanilla";
-
-/** The action a component bills against — surfaces in the price unit label. */
-export type BillingUnit =
-  | "render"
-  | "review"
-  | "approval"
-  | "signature"
-  | "check"
-  | "event"
-  | "session";
-
-export interface ComponentProp {
-  name: string;
-  /** TypeScript-ish type expression, shown verbatim in the API table. */
-  type: string;
-  required: boolean;
-  description: string;
-}
-
-export interface ComponentPricing {
-  /** Price per billed action in USD. */
-  pricePerAction: number;
-  unit: BillingUnit;
-  /** Free-tier monthly allowance before metering kicks in; 0 = none. */
-  freeQuota: number;
-}
-
-export interface SdkComponent {
-  id: string;
-  name: string;
-  /** Package suffix — full name is `@stirling/<package>`. */
-  package: string;
-  description: string;
-  maturity: ComponentMaturity;
-  frameworks: Framework[];
-  pricing: ComponentPricing;
-  /** Install command (npm). */
-  install: string;
-  /** Minimal usage snippet shown under the Code tab. */
-  usage: string;
-  props: ComponentProp[];
-  /**
-   * Embeds attributed to this component over the trailing 30 days — drives the
-   * per-card usage line. Zero for never-embedded components.
-   */
-  embeds30d: number;
-  /**
-   * Tier at which the component becomes available. Components above the active
-   * tier render locked with an upgrade nudge. `pro` is the default floor.
-   */
-  minTier: Tier;
-}
-
-export interface ComponentsSummary {
-  /** Count of GA (production-ready) components available to the tier. */
-  gaCount: number;
-  /** Count of Beta components available to the tier. */
-  betaCount: number;
-  /** Total embeds across all components this month. */
-  embedsThisMonth: number;
-  /** Month-to-date spend attributed to component actions, in USD. */
-  spendThisMonth: number;
-}
-
-export interface ComponentsResponse {
-  summary: ComponentsSummary;
-  components: SdkComponent[];
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Presentation metadata (client-side product copy, not data)              */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-export interface MaturityMeta {
-  label: string;
-  tone: "success" | "info";
-}
-
-/** `label` values are i18n keys — render with t(). */
-export const MATURITY_META: Record<ComponentMaturity, MaturityMeta> = {
-  ga: { label: "portal.components.maturity.ga", tone: "success" },
-  beta: { label: "portal.components.maturity.beta", tone: "info" },
-};
-
-/** Values are i18n keys — render with t(). */
-export const BILLING_UNIT_LABEL: Record<BillingUnit, string> = {
-  render: "portal.components.billingUnit.render",
-  review: "portal.components.billingUnit.review",
-  approval: "portal.components.billingUnit.approval",
-  signature: "portal.components.billingUnit.signature",
-  check: "portal.components.billingUnit.check",
-  event: "portal.components.billingUnit.event",
-  session: "portal.components.billingUnit.session",
-};
-
-/** Format a price as the per-action string shown on cards, e.g. "$0.04 / review". */
-export function formatPrice(
-  pricing: ComponentPricing,
-  t: (key: string) => string,
-): string {
-  return `$${pricing.pricePerAction.toFixed(2)} / ${t(BILLING_UNIT_LABEL[pricing.unit])}`;
-}
-
-const TIER_RANK: Record<Tier, number> = { free: 0, pro: 1, enterprise: 2 };
-
-/** Whether a component is usable at the given tier (vs locked/upgrade). */
-export function isUnlocked(component: SdkComponent, tier: Tier): boolean {
-  return TIER_RANK[tier] >= TIER_RANK[component.minTier];
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Endpoints                                                                */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-/** GET /v1/components?tier=… — summary strip + the embeddable SDK catalogue. */
-export async function fetchComponents(tier: Tier): Promise<ComponentsResponse> {
-  return apiClient.local.json<ComponentsResponse>(
-    `/v1/components?tier=${encodeURIComponent(tier)}`,
-  );
-}
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentCard.stories.tsx b/frontend/editor/src/portal/components/catalogue/ComponentCard.stories.tsx
deleted file mode 100644
index 0b6c284d93..0000000000
--- a/frontend/editor/src/portal/components/catalogue/ComponentCard.stories.tsx
+++ /dev/null
@@ -1,27 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { componentsFor } from "@portal/mocks/sdkComponents";
-import { ComponentCard } from "@portal/components/catalogue/ComponentCard";
-
-const PRO = componentsFor("pro");
-const GA = PRO.find((c) => c.maturity === "ga")!;
-const BETA = PRO.find((c) => c.maturity === "beta")!;
-
-const meta: Meta<typeof ComponentCard> = {
-  title: "Portal/Components/ComponentCard",
-  component: ComponentCard,
-  parameters: { layout: "padded" },
-  args: { component: GA, unlocked: true, onOpen: () => {} },
-};
-export default meta;
-type Story = StoryObj<typeof ComponentCard>;
-
-export const GeneralAvailability: Story = {};
-
-export const Beta: Story = {
-  args: { component: BETA },
-};
-
-/** Sits above the tier — dimmed with a lock affordance. */
-export const Locked: Story = {
-  args: { component: BETA, unlocked: false },
-};
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentCard.tsx b/frontend/editor/src/portal/components/catalogue/ComponentCard.tsx
deleted file mode 100644
index 5357ffd52f..0000000000
--- a/frontend/editor/src/portal/components/catalogue/ComponentCard.tsx
+++ /dev/null
@@ -1,79 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { Card, Chip, StatusBadge } from "@app/ui";
-import {
-  type SdkComponent,
-  MATURITY_META,
-  formatPrice,
-} from "@portal/api/sdkComponents";
-import "@portal/views/Components.css";
-
-interface ComponentCardProps {
-  component: SdkComponent;
-  /** False when the component sits above the active tier — renders locked. */
-  unlocked: boolean;
-  onOpen: (component: SdkComponent) => void;
-}
-
-/** A single catalogue tile: name, maturity, description, price and frameworks. */
-export function ComponentCard({
-  component,
-  unlocked,
-  onOpen,
-}: ComponentCardProps) {
-  const { t } = useTranslation();
-  const maturity = MATURITY_META[component.maturity];
-
-  return (
-    <Card
-      interactive
-      padding="default"
-      className={"portal-components__card" + (unlocked ? "" : " is-locked")}
-      role="button"
-      tabIndex={0}
-      aria-label={t("portal.catalogue.card.openAriaLabel", {
-        name: component.name,
-      })}
-      onClick={() => onOpen(component)}
-      onKeyDown={(e) => {
-        if (e.key === "Enter" || e.key === " ") {
-          e.preventDefault();
-          onOpen(component);
-        }
-      }}
-    >
-      <div className="portal-components__card-head">
-        <h3 className="portal-components__card-name">{component.name}</h3>
-        <StatusBadge tone={maturity.tone} size="sm" showDot={false}>
-          {t(maturity.label)}
-        </StatusBadge>
-        {!unlocked && (
-          <span
-            className="portal-components__lock"
-            aria-label={t("portal.catalogue.card.lockedAriaLabel")}
-          >
-            🔒
-          </span>
-        )}
-      </div>
-
-      <p className="portal-components__card-desc">{component.description}</p>
-
-      <div className="portal-components__card-meta">
-        <span className="portal-components__price">
-          {formatPrice(component.pricing, t)}
-        </span>
-        <span className="portal-components__pkg">
-          @stirling/{component.package}
-        </span>
-      </div>
-
-      <div className="portal-components__frameworks">
-        {component.frameworks.map((fw) => (
-          <Chip key={fw} size="sm">
-            {fw}
-          </Chip>
-        ))}
-      </div>
-    </Card>
-  );
-}
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.stories.tsx b/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.stories.tsx
deleted file mode 100644
index 7a8be30dde..0000000000
--- a/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.stories.tsx
+++ /dev/null
@@ -1,27 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { componentsFor } from "@portal/mocks/sdkComponents";
-import { ComponentDetailModal } from "@portal/components/catalogue/ComponentDetailModal";
-
-const PRO = componentsFor("pro");
-const VIEWER = PRO.find((c) => c.id === "viewer")!;
-const TOOLKIT = PRO.find((c) => c.id === "toolkit")!;
-
-const meta: Meta<typeof ComponentDetailModal> = {
-  title: "Portal/Components/ComponentDetailModal",
-  component: ComponentDetailModal,
-  parameters: { layout: "fullscreen" },
-  args: { component: VIEWER, unlocked: true, onClose: () => {} },
-};
-export default meta;
-type Story = StoryObj<typeof ComponentDetailModal>;
-
-export const Unlocked: Story = {};
-
-/** Enterprise-only component opened on a lower tier — shows the upgrade nudge. */
-export const Locked: Story = {
-  args: { component: TOOLKIT, unlocked: false },
-};
-
-export const Closed: Story = {
-  args: { component: null },
-};
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx b/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx
deleted file mode 100644
index 0599d80d72..0000000000
--- a/frontend/editor/src/portal/components/catalogue/ComponentDetailModal.tsx
+++ /dev/null
@@ -1,233 +0,0 @@
-import { useState } from "react";
-import { useTranslation } from "react-i18next";
-import {
-  Banner,
-  Button,
-  Chip,
-  CodeBlock,
-  Modal,
-  StatTile,
-  StatusBadge,
-  Tabs,
-} from "@app/ui";
-import {
-  type SdkComponent,
-  BILLING_UNIT_LABEL,
-  MATURITY_META,
-  formatPrice,
-} from "@portal/api/sdkComponents";
-import { TIER_INFO } from "@portal/contexts/TierContext";
-import { ComponentPropsTable } from "@portal/components/catalogue/ComponentPropsTable";
-import "@portal/views/Components.css";
-
-type DetailTab = "overview" | "code" | "props" | "pricing";
-
-const TAB_KEYS: DetailTab[] = ["overview", "code", "props", "pricing"];
-
-interface ComponentDetailModalProps {
-  component: SdkComponent | null;
-  /** False when the open component sits above the active tier. */
-  unlocked: boolean;
-  onClose: () => void;
-}
-
-/**
- * Detail overlay for a catalogue component: a live-preview placeholder plus
- * Overview / Code / Props / Pricing tabs. Locked components swap the install
- * CTA for an upgrade nudge.
- */
-export function ComponentDetailModal({
-  component,
-  unlocked,
-  onClose,
-}: ComponentDetailModalProps) {
-  const { t } = useTranslation();
-  const [tab, setTab] = useState<DetailTab>("overview");
-
-  // Reset to the first tab whenever a new component is opened.
-  const open = component !== null;
-  if (!component) {
-    return (
-      <Modal
-        open={false}
-        onClose={onClose}
-        ariaLabel={t("portal.catalogue.detail.ariaLabel")}
-      />
-    );
-  }
-
-  const tabs = TAB_KEYS.map((key) => ({
-    key,
-    label: t(`portal.catalogue.detail.tabs.${key}`),
-  }));
-
-  const maturity = MATURITY_META[component.maturity];
-  const npm = `@stirling/${component.package}`;
-
-  return (
-    <Modal
-      key={component.id}
-      open={open}
-      onClose={() => {
-        onClose();
-        setTab("overview");
-      }}
-      width="xl"
-      title={
-        <span className="portal-components__modal-title">
-          {component.name}
-          <StatusBadge tone={maturity.tone} size="sm" showDot={false}>
-            {t(maturity.label)}
-          </StatusBadge>
-        </span>
-      }
-      subtitle={npm}
-      footer={
-        unlocked ? (
-          <div className="portal-components__modal-footer">
-            <span className="portal-components__price">
-              {formatPrice(component.pricing, t)}
-            </span>
-            <Button
-              size="sm"
-              // TODO(backend): open the package quickstart / provision a
-              // publishable key scoped to this component.
-              onClick={() => onClose()}
-            >
-              {t("portal.catalogue.detail.addToProject")}
-            </Button>
-          </div>
-        ) : (
-          <Button
-            size="sm"
-            accent="premium"
-            // TODO(backend): route to the upgrade / contact-sales flow.
-            onClick={() => onClose()}
-          >
-            {t("portal.catalogue.detail.upgradeToUnlock")}
-          </Button>
-        )
-      }
-    >
-      {!unlocked && (
-        <Banner
-          tone="warning"
-          title={t("portal.catalogue.detail.locked.title")}
-          description={t("portal.catalogue.detail.locked.description", {
-            name: component.name,
-            plan: t(TIER_INFO[component.minTier].labelKey),
-          })}
-        />
-      )}
-
-      {/* Live-preview sandbox — a styled placeholder until a real host mounts. */}
-      <div className="portal-components__preview" aria-hidden>
-        {/* TODO(backend)/host: mount the live <Sandbox> here, booting the
-            component against a demo document and the dev's publishable key. */}
-        <span className="portal-components__preview-badge">
-          {t("portal.catalogue.detail.preview.badge")}
-        </span>
-        <span className="portal-components__preview-note">
-          {t("portal.catalogue.detail.preview.note")}
-        </span>
-      </div>
-
-      <Tabs<DetailTab>
-        className="portal-components__tabs"
-        items={tabs}
-        activeKey={tab}
-        onChange={setTab}
-        variant="underline"
-        ariaLabel={t("portal.catalogue.detail.tabsAriaLabel")}
-      />
-
-      <div className="portal-components__tab-body">
-        {tab === "overview" && (
-          <div className="portal-components__overview">
-            <p className="portal-components__overview-desc">
-              {component.description}
-            </p>
-            <div className="portal-components__frameworks">
-              {component.frameworks.map((fw) => (
-                <Chip key={fw} size="sm">
-                  {fw}
-                </Chip>
-              ))}
-            </div>
-            <div className="portal-components__stat-grid">
-              <StatTile
-                label={t("portal.catalogue.detail.stats.maturity")}
-                value={t(maturity.label)}
-              />
-              <StatTile
-                label={t("portal.catalogue.detail.stats.price")}
-                value={formatPrice(component.pricing, t)}
-              />
-              <StatTile
-                label={t("portal.catalogue.detail.stats.freeQuota")}
-                value={
-                  component.pricing.freeQuota > 0
-                    ? t("portal.catalogue.detail.stats.freeQuotaValue", {
-                        amount: component.pricing.freeQuota.toLocaleString(),
-                      })
-                    : t("portal.catalogue.detail.stats.none")
-                }
-              />
-              <StatTile
-                label={t("portal.catalogue.detail.stats.embeds30d")}
-                value={component.embeds30d.toLocaleString()}
-              />
-            </div>
-          </div>
-        )}
-
-        {tab === "code" && (
-          <div className="portal-components__code">
-            <CodeBlock
-              code={component.install}
-              lang="bash"
-              caption={t("portal.catalogue.detail.code.install")}
-            />
-            <CodeBlock
-              code={component.usage}
-              lang="typescript"
-              caption={t("portal.catalogue.detail.code.usage")}
-            />
-          </div>
-        )}
-
-        {tab === "props" && <ComponentPropsTable props={component.props} />}
-
-        {tab === "pricing" && (
-          <div className="portal-components__pricing">
-            <div className="portal-components__stat-grid">
-              <StatTile
-                label={t("portal.catalogue.detail.stats.perAction")}
-                value={formatPrice(component.pricing, t)}
-              />
-              <StatTile
-                label={t("portal.catalogue.detail.stats.billedOn")}
-                value={t(BILLING_UNIT_LABEL[component.pricing.unit])}
-              />
-              <StatTile
-                label={t("portal.catalogue.detail.stats.freeQuota")}
-                value={
-                  component.pricing.freeQuota > 0
-                    ? t("portal.catalogue.detail.stats.freeQuotaValue", {
-                        amount: component.pricing.freeQuota.toLocaleString(),
-                      })
-                    : t("portal.catalogue.detail.stats.none")
-                }
-              />
-            </div>
-            <p className="portal-components__pricing-note">
-              {t("portal.catalogue.detail.pricing.note", {
-                unit: t(BILLING_UNIT_LABEL[component.pricing.unit]),
-              })}
-            </p>
-          </div>
-        )}
-      </div>
-    </Modal>
-  );
-}
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentGrid.stories.tsx b/frontend/editor/src/portal/components/catalogue/ComponentGrid.stories.tsx
deleted file mode 100644
index b11c302b60..0000000000
--- a/frontend/editor/src/portal/components/catalogue/ComponentGrid.stories.tsx
+++ /dev/null
@@ -1,24 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { componentsFor } from "@portal/mocks/sdkComponents";
-import { ComponentGrid } from "@portal/components/catalogue/ComponentGrid";
-
-const meta: Meta<typeof ComponentGrid> = {
-  title: "Portal/Components/ComponentGrid",
-  component: ComponentGrid,
-  parameters: { layout: "padded" },
-  args: { components: componentsFor("pro"), tier: "pro", onOpen: () => {} },
-};
-export default meta;
-type Story = StoryObj<typeof ComponentGrid>;
-
-export const Pro: Story = {};
-
-/** Free locks every paid component — the whole grid shows upgrade nudges. */
-export const Free: Story = {
-  args: { components: componentsFor("free"), tier: "free" },
-};
-
-/** Enterprise unlocks the enterprise-only Beta components. */
-export const Enterprise: Story = {
-  args: { components: componentsFor("enterprise"), tier: "enterprise" },
-};
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentGrid.tsx b/frontend/editor/src/portal/components/catalogue/ComponentGrid.tsx
deleted file mode 100644
index 140f71c07f..0000000000
--- a/frontend/editor/src/portal/components/catalogue/ComponentGrid.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-import { type SdkComponent, isUnlocked } from "@portal/api/sdkComponents";
-import type { Tier } from "@portal/contexts/TierContext";
-import { ComponentCard } from "@portal/components/catalogue/ComponentCard";
-import "@portal/views/Components.css";
-
-interface ComponentGridProps {
-  components: SdkComponent[];
-  tier: Tier;
-  onOpen: (component: SdkComponent) => void;
-}
-
-/** Responsive grid of catalogue cards; locks components above the tier. */
-export function ComponentGrid({
-  components,
-  tier,
-  onOpen,
-}: ComponentGridProps) {
-  return (
-    <div className="portal-components__grid">
-      {components.map((c) => (
-        <ComponentCard
-          key={c.id}
-          component={c}
-          unlocked={isUnlocked(c, tier)}
-          onOpen={onOpen}
-        />
-      ))}
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentPropsTable.stories.tsx b/frontend/editor/src/portal/components/catalogue/ComponentPropsTable.stories.tsx
deleted file mode 100644
index 7ac11e6593..0000000000
--- a/frontend/editor/src/portal/components/catalogue/ComponentPropsTable.stories.tsx
+++ /dev/null
@@ -1,16 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { componentsFor } from "@portal/mocks/sdkComponents";
-import { ComponentPropsTable } from "@portal/components/catalogue/ComponentPropsTable";
-
-const VIEWER = componentsFor("pro").find((c) => c.id === "viewer")!;
-
-const meta: Meta<typeof ComponentPropsTable> = {
-  title: "Portal/Components/ComponentPropsTable",
-  component: ComponentPropsTable,
-  parameters: { layout: "padded" },
-  args: { props: VIEWER.props },
-};
-export default meta;
-type Story = StoryObj<typeof ComponentPropsTable>;
-
-export const Default: Story = {};
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentPropsTable.tsx b/frontend/editor/src/portal/components/catalogue/ComponentPropsTable.tsx
deleted file mode 100644
index 9a87fc3c0d..0000000000
--- a/frontend/editor/src/portal/components/catalogue/ComponentPropsTable.tsx
+++ /dev/null
@@ -1,62 +0,0 @@
-import { useMemo } from "react";
-import { useTranslation } from "react-i18next";
-import { Chip, Table, type TableColumn } from "@app/ui";
-import type { ComponentProp } from "@portal/api/sdkComponents";
-import "@portal/views/Components.css";
-
-interface ComponentPropsTableProps {
-  props: ComponentProp[];
-}
-
-/** Small Props/API reference shown under the detail modal's Props tab. */
-export function ComponentPropsTable({ props: rows }: ComponentPropsTableProps) {
-  const { t } = useTranslation();
-  const columns = useMemo<TableColumn<ComponentProp>[]>(
-    () => [
-      {
-        key: "name",
-        header: t("portal.catalogue.props.columns.name"),
-        render: (p) => (
-          <span className="portal-components__prop-name">{p.name}</span>
-        ),
-      },
-      {
-        key: "type",
-        header: t("portal.catalogue.props.columns.type"),
-        render: (p) => (
-          <code className="portal-components__prop-type">{p.type}</code>
-        ),
-      },
-      {
-        key: "required",
-        header: t("portal.catalogue.props.columns.required"),
-        render: (p) =>
-          p.required ? (
-            <Chip size="sm" accent="warning">
-              {t("portal.catalogue.props.required")}
-            </Chip>
-          ) : (
-            <span className="portal-components__muted">
-              {t("portal.catalogue.props.optional")}
-            </span>
-          ),
-      },
-      {
-        key: "description",
-        header: t("portal.catalogue.props.columns.description"),
-        render: (p) => (
-          <span className="portal-components__prop-desc">{p.description}</span>
-        ),
-      },
-    ],
-    [t],
-  );
-
-  return (
-    <Table<ComponentProp>
-      columns={columns}
-      rows={rows}
-      rowKey={(p) => p.name}
-    />
-  );
-}
diff --git a/frontend/editor/src/portal/components/catalogue/ComponentsSummaryStrip.tsx b/frontend/editor/src/portal/components/catalogue/ComponentsSummaryStrip.tsx
deleted file mode 100644
index ccb3965a5c..0000000000
--- a/frontend/editor/src/portal/components/catalogue/ComponentsSummaryStrip.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { MetricCard, MetricStrip } from "@app/ui";
-import type { ComponentsResponse } from "@portal/api/sdkComponents";
-
-/**
- * Labels are product copy — they describe what each metric IS, not its value,
- * so the strip's structure stays stable across loading / empty / ready states.
- * Only values flow from the API.
- */
-const KPI_LABEL_KEYS = [
-  "portal.catalogue.summary.componentsGa",
-  "portal.catalogue.summary.inBeta",
-  "portal.catalogue.summary.embedsThisMonth",
-  "portal.catalogue.summary.componentSpendMtd",
-] as const;
-
-interface ComponentsSummaryStripProps {
-  data: ComponentsResponse | null;
-  loading: boolean;
-}
-
-export function ComponentsSummaryStrip({
-  data,
-  loading,
-}: ComponentsSummaryStripProps) {
-  const { t } = useTranslation();
-  const s = loading ? undefined : data?.summary;
-  const values: (string | number)[] = [
-    s?.gaCount ?? "—",
-    s?.betaCount ?? "—",
-    s ? s.embedsThisMonth.toLocaleString() : "—",
-    s ? `$${s.spendThisMonth.toLocaleString()}` : "—",
-  ];
-
-  return (
-    <MetricStrip>
-      {KPI_LABEL_KEYS.map((labelKey, i) => (
-        <MetricCard key={labelKey} label={t(labelKey)} value={values[i]} />
-      ))}
-    </MetricStrip>
-  );
-}
diff --git a/frontend/editor/src/portal/components/icons.tsx b/frontend/editor/src/portal/components/icons.tsx
index 8f8609648c..ed8e6454ff 100644
--- a/frontend/editor/src/portal/components/icons.tsx
+++ b/frontend/editor/src/portal/components/icons.tsx
@@ -221,17 +221,6 @@ export function PoliciesIcon(props: IconProps) {
   );
 }
 
-export function ComponentsIcon(props: IconProps) {
-  return (
-    <Svg {...props}>
-      <rect x="3" y="3" width="7" height="7" rx="1" />
-      <rect x="14" y="3" width="7" height="7" rx="1" />
-      <rect x="3" y="14" width="7" height="7" rx="1" />
-      <rect x="14" y="14" width="7" height="7" rx="1" />
-    </Svg>
-  );
-}
-
 export function AgentBuilderIcon(props: IconProps) {
   return (
     <Svg {...props}>
diff --git a/frontend/editor/src/portal/components/sidebarGroups.tsx b/frontend/editor/src/portal/components/sidebarGroups.tsx
index 71b7539412..32e1ce116c 100644
--- a/frontend/editor/src/portal/components/sidebarGroups.tsx
+++ b/frontend/editor/src/portal/components/sidebarGroups.tsx
@@ -7,7 +7,6 @@ import {
   PoliciesIcon,
   PipelinesIcon,
   DocumentsIcon,
-  ComponentsIcon,
   InfrastructureIcon,
   UsageIcon,
   DocsIcon,
@@ -34,7 +33,6 @@ export const GROUP_OPERATIONAL: NavEntry[] = [
   { id: "policies", icon: <PoliciesIcon /> },
   { id: "pipelines", icon: <PipelinesIcon /> },
   { id: "documents", icon: <DocumentsIcon /> },
-  { id: "components", icon: <ComponentsIcon /> },
 ];
 
 export const GROUP_PLATFORM: NavEntry[] = [
diff --git a/frontend/editor/src/portal/contexts/ViewContext.tsx b/frontend/editor/src/portal/contexts/ViewContext.tsx
index dd8d207944..6fc7a6eba2 100644
--- a/frontend/editor/src/portal/contexts/ViewContext.tsx
+++ b/frontend/editor/src/portal/contexts/ViewContext.tsx
@@ -11,7 +11,6 @@ export type ViewId =
   | "policies"
   | "pipelines"
   | "documents"
-  | "components"
   | "infrastructure"
   | "usage"
   | "docs"
@@ -27,7 +26,6 @@ export const VIEW_LABELS: Record<ViewId, string> = {
   policies: "Policies",
   pipelines: "Pipelines",
   documents: "Documents",
-  components: "Components",
   infrastructure: "Infrastructure",
   usage: "Usage & Billing",
   docs: "Developer Docs",
@@ -44,7 +42,6 @@ export const VIEW_PATHS: Record<ViewId, string> = {
   policies: "/policies",
   pipelines: "/pipelines",
   documents: "/documents",
-  components: "/components",
   infrastructure: "/infrastructure",
   usage: "/usage",
   docs: "/docs",
diff --git a/frontend/editor/src/portal/mocks/handlers/index.ts b/frontend/editor/src/portal/mocks/handlers/index.ts
index 2e50a14eb1..29d7415c61 100644
--- a/frontend/editor/src/portal/mocks/handlers/index.ts
+++ b/frontend/editor/src/portal/mocks/handlers/index.ts
@@ -14,7 +14,6 @@ import { agentsHandlers } from "@portal/mocks/handlers/agents";
 import { policiesHandlers } from "@portal/mocks/handlers/policies";
 import { classificationHandlers } from "@portal/mocks/handlers/classification";
 import { documentsHandlers } from "@portal/mocks/handlers/documents";
-import { sdkComponentsHandlers } from "@portal/mocks/handlers/sdkComponents";
 import { editorDeployHandlers } from "@portal/mocks/handlers/editorDeploy";
 import { linkHandlers } from "@portal/mocks/handlers/link";
 
@@ -35,7 +34,6 @@ export const handlers = [
   ...policiesHandlers,
   ...classificationHandlers,
   ...documentsHandlers,
-  ...sdkComponentsHandlers,
   ...editorDeployHandlers,
   ...linkHandlers,
 ];
diff --git a/frontend/editor/src/portal/mocks/handlers/sdkComponents.ts b/frontend/editor/src/portal/mocks/handlers/sdkComponents.ts
deleted file mode 100644
index 9cceaefdd7..0000000000
--- a/frontend/editor/src/portal/mocks/handlers/sdkComponents.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import { http, HttpResponse, delay } from "msw";
-import type { Tier } from "@portal/contexts/TierContext";
-import { buildComponentsResponse } from "@portal/mocks/sdkComponents";
-
-export const sdkComponentsHandlers = [
-  http.get("/v1/components", async ({ request }) => {
-    await delay(120);
-    const url = new URL(request.url);
-    const tier = (url.searchParams.get("tier") ?? "pro") as Tier;
-    return HttpResponse.json(buildComponentsResponse(tier));
-  }),
-];
diff --git a/frontend/editor/src/portal/mocks/sdkComponents.ts b/frontend/editor/src/portal/mocks/sdkComponents.ts
deleted file mode 100644
index f86797637c..0000000000
--- a/frontend/editor/src/portal/mocks/sdkComponents.ts
+++ /dev/null
@@ -1,413 +0,0 @@
-/**
- * Components surface fixtures. Types and presentation metadata live in
- * api/sdkComponents.ts (the backend contract); this module only builds fake
- * data for Storybook and tests.
- *
- * "Components" are embeddable React/Vue/Vanilla SDK widgets a developer drops
- * into their own product — a PDF Viewer, an E-Sign flow, an AI Review panel —
- * each metered per action (per render, per review, per signature). Every
- * component carries its npm package, maturity, supported frameworks, per-action
- * price, an install/usage snippet, and its key props.
- */
-
-import { isUnlocked } from "@portal/api/sdkComponents";
-import type {
-  ComponentPricing,
-  ComponentsResponse,
-  ComponentsSummary,
-  SdkComponent,
-} from "@portal/api/sdkComponents";
-import type { Tier } from "@portal/contexts/TierContext";
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Fixtures                                                                 */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-/**
- * The catalogue. Authored once, then filtered/repriced per tier so a dev can
- * see tier variation (locked Beta components on free, enterprise discounts).
- */
-const CATALOGUE: SdkComponent[] = [
-  {
-    id: "viewer",
-    name: "Viewer",
-    package: "viewer",
-    description:
-      "Drop-in PDF viewer with text selection, search, thumbnails and lazy page rendering. The cheapest, highest-volume primitive.",
-    maturity: "ga",
-    frameworks: ["React", "Vue", "Vanilla"],
-    pricing: { pricePerAction: 0.01, unit: "render", freeQuota: 1000 },
-    install: "npm install @stirling/viewer",
-    usage: `import { Viewer } from "@stirling/viewer";
-
-export function DocumentPage({ fileUrl }: { fileUrl: string }) {
-  return (
-    <Viewer
-      src={fileUrl}
-      apiKey={process.env.STIRLING_KEY}
-      onRender={(p) => console.log("rendered page", p.page)}
-    />
-  );
-}`,
-    props: [
-      {
-        name: "src",
-        type: "string | Blob",
-        required: true,
-        description: "Document URL or in-memory blob to render.",
-      },
-      {
-        name: "apiKey",
-        type: "string",
-        required: true,
-        description: "Publishable key used to meter renders.",
-      },
-      {
-        name: "initialPage",
-        type: "number",
-        required: false,
-        description: "Page to open on first render. Defaults to 1.",
-      },
-      {
-        name: "onRender",
-        type: "(e: RenderEvent) => void",
-        required: false,
-        description: "Fires per rendered page — one billed render each.",
-      },
-    ],
-    embeds30d: 184200,
-    minTier: "pro",
-  },
-  {
-    id: "review",
-    name: "Review",
-    package: "review",
-    description:
-      "AI-assisted document review panel — surfaces extracted fields, risks and suggested redactions for a human to accept or reject.",
-    maturity: "ga",
-    frameworks: ["React", "Vue"],
-    pricing: { pricePerAction: 0.04, unit: "review", freeQuota: 50 },
-    install: "npm install @stirling/review",
-    usage: `import { Review } from "@stirling/review";
-
-export function ReviewPane({ docId }: { docId: string }) {
-  return (
-    <Review
-      documentId={docId}
-      pipeline="invoice-v3"
-      apiKey={process.env.STIRLING_KEY}
-      onComplete={(r) => save(r.fields)}
-    />
-  );
-}`,
-    props: [
-      {
-        name: "documentId",
-        type: "string",
-        required: true,
-        description: "Id of an ingested document to review.",
-      },
-      {
-        name: "pipeline",
-        type: "string",
-        required: true,
-        description: "Pipeline whose extraction schema drives the panel.",
-      },
-      {
-        name: "onComplete",
-        type: "(r: ReviewResult) => void",
-        required: false,
-        description: "Called when the reviewer submits — bills one review.",
-      },
-    ],
-    embeds30d: 42800,
-    minTier: "pro",
-  },
-  {
-    id: "confidence",
-    name: "Confidence",
-    package: "confidence",
-    description:
-      "Inline confidence overlay — paints per-field certainty heatmaps over extracted values so reviewers triage low-confidence fields first.",
-    maturity: "ga",
-    frameworks: ["React", "Vue", "Vanilla"],
-    pricing: { pricePerAction: 0.02, unit: "check", freeQuota: 200 },
-    install: "npm install @stirling/confidence",
-    usage: `import { Confidence } from "@stirling/confidence";
-
-export function FieldOverlay({ result }: { result: ExtractResult }) {
-  return <Confidence fields={result.fields} threshold={0.85} />;
-}`,
-    props: [
-      {
-        name: "fields",
-        type: "ExtractedField[]",
-        required: true,
-        description: "Fields with per-value confidence scores.",
-      },
-      {
-        name: "threshold",
-        type: "number",
-        required: false,
-        description: "Highlight fields below this 0..1 score. Defaults to 0.8.",
-      },
-    ],
-    embeds30d: 31500,
-    minTier: "pro",
-  },
-  {
-    id: "approval",
-    name: "Approval",
-    package: "approval",
-    description:
-      "Routable approval flow — assign reviewers, collect sign-offs and enforce approval order before a document advances.",
-    maturity: "ga",
-    frameworks: ["React", "Vue"],
-    pricing: { pricePerAction: 0.1, unit: "approval", freeQuota: 0 },
-    install: "npm install @stirling/approval",
-    usage: `import { Approval } from "@stirling/approval";
-
-export function ApprovalGate({ docId }: { docId: string }) {
-  return (
-    <Approval
-      documentId={docId}
-      approvers={["ap@acme.com", "controller@acme.com"]}
-      order="sequential"
-      onApproved={() => advance(docId)}
-    />
-  );
-}`,
-    props: [
-      {
-        name: "documentId",
-        type: "string",
-        required: true,
-        description: "Document the approval gate guards.",
-      },
-      {
-        name: "approvers",
-        type: "string[]",
-        required: true,
-        description: "Ordered list of approver email addresses.",
-      },
-      {
-        name: "order",
-        type: '"sequential" | "parallel"',
-        required: false,
-        description: "Routing mode. Defaults to sequential.",
-      },
-    ],
-    embeds30d: 9600,
-    minTier: "pro",
-  },
-  {
-    id: "esign",
-    name: "E-Sign",
-    package: "esign",
-    description:
-      "Legally-binding e-signature ceremony — signer fields, audit-grade consent capture and a tamper-evident completion certificate.",
-    maturity: "ga",
-    frameworks: ["React", "Vue", "Vanilla"],
-    pricing: { pricePerAction: 0.35, unit: "signature", freeQuota: 0 },
-    install: "npm install @stirling/esign",
-    usage: `import { ESign } from "@stirling/esign";
-
-export function SignFlow({ docId }: { docId: string }) {
-  return (
-    <ESign
-      documentId={docId}
-      signers={[{ email: "client@acme.com", role: "signer" }]}
-      onSigned={(cert) => store(cert.certificateUrl)}
-    />
-  );
-}`,
-    props: [
-      {
-        name: "documentId",
-        type: "string",
-        required: true,
-        description: "Document to be signed.",
-      },
-      {
-        name: "signers",
-        type: "Signer[]",
-        required: true,
-        description: "Ordered signers with email + role.",
-      },
-      {
-        name: "onSigned",
-        type: "(c: Certificate) => void",
-        required: false,
-        description: "Fires on completion — bills one signature per signer.",
-      },
-    ],
-    embeds30d: 5400,
-    minTier: "pro",
-  },
-  {
-    id: "audit-trail",
-    name: "Audit Trail",
-    package: "audit-trail",
-    description:
-      "Read-only event timeline for a document — every render, edit, approval and signature, exportable as a compliance-grade ledger.",
-    maturity: "ga",
-    frameworks: ["React", "Vue"],
-    pricing: { pricePerAction: 0.01, unit: "event", freeQuota: 500 },
-    install: "npm install @stirling/audit-trail",
-    usage: `import { AuditTrail } from "@stirling/audit-trail";
-
-export function History({ docId }: { docId: string }) {
-  return <AuditTrail documentId={docId} export="pdf" />;
-}`,
-    props: [
-      {
-        name: "documentId",
-        type: "string",
-        required: true,
-        description: "Document whose events are shown.",
-      },
-      {
-        name: "export",
-        type: '"pdf" | "csv" | false',
-        required: false,
-        description: "Enable a ledger export button. Defaults to false.",
-      },
-    ],
-    embeds30d: 14200,
-    minTier: "pro",
-  },
-  {
-    id: "markup",
-    name: "Markup",
-    package: "markup",
-    description:
-      "Collaborative annotation layer — highlights, comments, stamps and freehand drawing synced live across reviewers.",
-    maturity: "beta",
-    frameworks: ["React", "Vue"],
-    pricing: { pricePerAction: 0.03, unit: "session", freeQuota: 25 },
-    install: "npm install @stirling/markup@beta",
-    usage: `import { Markup } from "@stirling/markup";
-
-export function AnnotateLayer({ docId }: { docId: string }) {
-  return (
-    <Markup
-      documentId={docId}
-      collaborative
-      tools={["highlight", "comment", "stamp"]}
-    />
-  );
-}`,
-    props: [
-      {
-        name: "documentId",
-        type: "string",
-        required: true,
-        description: "Document to annotate.",
-      },
-      {
-        name: "collaborative",
-        type: "boolean",
-        required: false,
-        description: "Enable live multi-user sync. Defaults to false.",
-      },
-      {
-        name: "tools",
-        type: "MarkupTool[]",
-        required: false,
-        description: "Visible annotation tools. Defaults to all.",
-      },
-    ],
-    embeds30d: 2100,
-    minTier: "pro",
-  },
-  {
-    id: "toolkit",
-    name: "Toolkit",
-    package: "toolkit",
-    description:
-      "Headless operations toolkit — merge, split, redact, compress and convert exposed as composable hooks with no UI of its own.",
-    maturity: "beta",
-    frameworks: ["React", "Vue", "Vanilla"],
-    pricing: { pricePerAction: 0.05, unit: "event", freeQuota: 0 },
-    install: "npm install @stirling/toolkit@beta",
-    usage: `import { useToolkit } from "@stirling/toolkit";
-
-export function MergeButton({ files }: { files: File[] }) {
-  const { merge } = useToolkit({ apiKey: process.env.STIRLING_KEY });
-  return <button onClick={() => merge(files)}>Merge</button>;
-}`,
-    props: [
-      {
-        name: "apiKey",
-        type: "string",
-        required: true,
-        description: "Publishable key used to meter operations.",
-      },
-      {
-        name: "operations",
-        type: "Operation[]",
-        required: false,
-        description: "Restrict the toolkit to a subset of operations.",
-      },
-    ],
-    // Beta + enterprise-only: still gated to design partners, never embedded
-    // on lower tiers.
-    embeds30d: 0,
-    minTier: "enterprise",
-  },
-];
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Tier shaping                                                             */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-/**
- * Enterprise negotiates volume pricing — renders and reviews come in cheaper.
- * Applied as a flat per-tier multiplier so the catalogue stays single-sourced.
- */
-function priceFor(component: SdkComponent, tier: Tier): ComponentPricing {
-  if (tier !== "enterprise") return component.pricing;
-  return {
-    ...component.pricing,
-    pricePerAction: Number((component.pricing.pricePerAction * 0.8).toFixed(3)),
-  };
-}
-
-/**
- * The catalogue for a tier. Every component is returned at every tier so the
- * grid is browsable — the view locks the ones above the tier and shows an
- * upgrade nudge. Pricing is re-stamped per tier.
- */
-export function componentsFor(tier: Tier): SdkComponent[] {
-  return CATALOGUE.map((c) => ({ ...c, pricing: priceFor(c, tier) }));
-}
-
-export function summaryFor(tier: Tier): ComponentsSummary {
-  const components = componentsFor(tier);
-  const unlocked = components.filter((c) => isUnlocked(c, tier));
-  const gaCount = unlocked.filter((c) => c.maturity === "ga").length;
-  const betaCount = unlocked.filter((c) => c.maturity === "beta").length;
-
-  if (tier === "free") {
-    // Free hasn't embedded anything yet — the strip reads as a cold start.
-    return { gaCount, betaCount, embedsThisMonth: 0, spendThisMonth: 0 };
-  }
-
-  const embedsThisMonth = unlocked.reduce((sum, c) => sum + c.embeds30d, 0);
-  // Spend = embeds beyond the free quota, billed at the tier price.
-  const spendThisMonth = unlocked.reduce((sum, c) => {
-    const billable = Math.max(0, c.embeds30d - c.pricing.freeQuota);
-    return sum + billable * c.pricing.pricePerAction;
-  }, 0);
-
-  return {
-    gaCount,
-    betaCount,
-    embedsThisMonth,
-    spendThisMonth: Number(spendThisMonth.toFixed(2)),
-  };
-}
-
-export function buildComponentsResponse(tier: Tier): ComponentsResponse {
-  return { summary: summaryFor(tier), components: componentsFor(tier) };
-}
diff --git a/frontend/editor/src/portal/views/Components.css b/frontend/editor/src/portal/views/Components.css
deleted file mode 100644
index c37cc7924a..0000000000
--- a/frontend/editor/src/portal/views/Components.css
+++ /dev/null
@@ -1,244 +0,0 @@
-.portal-components {
-  display: flex;
-  flex-direction: column;
-  gap: 1.25rem;
-  padding: 1.5rem;
-  max-width: 84rem;
-  margin: 0 auto;
-}
-
-/* Header */
-.portal-components__head {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 1rem;
-}
-
-.portal-components__title {
-  margin: 0;
-  font-size: 1.375rem;
-  font-weight: 650;
-  color: var(--color-text-1);
-}
-
-.portal-components__sub {
-  margin: 0.25rem 0 0;
-  font-size: 0.8125rem;
-  line-height: 1.5;
-  color: var(--color-text-3);
-  max-width: 46rem;
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Catalogue grid                                                           */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-.portal-components__grid,
-.portal-components__grid-skeleton {
-  display: grid;
-  grid-template-columns: repeat(auto-fill, minmax(18rem, 1fr));
-  gap: 1rem;
-}
-
-.portal-components__card {
-  display: flex;
-  flex-direction: column;
-  gap: 0.75rem;
-  cursor: pointer;
-  height: 100%;
-}
-
-/* Locked cards read as available-but-gated: dimmed, never disabled. */
-.portal-components__card.is-locked {
-  opacity: 0.7;
-}
-
-.portal-components__card-head {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-}
-
-.portal-components__card-name {
-  margin: 0;
-  font-size: 1rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-components__lock {
-  margin-left: auto;
-  font-size: 0.875rem;
-  line-height: 1;
-}
-
-.portal-components__card-desc {
-  margin: 0;
-  font-size: 0.8125rem;
-  line-height: 1.5;
-  color: var(--color-text-3);
-  flex: 1;
-}
-
-.portal-components__card-meta {
-  display: flex;
-  align-items: baseline;
-  justify-content: space-between;
-  gap: 0.5rem;
-}
-
-.portal-components__price {
-  font-family: var(--font-mono);
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-components__pkg {
-  font-family: var(--font-mono);
-  font-size: 0.6875rem;
-  color: var(--color-text-4);
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-}
-
-.portal-components__frameworks {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 0.375rem;
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Detail modal                                                             */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-.portal-components__modal-title {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.625rem;
-}
-
-.portal-components__modal-footer {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.75rem;
-  width: 100%;
-}
-
-/* Live-preview sandbox placeholder */
-.portal-components__preview {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  gap: 0.375rem;
-  min-height: 9rem;
-  margin-bottom: 1rem;
-  border: 1px dashed var(--color-border-strong, var(--color-border));
-  border-radius: var(--radius-lg);
-  background: repeating-linear-gradient(
-    45deg,
-    var(--color-bg-subtle),
-    var(--color-bg-subtle) 10px,
-    var(--color-surface) 10px,
-    var(--color-surface) 20px
-  );
-}
-
-.portal-components__preview-badge {
-  font-size: 0.6875rem;
-  font-weight: 600;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-  color: var(--color-blue);
-  padding: 0.1875rem 0.5rem;
-  border-radius: var(--radius-sm);
-  background: var(--color-blue-light);
-}
-
-.portal-components__preview-note {
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-}
-
-.portal-components__tabs {
-  margin-bottom: 1rem;
-}
-
-.portal-components__tab-body {
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-  min-height: 12rem;
-}
-
-.portal-components__overview {
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-}
-
-.portal-components__overview-desc {
-  margin: 0;
-  font-size: 0.875rem;
-  line-height: 1.55;
-  color: var(--color-text-2);
-}
-
-.portal-components__code {
-  display: flex;
-  flex-direction: column;
-  gap: 0.75rem;
-}
-
-.portal-components__stat-grid {
-  display: grid;
-  grid-template-columns: repeat(4, 1fr);
-  gap: 0.875rem;
-}
-
-@media (max-width: 48rem) {
-  .portal-components__stat-grid {
-    grid-template-columns: repeat(2, 1fr);
-  }
-}
-
-.portal-components__pricing {
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-}
-
-.portal-components__pricing-note {
-  margin: 0;
-  font-size: 0.8125rem;
-  line-height: 1.55;
-  color: var(--color-text-3);
-}
-
-/* Props table cells */
-.portal-components__prop-name {
-  font-family: var(--font-mono);
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-components__prop-type {
-  font-family: var(--font-mono);
-  font-size: 0.75rem;
-  color: var(--color-blue);
-}
-
-.portal-components__prop-desc {
-  font-size: 0.8125rem;
-  color: var(--color-text-3);
-}
-
-.portal-components__muted {
-  font-size: 0.8125rem;
-  color: var(--color-text-4);
-}
diff --git a/frontend/editor/src/portal/views/Components.tsx b/frontend/editor/src/portal/views/Components.tsx
deleted file mode 100644
index 4b2cc1aef6..0000000000
--- a/frontend/editor/src/portal/views/Components.tsx
+++ /dev/null
@@ -1,90 +0,0 @@
-import { useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Banner, EmptyState, Skeleton } from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import {
-  fetchComponents,
-  isUnlocked,
-  type ComponentsResponse,
-  type SdkComponent,
-} from "@portal/api/sdkComponents";
-import { ComponentsSummaryStrip } from "@portal/components/catalogue/ComponentsSummaryStrip";
-import { ComponentGrid } from "@portal/components/catalogue/ComponentGrid";
-import { ComponentDetailModal } from "@portal/components/catalogue/ComponentDetailModal";
-import "@portal/views/Components.css";
-
-export function Components() {
-  const { t } = useTranslation();
-  const { tier } = useTier();
-  const state = useAsync<ComponentsResponse>(
-    () => fetchComponents(tier),
-    [tier],
-  );
-  const { data, loading } = state;
-  const { isLoading, isEmpty } = useSectionFlags(state);
-
-  const [openId, setOpenId] = useState<string | null>(null);
-
-  const components = data?.components ?? [];
-  const open = components.find((c) => c.id === openId) ?? null;
-  const hasLocked = components.some((c) => !isUnlocked(c, tier));
-
-  function handleOpen(component: SdkComponent) {
-    setOpenId(component.id);
-  }
-
-  return (
-    <div className="portal-components">
-      <header className="portal-components__head">
-        <div>
-          <h1 className="portal-components__title">
-            {t("portal.componentsView.title")}
-          </h1>
-          <p className="portal-components__sub">
-            {t("portal.componentsView.subtitle")}
-          </p>
-        </div>
-      </header>
-
-      <ComponentsSummaryStrip data={data} loading={loading} />
-
-      {tier === "free" && hasLocked && (
-        <Banner
-          tone="info"
-          title={t("portal.componentsView.lockedBanner.title")}
-          description={t("portal.componentsView.lockedBanner.description")}
-        />
-      )}
-
-      {isLoading && (
-        <div className="portal-components__grid-skeleton" aria-hidden>
-          {Array.from({ length: 6 }).map((_, i) => (
-            <Skeleton key={i} height="11rem" />
-          ))}
-        </div>
-      )}
-
-      {isEmpty && (
-        <EmptyState
-          title={t("portal.componentsView.empty.title")}
-          description={t("portal.componentsView.empty.description")}
-        />
-      )}
-
-      {!isLoading && !isEmpty && components.length > 0 && (
-        <ComponentGrid
-          components={components}
-          tier={tier}
-          onOpen={handleOpen}
-        />
-      )}
-
-      <ComponentDetailModal
-        component={open}
-        unlocked={open ? isUnlocked(open, tier) : false}
-        onClose={() => setOpenId(null)}
-      />
-    </div>
-  );
-}

From da1be650eae0a5dd761f2c3c7c2a23146a925d12 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:49:15 +0100
Subject: [PATCH 029/109] Portal Billing: use design tokens for colours (#6996)

# Description of Changes

Swaps off-palette hard-coded blues/cyans on the usage & billing page for
shared design tokens, so button and meter colours match the rest of the
portal in both themes.

Part of a portal (processor) UI-consistency pass, split into small
focused PRs.

## Before / after
<img width="2816" height="1000" alt="after-billing-free"
src="https://github.com/user-attachments/assets/1f6acad3-56a1-47a8-b5f5-8cc25565492b"
/>
<img width="2816" height="2048" alt="after-billing-subscribed-dark"
src="https://github.com/user-attachments/assets/35a75057-bdf5-4143-bdfa-4dbe94b5429e"
/>
<img width="2816" height="2048" alt="after-billing-subscribed-light"
src="https://github.com/user-attachments/assets/f9e7eab8-7d01-4d29-b842-b5d38adf7780"
/>
<img width="2816" height="1000" alt="before-billing-free"
src="https://github.com/user-attachments/assets/c7e5eca6-a57a-4959-9781-fd664dbca576"
/>
<img width="2816" height="2004" alt="before-billing-subscribed-dark"
src="https://github.com/user-attachments/assets/d7fc08be-7b91-4803-bd50-3301b886e1c0"
/>
<img width="2816" height="2004" alt="before-billing-subscribed-light"
src="https://github.com/user-attachments/assets/ff430ec1-c3bb-4517-b6b5-2150c566eca4"
/>


---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [x] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../components/billing/EnterpriseUpsell.tsx   |  6 +-
 .../src/portal/components/billing/billing.css | 96 ++++++++++---------
 2 files changed, 54 insertions(+), 48 deletions(-)

diff --git a/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx b/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx
index 3e6a9859dd..161b3bea72 100644
--- a/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx
+++ b/frontend/editor/src/portal/components/billing/EnterpriseUpsell.tsx
@@ -35,7 +35,11 @@ export function EnterpriseUpsell({ bare = false }: Props) {
             )}
           </p>
         </div>
-        <Button size="sm" onClick={() => setActiveView("procurement")}>
+        <Button
+          size="sm"
+          variant="secondary"
+          onClick={() => setActiveView("procurement")}
+        >
           {t("portal.billing.enterpriseUpsell.cta", "Explore Enterprise")}
         </Button>
       </div>
diff --git a/frontend/editor/src/portal/components/billing/billing.css b/frontend/editor/src/portal/components/billing/billing.css
index 1809a4f80c..423e917c94 100644
--- a/frontend/editor/src/portal/components/billing/billing.css
+++ b/frontend/editor/src/portal/components/billing/billing.css
@@ -119,7 +119,7 @@
 /* Free grant still offsetting spend — reads as a positive credit note, pulled up
    under the "PDFs processed" line. */
 .portal-billing__free-remaining {
-  color: var(--color-green-600, var(--color-green));
+  color: var(--color-green);
   margin-top: -0.5rem;
 }
 
@@ -171,7 +171,7 @@
 }
 
 .portal-billing__error {
-  color: var(--color-red, #b91c1c);
+  color: var(--color-red, var(--color-red-dark));
   font-size: 0.875rem;
   margin: 0.5rem 0;
 }
@@ -228,11 +228,7 @@
 
 .portal-billing__meter-fill {
   height: 100%;
-  background: linear-gradient(
-    90deg,
-    var(--color-blue, #0a8bff),
-    var(--color-purple, #8b5cf6)
-  );
+  background: linear-gradient(90deg, var(--color-blue), var(--color-purple));
   border-radius: 999px;
   transition: width 200ms ease;
 }
@@ -308,28 +304,28 @@
   border-radius: 999px;
 }
 .payg-status[data-state="FULL"] {
-  background: #dcfce7;
-  color: #15803d;
+  background: var(--color-green-light);
+  color: var(--color-green-dark);
 }
 .payg-status[data-state="FULL"] .payg-status__dot {
-  background: #22c55e;
-  box-shadow: 0 0 0 3px rgba(34, 197, 94, 0.18);
+  background: var(--color-green);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--color-green) 18%, transparent);
 }
 .payg-status[data-state="WARNED"] {
-  background: #fef3c7;
-  color: #a16207;
+  background: var(--color-amber-light);
+  color: var(--color-amber-dark);
 }
 .payg-status[data-state="WARNED"] .payg-status__dot {
-  background: #eab308;
-  box-shadow: 0 0 0 3px rgba(234, 179, 8, 0.2);
+  background: var(--color-amber);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--color-amber) 20%, transparent);
 }
 .payg-status[data-state="DEGRADED"] {
-  background: #fee2e2;
-  color: #b91c1c;
+  background: var(--color-red-light);
+  color: var(--color-red-dark);
 }
 .payg-status[data-state="DEGRADED"] .payg-status__dot {
-  background: #ef4444;
-  box-shadow: 0 0 0 3px rgba(239, 68, 68, 0.2);
+  background: var(--color-red);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--color-red) 20%, transparent);
 }
 
 /* Segmented usage bar */
@@ -347,13 +343,13 @@
   transition: width 0.5s cubic-bezier(0.16, 1, 0.3, 1);
 }
 .payg-bar__fill[data-state="FULL"] {
-  background: linear-gradient(90deg, #0a8bff, #38bdf8);
+  background: var(--color-blue);
 }
 .payg-bar__fill[data-state="WARNED"] {
-  background: linear-gradient(90deg, #f59e0b, #fbbf24);
+  background: var(--color-amber);
 }
 .payg-bar__fill[data-state="DEGRADED"] {
-  background: linear-gradient(90deg, #dc2626, #f87171);
+  background: var(--color-red);
 }
 
 /* ── Plan card (free state) ─────────────────────────────────────────────── */
@@ -394,7 +390,7 @@
 
 .portal-billing__plan-features li::before {
   content: "✓";
-  color: var(--color-green, #10b981);
+  color: var(--color-green);
   position: absolute;
   left: 0;
   font-weight: 600;
@@ -457,15 +453,15 @@
 }
 
 .portal-billing__breakdown-fill--blue {
-  background: #0a8bff;
+  background: var(--color-blue);
 }
 
 .portal-billing__breakdown-fill--purple {
-  background: #8b5cf6;
+  background: var(--color-purple);
 }
 
 .portal-billing__breakdown-fill--teal {
-  background: #06b6d4;
+  background: var(--color-cat-extraction);
 }
 
 /* ── Cap control ────────────────────────────────────────────────────────── */
@@ -570,10 +566,10 @@
    Same class names + structure so the visual is identical to the SaaS Plan
    page; when the shared-component move lands, these dedupe to one stylesheet. */
 .scc {
-  --scc-accent: #0a8bff;
-  --scc-accent-text: #0a8bff;
-  --scc-accent-soft: rgba(10, 139, 255, 0.12);
-  --scc-accent-border: rgba(10, 139, 255, 0.25);
+  --scc-accent: var(--color-blue);
+  --scc-accent-text: var(--color-blue);
+  --scc-accent-soft: color-mix(in srgb, var(--color-blue) 12%, transparent);
+  --scc-accent-border: color-mix(in srgb, var(--color-blue) 25%, transparent);
   --scc-chip-bg: var(--color-bg-muted, #f8fafc);
   --scc-chip-border: var(--color-border, #e2e8f0);
   --scc-text-primary: var(--color-text-1, #0f172a);
@@ -585,11 +581,11 @@
   gap: 14px;
   margin-top: 0.75rem;
 }
-[data-mantine-color-scheme="dark"] .scc {
-  --scc-accent-text: #66b8ff;
-  --scc-accent-soft: rgba(10, 139, 255, 0.16);
-  --scc-chip-bg: #272d35;
-  --scc-chip-border: #3d444e;
+[data-theme="dark"] .scc {
+  --scc-accent-text: var(--color-blue);
+  --scc-accent-soft: color-mix(in srgb, var(--color-blue) 16%, transparent);
+  --scc-chip-bg: var(--color-bg-muted);
+  --scc-chip-border: var(--color-border);
 }
 
 .scc-row {
@@ -736,9 +732,9 @@
   white-space: nowrap;
 }
 .portal-billing__role-pill[data-leader="true"] {
-  background: rgba(10, 139, 255, 0.12);
-  color: #0a8bff;
-  border: 1px solid rgba(10, 139, 255, 0.25);
+  background: color-mix(in srgb, var(--color-blue) 12%, transparent);
+  color: var(--color-blue);
+  border: 1px solid color-mix(in srgb, var(--color-blue) 25%, transparent);
 }
 .portal-billing__role-pill[data-leader="false"] {
   background: var(--color-bg-muted);
@@ -768,10 +764,10 @@
   margin-bottom: 8px;
 }
 .portal-billing__planhead-lbl--free {
-  color: #10b981;
+  color: var(--color-green);
 }
 .portal-billing__planhead-lbl--meter {
-  color: #0a8bff;
+  color: var(--color-blue);
 }
 .portal-billing__planhead-title {
   margin: 0;
@@ -839,7 +835,7 @@
 
 .portal-billing__invoice-link:focus-visible {
   outline: none;
-  border-color: var(--color-blue, #0a8bff);
+  border-color: var(--color-blue);
   background: var(--color-bg-muted, #f1f5f9);
 }
 
@@ -953,6 +949,12 @@
   align-items: flex-start;
   gap: 1rem;
 }
+/* Keep the CTA on one line at its natural width — in the narrow subscribed
+   column it was shrinking and clipping its label. */
+.portal-billing__enterprise-head > .sui-btn {
+  flex-shrink: 0;
+  white-space: nowrap;
+}
 /* Bare variant — embeds in another card's column without its own surface. */
 .portal-billing__enterprise-bare {
   display: block;
@@ -988,13 +990,13 @@
   height: 100%;
 }
 .portal-billing__segbar-seg--blue {
-  background: #0a8bff;
+  background: var(--color-blue);
 }
 .portal-billing__segbar-seg--purple {
-  background: #8b5cf6;
+  background: var(--color-purple);
 }
 .portal-billing__segbar-seg--teal {
-  background: #06b6d4;
+  background: var(--color-cat-extraction);
 }
 .portal-billing__seglegend {
   display: flex;
@@ -1016,13 +1018,13 @@
   flex-shrink: 0;
 }
 .portal-billing__dot--blue {
-  background: #0a8bff;
+  background: var(--color-blue);
 }
 .portal-billing__dot--purple {
-  background: #8b5cf6;
+  background: var(--color-purple);
 }
 .portal-billing__dot--teal {
-  background: #06b6d4;
+  background: var(--color-cat-extraction);
 }
 .portal-billing__seglegend-label {
   font-weight: 600;

From d2c8bbfcb2321c3e974b54d4ad5534b9e1f72093 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:49:21 +0100
Subject: [PATCH 030/109] Portal Sources: consistent SVG source icons (#6995)

# Description of Changes

Replaces the odd glyph icons in the Sources connect flow with centred
stroke SVGs, and fixes the connect-modal type-tile alignment and the
inconsistent Folder chip width.

Part of a portal (processor) UI-consistency pass, split into small
focused PRs.

## Before / after

<img width="2816" height="1224" alt="before-sources-light"
src="https://github.com/user-attachments/assets/22814817-8123-4bc7-b40b-5c2ba2881415"
/>
<img width="2880" height="2000" alt="after-connect-modal"
src="https://github.com/user-attachments/assets/0e51ca78-cda0-4909-bff3-912ecd7925a3"
/>
<img width="2816" height="1224" alt="after-sources-light"
src="https://github.com/user-attachments/assets/b9fd4b8a-c45a-4518-9676-e871bbabd9b8"
/>
<img width="2880" height="2000" alt="before-connect-modal"
src="https://github.com/user-attachments/assets/55058c40-d152-4c5e-a8a0-1ca5549a121c"
/>


---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [x] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../components/sources/SourceTypeIcon.tsx     | 34 +++++++++++++++++
 .../components/sources/SourcesTable.tsx       |  3 +-
 frontend/editor/src/portal/views/Sources.css  | 38 +++++++++++++++++--
 3 files changed, 71 insertions(+), 4 deletions(-)
 create mode 100644 frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx

diff --git a/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx b/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx
new file mode 100644
index 0000000000..606fe45b1e
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx
@@ -0,0 +1,34 @@
+/**
+ * Stroke-SVG icons for source types, replacing the black Unicode glyphs
+ * (⛁ ☁ ✏ ◇) that rendered off-style and mis-centred inside the type tiles and
+ * table badges. Keyed by the backend source `type`; unknown types fall back to
+ * a neutral document mark.
+ */
+
+const PATHS: Record<string, string> = {
+  folder: "M3 7h6l2 2h10v9a1 1 0 01-1 1H4a1 1 0 01-1-1V7z",
+  s3: "M7 18a4 4 0 010-8 5 5 0 019.6-1.3A3.5 3.5 0 0117 18H7z",
+  editor: "M4 20h16M14 4l6 6-9 9H5v-6l9-9z",
+  _default:
+    "M14 3H7a1 1 0 00-1 1v16a1 1 0 001 1h10a1 1 0 001-1V7l-4-4zM14 3v4h4",
+};
+
+export function SourceTypeIcon({ type }: { type: string }) {
+  const d = PATHS[type] ?? PATHS._default;
+  return (
+    <svg
+      className="portal-sources__type-svg"
+      viewBox="0 0 24 24"
+      fill="none"
+      aria-hidden
+    >
+      <path
+        d={d}
+        stroke="currentColor"
+        strokeWidth="1.7"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+      />
+    </svg>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sources/SourcesTable.tsx b/frontend/editor/src/portal/components/sources/SourcesTable.tsx
index 2c4a1e826a..ad0a17c81e 100644
--- a/frontend/editor/src/portal/components/sources/SourcesTable.tsx
+++ b/frontend/editor/src/portal/components/sources/SourcesTable.tsx
@@ -13,6 +13,7 @@ import {
   EDITOR_SOURCE_TYPE,
   sourceTypeMeta,
 } from "@portal/components/sources/sourceTypes";
+import { SourceTypeIcon } from "@portal/components/sources/SourceTypeIcon";
 import "@portal/views/Sources.css";
 
 const STATUS_TONE: Record<SourceStatus, StatusTone> = {
@@ -45,7 +46,7 @@ export function SourcesTable({ sources, onRowClick }: SourcesTableProps) {
                 className={`portal-sources__type-dot portal-sources__type-dot--${meta.accent}`}
                 aria-hidden
               >
-                {meta.icon}
+                <SourceTypeIcon type={s.type} />
               </span>
               <div className="portal-sources__name-text">
                 <strong>{isEditor ? t(meta.labelKey) : s.name}</strong>
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index 54d8906be9..b0966c3151 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -49,6 +49,7 @@
 .portal-sources__name-text {
   display: flex;
   flex-direction: column;
+  align-items: flex-start;
   gap: 0.25rem;
   min-width: 0;
 }
@@ -366,7 +367,7 @@
 
 .portal-sources__type-grid {
   display: grid;
-  grid-template-columns: repeat(4, 1fr);
+  grid-template-columns: repeat(auto-fit, minmax(9rem, 1fr));
   gap: 0.625rem;
 }
 
@@ -376,6 +377,17 @@
   }
 }
 
+/* The shared Button lays its children out in a flex-row label; force the type
+   tile back to a centred icon-over-label column so the SVG sits above the name
+   with real spacing (not jammed against it). */
+.portal-sources__type-card .mantine-Button-label {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 0.5rem;
+  width: 100%;
+}
+
 .portal-sources__type-card {
   display: flex;
   flex-direction: column;
@@ -402,9 +414,29 @@
   box-shadow: 0 0 0 1px var(--color-blue) inset;
 }
 
+/* Icon inside the type picker: a plain stroke icon above the label (no badge
+   box — the tinted box read as an extra bordered chip floating on the tile). */
 .portal-sources__type-icon {
-  font-size: 1.25rem;
-  color: var(--color-text-2);
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  color: var(--color-text-3);
+}
+
+.portal-sources__type-card.is-selected .portal-sources__type-icon {
+  color: var(--color-blue);
+}
+
+.portal-sources__type-icon .portal-sources__type-svg {
+  width: 1.6rem;
+  height: 1.6rem;
+}
+
+/* Sized to sit centred inside the 1.875rem table badge / picker dot. */
+.portal-sources__type-svg {
+  width: 1.05rem;
+  height: 1.05rem;
+  display: block;
 }
 
 .portal-sources__type-name {

From 8ed1ff152b9f06a3b5b5e3a7cd87cf6fd5c7ad38 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:49:25 +0100
Subject: [PATCH 031/109] Hide processor pipelines stat boxes during
 loading/empty state (#6983)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Description of Changes

Gate the processor Pipelines KPI strip on having real pipelines, so the
loading and empty states no longer flash a row of empty `—` stat boxes.
Matches the Policies view; Sources is intentionally left as-is.

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [x] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 frontend/editor/src/portal/views/Pipelines.tsx | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/frontend/editor/src/portal/views/Pipelines.tsx b/frontend/editor/src/portal/views/Pipelines.tsx
index 23a8da75da..4e9893dd03 100644
--- a/frontend/editor/src/portal/views/Pipelines.tsx
+++ b/frontend/editor/src/portal/views/Pipelines.tsx
@@ -22,10 +22,12 @@ export function Pipelines() {
   const { isLoading } = useSectionFlags(state);
 
   const pipelines = data?.pipelines ?? [];
-  // Empty once the fetch settles with no pipelines (or fails → no data). Gates
-  // both the KPI strip and the empty panel so no placeholder stat boxes sit
-  // above an empty page.
+  // Empty once the fetch settles with no pipelines (or fails → no data); gates
+  // the empty panel below.
   const showEmpty = !isLoading && pipelines.length === 0;
+  // The KPI strip is pure stat boxes: show it only once real pipelines exist, so
+  // the loading and empty states don't flash a row of placeholder cards.
+  const hasPipelines = pipelines.length > 0;
 
   const openCreate = () =>
     navigate(`${toPortalPath(VIEW_PATHS.pipelines)}/new`);
@@ -54,7 +56,7 @@ export function Pipelines() {
         </Button>
       </header>
 
-      {!showEmpty && <KpiStrip data={data} loading={loading} />}
+      {hasPipelines && <KpiStrip data={data} loading={loading} />}
 
       {isLoading && (
         <div className="portal-pipelines__table-skeleton" aria-hidden>

From bef83d80a1b00aab8314bd8edf32e8813163fc4f Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 15 Jul 2026 15:49:33 +0100
Subject: [PATCH 032/109] Patch CVEs in engine Python dependencies (#6804)

# Description of Changes

- Patch CVEs in engine Python dependencies (43 alerts): `starlette`
1.3.1, `cryptography` 49.0.0, `pyjwt` 2.13.0, `urllib3` 2.7.0, `aiohttp`
3.14.1, `python-multipart` 0.0.32, `langchain-core` 1.4.8, `langsmith`
0.9.1, `authlib` 1.7.2, `requests` 2.34.2, `idna` 3.18, `pytest` 9.1.1,
`pygments` 2.20.0, `pydantic-settings` 2.14.2
- Cap `pydantic-ai` `<2.0.0` and bump to 1.107.0 (1.99.0 patches
CVE-2026-46678; 2.0 is a separate major migration)

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs (if functionality has heavily
changed)
- [ ] I have read the section Add New Translation Tags (for new
translation tags only)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally
---
 engine/pyproject.toml |   5 +-
 engine/uv.lock        | 801 +++++++++++++++++++++++++-----------------
 2 files changed, 472 insertions(+), 334 deletions(-)

diff --git a/engine/pyproject.toml b/engine/pyproject.toml
index 7bd2fa7bea..5113ea03ff 100644
--- a/engine/pyproject.toml
+++ b/engine/pyproject.toml
@@ -8,8 +8,9 @@ dependencies = [
     "pgvector>=0.3.6",
     "psycopg[binary,pool]>=3.2",
     "pydantic>=2.0.0",
-    "pydantic-ai>=1.67.0",
-    "pydantic-ai-slim[voyageai]>=1.67.0",
+    # <2 cap: 1.99.0 patches CVE-2026-46678; 2.0 is an untested major migration
+    "pydantic-ai>=1.99.0,<2.0.0",
+    "pydantic-ai-slim[voyageai]>=1.99.0,<2.0.0",
     "pydantic-settings>=2.0.0",
     "python-dotenv>=1.2.1",
     "sqlite-vec>=0.1.6",
diff --git a/engine/uv.lock b/engine/uv.lock
index 00a8345c13..3434f4df16 100644
--- a/engine/uv.lock
+++ b/engine/uv.lock
@@ -8,14 +8,14 @@ resolution-markers = [
 
 [[package]]
 name = "ag-ui-protocol"
-version = "0.1.14"
+version = "0.1.19"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pydantic" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/53/ee/319d189343e1dc67b1109c950a0d1091fe32498104b5917fbbd806ff58dd/ag_ui_protocol-0.1.14.tar.gz", hash = "sha256:d8e86b308f86a6cf6a5e18ca7154d7642895de2fe94cd2cece57723cdbba6406", size = 5687, upload-time = "2026-03-18T00:43:13.358Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/a7/10/4ad299267a7d04b89935aa99eef62979758fcf95aee9f8bb5d70c35b1be1/ag_ui_protocol-0.1.19.tar.gz", hash = "sha256:43c27f60d41712dcad0e9e0a203cbdf1c8e248b22417374c5c68321c448af4ea", size = 10720, upload-time = "2026-06-02T17:26:15.627Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0c/99/eaa83816924791fc25ebb44ac7987196b687a3fdf597b1e7a62c69306a8d/ag_ui_protocol-0.1.14-py3-none-any.whl", hash = "sha256:ec072e6a45e0d45b8714e6d54919cc9bde3d097fdc36f7e82953b2f21f1cdbef", size = 8069, upload-time = "2026-03-18T00:43:12.1Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/0a/bcad8116eb058e4b4a305e3fc37ebd7efc879deeb86b854f1c5b8b6e97dd/ag_ui_protocol-0.1.19-py3-none-any.whl", hash = "sha256:898843b1410d378824da0c6a776486288b9c5828689d0bf563118868e37f390f", size = 13490, upload-time = "2026-06-02T17:26:16.313Z" },
 ]
 
 [[package]]
@@ -41,7 +41,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.13.5"
+version = "3.14.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -52,59 +52,72 @@ dependencies = [
     { name = "propcache" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/77/9a/152096d4808df8e4268befa55fba462f440f14beab85e8ad9bf990516918/aiohttp-3.13.5.tar.gz", hash = "sha256:9d98cc980ecc96be6eb4c1994ce35d28d8b1f5e5208a23b421187d1209dbb7d1", size = 7858271, upload-time = "2026-03-31T22:01:03.343Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/82/78/8ea7308cac6934de8c74a14f3d5f65d1c89287426688be79538d0e5c013d/aiohttp-3.14.1.tar.gz", hash = "sha256:307f2cff90a764d329e77040603fa032db89c5c24fdad50c4c15334cba744035", size = 7955794, upload-time = "2026-06-07T21:09:35.529Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/78/e9/d76bf503005709e390122d34e15256b88f7008e246c4bdbe915cd4f1adce/aiohttp-3.13.5-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:a5029cc80718bbd545123cd8fe5d15025eccaaaace5d0eeec6bd556ad6163d61", size = 742930, upload-time = "2026-03-31T21:58:13.155Z" },
-    { url = "https://files.pythonhosted.org/packages/57/00/4b7b70223deaebd9bb85984d01a764b0d7bd6526fcdc73cca83bcbe7243e/aiohttp-3.13.5-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:4bb6bf5811620003614076bdc807ef3b5e38244f9d25ca5fe888eaccea2a9832", size = 496927, upload-time = "2026-03-31T21:58:15.073Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/f5/0fb20fb49f8efdcdce6cd8127604ad2c503e754a8f139f5e02b01626523f/aiohttp-3.13.5-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:a84792f8631bf5a94e52d9cc881c0b824ab42717165a5579c760b830d9392ac9", size = 497141, upload-time = "2026-03-31T21:58:17.009Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/86/b7c870053e36a94e8951b803cb5b909bfbc9b90ca941527f5fcafbf6b0fa/aiohttp-3.13.5-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:57653eac22c6a4c13eb22ecf4d673d64a12f266e72785ab1c8b8e5940d0e8090", size = 1732476, upload-time = "2026-03-31T21:58:18.925Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/e5/4e161f84f98d80c03a238671b4136e6530453d65262867d989bbe78244d0/aiohttp-3.13.5-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:e5e5f7debc7a57af53fdf5c5009f9391d9f4c12867049d509bf7bb164a6e295b", size = 1706507, upload-time = "2026-03-31T21:58:21.094Z" },
-    { url = "https://files.pythonhosted.org/packages/d4/56/ea11a9f01518bd5a2a2fcee869d248c4b8a0cfa0bb13401574fa31adf4d4/aiohttp-3.13.5-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c719f65bebcdf6716f10e9eff80d27567f7892d8988c06de12bbbd39307c6e3a", size = 1773465, upload-time = "2026-03-31T21:58:23.159Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/40/333ca27fb74b0383f17c90570c748f7582501507307350a79d9f9f3c6eb1/aiohttp-3.13.5-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d97f93fdae594d886c5a866636397e2bcab146fd7a132fd6bb9ce182224452f8", size = 1873523, upload-time = "2026-03-31T21:58:25.59Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/d2/e2f77eef1acb7111405433c707dc735e63f67a56e176e72e9e7a2cd3f493/aiohttp-3.13.5-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3df334e39d4c2f899a914f1dba283c1aadc311790733f705182998c6f7cae665", size = 1754113, upload-time = "2026-03-31T21:58:27.624Z" },
-    { url = "https://files.pythonhosted.org/packages/fb/56/3f653d7f53c89669301ec9e42c95233e2a0c0a6dd051269e6e678db4fdb0/aiohttp-3.13.5-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:fe6970addfea9e5e081401bcbadf865d2b6da045472f58af08427e108d618540", size = 1562351, upload-time = "2026-03-31T21:58:29.918Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/a6/9b3e91eb8ae791cce4ee736da02211c85c6f835f1bdfac0594a8a3b7018c/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7becdf835feff2f4f335d7477f121af787e3504b48b449ff737afb35869ba7bb", size = 1693205, upload-time = "2026-03-31T21:58:32.214Z" },
-    { url = "https://files.pythonhosted.org/packages/98/fc/bfb437a99a2fcebd6b6eaec609571954de2ed424f01c352f4b5504371dd3/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:676e5651705ad5d8a70aeb8eb6936c436d8ebbd56e63436cb7dd9bb36d2a9a46", size = 1730618, upload-time = "2026-03-31T21:58:34.728Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/b6/c8534862126191a034f68153194c389addc285a0f1347d85096d349bbc15/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:9b16c653d38eb1a611cc898c41e76859ca27f119d25b53c12875fd0474ae31a8", size = 1745185, upload-time = "2026-03-31T21:58:36.909Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/93/4ca8ee2ef5236e2707e0fd5fecb10ce214aee1ff4ab307af9c558bda3b37/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:999802d5fa0389f58decd24b537c54aa63c01c3219ce17d1214cbda3c2b22d2d", size = 1557311, upload-time = "2026-03-31T21:58:39.38Z" },
-    { url = "https://files.pythonhosted.org/packages/57/ae/76177b15f18c5f5d094f19901d284025db28eccc5ae374d1d254181d33f4/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:ec707059ee75732b1ba130ed5f9580fe10ff75180c812bc267ded039db5128c6", size = 1773147, upload-time = "2026-03-31T21:58:41.476Z" },
-    { url = "https://files.pythonhosted.org/packages/01/a4/62f05a0a98d88af59d93b7fcac564e5f18f513cb7471696ac286db970d6a/aiohttp-3.13.5-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:2d6d44a5b48132053c2f6cd5c8cb14bc67e99a63594e336b0f2af81e94d5530c", size = 1730356, upload-time = "2026-03-31T21:58:44.049Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/85/fc8601f59dfa8c9523808281f2da571f8b4699685f9809a228adcc90838d/aiohttp-3.13.5-cp313-cp313-win32.whl", hash = "sha256:329f292ed14d38a6c4c435e465f48bebb47479fd676a0411936cc371643225cc", size = 432637, upload-time = "2026-03-31T21:58:46.167Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/1b/ac685a8882896acf0f6b31d689e3792199cfe7aba37969fa91da63a7fa27/aiohttp-3.13.5-cp313-cp313-win_amd64.whl", hash = "sha256:69f571de7500e0557801c0b51f4780482c0ec5fe2ac851af5a92cfce1af1cb83", size = 458896, upload-time = "2026-03-31T21:58:48.119Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/ce/46572759afc859e867a5bc8ec3487315869013f59281ce61764f76d879de/aiohttp-3.13.5-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:eb4639f32fd4a9904ab8fb45bf3383ba71137f3d9d4ba25b3b3f3109977c5b8c", size = 745721, upload-time = "2026-03-31T21:58:50.229Z" },
-    { url = "https://files.pythonhosted.org/packages/13/fe/8a2efd7626dbe6049b2ef8ace18ffda8a4dfcbe1bcff3ac30c0c7575c20b/aiohttp-3.13.5-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:7e5dc4311bd5ac493886c63cbf76ab579dbe4641268e7c74e48e774c74b6f2be", size = 497663, upload-time = "2026-03-31T21:58:52.232Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/91/cc8cc78a111826c54743d88651e1687008133c37e5ee615fee9b57990fac/aiohttp-3.13.5-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:756c3c304d394977519824449600adaf2be0ccee76d206ee339c5e76b70ded25", size = 499094, upload-time = "2026-03-31T21:58:54.566Z" },
-    { url = "https://files.pythonhosted.org/packages/0a/33/a8362cb15cf16a3af7e86ed11962d5cd7d59b449202dc576cdc731310bde/aiohttp-3.13.5-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ecc26751323224cf8186efcf7fbcbc30f4e1d8c7970659daf25ad995e4032a56", size = 1726701, upload-time = "2026-03-31T21:58:56.864Z" },
-    { url = "https://files.pythonhosted.org/packages/45/0c/c091ac5c3a17114bd76cbf85d674650969ddf93387876cf67f754204bd77/aiohttp-3.13.5-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:10a75acfcf794edf9d8db50e5a7ec5fc818b2a8d3f591ce93bc7b1210df016d2", size = 1683360, upload-time = "2026-03-31T21:58:59.072Z" },
-    { url = "https://files.pythonhosted.org/packages/23/73/bcee1c2b79bc275e964d1446c55c54441a461938e70267c86afaae6fba27/aiohttp-3.13.5-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0f7a18f258d124cd678c5fe072fe4432a4d5232b0657fca7c1847f599233c83a", size = 1773023, upload-time = "2026-03-31T21:59:01.776Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/ef/720e639df03004fee2d869f771799d8c23046dec47d5b81e396c7cda583a/aiohttp-3.13.5-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:df6104c009713d3a89621096f3e3e88cc323fd269dbd7c20afe18535094320be", size = 1853795, upload-time = "2026-03-31T21:59:04.568Z" },
-    { url = "https://files.pythonhosted.org/packages/bd/c9/989f4034fb46841208de7aeeac2c6d8300745ab4f28c42f629ba77c2d916/aiohttp-3.13.5-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:241a94f7de7c0c3b616627aaad530fe2cb620084a8b144d3be7b6ecfe95bae3b", size = 1730405, upload-time = "2026-03-31T21:59:07.221Z" },
-    { url = "https://files.pythonhosted.org/packages/ce/75/ee1fd286ca7dc599d824b5651dad7b3be7ff8d9a7e7b3fe9820d9180f7db/aiohttp-3.13.5-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c974fb66180e58709b6fc402846f13791240d180b74de81d23913abe48e96d94", size = 1558082, upload-time = "2026-03-31T21:59:09.484Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/20/1e9e6650dfc436340116b7aa89ff8cb2bbdf0abc11dfaceaad8f74273a10/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:6e27ea05d184afac78aabbac667450c75e54e35f62238d44463131bd3f96753d", size = 1692346, upload-time = "2026-03-31T21:59:12.068Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/40/8ebc6658d48ea630ac7903912fe0dd4e262f0e16825aa4c833c56c9f1f56/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:a79a6d399cef33a11b6f004c67bb07741d91f2be01b8d712d52c75711b1e07c7", size = 1698891, upload-time = "2026-03-31T21:59:14.552Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/78/ea0ae5ec8ba7a5c10bdd6e318f1ba5e76fcde17db8275188772afc7917a4/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:c632ce9c0b534fbe25b52c974515ed674937c5b99f549a92127c85f771a78772", size = 1742113, upload-time = "2026-03-31T21:59:17.068Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/66/9d308ed71e3f2491be1acb8769d96c6f0c47d92099f3bc9119cada27b357/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:fceedde51fbd67ee2bcc8c0b33d0126cc8b51ef3bbde2f86662bd6d5a6f10ec5", size = 1553088, upload-time = "2026-03-31T21:59:19.541Z" },
-    { url = "https://files.pythonhosted.org/packages/da/a6/6cc25ed8dfc6e00c90f5c6d126a98e2cf28957ad06fa1036bd34b6f24a2c/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:f92995dfec9420bb69ae629abf422e516923ba79ba4403bc750d94fb4a6c68c1", size = 1757976, upload-time = "2026-03-31T21:59:22.311Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/2b/cce5b0ffe0de99c83e5e36d8f828e4161e415660a9f3e58339d07cce3006/aiohttp-3.13.5-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:20ae0ff08b1f2c8788d6fb85afcb798654ae6ba0b747575f8562de738078457b", size = 1712444, upload-time = "2026-03-31T21:59:24.635Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/cf/9e1795b4160c58d29421eafd1a69c6ce351e2f7c8d3c6b7e4ca44aea1a5b/aiohttp-3.13.5-cp314-cp314-win32.whl", hash = "sha256:b20df693de16f42b2472a9c485e1c948ee55524786a0a34345511afdd22246f3", size = 438128, upload-time = "2026-03-31T21:59:27.291Z" },
-    { url = "https://files.pythonhosted.org/packages/22/4d/eaedff67fc805aeba4ba746aec891b4b24cebb1a7d078084b6300f79d063/aiohttp-3.13.5-cp314-cp314-win_amd64.whl", hash = "sha256:f85c6f327bf0b8c29da7d93b1cabb6363fb5e4e160a32fa241ed2dce21b73162", size = 464029, upload-time = "2026-03-31T21:59:29.429Z" },
-    { url = "https://files.pythonhosted.org/packages/79/11/c27d9332ee20d68dd164dc12a6ecdef2e2e35ecc97ed6cf0d2442844624b/aiohttp-3.13.5-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:1efb06900858bb618ff5cee184ae2de5828896c448403d51fb633f09e109be0a", size = 778758, upload-time = "2026-03-31T21:59:31.547Z" },
-    { url = "https://files.pythonhosted.org/packages/04/fb/377aead2e0a3ba5f09b7624f702a964bdf4f08b5b6728a9799830c80041e/aiohttp-3.13.5-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:fee86b7c4bd29bdaf0d53d14739b08a106fdda809ca5fe032a15f52fae5fe254", size = 512883, upload-time = "2026-03-31T21:59:34.098Z" },
-    { url = "https://files.pythonhosted.org/packages/bb/a6/aa109a33671f7a5d3bd78b46da9d852797c5e665bfda7d6b373f56bff2ec/aiohttp-3.13.5-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:20058e23909b9e65f9da62b396b77dfa95965cbe840f8def6e572538b1d32e36", size = 516668, upload-time = "2026-03-31T21:59:36.497Z" },
-    { url = "https://files.pythonhosted.org/packages/79/b3/ca078f9f2fa9563c36fb8ef89053ea2bb146d6f792c5104574d49d8acb63/aiohttp-3.13.5-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8cf20a8d6868cb15a73cab329ffc07291ba8c22b1b88176026106ae39aa6df0f", size = 1883461, upload-time = "2026-03-31T21:59:38.723Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/e3/a7ad633ca1ca497b852233a3cce6906a56c3225fb6d9217b5e5e60b7419d/aiohttp-3.13.5-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:330f5da04c987f1d5bdb8ae189137c77139f36bd1cb23779ca1a354a4b027800", size = 1747661, upload-time = "2026-03-31T21:59:41.187Z" },
-    { url = "https://files.pythonhosted.org/packages/33/b9/cd6fe579bed34a906d3d783fe60f2fa297ef55b27bb4538438ee49d4dc41/aiohttp-3.13.5-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6f1cbf0c7926d315c3c26c2da41fd2b5d2fe01ac0e157b78caefc51a782196cf", size = 1863800, upload-time = "2026-03-31T21:59:43.84Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/3f/2c1e2f5144cefa889c8afd5cf431994c32f3b29da9961698ff4e3811b79a/aiohttp-3.13.5-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:53fc049ed6390d05423ba33103ded7281fe897cf97878f369a527070bd95795b", size = 1958382, upload-time = "2026-03-31T21:59:46.187Z" },
-    { url = "https://files.pythonhosted.org/packages/66/1d/f31ec3f1013723b3babe3609e7f119c2c2fb6ef33da90061a705ef3e1bc8/aiohttp-3.13.5-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:898703aa2667e3c5ca4c54ca36cd73f58b7a38ef87a5606414799ebce4d3fd3a", size = 1803724, upload-time = "2026-03-31T21:59:48.656Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/b4/57712dfc6f1542f067daa81eb61da282fab3e6f1966fca25db06c4fc62d5/aiohttp-3.13.5-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0494a01ca9584eea1e5fbd6d748e61ecff218c51b576ee1999c23db7066417d8", size = 1640027, upload-time = "2026-03-31T21:59:51.284Z" },
-    { url = "https://files.pythonhosted.org/packages/25/3c/734c878fb43ec083d8e31bf029daae1beafeae582d1b35da234739e82ee7/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:6cf81fe010b8c17b09495cbd15c1d35afbc8fb405c0c9cf4738e5ae3af1d65be", size = 1806644, upload-time = "2026-03-31T21:59:53.753Z" },
-    { url = "https://files.pythonhosted.org/packages/20/a5/f671e5cbec1c21d044ff3078223f949748f3a7f86b14e34a365d74a5d21f/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:c564dd5f09ddc9d8f2c2d0a301cd30a79a2cc1b46dd1a73bef8f0038863d016b", size = 1791630, upload-time = "2026-03-31T21:59:56.239Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/63/fb8d0ad63a0b8a99be97deac8c04dacf0785721c158bdf23d679a87aa99e/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:2994be9f6e51046c4f864598fd9abeb4fba6e88f0b2152422c9666dcd4aea9c6", size = 1809403, upload-time = "2026-03-31T21:59:59.103Z" },
-    { url = "https://files.pythonhosted.org/packages/59/0c/bfed7f30662fcf12206481c2aac57dedee43fe1c49275e85b3a1e1742294/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:157826e2fa245d2ef46c83ea8a5faf77ca19355d278d425c29fda0beb3318037", size = 1634924, upload-time = "2026-03-31T22:00:02.116Z" },
-    { url = "https://files.pythonhosted.org/packages/17/d6/fd518d668a09fd5a3319ae5e984d4d80b9a4b3df4e21c52f02251ef5a32e/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:a8aca50daa9493e9e13c0f566201a9006f080e7c50e5e90d0b06f53146a54500", size = 1836119, upload-time = "2026-03-31T22:00:04.756Z" },
-    { url = "https://files.pythonhosted.org/packages/78/b7/15fb7a9d52e112a25b621c67b69c167805cb1f2ab8f1708a5c490d1b52fe/aiohttp-3.13.5-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:3b13560160d07e047a93f23aaa30718606493036253d5430887514715b67c9d9", size = 1772072, upload-time = "2026-03-31T22:00:07.494Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/df/57ba7f0c4a553fc2bd8b6321df236870ec6fd64a2a473a8a13d4f733214e/aiohttp-3.13.5-cp314-cp314t-win32.whl", hash = "sha256:9a0f4474b6ea6818b41f82172d799e4b3d29e22c2c520ce4357856fced9af2f8", size = 471819, upload-time = "2026-03-31T22:00:10.277Z" },
-    { url = "https://files.pythonhosted.org/packages/62/29/2f8418269e46454a26171bfdd6a055d74febf32234e474930f2f60a17145/aiohttp-3.13.5-cp314-cp314t-win_amd64.whl", hash = "sha256:18a2f6c1182c51baa1d28d68fea51513cb2a76612f038853c0ad3c145423d3d9", size = 505441, upload-time = "2026-03-31T22:00:12.791Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/97/bd137012dd97e1649162b099135a80e1fd59aaa807b2430fc448d1029aff/aiohttp-3.14.1-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:b3a03285a7f9c7b016324574a6d92a1c895da6b978cb8f1deee3ac72bc6da178", size = 506882, upload-time = "2026-06-07T21:07:15.501Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/79/e5cc690e9d922a66887ceeaca53a8ffd5a7b0be3816142b7abc433742d89/aiohttp-3.14.1-cp313-cp313-android_21_x86_64.whl", hash = "sha256:2a73f487ab8ef5abbb24b7aa9b73e98eaba9e9e031804ff2416f02eca315ccaf", size = 515270, upload-time = "2026-06-07T21:07:17.53Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/22/a73ccbf9dbd6e26dda0b24d5fd5db7da92ee3383a79f47677ffb834c5c5b/aiohttp-3.14.1-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:915fbb7b41b115192259f8c9ae58f3ddc444d2b5579917270211858e606a4afd", size = 485841, upload-time = "2026-06-07T21:07:19.555Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/b9/57ed8eaf596321c2ad747bd480fb1700dbd7177c60dfc9e4c187f629662e/aiohttp-3.14.1-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:7fb4bdf95b0561a79f259f9d28fbc109728c5ee7f27aff6391f0ca703a329abe", size = 492088, upload-time = "2026-06-07T21:07:21.581Z" },
+    { url = "https://files.pythonhosted.org/packages/78/c0/5ebe5270a7c140d7c6f79dcb018640225f14d406c149e4eec04a7d82fe71/aiohttp-3.14.1-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:1b9748363260121d2927704f5d4fc498150669ca3ae93625986ee89c8f80dcd4", size = 501564, upload-time = "2026-06-07T21:07:23.388Z" },
+    { url = "https://files.pythonhosted.org/packages/75/7f/8cdaa24fc7983865e0915153b96a9ac5bcdd3548d64c5a27d17cecccad2d/aiohttp-3.14.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:86a6dab78b0e43e2897a3bbe15745aa60dc5423ca437b7b0b164c069bf91b876", size = 751998, upload-time = "2026-06-07T21:07:25.046Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/f4/c4227aacfacc5cb0cc2d119b65301d177912a6842cd64e120c47af76064f/aiohttp-3.14.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:4dfd6e47d3c44c2279907607f73a4240b88c69eb8b90da7e2441a8045dfd21da", size = 510918, upload-time = "2026-06-07T21:07:27.28Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/01/a2d5f96cd4e74424864d30bc0a7e44d0a12dacdcfa91b5b2d1bd3dca6bf3/aiohttp-3.14.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:317acd9f8602858dc7d59679812c376c7f0b97bcbbf16e0d6237f54141d8a8a6", size = 508657, upload-time = "2026-06-07T21:07:29.252Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/ed/3c0fb5c500fdd8e7ebc10d1889c04384fffa1a9163eac1356088ca9da1b1/aiohttp-3.14.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bd869c427324e5cb15195793de951295710db28be7d818247f3097b4ab5d4b96", size = 1757907, upload-time = "2026-06-07T21:07:31.03Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/ab/d4c924d9bd5be3050c226612413ce68cb54c70d2c31b661bfc8d9a5b6a70/aiohttp-3.14.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:93b032b5ec3255473c143627d21a69ac74ae12f7f33974cb587c564d11b1066f", size = 1737565, upload-time = "2026-06-07T21:07:33.031Z" },
+    { url = "https://files.pythonhosted.org/packages/19/2a/37326821ff779084020cdc33224d20b19f42f4183a500ff92022a739eda7/aiohttp-3.14.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f234b4deb12f3ad59127e037bc57c40c21e45b45282df7d3a55a0f409f595296", size = 1799018, upload-time = "2026-06-07T21:07:35.003Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/4f/6e947ba73e4ce09070761c05ed3a8ceb7c21f5e46798671d8b2aac0e4626/aiohttp-3.14.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:9af6779bfb46abf124068327abcdf9ce95c9ef8287a3e8da76ccf2d0f16c28fa", size = 1894416, upload-time = "2026-06-07T21:07:36.956Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/6e/dbf1d0625dc711fb2851f4f3c3055c39ed58bae92082d8c627dbe6013736/aiohttp-3.14.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:faccab372e66bc76d5731525e7f1143c922271725b9d38c9f97edcc66266b451", size = 1783881, upload-time = "2026-06-07T21:07:39.063Z" },
+    { url = "https://files.pythonhosted.org/packages/44/c2/5e25098a67268ed369483ae7d1a58bd0a13d03aab860d2a0e4a6eb25b046/aiohttp-3.14.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f380468b09d2a81633ee863b0ec5648d364bd17bb8ecfb8c2f387f7ac1faf42c", size = 1587572, upload-time = "2026-06-07T21:07:41.058Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/bd/cf9cee17e140f942a3de73e658a543aa8fbf35a5fc67a9d2538d52d77f0b/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:97e704dcd26271f5bda3fa07c3ce0fb76d6d3f8659f4baa1a24442cc9ba177ca", size = 1722137, upload-time = "2026-06-07T21:07:43.014Z" },
+    { url = "https://files.pythonhosted.org/packages/89/6d/5684f8c59045c96f81a18cefbc1fbbd79d25b88f1c622f2a5c5c08fcb632/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:269b76ac5394092b95bc4a098f4fc6c191c083c3bd12775d1e30e663132f6a09", size = 1755953, upload-time = "2026-06-07T21:07:45.933Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/40/35caf3170f8359760740a7d9aa0fff2e344bef98e1d1186f5a0f6dec17e6/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:5c0b3e614340c889d575451696374c9d17affd54cd607ca0babed8f8c37b9397", size = 1766479, upload-time = "2026-06-07T21:07:48.047Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/a1/b0c61e7a137f0d81de49a82023a6df73c3c16d6fefb0f8e4a93d21639002/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:5663ee9257cfa1add7253a7da3035a02f31b6600ec48261585e1800a81533080", size = 1580077, upload-time = "2026-06-07T21:07:50.069Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/41/194ea4623693009fcefebef7aef63c141754f153e9cd0d39d3b9e36c175c/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:603a2c834142172ffddc054067f5ec0ca65d57a0aa98a71bc81952573208e345", size = 1791688, upload-time = "2026-06-07T21:07:52.106Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/45/4de841f005cfe1fd63e2a2fe011262c515e2a62aa6994b15947e7d717ac9/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:cb21957bb8aca671c1765e32f58164cf0c50e6bf41c0bbbd16da20732ecaf588", size = 1761094, upload-time = "2026-06-07T21:07:54.113Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/ae/dbce10533d3896d544d5053939ed75b7dc31a1b0973d959b1b5ae21028d6/aiohttp-3.14.1-cp313-cp313-win32.whl", hash = "sha256:e509a55f681e6158c20f70f102f9cf61fb20fbc382272bc6d94b7343f2582780", size = 452662, upload-time = "2026-06-07T21:07:56.06Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/d9/0bf1a19362c32f06229da5e7ddfcec91f93474d6307f7a2d3135e9c674dc/aiohttp-3.14.1-cp313-cp313-win_amd64.whl", hash = "sha256:1ac8531b638959718e18c2207fbfe297819875da46a740b29dfa29beba64355a", size = 479748, upload-time = "2026-06-07T21:07:58.319Z" },
+    { url = "https://files.pythonhosted.org/packages/22/0a/62e7232dc9484fbec112ceb32efb6a624cc7994ec6e2b019286f17c4e8f2/aiohttp-3.14.1-cp313-cp313-win_arm64.whl", hash = "sha256:250d14af67f6b6a1a4a811049b1afa69d61d617fca6bf33149b3ab1a6dbcf7b8", size = 447723, upload-time = "2026-06-07T21:08:00.154Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/a1/5fafa04e1ca91ddb47608699d60649c1c6db3cf41c99e78fc4056f9513db/aiohttp-3.14.1-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:7c106c26852ca1c2047c6b80384f17100b4e439af276f21ef3d4e2f450ae7e15", size = 508531, upload-time = "2026-06-07T21:08:02.093Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/2e/bfa02f699d87ffc86d5959270b28f1cb410add3ccaced8ed2e0b8a5238fc/aiohttp-3.14.1-cp314-cp314-android_24_x86_64.whl", hash = "sha256:20205f7f5ade7aaec9f4b500549bbc071b046453aed72f9c06dcab87896a83e8", size = 514718, upload-time = "2026-06-07T21:08:04.476Z" },
+    { url = "https://files.pythonhosted.org/packages/85/a5/9594ad6289eebbc97d167c44213d557807f90e59115caad24de21ad2c3b1/aiohttp-3.14.1-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:62a759436b29e677181a9e76bab8b8f689a29cb9c535f45f7c48c9c830d3f8c3", size = 487918, upload-time = "2026-06-07T21:08:06.377Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/61/16a32c36c3c49edec122a3dc811f2057df2f94d3b14aa107c8017d981618/aiohttp-3.14.1-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:2964cbf553df4d7a57348da44d961d871895fc1ee4e8c322b2a95612c7b17fba", size = 494014, upload-time = "2026-06-07T21:08:08.263Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/89/3ebcf96ed99c05bec9c434aaac6963fd3cbab4a786ae739908a144d9ce44/aiohttp-3.14.1-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:237651caadc3a59badd39319c54642b5299e9cc98a3a194310e55d5bb9f5e397", size = 502398, upload-time = "2026-06-07T21:08:10.244Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/3d/b74870a0c2d40c355928cd5b96c7a11fa821b8a40fc41365e64479b151fb/aiohttp-3.14.1-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:896e12dfdbbab9d8f7e16d2b28c6769a60126fa92095d1ebf9473d02593a2448", size = 758018, upload-time = "2026-06-07T21:08:12.447Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/66/f42f5c984d99e49c6cff5f26f590750f2e2f7ef1fcfb99966ab5be1b632e/aiohttp-3.14.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:d03f281ed22579314ba00821ce20115a7c0ac430660b4cc05704a3f818b3e004", size = 512462, upload-time = "2026-06-07T21:08:14.624Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/a7/248e1aebe0c7810b0271e021a0f2a5eb6e78a051885b3c9df49f42a5802d/aiohttp-3.14.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:07eabb979d236335fed927e137a928c9adfb7df3b9ec7aa31726f133a62be983", size = 512824, upload-time = "2026-06-07T21:08:16.572Z" },
+    { url = "https://files.pythonhosted.org/packages/26/97/2aa0e5ba0727dc3bd5aaebb7ccbc510f7dfb7fb961ec87497cd496635ab1/aiohttp-3.14.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4fe1f1087cbadb280b5e1bb054a4f00d1423c74d6626c5e48400d871d34ecefe", size = 1749898, upload-time = "2026-06-07T21:08:18.635Z" },
+    { url = "https://files.pythonhosted.org/packages/00/8d/e97f6c96c891d457c8479d92a514ba194d0412f981d72c70341ee18488ed/aiohttp-3.14.1-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:367a9314fdc79dab0fac96e216cb41dd73c85bdca85306ce8999118ba7e0f333", size = 1710114, upload-time = "2026-06-07T21:08:20.892Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/e6/aa8d7e863048c8fceb5cd6ce74017311cec3ead07847387e12265fb4444e/aiohttp-3.14.1-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a24f677ebe83749039e7bdf862ff0bbb16818ae4193d4ef96505e269375bcce0", size = 1802541, upload-time = "2026-06-07T21:08:23.044Z" },
+    { url = "https://files.pythonhosted.org/packages/83/a8/72193137de57fda4ebfae4563182d082c8856e3b6e9871d0b46f028fb369/aiohttp-3.14.1-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c83afe0ba876be7e943d2e0ba645809ad441575d2840c895c21ee5de93b9377a", size = 1875776, upload-time = "2026-06-07T21:08:25.288Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/18/938441025db6769a3464596b2410af3afde0b21eb2f204c6f766f68af4bd/aiohttp-3.14.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:634e385930fb6d2d479cf3aa66515955863b77a5e3c2b5894ca259a25b308602", size = 1760329, upload-time = "2026-06-07T21:08:27.363Z" },
+    { url = "https://files.pythonhosted.org/packages/60/29/bf2496b4065e76e09fe48015aaffe5ce161d8f089b06ac6982070f653076/aiohttp-3.14.1-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:eeea07c4397bbc57719c4eed8f9c284874d4f175f9b6d57f7a1546b976d455ca", size = 1587293, upload-time = "2026-06-07T21:08:29.805Z" },
+    { url = "https://files.pythonhosted.org/packages/49/a2/2136674d52123b1354bd05dd5753c318db47dc0c927cc70b27bab3755456/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:335c0cc3e3545ce98dcb9cfcb836f40c3411f43fa03dab757597d80c89af8a35", size = 1714756, upload-time = "2026-06-07T21:08:32.094Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/b9/e5fd2e6f915503081c0f9b1e8540947037929c70c191da2e4d54b31a21a1/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:ae6be797afdef264e8a84864a85b196ca06045586481b3df8a967322fd2fa844", size = 1721052, upload-time = "2026-06-07T21:08:34.167Z" },
+    { url = "https://files.pythonhosted.org/packages/63/5a/2833e324a2263e104e31e2e91bc5bbee81bc499afd32203faee048a883f0/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:8560b4d712474335d08907db7973f71912d3a9a8f1dee992ec06b5d2fe359496", size = 1766888, upload-time = "2026-06-07T21:08:36.95Z" },
+    { url = "https://files.pythonhosted.org/packages/57/fa/dea6511870913162f3b2e8c42a7614eb203a4540b8c2da43e0bfb0548f3c/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2b7edd08e0a5deb1e8564a2fcd8f4561014a3f05252334671bbf55ddd47db0e5", size = 1581679, upload-time = "2026-06-07T21:08:39.292Z" },
+    { url = "https://files.pythonhosted.org/packages/14/bd/3cf0d55e71784b33534e9710a67d382d900598b4787fbce6cc7317f8c42a/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:b6ff7fcee63287ae57b5df3e4f5957ce032122802509246dec1a5bcc55904c95", size = 1782021, upload-time = "2026-06-07T21:08:41.407Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/af/14bb5843eccbe234f4dfb78ab73e549d99727247e62ae5d62cbd22eaf5b0/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:6ffbb2f4ec1ceaff7e07d43922954da26b223d188bf30658e561b98e23089444", size = 1742574, upload-time = "2026-06-07T21:08:43.795Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/1e/fbeb7af9210a67ac0f9c9bec0f8f4568497924e33137a3d5b48e1cf85f3f/aiohttp-3.14.1-cp314-cp314-win32.whl", hash = "sha256:a9875b46d910cff3ea2f5962f9d266b465459fe634e22556ab9bd6fc1192eea0", size = 457773, upload-time = "2026-06-07T21:08:46.168Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/2b/13e8d741a9ec5db7d900c060554cf8352ab85e44e2a4469ebb9d377bda17/aiohttp-3.14.1-cp314-cp314-win_amd64.whl", hash = "sha256:af8b4b81a960eeaf1234971ac3cd0ba5901f3cd42eae42a46b4d089a8b492719", size = 485001, upload-time = "2026-06-07T21:08:48.401Z" },
+    { url = "https://files.pythonhosted.org/packages/df/30/491acfa2c4d6c3ff59c49a14fc1b50be3241e25bbb0c84c09e2da4d11395/aiohttp-3.14.1-cp314-cp314-win_arm64.whl", hash = "sha256:cf4491381b1b57425c315a56a439251b1bdac07b2275f19a8c44bc57744532ec", size = 453809, upload-time = "2026-06-07T21:08:50.7Z" },
+    { url = "https://files.pythonhosted.org/packages/34/e3/19dbe1a1f4cc6230eb9e314de7fe68053b0992f9302b27d12141a0b5db53/aiohttp-3.14.1-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:819c054312f1af92947e6a55883d1b66feefab11531a7fc45e0fb9b63880b5c2", size = 793320, upload-time = "2026-06-07T21:08:52.775Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/20/1b7182219ba1b108430d6e4dc53d25ae02dcfcf5a045b33af4e8c5167527/aiohttp-3.14.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:10ee9c1753a8f706345b22496c79fbddb5be0599e0823f3738b1534058e25340", size = 529077, upload-time = "2026-06-07T21:08:55Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/c8/14ce60ec31a2e5f5274bb17d383a6f7a3aabca31ac04eee05585bbadab16/aiohttp-3.14.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1601cc37baf5750ccacae618ec2daf020769581695550e3b654a911f859c563d", size = 532476, upload-time = "2026-06-07T21:08:57.176Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/02/9ac85e081e53da2e061b02fa7758fe0a12d17b8ce2d1f5e6c7cb76730328/aiohttp-3.14.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4d6e0ac9da31c9c04c84e1c0182ad8d6df35965a85cae29cd71d089621b3ae94", size = 1922347, upload-time = "2026-06-07T21:08:59.563Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/3e/d3ba07a0ab38b5389e10bec4362d21e10a4f667cba2d79ba30837b3a5059/aiohttp-3.14.1-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:9e8f2d660c350b3d0e259c7a7e3d9b7fc8b41210cbcc3d4a7076ff0a5e5c2fdc", size = 1786465, upload-time = "2026-06-07T21:09:01.909Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/cb/e2ee978a00cfb2df829704a69528b18154eba5939f45bc1efa8f33aee4c5/aiohttp-3.14.1-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:4691802dda97be727f79d86818acaad7eb8e9252626a1d6b519fedbb92d5e251", size = 1909423, upload-time = "2026-06-07T21:09:04.357Z" },
+    { url = "https://files.pythonhosted.org/packages/73/5d/1430334858b1022b58ae50399a918f0bd6fe8fa7fa183598d657ff61e040/aiohttp-3.14.1-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c389c482a7e9b9dc3ee2701ac46c4125297a3818875b9c305ddb603c04828fd1", size = 2001906, upload-time = "2026-06-07T21:09:06.722Z" },
+    { url = "https://files.pythonhosted.org/packages/66/4e/560c7472d3d198a23aa5c8b19a5115bf6a9b77b7d3e4bb363da320430ad2/aiohttp-3.14.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fc0cacab7ba4e56f0f81c82a98c09bed2f39c940107b03a34b168bdf7597edd3", size = 1877095, upload-time = "2026-06-07T21:09:09.011Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/f1/4745806578d447db4a784a8591e2dae3afdfc2bcb96f8f81271b13df6543/aiohttp-3.14.1-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:979ed4717f59b8bb12e3963378fa285d93d367e15bcd66c721311826d3c44a6c", size = 1676222, upload-time = "2026-06-07T21:09:11.461Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/c9/48255813cca749a229ef0ab476004ec623728ad79a9c0840616f6c076325/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:38e1e7daaea81df51c952e18483f323d878499a1e2bfe564790e0f9701d6f203", size = 1842922, upload-time = "2026-06-07T21:09:14.118Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/c0/bbd054e2bee909f529523a5af3891052606af5143c09f5f183ec3b234676/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:4132e72c608fe9fecb8f409113567605915b83e9bdd3ea56538d2f9cd35002f1", size = 1825035, upload-time = "2026-06-07T21:09:16.447Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/ae/90395d4376deceb74e09ec26b6adf7d2015a6f8802d6d84446af860fef04/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:eefd9cc9b6d4a2db5f00a26bc3e4f9acf71926a6ec557cd56c9c6f27c290b665", size = 1849512, upload-time = "2026-06-07T21:09:18.742Z" },
+    { url = "https://files.pythonhosted.org/packages/93/bd/fb25f3049957553d4ce0ba6ae480aa2f592a6985497fca590837d16c1be0/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:b165790117eea512d7f3fb22f1f6dad3d55a7189571993eb015591c1401276d1", size = 1668571, upload-time = "2026-06-07T21:09:21.458Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/22/7f73303d64dd567ff3addca90b556690ed1233a47b8f55d242fb90af3681/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:ed09c7eb1c391271c2ed0314a51903e72a3acb653d5ccfc264cdf3ef11f8269d", size = 1881159, upload-time = "2026-06-07T21:09:23.813Z" },
+    { url = "https://files.pythonhosted.org/packages/44/be/0474c5a8b5640e1e4aa1923430a91f4151be82e511373fe764189b89aef5/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:99abd37084b82f5830c635fddd0b4993b9742a66eb746dacf433c8590e8f9e3c", size = 1841409, upload-time = "2026-06-07T21:09:26.207Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/3c/bb4a7cba26956cb3da4553cc2056cf67be5b5ff6e6d8fa4fbdff73bfb7ae/aiohttp-3.14.1-cp314-cp314t-win32.whl", hash = "sha256:47ddf841cdecc810749921d25606dee45857d12d2ad5ddb7b5bd7eab12e4b365", size = 494166, upload-time = "2026-06-07T21:09:28.505Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/84/ec80c2c1f66a952555a9f86df6b33af65108a6febfa0471b69013a12f807/aiohttp-3.14.1-cp314-cp314t-win_amd64.whl", hash = "sha256:5e78b522b7a6e27e0b25d19b247b75039ac4c94f99823e3c9e53ae1603a9f7e9", size = 530255, upload-time = "2026-06-07T21:09:30.843Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/71/6e22be134a4061ada85a92951b842f2657f17d926b727f3f94c56ae963d6/aiohttp-3.14.1-cp314-cp314t-win_arm64.whl", hash = "sha256:90d53f1609c29ccc2193945ef732428382a28f78d0456ae4d3daf0d48b74f0f6", size = 469640, upload-time = "2026-06-07T21:09:33.028Z" },
 ]
 
 [[package]]
@@ -148,7 +161,7 @@ wheels = [
 
 [[package]]
 name = "anthropic"
-version = "0.93.0"
+version = "0.112.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -160,21 +173,21 @@ dependencies = [
     { name = "sniffio" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c2/70/2429d6f7c2516db99fb342c3ad89575ab3e0cd31d3d2f6cba5fdf5e9c65b/anthropic-0.93.0.tar.gz", hash = "sha256:fea8376f7d5cdf99d5e8e85a48fe7a7bd8ab307cdfee4b1e8283a18b1c0ce1b5", size = 654155, upload-time = "2026-04-09T18:13:53.522Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7b/dd/808c144d4a883fcfd12fe0d7689b1d86bbbea6666c1cc957ad19f1017c22/anthropic-0.112.0.tar.gz", hash = "sha256:e180cd91aa5b9b32e4007fe69892ab128d8a86b9f90825103b1903fbc977d0af", size = 937460, upload-time = "2026-06-24T18:45:56.844Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c9/7b/5b2c11902707c49c7a99418eb027ed3eb63876193fee5c80b5c878e3a673/anthropic-0.93.0-py3-none-any.whl", hash = "sha256:2c20b2ce6d305564c66a6cbaedddee8efdd3b9753098bf314093fcf4c662d04c", size = 627482, upload-time = "2026-04-09T18:13:51.606Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/26/ea71185027956325be1903d4fcaf7461d5ef40ca8f0e64f992e24ea9db0e/anthropic-0.112.0-py3-none-any.whl", hash = "sha256:bcc6268612c716dbb77133dd60fc41d26016d1b81dee9a52314d210193638751", size = 931954, upload-time = "2026-06-24T18:45:58.205Z" },
 ]
 
 [[package]]
 name = "anyio"
-version = "4.12.1"
+version = "4.14.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "idna" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/96/f0/5eb65b2bb0d09ac6776f2eb54adee6abe8228ea05b20a5ad0e4945de8aac/anyio-4.12.1.tar.gz", hash = "sha256:41cfcc3a4c85d3f05c932da7c26d0201ac36f72abd4435ba90d0464a3ffed703", size = 228685, upload-time = "2026-01-06T11:45:21.246Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/72/5562aabb8dd7181e8e860622a38bea08d17842b99ecd4c91f84ac95251b0/anyio-4.14.1.tar.gz", hash = "sha256:8d648a3544c1a700e3ff78615cd679e4c5c3f149904287e73687b2596963629e", size = 254831, upload-time = "2026-06-24T20:56:06.017Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/38/0e/27be9fdef66e72d64c0cdc3cc2823101b80585f8119b5c112c2e8f5f7dab/anyio-4.12.1-py3-none-any.whl", hash = "sha256:d405828884fc140aa80a3c667b8beed277f1dfedec42ba031bd6ac3db606ab6c", size = 113592, upload-time = "2026-01-06T11:45:19.497Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/7b/90df4a0a816d98d6ea26f559d87836d494a2cf1fcf063be67df50a7bcc30/anyio-4.14.1-py3-none-any.whl", hash = "sha256:4e5533c5b8ff0a24f5d7a176cbe6877129cd183893f66b537f8f227d10527d72", size = 124875, upload-time = "2026-06-24T20:56:04.413Z" },
 ]
 
 [[package]]
@@ -197,14 +210,15 @@ wheels = [
 
 [[package]]
 name = "authlib"
-version = "1.6.9"
+version = "1.7.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cryptography" },
+    { name = "joserfc" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/af/98/00d3dd826d46959ad8e32af2dbb2398868fd9fd0683c26e56d0789bd0e68/authlib-1.6.9.tar.gz", hash = "sha256:d8f2421e7e5980cc1ddb4e32d3f5fa659cfaf60d8eaf3281ebed192e4ab74f04", size = 165134, upload-time = "2026-03-02T07:44:01.998Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/36/98/7d93f30d029643c0275dbc0bd6d5a6f670661ee6c9a94d93af7ab4887600/authlib-1.7.2.tar.gz", hash = "sha256:2cea25fefcd4e7173bdf1372c0afc265c8034b23a8cd5dcb6a9164b826c64231", size = 176511, upload-time = "2026-05-06T08:10:23.116Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/53/23/b65f568ed0c22f1efacb744d2db1a33c8068f384b8c9b482b52ebdbc3ef6/authlib-1.6.9-py2.py3-none-any.whl", hash = "sha256:f08b4c14e08f0861dc18a32357b33fbcfd2ea86cfe3fe149484b4d764c4a0ac3", size = 244197, upload-time = "2026-03-02T07:44:00.307Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/95/adcb68e20c34162e9135f370d6e31737719c2b6f94bc953fe7ed1f10fe21/authlib-1.7.2-py2.py3-none-any.whl", hash = "sha256:3e1faedc9d87e7d56a164eca3ccb6ace0d61b94abe83e92242f8dc8bba9b4a9f", size = 259548, upload-time = "2026-05-06T08:10:21.436Z" },
 ]
 
 [[package]]
@@ -254,30 +268,30 @@ wheels = [
 
 [[package]]
 name = "boto3"
-version = "1.42.74"
+version = "1.43.36"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "botocore" },
     { name = "jmespath" },
     { name = "s3transfer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/74/ec/636ab2aa7ad9e6bf6e297240ac2d44dba63cc6611e2d5038db318436d449/boto3-1.42.74.tar.gz", hash = "sha256:dbacd808cf2a3dadbf35f3dbd8de97b94dc9f78b1ebd439f38f552e0f9753577", size = 112739, upload-time = "2026-03-23T19:34:09.815Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ff/9f/897287e955db0f50b12fd69ef45956e4fd2c7ddb48c736872f7ea2314443/boto3-1.43.36.tar.gz", hash = "sha256:587d7ee92a12e440ad12b0e7f11f3358f0c4d65b19f64726efc94aaf194aff28", size = 112690, upload-time = "2026-06-23T02:47:14.561Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ad/16/a264b4da2af99f4a12609b93fea941cce5ec41da14b33ed3fef77a910f0c/boto3-1.42.74-py3-none-any.whl", hash = "sha256:4bf89c044d618fe4435af854ab820f09dd43569c0df15d7beb0398f50b9aa970", size = 140557, upload-time = "2026-03-23T19:34:07.084Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/f1/274303f52483ecf199eae6f8d9b6f5951670397ee4d72c06cfd4eb644612/boto3-1.43.36-py3-none-any.whl", hash = "sha256:42942dde254673abcbc9e6e60017c88341a4f49d99d24e1f2e290fb38138c26f", size = 140031, upload-time = "2026-06-23T02:47:13.178Z" },
 ]
 
 [[package]]
 name = "botocore"
-version = "1.42.74"
+version = "1.43.36"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "jmespath" },
     { name = "python-dateutil" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9d/c7/cab8a14f0b69944bd0dd1fd58559163455b347eeda00bf836e93ce2684e4/botocore-1.42.74.tar.gz", hash = "sha256:9cf5cdffc6c90ed87b0fe184676806182588be0d0df9b363e9fe3e2923ac8e80", size = 15014379, upload-time = "2026-03-23T19:33:57.692Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7c/37/da9e7f6ca73ac73afd7f0bb7f238aa5daba35c081e98d7f48a7c399599c0/botocore-1.43.36.tar.gz", hash = "sha256:4cae47d1b2d426316b85a0087d9e69e048f13bc003b5177d74639fe9dfd28205", size = 15625488, upload-time = "2026-06-23T02:47:03.192Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d3/65/75852e04de5423c9b0c5b88241d0bdea33e6c6f454c88b71377d230216f2/botocore-1.42.74-py3-none-any.whl", hash = "sha256:3a76a8af08b5de82e51a0ae132394e226e15dbf21c8146ac3f7c1f881517a7a7", size = 14688218, upload-time = "2026-03-23T19:33:52.677Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/19/934f81592527a3f7f9b943c893e334c721a4644948642bc33885d584e9ec/botocore-1.43.36-py3-none-any.whl", hash = "sha256:3c65fdc39ed01d8dfde1e961b34038aed03c459f8ddf80717a12ac006475e49d", size = 15313630, upload-time = "2026-06-23T02:46:59.327Z" },
 ]
 
 [[package]]
@@ -431,7 +445,7 @@ wheels = [
 
 [[package]]
 name = "cohere"
-version = "5.20.7"
+version = "7.0.4"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "fastavro" },
@@ -443,9 +457,9 @@ dependencies = [
     { name = "types-requests" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/44/0b/96e2b55a0114ed9d69b3154565f54b764e7530735426290b000f467f4c0f/cohere-5.20.7.tar.gz", hash = "sha256:997ed85fabb3a1e4a4c036fdb520382e7bfa670db48eb59a026803b6f7061dbb", size = 184986, upload-time = "2026-02-25T01:22:18.673Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/cf/3c/670631ee223d7b64d157dc3f309bf93bde65efe0bb1a8341d9b575f407d3/cohere-7.0.4.tar.gz", hash = "sha256:35b6a397d35ae6eafa1a02921f42c2a98309a990874533e5238efaf3426b6a21", size = 208794, upload-time = "2026-06-11T15:17:52.994Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/9d/86/dc991a75e3b9c2007b90dbfaf7f36fdb2457c216f799e26ce0474faf0c1f/cohere-5.20.7-py3-none-any.whl", hash = "sha256:043fef2a12c30c07e9b2c1f0b869fd66ffd911f58d1492f87e901c4190a65914", size = 323389, upload-time = "2026-02-25T01:22:16.902Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/5d/5b6845104240c13fc2530d052b6b59730dc208aa0c0e676e524a280657d6/cohere-7.0.4-py3-none-any.whl", hash = "sha256:23dfaa0790940174363dede0c646765e5a5ade3fe3d2415b19933df3d535e889", size = 352009, upload-time = "2026-06-11T15:17:51.247Z" },
 ]
 
 [[package]]
@@ -459,60 +473,57 @@ wheels = [
 
 [[package]]
 name = "cryptography"
-version = "46.0.7"
+version = "49.0.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/47/93/ac8f3d5ff04d54bc814e961a43ae5b0b146154c89c61b47bb07557679b18/cryptography-46.0.7.tar.gz", hash = "sha256:e4cfd68c5f3e0bfdad0d38e023239b96a2fe84146481852dffbcca442c245aa5", size = 750652, upload-time = "2026-04-08T01:57:54.692Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1f/99/d1c90d6041656cc6ee229dc99cd67fd0cd5aec3c5f7d72fffc27cc750054/cryptography-49.0.0.tar.gz", hash = "sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493", size = 854345, upload-time = "2026-06-12T20:02:30.512Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0b/5d/4a8f770695d73be252331e60e526291e3df0c9b27556a90a6b47bccca4c2/cryptography-46.0.7-cp311-abi3-macosx_10_9_universal2.whl", hash = "sha256:ea42cbe97209df307fdc3b155f1b6fa2577c0defa8f1f7d3be7d31d189108ad4", size = 7179869, upload-time = "2026-04-08T01:56:17.157Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/45/6d80dc379b0bbc1f9d1e429f42e4cb9e1d319c7a8201beffd967c516ea01/cryptography-46.0.7-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:b36a4695e29fe69215d75960b22577197aca3f7a25b9cf9d165dcfe9d80bc325", size = 4275492, upload-time = "2026-04-08T01:56:19.36Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/9a/1765afe9f572e239c3469f2cb429f3ba7b31878c893b246b4b2994ffe2fe/cryptography-46.0.7-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:5ad9ef796328c5e3c4ceed237a183f5d41d21150f972455a9d926593a1dcb308", size = 4426670, upload-time = "2026-04-08T01:56:21.415Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/3e/af9246aaf23cd4ee060699adab1e47ced3f5f7e7a8ffdd339f817b446462/cryptography-46.0.7-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:73510b83623e080a2c35c62c15298096e2a5dc8d51c3b4e1740211839d0dea77", size = 4280275, upload-time = "2026-04-08T01:56:23.539Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/54/6bbbfc5efe86f9d71041827b793c24811a017c6ac0fd12883e4caa86b8ed/cryptography-46.0.7-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cbd5fb06b62bd0721e1170273d3f4d5a277044c47ca27ee257025146c34cbdd1", size = 4928402, upload-time = "2026-04-08T01:56:25.624Z" },
-    { url = "https://files.pythonhosted.org/packages/2d/cf/054b9d8220f81509939599c8bdbc0c408dbd2bdd41688616a20731371fe0/cryptography-46.0.7-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:420b1e4109cc95f0e5700eed79908cef9268265c773d3a66f7af1eef53d409ef", size = 4459985, upload-time = "2026-04-08T01:56:27.309Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/46/4e4e9c6040fb01c7467d47217d2f882daddeb8828f7df800cb806d8a2288/cryptography-46.0.7-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:24402210aa54baae71d99441d15bb5a1919c195398a87b563df84468160a65de", size = 3990652, upload-time = "2026-04-08T01:56:29.095Z" },
-    { url = "https://files.pythonhosted.org/packages/36/5f/313586c3be5a2fbe87e4c9a254207b860155a8e1f3cca99f9910008e7d08/cryptography-46.0.7-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:8a469028a86f12eb7d2fe97162d0634026d92a21f3ae0ac87ed1c4a447886c83", size = 4279805, upload-time = "2026-04-08T01:56:30.928Z" },
-    { url = "https://files.pythonhosted.org/packages/69/33/60dfc4595f334a2082749673386a4d05e4f0cf4df8248e63b2c3437585f2/cryptography-46.0.7-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:9694078c5d44c157ef3162e3bf3946510b857df5a3955458381d1c7cfc143ddb", size = 4892883, upload-time = "2026-04-08T01:56:32.614Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/0b/333ddab4270c4f5b972f980adef4faa66951a4aaf646ca067af597f15563/cryptography-46.0.7-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:42a1e5f98abb6391717978baf9f90dc28a743b7d9be7f0751a6f56a75d14065b", size = 4459756, upload-time = "2026-04-08T01:56:34.306Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/14/633913398b43b75f1234834170947957c6b623d1701ffc7a9600da907e89/cryptography-46.0.7-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:91bbcb08347344f810cbe49065914fe048949648f6bd5c2519f34619142bbe85", size = 4410244, upload-time = "2026-04-08T01:56:35.977Z" },
-    { url = "https://files.pythonhosted.org/packages/10/f2/19ceb3b3dc14009373432af0c13f46aa08e3ce334ec6eff13492e1812ccd/cryptography-46.0.7-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:5d1c02a14ceb9148cc7816249f64f623fbfee39e8c03b3650d842ad3f34d637e", size = 4674868, upload-time = "2026-04-08T01:56:38.034Z" },
-    { url = "https://files.pythonhosted.org/packages/1a/bb/a5c213c19ee94b15dfccc48f363738633a493812687f5567addbcbba9f6f/cryptography-46.0.7-cp311-abi3-win32.whl", hash = "sha256:d23c8ca48e44ee015cd0a54aeccdf9f09004eba9fc96f38c911011d9ff1bd457", size = 3026504, upload-time = "2026-04-08T01:56:39.666Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/02/7788f9fefa1d060ca68717c3901ae7fffa21ee087a90b7f23c7a603c32ae/cryptography-46.0.7-cp311-abi3-win_amd64.whl", hash = "sha256:397655da831414d165029da9bc483bed2fe0e75dde6a1523ec2fe63f3c46046b", size = 3488363, upload-time = "2026-04-08T01:56:41.893Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/56/15619b210e689c5403bb0540e4cb7dbf11a6bf42e483b7644e471a2812b3/cryptography-46.0.7-cp314-cp314t-macosx_10_9_universal2.whl", hash = "sha256:d151173275e1728cf7839aaa80c34fe550c04ddb27b34f48c232193df8db5842", size = 7119671, upload-time = "2026-04-08T01:56:44Z" },
-    { url = "https://files.pythonhosted.org/packages/74/66/e3ce040721b0b5599e175ba91ab08884c75928fbeb74597dd10ef13505d2/cryptography-46.0.7-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:db0f493b9181c7820c8134437eb8b0b4792085d37dbb24da050476ccb664e59c", size = 4268551, upload-time = "2026-04-08T01:56:46.071Z" },
-    { url = "https://files.pythonhosted.org/packages/03/11/5e395f961d6868269835dee1bafec6a1ac176505a167f68b7d8818431068/cryptography-46.0.7-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ebd6daf519b9f189f85c479427bbd6e9c9037862cf8fe89ee35503bd209ed902", size = 4408887, upload-time = "2026-04-08T01:56:47.718Z" },
-    { url = "https://files.pythonhosted.org/packages/40/53/8ed1cf4c3b9c8e611e7122fb56f1c32d09e1fff0f1d77e78d9ff7c82653e/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:b7b412817be92117ec5ed95f880defe9cf18a832e8cafacf0a22337dc1981b4d", size = 4271354, upload-time = "2026-04-08T01:56:49.312Z" },
-    { url = "https://files.pythonhosted.org/packages/50/46/cf71e26025c2e767c5609162c866a78e8a2915bbcfa408b7ca495c6140c4/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:fbfd0e5f273877695cb93baf14b185f4878128b250cc9f8e617ea0c025dfb022", size = 4905845, upload-time = "2026-04-08T01:56:50.916Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/ea/01276740375bac6249d0a971ebdf6b4dc9ead0ee0a34ef3b5a88c1a9b0d4/cryptography-46.0.7-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:ffca7aa1d00cf7d6469b988c581598f2259e46215e0140af408966a24cf086ce", size = 4444641, upload-time = "2026-04-08T01:56:52.882Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/4c/7d258f169ae71230f25d9f3d06caabcff8c3baf0978e2b7d65e0acac3827/cryptography-46.0.7-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:60627cf07e0d9274338521205899337c5d18249db56865f943cbe753aa96f40f", size = 3967749, upload-time = "2026-04-08T01:56:54.597Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/2a/2ea0767cad19e71b3530e4cad9605d0b5e338b6a1e72c37c9c1ceb86c333/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:80406c3065e2c55d7f49a9550fe0c49b3f12e5bfff5dedb727e319e1afb9bf99", size = 4270942, upload-time = "2026-04-08T01:56:56.416Z" },
-    { url = "https://files.pythonhosted.org/packages/41/3d/fe14df95a83319af25717677e956567a105bb6ab25641acaa093db79975d/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:c5b1ccd1239f48b7151a65bc6dd54bcfcc15e028c8ac126d3fada09db0e07ef1", size = 4871079, upload-time = "2026-04-08T01:56:58.31Z" },
-    { url = "https://files.pythonhosted.org/packages/9c/59/4a479e0f36f8f378d397f4eab4c850b4ffb79a2f0d58704b8fa0703ddc11/cryptography-46.0.7-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d5f7520159cd9c2154eb61eb67548ca05c5774d39e9c2c4339fd793fe7d097b2", size = 4443999, upload-time = "2026-04-08T01:57:00.508Z" },
-    { url = "https://files.pythonhosted.org/packages/28/17/b59a741645822ec6d04732b43c5d35e4ef58be7bfa84a81e5ae6f05a1d33/cryptography-46.0.7-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:fcd8eac50d9138c1d7fc53a653ba60a2bee81a505f9f8850b6b2888555a45d0e", size = 4399191, upload-time = "2026-04-08T01:57:02.654Z" },
-    { url = "https://files.pythonhosted.org/packages/59/6a/bb2e166d6d0e0955f1e9ff70f10ec4b2824c9cfcdb4da772c7dd69cc7d80/cryptography-46.0.7-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:65814c60f8cc400c63131584e3e1fad01235edba2614b61fbfbfa954082db0ee", size = 4655782, upload-time = "2026-04-08T01:57:04.592Z" },
-    { url = "https://files.pythonhosted.org/packages/95/b6/3da51d48415bcb63b00dc17c2eff3a651b7c4fed484308d0f19b30e8cb2c/cryptography-46.0.7-cp314-cp314t-win32.whl", hash = "sha256:fdd1736fed309b4300346f88f74cd120c27c56852c3838cab416e7a166f67298", size = 3002227, upload-time = "2026-04-08T01:57:06.91Z" },
-    { url = "https://files.pythonhosted.org/packages/32/a8/9f0e4ed57ec9cebe506e58db11ae472972ecb0c659e4d52bbaee80ca340a/cryptography-46.0.7-cp314-cp314t-win_amd64.whl", hash = "sha256:e06acf3c99be55aa3b516397fe42f5855597f430add9c17fa46bf2e0fb34c9bb", size = 3475332, upload-time = "2026-04-08T01:57:08.807Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/7f/cd42fc3614386bc0c12f0cb3c4ae1fc2bbca5c9662dfed031514911d513d/cryptography-46.0.7-cp38-abi3-macosx_10_9_universal2.whl", hash = "sha256:462ad5cb1c148a22b2e3bcc5ad52504dff325d17daf5df8d88c17dda1f75f2a4", size = 7165618, upload-time = "2026-04-08T01:57:10.645Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/d0/36a49f0262d2319139d2829f773f1b97ef8aef7f97e6e5bd21455e5a8fb5/cryptography-46.0.7-cp38-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:84d4cced91f0f159a7ddacad249cc077e63195c36aac40b4150e7a57e84fffe7", size = 4270628, upload-time = "2026-04-08T01:57:12.885Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/6c/1a42450f464dda6ffbe578a911f773e54dd48c10f9895a23a7e88b3e7db5/cryptography-46.0.7-cp38-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:128c5edfe5e5938b86b03941e94fac9ee793a94452ad1365c9fc3f4f62216832", size = 4415405, upload-time = "2026-04-08T01:57:14.923Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/92/4ed714dbe93a066dc1f4b4581a464d2d7dbec9046f7c8b7016f5286329e2/cryptography-46.0.7-cp38-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:5e51be372b26ef4ba3de3c167cd3d1022934bc838ae9eaad7e644986d2a3d163", size = 4272715, upload-time = "2026-04-08T01:57:16.638Z" },
-    { url = "https://files.pythonhosted.org/packages/b7/e6/a26b84096eddd51494bba19111f8fffe976f6a09f132706f8f1bf03f51f7/cryptography-46.0.7-cp38-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:cdf1a610ef82abb396451862739e3fc93b071c844399e15b90726ef7470eeaf2", size = 4918400, upload-time = "2026-04-08T01:57:19.021Z" },
-    { url = "https://files.pythonhosted.org/packages/c7/08/ffd537b605568a148543ac3c2b239708ae0bd635064bab41359252ef88ed/cryptography-46.0.7-cp38-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:1d25aee46d0c6f1a501adcddb2d2fee4b979381346a78558ed13e50aa8a59067", size = 4450634, upload-time = "2026-04-08T01:57:21.185Z" },
-    { url = "https://files.pythonhosted.org/packages/16/01/0cd51dd86ab5b9befe0d031e276510491976c3a80e9f6e31810cce46c4ad/cryptography-46.0.7-cp38-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:cdfbe22376065ffcf8be74dc9a909f032df19bc58a699456a21712d6e5eabfd0", size = 3985233, upload-time = "2026-04-08T01:57:22.862Z" },
-    { url = "https://files.pythonhosted.org/packages/92/49/819d6ed3a7d9349c2939f81b500a738cb733ab62fbecdbc1e38e83d45e12/cryptography-46.0.7-cp38-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:abad9dac36cbf55de6eb49badd4016806b3165d396f64925bf2999bcb67837ba", size = 4271955, upload-time = "2026-04-08T01:57:24.814Z" },
-    { url = "https://files.pythonhosted.org/packages/80/07/ad9b3c56ebb95ed2473d46df0847357e01583f4c52a85754d1a55e29e4d0/cryptography-46.0.7-cp38-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:935ce7e3cfdb53e3536119a542b839bb94ec1ad081013e9ab9b7cfd478b05006", size = 4879888, upload-time = "2026-04-08T01:57:26.88Z" },
-    { url = "https://files.pythonhosted.org/packages/b8/c7/201d3d58f30c4c2bdbe9b03844c291feb77c20511cc3586daf7edc12a47b/cryptography-46.0.7-cp38-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:35719dc79d4730d30f1c2b6474bd6acda36ae2dfae1e3c16f2051f215df33ce0", size = 4449961, upload-time = "2026-04-08T01:57:29.068Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/ef/649750cbf96f3033c3c976e112265c33906f8e462291a33d77f90356548c/cryptography-46.0.7-cp38-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:7bbc6ccf49d05ac8f7d7b5e2e2c33830d4fe2061def88210a126d130d7f71a85", size = 4401696, upload-time = "2026-04-08T01:57:31.029Z" },
-    { url = "https://files.pythonhosted.org/packages/41/52/a8908dcb1a389a459a29008c29966c1d552588d4ae6d43f3a1a4512e0ebe/cryptography-46.0.7-cp38-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:a1529d614f44b863a7b480c6d000fe93b59acee9c82ffa027cfadc77521a9f5e", size = 4664256, upload-time = "2026-04-08T01:57:33.144Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/fa/f0ab06238e899cc3fb332623f337a7364f36f4bb3f2534c2bb95a35b132c/cryptography-46.0.7-cp38-abi3-win32.whl", hash = "sha256:f247c8c1a1fb45e12586afbb436ef21ff1e80670b2861a90353d9b025583d246", size = 3013001, upload-time = "2026-04-08T01:57:34.933Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/f1/00ce3bde3ca542d1acd8f8cfa38e446840945aa6363f9b74746394b14127/cryptography-46.0.7-cp38-abi3-win_amd64.whl", hash = "sha256:506c4ff91eff4f82bdac7633318a526b1d1309fc07ca76a3ad182cb5b686d6d3", size = 3472985, upload-time = "2026-04-08T01:57:36.714Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/22/adf66990e63584a68dfb50c24f48a125c07b1699899381c8151e63ed458c/cryptography-49.0.0-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db", size = 4032100, upload-time = "2026-06-12T20:02:32.143Z" },
+    { url = "https://files.pythonhosted.org/packages/09/41/3797cfaf69cae04a13ee78ebd83f0678d9c02b4779d21ce24445326f1a69/cryptography-49.0.0-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db", size = 4692978, upload-time = "2026-06-12T20:01:21.305Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/8b/43011f7ebe515a8aa20d61f290a326cd890c2e738e16e59eaff8d9c3a412/cryptography-49.0.0-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325", size = 4716422, upload-time = "2026-06-12T20:01:48.566Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/91/01ce7303a4579e6d3a6abef01bd322848e9ea7a219adcabc5048b9033571/cryptography-49.0.0-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2", size = 4700503, upload-time = "2026-06-12T20:02:47.091Z" },
+    { url = "https://files.pythonhosted.org/packages/62/99/a2c95cf8293f07491e9e27c20cc4dcd18176d944e674679adeb1d0173fd6/cryptography-49.0.0-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b", size = 5309779, upload-time = "2026-06-12T20:02:08.987Z" },
+    { url = "https://files.pythonhosted.org/packages/20/2c/0622f20ff02b2ef32558733443805dc82fd4c275be01b2d19d14676f3a1b/cryptography-49.0.0-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6", size = 4749683, upload-time = "2026-06-12T20:02:03.335Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5b/c5246635d5fd3b64e0d45ae10e99fd32fe9676a79915ccfe5a61ba9af1a5/cryptography-49.0.0-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c", size = 4337874, upload-time = "2026-06-12T20:02:54.323Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/88/05563c7fe2e914e87d1a536d06fe83e66b4e1d95cb593e05aea375531da8/cryptography-49.0.0-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7", size = 4700283, upload-time = "2026-06-12T20:01:34.822Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/b6/d7696e4e890d6ae1469935164c9e5215c557671cb78d6e3f458ccceaa632/cryptography-49.0.0-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68", size = 5265844, upload-time = "2026-06-12T20:01:24.09Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/3c/f3ad17eecc1a57b0ba236dc01f90e783c51f4a2f35f64777cc4f47a184b2/cryptography-49.0.0-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9", size = 4749290, upload-time = "2026-06-12T20:01:30.848Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/01/339573cf1023163a400b0b5d16f6d507de413b9f60be6fd1b77feeaf6737/cryptography-49.0.0-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f", size = 4834612, upload-time = "2026-06-12T20:01:29.246Z" },
+    { url = "https://files.pythonhosted.org/packages/71/fd/577302e213a1be9468f92d1afef66fcf1ef83d516819d9992ca547f592bd/cryptography-49.0.0-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459", size = 4980804, upload-time = "2026-06-12T20:01:42.853Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/09/f42b1d190c5ba75f72062a387f8030d1d75f6ab035788f1d9c4b01de6525/cryptography-49.0.0-cp311-abi3-win_amd64.whl", hash = "sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e", size = 3810026, upload-time = "2026-06-12T20:02:39.262Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/9e/db72b3ae7fc9cfad53e630e56c6ae83b9b6ff0bf3718ffb8012d20b3aabf/cryptography-49.0.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7", size = 4013892, upload-time = "2026-06-12T20:02:10.735Z" },
+    { url = "https://files.pythonhosted.org/packages/86/12/c48a424f38db03027be9f7ed5c7dc5de9933dbee992865f98b13727a009d/cryptography-49.0.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d", size = 4678835, upload-time = "2026-06-12T20:02:48.743Z" },
+    { url = "https://files.pythonhosted.org/packages/68/28/8a3ad4653662c93fc44dc4e5d8fd374c25c42e07b34bbfbadf49cf57a5a8/cryptography-49.0.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa", size = 4697239, upload-time = "2026-06-12T20:02:56.03Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/b2/2193fc74f81aee4f9b62733133b73b5176718932ed8f2e4b03fa040480a6/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb", size = 4685593, upload-time = "2026-06-12T20:02:50.666Z" },
+    { url = "https://files.pythonhosted.org/packages/47/f1/1d3eaa243bfc5de4a187b22aa8c048b3e4980bfbe830ac46e6bac2e66947/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d", size = 5289961, upload-time = "2026-06-12T20:01:46.468Z" },
+    { url = "https://files.pythonhosted.org/packages/58/39/2d51306721330c486495853eda1c567880ff036de15a14c4b74f399934af/cryptography-49.0.0-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561", size = 4731145, upload-time = "2026-06-12T20:02:16.832Z" },
+    { url = "https://files.pythonhosted.org/packages/17/50/983e838c7fd0d87fd8c969bcdd328edaf5f756e38df5281637424c155873/cryptography-49.0.0-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122", size = 4321719, upload-time = "2026-06-12T20:02:52.611Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/f5/8f571d7e27c55bce9f76f026143bcb1e040a4233149ecca0bea5fa5dd5f7/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505", size = 4685209, upload-time = "2026-06-12T20:02:07.282Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/84/0e27016a6fc5a0886f797018b26aa42f40c09a82332bff77822a451deaaa/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866", size = 5246285, upload-time = "2026-06-12T20:01:32.439Z" },
+    { url = "https://files.pythonhosted.org/packages/11/2d/5e1fb307cb5931881516b464c98774b3f2c36b5d4bb9a2830253cf553cad/cryptography-49.0.0-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8", size = 4730441, upload-time = "2026-06-12T20:02:01.469Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/c0/bff5a02ee731d207d6a1ed51732549d8c53d2bc8da1d10ec6f2844201d68/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3", size = 4815869, upload-time = "2026-06-12T20:01:36.574Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/26/814681d14248d95d73d5c3eea0c39a94eb8302df966f670a2c60de90974b/cryptography-49.0.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27", size = 4960948, upload-time = "2026-06-12T20:02:18.688Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/fe/93ecac273d3738939d023612ad12cca9a3740a5345d69fda04134c43fd96/cryptography-49.0.0-cp314-cp314t-win_amd64.whl", hash = "sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61", size = 3799153, upload-time = "2026-06-12T20:01:39.059Z" },
+    { url = "https://files.pythonhosted.org/packages/19/2a/5bb823f5bedcf80718cea7fbc95ec5515cca3769633c4b01a32be7f30e7c/cryptography-49.0.0-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a", size = 4025947, upload-time = "2026-06-12T20:01:25.745Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/df/40577043ca124e17012f408ddddaeb213b856336ac82ddb3bc915f39e29f/cryptography-49.0.0-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4", size = 4692429, upload-time = "2026-06-12T20:01:53.628Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/99/2d13299eb3dd27b02dcfaafcc91d6b5cb3329f7cbd6d8f51921acd566c1a/cryptography-49.0.0-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18", size = 4700968, upload-time = "2026-06-12T20:02:45.383Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/4d/9c0cd02f95e2602dd5e563da149ee0830abef3537be8b34dc56281ebe27a/cryptography-49.0.0-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69", size = 4697758, upload-time = "2026-06-12T20:01:41.13Z" },
+    { url = "https://files.pythonhosted.org/packages/24/01/186c825898477d77e2324d5360fefe622ff1d8d1963ec0554e2cada8ec77/cryptography-49.0.0-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64", size = 5298863, upload-time = "2026-06-12T20:02:24.579Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/7b/62cbbab75d0659865bf0273790031544a0b16c8072d258f9428dcd8190dc/cryptography-49.0.0-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21", size = 4735983, upload-time = "2026-06-12T20:01:50.14Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/72/3e798c064bc39e471008075d0f9bc9daf77a80879c092e4a8e170c585ed4/cryptography-49.0.0-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9", size = 4334173, upload-time = "2026-06-12T20:01:44.743Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/ee/6fca21d1ac73e06f8bef71940abfd4d2f6472b4bca284d770f32bd4086f6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc", size = 4697298, upload-time = "2026-06-12T20:02:20.918Z" },
+    { url = "https://files.pythonhosted.org/packages/67/d0/a5fcd3515f0bae49a7b6d0413cc1bdccdcc1fc0047037a0d480642cdc5d6/cryptography-49.0.0-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8", size = 5254338, upload-time = "2026-06-12T20:02:22.737Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/84/84fe36f19caf857d61cb7fc9c63035a47ffabd84ea12d1d393148efa3615/cryptography-49.0.0-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36", size = 4735650, upload-time = "2026-06-12T20:02:41.389Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/a0/db537264e234f7273a73ec020873d6d6b39dfd8a53db78b550ca8320440e/cryptography-49.0.0-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e", size = 4834820, upload-time = "2026-06-12T20:01:51.847Z" },
+    { url = "https://files.pythonhosted.org/packages/93/77/8df9eb486495979bccecd1062e2eaf435250e84437040295b57d09048b0b/cryptography-49.0.0-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b", size = 4967968, upload-time = "2026-06-12T20:02:12.524Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/e6/f60198ea8d9dfa15fff9ed4ca02ce362f6eadd9ba757dcc50634c4257b63/cryptography-49.0.0-cp39-abi3-win_amd64.whl", hash = "sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001", size = 3785547, upload-time = "2026-06-12T20:02:26.847Z" },
 ]
 
 [[package]]
 name = "cyclopts"
-version = "4.10.1"
+version = "4.19.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "attrs" },
@@ -520,9 +531,9 @@ dependencies = [
     { name = "rich" },
     { name = "rich-rst" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/6c/c4/2ce2ca1451487dc7d59f09334c3fa1182c46cfcf0a2d5f19f9b26d53ac74/cyclopts-4.10.1.tar.gz", hash = "sha256:ad4e4bb90576412d32276b14a76f55d43353753d16217f2c3cd5bdceba7f15a0", size = 166623, upload-time = "2026-03-23T14:43:01.098Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/65/e7/4b3048094559b86a800e0f0de7faf8e6d8213727cf31553ec58453f25abc/cyclopts-4.19.0.tar.gz", hash = "sha256:c7532803ab8560d4de8600769793c3de4b2dc8c3b23ec707b989d84d9bae6ff4", size = 189274, upload-time = "2026-06-22T23:58:54.176Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/8a/0b/2261922126b2e50c601fe22d7ff5194e0a4d50e654836260c0665e24d862/cyclopts-4.10.1-py3-none-any.whl", hash = "sha256:35f37257139380a386d9fe4475e1e7c87ca7795765ef4f31abba579fcfcb6ecd", size = 204331, upload-time = "2026-03-23T14:43:02.625Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/e8/b84c32f35a19107b55b8ceed260de9469206464da26bd0b979db470782c3/cyclopts-4.19.0-py3-none-any.whl", hash = "sha256:a8c11adb45afae25db310122950c7639c70b56e2ce341e5b29848bf3a8ecc1d4", size = 228005, upload-time = "2026-06-22T23:58:52.495Z" },
 ]
 
 [[package]]
@@ -576,15 +587,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/55/e2/2537ebcff11c1ee1ff17d8d0b6f4db75873e3b0fb32c2d4a2ee31ecb310a/docstring_parser-0.17.0-py3-none-any.whl", hash = "sha256:cf2569abd23dce8099b300f9b4fa8191e9582dda731fd533daf54c4551658708", size = 36896, upload-time = "2025-07-21T07:35:00.684Z" },
 ]
 
-[[package]]
-name = "docutils"
-version = "0.22.4"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/ae/b6/03bb70946330e88ffec97aefd3ea75ba575cb2e762061e0e62a213befee8/docutils-0.22.4.tar.gz", hash = "sha256:4db53b1fde9abecbb74d91230d32ab626d94f6badfc575d6db9194a49df29968", size = 2291750, upload-time = "2025-12-18T19:00:26.443Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/02/10/5da547df7a391dcde17f59520a231527b8571e6f46fc8efb02ccb370ab12/docutils-0.22.4-py3-none-any.whl", hash = "sha256:d0013f540772d1420576855455d050a2180186c91c15779301ac2ccb3eeb68de", size = 633196, upload-time = "2025-12-18T19:00:18.077Z" },
-]
-
 [[package]]
 name = "email-validator"
 version = "2.3.0"
@@ -635,8 +637,8 @@ requires-dist = [
     { name = "posthog", specifier = ">=3.0.0" },
     { name = "psycopg", extras = ["binary", "pool"], specifier = ">=3.2" },
     { name = "pydantic", specifier = ">=2.0.0" },
-    { name = "pydantic-ai", specifier = ">=1.67.0" },
-    { name = "pydantic-ai-slim", extras = ["voyageai"], specifier = ">=1.67.0" },
+    { name = "pydantic-ai", specifier = ">=1.99.0,<2.0.0" },
+    { name = "pydantic-ai-slim", extras = ["voyageai"], specifier = ">=1.99.0,<2.0.0" },
     { name = "pydantic-settings", specifier = ">=2.0.0" },
     { name = "python-dotenv", specifier = ">=1.2.1" },
     { name = "sqlite-vec", specifier = ">=0.1.6" },
@@ -655,11 +657,11 @@ dev = [
 
 [[package]]
 name = "eval-type-backport"
-version = "0.3.1"
+version = "0.4.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/fb/a3/cafafb4558fd638aadfe4121dc6cefb8d743368c085acb2f521df0f3d9d7/eval_type_backport-0.3.1.tar.gz", hash = "sha256:57e993f7b5b69d271e37482e62f74e76a0276c82490cf8e4f0dffeb6b332d5ed", size = 9445, upload-time = "2025-12-02T11:51:42.987Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1c/15/273a4baf8248d6d76220723c3caf039d283774b31a7c46ba686120145b76/eval_type_backport-0.4.0.tar.gz", hash = "sha256:8397d25e6524c2e67b9576bb0636be27dea2192017711220c534ec2de921e9b0", size = 10260, upload-time = "2026-06-02T13:22:06.059Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/cf/22/fdc2e30d43ff853720042fa15baa3e6122722be1a7950a98233ebb55cd71/eval_type_backport-0.3.1-py3-none-any.whl", hash = "sha256:279ab641905e9f11129f56a8a78f493518515b83402b860f6f06dd7c011fdfa8", size = 6063, upload-time = "2025-12-02T11:51:41.665Z" },
+    { url = "https://files.pythonhosted.org/packages/50/a7/bb99bf5e6f78736ddb53480f2c3ff3702ffe2196a7c5e1661c03081d398e/eval_type_backport-0.4.0-py3-none-any.whl", hash = "sha256:ad5e2a8db71b6696a56eafb938b0f5a337d3217f256b8e158b469422b4772b20", size = 6432, upload-time = "2026-06-02T13:22:04.827Z" },
 ]
 
 [[package]]
@@ -698,64 +700,98 @@ wheels = [
 
 [[package]]
 name = "fastavro"
-version = "1.12.1"
+version = "1.12.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/65/8b/fa2d3287fd2267be6261d0177c6809a7fa12c5600ddb33490c8dc29e77b2/fastavro-1.12.1.tar.gz", hash = "sha256:2f285be49e45bc047ab2f6bed040bb349da85db3f3c87880e4b92595ea093b2b", size = 1025661, upload-time = "2025-10-10T15:40:55.41Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6e/5b/ccb338db71f347e3bc031d268bf6dc41e5ead63b6997b8e72af92f05e18e/fastavro-1.12.2.tar.gz", hash = "sha256:3c79502d56cf6b76210032e1c53494ddfbc73c140bccf2ef4092b3f0825323ab", size = 1030127, upload-time = "2026-04-24T14:36:01.269Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/bb/57/26d5efef9182392d5ac9f253953c856ccb66e4c549fd3176a1e94efb05c9/fastavro-1.12.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:78df838351e4dff9edd10a1c41d1324131ffecbadefb9c297d612ef5363c049a", size = 1000599, upload-time = "2025-10-10T15:41:36.554Z" },
-    { url = "https://files.pythonhosted.org/packages/33/cb/8ab55b21d018178eb126007a56bde14fd01c0afc11d20b5f2624fe01e698/fastavro-1.12.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:780476c23175d2ae457c52f45b9ffa9d504593499a36cd3c1929662bf5b7b14b", size = 3335933, upload-time = "2025-10-10T15:41:39.07Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/03/9c94ec9bf873eb1ffb0aa694f4e71940154e6e9728ddfdc46046d7e8ced4/fastavro-1.12.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0714b285160fcd515eb0455540f40dd6dac93bdeacdb03f24e8eac3d8aa51f8d", size = 3402066, upload-time = "2025-10-10T15:41:41.608Z" },
-    { url = "https://files.pythonhosted.org/packages/75/c8/cb472347c5a584ccb8777a649ebb28278fccea39d005fc7df19996f41df8/fastavro-1.12.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a8bc2dcec5843d499f2489bfe0747999108f78c5b29295d877379f1972a3d41a", size = 3240038, upload-time = "2025-10-10T15:41:43.743Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/77/569ce9474c40304b3a09e109494e020462b83e405545b78069ddba5f614e/fastavro-1.12.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:3b1921ac35f3d89090a5816b626cf46e67dbecf3f054131f84d56b4e70496f45", size = 3369398, upload-time = "2025-10-10T15:41:45.719Z" },
-    { url = "https://files.pythonhosted.org/packages/4a/1f/9589e35e9ea68035385db7bdbf500d36b8891db474063fb1ccc8215ee37c/fastavro-1.12.1-cp313-cp313-win_amd64.whl", hash = "sha256:5aa777b8ee595b50aa084104cd70670bf25a7bbb9fd8bb5d07524b0785ee1699", size = 444220, upload-time = "2025-10-10T15:41:47.39Z" },
-    { url = "https://files.pythonhosted.org/packages/6c/d2/78435fe737df94bd8db2234b2100f5453737cffd29adee2504a2b013de84/fastavro-1.12.1-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:c3d67c47f177e486640404a56f2f50b165fe892cc343ac3a34673b80cc7f1dd6", size = 1086611, upload-time = "2025-10-10T15:41:48.818Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/be/428f99b10157230ddac77ec8cc167005b29e2bd5cbe228345192bb645f30/fastavro-1.12.1-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5217f773492bac43dae15ff2931432bce2d7a80be7039685a78d3fab7df910bd", size = 3541001, upload-time = "2025-10-10T15:41:50.871Z" },
-    { url = "https://files.pythonhosted.org/packages/16/08/a2eea4f20b85897740efe44887e1ac08f30dfa4bfc3de8962bdcbb21a5a1/fastavro-1.12.1-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:469fecb25cba07f2e1bfa4c8d008477cd6b5b34a59d48715e1b1a73f6160097d", size = 3432217, upload-time = "2025-10-10T15:41:53.149Z" },
-    { url = "https://files.pythonhosted.org/packages/87/bb/b4c620b9eb6e9838c7f7e4b7be0762834443adf9daeb252a214e9ad3178c/fastavro-1.12.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:d71c8aa841ef65cfab709a22bb887955f42934bced3ddb571e98fdbdade4c609", size = 3366742, upload-time = "2025-10-10T15:41:55.237Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/d1/e69534ccdd5368350646fea7d93be39e5f77c614cca825c990bd9ca58f67/fastavro-1.12.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:b81fc04e85dfccf7c028e0580c606e33aa8472370b767ef058aae2c674a90746", size = 3383743, upload-time = "2025-10-10T15:41:57.68Z" },
-    { url = "https://files.pythonhosted.org/packages/58/54/b7b4a0c3fb5fcba38128542da1b26c4e6d69933c923f493548bdfd63ab6a/fastavro-1.12.1-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:9445da127751ba65975d8e4bdabf36bfcfdad70fc35b2d988e3950cce0ec0e7c", size = 1001377, upload-time = "2025-10-10T15:41:59.241Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/4f/0e589089c7df0d8f57d7e5293fdc34efec9a3b758a0d4d0c99a7937e2492/fastavro-1.12.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ed924233272719b5d5a6a0b4d80ef3345fc7e84fc7a382b6232192a9112d38a6", size = 3320401, upload-time = "2025-10-10T15:42:01.682Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/19/260110d56194ae29d7e423a336fccea8bcd103196d00f0b364b732bdb84e/fastavro-1.12.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3616e2f0e1c9265e92954fa099db79c6e7817356d3ff34f4bcc92699ae99697c", size = 3350894, upload-time = "2025-10-10T15:42:04.073Z" },
-    { url = "https://files.pythonhosted.org/packages/d0/96/58b0411e8be9694d5972bee3167d6c1fd1fdfdf7ce253c1a19a327208f4f/fastavro-1.12.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:cb0337b42fd3c047fcf0e9b7597bd6ad25868de719f29da81eabb6343f08d399", size = 3229644, upload-time = "2025-10-10T15:42:06.221Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/db/38660660eac82c30471d9101f45b3acfdcbadfe42d8f7cdb129459a45050/fastavro-1.12.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:64961ab15b74b7c168717bbece5660e0f3d457837c3cc9d9145181d011199fa7", size = 3329704, upload-time = "2025-10-10T15:42:08.384Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/a9/1672910f458ecb30b596c9e59e41b7c00309b602a0494341451e92e62747/fastavro-1.12.1-cp314-cp314-win_amd64.whl", hash = "sha256:792356d320f6e757e89f7ac9c22f481e546c886454a6709247f43c0dd7058004", size = 452911, upload-time = "2025-10-10T15:42:09.795Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/8d/2e15d0938ded1891b33eff252e8500605508b799c2e57188a933f0bd744c/fastavro-1.12.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:120aaf82ac19d60a1016afe410935fe94728752d9c2d684e267e5b7f0e70f6d9", size = 3541999, upload-time = "2025-10-10T15:42:11.794Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/1c/6dfd082a205be4510543221b734b1191299e6a1810c452b6bc76dfa6968e/fastavro-1.12.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b6a3462934b20a74f9ece1daa49c2e4e749bd9a35fa2657b53bf62898fba80f5", size = 3433972, upload-time = "2025-10-10T15:42:14.485Z" },
-    { url = "https://files.pythonhosted.org/packages/24/90/9de694625a1a4b727b1ad0958d220cab25a9b6cf7f16a5c7faa9ea7b2261/fastavro-1.12.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:1f81011d54dd47b12437b51dd93a70a9aa17b61307abf26542fc3c13efbc6c51", size = 3368752, upload-time = "2025-10-10T15:42:16.618Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/93/b44f67589e4d439913dab6720f7e3507b0fa8b8e56d06f6fc875ced26afb/fastavro-1.12.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:43ded16b3f4a9f1a42f5970c2aa618acb23ea59c4fcaa06680bdf470b255e5a8", size = 3386636, upload-time = "2025-10-10T15:42:18.974Z" },
+    { url = "https://files.pythonhosted.org/packages/83/39/f489a441d41cc9c0a8449fb1325d7a9c9eb57a5634e6ab19dfb0a1105324/fastavro-1.12.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:57bb6b908cb2e05baab63b04c3a31be3b4545a10bfab9748b8763016b5256704", size = 958566, upload-time = "2026-04-24T14:36:45.49Z" },
+    { url = "https://files.pythonhosted.org/packages/31/69/776cc025aee2d02acacb734cf690d2fbc295eaadde1b5d47caf8c77a6a2b/fastavro-1.12.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3a007f95cc682f56e6d83f1d17c29c00bf719d6fe8e003282b535af3a1ba09c0", size = 3276390, upload-time = "2026-04-24T14:36:47.875Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/bc/b7e15fa788f42cbe65827af2ec06c9ad91bb9f72c213110dbef61b53a5b0/fastavro-1.12.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5e90460b0cd21f62be3cb26087e706e2cebb7b3fcef9e05b4473b61bb0415b5e", size = 3372779, upload-time = "2026-04-24T14:36:50.122Z" },
+    { url = "https://files.pythonhosted.org/packages/79/c2/98993ca810231fc1397212f48c3d46626983722a24bbaaa5c27ee0963751/fastavro-1.12.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7ccd15966b8218d41b06ec3e7c2556be89a8a693026c771e6564d2e40bbaf8ea", size = 3187591, upload-time = "2026-04-24T14:36:52.451Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/bb/c180f340eba6478f1b20deccdd17e2b4a4d5074dafd812e3c4254fd035f7/fastavro-1.12.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:06b6971d3dae10cb34353b857d16ad21ebd6f0ea394e86c96abdcad109005d6e", size = 3320589, upload-time = "2026-04-24T14:36:54.647Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/e9/aca0456216b5b8992e7b0a8542711b66799c05bfe24c8e32ef6f56e7eb93/fastavro-1.12.2-cp313-cp313-win_amd64.whl", hash = "sha256:98dfcdfaf1498ae2f0e2fafe900a82e8320cc81d8ae5a95b8b8879eaa3298c39", size = 440883, upload-time = "2026-04-24T14:36:56.585Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/7e/984896e716af504927be71b80a1e9661aa96c6f9e1e777d52823aacb99f2/fastavro-1.12.2-cp313-cp313-win_arm64.whl", hash = "sha256:3888ef7a51adc77cdf07251bc762566a1be36211e1cff689f13980f3776a2f36", size = 377536, upload-time = "2026-04-24T14:36:58.274Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/42/09a1e1f8d9998d73848a6ff0aad6713ae6abf0dbf99918776f8ef33344a7/fastavro-1.12.2-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:283dcd3129b632021894425974bedd0eb6db3bbf5994e448ccad10db4d803d31", size = 1049506, upload-time = "2026-04-24T14:36:59.797Z" },
+    { url = "https://files.pythonhosted.org/packages/52/ef/80cc16f43919d532f25a707f34b275cccc09dca87a05b000fbbfc8e8f255/fastavro-1.12.2-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2d125e210d5a0a1f701f12c0ecad9a03f1b04b5eddbce6ca36a1fc217da977ef", size = 3495899, upload-time = "2026-04-24T14:37:02.306Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/54/a0817d1d0236e9e0233f5c996f450cc795b056b8e06edb531f24b9df82ed/fastavro-1.12.2-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2d4d66afad78e8f47feaa307728a6b71fe3effc63ba2b9eeb109ee687c9bd397", size = 3399232, upload-time = "2026-04-24T14:37:04.837Z" },
+    { url = "https://files.pythonhosted.org/packages/38/0a/650f256c15f5875b6081544b9ba7ed8254329213e7e49e3db0aec68b5bee/fastavro-1.12.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:2328ec07925c04c89719e3971c9068a165c7fd474ea87675b1204de0440e71ff", size = 3320222, upload-time = "2026-04-24T14:37:07.281Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/54/8351d388f94fbb0870e8cffaae41d3cc607acc8d6a8a6a217e2794829593/fastavro-1.12.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:55dea7e74b834d4b70467fc19c5b9ccb5509fe39abc4d26891187c1b22176423", size = 3337096, upload-time = "2026-04-24T14:37:09.452Z" },
+    { url = "https://files.pythonhosted.org/packages/da/eb/b36ba9a88826e8c272df02e2f8b5da717e88b6eb508fddca3ca450043731/fastavro-1.12.2-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:8d37c87826ae7195cfbd20fcd448801f2f563bb38f2691ec6574e39cb9eca6c8", size = 963119, upload-time = "2026-04-24T14:37:11.557Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/02/3d7f540fb26ba4ea1f4ebd2783c586614da9ac00906a3092e92fd3f104a2/fastavro-1.12.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4c463a3701f293e30d3d62e71e1989f112028d07f87432baf4507eeb57ec3831", size = 3266238, upload-time = "2026-04-24T14:37:13.84Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/0b/b77be56c5109da0fc7dcfd7e6b6752fe0a61d0a5c58c6a65e38b4501946a/fastavro-1.12.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f604ba83498e209fff4c7ecc5063a39421dc538dace694bc592f9f338254f3dc", size = 3324020, upload-time = "2026-04-24T14:37:16.096Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/6e/951d41f244107e91bf2f59245b71783c03eaab4bdbc960d58316c19652bb/fastavro-1.12.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:bfac2dada8ddc002e8b7d8289d6fad4f070bc1fec20371cec684a7d10d932e96", size = 3170160, upload-time = "2026-04-24T14:37:18.168Z" },
+    { url = "https://files.pythonhosted.org/packages/94/6f/2adb571fda448d4afd2466e1cef2963fefdc6b37847da05249983e415f17/fastavro-1.12.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:bc44ba6289fb1f5ee318335958dde6ad6d742dcb4bb8930de843e9024c64b68c", size = 3281842, upload-time = "2026-04-24T14:37:20.833Z" },
+    { url = "https://files.pythonhosted.org/packages/17/07/4bad2e96c4c6bae40253be2573cc09c1e5b9ccf821e1ff74e0d33b64bf90/fastavro-1.12.2-cp314-cp314-win_amd64.whl", hash = "sha256:a475418f71c5aed69899813ecccf392429c08c3a63df3030129db71760b0db8f", size = 450903, upload-time = "2026-04-24T14:37:23.059Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/b7/180f67ba9a46ba23a1ff6432f48d3087d4f2048579ecc262b00426cb1c63/fastavro-1.12.2-cp314-cp314-win_arm64.whl", hash = "sha256:daec9f9655a1d4636613c47d6d3343f6e039150d66cdce62543e20ca36612a8a", size = 391076, upload-time = "2026-04-24T14:37:24.756Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/8f/18f60329b627d2118a4a2b19e8741fbd807d60bf0470554e1bbfb7f1bca3/fastavro-1.12.2-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:57594b72cf663bbd0f3ad8a319a999fc3d7c71065a6799b2c1d1a6a137894c5b", size = 1055430, upload-time = "2026-05-09T21:53:14.364Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/ac/a1fa1fc29df0efc89d4946a743b09bdc9500591b5b92083eaf8e93664916/fastavro-1.12.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:74412132bbfb153cbf704517f2c89f7d3e170feb681b13bceace690f66f8d5fa", size = 3503075, upload-time = "2026-04-24T14:37:26.826Z" },
+    { url = "https://files.pythonhosted.org/packages/82/bf/4f669e10b6bc38a731ee3400aed1a1e2d0a3e3cf411e72f6b320d3af0eaf/fastavro-1.12.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e367a84c9133018e0a3bc822abe78d7f1f9a6092991a0ec409468cf4ef260282", size = 3410900, upload-time = "2026-04-24T14:37:29.233Z" },
+    { url = "https://files.pythonhosted.org/packages/10/39/ecb19fdae4158a7730b5963fbf1b6d38d74678392d73083be518642af0c1/fastavro-1.12.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:044fafca0853e9ae14009de7763ac9e8e8f8b96f8a4e90bd58b695443266a370", size = 3335637, upload-time = "2026-04-24T14:37:31.472Z" },
+    { url = "https://files.pythonhosted.org/packages/32/f1/f21bd5319113e89ceceed2df840df21e9c5150d181db74b6ba80400f9f48/fastavro-1.12.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:afede7324822800e4f90e96b9514188a237a60f35e8e7a10b2129c10c78f6e4d", size = 3356664, upload-time = "2026-04-24T14:37:34.231Z" },
 ]
 
 [[package]]
 name = "fastmcp"
-version = "3.2.3"
+version = "3.4.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "fastmcp-slim", extra = ["client", "server"] },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/29/18/46beaec18c9f86a599ae3f9cdf6677dd6b50240cfd844d18233710b47f13/fastmcp-3.4.2.tar.gz", hash = "sha256:b468722946fc467c3796a6572f7a14d93d48c014cf8fea12910245220cbbe4e1", size = 28756849, upload-time = "2026-06-06T01:30:35.694Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/58/4d/8b1ba42251160e11ca34686344572121432c23a082d56ef6bbdec5888fc1/fastmcp-3.4.2-py3-none-any.whl", hash = "sha256:c87a62b029f0c5400ada85f683629345d2466c39169f0cb853e487b2f7308c08", size = 8018, upload-time = "2026-06-06T01:30:38.118Z" },
+]
+
+[[package]]
+name = "fastmcp-slim"
+version = "3.4.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "platformdirs" },
+    { name = "pydantic", extra = ["email"] },
+    { name = "pydantic-settings" },
+    { name = "python-dotenv" },
+    { name = "rich" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/a3/2e/d627b28b7403ecc526991ef732921b08bde010006e6148635f053fd29f4c/fastmcp_slim-3.4.2.tar.gz", hash = "sha256:290646e0955a516235a317151034559aa48336cb843d3f006131aedad8759bb4", size = 576291, upload-time = "2026-06-06T01:30:12.553Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f7/58/22afebf18df7260b09148199cbeb90cdcc4b3a4e1b5d7460e3591c3a7add/fastmcp_slim-3.4.2-py3-none-any.whl", hash = "sha256:bdc72492212681ca502755fa8acc0457f559295da1fc3dfc0599adc1c04b82f3", size = 749195, upload-time = "2026-06-06T01:30:11.22Z" },
+]
+
+[package.optional-dependencies]
+client = [
+    { name = "authlib" },
+    { name = "exceptiongroup" },
+    { name = "httpx" },
+    { name = "mcp" },
+    { name = "opentelemetry-api" },
+    { name = "py-key-value-aio", extra = ["filetree", "keyring", "memory"] },
+    { name = "starlette" },
+]
+server = [
     { name = "authlib" },
     { name = "cyclopts" },
     { name = "exceptiongroup" },
+    { name = "griffelib" },
     { name = "httpx" },
+    { name = "joserfc" },
     { name = "jsonref" },
     { name = "jsonschema-path" },
     { name = "mcp" },
     { name = "openapi-pydantic" },
     { name = "opentelemetry-api" },
     { name = "packaging" },
-    { name = "platformdirs" },
     { name = "py-key-value-aio", extra = ["filetree", "keyring", "memory"] },
-    { name = "pydantic", extra = ["email"] },
     { name = "pyperclip" },
-    { name = "python-dotenv" },
+    { name = "python-multipart" },
     { name = "pyyaml" },
-    { name = "rich" },
+    { name = "starlette" },
     { name = "uncalled-for" },
     { name = "uvicorn" },
     { name = "watchfiles" },
     { name = "websockets" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/b9/42/7eed0a38e3b7a386805fecacf8a5a9353a2b3040395ef9e30e585d8549ac/fastmcp-3.2.3.tar.gz", hash = "sha256:4f02ae8b00227285a0cf6544dea1db29b022c8cdd8d3dfdec7118540210ae60a", size = 26328743, upload-time = "2026-04-09T22:05:03.402Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/f5/48/84b6dcba793178a44b9d99b4def6cd62f870dcfc5bb7b9153ac390135812/fastmcp-3.2.3-py3-none-any.whl", hash = "sha256:cc50af6eed1f62ed8b6ebf4987286d8d1d006f08d5bec739d5c7fb76160e0911", size = 707260, upload-time = "2026-04-09T22:05:01.225Z" },
-]
 
 [[package]]
 name = "ffmpeg-python"
@@ -871,15 +907,15 @@ wheels = [
 
 [[package]]
 name = "genai-prices"
-version = "0.0.56"
+version = "0.0.67"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "httpx" },
+    { name = "httpx2" },
     { name = "pydantic" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/44/6b/94b3018a672c7775edfb485f0fed8f6068fba75e49b067e8a1ac5eb96764/genai_prices-0.0.56.tar.gz", hash = "sha256:ac24b16a84d0ab97539bfa48dfa4649689de8e3ce71c12ebacef29efb1998045", size = 65872, upload-time = "2026-03-20T20:33:00.732Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/17/9e/f96ad08d62f7bd33a5b24e65d4eb220569714b9a2a8813ada2e1fa47b4dd/genai_prices-0.0.67.tar.gz", hash = "sha256:54e07eb6541fda377187a471c5dba21a81b439c57f8dc44d89db3103c29ca343", size = 80015, upload-time = "2026-06-24T20:16:23.661Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a3/f6/8ef7e4c286deb2709d11ca96a5237caae3ef4876ab3c48095856cfd2df30/genai_prices-0.0.56-py3-none-any.whl", hash = "sha256:dbe86be8f3f556bed1b72209ed36851fec8b01793b3b220f42921a4e7da945f6", size = 68966, upload-time = "2026-03-20T20:33:02.555Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/05/d1ca6b960a3305f86d1c5f4274f2ddf8c94611ec7edc436a01cd38a01742/genai_prices-0.0.67-py3-none-any.whl", hash = "sha256:08977f1e83b4132abcfc60dabf21ff13c2d25958afb9199e59c4407bf5c9ed3f", size = 82495, upload-time = "2026-06-24T20:16:22.4Z" },
 ]
 
 [[package]]
@@ -911,7 +947,7 @@ requests = [
 
 [[package]]
 name = "google-genai"
-version = "1.68.0"
+version = "2.10.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -925,9 +961,9 @@ dependencies = [
     { name = "typing-extensions" },
     { name = "websockets" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9c/2c/f059982dbcb658cc535c81bbcbe7e2c040d675f4b563b03cdb01018a4bc3/google_genai-1.68.0.tar.gz", hash = "sha256:ac30c0b8bc630f9372993a97e4a11dae0e36f2e10d7c55eacdca95a9fa14ca96", size = 511285, upload-time = "2026-03-18T01:03:18.243Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/cd/fe/b796087493c3c55371aa58b9f264841ace5bfdf8c668cafa7afa33c44bec/google_genai-2.10.0.tar.gz", hash = "sha256:77912cd558cd7dfd5b75c25fd1c609e78d7954dde583331104022a46ea90f9ee", size = 600039, upload-time = "2026-06-24T01:33:18.157Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/84/de/7d3ee9c94b74c3578ea4f88d45e8de9405902f857932334d81e89bce3dfa/google_genai-1.68.0-py3-none-any.whl", hash = "sha256:a1bc9919c0e2ea2907d1e319b65471d3d6d58c54822039a249fe1323e4178d15", size = 750912, upload-time = "2026-03-18T01:03:15.983Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/39/00bcfd94de255d24249401efff4f48d77bf6066b46447e519fa193c0c299/google_genai-2.10.0-py3-none-any.whl", hash = "sha256:d5350311567ae660c24cbc1752aee4b3d660f89c0106d2dcd2a69978c35afe1e", size = 957974, upload-time = "2026-06-24T01:33:16.296Z" },
 ]
 
 [[package]]
@@ -953,7 +989,7 @@ wheels = [
 
 [[package]]
 name = "groq"
-version = "1.1.1"
+version = "1.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -963,40 +999,40 @@ dependencies = [
     { name = "sniffio" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/9f/bc/7ad1d9967c58b21cdec0c94f26f40fc37b07ba60715d6cbc7c7ef775d927/groq-1.1.1.tar.gz", hash = "sha256:ea971eca72d88e875a78567904bfb46a2f2e43907bfe400fc36a81150a4066d8", size = 150783, upload-time = "2026-03-11T09:11:32.027Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/0b/3a/31c54e35d694ba9c263939ecae0874c78fc51f22b9fb13d2dab50edf6e3c/groq-1.5.0.tar.gz", hash = "sha256:8648388f8668629490bb0eab11252b4cc43316149fda9c6343e9a9577fe7df88", size = 158239, upload-time = "2026-06-21T22:57:30.202Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/8f/1d/0749c5f0ed76693f6a3a40e2b0c40201fa23e1ccb00e69d5aa63e3f5b0ff/groq-1.1.1-py3-none-any.whl", hash = "sha256:6b7932c0fd3189ad1842fbc294f57fbf014713e01f72037451cb60a138c4b846", size = 139650, upload-time = "2026-03-11T09:11:29.87Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/c3/cac2aee75198c0382a2e6070619a798de2288e01850abb6e999746bb92e3/groq-1.5.0-py3-none-any.whl", hash = "sha256:a927fd75b4a60cb066c408cb4f9647536caf74e241ea75bc57d1810501b8203f", size = 143690, upload-time = "2026-06-21T22:57:29.213Z" },
 ]
 
 [[package]]
 name = "grpcio"
-version = "1.78.0"
+version = "1.81.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/06/8a/3d098f35c143a89520e568e6539cc098fcd294495910e359889ce8741c84/grpcio-1.78.0.tar.gz", hash = "sha256:7382b95189546f375c174f53a5fa873cef91c4b8005faa05cc5b3beea9c4f1c5", size = 12852416, upload-time = "2026-02-06T09:57:18.093Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b0/b5/1ff353970a87eda4c98251e34d2dfd214abd4982dc89119c9252a2a482d2/grpcio-1.81.1.tar.gz", hash = "sha256:6fa10a767143a5e82e8eaab53918af0cd8909a57a27f8cb2288b80a613ac671b", size = 13026582, upload-time = "2026-06-11T12:46:51.673Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/05/a9/8f75894993895f361ed8636cd9237f4ab39ef87fd30db17467235ed1c045/grpcio-1.78.0-cp313-cp313-linux_armv7l.whl", hash = "sha256:ce3a90455492bf8bfa38e56fbbe1dbd4f872a3d8eeaf7337dc3b1c8aa28c271b", size = 5920143, upload-time = "2026-02-06T09:55:52.035Z" },
-    { url = "https://files.pythonhosted.org/packages/55/06/0b78408e938ac424100100fd081189451b472236e8a3a1f6500390dc4954/grpcio-1.78.0-cp313-cp313-macosx_11_0_universal2.whl", hash = "sha256:2bf5e2e163b356978b23652c4818ce4759d40f4712ee9ec5a83c4be6f8c23a3a", size = 11803926, upload-time = "2026-02-06T09:55:55.494Z" },
-    { url = "https://files.pythonhosted.org/packages/88/93/b59fe7832ff6ae3c78b813ea43dac60e295fa03606d14d89d2e0ec29f4f3/grpcio-1.78.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:8f2ac84905d12918e4e55a16da17939eb63e433dc11b677267c35568aa63fc84", size = 6478628, upload-time = "2026-02-06T09:55:58.533Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/df/e67e3734527f9926b7d9c0dde6cd998d1d26850c3ed8eeec81297967ac67/grpcio-1.78.0-cp313-cp313-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:b58f37edab4a3881bc6c9bca52670610e0c9ca14e2ea3cf9debf185b870457fb", size = 7173574, upload-time = "2026-02-06T09:56:01.786Z" },
-    { url = "https://files.pythonhosted.org/packages/a6/62/cc03fffb07bfba982a9ec097b164e8835546980aec25ecfa5f9c1a47e022/grpcio-1.78.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:735e38e176a88ce41840c21bb49098ab66177c64c82426e24e0082500cc68af5", size = 6692639, upload-time = "2026-02-06T09:56:04.529Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/9a/289c32e301b85bdb67d7ec68b752155e674ee3ba2173a1858f118e399ef3/grpcio-1.78.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:2045397e63a7a0ee7957c25f7dbb36ddc110e0cfb418403d110c0a7a68a844e9", size = 7268838, upload-time = "2026-02-06T09:56:08.397Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/79/1be93f32add280461fa4773880196572563e9c8510861ac2da0ea0f892b6/grpcio-1.78.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:a9f136fbafe7ccf4ac7e8e0c28b31066e810be52d6e344ef954a3a70234e1702", size = 8251878, upload-time = "2026-02-06T09:56:10.914Z" },
-    { url = "https://files.pythonhosted.org/packages/65/65/793f8e95296ab92e4164593674ae6291b204bb5f67f9d4a711489cd30ffa/grpcio-1.78.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:748b6138585379c737adc08aeffd21222abbda1a86a0dca2a39682feb9196c20", size = 7695412, upload-time = "2026-02-06T09:56:13.593Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/9f/1e233fe697ecc82845942c2822ed06bb522e70d6771c28d5528e4c50f6a4/grpcio-1.78.0-cp313-cp313-win32.whl", hash = "sha256:271c73e6e5676afe4fc52907686670c7cea22ab2310b76a59b678403ed40d670", size = 4064899, upload-time = "2026-02-06T09:56:15.601Z" },
-    { url = "https://files.pythonhosted.org/packages/4d/27/d86b89e36de8a951501fb06a0f38df19853210f341d0b28f83f4aa0ffa08/grpcio-1.78.0-cp313-cp313-win_amd64.whl", hash = "sha256:f2d4e43ee362adfc05994ed479334d5a451ab7bc3f3fee1b796b8ca66895acb4", size = 4797393, upload-time = "2026-02-06T09:56:17.882Z" },
-    { url = "https://files.pythonhosted.org/packages/29/f2/b56e43e3c968bfe822fa6ce5bca10d5c723aa40875b48791ce1029bb78c7/grpcio-1.78.0-cp314-cp314-linux_armv7l.whl", hash = "sha256:e87cbc002b6f440482b3519e36e1313eb5443e9e9e73d6a52d43bd2004fcfd8e", size = 5920591, upload-time = "2026-02-06T09:56:20.758Z" },
-    { url = "https://files.pythonhosted.org/packages/5d/81/1f3b65bd30c334167bfa8b0d23300a44e2725ce39bba5b76a2460d85f745/grpcio-1.78.0-cp314-cp314-macosx_11_0_universal2.whl", hash = "sha256:c41bc64626db62e72afec66b0c8a0da76491510015417c127bfc53b2fe6d7f7f", size = 11813685, upload-time = "2026-02-06T09:56:24.315Z" },
-    { url = "https://files.pythonhosted.org/packages/0e/1c/bbe2f8216a5bd3036119c544d63c2e592bdf4a8ec6e4a1867592f4586b26/grpcio-1.78.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:8dfffba826efcf366b1e3ccc37e67afe676f290e13a3b48d31a46739f80a8724", size = 6487803, upload-time = "2026-02-06T09:56:27.367Z" },
-    { url = "https://files.pythonhosted.org/packages/16/5c/a6b2419723ea7ddce6308259a55e8e7593d88464ce8db9f4aa857aba96fa/grpcio-1.78.0-cp314-cp314-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:74be1268d1439eaaf552c698cdb11cd594f0c49295ae6bb72c34ee31abbe611b", size = 7173206, upload-time = "2026-02-06T09:56:29.876Z" },
-    { url = "https://files.pythonhosted.org/packages/df/1e/b8801345629a415ea7e26c83d75eb5dbe91b07ffe5210cc517348a8d4218/grpcio-1.78.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:be63c88b32e6c0f1429f1398ca5c09bc64b0d80950c8bb7807d7d7fb36fb84c7", size = 6693826, upload-time = "2026-02-06T09:56:32.305Z" },
-    { url = "https://files.pythonhosted.org/packages/34/84/0de28eac0377742679a510784f049738a80424b17287739fc47d63c2439e/grpcio-1.78.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:3c586ac70e855c721bda8f548d38c3ca66ac791dc49b66a8281a1f99db85e452", size = 7277897, upload-time = "2026-02-06T09:56:34.915Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/9c/ad8685cfe20559a9edb66f735afdcb2b7d3de69b13666fdfc542e1916ebd/grpcio-1.78.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:35eb275bf1751d2ffbd8f57cdbc46058e857cf3971041521b78b7db94bdaf127", size = 8252404, upload-time = "2026-02-06T09:56:37.553Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/05/33a7a4985586f27e1de4803887c417ec7ced145ebd069bc38a9607059e2b/grpcio-1.78.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:207db540302c884b8848036b80db352a832b99dfdf41db1eb554c2c2c7800f65", size = 7696837, upload-time = "2026-02-06T09:56:40.173Z" },
-    { url = "https://files.pythonhosted.org/packages/73/77/7382241caf88729b106e49e7d18e3116216c778e6a7e833826eb96de22f7/grpcio-1.78.0-cp314-cp314-win32.whl", hash = "sha256:57bab6deef2f4f1ca76cc04565df38dc5713ae6c17de690721bdf30cb1e0545c", size = 4142439, upload-time = "2026-02-06T09:56:43.258Z" },
-    { url = "https://files.pythonhosted.org/packages/48/b2/b096ccce418882fbfda4f7496f9357aaa9a5af1896a9a7f60d9f2b275a06/grpcio-1.78.0-cp314-cp314-win_amd64.whl", hash = "sha256:dce09d6116df20a96acfdbf85e4866258c3758180e8c49845d6ba8248b6d0bbb", size = 4929852, upload-time = "2026-02-06T09:56:45.885Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/42/dcc2e4b600538ef18327c0839d56b7d3c3812337c5d710df5877dbb39b1e/grpcio-1.81.1-cp313-cp313-linux_armv7l.whl", hash = "sha256:b10e1ff4756ed27d5a29d7fc79cfce7ef1ff56ad20025b89bac7cf79e09abbbe", size = 6054466, upload-time = "2026-06-11T12:45:48.43Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/4a/a36e03210183a8a7d4c80c3936acee679f4bd77d5861f369db47b2cc5f05/grpcio-1.81.1-cp313-cp313-macosx_11_0_universal2.whl", hash = "sha256:819edbdcb42ab8598b494bcf0222684bbb7a3c772bd1b1f0be7e029a6063c28e", size = 12048795, upload-time = "2026-06-11T12:45:54.011Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/d5/d68e30b29098f63beab6fe501100fe82674ff142b32c672532da86a99b3a/grpcio-1.81.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c5bf2dc311127d91230cc79b92188c082634a06cf66c5234db49a43b910183b0", size = 6599094, upload-time = "2026-06-11T12:45:57.799Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/b3/e837954d279754f638a11cca5dcf6b24a005efb398984cefaf7735945a54/grpcio-1.81.1-cp313-cp313-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:e8ca6a1fcdb2943c9cbc1804a1baf3acb6071d72a471591678ded84218006e14", size = 7307182, upload-time = "2026-06-11T12:46:00.568Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/1e/b47957057e729adc6cdf519a47f8be2562b7140e280f1418443eb4022192/grpcio-1.81.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:e64dd101d380a115cc5a0c7856788adb535f1a4e21fc543775602f8be95180ae", size = 6810962, upload-time = "2026-06-11T12:46:03.312Z" },
+    { url = "https://files.pythonhosted.org/packages/40/26/569868e364e05b19ec8f969da53d230bcd89c962cd198f7c29943155c4d3/grpcio-1.81.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:98a07f9bf591e3a8919797bee1c53f026ba4acd587e5a4404c8e57c9ec36b2a5", size = 7415698, upload-time = "2026-06-11T12:46:06.005Z" },
+    { url = "https://files.pythonhosted.org/packages/36/0c/5440a0582cb5653fc42a6e262eeb22700943313f8076f9dc927491b20a59/grpcio-1.81.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:c261d74b1a945cf895a9d6eccd1685a8e837531beaab782da4d630a8d12deffb", size = 8407779, upload-time = "2026-06-11T12:46:08.84Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/aa/66fe9f39871d766987d869a03ee0842a026f499c7b1e62decb9e78a8088e/grpcio-1.81.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:58ad1131c300d3c9b933802b3cc4dc69d380822935ba50b28703156ea826fbf7", size = 7844521, upload-time = "2026-06-11T12:46:12.171Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/9e/69bb7194861bcd28fb3193261d4f9c3831b4446993f002cf59068943e7ab/grpcio-1.81.1-cp313-cp313-win32.whl", hash = "sha256:78e29211f26da2fdd0e9c6d2b79f489476140cf7029b6a64808ade7ca4156a42", size = 4182786, upload-time = "2026-06-11T12:46:15.192Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/20/3da8bb0d637feccdc3e1e419bb511ce93651ce7d54164f95de22cc0b8b34/grpcio-1.81.1-cp313-cp313-win_amd64.whl", hash = "sha256:edb59506291b647a30884b1d51a599d605f40b20af4a7dc3d33786a47a31de60", size = 4928648, upload-time = "2026-06-11T12:46:17.823Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/58/19414622b1bf6981bc9c05a365bd548e71876c89000083b3af489251e9c0/grpcio-1.81.1-cp314-cp314-linux_armv7l.whl", hash = "sha256:506f48f2f9c29b143fca3dad7b0d518c188b6c9648c75a2ae6e2d9f2c13a060b", size = 6055336, upload-time = "2026-06-11T12:46:20.557Z" },
+    { url = "https://files.pythonhosted.org/packages/32/f1/2ec88adb92b0eba970dd0e0e7dd086341daa3c75eba4f735f9e44bf684b0/grpcio-1.81.1-cp314-cp314-macosx_11_0_universal2.whl", hash = "sha256:d865db4a6318e1c1bea83292e0ed231090538fc4ca45425b0f0480eb338bbc6e", size = 12056279, upload-time = "2026-06-11T12:46:24.255Z" },
+    { url = "https://files.pythonhosted.org/packages/41/36/e8c5f8c6ec71de73733695ebc809e98b178b534ec6d8eaa31a7ebab4ad4c/grpcio-1.81.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:e2aa72e3ce1770317ef534f63d397b55e130725f5149bd36077c3b539019db27", size = 6608225, upload-time = "2026-06-11T12:46:27.601Z" },
+    { url = "https://files.pythonhosted.org/packages/30/22/96fc577a845ab093326d9ab1adb874bd4936c8cf98ac8ed2f3db13a0a2fb/grpcio-1.81.1-cp314-cp314-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:0490c30c261eded63f3f354979f9dc4502a9fb944cccb60cd9dc85f5a7349854", size = 7306576, upload-time = "2026-06-11T12:46:30.514Z" },
+    { url = "https://files.pythonhosted.org/packages/76/7b/61dab5d5969f28d97fb1009cead1df0a5cd987d3315e1b37f18a4449f8bc/grpcio-1.81.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:410482da976329fe5f4067270401b12cf2bd552ff8020f054ecfaddb5475f9d6", size = 6812165, upload-time = "2026-06-11T12:46:33.699Z" },
+    { url = "https://files.pythonhosted.org/packages/82/78/6e501929d4f5f96462fd82fd9f0f06e5f9612207582b862868d68757b27d/grpcio-1.81.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:e3657301562ac3cb8018d30d0d3ebfa39932239f7b5703422057ef14b69949f5", size = 7422962, upload-time = "2026-06-11T12:46:36.511Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/7e/f2157589e66daa78ebb3165942d05a08bdea93b9d11c2bc1e172aef89685/grpcio-1.81.1-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:24c8e57504c8f45b237e40b99262d181071e5099a07053695b75d97bb53053a0", size = 8408176, upload-time = "2026-06-11T12:46:39.803Z" },
+    { url = "https://files.pythonhosted.org/packages/da/df/c6717fef716e00d235ffb96123baf6dce76d6004f6233fa767c502861460/grpcio-1.81.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:b427c19380991a4eaab2f6144b64b99b412043314c6bf4ab544f97bb31ee4190", size = 7846681, upload-time = "2026-06-11T12:46:43.013Z" },
+    { url = "https://files.pythonhosted.org/packages/36/84/3502e9f210a6a5c4438c8aca3f88edd2e04f6a27f3d41b26cf0a0024b096/grpcio-1.81.1-cp314-cp314-win32.whl", hash = "sha256:61233fe8951e5c85dff81c2458b6528624760166946b5b47ea150a589168411f", size = 4264615, upload-time = "2026-06-11T12:46:45.741Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/b0/4af731ff7492c68a96e4c71bfd0f4590acde92b31c6fe4894e6465c10ff6/grpcio-1.81.1-cp314-cp314-win_amd64.whl", hash = "sha256:3768a5ff1b2125e6f552e561b6b2dca0e64982d8949689b4df145cf8b98d7821", size = 5070275, upload-time = "2026-06-11T12:46:48.486Z" },
 ]
 
 [[package]]
@@ -1053,6 +1089,19 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/7e/f5/f66802a942d491edb555dd61e3a9961140fd64c90bce1eafd741609d334d/httpcore-1.0.9-py3-none-any.whl", hash = "sha256:2d400746a40668fc9dec9810239072b40b4484b640a8c38fd654a024c7a1bf55", size = 78784, upload-time = "2025-04-24T22:06:20.566Z" },
 ]
 
+[[package]]
+name = "httpcore2"
+version = "2.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "h11" },
+    { name = "truststore" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/7b/9b/2b1d1833a58236d1f6ee755e027a3917da0db59cc9708554cefc440ee8b6/httpcore2-2.4.0.tar.gz", hash = "sha256:3093a8ab8980d9f910b9cb4351df9186a0ad2350a6284a9107ac9a362a584422", size = 64618, upload-time = "2026-06-11T06:35:53.425Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7c/72/4fdf2306143a92a471fad9f3655aa542d43aa9188a7c9534e82c9aecf837/httpcore2-2.4.0-py3-none-any.whl", hash = "sha256:5218779da5d6e3c2013ac706121abfb3815d450e0613495c0de50264dce58242", size = 80151, upload-time = "2026-06-11T06:35:50.89Z" },
+]
+
 [[package]]
 name = "httpx"
 version = "0.28.1"
@@ -1077,6 +1126,21 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d2/fd/6668e5aec43ab844de6fc74927e155a3b37bf40d7c3790e49fc0406b6578/httpx_sse-0.4.3-py3-none-any.whl", hash = "sha256:0ac1c9fe3c0afad2e0ebb25a934a59f4c7823b60792691f779fad2c5568830fc", size = 8960, upload-time = "2025-10-10T21:48:21.158Z" },
 ]
 
+[[package]]
+name = "httpx2"
+version = "2.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "anyio" },
+    { name = "httpcore2" },
+    { name = "idna" },
+    { name = "truststore" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/fc/60/b43ced4ccf26e95b396dbf67051d3e5042b645917d4da0469dd82a3bdd4f/httpx2-2.4.0.tar.gz", hash = "sha256:32e0734b61eb0824b3f56a9e98d6d92d381a3ef12c0045aa917ee63df6c411ef", size = 81691, upload-time = "2026-06-11T06:35:54.538Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/29/45/82bc57c3d9c3314f663b67cc057f1c017a6450685dde513f4f8db5cf431f/httpx2-2.4.0-py3-none-any.whl", hash = "sha256:425acd99297829599decf6701386dd84db3542597d36d3e2e4def930ecd57fd9", size = 74941, upload-time = "2026-06-11T06:35:52.235Z" },
+]
+
 [[package]]
 name = "huggingface-hub"
 version = "1.7.2"
@@ -1099,11 +1163,11 @@ wheels = [
 
 [[package]]
 name = "idna"
-version = "3.11"
+version = "3.18"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/6f/6d/0703ccc57f3a7233505399edb88de3cbd678da106337b9fcde432b65ed60/idna-3.11.tar.gz", hash = "sha256:795dafcc9c04ed0c1fb032c2aa73654d8e8c5023a7df64a53f39190ada629902", size = 194582, upload-time = "2025-10-12T14:55:20.501Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/cd/63/9496c57188a2ee585e0f1db071d75089a11e98aa86eb99d9d7618fc1edce/idna-3.18.tar.gz", hash = "sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848", size = 196711, upload-time = "2026-06-02T14:34:07.794Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0e/61/66938bbb5fc52dbdf84594873d5b51fb1f7c7794e9c0f5bd885f30bc507b/idna-3.11-py3-none-any.whl", hash = "sha256:771a87f49d9defaf64091e6e6fe9c18d4833f140bd19464795bc32d966ca37ea", size = 71008, upload-time = "2025-10-12T14:55:18.883Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/5e/d4e9f1a599fb8e573b7b87160658329fbf28d19eac2718f51fc3def3aa5a/idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2", size = 65455, upload-time = "2026-06-02T14:34:06.319Z" },
 ]
 
 [[package]]
@@ -1263,6 +1327,18 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/14/2f/967ba146e6d58cf6a652da73885f52fc68001525b4197effc174321d70b4/jmespath-1.1.0-py3-none-any.whl", hash = "sha256:a5663118de4908c91729bea0acadca56526eb2698e83de10cd116ae0f4e97c64", size = 20419, upload-time = "2026-01-22T16:35:24.919Z" },
 ]
 
+[[package]]
+name = "joserfc"
+version = "1.7.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/44/90/25cb27518750218e4f850be63d8bbb2343efaad1c01c3571aaa4b3c33bd7/joserfc-1.7.1.tar.gz", hash = "sha256:77d0b76514879c68c6f433bc5b7357a4ab72008ff1e33d8379fd11d72bd8ca81", size = 233181, upload-time = "2026-06-08T07:21:33.412Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b3/00/fa62404c3e347f946faa13aa21085205f9cc06ad17671e37f81a51662ae8/joserfc-1.7.1-py3-none-any.whl", hash = "sha256:b3e3d655612e2e1ef67b2600f2f420e12e537b020208fab1761fad647319c164", size = 70423, upload-time = "2026-06-08T07:21:32.001Z" },
+]
+
 [[package]]
 name = "jsonpatch"
 version = "1.33"
@@ -1277,11 +1353,11 @@ wheels = [
 
 [[package]]
 name = "jsonpath-python"
-version = "1.1.5"
+version = "1.1.6"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/2d/db/2f4ecc24da35c6142b39c353d5b7c16eef955cc94b35a48d3fa47996d7c3/jsonpath_python-1.1.5.tar.gz", hash = "sha256:ceea2efd9e56add09330a2c9631ea3d55297b9619348c1055e5bfb9cb0b8c538", size = 87352, upload-time = "2026-03-17T06:16:40.597Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/98/18/4ca8742534a5993ff383f7602e325ce2d5d7cc93d72ac5e1cdedbea8a458/jsonpath_python-1.1.6.tar.gz", hash = "sha256:dded9932b4ec41fb8726e09c83afa4e6be618f938c2db287cc2a81723c639671", size = 88178, upload-time = "2026-05-07T01:26:34.482Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/28/50/1a313fb700526b134c71eb8a225d8b83be0385dbb0204337b4379c698cef/jsonpath_python-1.1.5-py3-none-any.whl", hash = "sha256:a60315404d70a65e76c9a782c84e50600480221d94a58af47b7b4d437351cb4b", size = 14090, upload-time = "2026-03-17T06:16:39.152Z" },
+    { url = "https://files.pythonhosted.org/packages/55/8a/1270a6803bd821cbfcdda387eaa13cb41a7b1f7b9bd145979b3bfb9d6cb7/jsonpath_python-1.1.6-py3-none-any.whl", hash = "sha256:a1c50afd8d3fbbaf47a4873bc890dcb3c15da96f5c020327977d844d8731a2d4", size = 14453, upload-time = "2026-05-07T01:26:33.306Z" },
 ]
 
 [[package]]
@@ -1319,16 +1395,17 @@ wheels = [
 
 [[package]]
 name = "jsonschema-path"
-version = "0.4.5"
+version = "0.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "attrs" },
     { name = "pathable" },
     { name = "pyyaml" },
     { name = "referencing" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/5b/8a/7e6102f2b8bdc6705a9eb5294f8f6f9ccd3a8420e8e8e19671d1dd773251/jsonschema_path-0.4.5.tar.gz", hash = "sha256:c6cd7d577ae290c7defd4f4029e86fdb248ca1bd41a07557795b3c95e5144918", size = 15113, upload-time = "2026-03-03T09:56:46.87Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/39/79/cd02a4df6d9270efdc7d3feefe6edd730b0820c39eeaa107a2faee8322d5/jsonschema_path-0.5.0.tar.gz", hash = "sha256:493b156ba895c97602655b620a8456caa2ce08c1aa389f5a7addec065e6e855c", size = 19597, upload-time = "2026-05-19T20:45:00.971Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/04/d5/4e96c44f6c1ea3d812cf5391d81a4f5abaa540abf8d04ecd7f66e0ed11df/jsonschema_path-0.4.5-py3-none-any.whl", hash = "sha256:7d77a2c3f3ec569a40efe5c5f942c44c1af2a6f96fe0866794c9ef5b8f87fd65", size = 19368, upload-time = "2026-03-03T09:56:45.39Z" },
+    { url = "https://files.pythonhosted.org/packages/04/2c/9e69d73c4297508be9e3b64a970ea3971b3eb8db64ffc5802d40bd25981f/jsonschema_path-0.5.0-py3-none-any.whl", hash = "sha256:2790a070bc7abb08ea3dbe4d340ece4efadf639223001f020c7503229ba068e2", size = 24077, upload-time = "2026-05-19T20:44:59.225Z" },
 ]
 
 [[package]]
@@ -1362,10 +1439,11 @@ wheels = [
 
 [[package]]
 name = "langchain-core"
-version = "1.3.0"
+version = "1.4.8"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "jsonpatch", marker = "python_full_version < '3.14'" },
+    { name = "langchain-protocol", marker = "python_full_version < '3.14'" },
     { name = "langsmith", marker = "python_full_version < '3.14'" },
     { name = "packaging", marker = "python_full_version < '3.14'" },
     { name = "pydantic", marker = "python_full_version < '3.14'" },
@@ -1374,9 +1452,21 @@ dependencies = [
     { name = "typing-extensions", marker = "python_full_version < '3.14'" },
     { name = "uuid-utils", marker = "python_full_version < '3.14'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/92/fe/20190232d9b513242899dbb0c2bb77e31b4d61e343743adbe90ebc2603d2/langchain_core-1.3.0.tar.gz", hash = "sha256:14a39f528bf459aa3aa40d0a7f7f1bae7520d435ef991ae14a4ceb74d8c49046", size = 860755, upload-time = "2026-04-17T14:51:38.298Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/12/e3/bea6d0080acf183332f24dcd74c208aee5857cf8f783c3fb0bd86027d8fb/langchain_core-1.4.8.tar.gz", hash = "sha256:5bf1f8411077c904182ad8f975943d36adcbf579c4e017b3a118b719229ebf9a", size = 957974, upload-time = "2026-06-18T19:39:23.636Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f8/e2/dbfa347aa072a6dc4cd38d6f9ebfc730b4c14c258c47f480f4c5c546f177/langchain_core-1.3.0-py3-none-any.whl", hash = "sha256:baf16ee028475df177b9ab8869a751c79406d64a6f12125b93802991b566cced", size = 515140, upload-time = "2026-04-17T14:51:36.274Z" },
+    { url = "https://files.pythonhosted.org/packages/13/d6/bdf6f0481cc57ef300d6b1eb48cf1400c0409be715d6eb3cabadd1142a09/langchain_core-1.4.8-py3-none-any.whl", hash = "sha256:d84c28b05e3ba8d4271d0827aad5b592ccdaaf986e76768c23503f0a2045e8aa", size = 557416, upload-time = "2026-06-18T19:39:21.902Z" },
+]
+
+[[package]]
+name = "langchain-protocol"
+version = "0.0.18"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions", marker = "python_full_version < '3.14'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/d2/59/b5959aea96faa9146e2e49a7a22882b3528c62efafe9a6a95beab30c2305/langchain_protocol-0.0.18.tar.gz", hash = "sha256:ec3e11782f1ed0c9db38e5a9ed01b0e7a0d3fba406faa8aef6594b73c56a63e6", size = 6150, upload-time = "2026-06-18T17:08:26.959Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/99/2e/d82db9eec13ad0f72e7aaad5c4bc730ab111934fdc83c85523206eb9b0a0/langchain_protocol-0.0.18-py3-none-any.whl", hash = "sha256:70b53a86fbf9cedc863555effe44da192ab02d556ddbf2cf95b8873adcf41b5a", size = 7221, upload-time = "2026-06-18T17:08:25.996Z" },
 ]
 
 [[package]]
@@ -1393,22 +1483,27 @@ wheels = [
 
 [[package]]
 name = "langsmith"
-version = "0.7.32"
+version = "0.9.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
+    { name = "anyio", marker = "python_full_version < '3.14'" },
+    { name = "distro", marker = "python_full_version < '3.14'" },
     { name = "httpx", marker = "python_full_version < '3.14'" },
     { name = "orjson", marker = "python_full_version < '3.14' and platform_python_implementation != 'PyPy'" },
     { name = "packaging", marker = "python_full_version < '3.14'" },
     { name = "pydantic", marker = "python_full_version < '3.14'" },
     { name = "requests", marker = "python_full_version < '3.14'" },
     { name = "requests-toolbelt", marker = "python_full_version < '3.14'" },
+    { name = "sniffio", marker = "python_full_version < '3.14'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.14'" },
     { name = "uuid-utils", marker = "python_full_version < '3.14'" },
+    { name = "websockets", marker = "python_full_version < '3.14'" },
     { name = "xxhash", marker = "python_full_version < '3.14'" },
     { name = "zstandard", marker = "python_full_version < '3.14'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/2f/b4/a0b4a501bee6b8a741ce29f8c48155b132118483cddc6f9247735ddb38fa/langsmith-0.7.32.tar.gz", hash = "sha256:b59b8e106d0e4c4842e158229296086e2aa7c561e3f602acda73d3ad0062e915", size = 1184518, upload-time = "2026-04-15T23:42:41.885Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5b/26/b72987d947278f63ec1e85f01ce85ca7ab2621c7efc0845d4a3a8e5d5dfb/langsmith-0.9.1.tar.gz", hash = "sha256:e5eb905224d156bcece4985285c55b51fffcb06c9353b2c4adb42e1c48b0d05d", size = 4557557, upload-time = "2026-06-23T17:04:23.233Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/62/bc/148f98ac7dad73ac5e1b1c985290079cfeeb9ba13d760a24f25002beb2c9/langsmith-0.7.32-py3-none-any.whl", hash = "sha256:e1fde928990c4c52f47dc5132708cec674355d9101723d564183e965f383bf5f", size = 378272, upload-time = "2026-04-15T23:42:39.905Z" },
+    { url = "https://files.pythonhosted.org/packages/63/42/13c67eb24cddb368df2c8af13e319c86b1d270c90f5b8c9e8baed3593e04/langsmith-0.9.1-py3-none-any.whl", hash = "sha256:1160bf667af63d9bc081821f1df351cb84f7875740858f2a97ffef62b21800a9", size = 578856, upload-time = "2026-06-23T17:04:21.47Z" },
 ]
 
 [[package]]
@@ -1543,7 +1638,7 @@ wheels = [
 
 [[package]]
 name = "mistralai"
-version = "2.1.3"
+version = "2.5.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "eval-type-backport" },
@@ -1555,9 +1650,9 @@ dependencies = [
     { name = "python-dateutil" },
     { name = "typing-inspection" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/7d/98/5fe39d514c19477f06a07e088ce4a44c2e60ac9deebefb9e2c8ed8ef87d2/mistralai-2.1.3.tar.gz", hash = "sha256:0c5de4855b043cd0582406d5c1ddfd91e176f484a158e6ee0b4a0054231be266", size = 331929, upload-time = "2026-03-23T15:00:29.579Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c8/88/960acba5e95998b4a09998d14ff95a25ada8c96ce8670091e3bf85f25696/mistralai-2.5.0.tar.gz", hash = "sha256:b2724154f62f6505d22027cbdb414e2bb143474bb51f89dc362afb1b141d2bae", size = 504089, upload-time = "2026-06-23T17:05:22.687Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/15/7c/f91a26bf469c1cff57325379afa112baeb113ac577d28e69dd408cee5745/mistralai-2.1.3-py3-none-any.whl", hash = "sha256:26daac3bdc69fc2dd58f2c421710eb34131be7883b44a9ea81904a6306e6a90a", size = 754931, upload-time = "2026-03-23T15:00:30.934Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/31/472fa3c766aa9b7869dceb6804344cc9945115ae2ee871258b404d0e7c84/mistralai-2.5.0-py3-none-any.whl", hash = "sha256:f29813f1c2e4c19d24707cb5f74ea5c071d106fcaa84dd856a7e4f2d36d908b2", size = 1216614, upload-time = "2026-06-23T17:05:20.819Z" },
 ]
 
 [[package]]
@@ -1661,14 +1756,14 @@ wheels = [
 
 [[package]]
 name = "nexus-rpc"
-version = "1.2.0"
+version = "1.4.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/06/50/95d7bc91f900da5e22662c82d9bf0f72a4b01f2a552708bf2f43807707a1/nexus_rpc-1.2.0.tar.gz", hash = "sha256:b4ddaffa4d3996aaeadf49b80dfcdfbca48fe4cb616defaf3b3c5c2c8fc61890", size = 74142, upload-time = "2025-11-17T19:17:06.798Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/35/d5/cd1ffb202b76ebc1b33c1332a3416e55a39929006982adc2b1eb069aaa9b/nexus_rpc-1.4.0.tar.gz", hash = "sha256:3b8b373d4865671789cc43623e3dc0bcbf192562e40e13727e17f1c149050fba", size = 82367, upload-time = "2026-02-25T22:01:34.053Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/13/04/eaac430d0e6bf21265ae989427d37e94be5e41dc216879f1fbb6c5339942/nexus_rpc-1.2.0-py3-none-any.whl", hash = "sha256:977876f3af811ad1a09b2961d3d1ac9233bda43ff0febbb0c9906483b9d9f8a3", size = 28166, upload-time = "2025-11-17T19:17:05.64Z" },
+    { url = "https://files.pythonhosted.org/packages/11/52/6327a5f4fda01207205038a106a99848a41c83e933cd23ea2cab3d2ebc6c/nexus_rpc-1.4.0-py3-none-any.whl", hash = "sha256:14c953d3519113f8ccec533a9efdb6b10c28afef75d11cdd6d422640c40b3a49", size = 29645, upload-time = "2026-02-25T22:01:33.122Z" },
 ]
 
 [[package]]
@@ -1932,11 +2027,11 @@ wheels = [
 
 [[package]]
 name = "pathable"
-version = "0.5.0"
+version = "0.6.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/72/55/b748445cb4ea6b125626f15379be7c96d1035d4fa3e8fee362fa92298abf/pathable-0.5.0.tar.gz", hash = "sha256:d81938348a1cacb525e7c75166270644782c0fb9c8cecc16be033e71427e0ef1", size = 16655, upload-time = "2026-02-20T08:47:00.748Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/66/f3/5a20387de9bcd0607871bfc2198ee0e15836da7baa4592ccd7f24c27c986/pathable-0.6.0.tar.gz", hash = "sha256:6404b8b82aef5ff0fd478934137128b99b12212ba35afdde5525ca4f8388ea58", size = 18970, upload-time = "2026-05-19T18:15:11.911Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/52/96/5a770e5c461462575474468e5af931cff9de036e7c2b4fea23c1c58d2cbe/pathable-0.5.0-py3-none-any.whl", hash = "sha256:646e3d09491a6351a0c82632a09c02cdf70a252e73196b36d8a15ba0a114f0a6", size = 16867, upload-time = "2026-02-20T08:46:59.536Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/e8/6d75ffd9784bce2e93d1ae4415649427e39a53bb172d4672b2b59c6f0a7b/pathable-0.6.0-py3-none-any.whl", hash = "sha256:82c4ca6c98c502ad12e0d4e9779b6210afee93c38990988c8c5d1b49bdcdf566", size = 18983, upload-time = "2026-05-19T18:15:10.728Z" },
 ]
 
 [[package]]
@@ -2287,19 +2382,19 @@ email = [
 
 [[package]]
 name = "pydantic-ai"
-version = "1.70.0"
+version = "1.107.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "pydantic-ai-slim", extra = ["ag-ui", "anthropic", "bedrock", "cli", "cohere", "evals", "fastmcp", "google", "groq", "huggingface", "logfire", "mcp", "mistral", "openai", "retries", "temporal", "ui", "vertexai", "xai"] },
+    { name = "pydantic-ai-slim", extra = ["ag-ui", "anthropic", "bedrock", "cli", "cohere", "evals", "fastmcp", "google", "groq", "huggingface", "logfire", "mcp", "mistral", "openai", "retries", "spec", "temporal", "ui", "vertexai", "xai"] },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/53/98/87c97dce65711f922ac448f9103a0bf7c59be67af6663450a8bee3dc824a/pydantic_ai-1.70.0.tar.gz", hash = "sha256:f06368a4fa91f6abcc11d73524dc81516b63739bd88ac93b330e16708b6f784b", size = 12297, upload-time = "2026-03-18T04:24:32.485Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/17/71/7132293bc7ce791d8f3ee7f56b696b216a104bb30a08113f7b3db30a0c9a/pydantic_ai-1.107.0.tar.gz", hash = "sha256:254496d18451b2750a4dddc2591c6c42f25dd223d02ca4252812ab06e75f1044", size = 18414, upload-time = "2026-06-10T14:53:08.678Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fa/08/3a49448850ecdbc020ffa9fde9b7e4f6986c4d67488da33c17bc2150616c/pydantic_ai-1.70.0-py3-none-any.whl", hash = "sha256:d2dbac707153fcdd890e48fc31c4235b4f5f15c815fb60438b76085ffcd0205f", size = 7227, upload-time = "2026-03-18T04:24:24.543Z" },
+    { url = "https://files.pythonhosted.org/packages/65/38/db37ab59fced191a75babbbbe99470e512c91fe730b27d113e3280fdbe44/pydantic_ai-1.107.0-py3-none-any.whl", hash = "sha256:e031880b44ad7ce3836b2f6aa8ce2a0bd733cdb0b89a34adba647e96ddcba788", size = 7588, upload-time = "2026-06-10T14:53:00.57Z" },
 ]
 
 [[package]]
 name = "pydantic-ai-slim"
-version = "1.70.0"
+version = "1.107.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "genai-prices" },
@@ -2310,9 +2405,9 @@ dependencies = [
     { name = "pydantic-graph" },
     { name = "typing-inspection" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ac/97/d57ee44976c349658ea7c645c5c2e1a26830e4b60fdeeee2669d4aaef6eb/pydantic_ai_slim-1.70.0.tar.gz", hash = "sha256:3df0c0e92f72c35e546d24795bce1f4d38f81da2d10addd2e9f255b2d2c83c91", size = 445474, upload-time = "2026-03-18T04:24:34.393Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/4c/26/ced63dfaabbc77f3beb86d59689cdea748e7ccffb6b419dbaf4780f211e8/pydantic_ai_slim-1.107.0.tar.gz", hash = "sha256:4616f689a92fcfecfecf2a7af27aca22f139a873cf6d7a8929eaeee9c0eedbb4", size = 779902, upload-time = "2026-06-10T14:53:10.574Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/da/8c/8545d28d0b3a9957aa21393cfdab8280bb854362360b296cd486ed1713ec/pydantic_ai_slim-1.70.0-py3-none-any.whl", hash = "sha256:162907092a562b3160d9ef0418d317ec941c5c0e6dd6e0aa0dbb53b5a5cd3450", size = 576244, upload-time = "2026-03-18T04:24:27.301Z" },
+    { url = "https://files.pythonhosted.org/packages/15/57/71044e17f931b08cc3930bc0fe5a1e1fd37fa474ae826be004729ef1cb4a/pydantic_ai_slim-1.107.0-py3-none-any.whl", hash = "sha256:1af49bbae06a6c598f72c54d4734ba377100cac493c9a05fa8e089bebeae0da6", size = 964046, upload-time = "2026-06-10T14:53:03.333Z" },
 ]
 
 [package.optional-dependencies]
@@ -2330,6 +2425,7 @@ cli = [
     { name = "argcomplete" },
     { name = "prompt-toolkit" },
     { name = "pyperclip" },
+    { name = "pyyaml" },
     { name = "rich" },
 ]
 cohere = [
@@ -2348,13 +2444,14 @@ groq = [
     { name = "groq" },
 ]
 huggingface = [
+    { name = "hf-xet", marker = "platform_machine == 'AMD64' or platform_machine == 'aarch64' or platform_machine == 'amd64' or platform_machine == 'arm64' or platform_machine == 'x86_64'" },
     { name = "huggingface-hub" },
 ]
 logfire = [
     { name = "logfire", extra = ["httpx"] },
 ]
 mcp = [
-    { name = "mcp" },
+    { name = "fastmcp-slim", extra = ["client"] },
 ]
 mistral = [
     { name = "mistralai" },
@@ -2366,6 +2463,10 @@ openai = [
 retries = [
     { name = "tenacity" },
 ]
+spec = [
+    { name = "pydantic-handlebars" },
+    { name = "pyyaml" },
+]
 temporal = [
     { name = "temporalio" },
 ]
@@ -2438,7 +2539,7 @@ wheels = [
 
 [[package]]
 name = "pydantic-evals"
-version = "1.70.0"
+version = "1.107.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -2448,14 +2549,14 @@ dependencies = [
     { name = "pyyaml" },
     { name = "rich" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/01/46/21ab46e81cba78892c92ab71d21b61b23682e5e5fc645aa3647822abc3a5/pydantic_evals-1.70.0.tar.gz", hash = "sha256:ac42099233557344b41f6c43429294e61202490eb0ee9ebf6422dd4c7ea6d941", size = 56737, upload-time = "2026-03-18T04:24:35.643Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/26/ad/f33306cf668d33cabce8af5e82b58ae367cc8422a2078c2df13327c13532/pydantic_evals-1.107.0.tar.gz", hash = "sha256:153378eda4847d48ca5e6b995e6221e5f0e4f4641771a1eed244fa2065923b27", size = 78546, upload-time = "2026-06-10T14:53:12.01Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/13/9a/6d5b74b602820621bb225e47d47f514d72e5ac5119e5dd740cd493e8ffa7/pydantic_evals-1.70.0-py3-none-any.whl", hash = "sha256:2f0c3c045c8c07b3d13876b8b0a64063ef14eb9ce27331694c8c1275f9c234b1", size = 67604, upload-time = "2026-03-18T04:24:29.134Z" },
+    { url = "https://files.pythonhosted.org/packages/23/ea/ecdaab037479f3b26c0efd47598f7caaad506fc53837196c1cf7e4701263/pydantic_evals-1.107.0-py3-none-any.whl", hash = "sha256:2df2f6deb82226f0404137ebecf9389c2270e08e30c066e239ae9090173826ec", size = 93586, upload-time = "2026-06-10T14:53:05.362Z" },
 ]
 
 [[package]]
 name = "pydantic-graph"
-version = "1.70.0"
+version = "1.107.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "httpx" },
@@ -2463,41 +2564,53 @@ dependencies = [
     { name = "pydantic" },
     { name = "typing-inspection" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/07/27/f7a71ca2a3705e7c24fd777959cf5515646cc5f23b5b16c886a2ed373340/pydantic_graph-1.70.0.tar.gz", hash = "sha256:3f76d9137369ef8748b0e8a6df1a08262118af20a32bc139d23e5c0509c6b711", size = 58578, upload-time = "2026-03-18T04:24:37.007Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/dd/c3/6e8c2d13b8701041f1b3eac5deb41f25d4dbfa479a190d5c6becc23f2a49/pydantic_graph-1.107.0.tar.gz", hash = "sha256:278dd89b3e33f3a2963ac949f27a53aef705c5d883a8ce5d06d23e6e3cfbd972", size = 62564, upload-time = "2026-06-10T14:53:13.366Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/38/fd/19c42b60c37dfdbbf5b76c7b218e8309b43dac501f7aaf2025527ca05023/pydantic_graph-1.70.0-py3-none-any.whl", hash = "sha256:6083c1503a2587990ee1b8a15915106e3ddabc8f3f11fbc4a108a7d7496af4a5", size = 72351, upload-time = "2026-03-18T04:24:30.291Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/72/621556e3f5068400d43a0375d38e5963de30256eaa5a702aba12e82ed0ff/pydantic_graph-1.107.0-py3-none-any.whl", hash = "sha256:71add94fe7e14c703977a895117c475aae6c0b02a774a036c4d00d9a63c78b00", size = 80106, upload-time = "2026-06-10T14:53:06.543Z" },
+]
+
+[[package]]
+name = "pydantic-handlebars"
+version = "0.2.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pydantic" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/96/73/e55a1fe1a8788a5fa82d9209e796f4111e28f2d2fecab7173aa6d80516ad/pydantic_handlebars-0.2.1.tar.gz", hash = "sha256:d4124cfbf7d6e3bded9331a08ccccf6f29f3e3a93665b35b5d6061650aeeb49f", size = 176949, upload-time = "2026-05-25T01:24:38.354Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/55/11/364bc401f1d8fdb3947079fc43ffdfbfc9132d065981a03a95d2e87440c4/pydantic_handlebars-0.2.1-py3-none-any.whl", hash = "sha256:c713427d6498cf4b66814447d54753a2748f8a8d3a9f00c194192ddb3df61e52", size = 50476, upload-time = "2026-05-25T01:24:37.104Z" },
 ]
 
 [[package]]
 name = "pydantic-settings"
-version = "2.13.1"
+version = "2.14.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pydantic" },
     { name = "python-dotenv" },
     { name = "typing-inspection" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/52/6d/fffca34caecc4a3f97bda81b2098da5e8ab7efc9a66e819074a11955d87e/pydantic_settings-2.13.1.tar.gz", hash = "sha256:b4c11847b15237fb0171e1462bf540e294affb9b86db4d9aa5c01730bdbe4025", size = 223826, upload-time = "2026-02-19T13:45:08.055Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5c/b5/8f48e906c3e0205276e8bd8cb7512217a87b2685304d64be27cad5b3019f/pydantic_settings-2.14.2.tar.gz", hash = "sha256:c19dd64b19097f1de80184f0cc7b0272a13ae6e170cbf240a3e27e381ed14a5f", size = 237700, upload-time = "2026-06-19T13:44:56.324Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/00/4b/ccc026168948fec4f7555b9164c724cf4125eac006e176541483d2c959be/pydantic_settings-2.13.1-py3-none-any.whl", hash = "sha256:d56fd801823dbeae7f0975e1f8c8e25c258eb75d278ea7abb5d9cebb01b56237", size = 58929, upload-time = "2026-02-19T13:45:06.034Z" },
+    { url = "https://files.pythonhosted.org/packages/77/c1/6e422f34e569cf8e18df68d1939c81c099d2b61e4f7d9621c8a77560799c/pydantic_settings-2.14.2-py3-none-any.whl", hash = "sha256:a20c97b37910b6550d5ea50fbcc2d4187defe58cd57070b73863d069419c9440", size = 61715, upload-time = "2026-06-19T13:44:55.02Z" },
 ]
 
 [[package]]
 name = "pygments"
-version = "2.19.2"
+version = "2.20.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/b0/77/a5b8c569bf593b0140bde72ea885a803b82086995367bf2037de0159d924/pygments-2.19.2.tar.gz", hash = "sha256:636cb2477cec7f8952536970bc533bc43743542f70392ae026374600add5b887", size = 4968631, upload-time = "2025-06-21T13:39:12.283Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/c7/21/705964c7812476f378728bdf590ca4b771ec72385c533964653c68e86bdc/pygments-2.19.2-py3-none-any.whl", hash = "sha256:86540386c03d588bb81d44bc3928634ff26449851e99741617ecb9037ee5ec0b", size = 1225217, upload-time = "2025-06-21T13:39:07.939Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
 ]
 
 [[package]]
 name = "pyjwt"
-version = "2.12.1"
+version = "2.13.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c2/27/a3b6e5bf6ff856d2509292e95c8f57f0df7017cf5394921fc4e4ef40308a/pyjwt-2.12.1.tar.gz", hash = "sha256:c74a7a2adf861c04d002db713dd85f84beb242228e671280bf709d765b03672b", size = 102564, upload-time = "2026-03-13T19:27:37.25Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e5/7a/8dd906bd22e79e47397a61742927f6747fe93242ef86645ee9092e610244/pyjwt-2.12.1-py3-none-any.whl", hash = "sha256:28ca37c070cad8ba8cd9790cd940535d40274d22f80ab87f3ac6a713e6e8454c", size = 29726, upload-time = "2026-03-13T19:27:35.677Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
 ]
 
 [package.optional-dependencies]
@@ -2529,7 +2642,7 @@ wheels = [
 
 [[package]]
 name = "pytest"
-version = "9.0.2"
+version = "9.1.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -2538,9 +2651,9 @@ dependencies = [
     { name = "pluggy" },
     { name = "pygments" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d1/db/7ef3487e0fb0049ddb5ce41d3a49c235bf9ad299b6a25d5780a89f19230f/pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11", size = 1568901, upload-time = "2025-12-06T21:30:51.014Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e4/47/b9efed96c114afcfa3c9d3fe98a76a1d14c74a9e266d397cf6eb64be5e01/pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313", size = 1636369, upload-time = "2026-06-19T10:58:32.857Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/3b/ab/b3226f0bd7cdcf710fbede2b3548584366da3b19b5021e74f5bde2a8fa3f/pytest-9.0.2-py3-none-any.whl", hash = "sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b", size = 374801, upload-time = "2025-12-06T21:30:49.154Z" },
+    { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" },
 ]
 
 [[package]]
@@ -2566,11 +2679,11 @@ wheels = [
 
 [[package]]
 name = "python-multipart"
-version = "0.0.22"
+version = "0.0.32"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/94/01/979e98d542a70714b0cb2b6728ed0b7c46792b695e3eaec3e20711271ca3/python_multipart-0.0.22.tar.gz", hash = "sha256:7340bef99a7e0032613f56dc36027b959fd3b30a787ed62d310e951f7c3a3a58", size = 37612, upload-time = "2026-01-25T10:15:56.219Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/5b/42/55c32bb9b12693c092ad250a0e82edb5b31ddeda6eb772de5f308b3804ad/python_multipart-0.0.32.tar.gz", hash = "sha256:be54b7f3fa167bb83e4fcd936b887b708f4e57fe75911c02aebf53efaf8d938e", size = 46881, upload-time = "2026-06-04T16:18:58.647Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1b/d0/397f9626e711ff749a95d96b7af99b9c566a9bb5129b8e4c10fc4d100304/python_multipart-0.0.22-py3-none-any.whl", hash = "sha256:2b2cd894c83d21bf49d702499531c7bafd057d730c201782048f7945d82de155", size = 24579, upload-time = "2026-01-25T10:15:54.811Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/04/e8135ebd1ad02c56ec633277529b2602ff99ff634be76cdba5744cf554fd/python_multipart-0.0.32-py3-none-any.whl", hash = "sha256:ff6d3f776f16878c894e52e107296ffc890e913c611b1a4ec6c44e2821fe2e23", size = 30042, upload-time = "2026-06-04T16:18:57.319Z" },
 ]
 
 [[package]]
@@ -2742,7 +2855,7 @@ wheels = [
 
 [[package]]
 name = "requests"
-version = "2.32.5"
+version = "2.34.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "certifi" },
@@ -2750,9 +2863,9 @@ dependencies = [
     { name = "idna" },
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c9/74/b3ff8e6c8446842c3f5c837e9c3dfcfe2018ea6ecef224c710c85ef728f4/requests-2.32.5.tar.gz", hash = "sha256:dbba0bac56e100853db0ea71b82b4dfd5fe2bf6d3754a8893c3af500cec7d7cf", size = 134517, upload-time = "2025-08-18T20:46:02.573Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ac/c3/e2a2b89f2d3e2179abd6d00ebd70bff6273f37fb3e0cc209f48b39d00cbf/requests-2.34.2.tar.gz", hash = "sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed", size = 142856, upload-time = "2026-05-14T19:25:27.735Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1e/db/4254e3eabe8020b458f1a747140d32277ec7a271daf1d235b70dc0b4e6e3/requests-2.32.5-py3-none-any.whl", hash = "sha256:2462f94637a34fd532264295e186976db0f5d453d1cdd31473c85a6a161affb6", size = 64738, upload-time = "2025-08-18T20:46:00.542Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/f4/c67b0b3f1b9245e8d266f0f112c500d50e5b4e83cb6f3b71b6528104182a/requests-2.34.2-py3-none-any.whl", hash = "sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0", size = 73075, upload-time = "2026-05-14T19:25:26.443Z" },
 ]
 
 [[package]]
@@ -2782,15 +2895,15 @@ wheels = [
 
 [[package]]
 name = "rich-rst"
-version = "1.3.2"
+version = "2.0.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "docutils" },
+    { name = "pygments" },
     { name = "rich" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/bc/6d/a506aaa4a9eaa945ed8ab2b7347859f53593864289853c5d6d62b77246e0/rich_rst-1.3.2.tar.gz", hash = "sha256:a1196fdddf1e364b02ec68a05e8ff8f6914fee10fbca2e6b6735f166bb0da8d4", size = 14936, upload-time = "2025-10-14T16:49:45.332Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/57/56/3191bae66b08ccc637ea8120426068bcb361cc323c96404c310886937067/rich_rst-2.0.1.tar.gz", hash = "sha256:cbe236ed0901d1ec8427cc6a50bf0a34353ba28ad014dc24def68bfe7f3b9e68", size = 300570, upload-time = "2026-05-16T00:47:57.362Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/13/2f/b4530fbf948867702d0a3f27de4a6aab1d156f406d72852ab902c4d04de9/rich_rst-1.3.2-py3-none-any.whl", hash = "sha256:a99b4907cbe118cf9d18b0b44de272efa61f15117c61e39ebdc431baf5df722a", size = 12567, upload-time = "2025-10-14T16:49:42.953Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/3d/55c17d3ebdf3cd81356002afe5bef9bb8af631db2819785b6eac845b925b/rich_rst-2.0.1-py3-none-any.whl", hash = "sha256:7ee15f345ce25fa02b582c272a6cdbaf0c21243e38061cea273cff659bf3ef61", size = 272922, upload-time = "2026-05-16T00:47:55.508Z" },
 ]
 
 [[package]]
@@ -2886,14 +2999,14 @@ wheels = [
 
 [[package]]
 name = "s3transfer"
-version = "0.16.0"
+version = "0.19.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "botocore" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/05/04/74127fc843314818edfa81b5540e26dd537353b123a4edc563109d8f17dd/s3transfer-0.16.0.tar.gz", hash = "sha256:8e990f13268025792229cd52fa10cb7163744bf56e719e0b9cb925ab79abf920", size = 153827, upload-time = "2025-12-01T02:30:59.114Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/f6/94/dcdaeb1713cab9c84def276cfac7388b17c7d9855bbcfe88d77e4dbafd44/s3transfer-0.19.0.tar.gz", hash = "sha256:ce436931687addc4c1712d52d40b32f53e88315723f107ffa20ba82b05a0f685", size = 165171, upload-time = "2026-06-16T19:44:51.599Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fc/51/727abb13f44c1fcf6d145979e1535a35794db0f6e450a0cb46aa24732fe2/s3transfer-0.16.0-py3-none-any.whl", hash = "sha256:18e25d66fed509e3868dc1572b3f427ff947dd2c56f844a5bf09481ad3f3b2fe", size = 86830, upload-time = "2025-12-01T02:30:57.729Z" },
+    { url = "https://files.pythonhosted.org/packages/46/5f/4c174edad94f82de888ac00a5ddd8d07b35609b6c94f0bdf4d74af57703e/s3transfer-0.19.0-py3-none-any.whl", hash = "sha256:777cc2415536f1debadb5c2ef7779275d0fc0fe0e042411cdd6caebeb2685262", size = 90101, upload-time = "2026-06-16T19:44:50.439Z" },
 ]
 
 [[package]]
@@ -2963,19 +3076,19 @@ wheels = [
 
 [[package]]
 name = "starlette"
-version = "1.0.0"
+version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/81/69/17425771797c36cded50b7fe44e850315d039f28b15901ab44839e70b593/starlette-1.0.0.tar.gz", hash = "sha256:6a4beaf1f81bb472fd19ea9b918b50dc3a77a6f2e190a12954b25e6ed5eea149", size = 2655289, upload-time = "2026-03-22T18:29:46.779Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/eb/e3/7c1dc7381d9f8ab7d854328ebfa884e62cb3f3d8549ddfd37c7814f42afa/starlette-1.3.1.tar.gz", hash = "sha256:05d0213193f2fbaae60e2ecb593b4add4262ad4e46536b54abe36f11a71724e0", size = 2703240, upload-time = "2026-06-12T09:23:11.602Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0b/c9/584bc9651441b4ba60cc4d557d8a547b5aff901af35bda3a4ee30c819b82/starlette-1.0.0-py3-none-any.whl", hash = "sha256:d3ec55e0bb321692d275455ddfd3df75fff145d009685eb40dc91fc66b03d38b", size = 72651, upload-time = "2026-03-22T18:29:45.111Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/bb/2799cc2ede3ed41131f8975621e7213dfc7ef4acbbaadfa440f32500c370/starlette-1.3.1-py3-none-any.whl", hash = "sha256:c7372aae11c3c3f26a42df7bd626cec2f47d03483d261d369516a615a53714c6", size = 73632, upload-time = "2026-06-12T09:23:10.017Z" },
 ]
 
 [[package]]
 name = "temporalio"
-version = "1.20.0"
+version = "1.29.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "nexus-rpc" },
@@ -2983,13 +3096,13 @@ dependencies = [
     { name = "types-protobuf" },
     { name = "typing-extensions" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/21/db/7d5118d28b0918888e1ec98f56f659fdb006351e06d95f30f4274962a76f/temporalio-1.20.0.tar.gz", hash = "sha256:5a6a85b7d298b7359bffa30025f7deac83c74ac095a4c6952fbf06c249a2a67c", size = 1850498, upload-time = "2025-11-25T21:25:20.225Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/0e/95/22e2e19ad95d42d69320e8cd8d48c8543841f367d2d5a4dca48165e466d2/temporalio-1.29.0.tar.gz", hash = "sha256:3fbfddc5f847956ca20c2e671d3f09cefdb2ab6f0d6a6d59664c6102e922f80b", size = 2657001, upload-time = "2026-06-17T21:18:16.72Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f4/1b/e69052aa6003eafe595529485d9c62d1382dd5e671108f1bddf544fb6032/temporalio-1.20.0-cp310-abi3-macosx_10_12_x86_64.whl", hash = "sha256:fba70314b4068f8b1994bddfa0e2ad742483f0ae714d2ef52e63013ccfd7042e", size = 12061638, upload-time = "2025-11-25T21:24:57.918Z" },
-    { url = "https://files.pythonhosted.org/packages/ae/3b/3e8c67ed7f23bedfa231c6ac29a7a9c12b89881da7694732270f3ecd6b0c/temporalio-1.20.0-cp310-abi3-macosx_11_0_arm64.whl", hash = "sha256:ffc5bb6cabc6ae67f0bfba44de6a9c121603134ae18784a2ff3a7f230ad99080", size = 11562603, upload-time = "2025-11-25T21:25:01.721Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/be/ed0cc11702210522a79e09703267ebeca06eb45832b873a58de3ca76b9d0/temporalio-1.20.0-cp310-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a1e80c1e4cdf88fa8277177f563edc91466fe4dc13c0322f26e55c76b6a219e6", size = 11824016, upload-time = "2025-11-25T21:25:06.771Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/97/09c5cafabc80139d97338a2bdd8ec22e08817dfd2949ab3e5b73565006eb/temporalio-1.20.0-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ba92d909188930860c9d89ca6d7a753bc5a67e4e9eac6cea351477c967355eed", size = 12189521, upload-time = "2025-11-25T21:25:12.091Z" },
-    { url = "https://files.pythonhosted.org/packages/11/23/5689c014a76aff3b744b3ee0d80815f63b1362637814f5fbb105244df09b/temporalio-1.20.0-cp310-abi3-win_amd64.whl", hash = "sha256:eacfd571b653e0a0f4aa6593f4d06fc628797898f0900d400e833a1f40cad03a", size = 12745027, upload-time = "2025-11-25T21:25:16.827Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/82/e0810e7e7f5f4eb97e40468abf6bc8d3df0dbc882c09a2c207c38c90d56d/temporalio-1.29.0-cp310-abi3-macosx_10_12_x86_64.whl", hash = "sha256:9d18f989fbea13014e3221de034fbd1945ec05499b663195f0eacb49cc922986", size = 14874156, upload-time = "2026-06-17T21:18:03.299Z" },
+    { url = "https://files.pythonhosted.org/packages/41/48/55a2f948f4cd30d8dcaf1d37a15e23b34d90a68d0d1da6765a08c650bbb2/temporalio-1.29.0-cp310-abi3-macosx_11_0_arm64.whl", hash = "sha256:28bc12b64a7ffc08f7709897d3a0c93faa8972227734669f248cb7de2ce3e69f", size = 14384773, upload-time = "2026-06-17T21:18:06.151Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/71/a13f427089b54de4e11f347b2043934d693baffda569c4b4914e588a6074/temporalio-1.29.0-cp310-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:dd02a107c3f5fa088ed5e4aeda9af91d11afbc53dfd5b28d730776354b159297", size = 14602055, upload-time = "2026-06-17T21:18:08.704Z" },
+    { url = "https://files.pythonhosted.org/packages/73/6a/3ee32775c9b5172560add2ec69c554f476bc6c51ea7a3c24206e03f08cc5/temporalio-1.29.0-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:950b42e05793762eb7b4b3809e78c9e9dcdf2f23f797aa939ac17eca8ad9b3d3", size = 15075878, upload-time = "2026-06-17T21:18:11.499Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/92/24ef16052075a08e7ed071311704a244944485bc8581d82313f0c3d1b385/temporalio-1.29.0-cp310-abi3-win_amd64.whl", hash = "sha256:8969718f947c6b9df3b51ab4a71bad67abfce81a1023aa1a598a224b712b713a", size = 15333733, upload-time = "2026-06-17T21:18:14.201Z" },
 ]
 
 [[package]]
@@ -3079,6 +3192,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/16/e1/3079a9ff9b8e11b846c6ac5c8b5bfb7ff225eee721825310c91b3b50304f/tqdm-4.67.3-py3-none-any.whl", hash = "sha256:ee1e4c0e59148062281c49d80b25b67771a127c85fc9676d3be5f243206826bf", size = 78374, upload-time = "2026-02-03T17:35:50.982Z" },
 ]
 
+[[package]]
+name = "truststore"
+version = "0.10.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/a3/1585216310e344e8102c22482f6060c7a6ea0322b63e026372e6dcefcfd6/truststore-0.10.4.tar.gz", hash = "sha256:9d91bd436463ad5e4ee4aba766628dd6cd7010cf3e2461756b3303710eebc301", size = 26169, upload-time = "2025-08-12T18:49:02.73Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/19/97/56608b2249fe206a67cd573bc93cd9896e1efb9e98bce9c163bcdc704b88/truststore-0.10.4-py3-none-any.whl", hash = "sha256:adaeaecf1cbb5f4de3b1959b42d41f6fab57b2b1666adb59e89cb0b53361d981", size = 18660, upload-time = "2025-08-12T18:49:01.46Z" },
+]
+
 [[package]]
 name = "typeguard"
 version = "4.5.1"
@@ -3117,14 +3239,14 @@ wheels = [
 
 [[package]]
 name = "types-requests"
-version = "2.32.4.20260324"
+version = "2.33.0.20260518"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "urllib3" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/6c/b1/66bafdc85965e5aa3db42e1b9128bf8abe252edd7556d00a07ef437a3e0e/types_requests-2.32.4.20260324.tar.gz", hash = "sha256:33a2a9ccb1de7d4e4da36e347622c35418f6761269014cc32857acabd5df739e", size = 23765, upload-time = "2026-03-24T04:06:35.106Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e0/01/c5a19253fe1ac159159ddf9a3a07cec8bb5e486ec4d9002ad2821da0e5d2/types_requests-2.33.0.20260518.tar.gz", hash = "sha256:df7bd3bfe0ca8402dfb841e7d9be714bb5578203283d66d7dc4ef69343449a5e", size = 24752, upload-time = "2026-05-18T06:07:37.966Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/5b/5a/ce5999f9bd72c7fac681d26cd0a5782b379053bfc2214e2a3fbe30852c9e/types_requests-2.32.4.20260324-py3-none-any.whl", hash = "sha256:f83ef2deb284fe99a249b8b0b0a3e4b9809e01ff456063c4df0aac7670c07ab9", size = 20735, upload-time = "2026-03-24T04:06:33.9Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/bc/b139710a3b6018f7fb2b9508b35c8af564e61bf2bf4fa619d088f3e16f85/types_requests-2.33.0.20260518-py3-none-any.whl", hash = "sha256:626d697d1adaaff76e2044dc8c5c051d8f21abc157bdfe204a75558076fe0bf0", size = 21391, upload-time = "2026-05-18T06:07:37.044Z" },
 ]
 
 [[package]]
@@ -3159,20 +3281,20 @@ wheels = [
 
 [[package]]
 name = "uncalled-for"
-version = "0.2.0"
+version = "0.3.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/02/7c/b5b7d8136f872e3f13b0584e576886de0489d7213a12de6bebf29ff6ebfc/uncalled_for-0.2.0.tar.gz", hash = "sha256:b4f8fdbcec328c5a113807d653e041c5094473dd4afa7c34599ace69ccb7e69f", size = 49488, upload-time = "2026-02-27T17:40:58.137Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/b5/82/345cc927f7fbdae6065e7768759932fcc827fc20b29b45dfbafa2f1f7da4/uncalled_for-0.3.2.tar.gz", hash = "sha256:89f5dbcd71e2b8f47c030b1fa302e6cce2ec795d1ac565eeb6525c5fe55cb8a2", size = 50032, upload-time = "2026-05-06T13:38:25.204Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/ff/7f/4320d9ce3be404e6310b915c3629fe27bf1e2f438a1a7a3cb0396e32e9a9/uncalled_for-0.2.0-py3-none-any.whl", hash = "sha256:2c0bd338faff5f930918f79e7eb9ff48290df2cb05fcc0b40a7f334e55d4d85f", size = 11351, upload-time = "2026-02-27T17:40:56.804Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/25/2c87754f3a9e692315f7b811244090e68f362979fc8886b3fbd2985a1d8c/uncalled_for-0.3.2-py3-none-any.whl", hash = "sha256:0ff60b142c7d1f8070bde9d42afaa70aedc77dcc10998c227687e9c15713418e", size = 11444, upload-time = "2026-05-06T13:38:24.025Z" },
 ]
 
 [[package]]
 name = "urllib3"
-version = "2.6.3"
+version = "2.7.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/c7/24/5f1b3bdffd70275f6661c76461e25f024d5a38a46f04aaca912426a2b1d3/urllib3-2.6.3.tar.gz", hash = "sha256:1b62b6884944a57dbe321509ab94fd4d3b307075e0c2eae991ac71ee15ad38ed", size = 435556, upload-time = "2026-01-07T16:24:43.925Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/39/08/aaaad47bc4e9dc8c725e68f9d04865dbcb2052843ff09c97b08904852d84/urllib3-2.6.3-py3-none-any.whl", hash = "sha256:bf272323e553dfb2e87d9bfd225ca7b0f467b919d7bbd355436d3fd37cb0acd4", size = 131584, upload-time = "2026-01-07T16:24:42.685Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
 ]
 
 [[package]]
@@ -3233,59 +3355,74 @@ wheels = [
 
 [[package]]
 name = "watchfiles"
-version = "1.1.1"
+version = "1.2.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/c2/c9/8869df9b2a2d6c59d79220a4db37679e74f807c559ffe5265e08b227a210/watchfiles-1.1.1.tar.gz", hash = "sha256:a173cb5c16c4f40ab19cecf48a534c409f7ea983ab8fed0741304a1c0a31b3f2", size = 94440, upload-time = "2025-10-14T15:06:21.08Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/cd/41/5e1a4bb12aac5f1493fa1bdc11154eca3b258ca4eba65d39c473fe19d8e9/watchfiles-1.2.0.tar.gz", hash = "sha256:c995fba777f1ea992f090f9236e9284cf7a5d1a0130dd5a3d82c598cacd76838", size = 108252, upload-time = "2026-05-18T04:32:04.251Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/bb/f4/f750b29225fe77139f7ae5de89d4949f5a99f934c65a1f1c0b248f26f747/watchfiles-1.1.1-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:130e4876309e8686a5e37dba7d5e9bc77e6ed908266996ca26572437a5271e18", size = 404321, upload-time = "2025-10-14T15:05:02.063Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/f9/f07a295cde762644aa4c4bb0f88921d2d141af45e735b965fb2e87858328/watchfiles-1.1.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:5f3bde70f157f84ece3765b42b4a52c6ac1a50334903c6eaf765362f6ccca88a", size = 391783, upload-time = "2025-10-14T15:05:03.052Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/11/fc2502457e0bea39a5c958d86d2cb69e407a4d00b85735ca724bfa6e0d1a/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:14e0b1fe858430fc0251737ef3824c54027bedb8c37c38114488b8e131cf8219", size = 449279, upload-time = "2025-10-14T15:05:04.004Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/1f/d66bc15ea0b728df3ed96a539c777acfcad0eb78555ad9efcaa1274688f0/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:f27db948078f3823a6bb3b465180db8ebecf26dd5dae6f6180bd87383b6b4428", size = 459405, upload-time = "2025-10-14T15:05:04.942Z" },
-    { url = "https://files.pythonhosted.org/packages/be/90/9f4a65c0aec3ccf032703e6db02d89a157462fbb2cf20dd415128251cac0/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:059098c3a429f62fc98e8ec62b982230ef2c8df68c79e826e37b895bc359a9c0", size = 488976, upload-time = "2025-10-14T15:05:05.905Z" },
-    { url = "https://files.pythonhosted.org/packages/37/57/ee347af605d867f712be7029bb94c8c071732a4b44792e3176fa3c612d39/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:bfb5862016acc9b869bb57284e6cb35fdf8e22fe59f7548858e2f971d045f150", size = 595506, upload-time = "2025-10-14T15:05:06.906Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/78/cc5ab0b86c122047f75e8fc471c67a04dee395daf847d3e59381996c8707/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:319b27255aacd9923b8a276bb14d21a5f7ff82564c744235fc5eae58d95422ae", size = 474936, upload-time = "2025-10-14T15:05:07.906Z" },
-    { url = "https://files.pythonhosted.org/packages/62/da/def65b170a3815af7bd40a3e7010bf6ab53089ef1b75d05dd5385b87cf08/watchfiles-1.1.1-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c755367e51db90e75b19454b680903631d41f9e3607fbd941d296a020c2d752d", size = 456147, upload-time = "2025-10-14T15:05:09.138Z" },
-    { url = "https://files.pythonhosted.org/packages/57/99/da6573ba71166e82d288d4df0839128004c67d2778d3b566c138695f5c0b/watchfiles-1.1.1-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:c22c776292a23bfc7237a98f791b9ad3144b02116ff10d820829ce62dff46d0b", size = 630007, upload-time = "2025-10-14T15:05:10.117Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/51/7439c4dd39511368849eb1e53279cd3454b4a4dbace80bab88feeb83c6b5/watchfiles-1.1.1-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:3a476189be23c3686bc2f4321dd501cb329c0a0469e77b7b534ee10129ae6374", size = 622280, upload-time = "2025-10-14T15:05:11.146Z" },
-    { url = "https://files.pythonhosted.org/packages/95/9c/8ed97d4bba5db6fdcdb2b298d3898f2dd5c20f6b73aee04eabe56c59677e/watchfiles-1.1.1-cp313-cp313-win32.whl", hash = "sha256:bf0a91bfb5574a2f7fc223cf95eeea79abfefa404bf1ea5e339c0c1560ae99a0", size = 272056, upload-time = "2025-10-14T15:05:12.156Z" },
-    { url = "https://files.pythonhosted.org/packages/1f/f3/c14e28429f744a260d8ceae18bf58c1d5fa56b50d006a7a9f80e1882cb0d/watchfiles-1.1.1-cp313-cp313-win_amd64.whl", hash = "sha256:52e06553899e11e8074503c8e716d574adeeb7e68913115c4b3653c53f9bae42", size = 288162, upload-time = "2025-10-14T15:05:13.208Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/61/fe0e56c40d5cd29523e398d31153218718c5786b5e636d9ae8ae79453d27/watchfiles-1.1.1-cp313-cp313-win_arm64.whl", hash = "sha256:ac3cc5759570cd02662b15fbcd9d917f7ecd47efe0d6b40474eafd246f91ea18", size = 277909, upload-time = "2025-10-14T15:05:14.49Z" },
-    { url = "https://files.pythonhosted.org/packages/79/42/e0a7d749626f1e28c7108a99fb9bf524b501bbbeb9b261ceecde644d5a07/watchfiles-1.1.1-cp313-cp313t-macosx_10_12_x86_64.whl", hash = "sha256:563b116874a9a7ce6f96f87cd0b94f7faf92d08d0021e837796f0a14318ef8da", size = 403389, upload-time = "2025-10-14T15:05:15.777Z" },
-    { url = "https://files.pythonhosted.org/packages/15/49/08732f90ce0fbbc13913f9f215c689cfc9ced345fb1bcd8829a50007cc8d/watchfiles-1.1.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:3ad9fe1dae4ab4212d8c91e80b832425e24f421703b5a42ef2e4a1e215aff051", size = 389964, upload-time = "2025-10-14T15:05:16.85Z" },
-    { url = "https://files.pythonhosted.org/packages/27/0d/7c315d4bd5f2538910491a0393c56bf70d333d51bc5b34bee8e68e8cea19/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ce70f96a46b894b36eba678f153f052967a0d06d5b5a19b336ab0dbbd029f73e", size = 448114, upload-time = "2025-10-14T15:05:17.876Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/24/9e096de47a4d11bc4df41e9d1e61776393eac4cb6eb11b3e23315b78b2cc/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:cb467c999c2eff23a6417e58d75e5828716f42ed8289fe6b77a7e5a91036ca70", size = 460264, upload-time = "2025-10-14T15:05:18.962Z" },
-    { url = "https://files.pythonhosted.org/packages/cc/0f/e8dea6375f1d3ba5fcb0b3583e2b493e77379834c74fd5a22d66d85d6540/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:836398932192dae4146c8f6f737d74baeac8b70ce14831a239bdb1ca882fc261", size = 487877, upload-time = "2025-10-14T15:05:20.094Z" },
-    { url = "https://files.pythonhosted.org/packages/ac/5b/df24cfc6424a12deb41503b64d42fbea6b8cb357ec62ca84a5a3476f654a/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:743185e7372b7bc7c389e1badcc606931a827112fbbd37f14c537320fca08620", size = 595176, upload-time = "2025-10-14T15:05:21.134Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/b5/853b6757f7347de4e9b37e8cc3289283fb983cba1ab4d2d7144694871d9c/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:afaeff7696e0ad9f02cbb8f56365ff4686ab205fcf9c4c5b6fdfaaa16549dd04", size = 473577, upload-time = "2025-10-14T15:05:22.306Z" },
-    { url = "https://files.pythonhosted.org/packages/e1/f7/0a4467be0a56e80447c8529c9fce5b38eab4f513cb3d9bf82e7392a5696b/watchfiles-1.1.1-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3f7eb7da0eb23aa2ba036d4f616d46906013a68caf61b7fdbe42fc8b25132e77", size = 455425, upload-time = "2025-10-14T15:05:23.348Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/e0/82583485ea00137ddf69bc84a2db88bd92ab4a6e3c405e5fb878ead8d0e7/watchfiles-1.1.1-cp313-cp313t-musllinux_1_1_aarch64.whl", hash = "sha256:831a62658609f0e5c64178211c942ace999517f5770fe9436be4c2faeba0c0ef", size = 628826, upload-time = "2025-10-14T15:05:24.398Z" },
-    { url = "https://files.pythonhosted.org/packages/28/9a/a785356fccf9fae84c0cc90570f11702ae9571036fb25932f1242c82191c/watchfiles-1.1.1-cp313-cp313t-musllinux_1_1_x86_64.whl", hash = "sha256:f9a2ae5c91cecc9edd47e041a930490c31c3afb1f5e6d71de3dc671bfaca02bf", size = 622208, upload-time = "2025-10-14T15:05:25.45Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/f4/0872229324ef69b2c3edec35e84bd57a1289e7d3fe74588048ed8947a323/watchfiles-1.1.1-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:d1715143123baeeaeadec0528bb7441103979a1d5f6fd0e1f915383fea7ea6d5", size = 404315, upload-time = "2025-10-14T15:05:26.501Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/22/16d5331eaed1cb107b873f6ae1b69e9ced582fcf0c59a50cd84f403b1c32/watchfiles-1.1.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:39574d6370c4579d7f5d0ad940ce5b20db0e4117444e39b6d8f99db5676c52fd", size = 390869, upload-time = "2025-10-14T15:05:27.649Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/7e/5643bfff5acb6539b18483128fdc0ef2cccc94a5b8fbda130c823e8ed636/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7365b92c2e69ee952902e8f70f3ba6360d0d596d9299d55d7d386df84b6941fb", size = 449919, upload-time = "2025-10-14T15:05:28.701Z" },
-    { url = "https://files.pythonhosted.org/packages/51/2e/c410993ba5025a9f9357c376f48976ef0e1b1aefb73b97a5ae01a5972755/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:bfff9740c69c0e4ed32416f013f3c45e2ae42ccedd1167ef2d805c000b6c71a5", size = 460845, upload-time = "2025-10-14T15:05:30.064Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/a4/2df3b404469122e8680f0fcd06079317e48db58a2da2950fb45020947734/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b27cf2eb1dda37b2089e3907d8ea92922b673c0c427886d4edc6b94d8dfe5db3", size = 489027, upload-time = "2025-10-14T15:05:31.064Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/84/4587ba5b1f267167ee715b7f66e6382cca6938e0a4b870adad93e44747e6/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:526e86aced14a65a5b0ec50827c745597c782ff46b571dbfe46192ab9e0b3c33", size = 595615, upload-time = "2025-10-14T15:05:32.074Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/0f/c6988c91d06e93cd0bb3d4a808bcf32375ca1904609835c3031799e3ecae/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:04e78dd0b6352db95507fd8cb46f39d185cf8c74e4cf1e4fbad1d3df96faf510", size = 474836, upload-time = "2025-10-14T15:05:33.209Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/36/ded8aebea91919485b7bbabbd14f5f359326cb5ec218cd67074d1e426d74/watchfiles-1.1.1-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5c85794a4cfa094714fb9c08d4a218375b2b95b8ed1666e8677c349906246c05", size = 455099, upload-time = "2025-10-14T15:05:34.189Z" },
-    { url = "https://files.pythonhosted.org/packages/98/e0/8c9bdba88af756a2fce230dd365fab2baf927ba42cd47521ee7498fd5211/watchfiles-1.1.1-cp314-cp314-musllinux_1_1_aarch64.whl", hash = "sha256:74d5012b7630714b66be7b7b7a78855ef7ad58e8650c73afc4c076a1f480a8d6", size = 630626, upload-time = "2025-10-14T15:05:35.216Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/84/a95db05354bf2d19e438520d92a8ca475e578c647f78f53197f5a2f17aaf/watchfiles-1.1.1-cp314-cp314-musllinux_1_1_x86_64.whl", hash = "sha256:8fbe85cb3201c7d380d3d0b90e63d520f15d6afe217165d7f98c9c649654db81", size = 622519, upload-time = "2025-10-14T15:05:36.259Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/ce/d8acdc8de545de995c339be67711e474c77d643555a9bb74a9334252bd55/watchfiles-1.1.1-cp314-cp314-win32.whl", hash = "sha256:3fa0b59c92278b5a7800d3ee7733da9d096d4aabcfabb9a928918bd276ef9b9b", size = 272078, upload-time = "2025-10-14T15:05:37.63Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/c9/a74487f72d0451524be827e8edec251da0cc1fcf111646a511ae752e1a3d/watchfiles-1.1.1-cp314-cp314-win_amd64.whl", hash = "sha256:c2047d0b6cea13b3316bdbafbfa0c4228ae593d995030fda39089d36e64fc03a", size = 287664, upload-time = "2025-10-14T15:05:38.95Z" },
-    { url = "https://files.pythonhosted.org/packages/df/b8/8ac000702cdd496cdce998c6f4ee0ca1f15977bba51bdf07d872ebdfc34c/watchfiles-1.1.1-cp314-cp314-win_arm64.whl", hash = "sha256:842178b126593addc05acf6fce960d28bc5fae7afbaa2c6c1b3a7b9460e5be02", size = 277154, upload-time = "2025-10-14T15:05:39.954Z" },
-    { url = "https://files.pythonhosted.org/packages/47/a8/e3af2184707c29f0f14b1963c0aace6529f9d1b8582d5b99f31bbf42f59e/watchfiles-1.1.1-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:88863fbbc1a7312972f1c511f202eb30866370ebb8493aef2812b9ff28156a21", size = 403820, upload-time = "2025-10-14T15:05:40.932Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/ec/e47e307c2f4bd75f9f9e8afbe3876679b18e1bcec449beca132a1c5ffb2d/watchfiles-1.1.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:55c7475190662e202c08c6c0f4d9e345a29367438cf8e8037f3155e10a88d5a5", size = 390510, upload-time = "2025-10-14T15:05:41.945Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/a0/ad235642118090f66e7b2f18fd5c42082418404a79205cdfca50b6309c13/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3f53fa183d53a1d7a8852277c92b967ae99c2d4dcee2bfacff8868e6e30b15f7", size = 448408, upload-time = "2025-10-14T15:05:43.385Z" },
-    { url = "https://files.pythonhosted.org/packages/df/85/97fa10fd5ff3332ae17e7e40e20784e419e28521549780869f1413742e9d/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:6aae418a8b323732fa89721d86f39ec8f092fc2af67f4217a2b07fd3e93c6101", size = 458968, upload-time = "2025-10-14T15:05:44.404Z" },
-    { url = "https://files.pythonhosted.org/packages/47/c2/9059c2e8966ea5ce678166617a7f75ecba6164375f3b288e50a40dc6d489/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f096076119da54a6080e8920cbdaac3dbee667eb91dcc5e5b78840b87415bd44", size = 488096, upload-time = "2025-10-14T15:05:45.398Z" },
-    { url = "https://files.pythonhosted.org/packages/94/44/d90a9ec8ac309bc26db808a13e7bfc0e4e78b6fc051078a554e132e80160/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:00485f441d183717038ed2e887a7c868154f216877653121068107b227a2f64c", size = 596040, upload-time = "2025-10-14T15:05:46.502Z" },
-    { url = "https://files.pythonhosted.org/packages/95/68/4e3479b20ca305cfc561db3ed207a8a1c745ee32bf24f2026a129d0ddb6e/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:a55f3e9e493158d7bfdb60a1165035f1cf7d320914e7b7ea83fe22c6023b58fc", size = 473847, upload-time = "2025-10-14T15:05:47.484Z" },
-    { url = "https://files.pythonhosted.org/packages/4f/55/2af26693fd15165c4ff7857e38330e1b61ab8c37d15dc79118cdba115b7a/watchfiles-1.1.1-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8c91ed27800188c2ae96d16e3149f199d62f86c7af5f5f4d2c61a3ed8cd3666c", size = 455072, upload-time = "2025-10-14T15:05:48.928Z" },
-    { url = "https://files.pythonhosted.org/packages/66/1d/d0d200b10c9311ec25d2273f8aad8c3ef7cc7ea11808022501811208a750/watchfiles-1.1.1-cp314-cp314t-musllinux_1_1_aarch64.whl", hash = "sha256:311ff15a0bae3714ffb603e6ba6dbfba4065ab60865d15a6ec544133bdb21099", size = 629104, upload-time = "2025-10-14T15:05:49.908Z" },
-    { url = "https://files.pythonhosted.org/packages/e3/bd/fa9bb053192491b3867ba07d2343d9f2252e00811567d30ae8d0f78136fe/watchfiles-1.1.1-cp314-cp314t-musllinux_1_1_x86_64.whl", hash = "sha256:a916a2932da8f8ab582f242c065f5c81bed3462849ca79ee357dd9551b0e9b01", size = 622112, upload-time = "2025-10-14T15:05:50.941Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/4d/70a7feced9f87e2ff26dba42667290f41694fc64646c67261fbb8cab5d5c/watchfiles-1.2.0-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:01ea8d66f0693b9b60a6541c8d10263091ca9a9060d242f3c1f3143f9aad2c98", size = 399730, upload-time = "2026-05-18T04:31:38.162Z" },
+    { url = "https://files.pythonhosted.org/packages/31/3a/0da302f2307aee316922806ebd5726c542cbd787c938271cf14a074c7daf/watchfiles-1.2.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:7ba0480b9a74af058f43b337e937a451e109295c420916d68ad24e3dc02f5e44", size = 392842, upload-time = "2026-05-18T04:30:27.051Z" },
+    { url = "https://files.pythonhosted.org/packages/db/ef/d5bdb705c224dbc256aa0c1ec47bf4e61ec52558f2afb44a71a1fe4d7015/watchfiles-1.2.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4f34e26a19f91f710c08e0183429f0d1d15df734e6bc78c31e77b9ea9c433658", size = 452989, upload-time = "2026-05-18T04:31:11.945Z" },
+    { url = "https://files.pythonhosted.org/packages/71/29/5495f2c1661949ef7a35e4d71111d129cfe7606414a26887a919d0a55406/watchfiles-1.2.0-cp313-cp313-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:b4e77f6a55f858504069abd35d336a637555c09bca453dde1ee1e5ada8a6a1fb", size = 458978, upload-time = "2026-05-18T04:30:52.606Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/8c/7f9c07c433811c2fffd93e13fdfb7135de9aab5f2ae41be08960fa0047dc/watchfiles-1.2.0-cp313-cp313-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0cb4d80e212f116474a545c21c912b445f16bb0cef9e6a73a498164223e14e2f", size = 490248, upload-time = "2026-05-18T04:31:36.003Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/11/d93632febc52fbc21be90231bb7c17fd5387f46c9076fd40a5f9c2ae6910/watchfiles-1.2.0-cp313-cp313-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b974946a10af379d425e2eef5b62f5c6ebeaccf91d45eaad6f5b27ecd4f91aa0", size = 571847, upload-time = "2026-05-18T04:31:10.862Z" },
+    { url = "https://files.pythonhosted.org/packages/55/b4/383173e73aabb07ad1d9c7aa859d95437ac46a6d6a1e11005facda0c9d19/watchfiles-1.2.0-cp313-cp313-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:86bc13c25a8d1fcd70b51d0ce7c9b65e90de5666fcbfd3e34957cc73ee19aeb5", size = 465974, upload-time = "2026-05-18T04:30:17.006Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/6c/89b1a230a78f57c52dd8893adb1f92f94411721b6ec12596c56d98c74356/watchfiles-1.2.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ca148d73dea36c9763aaa351e4d7a51780ec1584217c45276f4fe8239c768b71", size = 454782, upload-time = "2026-05-18T04:30:35.656Z" },
+    { url = "https://files.pythonhosted.org/packages/24/62/1732118367cfff0a9fce3bf62ff4bfded09ef5df21d9d446b858b3f70a96/watchfiles-1.2.0-cp313-cp313-manylinux_2_31_riscv64.whl", hash = "sha256:c525543d91961c6955b2636b308569e84a1d1c5f5f2932041ab9ef46422f43e3", size = 465182, upload-time = "2026-05-18T04:30:20.846Z" },
+    { url = "https://files.pythonhosted.org/packages/28/96/716f7e5f51339bf22963f3345f9f27d7f3b30e2eadc597e257c881dd3c53/watchfiles-1.2.0-cp313-cp313-musllinux_1_1_aarch64.whl", hash = "sha256:a204794696ffb8f9b10fba6f7cb5216d42f3b2b71860ccac6b6e42f5f10973b0", size = 629841, upload-time = "2026-05-18T04:31:05.397Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/fe/c40783950fd771ccf66ab3ec2722d188a9af1c7f96c6e811f36e40c6e03f/watchfiles-1.2.0-cp313-cp313-musllinux_1_1_x86_64.whl", hash = "sha256:10d86db20695afe7997ac9e1717637d6714a8d0220458c33f3d2061f54cec427", size = 658028, upload-time = "2026-05-18T04:31:48.22Z" },
+    { url = "https://files.pythonhosted.org/packages/71/72/4508db1856d1d87fcbb3b63f4839bab1b5682cb0e8d224d122263c09654a/watchfiles-1.2.0-cp313-cp313-win32.whl", hash = "sha256:eb283ee99e21ad6443c8cdb06ac5b34b1308c329cbdf03fa02b445363714c799", size = 275183, upload-time = "2026-05-18T04:30:59.57Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/36/14b76ca57652e5cc5fd1c11f32a261292c08a0d19a00351013c2549cbfb2/watchfiles-1.2.0-cp313-cp313-win_amd64.whl", hash = "sha256:a0f27f01bee51861392bb6b7c4fdb290b27d1eb194e9e28788d68102a0e898d9", size = 288059, upload-time = "2026-05-18T04:32:07.937Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/8d/0a85e395398d8d20fadfe5c5d32c726eee17a519e78fb356f2cf7531bffe/watchfiles-1.2.0-cp313-cp313-win_arm64.whl", hash = "sha256:3651aa7058595e9cfb75d35dd5ada2bf9f48a5b8a0f3562821d3e210c507e077", size = 280186, upload-time = "2026-05-18T04:31:54.484Z" },
+    { url = "https://files.pythonhosted.org/packages/37/68/36db056f1fdcc5f07302f56e631774d6835bcd6fa3ace402304621d5f9e5/watchfiles-1.2.0-cp313-cp313t-macosx_10_12_x86_64.whl", hash = "sha256:faea288b6f0ab1902ef08f4ca6de005dccf856c4e0c4f21b8c5fce02d90a1b08", size = 399031, upload-time = "2026-05-18T04:30:44.576Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/64/01a9d6f66a82a5c101ce939274106cc72759d62427e153f01edd2b9f87c2/watchfiles-1.2.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:01859b11fd9fbca670f4d5da00fbac282cfea9bd67a2125d8b2833a3b5617ea9", size = 391205, upload-time = "2026-05-18T04:30:25.413Z" },
+    { url = "https://files.pythonhosted.org/packages/84/2c/0a44fe058cb4bb7b8ede6b6670698bbb7c0400740e378d00022189b7b31d/watchfiles-1.2.0-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:fff610d7bb2256a317bb1e96f0d7862c7aa8076733ee5df0fd41bbe76a24a4f4", size = 451892, upload-time = "2026-05-18T04:32:14.005Z" },
+    { url = "https://files.pythonhosted.org/packages/67/a1/351e0d56cd35e6488b5c8b4fb11a809a5bc923e8fe8fed9faf8920be0c89/watchfiles-1.2.0-cp313-cp313t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:b141a4891c995a039cd89e9a49e62df1dc8a559a5d1a6e4c7106d16c12777a55", size = 458867, upload-time = "2026-05-18T04:31:22.279Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/7d/9d09605187f1b838998624049fcf8bf47b73c1a3b76901fcac1782f62277/watchfiles-1.2.0-cp313-cp313t-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:f22943b7770483f6ea0721c6b11d022947a98eb0acae14694de034f4d0d38925", size = 490217, upload-time = "2026-05-18T04:31:43.657Z" },
+    { url = "https://files.pythonhosted.org/packages/60/5d/a17a16eccb182f04188cd308ec24b1a71a9b5c4e7098269cf35d9fa56d02/watchfiles-1.2.0-cp313-cp313t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:1bc6195825b7dcd217968bb1f801a60fd4c16e8eeab5bedc7fe917d7d5995ab4", size = 571458, upload-time = "2026-05-18T04:32:11.875Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/3d/4dd457062083ab1938e5dfd45032eb425cee2ac817287ca8ff4356183e5d/watchfiles-1.2.0-cp313-cp313t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:d4a4b147f5dca2a5d325a06a832fb43f345751adfbc63204aec30e0d9ca965a2", size = 464707, upload-time = "2026-05-18T04:30:43.492Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/71/ea8c57b128f5383de74d0c7d2d9c57ad7c9a65a930c451bd25d524b295b7/watchfiles-1.2.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:4543579a9bdb0c9560039b4ffddbdb39545707659fbc430ce4c10f3f68d557f9", size = 454663, upload-time = "2026-05-18T04:30:16.061Z" },
+    { url = "https://files.pythonhosted.org/packages/53/fd/2e812bf938406d7db351f0703ddd3fc6c061cf30d96153a77bc79a943a44/watchfiles-1.2.0-cp313-cp313t-manylinux_2_31_riscv64.whl", hash = "sha256:20aa0e708b920bde876a4aa82dc7dd6ebea228a63a67cda6632c2fc87b787efa", size = 463537, upload-time = "2026-05-18T04:31:44.9Z" },
+    { url = "https://files.pythonhosted.org/packages/86/56/d17a7f1dd1bc3035f1072694a551301272f1739c2d8e319c927cb9e29b38/watchfiles-1.2.0-cp313-cp313t-musllinux_1_1_aarch64.whl", hash = "sha256:d413349d565dab74297f2a63e84a097936be69bf8f3b3801f27f380e32040f44", size = 629194, upload-time = "2026-05-18T04:31:14.141Z" },
+    { url = "https://files.pythonhosted.org/packages/be/06/f1ff66bf5cae50aa4062779a0ecd0bbaf15e466195719074078947d9a17d/watchfiles-1.2.0-cp313-cp313t-musllinux_1_1_x86_64.whl", hash = "sha256:f28b2725eb8cce327b9b3ab02415c853011dc55c95832fe90de6bc56f5315f72", size = 656194, upload-time = "2026-05-18T04:31:47.14Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/54/a9c7ea9a82a4ac65e7004c0a03920b5cdd2f9c3b678757d9cd425aa51d53/watchfiles-1.2.0-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:b8c8358484d5fa12ef34f05b7f4168eaf1932f408725ff6d023c33ec17bd79d4", size = 400205, upload-time = "2026-05-18T04:32:05.153Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/5d/c9ab3534374a4a67450696905d6ef16a04405448b8dc52bd752ae50423d4/watchfiles-1.2.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:9f04b092229ad2c50126dd3c922c8822e51e605993764a33058d4a791ab42281", size = 392508, upload-time = "2026-05-18T04:30:54.849Z" },
+    { url = "https://files.pythonhosted.org/packages/26/ca/1ad30103535cf0cecd7b993e8d50edc5351b1820e38f2d22e3df58962feb/watchfiles-1.2.0-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7a7ce236284f002a156f70add88efe5c70879cccbb658be0822c54b1306fc09d", size = 452448, upload-time = "2026-05-18T04:30:53.727Z" },
+    { url = "https://files.pythonhosted.org/packages/37/a1/ceee2cdf2afbd715fa07758d39c9859513eae411b23196f7fd039e5feedd/watchfiles-1.2.0-cp314-cp314-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:b9909cc2b48468b575eefa944919e1fe8a36c5849d5c7c168f80a8c1db69398e", size = 459605, upload-time = "2026-05-18T04:30:23.312Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/f6/421e30fd1cb3907a84ed92ab3f1983e37ba2dca015e9a894a048418417a2/watchfiles-1.2.0-cp314-cp314-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:0a37faaed405c67e28e6be45a1fa4f206ef5a2860f27c237db9fa30704c38242", size = 490757, upload-time = "2026-05-18T04:30:47.358Z" },
+    { url = "https://files.pythonhosted.org/packages/41/b0/55ed1b97ed08be7bba6f9a541cac15f2a858e1d74d2b07b6da70a82aab00/watchfiles-1.2.0-cp314-cp314-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:9649193aa27bd9ff2e80ff29bfaa93085496c7a3a377592823cc58b77ee88add", size = 568672, upload-time = "2026-05-18T04:30:38.915Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/cf/d8ae8a80dd7bafab395ea7681c10237311bbf34d37704a8c744e7cf31fc7/watchfiles-1.2.0-cp314-cp314-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:4e4ff8e37f99cf1da89e255e07c9c4b37c214038c4283707bdec308cb1b0ea1f", size = 464197, upload-time = "2026-05-18T04:30:09.914Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/8a/3076c496ca8dafe0e8cd03fcebdfc47be4b1174b4e5b24ff6e396e6b3af2/watchfiles-1.2.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:054dc20fd2e3132b4c3883b4a00d72fd6e1f56fdaf89fccd12e8057d74cd74d7", size = 453181, upload-time = "2026-05-18T04:30:14.829Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/10/9745e17c98e7b8a86454df0a3c7b5686bd650383f1e9f26e4ebcbd6cc0c0/watchfiles-1.2.0-cp314-cp314-manylinux_2_31_riscv64.whl", hash = "sha256:e140ed30ebde76796b686e67c182cff10ea2fbab186fafd1560f74bb5a473a6e", size = 465109, upload-time = "2026-05-18T04:30:28.123Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/95/8ef4a95481d3e0cb52d62a06fa6e972e81424be2d9698b91a2fecca9904c/watchfiles-1.2.0-cp314-cp314-musllinux_1_1_aarch64.whl", hash = "sha256:bb7e52ecf68ba46d22df23467b87cffeb2146908aa523ebfe803019618cfda06", size = 630653, upload-time = "2026-05-18T04:31:49.304Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/e4/3b3bf36b0f829b50c6ebcb8d031583863c59f923d6a6af3d485e470d0fac/watchfiles-1.2.0-cp314-cp314-musllinux_1_1_x86_64.whl", hash = "sha256:23282a321c8baf9b3a3c4afff673f9fe65eb7fdc2338d765ccad9d3d1916a5ba", size = 657838, upload-time = "2026-05-18T04:31:06.497Z" },
+    { url = "https://files.pythonhosted.org/packages/21/b1/6cbbb50c1f3002ab568777d44aa21206dfb8807a840990c4037523b51812/watchfiles-1.2.0-cp314-cp314-win32.whl", hash = "sha256:c0db965c5f79aa49fe672d297cf1febc5ad149b658594944f49a54a2b96270a7", size = 275108, upload-time = "2026-05-18T04:30:06.891Z" },
+    { url = "https://files.pythonhosted.org/packages/92/45/190ce6db8dcb4536682cf75d3889ff1a27182a58cb519d343cb6d9ea63d8/watchfiles-1.2.0-cp314-cp314-win_amd64.whl", hash = "sha256:71283b39fd17e5408eb123bd37aeecfd9d54c81fc184421943208aadb879d103", size = 288441, upload-time = "2026-05-18T04:32:12.901Z" },
+    { url = "https://files.pythonhosted.org/packages/74/0d/3eae1c2313ab08378431d907c3f8095ecca00f3eda33111cf4f0f2591799/watchfiles-1.2.0-cp314-cp314-win_arm64.whl", hash = "sha256:c5c19526f4e54a00f2666a6c0e9e40d582c09e865055ea7378bf0009aab857b3", size = 280684, upload-time = "2026-05-18T04:31:26.902Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/75/fb64e6c25d6b5ca636d03df34ffb1c6e9873303e76d27967e045f8df088f/watchfiles-1.2.0-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:d73a585accffa5ae39c17264c36ec3166d2fad7000c780f5ef83b2722afb9dd2", size = 398857, upload-time = "2026-05-18T04:32:17.108Z" },
+    { url = "https://files.pythonhosted.org/packages/73/4e/9f7adf01754cbf81843722ccfec169d8f26c69778281a302855cecd2ee08/watchfiles-1.2.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:ae99b14c5f21e026e0e9d96f40e07d8570ebee6cafd9d8fc318354606daa7a28", size = 392413, upload-time = "2026-05-18T04:31:07.911Z" },
+    { url = "https://files.pythonhosted.org/packages/47/c8/bec626bcc2d69f44b9acb24ce7d60ed7b16b73628eea747fcbd169d8edda/watchfiles-1.2.0-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4429f3b105524a10b72c3a819b091c495d2811d419c1e1e8df773a5a5974f831", size = 452409, upload-time = "2026-05-18T04:31:20.142Z" },
+    { url = "https://files.pythonhosted.org/packages/00/b7/b6362068e81e7c556d155a34c35d40ac3ef42d747b06d7f6e5bf58e359c2/watchfiles-1.2.0-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:43d818978d06062d9b22c4fab2ebe44cf5213d42dc8e62bda8c2760cfa2eeb33", size = 458827, upload-time = "2026-05-18T04:32:06.219Z" },
+    { url = "https://files.pythonhosted.org/packages/67/f8/9a813fa42afb1e0b4625e75f0479826644d3ee8dc287e093799bc01f390c/watchfiles-1.2.0-cp314-cp314t-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:b9f732dc58b2dbe69e464ccf8fff7a03b0dd0be439da4c0720d3558527d3d6b4", size = 490104, upload-time = "2026-05-18T04:31:56.034Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/bf/27dfb6094ca4c9aad21298b5525b6c53cb36121ee454331d05161e58d130/watchfiles-1.2.0-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8f200104103feb097de4cab8fe4f5dd18a2026934c7dea98c55a2f5fd6d5a33b", size = 571360, upload-time = "2026-05-18T04:31:57.133Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/39/44a096d67270ea93df91d33877dbe91fbda3aa4f8ec2edf799d93eda8736/watchfiles-1.2.0-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:63ac26eefbf4af1741247d6fb68b11c49a25b2f7413fbd318a83a12aaa9cf666", size = 464644, upload-time = "2026-05-18T04:30:57.33Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/80/c7472203bad6268e3ef1ad260739704847898938ad7ea8b63a5131f46b50/watchfiles-1.2.0-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:0c4997d4e4a55f0d02b6cde327322daf3a0400e5df6c6b15948994bf72497925", size = 454771, upload-time = "2026-05-18T04:30:48.736Z" },
+    { url = "https://files.pythonhosted.org/packages/51/cf/3b10b268b4b7f0fc26e9debb5eef1998b515887840f444cd3ec80c688755/watchfiles-1.2.0-cp314-cp314t-manylinux_2_31_riscv64.whl", hash = "sha256:4c887eba18b7945ac73067a8b4a66f21cd46c2539b2bc68588f7be6c7eb6d26b", size = 463494, upload-time = "2026-05-18T04:31:33.826Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/3e/a4302545cd589262a0dc7d140e86f7688eba3f9c72776c27f7e23b8864c4/watchfiles-1.2.0-cp314-cp314t-musllinux_1_1_aarch64.whl", hash = "sha256:3416ff151bb6b5a8d8d11664974fbef4d9305b9b2957839ab5a270468fd8df30", size = 629383, upload-time = "2026-05-18T04:31:15.596Z" },
+    { url = "https://files.pythonhosted.org/packages/db/99/d5649df0a9a410d45b7c882304d0b790903ac9b6e8f2cfd12114e0c6b9f2/watchfiles-1.2.0-cp314-cp314t-musllinux_1_1_x86_64.whl", hash = "sha256:0e831a271c035d89789cffc386b6aa1375f39f1cd25eb7ca0997e4970d152fc5", size = 656093, upload-time = "2026-05-18T04:31:58.707Z" },
+    { url = "https://files.pythonhosted.org/packages/92/b9/362702539275019a54dd2e94511b31a9b89c5f9e6a21966de7eb692549fc/watchfiles-1.2.0-cp315-cp315-macosx_10_12_x86_64.whl", hash = "sha256:37a6721cdf3f65dbb13aa9503510ccb4451603ac837e44d265d7992a597e1374", size = 400109, upload-time = "2026-05-18T04:31:16.879Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/75/71d5ba62db781e5587bded1d944c675374bc4aa37ff33d5018d98e8b6538/watchfiles-1.2.0-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:2b37d10b5a63bd4d87e18472d80fa525bd670586fae62e5dd580452764879b65", size = 392167, upload-time = "2026-05-18T04:31:28.058Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/01/c66dd95d0423fe30d31820e2d1d5bda773764131bbb6ac0cb1cf303ac328/watchfiles-1.2.0-cp315-cp315-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:0a105bc2283f67e8fbec74253ec2d94925de92ed72c0393f1206bf326b7b7b69", size = 452372, upload-time = "2026-05-18T04:31:00.836Z" },
+    { url = "https://files.pythonhosted.org/packages/91/15/2fe99557e72f85627c6a8eed50d889e8d101623e060a22ad75b875cb932d/watchfiles-1.2.0-cp315-cp315-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:5327989a465505f05cfe06f04fa9d0c2fd5432bb243e10e6f012b1bdca3c8579", size = 459596, upload-time = "2026-05-18T04:31:34.96Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/23/d4acfa0023367428ed48351b3b9b267893037b6cadae55620c61c24bcfd4/watchfiles-1.2.0-cp315-cp315-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:ecb47f183a8025b2aa18b546725c3657e542112ae9c0613a2af79b4fa8d04ad7", size = 490869, upload-time = "2026-05-18T04:31:59.923Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/5f/3164cbdce06c9fb95c4f7b9e2f9760b5e2797af43a9ecc317ef42a23a278/watchfiles-1.2.0-cp315-cp315-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8520a4ab0e37f770afc34459c4f8f7019e153f9124dc101c15538365875d1ab2", size = 571641, upload-time = "2026-05-18T04:32:00.948Z" },
+    { url = "https://files.pythonhosted.org/packages/41/e6/85d3731c55e65cd7690f3f803d24c139588aaf863e4bf2148fe7a7fa1a19/watchfiles-1.2.0-cp315-cp315-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:71cd71740ed2c15211ebb237ced4e39a1cdf6f80566e5fe95428da1626f4fde6", size = 464444, upload-time = "2026-05-18T04:30:34.298Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/7d/562641012b8b09872742c3b8adf9629ec479fd78f8d68ae4a0c13da8add6/watchfiles-1.2.0-cp315-cp315-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f88af53d6ddaf72179ef613ddc905e6f4785f712b49b80b3bef9f3525e6194b4", size = 453593, upload-time = "2026-05-18T04:31:23.464Z" },
+    { url = "https://files.pythonhosted.org/packages/56/fe/cb8ef3d6f929d14158fdaaad9925985b7310abc9384dcd4d82dd0016fb59/watchfiles-1.2.0-cp315-cp315-manylinux_2_31_riscv64.whl", hash = "sha256:cee9d5efd929efdac5f7e58f72b3376f676b64050a91c5b99a7094c5b2317488", size = 465096, upload-time = "2026-05-18T04:31:30.384Z" },
+    { url = "https://files.pythonhosted.org/packages/25/91/80908e835e100527a9267147b08c0eee1fa6ab0ffec15edc04d1d44885f7/watchfiles-1.2.0-cp315-cp315-musllinux_1_1_aarch64.whl", hash = "sha256:b718bf356bbc15e559bd8ef41782b573b8ae0e3f177ab244b440568d7ea02cfb", size = 630638, upload-time = "2026-05-18T04:30:49.89Z" },
+    { url = "https://files.pythonhosted.org/packages/46/4b/95ab2f256bb4af3cb2eb23b9317bda984ee6e0f11733a5c004a6c95b06e3/watchfiles-1.2.0-cp315-cp315-musllinux_1_1_x86_64.whl", hash = "sha256:922c0e019fe68b3ae392965a766b02a71ba1168c932cebc3733cd52c5fe5b377", size = 657684, upload-time = "2026-05-18T04:31:32.027Z" },
 ]
 
 [[package]]
@@ -3374,7 +3511,7 @@ wheels = [
 
 [[package]]
 name = "xai-sdk"
-version = "1.9.1"
+version = "1.17.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohttp" },
@@ -3386,9 +3523,9 @@ dependencies = [
     { name = "pydantic" },
     { name = "requests" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/a6/fa/ec15a3511a96c615ff2650d8aa60b7d1c7684515db94e925e9c8fb460fc3/xai_sdk-1.9.1.tar.gz", hash = "sha256:0406728c540c169041d0440b964278cfafa19240e1c3184f175c205f2253a836", size = 397879, upload-time = "2026-03-19T22:57:47.112Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/0d/79/722beabb2ffbac413e4e776230ee56db2710e83c02f038f5769f9da748c1/xai_sdk-1.17.0.tar.gz", hash = "sha256:ec695ad8b459a4080c01f6e7bb8abf38ed6a4ec69532bfdd73c4de14db1d485c", size = 452803, upload-time = "2026-06-12T03:44:13.329Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/27/5d/62c394d46e56e43989b34977b490f84bd60ff715e8ea696880f63546b8be/xai_sdk-1.9.1-py3-none-any.whl", hash = "sha256:3f313f1238d847ec08401894c42bf91f034fdeae04fe279c974b0e2a9644573d", size = 247192, upload-time = "2026-03-19T22:57:45.447Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/ad/99ad3209727f6e0e280681c05aa6a49feb130926d939bdb4767ee825b0da/xai_sdk-1.17.0-py3-none-any.whl", hash = "sha256:88a6a53181fa13d55662e3296dafd2a3cf258803450b7d82c7318b8c64e8a485", size = 273997, upload-time = "2026-06-12T03:44:11.828Z" },
 ]
 
 [[package]]

From 963fe6c0cfc5bcaaf1ea554d6a4322394038560e Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Thu, 16 Jul 2026 11:12:36 +0100
Subject: [PATCH 033/109] Portal: add docs + auto-synced with full-text search
 (#6985)

# Description of Changes

<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .github/workflows/sync-portal-docs.yml        |  92 ++
 frontend/.prettierignore                      |   2 +
 .../public/locales/en-GB/translation.toml     |  14 +-
 .../public/locales/en-US/translation.toml     |  14 +-
 frontend/editor/scripts/sync-portal-docs.mts  | 159 +++
 frontend/editor/scripts/tsconfig.json         |   4 +-
 frontend/editor/src/portal/ViewRouter.tsx     |  18 +-
 .../src/portal/components/docs/DocsNav.tsx    | 206 +++-
 .../src/portal/components/docs/DocsSearch.tsx | 137 +++
 .../src/portal/components/docs/DocsToc.tsx    |  80 ++
 .../portal/components/docs/MarkdownDoc.tsx    | 131 +++
 .../src/portal/components/sidebarGroups.tsx   |   6 +-
 .../src/portal/contexts/ViewContext.tsx       |   2 +-
 .../editor/src/portal/docs/headings.test.ts   |  47 +
 frontend/editor/src/portal/docs/headings.ts   |  48 +
 .../src/portal/docs/manifest/registry.ts      |  38 +
 .../portal/docs/manifest/transform.test.ts    | 208 ++++
 .../src/portal/docs/manifest/transform.ts     | 481 +++++++++
 .../editor/src/portal/docs/search.test.ts     | 100 ++
 frontend/editor/src/portal/docs/search.ts     | 153 +++
 .../src/portal/generated/docsManifest.json    | 989 ++++++++++++++++++
 .../editor/src/portal/views/DeveloperDocs.css | 533 +++++++++-
 .../portal/views/DeveloperDocs.stories.tsx    |  24 +
 .../src/portal/views/DeveloperDocs.test.tsx   |  80 ++
 .../editor/src/portal/views/DeveloperDocs.tsx | 201 ++--
 frontend/package.json                         |   1 +
 26 files changed, 3594 insertions(+), 174 deletions(-)
 create mode 100644 .github/workflows/sync-portal-docs.yml
 create mode 100644 frontend/editor/scripts/sync-portal-docs.mts
 create mode 100644 frontend/editor/src/portal/components/docs/DocsSearch.tsx
 create mode 100644 frontend/editor/src/portal/components/docs/DocsToc.tsx
 create mode 100644 frontend/editor/src/portal/components/docs/MarkdownDoc.tsx
 create mode 100644 frontend/editor/src/portal/docs/headings.test.ts
 create mode 100644 frontend/editor/src/portal/docs/headings.ts
 create mode 100644 frontend/editor/src/portal/docs/manifest/registry.ts
 create mode 100644 frontend/editor/src/portal/docs/manifest/transform.test.ts
 create mode 100644 frontend/editor/src/portal/docs/manifest/transform.ts
 create mode 100644 frontend/editor/src/portal/docs/search.test.ts
 create mode 100644 frontend/editor/src/portal/docs/search.ts
 create mode 100644 frontend/editor/src/portal/generated/docsManifest.json
 create mode 100644 frontend/editor/src/portal/views/DeveloperDocs.stories.tsx
 create mode 100644 frontend/editor/src/portal/views/DeveloperDocs.test.tsx

diff --git a/.github/workflows/sync-portal-docs.yml b/.github/workflows/sync-portal-docs.yml
new file mode 100644
index 0000000000..6eea2988c6
--- /dev/null
+++ b/.github/workflows/sync-portal-docs.yml
@@ -0,0 +1,92 @@
+name: Sync Portal Docs
+
+# Regenerates the portal Developer Docs manifest from the Stirling docs repo and
+# opens a PR when it changes. Runs weekly, on manual dispatch, or when the docs
+# repo fires a `docs-updated` repository_dispatch.
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: "Docs repo ref (branch or tag) to sync from"
+        required: false
+        default: "main"
+  repository_dispatch:
+    types: [docs-updated]
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    name: Sync docs manifest
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup GitHub App Bot
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        env:
+          NPM_CONFIG_IGNORE_SCRIPTS: "true"
+        run: npm ci --ignore-scripts --audit=false --fund=false
+
+      - name: Regenerate docs manifest
+        working-directory: frontend
+        env:
+          DOCS_REF: ${{ github.event.inputs.ref || github.event.client_payload.ref || 'main' }}
+          GITHUB_TOKEN: ${{ steps.setup-bot.outputs.token }}
+        run: npm run docs:sync
+
+      - name: Create Pull Request
+        id: cpr
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ steps.setup-bot.outputs.token }}
+          commit-message: "Sync portal docs from docs repo"
+          committer: ${{ steps.setup-bot.outputs.committer }}
+          author: ${{ steps.setup-bot.outputs.committer }}
+          signoff: true
+          branch: sync-portal-docs
+          base: main
+          title: "Sync portal docs from docs repo"
+          body: |
+            Auto-generated by ${{ steps.setup-bot.outputs.app-slug }}[bot].
+
+            Regenerates `frontend/editor/src/portal/generated/docsManifest.json`
+            from the Stirling docs repo via `npm run docs:sync`.
+          labels: documentation,github-actions,frontend
+          add-paths: frontend/editor/src/portal/generated/docsManifest.json
+          delete-branch: true
+          sign-commits: true
diff --git a/frontend/.prettierignore b/frontend/.prettierignore
index 25caf7cd10..ccbc95322f 100644
--- a/frontend/.prettierignore
+++ b/frontend/.prettierignore
@@ -12,6 +12,8 @@ editor/public/mockServiceWorker.js
 # Auto-generated OG/social-preview metadata (scripts/generate-og-metadata.mjs); regenerated verbatim.
 editor/public/og-metadata.json
 editor/src/core/data/ogImageMap.json
+# Auto-generated portal docs manifest (scripts/sync-portal-docs.mts); regenerated verbatim.
+editor/src/portal/generated/docsManifest.json
 editor/public/pdfjs*/
 editor/public/js/thirdParty/
 editor/public/css/cookieconsent.css
diff --git a/frontend/editor/public/locales/en-GB/translation.toml b/frontend/editor/public/locales/en-GB/translation.toml
index ff3a30a66c..10b90e2f8a 100644
--- a/frontend/editor/public/locales/en-GB/translation.toml
+++ b/frontend/editor/public/locales/en-GB/translation.toml
@@ -6534,6 +6534,10 @@ signature = "signature"
 beta = "Beta"
 ga = "GA"
 
+[portal.docs]
+browse = "Browse docs"
+viewSource = "View source on GitHub"
+
 [portal.docs.authentication]
 codeCaption = "every request"
 eyebrow = "GETTING STARTED"
@@ -6619,11 +6623,19 @@ title = "Official SDKs"
 beta = "Beta"
 deprecated = "Deprecated"
 
+[portal.docs.search]
+empty = "No matching docs"
+placeholder = "Search docs"
+results = "{{count}} results"
+
 [portal.docs.skills]
 eyebrow = "SKILLS"
 lead = "Bundled, named capabilities your agent invokes as a single tool. Each skill is a deterministic op chain with evals attached."
 title = "Agent skills"
 
+[portal.docs.toc]
+title = "On this page"
+
 [portal.docs.webhooks]
 codeCaption = "document.processed"
 eyebrow = "API REFERENCE"
@@ -7177,7 +7189,7 @@ storage = "Storage"
 [portal.nav]
 agent-builder = "Agent Builder"
 components = "Components"
-docs = "Developer Docs"
+docs = "Documentation"
 documents = "Documents"
 editor = "Editor"
 home = "Home"
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 9745842c52..6be49df2e0 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6463,6 +6463,10 @@ bucket = "Bucket"
 name = "Name"
 region = "Region"
 
+[portal.docs]
+browse = "Browse docs"
+viewSource = "View source on GitHub"
+
 [portal.docs.authentication]
 codeCaption = "every request"
 eyebrow = "GETTING STARTED"
@@ -6548,11 +6552,19 @@ title = "Official SDKs"
 beta = "Beta"
 deprecated = "Deprecated"
 
+[portal.docs.search]
+empty = "No matching docs"
+placeholder = "Search docs"
+results = "{{count}} results"
+
 [portal.docs.skills]
 eyebrow = "SKILLS"
 lead = "Bundled, named capabilities your agent invokes as a single tool. Each skill is a deterministic op chain with evals attached."
 title = "Agent skills"
 
+[portal.docs.toc]
+title = "On this page"
+
 [portal.docs.webhooks]
 codeCaption = "document.processed"
 eyebrow = "API REFERENCE"
@@ -7217,7 +7229,7 @@ storage = "Storage"
 [portal.nav]
 agent-builder = "Agent Builder"
 components = "Components"
-docs = "Developer Docs"
+docs = "Documentation"
 documents = "Documents"
 editor = "Editor"
 home = "Home"
diff --git a/frontend/editor/scripts/sync-portal-docs.mts b/frontend/editor/scripts/sync-portal-docs.mts
new file mode 100644
index 0000000000..08ba00137b
--- /dev/null
+++ b/frontend/editor/scripts/sync-portal-docs.mts
@@ -0,0 +1,159 @@
+/**
+ * Sync the portal Developer Docs from the Stirling docs repo.
+ *
+ * Fetches the docs repo tarball, extracts `docs/**` in-process (no external tar
+ * binary, no per-file GitHub rate limits), shapes it with the pure transforms in
+ * src/portal/docs/manifest/transform.ts, and writes the committed manifest that
+ * the portal docs view renders. Re-run with `npm run docs:sync`.
+ *
+ * Env: DOCS_REPO, DOCS_REF, DOCS_ROOT override the defaults below.
+ */
+import { gunzipSync } from "node:zlib";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+// tsx/node16 can't resolve the @portal alias here, so import by relative .ts path.
+// eslint-disable-next-line no-restricted-imports
+import {
+  buildManifest,
+  type CategoryMap,
+  type RawDoc,
+} from "../src/portal/docs/manifest/transform.ts";
+
+const REPO = process.env.DOCS_REPO ?? "Stirling-Tools/Stirling-Tools.github.io";
+const REF = process.env.DOCS_REF ?? "main";
+const ROOT = process.env.DOCS_ROOT ?? "docs";
+const SITE = "https://docs.stirlingpdf.com";
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const OUT = resolve(HERE, "../src/portal/generated/docsManifest.json");
+
+/* ── Minimal tar reader (ustar + pax/GNU long names) ─────────────────────── */
+
+interface TarEntry {
+  name: string;
+  type: string;
+  data: Buffer;
+}
+
+function readTar(buf: Buffer): TarEntry[] {
+  const entries: TarEntry[] = [];
+  let offset = 0;
+  let longName: string | null = null;
+  let paxPath: string | null = null;
+
+  const str = (start: number, len: number) => {
+    const slice = buf.subarray(start, start + len);
+    const end = slice.indexOf(0);
+    return slice.toString("utf8", 0, end === -1 ? len : end);
+  };
+
+  while (offset + 512 <= buf.length) {
+    const header = buf.subarray(offset, offset + 512);
+    // Two consecutive zero blocks mark the end of the archive.
+    if (header.every((b) => b === 0)) break;
+
+    const name = str(offset, 100);
+    const prefix = str(offset + 345, 155);
+    const sizeStr = str(offset + 124, 12).trim();
+    const size = parseInt(sizeStr, 8) || 0;
+    const type = String.fromCharCode(header[156]);
+    const dataStart = offset + 512;
+    const data = buf.subarray(dataStart, dataStart + size);
+
+    let fullName = prefix ? `${prefix}/${name}` : name;
+    if (longName) {
+      fullName = longName;
+      longName = null;
+    }
+    if (paxPath) {
+      fullName = paxPath;
+      paxPath = null;
+    }
+
+    if (type === "L") {
+      // GNU long name: the payload is the real name of the next entry.
+      longName = data.toString("utf8").replace(/\0+$/, "");
+    } else if (type === "x") {
+      // pax extended header: pull a `path=` record for the next entry.
+      const record = /(?:^|\n)\d+ path=([^\n]+)\n/.exec(data.toString("utf8"));
+      if (record) paxPath = record[1];
+    } else if (type === "0" || type === "\0" || type === "") {
+      entries.push({ name: fullName, type, data: Buffer.from(data) });
+    }
+
+    offset = dataStart + Math.ceil(size / 512) * 512;
+  }
+  return entries;
+}
+
+/* ── Fetch + shape ───────────────────────────────────────────────────────── */
+
+async function main(): Promise<void> {
+  const url = `https://api.github.com/repos/${REPO}/tarball/${REF}`;
+  console.log(`Fetching ${REPO}@${REF} …`);
+  const res = await fetch(url, {
+    headers: {
+      Accept: "application/vnd.github+json",
+      "User-Agent": "stirling-portal-docs-sync",
+      ...(process.env.GITHUB_TOKEN
+        ? { Authorization: `Bearer ${process.env.GITHUB_TOKEN}` }
+        : {}),
+    },
+  });
+  if (!res.ok) {
+    throw new Error(
+      `GitHub tarball fetch failed: ${res.status} ${res.statusText}`,
+    );
+  }
+  const gz = Buffer.from(await res.arrayBuffer());
+  const entries = readTar(gunzipSync(gz));
+
+  // Strip the "<repo>-<sha>/" wrapper dir and keep only files under docs root.
+  const prefix = `${ROOT}/`;
+  const rawDocs: RawDoc[] = [];
+  const categories: CategoryMap = {};
+  for (const entry of entries) {
+    const rel = entry.name.replace(/^[^/]+\//, "");
+    if (!rel.startsWith(prefix)) continue;
+    const inner = rel.slice(prefix.length);
+    if (!inner) continue;
+    if (inner.endsWith("/_category_.json")) {
+      const dir = inner.slice(0, -"/_category_.json".length);
+      try {
+        categories[dir] = JSON.parse(entry.data.toString("utf8"));
+      } catch {
+        console.warn(`  skipping unparseable _category_.json in ${dir}`);
+      }
+    } else if (/\.mdx?$/i.test(inner)) {
+      rawDocs.push({ relPath: inner, content: entry.data.toString("utf8") });
+    }
+  }
+
+  if (rawDocs.length === 0) {
+    throw new Error(`No markdown found under ${ROOT}/ — wrong repo/ref/root?`);
+  }
+
+  const manifest = buildManifest(rawDocs, categories, {
+    repo: REPO,
+    ref: REF,
+    root: ROOT,
+    siteBaseUrl: SITE,
+  });
+
+  mkdirSync(dirname(OUT), { recursive: true });
+  writeFileSync(OUT, JSON.stringify(manifest, null, 2) + "\n", "utf8");
+
+  const items = manifest.nav.reduce((n, s) => n + s.items.length, 0);
+  console.log(
+    `Wrote ${manifest.nav.length} sections, ${items} docs → ${OUT.replace(/.*[/\\]frontend[/\\]/, "frontend/")}`,
+  );
+  for (const s of manifest.nav) {
+    console.log(`  ${s.icon} ${s.label} (${s.items.length})`);
+  }
+}
+
+main().catch((err) => {
+  console.error(err instanceof Error ? err.message : err);
+  process.exitCode = 1;
+});
diff --git a/frontend/editor/scripts/tsconfig.json b/frontend/editor/scripts/tsconfig.json
index 38e4f505a3..d80666471b 100644
--- a/frontend/editor/scripts/tsconfig.json
+++ b/frontend/editor/scripts/tsconfig.json
@@ -4,7 +4,9 @@
     "module": "node16",
     "moduleResolution": "node16",
     "types": ["node"],
-    "noEmit": true
+    "noEmit": true,
+    // sync-portal-docs.mts imports the shared transform by its .ts path (run via tsx).
+    "allowImportingTsExtensions": true
   },
   "include": ["./**/*.ts", "./**/*.mts"]
 }
diff --git a/frontend/editor/src/portal/ViewRouter.tsx b/frontend/editor/src/portal/ViewRouter.tsx
index 44d370ff49..dc580a3a2b 100644
--- a/frontend/editor/src/portal/ViewRouter.tsx
+++ b/frontend/editor/src/portal/ViewRouter.tsx
@@ -1,3 +1,4 @@
+import { lazy, Suspense } from "react";
 import { Navigate, Route, Routes } from "react-router-dom";
 import { Home } from "@portal/views/Home";
 import { Users } from "@portal/views/Users";
@@ -11,10 +12,16 @@ import { Policies } from "@portal/views/Policies";
 import { EditorAdmin } from "@portal/views/EditorAdmin";
 import { Infrastructure } from "@portal/views/Infrastructure";
 import { PortalBillingGate } from "@portal/components/billing/PortalBillingGate";
-import { DeveloperDocs } from "@portal/views/DeveloperDocs";
 import { Procurement } from "@portal/views/Procurement";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 
+// Lazy so the generated docs manifest (bundled JSON) lands in its own chunk.
+const DeveloperDocs = lazy(() =>
+  import("@portal/views/DeveloperDocs").then((m) => ({
+    default: m.DeveloperDocs,
+  })),
+);
+
 // The portal mounts as a route-set under /processor/* in the editor app, so these
 // child routes are relative to that base: strip the leading slash from the
 // logical VIEW_PATHS, and home is the index route. Redirects use toPortalPath
@@ -57,7 +64,14 @@ export function ViewRouter() {
       />
       <Route path={rel(VIEW_PATHS.usage)} element={<PortalBillingGate />} />
       <Route path={rel(VIEW_PATHS.procurement)} element={<Procurement />} />
-      <Route path={rel(VIEW_PATHS.docs)} element={<DeveloperDocs />} />
+      <Route
+        path={rel(VIEW_PATHS.docs)}
+        element={
+          <Suspense fallback={null}>
+            <DeveloperDocs />
+          </Suspense>
+        }
+      />
       {/* Account-link is now a Settings panel; redirect legacy bookmarks home. */}
       <Route
         path="account-link"
diff --git a/frontend/editor/src/portal/components/docs/DocsNav.tsx b/frontend/editor/src/portal/components/docs/DocsNav.tsx
index 48d325e9ae..1063d5e98f 100644
--- a/frontend/editor/src/portal/components/docs/DocsNav.tsx
+++ b/frontend/editor/src/portal/components/docs/DocsNav.tsx
@@ -1,8 +1,45 @@
+import { useEffect, useMemo, useRef, useState } from "react";
 import { Button, Skeleton, StatusBadge } from "@app/ui";
 import { useTranslation } from "react-i18next";
 import type { DocsNavSection } from "@portal/api/docs";
 
-/** Left-hand documentation nav tree; each leaf selects an in-page section. */
+/**
+ * Left-hand documentation nav: a hierarchical accordion. Section ids encode their
+ * path ("functionality/security" is a child of "functionality"), so sub-sections
+ * nest under their parent. The root "Overview" section is static (always open, no
+ * toggle); every other section collapses, and only the branch leading to the
+ * active doc opens by default. (Search lives in DocsSearch above this.)
+ */
+
+// Matches the generator's ROOT_SECTION_ID: the intro section is never collapsible.
+const STATIC_SECTION_ID = "overview";
+
+interface NavNode {
+  section: DocsNavSection;
+  children: NavNode[];
+}
+
+/** Split "a/b/c" → "a/b"; null for a top-level id. */
+function parentId(id: string): string | null {
+  const i = id.lastIndexOf("/");
+  return i === -1 ? null : id.slice(0, i);
+}
+
+/** Build the section tree from the flat, pre-sorted section list. */
+function buildTree(sections: DocsNavSection[]): NavNode[] {
+  const byId = new Map<string, NavNode>(
+    sections.map((s) => [s.id, { section: s, children: [] }]),
+  );
+  const roots: NavNode[] = [];
+  for (const node of byId.values()) {
+    const pid = parentId(node.section.id);
+    const parent = pid ? byId.get(pid) : undefined;
+    if (parent) parent.children.push(node);
+    else roots.push(node);
+  }
+  return roots;
+}
+
 export function DocsNav({
   sections,
   active,
@@ -13,50 +50,125 @@ export function DocsNav({
   onSelect: (id: string) => void;
 }) {
   const { t } = useTranslation();
+  // Per-section manual open/close, overriding the "active branch only" default.
+  const [toggled, setToggled] = useState<Record<string, boolean>>({});
+  const activeRef = useRef<HTMLButtonElement>(null);
+
+  const activeSectionId = useMemo(
+    () => sections.find((s) => s.items.some((i) => i.id === active))?.id,
+    [sections, active],
+  );
+
+  const tree = useMemo(() => buildTree(sections), [sections]);
+
+  // Keep the active item in view when navigating (e.g. via a cross-link).
+  useEffect(() => {
+    activeRef.current?.scrollIntoView?.({ block: "nearest" });
+  }, [active]);
+
+  const isOpen = (id: string): boolean => {
+    if (id === STATIC_SECTION_ID) return true;
+    // Default-open the branch containing the active doc (self or ancestor).
+    const onActivePath =
+      !!activeSectionId &&
+      (activeSectionId === id || activeSectionId.startsWith(id + "/"));
+    return toggled[id] ?? onActivePath;
+  };
+
+  const renderNode = (node: NavNode) => {
+    const { section, children } = node;
+    const isStatic = section.id === STATIC_SECTION_ID;
+    const open = isOpen(section.id);
+    return (
+      <div key={section.id} className="portal-docs__nav-group">
+        {isStatic ? (
+          <div className="portal-docs__nav-head">{section.label}</div>
+        ) : (
+          <Button
+            variant="tertiary"
+            fullWidth
+            justify="between"
+            className="portal-docs__nav-head portal-docs__nav-head--button"
+            aria-expanded={open}
+            onClick={() =>
+              setToggled((prev) => ({ ...prev, [section.id]: !open }))
+            }
+            rightSection={
+              <span className="portal-docs__nav-count">
+                {section.items.length}
+              </span>
+            }
+          >
+            <span className="portal-docs__nav-head-main">
+              <span
+                className={
+                  "portal-docs__nav-chevron" + (open ? " is-open" : "")
+                }
+                aria-hidden
+              >
+                ▸
+              </span>
+              <span className="portal-docs__nav-headlabel">
+                {section.label}
+              </span>
+            </span>
+          </Button>
+        )}
+
+        {open && (
+          <>
+            {section.items.length > 0 && (
+              <ul className="portal-docs__nav-list">
+                {section.items.map((item) => {
+                  const isActive = item.id === active;
+                  return (
+                    <li key={item.id}>
+                      <Button
+                        ref={isActive ? activeRef : undefined}
+                        variant="tertiary"
+                        justify="start"
+                        fullWidth
+                        className={
+                          "portal-docs__nav-link" +
+                          (isActive ? " is-active" : "")
+                        }
+                        aria-current={isActive ? "page" : undefined}
+                        onClick={() => onSelect(item.id)}
+                      >
+                        <span className="portal-docs__nav-label">
+                          {item.label}
+                        </span>
+                        {item.badge && (
+                          <StatusBadge
+                            tone={item.badge === "New" ? "success" : "info"}
+                            size="sm"
+                          >
+                            {item.badge}
+                          </StatusBadge>
+                        )}
+                      </Button>
+                    </li>
+                  );
+                })}
+              </ul>
+            )}
+            {children.length > 0 && (
+              <div className="portal-docs__nav-children">
+                {children.map(renderNode)}
+              </div>
+            )}
+          </>
+        )}
+      </div>
+    );
+  };
+
   return (
     <nav
       className="portal-docs__nav"
       aria-label={t("portal.docs.nav.ariaLabel")}
     >
-      {sections.map((section) => (
-        <div key={section.id} className="portal-docs__nav-group">
-          <div className="portal-docs__nav-head">
-            <span className="portal-docs__nav-icon" aria-hidden>
-              {section.icon}
-            </span>
-            {section.label}
-          </div>
-          <ul className="portal-docs__nav-list">
-            {section.items.map((item) => {
-              const isActive = item.id === active;
-              return (
-                <li key={item.id}>
-                  <Button
-                    variant="tertiary"
-                    justify="start"
-                    fullWidth
-                    className={
-                      "portal-docs__nav-link" + (isActive ? " is-active" : "")
-                    }
-                    aria-current={isActive ? "page" : undefined}
-                    onClick={() => onSelect(item.id)}
-                  >
-                    <span className="portal-docs__nav-label">{item.label}</span>
-                    {item.badge && (
-                      <StatusBadge
-                        tone={item.badge === "New" ? "success" : "info"}
-                        size="sm"
-                      >
-                        {item.badge}
-                      </StatusBadge>
-                    )}
-                  </Button>
-                </li>
-              );
-            })}
-          </ul>
-        </div>
-      ))}
+      {tree.map(renderNode)}
     </nav>
   );
 }
@@ -64,14 +176,16 @@ export function DocsNav({
 export function DocsNavSkeleton() {
   return (
     <nav className="portal-docs__nav" aria-hidden>
-      {Array.from({ length: 4 }).map((_, gi) => (
+      {Array.from({ length: 5 }).map((_, gi) => (
         <div key={gi} className="portal-docs__nav-group">
           <Skeleton width="7rem" height="0.75rem" />
-          <div className="portal-docs__nav-list">
-            {Array.from({ length: 3 }).map((_, li) => (
-              <Skeleton key={li} width="80%" height="0.875rem" />
-            ))}
-          </div>
+          {gi === 0 && (
+            <div className="portal-docs__nav-list">
+              {Array.from({ length: 4 }).map((_, li) => (
+                <Skeleton key={li} width="80%" height="0.875rem" />
+              ))}
+            </div>
+          )}
         </div>
       ))}
     </nav>
diff --git a/frontend/editor/src/portal/components/docs/DocsSearch.tsx b/frontend/editor/src/portal/components/docs/DocsSearch.tsx
new file mode 100644
index 0000000000..49bdb3101f
--- /dev/null
+++ b/frontend/editor/src/portal/components/docs/DocsSearch.tsx
@@ -0,0 +1,137 @@
+import { useEffect, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import type { SearchResult, Segment } from "@portal/docs/search";
+
+/** Render highlighted segments, wrapping matched runs in <mark>. */
+function Highlighted({ segments }: { segments: Segment[] }) {
+  return (
+    <>
+      {segments.map((s, i) =>
+        s.hit ? (
+          <mark key={i} className="portal-docs__hl">
+            {s.text}
+          </mark>
+        ) : (
+          <span key={i}>{s.text}</span>
+        ),
+      )}
+    </>
+  );
+}
+
+/**
+ * Docs search box + results. While a query is active it shows a ranked list of
+ * matching docs — each with its section, a highlighted title, and a content
+ * snippet — that navigates on click (or Enter). Arrow keys move the selection.
+ */
+export function DocsSearch({
+  query,
+  onQueryChange,
+  results,
+  onSelect,
+}: {
+  query: string;
+  onQueryChange: (q: string) => void;
+  results: SearchResult[];
+  onSelect: (docId: string) => void;
+}) {
+  const { t } = useTranslation();
+  // -1 = nothing pre-selected; arrow keys drive this, the mouse uses CSS :hover.
+  const [activeIndex, setActiveIndex] = useState(-1);
+  const listRef = useRef<HTMLUListElement>(null);
+  const hasQuery = query.trim().length > 0;
+
+  useEffect(() => setActiveIndex(-1), [query]);
+
+  useEffect(() => {
+    listRef.current
+      ?.querySelector<HTMLElement>('[data-active="true"]')
+      ?.scrollIntoView?.({ block: "nearest" });
+  }, [activeIndex]);
+
+  const onKeyDown = (e: React.KeyboardEvent<HTMLInputElement>) => {
+    if (e.key === "Escape") {
+      onQueryChange("");
+      return;
+    }
+    if (!results.length) return;
+    if (e.key === "ArrowDown") {
+      e.preventDefault();
+      setActiveIndex((i) => Math.min(i + 1, results.length - 1));
+    } else if (e.key === "ArrowUp") {
+      e.preventDefault();
+      setActiveIndex((i) => Math.max(i - 1, 0));
+    } else if (e.key === "Enter") {
+      e.preventDefault();
+      const hit = results[activeIndex >= 0 ? activeIndex : 0];
+      if (hit) onSelect(hit.id);
+    }
+  };
+
+  return (
+    <div className="portal-docs__search">
+      <div className="portal-docs__search-box">
+        <span className="portal-docs__search-icon" aria-hidden>
+          ⌕
+        </span>
+        <input
+          type="search"
+          className="portal-docs__search-input"
+          placeholder={t("portal.docs.search.placeholder")}
+          value={query}
+          onChange={(e) => onQueryChange(e.target.value)}
+          onKeyDown={onKeyDown}
+          aria-label={t("portal.docs.search.placeholder")}
+        />
+      </div>
+
+      {hasQuery && (
+        <div className="portal-docs__results">
+          {results.length === 0 ? (
+            <p className="portal-docs__nav-empty">
+              {t("portal.docs.search.empty")}
+            </p>
+          ) : (
+            <>
+              <div className="portal-docs__results-count">
+                {t("portal.docs.search.results", { count: results.length })}
+              </div>
+              <ul ref={listRef} className="portal-docs__results-list">
+                {results.map((r, i) => (
+                  <li key={r.id}>
+                    <Button
+                      variant="tertiary"
+                      fullWidth
+                      justify="start"
+                      className={
+                        "portal-docs__result" +
+                        (i === activeIndex ? " is-active" : "")
+                      }
+                      data-active={i === activeIndex}
+                      onClick={() => onSelect(r.id)}
+                    >
+                      <span className="portal-docs__result-body">
+                        <span className="portal-docs__result-head">
+                          <span className="portal-docs__result-title">
+                            <Highlighted segments={r.titleSegments} />
+                          </span>
+                          <span className="portal-docs__result-section">
+                            {r.sectionLabel}
+                          </span>
+                        </span>
+                        <span className="portal-docs__result-snippet">
+                          <Highlighted segments={r.snippet} />
+                        </span>
+                      </span>
+                    </Button>
+                  </li>
+                ))}
+              </ul>
+            </>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/docs/DocsToc.tsx b/frontend/editor/src/portal/components/docs/DocsToc.tsx
new file mode 100644
index 0000000000..1f6ee6ebad
--- /dev/null
+++ b/frontend/editor/src/portal/components/docs/DocsToc.tsx
@@ -0,0 +1,80 @@
+import { useEffect, useState, type RefObject } from "react";
+import { useTranslation } from "react-i18next";
+import type { Heading } from "@portal/docs/headings";
+
+/**
+ * "On this page" table of contents. Lists the current doc's H2/H3 headings,
+ * scrolls the reading pane to a heading on click, and highlights the section
+ * currently in view (scroll-spy against the pane's scroll container).
+ */
+export function DocsToc({
+  headings,
+  scrollRef,
+}: {
+  headings: Heading[];
+  scrollRef: RefObject<HTMLElement | null>;
+}) {
+  const { t } = useTranslation();
+  const [active, setActive] = useState<string>(headings[0]?.slug ?? "");
+
+  useEffect(() => {
+    const root = scrollRef.current;
+    if (!root || headings.length === 0) return;
+    setActive(headings[0].slug);
+
+    const visible = new Set<string>();
+    const observer = new IntersectionObserver(
+      (entries) => {
+        for (const e of entries) {
+          if (e.isIntersecting) visible.add(e.target.id);
+          else visible.delete(e.target.id);
+        }
+        // The topmost heading currently within the active zone wins.
+        const current = headings.find((h) => visible.has(h.slug));
+        if (current) setActive(current.slug);
+      },
+      // Active zone = the top ~30% of the reading pane.
+      { root, rootMargin: "0px 0px -70% 0px", threshold: 0 },
+    );
+
+    const els = headings
+      .map((h) => root.querySelector(`[id="${h.slug}"]`))
+      .filter((el): el is Element => el !== null);
+    els.forEach((el) => observer.observe(el));
+    return () => observer.disconnect();
+  }, [headings, scrollRef]);
+
+  const onSelect = (slug: string) => {
+    scrollRef.current
+      ?.querySelector(`[id="${slug}"]`)
+      ?.scrollIntoView({ block: "start", behavior: "smooth" });
+    setActive(slug);
+  };
+
+  return (
+    <nav className="portal-docs__toc" aria-label={t("portal.docs.toc.title")}>
+      <div className="portal-docs__toc-title">{t("portal.docs.toc.title")}</div>
+      <ul className="portal-docs__toc-list">
+        {headings.map((h) => (
+          <li key={h.slug}>
+            <a
+              href={`#${h.slug}`}
+              className={
+                "portal-docs__toc-link" +
+                (h.level === 3 ? " is-sub" : "") +
+                (active === h.slug ? " is-active" : "")
+              }
+              aria-current={active === h.slug ? "location" : undefined}
+              onClick={(e) => {
+                e.preventDefault();
+                onSelect(h.slug);
+              }}
+            >
+              {h.text}
+            </a>
+          </li>
+        ))}
+      </ul>
+    </nav>
+  );
+}
diff --git a/frontend/editor/src/portal/components/docs/MarkdownDoc.tsx b/frontend/editor/src/portal/components/docs/MarkdownDoc.tsx
new file mode 100644
index 0000000000..faf3339478
--- /dev/null
+++ b/frontend/editor/src/portal/components/docs/MarkdownDoc.tsx
@@ -0,0 +1,131 @@
+import { isValidElement, useState, type ReactNode } from "react";
+import ReactMarkdown, {
+  defaultUrlTransform,
+  type Components,
+} from "react-markdown";
+import remarkGfm from "remark-gfm";
+import { Button } from "@app/ui";
+import { makeSlugger } from "@portal/docs/headings";
+
+/** Flatten a heading's React children to plain text for its anchor id. */
+function childText(node: ReactNode): string {
+  if (typeof node === "string" || typeof node === "number") return String(node);
+  if (Array.isArray(node)) return node.map(childText).join("");
+  if (isValidElement(node)) {
+    return childText((node.props as { children?: ReactNode }).children);
+  }
+  return "";
+}
+
+// Keep our internal `doc:` scheme; sanitize every other URL as react-markdown
+// would by default (it strips unknown protocols, which would kill doc: links).
+function urlTransform(url: string): string {
+  return url.startsWith("doc:") ? url : defaultUrlTransform(url);
+}
+
+/**
+ * Renders a doc's normalised markdown. Internal cross-doc links carry the
+ * `doc:` scheme (see the sync transform) and are intercepted here so they
+ * navigate within the portal instead of leaving the app.
+ */
+
+function CopyButton({ text }: { text: string }) {
+  const [copied, setCopied] = useState(false);
+  return (
+    <Button
+      variant="tertiary"
+      size="sm"
+      className="portal-docs__md-copy"
+      onClick={() =>
+        void navigator.clipboard.writeText(text).then(() => {
+          setCopied(true);
+          setTimeout(() => setCopied(false), 1500);
+        })
+      }
+    >
+      {copied ? "✓ Copied" : "Copy"}
+    </Button>
+  );
+}
+
+function buildComponents(
+  onNavigate: (docId: string) => void,
+  slug: (text: string) => string,
+): Components {
+  return {
+    h2: ({ children }) => <h2 id={slug(childText(children))}>{children}</h2>,
+    h3: ({ children }) => <h3 id={slug(childText(children))}>{children}</h3>,
+    a: ({ href, children }) => {
+      if (href?.startsWith("doc:")) {
+        const id = href.slice(4);
+        return (
+          <a
+            href={`#${id}`}
+            onClick={(e) => {
+              e.preventDefault();
+              onNavigate(id);
+            }}
+          >
+            {children}
+          </a>
+        );
+      }
+      const external = /^https?:/i.test(href ?? "");
+      return (
+        <a
+          href={href}
+          target={external ? "_blank" : undefined}
+          rel={external ? "noopener noreferrer" : undefined}
+        >
+          {children}
+        </a>
+      );
+    },
+    // Eager, not lazy: lazy-loading inside the docs' own scroll container isn't
+    // reliably triggered, and docs pages have only a handful of images.
+    img: ({ node: _node, ...props }) => (
+      <img {...props} className="portal-docs__md-img" />
+    ),
+    pre: ({ children }) => {
+      const code = isValidElement(children)
+        ? String(
+            (children.props as { children?: unknown }).children ?? "",
+          ).replace(/\n$/, "")
+        : String(children ?? "");
+      return (
+        <div className="portal-docs__md-pre">
+          <pre>{children}</pre>
+          <CopyButton text={code} />
+        </div>
+      );
+    },
+    table: ({ children }) => (
+      <div className="portal-docs__md-tablewrap">
+        <table>{children}</table>
+      </div>
+    ),
+  };
+}
+
+export function MarkdownDoc({
+  markdown,
+  onNavigate,
+}: {
+  markdown: string;
+  onNavigate: (docId: string) => void;
+}) {
+  // A fresh de-duping slugger per render; react-markdown invokes h2/h3 in
+  // document order, so ids line up with the TOC's extractHeadings slugs.
+  const slug = makeSlugger();
+  return (
+    <div className="portal-docs__md">
+      <ReactMarkdown
+        remarkPlugins={[remarkGfm]}
+        urlTransform={urlTransform}
+        components={buildComponents(onNavigate, slug)}
+      >
+        {markdown}
+      </ReactMarkdown>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sidebarGroups.tsx b/frontend/editor/src/portal/components/sidebarGroups.tsx
index 32e1ce116c..9bf2626b34 100644
--- a/frontend/editor/src/portal/components/sidebarGroups.tsx
+++ b/frontend/editor/src/portal/components/sidebarGroups.tsx
@@ -19,10 +19,6 @@ export interface NavEntry {
   externalUrl?: string;
 }
 
-// Developer docs has no built-in portal page yet, so the tab opens the hosted docs
-// site in a new tab rather than routing to an empty page.
-const DEVELOPER_DOCS_URL = "https://docs.stirlingpdf.com/";
-
 // Sidebar nav groups. This is a flavor seam: the SaaS build shadows this file to
 // drop sections not yet shipped there (see src/portal-saas/components/sidebarGroups).
 export const GROUP_PRIMARY: NavEntry[] = [{ id: "home", icon: <HomeIcon /> }];
@@ -38,5 +34,5 @@ export const GROUP_OPERATIONAL: NavEntry[] = [
 export const GROUP_PLATFORM: NavEntry[] = [
   { id: "infrastructure", icon: <InfrastructureIcon /> },
   { id: "usage", icon: <UsageIcon /> },
-  { id: "docs", icon: <DocsIcon />, externalUrl: DEVELOPER_DOCS_URL },
+  { id: "docs", icon: <DocsIcon /> },
 ];
diff --git a/frontend/editor/src/portal/contexts/ViewContext.tsx b/frontend/editor/src/portal/contexts/ViewContext.tsx
index 6fc7a6eba2..3c9ebc9fa8 100644
--- a/frontend/editor/src/portal/contexts/ViewContext.tsx
+++ b/frontend/editor/src/portal/contexts/ViewContext.tsx
@@ -28,7 +28,7 @@ export const VIEW_LABELS: Record<ViewId, string> = {
   documents: "Documents",
   infrastructure: "Infrastructure",
   usage: "Usage & Billing",
-  docs: "Developer Docs",
+  docs: "Documentation",
   procurement: "Procurement",
   settings: "Settings",
 };
diff --git a/frontend/editor/src/portal/docs/headings.test.ts b/frontend/editor/src/portal/docs/headings.test.ts
new file mode 100644
index 0000000000..8069fa2fef
--- /dev/null
+++ b/frontend/editor/src/portal/docs/headings.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, it } from "vitest";
+import { extractHeadings, slugify } from "@portal/docs/headings";
+
+describe("slugify", () => {
+  it("lowercases, hyphenates, and trims punctuation", () => {
+    expect(slugify("How it Works!")).toBe("how-it-works");
+    expect(slugify("  Trailing & spaces  ")).toBe("trailing-spaces");
+  });
+});
+
+describe("extractHeadings", () => {
+  it("extracts H2/H3 only, with slugs matching the rendered ids", () => {
+    const md = [
+      "# Page Title",
+      "## How it Works",
+      "text",
+      "### Sub Section",
+      "#### Too Deep",
+      "## Operations",
+    ].join("\n");
+    expect(extractHeadings(md)).toEqual([
+      { level: 2, text: "How it Works", slug: "how-it-works" },
+      { level: 3, text: "Sub Section", slug: "sub-section" },
+      { level: 2, text: "Operations", slug: "operations" },
+    ]);
+  });
+
+  it("de-duplicates repeated heading text into unique slugs", () => {
+    const md = ["## What Changed", "### What Changed", "## What Changed"].join(
+      "\n",
+    );
+    expect(extractHeadings(md).map((h) => h.slug)).toEqual([
+      "what-changed",
+      "what-changed-1",
+      "what-changed-2",
+    ]);
+  });
+
+  it("ignores headings inside fenced code and strips inline marks", () => {
+    const md = ["```", "## not a heading", "```", "## `Code` and *em*"].join(
+      "\n",
+    );
+    expect(extractHeadings(md)).toEqual([
+      { level: 2, text: "Code and em", slug: "code-and-em" },
+    ]);
+  });
+});
diff --git a/frontend/editor/src/portal/docs/headings.ts b/frontend/editor/src/portal/docs/headings.ts
new file mode 100644
index 0000000000..d99b385476
--- /dev/null
+++ b/frontend/editor/src/portal/docs/headings.ts
@@ -0,0 +1,48 @@
+/**
+ * Heading extraction for the "On this page" table of contents. The same
+ * `slugify` is used here and in MarkdownDoc's heading renderer, so the TOC links
+ * and the rendered heading ids always match.
+ */
+
+export interface Heading {
+  /** 2 or 3 (H2/H3). */
+  level: number;
+  text: string;
+  slug: string;
+}
+
+/** "How it Works!" → "how-it-works" (the base id, before de-duplication). */
+export function slugify(text: string): string {
+  return text
+    .toLowerCase()
+    .trim()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
+/**
+ * A stateful slugger that de-duplicates: repeated heading text gets `-1`, `-2`, …
+ * The TOC extraction and MarkdownDoc's heading renderer each make one and feed it
+ * headings in document order, so their slugs (and thus link ↔ id) always match.
+ */
+export function makeSlugger(): (text: string) => string {
+  const seen = new Map<string, number>();
+  return (text: string) => {
+    const base = slugify(text) || "section";
+    const n = seen.get(base) ?? 0;
+    seen.set(base, n + 1);
+    return n === 0 ? base : `${base}-${n}`;
+  };
+}
+
+/** Extract H2/H3 headings from a doc body, skipping fenced code blocks. */
+export function extractHeadings(markdown: string): Heading[] {
+  const noCode = markdown.replace(/^(```|~~~)[\s\S]*?^\1[ \t]*$/gm, "");
+  const slug = makeSlugger();
+  const headings: Heading[] = [];
+  for (const m of noCode.matchAll(/^ {0,3}(#{2,3})[ \t]+(.+?)[ \t]*#*$/gm)) {
+    const text = m[2].replace(/[`*_]/g, "").trim();
+    if (text) headings.push({ level: m[1].length, text, slug: slug(text) });
+  }
+  return headings;
+}
diff --git a/frontend/editor/src/portal/docs/manifest/registry.ts b/frontend/editor/src/portal/docs/manifest/registry.ts
new file mode 100644
index 0000000000..02d608f264
--- /dev/null
+++ b/frontend/editor/src/portal/docs/manifest/registry.ts
@@ -0,0 +1,38 @@
+/**
+ * Runtime accessors over the generated docs manifest. This is the only module
+ * that imports the (large) JSON, so lazy-loading the docs view keeps it in its
+ * own chunk. Regenerate the JSON with `npm run docs:sync`.
+ */
+// Imported as a raw string (not a JSON module) so tsc doesn't infer a ~half-MB
+// literal type; parsed once here into the typed manifest.
+import manifestRaw from "@portal/generated/docsManifest.json?raw";
+import type {
+  DocEntry,
+  DocsManifest,
+  DocsNavSection,
+} from "@portal/docs/manifest/transform";
+
+const manifest = JSON.parse(manifestRaw) as DocsManifest;
+
+/** Provenance of the current manifest (repo + ref it was generated from). */
+export const docsSource = manifest.source;
+
+/** The auto-sorted nav tree (sections → items). */
+export function loadDocsNav(): DocsNavSection[] {
+  return manifest.nav;
+}
+
+/** A single doc by id, or undefined if it isn't in the manifest. */
+export function loadDoc(id: string): DocEntry | undefined {
+  return manifest.docs[id];
+}
+
+/** Every doc, for building the search index. */
+export function allDocs(): DocEntry[] {
+  return Object.values(manifest.docs);
+}
+
+/** The first doc id (first item of the first section) — the default landing. */
+export function firstDocId(): string | undefined {
+  return manifest.nav[0]?.items[0]?.id;
+}
diff --git a/frontend/editor/src/portal/docs/manifest/transform.test.ts b/frontend/editor/src/portal/docs/manifest/transform.test.ts
new file mode 100644
index 0000000000..5bc105f7ef
--- /dev/null
+++ b/frontend/editor/src/portal/docs/manifest/transform.test.ts
@@ -0,0 +1,208 @@
+import { describe, expect, it } from "vitest";
+import {
+  buildManifest,
+  convertAdmonitions,
+  demoteHeadings,
+  docIdForPath,
+  humanize,
+  parseFrontmatter,
+  resolveRelative,
+  rewriteReferences,
+  sectionIcon,
+  stripJsxTags,
+  stripMdxImports,
+  stripRedundantH1,
+  type CategoryMap,
+  type RawDoc,
+} from "@portal/docs/manifest/transform";
+
+const OPTS = {
+  repo: "Owner/Repo",
+  ref: "main",
+  root: "docs",
+  siteBaseUrl: "https://docs.example.com",
+};
+
+describe("parseFrontmatter", () => {
+  it("splits scalar YAML frontmatter from the body", () => {
+    const { data, body } = parseFrontmatter(
+      "---\ntitle: OCR\nsidebar_position: 7\n---\n# Heading\ntext",
+    );
+    expect(data.title).toBe("OCR");
+    expect(data.sidebar_position).toBe(7);
+    expect(body).toBe("# Heading\ntext");
+  });
+
+  it("returns the whole content as body when there is no frontmatter", () => {
+    const { data, body } = parseFrontmatter("# Just a doc\nbody");
+    expect(data).toEqual({});
+    expect(body).toBe("# Just a doc\nbody");
+  });
+
+  it("normalises CRLF line endings", () => {
+    const { data } = parseFrontmatter("---\r\nid: x\r\n---\r\nbody");
+    expect(data.id).toBe("x");
+  });
+});
+
+describe("id + label helpers", () => {
+  it("slugifies nested paths", () => {
+    expect(docIdForPath("Configuration/OCR.md")).toBe("configuration/ocr");
+    expect(docIdForPath("Getting Started.md")).toBe("getting-started");
+  });
+
+  it("humanises file/dir names", () => {
+    expect(humanize("Getting-Started.md")).toBe("Getting Started");
+  });
+
+  it("picks a section icon from the label", () => {
+    expect(sectionIcon("Configuration")).toBe("⚙");
+    expect(sectionIcon("Totally Unknown")).toBe("◇");
+  });
+});
+
+describe("MDX normalisation", () => {
+  it("converts admonitions to titled blockquotes", () => {
+    const out = convertAdmonitions(":::tip Upgrading?\nread this\n:::");
+    expect(out).toContain("> **💡 Tip: Upgrading?**");
+    expect(out).toContain("> read this");
+  });
+
+  it("strips import/export statements", () => {
+    const out = stripMdxImports("import Tabs from '@theme/Tabs';\n# Keep");
+    expect(out).toBe("# Keep");
+  });
+
+  it("removes JSX component tags but keeps inner content", () => {
+    expect(
+      stripJsxTags("<Tabs>\n<TabItem value='a'>keep</TabItem>\n</Tabs>"),
+    ).toContain("keep");
+    expect(stripJsxTags("<TabItem>x</TabItem>")).not.toMatch(/<TabItem/);
+  });
+
+  it("demotes body H1 to H2 but leaves code comments alone", () => {
+    const md = "# Title\n\n```bash\n# a shell comment\n```";
+    const out = demoteHeadings(md);
+    expect(out).toContain("## Title");
+    expect(out).toContain("# a shell comment");
+  });
+
+  it("strips a leading H1 that duplicates the page title", () => {
+    expect(stripRedundantH1("# OCR\nbody", "OCR")).toBe("body");
+    expect(stripRedundantH1("# Other\nbody", "OCR")).toBe("# Other\nbody");
+  });
+});
+
+describe("resolveRelative", () => {
+  it("collapses ./ and ../ against a base dir", () => {
+    expect(resolveRelative("Configuration", "./OCR.md")).toBe(
+      "Configuration/OCR.md",
+    );
+    expect(
+      resolveRelative("Configuration", "../Functionality/Compare.md"),
+    ).toBe("Functionality/Compare.md");
+  });
+});
+
+describe("rewriteReferences", () => {
+  const ctx = {
+    dir: "Configuration",
+    // Keys are lowercased file paths (spaces preserved), as buildManifest builds them.
+    pathToId: new Map([
+      [
+        "configuration/system and security",
+        "configuration/system-and-security",
+      ],
+    ]),
+    rawBase: "https://raw.example.com/Owner/Repo/main",
+    siteBaseUrl: "https://docs.example.com",
+  };
+
+  it("rewrites resolvable internal links to the doc: scheme (decoded + case-insensitive)", () => {
+    const out = rewriteReferences(
+      "see [sec](./System%20and%20Security.md)",
+      ctx,
+      "docs",
+    );
+    expect(out).toBe("see [sec](doc:configuration/system-and-security)");
+  });
+
+  it("falls back to the live docs site for unresolved internal links", () => {
+    const out = rewriteReferences("[x](./Missing.md)", ctx, "docs");
+    expect(out).toBe("[x](https://docs.example.com/Configuration/Missing)");
+  });
+
+  it("leaves absolute and anchor links untouched", () => {
+    const md = "[a](https://x.com) and [b](#top)";
+    expect(rewriteReferences(md, ctx, "docs")).toBe(md);
+  });
+
+  it("rewrites relative images to absolute raw URLs", () => {
+    expect(rewriteReferences("![a](./img/x.png)", ctx, "docs")).toBe(
+      "![a](https://raw.example.com/Owner/Repo/main/docs/Configuration/img/x.png)",
+    );
+    expect(rewriteReferences("![a](/img/y.png)", ctx, "docs")).toBe(
+      "![a](https://raw.example.com/Owner/Repo/main/static/img/y.png)",
+    );
+  });
+
+  it("does not rewrite inside fenced code blocks", () => {
+    const md = "```\n[x](./y.md)\n```";
+    expect(rewriteReferences(md, ctx, "docs")).toBe(md);
+  });
+});
+
+describe("buildManifest", () => {
+  const rawDocs: RawDoc[] = [
+    {
+      relPath: "Getting Started.md",
+      content: "---\nsidebar_position: 0\n---\nintro",
+    },
+    {
+      relPath: "Configuration/OCR.md",
+      content: "---\ntitle: OCR\nsidebar_position: 7\n---\n# OCR\nbody",
+    },
+    {
+      relPath: "Configuration/DATABASE.md",
+      content: "---\nsidebar_position: 1\n---\n# Database\nsee [ocr](./OCR.md)",
+    },
+  ];
+  const categories: CategoryMap = {
+    Configuration: { label: "Configuration", position: 5 },
+  };
+
+  it("auto-sorts sections (root Overview first, then by category position)", () => {
+    const m = buildManifest(rawDocs, categories, OPTS);
+    expect(m.nav.map((s) => s.id)).toEqual(["overview", "configuration"]);
+    expect(m.nav[0].label).toBe("Overview");
+    expect(m.nav[1].label).toBe("Configuration");
+  });
+
+  it("orders nav items by sidebar_position", () => {
+    const m = buildManifest(rawDocs, categories, OPTS);
+    const config = m.nav.find((s) => s.id === "configuration")!;
+    expect(config.items.map((i) => i.id)).toEqual([
+      "configuration/database",
+      "configuration/ocr",
+    ]);
+  });
+
+  it("derives titles from frontmatter, heading, then filename", () => {
+    const m = buildManifest(rawDocs, categories, OPTS);
+    expect(m.docs["configuration/ocr"].title).toBe("OCR");
+    expect(m.docs["getting-started"].title).toBe("Getting Started");
+  });
+
+  it("resolves cross-doc links and records source/edit urls", () => {
+    const m = buildManifest(rawDocs, categories, OPTS);
+    expect(m.docs["configuration/database"].markdown).toContain(
+      "[ocr](doc:configuration/ocr)",
+    );
+    expect(m.docs["configuration/ocr"].sourcePath).toBe(
+      "docs/Configuration/OCR.md",
+    );
+    expect(m.docs["configuration/ocr"].editUrl).toBe(
+      "https://github.com/Owner/Repo/blob/main/docs/Configuration/OCR.md",
+    );
+  });
+});
diff --git a/frontend/editor/src/portal/docs/manifest/transform.ts b/frontend/editor/src/portal/docs/manifest/transform.ts
new file mode 100644
index 0000000000..60ced60ee4
--- /dev/null
+++ b/frontend/editor/src/portal/docs/manifest/transform.ts
@@ -0,0 +1,481 @@
+/**
+ * Pure transforms that turn the Docusaurus docs repo into the portal docs
+ * manifest. No I/O and no external deps so `tsx` (the sync CLI) and vitest can
+ * both use it. The sync CLI does the fetching; this module does the shaping.
+ *
+ * The auto-sort rules:
+ *   - every directory that directly holds markdown becomes a nav section,
+ *     labelled + ordered by its `_category_.json` (root files → "Overview"),
+ *   - each `.md`/`.mdx` file becomes a nav item, ordered by frontmatter
+ *     `sidebar_position` then title,
+ *   - Docusaurus MDX is normalised to plain GitHub-flavoured markdown that
+ *     react-markdown can render (admonitions, JSX, relative links, images).
+ */
+
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Manifest shape (mirrored structurally by @portal/api/docs)               */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+export interface DocsNavItem {
+  id: string;
+  label: string;
+  badge?: string;
+}
+
+export interface DocsNavSection {
+  id: string;
+  label: string;
+  icon: string;
+  items: DocsNavItem[];
+}
+
+export interface DocEntry {
+  id: string;
+  title: string;
+  description?: string;
+  section: string;
+  markdown: string;
+  sourcePath: string;
+  editUrl: string;
+}
+
+export interface DocsManifest {
+  source: { repo: string; ref: string; root: string };
+  nav: DocsNavSection[];
+  docs: Record<string, DocEntry>;
+}
+
+/** One markdown file read from the repo, before shaping. */
+export interface RawDoc {
+  /** Posix path relative to the docs root, e.g. "Configuration/OCR.md". */
+  relPath: string;
+  content: string;
+}
+
+/** `_category_.json` contents, keyed by posix dir path relative to docs root. */
+export type CategoryMap = Record<string, { label?: string; position?: number }>;
+
+export interface BuildOptions {
+  repo: string;
+  ref: string;
+  /** Docs root within the repo, e.g. "docs". */
+  root: string;
+  /** Live docs site base, used as the fallback for unresolved internal links. */
+  siteBaseUrl: string;
+}
+
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Small helpers                                                            */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+const SECTION_ICONS: Array<[RegExp, string]> = [
+  [/overview|getting started|start/i, "▶"],
+  [/config/i, "⚙"],
+  [/function|tool|feature/i, "▤"],
+  [/install|deploy/i, "⤓"],
+  [/migrat|upgrade/i, "⇄"],
+  [/security|sign|auth/i, "🛡"],
+  [/convert/i, "⇋"],
+  [/page/i, "▦"],
+  [/api|develop/i, "{ }"],
+];
+
+/** A single-glyph icon for a section, chosen from its label. */
+export function sectionIcon(label: string): string {
+  for (const [re, glyph] of SECTION_ICONS) if (re.test(label)) return glyph;
+  return "◇";
+}
+
+/** "Getting-Started_Guide" → "Getting Started Guide". */
+export function humanize(name: string): string {
+  return name
+    .replace(/\.mdx?$/i, "")
+    .replace(/[-_]+/g, " ")
+    .replace(/\s+/g, " ")
+    .trim()
+    .replace(/\b\w/g, (c) => c.toUpperCase());
+}
+
+/** Lowercase, hyphenated, url-safe id for a path segment. */
+export function slugifySegment(name: string): string {
+  return name
+    .replace(/\.mdx?$/i, "")
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
+/** Docs-root-relative posix path → stable doc id, e.g. "configuration/ocr". */
+export function docIdForPath(relPath: string): string {
+  return relPath.split("/").map(slugifySegment).filter(Boolean).join("/");
+}
+
+/** Posix dirname ("" for a root-level file). */
+export function dirOf(relPath: string): string {
+  const i = relPath.lastIndexOf("/");
+  return i === -1 ? "" : relPath.slice(0, i);
+}
+
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Frontmatter                                                              */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+export interface Frontmatter {
+  data: Record<string, string | number>;
+  body: string;
+}
+
+/** Split leading `--- ... ---` YAML frontmatter (scalar keys only) from body. */
+export function parseFrontmatter(content: string): Frontmatter {
+  const normalised = content.replace(/\r\n/g, "\n");
+  if (!normalised.startsWith("---\n")) return { data: {}, body: normalised };
+  const end = normalised.indexOf("\n---", 4);
+  if (end === -1) return { data: {}, body: normalised };
+  const raw = normalised.slice(4, end);
+  const rest = normalised.slice(end + 4).replace(/^\n/, "");
+  const data: Record<string, string | number> = {};
+  for (const line of raw.split("\n")) {
+    const m = /^([A-Za-z0-9_]+):\s*(.*)$/.exec(line);
+    if (!m) continue;
+    let value: string | number = m[2].trim().replace(/^["']|["']$/g, "");
+    if (/^-?\d+(\.\d+)?$/.test(value)) value = Number(value);
+    data[m[1]] = value;
+  }
+  return { data, body: rest };
+}
+
+/** First `# H1` heading text in a body, if any. */
+export function firstHeading(body: string): string | undefined {
+  const m = /^#\s+(.+?)\s*$/m.exec(stripCodeFences(body));
+  return m ? m[1].trim() : undefined;
+}
+
+/** Blank out fenced code blocks so heading/link scans ignore their contents. */
+function stripCodeFences(md: string): string {
+  return md.replace(/^(```|~~~)[\s\S]*?^\1\s*$/gm, "");
+}
+
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Body normalisation (MDX → plain markdown)                                */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+/** Run `fn` over the non-fenced-code spans of `md`, leaving code blocks intact. */
+function mapOutsideCode(md: string, fn: (text: string) => string): string {
+  const parts = md.split(/(^(?:```|~~~)[\s\S]*?^(?:```|~~~)\s*$)/gm);
+  return parts.map((part, i) => (i % 2 === 0 ? fn(part) : part)).join("");
+}
+
+const ADMONITION_META: Record<string, { icon: string; label: string }> = {
+  tip: { icon: "💡", label: "Tip" },
+  note: { icon: "📝", label: "Note" },
+  info: { icon: "ℹ️", label: "Info" },
+  warning: { icon: "⚠️", label: "Warning" },
+  caution: { icon: "⚠️", label: "Caution" },
+  danger: { icon: "🚫", label: "Danger" },
+};
+
+/** `:::tip Title\n…\n:::` → a blockquote with a bold titled first line. */
+export function convertAdmonitions(md: string): string {
+  const re = /^:::(\w+)[ \t]*(.*)\n([\s\S]*?)^:::[ \t]*$/gm;
+  return md.replace(re, (_all, type: string, title: string, body: string) => {
+    const meta = ADMONITION_META[type.toLowerCase()] ?? {
+      icon: "•",
+      label: humanize(type),
+    };
+    const heading = title.trim()
+      ? `${meta.label}: ${title.trim()}`
+      : meta.label;
+    const quoted = body
+      .replace(/\s+$/, "")
+      .split("\n")
+      .map((l) => (l ? `> ${l}` : ">"))
+      .join("\n");
+    return `> **${meta.icon} ${heading}**\n>\n${quoted}\n`;
+  });
+}
+
+/** Drop MDX `import`/`export` statement lines (outside code). */
+export function stripMdxImports(md: string): string {
+  return md
+    .split("\n")
+    .filter((l) => !/^\s*(import|export)\s.+from\s.+;?\s*$/.test(l))
+    .filter((l) => !/^\s*import\s+['"][^'"]+['"];?\s*$/.test(l))
+    .join("\n");
+}
+
+/** Remove JSX component tags (Capitalised), keeping any inner content. */
+export function stripJsxTags(md: string): string {
+  return md.replace(/<\/?[A-Z][A-Za-z0-9.]*(?:\s[^>]*?)?\/?>/g, "");
+}
+
+/** Resolve a relative posix path against a base dir, collapsing `.`/`..`. */
+export function resolveRelative(baseDir: string, target: string): string {
+  const stack = baseDir ? baseDir.split("/") : [];
+  for (const seg of target.split("/")) {
+    if (seg === "" || seg === ".") continue;
+    if (seg === "..") stack.pop();
+    else stack.push(seg);
+  }
+  return stack.join("/");
+}
+
+interface LinkContext {
+  dir: string;
+  pathToId: Map<string, string>;
+  rawBase: string;
+  siteBaseUrl: string;
+}
+
+/** Split "path#anchor" → [path, "#anchor" | ""]. */
+function splitAnchor(target: string): [string, string] {
+  const i = target.indexOf("#");
+  return i === -1 ? [target, ""] : [target.slice(0, i), target.slice(i)];
+}
+
+/** Percent-decode a link path, tolerating malformed escapes. */
+function decodePath(p: string): string {
+  try {
+    return decodeURIComponent(p);
+  } catch {
+    return p;
+  }
+}
+
+/**
+ * Look up the doc id for a relative link target. Keys in pathToId are lowercased
+ * so links work whether they use the filename or a slug, in any case, and with
+ * percent-encoded spaces (the repo links to "System%20and%20Security").
+ */
+function resolveDocId(ctx: LinkContext, rawPath: string): string | undefined {
+  const resolved = resolveRelative(ctx.dir, decodePath(rawPath)).toLowerCase();
+  const noExt = resolved.replace(/\.mdx?$/i, "");
+  const candidates = [
+    resolved,
+    noExt,
+    `${noExt.replace(/\/$/, "")}/index`,
+    noExt.replace(/\/index$/i, ""),
+  ];
+  for (const c of candidates) {
+    const id = ctx.pathToId.get(c);
+    if (id) return id;
+  }
+  return undefined;
+}
+
+/** Rewrite a single markdown link target to a portal-usable href. */
+function rewriteLinkTarget(ctx: LinkContext, target: string): string {
+  const trimmed = target.trim();
+  if (/^(https?:|mailto:|tel:|#|doc:)/i.test(trimmed)) return trimmed;
+  const [path, anchor] = splitAnchor(trimmed);
+  if (!path) return trimmed;
+  const id = resolveDocId(ctx, path);
+  if (id) return `doc:${id}`;
+  // Unresolved internal link → fall back to the live docs site (encode spaces).
+  const slug = resolveRelative(ctx.dir, decodePath(path)).replace(
+    /\.mdx?$/i,
+    "",
+  );
+  const encoded = slug.split("/").map(encodeURIComponent).join("/");
+  return `${ctx.siteBaseUrl}/${encoded}${anchor}`;
+}
+
+/** Rewrite a relative image src to an absolute raw-content URL. */
+function rewriteImageSrc(ctx: LinkContext, src: string, root: string): string {
+  const trimmed = src.trim();
+  if (/^(https?:|data:)/i.test(trimmed)) return trimmed;
+  if (trimmed.startsWith("/")) return `${ctx.rawBase}/static${trimmed}`;
+  const resolved = resolveRelative(`${root}/${ctx.dir}`, trimmed);
+  return `${ctx.rawBase}/${resolved}`;
+}
+
+/** Rewrite markdown links + images (outside code) to portal/absolute targets. */
+export function rewriteReferences(
+  md: string,
+  ctx: LinkContext,
+  root: string,
+): string {
+  return mapOutsideCode(md, (text) => {
+    // Images first so their `!` prefix isn't eaten by the link pattern.
+    let out = text.replace(
+      /!\[([^\]]*)\]\(([^)\s]+)([^)]*)\)/g,
+      (_m, alt: string, src: string, tail: string) =>
+        `![${alt}](${rewriteImageSrc(ctx, src, root)}${tail})`,
+    );
+    out = out.replace(
+      /(^|[^!])\[([^\]]+)\]\(([^)\s]+)([^)]*)\)/g,
+      (_m, pre: string, label: string, href: string, tail: string) =>
+        `${pre}[${label}](${rewriteLinkTarget(ctx, href)}${tail})`,
+    );
+    return out;
+  });
+}
+
+/** Drop a leading `# H1` whose text equals the page title (avoids a dup head). */
+export function stripRedundantH1(md: string, title: string): string {
+  const m = /^\s*#\s+(.+?)\s*(\n|$)/.exec(md);
+  if (m && m[1].trim().toLowerCase() === title.trim().toLowerCase()) {
+    return md.slice(m[0].length).replace(/^\n+/, "");
+  }
+  return md;
+}
+
+/** Demote body `# H1` headings to `## H2` so the page title is the sole H1. */
+export function demoteHeadings(md: string): string {
+  return mapOutsideCode(md, (text) => text.replace(/^# (?=\S)/gm, "## "));
+}
+
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Section ordering                                                         */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+const ROOT_SECTION_ID = "overview";
+
+/** Composite order key: `_category_.json.position` down the dir path. */
+function sectionOrderKey(dir: string, categories: CategoryMap): number[] {
+  if (dir === "") return [-1];
+  const key: number[] = [];
+  const segs = dir.split("/");
+  for (let i = 0; i < segs.length; i++) {
+    const sub = segs.slice(0, i + 1).join("/");
+    key.push(categories[sub]?.position ?? 999);
+  }
+  return key;
+}
+
+function compareKeys(a: number[], b: number[]): number {
+  const n = Math.max(a.length, b.length);
+  for (let i = 0; i < n; i++) {
+    const d = (a[i] ?? 0) - (b[i] ?? 0);
+    if (d !== 0) return d;
+  }
+  return 0;
+}
+
+/* ──────────────────────────────────────────────────────────────────────── */
+/*  Build                                                                    */
+/* ──────────────────────────────────────────────────────────────────────── */
+
+interface ShapedDoc extends DocEntry {
+  navLabel: string;
+  sidebarPosition: number;
+  orderKey: number[];
+  sectionLabel: string;
+}
+
+/** Turn raw docs + category metadata into the full portal docs manifest. */
+export function buildManifest(
+  rawDocs: RawDoc[],
+  categories: CategoryMap,
+  opts: BuildOptions,
+): DocsManifest {
+  const rawBase = `https://raw.githubusercontent.com/${opts.repo}/${opts.ref}`;
+  const editBase = `https://github.com/${opts.repo}/blob/${opts.ref}`;
+
+  // First pass: assign stable ids so links between docs can resolve. Keys are
+  // lowercased (case-insensitive link matching); both with and without ext.
+  const pathToId = new Map<string, string>();
+  for (const doc of rawDocs) {
+    const id = docIdForPath(doc.relPath);
+    const lower = doc.relPath.toLowerCase();
+    pathToId.set(lower, id);
+    pathToId.set(lower.replace(/\.mdx?$/i, ""), id);
+  }
+
+  const shaped: ShapedDoc[] = rawDocs.map((doc) => {
+    const dir = dirOf(doc.relPath);
+    const { data, body } = parseFrontmatter(doc.content);
+    const title =
+      (typeof data.title === "string" && data.title) ||
+      firstHeading(body) ||
+      humanize(doc.relPath.split("/").pop() ?? doc.relPath);
+    const navLabel =
+      (typeof data.sidebar_label === "string" && data.sidebar_label) || title;
+    const description =
+      typeof data.description === "string" ? data.description : undefined;
+
+    const ctx: LinkContext = {
+      dir,
+      pathToId,
+      rawBase,
+      siteBaseUrl: opts.siteBaseUrl.replace(/\/$/, ""),
+    };
+    let markdown = body;
+    markdown = stripMdxImports(markdown);
+    markdown = convertAdmonitions(markdown);
+    markdown = stripJsxTags(markdown);
+    markdown = rewriteReferences(markdown, ctx, opts.root);
+    markdown = stripRedundantH1(markdown, title);
+    markdown = demoteHeadings(markdown).trim();
+
+    const sectionId = dir === "" ? ROOT_SECTION_ID : docIdForPath(dir);
+    const sectionLabel =
+      dir === ""
+        ? "Overview"
+        : (categories[dir]?.label ?? humanize(dir.split("/").pop() ?? dir));
+
+    return {
+      id: docIdForPath(doc.relPath),
+      title,
+      navLabel,
+      description,
+      section: sectionId,
+      markdown,
+      sourcePath: `${opts.root}/${doc.relPath}`,
+      editUrl: `${editBase}/${opts.root}/${doc.relPath}`,
+      sidebarPosition:
+        typeof data.sidebar_position === "number" ? data.sidebar_position : 999,
+      orderKey: sectionOrderKey(dir, categories),
+      sectionLabel,
+    };
+  });
+
+  // Group into sections and order everything deterministically.
+  const bySection = new Map<string, ShapedDoc[]>();
+  for (const doc of shaped) {
+    const list = bySection.get(doc.section) ?? [];
+    list.push(doc);
+    bySection.set(doc.section, list);
+  }
+
+  const nav: DocsNavSection[] = [...bySection.entries()]
+    .map(([id, docs]) => {
+      const first = docs[0];
+      const items = [...docs]
+        .sort(
+          (a, b) =>
+            a.sidebarPosition - b.sidebarPosition ||
+            a.navLabel.localeCompare(b.navLabel),
+        )
+        .map<DocsNavItem>((d) => ({ id: d.id, label: d.navLabel }));
+      return {
+        id,
+        label: first.sectionLabel,
+        icon: sectionIcon(first.sectionLabel),
+        items,
+        _key: first.orderKey,
+      };
+    })
+    .sort(
+      (a, b) => compareKeys(a._key, b._key) || a.label.localeCompare(b.label),
+    )
+    .map(({ _key, ...section }) => section);
+
+  const docs: Record<string, DocEntry> = {};
+  for (const d of shaped) {
+    docs[d.id] = {
+      id: d.id,
+      title: d.title,
+      description: d.description,
+      section: d.section,
+      markdown: d.markdown,
+      sourcePath: d.sourcePath,
+      editUrl: d.editUrl,
+    };
+  }
+
+  return {
+    source: { repo: opts.repo, ref: opts.ref, root: opts.root },
+    nav,
+    docs,
+  };
+}
diff --git a/frontend/editor/src/portal/docs/search.test.ts b/frontend/editor/src/portal/docs/search.test.ts
new file mode 100644
index 0000000000..84d7c53c76
--- /dev/null
+++ b/frontend/editor/src/portal/docs/search.test.ts
@@ -0,0 +1,100 @@
+import { describe, expect, it } from "vitest";
+import {
+  buildSnippet,
+  highlight,
+  searchDocs,
+  toPlainText,
+  type SearchDoc,
+} from "@portal/docs/search";
+
+const DOCS: SearchDoc[] = [
+  {
+    id: "ocr",
+    title: "OCR Guide",
+    sectionLabel: "Configuration",
+    text: "Stirling PDF uses Tesseract for its text recognition and language packs.",
+  },
+  {
+    id: "docker",
+    title: "Docker Install",
+    sectionLabel: "Installation",
+    text: "Run Stirling with docker compose up to start the container.",
+  },
+  {
+    id: "ranky",
+    title: "Something else",
+    sectionLabel: "Misc",
+    text: "docker docker docker appears many times in the body here.",
+  },
+];
+
+describe("toPlainText", () => {
+  it("strips headings, links, inline code, and code fences", () => {
+    const md =
+      "# Title\n\nSee [the guide](doc:x) and run `npm i`.\n\n```bash\nnpm run build\n```";
+    const out = toPlainText(md);
+    expect(out).toContain("Title");
+    expect(out).toContain("the guide");
+    expect(out).toContain("npm i");
+    expect(out).toContain("npm run build"); // code text kept, fences dropped
+    expect(out).not.toContain("#");
+    expect(out).not.toContain("```");
+    expect(out).not.toContain("](");
+  });
+});
+
+describe("highlight", () => {
+  it("splits text into hit/non-hit segments", () => {
+    expect(highlight("Hello world", ["world"])).toEqual([
+      { text: "Hello ", hit: false },
+      { text: "world", hit: true },
+    ]);
+  });
+
+  it("is safe against regex metacharacters in terms", () => {
+    expect(() => highlight("a (b) c", ["("])).not.toThrow();
+  });
+});
+
+describe("buildSnippet", () => {
+  it("windows around the first match and marks it", () => {
+    const text =
+      "lorem ipsum ".repeat(20) + "the TARGET keyword " + "dolor ".repeat(20);
+    const segs = buildSnippet(text, ["target"]);
+    expect(segs.some((s) => s.hit && /target/i.test(s.text))).toBe(true);
+    // Windowed, so it should be far shorter than the full text.
+    expect(segs.map((s) => s.text).join("").length).toBeLessThan(text.length);
+  });
+});
+
+describe("searchDocs", () => {
+  it("returns nothing for an empty query", () => {
+    expect(searchDocs(DOCS, "   ")).toEqual([]);
+  });
+
+  it("matches body content, not just titles (with a snippet)", () => {
+    const res = searchDocs(DOCS, "tesseract");
+    expect(res.map((r) => r.id)).toEqual(["ocr"]);
+    expect(res[0].snippet.some((s) => s.hit && /tesseract/i.test(s.text))).toBe(
+      true,
+    );
+  });
+
+  it("ranks title matches above body matches", () => {
+    const res = searchDocs(DOCS, "docker");
+    // "Docker Install" (title hit) outranks "Something else" (body-only hits).
+    expect(res[0].id).toBe("docker");
+    expect(res.map((r) => r.id)).toContain("ranky");
+  });
+
+  it("requires every term to match (AND)", () => {
+    expect(searchDocs(DOCS, "docker compose").map((r) => r.id)).toEqual([
+      "docker",
+    ]);
+    expect(searchDocs(DOCS, "docker tesseract")).toEqual([]);
+  });
+
+  it("does not throw on regex-special-character queries", () => {
+    expect(() => searchDocs(DOCS, "a(b")).not.toThrow();
+  });
+});
diff --git a/frontend/editor/src/portal/docs/search.ts b/frontend/editor/src/portal/docs/search.ts
new file mode 100644
index 0000000000..17b586b4d8
--- /dev/null
+++ b/frontend/editor/src/portal/docs/search.ts
@@ -0,0 +1,153 @@
+/**
+ * Full-text search over the docs manifest. Pure + dependency-free so it's unit
+ * testable. Indexes each doc's title + plaintext body; ranks title matches above
+ * body matches; returns highlighted title + a content snippet per hit.
+ */
+
+export interface SearchDoc {
+  id: string;
+  title: string;
+  sectionLabel: string;
+  /** Plaintext body (markdown stripped), original case. */
+  text: string;
+}
+
+/** A run of result text, flagged when it matches a query term (for <mark>). */
+export interface Segment {
+  text: string;
+  hit: boolean;
+}
+
+export interface SearchResult {
+  id: string;
+  title: string;
+  sectionLabel: string;
+  titleSegments: Segment[];
+  snippet: Segment[];
+  score: number;
+}
+
+/** Strip markdown/MDX down to readable plaintext for indexing + snippets. */
+export function toPlainText(md: string): string {
+  return md
+    .replace(/^(```|~~~).*$/gm, " ") // fence delimiters (keep the code text)
+    .replace(/`([^`]+)`/g, "$1") // inline code
+    .replace(/!\[[^\]]*\]\([^)]*\)/g, " ") // images
+    .replace(/\[([^\]]+)\]\([^)]*\)/g, "$1") // links → their text
+    .replace(/^\s{0,3}>\s?/gm, "") // blockquotes
+    .replace(/^\s{0,3}#{1,6}\s+/gm, "") // headings
+    .replace(/^\s*[-*+]\s+/gm, "") // list bullets
+    .replace(/[*_~]/g, "") // emphasis marks
+    .replace(/\|/g, " ") // table pipes
+    .replace(/\s+/g, " ") // collapse whitespace
+    .trim();
+}
+
+function escapeRegExp(s: string): string {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function countOccurrences(haystack: string, needle: string): number {
+  let count = 0;
+  let i = haystack.indexOf(needle);
+  while (i !== -1) {
+    count++;
+    i = haystack.indexOf(needle, i + needle.length);
+  }
+  return count;
+}
+
+/** Split `text` into segments, flagging any run that matches a query term. */
+export function highlight(text: string, terms: string[]): Segment[] {
+  const cleaned = terms.map(escapeRegExp).filter(Boolean);
+  if (!cleaned.length) return [{ text, hit: false }];
+  const re = new RegExp(`(${cleaned.join("|")})`, "gi");
+  const segments: Segment[] = [];
+  let last = 0;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(text)) !== null) {
+    if (m.index > last) {
+      segments.push({ text: text.slice(last, m.index), hit: false });
+    }
+    segments.push({ text: m[0], hit: true });
+    last = m.index + m[0].length;
+    if (m.index === re.lastIndex) re.lastIndex++; // guard against zero-width
+  }
+  if (last < text.length) segments.push({ text: text.slice(last), hit: false });
+  return segments.length ? segments : [{ text, hit: false }];
+}
+
+/** Build a ~context-window snippet around the earliest term match. */
+export function buildSnippet(
+  text: string,
+  terms: string[],
+  radius = 90,
+): Segment[] {
+  const lower = text.toLowerCase();
+  let pos = -1;
+  for (const term of terms) {
+    const i = lower.indexOf(term);
+    if (i !== -1 && (pos === -1 || i < pos)) pos = i;
+  }
+  if (pos === -1) {
+    const head = text.slice(0, radius * 2);
+    return highlight(head + (text.length > head.length ? "…" : ""), terms);
+  }
+  let start = Math.max(0, pos - radius);
+  let end = Math.min(text.length, pos + radius);
+  // Snap to word boundaries so we don't slice mid-word.
+  if (start > 0) {
+    const space = text.indexOf(" ", start);
+    if (space !== -1 && space < pos) start = space + 1;
+  }
+  if (end < text.length) {
+    const space = text.lastIndexOf(" ", end);
+    if (space > pos) end = space;
+  }
+  let snippet = text.slice(start, end).trim();
+  if (start > 0) snippet = "…" + snippet;
+  if (end < text.length) snippet = snippet + "…";
+  return highlight(snippet, terms);
+}
+
+/**
+ * Rank docs against a query. A doc matches when every term appears in its title
+ * or body; title hits score highest.
+ */
+export function searchDocs(
+  docs: SearchDoc[],
+  query: string,
+  limit = 40,
+): SearchResult[] {
+  const terms = query.trim().toLowerCase().split(/\s+/).filter(Boolean);
+  if (!terms.length) return [];
+
+  const results: SearchResult[] = [];
+  for (const doc of docs) {
+    const titleLower = doc.title.toLowerCase();
+    const textLower = doc.text.toLowerCase();
+    const matchesAll = terms.every(
+      (term) => titleLower.includes(term) || textLower.includes(term),
+    );
+    if (!matchesAll) continue;
+
+    let score = 0;
+    for (const term of terms) {
+      if (titleLower.includes(term)) score += 10;
+      if (titleLower.startsWith(term)) score += 5;
+      score += Math.min(countOccurrences(textLower, term), 5);
+    }
+
+    results.push({
+      id: doc.id,
+      title: doc.title,
+      sectionLabel: doc.sectionLabel,
+      titleSegments: highlight(doc.title, terms),
+      snippet: buildSnippet(doc.text, terms),
+      score,
+    });
+  }
+
+  results.sort((a, b) => b.score - a.score || a.title.localeCompare(b.title));
+  return results.slice(0, limit);
+}
diff --git a/frontend/editor/src/portal/generated/docsManifest.json b/frontend/editor/src/portal/generated/docsManifest.json
new file mode 100644
index 0000000000..1931a4d9af
--- /dev/null
+++ b/frontend/editor/src/portal/generated/docsManifest.json
@@ -0,0 +1,989 @@
+{
+  "source": {
+    "repo": "Stirling-Tools/Stirling-Tools.github.io",
+    "ref": "main",
+    "root": "docs"
+  },
+  "nav": [
+    {
+      "id": "overview",
+      "label": "Overview",
+      "icon": "▶",
+      "items": [
+        {
+          "id": "getting-started",
+          "label": "Getting Started"
+        },
+        {
+          "id": "server-admin-onboarding",
+          "label": "Production Deployment Guide"
+        },
+        {
+          "id": "paid-offerings",
+          "label": "Paid Offerings"
+        },
+        {
+          "id": "modes-and-licensing",
+          "label": "Modes"
+        },
+        {
+          "id": "api",
+          "label": "API"
+        },
+        {
+          "id": "contribute",
+          "label": "Contribution guidelines"
+        },
+        {
+          "id": "faq",
+          "label": "FAQ"
+        },
+        {
+          "id": "analytics-and-telemetry",
+          "label": "Analytics and Telemetry"
+        }
+      ]
+    },
+    {
+      "id": "functionality",
+      "label": "Functionality",
+      "icon": "▤",
+      "items": [
+        {
+          "id": "functionality/functionality",
+          "label": "PDF Tools"
+        },
+        {
+          "id": "functionality/recommended-tools",
+          "label": "Recommended Tools"
+        },
+        {
+          "id": "functionality/compare",
+          "label": "Compare PDFs"
+        },
+        {
+          "id": "functionality/compress",
+          "label": "Compress PDF"
+        },
+        {
+          "id": "functionality/features-pipeline",
+          "label": "Features - Pipeline / Automate"
+        },
+        {
+          "id": "functionality/ocr",
+          "label": "OCR (Optical Character Recognition)"
+        },
+        {
+          "id": "functionality/advanced-tools",
+          "label": "Advanced Tools"
+        },
+        {
+          "id": "functionality/multi-tool",
+          "label": "Multi-Tool Workbench"
+        },
+        {
+          "id": "functionality/read-and-annotate",
+          "label": "Read & Annotate PDFs"
+        },
+        {
+          "id": "functionality/fill-form",
+          "label": "Fill Form"
+        },
+        {
+          "id": "functionality/mobile-scanner",
+          "label": "Mobile Scanner"
+        },
+        {
+          "id": "functionality/the-technologies",
+          "label": "Third-Party Credits"
+        }
+      ]
+    },
+    {
+      "id": "functionality/convert",
+      "label": "Convert",
+      "icon": "⇋",
+      "items": [
+        {
+          "id": "functionality/convert/convert",
+          "label": "Convert"
+        }
+      ]
+    },
+    {
+      "id": "functionality/page-operations",
+      "label": "Page Operations",
+      "icon": "▦",
+      "items": [
+        {
+          "id": "functionality/page-operations/page-operations",
+          "label": "Page Operations"
+        },
+        {
+          "id": "functionality/page-operations/redact",
+          "label": "Redaction"
+        }
+      ]
+    },
+    {
+      "id": "functionality/security",
+      "label": "Security",
+      "icon": "🛡",
+      "items": [
+        {
+          "id": "functionality/security/certificate-signing",
+          "label": "Certificate Signing"
+        },
+        {
+          "id": "functionality/security/security",
+          "label": "Features - Security"
+        },
+        {
+          "id": "functionality/security/sign",
+          "label": "Sign PDF (Handwritten Signatures)"
+        },
+        {
+          "id": "functionality/security/shared-signing",
+          "label": "Shared Signing"
+        }
+      ]
+    },
+    {
+      "id": "functionality/content-editing",
+      "label": "Content & Editing",
+      "icon": "◇",
+      "items": [
+        {
+          "id": "functionality/content-editing/content-editing",
+          "label": "Content & Editing"
+        }
+      ]
+    },
+    {
+      "id": "installation",
+      "label": "Installation",
+      "icon": "⤓",
+      "items": [
+        {
+          "id": "installation/versions",
+          "label": "Versions"
+        },
+        {
+          "id": "installation/docker-install",
+          "label": "Docker Guide"
+        },
+        {
+          "id": "installation/kubernetes",
+          "label": "Kubernetes Guide"
+        },
+        {
+          "id": "installation/mac",
+          "label": "Mac Installation Guide"
+        },
+        {
+          "id": "installation/unix",
+          "label": "Unix Installation Guide"
+        },
+        {
+          "id": "installation/windows",
+          "label": "Windows Guide"
+        },
+        {
+          "id": "installation/development-setup",
+          "label": "Development Setup Guide"
+        },
+        {
+          "id": "installation/managed-deployment",
+          "label": "Managed Desktop Deployment"
+        },
+        {
+          "id": "installation/path-structure",
+          "label": "Path Structure"
+        }
+      ]
+    },
+    {
+      "id": "migration",
+      "label": "Migration from V1 to V2",
+      "icon": "⇄",
+      "items": [
+        {
+          "id": "migration/overview",
+          "label": "Migrating from V1 to V2"
+        },
+        {
+          "id": "migration/settings-changes",
+          "label": "Settings Changes from V1 to V2"
+        },
+        {
+          "id": "migration/new-features",
+          "label": "New Features in V2"
+        },
+        {
+          "id": "migration/breaking-changes",
+          "label": "Breaking Changes in V2"
+        }
+      ]
+    },
+    {
+      "id": "configuration",
+      "label": "Configuration",
+      "icon": "⚙",
+      "items": [
+        {
+          "id": "configuration/configuration",
+          "label": "Configuration Guide"
+        },
+        {
+          "id": "configuration/system-and-security",
+          "label": "Login, System and Security"
+        },
+        {
+          "id": "configuration/oauth-sso-configuration",
+          "label": "OAuth 2.0 Single Sign-On Configuration"
+        },
+        {
+          "id": "configuration/single-sign-on-configuration",
+          "label": "Single Sign-On (SSO) Overview"
+        },
+        {
+          "id": "configuration/ui-customisation",
+          "label": "UI Customisation"
+        },
+        {
+          "id": "configuration/google-drive-file-picker",
+          "label": "Google Drive File Picker"
+        },
+        {
+          "id": "configuration/usage-monitoring",
+          "label": "Usage Monitoring"
+        },
+        {
+          "id": "configuration/endpoint-or-feature-customisation",
+          "label": "Endpoints Customisation"
+        },
+        {
+          "id": "configuration/folderscanning",
+          "label": "Folder Scanning"
+        },
+        {
+          "id": "configuration/ocr",
+          "label": "OCR (Optical Character Recognition)"
+        },
+        {
+          "id": "configuration/fail2ban",
+          "label": "Fail2Ban Integration"
+        },
+        {
+          "id": "configuration/external-database",
+          "label": "External Database"
+        },
+        {
+          "id": "configuration/database",
+          "label": "Database Backups"
+        },
+        {
+          "id": "configuration/pipeline",
+          "label": "Pipeline Automation (Automate)"
+        },
+        {
+          "id": "configuration/extra-settings",
+          "label": "Custom Settings Configuration"
+        },
+        {
+          "id": "configuration/sign-with-custom-files",
+          "label": "Visual Sign with Custom File Storage"
+        },
+        {
+          "id": "configuration/file-sharing-and-storage",
+          "label": "File Sharing and Storage"
+        },
+        {
+          "id": "configuration/other-customisations",
+          "label": "Other Customisations"
+        },
+        {
+          "id": "configuration/telegram-bot",
+          "label": "Telegram Bot Integration"
+        },
+        {
+          "id": "configuration/ssrf-protection",
+          "label": "SSRF Protection"
+        },
+        {
+          "id": "configuration/process-limits",
+          "label": "Process Limits"
+        },
+        {
+          "id": "configuration/audit-logging",
+          "label": "Audit Logging"
+        },
+        {
+          "id": "configuration/keyboard-shortcuts",
+          "label": "Keyboard Shortcuts"
+        },
+        {
+          "id": "configuration/mobile-scanner",
+          "label": "Mobile Scanner Configuration"
+        },
+        {
+          "id": "configuration/diagnostics",
+          "label": "Diagnostics & Reporting Issues"
+        },
+        {
+          "id": "configuration/libreoffice-parallel-processing",
+          "label": "LibreOffice Parallel Processing"
+        },
+        {
+          "id": "configuration/performance-optimization",
+          "label": "Performance Optimization & Sizing"
+        }
+      ]
+    },
+    {
+      "id": "configuration/saml-sso-configuration",
+      "label": "SAML SSO Configuration",
+      "icon": "⚙",
+      "items": [
+        {
+          "id": "configuration/saml-sso-configuration/saml-sso-configuration",
+          "label": "SAML 2.0 Single Sign-On Configuration"
+        }
+      ]
+    },
+    {
+      "id": "advanced-configuration",
+      "label": "Advanced Configuration",
+      "icon": "⚙",
+      "items": [
+        {
+          "id": "advanced-configuration/other-customisations",
+          "label": "Other Customisations"
+        },
+        {
+          "id": "advanced-configuration/mcp-server",
+          "label": "MCP Server"
+        },
+        {
+          "id": "advanced-configuration/pdf-to-cbr-conversion",
+          "label": "Enabling PDF to CBR Conversion in Stirling PDF"
+        }
+      ]
+    }
+  ],
+  "docs": {
+    "api": {
+      "id": "api",
+      "title": "API",
+      "description": "Overview of API offering in S-PDF",
+      "section": "overview",
+      "markdown": "## Stirling PDF API\n\nStirling PDF exposes a simple API for easy integration with external scripts. You can access the API documentation in two ways:\n\n1. Local Swagger UI at `/swagger-ui.html` on your Stirling PDF instance\n2. Online [Swagger Documentation](https://app.swaggerhub.com/apis-docs/Frooodle/Stirling-PDF/)\n\nYou can also access the documentation through the settings menu (gear icon in the top-right corner).\n\n## Accessing API Documentation\n\n### Local Swagger UI\nYour Stirling PDF instance includes built-in API documentation:\n1. Navigate to `http://your-instance:port/swagger-ui.html`\n2. Or append `/swagger-ui.html` to your Stirling PDF URL\n3. This provides an interactive documentation interface where you can:\n   - View all available endpoints\n   - Test API calls directly\n   - See request/response schemas\n   - View authentication requirements\n\n### Settings Menu Access\n1. Click the gear icon (⚙️) in the top-right corner\n2. Look for the \"API Documentation\" or \"API\" link\n3. This will take you to the local Swagger UI\n\n## API Authentication\n\nWhen security is enabled, all API requests require authentication. There are two ways to handle API authentication:\n\n### User-Specific API Keys\n1. Obtain your API key:\n   - Log into Stirling PDF\n   - Go to Account Settings (via the gear icon)\n   - Find your API key in the account details\n\n### Global API Key\nYou can set a custom global API key using the environment variable:\n```bash\nSECURITY_CUSTOMGLOBALAPIKEY=your-custom-api-key\n```\nThis allows you to set a single API key that works regardless of user authentication.\n\n2. Include the API key in all requests:\n   ```http\n   X-API-KEY: your-api-key-here\n   ```\n\n3. Example authenticated request:\n   ```bash\n   curl -X POST \"http://localhost:8080/api/v1/security/add-watermark\" \\\n        -H \"X-API-KEY: your-api-key-here\" \\\n        -H \"Content-Type: multipart/form-data\" \\\n        ...\n   ```\n\n## Endpoint Paths\n\n> **ℹ️ Info**\n>\n> Every operation lives under `/api/v1/<category>/<operation>`, where the category is one of `security`, `general`, `misc`, `convert`, etc. For example, \"Add Watermark\" is at `/api/v1/security/add-watermark`. The exact path for any operation is shown in the [Swagger UI](#local-swagger-ui).\n\n\n### AI assistants / MCP\n\nTo drive these endpoints from an AI assistant (Claude Desktop, Cursor, etc.) over the Model Context Protocol, see [MCP Server](doc:advanced-configuration/mcp-server).\n\n## API Limitations\n\nStirling PDF's feature set is not entirely confined to the backend, hence not all functionalities are accessible via the API. Certain operations, such as the \"view-pdf\" or \"visually sign\", are executed exclusively on the front-end, and as such, they are only available through the Web-UI. If you encounter a situation where some API endpoints appear to be absent, it is likely attributable to these front-end exclusive features.\n\nStirling PDF also has statistic and health endpoints to integrate with monitoring/dashboard applications.\n\n## Example CURL Commands\n\n\n  \n    ```bash\n    curl -X POST \"http://localhost:8080/api/v1/security/add-watermark\" \\\n         -H \"Content-Type: multipart/form-data\" \\\n         -F \"fileInput=@/Users/username/Downloads/sample-1_cropped.pdf\" \\\n         -F \"watermarkType=text\" \\\n         -F \"watermarkText=YOUR_WATERMARK_TEXT\" \\\n         -F \"alphabet=roman\" \\\n         -F \"fontSize=30\" \\\n         -F \"rotation=0\" \\\n         -F \"opacity=0.5\" \\\n         -F \"widthSpacer=50\" \\\n         -F \"heightSpacer=50\" \\\n         > \"/Users/username/Downloads/output.pdf\"\n    ```\n  \n  \n    ```bash\n    curl -X POST \"http://localhost:8080/api/v1/security/add-watermark\" ^\n         -H \"Content-Type: multipart/form-data\" ^\n         -F \"fileInput=@C:\\Users\\systo\\Downloads\\sample-1_cropped.pdf\" ^\n         -F \"watermarkType=text\" ^\n         -F \"watermarkText=YOUR_WATERMARK_TEXT\" ^\n         -F \"alphabet=roman\" ^\n         -F \"fontSize=30\" ^\n         -F \"rotation=0\" ^\n         -F \"opacity=0.5\" ^\n         -F \"widthSpacer=50\" ^\n         -F \"heightSpacer=50\" ^\n         > \"C:\\Users\\systo\\Downloads\\output.pdf\"\n    ```\n  \n\n\n## Integrations (n8n, Zapier, Make, Power Automate, etc.)\n\nStirling PDF does not ship dedicated plugins or nodes for any specific automation platform. Integration is **via the REST API** documented above, which works with any tool that can make an authenticated HTTP request.\n\n### What this looks like in practice\n\n- **n8n**: use the built-in [HTTP Request node](https://docs.n8n.io/integrations/builtin/core-nodes/n8n-nodes-base.httprequest/) pointed at your Stirling PDF instance. Set method `POST`, content type `multipart/form-data`, attach the binary as `fileInput`, add the `X-API-KEY` header, and connect the binary output to a `Read/Write Binary File` node or onward to your storage.\n- **Zapier / Make / Power Automate**: use the generic HTTP / Webhooks action with the same multipart pattern.\n- **Home Assistant**: a `rest_command` definition pointing at the appropriate Stirling endpoint.\n- **Bash / Python / JavaScript**: any HTTP client (`curl`, `requests`, `fetch`) - the curl examples on this page translate directly.\n\n### Common automation recipe: chain multiple operations in one call\n\nRather than wiring 5 separate HTTP nodes for \"OCR then compress then watermark then sign...\", you could use the **pipeline endpoint** to chain everything in one request:\n\n- Endpoint: `POST /api/v1/pipeline/handleData`\n- Request: multipart with one or more `fileInput` parts plus a `json` field containing the full pipeline configuration\n- Response: a single processed file, or a ZIP if the pipeline produced multiple outputs\n\nFull schema, operation list, parameter reference, and curl examples: see **[Pipeline Automation](doc:configuration/pipeline)**.\n\n### Building the pipeline JSON\n\nThe fastest path is:\n1. Build the workflow visually in the **Automate** tool inside Stirling PDF.\n2. Click **Export for Folder Scanning** in the save panel - this produces the JSON in the format the API expects.\n3. Drop that JSON into your automation tool's HTTP request as the `json` form field.\n\nRe-import the same file later via the Automate UI's import dialog to round-trip workflows between machines.\n\n### Authentication for automation tools\n\nWhen security is enabled, set a global API key once via `SECURITY_CUSTOMGLOBALAPIKEY=<key>` and reference it from your automation tool as the `X-API-KEY` header. This avoids needing per-user logins from headless scripts.",
+      "sourcePath": "docs/API.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/API.md"
+    },
+    "advanced-configuration/mcp-server": {
+      "id": "advanced-configuration/mcp-server",
+      "title": "MCP Server",
+      "description": "Expose Stirling PDF's tools to MCP clients over a built-in Model Context Protocol server",
+      "section": "advanced-configuration",
+      "markdown": "Stirling PDF ships a built-in [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server. MCP is the open standard MCP clients (Claude Desktop, the MCP Inspector, IDE agents, and custom tools) use to discover and call tools on a remote server. When enabled, Stirling PDF exposes its PDF operations as MCP tools so an MCP-capable assistant can run them on your behalf.\n\nThe MCP server is built into the Stirling PDF self-hosted server and the desktop app in Local / Self-hosted modes. It is **off by default** and must be enabled and configured per deployment.\n\n> **ℹ️ Info: Self-hosted capability**\n>\n> This page documents the MCP server you run on your own Stirling PDF instance. The per-user MCP tab in Stirling Cloud is a separate, cloud-only surface and is not covered here. For where each deployment mode applies, see [Modes](doc:modes-and-licensing).\n\n\n---\n\n## Enable the server\n\nThe MCP server runs only when `mcp.enabled` is `true`. While off, there is no `/mcp` endpoint and no MCP metadata.\n\nTurn it on either way:\n\n- **Settings file / environment variable**: set `mcp.enabled: true` in `settings.yml`, or the environment variable `MCP_ENABLED=true`. A restart applies file edits.\n- **Admin UI**: open **Admin Settings → MCP Server**. This page is shown to admins, and on instances where login is disabled. Saving prompts for a restart.\n\nEnabling alone is not enough - you also need to choose and configure an [authentication mode](#authentication) before clients can call tools.\n\n---\n\n## Transport and protocol\n\n- **Endpoint**: `POST /mcp` on the same host and port as the rest of Stirling PDF.\n- **Protocol**: JSON-RPC 2.0 over streamable-HTTP.\n- **Supported MCP protocol versions**: `2025-06-18` (preferred), `2025-03-26`, and `2024-11-05`. The server echoes the client's requested version when it is supported, otherwise it advertises the preferred version.\n\n---\n\n## Tools exposed\n\nThe server presents a small set of category tools rather than one tool per operation. An MCP client lists them, then drills into a specific PDF operation using `stirling_describe_operation`.\n\n| Tool | Purpose |\n|---|---|\n| `stirling_describe_operation` | Look up the parameters and JSON schema for a specific operation id. |\n| `stirling_pages` | Page-level operations (merge, split, rotate, reorder, add blank pages, and similar). |\n| `stirling_convert` | Conversions to and from PDF (images, office formats, and similar). |\n| `stirling_misc` | Miscellaneous utilities (compress, flatten, repair, and similar). |\n| `stirling_security` | Security operations (encrypt, decrypt, permissions, and similar). |\n| `stirling_upload` | Store a file server-side and get back a `fileId` for large inputs. |\n| `stirling_download` | Fetch a result that was returned by reference rather than inline. |\n| `stirling_ai` | AI-engine capabilities. **Not usable in self-hosted - see the caveat below.** |\n\n> **⚠️ Warning: `stirling_ai` requires a Stirling Cloud AI engine**\n>\n> `stirling_ai` only has capabilities when a Stirling AI engine is configured. The AI engine is a Stirling Cloud feature and is **not available in self-hosted** today, so on a self-hosted server `stirling_ai` exposes nothing and only the PDF tools above are usable over MCP.\n\n\n---\n\n## Authentication\n\nPick one of two modes with `mcp.auth.mode`.\n\n### OAuth2 resource server (`oauth`, default)\n\nIn OAuth mode the `/mcp` endpoint runs as an OAuth2 resource server: it validates incoming JWTs (signature, issuer, expiry, and audience) and binds each token to an existing Stirling account. It publishes RFC 9728 protected-resource metadata at `/.well-known/oauth-protected-resource` so MCP clients can discover the authorization server.\n\n| Key | Env | Default | Purpose |\n|---|---|---|---|\n| `mcp.auth.issuerUri` | `MCP_AUTH_ISSUERURI` | empty | OAuth2 issuer URI (e.g. `http://localhost:9000`). **Required** in OAuth mode; every token is rejected until it is set. |\n| `mcp.auth.jwksUri` | `MCP_AUTH_JWKSURI` | empty | JWKS URI. Blank means it is derived from the issuer's `/.well-known/openid-configuration`. |\n| `mcp.auth.resourceId` | `MCP_AUTH_RESOURCEID` | empty | RFC 8707 resource identifier of this server. Must equal the public `/mcp` URL clients call and **end in `/mcp`** (e.g. `http://localhost:8080/mcp`). Tokens that do not list it in `aud` are rejected. |\n| `mcp.auth.acceptedAudiences` | `MCP_AUTH_ACCEPTEDAUDIENCES` | `[]` | Extra `aud` values accepted on top of `resourceId`. Empty keeps strict RFC 8707 binding. Use this for IdPs that cannot mint a resource-specific audience (e.g. Supabase always issues `aud=authenticated`). |\n| `mcp.auth.usernameClaim` | `MCP_AUTH_USERNAMECLAIM` | `sub` | JWT claim matched against a Stirling username. Set to `email` or `preferred_username` if your IdP maps users differently. |\n| `mcp.auth.requireExistingAccount` | `MCP_AUTH_REQUIREEXISTINGACCOUNT` | `true` | Reject tokens whose subject has no enabled Stirling account. Keep `true` unless you intend open access for any IdP-valid token. |\n| `mcp.scopesEnabled` | `MCP_SCOPESENABLED` | `true` | Enforce the `mcp.tools.read` / `mcp.tools.write` scopes. Read-style tools require `mcp.tools.read`; mutating operations require `mcp.tools.write`. Set `false` only if your IdP can issue a single coarse token. |\n\nEach validated token is bound to the matching Stirling account so that audit and attribution are correct.\n\n### API key (`apikey`)\n\nAPI-key mode is the low-friction option for self-hosters with no external identity provider. Set `mcp.auth.mode: apikey` (env `MCP_AUTH_MODE=apikey`) and clients authenticate with an existing per-user Stirling API key.\n\nSend the key as either header:\n\n```text\nX-API-KEY: <your-stirling-api-key>\n```\n\nor\n\n```text\nAuthorization: Bearer <your-stirling-api-key>\n```\n\nThe key must belong to an existing, enabled account (generate one under **Account → API Keys** - see [API documentation](doc:api)). No external IdP, OAuth, or JWKS configuration is needed.\n\n---\n\n## Restrict which operations are exposed\n\nTwo MCP-level lists control which operations clients can see and call. They use the same kebab-case operation ids as the [Endpoint or Feature Customisation](doc:configuration/endpoint-or-feature-customisation) page (e.g. `compress-pdf`).\n\n| Key | Env | Default | Behaviour |\n|---|---|---|---|\n| `mcp.allowedOperations` | `MCP_ALLOWEDOPERATIONS` | `[]` | When **non-empty**, acts as a strict allow-list - only these operations are exposed over MCP; everything else is hidden, undescribable, and uninvocable. Empty means allow all. |\n| `mcp.blockedOperations` | `MCP_BLOCKEDOPERATIONS` | `[]` | A deny-list. Anything listed is always removed, applied **after** the allow-list, so a blocked id wins even if it is also allowed. |\n\nThese lists layer **on top of** the global [`endpoints.toRemove` / `endpoints.groupsToRemove`](doc:configuration/endpoint-or-feature-customisation) configuration. An operation disabled globally is never exposed over MCP regardless of these lists.\n\n---\n\n## Limits\n\n| Key | Env | Default | Purpose |\n|---|---|---|---|\n| `mcp.maxRequestBytes` | `MCP_MAXREQUESTBYTES` | 10 MB | Maximum MCP request body size. Inline file uploads ride in the JSON-RPC body, so this caps how large an inline input can be. |\n| `mcp.maxInlineResponseBytes` | `MCP_MAXINLINERESPONSEBYTES` | 10 MB | Results up to this size return inline as base64; larger results return a `fileId` instead, which the client fetches with `stirling_download`. |\n| `mcp.engineCapabilityRefreshMinutes` | `MCP_ENGINECAPABILITYREFRESHMINUTES` | `5` | How often the AI capabilities manifest is refreshed from the engine (only relevant when an AI engine is available). |\n\n---\n\n## Troubleshooting and operability\n\n- **Startup config validation**: when MCP is enabled, the server validates the resolved config at boot and logs findings. Misconfiguration (missing issuer, a `resourceId` that does not end in `/mcp`, a `username-claim` of `sub` with `require-existing-account=true`, and similar) is logged as a warning so it surfaces in the logs instead of as a later rejected-token `401`.\n- **Meaningful `401` responses**: a rejected OAuth token returns a `WWW-Authenticate` header carrying a real `error_description` (audience, issuer, or expiry mismatch), plus a `resource_metadata` pointer for discovery. A tokenless `401` is the normal discovery handshake, not an error.\n- **Audit logging**: MCP calls are attributed to the bound Stirling account, and no secret is written to the audit log.\n\n---\n\n## Connect a client\n\nPoint any MCP client at `http://your-host:8080/mcp` (use your real host, port, and scheme).\n\n**MCP Inspector** (quick manual testing):\n\n```bash\nnpx @modelcontextprotocol/inspector\n```\n\nThen set the transport to streamable-HTTP and the URL to your `/mcp` endpoint, adding the appropriate auth header (`X-API-KEY` in API-key mode, or a Bearer token in OAuth mode).\n\n**Claude Desktop** via the `mcp-remote` bridge - add to your Claude Desktop config:\n\n```json\n{\n  \"mcpServers\": {\n    \"stirling-pdf\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"mcp-remote\",\n        \"http://your-host:8080/mcp\",\n        \"--header\",\n        \"X-API-KEY:your-stirling-api-key\"\n      ]\n    }\n  }\n}\n```\n\nIn OAuth mode, drop the `X-API-KEY` header and let `mcp-remote` complete the OAuth flow against your configured issuer.\n\n---\n\n## Related Documentation\n\n- **[API documentation](doc:api)** - generate the per-user API key used in API-key mode\n- **[Endpoint or Feature Customisation](doc:configuration/endpoint-or-feature-customisation)** - the operation ids and global enable/disable config the MCP lists build on\n- **[Modes](doc:modes-and-licensing)** - where each deployment mode and feature applies",
+      "sourcePath": "docs/Advanced Configuration/MCP-Server.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Advanced Configuration/MCP-Server.md"
+    },
+    "advanced-configuration/other-customisations": {
+      "id": "advanced-configuration/other-customisations",
+      "title": "Other Customisations",
+      "section": "advanced-configuration",
+      "markdown": "Stirling PDF offers various other customisation options, such as:\n\n### Defaulting Language\nDefault language selection via the `SYSTEM_DEFAULTLOCALE` environment variable. Accepted values include `de-DE`, `fr-FR`, `ar-AR` and all other languages codes that are within Stirling PDFs current list.\n\n### Google Search Visibility (robots.txt)\nEnable or disable search engine visibility with the `ALLOW_GOOGLE_VISIBILITY` variable.\n\n### Custom Root path\nRedirect the root path of the application using `APP_ROOT_PATH`.\nThis is for changing websites like stirlingtools.com to instead host the interface at stirlingtools.com/`APP_ROOT_PATH` like stirlingtools.com/demo\n\n### Enable/Disable Analytics\nAnalytics can be enabled/disabled with ``SYSTEM_ENABLEANALYTICS`` or\n```yaml\nsystem:\n  enableAnalytics: 'true'\n```\nIn configs/Settings.yml\n\n### Using an outgoing HTTP(S) proxy\nTo make Stirling PDF use an outgoing proxy server (e.g. for checking the license validity):\n\n\n  \n    ```bash\n    JAVA_CUSTOM_OPTS=\"-Dhttp.proxyHost=proxyserver -Dhttp.proxyPort=8888 -Dhttp.nonProxyHosts='localhost|127.0.0.1|127.0.1.1|127.0.0.0/8|::1|10.0.0.0/8|.svc|.cluster.local' -Dhttps.proxyHost=proxyserver -Dhttps.proxyPort=8888 -Dhttps.nonProxyHosts='localhost|127.0.0.1|127.0.1.1|127.0.0.0/8|::1|10.0.0.0/8|.svc|.cluster.local'\"\n    ```\n  \n  \n    ```bash\n    docker run -d \\\n      -p 8080:8080 \\\n      -e JAVA_CUSTOM_OPTS=\"-Dhttp.proxyHost=proxyserver -Dhttp.proxyPort=8888 -Dhttp.nonProxyHosts='localhost|127.0.0.1|127.0.1.1|127.0.0.0/8|::1|10.0.0.0/8|.svc|.cluster.local' -Dhttps.proxyHost=proxyserver -Dhttps.proxyPort=8888 -Dhttps.nonProxyHosts='localhost|127.0.0.1|127.0.1.1|127.0.0.0/8|::1|10.0.0.0/8|.svc|.cluster.local'\" \\\n      stirlingtools/stirling-pdf:latest\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        image: stirlingtools/stirling-pdf:latest\n        environment:\n          JAVA_CUSTOM_OPTS: \"-Dhttp.proxyHost=proxyserver -Dhttp.proxyPort=8888 -Dhttp.nonProxyHosts='localhost|127.0.0.1|127.0.1.1|127.0.0.0/8|::1|10.0.0.0/8|.svc|.cluster.local' -Dhttps.proxyHost=proxyserver -Dhttps.proxyPort=8888 -Dhttps.nonProxyHosts='localhost|127.0.0.1|127.0.1.1|127.0.0.0/8|::1|10.0.0.0/8|.svc|.cluster.local'\"\n    ```",
+      "sourcePath": "docs/Advanced Configuration/Other Customisations.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Advanced Configuration/Other Customisations.md"
+    },
+    "advanced-configuration/pdf-to-cbr-conversion": {
+      "id": "advanced-configuration/pdf-to-cbr-conversion",
+      "title": "Enabling PDF to CBR Conversion in Stirling PDF",
+      "section": "advanced-configuration",
+      "markdown": "## Overview\n\nStirling PDF can convert PDF files into the Comic Book RAR (`.cbr`) format. This process relies on an external command-line utility, `rar`, which is not included by default. To enable this feature, you must first install the `rar` utility on your system and then make it accessible to Stirling PDF.\n\n### What is a CBR file?\n\nA CBR (Comic Book RAR) file is an archive used for distributing digital comic books. It is essentially a collection of sequential image files (e.g., JPEG, PNG) compressed into a single file using RAR compression.\n\nWhile CBR is a popular format, it requires the proprietary `rar` utility for creation. Its more common, open-standard alternative is CBZ (Comic Book ZIP), which is supported by Stirling PDF out of the box.\n\n-----\n\n## Step 1: Install the `rar` Command-Line Utility\n\nThis is a mandatory prerequisite for both Docker and non-Docker setups. The `rar` executable must be installed on the host machine.\n\n### Linux\n\nThe easiest method is to use your distribution's package manager.\n\n**Debian / Ubuntu:**\nThe `rar` package is available in the `non-free` repository.\n\n```bash\nsudo apt update\nsudo apt install rar\n```\n\n**Fedora / CentOS / RHEL:**\nThe `rar` package is available in the RPM Fusion \"non-free\" repository.\n\n```bash\n# First, enable the RPM Fusion non-free repository for your system.\n# See https://rpmfusion.org/Configuration for instructions.\n\n# Then, install rar\nsudo dnf install rar  # For Fedora, RHEL 8+, CentOS Stream\n# or\nsudo yum install rar  # For CentOS 7\n```\n\n**Manual Installation (Any Linux Distribution):**\n\n1.  Visit the official download page: [rarlab.com/download.htm](https://www.rarlab.com/download.htm).\n2.  Download the \"RAR for Linux x64\" command-line version.\n3.  Extract the archive and install the binary:\n    ```bash\n    # The version number (e.g., 712, as of writing this guide) will change.\n    # Use the actual filename.\n    tar -xzf rarlinux-x64-*.tar.gz\n\n    # Move the binary to a standard location in your system's PATH\n    sudo mv rar/rar /usr/local/bin/\n\n    # Ensure it has execute permissions\n    sudo chmod +x /usr/local/bin/rar\n    ```\n\n### Windows\n\n1.  Download the \"WinRAR and RAR command line tools\" from [rarlab.com/download.htm](https://www.rarlab.com/download.htm).\n2.  Extract the downloaded archive.\n3.  Copy the `rar.exe` file to a folder that is included in your system's `PATH` environment variable. A common and reliable location is `C:\\Windows\\System32`.\n4.  If Stirling PDF is already running, restart it to ensure it recognizes the updated `PATH`.\n\n### macOS\n\nThe recommended method is to use the [Homebrew](https://brew.sh/) package manager.\n\n```bash\nbrew install rar\n```\n\n-----\n\n## Step 2: Configure Stirling PDF\n\nAfter installing `rar` on your host system, follow the appropriate instructions for your environment.\n\n### For Non-Docker Users\n\nIf you installed Stirling PDF directly on your operating system (without Docker), no further configuration is needed. As long as the `rar` command is available in your system's `PATH`, Stirling PDF will automatically (after restart) detect and use it.\n\n### For Docker Users\n\nFor the binary to be accessible inside the container, you have to mount the binary as a volume.\n\nUpdate your `docker-compose.yml` to include the volume mount. The path on the host side must match where you installed `rar`.\n\n```yaml\nservices:\n  stirling-pdf:\n    image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest\n    ports:\n      - '8080:8080'\n    volumes:\n      - ./StirlingPDF/trainingData:/usr/share/tessdata\n      - ./StirlingPDF/extraConfigs:/configs\n      - ./StirlingPDF/customFiles:/customFiles/\n      - ./StirlingPDF/logs:/logs/\n      - ./StirlingPDF/pipeline:/pipeline/\n      # Add the following line to mount the rar binary\n      - /usr/local/bin/rar:/usr/local/bin/rar:ro\n```\n\n**Note for Windows Docker Users:**\nThe host path must use forward slashes. For example, if you placed `rar.exe` in `C:\\Program Files\\RAR`, your volume mount would look like this:\n\n```yaml\n# Example for Windows host path\n- \"C:/Program Files/RAR/rar.exe:/usr/local/bin/rar:ro\"\n```\n\n-----\n\n## Step 3: Verification\n\nConfirm that Stirling PDF can access the `rar` command.\n\n* **For Docker Users:** Execute a command inside the running container.\n\n  ```bash\n  docker exec -it stirling-pdf rar\n  ```\n\n* **For Non-Docker Users:** Check if the `rar` command is recognized in your terminal.\n\n  ```bash\n  # On Linux and macOS\n  which rar\n\n  # On Windows\n  where rar\n  ```\n\nIn both cases, a successful setup will display the RAR version and usage information. An error like \"command not found\" means there is a problem with the installation or `PATH`.\n\n-----\n\n## Important Considerations\n\n### License Note\n\nRAR is shareware. While it is free to use for personal, non-commercial purposes, business or commercial use may require purchasing a license. Please review the official RAR license terms on the RARLAB website for complete details.\n\n### Alternative: Use the CBZ Format\n\nFor broader compatibility and to avoid proprietary software, using the **CBZ (Comic Book ZIP)** format is highly recommended.\n\n* CBZ uses the open and universal ZIP standard.\n* The **PDF to CBZ** tool is enabled in Stirling PDF by default and requires no extra software.\n* CBZ is supported by virtually all modern comic book reader applications.",
+      "sourcePath": "docs/Advanced Configuration/PDF to CBR Conversion.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Advanced Configuration/PDF to CBR Conversion.md"
+    },
+    "analytics-and-telemetry": {
+      "id": "analytics-and-telemetry",
+      "title": "Analytics and Telemetry",
+      "section": "overview",
+      "markdown": "> Please note all the following applies to version 1.5.0 onward due to be released 16th October\n\n\nStirling‑PDF uses analytics to understand usage patterns and improve the application. This page explains what data is collected, why we collect it, and how to disable analytics if desired.\n\n> **User control**: All analytics are **opt‑in via a consent banner** (disabled until a user allows it). A self‑hosted administrator can also turn all analytics off system‑wide. If analytics are disabled system‑wide, no banner is shown.\n\n## Overview\n\nStirling‑PDF uses two analytics services:\n\n1. **[Scarf](https://scarf.sh)** - a privacy‑friendly tool designed for open‑source projects.\n2. **[PostHog](https://posthog.com)** - an open‑source product analytics platform for detailed usage insights.\n\nBoth services are designed with privacy in mind and can be completely disabled.\n\n---\n\n## PostHog Analytics\n\n### What is PostHog?\n\nPostHog is an open‑source product analytics platform that provides detailed insights into how users interact with Stirling‑PDF. It's hosted on PostHog's European servers (`eu.i.posthog.com`) for GDPR alignment.\n\n### Data collected by PostHog\n\nPostHog collects comprehensive system and usage information **only when analytics are enabled and consented**:\n\n#### System information\n- Operating system name and version\n- Java version and vendor\n- CPU cores and memory allocation\n- Deployment type (Docker, JAR, EXE)\n- Docker/Kubernetes environment details (if applicable)\n- Timezone and locale settings\n\n#### Application configuration\n- Security settings (login enabled, OAuth/SAML configuration status)\n- UI customization settings\n- Feature flags and enabled functionality\n- Legal document URLs (terms, privacy policy, etc.)\n- System limits and quotas\n\n#### Usage data\n- Aggregate counts (e.g., total number of user accounts created)\n- Feature/tool usage (which tools/operations are used)\n- Error tracking\n- Browser and device information (for the web interface)\n\n**Important privacy notes**:\n- **No document content, PDF data, or file metadata is ever collected or transmitted.**\n- PostHog is configured with:\n  - `opt_out_capturing_by_default: true`\n  - `mask_all_text: true`\n  - `mask_all_element_attributes: true`\n- Users must accept cookies before any data is captured.\n- Data is stored on EU servers.\n- Each instance has a unique UUID (not tied to individuals).\n\n### Why we use PostHog\n\nPostHog shows us which features get used, helps us catch bugs, and guides what to build next.\n\n---\n\n\n## Scarf\n\n### What is Scarf?\n\n[Scarf](https://scarf.sh) provides a simple tracking pixel (`pixel.stirling.com`) that collects basic, non‑personally identifiable information about Stirling‑PDF usage.\n\n### Data collected by Scarf\n\nThe Scarf pixel collects the following information:\n\n- **Machine Type**: Deployment type (Docker, JAR, or EXE)\n- **App Version**: The version of Stirling‑PDF you're running\n- **License Type**: Whether you're using Community or Enterprise edition\n- **Login Enabled**: Whether authentication is enabled\n- **Page Endpoint Loaded**: Which Stirling‑PDF page was loaded (e.g., `/split-pdf`)\n\n**Important**: The Scarf pixel does **not** collect or store:\n- Personal information (PII)\n- IP addresses (IP addresses are not stored)\n- User‑specific identifiers\n- Document content or file metadata\n- Fine‑grained user behavior beyond which page/endpoint was loaded\n\n### Why we use Scarf\n\nScarf gives us a rough idea of how Stirling-PDF is deployed and which pages are reached, so we can prioritise work and keep it compatible across setups.\n\n### How to disable Scarf\n\nScarf is opt‑in by default (via the cookie consent banner). To disable the Scarf tracking pixel **system‑wide** and suppress the banner for it:\n\n**Environment variable**\n```bash\nSYSTEM_ENABLESCARF=false\n```\n\n**settings.yml**\n```yaml\nsystem:\n  enableScarf: false\n```\n\n---\n\n\n\n## Configuration and Control\n\nAnalytics are governed by a **global master toggle**, **component toggles**, and the **cookie consent banner**.\n\n### 1) Global analytics toggle (master switch)\n\nControls **all** analytics and whether a consent banner appears.\n\n\n  \n    ```yaml\n    system:\n      enableAnalytics: false  # true | false | null (unset)\n    ```\n  \n  \n    ```bash\n    SYSTEM_ENABLEANALYTICS=false   # true | false | (unset = null)\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        environment:\n          SYSTEM_ENABLEANALYTICS: false\n    ```\n  \n\n\n**Behavior**\n- `false`: Disables **all** analytics (no consent banner; PostHog & Scarf are off).\n- `true`: Allows analytics (banner still required for user consent before any capture).\n- `null`/unset: **First‑run admin choice** - on the first ever connection to a self‑hosted instance, the first visitor (assumed admin) is prompted to choose, and that choice sets the global behavior for all users (either disabling analytics or enabling the consent banner for others).\n\n### 2) Component toggles\n\nUse these to selectively enable/disable providers **in addition** to the global toggle.\n\n**PostHog:**\n\n\n  \n    ```yaml\n    system:\n      enablePosthog: false   # true | false | null\n    ```\n  \n  \n    ```bash\n    SYSTEM_ENABLEPOSTHOG=false\n    ```\n  \n\n\n**Scarf tracking pixel:**\n\n\n  \n    ```yaml\n    system:\n      enableScarf: false     # true | false | null\n    ```\n  \n  \n    ```bash\n    SYSTEM_ENABLESCARF=false\n    ```\n  \n\n\n**Interaction**\n- If `enableAnalytics` is `false`, everything is off regardless of component toggles.\n- If `enableAnalytics` is `true`/`null`, the consent banner is shown (see below). After consent:\n  - PostHog runs only if `enablePosthog` is `true`/`null` **and** the user consented.\n  - Scarf runs only if `enableScarf` is `true`/`null` **and** the user consented.\n\n### 3) Cookie consent banner\n\nWhen analytics are allowed globally (`system.enableAnalytics: true` or resolved via the first‑run admin choice), users see a cookie consent banner on their first visit. Users can:\n\n- **Accept all** → enables PostHog (if `enablePosthog` is `true`/`null`) and Scarf (if `enableScarf` is `true`/`null`)\n- **Accept only necessary** → disables PostHog and Scarf\n- **Customize** → granular selection where applicable\n\n**User control details**\n- Users can change preferences at any time.\n- Consent choices are stored locally in the user's browser.\n- PostHog and Scarf respect the consent decision immediately.\n- No tracking occurs until explicit consent is given.\n\n---\n\n## Complete analytics disable (shortcut)\n\nIf you want to disable **all** analytics and telemetry (and suppress any consent prompts) at once:\n\n\n  \n    ```yaml\n    system:\n      enableAnalytics: false\n    ```\n  \n  \n    ```bash\n    SYSTEM_ENABLEANALYTICS=false\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        environment:\n          SYSTEM_ENABLEANALYTICS: false\n    ```\n  \n\n\n---\n\n## Privacy and Data Security\n\n### Data retention\n- PostHog data is retained according to PostHog’s configured retention policies.\n- Scarf pixel data is aggregated and anonymized.\n- No personal documents or content are ever transmitted.\n\n### GDPR alignment\n- PostHog servers are located in the EU.\n- Cookie consent is required before tracking.\n- Users can opt out at any time.\n- No cross‑site tracking or fingerprinting.\n- Text and element masking helps prevent accidental PII collection.\n\n### Transparency\n- All analytics‑related code is open source and visible in the repository.\n- Analytics can be completely disabled with simple configuration changes.\n- Users have full control over their data via cookie preferences (when analytics are allowed globally).\n\n---\n\n## For Self‑Hosted Instances\n\nIf you're running Stirling‑PDF on your own infrastructure:\n\n1. **Private networks**: Analytics from self‑hosted instances help us understand deployment patterns but don't expose your internal network.\n2. **Air‑gapped environments**: Disable analytics; the application works perfectly without external connections.\n3. **Corporate environments**: Disable analytics if your security policy requires it, or allow it to help improve the product.\n\n---\n\n## Support\n\nIf you have questions or concerns about analytics:\n\n- Check our [Privacy Policy](https://www.stirling.com/privacy-policy)\n- Review the [source code](https://github.com/Stirling-Tools/Stirling-PDF)\n- Ask questions on [Discord](https://discord.gg/HYmhKj45pU)\n- Open an issue on [GitHub](https://github.com/Stirling-Tools/Stirling-PDF/issues)",
+      "sourcePath": "docs/Analytics-and-telemetry.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Analytics-and-telemetry.md"
+    },
+    "configuration/audit-logging": {
+      "id": "configuration/audit-logging",
+      "title": "Audit Logging",
+      "section": "configuration",
+      "markdown": "> **Tier**: Enterprise\n\nLogs every operation, who ran it, what tool, which files, when. All data is stored in the database.\nWe recommend external database setup when using this feature due to the potential volume.\nPlease note the data stored is customisable based on you and your organisations needs and legal requirements.\n\n\nSettings are under `premium.enterpriseFeatures.audit`.\n\n| Setting | Default | Description |\n|---|---|---|\n| `enabled` | `true` | Turn audit logging on or off |\n| `level` | `2` | Verbosity: `0` = off, `1` = basic, `2` = standard, `3` = verbose |\n| `retentionDays` | `90` | Days to keep audit records before purging (`0` = infinite retention) |\n| `captureFileHash` | `false` | Store a SHA-256 hash of each processed file |\n| `capturePdfAuthor` | `false` | Extract and store PDF author metadata |\n| `captureOperationResults` | `false` | Store operation return values - high volume, use sparingly |\n\n## Audit levels\n\n| Level | What's recorded |\n|---|---|\n| `0` - OFF | Nothing |\n| `1` - BASIC | File modifications only - PDF operations (compress, split, merge, etc.) and settings changes |\n| `2` - STANDARD | BASIC + user actions (login/logout, account changes, general GET requests) |\n| `3` - VERBOSE | STANDARD + continuous polling calls and all GET requests |\n\n## Example\n\n\n  \n    ```yaml\n    premium:\n      enabled: true\n      key: your-enterprise-license-key\n      enterpriseFeatures:\n        audit:\n          enabled: true\n          level: 2\n          retentionDays: 365\n          captureFileHash: true\n          capturePdfAuthor: false\n          captureOperationResults: false\n    ```\n  \n  \n    ```bash\n    PREMIUM_ENABLED=true\n    PREMIUM_KEY=your-enterprise-license-key\n    PREMIUM_ENTERPRISEFEATURES_AUDIT_ENABLED=true\n    PREMIUM_ENTERPRISEFEATURES_AUDIT_LEVEL=2\n    PREMIUM_ENTERPRISEFEATURES_AUDIT_RETENTIONDAYS=365\n    PREMIUM_ENTERPRISEFEATURES_AUDIT_CAPTUREFILEHASH=true\n    PREMIUM_ENTERPRISEFEATURES_AUDIT_CAPTUREPDFAUTHOR=false\n    PREMIUM_ENTERPRISEFEATURES_AUDIT_CAPTUREOPERATIONRESULTS=false\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest\n        environment:\n          PREMIUM_ENABLED: true\n          PREMIUM_KEY: your-enterprise-license-key\n          PREMIUM_ENTERPRISEFEATURES_AUDIT_ENABLED: true\n          PREMIUM_ENTERPRISEFEATURES_AUDIT_LEVEL: 2\n          PREMIUM_ENTERPRISEFEATURES_AUDIT_RETENTIONDAYS: 365\n          PREMIUM_ENTERPRISEFEATURES_AUDIT_CAPTUREFILEHASH: true\n    ```\n  \n\n\n> **Note on performance:** `captureFileHash` adds a SHA-256 calculation for every file processed - noticeable overhead at high volume. `captureOperationResults` stores full operation output in the database and can grow very large; only enable it when specifically needed.",
+      "sourcePath": "docs/Configuration/Audit Logging.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Audit Logging.md"
+    },
+    "configuration/configuration": {
+      "id": "configuration/configuration",
+      "title": "Configuration Guide",
+      "description": "Configure Stirling PDF using environment variables, settings files, or in-app settings",
+      "section": "configuration",
+      "markdown": "Stirling PDF can be configured in three ways, depending on your deployment and preferences.\n\n## Configuration Methods\n\n### 1. In-App Settings (Recommended)\n\nIf you have login enabled, admins can configure everything through the Settings menu in the application.\n\n**To use:**\n1. Set `SECURITY_ENABLELOGIN=true`\n2. Log in as admin\n3. Go to Settings → configure through UI\n4. Changes apply immediately, no restart needed\n\n**Best for:** Production deployments with admin users\n\n---\n\n### 2. Environment Variables\n\nConfigure via Docker environment variables or system environment variables.\n\n**To use:**\n```bash\ndocker run -d \\\n  -e SECURITY_ENABLELOGIN=true \\\n  -e SYSTEM_DEFAULTLOCALE=en-US \\\n  stirlingtools/stirling-pdf:latest\n```\n\n**Best for:** Docker deployments, infrastructure-as-code, initial setup\n\n---\n\n### 3. Settings File (settings.yml)\n\nEdit `/configs/settings.yml` directly for advanced configuration.\n\n**To use:**\n```yaml\nsecurity:\n  enableLogin: true\nsystem:\n  defaultLocale: en-US\n```\n\n**Best for:** Complex configurations, when you prefer file-based config\n\n---\n\n## Common Settings\n\n### Authentication\n\n**Note:** Authentication and additional features are included by default in:\n- **Docker**: All images except ultra-lite (authentication is enabled by default)\n- **JAR**: [Stirling-PDF-with-login.jar](https://files.stirlingpdf.com/Stirling-PDF-with-login.jar) **(Recommended)**\n\nThe plain [Stirling-PDF.jar](https://files.stirlingpdf.com/Stirling-PDF.jar) does not include authentication or additional features.\n\nConfigure user login:\n\n\n  \n    ```yaml\n    security:\n      enableLogin: true\n      initialLogin:\n        username: admin\n        password: changeme123\n    ```\n  \n  \n    ```bash\n    SECURITY_ENABLELOGIN=true\n    SECURITY_INITIALLOGIN_USERNAME=admin\n    SECURITY_INITIALLOGIN_PASSWORD=changeme123\n    ```\n  \n\n\nDefault credentials: `admin` / `stirling` (change immediately after first login)\n\nFor more details, see [System and Security Configuration](doc:configuration/system-and-security).\n\n### Language & Localization\n\n\n  \n    ```yaml\n    ui:\n      languages: []        # Available languages (empty = all enabled), e.g. [\"en_US\", \"de_DE\"]\n    system:\n      defaultLocale: en-US # Default language for new users\n    ```\n  \n  \n    ```bash\n    UI_LANGUAGES=en_US,de_DE       # Restrict available languages (omit to enable all)\n    SYSTEM_DEFAULTLOCALE=en-US     # Default language\n    ```\n  \n\n\nLeaving `defaultLocale` empty (the default) auto-detects the language from the browser and falls back to `en-US` if no preference is found.\n\n**How language selection works:**\n\nStirling PDF determines the interface language using this priority order:\n\n1. **User's manual selection** (highest priority)\n   - When a user clicks the language globe icon and selects a language\n   - Choice is stored in browser's localStorage (persists across sessions)\n   - Storage key: `i18nextLng`\n\n2. **System default locale**\n   - Set via `SYSTEM_DEFAULTLOCALE` or `system.defaultLocale`\n   - When configured, it overrides the browser's detected language for users who have not made a manual selection\n\n3. **Browser's language preference**\n   - Automatically detected from the browser's language setting\n   - Example: Firefox set to Swedish (sv-SE) shows Swedish UI when no `defaultLocale` is configured\n\n4. **Fallback** (lowest priority)\n   - `en-US` is used when none of the above resolve to an available language\n\n**Example:**\n- Config: `SYSTEM_DEFAULTLOCALE=en-US`\n- Browser: Swedish (sv-SE)\n- Result: UI shows English (US) (the configured default overrides the browser preference)\n\nIf `defaultLocale` is left empty (the default), the browser-detected language is used instead. Users can always override either choice by manually selecting a language via the language globe icon.\n\n> **Tip**: Set `SYSTEM_DEFAULTLOCALE` to your organization's primary language. Users can always override it using the language selector in the top-right corner.\n\n### File Upload Limits\n\n\n  \n    ```yaml\n    system:\n      fileUploadLimit: \"500MB\"  # Number (0-999) followed by KB, MB, or GB. Empty = no limit\n    spring:\n      servlet:\n        multipart:\n          max-file-size: 2000MB\n          max-request-size: 2000MB\n    ```\n  \n  \n    ```bash\n    SYSTEM_MAXFILESIZE=500        # Size in MB (valid range 1-999)\n    SPRING_SERVLET_MULTIPART_MAX_FILE_SIZE=2000MB\n    SPRING_SERVLET_MULTIPART_MAX_REQUEST_SIZE=2000MB\n    ```\n  \n\n\n### Memory Management\n\n```bash\nJAVA_TOOL_OPTIONS=\"-Xms512m -Xmx4g\"  # Min 512MB, Max 4GB RAM\n```\n\n---\n\n## Specialized Configuration Guides\n\nFor advanced features and specific use cases, see these detailed guides:\n\n### Authentication & Security\n\n**[Single Sign-On (SSO)](doc:configuration/single-sign-on-configuration)**\n- OAuth2 (Google, GitHub, Keycloak, OIDC) - Server tier\n- SAML2 (Okta, Azure AD) - Enterprise tier\n- Complete configuration examples\n\n**[System and Security](doc:configuration/system-and-security)**\n- Server certificates\n- JWT configuration\n\n**[Fail2Ban Integration](doc:configuration/fail2ban)**\n- Protect against brute-force attacks\n- Auto-ban after failed login attempts\n\n---\n\n### Features & Customization\n\n**[UI Customization](doc:configuration/ui-customisation)**\n- Branding and logos\n- Theme customization\n- Custom styling\n\n**[Endpoint/Feature Control](doc:configuration/endpoint-or-feature-customisation)**\n- Enable/disable specific tools\n- Control feature availability by user/role\n\n**[Pipeline (Automation)](doc:configuration/pipeline)**\n- Automated workflows\n- Folder scanning\n- Batch processing\n- Multi-step operations\n\n---\n\n### Integration & Storage\n\n**[External Database](doc:configuration/external-database)**\n- PostgreSQL configuration (Pro/Enterprise)\n- Database migration\n- Backup strategies\n\n**[Google Drive File Picker](doc:configuration/google-drive-file-picker)**\n- Direct Google Drive integration\n- OAuth setup\n\n**[MCP Server](doc:advanced-configuration/mcp-server)**\n- Expose Stirling PDF tools over the Model Context Protocol\n- OAuth2 or API-key authentication\n- Operation allow/deny lists\n\n**[S3 / Object Storage](doc:configuration/file-sharing-and-storage)**\n- Store uploads and job artifacts in S3-compatible object storage\n- Shared storage for multi-node deployments\n\n**[Telegram Bot](doc:configuration/telegram-bot)**\n- Run a Telegram bot that processes PDFs sent in chat\n\n**[OCR Configuration](doc:configuration/ocr)**\n- Tesseract language packs\n- OCR optimization\n\n**[Usage Monitoring](doc:configuration/usage-monitoring)**\n- Prometheus metrics (Pro/Enterprise)\n- Application monitoring\n- Performance tracking\n\n---\n\n### Performance & Scaling\n\n**[Performance Optimization & Sizing](doc:configuration/performance-optimization)**\n- Resource sizing, JVM tuning, memory model, and scaling guidance\n\n**[Process Limits](doc:configuration/process-limits)**\n- Session limits and timeouts for external tools\n\n**[LibreOffice Parallel Processing](doc:configuration/libreoffice-parallel-processing)**\n- Configure multiple LibreOffice instances for faster document conversion\n- Local UNO server pool and remote UNO server endpoints\n\n---\n\n### Diagnostics & Support\n\n**[Diagnostics & Reporting Issues](doc:configuration/diagnostics)**\n- Built-in diagnostics tool for Docker containers\n- How to report issues via GitHub, Discord, and email\n\n---\n\n### Other Configuration\n\n**[Folder Scanning](doc:configuration/folderscanning)**\n- Watch folders for automatic processing\n\n**[Custom Signature Files](doc:configuration/sign-with-custom-files)**\n- Pre-loaded signatures for quick signing\n\n**[Extra Settings](doc:configuration/extra-settings)**\n- Logging configuration\n- Server settings (port, SSL/TLS)\n- Advanced Spring Boot settings\n\n---\n\n## Configuration Priority\n\nWhen the same setting is defined in multiple places, this is the order of precedence (highest to lowest):\n\n1. **Environment Variables**\n2. **settings.yml / In-App Settings**\n3. **Default values**\n\n---\n\n## Environment Variable Format\n\nConvert YAML paths to environment variables:\n\n```yaml\n# settings.yml\nsecurity:\n  enableLogin: true\n```\n\nBecomes:\n```bash\nSECURITY_ENABLELOGIN=true\n```\n\n**Rules:**\n- Uppercase everything\n- Replace `.` with `_`\n- Nested properties become `PARENT_CHILD`\n\n---\n\n## Troubleshooting\n\n### Settings Not Applied\n\n1. Check configuration priority (env vars override settings.yml)\n2. Restart container after changing environment variables\n3. Check logs: `docker logs stirling-pdf | grep ERROR`\n4. Verify file permissions on `/configs` volume\n\n### Database Issues\n\nDefault database location: `/configs/stirling-pdf-DB-<schema-version>.mv.db` (the schema version is part of the filename, e.g. `/configs/stirling-pdf-DB-2.3.232.mv.db`).\n\nIf missing:\n- Ensure `/configs` volume is mounted\n- Check write permissions\n- Review startup logs\n\n---\n\n## Next Steps\n\n- **Production Deployment:** See [Production Deployment Guide](doc:server-admin-onboarding)\n- **API Usage:** See [API Documentation](doc:api)\n- **Tool Reference:** See [Functionality](doc:functionality/functionality)\n- **Troubleshooting:** See [Diagnostics & Reporting Issues](doc:configuration/diagnostics)",
+      "sourcePath": "docs/Configuration/Configuration.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Configuration.md"
+    },
+    "configuration/database": {
+      "id": "configuration/database",
+      "title": "Database Backups",
+      "section": "configuration",
+      "markdown": "> **Tier**: Server\n\n## Functionality Overview\n\nThe newly introduced feature enhances the application with robust database backup and import capabilities. This feature is designed to ensure data integrity and provide a straightforward way to manage database backups. Here's how it works:\n\n1. Automatic Backup Creation\n   - The system automatically creates a database backup every day at midnight. This ensures that there is always a recent backup available, minimizing the risk of data loss.\n2. Manual Backup Export\n   - Admin actions that modify the user database trigger a manual export of the database. This keeps the backup up-to-date with the latest changes and provides an extra layer of data security.\n3. Importing Database Backups\n   - Admin users can import a database backup either via the web interface or API endpoints. This allows for easy restoration of the database to a previous state in case of data corruption or other issues.\n   - The import process ensures that the database structure and data are correctly restored, maintaining the integrity of the application.\n4. Managing Backup Files\n   - Admins can view a list of all existing backup files, along with their creation dates and sizes. This helps in managing storage and identifying the most recent or relevant backups.\n   - Backup files can be downloaded for offline storage or transferred to other environments, providing flexibility in database management.\n   - Unnecessary backup files can be deleted through the interface to free up storage space and maintain an organized backup directory.\n\n## User Interface\n\n### Web Interface\n\n1. Upload SQL files to import database backups.\n2. View details of existing backups, such as file names, creation dates, and sizes.\n3. Download backup files for offline storage.\n4. Delete outdated or unnecessary backup files.\n\n### API Endpoints\n\n1. Import database backups by uploading SQL files.\n2. Download backup files.\n3. Delete backup files.\n\nThis new functionality streamlines database management, ensuring that backups are always available and easy to manage, thus improving the reliability and resilience of the application.",
+      "sourcePath": "docs/Configuration/DATABASE.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/DATABASE.md"
+    },
+    "configuration/diagnostics": {
+      "id": "configuration/diagnostics",
+      "title": "Diagnostics & Reporting Issues",
+      "description": "Use the built-in diagnostics tool and learn how to report issues effectively",
+      "section": "configuration",
+      "markdown": "Stirling PDF includes a built-in diagnostics tool inside Docker containers that collects logs, configuration, system information, and application metrics into a single archive. This is the fastest way to gather the information needed when troubleshooting or reporting issues.\n\n---\n\n## Running the Diagnostics Tool\n\nOpen an interactive shell inside the running container and invoke the tool:\n\n```bash\ndocker exec -it <container_name> diag\n```\n\nThe following aliases all work identically: `diag`, `debug`, `diagnostic`, `diagnostics`, `stirling-diagnostics`.\n\n> **⚠️ Caution: Interactive Terminal Required**\n>\n> The diagnostics tool requires an interactive terminal (`-it` flag). It will not run in non-interactive or headless sessions.\n\n\n---\n\n## Collection Modes\n\nWhen you run the tool, you'll be prompted to choose a collection mode.\n\n### Auto Mode (Recommended)\n\nSelect option **1** when prompted. Auto mode collects:\n\n- Application logs from the last 24 hours\n- Configuration files from `/configs`\n- System information (OS, CPU, memory, disk, Java version)\n- Application metrics and health endpoints\n\nThis is sufficient for most issue reports.\n\n### Custom Mode\n\nSelect option **2** for granular control over what gets collected:\n\n| Prompt | Default | What It Collects |\n|---|---|---|\n| Output directory | `/configs` | Where to save the archive |\n| Days of logs | 1 | How many days of logs to include |\n| Include /configs | Yes | Configuration files |\n| Include /customFiles | No | Custom files (excluding PDFs and images) |\n| Include /pipeline | No | Pipeline working files (excluding PDFs) |\n| Include /tmp/stirling-pdf | No | Temporary processing files |\n| Include system information | Yes | OS, CPU, RAM, disk, Java/Python versions |\n| Include environment variables | No | Full environment dump |\n| Fetch metrics endpoints | Yes | Application status, health, and load data |\n| Include UI data endpoints | No | Sign, pipeline, and OCR endpoint data |\n| Redact sensitive information | Yes | Apply redaction filters (see below) |\n\n### Redaction Options\n\nWhen redaction is enabled, you can selectively mask:\n\n- **Secrets/tokens/passwords** - Redacts Authorization headers, API keys, passwords, and similar credentials\n- **URL hosts/domains** - Masks hostnames in URLs\n- **Email addresses** - Replaces email addresses with `[REDACTED_EMAIL]`\n- **Host/Domain/Server fields** - Masks values in host-related configuration fields\n\n> **⚠️ Caution**\n>\n> Always enable redaction if you plan to share the diagnostics bundle publicly (for example, in a GitHub issue). However, redaction is not perfect and may miss some sensitive values - always review the output manually before sharing publicly. You can disable redaction for private support channels if full detail is needed.\n\n\n---\n\n## What Gets Collected\n\nThe diagnostics bundle is a `.tar.gz` archive saved to the output directory (default: `/configs`). It contains:\n\n```\nstirling-diagnostics-YYYYMMDD-HHMMSS.tar.gz\n├── summary.txt                  # Collection metadata and settings\n├── bundle/\n│   ├── logs/                    # Application log files\n│   ├── configs/                 # Configuration files (settings.yml, etc.)\n│   ├── system/                  # System information\n│   │   ├── uname.txt           # Kernel version\n│   │   ├── os-release          # OS distribution info\n│   │   ├── meminfo.txt         # Memory details\n│   │   ├── cpuinfo.txt         # CPU details\n│   │   ├── df.txt              # Disk usage\n│   │   ├── free.txt            # Memory summary\n│   │   ├── ps.txt              # Running processes\n│   │   ├── java-version.txt    # Java runtime version\n│   │   └── python-version.txt  # Python version\n│   ├── metrics/                 # Application metrics\n│   │   ├── api/v1/info/status.json\n│   │   ├── api/v1/info/uptime.json\n│   │   ├── api/v1/info/health.json\n│   │   ├── api/v1/info/requests.json\n│   │   ├── api/v1/info/load.json\n│   │   ├── actuator/health.json\n│   │   └── actuator/prometheus.txt\n│   ├── env/                     # Environment variables (if requested)\n│   └── tree/                    # Directory listings\n│       ├── logs.txt\n│       ├── configs.txt\n│       ├── customFiles.txt\n│       ├── pipeline.txt\n│       ├── tessdata.txt         # Installed OCR language packs\n│       └── tessdata-mount.txt\n```\n\nPDFs, images, and compressed archives are always excluded from collection.\n\n### Retrieving the Bundle\n\nAfter the tool finishes, copy the archive out of the container:\n\n```bash\ndocker cp <container_name>:/configs/stirling-diagnostics-*.tar.gz ./\n```\n\n---\n\n## AOT Diagnostics\n\nIf you are running with AOT (Ahead-of-Time) compilation enabled (`STIRLING_AOT_ENABLE=true`), an additional diagnostics tool is available:\n\n```bash\ndocker exec -it <container_name> aot-diag\n```\n\nThis tool diagnoses AOT cache generation failures, particularly on ARM64/aarch64 platforms. It checks cache integrity, JVM compatibility, and can run smoke tests.\n\nAliases: `aot-diag`, `aot-diagnostics`\n\n---\n\n## How to Report Issues\n\nWhen you encounter a problem with Stirling PDF, choose the right channel depending on the nature of your issue.\n\n### GitHub Issues - Bug Reports & Feature Requests\n\nFor reproducible bugs and feature requests, open an issue at:\n**https://github.com/Stirling-Tools/Stirling-PDF/issues**\n\nThe repository includes issue templates for bug reports and feature requests that will guide you through providing the right information.\n\nWhen submitting a bug report, include as much detail as possible: the diagnostics bundle (run `diag` in your container first), steps to reproduce the issue, expected vs. actual behavior, your deployment method (Docker, bare metal, Kubernetes), Stirling PDF version (visible in the UI footer or in `summary.txt` from the diagnostics bundle), and any commands, API requests, or actions you were performing when the issue occurred. The more context you provide, the faster it can be resolved.\n\n### Discord Community - Questions & Discussion\n\nFor quick questions, troubleshooting help, and community discussion:\n**https://discord.gg/HYmhKj45pU**\n\nDiscord is the best place for configuration help, setup questions, sharing workarounds with other users, general discussion about features and usage, and getting faster informal feedback before filing a formal issue. It's also great for following up on GitHub issues and having deeper conversations with the community.\n\n### Email Support\n\nFor enterprise customers and licensing inquiries:\n**support@stirlingpdf.com**\n\nFor security vulnerabilities:\n**security@stirlingpdf.com** or use the [GitHub Security Advisory](https://github.com/Stirling-Tools/Stirling-PDF/security) process.",
+      "sourcePath": "docs/Configuration/Diagnostics.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Diagnostics.md"
+    },
+    "configuration/endpoint-or-feature-customisation": {
+      "id": "configuration/endpoint-or-feature-customisation",
+      "title": "Endpoints Customisation",
+      "section": "configuration",
+      "markdown": "You can selectively disable and remove endpoints and functionalities from Stirling PDF as per your requirements.\nThere are many use-cases for this such as\n- Avoid confusion for users for functionality you/your business don't use.\n- Running a reduced version of Stirling PDF that doesn't have the necessary server power to support the more advanced features.\n- Cleanup interface for features you don't use\n\nYou have two ways to disable endpoints:\n\n1. **Environment Variables** (`ENDPOINTS_TOREMOVE` and `ENDPOINTS_GROUPSTOREMOVE`):\n   - Example: `ENDPOINTS_TOREMOVE=merge-pdfs,remove-pages` disables merge and remove page tools\n   - Example: `ENDPOINTS_GROUPSTOREMOVE=LibreOffice` disables all LibreOffice-dependent tools\n\n2. **Settings File** (`settings.yml` under `endpoints.toRemove` and `endpoints.groupsToRemove`):\n   - Example: `toRemove: [merge-pdfs, remove-pages]`\n   - Example: `groupsToRemove: [LibreOffice]`\n\n## Available Endpoint Groups\n\nYou can disable entire groups of related endpoints using `ENDPOINTS_GROUPSTOREMOVE`:\n\n| Group Name | What It Disables | Example |\n|------------|------------------|---------|\n| `LibreOffice` | All office document conversions (DOCX, XLSX, PPTX to/from PDF) | `ENDPOINTS_GROUPSTOREMOVE=LibreOffice` |\n| `Python` | Python-backed features (scan extraction and some file/HTML/URL conversions) | `ENDPOINTS_GROUPSTOREMOVE=Python` |\n| `OpenCV` | Advanced image processing operations | `ENDPOINTS_GROUPSTOREMOVE=OpenCV` |\n| `OCRmyPDF` | OCR (Optical Character Recognition) features | `ENDPOINTS_GROUPSTOREMOVE=OCRmyPDF` |\n| `Weasyprint` | HTML to PDF conversion | `ENDPOINTS_GROUPSTOREMOVE=Weasyprint` |\n| `Calibre` | E-book format conversions | `ENDPOINTS_GROUPSTOREMOVE=Calibre` |\n| `qpdf` | Various PDF operations powered by QPDF | `ENDPOINTS_GROUPSTOREMOVE=qpdf` |\n| `Ghostscript` | Compression, repair and related operations powered by Ghostscript | `ENDPOINTS_GROUPSTOREMOVE=Ghostscript` |\n| `Automation` | Automation/pipeline endpoints (`handleData`, `automate`, `pipeline`) | `ENDPOINTS_GROUPSTOREMOVE=Automation` |\n| `DeveloperTools` | Developer tools such as Show JavaScript | `ENDPOINTS_GROUPSTOREMOVE=DeveloperTools` |\n| `DeveloperDocs` | In-app developer doc links (API docs, folder scanning, SSO, air-gapped) | `ENDPOINTS_GROUPSTOREMOVE=DeveloperDocs` |\n\n**Example - Disable multiple groups:**\n```bash\nENDPOINTS_GROUPSTOREMOVE=LibreOffice,Calibre,Weasyprint\n```\n\n## Usage Examples\n\n### Environment Variables\n\n**Disable specific tools:**\n```bash\n# Docker Run\ndocker run -e ENDPOINTS_TOREMOVE=sign,add-watermark,add-stamp stirlingtools/stirling-pdf:latest\n\n# Docker Compose\nenvironment:\n  - ENDPOINTS_TOREMOVE=sign,add-watermark,add-stamp\n```\n\n**Disable entire groups:**\n```bash\n# Disable all office conversions and OCR\nENDPOINTS_GROUPSTOREMOVE=LibreOffice,OCRmyPDF\n```\n\n**Combine both methods:**\n```bash\n# Disable groups AND specific tools\nENDPOINTS_GROUPSTOREMOVE=LibreOffice,Calibre\nENDPOINTS_TOREMOVE=sign,compare,multi-tool\n```\n\n### Settings File (settings.yml)\n\nIf you're editing `settings.yml` directly, use the kebab-case endpoint IDs:\n\n**Disable specific tools:**\n```yaml\nendpoints:\n  toRemove:\n    - sign\n    - add-watermark\n    - add-stamp\n    - compare\n    - merge-pdfs\n```\n\n**Disable entire groups:**\n```yaml\nendpoints:\n  groupsToRemove:\n    - LibreOffice\n    - OCRmyPDF\n```\n\n**Combine both methods:**\n```yaml\nendpoints:\n  toRemove:\n    - sign\n    - compare\n    - multi-tool\n    - merge-pdfs\n  groupsToRemove:\n    - LibreOffice\n    - Calibre\n```\n\n## Complete Endpoint Reference for settings.yml\n\nUse these exact kebab-case IDs with `endpoints.toRemove` in settings.yml.\n\n### Page Operations\n- `merge-pdfs` - Merge PDFs\n- `split-pages` - Split PDFs\n- `extract-pages` - Extract Pages\n- `remove-pages` - Remove Pages\n- `rearrange-pages` - Rearrange Pages\n- `rotate-pdf` - Rotate PDFs\n- `crop` - Crop Pages\n- `scale-pages` - Scale Pages\n- `add-page-numbers` - Add Page Numbers\n- `pdf-to-single-page` - PDF to Single Page\n- `multi-page-layout` - Multi-Page Layout\n- `booklet-imposition` - Booklet Imposition\n- `overlay-pdf` - Overlay PDFs\n- `split-pdf-by-sections` - Split by Sections\n- `split-pdf-by-chapters` - Split by Chapters\n- `auto-split-pdf` - Auto Split PDF\n- `split-by-size-or-count` - Split by Size/Count\n- `add-attachments` - Add Attachments\n\n### Conversion\n- `pdf-to-img` - PDF to Image\n- `img-to-pdf` - Image to PDF\n- `file-to-pdf` - File to PDF\n- `pdf-to-word` - PDF to Word\n- `pdf-to-presentation` - PDF to Presentation\n- `pdf-to-text` - PDF to Text\n- `pdf-to-html` - PDF to HTML\n- `pdf-to-xml` - PDF to XML\n- `pdf-to-markdown` - PDF to Markdown\n- `pdf-to-csv` - PDF to CSV\n- `pdf-to-epub` - PDF to EPUB\n- `pdf-to-vector` - PDF to Vector\n- `pdf-to-json` - PDF to JSON\n- `pdf-to-rtf` - PDF to RTF\n- `pdf-to-cbz` - PDF to CBZ\n- `pdf-to-cbr` - PDF to CBR\n- `pdf-to-pdfa` - PDF to PDF/A\n- `html-to-pdf` - HTML to PDF\n- `url-to-pdf` - URL to PDF\n- `markdown-to-pdf` - Markdown to PDF\n- `eml-to-pdf` - Email to PDF\n- `cbz-to-pdf` - CBZ to PDF\n- `json-to-pdf` - JSON to PDF\n- `vector-to-pdf` - Vector to PDF\n\n### Security & Signing\n- `add-password` - Add Password Protection\n- `remove-password` - Remove Password\n- `change-permissions` - Change Permissions\n- `add-watermark` - Add Watermark\n- `add-stamp` - Add Stamp\n- `sanitize-pdf` - Sanitize PDF\n- `flatten` - Flatten Form Fields\n- `unlock-pdf-forms` - Unlock PDF Forms\n- `cert-sign` - Certificate Sign\n- `sign` - Draw/Text/Image Signature\n- `timestamp-pdf` - Add Trusted Timestamp\n- `remove-cert-sign` - Remove Certificate Signature\n- `validate-signature` - Validate Signature\n- `verify-pdf` - Verify PDF\n- `redact` - Redact Information\n- `auto-redact` - Auto Redact\n\n### Content Extraction & Removal\n- `extract-images` - Extract Images\n- `extract-image-scans` - Extract Image Scans\n- `remove-image-pdf` - Remove Images\n- `remove-annotations` - Remove Annotations\n- `remove-blanks` - Remove Blank Pages\n- `ocr-pdf` - OCR\n\n### Document Editing & Analysis\n- `text-editor-pdf` - Text Editor\n- `edit-table-of-contents` - Edit Table of Contents\n- `update-metadata` - Change Metadata\n- `get-info-on-pdf` - Get PDF Info\n- `compare` - Compare PDFs\n- `adjust-contrast` - Adjust Contrast\n- `replace-invert-pdf` - Replace/Invert Colors\n- `scanner-effect` - Scanner Effect\n- `repair` - Repair PDF\n- `add-image` - Add Image to PDF\n\n### Form Fields\n- `fields` - Form Fields\n- `fill` - Fill Form Fields\n- `modify-fields` - Modify Form Fields\n- `delete-fields` - Delete Form Fields\n\n### Multi-Tool & Automation\n- `multi-tool` - Multi-Tool Workbench\n- `compare` - Compare PDFs\n- `compress-pdf` - Compress PDFs\n- `automate` - Automation/Pipeline\n- `pipeline` - Pipeline\n- `auto-rename` - Auto Rename\n\n### Viewing & Display\n- `view-pdf` - PDF Viewer\n- `show-javascript` - Show JavaScript in PDF\n\n### Developer Tools\n- `dev-api-docs` - API Documentation\n- `dev-folder-scanning-docs` - Folder Scanning Guide\n- `dev-sso-guide-docs` - SSO Guide\n- `dev-airgapped-docs` - Air-gapped Setup Guide\n\n### Internal\n- `handleData` - Handle Data\n\n## Notes\n\n- Tool IDs are case-sensitive (use exact names from the reference above)\n- Group IDs are also case-sensitive - note the lowercase `qpdf`\n- Disabling a tool removes it completely from the UI and API\n- Some tools may depend on others - test your configuration\n- Changes require container restart to take effect\n- The [MCP server](doc:advanced-configuration/mcp-server) applies its own allow/deny filtering on top of these removals, so an endpoint can be enabled here yet still be hidden from MCP clients",
+      "sourcePath": "docs/Configuration/Endpoint or Feature Customisation.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Endpoint or Feature Customisation.md"
+    },
+    "configuration/external-database": {
+      "id": "configuration/external-database",
+      "title": "External Database",
+      "section": "configuration",
+      "markdown": "## Using an External Database\n> **Tier**: Server\n\nIt is possible to use your own external database with Stirling PDF rather than the default H2 database if you wish.\nPostgreSQL is currently the only supported variant, others will be added on request.\n\n### Setting Up External Database Configuration\nYou can configure the new `Datasource` property in your `settings.yml` to connect to your external database:\n\n> #### ⚠️ Note\n> _To use the external database feature, you will need to have a valid enterprise license and set the environment variable `DISABLE_ADDITIONAL_FEATURES` to `false`._\n\n\n  \n\n```yaml\n  datasource:\n    enableCustomDatabase: false\n    customDatabaseUrl: jdbc:postgresql://localhost:5432/postgres\n    username: postgres\n    password: postgres\n    type: postgresql\n    hostName: localhost\n    port: 5432\n    name: postgres\n```\n\n- `enableCustomDatabase`: Set this property to `true` to enable use of the custom database **Note: An enterprise license to use this feature**\n- `customDatabaseUrl`: Enter the database connection url for the database here. **Note: If you set the `customDatabaseUrl` you do not need to set the type, hostName, port and name, they will all be automatically derived from the url.**\n- `username`: The username for the database\n- `password`: The password for the database\n\nIf you would like more fine-grained control of the database connection, you can also use the following properties:\n\n#### Fine-grained Database Configuration\n- `type`: The database type. Available options are `h2` and `postgresql`\n- `hostName`: The host name of the database connection url (e.g. 'localhost')\n- `port`: The port number of the database connection url (e.g. 8080)\n- `name`: The name of the custom database. This should match the name you have set for your database\n\n\n  \n\n```yaml\nservices:\n  db:\n    image: 'postgres:17.2-alpine'\n    container_name: db\n    ports:\n      - \"5432:5432\"\n    environment:\n      POSTGRES_DB: \"stirling_pdf\"\n      POSTGRES_USER: \"admin\"\n      POSTGRES_PASSWORD: \"stirling\"\n```\n\n- `container_name`: This is the name of your database container. This should match the name of the container under `services` as this is what Docker will use to refer to your database\n- `ports`: Specify the port number for your database. The number on the left is the port number the container will access the database internally. The number on the right is the port number the Stirling PDF app will use to connect to the database externally. Ensure this matches the port number in the connection url for your database otherwise the app will not be able to access it.\n- `POSTGRES_DB`: An environment variable for the database container. Specify the name of the custom database here\n- `POSTGRES_USER`: An environment variable for the database container. Specify the username for the database\n- `POSTGRES_PASSWORD`: An environment variable for the database container. Specify the password for the database\n\nYou will also need to update the Docker configuration in your app in order to connect to the database:\n\n```yaml\nservices:\n  stirling-pdf:\n    depends_on:\n      - db\n    environment:\n      DISABLE_ADDITIONAL_FEATURES: \"false\" \"true\"\n      SYSTEM_DATASOURCE_ENABLECUSTOMDATABASE: \"true\"\n      SYSTEM_DATASOURCE_CUSTOMDATABASEURL: \"jdbc:postgresql://db:5432/stirling_pdf\"\n      SYSTEM_DATASOURCE_USERNAME: \"admin\"\n      SYSTEM_DATASOURCE_PASSWORD: \"stirling\"\n    # further configuration\n```\n\n- `depends_on`: This specifies any services that your app will need in order to run. Ensure the name matches the container name for your database\n- `DISABLE_ADDITIONAL_FEATURES`: Set this to `false` to enable security features\n- `SYSTEM_DATASOURCE_ENABLECUSTOMDATABASE`: An environment variable to connect to the database container. Set this to `true` to enable use of the external database\n- `SYSTEM_DATASOURCE_CUSTOMDATABASEURL`: An environment variable to connect to the database container. Set the connection url for the database here. **Note: If you set this url you do not need to set the type, hostName, port and name (namely `SYSTEM_DATASOURCE_TYPE`, `SYSTEM_DATASOURCE_HOSTNAME`, `SYSTEM_DATASOURCE_PORT`, `SYSTEM_DATASOURCE_NAME`), they will all be automatically derived from the url.**\n- `SYSTEM_DATASOURCE_USERNAME`: An environment variable to connect to the database container. Set the username for the database. Ensure this matches the corresponding property in your database container\n- `SYSTEM_DATASOURCE_PASSWORD`: An environment variable to connect to the database container. Set the password for the database. Ensure this matches the corresponding property in your database container\n\nBelow is an example of what your configuration should look like after configuring the custom database:\n\n```yaml\nservices:\n  stirling-pdf:\n    depends_on:\n      - db\n    environment:\n      DISABLE_ADDITIONAL_FEATURES: \"false\" \"true\"\n      SYSTEM_DATASOURCE_ENABLECUSTOMDATABASE: \"true\"\n      SYSTEM_DATASOURCE_CUSTOMDATABASEURL: \"jdbc:postgresql://db:5432/stirling_pdf\"\n      SYSTEM_DATASOURCE_USERNAME: \"admin\"\n      SYSTEM_DATASOURCE_PASSWORD: \"stirling\"\n    # further configuration\n\n  db:\n    image: 'postgres:17.2-alpine'\n    container_name: db\n    ports:\n      - \"5432:5432\"\n    environment:\n      POSTGRES_DB: \"stirling_pdf\"\n      POSTGRES_USER: \"admin\"\n      POSTGRES_PASSWORD: \"stirling\"\n```\n\n  \n\n\n*Example configuration can be found in [exampleYmlFiles/docker-compose-latest-fat-security-postgres.yml](https://github.com/Stirling-Tools/Stirling-PDF/blob/428b4238e3a7280d71697d994a66174a250387a7/exampleYmlFiles/docker-compose-latest-fat-security-postgres.yml)*",
+      "sourcePath": "docs/Configuration/External Database.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/External Database.md"
+    },
+    "configuration/extra-settings": {
+      "id": "configuration/extra-settings",
+      "title": "Custom Settings Configuration",
+      "section": "configuration",
+      "markdown": "Stirling PDF provides a `/configs/custom_settings.yml` file where users can configure additional settings beyond the standard configuration. This file follows standard YAML format and supports Spring Boot application properties, allowing you to customize the application without modifying core files.\n\n## Logging Configuration\n\nControl the verbosity of logs by adjusting log levels for different components:\n\n```yaml\nlogging:\n  level:\n    root: INFO\n    org.springframework: WARN\n    org.hibernate: WARN\n    org.eclipse.jetty: WARN\n    stirling.software.SPDF: INFO\n    # Enable debug logging for specific components when troubleshooting\n    # org.springframework.security.saml2: TRACE\n    # org.springframework.security: DEBUG\n    # org.opensaml: DEBUG\n```\n\n## Server Configuration\n\nConfigure server behavior including port, address binding, and session timeout:\n\n```yaml\nserver:\n  port: 8080  # Default port\n  address: 0.0.0.0  # Bind to all interfaces\n  servlet:\n    context-path: /  # Application context path\n    session:\n      timeout: 30m  # Session timeout\n  jetty:\n    threads:\n      max: 200  # Maximum number of request processing threads\n      min: 10   # Minimum number of threads always kept running\n    connection-idle-timeout: 30000  # Connection idle timeout in milliseconds\n    max-http-request-header-size: 65536  # Maximum size of request headers in bytes\n```\n\n### HTTP 431 \"Request Header Fields Too Large\" during SSO/OAuth login\n\nSome SSO/OAuth providers send very large request headers (for example, large cookies or JWTs), which can trigger an **HTTP 431 Request Header Fields Too Large** error during login. Stirling PDF's default limit is `32768` (32 KB); raise it to resolve the error.\n\n\n  \n    ```yaml\n    server:\n      jetty:\n        max-http-request-header-size: 65536  # bytes (Stirling default: 32768)\n    ```\n  \n  \n    ```yaml\n    environment:\n      SERVER_JETTY_MAX_HTTP_REQUEST_HEADER_SIZE: \"65536\"\n    ```\n  \n  \n    ```bash\n    docker run -d \\\n      -p 8080:8080 \\\n      -e SERVER_JETTY_MAX_HTTP_REQUEST_HEADER_SIZE=65536 \\\n      stirlingtools/stirling-pdf:latest\n    ```\n  \n\n\nRaise the value further (for example `131072`) if the error persists, then restart Stirling PDF.\n\n## SSL/TLS Configuration\n\nConfigure HTTPS for secure connections:\n\n\n  \n    ```yaml\n    server:\n      port: 8443  # Standard HTTPS port\n      ssl:\n        enabled: true\n        key-store: classpath:keystore.p12  # Path to keystore file\n        key-store-password: your-keystore-password\n        key-store-type: PKCS12  # Type of keystore\n        key-alias: tomcat  # Alias of the certificate\n    ```\n  \n  \n    ```bash\n    SERVER_PORT=8443\n    SERVER_SSL_ENABLED=true\n    SERVER_SSL_KEY-STORE=classpath:keystore.p12\n    SERVER_SSL_KEY-STORE-PASSWORD=your-keystore-password\n    SERVER_SSL_KEY-STORE-TYPE=PKCS12\n    SERVER_SSL_KEY-ALIAS=tomcat\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        image: stirlingtools/stirling-pdf:latest\n        environment:\n          SERVER_PORT: 8443\n          SERVER_SSL_ENABLED: true\n          SERVER_SSL_KEY-STORE: classpath:keystore.p12\n          SERVER_SSL_KEY-STORE-PASSWORD: your-keystore-password\n          SERVER_SSL_KEY-STORE-TYPE: PKCS12\n          SERVER_SSL_KEY-ALIAS: tomcat\n    ```\n  \n\n\n### Creating a Self-Signed Certificate\n\nTo generate a self-signed certificate for development or testing:\n\n```shell\nkeytool -genkeypair -alias tomcat -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore keystore.p12 -validity 365\n```\n\n> #### ⚠️ Note\n> _For production use, it's recommended to use a certificate from a trusted Certificate Authority._\n\n## Configuration Examples\n\n### Basic Configuration\n\nA simple configuration that changes the port and adjusts logging levels:\n\n```yaml\n# custom_settings.yml\nserver:\n  port: 9000\n\nlogging:\n  level:\n    root: INFO\n    org.springframework: WARN\n    org.hibernate: WARN\n    stirling.software.SPDF: INFO\n```\n\n### HTTPS Configuration\n\nEnable HTTPS with a custom certificate:\n\n```yaml\n# custom_settings.yml\nserver:\n  port: 8443\n  ssl:\n    enabled: true\n    key-store: classpath:keystore.p12\n    key-store-password: your-keystore-password\n    key-store-type: PKCS12\n    key-alias: tomcat\n\nlogging:\n  level:\n    root: INFO\n    org.springframework: WARN\n```\n\n## Troubleshooting Common Issues\n\n### Authentication Issues\n\nIncrease security logging to diagnose authentication problems:\n\n```yaml\nlogging:\n  level:\n    org.springframework.security: DEBUG\n    stirling.software.SPDF.config.security: DEBUG\n```\n\n### SAML/OAuth Issues\n\nIncrease SAML-related logging for SSO troubleshooting:\n\n```yaml\nlogging:\n  level:\n    org.springframework.security.saml2: TRACE\n    org.springframework.security.oauth2: DEBUG\n    org.opensaml: DEBUG\n```\n\n### General Application Issues\n\nFor general application issues:\n\n```yaml\nlogging:\n  level:\n    stirling.software.SPDF: DEBUG\n```\n\n> #### ⚠️ Note\n> _Debug-level logging can significantly increase log volume and may impact performance in production environments. Return logging to normal levels after troubleshooting._",
+      "sourcePath": "docs/Configuration/Extra-Settings.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Extra-Settings.md"
+    },
+    "configuration/fail2ban": {
+      "id": "configuration/fail2ban",
+      "title": "Fail2Ban Integration",
+      "section": "configuration",
+      "markdown": "## Fail2Ban Setup for Stirling PDF\nThis document provides instructions on how to set up Fail2Ban with Stirling PDF to protect against unauthorized login attempts. (Note Stirling PDF blocks IPs after a set retry count regardless of Fail2Ban, This configuration is only useful for users specifically wanting Fail2Ban configuration)\n\n## How does Fail2Ban Work with Stirling PDF\nStirling PDF logs failed authentication attempts to a log file which Fail2Ban monitors. When it detects multiple failed login attempts from the same IP address, Fail2Ban automatically blocks that IP address for a configured period of time.\n\n\n## Prerequisites\n- Fail2Ban installed on your system\n- Access to Stirling PDF log directory\n- Security settings configured:\n\n\n  \n    ```yaml\n    security:\n      enableLogin: true    # Login must be enabled for Fail2Ban integration\n      loginAttemptCount: -1 # Set to -1 when using Fail2Ban recommended but not required\n    ```\n  \n  \n    ```bash\n    SECURITY_ENABLELOGIN=true\n    SECURITY_LOGINATTEMPTCOUNT=-1\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        environment:\n          SECURITY_ENABLELOGIN: true\n          SECURITY_LOGINATTEMPTCOUNT: -1\n    ```\n  \n\n\n### Important Configuration Notes\n- The `enableLogin` setting must be set to `true` as Fail2Ban integration requires authentication to be active\n- When using Fail2Ban, set `loginAttemptCount` to `-1` to disable the built-in account locking mechanism and let Fail2Ban handle login attempt management\n- For more details on security configuration options, refer to the [System and Security](doc:configuration/system-and-security) documentation\n\n## Configuration\n\n### Log File Location\nThe log file location containing the failed authentication messages depends on your installation type:\n\n- **Default/Docker Installation**: ``./logs/invalid-auths.log``\n- **Windows Desktop**: ``%APPDATA%\\Stirling-PDF\\logs\\invalid-auths.log``\n- **MacOS Desktop**: ``~/Library/Application Support/Stirling-PDF/logs/invalid-auths.log``\n- **Linux Desktop**: ``~/.config/Stirling-PDF/logs/invalid-auths.log``\n\n###  Example Fail2Ban Filter\n`/etc/fail2ban/filter.d/stirling-pdf.conf`\n```ini\n[Definition]\nfailregex = Failed login attempt from IP: \n```\n\n### Example Jail Configuration\n`/etc/fail2ban/jail.local`\n```ini\n[stirling-pdf]\nenabled = true\nfilter = stirling-pdf\nlogpath = /logs/invalid-auths.log\nmaxretry = 5\nfindtime = 300\nbantime = 3600\n```\n\nConfiguration parameters:\n- `maxretry`: Number of failed attempts before ban (default: 5)\n- `findtime`: Time window for failed attempts in seconds (default: 300 seconds / 5 minutes)\n- `bantime`: Duration of the ban in seconds (default: 3600 seconds / 1 hour)\n\n\n### Ensure access to Logs path\n\n  \n    Modify your `docker-compose.yml` to expose the log directory:\n    ```yaml\n    services:\n      stirling-pdf:\n        volumes:\n          - ./logs:/logs\n    ```\n  \n  \n    Add the volume mount to your Docker run command:\n    ```bash\n    -v ./logs:/logs\n    ```",
+      "sourcePath": "docs/Configuration/Fail2Ban.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Fail2Ban.md"
+    },
+    "configuration/file-sharing-and-storage": {
+      "id": "configuration/file-sharing-and-storage",
+      "title": "File Sharing and Storage",
+      "description": "Configure server-side file storage, sharing, and storage quotas",
+      "section": "configuration",
+      "markdown": "> **⚠️ Warning: [Alpha Feature]**\n>\n> File Sharing and Storage is currently in **alpha**. Functionality may change, and some features are incomplete. Use in production at your own risk.\n\n\nStirling PDF can store files on the server and let users share them with each other. Files can be shared directly with specific users or via shareable links. Admins can set storage quotas to control disk usage.\n\nBasic local-disk storage and sharing need **no license** - just turn on `security.enableLogin` and `storage.enabled`. Only the **database** and **s3** storage providers require a Pro/Enterprise license. See [Modes](doc:modes-and-licensing) for what each deploy mode includes; self-hosted instances never use credits.\n\n> **💡 Tip: Already set up?**\n>\n> If your admin has turned storage on and you just want to use it, skip ahead to [The My Files Page](#the-my-files-page) and [Sharing Files](#sharing-files). The setup sections in between (storage providers, S3, quotas) are for whoever runs the server.\n\n\n---\n\n## What You Can Do\n\n- **Store files server-side** -- upload PDFs and other files that persist across sessions\n- **Share with specific users** -- grant other registered users access to your files with configurable permissions\n- **Share via link** -- generate a shareable link that any logged-in user with the link can access\n- **Control access levels** -- assign Editor, Commenter, or Viewer roles to shared users\n- **Set storage quotas** -- limit storage per user, per file, or system-wide\n- **Audit access** -- see who accessed your shared links and when\n- **Automatic cleanup** -- expired share links and orphaned files are cleaned up daily\n\n---\n\n## Prerequisites\n\n- **Authentication must be enabled** (`security.enableLogin: true`)\n- For share links: `system.frontendUrl` must be set to your instance URL\n- For email notifications when sharing: `mail.enabled: true` with valid SMTP configuration\n\n---\n\n## Enabling File Storage\n\n\n  \n    ```yaml\n    storage:\n      enabled: true\n      provider: local          # 'local', 'database', or 's3'\n      local:\n        basePath: './storage'  # Filesystem path (local provider only)\n    ```\n  \n  \n    ```bash\n    STORAGE_ENABLED=true\n    STORAGE_PROVIDER=local\n    STORAGE_LOCAL_BASEPATH=./storage\n    ```\n  \n\n\n### Storage Providers\n\n| Provider | Config Value | License | Description | Best For |\n|----------|-------------|---------|-------------|----------|\n| **Local Filesystem** | `local` | Free | Files stored on disk under `basePath` | Most deployments, large files |\n| **Database** | `database` | Pro/Enterprise | Files stored as BLOBs in the database | Simple setups where you want everything in one place |\n| **S3-Compatible** | `s3` | Pro/Enterprise | Files stored in an S3-compatible object store | Multi-node clusters, cloud object storage |\n\n> **💡 Tip**\n>\n> The **local** provider is recommended for most deployments and requires no license. It handles large files well and keeps database size manageable. The **database** provider is convenient but uses more memory with large files. The **s3** provider is for object-storage and multi-node deployments. The **database** and **s3** providers require a Pro/Enterprise license.\n\n\n### Docker Volume Mount\n\nWhen using the local provider with Docker, mount the storage directory so files persist across container restarts:\n\n```yaml\nvolumes:\n  - ./stirling-storage:/storage\n```\n\n---\n\n## S3-Compatible Object Storage\n\n> **ℹ️ Info: [Pro/Enterprise]**\n>\n> The **s3** storage provider requires a valid Pro or Enterprise license.\n\n\nSet `storage.provider: s3` to store user uploads in any S3-compatible object store. The same `storage.s3.*` block is also used by the cluster artifact store (see below).\n\n\n  \n    ```yaml\n    storage:\n      enabled: true\n      provider: s3\n      s3:\n        endpoint: \"\"                       # blank = AWS regional default; otherwise full URL incl. https://\n        bucket: my-bucket                  # required\n        region: us-east-1\n        accessKey: \"\"                      # blank = fall back to AWS DefaultCredentialsProvider (env / profile / IMDS)\n        secretKey: \"\"\n        pathStyleAccess: false             # true for MinIO and Supabase; false for AWS/R2/most CDNs\n        allowPrivateEndpoints: false       # SSRF guard - see below\n        requestChecksumCalculation: WHEN_SUPPORTED   # WHEN_SUPPORTED | WHEN_REQUIRED | DISABLED\n        responseChecksumValidation: WHEN_SUPPORTED   # WHEN_SUPPORTED | WHEN_REQUIRED | DISABLED\n    ```\n  \n  \n    ```bash\n    STORAGE_ENABLED=true\n    STORAGE_PROVIDER=s3\n    STORAGE_S3_ENDPOINT=\n    STORAGE_S3_BUCKET=my-bucket\n    STORAGE_S3_REGION=us-east-1\n    STORAGE_S3_ACCESSKEY=\n    STORAGE_S3_SECRETKEY=\n    STORAGE_S3_PATHSTYLEACCESS=false\n    STORAGE_S3_ALLOWPRIVATEENDPOINTS=false\n    STORAGE_S3_REQUESTCHECKSUMCALCULATION=WHEN_SUPPORTED\n    STORAGE_S3_RESPONSECHECKSUMVALIDATION=WHEN_SUPPORTED\n    ```\n  \n\n\n### S3 Configuration Keys\n\n| Key | Default | Description |\n|-----|---------|-------------|\n| `endpoint` | _(blank)_ | Blank uses the AWS regional default. For other vendors, the full URL including `https://`. |\n| `bucket` | _(blank)_ | Required. The bucket that holds the stored files. |\n| `region` | `us-east-1` | Region of the bucket. |\n| `accessKey` | _(blank)_ | Static access key. Blank falls back to the AWS `DefaultCredentialsProvider` (env vars, profile, or IMDS). |\n| `secretKey` | _(blank)_ | Static secret key. Used together with `accessKey`. |\n| `pathStyleAccess` | `false` | Use path-style (`endpoint/bucket/key`) instead of virtual-host addressing. `true` for MinIO and Supabase. |\n| `allowPrivateEndpoints` | `false` | SSRF guard. When `false`, an endpoint that resolves to a loopback, link-local, or private (RFC1918) address is rejected at startup. Set `true` to opt in (for example in-cluster MinIO). Leave `false` for any internet-facing vendor. |\n| `requestChecksumCalculation` | `WHEN_SUPPORTED` | `WHEN_SUPPORTED`, `WHEN_REQUIRED`, or `DISABLED`. Set `WHEN_REQUIRED` if your vendor rejects auto-added `x-amz-checksum-*` headers (older Backblaze B2, some R2 corner cases). |\n| `responseChecksumValidation` | `WHEN_SUPPORTED` | `WHEN_SUPPORTED`, `WHEN_REQUIRED`, or `DISABLED`. Set `WHEN_REQUIRED` if you see false-positive checksum-mismatch errors on GET from a vendor that never returns checksum headers. |\n\n> **⚠️ Warning: [SSRF guard]**\n>\n> `allowPrivateEndpoints` defaults to `false`. The server resolves the configured `endpoint` host and refuses to start if it points at a loopback, link-local, or private IP. This blocks an admin-supplied endpoint from being pointed at the cloud metadata service (for example `http://169.254.169.254/`) to exfiltrate instance-role credentials. Only set it to `true` for a trusted in-cluster store such as MinIO.\n\n\n### Per-Vendor Cheat Sheet\n\n| Vendor | `endpoint` | `region` | `pathStyleAccess` | Notes |\n|--------|-----------|----------|-------------------|-------|\n| **AWS S3** | _(blank)_ | your region | `false` | Uses the AWS regional default. |\n| **MinIO** (in-cluster) | `http://minio:9000` | `us-east-1` | `true` | Also set `allowPrivateEndpoints: true`. |\n| **Cloudflare R2** | `https://<acct>.r2.cloudflarestorage.com` | `auto` | `false` | If uploads fail with `unsupported header x-amz-checksum-*`, set `requestChecksumCalculation: WHEN_REQUIRED`. |\n| **Supabase Storage** | `https://<project>.supabase.co/storage/v1/s3` | your project region | `true` | Non-ASCII display filenames are fine - the storage key is opaque. |\n| **Backblaze B2** | `https://s3.<region>.backblazeb2.com` | your region | `false` | On B2 deployments older than July 2025, if uploads return `Unsupported header x-amz-checksum-crc32`, set `requestChecksumCalculation: WHEN_REQUIRED`. |\n| **DigitalOcean Spaces** | `https://<region>.digitaloceanspaces.com` | your region | `false` | 5 GB per-object cap (regardless of multipart). |\n\n### Sharing Credentials with the Cluster Artifact Store\n\nThe `storage.s3.*` block is used in two places: the **s3** storage provider (persistent user uploads) and the cluster artifact store when `cluster.artifactStore: s3` (transient multi-node job artifacts). When both use S3 they reuse the same credentials and bucket. The cluster store writes under a separate key prefix (`cluster.s3.keyPrefix`, default `transient/`) so a single bucket can host both persistent uploads and transient artifacts without collisions. Multi-node deployments must set `cluster.artifactStore: s3`.\n\n---\n\n## Enabling File Sharing\n\n\n  \n    ```yaml\n    storage:\n      enabled: true\n      sharing:\n        enabled: true            # Master switch for all sharing\n        linkEnabled: true        # Enable shareable links\n        emailEnabled: true       # Send email notifications when sharing\n        linkExpirationDays: 3    # Days until share links expire\n    ```\n  \n  \n    ```bash\n    STORAGE_SHARING_ENABLED=true\n    STORAGE_SHARING_LINKENABLED=true\n    STORAGE_SHARING_EMAILENABLED=true\n    STORAGE_SHARING_LINKEXPIRATIONDAYS=3\n    ```\n  \n\n\n### Feature Dependencies\n\n| Feature | What It Needs |\n|---------|---------------|\n| File Storage | `security.enableLogin: true` |\n| File Sharing | Storage enabled |\n| Shareable Links | Sharing enabled + `system.frontendUrl` set |\n| Email Notifications | Sharing enabled + `mail.enabled: true` |\n| Shared Signing | Storage enabled + `storage.signing.enabled: true` |\n\n---\n\n## Storage Quotas\n\nControl how much storage space is available.\n\n\n  \n    ```yaml\n    storage:\n      quotas:\n        maxStorageMbPerUser: -1   # Per-user cap in MB (-1 = unlimited)\n        maxStorageMbTotal: -1     # Total system cap in MB (-1 = unlimited)\n        maxFileMb: -1             # Max size per upload in MB (-1 = unlimited)\n    ```\n  \n  \n    ```bash\n    STORAGE_QUOTAS_MAXSTORAGEMBPERUSER=500\n    STORAGE_QUOTAS_MAXSTORAGEMBTOTAL=10000\n    STORAGE_QUOTAS_MAXFILEMB=100\n    ```\n  \n\n\nQuotas are checked before a file is stored. When replacing an existing file, only the size difference counts against the quota.\n\n---\n\n## Access Roles\n\nWhen sharing a file, you choose what level of access to grant:\n\n| Role | Can View/Download | Can Replace File | In Signing Workflows |\n|------|-------------------|-----------------|---------------------|\n| **Editor** | Yes | Yes | Can sign |\n| **Commenter** | Yes | No | Can sign |\n| **Viewer** | Yes | No | Read-only |\n\nThe file **owner** always has full access. The default role is **Editor**.\n\nThe difference between Commenter and Viewer only matters in [Shared Signing](doc:functionality/security/shared-signing) workflows -- both are read-only for regular file sharing.\n\n---\n\n## The My Files Page\n\nWhen your admin has turned storage on, you get a **My Files** page (find it at `/files` once you are logged in). It is your personal space on the server for keeping documents that stick around between sessions, instead of living only in your browser tab.\n\nOn the My Files page you can:\n\n- **Upload** documents to keep them on the server\n- **Organize them into folders**, including folders inside folders, and drag files between them\n- **Preview** a stored file right in the browser without downloading it\n- **Rename, move, and delete** files and folders\n- **Jump around quickly** using the folder sidebar on the left\n- **Personalize folders** with colors and thumbnails so they are easy to spot\n- **See where each file lives** - every item shows a small badge telling you whether it is in your current browser session or saved on the server\n\nYour folders are private to you. Folders themselves are not shared; you share individual files instead (see [Sharing Files](#sharing-files) below).\n\n---\n\n## Sharing Files\n\nYou can share a file from the **My Files** page, or from the **Share** button in the top bar of the editor workbench while a file is open.\n\n### Share with a Specific User\n\nFrom the file manager, select a file and share it with another user by their username or email address. You can choose the access role when sharing.\n\nIf you enter an email address for someone who doesn't have an account, the system will create a share link and email it to them (if email notifications are enabled).\n\n### Share via Link\n\nGenerate a shareable link for any file you own. Anyone who is logged in and has the link can access the file. Links expire automatically based on your `linkExpirationDays` setting (default: 3 days).\n\nYou can revoke a share link at any time, which immediately removes access and deletes all access records for that link.\n\nThe share link URL follows the format:\n```\nhttps://your-stirling-instance.com/share/{token}\n```\n\n> **ℹ️ Info**\n>\n> Share links require the recipient to be logged in. There is no anonymous or public access -- the link is an additional credential on top of authentication.\n\n\n### Access History\n\nFor any share link you've created, you can view who accessed it, whether they viewed or downloaded the file, and when.\n\n---\n\n## Security\n\n- **All endpoints require authentication** -- there is no anonymous file access\n- **Owner-only controls** -- only the file owner can update, delete, or manage sharing\n- **Random tokens** -- share link tokens are cryptographically random UUIDs\n- **Automatic expiration** -- expired links return an error and are cleaned up daily\n- **Revocation** -- owners can revoke any share link immediately\n- **Access auditing** -- every share link access is recorded with user, action type, and timestamp\n\n---\n\n## Known Limitations\n\n- Share links require `system.frontendUrl` to be configured\n- Share links require the user to be logged in -- there is no public/anonymous access\n- The database storage provider uses more memory with large files (use the local provider for large deployments)\n\n---\n\n## Troubleshooting\n\n### \"Storage is disabled\"\n- Verify `storage.enabled: true` in your settings\n- Verify `security.enableLogin: true`\n\n### \"Share links are disabled\"\n- Verify `storage.sharing.linkEnabled: true`\n- Verify `system.frontendUrl` is set to your instance URL\n\n### \"Email sharing is disabled\"\n- Verify `storage.sharing.emailEnabled: true`\n- Verify `mail.enabled: true` with valid SMTP settings\n\n### Share link returns 404 Not Found\n- The link has expired or does not exist. Expired and missing links both return **404 Not Found**. The file owner needs to create a new one.\n\n### Quota exceeded (HTTP 413)\n- A file or upload that exceeds a configured quota is rejected with **413 Payload Too Large** (per-file, per-user, and total-storage caps all use this status)\n- Increase `maxStorageMbPerUser`, `maxStorageMbTotal`, or `maxFileMb`, or delete unused files to free up space\n\n---\n\n## Developer Reference: Storage API\n\nThis section is for developers and admins automating storage outside the web app. If you just want to upload, organize, and share files, everything above is done from the **My Files** page - you do not need any of this.\n\nThe full storage and sharing endpoints are listed below. See [API Documentation](doc:api) for authentication and general usage.\n\n| Method | Endpoint | Description |\n|--------|----------|-------------|\n| POST | `/api/v1/storage/files` | Upload file |\n| PUT | `/api/v1/storage/files/{id}` | Update file (owner only) |\n| GET | `/api/v1/storage/files` | List accessible files |\n| GET | `/api/v1/storage/files/{id}` | Get file metadata |\n| GET | `/api/v1/storage/files/{id}/download` | Download file |\n| DELETE | `/api/v1/storage/files/{id}` | Delete file (owner only) |\n| POST | `/api/v1/storage/files/{id}/shares/users` | Share with user |\n| DELETE | `/api/v1/storage/files/{id}/shares/users/{username}` | Revoke user share |\n| DELETE | `/api/v1/storage/files/{id}/shares/self` | Leave shared file |\n| POST | `/api/v1/storage/files/{id}/shares/links` | Create share link |\n| DELETE | `/api/v1/storage/files/{id}/shares/links/{token}` | Revoke share link |\n| GET | `/api/v1/storage/share-links/{token}` | Access via share link |\n| GET | `/api/v1/storage/share-links/{token}/metadata` | Get share link info |\n| GET | `/api/v1/storage/share-links/accessed` | List your accessed links |\n| GET | `/api/v1/storage/files/{id}/shares/links/{token}/accesses` | Access history (owner only) |\n\n### Folder Endpoints\n\nThese are the endpoints behind the folders on the **My Files** page. All operations are scoped to the authenticated user.\n\n| Method | Endpoint | Description |\n|--------|----------|-------------|\n| GET | `/api/v1/storage/folders` | List your folders |\n| POST | `/api/v1/storage/folders` | Create a folder |\n| PATCH | `/api/v1/storage/folders/{folderId}` | Update a folder (name, appearance) |\n| DELETE | `/api/v1/storage/folders/{folderId}` | Delete a folder |\n| PATCH | `/api/v1/storage/files/{fileId}/folder` | Move a single file to a folder (or to root when `folderId` is null) |\n| PATCH | `/api/v1/storage/files/folder` | Bulk-move files to a folder (up to 1000 per request) |\n\n---\n\n## Related\n\n- [Shared Signing](doc:functionality/security/shared-signing) -- Collaborative multi-participant document signing\n- [Certificate Signing](doc:functionality/security/certificate-signing) -- Individual certificate signing\n- [System and Security Settings](doc:configuration/system-and-security) -- JWT, sessions, server certificates",
+      "sourcePath": "docs/Configuration/File Sharing and Storage.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/File Sharing and Storage.md"
+    },
+    "configuration/folderscanning": {
+      "id": "configuration/folderscanning",
+      "title": "Folder Scanning",
+      "section": "configuration",
+      "markdown": "## User Guide for Local Directory Scanning and File Processing\n\nFolder scanning uses settings configured from our pipeline tool, it is advised you first read the [Pipeline Guide](doc:configuration/pipeline)\n### Setting Up Watched Folders\n\n- Create a folder where you want your files to be monitored. This is your 'watched folder'.\n- The default directory for this is `./pipeline/watchedFolders/`.\n- Place any directories you want to be scanned into this folder. This folder should contain multiple folders, each for their own tasks and pipelines.\n\n### Configuring Processing with JSON Files\n\n- In each directory you want processed (e.g., `./pipeline/watchedFolders/officePrinter`), include a JSON configuration file.\n- This JSON file should specify how you want the files in the directory to be handled (e.g., what operations to perform on them). This can be made, configured, and downloaded from the Stirling PDF Pipeline interface. For JSON creation guide please see [Pipeline setup](doc:configuration/pipeline)\n\n### Automatic Scanning and Processing\n\n- The system automatically checks the watched folder every minute for new directories and files to process.\n- When a directory with a valid JSON configuration file is found, it begins processing the files inside according to the configuration.\n\n### Processing Steps\n\n- Files in each directory are processed according to the instructions in the JSON file.\n- This might involve file conversions, data filtering, renaming files, etc. If the output of a step is a zip, this zip will be automatically unzipped as it passes to the next process.\n\n### Results and Output\n\n- After processing, the results are saved in a specified output location. This could be a different folder or location as defined in the JSON file or the default location `./pipeline/finishedFolders/`.\n- Each processed file is named and organized according to the rules set in the JSON configuration.\n\n### Completion and Cleanup\n\n- Once processing is complete, the original files in the watched folder's directory are removed.\n- You can find the processed files in the designated output location.\n\n### Error Handling\n\n- If there's an error during processing, the system will not delete the original files, allowing you to check and retry if necessary.\n\n### User Interaction\n\n- As a user, your main tasks are to set up the watched folders, place directories with files for processing, and create the corresponding JSON configuration files.\n- The system handles the rest, including scanning, processing, and outputting results.",
+      "sourcePath": "docs/Configuration/FolderScanning.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/FolderScanning.md"
+    },
+    "configuration/google-drive-file-picker": {
+      "id": "configuration/google-drive-file-picker",
+      "title": "Google Drive File Picker",
+      "section": "configuration",
+      "markdown": "> **Tier**: Server\n\nStirling PDF allows users to select Files for processing through tools via google drive.\n\n## Google Api Access\nTo enable this features for your users, you must first set up your Google environment. This includes creating a Google Cloud project. Follow the **Setting up your environment** section of [this guide](https://developers.google.com/workspace/drive/picker/guides/overview#setup) to do so.\n\n## Stirling PDF configuration\n\n```yaml\npremium:\n  ...\n  enabled: true # Enable license key checks for pro/enterprise features\n  proFeatures:\n    ...\n    googleDrive:\n      enabled: true\n      clientId: <YOUR_CLIENT_ID>\n      apiKey: <YOUR_API_KEY>\n      appId: <YOUR_APP_ID>\n```\n- `premium.enabled`: Set to `true` to enable premium features. \n- `googleDrive.enabled`: Set to `true` to enable google drive file picker features. \n- `googleDrive.clientId`: Your Google web app's client ID. [Go to Credentials](https://console.cloud.google.com/apis/credentials) and Click **Create credentials > OAuth client ID**.\n- `googleDrive.apiKey`: API key for google api access. [Go to Credentials](https://console.cloud.google.com/apis/credentials) and Click **Create credentials > API key**.\n- `googleDrive.appId`: Google drive app ID also known as your Project Number Found in your [IAM&Admin Project Settings](https://console.cloud.google.com/iam-admin/settings)\n\n\n > #### ⚠️ Note\n> _You must set the Authorized Javascript origins for your OAuth client ID to include your Stirling PDF host domain or IP address._\n\n## Configurations Examples\nBelow are examples of the full configuration for enabling the google Drive Picker:\n\n\n  \n    ```yaml\n    premium:\n      enabled: true # Enable license key checks for pro/enterprise features\n      proFeatures:\n        googleDrive:\n          enabled: true\n          clientId: <YOUR_CLIENT_ID>\n          apiKey: <YOUR_API_KEY>\n          appId: <YOUR_APP_ID>\n    ```\n  \n  \n    ```bash\n    export PREMIUM_ENABLED=true\n    export PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_ENABLED=true\n    export PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_CLIENT_ID=\"<YOUR_CLIENT_ID>\"\n    export PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_API_KEY=\"<YOUR_API_KEY>\"\n    export PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_APP_ID=\"<YOUR_APP_ID>\"\n    ```\n  \n  \n    ```bash\n    -e PREMIUM_ENABLED=true \\\n    -e PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_ENABLED=true \\\n    -e PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_CLIENT_ID=\"<YOUR_CLIENT_ID>\" \\\n    -e PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_API_KEY=\"<YOUR_API_KEY>\" \\\n    -e PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_APP_ID=\"<YOUR_APP_ID>\" \\\n    ```\n  \n  \n    ```yaml\n    environment:\n      PREMIUM_ENABLED: true\n      PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_ENABLED: true\n      PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_CLIENT_ID: <YOUR_CLIENT_ID>\n      PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_API_KEY: <YOUR_API_KEY>\n      PREMIUM_PRO_FEATURES_GOOGLE_DRIVE_APP_ID: <YOUR_APP_ID>\n    ```",
+      "sourcePath": "docs/Configuration/Google Drive File Picker.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Google Drive File Picker.md"
+    },
+    "configuration/keyboard-shortcuts": {
+      "id": "configuration/keyboard-shortcuts",
+      "title": "Keyboard Shortcuts",
+      "section": "configuration",
+      "markdown": "Stirling PDF supports keyboard shortcuts for quick tool access and PDF viewer navigation. Custom shortcuts are saved in your browser's local storage, with plans to bind to your account in the future.\n\n## Tool Shortcuts\n\n### Default shortcuts\n\nTools in the Quick Access bar (the \"Recommended Tools\" category) automatically receive shortcuts:\n\n| Windows / Linux | Mac | Action |\n|---|---|---|\n| `Ctrl + Alt + 1` | `⌘ + ⌥ + 1` | First Quick Access tool |\n| `Ctrl + Alt + 2` | `⌘ + ⌥ + 2` | Second Quick Access tool |\n| `Ctrl + Alt + 3` | `⌘ + ⌥ + 3` | Third Quick Access tool |\n| … up to `9` | | |\n\nAll other tools have no default shortcut but can be assigned one.\n\n### Customising shortcuts\n\n1. Open **Settings** (gear icon at the bottom of the Quick Access bar)\n2. Go to **Keyboard Shortcuts**\n3. Find the tool you want\n4. Click **Change shortcut**, then press your key combination\n5. Press **Esc** to cancel\n\nYour shortcut must include at least one modifier key (`Ctrl`, `Alt`, or `Cmd`). `Shift` alone does not count as a modifier. If the combination is already taken by another tool, you'll see a conflict warning.\n\n### Resetting a shortcut\n\nClick **Reset** next to any tool to restore its default. If a tool has no default, Reset clears the custom binding.\n\n## PDF Viewer Shortcuts\n\nThese shortcuts work when the PDF viewer is active (hovered), except for Print, Select all text, and zoom which work whenever the viewer is open.\n\n### Modifier shortcuts (Ctrl / Cmd + key)\n\n| Windows / Linux | Mac | Action |\n|---|---|---|\n| `Ctrl + P` | `⌘ + P` | Print (works globally when viewer is mounted) |\n| `Ctrl + A` | `⌘ + A` | Select all text (works globally when viewer is open) |\n| `Ctrl + F` | `⌘ + F` | Open / focus search |\n| `Ctrl + S` | `⌘ + S` | Save / apply changes |\n| `Ctrl + Z` | `⌘ + Z` | Undo |\n| `Ctrl + Shift + Z` | `⌘ + ⇧ + Z` | Redo |\n| `Ctrl + Y` | `⌘ + Y` | Redo (alternative) |\n| `Ctrl + =` / `Ctrl + +` | `⌘ + =` / `⌘ + +` | Zoom in |\n| `Ctrl + -` | `⌘ + -` | Zoom out |\n| `Ctrl + 0` | `⌘ + 0` | Reset zoom (fit width) |\n\n### Navigation shortcuts (no modifier needed)\n\n| Key | Action |\n|---|---|\n| `Home` | Jump to first page |\n| `End` | Jump to last page |\n| `Page Up` | Previous page |\n| `Page Down` | Next page |\n| `Escape` | Close search |\n\n### Rotate tool\n\nWhen the Rotate tool is active:\n\n| Key | Action |\n|---|---|\n| `←` (Left Arrow) | Rotate left |\n| `→` (Right Arrow) | Rotate right |\n\n## Desktop App\n\nThe desktop app adds one extra shortcut:\n\n| Windows / Linux | Mac | Action |\n|---|---|---|\n| `Ctrl + S` | `⌘ + S` | Save selected files to disk |",
+      "sourcePath": "docs/Configuration/Keyboard-Shortcuts.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Keyboard-Shortcuts.md"
+    },
+    "configuration/libreoffice-parallel-processing": {
+      "id": "configuration/libreoffice-parallel-processing",
+      "title": "LibreOffice Parallel Processing",
+      "description": "Configure multiple LibreOffice instances for parallel document conversion",
+      "section": "configuration",
+      "markdown": "Stirling PDF uses LibreOffice for converting office documents (DOCX, XLSX, PPTX, etc.) to PDF and other formats. LibreOffice processes each conversion in a single thread, meaning one conversion uses one CPU core at 100% regardless of how many cores are available. To process multiple conversions at the same time, you need to run multiple LibreOffice instances.\n\n---\n\n## Local UNO Server Pool\n\nBy default, Stirling PDF manages a local pool of UNO (Universal Network Objects) server instances. The number of instances is controlled by the `libreOfficeSessionLimit` setting.\n\n\n  \n    ```yaml\n    processExecutor:\n      autoUnoServer: true\n      sessionLimit:\n        libreOfficeSessionLimit: 4  # Run 4 LibreOffice instances\n    ```\n  \n  \n    ```bash\n    PROCESS_EXECUTOR_SESSION_LIMIT_LIBRE_OFFICE_SESSION_LIMIT=4\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest\n        environment:\n          PROCESS_EXECUTOR_SESSION_LIMIT_LIBRE_OFFICE_SESSION_LIMIT: 4\n    ```\n  \n\n\nA reasonable starting point is one instance per 2 CPU cores. See [Host resource requirements](#host-resource-requirements) for memory and storage sizing.\n\n> **ℹ️ Info**\n>\n> The default `libreOfficeSessionLimit` is `1`, meaning only one conversion runs at a time. If you see conversions queuing up or running slowly, increasing this is the first thing to try.\n\n\n### Throughput expectations\n\nPer-conversion time varies from sub-second (small DOCX) to tens of seconds (complex PPTX, large spreadsheets). Pool throughput scales roughly linearly with worker count up to host CPU saturation - benchmark a representative document before sizing.\n\n---\n\n## Remote unoservers\n\nFor larger deployments, or when you want to isolate LibreOffice from the main application, run UNO servers as separate containers and configure Stirling PDF to connect to them remotely. This is a two-step setup: start the unoserver containers, then point Stirling PDF at them.\n\n### Starting unoserver Containers\n\nEach container is a single worker that listens internally on port `2003`. Expose it on a different host port per instance if you want to reach them from outside Docker or from another host.\n\n\n  \n    ```yaml\n    services:\n      unoserver1:\n        image: ghcr.io/stirling-tools/stirling-unoserver:latest\n        ports:\n          - \"2003:2003\"\n\n      unoserver2:\n        image: ghcr.io/stirling-tools/stirling-unoserver:latest\n        ports:\n          - \"2004:2003\"\n    ```\n    Add these alongside your `stirling-pdf` service. Host-port mappings are only required if Stirling PDF runs outside Docker, on a different host, or on a separate Docker network.\n  \n  \n    ```bash\n    docker run -d --name unoserver1 -p 2003:2003 \\\n      ghcr.io/stirling-tools/stirling-unoserver:latest\n\n    docker run -d --name unoserver2 -p 2004:2003 \\\n      ghcr.io/stirling-tools/stirling-unoserver:latest\n    ```\n  \n\n\nFor tunable options (timeouts, periodic recycling, CJK fonts), see [The `stirling-unoserver` Image](#the-stirling-unoserver-image) below.\n\n### Connecting Stirling PDF to Remote Endpoints\n\nOnce your unoserver containers are running, set `autoUnoServer` to `false` and point Stirling PDF at them:\n\n\n  \n    ```yaml\n    processExecutor:\n      autoUnoServer: false\n      unoServerEndpoints:\n        - host: \"unoserver1\"\n          port: 2003\n          hostLocation: \"remote\"\n          protocol: \"http\"\n        - host: \"unoserver2\"\n          port: 2003\n          hostLocation: \"remote\"\n          protocol: \"http\"\n        - host: \"unoserver3\"\n          port: 2003\n          hostLocation: \"remote\"\n          protocol: \"http\"\n    ```\n  \n  \n    ```bash\n    PROCESS_EXECUTOR_AUTO_UNO_SERVER=false\n    PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_0_HOST=unoserver1\n    PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_0_PORT=2003\n    PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_0_HOST_LOCATION=remote\n    PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_0_PROTOCOL=http\n    PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_1_HOST=unoserver2\n    PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_1_PORT=2003\n    PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_1_HOST_LOCATION=remote\n    PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_1_PROTOCOL=http\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest\n        ports:\n          - \"8080:8080\"\n        environment:\n          PROCESS_EXECUTOR_AUTO_UNO_SERVER: \"false\"\n          PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_0_HOST: \"unoserver1\"\n          PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_0_PORT: \"2003\"\n          PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_0_HOST_LOCATION: \"remote\"\n          PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_1_HOST: \"unoserver2\"\n          PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_1_PORT: \"2003\"\n          PROCESS_EXECUTOR_UNO_SERVER_ENDPOINTS_1_HOST_LOCATION: \"remote\"\n    ```\n  \n\n\nTo add more endpoints, add additional entries to the `unoServerEndpoints` list in settings.yml, or for environment variables, increment the index number (e.g. `_0_` for the first, `_1_` for the second, `_2_` for the third, and so on).\n\n> **💡 Tip**\n>\n> Set `libreOfficeSessionLimit` to match your endpoint count so the pool uses all of them concurrently. With 3 endpoints and a session limit of 1, you'll only ever use one at a time.\n\n\n#### Endpoint Configuration\n\nThe `host` field accepts a Docker service name (e.g. `unoserver1`), a DNS hostname (e.g. `uno.internal.example.com`), or an IP address (e.g. `192.168.1.50`). The default is `127.0.0.1`.\n\nThe `hostLocation` setting controls how files are transferred between Stirling PDF and the UNO server:\n\n| Value | When to Use | How It Works |\n|---|---|---|\n| `auto` | Default, detects automatically | Checks if the host is local or remote |\n| `local` | UNO server is on the same machine | Files are passed via filesystem paths (fastest) |\n| `remote` | UNO server is a separate container or machine | Files are transferred over HTTP |\n\n> **⚠️ Caution**\n>\n> Use `remote` when running UNO servers in separate Docker containers, even if the containers are on the same host machine. The containers don't share a filesystem, so `local` will not work.\n\n\n---\n\n## The `stirling-unoserver` Image\n\n`ghcr.io/stirling-tools/stirling-unoserver` is the official standalone worker image.\n\n> **⚠️ Caution: Alpha release**\n>\n> The `stirling-unoserver` image is currently in **alpha**. Only the `:alpha` tag is published today. `:latest` and versioned tags (`:1.0.0`, `:1.0.1`, etc.) will follow once we cut the first stable release. The compose examples on this page reference `:latest` for forward-compatibility, so for now substitute `:alpha` until the stable release is announced. Configuration variables and behaviour are not expected to change between alpha and 1.0.\n\n\n| Tag | Status | Use |\n|---|---|---|\n| `:alpha` | **Available now** | All deployments while the image is in alpha |\n| `:latest` | Coming soon | Production once 1.0 ships |\n| `:1.0.0`, `:1.0.1`, etc. | Coming soon | Pinned version once 1.0 ships |\n\nThe latest `stirling-unoserver` image is always compatible with the latest Stirling PDF, so if you track `:latest` (or `:alpha` today) on both you don't need to coordinate upgrades. The image will be versioned independently from Stirling PDF, so you can also pin a specific version and update it on its own cadence. Any compatibility breaks will be called out in release notes.\n\n### Configuration\n\n| Variable | Default | Purpose |\n|---|---|---|\n| `UNOSERVER_PORT` | `2003` | Listen port. |\n| `UNOSERVER_INTERFACE` | `0.0.0.0` | Listen address; use `127.0.0.1` to restrict to the same host. |\n| `UNOSERVER_CONVERSION_TIMEOUT` | `1800` (s) | Max time per conversion. Set ≥ `libreOfficeTimeoutMinutes`. |\n| `UNOSERVER_RECYCLE_INTERVAL_SECONDS` | `0` (off) | Periodic restart to bound LibreOffice memory growth. Minimum 60 s; e.g. `3600` for hourly. |\n\n### CPU allocation\n\nCore allocation between instances should be handled automatically by the Linux scheduler. However, if you see uneven core usage or want to cap how much CPU each worker can use, you have two options:\n\n**Soft cap (recommended).** Limit each container to a CPU budget. The kernel still picks which cores to use.\n\n```yaml\nservices:\n  unoserver1:\n    image: ghcr.io/stirling-tools/stirling-unoserver:alpha\n    deploy:\n      resources:\n        limits:\n          cpus: \"2.0\"      # up to 2 cores worth of CPU time\n          memory: 1g\n```\n\nFor `docker run`: `--cpus=\"2.0\"`.\n\n**Hard pinning.** Bind each container to specific cores. Use this only if the soft cap isn't enough.\n\n```yaml\nservices:\n  unoserver1:\n    image: ghcr.io/stirling-tools/stirling-unoserver:alpha\n    cpuset: \"0,1\"\n  unoserver2:\n    image: ghcr.io/stirling-tools/stirling-unoserver:alpha\n    cpuset: \"2,3\"\n```\n\nFor `docker run`: `--cpuset-cpus=\"0,1\"`. For systemd-managed unoservers, the equivalent is `CPUAffinity=0 1` in the service unit.\n\n### CJK fonts\n\nThe default image covers European languages with hyphenation for EN/FR/DE/ES/IT/PT/NL/PL/RU. For Chinese/Japanese/Korean, rebuild with `--build-arg INSTALL_CJK_FONTS=true` (~120 MB extra).\n\n---\n\n## Running UNO Servers Without Docker\n\nIf you are running Stirling PDF without Docker (bare metal or systemd), you can start additional UNO server instances manually using the `unoserver` Python package:\n\n```bash\n# Install unoserver (included in Docker images)\npip install unoserver\n\n# Start instances on different ports\nunoserver --port 2003 &\nunoserver --port 2004 &\nunoserver --port 2005 &\n```\n\nThen configure Stirling PDF to connect to these instances at `127.0.0.1` on the respective ports with `hostLocation: \"local\"`.\n\n---\n\n## Timeout Configuration\n\nLibreOffice conversion has a default timeout of **30 minutes**. For very large or complex documents, you may need to increase this:\n\n\n  \n    ```yaml\n    processExecutor:\n      timeoutMinutes:\n        libreOfficetimeoutMinutes: 60\n    ```\n  \n  \n    ```bash\n    PROCESS_EXECUTOR_TIMEOUT_MINUTES_LIBRE_OFFICETIMEOUT_MINUTES=60\n    ```\n  \n\n\nIf conversions are consistently timing out, this usually indicates the system is under-resourced rather than needing a longer timeout. Check CPU and memory usage first.\n\n---\n\n## Host resource requirements\n\n- **Memory** - ~70 MB idle, 140–250 MB during conversion, per worker. Add headroom for the OS and Stirling PDF itself.\n- **CPU** - each active conversion saturates roughly one CPU core (LibreOffice is single-threaded per document). Start with one worker per two cores; the kernel handles core distribution automatically. See [CPU allocation](#cpu-allocation) if you want to cap or pin workers explicitly.\n\n---\n\n## Related\n\n- [Process Limits](doc:configuration/process-limits) - Configure session limits and timeouts for all external tools\n- [Production Deployment Guide](doc:server-admin-onboarding) - Sizing recommendations for different workloads\n- [Diagnostics](doc:configuration/diagnostics) - Collect system and application diagnostics for troubleshooting",
+      "sourcePath": "docs/Configuration/LibreOffice-Parallel-Processing.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/LibreOffice-Parallel-Processing.md"
+    },
+    "configuration/mobile-scanner": {
+      "id": "configuration/mobile-scanner",
+      "title": "Mobile Scanner Configuration",
+      "description": "Enable and configure Mobile Scanner for document scanning via phone camera",
+      "section": "configuration",
+      "markdown": "Enable and configure the Mobile Scanner feature, which lets users scan documents with their phone camera and upload them directly to Stirling PDF via QR code.\n\n## Settings\n\n\n  \n    ```yaml\n    system:\n      enableMobileScanner: true\n      mobileScannerSettings:\n        convertToPdf: true                    # Convert images to PDF (true/false)\n        imageResolution: full                 # 'full' (original size) or 'reduced' (max 1200px)\n        pageFormat: A4                        # 'keep' (original dimensions), 'A4', or 'letter'\n        stretchToFit: false                   # Stretch images to fill page (may distort)\n    ```\n  \n  \n    ```bash\n    SYSTEM_ENABLEMOBILESCANNER=true\n    SYSTEM_MOBILESCANNERSETTINGS_CONVERTTOPDF=true\n    SYSTEM_MOBILESCANNERSETTINGS_IMAGERESOLUTION=full\n    SYSTEM_MOBILESCANNERSETTINGS_PAGEFORMAT=A4\n    SYSTEM_MOBILESCANNERSETTINGS_STRETCHTOFIT=false\n    ```\n  \n  \n    ```bash\n    docker run -d \\\n      -p 8080:8080 \\\n      -e SYSTEM_ENABLEMOBILESCANNER=true \\\n      -e SYSTEM_MOBILESCANNERSETTINGS_CONVERTTOPDF=true \\\n      -e SYSTEM_MOBILESCANNERSETTINGS_IMAGERESOLUTION=full \\\n      -e SYSTEM_MOBILESCANNERSETTINGS_PAGEFORMAT=A4 \\\n      -e SYSTEM_MOBILESCANNERSETTINGS_STRETCHTOFIT=false \\\n      stirlingtools/stirling-pdf:latest\n    ```\n  \n  \n    ```yaml\n    environment:\n      SYSTEM_ENABLEMOBILESCANNER: true\n      SYSTEM_MOBILESCANNERSETTINGS_CONVERTTOPDF: true\n      SYSTEM_MOBILESCANNERSETTINGS_IMAGERESOLUTION: full\n      SYSTEM_MOBILESCANNERSETTINGS_PAGEFORMAT: A4\n      SYSTEM_MOBILESCANNERSETTINGS_STRETCHTOFIT: false\n    ```\n  \n\n\n## Configuration Options\n\n| Setting | Values | Description |\n|---------|--------|-------------|\n| `enableMobileScanner` | `true` / `false` | Enable/disable Mobile Scanner feature |\n| `convertToPdf` | `true` / `false` | Automatically convert uploaded images to PDF. If false, images are kept as-is. |\n| `imageResolution` | `full` / `reduced` | Image resolution for PDF conversion: `full` = original size, `reduced` = max 1200px on longest side. Only applies when `convertToPdf` is true. |\n| `pageFormat` | `keep` / `A4` / `letter` | Page format for converted PDFs: `keep` = original image dimensions, `A4` = A4 page size, `letter` = US Letter page size. Only applies when `convertToPdf` is true. |\n| `stretchToFit` | `true` / `false` | Stretch images to fill entire page (may distort aspect ratio). If false, images are centered with preserved aspect ratio. Only applies when `convertToPdf` is true. |\n\n## Desktop app behaviour\n\nThe Stirling PDF desktop app has built-in support for Mobile Scanner. For the end-user walkthrough, see [Mobile Scanner](doc:functionality/mobile-scanner).\n\nAdmin note specific to the desktop app:\n\n- In desktop mode the app serves its own simple upload page (controlled by the `STIRLING_PDF_TAURI_MODE` setting) instead of the standard web `/mobile-scanner` page, because a phone cannot load the desktop app's own window.",
+      "sourcePath": "docs/Configuration/Mobile-Scanner.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Mobile-Scanner.md"
+    },
+    "configuration/oauth-sso-configuration": {
+      "id": "configuration/oauth-sso-configuration",
+      "title": "OAuth 2.0 Single Sign-On Configuration",
+      "section": "configuration",
+      "markdown": "> **Tier**: Server\n\nStirling PDF supports Single Sign-On (SSO) using OAuth 2.0 OpenID Connect (OIDC). This allows users to log in using accounts from external providers such as Google, GitHub, Keycloak, Authentik, and others.\n\n> **Looking for SAML 2.0 SSO?** See [SAML SSO Configuration](doc:configuration/saml-sso-configuration/saml-sso-configuration) (Enterprise tier).\n\n## Prerequisites\n\nBefore configuring OAuth 2.0 SSO, ensure you have:\n\n- [ ] Stirling PDF with login enabled (`security.enableLogin: true`)\n- [ ] Valid license for the Server tier or higher\n- [ ] An OAuth 2.0 provider account (Google, GitHub, Keycloak, etc.)\n- [ ] Registered OAuth application with your provider\n- [ ] OAuth Client ID and Client Secret from your provider\n- [ ] Public HTTPS URL configured with `system.backendUrl` set to your public backend API URL (often same as frontend, verify `https://your-domain.com/api/v1/info/status` is accessible)\n- [ ] Callback URL added to provider: `https://your-domain.com/login/oauth2/code/<provider>`\n\n> **Tip**: Start with `loginMethod: all` during initial setup to allow both username/password and OAuth login. This ensures you can always access the admin account if SSO configuration needs adjustment.\n\n## Setup Guide\n\n### Step 1: Configure Login Settings\n\nEnable login and set the login method to allow both standard and OAuth authentication during initial setup.\n\n\n  \n    ```yaml\n    security:\n      enableLogin: true\n      loginMethod: all  # Allows both username/password and OAuth login\n    ```\n  \n  \n    ```bash\n    SECURITY_ENABLELOGIN=true\n    SECURITY_LOGINMETHOD=all\n    ```\n  \n\n\n**Login Method Options:**\n- `all`: Enables all login methods (username/password + OAuth 2)\n- `normal`: Username/password only\n- `oauth2`: OAuth 2 SSO only (disables username/password login)\n- `saml2`: SAML 2 SSO only (Enterprise tier)\n\n### Step 2: Create Initial Admin Account\n\nBefore enabling OAuth, create an initial admin account using one of these methods:\n\n**Option A: Use initialLogin credentials** (recommended for first setup)\n\n\n  \n    ```yaml\n    security:\n      initialLogin:\n        username: 'admin'\n        password: 'yourSecurePassword123'\n    ```\n  \n  \n    ```bash\n    SECURITY_INITIALLOGIN_USERNAME=admin\n    SECURITY_INITIALLOGIN_PASSWORD=yourSecurePassword123\n    ```\n  \n\n\n**Option B: Create admin manually**\n1. Access Stirling PDF with OAuth disabled\n2. Create an admin user through the UI\n3. Then enable OAuth\n\n### Step 3: Configure OAuth Provider\n\nSet `security.oauth2.enabled` to `true` and configure your chosen provider.\n\n\n  \n    \n      \n        ```yaml\n        security:\n          oauth2:\n            enabled: true\n            client:\n              google:\n                clientId: <YOUR_CLIENT_ID>\n                clientSecret: <YOUR_CLIENT_SECRET>\n                scopes: email, profile\n                useAsUsername: email\n            provider: google\n            autoCreateUser: true\n            blockRegistration: false\n        ```\n      \n      \n        ```bash\n        SECURITY_OAUTH2_ENABLED=true\n        SECURITY_OAUTH2_CLIENT_GOOGLE_CLIENTID=<YOUR_CLIENT_ID>\n        SECURITY_OAUTH2_CLIENT_GOOGLE_CLIENTSECRET=<YOUR_CLIENT_SECRET>\n        SECURITY_OAUTH2_CLIENT_GOOGLE_SCOPES=email, profile\n        SECURITY_OAUTH2_CLIENT_GOOGLE_USEASUSERNAME=email\n        SECURITY_OAUTH2_PROVIDER=google\n        SECURITY_OAUTH2_AUTOCREATEUSER=true\n        SECURITY_OAUTH2_BLOCKREGISTRATION=false\n        ```\n      \n    \n\n    **Provider Setup:**\n    1. Go to [Google Cloud Console](https://console.cloud.google.com/)\n    2. Create a new project or select existing\n    3. Enable Google+ API\n    4. Create OAuth 2.0 credentials (Web application)\n    5. Add authorized redirect URI: `https://your-domain.com/login/oauth2/code/google`\n    6. Copy Client ID and Client Secret\n  \n  \n    \n      \n        ```yaml\n        security:\n          oauth2:\n            enabled: true\n            client:\n              github:\n                clientId: <YOUR_CLIENT_ID>\n                clientSecret: <YOUR_CLIENT_SECRET>\n                scopes: read:user\n                useAsUsername: login\n            provider: github\n            autoCreateUser: true\n            blockRegistration: false\n        ```\n      \n      \n        ```bash\n        SECURITY_OAUTH2_ENABLED=true\n        SECURITY_OAUTH2_CLIENT_GITHUB_CLIENTID=<YOUR_CLIENT_ID>\n        SECURITY_OAUTH2_CLIENT_GITHUB_CLIENTSECRET=<YOUR_CLIENT_SECRET>\n        SECURITY_OAUTH2_CLIENT_GITHUB_SCOPES=read:user\n        SECURITY_OAUTH2_CLIENT_GITHUB_USEASUSERNAME=login\n        SECURITY_OAUTH2_PROVIDER=github\n        SECURITY_OAUTH2_AUTOCREATEUSER=true\n        SECURITY_OAUTH2_BLOCKREGISTRATION=false\n        ```\n      \n    \n\n    **Provider Setup:**\n    1. Go to [GitHub Developer Settings](https://github.com/settings/developers)\n    2. Create new OAuth App\n    3. Set Authorization callback URL: `https://your-domain.com/login/oauth2/code/github`\n    4. Copy Client ID and generate Client Secret\n  \n  \n    \n      \n        ```yaml\n        security:\n          oauth2:\n            enabled: true\n            issuer: https://your-keycloak.com/realms/your-realm\n            clientId: <YOUR_CLIENT_ID>\n            clientSecret: <YOUR_CLIENT_SECRET>\n            scopes: openid, profile, email\n            useAsUsername: preferred_username\n            provider: keycloak\n            autoCreateUser: true\n            blockRegistration: false\n        ```\n      \n      \n        ```bash\n        SECURITY_OAUTH2_ENABLED=true\n        SECURITY_OAUTH2_ISSUER=https://your-keycloak.com/realms/your-realm\n        SECURITY_OAUTH2_CLIENTID=<YOUR_CLIENT_ID>\n        SECURITY_OAUTH2_CLIENTSECRET=<YOUR_CLIENT_SECRET>\n        SECURITY_OAUTH2_SCOPES=openid, profile, email\n        SECURITY_OAUTH2_USEASUSERNAME=preferred_username\n        SECURITY_OAUTH2_PROVIDER=keycloak\n        SECURITY_OAUTH2_AUTOCREATEUSER=true\n        SECURITY_OAUTH2_BLOCKREGISTRATION=false\n        ```\n      \n    \n\n    **Provider Setup:**\n    1. Access your Keycloak admin console\n    2. Select your realm\n    3. Create new client (OpenID Connect)\n    4. Set Valid Redirect URIs: `https://your-domain.com/login/oauth2/code/keycloak`\n    5. Enable \"Client authentication\" for confidential access\n    6. Copy Client ID and Client Secret from Credentials tab\n  \n  \n    \n      \n        ```yaml\n        security:\n          oauth2:\n            enabled: true\n            issuer: https://your-authentik.com/application/o/stirling-pdf/\n            clientId: <YOUR_CLIENT_ID>\n            clientSecret: <YOUR_CLIENT_SECRET>\n            scopes: openid, profile, email\n            useAsUsername: preferred_username\n            provider: authentik\n            autoCreateUser: true\n            blockRegistration: false\n        ```\n      \n      \n        ```bash\n        SECURITY_OAUTH2_ENABLED=true\n        SECURITY_OAUTH2_ISSUER=https://your-authentik.com/application/o/stirling-pdf/\n        SECURITY_OAUTH2_CLIENTID=<YOUR_CLIENT_ID>\n        SECURITY_OAUTH2_CLIENTSECRET=<YOUR_CLIENT_SECRET>\n        SECURITY_OAUTH2_SCOPES=openid, profile, email\n        SECURITY_OAUTH2_USEASUSERNAME=preferred_username\n        SECURITY_OAUTH2_PROVIDER=authentik\n        SECURITY_OAUTH2_AUTOCREATEUSER=true\n        SECURITY_OAUTH2_BLOCKREGISTRATION=false\n        ```\n      \n    \n\n    **Provider Setup:**\n    1. Create new Provider (OAuth2/OpenID)\n    2. Create new Application\n    3. Set Redirect URIs: `https://your-domain.com/login/oauth2/code/authentik`\n    4. Copy Client ID and Client Secret\n  \n  \n    \n      \n        ```yaml\n        security:\n          oauth2:\n            enabled: true\n            issuer: <YOUR_ISSUER_URI>\n            clientId: <YOUR_CLIENT_ID>\n            clientSecret: <YOUR_CLIENT_SECRET>\n            scopes: openid, profile, email\n            useAsUsername: email\n            provider: <PROVIDER_NAME>\n            autoCreateUser: true\n            blockRegistration: false\n        ```\n      \n      \n        ```bash\n        SECURITY_OAUTH2_ENABLED=true\n        SECURITY_OAUTH2_ISSUER=<YOUR_ISSUER_URI>\n        SECURITY_OAUTH2_CLIENTID=<YOUR_CLIENT_ID>\n        SECURITY_OAUTH2_CLIENTSECRET=<YOUR_CLIENT_SECRET>\n        SECURITY_OAUTH2_SCOPES=openid, profile, email\n        SECURITY_OAUTH2_USEASUSERNAME=email\n        SECURITY_OAUTH2_PROVIDER=<PROVIDER_NAME>\n        SECURITY_OAUTH2_AUTOCREATEUSER=true\n        SECURITY_OAUTH2_BLOCKREGISTRATION=false\n        ```\n      \n    \n\n    **Requirements:**\n    - Provider must support OpenID Connect Discovery\n    - Must expose `/.well-known/openid-configuration` endpoint\n  \n\n\n### Step 4: Configure Callback URL\n\nWhen registering your application with the OAuth provider, use this callback URL format:\n\n```\nhttps://<your-domain>/login/oauth2/code/<provider>\n```\n\n**Understanding the Provider Slug:**\n\nThe `<provider>` portion of the callback URL must exactly match your `security.oauth2.provider` configuration value:\n\n```yaml\nsecurity:\n  oauth2:\n    provider: authentik  # This becomes part of the callback URL\n```\n\nWith the above configuration, your callback URL becomes:\n```\nhttps://your-domain.com/login/oauth2/code/authentik\n```\n\n**Examples:**\n- Google: `https://stirling.example.com/login/oauth2/code/google`\n- GitHub: `https://stirling.example.com/login/oauth2/code/github`\n- Keycloak: `https://stirling.example.com/login/oauth2/code/keycloak`\n- Custom provider: `https://stirling.example.com/login/oauth2/code/mycompany`\n\n> **Important**: If the provider slug in the callback URL doesn't match your `security.oauth2.provider` value, OAuth login will fail with redirect errors.\n\n> **Tip**: For generic OIDC providers (not Google/GitHub/Keycloak), you can set `provider` to any lowercase alphanumeric value that makes sense for your organization.\n\n### Step 5: Test OAuth Login and Promote User\n\n1. Restart Stirling PDF\n2. Test OAuth login in an incognito/private browser window\n3. Verify you can log in with your OAuth provider\n4. Log in with your initial admin account (username/password)\n5. Go to **Settings** → **User Management**\n6. Find the OAuth user account (created during test login)\n7. Change role to **Admin**\n\n### Step 6: (Optional) Switch to SSO-Only Mode\n\nOnce you've verified OAuth works and promoted an OAuth user to admin, you can disable username/password login:\n\n\n  \n    ```yaml\n    security:\n      loginMethod: oauth2  # Disables username/password login\n    ```\n  \n  \n    ```bash\n    SECURITY_LOGINMETHOD=oauth2\n    ```\n  \n\n\n> **Important**: If you set `loginMethod: oauth2` before creating an OAuth admin user, you will only be able to log in via OAuth, and all new OAuth users will have regular user permissions. Keep `loginMethod: all` until you have at least one OAuth user with admin privileges.\n\n## Configuration Reference\n\n### Required Properties\n\n| Property | Description | Example |\n|----------|-------------|---------|\n| `security.oauth2.enabled` | Enable OAuth 2 login | `true` |\n| `security.oauth2.clientId` | Client ID from your OAuth provider | `stirling-pdf-client` |\n| `security.oauth2.clientSecret` | Client Secret from your OAuth provider | `your-secret-key` |\n| `security.oauth2.provider` | Provider name | `google`, `github`, `keycloak`, `authentik` |\n\n### Optional Properties\n\n| Property | Description | Default | Example |\n|----------|-------------|---------|---------|\n| `security.oauth2.issuer` | OIDC issuer URL (required for generic providers, must support `/.well-known/openid-configuration`) | - | `https://keycloak.example.com/realms/myrealm` |\n| `security.oauth2.autoCreateUser` | Auto-create users on first login | `true` | `false` |\n| `security.oauth2.blockRegistration` | Block new user registration, only allow pre-registered users | `false` | `true` |\n| `security.oauth2.scopes` | Space or comma-separated list of OAuth scopes | Provider-specific | `openid, profile, email` |\n| `security.oauth2.useAsUsername` | Claim to use as username (options depend on provider) | Provider-specific | `email`, `preferred_username`, `login` |\n\n### Provider-Specific Configuration\n\n**Named providers** (Google, GitHub, Keycloak):\n```yaml\noauth2:\n  client:\n    google:  # or github, keycloak\n      clientId: ...\n      clientSecret: ...\n```\n\n**Generic providers** (Authentik, custom OIDC):\n```yaml\noauth2:\n  issuer: <ISSUER_URI>  # Must support OIDC discovery\n  clientId: ...\n  clientSecret: ...\n```\n\n### Username Claim Options\n\n**Google:**\n- `email`, `name`, `given_name`, `family_name`\n- See [Google OAuth Scopes](https://developers.google.com/identity/protocols/oauth2/scopes)\n\n**GitHub:**\n- `login`, `email`, `name`\n- See [GitHub OAuth Scopes](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/scopes-for-oauth-apps)\n\n**Keycloak/Generic OIDC:**\n- `email`, `preferred_username`, `nickname`, `name`\n\n## Advanced Configuration\n\n### Backend URL Configuration\n\nIf your Stirling PDF backend is accessible at a different URL than the frontend, configure the backend URL:\n\n\n  \n    ```yaml\n    system:\n      backendUrl: https://stirling-api.example.com\n    ```\n  \n  \n    ```bash\n    SYSTEM_BACKENDURL=https://stirling-api.example.com\n    ```\n  \n\n\nVerify the backend URL is correct by checking that `https://your-domain.com/api/v1/info/status` is accessible.\n\n### Auto-Login Feature\n> **Tier**: Server\n\nAutomatically redirect users to OAuth login page, bypassing the Stirling PDF login screen.\n\n\n  \n    ```yaml\n    premium:\n      proFeatures:\n        ssoAutoLogin: true\n    ```\n  \n  \n    ```bash\n    PREMIUM_PROFEATURES_SSOAUTOLOGIN=true\n    ```\n  \n\n\n**Auto-login Activation Requirements:**\n\nAuto-login only triggers when **ALL** of the following conditions are met:\n\n1. `ssoAutoLogin` is enabled (as configured above)\n2. `loginMethod` is NOT `'all'` and NOT `'normal'` (i.e., SSO-only mode required)\n3. Exactly one OAuth provider is configured\n\n**Behavior:**\n- When all conditions are met: Users are automatically redirected to OAuth provider login\n- When conditions are not met: Standard login page is displayed\n- If the SSO redirect fails, the browser stops auto-redirecting for the current session so the login page stays reachable\n- After logging out, auto-redirect is suppressed for that session so you can sign in as a different user\n\n### User Interface\n\nOnce OAuth is configured, users will see the SSO login button:\n\n| ![login-page.png](https://raw.githubusercontent.com/Stirling-Tools/Stirling-Tools.github.io/main/static/img/login-page.png) | ![sso-login-option.png](https://raw.githubusercontent.com/Stirling-Tools/Stirling-Tools.github.io/main/static/img/sso-login-option.png) |\n|----------------------------------------|---------------------------------------------------|\n\n## Troubleshooting\n\n### Common Issues\n\n**\"OAuth2 authentication error\"**\n- Verify callback URL matches exactly (including provider slug)\n- Check client ID and secret are correct\n- Ensure provider allows the configured redirect URI\n- Confirm `security.oauth2.provider` matches the provider slug in callback URL\n\n**\"Invalid issuer\"**\n- Confirm issuer URL is correct\n- Test `https://your-issuer/.well-known/openid-configuration` returns valid JSON\n- Check network connectivity from Stirling PDF container to provider\n\n**\"User not created\"**\n- Set `autoCreateUser: true`\n- Check `blockRegistration` is `false` or user is pre-registered\n- Verify license allows user count\n\n**Users redirected to wrong URL**\n- Verify `system.backendUrl` is configured correctly\n- Test that `https://your-domain.com/api/v1/info/status` is accessible\n- Check provider's registered redirect URIs match your domain\n\n### Debug Logging\n\nEnable OAuth debug logging to troubleshoot authentication issues.\n\n\n  \n    ```yaml\n    logging:\n      level:\n        org.springframework.security.oauth2: DEBUG\n    ```\n  \n  \n    ```bash\n    LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY_OAUTH2=DEBUG\n    ```\n  \n\n\n### Logging the Provider's Claims (\"Attribute value for email cannot be null\")\n\nIf login fails with **\"Attribute value for email cannot be null\"** (common with ADFS and Azure AD), the provider is not returning the claim named by `useAsUsername`. Enable `security.oauth2.debugLogging` to log the full ID-token / UserInfo claim set and the resolved username, so you can see exactly which claims the provider sends and pick the right `useAsUsername` value.\n\n\n  \n    ```yaml\n    security:\n      oauth2:\n        debugLogging: true\n    ```\n  \n  \n    ```bash\n    SECURITY_OAUTH2_DEBUGLOGGING=true\n    ```\n  \n\n\nThe claims are logged at `INFO` level on each login (and again at `ERROR` level when the username attribute cannot be resolved).\n\n**⚠️ Disable `debugLogging` again as soon as you are done.** It writes personally identifiable information (such as `sub`, `email`, and `name`) to the application logs.\n\n## Known Limitations\n\n- OAuth users must be manually promoted to admin role after first login\n- Provider discovery requires `/.well-known/openid-configuration` endpoint support\n- Auto-login feature requires the Server tier (or higher)\n\n## See Also\n\n- [SAML SSO Configuration](doc:configuration/saml-sso-configuration/saml-sso-configuration) - Enterprise SAML 2.0 setup\n- [System and Security](doc:configuration/system-and-security) - Additional security settings\n- [External Database](doc:configuration/external-database) - User storage configuration",
+      "sourcePath": "docs/Configuration/OAuth SSO Configuration.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/OAuth SSO Configuration.md"
+    },
+    "configuration/ocr": {
+      "id": "configuration/ocr",
+      "title": "OCR (Optical Character Recognition)",
+      "section": "configuration",
+      "markdown": "## OCR Language Packs and Setup\nThis document provides instructions on how to add additional language packs for the OCR tab in Stirling PDF, both inside and outside of Docker.\n\n## How does the OCR Work\nStirling PDF uses Tesseract for its text recognition. All credit goes to them for this awesome work! Note that OCR recognizes text only - it does not perform table-structure or formula recognition.\n\n> **📝 Note: Requires a server backend**\n>\n> OCR runs on a server-side backend with Tesseract installed. The desktop app cannot OCR in local-only mode - connect it to Stirling Cloud or a self-hosted server that has OCR available. To OCR non-English documents, install the matching language pack as described below.\n\n\n## Language Packs\n\nTesseract OCR supports a variety of languages. You can find additional language packs in the Tesseract GitHub repositories:\n\n- [tessdata_fast](https://github.com/tesseract-ocr/tessdata_fast): These language packs are smaller and faster to load but may provide lower recognition accuracy.\n- [tessdata](https://github.com/tesseract-ocr/tessdata): These language packs are larger and provide better recognition accuracy, but may take longer to load.\n\nDepending on your requirements, you can choose the appropriate language pack for your use case. By default, Stirling PDF uses `tessdata_fast` for English, but this can be replaced.\n\n### Installing Language Packs manually\n\n1. Download the desired language pack(s) by selecting the `.traineddata` file(s) for the language(s) you need.\n2. Place the `.traineddata` files in the Tesseract tessdata directory: `/usr/share/tessdata` (or equivalent)\n\n**DO NOT REMOVE EXISTING `eng.traineddata`, IT'S REQUIRED.**\n\n### Docker Setup\n\nIf you are using Docker, you need to expose the Tesseract tessdata directory as a volume in order to use the additional language packs.\n\n\n  \n    Modify your `docker-compose.yml` file to include the following volume configuration:\n\n    ```yaml\n    services:\n      your_service_name:\n        image: your_docker_image_name\n        volumes:\n          - /location/of/trainingData:/usr/share/tessdata\n    ```\n  \n  \n    Add the following to your existing Docker run command:\n\n    ```bash\n    -v /location/of/trainingData:/usr/share/tessdata\n    ```\n  \n\n\n### Non-Docker Setup\n\n\n  \n    For Debian-based systems, use the following commands to manage Tesseract languages:\n\n    ```bash\n    sudo apt update &&\\\n    # All languages\n    # sudo apt install -y 'tesseract-ocr-*'\n    \n    # Find available languages:\n    apt search tesseract-ocr-\n    \n    # View installed languages:\n    dpkg-query -W tesseract-ocr- | sed 's/tesseract-ocr-//g'\n    ```\n  \n  \n    For Fedora systems, use the following commands:\n\n    ```bash\n    # All languages\n    # sudo dnf install -y tesseract-langpack-*\n    \n    # Find available languages:\n    dnf search -C tesseract-langpack-\n    \n    # View installed languages:\n    rpm -qa | grep tesseract-langpack | sed 's/tesseract-langpack-//g'\n    ```\n  \n  \n    Follow these steps to set up Tesseract languages on Windows:\n\n    1. Download desired `.traineddata` files from [tessdata](https://github.com/tesseract-ocr/tessdata) or [tessdata_fast](https://github.com/tesseract-ocr/tessdata_fast)\n    \n    2. Place them in the tessdata folder within your Tesseract installation directory:\n       ```\n       C:\\Program Files\\Tesseract-OCR\\tessdata\n       ```\n    \n    3. Verify the installation by running:\n       ```powershell\n       tesseract --list-langs\n       ```\n    \n    4. Edit your `/configs/settings.yml` and update the `system.tessdataDir`:\n       ```yaml\n       system:\n         tessdataDir: C:/Program Files/Tesseract-OCR/tessdata # path to Tessdata files\n       ```",
+      "sourcePath": "docs/Configuration/OCR.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/OCR.md"
+    },
+    "configuration/other-customisations": {
+      "id": "configuration/other-customisations",
+      "title": "Other Customisations",
+      "section": "configuration",
+      "markdown": "Stirling PDF offers various other customisation options, such as:\n\n## Static File Overrides\n\nYou can override static files (logos, images, favicons, etc.) by placing custom versions in the `customFiles/static/` directory.\n\n### How It Works\n\nStirling PDF checks for files in this order:\n1. **First:** `customFiles/static/` (your custom files)\n2. **Fallback:** Built-in static files embedded in the application\n\nThis means you can replace any static resource by placing a file with the matching path in `customFiles/static/`.\n\n### Finding File Paths to Override\n\nMost static files in the application come from the `frontend/editor/public/` folder in the source code (brand logos live in `frontend/shared/assets/brand/`). To override a file, place it under `customFiles/static/` matching the same path it is served at. The mapping is direct:\n\n**Frontend source → Your override path:**\n- `frontend/editor/public/manifest.json` → `customFiles/static/manifest.json`\n- `frontend/shared/assets/brand/modern-logo/StirlingPDFLogoBlackText.svg` → `customFiles/static/modern-logo/StirlingPDFLogoBlackText.svg`\n- `frontend/shared/assets/brand/classic-logo/StirlingPDFLogoBlackText.svg` → `customFiles/static/classic-logo/StirlingPDFLogoBlackText.svg`\n\n**To see what files you can override:**\n1. Browse the [frontend/editor/public folder on GitHub](https://github.com/Stirling-Tools/Stirling-PDF/tree/main/frontend/editor/public)\n2. Match the directory structure in your `customFiles/static/` folder\n\nCommon files you might want to override:\n\n**Favicons & Icons** (override by placing a matching file at the root of `customFiles/static/`):\n- `favicon.svg`, `favicon.ico` - Browser favicons\n- `apple-touch-icon.png` - iOS home screen icon\n- `android-chrome-192x192.png` - Android icon (192x192)\n- `android-chrome-512x512.png` - Android icon (512x512)\n\n**Logo Variants (Both classic-logo/ and modern-logo/):**\n\nBoth logo directories contain the same file structure - just replace `classic-logo/` or `modern-logo/` with whichever style you're using:\n\n- `{style}/StirlingPDFLogoBlackText.svg` - Logo with black text (light mode)\n- `{style}/StirlingPDFLogoWhiteText.svg` - Logo with white text (dark mode)\n- `{style}/StirlingPDFLogoGreyText.svg` - Logo with grey text\n- `{style}/StirlingPDFLogoNoTextDark.svg` - Logo without text (dark variant)\n- `{style}/StirlingPDFLogoNoTextLight.svg` - Logo without text (light variant)\n- `{style}/logo-tooltip.svg` - Small logo for tooltips\n- `{style}/favicon.ico` - Style-specific favicon\n- `{style}/logo192.png`, `{style}/logo512.png` - PNG versions at different sizes\n- `{style}/Firstpage.png` - First page preview image\n\nWhere `{style}` is either `classic-logo` or `modern-logo` depending on your logo style setting:\n\n**Settings file (configs/settings.yml):**\n```yaml\nui:\n  logoStyle: classic  # Options: 'classic' or 'modern'\n```\n\n**Environment variable (Docker):**\n```bash\nUI_LOGOSTYLE=classic\n```\n\n**In-app configuration:**\nSettings → Configuration → System Settings → Logo Style (requires login enabled)\n\n**Other Assets:**\n- `robots.txt` - Search engine directives\n- `manifest.json`, `manifest-classic.json` - Web app manifests\n- Images, fonts, and locales\n\n### Example: Custom Favicon\n\n```bash\n# Your directory structure\ncustomFiles/\n  └── static/\n      ├── favicon.svg\n      └── favicon.ico\n```\n\nDocker compose:\n```yaml\nvolumes:\n  - ./customFiles:/customFiles:rw\n```\n\nRestart the container - your custom favicons will be used!\n\n### Example: Custom Logo (Simple)\n\n```bash\ncustomFiles/\n  └── static/\n      └── classic-logo/\n          └── StirlingPDFLogoBlackText.svg\n```\n\nThis overrides the classic logo with black text (used in light mode).\n\n**Important:** Make sure your logo style is set to `classic` in your configuration:\n```yaml\nui:\n  logoStyle: classic  # Must match the directory you're overriding!\n```\n\nOr via environment variable:\n```bash\nUI_LOGOSTYLE=classic\n```\n\nIf you have `logoStyle: modern` set, override files in `modern-logo/` instead!\n\n### Example: Complete Branding Customization\n\nTo fully rebrand Stirling PDF with your company logo, override multiple variants:\n\n```bash\ncustomFiles/\n  └── static/\n      ├── favicon.svg                                    # Main favicon\n      ├── favicon.ico                                    # Legacy favicon\n      └── classic-logo/                                  # Or modern-logo/ if using modern style\n          ├── StirlingPDFLogoBlackText.svg              # Light mode with text\n          ├── StirlingPDFLogoWhiteText.svg              # Dark mode with text\n          ├── StirlingPDFLogoNoTextLight.svg            # Light mode icon only\n          ├── StirlingPDFLogoNoTextDark.svg             # Dark mode icon only\n          ├── logo-tooltip.svg                          # Small icon\n          ├── favicon.ico                               # Style-specific favicon\n          └── Firstpage.png                             # Homepage preview\n```\n\n**Important:** Set your logo style to match the directory:\n```yaml\nui:\n  logoStyle: classic  # Use 'classic' if overriding classic-logo/, 'modern' if overriding modern-logo/\n```\n\nOr via environment variable: `UI_LOGOSTYLE=classic`\n\n**Tips:**\n- For consistent branding across light/dark modes, provide both:\n  - `StirlingPDFLogoBlackText.svg` (shows on light backgrounds)\n  - `StirlingPDFLogoWhiteText.svg` (shows on dark backgrounds)\n- You can also configure this in-app: Settings → Configuration → System Settings → Logo Style (if you have login enabled)\n\n### Advanced: Overriding Built Files (HTML, JS, CSS)\n\n**⚠️ For developers only!**\n\nFiles like `index.html`, JavaScript bundles, and CSS are **generated** by the build process from `frontend/editor/src/`. To override these:\n\n1. Clone the Stirling PDF repository\n2. Make your changes to the React source code in `frontend/editor/src/`\n3. Build the frontend: `task frontend:build` (from the repository root)\n4. The built files appear in `frontend/editor/dist/`\n5. Copy the specific files you want to override to `customFiles/static/` matching the path structure\n\n**Example:** To override `index.html`:\n```bash\n# After building the frontend\ncp frontend/editor/dist/index.html customFiles/static/index.html\n```\n\n**Warning:** Built files may include hashed filenames (e.g., `assets/index-abc123.js`) that change with each build. Overriding these requires matching the exact filename from your build and is not recommended for most users.\n\n---\n\n## Defaulting Language\nDefault language selection via the `SYSTEM_DEFAULTLOCALE` environment variable. Accepted values include `de-DE`, `fr-FR`, `ar-AR` and all other languages codes that are within Stirling PDFs current list.\n\n## Google Search Visibility (robots.txt)\nEnable or disable search engine visibility (via `robots.txt`) with the `SYSTEM_GOOGLEVISIBILITY` environment variable, or in `configs/settings.yml`:\n```yaml\nsystem:\n  googlevisibility: true  # 'true' to allow Google visibility, 'false' to disallow\n```\n\n## Custom Root path\nHost the interface under a sub-path with the `SYSTEM_ROOTURIPATH` environment variable.\nThis is for changing websites like stirlingtools.com to instead host the interface at stirlingtools.com/demo:\n```bash\nSYSTEM_ROOTURIPATH=/demo\n```\nThe setting can also be written in `configs/settings.yml`:\n```yaml\nserver:\n  servlet:\n    context-path: /demo\n```\n\n## Enable/Disable Analytics\nAnalytics can be enabled/disabled with ``SYSTEM_ENABLEANALYTICS`` or\n```yaml\nsystem:\n  enableAnalytics: 'true'\n```\nIn configs/settings.yml",
+      "sourcePath": "docs/Configuration/Other Customisations.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Other Customisations.md"
+    },
+    "configuration/performance-optimization": {
+      "id": "configuration/performance-optimization",
+      "title": "Performance Optimization & Sizing",
+      "description": "Resource sizing and scaling guidance for Stirling PDF deployments",
+      "section": "configuration",
+      "markdown": "PDF processing is memory-intensive - a single large PDF can expand to many times its file size in memory during processing. This guide helps you size your deployment correctly.\n\n---\n\n## How Stirling PDF Uses Memory\n\nStirling PDF loads PDFs into memory using a tiered strategy based on file size:\n\n| File Size | Strategy | Memory Impact |\n|---|---|---|\n| Up to 10 MB | Loaded entirely into memory | Fast, but consumes memory proportional to file size |\n| 10 MB to 50 MB | Partially in memory, remainder stored on disk | Moderate memory usage with disk spillover |\n| Over 50 MB | Fully stored on disk during processing | Minimal memory usage, but requires adequate disk space |\n\nThe application also monitors memory pressure. If available memory drops too low, all operations are forced into disk-backed mode regardless of file size.\n\n> **⚠️ Caution: Memory-Intensive Operations**\n>\n> A 50 MB PDF with complex vector graphics, embedded fonts, and many pages can expand to 200-500 MB in memory during processing. Operations that render pages (such as PDF-to-image conversion) and OCR are particularly memory-intensive. Plan for several times the maximum expected file size per concurrent operation.\n\n\n---\n\n## Resource Recommendations\n\n\n\n\n**Recommended specifications:**\n- **CPU:** 2 cores (4+ recommended)\n- **RAM:** 4 GB\n- **Disk:** 10 GB free space\n\n**Docker Compose:**\n```yaml\nservices:\n  stirling-pdf:\n    image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest\n    deploy:\n      resources:\n        limits:\n          memory: 4G\n          cpus: '2.0'\n```\n\n\n\n\n**Recommended specifications:**\n- **CPU:** 4-8 cores\n- **RAM:** 8-16 GB\n- **Disk:** 50 GB (SSD recommended)\n\n**Docker Compose:**\n```yaml\nservices:\n  stirling-pdf:\n    image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest\n    environment:\n      PROCESS_EXECUTOR_SESSION_LIMIT_LIBRE_OFFICE_SESSION_LIMIT: 2\n    deploy:\n      resources:\n        limits:\n          memory: 8G\n          cpus: '4.0'\n```\n\n**Consider:**\n- Increase LibreOffice session limit for faster document conversions - see [LibreOffice Parallel Processing](doc:configuration/libreoffice-parallel-processing)\n- External PostgreSQL database for reliability\n\n\n\n\n**Recommended specifications:**\n- **CPU:** 8+ cores\n- **RAM:** 16-32 GB\n- **Disk:** 100+ GB, SSD strongly recommended\n\n**Docker Compose:**\n```yaml\nservices:\n  stirling-pdf:\n    image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest\n    environment:\n      PROCESS_EXECUTOR_SESSION_LIMIT_LIBRE_OFFICE_SESSION_LIMIT: 4\n      PROCESS_EXECUTOR_SESSION_LIMIT_TESSERACT_SESSION_LIMIT: 2\n    deploy:\n      resources:\n        limits:\n          memory: 16G\n          cpus: '8.0'\n```\n\n**Architecture considerations:**\n- Multiple instances behind a load balancer with session affinity\n- Remote UNO servers for LibreOffice scaling - see [LibreOffice Parallel Processing](doc:configuration/libreoffice-parallel-processing)\n- External PostgreSQL database (enterprise feature)\n- Shared `/configs` volume across instances for consistent settings\n\n> **💡 Tip: Server/Enterprise Recommended**\n>\n> For large organizations, **Server or Enterprise plans** provide SSO, external database support, advanced monitoring, and dedicated support.\n>\n> [Learn more](doc:server-admin-onboarding)\n\n\n\n\n\n---\n\n## Fine Tuning\n\nFor most deployments, Stirling PDF's defaults work well and no manual tuning is needed. If you are experiencing performance issues with large files or high concurrency, you can adjust the memory allocated to the application using the `JAVA_TOOL_OPTIONS` environment variable:\n\n```yaml\nservices:\n  stirling-pdf:\n    environment:\n      JAVA_TOOL_OPTIONS: \"-Xms512m -Xmx4g\"\n```\n\n`-Xms` sets the initial memory allocation and `-Xmx` sets the maximum. If running in Docker or Kubernetes with memory limits, set the container limit to **at least 1.5x the `-Xmx` value** to leave room for background processes like LibreOffice and Tesseract.\n\n---\n\n## Resource-Intensive Operations\n\nSome operations require significantly more resources than others. If your organization primarily uses specific tools, you should size your deployment based on the most resource-heavy operations your users will perform.\n\n| Operation | CPU Impact | Memory Impact | Notes |\n|---|---|---|---|\n| Merge / Split | Low | Proportional to total file sizes | Lightweight file operations |\n| OCR (Tesseract) | Very High | High | CPU-bound image analysis |\n| File Conversion (LibreOffice) | High | High | Single-threaded per instance - see [LibreOffice Parallel Processing](doc:configuration/libreoffice-parallel-processing) to scale. |\n| PDF-to-Image | Moderate | Very High | Page rendering expands memory significantly |\n| PDF/A Conversion | Moderate | High | Font embedding and color profiles |\n| Compression | Moderate | High | Rewriting internal PDF structures |\n\nFor example, if your team primarily uses OCR and document conversion, you will need significantly more resources than a team that mainly merges and splits PDFs. Adjust your [Process Limits](doc:configuration/process-limits) and resource allocation accordingly.\n\n---\n\n## Related\n\n- [Process Limits](doc:configuration/process-limits) - Configure session limits and timeouts for all external tools\n- [LibreOffice Parallel Processing](doc:configuration/libreoffice-parallel-processing) - Scale document conversions with multiple instances\n- [Production Deployment Guide](doc:server-admin-onboarding) - Full production setup walkthrough\n- [Diagnostics](doc:configuration/diagnostics) - Collect system and application diagnostics for troubleshooting",
+      "sourcePath": "docs/Configuration/Performance-Optimization.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Performance-Optimization.md"
+    },
+    "configuration/pipeline": {
+      "id": "configuration/pipeline",
+      "title": "Pipeline Automation (Automate)",
+      "description": "Create automated multi-step PDF workflows with the Automate tool",
+      "section": "configuration",
+      "markdown": "Create powerful automated workflows that combine multiple PDF operations into sequential processes. The Automate tool (formerly called \"Pipeline\") lets you build, save, and reuse complex PDF processing workflows.\n\n> **ℹ️ Info: V2.0 Update - New \"Automate\" Feature**\n>\n> In V2.0, the pipeline frontend interface has been redesigned as the **\"Automate\"** feature with an improved user experience for creating and managing automation workflows. The backend pipeline system (JSON configuration and folder scanning) continues to work the same way.\n>\n> **What changed:**\n> - Backend pipeline processing - **No changes**\n> - JSON pipeline configurations - **Still work exactly the same**\n> - Folder scanning with pipelines - **Still works the same**\n> - Frontend interface - **Now called \"Automate\" with better UX**\n>\n> If you have existing pipeline JSON files, they continue to work in V2.0's Automate feature.\n\n\n---\n\n## What is Pipeline Automation?\n\nPipeline automation allows you to:\n- **Chain operations** - Combine multiple PDF tools in sequence\n- **Save workflows** - Reuse common operation sequences\n- **Automate processing** - Process files automatically with folder scanning\n- **Standardize procedures** - Ensure consistent processing across teams\n- **Batch process** - Apply same workflow to multiple files\n\nThink of it as **\"macros for PDFs\"** - record your steps once, replay them unlimited times.\n\n---\n\n## Why Use Pipelines?\n\n### Without Pipelines:\n1. Upload PDF to Split tool, download split files\n2. Upload each split file to Watermark tool, download watermarked files\n3. Upload each watermarked file to Compress tool, download final files\n4. Repeat for every batch of documents\n\n### With Pipelines:\n1. Create \"Split-Watermark-Compress\" pipeline once\n2. Upload PDFs, automatic processing, download results\n3. Reuse same pipeline for all future batches\n\n**Time saved:** Minutes per file, hours per day.\n\n---\n\n## Key Concepts\n\n### Operations\nIndividual PDF tools that perform specific tasks:\n- Split, Merge, Compress, Watermark, etc.\n- Each operation has configurable parameters\n- Operations execute in the order you define\n\n### Pipeline\nA sequence of operations with saved configurations:\n- Named workflow (e.g., \"Invoice Processing\")\n- Ordered list of operations\n- Pre-configured settings for each operation\n- Reusable across multiple files\n\n### Pipeline Configuration (JSON)\nText file that defines your pipeline:\n- Lists operations in order\n- Specifies parameters for each operation\n- Can be shared, versioned, and backed up\n- Human-readable and editable\n\n### Folder Scanning\nAutomated processing mode:\n- Watch a folder for new files\n- Automatically apply pipeline to new files\n- Move processed files to output folder\n- Unattended batch processing\n\n---\n\n## Getting Started with Automate\n\n### Accessing the Automate Tool\n\n1. **From Home Page**\n   - Click \"Automate\" in the Advanced Tools section\n   - Or search for \"automate\" or \"pipeline\"\n\n2. **Open the Automation Builder**\n   - Click \"Create New Automation\"\n   - The automation builder opens\n\n---\n\n## Building Your First Pipeline\n\n## Steps to Configure and Use Your Pipeline\n\n1. **Start a New Automation**\n   - On the Automate screen, click **Create New Automation**.\n\n2. **Enter Automation Name**\n   - Provide a name for your automation in the designated field (you can also add an optional description and icon).\n\n3. **Add Tools**\n   - Choose the tools for your automation (e.g., **Split Pages**) with **Add Tool**. Tools run in the order you add them.\n\n4. **Configure Tool Settings**\n   - Configure each added tool. A tool shows a **! Not Configured** marker until its settings are saved.\n\n5. **Add More Tools**\n   - You can add and reorder multiple tools. Make sure each tool is configured.\n\n6. **Save Tool Settings**\n   - Click **Save Configuration** in each tool's settings dialog after customizing it.\n\n7. **Save the Automation**\n   - Click **Save Automation** once all tools are configured. The Save button stays disabled until the automation is complete.\n\n8. **Download Pipeline Configuration**\n   - The Automate UI offers two download buttons:\n     - **Export** - downloads `<name>.automate.json` in the **native Automate format** with frontend tool IDs. Use this for re-importing into another Stirling PDF instance via the UI.\n     - **Export for Folder Scanning** - downloads `<name>.folder-scan.json` in the **backend format** with full endpoint paths. Use this for the REST API and for folder scanning.\n   - To pre-load a pipeline for all users, place a folder-scanning-format JSON file in `/pipeline/defaultWebUIConfigs/` - it will appear in the dropdown.\n\n9. **Run the Automation**\n   - Once saved, select the automation from the list, add your files, and run it.\n\n10. **Note on Web UI Limitations**\n    - The current web UI version does not support operations that require multiple different types of inputs, such as adding a separate image to a PDF.\n\n### Current Limitations\n\n- Cannot have more than one of the same operation.\n- Cannot input additional files via UI.\n- All files and operations run in serial mode.\n\n---\n\n## Example Pipelines\n\n### Example 1: Invoice Processing\n**Goal:** Process scanned invoices for archival\n\n**Pipeline Steps:**\n1. **OCR** - Make invoices searchable\n   - Language: English\n   - Preserve formatting: Yes\n2. **Crop** - Remove scanner edges\n   - Margins: 0.5 inches all sides\n3. **Add Watermark** - Mark as processed\n   - Text: \"PROCESSED [DATE]\"\n   - Position: Bottom right\n   - Opacity: 50%\n4. **Compress** - Reduce file size\n   - Level: Medium\n5. **Add Password** - Secure documents\n   - Password: [configured per run]\n\n**Use Case:** Accounting department processing hundreds of invoices monthly\n\n---\n\n### Example 2: Report Distribution\n**Goal:** Prepare reports for external sharing\n\n**Pipeline Steps:**\n1. **Remove Pages** - Remove internal pages\n   - Pages: 2,3 (remove cover sheets)\n2. **Add Page Numbers** - Number all pages\n   - Position: Bottom center\n   - Format: \"Page X of Y\"\n3. **Add Stamp** - Add \"CONFIDENTIAL\" stamp\n   - Position: Top right\n   - Color: Red\n4. **Change Permissions** - Restrict editing\n   - Allow printing: Yes\n   - Allow editing: No\n5. **Compress** - Optimize for email\n   - Level: High\n\n**Use Case:** Monthly reports sent to clients\n\n---\n\n### Example 3: Document Standardization\n**Goal:** Standardize format of received documents\n\n**Pipeline Steps:**\n1. **Rotate** - Fix orientation\n   - Mode: Auto-detect\n2. **Scale Pages** - Standardize to Letter size\n   - Target: 8.5 x 11 inches\n3. **Add Metadata** - Tag documents\n   - Title: [Auto-extracted]\n   - Author: \"Company Name\"\n   - Keywords: \"Standardized, Processed\"\n4. **Remove Annotations** - Clean markup\n5. **Flatten** - Remove form fields\n\n**Use Case:** HR department standardizing employee submissions\n\n---\n\n### Example 4: Batch Conversion\n**Goal:** Convert and optimize image scans\n\n**Pipeline Steps:**\n1. **Convert** - Images to PDF\n   - Source: JPG, PNG\n2. **OCR** - Add text layer\n   - Language: Multiple\n3. **Remove Blanks** - Delete empty pages\n   - Threshold: 95%\n4. **Compress** - Optimize size\n   - Level: Medium\n5. **PDF/A** - Convert for archival\n   - Version: PDF/A-2b\n\n**Use Case:** Digitization project for paper archives\n\n---\n\n## Common Pipeline Patterns\n\n### Quality Enhancement Pipeline\n**Pattern:** Improve scanned document quality\n```\nOCR → Remove Blanks → Adjust Contrast → Compress → Add Metadata\n```\n\n### Security Pipeline\n**Pattern:** Secure documents for distribution\n```\nRemove Metadata → Add Watermark → Add Password → Change Permissions\n```\n\n### Compression Pipeline\n**Pattern:** Reduce file sizes for storage/email\n```\nRemove Annotations → Remove Images (optional) → Compress → Validate\n```\n\n### Branding Pipeline\n**Pattern:** Add company branding to documents\n```\nAdd Watermark → Add Stamp → Add Page Numbers → Add Metadata\n```\n\n### Preparation Pipeline\n**Pattern:** Prepare documents for printing\n```\nRotate → Scale Pages → Booklet Imposition → Remove Annotations\n```\n\n---\n\n## JSON Configuration\n\n### Basic Structure\n\nA pipeline JSON file has a `name` and a `pipeline` array. Each entry has an `operation` (the full API endpoint path) and a `parameters` object:\n\n```json\n{\n  \"name\": \"My Pipeline\",\n  \"pipeline\": [\n    {\n      \"operation\": \"/api/v1/general/split-pages\",\n      \"parameters\": {\n        \"pageNumbers\": \"5\"\n      }\n    },\n    {\n      \"operation\": \"/api/v1/misc/compress-pdf\",\n      \"parameters\": {\n        \"optimizeLevel\": 5,\n        \"expectedOutputSize\": \"\"\n      }\n    }\n  ]\n}\n```\n\n> **📝 Note: Operation names are full endpoint paths**\n>\n> Pipeline operation names use the **full REST API path**, not short names. For example, use `/api/v1/general/split-pages` (not just `split-pages`). The Folder-Scanning export from the Automate UI produces these paths automatically.\n>\n> If you have older pipeline JSONs that used short names, regenerate them from the Automate UI using **Export for Folder Scanning**.\n\n\n### Optional fields\n\nFor folder scanning (not used by the REST API):\n\n```json\n{\n  \"name\": \"...\",\n  \"pipeline\": [ ... ],\n  \"outputDir\": \"{outputFolder}/{folderName}\",\n  \"outputFileName\": \"{filename}-{pipelineName}-{date}-{time}\"\n}\n```\n\n`outputDir` and `outputFileName` accept the placeholders `{outputFolder}`, `{folderName}`, `{filename}`, `{pipelineName}`, `{date}`, `{time}`.\n\n---\n\n## Operation and parameter reference\n\nPipeline operations use the **full endpoint paths** of Stirling PDF's REST API, with the same field names. So once you know the underlying endpoint, you know the pipeline operation - no separate vocabulary to learn.\n\nFor the canonical list of operations and the full parameter schema for each, see:\n\n- **Local Swagger UI** at `/swagger-ui.html` on your instance - includes every endpoint, parameter types, and lets you try requests live\n- **Online API reference** - the [Stirling PDF API documentation](https://app.swaggerhub.com/apis-docs/Frooodle/Stirling-PDF/) and the [Scalar API registry](https://registry.scalar.com/@stirlingpdf/apis/stirling-pdf-processing-api/)\n\nSee [API Documentation](doc:api) for authentication and general API usage.\n\nPipelines can only call endpoints under `/api/v1/general/...`, `/api/v1/misc/...`, `/api/v1/security/...`, `/api/v1/convert/...`, `/api/v1/filter/...`, and `/api/v1/ai/tools/...`. Anything outside those namespaces is rejected by the pipeline processor with a `SecurityException` - this includes `/api/v1/info/...`, `/api/v1/auth/...`, `/api/v1/admin/...`, and `/api/v1/pipeline/handleData` itself (pipelines cannot recursively call themselves).\n\nThe `/api/v1/ai/tools/...` namespace currently exposes proprietary AI features (e.g. `math-auditor-agent`, `pdf-comment-agent`) and is only available with the corresponding paid license.\n\n> **💡 Tip: Build it in the UI, export it as JSON**\n>\n> The fastest way to get a correct pipeline JSON for any combination of operations is to build it visually in the **Automate** tool and click **Export for Folder Scanning**. The exported file uses exactly the format the API expects, with the right operation paths and parameters already filled in for you.\n\n\n---\n\n## Filter / conditional operations\n\nFilter operations let you **branch a pipeline**. Each one checks a property of the file and either lets the file **continue to the next steps** or **drops it** so the rest of the pipeline never sees it. This is how you say \"only keep processing files that match X\" inside an automation - for example, only run OCR on scans that have no text yet, or only watermark documents over a certain page count.\n\nA file that does not match a filter is simply removed from the rest of the pipeline. It is not treated as an error.\n\nThese operation names go in your pipeline configuration:\n\n| Operation name | Keeps the file when... |\n|---|---|\n| `filter-contains-text` | the PDF contains a given piece of text (you can limit the check to specific pages) |\n| `filter-contains-image` | the PDF contains an image (you can limit the check to specific pages) |\n| `filter-page-count` | the page count is greater than, equal to, or less than a value you set |\n| `filter-page-size` | the first page's size compares to a standard page size you choose |\n| `filter-file-size` | the file size compares to a value you set |\n| `filter-page-rotation` | the first page's rotation compares to a value you set |\n\nThe four comparison filters (`filter-page-count`, `filter-page-size`, `filter-file-size`, `filter-page-rotation`) take a `comparator` of `Greater`, `Equal`, or `Less`.\n\n**Example - only OCR files that are image-only scans:** detect scans with no text layer using `filter-contains-image`, then route the matching files through the OCR operation. Files that already contain text are dropped before the OCR step, so you only spend processing time on the scans that need it.\n\n```json\n{\n  \"name\": \"OCR only image-only scans\",\n  \"pipeline\": [\n    {\"operation\": \"/api/v1/filter/filter-contains-image\", \"parameters\": {\"pageNumbers\": \"all\"}},\n    {\"operation\": \"/api/v1/misc/ocr-pdf\", \"parameters\": {\"languages\": [\"eng\"], \"ocrType\": \"skip-text\"}}\n  ]\n}\n```\n\nThese filter operations work both in the REST API and in folder scanning.\n\n---\n\n\n## REST API: `POST /api/v1/pipeline/handleData`\n\nTrigger a pipeline programmatically via the REST API. Use this from scripts, automation platforms (n8n, Zapier, Make, Power Automate), or your own integrations.\n\n### Request\n\n- **Method**: `POST`\n- **URL**: `/api/v1/pipeline/handleData`\n- **Content-Type**: `multipart/form-data`\n- **Authentication**: When security is enabled, set the `X-API-KEY` header. See [API Documentation](doc:api) for details.\n\n### Multipart fields\n\n| Field | Type | Required | Purpose |\n|---|---|---|---|\n| `fileInput` | file | yes | One or more PDF files. Repeat the field for multiple files. |\n| `json` | string | yes | The pipeline configuration JSON. |\n\nYou don't need to include `fileInput` inside the `parameters` object - the pipeline processor injects each uploaded file automatically. The Automate UI's \"Export for Folder Scanning\" includes `\"fileInput\": \"automated\"` as a marker in every step, which the backend ignores; you can leave it in or strip it out, both work.\n\n### Optional query parameters\n\n- `?async=true` - run the pipeline asynchronously and return a job ID instead of the file. Poll `GET /api/v1/general/job/{id}` for progress.\n\n### Response\n\n- **Single output file**: returned directly as `application/octet-stream` with `Content-Disposition: attachment; filename=...`.\n- **Multiple output files**: returned as `output.zip`.\n- **Async mode**: returns a JSON body with the job ID.\n\n### Working curl example\n\n```bash\ncurl -X POST \"http://localhost:8080/api/v1/pipeline/handleData\" \\\n  -H \"X-API-KEY: $STIRLING_API_KEY\" \\\n  -F \"fileInput=@/path/to/input.pdf\" \\\n  -F 'json={\n    \"name\": \"Repair-then-compress\",\n    \"pipeline\": [\n      {\"operation\": \"/api/v1/misc/repair\", \"parameters\": {}},\n      {\"operation\": \"/api/v1/misc/compress-pdf\", \"parameters\": {\"optimizeLevel\": 2}}\n    ]\n  }' \\\n  --output result.pdf\n```\n\nFor multiple files use repeated `-F \"fileInput=@...\"` flags; the response will be `output.zip`. For the full parameter list for each operation, see the API docs linked above.\n\n### Error responses\n\n| Situation | HTTP status | Body |\n|---|---|---|\n| Auth required and no key supplied | 401 | `{\"error\":\"Unauthorized\",\"message\":\"Authentication required...\",\"status\":401}` |\n| Multipart parsing failed (missing field, bad JSON) | 400 | Spring's standard error JSON |\n| Invalid operation name, disallowed endpoint, or missing required parameter | 200 with empty body | The server logs an `IllegalArgumentException` but returns an empty response. |\n| Downstream endpoint returned non-2xx | 200 with partial/empty body | The error is logged but does not surface in the HTTP response. |\n\n> **⚠️ Warning: Validate response bodies**\n>\n> Errors that occur after multipart parsing currently collapse to `HTTP 200` with an empty body. Always check that the response is a non-empty PDF (starts with `%PDF-`) or a ZIP (starts with `PK\\x03\\x04`) before treating the call as successful.\n\n\n### Tips\n\n- **Build in the UI, export the JSON.** The fastest way to get a correct JSON is to build the pipeline in the Automate UI, then click **Export for Folder Scanning**. The exported file works directly with `handleData`. The other button, **Export**, produces a different \"native Automate\" format (uses an `operations` key with frontend tool IDs like `\"merge\"`) that is only for re-importing into another Automate UI, not for the API.\n- **No image / file parameters.** Operations that take an additional file input (image watermarks, separate overlay PDFs, attaching files) cannot be expressed in pipeline JSON via the REST API. Call those endpoints directly instead.\n- **List parameters become repeated form fields.** Internally the processor expands `[\"eng\",\"deu\"]` into two `languages=eng` and `languages=deu` form parts, which is what the underlying endpoints expect.\n- **Filters drop files.** A filter step that doesn't match keeps the file out of later steps. Useful for \"process only PDFs that contain X\".\n- **Multi-input operations batch.** Operations marked multi-input (e.g. `merge-pdfs`) receive every matching file in a single call. If no files in the working set match the operation's expected extension, the step logs `No files with extension X found for operation Y...` and continues with the other files.\n- **Unknown JSON fields are ignored.** The pipeline parser silently drops fields it doesn't recognise, so you can add `description`, `icon`, or other metadata at the top level without breaking anything.\n\n---\n\n## Folder Scanning Setup\n\nAutomate processing of files placed in watched folders.\n\n### How Folder Scanning Works\n\n1. **Watch Input Folder** - Monitor for new files\n2. **Detect New Files** - Identify PDFs added to folder\n3. **Apply Pipeline** - Process with configured pipeline\n4. **Output Results** - Save to output folder\n5. **Archive Originals** - Move processed files (optional)\n\n### Directory Structure\n\n```\n/pipeline/\n  ├── watchedFolders/\n  │   ├── invoice-processing/\n  │   │   ├── my-pipeline.json   # any *.json file in the folder is the pipeline config\n  │   │   ├── invoice-001.pdf    # drop PDFs directly into the folder root\n  │   │   ├── invoice-002.pdf\n  │   │   └── processing/        # auto-created by the scanner while a file is in flight\n  │   └── report-prep/\n  │       └── ...\n  ├── finishedFolders/           # outputs appear here by default (per `outputDir` placeholder)\n  └── defaultWebUIConfigs/       # pre-loaded pipelines exposed in the Automate UI dropdown\n      ├── invoice.json\n      └── reports.json\n```\n\n### Configuration File\n\nDrop a `.json` file (any name) into each watched folder. The first `.json` the scanner finds is used as the pipeline:\n\n```json\n{\n  \"name\": \"Invoice Processing\",\n  \"pipeline\": [\n    {\"operation\": \"/api/v1/misc/ocr-pdf\", \"parameters\": {\n       \"languages\": [\"eng\"], \"ocrType\": \"skip-text\",\n       \"ocrRenderType\": \"hocr\", \"deskew\": true, \"clean\": false,\n       \"cleanFinal\": false, \"sidecar\": false, \"removeImagesAfter\": false}}\n  ],\n  \"outputDir\": \"{outputFolder}/{folderName}\",\n  \"outputFileName\": \"{filename}-processed-{date}\"\n}\n```\n\nPDFs go directly in the watched folder root (NOT in an `input/` subdirectory). The scanner auto-creates a `processing/` subfolder while a file is being worked on, and writes outputs to wherever `outputDir` resolves to (typically `/pipeline/finishedFolders/...` via the `{outputFolder}` placeholder).\n\nThe watched-folder scanner runs every 60 seconds.\n\n**Learn more:** [Folder Scanning Guide](doc:configuration/folderscanning)\n\n---\n\n## Best Practices\n\n### Pipeline Design\n\n1. **Test Incrementally**\n   - Build pipeline one operation at a time\n   - Test each step before adding the next\n   - Verify output at each stage\n\n2. **Order Operations Logically**\n   - Do OCR before text-based operations\n   - Remove pages before processing remaining pages\n   - Compress last to optimize final output\n\n3. **Use Descriptive Names**\n   - Name pipelines clearly: \"Invoice-OCR-Watermark-Archive\"\n   - Add descriptions in comments\n   - Version your pipeline files\n\n4. **Handle Errors Gracefully**\n   - Test with various file types\n   - Consider edge cases (empty PDFs, locked files)\n   - Monitor logs for errors\n\n### Performance Optimization\n\n1. **Minimize Operations**\n   - Combine similar operations when possible\n   - Remove unnecessary steps\n   - Don't duplicate efforts\n\n2. **Optimize Compression**\n   - Compress once at the end, not multiple times\n   - Choose appropriate compression level\n   - Balance quality vs. file size\n\n3. **Batch Intelligently**\n   - Group similar files together\n   - Process during off-peak hours\n   - Monitor system resources\n\n### Maintenance\n\n1. **Version Control**\n   - Keep pipeline JSONs in git repository\n   - Track changes over time\n   - Document modifications\n\n2. **Regular Review**\n   - Audit pipelines quarterly\n   - Remove unused pipelines\n   - Update for new requirements\n\n3. **Monitor Performance**\n   - Check processing times\n   - Review error logs\n   - Optimize slow operations\n\n---\n\n## Troubleshooting\n\n### Pipeline Fails to Execute\n\n**Symptoms:** Pipeline starts but doesn't complete\n\n**Common Causes:**\n- Invalid parameter values\n- Unsupported file format\n- Missing dependencies (OCR languages, fonts)\n- File permissions issues\n\n**Solutions:**\n1. Validate JSON configuration\n2. Test each operation individually\n3. Check server logs for errors\n4. Verify required dependencies installed\n\n---\n\n### `handleData` Returns Empty Response\n\n**Symptoms:** REST API call returns HTTP 200 with an empty body.\n\n**Cause:** Errors after multipart parsing (invalid operation name, missing required parameter, downstream endpoint failure) currently collapse to `200 OK` with no body. Check the server logs for the actual error.\n\n**Common reasons:**\n- Operation name used short form (e.g. `compress-pdf`) instead of full path (`/api/v1/misc/compress-pdf`)\n- Operation references an endpoint outside the allowed namespaces (only `general`, `misc`, `security`, `convert`, `filter`, `ai/tools` are permitted)\n- A required parameter was omitted (check the schema for the underlying endpoint in the [Swagger UI / API reference](#operation-and-parameter-reference))\n- The pipeline tries to call `/api/v1/pipeline/handleData` recursively\n\n---\n\n### Folder Scanning Not Working\n\n**Symptoms:** Files not processed automatically\n\n**Possible Issues:**\n- Folder permissions incorrect\n- Pipeline configuration invalid\n- Folder scanning not enabled\n\n**Solutions:**\n1. Check folder permissions (read/write access)\n2. Test pipeline manually first\n3. Check `docker logs` for errors\n4. Ensure folder scanning feature enabled\n5. The scanner runs once every 60 seconds - allow that long after dropping a file\n\n---\n\n### Operation Parameters Not Applying\n\n**Symptoms:** Pipeline runs but doesn't use specified settings\n\n**Causes:**\n- Incorrect parameter names\n- Wrong parameter data types\n- Parameters not supported in operation\n\n**Solutions:**\n1. Check parameter names against the endpoint's schema in the [Swagger UI / API reference](#operation-and-parameter-reference)\n2. Verify parameter value types (string, number, boolean)\n3. Test the same parameters by calling the endpoint directly first\n\n---\n\n### Results Not as Expected\n\n**Symptoms:** Pipeline completes but output incorrect\n\n**Debugging Steps:**\n1. Test each operation individually\n2. Check intermediate outputs\n3. Verify operation order makes sense\n4. Review parameter values\n5. Test with simpler input files\n\n---\n\n## Pipeline vs. Multi-Tool vs. Manual\n\n### Use Pipeline/Automate When:\n- Same workflow repeated frequently\n- Predictable, consistent operations\n- Automated folder processing needed\n- No manual intervention required\n- Standardizing team processes\n- Large batch processing\n- Scheduled/unattended processing\n\n### Use Multi-Tool When:\n- Workflow varies per file\n- Need visual feedback at each step\n- Experimenting with different settings\n- Manual decision points in workflow\n- One-time complex tasks\n\n### Use Individual Tools When:\n- Single, simple operation\n- Quick one-off task\n- Learning how operations work\n- No need for automation\n\n---\n\n## Security Considerations\n\n### Pipeline Files\n- **Protect JSON configs** - May contain passwords or sensitive settings\n- **Restrict folder access** - Limit who can create/modify pipelines\n- **Review before deploying** - Audit pipelines for security issues\n\n### Folder Scanning\n- **Isolate watched folders** - Don't expose to untrusted users\n- **Monitor activity** - Log all processing for audit trail\n- **Secure output folders** - Protect processed documents appropriately\n\n### Automated Processing\n- **Validate inputs** - Ensure only expected files processed\n- **Error handling** - Don't expose sensitive error messages\n- **Resource limits** - Prevent resource exhaustion attacks\n\n---\n\n## Related Documentation\n\n- **[Folder Scanning Setup](doc:configuration/folderscanning)** - Detailed folder scanning guide\n- **[Multi-Tool](doc:functionality/multi-tool)** - Interactive multi-operation tool\n- **[Endpoint Customisation](doc:configuration/endpoint-or-feature-customisation)** - Operation names and IDs\n- **[API Documentation](doc:api)** - Programmatic pipeline execution\n- **[Advanced Tools](doc:functionality/advanced-tools)** - Other automation features\n\n---\n\n## Summary\n\nPipeline automation (Automate tool) transforms Stirling PDF into a workflow engine:\n\n- **Chain operations** - Combine multiple PDF tools sequentially\n- **Save workflows** - Reusable pipeline configurations\n- **Folder scanning** - Automated unattended processing\n- **REST API** - Trigger pipelines from any external system\n- **Standardization** - Consistent processing across teams\n- **Efficiency** - Minutes saved per file, hours per day\n\n**Perfect for:** Repetitive workflows, batch processing, automated document preparation, and standardized procedures.\n\nReady to automate? Create your first pipeline and transform how you process PDFs.",
+      "sourcePath": "docs/Configuration/Pipeline.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Pipeline.md"
+    },
+    "configuration/process-limits": {
+      "id": "configuration/process-limits",
+      "title": "Process Limits",
+      "section": "configuration",
+      "markdown": "Stirling PDF sometimes runs external tools to handle tools such as conversions or advanced operations\nTools like LibreOffice, Tesseract, Ghostscript, and others. All these tools are optional to Stirling PDFs general operation.\n\n> Some tools listed here may not be actively used in the current version of Stirling PDF. Their configuration is kept in place for potential re-introduction in future updates.\n\nTwo types of limits are customised for every external tool:\n\n- **Session limits** - how many of a given process can run at the same time\n- **Timeouts** - how long a single process can run before it's killed\n\nBoth sit under `processExecutor` in `settings.yml`. A value of `0` means \"use the default.\"\n\n---\n\n## Session limits\n\nControls how many concurrent instances of each process are allowed. Extra requests queue up and wait.\n\n| Setting | Default | What it controls |\n|---|---|---|\n| `sessionLimit.libreOfficeSessionLimit` | `1` | Word/Excel/PowerPoint/HTML → PDF |\n| `sessionLimit.tesseractSessionLimit` | `1` | OCR (Tesseract is single-threaded) |\n| `sessionLimit.pdfToHtmlSessionLimit` | `1` | PDF → HTML |\n| `sessionLimit.ghostscriptSessionLimit` | `8` | PDF compression, repair, manipulation |\n| `sessionLimit.pythonOpenCvSessionLimit` | `8` | Image processing |\n| `sessionLimit.imageMagickSessionLimit` | `4` | Image conversion |\n| `sessionLimit.qpdfSessionLimit` | `4` | PDF/A conversion, repair, compression |\n| `sessionLimit.ocrMyPdfSessionLimit` | `2` | Add OCR overlay to existing PDFs |\n| `sessionLimit.weasyPrintSessionLimit` | `16` | HTML/CSS → PDF (WeasyPrint) |\n| `sessionLimit.calibreSessionLimit` | `1` | E-book conversions |\n| `sessionLimit.installAppSessionLimit` | `1` | Internal install tasks |\n\n**Increase** limits on a beefy server with concurrent users. **Decrease** them on low-RAM servers - LibreOffice in particular is memory-hungry.\n\nFor LibreOffice specifically, you can also scale by running multiple remote UNO server instances - see [LibreOffice Parallel Processing](doc:configuration/libreoffice-parallel-processing) for details.\n\n> **ℹ️ Info**\n>\n> Be mindful of memory and CPU usage when raising session limits. Each concurrent process consumes resources, and setting limits too high can starve the host or cause out-of-memory issues possibly killing the instance. Start with the defaults and increase gradually while monitoring your server.\n\n\n---\n\n## Timeouts\n\nHow long (in minutes) a process can run before it's forcibly killed and an error is returned.\n\n| Setting | Default |\n|---|---|\n| `timeoutMinutes.libreOfficeTimeoutMinutes` | `30` |\n| `timeoutMinutes.tesseractTimeoutMinutes` | `30` |\n| `timeoutMinutes.ghostscriptTimeoutMinutes` | `30` |\n| `timeoutMinutes.pythonOpenCvTimeoutMinutes` | `30` |\n| `timeoutMinutes.imageMagickTimeoutMinutes` | `30` |\n| `timeoutMinutes.qpdfTimeoutMinutes` | `30` |\n| `timeoutMinutes.ocrMyPdfTimeoutMinutes` | `30` |\n| `timeoutMinutes.weasyPrintTimeoutMinutes` | `30` |\n| `timeoutMinutes.calibreTimeoutMinutes` | `30` |\n| `timeoutMinutes.pdfToHtmlTimeoutMinutes` | `20` |\n| `timeoutMinutes.installAppTimeoutMinutes` | `60` |\n\n**Increase** timeouts if users process very large files that legitimately take longer. **Decrease** them if you want faster failure and tighter resource control.\n\n---\n\n## Examples\n\n### Conservative - low-resource server\n\n\n  \n    ```yaml\n    processExecutor:\n      sessionLimit:\n        libreOfficeSessionLimit: 1\n        tesseractSessionLimit: 1\n        ghostscriptSessionLimit: 2\n        imageMagickSessionLimit: 2\n        pythonOpenCvSessionLimit: 2\n        weasyPrintSessionLimit: 4\n        qpdfSessionLimit: 1\n        ocrMyPdfSessionLimit: 1\n      timeoutMinutes:\n        libreOfficeTimeoutMinutes: 10\n        tesseractTimeoutMinutes: 15\n    ```\n  \n  \n    ```bash\n    PROCESSEXECUTOR_SESSIONLIMIT_LIBREOFFICESESSIONLIMIT=1\n    PROCESSEXECUTOR_SESSIONLIMIT_TESSERACTSESSIONLIMIT=1\n    PROCESSEXECUTOR_SESSIONLIMIT_GHOSTSCRIPTSESSIONLIMIT=2\n    PROCESSEXECUTOR_TIMEOUTMINUTES_LIBREOFFICETIMEOUTMINUTES=10\n    PROCESSEXECUTOR_TIMEOUTMINUTES_TESSERACTTIMEOUTMINUTES=15\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        image: docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest\n        environment:\n          PROCESSEXECUTOR_SESSIONLIMIT_LIBREOFFICESESSIONLIMIT: 1\n          PROCESSEXECUTOR_SESSIONLIMIT_TESSERACTSESSIONLIMIT: 1\n          PROCESSEXECUTOR_TIMEOUTMINUTES_LIBREOFFICETIMEOUTMINUTES: 10\n    ```\n  \n\n\n### High-throughput - powerful server\n\n\n  \n    ```yaml\n    processExecutor:\n      sessionLimit:\n        libreOfficeSessionLimit: 4\n        tesseractSessionLimit: 4\n        ghostscriptSessionLimit: 16\n        imageMagickSessionLimit: 8\n        pythonOpenCvSessionLimit: 16\n        qpdfSessionLimit: 8\n        ocrMyPdfSessionLimit: 4\n      timeoutMinutes:\n        libreOfficeTimeoutMinutes: 60\n        tesseractTimeoutMinutes: 60\n        ocrMyPdfTimeoutMinutes: 60\n    ```\n  \n  \n    ```bash\n    PROCESSEXECUTOR_SESSIONLIMIT_LIBREOFFICESESSIONLIMIT=4\n    PROCESSEXECUTOR_SESSIONLIMIT_TESSERACTSESSIONLIMIT=4\n    PROCESSEXECUTOR_TIMEOUTMINUTES_LIBREOFFICETIMEOUTMINUTES=60\n    ```",
+      "sourcePath": "docs/Configuration/Process-Limits.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Process-Limits.md"
+    },
+    "configuration/saml-sso-configuration/saml-sso-configuration": {
+      "id": "configuration/saml-sso-configuration/saml-sso-configuration",
+      "title": "SAML 2.0 Single Sign-On Configuration",
+      "section": "configuration/saml-sso-configuration",
+      "markdown": "> **Tier**: Enterprise\n\nStirling PDF supports SAML 2.0 Single Sign-On for enterprise deployments. This allows integration with Identity Providers (IdP) like Okta, Azure AD, Google Workspace, OneLogin, Authentik, and others.\n\n> **Looking for OAuth 2.0 SSO?** See [OAuth SSO Configuration](doc:configuration/oauth-sso-configuration) (Server tier).\n\n## Prerequisites\n\nBefore starting, ensure you have:\n\n- [ ] **Enterprise license active** - SAML requires Enterprise tier\n- [ ] **Configs directory mounted** - Docker volume mounted (e.g., `./configs:/configs:ro`)\n- [ ] **Public backend URL configured** - Set `system.backendUrl` to your public backend API URL (often same as frontend, verify `https://your-domain.com/api/v1/info/status` is accessible)\n- [ ] **Reverse proxy configured** - Nginx/Traefik/Caddy with X-Forwarded-* headers forwarding\n- [ ] **Login enabled** - `security.enableLogin: true` in settings\n- [ ] **Admin account ready** - Either existing admin or plan to use `security.initialLogin` credentials\n- [ ] **IdP admin access** - Access to your SAML Identity Provider (Okta, Azure AD, etc.)\n\n> ⚠️ **License Requirement**: SAML 2.0 authentication requires an **ENTERPRISE** license. Existing users created before SAML was license-gated are grandfathered and can continue using SAML with any license tier.\n\n> 💡 **Tip**: Start with `loginMethod: all` during initial setup to allow both username/password and SAML login. This ensures you can always access the admin account if SAML configuration needs adjustment.\n\n## Setup Guide\n\nFollow these steps in order to configure SAML SSO:\n\n### Step 1: Setup Certificates\n\nSAML requires 3 certificate files for mutual trust:\n\n| Certificate | Purpose | Action |\n|-------------|---------|--------|\n| **SP Private Key** | Sign SAML requests to IdP | Generate with OpenSSL |\n| **SP Certificate** | Prove identity to IdP | Generate with OpenSSL, upload to IdP |\n| **IdP Certificate** | Verify SAML responses from IdP | Download from your IdP |\n\n#### 1a. Generate Service Provider (SP) Keypair\n\nStirling PDF needs a keypair to sign SAML requests and verify responses.\n\n> ℹ️ **If you don't have a keypair**, generate one using OpenSSL:\n>\n> ```bash\n> openssl req -newkey rsa:2048 -nodes \\\n>   -keyout private_key.key \\\n>   -x509 -days 365 \\\n>   -out certificate.crt \\\n>   -subj \"/C=US/ST=State/L=City/O=Stirling-PDF/CN=your-domain.com\"\n> ```\n>\n> **Command explanation:**\n> - `rsa:2048`: Generates 2048-bit RSA key (secure standard)\n> - `-nodes`: No passphrase (required for automated systems)\n> - `-days 365`: Certificate valid for 1 year\n> - Creates two files: `private_key.key` (private) and `certificate.crt` (public)\n\nIf you already have a keypair, ensure you have both the private key and certificate files ready.\n\n#### 1b. Download IdP Certificate\n\n1. Go to your IdP admin panel\n2. Find SAML app/provider settings\n3. Download signing certificate (PEM format)\n4. Save as `idp-certificate.pem`\n\n#### 1c. Place Certificates in Mounted Directory\n\nPlace all 3 certificates inside your mounted configs directory:\n\n```\n./configs/\n  ├── private_key.key        ← SP private key (keep secure!)\n  ├── certificate.crt        ← SP certificate (will upload to IdP)\n  └── idp-certificate.pem    ← IdP certificate (downloaded)\n```\n\n> ⚠️ **Critical**: Use absolute paths in configuration: `/configs/filename.pem` (no `file:` or `classpath:` prefix for Docker)\n\n### Step 2: Configure Stirling PDF\n\nConfigure SAML authentication by providing:\n- **IdP URLs and certificate** - Get these from your Identity Provider (obtained from IdP admin panel)\n- **SP certificates** - Point to the certificate files created in Step 1\n- **Backend URL** - Your public backend API URL for SAML callbacks (often same as frontend, e.g., `https://stirling.example.com`)\n- **Login settings** - Enable login and set method to `all` (allows both username/password and SAML during setup)\n\n**Key configuration options:**\n- `autoCreateUser: true` - Automatically create user accounts on first SAML login\n- `blockRegistration: false` - Allow new SAML users (set to `true` to require admin pre-approval)\n- `registrationId: stirling` - Identifier used in SAML URLs (must match across all URLs)\n\n\n  \n    Edit `/configs/settings.yml`:\n\n    ```yaml\n    security:\n      enableLogin: true\n      loginMethod: all  # Keep 'all' during initial setup\n\n      saml2:\n        enabled: true\n        autoCreateUser: true\n        blockRegistration: false\n        registrationId: stirling\n\n        # Identity Provider (IdP) URLs (get from your IdP)\n        idpSingleLoginUrl: https://idp.example.com/saml/login\n        idpSingleLogoutUrl: https://idp.example.com/saml/logout\n        idpIssuer: https://idp.example.com/entityid\n        idpCert: /configs/idp-certificate.pem\n\n        # Service Provider (SP) Certificates\n        privateKey: /configs/private_key.key\n        spCert: /configs/certificate.crt\n\n    # Required for SAML callback URLs\n    system:\n      backendUrl: https://stirling.example.com\n    ```\n  \n  \n    Add to your `docker-compose.yml` or Docker run command:\n\n    ```yaml\n    environment:\n      SYSTEM_BACKENDURL: https://stirling.example.com\n      SECURITY_ENABLELOGIN: true\n      SECURITY_LOGINMETHOD: all\n      SECURITY_SAML2_ENABLED: true\n      SECURITY_SAML2_AUTOCREATEUSER: true\n      SECURITY_SAML2_BLOCKREGISTRATION: false\n      SECURITY_SAML2_REGISTRATIONID: stirling\n      SECURITY_SAML2_IDPSINGLELOGINURL: https://idp.example.com/saml/login\n      SECURITY_SAML2_IDPSINGLELOGOUTURL: https://idp.example.com/saml/logout\n      SECURITY_SAML2_IDPISSUER: https://idp.example.com/entityid\n      SECURITY_SAML2_IDPCERT: /configs/idp-certificate.pem\n      SECURITY_SAML2_PRIVATEKEY: /configs/private_key.key\n      SECURITY_SAML2_SPCERT: /configs/certificate.crt\n    ```\n  \n\n\n> 💡 **Tip**: Replace the example URLs (`idp.example.com`) with actual values from your Identity Provider.\n\n#### Public URL for SAML SLO\n\nFor Single Logout (SLO) to work correctly in production, Stirling PDF uses your `system.backendUrl` setting to tell the Identity Provider where to send the logout response. Make sure that value is set to your public-facing URL (the same setting used for the SAML callbacks above):\n\n\n  \n    Set in `/configs/settings.yml`:\n\n    ```yaml\n    system:\n      backendUrl: https://your-domain.com\n    ```\n  \n  \n    Set in your Docker Compose environment variables:\n\n    ```yaml\n    environment:\n      SYSTEM_BACKENDURL: https://your-domain.com\n    ```\n  \n\n\n> ⚠️ **Important**: `system.backendUrl` must be set to your public-facing URL for SAML (including Single Logout) to work correctly in production.\n\n### Step 3: Configure Your Identity Provider\n\nProvide your IdP with these Service Provider details:\n\n**Entity ID / SP Metadata URL:**\n```\nhttps://your-domain.com/saml2/service-provider-metadata/stirling\n```\n\n**Assertion Consumer Service (ACS) URL:**\n```\nhttps://your-domain.com/login/saml2/sso/stirling\n```\n\n**Single Logout (SLO) URL:**\n```\nhttps://your-domain.com/logout\n```\n\n> 📌 **Important**: Replace `stirling` with your `registrationId` value if you changed it. The registration ID must match in all URLs.\n\n**Upload SP Certificate to IdP** (Critical Step):\n1. Open `certificate.crt` (your SP public certificate)\n2. In your IdP's SAML app configuration, find \"Verification Certificate\" or \"SP Certificate\" field\n3. Upload or paste `certificate.crt` contents\n4. Save IdP configuration\n\n> Without uploading the SP certificate, your IdP cannot verify requests from Stirling PDF.\n\n**Configure NameID and Attributes:**\n- NameID format: `email` or `unspecified`\n- Ensure at least one username attribute is sent: `username`, `emailaddress`, `name`, `upn`, or `uid`\n\n### Step 4: Test SAML Login\n\n1. Open an incognito/private browser window\n2. Navigate to `https://your-domain.com`\n3. Click \"Login via Single Sign-On\" button\n4. You'll be redirected to your IdP login page\n5. Enter your IdP credentials\n6. You'll be redirected back to Stirling PDF\n7. A new user account is automatically created (if `autoCreateUser: true`)\n\n> ⚠️ **If login fails**, check application logs for SAML errors. See [Troubleshooting](#troubleshooting) section.\n\n### Step 5: Promote SAML User to Admin\n\n1. Log in with your initial admin account (username/password)\n2. Go to **Settings** → **User Management**\n3. Find the SAML user account (created during test login)\n4. Change **Role** to **Admin**\n5. **Save**\n\n> ⚠️ **Important**: Keep at least one SAML user with admin privileges before switching to SSO-only mode.\n\n### Step 6 (Optional): Switch to SSO-Only Mode\n\nOnce you've verified SAML works and have a SAML admin user:\n\n```yaml\nsecurity:\n  loginMethod: saml2  # Disables username/password login\n```\n\nRestart Stirling PDF.\n\n## Configuration Reference\n\n### Required Properties\n\n| Property | Description | Example |\n|----------|-------------|---------|\n| `security.saml2.enabled` | Enable SAML 2 authentication | `true` |\n| `security.saml2.idpSingleLoginUrl` | IdP's Single Sign-On URL | `https://idp.example.com/sso` |\n| `security.saml2.idpSingleLogoutUrl` | IdP's Single Logout URL | `https://idp.example.com/slo` |\n| `security.saml2.idpIssuer` | IdP's Entity ID / Issuer | `https://idp.example.com` |\n| `security.saml2.idpCert` | IdP's signing certificate (PEM format) | `/configs/idp-cert.pem` |\n| `security.saml2.privateKey` | Your SP private key | `/configs/private_key.key` |\n| `security.saml2.spCert` | Your SP certificate | `/configs/certificate.crt` |\n| `system.backendUrl` | Public HTTPS URL for callbacks | `https://stirling.example.com` |\n\n### Optional Properties\n\n| Property | Default | Description |\n|----------|---------|-------------|\n| `security.saml2.autoCreateUser` | `true` | Auto-create users on first SAML login |\n| `security.saml2.blockRegistration` | `false` | Block new users (only allow pre-registered) |\n| `security.saml2.registrationId` | `stirling` | Registration ID (must match ACS URL path) |\n| `security.saml2.provider` | `null` | Optional provider name for logging |\n| `security.loginMethod` | `all` | Login method: `all`, `normal`, `oauth2`, `saml2` |\n\n## Advanced Configuration\n\n### SAML Attribute Mapping\n\nStirling PDF attempts to determine the username in the following priority order:\n\n1. **`username`** attribute\n2. **`emailaddress`** attribute (or full URI: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress`)\n3. **`name`** attribute (or full URI: `http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name`)\n4. **`upn`** attribute (User Principal Name - often used in Active Directory)\n5. **`uid`** attribute (Unix user ID)\n6. **NameID** from SAML Subject (fallback if no attributes provided)\n\n**Minimum requirement:** NameID in the SAML Subject (used as fallback identifier)\n\n**Recommended:** At least one username attribute from the priority list above\n\n#### Attribute Debugging\n\nEnable debug logging to see what attributes your IdP is sending:\n\n\n  \n    Add to `/configs/custom_settings.yml`:\n\n    ```yaml\n    logging:\n      level:\n        stirling.software.proprietary.security.saml2: DEBUG\n    ```\n  \n  \n    ```bash\n    LOGGING_LEVEL_STIRLING_SOFTWARE_PROPRIETARY_SECURITY_SAML2=DEBUG\n    ```\n  \n\n\nCheck logs for:\n```\nExtracted SAML Attributes: {username=[john.doe], emailaddress=[john.doe@example.com], ...}\n```\n\n> 💡 **Note**: Currently, Stirling PDF only uses attributes for username identification. Other attributes (first name, last name, groups, roles) are extracted but not used.\n\n### Understanding Registration ID\n\nThe `registrationId` is a critical configuration value that becomes part of your SAML URLs:\n\n```yaml\nsecurity:\n  saml2:\n    registrationId: stirling  # Default value\n```\n\nWith `registrationId: stirling`, your URLs are:\n- Metadata: `https://your-domain.com/saml2/service-provider-metadata/stirling`\n- ACS: `https://your-domain.com/login/saml2/sso/stirling`\n\n**If you change the registration ID:**\n```yaml\nsecurity:\n  saml2:\n    registrationId: mycompany  # Custom value\n```\n\nYour URLs become:\n- Metadata: `https://your-domain.com/saml2/service-provider-metadata/mycompany`\n- ACS: `https://your-domain.com/login/saml2/sso/mycompany`\n\n> ⚠️ **Critical**: If you change `registrationId` after configuring your IdP, you must update ALL URLs in your IdP configuration. The registration ID must match exactly in all places, or SAML login will fail.\n\n> 💡 **Recommendation**: Keep the default `stirling` value unless you have a specific reason to change it (e.g., running multiple Stirling PDF instances with the same IdP).\n\n### Auto-Login Feature\n> **Tier**: Enterprise\n\nAutomatically redirect users to SAML login, bypassing the Stirling PDF login screen:\n\n```yaml\npremium:\n  proFeatures:\n    ssoAutoLogin: true\n```\n\n**Auto-login Activation Requirements:**\n\nAuto-login only triggers when **ALL** of the following conditions are met:\n\n1. `ssoAutoLogin` is enabled (as configured above)\n2. `loginMethod` is NOT `'all'` and NOT `'normal'` (i.e., SSO-only mode required)\n3. Exactly one SAML provider is configured\n\n**Behavior:**\n- When all conditions are met: Users are automatically redirected to IdP\n- When conditions are not met: Standard login page is displayed\n- If a single sign-on attempt fails, the automatic redirect is suppressed for the rest of that browser session so the login page stays visible (this is separate from the `security.loginAttemptCount` account-lockout setting, which locks the user account after repeated failures)\n- Users can still manually access `/login` for form login if `loginMethod: all`\n\n## Troubleshooting\n\n### \"SAML requires Enterprise license\"\n**Cause**: SAML authentication requires Enterprise tier license.\n\n**Solution**:\n- Verify valid Enterprise license is configured\n- Check `premium.enabled=true` in settings\n- Existing users created before license enforcement are grandfathered\n\n### \"Invalid SAML response signature\"\n**Cause**: IdP certificate mismatch or incorrect format.\n\n**Solution**:\n- Verify `idpCert` file matches certificate from IdP\n- Ensure certificate is in PEM format (starts with `-----BEGIN CERTIFICATE-----`)\n- Re-download certificate from IdP\n- Check certificate hasn't expired\n\n### \"ACS URL mismatch\"\n**Cause**: Redirect URL doesn't match IdP configuration.\n\n**Solution**:\n- Verify `SYSTEM_BACKENDURL` is set to public HTTPS URL\n- Check reverse proxy sends X-Forwarded-Proto, X-Forwarded-Host, X-Forwarded-Port headers\n- Ensure `registrationId` matches in both URL and configuration\n- Update ACS URL in IdP to match: `https://your-domain.com/login/saml2/sso/stirling`\n\n### \"File not found: idp-certificate.pem\"\n**Cause**: Certificate file path is incorrect.\n\n**Solution**:\n- Verify file exists at specified path\n- For Docker: ensure volume is mounted correctly\n- Use absolute paths like `/configs/filename.pem` (no `file:` prefix)\n- Check file permissions (must be readable by application)\n\n### \"Cannot auto-create user\"\n**Cause**: User doesn't exist and auto-creation is disabled.\n\n**Solution**:\n- Set `autoCreateUser: true` to allow new users\n- Or pre-create user accounts as admin\n- Check license allows additional users\n\n### \"Redirect loop after SAML login\"\n**Cause**: Session or cookie issues.\n\n**Solution**:\n- Clear browser cookies\n- Check `SYSTEM_BACKENDURL` matches actual access URL\n- Verify cookies are allowed for domain\n- Ensure SameSite cookie settings are compatible\n\n### \"Invalid username\" error\n**Cause**: No valid username found in assertion.\n\n**Solution**:\n1. Enable debug logging to see what attributes are received\n2. Ensure IdP sends at least one of: `username`, `emailaddress`, `name`, `upn`, `uid`\n3. Verify NameID is present in SAML Subject as fallback\n4. Check attribute name format (short name vs full URI)\n\n### Debug Logging\n\nEnable SAML debug logging to see detailed authentication flow:\n\n\n  \n    Add to `/configs/custom_settings.yml`:\n\n    ```yaml\n    logging:\n      level:\n        org.springframework.security.saml2: DEBUG\n        org.opensaml: DEBUG\n        stirling.software.proprietary.security: DEBUG\n    ```\n  \n  \n    ```bash\n    LOGGING_LEVEL_ORG_SPRINGFRAMEWORK_SECURITY_SAML2=DEBUG\n    LOGGING_LEVEL_ORG_OPENSAML=DEBUG\n    LOGGING_LEVEL_STIRLING_SOFTWARE_PROPRIETARY_SECURITY=DEBUG\n    ```\n  \n\n\nCheck logs for SAML attribute information:\n```\nExtracted SAML Attributes: {username=[john.doe], emailaddress=[john.doe@example.com], ...}\n```\n\n### Inspect SAML Assertions\n\nUse browser developer tools:\n1. Open Network tab\n2. Clear network log\n3. Attempt SAML login\n4. Look for POST to `/login/saml2/sso/stirling`\n5. Decode SAMLResponse parameter (Base64 + inflate)\n\n**Tools:**\n- [SAML-tracer](https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/) (Firefox/Chrome extension)\n- [SAML Decoder](https://www.samltool.com/decode.php) (online tool)\n\n## Known Limitations\n\n### idpMetadataUri Not Auto-Populating\n\nThe `idpMetadataUri` configuration field exists but is **not currently used** to auto-populate IdP settings. You must manually configure:\n- `idpSingleLoginUrl`\n- `idpSingleLogoutUrl`\n- `idpIssuer`\n- `idpCert`\n\n**Workaround**: Manually extract values from IdP metadata XML.\n\n> 💡 **Note**: Auto-populating IdP settings from metadata URI is a planned enhancement coming soon.\n\n## See Also\n\n- [OAuth SSO Configuration](doc:configuration/oauth-sso-configuration) - OAuth 2.0 / OIDC setup\n- [System and Security](doc:configuration/system-and-security) - Additional security settings\n- [External Database](doc:configuration/external-database) - User storage configuration\n- [Paid Offerings](doc:paid-offerings) - Enterprise tier and licensing information",
+      "sourcePath": "docs/Configuration/SAML SSO Configuration/SAML SSO Configuration.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/SAML SSO Configuration/SAML SSO Configuration.md"
+    },
+    "configuration/ssrf-protection": {
+      "id": "configuration/ssrf-protection",
+      "title": "SSRF Protection",
+      "section": "configuration",
+      "markdown": "## What is SSRF and why does it matter?\n\nSSRF (Server-Side Request Forgery) is when someone tricks your server into making HTTP requests on their behalf - to your internal network, cloud metadata endpoints, or other places they shouldn't be able to reach.\n\nIn Stirling PDF, the risk is tools like **URL to PDF**: a user could supply `http://192.168.1.1/admin` or `http://169.254.169.254/` and your server would fetch it. For self-hosted deployments on a private network, that's a real concern.\n\nSSRF protection is **enabled by default** at `MEDIUM` level. For most deployments, you don't need to touch it.\n\n> **⚠️ Warning**\n>\n> The URL to PDF feature is **disabled by default** (`system.enableUrlToPDF: false`) due to the SSRF risks described above. It is intended for internal use only and should not be exposed externally. If you enable it, make sure SSRF protection is properly configured.\n\n\n---\n\n## Settings\n\nAll settings are under `system.html.urlSecurity` in `settings.yml`.\n\n| Setting | Default | Description |\n|---|---|---|\n| `enabled` | `true` | Master on/off switch |\n| `level` | `MEDIUM` | `OFF`, `MEDIUM`, or `MAX` - see below |\n| `allowedDomains` | `[]` | Domains to always allow |\n| `blockedDomains` | `[]` | Domains to always block |\n| `internalTlds` | `.local`, `.internal`, `.corp`, `.home` | TLD suffixes treated as internal |\n| `blockPrivateNetworks` | `true` | Block RFC1918 private IP ranges |\n| `blockLocalhost` | `true` | Block 127.x / ::1 |\n| `blockLinkLocal` | `true` | Block 169.254.x.x / fe80:: |\n| `blockCloudMetadata` | `true` | Block AWS/GCP/Azure/Oracle/IBM metadata IPs |\n\n### Protection levels\n\n**`MEDIUM`** (default) - Blocks private IPs, localhost, cloud metadata, and internal TLDs. Public internet URLs are allowed by default.\n\n**`MAX`** - Only URLs explicitly listed in `allowedDomains` are allowed. Everything else is blocked. Unlike MEDIUM, subdomain matching is not supported in MAX mode - each domain and subdomain must be listed individually. Use this if you know exactly which external domains your users need.\n\n**`OFF`** - No SSRF checking at all. Only appropriate if you have network-level controls elsewhere.\n\n### Domain allow and block lists\n\nThe `allowedDomains` and `blockedDomains` settings work alongside whichever protection level you choose.\n\n- **`allowedDomains`** - When set at MEDIUM level, only these domains (and their subdomains) are permitted in addition to the default public-internet access. At MAX level, this is the exclusive list of permitted domains (no subdomain matching).\n- **`blockedDomains`** - Domains to always deny, regardless of level. Uses exact matching - blocking `example.com` will not block `sub.example.com`.",
+      "sourcePath": "docs/Configuration/SSRF-Protection.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/SSRF-Protection.md"
+    },
+    "configuration/sign-with-custom-files": {
+      "id": "configuration/sign-with-custom-files",
+      "title": "Visual Sign with Custom File Storage",
+      "section": "configuration",
+      "markdown": "Stirling PDF provides functionality to store and reuse files across sessions, particularly useful for features like signatures and commonly used assets. This guide explains how to set up and use custom file storage.\n\n## Overview\n\nThe custom file storage system allows you to:\n- Store files persistently across sessions\n- Share files between all users or restrict them to specific users\n- Access stored files through the web UI\n- Organize files in a structured way\n\n## Storage Location\n\nAll custom files should be stored in the `/customFiles/` directory. For features like signatures, the specific path is:\n\n```\n/customFiles/signatures/\n```\n\n## Access Levels\n\nThe system supports two types of access levels for stored files:\n\n### 1. All Users Access\nFiles that should be accessible to all users should be placed in:\n```\n/customFiles/signatures/ALL_USERS/\n```\nThis is useful for:\n- Organization-wide templates\n- Shared assets\n- Default signatures or watermarks\n- Environments where authentication isn't used\n\n### 2. User-Specific Access\nFiles that should only be accessible to specific users should be placed in user-specific directories:\n```\n/customFiles/signatures/{username}/\n```\nFor example:\n```\n/customFiles/signatures/john_doe/\n```\nThese files will only be accessible to the specified user when logged in.\n\n## Usage in Docker\n\nWhen using Docker, make sure to mount the customFiles directory as a volume to persist the files:\n\n```yaml\nvolumes:\n  - ./customFiles:/customFiles/\n```\n\n## Best Practices\n\n1. File Organization:\n   - Keep files organized in appropriate subdirectories\n   - Use clear, descriptive filenames\n   - Consider using date-based or category-based organization for large numbers of files\n\n2. Security:\n   - Only place files in ALL_USERS if they truly need to be accessible to everyone\n   - Regularly review and clean up unused files\n   - Monitor storage usage to prevent excessive accumulation of files\n\n3. Supported File Types:\n   - For signatures: common image formats (PNG, JPG, SVG)\n   - Ensure files are of appropriate size and format for their intended use\n\n## Example Structure\n\nHere's an example of how your custom files directory might look:\n\n```\n/customFiles/\n├── signatures/\n│   ├── ALL_USERS/\n│   │   ├── company-logo.png\n│   │   └── default-signature.png\n│   ├── john_doe/\n│   │   ├── personal-signature.png\n│   │   └── department-stamp.png\n│   └── jane_smith/\n│       └── signature-2024.png\n```\n\n## Accessing Files\n\nFiles stored in these locations will automatically be available in the relevant features of the Stirling PDF web interface. For example, saved signatures will appear in the signature selection interface when using the Sign feature.",
+      "sourcePath": "docs/Configuration/Sign with custom files.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Sign with custom files.md"
+    },
+    "configuration/single-sign-on-configuration": {
+      "id": "configuration/single-sign-on-configuration",
+      "title": "Single Sign-On (SSO) Overview",
+      "section": "configuration",
+      "markdown": "Stirling PDF supports Single Sign-On (SSO) authentication through two protocols:\n\n## OAuth 2.0 / OpenID Connect (OIDC)\n> **Tier**: Server\n\nOAuth 2.0 SSO allows login via popular identity providers like:\n- Google\n- GitHub\n- Keycloak\n- Authentik\n- Any OIDC-compliant provider\n\n**[→ Configure OAuth 2.0 SSO](doc:configuration/oauth-sso-configuration)**\n\n**Key Features:**\n- Easy setup with major providers\n- Auto-discovery via `.well-known/openid-configuration`\n- Social login support\n- Suitable for small to medium organizations\n\n---\n\n## SAML 2.0\n> **Tier**: Enterprise\n\nSAML 2.0 SSO provides enterprise-grade authentication with:\n- Okta\n- Azure AD (Entra ID)\n- Google Workspace\n- OneLogin\n- Any SAML 2.0-compliant IdP\n\n**[→ Configure SAML 2.0 SSO](doc:configuration/saml-sso-configuration/saml-sso-configuration)**\n\n**Key Features:**\n- Enterprise identity provider integration\n- Advanced security controls\n- Single Logout (SLO) support\n- Suitable for large organizations",
+      "sourcePath": "docs/Configuration/Single Sign-On Configuration.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Single Sign-On Configuration.md"
+    },
+    "configuration/system-and-security": {
+      "id": "configuration/system-and-security",
+      "title": "Login, System and Security",
+      "section": "configuration",
+      "markdown": "Stirling PDF allows customization of system and security settings. For security features to be enabled, you must use the security jar. For Docker users, this means setting `DISABLE_ADDITIONAL_FEATURES` to `false` via an environment variable.\n\n## Basic Security Settings\n\n- `enableLogin`: Enables or disables the login functionality (only available in Stirling-PDF-with-login.jar or when `DISABLE_ADDITIONAL_FEATURES=false`)\n- `defaultLocale`: Set the default language (e.g. 'de-DE', 'fr-FR', etc)\n- `googlevisibility`: 'true' to allow Google visibility (via robots.txt), 'false' to disallow\n- `xFrameOptions`: Controls whether your instance can be embedded in an iframe. Set to `DENY` to prevent clickjacking. Use `SAMEORIGIN` only if you embed the UI in your own application.\n- `loginAttemptCount`: Number of failed login attempts before an account is locked (e.g. `5`)\n- `loginResetTimeMinutes`: Minutes before a locked account is automatically unlocked (e.g. `10`)\n\n## Authentication Setup\n\n**Important:** Authentication and additional features are included by default in:\n- **Docker**: All images except ultra-lite (authentication is **enabled by default**)\n- **JAR files**: Use [Stirling-PDF-with-login.jar](https://files.stirlingpdf.com/Stirling-PDF-with-login.jar) **(Recommended)**\n\n**Not included in:**\n- **Docker ultra-lite**: Minimal build without authentication (set `DISABLE_ADDITIONAL_FEATURES=false` to enable)\n- **Plain JAR**: [Stirling-PDF.jar](https://files.stirlingpdf.com/Stirling-PDF.jar) - Basic build without authentication or additional features\n\n### Prerequisites\n1. Ensure the `/configs` directory is mounted as a volume in Docker for persistence across updates\n2. Use the appropriate build:\n   - **JAR**: Download Stirling-PDF-with-login.jar\n   - **Docker**: Set `DISABLE_ADDITIONAL_FEATURES=false` in environment variables\n\n### Initial Login Credentials\n- Default Username: `admin`\n- Default Password: `stirling`\n- Note: Users will be forced to change their password on first login\n- Custom initial credentials can be set using:\n  - `SECURITY_INITIALLOGIN_USERNAME`\n  - `SECURITY_INITIALLOGIN_PASSWORD`\n\n### Database Location\nUpon successful setup, a new `stirling-pdf-DB-<version>.mv.db` file (the version number is part of the filename, e.g. `stirling-pdf-DB-2.3.232.mv.db`) will be created in your configured storage location. This file contains user data and should be backed up regularly.\n\n### Account Management\n1. Access Account Settings:\n   - Click the settings cog menu in the top right navbar\n   - Select \"Account Settings\"\n   - Here you can manage your profile and find your API key\n\n2. Adding New Users:\n   - Navigate to Account Settings\n   - Scroll to bottom and click 'Admin Settings'\n   - Use the user management interface to add new users\n\n### Role-Based Access Control\nCurrently, roles are primarily used for rate limiting purposes. The role system is under active development and will be expanded with additional features in future updates.\n\n### API Authentication\nWhen using the API:\n- Each user has a unique API key found in their Account Settings\n- Include the API key in requests using the `X-API-KEY` header\n- Example:\n  ```\n  X-API-KEY: your-api-key-here\n  ```\n\n## Running Without Authentication\n\nIf you need to run without authentication (note: this also disables additional features), you have two options:\n\n### Option 1: Disable Login in With-Login Version (Recommended)\n\nDisable authentication while keeping additional features:\n\n\n  \n    ```yaml\n    security:\n      enableLogin: false\n    ```\n  \n  \n    ```bash\n    SECURITY_ENABLELOGIN=false\n    ```\n  \n  \n    ```bash\n    docker run -d \\\n      -p 8080:8080 \\\n      -e SECURITY_ENABLELOGIN=false \\\n      -e DISABLE_ADDITIONAL_FEATURES=false \\\n      stirlingtools/stirling-pdf:latest\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        image: stirlingtools/stirling-pdf:latest\n        environment:\n          SECURITY_ENABLELOGIN: false\n          DISABLE_ADDITIONAL_FEATURES: false\n    ```\n  \n  \n    ```bash\n    java -jar Stirling-PDF-with-login.jar -DSECURITY_ENABLELOGIN=false\n    ```\n  \n  \n    ```bash\n    export SECURITY_ENABLELOGIN=false\n    java -jar Stirling-PDF-with-login.jar\n    ```\n  \n\n\n### Option 2: Use Open Source JAR\n\nUse [Stirling-PDF.jar](https://files.stirlingpdf.com/Stirling-PDF.jar) which has no authentication (note: also excludes additional features):\n\n```bash\njava -jar Stirling-PDF.jar\n```\n\n### Recommendation\n\n**We recommend Stirling-PDF-with-login.jar for all deployments** because it includes additional features beyond just authentication. You can always disable authentication if needed while keeping the extra functionality.\n\n---\n\n## Login Agreement / Disclaimer\n\nShow a disclaimer that users must accept before they can use the app. It appears as a blocking dialog after a successful login (or on launch when login is disabled), and works on every edition.\n\n```yaml\nlegal:\n  loginAgreement:\n    enabled: false              # Master on/off switch\n    showInAnonymousMode: true   # When login is disabled, set false to hide the dialog\n    fallbackText: \"\"            # Markdown shown when no per-language file is found\n```\n\n**Environment Variables:**\n```bash\nLEGAL_LOGINAGREEMENT_ENABLED=true\nLEGAL_LOGINAGREEMENT_SHOWINANONYMOUSMODE=true\nLEGAL_LOGINAGREEMENT_FALLBACKTEXT=\"By signing in you agree to the terms...\"\n```\n\nThe disclaimer is written in **Markdown**. Provide per-language versions as files at `customFiles/disclaimer/<locale>.md` (for example `en-US.md` or `de-DE.md`); the text shown follows each user's interface language and falls back to `fallbackText` when no matching file exists. If no text resolves at all (no files and no `fallbackText`), the dialog is not shown even when `enabled` is `true`. For a single-language or headless install, set `fallbackText` (env `LEGAL_LOGINAGREEMENT_FALLBACKTEXT`) and skip the per-language files. Editing the text takes effect on the next login with no restart; turning `enabled` on or off requires a restart.\n\nAdmins can also edit the text in-app from **Admin Settings → Legal**, which writes the same per-language files.\n\nIn the desktop app, the dialog can be enabled per machine through MDM - see [Managed Desktop Deployment](doc:installation/managed-deployment).\n\n---\n\n## Server Certificates\n\nStirling PDF can auto-generate certificates for the \"Sign with Stirling PDF\" feature.\n\n### Configuration\n\n```yaml\nsystem:\n  serverCertificate:\n    enabled: true                    # Enable auto-generation\n    organizationName: Stirling-PDF   # Certificate organization name\n    validity: 365                    # Days until expiration\n    regenerateOnStartup: false       # Keep same cert across restarts\n```\n\n**Environment Variables:**\n```bash\nSYSTEM_SERVERCERTIFICATE_ENABLED=true\nSYSTEM_SERVERCERTIFICATE_ORGANIZATIONNAME=\"My Company\"\nSYSTEM_SERVERCERTIFICATE_VALIDITY=365\nSYSTEM_SERVERCERTIFICATE_REGENERATEONSTARTUP=false\n```\n\n### How It Works\n\n1. **First Startup:** Server generates a self-signed certificate, stored as `/configs/server-certificate.p12`\n2. **Subsequent Startups:** Reuses existing certificate (unless `regenerateOnStartup: true`)\n3. **User Signs:** PDFs signed using this certificate via \"Sign with Stirling-PDF\" option\n\n---\n\n## Signature Validation\n\nConfigure how PDF certificate signatures are validated.\n\n### Trust Sources\n\n```yaml\nsecurity:\n  validation:\n    trust:\n      serverAsAnchor: true      # Trust server-generated certificates\n      useSystemTrust: true       # Use OS certificate store\n      useMozillaBundle: true     # Mozilla CA bundle\n      useAATL: false             # Adobe Approved Trust List\n      useEUTL: false             # EU Trusted List (eIDAS)\n```\n\n**Environment Variables:**\n```bash\nSECURITY_VALIDATION_TRUST_SERVERASANCHOR=true\nSECURITY_VALIDATION_TRUST_USESYSTEMTRUST=true\nSECURITY_VALIDATION_TRUST_USEMOZILLABUNDLE=true\nSECURITY_VALIDATION_TRUST_USEAATL=false\nSECURITY_VALIDATION_TRUST_USEEUTL=false\n```\n\n### Trust List URLs\n\nConfigure external trust list locations:\n\n```yaml\nsecurity:\n  validation:\n    aatl:\n      url: https://trustlist.adobe.com/tl.pdf\n    eutl:\n      lotlUrl: https://ec.europa.eu/tools/lotl/eu-lotl.xml\n      acceptTransitional: false\n```\n\n### Revocation Checking\n\nVerify certificates haven't been revoked:\n\n```yaml\nsecurity:\n  validation:\n    revocation:\n      mode: none          # Options: none, ocsp, crl, ocsp+crl\n      hardFail: false     # Fail validation if revocation check fails\n```\n\n**Revocation Modes:**\n- `none`: No revocation checking (not recommended for production)\n- `ocsp`: Online Certificate Status Protocol (fast, requires network)\n- `crl`: Certificate Revocation Lists (slower, works offline)\n- `ocsp+crl`: Try OCSP first, fall back to CRL (recommended)\n\n**Environment Variables:**\n```bash\nSECURITY_VALIDATION_REVOCATION_MODE=ocsp+crl\nSECURITY_VALIDATION_REVOCATION_HARDFAIL=false\n```\n\n### Authority Information Access (AIA)\n\nAllow automatic fetching of intermediate certificates:\n\n```yaml\nsecurity:\n  validation:\n    allowAIA: false  # Set true to enable (requires network access)\n```\n\n**⚠️ Security Note:** Disabled by default. Only enable in controlled environments where outbound HTTPS is secure.\n\n**Learn more:** [Certificate Signing - Validation](doc:functionality/security/certificate-signing)\n\n---\n\n## JWT Authentication\n\nLogins use JSON Web Tokens. The main thing to configure is how long a session lasts before a user has to sign in again.\n\n```yaml\nsecurity:\n  jwt:\n    tokenExpiryMinutes: 1440          # Web login lifetime (default 24 hours)\n    desktopTokenExpiryMinutes: 43200  # Desktop login lifetime (default 30 days)\n```\n\nEnvironment variables: `SECURITY_JWT_TOKENEXPIRYMINUTES` and `SECURITY_JWT_DESKTOPTOKENEXPIRYMINUTES`.\n\nLower these for tighter security (users sign in more often) or raise them for convenience.\n\n---\n\n## Email Configuration\n\nConfigure SMTP for sending email invitations and notifications. Enable `mail.enableInvites` to allow invitation links.\n\n> 💡 **When is email configuration required?**\n>\n> Email configuration is **OPTIONAL** and only needed for:\n> - **Email invitations**: Admins can send invite links to users via email\n> - **Password reset emails**: Users can reset forgotten passwords (if implemented)\n>\n> Email is **NOT required** for:\n> - Basic username/password login\n> - SSO authentication (OAuth 2.0 or SAML 2.0)\n> - Manual user creation by admins\n> - Normal application operation\n>\n> You can run Stirling PDF without any email configuration if you create users manually or use SSO.\n\n### Email Invites\n\nEnable email-based user invitations:\n\n```yaml\nmail:\n  enabled: true\n  enableInvites: true\n  host: smtp.example.com\n  port: 587\n  username: noreply@example.com\n  password: ${MAIL_PASSWORD}\n  from: noreply@example.com\n  startTlsEnable: true\n```\n\n**Environment Variables:**\n```bash\nMAIL_ENABLED=true\nMAIL_ENABLEINVITES=true\nMAIL_HOST=smtp.gmail.com\nMAIL_PORT=587\nMAIL_USERNAME=your-email@gmail.com\nMAIL_PASSWORD=your-app-password\nMAIL_FROM=noreply@example.com\nMAIL_STARTTLSENABLE=true\n```\n\n**Requirements:**\n- `mail.enabled: true`\n- `mail.enableInvites: true` for invitation flows\n- `security.enableLogin: true`\n- Valid SMTP configuration\n- `system.frontendUrl` configured (for invite links)\n\n---\n\n## UI Customization\n\n### Logo Style\n\nChoose between logo styles:\n\n```yaml\nui:\n  logoStyle: classic  # Options: 'classic' or 'modern'\n```\n\n**Environment Variable:**\n```bash\nUI_LOGOSTYLE=modern\n```\n\n**Styles:**\n- `classic`: Traditional \"S\" icon logo\n- `modern`: Minimalist design\n\n### Custom Logo\n\nYou can also override the bundled logo by dropping your own files into the matching style subdirectory:\n\n```bash\ncustomFiles/\n  └── static/\n      ├── classic-logo/\n      │   └── logo.svg  # Overrides the classic logo\n      └── modern-logo/\n          └── logo.svg  # Overrides the modern logo\n```\n\n**Learn more:** [UI Customisation](doc:configuration/ui-customisation)\n\n---\n\n## Configuration Examples\n\n\n  \n    ```yaml\n    security:\n      enableLogin: true  # Only works with Stirling-PDF-with-login.jar or DISABLE_ADDITIONAL_FEATURES=false\n      jwt:\n        tokenExpiryMinutes: 1440\n      validation:\n        trust:\n          serverAsAnchor: true\n          useSystemTrust: true\n          useMozillaBundle: true\n        revocation:\n          mode: ocsp\n          hardFail: false\n\n    system:\n      defaultLocale: 'en-US' # Set the default language (e.g. 'de-DE', 'fr-FR', etc)\n      googlevisibility: false # 'true' to allow Google visibility (via robots.txt), 'false' to disallow\n      serverCertificate:\n        enabled: true\n        organizationName: Stirling-PDF\n        validity: 365\n\n    mail:\n      enabled: false\n      enableInvites: false\n\n    ui:\n      logoStyle: classic\n    ```\n  \n  \n    You can configure these settings in two ways when running locally:\n\n    **Option 1: Using Java Properties**\n    ```bash\n    java -jar Stirling-PDF.jar -DDISABLE_ADDITIONAL_FEATURES=false -DSECURITY_ENABLELOGIN=true\n    ```\n\n    **Option 2: Using Environment Variables**\n    ```bash\n    export DISABLE_ADDITIONAL_FEATURES=false\n    export SECURITY_ENABLELOGIN=true\n    ```\n  \n  \n    ```bash\n    -e DISABLE_ADDITIONAL_FEATURES=false \\\n    -e SECURITY_ENABLELOGIN=true \\\n    -e SYSTEM_CORSALLOWEDORIGINS=https://pdf.example.com \\\n    -e SYSTEM_FRONTENDURL=https://pdf.example.com \\\n    -e SECURITY_JWT_ENABLEKEYSTORE=true \\\n    ```\n  \n  \n    ```yaml\n    environment:\n      DISABLE_ADDITIONAL_FEATURES: false\n      SECURITY_ENABLELOGIN: true\n      SECURITY_JWT_ENABLEKEYSTORE: true\n      SYSTEM_SERVERCERTIFICATE_ENABLED: true\n    ```\n  \n\n\n---\n\n## Related Documentation\n\n- **[Security Features](doc:functionality/security/security)** - PDF security tools, CORS, signature validation\n- **[Certificate Signing](doc:functionality/security/certificate-signing)** - Comprehensive signing and validation guide\n- **[Single Sign-On](doc:configuration/single-sign-on-configuration)** - Enterprise authentication\n- **[UI Customisation](doc:configuration/ui-customisation)** - Branding and appearance\n- **[Migration Guide](doc:migration/settings-changes)** - Upgrading from V1",
+      "sourcePath": "docs/Configuration/System and Security.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/System and Security.md"
+    },
+    "configuration/telegram-bot": {
+      "id": "configuration/telegram-bot",
+      "title": "Telegram Bot Integration",
+      "description": "Process PDFs through a Telegram bot powered by Stirling PDF pipelines",
+      "section": "configuration",
+      "markdown": "Stirling PDF can run a Telegram bot that accepts PDF files from chats and returns processed results using your saved [Automate / Pipeline](doc:configuration/pipeline) configurations. Send a PDF to the bot, get a processed PDF back.\n\nFree on all license tiers.\n\n> **⚠️ Warning: Community feature - not recommended for Enterprise use**\n>\n> The Telegram bot integration is a **community-built feature** in **beta**. It is not built, tested, or supported by Stirling Tools and is not covered by the Server / Enterprise support SLA. **We do not recommend it for Enterprise or production-critical deployments.** Raise issues on GitHub or in the community Discord. Behaviour and config keys may change in future releases.\n\n\n---\n\n## How it works\n\n1. A user, channel, or group sends a PDF file to your Telegram bot.\n2. The bot saves the file into a watched pipeline inbox folder.\n3. Stirling PDF processes the file using the pipeline JSON in that folder (see [Folder Scanning](doc:configuration/folderscanning)).\n4. The bot sends the result back to the chat.\n\nThe bot talks to Telegram outbound only - no inbound port or webhook setup required, just outbound HTTPS to `api.telegram.org`.\n\n---\n\n## Setup overview\n\n1. Create the bot in Telegram and get a bot token.\n2. Set your token and username in Stirling PDF.\n3. Drop a pipeline JSON into the inbox folder.\n4. Send a PDF to the bot.\n\n---\n\n## 1. Create the bot in Telegram\n\n1. Open [@BotFather](https://t.me/BotFather) in Telegram.\n2. Send `/newbot`.\n3. Pick a display name and a username ending in `bot`.\n4. Copy the token BotFather returns.\n\n**If you plan to add the bot to groups:** also send `/setprivacy`, select your bot, choose **Disable**. With privacy mode on (the default), the bot only sees commands and direct mentions in groups.\n\n---\n\n## 2. Configure Stirling PDF\n\nThe `telegram:` block is already present in the shipped `settings.yml` - find it and update the values (set `enabled: true`, fill in `botToken` and `botUsername`), or set the equivalent environment variables. Restart Stirling PDF after saving via file edits; the Admin UI hot-applies.\n\n### Minimal config\n\n```yaml\ntelegram:\n  enabled: true\n  botToken: \"your-token-from-botfather\"\n  botUsername: \"your_bot_username\"\n```\n\n### Recommended config\n\n```yaml\ntelegram:\n  enabled: true\n  botToken: \"your-token-from-botfather\"\n  botUsername: \"your_bot_username\"\n  customFolderSuffix: true       # one inbox per chat\n  enableAllowUserIDs: true       # restrict to known users\n  allowUserIDs: [123456789]\n  processingTimeoutSeconds: 180  # max time to wait for a result\n```\n\n### Admin UI\n\nIf you have login enabled, configure the bot from **Admin Settings → Connections → Telegram Bot**. Changes saved through the UI apply without a restart.\n\n---\n\n## 3. Drop a pipeline JSON into the inbox\n\nThe bot will not process uploads until at least one `.json` pipeline file exists in the chat's inbox folder.\n\nDefault inbox path: `/pipeline/watchedFolders/telegram/`. With `customFolderSuffix: true` (recommended), each chat gets its own subfolder named after its Telegram chat ID.\n\n### How to get a chat ID\n\nThe folder is created the first time a chat messages the bot. Easiest bootstrap:\n\n1. Send any message from the chat to the bot.\n2. Look at the new subfolder name under `/pipeline/watchedFolders/telegram/`.\n3. That subfolder name is the chat ID.\n\nOr chat with [@userinfobot](https://t.me/userinfobot) which echoes your user ID.\n\n### Build the pipeline JSON\n\nOpen the **Automate** tool, build the workflow you want, then click **Export for Folder Scanning** to download the JSON. Drop the file into the chat's inbox folder. The filename does not matter - any `.json` is picked up.\n\nSee [Pipeline Automation](doc:configuration/pipeline) for details.\n\n---\n\n## 4. Use the bot\n\nIn Telegram, send the bot a PDF. The bot acknowledges, processes it via the pipeline, and sends the result back. Typical end-to-end time is 1-3 minutes (depending on what the pipeline does).\n\nOnly files with MIME type `application/pdf` are accepted.\n\n`/start` in a private chat returns a welcome message.\n\n---\n\n## Configuration reference\n\nAll options live under the top-level `telegram:` block. Environment variables use the `TELEGRAM_*` form (Spring Boot relaxed binding: dots become underscores, camelCase joins stay glued).\n\n| YAML key | Default | Purpose |\n|---|---|---|\n| `enabled` | `false` | Master toggle. |\n| `botToken` | empty | BotFather token. |\n| `botUsername` | empty | Bot username, without the `@`. |\n| `pipelineInboxFolder` | `\"telegram\"` | Subfolder name under `/pipeline/watchedFolders/`. |\n| `customFolderSuffix` | `true` | Appends the chat ID as a subdirectory so each chat has its own inbox. |\n| `enableAllowUserIDs` | `true` | Turn on user ID allowlist (for private chats). |\n| `allowUserIDs` | `[]` | Allowed user IDs. |\n| `enableAllowChannelIDs` | `true` | Turn on channel ID allowlist. |\n| `allowChannelIDs` | `[]` | Allowed channel IDs (typically negative, e.g. `-1001234567890`). |\n| `processingTimeoutSeconds` | `180` | Max wait for a pipeline result. Keep ≥ 90s. |\n| `pollingIntervalMillis` | `2000` | How often to check for results. |\n| `feedback.user.*` | all `true` | Per-message-type replies in private chats (`noValidDocument`, `errorMessage`, `errorProcessing`, `processing`). |\n| `feedback.channel.*` | all `true` | Same for channels. |\n\n---\n\n## Access control\n\n- **Private chats**: controlled by `enableAllowUserIDs` + `allowUserIDs`.\n- **Channels**: controlled by `enableAllowChannelIDs` + `allowChannelIDs`.\n- **Groups and supergroups**: **always allowed** - the allowlist does not apply. To restrict group access, either don't add the bot to groups, or use BotFather's `/setjoingroups → Disable` so it can't be invited.\n\nFor production deployments, always enable the user or channel allowlist.\n\n---\n\n## Limitations\n\n- **20 MB upload limit** (a Telegram bot API constraint, not Stirling).\n- **One JSON per chat folder** when `customFolderSuffix: true`. Create the folder by messaging the bot first, then drop the JSON in.\n- **Output is sent file-by-file** - if your pipeline emits N files, the user gets N Telegram messages, no zipping.\n\n---\n\n## Recommended deployment patterns\n\n- **Personal use**: private-chat allowlist with your own user ID. Single pipeline JSON in your chat's subfolder.\n- **Team-shared inbox**: a Telegram group, with the bot's privacy mode disabled in BotFather. One pipeline JSON for the group.\n- **Per-user pipelines**: `customFolderSuffix: true` plus a tailored pipeline JSON per chat ID.\n- **Channel posting**: add the bot as a channel admin with \"Post Messages\" permission, restrict via `allowChannelIDs`.\n\n---\n\n## Related Documentation\n\n- **[Pipeline Automation](doc:configuration/pipeline)** - Build the pipeline JSONs the bot uses\n- **[Folder Scanning](doc:configuration/folderscanning)** - The processing engine the bot relies on\n- **[API Documentation](doc:api)** - Trigger pipelines without Telegram",
+      "sourcePath": "docs/Configuration/Telegram Bot.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Telegram Bot.md"
+    },
+    "configuration/ui-customisation": {
+      "id": "configuration/ui-customisation",
+      "title": "UI Customisation",
+      "section": "configuration",
+      "markdown": "Stirling PDF allows straightforward customization of the application name and appearance to make Stirling PDF your own.\n\n## Application Name Settings\nThis setting controls the application name:\n- `appNameNavbar` - Used as the browser tab title and as the issuer name shown in authenticator apps for two-factor (TOTP) login. Despite its name it is not shown in the navigation bar (which displays the logo), so do not leave it blank if you use TOTP. Empty falls back to \"Stirling PDF\".\n\n## Show update notifications\nThese settings (in Settings.yml) control system behavior and customization capabilities:\n- `showUpdate` - Controls whether update notifications are displayed\n- `showUpdateOnlyAdmin` - When true, restricts update notifications to admin users only (requires `showUpdate: true`)\n\n## UI Customization Options\n\n### In-App Settings Management (Recommended)\n\nIf you have login enabled and are logged in as an admin, you can configure all settings directly in the application through the **Settings** menu. No need to edit `settings.yml` manually!\n\n**How to access:**\n1. Enable login: `SECURITY_ENABLELOGIN=true`\n2. Log in as an admin user\n3. Navigate to **Settings** in the application\n4. Configure all options through the UI\n5. Changes apply immediately\n\n**Available customizations:**\n- Application name and branding\n- Update notification settings\n- Language settings\n- Theme preferences\n- Logo style (classic/modern)\n\nTo replace the bundled logo with your own, see [Static File Overrides](doc:configuration/other-customisations) - you drop your logo files into `customFiles/static/<style>-logo/` and they replace the built-in ones.\n\n### Static File Overrides (Advanced)\n\nFor customization beyond the built-in settings, you can override static files like logos, favicons, and images:\n\n```yaml\nservices:\n  stirling-pdf:\n    image: stirlingtools/stirling-pdf:latest\n    ports:\n      - '8080:8080'\n    volumes:\n      - ./customFiles:/customFiles:rw\n```\n\nThen place your custom files in `customFiles/static/` matching the path structure. Common examples:\n- `customFiles/static/favicon.svg` - Custom favicon\n- `customFiles/static/classic-logo/logo.svg` - Custom logo\n- `customFiles/static/modern-logo/logo.svg` - Custom modern logo\n\n**Learn more:** [Other Customisations - Static File Overrides](doc:configuration/other-customisations)\n\n### Injecting Custom CSS\n\nStirling PDF does not have a \"drop a CSS file here\" setting - the bundled `index.html` doesn't reference an extension stylesheet, so a `customFiles/static/custom.css` on its own won't load. To inject CSS you need to provide your own copy of `index.html` that links to your stylesheet.\n\nThis is the right approach for things like:\n\n- Tweaking colors or fonts beyond what theme settings cover\n- Overriding component z-index values (e.g. lifting the Google Drive Picker above modal overlays)\n- Hiding specific UI elements\n- Embedding tracking / analytics snippets in `<head>`\n\n#### Recipe\n\n**1. Drop your CSS file into `customFiles/static/`**\n\n```\ncustomFiles/\n  └── static/\n      └── custom.css\n```\n\nIt will be served at `/custom.css` (or under your configured root path if you've set `SYSTEM_ROOTURIPATH`).\n\n**2. Get a copy of the current bundled `index.html`**\n\nThe easiest way is to copy it out of a running container:\n\n```bash\ndocker cp stirling-pdf:/app/BOOT-INF/classes/static/index.html ./customFiles/static/index.html\n```\n\nIf that path doesn't exist on a future release (e.g. a layered JAR layout), try `/app/app.jar` instead and extract `BOOT-INF/classes/static/index.html` from it with `unzip`. The endpoint location is what matters - any equivalent copy of the served `index.html` works.\n\n**3. Add your stylesheet link**\n\nOpen `customFiles/static/index.html` and insert a `<link>` immediately before `</head>`:\n\n```html\n    <link rel=\"stylesheet\" href=\"/custom.css\">\n  </head>\n```\n\n**4. Restart Stirling PDF**\n\nOn the next boot, the log will show:\n\n```\nUsing custom index.html from: /customFiles/static/index.html\n```\n\nYour stylesheet now loads on every page.\n\n> **⚠️ Warning: Re-export `index.html` after every Stirling PDF upgrade**\n>\n> The bundled `index.html` references hashed JS/CSS asset filenames (e.g. `index-fSaGHxPC.js`) that change on every release. Your override will reference stale filenames after an upgrade and break the UI. Repeat step 2 (copy the new `index.html` and re-add your `<link>`) after each upgrade, or automate it with a small script in your deployment pipeline.\n\n\n#### Worked example - lift the Google Drive Picker above modal overlays\n\nThe file manager modal sits at `z-index: 1200`. The Google Drive picker, rendered by Google's own scripts, doesn't always respect this. Force its iframe overlay higher:\n\n```css\n/* customFiles/static/custom.css */\n.picker-dialog,\n.picker-dialog-bg {\n  z-index: 9999 !important;\n}\n```\n\nAfter completing the recipe above, restart and the picker now floats over the file manager.\n\n### Fork the Frontend (Developers)\n\nFor deeper customization than CSS can express (changing layouts, replacing components, adding new tools):\n\n1. Clone the Stirling PDF repository\n2. Modify the React components in `frontend/editor/src/`\n3. Build from the repo root: `cd frontend && npm ci`, then `task frontend:build:proprietary` (or pass `-PbuildWithFrontend=true` to the gradle build)\n4. Output appears in `frontend/editor/dist/`\n5. Copy the built artifacts into `customFiles/static/` and restart, or build your own Docker image\n\nThis approach requires maintaining your fork and manually merging updates.\n\n## Configuration Examples\n\n\n  \n    ```yaml\n    ui:\n      appNameNavbar: navbarName # Browser tab title and TOTP issuer label (not the navbar)\n\n    system:\n      showUpdate: false # Control update notification visibility\n      showUpdateOnlyAdmin: false # Restrict update notifications to admins\n    ```\n  \n  \n    You can configure the UI and system settings in two ways when running locally:\n\n    **Option 1: Using Java Properties**\n    ```bash\n    java -jar Stirling-PDF.jar \\\n      -DUI_APPNAMENAVBAR=\"Stirling PDF\" \\\n      -DSHOW_UPDATE=false \\\n      -DSHOW_UPDATE_ONLY_ADMIN=false\n    ```\n\n    **Option 2: Using Environment Variables**\n    ```bash\n    export UI_APPNAMENAVBAR=\"Stirling PDF\"\n    export SYSTEM_SHOWUPDATE=false\n    export SYSTEM_SHOWUPDATEONLYADMIN=false\n    ```\n  \n  \n    ```bash\n    -e UI_APPNAMENAVBAR=Stirling PDF \\\n    -e SYSTEM_SHOWUPDATE=false \\\n    -e SYSTEM_SHOWUPDATEONLYADMIN=false\n    ```\n  \n  \n    ```yaml\n    environment:\n      UI_APPNAMENAVBAR: Stirling PDF\n      SYSTEM_SHOWUPDATE: \"false\"\n      SYSTEM_SHOWUPDATEONLYADMIN: \"false\"\n    ```",
+      "sourcePath": "docs/Configuration/UI Customisation.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/UI Customisation.md"
+    },
+    "configuration/usage-monitoring": {
+      "id": "configuration/usage-monitoring",
+      "title": "Usage Monitoring",
+      "section": "configuration",
+      "markdown": "> **Tier**: Enterprise\n\nStirling PDF provides robust usage monitoring capabilities through its API, allowing you to track application usage patterns and performance metrics.\n\n## Non-Persistent Usage Monitoring API\n\nThe following API endpoints are available to all users to monitor usage statistics. These endpoints provide non-persistent usage data that can be queried on demand.\n\n| Endpoint | Description |\n|----------|-------------|\n| `GET /api/v1/info/status` | Application status and version information |\n| `GET /api/v1/info/requests` | Total count of POST requests for a specific endpoint (optional query parameter: `endpoint`) |\n| `GET /api/v1/info/requests/unique` | Count of unique users for POST requests for a specific endpoint |\n| `GET /api/v1/info/requests/all` | POST requests count for all endpoints |\n| `GET /api/v1/info/requests/all/unique` | Unique users count for POST requests for all endpoints |\n| `GET /api/v1/info/load` | Total count of GET requests for a specific endpoint (optional query parameter: `endpoint`) |\n| `GET /api/v1/info/load/unique` | Count of unique users for GET requests for a specific endpoint |\n| `GET /api/v1/info/load/all` | GET requests count for all endpoints |\n| `GET /api/v1/info/load/all/unique` | Unique users count for GET requests for all endpoints |\n\nAll endpoints return a JSON response with the requested statistics.\n\n## Prometheus Monitoring Configuration\n\nStirling PDF supports application metrics monitoring using Prometheus. This feature allows you to track application performance, usage patterns, and health metrics.\n\n### Prerequisites\n\n1. A valid Stirling PDF enterprise license\n2. Enterprise mode enabled in your configuration\n3. Running with additional features enabled (DISABLE_ADDITIONAL_FEATURES=false)\n\n### Configuration\n\nConfigure Prometheus monitoring using your preferred method:\n\n\n  \n    Configure in your `/configs/custom_settings.yml` file:\n\n    ```yaml\n    management:\n      endpoints:\n        web:\n          exposure:\n            include: prometheus,health,info\n      endpoint:\n        health:\n          show-details: always\n      metrics:\n        export:\n          prometheus:\n            enabled: true\n    enterprisemanagement:\n      metrics:\n        enabled: true\n    ```\n  \n  \n    Set the `JAVA_CUSTOM_OPTS` environment variable:\n\n    ```bash\n    JAVA_CUSTOM_OPTS=\"-Dmanagement.endpoints.web.exposure.include=prometheus,health,info -Dmanagement.endpoint.health.show-details=always -Dmanagement.metrics.export.prometheus.enabled=true -Denterprisemanagement.metrics.enabled=true\"\n    ```\n  \n  \n    ```bash\n    docker run -d \\\n      -p 8080:8080 \\\n      -e JAVA_CUSTOM_OPTS=\"-Dmanagement.endpoints.web.exposure.include=prometheus,health,info -Dmanagement.endpoint.health.show-details=always -Dmanagement.metrics.export.prometheus.enabled=true -Denterprisemanagement.metrics.enabled=true\" \\\n      stirlingtools/stirling-pdf:latest\n    ```\n  \n  \n    ```yaml\n    services:\n      stirling-pdf:\n        image: stirlingtools/stirling-pdf:latest\n        environment:\n          JAVA_CUSTOM_OPTS: \"-Dmanagement.endpoints.web.exposure.include=prometheus,health,info -Dmanagement.endpoint.health.show-details=always -Dmanagement.metrics.export.prometheus.enabled=true -Denterprisemanagement.metrics.enabled=true\"\n    ```\n  \n\n\n**What this configures:**\n- Prometheus metrics endpoint exposure\n- Health and info endpoints for basic monitoring\n- Detailed health information\n- Prometheus metrics export\n- Enterprise metrics collection\n\n### Accessing Metrics\n\nOnce configured, Prometheus metrics are available at the following endpoint:\n\n```\nhttps://your-stirling-pdf-instance/actuator/prometheus\n```\n\nThis endpoint provides metrics in a format that can be scraped by a Prometheus server.\n\n### Configuring Prometheus Server\n\nAdd the following job configuration to your Prometheus server's configuration file (`prometheus.yml`):\n\n```yaml\nscrape_configs:\n  - job_name: 'stirling-pdf'\n    metrics_path: '/actuator/prometheus'\n    scrape_interval: 15s\n    static_configs:\n      - targets: ['your-stirling-pdf-host:port']\n```\n\n### Available Metrics\n\nWith Prometheus integration enabled, Stirling PDF exposes the following types of metrics:\n- **JVM metrics**: Memory usage, garbage collection, thread utilization\n- **System metrics**: CPU usage, file descriptors\n- **Application metrics**: Request rates, processing times\n- **PDF processing metrics**: Document operations, conversion statistics",
+      "sourcePath": "docs/Configuration/Usage Monitoring.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Configuration/Usage Monitoring.md"
+    },
+    "contribute": {
+      "id": "contribute",
+      "title": "Contribution guidelines",
+      "section": "overview",
+      "markdown": "Thanks for taking a look at how to contribute to Stirling PDFs open-source codebase!\n\n## Development Setup\n\n### Prerequisites\n- Java 25 (JDK 25)\n- Node.js 18+\n- Docker (for testing)\n- Gradle (included in repository)\n\n### Getting Started\n\n1. **Clone the repository**\n   ```bash\n   git clone https://github.com/Stirling-Tools/Stirling-PDF.git\n   cd Stirling-PDF\n   ```\n\n2. **Install dependencies**\n\n   The repository uses [Task](https://taskfile.dev/) as a unified command runner. Install the `task` CLI, then from the repository root:\n   ```bash\n   task install\n   ```\n\n3. **Backend Development**\n   ```bash\n   # Build and run the Spring Boot backend\n   task backend:dev\n   # Backend runs on localhost:8080\n   ```\n\n4. **Frontend Development (V2.0+)**\n   ```bash\n   # Start the Vite dev server (run from the repository root)\n   task frontend:dev\n   # Frontend runs on localhost:5173, proxies API calls to backend (localhost:8080)\n   ```\n\n   To run the backend and frontend together, use `task dev` from the repository root.\n\n## Contributing to Code\n\n### Backend Contributions\n- See our [CONTRIBUTING guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)\n- Backend uses Spring Boot + Java\n- Code formatting: Run `./gradlew spotlessApply` before committing\n\n### Frontend Contributions (V2.0+)\n- Frontend is a React + TypeScript application\n- Uses Vite for build tooling\n- UI components: Mantine UI + TailwindCSS\n- Adding new tools: See [ADDING_TOOLS.md](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/ADDING_TOOLS.md)\n- Tool architecture: Uses `useToolOperation` hook pattern\n\n## Translation Contributions\n\n### Translations (TOML)\nTranslation files are located at `frontend/editor/public/locales/<lang>/translation.toml`\n- **CRITICAL**: Only edit `en-US/translation.toml`. `en-US` is the source/primary locale and the i18n fallback (`fallbackLng: \"en-US\"`); other languages are managed separately.\n- Each locale is a single TOML file (`translation.toml`), keyed by feature/tool.\n- For counts, use ICU-style plural suffixes on the key (`_one`, `_other`, and `_zero` where needed), for example `opCount_one`/`opCount_other`.\n\n## Development Resources\n- **API Documentation**: Access at `/swagger-ui/index.html` on your local instance\n- **Developer Guide**: See `DeveloperGuide.md` in the repository\n- **Claude Code Guide**: See `CLAUDE.md` for detailed architecture and patterns",
+      "sourcePath": "docs/Contribute.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Contribute.md"
+    },
+    "faq": {
+      "id": "faq",
+      "title": "FAQ",
+      "section": "overview",
+      "markdown": "## Frequently Asked Questions\n\n### Q1: Why are .htm files being downloaded when I use the application?\nThis is often caused by your NGINX configuration. NGINX's default file upload size is 1MB, and any file larger than this will cause an .htm file to be downloaded instead. To fix this issue, you should modify your NGINX configuration to increase the maximum file upload size.\n\n### Q2: Can I customize the appearance and language of the Stirling PDF application?\nYes, Stirling PDF provides several environment variables to allow customization of the application, custom HTML, CSS and other settings such as the visibility to search engines. Please refer to the [UI Customisation](doc:configuration/ui-customisation) section for more details.\n\n### Q3: I want to add a new feature to Stirling PDF. How can I contribute?\nWe welcome contributions from the community! Please open an issue on our GitHub page to discuss any large features before making any changes. Any small changes are fully welcome without discussion! After the feature has been discussed and approved, you can make the changes and submit a pull request.\n\n### Q4: I have a cool idea can you add it?\nAll feedback and suggestions are appreciated. It is best to submit these via a Github issue ticket with [Feature Request] in the title.\nYou can also reach out in discord but without a ticket to track it the request can often get lost!\n\n### Q5: I found a bug in Stirling PDF. Where can I report it?\nPlease report any bugs or issues you encounter through our [GitHub Issues page](https://github.com/Stirling-Tools/Stirling-PDF/issues). Be sure to include as much detail as possible so we can diagnose and resolve the issue quickly. If you're running Docker, use the built-in [diagnostics tool](doc:configuration/diagnostics) to collect logs, configuration, and system information into a shareable archive.\n\n### Q6: My Stirling PDF is using high RAM at idle. How can I optimize memory usage?\nStirling PDF's memory usage can be optimized in several ways:\n\n- **Use the Ultra Lite version:** Pull the `latest-ultra-lite` tag from Docker Hub or GitHub, which is specifically designed for lower-end hardware.\n- **Tune memory allocation:** See the [Fine Tuning](doc:configuration/performance-optimization) section of the Performance Optimization guide for how to adjust memory limits.\n- **Reduce LibreOffice instances:** Each idle LibreOffice UNO server instance uses approximately 50 MB. The default session limit is 1. See [LibreOffice Parallel Processing](doc:configuration/libreoffice-parallel-processing) for details.\n\nFor detailed sizing recommendations, see the [Performance Optimization](doc:configuration/performance-optimization) guide.\n\n### Q7: I'm experiencing connection errors when pulling from docker.stirlingpdf.com\n\nIf you experience connection issues, use these alternative endpoints:\n\n- Docker Hub: `docker pull stirlingtools/stirling-pdf:latest`\n- GitHub: `docker pull ghcr.io/stirling-tools/stirling-pdf:latest`\n\nAll endpoints provide the same functionality.\n\n### Q8: Does Stirling PDF track my data?\n\nNo, we track no data without your explicit consent. You can see how, when, and why at our [Analytics and Telemetry](https://docs.stirlingpdf.com/analytics-telemetry) page.\n\n### Q9: When I upload a file, where is it processed?\n\nUploads go to the server or desktop instance you're using, not to Stirling servers. The macOS/Windows desktop apps process files locally - even when you pick the Stirling Cloud sign-in today - so your PDFs stay on your device unless you point the app to a remote self-hosted server. Planned SaaS-assisted features (for desktop app) will be opt-in when they arrive.\n\n### Q10: What are the different JAR files and which should I use?\n\nStirling PDF comes in three different JAR files:\n\n**Stirling-PDF-with-login.jar** (Recommended - Full Features):\n- Bundles frontend UI + backend server\n- **Includes authentication and additional features** - requires user login\n- **Recommended for all users** - personal, shared, or enterprise deployments\n\n**Stirling-PDF.jar** (Plain JAR - Basic Features):\n- Bundles frontend UI + backend server\n- **Basic version** - no authentication, core features only\n- Only use if you require no login at all and don't mind missing certain features\n\n**Stirling-PDF-server.jar** (Backend Only - **Advanced**):\n- Backend server only (no bundled frontend UI)\n- **No authentication** - API access only\n- Use for API access, desktop app backend, or custom frontend\n\n### Q11: How do I enable or disable authentication?\n\n**Default JAR (Stirling-PDF.jar)**: Authentication is **not available** (security module not included at build time).\n\n**With-Login JAR (Stirling-PDF-with-login.jar)**: Authentication is **enabled by default**.\n\nTo disable authentication in the with-login version:\n\n\n  \n    ```yaml\n    security:\n      enableLogin: false\n    ```\n  \n  \n    ```bash\n    docker run -d \\\n      -p 8080:8080 \\\n      -e SECURITY_ENABLELOGIN=false \\\n      stirlingtools/stirling-pdf:latest\n    ```\n  \n  \n    ```yaml\n    environment:\n      SECURITY_ENABLELOGIN: false\n    ```\n  \n  \n    ```bash\n    java -jar Stirling-PDF-with-login.jar -DSECURITY_ENABLELOGIN=false\n    ```\n  \n  \n    ```bash\n    export SECURITY_ENABLELOGIN=false\n    java -jar Stirling-PDF-with-login.jar\n    ```\n  \n\n\nFor more details, see the [System and Security Configuration](doc:configuration/system-and-security) documentation.\n\n### Q12: Where do my files go on the desktop app, and what does \"uploading to server\" mean?\n\nThe desktop app runs a small Stirling PDF backend **inside the app on your own computer** (localhost). The Connection mode you pick (Settings -> Connection) decides where each tool runs:\n\n- **Local-only** (default; not signed in, no server connected): every tool runs on the local backend and your files never leave your device. If you use a tool the local backend can't perform (OCR, Office conversions, and similar), the file is **not** sent anywhere - the app stops and asks you to sign in to Stirling Cloud or connect to a self-hosted server.\n- **Signed in to Stirling Cloud**: server-side tools are processed on Stirling's cloud (transient, not stored).\n- **Connected to a self-hosted server**: server-side tools go only to your own server.\n\nBottom line: in local-only mode a server-side tool is either run locally or blocked with a prompt - it is never silently uploaded anywhere.\n\n### Q13: Can I remove an existing watermark from a PDF?\n\nThere is no dedicated watermark-removal tool. Stirling PDF can **add** watermarks (Add Watermark) but cannot automatically strip existing ones.\n\n### Q14: Can I add multi-line text or line breaks with Add Text, Stamp, or Watermark?\n\nYes. Put a literal `\\n` in the text field to force a line break; each line is rendered separately.\n\n### Q15: Why does my self-hosted instance make requests to js.stripe.com?\n\nStripe's script loads only for the in-app purchase / billing UI. No PDF or document data is sent to Stripe. Fully offline/air-gapped instances are unaffected in normal use - the request only matters if you open the billing/upgrade screen.\n\n### Q16: Is a specific feature supported?\n\nWe are continuously improving Stirling PDF, and the exact feature you're looking for might not be available yet - for example, a native Android app or in-app PDF translation. You can raise a feature request for any and all features on our [GitHub issues page](https://github.com/Stirling-Tools/Stirling-PDF/issues) with `[Feature Request]` in the title.",
+      "sourcePath": "docs/FAQ.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/FAQ.md"
+    },
+    "functionality/advanced-tools": {
+      "id": "functionality/advanced-tools",
+      "title": "Advanced Tools",
+      "description": "Power user features for automation and complex PDF operations",
+      "section": "functionality",
+      "markdown": "Advanced tools for automation workflows and complex PDF operations.\n\n---\n\n## Automation Tools\n\n### Automate (Pipeline)\n\n**Tool ID:** `automate`\n\nChain multiple operations into automated workflows. Save and reuse pipeline configurations, process files automatically with predefined steps, and set up folder watching for automatic processing.\n\n**[Read the complete Pipeline Automation Guide →](doc:configuration/pipeline)**\n\n---\n\n### Auto Rename\n\n**Tool ID:** `autoRename`\n\nAutomatically rename PDF files based on their content. Analyzes each PDF and suggests filenames using this priority:\n1. PDF metadata title (if present)\n2. Largest font text on first page\n3. First heading or prominent text\n4. First line of readable text\n\nWorks best with documents that have clear titles. Scanned documents may need [OCR](doc:functionality/ocr) first.\n\n---\n\n## Formatting Tools\n\n### Adjust Contrast\n\n**Tool ID:** `adjustContrast`\n\nAdjust brightness, contrast, and saturation of PDF content. Useful for improving readability of faded scans or creating high-contrast versions.\n\n---\n\n### Repair\n\n**Tool ID:** `repair`\n\nAttempt to repair corrupted or damaged PDF files. Can fix broken cross-reference tables, corrupted object streams, missing headers, and encoding errors.\n\nCannot recover physically deleted data. Success depends on extent of corruption.\n\n---\n\n### Scanner Image Split\n\n**Tool ID:** `scannerImageSplit`\n\nAutomatically detect and split individual scanned photos from multi-image PDF scans. Useful for batch-scanned photo collections.\n\n---\n\n### Overlay PDFs\n\n**Tool ID:** `overlayPdfs`\n\nLayer one PDF on top of another. Control position, opacity, and whether the overlay appears in the foreground or background. Apply to specific pages or all pages.\n\n---\n\n### Replace Color\n\n**Tool ID:** `replaceColor`\n\nReplace specific colors in a PDF or invert all colors. Options include full color inversion, targeted color replacement, and adjustable matching threshold.\n\n---\n\n### Add Image\n\n**Tool ID:** `addImage`\n\nInsert images into PDF pages with precise positioning and sizing. Supports common image formats.\n\n---\n\n### Scanner Effect\n\n**Tool ID:** `scannerEffect`\n\nApply realistic scanner-like effects to digital PDFs  - slight rotation/skew and scan artifacts to make documents appear physically scanned.\n\n---\n\n## Developer Tools\n\n### Show JavaScript\n\n**Tool ID:** `showJS`\n\nDisplay any embedded JavaScript code within a PDF document. Useful for security auditing and understanding PDF form logic.\n\n---\n\n### Quick Links\n\n- **[API Documentation](doc:api)**\n- **[Folder Scanning Setup](doc:configuration/folderscanning)**\n- **[SSO Configuration](doc:configuration/single-sign-on-configuration)**\n- **[General Configuration](doc:configuration/configuration)**",
+      "sourcePath": "docs/Functionality/Advanced-Tools.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Advanced-Tools.md"
+    },
+    "functionality/compare": {
+      "id": "functionality/compare",
+      "title": "Compare PDFs",
+      "description": "Compare two PDF documents and highlight differences",
+      "section": "functionality",
+      "markdown": "Compare two PDF documents and highlight their differences. Runs entirely in your browser, so your files never leave your computer.\n\nComparison is text-based (word-level): the tool extracts the text from both PDFs and highlights what changed, with removed words in red and added words in green. It works best on digital PDFs where you care about wording changes. For scanned documents, run [OCR](doc:functionality/ocr) first to make the text selectable.\n\n---\n\n## How to Use\n\n1. **Select Original PDF** - Choose the original/older version\n2. **Select Edited PDF** - Choose the new/revised version\n3. **Compare** - Process the documents\n4. **Review Differences** - View highlighted changes\n\n---\n\n## Features\n\n- **Side-by-side or stacked layout** - Toggle between horizontal and vertical views\n- **Word-level diff** - Removed words highlighted in red, added words highlighted in green\n- **Change navigation** - Dropdown selectors to jump between deletions and additions\n- **Synchronized scrolling** - Optional linked scrolling between the two panes\n- **Zoom and pan** - Scroll-wheel zoom, pinch-to-zoom, and drag to pan\n\n---\n\n## Limitations\n\n- Works best with digital PDFs (not scanned). It compares extracted text only, so layout-only or image-only changes are not detected. For scanned documents, run [OCR](doc:functionality/ocr) first\n- Documents with no extractable text cannot be compared\n- Very large or highly dissimilar documents may be stopped early with a warning\n\n---\n\n## Related Tools\n\n- **[OCR](doc:functionality/ocr)** - Make scanned PDFs searchable before comparing",
+      "sourcePath": "docs/Functionality/Compare.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Compare.md"
+    },
+    "functionality/compress": {
+      "id": "functionality/compress",
+      "title": "Compress PDF",
+      "description": "Reduce PDF file size while maintaining quality",
+      "section": "functionality",
+      "markdown": "Reduce PDF file size by compressing images, optimizing structure, and removing unnecessary data.\n\n**Important:** Compression is permanent. Always keep a backup of the original if you might need maximum quality later.\n\n---\n\n## How to Use\n\n1. **Upload Your PDF** - Select one or more PDFs\n2. **Choose Compression Level** - Select quality vs. size balance\n3. **Configure Options** - Enable grayscale, line art, etc. (optional)\n4. **Compress** - Process the files\n5. **Download** - Get your compressed PDFs\n\n---\n\n## Options\n\n| Option | Description |\n|--------|-------------|\n| **Optimize Level** (1-9) | Controls compression aggressiveness. Higher = smaller file, lower quality. Levels 1-3 are light, 4-5 are moderate, 6+ trigger additional compression passes |\n| **Expected Output Size** | Set a target file size (e.g. `25MB`) and the tool will automatically adjust the optimize level to hit it |\n| **Grayscale** | Convert all images to grayscale. Can significantly reduce size for color documents where color isn't needed |\n| **Linearize** | Optimize PDF for fast web viewing  - reorders the file so the first page loads before the entire file is downloaded |\n| **Normalize** | Normalize internal PDF structure for better compatibility |\n| **Line Art** | Convert images to high-contrast line art. Useful for documents with diagrams, sketches, or black-and-white illustrations |\n| **Line Art Threshold** (0-100) | Controls sensitivity of line art conversion. Default: 55. Only used when Line Art is enabled |\n| **Line Art Edge Level** (1-3) | Edge detection strength for line art. 1 = light, 3 = strong. Only used when Line Art is enabled |\n\n---\n\n## What Happens at Each Level\n\n- **Levels 1-3**  - Basic optimization, preserves quality\n- **Levels 4-5**  - Image recompression enabled, moderate quality reduction\n- **Levels 6+**  - Aggressive compression with additional processing passes\n- **Levels 8+**  - Uses Zopfli compression on supported systems for maximum reduction\n\n---\n\n## API Usage\n\n```bash\ncurl -X POST http://stirling-pdf:8080/api/v1/misc/compress-pdf \\\n  -F \"fileInput=@document.pdf\" \\\n  -F \"optimizeLevel=5\" \\\n  -F \"grayscale=false\" \\\n  -F \"linearize=false\" \\\n  -F \"lineArt=false\" \\\n  -o compressed.pdf\n```\n\nWith target size:\n```bash\ncurl -X POST http://stirling-pdf:8080/api/v1/misc/compress-pdf \\\n  -F \"fileInput=@document.pdf\" \\\n  -F \"expectedOutputSize=10MB\" \\\n  -o compressed.pdf\n```\n\nSee [API Documentation](doc:api) for complete endpoint reference.\n\n---\n\n## Decompress PDF\n\n> **📝 Note: Automation / API**\n>\n> There is also an automation option that does the opposite: it fully expands a compressed PDF so its contents are readable as plain text, which is handy for troubleshooting or editing a PDF by hand (the file gets larger). It runs through automation rather than a tool in the web app - see the [API reference](doc:api).\n\n\n---\n\n## Related Tools\n\n- **[OCR](doc:functionality/ocr)** - Make searchable before compressing\n- **[Convert](doc:functionality/convert/convert)** - Convert formats before compressing\n- **[Merge](doc:functionality/page-operations/page-operations)** - Combine then compress",
+      "sourcePath": "docs/Functionality/Compress.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Compress.md"
+    },
+    "functionality/content-editing/content-editing": {
+      "id": "functionality/content-editing/content-editing",
+      "title": "Content & Editing",
+      "description": "Add, extract, and modify PDF content",
+      "section": "functionality/content-editing",
+      "markdown": "## Features - Content & Editing\n\nTools for adding, extracting, and modifying content within PDF documents.\n\n---\n\n## Images\n\n- **Add Image**: Drop a logo, photo, or graphic onto your PDF. Choose where it sits on the page and resize it to fit.\n\n- **Extract Images**: Pull every image out of a PDF and download them as separate files (PNG, JPG, and other common formats).\n\n- **Remove Images**: Strip all images out of a PDF to shrink the file size. Use this when you want the pictures gone rather than saved (use **Extract Images** if you want to keep them).\n\n- **Detect & Split Scanned Photos**: Automatically detect individual scanned photos on a page and split them out into separate images.\n\n---\n\n## Stamps & Annotations\n\n- **Add Text**: Place custom text anywhere on your PDF. Pick the spot, then type a label, caption, or note directly onto the page. Multi-line text is supported: enter a literal `\\n` in the text field to add a line break.\n\n- **Add Stamp**: Stamp your pages with your own text or an image. Set the position, size, rotation, and opacity, and apply it to one page or all of them.\n\n- **Remove Annotations**: Clear out every comment, highlight, and markup while leaving the rest of the document untouched.\n\n---\n\n## Visual Editing\n\n- **Replace & Invert Color**: Recolor a PDF for better contrast or readability. Pick a high-contrast preset (such as white text on black), set your own text and background colors, invert every color at once, or convert to CMYK for printing.\n\n---\n\n## Metadata & Information\n\n- **Change Metadata**: Edit a PDF's document details such as author, title, subject, keywords, and creation date. You can also add or remove these fields.\n\n- **Get ALL Info on PDF**: See everything there is to know about a PDF, including:\n  - PDF version and file size\n  - Page count and dimensions\n  - Fonts used\n  - Security settings and permissions\n  - Complete metadata\n  - Export all information in JSON format\n\n---\n\n## Related Tools\n\n- **[OCR](doc:functionality/ocr)** - Make scanned images searchable before extracting text\n- **[Compress](doc:functionality/compress)** - Reduce file size after adding images\n- **[Security](doc:functionality/security/security)** - Add watermarks or sanitize metadata",
+      "sourcePath": "docs/Functionality/Content-Editing/Content-Editing.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Content-Editing/Content-Editing.md"
+    },
+    "functionality/convert/convert": {
+      "id": "functionality/convert/convert",
+      "title": "Convert",
+      "description": "Convert files to and from PDF format",
+      "section": "functionality/convert",
+      "markdown": "Convert between PDF and 50+ file formats including documents, images, web pages, and more.\n\n---\n\n## How to Use\n\n1. **Select conversion type** - Choose what you're converting from and to\n2. **Upload files** - Add one or multiple files\n3. **Configure options** - Adjust quality, DPI, layout (optional)\n4. **Convert** - Process and download\n\n---\n\n## Supported Conversions\n\n### Convert TO PDF\n\n| Category | Formats |\n|----------|---------|\n| **Office** | DOCX, DOC, ODT, XLSX, XLS, ODS, PPTX, PPT, ODP, TXT, RTF |\n| **Images** | JPG, JPEG, PNG, GIF, BMP, TIFF, WEBP, SVG |\n| **Web** | HTML (with CSS/images via ZIP), URL, Markdown |\n| **Email** | EML, MSG (Outlook) |\n| **eBook** | EPUB, MOBI, AZW3, FB2 |\n| **Comics** | CBZ, CBR |\n\neBook and Outlook (MSG) inputs are converted to PDF on the self-hosted server (eBook conversion uses the bundled Calibre runtime; enable the Calibre group if your image excludes it).\n\n### Convert FROM PDF\n\n| Category | Formats |\n|----------|---------|\n| **Office** | DOCX, ODT, PPTX, ODP, XLSX, TXT, RTF, Markdown |\n| **Images** | PNG, JPG, GIF, TIFF, BMP, WEBP |\n| **Data** | CSV, HTML, XML |\n| **Archival / Print** | PDF/A, PDF/X |\n| **eBook** | EPUB, AZW3 |\n| **Comics** | CBZ, CBR |\n\nPDF to Excel extracts tabular data and writes one worksheet per detected table. PDF to eBook (EPUB/AZW3) uses the bundled Calibre runtime. PDF/X is the print-optimized variant of PDF/A and is chosen from the same Archive / Print option (it needs Ghostscript, which is in the standard Docker image).\n\n---\n\n## Conversion Options\n\n### Image Settings (when converting to/from images)\n- **DPI:** 72 (screen), 150 (standard), 300 (print)\n- **Color Mode:** Color, Grayscale, Black & White\n- **Layout:** Fit to page, maintain aspect ratio, fill page\n- **Output:** Single PDF or separate files\n\n### PDF to Word / Office\n- Works best with digital PDFs (not scanned images)\n- For scanned PDFs, run [OCR](doc:functionality/ocr) first\n- Complex layouts may need manual adjustment after conversion\n\n### PDF to CSV\n- Works best with simple, well-structured tables in digital PDFs\n- Not reliable for scanned documents\n\n### PDF to Markdown\n- Table-aware converter that runs locally on your server\n- Turns larger text into Markdown headings based on font size\n- Rebuilds detected tables as Markdown tables, joining tables that split across a page break\n- Works best with digital PDFs; run [OCR](doc:functionality/ocr) first for scanned input\n\n---\n\n## Automation and API conversions\n\nA few conversions have no button in the Convert tool. They run only through the [API](doc:api) and the [Automate / pipeline](doc:configuration/pipeline) workflow.\n\n- **PDF to vector / page-description formats** - export a PDF as EPS, PS, PCL, or XPS for print and publishing workflows.\n- **PostScript to PDF** - turn PostScript files (PS, EPS, EPSF) into PDF, with an optional print-oriented (prepress) profile.\n\nThe vector and PostScript conversions need the **Ghostscript** group, which is included in the standard Docker image.\n\nSee the [API reference](doc:api) for the exact parameters of these conversions.\n\n---\n\n## API Usage\n\n\n  \n    ```bash\n    curl -X POST http://stirling-pdf:8080/api/v1/convert/img/pdf \\\n      -F \"fileInput=@image.jpg\" \\\n      -F \"colorType=color\" \\\n      -F \"fitOption=maintainAspectRatio\" \\\n      -o output.pdf\n    ```\n  \n  \n    ```bash\n    curl -X POST http://stirling-pdf:8080/api/v1/convert/pdf/word \\\n      -F \"fileInput=@document.pdf\" \\\n      -o output.docx\n    ```\n  \n\n\nSee [API Documentation](doc:api) for complete endpoint reference.\n\n---\n\n## Related Tools\n\n- **[Compress](doc:functionality/compress)** - Reduce file size after conversion\n- **[OCR](doc:functionality/ocr)** - Make scanned PDFs searchable before converting\n- **[Merge](doc:functionality/page-operations/page-operations)** - Combine multiple converted PDFs",
+      "sourcePath": "docs/Functionality/Convert/Convert.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Convert/Convert.md"
+    },
+    "functionality/features-pipeline": {
+      "id": "functionality/features-pipeline",
+      "title": "Features - Pipeline / Automate",
+      "description": "Pipeline and Automate Feature overview",
+      "section": "functionality",
+      "markdown": "> **ℹ️ Info: V2.0 Update**\n>\n> In V2.0, the pipeline feature's frontend interface has been renamed to **\"Automate\"** with an improved user experience. All backend functionality remains the same - existing pipeline JSON files work without changes.\n\n\nThe Pipeline/Automate feature in Stirling PDF enables automated, sequential processing of PDFs through multiple operations. This powerful automation tool allows you to:\n\n- `create-pipeline`: Create custom workflows combining multiple PDF operations into a single automated process. For example, you could create a pipeline that:\n  - Splits a PDF\n  - Adds watermarks to each part\n  - Compresses the results\n  - All in one automated sequence\n\n- `save-pipeline`: Save pipeline configurations for future use, share them with others, or use them in automated folder scanning processes\n\n- `folder-scanning`: Set up automated processing of files in watched folders using your pipeline configurations. The system will automatically process any files placed in these folders according to your pipeline rules\n\n## Additional Features\n\n- Web UI configuration interface for easy pipeline setup\n- JSON-based configuration for advanced users\n- Support for multiple pipeline configurations\n- Automatic unzipping of intermediate results\n- Error handling and validation\n- Ability to save and load pipeline configurations\n\nFor detailed information on setting up and using pipelines, see:\n- [Pipeline Configuration Guide](doc:configuration/pipeline)\n- [Folder Scanning Guide](doc:configuration/folderscanning)\n\n## Current Limitations\n\n- Cannot have multiple instances of the same operation in a single pipeline\n- Web UI does not support operations requiring multiple different types of inputs\n- Files and operations run in serial mode\n- Additional file inputs during processing are not supported via UI",
+      "sourcePath": "docs/Functionality/Features Pipeline.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Features Pipeline.md"
+    },
+    "functionality/fill-form": {
+      "id": "functionality/fill-form",
+      "title": "Fill Form",
+      "description": "Fill in a PDF's form fields right in the viewer and download the completed PDF",
+      "section": "functionality",
+      "markdown": "Fill Form lets you complete a PDF's interactive form fields directly in the viewer and download the filled result. Open a PDF that already contains form fields - text boxes, checkboxes, radio buttons, dropdowns - type your answers into the fields shown on the page, and save the completed document.\n\nFill Form works with fields that are already in the PDF; it does not add new fields. If a form has no fillable fields, there is nothing to type into.\n\n---\n\n## How to Use\n\n1. **Open the tool** - Select Fill Form from the tools list. It opens in the viewer workbench.\n2. **Load a PDF** - Upload a PDF that contains form fields. Stirling PDF reads the fields and overlays them on the page.\n3. **Fill the fields** - Click each field and enter its value. Checkboxes, radio buttons, and dropdowns can be toggled or selected.\n4. **Download** - Save to export the filled PDF.\n\n---\n\n## How It Differs from Other Form Tools\n\n- **Fill Form** keeps the fields editable - it just populates their values, so the form can still be changed later.\n- **Flatten** merges form fields into the page so they become part of the static document and can no longer be edited. Use it when you want to lock in answers before sending a final copy. See [Flatten](doc:functionality/security/security).\n- **Unlock PDF Forms** removes read-only restrictions from fields so locked fields can be edited again. Use it when a form refuses input because its fields are marked read-only. See [Unlock PDF Forms](doc:functionality/security/security).\n\n---\n\n## Notes\n\n- Runs in your self-hosted Stirling PDF instance with no external service or credits required. See [Modes](doc:modes-and-licensing).\n- The PDF must already contain fillable form fields. PDFs with no fields, or scanned image-only forms, have nothing to fill.\n- Automating form filling? You can do the same thing in a pipeline or script. See the [API reference](doc:api) for details.\n\n---\n\n## Related Tools\n\n- **[Multi-Tool Workbench](doc:functionality/multi-tool)** - Visual page editing\n- **[Complete Tool Reference](doc:functionality/functionality)** - All available tools",
+      "sourcePath": "docs/Functionality/Fill-Form.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Fill-Form.md"
+    },
+    "functionality/functionality": {
+      "id": "functionality/functionality",
+      "title": "PDF Tools",
+      "description": "All PDF tools organized by category",
+      "section": "functionality",
+      "markdown": "All tools organized by category.\n\n---\n\n## Most Popular\n\n- **[PDF Text Editor](doc:functionality/recommended-tools)** *(Alpha)* - Edit text and images in the browser\n- **[Multi-Tool](doc:functionality/multi-tool)** - Upload once, chain operations\n- **[Read & Annotate](doc:functionality/read-and-annotate)** - PDF viewer with annotations\n- **Merge** - Combine multiple PDFs\n- **[Convert](doc:functionality/convert/convert)** - 50+ format conversions\n- **[Compress](doc:functionality/compress)** - Reduce file size\n- **[OCR](doc:functionality/ocr)** - Make scanned PDFs searchable\n- **[Compare](doc:functionality/compare)** - See differences between PDFs\n- **Redact** - Remove sensitive content\n\n---\n\n## [Security](doc:functionality/security/security)\n\n- Add/Remove Password\n- Change Permissions\n- **[Sign](doc:functionality/security/sign)** - Handwritten signatures\n- **[Certificate Sign](doc:functionality/security/certificate-signing)** - Digital signatures\n- Validate Signature\n- Add Watermark\n- Sanitize PDF\n- Redact\n\n---\n\n## [Page Operations](doc:functionality/page-operations/page-operations)\n\n- Split PDF\n- Merge PDFs\n- Rotate Pages\n- Extract Pages\n- Reorganize Pages\n- Add Page Numbers\n- Remove Pages/Blank Pages\n\n**Detailed Guide:** [Redaction](doc:functionality/page-operations/redact)\n\n---\n\n## [Convert](doc:functionality/convert/convert)\n\n**To PDF:** Word, Excel, PowerPoint, Images, HTML, Markdown, Email, and more\n\n**From PDF:** Word, PowerPoint, Text, Images, CSV, HTML, XML, PDF/A, and more\n\n---\n\n## [Content & Editing](doc:functionality/content-editing/content-editing)\n\n- Add/Extract Images\n- Add Stamp\n- Edit Metadata\n- Remove Annotations\n- Replace Colors\n- Get PDF Info\n\n---\n\n## [Advanced Tools](doc:functionality/advanced-tools)\n\n- Overlay PDFs\n- Booklet Imposition\n- Multi-Page Layout\n- Scale Pages\n- Auto Rename\n- Show JavaScript\n- Scanner Effect\n\n---\n\n## Quick Tool Finder\n\n**I want to...**\n- Reduce file size → **[Compress](doc:functionality/compress)**\n- Make searchable → **[OCR](doc:functionality/ocr)**\n- Combine files → **Merge**\n- Split into parts → **Split**\n- Convert format → **[Convert](doc:functionality/convert/convert)**\n- Add signature → **[Sign](doc:functionality/security/sign)** or **[Certificate Sign](doc:functionality/security/certificate-signing)**\n- Remove content → **Redact** or **Sanitize**\n- Edit pages → **Reorganize Pages** or **[Multi-Tool](doc:functionality/multi-tool)**\n- Automate workflow → **[Automate](doc:configuration/pipeline)**",
+      "sourcePath": "docs/Functionality/Functionality.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Functionality.md"
+    },
+    "functionality/mobile-scanner": {
+      "id": "functionality/mobile-scanner",
+      "title": "Mobile Scanner",
+      "description": "Scan documents from your mobile phone and upload them directly to your desktop or server",
+      "section": "functionality",
+      "markdown": "## Mobile Scanner (Phone Upload)\n\nThe Mobile Scanner lets you scan documents with your phone camera and upload them straight to your Stirling PDF instance. Show a QR code on your desktop, scan it with your phone, and your photos transfer automatically - no cables, no cloud services, no manual file handling.\n\nDepending on your [server settings](doc:configuration/mobile-scanner), uploaded images can be automatically converted to PDF with configurable page format, resolution, and scaling options.\n\n## How It Works\n\n1. Desktop generates a QR code with a unique session ID\n2. Mobile device scans the QR code\n3. Mobile uploads photos or images\n4. Desktop retrieves files\n5. Files auto-delete after 10 minutes of inactivity or upon download\n\n## Using Mobile Scanner in the desktop app\n\nMobile Scanner also works in the Stirling PDF desktop app. A couple of things are worth knowing:\n\n- Your phone and the desktop must be on the **same local network (Wi-Fi)**.\n- The QR code points to your desktop's address on that network, so your phone connects straight to it. Nothing leaves your local network.\n- The desktop upload page is a simple capture-and-send page. It does **not** do the automatic page edge detection and auto-cropping that the browser-based Mobile Scanner offers, so line up and crop your photos before uploading.\n\n## Privacy & Security\n\n- Files stored temporarily in system temp directory only\n- No permanent storage on server\n- Auto-deleted after 10 minutes\n- Works on local network or HTTPS tunnel\n- No cloud storage involved\n\n## Configuration\n\nSee [Mobile Scanner Configuration](doc:configuration/mobile-scanner) for enable/disable and PDF conversion settings.",
+      "sourcePath": "docs/Functionality/Mobile-Scanner.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Mobile-Scanner.md"
+    },
+    "functionality/multi-tool": {
+      "id": "functionality/multi-tool",
+      "title": "Multi-Tool Workbench",
+      "description": "Visual page editor for PDF manipulation",
+      "section": "functionality",
+      "markdown": "**Tool ID:** `multiTool`\n\nMulti-Tool is Stirling PDF's visual page editor. Upload PDFs and manipulate pages directly - rotate, reorder, delete, split, and insert pages or files.\n\n> **💡 Tip**\n>\n> Multi-Tool uses browser file storage so you can upload files once and work with them without re-uploading.\n\n\n---\n\n## Features\n\n- **Thumbnail grid** - See every page at a glance with zoomable previews\n- **Rotate** pages left/right, individually or in bulk\n- **Reorder** pages by dragging and dropping\n- **Delete** unwanted pages\n- **Split** PDFs by toggling split positions between pages\n- **Insert page breaks** - add blank pages at any position\n- **Insert files** - add entire PDFs into the document at any point\n- **Select pages** individually, select all, or by page number range\n- **Export selected** pages or save the full document\n- **Undo/redo** all changes\n\n---\n\n## How to Use\n\n1. **Upload** - Drag and drop one or more PDFs into the workspace\n2. **Select pages** - Click thumbnails or use select all / page number input\n3. **Edit** - Rotate, reorder, delete, split, or insert as needed\n4. **Export** - Save changes to download the full PDF, or export selected pages only\n\n---\n\n## Multi-Tool vs. Individual Tools vs. Automate\n\n| | Multi-Tool | Individual Tools | Automate |\n|---|---|---|---|\n| Multiple operations | Yes | No | Yes |\n| Visual feedback | Yes | Limited | No |\n| Repeatable workflow | No | No | Yes |\n| Folder watching | No | No | Yes |\n\n---\n\n## Related Documentation\n\n- **[Automate (Pipeline)](doc:functionality/features-pipeline)** - Automated workflows\n- **[Complete Tool Reference](doc:functionality/functionality)** - All available tools",
+      "sourcePath": "docs/Functionality/Multi-Tool.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Multi-Tool.md"
+    },
+    "functionality/ocr": {
+      "id": "functionality/ocr",
+      "title": "OCR (Optical Character Recognition)",
+      "description": "Make scanned PDFs searchable and editable with OCR",
+      "section": "functionality",
+      "markdown": "Make scanned PDFs searchable and selectable by recognizing text in images. Uses the Tesseract OCR engine.\n\n> **📝 Note: Requires a server backend**\n>\n> OCR needs a server-side backend with Tesseract installed. The desktop app cannot OCR in local-only mode - connect it to Stirling Cloud or a self-hosted server that has OCR available.\n\n\n---\n\n## When You Need OCR\n\n- Scanned paper documents (no text layer)\n- Photos of documents or whiteboards\n- Image-only PDFs where you can't select or search text\n\n---\n\n## How to Use\n\n1. **Upload Your PDF** - Select a scanned or image-based PDF\n2. **Select Language(s)** - Choose the language(s) in your document\n3. **Configure Options** - Adjust OCR mode and preprocessing (optional)\n4. **Process** - Run OCR\n5. **Download** - Get your searchable PDF\n\n---\n\n## Options\n\n| Option | Values | Description |\n|--------|--------|-------------|\n| **Languages** | Select from installed packs | Must match the languages in your document. Select multiple if needed |\n| **OCR Mode** | Auto (default), Force, Strict | Auto skips pages that already have text. Force re-OCRs everything. Strict aborts if any text is found |\n| **Compatibility Mode** | On/Off | Uses sandwich PDF format for better compatibility with older software (larger files) |\n\n### Advanced Options\n\n| Option | Description |\n|--------|-------------|\n| **Deskew** | Automatically straighten tilted/skewed pages |\n| **Clean Input** | Preprocess by removing noise and enhancing contrast for better recognition |\n| **Clean Final Output** | Post-process the final PDF to remove OCR artifacts |\n| **Create Text File** | Generate a separate .txt file with the extracted text (output as ZIP) |\n\nAdvanced options require OCRmyPDF. With Tesseract only, they are ignored.\n\n---\n\n## Language Packs\n\nAvailable languages depend on which Tesseract language packs are installed. The default Docker image includes English, German, French, Portuguese, and Chinese Simplified. To add more languages, see the **[OCR Configuration Guide](doc:configuration/ocr)**.\n\n---\n\n## Limitations\n\n- Tesseract recognizes text only - it does not do table-structure or formula recognition\n- Handwritten text has limited accuracy\n- Stylized/decorative fonts and very small text (< 8pt) are challenging\n- For best results, use 300 DPI or higher scans with good contrast\n- To OCR non-English documents, install the matching Tesseract language pack (see [Language Packs](#language-packs))\n\n---\n\n## API Usage\n\n```bash\ncurl -X POST http://stirling-pdf:8080/api/v1/misc/ocr-pdf \\\n  -F \"fileInput=@scanned.pdf\" \\\n  -F \"languages=eng\" \\\n  -F \"languages=spa\" \\\n  -F \"ocrType=skip-text\" \\\n  -F \"ocrRenderType=hocr\" \\\n  -F \"deskew=true\" \\\n  -F \"clean=true\" \\\n  -F \"cleanFinal=true\" \\\n  -F \"sidecar=false\" \\\n  -o searchable.pdf\n```\n\nSee [API Documentation](doc:api) for complete endpoint reference.\n\n---\n\n## Related Tools\n\n- **[Convert](doc:functionality/convert/convert)** - Convert OCR'd PDFs to Word, text, or other formats\n- **[Compress](doc:functionality/compress)** - Reduce file size after OCR\n- **[Auto-Rename](doc:functionality/advanced-tools)** - Rename files based on OCR'd content",
+      "sourcePath": "docs/Functionality/OCR.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/OCR.md"
+    },
+    "functionality/page-operations/page-operations": {
+      "id": "functionality/page-operations/page-operations",
+      "title": "Page Operations",
+      "description": "List of all Page related features",
+      "section": "functionality/page-operations",
+      "markdown": "## Features - Page Operations\n\nTools for combining, splitting, rearranging, and reshaping the pages of your PDFs.\n\n---\n\n## Combine & Arrange\n\n- **Merge**: Join several PDFs together into one document.\n\n- **Reorganize Pages**: Rearrange, duplicate, or delete pages within a PDF.\n\n- **Extract Pages**: Pull out the pages you choose and save them as a new PDF.\n\n- **Remove Pages**: Delete the pages you don't want from a PDF.\n\n- **Rotate**: Turn pages to the orientation you want.\n\n- **Overlay PDFs**: Lay one PDF over another (on top, behind, and other arrangements) to combine their content.\n\n- **Add Attachments**: Embed files inside a PDF so they travel with it. Readers that support attachments can pull the files back out later.\n\n- **Add Page Numbers**: Stamp page numbers and custom text around the edges of your pages, with control over position, format, and which pages to number.\n\n- **Edit Table of Contents**: Add, edit, or rework a PDF's bookmarks so readers can navigate the document more easily.\n\n---\n\n## Split\n\nThe **Split** tool breaks one PDF into several files. Pick a method when you open it:\n\n- **Split at Page Numbers**: Cut the document at the page numbers you enter (for example `1,3-5,7`).\n\n- **Split by Chapters**: Create a separate file for each bookmarked section, using the document's table of contents to decide where each one starts.\n\n- **Split by Sections**: Slice each page into a grid of horizontal and vertical pieces - handy for splitting a page in half or quarters.\n\n- **Split by File Size**: Break a PDF into parts that each stay under a maximum file size you set.\n\n- **Split by Page Count** / **Split by Document Count**: Split into files of a set number of pages each, or into a set number of files.\n\n- **Split by Page Divider**: Separate scanned batches automatically using QR code divider sheets placed between documents - built for bulk scanning workflows.\n\n- **Split into Printable Chunks** (poster print): Tile each oversized page into a grid of standard-size sheets (A4, Letter, and so on) so you can print a large page across several sheets and tape them into a poster.\n\n---\n\n## Resize & Reshape\n\n- **Adjust Page Size/Scale**: Change the page size and how big the content sits on it. Choose a target size (A0-A6, Letter, Legal, or Keep Original Size) and a scale factor for the content. The **Page orientation** option (Portrait or Landscape) lets you apply the chosen size either way - for example A4 turned to landscape. Orientation has no effect when you keep the original size.\n\n- **Crop**: Trim pages down to the area you want.\n\n- **Multi-Page Layout**: Place several PDF pages together onto each output page.\n\n- **PDF to Single Large Page**: Stack every page into one tall, continuous page.\n\n- **Booklet Imposition**: Reorder pages for booklet printing so that, once folded and bound, they read in the right sequence. Produces printer-ready booklets.\n\n- **Adjust Colours/Contrast**: Tune the contrast, brightness, and saturation of the pages.\n\n---\n\n## Clean Up\n\n- **Remove Blank Pages**: Automatically find and drop pages with little or no content.\n\n---\n\n## Related Tools\n\n- **[Redaction](doc:functionality/page-operations/redact)** - Permanently remove sensitive content from pages",
+      "sourcePath": "docs/Functionality/Page-Operations/Page-Operations.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Page-Operations/Page-Operations.md"
+    },
+    "functionality/page-operations/redact": {
+      "id": "functionality/page-operations/redact",
+      "title": "Redaction",
+      "section": "functionality/page-operations",
+      "markdown": "## Redaction Tool User Guide\n\n## Overview\nThe Redaction tool permanently removes sensitive information from PDFs. It offers two modes:\n\n- **Automatic** - Type the words or regex patterns to remove and let the tool find and redact every match across the document.\n- **Manual** - Open the PDF in the viewer and draw redactions over specific text, areas, or whole pages.\n\nUnlike a simple black box drawn on top of the page, automatic redaction deletes the matching text from the file so the underlying text is genuinely removed - not merely hidden. You can also flatten the result to an image to guarantee nothing recoverable is left behind.\n\n## Choosing a mode\nAt the top of the Redact panel, the **Redaction Method** selector switches between **Automatic** and **Manual**. Selecting **Manual** opens the document in the viewer, where the drawing controls described below appear.\n\n---\n\n## Automatic redaction\nAutomatic redaction searches the document for the text you specify and removes every match.\n\n**How to use:**\n1. Choose **Automatic** as the redaction method.\n2. Under **Redaction Settings**, add each **word or pattern** to redact. Add as many as you need - the tool scans for all of them in a single pass, and matches are found across multiple columns and text lines.\n3. (Optional) Open **Advanced Settings** to adjust:\n   - **Use Regex** - Treat each entry as a regular expression rather than a literal word.\n   - **Whole Word Search** - Match only complete words, not substrings.\n   - **Box Colour** and **Custom Extra Padding** - Style the redaction boxes.\n   - **Convert PDF to PDF-Image** - Flatten the redacted PDF to an image so no text remains behind the boxes (enabled by default).\n4. Click **Redact**.\n\n### Redacting PII with patterns\nWith **Use Regex** enabled you can target common personally identifiable information (PII) by entering the matching pattern. For example:\n\n| Type | Example pattern |\n| --- | --- |\n| Social Security number (SSN) | `\\d{3}-\\d{2}-\\d{4}` |\n| Credit / debit card | `\\d{4}[ -]?\\d{4}[ -]?\\d{4}[ -]?\\d{4}` |\n| IBAN | `[A-Z]{2}\\d{2}[A-Z0-9]{1,30}` |\n| US routing number (ABA) | `\\b\\d{9}\\b` |\n| Account number (labelled) | `[Aa]ccount\\s*#?\\s*\\d{6,}` |\n| Email address | `[\\w.-]+@[\\w.-]+\\.\\w+` |\n| Phone number | `\\(\\d{3}\\)\\s*\\d{3}-\\d{4}` |\n\nAdd one pattern per entry; refine them to suit your documents to keep false positives down.\n\n### How text is removed\nAutomatic redaction deletes the matching text from the file rather than just covering it. For maximum safety, keep **Convert PDF to PDF-Image** enabled so no recoverable text can remain under the boxes.\n\n---\n\n## Manual redaction\nManual redaction lets you mark sensitive content visually in the viewer using three methods: text selection, area drawing, or entire page redaction.\n\n### 1. Text Selection Redaction\nPerfect for redacting specific words, sentences, or paragraphs.\n\n**How to use:**\n1. Click the text selection icon in the toolbar\n\n   ![image](https://github.com/user-attachments/assets/e66dbfc1-0b06-4f65-8f60-7277b8acca91)\n\n2. Select the text you want to redact\n3. Apply the redaction by either:\n   - Pressing `Ctrl + S`\n   - Clicking the save icon in the toolbar\n     \n      ![image](https://github.com/user-attachments/assets/73d4b1f0-a454-452b-ab60-028b9728004b)\n\n### 2. Area Drawing Redaction\nIdeal for redacting images, tables, or irregular content blocks.\n\n**How to use:**\n1. Click the drawing tool icon in the toolbar\n\n   ![image](https://github.com/user-attachments/assets/8597abed-0992-48d3-baf4-0e7673fb500c)\n\n2. Click and hold at your starting point\n3. Drag to create a rectangle over the area\n4. Click again to confirm and apply the redaction\n   - A red border means unsaved\n\n      ![image](https://github.com/user-attachments/assets/42809be3-34e6-4725-920b-b4d51eb72e4f)\n\n   - A green border means saved and active\n   \n      ![image](https://github.com/user-attachments/assets/0711ff11-da1a-41c3-9d57-82067ee0f8b8)\n\n### 3. Page Redaction\nUsed when you need to redact entire pages.\n\n**How to use:**\n1. Open the page redaction dialog\n   \n   ![image](https://github.com/user-attachments/assets/fae58a19-1f54-463e-bc81-027bd4f403bf)\n\n   ![image](https://github.com/user-attachments/assets/66c1b1aa-7da1-4262-a476-0551924ed509)\n\n3. Enter page numbers or ranges (e.g., \"1,3-5,7\")\n4. Select your preferred color\n5. Click \"Apply\" to save changes\n\n## Customizing Redactions\n\n### Changing Colors\n\n**For new redactions:**\n1. Click the color palette icon in the toolbar\n   \n   ![image](https://github.com/user-attachments/assets/788fd325-489e-4404-8377-07ec500a77dd)\n\n2. Select your preferred color\n3. Any new redactions will use this color\n\n**For existing redactions:**\n1. Click the redacted area\n2. Click the color palette icon that appears\n3. Choose your new color\n  \n![redaction_color](https://github.com/user-attachments/assets/0bc05461-6427-4a62-8cd4-745c3104c04f)\n\n### Removing Redactions\n1. Click the redacted area you want to remove\n2. Either:\n   - Click the trash icon that appears\n   - Press the `Delete` key\n\n![redaction_removal](https://github.com/user-attachments/assets/9bd3be2a-d2ec-4468-a229-bf81efb36bcc)\n\n### Converting PDF to PDF-image (Used in removing text behind the box)\nTo enable PDF to PDF-image option:\n   1. Click on the image icon\n   \n         ![image](https://github.com/user-attachments/assets/8c480923-05e1-46d3-8f59-5f78db6d87f8)\n\nTo disable PDF to PDF-image option:\n   1. Click on the image icon\n   \n         ![image](https://github.com/user-attachments/assets/e2e07e31-8eb0-41ac-80ab-ffd8520f5795)\n\n- If the image icon is green, then the option is enabled, if it is red then it is disabled.\n\n## Keyboard Shortcuts\n- `Ctrl + S`: Save/apply redaction\n- `Delete`: Remove selected redaction\n- `Escape`: Cancel unsaved area drawing\n\n## Tips\n- If you're in drawing mode and need to delete a redaction, temporarily disable drawing mode first\n- You can combine different redaction methods in the same document\n- Always review your redactions before finalizing the document\n- Redaction colors can be changed at any time, even after applying",
+      "sourcePath": "docs/Functionality/Page-Operations/redact.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Page-Operations/redact.md"
+    },
+    "functionality/read-and-annotate": {
+      "id": "functionality/read-and-annotate",
+      "title": "Read & Annotate PDFs",
+      "description": "Interactive PDF viewer with annotation tools for reading and markup",
+      "section": "functionality",
+      "markdown": "Read PDFs directly in your browser while adding comments, highlights, drawings, shapes, and other markup - all in one interactive viewer.\n\n> **💡 Tip**\n>\n> Built with **[EmbedPDF](https://www.embedpdf.com/)**, an advanced open-source PDF viewer with full support for PDF annotation standards.\n\n\n---\n\n## Annotation Tools\n\n### Text Markup\n- **Highlight**, **Underline**, **Strikeout**, **Squiggly underline**\n- Full color picker and opacity control (10-100%)\n\n### Drawing\n- **Pen** - Freehand drawing with adjustable width (1-12px)\n- **Freehand Highlighter** - Width (1-20px) and opacity control\n\n### Shapes\n- **Square**, **Circle**, **Line**, **Polygon**\n- Independent stroke and fill color, border width (0-12px), opacity\n\n### Comments & Text\n- **Comment** - Attach comments to any location\n- **Insert Text** / **Replace Text** - Mark text insertions and replacements\n- **Text box** - Free text with font size, alignment, and background color\n- **Note** - Sticky notes with background color\n\n### Images\n- **Add Image** - Place images or photos anywhere on the page\n\nFor adding signatures (typed, drawn, or uploaded), use the dedicated [Sign PDFs](doc:functionality/security/sign) tool.\n\n### Comment Threads\n- Reply threads on any annotation\n- Author attribution and timestamps\n- Comments sidebar listing all comments grouped by page; within each page, comments appear in visual reading order (top-to-bottom, left-to-right)\n- Click to navigate to the source annotation\n\n### Side Panels\n- Dedicated side panels for **comments**, **annotations**, and **attachments**, each with quick controls for adding items\n- A **clear all** button removes every comment or annotation in one action\n\n---\n\n## Viewer Features\n\n- Page navigation (first/prev/next/last, direct page jump)\n- Zoom in/out with manual percentage entry\n- Single page and dual-page spread modes\n- Thumbnail sidebar, bookmark sidebar, attachment sidebar\n- Full-text search (Ctrl+F) with result highlighting and navigation\n- Text selection with select-all (Ctrl+A) and a floating Copy button that appears over the selection\n- Print (Ctrl+P)\n\n---\n\n## Keyboard Shortcuts\n\n| Shortcut | Action |\n|----------|--------|\n| **Ctrl+A** | Select all text |\n| **Ctrl+F** | Search |\n| **Ctrl+P** | Print |\n| **Ctrl+S** | Save changes |\n| **Ctrl+Z** | Undo |\n| **Ctrl+Shift+Z / Ctrl+Y** | Redo |\n| **Ctrl++/-** | Zoom in/out |\n| **Ctrl+0** | Fit to width |\n| **Home / End** | First / last page |\n| **PageUp / PageDown** | Previous / next page |\n\n---\n\n## Saving\n\n- **Save Changes** button or Ctrl+S to apply annotations\n- Undo/redo history available before saving\n- Annotations are embedded in standard PDF format and compatible with Adobe Acrobat, Foxit Reader, PDF-XChange, and macOS Preview\n\n---\n\n## Related Documentation\n\n- **[Multi-Tool](doc:functionality/multi-tool)** - Page editing workspace\n- **[Sign PDFs](doc:functionality/security/sign)** - Add signatures",
+      "sourcePath": "docs/Functionality/Read-and-Annotate.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Read-and-Annotate.md"
+    },
+    "functionality/recommended-tools": {
+      "id": "functionality/recommended-tools",
+      "title": "Recommended Tools",
+      "description": "The most commonly used PDF tools in Stirling PDF",
+      "section": "functionality",
+      "markdown": "The PDF tools you'll reach for most often, featured on the home page for quick access.\n\n---\n\n## PDF Text Editor *(Alpha)* {#pdf-text-editor}\n\nOpen a PDF and edit its text and images right in your browser, then save a new copy. Edits are grouped so you can change a whole paragraph at once.\n\n> **⚠️ Warning: Experimental**\n>\n> The PDF Text Editor is **alpha / experimental**. Its behaviour and output may change, and complex PDFs may not come out perfectly. Always keep a copy of your original file.\n\n\n---\n\n## Multi-Tool\n\nUpload your PDFs once, then rotate, reorder, delete, and split pages in a single workspace without re-uploading between steps.\n\n**[Multi-Tool Guide →](doc:functionality/multi-tool)**\n\n---\n\n## Merge PDFs\n\nCombine several PDFs into one file. Drag and drop to set the order before you merge.\n\n---\n\n## Compare\n\nSpot the differences between two versions of a document. The comparison is text-based: removed words are highlighted in red and added words in green.\n\n**[Compare Guide →](doc:functionality/compare)**\n\n---\n\n## Compress\n\nShrink a PDF's file size (typically 10-90% smaller) by choosing how much quality you want to keep.\n\n**[Compress Guide →](doc:functionality/compress)**\n\n---\n\n## Convert\n\nConvert between PDF and 50+ formats, including images, Office documents, HTML, and more. You can convert several files in one go.\n\n**[Convert Guide →](doc:functionality/convert/convert)**\n\n---\n\n## OCR\n\nTurn scanned PDFs into searchable text by recognising the words in the page images. Supports 100+ languages.\n\n**[OCR Guide →](doc:functionality/ocr)**\n\n---\n\n## Redact\n\nPermanently remove sensitive information from a PDF. Draw boxes over what you want to hide, or let the tool find and remove text and patterns automatically.\n\n**Common patterns:**\n- SSN: `\\d{3}-\\d{2}-\\d{4}`\n- Phone: `\\(\\d{3}\\) \\d{3}-\\d{4}`\n- Email: `[\\w\\.-]+@[\\w\\.-]+\\.\\w+`\n\nRedaction is permanent - the original content cannot be recovered.\n\n**[Redaction Guide →](doc:functionality/page-operations/redact)**\n\n---\n\n## More Tools\n\n- **[All Tools](doc:functionality/functionality)** - Complete tool reference\n- **[Advanced Tools](doc:functionality/advanced-tools)** - Automation, repair, overlay, and more\n- **[API Documentation](doc:api)** - Programmatic access",
+      "sourcePath": "docs/Functionality/Recommended-Tools.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Recommended-Tools.md"
+    },
+    "functionality/security/certificate-signing": {
+      "id": "functionality/security/certificate-signing",
+      "title": "Certificate Signing",
+      "description": "Sign and validate PDF certificates",
+      "section": "functionality/security",
+      "markdown": "Digitally sign PDFs with X.509 certificates and validate existing signatures against trusted certificate chains.\n\n---\n\n## Signing PDFs\n\n\n  \n    Uses an auto-generated server certificate, so users can sign without uploading their own. This is a Pro/Enterprise feature and must be enabled by an administrator; it is not available on the free self-hosted edition.\n\n    1. Go to **Certificate Sign** tool\n    2. Upload PDF\n    3. In the **Certificate source** step, choose **Server** (shown only when the server certificate feature is enabled)\n    4. Configure signature appearance (optional)\n    5. Sign and download\n\n    **Configuration (Pro/Enterprise):**\n\n    \n      \n        ```yaml\n        system:\n          serverCertificate:\n            enabled: true\n            organizationName: Stirling-PDF\n            validity: 365\n            regenerateOnStartup: false\n        ```\n      \n      \n        ```bash\n        SYSTEM_SERVERCERTIFICATE_ENABLED=true\n        SYSTEM_SERVERCERTIFICATE_ORGANIZATIONNAME=\"My Company\"\n        SYSTEM_SERVERCERTIFICATE_VALIDITY=365\n        ```\n      \n    \n  \n  \n    Use your own X.509 certificate. Supported formats: PKCS#12 (`.p12`/`.pfx`), PEM (separate private key + certificate), and JKS. This option is available on every edition, including free self-hosted.\n\n    1. Go to **Certificate Sign** tool\n    2. Upload PDF\n    3. In the **Certificate source** step, choose **Upload**, then pick your certificate format\n    4. Upload your certificate file(s) and enter the password (if any)\n    5. Configure signature appearance\n    6. Sign and download\n\n    ```bash\n    # Generate a test certificate\n    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365\n\n    # Convert to PKCS#12\n    openssl pkcs12 -export -out mycert.p12 -inkey key.pem -in cert.pem\n    ```\n  \n  \n    Use a shared organization certificate so all users can sign without uploading their own. This is a Pro/Enterprise feature managed by an administrator; it is not available on the free self-hosted edition.\n\n    An administrator uploads your own `.p12`/`.pfx` keystore (with its password) through the admin server-certificate settings, replacing the auto-generated certificate. The server certificate feature must be enabled:\n\n    ```yaml\n    system:\n      serverCertificate:\n        enabled: true\n        organizationName: Acme Corp\n    ```\n\n    Once configured, users can choose **Server** in the **Certificate source** step to sign with the shared certificate.\n  \n  \n    Sign with a certificate held on your own machine - a USB token or smart card (PKCS#11), or the Windows certificate store. The private key never leaves the device: Stirling PDF asks the token or operating system to perform the signing. This option appears only in the **desktop app** and works on every edition.\n\n    1. Go to **Certificate Sign** tool\n    2. Upload PDF\n    3. In the **Certificate source** step, choose **This device**\n    4. Pick the hardware type:\n       - **Windows certificate store** (Windows only) - available certificates are listed automatically; pick one. Windows prompts for the card or token PIN when you sign.\n       - **USB token** (PKCS#11, Windows/macOS/Linux) - choose the PKCS#11 driver (common drivers such as OpenSC, YubiKey, SafeNet eToken, and Thales IDPrime are detected automatically, or enter a custom driver path), enter the token PIN, then **List certificates** and pick one.\n    5. Configure signature appearance\n    6. Sign and download\n\n    For security, you can only sign with a PKCS#11 driver that Stirling PDF auto-detects or one you explicitly allow. Add extra driver libraries with the `STIRLING_PKCS11_LIBRARIES` environment variable - absolute paths to the driver files, separated by your platform's path separator:\n\n    ```bash\n    STIRLING_PKCS11_LIBRARIES=/usr/lib/opensc-pkcs11.so\n    ```\n\n    :::note macOS and Linux\n    The macOS Keychain is not a direct signing source. On macOS and Linux, reach a smart card or token through a PKCS#11 driver such as OpenSC.\n    :::\n  \n\n\n---\n\n### Signature Appearance\n\n**Visible:** Appears as a box on a chosen page showing the signer name, signing date, and reason, with an optional logo.\n\n**Invisible:** Embedded in PDF metadata only, not visible on the page.\n\n---\n\n## Validating Signatures\n\nVerify that a PDF was signed by the claimed certificate, the certificate is trusted, the PDF hasn't been modified, and the certificate hasn't been revoked.\n\n### Trust Sources\n\n| Source | Config Key | What It Trusts |\n|--------|-----------|----------------|\n| Server certificates | `serverAsAnchor` | PDFs signed by your Stirling PDF instance |\n| System trust store | `useSystemTrust` | OS-trusted CAs |\n| Mozilla CA bundle | `useMozillaBundle` | Mozilla's curated CA list |\n| Adobe AATL | `useAATL` | Adobe Approved Trust List |\n| EU EUTL | `useEUTL` | EU Trusted List (eIDAS) |\n\n### Revocation Checking\n\nCertificates can be revoked (invalidated) after they're issued - for example if a private key is compromised. Revocation checking lets Stirling PDF verify that a certificate is still valid at the time of use.\n\n```yaml\nsecurity:\n  validation:\n    revocation:\n      mode: none       # Options: none, ocsp, crl, ocsp+crl\n      hardFail: false\n```\n\n| Mode | What it does |\n|------|-------------|\n| `none` | Skip revocation checks entirely |\n| `ocsp` | Check in real-time against the certificate authority's server (requires internet) |\n| `crl` | Download a list of revoked certificates (can work offline with cached lists) |\n| `ocsp+crl` | Try real-time check first, fall back to the list if that fails |\n\n**`hardFail`** controls what happens when the revocation check itself fails (e.g. server unreachable):\n- `false` (default) - validation passes with a warning\n- `true` - validation fails entirely. Use this in high-security environments where you'd rather reject a signature than skip the check.\n\n---\n\n## Timestamping PDFs\n\nUse the **Timestamp PDF** tool to add a trusted RFC 3161 timestamp that proves your PDF existed at a particular point in time. Pick a Time Stamp Authority (TSA), then download the timestamped file. The timestamp is added without altering the rest of the file, so any existing signatures stay intact.\n\n### Trusted Time Stamp Authorities\n\nYou can pick from the built-in TSA presets below, or your administrator can add more. Built-in presets:\n\n| Provider | URL |\n|----------|-----|\n| DigiCert | `http://timestamp.digicert.com` |\n| Sectigo | `http://timestamp.sectigo.com` |\n| SSL.com | `http://ts.ssl.com` |\n| FreeTSA | `https://freetsa.org/tsr` |\n| MeSign | `http://tsa.mesign.com` |\n\nIf you don't choose one, the server default is used (DigiCert by default). Administrators can allow additional TSA servers and change the default in `settings.yml`:\n\n```yaml\nsecurity:\n  timestamp:\n    defaultTsaUrl: http://timestamp.digicert.com\n    customTsaUrls:\n      - https://tsa.example.com/timestamp\n```\n\n### API Usage\n\n```bash\n# tsaUrl is optional; omit to use the server default\ncurl -X POST http://stirling-pdf:8080/api/v1/security/timestamp-pdf \\\n  -F \"fileInput=@document.pdf\" \\\n  -F \"tsaUrl=http://timestamp.digicert.com\" \\\n  -o timestamped.pdf\n```\n\n---\n\n## Configuration Examples\n\n\n  \n    ```yaml\n    system:\n      serverCertificate:\n        enabled: true\n\n    security:\n      validation:\n        trust:\n          serverAsAnchor: true\n          useSystemTrust: true\n    ```\n  \n  \n    ```yaml\n    system:\n      serverCertificate:\n        enabled: true\n        organizationName: Acme Corp\n        validity: 365\n\n    security:\n      validation:\n        trust:\n          serverAsAnchor: true\n          useSystemTrust: true\n          useMozillaBundle: true\n          useAATL: false\n        allowAIA: false\n        revocation:\n          mode: ocsp\n          hardFail: false\n    ```\n  \n  \n    ```yaml\n    security:\n      validation:\n        trust:\n          serverAsAnchor: false\n          useSystemTrust: true\n          useMozillaBundle: true\n          useAATL: true\n          useEUTL: true\n        allowAIA: false\n        revocation:\n          mode: ocsp+crl\n          hardFail: true\n    ```\n  \n  \n    ```yaml\n    security:\n      validation:\n        trust:\n          serverAsAnchor: false\n          useSystemTrust: false\n          useMozillaBundle: false\n          useAATL: false\n          useEUTL: true\n        eutl:\n          lotlUrl: https://ec.europa.eu/tools/lotl/eu-lotl.xml\n          acceptTransitional: true\n        allowAIA: false\n        revocation:\n          mode: ocsp+crl\n          hardFail: true\n    ```\n  \n\n\n> **📝 Note**\n>\n> The `system.serverCertificate.*` keys are honoured only on Pro/Enterprise editions. On the free self-hosted edition, setting `enabled: true` has no effect and the **Server** certificate source stays hidden; use a custom certificate (**Upload**), or **This device** in the desktop app, instead. All `security.validation.*` and `security.timestamp.*` settings apply to every edition.\n\n\n---\n\n## API Usage\n\n\n  \n    ```bash\n    # certType must be one of PEM, PKCS12, PFX, JKS, SERVER, WINDOWS_STORE, PKCS11 (uppercase)\n    # certType=SERVER requires the Pro/Enterprise server certificate feature to be enabled\n    curl -X POST http://stirling-pdf:8080/api/v1/security/cert-sign \\\n      -F \"fileInput=@document.pdf\" \\\n      -F \"certType=SERVER\" \\\n      -F \"reason=Approved\" \\\n      -F \"location=London\" \\\n      -F \"showSignature=true\" \\\n      -F \"pageNumber=1\" \\\n      -o signed.pdf\n    ```\n  \n  \n    ```bash\n    # PKCS12/PFX use p12File; JKS uses jksFile; PEM uses privateKeyFile + certFile\n    curl -X POST http://stirling-pdf:8080/api/v1/security/cert-sign \\\n      -F \"fileInput=@document.pdf\" \\\n      -F \"certType=PKCS12\" \\\n      -F \"p12File=@mycert.p12\" \\\n      -F \"password=certpass\" \\\n      -o signed.pdf\n    ```\n  \n  \n    ```bash\n    # Desktop app only; the request must come from the local machine.\n    # WINDOWS_STORE selects a cert by alias; PKCS11 uses pkcs11LibraryPath (+ optional pkcs11Slot),\n    # with password as the token PIN.\n    curl -X POST http://localhost:8080/api/v1/security/cert-sign \\\n      -F \"fileInput=@document.pdf\" \\\n      -F \"certType=PKCS11\" \\\n      -F \"pkcs11LibraryPath=/usr/lib/opensc-pkcs11.so\" \\\n      -F \"password=token-pin\" \\\n      -o signed.pdf\n    ```\n  \n  \n    ```bash\n    curl -X POST http://stirling-pdf:8080/api/v1/security/validate-signature \\\n      -F \"fileInput=@signed.pdf\"\n    ```\n  \n\n\nSee [API Documentation](doc:api) for complete endpoint reference.\n\n---\n\n## Troubleshooting\n\n### \"Certificate not trusted\"\nEnable the appropriate trust source in config, or add your CA certificate to the system trust store:\n```bash\ndocker cp ca-cert.crt stirling-pdf:/usr/local/share/ca-certificates/\ndocker exec stirling-pdf update-ca-certificates\n```\n\n### Revocation check fails\nCheck that the container has HTTPS access to OCSP/CRL servers. Use `hardFail: false` or switch to `crl` mode for restricted networks.\n\n### Server certificate not generated\nThe server certificate feature requires a Pro/Enterprise license; on the free self-hosted edition it stays disabled regardless of configuration. With a license, ensure `SYSTEM_SERVERCERTIFICATE_ENABLED=true` is set. Check logs with `docker logs stirling-pdf | grep -i certificate`.\n\n---\n\n## Related\n\n- [System and Security Settings](doc:configuration/system-and-security)\n- [Sign (Handwritten)](doc:functionality/security/sign)\n- [Settings Changes](doc:migration/settings-changes)",
+      "sourcePath": "docs/Functionality/Security/Certificate-Signing.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Security/Certificate-Signing.md"
+    },
+    "functionality/security/security": {
+      "id": "functionality/security/security",
+      "title": "Features - Security",
+      "description": "Security features for PDFs and deployment configurations",
+      "section": "functionality/security",
+      "markdown": "These are the tools you'll find under **Security** in the Stirling PDF app. Open a PDF, pick a tool, set your options, and download the result.\n\n## Password and access\n\n- **Add Password** - lock a PDF with a password. You can set a user password (needed to open the file) and an owner password (controls what people can do once it's open).\n\n- **Remove Password** - unlock a protected PDF. You'll need the current password.\n\n- **Change Permissions** - control what others can do with your PDF: printing, copying, editing, form filling, and more.\n\n- **Flatten** - merge form fields and interactive elements into the page so they can no longer be edited or filled in. Use this to lock down a completed form.\n\n- **Unlock PDF Forms** - reverse the lock on form fields so they can be edited and filled in again.\n\n## Signatures\n\n- **Sign** - add a handwritten, typed, or image signature. Draw with your mouse or touchscreen, type your name, or upload a signature image. For a cryptographic digital signature, use Certificate Sign.\n\n  **Learn more:** [Sign PDF (Handwritten Signatures)](doc:functionality/security/sign)\n\n- **Certificate Sign** - digitally sign a PDF with an X.509 certificate to prove who signed it and that the document hasn't been changed. Choose **Manual** to upload your own certificate (PEM, PKCS12, or JKS), or **Auto (server)** to sign with the server's certificate (the server certificate requires a Pro or Enterprise license).\n\n  **Learn more:** [Certificate Signing Guide](doc:functionality/security/certificate-signing)\n\n- **Shared Signing** *(Pro/Enterprise, Alpha)* - send a PDF to several people to sign. The owner invites registered users, each signs with their own certificate and an optional handwritten signature, and the owner tracks progress and finalizes the document.\n\n  **Learn more:** [Shared Signing Guide](doc:functionality/security/shared-signing)\n\n- **Validate PDF Signature** - check the digital signatures in a PDF: confirm who signed it, whether the certificate is trusted, and whether the document was changed after signing.\n\n  **Learn more:** [Certificate Signing - Validation](doc:functionality/security/certificate-signing)\n\n- **Remove Certificate Sign** - strip digital certificate signatures from a PDF. Handy when you need to edit a document that was already signed.\n\n- **Timestamp PDF** - add a trusted RFC 3161 timestamp that proves your PDF existed at a particular point in time. Stirling PDF contacts a trusted Time Stamp Authority (TSA) and embeds the timestamp. Only a SHA-256 hash of the document is sent to the TSA, so the PDF itself never leaves your server.\n\n  **Learn more:** [Certificate Signing - Timestamping](doc:functionality/security/certificate-signing)\n\n## Content security\n\n- **Add Watermark** - stamp a text or image watermark across your PDF, with control over spacing, opacity, and rotation.\n\n- **Sanitize** - strip potentially dangerous content such as JavaScript, embedded files, external links, fonts, and metadata. A good first step before sharing untrusted PDFs.\n\n- **Redact** - permanently remove sensitive information. Search for text (or match a pattern) to find and black it out automatically, or draw redaction boxes by hand. The underlying text is removed, not just covered.\n\n## Information\n\n- **Get ALL Info on PDF** - see everything about a PDF: version, fonts, page dimensions, permissions, metadata, and more. View it as tables in the app or export it as JSON.\n\n---\n\n## How signature validation chooses what to trust\n\nWhen you run **Validate PDF Signature**, your administrator decides which certificate authorities count as trusted and whether to check that certificates haven't been revoked. The trust sources available are the operating system trust store, the Mozilla CA bundle, the Adobe Approved Trust List (AATL), the EU Trusted List (EUTL, for eIDAS), and your own server-generated certificates. Revocation can be checked in real time (OCSP), against a downloaded list (CRL), or both.\n\nFor the full list of settings and example configurations, see [Certificate Signing - Configuration](doc:functionality/security/certificate-signing).\n\n---\n\n## Related Configuration\n\nFor advanced security configuration, see:\n\n- **[System and Security Settings](doc:configuration/system-and-security)** - JWT, session management, server certificates\n- **[Certificate Signing](doc:functionality/security/certificate-signing)** - Comprehensive signing and validation guide\n- **[Single Sign-On](doc:configuration/single-sign-on-configuration)** - Enterprise authentication",
+      "sourcePath": "docs/Functionality/Security/Security.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Security/Security.md"
+    },
+    "functionality/security/shared-signing": {
+      "id": "functionality/security/shared-signing",
+      "title": "Shared Signing",
+      "description": "Collaborative multi-participant PDF signing workflows with digital certificates and wet signatures",
+      "section": "functionality/security",
+      "markdown": "> **⚠️ Warning: [Alpha Feature]**\n>\n> Shared Signing is currently in **alpha**. Functionality may change, and some features are incomplete. Use in production at your own risk.\n\n\nShared Signing lets a document owner send a PDF to multiple registered users for signing. Each participant reviews the document, applies their signature, and submits it back. The owner tracks progress and finalizes the document once all signatures are collected.\n\nShared Signing builds on storage. With the **local** storage provider it needs **no license** - just turn on `security.enableLogin`, `storage.enabled`, and `storage.signing.enabled`. The managed certificate options (Personal and Server certificates) require a Pro/Enterprise license; without one, participants sign by uploading their own certificate (P12/PKCS12 or JKS). The **database** and **s3** storage providers also require a Pro/Enterprise license. See [Modes](doc:modes-and-licensing) for details.\n\n---\n\n## What You Can Do\n\n- **Invite multiple signers** -- add registered users as participants to a signing session\n- **Flexible signing options** -- participants can use the server certificate, their personal certificate, or upload their own (P12, JKS, PEM)\n- **Handwritten signatures** -- participants can draw, type, or upload a wet signature overlay and place it on any page\n- **Track progress** -- see who has signed, viewed, or declined in real time\n- **Summary page** -- optionally append a page to the final PDF listing all signers, timestamps, and details\n- **Data cleanup** -- sensitive signature and certificate data is automatically cleared from the server after finalization\n\n---\n\n## Prerequisites\n\n\n  \n    ```yaml\n    security:\n      enableLogin: true\n\n    storage:\n      enabled: true\n      signing:\n        enabled: true\n\n    system:\n      frontendUrl: https://your-stirling-instance.com\n      serverCertificate:\n        enabled: true\n    ```\n  \n  \n    ```bash\n    SECURITY_ENABLELOGIN=true\n    STORAGE_ENABLED=true\n    STORAGE_SIGNING_ENABLED=true\n    SYSTEM_FRONTENDURL=https://your-stirling-instance.com\n    SYSTEM_SERVERCERTIFICATE_ENABLED=true\n    ```\n  \n\n\n---\n\n## How It Works\n\n### Step 1: Create a Signing Session\n\n1. Open a PDF in the viewer\n2. Click the **Sign** button in the Quick Access Bar\n3. Click the **+** button next to **Signature Requests**\n4. Add participants by selecting registered users\n5. Optionally set a due date and configure signature display preferences\n6. Review and submit\n\n**Session options:**\n\n| Option | What it does |\n|--------|-------------|\n| **Signature visibility** | Choose whether the digital signature block is visible on the PDF or embedded invisibly |\n| **Signature page number** | Which page to place the signature block on |\n| **Reason** | A reason for signing (e.g., \"Approved\", \"I agree to these terms\") |\n| **Location** | Where the signing is taking place (e.g., \"New York\") |\n| **Show logo** | Includes the organization logo in the signature block |\n| **Include summary page** | Appends a page at the end listing all signers and their details |\n\n### Step 2: Participants Review and Sign\n\nParticipants see pending sign requests under the **Sign** button in the Quick Access Bar after logging in.\n\nFrom there they can:\n1. **Review** the document and session details (due date, signature preferences)\n2. **Choose a certificate** to sign with:\n\n| Certificate Option | Description | Requires Upload? |\n|-------------------|-------------|-----------------|\n| **Server Certificate** | Your organization's certificate | No |\n| **Personal Certificate** | Auto-generated for the participant | No |\n| **P12 / PKCS12 / PFX** | Participant's own certificate file | Yes (+ password) |\n| **JKS** | Java KeyStore file | Yes (+ password) |\n| **PEM** | PEM certificate + private key | Yes |\n\n3. **Add wet signatures** (optional) -- draw, type, or upload a handwritten signature and position it on any page. Multiple signatures can be placed across different pages.\n4. **Submit** their signature\n\nOnce submitted, the participant's status changes to **Signed** and they can no longer modify their submission.\n\nParticipants can also **decline** to sign, which marks their status as **Declined**.\n\n### Step 3: Track Progress\n\nThe session owner can monitor progress from the Quick Access Bar or the session detail view:\n\n- **Signature count** shown as \"X/Y signatures\" (e.g., \"3/5 signatures\")\n- **Color-coded badges**: Blue (none signed), Yellow (some signed), Green (all signed -- ready to finalize)\n- **Per-participant status**: Pending, Viewed, Signed, or Declined\n\nThe status auto-refreshes every 15 seconds.\n\n### Step 4: Finalize\n\nOnce you've collected the signatures you need, click **Finalize** to produce the signed PDF.\n\n> **⚠️ Warning**\n>\n> Finalization is a one-time operation. Participants who haven't signed will be skipped. Make sure you have all the signatures you need before finalizing.\n\n\n**What happens when you finalize:**\n\n1. All wet signature images are applied to the PDF at the positions each participant chose\n2. If enabled, a summary page is appended showing each participant's name, email, status, timestamp, reason, and certificate type\n3. Each participant's digital certificate is applied to the document\n4. The signed PDF is saved and available for download\n5. Sensitive data (signature images, certificate files, passwords) is permanently cleared from the server\n\n### Step 5: Download the Signed PDF\n\nAfter finalization, download the completed PDF from the session detail view or the **Completed Sessions** panel. The PDF contains all digital certificate signatures and wet signature overlays embedded in the document.\n\n---\n\n## Security\n\n- **One-time signing** -- after signing or declining, participants are automatically downgraded to read-only access and cannot re-sign\n- **Certificate validation** -- uploaded certificates are validated at submission time. Trust chain validation is configurable (see [Certificate Signing](doc:functionality/security/certificate-signing))\n- **Audit trail** -- all participant actions are recorded (viewed, signed, declined) with timestamps\n- **Post-finalization cleanup** -- wet signature images, certificate files, and passwords are permanently removed from the database after finalization. Only the final signed PDF is retained\n\n---\n\n## Configuration Reference\n\n### Signing Settings\n\n\n  \n    ```yaml\n    storage:\n      enabled: true\n      signing:\n        enabled: true              # Master switch for shared signing\n        userListScope: org         # Who appears in the signer picker: 'org' (default) = whole instance, any other value = your own team only\n\n    system:\n      frontendUrl: https://your-instance.com\n      serverCertificate:\n        enabled: true\n        organizationName: My Company\n        validity: 365              # Certificate validity in days\n        regenerateOnStartup: false\n    ```\n  \n  \n    ```bash\n    STORAGE_ENABLED=true\n    STORAGE_SIGNING_ENABLED=true\n    STORAGE_SIGNING_USERLISTSCOPE=org\n    SYSTEM_FRONTENDURL=https://your-instance.com\n    SYSTEM_SERVERCERTIFICATE_ENABLED=true\n    SYSTEM_SERVERCERTIFICATE_ORGANIZATIONNAME=\"My Company\"\n    SYSTEM_SERVERCERTIFICATE_VALIDITY=365\n    ```\n  \n\n\n#### Who appears in the signer picker\n\nWhen you create a signing session, the participant picker lists the people you can invite. The `storage.signing.userListScope` setting controls who shows up:\n\n| Value | Who appears in the picker |\n|-------|---------------------------|\n| `org` (default) | Every enabled user on your instance |\n| _any other value_ | Only the people in your own team |\n\nThe signer list is only ever shown to signed-in users, so no one can browse your user list without logging in, whichever scope you choose.\n\n### Certificate Validation Settings\n\n```yaml\nsecurity:\n  validation:\n    trust:\n      serverAsAnchor: true       # Trust server-generated certificates\n      useSystemTrust: true       # Trust OS certificate store\n      useMozillaBundle: true     # Trust Mozilla CA bundle\n    revocation:\n      mode: none                 # Options: none, ocsp, crl, ocsp+crl\n      hardFail: false            # Fail if revocation check is inconclusive\n```\n\nSee [Certificate Signing - Configuration](doc:functionality/security/certificate-signing) for detailed trust chain configuration.\n\n---\n\n## Known Limitations\n\n- Participants must be registered users with accounts on your Stirling PDF instance\n- Finalization can only be done once -- a session cannot be re-opened afterwards\n- Each session covers a single document\n- Digital certificates are applied in participant order during finalization\n- The signature summary page is English-only\n\n---\n\n## Troubleshooting\n\n### Signature not appearing on the finalized PDF\n- Double-check the certificate type and password were entered correctly\n- Check the Stirling PDF server logs for signing errors\n- Make sure the source PDF is not corrupted or password-protected\n\n### Progress count not updating\n- The dashboard auto-refreshes every 15 seconds -- wait a moment and check again\n- Check your browser's network tab for failed API requests\n\n### Wet signatures missing after finalization\n- Make sure the page numbers used are within the document's page range (pages start at 0)\n\n### \"Group signing is disabled\" when creating a session\n- Verify `security.enableLogin: true`, `storage.enabled: true`, and `storage.signing.enabled: true` in your configuration\n\n---\n\n## Automation / API\n\nYou don't need any of this for normal use - the whole workflow above runs from the app. This section is for developers who want to drive the signing workflow programmatically. The endpoints are listed below; see the [API reference](doc:api) for full details.\n\n### Owner Endpoints (Authentication Required)\n\n| Method | Endpoint | Description |\n|--------|----------|-------------|\n| POST | `/api/v1/security/cert-sign/sessions` | Create signing session |\n| GET | `/api/v1/security/cert-sign/sessions` | List your sessions |\n| GET | `/api/v1/security/cert-sign/sessions/{id}` | Get session details |\n| GET | `/api/v1/security/cert-sign/sessions/{id}/pdf` | Download original PDF |\n| POST | `/api/v1/security/cert-sign/sessions/{id}/finalize` | Finalize and generate signed PDF |\n| GET | `/api/v1/security/cert-sign/sessions/{id}/signed-pdf` | Download signed PDF |\n| DELETE | `/api/v1/security/cert-sign/sessions/{id}` | Delete session |\n| POST | `/api/v1/security/cert-sign/sessions/{id}/participants` | Add participants |\n| DELETE | `/api/v1/security/cert-sign/sessions/{id}/participants/{pid}` | Remove participant |\n\n### Participant Endpoints (Authentication Required)\n\n| Method | Endpoint | Description |\n|--------|----------|-------------|\n| GET | `/api/v1/security/cert-sign/sign-requests` | List your sign requests |\n| GET | `/api/v1/security/cert-sign/sign-requests/{id}` | Get sign request details |\n| GET | `/api/v1/security/cert-sign/sign-requests/{id}/document` | Download document to review |\n| POST | `/api/v1/security/cert-sign/sign-requests/{id}/sign` | Sign the document |\n| POST | `/api/v1/security/cert-sign/sign-requests/{id}/decline` | Decline to sign |\n\n---\n\n## Related\n\n- [File Sharing and Storage](doc:configuration/file-sharing-and-storage) -- Configure storage, sharing, and quotas\n- [Certificate Signing](doc:functionality/security/certificate-signing) -- Individual certificate signing and validation\n- [Sign (Handwritten)](doc:functionality/security/sign) -- Non-cryptographic visual signatures\n- [System and Security Settings](doc:configuration/system-and-security) -- Server certificates, JWT, sessions",
+      "sourcePath": "docs/Functionality/Security/Shared-Signing.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Security/Shared-Signing.md"
+    },
+    "functionality/security/sign": {
+      "id": "functionality/security/sign",
+      "title": "Sign PDF (Handwritten Signatures)",
+      "description": "Add handwritten, text, or image signatures to PDFs",
+      "section": "functionality/security",
+      "markdown": "Add handwritten signatures, text signatures, or image-based signatures to PDF documents. This tool is for visual/handwritten signatures - for certificate-based digital signatures, see [Certificate Signing](doc:functionality/security/certificate-signing).\n\n---\n\n## Signature Methods\n\n\n  \n    1. Upload PDF and navigate to the signing location\n    2. Select the \"Draw\" tab to open the signature canvas\n    3. Draw using mouse or touchscreen\n    4. Position and resize the signature on the page\n    5. Apply and download\n\n    A touchscreen or stylus gives the best results.\n  \n  \n    1. Upload PDF\n    2. Select the \"Type\" tab\n    3. Type your name and choose a font (Helvetica, Times, Courier, Arial, or Georgia)\n    4. Position and apply\n  \n  \n    1. Upload PDF\n    2. Select the \"Upload\" tab\n    3. Select a PNG/JPG of your signature\n    4. Position, resize, and apply\n\n    Use a PNG with transparent background for best results.\n  \n\n\n---\n\n## Pre-stored Signatures\n\nConfigure Stirling PDF to load pre-stored signature files for quick, consistent signing across documents.\n\n**Configuration:** [Sign with Custom Files](doc:configuration/sign-with-custom-files)\n\n---\n\n## Signature Options\n\n- **Transparency** - Remove the white background of an uploaded signature image to make it transparent\n- **Color** - Pick any ink color from the color picker (with quick black, blue, red, orange, green, and purple swatches) for drawn and typed signatures\n- **Size** - Adjust the pen thickness and resize the placed signature to fit the signature line\n- **Pages** - Sign on a single page, or place signatures on multiple pages\n\n---\n\n## Visual vs. Digital Signatures\n\n| | Visual Signature (This Tool) | Digital Signature ([Certificate](doc:functionality/security/certificate-signing)) |\n|---|---|---|\n| **Security** | Visual only, can be copied | Cryptographically secure |\n| **Authentication** | No verification | Proves signer identity |\n| **Tamper Detection** | None | Detects changes after signing |\n| **Setup** | None required | Requires certificate |\n\nVisual signatures do **not** provide authentication, tamper protection, or guaranteed legal standing. For legally binding signatures requiring verification, use [Certificate Signing](doc:functionality/security/certificate-signing).\n\n---\n\n## Related Tools\n\n- **[Certificate Signing](doc:functionality/security/certificate-signing)** - Digital signatures with certificates\n- **[Add Stamp](doc:functionality/content-editing/content-editing)** - Add official stamps\n- **[Add Password](doc:functionality/security/security)** - Protect signed documents",
+      "sourcePath": "docs/Functionality/Security/Sign.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/Security/Sign.md"
+    },
+    "functionality/the-technologies": {
+      "id": "functionality/the-technologies",
+      "title": "Third-Party Credits",
+      "description": "Open-source libraries and tools used by Stirling PDF",
+      "section": "functionality",
+      "markdown": "Stirling PDF is built on these open-source projects.\n\n## Server-Side\n\n- **[PDFBox](https://pdfbox.apache.org/)** - Core PDF manipulation\n- **JPDFium** - PDFium-based engine used for merge/split and reading text and tables from PDFs\n- **[LibreOffice](https://www.libreoffice.org/)** - Office document conversions\n- **[qpdf](https://qpdf.sourceforge.io/)** - Specialized PDF operations\n- **[Tesseract OCR](https://github.com/tesseract-ocr/tesseract)** - Text recognition from images\n- **[OpenCV](https://opencv.org/)** - Image processing\n\n## Frontend\n\n- **[React](https://react.dev/)** + **[TypeScript](https://www.typescriptlang.org/)** with **[Vite](https://vitejs.dev/)**\n- **[EmbedPDF](https://www.embedpdf.com/)** / **[PDF.js](https://mozilla.github.io/pdf.js/)** - PDF viewing and annotation\n- **[pdf-lib](https://pdf-lib.js.org/)** - Client-side PDF manipulation\n- **[Mantine](https://mantine.dev/)** - UI components\n- **[i18next](https://www.i18next.com/)** - 40+ language translations\n\n## Desktop\n\n- **[Tauri](https://tauri.app/)** - Native app framework (Windows, Mac, Linux)\n\n## Browser File Storage\n\nFiles are stored locally in your browser's [IndexedDB](https://developer.mozilla.org/en-US/docs/Web/API/IndexedDB_API) between operations. They never leave your device until you process them. Clear storage when done on shared computers.\n\n## Source Code\n\n- [GitHub](https://github.com/Stirling-Tools/Stirling-PDF)",
+      "sourcePath": "docs/Functionality/The Technologies.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Functionality/The Technologies.md"
+    },
+    "getting-started": {
+      "id": "getting-started",
+      "title": "Getting Started",
+      "section": "overview",
+      "markdown": "## Benefits of Stirling PDF\n- **Extensive PDF Functionality:** Access 60+ tools, including signing, converting, merging, and more.\n- **Advanced Customization:** Deep customization, themes, and environment variables.\n- **Enterprise Features:** SSO, user management, and permission controls.\n- **Data Security:** Local file processing with automatic deletion post-task.\n- **Scalability & Automation:** Batch processing with Docker and Kubernetes support.\n- **API Integration:** Use APIs for automation and external integrations.\n- **Open-Source:** Community-driven with frequent updates and GitHub support.\n- **Multi-Language Support:** Available in 40+ languages with active translations.\n\n## Welcome to Stirling PDF\n\n> **💡 Tip: Upgrading from V1?**\n>\n> See the **[Migration Guide](doc:migration/overview)** for what's new and how to upgrade smoothly.\n\n\nStirling PDF is a locally hosted web application that allows you to perform various operations on PDF files. With 60+ tools, flexible deployment options, and enterprise features, it's the comprehensive PDF solution for individuals and organizations.\n\n---\n\n## What's New in V2\n\nV2 brings major improvements to performance, workflow, and deployment flexibility:\n\n- **Stateful Processing** - Upload once, use across multiple tools without re-uploading\n- **Undo & Redo** - Full version history for page editing\n- **Native Desktop Apps** - Fast startup, \"Open with\" integration, offline capable\n- **In-App Settings** - Configure everything through the UI, no file editing needed\n\n---\n\n## Documentation Guide\n\n### For Individual Users\n\n**[Tool Reference](doc:functionality/functionality)**\nBrowse all 60+ PDF tools with descriptions\n\n---\n\n### For Organizations & IT Teams\n\n**[Production Deployment Guide](doc:server-admin-onboarding)**\nComplete walkthrough: installation - configuration - security - monitoring\n\n**[Paid Offerings (Server & Enterprise)](doc:paid-offerings)**\nExternal databases, Google Drive integration, SSO, advanced monitoring, and priority support\n\n**[Configuration Options](doc:configuration/extra-settings)**\nAll configuration options for Docker and server deployments\n\n---\n\n### For Developers & Integration\n\n**[API Documentation](doc:api)**\nIntegrate Stirling PDF into your applications and workflows\n\n**[Configuration](doc:configuration/system-and-security)**\nSSO, certificates, security settings, and more\n\n**[Contribute Guide](doc:contribute)**\nHelp improve Stirling PDF - development setup and guidelines\n\n---\n\n## Installation\n\nChoose how you want to run Stirling PDF based on your needs:\n\n### Desktop Applications\n\nNative apps with system integration:\n\n| Platform | Download | Guide |\n|----------|----------|-------|\n| **Windows** | [Installer](https://files.stirlingpdf.com/win-installer.exe) | [Windows Guide](doc:installation/windows) |\n| **Mac** (Universal) | [DMG](https://files.stirlingpdf.com/mac-installer.dmg) | [Mac Guide](doc:installation/mac) |\n| **Linux** | [DEB](https://files.stirlingpdf.com/linux-installer.deb) | [Unix Guide](doc:installation/unix) |\n\n**Features:** Fast startup, \"Open with\" integration, no login required, optional server connection for advanced tools\n\n---\n\n### Docker Deployment\n\nRecommended for server deployments and organizations:\n\n**Quick Start:**\n```bash\ndocker run -d \\\n  -p 8080:8080 \\\n  -v ./stirling-data:/configs \\\n  stirlingtools/stirling-pdf:latest\n```\n\n**Available versions:**\n- `latest` - Standard version (recommended)\n- `latest-fat` - Extra fonts and tools for highest quality conversions and full format support\n- `latest-ultra-lite` - Minimal size for resource-constrained environments\n\n**Full guide:** [Docker Installation Guide](doc:installation/docker-install)\n\n---\n\n### Manual Server Setup\n\nFor bare metal installations or environments without Docker:\n\n1. Download `Stirling-PDF.jar`\n2. Install Java 25+\n3. Install dependencies (LibreOffice, Tesseract for OCR)\n4. Run the JAR file\n\n**Full guide:** [Unix Installation Guide](doc:installation/unix)\n\n---\n\n## Quick Links\n\n- **Questions?** Check our **[FAQ](doc:faq)**\n- **Issues?** Report on **[GitHub](https://github.com/Stirling-Tools/Stirling-PDF/issues)**\n- **Community?** Join our **[Discord](https://discord.gg/Cn8pWhQRxZ)**",
+      "sourcePath": "docs/Getting Started.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Getting Started.md"
+    },
+    "installation/development-setup": {
+      "id": "installation/development-setup",
+      "title": "Development Setup Guide",
+      "section": "installation",
+      "markdown": "## Development Setup for Stirling PDF\n\nThis guide covers setting up a local development environment for Stirling PDF, including both backend and frontend (V2.0+) development.\n\n## Prerequisites\n\nBefore getting started, ensure you have the following installed:\n\n- **Java**: JDK 25\n- **Node.js**: Version 22+ for frontend development\n- **npm**: Comes with Node.js\n- **Docker**: For testing and containerization\n- **Gradle**: Included in the repository (use `./gradlew`)\n- **Git**: For version control\n- **Task** (optional but recommended): [Task](https://taskfile.dev/) is the project's unified command runner. With it installed you can run `task dev`, `task check`, etc. from the repo root. Run `task --list` to see all commands.\n\n### IDE Setup\n\nRecommended IDEs:\n- **IntelliJ IDEA** (recommended for Java development)\n- **Visual Studio Code** (good for both frontend and backend)\n- **Eclipse**\n\n**Important**: Install the Lombok plugin for your IDE. Visit [projectlombok.org/setup](https://projectlombok.org/setup/) for IDE-specific instructions.\n\n## Getting Started\n\n### 1. Clone the Repository\n\n```bash\ngit clone https://github.com/Stirling-Tools/Stirling-PDF.git\ncd Stirling-PDF\n```\n\n### 2. Backend Development\n\n#### Running the Backend\n\n```bash\n# Build and run the Spring Boot application\n./gradlew bootRun\n```\n\nThe backend will start on `http://localhost:8080`\n\n#### Code Formatting\n\nStirling PDF uses Spotless for code formatting:\n\n```bash\n# Apply formatting (run before committing)\n./gradlew spotlessApply\n```\n\n#### Enable Security Features (Optional)\n\nFor local testing with full security features:\n\n```bash\n# Set environment variable\nexport SECURITY_ENABLELOGIN=true\n\n# Or add to your IDE's run configuration\n-DSECURITY_ENABLELOGIN=true\n```\n\n### 3. Frontend Development (V2.0+)\n\n#### Initial Setup\n\n```bash\n# Navigate to frontend directory\ncd frontend\n\n# Install dependencies\nnpm install\n```\n\n#### Running the Development Server\n\nThe project uses [Task](https://taskfile.dev/) as its command runner. From the repository root:\n\n```bash\n# Start the Vite dev server (runs `npx vite editor` under the hood)\ntask frontend:dev\n```\n\nThe frontend will start on `http://localhost:5173`\n\n**Important**: The Vite dev server automatically proxies API requests to the backend at `localhost:8080`. Make sure the backend is running before starting the frontend dev server.\n\n#### Frontend Technology Stack\n\n- **Framework**: React + TypeScript\n- **Build Tool**: Vite\n- **UI Library**: Mantine UI\n- **Styling**: TailwindCSS\n- **PDF Rendering**: PDF.js\n- **PDF Manipulation**: PDF-LIB\n- **Storage**: IndexedDB for client-side file storage\n- **i18n**: i18next for internationalization\n\n### 4. Desktop Application Development\n\nStirling PDF V2.0 uses Tauri for native desktop applications. Desktop builds also require **Rust** and **Cargo** installed. From the repository root:\n\n```bash\n# Run desktop app in development mode (runs `npx tauri dev`)\ntask desktop:dev\n\n# Build desktop application (runs `npx tauri build`)\ntask desktop:build\n```\n\n## Development Workflow\n\n### Full Development Setup\n\nThe quickest way is the unified Task runner, which starts the backend and frontend together:\n\n```bash\n# From the repository root - starts backend + frontend concurrently\ntask dev\n```\n\nOr run them in separate terminals:\n\n1. **Terminal 1** - Backend:\n   ```bash\n   ./gradlew bootRun\n   ```\n\n2. **Terminal 2** - Frontend:\n   ```bash\n   task frontend:dev\n   ```\n\n3. **Access the application**:\n   - Frontend (React): http://localhost:5173\n   - Backend API: http://localhost:8080\n   - API Documentation: http://localhost:8080/swagger-ui/index.html\n\n### Building the Project\n\n```bash\n# Backend only (default - the frontend is not bundled unless asked for)\n./gradlew clean build\n\n# Full build with the frontend bundled into the backend JAR\n./gradlew clean build -PbuildWithFrontend=true\n```\n\n## Architecture Overview\n\n### Backend Architecture\n\n- **Framework**: Spring Boot\n- **PDF Processing**: Apache PDFBox\n- **Document Conversion**: LibreOffice (optional dependency)\n- **PDF Optimization**: qpdf (optional dependency)\n- **Security**: Spring Security (optional, controlled by `SECURITY_ENABLELOGIN`)\n\n### Frontend Architecture (V2.0)\n\n- **State Management**: React Context (FileContext for file operations)\n- **File Storage**: IndexedDB for client-side persistence\n- **Tool Architecture**: Hook-based pattern using `useToolOperation`\n- **Memory Management**: Manual cleanup for PDF.js documents and blob URLs\n- **Performance Target**: Improved handling of large PDFs with better memory management\n\n### Key Frontend Concepts\n\n#### FileContext\nCentral state management for all file operations:\n- Active files and their variants\n- Tool navigation state\n- Memory management (PDF.js documents, blob URLs, Web Workers)\n- IndexedDB persistence\n\n#### Tool Development\nTools use a modular hook-based architecture:\n- **useToolOperation**: Main orchestrator hook\n- **useToolState**: UI state management\n- **useToolApiCalls**: HTTP requests and file processing\n- **useToolResources**: Blob URLs, thumbnails, ZIP downloads\n\nSee `ADDING_TOOLS.md` in the repository for detailed tool development guide.\n\n## Testing\n\n### Running Tests\n\n```bash\n# Run all tests\n./gradlew test\n\n# Full Docker test suite (tests all variants)\n./testing/test.sh\n```\n\n### Testing Different Versions\n\nStirling PDF offers three Docker variants:\n- **Ultra-lite**: Basic PDF operations only\n- **Standard** (latest): Full feature set\n- **Fat** (latest-fat): Pre-downloaded dependencies for air-gapped environments\n\n## Configuration Files\n\n### Backend Configuration\n\n- `app/core/src/main/resources/application.properties`: Main application configuration\n- `settings.yml`: User-configurable settings (generated on first run)\n\n### Frontend Configuration\n\n- `frontend/editor/.env`: Environment variables for development (with `.env.desktop` and `.env.saas` overrides per build mode)\n- `frontend/editor/vite.config.ts`: Vite build/dev-server configuration\n- `frontend/editor/public/locales/<lang>/translation.toml`: Translation files (TOML format)\n\n> **📝 Note: FRONTEND_ALLOWED_HOSTS**\n>\n> `FRONTEND_ALLOWED_HOSTS` is a comma-separated allowlist of `Host` header values that the Vite dev server will accept. Set it when running the dev server behind a reverse proxy or under a custom hostname (e.g. `FRONTEND_ALLOWED_HOSTS=dev.example.com,localhost`). This is a dev-server environment variable only - it is not a production `settings.yml` key. When empty or unset, Vite keeps its default host checks.\n\n\n## Common Development Tasks\n\n### Adding Translations\n\nTranslations use TOML files, one per locale:\n\n1. Navigate to `frontend/editor/public/locales/<lang>/translation.toml`\n2. **Important**: Only update `en-US/translation.toml`. `en-US` is the source/primary locale and the language used when a translation is missing (`fallbackLng: \"en-US\"`).\n3. Edit `translation.toml`, adding keys under the relevant feature/tool.\n4. For counts, use ICU-style plural suffixes on the key (`_one`, `_other`, and `_zero` where needed).\n5. Other languages are managed separately by the community.\n\n### Adding a New PDF Tool\n\nSee the repository's `ADDING_TOOLS.md` for detailed instructions. Quick overview:\n\n1. Create backend controller endpoint\n2. Create frontend tool hook using `useToolOperation`\n3. Add UI component\n4. Add translations\n5. Register tool in routing\n\n## Troubleshooting\n\n### Backend Issues\n\n- **Port already in use**: Override the port with `-Dserver.port=8081` (or set the `SERVER_PORT` environment variable)\n- **Lombok errors**: Ensure Lombok plugin is installed in your IDE\n- **Build failures**: Run `./gradlew clean` and try again\n\n### Frontend Issues\n\n- **npm install fails**: Delete `node_modules` and `package-lock.json`, then run `npm install` again\n- **Proxy errors**: Ensure backend is running on port 8080\n- **Memory issues with large PDFs**: This is expected during development; memory management is optimized in production builds\n\n### Docker Issues\n\n- **Build failures**: Ensure Docker has enough memory allocated (at least 4GB recommended)\n- **Permission issues**: Use Docker without sudo or add your user to the docker group\n\n## Additional Resources\n\n- **GitHub Repository**: [Stirling-Tools/Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF)\n- **CLAUDE.md**: Detailed architecture and development patterns\n- **DeveloperGuide.md**: Comprehensive developer documentation\n- **ADDING_TOOLS.md**: Guide for creating new PDF tools\n- **CONTRIBUTING.md**: Contribution guidelines\n\n## Need Help?\n\n- **GitHub Issues**: [Report bugs and request features](https://github.com/Stirling-Tools/Stirling-PDF/issues)\n- **Discord**: [Join our community](https://discord.gg/Cn8pWhQRxZ)\n- **Discussions**: [Ask questions on GitHub Discussions](https://github.com/Stirling-Tools/Stirling-PDF/discussions)",
+      "sourcePath": "docs/Installation/Development Setup.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Installation/Development Setup.md"
+    },
+    "installation/docker-install": {
+      "id": "installation/docker-install",
+      "title": "Docker Guide",
+      "section": "installation",
+      "markdown": "## Docker Installation for Stirling PDF\n\nRun Stirling PDF in Docker for easy self-hosting, automatic updates, and flexible deployment.\n\n## Quick Start\n\n\n\n\n```bash\ndocker run -d \\\n  --name stirling-pdf \\\n  -p 8080:8080 \\\n  -v ./stirling-data:/configs \\\n  stirlingtools/stirling-pdf:latest\n```\n\n\n\n\nCreate `docker-compose.yml`:\n\n```yaml\nservices:\n  stirling-pdf:\n    image: stirlingtools/stirling-pdf:latest\n    container_name: stirling-pdf\n    ports:\n      - '8080:8080'\n    volumes:\n      - ./stirling-data:/configs\n    restart: unless-stopped\n```\n\nThen run:\n```bash\ndocker-compose up -d\n```\n\n\n\n\nThen open `http://localhost:8080` in your browser!\n\n> **ℹ️ Info: Login is ON by default**\n>\n> The default is `security.enableLogin: true`, so a fresh container starts with login **enabled** and creates a default admin account:\n>\n> ```\n> Username: admin\n> Password: stirling\n> ```\n>\n> Change this password immediately after first login. If you want the no-login experience instead (no authentication, no admin account), you must opt out explicitly by setting `SECURITY_ENABLELOGIN=false`. See [Modes](doc:modes-and-licensing) for how the deploy modes differ.\n\n\n## Choosing Your Version\n\n| Version | Tag | What's Included | Best For |\n|---------|-----|-----------------|----------|\n| **Standard** | `latest` | All PDF features | Most users, balanced features & size |\n| **Fat** | `latest-fat` | Everything + extra fonts & tools | Highest quality conversions, full format support |\n| **Ultra-Lite** | `latest-ultra-lite` | Core features only | Limited resources, minimal size |\n\n**Most users should use `latest`** - it has everything you need.\n\n### When to use each version:\n\n**Standard (`latest`)** - You want all PDF features, have normal server specs, or you're not sure which to pick.\n\n**Fat (`latest-fat`)** - You need the highest quality conversions with full font support, every conversion format, and all optional tools. Disk space isn't a concern.\n\n**Ultra-Lite (`latest-ultra-lite`)** - Running on very limited hardware (Raspberry Pi, low-end VPS), want fastest startup, or only need basic PDF operations.\n\nTo use a different version, just change the tag:\n```bash\ndocker run -d stirlingtools/stirling-pdf:latest-ultra-lite\n```\n\n## Full Setup (With All Features)\n\nWant OCR, custom settings, and logging? Add more volumes:\n\n\n\n\n```bash\ndocker run -d \\\n  --name stirling-pdf \\\n  -p 8080:8080 \\\n  -v ./stirling-data/tessdata:/usr/share/tessdata \\\n  -v ./stirling-data/configs:/configs \\\n  -v ./stirling-data/logs:/logs \\\n  -v ./stirling-data/pipeline:/pipeline \\\n  -e SECURITY_ENABLELOGIN=false \\\n  -e SYSTEM_DEFAULTLOCALE=en-GB \\\n  stirlingtools/stirling-pdf:latest\n```\n\n\n\n\nCreate `docker-compose.yml`:\n\n```yaml\nservices:\n  stirling-pdf:\n    image: stirlingtools/stirling-pdf:latest\n    container_name: stirling-pdf\n    ports:\n      - '8080:8080'\n    volumes:\n      - ./stirling-data/tessdata:/usr/share/tessdata  # OCR language files\n      - ./stirling-data/configs:/configs               # Settings & database\n      - ./stirling-data/logs:/logs                     # Application logs\n      - ./stirling-data/pipeline:/pipeline             # Automation configs\n    environment:\n      - SECURITY_ENABLELOGIN=false      # Opt out of login (default is true / enabled)\n      - SYSTEM_DEFAULTLOCALE=en-GB      # Default interface language\n    restart: unless-stopped\n```\n\nThen run:\n```bash\ndocker-compose up -d\n```\n\n\n\n\n**What each volume does:**\n- `/configs` - Your settings and database\n- `/usr/share/tessdata` - OCR language files\n- `/logs` - Application logs\n- `/pipeline` - Automation configurations\n\n## Updating Stirling PDF\n\n\n\n\n```bash\ndocker stop stirling-pdf\ndocker rm stirling-pdf\ndocker pull stirlingtools/stirling-pdf:latest\n# Then run your original docker run command\n```\n\n\n\n\n```bash\ndocker-compose down\ndocker-compose pull\ndocker-compose up -d\n```\n\n\n\n\nYour data is safe in the volumes and will persist across updates.\n\n## Platform-specific quick starts\n\nSeveral platforms have one-click installs or community packages that wrap the Docker setup. Use these when available - they're maintained by their respective communities and handle the platform-native bits (permissions, networking, backups) for you.\n\n\n\n\nAvailable in the **TrueNAS Apps catalog** (Community train).\n\n1. **Apps → Discover Apps**, search for \"Stirling PDF\".\n2. Click **Install**, accept defaults (or customise port / persistence).\n3. Open from **Apps → Installed**.\n\nSee the catalog listing at [apps.truenas.com/catalog/stirling-pdf/](https://apps.truenas.com/catalog/stirling-pdf/).\n\n\n\n\nAvailable in **Community Applications**. Stirling PDF was the [Unraid App of the Month for February 2026](https://newsletter.unraid.net/p/unraid-february-digest-0617).\n\n1. Install the [Community Applications](https://forums.unraid.net/topic/38582-plug-in-community-applications/) plugin if you don't already have it.\n2. **Apps** tab → search \"Stirling PDF\" → click the result → **Install**.\n3. Review the default paths / variables on the template, then **Apply**.\n\nThe template populates volumes, ports, and the standard Unraid `PUID=99 PGID=100` env vars for you.\n\n\n\n\nThe **Community Scripts** project provides a one-line LXC installer. From the Proxmox VE shell:\n\n```bash\nbash -c \"$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/stirling-pdf.sh)\"\n```\n\nThis creates an LXC, installs Java, LibreOffice, Tesseract, OCRmyPDF, and Stirling PDF as a systemd service. Once finished, browse to `http://<container-ip>:8080`.\n\nScript reference: [community-scripts/ProxmoxVE - stirling-pdf](https://community-scripts.github.io/ProxmoxVE/scripts?id=stirling-pdf).\n\nPrefer Docker-in-LXC instead? Create a Debian/Ubuntu LXC, enable nesting (`pct set <ctid> -features nesting=1,keyctl=1`), install Docker, and use the standard compose at the top of this page.\n\n\n\n\nSee the [Marius Hosting Synology guide](https://mariushosting.com/how-to-install-stirling-pdf-on-your-synology-nas/).\n\n\n\n\nSee the [Marius Hosting UGREEN guide](https://mariushosting.com/how-to-install-stirling-pdf-on-your-ugreen-nas/).\n\n\n\n\nSee the [Marius Hosting Asustor guide](https://mariushosting.com/how-to-install-stirling-pdf-on-your-asustor-nas/).\n\n\n\n\nNo official store entry, but the standard Docker Compose works fine in any compose-based UI:\n\n- **Portainer**: Stacks → Add stack → paste the compose from the [Full Setup](#full-setup-with-all-features) section.\n- **CasaOS**: Use the \"Install a customized app\" flow with the Docker image `docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest`, port `8080`, and bind mounts for `/configs`, `/logs`, `/customFiles`, `/pipeline`, `/usr/share/tessdata`.\n\n\n\n\nFor rootless Podman with systemd, drop a Quadlet file at `~/.config/containers/systemd/stirling-pdf.container`:\n\n```ini\n[Unit]\nDescription=Stirling PDF\n\n[Container]\nImage=docker.stirlingpdf.com/stirlingtools/stirling-pdf:latest\nPublishPort=8080:8080\nVolume=%h/stirling-pdf/configs:/configs:Z\nVolume=%h/stirling-pdf/logs:/logs:Z\nVolume=%h/stirling-pdf/customFiles:/customFiles:Z\nVolume=%h/stirling-pdf/pipeline:/pipeline:Z\nVolume=%h/stirling-pdf/tessdata:/usr/share/tessdata:Z\nUserNS=keep-id:uid=1000,gid=1000\nAutoUpdate=registry\n\n[Install]\nWantedBy=default.target\n```\n\nThen `systemctl --user daemon-reload && systemctl --user start stirling-pdf`.\n\nThe `:Z` label is required on SELinux distros (Fedora/RHEL). `--userns=keep-id` sidesteps the `PUID`/`PGID` remap, which is skipped under rootless Podman.\n\n\n\n\n> **📝 Note: Community-maintained**\n>\n> The TrueNAS, Unraid, and Proxmox integrations above are community-maintained, not built or operated by Stirling Tools. Report issues with the integration itself to the respective project (TrueNAS Apps, Unraid Community Apps, community-scripts/ProxmoxVE). For Stirling PDF behaviour, use the [Stirling PDF issue tracker](https://github.com/Stirling-Tools/Stirling-PDF/issues).\n\n\n## Common Configurations\n\n### User Authentication\nLogin is enabled by default (default admin `admin` / `stirling`). To turn it off and run without authentication, set:\n```yaml\nenvironment:\n  - SECURITY_ENABLELOGIN=false\n```\n\n### Change Interface Language\nSet the default UI language (locale codes use a hyphen). Empty/unset auto-detects from the browser and falls back to `en-US`.\n```yaml\nenvironment:\n  - SYSTEM_DEFAULTLOCALE=es-ES  # Spanish, or en-GB, fr-FR, de-DE, etc.\n```\n\n### Custom Port\n```yaml\nports:\n  - '9000:8080'  # Access at http://localhost:9000\n```\n\n## Next Steps\n\n- **Add OCR Languages**: See [OCR Configuration](doc:configuration/ocr)\n- **Enable Authentication**: See [Security Settings](doc:configuration/system-and-security)\n- **Setup Automation**: See [Pipeline Configuration](doc:configuration/pipeline)\n- **More Settings**: See [Configuration](doc:configuration/configuration)\n\n## Troubleshooting\n\n**Can't access at localhost:8080?**\n- Check if port 8080 is already in use\n- Try a different port: `-p 9000:8080`\n- Check firewall settings\n\n**Permission errors with volumes?**\n- Make sure the directories exist\n- Check folder permissions: `chmod -R 755 ./stirling-data`\n\n**Container keeps restarting?**\n- Check logs: `docker logs stirling-pdf`\n- Check system resources (RAM, disk space)\n- Try ultra-lite version for limited hardware",
+      "sourcePath": "docs/Installation/Docker Install.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Installation/Docker Install.md"
+    },
+    "installation/kubernetes": {
+      "id": "installation/kubernetes",
+      "title": "Kubernetes Guide",
+      "section": "installation",
+      "markdown": "### Run stirling-pdf helm chart\n\n```bash\nhelm repo add stirling-pdf https://stirling-tools.github.io/Stirling-PDF-chart\nhelm repo update\nhelm install stirling-pdf stirling-pdf/stirling-pdf-chart --namespace stirling-pdf --create-namespace\n```\n\n### Override stirling-pdf default values\n\nCreate a `values.yaml` file with the values you want to override from the [documentation](https://github.com/Stirling-Tools/Stirling-PDF-chart/tree/main/charts/stirling-pdf).\n(For examples, see the comments in the default [values.yml](https://github.com/Stirling-Tools/Stirling-PDF-chart/blob/main/charts/stirling-pdf/values.yaml) file.)\nThen, add `-f values.yaml` to the `helm install` command.\n\n### Persistent storage\n\nStirling PDF keeps runtime data - user accounts, `settings.yml`, the internal database, and other state - under `/configs` (and related data paths). You can run without a persistent volume by supplying configuration through environment variables in your `values.yaml`, and the app works fine that way.\n\nA `PersistentVolumeClaim` is still recommended for reliable operation: it preserves data such as logins and settings across pod restarts and avoids errors from state being lost when a pod is rescheduled. The official Helm chart exposes persistence options in its [`values.yaml`](https://github.com/Stirling-Tools/Stirling-PDF-chart/blob/main/charts/stirling-pdf/values.yaml) - refer to the persistence-related keys there to enable a PVC and choose a storage class and size.\n\n### Overriding configuration\n\nConfiguration is controlled through the same environment variables and `settings.yml` options used in other deployments, set through the chart's `values.yaml`.\n\nCreate a `values.yaml` file and add the environment variables you want under the chart's env section, then pass it to Helm with `-f values.yaml`. See the comments in the default [`values.yaml`](https://github.com/Stirling-Tools/Stirling-PDF-chart/blob/main/charts/stirling-pdf/values.yaml) for the exact structure.\n\nFor example, to raise the log level for debugging you can set the standard Stirling PDF logging environment variable (such as `LOGGING_LEVEL_STIRLING=DEBUG`) as an env entry in your `values.yaml`, alongside any other environment variables like locale, security, or OAuth/SAML settings.\n\n### Upgrade the helm chart\n\n```bash\nhelm repo update\nhelm upgrade stirling-pdf stirling-pdf/stirling-pdf-chart --namespace stirling-pdf --reuse-values\n```",
+      "sourcePath": "docs/Installation/Kubernetes.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Installation/Kubernetes.md"
+    },
+    "installation/mac": {
+      "id": "installation/mac",
+      "title": "Mac Installation Guide",
+      "section": "installation",
+      "markdown": "## MacOS Installation Guide for Stirling PDF\n\nStirling PDF for Mac is available as a **native desktop application** or can run as a **server** using the JAR file.\n\n## Desktop Application (Recommended)\n\nNative Mac desktop app with all PDF tools available.\n\n### What You Get\n\n- ✅ **Native macOS application** - Optimized for both Apple Silicon and Intel Macs\n- ✅ **No login required** - Install and start using PDF tools right away\n- ✅ **Processes files locally** - All your PDF processing stays on your Mac\n- ✅ **Optional server connection** - Connect to Stirling Cloud or your own self-hosted server for advanced tools like OCR and document conversions\n- ✅ **All local tools included** - Merge, split, rotate, sign, and more work without any server\n- ✅ **Better performance** - Native speed on M1/M2/M3 chips\n- ✅ **No external browser needed** - Uses the built-in window\n- ✅ **Menu bar integration** - Feels like a native Mac app\n\n### Installation\n\nPick whichever method you prefer. Both install the same desktop app.\n\n\n  \n    **1. Download the installer:** [Download Stirling PDF for Mac](https://files.stirlingpdf.com/mac-installer.dmg)\n\n    The DMG is a universal binary that runs natively on both Apple Silicon (M1/M2/M3/etc.) and Intel Macs - no need to pick a build for your chip.\n\n    **2. Install:** open the `.dmg` and drag Stirling PDF to your Applications folder.\n\n    ![mac-installer.png](https://raw.githubusercontent.com/Stirling-Tools/Stirling-Tools.github.io/main/static/img/mac-installer.png)\n\n    **3. First-time launch (Gatekeeper):** macOS blocks the app on first launch because it's not from the App Store.\n\n    ![mac-app-blocked.png](https://raw.githubusercontent.com/Stirling-Tools/Stirling-Tools.github.io/main/static/img/mac-app-blocked.png)\n\n    Open **System Settings → Privacy & Security**, scroll to the **Security** section, click **\"Open Anyway\"** next to the Stirling PDF message, then launch again.\n\n    ![mac-security-allow.png](https://raw.githubusercontent.com/Stirling-Tools/Stirling-Tools.github.io/main/static/img/mac-security-allow.png)\n  \n  \n    ```bash\n    brew tap Stirling-Tools/stirling-pdf\n    brew install --cask stirling-pdf\n    ```\n\n    Updates come through `brew upgrade`:\n\n    ```bash\n    brew upgrade --cask stirling-pdf\n    ```\n  \n\n\n### Using the Desktop App\n\n1. Launch Stirling PDF\n2. Start using local PDF tools right away - no login needed\n3. Upload or drag-and-drop files into the window\n4. Optionally connect to Stirling Cloud or a self-hosted server for advanced tools like OCR and document conversions\n\n**Making Stirling PDF your default PDF viewer:**\n1. Right-click (or Control+click) any PDF file\n2. Select **\"Get Info\"**\n3. Under **\"Open with\"**, choose **Stirling PDF**\n4. Click **\"Change All\"** to apply to all PDFs\n5. Confirm when prompted\n\n**Benefits of desktop app:**\n- Files stay on your Mac (not in browser storage)\n- Work without internet connection\n- Native performance (especially on Apple Silicon)\n- Unlimited file storage\n- Menu bar integration\n- macOS gestures and features work\n\n**Multiple windows:**\n- Press **Cmd+N** to open an empty new window\n- Use **Open in new window** from the My Files page to open files in a separate window\n\n### Connection modes\n\nYou can pick one of three connection modes. See [Modes](doc:modes-and-licensing) for how each mode is licensed.\n\n- **Bundled local backend (default):** the app runs its own copy of Stirling PDF on your Mac, no setup or login, fully offline.\n- **Stirling Cloud:** sign in for advanced server-side tools.\n- **Self-hosted Server:** enter the URL of your own Stirling PDF instance (e.g., `http://192.168.1.53:8080`) for full control over your data.\n\n### Managed deployment (Jamf / MDM)\n\nTo pre-configure and lock the app across managed Macs - server URL, connection lock, and update behaviour - see [Managed Desktop Deployment](doc:installation/managed-deployment).\n\n## Server Version (For Hosting and Sharing)\n\nWant to host Stirling PDF on a Mac server for multiple users? Use the JAR file version.\n\n### Prerequisites\n\nInstall Java 25 (required for server version):\n\n```bash\n# Install Homebrew if you don't have it\n/bin/bash -c \"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\"\n\n# Install Java 25\nbrew install openjdk@25\n\n# Add to your PATH (add to ~/.zshrc to make permanent)\n# Using `brew --prefix` keeps this correct on both Apple Silicon (/opt/homebrew) and Intel (/usr/local)\nexport PATH=\"$(brew --prefix openjdk@25)/bin:$PATH\"\n```\n\n### JAR Downloads\n\nStirling PDF comes in three different JAR files:\n\n**Stirling-PDF-with-login.jar** (Recommended - Full Features):\n- Download: [Stirling-PDF-with-login.jar](https://files.stirlingpdf.com/Stirling-PDF-with-login.jar)\n- Bundles frontend UI + backend server in one file\n- **Includes authentication and additional features** - requires user login (default credentials: `admin` / `stirling`)\n- **Recommended for all users** - personal, shared, or enterprise deployments\n\n**Stirling-PDF.jar** (Plain JAR - Basic Features):\n- Download: [Stirling-PDF.jar](https://files.stirlingpdf.com/Stirling-PDF.jar)\n- Bundles frontend UI + backend server in one file\n- **Basic version** - no authentication, core features only\n- Only use if you require no login at all and don't mind missing certain features\n\n**Stirling-PDF-server.jar** (Backend Only - **Advanced**):\n- Download: [Stirling-PDF-server.jar](https://files.stirlingpdf.com/Stirling-PDF-server.jar)\n- Backend server only (no bundled UI)\n- **No authentication** - API access only\n- For desktop app backend, custom frontend, or API integrations\n\n### Running the Server\n\n1. **Download your preferred JAR file** (see above)\n\n2. **Open Terminal** and navigate to the download folder:\n   ```bash\n   cd ~/Downloads  # Or wherever you saved the JAR\n   ```\n\n3. **Run Stirling PDF**:\n   ```bash\n   java -jar Stirling-PDF.jar\n   ```\n\n4. **Access via browser** at `http://localhost:8080`\n\n5. **Share with others** on your network at `http://your-mac-ip:8080`\n\n### Creating a Convenience Script\n\nFor easier launching, create a startup script:\n\n1. **Create the script**:\n   ```bash\n   nano ~/run-stirling.sh\n   ```\n\n2. **Add these contents**:\n   ```bash\n   #!/bin/bash\n   cd ~/Downloads  # Change to where your JAR is located\n   java -jar Stirling-PDF.jar\n   ```\n\n3. **Save and exit** (Ctrl+X, then Y, then Enter)\n\n4. **Make it executable**:\n   ```bash\n   chmod +x ~/run-stirling.sh\n   ```\n\n5. **Run anytime with**:\n   ```bash\n   ~/run-stirling.sh\n   ```\n\n\n### Optional Dependencies\nInstall these via [Homebrew](https://brew.sh/) to enable additional features like advanced document conversion or PDF compression:\n\n ```bash\n # Install Homebrew if needed\n /bin/bash -c \"$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\"\n\n # Install dependencies as needed\n brew install openjdk@25          # Required\n brew install qpdf                # PDF compression\n brew install --cask libreoffice  # Document conversion\n brew install tesseract           # OCR functionality\n brew install tesseract-lang      # Additional OCR languages\n brew install poppler             # PDF to HTML conversion\n pip3 install weasyprint          # URL to PDF conversion\n pip3 install unoserver           # File to PDF conversion\n ```\n\nFor Tesseract OCR, add to `config/settings.yml` (generated once you first run the jar):\n\n```yaml\nsystem:\n  tessdataDir: /usr/local/share/tessdata\n```\n\n ## Quick Troubleshooting\n - Java not found? Add to `~/.zshrc` (works on both Apple Silicon and Intel):\n   ```bash\n   export PATH=\"$(brew --prefix openjdk@25)/bin:$PATH\"\n   ```\n - Verify installations with: `[command] --version` (e.g., `java --version`)\n - LibreOffice issues? Ensure no LibreOffice processes are running\n - Need help? Visit [GitHub Issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)\n\n### Starting unoserver alongside Stirling PDF\n\nTo ensure that unoserver is running alongside Stirling PDF, you need to start it with the following command:\n\n```bash\nunoserver --port 2003 --interface 0.0.0.0\n```\n\nYou can add this command to your startup script or systemd service file to ensure it starts automatically with Stirling PDF.",
+      "sourcePath": "docs/Installation/Mac.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Installation/Mac.md"
+    },
+    "installation/managed-deployment": {
+      "id": "installation/managed-deployment",
+      "title": "Managed Desktop Deployment",
+      "description": "Pre-configure and lock the Stirling PDF desktop app across many machines with MDM (Intune, Jamf, SCCM, Group Policy)",
+      "section": "installation",
+      "markdown": "This guide is for IT administrators rolling out the Stirling PDF **desktop app** to many machines and pre-configuring it - for example pointing everyone at a self-hosted server, stopping users changing that, or controlling how updates are applied. It works with any deployment or MDM tool (Microsoft Intune, Jamf, SCCM, Group Policy, Munki, and so on).\n\nFor a normal single-machine install, use the [Windows](doc:installation/windows), [Mac](doc:installation/mac), or [Linux](doc:installation/unix) guides instead.\n\n---\n\n## How it works\n\nWhen the desktop app starts, it looks for a small JSON file called **`stirling-provisioning.json`**. Whatever that file contains is applied to the app: the server it connects to, whether the user can change that, and how updates behave.\n\nWhere you put the file decides whether the user can override it:\n\n- **System directory (needs admin rights to write)** - the settings are applied **and locked**. The affected controls are greyed out with a \"Managed by administrator\" label and users cannot change them. This is what you want for a managed fleet.\n- **Per-user directory** - the settings are applied but **not locked**, so the user can still change them. Useful for setting a default without forcing it.\n\nYou can write this file yourself (it is only a few lines), or on Windows let the installer write it for you from install parameters (see the Windows section below).\n\n---\n\n## The provisioning file\n\n`stirling-provisioning.json` is plain JSON. Every field is optional - include only the ones you want to set:\n\n```json\n{\n  \"serverUrl\": \"http://192.168.1.53:8080\",\n  \"lockConnectionMode\": true,\n  \"updateMode\": \"disabled\"\n}\n```\n\n| Field | Type | What it does |\n|-------|------|--------------|\n| `serverUrl` | string | The server the app connects to on launch (your self-hosted instance, or a Stirling Cloud URL). Include the protocol (`http://` or `https://`); a trailing slash is optional. |\n| `lockConnectionMode` | boolean | `true` stops users changing the server or connection mode in Settings. Only takes effect when `serverUrl` is also set. |\n| `loginAgreementEnabled` | boolean | `true` enables the login agreement/disclaimer dialog. It only turns the feature on - the text is supplied separately (see note below), and with no text nothing is shown. Can be set on its own (no `serverUrl` needed), so it also applies to local, no-login desktop installs. |\n| `updateMode` | string | How the built-in updater behaves: `prompt` (default - ask the user), `auto` (download and install silently on startup), or `disabled` (never check or show update UI). |\n\nA file with none of these fields is ignored.\n\n> **📝 Note: The login agreement flag only enables it**\n>\n> `loginAgreementEnabled` / `STIRLING_LOGIN_AGREEMENT` switches the feature on; it does not carry the disclaimer text. The dialog stays hidden until text is available - from the server the desktop connects to, or for a local bundled backend from a `customFiles/disclaimer/<locale>.md` file or the `LEGAL_LOGINAGREEMENT_FALLBACKTEXT` setting. With no text configured, nothing is shown. See [Login Agreement](doc:configuration/system-and-security).\n>\n> Passing the disclaimer text directly as an install parameter is planned for a future update.\n\n\n---\n\n## File locations\n\nPut the file in the **system** directory to apply and lock settings for everyone on the machine. The app also reads a **per-user** copy, which is applied but not locked.\n\n| OS | System directory (applies and locks) | Per-user directory (applies only) |\n|----|--------------------------------------|-----------------------------------|\n| **Windows** | `%PROGRAMDATA%\\Stirling-PDF\\stirling-provisioning.json` | `%APPDATA%\\Stirling-PDF\\stirling-provisioning.json` |\n| **macOS** | `/Library/Application Support/Stirling-PDF/stirling-provisioning.json` | `~/Library/Application Support/Stirling-PDF/stirling-provisioning.json` |\n| **Linux** | `/etc/stirling-pdf/stirling-provisioning.json` | `~/.config/Stirling-PDF/stirling-provisioning.json` |\n\n---\n\n## Windows (Intune / SCCM / Group Policy)\n\nOn Windows you do not have to write the JSON by hand. The MSI installer (and `winget --custom`) accept parameters and write the system provisioning file for you during a silent install.\n\n| Parameter | Description | Example |\n|-----------|-------------|---------|\n| `STIRLING_SERVER_URL` | Server URL the app connects to | `http://192.168.1.53:8080` |\n| `STIRLING_LOCK_CONNECTION` | Lock the connection so users cannot change it (`1` = locked) | `1` |\n| `STIRLING_LOGIN_AGREEMENT` | Enable the login agreement/disclaimer dialog (`1` = enabled). The text is supplied separately; the flag alone shows nothing. | `1` |\n| `STIRLING_UPDATE_MODE` | Set and lock the update mode (`prompt`, `auto`, or `disabled`) | `disabled` |\n| `INSTALLDIR` | Custom install directory (MSI only) | `C:\\CustomPath\\Stirling-PDF` |\n| `ALLUSERS` | Install for all users (requires admin; `1`) | `1` |\n\n**MSI (msiexec):**\n```batch\nmsiexec /i \"Stirling-PDF-windows-x86_64.msi\" /qn ^\n  STIRLING_SERVER_URL=\"http://192.168.1.53:8080\" ^\n  STIRLING_LOCK_CONNECTION=1 ^\n  STIRLING_UPDATE_MODE=disabled ^\n  ALLUSERS=1\n```\n\n**winget:**\n```powershell\nwinget install StirlingTools.StirlingPDF `\n  --custom \"STIRLING_SERVER_URL=http://192.168.1.53:8080 STIRLING_LOCK_CONNECTION=1\"\n```\n\n`/qn` runs the MSI silently with no UI. The MSI is available in the [GitHub releases](https://github.com/Stirling-Tools/Stirling-PDF/releases/latest). These parameters write `%PROGRAMDATA%\\Stirling-PDF\\stirling-provisioning.json`, so the settings are applied and locked for every user on the machine.\n\n---\n\n## macOS (Jamf / MDM)\n\nWrite `stirling-provisioning.json` to the system directory and push it with your MDM (Jamf, Munki, and so on):\n\n```\n/Library/Application Support/Stirling-PDF/stirling-provisioning.json\n```\n\nFor example, to point every Mac at a self-hosted server, lock that choice, and turn updates off:\n\n```json\n{ \"serverUrl\": \"https://pdf.example.com\", \"lockConnectionMode\": true, \"updateMode\": \"disabled\" }\n```\n\n---\n\n## Linux (managed desktops)\n\nWrite the same file to the system directory:\n\n```\n/etc/stirling-pdf/stirling-provisioning.json\n```\n\nA per-user copy in `~/.config/Stirling-PDF/` is also read, but it is not locked.\n\n---\n\n## Changing or removing managed settings\n\nLocked settings can only be changed through the provisioning file. To update them, push a new `stirling-provisioning.json` (or remove it) with the same tool you used to deploy it, then have users restart the app. Removing the system file unlocks the controls again.",
+      "sourcePath": "docs/Installation/Managed Deployment.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Installation/Managed Deployment.md"
+    },
+    "installation/path-structure": {
+      "id": "installation/path-structure",
+      "title": "Path Structure",
+      "section": "installation",
+      "markdown": "## Server Deployment\nWhen running in server mode, the base path defaults to `./` (current directory)\n\n\n## Desktop Deployment\nWhen running as a desktop application (non-server deployment), the base path is set according to the operating system:\n\n- **Windows**: `%APPDATA%\\Stirling-PDF\\`\n- **macOS**: `~/Library/Application Support/Stirling-PDF/`\n- **Linux/Unix**: `~/.config/Stirling-PDF/`\n\n\n## Directory Structure\n\nAll paths below are relative to the BASE_PATH. The File.separator ensures cross-platform compatibility.\n\n## Root Directories\n- `logs/` - Application logs storage\n- `configs/` - Configuration files\n- `pipeline/` - Pipeline-related operations\n- `customFiles/` - Custom assets and templates\n- `clientWebUI/` - Web interface assets\n\n## Configuration Files\n- `configs/settings.yml` - Main settings file\n- `configs/custom_settings.yml` - User-specific settings\n\n## Pipeline Directories\n- `pipeline/watchedFolders/` - Monitored directories for automated processing\n- `pipeline/finishedFolders/` - Completed processing output location\n\n## Custom Files Structure\n- `customFiles/static/` - Static asset overrides (logos, images, favicons, etc.)\n- `customFiles/templates/` - Legacy template files (deprecated, not used)\n- `customFiles/signatures/` - Digital signature files",
+      "sourcePath": "docs/Installation/Path Structure.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Installation/Path Structure.md"
+    },
+    "installation/unix": {
+      "id": "installation/unix",
+      "title": "Unix Installation Guide",
+      "section": "installation",
+      "markdown": "## Unix Installation\n\nStirling PDF on Linux is available as a **native desktop application** or as a **server** using the JAR file.\n\n## Desktop Application (Recommended for Personal Use)\n\nNative Linux desktop app with all PDF tools available.\n\n### What You Get\n\n- ✅ **Native Linux application** - Integrated with your desktop environment\n- ✅ **Open PDFs directly** - Double-click any PDF to open in Stirling-PDF\n- ✅ **No login required** - Install and start using PDF tools right away\n- ✅ **Processes files locally** - All your PDF processing stays on your device\n- ✅ **Optional server connection** - Connect to Stirling Cloud or your own self-hosted server for advanced tools like OCR and document conversions\n- ✅ **All local tools included** - Merge, split, rotate, sign, and more work without any server\n- ✅ **Better performance** - Native Linux integration\n- ✅ **No browser needed** - Standalone application\n\n### Installation\n\nPick whichever package format matches your distribution.\n\n\n  \n    ```bash\n    wget https://files.stirlingpdf.com/linux-installer.deb\n    sudo dpkg -i linux-installer.deb\n    ```\n\n    Launch via your application menu or `stirling-pdf` from the terminal.\n  \n  \n    ```bash\n    wget https://files.stirlingpdf.com/linux-installer.rpm\n    sudo dnf install ./linux-installer.rpm\n    ```\n  \n  \n    No install required - download, mark executable, run:\n\n    ```bash\n    wget https://files.stirlingpdf.com/linux-installer.AppImage\n    chmod +x linux-installer.AppImage\n    ./linux-installer.AppImage\n    ```\n\n    If you see `fuse: device not found` on Ubuntu 22.04+, install FUSE:\n\n    ```bash\n    sudo apt-get install libfuse2\n    ```\n  \n  \n    Install via any AUR helper:\n\n    ```bash\n    paru -S stirling-pdf-desktop\n    # or: yay -S stirling-pdf-desktop\n    ```\n\n    Package: [stirling-pdf-desktop](https://aur.archlinux.org/packages/stirling-pdf-desktop).\n  \n\n\n### Connecting to a server\n\nThe desktop app works fully offline for local PDF tools like merging, splitting, rotating, and signing. If you need advanced server-side features like OCR or document format conversions, you can connect to a server at any time. See [Modes](doc:modes-and-licensing) for how each mode is licensed.\n\n**Stirling Cloud**\n- Sign in with your Stirling Cloud account\n- Gives access to advanced tools powered by server-side processing\n- See [Modes](doc:modes-and-licensing) for what this mode includes\n\n**Self-hosted Server**\n- Enter the URL of your own Stirling-PDF server instance (e.g., `http://192.168.1.53:8080`)\n- Full control over your data and processing\n- Useful for team deployments or when you want all features on your own infrastructure\n\n### Managed deployment (MDM)\n\nTo pre-configure and lock the app across managed Linux desktops - server URL, connection lock, and update behaviour - see [Managed Desktop Deployment](doc:installation/managed-deployment).\n\n---\n\n## Server Version (For Hosting and Sharing)\n\nTo run the application without Docker/Podman, you will need to manually install all dependencies and build the necessary components.\n\nNote that some dependencies might not be available in the standard repositories of all Linux distributions, and may require additional steps to install.\n\nThe following guide assumes you have a basic understanding of using a command line interface in your operating system.\n\nIt should work on most Linux distributions and MacOS. For Windows, you might need to use Windows Subsystem for Linux (WSL) for certain steps.\nThe amount of dependencies is to actually reduce overall size, ie installing LibreOffice sub components rather than full LibreOffice package.\n\nYou could theoretically use a Distrobox/Toolbox, if your Distribution has old or not all Packages. But you might just as well use the Docker Container then.\n\n### Step 1: Prerequisites\n\nInstall the following software, if not already installed:\n\n- Java 25 or later\n- Gradle 7.0 or later (included within repo so not needed on server)\n- Git\n- Python 3.8 (with pip)\n- Make\n- GCC/G++\n- Automake\n- Autoconf\n- libtool\n- pkg-config\n- zlib1g-dev\n- libleptonica-dev\n\n\n  \n    ```bash\n    sudo apt-get update\n    sudo apt-get install -y git automake autoconf libtool \\\n        libleptonica-dev pkg-config zlib1g-dev make g++ \\\n        openjdk-25-jdk python3 python3-pip\n    ```\n  \n  \n    ```bash\n    sudo dnf install -y git automake autoconf libtool \\\n        leptonica-devel pkg-config zlib-devel make gcc-c++ \\\n        java-25-openjdk python3 python3-pip\n    ```\n  \n  \n    ```bash\n    nix-channel --update\n    nix-env -iA nixpkgs.jdk25 nixpkgs.git nixpkgs.python38 \\\n        nixpkgs.gnumake nixpkgs.libgcc nixpkgs.automake \\\n        nixpkgs.autoconf nixpkgs.libtool nixpkgs.pkg-config \\\n        nixpkgs.zlib nixpkgs.leptonica\n    ```\n  \n\n\n### Step 2: Clone and Build jbig2enc (Only required for certain OCR functionality)\n\n\n  \n    ```bash\n    mkdir ~/.git\n    cd ~/.git &&\\\n    git clone https://github.com/agl/jbig2enc.git &&\\\n    cd jbig2enc &&\\\n    ./autogen.sh &&\\\n    ./configure &&\\\n    make &&\\\n    sudo make install\n    ```\n  \n  \n    ```bash\n    mkdir ~/.git\n    cd ~/.git &&\\\n    git clone https://github.com/agl/jbig2enc.git &&\\\n    cd jbig2enc &&\\\n    ./autogen.sh &&\\\n    ./configure &&\\\n    make &&\\\n    sudo make install\n    ```\n  \n  \n    ```bash\n    nix-env -iA nixpkgs.jbig2enc\n    ```\n  \n\n\n### Step 3: Install Additional Software\n\nNext we need to install LibreOffice for conversions, tesseract for OCR, and opencv for pattern recognition functionality.\n\nInstall the following software:\n\n- libreoffice (libreoffice-core libreoffice-common libreoffice-writer libreoffice-calc libreoffice-impress)\n- python3-uno\n- unoserver\n- pngquant\n- tesseract\n- opencv-python-headless\n\n\n  \n    ```bash\n    sudo apt-get install -y libreoffice-writer libreoffice-calc libreoffice-impress tesseract-ocr\n    pip3 install uno opencv-python-headless unoserver pngquant WeasyPrint --break-system-packages\n    ```\n  \n  \n    ```bash\n    sudo dnf install -y libreoffice-writer libreoffice-calc libreoffice-impress tesseract\n    pip3 install uno opencv-python-headless unoserver pngquant WeasyPrint\n    ```\n  \n  \n    ```bash\n    nix-env -iA nixpkgs.libreoffice nixpkgs.tesseract nixpkgs.poppler_utils\n    pip3 install uno opencv-python-headless unoserver pngquant WeasyPrint\n    ```\n  \n\n\n### Step 4: Grab latest Stirling PDF Jar\n\nStirling PDF comes in three different JAR files:\n\n**Stirling-PDF-with-login.jar** (Recommended - Full Features):\n- Download: [Stirling-PDF-with-login.jar](https://files.stirlingpdf.com/Stirling-PDF-with-login.jar)\n- Bundles frontend UI + backend server in one file\n- **Includes authentication and additional features** - requires user login (default credentials: `admin` / `stirling`)\n- **Recommended for all users** - personal, shared, or enterprise deployments\n\n**Stirling-PDF.jar** (Plain JAR - Basic Features):\n- Download: [Stirling-PDF.jar](https://files.stirlingpdf.com/Stirling-PDF.jar)\n- Bundles frontend UI + backend server in one file\n- **Basic version** - no authentication, core features only\n- Only use if you require no login at all and don't mind missing certain features\n\n**Stirling-PDF-server.jar** (Backend Only - **Advanced**):\n- Download: [Stirling-PDF-server.jar](https://files.stirlingpdf.com/Stirling-PDF-server.jar)\n- Backend server only (no bundled UI)\n- **No authentication** - API access only\n- For desktop app backend, custom frontend, or API integrations\n\nExample download and setup:\n\n```bash\nsudo wget https://files.stirlingpdf.com/Stirling-PDF.jar\nsudo chmod +x Stirling-PDF.jar\n```\n\n### Step 4b: Clone the Stirling-PDF Repository\n\nYou need the repository to get the `scripts` folder, which contains Python scripts used by OpenCV for certain PDF operations.\n\n```bash\ngit clone https://github.com/Stirling-Tools/Stirling-PDF.git\n```\n\n### Step 5: Move JAR and Scripts to Desired Location\n\nMove the downloaded JAR file and the `scripts` folder from the cloned repository to a desired location, for example, `/opt/Stirling-PDF/`.\nThe `scripts` folder is required for the Python scripts using OpenCV.\n\n\n  \n    ```bash\n    sudo mkdir -p /opt/Stirling-PDF &&\\\n    sudo mv Stirling-PDF.jar /opt/Stirling-PDF/ &&\\\n    sudo cp -r Stirling-PDF/scripts /opt/Stirling-PDF/ &&\\\n    echo \"JAR and scripts installed.\"\n    ```\n  \n  \n    ```bash\n    sudo mkdir -p /opt/Stirling-PDF &&\\\n    sudo mv Stirling-PDF.jar /opt/Stirling-PDF/ &&\\\n    sudo cp -r Stirling-PDF/scripts /opt/Stirling-PDF/ &&\\\n    echo \"JAR and scripts installed.\"\n    ```\n  \n  \n    ```bash\n    mkdir -p ~/Stirling-PDF &&\\\n    mv Stirling-PDF.jar ~/Stirling-PDF/ &&\\\n    cp -r Stirling-PDF/scripts ~/Stirling-PDF/\n    ```\n  \n\n\n### Step 6: OCR Language Support\n\nIf you plan to use the OCR (Optical Character Recognition) functionality, you might need to install language packs for Tesseract if running non-english scanning.\n\n\n  \n    ```bash\n    sudo apt update &&\\\n    # All languages\n    # sudo apt install -y 'tesseract-ocr-*'\n\n    # Find languages:\n    apt search tesseract-ocr-\n    \n    # View installed languages:\n    dpkg-query -W tesseract-ocr- | sed 's/tesseract-ocr-//g'\n    ```\n  \n  \n    ```bash\n    # All languages\n    # sudo dnf install -y tesseract-langpack-*\n\n    # Find languages:\n    dnf search -C tesseract-langpack-\n    \n    # View installed languages:\n    rpm -qa | grep tesseract-langpack | sed 's/tesseract-langpack-//g'\n    ```\n  \n  \n    ```bash\n    nix-env -iA nixpkgs.tesseract\n    ```\n    Note: Nix Package Manager pre-installs almost all the language packs when tesseract is installed.\n  \n  \n    1. Download the desired language pack(s) by selecting the `.traineddata` file(s) for the language(s) you need.\n    2. Place the `.traineddata` files in the Tesseract tessdata directory: `/usr/share/tessdata`\n    3. Please view [tesseract install guide](https://tesseract.readthedocs.io/en/latest/installation.html) for more info.\n\n    **IMPORTANT:** DO NOT REMOVE EXISTING `eng.traineddata`, IT'S REQUIRED.\n\n  \n\n\n### Step 7: Run Stirling PDF\n\n\n  \n    ```bash\n    java -jar /opt/Stirling-PDF/Stirling-PDF-*.jar\n    ```\n  \n  \n    ```bash\n    java -jar /opt/Stirling-PDF/Stirling-PDF-*.jar\n    ```\n  \n  \n    ```bash\n    java -jar /opt/Stirling-PDF/Stirling-PDF-*.jar\n    ```\n  Since libreoffice, soffice, and conversion tools have their dbus_tmp_dir set as `dbus_tmp_dir=\"/run/user/$(id -u)/libreoffice-dbus\"`, you get the following error:\n  `[Thread-7] INFO  s.s.SPDF.utils.ProcessExecutor - mkdir: cannot create directory '/run/user/1501': Permission denied`\n  To resolve this, use:\n  `bash\n      mkdir temp\n      export DBUS_SESSION_BUS_ADDRESS=\"unix:path=./temp\"\n    `\n  \n\n\n### Step 8: Adding a Desktop Icon\n\nThis will add a modified Appstarter to your Appmenu.\n\n```bash\nlocation=$(pwd)/gradlew\nimage=$(pwd)/docs/stirling.svg\n\ncat > ~/.local/share/applications/Stirling-PDF.desktop <<EOF\n[Desktop Entry]\nName=Stirling PDF;\nGenericName=Launch StirlingPDF and open its WebGUI;\nCategory=Office;\nExec=xdg-open http://localhost:8080 && nohup $location java -jar /opt/Stirling-PDF/Stirling-PDF-*.jar &;\nIcon=$image;\nKeywords=pdf;\nType=Application;\nNoDisplay=false;\nTerminal=true;\nEOF\n```\n\nNote: Currently the app will run in the background until manually closed.\n\n### Optional: Changing the Host and Port\n\nTo override the default configuration, you can add the following to the `configs/custom_settings.yml` file inside your install directory (for example, `/opt/Stirling-PDF/configs/custom_settings.yml`):\n\n```yaml\nserver:\n  host: 0.0.0.0\n  port: 3000\n```\n\nFor systemd add in the .env file (see run as service for setting environment variables):\n\n```bash\nSERVER_HOST=\"0.0.0.0\"\nSERVER_PORT=\"3000\"\n```\n\n**Note:** The file `custom_settings.yml` is created after the first application launch. To have it before that, you can create the directory and add the file yourself.\n\n### Optional: Run Stirling PDF as a service (requires root).\n\nFirst create a .env file, where you can store environment variables:\n\n```\ntouch /opt/Stirling-PDF/.env\n```\n\nIn this file you can add all variables, one variable per line, as stated in the main readme (for example SYSTEM_DEFAULTLOCALE=\"de-DE\").\n\nCreate a new file where we store our service settings and open it with nano editor:\n\n```\nnano /etc/systemd/system/stirlingpdf.service\n```\n\nPaste this content, make sure to update the filename of the jar-file. Press Ctrl+S and Ctrl+X to save and exit the nano editor:\n\n```\n[Unit]\nDescription=Stirling-PDF service\nAfter=syslog.target network.target\n\n[Service]\nSuccessExitStatus=143\n\nUser=root\nGroup=root\n\nType=simple\n\nEnvironmentFile=/opt/Stirling-PDF/.env\nWorkingDirectory=/opt/Stirling-PDF\nExecStart=/usr/bin/java -jar Stirling-PDF-*.jar\nExecStop=/bin/kill -15 $MAINPID\n\n[Install]\nWantedBy=multi-user.target\n```\n\nNotify systemd that it has to rebuild its internal service database (you have to run this command every time you make a change in the service file):\n\n```\nsudo systemctl daemon-reload\n```\n\nEnable the service to tell the service to start it automatically:\n\n```\nsudo systemctl enable stirlingpdf.service\n```\n\nSee the status of the service:\n\n```\nsudo systemctl status stirlingpdf.service\n```\n\nManually start/stop/restart the service:\n\n```\nsudo systemctl start stirlingpdf.service\nsudo systemctl stop stirlingpdf.service\nsudo systemctl restart stirlingpdf.service\n```\n\n### Starting unoserver alongside Stirling PDF\n\nTo ensure that unoserver is running alongside Stirling PDF, you need to start it with the following command:\n\n```bash\nunoserver --port 2003 --interface 0.0.0.0\n```\n\nYou can add this command to your startup script or systemd service file to ensure it starts automatically with Stirling PDF.\n\n### Customizing Paths in settings.yml\n\nIf the install path is different, it can be customized in `settings.yml`:\n\n```yaml\nsystem:\n  customPaths:\n    pipeline:\n      watchedFoldersDir: \"\" #Defaults to /pipeline/watchedFolders\n      finishedFoldersDir: \"\" #Defaults to /pipeline/finishedFolders\n    operations:\n      weasyprint: \"\" #Defaults to /opt/venv/bin/weasyprint\n      unoconvert: \"\" #Defaults to /opt/venv/bin/unoconvert\n```",
+      "sourcePath": "docs/Installation/Unix.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Installation/Unix.md"
+    },
+    "installation/versions": {
+      "id": "installation/versions",
+      "title": "Versions",
+      "section": "installation",
+      "markdown": "## Versions of Stirling PDF\n\nStirling PDF is available in several formats, each catering to different needs and use cases:\n\n## Docker Versions\nFor server deployments, we offer three pre-configured Docker images:\n- ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/stirlingtools/stirling-pdf/latest-fat?label=Stirling-PDF%20Fat)\n- ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/stirlingtools/stirling-pdf/latest?label=Stirling-PDF%20Full)\n- ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/stirlingtools/stirling-pdf/latest-ultra-lite?label=Stirling-PDF%20Ultra-Lite)\n\n- **Fat**: Includes all Full features plus additional fonts and pre-bundled jar security version\n- **Full**: All features pre-configured and ready to use\n- **Ultra-Lite**: Minimal installation with core features only\n\n\n## Desktop Versions (Windows & Unix)\nThe desktop versions of Stirling PDF use a dynamic feature system. They start with Ultra-Lite features as the base and automatically enable additional functionality based on installed dependencies:\n\nBase Features (Ultra-Lite):\n- Core PDF operations (merge, split, rotate, etc.)\n- Basic conversions\n- Password protection\n- All features marked with ✔️ in the Ultra-Lite column below\n\nAdditional features become available automatically when you install:\n- LibreOffice: Enables document format conversions (PDF to Word, Excel, etc.)\n- Tesseract: Enables OCR functionality\n- QPDF: Enables compression and repair features\n- Other dependencies: Enable their respective features\n\n\n## Feature Comparison\n\nFor the desktop app, the **Ultra-Lite** column below lists the tools that run locally and fully offline on the bundled backend. The **Full-only** tools (OCR, Office conversions, and other tools that depend on external binaries) require a connected server - either Stirling Cloud or your own self-hosted server.\n\nHere are the different technologies each version uses:\n\n| Technology     | Ultra-Lite | Full |\n|----------------|:----------:|:----:|\n| Java           |     ✔️      |  ✔️  |\n| JavaScript     |     ✔️      |  ✔️  |\n| Libre          |            |  ✔️  |\n| Python         |            |  ✔️  |\n| OpenCV         |            |  ✔️  |\n| Tesseract       |            |  ✔️  |\n\nAnd here you see what functions are offered as part of each.\n\nOperation                | Ultra-Lite | Full\n-------------------------|------------|-----\nadd-page-numbers         |     ✔️      |  ✔️\nadd-password             |     ✔️      |  ✔️\nadd-image                |     ✔️      |  ✔️\nadd-watermark            |     ✔️      |  ✔️\nadjust-contrast          |     ✔️      |  ✔️\nauto-split-pdf           |     ✔️      |  ✔️\nauto-redact              |     ✔️      |  ✔️\nauto-rename              |     ✔️      |  ✔️\ncert-sign                |     ✔️      |  ✔️\ncrop                     |     ✔️      |  ✔️\nchange-metadata          |     ✔️      |  ✔️\nchange-permissions       |     ✔️      |  ✔️\ncompare                  |     ✔️      |  ✔️\nextract-page             |     ✔️      |  ✔️\nextract-images           |     ✔️      |  ✔️\nflatten                  |     ✔️      |  ✔️\nget-info-on-pdf          |     ✔️      |  ✔️\nimg-to-pdf               |     ✔️      |  ✔️\nmarkdown-to-pdf          |     ✔️      |  ✔️\nmerge-pdfs               |     ✔️      |  ✔️\nmulti-page-layout        |     ✔️      |  ✔️\noverlay-pdf              |     ✔️      |  ✔️\npdf-organizer            |     ✔️      |  ✔️\npdf-to-csv               |     ✔️      |  ✔️\npdf-to-img               |     ✔️      |  ✔️\npdf-to-single-page       |     ✔️      |  ✔️\nremove-blanks            |     ✔️      |  ✔️\nremove-pages             |     ✔️      |  ✔️\nremove-password          |     ✔️      |  ✔️\nrotate-pdf               |     ✔️      |  ✔️\nsanitize-pdf             |     ✔️      |  ✔️\nscale-pages              |     ✔️      |  ✔️\nsign                     |     ✔️      |  ✔️\nshow-javascript          |     ✔️      |  ✔️\nsplit-by-size-or-count   |     ✔️      |  ✔️\nsplit-pdf-by-sections    |     ✔️      |  ✔️\nsplit-pdfs               |     ✔️      |  ✔️\ncompress-pdf             |            |  ✔️\nextract-image-scans      |            |  ✔️\nocr-pdf                  |            |  ✔️\npdf-to-pdfa              |            |  ✔️\npdf-to-text             |     ✔️      |  ✔️\npdf-to-html             |            |  ✔️\npdf-to-word             |            |  ✔️\npdf-to-presentation     |            |  ✔️\npdf-to-xml              |            |  ✔️\nremove-annotations      |     ✔️      |  ✔️\nremove-cert-sign        |     ✔️      |  ✔️\nremove-image-pdf        |     ✔️      |  ✔️\nfile-to-pdf             |            |  ✔️\nxlsx-to-pdf             |            |  ✔️\nhtml-to-pdf             |            |  ✔️\nurl-to-pdf              |            |  ✔️\nrepair                  |            |  ✔️",
+      "sourcePath": "docs/Installation/Versions.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Installation/Versions.md"
+    },
+    "installation/windows": {
+      "id": "installation/windows",
+      "title": "Windows Guide",
+      "section": "installation",
+      "markdown": "## Windows Installation Guide for Stirling PDF\n\nStirling PDF for Windows comes in two versions: a **Desktop Application** for personal use and a **Server Version** for hosting and sharing with others.\n\n## Desktop Application (Recommended for Personal Use)\n\n**V2.0 brings a native Windows desktop experience** with all PDF tools available offline!\n\n### What You Get\n\n- ✅ **Native Windows application** - Feels like a built-in Windows program\n- ✅ **Open PDFs directly** - Double-click any PDF to open in Stirling PDF\n- ✅ **No login required** - Install and start using PDF tools right away\n- ✅ **Processes files locally** - All your PDF processing stays on your device\n- ✅ **Optional server connection** - Connect to Stirling Cloud or your own self-hosted server for advanced tools like OCR and document conversions\n- ✅ **All local tools included** - Merge, split, rotate, sign, and more work without any server\n- ✅ **Automatic updates** - Stay current with latest features\n- ✅ **Better performance** - Optimized for Windows\n- ✅ **No browser needed** - Standalone application\n\n### Installation\n\nPick whichever method you prefer. All three install the same desktop app.\n\n\n  \n    1. Download: [Stirling PDF Desktop Installer](https://files.stirlingpdf.com/win-installer.exe)\n    2. Run the installer and follow the prompts (installs to `C:\\Program Files\\Stirling-PDF`)\n    3. Launch from the Start Menu - search for \"Stirling PDF\"\n\n    For unattended deployments with a pre-configured server URL, see [Automated Installation](#automated-installation) below.\n  \n  \n    ```powershell\n    winget install StirlingTools.StirlingPDF\n    ```\n\n    For unattended deployments with a pre-configured server URL, see [Automated Installation](#automated-installation) below.\n  \n  \n    ```powershell\n    scoop bucket add stirling-pdf https://github.com/Stirling-Tools/homebrew-stirling-pdf\n    scoop install stirling-pdf/stirling-pdf\n    ```\n\n    Updates come through automatically on new releases:\n\n    ```powershell\n    scoop update stirling-pdf\n    ```\n  \n\n\n### Connecting to a server\n\nThe desktop app works fully offline for local PDF tools like merging, splitting, rotating, and signing. If you need advanced server-side features like OCR or document format conversions, you can pick one of three connection modes. See [Modes](doc:modes-and-licensing) for how each mode is licensed.\n\n**Built-in local processing (default)**\n- The desktop app runs its own Stirling PDF server on your machine, no setup or login\n- All processing stays on your device and works without internet\n\n**Stirling Cloud**\n- Sign in with your Stirling Cloud account\n- Gives access to advanced tools powered by server-side processing\n- See [Modes](doc:modes-and-licensing) for what this mode includes\n\n**Self-hosted Server**\n- Enter the URL of your own Stirling PDF server instance (e.g., `http://192.168.1.53:8080`)\n- Full control over your data and processing\n- Useful for team deployments or when you want all features on your own infrastructure\n\n### Using the Desktop App\n\n**Opening PDFs:**\n- **Double-click any PDF file** - Opens in Stirling PDF\n- **Right-click → Open with → Stirling PDF**\n- **Drag and drop** files into the application\n- **File → Open** from the menu\n\n**Making Stirling PDF your default PDF viewer:**\n1. Right-click any PDF file\n2. Select \"Open with\" → \"Choose another app\"\n3. Select \"Stirling PDF\"\n4. Check \"Always use this app to open .pdf files\"\n5. Click OK\n\n**Benefits of desktop app:**\n- Files stay on your computer (not in browser storage)\n- Work without internet connection\n- Faster performance\n- Unlimited file storage (not limited by browser)\n\n**Multiple windows:**\n- Press **Ctrl+N** to open an empty new window\n- Use **Open in new window** from the My Files page to open files in a separate window\n\n### Software Updates\n\nThe desktop app keeps itself current. Open **Settings → Software Updates** to check for updates and choose how they are applied. The update behaviour is controlled by the `update_mode` setting, which has three values:\n\n| Mode | Behaviour |\n|------|-----------|\n| `prompt` | Default. Shows the update popup and lets you decide when to install |\n| `auto` | Silently downloads, installs, and restarts on startup |\n| `disabled` | Never checks for updates or shows update UI |\n\nWhen the mode is set by an administrator through a provisioning file (see [Managed Desktop Deployment](doc:installation/managed-deployment)), the Software Updates control is locked and shows **\"Managed by administrator\"** so users cannot change it.\n\n### Automated Installation\n\nFor silent or headless installs and pre-configuring the app for managed fleets - server URL, connection lock, and update mode via MSI or `winget` parameters, or a provisioning file - see [Managed Desktop Deployment](doc:installation/managed-deployment).\n\n### Desktop app troubleshooting\n\n- **App shows in Task Manager but no window appears** - The desktop app renders its UI using the Microsoft Edge WebView2 Runtime. If the process is running but nothing is displayed, install the [Microsoft Edge WebView2 Runtime](https://developer.microsoft.com/en-us/microsoft-edge/webview2/) and launch the app again.\n- **Connecting to a self-hosted server** - Use your backend server URL (for example `http://192.168.1.53:8080`). To verify the server is reachable, open `http://<server>:<port>/api/v1/info/status` in a browser - it should return JSON with a status of `UP`.\n\n## Server Version (For Hosting and Sharing)\n\nWant to host Stirling PDF on a Windows server for multiple users? Use the server version.\n\n### Server Downloads\n\nStirling PDF comes in three different JAR files:\n\n**Stirling-PDF-with-login.jar** (Recommended - Full Features):\n- Download: [Stirling-PDF-with-login.jar](https://files.stirlingpdf.com/Stirling-PDF-with-login.jar)\n- Bundles frontend UI + backend server in one file\n- **Includes authentication and additional features** - requires user login (default credentials: `admin` / `stirling`)\n- **Recommended for all users** - personal, shared, or enterprise deployments\n\n**Stirling-PDF.jar** (Plain JAR - Basic Features):\n- Download: [Stirling-PDF.jar](https://files.stirlingpdf.com/Stirling-PDF.jar)\n- Bundles frontend UI + backend server in one file\n- **Basic version** - no authentication, core features only\n- Only use if you require no login at all and don't mind missing certain features\n\n**Stirling-PDF-server.jar** (Backend Only - **Advanced**):\n- Download: [Stirling-PDF-server.jar](https://files.stirlingpdf.com/Stirling-PDF-server.jar)\n- Backend server only (no bundled UI)\n- **No authentication** - API access only\n- For desktop app backend, custom frontend, or API integrations\n\n**Required:** [Java JDK 25 (Temurin 25)](https://adoptium.net/temurin/releases/?version=25&os=windows) - Server versions need Java installed\n\n### Server Installation Steps\n\n1. **Install Java JDK 25** from the link above\n2. **Download** your preferred JAR file\n3. **Run the JAR file:**\n   ```bash\n   java -jar Stirling-PDF.jar\n   ```\n4. **Access** via browser at `http://localhost:8080`\n5. **Share the URL** with users on your network (e.g., `http://your-server-ip:8080`)\n\n### Optional Dependencies\nThese dependencies enable additional features in Stirling PDF. Install only the ones you need:\n\n#### Python and Related Tools\nPython and its related tools enable various features in Stirling PDF:\n- OpenCV: Enables image scan extraction features\n- Unoserver: Enables file to PDF conversion features\n- Python: Required base for OpenCV and other Python-based features\n\n1. Python Installation:\n   - Download Python from [Python's official site](https://www.python.org/downloads/)\n   - **Recommended version:** install **Python 3.11.x**. Python 3.12 and newer can break the unoserver/unoconv LibreOffice conversion path, so 3.11 is the safe choice.\n   - During installation, **IMPORTANT**: Check \"Add Python to PATH\"\n   - Verify installation by opening Command Prompt and running:\n     ```bash\n     python --version\n     ```\n\n2. OpenCV Installation:\n   - After Python is installed, open Command Prompt as administrator\n   - Install OpenCV by running:\n     ```bash\n     pip install opencv-python\n     ```\n   - Verify installation:\n     ```bash\n     python -c \"import cv2\"\n     ```\n   - Enables the Detect & Split Scanned Photos operation\n     \n3. Unoserver Installation:\n   - First install LibreOffice (see LibreOffice section below)\n   - Open Command Prompt as administrator\n   - Install unoserver:\n     ```bash\n     pip install unoserver\n     ```\n   - Verify installation:\n     ```bash\n     unoserver --version\n     ```\n   - Enables File To PDF operation\n   Note: Unoserver requires both Python and LibreOffice to function properly\n\n#### QPDF\n- Download from [QPDF's official site](https://qpdf.sourceforge.io/)\n- Enables PDF compression and other operations\n\n#### LibreOffice\n- Download and install from [LibreOffice's official site](https://www.libreoffice.org/download/download-libreoffice/)\n- Enables PDF to DOCX conversion and other document format conversions\n\n#### Tesseract OCR\n1. Download the installer from [UB Mannheim's GitHub](https://github.com/UB-Mannheim/tesseract/wiki)\n2. During installation, check additional languages you need\n3. Add to settings.yml in your Stirling PDF installation directory:\n   ```yaml\n   system:\n     tessdataDir: C:\\\\Program Files\\\\Tesseract-OCR\\\\tessdata\n   ```\n- Enables OCR functionality for PDFs\n\n#### Weasyprint\n1. Download from [Weasyprint's releases](https://github.com/Kozea/WeasyPrint/releases)\n2. Create a directory (e.g., `c:\\weasyprint\\`) and place weasyprint.exe there\n- Enables URL to PDF conversion\n- Note: Some antivirus software may flag weasyprint.exe - you may need to whitelist it\n\n#### PDFtoHTML\n1. Download from [SourceForge](https://sourceforge.net/projects/pdftohtml/)\n2. Create a directory (e.g., `c:\\pdftohtml\\`) and place pdftohtml.exe there\n- Enables PDF to HTML conversion\n\n## Adding Directories to System PATH\n\nAfter installing dependencies, you'll need to add their directories to your system's PATH. Here's how:\n\n1. Open Windows Search (Windows key + S)\n2. Type \"Environment Variables\" and click \"Edit the system environment variables\"\n3. Click \"Environment Variables\" button at the bottom\n4. Under \"System variables\", find and select \"Path\"\n5. Click \"Edit\"\n6. Click \"New\" to add each required path:\n   - For Python: Should be added automatically during installation if \"Add Python to PATH\" was checked\n   - For LibreOffice: `C:\\Program Files\\LibreOffice\\program`\n   - For Tesseract: `C:\\Program Files\\Tesseract-OCR`\n   - For Weasyprint: `C:\\weasyprint` (or your chosen directory)\n   - For PDFtoHTML: `C:\\pdftohtml` (or your chosen directory)\n   - For QPDF: The installation directory (usually `C:\\Program Files\\qpdf\\bin`)\n7. Click \"OK\" on all windows to save changes\n\n## Server Installation Steps\n\n1. Download the latest Stirling PDF JAR from the [releases page](https://github.com/Stirling-Tools/Stirling-PDF/releases/latest)\n2. Install any desired optional dependencies following the instructions above\n3. Launch the JAR with `java -jar Stirling-PDF.jar`\n4. Access the web interface through your browser. The application prints the URL in the console logs, normally http://localhost:8080\n\n## Notes\n- The application hosts a web server that is accessible to anyone on your network\n- If you install multiple Python-based dependencies, ensure they're using the same Python installation to avoid conflicts\n- Make sure to restart Stirling PDF after installing new dependencies or modifying PATH variables\n- Some features will be unavailable until their required dependencies are installed\n\n## Troubleshooting\n\n1. Verifying PATH Settings:\n   - Open Command Prompt (cmd)\n   - Type `echo %PATH%` to see all directories in your PATH\n   - For each dependency, try running its command to verify it's accessible:\n     ```bash\n     python --version\n     unoserver --version\n     python -c \"import cv2\"\n     tesseract --version\n     ```\n\n2. Common Issues:\n   - If changes to PATH don't take effect, try:\n     - Logging out and back in\n     - Restarting your computer\n     - Opening a new Command Prompt window\n   - If a dependency isn't found, double-check the exact path in File Explorer\n   - For Tesseract issues, verify the tessdata directory contains language files\n   - For LibreOffice conversions, ensure no LibreOffice windows are open when converting\n   - For Python/OpenCV issues:\n     - Make sure pip is up to date: `python -m pip install --upgrade pip`\n     - Try installing with administrator privileges\n     - Check if Python is properly added to PATH\n   - For unoserver issues:\n     - Verify both Python and LibreOffice are properly installed\n     - Make sure LibreOffice is in PATH\n     - Try running LibreOffice once before using unoserver\n\n## Starting unoserver alongside Stirling PDF\n\nTo ensure that unoserver is running alongside Stirling PDF, you need to start it with the following command:\n\n```bash\nunoserver --port 2003 --interface 0.0.0.0\n```\n\nYou can add this command to your startup script or systemd service file to ensure it starts automatically with Stirling PDF.\n\n\nNeed help? Visit the [Stirling PDF GitHub Issues](https://github.com/Stirling-Tools/Stirling-PDF/issues) page.",
+      "sourcePath": "docs/Installation/Windows.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Installation/Windows.md"
+    },
+    "migration/breaking-changes": {
+      "id": "migration/breaking-changes",
+      "title": "Breaking Changes in V2",
+      "description": "Important changes that may affect your V2 upgrade",
+      "section": "migration",
+      "markdown": "Most V1 deployments will upgrade smoothly to V2, but there are some important changes you should know about. This page documents breaking changes and how to handle them.\n\n---\n\n## ⚠️ Impact Summary\n\n| Change | Impact | Action Required |\n|--------|--------|-----------------|\n| **Template Customization** | High | Rewrite customizations |\n| **UI Settings Location** | Medium | Use in-app settings |\n| **Session Management** | Low | Update setting names |\n| **Database Notifications** | Low | Use audit logs instead |\n\n---\n\n## 🎨 UI Customization Architecture Changed\n\n**Impact:** HIGH for users who customized UI using `customFiles/templates/`\n\n### What Changed\n\n**V1 Architecture:**\n```bash\ncustomFiles/\n  └── templates/\n      ├── fragments/\n      │   └── navbar.html       # Custom Thymeleaf template\n      └── home.html             # Custom Thymeleaf template\n```\n\nV1 used **server-side rendering** with Thymeleaf templates. HTML was generated dynamically on the server for each request.\n\n**V2 Architecture:**\nV2 uses a **React frontend** with client-side rendering. The UI is built into **static files** (HTML, CSS, JavaScript) that are served to the browser.\n\n**What this means:**\n- ❌ Thymeleaf templates (`.html` with `th:*` attributes) no longer work because there's no server-side rendering\n- ✅ Static file overrides **still work** via `customFiles/static/` - same concept, different paths\n- The file paths are different because they're now built React files instead of Thymeleaf templates\n\n### Migration Path\n\nYour V1 Thymeleaf templates cannot be directly reused in V2, but you have three options:\n\n#### Option 1: Use Built-In Customization (Recommended)\n\nV2 provides in-app settings for most common customizations:\n\n**Available Customizations:**\n- App name and description\n- Navbar branding\n- Logo style (classic/modern)\n- Custom logo upload\n- Homepage description\n\n**How to use:**\n1. Enable login: `SECURITY_ENABLELOGIN=true`\n2. Log in as admin\n3. Go to Settings → UI\n4. Configure branding there\n\n**Learn more:** [UI Customisation](doc:configuration/ui-customisation)\n\n#### Option 2: Static File Overrides (Same Concept as V1, Different Paths)\n\n**✅ Still supported in V2!** The static file override system works the same way conceptually - place files in `customFiles/static/` to override defaults.\n\n**How it works:**\n1. V2 checks `customFiles/static/` **first** for any requested file\n2. If not found, falls back to the bundled static files\n3. This lets you override logos, CSS, HTML, JavaScript, or any other static asset\n\n**Example Docker compose:**\n```yaml\nvolumes:\n  - ./customFiles:/customFiles:rw\n```\n\n**Key difference from V1:**\n- V1 paths: `customFiles/templates/fragments/navbar.html` (Thymeleaf)\n- V2 paths: `customFiles/static/index.html` (React build output)\n\nThe file paths are different because V2 serves the **compiled React app** instead of Thymeleaf templates. See [Other Customisations - Static File Overrides](doc:configuration/other-customisations) for:\n- How to determine the correct file paths in V2\n- Examples of common customizations\n- Understanding the build output structure\n\n**Use cases:**\n- Custom favicon or logo\n- Modified `index.html` for advanced branding\n- Custom CSS to override styles\n- Additional static assets\n\n#### Option 3: Fork the Frontend (Advanced)\n\nFor complete UI customization:\n\n**Steps:**\n1. Fork Stirling PDF repository\n2. Modify React components in `frontend/src/`\n3. Build custom frontend\n4. Deploy in split mode with custom frontend\n\n**Trade-offs:**\n- ✅ Complete control\n- ❌ Must maintain your fork\n- ❌ Manual merges for updates\n\n### What No Longer Works\n\nThese V1 **Thymeleaf template features** no longer work because V2 uses React (client-side) instead of Thymeleaf (server-side):\n\n```html\n<!-- V1: Thymeleaf fragment injection (NO LONGER WORKS) -->\n<div th:replace=\"fragments/navbar :: navbar\"></div>\n\n<!-- V1: Thymeleaf conditionals (NO LONGER WORKS) -->\n<div th:if=\"${@propertyService.get('ui.showAdvanced')}\">\n  Custom content\n</div>\n\n<!-- V1: Thymeleaf variables (NO LONGER WORKS) -->\n<span th:text=\"${appName}\"></span>\n```\n\n**Why they don't work:** These are Thymeleaf-specific features that require server-side HTML generation. V2 uses React which compiles to static JavaScript that runs in the browser.\n\n**Alternative:** You can still customize the **output** by overriding the built static files in `customFiles/static/`, but you'll be editing the compiled HTML/CSS/JS instead of Thymeleaf templates.\n\n---\n\n## ⚙️ UI Settings Moved to In-App Configuration\n\n**Impact:** MEDIUM - Settings moved, but easy to reconfigure\n\n### What Changed\n\n**V1 Configuration:**\n```yaml\nui:\n  appName: 'My PDF Tool'\n  homeDescription: 'Welcome to our PDF service!'\n```\n\n**V2 Configuration:**\n```yaml\nui:\n  appNameNavbar: 'My PDF Tool'  # Still in YAML\n  # appName and homeDescription REMOVED\n  # Configure these in-app instead\n```\n\n### Why the Change\n\n**Benefits:**\n- ✅ No container restart needed\n- ✅ Visual interface with preview\n- ✅ Validation prevents errors\n- ✅ Changes apply immediately\n- ✅ Role-based access control\n\n### Migration Steps\n\n1. **Note your current settings:**\n   ```yaml\n   # From V1 settings.yml\n   ui:\n     appName: 'CompanyName PDF'\n     homeDescription: 'Internal document processing'\n   ```\n\n2. **Remove from settings.yml:**\n   ```yaml\n   ui:\n     appNameNavbar: 'CompanyName PDF'\n     # appName - REMOVE THIS LINE\n     # homeDescription - REMOVE THIS LINE\n   ```\n\n3. **Configure in UI:**\n   - Enable login: `SECURITY_ENABLELOGIN=true`\n   - Start V2\n   - Log in as admin\n   - Go to Settings → UI\n   - Enter app name and description\n   - Save\n\n### Environment Variables\n\nThese environment variables **no longer work**:\n\n```bash\n# V1 (NO LONGER WORKS)\nUI_APPNAME=\"My PDF Tool\"\nUI_HOMEDESCRIPTION=\"Welcome!\"\n\n# V2 (USE IN-APP SETTINGS INSTEAD)\n# Set through UI after logging in\n```\n\n`UI_APPNAMENAVBAR` still works for navbar branding.\n\n---\n\n## 🔐 Session Management Improvements\n\n**Impact:** LOW - New session features with simple setting updates\n\n### What Changed\n\nSession management enhanced with new JWT-based features and improved settings:\n\n| V1 Setting | V2 Setting | Change |\n|------------|------------|--------|\n| `jwt.enabled` | `jwt.persistence` | Renamed |\n| `jwt.keyCleanup` | `jwt.enableKeyCleanup` | Renamed |\n| `jwt.secureCookie` | _(removed)_ | Always secure now |\n| _(new)_ | `jwt.enableKeyRotation` | New feature |\n| _(new)_ | `jwt.keyRetentionDays` | New feature |\n\n### Migration\n\n**V1 Configuration:**\n```yaml\nsecurity:\n  jwt:\n    enabled: false\n    keyCleanup: false\n    secureCookie: true\n```\n\n**V2 Configuration:**\n```yaml\nsecurity:\n  jwt:\n    persistence: true           # was 'enabled'\n    enableKeyCleanup: true      # was 'keyCleanup'\n    enableKeyRotation: true     # NEW\n    keyRetentionDays: 7         # NEW\n    # secureCookie REMOVED\n```\n\n### Environment Variables\n\n**V1 (NO LONGER WORKS):**\n```bash\nSECURITY_JWT_ENABLED=false\nSECURITY_JWT_KEYCLEANUP=false\nSECURITY_JWT_SECURECOOKIE=true\n```\n\n**V2 (USE THESE):**\n```bash\nSECURITY_JWT_PERSISTENCE=true\nSECURITY_JWT_ENABLEKEYCLEANUP=true\nSECURITY_JWT_ENABLEKEYROTATION=true\nSECURITY_JWT_KEYRETENTIONDAYS=7\n```\n\n### After Upgrade\n\n**Expected behavior:** Users will be logged out once after upgrade.\n\n**Why:** Session token format changed with new JWT implementation.\n\n**Action:** Users just need to log in again. Normal behavior.\n\n**Learn more:** [Settings Changes - JWT Configuration](doc:migration/settings-changes)\n\n---\n\n## 🔕 Database Notifications Removed\n\n**Impact:** LOW - Replaced with better alternative\n\n### What Changed\n\nDatabase backup/import notifications removed.\n\n**V1 Configuration (NO LONGER WORKS):**\n```yaml\npremium:\n  enterpriseFeatures:\n    databaseNotifications:\n      backups:\n        successful: false\n        failed: false\n      imports:\n        successful: false\n        failed: false\n```\n\n### Why Removed\n\nReplaced with comprehensive audit logging system that provides:\n- More detailed information\n- Searchable history\n- Export capabilities\n- Better retention policies\n\n### Migration to Audit Logs\n\n**V2 Alternative:**\n\n1. **Enable audit logging:**\n   ```yaml\n   system:\n     logging:\n       level: INFO\n   ```\n\n2. **Monitor logs:**\n   ```bash\n   docker logs stirling-pdf | grep \"Database backup\"\n   docker logs stirling-pdf | grep \"Database import\"\n   ```\n\n3. **Or use audit log UI:**\n   - Log in as admin\n   - Go to Settings → Audit Logs\n   - Filter by operation type\n   - Export as needed\n\n### What You Get Instead\n\n**Audit logs provide:**\n- ✅ Database operations (backup, import, export)\n- ✅ User actions (login, logout, operations)\n- ✅ Admin actions (settings changes, user management)\n- ✅ Failed operations with error details\n- ✅ Search and filter capabilities\n- ✅ Export to CSV/JSON\n\n**Example audit log entry:**\n```json\n{\n  \"timestamp\": \"2025-01-15T10:30:00Z\",\n  \"user\": \"admin\",\n  \"action\": \"database.backup\",\n  \"status\": \"success\",\n  \"details\": {\n    \"size\": \"1.2 GB\",\n    \"duration\": \"45s\",\n    \"location\": \"/backups/db-2025-01-15.sql\"\n  }\n}\n```\n\n---\n\n## 🔧 Calibre Custom Path Removed\n\n**Impact:** LOW - Auto-detection improved\n\n### What Changed\n\nCustom Calibre path no longer needed.\n\n**V1 Configuration (NO LONGER WORKS):**\n```yaml\nsystem:\n  customPaths:\n    operations:\n      calibre: '/usr/bin/calibre'\n```\n\n### Why Removed\n\nV2 has improved path detection:\n- Automatically finds Calibre in standard locations\n- Checks multiple common paths\n- Better error messages if not found\n\n### Migration\n\n1. **Remove from settings.yml:**\n   ```yaml\n   system:\n     customPaths:\n       operations:\n         # calibre: ''  # DELETE THIS LINE\n   ```\n\n2. **Verify Calibre is installed:**\n   ```bash\n   docker exec stirling-pdf which ebook-convert\n   ```\n\n3. **If not found, install in container:**\n   ```dockerfile\n   # In your Dockerfile\n   RUN apt-get update && apt-get install -y calibre\n   ```\n\n### Standard Detection Paths\n\nV2 automatically checks:\n- `/usr/bin/ebook-convert`\n- `/usr/local/bin/ebook-convert`\n- `ebook-convert` (in PATH)\n\nIf Calibre is in any standard location, it will be found automatically.\n\n---\n\n## 📦 Docker Image Changes\n\n**Impact:** LOW - Most users unaffected\n\n### Tag Changes\n\n**V1 Tags:**\n```bash\nstirlingtools/s-pdf:latest        # OLD NAME\nstirlingtools/s-pdf:0.xx.x\n```\n\n**V2 Tags:**\n```bash\nstirlingtools/stirling-pdf:latest  # NEW NAME\nstirlingtools/stirling-pdf:2.x.x\n```\n\n### Migration\n\nUpdate your docker-compose.yml:\n\n**V1:**\n```yaml\nservices:\n  stirling-pdf:\n    image: stirlingtools/s-pdf:latest  # OLD\n```\n\n**V2:**\n```yaml\nservices:\n  stirling-pdf:\n    image: stirlingtools/stirling-pdf:latest  # NEW\n```\n\n### Backwards Compatibility\n\nThe old `s-pdf` image is deprecated but still receives updates for now. However, you should migrate to the new image name.\n\n---\n\n## 🌐 API Compatibility\n\n**Impact:** LOW - Most endpoints unchanged\n\n### What Stayed the Same\n\n✅ All existing API endpoints work\n✅ Request/response formats unchanged\n✅ Authentication methods compatible\n✅ API keys still valid\n\n### What Changed\n\n**New endpoints added:**\n- `/api/v1/security/validate-signature` - PDF signature validation\n- `/api/v1/misc/remove-cert-sign` - Remove certificate signatures\n- `/api/v1/misc/booklet-imposition` - Booklet printing layout\n- `/api/v1/misc/unlock-pdf-forms` - Unlock form fields\n- `/api/v1/misc/replace-color` - Color replacement\n- `/api/v1/misc/add-attachments` - Add file attachments\n- `/api/v1/misc/edit-toc` - Edit table of contents\n\n**Enhanced endpoints:**\n- Better error messages\n- Consistent error format\n- Progress tracking for long operations\n\n### Migration\n\n**No action needed** for existing API integrations. New endpoints are additive.\n\n**If using OpenAPI spec:**\n1. Download updated spec from `/v3/api-docs`\n2. Regenerate client code if needed\n\n---\n\n## 🗄️ Database Schema\n\n**Impact:** NONE - Automatic migration\n\n### What Changed\n\nDatabase schema updated to support:\n- Enhanced audit logging\n- JWT key rotation\n- User invitation system\n- In-app settings storage\n\n### Migration\n\n**Automatic!** On first V2 startup:\n1. V2 detects V1 schema\n2. Runs migration scripts\n3. Updates to V2 schema\n4. All data preserved\n\n**No manual action needed.**\n\n### Rollback Considerations\n\nDatabase is **forward-compatible only**:\n- ✅ V1 → V2 upgrade: Automatic\n- ⚠️ V2 → V1 rollback: Database needs manual downgrade\n\n**If you need to rollback:**\n1. Restore database backup from before V2 upgrade\n2. Or use V1-compatible database dump\n\n**Recommendation:** Take database backup before upgrading.\n\n---\n\n## 📱 Browser Compatibility\n\n**Impact:** LOW - Modern browsers required\n\n### Minimum Browser Versions\n\n**V2 Requirements:**\n\n| Browser | Minimum Version | Notes |\n|---------|----------------|-------|\n| **Chrome** | 90+ | Recommended |\n| **Firefox** | 88+ | Recommended |\n| **Safari** | 14+ | Some limitations |\n| **Edge** | 90+ | Chromium-based |\n\n**V1 vs V2:**\n- V1 supported older browsers (IE11, old Safari)\n- V2 requires modern browsers for IndexedDB, modern JavaScript\n\n### Why the Change\n\nV2 features require modern browser APIs:\n- IndexedDB for file storage\n- ES2020+ JavaScript\n- Modern CSS features\n- Web Workers for performance\n\n### If Users Have Old Browsers\n\n**Options:**\n1. **Update browser** (recommended)\n2. **Use desktop app** (supports older systems)\n3. **Stay on V1** (still receives security updates)\n\n---\n\n## 🔒 Security Changes\n\n**Impact:** LOW - Generally more secure\n\n### HTTPS Enforcement\n\n**V2 Change:** Secure cookies always enabled for production.\n\n**V1:**\n```yaml\nsecurity:\n  jwt:\n    secureCookie: true  # Configurable\n```\n\n**V2:**\n```yaml\n# secureCookie removed - always secure in production\n```\n\n**Impact:**\n- ✅ More secure by default\n- ⚠️ Requires HTTPS in production\n- Development mode (localhost) still works over HTTP\n\n**Migration:**\nIf running in production, ensure HTTPS is configured:\n```yaml\nserver:\n  ssl:\n    enabled: true\n    key-store: /path/to/keystore.p12\n    key-store-password: ${SSL_PASSWORD}\n```\n\n### Session Management\n\n**V2 Changes:**\n- Shorter default session timeout (4 hours → 2 hours)\n- Better session invalidation\n- Stricter CORS policies\n\n**To increase timeout:**\n```yaml\nsecurity:\n  sessionTimeout: 14400  # 4 hours in seconds\n```\n\n---\n\n## 🎯 Feature Flag Changes\n\n**Impact:** LOW - Endpoint customization still works\n\n### What Changed\n\nTool IDs updated for consistency:\n\n| Old ID (V1) | New ID (V2) | Tool Name |\n|-------------|-------------|-----------|\n| `pdf-organizer` | `reorganize-pages` | Reorganize Pages |\n| `sign-forms` | `sign` | Sign PDF |\n\n### Migration\n\nUpdate `settings.yml` endpoint customization:\n\n**V1:**\n```yaml\nendpoints:\n  toRemove: ['pdf-organizer']\n```\n\n**V2:**\n```yaml\nendpoints:\n  toRemove: ['reorganize-pages']\n```\n\n**Complete tool ID list:** [Endpoint Customisation](doc:configuration/endpoint-or-feature-customisation)\n\n---\n\n## 📖 Documentation Structure\n\n**Impact:** NONE - Just informational\n\n### What Changed\n\nDocumentation reorganized for clarity:\n- \"V2 Guides\" → \"Guides\" (current features)\n- \"Migration\" section added (V1→V2 transition)\n- Dedicated pages for super tools\n- Comprehensive tool reference\n\n### Old Links\n\nDocumentation has been reorganized:\n- Guides section contains current features (File Storage, Undo/Redo, Desktop vs Web)\n- Migration section contains V1→V2 transition information\n- Individual pages moved to appropriate sections\n\n---\n\n## ✅ Pre-Upgrade Checklist\n\nBefore upgrading to V2, verify:\n\n### 1. Customizations\n- [ ] **Using custom templates?** → Plan rewrite or use built-in settings\n- [ ] **Custom logo?** → Will work in V2\n\n### 2. Configuration\n- [ ] **Backup settings.yml** before modifying\n- [ ] **Note UI settings** (appName, homeDescription)\n- [ ] **Update JWT settings** (enabled → persistence)\n- [ ] **Remove deprecated sections** (database notifications)\n\n### 3. Infrastructure\n- [ ] **Backup database** before upgrade\n- [ ] **Test in staging** environment first\n- [ ] **Verify HTTPS** configured for production\n- [ ] **Check browser versions** for users\n\n### 4. Features\n- [ ] **Using database notifications?** → Switch to audit logs\n- [ ] **Custom Calibre path?** → Remove, auto-detection works\n\n### 5. API Integrations\n- [ ] **Using deprecated tool IDs?** → Update to new IDs\n- [ ] **Update OpenAPI spec** if using generated clients\n- [ ] **Test API endpoints** in staging\n\n---\n\n## 🆘 Troubleshooting\n\n### \"Unknown configuration key\" warnings\n\n**Symptom:**\n```\nWARN: Unknown configuration key: premium.proFeatures.googleDrive\n```\n\n**Solution:** Remove deprecated settings from settings.yml. See [Settings Changes](doc:migration/settings-changes).\n\n---\n\n### Custom templates not loading\n\n**Symptom:** Custom navbar/homepage not appearing.\n\n**Solution:** Template system removed. Use in-app settings or custom CSS instead.\n\n---\n\n### Users logged out after upgrade\n\n**Symptom:** All users need to re-login after V2 upgrade.\n\n**Solution:** Expected behavior due to JWT format change. Users just need to log in once.\n\n---\n\n### API returns 404 for tool\n\n**Symptom:** API call fails with tool not found.\n\n**Solution:** Update tool IDs. Example: `pdf-organizer` → `reorganize-pages`. See [Feature Flag Changes](#-feature-flag-changes).\n\n---\n\n### App name not showing\n\n**Symptom:** `ui.appName` in settings.yml not displaying.\n\n**Solution:** Setting moved to in-app configuration. Log in as admin, go to Settings → UI. See [UI Settings](#%EF%B8%8F-ui-settings-moved-to-in-app-configuration).\n\n---\n\n## 🔄 Rollback Guide\n\nIf you need to return to V1:\n\n### 1. Stop V2\n```bash\ndocker stop stirling-pdf\n```\n\n### 2. Restore Database\n```bash\n# Option A: Restore from backup\ndocker exec -i postgres psql -U stirling < backup-before-v2.sql\n\n# Option B: Use existing (database is backward compatible for rollback)\n```\n\n### 3. Restore Settings\n```bash\n# Restore V1 settings.yml from backup\ncp settings.yml.v1.backup configs/settings.yml\n```\n\n### 4. Start V1\n```bash\n# Update docker-compose.yml\nimage: stirlingtools/stirling-pdf:1.5.0\n\ndocker-compose up -d\n```\n\n### Data Preservation\n\nYour data remains intact:\n- ✅ User accounts\n- ✅ API keys\n- ✅ Configurations\n- ✅ Custom files\n\n---\n\n## 📚 Related Documentation\n\n- **[Migration Overview](doc:migration/overview)** - General upgrade guide\n- **[New Features](doc:migration/new-features)** - What's new in V2\n- **[Settings Changes](doc:migration/settings-changes)** - Configuration updates\n- **[FAQ](doc:faq)** - Common questions\n\n---\n\n## Summary\n\n**Breaking changes are minimal:**\n\n✅ Most configurations work unchanged\n✅ All data migrates automatically\n✅ API compatibility maintained\n⚠️ Template customizations need rewrite\n⚠️ UI settings moved to in-app config\n⚠️ JWT settings renamed\n\n**Action required:**\n1. Update JWT setting names\n2. Remove deprecated configurations\n3. Reconfigure UI settings in-app\n4. Rewrite template customizations (if any)\n\n**Most users can upgrade with minimal changes!**",
+      "sourcePath": "docs/Migration/Breaking-Changes.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Migration/Breaking-Changes.md"
+    },
+    "migration/new-features": {
+      "id": "migration/new-features",
+      "title": "New Features in V2",
+      "description": "All new features and capabilities added in V2",
+      "section": "migration",
+      "markdown": "V2 brings powerful new features that fundamentally improve how you work with PDFs. This page documents everything new in V2.\n\n---\n\n## 📁 Browser File Storage\n\n**The Game Changer:** Upload PDFs once, use them across multiple tools without re-uploading.\n\n### What's New\n\n- **Persistent Storage:** Files stored locally in your browser using IndexedDB\n- **Cross-Tool Usage:** Access uploaded files from any tool\n- **Smart Management:** Automatic cleanup, manual delete options\n- **Large File Support:** Up to 10GB storage (browser-dependent)\n\n### How It Works\n\n```\nUpload PDF → Stored in Browser → Use in Any Tool → Delete When Done\n```\n\n**Example Workflow:**\n1. Upload `report.pdf` in Multi-Tool\n2. Compress it\n3. Switch to Add Page Numbers (file still there!)\n4. Add watermark (still no re-upload!)\n5. Download final result\n\n### Storage Limits\n\n| Browser | Storage Limit | Notes |\n|---------|--------------|-------|\n| Chrome/Edge | ~10GB | 60% of available disk space |\n| Firefox | ~10GB | User-configurable |\n| Safari | ~1GB | More restrictive |\n\n---\n\n## ⏮️ Undo, Redo & Version History\n\n**Made a mistake?** Just undo it! V2 introduces comprehensive version control.\n\n### What's New\n\n- **Undo/Redo:** Undo and redo buttons in toolbar\n- **Version History:** See all previous versions with timestamps\n- **Jump to Version:** Restore any previous state\n- **Visual Indicators:** See current version in timeline\n- **All Local:** History stored in your browser, fully private\n\n### How It Works\n\nEvery operation creates a new version:\n\n```\nOriginal.pdf → [Compress] → v1 → [Add Pages] → v2 → [Watermark] → v3\n                ↑           ↑                 ↑                   ↑\n                Can restore to any point in history\n```\n\n### Accessing Features\n\n- **Undo Button:** Click undo in toolbar\n- **Redo Button:** Click redo in toolbar\n- **History Panel:** Click history icon in Multi-Tool\n\n### Example Use Case\n\n**Scenario:** You compressed a PDF too aggressively and text is blurry.\n\n**Solution:**\n1. Click undo button to undo compression\n2. Open Version History panel\n3. See: Original → Compress (MEDIUM) ← You are here\n4. Click \"Restore\" on Original\n5. Re-compress with LIGHT setting instead\n\n\n---\n\n## 🖥️ Desktop Applications\n\n**NEW:** Native desktop apps for Windows, Mac, and Linux.\n\n### What's New\n\n- **Lightning Fast:** 0.3 second startup time\n- **Native Integration:** \"Open with Stirling PDF\" in file explorer\n- **System Default:** Set as default PDF viewer\n- **Sign in with Stirling Cloud or self-hosted server** - Choose your connection on launch\n- **Resource Efficient:** Uses ~50MB RAM vs browser ~200MB\n\n### Platform Support\n\n| Platform | Format | Features |\n|----------|--------|----------|\n| **Windows** | `.exe` installer | Context menu integration |\n| **macOS** | `.dmg` | Dock integration |\n| **Linux** | `.deb` | Desktop file integration |\n\n### Key Differences from Web\n\n| Feature | Desktop | Web Browser |\n|---------|---------|-------------|\n| Startup Speed | 0.3s | 2-3s |\n| File Association | ✅ Yes | ❌ No |\n| Default Viewer | ✅ Yes | ❌ No |\n| System Integration | ✅ Native | ⚠️ Limited |\n| Storage | Unlimited | Browser limits |\n| Updates | Manual | Automatic |\n\n### Right-Click Integration\n\nAfter installation:\n1. Right-click any PDF in file explorer\n2. Select \"Open with Stirling PDF\"\n3. PDF opens directly in app\n4. Sign in (if needed)\n5. Process immediately\n\n**Learn More:**\n- [Windows Installation](doc:installation/windows)\n- [Mac Installation](doc:installation/mac)\n- [Linux Installation](doc:installation/unix)\n\n---\n\n---\n\n## ⌨️ Custom Keyboard Shortcuts\n\n**NEW:** Configure your own keyboard shortcuts for quick tool access.\n\n### What's New\n\n- **Custom Hotkeys:** Assign keyboard shortcuts to any tool\n- **Quick Access:** Default shortcuts for 7 most popular tools (Cmd/Ctrl+Alt+1-7)\n- **Flexible Mapping:** Use any combination of Ctrl, Alt, Shift, Cmd keys\n- **Visual Feedback:** See all shortcuts in settings\n- **Conflict Detection:** Prevents duplicate shortcut assignments\n- **Easy Reset:** Restore default shortcuts anytime\n\n### Default Shortcuts\n\nThe 7 Recommended Tools come with pre-configured shortcuts:\n\n| Tool | Windows/Linux | Mac |\n|------|---------------|-----|\n| Multi-Tool | Ctrl+Alt+1 | Cmd+Option+1 |\n| Read & Annotate | Ctrl+Alt+2 | Cmd+Option+2 |\n| Merge | Ctrl+Alt+3 | Cmd+Option+3 |\n| Compare | Ctrl+Alt+4 | Cmd+Option+4 |\n| Compress | Ctrl+Alt+5 | Cmd+Option+5 |\n| OCR | Ctrl+Alt+6 | Cmd+Option+6 |\n| Redact | Ctrl+Alt+7 | Cmd+Option+7 |\n\n### Customizing Shortcuts\n\n**To configure:**\n1. Open Settings (gear icon)\n2. Navigate to \"Keyboard Shortcuts\" section\n3. Find the tool you want to assign\n4. Click \"Set Shortcut\"\n5. Press your desired key combination\n6. Save changes\n\n**Example:**\n- Want to open Convert with Ctrl+Alt+C?\n- Navigate to Convert tool in shortcuts list\n- Click \"Set Shortcut\"\n- Press Ctrl+Alt+C\n\n### Tips\n\n- **Don't override browser shortcuts:** Avoid Ctrl+T, Ctrl+W, etc.\n- **Use Alt/Option combos:** Less likely to conflict with system shortcuts\n- **Keep it memorable:** Use letters that relate to tool names\n- **Test after setting:** Make sure shortcuts work in practice\n\n---\n\n## ⚙️ In-App Settings Management\n\n**NEW:** Configure everything through the UI (admin only).\n\n### What's New\n\n- **Visual Configuration:** No more editing YAML files\n- **Instant Validation:** See errors before saving\n- **Live Preview:** Some settings apply immediately\n- **Organized Sections:** Settings grouped logically\n- **Search Settings:** Find what you need quickly\n- **Import/Export:** Backup and restore configurations\n\n### Settings You Can Configure\n\n**System:**\n- Default locale and timezone\n- Resource limits\n- Logging levels\n- CORS origins\n\n**Security:**\n- Login requirements\n- User registration\n- Session timeout\n- Password policies\n\n**UI Customization:**\n- App name and description\n- Logo style (classic/modern)\n- Navbar branding\n- Homepage content\n\n**Features:**\n- Enable/disable tools\n- Endpoint customization\n- OCR languages\n- Conversion settings\n\n### How to Access\n\n1. Enable login: `SECURITY_ENABLELOGIN=true`\n2. Log in as admin\n3. Click Settings icon in navbar\n4. Configure through UI\n5. Save changes\n\n**Benefits Over File Configuration:**\n- No container restart needed (for most settings)\n- Validation prevents errors\n- Changes tracked in audit log\n- Role-based access control\n\n---\n\n## 🔐 PDF Signature Validation\n\n**NEW:** Comprehensive certificate chain validation for signed PDFs.\n\n### What's New\n\nFull trust chain validation system:\n\n- **Multiple Trust Sources:**\n  - System trust store\n  - Mozilla CA bundle\n  - Adobe Approved Trust List (AATL)\n  - EU Trusted List (EUTL)\n  - Server-generated anchor certificates\n\n- **Revocation Checking:**\n  - OCSP (Online Certificate Status Protocol)\n  - CRL (Certificate Revocation Lists)\n  - Configurable hard/soft fail\n\n- **AIA (Authority Information Access):**\n  - Automatic intermediate cert fetching\n  - Chain building support\n\n### Configuration\n\n```yaml\nsecurity:\n  validation:\n    trust:\n      serverAsAnchor: true          # Trust server-generated certs\n      useSystemTrust: true           # Use OS trust store\n      useMozillaBundle: true         # Mozilla CA certificates\n      useAATL: false                 # Adobe trust list\n      useEUTL: false                 # EU trust list\n    allowAIA: false                  # Fetch intermediate certs\n    revocation:\n      mode: none                     # none, ocsp, crl, ocsp+crl\n      hardFail: false                # Fail if revocation check fails\n```\n\n### Use Cases\n\n**Enterprise:**\n- Validate invoices signed by partners\n- Verify contract signatures\n- Compliance with legal requirements\n\n**Government:**\n- Validate officially signed documents\n- EU eIDAS compliance\n- EUTL integration\n\n**General:**\n- Verify PDF authenticity\n- Check if signature still valid\n- Detect tampered documents\n\n**Learn More:** [Certificate Signing](doc:functionality/security/certificate-signing)\n\n---\n\n## 🔑 Server Certificate Management\n\n**NEW:** Automatic certificate generation for signing PDFs.\n\n### What's New\n\n- **Auto-Generated Certs:** Server creates signing certificates on startup\n- **Customizable:** Configure organization name, validity period\n- **No Manual Setup:** Works out of the box\n- **Renewable:** Regenerate certificates as needed\n- **\"Sign with Stirling PDF\" Feature:** Users can sign with server cert\n\n### Configuration\n\n```yaml\nsystem:\n  serverCertificate:\n    enabled: true\n    organizationName: Stirling-PDF\n    validity: 365  # days\n    regenerateOnStartup: false\n```\n\n### How It Works\n\n1. **First Startup:**\n   - Server generates self-signed certificate\n   - Stored in `configs/` directory\n   - Used for \"Sign with Stirling PDF\" feature\n\n2. **Subsequent Startups:**\n   - Uses existing certificate (unless `regenerateOnStartup: true`)\n   - Certificate persists across restarts\n\n3. **User Signs PDF:**\n   - Selects \"Sign with Stirling PDF\"\n   - Server signs using generated certificate\n   - Signature embedded in PDF\n\n### Custom Certificates\n\nYou can also provide your own certificates:\n\n```bash\nconfigs/\n  ├── keystore.p12           # Your certificate\n  └── settings.yml\n```\n\nThen disable auto-generation:\n```yaml\nsystem:\n  serverCertificate:\n    enabled: false  # Use custom cert instead\n```\n\n**Learn More:**\n- [Certificate Signing Guide](doc:functionality/security/certificate-signing)\n- [Configuration](doc:configuration/system-and-security)\n\n---\n\n## 🎯 Multi-Tool Workbench\n\n**NEW:** Dedicated workspace for chaining unlimited operations.\n\n### What's New\n\n- **Visual Workbench:** See all loaded files and their history\n- **Unlimited Operations:** Chain as many tools as needed\n- **Operation History:** See what you've done to each file\n- **Undo/Redo:** Per-file version control\n- **Batch Processing:** Process multiple files simultaneously\n- **Result Management:** Keep, download, or discard results\n\n### Example Workflow\n\n```\nMulti-Tool Workbench\n├── invoice.pdf\n│   ├── [Original]\n│   ├── [OCR - English]\n│   ├── [Compress - MEDIUM]\n│   └── [Add Page Numbers] ← Current\n├── report.pdf\n│   ├── [Original]\n│   └── [Add Watermark] ← Current\n└── contract.pdf\n    └── [Original] ← No operations yet\n```\n\n### Key Features\n\n1. **Smart Tool Switching:**\n   - Switch tools without losing files\n   - Context preserved between operations\n   - No re-uploading needed\n\n2. **Operation Queue:**\n   - See pending operations\n   - Reorder before processing\n   - Cancel if needed\n\n3. **Result Preview:**\n   - Preview before downloading\n   - Compare before/after\n   - Verify operations succeeded\n\n**Learn More:** [Multi-Tool Workbench Guide](doc:functionality/multi-tool)\n\n---\n\n## 📖 Read & Annotate Tool\n\n**NEW:** Full-featured PDF viewer with annotation capabilities.\n\n### What's New\n\n- **PDF Viewer:** Read PDFs directly in browser\n- **Annotation Tools:**\n  - Highlight text\n  - Add comments\n  - Draw shapes\n  - Insert text boxes\n  - Sticky notes\n- **Navigation:**\n  - Thumbnail sidebar\n  - Table of contents\n  - Page search\n  - Zoom controls\n- **Collaboration:**\n  - Export annotations\n  - Share annotated PDFs\n  - Comment threads\n\n### Use Cases\n\n**Review:**\n- Mark up documents for approval\n- Add review comments\n- Highlight important sections\n\n**Collaboration:**\n- Annotate contracts before signing\n- Review proposals with team\n- Provide feedback on drafts\n\n**Study:**\n- Highlight key passages\n- Add study notes\n- Mark important pages\n\n### Annotation Types\n\n| Tool | Use Case | Example |\n|------|----------|---------|\n| **Highlight** | Mark important text | Legal clauses |\n| **Comment** | Add feedback | \"Needs revision\" |\n| **Text Box** | Add missing text | Corrections |\n| **Shape** | Circle/underline | Draw attention |\n| **Sticky Note** | Quick notes | \"Follow up\" |\n\n**Learn More:** [Read & Annotate Guide](doc:functionality/read-and-annotate)\n\n---\n\n## 🔄 Enhanced Session Management\n\n**Improved:** Better session and token management with rotation and cleanup.\n\n### What's New in V2\n\n| Feature | V1 | V2 |\n|---------|----|----|\n| Token Persistence | Optional | Configurable |\n| Key Rotation | ❌ No | ✅ Yes |\n| Key Cleanup | Manual | Automatic |\n| Key Retention | N/A | Configurable days |\n| Secure Cookie | Hardcoded | Removed (always secure) |\n\n### New Settings\n\n```yaml\nsecurity:\n  jwt:\n    persistence: true           # Store keys across restarts\n    enableKeyRotation: true     # Rotate signing keys periodically\n    enableKeyCleanup: true      # Auto-delete old keys\n    keyRetentionDays: 7         # How long to keep old keys\n```\n\n### Benefits\n\n**Key Rotation:**\n- Improved security through regular key changes\n- Seamless for users (old tokens still work during grace period)\n- Configurable rotation schedule\n\n**Automatic Cleanup:**\n- No manual key management needed\n- Prevents key accumulation\n- Configurable retention period\n\n**Persistence:**\n- Keys survive container restarts\n- No user re-login after restart\n- Optional for stateless deployments\n\n---\n\n## ✉️ Email Invitation System\n\n**NEW:** Invite users via email instead of manual registration.\n\n### What's New\n\n- **Email Invites:** Send registration links via email\n- **Token-Based:** Secure one-time registration tokens\n- **Expiration:** Invites expire after configurable period\n- **Role Assignment:** Set user role in invite\n- **Bulk Invites:** Invite multiple users at once\n\n### Configuration\n\n```yaml\nmail:\n  enabled: true\n  from: noreply@example.com\n  smtp:\n    host: smtp.example.com\n    port: 587\n    username: noreply@example.com\n    password: ${MAIL_PASSWORD}\n```\n\n### Requirements\n\n- `mail.enabled: true`\n- `security.enableLogin: true`\n- Valid SMTP configuration\n\n### How It Works\n\n**Admin perspective:**\n1. Go to User Management\n2. Click \"Invite User\"\n3. Enter email and select role\n4. Send invite\n\n**User perspective:**\n1. Receive email with invite link\n2. Click link (valid for 48 hours)\n3. Create account with password\n4. Automatically logged in\n\n### Environment Variables\n\n```bash\nMAIL_ENABLED=true\nMAIL_FROM=noreply@example.com\nMAIL_ENABLEINVITES=true\nMAIL_HOST=smtp.gmail.com\nMAIL_PORT=587\nMAIL_USERNAME=your-email@gmail.com\nMAIL_PASSWORD=your-app-password\nMAIL_TLS_ENABLED=true\n```\n\n---\n\n## 🎨 Logo Customization\n\n**NEW:** Choose between logo styles and customize branding.\n\n### What's New\n\n```yaml\nui:\n  logoStyle: classic  # Options: 'classic' or 'modern'\n```\n\n### Logo Styles\n\n| Style | Description | Best For |\n|-------|-------------|----------|\n| **Classic** | Traditional \"S\" icon | Established brands |\n| **Modern** | Minimalist design | Clean, modern look |\n\n### Custom Logo\n\nYou can still provide custom logo files:\n\n```bash\ncustomFiles/\n  └── static/\n      └── logo.svg  # Your custom logo\n```\n\nThen reference in settings:\n```yaml\nui:\n  appNameNavbar: 'My Company PDF'\n  logoStyle: classic  # Or use custom logo\n```\n\n---\n\n## Summary\n\n**V2's Major Features:**\n\n- 📁 **Browser File Storage** - Upload once, use across multiple tools\n- ⏮️ **Undo/Redo & Version History** - Never lose work\n- 🖥️ **Desktop Applications** - Native Windows, Mac, Linux apps\n- 🎨 **Multi-Tool Workbench** - Chain unlimited operations\n- 📖 **Read & Annotate** - Full PDF viewer with annotation support\n- ⚙️ **In-App Settings** - Configure everything through UI\n- 🔐 **Enhanced Security** - PDF signature validation, server certificates\n- ✉️ **Email Invitations** - Streamlined user onboarding\n- ⌨️ **Custom Keyboard Shortcuts** - Quick tool access\n- 🔄 **Enhanced Session Management** - Better token management with rotation\n\n---\n\n## Learn More\n\n- **[Migration Overview](doc:migration/overview)** - How to upgrade\n- **[Settings Changes](doc:migration/settings-changes)** - Configuration updates\n- **[Breaking Changes](doc:migration/breaking-changes)** - What changed\n- **[Getting Started](doc:getting-started)** - Start using V2",
+      "sourcePath": "docs/Migration/New-Features.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Migration/New-Features.md"
+    },
+    "migration/overview": {
+      "id": "migration/overview",
+      "title": "Migrating from V1 to V2",
+      "description": "Complete guide for upgrading from Stirling PDF V1 to V2",
+      "section": "migration",
+      "markdown": "Upgrading to Stirling PDF V2 is straightforward for most users. This guide will walk you through the upgrade process.\n\n> **⚠️ Warning: Backup Your Configuration**\n>\n> Before upgrading, **back up your configuration folder** (usually mounted as `/configs`) to ensure you can restore your settings if needed:\n> ```bash\n> # Docker volume backup\n> docker cp stirling-pdf:/configs ./configs-backup\n>\n> # Or if using bind mount\n> cp -r ./configs ./configs-backup\n> ```\n\n\n---\n\n## Quick Upgrade Guide\n\n### Docker Users (Most Common)\n\nUpdate your image tag to `latest` (or specific V2 version):\n\n```yaml\nservices:\n  stirling-pdf:\n    image: stirlingtools/stirling-pdf:latest  # Change from 1.x to latest\n    # Keep all your existing environment variables and volumes\n```\n\nThen pull and restart. See the [Docker Installation Guide - Updating Section](doc:installation/docker-install) for complete update commands.\n\n**That's it!** Your data and settings migrate automatically.\n\n---\n\n### Desktop Application Users\n\n1. **Windows**: Download new installer from [GitHub Releases](https://github.com/Stirling-Tools/Stirling-PDF/releases), run it (automatically updates)\n2. **Mac**: Download new DMG, drag to Applications (replaces old version)\n3. **Linux**: Install new `.deb`/`.rpm`/`.AppImage`\n\nYour settings carry over automatically.\n\n---\n\n### Manual Installation (JAR)\n\n1. Download the latest V2 release from [GitHub Releases](https://github.com/Stirling-Tools/Stirling-PDF/releases)\n2. Stop the current V1 instance\n3. Replace the JAR file\n4. Start with the same command\n\n---\n\n## Migration Guide Sections\n\nThis migration guide is organized into detailed sections:\n\n### 📋 [Settings Changes](doc:migration/settings-changes)\n**Start here** if you have custom configuration. Covers:\n- New settings added in V2\n- Deprecated settings to remove\n- Settings that were renamed\n- Configuration examples and migration checklist\n\n### ⚠️ [Breaking Changes](doc:migration/breaking-changes)\n**Important** - Review if you have customizations. Covers:\n- Template customization system changes (most impactful)\n- UI settings moved to in-app configuration\n- Session management improvements\n- Database notification changes\n- API compatibility notes\n\n### ✨ [New Features](doc:migration/new-features)\n**Explore what's new** - Comprehensive list of V2 features:\n- Browser file storage\n- Undo/redo functionality\n- Desktop applications\n- Multi-Tool workbench\n- PDF signature validation\n- In-app settings management\n- And much more...\n\n---\n\n## Should You Upgrade?\n\n**Yes, if you want:**\n- ✅ Faster workflows with file persistence\n- ✅ Undo/redo functionality\n- ✅ Better performance with large files\n- ✅ Desktop applications\n- ✅ Modern, responsive interface\n- ✅ Future features and updates\n\n**Consider staying on V1 if:**\n- ⚠️ You heavily customized UI using Thymeleaf templates in `customFiles/templates/` (requires rewriting for React in V2)\n  - **Note:** Static file overrides via `customFiles/static/` still work in V2 - only Thymeleaf templates don't work\n- ⚠️ You have specific compatibility requirements with very old browsers\n\n---\n\n## What Stays the Same\n\n- ✅ All existing PDF tools\n- ✅ Backend API compatibility\n- ✅ Configuration files (settings.yml)\n- ✅ Docker deployment process\n- ✅ Security features (SSO, user management)\n- ✅ Pipeline automation (renamed \"Automate\" in UI)\n- ✅ Privacy commitment\n\n---\n\n## Your Data is Safe\n\nV2 is **fully compatible** with V1 data:\n- ✅ User accounts and permissions\n- ✅ API keys\n- ✅ Settings and configurations\n- ✅ Database (internal or external)\n- ✅ Custom OCR language files\n- ✅ Custom fonts and certificates\n\n**No manual migration needed** - database schema updates automatically on first startup.\n\n---\n\n## Post-Upgrade Checklist\n\nAfter upgrading, verify everything works:\n\n- [ ] Can log in with existing credentials\n- [ ] All PDF tools work as expected\n- [ ] Settings and preferences retained\n- [ ] API integrations still function (if applicable)\n- [ ] Custom branding appears correctly\n- [ ] OCR languages available\n- [ ] Pipelines continue working (now called \"Automate\" in UI)\n\n---\n\n## Troubleshooting\n\n### Common Issues\n\n**\"Unknown configuration key\" warnings**\n- **Cause:** Old V1 settings in your `settings.yml`\n- **Solution:** See [Settings Changes](doc:migration/settings-changes) to remove deprecated settings\n\n**Users logged out after upgrade**\n- **Cause:** JWT token format changed (normal)\n- **Solution:** Users just need to log in once\n\n**Custom templates not loading**\n- **Cause:** Thymeleaf template system no longer used (V2 uses React)\n- **Solution:** Use static file overrides instead via `customFiles/static/` - See [Breaking Changes - UI Customization](doc:migration/breaking-changes)\n\n**App name not showing**\n- **Cause:** Setting moved to in-app configuration\n- **Solution:** Log in as admin → Settings → UI\n\n---\n\n## Rolling Back (If Needed)\n\nIf you need to return to V1:\n\n```bash\n# Restore config backup\ncp -r ./configs-backup ./configs\n\n# Pull V1 image\ndocker pull stirlingtools/stirling-pdf:1.5.0\n\n# Update docker-compose.yml to use 1.5.0 tag\ndocker-compose up -d\n```\n\n**Note:** Your data will work if you roll back (database is backward compatible).\n\n---\n\n## Getting Help\n\nIf you encounter issues:\n\n1. **[Settings Changes](doc:migration/settings-changes)** - Update your configuration\n2. **[Breaking Changes](doc:migration/breaking-changes)** - Review important changes\n3. **[New Features](doc:migration/new-features)** - Learn what's new\n4. **[FAQ](doc:faq)** - Common questions answered\n5. **[GitHub Issues](https://github.com/Stirling-Tools/Stirling-PDF/issues)** - Report problems\n6. **[Discord](https://discord.gg/Cn8pWhQRxZ)** - Community support\n\n---\n\n## Summary\n\n**Upgrading is easy:**\n1. Back up your `/configs` folder\n2. Pull latest Docker image (or download desktop app)\n3. Start with existing configuration\n4. Review [Settings Changes](doc:migration/settings-changes) for any needed updates\n5. Check [Breaking Changes](doc:migration/breaking-changes) if you have customizations\n\n**Welcome to V2!** Enjoy the faster, more modern Stirling PDF experience.",
+      "sourcePath": "docs/Migration/Overview.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Migration/Overview.md"
+    },
+    "migration/settings-changes": {
+      "id": "migration/settings-changes",
+      "title": "Settings Changes from V1 to V2",
+      "description": "Configuration changes between V1 and V2",
+      "section": "migration",
+      "markdown": "This page documents all `settings.yml` changes between V1 and V2.\n\n---\n\n## New Settings in V2\n\n### PDF Signature Validation\n\n**Entire new section added:**\n\n```yaml\nsecurity:\n  validation: # NEW in V2\n    trust:\n      serverAsAnchor: true\n      useSystemTrust: true\n      useMozillaBundle: true\n      useAATL: false # Adobe Approved Trust List\n      useEUTL: false # EU Trusted List\n    allowAIA: false\n    aatl:\n      url: https://trustlist.adobe.com/tl.pdf\n    eutl:\n      lotlUrl: https://ec.europa.eu/tools/lotl/eu-lotl.xml\n      acceptTransitional: false\n    revocation:\n      mode: none # Options: none, ocsp, crl, ocsp+crl\n      hardFail: false\n```\n\n**What it does:** Comprehensive PDF signature validation with configurable trust chains.\n\n**Migration:** No action needed, defaults are safe for most users.\n\n**Learn more:** [Certificate Signing](doc:functionality/security/certificate-signing) | [Security Configuration](doc:configuration/system-and-security)\n\n---\n\n### Server Certificate Management\n\n**New section added:**\n\n```yaml\nsystem:\n  serverCertificate: # NEW in V2\n    enabled: true\n    organizationName: Stirling-PDF\n    validity: 365 # days\n    regenerateOnStartup: false\n```\n\n**What it does:** Auto-generates signing certificates for \"Sign with Stirling PDF\" feature.\n\n**Migration:** Works automatically with defaults.\n\n**Learn more:** [Certificate Signing](doc:functionality/security/certificate-signing) | [Certificate Configuration](doc:configuration/system-and-security)\n\n---\n\n### Enhanced JWT Configuration\n\n**Changed settings:**\n\n```yaml\n# V1 (OLD)\nsecurity:\n  jwt:\n    enabled: false\n    keyCleanup: false\n    secureCookie: true # REMOVED\n\n# V2 (NEW)\nsecurity:\n  jwt:\n    persistence: true # replaces 'enabled'\n    enableKeyRotation: true # NEW\n    enableKeyCleanup: true # replaces 'keyCleanup'\n    keyRetentionDays: 7\n```\n\n**Migration:**\n- Replace `jwt.enabled` with `jwt.persistence`\n- Replace `jwt.keyCleanup` with `jwt.enableKeyCleanup`\n- Add `jwt.enableKeyRotation: true`\n- Remove `jwt.secureCookie` (no longer used)\n\n---\n\n### Email Invites\n\n**New setting added:**\n\n```yaml\nmail:\n  enableInvites: false # NEW in V2\n```\n\n**What it does:** Enable email invitations for user registration.\n\n**Requirements:**\n- `mail.enabled: true`\n- `security.enableLogin: true`\n\n**Migration:** Set to `true` if you want invite functionality.\n\n---\n\n### UI Logo Customization\n\n**New setting added:**\n\n```yaml\nui:\n  logoStyle: classic # NEW in V2 - Options: 'classic' or 'modern'\n```\n\n**What it does:** Choose between classic S icon or modern minimalist logo.\n\n**Migration:** Leave as `classic` (default) or set to `modern` for new look.\n\n---\n\n## Removed Settings in V2\n\n### UI Settings Moved to In-App Configuration\n\n**V1 settings (REMOVED):**\n\n```yaml\nui:\n  appName: '' # REMOVED\n  homeDescription: '' # REMOVED\n```\n\n**Migration:**\n1. Enable login: `SECURITY_ENABLELOGIN=true`\n2. Log in as admin\n3. Go to Settings in UI\n4. Configure app name and description there\n\n**Why:** In-app settings are more user-friendly and apply immediately.\n\n**Learn more:** [UI Customisation](doc:configuration/ui-customisation)\n\n---\n\n### Google Drive Integration\n\n**V1 settings (REMOVED):**\n\n```yaml\npremium:\n  proFeatures:\n    googleDrive: # REMOVED in V2\n      enabled: false\n      clientId: ''\n      apiKey: ''\n      appId: ''\n```\n\n**Migration:** Remove this section from your `settings.yml`.\n\n**Why:** Feature discontinued in V2.\n\n---\n\n### Database Notifications\n\n**V1 settings (REMOVED):**\n\n```yaml\npremium:\n  enterpriseFeatures:\n    databaseNotifications: # REMOVED in V2\n      backups:\n        successful: false\n        failed: false\n      imports:\n        successful: false\n        failed: false\n```\n\n**Migration:** Remove this section from your `settings.yml`.\n\n**Why:** Replaced with more comprehensive audit logging.\n\n---\n\n### Calibre Custom Path\n\n**V1 setting (REMOVED):**\n\n```yaml\nsystem:\n  customPaths:\n    operations:\n      calibre: '' # REMOVED in V2\n```\n\n**Migration:** Remove this line.\n\n**Why:** Path detection improved, no longer needs custom configuration.\n\n---\n\n## Migration Checklist\n\nUse this checklist when upgrading your `settings.yml`:\n\n### Required Changes\n\n- [ ] **JWT Settings:**\n  - [ ] Replace `jwt.enabled` with `jwt.persistence`\n  - [ ] Replace `jwt.keyCleanup` with `jwt.enableKeyCleanup`\n  - [ ] Add `jwt.enableKeyRotation: true`\n  - [ ] Remove `jwt.secureCookie` line\n\n- [ ] **Remove Deprecated Sections:**\n  - [ ] Remove `premium.proFeatures.googleDrive` section\n  - [ ] Remove `premium.enterpriseFeatures.databaseNotifications` section\n  - [ ] Remove `system.customPaths.operations.calibre` line\n\n- [ ] **UI Settings:**\n  - [ ] Remove `ui.appName` (use in-app settings)\n  - [ ] Remove `ui.homeDescription` (use in-app settings)\n\n### Optional Additions\n\n- [ ] **Add `ui.logoStyle: classic`** if you want to explicitly set logo\n- [ ] **Configure `security.validation`** if you need custom signature validation\n- [ ] **Set `system.serverCertificate`** options if needed\n- [ ] **Enable `mail.enableInvites`** if you want email invitations\n\n---\n\n## Environment Variable Changes\n\n### New Environment Variables in V2\n\n```bash\n# Signature validation\nSECURITY_VALIDATION_TRUST_SERVERASANCHOR=true\nSECURITY_VALIDATION_TRUST_USESYSTEMTRUST=true\nSECURITY_VALIDATION_TRUST_USEMOZILLABUNDLE=true\nSECURITY_VALIDATION_TRUST_USEAATL=false\nSECURITY_VALIDATION_TRUST_USEEUTL=false\nSECURITY_VALIDATION_REVOCATION_MODE=none\n\n# Server certificates\nSYSTEM_SERVERCERTIFICATE_ENABLED=true\nSYSTEM_SERVERCERTIFICATE_ORGANIZATIONNAME=\"My Company\"\nSYSTEM_SERVERCERTIFICATE_VALIDITY=365\n\n# JWT\nSECURITY_JWT_PERSISTENCE=true\nSECURITY_JWT_ENABLEKEYROTATION=true\nSECURITY_JWT_ENABLEKEYCLEANUP=true\n\n# Email configuration\nMAIL_FROM=noreply@example.com\nMAIL_ENABLEINVITES=true\n\n# Logo\nUI_LOGOSTYLE=modern\n```\n\n### Deprecated Environment Variables\n\n```bash\n# These no longer work in V2\nSECURITY_JWT_ENABLED  # Use SECURITY_JWT_PERSISTENCE\nSECURITY_JWT_KEYCLEANUP  # Use SECURITY_JWT_ENABLEKEYCLEANUP\nSECURITY_JWT_SECURECOOKIE  # Removed\nUI_APPNAME  # Use in-app settings\nUI_HOMEDESCRIPTION  # Use in-app settings\n```\n\n---\n\n## Configuration Examples\n\n### Minimal V2 Configuration (Works Out of Box)\n\n```yaml\nsecurity:\n  enableLogin: false\n\nsystem:\n  defaultLocale: en-US\n\nui:\n  appNameNavbar: ''\n```\n\nAll new V2 features use sensible defaults.\n\n---\n\n### V1 to V2 Configuration Diff\n\n**V1 Configuration:**\n```yaml\nsecurity:\n  jwt:\n    enabled: false\n    keyCleanup: false\n    secureCookie: true\n\nui:\n  appName: 'My PDF Tool'\n  homeDescription: 'Welcome!'\n  appNameNavbar: 'PDF Tool'\n\npremium:\n  proFeatures:\n    googleDrive:\n      enabled: false\n```\n\n**V2 Configuration:**\n```yaml\nsecurity:\n  jwt:\n    persistence: true  # Changed\n    enableKeyRotation: true  # NEW\n    enableKeyCleanup: true  # Changed\n    keyRetentionDays: 7\n  validation:  # NEW section\n    trust:\n      serverAsAnchor: true\n      useSystemTrust: true\n\nsystem:\n  serverCertificate:  # NEW section\n    enabled: true\n    organizationName: Stirling-PDF\n\nui:\n  appNameNavbar: 'PDF Tool'\n  logoStyle: classic  # NEW\n  # appName and homeDescription removed - use in-app settings\n```\n\n---\n\n## Troubleshooting\n\n### \"Unknown configuration key\" warnings\n\n**Symptom:** Warnings about unrecognized settings on startup.\n\n**Cause:** Old V1 settings still in your `settings.yml`.\n\n**Solution:** Remove deprecated settings listed in this guide.\n\n---\n\n### JWT tokens invalid after upgrade\n\n**Symptom:** Users logged out, need to re-login.\n\n**Cause:** JWT key format changed.\n\n**Solution:** Expected behavior, users just need to log in again once.\n\n---\n\n### Custom app name not showing\n\n**Symptom:** App name doesn't appear after setting `ui.appName`.\n\n**Cause:** Setting moved to in-app configuration.\n\n**Solution:**\n1. Log in as admin\n2. Go to Settings → UI\n3. Configure there\n\n---\n\n## Related Documentation\n\n- **[New Features](doc:migration/new-features)** - What's new in V2\n- **[Breaking Changes](doc:migration/breaking-changes)** - Important changes\n- **[Configuration Options](doc:configuration/extra-settings)** - All configuration variables\n- **[System and Security](doc:configuration/system-and-security)** - Advanced config\n\n---\n\n## Summary\n\n**Key Takeaways:**\n- ✅ Most settings remain the same\n- 🔄 JWT settings have new names\n- ➕ Many new optional features\n- ➖ Google Drive and database notifications removed\n- 🎨 UI settings moved to in-app configuration\n\n**Action Required:**\n- Update JWT setting names\n- Remove deprecated sections\n- Optionally configure new features\n\nYour existing configuration will work in V2 with minimal changes!",
+      "sourcePath": "docs/Migration/Settings-Changes.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Migration/Settings-Changes.md"
+    },
+    "modes-and-licensing": {
+      "id": "modes-and-licensing",
+      "title": "Modes",
+      "description": "The different ways to run Stirling PDF and where credits apply",
+      "section": "overview",
+      "markdown": "Stirling PDF runs in several modes depending on how you deploy it. This page is just an overview of what each mode is - for pricing, feature matrix, and full license terms see [Paid Offerings](doc:paid-offerings).\n\n---\n\n## At a glance\n\n| Mode | What it is | Where files are processed | Credits? |\n|---|---|---|---|\n| **Desktop - Local** | Native Windows/Mac/Linux app, no sign-in | Your device | No |\n| **Desktop + Stirling.com Cloud** | Same desktop app, signed in to Stirling.com Cloud | Mix: local for basic tools, cloud for advanced | Yes, on cloud-routed ops |\n| **Desktop + Self-hosted server** | Desktop app pointed at your own Stirling server | Your server | No |\n| **Web - Self-hosted** | Docker / Kubernetes / JAR, accessed via browser | Your server | No |\n| **Stirling.com Cloud** | `stirling.com/app` web app | Stirling.com Cloud | Yes |\n\n---\n\n## Desktop\n\n### Local\n\nThe default for the Windows, Mac, and Linux desktop apps. No sign-in, no server, no credits. Basic PDF tools (merge, split, rotate, sign, watermark, page operations, etc.) run entirely on your device.\n\nTools that need server-side processing (OCR, document-format conversions, compression, repair) are not available in this mode - sign in to Stirling.com Cloud or connect to a self-hosted server to use them.\n\n### With Stirling.com Cloud\n\nThe desktop app signed in to your Stirling.com Cloud account. Basic tools still run locally for free; advanced tools route to Stirling.com Cloud and consume credits.\n\n### With a self-hosted server\n\nThe desktop app pointed at a Stirling PDF instance you run yourself. All tools route to your server and **no credits apply**. Whichever license tier your server runs (Free, Server, Enterprise) is what the desktop client gets.\n\n---\n\n## Web - Self-hosted\n\nStirling PDF running in Docker, Kubernetes, or as a bare-metal JAR, accessed via a browser. **No credits ever.** License tier determines which advanced features (unlimited users, SSO, SAML, audit logs, etc.) are unlocked - see [Paid Offerings](doc:paid-offerings).\n\n---\n\n## Stirling.com Cloud\n\nThe hosted version at [stirling.com/app](https://stirling.com/app). All processing happens in Stirling's cloud, and every operation costs credits. Free accounts include a monthly allowance; paid plans include more credits. See [Paid Offerings](doc:paid-offerings) for current pricing.\n\n---\n\n## More than 5 users\n\nThe free tier covers up to 5 users. Once you have more than 5, you need a paid Server or Enterprise plan. A paid plan also adds:\n\n- Official support (tickets, SLA, priority responses)\n- SSO, SAML, audit logging, and other paid-tier features\n\nSee [Paid Offerings](doc:paid-offerings) for the full feature comparison or [contact us](https://www.stirling.com/book-a-demo) if you're not sure which plan fits.",
+      "sourcePath": "docs/Modes-and-Licensing.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Modes-and-Licensing.md"
+    },
+    "paid-offerings": {
+      "id": "paid-offerings",
+      "title": "Paid Offerings",
+      "description": "Server and Enterprise paid plans for Stirling PDF",
+      "section": "overview",
+      "markdown": "## Stirling PDF Paid Offerings\n\nStirling PDF offers Server and Enterprise paid plans. These provide the same great software with added features, streamlined license management, and support options.\n\n> This page covers **self-hosted** Server and Enterprise licensing (a flat-rate or per-seat license key, no credits). Stirling Cloud is a separate, credit-based offering - see [Modes](doc:modes-and-licensing) for how the deployment modes compare.\n\n## Available Plans\n\n### Free Plan\n- **Cost**: Free forever\n- **Users**: Up to 5 users\n- **Features**:\n  - Self-hosted deployment\n  - All PDF operations\n  - Community support\n  - Regular updates\n- **Perfect for**: Personal use, small teams, or evaluation\n\n### Server Plan\n- **Cost**: $99/month or $999/year (save $189 with annual billing)\n- **Available billing**: Monthly or Yearly\n- **Users**: Unlimited users (flat rate regardless of user count)\n- **Value**: The more users you have, the better the value (e.g., 100 users = $1/user/month)\n- **Features**:\n  - Self-hosted deployment\n  - All PDF operations\n  - Unlimited users - no per-seat charges\n  - Community support\n  - Regular updates\n  - Support tickets via support@stirlingpdf.com\n  - [External Database](doc:configuration/external-database) support for optimized deployments and load-balancing\n  - Google Drive integration\n  - [OAuth2 SSO](doc:configuration/oauth-sso-configuration) (Google, GitHub, Keycloak, any OIDC provider)\n- **Perfect for**: Organizations with many users who want predictable, flat-rate pricing\n\n### Enterprise Plan\n- **Cost**: Base server price + per-seat licensing (check [stirling.com/pricing](https://stirling.com/pricing))\n- **Available billing**: Monthly or Yearly (save with annual billing)\n- **Users**: Per-seat licensing (flexible scaling)\n- **Features**:\n  - All Server Plan features, plus:\n  - [SAML2 SSO](doc:configuration/saml-sso-configuration/saml-sso-configuration) (Okta, Azure AD, etc.) with automated login handling\n  - Custom automated metadata handling\n  - Priority support tickets via support@stirlingpdf.com\n  - 1:1 meetings with the Stirling PDF team (from registered email domain)\n  - Priority feature enhancements\n  - Prometheus endpoint for advanced usage monitoring\n  - Usage Monitoring UI\n  - Audit logs\n  - SLA guarantee\n  - Custom integrations support\n  - Dedicated account manager\n- **Perfect for**: Large enterprises requiring priority support, SLA guarantees, and per-seat licensing\n\n## Purchasing a License\n\n### In-App Purchase (Recommended)\n\nStirling PDF offers streamlined in-app purchasing and license activation:\n\n1. **Navigate to Settings**: Log in as an admin and go to Settings → Plan\n2. **Select Your Plan**: Choose between Server (unlimited users) or Enterprise (per-seat) plans\n3. **Choose Billing Period**: Select monthly or yearly billing (yearly saves money)\n4. **Complete Checkout**: You'll be redirected to Stripe's secure checkout\n5. **Automatic Activation**: After payment, your license key is automatically retrieved and activated\n6. **Confirmation**: You'll see your active plan status immediately in the Settings\n\n**Benefits of In-App Purchase:**\n- No manual license key entry required\n- Instant activation after payment\n- Manage billing directly from the app\n- Automatic license key synchronization\n- Easy plan upgrades\n\n### Alternative - Contact Us\n\nIf you prefer to purchase outside the app or have questions:\n\n1. Visit [stirling.com/contact](https://stirling.com/contact) or email support@stirlingpdf.com\n2. Our team will assist you with your purchase\n3. You'll receive your license key via email\n4. Follow manual activation steps below\n\n## Activating Your License\n\n### Automatic Activation\n\nIf you purchased in-app, your license is automatically activated. No further action needed!\n\n### Manual Activation\n\nStirling PDF accepts two manual activation inputs from the admin UI: a license **key** (string), or a license **certificate file** (`.lic` / `.cert`, used for offline / air-gapped Enterprise activation).\n\n#### Option 1 - License Key\n\nIf you purchased via the website and received a license key by email:\n\n1. **Admin Settings**: Log in as an admin and navigate to Settings → Plan\n2. **Open License Input**: Expand the \"Got a license key or certificate file?\" section\n3. **Select Input Type**: Make sure \"License Key\" is selected\n4. **Enter License Key**: Paste your license key in the provided field\n5. **Activate**: Save to apply the license\n6. **Confirmation**: Your plan features will be enabled immediately\n\n#### Option 2 - Certificate File (Air-Gapped / Offline)\n\nIf you received a `.lic` or `.cert` certificate file (typically issued for Enterprise customers who need to activate without outbound internet access):\n\n1. **Admin Settings**: Log in as an admin and navigate to Settings → Plan\n2. **Open License Input**: Expand the \"Got a license key or certificate file?\" section\n3. **Select Input Type**: Switch to \"Certificate File\"\n4. **Choose File**: Click \"Choose License File\" and select your `.lic` or `.cert` file (must start with `-----BEGIN LICENSE FILE-----`)\n5. **Upload**: The file is uploaded, validated, saved to your `configs/` folder, and activated automatically. Any previous certificate is backed up to `configs/backup/`\n6. **Confirmation**: Your plan features will be enabled immediately\n\nBoth flows activate dynamically and do not strictly require a restart.\n\n> **Recommended**: Restart the Stirling PDF installation after activation. While the license is applied immediately, restarting ensures all components (security profile, premium feature gates, user/seat counters, scheduled validation jobs) pick up the new license state from a clean startup. This avoids edge cases where cached state from before activation lingers in a long-running process.\n\n### Legacy - settings.yml Activation\n\nFor scripted deployments or fully automated provisioning, you can still activate via `settings.yml` directly:\n\n1. Navigate to the Stirling PDF config folder\n2. Open `settings.yml`\n3. Find the premium section:\n\n```yaml\npremium:\n  key: 00000000-0000-0000-0000-000000000000\n  enabled: false # Enable license key checks for pro/enterprise features\n```\n\n4. Replace the key with your license key\n5. Change `enabled` from `false` to `true`\n6. Restart Stirling PDF\n\nTo reference a certificate file from `settings.yml` instead of uploading via the UI:\n\n  1. Place your `.lic` or `.cert` certificate in the config folder (e.g., `configs/cert.lic`)\n  2. Use the `file:` prefix to point at the certificate path:\n\n  ```yaml\n  premium:\n    key: file:configs/cert.lic\n    enabled: true\n  ```\n\n\n## Managing Your Subscription\n\n### Billing Portal\n\nStirling PDF includes a convenient billing management interface:\n\n1. Navigate to Settings → Plan\n2. On your current plan, click \"Manage\"\n3. You'll be redirected to Stripe's customer portal where you can:\n   - Update payment methods\n   - View invoices\n   - Cancel or modify subscriptions\n   - Update billing information\n\n## Feature Configuration\n\nOnce activated, you can customize premium features in your `settings.yml`:\n\n```yaml\npremium:\n  proFeatures:\n    ssoAutoLogin: false\n    customMetadata:\n      autoUpdateMetadata: false\n      author: username\n      creator: Stirling-PDF\n      producer: Stirling-PDF\n    googleDrive:\n      enabled: false\n      clientId: ''\n      apiKey: ''\n      appId: ''\n```\n\n## License Model\n\nStirling PDF uses an **installation-based licensing model**:\n\n- Each license is tied to a specific installation (identified by machine fingerprint)\n- **Server Plan**: Flat-rate pricing with unlimited users for one installation\n  - $99/month = unlimited users (great value for larger teams)\n  - Example: 100 users = only $1 per user per month\n  - Example: 500 users = only $0.20 per user per month\n- **Enterprise Plan**: Base installation license + per-seat user licensing\n- **Named User Model**: For Enterprise, seats represent unique users who can log in\n  - Example: A company with 10 employees who use Stirling PDF needs 10 seats\n\n## Upgrading Your Plan\n\nYou can upgrade from Free → Server or Server → Enterprise at any time:\n\n1. Navigate to Settings → Plan\n2. On the plan tier you want, click \"Upgrade\"\n3. Complete checkout\n4. Your existing license will be automatically upgraded\n\n**Note**: When upgrading, your new plan starts immediately and you'll be credited for any unused time on your previous plan.\n\n## Support\n\n### Community Support (All Plans)\n- GitHub Issues: [github.com/Stirling-Tools/Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF)\n- Discord: Join our community server\n\n### Email Support (Server & Enterprise)\n- Email: support@stirlingpdf.com\n- Response time: 1-2 business days (Server), Priority response (Enterprise)\n\n### Enterprise Support\n- Priority email support\n- 1:1 meetings with Stirling PDF team\n- Dedicated account manager\n- SLA guarantees\n\n## Frequently Asked Questions\n\n**Q: Can I try before I buy?**\nA: Yes! The Free plan includes all features for up to 5 users. Test thoroughly before upgrading.\n\n**Q: What happens if I cancel?**\nA: Your license remains active until the end of your billing period, then reverts to Free plan limits.\n\n**Q: Can I move my license to a different server?**\nA: Contact support@stirlingpdf.com for license transfers. Enterprise customers have more flexibility.\n\n**Q: Do I need an internet connection?**\nA: License activation requires internet for initial verification. Enterprise customers can request offline certificate files.\n\n**Q: What's the difference between monthly and yearly billing?**\nA: Yearly billing offers significant savings. For Server plan: $999/year vs $1,188/year monthly (save $189 = almost 2 months free).\n\n**Q: How do I get an invoice?**\nA: Invoices are automatically sent via email and accessible through the Billing Portal.\n\n## Migration from V1\n\nIf you're upgrading from Stirling PDF V1 with an existing license:\n\n1. Your existing license key will continue to work\n2. You can enter it manually via Settings → Plan\n3. Or, re-activate through the in-app purchase flow\n4. Contact support@stirlingpdf.com if you encounter any issues\n\n---\n\nFor pricing details, visit [stirling.com/pricing](https://stirling.com/pricing)\n\nFor technical support, email support@stirlingpdf.com",
+      "sourcePath": "docs/Paid-Offerings.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Paid-Offerings.md"
+    },
+    "server-admin-onboarding": {
+      "id": "server-admin-onboarding",
+      "title": "Production Deployment Guide",
+      "description": "Complete production deployment guide for server administrators deploying Stirling-PDF",
+      "section": "overview",
+      "markdown": "Welcome! This guide will walk you through deploying Stirling-PDF for your organization, from initial installation to advanced configuration and scaling.\n\n> **💡 Tip: For Organizations & Teams**\n>\n> This guide is designed for server administrators deploying Stirling-PDF for teams, departments, or entire organizations. If you're interested in **paid plan features** (external database, Google Drive, SSO, advanced user management, priority support), we'll highlight upgrade paths throughout this guide.\n\n\n---\n\n## Overview: What You'll Accomplish\n\nBy the end of this guide, you'll have:\n\n1. ✅ **Stirling-PDF running** on your infrastructure\n2. ✅ **User authentication configured** with admin access\n3. ✅ **Settings customized** for your organization\n4. ✅ **Security hardened** with HTTPS and proper access controls\n5. ✅ **Monitoring setup** to track usage and performance\n6. ✅ **Understanding of paid plan** upgrade paths (Server/Enterprise)\n\n**Time estimate:** 30-60 minutes for basic setup, 2-3 hours for full enterprise configuration\n\n---\n\n## Step 1: Choose Your Deployment Path\n\n\n\n\n**Best for:** Most organizations, production deployments, easy management\n\n**Why Docker Compose?**\n- ✅ Simple one-command deployment\n- ✅ Easy updates and rollbacks\n- ✅ Persistent data management\n- ✅ Production-ready configuration\n- ✅ Easy to scale and customize\n\n**Requirements:**\n- Docker Engine 20.10+\n- Docker Compose 1.29+\n- 2GB RAM minimum (4GB+ recommended)\n- 10GB disk space\n\n**Jump to:** [Docker Compose Setup](#docker-compose-setup)\n\n\n\n\n**Best for:** Quick testing, single-container deployments, learning\n\n**Why Docker Run?**\n- ✅ Fastest way to get started\n- ✅ Single command deployment\n- ✅ Good for testing before production\n- ⚠️ More manual management needed\n\n**Requirements:**\n- Docker Engine 20.10+\n- 2GB RAM minimum\n- 5GB disk space\n\n**Jump to:** [Docker Run Setup](#docker-run-setup)\n\n\n\n\n**Best for:** Enterprise scale, high availability, cloud-native deployments\n\n**Why Kubernetes?**\n- ✅ Auto-scaling capabilities\n- ✅ High availability and fault tolerance\n- ✅ Load balancing built-in\n- ✅ Cloud provider integration\n- ⚠️ More complex to set up\n\n**Requirements:**\n- Kubernetes cluster 1.19+\n- kubectl configured\n- Persistent volume support\n- Load balancer support\n\n**Jump to:** [Kubernetes Guide](doc:installation/kubernetes)\n\n\n\n\n**Best for:** Environments without Docker, specific OS requirements\n\n**Why Bare Metal?**\n- ✅ Maximum control\n- ✅ No container overhead\n- ✅ Custom Java configurations\n- ⚠️ More maintenance required\n\n**Requirements:**\n- Java 25+\n- Linux/Unix system\n- 2GB RAM minimum\n- LibreOffice, Tesseract (for features)\n\n**Jump to:** [Unix Installation Guide](doc:installation/unix)\n\n\n\n\n---\n\n## Step 2: Installation\n\nFollow the installation instructions for your chosen deployment method from Step 1.\n\n\n\n\n### Docker Compose Setup\n\nThis is the recommended approach for production deployments.\n\n#### 2.1: Create docker-compose.yml\n\nCreate a directory for your Stirling-PDF deployment:\n\n```bash\nmkdir -p ~/stirling-pdf\ncd ~/stirling-pdf\n```\n\nCreate `docker-compose.yml` with this production-ready configuration:\n\n```yaml\n\nservices:\n  stirling-pdf:\n    image: stirlingtools/stirling-pdf:latest\n    container_name: stirling-pdf\n    ports:\n      - '8080:8080'\n    volumes:\n      # Persistent data storage\n      - ./stirling-data/tessdata:/usr/share/tessdata    # OCR language files\n      - ./stirling-data/configs:/configs                 # Settings & database\n      - ./stirling-data/logs:/logs                       # Application logs\n      - ./stirling-data/customFiles:/customFiles:rw      # Custom branding files\n      - ./stirling-data/pipeline:/pipeline               # Automation configs\n    environment:\n      # Core Settings\n      - SECURITY_ENABLELOGIN=true            # Enable user authentication\n\n      # Language & Localization\n      - SYSTEM_DEFAULTLOCALE=en-US           # Default UI locale for new users\n\n      # System Configuration\n      - SYSTEM_GOOGLEVISIBILITY=false        # Hide from search engines\n      - SYSTEM_ROOTURIPATH=/                 # Base URL path\n      - SYSTEMFILEUPLOADLIMIT=2000MB         # Max upload size (legacy: SYSTEM_MAXFILESIZE in MB)\n\n    restart: unless-stopped\n\n    # Optional: Resource limits\n    deploy:\n      resources:\n        limits:\n          memory: 4G\n          cpus: '2.0'\n        reservations:\n          memory: 2G\n          cpus: '1.0'\n```\n\n#### 2.2: Start Stirling-PDF\n\n```bash\n# Start the container\ndocker-compose up -d\n\n# Check if it's running\ndocker-compose ps\n\n# View logs\ndocker-compose logs -f\n```\n\n#### 2.3: Verify Installation\n\nOpen your browser and navigate to:\n```\nhttp://your-server-ip:8080\n```\n\nYou should see the Stirling-PDF homepage!\n\n> **💡 Tip: Success!**\n>\n> If you see the Stirling-PDF interface, your installation is successful. Continue to Step 3 to set up authentication.\n\n\n**Troubleshooting:**\n- **Can't connect?** Check firewall rules: `sudo ufw allow 8080`\n- **Container won't start?** Check logs: `docker-compose logs`\n- **Permission errors?** Fix permissions: `sudo chmod -R 755 ./stirling-data`\n\n\n\n\n### Docker Run Setup\n\nFor quick testing or simpler deployments.\n\n#### 2.1: Create Data Directory and Run Container\n\n```bash\n# Create data directory\nmkdir -p ~/stirling-data\n\n# Run Stirling-PDF\ndocker run -d \\\n  --name stirling-pdf \\\n  -p 8080:8080 \\\n  -v ~/stirling-data/tessdata:/usr/share/tessdata \\\n  -v ~/stirling-data/configs:/configs \\\n  -v ~/stirling-data/logs:/logs \\\n  -v ~/stirling-data/customFiles:/customFiles:rw \\\n  -e SECURITY_ENABLELOGIN=true \\\n  -e SYSTEM_DEFAULTLOCALE=en-US \\\n  -e SYSTEM_GOOGLEVISIBILITY=false \\\n  -e SYSTEMFILEUPLOADLIMIT=2000MB \\\n  --restart unless-stopped \\\n  stirlingtools/stirling-pdf:latest\n```\n\n#### 2.2: Verify Installation\n\n```bash\n# Check if running\ndocker ps | grep stirling-pdf\n\n# View logs\ndocker logs -f stirling-pdf\n```\n\nOpen your browser and navigate to:\n```\nhttp://your-server-ip:8080\n```\n\nYou should see the Stirling-PDF homepage!\n\n> **💡 Tip: Success!**\n>\n> If you see the Stirling-PDF interface, your installation is successful. Continue to Step 3 to set up authentication.\n\n\n**Troubleshooting:**\n- **Can't connect?** Check firewall rules: `sudo ufw allow 8080`\n- **Container won't start?** Check logs: `docker logs stirling-pdf`\n- **Permission errors?** Fix permissions: `sudo chmod -R 755 ~/stirling-data`\n\n\n\n\n### Kubernetes Setup\n\nFor enterprise-scale deployments with high availability.\n\nKubernetes deployment requires:\n- Persistent Volume Claims (PVCs)\n- Deployments and Services\n- Ingress/LoadBalancer configuration\n- Resource limits and autoscaling\n\n**See full guide:** [Kubernetes Installation Guide](doc:installation/kubernetes)\n\nThis includes complete YAML configurations, namespace setup, SSL/TLS, and horizontal pod autoscaling.\n\n\n\n\n### Bare Metal Setup\n\nFor environments without Docker or specific OS requirements.\n\nBare metal installation requires:\n- Java 25+\n- LibreOffice (for conversions)\n- Tesseract OCR (for OCR features)\n- Systemd service setup\n\n**See full guide:** [Unix Installation Guide](doc:installation/unix)\n\nThis includes complete dependency installation, JAR setup, systemd configuration, and troubleshooting.\n\n\n\n\n---\n\n## Step 3: Initial Login & Admin Setup\n\nNow that Stirling-PDF is running with authentication enabled, you need to create your admin account.\n\n### 3.1: First-Time Login\n\n1. **Navigate to your Stirling-PDF instance:**\n   ```\n   http://your-server-ip:8080\n   ```\n\n2. **Log in with default credentials:**\n   ```\n   Username: admin\n   Password: stirling\n   ```\n\n3. **Change the default password immediately:**\n   - After first login, go to Settings → Account\n   - Change to a strong password (12+ characters, mixed case, numbers, symbols)\n\n> **💡 Tip: Customizing Default Credentials**\n>\n> You can set custom default credentials **before first startup** using environment variables:\n>\n> ```yaml\n> environment:\n>   - SECURITY_INITIALLOGIN_USERNAME=youradmin\n>   - SECURITY_INITIALLOGIN_PASSWORD=YourSecurePassword123!\n> ```\n>\n> **Important:** These only work on first startup. If you change them after the database is created, the old credentials remain active. Always change the password through the UI after first login.\n\n\n> **💡 Tip: User Registration**\n>\n> After first login, you can control how additional users are created through Settings → Security (covered in Step 4).\n\n\n### 3.2: Verify Admin Access\n\n1. **Log in with your admin account**\n\n2. **Click the Settings gear icon** ⚙️ in the top navigation bar\n\n3. **Verify you have admin access** by checking for admin-only sections:\n   - **General Settings** - System configuration\n   - **Security Settings** - User management, login settings\n   - **UI Customization** - Branding and appearance\n   - **User Management** - Create/manage users\n   - **Endpoint Configuration** - Enable/disable tools\n\n   **Note:** Regular users can also access Settings but only see their personal preferences (language, theme). Only admins see the sections listed above.\n\n4. **If you don't see admin sections:**\n   - Check logs: `docker logs stirling-pdf`\n   - Verify you're the first user created\n   - Confirm `SECURITY_ENABLELOGIN=true` is set\n\n> **⚠️ Warning: Secure Your Admin Account**\n>\n> - **Change the default password immediately** after first login\n> - Use a strong password (12+ characters, mixed case, numbers, symbols)\n> - Consider using SSO (OAuth2/SAML2) to avoid password management entirely\n\n\n---\n\n## Step 4: Configure Essential Settings\n\nNow that you're logged in as admin, let's configure Stirling-PDF for your organization.\n\n### 4.1: General Settings\n\nNavigate to **Settings → General**\n\n\n\n\n**These settings should be configured immediately:**\n\n#### System Locale & Language\n```yaml\nsystem:\n  defaultLocale: en-US  # or en-GB, de-DE, fr-FR, etc.\n\nui:\n  languages: []  # Empty = all languages enabled. Or specify: [\"en_GB\", \"de_DE\", \"fr_FR\"]\n```\n\n**Why:** Ensures UI appears in the correct language for your users\n\n#### Search Engine Visibility\n```yaml\nsystem:\n  googlevisibility: false  # Prevents search engines from indexing your site\n```\n\n**Why:** Keeps your internal PDF tool private\n\n#### File Upload Limits\n```yaml\nsystem:\n  fileUploadLimit: 2000MB  # or \"2GB\" - adjust based on your needs\n```\n\n**Why:** Prevents users from uploading files that crash the system\n\n\n\n\n**Configure these for better user experience:**\n\n#### Legal & Compliance\n```yaml\nlegal:\n  termsAndConditions: https://yourcompany.com/tos  # or empty string to disable\n  privacyPolicy: https://yourcompany.com/privacy  # or empty string to disable\n  accessibilityStatement: ''  # optional\n  cookiePolicy: ''  # optional\n  impressum: ''  # optional (required in some countries like Germany)\n```\n\n**Why:** Legal compliance, especially in GDPR/regulated industries\n\n#### Update Notifications (Optional)\n```yaml\nsystem:\n  showUpdate: false  # Set true to show update notifications\n  showUpdateOnlyAdmin: false  # Only admins see updates (requires showUpdate: true)\n```\n\n**Why:** Control update notifications in production environments\n\n#### Process Limits\n```yaml\nprocessExecutor:\n  sessionLimit:\n    libreOfficeSessionLimit: 1\n    tesseractSessionLimit: 1\n    pythonOpenCvSessionLimit: 8\n  timeoutMinutes:\n    libreOfficetimeoutMinutes: 30\n    tesseractTimeoutMinutes: 30\n```\n\n**Why:** Prevents resource exhaustion based on your server capacity\n\n\n\n\n### 4.2: Security Settings\n\nNavigate to **Settings → Security**\n\n> **⚠️ Warning: Critical for Production**\n>\n> These settings directly impact your organization's security. Review carefully!\n\n\n#### User Registration Control\n\n\n\n\n**Best for:** Controlled environments, enterprises, security-conscious orgs\n\n**How it works:**\n1. Admin creates user accounts manually in Settings → User Management\n2. Admin shares credentials with users securely\n3. Users log in with provided credentials\n\n**Email Invitations (Optional):**\nIf you configure email, admins can send invitation links instead.\n\n\n\n\n```yaml\nmail:\n  enabled: true\n  enableInvites: true\n  host: smtp.gmail.com\n  port: 587\n  username: noreply@yourcompany.com\n  password: ${MAIL_PASSWORD}  # Use environment variable\n  from: noreply@yourcompany.com\n  startTlsEnable: true  # STARTTLS upgrade after connecting (port 587)\n```\n\n\n\n\n```bash\nMAIL_ENABLED=true\nMAIL_ENABLEINVITES=true\nMAIL_HOST=smtp.gmail.com\nMAIL_PORT=587\nMAIL_USERNAME=noreply@yourcompany.com\nMAIL_PASSWORD=your-app-password\nMAIL_FROM=noreply@yourcompany.com\nMAIL_STARTTLSENABLE=true\n```\n\n\n\n\n\n\n\n**Best for:** Large enterprises, existing SSO infrastructure\n\n**Single Sign-On (SSO) options:**\n- **OAuth2:** Server tier - Supports Google, GitHub, Keycloak, any OpenID Connect provider\n- **SAML2:** Enterprise tier - Supports Okta, Azure AD, etc.\n\n**Key settings:**\n```yaml\nsecurity:\n  enableLogin: true\n  loginMethod: oauth2  # or 'saml2' or 'all'\n  oauth2:\n    enabled: true\n    autoCreateUser: true  # Auto-create users on first login\n    blockRegistration: false  # Set true to require admin pre-registration\n```\n\n**Benefits:**\n- ✅ No password management\n- ✅ Centralized access control\n- ✅ Automatic user provisioning\n- ✅ Corporate policy compliance\n\n**See full guide:** [SSO Configuration Guide](doc:configuration/single-sign-on-configuration)\n\nComplete configuration examples for Google, GitHub, Keycloak, Okta, Azure AD, and generic OIDC/SAML2 providers.\n\n\n\n\n#### Login Security Settings\n\n```yaml\nsecurity:\n  loginAttemptCount: 5  # Lock account after 5 failed attempts\n  loginResetTimeMinutes: 120  # Unlock after 2 hours\n```\n\n**Notes:**\n- Session timeout is not configurable via settings\n- Password policies (length, complexity) are not currently configurable\n- Use SSO/OAuth2 for enterprise password policies\n\n### 4.3: Feature Control\n\nNavigate to **Settings → Endpoints**\n\nControl which PDF tools are available to users.\n\n\n\n\n**All tools are enabled by default.** You can disable specific tools if needed:\n\n```yaml\nendpoints:\n  toRemove: []  # Add tool IDs to disable, e.g. ['sign', 'add-password']\n  groupsToRemove: []  # Disable entire groups, e.g. ['LibreOffice']\n```\n\n**Most organizations don't need to disable anything** - all tools are useful and safe\n\n\n\n\n**Example: Disable security-sensitive tools:**\n\n```yaml\nendpoints:\n  toRemove:\n    - 'add-password'  # Disable password protection tool\n    - 'remove-password'  # Disable password removal tool\n    - 'change-permissions'  # Disable permissions modification\n```\n\n**Example: Disable entire groups:**\n\n```yaml\nendpoints:\n  groupsToRemove:\n    - 'LibreOffice'  # Disables all LibreOffice-based conversions\n```\n\n**How to disable in UI:**\n1. Log in as admin\n2. Go to Settings → Endpoints\n3. In \"Disabled Endpoints\", select the tools you want to disable (or use \"Disabled Endpoint Groups\" for whole groups)\n4. Save changes\n\n**See all tool IDs:** [Endpoint Customisation](doc:configuration/endpoint-or-feature-customisation)\n\n\n\n\n### 4.4: Save and Apply Settings\n\nAfter configuring all settings:\n\n1. **Click \"Save\" button** at the bottom of each settings page\n2. **Verify settings saved** - You should see a success message\n3. **Some settings require restart** - Check if restart notification appears\n4. **Test changes** - Log out and log in as a regular user to verify\n\n**If restart is needed:**\n```bash\n# Docker Compose\ndocker-compose restart\n\n# Docker Run\ndocker restart stirling-pdf\n```\n\n---\n\n## Step 5: HTTPS & Domain Setup\n\n> **🚫 Danger: Production Requirement**\n>\n> **Never run in production without HTTPS.** User credentials and PDF files will be transmitted in plain text over the network.\n\n\n### 5.1: Choose Your HTTPS Method\n\n\n\n\n**Best for:** Simple deployments, no reverse proxy needed\n\nStirling-PDF can handle HTTPS directly using built-in SSL configuration.\n\n#### Configure SSL in Stirling-PDF\n\n1. **Generate or obtain SSL certificate:**\n\n   **Option A: Self-signed (for testing/internal use):**\n   ```bash\n   # Generate self-signed certificate\n   keytool -genkeypair \\\n     -alias stirling \\\n     -keyalg RSA \\\n     -keysize 2048 \\\n     -storetype PKCS12 \\\n     -keystore keystore.p12 \\\n     -validity 365\n\n   # Move to configs directory\n   mv keystore.p12 ./stirling-data/configs/\n   ```\n\n   **Option B: Let's Encrypt (for production):**\n   ```bash\n   # Get certificate with certbot\n   sudo certbot certonly --standalone -d pdf.yourcompany.com\n\n   # Convert to PKCS12 format\n   sudo openssl pkcs12 -export \\\n     -in /etc/letsencrypt/live/pdf.yourcompany.com/fullchain.pem \\\n     -inkey /etc/letsencrypt/live/pdf.yourcompany.com/privkey.pem \\\n     -out keystore.p12 \\\n     -name stirling\n\n   # Move to configs\n   sudo mv keystore.p12 ./stirling-data/configs/\n   sudo chown $USER:$USER ./stirling-data/configs/keystore.p12\n   ```\n\n2. **Create custom_settings.yml:**\n\n   Create `./stirling-data/configs/custom_settings.yml`:\n   ```yaml\n   server:\n     port: 8443  # HTTPS port\n     ssl:\n       enabled: true\n       key-store: file:/configs/keystore.p12\n       key-store-password: your-keystore-password\n       key-store-type: PKCS12\n       key-alias: stirling\n   ```\n\n3. **Update docker-compose.yml to expose port 8443:**\n   ```yaml\n   services:\n     stirling-pdf:\n       ports:\n         - '8443:8443'  # Change from 8080:8080\n   ```\n\n4. **Restart Stirling-PDF:**\n   ```bash\n   docker-compose down\n   docker-compose up -d\n   ```\n\n5. **Access via HTTPS:**\n   ```\n   https://pdf.yourcompany.com:8443\n   ```\n\n**Benefits:**\n- ✅ Simple setup, no reverse proxy needed\n- ✅ Direct SSL termination in application\n- ✅ Good for small deployments\n\n**Limitations:**\n- ⚠️ Manual certificate renewal\n- ⚠️ No load balancing\n- ⚠️ Port 8443 instead of standard 443\n\n**Learn more:** [Custom Settings - SSL Configuration](doc:configuration/extra-settings)\n\n\n\n\n**Best for:** Production deployments, standard ports (443), load balancing\n\nUse a reverse proxy like **Nginx, Apache, or Traefik** to handle HTTPS.\n\n#### Option A: Nginx with Let's Encrypt\n\n**Install Nginx and Certbot:**\n```bash\nsudo apt update\nsudo apt install nginx certbot python3-certbot-nginx\n```\n\n**Configure Nginx:**\n\nCreate `/etc/nginx/sites-available/stirling-pdf`:\n```nginx\nserver {\n    listen 80;\n    server_name pdf.yourcompany.com;\n\n    # Redirect HTTP to HTTPS\n    return 301 https://$server_name$request_uri;\n}\n\nserver {\n    listen 443 ssl http2;\n    server_name pdf.yourcompany.com;\n\n    # SSL certificates (will be added by certbot)\n    ssl_certificate /etc/letsencrypt/live/pdf.yourcompany.com/fullchain.pem;\n    ssl_certificate_key /etc/letsencrypt/live/pdf.yourcompany.com/privkey.pem;\n\n    # Strong SSL settings\n    ssl_protocols TLSv1.2 TLSv1.3;\n    ssl_ciphers HIGH:!aNULL:!MD5;\n    ssl_prefer_server_ciphers on;\n\n    # Security headers\n    add_header Strict-Transport-Security \"max-age=31536000; includeSubDomains\" always;\n    add_header X-Frame-Options \"SAMEORIGIN\" always;\n    add_header X-Content-Type-Options \"nosniff\" always;\n    add_header X-XSS-Protection \"1; mode=block\" always;\n\n    # Large file uploads\n    client_max_body_size 2000M;\n    client_body_timeout 300s;\n\n    # Proxy to Stirling-PDF\n    location / {\n        proxy_pass http://localhost:8080;\n        proxy_set_header Host $host;\n        proxy_set_header X-Real-IP $remote_addr;\n        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n        proxy_set_header X-Forwarded-Proto $scheme;\n\n        # WebSocket support (if needed)\n        proxy_http_version 1.1;\n        proxy_set_header Upgrade $http_upgrade;\n        proxy_set_header Connection \"upgrade\";\n\n        # Timeouts for large files\n        proxy_connect_timeout 300s;\n        proxy_send_timeout 300s;\n        proxy_read_timeout 300s;\n    }\n}\n```\n\n**Enable site and get certificate:**\n```bash\n# Enable site\nsudo ln -s /etc/nginx/sites-available/stirling-pdf /etc/nginx/sites-enabled/\nsudo nginx -t\nsudo systemctl reload nginx\n\n# Get Let's Encrypt certificate\nsudo certbot --nginx -d pdf.yourcompany.com\n\n# Auto-renewal (certbot sets this up automatically)\nsudo certbot renew --dry-run\n```\n\n**Update DNS:**\n```\nA record: pdf.yourcompany.com → your-server-ip\n```\n\n**Access your site:**\n```\nhttps://pdf.yourcompany.com\n```\n\n\n\n\n**Best for:** Docker environments, automatic certificate management\n\nTraefik is a Docker-native reverse proxy that automatically:\n- Obtains SSL certificates from Let's Encrypt\n- Renews certificates automatically\n- Routes traffic based on Docker labels\n\n**Key benefits:**\n- ✅ Zero-config certificate management\n- ✅ Docker label-based routing\n- ✅ Automatic service discovery\n\nAdd Traefik container to your `docker-compose.yml` and configure Stirling-PDF with Docker labels for routing.\n\n**See Traefik documentation:** https://doc.traefik.io/traefik/user-guides/docker-compose/basic-example/\n\n\n\n\n**Best for:** No public IP, behind firewall, home servers\n\nCloudflare Tunnel provides:\n- ✅ No port forwarding needed\n- ✅ DDoS protection included\n- ✅ Automatic HTTPS\n- ✅ Free for most use cases\n\n**Quick setup:**\n1. Install `cloudflared`\n2. Authenticate with Cloudflare\n3. Create tunnel pointing to `http://localhost:8080`\n4. Add DNS record\n5. Run as system service\n\n**See Cloudflare documentation:** https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/install-and-setup/tunnel-guide/\n\n\n\n\n### 5.2: Update Stirling-PDF Configuration\n\nAfter setting up HTTPS, update Stirling-PDF to use the correct URL:\n\n**In Settings → General:**\n```yaml\nSystem Settings:\n  Root URI Path: / (or /pdf if using subdirectory)\n  Frontend URL: https://pdf.yourcompany.com\n  CORS Allowed Origins: https://pdf.yourcompany.com\n```\n\n---\n\n## Step 6: User Management\n\nNow that your system is secure and accessible, let's set up users.\n\n### 6.1: Understanding User Roles\n\n\n\n\n**Out-of-the-box roles:**\n\n| Role | Permissions | Use Case |\n|------|-------------|----------|\n| **Admin** | Full access to all features, settings, user management | System administrators, IT staff |\n| **User** | Access to enabled PDF tools, no settings access | Regular employees, end users |\n\n**Admin capabilities:**\n- ✅ Access all PDF tools\n- ✅ Manage users (create, delete, reset passwords)\n- ✅ Configure all settings\n- ✅ View usage statistics\n- ✅ Enable/disable features\n- ✅ View logs (if configured)\n\n**User capabilities:**\n- ✅ Access enabled PDF tools only\n- ✅ Upload and process files\n- ✅ Download results\n- ❌ No settings access\n- ❌ No user management\n- ❌ No system configuration\n\n\n\n\n### 6.2: Adding Users\n\n\n\n\n**As admin, manually create user accounts:**\n\n1. **Navigate to Settings → User Management**\n\n2. **Click \"Add User\" button**\n\n3. **Fill in user details:**\n   ```\n   Username: john.doe\n   Email: john.doe@yourcompany.com (optional but recommended)\n   Password: Auto-generate or set manually\n   Role: User (or Admin for additional admins)\n   Enabled: Yes\n   ```\n\n4. **Click \"Create User\"**\n\n5. **Share credentials with user** (via secure channel)\n\n**Bulk user creation:**\nYou can paste a list of email addresses (one per line) to create multiple users at once.\n\n**Best practices:**\n- Use email as username for easier identification\n- Auto-generate strong passwords\n- Keep records of who has access\n\n\n\n\n**Send email invitations** (requires email configuration):\n\n1. **Navigate to Settings → User Management**\n\n2. **Click \"Invite User\" button**\n\n3. **Fill in details:**\n   ```\n   Email: jane.smith@yourcompany.com\n   Role: User\n   Message: Optional welcome message\n   ```\n\n4. **Click \"Send Invitation\"**\n\n5. **User receives email** with magic link to register\n\n6. **User clicks link, creates password, and is automatically logged in**\n\n**Bulk invitations:**\nYou can paste a list of email addresses (one per line) to send multiple invitations at once.\n\n**Benefits:**\n- ✅ More secure (user sets own password)\n- ✅ Professional onboarding experience\n- ✅ Magic link authentication\n- ✅ No need to share passwords\n\n**Email configuration required:**\n```yaml\nEmail Settings:\n  SMTP Host: smtp.gmail.com\n  SMTP Port: 587\n  SMTP Username: noreply@yourcompany.com\n  SMTP Password: your-app-password\n  From Address: noreply@yourcompany.com\n```\n\n\n\n\n### 6.3: User Management Tasks\n\n**Common admin tasks:**\n\n#### View All Users\n- Navigate to **Settings → User Management**\n- See list of all users with status, role, last login\n\n#### Reset User Password\n1. Find user in user list\n2. Click \"Reset Password\" button\n3. New password generated or set manually\n4. Share new password securely\n\n#### Disable/Enable User\n1. Find user in user list\n2. Toggle \"Enabled\" switch\n3. Disabled users cannot log in\n\n#### Delete User\n1. Find user in user list\n2. Click \"Delete\" button\n3. Confirm deletion\n4. ⚠️ **Warning:** This is permanent\n\n#### Change User Role\n1. Find user in user list\n2. Change role dropdown (User/Admin)\n3. Save changes\n\n---\n\n## Step 7: Monitoring & Usage Tracking\n\nUnderstanding how your users are using Stirling-PDF helps with capacity planning and identifying issues.\n\n### 7.1: Basic Monitoring\n\n\n\n\n**View application logs:**\n\n```bash\n# Docker Compose\ndocker-compose logs -f stirling-pdf\n\n# Docker Run\ndocker logs -f stirling-pdf\n\n# Last 100 lines\ndocker logs --tail 100 stirling-pdf\n\n# Filter for errors\ndocker logs stirling-pdf 2>&1 | grep ERROR\n```\n\n**What to look for:**\n- ✅ Successful operations\n- ⚠️ Warnings (disk space, memory)\n- ❌ Errors (failed operations, crashes)\n- 🔒 Security events (failed logins, unauthorized access)\n\n**Common log entries:**\n```\nINFO: User john.doe uploaded file document.pdf\nINFO: Operation MERGE completed successfully\nWARN: Disk space low: 85% used\nERROR: OCR operation failed: Tesseract not found\n```\n\n\n\n\n#### Basic API Monitoring\n\n**Usage Statistics API** (available to all users):\n```bash\n# Application status\ncurl http://localhost:8080/api/v1/info/status\n\n# Request counts\ncurl http://localhost:8080/api/v1/info/requests/all\n\n# Unique users\ncurl http://localhost:8080/api/v1/info/requests/all/unique\n```\n\n**Health Check Endpoint:**\n```bash\ncurl http://localhost:8080/api/v1/info/status\n\n# Response:\n{\"status\":\"UP\",\"version\":\"<version>\"}\n```\n\nUse `/api/v1/info/status` for health and uptime checks - it is always reachable without authentication.\n\n**Use for:**\n- Load balancer health checks\n- Uptime monitoring (Uptime Robot, Pingdom)\n- Custom monitoring scripts\n\n#### Prometheus Integration (Enterprise)\n\nStirling-PDF Enterprise plan supports Prometheus metrics for advanced monitoring.\n\n**Learn more:** [Usage Monitoring - Prometheus Setup](doc:configuration/usage-monitoring)\n\n**Features:**\n- JVM metrics (memory, GC, threads)\n- System metrics (CPU, disk)\n- Application metrics (request rates, processing times)\n- PDF processing metrics\n\n#### Log Aggregation\n\nForward logs to centralized logging:\n\n**Option 1: Docker log driver**\n```yaml\nservices:\n  stirling-pdf:\n    logging:\n      driver: \"json-file\"\n      options:\n        max-size: \"10m\"\n        max-file: \"3\"\n```\n\n**Option 2: Syslog**\n```yaml\nservices:\n  stirling-pdf:\n    logging:\n      driver: syslog\n      options:\n        syslog-address: \"tcp://your-syslog-server:514\"\n```\n\n**Popular log aggregation tools:**\n- ELK Stack (Elasticsearch, Logstash, Kibana)\n- Splunk\n- Graylog\n- Datadog\n\n\n\n\n### 7.2: Set Up Monitoring\n\n**Basic monitoring approach:**\n\n1. **Monitor Docker logs regularly:**\n   ```bash\n   docker logs stirling-pdf --tail 100 -f\n   ```\n\n2. **Check Docker container health:**\n   ```bash\n   docker ps\n   docker stats stirling-pdf\n   ```\n\n3. **Monitor disk space:**\n   ```bash\n   df -h\n   du -sh ./stirling-data/*\n   ```\n\n4. **Use external uptime monitoring:**\n   - Uptime Robot (free)\n   - Pingdom\n   - StatusCake\n   - Monitor the status endpoint: `http://localhost:8080/api/v1/info/status`\n\n---\n\n## Step 8: Backup & Disaster Recovery\n\nProtect your users' data and configuration with proper backups.\n\n### 8.1: What to Backup\n\n**Critical data to backup:**\n\n| Data | Location | Frequency | Importance |\n|------|----------|-----------|------------|\n| **User Database (if local)** | `./stirling-data/configs/stirling-pdf-DB-<schema-version>.mv.db` | Daily | Critical* |\n| **Settings File** | `./stirling-data/configs/settings.yml` | After changes | Critical |\n| **Custom Files** | `./stirling-data/customFiles/` | After changes | High |\n| **OCR Languages** | `./stirling-data/tessdata/` | Weekly | Medium |\n| **Logs** | `./stirling-data/logs/` | Optional | Low |\n\n**\\*Note on User Database:**\n- **Free edition:** Uses a local H2 database file named `stirling-pdf-DB-<schema-version>.mv.db` (the schema version is embedded in the filename, e.g. `stirling-pdf-DB-2.3.232.mv.db`) - must be backed up. The simplest approach is to back up the whole `configs/` directory.\n- **Server/Enterprise:** Should use external PostgreSQL database (backed up separately)\n\n> **💡 Tip: Server/Enterprise Recommendation**\n>\n> Server and Enterprise plan users should configure an external PostgreSQL database instead of using the local H2 database. This provides better reliability, scalability, and backup capabilities.\n>\n> **Learn more:** [External Database Configuration](doc:configuration/external-database)\n\n\n### 8.2: Backup Strategies\n\n\n\n\n**Create automated backup script:**\n\nCreate `backup-stirling.sh`:\n```bash\n#!/bin/bash\n\n# Configuration\nBACKUP_DIR=\"/backups/stirling-pdf\"\nSTIRLING_DATA=\"/path/to/stirling-data\"\nRETENTION_DAYS=30\n\n# Create backup directory\nmkdir -p \"$BACKUP_DIR\"\n\n# Generate timestamp\nTIMESTAMP=$(date +%Y%m%d-%H%M%S)\nBACKUP_FILE=\"$BACKUP_DIR/stirling-backup-$TIMESTAMP.tar.gz\"\n\n# Stop container (optional, for consistency)\n# docker-compose -f /path/to/docker-compose.yml stop stirling-pdf\n\n# Create backup\ntar -czf \"$BACKUP_FILE\" \\\n  -C \"$STIRLING_DATA\" \\\n  configs/ \\\n  customFiles/ \\\n  tessdata/\n\n# Start container (if stopped)\n# docker-compose -f /path/to/docker-compose.yml start stirling-pdf\n\n# Delete old backups\nfind \"$BACKUP_DIR\" -name \"stirling-backup-*.tar.gz\" -mtime +$RETENTION_DAYS -delete\n\n# Log result\necho \"[$TIMESTAMP] Backup completed: $BACKUP_FILE\"\n```\n\n**Make executable and schedule:**\n```bash\nchmod +x backup-stirling.sh\n\n# Add to crontab (daily at 2 AM)\ncrontab -e\n# Add: 0 2 * * * /path/to/backup-stirling.sh >> /var/log/stirling-backup.log 2>&1\n```\n\n\n\n\n**Backup Docker volumes:**\n\n```bash\n# Stop container\ndocker-compose stop stirling-pdf\n\n# Backup volumes\ndocker run --rm \\\n  -v $(pwd)/stirling-data:/data \\\n  -v $(pwd)/backups:/backup \\\n  alpine tar -czf /backup/stirling-data-$(date +%Y%m%d).tar.gz /data\n\n# Start container\ndocker-compose start stirling-pdf\n```\n\n**Automated with Cron:**\nCreate `docker-volume-backup.sh`:\n```bash\n#!/bin/bash\ncd /path/to/stirling-pdf\ndocker-compose stop stirling-pdf\ndocker run --rm \\\n  -v \"$(pwd)/stirling-data:/data\" \\\n  -v \"$(pwd)/backups:/backup\" \\\n  alpine tar -czf /backup/stirling-data-$(date +%Y%m%d).tar.gz /data\ndocker-compose start stirling-pdf\n\n# Cleanup old backups (keep 30 days)\nfind backups/ -name \"stirling-data-*.tar.gz\" -mtime +30 -delete\n```\n\n\n\n\n### 8.3: Restore from Backup\n\n**Restore procedure:**\n\n1. **Stop Stirling-PDF:**\n   ```bash\n   docker-compose stop stirling-pdf\n   ```\n\n2. **Extract backup:**\n   ```bash\n   tar -xzf stirling-backup-YYYYMMDD-HHMMSS.tar.gz -C ./stirling-data/\n   ```\n\n3. **Verify files restored:**\n   ```bash\n   ls -la ./stirling-data/configs/\n   # Should see: stirling-pdf-DB-<schema-version>.mv.db, settings.yml\n   ```\n\n4. **Start Stirling-PDF:**\n   ```bash\n   docker-compose start stirling-pdf\n   ```\n\n5. **Verify functionality:**\n   - Access web interface\n   - Log in as admin\n   - Check users exist\n   - Verify settings\n\n---\n\n## Step 9: Performance Optimization\n\nFor resource sizing recommendations, scaling guidance, and fine tuning, see the dedicated [Performance Optimization & Sizing](doc:configuration/performance-optimization) guide.\n\n---\n\n## Step 10: Paid Plans (Server/Enterprise)\n\nStirling-PDF offers **Server and Enterprise paid plans** with additional features for organizations.\n\n### Key Paid Plan Features\n\n**Authentication & Security:**\n- **OAuth2 SSO:** Server tier (Google, GitHub, Keycloak, OIDC)\n- **SAML2 SSO:** Enterprise tier (Okta, Azure AD, etc.)\n- Enhanced security features\n\n**Database & Infrastructure:**\n- **External PostgreSQL Database:** Available for Server/Enterprise deployments\n- Better reliability and scalability than local H2 database\n- Professional backup and replication strategies\n\n**Monitoring & Analytics:**\n- **Prometheus Integration:** Advanced metrics and monitoring\n- **Usage Monitoring UI:** Graphical usage statistics in the admin interface\n- Enhanced monitoring APIs\n\n**For pricing and enterprise inquiries:**\n- **Email:** support@stirlingpdf.com\n- **Website:** https://stirling.com/pricing\n- **Documentation:** [Paid Offerings](doc:paid-offerings)\n- **External Database Setup:** [External Database Guide](doc:configuration/external-database)\n- **Monitoring Setup:** [Usage Monitoring](doc:configuration/usage-monitoring)\n\n---\n\n## Next Steps & Resources\n\nCongratulations! You've successfully deployed and configured Stirling-PDF for your organization.\n\n### Recommended Next Steps\n\n1. **📚 Train your users**\n   - Share the [Getting Started Guide](doc:getting-started)\n   - Point them to [Tool Reference](doc:functionality/functionality)\n   - Create internal documentation for your specific workflows\n\n2. **🔧 Advanced configuration**\n   - [OCR Configuration](doc:configuration/ocr) - Add more languages\n   - [Pipeline Automation](doc:configuration/pipeline) - Automate workflows\n   - [API Integration](doc:api) - Integrate with other systems\n   - [LibreOffice Parallel Processing](doc:configuration/libreoffice-parallel-processing) - Scale document conversions\n\n3. **🔒 Harden security**\n   - [Fail2Ban Setup](doc:configuration/fail2ban) - Prevent brute force\n   - [External Database](doc:configuration/external-database) - Use PostgreSQL\n   - Review [System and Security](doc:configuration/system-and-security) settings\n\n4. **📊 Monitor and optimize**\n   - Set up regular backup verification\n   - Review logs weekly\n   - Monitor disk space and performance\n   - Plan for growth\n\n### Support & Community\n\n- **Documentation:** https://docs.stirlingpdf.com\n- **GitHub:** https://github.com/Stirling-Tools/Stirling-PDF\n- **Discord:** https://discord.gg/HYmhKj45pU\n- **Issue Tracker:** https://github.com/Stirling-Tools/Stirling-PDF/issues\n\n### Stay Updated\n\n- **Release Notes:** https://github.com/Stirling-Tools/Stirling-PDF/releases\n- **Blog:** https://stirlingtools.com/blog\n- **Newsletter:** Subscribe at https://stirlingtools.com\n\n---\n\n## Troubleshooting Common Issues\n\n### Authentication Issues\n\n**Problem:** Can't log in as admin\n\n**Solutions:**\n1. Check logs: `docker logs stirling-pdf | grep ERROR`\n2. Verify `SECURITY_ENABLELOGIN=true` is set\n3. Reset admin password via command line:\n   ```bash\n   docker exec -it stirling-pdf sh\n   # Use built-in password reset tool\n   ```\n\n### Performance Issues\n\n**Problem:** Slow processing, timeouts\n\n**Solutions:**\n1. Check resource limits: `docker stats stirling-pdf`\n2. Increase JVM heap - see [Performance Optimization](doc:configuration/performance-optimization)\n3. Increase LibreOffice instances if document conversions are slow - see [LibreOffice Parallel Processing](doc:configuration/libreoffice-parallel-processing)\n4. Check disk I/O: Use SSD for temp file storage\n5. Run the built-in [diagnostics tool](doc:configuration/diagnostics) and check application logs\n\n### HTTPS/Certificate Issues\n\n**Problem:** Certificate errors, HTTPS not working\n\n**Solutions:**\n1. Check Nginx/Traefik logs\n2. Verify DNS points to correct IP\n3. Ensure ports 80 and 443 are open\n4. Test Let's Encrypt manually: `sudo certbot certificates`\n\n### File Upload Issues\n\n**Problem:** Can't upload large files\n\n**Solutions:**\n1. Increase Nginx limit: `client_max_body_size 2000M;`\n2. Increase Stirling-PDF limit: `system.fileUploadLimit: 2000MB` (env `SYSTEMFILEUPLOADLIMIT=2000MB`)\n3. Check disk space: `df -h`\n4. Increase timeouts: `client_body_timeout 300s;`\n\n### Need More Help?\n\nRun the built-in [diagnostics tool](doc:configuration/diagnostics) inside your Docker container to collect logs, configuration, and system information into a shareable archive.\n\n**For Community Support:**\n- Join Discord: https://discord.gg/HYmhKj45pU\n- Search GitHub Issues: https://github.com/Stirling-Tools/Stirling-PDF/issues\n\n**For Priority Support:**\n- Upgrade to Server or Enterprise plan\n- Email: support@stirlingpdf.com\n- Get dedicated support team\n\n---\n\n**You're all set!** 🎉\n\nYour Stirling-PDF deployment is ready for production use. If you have any questions or need assistance, don't hesitate to reach out to our community or consider upgrading to a paid plan (Server or Enterprise) for dedicated support.\n\nHappy PDF processing! 📄✨",
+      "sourcePath": "docs/Server-Admin-Onboarding.md",
+      "editUrl": "https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/Server-Admin-Onboarding.md"
+    }
+  }
+}
diff --git a/frontend/editor/src/portal/views/DeveloperDocs.css b/frontend/editor/src/portal/views/DeveloperDocs.css
index e023afeb69..1786940dd5 100644
--- a/frontend/editor/src/portal/views/DeveloperDocs.css
+++ b/frontend/editor/src/portal/views/DeveloperDocs.css
@@ -1,73 +1,254 @@
+/* Full-height docs surface: the sidebar and reading pane each scroll on their
+   own inside the portal shell's scroll container, so a 70+ item nav no longer
+   drags the whole page around. */
 .portal-docs {
   display: grid;
-  grid-template-columns: 15rem minmax(0, 1fr);
-  gap: 2rem;
-  padding: 1.5rem;
-  max-width: 84rem;
-  margin: 0 auto;
-  align-items: start;
+  grid-template-columns: 16rem minmax(0, 1fr);
+  height: 100%;
+  min-height: 0;
+  overflow: hidden;
 }
 
-@media (max-width: 60rem) {
-  .portal-docs {
-    grid-template-columns: 1fr;
-    gap: 1.25rem;
+/* With an "On this page" TOC, add a right-hand column. */
+.portal-docs--with-toc {
+  grid-template-columns: 16rem minmax(0, 1fr) 15rem;
+}
+
+/* Not enough room for three columns → drop the TOC. */
+@media (max-width: 72rem) {
+  .portal-docs--with-toc {
+    grid-template-columns: 16rem minmax(0, 1fr);
+  }
+  .portal-docs__toc-col {
+    display: none;
   }
 }
 
-/* ── Left nav ──────────────────────────────────────────────────────────── */
+.portal-docs--empty {
+  display: block;
+  padding: 3rem 1.5rem;
+}
+
+/* ── Left nav (own scroll column) ──────────────────────────────────────── */
 
 .portal-docs__sidebar {
-  position: sticky;
-  top: 1.5rem;
-  align-self: start;
-}
-
-@media (max-width: 60rem) {
-  .portal-docs__sidebar {
-    position: static;
-  }
+  min-height: 0;
+  height: 100%;
+  overflow-y: auto;
+  border-right: 1px solid var(--color-border-light);
+  padding: 1.25rem 0;
 }
 
 .portal-docs__nav {
   display: flex;
   flex-direction: column;
-  gap: 1.25rem;
+  gap: 0.25rem;
+}
+
+/* Search */
+.portal-docs__search {
+  margin-bottom: 0.75rem;
+  padding: 0 0.75rem;
+}
+
+.portal-docs__search-box {
+  position: relative;
+}
+
+.portal-docs__search-icon {
+  position: absolute;
+  left: 0.625rem;
+  top: 50%;
+  transform: translateY(-50%);
+  font-size: 0.9375rem;
+  color: var(--color-text-4);
+  pointer-events: none;
+}
+
+.portal-docs__search-input {
+  width: 100%;
+  padding: 0.4rem 0.6rem 0.4rem 1.9rem;
+  font-size: 0.8125rem;
+  color: var(--color-text-1);
+  background: var(--color-bg-subtle);
+  border: 1px solid var(--color-border-light);
+  border-radius: var(--radius-md);
+  outline: none;
+}
+
+.portal-docs__search-input:focus {
+  border-color: var(--color-blue);
+}
+
+.portal-docs__nav-empty {
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
+  padding: 0.5rem 0.75rem;
+  margin: 0;
+}
+
+/* ── Search results ────────────────────────────────────────────────────── */
+
+.portal-docs__results {
+  margin-top: 0.5rem;
+}
+
+.portal-docs__results-count {
+  font-size: 0.6875rem;
+  font-weight: 500;
+  color: var(--color-text-4);
+  padding: 0 0.75rem 0.5rem;
+}
+
+.portal-docs__results-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+}
+
+/* Hairline divider between results for clear, calm separation. */
+.portal-docs__results-list li + li {
+  border-top: 1px solid var(--color-border-light);
+}
+
+.portal-docs__result {
+  height: auto;
+  padding: 0.5rem 0.75rem;
+  border-radius: 0;
+}
+
+.portal-docs__result:hover,
+.portal-docs__result.is-active {
+  background: var(--color-bg-hover);
+}
+
+.portal-docs__result-body {
+  display: flex;
+  flex-direction: column;
+  gap: 0.125rem;
+  width: 100%;
+  min-width: 0;
+  text-align: left;
+  white-space: normal;
+}
+
+/* Title + section share one line; the title truncates before the section. */
+.portal-docs__result-head {
+  display: flex;
+  align-items: baseline;
+  gap: 0.4rem;
+  min-width: 0;
+}
+
+.portal-docs__result-title {
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+  line-height: 1.3;
+  min-width: 0;
+  overflow: hidden;
+  white-space: nowrap;
+  text-overflow: ellipsis;
+}
+
+.portal-docs__result-section {
+  flex-shrink: 0;
+  font-size: 0.6875rem;
+  color: var(--color-text-4);
+}
+
+.portal-docs__result-snippet {
+  font-size: 0.75rem;
+  line-height: 1.4;
+  color: var(--color-text-4);
+  display: -webkit-box;
+  -webkit-line-clamp: 1;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+}
+
+/* Subtle match emphasis — coloured text, not a filled block. */
+.portal-docs__hl {
+  color: var(--color-blue);
+  font-weight: 600;
+  background: none;
 }
 
 .portal-docs__nav-group {
   display: flex;
   flex-direction: column;
-  gap: 0.375rem;
+  gap: 0.0625rem;
 }
 
+/* Section label: shared typography for the static Overview label and the
+   collapsible accordion headers below. */
 .portal-docs__nav-head {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
+  padding: 0.4rem 0.75rem 0.2rem;
   font-size: 0.6875rem;
   font-weight: 700;
   letter-spacing: 0.06em;
   text-transform: uppercase;
   color: var(--color-text-4);
-  padding: 0 0.5rem;
 }
 
-.portal-docs__nav-icon {
-  display: inline-flex;
+/* Collapsible section header (Overview stays a static label). */
+.portal-docs__nav-head--button:hover {
+  background: var(--color-bg-hover);
+  color: var(--color-text-2);
+}
+
+.portal-docs__nav-head-main {
+  display: flex;
   align-items: center;
-  justify-content: center;
-  width: 1.125rem;
-  height: 1.125rem;
-  font-size: 0.6875rem;
-  border-radius: var(--radius-sm);
+  gap: 0.4rem;
+  min-width: 0;
+}
+
+.portal-docs__nav-headlabel {
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.portal-docs__nav-chevron {
+  font-size: 0.625rem;
+  color: var(--color-text-4);
+  transition: transform var(--motion-fast);
+}
+
+.portal-docs__nav-chevron.is-open {
+  transform: rotate(90deg);
+}
+
+.portal-docs__nav-count {
+  font-size: 0.625rem;
+  font-weight: 600;
+  color: var(--color-text-4);
   background: var(--color-bg-subtle);
-  color: var(--color-text-3);
+  border-radius: var(--radius-pill);
+  padding: 0.05rem 0.4rem;
+}
+
+/* Space consecutive sections apart (not before the first). */
+.portal-docs__nav-group + .portal-docs__nav-group {
+  margin-top: 0.4rem;
+}
+
+/* Nested sub-sections: indented under their parent with a guide line. */
+.portal-docs__nav-children {
+  margin: 0.125rem 0 0.25rem 0.85rem;
+  padding-left: 0.4rem;
+  border-left: 1px solid var(--color-border-light);
+  display: flex;
+  flex-direction: column;
+  gap: 0.0625rem;
 }
 
 .portal-docs__nav-list {
   list-style: none;
-  margin: 0;
+  margin: 0 0 0.375rem;
   padding: 0;
   display: flex;
   flex-direction: column;
@@ -80,10 +261,10 @@
   justify-content: space-between;
   gap: 0.5rem;
   width: 100%;
-  padding: 0.375rem 0.5rem;
+  padding: 0.35rem 0.75rem;
   border: none;
   background: transparent;
-  border-radius: var(--radius-md);
+  border-radius: 0;
   font-size: 0.8125rem;
   color: var(--color-text-3);
   cursor: pointer;
@@ -110,10 +291,129 @@
   white-space: nowrap;
 }
 
-/* ── Content shell ─────────────────────────────────────────────────────── */
+/* Mobile-only nav toggle (a drawer button); hidden on desktop. */
+.portal-docs__nav-toggle {
+  display: none;
+}
+
+/* ── Reading pane (own scroll column) ──────────────────────────────────── */
 
 .portal-docs__content {
   min-width: 0;
+  min-height: 0;
+  height: 100%;
+  overflow-y: auto;
+  padding: 1.5rem 2rem 4rem;
+}
+
+.portal-docs__content-inner {
+  max-width: 46rem;
+  margin: 0 auto;
+}
+
+/* ── On this page (right rail) ─────────────────────────────────────────── */
+
+.portal-docs__toc-col {
+  min-height: 0;
+  height: 100%;
+  overflow-y: auto;
+  border-left: 1px solid var(--color-border-light);
+  padding: 1.5rem 0.75rem;
+}
+
+.portal-docs__toc {
+  position: sticky;
+  top: 0;
+}
+
+.portal-docs__toc-title {
+  font-size: 0.6875rem;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+  color: var(--color-text-4);
+  padding: 0 0.5rem 0.5rem;
+}
+
+.portal-docs__toc-list {
+  list-style: none;
+  margin: 0;
+  padding: 0;
+  display: flex;
+  flex-direction: column;
+  gap: 0.0625rem;
+}
+
+.portal-docs__toc-link {
+  display: block;
+  padding: 0.25rem 0.5rem;
+  border-left: 2px solid transparent;
+  font-size: 0.8125rem;
+  line-height: 1.35;
+  color: var(--color-text-3);
+  text-decoration: none;
+  transition: color var(--motion-fast);
+}
+
+.portal-docs__toc-link.is-sub {
+  padding-left: 1.25rem;
+  font-size: 0.75rem;
+}
+
+.portal-docs__toc-link:hover {
+  color: var(--color-text-1);
+}
+
+.portal-docs__toc-link.is-active {
+  color: var(--color-blue);
+  border-left-color: var(--color-blue);
+  font-weight: 600;
+}
+
+/* Scroll-to-heading lands just below the pane top, not flush against it. */
+.portal-docs__md h2,
+.portal-docs__md h3 {
+  scroll-margin-top: 1rem;
+}
+
+/* ── Small screens: nav collapses into a drawer above the content ──────── */
+
+@media (max-width: 60rem) {
+  .portal-docs {
+    grid-template-columns: 1fr;
+    grid-template-rows: auto auto minmax(0, 1fr);
+  }
+
+  .portal-docs__nav-toggle {
+    display: flex;
+    align-items: center;
+    gap: 0.5rem;
+    margin: 0.75rem 1rem 0;
+    padding: 0.5rem 0.75rem;
+    font-size: 0.8125rem;
+    font-weight: 600;
+    color: var(--color-text-1);
+    background: var(--color-bg-subtle);
+    border: 1px solid var(--color-border-light);
+    border-radius: var(--radius-md);
+    cursor: pointer;
+  }
+
+  .portal-docs__sidebar {
+    display: none;
+    height: auto;
+    max-height: 60vh;
+    border-right: none;
+    border-bottom: 1px solid var(--color-border-light);
+  }
+
+  .portal-docs__sidebar.is-open {
+    display: block;
+  }
+
+  .portal-docs__content {
+    padding: 1.25rem 1.25rem 3rem;
+  }
 }
 
 .portal-docs__section {
@@ -523,3 +823,160 @@
   font-size: 0.75rem;
   color: var(--color-text-4);
 }
+
+/* ── Markdown content ──────────────────────────────────────────────────── */
+
+.portal-docs__md {
+  font-size: 0.9375rem;
+  line-height: 1.65;
+  color: var(--color-text-2);
+}
+
+.portal-docs__md h1,
+.portal-docs__md h2,
+.portal-docs__md h3,
+.portal-docs__md h4 {
+  color: var(--color-text-1);
+  font-weight: 650;
+  line-height: 1.25;
+  margin: 1.75rem 0 0.75rem;
+}
+
+.portal-docs__md h2 {
+  font-size: 1.3125rem;
+  padding-bottom: 0.3rem;
+  border-bottom: 1px solid var(--color-border-light);
+}
+
+.portal-docs__md h3 {
+  font-size: 1.0625rem;
+}
+
+.portal-docs__md h4 {
+  font-size: 0.9375rem;
+}
+
+.portal-docs__md > :first-child {
+  margin-top: 0;
+}
+
+.portal-docs__md p,
+.portal-docs__md ul,
+.portal-docs__md ol {
+  margin: 0 0 0.875rem;
+}
+
+.portal-docs__md li {
+  margin: 0.25rem 0;
+}
+
+.portal-docs__md a {
+  color: var(--color-blue);
+  text-decoration: none;
+}
+
+.portal-docs__md a:hover {
+  text-decoration: underline;
+}
+
+.portal-docs__md code {
+  font-family: var(--font-mono, monospace);
+  font-size: 0.85em;
+  background: var(--color-bg-subtle);
+  padding: 0.1em 0.35em;
+  border-radius: var(--radius-sm);
+}
+
+.portal-docs__md blockquote {
+  margin: 0 0 0.875rem;
+  padding: 0.125rem 0.875rem;
+  border-left: 3px solid var(--color-blue);
+  background: var(--color-bg-subtle);
+  border-radius: 0 var(--radius-md) var(--radius-md) 0;
+  color: var(--color-text-3);
+}
+
+.portal-docs__md blockquote p {
+  margin: 0.5rem 0;
+}
+
+.portal-docs__md-img {
+  max-width: 100%;
+  height: auto;
+  border-radius: var(--radius-md);
+  border: 1px solid var(--color-border-light);
+}
+
+.portal-docs__md hr {
+  border: none;
+  border-top: 1px solid var(--color-border-light);
+  margin: 1.5rem 0;
+}
+
+.portal-docs__md-pre {
+  position: relative;
+  margin: 0 0 0.875rem;
+}
+
+.portal-docs__md-pre pre {
+  margin: 0;
+  padding: 0.875rem 4rem 0.875rem 0.875rem;
+  background: var(--color-bg-subtle);
+  border: 1px solid var(--color-border-light);
+  border-radius: var(--radius-md);
+  overflow-x: auto;
+  font-size: 0.8125rem;
+  line-height: 1.5;
+}
+
+.portal-docs__md-pre pre code {
+  background: none;
+  padding: 0;
+  font-size: inherit;
+}
+
+.portal-docs__md-copy {
+  position: absolute;
+  top: 0.5rem;
+  right: 0.5rem;
+}
+
+.portal-docs__md-tablewrap {
+  overflow-x: auto;
+  margin: 0 0 0.875rem;
+}
+
+.portal-docs__md-tablewrap table {
+  border-collapse: collapse;
+  width: 100%;
+  font-size: 0.8125rem;
+}
+
+.portal-docs__md-tablewrap th,
+.portal-docs__md-tablewrap td {
+  border: 1px solid var(--color-border-light);
+  padding: 0.4rem 0.625rem;
+  text-align: left;
+}
+
+.portal-docs__md-tablewrap th {
+  background: var(--color-bg-subtle);
+  font-weight: 600;
+}
+
+.portal-docs__source {
+  margin-top: 2rem;
+  padding-top: 1rem;
+  border-top: 1px solid var(--color-border-light);
+  font-size: 0.8125rem;
+}
+
+.portal-docs__source a {
+  color: var(--color-text-3);
+  text-decoration: none;
+}
+
+.portal-docs__source a:hover {
+  color: var(--color-blue);
+  text-decoration: underline;
+}
diff --git a/frontend/editor/src/portal/views/DeveloperDocs.stories.tsx b/frontend/editor/src/portal/views/DeveloperDocs.stories.tsx
new file mode 100644
index 0000000000..70a2549e27
--- /dev/null
+++ b/frontend/editor/src/portal/views/DeveloperDocs.stories.tsx
@@ -0,0 +1,24 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { DeveloperDocs } from "@portal/views/DeveloperDocs";
+
+// Renders the real docs manifest (generated by scripts/sync-portal-docs.mts), so
+// this story is a live view of the auto-built Documentation browser. The view
+// fills its container's height (independent sidebar/content scroll), so the
+// decorator gives it a viewport-height frame.
+const meta: Meta<typeof DeveloperDocs> = {
+  title: "Portal/DeveloperDocs/View",
+  component: DeveloperDocs,
+  parameters: { layout: "fullscreen" },
+  decorators: [
+    (Story) => (
+      <div style={{ height: "100vh" }}>
+        <Story />
+      </div>
+    ),
+  ],
+};
+export default meta;
+
+type Story = StoryObj<typeof DeveloperDocs>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/portal/views/DeveloperDocs.test.tsx b/frontend/editor/src/portal/views/DeveloperDocs.test.tsx
new file mode 100644
index 0000000000..d2071011d8
--- /dev/null
+++ b/frontend/editor/src/portal/views/DeveloperDocs.test.tsx
@@ -0,0 +1,80 @@
+import { describe, expect, it, vi } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { MemoryRouter } from "react-router-dom";
+import type { ReactElement } from "react";
+
+// Deterministic labels; the view + DocsNav + MarkdownDoc all use useTranslation.
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    // 2nd arg may be a default string or i18next interpolation options ({count}).
+    t: (key: string, opts?: unknown) => (typeof opts === "string" ? opts : key),
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+import { DeveloperDocs } from "@portal/views/DeveloperDocs";
+
+const renderDocs = (ui: ReactElement) =>
+  render(
+    <MemoryRouter initialEntries={["/processor/docs"]}>
+      <MantineProvider>{ui}</MantineProvider>
+    </MemoryRouter>,
+  );
+
+describe("DeveloperDocs — markdown browser over the generated manifest", () => {
+  it("keeps Overview static (open, no toggle) and other sections collapsed", () => {
+    renderDocs(<DeveloperDocs />);
+    expect(screen.getByRole("searchbox")).toBeInTheDocument();
+    // Overview is static: its items show, and it has no toggle button.
+    expect(
+      screen.getByRole("button", { name: "Production Deployment Guide" }),
+    ).toBeInTheDocument();
+    expect(
+      screen.queryByRole("button", { name: /^Overview/i }),
+    ).not.toBeInTheDocument();
+    // Other sections collapse, so their items are hidden until expanded.
+    expect(
+      screen.queryByRole("button", { name: "Kubernetes Guide" }),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.getByText(/locally hosted web application/i),
+    ).toBeInTheDocument();
+  });
+
+  it("expands a collapsible section when its header is clicked", () => {
+    renderDocs(<DeveloperDocs />);
+    fireEvent.click(screen.getByRole("button", { name: /Installation/i }));
+    expect(
+      screen.getByRole("button", { name: "Kubernetes Guide" }),
+    ).toBeInTheDocument();
+  });
+
+  it("searches doc content (not just titles), shows a snippet, and navigates", async () => {
+    renderDocs(<DeveloperDocs />);
+    // "Tesseract" appears in the OCR doc body but in no doc title — a result
+    // whose snippet contains it proves full-text (content) search.
+    fireEvent.change(screen.getByRole("searchbox"), {
+      target: { value: "Tesseract" },
+    });
+    const hits = await screen.findAllByRole("button", { name: /Tesseract/i });
+    expect(hits.length).toBeGreaterThan(0);
+    fireEvent.click(hits[0]);
+    await waitFor(() =>
+      expect(
+        screen.queryByText(/locally hosted web application/i),
+      ).not.toBeInTheDocument(),
+    );
+  });
+
+  it("follows an internal doc: link inside the rendered markdown", async () => {
+    renderDocs(<DeveloperDocs />);
+    // The Getting Started body links to the Migration guide via the doc: scheme.
+    fireEvent.click(screen.getByRole("link", { name: /Migration Guide/i }));
+    await waitFor(() =>
+      expect(
+        screen.queryByText(/locally hosted web application/i),
+      ).not.toBeInTheDocument(),
+    );
+  });
+});
diff --git a/frontend/editor/src/portal/views/DeveloperDocs.tsx b/frontend/editor/src/portal/views/DeveloperDocs.tsx
index f94cdb79b1..47eaffda5a 100644
--- a/frontend/editor/src/portal/views/DeveloperDocs.tsx
+++ b/frontend/editor/src/portal/views/DeveloperDocs.tsx
@@ -1,97 +1,140 @@
-import { useState } from "react";
+import { useCallback, useEffect, useMemo, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { EmptyState } from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
+import { useLocation, useNavigate } from "react-router-dom";
+import { Button, EmptyState } from "@app/ui";
+import { DocsNav } from "@portal/components/docs/DocsNav";
+import { DocsSearch } from "@portal/components/docs/DocsSearch";
+import { DocsSection } from "@portal/components/docs/DocsSection";
+import { DocsToc } from "@portal/components/docs/DocsToc";
+import { MarkdownDoc } from "@portal/components/docs/MarkdownDoc";
+import { extractHeadings } from "@portal/docs/headings";
 import {
-  fetchDocsContent,
-  fetchDocsNav,
-  type DocsContent,
-  type DocsNavSection,
-} from "@portal/api/docs";
-import { DocsNav, DocsNavSkeleton } from "@portal/components/docs/DocsNav";
-import { GettingStartedSection } from "@portal/components/docs/GettingStartedSection";
-import { AuthenticationSection } from "@portal/components/docs/AuthenticationSection";
-import { RateLimitsSection } from "@portal/components/docs/RateLimitsSection";
-import { EndpointReferenceSection } from "@portal/components/docs/EndpointReferenceSection";
-import { ErrorsSection } from "@portal/components/docs/ErrorsSection";
-import { WebhooksSection } from "@portal/components/docs/WebhooksSection";
-import { SdksSection } from "@portal/components/docs/SdksSection";
-import { ComponentsSection } from "@portal/components/docs/ComponentsSection";
-import { PlaybooksSection } from "@portal/components/docs/PlaybooksSection";
-import { SkillsSection } from "@portal/components/docs/SkillsSection";
+  allDocs,
+  firstDocId,
+  loadDoc,
+  loadDocsNav,
+} from "@portal/docs/manifest/registry";
+import { searchDocs, toPlainText, type SearchDoc } from "@portal/docs/search";
 import "@portal/views/DeveloperDocs.css";
 
-/** Renders the content pane for the active nav leaf against fetched content. */
-function DocsContentPane({
-  active,
-  content,
-}: {
-  active: string;
-  content: DocsContent;
-}) {
-  switch (active) {
-    case "authentication":
-      return <AuthenticationSection />;
-    case "rate-limits":
-      return <RateLimitsSection rateLimit={content.rateLimit} />;
-    case "endpoints":
-      return <EndpointReferenceSection />;
-    case "errors":
-      return <ErrorsSection errors={content.errors} />;
-    case "webhooks":
-      return <WebhooksSection />;
-    case "sdk-overview":
-      return <SdksSection sdks={content.sdks} />;
-    case "component-library":
-      return <ComponentsSection components={content.components} />;
-    case "recipes":
-      return <PlaybooksSection playbooks={content.playbooks} />;
-    case "skill-catalog":
-      return <SkillsSection skills={content.skills} />;
-    default:
-      return (
-        <GettingStartedSection
-          samples={content.quickstartSamples}
-          response={content.quickstartResponse}
-        />
-      );
-  }
-}
-
+/**
+ * Developer Docs — a markdown browser over the docs manifest generated from the
+ * Stirling docs repo (see scripts/sync-portal-docs.mts). The nav is auto-sorted
+ * from the repo's folders + frontmatter; content is the repo markdown, and the
+ * search box does full-text search across every doc.
+ */
 export function DeveloperDocs() {
   const { t } = useTranslation();
-  const { tier } = useTier();
-  const [active, setActive] = useState("quickstart");
+  const { hash } = useLocation();
+  const navigate = useNavigate();
+  const contentRef = useRef<HTMLElement>(null);
+  const [navOpen, setNavOpen] = useState(false);
+  const [query, setQuery] = useState("");
 
-  const navState = useAsync<DocsNavSection[]>(() => fetchDocsNav(), []);
-  const { data: nav } = navState;
-  const { isLoading, isEmpty } = useSectionFlags(navState);
+  const nav = useMemo(() => loadDocsNav(), []);
+  const fallback = useMemo(() => firstDocId(), []);
 
-  const { data: content } = useAsync<DocsContent>(
-    () => fetchDocsContent(tier),
-    [tier],
+  // Full-text index over every doc's plaintext body (built once).
+  const index = useMemo<SearchDoc[]>(() => {
+    const labels = new Map(nav.map((s) => [s.id, s.label]));
+    return allDocs().map((d) => ({
+      id: d.id,
+      title: d.title,
+      sectionLabel: labels.get(d.section) ?? "",
+      text: toPlainText(d.markdown),
+    }));
+  }, [nav]);
+  const results = useMemo(() => searchDocs(index, query), [index, query]);
+  const searching = query.trim().length > 0;
+
+  // Deep-link support: the active doc id lives in the URL hash.
+  const hashId = decodeURIComponent(hash.replace(/^#/, ""));
+  const activeId = hashId && loadDoc(hashId) ? hashId : fallback;
+  const doc = activeId ? loadDoc(activeId) : undefined;
+  const section = useMemo(
+    () => nav.find((s) => s.items.some((i) => i.id === activeId)),
+    [nav, activeId],
+  );
+  // "On this page" headings for the current doc.
+  const headings = useMemo(
+    () => (doc ? extractHeadings(doc.markdown) : []),
+    [doc],
   );
 
+  // Navigating closes the mobile drawer, clears the search, and resets the pane.
+  const onSelect = useCallback(
+    (id: string) => {
+      navigate({ hash: id });
+      setNavOpen(false);
+      setQuery("");
+    },
+    [navigate],
+  );
+
+  useEffect(() => {
+    contentRef.current?.scrollTo?.({ top: 0 });
+  }, [activeId]);
+
+  if (nav.length === 0 || !doc) {
+    return (
+      <div className="portal-docs portal-docs--empty">
+        <EmptyState
+          title={t("portal.docs.nav.empty.title")}
+          description={t("portal.docs.nav.empty.description")}
+        />
+      </div>
+    );
+  }
+
+  const hasToc = headings.length > 0;
+
   return (
-    <div className="portal-docs">
-      <aside className="portal-docs__sidebar">
-        {isLoading && <DocsNavSkeleton />}
-        {isEmpty && (
-          <EmptyState
-            size="compact"
-            title={t("portal.docs.nav.empty.title")}
-            description={t("portal.docs.nav.empty.description")}
-          />
-        )}
-        {nav && nav.length > 0 && (
-          <DocsNav sections={nav} active={active} onSelect={setActive} />
+    <div className={"portal-docs" + (hasToc ? " portal-docs--with-toc" : "")}>
+      <Button
+        variant="tertiary"
+        className="portal-docs__nav-toggle"
+        aria-expanded={navOpen}
+        onClick={() => setNavOpen((open) => !open)}
+        leftSection={<span aria-hidden>☰</span>}
+      >
+        {t("portal.docs.browse")}
+      </Button>
+
+      <aside className={"portal-docs__sidebar" + (navOpen ? " is-open" : "")}>
+        <DocsSearch
+          query={query}
+          onQueryChange={setQuery}
+          results={results}
+          onSelect={onSelect}
+        />
+        {!searching && (
+          <DocsNav sections={nav} active={activeId ?? ""} onSelect={onSelect} />
         )}
       </aside>
 
-      <main className="portal-docs__content">
-        {content && <DocsContentPane active={active} content={content} />}
+      <main className="portal-docs__content" ref={contentRef}>
+        <div className="portal-docs__content-inner">
+          <DocsSection
+            id={doc.id}
+            eyebrow={section?.label ?? ""}
+            title={doc.title}
+            lead={doc.description}
+          >
+            <MarkdownDoc markdown={doc.markdown} onNavigate={onSelect} />
+            <div className="portal-docs__source">
+              <a href={doc.editUrl} target="_blank" rel="noopener noreferrer">
+                {t("portal.docs.viewSource")}
+              </a>
+            </div>
+          </DocsSection>
+        </div>
       </main>
+
+      {hasToc && (
+        <aside className="portal-docs__toc-col">
+          <DocsToc headings={headings} scrollRef={contentRef} />
+        </aside>
+      )}
     </div>
   );
 }
diff --git a/frontend/package.json b/frontend/package.json
index be45f0215e..51b2472dcb 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -83,6 +83,7 @@
     "web-vitals": "^5.1.0"
   },
   "scripts": {
+    "docs:sync": "tsx editor/scripts/sync-portal-docs.mts",
     "update:minor": "node scripts/update-minor.js",
     "update:major": "npx npm-check-updates -u && npm install",
     "update:interactive": "npx npm-check-updates -i",

From 2118de0bb7f0ddab45be73035460989480c0d846 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Thu, 16 Jul 2026 11:20:49 +0100
Subject: [PATCH 034/109] Open processor "Open in browser" CTAs in a new tab
 (#7045)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Description

The processor home-hero and download-editor modal "Open in browser"
buttons were meant to open the editor in a new tab, but they used
`window.location.href = EDITOR_URL`, which replaces the current tab.

This switches both to `window.open(EDITOR_URL, "_blank",
"noopener,noreferrer")`, matching the existing behaviour of the "Open"
button in `EditorStatusCard.tsx`. The `noopener,noreferrer` flags mirror
that same call and prevent the new tab from getting a `window.opener`
reference.

## Changes

- `WelcomeBanner.tsx` — home-hero "Open in browser" CTA
- `DownloadEditorModal.tsx` — download modal "Open in browser" CTA

## Notes

`EDITOR_URL` can resolve to a same-origin path when the editor is the
same SPA, so opening in a new tab triggers a full page load of the
editor app. This is the expected behaviour for "Open in browser".
---
 frontend/editor/src/portal/components/DownloadEditorModal.tsx | 2 +-
 frontend/editor/src/portal/components/WelcomeBanner.tsx       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/frontend/editor/src/portal/components/DownloadEditorModal.tsx b/frontend/editor/src/portal/components/DownloadEditorModal.tsx
index 3a4c9bb29d..602e3ca530 100644
--- a/frontend/editor/src/portal/components/DownloadEditorModal.tsx
+++ b/frontend/editor/src/portal/components/DownloadEditorModal.tsx
@@ -255,7 +255,7 @@ export function DownloadEditorModal({ open, onClose }: Props) {
             variant="secondary"
             leftSection={<OpenInNewRounded sx={{ fontSize: 15 }} />}
             onClick={() => {
-              window.location.href = EDITOR_URL;
+              window.open(EDITOR_URL, "_blank", "noopener,noreferrer");
             }}
           >
             {t("portal.home.download.openInBrowser")}
diff --git a/frontend/editor/src/portal/components/WelcomeBanner.tsx b/frontend/editor/src/portal/components/WelcomeBanner.tsx
index 0d56e85730..c1d6857bdb 100644
--- a/frontend/editor/src/portal/components/WelcomeBanner.tsx
+++ b/frontend/editor/src/portal/components/WelcomeBanner.tsx
@@ -78,7 +78,7 @@ export function WelcomeBanner({ footer }: WelcomeBannerProps) {
             className="portal-welcome__cta"
             leftSection={<ExternalLinkIcon size={15} />}
             onClick={() => {
-              window.location.href = EDITOR_URL;
+              window.open(EDITOR_URL, "_blank", "noopener,noreferrer");
             }}
           >
             {t("portal.welcome.openInBrowser")}

From 939afef14f902b4b4e48ca81d2c2fc6e24044087 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Thu, 16 Jul 2026 13:00:02 +0100
Subject: [PATCH 035/109] perf(portal): collapse admin-roster N+1 + session
 indexes (#7008)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Description of Changes

Collapses the portal admin-roster endpoint (`getAdminSettingsData`,
`/api/v1/proprietary/ui-data/admin-settings`) from a per-user N+1 into a
constant set of queries, and adds the missing
session/user/team-membership indexes.

**Verified on H2 and real Postgres 16, 2,000-user roster:** 10,601 → 7
SQL statements, 600 → 0 writes-during-a-GET, O(N) → O(1). Portal-access
resolution is proven equivalent to the per-user check (parity test), and
a scaling guard fails the build if the endpoint ever regresses.

Also in scope (same controller / session subsystem): `getLoginData`
counts instead of loading the whole user table; `getTeamDetailsData`
fetch-joins authorities; `SessionScheduled` uses one bulk expire + a
bounded purge.

Behaviour note: the roster "active" flag now reflects *any* live session
(a strict superset of the old "newest session only") — no user who was
active is ever shown inactive.

---

## Checklist

### General

- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Testing

- [x] I have run backend `task check` (spotless + full backend test
suite) — all green
- [x] I have tested my changes locally (before/after benchmark on H2 +
Postgres)
---
 .../src/main/resources/application.properties |   2 +
 app/proprietary/build.gradle                  |   1 +
 .../access/service/ResourceAccessService.java |  42 +++
 .../api/ProprietaryUIDataController.java      | 193 +++++++------
 .../proprietary/model/TeamMembership.java     |  12 +-
 .../repository/SessionRepository.java         |  25 ++
 .../database/repository/UserRepository.java   |  11 +
 .../proprietary/security/model/Authority.java |   6 +-
 .../security/model/SessionEntity.java         |  12 +-
 .../proprietary/security/model/User.java      |   5 +-
 .../session/SessionPersistentRegistry.java    |  10 +
 .../security/session/SessionScheduled.java    |  26 +-
 .../ResourceAccessPortalBulkParityTest.java   | 151 +++++++++++
 .../api/AdminSettingsPerfHarness.java         | 255 ++++++++++++++++++
 .../api/AdminSettingsQueryPerfTest.java       | 194 +++++++++++++
 .../api/AdminSettingsQueryPostgresTest.java   | 109 ++++++++
 .../ProprietaryUIDataControllerMoreTest.java  |  12 +-
 .../api/ProprietaryUIDataControllerTest.java  |   3 +-
 18 files changed, 941 insertions(+), 128 deletions(-)
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessPortalBulkParityTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsPerfHarness.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsQueryPerfTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsQueryPostgresTest.java

diff --git a/app/core/src/main/resources/application.properties b/app/core/src/main/resources/application.properties
index da564e454b..7c1190926b 100644
--- a/app/core/src/main/resources/application.properties
+++ b/app/core/src/main/resources/application.properties
@@ -72,6 +72,8 @@ spring.datasource.username=sa
 spring.datasource.password=
 spring.h2.console.enabled=false
 spring.jpa.hibernate.ddl-auto=update
+# Batch associations into IN() loads so list endpoints don't N+1 as tables grow.
+spring.jpa.properties.hibernate.default_batch_fetch_size=100
 # Defer datasource initialization to ensure that the database is fully set up
 # before Hibernate attempts to access it. This is particularly useful when
 # using database initialization scripts or tools.
diff --git a/app/proprietary/build.gradle b/app/proprietary/build.gradle
index 1e51b820ae..60f6541c82 100644
--- a/app/proprietary/build.gradle
+++ b/app/proprietary/build.gradle
@@ -103,6 +103,7 @@ dependencies {
     testImplementation "org.testcontainers:testcontainers:${testcontainersMinioVersion}"
     testImplementation "org.testcontainers:minio:${testcontainersMinioVersion}"
     testImplementation "org.testcontainers:localstack:${testcontainersMinioVersion}"
+    testImplementation "org.testcontainers:postgresql:${testcontainersMinioVersion}"
     testImplementation "org.testcontainers:junit-jupiter:${testcontainersMinioVersion}"
 }
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/access/service/ResourceAccessService.java b/app/proprietary/src/main/java/stirling/software/proprietary/access/service/ResourceAccessService.java
index 72159829a4..b3c987d6f2 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/access/service/ResourceAccessService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/access/service/ResourceAccessService.java
@@ -1,5 +1,6 @@
 package stirling.software.proprietary.access.service;
 
+import java.util.Collection;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
@@ -42,6 +43,47 @@ public class ResourceAccessService {
         return canUseResource(ResourceType.PORTAL, "", null, portalDefaultPolicy, user);
     }
 
+    /** Portal access for a roster (admin, grant, or default policy). */
+    public Set<Long> usersWithPortalAccess(Collection<User> users, Set<Long> teamLeaderUserIds) {
+        Set<PrincipalRef> grantedPrincipals = new HashSet<>();
+        for (ResourceGrant g :
+                grantRepository.findByResourceTypeAndResourceId(ResourceType.PORTAL, "")) {
+            if (permissionSatisfies(g.getPermission(), AccessPermission.USE)) {
+                grantedPrincipals.add(new PrincipalRef(g.getPrincipalType(), g.getPrincipalId()));
+            }
+        }
+        Set<Long> leaderIds = teamLeaderUserIds == null ? Set.of() : teamLeaderUserIds;
+        Set<Long> allowed = new HashSet<>();
+        for (User user : users) {
+            if (user != null
+                    && user.getId() != null
+                    && hasPortalAccess(user, grantedPrincipals, leaderIds)) {
+                allowed.add(user.getId());
+            }
+        }
+        return allowed;
+    }
+
+    private boolean hasPortalAccess(
+            User user, Set<PrincipalRef> grantedPrincipals, Set<Long> leaderIds) {
+        if (isAdmin(user)) {
+            return true;
+        }
+        for (PrincipalRef principal : principalResolver.principalsOf(user)) {
+            if (grantedPrincipals.contains(principal)) {
+                return true;
+            }
+        }
+        if (portalDefaultPolicy == null) {
+            return false;
+        }
+        return switch (portalDefaultPolicy) {
+            case ORG_ALL -> principalResolver.allowsDeploymentWideAccess();
+            case ADMINS_AND_TEAM_LEADS -> leaderIds.contains(user.getId());
+            case EXPLICIT_ONLY -> false;
+        };
+    }
+
     /** Whether the user may use a resource, falling back to its default policy. */
     public boolean canUseResource(
             ResourceType type,
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java
index 8db5f48174..2c0b995b8b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java
@@ -3,7 +3,6 @@ package stirling.software.proprietary.controller.api;
 import static stirling.software.common.util.ProviderUtils.validateProvider;
 
 import java.time.Instant;
-import java.time.temporal.ChronoUnit;
 import java.util.*;
 import java.util.stream.Collectors;
 
@@ -45,7 +44,6 @@ import stirling.software.proprietary.security.config.EnterpriseEndpoint;
 import stirling.software.proprietary.security.database.repository.SessionRepository;
 import stirling.software.proprietary.security.database.repository.UserRepository;
 import stirling.software.proprietary.security.model.Authority;
-import stirling.software.proprietary.security.model.SessionEntity;
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.model.dto.AdminUserSummary;
 import stirling.software.proprietary.security.repository.TeamMembershipRepository;
@@ -169,16 +167,8 @@ public class ProprietaryUIDataController {
         boolean isFirstTimeSetup = false;
         boolean showDefaultCredentials = false;
 
-        List<User> allUsers = userRepository.findAll();
-        List<User> realUsers =
-                allUsers.stream()
-                        .filter(
-                                user ->
-                                        !Role.INTERNAL_API_USER
-                                                .getRoleId()
-                                                .equals(user.getUsername()))
-                        .toList();
-        long userCount = realUsers.size();
+        // Count real users, excluding the internal API user.
+        long userCount = userRepository.countByUsernameNot(Role.INTERNAL_API_USER.getRoleId());
 
         if (userCount == 0) {
             isFirstTimeSetup = true;
@@ -265,92 +255,67 @@ public class ProprietaryUIDataController {
     @PreAuthorize("hasRole('ADMIN')")
     @Operation(summary = "Get admin settings data")
     public ResponseEntity<AdminSettingsData> getAdminSettingsData(Authentication authentication) {
-        List<User> allUsers = userRepository.findAllWithTeam();
-        Iterator<User> iterator = allUsers.iterator();
+        List<User> allUsers = userRepository.findAllWithTeamAndAuthorities();
         Map<String, String> roleDetails = Role.getAllRoleDetails();
 
+        // Drop the internal API user and internal-team members; the roster never shows them.
+        boolean hasInternalApiUser = false;
+        List<User> visibleUsers = new ArrayList<>(allUsers.size());
+        for (User user : allUsers) {
+            if (user == null) {
+                continue;
+            }
+            if (isInternalApiUser(user)) {
+                hasInternalApiUser = true;
+                continue;
+            }
+            if (user.getTeam() != null
+                    && TeamService.INTERNAL_TEAM_NAME.equals(user.getTeam().getName())) {
+                continue;
+            }
+            visibleUsers.add(user);
+        }
+        if (hasInternalApiUser) {
+            roleDetails.remove(Role.INTERNAL_API_USER.getRoleId());
+        }
+
+        // All users' settings in one query (mfaSecret masked).
+        Map<Long, Map<String, String>> settingsByUserId =
+                loadSettingsByUserId(visibleUsers.stream().map(User::getId).toList());
+
+        // Active = any non-expired session within the inactivity window; expiry is left to
+        // SessionScheduled.
+        int maxInactiveInterval = sessionPersistentRegistry.getMaxInactiveInterval();
+        Instant activeCutoff = Instant.now().minusSeconds(maxInactiveInterval);
+        Map<String, Instant> lastRequestByPrincipal = new HashMap<>();
+        for (Object[] row : sessionRepository.findLatestRequestPerPrincipal()) {
+            if (row[0] != null) {
+                lastRequestByPrincipal.put((String) row[0], (Instant) row[1]);
+            }
+        }
+        Set<String> activePrincipals =
+                new HashSet<>(sessionRepository.findActivePrincipalsSince(activeCutoff));
+
         Map<String, Boolean> userSessions = new HashMap<>();
         Map<String, Date> userLastRequest = new HashMap<>();
         Map<String, Map<String, String>> userSettings = new HashMap<>();
         int activeUsers = 0;
         int disabledUsers = 0;
-
-        while (iterator.hasNext()) {
-            User user = iterator.next();
-            if (user != null) {
-                String username = user.getUsername();
-                boolean shouldRemove = false;
-
-                // Check if user is an INTERNAL_API_USER
-                for (Authority authority : user.getAuthorities()) {
-                    if (authority.getAuthority().equals(Role.INTERNAL_API_USER.getRoleId())) {
-                        shouldRemove = true;
-                        roleDetails.remove(Role.INTERNAL_API_USER.getRoleId());
-                        break;
-                    }
-                }
-
-                // Check if user is part of the Internal team
-                if (user.getTeam() != null
-                        && TeamService.INTERNAL_TEAM_NAME.equals(user.getTeam().getName())) {
-                    shouldRemove = true;
-                }
-
-                if (shouldRemove) {
-                    iterator.remove();
-                    continue;
-                }
-
-                // Session status and last request time
-                int maxInactiveInterval = sessionPersistentRegistry.getMaxInactiveInterval();
-                boolean hasActiveSession = false;
-                Date lastRequest = null;
-                Optional<SessionEntity> latestSession =
-                        sessionPersistentRegistry.findLatestSession(username);
-
-                if (latestSession.isPresent()) {
-                    SessionEntity sessionEntity = latestSession.get();
-                    Instant lastAccessedTime =
-                            Optional.ofNullable(sessionEntity.getLastRequest())
-                                    .orElse(Instant.EPOCH);
-                    Instant now = Instant.now();
-                    Instant expirationTime =
-                            lastAccessedTime.plus(maxInactiveInterval, ChronoUnit.SECONDS);
-
-                    if (now.isAfter(expirationTime)) {
-                        sessionPersistentRegistry.expireSession(sessionEntity.getSessionId());
-                    } else {
-                        hasActiveSession = !sessionEntity.isExpired();
-                    }
-                    lastRequest = Date.from(lastAccessedTime);
-                } else {
-                    lastRequest = new Date(0);
-                }
-
-                User userWithSettings =
-                        userRepository.findByIdWithSettings(user.getId()).orElse(user);
-
-                // Mask mfaSecret if present in settings
-                Map<String, String> originalSettings = userWithSettings.getSettings();
-                Map<String, String> settingsCopy =
-                        originalSettings != null
-                                ? new HashMap<>(originalSettings)
-                                : new HashMap<>();
-                if (settingsCopy.containsKey("mfaSecret")) {
-                    settingsCopy.put("mfaSecret", "********");
-                }
-                userSettings.put(username, settingsCopy);
-                userSessions.put(username, hasActiveSession);
-                userLastRequest.put(username, lastRequest);
-
-                if (hasActiveSession) activeUsers++;
-                if (!user.isEnabled()) disabledUsers++;
-            }
+        for (User user : visibleUsers) {
+            String username = user.getUsername();
+            boolean hasActiveSession = activePrincipals.contains(username);
+            Instant lastRequest = lastRequestByPrincipal.get(username);
+            userSessions.put(username, hasActiveSession);
+            userLastRequest.put(
+                    username, lastRequest != null ? Date.from(lastRequest) : new Date(0));
+            userSettings.put(username, maskSecrets(settingsByUserId.get(user.getId())));
+            if (hasActiveSession) activeUsers++;
+            if (!user.isEnabled()) disabledUsers++;
         }
 
         // Sort users by active status and last request date
         List<User> sortedUsers =
-                allUsers.stream()
+                visibleUsers.stream()
                         .sorted(
                                 (u1, u2) -> {
                                     boolean u1Active = userSessions.get(u1.getUsername());
@@ -380,11 +345,13 @@ public class ProprietaryUIDataController {
         int licenseMaxUsers = licenseSettingsService.getSettings().getLicenseMaxUsers();
         boolean premiumEnabled = applicationProperties.getPremium().isEnabled();
 
-        // Convert User entities to AdminUserSummary DTOs to exclude sensitive fields
+        // Resolve portal access for the whole roster.
         Set<Long> leaderUserIds = leaderUserIds();
+        Set<Long> portalAccessUserIds =
+                resourceAccessService.usersWithPortalAccess(sortedUsers, leaderUserIds);
         List<AdminUserSummary> userSummaries =
                 sortedUsers.stream()
-                        .map(user -> convertUserToSummary(user, leaderUserIds))
+                        .map(user -> convertUserToSummary(user, leaderUserIds, portalAccessUserIds))
                         .toList();
 
         AdminSettingsData data = new AdminSettingsData();
@@ -393,7 +360,7 @@ public class ProprietaryUIDataController {
         data.setRoleDetails(roleDetails);
         data.setUserSessions(userSessions);
         data.setUserLastRequest(userLastRequest);
-        data.setTotalUsers(allUsers.size());
+        data.setTotalUsers(visibleUsers.size());
         data.setActiveUsers(activeUsers);
         data.setDisabledUsers(disabledUsers);
         data.setTeams(allTeams);
@@ -516,7 +483,8 @@ public class ProprietaryUIDataController {
         }
 
         List<User> teamUsers = userRepository.findAllByTeamId(id);
-        List<User> allUsers = userRepository.findAllWithTeam();
+        // Fetch authorities + team for the available-users list.
+        List<User> allUsers = userRepository.findAllWithTeamAndAuthorities();
         List<User> availableUsers =
                 allUsers.stream()
                         .filter(
@@ -575,17 +543,48 @@ public class ProprietaryUIDataController {
                 .collect(Collectors.toSet());
     }
 
+    /** Whether the user holds the internal-API authority (never shown in the roster). */
+    private boolean isInternalApiUser(User user) {
+        for (Authority authority : user.getAuthorities()) {
+            if (Role.INTERNAL_API_USER.getRoleId().equals(authority.getAuthority())) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    /** Assemble per-user settings maps from the flat (id, key, value) rows of one bulk query. */
+    private Map<Long, Map<String, String>> loadSettingsByUserId(List<Long> userIds) {
+        Map<Long, Map<String, String>> byUser = new HashMap<>();
+        if (userIds.isEmpty()) {
+            return byUser;
+        }
+        for (Object[] row : userRepository.findSettingsByUserIds(userIds)) {
+            byUser.computeIfAbsent((Long) row[0], id -> new HashMap<>())
+                    .put((String) row[1], (String) row[2]);
+        }
+        return byUser;
+    }
+
+    /** Copy a settings map with mfaSecret masked; null-safe. */
+    private Map<String, String> maskSecrets(Map<String, String> settings) {
+        Map<String, String> copy = settings != null ? new HashMap<>(settings) : new HashMap<>();
+        if (copy.containsKey("mfaSecret")) {
+            copy.put("mfaSecret", "********");
+        }
+        return copy;
+    }
+
     /**
-     * Convert User entity to AdminUserSummary DTO, excluding sensitive fields like password and
-     * apiKey.
+     * Convert a User to AdminUserSummary (excludes sensitive fields); portal access is passed in.
      */
-    private AdminUserSummary convertUserToSummary(User user, Set<Long> leaderUserIds) {
+    private AdminUserSummary convertUserToSummary(
+            User user, Set<Long> leaderUserIds, Set<Long> portalAccessUserIds) {
         AdminUserSummary summary = new AdminUserSummary();
         summary.setId(user.getId());
         summary.setTeamLead(leaderUserIds.contains(user.getId()));
-        // Authoritative portal access, same call /me uses, so the roster honors the configured
-        // policy instead of the frontend guessing from role/team-leadership.
-        summary.setPortalAccess(resourceAccessService.canAccessPortal(user));
+        // Portal access (same policy /me uses).
+        summary.setPortalAccess(portalAccessUserIds.contains(user.getId()));
         summary.setUsername(user.getUsername());
         summary.setEmail(user.getUsername()); // Use username as email for consistency
         summary.setRoleName(user.getRoleName());
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamMembership.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamMembership.java
index de121939bb..08de0b190d 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamMembership.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamMembership.java
@@ -24,7 +24,17 @@ import stirling.software.proprietary.security.model.User;
 @Entity
 @Table(
         name = "team_memberships",
-        uniqueConstraints = {@UniqueConstraint(columnNames = {"team_id", "user_id"})})
+        uniqueConstraints = {@UniqueConstraint(columnNames = {"team_id", "user_id"})},
+        // Match the saas migration names so ddl-auto skips them on saas (index already there) and
+        // only creates them on self-hosted, which has no migrations.
+        indexes = {
+            @Index(
+                    name = "idx_team_memberships_user_role",
+                    columnList = "user_id, role"), // leader-set lookups
+            @Index(
+                    name = "idx_team_memberships_team_role",
+                    columnList = "team_id, role") // per-team member lists
+        })
 @NoArgsConstructor
 @Getter
 @Setter
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/SessionRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/SessionRepository.java
index db5d5a9b33..af35516cdb 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/SessionRepository.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/SessionRepository.java
@@ -45,4 +45,29 @@ public interface SessionRepository extends JpaRepository<SessionEntity, String>
                     + "WHERE u.team.id = :teamId "
                     + "GROUP BY u.username")
     List<Object[]> findLatestSessionByTeamId(@Param("teamId") Long teamId);
+
+    /** Latest request instant per principal. */
+    @Query(
+            "SELECT s.principalName, MAX(s.lastRequest) FROM SessionEntity s GROUP BY s.principalName")
+    List<Object[]> findLatestRequestPerPrincipal();
+
+    /** Principals with a live (non-expired, within-window) session. */
+    @Query(
+            "SELECT DISTINCT s.principalName FROM SessionEntity s "
+                    + "WHERE s.expired = false AND s.lastRequest > :cutoff")
+    List<String> findActivePrincipalsSince(@Param("cutoff") Instant cutoff);
+
+    /** Flag timed-out sessions as expired. */
+    @Modifying
+    @Transactional
+    @Query(
+            "UPDATE SessionEntity s SET s.expired = true "
+                    + "WHERE s.expired = false AND s.lastRequest < :cutoff")
+    int expireOlderThan(@Param("cutoff") Instant cutoff);
+
+    /** Purge long-expired sessions to bound table growth. */
+    @Modifying
+    @Transactional
+    @Query("DELETE FROM SessionEntity s WHERE s.expired = true AND s.lastRequest < :cutoff")
+    int deleteExpiredOlderThan(@Param("cutoff") Instant cutoff);
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java
index acae6044de..c7aa508e31 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/database/repository/UserRepository.java
@@ -1,11 +1,13 @@
 package stirling.software.proprietary.security.database.repository;
 
 import java.time.LocalDateTime;
+import java.util.Collection;
 import java.util.List;
 import java.util.Optional;
 import java.util.UUID;
 import java.util.stream.Stream;
 
+import org.springframework.data.jpa.repository.EntityGraph;
 import org.springframework.data.jpa.repository.JpaRepository;
 import org.springframework.data.jpa.repository.Modifying;
 import org.springframework.data.jpa.repository.Query;
@@ -43,6 +45,15 @@ public interface UserRepository extends JpaRepository<User, Long> {
     @Query(value = "SELECT u FROM User u LEFT JOIN FETCH u.team")
     List<User> findAllWithTeam();
 
+    /** All users with team + authorities fetched (DISTINCT dedupes the collection join). */
+    @EntityGraph(attributePaths = {"team", "authorities"})
+    @Query("SELECT DISTINCT u FROM User u")
+    List<User> findAllWithTeamAndAuthorities();
+
+    /** (userId, key, value) settings rows for the given users. */
+    @Query("SELECT u.id, KEY(s), VALUE(s) FROM User u JOIN u.settings s WHERE u.id IN :ids")
+    List<Object[]> findSettingsByUserIds(@Param("ids") Collection<Long> ids);
+
     @Query(
             "SELECT u FROM User u JOIN FETCH u.authorities JOIN FETCH u.team WHERE u.team.id = :teamId")
     List<User> findAllByTeamId(@Param("teamId") Long teamId);
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/Authority.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/Authority.java
index 9adcce1ad3..659f7691bd 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/Authority.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/Authority.java
@@ -11,6 +11,7 @@ import jakarta.persistence.Entity;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
+import jakarta.persistence.Index;
 import jakarta.persistence.JoinColumn;
 import jakarta.persistence.ManyToOne;
 import jakarta.persistence.Table;
@@ -19,7 +20,10 @@ import lombok.Getter;
 import lombok.Setter;
 
 @Entity
-@Table(name = "authorities")
+@Table(
+        name = "authorities",
+        // index the FK: authorities load by user_id
+        indexes = @Index(name = "idx_authorities_user_id", columnList = "user_id"))
 @Getter
 @Setter
 public class Authority implements GrantedAuthority, Serializable {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/SessionEntity.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/SessionEntity.java
index 7e9da2cb7d..552d97d022 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/SessionEntity.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/SessionEntity.java
@@ -5,13 +5,23 @@ import java.time.Instant;
 
 import jakarta.persistence.Entity;
 import jakarta.persistence.Id;
+import jakarta.persistence.Index;
 import jakarta.persistence.Table;
 
 import lombok.Data;
 
 @Entity
 @Data
-@Table(name = "sessions")
+@Table(
+        name = "sessions",
+        indexes = {
+            // per-principal session/activity lookups
+            @Index(
+                    name = "idx_sessions_principal_last",
+                    columnList = "principal_name, last_request"),
+            // scheduled expiry/purge scan
+            @Index(name = "idx_sessions_expired", columnList = "expired")
+        })
 public class SessionEntity implements Serializable {
     @Id private String sessionId;
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java
index eeeda1823b..32733f5fc5 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/User.java
@@ -28,7 +28,10 @@ import stirling.software.common.model.enumeration.Role;
 import stirling.software.proprietary.model.Team;
 
 @Entity
-@Table(name = "users")
+@Table(
+        name = "users",
+        // team_id backs Team.users joins, the admin roster fetch, and per-team user counts.
+        indexes = @Index(name = "idx_users_team_id", columnList = "team_id"))
 @NoArgsConstructor
 @Getter
 @Setter
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/session/SessionPersistentRegistry.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/session/SessionPersistentRegistry.java
index 3961107870..19adb9a970 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/session/SessionPersistentRegistry.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/session/SessionPersistentRegistry.java
@@ -146,6 +146,16 @@ public class SessionPersistentRegistry implements SessionRegistry {
         return sessionRepository.findAll();
     }
 
+    // Flag every session idle past the timeout.
+    public int expireStaleSessions() {
+        return sessionRepository.expireOlderThan(Instant.now().minus(defaultMaxInactiveInterval));
+    }
+
+    // Purge sessions expired longer than the retention window.
+    public int purgeExpiredSessions(Duration retention) {
+        return sessionRepository.deleteExpiredOlderThan(Instant.now().minus(retention));
+    }
+
     // Mark a session as expired
     public void expireSession(String sessionId) {
         Optional<SessionEntity> sessionEntityOpt = sessionRepository.findById(sessionId);
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/session/SessionScheduled.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/session/SessionScheduled.java
index 1f491bf4d6..8afde4959d 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/session/SessionScheduled.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/session/SessionScheduled.java
@@ -1,12 +1,8 @@
 package stirling.software.proprietary.security.session;
 
-import java.time.Instant;
-import java.time.temporal.ChronoUnit;
-import java.util.Date;
-import java.util.List;
+import java.time.Duration;
 
 import org.springframework.scheduling.annotation.Scheduled;
-import org.springframework.security.core.session.SessionInformation;
 import org.springframework.stereotype.Component;
 
 import lombok.RequiredArgsConstructor;
@@ -15,23 +11,15 @@ import lombok.RequiredArgsConstructor;
 @RequiredArgsConstructor
 public class SessionScheduled {
 
+    // Retention before an expired session is purged.
+    private static final Duration EXPIRED_SESSION_RETENTION = Duration.ofDays(30);
+
     private final SessionPersistentRegistry sessionPersistentRegistry;
 
     @Scheduled(cron = "0 0/5 * * * ?")
     public void expireSessions() {
-        Instant now = Instant.now();
-        for (Object principal : sessionPersistentRegistry.getAllPrincipals()) {
-            List<SessionInformation> sessionInformations =
-                    sessionPersistentRegistry.getAllSessions(principal, false);
-            for (SessionInformation sessionInformation : sessionInformations) {
-                Date lastRequest = sessionInformation.getLastRequest();
-                int maxInactiveInterval = sessionPersistentRegistry.getMaxInactiveInterval();
-                Instant expirationTime =
-                        lastRequest.toInstant().plus(maxInactiveInterval, ChronoUnit.SECONDS);
-                if (now.isAfter(expirationTime)) {
-                    sessionPersistentRegistry.expireSession(sessionInformation.getSessionId());
-                }
-            }
-        }
+        // Flag timed-out sessions, then purge long-dead ones.
+        sessionPersistentRegistry.expireStaleSessions();
+        sessionPersistentRegistry.purgeExpiredSessions(EXPIRED_SESSION_RETENTION);
     }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessPortalBulkParityTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessPortalBulkParityTest.java
new file mode 100644
index 0000000000..858de91726
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessPortalBulkParityTest.java
@@ -0,0 +1,151 @@
+package stirling.software.proprietary.access.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.lenient;
+
+import java.util.List;
+import java.util.Set;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.access.model.AccessPermission;
+import stirling.software.proprietary.access.model.DefaultAccessPolicy;
+import stirling.software.proprietary.access.model.PrincipalRef;
+import stirling.software.proprietary.access.model.PrincipalType;
+import stirling.software.proprietary.access.model.ResourceGrant;
+import stirling.software.proprietary.access.model.ResourceType;
+import stirling.software.proprietary.access.repository.ResourceGrantRepository;
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.model.Authority;
+import stirling.software.proprietary.security.model.User;
+
+/** Bulk portal-access must match per-user canAccessPortal for every policy. */
+@ExtendWith(MockitoExtension.class)
+class ResourceAccessPortalBulkParityTest {
+
+    @Mock private ResourceGrantRepository grantRepository;
+    @Mock private TeamLeadLookup teamLeadLookup;
+
+    private ResourceAccessService service;
+
+    private User admin;
+    private User leader;
+    private User userGrantHolder;
+    private User teamGrantMember;
+    private User plainMember;
+    private List<User> everyone;
+    private Set<Long> leaderUserIds;
+
+    void setUp(DefaultAccessPolicy policy) {
+        service =
+                new ResourceAccessService(
+                        grantRepository, teamLeadLookup, new DefaultPrincipalResolver());
+        ReflectionTestUtils.setField(service, "portalDefaultPolicy", policy);
+
+        admin = user(1L, null, Role.ADMIN.getRoleId());
+        leader = user(2L, 10L, Role.USER.getRoleId());
+        userGrantHolder = user(3L, null, Role.USER.getRoleId());
+        teamGrantMember = user(4L, 20L, Role.USER.getRoleId());
+        plainMember = user(5L, 10L, Role.USER.getRoleId());
+        everyone = List.of(admin, leader, userGrantHolder, teamGrantMember, plainMember);
+
+        // Grants: a USER grant to #3 and a TEAM grant to team 20 (which #4 belongs to).
+        lenient()
+                .when(grantRepository.findByResourceTypeAndResourceId(ResourceType.PORTAL, ""))
+                .thenReturn(
+                        List.of(
+                                grant(PrincipalType.USER, 3L, AccessPermission.USE),
+                                grant(PrincipalType.TEAM, 20L, AccessPermission.USE)));
+
+        // Only #2 leads a team; leaderUserIds is what the controller passes to the bulk method.
+        lenient().when(teamLeadLookup.isAnyTeamLeader(leader)).thenReturn(true);
+        leaderUserIds = Set.of(2L);
+    }
+
+    @Test
+    void bulkMatchesPerUserForAdminsAndTeamLeadsPolicy() {
+        assertParity(DefaultAccessPolicy.ADMINS_AND_TEAM_LEADS);
+    }
+
+    @Test
+    void bulkMatchesPerUserForOrgAllPolicy() {
+        assertParity(DefaultAccessPolicy.ORG_ALL);
+    }
+
+    @Test
+    void bulkMatchesPerUserForExplicitOnlyPolicy() {
+        assertParity(DefaultAccessPolicy.EXPLICIT_ONLY);
+    }
+
+    /** SaaS no-leak: ORG_ALL grants nobody deployment-wide when the resolver forbids it. */
+    @Test
+    void orgAllDoesNotLeakDeploymentWideWhenResolverForbidsIt() {
+        DefaultPrincipalResolver base = new DefaultPrincipalResolver();
+        PrincipalResolver saasLikeResolver =
+                new PrincipalResolver() {
+                    @Override
+                    public Set<PrincipalRef> principalsOf(User user) {
+                        return base.principalsOf(user);
+                    }
+                    // allowsDeploymentWideAccess() inherits the interface default (false) = SaaS.
+                };
+        service = new ResourceAccessService(grantRepository, teamLeadLookup, saasLikeResolver);
+        ReflectionTestUtils.setField(service, "portalDefaultPolicy", DefaultAccessPolicy.ORG_ALL);
+        lenient()
+                .when(grantRepository.findByResourceTypeAndResourceId(ResourceType.PORTAL, ""))
+                .thenReturn(List.of());
+
+        User adminUser = user(1L, null, Role.ADMIN.getRoleId());
+        User plainMember = user(5L, 10L, Role.USER.getRoleId());
+
+        Set<Long> bulk = service.usersWithPortalAccess(List.of(adminUser, plainMember), Set.of());
+
+        assertThat(bulk).contains(1L).doesNotContain(5L);
+        assertThat(service.canAccessPortal(plainMember))
+                .as("ORG_ALL must not grant a plain member deployment-wide on a SaaS-like resolver")
+                .isFalse();
+        assertThat(service.canAccessPortal(adminUser)).isTrue();
+    }
+
+    private void assertParity(DefaultAccessPolicy policy) {
+        setUp(policy);
+        Set<Long> bulk = service.usersWithPortalAccess(everyone, leaderUserIds);
+        for (User user : everyone) {
+            boolean authoritative = service.canAccessPortal(user);
+            assertThat(bulk.contains(user.getId()))
+                    .as(
+                            "policy=%s user=%d bulk should equal canAccessPortal(%s)",
+                            policy, user.getId(), authoritative)
+                    .isEqualTo(authoritative);
+        }
+    }
+
+    private User user(Long id, Long teamId, String authority) {
+        User user = new User();
+        user.setId(id);
+        user.setUsername("user-" + id);
+        new Authority(authority, user);
+        if (teamId != null) {
+            Team team = new Team();
+            team.setId(teamId);
+            team.setName("team-" + teamId);
+            user.setTeam(team);
+        }
+        return user;
+    }
+
+    private ResourceGrant grant(PrincipalType type, Long principalId, AccessPermission permission) {
+        ResourceGrant grant = new ResourceGrant();
+        grant.setResourceType(ResourceType.PORTAL);
+        grant.setResourceId("");
+        grant.setPrincipalType(type);
+        grant.setPrincipalId(principalId);
+        grant.setPermission(permission);
+        return grant;
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsPerfHarness.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsPerfHarness.java
new file mode 100644
index 0000000000..35b9e354de
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsPerfHarness.java
@@ -0,0 +1,255 @@
+package stirling.software.proprietary.controller.api;
+
+import static org.mockito.Mockito.RETURNS_DEEP_STUBS;
+import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.mock;
+
+import java.time.Duration;
+import java.time.Instant;
+import java.time.LocalDateTime;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+import org.hibernate.SessionFactory;
+import org.hibernate.stat.Statistics;
+import org.springframework.security.core.Authentication;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.EntityManagerFactory;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.common.model.enumeration.TeamRole;
+import stirling.software.proprietary.access.model.DefaultAccessPolicy;
+import stirling.software.proprietary.access.repository.ResourceGrantRepository;
+import stirling.software.proprietary.access.service.DefaultPrincipalResolver;
+import stirling.software.proprietary.access.service.MembershipTeamLeadLookup;
+import stirling.software.proprietary.access.service.ResourceAccessService;
+import stirling.software.proprietary.config.AuditConfigurationProperties;
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.model.TeamMembership;
+import stirling.software.proprietary.model.UserLicenseSettings;
+import stirling.software.proprietary.repository.PersistentAuditEventRepository;
+import stirling.software.proprietary.security.database.repository.SessionRepository;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.Authority;
+import stirling.software.proprietary.security.model.SessionEntity;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.TeamMembershipRepository;
+import stirling.software.proprietary.security.repository.TeamRepository;
+import stirling.software.proprietary.security.service.DatabaseServiceInterface;
+import stirling.software.proprietary.security.service.LoginAttemptService;
+import stirling.software.proprietary.security.service.MfaService;
+import stirling.software.proprietary.security.session.SessionPersistentRegistry;
+import stirling.software.proprietary.service.UserLicenseSettingsService;
+
+import tools.jackson.databind.ObjectMapper;
+
+/** Shared seeding, wiring, and statement-count measurement for the admin-roster query tests. */
+class AdminSettingsPerfHarness {
+
+    static final Duration SESSION_TIMEOUT = Duration.ofMinutes(30);
+    private static final Instant STALE = Instant.now().minus(Duration.ofHours(2));
+    private static final Instant FRESH = Instant.now().minus(Duration.ofMinutes(2));
+
+    record Measure(int users, long statements, long updates, long inserts, long millis) {}
+
+    private final UserRepository userRepository;
+    private final SessionRepository sessionRepository;
+    private final TeamRepository teamRepository;
+    private final TeamMembershipRepository teamMembershipRepository;
+    private final ResourceGrantRepository resourceGrantRepository;
+    private final EntityManager em;
+    private final EntityManagerFactory emf;
+
+    AdminSettingsPerfHarness(
+            UserRepository userRepository,
+            SessionRepository sessionRepository,
+            TeamRepository teamRepository,
+            TeamMembershipRepository teamMembershipRepository,
+            ResourceGrantRepository resourceGrantRepository,
+            EntityManager em,
+            EntityManagerFactory emf) {
+        this.userRepository = userRepository;
+        this.sessionRepository = sessionRepository;
+        this.teamRepository = teamRepository;
+        this.teamMembershipRepository = teamMembershipRepository;
+        this.resourceGrantRepository = resourceGrantRepository;
+        this.em = em;
+        this.emf = emf;
+    }
+
+    Measure seedAndMeasure(
+            ProprietaryUIDataController controller, Authentication auth, int userCount) {
+        wipe();
+        seed(userCount);
+        em.flush();
+        em.clear();
+
+        Statistics stats = emf.unwrap(SessionFactory.class).getStatistics();
+        stats.setStatisticsEnabled(true);
+        stats.clear();
+
+        long t0 = System.nanoTime();
+        var response = controller.getAdminSettingsData(auth);
+        int users = response.getBody().getUsers().size();
+        em.flush(); // materialise any writes the GET issued so they are counted
+        long millis = (System.nanoTime() - t0) / 1_000_000;
+
+        return new Measure(
+                users,
+                stats.getPrepareStatementCount(),
+                stats.getEntityUpdateCount(),
+                stats.getEntityInsertCount(),
+                millis);
+    }
+
+    void wipe() {
+        // Detach anything a prior measure left managed, then delete children before parents.
+        em.clear();
+        teamMembershipRepository.deleteAllInBatch();
+        sessionRepository.deleteAllInBatch();
+        resourceGrantRepository.deleteAllInBatch();
+        // Not deleteAllInBatch: a bulk DELETE bypasses the User->authorities/user_settings cascade.
+        userRepository.deleteAll();
+        em.flush();
+        teamRepository.deleteAllInBatch();
+        em.flush();
+        em.clear();
+    }
+
+    void seed(int userCount) {
+        int teamCount = Math.max(1, userCount / 40);
+        List<Team> teams = new ArrayList<>(teamCount);
+        for (int i = 0; i < teamCount; i++) {
+            Team team = new Team();
+            team.setName("team-" + i);
+            teams.add(team);
+        }
+        List<Team> savedTeams = teamRepository.saveAll(teams);
+        em.flush();
+
+        List<User> users = new ArrayList<>(userCount);
+        List<SessionEntity> sessions = new ArrayList<>(userCount);
+        for (int i = 0; i < userCount; i++) {
+            User user = new User();
+            String username = "user-" + i;
+            user.setUsername(username);
+            user.setEnabled(true);
+            user.setTeam(savedTeams.get(i % teamCount));
+            new Authority(i == 0 ? Role.ADMIN.getRoleId() : Role.USER.getRoleId(), user);
+            Map<String, String> settings = new HashMap<>();
+            settings.put("language", "en-GB");
+            if (i % 5 == 0) {
+                settings.put("mfaSecret", "SECRET-" + i);
+            }
+            user.setSettings(settings);
+            users.add(user);
+
+            SessionEntity session = new SessionEntity();
+            session.setSessionId(UUID.randomUUID().toString());
+            session.setPrincipalName(username);
+            // ~30% of sessions are past the timeout.
+            session.setLastRequest(i % 10 < 3 ? STALE : FRESH);
+            session.setExpired(false);
+            sessions.add(session);
+        }
+        List<User> savedUsers = userRepository.saveAll(users);
+        sessionRepository.saveAll(sessions);
+        em.flush();
+
+        List<TeamMembership> memberships = new ArrayList<>();
+        for (int i = 0; i < userCount; i++) {
+            if (i % 10 == 0) {
+                TeamMembership membership = new TeamMembership();
+                membership.setTeam(savedUsers.get(i).getTeam());
+                membership.setUser(savedUsers.get(i));
+                membership.setRole(TeamRole.LEADER);
+                membership.setInvitedAt(LocalDateTime.now());
+                memberships.add(membership);
+            }
+        }
+        teamMembershipRepository.saveAll(memberships);
+        em.flush();
+    }
+
+    ProprietaryUIDataController buildController() {
+        ApplicationProperties applicationProperties =
+                mock(ApplicationProperties.class, RETURNS_DEEP_STUBS);
+
+        SessionPersistentRegistry sessionRegistry =
+                new SessionPersistentRegistry(sessionRepository);
+        ReflectionTestUtils.setField(
+                sessionRegistry, "defaultMaxInactiveInterval", SESSION_TIMEOUT);
+
+        ResourceAccessService resourceAccessService =
+                new ResourceAccessService(
+                        resourceGrantRepository,
+                        new MembershipTeamLeadLookup(teamMembershipRepository),
+                        new DefaultPrincipalResolver());
+        ReflectionTestUtils.setField(
+                resourceAccessService,
+                "portalDefaultPolicy",
+                DefaultAccessPolicy.ADMINS_AND_TEAM_LEADS);
+
+        UserLicenseSettingsService licenseSettingsService = mock(UserLicenseSettingsService.class);
+        UserLicenseSettings licenseSettings = mock(UserLicenseSettings.class);
+        lenient().when(licenseSettings.getLicenseMaxUsers()).thenReturn(0);
+        lenient().when(licenseSettingsService.getSettings()).thenReturn(licenseSettings);
+        lenient().when(licenseSettingsService.calculateMaxAllowedUsers()).thenReturn(100_000);
+        lenient().when(licenseSettingsService.getAvailableUserSlots()).thenReturn(100_000L);
+        lenient().when(licenseSettingsService.getDisplayGrandfatheredCount()).thenReturn(0);
+
+        LoginAttemptService loginAttemptService = mock(LoginAttemptService.class);
+        lenient().when(loginAttemptService.getAllBlockedUsers()).thenReturn(new ArrayList<>());
+
+        return new ProprietaryUIDataController(
+                applicationProperties,
+                mock(AuditConfigurationProperties.class),
+                sessionRegistry,
+                userRepository,
+                teamRepository,
+                teamMembershipRepository,
+                sessionRepository,
+                mock(DatabaseServiceInterface.class),
+                mock(ObjectMapper.class),
+                false,
+                licenseSettingsService,
+                mock(PersistentAuditEventRepository.class),
+                mock(MfaService.class),
+                loginAttemptService,
+                resourceAccessService);
+    }
+
+    Authentication adminAuth() {
+        Authentication auth = mock(Authentication.class);
+        lenient().when(auth.getName()).thenReturn("user-0");
+        return auth;
+    }
+
+    User mkUser(String username, Team team, String authority, Map<String, String> settings) {
+        User user = new User();
+        user.setUsername(username);
+        user.setEnabled(true);
+        user.setTeam(team);
+        new Authority(authority, user);
+        user.setSettings(new HashMap<>(settings));
+        return user;
+    }
+
+    TeamRepository teams() {
+        return teamRepository;
+    }
+
+    UserRepository users() {
+        return userRepository;
+    }
+
+    EntityManager em() {
+        return em;
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsQueryPerfTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsQueryPerfTest.java
new file mode 100644
index 0000000000..92ec752610
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsQueryPerfTest.java
@@ -0,0 +1,194 @@
+package stirling.software.proprietary.controller.api;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.mock;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.SpringBootConfiguration;
+import org.springframework.boot.data.jpa.test.autoconfigure.DataJpaTest;
+import org.springframework.boot.persistence.autoconfigure.EntityScan;
+import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
+import org.springframework.security.core.Authentication;
+
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.EntityManagerFactory;
+import jakarta.persistence.PersistenceContext;
+
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.access.repository.ResourceGrantRepository;
+import stirling.software.proprietary.controller.api.AdminSettingsPerfHarness.Measure;
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.security.database.repository.SessionRepository;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.model.dto.AdminUserSummary;
+import stirling.software.proprietary.security.repository.TeamMembershipRepository;
+import stirling.software.proprietary.security.repository.TeamRepository;
+import stirling.software.proprietary.security.service.TeamService;
+
+/** Admin roster issues a constant query count regardless of size (H2). */
+@DataJpaTest
+class AdminSettingsQueryPerfTest {
+
+    @Autowired private UserRepository userRepository;
+    @Autowired private SessionRepository sessionRepository;
+    @Autowired private TeamRepository teamRepository;
+    @Autowired private TeamMembershipRepository teamMembershipRepository;
+    @Autowired private ResourceGrantRepository resourceGrantRepository;
+    @Autowired private EntityManagerFactory emf;
+
+    @PersistenceContext private EntityManager em;
+
+    private AdminSettingsPerfHarness harness() {
+        return new AdminSettingsPerfHarness(
+                userRepository,
+                sessionRepository,
+                teamRepository,
+                teamMembershipRepository,
+                resourceGrantRepository,
+                em,
+                emf);
+    }
+
+    @Test
+    void queryCountDoesNotScaleWithUsers() {
+        AdminSettingsPerfHarness harness = harness();
+        ProprietaryUIDataController controller = harness.buildController();
+        Authentication admin = harness.adminAuth();
+
+        Measure small = harness.seedAndMeasure(controller, admin, 150);
+        Measure large = harness.seedAndMeasure(controller, admin, 750);
+
+        System.out.printf(
+                "%n[admin-settings scaling] N=%d -> %d statements, %d updates, %d ms%n",
+                small.users(), small.statements(), small.updates(), small.millis());
+        System.out.printf(
+                "[admin-settings scaling] N=%d -> %d statements, %d updates, %d ms%n",
+                large.users(), large.statements(), large.updates(), large.millis());
+        long delta = large.statements() - small.statements();
+        System.out.printf(
+                "[admin-settings scaling] +%d users cost +%d statements%n",
+                large.users() - small.users(), delta);
+
+        assertTrue(
+                delta <= 40,
+                "admin-settings issues per-user queries: adding "
+                        + (large.users() - small.users())
+                        + " users added "
+                        + delta
+                        + " SQL statements (expected <= 40). The roster endpoint still scales O(N).");
+        assertEquals(
+                0,
+                large.updates(),
+                "admin-settings performed " + large.updates() + " row UPDATEs during a read (GET)");
+    }
+
+    @Test
+    void headlineBenchmark() {
+        int n = Integer.getInteger("adminBenchUsers", 2000);
+        AdminSettingsPerfHarness harness = harness();
+        ProprietaryUIDataController controller = harness.buildController();
+
+        Measure m = harness.seedAndMeasure(controller, harness.adminAuth(), n);
+        System.out.printf(
+                "%n==== admin-settings headline (N=%d users) ====%n"
+                        + "  SQL statements : %d%n"
+                        + "  row UPDATEs    : %d%n"
+                        + "  row INSERTs    : %d%n"
+                        + "  wall-clock     : %d ms%n"
+                        + "  statements/user: %.2f%n"
+                        + "==============================================%n",
+                m.users(),
+                m.statements(),
+                m.updates(),
+                m.inserts(),
+                m.millis(),
+                (double) m.statements() / n);
+
+        assertEquals(n, m.users(), "roster should return every seeded (non-internal) user");
+    }
+
+    @Test
+    void rosterExcludesInternalAccountsAndMasksSecrets() {
+        AdminSettingsPerfHarness harness = harness();
+        ProprietaryUIDataController controller = harness.buildController();
+        harness.wipe();
+
+        Team acme = new Team();
+        acme.setName("acme");
+        Team internal = new Team();
+        internal.setName(TeamService.INTERNAL_TEAM_NAME);
+        List<Team> savedTeams = harness.teams().saveAll(List.of(acme, internal));
+        harness.em().flush();
+
+        User adminUser =
+                harness.mkUser("admin", savedTeams.get(0), Role.ADMIN.getRoleId(), Map.of());
+        User mfaUser =
+                harness.mkUser(
+                        "mfa-user",
+                        savedTeams.get(0),
+                        Role.USER.getRoleId(),
+                        Map.of("mfaSecret", "TOPSECRET", "language", "fr"));
+        User apiUser =
+                harness.mkUser(
+                        "internal-api",
+                        savedTeams.get(0),
+                        Role.INTERNAL_API_USER.getRoleId(),
+                        Map.of());
+        User internalTeamUser =
+                harness.mkUser("internal-team", savedTeams.get(1), Role.USER.getRoleId(), Map.of());
+        harness.users().saveAll(List.of(adminUser, mfaUser, apiUser, internalTeamUser));
+        harness.em().flush();
+        harness.em().clear();
+
+        Authentication auth = mock(Authentication.class);
+        lenient().when(auth.getName()).thenReturn("admin");
+        ProprietaryUIDataController.AdminSettingsData data =
+                controller.getAdminSettingsData(auth).getBody();
+
+        Set<String> usernames =
+                data.getUsers().stream()
+                        .map(AdminUserSummary::getUsername)
+                        .collect(Collectors.toSet());
+        assertTrue(usernames.contains("admin"));
+        assertTrue(usernames.contains("mfa-user"));
+        assertFalse(usernames.contains("internal-api"), "internal-api user must be excluded");
+        assertFalse(usernames.contains("internal-team"), "internal-team user must be excluded");
+        assertEquals(2, data.getTotalUsers());
+
+        Map<String, String> mfaSettings = data.getUserSettings().get("mfa-user");
+        assertEquals("********", mfaSettings.get("mfaSecret"), "mfaSecret must be masked");
+        assertEquals("fr", mfaSettings.get("language"), "non-secret settings preserved");
+
+        AdminUserSummary adminSummary =
+                data.getUsers().stream()
+                        .filter(u -> "admin".equals(u.getUsername()))
+                        .findFirst()
+                        .orElseThrow();
+        assertTrue(adminSummary.isPortalAccess(), "admin should have portal access");
+    }
+
+    @SpringBootConfiguration
+    @EntityScan(
+            basePackages = {
+                "stirling.software.proprietary.security.model",
+                "stirling.software.proprietary.model",
+                "stirling.software.proprietary.access.model"
+            })
+    @EnableJpaRepositories(
+            basePackages = {
+                "stirling.software.proprietary.security.database.repository",
+                "stirling.software.proprietary.security.repository",
+                "stirling.software.proprietary.access.repository"
+            })
+    static class TestApp {}
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsQueryPostgresTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsQueryPostgresTest.java
new file mode 100644
index 0000000000..11d3e7184c
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/AdminSettingsQueryPostgresTest.java
@@ -0,0 +1,109 @@
+package stirling.software.proprietary.controller.api;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.SpringBootConfiguration;
+import org.springframework.boot.data.jpa.test.autoconfigure.DataJpaTest;
+import org.springframework.boot.jdbc.test.autoconfigure.AutoConfigureTestDatabase;
+import org.springframework.boot.persistence.autoconfigure.EntityScan;
+import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
+import org.springframework.security.core.Authentication;
+import org.springframework.test.context.DynamicPropertyRegistry;
+import org.springframework.test.context.DynamicPropertySource;
+import org.testcontainers.containers.PostgreSQLContainer;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+
+import jakarta.persistence.EntityManager;
+import jakarta.persistence.EntityManagerFactory;
+import jakarta.persistence.PersistenceContext;
+
+import stirling.software.proprietary.access.repository.ResourceGrantRepository;
+import stirling.software.proprietary.controller.api.AdminSettingsPerfHarness.Measure;
+import stirling.software.proprietary.security.database.repository.SessionRepository;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.repository.TeamMembershipRepository;
+import stirling.software.proprietary.security.repository.TeamRepository;
+
+/** Admin-roster queries + index DDL on real Postgres (skipped without Docker). */
+@DataJpaTest
+@AutoConfigureTestDatabase(replace = AutoConfigureTestDatabase.Replace.NONE)
+@Testcontainers(disabledWithoutDocker = true)
+class AdminSettingsQueryPostgresTest {
+
+    @Container
+    static PostgreSQLContainer<?> POSTGRES = new PostgreSQLContainer<>("postgres:16-alpine");
+
+    @DynamicPropertySource
+    static void datasource(DynamicPropertyRegistry registry) {
+        registry.add("spring.datasource.url", POSTGRES::getJdbcUrl);
+        registry.add("spring.datasource.username", POSTGRES::getUsername);
+        registry.add("spring.datasource.password", POSTGRES::getPassword);
+        registry.add("spring.datasource.driver-class-name", () -> "org.postgresql.Driver");
+        registry.add("spring.jpa.hibernate.ddl-auto", () -> "create-drop");
+        registry.add("spring.jpa.properties.hibernate.default_batch_fetch_size", () -> "100");
+    }
+
+    @Autowired private UserRepository userRepository;
+    @Autowired private SessionRepository sessionRepository;
+    @Autowired private TeamRepository teamRepository;
+    @Autowired private TeamMembershipRepository teamMembershipRepository;
+    @Autowired private ResourceGrantRepository resourceGrantRepository;
+    @Autowired private EntityManagerFactory emf;
+
+    @PersistenceContext private EntityManager em;
+
+    private AdminSettingsPerfHarness harness() {
+        return new AdminSettingsPerfHarness(
+                userRepository,
+                sessionRepository,
+                teamRepository,
+                teamMembershipRepository,
+                resourceGrantRepository,
+                em,
+                emf);
+    }
+
+    @Test
+    void newRosterQueriesRunOnPostgresWithConstantScaling() {
+        AdminSettingsPerfHarness harness = harness();
+        ProprietaryUIDataController controller = harness.buildController();
+        Authentication admin = harness.adminAuth();
+
+        Measure small = harness.seedAndMeasure(controller, admin, 100);
+        Measure large = harness.seedAndMeasure(controller, admin, 400);
+
+        System.out.printf(
+                "%n[admin-settings postgres] N=%d -> %d statements, %d updates, %d ms%n",
+                small.users(), small.statements(), small.updates(), small.millis());
+        System.out.printf(
+                "[admin-settings postgres] N=%d -> %d statements, %d updates, %d ms%n",
+                large.users(), large.statements(), large.updates(), large.millis());
+
+        assertEquals(400, large.users(), "roster returns every seeded user on Postgres");
+        assertTrue(
+                large.statements() - small.statements() <= 40,
+                "roster must not scale per-user on Postgres (delta="
+                        + (large.statements() - small.statements())
+                        + ")");
+        assertEquals(0, large.updates(), "no writes during the GET on Postgres");
+    }
+
+    @SpringBootConfiguration
+    @EntityScan(
+            basePackages = {
+                "stirling.software.proprietary.security.model",
+                "stirling.software.proprietary.model",
+                "stirling.software.proprietary.access.model"
+            })
+    @EnableJpaRepositories(
+            basePackages = {
+                "stirling.software.proprietary.security.database.repository",
+                "stirling.software.proprietary.security.repository",
+                "stirling.software.proprietary.access.repository"
+            })
+    static class TestApp {}
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerMoreTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerMoreTest.java
index 585edc6e66..58b8972a45 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerMoreTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerMoreTest.java
@@ -141,7 +141,8 @@ class ProprietaryUIDataControllerMoreTest {
         void singleAdminFirstLogin() {
             User admin = normalUser(1L, "admin");
             admin.setFirstLogin(true);
-            when(userRepository.findAll()).thenReturn(List.of(admin));
+            when(userRepository.countByUsernameNot(Role.INTERNAL_API_USER.getRoleId()))
+                    .thenReturn(1L);
             when(userRepository.findByUsernameIgnoreCase("admin")).thenReturn(Optional.of(admin));
 
             ResponseEntity<LoginData> response = controller.getLoginData();
@@ -154,7 +155,8 @@ class ProprietaryUIDataControllerMoreTest {
         @Test
         @DisplayName("does not flag setup when a normal user exists")
         void normalUserNoSetup() {
-            when(userRepository.findAll()).thenReturn(List.of(normalUser(1L, "bob")));
+            when(userRepository.countByUsernameNot(Role.INTERNAL_API_USER.getRoleId()))
+                    .thenReturn(1L);
 
             ResponseEntity<LoginData> response = controller.getLoginData();
 
@@ -252,11 +254,9 @@ class ProprietaryUIDataControllerMoreTest {
         @DisplayName("aggregates users, teams and license limits")
         void aggregates() {
             User user = normalUser(1L, "bob");
-            when(userRepository.findAllWithTeam())
+            when(userRepository.findAllWithTeamAndAuthorities())
                     .thenReturn(new java.util.ArrayList<>(List.of(user)));
             when(sessionPersistentRegistry.getMaxInactiveInterval()).thenReturn(3600);
-            when(sessionPersistentRegistry.findLatestSession("bob")).thenReturn(Optional.empty());
-            when(userRepository.findByIdWithSettings(1L)).thenReturn(Optional.of(user));
             when(teamRepository.findAll()).thenReturn(List.of());
 
             when(licenseSettingsService.calculateMaxAllowedUsers()).thenReturn(10);
@@ -310,7 +310,7 @@ class ProprietaryUIDataControllerMoreTest {
             team.setName("Engineering");
             when(teamRepository.findById(5L)).thenReturn(Optional.of(team));
             when(userRepository.findAllByTeamId(5L)).thenReturn(List.of());
-            when(userRepository.findAllWithTeam()).thenReturn(List.of());
+            when(userRepository.findAllWithTeamAndAuthorities()).thenReturn(List.of());
             when(sessionRepository.findLatestSessionByTeamId(5L))
                     .thenReturn(Collections.emptyList());
 
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerTest.java
index 0b01c9bcf5..297d83583d 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerTest.java
@@ -3,7 +3,6 @@ package stirling.software.proprietary.controller.api;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.when;
 
-import java.util.Collections;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@@ -93,7 +92,7 @@ class ProprietaryUIDataControllerTest {
 
     @Test
     void loginDataFlagsFirstTimeSetupWhenNoUsers() {
-        when(userRepository.findAll()).thenReturn(Collections.emptyList());
+        when(userRepository.countByUsernameNot(Role.INTERNAL_API_USER.getRoleId())).thenReturn(0L);
 
         ResponseEntity<LoginData> response = controller.getLoginData();
 

From 1835e6fe6b351ac69fa911caf665b86da3db88cf Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Thu, 16 Jul 2026 14:43:11 +0200
Subject: [PATCH 036/109] Avoid uv cache reservation collisions in CI by adding
 per-workflow cache-suffix (#7060)

### Motivation
- Prevent concurrent GitHub Actions jobs from attempting to reserve the
same `setup-uv` cache key and failing with "Unable to reserve cache ...
another job may be creating this cache" when multiple workflows run at
once.
- Target workflows that enable `setup-uv` caching and have run
concurrently in CI: pre-commit, check-generated-models, ai-engine, and
sync_files_v2.

### Description
- Added a `cache-suffix` value to the `astral-sh/setup-uv` step in
`.github/workflows/pre_commit.yml`,
`.github/workflows/check-generated-models.yml`,
`.github/workflows/ai-engine.yml`, and
`.github/workflows/sync_files_v2.yml` to create unique cache keys
(`pre-commit`, `generated-models`, `ai-engine`, `sync-files`).
- No behavior changes beyond isolating the uv cache keys per-workflow
and no other workflow steps were modified.

### Testing
- Ran `git diff --check` which completed with no reported whitespace or
index issues.
- Verified each modified workflow is valid YAML by loading them with a
Ruby YAML parser which succeeded for all four files.
- Attempted to run `task --list` to exercise the Taskfile locally but
`task` is not installed in this environment so that check could not be
executed.

------
[Codex
Task](https://chatgpt.com/codex/cloud/tasks/task_e_6a58b399a33083259d65e0614fcc35d2)
---
 .github/workflows/ai-engine.yml              | 1 +
 .github/workflows/check-generated-models.yml | 1 +
 .github/workflows/pre_commit.yml             | 1 +
 .github/workflows/sync_files_v2.yml          | 1 +
 4 files changed, 4 insertions(+)

diff --git a/.github/workflows/ai-engine.yml b/.github/workflows/ai-engine.yml
index 554100f535..58fe551c33 100644
--- a/.github/workflows/ai-engine.yml
+++ b/.github/workflows/ai-engine.yml
@@ -33,6 +33,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
+          cache-suffix: ai-engine
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
diff --git a/.github/workflows/check-generated-models.yml b/.github/workflows/check-generated-models.yml
index db9c49fba2..f6e63f0006 100644
--- a/.github/workflows/check-generated-models.yml
+++ b/.github/workflows/check-generated-models.yml
@@ -36,6 +36,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
+          cache-suffix: generated-models
 
       - name: Set up JDK 25
         uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
diff --git a/.github/workflows/pre_commit.yml b/.github/workflows/pre_commit.yml
index 37c31b7be3..3feca530d1 100644
--- a/.github/workflows/pre_commit.yml
+++ b/.github/workflows/pre_commit.yml
@@ -28,6 +28,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
+          cache-suffix: pre-commit
 
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0
diff --git a/.github/workflows/sync_files_v2.yml b/.github/workflows/sync_files_v2.yml
index 956453192b..38873bb1eb 100644
--- a/.github/workflows/sync_files_v2.yml
+++ b/.github/workflows/sync_files_v2.yml
@@ -64,6 +64,7 @@ jobs:
         uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           enable-cache: true
+          cache-suffix: sync-files
 
       - name: Install Task
         uses: go-task/setup-task@3be4020d41929789a01026e0e427a4321ce0ad44 # v2.0.0

From 275d70242e88a902987ace7bb53d3dd27c6ccb68 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Thu, 16 Jul 2026 15:01:11 +0100
Subject: [PATCH 037/109] Portal Editor admin: replace glyph icons with SVGs
 (#6999)

# Description of Changes

Swaps the emoji and box glyphs in the editor deployment, pairing and
storage panels for tinted icons consistent with the rest of the portal.

Part of a portal (processor) UI-consistency pass, split into small
focused PRs.


---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [x] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../editor/src/portal/api/editorDeploy.ts     |  7 +-
 .../editor-admin/DeploymentTargets.tsx        | 18 ++++-
 .../components/editor-admin/PairingPanel.tsx  | 25 ++++--
 .../components/infrastructure/StorageTab.tsx  | 78 ++++++++++---------
 .../editor/src/portal/views/EditorAdmin.css   | 22 +++++-
 5 files changed, 100 insertions(+), 50 deletions(-)

diff --git a/frontend/editor/src/portal/api/editorDeploy.ts b/frontend/editor/src/portal/api/editorDeploy.ts
index 67952d8bb4..e90cac89c3 100644
--- a/frontend/editor/src/portal/api/editorDeploy.ts
+++ b/frontend/editor/src/portal/api/editorDeploy.ts
@@ -119,14 +119,13 @@ export interface EditorDeploymentResponse {
 /* ──────────────────────────────────────────────────────────────────────── */
 
 export interface TargetMeta {
-  icon: string;
   tone: "neutral" | "blue" | "purple";
 }
 
 export const TARGET_META: Record<TargetKind, TargetMeta> = {
-  cloud: { icon: "☁", tone: "blue" },
-  docker: { icon: "▣", tone: "neutral" },
-  kubernetes: { icon: "⎈", tone: "purple" },
+  cloud: { tone: "blue" },
+  docker: { tone: "neutral" },
+  kubernetes: { tone: "purple" },
 };
 
 export const INSTANCE_STATUS_TONE: Record<
diff --git a/frontend/editor/src/portal/components/editor-admin/DeploymentTargets.tsx b/frontend/editor/src/portal/components/editor-admin/DeploymentTargets.tsx
index 7add4fd8b5..2348b6311e 100644
--- a/frontend/editor/src/portal/components/editor-admin/DeploymentTargets.tsx
+++ b/frontend/editor/src/portal/components/editor-admin/DeploymentTargets.tsx
@@ -1,8 +1,21 @@
 import { useTranslation } from "react-i18next";
+import CloudQueueRounded from "@mui/icons-material/CloudQueueRounded";
+import HubRounded from "@mui/icons-material/HubRounded";
+import Inventory2Rounded from "@mui/icons-material/Inventory2Rounded";
 import { Button, Card, CodeBlock, StatusBadge } from "@app/ui";
-import { TARGET_META, type DeploymentTarget } from "@portal/api/editorDeploy";
+import {
+  TARGET_META,
+  type DeploymentTarget,
+  type TargetKind,
+} from "@portal/api/editorDeploy";
 import { useTier } from "@portal/contexts/TierContext";
 
+const TARGET_ICON: Record<TargetKind, typeof CloudQueueRounded> = {
+  cloud: CloudQueueRounded,
+  docker: Inventory2Rounded,
+  kubernetes: HubRounded,
+};
+
 const STATE_BADGE_TONE: Record<
   DeploymentTarget["state"],
   "success" | "info" | "neutral"
@@ -36,6 +49,7 @@ export function DeploymentTargets({ targets, onUpgrade }: Props) {
     <div className="portal-editor__targets">
       {targets.map((target) => {
         const meta = TARGET_META[target.kind];
+        const Icon = TARGET_ICON[target.kind];
         const locked = target.state === "locked";
         return (
           <Card
@@ -48,7 +62,7 @@ export function DeploymentTargets({ targets, onUpgrade }: Props) {
                 className={`portal-editor__target-icon portal-editor__target-icon--${meta.tone}`}
                 aria-hidden
               >
-                {meta.icon}
+                <Icon style={{ fontSize: "1.2rem" }} />
               </span>
               <div className="portal-editor__target-titles">
                 <h3 className="portal-editor__target-name">{target.label}</h3>
diff --git a/frontend/editor/src/portal/components/editor-admin/PairingPanel.tsx b/frontend/editor/src/portal/components/editor-admin/PairingPanel.tsx
index 6544ab1967..ea14ffd669 100644
--- a/frontend/editor/src/portal/components/editor-admin/PairingPanel.tsx
+++ b/frontend/editor/src/portal/components/editor-admin/PairingPanel.tsx
@@ -1,12 +1,21 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
+import CastRounded from "@mui/icons-material/CastRounded";
+import TerminalRounded from "@mui/icons-material/TerminalRounded";
+import VpnKeyRounded from "@mui/icons-material/VpnKeyRounded";
 import { Button, Card, Chip, CodeBlock } from "@app/ui";
 import type { PairingMethod, PairingOption } from "@portal/api/editorDeploy";
 
-const METHOD_ICON: Record<PairingMethod, string> = {
-  token: "🔑",
-  shortcode: "📺",
-  iac: "🧱",
+const METHOD_ICON: Record<PairingMethod, typeof VpnKeyRounded> = {
+  token: VpnKeyRounded,
+  shortcode: CastRounded,
+  iac: TerminalRounded,
+};
+
+const METHOD_TONE: Record<PairingMethod, "blue" | "purple" | "green"> = {
+  token: "blue",
+  shortcode: "purple",
+  iac: "green",
 };
 
 interface Props {
@@ -36,6 +45,7 @@ export function PairingPanel({ pairings, onUpgrade }: Props) {
     <div className="portal-editor__pairings">
       {pairings.map((p) => {
         const isCode = p.method === "iac";
+        const Icon = METHOD_ICON[p.method];
         return (
           <Card
             key={p.method}
@@ -43,8 +53,11 @@ export function PairingPanel({ pairings, onUpgrade }: Props) {
             className="portal-editor__pairing"
           >
             <div className="portal-editor__pairing-head">
-              <span className="portal-editor__pairing-icon" aria-hidden>
-                {METHOD_ICON[p.method]}
+              <span
+                className={`portal-editor__pairing-icon portal-editor__pairing-icon--${METHOD_TONE[p.method]}`}
+                aria-hidden
+              >
+                <Icon style={{ fontSize: "1.2rem" }} />
               </span>
               <div className="portal-editor__pairing-titles">
                 <h3 className="portal-editor__pairing-name">{p.label}</h3>
diff --git a/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx b/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
index a1f3b91869..49033345e1 100644
--- a/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/StorageTab.tsx
@@ -1,5 +1,8 @@
-import { useState } from "react";
+import { useState, type ComponentType, type CSSProperties } from "react";
 import { useTranslation } from "react-i18next";
+import ArrowForwardRounded from "@mui/icons-material/ArrowForwardRounded";
+import CloudRounded from "@mui/icons-material/CloudRounded";
+import StorageRounded from "@mui/icons-material/StorageRounded";
 import {
   Button,
   Card,
@@ -20,13 +23,13 @@ import {
 import { SectionHeader } from "@portal/components/infrastructure/SectionHeader";
 import { pct } from "@portal/components/infrastructure/infraFormat";
 
-const PROVIDER_GLYPH: Record<
+const PROVIDER_ICON: Record<
   StorageConfig["providers"][number]["kind"],
-  string
+  ComponentType<{ style?: CSSProperties }>
 > = {
-  stirling: "◆",
-  s3: "▣",
-  azure: "▤",
+  stirling: StorageRounded,
+  s3: CloudRounded,
+  azure: CloudRounded,
 };
 
 /** Storage fills past this fraction of quota are surfaced in red. */
@@ -143,35 +146,38 @@ export function StorageTab() {
             sub={t("portal.infrastructure.storage.providers.subheading")}
           />
           <ul className="portal-infra__providers">
-            {data.providers.map((p) => (
-              <li key={p.id} className="portal-infra__provider">
-                <span className="portal-infra__provider-glyph" aria-hidden>
-                  {PROVIDER_GLYPH[p.kind]}
-                </span>
-                <span className="portal-infra__provider-text">
-                  <span className="portal-infra__cell-strong">{p.name}</span>
-                  <span className="portal-infra__muted">{p.detail}</span>
-                </span>
-                {p.connected ? (
-                  <span className="portal-infra__provider-meta">
-                    <span className="portal-infra__mono">
-                      {t("portal.infrastructure.storage.gbValue", {
-                        value: p.usedGb,
-                      })}
-                    </span>
-                    <StatusBadge tone="success" size="sm">
-                      {t("portal.infrastructure.storage.providers.connected")}
-                    </StatusBadge>
+            {data.providers.map((p) => {
+              const ProviderIcon = PROVIDER_ICON[p.kind];
+              return (
+                <li key={p.id} className="portal-infra__provider">
+                  <span className="portal-infra__provider-glyph" aria-hidden>
+                    <ProviderIcon style={{ fontSize: "1.2rem" }} />
                   </span>
-                ) : (
-                  // TODO(backend): launch the provider OAuth/credential flow,
-                  // then POST /v1/infrastructure/storage/providers/{id}/connect
-                  <Button variant="secondary" size="sm">
-                    {t("portal.infrastructure.storage.providers.connect")}
-                  </Button>
-                )}
-              </li>
-            ))}
+                  <span className="portal-infra__provider-text">
+                    <span className="portal-infra__cell-strong">{p.name}</span>
+                    <span className="portal-infra__muted">{p.detail}</span>
+                  </span>
+                  {p.connected ? (
+                    <span className="portal-infra__provider-meta">
+                      <span className="portal-infra__mono">
+                        {t("portal.infrastructure.storage.gbValue", {
+                          value: p.usedGb,
+                        })}
+                      </span>
+                      <StatusBadge tone="success" size="sm">
+                        {t("portal.infrastructure.storage.providers.connected")}
+                      </StatusBadge>
+                    </span>
+                  ) : (
+                    // TODO(backend): launch the provider OAuth/credential flow,
+                    // then POST /v1/infrastructure/storage/providers/{id}/connect
+                    <Button variant="secondary" size="sm">
+                      {t("portal.infrastructure.storage.providers.connect")}
+                    </Button>
+                  )}
+                </li>
+              );
+            })}
           </ul>
         </Card>
 
@@ -205,7 +211,7 @@ export function StorageTab() {
               </span>
             </div>
             <span className="portal-infra__lifecycle-arrow" aria-hidden>
-              →
+              <ArrowForwardRounded style={{ fontSize: "1.2rem" }} />
             </span>
             <div className="portal-infra__lifecycle-stage">
               <span className="portal-infra__lifecycle-dot" />
@@ -217,7 +223,7 @@ export function StorageTab() {
               </span>
             </div>
             <span className="portal-infra__lifecycle-arrow" aria-hidden>
-              →
+              <ArrowForwardRounded style={{ fontSize: "1.2rem" }} />
             </span>
             <div className="portal-infra__lifecycle-stage">
               <span className="portal-infra__lifecycle-dot" />
diff --git a/frontend/editor/src/portal/views/EditorAdmin.css b/frontend/editor/src/portal/views/EditorAdmin.css
index 92dc1d384e..2fda00cda5 100644
--- a/frontend/editor/src/portal/views/EditorAdmin.css
+++ b/frontend/editor/src/portal/views/EditorAdmin.css
@@ -181,8 +181,26 @@
 }
 
 .portal-editor__pairing-icon {
-  font-size: 1.125rem;
-  line-height: 1.4;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 2rem;
+  height: 2rem;
+  flex-shrink: 0;
+  border-radius: var(--radius-md);
+}
+
+.portal-editor__pairing-icon--blue {
+  background: var(--color-blue-light);
+  color: var(--color-blue);
+}
+.portal-editor__pairing-icon--purple {
+  background: var(--color-purple-light);
+  color: var(--color-purple);
+}
+.portal-editor__pairing-icon--green {
+  background: var(--color-green-light);
+  color: var(--color-green);
 }
 
 .portal-editor__pairing-titles {

From 6b2ab5a743546f6e31a9f3a0c973830f2a890487 Mon Sep 17 00:00:00 2001
From: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Date: Thu, 16 Jul 2026 16:32:08 +0100
Subject: [PATCH 038/109] The flow chart for policies running (#7014)

---
 frontend/.storybook/preview.tsx               |  24 +-
 .../public/locales/en-US/translation.toml     |  42 ++
 frontend/editor/src/core/ui/StatusBadge.css   |  35 +-
 .../editor/src/portal/api/processorFlow.ts    | 173 ++++++++
 .../src/portal/components/ProcessorFlow.css   | 394 ++++++++++++++++++
 .../components/ProcessorFlow.stories.tsx      |  60 +++
 .../src/portal/components/ProcessorFlow.tsx   | 184 ++++++++
 .../components/processor-flow/FlowIcons.tsx   |  28 ++
 .../processor-flow/FlowOutcomes.tsx           |  59 +++
 .../processor-flow/FlowPolicies.tsx           |  79 ++++
 .../components/processor-flow/FlowSankey.tsx  | 237 +++++++++++
 .../components/processor-flow/FlowSources.tsx |  94 +++++
 .../components/processor-flow/flowTypes.ts    | 103 +++++
 .../processor-flow/useFlowGeometry.tsx        | 123 ++++++
 .../processor-flow/useFlowParticles.ts        | 261 ++++++++++++
 frontend/editor/src/portal/mocks/policies.ts  | 117 ++++--
 frontend/editor/src/portal/views/Home.tsx     |   2 +
 .../src/portal/views/Infrastructure.tsx       |  26 +-
 frontend/editor/src/portal/views/Policies.tsx |  17 +-
 frontend/editor/src/portal/views/Sources.css  |  24 +-
 20 files changed, 2006 insertions(+), 76 deletions(-)
 create mode 100644 frontend/editor/src/portal/api/processorFlow.ts
 create mode 100644 frontend/editor/src/portal/components/ProcessorFlow.css
 create mode 100644 frontend/editor/src/portal/components/ProcessorFlow.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/ProcessorFlow.tsx
 create mode 100644 frontend/editor/src/portal/components/processor-flow/FlowIcons.tsx
 create mode 100644 frontend/editor/src/portal/components/processor-flow/FlowOutcomes.tsx
 create mode 100644 frontend/editor/src/portal/components/processor-flow/FlowPolicies.tsx
 create mode 100644 frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx
 create mode 100644 frontend/editor/src/portal/components/processor-flow/FlowSources.tsx
 create mode 100644 frontend/editor/src/portal/components/processor-flow/flowTypes.ts
 create mode 100644 frontend/editor/src/portal/components/processor-flow/useFlowGeometry.tsx
 create mode 100644 frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts

diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index fd3673ca1a..4f358cc634 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -43,14 +43,32 @@ function parseEnTranslation(): Record<string, unknown> {
   }
 }
 
+const enTranslationResources = parseEnTranslation();
 if (!i18next.isInitialized) {
+  // initImmediate: false → initialise synchronously from the inline resources
+  // (there's no async backend here), so i18next is ready before the first story
+  // renders. Without it the first render can beat init and stick on raw keys.
   void i18next.use(initReactI18next).init({
-    lng: "en",
-    fallbackLng: "en",
-    resources: { en: { translation: parseEnTranslation() } },
+    lng: "en-US",
+    fallbackLng: "en-US",
+    supportedLngs: ["en-US"],
+    resources: { "en-US": { translation: enTranslationResources } },
     interpolation: { escapeValue: false },
     react: { useSuspense: false },
+    initImmediate: false,
   });
+} else {
+  // Something initialised i18next first (e.g. the app's async TOML backend):
+  // inject the shipped English copy under the resolved language so t() renders
+  // real copy, not raw keys.
+  const lng = i18next.resolvedLanguage || i18next.language || "en-US";
+  i18next.addResourceBundle(
+    lng,
+    "translation",
+    enTranslationResources,
+    true,
+    true,
+  );
 }
 
 // Start MSW once. Storybook runs in a browser so this uses the service worker.
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 6be49df2e0..fefa9c7e3f 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7641,6 +7641,48 @@ soon = "Soon"
 managePlan = "Manage plan"
 volumeSuffix = "PDFs processed · last 30 days"
 
+[portal.processorFlow]
+footnote = "Counts are over the last 24 hours. Flow speed is illustrative."
+liveBadge = "Live"
+stats = "{{connected}} connected · {{processed}} PDFs processed"
+title = "PDF Processor"
+
+[portal.processorFlow.lens]
+ariaLabel = "View mode"
+flow = "Flow"
+sankey = "Sankey"
+
+[portal.processorFlow.outcomes]
+count = "{{n}} · 24h"
+failed = "Failed"
+heading = "Outcomes"
+success = "Delivered"
+
+[portal.processorFlow.policies]
+activeCount = "{{n}} active"
+count = "{{n}} · 24h"
+heading = "Policies"
+setUp = "Set up"
+soon = "Soon"
+
+[portal.processorFlow.sankey]
+waist = "Policies · {{n}} active"
+
+[portal.processorFlow.sankey.empty]
+description = "Connect a source and switch on a policy to watch documents flow through the processor."
+title = "No flow yet"
+
+[portal.processorFlow.sources]
+comingSoonTag = "Connect"
+editor = "Stirling PDF Editor"
+heading = "Sources"
+perDay = "{{n}} / 24h"
+
+[portal.processorFlow.sources.comingSoon]
+apiMcp = "API · MCP"
+cloud = "Drive · Box · S3"
+email = "Email intake"
+
 [portal.procurement]
 subtitle = "Get your team evaluated, contracted, and onboarded. Every document in one place."
 title = "Procurement"
diff --git a/frontend/editor/src/core/ui/StatusBadge.css b/frontend/editor/src/core/ui/StatusBadge.css
index a250f99d9a..9115eb6099 100644
--- a/frontend/editor/src/core/ui/StatusBadge.css
+++ b/frontend/editor/src/core/ui/StatusBadge.css
@@ -8,6 +8,17 @@
   letter-spacing: 0.01em;
   border: 1px solid transparent;
   line-height: 1;
+  color: var(--sui-status-c, var(--color-text-3));
+  background: color-mix(
+    in srgb,
+    var(--sui-status-c, var(--color-text-3)) 12%,
+    transparent
+  );
+  border-color: color-mix(
+    in srgb,
+    var(--sui-status-c, var(--color-text-3)) 28%,
+    transparent
+  );
 }
 .sui-status--sm {
   font-size: 0.6875rem;
@@ -38,33 +49,27 @@
   animation: pulseRing 1.4s ease-out infinite;
 }
 
+/* Neutral keeps the plain muted surface rather than an accent tint. */
 .sui-status--neutral {
   color: var(--color-text-3);
   background: var(--color-bg-muted);
   border-color: var(--color-border-light);
 }
+/* Accent tones only pick the accent; the base rule builds the fill + border.
+   The `-dark` variants are theme-adaptive (darker in light, brighter in dark),
+   so the text stays legible on the pale fill in both themes. */
 .sui-status--success {
-  color: var(--color-green);
-  background: var(--color-green-light);
-  border-color: var(--color-green-border);
+  --sui-status-c: var(--color-green-dark);
 }
 .sui-status--warning {
-  color: var(--color-amber-dark);
-  background: var(--color-amber-light);
-  border-color: var(--color-amber-border);
+  --sui-status-c: var(--color-amber-dark);
 }
 .sui-status--danger {
-  color: var(--color-red);
-  background: var(--color-red-light);
-  border-color: var(--color-red-border);
+  --sui-status-c: var(--color-red-dark);
 }
 .sui-status--info {
-  color: var(--color-blue);
-  background: var(--color-blue-light);
-  border-color: var(--color-blue-border);
+  --sui-status-c: var(--color-blue-dark);
 }
 .sui-status--purple {
-  color: var(--color-purple);
-  background: var(--color-purple-light);
-  border-color: var(--color-purple-border);
+  --sui-status-c: var(--color-purple-dark);
 }
diff --git a/frontend/editor/src/portal/api/processorFlow.ts b/frontend/editor/src/portal/api/processorFlow.ts
new file mode 100644
index 0000000000..30a9b468a6
--- /dev/null
+++ b/frontend/editor/src/portal/api/processorFlow.ts
@@ -0,0 +1,173 @@
+/**
+ * Processor-flow assembler for the home visualiser.
+ *
+ * Fans in the three real portal surfaces — sources (`/api/v1/sources`), policies
+ * (`/api/v1/policies`) and their runs (`/api/v1/policies/runs`) — and derives the
+ * left→middle→right shape the {@link ProcessorFlow} component renders:
+ *
+ *   sources  →  policies  →  outcomes
+ *
+ * Everything here is real backend data. Per-run source attribution does not
+ * exist (a `PolicyRunView` carries `policyId` but no source id), so the flow
+ * animation is illustrative; the node counts are not — each source's `docs24h`,
+ * each policy's trailing-24h run count, and the success/failure split all come
+ * straight from the API.
+ */
+
+import { apiClient } from "@portal/api/http";
+import { fetchSources } from "@portal/api/sources";
+import { POLICY_CATEGORIES } from "@portal/api/policies";
+import { fromWirePolicy } from "@app/policies/codec";
+import type { PolicyRunView, WirePolicy } from "@app/policies/types";
+
+/** A source that actually feeds the processor today (editor, folder, S3, …). */
+export interface FlowSource {
+  id: string;
+  /** Display name (already resolved; editor rows get a friendly label). */
+  name: string;
+  type: string;
+  /** Documents this source fed into runs over the trailing 24h. */
+  docs24h: number;
+}
+
+/**
+ * A connector type shown in the sources column but not yet a real source type —
+ * a "coming soon" affordance only. `labelKey` is an i18n key.
+ */
+export interface FlowComingSoonSource {
+  key: string;
+  labelKey: string;
+}
+
+/**
+ * Row display state, mirroring the Policies page:
+ *   - `active`  — configured + enabled; shows its live 24h run count
+ *   - `off`     — available but not set up; offers a "Set up" CTA
+ *   - `locked`  — a coming-soon category that doesn't exist yet
+ */
+export type FlowPolicyState = "active" | "off" | "locked";
+
+/**
+ * One row in the middle policies column — the full policy catalogue, in the
+ * same order the Policies page shows, including the coming-soon categories.
+ */
+export interface FlowPolicy {
+  /** Category id (also the lane key for the flow animation + its icon). */
+  key: string;
+  /** i18n key for the category label. */
+  labelKey: string;
+  state: FlowPolicyState;
+  configured: boolean;
+  runs24h: number;
+}
+
+export type FlowOutcomeKey = "success" | "failed";
+
+/** A terminal audit outcome node on the right, counted over the trailing 24h. */
+export interface FlowOutcome {
+  key: FlowOutcomeKey;
+  labelKey: string;
+  count24h: number;
+}
+
+export interface ProcessorFlow {
+  sources: FlowSource[];
+  comingSoonSources: FlowComingSoonSource[];
+  policies: FlowPolicy[];
+  outcomes: FlowOutcome[];
+}
+
+const DAY_MS = 86_400_000;
+
+/** Connector types the sources column advertises but can't create yet. */
+const COMING_SOON_SOURCES: FlowComingSoonSource[] = [
+  { key: "apiMcp", labelKey: "portal.processorFlow.sources.comingSoon.apiMcp" },
+  {
+    key: "cloud",
+    labelKey: "portal.processorFlow.sources.comingSoon.cloud",
+  },
+  {
+    key: "email",
+    labelKey: "portal.processorFlow.sources.comingSoon.email",
+  },
+];
+
+/**
+ * The full policy catalogue, in the Policies-page order, including the
+ * coming-soon categories (rendered as locked). `active` rows carry their
+ * trailing-24h run count.
+ */
+function buildPolicies(
+  wirePolicies: WirePolicy[],
+  runs: PolicyRunView[],
+): FlowPolicy[] {
+  const cutoff = Date.now() - DAY_MS;
+  const decoded = wirePolicies.map(fromWirePolicy);
+
+  return POLICY_CATEGORIES.map((cat) => {
+    const dp = decoded.find((p) => p.categoryId === cat.id);
+    const configured = Boolean(dp?.enabled);
+    const state: FlowPolicyState = configured
+      ? "active"
+      : cat.comingSoon
+        ? "locked"
+        : "off";
+    const runs24h = dp
+      ? runs.filter((r) => r.policyId === dp.id && r.createdAt >= cutoff).length
+      : 0;
+    return {
+      key: cat.id,
+      labelKey: cat.label,
+      state,
+      configured,
+      runs24h,
+    };
+  });
+}
+
+/** Terminal audit outcomes over the trailing 24h — success vs failure. */
+function buildOutcomes(runs: PolicyRunView[]): FlowOutcome[] {
+  const cutoff = Date.now() - DAY_MS;
+  const recent = runs.filter((r) => r.createdAt >= cutoff);
+  const success = recent.filter((r) => r.status === "COMPLETED").length;
+  const failed = recent.filter(
+    (r) => r.status === "FAILED" || r.status === "CANCELLED",
+  ).length;
+  return [
+    {
+      key: "success",
+      labelKey: "portal.processorFlow.outcomes.success",
+      count24h: success,
+    },
+    {
+      key: "failed",
+      labelKey: "portal.processorFlow.outcomes.failed",
+      count24h: failed,
+    },
+  ];
+}
+
+/** Assemble the full flow model from the three live portal surfaces. */
+export async function fetchProcessorFlow(): Promise<ProcessorFlow> {
+  const [sourcesResp, wirePolicies, runs] = await Promise.all([
+    fetchSources(),
+    apiClient.local.json<WirePolicy[]>("/api/v1/policies"),
+    apiClient.local
+      .json<PolicyRunView[]>("/api/v1/policies/runs")
+      .catch(() => [] as PolicyRunView[]),
+  ]);
+
+  const sources: FlowSource[] = sourcesResp.sources.map((s) => ({
+    id: s.id,
+    name: s.name,
+    type: s.type,
+    docs24h: s.docs24h,
+  }));
+
+  return {
+    sources,
+    comingSoonSources: COMING_SOON_SOURCES,
+    policies: buildPolicies(wirePolicies, runs),
+    outcomes: buildOutcomes(runs),
+  };
+}
diff --git a/frontend/editor/src/portal/components/ProcessorFlow.css b/frontend/editor/src/portal/components/ProcessorFlow.css
new file mode 100644
index 0000000000..5aa7f6198f
--- /dev/null
+++ b/frontend/editor/src/portal/components/ProcessorFlow.css
@@ -0,0 +1,394 @@
+/* Processor-flow visualiser — sources → policies → outcomes. The flow is an
+   SVG overlay measured from the HTML cards: bézier wires underneath, and a
+   rAF-driven particle layer on top (see ProcessorFlow.tsx). */
+
+.portal-pf {
+  --pf-accent: var(--color-green);
+}
+
+/* ── Header ──────────────────────────────────────────────────────────────── */
+.portal-pf__head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  margin-bottom: 1rem;
+}
+
+.portal-pf__head-text {
+  display: flex;
+  align-items: baseline;
+  gap: 0.5rem;
+  min-width: 0;
+}
+
+.portal-pf__head-actions {
+  display: flex;
+  align-items: center;
+  gap: 0.625rem;
+  flex: none;
+}
+
+.portal-pf__live {
+  align-self: center;
+  width: 0.5rem;
+  height: 0.5rem;
+  border-radius: 50%;
+  background: var(--color-border);
+}
+
+.portal-pf__live--on {
+  background: var(--pf-accent);
+  box-shadow: 0 0 0 0 color-mix(in srgb, var(--pf-accent) 55%, transparent);
+  animation: pf-pulse 2.4s ease-out infinite;
+}
+
+.portal-pf__title {
+  margin: 0;
+  font-size: 0.9375rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+}
+
+.portal-pf__connected {
+  font-size: 0.75rem;
+  color: var(--color-text-4);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+/* ── Stage: relative box the SVG overlays are measured against ───────────── */
+.portal-pf__stage {
+  position: relative;
+  padding: 0.25rem 0 0.5rem;
+}
+
+.portal-pf__wires,
+.portal-pf__particles {
+  position: absolute;
+  inset: 0;
+  width: 100%;
+  height: 100%;
+  pointer-events: none;
+  overflow: visible;
+}
+
+.portal-pf__wires {
+  z-index: 0;
+}
+
+.portal-pf__particles {
+  z-index: 2;
+}
+
+.portal-pf__wire-path {
+  fill: none;
+  stroke: var(--color-border-light);
+  stroke-width: 1.25;
+}
+
+/* ── Columns ─────────────────────────────────────────────────────────────── */
+.portal-pf__cols {
+  position: relative;
+  z-index: 1;
+  display: flex;
+  justify-content: space-between;
+  align-items: stretch;
+  gap: 1rem;
+}
+
+.portal-pf__col {
+  display: flex;
+  flex-direction: column;
+  justify-content: center;
+  gap: 0.5rem;
+  flex: none;
+  width: 15rem;
+}
+
+.portal-pf__col-head,
+.portal-pf__policies-head {
+  font-size: 0.6875rem;
+  font-weight: 600;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  color: var(--color-text-5);
+  margin-bottom: 0.125rem;
+}
+
+/* ── Nodes (source + outcome cards) ─────────────────────────────────────────── */
+.portal-pf__node {
+  height: auto;
+  width: 100%;
+  text-align: left;
+  background: var(--color-bg);
+  border: 1px solid var(--color-border-light);
+  border-radius: var(--radius-md);
+  transition:
+    background var(--motion-fast),
+    border-color var(--motion-fast);
+}
+
+.portal-pf__node .mantine-Button-label {
+  flex: 1 1 auto;
+  justify-content: flex-start;
+  overflow: visible;
+}
+
+.portal-pf__node:hover {
+  background: var(--color-bg-hover);
+  border-color: var(--color-border);
+}
+
+.portal-pf__node:focus-visible {
+  outline: 2px solid var(--color-blue);
+  outline-offset: 2px;
+}
+
+.portal-pf__node--soon {
+  background: transparent;
+  border-style: dashed;
+  opacity: 0.75;
+}
+
+.portal-pf__node-icon {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  flex: none;
+  width: 1.75rem;
+  height: 1.75rem;
+  border-radius: var(--radius-md);
+  font-size: 0.9375rem;
+  background: var(--color-bg-muted);
+  color: var(--color-text-3);
+}
+
+.portal-pf__node--soon .portal-pf__node-icon {
+  color: var(--color-text-5);
+  font-weight: 600;
+}
+
+.portal-pf__node--success .portal-pf__node-icon {
+  background: color-mix(in srgb, var(--color-green) 14%, transparent);
+  color: var(--color-green-dark);
+}
+
+.portal-pf__node--failed .portal-pf__node-icon {
+  background: color-mix(in srgb, var(--color-red) 14%, transparent);
+  color: var(--color-red-dark);
+}
+
+.portal-pf__node-text {
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+}
+
+.portal-pf__node-text strong {
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+  white-space: nowrap;
+  overflow: hidden;
+  text-overflow: ellipsis;
+}
+
+.portal-pf__node-text span {
+  font-size: 0.6875rem;
+  color: var(--color-text-4);
+}
+
+/* ── Policies card (core) ───────────────────────────────────────────────────── */
+.portal-pf__policies {
+  align-self: center;
+  flex: none;
+  width: 18rem;
+  padding: 0.75rem;
+  background: var(--color-bg);
+  border: 1px solid var(--color-border-light);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-sm);
+}
+
+.portal-pf__policies-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0 0.25rem 0.5rem;
+}
+
+.portal-pf__policies-active {
+  text-transform: none;
+  letter-spacing: 0;
+  color: var(--color-green-dark);
+}
+
+.portal-pf__policy {
+  padding: 0.5rem 0.25rem;
+}
+
+.portal-pf__policy + .portal-pf__policy {
+  border-top: 1px solid var(--color-border-light);
+}
+
+.portal-pf__policy-line {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+.portal-pf__policy-icon {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  flex: none;
+  width: 1.5rem;
+  height: 1.5rem;
+  border-radius: 6px;
+  font-size: 0.875rem;
+  color: var(--color-text-4);
+  transition:
+    color 0.3s ease,
+    background-color 0.3s ease,
+    box-shadow 0.3s ease;
+}
+
+.portal-pf__policy--active .portal-pf__policy-icon {
+  color: var(--pf-accent);
+}
+
+.portal-pf__policy--locked .portal-pf__policy-icon {
+  color: var(--color-text-5);
+}
+
+/* Leading-LED blink: added for 150ms as a particle threads this row's lane,
+   then eased back out by the transition above. */
+.portal-pf__policy-icon.is-pulse {
+  color: var(--color-green-dark);
+  background-color: color-mix(in srgb, var(--color-green) 20%, transparent);
+  box-shadow: 0 0 8px 1px
+    color-mix(in srgb, var(--color-green) 55%, transparent);
+}
+
+.portal-pf__policy-label {
+  flex: 1 1 auto;
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--color-text-2);
+  min-width: 0;
+}
+
+.portal-pf__policy--active .portal-pf__policy-label {
+  color: var(--color-text-1);
+}
+
+.portal-pf__policy--locked .portal-pf__policy-label {
+  color: var(--color-text-4);
+  font-weight: 500;
+}
+
+.portal-pf__policy-count {
+  font-size: 0.75rem;
+  color: var(--color-text-4);
+  font-variant-numeric: tabular-nums;
+  white-space: nowrap;
+}
+
+.portal-pf__policy-soon {
+  flex: none;
+  font-size: 0.6875rem;
+  font-weight: 600;
+  color: var(--color-text-5);
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+
+/* Vertical padding via the `py` prop; height auto so it grows with it. */
+.portal-pf__setup {
+  flex: none;
+  height: auto;
+}
+
+/* ── Footnote / loading ─────────────────────────────────────────────────────── */
+.portal-pf__foot {
+  margin: 0.875rem 0 0;
+  font-size: 0.6875rem;
+  color: var(--color-text-5);
+}
+
+.portal-pf__loading {
+  padding: 0.5rem 0;
+}
+
+/* ── Sankey lens ────────────────────────────────────────────────────────────── */
+.portal-pf__sankey {
+  max-width: 46rem;
+  margin: 0.5rem auto 0;
+}
+
+.portal-pf__sankey svg {
+  display: block;
+  width: 100%;
+  height: auto;
+  overflow: visible;
+}
+
+.portal-pf__sankey-label {
+  font-size: 12px;
+  font-weight: 600;
+  fill: var(--color-text-2);
+  font-variant-numeric: tabular-nums;
+}
+
+.portal-pf__sankey-caption {
+  font-size: 10.5px;
+  font-weight: 600;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+  fill: var(--color-text-5);
+}
+
+.portal-pf__sankey-empty {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  min-height: 11rem;
+}
+
+@keyframes pf-pulse {
+  0% {
+    box-shadow: 0 0 0 0 color-mix(in srgb, var(--pf-accent) 55%, transparent);
+  }
+  70% {
+    box-shadow: 0 0 0 0.4rem transparent;
+  }
+  100% {
+    box-shadow: 0 0 0 0 transparent;
+  }
+}
+
+/* ── Responsive: stack the columns; the measured-geometry flow overlay only
+   makes sense on the wide 3-column layout, so drop it below the breakpoint. ── */
+@media (max-width: 60rem) {
+  .portal-pf__wires,
+  .portal-pf__particles {
+    display: none;
+  }
+  .portal-pf__cols {
+    flex-direction: column;
+    gap: 0.75rem;
+  }
+  .portal-pf__col,
+  .portal-pf__policies {
+    width: 100%;
+    align-self: stretch;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .portal-pf__live--on {
+    animation: none;
+  }
+}
diff --git a/frontend/editor/src/portal/components/ProcessorFlow.stories.tsx b/frontend/editor/src/portal/components/ProcessorFlow.stories.tsx
new file mode 100644
index 0000000000..e573751ac6
--- /dev/null
+++ b/frontend/editor/src/portal/components/ProcessorFlow.stories.tsx
@@ -0,0 +1,60 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import { ProcessorFlow } from "@portal/components/ProcessorFlow";
+
+/**
+ * The home processor visualiser. Data is served by the global portal MSW
+ * handlers (seeded sources + one active Security policy + its runs), so the
+ * middle column shows Security "active" and Classification with a "Set up" CTA,
+ * and the outcomes reflect the seeded 24h success/failure split.
+ *
+ * NB: the flow particles animate via requestAnimationFrame, which browsers
+ * pause while the tab/preview is hidden — open the story in a focused tab to
+ * see the dots move.
+ */
+const meta: Meta<typeof ProcessorFlow> = {
+  title: "Portal/Components/ProcessorFlow",
+  component: ProcessorFlow,
+  parameters: { layout: "padded" },
+};
+export default meta;
+
+type Story = StoryObj<typeof ProcessorFlow>;
+
+/** Live machine: Security configured + real throughput → the flow runs. */
+export const Default: Story = {};
+
+/**
+ * Nothing set up and no activity — the empty state from the design. In
+ * production the flow stays still here; the DEV_KEEP_FLOWING dev flag forces it
+ * on with synthetic rates so the animation is visible while iterating.
+ */
+export const IdleEmpty: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/sources", () =>
+          HttpResponse.json({
+            kpis: [],
+            sources: [
+              {
+                id: "editor",
+                name: "Editor",
+                type: "editor",
+                status: "active",
+                referenceCount: 0,
+                referencingPolicies: [],
+                config: [],
+                docsTotal: 0,
+                docs24h: 0,
+                docs30d: 0,
+              },
+            ],
+          }),
+        ),
+        http.get("/api/v1/policies", () => HttpResponse.json([])),
+        http.get("/api/v1/policies/runs", () => HttpResponse.json([])),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/ProcessorFlow.tsx b/frontend/editor/src/portal/components/ProcessorFlow.tsx
new file mode 100644
index 0000000000..4b4a832ad3
--- /dev/null
+++ b/frontend/editor/src/portal/components/ProcessorFlow.tsx
@@ -0,0 +1,184 @@
+import { useState } from "react";
+import { useNavigate } from "react-router-dom";
+import { useTranslation } from "react-i18next";
+import { Card, SegmentedControl, Skeleton, StatusBadge } from "@app/ui";
+import {
+  useView,
+  VIEW_PATHS,
+  toPortalPath,
+} from "@portal/contexts/ViewContext";
+import { useAsync } from "@portal/hooks/useAsync";
+import {
+  fetchProcessorFlow,
+  type ProcessorFlow as ProcessorFlowModel,
+} from "@portal/api/processorFlow";
+import {
+  DEV_KEEP_FLOWING,
+  DEV_SYNTH_RATE,
+  type Lens,
+} from "@portal/components/processor-flow/flowTypes";
+import { useFlowGeometry } from "@portal/components/processor-flow/useFlowGeometry";
+import { useFlowParticles } from "@portal/components/processor-flow/useFlowParticles";
+import { FlowSources } from "@portal/components/processor-flow/FlowSources";
+import { FlowPolicies } from "@portal/components/processor-flow/FlowPolicies";
+import { FlowOutcomes } from "@portal/components/processor-flow/FlowOutcomes";
+import { FlowSankey } from "@portal/components/processor-flow/FlowSankey";
+import "@portal/components/ProcessorFlow.css";
+
+/**
+ * Animated processor visualiser for the home surface: connected sources on the
+ * left flow through the standing policies in the middle to their audit outcomes
+ * on the right. Two lenses — a live particle flow and a Sankey summary.
+ *
+ * This module wires the data + gating together; the moving parts live under
+ * `processor-flow/`: geometry ({@link useFlowGeometry}), the rAF particle loop
+ * ({@link useFlowParticles}), the three columns, and the Sankey. The flow only
+ * runs when something is set up AND there's activity; an idle machine stays
+ * still (unless {@link DEV_KEEP_FLOWING} forces it while iterating).
+ */
+export function ProcessorFlow() {
+  const { t } = useTranslation();
+  const { setActiveView } = useView();
+  const navigate = useNavigate();
+  const { data, loading } = useAsync<ProcessorFlowModel>(
+    () => fetchProcessorFlow(),
+    [],
+  );
+
+  const [lens, setLens] = useState<Lens>("flow");
+  const isLoading = loading && data === null;
+
+  /** Deep-link to the Policies page and auto-open that policy's setup wizard. */
+  const openPolicySetup = (key: string) =>
+    navigate(
+      `${toPortalPath(VIEW_PATHS.policies)}?setup=${encodeURIComponent(key)}`,
+    );
+
+  /** Deep-link to Infrastructure with the audit-log tab open. */
+  const openAuditLog = () =>
+    navigate(`${toPortalPath(VIEW_PATHS.infrastructure)}?tab=audit`);
+
+  const sources = data?.sources ?? [];
+  const policies = data?.policies ?? [];
+  const outcomes = data?.outcomes ?? [];
+  const comingSoonSources = data?.comingSoonSources ?? [];
+
+  // ── Flow gating: run only when something is set up AND there's activity.
+  const totalRate = sources.reduce((sum, s) => sum + s.docs24h, 0);
+  const hasConfigured = policies.some((p) => p.configured);
+  const liveFlow = hasConfigured && totalRate > 0;
+  // When forcing for dev with no live flow, synthesise rates + thread every row.
+  const devForced = DEV_KEEP_FLOWING && !liveFlow;
+  const animate = liveFlow || devForced;
+
+  // Particles only thread configured (active) policies; while dev-forcing with
+  // no live flow, thread the available (non-locked) rows so the demo has lanes.
+  const laneKeys = policies
+    .filter((p) => (devForced ? p.state !== "locked" : p.state === "active"))
+    .map((p) => p.key);
+
+  const activeCount = policies.filter((p) => p.state === "active").length;
+  const pdfsProcessed = outcomes.reduce((sum, o) => sum + o.count24h, 0);
+  const statsLabel = t("portal.processorFlow.stats", {
+    connected: sources.length,
+    processed: pdfsProcessed.toLocaleString(),
+  });
+
+  // Per-source rates + outcome weights feeding the particle loop.
+  const rates = sources.map((s) => (devForced ? DEV_SYNTH_RATE : s.docs24h));
+  const weights = (() => {
+    const raw = outcomes.map((o) => o.count24h);
+    const sum = raw.reduce((a, b) => a + b, 0);
+    if (sum > 0) return raw.map((v) => v / sum);
+    // No real outcomes yet (dev flow): success-heavy default.
+    return outcomes.map((o) => (o.key === "failed" ? 0.15 : 0.85));
+  })();
+  const outcomeKeys = outcomes.map((o) => o.key);
+
+  const { wrapRef, srcRefs, outRefs, coreRef, laneRefs, geoRef, wires } =
+    useFlowGeometry();
+  const pGroupRef = useFlowParticles({
+    geoRef,
+    animate,
+    lens,
+    rates,
+    weights,
+    laneKeys,
+    outcomeKeys,
+  });
+
+  return (
+    <Card padding="loose" className="portal-pf">
+      <header className="portal-pf__head">
+        <div className="portal-pf__head-text">
+          <span
+            className={
+              "portal-pf__live" + (animate ? " portal-pf__live--on" : "")
+            }
+            aria-hidden
+          />
+          <h2 className="portal-pf__title">
+            {t("portal.processorFlow.title")}
+          </h2>
+          <span className="portal-pf__connected">{statsLabel}</span>
+        </div>
+        <div className="portal-pf__head-actions">
+          <StatusBadge tone={animate ? "success" : "neutral"} size="sm">
+            {t("portal.processorFlow.liveBadge")}
+          </StatusBadge>
+          <SegmentedControl<Lens>
+            size="xs"
+            value={lens}
+            onChange={setLens}
+            ariaLabel={t("portal.processorFlow.lens.ariaLabel")}
+            options={[
+              { label: t("portal.processorFlow.lens.flow"), value: "flow" },
+              { label: t("portal.processorFlow.lens.sankey"), value: "sankey" },
+            ]}
+          />
+        </div>
+      </header>
+
+      {isLoading ? (
+        <div className="portal-pf__loading" aria-hidden>
+          <Skeleton height="9rem" />
+        </div>
+      ) : lens === "sankey" ? (
+        <FlowSankey sources={sources} outcomes={outcomes} policies={policies} />
+      ) : (
+        <div className="portal-pf__stage" ref={wrapRef}>
+          <svg className="portal-pf__wires" aria-hidden>
+            {wires}
+          </svg>
+
+          <div className="portal-pf__cols">
+            <FlowSources
+              sources={sources}
+              comingSoonSources={comingSoonSources}
+              srcRefs={srcRefs}
+              onOpen={() => setActiveView("sources")}
+            />
+            <FlowPolicies
+              policies={policies}
+              activeCount={activeCount}
+              coreRef={coreRef}
+              laneRefs={laneRefs}
+              onSetup={openPolicySetup}
+            />
+            <FlowOutcomes
+              outcomes={outcomes}
+              outRefs={outRefs}
+              onOpen={openAuditLog}
+            />
+          </div>
+
+          <svg className="portal-pf__particles" aria-hidden>
+            <g ref={pGroupRef} />
+          </svg>
+        </div>
+      )}
+
+      <p className="portal-pf__foot">{t("portal.processorFlow.footnote")}</p>
+    </Card>
+  );
+}
diff --git a/frontend/editor/src/portal/components/processor-flow/FlowIcons.tsx b/frontend/editor/src/portal/components/processor-flow/FlowIcons.tsx
new file mode 100644
index 0000000000..8cb83ab444
--- /dev/null
+++ b/frontend/editor/src/portal/components/processor-flow/FlowIcons.tsx
@@ -0,0 +1,28 @@
+import LocalIcon from "@app/components/shared/LocalIcon";
+import type { FlowOutcomeKey } from "@portal/api/processorFlow";
+import {
+  EDITOR_TYPE,
+  ICON_SIZE,
+} from "@portal/components/processor-flow/flowTypes";
+
+/** Real Material Symbols icon for a live source node, keyed off its `type`. */
+export function SourceIcon({ type }: { type: string }) {
+  switch (type) {
+    case EDITOR_TYPE:
+      return <LocalIcon icon="edit-document" width={ICON_SIZE} />;
+    case "s3":
+      return <LocalIcon icon="cloud" width={ICON_SIZE} />;
+    case "folder":
+      return <LocalIcon icon="folder" width={ICON_SIZE} />;
+    default:
+      return <LocalIcon icon="database" width={ICON_SIZE} />;
+  }
+}
+
+/** Real Material Symbols icon for an audit outcome node. Literal icon names
+ *  (not a ternary) so the icon extractor bundles them. */
+export function OutcomeIcon({ outcome }: { outcome: FlowOutcomeKey }) {
+  if (outcome === "success")
+    return <LocalIcon icon="check-circle" width={ICON_SIZE} />;
+  return <LocalIcon icon="cancel" width={ICON_SIZE} />;
+}
diff --git a/frontend/editor/src/portal/components/processor-flow/FlowOutcomes.tsx b/frontend/editor/src/portal/components/processor-flow/FlowOutcomes.tsx
new file mode 100644
index 0000000000..1a3eeabfde
--- /dev/null
+++ b/frontend/editor/src/portal/components/processor-flow/FlowOutcomes.tsx
@@ -0,0 +1,59 @@
+import { type RefObject } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import type { FlowOutcome } from "@portal/api/processorFlow";
+import { OutcomeIcon } from "@portal/components/processor-flow/FlowIcons";
+
+interface FlowOutcomesProps {
+  outcomes: FlowOutcome[];
+  /** One ref slot per outcome, in order, for geometry measurement. */
+  outRefs: RefObject<(HTMLElement | null)[]>;
+  onOpen: () => void;
+}
+
+/** Right column: terminal audit outcomes (delivered / failed). */
+export function FlowOutcomes({ outcomes, outRefs, onOpen }: FlowOutcomesProps) {
+  const { t } = useTranslation();
+  return (
+    <section
+      className="portal-pf__col portal-pf__col--outcomes"
+      aria-label={t("portal.processorFlow.outcomes.heading")}
+    >
+      <span className="portal-pf__col-head">
+        {t("portal.processorFlow.outcomes.heading")}
+      </span>
+      {outcomes.map((outcome, j) => (
+        <Button
+          key={outcome.key}
+          variant="quiet"
+          justify="start"
+          fullWidth
+          px="sm"
+          py="sm"
+          className={
+            "portal-pf__node portal-pf__node--outcome portal-pf__node--" +
+            outcome.key
+          }
+          onClick={onOpen}
+          ref={(el: HTMLButtonElement | null) => {
+            outRefs.current[j] = el;
+          }}
+          leftSection={
+            <span className="portal-pf__node-icon" aria-hidden>
+              <OutcomeIcon outcome={outcome.key} />
+            </span>
+          }
+        >
+          <span className="portal-pf__node-text">
+            <strong>{t(outcome.labelKey)}</strong>
+            <span>
+              {t("portal.processorFlow.outcomes.count", {
+                n: outcome.count24h,
+              })}
+            </span>
+          </span>
+        </Button>
+      ))}
+    </section>
+  );
+}
diff --git a/frontend/editor/src/portal/components/processor-flow/FlowPolicies.tsx b/frontend/editor/src/portal/components/processor-flow/FlowPolicies.tsx
new file mode 100644
index 0000000000..f01d51c44d
--- /dev/null
+++ b/frontend/editor/src/portal/components/processor-flow/FlowPolicies.tsx
@@ -0,0 +1,79 @@
+import { type RefObject } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import { policyCategoryIcon } from "@app/components/policies/policyCategoryIcon";
+import type { FlowPolicy } from "@portal/api/processorFlow";
+
+interface FlowPoliciesProps {
+  policies: FlowPolicy[];
+  activeCount: number;
+  /** Ref for the core card (measured as the particle waist). */
+  coreRef: RefObject<HTMLDivElement | null>;
+  /** Per-policy lane-line refs, keyed by policy id, for particle threading. */
+  laneRefs: RefObject<Record<string, HTMLElement>>;
+  /** Deep-link into that policy's setup wizard. */
+  onSetup: (key: string) => void;
+}
+
+/** Centre column: the standing-policy catalogue — the particle "waist". */
+export function FlowPolicies({
+  policies,
+  activeCount,
+  coreRef,
+  laneRefs,
+  onSetup,
+}: FlowPoliciesProps) {
+  const { t } = useTranslation();
+  return (
+    <div className="portal-pf__policies" ref={coreRef}>
+      <div className="portal-pf__policies-head">
+        <span>{t("portal.processorFlow.policies.heading")}</span>
+        <span className="portal-pf__policies-active">
+          {t("portal.processorFlow.policies.activeCount", { n: activeCount })}
+        </span>
+      </div>
+      {policies.map((policy) => (
+        <div
+          key={policy.key}
+          className={"portal-pf__policy portal-pf__policy--" + policy.state}
+        >
+          <div
+            className="portal-pf__policy-line"
+            ref={(el: HTMLDivElement | null) => {
+              if (el) laneRefs.current[policy.key] = el;
+              else delete laneRefs.current[policy.key];
+            }}
+          >
+            <span className="portal-pf__policy-icon" aria-hidden>
+              {policyCategoryIcon(policy.key, { fontSize: "1.125rem" })}
+            </span>
+            <span className="portal-pf__policy-label">
+              {t(policy.labelKey)}
+            </span>
+            {policy.state === "active" ? (
+              <span className="portal-pf__policy-count">
+                {t("portal.processorFlow.policies.count", {
+                  n: policy.runs24h,
+                })}
+              </span>
+            ) : policy.state === "off" ? (
+              <Button
+                size="sm"
+                py="xs"
+                variant="primary"
+                className="portal-pf__setup"
+                onClick={() => onSetup(policy.key)}
+              >
+                {t("portal.processorFlow.policies.setUp")}
+              </Button>
+            ) : (
+              <span className="portal-pf__policy-soon">
+                {t("portal.processorFlow.policies.soon")}
+              </span>
+            )}
+          </div>
+        </div>
+      ))}
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx b/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx
new file mode 100644
index 0000000000..1d90705c2c
--- /dev/null
+++ b/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx
@@ -0,0 +1,237 @@
+import { type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { EmptyState } from "@app/ui";
+import type {
+  FlowOutcome,
+  FlowOutcomeKey,
+  FlowPolicy,
+  FlowSource,
+} from "@portal/api/processorFlow";
+import {
+  EDITOR_TYPE,
+  OUTCOME_FILL,
+} from "@portal/components/processor-flow/flowTypes";
+
+interface FlowSankeyProps {
+  sources: FlowSource[];
+  outcomes: FlowOutcome[];
+  policies: FlowPolicy[];
+}
+
+/**
+ * Sankey lens: sources → policies waist → outcomes, ribbon width ∝ 24h volume.
+ * The waist splits into one segment per active policy. Shows a friendly empty
+ * state when nothing has flowed yet.
+ */
+export function FlowSankey({ sources, outcomes, policies }: FlowSankeyProps) {
+  const { t } = useTranslation();
+  const activePolicies = policies.filter((p) => p.state === "active");
+  const activeCount = activePolicies.length;
+
+  const flows = sources.filter((s) => s.docs24h > 0);
+  const srcSum = flows.reduce((sum, s) => sum + s.docs24h, 0);
+  if (!srcSum) {
+    return (
+      <div className="portal-pf__sankey-empty">
+        <EmptyState
+          size="compact"
+          title={t("portal.processorFlow.sankey.empty.title")}
+          description={t("portal.processorFlow.sankey.empty.description")}
+        />
+      </div>
+    );
+  }
+
+  const SW = 720;
+  const SH = 220;
+  const padY = 22;
+  const xL = 180;
+  const xR = 560;
+  const xM = (xL + xR) / 2;
+  const barW = 9;
+  const midW = 11;
+  const gap = 12;
+  const H = SH - padY * 2;
+
+  const k = (H - (flows.length - 1) * gap) / srcSum;
+  const lt = flows.map((s) => Math.max(3, s.docs24h * k));
+  const midH = lt.reduce((a, b) => a + b, 0);
+  const y0L = padY + (H - (midH + (flows.length - 1) * gap)) / 2;
+  const midY = padY + (H - midH) / 2;
+
+  const outSum = outcomes.reduce((a, o) => a + o.count24h, 0);
+  const rawRt = outcomes.map((o) =>
+    outSum > 0
+      ? Math.max(3, midH * (o.count24h / outSum))
+      : midH / outcomes.length,
+  );
+  const rtSum = rawRt.reduce((a, b) => a + b, 0);
+  const rt = rawRt.map((v) => (v * midH) / rtSum);
+  const y0R = padY + (H - (midH + (outcomes.length - 1) * gap)) / 2;
+
+  const outFill = (key: FlowOutcomeKey) => OUTCOME_FILL[key];
+  const srcFill = "var(--color-blue)";
+  const waistFill = "var(--color-text-4)";
+
+  const ribbon = (
+    x0: number,
+    t0: number,
+    b0: number,
+    x1: number,
+    t1: number,
+    b1: number,
+    fill: string,
+    key: string,
+  ) => {
+    const mx = (x0 + x1) / 2;
+    return (
+      <path
+        key={key}
+        d={`M ${x0} ${t0} C ${mx} ${t0}, ${mx} ${t1}, ${x1} ${t1} L ${x1} ${b1} C ${mx} ${b1}, ${mx} ${b0}, ${x0} ${b0} Z`}
+        style={{ fill }}
+        opacity={0.3}
+      />
+    );
+  };
+
+  const wires: ReactNode[] = [];
+  const bars: ReactNode[] = [];
+  const texts: ReactNode[] = [];
+
+  // Left stage: sources → waist.
+  let accL = y0L;
+  let accM = midY;
+  flows.forEach((s, i) => {
+    wires.push(
+      ribbon(
+        xL + barW,
+        accL,
+        accL + lt[i],
+        xM,
+        accM,
+        accM + lt[i],
+        srcFill,
+        "wl" + i,
+      ),
+    );
+    bars.push(
+      <rect
+        key={"bl" + i}
+        x={xL}
+        y={accL}
+        width={barW}
+        height={lt[i]}
+        rx={2}
+        style={{ fill: srcFill }}
+        opacity={0.9}
+      />,
+    );
+    const label =
+      s.type === EDITOR_TYPE
+        ? t("portal.processorFlow.sources.editor")
+        : s.name;
+    texts.push(
+      <text
+        key={"tl" + i}
+        x={xL - 10}
+        y={accL + lt[i] / 2 + 4}
+        textAnchor="end"
+        className="portal-pf__sankey-label"
+      >
+        {label} · {s.docs24h}
+      </text>,
+    );
+    accL += lt[i] + gap;
+    accM += lt[i];
+  });
+
+  // Waist: one segment per active policy (sized by its 24h runs) so the centre
+  // reads as distinct policies rather than a single bar.
+  const segGap = 4;
+  const nSeg = Math.max(activePolicies.length, 1);
+  const segAvail = midH - (nSeg - 1) * segGap;
+  const polSum = activePolicies.reduce((a, p) => a + p.runs24h, 0);
+  const segPolicies = activePolicies.length ? activePolicies : [null];
+  let segY = midY;
+  segPolicies.forEach((p, i) => {
+    const wgt = p && polSum > 0 ? p.runs24h / polSum : 1 / nSeg;
+    const h = Math.max(2, segAvail * wgt);
+    bars.push(
+      <rect
+        key={"waist" + i}
+        x={xM}
+        y={segY}
+        width={midW}
+        height={h}
+        rx={2}
+        style={{ fill: waistFill }}
+        opacity={0.9}
+      />,
+    );
+    segY += h + segGap;
+  });
+  texts.push(
+    <text
+      key="waist-cap"
+      x={xM + midW / 2}
+      y={midY - 8}
+      textAnchor="middle"
+      className="portal-pf__sankey-caption"
+    >
+      {t("portal.processorFlow.sankey.waist", { n: activeCount })}
+    </text>,
+  );
+
+  // Right stage: waist → outcomes.
+  let accWaist = midY;
+  let accR = y0R;
+  outcomes.forEach((o, j) => {
+    wires.push(
+      ribbon(
+        xM + midW,
+        accWaist,
+        accWaist + rt[j],
+        xR,
+        accR,
+        accR + rt[j],
+        outFill(o.key),
+        "wr" + j,
+      ),
+    );
+    bars.push(
+      <rect
+        key={"br" + j}
+        x={xR}
+        y={accR}
+        width={barW}
+        height={rt[j]}
+        rx={2}
+        style={{ fill: outFill(o.key) }}
+        opacity={0.9}
+      />,
+    );
+    texts.push(
+      <text
+        key={"tr" + j}
+        x={xR + barW + 10}
+        y={accR + rt[j] / 2 + 4}
+        textAnchor="start"
+        className="portal-pf__sankey-label"
+      >
+        {t(o.labelKey)} · {o.count24h}
+      </text>,
+    );
+    accWaist += rt[j];
+    accR += rt[j] + gap;
+  });
+
+  return (
+    <div className="portal-pf__sankey">
+      <svg viewBox={`0 0 ${SW} ${SH}`} width="100%" aria-hidden>
+        {wires}
+        {bars}
+        {texts}
+      </svg>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/processor-flow/FlowSources.tsx b/frontend/editor/src/portal/components/processor-flow/FlowSources.tsx
new file mode 100644
index 0000000000..927e74304d
--- /dev/null
+++ b/frontend/editor/src/portal/components/processor-flow/FlowSources.tsx
@@ -0,0 +1,94 @@
+import { type RefObject } from "react";
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+import LocalIcon from "@app/components/shared/LocalIcon";
+import type {
+  FlowComingSoonSource,
+  FlowSource,
+} from "@portal/api/processorFlow";
+import {
+  EDITOR_TYPE,
+  ICON_SIZE,
+} from "@portal/components/processor-flow/flowTypes";
+import { SourceIcon } from "@portal/components/processor-flow/FlowIcons";
+
+interface FlowSourcesProps {
+  sources: FlowSource[];
+  comingSoonSources: FlowComingSoonSource[];
+  /** One ref slot per live source, in order, for geometry measurement. */
+  srcRefs: RefObject<(HTMLElement | null)[]>;
+  onOpen: () => void;
+}
+
+/** Left column: live source cards (measured) + coming-soon connect cards. */
+export function FlowSources({
+  sources,
+  comingSoonSources,
+  srcRefs,
+  onOpen,
+}: FlowSourcesProps) {
+  const { t } = useTranslation();
+  return (
+    <section
+      className="portal-pf__col portal-pf__col--sources"
+      aria-label={t("portal.processorFlow.sources.heading")}
+    >
+      <span className="portal-pf__col-head">
+        {t("portal.processorFlow.sources.heading")}
+      </span>
+      {sources.map((source, i) => (
+        <Button
+          key={source.id}
+          variant="quiet"
+          justify="start"
+          fullWidth
+          px="sm"
+          py="sm"
+          className="portal-pf__node portal-pf__node--source"
+          onClick={onOpen}
+          ref={(el: HTMLButtonElement | null) => {
+            srcRefs.current[i] = el;
+          }}
+          leftSection={
+            <span className="portal-pf__node-icon" aria-hidden>
+              <SourceIcon type={source.type} />
+            </span>
+          }
+        >
+          <span className="portal-pf__node-text">
+            <strong>
+              {source.type === EDITOR_TYPE
+                ? t("portal.processorFlow.sources.editor")
+                : source.name}
+            </strong>
+            <span>
+              {t("portal.processorFlow.sources.perDay", { n: source.docs24h })}
+            </span>
+          </span>
+        </Button>
+      ))}
+      {comingSoonSources.map((cs) => (
+        <Button
+          key={cs.key}
+          variant="quiet"
+          justify="start"
+          fullWidth
+          px="sm"
+          py="sm"
+          className="portal-pf__node portal-pf__node--soon"
+          onClick={onOpen}
+          leftSection={
+            <span className="portal-pf__node-icon" aria-hidden>
+              <LocalIcon icon="add" width={ICON_SIZE} />
+            </span>
+          }
+        >
+          <span className="portal-pf__node-text">
+            <strong>{t(cs.labelKey)}</strong>
+            <span>{t("portal.processorFlow.sources.comingSoonTag")}</span>
+          </span>
+        </Button>
+      ))}
+    </section>
+  );
+}
diff --git a/frontend/editor/src/portal/components/processor-flow/flowTypes.ts b/frontend/editor/src/portal/components/processor-flow/flowTypes.ts
new file mode 100644
index 0000000000..217d35760f
--- /dev/null
+++ b/frontend/editor/src/portal/components/processor-flow/flowTypes.ts
@@ -0,0 +1,103 @@
+import type { FlowOutcomeKey } from "@portal/api/processorFlow";
+
+/** Which lens the visualiser is showing. */
+export type Lens = "flow" | "sankey";
+
+/**
+ * DEV ONLY: force the flow animation on even when nothing is set up / no
+ * activity has taken place, using synthetic rates. Off by design — an idle
+ * machine shows no animated dots; flip to true only to preview the motion
+ * while iterating on an empty workspace.
+ */
+export const DEV_KEEP_FLOWING = false;
+
+export const EDITOR_TYPE = "editor";
+
+/** Emission tuning: particles/sec for a source ≈ rate / 86400 × SPEED. */
+export const SPEED = 300;
+/** Synthetic per-source rate used only while DEV_KEEP_FLOWING forces the flow. */
+export const DEV_SYNTH_RATE = 320;
+/** Hard cap on live particles (matches the reference). */
+export const MAX_PARTICLES = 36;
+/** No two dots leave the same source within this window (ms). */
+export const MIN_EMIT_GAP = 200;
+
+export const ICON_SIZE = "1.125rem";
+
+/** SVG `fill` (a CSS property, so var() resolves per-theme) for each outcome. */
+export const OUTCOME_FILL: Record<FlowOutcomeKey, string> = {
+  success: "var(--color-green)",
+  failed: "var(--color-red)",
+};
+
+/* ── Measured geometry ──────────────────────────────────────────────────── */
+
+export interface Rect {
+  l: number;
+  r: number;
+  t: number;
+  b: number;
+  cy: number;
+}
+
+export interface Lane {
+  key: string;
+  cy: number;
+  el: HTMLElement;
+}
+
+export interface Geo {
+  w: number;
+  h: number;
+  srcs: (Rect | undefined)[];
+  outs: (Rect | undefined)[];
+  core: Rect | null;
+  lanes: Lane[];
+}
+
+export interface Point {
+  x: number;
+  y: number;
+}
+
+export interface Particle {
+  el: SVGCircleElement;
+  src: number;
+  out: number;
+  lane: string | null;
+  phase: 0 | 1 | 2;
+  t: number;
+  d0: number;
+  d1: number;
+  d2: number;
+  pulsed: boolean;
+}
+
+/** Cubic bézier point at t. */
+export function cbez(a: Point, b: Point, c: Point, d: Point, t: number): Point {
+  const m = 1 - t;
+  return {
+    x:
+      m * m * m * a.x +
+      3 * m * m * t * b.x +
+      3 * m * t * t * c.x +
+      t * t * t * d.x,
+    y:
+      m * m * m * a.y +
+      3 * m * m * t * b.y +
+      3 * m * t * t * c.y +
+      t * t * t * d.y,
+  };
+}
+
+/** Smoothstep easing used for the in-card lane glide. */
+export function smooth(t: number): number {
+  return t * t * (3 - 2 * t);
+}
+
+/** Where each source's wire enters the core (spread across its height). */
+export function coreEntryY(g: Geo, i: number): number {
+  if (!g.core) return 0;
+  const n = Math.max(g.srcs.length, 2);
+  return g.core.t + 34 + (g.core.b - g.core.t - 68) * (i / (n - 1));
+}
diff --git a/frontend/editor/src/portal/components/processor-flow/useFlowGeometry.tsx b/frontend/editor/src/portal/components/processor-flow/useFlowGeometry.tsx
new file mode 100644
index 0000000000..1e43ebc161
--- /dev/null
+++ b/frontend/editor/src/portal/components/processor-flow/useFlowGeometry.tsx
@@ -0,0 +1,123 @@
+import {
+  useEffect,
+  useLayoutEffect,
+  useRef,
+  useState,
+  type ReactNode,
+} from "react";
+import {
+  coreEntryY,
+  type Geo,
+  type Rect,
+} from "@portal/components/processor-flow/flowTypes";
+
+/**
+ * Owns the measured-geometry seam for the flow visualiser: refs for the source,
+ * outcome and core cards (plus the per-policy lane lines), a `measure()` that
+ * projects their edges into a wrapper-relative {@link Geo}, and the SVG wires
+ * drawn between them. The particle loop reads the same `geoRef` live.
+ *
+ * Callers spread the returned refs onto the cards and render `wires` inside the
+ * underlay `<svg>`; geometry re-measures on every layout + on resize, and the
+ * wires re-render only when the measured signature actually changes.
+ */
+export function useFlowGeometry() {
+  const wrapRef = useRef<HTMLDivElement>(null);
+  const srcRefs = useRef<(HTMLElement | null)[]>([]);
+  const outRefs = useRef<(HTMLElement | null)[]>([]);
+  const coreRef = useRef<HTMLDivElement>(null);
+  const laneRefs = useRef<Record<string, HTMLElement>>({});
+  const geoRef = useRef<Geo | null>(null);
+  const geoSigRef = useRef("");
+  const [, setGeoTick] = useState(0);
+
+  const measure = () => {
+    const w = wrapRef.current;
+    if (!w) return;
+    const wr = w.getBoundingClientRect();
+    if (!wr.width) return;
+    const rel = (r: DOMRect): Rect => ({
+      l: r.left - wr.left,
+      r: r.right - wr.left,
+      t: r.top - wr.top,
+      b: r.bottom - wr.top,
+      cy: r.top - wr.top + r.height / 2,
+    });
+    const g: Geo = {
+      w: wr.width,
+      h: wr.height,
+      srcs: [],
+      outs: [],
+      core: null,
+      lanes: [],
+    };
+    srcRefs.current.forEach((el, i) => {
+      if (el) g.srcs[i] = rel(el.getBoundingClientRect());
+    });
+    outRefs.current.forEach((el, j) => {
+      if (el) g.outs[j] = rel(el.getBoundingClientRect());
+    });
+    if (coreRef.current) g.core = rel(coreRef.current.getBoundingClientRect());
+    Object.entries(laneRefs.current).forEach(([key, el]) => {
+      if (el && el.isConnected)
+        g.lanes.push({ key, cy: rel(el.getBoundingClientRect()).cy, el });
+    });
+    geoRef.current = g;
+
+    let cySum = 0;
+    g.srcs.forEach((s) => s && (cySum += s.cy));
+    g.outs.forEach((o) => o && (cySum += o.cy));
+    const sig = [
+      Math.round(g.w),
+      Math.round(g.h),
+      g.srcs.length,
+      g.outs.length,
+      g.core ? Math.round(g.core.t) + ":" + Math.round(g.core.b) : 0,
+      Math.round(cySum),
+    ].join(":");
+    if (sig !== geoSigRef.current) {
+      geoSigRef.current = sig;
+      setGeoTick((n) => n + 1);
+    }
+  };
+
+  useLayoutEffect(measure);
+
+  useEffect(() => {
+    const onResize = () => measure();
+    window.addEventListener("resize", onResize);
+    return () => window.removeEventListener("resize", onResize);
+  }, []);
+
+  // Wires (SVG underlay); recomputed whenever the geometry signature changes.
+  const g = geoRef.current;
+  let wires: ReactNode = null;
+  if (g && g.core) {
+    const core = g.core;
+    const paths: ReactNode[] = [];
+    g.srcs.forEach((s, i) => {
+      if (!s) return;
+      const ty = coreEntryY(g, i);
+      paths.push(
+        <path
+          key={"ws" + i}
+          className="portal-pf__wire-path"
+          d={`M ${s.r} ${s.cy} C ${s.r + 44} ${s.cy}, ${core.l - 44} ${ty}, ${core.l} ${ty}`}
+        />,
+      );
+    });
+    g.outs.forEach((o, j) => {
+      if (!o) return;
+      paths.push(
+        <path
+          key={"wo" + j}
+          className="portal-pf__wire-path"
+          d={`M ${core.r} ${o.cy} C ${core.r + 44} ${o.cy}, ${o.l - 44} ${o.cy}, ${o.l} ${o.cy}`}
+        />,
+      );
+    });
+    wires = paths;
+  }
+
+  return { wrapRef, srcRefs, outRefs, coreRef, laneRefs, geoRef, wires };
+}
diff --git a/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts b/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts
new file mode 100644
index 0000000000..0d19ab5295
--- /dev/null
+++ b/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts
@@ -0,0 +1,261 @@
+import { useEffect, useRef, type RefObject } from "react";
+import type { FlowOutcomeKey } from "@portal/api/processorFlow";
+import {
+  cbez,
+  coreEntryY,
+  smooth,
+  MAX_PARTICLES,
+  MIN_EMIT_GAP,
+  OUTCOME_FILL,
+  SPEED,
+  type Geo,
+  type Lens,
+  type Particle,
+  type Point,
+} from "@portal/components/processor-flow/flowTypes";
+
+interface FlowParticlesOptions {
+  geoRef: RefObject<Geo | null>;
+  animate: boolean;
+  lens: Lens;
+  /** Per-source emission rate (docs/24h, or synthetic while dev-forcing). */
+  rates: number[];
+  /** Outcome share for the weighted round-robin destination picker. */
+  weights: number[];
+  /** Policy lane keys a dot may thread through the core. */
+  laneKeys: string[];
+  /** Outcome keys, index-aligned with `weights`, for recolouring on arrival. */
+  outcomeKeys: FlowOutcomeKey[];
+}
+
+/**
+ * Drives the rAF particle loop: emits dots per source on a jittered schedule
+ * (min-gap floored), routes each to an outcome via a weighted round-robin so
+ * the split matches the counts, threads it through a policy lane (blinking that
+ * row's LED), and recolours it to the outcome on arrival. Reads geometry live
+ * from `geoRef`, so it tracks card movement without restarting.
+ *
+ * Returns the `<g>` ref the caller mounts inside the particle overlay `<svg>`.
+ * The loop only runs on the flow lens, when `animate` is set, and outside
+ * reduced-motion; browsers pause rAF for hidden tabs (desirable).
+ */
+export function useFlowParticles({
+  geoRef,
+  animate,
+  lens,
+  rates,
+  weights,
+  laneKeys,
+  outcomeKeys,
+}: FlowParticlesOptions): RefObject<SVGGElement | null> {
+  const pGroupRef = useRef<SVGGElement>(null);
+
+  // Restart the loop only when the meaningful inputs change.
+  const flowSig = [
+    animate,
+    lens,
+    rates.join(","),
+    laneKeys.join(","),
+    weights.map((w) => w.toFixed(3)).join(","),
+    outcomeKeys.join(","),
+  ].join("|");
+
+  useEffect(() => {
+    if (!animate || lens !== "flow") return;
+    const reduced =
+      typeof window !== "undefined" &&
+      window.matchMedia &&
+      window.matchMedia("(prefers-reduced-motion: reduce)").matches;
+    if (reduced) return;
+    const pg = pGroupRef.current;
+    if (!pg) return;
+    const NS = "http://www.w3.org/2000/svg";
+
+    const particles: Particle[] = [];
+    let last = performance.now();
+    let raf = 0;
+    const glowTimers: Record<string, ReturnType<typeof setTimeout>> = {};
+
+    // Per-source emission schedule. Mean interval keeps each source's share of
+    // the flow proportional to its rate; the scheduled model (vs. a steady
+    // accumulator) is what lets us jitter departures and floor the gap.
+    const meanInterval = rates.map((r) => {
+      const perSec = (r / 86400) * SPEED;
+      return perSec > 0 ? 1000 / perSec : Infinity;
+    });
+    // Stagger the first emission so sources don't all fire together at t=0.
+    const nextEmit = meanInterval.map((mi) =>
+      Number.isFinite(mi) ? last + Math.random() * mi : Infinity,
+    );
+    // Random departure within [0.5×, 1.5×] the mean, but never closer than the
+    // minimum gap — a random flow with no two dots out at once per source.
+    const scheduleNext = (i: number, now: number): number =>
+      now + Math.max(MIN_EMIT_GAP, meanInterval[i] * (0.5 + Math.random()));
+
+    // Weighted round-robin so the outcome split visibly matches the counts
+    // (e.g. 3 failed / 30 delivered → ~1 in 11 dots to Failed), interleaved
+    // rather than clustered like independent random draws.
+    const outAcc = weights.map(() => 0);
+    const pickOut = (): number => {
+      if (!weights.length) return 0;
+      for (let j = 0; j < weights.length; j++) outAcc[j] += weights[j];
+      let best = 0;
+      for (let j = 1; j < weights.length; j++) {
+        if (outAcc[j] > outAcc[best]) best = j;
+      }
+      outAcc[best] -= 1;
+      return best;
+    };
+    const pickLane = (): string | null => {
+      if (!laneKeys.length) return null;
+      return laneKeys[Math.floor(Math.random() * laneKeys.length)];
+    };
+    const laneY = (g: Geo, key: string | null): number | null => {
+      if (!key) return null;
+      const l = g.lanes.find((x) => x.key === key);
+      return l ? l.cy : null;
+    };
+    // Blink the row's leading LED (its icon) for 150ms as a particle threads it.
+    const pulseLane = (g: Geo, key: string | null) => {
+      if (!key) return;
+      const lane = g.lanes.find((x) => x.key === key);
+      const led = lane?.el.firstElementChild;
+      if (!led || !led.classList.contains("portal-pf__policy-icon")) return;
+      led.classList.add("is-pulse");
+      if (glowTimers[key]) clearTimeout(glowTimers[key]);
+      glowTimers[key] = setTimeout(() => led.classList.remove("is-pulse"), 150);
+    };
+
+    const frame = (now: number) => {
+      const g = geoRef.current;
+      const dt = Math.min(now - last, 200);
+      last = now;
+      if (g && g.core) {
+        // At most one dot per source per frame, once its scheduled (jittered)
+        // departure time is reached — guarantees the per-source minimum gap.
+        for (let i = 0; i < meanInterval.length; i++) {
+          if (!Number.isFinite(meanInterval[i]) || !g.srcs[i]) continue;
+          if (now >= nextEmit[i] && particles.length < MAX_PARTICLES) {
+            const c = document.createElementNS(
+              NS,
+              "circle",
+            ) as SVGCircleElement;
+            c.setAttribute("r", "2.5");
+            c.setAttribute("opacity", "0.75");
+            c.style.fill = "var(--color-blue)";
+            pg.appendChild(c);
+            particles.push({
+              el: c,
+              src: i,
+              out: pickOut(),
+              lane: pickLane(),
+              phase: 0,
+              t: 0,
+              d0: 900 + Math.random() * 300,
+              d1: 760,
+              d2: 780 + Math.random() * 200,
+              pulsed: false,
+            });
+            nextEmit[i] = scheduleNext(i, now);
+          }
+        }
+
+        for (let k = particles.length - 1; k >= 0; k--) {
+          const p = particles[k];
+          p.t += dt;
+          const s = g.srcs[p.src];
+          if (!s) {
+            p.el.remove();
+            particles.splice(k, 1);
+            continue;
+          }
+          let pos: Point;
+          if (p.phase === 0) {
+            const ey = coreEntryY(g, p.src);
+            const f0 = Math.min(1, p.t / p.d0);
+            pos = cbez(
+              { x: s.r, y: s.cy },
+              { x: s.r + 44, y: s.cy },
+              { x: g.core.l - 44, y: ey },
+              { x: g.core.l, y: ey },
+              f0,
+            );
+            if (f0 >= 1) {
+              p.phase = 1;
+              p.t = 0;
+              p.pulsed = false;
+              p.el.setAttribute("r", "2");
+              p.el.setAttribute("opacity", "0.45");
+            }
+          } else if (p.phase === 1) {
+            const o1 = g.outs[p.out];
+            if (!o1) {
+              p.el.remove();
+              particles.splice(k, 1);
+              continue;
+            }
+            const f1 = Math.min(1, p.t / p.d1);
+            const entY = coreEntryY(g, p.src);
+            const exitY = o1.cy;
+            const ly1 = laneY(g, p.lane);
+            let yy: number;
+            if (ly1 == null) {
+              yy = entY + (exitY - entY) * f1;
+            } else if (f1 < 0.25) {
+              yy = entY + (ly1 - entY) * smooth(f1 / 0.25);
+            } else if (f1 < 0.75) {
+              yy = ly1;
+              if (!p.pulsed) {
+                p.pulsed = true;
+                pulseLane(g, p.lane);
+              }
+            } else {
+              yy = ly1 + (exitY - ly1) * smooth((f1 - 0.75) / 0.25);
+            }
+            pos = { x: g.core.l + (g.core.r - g.core.l) * f1, y: yy };
+            if (f1 >= 1) {
+              p.phase = 2;
+              p.t = 0;
+              p.el.style.fill =
+                OUTCOME_FILL[outcomeKeys[p.out]] ?? "var(--color-blue)";
+              p.el.setAttribute("r", "2.5");
+              p.el.setAttribute("opacity", "0.75");
+            }
+          } else {
+            const o2 = g.outs[p.out];
+            if (!o2) {
+              p.el.remove();
+              particles.splice(k, 1);
+              continue;
+            }
+            const f2 = Math.min(1, p.t / p.d2);
+            pos = cbez(
+              { x: g.core.r, y: o2.cy },
+              { x: g.core.r + 44, y: o2.cy },
+              { x: o2.l - 44, y: o2.cy },
+              { x: o2.l, y: o2.cy },
+              f2,
+            );
+            if (f2 >= 1) {
+              p.el.remove();
+              particles.splice(k, 1);
+              continue;
+            }
+          }
+          p.el.setAttribute("cx", String(pos.x));
+          p.el.setAttribute("cy", String(pos.y));
+        }
+      }
+      raf = requestAnimationFrame(frame);
+    };
+    raf = requestAnimationFrame(frame);
+
+    return () => {
+      cancelAnimationFrame(raf);
+      Object.values(glowTimers).forEach(clearTimeout);
+      while (pg.firstChild) pg.removeChild(pg.firstChild);
+    };
+  }, [flowSig, geoRef]);
+
+  return pGroupRef;
+}
diff --git a/frontend/editor/src/portal/mocks/policies.ts b/frontend/editor/src/portal/mocks/policies.ts
index 64a9b2ed19..1a3cfa2259 100644
--- a/frontend/editor/src/portal/mocks/policies.ts
+++ b/frontend/editor/src/portal/mocks/policies.ts
@@ -31,6 +31,10 @@ const SECURITY_STEPS: WirePipelineStep[] = [
   },
 ];
 
+const CLASSIFICATION_STEPS: WirePipelineStep[] = [
+  { operation: "/api/v1/ai/tools/classify-and-label", parameters: {} },
+];
+
 export function seedPolicies(): WirePolicy[] {
   return [
     {
@@ -57,57 +61,80 @@ export function seedPolicies(): WirePolicy[] {
         },
       },
     },
+    {
+      id: "pol_classification_default",
+      name: "Classification Policy",
+      owner: "data-eng@acme.com",
+      enabled: true,
+      trigger: null,
+      steps: CLASSIFICATION_STEPS,
+      output: {
+        type: "inline",
+        options: {
+          runOn: "upload",
+          mode: "new_version",
+          name: "",
+          position: "suffix",
+          maxRetries: 3,
+          retryDelayMinutes: 5,
+          categoryId: "classification",
+          sources: ["src-contracts"],
+          scopeTypes: [],
+          reviewerEmail: "data-eng@acme.com",
+          fieldValues: {},
+        },
+      },
+    },
   ];
 }
 
 const NOW = Date.now();
 const M = 60000;
-const H = 3600000;
 const D = 86400000;
 
-/** Seed `PolicyRunView` records that drive the activity feed + stats. */
+/** Seed `PolicyRunView` records that drive the activity feed + stats.
+ * 40 delivered + 3 failed within the trailing 24h so the home visualiser shows
+ * a lively flow; a tail of older completed runs keeps the lifetime stats real.
+ * Runs are split across the two active policies so the Sankey waist divides. */
 export function seedPolicyRuns(): PolicyRunView[] {
-  return [
-    {
-      runId: "run_001",
-      policyId: "pol_security_default",
-      status: "COMPLETED",
-      currentStep: 2,
-      stepCount: 2,
-      error: null,
-      outputs: [{ fileId: "f1", fileName: "Q2-vendor-agreement.pdf" }],
-      createdAt: NOW - 12 * M,
-    },
-    {
-      runId: "run_002",
-      policyId: "pol_security_default",
-      status: "FAILED",
-      currentStep: 1,
-      stepCount: 2,
-      error: "Low-confidence match — routed for review",
-      outputs: [{ fileId: "f2", fileName: "patient-intake-0481.pdf" }],
-      createdAt: NOW - 1 * H,
-    },
-    {
-      runId: "run_003",
-      policyId: "pol_security_default",
-      status: "RUNNING",
-      currentStep: 1,
-      stepCount: 2,
-      error: null,
-      outputs: [{ fileId: "f3", fileName: "invoice-7782.pdf" }],
-      createdAt: NOW - 2 * M,
-    },
-    // Older completed runs for stats
-    ...Array.from({ length: 4818 }, (_, i) => ({
-      runId: `run_old_${i}`,
-      policyId: "pol_security_default",
-      status: "COMPLETED" as const,
-      currentStep: 2,
-      stepCount: 2,
-      error: null,
-      outputs: [] as { fileId: string; fileName: string }[],
-      createdAt: NOW - (34 * D + i * 10 * M),
-    })),
-  ];
+  // Split the throughput across the two active policies (security / classification)
+  // so both show a 24h count and the Sankey waist splits into two segments.
+  const policyFor = (i: number, total: number) =>
+    i < Math.round(total * 0.6)
+      ? "pol_security_default"
+      : "pol_classification_default";
+  // 40 successful runs spread across the last ~13h.
+  const delivered = Array.from({ length: 40 }, (_, i) => ({
+    runId: `run_ok_${i}`,
+    policyId: policyFor(i, 40),
+    status: "COMPLETED" as const,
+    currentStep: 2,
+    stepCount: 2,
+    error: null,
+    outputs: [{ fileId: `f${i}`, fileName: `document-${i + 1}.pdf` }],
+    createdAt: NOW - i * 20 * M,
+  }));
+  // 3 failures within the last few hours.
+  const failed = Array.from({ length: 3 }, (_, i) => ({
+    runId: `run_fail_${i}`,
+    policyId: policyFor(i, 3),
+    status: "FAILED" as const,
+    currentStep: 1,
+    stepCount: 2,
+    error: "Low-confidence match — routed for review",
+    outputs: [{ fileId: `ff${i}`, fileName: `flagged-${i + 1}.pdf` }],
+    createdAt: NOW - (i + 1) * 90 * M,
+  }));
+  // Older completed runs (>24h) for lifetime stats — excluded from 24h counts.
+  const older = Array.from({ length: 4800 }, (_, i) => ({
+    runId: `run_old_${i}`,
+    policyId: "pol_security_default",
+    status: "COMPLETED" as const,
+    currentStep: 2,
+    stepCount: 2,
+    error: null,
+    outputs: [] as { fileId: string; fileName: string }[],
+    createdAt: NOW - (34 * D + i * 10 * M),
+  }));
+  return [...delivered, ...failed, ...older];
 }
diff --git a/frontend/editor/src/portal/views/Home.tsx b/frontend/editor/src/portal/views/Home.tsx
index 2f8f812581..e127fe41ad 100644
--- a/frontend/editor/src/portal/views/Home.tsx
+++ b/frontend/editor/src/portal/views/Home.tsx
@@ -4,6 +4,7 @@ import { useTier } from "@portal/contexts/TierContext";
 import { useView, type ViewId } from "@portal/contexts/ViewContext";
 import { HomeHero } from "@portal/components/HomeHero";
 import { HomeGreeting } from "@portal/components/HomeGreeting";
+import { ProcessorFlow } from "@portal/components/ProcessorFlow";
 import { RecentActivity } from "@portal/components/RecentActivity";
 import { ProcessingStatusStrip } from "@portal/components/ProcessingStatusStrip";
 import { PolicySummary } from "@portal/components/PolicySummary";
@@ -142,6 +143,7 @@ export function Home() {
       {/* Per-tier hero. Its footer is the deal-status hero while a procurement
           deal is underway (a bolt-on to any tier), otherwise the setup checklist. */}
       <HomeHero tier={tier} />
+      <ProcessorFlow />
 
       {/* One unified layout across tiers: real processed-PDF volume, real audit
           activity, quick actions, and the standing-policy summary. */}
diff --git a/frontend/editor/src/portal/views/Infrastructure.tsx b/frontend/editor/src/portal/views/Infrastructure.tsx
index bc0920382c..7d720f6895 100644
--- a/frontend/editor/src/portal/views/Infrastructure.tsx
+++ b/frontend/editor/src/portal/views/Infrastructure.tsx
@@ -1,4 +1,5 @@
-import { useState } from "react";
+import { useEffect, useState } from "react";
+import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { Button, Tabs, type TabItem } from "@app/ui";
 import { useView } from "@portal/contexts/ViewContext";
@@ -18,10 +19,33 @@ type InfraTab =
   | "storage"
   | "audit";
 
+const INFRA_TABS: InfraTab[] = [
+  "deployments",
+  "api-keys",
+  "security",
+  "models",
+  "storage",
+  "audit",
+];
+
 export function Infrastructure() {
   const { t } = useTranslation();
   const [tab, setTab] = useState<InfraTab>("deployments");
   const { setActiveView } = useView();
+  const [searchParams, setSearchParams] = useSearchParams();
+
+  // Deep-link (?tab=<key>) from elsewhere (e.g. the home visualiser's outcome
+  // cards → audit log): open that tab, then drop the param.
+  useEffect(() => {
+    const requested = searchParams.get("tab");
+    if (!requested) return;
+    if ((INFRA_TABS as string[]).includes(requested)) {
+      setTab(requested as InfraTab);
+    }
+    const next = new URLSearchParams(searchParams);
+    next.delete("tab");
+    setSearchParams(next, { replace: true });
+  }, [searchParams, setSearchParams]);
 
   const tabs: TabItem<InfraTab>[] = [
     { key: "deployments", label: t("portal.infrastructure.tabs.deployments") },
diff --git a/frontend/editor/src/portal/views/Policies.tsx b/frontend/editor/src/portal/views/Policies.tsx
index a4ffcf1067..79440f96e7 100644
--- a/frontend/editor/src/portal/views/Policies.tsx
+++ b/frontend/editor/src/portal/views/Policies.tsx
@@ -1,4 +1,5 @@
-import { useCallback, useState } from "react";
+import { useCallback, useEffect, useState } from "react";
+import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { Banner, Button, Skeleton } from "@app/ui";
 import { errorMessage } from "@portal/api/http";
@@ -34,6 +35,20 @@ export function Policies() {
   const [wizard, setWizard] = useState<CatalogueEntry | null>(null);
   const [busy, setBusy] = useState(false);
   const [pageError, setPageError] = useState<string | null>(null);
+  const [searchParams, setSearchParams] = useSearchParams();
+
+  useEffect(() => {
+    const setupId = searchParams.get("setup");
+    if (!setupId || !data) return;
+    const entry = data.catalogue.find((e) => e.category.id === setupId);
+    if (entry && !entry.category.comingSoon) {
+      if (entry.policy) setDetail(entry);
+      else setWizard(entry);
+    }
+    const next = new URLSearchParams(searchParams);
+    next.delete("setup");
+    setSearchParams(next, { replace: true });
+  }, [searchParams, data, setSearchParams]);
 
   const { enabled: aiEngineEnabled, loading: aiEngineLoading } =
     useAiEngineEnabled();
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index b0966c3151..90d30c4175 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -69,31 +69,33 @@
   flex-shrink: 0;
   border-radius: var(--radius-md);
   font-size: 0.875rem;
+  color: var(--dot-c, var(--color-text-3));
+  background: color-mix(
+    in srgb,
+    var(--dot-c, var(--color-text-3)) 14%,
+    transparent
+  );
 }
 
+/* Neutral keeps a plain muted surface rather than an accent tint. */
 .portal-sources__type-dot--neutral {
-  background: var(--color-bg-subtle);
+  background: var(--color-bg-muted);
   color: var(--color-text-3);
 }
 .portal-sources__type-dot--default {
-  background: var(--color-blue-light);
-  color: var(--color-blue);
+  --dot-c: var(--color-blue-dark);
 }
 .portal-sources__type-dot--premium {
-  background: var(--color-purple-light);
-  color: var(--color-purple);
+  --dot-c: var(--color-purple-dark);
 }
 .portal-sources__type-dot--success {
-  background: var(--color-green-light);
-  color: var(--color-green-dark);
+  --dot-c: var(--color-green-dark);
 }
 .portal-sources__type-dot--warning {
-  background: var(--color-amber-light);
-  color: var(--color-amber-dark);
+  --dot-c: var(--color-amber-dark);
 }
 .portal-sources__type-dot--danger {
-  background: var(--color-red-light);
-  color: var(--color-red);
+  --dot-c: var(--color-red-dark);
 }
 
 .portal-sources__muted {

From d271b8f3573e52d89f691c3f8538c405d6e27d17 Mon Sep 17 00:00:00 2001
From: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Date: Fri, 17 Jul 2026 00:02:49 +0100
Subject: [PATCH 039/109] Slim down login/signup to a single centered form
 (#7033)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replaces the two-column carousel login/signup with a single clean
centered form, uniform across proprietary, saas, desktop, and the portal
(all now route through the shared single-column `AuthShell`). Adds a
Storybook playground under **Auth → Auth Screens** (provider /
login-method controls) to iterate on it.

## Before / After

<img width="1600" height="920" alt="image"
src="https://github.com/user-attachments/assets/6e3f166f-40df-468e-825a-bc4c7880406c"
/>

<img width="2056" height="1000" alt="Screenshot 2026-07-14 at 6 11
11 PM"
src="https://github.com/user-attachments/assets/e015efc9-71e5-4b9b-b64a-5ba1dbf2fcec"
/>
---
 .../public/locales/en-US/translation.toml     |  16 +-
 .../editor/src/core/assets/login/AddToPDF.png | Bin 734196 -> 0 bytes
 .../src/core/assets/login/Firstpage.png       | Bin 215942 -> 0 bytes
 .../assets/login/LoginBackgroundPanel.png     | Bin 5426 -> 0 bytes
 .../src/core/assets/login/SecurePDF.png       | Bin 234488 -> 0 bytes
 frontend/editor/src/core/styles/theme.css     |   8 +-
 .../tests/live/authentication-login.spec.ts   |  30 ---
 .../SetupWizard/DesktopAuthLayout.tsx         |  57 +----
 .../components/SetupWizard/desktopOAuth.css   |   8 +-
 .../src/portal/components/LoginScreen.tsx     |  21 +-
 .../auth/ui/AuthDefaultCredentials.tsx        |  55 +++++
 .../auth/ui/AuthScreens.stories.tsx           | 203 ++++++++++++++++
 .../proprietary/auth/ui/AuthShell.module.css  |  34 +--
 .../src/proprietary/auth/ui/AuthShell.tsx     |  48 +---
 .../proprietary/auth/ui/AuthSignupPrompt.tsx  |  30 +++
 .../proprietary/auth/ui/EmailPasswordForm.tsx |  19 +-
 .../auth/ui/LoginRightCarousel.tsx            | 218 ------------------
 .../proprietary/auth/ui/SpringLoginForm.tsx   |  28 ++-
 .../src/proprietary/auth/ui/auth-theme.css    |  70 +++---
 .../editor/src/proprietary/auth/ui/auth.css   | 184 ++++++++-------
 .../src/proprietary/auth/ui/loginSlideText.ts |  56 -----
 .../src/proprietary/auth/ui/loginSlides.ts    |  23 --
 .../components/shared/loginSlides.ts          |  28 ---
 .../routes/AuthCallback.module.css            | 131 -----------
 .../src/proprietary/routes/AuthCallback.tsx   |  58 +++--
 .../src/proprietary/routes/InviteAccept.tsx   | 138 ++++++-----
 .../editor/src/proprietary/routes/Login.tsx   |  64 +----
 .../routes/authShared/AuthLayout.tsx          |  33 +--
 .../proprietary/routes/signup/SignupForm.tsx  |   5 +-
 .../editor/src/saas/routes/AuthCallback.tsx   | 128 +++++-----
 frontend/editor/src/saas/routes/Login.tsx     |   2 +-
 .../editor/src/saas/routes/OAuthConsent.tsx   | 117 +++-------
 frontend/editor/src/saas/routes/Signup.tsx    |   2 +-
 .../routes/authShared/AuthLayout.module.css   |  75 ------
 .../src/saas/routes/authShared/AuthLayout.tsx |  84 +------
 .../editor/src/saas/styles/saas-theme.css     |  67 +++---
 36 files changed, 735 insertions(+), 1305 deletions(-)
 delete mode 100644 frontend/editor/src/core/assets/login/AddToPDF.png
 delete mode 100644 frontend/editor/src/core/assets/login/Firstpage.png
 delete mode 100644 frontend/editor/src/core/assets/login/LoginBackgroundPanel.png
 delete mode 100644 frontend/editor/src/core/assets/login/SecurePDF.png
 create mode 100644 frontend/editor/src/proprietary/auth/ui/AuthDefaultCredentials.tsx
 create mode 100644 frontend/editor/src/proprietary/auth/ui/AuthScreens.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/auth/ui/AuthSignupPrompt.tsx
 delete mode 100644 frontend/editor/src/proprietary/auth/ui/LoginRightCarousel.tsx
 delete mode 100644 frontend/editor/src/proprietary/auth/ui/loginSlideText.ts
 delete mode 100644 frontend/editor/src/proprietary/auth/ui/loginSlides.ts
 delete mode 100644 frontend/editor/src/proprietary/components/shared/loginSlides.ts
 delete mode 100644 frontend/editor/src/proprietary/routes/AuthCallback.module.css
 delete mode 100644 frontend/editor/src/saas/routes/authShared/AuthLayout.module.css

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index fefa9c7e3f..4bb5ae928b 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -4702,6 +4702,7 @@ login = "Login"
 magicLinkSent = "Magic link sent to {{email}}! Check your email and click the link to sign in."
 mfaCode = "Authentication Code"
 mfaRequired = "Two-factor code required"
+noAccount = "Don't have an account?"
 or = "Or"
 password = "Password"
 passwordChangedSuccess = "Password changed successfully! Please sign in with your new password."
@@ -4726,21 +4727,6 @@ useMagicLink = "Use magic link instead"
 username = "Username"
 youAreLoggedIn = "You are logged in!"
 
-[login.slides.edit]
-alt = "Edit PDFs"
-subtitle = "With over a dozen tools to help you redact, sign, read and manipulate PDFs, you will be sure to find what you are looking for."
-title = "Edit PDFs to display/secure the information you want"
-
-[login.slides.overview]
-alt = "Stirling PDF overview"
-subtitle = "A privacy-first cloud suite for PDFs that lets you convert, sign, redact, and manage documents, along with 50+ other powerful tools."
-title = "Your one-stop-shop for all your PDF needs."
-
-[login.slides.secure]
-alt = "Secure PDFs"
-subtitle = "Add passwords, redact content, and manage certificates with ease."
-title = "Protect sensitive information in your PDFs"
-
 [margin]
 large = "Large"
 medium = "Medium"
diff --git a/frontend/editor/src/core/assets/login/AddToPDF.png b/frontend/editor/src/core/assets/login/AddToPDF.png
deleted file mode 100644
index 94e9a0dedfc60e60915e7adf3b711e1299bc5210..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 734196
zcmeEt<y%y3_$@I=!%%_(GIV!`Fobl2bccX+2}%zg(j5{KBHi5`0@B^xNcY*E^Xcb%
z{(*B{=K}+KKFn;MeLw47_gd=-RaTV3M0<?}2M32KBQ2o{2Zsv$iE51U0{HdvYN6@x
zm4mdlGjK)y_Xl1^mFg6D6W&=>N(`=agk%r609lACh{C~DM4>+zBf+6_hRR5Ys=LD<
zW+0~%Ox-?>E+T=@o9MKnD=AbY-sNl)HqDxZ|EMr#ljRCcwd7JU4aM;YZJ~Ppp>oJA
zS?(6v^4%ArVoV<%;yaWB7CnAg*;%|M9U(o=XhLVo5ndU!NN#Yp7)j?pI^H=K7AkWN
z0E?lJ|Noc&zXty=)j_H(NncIn6yKi~=zY^P&i|!?qwRSeNirb|J7*L${k55tD>7qs
zm0zVVuOU+Zw@2OT)$J(6$1;i&=~<v$p~?TEDG%B=?qB(~jRGYs7t70>IOp<}SRJKU
zE5F&(CHizQ-Y(C7KWGRAv;V`{Z5Ul@NH}SDsmlsPRA1Oo2VOxAk5JXy%OHF7zTrd8
zRwSLuG~^l+C+Vetf<r*`RwUZ#c>2+QZ;R=zBl)Eo^*1+0up_zG`&7IoUN{iT85-4>
zLWvZ}gX*=Lp3VbeP@}yshiUijK|cp2OGw-9rr02El3U9C;(wRL>J6^VS2Mza<-OL}
zdnFWvhnSZH4ffIX)s}n2s8mUXLnw9Y(H9A5+^J~2k{ll{yzg!LG>)?(oLX_tw9=Vv
z4tDxgzi;f_X6Xla<0Hi2JCb7>YLom2J)-jw*Me+IA-nBo%#IWMzmG-k538I-wTJHC
z-j&dGMxwbEx-!BQJ_!ig3263oB+J;Z5rtIs@QANNddccmlS2tZ<6gXXuhWrAM6>Ej
z<#-hC#!+qG-iVH9NDiUiuwT9YFJ84W<A?GrQmjQCiA1H1D2E7-o97Q2ZiBWKcJMg&
z>xIUB10w|#e#$kI$g^C$%DdxRl<Zcp5YtkWy&yQg*Px@tiR=lF>M%cBwsND0e>9Tx
z5{^phs(&oS<IKY=^!+u!cki}+TR)pJlK0<l|I^ZgP)0K=gYLFTWD>cZ`^<o=SRdb>
zOHJyxZt@#N*f2q*kNk{6RC*E@ezRUnD3+S5VUXFhLJn_#OHa0X<K^Z37e~&Nw;osf
zPCkl5GQFyLOe_KwV(fwqJ%N^c0<33(NpwvzF#q~$D1(ffWMwF)UM9)yvdYIddyaW4
zDODSjjReK$>EZvbOY{k=_Ii+3j{w7ZJ%b(1`Svf}(LxAS0>V#e{LRG3@@CbOIO@h%
zKSz}ce(2;}aIBqg;C2?&Lulv+Is?(|9sS_w6!}-{&E>T0RGPF6y&f-T+9J{hG!4Bj
zIh$6H#IpRc1bz&T?3~}O5rplnh6S38B)m#XFyNTNrk<E*)+#qDK)Y-hBnV%_%~lWn
zlna*)azvV;m1-pnIOkzue(KQJbIUiJ*B?$W;6(kmj#eQ2Qi+TqEmA7+B>v7L{Is3?
zhZSq-Aiau(VeU9RmTU2X4lU*`k<o8fqx!gO63x;-HiqK<d>1=Yxm)_k5w>SHGx+GJ
z%qnR4bJnb)opT<`6>WvPh-F-3sp}ebnR78wpqw-@_-^mqNn_`F#b;%IX_PxoqeREG
z?{OAOU>DMc-PT7G?c_F0XHxGevOsXh{#wYL?Jl?fvTt7UTEQ;r2bAOKa4By@`_j?S
z=kb#5Ag<i-(A!AhrDq${-R^?C9+OU0iG84lK=&_vw-|e}t0t32>o(S8!7C5M3avnn
zr|$=_s+x{z?fav!a8lTR5MTukAC6fHVFwA1H(43^_k={XsR`EY?Ekq-Tbk=T(|CA!
zKAaa`{&!pr$Hp1(u+BUET{_rF6$tv&RE@&$IQQ*U!LY1Yg&3WDhhVm_<q!m_U&!(f
z-o~16VWEko5SkM&_+sC3i_G)1ga6{Pm)M@9i0J1Wj1_cp()R3axNMQ>^>VM`S;+I|
zbg}vK`JMSv=ID-;$uN>h1s%S`-15H7$reMi#ZR*EZoA4Md^m+Po};&u;=T4Gy`>{D
zU_4f;%%$sKiZw+(H=DyIG=!|@#}l7{X6dE2ZaY1*9&&?t6ArX)!GSwd{}%^J)P7ku
z{KfA}yGbUv-6}5I{{vzDZYg{T+e251YP{sOaU`bJ+&)hazc#2%e<Z2|{;3|OqE60p
z4-20#f1g9QC8u?LA-LOs`sy+*x{)U%)uw{WV2{T|wDG44zwsPjsdCazm%4W12L`P1
z*oGdpC9dEe)eL@x(ZHvUTkpranof(u4Qfc{=**gd4H2)dO~pHFo2$=joq<06jbtmj
z#Pu);TaqIEOXSCI$8q)YjpY|j1$PhU5e#0XqlHd|>L2*9hMYuG*{|Q?!sX4sE(qJE
z7Um^C(zU&7<>PKMMdNR+=`M8TI9xb&6CHUh@8o;+dPJn|#(uzLuf5g&Jm#N{98G{E
z0Ouv%{+lY{cxcJz`LWcn%{#_M+Q0gnF2cH)KvE7IQ@Zcrt48}u4_T7jGL8bU^OMR<
zYX3JsF9D?Y^u;XD1&FN3kg)E2A>;?i!maw-mmb(&iiwEIwxI`clRS5N1+;Mj+(?)K
zeQTF%P5b9LYhA$}JKv<<d^VG+14*|uj;3(ZcGmX1)RnMrd;Ii=v^Pdb#F=D(FD+yT
zxl~PMR;0r@OwWD&-7zQiL|{+&qGg!gcP#$RXe^fRN}Jz89auOB8B_3N*7&Bm>}6K0
z=Nup2I+VzuGr}6yM1mjv9b?`nR&P)>vATp*jE29FAs?&5JSgMa`uKsx>L#N@uhTPA
z#K(L4E_!r_Rwqns5xJ9lnPeL_su4_6mhd0!Ge<;%4u!IXl$wM|Si*Psqp>|$gz(Q-
zTUB+#z$l^)D8|9IC|5eG(+C}jPd`;-It2Ne3<HV6L*Fq;>tR(R?i;&S+;>fyktZTB
zxO?j~Z^F1#1{zjhrO>x48)7;%RT1WOGRVSz7-ga682s|SX?k8~DC##EU)0lds}o~M
zwQALb&nve@$G$Ir7wg#P`99OFuj7rWERW|1liPChXS}Y_A8}t3*qD>i18A%|+06=P
zd|Rp#5BlV6ZEZhzZPp4L{+4{ayBwPH+T#)zeJyA)>a=3K4w)j9E-0zurUsi$YA{Tw
ziq7d_jm&Wl=6g{xG7Y%1#pLGi{jpAqBy8g`J`x}7N86gx))9U5VyKa%?K{i4NTe>K
z{&%seNdTmwg=IBX83`g3&;+~^@%F?@3*&KE!bSCk1Ch^)O9yxrC}!aP4pj>##JuYx
z(DTh1dqu@OUeQ=^%_8mz*OmO0cbSi8?JGaBw(mR$l}4CNGp<@(MyEcv6WK%L+5B{b
z+V2N^q?|@TXppK&*6Cf27j^Z>TGNeN&_R@%-%G5q9l42>gW@VI*v)UC!w_5^&P|Aj
zU(GtH+U3K2-0Y8uE646J(I^|+6Tk13prOtXK1{D6y`w)gZD|$P@OsIjw|n5vBi8i8
z{a4Bj+-ThwFGCVZ`3F<6y6PKR{L`!wpUWac*B|O1zN8;)2l{0%XpYUWlj>`Du6G)t
z>M!It*iJU!6;9~A^V<ZFPSOOMmmS5=0ejjmEjYWpfBM)+A%vcU@}HG6yA_2WbE3dl
zB+hQ{ROPj8KI{E`I9KH?MphT#vNxWGJt&$2hEK^tgkNM+h|XU3t5?sE3l$V|BO;-M
z*mTA~mDO-T0c(n;er9mL#X`BvWk_wv8rzc>LcMrmPy;CFnqqHg6|^$To0Tu{>r2$X
zNa>}aFHCj6>);&2+Wn5=MLpR_o%_B>qh@^P_w&<r+oBYi7ydxS3eb;cR016*PlH7s
zvO5AyUVu!A7_$X&+5AF=-0cysNdd(7_Cj50a6On#iKJAOB%MbZk*=hsfVh&MJz8I)
z0c&i$^1cIpetKRQ|2e?9XFIssQ2{Uf>o`J5mcsYR2Ub}TNev+;>dep!1Y{PxgPReq
z0{-WB_~s*0+TtJ5<X%ZYKcz9UzZ479iaw71$^I`(PsA%Bv2q;lpu|{2HUYDKV(Y+4
z*EIm{o3wH;O~mJk)ONm_zj*Qb{rmSd`!D=CnBj;ieXR?7#mJ)t;IktgwRTo#Px6jw
z;AHj0hcl2)VAm+$G+*MSX9;I|U8RU1{|-eeRIyXdjz5wXD2ZppVoUoT$*P<2X)yLL
zeCS`ixsZu%lw0T(>C;oz6D2afO_psf3iB!6m+_hs?V5+nVKv;v<Xu#bqn?a`JcO6%
z)XcXoUXQP&DWq^v?=Ln~#r>K=hh?=rU6xI;AQrAj<YM_#;*AH@*e>uG*w##$5IEg7
zT0eKwe25hu9Pqkb)elcMlb6S>C%$bZ67g<sYm22+F*V(w6Vlw@P$m;Bd)yl;KMVR5
zV7jJ^N@~-Jh@W>;8JEns%d0T6eKE`Z?k31vQ#8Sz&02~Pd1rX4hs3YH&L5gfSQ<yu
zd2S+5{5g4Nwkw9wy0rOnS~spD*i!8iyToS>!be}Ic5+<hZAF1;_3l%#YwSOb1zc&9
zji`)nD)t)hS?ech`UDpf);c<9C2;q9lrZcx+oR!6>(kwVN|nW^H`PH3I6#`8pRXMX
z0y*N0P_7a;9w&z@LefKEUN&}+#Cd8Le^KacI#qPzZ~*h4;xJRR6YIXz{ei+ExfsS+
zd$4O|dj)@%7AZsnMNP~qOAwhnHa_?ZS0Rff;o|rEbpDa7LsdJ81h%s%r0L(&*-c>B
zwtH#*UgtD#k<i|dT2-t4)K7wL@rFQjLP@m(#jh`!w4%GFYpiF6)s=5Oy?L&ty}?vS
zFgm&SFT;ArTG#5!bHeU=mZy%fNrD`d^65~s6d*?8#Kwo~-tl>l`}dN87BsUAPCxIk
zLVaSdIgF*odL5JZvCeUhV4uQL$KWjG2%4!&_38Qst1oN|y=fR(-qGWIb$H|;WG1-X
zVrz41(7TV|AdckUPJY2RJ|N_hU6lT7Ky|bdzROYkA4=E%ClDcP%NJG4w_%$IC6{6h
z>o=k>rI(sUYHnHE)0fQ<9LnX<FW(m1=&xK|T@92$>_`YtC=WV68Sxf=q<uw4eB1|Z
zA|cZ>s`TZ|k{GPcB6h%ai`-zq!%$OJ*<#;|;JGEA(#SKL+EIxqE-=cp1;(pp-($C`
z{f^4x^S`0RA<|CMK$y`*<MB$OTKd{jXDtv)@D(j2Rv=5hxeB#1Iv?GtDc5kY@tH}h
zd^OLuZi%O=t?1{^M%TkxcAa_$@_DAgo%7!XnciU)lWz}%8@zE#%SuYVwm$qBBAG|G
zg?IFw`rWO4C2ZVCr!b_kDgXUsPsI8)tB;Mzn}!0OB1N@)dC?5Ekrosb;s6<q$V7Ws
zh07rMwZ2mks(wA>5M?P*tbm%Ye3b}T{Erj)3LhxjZwCWNw&U}*_z1q-Hhi#ywoeD2
zd<?6x7u<6s%YW*G-=^vfx^l%j*16NSl}xE(PJnD@H!4z}&-F(Ba`Slk&2~h^_%;8(
z;3GZMiEqRl@#2U)_bhXwuuZ-g24NiM5p5=qCxGMT;%ctEKW<Vg1gn?4WB8%RLP*IS
z?|DW4O+70v7sSa+ND_QZ@rtU$C&aGvu8Ul3BC;VL!6I~je_tp71xy90k>6!7UdNR~
z4|@CU`{=a?UP1B=GBjXP{S12_BL*LO#}S`x2Yp9Bm@YtJ<seuk?~)a2qHLj%xq(DD
zZIC??bD?J2Pzh8v+sEl*ZT?q;ahr{H=HE2E4od2#-+Y=i29I{56SBAzm9+|}_L!qR
z<Tf93T8td7G`b$_|NQyW3|eC~k*|CDaD6pzU1rROrDi|({gO1!)JTk$B#o}P@Udd~
z%fZp<w66W7XhwCUux;|>XuALF+_yob0Aq3WBcjJr?enrw^$oN_%+4>z_f!mYqG@hl
z-i{WaF*bP5WYFiK5|+=#t>tcuH-lV>;ClvZ$hJ1Mv99qxngJEJC}<T~mkU?hF4Xo@
z)3pfqyL-5m)J&(+k)0DIt?^Z?i2O%9v2xtq9_vgt4VpW!oX?@6j%DO4zj4tAKSKiJ
z4iAR%WWSvM;&ppyd%kZ|0seK*x^xJr`DQ(w7@LSKOYt2PY_v)45(9O3<L6T-RV)_C
zr&t(@rrohl=fZ-Jy`i{!2zwjA<sRJFD8Lut2{CtJop^)iak2Zm2<V;c`~DCv2`HEq
z>gnGo3PlJe$4k|Mn_E<p7y5ogwCCke;IN;+S#8%a5Jx-8JR#xG{#mqiiL_5AQ)`G#
zDq(if*K8=*6;)NSr|?>iV>N(<dA3NpOM*Xi)q1@<RH^^Gj`h7%q1>}=?cDa3lE~x5
zC)DnftwD%63C+fC1s18m&6jUq_6w)_$b25G7|WXfRM^prW)6I+i72o><#!1}g*^%<
z;NShy%N{osU-r76(lmS&=6}DDh+8<yW;GKB0gbz84cz!@Q7^HsNWyBmqIm27tX4Ie
zQJ;fH3<PQ)NZi*$X&Z-T@9Z0#*pEFf_b>4x+&mLGVr#{;9q`fg2gg?C^Jz+RvP_XE
z-YTlQ#N~eCTzxP-*w{)kG^jcs5j-j1|5>!WlL*hzRyGH~f@0@GpM@^vuxO-d&_CTI
zIx!dv$}Ex0(3frsx2VkJ8b(;w{t8Kq2zB=Uq%V?mp&<PRnO^(ToH=2x|KKlx(Yq|v
z+76-l^2{3f3!}eeN~RKB(Ha~P_g$Mr?GF==ULkQEE))%9PCV`-fu$qGPvOwY3N~5Z
zezMPh3_%UNm<@F8e9T4%2guS0bp~0aW=UpzNDm8+brYXYouAjqjdMzXrgAmBTqh$V
zdfqQ8J1o*tqoSrC15ff;kP*n_h0BdA7wXEza{L0l?r=4Dp!A9dAdevp;Sks!q?B7*
zn~ekGD_bni+}zx0(=#(OF1usKX$cxSR!vNfTF!pSa<z=d4Lfi6&eC-|scBR@LX^-g
z9#8)av7U^T>Nk;YeIvafP13o+o3vU{%n-P2Ic_}o6cgpT4QB>JBrx%^euqp$)#YCG
zIpmBmY=sFaE`4-Pulp&Swe<(xVK+&)dr}21a;f?@iW$ZC+{ekOLCs$Ty{t&2j6@70
zVNAbr8zpX6QV9**vn6|FR;Dy`OGLK67h`)Za{Q%*Z9c%QeTsLr+cA9H*Q}b_V^Nx+
z`xguo$z0$*ijGr24!POTXrt&_T=ysGuaBEfjwc$Ncba4qu7QecS*$Sadvp{6Sednk
zws`{l);B<~I-H<te|AH?`XZJ5>1dugU<ec83E1^t*Q))`QT`N__XLK$bgn=pbrYi{
z_L3Y45UCCRk=NS#G~{$C#=uxOA*tW!5~@O$UQ|>R{tLCg6kR_|j29QtwIW^z{8kH%
zW3p@C>2gYQ=HbvnBu%H3#c3&gsmW~xkwxYv;!cZrjT3~kj}Y)SKxP}EI(aApwP0-Y
zPCqx2Yq<uA0#kwa<<(~_SeZe~mlnOB-au^;E#)huWoYWVzQ0}p*z&IHwDykBH74cb
zb>H7A-*=GD@=9-=SZr{<m&+jM*gZ+iUM(PTppA7bzfI6InDZSKh&*5M!#B!K9`5Ef
zu*|bP79(VdU?ws3^g8W8UgBMJ=)xW(5CT*QL9>YG7d_&17RQ>|c*^y{Mm{TE*IVHX
znwExPz8V-g$`7ViG%H^YO0d!ZTv$sEPt~aG+1dE3y9qu&ocp9WZR9xP|0{|O`K41b
zM{Whc(t<-ReL*WNYM3nA)+III?so#2l_MC2-nUzf4*s|6;jB)8+&5HR2Q-4OZoYmH
zDTH=MeSLkbb+{1o!Dx^LIUgHyG(TVRZhN;#;vkx$@b<R91$j+G5p-uH<FUqJrK3f3
zu(bQ_ixC22UGl82m^<ZC`l}CkVLqqcba>`UDI7?)3%R~^1}9PEZ#W#$Rl^I>m2<6P
z!qlm$NqqHWAMmX1*bJ5U-e$LLJ$m`L?N1KW*srvDG<=a^^ZLV3R2(awIdsq6NC5Y_
z22Xwx|C^nq<*fYv?Fvvwk8-^WYj*r0nAO5dTPgQ*JMJo2wI3LLH>Y3EDaPA|*kBJ{
zHNU}*EtzJPVyl(amfsVSUuMOBHaesz(NiPwjaP0aoO|dBVn=7fB%2O6@%^zcC?iX?
z9aFP$UFq#L`}2L#P~OTXmmw=*lVdWcesa>yv9j-?uVun~{$Xq=R>pL2AIXOw`(WFN
zi9O@G<oej%tmiwU*LKiM@4LdbazOD)OJsBgbOqCNff6nr9*sf!_nfA^7>3)Eg=!_4
z<Y5Ek1n-GfrLta{B)IsBWVBMdkoZ~B%HJb(d<A8Ecb(Da<s3^N-LarNA}D<~&x!If
zSLlQaM2^TaiA{lAP0-C-k8Nwwry51FUwPI`Oj{~TV**WaxbSQLu$7=$N^~KqpX)^t
z;slAUbW+CVBM~(-JFzrDsSf9-%DbOaEztHsBv82J@rR<Gun-5lRRNgg+*6|P)m~e<
z%!=lSMJ);R3vWcm*+$<EL~;+fXC~9Srsh7*KdvSBFMa@QqIS~8Z#Apmj}e{V2_vx!
zwNjsc0Wt?+*e~c4H}fzk(`GRuF&0ZLM_jKOLq%Wb!W%Lk7JCSK8(@<VF92>fZr&i;
zz_}KU2>EPgLP5}a`*W2{m$DdxfKCPH0u%4buVlsz*cxk<FAUZa<92Bk>g<*pt-r{~
z^#zmmq5Zo7m@$x`%pj9f8p(1vVGv%n15%PghQJhnSOe%1ABK}-0PNn^C>=({qmlO`
zG6Pm<gghkk@&V9wvq@OF9QWBkju^hCir`fxlys_fsC0}FvI$X$vxCh#nKPRc5)K|n
zUVEyO^8=;j*SoZHEFNbZu{-9;QD2nZr~8vAc^i`*=1al=b%x@z5dkoT7XVK0>6-ML
zK5-N5n;^Vl9qgc=M9QJ6zqDjvbJjb9y*U_)H)6oa-2H6$VRd?4KN8}?v4%9hmerQm
zQp>6-Vl{dV?6<Ty%$y%z>JT7D7vNqjRSDxLH$Bs@+#^ma(X(*<BwzS4Xjq0n6lBVc
z5c02RexfuJTrh7FXD;=ljMf#tAuLyyg*%742O!1ny;!cbnBCLEEdhF;dlEM};o=VI
zK()MKYl9cO93Iif@Z|BmG}=c&|4S)vap3d8(gSr}Sb`Cickwsh#328+2AvR%NI*!2
zo+981BD15zuHj6;C{9#2kw%`)cl$*<FR<U}Edkr9GLj7$5Rr*OMCWU)cZ6>@<LDCw
zitxd>Q<IbKD(J%E>EGAmX7z+MbZu+2^j*<jVg~NEjtT{cJ6HHEpqIW|LX;w5MS%H7
z#uJP8PXe7rZxu})r-e6aLysl+k7p`V2qq*J28JK)t|FK8g`>l#hCY~%`dcE~hF+Lh
zDuujOpPayl7=$UL`}6n`iOmnpAYJ-up&?*+CVF`S)up}C>(><+%G0ciPU2tvE2q2+
zpmPB8s%Pq$0ce*VtJhJF#JKQ^^r{|`F5cFySMCUF1PT8ivvgiwx}zwaI+B<xV*1Oo
zBbxKw&Bv<+`yAAXF_H1B2Edr;Ta;p=POfr1dKn6f{&~nSBXl+nVctn9MPknmXbwgd
ze7HBln179MhTTiA*KPLDm)NVg{l2FH#%`&o?VjF<d~0E3AT#IPid=ZJ4vkQ+E{)lW
z!a9)fHSd(rAGKa`0v#Z#o*8>3^Es}Ul^bjb?SH4I-GG#skqnFf`@H%&0uZtiyQC~}
zk}>rJ<S}q-K29<4z+=K1sy_S*^ZpZ;c|ot447y#>Jc}X>Xvg_*e>9ZZccZSb?JxnX
zy4Hl>ElP2i4MbY3olnwt1>t@>-Q*ba1`A$a&wAt?4TJ+y?H7)7tZ$Lw+Sr8l<EC9O
zBw5;Gf3lEWLTH>Py9i~O6B`GC#3J{N3LUf(pA)Q>vWk4aT`vy}sRHVy&(bF(8S+8w
zl>@%28|7#^zq98Q`7wJi)gdzWo5K~#u@vZozl-s*vCN4aNnErY#$U2UF0hvy_ffuI
zH7xV_VaGJ1k#V3#E$Z!+RvlAJ1+UJXQ#A>XwBYbJUi;<T=@Q-VN+eg8mzR`oORh85
zkjT!a?{C@cV(idNwMb)|Aq78wenhUrxcN)ZdJX2SV{N1fd3C?-y)#iQ3;J8aJ%5RS
zvu9%M@DNeIskdk`h3Qn&%xryhYbZB$8msOd6CrEm3xQ4oRS#xVFnkNGx#1M9Nszh@
zKi<lXqY;dxxhj86T#&E+w*P~3kxAewMhJrW^4%yM;%;)(@3vX-)v51NQD%z=N9y*T
zUAy&>2-*2cDj{dtrp}yo@%>t<RMwqCe7&CW4g9a1aXQ)4<3{5Q0GM&ZetR+YLX(K|
zvo<lVBhfxZ8?kpuw_df&C+H3)Y3{#$OFKvzZW1Ax5*Tsc?&rj0MG`+P0_6AD{~kAj
z_27weX4Gn?G(&05f7Bw~QSvdA_M6u69|^dN+nr1)omRsA)dqmRDR&}UQoBd|(%xsr
zWJ&X-XPvoGcT99bhY@?$PKwTMJf5ZlZA0n!_xIqUfKXqESUE$NU-vk8&fFn2=93>B
zl`KD9N;!j!Z6ZrsEFyT(wmg&D`sHGHGz`-gr1@=jusYrh{AQra87#iqkcvyMdKOia
z;$|cIJF#>CWGG#jdxRvK=raP3Orl)dMt;*-gX<eLUu%1?Aa!RK23l>ZM_X+K7;2=p
z>(u+YSROmW<3@l8uU$7CH!^~t6^%?iQ&UrCfF64een&nQMW`NJpr@}-de>LL=^rBh
zj=~|N(as-}XBL?SQYtSvbg$Ui3do@g2}M!Wzc;MQTCPwHJ<kHmqJ&n^eR72zgRw|W
z_L79=i4h11s8fiTC7-oq1uwAmQuU0n?ifI(uWc7J_Z{<e1zzxSaV;|3kBWDURO0jO
zy36Y2u@TBE=X?29kQE-h=ODYkJ`wr6J)B}bl<?^gOBAwQG`s+Sp#wtfIiUKS5eK{{
zY8ub~+%&2xZyX^$7V{~ad?=6(KVy!)TSTji9Ci<s?`Tqkk52;v8@4%CGnKQ^1QUEt
zylWS>_o@GZz9`DJeb1fmXZkiq_JF)yp9s=nsRtG)D8Sn6>5fC0c36s-lOehK3)LQ2
z|Amu&$>CMpF9`)O31-}Vkl??VA}ux&W3H&)jx6-+4BEqJ0B2&ymg-GwoR^@%Kpc@F
z=w?TO(h;;uAMl37-{<K(lWtVcw;2kTLkYSGtOtex;ZwA;NHiK;oURUJvh*rnkr8os
zL~@J(vP1^yC7XvwI>UoGs%sqdr%pc*u>?kTG;${~-hGy5h#=Duem57`8_HzH@)mqA
z4W3V0P$z`cFH1v+5ts_FWU?Ux;nl-OD2g(P^S#PA0TVomBj0~bK2o5~52webPnE^4
zqR&W^t=%RU@S`3^xxSJXT=E>CPO@RWTr}vNwx_auHk-aIDz218W+Xm=3#Lv_f)gf5
zaMDn!SD({*m$rNJ6$0&W1O^D2762AJ`d!`HF;Pay$L*p9wQhVi`l6l-Ckx9WqDaZS
zE`D$5^MFgXG=SkkXl4d}H0kc<OM3|_VM;XGI$@feLxGq_+9`uXh7^T@xcUO1)c7=Q
z=RGpK`#O05sz);(N&aE1T@Rm!ghSJg2;NHmPSop7=Th|<NmN(u&38o>?^dJ5zwDly
zwe`j%GlkQ_?ztOJ>4H0n%@svX)i(uiER5+X=9AX^lkL9q-N2_j8$8&N=-i72bLskT
zg$GKx8!Y@$6;V%jYuG+Fr}d5-U*<gH`8i~#hXu_`1RuMwMIH)^-D<2$8@AUfy$w?@
z<x^<Ag-s>^e_FH6!04AcE&Vg;aYw2zd)Sv%-qCiQ6qdGey_m{-fQpkSMq|QSL>onK
z?}S>_9LKI-L|D%W&$#vR3F_89x{$CWu`B%pP#Su>06u}}gPRdiVc9nrNw|D{p0`^`
zq4!a%6F$am<Fbsls-?qat#==>0z~Q+-;tj^+@5oi8aKM^sV=p8d7L1aA&{Z~)2Nld
zx}uD1IsS4<$2eWyzLB2+>+AA(aT=CR?gTxzYOiKz6cV@9W>YbQ_-rgHgJd{(1PNJb
zanNt<NM<A=5@lb#v@XFlgAnV(TlXDV*N(TqoKKS+@(T&2Z<oxfEf-T5h_5W(pR{Fa
z7UWV?;Fku2yGyxgu~3p%)y<B6Zt>+lixHclw&vP>ot{=iJOLv$U{HZYuBs;#(>{*=
zq=M;~C%pfuY4CY#5tu6pDf*v#2n{!>$1>xtt|H~edE5(x=B3{0?7E%cB38VVQ24ai
z=JPBA46A(8^JqB?c&EFG;$$DDXp@HCo3dW|qR_Ekwx6#FRE{kpQ9uYvwa9L36I#z;
z?0iu_h|xxFow_QRTwgO?&or8Mp-PduPICJrV_(q^jE~TKDV?Ku<@$7H6$iOeA^et(
z#?XAKuoLR`?B_1kYp1BTzg4}$(NRCce~{ssTcVW2^IW24jDKf8`9lSdRzA5rt$73F
z+~TAFf`K%pt6tP47UkKwmLjQ~bwTE?5=zQ!xCMCaV~*0zA3a0V^hD#w%erT3Dn;Yj
zwXOu2kE;C7;_IJ(WYMVBF+OL6Vv+M5P8H2a@VjvZcyO>5v00c6s{_hwa@N>g8<SH@
zX4@Z+Ey!S8LqgpOPXrk~`Z=n#zuQ)4MZ_<n4b>UDw&gVs6j^c(1^l@1#mZQ({S2k(
zrS~jp-jxczv$Dr+Q(huJTm$*%l|)Vmz3FYwN*RY6p8JC~1gz5BNdK8CZVjNwSue$U
zL@LmHJ;(4^sJH15AzAP!`C>mdIP_#bjDCCj4&f(%h!2FpFIlYiu2`VBqWASuji=m1
zLN0vQ=lE>;T2HpQWAPRot)L-LHxmlOhK|BLei%J&0jYD)tmXHwjg4rzYH{%OsN~X^
zDySeV@C~#bz5_em4R9z+p)Vu^+-Vol3vdrru$!ILdZg`Q#(KYBi{@^TGCN?6O8Js@
zd~!Bo9}YzHvW5Q~!mVuR%)k+YD<SDXiXh#gR%(E&M^*%TWxcTr$VUB#CxALtsKdhw
z?$Rp6U$vhp)xQKvj~w*J&l_~B-+@XOeD=eRqcw9F73C4M_7!dRVOh^|><OF&U8TAX
zTqnc(YF^3<_-;q!__25H9pDksG0N-rfjO^Tt!3}}BYzu!!yB?#{l0E-j_{dAM?_KT
z@nHVJl6nJpiY1#3I~w)1lD#WyyWY;P&?cUkzY>E%Z|FGjmy90UEl@VqA50ZZo;*;>
zV7Git<D6q;y9-Ldz@V~s&#CwEQB=0>&D$>z*M$Y&1oZTMbKGO5-fOc*qZzI)a`Y1{
z>d^dv{CKC#K7vvw9gWx82l4XG^R^#3hbVqtPI&noFqvbZ(`J6QXeMuL12Rmh2h-O-
zd_i<$3h`m%HD~Fq)i5>a`XzPOv~J&4Os(Gr_!j9U*bMmLuZf8(gg@ipOd~t%$JKOL
zg~_nCqHljkKKTACE`FC5ZQ8hb2dt_6faf%H-H-aCw)2|E`q8Y5#B+?GH<SN`exaS{
zkeLwf|7@Mn1lVZ4Izh7}uU93;%M9BnR1jdfC?gcEvH+8a6}DVzbk#=AqF2jLzUczJ
z0h@6(Vr-^<M4hIgzz9(~6vV5A=E5e~b)*RMA6047Hs6Fe$qNM-m6gfk_hgUdqLvDN
zt+F7jM&0+^^b3JUz{BH)+JGQ8?C`je??Lzr*H?#Qq0+DkN9yY|aBgy}w=_uL%RD+s
z^aoUmH$r4NZ>r<+<T%F+3h{ZDzaqjgtCRBe#C7kiAvdu+A;V|+_<x2a2|TtoiHKoG
zDF_hML$?ms#M%N?V#@_;7BZT~-;lO4%K09I2Z5Kk$T$(kHXJXVrk`kzE35VCkhiSR
z%EG*0_)ZS}l{-In+p|gPlZ=L;M!BPIcE6itC2U8it&ScDXTPtQc|TGg%>5}2ohVRR
zsRSg;x{W9OPjg#B{MVUi*N3#{-F0dC4~)3|AcP;=;1mxcUtfBB)gSF$Wa80*wSD<V
zCZognaM{f4ZnR3@JS&<{uC!-loAjRm^YW^rDdn_#g@m;fetc5XB8l!pxiv-V_K(`o
z8L?T!Go`!(d+nE<$OOEi>En|wa`nd@c`~DB^xFu*^lg3h?R*JmNho|3EGEA?bY72W
z<8AJpz%RBk2*COMl>(6vx*eWq5AyR6s<`~LPFCSShu1v;Hi?oWy(-az!@4S{b@edI
zq6Q4@&W0=7@6+65&KNKvR%SGTw7sr>nqjLT8<G~fZ%BUQ4%5qsfYTQp_kaSOn?5LW
ziccTuq$G6Kov&>!3#oat{(`T0mLK&vlKVPJwYYKrr~cYiRt|;*!YkLgvl*><st{cP
z*Zp|V$M>7Kc?XgA`HC5hT>$TI#fAj|4)%Vn!&+zW?fFjB&$2Qf?MVHXxar?W<HNa(
zXck4$erTypwZqdTx^X8_Wd1?rg{mVWQ-wgD?q=GiZR(ajrD^NuDm2OQSJkkTss9Ww
z^UbH^)O^F2<2#Ze*ay~Zx9u7KibS<H!9|DNk;D%tYP0^1D;35dsUOpdc@*v|v>57O
zow#bfSno)dj0m2Gzvo@?bY2ALNS9NcJ2Gj*G|2q(3>R)4>EzV7-JC^zH;VKlA}!<s
z2jK~9b88JTnc&ca(4DT6AFgpBtijdF(znZ7X5}FA;eA%Y9rqh}#5$&y=FYw3ye6(T
zrP=@&UOJ5%qMJwDOq$pCN<c@2&WG1nDBZEnq9RiCuNUmwWa_bVD92`J-CKu8Nr#qb
zAKNy7N2`7QzcUk{*Rw^$(X8_<uCGe@3pp|()_#o$oy)Uo#W)J-?z7AEj!N@22h5nr
z&s9VkJL55;OSu10JT7fI-e<A(DlU>&X!>+i8ht(215!*J80e-G{aNKT6b~OGx>D>S
z!EonyFW0vEs;-`czFB?DIow(Ry#Am(`0<BJb}9Oo<Ph1_2j^OA;hK7-!CQY+{nRzA
zn&dGCmuEkZG&GwBemQK5lT}qK(B*Y|lXnA+?=7wCr8R1L!`Nu@5FN6i_@PD8I++|J
zt#xLmKg~RsN@2r#pqQFh<nuhicrP>R<7UhKfDW79%7Q@o9Q}<370l6cveDc>6jqKo
zZGq_)SZ&-@Za*mWPoE@bd<o=)Oqq<3dBK>ApLvP0_Oc)_)C{Kw1B8a9%E7nSi_Qmt
zo0A4w)+fKYdpG?S;Adxh_0g5@GG3pOASaO$0GNhLiJ7dI7_5arj4+9t{wswM+${>O
z;^N{uRMXe@@|SBcto}HKwr6s6JXMrr%>af#<=4>)vkzyRP*YH(2P57~;H7*A32(R$
zC$skf#{cnXX#k#-Ga$b~0NbnK)0=fNP4EfT%tyf<2gz}d@WILpLk%w2A3lpxnU~Rh
zPl1F6vs6U}<C<UnW{1LE_74tr%$6uOx&+}0jZiw%?zpG5z8_v%T3d-fNBrIC0q`mi
zGe2wTHxyaQR9n@VkPjRxuX;IKgOh(D<sgP2{bl^m$COf$!^J+QrFKBFYuT$ifErww
zjlnm=hq+I=qy_X+3Ktj(%Jl&eJ9%82#@*Ga6L!FjMP~qN)8)yE5AJqy=&)}@IN_!T
zsB=ibthnWB{xNUGzK^~4MYl80Gr0>&uS`A=C+CB3@Uwe<YyKX3O(UE3EZMsjp6Y~}
z!$GV$qF1aQ!L7S9X#x#E_M46rJa$jDrT`1bWFETTtOY+KcS?qcb)J#sy8Qe__X3vT
zc6rx-r*RPVM88$c*$*TtLLHE2<en!RVQDhX0CTE+D|nEzs;>um>S)nyq(<&cbT;b}
z)Iuxfo5HFoh4i*RX)HZx?xZ^_vXH24V+B^0vxu5)T-1RM1bgAT6C46NAGk%oHEt$P
zXl{FUKRAVhU}pdcVV|)v5Zz3QyZt7WaroJfF)1@imG$B2_JCYt+{LpZUxiB(LgME3
z%OR8@aQL~(j8|`guCU<#WvH)>P=KPOz~~_<k2ABBNL@dDKS=c1F_4G!_#ZUwN5fY0
zWfqrz@b}HgJN1LWA-s0BRE`ltfL%cm3iXE)(EB1GEukxri)g35dW=o&sh1n?kqHfh
z!gM{olvz>7d%^cvr6|YNOL1R1d)5xh+FIrJ-7~Gf?59;GGsf`a!Sj(DM@^bI&>^_@
zoeHA}8USNiDh{ROLlvL{C$WS#O5b<CCb_mXqkw=asiTj}Py?jj1t^m2x}k`S1%W-u
z>7pQYs3F3S7iw+TcTECC27sD1tNz)?kZax;kZz9w_hv*Mp5{_dv+UYdlfFkOjmP%q
zn*62<leF&&`J)EIO}b~0v}_qO?lXj$@D67sZ3w0Iy{0}lEDHqzA>Ly`f!7=jEB9!j
z2r_^k7mYPcAR)oe$6y@i)IulvEum^sa~8-d$Xh0a^sv>EgHnY)J28Wpw!R4(cLro$
z0QE>QkCF4@f|!TYN4mg8N~0z3uyxm20Xr#|uT#Lt1UH1_(3w6usE<HZJL70D!kWI|
zKGnMPHg|Z2lnIGU`FE63%LgwcO_n6gag^h&RKJL_6;tdaHo2vM>q&gYm@pQOo!nZ{
z7{~}gH+!AgqV56O2sEaog5#3{-GrWEG>1SINr^pOL?}XxL1WoBYq2@-^<=_rspMU*
zp)6NIwf`HD6ZO+gv=emp<QiMLM8|CwT4&R~86brHs^M8}?umARmg8Gl+x4<XQ&$C}
z!|qwBMq;mAkBb7%rZ(~Cn5;JodQ8nO;)vt?UmWRu;ZPMNz{w^o>pBlFbOdCEnIp&v
z;8UdSLUg~}$>>K5kDxnL%v^;H{%RtKmk6+GV+Z>-h%K;=s_Q=jL(ZkAp7g61$R(nV
zcoXOU1eT+>uz?IJ_%ZYTi3nc$5a%L*uN_1s{oTA11AWmn&d3v>e@N&r<x#sKv-g#G
z!?G|m!w>gYM~@cHgwQXHsAD>>TJ`EVSKC1tC?m3CJZ}VCEU$S30Z(RQi37sS(y<Kd
zv+4+|PADUO@*^_+vpKL-2Lw9`bn5IL(d#ghffSt?%KI^46cfaHtpL~JqM|C_8YOdo
zXsw^Hq_2j5wZUm%J5T9v7fqSTIn|n!RjUlw=>ZqGSUB(RdFOuvI8?+~&Z;|=6p&oF
zt{O%EtG}Ki37M+5$1AsbtaY-*I63571t`rCA}@q54BEZfR(FQJhRsud-fla1{C)@Q
z^S28+eNoajMgu`v9I#=C-~jQ;QF3z}(7R9cPkyH;=0$0Vgm9wnz7;0Ky>*i%_6-(;
zO_`NLEKTxacWjHSkBJB4dEsS6q;i>W4>_Xww<Zj-SI7}KjQzi2Dj<KL-^gk28KTVe
zieBPY8KZFCGB{+<KYdCT(IBW685wAjXK@p0^*L#|u1)x<-t@s}Z{+Y%EIW`?lP;$W
z?N#hS?xVH7=%H%pqZ#R8!F4gM=@v?z*`)Ns%^7(5Ek0*npclsn#;~uOsn)qiGfB4L
zPBYTlHCD#KZ@UOo3#Ni*#BKaqLi;*Bd?W6w%nXDm&%KfBq={51t=o+SkE$nj0Z|>x
zC6GT!P1JyctRj=&`9r=mMx==ru|r8IHu&Om5?g^YzPYBRrbhw!!*t3RJ9zUmB&0jl
zDAN|hnDsz1A36#p9=ej!1nVS7>^lYgYKo8M#u08Hh!}gNDAII#f<gf9oqzUP;zjJ8
z@h)Z4q?LYzpb5m7{A1-r6QJkAS;I3aTZ<~f!J~Ey0>=9peHoQ9n$#QC*J5J^uv&8@
za$M;Qyj=f3kY9Kb6o7uN`5le+B_b@kJr90#NG|#%8M803^%8}%g+m~|=JJ5qU_3oH
zuCiAzbIOEdobsA<ESd!n^9cjWk5t@!0>}$)>SqGc6T1U|6-_vZIu0e~lAd}V;DIXF
z-~ygvq4jQXFg)COJX`;#YPhNfCto0NP8<2kq1|_NhybJ!8jb~P8s|07Ajxej2-s`u
zYymwEg?-5#p85n>I{U$7-t{<QS+WR_hF)~LNmp9bc<a+wFyhQVQoR<fUiVjyyDvcG
z(G3l={LVWa79p;!H#yPSitpaF%A@!We$|ASmPyXn!FM7~%4PU^3Xl`Pz0)8p;@rmV
zX4@t~nxQ5Yk?sn*W=i3an!jBGRN_^8I=pLHLqUZSbF26VSEaX?lRx|rkw;i)lRJ`y
z0O})nSl)$&X&1xCntsnC8P*%tia7o<<0ut=|7<Oo%<jsc?7@giFPZIwf)Fyhu9^ha
zxItRuwi+UP!o{eAx_Ixi2_eQCJ>l@U$=|)rQ)QCd8fxjTLVts&n#+$Of4nUk@}Rvd
z-m2Hnxr%)ZMt@w@W=L6;e^T+l*xqd~lQDCzdR;GR9yhc;|F%o*94aFdSh>q9tE(9a
z2;!@~hdjmn;aD*K#Xa+Izx(@pflbThbQzF%Qui!{Y@az7smh8zcqc=ZOR-7Q(gi#S
z@*MrU(ii<3jj^`bk>R}!%Y)XndKF`FCnO3g?b25nAhw>zEKP?_Zz9P)Z^p!cg%cV|
z%WBk;y_FVNHG+i?HV8Uj_Uj>bwM?u~6JQItQadyF{+z1t^ODO44drCoY075AOxxGn
z)X91+yZ#fa-X!+Nf({WmyR)sLQKX5WvZDmN024{W38SWKFsLEaUIHhO60jA;F-+;d
zo$4b=C705sJBZaZR=fX}05V2+qM><KG3_Qcu1Mf|Nb(Zk5m@M>hxn{AOw7)PxX1~k
z6h(4q>=2o}2;mzRUH|KgjNz`6S$j<OAYozPwkt{q?Us#&{=i3B7v~}f6UGRUg$vMh
zXLSt~6G>FKrSS?EW=2z_L?Ys`YQolg(RS0r`o&8BcWVMk&d)V<Ge56fMDclM1*B~R
z<0!_2m&4=e*<{RLUkAL9<_!3iE(ZI<n4iB7<XG;ZmcAbA?Fp6@@n#M-oo+O<FbAm&
z--jE&s;KJEG8I!E0C3S>48V}ko9|;TT(RuLz}e&q-)zV8zdCuFX|&WWIt`IRz+HO5
z$s-`w?H@?;>Lz~Pn$ljbwYmtvHvH-)tCzfL6j<yu&BLKVW4^>XW4Dp$TWh;;jGpuz
z%C_5s%Anq_Hx$i)IrF+S+Th1DH%_jMT3=QrEWMqYrs$1ekn@xTH#ih(^L^#^#Qg1k
z5|Ct@=myA6dN9x5Qv%1pnIR^Rl1tRVI(!3$8z@<#(<f1~87%>sqJm=Vdkx%YqRQ6H
zk0&toFUfNIy$K#bE}aq0S5FjTSrGflF>unec0^)3>jMiE$R+SA_#{_zl1z4v@+dKc
zYK`@(CY>{5t^!>42FAF707}X$_fp_9KUVi^&zEUyVGb=df0|W&k!qUkebUx-4{4#A
z|Jd#eZ(u|7=#yomdkjdhC3%l^@t+;Dirsbw1TLc^o@4B8VHF-ZHk7#|c&nC@7XRX;
z{R=eTM0RC2$gHKPP(3M>2o4Mmgn-15oDZR^_<PzqH6P#eASHvY^QBjT$aX<y>+yt=
zNJ|<h-G>H#dZR!o(>oNj$vgOS^sifKtq7Qx-3{H}!UdAW{lQju6h09~SAXZEcXAEr
zt6mksM)34zhe9MATp4jn<o<6ZNK`ZBblY$H5ZPm=`jWY=H6r58euSgCS1$`wSSylE
zkD^R=ZXuaOvArV#8IG4NPe~6cz($-}i{YeObxVAnpQgrF^mECcPV$lr=ASpBM4pza
zttMEsfH=V?$5)3nGX@2y2kY*D`D9p+0hGuQsW6v*%E}}r9mmWY&~3~hx}O_L-tc9Y
zgg~kRU4iXxhR-S&;9ZZq@heDu(4~ftj#PTKL5ZyvhM)zCPDeVlIqsL6nIfATEgE4M
z>y{gJc<k-;U$Y*!TrbBtVv__ov?a#Gjq=||+#TEwXEjDF=^WaYnvz)Fwe@!!&-NiX
zpq93cGsFM!j`P0wPS&y;_Rh*6#F%~|S7|6rFjt{2!Fy$h86KFRmgGa=>xz`6P0w>k
zc!GapN#9ci6J!{wUfb6KZoy;I;x!n02oML_fjjr6A!)oorx9SGU*oY9YEj`tB*WpZ
z43XT153T-9&7N$=DcM0ipsN(;S;cHp%eQZ>S%nb$+~0gN9MPA(t46${d5WpfUI5}^
zL;83zSMyhZF}i|9f1zi*yvbHpzT|y><jk;Ch9KJ17g#C+m&tw|^8zDtO&W=p<<aZx
z2(990Df@_oQ*HJVL*8@j&bJdZ`rBBA?TsUImNIU~)P|i^c<KP|3b|0GHdJ+dq7>-B
z6%pQ#s{G6g1T{VyQL`X!B>JiJe4Ti95!LB~VDsW{tZk&omwOXCQmTitoF9g7VydUg
za!X1Rj*#j+f4Cy4PzFH3Aj}-1kpCITG`sD<HyU~=#~cglA_qao@b&~JaXM0z;U_02
zSF79(=rt{Yz>T-h^^)83GBZ5NMJ5nMJsxB%6T<M*4bfHZDO4-y)ga52fq}cb8UHpt
zRv_{o_l>rrWlr^32G`xjNtT>o2_Gqrd_LNj8aCPAgir1pvECQ)$~nFI7i+5OaqQ%~
z1H3x>6=9qNY48HN-e!X^GJbk2RWhk{^vZZXzcWUK)7Xx~UB|u5>Qp8tAteF++S@h0
z%_X<NDJj@h%SqEoYuzF)#P137uZCk?TE8BKxcqr1qfk2sgU@sI?eA+p;uj=thq0UK
zd9hut`&W44?MT;To(1$lPTLRu2M~&Jqb5R<Rem72m5CeQMkMmEhMirXiYv4tA~$$}
zL|&q$MX2z0^B&z69hu&<pj246|M>(svGp71?}`}j%$$xST)+IuK}w4QTZyWJaQp<+
zdd7pn(62%F8vMB;ym1vV;^l9|zyt_A48>iGV&D~RWy8B`G))J0tCvI@n3$M8oqXbh
z)P?rDgX=vuyXc>vE5(Y6Yw}UuD}ovuZrmnX$nG7i{m|u7Jgi4Vo*%G??dsQd0GJpx
zssqL2QHyPs1JO?Mcj_R~k@HazY<OkBapA5JRQ<I^WJ1!6JZ*W=bP?yK8{>NFpxN<g
z(R5VXq_EvcCIzUfCo~(Yr%p4+z}Al&6KNc|bNq5OXR&iCr0Jldjq%F4rm{#4K1KI`
z=Z${3m><kl?R=~Bz&!sw?jt%(3B>)0<1Z`a3hz75lbiPE@w?v3U42G*v=KHTZTF1f
zUes>vV$pBxRt+*l6uH}_%-xWiR>B)xa^Lt$u+#n_&Gu7M{+I;6Fn4aXg?`GASLRQY
ze$~dF?M`#64taOVzT0Z+l|SvOL_viZzsND#=zriXzk*sK0~*}~$-IJ3Fa!flKjEP%
z$M(V=6D3G;U`NI23CrX7?^NzzoadEm_^Ca0O0`o5$@EJ|>xuFlX57xw`ag<*bhs$s
z@4)%Ja}MZuo|K9nfqmX?N91x<x&Rz$3<qWu38;7wh73s%L=uMrbC~8*)K_DFq9pbp
zki28XC*9+?!Rzmt=L|hgU%3c$3G_r+*@GZ_`DM&qAUCng(y=d>rkW4RV&w;puX($l
z^$?yM0HhC=B@`g-VA}ac)aEeeCnlCK5N0p`m=mn5?hh@=OM%}8A;=q<=irCPoksXP
z9vCj=edTpz21!8wdWDiFt@n2MUBQzb2oKv&8&NSYh6{%x^UgXw*5vBpfF$Me-1V2k
z1soH&hUGA9Qjfz|?>5@-0W<!}6}AeOmhjz9%pEI0D>N?l=(h!&*f*%r&WQ*R%OW=X
zvX|GgdgmVpIE?OlK)}0|$hG4IIXHleA%CEd@x9{EmGvgEee;=<MvHm+h2#Dw3R7z2
zBwXjI&gI^SFdqo++~|9_Qqu8!<bm0z(0GqOz-c+fn9qy4?jUEP4OFNE3Ic7BCE&}(
zE#X3rJb6iiI9Li}?q*C%qM0pNSZW*4r1gt{HrZ;xpFJE4=lBcY@$RG`t@+~y8a|#!
z<>?R3YG+<d2d?<Xc}koIC>F1U@Vp|q0!alwdFC(HIH18S5sv~_Kyt5w&d8l>icut|
zBXyiH8-W8GQPHEn?08c+JxrKP4br+aS054v0Ng(5F`==<&}(>T4nRSHLPK3i)(1|#
zA9{^2T{{G_#2|Q*AJBZ+kd=d~MHSWVZ&!)|fjkMXo*T3=cEU`WoUbCctlg9Ln>QYf
zDRJd%dT3PV3Yb8LATK^33l(6Eyb4QuWnK1hzVX&EXo|K`x6yG|e~3p)0E>|IYJcj$
zew;QKIBD=b>EWm%J0je$O9l13zlKEXB*-$XoZJP8;(wA~t5>^l)fg&uc-S!K{Ydy7
zL^7)0&mpo92T|w=KsSzS0U#i48e}MXSge7d>|(#>vaAHPtR=4NYv*FIcVpvnT|{E3
zwh^&lrgrAns-^%_{QZ)^L9sLMxJb)sC;CDI4a`D}4gsQNX=4*XZX_*8vD$b!W7w8+
zgB(e>(fd_Ue*VmyZ=xBHPZUbSK@&waEX(lH`!Oz%Mfre!)fkzD%{-9}wjRQA-%2Fw
zsWpl{`{v*aeuRzRe~$|Qh5US1hsz~0UBd<hBr?wd3^UJ%6aUHnRvzKP;eT;;Rbf$f
zU3(Y?7<vc+$)P2rr9>D)Is^nkx<n+Ty9Ei6mM#?#6p$`ykdTy?E=lR`f6ssRy=NYH
z=>^Z;d#!cX!gdPH5siKq3}j~CToS}YS=a7wC(qH~;j1|=Jcg0lWqq>wq0D4elr*E~
z7#7*?yufGark=-q;C6E~qS4qwcpb)Ha$1K;Bx)L;F>PSv(qMoK!!NHXTf0QdA&Sm{
zy*!`~RIdi5t?}Z<1aiZ?(mK0WKr|3v>y>lMzq`m2>SSRP;d+&!^N~Ay;46?MuYIP4
z?O6HrbZ8^)NmqurcZl6FKW{t^?ThHSJq@^BOY5}&_}oPH&C!>DSAa|XlNf?lNxTr4
z`%S;Pxil!d5?&?0s`KaI*>jt`<J=ez$6mx;GRl8-Ygq-vFugg(e62^8|2)DVotq_}
zGA28iMP^;K?ej*T4kyQ;T%FMJ_J5#L)kt#D4k|SV*xfM?_e)-~5o8`Ri+$eX-YJ1s
zSijxBZl{EhRMubX-Yanmy1ftkg935ZEG1X@*cZEX1~9t$KE_4{Tycf+7<-1HjY#88
zQ3~go`xBF=oHP3aLYq(CIAQ*N!ILs*g)4V|KaoTGiWcAKNM_}nxypnwg@3JF@28ad
zNb#Q~&7<_j20k37QEBZ&{YVkwXhw2vk-C*f`^MuA<N5CNg`9c3`v%LI$wS1BzY|WB
zC6|3N5*jsrzdh+_h`Y|z>dSPtzuNC&@G$V%uJVZWs*j1H=^J_RBT*+uw_18~<v6VO
zM)!|{6V~jANLKv&|Ls;*rithRlSo#XV%6D6vG>3al968>j51pQljZ?a2hv%i%2v8F
zn$D+TjDOqRl;bN(R<@l;&1p47%w_d1;uhr^c$%>MqV7)tW-Mq)Z^7-iNQPlBZpO77
zNq+d1CS)_bTMZzxWTE>yqkucGHzJe9<NkL)kNgQGm5Wk&U@ozqfl1pRT)iiMP&xF`
z^w?7r>hcKRN7qLqe(HdSOJ33cQso+;GJU-aG+5b@%V>qltGcaRhizif1xSO094=dv
zOe7N4<rm8kEs01>841IOUOFyem|gk-eaj*<X)-;ma8aDe!Y;BGm8H!h|3o@ouoXj2
z9-*FCPbuvHFGh$e-1=Q?e2J^OO6gWGa=BXD+<XPM`HCzM+if^}#RhoJ-wUm8*nu{3
z@hNWL?)~jIiRz9WQ|g;p9K(Y9VPf{CZ#;2!?RP}sn<{&c1d9`^C-`zJ$`cjzL;~w*
zLU$B~v&y3VY^8YPy)U<G1ZT6A83%pN3qD7uF}Y<KE*ed^V6Bnt$^<tWtn3ZPx_z&-
zvQK(Pn4t*jUv0j}?wm)#6JCLu1OQz|6*-y|)5~-Iir}t_=PF`OWn$gvdU!JDv-{^3
z(1x$j9n6Gf#u0~yy`SH8E9azQNRVe1DD7G7%f)uoY#cQYH;>PjV;C0GQZKmV{B4oz
z2Rn~8i?H_Qj`dHs8x99(r0<2OMcBWuuA?7NaLI$R>9zkzf0y=X0+v8yU#Xd2O0*l}
zY)Sa|`43v~>QaAjAx$`;!~GbS-*qryY9w4ktN+8#Xt5S^|HXPk1#Q`AxG_P9cguTt
zGiw36B=g_ox*oH3&(=v?SWsNGEle}93TH||at+EZH18l<-5BxZDS2Xr52GpY@zb%Z
zOwTg<xpf26M$N#{#)wDqWyzb;U-x}3>SQ8Iam!~_pZ#~5%nO6&ScPCcevq>^m}&}>
ze&oWB+OwZ5HJg3t{_pJe`Exjw#qsPHa2j1JTUan>V4B~VVi^!}g!2JbX)Kb6>_DCJ
z^Nut8lztZu*s;d<wrp(Ba`!i6__S)sSEyNC&?-nh<HU5^n6BCV4Ejv5T3oXPh)0FC
zt-jRapXbE4e>$E^FHD6(8ETbGD{kKY!2cDDY}5M2DEjVZXXMME5h9_M0y~(&D`}TO
z^ig+hFM06M=GZstXcmfvuy!0d5tp?AwF_(>rAgIw%*B|90K-@roM6a?NG^5cgZFxi
zP>!x&*<>?%kw9SYrI}Qh3p?I-KpjMhl8-Uwr9EOW=lZ7xvs~~IU2Qr3lAn)lOW&E2
zcjk;{eoxWrk=m#piy1A)2_uhU9H-zq`PAA0E$zixE$>J0=WMDej*$_R3w)mkWc&wY
zMnhb!gJOBv4|#=88OSkyj{{fI?7az*`WHy6`F8>W!(3jV>sbEDf|v@i2@_Hq=_vBC
z@-=)uz=89LTK_Y>Q-2O{9#O&RhjxHtCTZRx!C4@bRbb$&PSo;GM$xwwc&j|s$})<%
zz6p|zuJ7(wdsfX{LO4!eOWo|pD5RTWa-^zuf8^18%+x0|{N0bA!ty3Ve}}r3PT%{7
z^U=;Mjo3YAvSqP5c1r2i0}6Llwi$^!u+5NPL#m|LEJzTa%?OkC@3u$uqVV{l$Y`ha
z%GTO{vT+@gPo3}voU7oF9h&hr8;DWn#uCKwpMSy|xw1CkLPBMzB~@@<KyzE);H=Gx
z$fZb<`i$Zh$}ZA|3%Me68Mi56uiT0KpQ$2V{zM(UY33T@dC8pnJJJ1s$4qqGz1K`l
z?s8G01650(9`R<+Ae8VE@`&u@;EGZN*zL3dli)Amf90t{c@k_;4Y)t9A($HR_~3te
z4Ax+9jKk}0Q;;1QB#6-pTb5Xg)9vZg8i%`qkY<?Ze0RM()QbWhcGkLc7-T9sf^>t!
z@PViKf++2PdCMzds^)b-gq^V?^OuJ3HZ9f%IBJc5L#fz01ARhZF`qR*%U@T<>&Zit
zc-?mAuFY}96`oVxs-wkyy5a(4Oogal?{ttX(xv1ZPh*(~=M7q@m>6L37#DYFE@(<n
zY(${&elS-Vgt7$IUza0p6&KtFl1==@czVZhP-o2B3pHMct5(MNVZ?tJTZn(ZC*HG7
zV_;4aj>N=4^1{jq^^`^68oAfLC_msAsXj6)izIRsk4HM^FNaH5GmkPma_k@T;~+<W
zuHLyQk_{s=9(`f+b0~n*@W28Z6cEMX8<uE7#j8H?Xml$k;L4&OI7Osf^^Y{bVBLU#
zLCMM7kd5>(ON38%MV!`G;co;R-w)BA7bOIL%F7PJC_Xku2j`zlIPhmoYJ;ou23fcm
znYPgo_{7Q1?4@KMPND6pp8(NAl-)8OQ$<D*17hxMaM<IHcHW0ena<96U?7=Z5tlt0
z1_doSPt92?hSN=`FgV3*I9DlwYbKi9RP0W^XKPl($<XSDaT(E@Zi!o?@k`UjL?_=g
zT<#}QaPAelZ+qM>5%Eo2mjj3hkPj&6GK2O%tZ8*x@L=AhG1{K&@I*j+CVMhs1ip`d
z*jffc5dmvHyA~n8gG<s>IC1m+x8h?9UOn?Ph^j?Ff1g}?d8@I-Az9)_s+)@e%zQUa
z-1g;qx8@T6(7=#P97%_^<6PTSU_s~1G_V><lHKSjm;RjDe@-19x_I?wdExYD4T-<X
z6KgV}G@6u1jD!c$(JlxB=>^OQ!3NBXJk<`ovY5K;kF$=CcG|rv^ThMct$*?V3cPm@
zZ<vq`+6+3{fbt`;nIQLoe`Q_caTnL}zr4Ed8({aGG>qOg&yk*&ixmEkUhB0WkT=k%
z1};e<Q^HJ{p)rc{7(&;{x7imm{qYi(fZ1nI1p!A%;JjvX2DN9hB7Wq-{$VTg9nJsU
zu^IcSBLagkj`M}lKqyIIr-&5!*}s>Oh0XK;ANQMK>Y@y{p1~xRC@qBb{-}QuNd9=y
z8ZNf5vV<qC94?Nn%ef4?rrX)I>;MOKM3egP+%!}12LtF-4e!hgA~|?e8%Fnxp<(O=
zUhYUhYgKDBNzsF3>{`JV`;Pk<0ND7RE$MghMj(r)2^dU?5^v_@r`B?m64(fP>%Rk&
znvxOPXLNTV+24c^!~Yp#>g>`o<0t2W5}ybXcBy8`+;t-f*FZvpAI3yzRAzMBJQwkk
z_Xm{<<lS)Jr}_2x(ZY?zAW@lhm<2Vml<;>9tR~^B#T&%}V5ug-?)HO6t*HYUAAZsY
z!30>>4}&y1_#-}dJ|YAvY(aL)YQE@lF(mltAsZ3@eoWr>?@HH*N!&IuAP9x<knpGQ
z$!=;X!4i<$=OI-QMf}>FM%n7Uu-}1P@RGEvzNcOZ!c#9lYbIqCaP*};*m8L0sG}lB
zC>kT&?L4OWYDj_2fzJ#}jssYye?>cRv|a*~NYF>t(#(N7DPD<pe~D5;qiK-z(U@Yu
z{IeaE+8lIa@fk>3_sV-wtHN4atTGZ;6#zsuD^AOF%Z~cvc1;*6w!W6DZN{+raG-Z8
zLdbOv1K!NVsdWhb#n(ul5x6(7`V#9@4Bk^t8yFb17PPu#6`Tal+^tomlV_&H?JiY}
z=UXwNKR<r$^3Ax$pEHQ>uJ5`VzRI-0RlP@>&rmUH31J#Rs9aj@S_UXA7?rW1AZx*1
zkS~Inm^#&Ahp8nW;v(%6PFzEU%yfeEx*uXntA=?MyGVTbB$Y8p2ju1zao!r6LJNPa
zvyFaWb)c%$N8S`7Ue-lc{0IDKDt-c~jN;oT4)#v##QcO1?T|}))micZxmmE9_{e5B
z*A|<Asx%a~dlDBo9qM;+<h2*C!c&HPL@V_R`=3FL1EG_;B@dyabkK;p9>bl&e+fD`
zg@;C9YCp65LA(P47Kz8|bFU31RFO{tN5b>sgU_&+2;gGCM$@n<Y(I5XsbzFB>oMQ+
zt++ak*qBKauBjPA|LDZIAGLGX`a1kGQU;2Me0hmd4K{Uie$-)zL+2X1`;rVI{g2fr
zJm$(vRJf%O17#Z6m^e{%^R`=MZdZXcXCAzDCDwLL=c_fDuER<enfb?Q;QX`y-TB}X
zThsR?xJ|cb(E`xf8&+M2>6d}?I9K;uUYj%6!B3Vit+TvdB!Kbu^~39dRN2^n?TO-S
z)Q+2cEA;+ni+}V7gan9w5P-S*fhaEcZ+JL*GeT9vb1c~Eh?iH3Yv!hQf^g{9Uo0{F
zQ{%?;AidMZ8qB}(14DoUr`Adi0M+ktyZOEd(di7xu{pl)sW<7|!>Xl#;==y$`y)R=
zR;NNA1)owNh@s1m3qQmL7mGo2>g(&-Gpl=3_$@f`0v80JX80uv&lz*6<3~XFg9-~I
zp8v>0G_m{27Px3S7-;NDTOXAyyo^r}-uDTo1FlC+RtuiP8a2A1hFXm4T$iz$x~NuG
z(wA@D-sm|4U^ly{aLpOfSun|D{fPt4sfyGNN^>5(D`44u+x|o1Y~f9+ADfGfg&}3_
z?b$W>Y=_e0egab776XM;-xaA|y3pHx>EjJB?hG>F-D$qP*%5HB30VIaRxiE&M(wAR
zzfp(J=h?F4<DK6{;)(%w7l7=%(VhCPyoMq=JO@JFDTSSDI=Ls#4TTcZ$reP0h`yH>
zor*uDR)<$d>{GX*@tl*=F%dVqErN?TWRZacqj#FWpEZ^}eepJLr_#y7R>tw)8jJs0
z`=Fy_JHK4T*}%r-D}z;4iSY8#N8K@M;qUkcF}pr?!=lGyfb+-p^Oc(OkE0Prbg121
zPVDEpHf^tfBSy%0)1%t1iX8Jl%}pY@MMu%D6h1LiWQuPEGauYHjk!$?OzFw6d+98A
zaa;MWpevaIWE>?PeRxEJ%Nu-{1jyUSnCkGBUk!$uh17APGk2z$$5h7~(E$%Yh6uw5
zZFoimrN<>wumx&y`jYcA)6a>ESQ4bDXl}?Kpz+`4n!Wm0F?dr2sA@L%J*ylZ=MsIl
zIFv7wFrRcpeGkhu?gZXHkvUHb*b7Eq#o=ybAZ@M(mvXNq59Rvq{hFBrR@~b8ziHh7
zg!J4_(2x|v;b=gfVU(Z#?Wud&5l)gSeTk0qc<?ZZ|5Rzbs?M;4+8k1QYbqOPG9^H~
zPaN_beRuDz_b}H=fqNf@=3lNAf}7e|QY4np_W#I3#lg^btDtVEv#x5xTe0AS@$Q4<
zT%g$n>BiEcAr~oU3Y&={I81j1BSdXLMwbtR&%d(ImRS;P7&pK)pf1t>O!u+ix;8%b
zvOl~DNo4?31sYDh2+>FVDg5mZ5oX4r4k!fcQ)RAWv?2d7oRvF=I1a9LfHJkPlDT?w
zTGk>dTqI}~DO`KjO~e$=_GM%fOgbaOujeq<lbf%s{E`$^9^Wqr^FRbSc6HoG`;XRg
zGxgKj(0}S;+)Dv3P)5EXubW@rjPekLqRLAs$urN>NG1#y0vU!vWY-tzc>bDH0~t#{
zf3LlT)@%R$cP6T3^;pM815Y{A4z45l%fU;*8~0MVbL!_ok-Wt6)#2c4A!!Sag(9mR
zsiaL}2FpyFa^~b&i$kJA(od+`CyNbHn9bk6eS7E!rt5$J@CbRCgY=RBHUI3B)-#cP
z;*2q*c~CDwN!LY+j>rAWQFOxI$lJGXIqy`ip!4!L8oiI}4K8lJgMO#hTwNup9*<^t
zqvv&UKvKSA2&(6ceI>c!g|UNI4o6qyfKukwuJZZ~=04wMbTb1oEBGEFK-M(lZM0%N
zn_N(M*WlwTV}nSwFB`%-LR)Jp_lUI2o-pORT+kFBJ`}Ki0Ka~^w>A=*`Vg`C*4bm)
zzNQC(IW|7N!?@+ldwx@|Or)Wft6SY#{wSs~v5r0z^}lE(<2zZ5Apz_liHC1#2;`VZ
z2@bPKER&FF4}oX%h02~C4(=-5GY&nTAQ6V}3D^6R>^ux-1oBZ-{M9qpNm=-9bS`zR
z*Klf?q8tucflyr18J|(;6sPcB^g}Qb8chJE+F>~jBiLP$j5U44`}`uu;Y>aF{WM^*
zPiGqkB`;OST_5Wv&&204VJaF~9hVbk|JEQ~Khm74OhH{t;x}^J<4d;dLpkRAbf7uS
z+j_xs&6xlM;$=aKPwAMh4}EOX0;mxT#$8M~Ku9CZtvy=N!<Jr@-}Z4GR93olx8llq
zd51V{4bqjcGn`<WBVy?F>eV5L)v@QY;B)emxhT2@SrX4@*zIjJw>@`e>JWP?#i}ab
zF-c-GXcBb3WO~fqbqmIfr6emP)1+sjbg>mUWe^osddNV7H;EqK1<{#j+j$P5Gm<|Y
z#F}E*)iXR5wL9NQ+&-9)Tk)D*R9$-dFDOSWgdUzKb+y+%Te0&~e5g4fpa^Sj5t9iU
zHdQ<TZ(BC%?}4AL`<}S8%nh#Ii9P;UXr4BaTg+@%vX>s)OA5gt!%ta&e8SjB;QW`j
z(@zSKCa41(gSxc7V#HXY&m54B_>^Izh9J_P@^};KpDxmdFn#!iV$k>I$wie5DHelH
zz+G7su9vTx>f8{udyS^4#B@b$nQdqSq7JNPkC!;$U;5ng;vxBRvyGUf9W+TxW$_hB
zb+-jngZN%(b4aK1DIG{J`j(n9*x{)@foni%`EM<6_nLn-dp5?4W7oSKa8w5N1A3z0
z&AF_ZDD)rRWcNb;+5tAJ2F<w6TFqQm|MZcav@m~?PMIV;D2Ebdx25O^tFFFmELxlk
z>Vo}1{N?7=#LY^lpw*{VQlX)~NlFQ%vW=+QPtm69OuBZLKC-ZVTbH@vq;3ScwytCh
zsY&5|Ddii}7!hiTzgGPLmn4><=4JcP1GqWQsG2szh4}w7+1^L%`|N+b)j*T&v5_!6
zJFLBhCzG>g`4B%EC7Md{^gl(#*W@GQ<(~yiH~6MBc`z!g?v`qGGbo4srbaSa1hle0
zx?&gtUg)-xwq#)b2B?ba(Py9AbMTONs~)<d0bX0b$YHEh3t6E26fp8&F})T&K~T3;
zffFdYgC_CAYF|L56K3!|?&8-orEFm-!`XCobgc4~;!#T$4w|JRxEBsU;M44`0@*YJ
zTFkru7^_iI`lZx7sH8|N4u{fbA1Sp0LS4GQWCSg!{KUG+75i;hzmXpUT*k6t)??N{
zhuXwj)ocOx8olls_HMmz742&>eryB&QNf2Pp1>29$`lLi)*io|E!?L0TcaswS{5;7
z$R6_Amn+p1z=IvYzgEJzD!`6RT$^DM$;<tx+(vG*>{ixw{QNEDtHPG<FSi1eq`qO~
z(i;Ne9y?cuuHLL_I;(>^&bLALWL6Kd0OKQ}*LkZ}g4==t4<;bnn56pY0g9=-edyZz
zke3+JuDP?|Z=NVA)58`uOK>HDm#Xj@+1+kD#pSgFY`<Lj2T(wN`22zi)e_6(02$DW
z$Vwzd;3PzyyMQd?rz#8b+CX!KLg4jW!?UMDanm4Gb&Jc0*Iv+T@X;wP+4x<bN{kNF
zB!Dv;BbV6S!h(@q@90$5hdL?^{iCh`L+tZ-r}<x$;J{=#Xh%=Y{W{)W<j|{UK5HZ7
zNOqKh(RvDB)Yn0gUK3rx`+w&RehqLh14MLNYqOzP?C&JFbN27|P*mZKC4~O;pLiTa
zyca_$Dbn8|b`|f2{jnyiNyQ}7(z@P$9q^+`iw0#U>bTId#s(gUg5w|BIASybQ%R4n
zt(lNTi%EE@k24}nM_^*r`IRh)Zv^xbqOaRN4~4>y-y9NmD4*RgOAK_x7Q`rv)-j~F
z5$6r_qRJO_4dss$4cT~YxFr9V0yo4^G;HtDs<1HE2uyy`;-7hzsakL>Ax#HL?^}`G
z=*V!QG$O<!_S9Q*ylcMYj^f<*L~qNT0^RBgD<9*FE4ype{~bLJ8bNE7$Brw^6l+a{
zLZ_f=zPhJ!YbC7#>n}@2IpmMLg)R9x>W=uc4t7}2ehQ=aeyOgD@Tlk){`PjSRZh6p
z1nLDxUA7qK9hs0i(%ECU8xqF_!GacHLv|RkqZK5lOSOrDD&UR?_tf83PdoVh49=ja
zmDs6WewC}<@5}_HSQpWR8(JYCZ(RtW#h^DY%Zro7<1+;_Eny07a3D-<IY#oLo8fcw
z_AH|4!;O0ornY|5#U|I*Yq-@Ay=E+49|NymDWvt(>F=*t?<0Y(oV6?;9&K)x-KiUN
zhQKHFNAMj3gv9WXiR8~gaON!RKU=7L82RC`JEVpK{Vs~wV;PW9lofJW?K?HXCiR`8
z+Gt*2VlkM5Js#eD-0CH|q!>W^{MD86yqiMKl$2p6Klj2T5Vvg4Rd+i&HfH43L89Op
z*JA`4rwUu>J+dGdi9zV0OnlP4E#tcu6%YEOZ|!VDBebAv3@*O=>Cv-_SZ@BZK==Ik
zqFjli1r(SMA~Q@A#LYdP=^2_6VggBxBhmJbr2G>!UJeN%3Z3ZGG1yKQ+pgwsKgC}G
zKWF?)yB^h3u<Wo-82i{i#z1Jjm5#N5;#4}tmVe_$Tq)9gzkl5*4P<u21;xdUhFPar
zn;1^H#UIqCwI3@feU(+K3t5wXvKXq+@22K`(8K<{#wqYo*8M{X7vtltiSIS}w+B$N
z8Jv$FE3NZYCiBxBrlvC*7CJ-EUz$t0ED0>Cg6Yuz*;j(|Cize)N8Q6<lA?F3qAq|C
z5mEkOxXT$>HwTK5?aEY*d<?x`fi|N`3hCf#bi@-!h7d``FQFDkp+)nKHxY4dB+b(w
z;nrS(N|DxWO6o)|y1ccwEv)?|32xoHixA72ueR9?-`RZe0;Zkfit*Ly+U)QLQ(cm9
zLtQH#AUQ@d0{e{Mhgbm**U$R(Ia~PXkaAIJ^aM;uQOxsmj(~TnNmUyIKp1K&>$UTG
zWr}iUSd**SO!7g>sC_J#`cI|*-i9~eHo$JvO)@bX-a(*|?P0`S&*JJjQK(_?GOf_V
zDG{P$iO*6uULYYrY-3|mi0H;~B5BZJ&(RCE`JT*Wk)S5LK|LyBjiC)ACJE>Hn?qXO
zFFYMp2KfQZ%I|4B;KS{;tPmn*Ma)$wJA=z&4=Hmi;}VcWUA93J?_qYKKXsPMbIM|c
zcuu_SkA<(6oIeq&j0HmkLQqLs*wV-7yfoDQ^=zRwdjNgw^U4Rt8qn<2Yr1;Vls$!?
zQa84Ch*QNzput5afQ_{=ap7{hPuZ~N&Xl`{Ke$f~6Dja0+C``=+&rmuOyvCh_3N)M
zIKc?WX*vo*({Yat8EcUX>2<w`<)6cHkaJE^;1p09!G4<aHyaa&>yP>%C;l}@kgfF+
z19{ovTN<M7dWF?3^3*O7TV>7~pdohHPJ_r1u?fe=h~@S;i+6J21_Hd-Q-S(nn5j>S
z0~f(j`!%~AO?VA5O~7m>1ec7nej^Z_d&UsrAYR~OVPWydhqaWLl2@hiP9(Oocvu=M
zr2cP`L8lBk6|eI02Qgy>aG<105<HHXkaZL9!k)aoE22|=ej2D9%XLeXz}PLQ`KIo0
z!G#qESx3CP_V`&fw*JEcQBtO!86YaF-!9Pnj6LHzqBgsTx8iyYEQOCZS}pt3+|}g9
zuaaZLH}4s~W>Q3aG%4RnxTt;&j8X#CcF{7vNp9JrcMeHT)2RjrE(NHmsT*E8gU)o;
z(w;g+hhkg~2v=!8AIAt`>A3!WOgS4nX3dD0mWH#q1^9sEm5J!Pf~!Ma^gebYqKeDw
zcpFE^Py1WWDcA%k@{s<SfTU;C91^`V0Z51dBPlEz<d|c1w3}^$rwfyxu#?p=DG;xR
z&p*Mrf1_))3~yM*Nh3E{jO_jS(=4`}iZaU*X?LQHHoN{Zui$-K2g?n@W4YV3dx`-#
z_pfPA>cHc9Zvwn^4|7dUVw+jL@4q=RttuysTZ;)p6vT(e{D<BBfro`sA-<suuxyou
zkzXEf;ZRcGbYZCAU||H-wJrqgEI)_+VaZ9`kYmD7VHo|8^Sa1~>^cQA_7)wfRvt|W
zi1!!I)M6|+q%*L#o~CF~5O&K4i6YZPUK@{sSQV*y))uG>#l5bw2r37V#k`|`n#R`x
zP1v5QI%EoDEyfQX=j2n;;wTi<if{XtK?Pw#9zE3Rfm9abRW%sA!If;gjAK%{;2N>#
zK%B@0?R8n0BP&0`s(ZyDJr7wqS}GkFY6*}8KrFIEl0(FR_;dDDYITRPb#3I=hkY=>
zdVCV6Wo=_{AuD(OcZHrn`;N2#i?KlpLf89uJdzyXU8JHnUSiV20G)nR2&jZ6sm%H%
zJq8s9yNqLBujFq}?;(tQ_kS9p=@~L3vcU9sTnXgMp{L@KraZe(6Wm_klaX#LBQ^|a
z@JZ}9O7Gg-G&}5i=%W8iXb(7Eb;*|$^<SILY)&2@8qU!jZoYFq?LK{}$V)EJMdOEa
zd)^O-xA_MocL#TYo@vaJ;#cADn)O^j@BJE7>C@12URzD|Q$?dBxD)bT{Pvi$6^ut2
zAu7k|yywSm!LF_NMvO3sI7A`IS#2Vh(;!*$=4?5kX6n^99Lwuw@1Y#&LCL)q%=Db*
zrN=z#A1w$&NY&Ia*tUinFSxnBDPzT@{{PD&3OQc}bKS*@p#uTBz!kqptw6>*46E#&
zEFDsaC4dWHHhWq9^wg?}OTzozA!YVeBD{yE@n~2KjjZr;;kL*iVe#&CNZXyNX}gO4
z0LyLv8bIvr0<H9%hDxrJ>MEK4XT}*|qs=Z$l1-_Q2*>AWG55*Ajr->#+G9p6A~s4>
zqsVaX^3q!E_V0u+JfdG;UE7B3I^+Ry^J~$L*Ts=zq`%Yf<?QsnRXHRrkp<T)W)}VP
z4u~n1Ix7mUv*i93NMWltJTW|QW9%j+6jbbi)%O1(Aw53ygp9F8IBQ)h$@E3K)r{rR
z@KIh?_<vHv&j-NFtYuy(vA`5K=olg$*q4F5AZfah^N-?c&=1ywC{2L8$VXaU9Bmx4
z9RZEBNnC`#Djdc#q^tY%cfFhKEy0yWz(0~R;jT>OPc%P>rG*Gf*U+kny?F7Rdr8WD
z49xI|1y5~5EmcQT3{{(HDIOamZX_W|D85#hB5Hb<RZ;&y5@63u3~s&$NGp6=nzk(x
z@+xF5Y)<f!hGV$2rYRIZHXq~N@g$DBRYs$J3Bktv02@Uc8^)w6#uHHceQZlbT_MUL
zQj;1PqWhK3<}|ew+d!w8(09K(cxaUZYDPlqw*U><&P`BH%eb?m@Z=VpPlwlTn#r*Z
zQTitIw1J>Yi+0f8krKF-|HHqT7fgJszbgA8tqvf|R1VK2_xu2FbCXxNjK8C^TD#~P
zmENn$I>B6oxw#n!8)c*)_Fm)Oo&|B|l{FH}X&+_796k*Sm}Pwru5=SP0jZZ+Vjnul
zwL10mHJm5=YzS=o0I;d8OAgiiR5y!)lkqBd{oO^+(_87BOD%_GC8q6-!|FQaAKVz?
z#iQ#$##i%@NAyva;;zPkSweM6yyn2myBa#;w`5<~8dO;MqoaPj*I8fw9tQ8pdSu!X
zxCtUz=9)p?F8e1rcsm+OBUF4BAap+^FT}3=<z_0toOLdnehufCC3t0RoUvFG`NbOl
z`q9032!3k@N|4I3Vl2e%f^m30-*==g=E1)pEnWRnhE&Xi*f}C71*_8F7a6^)0XZCc
z&xK1MtYY|=gecO~n$PywnK>^3DUXf3wk`~CfyK57V7&QcYfmS#-+$l=X`9C{lYBCM
zu+plC@gm@%o}Xrb3nBy);h&9cC>Q$l{DqzU28Gzvoom0a^RG5{naO;<8hpT=igyhb
z72c1znMI@q5*|MO>FjSme4ahx>L8}(v?gVc#wUSqjug%KiKQU4OAs>e8y>WB{Rv<l
zUgbrPD3uu;LXJ#(QShS%JH`3%W~cb0m;Zr{=B@5Qp5qCb{_7J%%?A7nIKFg&&$Wgk
z|FXP6WfD*7kV2G@{WHQ6oCFb15i3&5o}eIFX$KZU?vdc8P~~yl3etbVhGBx7(U@do
zZ<}Yhsy82p{hSB4tTu<~F)p7PrCl{2={PPJg`;r_hv8}koq7f6*HjD#m^jHyhf}@%
z0x7xiI|!GYF{xhkA~MJx5dPta+6RcDP#;87I>@QY;8_@6n6HRmPB4r?Htm|g0}MG|
ziUr*Gnq)VFkxZM_^ZEEO2ZBJ_Rgirv^`NLE=rV?KFJ)35dU_7Th~LvQxIoZW>#?RH
z$y*DTDO@=@#bqoH#@k23L1y1r5OJoCBDK#@a<Jb)c;;6gqH{K1GJoO42ll1MImISn
zuMK&iVZl{j*~S6MOFQ1&v%Pj=jaciOjt6hj9qMu2l(p6iJlWZ|r1M2FZO)M7ZB^x`
z=^)FyP5=-B7(gF;Q#{NQwgbAqK`^r$Ot;jvLr>OaEAN+z=@w@G74vUM#Y7A&);2XY
z{Y#14-Bfcm--3oHu;B$$Dg1gFpOg3Tqgj;r<kQsN@V@l&L!Dp8$D!-k<{!b+Ez=Pn
z4n1xNpi~>vA-$`uEp#VdEQ`g;aux>}{@eQOLIxhP21HiHH1m$_gc`rroH>?B_ccma
zksqF;Lyl*1Pl7Fm0oiF1^VE9kCIbEs*sOb8$KyTzz2EA?f-lUmXZs2q`dQhr*;0&S
z-x>bNhF1?j*dNvr`$)u9E3rRBnjVHEnK3J6Q=Vtv=>11GB#cf`^<$QgI@58<2viO_
zHftvo@x4N;_JJ(F;LW^M(O7+S`_KMV{Md1~x^TJJlU}*@0?fcz@_`^Nh1xr2M$wG-
z2yfj31M!-bI2$6ZZaVcS%hXLXh4%CEoSs@|TiO%N^Gb{#&j)lqHy@C`_!CkiYy!Sp
zwNPNahMcscRJ%7e2rBu|fao?18ok4BO{0}j2%*{#EE}Ky4SEw}a36#et8ukDO$!wW
z>4N?<9T=f!<(3<Eso}5?4he**+y!qf(LzPuE=18MxRMSYzvx0`c>gB=^!as10?x}p
zBx!X2-SuF6o|NZ2rkofDJSArVEz`HFgXq-`sjVip&kAJ2h?fXyMN2;|N5l4R@3)TQ
z^d>$l#&BT>AAwYVe+MfS4CO?<xiYqN?Bnk;jJ~ikl5$$=uw@N@Ue1GHHv4YVa#iOV
zE7Tz;>3D-X8?fTbEp1s_f!h1K8~Oudh8hCRS(Vi0$xGq)I#_vfj}#}pnfMb@1(Pl4
zsxa?YY_<NxPFEGN#9j*x59S?imcigaoE`d?_^>qaOspxC?<80Iko$-pPKv=kG2R3X
zVPII+J_4VI3zl!v&*=gX^Z8#e?B^7Q3cf8qAT%PZ?eFKAMg(mUkd^Q*(i_HH_E}ki
z&ZX!cq|NwZ5w_7wHbWZdAv{4q7!NXn{Y13;AZ2af;f*M0dVhzPNuZ_#=$gyYVVxSd
zyBl+jm(|n-9-B*XMS^Uw_?y9uc?(e2!o)Y9n-ih*CVrK$gUG}*3nm)MT%0zsJFr$Y
z7VRkW?u?+xt}lZ!oBYodxt_Yy#nuT?Oh_ML?#Ikpa7;VW`xNnmKEzm`G45#hQa6C?
z$%geQAbFZr1yFc(pQFXUJ`W8?7_{2kECUVe!kn`$^RP?m8S3%fIJ}sv!>z5YbQbqG
z9}{UB9G;hKp1(4ke{rM^sFcs0&tp`kYcnENyPLrZrOu+u(oSQS{s%^FLf(1|3zj$l
z{P>|=(cy{CMkm>*MVk@shVzjw#^il*=46|8pSI7w3b@_9-DYh5cxPnN3IoH|-hSI;
zv4h>G79w4`(JV{N_iXA;{$ngA1mW^)Y*C!IYgLj1n_<lyxlQ{Z6}JDJ`>ibrOsHPC
zE2&K|^G0Pv^n%>9I{JcgWSLJVhbx!ZHEn>%V)zz&$(SZP2-zK=E|z&NIr=m$f;lCE
z;r<;an8_+0%d#myf9zG}N>^DOv}Y>RXID=?8uccxcrNamgmW_b9`^sLp}RdufE^18
zJ3w@(;2a=Y+HdE&_=61`A?2o&S{`~sO4@do2S8-v7u4dLa-i~9D&k(pKyOnnG8agj
zuv;G$yTnhm-w8p%Yt;t6wwr~~=`#PA0b1;s_=VY^5-2J6&2;+fCVk=UL@Xkm?gW_M
z?MY2@e_<lE@+K5Ra|fM@_NHM(mj@FUIX>@u*iQ^rtlZw`fCW<ZXt7DtYVlCrllI%~
zhQtwfNCKycsU4M^eBhrQ>3SMS>$9^tQr|&xU%#94wfEB3MiCwd%dc94u^c-&{&WgR
zszO%i0(qLwmM)YrZh+mR6`v9rBE$D5__KatGr`7|0zyyztKc0BRv9KW%oju`|2J^O
zl78}VMLJ>kP;%3V5qOA8`&+`TabPhXDc||vwHKb}M27HHhv}&ymMX&z2je3HglAnx
z92^Usr33Y$s~{o3ZH#uK;<x@OP_zYH5uR{fDP1gP`Rr`CF9hKb-Jc*{Juq{SII#;i
zx9oML2ZXwK;_EVT$e-s+p{&4N@212!00b;gUYCf72QZ38x*kFy93mrby|G?UA9fWf
zT~>>lO+ffkKilzcpd9|NNKbY>>1|$^0L1IFmPLtv9%>cXALA*R^f(3W948BfOo#y7
z{C-<sz&KibJ?G6104$=Z_@SRZDUK|j`)e(dG(}?*(TY}aM2i4>Ai#n?Wh0OE)v-P}
zT6^99HV0Bj$Lm)iEN(U5&Bc<%7|@nwGF)*NoHy?VL7nk^sk_PBctc`9j1eO1#8_p-
zq&P;XE|f&XBmOs0JHOIl*8BgXr<7~RyDu6WqyA7|a@*FLbS*AX7~}ANkCc5bK}mJ<
zqNSqm8mGkh>`_oSj$1-Aqqz%P{QMnWr~qS`VX}y|IGOz0r6Qz}fwSEPU1rHo4#p=%
zL}35g(1-7%`9#t^#=RO^UiHCL-Ttx*1s`fL7c=tlWYbDPkw6k8xagEuD;#7Y@E9Av
zXb`?FMvH4*x5n*1|EaKMXe5`(dH&~Z_w{bK?l=3Y8Lj63ungS9povmOpxWM=(gl0I
z#Tq3kkQKid9uRxcVUttAaeGJ$rTEg?-LlP&TV(bc?5!$+btz*9jGedY?-6yKNS#$h
zshYJ}B^$Z_?1&)4IbHv~%>66~L?;`bPBh=ReTD6-h>Ntm?}nbT(Zi>p>W~D((E4sc
z?C*ePXRpT_otTjF1f8}zz_C44@Gw~T{>_>qLU{kiLlEIY?Cga<D6d+MacBbd+G%MB
zas{RNInNFrKmT0<eS=L%9VV$3LwpC*>o=vAPY^n#oa@l|+eX!mq#^I_ne@2JDd5;1
zt)x-O+?(N&HemOwRRUiVX@9uX5`^i8qKGE<G*KDDLN4Hb7fGfDiAcXVp9S~$n8yTq
z#$xwwH(l;f>XNdkWl5Yn;0wtLg?MOw0zHwxJF8O{xEFzyK^hn@N~lT}9G0}#yOTD&
zSz7l#hY{Qzz9a1#^^Htj^yBl@Sq>mY89GEX=l#F7>e8&9-c66QVV#Ktl@D15{mUsw
zm1PtvB%z&tZ7lO!ZulC|ynvu%vM+53oRqmWZDom<^|nwD!bjejmp5{7Y7FojZMSWM
zD9{fyljL%}8?A!dnhs>x@7?VxuolBft(o`tiR|Ym!+1L&<jhm?-5tn|d*=Wv!EDta
zH4ggvit-LAt$F@1TIX&mE}FGI`=46WOTOB$|Mv`St#)G9FvByC8XJ+D6@!w!cBg(P
zf7ZH!_HZ^xu7z#Ki~25g!Q5}JN(*19>6`_hZPwC1Gs}%(rWQSnDI8xj-I051o6gXT
z_!Q#O2~+c|0ntt-eq%b%?Ah(Fzq6|0vstk~k>|y46(_!Ig(Rfcoig61>_GO)BFs0M
z_fX-1eVRl}Ied96AsvVu85ql!7HxiR2W?o6-gt&YwAF0Y==(W8wG-p0yOH<QxWlXF
z2Fzkko;f`yPl{>G3#)9@?qWNl`GtRRKUH>>ub^<pIf<0tIB^^iobwfhSm_NUi*1O}
zzz2QSmHN|Gl9wQWz?dAyI3(Z*+vJ+|{DZyaBTtU;zqe%N2NZx#xLRI%czpOvt!5A(
zxB~az1X#s__mUAA;%Io`c|KAO+NFe$AP;H5>J-KglobN7b#@}TSBOog&}13~yJfwU
zqUk<6X^O<K4n+DAjqJ!e`QBci2IzB!&*!Vr@X8P8RJpvHVdxWE7*lpbNAjmVO$JGJ
zhB!{6AaF>}<SP$b6!fKu%ahXTw~kyb*|JD7A9zq_3`6!C1I*wm3b`bd6?v_Z+{R@E
z%JCt&H{)z_(>t)ZCnCVN()ny}@%0BzbartST8x}oMG$ZubyrYeBv5I{jV3&xPiYAp
z$K7%OX3i~gA}8iJtb9Jwbc)EK?qSk&JiMnZ%n+qZiR6W%T~hOdc&p5AgJ56V`Xx?~
zeWD2H`Ly%wPX@lmB#PMpm6o?=Zz;L?ONDoPOrg*77wm0Xe2HPK5w)0y4xkOwu$+D8
zfj*OAy=Qkh-F$a4Tn4<Xfr~{dFR>O@VubdNEhj<yrm8_2jxo&AqW0s*k9K&h92Ntm
zX6=0I?I-)E=6&eppg>X^uFvPuZ`CCyvMIV!S+ovZxh3l_KhMibB*G!3(%~%jdv=9B
zbHGdJZFC6OJ%bE)s52I$Mo*R6s_kcdfJ8kX`jrk6&$M|kb1#CCTAM@DIt#$`+$2`;
z<$a7I)}0$FC_&-rrT*WXMoXh>CWIl&_G_jbLEs~8EfTQwtrWpQLNu9AEIOllRDH0e
zvm!9JGm3(~=#nnCzTW~W!8drMJiIrwv~{ZYpqiSo{{5#k7mQbafu<Y4j|4U@h;L>1
zf}rVb4!1}8Q#=(-Hn~zXdp=S99d!sNWgmIOZW>ukfaz1GLgQD%B|)nvm_i?(DLsxX
z+IGxo_oi3z=`5G*NZLgBoL`!M6cefoM%*KDlOcyG2pb3*w(fU*v47ec+l+m>&=46K
z?`jsL*!_B4<PO0(HvZ*rEh%v$8YEoncNr!AW*TiF*)wN`=tY8%Lj*?8<>PXqb01_;
zC>1;!g;tZ0MWY0gc=hlYhfM1{8tg9L4!({QP5)nb*77k}Pn8D=5`Y~n&?2z+qChku
zaxeU;W}G;LRfY`abl*>2ObA8)r=m1$2&WA}7N&Q>%h<FMuad>1Lj;3?S3P)IEq8#v
z=k_R!YP}7gx8e7FOf&=a4%m0fH5>^RBVera_jD*JVcy%5T0!sWA6;<N5Qu^lsc009
z{$--GARy<$HMx;^9{6tmf-Dk@mZ#~iZA%E!PI{qLa~K8IgIPDUhScNFZHsF`yM98I
zo8zp8%Po^jp6`v%Cz3r0u*9nWw`w^doDw;|RaaLx&W4p80tVL#FOa3XsUP?_Cg?55
zwo6CUAL_VH1%YwB(xX1O1-_L1vjkUb2nAc#?lZkoLN;s832N_^f(t|JDE<PiYf=MS
zN;KT=#O9nmc8_XG<WHekHl1nQO$r3nYnDlRTlGsKNV2qyG!PoRdMoz!sW$kbd%t~<
z<4<8&e+Q`Y*YSTj1;MD)TN;+2aPd&|5JKjWC>y+{jTx6(%+Zs<{g-}pa`G%l%u_n$
zV^<lz+&%T5V#5QeHZ8H`Lo<Cxe<G+*on6}-)gZjDS#7+w(EB_1@ZsX*yil3zTq4%Y
z5C@=?==j+^PM@0<T!4El2JAQ4##%M02vLN6-QT3sFt-sQn~w{~u+eA3IH`qHarwP+
zx<Pwi@6k=YA(jMMil`EhJSL@-d9dximgx~)$kOct?5s7d{NsYD249rv{C7C_KwO4#
zh)2jJop7I$sIysS&>7BF@HK^W?b{nTZ6qm4Y<|T%b>I{C)_-^F1_sM3YIC6p*h-^3
zeZbXz#kQcKn<|U@kTecsqXjw0$E1cwf$+pdKFP2_B10H+dh;qYgs`v$C<6WkSgdgI
zLWk!I8uCr#zRG3vrZdM@y3B<D@#D>MD2ff<M!%(akDyKJ%&tvFh2{kl5<%OQCO?=l
zm~msT%>r)|JE|M;qOXPieTuL=WD0XS0C<3bH=pPeY4UZfF$BiqE+;M8r9k;>p1=p}
zJj?l{S499KYlS>2qMDy?(M-TvdHy#8uR9VBs)=+;JzlFsEiSSkl$_a-dL1MbC7?2!
zQBb`b?>j7dLlS~0UW|dC9dz)-^!CX5pL(%;XaJ)ZI{+=PDxt8e4*VvjGy~o>_*-l7
z-KXYPXZr!updM#WJk`0O+uGcmQ#HZSL=P;hk5LpI!i)&$zE<Z}?<XG6to?cF!}2Q&
z2;0n|RJERpMqkIUdfw@<cy3NpLg|m_<P6~rQ;#?=lmgGXf_n~{6m{ZjC8ZJC+S+8c
zoaFO7Cq^6#wP41jDAGC2?)b>+3JIoq*%@_r@B^nUdgy*ad|ic!P2kz6wfPM=AKf*=
z13*R|Z^23>rX{z@B;W>bjoCc$W{OEg7!i0nLWFt}fZSG9pxt<fQG5F_jDE@$6p{K_
z9Y}C4IyT24J$b!XYvMiK!xJSS5+0}r+@3>1(|~Fr>!GAIM_Q>!Sy+T>zDD+qMopq3
zo$(*QpzY$$O0=~!Akur^!G2ZH2J+FzJKf1mJ<JBKiP=x*@AePD{IX2_<#1X~Sbaoe
zV{ZI$U#PVq_OPz;0(?J?tJdILptN}@k}Ln_FK>Vt!sYHX7+m-i$4A~3*%f(wT<<ch
zu;WP!ms_1R-;FtiYo+{kJ#^{IuwL;pQJf}pQt1JZlo-T~Xk7G*%~WKEE)|1-umF~}
z0A(lBb~65y3D%pJF&R}o08@6ctrM_pxH>}%FkQgv$sn>PMZ5oie6pz%Ncz51WP$Uw
zwHtAM_FI90ZiJjaD=`4wCraSj($BOeDr&<h`uq24gl5u9drHs(ly6psnVtaFXqX{C
zWkqg{&bJS~{CqlZVu(qV8}!O)zYAFZ4iUuPK&41+dyE*611n+=*TD9sD>ZbWa3B&I
z-;eLJcN$t*MtNf@sDS)p)6zC-dPbOVE#qTvr>BA>5cn8dUv1{cq0B&0#BWTVyMxk<
zW#cB&-oWDc*@xTz`b;f^3o($2fHNWQa_N*0_E5F1W(KZ^2#MH^b4%@5^`n$aY30TQ
zq+A@aroa(l1A0OFN3TW;-Y3ZbjBDybtgwq@J^Akkyy*W_7=1MJfw<D}7sd6orgDiW
z{Ps<yr2W>g=7?P#^WPc6{*CNgt|-_HX<1NR8|uici{nd*MDPL-+j4V2KxEEoX9=>J
zUnDI9Yjf1>FKtbT;)3_OJdORzo1&zzc+((R+fWPQ2xico)!;-Lw&>Ce@SfQ|t7DZ5
zZm+R5QdM1;KLx=koEw2IKv!WG705E2TY&mjpn-7w5a`h(S?+4OSVbCpyoNZE7lWJD
zKbHBf7o1#SguT%;cG8El6eV|sNr}XzAO=Qx;HU6OHHiIi3|!eS@^PL6I0grKod`3H
zalaE=&JgF`gt;+*ya{U8IrFoy_)H9w1=0RwQ_r;9I#xNIKn(p%@-cxZ0%TriG%rU#
zBr0B!hh>4dtn4Yz>QMm%%}Xg(n^)Dd?$giGw|1Z&-#|Hae8r(@&<&)?Lc*EqcwLi@
z{$K*GlbLdepbdv;1<V4SQgc^XF(Y>HJ}1w9VauM~MsoQst_Z`!Y9W`&^zhdp9p`n6
z8;*Ub+Uj2$N<+uir)1NxXsL(=Hr3t-pt~bBw2I6KJ37CiVroLW8FmE*ZqV33Q_$9)
zpQu#(gQ4hRo|n4-7AZ|Ue0B-qF?7=nBJzZ^+3CIjGrb!=t?vvelfB27zICR~Ybc(N
z2>>ukMA+bI!uHSeYwf^0_kDWm{_#;T!*tsg&;o{8mv5p!(XDfLEaNRa!~NfRYMV-G
zJEmoy;Sh)(!8gQ0cKQHS6puU}`}y{}SFc|AzGC-fw~~8qtl4<%kyD_4hT{kQxVqAl
zpwR$+jmCy(iE*EEm-2+{rXyttlU~C95AH25ElK}$CkVzaNPPI$)$WW4@ch6+q-q!3
z%*g$o#W14n9mtexjlXL8ISDS%@r=nA5Z^Ey)kXqe?$_d9(jPuan(M_65}HjGEF%^+
z`doIJZuHtp^bY2qw?1mV1zkyV{Dn0UZ@53`#cuXy*Hk^<sS@%vCLkBZTs#$Z>it?$
zQW6}iY82=@g}S<FA%PnJAt75YwNvGc%N}Vy*0&G#;fYdmorc9@J^wqtg!sP8fxP5E
ztq@^I&@#K>+^k8`njyNs6&I_Oyg@;4Wlcs@9#fwk4e*hsaHpSO1wF!jb$Q?MBH{sL
z_l-04QS=xgv;0tfVy*P%!YnEGqgX89aJl@+>(4JA{JEb3LkZ!m2Tbj^=F&b7iT8V$
zV<ZkjVTTlCb0IvUj-I6`<R&!i9UykjAHW8U1f`9}0S@%;*kUOS(;ry<WA6WrW@%N(
zl~*w&T9~xx(#mSa_Oo$dhN~+}U0Q@U_Bp|#HQZyc2=8a67>uqto)@x6?E9rTV+1R<
zg-8vAJQ9@z6x@8G`(;jtPw}^4A{ur@v!so^pi%9E8G9ov#8dPlV~sKYqutPbI#|?V
zQ^F|262q)PEY$#FXEptG7NJObk+qVT0`qn3w?LR5?_E*HoNSek3vIxAxu-v?oA$2*
z6DJMiYcAhSbOPr{(m-7TEylu$4OYr@ip&b@U!4J?(AgHN5^rdAJvc!px3jzc$zc0L
zEq(6ah&NlyfMaxhRd>LWA~^<7KJHMz1?&}|2X)fa(HXlnLu0Fq>xX}*sfb}5kAs|}
z7C|d@_P*$}qp{xMOuPWzbITUGEKy*hC6dWp&BNx>*`c&5=LV$VG52-CfPSaQ@7_t-
zS_siYaBwGRZFc8*luW>m;lG<8R>jc5t;}r#s{~l{gL>$L`EzG|8Z#Vm)@uH|NVhH{
z(!UTiN{AdcdgiF${8|2e{eTsO9r?_W#CeKHGSo6p$W)C4C-|=53quLOQ1*Cwga<gP
zpEOa4Ho}&&<=|G`yPdk_HzwlXhcQ75fE&>PF7PD!xD$zwg>4LhZg`(i$<9Y{$1?$)
zuOE!Nga=*#$p((pZujS@j3f&Gj<i>t=TU3zSlz>cJ>GO%*d9o!Ij|J)?lKS&Y=BO%
z;f;yUL$}S9pVFd9^Vto!L6*CjK}c*Z#@KC2nU)a{(ieJgEmMnW2C&UgnX>wt^Tx~y
z@vt4#Vm(cL+=lnAQLtU(&@PflIiw|xtuMe@2K;pWhb5?5d4J*t8ibscB1hP$DFRdJ
zq31Is+|lQB=ei*3!<^PhHXpX3V4S-s)B)w}84?iG^1J&#_o`?C_@Z3TOg~-^`iVj~
zoYo;L8syNAMA0m1=9m~|stQ!N&Rz;|n5){l#m|j%CNo5d7ufMfBLzecw!>D^MI`xI
z{L;bLIoDpe8M8CAi|=7CZqdp#!79neJ9HGK$&j7LirJQ@$k=N@-T5#^M_>n|8s?E%
zv5>hj($R*x2pwq#!v^s9Wt$C#d7@%0$OLE5CX=@q4x@kTw@MC6D9tuGVU%SxNA?#b
z{Ls#p;fjJu+p>Daz3JTt3-3+yJzAwpE1oJd$u_+)P>L&P&G1+4X72KuWgj3Q<!fd!
z0+QgdSG8R*5=UGypv*8aA?25)w#j}6sE0tM)f+Or`o6!+1lZ}zArbOzySc#q7R^N%
z+(1g+Jo!uHlz}#VvL!@7y=xL3A5vAho1$#h`%n^&LmhsfFFLn)tpUV|Sch0pn{wND
zbKgdx5D8JXWKc9`k%EaMQpM|-Svg`gJTCPRpi2$ixVx0Oki!yM3R6&JW`;h>S|^iz
zP#kJ7p7m(UX(9=8K((HJ^!)B9bE&PZb?#B+l>AqGY-os&=n@56!Tl*I|Af*+#NaeA
zzr{I?sMqkjFLfn|XqvAWDQp;`cU)D{VW(_JCO)$mpmpivw|EV#VeRRgu#lz;@Y^4}
z1+1at`-qk&S#>Bedj&fD^)FODZj8==Jl+@_8I(yy7en5Rd`TDS%grC=lvy#t0Pn|9
ziQsJ)R?Liy#kK>9X}8WQ5fZ0MV4vh{=(3}cj!0z)-*z%y?h?TB80tV|=?r?w6+<m(
z_-?I0sf{s>aeZHM*Hq0DbR;KYARdyf^)8O>hxpOfnF~mW;G}_gNfP!hy#$vN1~d(u
z+sUVW_x;rXc^<Ug3GAFWJa~8)Sct{v>s+iGK2zRyKgVFt={UwIY*j^sG~xv<b#``2
zgruF>E%l=o62c5(>oNWsmCC2M#ERAbIp=$vQl#MJ^DLwN#SY5-ePn=YM@msb5_R9n
zDgliDOLQu22&#IZ_fogj22X}Z|8)aRY@gT6t%ps`Y%<?{y<$5(k&?tU_m+7t4(of7
z|Dh|(Wn?ghh8IJ5&rB}iQ;dqCIiFyw4ItbVM0dOyz2g`XXR4)%mkze3+~#YwT4neE
zyO^;CR(-<SSHajZMqDEEc@P1VzK9}8asw05EN#A?=Dr5GD8~71D)B^Q9J9g=2iL;;
zmh#cd<b%0@8sR5v2$i+v-VQ177$4yPz+iv`Z1}5115%U#3}w8`0;J;cYCNfU-oj)D
z3jWq(Ykd1EfAsIg)^{lsbgpLW&_c!9vM|&!s^#o;z~yvVvf=-6byfjUg?rZr1YtlC
zm?5OWVQ3@-2}wb6=q^cVX;6>`VF2lFkdW?9kxuE9?i$IV`L^H9d(N5rxnS7Ov;VQy
zZ#l{O)C^x9uaCx$dfuL9KBU==O1I0<{M0e3-0twBdqSr79^39ofj<-EDb@(OqJhIA
z&=g!rHliB;bugeuHy>3xrtqjG#v*Nj-x=i84oW0%2Kl3dw%(gb<WzJ3aly-b2^gSh
z!y4cV*DE56qz5f|4LoCNEUvhLO802H(-rkuoa4Ui-<Uvt_r|}zp7&Pf*~hkGg*k7r
z8N1@DO;Wl}syxbFdKSlA?+D<|NlP2IQhe&%9k7gb0A!4iu;))KQcAizAHkk;;O1~o
zIYaL`pES}JlE)$e(jqX4s62MEP0N8V30L*hfqWDJCM`Q~A-g=s*o6J);96pZsOkKs
z0-_+TLK*di>eR0QOU;4yXBwK>*N*Tg>yhbLWwRZZKb2Q|y|BH&^$tHq*{2u43hb`V
z>CO{)UHzdhAyriS((RE}!m3F_f&9r+Vt7v##R8(3CJ^dD5v=zKzQOc=8G`!~$l7>Y
zd!HQ;;X{4>Qo;1=Auw>J_*d9b<8vhq?i2$~Wdj~S-tPU+-551F;~4dEaC&iedgZsl
z1|XSFr$49Q2c&d*8=oI~411>9NDW+6yejx4ua}}jGjF$R2zG$Egh=h;WlW{lxAWAg
zr-ytdT_FmI6>>7qBm0}YWE(ETfB3l)_Y!OvM^@Ub&tcO2f8j_Yim5&hX#I_9N_=km
z?S~=6A(s{sWEelg4K<-FzWWg%hXias`(Z2@gW#4VGDR_`orip!3BMrvf38ik!l7K`
z2?3_~<qKp&c~McQko!?u;xZlbap0s;)#wXevOwj_@Zm*2v(hsY>N!t9P5oMeAaEO?
z;VnIk0Cixdd1j*bpk65F6<j{>E&ueH(PyvM?R+{-y~?)%rXfBR!8}nDZ5{Rj-$3yG
zWFEpOwQZ)t_xPUR2cyVk%7aZWr;~`w)MDI^VzU>srjfG1%vJaU^SFOH?cv|Lp($PG
zuj7@6|1C9;(3HGvPfEnV^k?%e@DmF0bK1j!$kK8IKOi`IMfmeDz?mmf{stO~6M8Zo
z_4|a<l#Y3rzksM{oO$|lzz2FYSV^*om9W(l@37w?n&8y`&p2hviaG2KNP&?~k5t4Q
zyyzz@(P|!#IFn-riy77b>m+)K2+o+3pdtL4ONZ^E4_BkhPt;H=G|v0Vy(twDSL%Oa
z;y%p2@GTs5&A#j%sP(=5N7d8=Zb2WmpYoX)@BEu+76A*;sDWcQu`&5~rXO$DY%!t(
zgr9ByRVW;lxH0tid~d@!Q6MX>td4;YQO0%00v4hA#yJ?psTZxWD>hRA^XLmMQ7-i7
zhr7~UdE5U#lRO&#>QhoyCers>S!9{tX`>I%`|=mfz240NN@>RygKee!kOB*NxPMk4
zdS~_L{_f^s2Y|DCKUU<O-b&yA&HRHI6!-IcwFwluJmL5J=My#Im!sVzUBc>>>BjJ*
z2vj4v493Cs)5Xa%L$V!)edEPLTmJ-b|9$j<eo@J37^uVmNte;`Kb<l_zI=6<2r36w
z!)ii5k8$ZKcY9e{VT|Us45x0aS7n0$2zIM4?GCN5?JE#o$>@^p*saJvLOk01g}*Ev
zS9OR1ySG6ROAMCrGb!}nw2j8TVfE|%)urN5CV=_4)cS`$(i&RDMp=iZNxH;ZN94rm
zmvNTg3H|e+rBVX@nEO{R4)K$0Aeu(#7rQPV(P~<#ZRnEP@-P;1r?U=65=vIBp~*P8
z4IH+moxT^5Et&&{q>Sbthn|akxl9K3g8S9iEle_6q=FBD0Euq6-IFsT_PmRoXf6qj
zX}5Utnkaa=v9rknwdL=QBP9kZ$n^F|e2Xt&mY9-~GNMgt{$%9eWJ`Of@!x$`hj6hy
z!ZK$(VxBF&?9Hs23>M$xUyeL6Y&5!OwDALF4IMHONV4}lw@4e)saqHl$F_M&xd!Ma
zP3iN@!mUMnfWbk_f_GR-!0pFxF}0=bHQlx$$15DBH!cJGI2h4K{XKg?D1q}o>X{{w
z1lZ8Yjzus8gvsuzYFQ$KWIkh6hIwBo3UIfd%H#!c1)_pFuuPuge5S+b+~`C$37*v?
zjsLp$u6UJ$R`h(5&fyVmcjp+1o^A9kM+(6+G2hT-<^y)BJb~)nW!j~&k&&SN;Pily
ziD@VKg%2}1Gz<0i&(I?#T>ogzu<KgfSsc#fv_Bn3meA88eR0O3?nr(R4CxQQkrB%8
z%xcMt>Ecn3+YtR#h~p{0jJO^|s>R?wJyIf&q%%kvs^!TYeK<&XvRmdn0zW5>{~w#C
zPWHbh^7jK4wN(Y@-c0#>sNW$ar7uBXY?kXsK$Bp2hAxhCpV)LidY<<9^p49v)4{(1
zsP39&eOVaM7p}!F1JDZdYAcP(@i0!>SXdN}{p|2u7QSXxVPzQ5t)yYL69(4Rkh^iX
z<W|tufcVdv=-o-3pMe5JWmlF&Y*s`RL5>7{XReiKUQG9uw0TqFk#r<7dpV=Bd%*fi
z%y7bJ6Aq<akihY+QN$bL7{7--mXL$s_>ce|U^IIFueG(c4zK%y*Jv7m%tcO2QwA|a
z6V(5uEly4fnv8$keHx}9yRgQQh3JjWu%YMS)HwjNB4;&+9@1c5ht1Dj(|AQI4x1e@
zv&8h-IPl|lp?_|E09<qn?EwEREbr-{gnyBbfqm;aN1boMA^b8xc)ThQCG)#Mu3J==
zh18Q&D4{OW`(|PJ-}-b)iI;KsS(m88)#b3gx9J)UW}c}t8Ty4j7%lk{+p{Jcx8e5^
zU;ZzTgr_D2`qug$wx*dR>v^G^(V=Q8$|WXIEhEEZ=*Q{~bIteK4vP`&wa@)G#8a;;
z^Idxv3uCfe6aVq%6mWI`9p5ovaS<+a4x@A<@l05vD8^yW^oYzs@zCirrEmdR_w3*Q
z9XaWf0|7t^l6no0v_`oqqwDhIOP|XcsICh_9-#Y1v<;4a3ySoQt6U#r+T=}K3z0TN
zVc8hacj8sJAtvaVOO>2TFgU^fSI&MoJmcP|Q4QlHWOYrol5%2qm+04}^%-=qY@^ia
z^4&Vk!)yhxcR2(Y0V7;8V1&)zrH0W6_z!5i`F;ja_eb(cLvgk<fl~OOLH=dyWI>I(
zRx%Fr%U_?7xVvRB%LK`(b+D~}`M|6SkU9O_JHytit<;CV|E|}VNzd%ODsFMch}FPT
zz<hgEqeC#*AtgPsT^SKfpS8*Kmx<{LH&nzkV>ubEZ#)d60kUfU#5wbAt2weg_-#7K
zU*vk{`|l~-wMj_=Oj4*b1ExbiGaW2YW^~j~c@{C6cL95hJMB^6vkdvRY&3l0iWiX%
z@*QIClZ@DMdkpaNXyLYyeP<K!qvQZWOpAoQCpj>F8anorC2%CAK-B^))%GM%f8q}>
zxNw5gYFo6grF23hY`7KiKSNF_-{`Qs4u1m{v;kR%5n10cAv9n>ngBtQ<s2`lz@ai$
zM~lP5_>Op?M1aZRL?iC|8j{-}c4@kOSRIP@<?kS+jBh^L=_qa*qm%gWW~MA;C>2-E
z@770g4i5-8+bT&OksO|H=e{s`pc3}7^YxMn?Ii*OMF7UoaS$!vHo<!=M0{td#~z15
zDT<BX8{P&$7y<OC0}eWYe|JM2utNKccadt^^>_8x>V+A;SX(>YwS<qn?-a@u4*v#f
zBY+0&tKmz~oz=D}K`uVeE*BcL+xx1PK}n#z7PR2+JLiroM1)O2v|dAwL}VgAHN*xo
zg#mtmywBeN8vRJOz(;|Y+UuNRHs?&0sGr90^)-FkG7!o^tP$vonkfMo&VzL*j?DZn
zac+FT1djht639DFZ7QEz*RA{SYf1XF?_?#l2@DHAb)w#`&~J|K9w?MxxTG;2Y5D<J
zy{q5n470)X^-#-FiKyRnJv7B{zse_~OK?R^sdS4uOoY6;OY&iC7_`*e?);qQlqi=$
zDEO{X>@N|}Wc|XG^89%T#|&CMRUOfQT_eVkA3BSS?qP?P{xrn_O(A*dZVEWhu}rcy
z3~FeGKuj*wtmMs_DD}P4-x`Bhy|Tg+`<&P6R6c9JuNZ$6`{Yl%bCKr!MrXRC7JtZ{
z38VM>QJXm>z;F#ZMxua_Xqs8T8Y6E2j#{pvFk=_sIbgiOKc(r6$|{rc?+`=V2k6pn
zQb69vGq+*1kDq~H&ox=#t%oWeulxM`=E^}hn5hD=h!9|Q1GRTCg=E$aPeXk_(#>$%
z`8}`eo!_Hp)35hMXH<8{_vG^8IzQutIa1>KZMcIZOf5c&p{-*fF%+HzLX6Sc;cf=N
zrz+p|Xi>lsaAe`wJ&Govbl#|*fau-d=v05m!-|d;e8WKh@^GK&)60faXuB2*PN(2z
zuNTu}+yQnu(#NYxv-)*MbJ{%UQQvrmc;Dy+y?4NJO2{9g^s9M#sydyysbkTwrN+2^
z)Q88>up&wjrt>iN^nYN~tQZ2)3FMgDwD)7{RpPXmAyDmvFOfzh{`%wud@cMvlrIQY
zdh(A*4fV6=(O*J-@5cbI3vq|nkOzL(+e)-o80O+={NpwB#<T*2-)Xh&*D^TSV;=8=
zr6J&3%uX5_%4cd9JB@vNVS<6@I7h6mWlXe|CVp9mIW8=8V1dBHKt7zbD7KI!Ox(lA
zAlv3wIM#ALdVgANFh^csB^d-jbhc!CM+tspwG%GBN=$U%DIhqs5xQ{2TNv$9Q&dx=
z<Bh2e`$pKh6ok_AOaZF`bJOyFvz<|Cv_J9a5~+X&(=IVX*mKFZk{-Dh1SO~}Od1B}
z``QC9Gmi??Jy^gS0GjQk_nUuXezh`SG4yD2o)LhQ?S=sxw$Ye<AGgEWnGqG^f8@vC
zOr1-T(tdbB_K$FuRPjYe=JO{%;i>*<R2Qts$#Pv$-W)d%Hh+w-WytwGLQ>WXgOtVx
z+!Nk-J6qZK=ZDa{lI5#btWmgn90~odCv06Y@=n*p=9|F%PV;P1)y)uym9R@k=M!Ld
z#OP&z2scV+N=fCnPn91AO}<c|vfNh2e!90kJS@NPYlgzPe=ADw)pk0oA>*(Yo6hTi
zQI0?5ZtZ$C-a)8&X9I1+OIrhb1xz!$k2Aqm1D%a2lXMV@MzJ69a*wwBuW0hR4Ek?h
zA1f(aw7;f<cw^VinuK9z0MaCMo&8^(L3oVq$2}CHvAicQ3FZrDe<e3e?ef>3TG{Fk
zCY>WWfu?UpAN*67cK>jy{r<chH4l)#-{a}mw5%u@m_*eT?X&^Lpvf>@HaJO9@xH*g
zT^<csirp4TBxt20s3MF+5zzm9iqp=8TJ~vQrqy=3PCW<C=1uGEpVjT4vs4;SV4@KH
zV9*I@rxs{Gl$MsBuRm*d9(TVN3CUS;!!~|0ZoWF_Fzjb(Jzb*1rD|gGtM+6eVdmyk
zrt+&WU&FSn-gQ&|Cz-9hv!G?$ksMp%i_6Ir{<=|)Bp>a;@xpcWv!n(R<Md}#c@9sw
z2-*_cMy*oh&Ki{lLC260pw<ML8(abl!Lx)>u)*n%__{A20S<}9E|2M<kh7EZ7}wkX
zZr@_C9udo<W60v%&OVGJuA~XPhjNhNyrSFLm?V7HO|*pmj!LdbUp#4j0vv=-z(Md-
zJ8Rm%%Q%HX2#1QQGmgh^U$W_5wuoY3=(*IR{?&);NVfC1{M67_mYH~aQ3q3-zf@6d
zB#XU?Fe0Y-`$0-he|2rxyU>Fx&DYNNvdx6Mr*NogVMmLl*#3rExAp*;tpgf&Jr1T+
zfns_}Vpid^q8CBo`R|X<Ut>SMN;_-BRB}$S?hZ41g{2**c#}W!S^)ktK@AmI(F(}Z
z4>^!4YZ&gZL`7l<e{NSc8H2+oM5hQpP+tfl0S}KTkS*SeF7qreCq@e}INfXj3Wtl(
zIy{V~dk?T&;ex~(CZ+`~L4!Edm75EH{En7C)2WD=Xx*p;xJ<+JPyjDq%<7?Rc0(9Y
z1qhthvI6Y*jDPa2>L~*Zuf0FeAwm-szH|u(vLm8Pj!i*GD3}PFmXzNBYedug3wB|l
zM5zB1tj(#A>m!GN;K*=t&+;Q|7T1+f*NiPL>R0Rr<63)htAo|1IF#e~3VRWR$;C;m
zC9K|QSR7);p3>$^jJQ22{5~)AJQXUoLep(y-0&BjiK4Caf$&|&2M}e8iDyRRUhZPZ
z$<`N=Q1?k;W=$>)?ufHynaCH#?ok(<&=LzlENy;^oZrT*kO@l~A*~iz@OfB(EC2Kr
zvX^Yn(rZIiQNWm@V9O^>Q6<3*R%H={uQc6r5&oA-wM?<$<LbW^wGptZbWh}NGWynW
z%?TjC80!Gj9;2=8PFe)~)AyWqv*8YE8-D>e0ph(`{Tlc9^Apf>Y>H;?KA~^X77sT7
z@uvL&P*mDXHo-XT#rMjC2(nk^R#PH`r(Hk4qxL7mF{e$bgcuRb?ntanqBH46jBuz#
zX|g=e+~ZikxycH^AIOd%zzQl8>rf3`)u#H^qRi`3{7CS_Z;LQc2VHn4GV%6EfFBb*
z_vx>tML$8e1G0ZMK>8V`!`lzN4v#w>qhh$c((^tjjQa;ge7Jt@8s1rBR5%&jpF)<4
zeY$;y8hB7#Md9|IptRW5Sra^NY&fYadO!WM%p~?bWl{j;XT~CTa3ufhBt-%HN#6v2
zPOK!XbwK{0MhsA@|2`>uMC8IPE&~-WWWjvP%MeFOkI6yXNDJ43;CO_N*JApaM?P+p
zZv+K-7L0}{K+KS6bb)zGPGMp4F%Jfjt)ZSy;!WkhT^R`<v{%|x=QGrGb0uxfi1`?E
zXc-i9N9798oW%`@P|+Q{y^Dfh_Fm#}tccNiRVW9s%RGA=9PkOaWA2;&0re9&dd7WL
z>0k~jGtgW;#D*@-8!2*5Fq(079nY##)MGYo?4&Fji2}0ya)&2L9i2fKg>lNASa#ck
zIFcBvyp<P0!0jKn7RigHLH|T$Rkp-ROP>i7H?z<riwWnRBjKWVX?SG+Q}|GPKV^#T
zn*|<aMm!wGrx47qwHaHSgjQ&C`mQl?+GNQ2Isv;><q!hFhgt3Fx-g7NIm*f59&PTn
z!zs1h{M$;9rT;6h{=4kAad{n}<(D{ajCN5(8W2!M8ml62B2i3o2m?#BDyJOi>2PUJ
z7rejQn4BH_QnxvQppbZ2=irfaI)TrKzCDIJ&$6ap0~byHG;Ug}J`>vbsO+j+B<{;!
zjfr?mbSx?bxql?k;X7Y*N5j<Cq<u0+u4b{;m#zmhY)tyj1jz*9$@0n#O5prQr&vXg
z<Y(=tBb&;g^su{;t{6U=Q}JeF4w5{}U!pM0iDMl(OqDaw9IFn65|V$ql&p_`ny8?o
zN9lu`^S^>Dfl<FwBpKJ*E|4E`S}VqsQd4?IZ7nBVq9!u+LQ>2j-w#J-+GQ~jx!A}P
znBM<o!6c0R1ct`_`ZX|jZJTk*mAPG4!nEpqwQ0HYCN>ur&mdg=Q@D%aF)(b7bu`=U
zjA9w;*aixPuOl)tq+18ChsOhUmwDRc2!L4A?OHoJr>`M{%aLb#mv_IA;!K!THBnph
z`JJ=fO9soL+^=65pk5G5r*MuJDl_RnfPZG)D>8i4BS24fAa+e~53vC3Uo$UW19a$*
z|HPs+iO8nrEfq$)rt0v)rZdw2)yJBB{sl3TmsWAW#uqd8plo;|v%=N*_~Az1KUxGQ
z%=bH1FndU7hc(&lvvdxEPw}Qm)c|3Uf;~d)UGrO!S^Ywr0B7T@<yc&%-a>Xlu^+RH
z<;<O5a4XaWGrvTA=xd~nvLAgCh|NGHi$NDHTFxA#|F=Xrt5RE#j{o6@FC(Psa*}5&
zAA<|;`mrT$1sOh$TE0T%h41OJG-49)@K33ny1MB?XNi+mEb?DA!*jHd$61jWDpD%f
zw3szx%k$o_kiOLYpjtaxmrymUq%>9%RqZ`m8_$OU&35H*v}jc(oCz0QS&!1F-%oLV
z8e$qAE6DfyKTE)6bD;rc>|<oVgG^)f65y<O5T9N?-6o*yx%w?kuK)&z2FW!VS$Rr|
z>oIi387VN7BYZHT^&t6wRg86+E|^lj`#Ebd5jbVrz?lrWEW%elaTVaPQar3s_EaP4
zOIj)vN^8EQntl0NSmWO`-@r=lqd4=7xb2cxcH&#NACL0*W8)OAw2Dc?t*q}>t!qSj
z(UwZvKP5g-OX%&}QoY)S4w3GjR=j!tTEAch=FCAr(9NvHyPUt8Hh#}8_tV_&d5s2l
z<gmaXJIB4FZhJ1}KBK%INxtKgv^;(7XZ!6A??2o#y4IeGH@y^nu%q5Pjnz^c)1?os
zzWQ;q(G*v$rh>}>&d2HvB4u_nI%)U25UL$}M{#HKjdz-icGDI%s;e{|a|i%H4o@$Z
zeI8~c#8cXWr<j>vyO8`6%*}Zl;$Wa{Uz}L7Pe|#k!1>7WDJE}r>Y!5(Dpl}-UpV4d
zjS(=#J^J~%;gL=g=V!+DpU-~)Y=zI@^3MJd)u1`;05Tj?9Di;87gJMHbOuRE6dyjy
zUK#}I;b#E6OR|><uqP7axj3=yjwe)tE;7?3IOQAe#3<P5&-;t9>lM_D>NNwtV%=&Q
zLb-B!-Lqu3YExkmg#KJa?=5C$U)nwOXVSKd!v$&BKsu11q__uS{GJvbRs__EuVw)9
zUcc(-H**Dpl@#gHn)Od}nFO`AJ^cT}f(_-=t#pAt+)$T^5}?tsLoh;t8I-`Sy+^}O
zF*1KK$OVb7wXN+LbB8~KNyHaRB|tB(sTU7-Xs*)=O-D4ilNwA7l?d$+&)X3J>->21
zO<E1}YC9!1xJfP$gR8-9L;Z4v?T{qmm%7M(r%57$UqRm7KY%tUQXXpw%t+~4hfpo-
zdjmYCEiWC=0n)azu8h&z*C0Q=Km<jM*d_pp#g|6Q#87y2gU>-U`xY~>hK2v#Z*7c%
zwr_0dp*0MuO>}m0_&=rUnSO`gkLZw>&_2~B(tf5!rn6v`9DSaC9$Txjk`?EM%OY2=
z+C$gXg)1wRjZ}bSkB+2@u{-GfRTRs<#FC)V!Z{*2M~EiN-4Ny8I~r3YQK()nmC>#+
z71@V;W1Q3*44<OwOxBj6g2sGin7OL)6r6TW$j4nb2!eRiG?nMh59#}dN|M2ba17K{
zT_YyEAa!(0Q<z_HoPrfeFUtH*l_+sp^l8VdIvSdaW*dfrj@~3hu>Fwde;GE8-!wVD
zMp7y(@>H)vkyzlVz;@_j(PGY(jeoJs!e~Zpy|Z!A%hY=2u{0jSm~+{As)1?Mn-bTN
zyy@;-#h>I!x$AhC4v0QhnLFZww84{UrTHx>j1~twKL4xtHTc0^<RhnXv8pNq9H|z0
zTTKT0ayawjxoWas{kxQ3ZTg?TNOJB^QWSdB*m)ay?*8(#bO|egL*V)pJGoX}-DVo=
zZddFOAj22fm~ko5kip8w=kyLx#ya;;+5}b?=MnY<?JHE#^D5qhr(0#Quf|^=tP$b(
zi9wn$<{DRY?Pc@mVeRM#&jfd9Z@;aH>J@SNE?3f~=ZP|AwsNxk`0CCJ#C4u-1IZO@
zO1e#)U!IYs|Fx$oRf4t`I6PvxX8#Q_mZC5HYfw?A(<DQj@%3<Z=Bx%xIg&@U4`2kq
z4XEzJg?d!``JUzm^5<*^c1Q}Kuxvw-+msw@HRh+<P;c*S$%Xi}jXC~LRfNQL0i4+c
zApwAT)b?xMw6EtAO5aJ9d>p)YR#5{Fqwbg$1eA3vMS@xogtq>Q5jrF2&O6(n*zb3j
z-7jLipqL`;%?8enu$SzgC>!K2o%bkXo=u!vUT3smb<>67=yRWB>q(IjXrlbO_r9My
z>>@F^lvG7Bh#L-|Bcc}qB^E3phe7NO_!1;%L713eQi@y!5XJuYNRboIrxCgYTrsrP
z^l84P82;ah)ZZCBAHgUCW+e9_{CGM=Yz<Tm{s36?efrBUdWCNh=LRAUf&JKpjVFHc
z5+at>UF-vrAO~DIkb(q?2K)+&v|1xrkdUSZ^FJpzN#e&?qiLb(5@o@}z2RtKe3KZ0
zt?D1b|KshagGG83v0S^@2G68RY*O*t91OAo=OP*Hc%n=O(}A>n^;>Y$RTu1{^33fr
ze4p(u#sCPqDO=H2dsX(UuHu+#2<{v#i?Kj(AGnt3qGz(0vVhg&NINiqO&{KZa8oTD
zAnGNDpPJzdA(|rvwlMdVMI6Ru$K!V!bM4rr5?O~HzR<pr?J2D@;Ex!_GRt04d(~6=
zabA&+F~+^?!-(!y+oRXuW|~ul{nYxa$kFSMQYJadOkf;PY38Y)jp{h^N2cI7bVMFD
zS!1#DWwiK_PFl)C8`axrHU0v4h$)i1<aDI1{;JHTw%olz#QGtrqS$h{9>{+fRjJ^c
zZD4oW_IK#r(r3Xkh}pwi%gpVNNWZ0=;L0F@&k1;b5c#17X_01Pla-X&N(yo%-;XKz
zDeEPAa{%mKzFg>)b}ITj$yOLJ*rs4$fL4l}_j+*9u)4t;>f4oGwI(nBr3ikCFMiU-
zMG2^dZ}t5;h;70S?kpOxRt<*=fD-BYX@uBplw4_D9Z4Z~>q2%-sZt@97OgG81btq<
z0NNb2iC&09+Q_Jb{tG)jIU{mx6Ke1~LHVa2OhI?lI2T_+HR@%)?EAd1ee;Tsk3L-|
zev%H`k!aCZJ?l^{wf{!s`XA_&Zl+}=rPpXKBeqh<=8s?NN7kXF|23kL0?k59&1J8c
z!xPWD<zs3vhU{Nvn#UgkRuURXlfH`^s$D`oF{6g#vHUpY5!rtCF1}M3S0noRX{=62
z94wxm2MeTq2W$V)iJ^;z>>pJddmz;)Ma3+Vtm_x1G3O4yFPC<uW2aUFcEHyzKfLYL
zb$!JrX^UZ8{9l31x@|Anf`A`|ZCfL04B^U`zg7V+ZZOyXW|2`~x>3(X3s;Fv2wN92
zod0O9EgtbmoNo6x-1}4daWwqTpVJ%R(UT$rjb>|&Dc#yl9s73sg(?uGb?k~Ac+l!h
z0rH5Li=(#-tB|vwzO=Kc=`=(}@_GEH4$44P@n|p2RF3y;X&D99u_N}1^s*G8WDn*u
zs+ShyZZx+3+8m1B7&T6>xC=1hQ3C>Wis8Zi8lr@{@Rn;?$!$ha`R?pV##NgUO!I47
zRmZmw&0LHa^|PqZUjw><u>#bM8-|c$k@>s*5V&dz4<ZzH`JFQ_MZZ)^84H^>p1*Lx
zO$L4|eH<G$V}IBDDluW_-jsto`|@I&gOEP?t@3!?9+dC7{(C+@Df+%XlMS`mvZm<*
ziByKaTz)!hY?}%@TZ_D%H4*hZhcna9Vv>HGB{zQ(ov+(9ENqu?0N|}-QVby!2W=@r
z${rtWv<zgl!7;T}7qjU$Ic*1jOznotdd}ne1;K^HTxAtUOB1lam8YqfedRWd&=Xdn
z&^Dd|4hrmxqvD>*K$l}`Vnj&CQlWTFR0}JdQX{vM!rfJWPS~p1XZl@YIP(n0UpZuD
z7;0EjY`3-QJ~?9d`tqd-4G2}qks&8#4twQ%xGrjEqjRGe-6O&PsU3~SQ(oiz;Lqqh
z&h4mp-WGyH*hu1Ev=w*z2W^ut|Kt#Cg7gcQq#c>u@Hh+dZ0Ai1a6Gp#r<ZVYOzU%m
z;czqjC8MAy_D<Yf+?ID}sT}o4WL0EsZe33s@JO#i0qG@qQ(KmhnV?ZX@F`>LpQSw$
zS^T4dTM#||zAezZx~WMwSH;-7USe$qm;g)A#slWVA|{p+qDML^3Q2)tR&SE@Q>t_&
zwZDw&JkhpHy;h|s!yDC&u(()yLUCJN@6CXsC2kd6-}<{i|5~I~^t+zQkxy{|&v%i*
zR;6<-pK~oykAMETbkPf?20hb}<zjWr$!R`pwEz43edUj~!`!Ll=9)5F2n*pw0MqM6
zwq|l2b@+yL%s8wrCoBkL*16#Tc^}6YeHa02D_%E~J`$hWD2Hv^#w<|5S?X=a1rU~2
zVc%sL6L`h#j|h)sUYV4M#y9jzxkonqf#nRJuandH$-{mU)jzcud9f9x;@skJ?rDzV
zb!04>w>YeHYcf00i{0%H{6Z*2uOYNC{^DnZq;5*XWYhWiIcH@d6C~_@-0Vl7C`oFL
ztO}f#m0V^yISI%uk*MTjy_d|zcp+>rfDTX%geja|t1K)!(M!WR%lF#esU-br2CVco
z&{)*!A}q;CmQ8!_Ec;;$>PaLInNF>iNYl0p`!pW9gO<DhgpifRI#w!R&e>TyC!AYx
zzA1&^MSU9?mR?>hgKMQ6{V@x=gv)TH>3kC#)ms>5=!_*jZeraqrf^{&n`^z?_4|VR
zKZX3@{3Ni_f%_C{qM<Ftmp%*`s4RV~G#eG_HGWgFKFv4`7u(6XWZZol&)H`ZyBJND
zZ|+ay4o#@O|KTn_7#PeYGP>wmgi<<rv(Uv_CLCI>o7lAQLv(?Qs35zdd@b#Oa!i(W
zvTeEc3v<q|@K!ZeI^`D9?A8l!_;MmFzq*ZXHM;rwh|_{5Y=PS`cAwU;WYN2XYTEuV
z!%D|anM+00>$bVL(tWBSBByq;v9N*&87trOz>DIuE3VaAuEpU>YydHT7z$LZb$?4d
zxEax7&HET0Wl^RF>yR;MKS=*^Uw97t%UPMw%mU-4vrP_(D)L+u?@;ea;tZ1?in*te
zM7(|bcGaMzww8E$SC~D&pkM*tj8I1wLwl-hA(`pk3d}gqE6Jr+JJKbtYmf24=g-tl
z-$NZS3(@2L=Q8->*M}2Td+JX%a(tPZ?1Gl%1!(3gp}87y`QBQGC<PTgA`B}=gpZq>
zTjwbPSy{wK7iEz6E%TBZcgDz+`5jCX^>$PQ*RRuF9fH2er8tBsK4qUIs@2xoYG;x~
zu)6zz-?#4me!G0v=C)3$A=N^TK8sbW><wxtnddXh2)AGHqyIY`XrIW9h}QbE5tMKl
z^U$Z!I5H1KfRuwM=(1mmecPKz=AmhEP1>m&ekq$z0AGz*R6p7H6#u&u#<@Q@qEX3Q
zH}ZisfF}&j(T$wr;aGR%0n1yqcWE$$9pNU!^LsYAr>$DP@*Ibx&vb(}_+=A&7=xT`
z=miKVW}P-)nPT9$yAsX9vRR{3=-=e%h1JqcPUG9e3Ot*Gda=~WbZNw!hQKK9FwGno
z{(`%LGAZ%F2`NKy&3-U`-rd6fQ8GH!DeoM0eDPI7W|(}0xW_aF1;y&zwMA)v`#8;O
ztta1LWaob_OFAWUGoppp&vXh#*+oX>4v0+Mi#*Lo=^XoH|2!UV@~Gobyhv@14U669
zf|YuByNU-Rn1&Fr<fNxJ@|d|Yyi=iivSke6&%#W{YI|n0-qZ;nfN#t!+kv-=-`DER
zT;!~9QLkCN3flPevVmup&POl9%+mLb#a?g1I;(2RwR-DkIj6?_y5~($zk4LkshaE5
zpFlEA7tGw(TnKyI*D{F8#^^DFuFGrn_GA0<2m)d+0%q-t9!rfO1S;Yx@fU1$YT*qF
zt~+xK$drq4dY}9G*1BWLz~_8*>s9iY%JWk>-TIJUxhNR_UDA#EonaT(E?bOZ?X~W;
zf(;ls)u1Y>uoP^ZTJ{Um<$}XSYuV1~ruaDa&9-u?kRIiX+tXDt6&y912MxV(zIkDF
zySv^D)A7Wz=MS}9t1%ZreJ!&Ohi@(@qIy!z3om=5qSfBmv$#1O3lLAgH)$`GbU1z<
zWbwUDO1hXWG|&m$zUxKMEBO&a(wTl-&=VgaQv)~JD8p@bS!N)>Ltg9%nlf~0F^^cg
zy7GQeLb?NVE7C0PrLGNfq)Sy-JWOBrmZE2mWnA5rO_#I{8VtQle}P^?KXHIeKf}Ce
zE?Jf+X23mZFJ7%~M>-i-wFg&4M@J7mh<pfL!+m;M|HZ<Bal&5agc^k8-RI#=%yclg
zC{tS2D_jv!eJEvOS5z7FNF0dos~aqp@y`Qdsp0|t?oH-h%eF9b#!K`X!`<fA*{7v`
z-fL8$)OE6+@;?qshZ?B*nNkF2vfI|sbC7q{4mAO+<hIL%AfT(i+?sn)$!(Kw&KzuT
zJ+pmn;&R+Ky!$p5HDUlBGoOWix-`N-x6vXZb@|5Brxd!m6{nhdHu8O^GtH=IeX6YS
znzH+uT?E;Pf$Lv{L`cyv73|vrtl9v3%r^lZ823?$OFS%{XIlIqwhP;8rh-FJx&9Vv
z>VP)3Q9<cj<Mri>{&F;4h@PHaELfs}FYIo-tKhd;C5)3{PY&z-{D+)!GA<%(MBDAv
z34nH~0r`&a%LG!}(W5uNKGyl_JiB2@zt^`W%%_E)xH#D2{cv^%@ZU0}8H_4DE$FdR
zjS@`}l$t}1QsC=C92qa&*dJ7B_}pO8#ux6XoL2jh>AlVy$G45=c*dQC?zPW?g490|
zV!g1Fcygo2k}ng)Ec?LCWhm_z5>h71fyk+@)9B2clqz206VimYsDO-A8IxvT|LSrp
z=-)q^SGawV7<(oNzcs-CH@i`wV3%Vfg7!qk>(=1?GVhVN4PmhLek#$gsX*)a?{T1v
zMGZflRMw=@$it#}h=I@i+S9}8YyFmI@qgLclz#DtmC;YP&r7~ODk5Nt9R1<cD7!2U
zGnC7)V^EgMwDO?ZtpYWUySuGz#C3Zb3NsRBYD_&lA6gS`Te_K;>S=dI{AKe>yZB@F
zWYz<WWq|tgF{kuX`+=eQ9lu~_Lqpj-Nv14qXwAun&a9_w``gd-pX7Q=<>$Ao?X1C{
z-}V0ZD?p4^Nad8LVixaXfgSwPvwc6E<2bT$L%aFU9|S0Au<N+*jCtg~uFyx;XMeWp
zA(e3gnH^XGi<<Ii+}d?lyHSM0&0&w_g2YNSS#SCFUaLnZcY3qdmMqI7KAh{cC-1#1
zyFdkd@j2Sk=Q!_@IZ3zctyaa{4L}E~6nsV}wQ9!OwQ!|+cc}}Jmvu!CtxKq6pRJGI
zc<#w86l~2=Gc{uP|M7^gF#F?FFp3K%f0unb1;a-WN=%ipcsq@C?}V}7|Dw7pK3&ly
zFpV41ky_B(sv+8^cPtwV)NptmqVhb5Y62#<?pTD>o0KEUR*_O@{4Tr3qS~|eaq<$H
zFxVZEK~PV;@LoGkp=D%`Ofa(hQoBnT5*IkiwZ~Wz8M{BlH8e$!@UP;798(&LHrFEv
zUVQsmIAUiv)m78|Xt#|yMLyPx1fGMmcKT#zH{6ddgFV?uj1GeYuQ3YAgC8tA)sDof
ztE-LQcYmF_K`aKU-ypj7lJ!~;8Sm2qOS;e<>Bq}n=*M0lM!6fZ8koBJBi1^Lyp2&6
zB-mRqKQi}p=DpyieyXa+O5>3M&A~uUnX~`&zF|>9YD^~o)65AO(&mrNhOBccLn?b!
z(V<`ThyA)F(a$e5Z@S2Gtee>x_XjpaW@}TmJ4`x?cFN2iI@gYCC=K#idI{ZmO^Ofa
z51L6tNoVvjORihH=O(*Efj=z6>txA+3)b6>a7@H889%n?(xx)SsQ&&Vckj*!Uue%p
zH{zpYP;2nn2%@*FOlPogLf++N)u)O&N9ymFx>P;wQfol)^07%!?Vp~K^w(`X#i$?G
zX+lI^HB-|fdYTUtNfYjCyqcrXy16B(X{F99RW4(qZVNBo))DJBlR;uu?Mgi@jY7mQ
zxe6P1t!_4{@JhT<Wz^`Afg3Ler?AiYQmvaVW=`|9cWIz??eY6sE>{(2#Hk9oPU0Dg
zC4ZFuell{sd4ORpl-squ>LwlccMO+G?wD==h5D`YQ<AqI@MU0vRs8Q-BM;MCnwnUm
z<x;;V=-XR&CN^s@rHAg6U~(y6*MD2|frf;B6ceYdZD`Q$Y5&}b%<dAM*FveZ$6pJp
zw^x4Rd}t<HN(9WuPKGg;EVm=q%fGFM`ptVOQ`V|uDqe=0gDBUlYfxgT1e~Fd_V04<
zm)yBj$GR<Fo(~R`vI%m14ZGN`JvS&~nAc=WdY};Z@1VIj{FK+st9Y~C(%5vY;t-Eh
z{vYQ6ErW;vO&Cl2%{wZPj5>^w@w|Mg_?#%ka@^X}bKxmIe$i~8HzDKsLYK((K@38N
zRO+o`<Fz4+W(YXt;!ZAvAV>;E%S<FLku2$wClQo@klhFcW4$1f4@3yT_vQpsTV6*i
zE%w6t^kBD+DhEdRG{ABkJQu&yo#v?z=Ugqr{i1)^Rzq~G(vYE@md=y>iftSuDf*Mt
z`XNoO5pszb;1pmZeFV3(_E$R+HSzXdlB#D!tpq&#>ehEGR!hmC&T8^5b|_`&44i6Q
zr5c-36dMxF=NEjGDZI~gP?V8*9dJ>7uJU6{F2gicJBxZjquHH<@IG*}3yaC?u|}@4
z+r~k(l(@|7hnpmvw_Z9w-Y<N1DJ8<_PwvjpN~<Vc8+oNuev#rUHn}J#w~)avqv0Q*
zP8)T>3~rfo)=Cfg+38pk3H7fkT5e|gFyZwLqnduHc(1yd<sHBaJ%6K+6@6g`UeuBN
zW*3G*Nh&2Ybs52BGga*@z25GjsXHyK*e$LCQ76rS@ZH0In40o=jdr<5wu<V)l8#3!
zh;MSf`IHu47f=n(+nXxfO)THI+y;+sK}=1co{H0vrp>?j8XIS?T^94D7QQUA1_uY@
zfw2l7WZw`VWd*6{ml$Q=0|pD>7qwGM<|<;}PwQ2=;3pie$2Ys$wqV0|bRQVRs_qoB
za&5vTzB(MjhQ_(>j`d`hIo5>XL26SxVe9R>Gpm1eK>ll=tix`d50N0}MdqQ;jE*(j
z#!=PBP`3Q>M!8At6wk1yJ7nL<rfr(fy@c%7wuq;bWtb6nazTYtwK};5-1n@0i+z1E
z1j)1FcgQMzYp5y+pRfNaO#sb&v?Bxt#<0>s(GeC0ZeF4yOt{{@N(x1oXq@To`aJu!
zOzZLfou6%pZtVArHdeYQZ;Lw~oc6}+(zsK@H$FSP9)=td&JRNKa^8vK%MXw+#Tt~?
z4)z#2Qv*g`nah?YY$GoJoCv)?UJl=6%$4aB2@xQ~+I}Yh>F*wESM%O_`Ec^GebMJW
zu=%rhN9H<J+mk8##{cRZLXFl|WwSsp1h97A_eetm2<fwJgG|hCbG2ZEQLsq1i%wYf
zS@{6_o<!zm+8SfxtE&y7vB2ulIh93t(x><pi5ork8ru=<+MRG;N}IE}`zcSNryuP2
z#-w?Frb@1<18bX3{%`Gtuy5?vgE_CQ!R~hZf>In)IicfB#YJ%012`|bfxYzXtjP1s
zP#7)<6H4}5@_V456ZE&cV#XUCnFa>*D0#_OP7jsq19!a%3{OtLX>@{z<9YIQM;j-b
zgI7I0U-`CEW+$Deu|?6T*79!~i)~PMbV>{R;}kJn6rgjzS9{D$<sM%&3eG==-}JMu
z!DlhsrEV?f^j{N+Yx9R=V#`9*SlBF`^AQ-d0_cr32AVe_$&AP9(>*OD(ppjw#3UV)
zRciHU-EfzgZba-)jW25RGqIOKiIVDbSA%3h?%yV4$bHQGgC}*Qw(E~AmJt#Ka_XDb
zvu@6HA(i%aWl&f`h52?-Los*611HC=@XLuCyV%)_xd=TQQ}SW;o=djo{Gp|{l`rS3
zOGiwRY(l}^Xj0POLZLl{HQUkVGhOD%Ke)P5c3Ts1wu+9k8$?7uvbwWpS28%}EtR{q
zc`VBx$v<DNwnOzYa5<8&LKY~yba^`)V{vM&4Zf7Edd0ly<@R!`y@?s0-Xa5kK-G8z
zPot0yEp;}E>&v#D2ZI_4sZtqJOQ6*+RFpptJSHsEq~@kxEZEL@$C_j+E^BC*8IarW
zl-)nh<8m@TX>4kTm4$T{4^WL_Lib*_WkQJ3cZ88XsR8nE^5Y$!(YMVEwv{1ls3$#(
zzH6UKr+4jXK!G*fR}?ZR_JiE^puOJl<##Gybni5+Tc<8wk8f?|)APN3lSH#^*B(of
zo^ng__0R*k<IZ5^p21dM+ufC@Idk(vi0D8d@%DbfvoG{|-2UOhUUdKSsOJ*$YSW@Q
zwLO#OZ07!({ik0PB4sy;i@gnvcc}k-(pNOa(9WP0ATIbPD-2t2Z;@D@a9G=`=kbb8
zbC@&ntXiG9ahP-|8!85wxr&U%wmJIXTOv?lLPd^<IOGLSmAXrGD77_s#rkcMn1&EM
zFdKwqng`t^rAl1?k>pfyOUVrdmy;Mn-NS}3pK|T>tQoOb#Nv0x^Et-YRrd=L28rvi
zbji$H9<r2Bx$SP%W%s}Fd5H&pxJ2~Ou0-+pN%=7Mu=n`%Pl-v;Abg8Xlkk*XFbD1=
zofdNQCB=$f^YL-RKkRuxRihllKVsbL1l?_LX6Z^qsFM*=<;*8c?1y(|y=k&irzZio
zLPvSzVRFTucBq*^jyaVx6%SE7ux`IfR~PS?&UdE-xv=hoC(oV*&tIFjw6TT0>=Xn^
zLVm7AEIzmG6ph@jMrs@zA$C~b4C1dvyEIN<7J;4=@kvF?FnEV;7fRaqpTD0N)nDT`
zIbu_BaS<N#&9KW5SvRYyPx(@YXL=?|)Rkn}8R)w!05y|GdI}z?(S;in^hiSX;}8|U
zlfz;w+~M=o=fAFR3hpCh8MomMWQ^Ot?j229;bf-0p<@QC%_PGXsP4$;jSUU_hMT$h
z$B-Q2iMl?=LC#~}KLP4#B<aE|+3L1x)8drL-JduTalLX(zk%ww!^Fc5OP2&-AI5_v
zD>VMtfHh>Ja`)qY(-97s9h2EfDDHzRhdBrxl5uigaecEXfI~LcJf~2HoR7!b>@(p|
zvh)>O+XSi}6PEiz{m6r>d{jr-%o3K{^0|m|>U!%_yC%a0{Ts5^m1Dg43WWjTX-hB|
zOqa-hN0`QR8OjH$^%*6-W`8z7qa}bw*W;k|u*6*6qp6YeE=-{q&;P7m<<={XU$6!H
z%(DnNG&1tlOAz6wfMdouzASsOQ0SIqsf$eEe>X1~!Er%FQGOBe`dE+UUUs@(YK%c5
zYn-xJl~DQCj@A2a#;5fm@1@u7XvUk*C;NYftGCK;q=?Xy1I${=^TNtJ{;L;I^96bV
z1gzoJZXW2RXuk&Vuclx)4$(JzH3sm0sp(&CaDV^A)JR|{3ja{t<)cDPX$4gntFqQZ
zGG6?G=4Ya@u5HA^C9u%L0@>z2#BT9LXWZJHSFpdss_nLzgBD^w3C&i?4Yv+UspNk?
z<)r<0klk6h612?L^U!7b)ysB{sxcHYH`S2JvNX^Q;sbAKD=6Bk>4kqYF`lF*O{e}s
zp?j=9B{Kc7UBvbj++VsuUK~=hlSFh++#X6vcaSW1`MrV2Ip}wnc{ra{s=~~+nG?@J
zIa2p5wJ~;QmWXUupg$X0W*^2;HB0ZQS#&<+CB%LWJ;OWqlO)Rq^;i7KNjmWE3aO~W
zp$)s0&G39qWjDXJzUCc&*?ax<oDqJM`ssVXB_lse;rn-q33aE1hg;q`7IqTo%^8>a
ztf=hCG3L6wP>!lL3s;Y{gFZOpq0%b3SF;{hMiKFgin3iB+4kC<g5Qa2{FZat6(WVM
zV^oEqvsE~vU@`5$)a!y~mK<y6f`N#%!Za@}4vo4c(QQs|I}E{#W!gT37ek1T>d){g
zz6*^tt_gR^spXA5@Ul>L<gQmtTjXukwf!LKFrn35y`WbK>ErZLD8i@N8(vauaJ*<2
zE!yv>4;djQA%!ew2YoXRTRdGTx_ku^8NV??erHOuZf@Vb;rwP4zWzgIF|Wvy*Dmai
z|L|?8izt;I(ja~L$kEo_c#!<T?crelT-fKm?Jemsb#08h4r|0i4&S{V32D;BK3R2q
z8#cq23K4yphj=_~H^{#B-G|)D&@zKt@U)b;Izw6oFf{xv{5up%Ug3f2xooJ@?lZeh
zbfip>H8UdKPpl2w>b&C3h(Q%y!|5#eS~EBAzo!rH${;`41Y@$ZAZ9n8D+O0l#jzBz
zbF<_6$=w{RRmT>`9N9x20%hPrM*{<)Ykcyau%gWoGauHu#`6U$mGtBKN^)tA=goZh
zi&LnQ;?_w0HGkp|i7fRqEzkz^N33rj&Fe(|(NN5mHmWPpE5-*i6!JE`{gnG5eWo$h
zVgS|b-hL8a{)IMU=I9TvzukZI48D4PvR{GTS=RIc!;p=geKVBk*lY{ebm6Rgff%%v
zLlKr4<zfX*%63gTIEghJp|{)cHCDuO>L4h@``WGAe=ZRV1d3Jfun{u06`vL;Qjugv
zH=NJ5=es-lSR6f}y3cDVhF{j%DZLmTLZ=u0NNz{`hi!h*`b^Y1c7EdLR1UqMbYMU7
zQyS-PVpG0krCbs;E=o+uDrYRG9lCZL8#9HOpVPi^0qzztZe7e!XBBxjsyEn%U-sDB
zg!{`yY)YtiaSr^|@xf@pC$JQ;`9=6}o@A0G(;rPFcD4$z8PN&8`C&nBk~E$K37a2x
zBC6MrvSS!!uXz#rXkbG}ll~bv*@}L;i;>HuKrqT6^}4K9?TB?ROjbXx(c6sV=EI1Z
z4mKku$b0A~9fF}4R`6XfqFXnfi)Ap)Qr|_jFwKz7gxOIMcUy%fa!gi(qGXwoL(2{W
zJCXmQ%lp%}RIR;fq6O9bo7t+yZZe`?%Qd}0#Oy#ak0PYmjO3enrE}pzl)ws^pkYG8
zewPLDb*fBe-fw7IBhrkQG;1>ZdjM;c{GywxqZq-HSyvssm_tqZmet$YXzg-qB|$^=
z-dSP9k^gDJA5EL`TE=(BjTANY<UELg=yPI(e$_!y)VRI}OJXXUqq-cH6FDQv`wu8V
zSLP~Das$N;^|<7HRmPZOnu>c9MLi<++?#@rHoMKQ-iaBWjvQ`ynBz@rI=6@JhjyJa
zc1?Gqe0cfJN=m85?%2XAo!ue>^wdwvtewAxbwb0CcoMW=TyyC)X)qm@UkIkON(+gk
z>3zC>l8hQXE5fxla|!8@nd%8&!wAIPc?|V2ZP*9pPgc6Vze8Go82KFiTU6~eEy!R0
z<aH<&{k_}XA8=djy_ab_BjS5pkL~6`!tHQW+d2>Uem1YGPV>m{s3>bVt*yx0&R>|7
zeDK~=^dRzz#r?G83e^?1e3DRKvip`kEoT}1|DN=Y0!)mo0<^H6zk#wGjTnvmpYssx
zsgr>95*Ms$V`DQ?w;)*ytCuo(k}FFKzL6=(IlQ**Bz_Avl~7STubXqao85)lk_Ukq
zO@D2CN!#I52>>~=nZPI+iS@d25If3xE#JDAl5XC<vA>LfJLz@B!}}Obo;JT9nJ4TP
z%YzT3{_X3c+1*G6X~YQHPMB3Jeuk3&9fc|24k9{4tH;aa{juS=Hf!S%D8O3^DO`~s
zU0C#kV#Mso51wDv11mRc3AIt#Q7+ti7I7(vV{+DD-tjw$1%{C*&bPIa)G)S+n-7&t
zu-wqm!L{-#ChJ0&B=6@8+-`mD{>*pRP>gbJ#Xamqtj1d?s)jwL5T+h$D#0IV?_7qH
zC0Syo;v#PJLB)l6Yd(s<vLS_^*%ev{Q?~Kq<e}3Y?`8Au>%Lb%XALWLLTKkrBL|`W
z{W+UOd<9%ewS5J06?w8Y&KHG|Uf>9vKif=CKp)9=TgSZWZ_+|#)KmHMIk*+D^tQZX
z&SagX`VZ#jg?g4Wb}bO|<8M=q;41DMp>2B-2~6)wBo*A?ZZs}%?=LBR`Q-IZs;Oyd
z>IT=26iWp~K?!PO=_Y~DBl-0}$#4iu>3i6igq>;sMPdhSt37NQA(2@^{XL=0hsaOt
z)01NXfo5cSkI#HroaDjgIG^4!XLMq>RMU%Siw1n~PXv_vw^T4VtaEU2s_p1NnDEa`
zQD1HY`x^>yxA~as;1c2S8{<r-PUZ<qu~wAY&v+?;WB@v59^}^Tu98sqvlcIA4_|#t
z-`r$W0)u;5bYogG>9<<@m~}NhHF0k)JzW?`m%wC^TL+>vw=CsGQ*2oQ=#Ou9>ec+M
z1P(!>kDcz^2810wJOoQleco#1(1cAYn4nD@r|S8XOI=Mp9C7{J<yA4N(|3-OGnis|
z&F0K59~if}e1Ev?{Ri+}-`L-7i@Q5x0)dUy58vI|cYOZuK}T~KBtXB|sO*Q4c8jvm
z@eP=8K<}e}NPcAC%3x7YwWc3e`Ve%<9M<%^t2vOF3pYQ-GG;|OHZipOZzgZ_^F_`Q
zOByQa1=lCU@T8ghAP+)Q&(7n`P=fVWxXxBl0YTjmE7i$_bqlHC8k4T@?#sZ#&@2R(
zpoW49xjopxL?T?7oDtIfBB(o2N99RGH?>Zebeck0j$O|0f{>4*e7pJvVP0C`4#CWi
zxl$ormst*xx6tn<-#YIylaoQmb}%OHdJMRx+~o@{W!~cF(awRe6JCUs;$sODdZ`r4
zDgkQIH!tGJgfxZU3zG`-z*YBk7Tm)4s<sRFtLx;&vMdTc$ubM14gwo!g$E^{Xz0Gt
zxTVbTfi&hJTvIvSrBy^$t6`VKcK?s6>yD@T|NclBm9iDGM`cF#N@SBwR(AGwt?Np}
zHAD8eGP1HaaV6Z!%DlL^_PR#0uW^6x`h32>udhGyzC9lGKKC`wc|Omy5mfTojpvm1
zag8>PI)BV#(rQK}q-gov68s_*55pGVOEIOe8h*RJz^iCWCp!*ChaRJWC7YTo54=1d
zz=m(fy3}4Q#VJVBsL?L8pRF2Dd>B=A0&*hG>H4X+1G8@MeKL9v<K^;rYzdiB8iN{@
zRDCP=CXkq2-MELD#N@oF28A84CG$XKbhIt1cPpoQLb0Zs)=!M+(1Kq)5LSMAqi)MN
zdCO~Ex;^dm1B{B$C&Kotu`ah3&CUx&F5Wzhp2};t+!_<t%8{CUl#pL<5y}*sUs6&c
z@bRqaCQM&R+qTJ&rumhid;kJ_Xs|V|De`vVpphp^+oi@&G0>ML+io{7z|LVQJqOk>
z>D7Sw`M7kgNyOL3%^SYeZsB(3)EY}0Xy7Y*a4)_-$3e|y{K>xQmf2mDPIt??-|mcg
zEabpCc0FLziUFkPJ@sIdF`;GiRghy=X_ry8@H3uR(}x;o);lG~nTv^mrc-Xus7Aw&
zVios|H`52GQFDoF-?0;Jr=RwEPAS_{Ta*-w(t(jHB+>^_@$%+PK0o%khP!wU8xzLY
zkM!1Rd%_gM95S(OvqjkQWaVC~$B#cgzP3+RL)WqCD4a%OJ6x<A*jPlK|3QQ1OR=q2
zrKh&3oxCndI8eq2CA>Z$&&ir7@H4*b*JLA0Y9?|OJiB^cv7=;xX#{u9Fz8+c;MRU5
zKOEGD3DFi7d}Jc{?_KK9c!Rh0oszS4i8$#3<Evp;!o$x`q?Ar4L}6+vTn(r_jaTcZ
z8M)&P+ytbQ`oWLH)Q!r<6<Wn<U&)RIQ+%daS*ulLZ6OXN0$Whd8L)E?bv1IPYbfVV
zaauk0FNZp3D(_L6m5be{?;?Y`=fxo0(sMhbIAQhXl<16i4J1BeyICSb_rk7=d@1)e
zF;P!@|IE4gW(IqM%5lK%)^qx=($IzXjwV@nWUGSJPpO37bDmX0duC^6hr>()f+>!|
zBC;l=jNe0fixiN#@`xei{-<S|mz`Ik6zXZY=NitI1lPeLA5yX5(vl!{>;rW<s%~=L
z`XM*B$u<qniH9HLeW`k_In?9SM)Ot9#H#Og@p3j*tAH`lFKD~XZ8f^As&zSwhY17M
zYB`&#+CQ~(y@ryYK4oL$!bmu)JSuoq%QQBveVic<NNUtrjZ8kKA=oDG3S~w*_frBA
zT1ByoNrs*aSEPZ$uJP@AK(Oj#AuFl$6-uZ=g0Usi-ikgOr2wktRix?;vo1KF>G6Ir
z4yBwfgxaVpSnU9v&?w2Lqz$#<+7_v4J=kEEGgQ;Vt@D@Yp`(Kv^`C-^t;qd%!5o&#
zY6HeoT>c0>R)uUemz0;?VKUi0@V3THI*E30gV%<cLnsWJ7Hjod-b%9EFnhbqqv$|e
z>Lv0;tSHKEuz#vF&%S7@-8H>Kvok}%G%c#W^XN>xY_}NGh!OTko^dOy6uo%tnz*Vh
z-OAlivnc6QmThs03KXU8bTCzRw$9@?aH6d1-nHF%^N5uFfu&ZE5*73t*R*J$)`Zym
z+j={efk&^hp>3lP<zT3Lk@`-N*H*O~UzCXBBD_%Kql;#AFl^zmVcgSQneg_q_5x5%
zTsf$XM2o%s=jqh!kplzew8UhBuEDa6^^tCUu&4(6dx=d&7MI(Z8=}G&aR$~?U3Kf|
z$DGV{Xx3O=%J!0Ct(GMa&qa?o=BdiQ`2?3wS|VjOLorXD&gl!OQbnWEI5Nv*r?Kl6
z$DQyXz~khl#>x!g-3cBmGd~DF1U*anaC!+>g_scG|4icQ8}9mE{)js4oAfhHxfRa*
zCUOmfUVpi5fsCIz9!jjateVeTx%Wwuk~3Z+*_)y%D_)3j-PppwnK-+I1yd@J1)!`m
zerE#o#ldF{0i`E$4%-yk?zz_A(u*?I47T#-xFpn+i-)2HB$BzgsP~%anym)-Gd@>n
zgc@p!W~`0-W^#j|0^gb7)Zq*npIs+yd^ZLxeW(n=8q~xrk<>FHoi!x7-f#`(+xaiE
zIO&;yIWh8@G8tjQM@%fQk!NQ?9KVMP3RA2{q0y8GOJg)rNK`aekI+VwBf#LhP)W+-
zdg<z`L4!eE*p`2W^?MSMJU02vueuwhOAAY%B{N2EQ65s@PZGj8k>{%h52{pV-sm*O
zaeI@nQqyMJs~6C8vwWDSH@0Z7e@84!O39f<`P>^P04iZt&@q|TUoDzjc}aP`;+W@~
zKEV?8Q(erO>;Y#?)$u1)fkK(e;KjVaFerjTTQh-FW)uxDXJ_XyTgvq{ugz0^m?kQ(
z-GNNZm%kh=@m7*TKe@z62|$jyeLhNylj9~#iM>z~0!pGRRU50`U9;zDc!DjPVi>mv
z(2$QY=Y~6<e##s;9N5z<J=lN&VT&7folngopfT*KHMaF%rpVDgV+!zrBG%XOv*~xs
z+A9_^h3z;h^tKQt?l+-}<#)Y?IEpDK6v>mI`JZmi=NvCKEVOb<$p-S5#>rO<=ePyE
zMK)Qi2d+yhA=4wVre=DDpwIP)9(XKc;M<ay-={Y6zCEON@7~oP&5kwowyHU5g0k0?
z@tLk{(}cMVos@YFtISe{LxY3N#Jd&ewcO2XcilQAF}<91D&ZDG-Nl{)YSX>yMtW1n
z@mqojmO%UFW0|s9IK`W(z>eAQjfg3l)B0L4$K20A8Ho|XA+4ao{B}Q5frO$1meyup
zSU#OHy#7NPo*G#3{73v2YfqiSS%iJ@(UXneg`kLY>3mSpY?=0&ake3xa{HU2z$nxy
z`2bT|?ul1pr98nV_zuk<pWq$ET)yx){}-2A{R=Zsg5g!Sixs!veXWZnEmuWCVRrJL
z%e|>^0n#6}Wkvk80X!`KwJ&&bTxsfli4$QloX#7lO^f=|?+Birr?wfN4wFm)z8j*a
zBub#6X_xUFNm$6)M0V?zkXNg6>P^ZDzfiB&jDv9{iw=|RAb0n7PN5dZ-xsR-wWRDb
zj10=ZG0CReA&Bc?>LXz;#k$Vfj+qnGB2Y#}k+BP!HY?UEP-BIud$RsC10{Y!PH(d4
zml*O}M!=Pg-OUg9G(4WIlme-Dd69lHl;+}I=R-Bq87r%+ym{;jfet!4oiOfWlBAS?
z@fEw5I3rmf$nf5H4P+%98gf?sRRS{01D4?=j!GIH$bs{gWltfI1C9q*Q59aOwtdRj
z^c?FTSO3qVmZ8I1QTD;|!p?h1AJSpPhFi{$Mzms7>y{QC>sJs@4KDcClxcg;PxXg$
z`V^@uuztvP%txmvHkL^RYsHa_*?gQ@L!~0Q#GI0{U-0R!=4NLz*7p~>)XH$aemy|0
zXu+p=-npGxJ|d)c>i5}gfbgD&*{c)_d$OCz{Xk1FAIBYw`Ll76u?_ULvef%-x?=Ym
zu|$#vEm=AIv&hmxI$!h%=xt6!Y@_#?3PaL<wL8rE`+|f<Un8T%4r6)ki-}XEopim;
zl|&iGRrLXg#%cd|B?ZvC+aJ~>ZZBq*g35lTjnu?SqjPv1Dr3KHWM{+_@i?UB7}^c0
zy)qvBwhamL6`?7$|2TMfG13&dI9xHppwamlRbML23U=c<ts7exiW{tHiPPKxja9pa
zyKKNWdZQlJ2y#`2F{zCmt1ZMm3glN{&m+FBtvAn(O-SRGTH`LR^`H!w<(n<~+4u>E
z0*|`IP1)>(wM=|jNHL9F%GPJXg~vjo4ZIAy14_OXMEW?e=1v99G?&FG{GzfN9N(@z
zuW%G6wUCEE;a@0p49~Ued+KIIcSWB;zS`{W#BS`Q)oGo`q+=R8adu&7<^%fEEidg3
zHu85_!FBSkvNS}T^YK%Zsb<cN;xEH5EUlWG`lnZfd!lg1Ot{6`_RZe*P2^b%zq=^n
z5C}n-2mN09E*n4ahR;Vw6#}|+E$}v&@d8Mdhd&TxbR;q>bS8MqQWAWp{>E7o27NjV
z^(N8PbNW4__&UB}QlVkX8Z*2@@AF#QOe&FB<58vnjfew}<vUp950^yL7^k~#wfvd+
zZEV^%#Lof{*OSny!%+qNbdtBiA7&jWW(jXM@RsyW99F>(YrQ@$lrGJNzp#4E%}HEs
z;S0Z+NmmgK8HTE@mVWP*0}t!GT6hHRp<p*6jDq5Abn+qRn=!TU6e(%})Ak^7;7sR)
z!?i3!b<cG}Q|9L_HNt+du&MiHggiT5{^fjNjB?hoNJ?w>9U?)bdqr%6sN%v^d`Obj
zpC=qPV!axCr@Y2$KQ#_AlB8r2s*UG(hg!HKKGbiKX#p5HaWRGEM6>R^#+1EAQ$kee
zjaGBYwX~O-^;=1iGoiY=Q!w2+8AhjdkjthKy$d9P)NV9F_sL7D1e@_j%+Y7QN456v
zqcqj!()Qb!Tc8W+4ZCgxJ!^gBA_c6O$FntdHrib&V~VQJrtV3?+j{%v5mqPadiE8L
zhcX(NiNl6KXQZVI?fU6s>Y0MjyC@`9@j+Kj`^dU+%fzkWRc%_IkH{&9pjL&6bQ%6Y
zJHP|Hnr$9YFHN1B9;p(_OsR6bOF2G<z8S!;%>8O2P|kW}_SW_{v*Nq)G~Mj;S`Ub0
z(QfpC6vht5TZyj(qc%6qZqHtcGK|_5w6vh)ze{t(fv=0r(Gm2py35E#D>Eh<fWF?g
zN^T-mZZmY7`z&RnQD}CL$46&0AbP>n)U<Can{B@_NueH^D-zi~T6t!46ApnAbC*G<
ze{<Vi*ObvFe1HF5pCY~v5imzI^6u5AC1174<7u(*u-X;&qqm};E$1ZL7bSy{M_*Q(
zGOhcM)@e_z&*Imv*{rAlbUXFZS^Y`Q+L1%x{OB2_u!suVuGU=#mL=g_6-P_TiJ_9b
zDE^@^P}X}g$}SI9DRp8Ld-Wky+lu8Hf~oeWAP)tCbCWv#!@01BbG2A-XK7@DnC&Bf
z(;lO{(N{<lglGl}2cxd*bj2Ljf4jLwsYpX(q2CkvD4M4<59BRV-grz_|COIsu;o+L
zxm9K<H%qqK>bO5or?N}U;5IiOPn~$r-DH}Q{Jcd>mITZyEN?;%Q&!9Yy-syrxN2P?
z+j5_CUxkY;oO4M+T&5fRRgnE+XsJfpN!otw&^hrt?pL4s*~?CL=|S!rr8(Nar@#7|
zB^`<)8E1reO@iL#BoIEN`D&*v7p0`VpW*}>;1>Si=Hd9F;rL;9ReD*RSy9fL?#C(<
z<cqmcYc!Oq0n#+fHoI!t#riK!r?qdS#J+LA7rjuUqW92KzsgT6dNj(zt7Z0qf$I4q
zAI_R@X~Lzd;BIXCRKZS}(SBk|y*aYXkNcq8Z@MZzmcHH?p=w<_TFLw4$A)mmU|#ON
zG>A&b?x=`@M`2#;RVx&-5SXXDP~CYv>>2Z|CeXY%9!S)0kG<kjCJoyFlb>dWN!t!v
ze5Dhly$7#|OfVUkwOq-wMF32EZ-b#4jEsSdO<9o3jvJcB=;$UqOoc+iQmC&NRNu`;
zOgW1CmAqo2rVo@zVMNR(X%kayTVTycz0|Dx**j}i3uP<^XJ#|k_hP`gRjY2`!JOEN
z$?euy>-ug&Er5AQvz_L|3ew{m2DY8B!HvaF4h(@rDAS-yLl3(EbBf)ynRh*NCkMRI
zYeF8e?McqJ7GQMC`mx>Y8`aoY0ono^@vfotS0l4m#+f*N3yCJzi6}jCN}V;PAukc(
z?$p@{6?4s&zS5TOT{+67w+VLhhzkIjRD)!t%ERm#!|UdA5a_WghQ%*DIlQ+K5C@2C
zvlw69%N@g5*|tGm-=BH3TcD@sJ%o~c&nApVvk9eFHmnP@UncPQ+#-z?^ZfLKgZ(!`
z_d7?9E_)iGGx~f64U7|PY}>*B=mhtNPq)KxLtnmp8GXzp+hP%UbcrkEvZ=F5`RL&?
zW=yU6Xt*`4^l?#UnsOOIb;aD`U0uf+zbXe@tjs8NSMFK&I@D=oF~C2vlq{-8HNWhN
z%yMEap-_6)$7-)5A@0X6sBgJYaqkWlqg3hPM1a>~mCCQtC+x0+lHw7gY&8<~yguD)
zKU1ncK^43pRZW$8p9<|$dfW;|r%4|mir#B(Yn56TXfB(x7A5XCN7luzgNEB*YI3(U
z`Vb`?^JIy4f74ch@diA6h9CZ|Y;?Cr>-~e8u9UCMx`vEi@Sz&0K2PVjyo~7tKlc5{
zGdp$T&t#i3xCZ%Z*F>R&OCr={b8fBmy;B8yh1%W}*OhHvx@a*z;|cz;FcLHRq<d{i
z-CA2ULp`o{%wIxLpqbl9+4{I|<~t*ay6MI*z4*P_Vqwr@-!hj>af3olfs&A}?Q#JY
z%@)2wnTs(IsP!mp6ult%F~(KGWkB{W+j?tnUeW>`=>Yxi#8}|{dzFjFjl~sM|L~r-
zVNwzm<HmitUH*5ST4376v~eyw;}Q-*&z;>~*)!nuz0(dRmt<@mHglw-kEc0`ORNSG
zx%s2{fcxGieHb*n_6S_jhI|Tc+l6ggRBlOcIBq}TlTaA5?(92J<rYz?kRD2S7=)N5
zlDF0#GIt0voF43!`Ow_}3fpMGn0$_yKc;9(UrdgLcsWA{6e#HQcL>C<I2dbMQrw%|
z1!^Z6j5=*LQ#c!hcjFIkQKl8-F)<j(2(ib>8OOAiw&I5`AT(WFEw+m*8_(N`Pq%8(
z(&c+#J=8M5i`YSBrg1tHn_YVmM_*@W&D{y2v|qaH48Pzpx^q;9O;@d*^yYj}nhHP3
zgrB4*acN!X0v=PY+{Vw#yiWBODhza&l(;t`QEpM%3kJQ7d%Df|9F!Q#JQK>qA<M6v
zKg&oKM$0><1vV`@P+d(Lc2i+#E~#Z2-W|j+T_hQ;naonCWgNwjiaaV*G9r3NbA{O|
zj;<s+Vq6K4PzBcrz?h0mmhTx=A2>!hHq&yDv5tX!q`b&f1~VI;o*JEw(mY&=`d~Gn
zyi$;VDk>|>#0l-+QljjDUROBS?9`CRu({ry<3e?&w~)JbcYfGvu;rp}tNHHkB#rNu
zHUrgE@oFjf;H=JhaF{`>E=wXZE%5!ewzp|XPJNaDd*YBnGv|p<3>{L}=u;}^QNJKd
zgA(OgxcHNFOnel>tA)MFEY&<p{a2NyR-Xn-@DFc{R`xA_S0qXv)#s2Ppr)D656nL-
zE+4mpT%_c*0soZ-HrSiG1pAB%H<6}x3Nk5QR1nP=juJOY_tK(T(mU_Va`J}N!)C6S
z6&<u5tCz0kp9_y~@CmH^poST9yijeN+}#Z5`|<;54XAF+ggh6GC~In0Mr0q5NLO-S
zlyq@oD;kU;V{{2XIz9y_wi*;Sj`0f0QC#TL_GsI6+mQ|&oV*x^FP`+a9CO_<Oty}e
zegg~(E>IpUcWI%ahNk2_eNK+P+A=$LgK8!&s%wT@ir-69jnQ{MD~QQqT|A>!$J_X!
z&e6lv&qVz`-+J67E?oMGdPVQzpn;~#aW+RncOt&r@0)(JDP4NOV5ZY)BqAyr%SN)1
zSB&U^Ea$MY#5G5roSTTq<fF96(YM0IZPHI)+|{L3Lmi7E9*sG^X?CCV_nwgeVS^LD
zYB`%YYyr6xfoz{|EfE0VfT49hSONbP$62)uRkodK;9!wQ&ad^tU>s(FsrO3_D6FTd
zCnQ$Lt7BMZh@5-hBU(_O>F}KUEQi}%(^YOrTXolLd3H93#81_Wu*GlJiseIm{nG^|
zFi>xk*AbL`3Z~}xXjH}g$Wu^WT`|GGVH2^0^L2Os<+Qy*tSMI+wEU3C?|439PuOWZ
zE5!ZEC0Az%6(?B^Yh0hzqs&~#=*XH^*EL?I3&m*IfjqCN#-kjvn_VYrKB%aR8!8B@
zolm~~?&g&zxKZ)wh31TadPjnUdRl(8_&aa+B7tfRlPl`SR-GJPN5zd?q$X3-aS8#N
zPD(ZH{r)}e)=A5c8xtD>lc(V#NZ2S)wz1l;@D-R2$6eBz?CtqreXdkTyrRHG6SLn6
zw36{Mc(i&)mc)@v$dbuxrpo&Gdq6WgA@W8u2jDKe;V{YIQO7W&IhB<>9B789xbGoZ
zIvv$_-qU!$tp5I}WBimQ-;)>og1RvS5BgaUticlEl@nc%sUivSqEXb$_qHFV1rp8P
zW7%$-fzU<Wl$Os5yK40nv!Ib3Bm!t}WIb`LiG4?oHRoy+U<*blh^{}*{JEOJEk)Vs
zAl|}wbu-&$K(gnc2Z9ZbK5wofR+O~IlJPpFm^RGzWYin?QV<q)wt1iRDs~OHEOJXQ
z8Jjh;j-ew&pKgik4|WXP3HNe2;s%4zeaG=fl4_@K%$}CR8xO3#N+~?Q3?C=G?1?XD
zCT-ZYJDre}KRya8eP9lRrdWMWtC!ige|E19k6(*5Y0K}kR4J&iE$!z}UX9x+z5VnR
z*)xjsHO4}a$pgG<(CaWWUyHn2y*sByLto}^8YZLO@Bo?jSrPNF3$U%LTtNF_&ZuAg
zMPab*fT3rbj>Vz%^KHWwv1E+BMS|ItD_1D4hI3c8wMiFEnZAyroMJ!c96dcfRrDqp
zmSm44<89X*@@ZTkTpB!og5IV*y#Sl<G#`VM{k^A3jrUD1=~y5kP52#$AWiZ+_6q(H
z<!Cb2gsS$hgl@*L+q9hAEwk)x8gGjb6-?+b0-q<ZHSTfkO1)rIpmGRH1|vD=HmnN$
z;^L6DC>_D1?i+=j*D_;7Q?F;HX~icsbSo%$<TYySTeF6E|CVlslr-dKn5rQsZA`$A
z1Y)m_*hjyvg{lUQXXkxcny@?_-BH6jJJm5NSw-tf*<v)BUM4&f`R-b;k>M0-ws5z5
zr2wJ9HS$>7P1}O=t)LRyj8kiB%Pq%vXhj_lzQXV``vhJI1B$1H-BiY?u&LArL{@Ac
zFIQ}~kVi)Mi)J<!{YjNMZ7%ALI}Xz?rgpZ(c4tvXPqVWs>zqK^A%?VVg)UIE8wORc
zT;Yh;B*@TQxV?C7QFfGbNrkaWLfmQ$Et`EvolW>eRPdsgZ1w&YW6Qg)ZJ(&+Xvs#B
ztDE4=$kRuG=-Fak)-9p?NMq!<lEQ-xjCW8VQM!|MzjOtK;n=p4&-e9+r8Z;5dLKvF
z8kG;{@NSWZ@5%3F(>!`g^h9f?V?xi?daWY55Xg;>G~%>w{}c~7%?XoxVG;kJ_OQn{
z%p<!&ae<@0jZeZ;iBB;3y2%2TCN7m&qE|uX^}7WTR&v9L!R)YR&I~n(wfgbL3tLtp
zv>}I0??{@sB;sUmbq|1m%*0Wc-x<W*Su#DL_4Py3AxrEwn8f8rQ6WEGzkdCIRGl>!
zevX2lXH#-%e(so=1|R3*255`Q5?v0-3U)3jC#kP21e+yX>Kz41dewYM-%Is)=AFf7
zKB`!j*M9%ujc$UeA(33@5$L|y7Y0sQUOui^Il<j$R1XNNpGfB@_0ps#MS7`5uc_n*
zgvC`hC>fIXw;Aq=eQ!ohStl)e<TZR^l#Qizlr*HcLzNdy1-3)hxj&vQiwP~+m~P?s
z4Ef1kr7H0yP4gNm%uM<&r%zNBw}7<umOW*!ud|n7wY}q!`~oaP?fHSJ1W7vuZHc>v
z?;sEBw{C8hXwsTBmU6>_1jT{^54j8}Lxy)SZWjmR?gq>RRx`%G_W0w2h2Cv2D?16n
z!}7*c2AIXzvuH@Iwehrm4Da>TxLs)$tA`EuW2qikpBXe6w(vP+at2!$WOTRbv&IBi
z=v$~P?pZNa0$E?!(WB8KXPm;>h%XOh>jSz(gHr@3koey9iLq#;NoAoVitf}f?HgC@
zS#)SaXI3E3+urTwgTg5>ErdyW&nshGDRRB$T4XGnSMF^=`TLvpop<R^8wD<OceU;i
zSuY=cXxVO0CbdfxT(=5zwt_oaP?3vcL_N+7t%tUs27&Z<lIto>D{*Vh>&6`5lB!)7
zr2QaQ^U(*!0L!#j_nY54&0<99aPxi+-Y=+N)GG94%F5AiYttkYe>mKDk(J()(UU$)
zQhJKTb_Raw{>B$*&#oP#?`#G@A3?wE4au)#)@#GNOyP1Xe0HHZzrfwll45CJx4u|)
zpCGN|UFqe`X^93X#F^nEJl_BTY9IlTKcBWU9ZV<@xj+TuwxnIp)dtPLYF2{HiY45t
zo=#3>9NOttOK*WhdoN6a5f`anr^nIJQ5jsC>iWlXcB~)|jk-JwNmyqb^cA-RrR|Dv
zK{CbNw(~7F$mIO|yhT%H>n)23$NJze3SHXleq$F!1(-``7LQC$i&g|*ue>-KLPOD*
zHd@H)TDB1|tzi~6yl&BrWPG$KdA;7KN|+DPP`IVWX0L<D@}80J59jWlmRL|oE)(|%
z`^alb|Ih~08-Dn$E@0DmIji7S_5jRPNHm9CwOD<}A^`2mLBQEU`M!kh9V22OwW8Lx
zm22Gx6v<QLMJ4jY43cs{SKGC9UoAhRjuq<P%M+@UlwXS3mKl;}>niU)&VBSOTA#JL
zOZ)3s*L4?UvP_XCpBBwcJ2Z6be*c|<5f91k&(N;yA_}F#gy%lADH*>CqReX=KEg0y
zo~_eee*<s>->hmSIxam<x;4IjFBN%*2^mxYm!+v#98F3*Y%Hj(KR{xdT;3nF2erNW
zygy^WKmO6%`J<+c?<UzQPZGGoA9)uUy`|Ozu_My3?n+FQ`2D^_*^LECZ=!6)Fw*`!
z5T0@!`esPJf4=CVy;wTQsRvT@s&guEF#}YrjJ`?1Vf5KF;+0e&$Y3WF2!Br#N*sU`
zrBkZ6Q)~;gHE5{Q<8bUW>Z~xSSSq2u56Zm<M{k<18!s6~9QU;p|IP@$+Q=_@cdrDM
z<9OavFa)K!ZdaX@qrR;Zm5@aF?vUxuo$tUP&6+=RTmu752u^+luAh1xm!nar>oEG*
zXYRy0uo6iEMbX?UXFj=lv8p*j@A=NFW^%h9McW+aPT{yy2;yiR@F8_H;&6VGz2=9I
ziB^u-E77Y3OqcStrQSTj+uu*}p;+uPM*RBlwQI+RYeKRM{eC@c;(&7)BPij^H+CKR
zvpA{jtv1Xiu5gpxcYSmPEAz}u?s<H_>Y>*<)|)~m+bI6jV5_D9<af>GsOm7w)t{pL
z-t`o7tu6D3wt@2U?PC7-*<m*rr%<~L4OyhO_a_%ZbiTxD{5*AW;d?2PUTI5tWuhiJ
zPE=5&B5DM>`bmLIMN<97d?NV4uEJEqM7v|N?<@~#La7Tht%P@@UwLs{0{Yb|b80G3
zdbqv)UF4*~CMelN@4;~7s3K>wAIH|J1O3*q?`C*eoaDf$oeNi!#Dy+PY;%{*_4?zo
z7Uqw9zngQ?5XFklK0!>AX_`lEle-qO@zF`B68E2GK91EMBZ8d8BM07hwGPgcKz4RV
zkDKizA>$?JXsqO6z@jYJ5Q*~6Kb+d;JGrR^Ypb7Z;OOjVpzHKL0}^&(!J|e=?s-Yf
zKM8?Krzj@%E?Jt__Ny+GcrO$(ND_v3Vb8+W?^^d+h{Y)=`D*M=+fHr!eHykRUflhG
z^-|t;NSD%WIxp!7demNaq<Oc|cn7UwLFVD5GHtVcs!Dx5B{HPu^=tg{!Skc13~A61
zQ!0Y3ogE^gT#U%!nj3WP?h@QY{J<g8sskvDj{@e3AH1pb>wb8_k2{&%=KSSy27#|U
zuJkVhZ~r>F3BGd)E6uGlN6B|~B~k<Vq3k-QJHy}&^d6<j82lO16O7)c+Z`2^vd1=$
z1V}2Ki><fRF&><MYFqb^09TG27VtK^7-sV!;hD2AvZHaC*8N%b1Ko?h-m+ac<Eda!
zw!M*sp<7_lsu8YTGHPFKF!@yFCm(OwA*}VRz^}2gRlle=nBqJvxyk$#d9+ot*uB*(
zosSh-*Bd_fVF1D{N-&?CruMDr@o_TDCY{;34|2!0s9gtbj;@?VN`m=$4^~m@bbziG
zWw6i24jgRzw4e_L*5mHrRG8XbTQ_#H9{EQ|UtL6VV5W;y0~o(=#O)Y5LC(dIXxRg&
z&$CURnBW(2r8Bz7`QVQT2a_F%c%0J!?2wukO=N&NuC=AtJ@9bYA%bVMGgaJ)Uq7z5
zLb|MK4T9SCx)u#rYZqi;dL`v$hZ-o?)rO-1pB|i#Vy64)$olzKMcmg0G-v9*p@pWV
zme$d6i@l>`Dah0F_h?s_0_?}cgprrGcOBr1rn`6V9>eb&WMpK3NkA|576a}ChP~z4
zXZeELNAyPr;P!U@@uQ=IgK(?f7fjKIa3n1lqK;soqoW(zJ#YB}YQvZfI@G^l;&)3_
zOXX{;6KU93WV*D&Ij;p&e%)c#957v!u+Gd^Q}7dEWDqfJk?|?L@8l|5e<0#Ny>fSG
zo#DWG!hiH**B4e7^kc;5*+M38p@c=zjy}@DOQ&Q?$0;yf)0YE%-wAo19@o>fV)et9
zDEU$B$$iOIO8q1L^I%igR!g6vjBqk-xf1I*agJ|-Pf<EYH!MBee0lO$QWpA13b!xx
zKzf2ewbOzNOAAf9r1E+2cYkhxX6*2=S7==~oOv(ro#?dVrVpv#Lyn_gHG9rgqq2p!
zG8V_;N9Ol*A74~Trfh&8&L(Bv!NE4f#5F&8Z64#i<A=y7m&d$HT8Vt_f)1N6&an;N
z$&3Rt8EQ%^60P?Nx0PL1`yJz6UEkU^by*aPRT~YEz3}o{tFETYh6^8VV9YkQtr3FA
z4}PwV?k<F;DP1$RzSG$7BC;o*Cn{DKrVGk;7}C@joMv1=;}<u4sqilQ%tA6JfPE>%
z*nYAS1mkWDfM`fQ+KzeRCMPDoJyTNh;zcaJ0=L)JQWA=^^S`JwnwWhh{5yZ9;#sIM
zJrC*TLU;6d1yFj$RP?UwXGcc}>xC-h?6=uY0J7G6KackOP(uRW<#e%q0)`t*64d8J
zYBF8w+~RjFQS!JhA9^P<KEBtW6l!IHw1hPr)Gs!S)gK%(g4(P(U}Y1es1$W>eUJO!
z?U5z1j8SFTl_N){o)_;O3ChREKLzt{mm0CPZ4d6-7#Z^)1P)o6wZTmHOifuyBYW^H
ze`|Gy3va9RX1q6qR-3sDiDmQ|I>)6vzQ4nzdVQ;CSmlf|-Yl$#gCNpx)@i#QdTUfp
zW3<ONWt{UgZlI{4Ai=01zWttcOlNS$oEE3_(;HcghL~C&47;itTWV?G-K$gw)yXo^
zeb~0LgXXDSSK*2&tjkt&O8~CXmjh-tOf<DYW?cddn`&e+@2OtI=`Ouply%tiLBLOi
zy|RzAj1IxYYx}O>D;!IvW*@H~nFXR90{InP4_;KBxO&1X#4CTu#~9RlBz(SJ+Az_w
z)Haug#~p*?F7{9fGMZ4@iSpi@I#!Rj#%!9|AR01Lg9Zx`W5<noKEP<fm*lBx(SoDF
z0W#x!)b;-J+}oNyO<V`u4O8GZt$3JIth6fRO87w|9f`p~36KV*Q&?0~WNKpau%)$C
zEm>-?7Yc>e0Hds*53TO44ytA8-ne;_`pug+cW<%us1e*lUK~C9ASPhh$>g!S(0!Zy
z<M1nCc?Xfq0R;uy1)KeT^jSY<C-|rpJ`0)kKnN|xpJbv?C|%$3dZ)qO#EMIGD8JON
z5HW{HW_6Ji^bd70sBiGmv63oGarU^NvAZtdjl-nG`c^*u7J9EtLBXi9Hn&aF70tvP
z_%@9W+HN&^wYevo!{hAbHL9F-)5RCbaS5aA++cfeiRUxo-^QB{tJ4bkGdCsp3?!7i
zNgn8cSS9VeT}VO|yr_mnDDkJnF`D+;#M&QME83X+xTa@p7#U!XFl;N2ik7)MJ&1^i
zKJfpk&<C=fCzqBAT0NIlfkumDavx+M7eOLoVst6|rcKYA@gHaQJG;5@M+SOJdEu)v
zgnV)-M01U5^Ax<jmSDC)xQ_<F4es~gN!H+r3yAW#A?Ozy)5*7J$R;A#8Aa%`?&kaX
z*1rEGorf19N$o|orl*t|QpJ;s_i$U8J2$bYf^faT8yw+-(B8_txB3j0AN{2ot%mYW
za>4ies2v-tY2D{@Z$#w6%fuqkur7AU2In+Ox$ZIIHC2<%1?K7>90V1@l0f?PK+VQ_
z^%j_Dkim7IK4BkL(cIkZdcZ#>BqYS84|Kc<{P^)>02ddRR>|=>wg-Wrx3;$K2O4p_
z2GINyxa+snd4QEBTwGje!=<L2MG!&FNdEX!PmBDarpn67or}8T0|PYe(H$hn>P|G`
z?i~gOhH-JgJqU07tn#9K+{8zte)p#c+2!sVczDy)bs86AT*@;y6+|n{^!DCsaQ3L2
z@Hki?_QuA2GNyg-e%((X4K?*=e3H{TaQeX<0XBQ2X?7Mg1Bz`m5O`mNk$~RP_4s-a
zl}$VURVb6}JWqp=9sk{r&CN{`Tr(;)=>Y})i3IU$cD&!cPY8u2B&OV0nMr)|h}Z5x
zK|l!wMlveoY*i1>8{W|DOaA;e-nx;*M`#G2Y16Nk-@u4%+%%zA1?PfK6ZjH&k+OcN
zgEyD15_xr4e)1k_j3$-RR|<RP{m`Z6_tbGkgKw9JjR*Y?rjVlePcj!8>Peq(0T5-e
zIsje(!-Qs~(WDe=n*sUP(i!U2uN!!E%%$0PuDxQbjZ`s7=uvs#sG0CG>h}wCbKgI`
z4`4v*28qKo5HSDaq4+%JsIUDpSlp1oNXnE$r%ds+zPzv#qC1+l_XSVd6qVJN!=oc!
zvQL{kJ0SlY+Ndjg7)U2%HE>459dL9mh<={GspjiK1Do^}qPuKxL63<;fU`I^5(^De
zSGG~@67kS(k)gh=xci)gilFJ93Y-M|FglxyoWOQ(Z%<R6860Po%e;`Dk@16_U>FOu
zBU;ML%$!_Xdv*JYi;GJ*_}aB=zcn=tce5rhE`p1l7MO|#9izHr`|X4xUmqSGnnECO
z?B_1IZJ^D6xa>|~Yilda>nyp&1#)w+6_|*Qi;#tUzz9{Fdh)CG-1zS;>6p1*`}dQ3
zqb^Bsp1?}!RecH-aZ%CLl$4a3^z?LRTU(A#Nw<|X<*-%N)hy)C`N-eNxVgAorOgG-
z?<Vj%Pl6x1T+AdPSS(iJyp7i|mz9qQ_zYnuotl~Px$v_*p$2ehNBr5h_|Kw)d-ko?
zzf$+U(6+59;zj@nw2lH=L9P%`F*e-ByA-{f?q2$<;pX_1DzquO*ei4`!Bm9C9$sEv
zwr*~f3c>^9F3!$W{y7m~U_2aYa(Ou~s=_+_xMFRVZC8^8#6%KEg|l@LAj+j9@r~7e
z=VnqNRt<D^S(22LoTNt|_gvozT9w2lSirre4^F&-=b6rjnA*Ni#~2tG)a*~0wMvrz
zca`v_ZJF`@9N3W7Z06zSA+jg}V0Rua<>qtqQQ|+o8*An0_@lhCG86AxoNi1^%=@oj
zzs^qp=S7>CN=7tO0~$h#J0G3~?{h#ycqn+HLa4}T^1Aevm<xO^#60i*!0pOjAmUwJ
zUE6=m5Vqe$<02r(5oo&wCdJpr)9EBRxA8BpO!mLB*b{1pQJRJTdB?7$R<&W!5J2=!
z2_V(3s7TEsDmFIucNdhh`}o+;{fY#jYb^<Kf$yL8^P7U4OCB5LMN>X;m5AWGXl)xB
zriRv5dPfr9d%zS!3-siq|C?5lpv>S63mgU_U1&@4nudlZ^ftG-8>;!zqRegM<KO=C
zS<3nyWn7o|1I{R*4F$^H!()h-mv`NZh5X%gNI*cqkFha*F7kH^9qa@;yw&f*<gl|p
ze?E6W#I35%KsvG9$0}?coxxG~dmNF$z%1J-n(5c~{N`SZnl^hb!>7AA$WBDgS2EFO
zD=cORAbE268Wk#cLTI7mk|=*4=eFhK)562UAB6T+{#adIZ4H`vEGmjDUr24Wx3||i
z#uo5PkBp2+13fa@l9G~&&Q^PX^EZM#XJcc#^7I~DY8s7(#PjC|`}3p((#Q5RRqpKl
zf!^qi_V#uX3q6#?me8!T$j(7;zQlM(N5?me`B6)WLD|9XZ_Xyq<sT+n5>~wP5If|Z
zN^0`I3-gbJ9cBb%a(^Cw#q>-=mg3lU`xX}R7{H;e@mV1&D=S&7Urb|2P0Y-Afm{0(
z1eCo};iwx*45-qwLVQ6WllC>Sd83Qd6+)`%(8M+V?8d6)H3F&$6w0gLZX`_d<j>7A
z^#dlf;#`9LSDT!EZ=GIPoON4dWx`+}mCwdB*&(G)KL5z__fL1j4mkEI@EBq*d?3a{
z`JFDRPe)o*w8*Gpb8e0~$lTcYJ7BrK{>EYhWJE-0vU~=zC218TcQKaDaJX!w-)0a6
zR`_nL(}2saW#<lMm?EHtx*|@zQUM44GD7CC8h4NrxP3wbl0pF!wkB}<zf<8syyW=x
z-PtO{1zuv8WNFG@_x<~E@TJaBtfVK31V+j7PR3qMO^pIS+(nyE572HY!N&5r3qabu
zzc!VtxA&-_Vncm>@+|;PQJfqPQsCYXjUfOeI>@LXN6T-1qe6~?<YbxoZ1+@|o9YlX
zGn0Hhp`n!s$iuZ46&005!%l4xrc*yBCME`9(t(F%z`Ys9)OX*eO$oa8U(rG&saQMy
zeyq^xex0s6(Ag<(w1bgnW$u0rT&{4xO5j{~yM!xO_4oHLY);mGDYtiWde{YaadT_^
zV`Tj5+N-z)w<x=%3khYxU~uw;a_@sFKz|BL0P7X)`eZWvI&ICL2r({?J4%ZIBzPgk
zf0i$c&EMJEB1Kr3n(_dr7#KX=r7)R*<tmdTzoZ2^vajMk{Ixi9FFMiRqi~70xmz8R
zMreo{K7V$`=q(X0<xxJT$%ZTuQZ?MVabt;dLB*;2H3va1sn^v+Bjp7auUo(CyOfq;
z7wfPAsU4u&KVCBD_EixXnRXE%Fl@k0!DF5p{Z>ire{|26Ulu2SrI1Kc^oZ%UvmLtm
zt^Cs`o0ZZ<jMOvdtDt@W^a4ip>TdkuojZ4`i3N&Y2wJ>IIacZ&T1TYc{ss)HD+e4`
zbfeB9)NBTTaixvA8n{`FxIk7{S2M|O%b)qr?(w33^YWXUntF2*B+~yJ`pAa=+%x;X
zJA>yQ@r3YiKwZxMfp!eZYruC3RFfuq;zxPBWclqB5YPhDZrcn2`?KO-QCxMKsG+Tm
zaiL>rh4Sd8e9p0WR!`i+>i8~M)~JwB6F@Q5X?nc8`0NkZ(7(2_zfdjp;y4XMto;&x
z=mbB!^5Q+QGMOBw9fkcs*7s#k1**%@{J(NdyXa|~(V&*&6!uR#J3}}AqQPXqekMH#
zHX9rr)!SKGS}Fn7Mh4d`4xpwT48FzNYeYm5MAxo8!=9e*?7{#9*f{hm=F}5L4c`t<
zZf}=KCK<b^b)k0?$vndD#Fu_vWZdy{)uuu%?`A>vhm?xO4C(`egWDfAlQq*X?@BOU
zTA^v<U;IITH_BCRhI$p~Z0G``CTeJEqU(ABAk_4Q4!}y(0%pqD#f3LBE$y3#h{*5i
zYC)u9y=Qj_aDwg6&(BwS?&NiBN<|R>$u}f%RQMkcJg-Heo&x*F(;IsFlSuaXOXc~e
zLF^|B4}?W;V9wF!)wV8J>-#rDz*Q+Z>?L0V+Mg<V<9kAd{>PZ&|6{=L#NMt&B^fiM
zDab`#86j14NGE>f>nkEDCiV@O%RzN9aM=4~skXhH5C6G4`GY8V4&q?IvlV(<xi>H{
zkYz=UfElbbWI=P4Mm9njsCaw8K^Vo#teB8|VG5rf838z=SucRKajR<ZeKp)5aQ&Yz
ze0V_i>2pAWrSaoSYxVcB!|ctv^>l)Dy!if7b(nHFT_yG3HF`>w7M0iWFMg*X5)oUf
z<`z)&2iS_BVjv(pnoHreF}qRBm0E6rEurny9Umn@tNhB~gECo+L0*Ryp%FI?&er4Q
z_k&A-w}Vlx@vlEN#9B}(3ouzfNR%Bj=tyWrA4TDYE7~>3gr>~ZH8t%p7|au4;YW{j
zTwPq60k<%#1pYFxF|HsGQjs=S$A?vzbX(RFKT+r%qmj0yV8z40EhmfC)2%<Xd!o|P
zU{k7zpXWzt+()3RY_RTG(AexZMiNL3Tj}MhZ1=!7m9l>pp@a8jC<Bn~Np*#0vCdQR
zH7`GZL@Z!2fdGW1QG3vd=d5FW4WR6tZEV=%S#zbHy(t;k`nfB`LZM!5QF2?k|J^Yc
zX?Q2?ndcB1Z6O8B$%PN2P^a|>GsM8afZACz8YpxyjEjxE`XPR*@>T8B0Sm#URcY$~
z{?8Gf79R58de>v4B9$KioNu6fg6KNDSf`?*B4uV~W_fDrMf$2gK(|WHm+<sr;^I;O
zUcAzwi`6NfMWG%p`m_JK&q1JyVy0z=^960Kl^IVui+ue}Kl|$~pjf9o5CQ@Mzr1i;
z@bg9%Ucdl|n3$U0z%0KipfHQOjk|O(rt$whs7;DG<nN4(jEZH{i0l5`AxQ(^?nbY#
zJ8-f51TOdOYq9b1sle=?>!>{`{ye<mX~5>BA-1-*3RmxAR+EXjTkx(LvQpz_HZ|M=
zMy^7pA?tDQw?sL6S*t<l;bEO)DOp)`gV_`e=;ghJ<Da`r`d=~TT;2Xf#zCZMFO_<u
z@N~Tm9uQIhNce%}%*KWzd3MP3(vpokK_am-pPWP-Gz1_Ep_K1h@3#5G9wXif0g%g~
zmYop0Ie4+zXa;n;kDn1dJ`6%D$zq2F|Nf&WLA6Fq20P)S*9n*61R*Gj3pSZQl5`|7
zf3ykz#=|1`&PC`+{~r^71|S6<ix%(ul2TGP3b~^;0rTA4_4vhMcgo((j2Y5dq;)~O
zhW#4PC}8^LzXFWPEQUnaG_97n8hsp#P77LBv%td6SHIBL!^a%kj?~(h)Y?noa5w`!
zy_46YM7(bmy?n^a7SDx<fccLwAzUinhy*cCfQ6C{cLJ*BHa;&O-wzUQ1#cB%8`fN4
zene1EkW?h(MY%ycfD>-sys0nG%&3J1oGU9GBP(4%Y78qO=>h}X?ZdHvMJnvLi!0dO
z&+j-Q&I$MDpqig8(885inVazex}Qpc=a2~vS$NFymjV0{0QhOT$wKg#M$M^EgbO}N
zqhx#y7}|~QZpCuqhxxslf`DTKuq*9=`$sD9@Y9ABaAmq)pDY_l*_G@Rr+kf9y(`Vh
zPVi_qo*_h?8K~O$gC!fO6?dVFQ?h@KXK!z>tAoS+q~lcyB;A8cPCvXx#xtUzKQe?A
zMUG}8#JpD2?X+J;M@LUiPn#M+4mT%FF#vjd!wmt0&FT*^Q5OAxkqKRl=eI-wnQP;(
zglncw`oP@O1j#g44`1I3nmZW;Z+qd|B!T&keCKnikdstgnJ{UeX-HTWP!qy(TT|}O
z>;C;|Bqt8}`<TNz%q>6yQ5W6=rau`DWCHUp`<Lp3Bqht%%BwDb(_wgHqNnGXh=j!5
z6d#^w0-+D_xaoR0e8&~2GykQe`NZ?eZ=WG&k(p+%)!89HVJ{<uA*a~@En98h(65w$
z130Ea(N;<+65qtg==mq(`g{M80r>5D>)%TuC9MZ>Qkstez;5L@c+;8*=$ya2ygaup
zBrcwA*6dkGfy<Hv@zLMAH!uK`b<>oygp3W5C=<Y{Dk>}ai9@J}Xh;Zhd3s5k@y>hP
z&U%)BV>yi5l)W`u{3Vs&BG^SsYtRWm>7?Kk%6H9pDt*8SYl<Nz{;w=^BLDKBj**T8
z2hERD>F&=k9E6@qkO+Ig)+P)6{P9E8m6aLnTL0n%__Cp5uiV|Mq6mZ#Owm^`RFX7i
zA@Wpdj#}0A^#^YNlPv44UfU>pSRH@f23*)d^Q5QR(qw%Mu|QYe|4AbZdi$@wlv-8}
z1IFWyJ@Y2eNoe|5bpX7z8^G>=RAk;ng{O^80mHp}nlrwoR{*<J6$H2&YtHMC5_`ws
zS{Swj7Le(Nh-(#mIv6ls8$8;`!5s*Ye|ej9Oc3~zm+{h)York?^YHMzH{j>vGdNWy
z97Un%8#FXDN`^hfWn|1({LOP@A?*{hvt$Sz?Sj<2wgu$VQ9~+xl`~z1)Lf~a(C}h`
z=BsVXyl&0EfMM!wyG<f6F^>h*?CI=L`%k_v<COrU1h5tfN7nIL%k#?!^zX8F%)~1C
z^78O33HChXIrT9!0QRTF-p=lyFw5XycK08b+tAR^#UHmD%i!GHoI3=9lWva@0j#&h
z_Q7d9!V|{-C$6G#><LePmjB^kamo<g9CY&A;yvPzMz~jR@9TRQHbsLf5m~L?qLF@!
z_dgqtN5uR`ppYVRFMJ6w)>}HGOxTcF(dGNqV!#)im6O8<P`X|q;e^T)PY2jzMu3PS
zPL{1eAW<>=W_F4`WwtLoWS@p!*?8jXocxTC+0RD^Px|=yfD27SfN;<wv<M|u&x#4{
zY8vwAMgRV|vbFqUDW%F4$e+`sn)O{(3m3A5Kp-d(JHdk}R(d8TP&*j{h$|gNE8aUo
zJ~6AEd{4*C&{A2cMUeXoJSKRJC&-XB7r+vpuCCi);O>Gg+}w8d+(uV`R2oBI{XYZo
z&u4<Rh5Yl+wd?e9WWW-eT!QaN(*Gj^@Ow_^3ho8%pTC$JQKB*Pij%QX!ZIWS$Icn}
zf}h^)4FEv;k;N(ne*KGbXD=@y`a5?>1g$9W6<MAiYt~MFVr^D`1r!x=kH$V@BL*bL
zb`Z(@vi+-#&OKshrlzn&7AMITCppQ<)Fct|U%_S*zRh>Lo#gNcFNyK@agaf$`VT{s
z0SxJ~ET|+WJ6n1_RjaSBFKgeYlD{Zu9q4@R6c-nF7#|aJ<A(oPO9J4(BDaXgdb;Hg
z(H+(Q0L&El=oA|~)~^1_7*pRi={$?+od8w?azB3l*RNmFjuEQPh9GCB?TV<_DFvlV
z68u_^AQt%ZIYf(JDMj4Yxcha9xsj1OKw<$>0f{6sF*f!9fE2}iQ*SCiMzR~wi!zTM
zCH`TG0IKUmTH*j;;~ryIyFM&drF<t<Xp6G36@Gz%2QPZTPN(_d+D}_sTH1fN?SOZ#
z?*Q`}kAN0eKhBF<uGRnPTK?g@ePH2Wj_}f|0MWjGYMg$pvq##nXBZn9z498kLr?!O
zH6=wA>SAYSXR4*8H3^t%S7&FVO@rq8`od*-tIRK7o{&IPp&<b6u4{J|zWXH7Yj;60
z`8G~JyNO2#ZkAxVeU;zu%jqpLvRRO+^|`qDR^F@cjl7b9ht2?TL^o(rT)o7i@nC?D
z=&uzI%1Dq~1qeYniT%<?HsJlCV#=X80PABt9{~CcHY6`DE`Atq$<EGZ#!I~N4yWnk
zjN)5m^1>zDR!05t!iM&NkH0bnFM7BnU;nunFME*;1Q*iXEP!T;e-wsZ6q6U8r#APc
zMZklZ|L5h`iX~S7m8DFj_rpwyPtNno3uEK^%LGfJe_Ez41Mq2bY>Zk)txxFDBZ{m)
z0IJjnU>Q%KY+TIEcn-!s78WoC3GAsX3XQ(Sh0Ei|<{iz%Tz?Melg5)BJskQ8pB!L<
zEyX47gzqU6+AOeMIv&USUm#h3P5AMRq$oS~VwD*m8d}=r&q<kht3aDY|FW?kQF-5h
zl7`lOvt(caJ^?U@;-t&kz>3L>z;lR^JL=63+0$Ct)0)Z2Ne~0F=WihdE+Tj>qM^=t
zTY=*K$zigmfU2V0Q1~VNgeRjh_s>mnr)QpzcZ53dkg97+w*LqS4D1C^QXZh3^r+HI
zLw-vcGBSivT?N81#oPj1M9db`fR{P))KU1ZEfp?ONBboO?i<Uu)Xi}Ipn2GI%=Mp!
z;4#DVS^zJoWG(Sr<FVSR7@sG&wDP~!um0m3?69Ycz7p+o8~4pviA)l}tn+)Do6gNG
zEq5E#&T5;R@36x2P@2WSPDTT<keW&7Qo`MM1v&XnCID*!2+A1+cxPt)OzE|<#CE~5
zyOgqmQqt1dCk@JgI}A!?%sG^322}f8TJ3)x2kCfzI9Xb<819zU7=ii+26BEKK>zUZ
zKi<FKllS~J2M#f@v5&#hbiGylN5_x;KL!JsgBf%Q;NCht^G)960!9eO_gXi3uMa!@
ziR$Q`fiwsD`+ds5)l0rN4Hz!HIOs(O{@>M~JIt*ENL~0aYyDCcn<21=z(RKK?|Tc1
ziyLdIs}qVc!&?B|><dguSnlYMTPC(a?Dw)f;OT*cdlhRcN-$x6Mg;$Ey7uGh+OJ;%
znDzDhfN`7N-gaF<QJaPYedp=vbG-E8zmFmIRNC*7B-RK;bJyxd7_&n(v8+Tnv){je
z*QKPS1n1}H|MhbM_~K2@9Kk3WExUpFarIm3=@NDk^E~fVYnh<n92h}!MvG|1lfF1!
z#L1D#d9p=qt>?gCJ5jERUz&>zF1>Wl;o85(4;9AK%TA!0`ZWT$%$@*Ydr$ce$9<IT
z33QxsMomn(1H|ZIV?#qICjQ6V+{+K=XBUc6b>jHRfWp;OBw!nRD<cbV#drqfGsq@{
zg*G=iIr)ztGBOCbB-Dl<DKzu#P?!Ce9V54JtpC^@5jN;bVlJ2A=kdu}`!e{<xo7bD
zaG|<915ok#{~;7#V4g{kySo73+5QgrS~z-0Dx_BU>fmsuxFICco=iIG+C%!-x2FR;
zX9E|a@RNQ>%IZl+?9>q;)cIHblSF?1%7t&hrFkRZ0ATXSq|tGp3ZN@YiSJp$Wr8w7
z{Ewd(uaW<YKHvt|Cdic6lxz2W`0$}Eplh2O8Vmq`ZYnS#d>Qb{-{}@{sps9<*@@7R
zZ10lQTwvPWlf~`PHZ(Ru4x63<9h8ILI6~ho5!AJ|W&*6+mI7B?4uGPPE>*#SzW;ge
ze~1w(iFq1O^xW2UDPeM!=KvqLzsjii+CedAb$MmQZo=N%TR1ZK?c2AV4S>CQE}Gf@
zh!iZ(J0H(gD<&Yhj<LXD8<~(*K>12AMhmyEb<4ru*0#_kQ$cRNV^aU-^P0bu=ifu1
zb>&|o;3~u;qSkq*c~u#YN>R?T4d4x3qMmqB7XL@vcgIuRzyI45*+pfAP-I1A9?Bj`
zDk-awRAkRMR>R0l$T(%BO(bNOvI*IHuk3Mfj&pw3o4WJ){{K6FxOG43ykGCvxW@DO
zysnopoLT)2?8Qa-_VKKuyu5K>Wb9C@oHL?O%f64d+-J<%XY4C@SX`J*{{Yeg;;sR{
zqpmLWs;TLvgs$r~#-RrroEKHhcNi8DJ%zuIJp*^BfMr?NppZhLGS7pHpnk}s>IXcG
z_JqNmJ9qNo?t;CJ6p~C$psaYK#h<nkOm<u9z(u%G$M>E@<k{614Biuh;kPlUIaCyh
zhJ-nU%`b#@*L{BbUch_@F5#OIYqy<%<sH_4-XcI2>~JMsMd`}K%#6!6I`U#ET_pG`
z@KFfyQy@e7{aegOiVW@oQq5&PEO(Hf^V$U21)u8Jd(}APgvAP;O<coI=e{p2#0e9Y
zVWx#KMErQEI_9uS6wA*521OybhgjqGQv7l2?6f^Q4&6L!z;*ySaN-Atv(B0YSmw^U
z`g$Xd%L!RG?%b(MQt<lB4pG)FW8k@roauIxVc5xU^jD|MtNZh?Q7Si}$Fb__>L{X`
z?NVhd?N6`0XI`EHuVR#Ra%o(Qjg2i}zA`UQ{!8cyQkEUh-TJlcIJJ#6EA?0yg}jG|
zNr`hKVpMar!o~h?yzNtJXJ0iujgZ@3&+5nG#IPHU!ykLv+uPkrGw1ZC4U2~MVp?wH
zy4D;#$NGI0PTgEjhSL=ORxRw<yuG<jh~4hC*xC4Fz~)alV}CVTwVPv?UkdrTwO83i
zMaB(vb(ST8jgG@jKja(FD9FlQ0U1FdY$`_p$pC>dVvUm_rDUbPQ47?72oQfKXSp~y
z@Cy<%2k?j+7yGpc2+kO`5igUSo}O<1Zhd|IoFJ3=j<=teDuWmf`5*b4kpXA-zP76E
z%KG$)Rb`X8Ps2B-v=o#1{=F4g*-o%J{<yQ?&O=gOCA#0M#;&er-^e+le6Fp%Jyv)_
zIEaLH=!IJ;uGef8OX%yzy+0`Z8$wH>=YSt|iKm4{Y8<2tUO<_FoMf?_np=dGeC#?t
zR!XO2rgO3-BiC4V$FSUM{=~ud){H7jvsJ}{$4QY?(-k0q8W(G@z9@P5I^<R{ZIUz>
zAFoGy445yol8x>=@^aMv=bF(hikU24V;m@4?&_s`18RG4@B2622XU|Yad()SnTcJ;
zsYswuW}>2^PaTg*4n}=eKf|~4@xeTQAdrT#L??ewwX?F!Z9*Hj@7xg)y3I=Y8E&@v
z@cw-agx#Y-EP}gnALJZ|szC_As5mz>Q{bF%EP?hXL>ZTnwD<Gyfz_zkqLJ<k!c=v6
z<zY5QF<LWxgA7AEICb9)E()cs=eyA~DGM?Vmvx;G_SB|D;_6`y3Vtm2Nm<!9t@kNZ
zKw~os&a$(=UySJ-Fjm|ZvSY|mnXTd!!XYUJu2QNtN!Dd*8n&dcdJ1g+jBJ4Qcx$iA
zWinChG_3~Y#D%R?Yk;1YiB$6w3jw?#h9Q^YBxngbAy#&sY(88-dVeAl^2{Qk;5)zo
z9XxQL28?*F;_VX&>rg*6#Ynnuxa<vkmV4A<Pk~cuCt#xZgSpxg=KagM{ht&R6gZ6^
z0#EACqj{Q7hV{s99hJfJgF9w=;0XDjU@A#{P0keVl_sl!4jH4X(ZI9bpMeQj|08F>
zBOu)8>Rl7?9FwlT{(kNXMF{ekNvwiMUTvxvUGjklnve`Z!SR!~B2W#&+`#yvi$8wU
zUvr8L=1oXSdQYJge6+>Kk-||Ttj_r1j!|s?nyjxOKYU#!HggFAoPp(GZ7d=U*;{(g
zafi0C|Btj0?e6XlmLQJ-=NK+#QGa7;OVL>CO<3Bz1abj^dj&*lp8;ycJoyLUu8Z2y
z8H3t$5GRE<aCbMoPdT9$sef^2ge8A?TNFStE0p3CRxloTMZ&z~2|#5>?QY!o;o|1@
z(AFb4_UJ|*l!OSkCqaT|pIBU6EGcv25%Ih}YuqZX0D~(?g8hN*eWgn<He0AI#n+yJ
zlUwd_6VA)h49)5EwBCz%cB*6LUH+oL0s3@t*K<X#LyMwT@af;Drru1?%p6-Tc>7kk
z!tQZcm=@iIeD-hYUpnu6=4=T>F_Z3x&<7VV+_m@^Fi)bhg#}+UiN^R-8cnd-uNC%P
zz4VMq!*<)ZY)!APAj2PwQ|`$`7mJGYo5N(XfFCCM21Ddur=sjg*45Dw@hBr}4th+-
z!qTcb<~yR%C?tdCz=52Qnf(6aO!Ve7amHar#%1bPdw6*G!%@(x>!fh^hkf>LNR)~G
zLN-XX!==u%`u=e$4T90M5&HoA*&PJgz~}7j^Q+6tfh$0krw2K)Qo9oH9w#A12;WB>
z1-mZ&R34}Yn?|wCX0hH2bRAdw7N3@<2>E9LblM6->jaiNP;)Tn?#}zPd^70(p5har
z`UsSEBtHO2>E1%C?h%r-6!t7&DjtYE4h;<y%7WuH!=j=DdDyjXuoMSKFBPoFLu6Wt
zHnt!PqVNxi8g^$uR~Fw;P*jwNJ8zpOBpyP#6TtpAo$R}8baa464DE0fAe(|!Gc+{(
z<|;$f(b2geVZML^lB=om>{+ElyYIksdbJn!xx6Ep`1RVrOhQpHS@-N&S#;kWPtPtR
zy12xkDO{~d)lM@JP4?%2ngnvVLTanE_iDx{WLQ}uOg|wotpy*9qhNb}BWHgFig^^o
zL=X2c(^T)$7#$TuucsP*FkY`cm{gjPF+RPQbe~0;WKcLTU5l{fJj+HvPT&CR`k(B6
z`z-RX5=X1~d-UTWKzCHXPMihg#m)=^u+uCEiKdbg6Xm5PBwpOf9IL9TDvPi-H#e_9
zb4||8aj&d^Q$7JH&OL7oqHe%#E^fYo5WVjb*SD^&uJ+LI@RQD5Ne1HxjPfGo#Cmi3
zi7Q?Xq&uP_cgMfE<wHKUB*{0vfgEU7YCr(YM2{Ui;t$r%%FWHK0J>nW0_s3(r&Pjv
z6yyPC_078k1bNVPU&AtJ#AQfc6ROk|9q-U}OiWA|R*`B{nq9q0JCqDZ^xRwBlE4#c
zSd9Hy6{YPL-uj7={SyGrk~IsxZ^_Uzy#BnPKqjxKh(l30tkwYFj8orzkMs%q<XxGa
zn`3Y=zhWnKz%{NprEIGwj9zd`zJ2QF<>lofr4>L)Psqr;Ub^&nX}liNjpM2@@lKIl
zcH=t_B{Ut|l5>=q{D6q;Xn8#_HZpQ@3H5b#6z!aD{IjnsPB>0}90hxWgt^vlzm_l~
z+WdzW8>5SGCQIE?mtZc?-}UendUQY)Svzt-D_F-^QInddv9YaOs!uMCht8^AYudS|
zGAM|V+pb6SwEmT*JsPJIvUu7#cisJD2c`;PNk<!o!wAYsC*<W5F(|Yt*>h3v{@5(V
zAC6Y8#&VVFii?qR$*>2UQe7b$F8Uo(x)wsTFf@$4{sW0Gt^)`iK~rS_s0c-Ccq=pM
z|0eLS{m8dpx>s{QC)%I(XHQRJqVL!7+1Xh~N5^bOvf!@?B8^K3lv&{oaaIhJX<jSL
z>;<CdTXtqIH@=)3PjC?A=Hl{!i%Mc{LMD6eYbta_JgnmTT{os`Cr+`ot^@n^hPo{1
z6-_`8X97S$FL+o%I7??YToe$w4(MVw@QxOUV!l1#OfpRNjsO$(vV+;I!Q}LGVgH<4
z>C;T(g2kI2<oH#Fb#GiHs4ry^5<aux?TNLGz^>HK2zcB!_RDJLDD1d6e78n2%RADS
zdg@pVka3p#K1!cBap}j}``xNeuyPMa0Zab1r)p||EREM8tOpu(AS*kkHZw6h>(kKP
zPgqsPiBR*jmh7?R#lYr_mH3~eNm2C=Ak||P_eg!{K<hrrm+V=P@FL0bZ)+x#Ke=+x
z>Z+?v<vCWs&`nPz2J@DIyG#sLgk|;_&3C;w)9y24IKcrIUL~rJuh_oMlZL1ymNw!k
zr>N4_D{TMBqyOVg3ZG2NOuzfXpH@c;h5(o92<Za&tf!8oHA_ViYwEZaEH<|OMh;+p
zN6+#;cYm~Kw)qylf}3TBqBS$~TDaPVassXfd7%%mCc-trS-)$mkS)5yC~QC0m+v}j
z-1V}N?3PhOmqq|fwlam<E#Vb{MF7yZhgg8Nw6rX1KLaQITgjGDvOSSt@mS5GN6XBt
zf79ox5ST@ePer6YxQC#m$5sCL@l3W6R1`;&0GS?3%WQpMXZ9s!TJNSH{r|r6pFg@C
z0nA;W^>QdF0(pKt@!g@CQmAoB@(am*_AC$vWPfw``UL=Rsof$V5!x(1nAFcrl*#n!
zou<lt$DXya;&M`2I_CYmz-2H~_cy_D@?kMY|7SJr_Wbo_VnzxVwNnyCN3GghT3AlJ
z%glVZ0g@nP9{!J8pvP+=@naD7y0DHR4h%gSHmEA**~C`WY7MYB=r3qy6_HdDpfN_i
zBV>0V0g9%n;;pscX>s$V|L&diU*A!*w6x`uz)rNSfIdn92@7aeKrY&G*UPK0r?b-m
zY^^c{sBG#fU%`sD4ie`Xi1XgF?6ZI#j{_stu)Z`U53+(|AUtyc_^q6D0tO6ut)`bY
z3)xOXRPXmEJP`e!QYb=I*9Ju@v5ut7fTX=hj*AnrB}PUv!41(RtqwYP7L;{AuDBm}
zQ=gU1?iUp?iLE0WrT%I!3IgTy-|&P2)hHvm9bZ4t_D29_Z<zY%7|TLjcUaR+soiES
zo#P;(zw|byo4_V&EPfHr+Sf$_p#&rm!rl&g@(UF>{6=O;U%}==iMgevN`H$(4#c&K
z2w*llD>`~wYTH7yLZlXdcf2X+38`xu)zNL<WP6`-(Ei;j63mN28^VvtuU@&bTf+SG
zS^1Kqd&vbB!iT;rbM6fxg{X*AJ2%l+)U=4b24YL%h}t-|^4{ug)1_z1HlCo$&PfrH
z+~s@8(D3+o-`5&=KoShzgnb2N>-Lkje&&(<IgQrz>47JhDL`IP>yq(%a&p({gz9R|
zyn+HF&_=|-6@{(v#x%Rkta3W(Rv_>>To+0H6CTU0Fq_stzo&nGFY~?vm0zh75@?_C
zMne%%Q7Wd0Ol^asn&Klno;UFFZ+;ldr&}NS@$4h==y?GUt{Uu;FoxZh&RYOB^)y9X
z|NB#*50#OUN*itF@WVR_V7c8`sV~)#PK=`o<Na<u>zgHwZEkP^vqAW#)d6oe3_#X5
z>mXl9L%uD7Q~Y1u1R0I*);N-tKUw*Cu$EiZ>f`wgxlT$-4nbm63vpcmNvC2Aqmb<K
zle=hKw;0fqANnVdSiNyS7Z-hhB+X54?_$~U#l>tGFRkjV$`!Yb<;jF#;$mgO(rA4N
zr0)HLwGlgFJ$EYqKihOxaKfi<mxlh;;EgNDdK&K||6Ecs3o_xO3-$B!S>2tTyF`^H
z%UQ`?5hfH^;Aq;Ph~#TgO%Pj&_6s}%>=>|raqGhq#Bj?oGJflnhul7=3=h_SoS<TJ
z?lL5H#u9sD=jKP*yw`orP@_90J^9+-Y@t^3yA(6&5h@)!xh9W{2pSD0b8utVxZ#%K
zgFgWWJs~d6SaL<~&La}o(oP7~yo~HB&sB!apA6MWl?Rw_B^l%zKjK$oW)?J(yM04-
zQd$F_^YdEE6FFwe9VbXW_0Kxb(<#x*3s6M001@V|ax%Tg?S{2=K=Tg@8JNWQ9?u~+
zk=0ruC?q|V24N`a%<tdtINS)CgsDuQ&)2^<Br8k<X=<X+8gC56h2)x{BYB88y;I*w
zxaoYt-gC}tM)~EhU$X8Q+xfoA&T?CS%%46|E2*85%RdoG^Gb>-;(8gJhTM-F+}vUz
zDfZy0jxU7wXF%x7fXKH#G~Eoe3i9h)Z*VIidX<cO*|`&NbEQO?l09e%aJcV7$e!DC
z^wS?>`}khqRL#)%ukRB#IDB62%m%j}Th{wPMX99b!rMBi%qU1jv)X@+jfTy=6*54$
zaOcju$>}Wu7$Bi*rSe0y3iUUf>SDb%7u`j$>yGHRtzAd%mO)fQY@a*%%HoFw_Pf){
zR1X9nx6T-zcf6gk7af-O<YYN`jFUfTK8h6B{d;@g!hO7DTYpSejw@(@bMR*3J)jAO
zA*8~M$qHA0Y}Qi>-8&m=!Fu_5>n-mgwQ&W9p^6;1ZSC8kWfa19B_}7-+o^2vSlWkw
zfwy`_J{C?yje8KtXWiRi%MywU4{%-z@_pA~y(1*GkNumn?f0*cYyJiMA}for?FgAp
zlPRJcadFA*a=Ul02aapZK2oI0rfqI^_Q4sT|B-CbfHkg$1x%>nNm(plGm1p~`jQ<e
zRPOcl^f;^PYpg{BT;2U~RBJ?sChde8)6WZrhV6O<3B#d53Gc$%?LrRk1ZKA9BcD%`
z!~R_xie}<jLc(-%e7wwSNona;ISGlT@%EG8!Ou{{nbAv_gJ0qUuZvx4v?%H6zA5#?
zTc4uCJ6v&NBAk=0ex<9uWR;XtyRvn`yUFA1WTNN~-`B^21ws}q3vLlx&5qs;%Y%S*
zq}pXHcY2RY4>cRl_T!PC`M3WPF#DB^o*I-yg*1q*jh^J@;LxeQRvGJPV^fVdOC;=O
zC4D;XafJFgK*aY)VQCr3T?fD3w-=G2O0S%qhO3(~DB^^J?b@@<^#k91DVyp6(KsO?
zF?eqm2B?_C>t*+@W+Ry@B&=xMUE&NDSKmJyW<3*)!H?WVN(i<LMnL^&6(#v|ogoZV
zYJ>fXxGnIICq!k3)yj_^G%MN)pn681SREm)7jx-w9vg&z{kY=9#=x{O@AKBy)`8^X
zCr&)AwCx1lyeX@y{V)9shB=*efG&Q;9(b&_+Ll+c(%HYB)W2?a_g7dYm)CE!*Tjp5
zKJP((lyy@AjlT{N`)^2k@gBJ!5|fhl@TQ`%bA(=Us0^9Ith=0<WygQaFe5C+W_FH$
z|Nh;6a<#KUiCMl?71g%y-~2*B)!zvDddgCxn2Gh$BoHB%D_Ea7Y_hGW5<pqXbbM}H
z$O#S$4b7jKu`L)2Z0_%$12(zlMvf7L=~?}5-tBG*S6IK_KPaVoR@uy+fM2hhi)|gw
z0|GSQr-tefcTngo+&h4BK6!|+(C=NJcds_@UXNnJb4~iwL9`J;zLo@*MBgFmod+W0
zFEBnkhDP1MT>vqI<J;Da5{Sq$Xx;<<ku?a_5cdORgGt|ds}FHsJwd5E8NLv7FsX`L
zkI8)SGBfFGE^clHf2d@^d*n<`P7a7K6R@R3_0|(^bS2(%3zgoFODvkMF&_sm=Kk=s
z=dT~^Zu?4xr?pm6M}^c*@7jT=xQYC6fU|aCE<c+TJ(7vPV3Rd^FQ;;Qf4-!#oCBpa
zd5P!Ak^r~M%gM1g{alA$spMt>R3I4A#d!?{2@<B%1ZBWjjBDS?$<1|n+@Usp88YKq
zq-tdx3JlS|I0H~^m8kV<J)hX8K*syqYgmDLmILkJAYs7TfyWn7D0{Gy7YI@9uFcTH
zJbfGaw$gux*VtaxdukD70uG;=7O&P^eJ&K7Tgi>abFa-MAK>OTEQx*RvjMh>+FL;i
zB$Kd=NOi<N6wjx7bNkr3;W7AX%sr*b;L7QCne9BSAJIG`3gO0!2klZ`GjnO;otk68
zEPx_<<DDm{YAO)0KL*ft(bD(YF2)VfUe3DwJAk*cB#OV`nYe(dL{oUr9f-jVf{c*X
zf8UOAoTYY$xNn33cptM~ka|PxRM6C<?*`k+@#am9?tqI800Lh<4hO^o&Nk@l@#84s
zx&h(x3vbz3pu<4TDyiycQgTm*SO~|V<cjU7*;5D>a}nJ@#PEJ&g}dZ{OQc6Zyc4|X
z2zE7?ycS6%3Rw5FO*(dqlI^VW=y~zi@sn#B`y4F~zy9t5>usyZODMuHioi89WETlQ
zi=o2CL@Ig{n#3g>Vg?;;1xP>)$({pKl7$&6eaDGj6hto?R&rwfsJYhg;IeowpZ^_;
zvU_z=5kJUKiibVi@7W`PFTt$o5hqc_=f@QQ2w-4f$N@8<MU%F|Oof;@@LsK05JgF{
zkbP&*Vx)YD6C7mycaXP#E6ce5Ye7)-w#!;kR#wE-_tzZ^A%{2njm2?~W|YB+6;@YM
zqry8-DSVTl(qS^UfZISyK%Z`g<Y(_M-5yt~{9-@&wX_NAl6WXQ?Cs*LTdCJeq2QSW
zn?}rLCq^NyLp+3jY4phyM7OQQ!OTl8jR?5=-Tw%4UHc*Wx^|NV#nEa7ek!{EJG5jU
z*&q-ve~f$eT?O@VHXFECT+Y?^ZDO$)GN5trMB+o@Ja<VMw;+x0J%uT4MiMB(0svsC
z7HbAVWidPFM93?NL)f<zN(kf4OtS9kjla?Lv9y#3Zg=>xr-Vd=iV_qv#*+vIqt9yK
zQ&Vs+uJay=edN0%#3<vW`9lP`i3ew$x0Ns#{ow$bP-~ES4CdVWZsv`3Lu0!_%<w~V
zMNk3cwy|=1cHb$0U297~yhA{3B2~PoCTmq+=>*;G#3Q>QF%(0Nw;emVEA%67G%QAH
z!%vPkVjA1p+I;x8>f_EW8>Tk7Ck=gt#NzFQc+91@djrowkT{sLYADqK3=foeBnt0F
zL{<h1*wkQB?L#}KaQ4FAJW<&)d4g=@EJo4f&4iOlog)xKTJ^jO;ZxxtlpLHRB7F*{
z09nw+V-+XtNQ0bb3+GBOgb_j1`Y-^vlP|NIZsv!ui5(rf{k=DTbE}`k2rsLO5^<%J
z&_2G5#S*jRsQTNIK>4p=CI^b9yesdGU8cJDni>&@si?>WZiM&_*fB^JmD!!`?HRR-
zxGy?2U%@ub9{azmUe@9tWGb>Kd`vV5x0rsl$uPLcQG#$(?V1sPo91^5M7b;tI}<Fa
zpwEgSdL<;G{>CGcrAk^Rb3`#gh#fA$l{5Iv9|V$Ly?-IhO&)tAwG^qDZ6Er2;cAmL
zx{tIK5kf#IuI_g~qmQS=OZ5&=zw~0}Efd*Y_nlqb?IP<AGj3n$`v(K#RGM<Nh?@?-
zrD_7pFBgJ~s;ysKbbM6YtcYm5oXe__%7lSYfJclFy(nriGF*NneAB^=*4f2HVft$6
z%GFpDVIiFOJnS$v&q4-zBSW~-8$vX^%p0>spuQGwq?CfxB*+Zc)417V*1p1~%9My^
z<-CElbay}1-PKit)L?y({^3{s@m2Oxd~))KFg8x#)AGQV>rBpJq|^?n9TWM#GfE=g
z`b2%<LX5WV&<2a~os<?mA;*HCvnK&L0K6%`|JBojVKPG<*~X4s9wU)k<TUyzh78HB
zxl3nk?|K0b*dK_RRe>nEposuFdlYUV9F51-Bq-4<!%LN}+(!T$LdQ27&e(^6J-&EH
zd(uUhme?O_Yxx&6GwLX-IDDC{(+1+6^cn8-*VJFp160Ux^T{JfgqCi4T)XySX3kxv
z^OYh9$v%Jjbip<uIk^Er=@EW5mjHSFRWma;NTEIm1!wtKSe$8)??f<8bXR{rQOxc~
zykL6kErktac)E=q4Nm*Ol`VV+pmW^pZa>gV_;eKExp82a+=tT7#L6XL+=-6RJ?Esj
z_`n4($$quo@PW4B@QZ;lgeAzeYk|*0*t$_@)$w9_k(FTj1frYtyM}9FL?0Q5Z-5r1
zdJ)-!Mow3k!~Yl!ia&Y2+{39kHx^L6@(qT+&#TG=Su#)vve6yZwzj(0F}Jvbd|0Ew
zZeIk*+7hgios&}wMC_B7XM3UWpBz+nw1j$y&rJvHBHzD%j{#hRYhM0$GC!CLVl0FF
zeA&TGY0a$Ei&oip+HYS^;vqY*fBzBI&C$&FS>E_un}Sc?kN|44kQ^ba3q(<Ek7|31
z<hN99BOyJj6>&#H$f8MJITDy)FDt`f8zDj8YaJ7e2G;sG3sGa<VhA%q_C#9)Dp8`)
zODEAwsn}k({`U3Z;=W#90<M4M!XxyE&`9`-fQcK#r9&$Zt8y-POW$y$I>5nE2YM5J
zrQPi}Re1&7;Bu&r@s1_6=)?cEs;}Jczc3nm@LNz~%u0WTT3FFv0*<iF>GjPJ+cChm
z5N?(P5{r=ykvt46&OMl{K-3EjCBBc3GncFtrj3Y;P#;z4v`N6&W7P2LqWDEI;-Yq|
zX^=PgveVrcLGF?j-u3DWlrZKr9tF3+Od9i9!SUT2b?h(I7dx?p{BHx8yzQubtZJe1
zFuKs%(Ds(UxY`f~Bm!ALHVQ-^kJ#mlaO-zLXtJ=dFz_gPw?)d5o_+nt;c8WDFE6=+
z930Ld!Wdjbih&;b%u}Q1AL75vIbf(@TJ=!NKhL11KbSfJKRpK_%HGD@ygasByZrHA
zPERk%Gvos13mN%Ukc$b8y^COc1NIo8BK>8<7i(g>FnDj;1@i?i79vu{`RC)te`;H4
z*+Z(aWT9F`dK0u*U5avY!tEI2Aq>I+4q*^dDyISkfPgaIX|_iugtWF^+WO{AAsTPi
z)V-9ay98qk!)mVfZ?tiiHir8Qv0&DGRGkVkB0-j@u84I)VaFlhT2gt(dJB@$`e4eI
zFVL-VmwOM?GJgFGeJ%>+8xPMmxd@Nd!M+CwpcYOb&pfbL&dj8TE7jL_BtQR!$#!T-
zr&mnOM2!hPCT(ZpuIW)b3!DZ?+8pSHc?eC}6)0FO<sQC|p|@gyYPe@^&Vy*V;1-PV
zaXQ=#WVVeMtOo{LwS{H0Kr}U1m_gb<wt}dKJ(hryfHJZYdmk3E^~Qo=6(zM$a=1gV
z-zVsyG3#;79+uVk#6*$ywzfpE!9KWi>EQ~q-Xvkt^a~V<Tz|LIAy}8A2e+-(<}P%e
zpv1*aC`i7Xm!BU83d0)^A$Ed#DNtE?1cekId~trQT^sxb4(02i(mGWr-C2)v|IsEm
zUIQC4TP-!RwTp3e9pVJ&^Rb$PDIQ2ZO~5x2@r9)mAte(G&d&@o&UWVRb8zwioT@ob
zu)+_b2o^cW=#gZVaeOpWTE#c%ltW6y!3em(l4KEkgrm0qZF7HVbAP6ND6kJ1m5zUR
z2mIIVz<(R$$@#tt8u5a*s$#XT$wCANW}@*IXUzpOWqfL!SdiIrFGSLLxw(78oFJSY
zSOWvbfyTc<%Kgi2ts(9R8G4>o0vL`bpb4y3Gl%7o?Tl?fZMHPV-VXQLy@o`%Cn4N!
zM328V$dHTy9p&k_-(<v0i*6R)ca2-KzI#^>%g^e~b>P76Jgp&a^j)n2?oKvP&G(j<
z`^{cF(w@fJ+X4*Cg(1Ozuiz`Uhd_Q3`E!|VL*%O9TMplp%c@Og9`AIEcuCJe^R%bB
zIy!-CVrGkw+1s3CnX?4<bXMO?be%}fOq5Ef7g5NlIC13?N31r7FXC@&_G+9};NF~2
zC$1xfa*e$ik5p7ZpXIKMbQzFs;685r3Kf2<fRr*aJWvT(_I$iblin-u?r+&*U6(*X
zN=X{gwvN*W>T=;GK+U4FeAGPc<)l^daXYxBfwL*yTe(-6t?p4mQ0-_xbTdI!cxmFH
zUglunaeySE;?(Gs?7Y2u5teDLiu6_Mt^3fT4mS4}Bs)-$#a%8kJf(X+PZe!rlmgdS
zkNiqqfi5)zSH0yFe|ImWf}$^acAv*EG&jfw)+qM{6s>~9XY(@MWoPmz#v>JI=>vNT
zh_5yWU((UhJ%P>%>{)PLAG!b~lP<#(Bt+QNWOn7UvGD~8_MPxfzVKh2&k6Mu&JZFq
z0}5}i2!(u5aw}tIX80)^RJ<k6Pl>Z2QV<FWJy5(el2)&)>tC6~@@Gfl!V}T=93X1{
zMC?B&v*)mciSoVWbhC~0InO1i>d!_}&b*#u^G)GC%hH*it#1|ghqHwBc6Z+vJ!3oG
zq6o4_?_g2`TyNx(-a%#pP?@J>kdRWQfT;01)hoS2YG+&#TaLzWpU`^EL=PPbRtlNm
zk5SK6Pd^7X{f>u+Oob<q`8Sw1;d@3P4je?7|MyWp(3&J^qi`fu-IB5z!C=6x#SR1;
zC-SHX_0ya|t|MKkwrvd%TLuto$L}?a-!n@dCqMb+16U&zfY$`HO(!=WjR$^VgzUnb
zr?lsQbQ&QHhw+yBw}h)`1KxFis1!;DYoRVYgt)r_g=j#5hih5OY_2%ZtoQmUE_~=0
zbXlko%Ko}7BHrHgvl{l>WoP;IL0_K$h0T9iU(+qfMMgovL~A)4ggar-`)NVo6p76+
zP=*O{8uUnU`BJ(M2U`+a(h#RkKDNQqPMyc)b`j4~bA~}-xi-^#<~DI03K7uFCJ(`|
zt^j)U9%a`b86gxL{J|z<-d2-RR)C<7H@pl2GL92*YwEeP-$3j#RI2qo4J1dJ6c^UK
z+S~RyUEV?c<r@r^I&K+va6jf2yfL5;5_x^RfLO665@a$$!Wu|mCO}Jv!?D^wtEx1R
z0)CLVK4Up&SLvcomMqUiZ6!U9$vQg(_x)6-8t9$63m7DlfM;czxvna_$8|u}VWZ-7
zj^gy_WbT@)$=ZFhwfpcM09%!2yZH1E{9;j6ye~sikoqX|E2i+K)PYgpPQY8v<P{cP
zt=bf9TpHNT-_(dyV6h-on>Mp3*Z}1V>a&P+->PW#1Qzr2<{yM>Yx)Q1|Ek!N{8VJl
zrtI~O2&qRbKGdeatB^$)JE*@rAuT-$$s7NoM0?{s2-b7hv%pyvL6~7c0a8=2^&f&Z
zKyCI!1yztaif6h0O=MQs#^CVk>k#w>jJ!uSevq3mSh}=TwL8&x+yUgu48)0W!i1a;
zE)VU6g%SbfIKId*Ipz(GK$Z%WkA62)`G`>Iknz}JZTED;#?oCg0GoR6p7D%b{F-{@
z6B3OfxZyHhYan$^jO9X%`qa)6Li>!b=+W&%;`AyJJ+hpWpD)C8u7d}z*6{^FLI4dS
zJ1>NS-;$3XBOxNSg8HC6WL&CNdsX!dNa9H}DkErKWo9-~oQda!t{#iEWAv61CNWFl
zx7qN4b4l_ZlJAzr-F!N~kMfi>Ss#1*`R4JMU!+wOkPE(QlkI;BX(dt+g^yK1L4<Uz
z6!=4MHWxvQLviTm#>STl#rvh|4gD<N@5ewrbTL$e6c7^?y{}X@+7tdkSiW*eJ=;c=
z(=QOIg7(sN&e;`tDR>PKXj<Ib%Gj%6C~N<!$oxHD=#yqRYy)A3P!5-`Cqmk?XY}zb
zkG^t13ib7<8$W&*_XvSc`6nDnVN!k2Nb1u(nRYV%06n;|ww)Nh3iJ_25#~Tez(;PS
zcFjPt*E2tFe-qo*cInmTimVLrrV-TNL6O9!y1tofBXi#WFn{)j|ME!Zfym2;bJ)et
z*eNlS!da?b5XfJ;*$V|I5TPU^wto|PR4jqYK*WKh=68o9dGp75$_Yf-MKUTurUQcC
zu@TwNA^PU8Y0oi3i~J{Xk3OK7N%oGB0r(@lKDTcl`3)xXF~V@;!CT+a)tl<INK+1o
z&UWweMLOl|Mca<T=4YZ*0+v9!A_UM(N-Xy=ZHlxBDYuJsR@fal(Lfm0ALR?De-GLi
zf6%l|nmI>fBDIm3<n^Vr*zdlROJElQm6$gz0XW<B6$4&(6sj6J!4?6(6=9NZuPkAX
zh#(C(E+3_7UIf-5QdJ@%5M^YH(O%{wjY#y;p|RAz_OZHrp^|e~fDVPFe?qg0QZnxk
zG-Xo*BqEQ9QEM4cw#H=sVr><gd<>P|>#l|A;USTA7*cseShN+!uRO2-nE~ueee?Jp
zG(SnRf)0o8PD--Og!C_v!_J(gQJo?r?)@}h^)#Cd$&tlduCAYrO-%M!fr4?vG?dH<
zAOdBM<5E(Vk!AuVySjnyMpP}`yx)+3Axp$9x#Iy(eu4Ak`Msm*%#^4%!ZEtelt)u(
zgzojOE(I=K!N)$`OZxK45GIYYt-%pe0poy_QfJ*@+2iBf=$ZRL=qVM_nAS(=Z4;0D
z9Qg3Jgp|`?rX2{5KuT3Vh@T%Gd=GW4hCMN$h;JJ^FRBD;H|1A+FY3m|UPfDlsYrp-
zKh_FoXcP!V#x@Ok{zK<-Iz{#t9A0=Fh{`yd^hWEB){#T!LP?@=dY4~c;pJwU7HMn6
zroaVH2UW+PGg9vRt{TIxDPei*VHZ%dhDSHFXE-5=1h8Qo$iThC!;uDzB;PGAd`*So
z4lSO;AD_$`4iR<)@%HV1sVMpv`^-im9p+55L(qhCP#k)6QA;&UNtuyvA>=dY@(ZB>
z1`ioCQYioR89?6!6BPOpQ&57&#+T>Mp3!vkLT!oAGi~03?NCtqjGy{B^trh;b1=1d
zYV^P_Mca@Cv+{L82i`ZqDWw<Qdf&=SMDx!sv@^q!J7!yac=s;Q7Bbk@+ysO3@9I}}
zhF>52(1fj$dVA_@z&f>m@+wEjkQqVGn^-u5Rsfe?>j$RbeIqn&%LbQt$J<*0YA73_
zDyt^@9g=j|Zu0qMp&_{ibG`^iHS26Q#(iklv2oz6<7YBf5K<{MA^d5;!HCRn)=rec
z6n+sZC;^Ve^hY1f1Ws&}cH&xi3Y(V{=kGN*Vvik<3{tT={Pc~MoxetKbeG6|m8z$5
z9JYnWynTO*SyZzOW}$R0e;N-_IB-BoCoq<wC90=sc;31DCFkr@olmy6<hiu>9Tw<~
zdiaFSPBr49$c4STDfuI+R%US?<D01QqLX^2mSnGZZ)yG_swaQJCVRDE6TMi*iyJ+X
zKhmDQmDg<%n%R0wzt}V!P-41l_Cu*m*+c**^~fHa+xWdcjtK|YOo4**5J}bNpr_hr
zRxxSC?D#V(|9$j0Z;<dJA6cJsi`wKy5qoKjT@wH+yfrC|V=o9|Vh=E9x2#cqEu!;q
zU_V6@4+|p~D5a!Nfuc*`^y_1tjZad;g{U7`9ZoNknt0hhtt!+V)4<5@pvG--_YJ<?
zQbYIceqV8(HNo6OAtOvfNVcVG1pn1Y^Q+O0H#YLKvlo?~9%92s7yTOG{=^o5e)QjG
z!e;MoCgj7ZPIE&hqKT!`PMol@GA&E!%DpW_DF98A&P3D$#1k2#&M4(H{9_N=!=n>K
z6dTpq_Y6(x{3LU)><My`qK&BVQ{W=A6Twrrq;Rlj6K~G%(ehvMR1k};y>_LziKlw`
zc&C~rUen*lS#D-pa}1M~*1?~^pcS6mZA-ytqr~_CcD6TndfmJ`ZgqydT$P5^(Fm;w
zIniy`G=8O;{5zWeO{a>A9^a}j%hs^XHs(BHDQO~RekiE(FxFfH=tuV@3QdsLa<(}l
z9$GeRe`>j96zTG7>FT<#anrMS*6`@wMoNPD0g;TB$u&)qh^N$N<{4`I4=XEu3FH4s
z-I8&9Zo-Lz@z6AbX<_K;UOPi>CVcc0k`PewcGzhL(y4-)NM9hjY0->^@DVpe_DG=o
ztg9IliDgu%Mif2SbrQy{8QuD!@cuGcC^Fj<Ym%B&$(jS<!h5Ky9t1dEW{#yg;~V<4
z`}97pCuC0Fpvd(Tqz07AjG#170VTmRhf3_`t4nWf&YfkBI6mtvE2^#cYsS@Nzj$a1
zX>H{v_b@tCRLxX$(FxJDN-JU{|60ank)aj#xx6dKD2O-r=fHgS8WukOa+ijnsf9lB
zWY;$WOpa;?k)I{%HV+dO@!v3;48jhVZS9FLiP*t00A{beq-_LQpri-4vQktHK1fFf
z*irw1gO<|{!;MLD))9MX4ugD|xgUGj;}^4W6_usnQtfDVZFA~MSp?~;?itT2s=yT<
zA)0vKEFIj0pr2w?QJZZ=KL2!hhx#6}qx(YiGg_LI4pER4G@Gq>ngl#zta?&y$@s+b
z_vf0&2Tx{kQ{ke2lll8fbw|(!U;oMQZ%Vz-iIZ;)y-6Z=x3feQ#Ym0W;ZFN=M{A9X
zJul{v9x`aiz1=Rb#Cwo&?2N$k?!3F&j1&hfqb<psb(HKPPMxx5PKyq0AK(l+PNpk~
z=kN6XL9;Qr;%Pw_Wl4XOb@#C4iY!JLdw(EBE8V{i^|I-vPTTz%wN(s=-0oNe+UDZY
z;?exoc7X#J{tlaGOj`$g>qklk$K9aA$giGSJPVH>zS@60$fM~uYJkiVz^`}lo{UmZ
z#5oD8aIL6)4!hDd@Z<5pK9KFOsYd33=tfLLq{>}h?K8IsnDp*%x)gEyI(^exZ`s`7
zsk<t~x?F6RCtNMXo?+zoJJtN&;;T%i<$$Q`>E|`OW<FC9HHylaBpI$LF`j28k^0=7
zZWPG)=?MiGtH`IDUwk&dU;$oGd}bHT|KH(9w&m*|%;sAMOD~9@C4zQC`LGDXem`;g
z{Z7o(WY?hr#T>SM8b7;#AUp(h;PJd`AkU$o<106RHUgF&INCPtVmYzENWt&W3EM7o
z!Sv(hU*?DM_GEL@Su#>s_P5(A%`=SY`lGWrU&3a-@q&L%y<dG5<2>KEGTrV{_>qnc
zA3&%6VNaCOE9%vle`A}l`A))v%w<YOXsze*q)mY%d&Um=j!m_`Wlx{uI~d_TllkGp
z)U;1&=HYVj_q9|~9Q2WtLSL64Yph=jIDc(5S1Li5f^2em#<ly58n<RP*`aPd7~P7S
zEa%6$Lj#rO8~gzg%JU4_gkQI$1IkiB7i~#Y9^+P?4^O(N9h`ogSk~3`tiXQIKcCrJ
zbWN~)fEyXl_GhEae3v-#Yf8rDs33KNWsSuB8c~ww{&g~TU-(<Xsg{fjUF)Hgy{SF5
zsjARp>1E!hPk~Y9eV{h7uA~Hj(!Kj_>#b)q;K<ivv{c)nnN*sw=(NS_3(ceX=KK`+
z0R>GmXU4SvtZ^HLhb9GjHY#^!>IkIzDbc8XwFgT~fxj6qMnTNC;>SI0Abk6u(J5Wq
zwn9xUjZRh{&+m8SKf>^mR2hJUUk)@Brx_WOQ~58K_P39pwCkB?qLAVWm*!(6^X}n$
z003p?mG?hf@<JE%FV#^}6r48~?GC?+BJ-JA`2rmRZjvziqvs#JL%Es=B-E>&yxUii
zc3?SxPBo6ZT-p6`9ZK^O-~ZSa>StnG8*KU0aZSds5_>-sO)_+i$fl=xS?*gW+y23%
zMJZvrJ@a<wF`dHfZ018e)=>I!+LzwnB_avnGsEN94$X*S>(CWIq#SauJpRr1a(|(^
z2usVCL%Z67&c~zYON>lS!vH8YnP>Ps{d0g@{+1TspLIf3h~X3!$(H@_R?0trl?Jce
z6DmyofQ09y?jnbuk|W@SG|Eas#rKt-C!D<d48g*Fo@Jz{`g#0wV<k<W<_{Z2#veeL
zE`S6~vF(=h9{jFv_9Omi@m>hk8)B<1e}D?H3F<fCoO$Cu+tq@*Tqvm?Upjyf7)X0-
zn5pG?b;dWNZevG8u<gsZIfN<?I~ZkE^Eh~z6CrcW*DNcAyQ6?8zRw6C!Y!(A@Lf5p
z#lWqMFRn^Jmlxy9SFRjIs>~4l!!?l}JVnfi3uWW@*w~xZ0($qEAA&8hzt2_pj$SKZ
z&l07(oaxPZ-RrkSg#4G8#6Iesv%>EhwdF&-l@8scGV(RH5w{;L9{}ecJr0PsX-?;_
z_F~h<Z(ab@NgjACPp8j1={3CIzIgAM$q&m`Kmj%=_M_+7AG~k~uR0M}cLqE}lqEs=
z1n+Q-&!K?G3afg?H9pNF5<8zM@^>Y&4n3kGm5RO{;LOMf_|!W1)Un)l(}X9CXZ?No
zr7?=ha&Bj-0{lu#O6;J<Mjm&{r~#(<Ve_?;IX!=GyS}2J461S!A!#U`doy=vo;v)p
z7#9;h;CU)c_;n}UH}{PAw<meWPkvKRrJ(m|@7mJ%<AiB%m=zw1rt1Vfd7}3((!*bk
z<FhP<I3z`5p9v;BVf*%c^hXv~-dVXYtI~f~=@Az%>-PJ+r}@l%E+G2~#IntirSr6<
z1BHuM<Ls_oQ_eV}nVBXMr%7cwrF`SLrrM#{PU?7{d5$yZhiJoxBne;`biuGbA1yf=
zvpbtU9^$|+dqSdY7mW+DC!4KyjF;Q8$l~eN!<)HivNaWWk4NyQ=T}fpJeOkEay{g3
z?c%ahCaw17LL3!k5)?Hot`{kng(qF=xd)oqxH=1rUXAB9?++t}o`q4P|2!yD<R1^p
z#QB8&b3DZoAWh%3$sDAH8OWSS%9R>X#Cs5oylxp<Z+&a1!1gnMgj-&~PZ{h$IS!I4
zJ6X%Ur&oDI+O?_4uPJDjHIC^2Pq@4N2Fo`eVKr;~CkISHWzd<I=~A`?Z%Vc5;X6K?
zdvKhpsKkEo^aPdMS?=gb{4(CIz^-`G?|<fcd)oU_oOvQ>>l`vO$o-?PF)s%kTJedX
zXVju3uD!OA#~wIyOX2HI+qb<uDS2~BWqPtCLVJ0nc8zH=MD3o6<bNcjP<-|CK~(V_
z%^2Pt7UIu85#-@qbGjTa9>1Gji<&$=n~IZ0;90U@uE@U~%<D<x`f}^kG-1DK$Br!)
zZEDknR!%RcCXBrr$K@QrHCxn+{rmeVm1WyrjMp<`!1G(xFBf%Y#<bz+0dBU5Z_ju5
zlYjr@|NCz#*u8ql)J}NUvkw~yY)<rPn__bGtba%NINz#1_4oNH*taLoH)5j(Z%lnm
zPG<MM?(V#4slFWVVJC~&RI=@pT&zw%{XA~=o&EWw11L*w(T>4r*Rmz2uO$Dyo9CB9
zj1vc4*IshA@zd|#c<FVVlTpf>k2Amzh7jOSs)THpxfd4(!b=hlSf3|Fp_PYxA^iI<
zJpHb$M6-M2SWtk!fKlMj_8YiXF4^Pc0r0PFzHLozireKce1rNnLD8|8r>6$S$4AU%
z{;h#*&ofQ}C6}#Pcm47~8Y(S+fBH?^C(7{HWhwJ5FWJN*<=y@hB9i4K)z@bq#tQ}e
zbYi_Jh{lY6=YrR>u!P4!oH3icTHo98;c}A%J4|5MvF$lfP@d$$eCu;dFFEhVnUs@>
z?xZi}7nxK2dy<#=dp~{KtEm;J@UCC<m;xucKa4&9@3ZYyD*a^mbH!!p<~QDPigpjO
z-QV8$@Uu_z<lzRI<${rQa&M28a%DO)nEK%d+jDle<yxmtlrN^5U-JjXnekjbeW?H)
z{?Oksd*&fe?Y73s6lrW=n>RgVuY5|lTY86`9GUo2e;$8z`IL=+(uHcVC)kb9iqVqG
zQz3t!K2hvsFw|^L<W*><T$6u84EICk%%@^|&MU>en=oIhD&3=>HCT~4x-rBz-CRC?
zjh%2Dw<`1BAX2a)jhcx}6MI-PNM+BFiLA)>65V*@B4BZg_0~=!Go=3YKHfRl%*_uI
zdeWf9L)2;>NKhSC)zW<r2IpvZB&&UQeX8lrvNt_Sg&aD?IOCUzn#`<Hy+rI&$v`-g
z#aGuVgJA3vG?QhRW!24Z=Sd6Y0>1Rl7Ti;8Ec<UerVI}{xvpJx?a<}*tGhtNtm1U7
zH{(k@BH&*Zf2G^njRssU)Os6s+(kN~v%S7p9~n#|T6c$ub2i3Dah9}AuOw?{6Lqje
zU7ZyME}1a+hTaO))=M3kr1jFAozRTkhzf8i6}0h-_E?yI>$+z3Z)S#X-j(MfV*Gj5
z$V@q!i6;lO?q7TMP4W@)DhY9<$SMd$o^78N{VgHt5}Da(kXr`LlSdJXxG&T@ILeHU
z@ZXoomfV2v$y;4G|0dji@y44ud&h4B*W%G}d*EC8Z0Qj6A%&sn+mv&L*w0=Qd7Rkr
zE1ppG`9^ESrFf^-TPxbD#k5-k-`cZ!0otF5bIcpWC_0p^<dGGtmpO#Af`zT!=Vl;;
z{2gxd$q)xNl96me+T3qVlXr!oN>}#Lm7{X6%wT^nIqmqaXzkKP;Zn)l+{Bl^t?{H{
z7dL8S$h>$u1Qn94%3;cqer!)VuexcPo;D?Ayk{|iW5=>5o5H4g+z6yE5owzkU2+C1
zpR|{T0nVJW{nkdJWhdDhl17VLU%s4c)PX*Bw}I=unxeCSH!180M!iYaN{Augu{Y*S
z1{z0eV@)tGG&fkKZP$M7c`#wNe3>3{^}b_&ri;UHR`_-M44I#JAHUm-yttwQy4VzR
zZT`Ppw28V#j98P2uQ`lhKSHhHakGXO)U6KcVbz(Lm=tVYASTS)m&3L4aUqYMN!)a=
zOtrHomfm#uE7#GO8WhXUp*;`0w&o^g^5xU*LRw;E#peC!gS(?O=`A;#PM$AUnoM9e
zIsk)9mfAv+QW)M{D9B9hYgcz;V@O6Le7I#Lk@CO&kiw8+#!3H>&3GS=;Xa+A0q)U_
zy}h-TJtHsAB*n%1!mRJI*fM?I<~qGb7ComTPgUzN4-aRP>W+P*HLgOwanq_FOZ@Pk
z6>g%w#QuQzvU?`kr5q(1;Qq#-DQ$yIa5G|3@|s;D{56F`BBW}_&JcPXGF46KHubf;
z8zYk3U{Zk|JC2d5+~K3MZ#Wk8lotAIZa_9?xF?%b`AzA9pU;oU^X7K4Ps#asQv~nt
zhfzX$IwqRJ;3am1^ksCxc=Z6^Jas_vBP^5_O|;(1?ayhcr};0e@gC?@tk5Hj-6f2n
z#a?HdPUtyzR`gm%)sRSWuJOUZ^casLX+V>~%&S7{C^@?xr+TW9=Eb3~q>&Gt6vRix
z5$a=@9Xt2Qyf^W#b761)MlE_BN{?al$u{V;uWM1#aPC_kmL!*;h1d2jWjE47zCCwR
z?)J<6WO{<;1g#}uy=PnzTYdebyDoB&w?ACYO8^z4is0k6zGyY`u*i8bN-?ET!i6P8
zp8cRRV*s);xbiIn>v=1k+^1Rkb96hkXny2VHns`ZpEl<<reVh7Cih-j{m-EB%6`2m
zwV{sQ0F5iL7BW@`WhLKnO||Fbn@`*mON=77)*H8-O?yu1n8+vacT_qV`9y`HX8pU0
zpH2>77Tobh|Fham3M$2>#KF=HL*mrQo@t=I4_cCGVKs-8qx!8|{9r$_?MDvXUBfMF
zpm);vRAI<i^?m25CM%+YA4;|ntd!BO`F(%A5pRk*fLX-wc2lnzJ+ngBV{k|AkY!Qf
zy0|xAO0A9}CxVwQZ_XpWZ{mpKg{hvk_iJR`$^+rrw1Ff%W#89<l}S7QnrEpo^uImH
zq~Jeu1HT+wiXX+8nwTWv3Bd$)x`|kw>~OD#l*IgZs5%0CZ9jurG#tn#gW)Xa0!ZY2
z3eawk10s=RcoO)dl?6oKRsa;NVc_4TdNd)?SyCxRtVXR1qFq6OX7)u#$uQGYTA)=T
ze);ND%dcr_yE~8yq~!T-L1z=Mqd#C~)DDLWtQZHNBi1YF$3Xw#X$_tGmH{<Z6o$$A
z^SMi!P2xRBYnDF`0wJf{%-A!}V16wa#rCd5_f)w*XT5xD|D+8&1^o5!$A6B2y~ZlH
zp#iSyK$k{oLRw#Ivl$F#Wv;&z{j~ERoI5eY9$raYuk?X?UiLL&(1i7>$AF4*IUK*<
zd^ad|lG)r;)=LJltrPFJVM>L)VKj>}5etHQ%2Dl^W|*Rf1Kc{d#eNb6VLN31o9N;_
zGp;zj*xFGsGhnF#+=0UV#L<CB#Bbg@&o*-W2<1yYgOhTSj4***v0Dj$Wsm-TAN~)E
zRy`4+_HOMuckJvuAw^uAdYhTN;!P}N`L{LlUSAd=^g|iR9B6jnz6>Ni8ZZGgPfmEj
z=MB0!I*q{~>W)%14sm%Yd7)eJ&+>)1-HY)Qn>@CV4flR`I=`r$L*$vKCKs*nDozHp
zWw~Xwc>jMUk=HZfPU%Pndb1tvy{{3ZlDTHg`+cLZMHhC7#}v6rmkW5uPmUvV&Ws@9
zO%hK_*cI;-4cmQ)Pv(Zn`CzgHr7A^tPT)@N*d@4S1JsHE(YkwX4Q*y((weX@)3kUB
zWb#HBGf1k^*P3ji6WAH*8by%U>5|0tCon-_xv8_h4s2Dk(xPt`9@U}TRmQmGq5aD`
zNEKtnd=^4b&Qrf$XKn-Yh<$6qR<G)oEDSQB*Z2yI8%CBq3|?Odoe7buqOipANxvFL
z5Zevymp(a3v)z`Ah%u&rN&*Q^ipBIbw=#aWI{A67TecP?UghuEng9<&L9ql;|G&-t
zD4C@DuE*+Iv&|_zEY3T#ecGc+MbyAgv0698RI=D1fR^CkjS(RS^Bx|sHTlkWbo+M=
z|46U#o@6oB7`8hQyII-V4QJ4$MU(vj+H}WPM`)!l_JbCvaaDUar1p~`&YMr@H;y+o
z%5bhl|KI_P&y#g4j&Azs(xH0yR-!iMEhEK<B=I?(Z8raP`!u1ZCU~m>GXHGVKeRPP
zu%g%bCXPp%hUO%H%H8JT@PvI$cRk>mn(BOhMj;PRXDVly0Gn-RZc&?Fk;D~FYbkb?
zJdLekmFx=j$%FoA`^tI%o9)LRmu6+nxBLrQmMI2benUDhyVD!_!eF%g4$;sU`9>+~
zESr4sIg33t`DdCxoI~C;>@{C=-&rl+!_uExf&7dltttf6u+J)>s~co)gqiNV!<a_m
zzo?kk^Q$80n^Wf&(D@F-51<Oe!)c}~x7us=rE1U5n>fkHd}VU)s3>z!a?3AL?63j8
zZD;J9+Uk_Vj&dg(M+ef!QeUEaj*&w?zVWEgE=oUn4u|=JO(4;ppa_k>9z7K~5wIiw
zcc|){J+IuKFB>+8zxG3E?#d$XM8{FW(7FCN+RNJgd-xpY8!hE|Xn(>xFx2_~M!7rU
zR&D2E3{BSqlRgXlF<<Z>y~`&OHeWBe|L!gFVDXL`gNis)MT}dyJPld1k1k;PiuGyX
zPL4SilA>q58kAs(Wy!XE??*UQKUmx%f9Fem5hCV(`4TKuC`&3y0zIj(ui5N4tki2I
z=&`xY;!;B>Gd^9K_E1Er*i;WE1e!Q^9xo4BoSvsV%**h08pA0!xoGyf4mFlVYw5)_
zQ!v17e0iAc;L7Jzq2@z$-*R@WEd6>8dbN?T49W@Ug7G^EV5Z|w;M$qHPEH0m@h0na
zS^#rO3JaLRTL83qhFI5$Yuf>4W%D7nvPsVljik5bsQgEOUwpOv0^L@VD2U}=*Vuhd
z|J(I_ht}^AegoFq7va7%R$uK-LE5QUx181oO|ObZ)G9Tr#pv9VN+hBlJ-T^-d@I!H
zaAYfSPc9L1wJJq=FaN%uYjpK$%WqVE4pn-oxbT!6u=a;YCWd#uOZAN$PZr*6l1^$%
zq1fB)A8gD7vSYiIagsCIPS9&9x`ra{r2NYOzb$8?zKscU%BlA(3_;$a#^WNIjfX}D
zXMd!V`QG!AP_W3z+=bYitxuC2Ki#+Enr35g*PYRVG2>5gz!6Qx)Ul*A^t7wj_5=DY
ztF`6*D|M#A*fd2SJZ4j;oV*>XzAjeu@$=`G(L??lKyb|Z8*!sHC-pEp&aT@zMha^X
zAV$O;$_{{K2-O*NuZ5AMWHvu%WtU7i$hOHBZO+}EVbdJ%3+DFbZi5OKRFlKVtiPri
ziEz)M0Ch`ZIiDm6kSXiH;bC;b)rnsHxIR7ai8I_A#D8I7lU&tOkr9p&npmiOZj_XD
zn>D_0G={f3+y)^x?r^_EIvDe3RmPBM+qnZjN=0CV<CaAMr;Z7>Rf4&I-tX^O!o>Rn
z+`sD8Ht%>1zUxGL7AKc}`Xr_KQ4XrR4UfkB&jtf6&|)1l0O`wmgkb;ESRB$~DVKr8
zsw`?!oV~qWhLeIHPLcXHgW!1}t)+j8#;rUwWZYQP+O8-65D@dSLB&5;Q-q>)1PpdK
zO1BO{#f6|}GtoUc-qDdWvA?p-Xvj|Yrzea-VrUvgsllCL7ifvZhMq!yY-&_V?O~Vp
zkn!0-(qFY|R6L<Tjuw6Dwgn#7$gaQSear0c-xH~GxZ^wb)tRhtFOV}0O2!1NUQ3~1
zx4We>pa)+c;M2UBOke8<OY!$iTsk_<AR4US^~<=(UB9w3#0nb6JI-`TC+!<81&q3=
zzFs#zDJcfn$d|QS+!*5aQ{28I)d<Hwqn7q8+cY#bdMPuy$Lst6&sN~GDJ!6SM7*BB
zr}>#Xc80^)OlT`&5h_8#5l+5`#yw|i(9o=$(yca*9~Zvtsc_fI>bsoVY>%I6{yXJ&
z@w)$6s<{V3!9||MAH1X7!$g$ab*!nr>OQWrqpu=+l5IvCT8>gtai;h)QIZ$Q?nn~A
zlSb2;rPV-xjST_O=Mtfn7GmD9I_c+|Xz%PWPqF!mH4rdXpX#Y_2hp!4=Eiw~wl+Gw
z27PEHd{Fl>d@t*^2Oe&SA#G7NB%@0&wI95<G^Tru81t;JGU>!d1=b^vZtJKaKZ=L#
z1Axm@c6=aVdKW^a&;94`5D#a^>1`Z|?8U?KwroC~%r^hs!q1y>Mq-Nr<rJPJJL&x*
zq=P%H;`=}i`aSSreDI&l%-g{xbh%gR-(GrqUNqMGkN9AF;>pQ;pVhy-LGo1``allP
zCkvCi!fGvhctZGx{n;Mhvox`xtZ;(}f!4!621EFDh;i(?brf^E@|zyh%##J~Ka!;K
zQ-9P$MY8)xoqx0aY~+TDVVCyZOFbPOah77Gu#{XyaF5o6ZkXmvC$Z{#C1%v2o6mMk
z`jcO!R3Hv&9wF;6<(a0mFYU(|)4-K})11=P_cU_f&TYTx_AC`&tr?ZH0~frHN3KSF
zAHvquKx{Cc{mcyZ9vIDV#l|zW-V!umhv~PWLD@?$wR}1Af2!W<$<38ct7&boA_VYY
z;Oc?St}e$;bPuJZSQLU9ZG9$82JO^T_KR2ce#!^m@ItI*^>&I*+(SAg-@5U9((^Aj
zBu%)FFfr->G1>XD_DvzrI&2^&>nZYR`Nk;)4g8=i+*lSD-fou{zXjrKe|6tpWya^|
z^XLSZ{l3Qg#c95s3-Gje;>%9tTcgg@Cl&cX2Eo;`{T5`v$tPO;KIpD@(>UnF$|*kr
zKVtLvHyk8}PT%?D;;gpG^ENI}zoYr_vL%nyza1nDe95Zr(^{)#Z8c~cAj{QR%S7W0
zOd*3+DNqAp>ifmrS}dX{tE@J!Nx@;_4Bn3Aj1|rip#5(-e>v(^{IS&(qX?uLf-BzF
zSvKwGUQ_;-tE;DsVoLj4YVL8@`t-bOlwbKfWqq_Xi{*QQtHy@yE<mkx>+eypU7jo!
zjt0YiVafa~=j1IM%`CGyo{~aRPyWY^(u>+fhgcSimq7Y!y1*+fnoR=NBHgS<Y^xs%
z$TZo6gIeiP`LtI5kEgSaYP$X3I3*#eNXJlGrICh#C>@GQC@CY9?vfS|MY<a)i|z&y
zMyE=Q9xx`1ksC0^ejlFa`TlnJmvcC9bKmc{uGe)l@Gga6+Ir=;L0hG$Si=E6k;BJL
zkcSHJ@KS!pfD|MsmjZD|KzS{-VVj!ULk0?aoje%u_n-Ov<-Zh6A&*XyXjS0hm*20K
zc6Td#MnCww0ry@ao+2x3M>mp26{xrk$5jU3831RJHN6w4R6g1AGoAAeT8KR-p<(%1
z4OA!}ARj$Vt*m65>+D@!$8rF(el=@Q&FBZaK<CGhAk$=G^TY%+&Uepyk8etCWR{M1
zKbd&^VSh>w)W4_M-~I3uBOg7e^hK?FKhD3CYv%xdQ>Wi{NoYxnOHYZ_BixmO<p0;+
zTO9!D6X<d|S!3>QHn}aQ0}q0`7aVwb1<;q?+e(5R?tuk}z77y?OxpZAB#amF>&YqU
zXG$efj}<fLD?ZQIaB+40D@{pM%kn3mI$G$))%!=YddZ4V#lJFl7-RluPOfjLEnPUy
zJcdVjGC<3Q6O2AcJ-Gt}?7|mRuaU&@(WxHLtyAkDI1ey&R|4AQ{}HeN$9M~0XnHqr
zQ2*n+nJw<FV4lo?{Sq1r2%msQ7%2xK^5pO46DIvfP~iQ)l0I1!7Ug7TP6VU2F~4Cb
z$#IKx0@!7?_gM4vt}^&d6!v2vjlOLt38HsP?`z_cGdT@G!4UYQ-^BR!K6PmWNuq}@
zcLG=*?gz*=l5$hv!)FaRxf0^DDSPE~NJ6=Hss_oz{aKUs)ct98Y>P~P&4eR9fFL{m
zxO_K)8OVO;<(`CU>UC~-;!QFVw)FGMEAa9Y*tO@*$jc1`3^Yu8+S-!xcaJzqPZ0t5
zfM;kx_(UFDAWE9Jg@?qQ0@q+M@WTP0cqZTy?_n5Z<O&8D?*R7VS#UVbWl>tdOA7G5
z7Q*dPb@)YS1&&hHLbVlm$6z)PFslPWV(*jOm-tEnx_Py<iq*n9@cjWgbtIPJ<=z`e
zfnQrTgHT=ybe64O;5sNP=v*$y@XgtL=|g(oC7K;c6#H6f=81-w-m~Rz&{8Og)qOCp
z8UqDMl#Q|E-1oO?LTUncD2WbGa^Mjj=U1<hOV`Hfs~EnQj?=Y#8L_qg-_0;-tButJ
zu7y;RLx4onAms$mmZ32=j>*o5evIGWOU(W-fOO$Q(%YQ^dlQB0{}!aC9zcKGX3@@f
zMRX_(i357~%XeM2rK!4_r`by&Pkz9T=q1C%w7?>El}ld#t8weLbW(FYbA;D|XL8Sj
z>@S+1lI-^-;945+qUbg2_i9Zdz5A4iOd4`^#W~gf-kKu@qPH~4lt(oQ0}GLbAhKN^
zMZ=Y-wO1?gi{y8)iET~&aK4;JwY05l7_e!AXuqo;Yy6rf8EF*TAe~ooO+uElMq=>*
z{o!?pmq$7ei~l;s+5Elf_0y-B6D7i!oZT?>$WT+4|3AH2$SDgzX%WFQaq;QnM_PLR
z?ump~%kL+k00}U*Qy)U?d1#Oxu1QV;R5#N96$NXOMEv7Exowm{u^$24!vVlD{5koE
zrF71!`#Z%~CC1;VjJDTy*#qZyD7JrQc|JNAG9)ohcDzCBEy1oQ72mILl~}<a#lKP8
zKdDu&J`wLPw0y7n!vl?i&U%iZDfDs4GE%2)rU0@t_||Mc;!&iV<Y~lu?G-MQyXg!e
zwi!%X4ACjqE%OV8s=Z7LY5sg1%hf(8qL9MIX?ln!r?YU-?@VM&GHmn(PH|yMe>=_1
z1dD_s0tRJfT}Czzl7|uSu~I$bH?SUvtR-p0gSDHYsVr{a+%P6+L-ze1eVNIN$L~nP
zMv7wJuH|a}?;!^{H_J;bYPQtX@ixbL0KquG)UteT)P<nGzGQf&(s0A{Z@<jt?0WKl
zH@c3(6P?=|75z*+-3Xu=oI+zCOTpRzF$4gb33_taHWT;I|23aoSKJ+9Uj`kwn?n5Y
z6p|ic2|RxUL_0QK&Fb=nga3G1My@^zM3s35a<S2!N!F?t4$C~h`1bs^Zsy>t^t?AU
zcP$fZ5H^K&&3o^Tl)?*=v<Ik3LX+dv?5`)>NGLG)25-5m<O^%p=A7txbuL~W#8xOh
zC+CC}yYtxQE<c3o{>1fK@`vheVsL+}R%JFi%_$J36t)fE{qo6#Skecz1TxY*TLk9r
zVgx}HxA}2@k%uKN&`OCXsK4{l!gia2_r~L}s<pry@z3WIy%Gc$ZuI4CjJCifQ}Jj}
z@9z}CQ$8|>b8)+bEVHNEa|d|R#s3{Z!27+-!rXhdb;54)yOtVBT*_W%0Bx@nprg0|
z5*>huimQKL@g7pumfiU9&_dPIM&IzG`qUWD9(j-SpjXr^M+$`IeSh|;gA)6&`>&?n
z2^G-m#)6a6Spya=ft(MzfpcD>8Dct_qmF+H-hBDQ-%-7*b-vzGK3x`><i5nU@Rg5p
zD?E(fknY#y)c1!J<@=;y;c+H(29*+3hfo&phX!O2CD~Pq;Qb%D!JGp`J$k)KT>ZXH
zylmM;<derG{E^jn!WRqf*L)Axp1lwsc^%EOfBprfXnI=@SlO~)_b#NFg{Rv6Z>fH^
z@=BWBvcmW<nMU<F$w<7+WpxP{9BI!alh}l)h^7LJWMw5U=jX~{{}v%TC1TzwidN@<
zMu44+xaFUlwLGh!U`9^}^KyPxvue?mmq<(f#wVed4}LuPskcnL(I;yV&`I5(RtZw#
zh$SB^T%W1tU37hsT@el7TmH60+>kka^H^ttO*mE8Nc1<~fCIdcn`I!<XSD&OS8Md~
znjd4I(_Sy%x)!O2UUHOUm-8YVWoQ(k>!3}+aGLVf;kmIMK^x>Ce_agjYe~qU)kq#p
zsK3G5s2`J*<l811X=$i|&v$ln8E~J?xF{661c!*H{I)K9T`G`IPHeY^*H1H<9z9T|
zefK^Y|3Idc?@mU%Axisi5=j2PGjwLnP8Tz%Y(XBJ%DzH6K(u~YMqY}>#!><A>EH?A
z#P+8o(OG02yxg7y68(EI%S}<6oA0cxu^0l=>)?|9heQ*O(h3ZA)qrOMh-emzOM1!T
z(?}f^F)>Y3u2sVJDsfVfa&O$yP)|D9vdJYT-Wx_6?DDC`epr}U*XVXSzm<@VKne@^
zf%f<BWFgjyCTph~;U$lk_&#guT9=ZT8{M0uH#9g(KcUEQO1>BHggQRi$d+;dXwqC_
zA7Mc-2Wc(GyJ>%^Vs(6%V@SXJc`eCJFHLGR)2It*JmVf#oaNte(R|wZDEWSo!l3KA
zHbYaX$HvgP9QV)%s08D^|DLJI$mHwR`KTa?4NtSk0CS!M6c99?#UblD0JtX1FQ?97
z=2YS==f#Zw7Wn_JNfeCDtD}acBdAw^gJbae<?z$@*C3~ARN@d{pb<R-<cPUs4inR)
zYD$HJuSevlbYi{VMF$7b#g)u#Yqia#u38s{gKb!K1ai{!1b92S5>EwlMxn&&*{1@7
zjZ*Rz3-Cz9crS_7+6t@J%JC}Bnp?pt@VCc}g=@sJ`#C}y%nsb|35?(~a-R)&FpcE(
zd3?Nc(8tk%&L+X))khle@FN$FhZSW<IAxJo=4g4CjPJlYsy0&Y+oP4?5c`6o#_A)M
z|9%0Fv+eU6fhO?V?*m{v7;cbKTFMW@CjY*;-8~wg>|MJeFi-+c&AV)$`2P1ik%YEC
zCF=vm3!}g`6AzRxRpsGVi_}^dfDVUDArlY{0%E?uJI&qwlC6uC6VrWH@Q&?NLqS<`
zLV`3TLG9a9P0;qvHd{s0>@|v_r(f?0Gkx=j&UyKGIG{z98L}YpB@;CMK=Zp4)31~e
z8H<l2hje6BrO@(+kB_>K{D1n((&a>Wz8GY7j7yefDp<cVFwLmv_Fa$tp{?(PT<3`m
zdC;9A6!@yw!^<0;{RraZpbi!sweK}(7fCbf^L_LTQs#R<vRDbi<e8N;^)0qZ$HdPa
z%S!pbr|9j@`T!Bxz&c<$D9#gr@1Lk527zjL1W2-5_n9*J`Oj?efAxy?@0R>Hb!ML7
zf25Zd7WeQWp$b#h2lJNJPUJl4L_rFyEWcjHsMbx!`RqaXPzEn_pSvtCC-1u#nz_Ah
z_^RZ$du4F*aLvKfHw02k#aBzXEAyDs8h*O#Jx6~gF^D&&I3Ot5D}7Kjx%SicmXuj1
zM?zbd_{u#awYL4@Ni9&#BC9yTT{@kIrjH&|hkEe*+DOTVgu$M-rt~l%{l;LYV6o9z
zB{j~aU^=ZfPBWNouF>hwHaksyLx%_lR<_i<a=z$RombuUfTDD*!#6>%Y|i~ZT5`HU
zSP%cF9V~G#zQsK$JNHkUuyq2wJGRS*&RvhZfysiInb|ei_!s_e&Qzj0(tP%W<C$1M
z4)Nav+)m+yf`P~zf94Z_YM62NxEy`Dp4~Qeg1|qqtKFakgzFR2YNTP(iu97}ady%g
z-8zP?dGYC$>@+dgA;4MrcAdN^bw@r?B$a;z;!>r{8gr7#XKM)IzJ4b~&&#o>1?e&`
zrdgK4Jtdq%cfm$OF8N@tVp8jglI_5TCq)^EU-%RJRF8Ab)(9rxIz80`7C5ftob~6`
zL`9U_jX%0gqo&EN6Q|A7m#oFG2}wlhjyG=0vClypcTn+sId^7d#$c$%1eN*U1<%iH
zrP=>?Z9Jiq4KXX5MrL}pd|#A04&;KjpPmMwQ~^yW1{kK<T&|UX1|<uaLpVA-x?NX~
zsMVFae0lW$U4a8rlplYtklZ{$0KTy$U>}`?r`YJ0W*xA+I}A+jJAhxY8(<$WdQRn@
z@v&oqIgk*rvv9Amm^6<|V|qCbb(qA}I)(NtS#%x5j5UsZj8A**Vr>7_D|vMNCsvC6
zB$9^(j;hivIFZvl=WV=$gk*`L?C1)f*I}FU_OYZP(z*TA(r+mce6@d9%zuU*_+--c
zylR}*bn3JP#Y7g-^sD0(1he!sSQNN5Q;c4EL>H2_#9|7-)xp}|%CHtwb|ZTs<_dQ&
zMozNl%AX2r)o{)o)0O;o)oL@#aILZf`IVS|*XlG)ep7VYvhyYOX0ch?nvSjOT#}Lk
z$K<a~ssG>A<lpLDo$!hGuP`3|_Vo6=O)QP-bdOSF=o2eo=XbL+R74cVlo8`_DSK8R
z`L9I)_OpCNOrn%qz*<_AzfxP0=oL{vpwnbafcF0$ca_O8x}D}NKSJb9qkk)MZGe5$
zmXY@7gMoOd<Qc0_eW?vrv1Fj++Iao&AgX=6R&LV_Cb2eb3V*Z~N|NKqmjufAesw2c
z9k%bGH+mB<sClKB(+GaM78cf>-{yyYZA~wEURW8_@EiyaW(x*-(R;rS{W=f1TKv%Y
zJG;BDdFadfT4IT0$m(xOP2h1@I|nxt0E=}8aA^LvF1QdMV<+QR>_CGs<AH?4Jb(YE
zwDVitUdywkkTrZQigW&WWGsCrWMr^<CTVl5tUg<$P0R)MI>+;+>*FC`P+gQ!vbNA-
zwrKZjPw4YnZjH0c0VVL6q=-aGNj8Q~*&Sthzvm0izsle3*^-+vj_^1vcA)Uu7-E84
zc=(yN<nXeQ0XH3m_`eNiv9>v|3R#t}y#SmHzctAVL%Q4mmo?xHuw>wE{`9=!^${sB
zU?ffCWZzIjzl&+8_j8w&y0;v@_83=W<uO;~$hWu|PeUHeMu)p@Po2C^O7%lE(%G{y
zg^%$ThrV%~{bCLEp7N+?<cRcu5xiXHmX2}Q1#?I7Z8Pj_<uLzjkGh+9qDJw}kAW7S
zY)ZDjJ_W{yX(fwDN+a3jR-Y%sLBzETH(4ElP06@&Zm}G_hvlskif}bx<P%}QWpbSc
zy?RaUex^VzF0T95vMUQWda;F<g9B^l=VqvK`~{R86?H{~3&_+gokr?RyIP56q?yZ<
z504_e8bv(UD75YKOKPsc86V=p<>>p@nytC8N)v3surize6eFh6o~u)6pHlFa_O}kf
z$j^dv=9WVZY&c6!|EOnVAsUe(dkfe|NQ<qAgpB+(a|@|)#q)NX@BjTpu5sB$-6zJU
zaG#~{A@Qo>06!{S*DC(NN??!(0;owo;|q2Tw9*N{_~-wJp8GzP@`*z~Eg77s#If^$
z+O*RRFv!-Ev69@mo%UYMjJFOns*1i>;oC_#n!pOCu+cKaj+lOWY}GG>{XIMBtWdnK
zHRM&!Hv-`w*>G{tc})78LEKg;!>3>I(feV%U!YH`=!nBO6WJ2aw@0jj?04T<^N^h^
zbhL@)U}f#3S%(LsQY0IvH&KE6OZbmC&+R`VBJilVCzRblCdM=|;%4m$PdC6$c|jVU
zA9@kMW$ybGus)n(nz|}rVYSwobXk!L+TbmE2!5=!{b1;hCt}w^KKQKu*J~+uqF>0P
zo%1$Nw_poh|FmHyc?nrT;N9^(?OfEb!uIIS|Cni%ND1SCqhidtD9NWLU7sImMqMW>
zx}jq>2sua|ZQys5Ety<MvH2#p=&F7$o^0L;DIcCgP+m}ZvuR*-D{Ra(B2H$x-;qn*
zim@Zl&i?-{Tu$xJR{ise=#X2sxFn_2$fh@BgcWkhBVlb$vUUF8=K{ZF0XfYP(Z3ar
zhc^$6H2|;i;_u#5qEUwsWv5<{K%Boky?r10F5_odW{LTX-1YG|yNOpibv1%HShS7|
zqgLtjq|<rr!BhjsGLYDSmcXo-9aBftv)7(CZKah;6<G(Y<tF05zje&|eenZ(hcTfi
zRwYiL$M5e{6Qq)oE()tk+jc9L(>gjVfK-UoHvrcqGuKP3eJ_H1r~Uk37$6B0&4n@C
zJpwY3w95Oufy<fnErZ+<vf!fLUigP}7##?!QcJZsNu$a!g{=1pMj7i4^?kbW!4By|
zk<Ei_3dMn`B9_PU<?n!S;R%BWb;B>6U)*H)^7O8DXJX3zOcpV!AvR50k)%z@M-<xW
z+-}MEfe&>;Y*r)dCuHoLOsV&UZyXv`rrT9@@}hj7xOVJErw%a*XMC&me=RTid-LJ*
zzauG*;1#Fj9VjK*;=iWsQ#spNf;j`=c|8Jrh5u}*j^1_Z!3a{wp&z4h{_TOsw<AK<
zc3Itwp66YPTDFM)D;@ZKVm^2@bq<86CU#l^&uS7eCGm9($vglDp4@N#>}zIRhHfnK
zn;^}CESy9Z$#-(zC6%G-uW^fm2D2TvO}&x<TuhGDS8JD^8jNVm<fMq_{Puj3je=5_
zMTBs7iIF)x?E)ueSOq=XU4$hXmy0L|Ri3ZVhnOomx(@-KpY_2j6;R8uj6@F|rM9Fr
z9kW1uzW2_N*j;78W+&>6E~4>k>ydPThRa)l%Yu0fYA#wn7bGwjyJIVpkv8xkyN|-I
zo2UmoKzTH!E2djxnv5t2Rg>9u)9RA#ZV~w)XsFYYnc?^}sju&e=Mdch9boP1OZgBu
z1}q|mb;Y{)e(O9N@(p5P-b5ib>d9H{>as{FMsqkLAvD>4^cu>Huhh9^(x@aQ58@=@
zF-G5iLEQYH2B5*uGie_cWl{UtDSBnr2@V?dav+`RfTEuTTfdTI2j`WSMlSVoP?n3)
zcX#8_zt6aj&+;t6zyrcX%fCh({BUdA8=to|Om-xHllqZoZ*i;V#(O_tt^4nC=HMTx
zRHpW>>*SlJ&*8L}a;7cf66iy6o>anfbMps{*We1DQs(Ec_HZ6?2Y#=7uNAZJ$P*c&
z*_u~Y5A$J*KU+J^Pjz_ho0(?*<+h6C9FOfsEFOR8E6)1bta8RO)WUZ=h}|@D2IZ@J
zhR-)B=C9tt@bVgVCT8eemy7JqTXlDg2`4{pUID58;Q%C%6Xg8E46|>s6p`WNrzJNF
zKQDcDs;1AkRSjd{=J;5)VA17Z<p2o@QM<kIH7=SL>4Q@cD;u`2Z4F7qKUZoHaxf@J
zdfjkaq>Uacv-|2)V#j1!)XA;95+<(G$bow&)4lB-&COCEHAwDVNLi3kALIz~Ocr@s
zVxE<v<713v35c8@jjneIqH7h2)$pBzdl+4O2sQ>TlcTeK+0L7x8&&5_r&$H3Yym(r
zBehi`B0tCg5HisLGQW$_E@2=~4lIT?0US-gTpn<&P0|w9fN=!rG?4dPF#SCy^8!y4
zE<USKk8i8dHwDf2RiGbNEe{@tJ}ROO0aQi!U?1*I7`Jc8s+1DGB`;d09_(yr2|umE
z&sQOB1C=^wxPSNigO*+7xMxM*u#_+NVpf7|1Lt<lRd$rSC4Autf%LFAJ0)ih36V0d
z>6aZbA`XFEvslC6zfS@eW4rEXR*)Vlf9+TvpCESyPpV9#S2Nd?IicRLQX9ggh8+C_
z_b!@ie(&*ue1wa?V6%%yC~PSqG-eUu(b_Q~<7k4N%MJk@HrvVuUzBBd%q~;clcuAh
z=}8t?(--zOYR`DSwE&cwEWrPC*>!JisoVF_CjA(>+>!n_&G#r{`2ifW2e-{ri4~95
zSn^odiLP0h1~m_qVF$v2Jm;kJ=mQ_t*eaxb|J3W9p<PVy+}vXNZlPe>^JkkZhB_{*
zB_|;UYbEJLW5=0E4<jy^$X0*Or3lK$luUjfK0D(Yt&L1J10PR=`N6p5b6L-Wb?q<n
z$73U-$h^@Uj+_HKoGlQ!lCg2e>hx>-$=U}1r;|o@#2Wmwc2YQUMEN=9c5J@d3WFrU
zTGgx?Frw3P{_qxskI!^n__X+Jr>7ICuQ2@Wak8Frs(M9!Qx9EB-lulIcQC)m*{pbO
z!i$?N#(t;W6f-s!PfmDq4hLlbEp>2iR^H?W&CY?$j!MVr=0DYCp07y;N5;<7pDBE-
zKp!@aTWoZ#WYiVlWy<le-gaubBj_b)pk1mU7-jTurluvpN@ll0w`-<xI2P-p#61*3
zB1Wj-a{{J7fy=le(Amuz@XA2Y1|nn^!F|Si1fbadnaI<{Dc&~ST8sv{?c1)1U95=>
zfe8qL`6bWMM{;GE@8sHSPYCxh?_Llw!T6jybXBa~3HJ7Q)wK0k`R}n}&4r&==yHO}
zmP=SzR&l4(-coU=$%HFqba%j2O3v;BK>Izu<#%J#k67fSo$$vE|3|$GCXVmI`4J4N
zg2jUs7>KufutS%TMf&NeM*1FB0N5-@-;U^Xss>T={qUzT4LwsPyKk-3$hM3#9e<1p
z->_Dok@K4x?paBP&y!TEG+8wpd#l}!LAAAM|CRfJ2|b%G_!ImFe>_8<3-<ph*N!a}
z3)Z#*F+n11cWRT1l=quR5iA##N`K${-0ziXXDo2=JNMw+Z=!{z(mjeq&KQ!6Wk6{S
zeumg`FudK=Nmg`ps~3zXotIn8mrIZs;{xTz#8fa&>nA`Z0V3SDL)-5C!0b{tX3~Yi
zD_eC*CD6Xcq)WY(EzVV-gU@mL7Xns&4oqOUqW&F2e&<=a*)s4Ofmxeb`7~SlvjY$*
z7hU7|s6k4Pbfga~P!-6W^e<Esz?p@fO`-pkwloRnaBNQ@8~Fzy>vK}$+AblF4@$p2
z=x5;@kCg(IQ@_)vr@x<7^$~~N7?oX4UCdKP*-Y9!{6wr&?D)M$^<$uVq)Gh)V*#h-
zg!Pnylea+X%{kTSK8WBkD(7>s{wWTc)P7RIa&MyC_}frZ7apbkMeJNFY77B1Ktn)(
zY6m#Z6qzJ=7=Lp#9&XbUR_NEyK8OvOTnrNoFHXLN@-?}2yuuEobRU*3BVTvZPpO8Y
zgT%HMeNDM{$=kdT@$Ik57v~q=Hw8PFz>tG@Tn@1K3|H@O6s#riOi+^kiG4b~MH9T+
z;x#{a`Fswtbe%jzZQ=f!bbaOW^#e#q28yC-2;5mq9Zr6#kgK>Qs2x9|O6mJUj+XqO
z{>BRk$>6$^(O1!-wJCXd8<=n{Iu!jo0}_O&JPK@7{|)N*c%b1O>SB^<LBH8Be$7Q%
znf36qx-RfCCQuQW)e@5<L6{|fIBh`HYK+=>cT{MCHEtnck2N9m+X_YSIR_NKbrNz{
zvCqi#NZNx~J|@6aJSqqAI6To*h2-V}f?Vx7C5ihUCw!`^T&h=&(o&TuAu=Swn}?zi
z`57($owuXnq|#%%Pv+LZ9eh6SCO5G*^0Yb_+5M^BE#xqVqLBi(W63)}HSANZLT0lP
zOvbv}f?Mi8L~gX92fSMf;pDi@3(*!QdkS0(UL(f_bdB%0I!<MJxi^zyI7qCHS05DW
zoIou^dS0PR(X1j&`72<7h-an~844n5<Uq(Q^-9YT_P10F{l~e)WJixAx;sn3nsh2w
znG~cdUDMkk^DE>Pu1!u8Vv%|qLd4|F;ZDGA9_`d+4`?Nh+$;f=ENF6<{kZqi$9=@`
zpMb!lKOL_LJjq*v$nz;h$fK83e#3=itiYCmolH;5Q;=4)HtWh(M^gOUo{_C|p)Mbl
zB%9W^8o|gA!|0Cu^qirM56NOT_)LWKb%L{=_7^nGA5Jzx379;XXDGb$?krt;U2mPF
zlp==%LO265rUE*msBNob%-DG!*O@VFhdPxm4;N>(67J`3Ze5HAZcBia)NpQG9IkhN
zo83H;Mn!JfnIgd+4^X?``W{#p6a-_;kg#CR1dT@Z3YEc~!x5=*M{-cRN{hQuMtIxL
z>YX|VxcA(E<Xe}&J}!!LE~-e;yNsp1?8mLSW-20m_aEPam7$DZWJG;e%;bhKy$xT?
z|0K;pJ1Y7XTjMf2W-LX=djG|Z_fc|@N$6O&^JcPaMc;nCzu^Jeriq=!9tys>ZcQ-y
zKFu~`sAQvUP~+mGG5v%F3*&}tbrL7qv;B5W2yr&#a`zJ$+LQ2nS5x_XAi8aao|?o1
zyt9ht388#IPGq7&nQ*dC1D3N@N{@WSuyX(;mYG3`YgJa1Aq?(zwR^T%ZMNKKxF!Tk
z+IlA@5)^G=Pi<0mHNhVhV(tr0x3zSBaz+u*L>C7=%KTF?Eka+-t+!n})_iPjW=etS
z#Zzue(l&dz;`Z66ZQ0Lfqk?_LlLClvF*8U|YYpf5yDiML9iw)We8}gYGN3=3juiD$
zf3|B~ticP7*3Zu;5;n@4*bZO5s5W;F3S5lg3Tmp@<?Pv44{ANOX7m54Lb?PES<AFm
zaVBlN()$=OS6qVa%d4uyOVA<mhFQb+2i`}>fWM0*td%`fe91OzuoL-03_}HF#C`NN
zC;;zjdNdKjd|D0{^OkqbALPInNJcW~KFK-fEI9nGAceiNr8lMM2Qk;Ljfr9Bdbf`n
z%U~?9SnQrH)`K7cv$M-`Wn^)WP>t)Yoh+nXaKH+glB=lintLK3XYKugHMF}yKZCg?
zToq>R&JM#~E%*tp)WxD6HeSo^_5Uep?*2eQj&!-hHK?qKs(?ywduXS0*=wAhTKdOn
z*nx(epF3UKcqi=7ksk#H7OdGCr;2pRQQ>xU7)cnP^+<Eo+>xCh=7M`$vvB?)r-#S$
zj@db!Dbf~fAiV~H|13Jp1*2^PSyKN-bWUJ0$<gIqP%f5VQC{76S`XYt?XI<oUr2LT
ziff*0fNMLBV|Tvi%J9qXb5T;}bkwH&U)=s<bL)vCxi`@Zhu&=lP5g~ic+Y9*2rA}I
zRJ0fV)i@CZXHxIbd#u|^#4|fTKXu(Y`7c{fOVkMBBqz2W?D)d|KeyMXa`IhIkH}yo
zeA1E(*T{PdpfP>irjK3E$jAUp)YNu3PLnCA->-efET4{N=<q+dBEobvY8nueTs%`p
zfAx6%j-XiI%fl9JFa0;u7uOkZ+7{|;d45K4?L4)b8QEMk(Q9k5A&+cji+gS_w>xiR
z9aF^BZx4x)AZJv@?45DAWrhMk>#9xk`4Hjv`8@c{=df>?pj`K4SqkL}-Pu896OQ_p
z?{yuc3Co*SR`~YQ0>UZy9-)_T0?sDP5YE9_-w2zbQnHqzqwNQOX%8FR-YnK<a~<|`
zxMc(Q*Mw2RLDzY7z<%GhJ$}sMvOAC2yiC`!yFh~R<(pO)!=bN20I=>f5QTdle|k34
z<%+GUfN?xb0(Op@yLpP6LCdF=W;nc9mYXFmI{^RNM89cK0=_!2<Lr{NEfxZs9g_s~
z*7s~fGsRKqi-expqt@WV%?icM<%=A#OaeOe#HFt7iR`F740w9CH$en2AvOTMnN#-I
zEvqwc7r=Q}&AFVk#}k?en5Gf*#V$Gv-~@7%S-NF|Pa+8~FW{l)T!&}^KC~M4=U&sY
zxh&y0p{opT8GP(Bjiv|5#m`~}b|cvmcBqwJzVq&KSBj>HPU2c_s&GwMv>uk;cFRP+
z!GU3@^YP7%48m-u?1YVUw>$%K?Uu6kr{0)>9eUt-M3Z7PmCjkE0$f7(Br%!_!ST*%
zLQkkMF=BW%#PN*P%nU~J{^4bP1%-jyy;a&{HdZG)=rI)cZ9`dqAy{KxNr0>^Y3Ry;
zm#xWV`p_o871n(r<gh~@mvZ^7i{yF<#D_2E{Nqu*PUo<G{cX$~iUWiH9IRW#f-bj$
z64qrExbkiDk*GdTi=gI!9s1}Lc=$2bpUqj#nax?2_Iy{boewb0cJw@Rf~)+jY&&9}
zX}kNvR=!eyYP;`f8tQn~?hfS-9&4VdR9^7vmUhjmtXKg0VD@dl@yYnz_U<seCv5G{
z>U=L3$4t7bl?8{KBZVJ#D^|Qh(RFvh0~Igh2c4^!L2Y{nl`P|auyhs<`xY?fZX+A@
zdPADMZfyIa!V$ZsttkCagQ@C|$X7K9uHb2xxbY-KPyxB4*G&JbT`4-`A$2uj_ui&q
zXj4g%{xozZPYh|tB|`_5!duAFLhlJ*3t90Z-Bs!d$cTpL=QG1LRbbQGeozirw2O8D
zOQkY*<G88GnWA(@JJgI0qm0k$LHzZY$H{feZ_Ez_Yl7@sY0HYZ7M5>egTcX~&1iw{
z`pU(rg5x8sLSaRDm+rzc6V`7EZy_J2NGKbZb%*_(U#;$Xf;?m%UqnzGwl-#8aObFm
zf}q7?yjWSuQT!<MOg!`~$omZa+h*9yMQTyhFz3=a5;}>|R(Wxkxj;B$Sa8zB?Aveq
zisw@aX7w&PR%T{{03?7rICmA$_dk{$F(mJx9u~jcgm8ubYcraSty}yXRoUXXag`)Y
zX(84d_$Lt=eCsUG+(ucNo_y3osmEZ+*(LiaCJqY$Gfr4fq=$6fsW4X8fG4GXefA~w
zo8*%`CU6SV`1our>1aRWG9A-6%JrkpGU4cRP7yHUzpLEF2V}0TQFJb}g<5suru;S*
zvg)#ZPc=i2G)rY!9dGBD%LoQ3Dn1vbDeY*jXk04t1qPoj$7eaM6$4|Dig*A9QSw}5
zcp=tI{%}E_jW*`Gf06yB8e5I$7onCn2Ee?$ELcN>2ZGEhuu7B~2MemyB6&EHW1lRp
zRBDVeLz=D)_bYXRUJHQQ6Ap3kf|KUTF7w+kmtEvRhM}0#7qK|dtWQTE{8=7`0*KpP
zAIXxE<ouZxJ+zUWD<7=k+UfBGAb`5PGOL-(GCQ4!Q7PH3c;=Li*GyoUUv#YH9+i8m
z4?smz)|~dk_XMZ{*9>2zDq-y)JEfYYsrTi@9LDS#^!;Se!=oHx^FH~B*%noq5f-jf
zReiWQVC0tBowtjmVH|kmWopbER|jV19<UFmAvy88TdUnXLL$l$HXIl6%0htIy;MH&
zRkz)#2b**Ch_^4Pta7vSb<r1BF7o!pGs(9-a1jV(Ew?B&g(Nl4hldK&#28|~ueLd5
z*ipM`HDeMjhXwcTD;Y_>4HSP?C0SNZz1gl|^I_vi8K`d=j1#p!|GR>>W1O`bKk#x*
z(x;?pv;uhWni68vjAOiU)&T=VtF`<#LFWBrkSFd4&DP)vS7b66Ii=<nHSD_H$TZw7
z)9l4-A<%E9;eiToB%4XstXQ_2_811v_L$<#80*4m$^}i!fzEW6Pg#rCY#uz50+o5;
z+#Iaukku2oFaMB(XZxr3ppg6A)1})P!h9VUa7rj&Fx@Bp#g=dxPnS2degKDxTTpQr
zCZf0{`HAxil+}*R!@$~o?uEJiy<BQJV^KKk%9~!fCPT+aq~z0>o`8r~HFw`sS)Z;*
z7VCM<E$=Nx9MZ#1jjch|&VEa44XAB@-8uKA@rjFB*<6Q{eDAE1sWRA#klbeFPv#5e
zmhTq3hp}jBtRJQtE%luPD!bTtq5=(E^zh9(T)<}Ex##<<arMp5pjl=mXk%#?VG6Y}
z25wTyJw$dDAjb>tXjAM4;q&fN0mNdY7Yi(MoOyodNx|8#bu@b;?(uT@tfq-E4G#Mm
zO@LQk60{8R#Q`)HXflCHP7Ls#O(c}$sS8OY+*Jkaiin1kE5UjSkthU22B=E2`~NYG
zD)^R>2Dtl80B9vUAD`dqr@R0z<^Uk$03g<LQZ?{hV$AOSFf9d2N3gRX6`h2w1U%^%
z*0*#StsOd%qEq@h;feNDp;IP^GeYC@HGawqkDKb9!EsCWS}YOIf9Pr4{{1zdzF|IY
z;SIiw2B$86JR&R~a8TmBxcqA+pHXnLfs|HFk#bgzhd$yJgE?>i4Afcl+u@C?0jPIs
z0TpI#BLfef%TVXUh2`i8(2-9iKOZcXNhC`N&CC%>_PB0cj3)Da{(boVAb>S0yvm{z
zR8-7DtQ&4Ym!3u?C22c@J3kzU;cve~pH9`e%sa~PrHpQMe)?r%+4KbB;Gl`6$kW?$
zSAWE~q&Zk~8WkYSyk_^nme;n;GL@pOt)>VSMog?4bH%@}sd&!iXl;+Dxb(+^rl7dO
zublG>l$fu-A5hgs=TmI_rJ}_gp!P8xJPp#oMhGi*-kpxAPS!h7qX6G1{@DjVHw~Ii
zNC+dMIxpM|3G?GmtrkIJ66|B}j(>;XoEUDMux5}QeF`13$GF9poApuD_x%?@Z5G|s
zAxgpDHfk3X7)n-1BFdC+Q$o`yb-ehCrb<6EP_7ImwuJGVccVh2eM;?@3?2;~VVZro
z$#FX&^?mh7)jQ6;@Ou7DHSxDEpf;tpx!%?3DWX+J#$3j(PG?eAkwl++)AxP<&}P!3
zu)f1P?N%$fh7?3CEAm)&HHK-_-=VtIHY!w(=(kN07H&bx6(OY8`eWiaI+Ck<i|<^z
zJ$#6RXANj5jokUE_dDV|M7zh+6uh_f3-0W;P_sVZp_=d2|8PpLh_Fz!Ru=8PQouxJ
zWWD6An)*UhA#orrLzm*Gb;$SeG#f7zN{5!)WL7ZO0ol#$9;#Um1-~|v>!h6TDW)d!
z+~C<itDbr)x+jGXjy;CI@qnIHoR9h-n90fTE3>y|`_cm5+{gtX=!6xwB6gQ5x(ITj
zF%4PpdDxW?pFS>P!xgJMI@jF#j{Nv9I-92w45b#Tqq_5qzm@WLC)Nz=ehPFy%s`DF
zUGDy!0j#GR&Upk7$Smq7YT!&Cm|g`oQFQ;Bp%r}H^_`PfD9m>NQ`uw}u>K$kD_KTw
zUy*wK8sKpT4rG#C&V9($sE<OdF`#0tPm`+I#};ffG1>C=Ha3qv=RQFs&1h>Uld=y7
z`Md<wZho0%u*GBmfkd2KauG`R!j%&k7$U8?$<S}$+g2$CZM>ttx;nrCFzd3lYAOY@
z4*cm49^H&IxR<NG_5E_!bQGjMxZ%l8^mc`lY}<O2GF^E68idiIR-0QOh>I*-sXZXB
znUaT$Ea1zGsN+BrJi51LvFtS`1hPhS6S5aen&!zq5=k8H(OgV}=AA|STKmM4{`Uf}
zzvxGH?WX@0w(AJj`euXxI7x+E)fp)`9>TR0@+$4A6oAEG9v$2J+Z6Ge>N$%)v)=Ay
z(MZV)XOIfB92{i3phK#7Bh{=T^ejCErm%R`Z|7XKoHlwu?a)!R5+e%f)uP}ok;0Tf
zS1H8Ex|Ob$_0ji=28~Le??r>a7GVq*AJ;;@hcwlxHiOizu_j;iaKJpCCQ>#sf%Oa>
za6L-1pmU!0Sc`Nz$nWli(i7rqU~ZM$+mVqV5U6RC9v(ry$6G<Yu1!JO46*?AH;{(-
z=hIPYIrxw`f5Tm49hXqa%cDf4(-q3?C<WcnOE@h<_{_aCSG2X5Wo~kjgL>Relt(<?
zixf={C!TQ@^_qALBaO)eyCKZ`L-ZUhJ?65fw%yf45Xo`o)8JfQN+haV{)2TTJiq5w
zaDGwn6oN$0;jUUYRmcd`!KW3!*m5r~kETq@tYw^f(*p`ZyjEbKFn_cJ@Ah24N@4o0
z^fiCKjZ_uzTUtH$%Q7<;r&sB9l{XDlP|v3J?Cor}?(AKWTEz_8>3W1KiZW)vRf>_m
z1!HnC$eOsLH<cX;LCm*R3r)`4z721t(Or1paB@@OUmUGCzZGAoteo(OQ>(p{^IP=j
zK0(shOfOq$_F(Uyo!EfIcRfhy7MH`1Bo~&;kZ3vVQp$xa@jMvs_R%}N8R_CvaO%yI
zP5oWrb{HkP>xtQiB|~?wG*rStV!$co{Ah$8LR(%v%B!EX|NPPfcY0|F^ByVL^;Q!R
z2S9n2#<!Uw6(RB2<CdmU&MRDDw&L7HKcAQM&c^+`Fu4W6Xp@Vv@v+a@u+kUjYgGx4
zjs|%i28qRjxd+W%j8)FhHTkVRYbOf7Lm;F{6M44!4jXP5Gn}naWSeNLy?oqHmy}Nb
zO%?-)#B_C^-h9DOOQugBwvrhYl~M}`q?Yl!x(CNq!4{<9tsRx^XMevPe5?xAzuNMB
zq#!d5=ZD^c4-FmGp7j<aGYT4LH9Y@4Hqe(sE&1e|jzmF*_>rJl5QC$w^dphq8oq=W
z$>dHha?B}Z)|+Hi8Tm(@BN^fu(>(lfnuYqg2ZCd%Z#5?id6Jx2-+@eeKSW0CFxbBl
zPCsB*jr<Pws`EO?xR|m^z6^5vr8wx??y2s&+)~Ux+Ig6V-s%KQ`Bs*u0S3%0hI8?s
z^LdK@3~)c0<Z1KAHMzX#h^=*Kj1+Ug(w7dO;fvy++ONdhn0SL0`aT?;Sij5ZO_^}b
zTr{HU=pM^SAWi=?(fKS9VRiD^0$rC3G=rl#vLzmbd>R<-1Gzb`0d7r2J$4yaeTx{n
zWExk}S$bfhh$cR#+|r?6h02;_+h*TcUYDF|2A!AbDz_ji+tWFw*dCk5-eBnt15JsK
z+JLJ;S9*GoJ}<LG#n(T7m(jG-?Md)CQTx?%h`g>x7olD)dcK8{9BQt;8}^;}#E-e(
z2DIN>H2fzV^t)ye3DO0nhePqz=y|2ZKhrpLNybOp_s4AqmXt$3JjJbXAgrc?vup@p
zjp4+lU+gpDP$BI;;bcg7?BPg5np4w}B*<Q&`-dGjP_C*<vb<X*sVobf@IgFm6-gL6
zcnf+bAx5IceGIRI<sY4<h^}r#s7-C>UDPae_}Z;4BtZQ?277IHOY{bsw+LY8v_rWU
zLt5>cd5Brg)5f%XW*z#j(DJBj1Qz7W>?-+0av<gvluL9w_0=aPj`n{dt{}o93$u_T
zYMF>?B9=Hmw$KHq+;N0a>Dd(2?#zo^uJL4tcQ`(We%mmEGl#C<YuHomjph~MmljB)
z5TuvOS<uVYRIYRsiE6dTY`-^K5A+optGHv*O6$I3A)e;6?4^AwOG8hcpLOB<Y0*MJ
zURBlP4DGCt*zYmtyT`TiCldYF+g=#Ubtq>p!wD6U3eE*#+(>1)8liZuZr>GCc&<9G
z8C`c2xZt^1JJEl_u~*$)+}jDO5v}L=lcz#1huBl<P{R6+U4gdr<YnyQNMKnPdIl77
z$`x0mB9Pt+xTYF?I|VCXWuLeYRXLtoX0r#MLB(+Z!iJ0gl5X|M_NQ-s^M{xE2~LV{
zmApB5z6}Cmbg-;!xtiJ~w=xJT`ua7z0RTU=+t(p!W7I*BdCP<sq1$fw*w+nb@cV8r
zZZkgNED0}U8UGMza^!QJ>}7K8qfQnI5*yaz(%+wTo2HXIq|@hjsDx98vhn<sk1==N
zNp0~x?9COT%H4m28Dh+1F>|d9MJQgH&0B)d`4Fk1^o9Fnd8>|)@<VTqVo1*8F>1S&
zPA`1xx|bPkoSJbCBSuL<Lbg0BTv}>uCwF8tFOl)^(8H|ONZYgJyyUIP!tqOioTh>q
zp{32i^dOJ!<n5{bWR3lW^TCUsRXc>_k!LZnb@$8XAqP{s`s?wA=Qm(EqmYILlOoe<
z+`VsR9}*|a7hmaC!KQaKfyvqAj)s?4o#*BeTb_I^Y-$_3@rR=c;^3zVBL{Et=rRm_
z?lWs#+v4El;FO|$e%<dX&xx?;+~yp4CfVH<TI{Xhs5m`V4Y_>G2~Pwi^pO;|ejaJc
zz}G<)!v+dKF4ndM4Lye*Ykm*KR}mU6#4$4$^HwQ9!bkC$I;$ldDh8qZ={>+64)R%4
z>N-^HDo)6x3oVxrv9t{&`@8}*jKfKVZjNtxjl^JyrrWI9m7piy!nEhs>-+@rADB15
zvUIZR&^4&K{YW86f&mxiaT30}kztj8p7>_`0ypHsYuN>Cc21g_M&?7GSX+{DgdTsh
z`n_*TpME*uTF$R0Za!{C^|xMJ(okB1LkVa?Fc-QRM84m9D}B3m(E2n}7H_-lM!>ik
zVyJP*`4Rk9rmGh)_Tj{3EQPv*@4s9YUj%mPp&kctrFi1TE3i1*NSFS0QyK0WkSk%2
z)V{UCLY02=VU9KX`McaDhx$8>^rY6E-VEW2%$19K>@GB}9Ojs0<jicwk<*Om$tqLA
zNjS_!akKBpk@`FJbTi1c95!Xw>50&36(OvG&tqBv3Cg$xZCRem3^7zX_@V?$yWJC5
zqg+WlA;X$*cpY94v@4&tjQZeYlFK0nnus^0Xe5S`L$8KgWR5jZU>Kp4xVPAa#?=_t
z9f~oJ?*OoH9(1^t>yF67y|Gczn`t71`0^KV%gU|buObvNlfhU{a+d@dgMw+~>1CoF
z=RBPw2%F`NhM)ha>8|PZz}J9qH55Z+tNyD}-loijU59=b@%aw30?tzLdGOAlJ^7!t
zEG#S=RfOZNN_0!10;epQduh{5u;`*pDZ-2YOZ5W4v<agQ>GpIVvj%%qws~E{MIKTk
zZcC1~juSUhZTHD1;C}#gMYnEvBNmrO?dZY3<-W5J5Hnr}^OJ4H<V3^6eTj0ZcirCI
zIVRt2>&pw>MaSR_yq2Gw<k~9l2GPOZqQij@#^qlD`?8=zYnTO<Y`e-%U6?I-CjIu0
z&da%Gf*|5bdcq;)v`tW1m)IhfuCsh$nHbwdwro4Aad+A!L(#1VZ{fadVk$GgRqd=e
z%d*4Ue0Y7YrMHV|3QDB*##CUQ6K$JidI3J6Agm1BwJ>eO>DfNtp~i3=8W28)vUgmZ
zZ4+Q_=lyQ&uW+R!*5cwP-(}fpBMW&J{G(J@U>Q*=hUdXjjc!i>X>V2VQ}Ce_IP$vn
zZnPHqbD`I*TW8j`Sh-6TjpAUQM5PLbkHi}2g`4uOS+*@=t`Vh@;m9&Wl(;D#-?#!u
zU7J{@)yk)-04qGcDL)u9H%{5%l0pM?rRO{Y_Jr=AS!PO%eO1?nuhBx3>eZ`66dS!r
zd*nhAlTvhtuS04*h>{9YC?Zs@ixN?W-(;O2jyf6y4&a5R1vAMjAjfQc7`b7Ga{oHR
zVN}Z{G^eK_MQP(D0q76QmVU>MfVK8RH%Hh+7VQ+RA$|@f2BLSh8jO<kWZJqCw1q|S
z68cRKlUq%MmqIo{;~g%9Nb!s$`--{cIvz=F47=gEc;<Ir_Jrh>a>(DObKmfVp9ddn
zk=St4giSuww7>rSZKHbiQ<<C^mx(ml<#yhx<u?{*9i5H*5n;@RBJc6$TlB(|v-iX3
z6^brLTH3vh8!_Mm8+kuWZmQ11eW{|x8GlZP(ATh2-Kci_K5tcz;{It;E~9{}lod?i
zeG>;;<Qqk_|7W|EGoXiX|9c!{l$VoXrU*%-y1J@v>F-{!cv>R%4=3uuG8popJD~{L
z;ysP+wOi7nc)`<541U^`=6U}_Z7QwIE0Leqf_ziEJK>j{{oNSP_EpXt(T_*sl#<=F
zRMTo|4~|aug3-0G$+qpw0OgCR0>WYF1-%QHdAE!mATW3^klFq`0z|(WfT8Mf(IZwE
zTEiA6-@u3j{G5}3IpQN88yjmIx&|BmhkHWD_z&f0e_da4+!WBXqyk_nmjeOGo|VdW
zKt>59O>M8bvMbK>IBDN_$h|vOB6xG`d<_>)KJK{Oh8DDiUpG&=A*bC^<~W-X(k6_R
z-HipkO%{7rA|oZHR>_xdLHFZ9zcvv~Es?%@;ZO*Vu5n~20K7Oljsc(BoDOKJeBWre
zz487*aSb42X@ab-NBsKw4Cnyas89-$HidqJHzzhmvg!_ipeMa1xlY}sjHuHqqc4kl
z?q~=gvWDfPzQ}BVcAO;WQ;Q@iNQ{(HJMYKd&27^bzH>D5^TXo!S>%C*P~PVKDDi?U
zGU9;!GeHS4*HU&%FCJ$d+uG{870FCU3ALP?)#Z<bUIi7=PDGCyPdDn4mmZWDRq!1K
zwLWQbU7V6B$jeDXj42ED89n|XKCyxDG+U@B^Air)xDyIl1`8sbW6tO5%I}F&!lJDU
zg<?-*+n=Vav=mGd6?AiFyp$0vUF|lo-H~kKADBgrnD7<c(PbdlHYkN?Xw$`yzq@3Z
zeG(+j;x*R*V0%~1coSDwJz92zGof}3s)ckUyRmfep}YDSbV@W4%#Us*0=xz{P{eM2
z^bQ1?hboXp`M$^=73iE%g3T}id=FLt34#L*n#}>D09!5)LJ$?q<DnRiT9uCk2rK{3
zS@G~|<B=o&;)d$0Zfa=>;JIoIWSw&e+NFxS08K+!QS*Z&2mg$%lvJ|5pMxRw{m$Mi
z!7PQ>wWYUof*oEcpwbJ+KRx=YQ)HgTlaeB5OxE+jK6yicYki{`{*}%CR&i;?1XUbQ
zs_as;uuI!c3!`9(9kl3ZW^*(BM6Gc6#q&U!F%39{k*LW!F9`qH_sz}Elv&PeQ<h1P
z#8{#Cx=%i8*bb6i@bMZ-H~3L7KIY=5JDHpi8jXHClSD^3qPBVKJLs{pDSd?Z8}Nb^
zhVR|$uKM&lcYG&$&UI5<j;;y9d0)GN-}QgUND(Vs&vt+fWZYMA!z%NJ2gg4I!U5(Q
zz~`6JsqACK(ZMU)+^Zypx>Y`H!2ySuoZ1?X(B$|Kn~;#&B~>X=HWzi;t*PU(rul>>
zC^!91kn~^eFVEA&3(^8@XYvJI01stroYCNn_07dCp@xKOQkR(mlUVxjJ0}u1z;Q26
zcrL`>(<l%8JU9fzb!To6G8E@Cd!!KMS&wJpKE*_Q!tD=7zC3bNP^uoC0^9;3|KtF<
zc-&kd%aW_{z|E?4ox8&i;LgWzR8OGS_}E62A@`bsE&DNDtR`i&_yX3E5@zKfHDGM+
z{-08{@5%+=cthkFU_!NbaTx`C3}u#8PN~sooIQ{hryd|kW<s?4RgIiSwVyHYdVA!Y
z`GS{;#IUa9B9Ayf`*1ZZ$+cVru%Z5NHaO_3g?L@rkC=#pYPHhCtBH893S$Pg1hpKh
zD{Oh5bKe0!01^xLG$zHp!zOW2&b?tckGTHq)ZBnH;t_xpbx4<v{D^Mzx;>@Jl>2~E
z>V8;Kyj16IjC^xI3O>$hDz*eZl>BByA<1{bU%;}m><61RBtwy#)}@XHC9hBqQ=T}!
zdB^C+2Fe%svXgF`3Mm6!V_Apuizp68OU>~~ab57bKEZ$$ac*{!q7wrd5iX1-L$oR0
zLCSa!JFmme?|@+W>9=RUKFy4%I1X3jxzrR$%`GlA6jVj0Gxc`9WM^@Yu~E`sF2u|9
z@5@&&3Rr^w<PEdzv?L|1Is%F(i%%hfgR@U3u)(P$Qn(-`dF2t(woBT_(JVvrK{Nlm
zeB%?f6YYB92#+OX7$;eHJI8jB-#DC%Py8h2T|RT)%g2$S&Q@i!oqBNx01D<45}EjL
zT$1wQ+6;a@;BF`o=%M*9g^ugamtT#5_zCr}I!5s&1KC^aLO_A&53sYIlQ;w6wLmbd
zPrhf%P75^zaB<Z>dU=)2UV0`WmegTQo#_=bx1Kor(Z=qX3oV^++HE5Xe~sF?PxkOh
z9*$+hAJ5l_Za~gFpm(^)-k!n>lWSDyldba$@J~W@c4}tsO5<G(cb8!k2B~hraE|Po
zTR>>IB=^S+IEc{v%NgpCIXKYHh2W{vFR>fZt2In=^;6-{GVi*rf+S%?9ICAkI&z{5
z>{$=i!uV5CTkkK#7nJ;+JORbRAmVY6snNZiJG-uPE~xF!b;$tQxF3>_-aEO5sMX!D
zQ8jBg8S#U$G^JD#at(E=T2y(p9jp(Mjb2ZyJ>8Y#cX=(_n3ynJp^xeL+t|kb^qJ85
zrTL+_g(V|$b}=QVX(<uhiGeoOeZ4(AJU#^Ey<H1ZlER!yNy^IdCb@8=GN}`B$6woZ
z?)?MAu+aYep!j{w)3wql8{yysu2w!g9RDlRnBz0o-X&_Y0;8+VR{p~z0mn-^hP!+t
zZJ3#|n>FSBpJ;z6X2OtUtL{GGnbDGNkhC*6qXmG*gd+i5sdVg_4e}BiaP>b&koND^
zcxns5YxIEQ_fkDc&jJ<o>8fjM`*7Vl&?BzR$vuNsSvZEm^hA3TM3x;#;qvMpw!{|3
zZRTe0V5n2`G=;|`aaHKL*!#MZ2ig-1n`%M~wLhCxK}xsW$?VDu@)SyY6oiPGGj<NV
zyPe2<fh^G>ApI@j@6nd3+GaVR?6yp#{mTnFeK!{LE6-?v>}`_<e3DOBKbL8M&+K(O
z-pCl!mBpu+kpAa=KfBP|?xIyKzP;KMXNA_gQjG+Vqbl{#bDM&L(@!H~xf9<XP(s*_
zDA-GWfoM=62_>b(((1xDhB5f=U0VUV-2Y?htfQjpyT6TsfP{b`CEcLZ(9O^#sdUQF
z9nv8oIdpf62+|BOgmkw8Lrd47bP2qN`+4r)^Pc6OvX-uM_{QF!eO;3yGUo6xFvXWp
z{(%jMu=p555cdsyAJAQFL{!q@qJS_fjw}v)Dj;rT@Vjhub^y#VZ)O0vqZ%9%o??2I
z{~}$2Hx_h?W2#^U3#RV?mohnhJFp~GaJ{qN;<nR0>17gB`pBc7ajKf2VGoK1Lxy$d
z8f|~Zv4_tEa1UB2Ws(ifnG+y9gkKN*i)7ikMI#$Nn%i~fMZxsf<`NJH4^TC~(ZU%D
zM2M3vZm<9u5g(E{;6yYEFdq`L%0>b}j{h(Zh)n*$TrhL8;%ypr1T4XQ&b}J|U0V~x
z1yc{8`~UzMjNhrA-$^?CEaqNk(>bD1?8~x#ee0+-9B|g+z`7Bg_=<>8hKvKvnc+Sf
zRm-r3D~av*#v3I?+NO=eCAjPToqy+1k1vOL95%{hv?3gIR7(8%_ae#<Emq;x%CGkP
z<zPlU!V(bPujXNXo~N3M#yvq2EKdB%))T23jkMD64$H;qk9mq5R3b}rj`#U14GTY#
ztf3cvtS`Q5a%h+6Rwxvx!?sKPjla(I*P`iTy`EAn2&gJQf&UPt(jSB&n^sZ-N-L##
zts}|K+zrm%P`t}RHjsH|ctSVRLA+Ofs;GWIdwGJ)qVXG%70VC=I0_Bbjf<BDi2)IK
z<sb_;y}`|O(EH2QpZmBrKVB+MXch-4yX+M(Xld}~EY0T#wL3Dz0%OP1P>lgtXnrNf
z{4CU+TFkTdVJht5X&Xlb;3In#ma<7n`~~{D-{|ZZ)ZCg-feg1#ypf_{e0-&kB}#!c
zYDoZZq~{+lvis}iXk$YZbIGS%XcT}L3WQPuXil*}C}!6iW8_upEL`@hPn}&D<70dO
z;CB$j$n^Q!Adw1H)03ugS6buI)Ry(3+7x@-dP)>tiOG1%dqy@}6#kSEIN{RXXFqi;
z0JSWjA^X;81mr>DUC_a-nAhO&rywxx0%33%e(`Y^Hm9{Ejl|Qx-pT}~ii^-R(b+lj
z#%Xi3&3yY=Nx5(AHXq1?Cz6$r#kWp<&sc0W_nT*be<=RBm|#}L+3bgS#yEP%gGd~h
zt%VfiFq%N?KM5mYxpf07p|nYZwl>^3%;ZWPb<AgN4o?rZM&8;z-*UjvgwYsR(j^S*
zCfnNN@c0Z=ULV~Y>OyMuaQDjI4ueDlnA-wOGS9Y(M>XE>1N!CE*1PNS<GybK8y&ZG
z_urC_^y-FNuC`ukI{o0A!*ZaWb09@rxu_g(YPJqzq6jmPVwbD2l_8#01#h^HE5UDC
zfIX8e4ny<X+qH=rmU?7@xdQcnUKl~!ZvaK`G2m6k-spE+U7!{;;{tO6=G}|{;?zpr
zZC<5JdjJ0)k*`TKTx~g!z^wRg#I+2-cpoOwQKazW>lzvud3bnohk1dC$kwJFf~urE
zG>X_JR^}808edyqcO}jZCD~ko@d_{k!L&I9h1AM&XI}Lu{jz2tg8<FQ?K2JT;S=Tz
z|EVP!g_yskcR%u!9;+J9O6F5vB~VYoKRa{K(Cj>frTFFmfr>P0r}`mwC-cC2w+-=P
z7?s69&ocy9Q4kv@=xO4J)J=xnny4(Dd8F{dlr3;0@YI4eE+^l4v1Ax(<a&=K0T)$}
z=G3`lzGl@zig78k?2S0+b_46nSu9Fvu1ry-y9nhViP9SV0CQGKq61Iz6X_cqAIe>X
z#|iS@wKow)sATd%1Q*eC+v2Y8`~2EG!^BH2iif!v=B0m}qP2E4=OKghX>H6G_lwf=
zpzHZn%ddQiFw)o_Z2zOjCSe1*kVaIpAf-=h#n8C{s!}}vo$kz^)`H|ib;=y{>IQMs
zgP)!VaeGSDakQQHy+JfJ(q7EWZpsI)sqMHZf?P`&9_e5DnLD**FQFGDC}Lxm79-{o
zwCgy4A?sqzUYDG@8=k}_>uhF@IW}<tvh{z-C%>tU7xjKM1DM=IFqr^n7r=-dcCO5M
zSs8Z%aN$@8whD04ts5iFI)JL(zwj)8Tj2_rvI^Cl1xA43;RawnPy)X-C_frN%(T5i
zXDmAS#8(B)6I2`4ke$>`{K2dL-A44#uI#gA9mmz<p@0;IG-)4mm38J5#*Az(fNHq^
zJA7^RlJ+|W>Y9V=RcmU<(B`r0T2HIJlhdFWTGE`^a(m^>*USX;lDaOMA2@uOLIAtq
zeVHID-nsLZBp++rH?}U*#-9Q=E)sJq8fqcgdlx1tGs~ZO_p&@pJP!^n4(_D~A*e_3
zwEaBKGYU?9-t6MFfMCev#+&%T4F*Z)F)x}NU=eAAAweF+ni*+QWo#wQ-bdYq5H}&#
zlvh&@vkqA}0CuL8X#K62M+B-L)KRT!C0>k7p+hIl>_-ye`K^5co7v~r<o99YP^NP-
zWkdVXIKu7KImJW=RvQd<AItOoC+mW}7Sm9Nl}kZ-UAF4=VVJ*$<+mkU#a`IGHP??R
zyEbDJKh9?Z4^tZe6hn(&;LtAY^E+QZBjN&v*$=MRS$0>a=6>x&$BdEozOs`FEp0G#
zd5b!4k>teNBc_txwaxUh&40%~+dTX9pBt-uMN6L=83eC7I5^l~gd=s1Y#a1Lq1!O(
zUgc|vQW0S<Px}7>Nh<Q0_#gWu%2PhDy6a#t{xW)^umW(KJtPRglJvVt08nyZBAknD
zHPX2auMb-PTH8;7ZWm8vYL6dc<)oY|Qb%{?r`Pqmw(W9_%*5&k3TcAiC2C5(DCgj7
zb6|7+FmB?#`2u$%69_70Way0^hx7*o(ljnN0j;hvW%55~e&^n-h_NJ<^aK?l`px5j
zKI(A^d-%G&c#<T6j?e3;wNSwXW)9Xml3u;Y>I8GR(OR6vT)A>%1H0$)Wvc&Tim|U+
zJSU4zZryes2?nLb`hncKnTc>t7%(DiWZeD{Hqdj#hDkRM4C(F*Kzx0>4;K<gvc2R|
z-Mj~9T*;f>a_Cs>8#5FI=!9V=vd!}94&g}+Zeambp<<E<961M@!vn?g4<>s#4uczY
znz`QEQ9q&3!U>pXJldEn`D&4a=>;KJc20tm(5b534vPM}DW4hbnv_J6cQDr?&1|9A
zbhe|Znx^2la`W3npy+~o3^t%k(rR2t0bq{SGfay=!^Sw0iKRd1qcS26>dlz&(~<_E
zNs?4CT_E8$lDCWlUanTRZ;s}1;YLB(x-2wmNr!P{3l3PCy_+hvIV~nf&8$AeRIZx;
z_ZbY^He`x3bxK%zdz1Oo%omy6h_pTM3Ed!)YS%Iux8V=l?thXr+EXMgUade9ZtB<G
zyWaqU1mH}f#d$sK0E0`S0IFq3@)yTT;5q_=M)IQKD|zFF`IBWN_=}|iZBGDz@+3$n
zWj>oSeD(R?>1m7mBc?{y0-Th*sQ&LYvV$yW9l-I&`)V`I!sEO>m7v?V*?w$^o3Z2K
zrla(cq+q+mRgwg4+^gCJF>+j_@Z+OV-4QREZdEm(rCcKqhB{`|D3Z|Ua~BQEsn)ra
zH!BIJ`XaR-F5V%UPQK#od-4*-%lIFGp0Fk>Y1S-|g^`WEH9t5l;vO>p@B#jcd5dx6
zMXxj&ukSOD7KgIm4hS<Xxsb{OepnA0nUK(dBL6Y+L^9-qYMvOgLDq$X)dUQ3!U)f;
zb@ZKtISqOcoxvH&JP#5`V-C)t#SJ|1S)74dTdA3@u6hUDx>FwfeQ_a<yiFJxA?Tnz
z0r!<YdXwYcO!Q;S;JQMt$dO5DCXB>A1q#g2^^f1Pt#ZBPLh85<0d{My-_63x3=IcG
zKQPS?-hKfH+t$Ysbyk}{%Cv-$!1(?L^4F+wHa9tX?M=9Yq25o2+Fy_0mHf0H+L{p?
z{gV9ZEyD=0y#d~VaIK=LMz)2m=JEKtRqn%~7I>CBfTLZ{xed993g`}y#_rG$eJnuJ
zonp5A2afxHW8Y2fZ>X5p)vvKxU8;=W{A5;~>1{_|_6MuY!t?2kOOAFZ>WvE)yx$2E
zd&1|=DTk~llE5AG>yx^*i0tGj#-r|RQnWf!iLpQHZ$@7qJ&tF$6r`}p#|#d{|8w&9
zgj1ntGCSE{#O)di(Bk}K%%8e3Z}s5$2??LnTzn@shf>p+ezt3DWX;*i<@LB=zyT!=
zrpN@dRBCV8SgX{g*Iat+G<p=z&cWi~&v9>BmY4>VD&3`Q-IO)6#2A636lk7iU#+~k
zRL{N(YUIIGWp~jkIUHqi>^+!fSz@|P8RI{=X{X7e&5*?zq4+qCZo$+{J>IX9u6Ify
zWYI7A*N_Dg<fd6Uitx7{$Zud@+EOUw4lA%^v_(4Fs;iX<+szs%1XqJRuqTW?Iz|-c
zzr7(lorfWPYcEIi2Ip__cwo4#?-PUjmHECQ0(Wg-?CkepA77#!t){Pf7pPC<=OqEt
zw#$d~k3ZqBhHSgJxw&qSIg|<P)q3BzxBlshqLOY6&u4Xb$(e)jk-!?P!(jY_6i>4}
zsNp&Hd#PB|z-)2j_(-qhvB2*;ZqLr(8!NW|9@Hj%Q8N<%0i&Frjf_CSD~v<sMbv}>
zEd?FD=XGANDj5;^#4PG*O2*w;poT&CUo6+qgZrv~i8GDUWF{J-7_ij;2?Xkw1Zuu}
z*7PU^fc%jo8T->?`bW7R1uN+8sDl;ziYj@tKCrW<jK3(+&#jSXjNlpTxk`r!V|J$t
z=9f?J+Aw3*UeTnZP3H)5KR}@f+(T)q(K0M8w=Ek)-&L(lKO;m-O&%&4d{3Q&B{YUk
zn67Yr3#;EVsBQGu;s3pql!5SO@7xRygp%x@_a3p(-{b|kXNgQX9V-5C=zj?u4={vS
zf959a9q?#o3YFbJC9?w>>5<w-!vPjNdbnIuuJ3j8m-6h}SvKce(ZwS3(ljl!Z9QIc
zQN1iEP*Q~DW*f=<Y<FzjpOQ}+(*0{Mdz?a6hC>W|R0%+>Y<oXSVow>UbyhXJidph?
zJw~`C9!bGjBsexdnUde~n!da!wpqwG3x8aT^=_;9Z38lCnCX%9a?pkl)2_)B2yz~1
z4$m9lD7NT1s7<ihM_A>h#Q7hX>vvN<(j36rh{ZMrS}mUeLf5<*aPtuQ_WMatX`Yso
zX5A=-ps~w^c0N+G+98Oh?w6_cLXp`vZbPVH^IMVA2s``<NXFlt|H3^deaj6w?C{kA
z$oNLz3UELG0+Od!fcO)~(W@0u==o@~KY1XQhyNE4uAEdjTgX@K!VFDCDWBaZ|7ymW
zItqYFwr|?WV&npRmQ_o;;gDQ>9b#J|+=F#>x$a!vEV!%fFFn>&yF}I>@qgt|jpGr$
zGI$)Qn@#waM{Q{x%)V!02n3?j1&Zpc#Hi<EsTd-6;F2WZ)WHhW%eS^HH#gQ=MQ;u?
z4b?|ZG&78;dQ}N=8OiHQYJBBk0#1YHZ3g<WY<c5KI}+wA)QZKO675^}U|H7WVe*T4
z*Nd^2Q}Zp%A;!vI>nx6Hg@E5KL!U!>O|c{B#_<y}j}{LTkCNHnwlouw8Dww?3kTGv
zJRF4s;^V`Ar`%lEHWJgpCTJN@zng$~Lh4Qd4rewgkNiSNE!nQeMe(%bK>kW1mmP!C
z0{v+kLmEV5@53Hwk00RSDL4L1P3WLS_QfXK3W)@&%6Y^+UQoSM56w`2JRVC{U)<oP
zW(-(A1I!eOiPeS=c!c1T1LVm|Y76c(zJyXieTjpRMP=N(&TVHw3f0*D^K;k(e!}O1
zyq2WE%}($j`qpo#RQ!xpPrS|EQ^aedCi<p(O_IK%;%$Y}Oy$i_oeSO_97O8SPuo`7
zgp6cI5ib}Z-vHj_KhJNDh4A34=M8b#k0f{GA3>DEXfSac?OOqke)dDU{WVqa#{;)T
z%w2@I`Ya{+ie>);BPz4&Kf8LWVKpFp+<#E5bNab8XWKL`h!5c{wfh@vZErK5tQP7I
z^U*qY{<*%qAyHf$H)W_E7vL9wO#D_Xd7J85Mwej^R_3SmLGOH-`KT|YAqonNXQG|A
z<sd1&PevD9oz`<xgM5B{B5@~o52JZGabbLwo0^!Jk&$ro@?sO1$w&$aRJ3h~+X3M#
z6NV~6brN5r?}MLmSTK{ug|*yqVKyYsdPN)vUO>!mU)UTjB?VZ?AL}L9&!lnTtW}5`
ze{o@WKg&&iYBAwpNAre>P~ohn;!;B|is!`<$opw6;}O!l{Ac{qb*1}-hXvOT!os3h
z7q-3R%wmpLGJ4?g?8(cDPO<e#7S_^~7aj3$*6iacS;}2rKaWA)_pjM`l;j#&_B;B@
z3zPquO1eJuA0&xR91eZ%6O`?>RpDq=^)5}S<5f3ijdakD#zv$WOQg=AV)}5OcY2~^
zhGr!LB^=ovSv)<LY-HZ}VJ_9)OxrcZ`)M7FXDHM~@=c;1>)mBf|1zV&aiW9#jhTeY
zNMmE;#@#KhcQ2JR#7P*4KcYL(e#GuHYRJe$zZYz$X4;mAG@1dF)8!fKP>?yeb!cFE
zL<W-!t9u}zPtBG%-?*a)X)<7zp(hr$``qpS<Y$E!Q_g~-&W)OY!}7VQA~B7giOKA9
z(}zP_VDo{*KyWPhADb86FKl4<nB?A25-mXI=LnqzU;wRgtJJ^%R;D5TLbNRa9mEz>
zOpuvW=V<}1yf=dJO3ic#LvS!khS|AtKy!Y%qFE^ee)$4&Fy~C<JzWuF8$L_$SS*j#
znDr{)lm>HTB}vtoZb!O{t)-^!2@9p4^k!Ay45uni=r9zS$?KoJu|X~;8M_(u-NGQK
zYF#wnm$U&)w&lU38++|O#c9dU#U!qEyTO{Fk&2BdK423+FqaMaq&`&cv`}D`Mj~sz
zlshpFa4h1f`aDI>Z&PvL4rI7KnFNC}xl42=bdY)QIW<}(jkS&S0^mzJX+TcYN^4Qq
zu(McyLZNCsgdKP-g!P@2sDD+g@sYwxX>Lj;F<vmAbZW4etDA<Rd$fB6=p?eg+&YMl
zEVsvP@t8M4EVLALN*1*n<?SkGN6tsU2S>90dS(*L-V>$WklRI8tMJ$N!%RgQY+d($
zC_WHpEK%5qqmpcvigKBm=JBSKhdfIhos~h)z1J4bzrF>K&5#d9G1s|bFn}L2W~uW)
z-hX)7;_~x=1`ZiSq4F);fb$_x_EK#b2F#yAyUxJ>N|f%#JMmUOsgMWgHblh!N8JWg
z%T_;*2i~0!)S~>l+S+1L!r65L3NU1J$*EndmeMl>miOM8@y3?<ojf9NgZVK9b5Y;5
zP_KZ__P7y_c1wHiG6fu!@RwO2GhpBK<04gn|4gO6{((0L$X_k5!OdUv8<>Cq;Cm5p
zv4+!t7jNo6)fbc`Am={px>@>z!I<GGQ>4j`8}1%>MZs`b`8r1o(Q=b{YH(q(=wO#o
zN%MNX(I1Ws@{gg(s1Y9rsIPJ!nHoCe@GQ;2%fyCtP!K2bPSO>u8f^b1NTpyY*RP$W
z#E)Z{A%un$(p9!_)_4$L!N-M_5mb$2&K0sKeG0J`a1bQ5%U8*6vo5|7-Jv~EpM~k^
zD3^E}Gi<slZbi?{2%?T#6XmVI26+wQtrjTu2hgMk5oedVoW9>UwDU7EA#<}+=Em8=
ztj`3yYHD95U?b0;!96;JYa88kTtC%rxSi|HBV*+fsMI80G6e}IX^W%eRS9-aPjJkq
zB}FrDj^8#*Fh?_!@L}sL!`|>`WuWQw>IJTSq(nQC(V(yoRgucI%s6f^dLycj`hCqD
zsv;S*f#gpeg8AEL0X1=jX5G5s@kkPzBiL;d=Rb1Fe~#=tJ9$zoWXZ!80I7Rb=_5Nk
zJ1us+c!vivv)rQcktA_#zWhJVF}#0a@6KlXQ)`cd1LL0nkg93vu)Khd-+-fJ`ZXu#
zKJNeuFJNmZNG1x#b2f{4&2vin8IIq&D-d()OKH=14wNiY^uIBcxXQNDaNY!wV1xt$
z>1uSuWqUZ5E@&?f!b`p@_(NP?jx>2!DjvVDpkAjz^XGb)3JCLAl!~aBuqc<4Ar_XN
zo8b&e5m>%0Kn?Z%ac^rMZ7-NU0qWzh+qgGX=A;P88@7(<dZ#&%QmkH~RQZ;en#`h4
zntOoBJZ#EwG0o9UE9^E5irf{TKy1#HY#z(9hUOC02FZYBYfHYOA%aQK@UL91c+fW9
zqK626>}?0E%u~pQ;^-0aMgvXu@%h_Ir9N2XZ(0!z6BvJE@yd?kjH7&mekzv)b3nv_
zOaUwlmM8LD!vtb~(Xf)NYA)ZZ(f^D+vW1-tft2K$&X-8tI{chE$u^!_8wbNh)^-`1
zhPOhZE#NCJ$OPs+Jn7-L(uf7)w4ssg<gYK_Y8I2N;LKW}4{#^Bz+<)j!i}qp<*_fm
z(<c>Ko)j|H1^#dEtQ;_OjN=GlM#J8U*^l-P+eCc)xK~f2PEa~cqN7V0@;I%l@n_br
zD&6xGhv2;q(G`lH{1j2)T!B@y$trzRYQC@6hAAb4yfgkj=#&2WG(>iOD*>#u5~~|F
zX0T*s2cZC87jQ`jn=s}7J^^5KJ2*#%=a7FO#b$HZ0N!1uU&)o*KGD4~>8KJ-mm`e_
zfbX6FsULsq_PCA5SyX8W;mH~x5CtwIzoeosaeR|8P4*97u*ez?dpMH;$OQ!hG;1vx
zu00o3Jbh^WlpQ0Sqy&!M9fbZDs7pWPDX<)ygo?{Ma@7vtK<0kiew^~+{c%Rd{)#Vk
zGM}>>+~2;EFwh>31e?Aoc$)xS!a(aY%?b+%I`wg|;rBpRmj;PoT9H2sn?kym09CN6
zrDWpeDyQLrO1#Ym{O`$w#0(>;$m4@}PFtoN!-C>R(#=u?9~Sv8(H&+RhbeJdSRON>
z!rL87SyAB*b5IqI`sr;3yVCJ_?>g_-jWpoTEMQ`3Rn!oCil2`B#SH)imU5SGf69)p
zcm-*_3%aqX89q?%cXTVCoN$GZ#<f_0(|;y9%*pj!th&9JJ3pMi!dUw3PzpoWvFS+k
z=Oq}*_=)srWEfi{6mu@L*0)7-M&wlIDc&yb9!;a<OUALsN(i?tx1N2rx3?cS9IK=X
zOx|6n8J`8ts~%r&-3AUMRK=HEOx5rqNbdxobG=Zxv|YL6n2ma~kSd;mkN|Sb|2gfE
zA=81*#|6c04o80fc@D)+)Au)V0JXm#H(?DONRJf#mz_sHzVrf6-jtx~v;mDr39es%
z|F$j@XnoUW%n`y2!Z>BIp5GaG)X59*+Uq(Yb+V&f!SeJ4G6bO0%S=8wo*wH|Qj;#4
z_yL+PRxC&l=0WrgJEpv>s+DBli^D-d@`bV3%e=C5$Mxkf^q=_@r2MRZP;pVD;v=!q
zqlV=o9j67!2l5TlRNV~p&)CUug!N;wEZPfQD1L+-h;RsE2C+38DyqKDPV}oOUVx5(
zb3BwiU;>*l0?YBf5BDh%%VQ5}gQcK@Lw<{sJ6Nmt{=4R*<LKihC!?fMc$Ko9r*v3O
z*wO%0rriN!RFW{t$pj;#0{!5vEuWsC5a+n~2^78G-G?3C`i6T_eNV)o)@nAA<};y3
zX7i^ftRp|_-|7^bYm~jJ9$jUuQAH*DkfpiO@~SHEx2!kPcXo4h);QI-(P?mIOU&lS
zMX>;sLFdbyKc8lmz~=e41&@yS$uG2hhaGvZlwfa@5D0HFIhav5)FHgq0d8bNlmDgJ
zPKR#>M>NQ4p>ZX#ZB%4xvDr!u6^#TJ83tW@Zdc~UjM;sO6SbDlB17_P&WHSuMX}vN
z;QC$ILpC*G*2LE+#2?@?mXm$_bM<$Aw*7OQVEYZFAyehvR`C7l+f!abb*7QQsWL0z
zAU-rU_8EHM;<?$g=0^YQvD@}Tj_cu>gyRB4clpRWykTiMhwn{CUZT5j6{U}50N&pB
zX^y+Fv@iid!atY{8TW%?o_iF)C8YFm5HN^%0*;L0VZO50l2ngB>VHcG!1so24pEdo
z7x+_8ix!_h=I3>OU-3v3vr%$&<nZ=`O?@Va*o0V>Ln*x~>QcyEngLAAV)Mdk4?Kal
z#?|#bNnqIvXsEz|>)F6V-V1l?8j*Lar+0IlY47MX<Y{tU`7lcw)?JW#Gz8&s1>h>R
zrz45^uE~nb9~8xqcrDMpJbdMWJH@8mlzroYZ~F-62s6(oa+P5B;q}P@$8zRoO$}EM
z_%Kgtu_)YBKqwiuRO;cY6B0Lp&Yb71jg=Co@X=Nah6{7-sC>i~vxK|bINKYI{yb*B
zHei3hw$4-j>&f`gRI?hwf<uYPd_j86RVVWWbLE61N%AbnJX%>6(Gn=X2VbalGuPtT
z*f^0D0!SRkPwK5G7Kt#FK9N@x4<{x-uN`*nmlJ)R+UZ7f;8RY>2m$N;8ger+L?O|(
z>fj;|a2GAxW-RJwPByN4H9C_^nK@-GVDZ^@;d|x9DI!kM?IIWbZ~eiI?z17=r$ZI8
za>{XL27Ng#^{^R>iG2n0+YfqIL28P+6_HO*U@=%n1d(e+!75TNjDl)w_eiUC1Y$Yi
zcfdBh_W0L}huC7axW7J+0&X~F_54qof;3|v#q;y?4UE7)7)c(`@mJ%HP(`I+GaXd8
zqr`}<P#pmH+jZBkZNK~cnmvsnYnWlTc*=9IcR1s#-M=lN(^zoF+s1_)ce#ADbl=!~
zDu_aAQ(ad+8gNI@Hyk&HA8HCEYLNjp>WHcT>P=$d%d(Qafar_r^2vjJ&GiAzYiRhx
zG!DQqPh0akYlscrb>c|I$@5h8jIS++TUU&adgYgt<Lf326Em6vnNcN*Vp^AG7PQB-
z5j{OYoVuEgA`?*YEQ72>K<?rN;c>C~@^HntDm88_wTTy7nLc7x%S}dPkg*aS3%3cR
z^h`xJD)_Bf&j9BMWpcP@N!*kf?PKRYMa8dP!UsuAvD_@LQq%mJ=}MH|&3;-<dUQUC
z=Hbus>V*=2R)V3pQ<_tn*{n&1P(g+p{@b^4<RGdu-nxl_v03WV;wAf`<wMwIMj}xZ
zi?U8O7SB<lhZGaNNgWn$w0}bGq^9Ag_mh=%5Fl9Flab^n;i!`glBUsy%tpGJ0i)u=
z$j@TLb72Gg4ONUIe+{)=H-*YZ@{;!=Wk+|`t=xdoH&old1voeDmcwLc$kuKJDW}&d
z^A!$hHK|6?g}IJJ0gL#~MPNhoBcy5dovJb&+9RaB0zsz{BYe3+sHrMfr7NKIhtMZ~
z$v$c{r2lCVb&7t&=ZqW=4_JvVo8lzwQSkYJl@4%hLJ#>xy2q{XxU7DwjY@6uBaNEf
z;MKYA3*HdIS|woc?`aow2{}0b2@DX>{&`M~B_$Xgm1OedN~bfRfbMQ*_(61pb`H?V
zJAsn&0MP&Ib+ZYapnkrx(L)229sVV@>nd42k|H<s1w(%{W#VFzePm$$5QP$qK<Kr7
zSG59g8~NefT5<6ZqeyhR$%(s;D#m)(lCK-c_`$g`Y{(bI$FlfyAS!wC<ltiyaQ-i{
zDf{{dnpAzih1OWM*th;CQX;?mCGK2+P=Y=>4p?eaNe_^YLhgE6e^`D^9JTzA5#;o_
zR<buE3UqD)%V}#lSngmST@oS3Nn+RLGk69<wK=39v<m1fuemLC20RGwZREZ-2;sW!
zeh>le#Fe}ip>06aLXbC@K2gC8J3SW`9*!CyaQ;cGoG*x?9w;>^@{;e@5{TBdeK6@V
ze7CSMfkKmnbM8IqXx_&mu`s5%oST+m*g0k}Nkfcl4~EYpV|XvEior_Vjs`8?K0Azu
zo%*1HdFV_BF0h}^d9eMk1=UqU!lymF`YM@|DtupO6gtgnBp-c0bn<5bz}-Ida1}V-
zPXwU{7QH{NGZyj~zj)KefSf`Z9v4IsDR79m$^uc~S#002N7}>R)-vLvxzXyC#pijc
zXm()((h`6bylMxifI_M!jy|mad`bRYhePLpyK3;8K_gnHZ#wa`X++4!#8h{%q#}In
zPb$_6Ba@<<Qm|&bm^Ok-ArXc9;nw-jvuv<~3Tz}m=m&p-5DmQHXdh}>S4K$&`|UQR
zx2+WT&)@vlM+Hm#NEL!YBdTX)lww>Jj`Dcin8gn5@sKht=70<1_w+|QEH_~C!%1aO
zMUMtWd%Xes!k7cV0v&|~KZ~Ye#r-_(n+uh5naNQ>2U_@vrb~`$#&B<GWzguzi1p_@
zKvO(i>*Y!iWDqQpsmk#_J#7-tPh~jFjBJ1?)QjUJ-Vrx6=yV@GwWyz#6C(gwTuD-R
zJc`9j<<2mq!|WaMSH&1>Q%_G<l)0`U8!aQd{>FSaCd*^NRr3p-ow@<+_wqE3oc^2g
zw+#y#iSM6+#VlB7h>O*QXnB~o_?#`d$ZeftNocgxwHYLdv&cqwP&2);5Z)89yUsKV
zxn{aBX~knklD=RSewI99)$=iMZdR+2B@-snTrtE*HQPsZ#LK$>$|J7^w;<FT9+&bp
z_1UynQGihkQfy(1eV5mRH-ZTVm397>odg?1^#oL1CEs0u&aj!wJ}h=$dD&bG6|E2K
z8{;7&q{+8~#L4Q&t*4>~IXJdDu8b*Eikgpy*IJStGi^3ZHO$kwU=WbSfIO)Ds5B1k
z938boj`6w9=K(Naz8b!z#d*(Dpv{{k#rm`m<g&bfyIGjCc0TzV6~0)w^b7*t^SIV@
zIw;i59C>ljOv9MN3E~ip?EJS%d3soL%Zu)x2$O(J)zmaLmQoVIOjP<2;%@*|oorr_
zO!~_}0Oa}RDr9>E1z20;|7%*)xqc<C^zk8E!Y?53VFMWB=L?AlS<M3)VumWzERVEV
zh%Wc<*Z&l5L{<e!V&+OVmpPUeA#7c*vO~?Zl{pnxhq!w!GXMCA#-c{y;|H4(K~21W
zJ;5cFavt5U>fre1p=|84%gBBfYX1hCS#8b&@WVg{R31k=2WqWS6E_i56&V0PH-7`4
z7|KBi6rII;Sv}-!ZEwMCnv-hX25{3E{YYpT4XR(Tf-5r&_&i6?Jyln=n@b7+QnR$d
z*>dC+!8YA08nw+)Z*9kwYCb|`o($>`Gm20tij(*I?lvQb6--NKQ7A~93z5v^eo3))
zQ>$!|sNc@(-g+OsX3BV~tOmmWMfB`1^s-s<@Apb(o$Bcr#-5hH49)RI{c~fpzZd*>
zJ&N1h)P!ShruJtT$=wfHppNoPSxGAG_HpJK$5+8iTYz^#!6zi>&~BzZ95xlx@bY7w
z85jASO}vI3B#mdnWA7{zw9|-$dt~>3P1bw?acCt`x*|yC6S<(rTF=vmTvW+V{U0>>
zh8)cMp0j+~J3_v>*+Opm5{&~yKld-rS_ea$LKT%pY4b6*-?3FIFxbWEfR!VWd@#m?
z8xTb@W0qnqq4$HW_@AfHGY^?|>WoSh>>2-p%%2LjGL?TnU~vxq41oyr$Haa-HX-Ez
z)bA_(UEhIB{J(T{!OUWKo8MI}4axwRiOf(^1gKz;#}orX2U!mvGO2JS5+`A<nVt;$
z>yRKI!IY7aHT{|+;Cb?MjQbufJN0O8@(sech`QN)=<F^}X^DQ>kTdU(<bFVuIH{?2
z3pN?HDmc|D!0+kgZ7&5&9)ZqOSzV&DmuHMiIodpou5UjR#n&@+9WZf>^HD`QG6Z{f
zK|?btZquA+D(je8qBq0khC|O<a1q~}l>M#xRhK6d&A{<7b=Q|dM_skq`a?rreT_N1
zWP`Joy^S|ydqW3GHB=#*rtOwp1e`BWPOI~i81!PJ?~kU6CSicas^QVWTL0RU0Y{?w
zcMv51C*cH`|LT7I`jL8A8_a#d$mS3^uyyTVGy8kq<-?#)0tf0%*zx;}_j+G>cwAjw
z2C2qtq4pvlu2C1>3N5HU5!qPp`|;Hx7Y8YBOH2u|u3azEFag>+I5$gP=6F}uWP})8
zy%yt8^kX6{SzMIsErE`VWPxaRKlrEB@&dp_`9QWnxBum52h#`20SqiDe05qBcRcT$
zN8)&1U!9W{Njv!BF-~8fSD(s)5&$qQFrM(A=adSJp8vjPN9m&tGjLyt1&mqvfR)h~
z2sB$-SUk}i69Y<;9n9AvE`$t9Kw=aa#}vc)uiM3yq?xMHC-4_Zz^@>a)3nr7Q3&oM
z$UR`N`~1^(_Y*e<fU_B2z!QqBtM7TlXq?!L-pMm*%@T86i6ck<lt)OY##vL@*v6*(
zyF|5UO!uDzY^I4-JT!{}(FM2hoCc(c0tj37m|mimE$^}i&lV5~To*|s8Z<g8)#;@H
z6Kd4cl9U;cpNbB4w(rR8Le?qH7|81_emD$Oze}^XVKCN>=fZ^W?nHK8bD8kg?%U3}
z71APAbzBP)#9<D0%H+OT9^U>(qZ5@MAf=6QFv^jEG|TZM`${$*H^xDP|7chcI*%fe
zQ&C^Cbw(A}v%eYk`LMoXqBMS6VJhq7`5LZgiSu!Jks&ss@FdIUqJ(q3H_y{*$@|Nn
zP4;2_jpU`lKsbXu{Ph;bzAZT*+B(>c;2r0vv}6l_DCd|jE0HtfyFzJ$L)>^SKp4`o
zRL%V<$$SKwszHJ<&x>DrYo?1aB2@Cp(xXcBaB-x{xGChvp~cgS38U~vh}ltvSF<F~
z3r1XV1PNXhpUB(%g*d1LX;ew!V!#RPA)i2eLzZIujcvG8ZFsO(tJdXrE_y`U>6B-Q
zP2)Bp026w^cNUK%zjBeIgI9I`l0+Sw=+loFgPH7Dl^BZ9zJNP<1zOon2QZH)Wec&0
zdOa^utzzMeGW*xQdRqJf>q*GVwL}ye+^vkPtmr@1H#|jLILu<wqn6Vj)JOr%A2D#U
z{2!<O@Gx~lm89+FiH$R-VN?Ex8X&f?Re&}Jgx6H#a3qg5`aBuGpAWyDoc#P)Lo_r^
zW~z>o$SgjgTD`je@qMz2t*Q-!k|^ptiC!9he2^Is9aOHT#m8pMRo@!+u(Y0tL(Wa8
zZ~_C}ODgFkzppslVlV!1;l%Jvp50`&^`{3xKtVY2=iDz9;s+H6J-*OXTMF(d!l!2s
zKnQzdRWUcYV<D5mBlYVg7}1FkJP?=cR0KrTfNXIif0pvJ4&?S;8>^SBY({lxq>B~k
zZ!jhe?+0Yv*2{ls<71WQvys>7!clbVV`5DpwmKs_y>VTEjc$#lI>d?TRd2tV-_FpA
zcA1Fh=t@&;!m6chmgcb`f9)pmbwGJ7K|S>wKhLX9w{gYt%(MVs1N0>^#KI9TKGuHR
zL2aG4$pWj^mx0BuM2E&g^h=s{Yp$;C-lXd>n31;ZvEIs|Q+`IcdYC<_cj2Jd!I9hz
zIYja~8dJ=AKjdcdu77lca)7|y_9z*7`gI_K$Lf^AWwZTm74OayS2OBBJWt414j^kl
z07itJ#KL9@-mdraG}7obH{|!`!riE1$VC}p!$B+i!i?C`IE^Iglbdb!f65pSg^YeT
z0cQTJ(ZK;gn1JM{@wd&zeq4K-J%Ca?K8X=ULj!CpKA8Uj<kzeNMhM*=<G;2*J~(}~
zG9A#_*EKcm&|X3;E&HTb@i@LJmn4S6?Xf;R4!jEd5;7V>6Yat~v6?Q`{QBy>-mr~#
zrUqli%)$7clJHeK^TpwkG@H2%?;h-Sn4BW?!g&P0CkUk0p#R1$dp(^FrAOJ~jywD(
z15X)Ex*$NSK*A8sjF@7(aWbx8x!UGdqKUHSF&1<Cise6NNHYx!7&g}`HtK@Xty!c+
zoR~%w;LWevRJE?#K3o0(qbPCYH7;C0m$ttWDZ6RbFYJZOa)Y(a6;!^Cwqjs?L1JVy
z^^9<6WBja*|FqMP^#EfJ9EVL)>Uo>Vj^&8apD^Q_Ci}`Xv+<mzL+msEoC$8$39)X0
zrfi5yW-AL((xCEUzM}n^VCE6vyW#};NGTbFr3^{z3QXoE3+G=1^rsGi%iveqW<wgY
z_}OFgIT%+K$qF{|Zs!pR4>=Y<!{=835xqf-Z`B9Z0^$VCZ!-sUeGh}`xH!_n2QRBy
z3mLocdm8KgwDn`ca$f@ef#Gm%argWfzAppOYFL~N_n!<AR0}~k;pSoz#~v*-vE+mg
zMd^Q@N#95QNguObB+<}}pLrHKp)r03G_AnR;6uuI?~{85|5rF@z;C+rzy3*2?h1*^
zm-G)&m7}JY=#M0UO6Tk>%Oie@XJTl0_CTodX*C0CyfKX@+{l=PT1r{~iVZ;s>@=24
zFQ%$i(Ka*-m1%!HCx!5(GmI5KP7;4QdOB^(SF${p1Z)CT13crR^uR31{4*%ta5QH-
z%fkfVlqx39^<2L=lf>P+1QloJ2~+>f6Sp2c<8z&m?-@<YLeCGq^vAFmOXVijLnK@6
zS=L#S4Q=Gu>X`X3Ev>5PmzLGhLkg0uEcw>)ABX%c9%pbO(H6SOmbtBz3CTT$QyNjH
zW{tn-8E;9{DUdOyF=ubKsLzS_w|ZWY{CB%^;<?lFFAN&35=E1`Grt`M0<YCNm^*IZ
z9pw(SE!V79lhii^LT+0X4s}{<;X$I;5hb%Ejk*-U>-|A*gP40iSx{E5Z62x1Eu})k
zQOOXrS>uZFqfsU-J9lReFU?rOo@8XPBh1C(1(sWB7YqQ2&(PrUE@Rm!X9U?<kNe(p
z+<sUZ+r)SBz$uIuk*_*29tHP4>ybrLtJg0%3r?Lpu~-G_3LkDUv0f1=*P70r1zz?r
zZ*BoW^sSdp)*hT_2~WU=#?Kz9CftqpWTZe<9@n@w7m5W)4_d&d?0+_RcfFqHW#+&f
zus}NzMMwL00T8Kr%LcqH^!xmK)Qp(Pz(^HD6ZjBtsi&*Jdn%3KpY`grZi$%&p=0fD
z{#Rs}%Rr0J#YE|H2GpcZA3nV62c){Bz6DSmNlRc+pZ5Q;|AGAxI_8}zS#`I~WrWqU
zW%&(Rz)#U2sx=6stUb4;NIlYWqa=zc8dQHx4B166vLF4}KjZa6%`g(bJBqX8!Vmt4
z|HEbPN138JMzFj(x{8RvDQ2dkx@OhVltQLxEWMHpZokKMB^n~zpC^PuaxMG?YpU9u
znH;$<F5LJvXMFD`y}^x>wIZA!UtSrfCv$i6<Ix`l2cvgwxHWjm<C|_+^_)n%?1r^^
z@veETJ%@l&e)d^BnUef^3***UtYl(!2-D?-wAdhS!82?SSt+aW^Yd7Al9H~xje(*R
zEdKepGR3WvB0*g&#vb)!w&S(cbQ)&x;9;r5x-)OJ1A#TH$ZQs-F$2rZX-Jo?pHdiU
za=P$hP#({Ym#d=%07t-_O8FzxPG_+2Le>;TJ;Tcl#xzb_ZI;ISfr{eI!5+du&F+yj
zLA8W(Em$7yVB<*upqsCaqn-gdcnTa2$LN><rgO^ObKlyA=CbLOVHe^usF(+s)OvM1
zh<NHZM#ZC&{aO$B5P(ijJo9x@NIxoh%ldy6Y+yYA!<;llWF~ZMZeHUKbrzweBk@lB
zOrpO<Be#1-p}<Td@_u|dkAKjmbav^_pqL$U&mU|~`_wgT18Uiq+($mxf~!Y+liE$Y
z@av=TPCz?0W*~Vuet?<0U~#oH?ZA|7ErTubQ}SmRJs)Y#mu*d4{qMGiM)vmPP#MBE
z2L2dIaA~~LYyO*NFSq?EX?q}`f;ojx!#`M2gGkn!gAGNKNLGVrv&3AZRSWB*tML6|
zlS_zNk1l`;DMZDWWw5ie^G;;o?|s2`eRcYl3d9gY*u!m}{N7#o)gPAn8vD=UFDf}o
zQt5~5G$kRC3?XzeM_$2P6$J=urIG2*J6hWYbs1eEw6^=ZoAgo3_x>Y7g@78Vd%Uov
zmm(`c)0^CkSCq&qm!>#9RFxxxm#?CMD@zr{Dnh%>a%>@Z|HsChw`2FYtCwmp!yY}4
zLo|Jqi6KGmMk=a^=V~~vml-8&KWklB7UPWxwnfZ4OwXwbQhLSqp=j}i6tM(8r@Dx=
zA>~;Aa=FxX1}VCe5BTWNBEkfsxJhgNNn5^OK2*fL+$V&EuH<Y##QCu_@cKVKrXSXe
zfDjJTCX?B!vi6o~!?*lCQ+~cL+f}1@!(D>OO5Mr*fvMlG-y6dyWu$3#{=<Y|cxF`u
z|Ie+u?Qm<Dj><1Kp5OZ*4{f19x_0pUt*=h=DFsXR%J$^+-ICmz#%J42PO4-W@*3mT
zynP`UaU*`swaBD?H7-6k_@Z9l%$B9MA`z85BKR-!t6te&g%_#HvFiX3GkF%TYH+~N
zsnQ_!<$Z1RQF61WHXCbHA<Msi{0gcMdxh0ycTr>n@+$s{dm0H?q0P}*+$M3G=`lXm
zB%yhD)34v66hHjP&~U86Q=pc<wTHRPk`=f!PA%@ok|&b$?E3c34<ky=In^PCPWN5x
z3oP0(h^QO|V>Kn-s0W6zdbq`M>C;W(XKaKNS|RamhUJ$p+&~#?fBs;`$YF!kL+s97
zD3lAo@6h#l|B>0z#DvHc%W8ycMR7$ju-d5S_6;Pm7AoS&`(CX2JWI`t6+$FpTG>lT
zx>;cJ2tUj4aB#AxuizWurWpBbj`q1pN-GQThc)&*&y<(KREn7vwO8EnTV!=jR6_$L
z@95ED{=2ywU0DN}I{Itsmo}LL!soQ?MPKYsN)^~&6%HOKDQFs7C_W!<uUseYVnuh)
zZ~#{KKSQrbT<*F!s3g2Y0m|<izgqz1hU2xskyFXWT>PZx%@=ipLCK?ERSa)_Az}{%
zs3izGi5wCmzqJn!UB}yuLwLV?&B;66b6?*yg7Fwv-dIo?PFt>Y_Z>dr3A2QfR`KVU
z38zP-TRH60$!TF5fBU5G_9S&b#kLwJw#*1Ab~iABAU!;M^+jNIRFsdwQpG+@DFXm<
zn-ffVvz``Te(-XRxS?L@e_7Sx*f-0U7gs%{_hNF+uBuI2ChFZ7xCC=Y5a(NBl^&gI
z?VBuVW|_K4Ny|R#3F>_96^^ZBwQ)r6++g-s6b0Z{{J(#aIU{?U+@m~|FlertU@*&?
z)Mhx`t_F6s?E6~}aMBM}8Mm<!nEC<BfkeN?7Tev!&*g%jNdEJ2wYnz@H2uV_>SZ>)
z3?ndwrhlDVT<igIzobSfob2q8F_nVD8_(N{1qR21G7}kMH&eQxyAV1@wg!Fd+?P@2
zs=uJ!g|fejr5<6)k|mqTXfPC}1FLh5ao|m3;IKVFJ*lYVh+Yj@5cR))Yxs!;Ezt|s
z>P%3W9(H4}mF^x#KoFjl!9VK!2e96RU;Ogn(B~r=HsG7nW(h7%`N`fhjd{c%RX*AI
zI+HdNmjLb2H3lAcMl9D$YEw}`DOK<@Ssuk_6842Ns_IS^Q3_UvnmoU=SSKK#9!Jy?
z+GJS_&Q*`QqrHFBe{oB=&Qd91v5~gzb8?pJ`S+Ee+p;Gkl><rO{e?sipgCvQ&ru5z
zqrYaok6qVvhmg2H-W^43n=JOTQHBubRBg%9-ORliz?MR@fy$Lf7TuV;=w`lY`RtTH
z<|%KO82c<Q|EHdGT|=lxxq0Q&Y36YOq<y}5z?c-za!vy~k9~}0b&9F*p1Id4X;A=4
zK(6UUA>Qm$l>REvR8%o&ftY}7J3utk?DuYNPd-q7;2FakWy;B+``az?7c~G7aSYYA
zwXt)%+P&O&MQ)UcOxMkQB8*37>{rmvzN9RTXZ&=cMRwoUBy>w1{J(XBMM4cdB&c^j
z{)d-Jn;Ssgr1*GADJv0Oedql^3pROJEjVTV_bCuJ9>a+42ljn`w=u8e!3Hg2&nG7n
ze%kYI?-L_EQg~RF{8+wcj55)^I0_-BNJ}vA*sasV<X}U561+6cl^1X1tE5N={<R{c
z&vZ6#7)B?4<9-)<FkKQ%h{|CL64wr3f8u>w>mCMn!khk85MeDB!j#HylHmMmEfaPX
z@J0rxYlO07M#Zy^(?PF&)1eraLQ<kH74Hp)L(IdsbRXH8VUPCJdOOXVX;iEOqk}1W
zv3yQiXG*_tSG3&uDR4L4NQsXuONNPvbBEaac*eK6Z9*Nzhz^}4u!@@|^ajL-Bm0CM
z!(VUO%4Ks)<QB3;nR$su<$e`xuoch6Xk0(nYYVcp>K$1hp{TM769oxiTUMUv_PLID
zN0k2A@ZwMGA=%FPk=PkdKk1x8uMvAx9d5nYZ~vqBdjq#oX|#I3q4Wo$p)XgEEbdCW
zrq^EW;g;pBjuH?-iYOXu+I?fg;3l<frYRGwuB|bRacCC%?CYYPM1~Z*koO?@9{bdh
zDvL7O^#AV#ns8KfR)=Z*j8UPqGOjjjOR7>#)b;$mJi6k&okQ455f%8gC8Fj2;YE&1
z|NA1}5~(&Ox{Y4&^He)6wa6+P2ITNy+4GX?UHo22%i3ya;5+#Jd$_&(7gs4^%&|?r
zBz+1?DZ)LN29rSPG!0L=hgFE896G?(O9*{xP8%GI6ZO95s_*2_R+iHmpclXF#5*iR
zRFHHLMTw96TJhOuKR7sukd7DZoQN!W?o*AM@|j*azLy>cFYo<~gyfbl>6slJ&SUc_
zo<3J0=eCLZhS<Z&1U-^Y&`SR_Y0|Pelo_>Wixhu_#K15>O3PVqufp8owzXN?!|dv;
ztDw(gShtL#ObE8!#2m^?B%<+0`qzl5;P(&=ydH-rf5hAz{;woKlmaMf9TxYCB6v^x
z5C=slDRXL?iz!9<Ueog<3u^3G;&Ndk%y-T=-QChIz)a)AG#5eZQ441tRTj0h<rxkw
zew>vht~MYkz^($lz^Q|Teh~n<Wp}?QEhRc)=@TUHE<!x(A3UFUd66K*hc^1m)y9b}
zRncDO_aBrxGm^ok@Bra%Yv+jS2HPk@hkU3Ks-1xc0cxt{r|7AnV=Vnqm>|v)+*7Ua
z`*PqtYU}aWT>~pU8S{fzpTNF1zEiVuMX~XRQr{7(;+C)X8a^Ye=pN_qLZH=Vm5;IJ
zYr7srm?yIv-}hrNTEEZ#|Gtkrk{LghQI_p)!_APWlVEAaJ#M~HzoTD$0FxovMET9z
znG`(vub2<}g*W;Olz$Et$C?^qxLQ%%$NRHY<4(yoSq5#T_#py6T__B4RQvZl;A^po
z78&;4r4Gr{5IX$9TB6ut>vGcRK@<&MIo<MZyes$T=FRFY6Z!E2$(!g=0!@LL#g|1A
z*YqyMzX;zzZ40x80cyF6bA9*(-lR2eO+y2_o7Bb2DD~q5$kO}6q4%okqhS#k@)7dk
z1M9R?i=BT4y1z7r`@9O-ZZ!3#UG*}Jn6suRAm%C@?*8?Qs!&j18}p5Xln}#Gux$gQ
zy`zbo+a`r=4&|I<dBk09_HnB>?VRFh)7+;opOiNzy3hUp9`#?YOWc|30huxOU?#cA
z+q>WQ?L@A`y~1>8wHl|>?lCTJfrURXuH$aMqwj&DW$NUFcYhOj@6_x_=F%(36&0+i
z6{DQUKo|V0xtTidEXK(Xwc}K|BXs3<X{ERCT8==+Bdl)fsY_yKf;ivk6^wvi+Wzox
zb@^tc8{!oK5e~~?mR;1{THUb@&bQcl4WY=CXH6$N8R}&w=GJ~+nGsS--K{j*u-=zQ
zJS*YzcpU2etr;@^D|Jjlwm5UtL+JG7P?SPdwuWmB=0{S**?84ox7O>Sa?88NE=X^O
zzvSZAJ5+~D9pUnER9Q#!yt5h~x9MWvJ`&~mUD?bemqcJFjFAygYANoOqnnER?_mMh
z`ja`6dNYg5EVO&8y*2DTJ!e6DOu{Jd8pi%28&}2vCDC2}ylS52!{s428tdaf=L~OF
zZ;j$f;Pdsa%a-uFoX|Hg7%uNOXQ3jGkvle~|DLO+N=@{Ngm%bXI7r%)d^Tl{J((_Y
zs3crnMT#4H$+<_CaopK)n}W&GB*4?zndbeAmL&#Dn;biHo3fCfKVJyO8bztQ3R%5?
z^Kn`XY%d;+&wY;U@xJ=8t(y^{Vp$|E+QFfmTRbqOvgpe{W)wPXo`q}`&ikS?YBnX6
z|Nc)ae$3YMOl5;V`@_zE!-Uj+sU&B4=zhja6{>O|o;8jTty7J%VNosU{vl88-@{xl
z^XF}|s*6e!?kDx1zL63<=HPG!H}<uy(X7h{+U_%{#jS2U2_i7g6MK{U>)CC(!f7cw
zs_>I;me<C=4Zof|xCVt-{t8h#G>|HKJa<!BI9<UV^{V)eYdhCMq!_9LBFn1D4SuGa
zN@lRY<A7xc8iU?vrn?C_j@E~R^4}KDCwf5#ckn&<`Q&3QmXjd1ut>-=`$*<j<B{)|
zzk!G=oaNXGTbPo{BJu$cm3sN?>P;@@M~b?YDb1JPjIoI>zEyH4hw3_Rji#FG)2Y-A
z&G8E3B2w+n@fd-Ho+95ETLT*v0lb-iUf+LCidWvIwuv+EDc{@JDB6O<!^4U9!6~Tm
zWt4hA?P#ddu=#!4%_00@EGPeAJIM?E_vM#;q5J;zrG?zbr6w0?26{hG-y&)EBExp8
zqOpldBk5B)jC>C``+Fj}HyU1#{PnklhzQ;_M>xKhsVl<_Y>KEZgzo4=<qLO$=}55n
zqP#d)UzyxSMQHi7<wh99#>PSxS*;Pv^8_{cPbl>=qZEq1`l_S3y1su+a06j|B1v%k
zI!L(<|B2EOQQa=SnJDT~wC0J@1?}*0&4;_f`lR8hdE&VWQDyE7C>WIr3rzlvahkFP
z{mFpCI7Ju7T2F;k1f7!xrslC!!Q*~cRT-6cYs}(py`OIVPInScGj2C8+;_`z57#c$
zd3#)b!2+*K1KHMSvBKuGqr6y_xn~dlraV)O4(5wgdX?jAO?G>EWFGlw{mN_c_?kn8
zeY|;SoVYbTAhV`!)KJ9IkKe;ifu6^B66eVM{WFW11@Trn<t;{49+i<+gCZ)5S;9y0
zO?(yvwGjKt9Pwa#%h*h!L&fF{i5^Qu8HlBUDjBoR$oBgQ;zrI;t;nA7qwNd9;L+#(
zbS;l26{8;WjDfjV+-qvFYi8CghWJvWzvIcE)L)!(C#o9!Kd#;~tjewX9tHtHIyNPn
z5TrY#q+^4Eba!`mgEX5Gk#3M~P^7yXQCectAl?1mc%F0q{@&}_AMuOpUTcmy#+YMD
z7}l+hRQld6{f+<h36yxm702kQ+BcH<3sl$v;gU<=9oT8CId*NXNthzcU&w9%9QL4Q
z(LX)Kr=*y-h}{<eS=k2|WSF4=M5HdjNVOtJLAtu3A!QOi9EOUD653@b2am0*bWEs;
zaz{yJ1cvhB;ygq_5SYHHVI#V>yKRUOp>Z=bkrA-+w$?PMO7JV9cUNzC6R_}ZMAcs}
z2Vr&Jg;p>F(}a-=;YJvnpZ3La`z40sQjFJ<A<D7^RG&Sc%tK8Dbxo6*O=nY><jI8-
zP^FEFF=E-3-cas~CQ5jl9xvK|-r!jdt)G@AuR;G&9`4Z3B0(3jB(E0!agD*#kL$<&
zeuadeqQ^<r{iHu`4pv_MpGZWQk@yQV{RU|PEgTtjNICw#^v`_hBywmF9mO@U1*UEF
zG1!w@ENk$taIPY%CcZjfBz(g7&QE`1dFeLIKj?AMn3BZcWHXWe4QIF(Q>8;dV2U-w
z8R-?TA?7#Z81`t><}wPd`G!MT=LN06ZkyK`(d=6o3Kzo~a$(`auB$0WvgRP$9?Ir{
zlg|zhhPbJ#gTv-#nA=ZXz#jg;pGd?dqr4wx@6BTubJlBe$%gT|H3<s%Tm}el)|7W=
ztb^F`#d1Dry7K8}EA%!dusawsb!MeB6qrpQzTcJc$N%f8_am#4>qYLBjqWpgX9;*2
zrhvCwfwEnenGUP#P-5@+m;2J!!PFujwWC-7QaBO(M;YaMHRj{OPdrI_Lh)&eR1|v+
zcp+-&hqK266<&&VJj;2FYG0E;XrLKR+>p@S{~g>)4m#5BBT280q=peT-V1mhOCY|g
zwV(+k5c(-0Iu4}Nb{i`ebtW@ph6Q5ob|1wo)k5P^v>?Q|At1^j(L}<|#9<~-{91OA
zS?GXE6r?snt?3yfYqx0sh|v_SCDW0?oAi##w3EhHwVyh%P?gFULQAlD*RRB!ot8cE
z@uAKvI`tHk*=<*8Z8+0pP<x`K9_w<arzJ-1B}YX<&f0z(*9<gKeV=z@4{kW@bhhBS
z&vc}$El~C9F)k_*Rd4r!($`yB*~&1l9dkyUSI)GiNxWy)up!vTC~8)L(8s+>B!wHf
zp%H;nBq3p%=+#0)ndQhODv(LZGp}u?KkbCQPVk+HaPxCuS@?CT{Bd#7O>_7zjQrf)
z*7awUYE-Q7y+*f4MFVCnlVs&Ik7Tt}fd+SHnteqw`|-$3;i0bi{_U47CDmpH+4X_5
z->G{Z;8At9C9z-rf4|?y%LwoA%eJdxdik+3GV;})7Qb3A(0d_?deWlGhoIZ!7R_#O
ztk)y_c%M%c;6MC<iLBH=Cs};1L&%BGdd8yQO0%&|AHRgOwC#lj6YT`vY^aISs0gA6
zJ0<^56KunXRsMXU0_YotPwdWD5Wa$_yzBdmHr6>b$98sP1Nb0G3{-zQxngkO%O_TL
zwaTdSYXR$ggOzI`qpW7atp%R+(`*N%eFeT)x!Z`2;Epq0t~pne0YqX+;WvRM4koR!
z9~9s|@mf^yhM<H~5{6L{gx|<h6Af%`>VV^G!=RM-(2<!ed*5B{@BaMc6S*n!PKpa%
zv<-CMiwU5vB^L{sF~ZGi^l-3Nrdyq64@Z{Ml}lDu*2tnT*sF?7rJlee50?flUEQAP
z*7H}E^4m@!V{F^&6349Cy@@p1Hp;l~4Em@(Pe>!G`YD9j&Y3j9|8{tm<4K-&FF(>c
z;X#S{4lEbOB9=lOr$el&rslfN6z&{jn+PSU8fH<~{(dl0&I~3cTUp5qbNc15^7Rc*
zF^~e`yQb^}I#-}Oje?`oM>*&4%{{^196U?!lw^p2MyTyQUao(C!sMT^I~ymSsI9yC
zUF_@b9<LA00^N4s^+%f_6gHNh+-2THf6zJ~+P`SMhGVR`0A&l9lemf|;j!V*9yY7J
zJ>Q%EsAxLx=I7y&{B7RWdxA#YQz*&`YR1V%5;^gXJ40`9D<6+CyDa$$)Th46p@TNj
zLVZ{r!pVNWtL}fM-cw%S^p(%EV)7(z3`-t9!g`XACWxGCImC7?CYCE@z{`=wN$@3(
zu4|@|X+x-%!5m&Jn}82As6~qCJZAit{}aAcb#Z4)G<d2JIw$r%T(q2q`@F5lFYiYs
zj>%X-VQeK(7!CC8{a)MMw@cQC^|o+|uwB1(bw5c7dC)V(-{Qz5l)0%dai+-|pWZzN
z7atP(9}!Z5a?`LS1==2N+G2T@e3W}5Z&W9&es&svH{5#M-1Qj)baxx}a7d1NBwy}O
zpF1>e6g*Sd;n=Js($&gmHfkkZhAw<}cu@UtD%9JR$)^`OdW`x!LzT%ky>ITCFF13y
zfy`(|SfX@4xxp%xTnHL0wo{9p)^jFadzrr&I$^>MPE#~++`d(oEXN;Js91#^TPHbw
z@d`%9B3mwW_k$j}Fs(|_7Dpzr7+HI3pA*GOaX`LmX+ZiWT>Jgp_MM<<0zY;!cq^Ev
z6B`VmGMZ)Cr|18Nt3#fme=#Pg*-%Wnp5S}}*x5n-Zf<U$D<E6kx_oe|PacU}$*Y%N
zI?ErwnZXDAarkhaUXa!}O%l&A2z8u3c%MF@heZ<avy;3c!GL74=!!(Qqb%p8ABu;N
z6aStDZlkINgGOQ%^T`_*HQ0jK$}=Ro$9Ivwf*b4%Rc*bvJLoVhQ^kfQsO!aDW!FZl
z2yE3EvkyidDO<j{U(wej)=wZ5qnbAYt0Cx>W60vocp9C%4zt$ANC=NWH~~vMMGA)F
zjBnH(?FHKwsUiRKRKH;Zz85~<LPxKkcR~>A4&HOWO4$Aot_SV?6lbFI8*f(MMqV|!
zSjUX6CT9pM3D{ZuW|(*hNZu!}Y`bqnap=!Q2{Z2W^~3-w>k`Nj4M`aU53I4h`v~&j
zm2*LW`6Wn0`%328tMlKTB9r@2>~05kIiFk?7=&YrEVx&XWbL48V4G+<32}C61|)oa
zCEFJ!T_9*O0oRpBZ#K!&8&7s@5(R0YIuVah{+Q~RudKk_ZSt0o0y&190!4d6sU)p#
zvSGkxfUk@xv*bkkgiBaY&&*q%@|G@GOJ7^6aw+XK11T9e*ZT)PExDd|xf|M0hH1T-
zkL^%upH~LT6TEjHZ0F`h?8n8qA}6dW@EsjM=mV|+4M87X@iZ$%{yEZrAh@Csd4ZYn
zgy{SaTe>G7X?Ha?4RphDDWLuu+NBm>wP0TN`%MQM320ttq`v}wAU%FLe9`~HaQYQN
zCsXgCGy{nLQE~Fl&2hwYN7Nh*qlvpP7z&i@Q*FOtnj<t1#WS@7&AJLK)s15+LLf)S
zJ@{SRsxD*HjM6UW1dG&>w-@vo?CM>EGhJR*kv(D4SqMir=BV^gtx%hdO=TRcF-k$t
zYe&Z-a<+kLHh`jL6e*4|PZ#zE@9q2HE3d76;ogbKSoWMtT6&|7-xR?l^%ja0M%O0F
zAB;(}IJ5ecNYNC^zCSN&v;*{)pEp542sodsvRqzsgb+LO=Vpho2q#>It}0bu-UG3p
zxEEi6sI9E4w?|l&+E6_P_z6pocax$;UJOw&;>{Jr^t~sXKvgrG+Qg~oZ*`G79@pB*
zUbHaaIAqJ=wc!^7V~wQ8E>FBMziZ~xpICf3WU^0pT`keRmQr0wRrXaj>v=XR?JHm{
zUh(WA=jIWCJimV*&bfd(q991-==#lwqo=N9t#r3~twrdt4nlfq<80_Og3V^gU7`oO
z^PQ>G<8TvM;qL;J%o1y-MYzA9)hE{2=E?2xmUKB`7@R~PML#k8`RMBdjmp+*E67Eb
z^>oF$sh~=o;{P96<>B5R7JRE|ZvocB_mCI^Jynah`mLn`1OFCpm+w}xn9A*m&oPrY
zfs{&ed$ld1A4=p7%7AT2U=1om1X2h~iy!&Y!~I2dTN`cGwx2jWDjH$prjfw&h@x;9
zsE=NP*$2O)cYvVZh^otitKEga<GA<fli0X-+Vu`A7z?BqA3h^+J!g&z6~7e4$S@<7
z-}epoJAiB1C(Av0@%<(K3!J>7#6<P#FO4Cib5EJRy<aFBBIKts%4&9r<jW^5)^Vv}
zN@`Wz-Ksj-^grLEY)naZ<EV>#lKl2oMba;B@V%Adt#XI!LRer{&$=g!e7288Czy__
z1XUP>csKoUt-r3}f_qK)0Miej{Jt4DX}3{q)?3-q9OE%3#o=o;mq;;!E8BbH;Uo;<
zBBol58MiBo;5FwZO%wXDqI9?#yv1~o-BJ_b<xN~c2(x&oK5d$^=tO(H&IP_m^3AP{
z-<_)(`IxeDbJ&ID2pB(n03yg^cjQ}DT`P@PF=o%3GycGF!j5r)hUieC+1U&y-7y_`
z%yeE+o8FOgnH=ryhi>Z}k0jCm-PT9&wH^uk!pLWxSl~vV9~Xv2uGQ4k)KGjhzMW2)
zefv{gU$FWv_fNrAl*{|)^;XnlcuPwTd`rMOYW@nn7Ay9hQYai%vu4cdjMwp6gwOuP
zjmw*AV4x@*=@fEhbIjCd!;OE0+5-|L>dehUEsKw#Q(H+@mZWx^uk^pO#+8v&L`7oz
zWv8yAwG7H7f@s;=AB0~9!UzThzbkK6Mrp$=0`t21cm-yHtR;)SB`zo5@t3BV&31S=
z1n|m8*mM@r5faB>k{Jr@7<24LX!JSx*6Rg)EuXGx^nDh6-l#dvwQ16=VKjI6yRs9l
zK!i4%C`3h3FGPeI=V+`;3aevx2kYSw>!{_xSH40Nb%G9d#dWAvKxD=a+m(cokG@MZ
zce(|Vnfm$skK?nJEAMwIKMR7b^;QA(>1r5LBr!butu{@mlN5)o(~d=oqq&N9>e#Tx
zk`y?0_>w=|+!wtumYSbsp)O8>UC9}vq0SttRcc0pMX2wI_B9`4k_=0kQw<r5Jh|Fs
zSf?VlcD7&;CI4yZbI_IED6O4Tbpu&URb68!u%i?K2nYY*$Dzf7;zKNa{wkH4lIgYe
z?eVI38n+@7D7mgLSyI_!16(InEstaA9`%1|F<fPyq3sPFM;Dh*lkoi?(&pknvB~-l
zaC{~891A1wcpFW?1vFQm<V6_g{=m6r6_tJA<|W_v^&Lh9+=TqW$!Qj)zwCwxK{-VT
z<0k{dS#+5xM<c_RbGQ#GQMJ^t59Yre6?oyIA>t``{I_gRqGs1!;EY}-ZZ`I?uiY$v
zMvFNsTcnX<P}IxofQS5|B|1C*(5;N)ium>ETq%jg7xfYQ8X*{OhYf$12M0rLPA&=;
zzSAv#C#28jTWJ1IXA9RlMQehaL-pm(yUoc+V<t3nJ^Rdq2$2w@Lh{>XWXgctOEYip
z`O|srFQ$GuMVnl#C7UXH%Ni&2Y%%OecAzKhF;ROf0Ot!D6e<mR=eMJagV38?(H>>)
z?1?wDySd(i_hUrItLmNi$CruL1_IBM8;DZ*Qo`NkG_3O`v;aIvT7j4B8O2U^Ixg&G
zwc$!W*%7yG&0zlempRnGKE{XzC|&%ey>6bKl15{6PmIW^t@gL1d$Wv~aS8>$?V7QG
z-C3UJa;hfMI{8}dC;bbWf&XrOj)r1;X~!^E^eHD`J@q<g#+P?@UAYLylnDrpkALTb
z`(O7Oh$*7l>q<>j@3`6<VGB?m5<?3Mb$h^tl`Ev$-ToeEj5K6k3%NpiZxl%v6Q^jf
zKI7oyZuq$@WSt0V2e?YYfJn1&l%OXRjqG>A4`UBOOV{N~ojk2)%<1!jv@k}fnjEU(
zFnBIRNj#XDAcW#sV^}QvmQaVuA*dw?Ih+RJL>HCO#=zB>ka72Qfh~q?JgDV}$U96b
zSq^W~%^AHZwD)@`ioY5UtD)}={*NU0WuB{-_(<<6n6lP!t8C5fs&yj9ww_8Llc74$
zi5Mc1BGCgrvR?JJYt?P*d|FMH3%(Z6YNoH1dWjWz%qHu@G3)B%zWTb`*oPxwlUw?a
zp1bAW){<3CX2(LQ_k|Ns`Z2W4z&zDAgX+~ao;V}<%)EMdelww_-mu;;?)9;Gepq)v
zzlIuohWR|hl{dN$OwD~VBj^+GUNiKURPt$7>ZsI*s7lW4@UTdfqT#bGD5EOHySLv}
zDq8jxvB-b5gkkyJ;t6=2N`sS4+6XadH^n!8K)_OFWgdRfH-CI6|J2U)AybYNX~Qtr
zw^N@`NCPg%jZ+K8nAMn30#2XNJifLK7Ks1IU#$2E2-r{(-AJA`^-8^jv7nCjM%P^e
zB%&*T)^P>mX&rO7-J1AF1Gb223=&Ft1|!$j_4#y-aXnhGcn;zFZX1*5dz290<EJGa
zDWqJjA;XWhIpKWsyL1QX4aCdn-^@)*1c<3;`g=S`)x4Vry|S5SG;Vd8P4ZW-R<02$
z#5N1%B5NOf>hPWATAub$SIQ_~jinj0?U!isdJzVVgH0b3flgoV^%P0&b=63njP(%g
z*vOMC@S4M5x<lXhBz<4F?sTm--&oU}AMS3${+@=Ln_I#Kay0O*?atP5JqP8jgz!0S
z)@P@k6|oC490bz_=`;DP_#{?IR?w}AQOO^j;c*UR^Rw<LiGA~Xd!JPjO2m?L&jOyY
z?b|oXpT%yege?l#HB*N!`M%;eUw_pX7a%p_=4TVumy*V{TTj`g!Dg55ovGmM>J1qx
z;+f-My<7AJ?+JF_uf9%3-+z(ubfyo5@Z=yH#nE}Vb@Z8`%6fXYr`hfFWTE`g${v;?
znzi&vC;ryqvcf_^YIFfgHIRlZ#CJXH@<p$dD%y<b{Ki7c*rc_AoA{{U!Cc}0krnGQ
zffXaBh{-Ax8k5;FNB8%wDBeJyBL{kQxlEO}@#f6oIh2=81?vq1aJS!v{0DKX3GPFd
z77#ai>=(Z*c^?Qap3Wt_V?n~POx*yaDKiPY9BZi4QzkNv5RKqmRCNhLmF$`PAE;<M
zACNHck$7UF)$&5rN~4b~qOgQ61LQehpgh4TQ5Y9H`nfZwrCC&zt~RJ%ddtX)C~f(i
zDuz~imA%F!m@dO`K{$YrYdm7C!wo?r#@sI+L!p#s<)&3r0H;_(lV-E%r|-+C*cx!H
zt%a6Wg#Ty^`;BJKDi#t0m@_l!PDf8K(T^N!uduX-$&OYMtYN;-IH9`kF2GZ1Nf1ki
zPN~z!UR{=zpY`*~<97A#iaUvjN4xiXjZeMbNR$V1qP7%66W_){Yf5c@lvMDx;k1oi
z-K)J3juTIT51#4h7b6pe*tRO%oc<H}bj-$^=^^YN%#wG90@Iod()H83!(r0b_G!Z4
z&0i-?$K5(a!5rKRvD4|R>85U4qix&Bx*2QNpb1SHMUyEXlJcy-d_~9W3Xp&iG}fO8
zu~Be&d3;MtjjoJsK#bzx#T5B%2f2w4b`36k@uk#bAMzg`@xA)+3tEMKn;e=>Bv1E2
z^GVFB47rn8n_l&9$KgVAy8aK*+T{dP9o@tsqg;dZ68`a2k$9Ky5$1D<f~s|<0?Bf5
zr9g}&yi75c=9bT5$pt&*{f_Z8>1GU8jBXY%)zs9h8os*vlz`DN1rjCLMT1G`zrXBc
z%A|nyhMOC&Z8S|RW4nz@jE>nP*;c^!Nws_p9#4N=_OloS|B*;~wKIe!^F@Aq%z9F1
z0>k&6$e?LFU2~$Ao`rKU57;tV4z6B?m;|Hc3Xz0I>yFl@vhl`smjA_-oK=Q~j0`2t
z)*2Y5qNmH+t`vkR(_HRg60ur5JbyodZ39XDK2O_aBhc>RVxWh$GDEKu24g2nv3-{{
z|B2FWgnfFffR~~A;r6NkCHzSl8X;@)P)@i8Nwn0luhquVna!FxrnsW<>Z?8?wxgVD
zbR3&MDB^$AP*za03mohQR$b58El@BzpcU_Ww)68Au#sK`9&Sc5+dUrJgL=+?5VM2?
zHp$Zj+>=jdKy9dtf5~_B3-D_6pj7#_v1aX_HQvkk59pjK^f;NaLssEa%ikfkvhGsk
z#>S8GHI$9v^l=LK9HIbf$Ahv2oy*<T=EH5)>fxb+QQGB|`u(<Wg7KBhkZ7pnyU=hp
zxgwq6Zv>=<xE`6&TFls@N{J)bW7oX=9>E6u9WNPjs{*U&9Zfrbqf8XVZdXONbP0Y=
zLF+4B{rYWcm>5+meONF3dQ6`+2YdZ!weRvM)}N`e?Ygv$fn6^v!HTTpk}(3ac62dj
zRW^w{f{1gT!z-#n-9-;(&aWS5)ig#aojX&~IXWBL`HU_G7iZ=0@(p-p<t`RS9&=?=
znaMqICDgW-sl)oq3g3&e@i0OGNq;u38_0|XD%;M!p}__<_q2K!)-pf5z_-xOIH^(0
z`9V}#+Uk3Db<vMdjp37Y&)+F1m!Zb!p$IPCy0_a8x5_vYjy4`G8S{c+0IXe}_S;j>
znjC^@xd}SIYa}~n!kHi@r0w5ubpQJV^`9su6Jdt=u;RxhB;ZH5^1Pxhb%LXGd2Rkf
zAj5y~&dK%Rv8~Yif3jLXp>xEbYTJc(8}07?LIV}12oP9W=jQIdF4H(ZPMja;_@-IW
z%;Y;Ozd2u~2{95)F>lKZroU<#;)|(jzTrTEB8P|K6`=5^OUWzR^iV?DrU~Eo-Uxe<
zZ@P~eS{o~4nhO>(>#$bK#>BQ`vAx<fUWjMK(dHa3z`I(1g<p;Q?W>5bOy(%|2qjps
zHF~x__NXfM-o#|?YhWq~2$qjWD;U#o-K+rD-FogN7y)nm1N<w%Bg2;%%j75-7rxHH
zCNnF}I;z9S+rtkU2<Vh1azf-i&AiSzYAm_sY$zXO10MOpGb{!BitN@e5p^j<m1>0M
zq+>e5vMV*mAVn_x_t6RFC^}h6<ebb==4fv_qLnl3SRjl#xlAdWJ4)+Bla3KjxFBN_
z@Zl9wAVJ0Omn^dRdt<c3*WuP5hygAp#nL!4pY~&0rg8fp>*N0p<e0Pi@&f^BfX1Yu
zu5tC^c4LJKt!(tB1mscO++Y#;dCq|Nh)Vuy**uK3QPtNV7uRRI1hx)9NVHMg#iF;z
z&EB`|C!dmd22N1epp<kUvR&;`YRe5eJfFfIsIn$s;$38l2{?t4yw$6J=+_1rm8k1^
zN-n6=!R5-Jg*<oZ9uOWpI=uH~`ZnJ`&9kw|a4r}UE{h7UFjAVw+L?tYx|POFEuBlO
zF--?c-9lYWRj>8q7U$YGepn%ur9qJG74I&<#Jzl{%vDV|>cX^rSw<-GLV=$ES9KM#
zf`LS@qY<2g9lkG>0B75JKuGsAHPUO)ZekX?YEt3sc(<|%Bn^baZJlIHr?&CBkTCdU
zNi5)nzDg#`TY4=foRYKn+>rilPky1DsY6$z=RpcHwBaob(ers1H@OZ@;>31;i1>Q~
z=x&+A{YriUp;xWanrg%tfj4d_JZfKw&h`BcV<ij-P4GB8Y~8+5R(X<J>#d@90?S?N
zr;W%QQcf=_`>WdI`n*@Em;kz;L97BbKEh)lRnic!q)nw=o7wGHA1{^xB2#0C(rtX{
z)?>l(#Q6`<8?8J`+Hrp5#-Nmevoj$0qg_d43P|8YLIKE@&77pIh^g0p_NTJACZ^Tf
zg1l!mc{r#kh~=(2=~Xwym<HsPX)%SA{J@IELok+QV&LjfVKQC+@?{&~Tt4QCPj?o*
zk5`3#x)PU5hd^9kRV~hTm;esY`Y<Lr>gR*6XywguY6Ngs`rj7X&iMo^u84z$?ulAj
zF7lZ{&X*(1OqDE##@1b2uNX=61WjE_<g?5cYK+!UrBcO`yPZkF;C@EqV&12q)L#wG
z$d9;lG-{E5$aTBSRTVU&sWPt|6JOYXQoeQD<?ILW700Bc0goHLGPdDPDHT7o@Uo!I
zuVd;unNTy$OP2l;6|n1awmoeMBRazz_w^!Q-8Z&L_s5VaO|zKtK}YtLrG0iAN~NeB
zk~z$MG99RYkiDqKBUP4?nd}*+p2@-Zak&hsIN5X83$yMU4<PBXh*3c+>FTZ@S9GO{
zZ*YuZGKUdyO7Udjso&g6hlIb;$+4N);C;VK5s3@L1*$AMz|t>qb<+PI)|0&I3I0ks
z#d+yKxl0z*L18`;brub6azA)0+4+O-s+}sY!wEI;67F-pE9xV}$NNv3!e3WrQClzR
zY+5f>uk2hv9J+9U%O#NkNjf7_h{0p8z9$;_WSX+bEG&)_B#{$2VnGuLOECZCU!!~j
z2LH}mA~$fKhBW=`b>Qj_BlioR*7w(irS#iy<4vGSlCZvH1bfjTI^NNA_Hyj(sSZP=
zVCW`k!WFi8ufgzoQRl}Tp+Juf7U*5xVu#IYNU*ykTGqWr*|qgB6py*`3;~0_E6}Mv
zdtXAtB9zfn_-(5d$Sk71%A}-#2G(PJ<6|bfri_T!sBo`)AIRwZD-sVcufL>lu$7J>
z%`&EN&+D*@e@<pdx>u0%9FJ3o6FoMwoo92b266AJ?MAIABA@3<eb-hc-M~cAG<Ncp
zZKVz6>Q}SbKK`nP5!}oPOI72>%am#S%7*!G_Cxi`KE3P)5Aya8vRMlCB<%N$@9@6<
zsVDzChjp2tuc-W%>R4mU2Ib}DZ{UNlUM;ry``=4yo}_E%=9MKD;XMk1P6YbD+eH2W
z9X<o&@D}?4MtV!W7rLHfv_=lS!b_9yLr0mSBsqAdoPq>WWKW+qd_L@q!+wclYvTEI
zo*q#oL}Q)zDQY2Z2k-qaJ$W66%hT^nsRO)AfVWL(k~$0xNd(l9z8;PM?&BDt?Ma`<
z&@N&v&ueK$s4t)}y6GR{rhXH}6tleX4Dzdx=qwW|O~<(j%U|)znYBkS%tPq2ht_}Q
z?Hb_pD{!oVURF*TkwI)7e*x)$dcJ3>n({{&q@E?Vn{}L78{qar=w3-TuPP$3aIMG}
zz#mJ=Bg6+`A8*FUijTMDjNI!)+v(w*);`o(LXSz=9S~UvxDJaoq*hkWc>D5c)Lr3a
zm{HaOCN@{nghgeJ9l@x(ohoIyQ+C<rm=bj^>`WqO3{YrJ6IMs9qm6`7YlP^%Mi_2Z
z`D415@?Gfo_u2ls1d6TF1mJ)*PO5eyTKoQsi;EM0EF8QB@{ERd4cLmve1<Fa+bVkg
zxdDpE|A+#543{o4IPSI?;c|_hCp1*;9+Nf=6=_QVCoDk>+y%JsTsY_py2Ryo=bF_r
zZ5ANo4@r%YV9iuY9%Bh9{As{0{t2$1;Z!&wGi3Em2T~6U=-R<X^UHE_m?0euwPKa~
zR&ODMz=X7KjGi=7hz=L$NYR&g?<^9RXNqKmjU+a%lTm`a!V-xpD;Ea>j5cFo8qz9%
zPC*d1$eUQ~o}1c5c|O1K?HBdrD-z9Oooj&v+z1(M?5t{ez=rA2)j9k~Nkly4Vu!4@
z(>5{`QuuVvmiAZ5Q#~nZEv4)SD9$LJd4;bLcDz2RQBR2d+`X2vLhx=jdNka*Syl}E
z$8-=l*H)j2Er|(`8Z5jr#*bYwff2r(R{CVtZ;N%7uUfX(3?1F!3yxO(Y)1M`)RQ#P
z{53rae;#w|!O++_PutZyVg$V~5V9hQD*pFO+JKL(Yds#`8@!6(7ZLHB7wUf#xz3%r
z1;vCJn!mFF(^K&q_Fz|1<;`wDd`(J|BnxPE+tb1s)tizSx-KH%eI)wuiV*%Mp)*H5
zh{z*TEMg;zvb7!MzeXbs7;PlpnB;ETQZY&tGgsuz4oCQ)8_o({8Ig>yE=q#k$ik|e
zWX*BTFR%`S$Zz3*ec0|t-vCd%$LSVM>%-l_P$MwKJs<=!`aEz#S$r&pVS+Cw0Yj2_
zFI66LzQbpuf60)T_-*A1BMO2?hHlB#(XnWJ>Mb~I_KfMZ$c#?c_iIm^bnjokzo891
z!|6*2hZ5YGF!{J)Wry_hZKG9^Lk3mF$b0Q4Ttg2mH)UyGLLI~RW@<Ff32Et8_+~=;
zV#$Zhp&#g+R?p<nETKVzbOKkc*P2(9!S+48ybia|pYLJVWVA&kl*=3@O<{NRc<_t+
z^L9_H2*FIu=AN$>&2vsCg=tON`0rzs*|!F6d?#3*irgLExZHqs$IFcCoO#u>BpjCD
z8do#R$jHph%(U+}=;Aym5UE5=3Jt&)JHR<b?sC5S<23shw3!-?lqbX*>IUuin%+6-
zp`^$a{&XWi5-GHP{m<0GsMvoF=fmwp7<Hf6`Bz>z)t7H5=gTT9PX<!1@YubKZz+$J
z5aT+lWsc<O;rL&7Lgh&`i^5!$i?;fo@5|7M<lLZ3vVjH^K;r5zppkMJ$3NbqO-Q9e
zHfD%zYGcW{Uz(MC{lcKAJb45<atZ8bieKpmPjb)yT%P8)DF1CRz_ho{T<@owJG_RQ
zGb!T-esx~V*)W<7&B|>L_08)KW)XJD%|QwCJrj@zTk?`cjtY%Af4b7lFry1zIUDiJ
z8^ZeK2XLRSQIN!JHYxSfPZG9c_n;_6vzk1{Z6O<jGz-_bzq8*jxUrGFV@s1AA$rG7
zEWhmaic6~$V0f{))rP_BnIj1e1t%(*`5{|<*DlT~(IkCocZIuHgric_x5XQ~e7YZc
z9BrKU7lzeCv(6g-VrC?-xYE7o*ee%C8*J?CptXF{X<Eqo#PDvp8aZe09_zE@e-s>P
z!p}V**2H#h>6r7R>R_S4cmin)a4bAhaFUJ?NqTTDFLfbrfLOG?4na3QNKvE58Z6cS
zov30H9@GCFm%d5gE2JIwG9<x}RgKGD9{*?d%}1fUD-O-2(p3!Ckx$SYR~10r7Y(ip
z!D9NKj74pOxiVhF&^QE&OwH?se;si~A;s#-^ZhN@9LtrNVy0;GDW{<sffWVk$Mc!S
zLx$$6_t}ePyRzD72jopV)_N{tdU_Q7e35V4m7l$x5#Fd#Ht4dB7=68`w$d)XGP$_8
zxB$O(>X_;NTav*&jqq#O>dpPlLF97&Ppb&H@M?FLRv3S8&=EaH-F7YbM)?I{pwt~^
zD&wZaDIQZfY-?LQDpV@Gkm@wdjBHgWSj^HY#qGCIaczv7H-=jMTkDr8c#V8197#G)
zD>hRv+#GLjfBV(iM`msA%jS3C_6S62=i!Z?%-biHCCe{iNw9UJ2=JK`OD1OVSN_Fx
z4{pB4imZ;|B8%NLMOJRAZv16e*V@XmyT90CoibPOgBR#cKBhd!BMta$q!<zM=LU`a
zH_j8)FFY}MKgDDe<bAR+g2&SaSpGL<MsICU*{|>X7HzmalWZn4HVD<>KCPH{GPv?T
zO*2B9`61taMpxoAVO3{B0%fn^!uv+9+>DL$RtuGJgA(=RSHwVWGVQzZy}cKi?>-Fo
zYUt{+==kVx%G-rs?=*U{BjG~qNl7VB!8Udijs?uScU72uCv1^M=u*ar4G7a1%T@1x
zJL^HCm`H@J6HGdcG$n+9(e?P<a2O5$0oz7o;t1eIrR>a+4)07SL{;>I5ba4KQ)X_$
zdLnU!AxZfRs8KNzx5Uf4S0|gBoz%OWs9Aavb{ovmg+%B#hdRh4X-yis^CBFiR54~-
z?pSQ#s1M!6mf9G*+LhU}das<H6R-$x4>Pf63e*Gq84~=IyW5C6=+eh6@B7YN9(MR$
zdAI1_t^5P6!4AIXHk?UyrUbI3kc#;ZKMc-fM}T;BWZ?BdGnHiYTcYkTijmH5KUZZQ
z|KTzEf4xec%WW0IW-Rc!YXaoV@JMv^!tG+K?@fw;t&v^H2_!F$lSVoOJ_|1uft{lm
zEOnjF>xR=HiJaJuw#;AQQ=k#DG!NVPn5CFQ2ac$*2n5DUOdJBn-zi$NP?e?WtCz#o
zt#)m&Zy!#YtR=+G;Yy0W!?|~eC=i$J!;>{vj=;)OjzYpZX$*HQK@dhTJx!NLSKR6{
z!jR-i=r4rAdmk>pw-FD^mS=>!X6ghtJ}4M;J1dw-Okf#i5r_4Rf%FxNR3zhkC&rnr
zfN7;4uSEpW6`WHk5uJ9KJwy>wOnVpiDN}o@oCxg{IGwj@=RyQB47f>OaNJ<UWVU08
zaZ;6cI$GHsI&Z`taWe5g*VKCWoBn@Ls9~y={Y6)Z9iF8*xq_glS~fj8I+}7*eXiN~
zaA<5<lA-+^xd6bY=^M4eTBU!0>T#^R9wZ>*W(=@DSwvW;q-{J})q8=BcqSyhFK`yo
zIZ-1pMHC472@-u;o28jL`NbiH__gDjmIRWNVk>wupwIpBGIwN<)i@?lHXCjfC8)7k
zqtH2{Y;~F`(~w`Fdu36I*TV&QbziyGPS)RKw%tjv{wqOhskTK$hLo=>vY$0Rz&P6R
z5s?b@EFZq`LdL?859^<tIi+S?Fk?7*Vfj8}OqrCPH2-jGf+}Jf_EmBMqc2)c;8xb0
zOsJ!$l~ZpgJ{e6zC|@CLRW^(|Mo>3QO<mno5WvdRw)Xas2-tc3mnOvXhanRFBLg40
z@uF^SczwLET3T+*TF>J~X$tVjnjy$CyG<J0L*I930wFSpI&9M-c2+u$3td$ga9HHG
z{lD!u8ZU^pO%x>T^CcG+%yBGLJDG;~+#ar6G-&m*74`r6#C_gW*%|L}B^Kw5pkbF$
zsTz^>jx<#;nldUY*D&-sE8l#^YizER5dOFBlKyWFfH;n1k>TMQ@S@!&FEu!uv)C2r
zviwqKC?T;#rQL#4ncKVXtS-72qL;~$rpd#?B4E;x^Lgi-$Rsmj4ds$y<6OPzxDoCR
ziY4#&;0SyhlV%FL?h0`}%sB9oTJZlKOqsnCkkBNfS6`<Avil4}$HTy^;^7zJ%1Cwo
zJkxxNKht2{I`lz{<yH%YwJhaiW}}`Mb_6$h|HAJ!uMH<BZuLgvSBna&KS8&UzKCXU
zCoXCR-98^bf9E$qyo;DEL8JvOIpiFMPCw7^+6q5?W5%5jV9IXxTk`PMg(9~JJH!q|
zsk)hiFaZn%9zO18qr`=Q9dt^ru8jIE))2<NIefW*3v&$4lX|D)aaL+!ca73QGwjlJ
zWQF2{w)%#tE32S@`3U9iF1G4n%~+t>zi-$%%4>wDZ^+}Q-N}QLKdX^C()cU|QLg92
zNs>SP?{_~5eV4OrzRIto5r;GY1#lcBy5x#E?oKg#Dpl&p!(%7yz_a52ne;Nx{f`D7
zB+)r)&M(>oXshNInf_ys9rVq!9JW9)3<#y8H-u}wZTw0f&FGm*j6j1%#o8C$0W_X$
zt5Tf>zZx+OLru!5>Z?V^c7xJ{b$mr!z?Zj)KPxnZx+23j>{4`uuw>)L#FDyeSk!93
zm8@z1x`L?c^RtU+c3v-&n1smef+;=D`OB*OVjF8Kw;`P97(n(7++U=U4MpyMN8;1;
zY{~hZ_X5o4DsV_f4@F4GTIC0fx~p|!HVmzjmB5aHj>Y&Wbocz?f;!aN+8NDKt=qx(
zqezJHg(Wx$pwJ{w0q1a(JoUce4=rp&j*ax#Z4+o-7Zn%D$mY3u+!$pxJqrTore+lH
zbHjA`>W4Kd=P;a9dqEFF5=C$%T*Ul_XCT*GHWJtBi><;fav=!;A+D2^AmORHS_9;>
zXOMgtohtvGN@rooUY4AMDgJy)NFTl1@Y>wR$SCCDArE$Ke6hbTjo;u_WqQnLL8dYR
zMSEEDWhxMdKDY_==c~YbR5vv}o!{>W<T*rEY))6`#?yk2LIgG*-?H1K@P8GqVn9Nz
zY@W?OW6tuSuU_=rBwYk6XU84v?`tKXgjdTJcT104A>9++P1?~DGtiQu(xV<pyeR4)
zauTC1%0BGN?e7cZy{@ka+S_9;E3e3Ks9I5KU_AmSh)BlhL~sqm*3fKgz`U8r^Ntd9
zA8GMqLji6BB(q07v+=sE^@)|l@k@GGi|jlx=}%yGs4({6MReFkb}OG7M&>Ty_P&wG
zI^n=9E2{FT3oiy>RD?g>55rReNmHG%v8X3`Gf@>Hpoj5i(xXYfHFWv>y|m8)E(J4u
z>EPz(=5Qx)m_L`k&u7Hm%cB=dmE;uo<qZWisVvRY(>EHhIg<#7z9&6`cwnJBBD-;p
zT?8h3uHp1?BnI5-#96oq%dw)S*dQt49v2ssWY4-=OeVkw(2xn;t`RzFP8c7K+g&&L
zGMfvxRd%+nxG`OV5-@1-njc$rhpTjs_F;|t|1gcXrgyzY%;vn{xpFl|`nJL8>FF!q
zN5id7tB+?ZmZV4&+)a@1Wl(cj#6Nc1zw#1-SVUAm6H1EYBVgNyuIoQ8&NVUB>@74Y
z>+wJ3;hFNxoA_W$psNjvQ4EcD4Jy<4oVlFdfEC7#A{N|HJIWm?miYFz%h>c}rgBol
zK}TOgq~ah@UW^ZPm~1Ri?~Nwf^1l5Tdxik^=}8WFwk#5v{DDZy8*4()E3kdN!RIoD
zc2kb-x~3M!D;XK7Q5E9sr?tVt{&b^y@+h3;b<~p41SBR4Ukt>5=pc9_5{Eg>y8kdN
z%@Q6dG(a6bujC`4&Zs5XcGOEkDRMkqui8n}Ic9?}E$DY!zg2F#63N+C6SvNdTl-_?
zp$JPhEIAq=|L;)-m^zfaiODdM1q`?|;I~m$J8<^>UC?SfGOvuxHipGafY}xS&IdE`
zlf@c2Xx(TaQZ0j3%&KlQhVceNADN$i^t$HiTO4h@QM3@-bJ}{$|8pE<Fy2f;T3|xm
z5J>TyN=uFJ345+cunnw-cymEMy8%32KfV5W+QuaRYw=WI<gNM+_x+Dt{3LwQ^seTY
zfmb|3!~LV`YHGjp@~CF}7c{h0Z>ND!D<wy8!^;iYL|5>{S%e)^auS$8l0_A)(TZLD
zX^cm(Np8gxzEcY=dV{0)m+x#ZB#MdH@Q1fm>xJR$yIOw9Ot=Y;z}Z7MORiw+{3>U{
z96m_xBCccDR|=cKp-D3|!O?)Rmsi=@!E#FE{<qaA@_-J$2}|qoQ^xKlY6PTaxH~`c
z_-zS9^D#VlRXgt6R_NCfp{$>wz_e)uVIH=Hxw&~JslKQqdPexn)66Uu2^W)GP6fx#
z?-5(hDRUYd0%U<z5mk#2qYcAUiK_45$q9H14=&<8#TPUaS`}$2W5`5jSq2<FM(3}5
z<=%JO=vz;gTRamjr|ugmg=9{&zkFk2n8l0yoA5@v9%uHueIrM8<(TtBittNw{1_GI
zzHH^Y8_Dx$L4Va7ecpV84<O1*1ND$%{kJW^b}vpKR)UqP-C!r<Sdes__`#H5w#|zT
z_wfaELiHV1eI!#pB|+cb*49J$W*()-v_%ROCscA2QibI55nh^J4%P9Le6`YT;RE3=
z=g_rbufVfmp@a{)xc4f#Q6U%v=YHopF`HdjRwyJgRl1FhGX<0%Q}2vqX?3GQkvFi7
zPduSq#K!#llrf?GwJ0oS&lAy>N^|tAK~E@#{5G1i!rsD396i&w9Fff#5b!Gv-X$98
zv8Ch6Qz(2MPk8iZUs#od=%I%ar-v2P#Dw|*r7yjL*9JkqL9mBI6+QFIy0b8y*__q&
z-j(Z*P8uCnCSX($XAF`Y70Z?e5JtUbzUYvJu>xONDIK0CtZ4IYA5zFSwaTN%nf%7N
zq}J0j)}>Y3g$_59Dj@Qi0yr-~OTvKVg#emYa^%O}w`A^l-s$&fX!!T%qnNBU(L6J5
z^>xivaXkKI1fb5cp>Ot}p$2ThebIQ$p9d*<{NsO{hxI_7E;ODdT=?_zdHbv?w3T=c
zpL~%3MT3PfIXZk73wECQ>rca+;MedOYcoxo-BXl@)f*MBq8i`AO!mJkJ(ELO>NCqw
zEpTAAf<p5OtL~oPnjx1b*dmUY&gfa3Gj>zdZo>iIGBZUiO%4fx-Ic9F`dkZ!Cz$hR
z!`}n+wIMAH@MGm2&QI!NXmfEH37e8?{IkI9uFvbTd{alvoOF*kf4P^;Ftfz$_A^qA
zJr3P0MMJ0>l_KB@p%UI^F7geN&C-b7CyM|XEWrl4e_SZAyU<er(sd*yh0?(pp%W9L
zhPFyG4F#?8jB725<u#a%&Vr<}US__CluAawh?78A8$eX!#yc9b`OZm2p4Q-G$S1TM
zY{8mxm&6TlAIU?e*B=L*rd-u~vL3Co-9o>4HiPe0uit`uT*pX;t~?0c)SZ3}^5y(@
z3P5|duK06MWBNszxeGt(6#ur#XzFCMfT0z|NiJj^&ZQ*ub3Xbb^FjP?fQk%KmK{A3
z;jsn!^sh$Op+>JWt9u|$W58R8UVH_sEl)aN9KNV#irK!#Uo`9EKunUDIMRSM2f1z^
z{eq2&PwYjua%8yAuzgI8hN?)itI_L7BZ|I6W0h*zNIMY$A%x7AYZ1H0J#VT$lV*}+
ze{GKVSuSJ2WSa{4IYBOmBN_2~Gxel!7Bo3al!vqWRq164+Ptmd?yY)t9dIQQ-3^cd
zQzZZD4CU<#`F#4=05s%4c!;$#VSH_QSp@Jl&-~usA8pf)I)b?;?1F?RQy_?9>&fYQ
z^_laI56bdR1N^A5B~P$~AIHHYATAU}h{Q`-)GnHUkHv!x)qm@gI1gn6F{iT%?@Ph?
zM0qT!F&##=fcymJGTSz2bVg+=-@KRt=bf9*>5Wu)FV&jaf)3}mVY1P8H-)u`L5hLh
zs1us=JsbO_7A)l{##cQ*4QI#jS5=P8fHfXnfTbx0u(j?2d{FCqd;gpH%Tf1Msw_U1
z1xPRB$lLd0#VBlgCmT(&-B#66VY{hUal7fpiaL39cba{`A^rDTzp7H}3d2hqp&<<@
zL!u>z1Zb)vCKo$qI>2ca$%F6(UH=3ijf(tRP|7qSABy~e?E$+P?u&*(ZgTF}(3eE;
z5MTr~v*88z<K2>_?|xrj4vrK%R+f8J#;O21vh>KzHfhC7W<5C=Y&%JZ<zS22KFdh3
z<$6tm@|@J9A@XHTtt<m2MkBi91o|XhAmNmvHB(;emzabzXA7qC&S%f1<Iy$gkLj)>
z#89~0DQXTine=DePy;Tx2r6Hr%34hNsQpl(ev-=@wlvAUC5b75AITy_+eW8XFFY@z
zND?Utx>Nuj+yf(TO<5qeX-T<WMbdcSNZ381$YEq9-a3;!cS29p+_!IdHqo;!s%lXT
z)R!#VTQGvhYc{ToGoS4F9)ZUqWp8R?mN!<*8YxCS>1xxJ&Z&Ge+>W>6H=%zWv47o{
zFE7OyV|oCwquCsB-sj=iNE?)wk&JwmJ|xNF=$fdC{_TG0FIV&@)?^NdkiG*P!ytA@
zGA++iZ3R7!!P8w}fVzehNyJ5z6^rWTANu^Sslrg6_O-zTM%pO=?GC;>1Ty*McnCUa
zt%(LyAOWJq*dej>;PISZmhP9DLWH8X0$>G+=OzsSB%P(q#-_WtQ+2F{t|zz)*Bk}x
zY$>DIq3?O;WD9U|x%!Uh_{t8Np(7_r)z#k5Mn*YG>BFVOO(vfme}T3PZkk_f{$K?o
zpjrssUmD~5I((jsvgK*qbq30>sydm>x<BQVa>$_m47+dkqZiA)4978XLFSjy==P<%
zFP?itNXc)IL9KB;+aH%&9bM4FzB|G_HKxloWUcYb6Nxdcseib<cYL_ZVBEYW=_)17
zkVD3x=@nC@e)rV=?o7)i&22AKQ>rhMBegtggWuZ5cdSpz`^`d9N!BidU5uP?Ax>Xj
zNO&XH8_94L%#TbQeoiGYPN$!L8omD&lH(p_;OhpI^S4-K2jiBhMr6ueUoJ(A*Lm-N
zLNRtxx|6jQS-SW5;yv)d#Qt28b?RKF<087O033L1s`iq!)tifhG135lO_VbS<eEA<
z0={CTLO7I$XkNJw=Ikf&aGQ~LuGL=L#awHAdaNV#qxKy^(=Ov~VwWo%xTP@@TheZ1
zm{hW>;6&2gmM?*5m8~J!i@|uoWw{132RZhrv@UR3zh*=^HMnn76%9@}nbS`vMdQL7
zVh%fy$ql@{wF&rd(`Ti6Ga4#TT<WoG({AosQPfH-O0tlkQ(O04>dK(bt6wJ$Bex0y
zl8%w<>A$gc1M7eF_C5uY4yYoAjc~R-_xx}og`FFC`AmULr`I<ZY-!OFI@6kZy>r&~
z6wyZAQ8M1w{lh&%u$MjUU-)Wt5Jxb+@NZV%4XSs)Dgt^{DUNBPO2I~jqs#SIUWxHv
zc@@`_`-&A8#N(8y3HX_xm%t{|IeKG`%uQJbALvZp8nE)hWhgvY-2NXcGMme7u@#XE
zPX!%S`)4*MphGWqUj#<ut+If&Z)l7+wB-FGQu=@T5x!}#qTa9N<Bbb|I5{SzYG<Hx
zF*yBxe=ih52sm1S9G1#%ERfV~uJ}Ya%4>-Q$KUlI&5FANRO8<0Z}B<K>E^qv#j#$N
z7E_5)%pa{heFqfuGMn_S?}IdfUdVSV=!zdBjfV&4xH}=pdgB4Rh|(}(nl7?N<XCnh
zFl7V{5VZ7*UQ*ulLGMRi$ynjd$XEgbR)_%Tlj@PSc}MkUx=<DY7fhIv(E8bI-<KcR
zhqr(o@KVwVHeasv#c82e@{$xu%7$@Fer4R;@dbY*5;68ilRzND=hvMSQR-35N0gY|
z4h-wV9p>P2OmJK1j~aHc{IJK*ahvko+Qw*zHIm;9hwa5k9N00N0rstIRi%;B;2}09
z=5V<KLBQ`;W8uSP?TDx0@bep5I}tQTD_U54iDPP8;jF6Osf^M77rVzU`hUN{q&`da
zW4%iET%ryXHX&KFetTfcoIl4l&_#s!JBn7o$RBI@e_?1c$XO1>nV*X7{0JLdwm&vk
z0ND-hXqY0o-1N?M{_y33a;^=aMiY?W`1^cZxcp+?MIZXaP6D}n2h9+Cg;s!)i$ii~
zp|L7|Ws~8JPXbWN4PV{|Eh0{)gk(?kj`j?hr8UlW;YZ7J5ofz!B6`OP_hvVRS#Wdh
z#&f2{wHcg`?eO${#)X?u43jsHxZFTe_$;22B9S-&PYc!ah}o<rg6}oHY-J^wXfD{c
zFm72^+PDH5oQ)^hJ={J*N)nSem>1+m2NQx|Qh`@}<Pko-PCmS%q-XiBW(-NIQ^xY{
ziA3{)fO4ZT-x!?gIo2>le~o)Vj+WmL+i>orIT~n`1*}C{K^DG*zh5E07lr+#dzwoZ
zj$=;w<?ZlU8UZRLG{2j<pC!Gk{@z4IgZ`Xh_3zXOMZXx0f?kshx041S-Mm?^!AWxJ
z5fcHk)m%?xfv3h3=Q;eJ;~5+Z-$M83^1i!v)mquu2-Ubh%RH|K!6o1rTmhAZ`Qb3j
z)U)*GAaaoCXn*#R$1R%Ix8}p$tc=8p*LB@2KS|zk$~|k8x}l`6&Z2_y7B5wQcv&3I
zx>YB!f~{*#*O+Y)I^<-I|5Yo10$q;3>60r4`@;ZTO@v}5QQ~f@_&n~CX_KqV)M#Fd
z6Xxrr#qQNGEYr3XI>-$AFpF6mS7+?QJu4g8>4)er2ic|H+t|r+Jt`K}E36+q!*8&V
zD9;CYi-Bpih^5?s4M2FHEHPXfb%HMmrU9V>E9fIM!t7oxm;>$Wd2x*ITygJ-0L~>7
zM9XodUdZbd<)H0B2uMbvee%+dc5+KVKfK$y^?IlDyV@uY)j&P#yu!2OvYt29ggqK)
ztBIVaGM|mi;=uzh0VWGby;9*%<sHIPh-(nvuTt8u0$d{Qn~hNBFSq=od+Fj9db;z>
zF$W&7^Y|1`nPH7tGhwM-r1fU<$S-9|ux@r=i;YZ0|J~hP4q6bL;*3Ngb))x@`9t})
zMULr(;}j%z)b|@FR@Y<2WGQ#_1*p5_PI<TWOFa)(hiJuwDu2N#v@k5|qZJ7u-cV(=
z?t;w3$)D+%BKB=}=g&%wPyr_$T}CM*4}~hiV`ERN@UMY^pFvUL4C@N8=zj(Hul3OB
z1@KTKupT}V$KbOQIxH8*AQFs5BC%mG-^0O5W0K_&tfcdbFnK&8q*@kaFi{-xB)aY9
zrmf4ElQ4e3g$%x~KD@oF?(GYiP!E2wi*_5~ozz&)aof<n8hR~&WZijH-^ysmN-PO+
z44yR!o~^fEls7QlsO5V~)p5)uv~Trug78$5TNis%WtT2}<%-TO_b^l}W0MbV;H%}e
zI1Z@C42ZoXLVrrBQayB}E3gD>eECMM+eOuOxzz?ilC?RMP*RK)YLz!0W}AH&-j^Rf
zP^b6%`RRbPLXzj3IQH|%={FqWCcXZHeBr|ah0n}tHR@cz(_g;PY~qK+?n!fL0}lKj
z#wsMb-bS2B5%o&5Xu|VTVlu|H7&qeZlYo9Di6Z&_Ct&A)5$6wj?WiXgd$8T0Nwjd~
zmdK0EEYYpm=lfHG?LUw!spv-rWIv2^y!wh4f}(uU{b<Whr~7XCXG-E&;0OGl>0+QO
zKi-(qy6n5Vz3@A@C~IjEj2xu^!2umolKfD=8z8S;9UmY27(;k*@Zs>~7(@CCL9GfV
z#;-$Gqcq2eXf~C>Va}rP*nNqV6k;7iHr$L!8r^K=Y9xL{Ea`1tRPYK8!&j4<p&s0j
zgJt@0%RB-Xk&#Bzrkdn(>>oSH?|Pkn3&_Ov;J~)K%XX>cDV-e^;7nrhl_@~}B|_=o
zWOH>zpRW4}%TO2zs^U!H<}-T+N9@YlpFdSSYpfOFT;{IAb{k?a#Ur0&TlqAw_Namm
ze`n5z99%gtncugZrC&0j8Uap#UwL*Dbz`O$RHC|+aDyY4sc{gyUjFA;CYU=%xH@e#
zzJ~KQeR%NLbcZVuBlR!Hs8XWY_S5#}TTvXGP~&+E*6Y&~)fK@#jt4IMz(C{^AcAHX
zxi4v&1WAi>xF(Zz*sG3Y_O|KDZ>suW4EFl3WB4?NW-Sm6G1gNs^35|cH>c%sC1FJG
zN*@|Y<7t@t=)>0a|B>~UQB`g4`!^s6g2aYRmy|TJ=|+JKNOw!8bSMqduqo+oX(XkT
zu1&XufJlQ#Y`S?C=lst3p8t5pSc6xaS98rZ?|I+X^|=6LY1!BK!oNE6|2ci27S54J
zMw@{6$DtLd)>>#9QX>^<@CN;BjEszmIc3jw&ab0PC&|~;!RZ+C!zu=21g}E2nq^l>
zY|=Yw3@QAj0>XBibl&Jfx3q<52Um2s%V2?ou$Oo9;@7-(j*ey)g>*D(-|6H_Z?YmX
zq9j4Dg<j!fbCQd67I=$yt;KR*1cXILv-70ztCTlFZwNe|<PS`PWzTAAS|gnO18-x+
zCAi2tc<XWDBcLhLe#<UWG{z?^%u_8qE}@kL_-pG}qnt-#FY-5-Q1aIl2%XRJAtnZd
zA$)G-p0}s7h!p?J6pyQu(x@lB0+AfN;0C7^Ay}lxAC{Ri{HGBf#coJm$DjFYYQLf^
z+?sPM?~j?Kqr^*n5%swEW&V_Cq54^B4bhSV(TIy&r*dg~f@i@6tj0cX%a|<IsYzU7
z_cfMD0b12eN3}P`vVnTu*j!a<TAf%?x7g#>M}NexNa}XLQ#OI_etSlpj}m@RaEreO
zAwQp8f1L-;iUkCfhysl8t|Au9XpmvcjO=Ga0{+svUS0T4^{8(JL112|nB9zB@l^Mg
zZLbGi);~|;3(OfGCGo`mACC*#FUDtSr*<^nW)*Fw<-qQ}_JbaHIk5jtV2Du3d?uks
zRU@?St(!$U!DJ~MZ}LexYVC!M^!4k2*#^*9%K{dS7G+<YD)v-~Gz5t$$BHVcMn3tr
z6eu8nz06ZgUYqEa@wnK|TTfK~*eP2SN&Et)6C{y1;1>8Yznn>kc{F9LkjTv^59{Nj
zvGZR-A4y(d`qu6so$iah9bu@jcZgIOsNr_L9<Vg~WGU=m8)-~Oyb>-62@{mv)ENsF
z@SW@tr$gcLEw~6>eU6#NBx2GTIy>cx#j#485GfFX!y5^*u`ns#=0{_~f*1vJ@VR{*
zkaH)CS?UhM?Oh4IJfzTfsGIvqOz7vq(f3i*>%@BBTna=m=KOx)_$Xfok3`j7##xE<
zUi0D@Oq<m)Oq`i{PZL4=38Ap)SHbp5w1nn_Qo$Qtz{7<)XrD^@w$f9S)BgQ0^k~zz
zH@L}b`6NxfwumMp@GC+kwa*eBmOsW2C4I3utjL6DI#Ex({WQq0QwK=u%IzX;I&QrF
zb80~^^Gzr*)Ew~9bCehTI7xIKykfM3yE%oRaZ`H@>h}-7Rm%NmT*kNglYL`^BPVc$
z0OF#4vzQf=6%?%Zxro0%P!sln4IwHRQ!u!Rl4vC;=ti3g@xKZZ%NFtM!r=4Svo*?q
z8`U&{Ml5NYFnk&Xa4`?4Z8@5Z*^;mqoL4Ss48}U`GM|y1jZF5MbG`I!3D(=rUD6H6
zVyGTQ9L<AY^GMneMON~#1**udUw(NPcMk1KeV2cFqagyRA1}Yr!GoR`2q-Bea7#I}
zRZ9P{I!z>^^kyMKdyWN76<oAZMUo<>!BkgjI!uJT{oW?>98G31w2LT)RoqpaV=*~L
zJYvu!yo+CG{qW|GJfUFUnmXsP!o<#rvYO#Yk|ySdVd{mrOVf2SG!c5m?e#<_B$F*>
zA8sCpY~#s;{Pugi)`DUZT<_I8f|+!T+nAHFB9e%Frmy$w(8t7CFrqx95*MDbz7n#?
zvMM)4Q=>VYN+YlwAvxvw3$tKSsKX!fHMku)*?HlA%k+>^by;1QD#E8EB5u>%({p}R
zG76VkEHQq5V<^Sq)`tJMEcv)a*6Xir_YbXxGLrwR&-4aBCK_QS&TU-w%jgPkfjt_m
z9cJMlV)n_!lhFNy_YO=()Mw>cGHbiaXZDTeZ9YtQctq$)F9SaH=GRpgb*Q<sN$4e<
z+CPf=c3Z|{@4L41Wxe)c`SP6w3%^vVq_2!tCMAyef}%jw?2&|B#oj7s`m;T;E{~=#
z>kHHbhj5?w;Ujz6D`<*ec9AFNpAMMQR&q~Q53i!yIG9+tj(jP#871hbZ8gh_)0B2o
zElJoc;h|1ii?e8^y=!(qpkwZODkB-Of3;l@yZ&Q^_hgOwUMKkZVi+x$BdI_cLUm~%
z!eE-nlT?#y9JYYCmg_(6BX{h7@1vYTwLf+|iM{=^)!T&v(-1IH-^uj|-wdC|Qi~@a
zAGyA(wCdpyct5^^*uFak?oK}E-<EsJEycEnd;A`Ht%9(ea<qxrF1M{xQu5j1MD^$b
z$IYgI@2A)z&Hm)hnR3C&S!sMdmT+rJO8{TAWBMcKS7$5k@J$-vGaG5(Mm@D~OBR|F
zaYs(p=7yWyB%cpQ5X0m4wk{?DBA~Tpjuhx;K`Qk0IC9yxl@?nHR-fJ~QuJ;L<wRVJ
zyc_mu5{s!ifi5$hqWxF%ajZVWto*Wg8#XecIKx{3j7zsFoPV}>CX}-uKjcH}A?Vkg
z6*V*;fW(8`|8mG+g9F7a1B7%bfRtt)7*$|sW307L^3>zt;vR2oY}{;b_dD=q5WUf1
zdiFujH}grBiU>UEf*wGUKI?MHxo4#d5f5>VVL<4BlMb1mV=7(@=A%M6h&c>8Mn@Yk
z9LoZ>cI#FY8U&LaW9njb{i(ZiV+4-mT~nU|m)gT6vL9KBZ0wGvTx8*O<7(amK3iRg
zN5QYK%ZC<9__cqz-0z^qXtQQ|ZF2^7U54RshhQl<Gei8MW^qIK*s4{wU7b9h&3;!F
z0~)M~*VosY2<TaPusBw4il;IQ4IWf93R)n$5riw&@qpSjrN(sJ{wOtpxl*s&>yNml
zzDH0;et?l4`V@wTEl^QV3>SO`svj%p8_iuNgRlPgZ4@cTT^@X}`kw%N_2$g+zQJb`
zl0%&Ie69B`)s}Vy#>CP7vuE%M=c<*?e6y+aa+G^bxszaQB`q&43I{@d%1KGlF-liA
z$~Co-tK~>z{r=aCaL5JxeGL5bMGet81IQr>JFg^Gf@O5#LE`JIwW{Mx2~Xau+FUy^
z$m}`cl8;NR`K12w;1Z57`|CXXznyPHTX9g$H$bKsQVQJwZY9m7wz4)wE=Z=WQ`31$
z7`}rfob09#zx|Jfp)6zZNIE58{tVFftcNzyzQ&JKp628Oh-JNHJ)|u)MUg|+Jd+sJ
z+|0BcBFhBsiEI|AS{z-tA~Fh{d(A4rYR#)oKFk_<<xfKx<g*y;Dyj<VYNMh+W=v=d
zI{mKtc8@56qxr}_6HbrdLw)Nwh-#F~Vf0f7Jd-&Tz*8_4_l5h=wjYo7M3QHL)%u0w
zGYoPk3L{jJfHVi8X;~hfh-MgOr@SYFiU+N#fiBB!G2Zq>fegOQ%mFskK!Qe*@O!VA
zc8pjgZ6-8~rE*JW{5EV&5`nYOy(hqT+>pA*3b17d4w&8YF1BvZms4(;KCCnYjmE=5
zA>1)l-IqDM;vz&_pI}edJOS^Qg=nv?CPnH=rx>$wZJBQEPI}_A2s#BTI-cK^q{_I_
zg}h&qXX8HcJzoP+OjQOW%qOOYm17XrA5`!0BGMS)gXXK0{D4CE)#ql*P0!wn{Nq@4
zMF~MlC=vOVtdfxsdkroHme4cJeCimhZ%ak&4L3gG!Z=vXMy@0vX=D}CtCb8hVXRq?
zw(9?V%K>*iq`I;jJ^kVr*n~X@m#;=zBf?8zgmEj#{DC0pDd+q!!zFt2LF1+X__r2}
zf7n%Oof(UAsOAnny+1!iA+71_t!B?<<Gf_L-^gj6Pg0Q-#17*kh=a0M<hf4=?LF_W
zy?L5Kg%xQElUwg%Or;X@2|w^X@K$RQaNnl@jQqjU<s1+ruqC}suz`UGtU%AAD^-&>
zpe||NDG(=_kE6ro!-QR+wNE%tcE`Kz5(1j^XgtNM@FMWq9RAXV#}F`&F!i-X-zDD~
zL7>p91_Szs0<$0L<@|vDKcXb0*kqcxAcyT6UUScDS|AD2@_zZ!-yc0|1Lpyov~qC2
zf3QWHUG}n$M4Ta?M!kb3=~=ibWuu$Ys+HKhX0NxZ+wlYHs^>v$<h)|CQXB|hfo$WP
zJYWUk%XfRrgI9kAc=54i0|)vEZCQiXzJwk5*exJ`LT^Wqw+HAIm{|Ti$yqaLhNF;?
zL)plJepFy2*esv4#};%K&n^9Y$&R6NU}tIp|AJ*%aZWYpTr>fWAXR_-Hrnf&1m`U7
zxq1&!S=k=GwXd)<lD67I`LRnp{2F$_0lL>oHNxYQ>={ngTvKo_Ws%!czFSu|Z{2Oe
zNAKIU+gcnoKuSz;fQIa<dpbE2#A6LVbu;ZVfib1!soHk&%?8*|Y+?%%{@v^Ozb${{
zX(C$ef>ica0a)Be#(?%HLy+381!xq3=^nH#Llt9yr^^E1hMG}5vJ_oD(*dgNOEj5(
zMlx<1%3oD3f{t>|0Z2Uzpe_spy-|{SsR`621B@&c49A9~DX;@1`+#nU+qr9CM6Ib-
zWEm84J-!!aimjfAXYvG4&`qhhNfZ+bRm{!QsnHJLvc@XKsVK1nxSEX+jAXv?CnyG7
zthhieaJNE0L6ur4ES-p>;`kIalMKn|B}w&sv()n8bj04yZm$cIoaA&{Y^r<hS{x!H
zhHlPk&GWl|FI_6Dxk%AdE`@YZi%TGCT25{1;OT;}@WrXo{X5X=AJL`moZET#jUT#h
zzfIab?Q1sGB79l+sm{LPZytJMYI{@wo<Oww{pDNXh@YmF!cdmlRQqP!*b&=Q+ALS$
ztxudiHJ_?s5M#Id75AiWJfrgSeNt8X$o-dgtZ!V~E=L?!b8hSWpVK~*{-{|gzWAP_
zuPcxwY*s?3*KILL(8J|`k4!1b$Kp}+rcm<i`;kTURKjjV&+-$SMB_vS2rwy;AzjQx
z8~R-EQx9sjCNkr07-VDwfu9k-XeXFOqw6IZO8yk$^cx7jrun*5dD4#m81eObv$2i&
z*0@u_bV8tbm25q{RJqM#X;5E3*k0r@@ry$f;WN@F#%HA1>i=GwfR&vuq56}55r)g7
zslhQ3g=7{i3{cA5j{qZOY^258TvBQ;1MnT-`u}T0LG-T=jJNO@*I}{AB#qq6Q@MN*
zu#RnJWMpW)GgD-u)d@!mav}O+$ZTLYDG=AsK6`F5F<*2=WfjJv`T_VxFmbI22;-Nd
z3gU#YzmAtv&?s-EUjXOn!^1y@)EH=yvRisP1wH>!PCRTyZ8$E0Laiziv~fi;YT9I|
z(R3`uUEz==S<s47H3LR|EkbU>CDirlo}{1>ZT9uY3WqL)FId$qBmsm*3$Nr)q!Fa;
zGeK+s-9eA76n|1`e;;a~ppD1i6dKov)6k@tixB%IKo+gi(;d$8b^0d3|48`|$S8df
zy^I1He$MPD=!qmU4zR$LTc-B!6#L>#DPvxYy#a)Y$86c|h}%^m2N`rq*vAJ@9@^Ge
zP72>)Dygsc(He+ZN>}UDsK!6tm~Y#}<x5zJf4H;bllt74%}GIzJc~^?LWH@oUmwoL
zw9EGt@~9%tmUQlKOX@R#8Dz$+<`?Y-5Kr>31reBdlJskJZ<_|nbId`e6X1v^n%A7B
zxPD3V@xc2ya#F7;Q&rGxYXf$a8ewB)X&A)GY41E}e|+?#<h|J4|6{R*c3kPc)`bbi
zoN}EOw0QOJ0;9d7!7Ij;UJMVyzh#R5y48gSF*p+;#<|!Wo224s06~csXKr~p<sI1A
zT-Q=FALAVo5Ez2J048M`i6|hIzNHI3#fu>fw*|0JIw4(MPpv>jnqN^>$GaHDdbnf_
zf}29Jgtu`Y({>062z1z1p<&$Oee5VHb5bpNDHlX^$vVU=bTnbm4Ah0t;FpGGlm!zs
zmUWQl2yj~(+?wch=F}ir2!mn=!h|e#zA0?L7#H!2=COC2VAH(iF^WXv^9j|DXT&kQ
zA@T}ZQnrFneJ1>c#UDM6cah8B^Q^vDzX!U+%V5T&UEHdgUceX}$b!I)1;o?Bs<J1_
z_dDXfj<++8D~o4>sP!+U#Fh-T?XsISR;j)&j;Bel&i&?P#=Lzf+M?Lu)h-yTclgel
zYP|tjM0eGc;IVPvaOKF`U4TNnu@!Wi@eQ07f+IU~17}KM;sdp-P?-05`J7Bgt<f1z
z_g?&B{$0=KayH>I@w=j{kqZE?l2lrC;tr(>v|EVrkI(<;y&8oA#u2B$$9Ba5i!ME%
z;gx<~<$MLxD<s=@l1zuqPAh>?487vrD|kM%F~?oSo7-ZEk-i%9n{vl=yKHQIGl=ok
zyM*VH_vxfYL(F8V0*?t7^ceO2pI70Mvpy^HG!+d!w`F#BB&U6~I|_&>5Um*l5W<CW
zYQ6qRw9o$UmH4-BA|w~7?>Sa%1nm3H#$*4&cHip;Xuu;~ef@-+KU`(Z#Q;_p*2`#{
zh$g^N$%rF{V3WX?>1R#`Sx8wLW=$p)&gsB#HnY}*Xv=<Cfo4faX!@Lsb2nx_>o>U{
zWJ?*T@(@6|1<essQ>CTVpC`lnLHx9B?tu)`i;v$M*{0JDfa0y6(i2R5!dP3u*v3tz
zc%DyZQ=DSPwP!N!k10$|m-P-p-Zba!gS)V);}DG_Rp?RF0%ltfn;^o>X37LcNwjzE
z_Xqc33*ybu?H7^l9Xa=xIcAQI%E2#_`om`Fdg+sLLxKHG^Cr0MD5>g~yWf`k;ni+c
z<grpbLq|omFF>BZv%T3cx?}ju5atI^IsF;ng~GT6(>hOA5$(5oj*-VB4<OT<2RH-t
zrb~d6BY3UfRjcdS=%a;E+bsAhftee%*IG3HLo@@CM6tRv;z&?D#*0<%wPocLYQer(
zQIKTMT6UB-*A5-k>BpznmJaEbM(8m{lAnJDkfUPQzWb7#d^kwH{J~Ld!LUEFhhiFP
z=^Zj0KC2|y?mD8T+m3HSa6c4_ri8Dp)#Zn<%3K?|tF2-ztsPeK*4&`QBvUS?y?XMt
zh<($*0_}6tz7j>BSo61kW_1rYy0P%m2;GDM`WJv<g<@jIjcaD~;&LE?arN1VkTM?X
z%+=M^lRR8o{zzQEhta~I&A%d?0n_QpZwGA|%PpQ$`NEhX&jHZIC^O3HIV&sc48Xd8
zqUTP9eQ<#dM!<=*6GcWKS)(7=I70Bo%AT=I$TC-_6VoycrYbNVNlj(p9)x!*GEC>H
zgrI=)CQWq5Y+^NGUQ!lP{26%fzL~{*|M<Re0DK7Vzj^$80_?DzW>4@5(eDGdK)J%O
za1OTS!j~zCx?Yda-5uP)VozYWiZ!FoH?3hOZ?icFIVM&qE-C!pH93j@FsrU+ItFY2
zAhDWz0~R<nraAz=aoS%L1c~}S@GX&X(L|Hpa8vqkGo2i+NIHL6xuan8YjfR-!FbO^
zOY0*P6-XRI4HXl=98m7Lec;e1>Tor@(sPIzsj(pU7;$uPkXzXXm=v??z+`Q8(ydH~
zCl+5Aauvd=mJBDsjpZai$66u8?->}*bhT{AyH<zouyt7r#9=ge**@W&8q1x*L*TBh
zu|*`+$+=S&hm+S4ed5zH%)T-IHpvs$232J<QxT-9xphNxkzYyMYTa&lZsbvj#MIkk
zfF+W=1>h}1sH)#4ymO((QbGIMA^CSX2xL*%Dfo7?P=44%7y<FQg1ad%P1@{#r`O(^
z0%=tn-En#g5B<3Rg%4?Hpd_eW(D4rf<s$(Ej0{<|<{=yKf>BTMjCc}cS)}!Zs;YD{
zaWakN;Ypy@3+3AcdvLxa8pAv%S`c-$)gosyEIk?^MJDP60j+$24V4m!S?U;3C~;B{
zUI-I@Rub`JNvlrl$|%z;k%W*?2;f=S!tNB3iI>`Z`A)~=(b8=(Mx6>Os|}BI^00!w
zsX%fx&ue2vtJD|;f3>=w6bbnW!+Huatoa=*E0O)sx$#AbZ%g<H95hkzkxH&4aW?gB
zckIKlJ}gOt31$An*ejH@HU@yCF<pJ-{8@{0<>;ZvAT*IhBPsQSh^PgCt7I|UREaOI
z>LI0yOX=&OpeIo$D)JajYB75&S2lb>H5hQ>EW9G7ZOB;`=MI~x5ynxPjxo1X)HjQg
zdDByuhf!(3DjDAwJ~H>?Jqya`0XNuB<6voT?5yv+(|YXdn_jOKuhpF+%Iy4LbM+K(
zRU1Z*A~g?Jw)k{dc*Vk=d^@mzNb0J<_ZNP~eM^EwiK5!GDI>9tm1GLV1uhkDX^-T%
z^rc?L*ysGYkJy#`UsD{sajY(cG?JGZR<EcoQwM<YR=cB%aOj~pLOFFmUlUP>KP+ux
z-M>X0VG`#DM<Cv|PkZ-7o%12G#@*eW9g_!uZx@@U7Au|;^|7X9{K?Em*?6iWE6eTS
zfK==Tdu^%SREfLb9viJEH5NB$_PQYr7s$AwMTLsF)m%QHV`3DR0qGcQjs8j7dFw%d
zk|MZI17bgB4{I7TU*(Z(r1mTF2!@!iPMeO}3X8pcS2vwpeZGxcWa$T2!Wm=9jB27>
zNbV{6Y=aUD=d3b*nvwwM9RxYj&1o+NFki)M)^}$Lj;!mr&3FRfNU0B!H8@pJp(B+J
zNma~iC1f0^L=rhJ8f$Scho->~)~c4k^JRad1~cJi?8ah`=v}5Fxdd>8jcdJP@l<DH
z+a<ftT1p$ugz1-vY^CDK#|^R9>P+45ovyo>i@{cDu3EHgX?;+{m<_UuAW_kAxD{Pm
z7)6Z%I{36_b(mW+UOyG!w*J;N)D1GS4cDo-U{>59DHWVHAMWRquVlw`tXNEf_-4Q3
zou#Ir`n3`ib^#=9t+qW_;b*bYl)y-FWy>ML<F9#jC)$1dL?dzs*lsS1bD1#S;>-6b
z@(`;0Z+#PU&^6yoP748a6rZK}`2pQA`UkXAi(#wRX-``uuFQk5^?x7dA!!i!%QLcH
z(VRISSKfX_dei2U#y_dG0ko+JF&}S#k#Hy4mk$VbNte)g1P@Cpbh<?{Vec^J!9&me
zYCH3-LDo{>W<GGnl*5S`Tb)U$l(uBOzv0bBN@O`U8Y{Tdsr59<_)!Re*aB4S5s+=l
za4bbGO0&;(<}n0a+*n<q{efIlsmX%Ccd~UKPk*&(DsZb2Z>qUpF0zCR({Y%OD1`a_
z=;3MpUeYm^I-E%^4mZtbO9uyYD?Q)7(yFhkbPUS)2RAE<2u%gN3|5kXqmepj3tp-4
zNEK7-32~pXax8T2F@MZ2$AyQZFwK5hu3x-#Zt^D#Aq)=qVg?DUAlqF_tzTV?G<y^A
zK>$7Euw)UB8GkC7K4y6F#Q^=5F3>7UR_sg)6Bxmp_Ki4q8F9X94G2%9|H*zhat4YY
z0LNs}kezd8DUMUeeAGq0skYg)>CI$hvl3xl+aRiZ1<q$3odtq}L{b8aLZh(Y(KS{;
zmwgxzp0DdUWvY*gx~gh3W5&}-rz%O4;G!2rmp1ba&xO2m_NX1&t`d0>4I3n_s(iwW
z{QtCKX_e*}+}`r7SKuOO3Tqpfs~c>7OB~Hl3%Lp*y=nJb`U<pTix3Y^vBAiHcQScW
zVVEZ7a~Ib~!x<*FoFx6xh`oiz&skYnmpA~G)B(2htn1>%Po}9>fD%^jBvpfj96{`n
zI$DIWO8VBVPq1c#6d}7I15?}9=ngL%L=HPly{UwC)hbJIu*au_4Vp(3(?wm&Y*UK_
z5P!~}FX_g$brQ1ew^wc`n|(`y8<wg_P*;UJR!(<FPLfpls+v_kXL7IaBn)D5Gs?SH
zEA?!RR-7-I`76DBqq2{sc#K(bHg|k6T_sU&)7JL3tZ5IEf*EoN8G&Jjn~EuN_$(Xz
z;H0^1?Wi7~JWCK(h*7FXbZ%te&!#5#QHlUGh-wl!$)bTm1|k;ZTjk-m$AltDb>hAG
zussaEvS8EaNj96)3RLx{UYkG)D|+GQ`x#8b{$hA<=h7(LY)E~2S5Z*A^=AhVp(n-G
z8`8yamI1LEv9$f!N1Q;*H;d>wiMDd4B<7%-kdtQxLH{GF1aHVQ7=<I%kz9`IF#s3|
zZNu+_3QKhS@A7UEAAN*9L;)lc|64z^cqHi0uX13Lc_b(x<K={#3=?Nb^gl?-n25~c
ziB!>ZiOuvYF<zuclby+jk-;=l=`~66*Jas-)&;C!2EcH1W7p{Zt54-7OjVE2E%B26
zo2gLUMMIcYL4+M&Pl0e)Q{8!7)8wISMpawD%n@0-JZs79!pmP>d|TURk4wJmAM&|7
zoovhGI>znJ;!TrP-{yvMMurM3E+qI}8h-d*kKJK~+-HP$>*LIuBqz{Qb1|Uo7YMWh
zluaj@F7f~~D&AWC6{G(VW0MDhw(U6U;Mc7G?JTrH?TM4vuHZa2datM8-AR{;@F&st
zg8mkZvlqZ6Er{ysmMVS3;@Fqw#-<^8LimSFdfG0nwXyFp3RyJHR~eaAd=38NDTi6S
z*fYTPMR$UeV=N%>vdTT2KKj=M_Mes+DH0FsRN55#QTeT$ttTnwCvRke#e&7Fs#?#|
zrK(ivq5RK4C8{0ArMU|e;2PaY5$Of+tcULynyi|zKA66A<G(zABg`2Okx{@Z{F_{j
z<Uv5KEru6bO9EU9XM_M<S_BZo)t{hz(008q!l4lI*NEePQ7f?D&l>~J8hv>AyNDd4
ztm@Ky8tjE**X9g$b!&)dJ1V3LUga#d4F1p>{jl+9Az;nBgqJ)#TZC&(NE)oTg8B}$
z-_IA1{QitaVDozolb)_y=86@jaOiDbMKRs@d?4Fbkm||mvkKn0FUcb!9CZ7!c*<6?
z#gY_1??I2fv71Z?wv4XJq%_brby_=-lYi4lOx+cJSB!$w2^eDUeP^$;e-;=klAV8l
zf?PC#ntjl9?lP@Ue%RH8%&brHF{kj8n&57x(*nfo{Z_I2;ltux?7O$Kno`H0!6QwH
zU>}+euWp9gZ{!7W3MzjBIsjsrzZ}$HUXQ}6&ZLt)yq0}y?uqOVZCEu)R&uYINb@~S
zUjfbYDZsI&KTN_cE{`n4N-pr5$|O1UvWy>qh^0HfHGcc!H#*g%`G;G$x5o_vpdg)n
z9Nzwx7<fc6W+3ybF1oM~Cq24BFq<*v6_lJka~vt@ks@gM0UOVu#ukp)(neL;^s1)7
z@==S~tIQv+Xf^{Av>x@UGQ-8V*C=RWEG;9d+geOE7hXi=$|2O-woejscsu?saR2@*
zE?n5{>hL=OfW5i-HB{6()u|kR;V^2;<VLac^%ec*by_C%0Z8N6>j`orL;K6i+-v0>
z{LuOYbcy#AF19O`=RmV$wFJl}-&=h5runiEBV4{7+upVO{5R4GN|`ME*HMqQaK=eC
zXnbFxx&mR|sZDJC1wzM1A`UCdfCV!1gg+H(AGgur?2G#9(dR<KrXt1ZXS$w&*5kcR
z?jI&52;2b8Am2{L+VC)b_m>}k<j&J^4BC-jSm#gt2}cT9EnGaY652Q65&%yOx_Jci
zWT(3ld;XcZIbb1RGurN)e{=hZCU1PJAXcm^OW55BxXe3K>wz&fokSb2ca;5E<TJrI
z3a%#K85@2@CF_huFbv`EoVzU&Z)H#XLYgo)9wkkpr9ppX23VBXB`TiTb-Zt_6)%<Y
zg{s#bOwiTc(+!7)g)@rM*F})pVg*p=em9hE{fR$Ii4{Y7cO$qjzCn_4K$0LG0DjW~
z1lfM#>=O|3(}q@4%JgSFEf)U%3ZTwhtG?}n@SF9&pKJKWsZeaGjP?+G^3UVbS>3>$
zreN*ppo#M`3GiGB3k%OJEs44siJ>-=to{E)qEJs)eUVi)77S~DdBDf)3;<?<W=e42
zlRp1}_r*&=iQN5IW;yvs#(tWg^dt9V0|3adCj|s9PoXY`?Pe>8MOC$Yum+5U1Vltc
z#C(}C1#7gWiSv+53Zj>^ISOVBL5#HG7$X6uQ$>&?U21o+3z}@PJLY^F;^?n*ams50
zsO98acr(c>Ve&e<%b~W{(CcH8iBFNQ@0ml<aXC5Vd4wdg737iQ>z|<r5g~PY#f%qE
zV~PUn#rW(vOrrjQ@4V_HIZHkJZbP_lMs-}m1PdNEdl2h)LU*&1b5|NgSkSeNqamfK
zIi#BjuFE94Ve{L(taXFUUm#t_9vI(Gym|UfIZjHlE^5TRrU?}-OY=)I|2Us~Yd!s5
z<VgKXkQSNpxTr@sy7(=m!tE(K2#5#%$!GS)kz;K!WVZTCEq43NrtZkyfWZxYrTBNX
zhNWWzW)IbiW8B6&<mFqyKj9$?WWWZ$azj}aaQ-tFW|go`wB+yNs#q*b;5tgrp8to5
zwg3s^ECQiZk+pNr{;*yC@42KkVK+nMNeLk#PPezM4I3+{><ohIl{pHBPKrGrD*`{f
zMEjp}F!8K`app~{S5k75Af=ymgg1bKw*@SCRA_zLm`qBdqy_ga{*T#s&9y?Kx^RHO
zHXw!ydWHen#|;QZ$<;A%VQX|t7#N}?PWkOom>ZUl1u|@^#Lxw<m@R50y*>czlvYVH
zla?dNsQ^YdwDV()7mvf<bgSOc_&CWZaOwwSnb%lfOho-9;ty$2kf?~S6L~f-FJsoT
z2sp`8MhtSwFUd1;7L|fp#_8KMuL%@J&YeXh$WCkSw*j<VYmmu#z|NLVrgNE>oLz(B
zuvMSDE<kV=idi&G*&**?NEl;$@!~9Gl~P(?wWG@!t6N1%JPFTo0=xhG*0Y6>t_yPo
zci0OTkkb8*{Swk38+B5PMI+B4Ut^JJS=3%CAV}z{Rhp`%a1}f5eWm_K+=IH3n|CWK
z-5zeakTyU3XJi`^=KNNkwkur`u*Q9pwR$w|i-oQ%Ms&^qE3Gv*J>#|?6`f9LsCmE7
z#W(6txK|(Pbo*7Xke!wZUgRWWS2eV%X?aCG7NSx&uK+WR5?@$cl+r0*8@vDW?V?Wn
z+Vuu-);spmvzqoOJ#~SAwEQZ@%ZfU=);!#-f23?$^9nnS)c06(zm{q+;I^z3Aeb-d
zbIevLx-b3@#%2R6pgso*+$CoL*rqcI*Rnov!_3mA1uUh^RTaK!NE$Qq*`?8c<At&Q
zdW{lOA_qsps$3eq0S}PzO3qGN!iWwtCi<#CgHRUEn-BC3W%+=2F@Xz<tq-D$1w>NS
zsycGeWcQ?EqlXtTi!??V4yt0BX0r=ra!7%3B;vyTwtq{|JcUyE{4QN`NSe@q+k+r@
zEQHd9{kgg20h>pB4D_j^rq5o-^%5L=S}MgGzm3V+5Oq60Hx>kYc#xchmhfx+dW@|r
zBSZJxM)hfe+H`_U^$32nHwi8d{eD?}i`m&bDIh^HHe5pLV<J(T@akqadl|Bi)`=?-
z1;5Zjs;wK<aj(t`j*x_ChAv{v4*(e*0Sp{gPG^l|@K9^B7X+1fwUf9fm}@4wzR}iv
zjv^`FOx~BFMd3P_O4~WkCM|$ldYb;=ff!v@r@eOUV;qCcK{EDScC^-C2W#<U5uucd
zbXG6-+Hnz@#9CY*N=#|-_W<ZAHb(=gx;o^>8NRi(f?8R<7O~n2yyq5{A|%I9Z6?gK
z?Qy!T_jaz)UsTIyN9wnR+6>^wHLMNwOhWomc0mR*%>cF&@q=?#Uq`alvXUQjQ0k@m
zi{X(j0S=tcGt>X<`iEVO55%GzeWcI@w36g*emj$eo;F*+*{OE!bH3#6%JJZ{KTXpA
z*!SU~cUY|YkBo@is+8&ofC@gu)$%QA0z*gu7#VRNPf6quN*)~=uAEp00>KT!)x#Zq
z+8@IaQc;kM7!!14yJgm3hB3iW8)Q66JEr|6?{f}-2hV8w4D$<9FwmPO?3A}LV_P5&
zB*ApDV^iV}5jV6)V_!(%o7W9|<xUNFE7f{TRlvPwK5pk!$=Z#0p^AT~-D=d00yaFW
zyM%fK!(xO5Dc#i&pPcueYVmag$-zxyvRtmYi&mk!Gz1`is=8J|d6q6R*gHEA66KJh
zVFftv8g#t$&<!3!Bqt~Ltfra0N}={sR#n+R>XH5Skd<{2y?lWUSQ~Bl-?&h~v&Lo+
zEm?^sn)sCx3KpI3hIQ1w(ywI<&Z+fFBBraqg{k`EPSw~9*#%dxJmWcL)uZ`}KjGV7
zA9<H1=DMuQlOWr)!o)v>3ZeA0qmEhT@ddO56P-WyEqIdMVRJ9OY5mDr7>iOjz3RDC
zT9sPNy#wIpj{$*F-|ydF!R<_Uc_c71)vDQzx;5}DG<`Efr_=*!KMj&{Ifzf%*keFZ
zIVJH~D@CUcT3p7Rlc~P)|CG}rK28v;=<w8Z<)3@+*~K`m-dZG=f^?&hxlczHr$gD)
zkJqo)j?_J$T5miI5d|Opt2B588Oztl&cm*3e%(+sRmz(&QX!whp=uqU0q|nJ)K?zu
z)X<xk;%TFrP@Y;o3R{w_2%%{iCk{)Nm`1Fwjh}|?%Y(mFry_orSDC(hr%41e6v1?@
zkQi5e0+G5gORC2f>eJW)VZ(4==ty|8e;}XcB**0>J>}%XdSly^WmI52Kpdx1&>Aq|
z5xP<mYjXeOH+G-6g;Oiuh$Z=&b+`{#ymb|z(ICxwTU&amI8WS24Rghlp^Z8cadm*{
zR;XQ>6>jLHjW9Pbi>qkRPZ%g*)h*UKhJ4(P<~M}*Ms6Xh?w0){mM>@T2crg%rMo8#
zZloHiF%5tE94mU_M;!<f&<b#wB@t3dF~DmMNR__*a{5M_$~MOKY2azv4*J;Icd{ej
zcqL9UHwa}k^l<I_?+>Jn0`;m@{Gil3Sof%%U8p%NO1`DHVt#**2S9tWwu6m_=BInL
z22{790vYRVwH88uU<Dto5q7rO1N9d^WN&=ues;7Nd_7?)n!=EmAIi1WcJ{rnR1hJp
z<HXqDMtkX*OpK#In(h3%W-u>KwnjJD@StD8Dm>Sad$0We=`B(}DK$NOC8&O$XWLv~
zTN_VFMWq+BW)8kzZ1W`tOb87YZ7H<lfIdiRR+9a1kn(?EaEU~X`CcU`RXcZ*U7VTA
z7yAHB!z~NK4*)`*jaVl9rYQ%$>jYdmFL&q-t_IC%C-a<4IkzK@<>RM+J<gV5BZSCV
zH31oRK)jv}^qdG*$8?iNKp;MKS(w^qc252JIv>f}?^B3bBu2QW0S6nS)SOP}F2IA+
z1HRt@Y7}PPo3o1*cyJZA_<2!!8(3#GuDILEJQ2k*FlCXNK8GlBHCbjQS@ut&BHU2m
zm2{2v3XEn7Ug(Fz&cCCd-+a~I_NPy`qY?V7Cb40`m|YN+@6mTkVOVuBsNELmDjX#l
z*>f9a)?2eVSMm9C1WAe0W4+;mTH?oR6|Ne7Qc?T)3#x(ULcQkGGF%z3)FEE`+-G5x
z0uw;GXikT#s6wrdp{N6$vwlOkUtf0|sW_}igeRT-GJ6@)P~J(xn>`hkbdYv-waEWr
zZw7jipbdG8b?hNBtL2=@mT-40H2?Ew@|`-8MsI<tKwr+<GYmy?0jiM2i2Q=CdKRN<
zQ#}!77>~)x;+%o2qKBU~Uk$?#Me4-==mIvVAI*sNtwE?$6IPWp4?b~o*`^C<9(n>_
zaI9WsU6sE>l8!|F9sKmJwpKP@ZqO=s8Z^7~dL6W$U${L5qMYs1GAuSN^#KRRC6Fl4
zJNFFpiFARgVfpu5A2PXsV2e&Hl<7LMRr*ez7`*ge?CnoSA|N?tq`{-++z``bKvbQ5
zk?rbogF02yUl?v(rlr}HjusHzZ*MmhN<`5f@J!j5-J;Md94;FN<#xT1>fuwhG~vq1
z7pKUrYe8N9GH~kqkey_Js~X?sVn4@2!DSDF)6I3_bE*5MrJi3aQ+K&j&drnE<m&QG
zu`j%5dw%&P9zVlDtSu;Ok5Wgt!7W-z(hZ}GDB@9h{+OIQ4W_o;?o=iNG4e+X=hqNQ
zcZk3bNuDfYPYcR`G~9&~M(*1pjQ&AxR7(+Qvj!SGlf>Po$x*fuP7<6Eog#en#;*-e
zf-Rrgp<^Xzu;oXsnx@F>N%hX3Ni1X&%G4bEc~J$D?si@g5<{Gw?5K-)9KM`U<@s(s
zJrpj$trVk)(aJJJ{i~;jSw%ix$Dm|phEM7xeL62Z^nbS~ra^HOwI*X!k~bfo0uwjY
zwzjtHsg=xSqc)$*9-Js7?$e}-iby>*+nSTkzv4S||6M~gM;BJmIADs9@_b2y*X|AI
zKwg6I-dHkG8Kde@!1=NyJ?Ns39(!}8m0)axH79cMGtE8q-r8Wg6D=TqaXzm2-r+GV
zL!sydc{*~=yPkZzXr>p#>yDgn90b?vVTRJ%kPV!JyTV7|m7f?wbb2_*(48*^2<B%S
zh@|+z*>i@7*R`d?VwF~BLp{A#o~<#`Jd$nqB(YQ?uh>s&+7>(eW*9DtZrcb}?`~sN
zh8|66V`dE3C@izN4tMOEwfN(<4j?UgcZ6uSMa=xh`Mt-x4(`&4Vs-tvo+dCM+rGnP
zW;J<6fsj~^x%M}x7yw{F#aGgqwoFYX{(lzvd}|_6Kf6TQi3!2u4lZxVIU;Oc1=}2q
zf4O~<z1SW(k;}NH%kRqMC!%HSMcPp>qA*fwnee2`3w`UoQ73E4vXmvGfRK;rruXx%
zg0o4Mw<AR3I`Mw}@kt=7OB?t6igA;OZe^Ou8e*xJK*YUXZm1Ps7VxU(&hDDn*gUzp
z{B-=6ZnFiTz#JV9hvd^|Csa*tvE0df<<Kaaf;i_3T_+}1)T8=*ovigoV$$@DHsyfh
z^q*&g`iZRw)mF505XeaFg^6hJ;Yu;|aZrGUC=<@A?GE_U-yX~6?SiVmF5EyA(kk`O
zZ9|}gyh^~SiK^2JWQ8+xR5t;UNS<6pKqyj{GodI{25+NxJyMU7`)3TZ>~sdygf_-1
zTrMoDj^cyTMtn+sD%Ym%3aij<zgpi1-6Uhw4HM>d<~P1E?X0x$vhbRG6jPdXCD2Hp
ztfk~LD!NE%*%4E*)OU32JK(JMl$DP@IR~#88=p0TX7siz902lP2r&<X-Z1XlRlRO*
zPofQxh<U3hpm8g6jSCU+iJCv`r(i;%M`2~}%m1UF4&5LD-{z-oouvBUGxq%nE>~<z
z6|qzrYv|?Da(hwBG&e{P<)u8qYro`w1$w;1m>TUZn_oj3HqFBcS=ewgP^RtlshfL6
zx$up6f@|%gB^%diFJ-^8wIZdgo9;>zcT&ypRGJ{;HR<bnAlO46VpQxcA4bjbUEuK6
zgQqVR=*juHTr*w($z>LKyJLWOU4&Q`;Z;Bqjxdh#^!>>>m}IgL;+;r8TbP=<R{WYp
zNx3C^M>fgocl=*bk$*Qn2F1ys9xc3$Ny&4rN9zLwi|zhKZ|OdLf4lJjBV6{o-phP9
zUS_HF<iVi~-r)I-^p}uhP##`7Y&+1|_HH*>gs>Zfv#t2h%F*$K5zvS%H~3>&H*kBA
zh)pRC#Fe3~du}||=w;Q#znr%F!kO_D1bwnPKU{&elAIn(aGfKR9j;rZ^Wu8`pe*T9
zVpyAoi5V)saV5t@Z%XX^2!*BeH4kap_a|(17fKwoIg5k8^w<?-BzL3>G~siZEL_Wq
zeWZW9kg8^0+InI~2XRa;hO9k?wvaBxvV9#9D0;_SYYv-lirnv%Y|6%Zakx^S+{0Ev
z@=4>$Bq@-3=#N!WrNE?Ci>$}dpAGA7$lh45WWU};_NefCW}H<TZt0K>xP!dg{VO69
zrxVoH?y$+9JHKQ{_vb#Zl4xA4hamN1kstn6^ze)t$$H~qi2XX<jE5|BPqb+<G$FHC
zwjkotAxeZ5RopFnaD<Nt#r2Mif}0~m1q<t^RO;C0lfnvB24^;{SzM|`nRFsmCoo!C
zj+ykS2~bYbb~61grTC<BcIjzmJ(d+PjF`lj8t6HhkX{<Du^t<2;*_Tj`tSXgI?M|8
zQbtBb2QU!<0s^k(b5}78!q7a8mq3CJ^@mRw)`*qbK?cf)b+7&K4_<7i<cs)CIrv_O
z-(j)DAzOJ-ikgaQ6PU#xzblxqrh4>v!;Ymptt?ap^Ml=xOu<s8$E0MsQjPxw>JTf{
zZzT-4;HholyPG~Q%cat(jZ1@<iI#xJku+YwEKiaMpE1I2tJ#nFXYR*OgHH;uR9Tex
z6IN(|4#!-=WEQ-laRj1vY+Gez$lvHb?!Zpx!cK9DUbH0WGe$(C?0rmOIrX$s8~wNa
zda0maeAlr-U36@RdtAE1S*(}@1@`!XSSNY?^S~L*7HR#}cFZku{Y;mNkPZ%z_z3#>
z2~wsgC-@{6Y)Z(i-8>vIVqGHw&0}6oZR-8Cxk?;NpJpmF-(7G`Z7i{s^OK5=+b?_h
z72dRp<2(9E#h5?dPASQFsj=_N1HMNeli)}f9ZvVM#f(?*|4MJ5-dpOfUM56nQ{XC)
zAE}*MbRVT-Wb9hIy{~RKPH$qIw;Y}m$#9T@?)LPe7nZQebDuo+UA)|(1o*kH{}9_(
z6)?pYF9Jp{L^t&vp3&u?wz=qeVKtL~z(w(RB%wqheYUa37e|f&Fz;0M#u+9Tpyiw;
zTlj?e-(b)?)sMd)Q^QuhXQWsrd3=jx&EIBM_-|GO7=C;IxgyqDSN-9(L;mk=M^$u5
zt?kJ5&KrminMq>RUbp>vr-IjmJ3LZUARAAAG{2}bv;?8+0CsGhs!iY|k4)Wsz?P85
z$sy!zJqWn-GM?nrBMa47)n~G|{PIz`ah?{%FJIen3)Rz+{MH(LyfxN+EF#dLZpS)d
z4y}=l(fW$=PN9=N?QA?NCJvhkDIF%jM4f&>sl8}YR3I4~%~1Dc!a$E7o}TWyA)A2e
zCyP#w6+<AW|9R5+x%`Od8|nt)4lD_C^*%XlPEuraZ`|rXbBAQu&O-x7VD97FyPs4d
zb>zK*CV0;(LRK5haMb3;){`<6cdXrrw3wsfajaJDq_i_$w_|<P>2*d~z^R_r4WXVk
zxvrdlE=i;e`MsaEhXYbZx13EAjCr(>xr~tH#>s0Ua6aUkQidOcLf>(xh@Iu^M-<?l
z%GG!DT04bzBQS!3L|xg=ykXN(Y3w!jn<U9$XKyLnw(=dW`gik5_`hL@C-78OxVf=Z
zB7=OK?c+^&C`??<^!=1{FWxpTtlmgA=J>UbF||*sGP6>C$aaljmx5bNfG0dY1a<rJ
z=wa9KC}w0zP@wYO{dWpWjV?r?{G5P?EIM-^{#mQs1u?+Np982~R{^$iks)tAfEsEA
z%-5f4@0la>$sYYRLWuZxiwiKI)RvK(NPl2=fG_^3ujh69_69_h2r_25y98@Ml;D7H
zQ6*#&+u0-T;EcY{Mu>`VcepB95K5$Jt`pH?lw@O?)}u{{C0HwxBfP+w97+4JSos|9
zLd<fCv~TUn%*?DYHwp}v?lU0?j}L!Q?qg)zfcG@L<a;^^u04p=LN|~e_G{d?FOwfu
zw3%Aefj{y~O=Eo~&Qfrdo_9IpEJIAEk^!VWNr?G|g8bFz0Bb!NuEGzDyzp#fZmfb8
z8nQZzh{gPlaD;*GAY{i(fV`9Uwrtkti@yEECP|x3#$M<qi5SeNckhyky$w7guC;O!
zG<{+MX!>chaVCU)f=&E`>FdVr?9+C=o?x((TCrMb=myW1yoj?-+xf;`$#41o2JclX
z+Cqz*19{jK%WBVhRMaimiTnhPKAwq)Ku7g#Z^<{uE0PT7*Tb0%PLx111C&IRZZ?w+
z)~p})G75gByQ8Pk(?~hS?|&vWP3ItzhT*?`K_AFE)u&YaXn9za7?xS#iAu3)<2H78
zqGc%GJgiR<4M|G<`XpI985CUji@EBtj{hA%k^iTry1eW*wfwA=z!h4mKFD$h+;IZ|
zllGrKf7SuJXuLfsvX<B()Be`?ppV9cif={9?jNjlB9Z?rI<qd24n_VG?;(@sh|)1J
zfxh$V>ML}25pY7axRBWJkg13vtA|!o!uXDk%t%jB(c3QfAo6w*#c$nbIJ2VS`XE0>
z@QmG(dyQUDYT(ikZi*BhM_x**#%zEc#7^q-1j6!3M>jl@jd?76zCT^Q+7$1Uq4o_9
zi={HL9$kUCMn4*3)77F-T&?ynk7%m}@yyoLtmVyHuhnFjO?$(30Oy<!#_VRprU<YU
zoLzU;!QHpMc6M1|Yma5Q(U%Y;yy`wS^I$}j$wCyltI0PpExxfJiA;bYqDq$G3g0B&
zL7lQuHh5n<kMVw6RsGR&X1Ph|+Gy6orh#bidlXmfbTd0M3vc4P$@eSqX2kjQ=ANJ}
zG`4UJ3}Ld!go*V-Iyc;$T=x@_rQ29Y<cHk0!0)H_O#v@ZQUJlwy`^lCnN*P2>Hw-z
zau=v3E_UW9)TX;~z6OjmkeVtOVMTI&P2zT5)6l|lJYc~&#~LC-@Tsn?=?>iWVs=;t
z%fuCJBpPe(hwr1)LhRsZi_4hfmBd?6$}{6i*Fk2LK`c+atwnzOEdjJw#+XLznZk|T
zsbXRq&rP2Ri4)GQc5QeHDUOuIV3P*<9bhDwP`6oC&W?w{eYoLCV$N0zlj!UJyeGg5
zb9t#Qh?G}h$$8e&H4R}vv712d_j&O>7BE8!TY+_6<J1di0YA?U`sd}aVeS>@1Hu#&
zhace7w9jVW9kZMbHSGEL1Nk53*wB}!UZO7mD}}Nop|)mJ35Irwk<HA400lOvSKYa|
z#-Q=YH^BZ(kdKxlL@L>0voB7nTtG1r<HbT(=PLlP229RsDI;mz?B!~~ek8_R*~X>N
z*)%WbOtlQDPMLJ-$V7^-i>U9Wg?H!t_I6XBo&h)6n)?en`Z`E0y)@Z~RAl@{5#`}W
zU9q=C)UW2G*dcHiyD3p(0HGIhpger_STBn&Ihp@sAt>~g&b0``ndg<|5B@*cc%MfG
z-MD2|>nO&0uQs2DhS>`EaP=MT5J(mHy2WPyLUeo2wchZ4nc<+dt4s?;?VS@Nh_-yp
zoMkf2f4#Q^pZKXf+>FafMMb07XU$=sTQ~XY+Y)5WV#rv)?*kiInyG5kfSc(iJt1<!
zMi^lG8l1F#hcqUMugsaDG_gw!8&IjUxtg<1KPSy!9JbQKXkG0;nPF?tCazJ^DbJhN
zlbO>?IOEqI1#A@|yWfX#v_QS}7dP{!Cn=f+kEja9hj;s~p66J0pSR!p-VMVzw;zIW
zExd_3488YwFWY>|6s3H9HcnNQt^)IvV_2TsbCE^XjrYwwzVWi&oc?3mH~G$&+e&a6
z>4CEHe@~+S(^|HKw`rw{uw#gc=kej;xE@d-DvZ!AEG^XoEt0GZAuGS*O+}#`ae~{z
z{fCk0;PJmo9!kv{;ur=b*V2In$9DFHCZG1^<}|po-IOl_J1Qd(rU~H5#TbrDbubq6
zNFYSy+kM^E3@`~mcG+1S+d$pr%!K0gvnsWrM<g$bhyYnRT^1E=*1UZc-xFac7)k4F
zTgFdr-AKZ|0mGwbUn@}JDLH(^!hs4WY|OoyeBM$W<McIf@d%RfH12iqj1EPx@wHR;
z^B=6cP&bms5jIfip~#djrc_8ZBZh%Tvel0|Sba3sORgTEIy<M!Kp`)WI%2uDe665I
z@T%3`aJQGq@<~1d$tFJc`l4-~5iC=f+ZOs;+hu-~C2)qxGA$;C^N$#iR_?uhAkMSK
zgHMw{Y93s)7d?Z2qo;@}AH}kks`4v76{oLs=hJRC#B7EChjmq!WNWM46$K3Mtq6sg
zL~*VzeT{LpZTGnWz3SUhP?~c(?9rqfkUS0~G6(`@#NuqNFb8qg!{3y_^_s5fdV-Jb
z-1VX)+l+@2h*ceJvSGg>X*tj0_r<_hnaiS%o4ioVADKPO>6W7@$;s>AYO8r;QR<Yw
zo$G7}vbh?%vPaAK+JvlK0t6Tjnx1Rs7a|pQSg!6Y|ExdoA|&Q8Rw&OXu!jLBzAKCB
z*zNT>Al_;P4hA=oF<@BEroP()gf<|6v@DJpDDUIH7(I{wDI6zNd;LMKYpnQ4VxaD^
z7Me`}F-Z-t5kO*iZJNRluf@%&9r*ru9nG9kj53m=>@*p}Gf*#Fx-Nh%!vr9Iw0IG`
zn+;map0N--Hk)64rtvzGD+&(EXTn#-$?-{7bu(K?Wq>p^HdHs)M06bY>@Y&0_@m4r
zbV&pX&);TCaH>DCX7WMY0#G!r-?~xN%>nbDUZCV!3&r`~R0FBFEOukW$kCGMWMCyB
zn|Rv!1sS18NF+hjvBGL;mmc~z;$<l=%4ga0B)G1qe&m(pU6#{?06KlJmv0R({a{!E
z1apMsvr2RQUj20^li1$DrHDKFB5jFny&+`Sg`r3xGw!3Y(}_xtI65%$p7CbudWLDu
z))?YtrfKjYQ*SAAN^<2{V#G@pC6{3}toP%gvvvh-wE^FkW)%WTO|Ew2d34$ry3P4`
zb12z9JJ4WAaN7k?Fvj8^cPHewPQvY^`Ljq{s-4_wM{Z`w?Jw$y?7|j^aip6CUr@%`
zrTsS8{223cwaKiFKvfNY;L^bLsl(6^%=L0c-_eYVbm*oIqrqY`3(5&A-@fX;<PwL&
zN5x&`=2I9<T#B;PDX8`{rqVqja71^}uw*>p-r9z31P1os7yrNi-dh8a)WNu~@^~&*
zGJxsFz||mff6Iu%t@@y$&*!)4|KQyJ_1|TBO+pPT4Vq~YMs7#|;&UDl_GJM+?LP+x
z1yeiW*46-0AzHe-Eco$Y@zxh(m;|^(vaXKB;iV*Z(b7+veELo`IM?!Q?~~_aSe?*%
z|9EJ~5cZp3JMw60Y;tnjLlJcUd))gE0x-}8)#yPs0VB!KAd@Yq6Ju)+5VrU9Z4&8?
zB+oZ8!>i?>aXbSo`CnW(SBE43&sGNVP2X1x>!ZcYWs35PQKGmfdDiq}_;C{#l|duX
z*z`eS`3Th30@0^mWiTYEv$QCMg;T0cuSU*9mdI1N)94t%U)J$cp2L+)Vw|aXXTLbk
zbpH&(jgtobNyHJBq!9HD-(l-J>Pr?hA$KBULe+8`&%>I0x)gLxa!%c8K~D_-xJt;_
z@p}f!_IW>lMu&hnPva_~yWaQ05c|}NKz@i-$Iu3_8Al}je@tCxR8w2G4Je8M1f?lb
zMCphKDo7U)kRm++Lhl`v-oX+O5Kxd_BE19%Nbd>+Zs@&3E?s&LHOV{b_ul)?82C%a
zz_ZWZd#*XxnzM@KS@rvD7sl+LKR(4d2XR5m%IhhokLNFER*FRlPq>)%%|~Vw)P4WJ
z6=7-kkPMpqF`mb*>&4+B-Mlp&r`D<b)vPB%J56=&)YFQC(3<Hsd>C8gzpJfqioDv<
zgpGT&`S(78!m*=wJa3%shSzdnmZZ=&Z_>W@$&x8VAz|7*9hcOuNKy8Duda(ytcWsb
ze<spj+5dLYPneL<IBxjgMP?8oX)25k2x`k3sqD)C3WY-T+j?FJ46DSpyBUkxrVo!u
z92^~az9Ia~f{1?8`fYU5l|1p6mGBKOXqSO7YkFP^0InC`+)J9uge6QItye8j!Dv&O
z2`4{4J$#@jNWT+_E;sg({b=KO?G3ZCm9F9!YRgo+zF0j&=peN2h1DMQe$S?BrU^y4
z1DFM6)cA2+uq9&LwB=KuHibD&(vI^D;%iJVj_xh<rVM&+j<$WUhgn82x@myRp>1E7
z;nQj+=yEha1=+)D#@0O_r-O`AiG)iMH4&zt;>g#WK6uP1h_IyeTV95OvC&`9_Ydp+
zlX^N{-m*nc6xUy!uK5x{5yh#cchi9EYN@GGNi)ZFiQZ+;5g3b4RSLO%-mtVHUMl>w
zt4HiX(xSoF(e{6OSCxqa0WC3uWsZHK@6aM)s^n7}6ScccDg3E`<DI6IWjIQkHz125
z=C%j+V8Bc${Gn?0!?Py&VZt@i$8>MI+ly}x+3^JSWb+ntgra?_IFR2*dY&aWze($<
z<6X~OjIlhwxo4wO701|$Z1gyt4`2|oDy-$n^ssm9uHMDJe%20b$~Uje1WEY}S489L
zmJd(qIFh%V@@b+W<1FV%{ZD1;oDivE|LnIncC4)Wa&#Wt!qbm&`t`oKxaSt#r<P`#
z?0BwQ_g^rA4j3&fe5;?w#f!c^_EO!_;a((!VsaZuo85o=@YnJsuR8FbcGK0&n3g|=
z#`{C%JfuMWb^?$}3n}gEr7C}Q_1mDG)z;>wJ}?4F$9t(}>-hXTFyr&>LQUV+ntSq-
z$Nr!RtYeNK|6-8Ro}n#uoFDv?x~u-fQ=+`A(!I`{0}7zgn>g?)^oACkIiF^@XMx-x
zHoO*YkqJ0eT8d|w1$t7MYeq<R)s|c4XE9U6a$4QI!Nn?m&t=~GdUpMHxtF9BOZJ~W
zEFjj%_X@(EM4$!!5$){Xq$@vdmbvxwn8KP?!}{uVw}U%RTM}#eZ{$zB7BIAE1~P+I
z*0~ZoE`2g)toZWYPFNvD?MsyVjnxTr3Ks$1g|_{dmu2ZdQCE$J`@ej$N0z%(+h>l!
z(Cd9<wLfn<)!0nUN01lMbR?N@h1;uL?_YjaZ-c$22yh3JrQ27@rLI=rKCl{7lFWSG
zDc}3)?Z<#Lkl3vMt$D6@yma^2v`+Qi=Rd{2F|KQ7-f$>=@Hp6B`%~d!YPFaR9rN@9
z=O=ew?XK<uDY*rsq=423#8>Co7<E%nmM&%_Rjtp^fwk;7hPknB(i9{#`?rSIF4I<w
zI8t2>n(fizv5Zq5E*6gOAvw%9{cps`@ykc;gobvp|LXg<FG3*dt9c0+^0G8)joWVZ
z$*J|WeSWKeOtU}q#^A$qKGNSr#s5pI9=f9F_8HLdQRme3bj9zHZnb=!8Nhd0B-`1A
zxigCaph50wJ`(M-sAx#4D!C}uyxjUSmkH)f9k)gkhq*;9-5hoxL1KiWG5=B8eh+?M
zEv<b;hZ6P4qKIqQ3#`ZO*xV7@`p@9}4Zvqd&YY3VNZ32A8{_ezY$bKkXQg(z9NeEj
zM9jaNia_6-{P^rfxE)t$yy8d2K+3SNXMS#Mf#MgR{8o^>K#pgVQHLU2n$&&vNss4~
za3D|iix`nEd6_+%rqlJC{kWRmrEq%wv(K#umx`T?V^7NFhLxWAoq?46W4^q&VKMw+
zdr-Qu1Ket(Yn8Nod+1q5ng7R$!`YJ29&akAoyNC{j_5QX?$%sLuIG04M?S%{;8^7k
zYgP^&wh=DDp_pCXi$~9UE2k?gnQ=IpUM`@VM9SV!Vw)~W#XapQ*LzJ^(3=l^S}R-f
zkt@4aMR-PKaiH<_qAZlWwKgRSA-A{;v`_OJz5R9hNlk^wbmRUyaKjjMWGltIUhNCB
zsk@IZot-r<E-kU}^;Ib4-S$p+r7?fz`QXK(*BfE<&$;_A;_l5kI@(^XPL51lV0#?o
z#eOPR2ojfe5NT;QE9Cj(6Zf}{_=>ocrye`5Rua~?6n{w*HNL3YTwQImwX^g7hS~2K
zyZ3j?U?ot+t9QX63_KBka;n{~{I5xQZcf00g2@`Fo%|6vgxobYe;6n~xpA4VKa$?u
z?o4%FKDb}{^q!IVSG_yFDcRFf!thV*ayl`)@0nt6!Ff8$BR}#@ezEu>w<#-oeb(TG
zek`Mgyn@!JHK))?4=xx>5G!Tq1XkuVcXm<~>*dU69Rnmh2noXO&czG*7a3vS87}>!
zJ)CztFPk+>YrK)wY-GCa-(8`OY?6h^_QU(US$PjsEwberqI*<mY_GwP({`1H1>QzE
zx78%pSA1@F<OSMKB?gUfbalPk@ZWVLk!*=tapQ`Xpqo<bxW9Y$DRzcA`{R%Ax89?V
zSH9UhWLowu)~~>*<UOE$>;+Hf$pmhU=De}07Fwh|;&kDEb@K+j*hBdiqe=<G0#R{z
zg%*RQu&}%EvsR}eCE+`*xsSr$T25XzkbW*q)hndvV}>SQ7Z|pwK5n!RrmA*4Te!kA
zDhkhzR$GwkFwD)tIE8y!Qck{kV7Mozl;xN0vf^@^Ezs(|aG=>w<e<|(lKWF3w-M{M
z=Q(Wyn0kg5z})G+<r~5q0qVE6xu>aC$8Vq_7Yu3}B~_wT#O)xil~(`lo7#U(`j*~3
zbOaPxaPV4+B@j>*eg&kbPH`FcTc`5tmA)+Bs5K$&9?DPtU1hBPpJ^6f(Jz$B#Q{)H
z?1v`Z`*s1eRJk2@b6cNu897TE#A&~JyZGyo_&)`pUy+#~vELQ+hYPAcbMn^vGRD0z
z{S<uh<9+QN!{`g(7i+D}ec9Gynef#wmXG0qd~AMFPu?$9Pc*o$qVm()lh)VIVm(nt
ze)NW^hBuF20KrzB@!^J1a6X6PGs9@Ud-uS);Kf9v%g^z1B#L3wkG5sLa5Ay5M_X9g
z*Fg$RF+DdLdveWbY*w^kbM{%22J-r@;U`?tHvuz`ZHYk-quRX>tdiqzO_8bC+QeQV
z$;(yI&$b>|-{8uATgxdGIHkaxYT0vdLNasBTQbV3Ct=*X$8$Yf_A26=bNy=gb1qej
z8;a#6ZG%0BoI>LPp(CFF^+mG3)9oPbV}Q*tyCPnmlA4-B-N|MJU4HL2Jt4d|Na#35
ziev3o_8^Hvul0x_e_6VCYe#Hy8<&wNPbW>TwK_YYd{f)VvN<Ox%o(F1ORHe4{X=-`
zwUnM06)9W#GUv$pQ+*xPnbZVv)x45Y^31dchPCxYv>9%fZiZ#5Wes*LvIoxrJv_aw
zS;;Y<)McMse0f=ADVk~2t^(0bTMzoX<Ny45dMcOi=6kDXu;5-}j^s~2&e`5Io92cF
z|Eycz0bRd>U@$7DdPCD>?B(C0QS9yi5=?9QG(`PIlG1ON2Ao7H0KZy&cK5{xxVllQ
zH=ge)mnnd32RZhW*G6n5V>d~$ZP`j}ku*S*lZ|cmEzcWppL-+oMmc*un~U`KQXhOF
ze?;(GU%I|e^X%pIvKH?Uf3{ghc3^<z46xInGOB$|awJY>1ee!{&3!q1+2oXt9!1sp
zU8AzHAdk*QVH7;=q%^1;>qb;tXms*jP+>*N*@$FFfU2N_Fxbzo4zUNWO%7hydz-IM
z37}qsg}Xh36%$_MB|ZMl_z(I-m;{HM{G`3jkFDsPc(yNP{1N;{CG>q$=dGkIrYNpZ
z{6m|?Yh1%5UWwIeaV&>dEDzbd6gHP89)fN84UOC#suFHvtuLFuT4=uYULo`Ia;UWu
zZLy1UcE!k#`C+blrI<l%u;!secW=$LG(Y3&G_J=!D<>o}&qO5a8Oh#?l?GcpaJS;_
z9Ido=h|t5EFtW`Nc<Y-0=AFDd{klkv=)l?o^X^J^;m-VqILnp21$g8F`HMY`hRKIh
zaqYJ>LU#jA&!9%8V|$)9*174lt4<Cb#gW-<mz-R8va}rUA2L}F>D8IGQs>5fj!(R<
ziS~A<qW!N=Kr2XE_l6m#d!`2O5{9J{^QwtswJqv*f0e=>bxR8{x!?)7_kKn9HWo)Y
zME#bWeE*L*(AKIu(RE-g<x_Y*2Iv!=YEI=CmY7c5%1R#jb--4<`L~JuT^D`S_^H&_
zRrBBoXE1xHE=&8h&{F<ta=(BEl70#r1)$$JkWWiDVT&<~qT!~Q{`V5eI^7P1UL?ax
z#m1?=AvR>I_T*&oDscBHR1E$YTd96F!>lU$;FFSNI7_NJx4wZ%!pB06_s<4C0vY3x
z$JU$lz3(JNpWFJf96f6HaK1FG#h5M2X#bV{@wi&7&2C#t8WzV~T#C9+zCrHbT<bE;
zJOhu@Qds(UhsrpZS@4M}pf!iMGSstRVmY2OrOq$hH2<2P^h)t#-k00iU&xbg-Z<h&
zQsc?EZT@6E6?a1Z>fERwXj+{+sFh{0SJ#T=cM;7ne7|_r=D{nX5o5erXkvYPghBPB
z$n!wotJRaGb>HFHeF^Pwttat$Ukb9?#i!f`9KIu{+)Ei8R5$WuY>Ih1ge*JX%xk2p
zGG<8%*#7vk=;3b+n7;l~++W^Y_x1;MZ{w%eL}LFO_GwMRtarw0Fv;D$o_vlt-iT_R
z<Z5K(;C+SNR-x#^M=UzVLV;T5=kM0*D)3;A{yTS1!B#D#lQj$QF0GnU8h(rQSWdl~
zwW8Y<@oLFgvC3SC=QjgDWqw2k+>|ZtRY_lM=srizj*_B<rKPLcB{QhK0Dg=}tU$n5
z56|i2Huyu$Vrl^Ii@QeC`umd}P4Izx#cZ#^EjpRlvEJh|>m-YL_8p1LqvRq{sX6SV
zex}pWS!GmW$9b?JI0oJF$>OYL26dHzj}=bj{?W8<a|QJK+11u9nHgG_62&wsS4<uz
zCMJqVNwL`QTF|@0Ll(rQr>EzolMhCWTRNW3vw?m*CI^v#LcYX?`Yfy`4g8t8xkIT0
z(>gdg(SLb$jQzqrFp#BB2lSD_jHrF;&@K&l)b!AI7VGlBI8TFIQ4(JM{<JWSs2Khc
zo!<C=%QZ_niba>I0t?!Q?L?fN0wi^Z>__g1e38sZN}`N^cV<pg(QxkXXly)<;pS$4
zl!YBTuhdlY@|7Ob*+$qhyyLR0vf206tT<cDk&<q9)mvrE%+*6}Z0*g@byfM17tnR6
zh~Ve^@eT@^o(6shGPU}7Pfug~F3`t7Xs(aRG}c?4pQ@*(9;@?zX>vT~M=gr;33fa_
z#?z<^B@b(P<tELjSoVEobc4H)bDX+x>K^k(KaJ}jdDYx(LVk;0b#%$URKHxmR}KQ*
z46c2$YGd%SD?WB3xpK${T@-bj|0{Q_V||UfTOfG&0|>frPB)P3(8qneyyV%95qlNs
zJklDbO_nhs!GGEQ%yids|28CZZE0!5#>NH^xW`hWu1QD}+SO&G%ELOZHaKHLn{jy1
zXSj-%1|cPOoEnk}-V?lw&-aHk0d?{b-xJTkz}v8BNZd|d>`V{inW)|^o()=}dipZr
z?)jxZ>pd4gJ#C1!d(w(qTFOaBAX1Bx7$ec+TwPCg3dv&D<nx|@K&~%9<RH+eueGh5
z&;v{js9Qo(vhwuQ7bRjgJUna?A42zB(~z&Ej2(2?{jE|l$mHIuaeblWN*`=#XE*fq
zDsK2aVq$aVs)*F%#4FGDm-R9bH9Yi@B2Z))y}EI(MPtO^k{mO}@!~K$W;0Ghee>{e
zB#21d3$F1iNoee>y=lrYd_T9cS6_x=Xe&%V_G;5o3z#vYC`+fJJffz2{ha;7g52mg
z^#X^S4a(6sx+L8Gi*jSqU8j`_kU;}p3elt1bB`&}vF5r;WF%r5jrmgLYM5CcW6~cL
zFW+71;N050KZ=_4#~kaZ;7;cP-Dcuhh!^>|e&Qi^Yk%0KfHWsUG6vI)o2kXGh$fV1
zr&hXo4n-^%9kHIpClw<>P~w?!=GP!Jp5v=tcew>;fanhA>S?8OD&IN>cPJ>@9U}(a
z3iB^ERpw@x8WLn_lQ_kiYGCJPCedgJISGDl2cKb2stS2Wccs40K6mtO^roZfc?ud+
zBD!a<`ZN#=-yJ=ck>@^jfnkn)-{6$@GsZ<8Kect=5lHd`&wKCpNu9cPxoOtzYT)7@
z8UNkMb8o#GSh)BAi~TmETs~0visaMa@0FES4kRLCVw2O8li~SwzbBPa`1bm8A4|{a
zTq6hVGLb$9fy{DF^p;<>5<j6*>aYY{%`65JZm$U_SUW&t#q7dDmXx%#!;u<!n3|ee
zd*W+6pHK$LzTkVoL-|K3t}l_51=?zvIS!8*rt|_&=9_2djFTHYM8uZc+~KYIGA|Eu
zVm~ie`;SpL7a!J|DO63VRJ*!PXO1S48t>0*1l`Oy?_E01NKS)>FAc00uKEMeIDy&U
z_VHsK5ou``v_(1gCVwMTu=2`*{n5QG!NRDo?;eezXqEy+DY8DSiwa?_@LslOGZ8oH
zc9}4bo7C<0mK%=8>Y6GS5%~7fzL*lvps#6j%3QA7aV?lInuS8OMqA7Hq9)=UY+1))
zBYn3HhOl&|B6X*tsOdPPMk5&a*s-Q>3wJS6ug8d=(RSOCsl!jC4DU?0kLWqMY<oL3
zmKI5m?xsmA+4Zfk#iizs=k<?oTum-E^~4x3(YP(|rXM4@a(}WRkO^^wjj^?yRqjqH
z$+@sC?LsV6V8}I#-tjEsPE;%xQtl(4t`=Y8E5o{G4_5wDRyKL$Q+T2u#@jDFfKhZ@
z57V+31FYU1Sa*DE3nxn)fe#OU`N99sPX3Yjm4UN*dg~E72d!HK%JHS`b$<BZ!3WFh
z*RKb-xdV;5<^*?te~D66_qDHFzYlNC%ON1pkC%i0j)g(h`+)q!`jV0o%`4uvww)!V
zrBgt#w5f@S2s~tEb+t`QM@MHq2Z`jDI>bCbx0ktlK~eXXGKRuAUw1H1|1}gjF83^F
z)&=e$vPhpOxh2<7RxGYMrrkAZ){wV*9kWpzbhGnN!Xf@EpV(2oRBBpMCE(S71>0M*
z!u@pD))p4-)ukI&LHkH~_M|@;(bXywhf!~acla6PWF0gZgcULO$14bPhl{y-jD4^1
zj@0Iv(XBEyxYz#HjGbX#I80`hVZPV&*@z09@RT#rQ6cc^atdT4ZY(XOO53+Jpxi>r
zl$_o*BKI9+{V{L@G}4#YipBt+g=5(9FRmE2ZGViT6l|y5ak11qYN;TCj|JjzX)Q58
zureU`m)yz4yv#P_5qG+bpNMRBQ_QUTKE9@P(am=zrB{($k5^X@HNLeNBXb@5hIs74
z|Cup*)E#_9ihE`6Y#veR@MWAjBLLMDEhSyOb*4CvXrTGGNR%t?7zI~R8sl$wQ~SGN
zACaaNaX7Lr?e7ou_w;;N%d?V3^Pa@@IG<rKm`8(OdVKvL&&SJ~O>x{U&u@Z4xc_ta
zUVm*#{_>JpqU)tRFD+3~Q3JBO5Mpvl3V0RGVAkBf+x-=_G)(>FnW&9Ru^9!0X;s{k
zcddi5fqlSCig?yS37w(JDf_A+dx;V4dtN+^W|g)wmtyH=cFc9U{qI;J9xI9;GsUm#
z$yc$#)jV`S3g&dPbE)aq;@{@z^Kk`VVrZ4Kv|QAXe!IgJd<Wk`%^%IrtV=nbqp3c=
zEdK;wk};(NS57Ru=<<tk_HT5Y9G&FG5zjkYM2SA>%p>aRL1kf`(I&iN<~<Hk_Ni&f
z6)XO1`b|Qqn`|{1dbd=@Cnyj)kidjyg3P3EwtXk&_;5{z$Wgal>WP0Z<+Z(a)*5^4
zR~aT@dyroGs`sJ(<2tymcIE)eV?;v@&i5RJhc>r}vVp#fUhr!@IFuKe-Ok2etjbW2
z26AzwKvBo<Wx&%?l9Cg1b0*|AzqLE|g51<rS+;;(S=^m~>fJ4vli;{=b4$bd#*(*;
zhBS=Vw?#SiWpkTFIrBT4=F}j*yypMxK>hk>U5=$3&Ljy{2Pvtk8!T*WVZIM1XJ@JU
zOHim)?w;29EB_Cg5^6l{KXT_N(viXp4JoYM=}B)Z%3dZ5+3j9&AEvJRtd==IJ$#rJ
zrI+t?*0dB9(4(#{bA78YWqWWvH>*w#E%$;m$Ib$t^o|}d2Jyicb7}6!VDYoq^2y0#
zIe$?ILhF`-xgaDX9Aa}=^Nn?#4{<?F?92$nZ(zws!(66oaHDV(tcA*`B?_W1HoB8F
zN8PV~_H4;2c5A7ADCNl-gkHep3t@6=b`n1u&%(w!fnLj;t?p~J-Sl8<+c=REIK5sp
zW>>V(e_p+t+Tt7^?#mD1igRSEu&{qnDHMsQW$U_K(c1p*X(w07L{iOFy^8Z`iiVb!
z%2vGRNsl+i*4O94z%EkcjhDlYDR#o2EudFrxrn~o+CShIEb~{aAv@j~jM5f{2cfg|
zWyBMn49#UUfsNO&`CjLJ(x*!kvEe-YdR-!7QqIK1;0tO;W2D;Ai<4s&0bJ0rcd%#x
zv8JYmo$|@!$CfSl=@u3h!;OPFc7>W5GlzV})M8(Lafn2H)mSeaSSK#ja2Y22c4|sW
zg?47KYY{QBec{!f`=5mc1^B`zDIg$~6;!L_>gj3Scw={K>pK}q$tMue@q3+3O-+wx
zGtn_`NH|7=0lXyl7cb4+6`gT)c7}5(3cti*zKLz}$E!3Cuhp8MR_Si8>G3CP9wBxc
zNx@*we<_wM9Z^|zS*<dVjZq1ax%#rsF#iUZs@VK)%#P;EAXE@1tIWXJM%}WSrKRQk
zvF<3_;D_*58GFzC*O8+khZ0EZ5uitij&DFsLnCZ4NAvaMG;i3@p0w^EZ%*b{y&cpq
z754U5ay0)i%ApZ*<QpGUbmyhI;v*mqR2!ZWm|)Cy3hFE5-aj23-Oxgj;<2Rf>+PQ)
zTyr&hU0>-t9L9V%;VSYEx%9uspms`Za@{aRah4+IqY1OvjAQxd<A|xnMfrWPSX%I+
z2(*-Y$B@dLhmlkbqk0s;RH|$klq<OX-EMTldF-%kcrEncP~7kIe5pozV6_FmLln?;
z(=JfL1`{QkYY_NNTbxA8fduqnV%sqi>I5eKk{FYQzi;&vOZ3t|(2$csK^E3g{uM4L
z0GDqqVMqBLYg}7h3mxP~9rn`;Jkw%cO?(=l{<Cnmu9aKY+exb)aIL))33hY4$>qqv
z$k=A3oU85Y;;@OKya@vNUJm(v3#yzOhiw6BYfD9i4ltZfg|r-Daxgdlxg1S(wW#u;
z$wyMA=FbdiZ=er&FE7SnqOLW#7*FEy*>wv^@!i06%O{C`0(!D5EN@cJcBL>ZL^+^1
zwFtEK!K8+fONUM}IW3K{lQ2#^Gi@t(xSiL+!h%|tDJNC0?K5GLWg-VP6&(!|ZDGv+
zSRnaWWTc_h;Y&>&kv3bf(b9g^OtNu(H>y!9xqKMnd%0ViN_<{?7cE9%!#%P1R^+uN
zoGeA=J#8VemS=Ni)Ik-t$D)j0-u~t#8XIH&je2Tarzxr;(BzjU!5t}aI#8xNs_Gkh
z7i(A3X5uvV9D?jlBnRd59W8U;Mb$k4c@WK3S6BHYoI5)azp(s<CWMmR*;!8Po(%Co
zCX7#}e1GWNedm~81YV>fUHO=Tn9;28W<CGsU3_Sb*Bf7#**Qycw^wRvFyCSa`8L(R
z`{(|1cjou>Uo0ug%FBgN@Te)kekwm=)qw0<R8&;Zp5-f#=ISgkC`6j{IRHPc3eRG$
z`~VEACkuRCUHgGSOQZbZ!LHjf5)w$^dV{zkzou;$7Z=Kw2c=lSu3QC!49Vp)+0UgJ
z52y9t%t)Vnvrr-+w$9Fm`edZ8trk6nR*Bf7D+S^YzbCyiKWX4XAyuCE?v)pH2JB<F
zaeJL?)62_nDe1Xs;(p78jI)DZ7axX0wP}zX6*O7@{XK#(!gLhc+ai;iCc|2^cetu)
zQU!^bzpKhm_!=N%M$4pmq$|X8iW;%xbW|tiJ>?e1m#OmBC1g~~%L{Di&97Z`JJfF0
zQ!9N;wYGF*0yh+&HF?&Y^IYAtucPbnSdwq$BpNFeIhgyJpnoQ{)-sjY)<55tD19<}
zde}IREga!n%=GKGthpoi%-!9gZnTnk6pRmsCph@QryHi1jvKxsh!>U;YRxk6;%34T
zDr{W_OlrRjBR7DD#P_%A2$7BK%!^*&{nJaOBxk0a8?0?t5g)LnVnXIE<+XIpj{_A^
z{mJmk0Nl`vcYoIFN1|~th@%L^0Sm|#>jBbz4ULREgf3TBR9FHqGKF|}=gyrsvQ}xe
z_by)s`B0JE1%V!ETP(9tc`Z65Z*4ilL!3N4M+>!;pNNX)(+i0_eQM3f$Y`!PyKxjy
z0;O>Nv8(W_UuMZr3Lc<YKkGZP)bS}QCb1;Y-A1&gghoW`V=hdG^IMS53zBa^j>W4;
zrgM|vjQiDz>n({jCIvw{<n$p9RrP_30AfGJB1G}q@YpWChJn2G{q-(sF=-Kh?6jVA
z67>$tl!L)4Mx~g5H4;oUc(dl^#nOyzRyC(vRmD3+;Ob6Hs{)^OtWHH4IQ7$`&Z{&E
zt1VDoUJdyBbRz4%2zuNb``VX+bFXlW6w-lPa>Nwl#`XNnJRjV*jHCW>Lm4msa>^<$
z#3tbMqozID=6z-eRAtViZekQBXv?d?_W^fu=^mtSq5c-HsiShs>|&sVZ;YcOb~e=3
z*2bp9#5J^kcw;p)18V0N%W;qN@}HOAJflm(!$umRJ7F6XGzSb{cDx%Ey1Y~c64s-d
zMLVp5K$Q1Dz+Y8VX>N5EKJnxWKHqW;o-Wkzaw1{izbGKpbkoxW*}1t5c{j{z;<<0z
zNl;bq3694kS`8-IUU!=m0=JGh#^K#M33Jk7QsteU8S$O#P`>!$C(?7Mf@~ag(*Ll(
zKTjmhKi+;YJreK_FsH>w{W^jqD`q0FC%xFRwI$c*TeWl%YaR`J+00PALV=mXLk}O<
zS2+by`uPW+XT<T|>L%5?+Q{$aLAxAkKTilpR<wfl)`(J=3H=#+9?cMMBVYC60T%Fa
zsFUnNK8lQ_F4pX+X;<m@KnD#d?PSixJmd+YZhGQ9qJfd5dU<Ms6F<Ao$|iyTrjcpK
z3HKUuc!lRv0yEKX3N=-0yY-wO9N-ROf?2r=JT9*8w76D0e$2j`z4J_$a1C|Lcew1{
zqC~9OStjs+4KDwa4~Y#x*-{_Z0H>t$?2@RaLLLTl8>#ESz(+hWIUE1iE%?e_N|dMT
zp9L|~JyFcgJa^jf45PPMfshnv7oND)6<3={*GY*9I+G}plY<`7{n-RXawkg8KXgg#
zoSg+W8(UiXuk;-p9E@#w1<Lf8gZ<mBg_{5d?cKa-AKFE28`BrSf1oGJV4J(=W*3zk
zf>|0l$HZA;c80#k#88(620I_w4Cm!xH}n>iBbVrg9>VZ2QGCcNA8JVa8);{!`05&!
zXq0Z}Rx0)aVQL)JD%NB|p7h~!KmL7sfSVKXgqrAIaJ}*ou{kR7j97KD6sNIet0Yqq
zd=f^y&umz#>$E2tG~9e7L&O$COG3L|NPlqj!&jR%Es3k(tMweDpnSChT*c#Crm9Y1
zz?{F;thyk6&ZtFLJ!x*w9-VRchP<co?0O{nR<W{)1aSK#H0Dpm8;r9y#IT<}hBDOz
z31#V-7Y7O4h3N8q(2R2dOW_aZflK7&u+Gk;9^k}ElcbH#X$~^W7bX;;r>wGVTB;78
zI_mP{=82~Om2qsl#g940#V=vYeboO^I<k0Ogk9f+L{^yCsWMy&NLLs2Ewx%MciZ=6
zjl(YWv2IU!?X3X?!f=(Fo0RG4lq)wXJ3<ak!1n21yr^4Os|(itjm&^2V6tl3*%US2
z=7k*Hhy7px03bhzuKE~<YvqV2%0QBSW{_Jc0=UipEUfmzdV&W;?H0)Ku9N+>6kz#(
z#B?o(f(F*s?0sA;Ebd(il6&_JRw4`wy4v~zE+=F{@1z1nj>(fNLcFHDoi|Jh#e18Y
zL?v9w#;LOk?r9d_76O?Td|}W|st?vz;JX@QBHfeA%eh?oa-%87Hggqz*@M(Hh2Q)1
zF)6gPI20j2n1yeON6p>SGyZ}l{R4v=2K%M(P@Tbv7uWXE53fyr<CNyz+Bi9%6~r+k
z=$bSInf18sEKNj&dDSguCLF$SIl-i5c<V#rLoRH#swx$g$Z4!gjUyspU%B8@?wB_>
zH#fBOYuh<tSO!mw+sQQBX%e-3{P;2MVh8$C`rOI~Z{g+~?=T8RFZ_^bK8tRms$N+q
zD*9>6p3%QQJYlcAs8<e(Nga!)2mZ0xU?t4*US-H*)G?1_pujunKQG<vh5Zevu+k!M
zz9l<?E0~Ma)BDUFg4Qq(5*ef&2s#!gz|{o`S)~Dyf<X7V1>94q{DAbui{OhGVtH+K
z^~xw%?VN#uVFs9f75NBl$hR`vlKaSk(`k*|2!nxFO4!zK3y#ZiChhG-%pwAu(mSs@
zN>w|%SpYKMX|#pCq;7q9R0W6E?DrX?u*hrQ#*1zo$;$_VS?XxsX${!8SqNYD<6Bno
z88kuNnNok1a~=uLs+z9x3LI4-1U;17D8yh25Ao*^7htAc{znIQ%|P>mI$bhfF#26x
zvG~yNnCC;O8dITsHbOY+Hc?vM`ddEMX#3)cK3%EUDOaTB<oS|>Iq#30&e^3T=*AR~
zfV)U@S)1%zE-F}{v2S@<;Y51<2<B6wNAGV!ob>?mh#6p6kTd$EfPh6Kjq2UESKo`{
zyI#%%P{Nq~9^|s$rsTxvXkC@7ODvW!=Riy4sHP6fh1CS@=9_7ld<=FZ`Tg2|kUQ2)
zt8a}wm5BrH%_pvfUZ$|aTzC|i1R!}r(RM&f`Me}VE(Rq_@d)(8{V%C-lb?8^7ap<u
z>^99g6d8}c1ctvuAP~o$ot>G2)ub$XdU|~2cluPXOouXlO^toc{!ypQL}RNoLIlcM
zvuD+3v0iRjBU;qwZi5IqD+k~pXUm2zQ|w@{vq0!`O=5mOnR-C!^{D<_mmzO|Pb&QG
z7neBNVG$xhuXr%2%%Yqw<97*|4XX)<J=QJLB3}hUv>*08l&Al;@5A}QnU#&LEtT)?
zArKh+ggN{97eYr~ULM_(3K($e`JIjb8cwh&-%8YIlMvS!eH~$sW`i88T@8tlR~2_e
zOxeO6<S`qbo&xBLRS$!>2MG9*5xEEpbAS~P4wI)nWSRTj{=2;w4i7AjV$n3jGk0j9
zOI};0*?)HZr~}D1dgO*ZKn`d-`HpoXQ2iwdCSWCcaj#%+N73;_+}>c=m>m~(cC)gH
z_)~AV+LX*6c6#;i_kUPO`ngpiMP`Wk6CVWNc&y@{zo!qepeO@SuoI$>8$eUHLP0bj
z&@Hh#Sr;g&9@5GJ^zza&5QUk~V1@xr9r-nJuOb)1uT1-}Yt+j&fj{w(XRkjgFVU$G
zGheh+xO0bpVicY1xh>)4?anCod~sQkylcs%fT%&N9M%2Ua-s*fZ=ExO+#$0VSyu_B
zU0ht8&)e_`@S&W))fDzl$n<<_yme1pJy>wh2p;Uw(;rMYcyK{WDuWSoC^=foM}&?V
z00WHkwfcqY^YiSw;Gqo&U;IFaYCr!!!_-F}XC>vjay)f2C(`9G&C+)FXL`r=53A~R
zus+7}b{Zldq63NeWBFaB@m&;Qv;|D^%-C^%N7+XmD;v;a?l)_Kt74S%LE37_>9ZFv
zA~JT2izlt{h+HIx?)S;6gJF%$dQW@35(>zMN^^@}!C7|AT8#|9_U7N$d%?F~PL>24
z0S<3F6J>Xf!R>7qeJuT@=kLjhAW$g#AJC*#OloClXb4z$t^z+5jUj+lj|9()OqJ(=
zCzXj*6@AaZ514t>t@R%bL)3&1uOp9wyS2?{E^4RjN4N3@zPsdG){G0>;g8}BOK@_U
zF(|yn-`g%O>f2v~>f+nuI2O9d{h{hqm5V=1)htt(Pnw*Zr0E*ud$2X0qbB_%L2cxN
z7YyA0OAP*+?uvHq-Sqq)8g)k3cS;7LRKy%jDOuN;XMrW}{1qtovS7NRv(M7bINx%3
zzkmMdsQK)Cbi?7?R^~i85Xf<!Z<>37${Zi|@9ph{H}CHqtk-+^BN3a7D{<H=%h|d2
zQqmlVY)|Xs<74)+Q9E_6aZ@TtxOkD`*Nf&e4W>QeKi_1CDZ2s1qh37+C1LN|+i||^
zz=wAA>eV1?YtEkek1Nu{WM3v1`1ydF@INn5g?SSvY6=1UrmW^OW@l#y_zmN=bV**y
zUL|Am3%8<SAv93WBN9I&>zAY#>jthP9ToJ-$}M_Tj^6M$%h)h7B0{~)xVbyW(rPPU
zCCO@^)C@EADV&jKg7Jb!2VU;1@6D5UkC)CklOU5yBzMW&>81v;5nNV;qZY!r!Cj>o
zPo0TXEWRN)5pqM@I<tj%-cmCL;lB{*P>}+!U$n_w$d7rcuM+xpF4PNz4}tkT>&$H6
z*(Hb{&l7$I5s!nhdA50NRllAR&Vz|NxcM-)(2&$Qjm|YZp||B!l>OtO(NTt`ec?3K
z&TS-(eHJg2a;W8g{TNpNB5L5wNq@zrEJB;ul(Fsa7QjP4q8c;k-n7)@TH@*JlFyCM
z7d>r4j;8cBAKw|X>w}Sd)@9Mlf&PITHmBeI^U8mq-gyN5lTRNK03-RQzpt;}qI^OJ
zNHW9g^2IxSxAym+=63&vH>mV5839g$cYn?UUf68b`NS19`jA-J*SN~uOaH>*WcknG
ze04mB-z@1HHFE)z-CgSe)jLYOX4;$H5pI28m!2XBBTVj9fA8dAzx4Nm1C6cyg&7xa
z*R7^W6s*pO;_a8a>S2<PkA!ZiUkl4CsnR`F%%p|C8(~t-6e4q^+txz!ka_5uE5!+c
z7e30#7Cp@EdQtxFbGw7I6c)9gJq{UA=v-$e`}n))oJOM+aDMgZb!mTpfA*Y;%1Sz}
z_oXmBC=UaGEe$FLDaZ4Q#K5#`Rk}ZUpg4e@_QO41Pw_}AeG0v!o%AbiQDc*^Jr}f5
z6U^V}Rj$i?W-PV3<`LH_4j_Kqdk*aTWBi!SY?y?El$d(+PQ#M7!1N3Ej;>KfH%G3k
z4CjJ5!Bt1+`6&HI|M{#1Mjb}E52Vc%72Gwl6s+^}^X0j%_XU0o`LbfMIcL<Me?2dU
z{3d=dR4()cjFR-l`nrQGeaI4!W!B%{-vAtqG@n0PX>QSPe=fSo<)dT)Njm&egz-^D
z_S-d>!R3^59gDU3CSJIAxloK}a_X<n&$*xkd%YW=ta_0pdwR0p`UkU%Owk>N53I5s
zHSLsW1<@Alm)*f+jN2Pgu!-oM%)rd2<0tyUV(u1Eia@w}$JWI{E2{)G<^a8PTE6S+
z0j-l{h#vGeHm!+0-p<|8qC7vG0<ZE6WViI+nkm%fW3RmrRQlFQ@8rdynM^FG&iVw=
zplN&SyDTUb)rc{G3e25kaouT=VSM)n&-POWpBx(K-7h(*frW><%s-a)ni}&BC{y20
zm#jSB>QzC%L5?{>3)S^`Pw`-Mxsfc-@e+%E&tG*SXtaG-gRdG?QAzq)2ky`-72j<Q
zhz+Y%yIP`T!6G6e0nMXQAkh22_<<G)vOk!{61;fmz5~F`qE-pu-CjBW0EFzcD}&{;
zUkdPpTU!G6mjy>s*K2(4P;MNyJwtocP*=T8qc73CRdb9bM$w$vV~wUgH(Ft~hza>z
z>*2UzXpsh-=9Qh+=tgpI?Csl>UnS$2SzAR>Fk4?F6ksktaR-YI<IObp5$ZLT_-M<f
z*Xr3?0G4*B@<Rvh#}OavUK_%Whh1fxYHJI$<Ajz*hlvjOf{6jUKLe6_PS-SKz`?=8
z!{F_&a(9*9vZiN`YkA&<uxZ;lo13$L2r}}Enu6xCLe8~7FV8(b6)^^mwQCR`pFMHX
zt<23uB@5tfrt*qE2eHlWmaGQnnztB9a$Gnj1<gB5S*t5&xR4WluvOCy6b%h^RbjYv
zV^getlZbuPSx&E7Z^|9yVVg-)K8meA6z%=+(5>aZ`CZWO=h0N<GgbHJ<*yoZB3U4V
z+-e_~nVCP}cE0d|CXo>`(YwIM{Oa#}&)U^+BIb6kzfG5>XGN8ko^^MtV%I#<T5ry}
zh*Cz=7XhCB51T{h(Myk6@dcPN6+yg>nUL9#4xE+DBNovGv}PE&=oe~MmTM2XxS)U<
z)G<+}p)9=cxOgt9Y^B}Gt*pB#^3JB#Q{93mIX|>ewC{vaIDk`5$=Kl%+-R+qdxDk|
zk`$GCYHezIRv&mcs5I8>m@450=(|(!-rhdAqbHi+Sg@SNx5;y|7+04<+$Z7%GwU_7
z2i0(+ZBN(tb_m-$p$S$PEDC6X4XZW-pV+mK%7D*!E*^`D+7eG<h_|NR{+7&53P3s6
za%59zz%?dkQVl_o56OZ$I?lGbBG5y_y90uc!j|N6vx5rwPxCgn2~*osm>u^ZhxDa`
z4T<xA@hJTgA<IR}r|xHc!(OHa>JLorqXF(7cz&RGdTDtt;(BOL0S;0#{A^*N^_7Ok
zd0ZTA?<L==(DBBBt}c~lN~6IK7)+uojMrv(oPYe^mmhb<r<F%fsw^%Qkl3~8?@}dD
zfQg5GO*HJ!q@+gg!bl=$D79%8S5`V4tEfyu{fFlQUUK(-;E7oP!-M=w2NJsAP%Ut&
zE?D6J9ZSEnQ~WxZwv{V=JAHP>WTMBvA~WK%DuLgnT)%ppzf-bAa;Y^qpar6L61fgv
zJ)f2?Nzr*Z?Lpr*D6UHK&BpznZ%lbv%c}omH<B}v?}$e~=RiE&rIv*)_$H~G!!m>w
zrC(>H+$PGvx5CqN@EhPg>H`QoH+AkAx{L7n`?I>FXZ)t8D&*JfTVL+v2hMMW6@%RI
z!isB`5(6D55WK{uT5g$cojHr=s*KDP;t5wijr8@LM|-mElmz<68wK+RWM~7zp2N{o
zXf@3F-iKhY{Yj^7OG%TTDWW+L`X!tWfV;qRGMXiZseM*H>Tp_ESolaHi@^*q+;DmG
zW>7#-Ff1@-N9`Ge<m@MP(C3o!`xlo$KG#X^{$?GA=pUNv5H)u;fC=vW(MOnXllF%1
zmjJ*lBPy!*@=AZv72Vp#Mh_Sy`#F3`b!#DVdG0K^GX3jD;tQPpUGB^BbOp*Ti<XNk
zvD5m?eI0BaTbm1(j<Y6)t9yfd@v-qLMWH&^=Hmu}yK_s5gqsf2hwgsTK#tey|K!>?
z_@$`CXv|JA@!_s^E`v*4oQ}Lq@;h1l;`u5fJw41Urd8hEeJAXIj&#T!e9{j3Jf|Vc
zUbQmx;q$g-gJ3#x`h2H_jgM@N8FG0@$n`9OqV$o|F|sGd|NHTpkbzu2&6FS9wQP0x
z8+6|Yb%#`Twl7_3&NQq@#(S&bb+3B`n||QEy5_x<I*a`V-(x=2rBKt2VJgz+px@8G
zdK#2FIrJf|%~q_#$Q0i~U2s2u)nB(XH?wZnR99Eh2s;g5p#<$RlRgJH_oW=EA9BlV
z-SHlPS_$zr0>+h5qrzbA6PKDh*AYoc<nJx3EWss7w|IiZ8WlR)Z0+L-{l<Kd;%|J<
zEfxF)lWBbeYAeE)aD!oNuxv4NTA-TCTUA|Na#eu%?Z=0J@rssnQd?f}8!9-yumyxJ
zkK6W9B+Hnes)e1>d|Dxf_k66TnVwW)3WZ^rrP~dM1RkE$0C1ocn@{@O;UG7a0JYpz
zl4YMA*;ft5p4}O9qyv+kUw~aFUHF5%(;v`0O$b2D&dIkN>Fo>Wcd~Jh2U=4fZw<iI
zu)$R@)u6~^nhRxu`D~c_N$HHOk)t$H;o?7aL(yPXyHzuHDlRE4O)XCq3;<$?$argq
zRrGM-R9!USxrUQD`AOZ#mzi%zas_lN;%|v2?cARui-NY~G?lgKV0wR_R-l2sz4ESA
zX)!&49~S<P0w(L;Zt1_xHyzDe>VkU4iI^0@d^ZPG+^sio;<(q-)iJKp-}h9|9bMLd
z?x?KJM6va=r{gTDWd<2)wq3_%ZSb-fd&Xzd8TYyCv*u@lbW_n1oe@Kd)}4Bn{8S@T
zQRHSeUfMZ3H$wKzuw-<deJT6yE6zGX5GT8_)4p%yL*#=I6l+d|0=l>e@<zYbri@}r
z^Ymb-NVWbbLZjKc!lm|fJFwuy-P_w%bllnB$LERO1N|nk+obx-doVZrB9sU6o#L0N
zVat4q7~$w|$5=~H<ujE7x%Ykj{S{knZSsaDCVi}qb3mitZ0^BJX(~JofdoXU@J9lr
zBUU1Y<MN?;dh$p?XYTjb`QPinI+Vbm3gu^|j(_{NEGhp1m(soCR?w?1m+LHwqi?V`
zo$ft~pPi}R%pAV%+{(9{MGtve@W`fAQ?-vjMUNa!#qjgZrJa$O;-zdk#PN`&eu;Kz
z65H|EL6hblw`o=9d5~dw&{Kr=vwZE_)cu9C(0p2AXk0(6a_J516}K-C0A_w))i5dW
ztzXj;ku^3L!CHJU@%=okq0C|nm*<QwkBIN~M2;|x*{Oy04^SJ@S5O!9uVV1OHx($v
z)DpaFXQEAy0H!J@5__ye;g%_a;^N|92m(S@VDzw)!7OvZ*DX@8jgkWNufgRI;65qX
z2lNv5%b7q22{*S3kXKLn5g0fIQ&Ur`&m({ix<?-qph$W?5T<NY<U}}<J#9vwANDiq
z$epX6p4Hi+(c;L8G&e}6Y9qB<Gj}EbDjO_!s%*~<%~Zw9&pizv(s$$6|9KW~pD{Ni
z`r7{4DwQ5Ra)**HA;RE9X(uk9!4zL411B87^^|kmd>=I0qEZ9W-oaNpI#qGI1Fk<I
zl@`QP6Sp8gYtE)-cbk^4l$yn$udinh9d`_lORZ~a1RVLzJl)N`si~n%Y&GE+-qfU|
z@^UvRUnA<#h{JdffBf#(NK<>asM6IfifG<HtP?1}J{N*%`_Ko>Fxp*{5fig7Pw59V
z^LNipYJj7<rMjA-Plw)P)(sLu2?{a)4|*Xf@2Im!I8p@}3*W7-s}qBO+`s_^8aSZm
zY{#oX-8tR@xKNAeNr(9E?1bM7m~4_x{(@{@97@oxb8%6Rx0Q=eiyfs{gcdd>Uf^Q9
zJbi7BF<7)S(pglm27{Ho?^|k9r6?tqpOhgw7A&CWGn&OGU@%N&&H`a}Tl2?#@7791
z)ie=KMDy3BG;r|QQd11Kgy@!d0wFme0`FxsWvYTC9;UkI9`|2}A?XcjgIM%lqA*9t
zhITSz6r;XpIvPS{*^C=g#^)W|+fzXAsOz!lIPT;G;MCK~<$C83sWmE9HkR=z@f{sK
zx^*v!gPv;*eC>`Jw7T^_<fPRg|69I@!oK?W`)^$31J&stUChsCYVyU`16f-Jre5&i
z{UKj1E>RK?>My6E!u)R@``ziODR5I6tqY*M(Ons;hJ~z|kbJv!YlyZ8^y0*Jr0(tc
zOb}$W{0)B;eTnY=*oJ4x0g(MMPgi{6gHX$wnOwvh@7JbE9^WdO_!Q5F*<*l3pda-i
zhn_O<{ac&4b4+1^7c5iZ4_0Td!B?Y3`j2X7l!c5(B9Wc3hWqIp#5Eji@vv{%2GZR>
zK(iYawzRQskf~p$ooThar?|f}_#rAvuQ(|n_^dR5a1Oqmec{^P@>gI1WhJa9qz;AC
zhv=e>=tH8Tqg!972=}iUmO!69qyn8*PE~I7FVc{bf*Pa$R>O5~onc@u%6Is_K6N`1
zE>%_4_4q9|Ha1UwBO{}e@bGKcjU%wV&p*4!e1vOwX1c`$A6>+lQ=h*3x>SWpC#$QW
zm)m}Mda$33_p$d_k{xhk+4qLqBcF1~O&1N2A@v6%4-G?n5jfHfB8DCeT=)S7#0)u(
z&N}Y5nY*YcuE;}nV?hD0kyl=xv8dIb+pIgqo`KeSdWl}X1baJWpn1XB%Vvz}=o-J?
z`bx+83Y&OB!gFCZ<f)G+$LFuE$g#)2PZQuc@h(zlEhHW2=}{|i3G(n*(jC3n-PLs7
zf*dvGi<qUH_oUAWM)pPUgMQFl4*6ZKhQ|jK%S=$+0idb+`z5R4lH%eCpl!h`AX9Uf
zFWWyTh}9b&rwfcgbFp!KnTrdPPCp~}E=}ZYp8<%|;No9S#X^>BBTTrtwkD}c*SMB=
zen(U66nfIv&KSa*=o}C*!xVK5IqC>yzEdIh=D}%${}U`^AeSyWGT7hr?9pUgtr4XV
z@6w^!Y+utXpk$Wy<J;0_XKQ-tA!3DAqx-eJ1l$hHx6#QmQ$<_sv<E+CU6eM$e`q>U
zS9)X^MlT0vPb4Tx<IVl*ign*soBn<cpnu1crdsm_emrm{Spk^bR*r5AMmcFnTvGDz
zH{EzLItuCa#R0m3DH%`N359Ob70|`{{Xc}>ml)^B{rARIARx)I;{E&gG~O?-{8Ku<
z!F#dD#l`ht^7`u1CAnLkmq?h$1;=P>5PTm3(F?V8d++GMxrD``q<Gejp5rs~gs^i7
z$I}d;Ez^M4*TtzZfmugL@0KcIZUl^+peC^{X*Fs1klFemI=H)kPci7kky=7`d|Z`)
znpT!J?W}KhoV7aNBXqE`Z5I#MX-Mxh9mV2PJ`{~O0F`mZOc%7|)r9{3X;ll`FWx+a
zsBgZU%*&-&<Z)k(vgK{2Kkwj&&TQ#QMo%aBc?q;z<JBuTSq%6rEiKIlB7((YMFrfP
zL{cXYy8xO1xyJYy76LGGe|2DWCc?E*m&Nr&AOuL$#0p3~6!-x&ObAthBD*b0OG_KC
z^p1~@XZDmrr~cK`l@44OdZAfhvUq;(UqlJ1-h-h#x-G}l+Js_euQo`^RBS-IVYasO
z9%Lb0cXXiXN$S<zz_(D7B^WAVHV=Iu?M?!>eYllaF5WG3FxAhDMBUXruTv(Z`;;{_
zR2v(mO}4eYr&sA)2jf2_mS_n~kMwx#CwIv6bQLo<OW>7=()1J#+|bP$Itu!PLxjs_
z(_eleq<_VN?3-1oaL*eqceN(q(EIn_9{~3E?|oB*AIIUml8B$2TZZb?TLFnE^FJ)Z
z)pn*G7iVXCn$5BC@j&D#Sm4L@&Q4(d@Ebs=5Rs6$)0YfD*U^ymBfkRB3yLzWI9KAR
zf0Zcm$6`jpI0mxf8?T`}?L`j;dgj5MpHlgw;CYZmjB~ZHwa$)r$-!&3B4sHr){^sG
zyG{U79#gLeTf@t<fGG;+fJQpMN=7g`Xrp*fh`)dyx?gL`#672LUoa3%l=DlMCi+@9
zmL4)8dWUn?IN>g>f!hb6<A>}s!)uZgTU+T;9OJ?6{+3&~lBk%dN&Rxu-h89dsm+V4
zP(FZIF1E0YSFziH@YFA9t7`C_{;H>kF;Tqzc2XriY{J$myZ4J=+q+tN<xchA+xDU!
z5P43+w)gjip~5@8{r!&8kJSQx3q1A-R(+2po*A#+T2;74LIN_8|AWk!sa$}r(I+%x
z4oMg66ciMhWJy;#04zedxR8|01bwEYtQPvdPx7rs@<KVatWx+hny_YL2^ZpDhZcS4
z5{;pD=8uXpKpmJhb^333oR_qYh-~cd&lr)@an@M)AsTIzw^~QI9?Yn)bL2S4!Y#hD
zz`oF*CB}w+a2rhC)NW{UNt;mS+)2JzCCrOVVyOhSbj4xEEB+Yb>A*U2e2a4&pEOg?
z?y8G~6l<62i`7MOBC>TKOi%bcJ^i!@eGqMsInpx5y@Q~S_nJK3KVzJXA*C`A{j-xm
zp~G42a+#kIyK90vsw?6#F)@pudK@c^nh__Mm5BdR15}s@gEsmrvDF|7jWsr)iwi81
zuHNbRXm-o1jSwClPV@B}*#wH|xCiGRusxuky#fL8@X=8~q49_%*SyD2%3zs3B$MWJ
zso^+o_k^ZZ_RK%R)=OTZ_#Hik0`e1NcvoY;R`<I_xmE5`5HQUmiTeDxRnFl)!}@At
zMp=1SSVKO^-TVQqewZlZ*qWEz$?80T-6@Plv)@n)wRVPLEW+z{Lthc*kfTB5b`MU~
z%*nqMy?}1IGR_H0KBfD~_UHc_Qj=Mi;-QtLLs14rE&~{|jqugf$fze;uj&9e6N;A^
ze|LM^{s%0;PPr)qENNc;=~MXKrsF*P^QY`Hub?35na*{YUYo~h-*z>sV4QW2zJqZJ
zd(z`D{w+%g6MyQ46ql=nO|Bn0Z@nUOA^J3kzclD%1@e>?g4KHYkN07%V+^&o7j|P}
zaj|JuW`_Hm^?a+Mv2U=6;%Da1{-@F+8OWYE!XS4H@(5PIq01L#=v-uu29Dr3%Z*VO
zIsKX^7<`L<C?pOVW=$4kQibzl3X16bdpiCPRaYGr)!KazsS@f{(gFiPS|kK1^<trb
z$N<tQ-HpU3f`N*P2vP$`Nq3hZB1j`SASof;J^c1z!2A8q^W5+G{?PH9H}<>sT5InY
zDM5M^Fk&-mN*`)5K6^l{5eD*+k%1vYAG~BeU0rI%dvY=|2K@6II_7*)MvREPzd!$N
zIk@@jS2*R@lvY#k5dhv92NlAV>%LAp7S`!7r@AB`l24*j8r^Dt;O($xQAigt+rLFu
zFiX*EwP`434;JYXyw%~@gD`JlDG7_>XH(m#CBB!xe02q^iDz;(R0^dNOT#tfyLgiX
zwd8)4Fj*!jMW^|3(&Q`J&U;(S8P^4zz)49A>Mx$A4)FG23?zoTGCqGb?78Ys35~%&
zLW6_nKxuchwbi3S0&cODmX@+4gqrc9DODVO<2u*LmVMyH`cH!4b_$tx;Zb8dOeRUS
z6|XS`7e8=j<QcF|Dt(k;|Mun}|7}TY|4j$)q}%6sKD0cfr?Ta2(0JzkxYm0_!#GJu
zSW8ZuHJR>xx0~y|zHh%1CiA!vL2I6qU-k3H$M(2t*d&#PNx<q8NlV48*mPcZ)+*uY
z!XMpm;x8pGI3#tS|5*Soni?8U)(tH0(LW9y7J^c-WN^knVSKN-a1T@>_I7jtnuYEN
ztU%Pf7`VkKOIapoXzk?aNL3wiG3oVPiU_$lePW;<2OZ?ft;i<hJh<2;M_cc0E$lkw
zurJ-}EQ3B1j=W0-(_5S3=eqnQm(N`M=|^_oJX>fbcr#mVGot=z>g@pcj6L2W$M8Q=
z8r0hufBotf=2_MtX#3`_B<x)$#)P6Uy>zArTJKhGvT$Bx7vV7u4G(X7aXnDHx1}hS
z6G00eU=gV<#Qzz&Hu(T4Q)k_V7cV?p*>6&~YaEeQpiX12`aIXLvEeqFoJ=LHcIR;7
z9+QAqHIt;Jc?%6QJaJkZ7cMhfeMtN@?>Idc?sEL$+(Zc9M840gRX`*-8sI4#iFLVE
z-C*M5dB*MoND{gU*GO0~NI_wtUEPEE>V-PH)*uq(S<oOb6Q|kQd%I%1w1BX&1dU#c
zOFz10EZ)yi_=xg~k)B?;-g>H9@`JL{(D6XzND=LzK7IHjbq@6fw~HKw`P~mo93N(X
zj(F?0eE(=#e=6<vKaUOc$EDt01#AUB*pkC=L9EU!f%MIp`7l^}hZ1m4y^0%#ui5#Y
zAwj<Hm@pVgGoUEMJng7T<@;MP)~O6S3FOg}iHV7gq_^>_lK8UHuW1)w6U5eMLpJWL
zZ#Lqke~z@)NffVkZ?@q3DDo#_ou=5f0<>R!nadp+?fo#Z#85@#5&9;h=ijF$|4^jn
z&t7ZR81C=ajYpI|E4i7IK<fALxGV)LQWipd4K~f5L#Gc|>g%6Ax|m?JggW&RleAEp
zH<=zc5)gZ+F%;vCp~tGSdGS5FHA5HP-EAk4E7|^obK(Ni?=iTuczwb_``5FD?NLCA
zj#ld3b(+erd=3YnhmFm7^XaK6u{sCShwkp17>m)YE<2A$XAtBc5>{Bbwpq<G$)#Cq
zGW1wbjI&RjJ-T-qs2+=e)>aEsQ_hD|!^3Cyzh*u&7+6-km@IX9zOp;?Vap=%T<+5x
zcPwnP%*}+}qCa@~_$D_tHnKlxp^03!U7h>4z5~gne+}aa?5&<Z4?hfoW7t}%gOppU
z<6G*b&HHp7>FWJ<-5OuINAe_=agkNaIA+@)+Q~nPYev?iiJ!C*2-hlnP-a&ttGaXN
z&g#dHANi{~Cmq8$L(FVGsbMSavi81f(?+nlU);cp!*pM5_0U!6KhKjf=hcpbRwwAJ
zVNUV@S`*S_2z3wx6oL&r#K;yK;O3SzdRX1{I4BOAU9W-GqPPDPC5rT2*qNF3Ua@Yo
znMBDBJ3BiquK_@nfi&-*h9CVgEZJ^!l=yZ?35U(ysNswH)cm5NqBfO!=W8`#FrZCd
z82tAtPShK_7AJZ|8o?R`&;S`p?%kBKeEwkc!8axfMG({nS?}wz9#53)N<ipTe#Vm?
zG_)fQFH#f@a+H<ekw^;FNQGy1A0#Bw^YV<r$B|P|@Ta}4EyMebWLRyj%KlR{;H~%<
zmK1Qtb6)D%NK1!GKTGnvo0Q+=U*Dl@?9T%yS7AZHkz)rh5!WYzWmMp1sBkaV@+)*p
zLcq#u1dOz!v-8SO=;Y+&o28rTSc>4o6o?KJDvx8|`ukw7tguV11OUI$<LwT{KR}>n
za49D}HgvgDk2yI<*BibLeXxv&)v+>AQdOco+Fb}zE|2js8WPcV`HdB@f+QUgL(2#%
zh$DQiw_Mhuly1W$TTQ-P8p35K<o2Ia9gDRNRMG6;!GB1fZ<Oh8Q<4vf2wiAcSU%Ve
z_&Yz(G|bIqOioStG|IbXLXybnb>#{Ca6=>o6S@diZFAvocv|Y}UiK4m-p^BJ%f!0#
z?ap@rH0cr)Plj(0K7M5Obag$F0~THjPfw|1Il$d4LA6-dw{Mho!3eg2SRN`)``FOQ
zNu?EQZensSDgGl4cfiYtHUUJaq)zj$y1G|8Q&uJ`oA}O%gtbon4;<lv6mF;;Y>=iZ
zDK!-j=d|pPErStwy{p?_|B3S`9XpwBZf52nSdN5Pa}+-hJuKD|K3I~Mx3|jFI*CDN
zjP>IqqL%@d>~LyoYI3WoL?<l%3O7SY1gek4$q!$u7=){-QYqf7nvQ~h_8$Cs>_3Os
zHLI$QkmEu_>E2zoaeT>%KwTpPD3s-Yf?)Di-XAese&;UpcQrIy=0ba|`=6Se4~^a&
z7Iqkcwm@2`%L_VS_T)D0?(Y7%@xTf~ROn$Yz}fuIsH9;jM}M7Z=+hC=KI`P^*$ZY~
zF>h>reSOA^U;QgSf0`WTbGrk6-UQAUL8p(k77zR&zFb|j<#Fu(^-CGysMQ}HzWTA9
ze3w)`gOlBgKafLNVS~9XKD4sZ0k7;6E@hrZ4DtxVckW{;ja@JVx6TsCoN=`dlA^pK
z$8Yh0ze|A}i?RsS*#xTPKc2}9I>00R37LFnp{}MzwWqeB;i<9?tV>=e%MRsyO<1bv
z<9rk9Xb5mQeD)@60k8`DC@*&c-DDS>UhZP~nhwFzkg&qedZ#p}EJA?=|Lcs);*Y6C
zSKY13N^fv~sS2bmfmr<hI|cf4P-PzVqB3d<yx?}Pu3hzIo`kgJiHn?^+!YiO_}AGb
zPy{hZ?6*D-hNv=DQfXA5Fn$xl<#Lo0p}i#6>e+nojUU;dYw-!n)+}Ua1ZNZrdQzsk
zLA}bc0`oJ_)0^Gh8aY-l?%>z!{_`incRoBMB*cc$a&L3buI_Q>^O`&j2{15FW7qg-
zy0i1XF-hzro6OFvkdUMLXf#3}tW%_NqW8l(jFy(x+Su5b0?Cd22M$ye84C0=pMXo?
z3pR?Q1DZbek|Ra22Jq)kpJ^Wv8+Q+j`!WkV(9_wO;}{DI9!MT#-uPD2e27_pH^bfR
zxjc6`z(}QG*gM^fa`6tnzP>5j9^+%L!Ky^vS|=hbY=1jw_{_HMMUUO4f!Hjwo7p~;
z9Ea1gv~(IcGbOQh6P++F-yeOjd(fxMcYM+HWbG#ewAH=7^g>pjL)5VJzLoq=pBZ%2
zhC0lJg-XZ#MHTA2|8!e_f{@TBN{&T;yV;Zx$MyTuml>!4Etk&8%8J&6LVj1*;IK~^
zp*9wdodGYCwSzhB)T;!FCM|MXuhZRv&jl#825HAkD5*5T<fa{iDCu9OB85tUVfZFx
zH7_$0TKzf%A*Djv+0n7BS>N5YS62SyUUKx!fe>O_RZC_N4z7z0fx;Pl^|4rWRn?iN
zPoGATHUh#FcFG3>m+gE+@L)96K}3gxR2p3)(Stqa{l1i6Ad$<+1K(3h%a{R~4&bZ2
zyhhVtetx(zg%|dePk86f8Heye%_`TAL4VO2_H}>JT7H%Myga58?DJtB78Z4I+&j$M
zoD!sbG@y4KLFS00!>8GlZv{4Gg=n(zC=Enjo8PvbEO0!w3P5m{qsIb)l@)xJ<^_zt
zDw{s~HSo-o|0GRnGFDA&eGz#Aw8`aY3RQvLv3Dbox&%Yw1|Tbr>lDeZ-$(QaU1G4j
zM_FM>$rPNL$D>*WAS89pZ-bplf0Es>UnUFZ{wjk`a3&OIWX`Dal--JXr{XYwD`o)F
zB6^xRSn#WrFY_&R5Ja4)$-GznCH%|E+}t@Exg;vO@3eL{0()Nog8)f#|7JI2z5MaO
zpE2y|+<tL*^+PWz^^8eA^ojtB4|z($#31andn?yZM!-~Hw$9hNKs630Ii39M7%hTr
zCmvhu$%Mld5?2F@pdbOL$=Q`WZF;Pwl~sl1&ho)BHcmP^EKh_Efo9eo^=)(0JsY83
zhjQ=ofhvXl#Zt7lRv~T8B#!#K1M|j>M^#GWkEKlclVnI;yy!ex)FFHuZ$iOJ`D5oz
zwVKWB-UVlhOGqrjXvz5=F@$?F9)g#x63XyQY%g5;_191(n!c%WY~dD^OsG`RoJf5%
zySSLWyC(}3l9iuMfrRT&sn?Xa**-UCD_oTix+#OSrMdZ&=Z!`$BFT`0#P5{x>eg82
zqs3}-g%m<{J!c?(e6idHN~jzi9O&2eFWlN$YBTkkS|Imh5L7I}o02GhR>}}<0Cgmg
z($mf3@|nK|f<t@qK_VZEtpYP6_&kaj7Elh$Z+ubg6B=63XZq{pWb$W4m&Dc#2wQ1<
zAMt`f_Ek;5Ne{?ma^_+fSsjB6DZ;-Kmg&e}#8|cNxs-$W$HcHL{%9*<TB;5&%+F8%
z;!gZUWJZRQ!54sPHuErdNZo^YWGM6p1Gl5taqt5I+SkPah&=e_vD8>PxAotXD1pBb
zbHE(1MpF$Flyx5X5?)bJ!QFR3LShnkX(v@gN{j&lIh80U=0ii{x;x=vVczR{>7)Ll
zb&aIld>^-Hs!T5%*xD5^!<qjc;;qht0Z)k@!f}i8yB0mR`RUZcf)WWUK(jeDOw0J<
zORe2?`HRE}6cW(kf=ba08e+-)2qQ2Ia0a{pTcY7QFt4s&d{GA#N^B1z$Q24!G!4xl
zNh6g8i<%|m)~U(Ks{sK4D@q(sFI~7W2q%UGIQbzlrRHDk6h;}=?Z^2tSjpf_vo0Ox
zDTIYj!FqG}(k8@4Tu8_~1ZcV3EDBX)vTG}QV8Dsdxv5WBv;Q4t?*9Gzv#<lHgfCHG
zp$xy=lsTKM<qP2ZBhpXp#up3DksJJXewAlkOm8xNVo_&TUt7CCNhSf%1$G&%aC=<6
zx2YcL2J|6<ilK)ZaVJ?*sidJC3y|)SB|aV=@AWH@2d`Da%6s`@=go^Q1Sgv3;&s>8
z*1DjHTu`R?rAwJ$W8q@(jf~1)Vw(@^UxoEz?WVDJY%THh$ML^28=6I>uy-qd!-62{
z{fN>J7aY6;u@GmK7nKA4Rdo+qpgDlgBpjGd_V&>U!@8FDF!hTY022CsG!m$h8E#T(
zG$wz=@bV@*B{Jwh%Bic6WC06RPF{Wz3jWP=)sj2lPZA%k+QC8n9BUW>gOlNqzohlq
z5X+w=McI>)_hE4^cTt!fPNXmCXnpi?<Em@QKS{Yi)M2R8v{D&!fE22ToLz8s<Idgv
zRlXSI#LpC}L2>8`F(rvrXn<fNKP;r3IF$)WX5G_2;V`1uk?n=|B$`V@@Oxcv2uQK8
z=bhc`?cYm?NJv-!Cn$8}Rin202qqD;8@>X;umZhPEPM|74U1t&Mi&+Ym5}C=&CSgT
zm(K2P8tRkKb!-{X=GE<$hdNbk-jBngEZ0$`$ATm-Bn^-o${92SjO**oveh~x@|6?M
z|BV-V5OwoZC|G%vjvXB4@^`tDTU2BYiDUol+L|jG6la9v5%TRiuqp?Q#Zz$TA#dX0
zR8idzE)(S5A`Wyg*f!9#G0}Wyko#mz9_d5Oa{|xs;!jd@$bGr3HSXVU(lCn0mgMI%
z`_(aAG=2SESqH&hRzk}#KGkq-WM*go&Z4?TkNwwcQ1LSzC6v3`ySkdfhU?GI%eeO6
zugBOI_E@LRydFLmvVCx8p{WBf3s)rJ<SwAbSI>Ju1B%cn&QY6_XHZUZr`q5hOE>4n
zr*#O1?WWlom<y1<b>?s)V7f9>nqX$y8F6Qou1Uw7uv#OZ{2Gl)yWFg-p;pq{O0(j8
zVbq4N5AUwH=%GDdVb68yEFbM%xyEP7?lqKF+CDDYV=q_Y5Tq5Wmb}9#B1P0dc6M_$
zg0E}@Q&-e7_C&N6O1Wo#!gUUx*Ye}36l{}dYwbvpH`~;y2b;N-RUw3yiCNHNx#*|}
zaAia`{dvH~yro^ch@!+eU*>rUP>nP40-nr{bbz<~@=HstAc#ul8;(@|k?K;0f-$Tv
zI??=B1Uc##^Bu=(7{QVgn~@JZW6cmRFYj7a)pdxxKoNOBND75YrA1PPhYxl}qD;0C
z94j6IwZPsesMWD6@qs!%H9E?nBw7ko5`;I2ItN1E9;q1<NFU6aN&nh>qKDM6-kxWa
zsFsI@&Rn_{W81pMB^e$bo-;phXC`<=H>MU&mL~Y~+fP}cy^9Na<g4|KLOytv-`K^a
zb9!<T${0Aq$MdfUuy^^63^80MMP|r(%24R|0^_E4z<jZ~ZL_AP#;htFhr5J9UXTr{
zC4WO8z@tx@Z*$bwZqh1gzwA78i}UdCREo-B_P($SO06^8UjoCjQ$No%;9?o@19Czj
zAH+LhBThmxS-u2`?8P49Zy|k#-hYOghK3A+MnXeEsQvt1>iDfbQ%M)7{GK0L>e4ui
z#$#e4{i!CVI5qp!H!CYEDdxS5R1^Vqw8>>Z39|IqXsy(z4;S$}Q-}@Z7ZzqvbL*6r
z!2zh^Prc90kll-NK2*|Z5c3q6W_I;}ufaVcs?jDc>U=i6@Sf`0+6`)0_@GW8vo6YA
zW<46e@(Cl%`CmBdpPfBld$-Lr+q%~@djdLrK<*~kI)+N#MZ*wtE&}en<9njQ(USLl
z4G3LCK4hUNXW%zX7#@}cBnOhTB;E`<VCWPN%t4N>?JnmT#h;|GB5Q|-hs#fW%cAJ;
zf738L{2<Ry2K$~uQRkWP-%Wj*eZM8-6s`p-)M+SE2TZJ`dhS!3HlQZ-q}SBcG{M}_
zF#L3h^83y}YuzsF*}n`rVw<_}Rf-76f%uI+=hqr&T}WKWgodS%M)rScYg5*!{T_7<
zP#ZBcy(pJTrwx*2aa+gt@)}DgW#mH)KKO<cIez?jJ_H95A)(){P_#($yxz~tV&|W7
zJ_kFh%~((i@9E|?k)3uvKOdTM@ZsUO3nuI7=xD4^IQI-K6a&5xjeh~<Qmd_eYC?lB
zMPZaR5Ni5^GBYoD+SvRP-d<J!b9?Y^wwlo2U#||0mLF!%oO!K=m4Oe2Bq0w{5rE4)
z%Hn>YL2Djl7G9$U4%B(ad!PR$+0Q-oboL5o;12?*l6<_pri~MD+F-7U&?F4jFePW~
z9JtuP*ws4_dxh+pLVrWoB*?b7nX)o64xN>RZ^BH9n{CD1l15vAphhw%;Wa0To$>ot
zXcAxbnW6*gRXUVEcEbno^GixdfYubwsP#!Xky+nx=jHjhYwss0t^!sqEGnW|M`zkU
zfshG$L5@)G=S`?BwXyjWGaq%^{BO>6D+!^ShCIz-8i;rMY3MVa#d-E9ITXp<8X5jE
zkU)A6-MQOO(fccrGiUNzV1`>+C>}yS4y@n@@!!C_6eol=)YZ9UBj7TrQ5N~;BKKGt
zj)-mWa+*ylt+h{;tWTBF39=@3d`?kO(o;!h!KZ@|$;#ci6aSvZpWDa1t^F9-hoRG0
zVzZx=q~!kj@UiY#@S@TV3vQhYroQ8X>bpCBpm$b1LLJ{^6ZN3Hgv$^d<UGuR2OjP-
z+IioZ#~_9aejGE+R_l(5lC*sA;B3f{5;cDh(76R+VaH`HAzS?R&1ZR&pe@NrPKxyH
zBb5eB^3%XQMV}%9px=xt`rD&@eXPggsiYy=LbE$G$XvPK^Q3`xcUJqT1C^1Qucp6Y
z%KNo=%Ira)NnMr0T*`$L%a<N|$dv3u54e~}$gvRKzB3=|JL}a4&N2LvV|;vk>lY&c
z^U_w`mXq_55rCPP6{M_2h>zC4x%gJipo*fBk~Y0cekoDtwKwHk83pN$HNbyP#KOwz
z=_KTa*0(Kn&!7{vWBGYYnJ3vxI>9crdh;YR-P1>Dkl9mtbCcV9c!VdvfMMpH%&cSm
z8*w=pd<&@U{DEx2cWw;9!i4?jZGk}&lsG*c9E9Lnd*JnbPK;dq3_EJ41nu0B(QlIN
zvsy9Mtpu*l1xTkm`$T-OKS^)<WoN+3^I_20{R$;Dk{i@?#lz=#Zd-}rl;>@LdIH*D
z2nHFBOY4_}NRUftnEm2NAy;Q2m4-Qp{+b}g8|%rPwK>Q6JP~sqa_GQYY`~N-h2Psd
z3L<pMi`i=A(u7s+ZdgY6#=taP2|)mbvDEV)dMuZ3VsLQh7APd)6z<Jq3fC9^!xT}i
zJYHTJ0bc^_F|`-s7F8<GkWHk0`k%v}oJZ+rae_b8;XH;&1idB3fs=xP-@8sZA_~BQ
z`gFxt4wQ#&ASyw(JYTNczx5@RR-?@<C@_UXwr$LwQsv7Nlr2(vu6YmlUjRe(1<8*g
z3$L!7&e|*}D$2?tRY=Rr8-@O9nAz^n1E>U3Iw3E>5}b<sOV5gw@snd=>D;)flDE=9
zb-N!26f)T4j#Cy__jP0`o@M6718xOE!P3=rt=h~ufcAejEkK1jZ67>pv|EqaOh5!x
zTiHKO)A)@*bZ`%)enoxyGqe_9+99SuNx3Q=d8Bb^DaTdsX&fq^HaEXZKsq-zid>D1
zHZ#F>6_1?xFD-f3HJJnP(miST@bU=P8aE%GdcKBZz%7~ia4qT+09%w6;}{!m65R#i
z#Id@Ya|PgHR&twmH8wATWOj42Smh``W~<2`(i7qH=l@Y|2fp+PmGrC|LVTR}wVGn)
z{ZpEZM|G2?1|dawIChe1V+E)(ZEfuX^EewegOo!D?Lz(%3^7vmi|HDcZ>&hpp5M5~
zL08m;1*D&g&wh|O=D(S4!0W!de~W^krNhuHG&p47TZ4o}L{c(Elfv6G>-$}LY!VBp
ztw|*-F61Z$(kDa#2#ZNVUO5kpHy5)JSxa5d&q{MtTSI>N1qJ`5Knbm;IX$M?SMK7_
zOl343KUuI58q09ukCsK5VrTvnn9K?VlD%lt#O}Vfsu;eu1LTI7M-aiN0Xw_7nL{ln
z9K7C}N0i#f7p=?tOm~%%m8ez}9GDANXc&b~|I~<u@lG7bZ+~26Y-aYu!rWW|<u0#n
zWAoGOlQzfy^d#)b0q*=M8$YMtQ7#0$A0bn5;GsHiVl~P7A1>7@2V|$It!;Lp*2pwv
zerV_`q#heE^<XYKQ1~=7f#R)=B`~=}`sNci%@a86F;wl)L(B`pxH-Vk{YhbzyUF*A
z;&vLCtjyI7M9CO$t=)-Z$MS$=FD)ntuCp^GG0-44iIjHbcqs>HcjgG1O=I6iVR*+_
zMW(1QSU6nDU!$u$D{G<41x}d$j)fikh497VC)EmjmVhMTpyRH$f^_&vRrP#VKOFFy
zF^c=_g5aQw9LOJ*y85T;LiRqy`NR$>>ZQ?BW#R1s91?fFH@$!<3CJ};VZcWmzy3{E
zDfzOaK!@<(1?PR`vfX>$c2aJjHWR2W%QNtqmfQ<ypeJ;8bSV7BH4=QctI>(`m}KAT
z+uPNph%*NZGg!^~KSRM=izzd0_#%*Q_U5VW)b2TntqD6opiK70Fq@_T`)5Qxeno#w
zPX==d*n)8gyZ4jKJ)E2v6G$rUT5Ly8O4E6vcmUavkdF3oZVZAfQlWFdpC#aHtF)*x
z5*!v*$BCHm?}nF|{aJX>5u-~Xt^j`FuC=qaJ~-9Fpd;sd0_LpZ)OWXazF|?4T>;6+
z8Vgj<7=#0~#4X1P<Q}r2NG{!N2!f7AU(9FDd<GFX1Av0|aCH@{bvQf!vA_;Z!)Al$
zAwS&b%ZefA@WG;hi)lOXLt_8MlG_RRNiArcCQO0-xg=W^AGZWi1QgHyQ0Nrcv+7!G
zxii``%~>4j+Z51j_sNqTpKgr+b8-K>k)2)396EP9#KzE&a>0}EcIf$}3(aTY-*0&R
z#Q%{{jLj~gaTur=K-v%H1HA(3Aps5JB%BEWOLdiPRi&NycC;qiTmsr_7z0Xy7=W+{
zP+L$Mlp{LIFQ|O>#oynbGkF|ndv0cf-F;WYPvN1_MOurJbYWnjNiaB3E}dXqQc$pV
zX6W#m=lvYkcQUWRdA0-GJYV8jhB#OBH!s^oFz7Uo*_W3<N7RRIZZvqY>riH&2X2!m
z@L}6ek*tTQ>7Sd8*Qt-fF<K#RWNQa27@}vz6Jtv)*mS!{_Q!IumbSL%+z{jsd2l3A
z?*S<8O@&?>_vBH+|E#WC!|Wh$0srTbQnd<3X>Cv{3BP|E!pgLR{~(Ltq23s(kRpGy
zoBo_;U&>eht)5K+Ns1Gve~8orUETg_tTQ+XghJ}rM<DQ_Pnm2%e*WE<IreoyPml@H
zGhAX6@2;?m$E`MGk*Qt;4$7I5gcVg$n_GF(lT|u$0o|fJy^5c?1te7f+07wo>daTe
z9EKJfJHLtzR7z}}SX)!G`{?N6@|kMbvg2_jAhez$Qt4`*T9@I+(g;#SEPX#Wrn6Fw
zy|^FiPm<2H4Y*k+p!Gm5ux3dEAZ2{N_Wi%ZiT5j&G)!l|WN)+Vd<cBG{A;kCd>_6l
z)PB?34$f6JG@zf%|6*Nw*-?$s7}`kz^U``04^5@GeXv6t8yY-i<$bD&W?416;YaHQ
z=ZA5^(vmPaRxf)F0{p?za}2&EN}S$QBf!7F?u;AU@we=4^_;tW@(K!tiEPQOeimB$
z9!Ld2%G~dzP5XKtSQb~;E^U~`%MQg_?NjXudv{|5V+_FI)gRphUuRS!!-1E(Bqo+2
z7dHqf0h}~X@@2gNZE@3XJ*fa%-DpP*UMg%uz!{EjYildl$B-TY#AgZAPe~UbOEtq!
z{w6`R$oA7G17j1#`CItl@O@R)G+<`atel+M;g%SK1~$708{QT)&)+HkiH;`IkWJh&
z*i7{&u>sa8!fidZrR5$}rPP#5F1q&oM+wN<ZqmQv%|Tl9WSRzKM8(8j(AT?{)Ic!K
z-Yf9C<<@@_DSCe6G|;2E`tI(UT>9lDKs`erDYS901WlqId|B`5-QA~k3vh54i$*Ba
z$XUShx$lhwBLQT)3C<q2wgb(p4MA&>8Q?m&PmV=#(%om*ABAt+3Ir-3^$XCKoB`$j
zu(gkfkE_C8GBMFe#RyM2hWyoqogUcQ3UuSb!+l(2c}%$jf20q%2&3y8x>yzML39q1
zu%b&^Z-qUF#2@YE_XqYJt>2}v*U;*i=4q83Xw=P|A*R`;2=SRQOiN4CsSb^8*Dy-5
zmlP3UJS*Kw$t}Wu>i{aU5?5XND;1B>!s22J&gVz>e0xU|q?wCftgfq+>=IiB(+D}X
zYf_l(Z)$h;qd$$EKLqgp*`Gh(w|D>U?haLZk`JSX5mBL!Xr#Pd746G1s1Z9g?+5-I
z;<3b;N@!QxjGD|la!pX-HF&4)u>iv=OWD>bov)Ux$i+x}-7;SwclsqYCxYtC;G8x<
zr2<zTw__2?I;bJw>Ob2ZS8kr}5#0E6q64J>z<FB;S+O4w6L#KLzEmY#hI-xPPXOSz
zA8eq2uyCx*^WYE~KadOZ00-?`2DQXYcaT8va1O0?@DZ(p1S{>JfW;R5m8)L!VF<F9
zgcU~logOtmtp}`DXe)e^Y2m{ULnu(~h6)ep!6PMl-Rlp?x-}D~|Ebx)natiaj%zhF
zd8?n}JPR~eH>6eS=3Chy$-Hj8a)X8aUmot)1~#Vwz>#Co_0jx-@$Lb0+9#0mhKr*~
z#gx3fd?tyFK)fUT!@C=uFS*Ck>`@e?50HE*RF6Q`;p4IaW=MuZU`pyqT+1K6qKRWi
zRaZGQW4orHF*E1IvJnx-DcvP0Dw+=QCJmfmK#f6*rwX3%SSsoK%3YK=;|(<Xeazgo
zPyHB@8_?tfY#taADm?t9;K5o_>3x{X(=qeGx&(h#$clDW;GCh2Og{^T1pa-@3ebj5
zXfFm}X^(xPLiORPKYuv0kd`vFzwo~=#`vusq+bU#1ynvlhjzC(2B8|zy4y8kji-PK
zEHu(J{pnr#3Z3SPMwHll`QDy?qQy41lh8q$q`|um3(U#cdDJHiw?AzsGWErH_W?Un
zX;J6&O<Ml5lIx*~rl=|acRbIsoXK`|Vh&pyOf6*K{&%N;{rcrkhSKjZf`D}Xp|ZdE
zFQ9ck2b7O!4Rp|YY6+WgqP@g2H>6H8mZ$77?A}1Cr~8#}>_J$gwk;{5t2I(l7=9CK
zeyA#Qg!7*>aNG`q1tl5wg`_g_Vslsc?DJIyR*vI*NQV-2T3#~B>)UkPwuI~)z#p1;
z{2IBnHN-_pg1ouD&A;2u{kDW;MN54WZGsIPi?Eaw3nw!69*~N!dnO#RFvIAB#v)qZ
zLuT1s{+s7(Kjq(+#XqhFkrvVrzpA_iN%7e2ES3n^-lvjA3*=Q}Rby<f3W1X^LvYj$
zsBt)}bg^O6Z||W0^!CFyxwO>Q%%B4$S&zb@;X_OLHz-z^(E!i-;fU&PqtKtVYMyr?
zW!RCBzAHu;ftTdy1Q_^z)(s+#-TG~+PLBnR>JB~j=PB-}|8}Ax<UYe^AUO<eum?yq
zH8H_Wy#UH#9^6Mf6Rq|H?GLgUOy=O;FN(hOP9F~p(?$Y?Dz`TmB(n1R6)7UnvRl^r
zTm%GVns>W+>lySaRSMAP4+DM=bjI8TAcKi2Tl1gcFOWlWBHqx_=jR>WlmGMEca^7v
z_hUc7{%7}twGVX|lq%o&Z|v;589hDB97twCILPDg8M1iV+tUs6f`T$N#cOWX{|P-w
z-l5RDfye`&3QV!zcQZnF4>vcr0a-r~plJfbplJ1WckehIkfJQp>_0&4W>!(n*Fv^X
z`MTOImM`E|r-o5tt1ZAe-PiYc%ECWVQXs5E0qMQ!fN+X^(;vowa{9$e@U;O2JF&8I
zF`VHwkfQ$sT=(apMg+Cw4}c88D_QwLD@=}E{bycb;W(OLd(=Gw{&j~5h7<3wN^v}0
ziZSMP3PlhRwcJ~5b{v~8up8q%N?EtF8noUIp9QB<cF_4LTbmNNIhKDSo=C-nlqyj~
zSV!31R|SpWGVvU-;SbH(qLN561kDn<lyM=z6@ukA1X!h$5fDUEFFQc`K{f=2X6e6_
zPeS{6g7paouCsO@Ad4#BFciR<z|etNB(*|t&mYM9?@*s`aN|@GBeoqv*FS*z8NaUx
za08CQRA6;k0=JJOv-rBf%rVLz;P366=S1m&9e@El1vp{qV-78Pl?L?!w`~(zRdVrl
z!+em<ZGxAUVeYwIq>as){}AYYXBm=+A!wm@!#zFw)V1Oa_<s%H{B_Mnprnw0XK<Vu
z(bQ7rxd}x?Qn3775zM29i_2=YOYj!Wo<-TMC;IzH|1M)qriJj(P_PD2mK@<oTtmYE
z2aXHgKv%)t&hBu7{+k^wqfZ9JDRcG9;lL=MsrL(M_&7Q0ql+6ryXK*ro4(Qg2&wI?
z8yTX5kg&o@Wh+=#w^;00&DsH=DPC~Oe-Q12z6q8l@QeYsQ_(uUn3mdOdExKMmdjG(
z39P-}1>F#XrZrSmq2bm-XhP_S3E_e^{qeuNraza>IJi0_I^dpQKpX9^+gaD<=H_lz
z;@tjvu2xO~n^D+Pe?larj=Smb$R!MkF<6;618V%U8oqtI2KmT#dP;<aZ0#dz`2Nx#
z6O)tqz=+9OY9;CmDoBcp+e5p5a3KQi(%(HkZbn(PGss$@YFH36Js&<i>Qu~W6JGCf
z)-D)^S@e<-NOZOCoEwL^kl#dUXL~RdZQWC{H_tSF%E-5Q2+c6E5R{Gr1MGx~wuS7T
zw$;|%%z8%VN5jptb{`3IbBex<n?$y;b6`L(9(gaxGJGCdx(x_&_#P$My;vezWU)x{
z;>ENpk$tcrmh%%Xqn_HNjBT4D`o7q}_q8_*U=K>bT%)3*g&2?VOL{Eo>jE8KTV34_
z6hBC#@jFx<%{;hHCLY4rP67ld2g7hUo7a$aEkLSE5)uwn1h~22$q0PFlHy-55TVNL
zv#vp%c3Z%YdH4caC*Te_s%|N%^q6=&;VqB7Ac9a5NBjCo2=y;8SSUKG=*#UiH}$^F
zv~l9Z37<bw0A2~8Z69+2OPAaYl}-hLzYwgs+dx3xq*@~u>^?Vm%EZFtg78U7obtoG
zfJrnpXwKQZg}vfJjztm7^F;LlRuSfnZ(l4sw0Q$J34{^=&$ac?I41+7#57pk`smQW
zGxH8^{K@Gt7EA)wkwFKJ;Z6cTH~qaFE|Rhv=HT?frT7rNV<fEG0Bn&Z*#oQzccms!
z$50dq?=Td)5ur4(?gD9!>FB!KolNJ;x{CMcv9=l-3(nToeRQN<&>p}$A`cPhC9Q2j
zb^c?d(hxb63?)+ONfo6gAgl9!WDYtZ3ycRzdKVUo1dJcO)OXm~hghe}^Y0m`Rxa`=
zEr9$wfg(q{52#l$9li^C*Hd62$2>|7|67*&1d^h-N9pmmQz&b}U+hRcT03ok*m?NS
z47dP<`1G;GE9NJ>i=%hDk~acoLh(3-#-^sXJiNRQszB)&7N<v=NxyHH-K9VeSQ1ur
z6l@Kxgpj2K<h`e)=3RZ5x7n2mFr8h4E_lRe`W@IF=3qE=Utds0K>L9jDd1u1?~y>)
zVp?4NQ%WVVJs|HB>#35hZ(5!wr>p5R6?#ee%@!ybH7whD5hqe<_wKS?hw@(};C#~y
zQ!Qk~oEXRgBz$!}pd5uU@sHzfJVX8mwvD4iRnf-5m$HzGq#D$Ird8l(GJrpZZJb#J
z!41^0avP}Y{rj#cyjZ%KhC*1$r5MF?=Dj^V5D2o<?)kC+>M4Kx{UQt1Uz+*(X7W5e
z*2ntK=VY)1vUwSc03{n9-#)&b#G+q6!@B~<-dQ0`@&<^Mv2k&k3_9R~fF1`@qL)cn
zL4IA~CdY24ViXao6dWne&?UjcwifurTf=Lxk?Bc;;Rb?rIOHm1zXtANV&{{Sj+bh0
znucd|n)|pz+A8A*EPm%|jRx{PP6V*mUw20fr?hTF;+JWV;!*rk1t=v}F&_>vM>n@)
z_2AOm+aPp=HdBSnfU*XCVR*D|XR84({?4U_ADn8UsBR4l=8u1VZCcQI@L2WhryOw&
zWdWL(C<C3zFG(u~7oWVG92!L^>mzSZfv}Gfs0j$T=<{Jcs-h(B_VepGKo*9+=ej4r
zJFXFnwhGOt^sUapcXaIa8+0>Hdb1yqK0(5|eQq>j*7<sxA(I*c1I8aZN;SAg1B1K+
zSZFTY4cxA~z;|%h0yTj?SjHg?2}jR<yWom)@oMq7Y&D*^nh_v~B<r85@m>TAYy^tO
zUcR}=>X;v#n~|A$cnK09MzOGZ{}BL$Jzu{*`AqfZr>T(gcj7N1&L)v-@@k*OYwspd
zbU@H^DAZ)+LY^mtc|y<Rz0|BN^F>#rm9|I_@u$Sac6CjC-O6(vuiGo{F?Sfi!3Ypl
z&;(i#YA6#B8Q`CiKHM$cWgwmRfrTG$DR?CIVB^rxkpF5ukZa}OS2EhW@pTh*p}!!Q
z|7L{^EJEac-|aWg{4&|r_Te6LH*D$L!os6VkYO4%aBZMwG0bM%wne<o{{(*L3ua_c
z8nFb#+x#C;6iPjJ#x8_vulFVpFeSi^Sk$>pfe(SHz_-<N08kZ^^!6@%Z|^NTio}K}
zm#Q8ay=ygLAZ-pM1AgG53H!vLGs_14L&*7dS%)HW4ALBGkkr=#RQ|IOz|EJ2K?)@I
z$SMXiMw^b-qllqxX09w`H*<23)tEi>P8!f~4#+d%@|0f_=JcVFgYLh_@Sf+8_cRGt
zQ7=-J@n0Nvmm&ga1GUh21|3mLM@QjW6=2i5fZtpCS8U{SexvH_(<N=7cTnt)yrfHh
z^L$XV2e?Tei{xkN8fIxXwhg7XVO>9RU}DY1Tl|kCpM(IdR;~}V&qYN)W2M0M2$%--
z;M(R{Wvkire*(r@?=qyt7l;WyTZ$z!w@YDWCJe?Df$%HfR*ZRBXezY&-cR>Gc2A|s
zIJM;cnn6Lz2-V?mh)=rUpiV)pNZ9U<4rc-OBlu@%UWG;<{tUssIu%55?+uA`=*v(7
zZPOG;;_;Iu!f9=$M>lLY;U>Xsv<=jfi~Go>-hG&0tuEZwDh|I~vRo`ul1qps%zF|V
zI`xkyj=P(9E~<E<t-_aF*!-_98J=HRo~^U;Xdyt;rw*;hC8b+4EQG5op6n&Jd-rWG
zl$FK)wXrbvFJa(=RAA=NTnMVu{RN?KAzgM@s(4r$Lo1<tEe>+aUD+`@QQfV`@3$5G
z&u4G|JA-jG#oE?3s?q0Ld-$VS#&IjcuvPhV#G6{&W+%=Yd%c@+bLOd37Bm!E$HN^G
z=36+z7_P(_8J*rDOkZU+G%*=__2{5PYD0wn;Gok#$l8z6jUO|`zf0A<)fPnmT`%3*
zoW^^uTW#@ZB)$&dyVoJpA0oBtFIAm#A2%3y9C?9LFTEFCnmO&UT-dq9vf0GanOm~R
zLktbhCSdJ-&aeI1MXm>+C#JI~ZWHPQpLhcBc$h#+S2+m8;7KAQEywLpn4OJLSXE#A
zB1c&PvTiFJ39xQJbi#!m-t!H#$R}9fkoyDWzxc9jtyD#3ye2)d%Id>06UqP0&tu^e
z_xo914)N1eZAH&hwhj>b4ov)zjtn>;wZXq`IUjk>V!RO3cfG1e$uO+pYVU8x<3+2`
zY_Wo!KE!}uV~IE64l!v2n9a}b0?tfgDTcS`4-hHL`v<;!d4wkQKz~5Rb{!z-c+xis
z5l>0COHy{O%!pFxzy8}wXs(r2)vJGl1hVulsIs^XIq-mK@D+jY!fxm3q?u_pi^e*f
z{`scB#gpyz0>4Tnqx~Qud?BYd@XD1^OTqvj;Z!2>KCbaCp-t)0jou%4f;+MNZbN{c
ziUMpT``Y3BEP>W&A>rZsq2Yv|UnX4No|t&@AXND<P63f=u_c4j$C<>jeN9=IqCG9F
zL<Scx+kpiLV#*b1*cYjbEgt|>gFCCZX5yPi=gRLj@c<*e*5E*Jbv%}80zb^&r*0p|
z3fIKH1O&$C%o|4a&fIAYr8`8vy?UJkfw6;pTkA5bgr#suB$YxEAu}zFe?h#?JvO;?
zfxp&;lb^1E3}Gc!`rnNo_TTU$q?4zR9*g9JE@Ur2*tyGgFtwzUGdc0g3@DsA$G_nC
z>PJ2+9R7StR(vFNYb|xsYHP_V)B1In2CS~lCbQJfoP1Pnqgo@Lzao6=F*6*>B#IQQ
zJswR58++llAAIjdUGI~1=N`|sIM21AO-lDkGi~bWxcMk6kNJ=W%BY1N53M!Jx#{HT
z*-O2vaw|!uk7B1+*L$}-oOwNuN4*eT^VqXIzTCK+-2Oec>qTnV7Og|*lDo3?&EAmu
z>K~qr1^YFvHar%K$6S)%v@9nz1RYozb!rtAyEZMc(p3<<(fd9{sH7wZ8lHyE7A$_0
zTpRtw-X3fA9d}_Rgt#$ih-T%A@=8@G9?E>F8~zL6-tg)2q2Ewb)`jf^*Z?w-GTQ?G
z@<+-?XvH@?*R;F7{fOC2ao{>b)*odF6Rr=($zZi~K42?Vu%x6yE-DNz5O(&nXCHv3
zvG%C0-BgGtZuJ$g=hH53k%Wl`!fpS5IxUzMMOEbOByb-tEJ>|3`IYP6adlhif7(zo
z{PU;M#Vw05hea(Z!mJ-oqur@=y~n6wm9SijJ03S)y*^$_7&k9Xx!Rsk)w|Y~n=#(}
za7=8_Y;<$J!KBxzWIn86QS^+5QALXEg6o>bsy<<kZ)>i4q|NL*8ZskGTl%uc=OvfB
zOsnG>!sL`BTsAqj@FthGBxfJCSkaYIyW?DoH+nA@DHr2LCAY#oH>y03Eulf|*jneD
zr~K@EWqUi%)<vzWgu=G*aWRJ<rItk}w#Nsn3$6DEQ=YIQeXF~NRNm!3S@zGbSw73o
z9tZaooPAeSH>BLM?Nbx&JRxftV<2~>@)*^aI5C-1g5v=D5BM%j*9|w{l$#~HLjWq@
z1W1KmgER>aLs@xiKoaIhN(8qzsnYwmXxQu5qE}XWBom-P7?LLpRnM+2X|7J@M!pbE
z_!;#_aP@^$!rYvTwrqQB4c}~meh6=m67w~By?>`;UWmPwOsuEJ#NCxSlAXF%)aozk
zt0f;`e#%`EQ&p{E`U1C_Uvsr!NtgZurM5Z_T2ByGs-$vQHb<{_5;lz754#_5WeH2{
zWz)iyTn%H{I`MC>1EKe!d+sXd)iv%eMyVD%91p=_?9#K;)R5QhcAkV0&l9g(N;Z05
zlw8HAG#kCbL=WBJ*#TY6ZQ39jwH<lolT&eK1Z)QJQ=d$SU5mi`nP7Wj<TS)=428rK
zPYtp2{~__&%|BAQX-CzuVDuShpezNu2NZCi#ryRi!^2OwF;muPAEHv@a63(<HguK$
zymJ))9ZBQ22i%O;Exazc@=+-28MCw0JhzCD^mBX2lkNRtF8R|bZ{@j@hrDG6MqEGl
zJ(K+On2RcpqbSPL$>VLCUc>Xq&@UgfagY%$$4_7G$9?G)pnSieIqb>e9Xr>%%6E!I
zu14Fgh*Cm|n=ZEZJmJHt*-8-!5y8)l%kY#PN>NVi1PdBLq$}@66WGGWTvGF20NFSZ
zYTyagQwg0lgcXl{ti!@2yUGIlq(gGqqpm4q`rD&VlS?`hke_4r8maAe)yQhK&P8Tb
zBeEetNzThkt87PTJcn3D{O<9ORveI`2?(R)k}iHudVKYuTuJjww_mKUNyS&k@7-Wy
zS!;T7N0M%CbJ}yOIzK^j{s&E8(JQ6|#XiF{+xo(Y89$GTFTJN~v~gFIw71sUuhO$0
zU)M0i<pykpytpjbGxsPa_p=r;5YGrhNAb-38nEf`gIQn+GPC^3%F2l#)${7mD6fa6
z^)dLnP7*D<%`@^7BoES$cL2ww3&$)}vWC?Ro%J#VtMdTt6DpK!iGbep%@_fwsGyzJ
zlGK@vy(L-km<g9__@Vr40>S^l7{|fG?Dy!}m}&ME-;_k6$9>!VQxE#b@%xtZp3f3w
zI=JTWDM4y>p35!fgPs>y(l>{$il$En!@{Fk3nUMk>n+w2DQUB_XxQGm2!XAcN?O-)
zZf#8rkE_-8S*=Ge=&TurszUSdf9F{t&sEOcUuF6l6x>~~%tWZ3R@2tzi>Cu!Apx{j
z$yJs)&A66ygGTcn%XY4yCMadO^V6shlqAk&*<oLriXoNTD46TaIjcyie6QF6x#6iY
z8;p51EWfoNFExLRLTwJ?`;+SSBy`3ad#F5mR#~gr={(b)CZ{C#HBHJyuF64AX1bN?
z+$Y39zH$n@3{XlA!4}dUSuzRT0mXnipc>s{6st)k$28vE6SB83c0YX*vI%~o-B5;1
z9kcm7!1LXsRQ3D!U7FX`xD4$<cTQ@QXQBb2)i5;@HF`Y2Zm`V&dc1)5xQ7_0o$^hn
z+Gy3@Y*o)SR>X5qi2J|_VDWx5_b5W7dJpE;QfTRlZ|UCTq*KsVI`4P;+j5EC^<T>w
zy}~}Oa|@ToA1bd4X1jx{e$=9Leq`g+PAh~mz6AWF&qE$LI&aT+tN+wFB)rQX7RX$!
z0i0u=0=&U3>X1F#;tP>Fl1Wr=#_;NX^j(6&i+nIAfMNS+PPXE;FDw#3RWZ~95&Hes
zc&wK>CsIu2b&>^B|2#R968GcjLnTpmMV(;?k@8pG3?JB<IWU<y>YyYsoL?j96`)PW
z;Ci%R>Bi-NFZ}OFZ>=^&j{{dm6Uo?f3RC8SXKj&nsctin+UP%!SxQ1-vrsJ4^}0Wl
ziM&Qd!S!(1a%@B72mQB?RlQEK7CV*H5i_K+QYFZ!eGeaf<pXWVG_vio5j!A<1gch}
zNfpFskGyV?@=?0E2f=RVkoS2@|DesQq5LmFDn}(~0ED_M#2>(4JLT7Eoe+!wpALVA
z08_le%xOw%y0-69EV+vtcCBg)YdHGwyEE4?59U(eil}Pd(2d+M1NM2pgnVT5N^pUr
z_glIXicB}~)xDYw=1m^OmNcmxMen7Y(&p;$-?cyG^q$R{?{<nYd)|H|Ri!FH?=E4T
zAVYe7b^M6qE7xhay|TS`2=0_zXEwjEY+TN3P$8?)E+oaQ(b{X3+`+R_<js{9dw8v^
zo2cU+&R7jvNFLbUQf2(xE<P0!j+}+&?il&-_M%udtVyn~oj|a>BK^XGVY%oIU-GgD
z0*9llBR#};Umy)*T3cJwLH(FD&^ENONf(on(gu^1g&Z3wArFqc`ld104YjZ8H>NxX
zXJ%#|p3r^<Nki#EwN=#fXY9Ek$ZhpZd$a>Ym-4XPKu`UdZZs)?R07JcKMj`7hfNnP
zb%_a=gunLmmm&;G)xU0CI^eld(VlX_^EN@uA<43<UTWFMbIGW4mBnMF->hLg*6ihg
z(cPOyfC?_`504xC<+D~?I#wtlC3T=`>{8pZztmZe(u$$dcIV<Q#$MUfREw~!PjFOr
zPRlHNwa1t>8MT`YYiqCD7gy9bIVCQ)2#u$|Zsj3_jjrA(ZAqJd>b_^Kc+g33qIj@Z
zQ~be9L2|Dve-WY2Y&?6wg&3n;JmFHl<x)&yYo%*3;j)1Isz+w08{bFyAhh78@z{e5
z&6ZHq1uq&l$ZhiL-aM{a<KHi(2`}YPU#G%`=RqJEe~N!57Nn3q0IPhWo`%3h-~t~e
z*v4n%dt2tJgM)wv*j+lP5{E*W0tG0z1nYGr0JyCNmD07==_4Lvl8KytoS8$3InNS4
z58;J><GpB`ZCw3Cj$fD%qwHP2)4r-<CcvC@mM+z(!{I>5)B0AklDhHz^Y?o#N-`Sl
z=uN{PvJ~eeOpg|=h-O*MJcM=+2MS9X)_8H3uD3_ES*(`Q9+yfAQ!jE1i>r}HUu(d-
zHHe9%B(#`~;I@izixwVNw?|}Vd_-z9ZfjwSu)Ia+-C`Wk$W`F5Z&}w$SN&Pci7bN6
zP{e{P*86U;LCGoZf4e$5o*j-VIIy+Oi^2Y_7mR|sBI~0nh1(u`ur2064<I1MuOP-y
z3kMbFoO_jmf`d8FZjpI(KwW3$P?7aI0DE>)>FswwkP>SuWOF-5m4zl1V90TM;Pl`@
zEF&4(Y@m3k(b+$oRJu!HFNf&$5OUNlKo3-|&e!PQmh|LQ^jJ!qAN@ttiEampJ5;M&
z32~ihmc)}s64ODXhzoSz=HHCsH7GA3kIz7>{5d0@y06xZ{=LiUF1XZBKzWVP>0Sfr
zV^hGW+~I<w^Z|OW6vuPCx$q`55J+t`h4YkoCpku(&jSJ6T={&?z#~JIdky?}_}<=J
zRCM%Zq(`7pqk->f$d5_LvA|P)Z_*L@WdH&i$|jQ730&O2eUl8T8o&0^gNr>}JL10V
zlHP92#{dApl3|aGF!<HtG2_LuFt?u7cwYNFsB-ZJFmR{O9PcjB$XDM&@7@Z7Q3s>*
zK}780#YWSQ*4>?*AHi%=zaL7f_AR6T{`ON8?O13505~MEsHmtm9Ia>uYXydrJ{4bI
z|Jt#zk%c=wJ^desfA{CmK+d-<@iLt=VZ)_;_B6M!$VdGY$Jh1Pub4!D<%_WawWLyh
z+xhWd-g@aPT~S{_4-EPE(Z!;EZfdHY%`U8Kfo!rg1DHF?9S%sO%)#aoGkKxC%u6_e
zI)Sl;S5o1i+nAV00<M0=fd4pUGgvPZTeG@+-tI8BSjHwO){WDXv=ZX$G|dL_==reJ
z{K<%1cUoZi7)hnkomuo}Gl0es3QP1Bar_(}OVN)m+hnW79D!|%K3K-{;2BxH0acqv
zPq5p41Uh|~2k7-4NZr6@Q;Qa!4*RdlCP22f(>2I;j!cus9j&I5NC#5V0xEfL#V872
zRA!4<;7`50ThmdLWgkAb4=M|RB(Z>1kGA5i3Z90tmi;4NW!_McJRcVOyAp0Ry$G_;
z_LcXN_JHc(g|Awgnsu-50bdItdKH?0c)GZZ0f>jp`uWo|jU9QY%-19r4?_YTHZi=D
zhewKw9BR39L!(s()B^m#TxEO=lC{WAldWSzv6mwhgyB=ytIq>*ZX#0$2JSkz^5rrM
zZ4y*|#uz#>a}zNT;`|SwE!gX!AxgffP!x-HZwTv(s~KM1F7VXd0v^GW&A|28UnLca
zj+sbrQI>$>7tK>vq=uyh0Uu7<G>Hz8U3OFJO1f$-Cn5uMEZ{+uXm2;s)lWjQfRTpn
zdS!9mfN-x+Fqb(oiVT?v-lmv?@|tD7u*j;rz-_g7lnDkD^UxNGip*6t4_}prk_5`X
z1nnWg>*oN+8w+ND=lsmJ)s`s-w2ADFyCUA6u8>(%?K7;#ZJfG^Ag73Ki4Q3r>9FR^
zktD@@U@AR4JP6h4U?I*z4hP_OT0?-=mxwH=si(p*2zPQp?Sr>^=+^DmKeW7{tJe;V
zHw1PymOaIsUS^wz@;(Amw}uWSf0Q<%FVYn*vy3l-sHb%MDSD6II4ScS@b4VJO5LeB
za6W^64r~;x5<KvlpzQ`hv(z$ZykZTa&Y}Oh7l&qjwNPG!(?#9sejYpX86!NXM5sU3
zoa<sVv`{dF1|B9KcGU1b8F5L;0>{G17AonJUoQv=waVg_Ab=(y1_=n101YT@vh%f*
zKpGLbokl#?TV$bi1LY5Tn7+Q}n+jfN+IQ|WB(O$|>0jNWi1-o+`SkYVOagQ}_bo66
zsD9R<J`My$@i3qN(~~sORMLmYU{+M$^S(B)gbK(b#Bn~PQZVXaX2vD1K+PXefidX@
z>(02nnC=$1bAbWFAagbfkbU76T6dN=Ht-!(xETKuuvq*pm<siCz>VngUPyL3F~s;U
zT1SqKC)^Y+EpmKl4aBdW!Y>$pqBRLUVxTISY9k)!2wgL>D1sUmcZ(shjQ@<V0fUf4
z^=1lMwG|CtFobH8ZXgDwL{;Xa@>lO7NO%P5WML9g`!g{3g0V^38BTTgba$}g0yhT5
zHTEx|+l>qeZ#Vy^hHD=bzoGg=!92`q|13z%V4bAG2jh#t{|X8#{JrK|qmr~+XeBZ~
z-S*qZ@AJ~6rq(Kd!HA>5TA*E+UpSPZvZ|`;cey+el)UsXh$8=uL{lhu*g3n(sORz-
zbWq=t5~8?$c`45W8hIs7dR(pH+9N9I|9ADmWlL_~5by(C&LEYB)gM{c4&AXkU}2h~
z&aHugf$H&X(;hmfWz=?nN}#^|U4AWp{&v|9tQ%c*o-)Dqe7I&4HMpNzgX+CD-j}F7
zjEShDKyQG%Y6NAnerxE@&N9`yCfn+PHmn&0Z7TjmG>O3ftb4um_)EY{!ab;Jtu>kg
zM$C+2-$dmZ)v?ehOK)bR+KjgTEh)lEj)k|0pNrh1Y6`ThqmxrB;YZ-D82(erdvD}A
zzoe|Q389ikh!1Lw%62SFo*U)`FIIq?eJPkAL6f`M(0b|yn9uAv(0_lYZxP$^Zl4)H
z`M?rm`j_#7miErh&_lB-mQxyFLjOhO-E+&C5xkY998ig2?+L|Ab?V=|U%3RY|Gd+W
zvzL62Zg~z;X*gY?jrl{lHV#9j14L%gR4OSL;snwmC}PM^)+vChgCiQuSDE$_U$o3u
zfg(a2)SXSVu`c<0@oA{O&k+3q#t-Y%{05DqY3;+;pwZfPZ;88y6ITs%!=Z6ZPbg(2
zU`eQ7I~E=S{foAxm-6_F%u0BGA7JZ!kh&AH5x!(ltl+*r)Jg)MRpkLqk3upvpk2#+
zIJ}vMo!td|D#g41QHYO-So3)R0D<zd0#%Y5m*@%m_6&1w{Tz4L`Aw`-8ES2}3xMU)
z<p`!Fwc1hCB+$@}$Ik;YW3vnIIzh9ZmiEuzTM6lgtLeA)DN%|rpMgky33?1ogRyx6
zuCS>BQHl7>uto6uflq%w9tK{Hrz}g8o53B5T7bV!SQ`wkdk}<&gYrb^0f$uzKLq)g
z9E)!C>VRB~mHEA`apG;4$0%!Ho^`dkBe_6Fph-(?<z%zn1$d}KYDzu%!xeGKdZ!a;
zi370jtMY6f1Nvw&-_Cu0Yydo}`$TBmvZ<~u!`t>h?;r)oRYzTY{TgtCkoWFw=;`j}
zm)?m<GrUjotFL|fhvib8W<7v5@LZ-B6>SWWLzj?qk@i~lX<}l#J=zr4^m_=815sHX
zG^<Ns@fKng&PM!KSGRnN*PmMqY0N*|VmMdGcK7|iuP)Y%^0&`P`yv`0w7l;M#RLwr
zk~}8EQ@cJedKif5mPj;UGYL%U`bGXdVbYxR*g%wp!KFPsWXs)2<ap_<y|1mgjrN`-
zrP%y*CZXrlc-!=(tLZIs#pJ0E9S_#mNiLr8t<+2BU};!iTb69l=oqtq401SH;0rbj
zDKX1zwU_8oi#{}J)^KXgi?6!<0=b!u?_ax*jE>Od_wuKv8=PCJF%e4VSrLSn$p-%H
z)qlA(vufBZx9E*2K<9R7(z)1a1QkJ`R_~$OG7$JU1JeHmQPFMWs=+&=QvENP#nbV{
z#dhsNFdD|?fB}|0*QwWi`D4}UfG^)h`c!Wz?n%D2&>DX0Phx8Ka<AvKr?0%^>R0!T
z*(w!Rzp2He#ao1ROB0joEy{xSoXbt3Zu4~_gjpk;`*3(WI3lIKVaBFqduQ9Fw=~A4
z2YwYlB-<p4KxGsq&GONM12V7Fia0<psg{HKzTfk!{K4amq~EO_95Ahon?=S&((fps
zrXp^e8oA1zM%U<HRdOJQbITa>lCsJ*sSoX31ZjYPFl%^FP~&=5%{Mru)0KvU&)tqh
zzV#G3`HxUVY%H|MOFBn{lrvLlXfWJvI&XiE!w?K8{igO7y$`1)mS_5}vV`ZmujiE3
zPZ!P0_4Wm%q%Sqy`ND!n@BUh=I&eaqNmY9I2Vbdulfj3r6Jj_<-QIg6smOZ*rPNBF
z7xg2?<Juydug2^=Xh~Q#eJ?pptyHazOtl|!-PV=*7)L*g-UJUD81evtUa~4#eQ;4g
zVBp&I>zi(|aJ40gf#3*pth(nv(87FS+tf&N{0Cul>uWzQ0=U$^)pAx>z@prARMj~k
zk9T2v4tn$1-+NX;x~B)DL07N>U+6w_<&mEj#)EFH$tE0=|3HC`f!XKQzXelb@|RR7
z9w{xx^yaHKUL#@N+<&cs{)plm+5Tip<=<lkiQh*xvIg$pwxaCisB%Y{*4CSyR4PNX
zB)2x~mVsi;3$(e{K2R{Wv2b+UZ68r7nYpzpS`F)U>tYXSQjet+{r(rj;zC=WIi)@7
zZ~LBXxeV*FSztee<!8|<xyEHjY27yUH?L2QGJyMKGO?r+fYMFR31gi}?V~I#pd3F9
z(bavX6}fj)4pv~;ffWv#=odmg78MJ@X9Yd>MIQAwE!kXB7ooA2XyM*y<_pzJ&T+-;
zQFNBg)#B-~zoS$)b~c*5*s{x4nfcbe8-HR`DjiyuvpJ<<XTVF$WOODmuob|vAK{o^
zEvmEg5$-ift^+lPv~Ce(M%7i^O!W}QK2}6po*WC|tug)Jn{UOgI`~#n?qb|xUCu!-
zC<Z4pf2tz;hz=9iRD4#5j$@Tgaq(Dk$`Q)7qq+N{MqK>t_dI=>AmYGsuQY&jq-cK<
z=l?NvrSVYi?|UfK8A_)tMV8K~$d*c!okA(046+N6wX$WKA!$>zNr<tAnHWpRI+jz~
z>}h0aD%F@Qqs&-l%*_9O=$zmGdC`kLHS^4~e82a7-Ph8Y*jr_lvK2W8R4lRE^ZUTS
zLp=HB_nq7wT;MfrhB2eqdUSvhv`eSNT`>lh9dWCk^5GdcxHLMy|0S-pB=QdpdC>gK
zk<MmEW3f|U`jOpRn_#^4=2XmCXF)@<2->ws>bjsN+PdgVGKOHSZi2yt-~(3|&|G6!
zDM6M6gnj5S#q7JK7xHL>r7=|&TOYWjT%NFJZ)r4ZKgu9do;bXwxZ)<~dT5Wk%!Z!g
zr&y=BgAYD<BQH0vHk0brA91tw0O6enwUFX%|7M?#g0M{}K1i!E5T9eNNv9fysP?K3
z_r@v4$YD&`(C%hDy<ah&6I?sN9#0={jI_X)%nh&@;cI)1w)yRw+cOc)Xwqk^WM-6_
zu!D|JcgKu`-r7|!5vIbKeCkYc{pK*>O^;y@RaT#g>}Yk+W=xS+Op<2$Ysa5OK58nZ
zliQdP1Dr$DQ+U>U#~{6ar6(LlBh|ohcFu?Dh{<$$T(aEYkc7eN@TYrLv_8H;qQiqN
z;U*Oh!hAN`uxDKVYu*i-uaJcBBzNiFi0u0ob3!ZNHLxZ8nR4l7K%$iHnbFEK`UN^0
z4T-gn6wY{i@4IX3nv(|hSEoY^Kq1Pr>){%dP{!wsoe+aY*SdLF9~wf)S4HL6+>og0
zPe#u`c8}#P&_35Qn#OC2$+bT9varf>Ch0M~_`FHE=;=6v(!lEE>O$`PXfkgLW28P+
zm(rxogH@PTLyvxU;yA-Dqn0zr;CM*MoNO-(sG|grOl;DgQou*weN>ZlM?Wa$g%>lk
z51%tP<UKY(A20HtKh$oD;WPEQ`CVr1jT2gxU6!u*nBf+#Cwsyvnp|vH78}0Zt3B#h
z@~i>RVyyA(AfvKN|7a3RC6b(!M=hg{(-{PYJH;69g*!ScQ^!wIgPRkbNh&?c4nN9|
zaSl^u4h=1g*|TNC@E_YdN0JI0+4W<O{RlCAUG<~@b~p!q4Ze=Yo?`oRhAO%$gVhJk
zC~afs$<*Z+!8OC@7+0(3Vx3r*1<y+#&rbwu`K9k_`>q}^Ffb@R&@r}9axrUWZAX;p
zDB~D2ECG9IerW(1``J5wSbd#<iD-NX3bItln**e81$qGS54<AMUK!`8?*m@f#<c|R
z;M!p)=3v9$s1V?Ep-${?eV%hU<e71@bMm>kgmq$p-BF?S!L%fD4eEG$>tA7uA)6lS
zOv_8$KD=5^<xsE8L#ynz=W$sYLc5+i$KgY)o*PSR2L;s3G^xBjP3x2SQXYFu+kWHY
z(r+_YR6|5KSz&!M*w0%zY9o|G)b`MX^a<?({<;a>&|4E)-PqY@I;i}azVdn!t8yT`
zH?+6vX-1M4&TIsSr;}4du08K8<_yl(ORyhJp>8<~bJset90m+lkHqb2{KyS239iXL
zMe?|waH*HZfz6r|Kqqgn|4yHo;6)w9Wyy5$czs5SJ*?%T$bEhe2l<tIH8sDlFx<Ft
zBLFWBFN;vOzwfJhw!02@awfCx)SAOul2>DmFBzg@WtW!dmzU22x{(_fl)dNKESPp)
zQBE;83YqEJyIJ*i?SQ0?lxMw9+2piu!H~r%VP)$#*)C5e``{7$;wVagtm#l^H?*}%
z`b3&%J^kVP+`}ag4^6&crYGHb9A@gf&`(;6N!LG0`xqmViSOJxa^lFumXPSiuFiT_
z&aOsRTJdOTjeYOW$tZ$M-<#e8!(<$lI#J2|z-XMy3Ni@A_--!Hv}|+;E*J`@?`5X3
zlir`Up!CRwlNqoxF-uD8NGuG!G9)nU<j~%#FF!&j`-Yx0rsg|7(o3A}iK^#IOb$AX
z?=BDEmL_n6vpwLpFzc$`RgeWT>odujL35##tW03CabwsF4Chq6_5$prTn1rgg4OjN
zh%M(nKcsuS!tm0T_i@TsCi5K(tLx8Hp3N{8W)55g4b)`-^o>G<1E%)6sL)(3yFvv~
zZl(amG~ez)QC2-i3($}Ad%!u^S+9H~&n#IR@g9N>1vqZw{P^nG<W>DfYN^5+FL$7r
zKMD>SpwBpA!fzY3U*B;sdOAl(%%kN`ohFx>_2zTC#a~BA2%igC9elG@Nn0|(=Rs=f
zNMc!6nY@`+0L6PO%=t6gSwY6`^A6!7JELblwZw1pzpz=zLdE~IfMTZWE(uiKO?}s`
z+qgR#jZN(Om5a6me`acj{iYo<%-wXWo;N29%>+uO&ZT6{2|r-vQfH?|>UqN<y3Rqu
zX|KHa{`AJWo%Y)$?E9$6AM-qZ;ICqF%WUz*!G@nNq?;m3B^1u=*_=TM0cK@-n@C>m
z+fPt*ZrZ&0k9}RmKiWY4^<7MDCALmd_uszKs(d<m?d^T2_dg^{u3gW%0y#)6p!9M<
z!>DV|tn3JFW}&Q)K986qfA0UWZdZe1g6biG%ialrr6-<$+tY<EZ8&ECTz7nn>baj!
zf+JkmYi<5GEPg=@-SZQ}{iY-!-xHxcpZ9tndIepVlMtI_f)Bt`i5q&~oKXK(N5T(K
zbCYl~IALx+ado3eLV~P*^jMpVc6dUm*u!1}Gq#8h55xPgLFQ<CnUW(O$Ey{+<2=V$
zjVxo$>NmavG4}W#D-<yBa%*1;le{ZGgk-mOg}(RQ$3KMW?yqnf(%5AVJGtSmrNQJu
zg>?c8?dU~_EEsueG}-*f_BHsaa*Qfwdt&FIC42p2&wgG)*^R%@k`4YTlI7FSEA55z
zQWu_J88sAqA^NBRSASHyRcs{Sb#HG;9=wE=V}sPDn4zmUvDZ-_7(sCxW13obQY<Lb
zJ632@v78d=%j5Ho-Jw?J+6DCqpYr^&c%1ql29DZzIo#szvmM?!xfyF5mzoWAe*iVe
zcA>vuf6Etom=FQpmYD>;e_$ZHgK$Q+BZ6Hkk$`)$Vaa%y`@0@*Y<(W-rX_VN8_Y-p
z&?<*koJr}x{NZdM50gbE(HA8A(P_>N4(wZE8n=m0Ki1u>VxAbtcI|F%HI;ZcCW*C{
z&L>7c&@Z%8Y;E1MYvbFp2S>O~$yKDt58d~7B(t4&Vag(8C3<T+HSN$_>AE2@Hh0E$
z*b^(qbAKG^WiSp?>g!Y9CzjcI%tq`oH`<<gkLSV~+S%aIk_i>|j)f?@?S)t)b&fur
zY{v~li_?Q_81+evC7yY6*&EM2pP?MXJpmDHL>9QRodcWEu5e%XJVJ(9a8?{4%~2>@
z48d%hmQa8kvD7*X!PRuzgFW&GR8q_>8_imBprVu;a+8iPq?%)l4q?nxrhny%Sy^=(
zevWtPH-$Dcrp!oXAou;D5dql*vB-oiz3qM8#l}gB@;x1wHsfPv)1s`=&I9}C;x-lM
zUcHIFGFCq}$h^C5PeI$UMkS7q>ySZAiAoW34^xLe6H49nl(mP+b)9AGvcO%Hct~%m
zuG2*CY4rCoV`^oOU+ACp=Z@hMnFg!FN=*76{iB~(uXH<~|KUfeQh`S?H?_fkTyJR$
zc3J(w|Gg}GeX@kI@1h=98!BfZk+zYIQ?3YIc^`RwhokOJ&c?0;{fNVH!6?I^m9g;1
zTU|do%oZR`siMScP%}?Yn9ltmmZa>f)>FGBUG!Eh&{SLG?m7t{SQ*iO+RvMPj&%|D
zz_RHIU~H^eMr&+cIme({5>UnBDVHSB3S*UGR%Kn*7tP{CWsY*_EK39KJ1X(?^{S=~
z!cB^s@<)}1v*&g`^)$N9tR34IFurczhX?~p>1{E17w|YwUn~zk9Ars#O@Or!OUk}c
zdOg!DJ?3$%C0oULqjNa%M*duJ#l57nIl3d`H4OdsHw5X;GIr#|Db|ov)!k$4^zhY<
z6G7JG+RiFFd4-rjZYM=aJ=9g$ub_Z@Am&PG0#BATHwz^u>&d#%4^-1|mW+%g^$4W^
zI9SK##<gph)$q`4vr%B{+bwt>jpXj#x=Y%2399)NIz9h$G`rvTfU4D_hYzP`?hlrN
z9gr4y)fg4q)ZLx}xp>ZtkD8KF!hPbsU<JMS23|rDap~a~pYig%<Swiuup73>%ANr&
zIoGY$h2#zO=U$+VoN6S2Wo;<<vc5{Xb<2y-EHvPbAhbK3brfTPH9|^kq4i?XRz;t<
zb5u*Ef_!>RB-vOt@(Be~ZssnPAm2L_Dv}UUcTgR@-5zDc*?F;B*)xBAe5N0ntFkSB
zlpZa9rQGUr^{JO8w8BYr%2<QSAy0AZC;e%i7!on}HOAp`fx$s4hF0uBPtT7x59^qS
z8lOj3=@PYXmd5Q!7OS&<)^<skts5g(b!I$p?}Mfn?2i&Qy-{Mk@=5fqvBo;AM0#&<
zW}#3#Q{OpUr;9mvnExV7W`aZKg!5-j$#H@Q=r`O_duY*fBjJ*zRWVmGQ?YH#FwO*)
zV*KQ^b=}>&rG+wmysXJ*b(-|9r{g((1dnlUT~b&;FZotNUoWM<v(JU%XPc=IGs4<j
z=b~LLG|JpO8&!Y{Pnc6V)<2F<3+c}bk*=R&EX@;|N&RhCMfu;Uiy62XzSo|#8K1z)
zJV)lU%#Jfd0QF@qEG%?p1T}r=X{vQ9J*grQI+G~<=G%o$w<xTE*Qf(1RNc=Y*bvl1
zzO29Px_u*ewRb`+bC~*0j?<H8M)-BFpO7~803tIxj#*fE<+lIb6ScQTl?bLT+5*{>
z+r}bw&ig!Po^aKM+LhksD?fJ9;@q4HbE2Fd4q2lt^XNzakMW8*UOE)ry#m=ZFNiyj
z5L2sg8?kVnBW~ft0zJa4U8+sgZ}Nb`w>XIq=J<9kc%Q(E%r4qc$C*m7zR?COZ?d+w
z_8bHU>FwFG;bUE>vJJ`y@Z8nd+yzUaSh02JFG@790QUL^c@po~%qyG~ur0B5F0rjI
z!#m*gu#5ZiG~EU<3>|&_SqAj%;XQ7HpIIR(sKi=x_0ftL<^g(`tJdeo`gt5FJ<G!h
zZtVtj6An(^ZsU(h3z#HaKdyS7v$XhRlR@Ti4s0b1vOqpF`3xp}@&1}a^pAEkSp?oj
zgMu<p5T96HaLUEi-lLz`MJa$|)o~(FBTVf<s|Z7sUkeQ|u$cP#^)kXOL5|osu=&E4
ze}OR?o@nD2*7Jx4@>ADi;C~<s*FN-wYG*tZ2I=V42}Z-5qrrJL0JelIWrSV1A%t@p
z7F3Cp#R7K;(6w{muFRzXx(=aw!=vrVRgo{iCBF_vr#gqS(T0)u6|t_08K`A$7)eys
z+#kN$1vD$rU8Ws-aW*g*d<z+1iz#ke18xJax^Pev5JklPIhl@7ee}GL@^Jn2)iv1b
zZy+kT48Upo&BNfyj5xc%w8~06_AQh7R8Gv#DhBK^Uu^x${JY@1343v-Yb4bbOSj|h
z9Jn|)<va(kxz5tBpLSRSh6$x8u@^I$MxeTcaNh5l`?}~foxF%REAj4<X;BCRYW7-k
z#Jgg?<>ODGXpK*pHHssvK;y0a^&ZSGSa_Ij^7Z`$B=kR{KBbOzX6o>k+X@%C5B|2{
zIfQ%dATtPa0sIp1n^BFzouG5zRRJ;Y-a|TJ425DY2PoKxv9CutbJip20&+|>RaKZ%
za$#Z)Z_CngF(LXkc%T5Mi?j&dbPQKe!dep2{qE!?w&^=8`UuO9KELz7PdgFsgo9j>
zNGBDE{x5HWq@kXK-75Zg;l{U}opod7-~evJlH-H#dNHHs_p}Wa-yK-vOzi)aTq0z@
z<DRuwc3F?l`~lFRd_8E8mzT#?;?8&9UV+Mn07Wn!$`PAuoCWK<MfnIo;0-`Ie5_Uf
zXA`#hNpBqh?Eqvg9jh!7Hvl4}8YmzEQeO#8UvT$6m3@Pj`@_IiXhbOw?nUI1!tlxi
z0^bMKP+orLa!hVJ1So8M>A43jw9qmQ?g#5@P{P5rTa*!+0CI>tQbHAL*Gec!fivJ5
z9~dX5yuDZZ24tFrCdu!4M?c_w43M*AFKghHei~9l!%EO#LLCeQ2gvNrN8bh;Q9}-x
zVgZ)B!qv70tV+S_Bko_mg2)Xe6vVt}VAR26NEo;b3Ln2pYL>$26pi}uXzZTz3gq)6
zmq_GS%yqk2xh+B2ziQ-SnAUEp&9A>*=>4u-in?!&@&P?37zW3=B(55a`)|~%?)DiZ
zMpO69^&Q5Gpd%8ynUr*;CUE3eKuhjW!rTJWa?=I`*<6yNsXvLHH$$?eUg}0N6*un(
zekhVg;i(=C&M<F0wHs{*QS+=5DP`^&PiRYbvzcVAp|JV;g#-L&AN*a`{Dg7ywk}{1
z7+0Y-!U)Is<^IJ{6lx6IHv#G^8u;<xBIc$XipWikIw7I;EOgwq$mIiAl&p@0;T6{p
z++ZZ4-*apPuJ!ziMOYKy9oeOKak{yYGgWWd$orP+T1RSPzmDN^=XeXN<)S|!ZB}b*
z>)vF}b4gdHHHOi%AH4Mp@`e!9tZCtU#@AZHA$nsM`)yzlnOjZfPt`LPcb8@~Wi;iL
z-Wl7gzwmYA+z^%bexxyqq8B~i4L#c47(G@5TZOwrTa<I_W+|mz4)@5ZW{P@<K^eDO
zuvle5D`Mo4S2$A<D4ASu)aRMinPYd`jABWd%?$r|9s(_2g-sH1XPDtn7};bpjr)5%
z9$!fK3J+|Y66)JbgaP@KqL}}>zFRkMIz6m>*J{>*yODq^;;n#-wM5C&KA$$^+3l#7
z+J?}JqBPl}UvnJd&JIC@QCVYSrbsR#^3o`qC3-$_t!^_^T+DMjOp0v-GN`Cw1Hgm&
zpR(nz1P<~~eU=cCg>I2H$4C0-YGQ+>SV&J(ZueD-d|lBPJack~pkYlA6^v^b)H#Y7
z?Fqwgh{OpF)e8+kU}nBk%LZYFqI?0>oLs1Q?VZfSa_T?WV6FuDtJ{szOfHsm18X-D
z(h(99+Q^JbY}I3{hNxDJlooc{wWx4MPArS?Vn6rzR$T(d4n~R6ch1-Mb(bSygd!c(
z@cC((_10|jg522Kl}d($%Yp6Lp!ms_Tbh~XoKC^DD(uYi%$8nzt?f)@+U3YSX~*_M
z@`#OaI;e>y+_2KB&8rRy;IRTi7`>jZBCB|eYq|N3^x?5m%|6SzJvTmjZ~U7(#$p~Q
zpz?LaWP27q+OWihjp=m*2Yv*LvCD3sB>52u>bnl&q2og6cCCIAwtos+Ifp%Rjf6V+
zvFqyt4&CN756UUN(;|WeepEV3*P`eT@^=_}FRc-uz5`6%s&igQ9`WLUk?!3Col|H-
zLiESRbCX9D%5Fcu^}jiZ%jYi~mm!or(Q_hn?S0V4<O(oP#(xIC9!L!8I1y`>BUF|A
z!=xo`>JJeiDStk#*gx0svd{rB?Yf%|HpS^3p=I(fEUXe0=;FVu_8$_zSa<M5-ACKC
zbdv(y3O~IEXE3<BcpK9p=3wF~BDO?LcxGT9h2e*jTsl=Z#RPElSPcf?U<0fnbxT+W
z$Rew&UzXT?^IckImMAb+?qCFdS%Ta3B^VAKTH&ELI|RgbvfcJ<Si#6jrbORdf$EcK
z&Pu2e6(R9==7f3^n?bLD8kcSMc}hDkoMOpmrn-zvnzOf;8(tGU+87N(DQwEaBX-v!
zPH9&&(F=+L!5?ai1@DwHcGa@G%8p!(_gPpj`K*otmLHsgO$r9LCu+^mq@ijvY`o63
zPRAwe&Q9(9^|j-to_H(@)wtZ}ZdW@m{UZ6^q||z%R<%#Izc{jxIOkYdtuOLe;ekQ5
zcAOB;k~}Nm)$bvzdvSVr@|KuGgsqP$EoEI9GjC4$SRNN+O`Dw@vaD+8ttA*I%^t0h
z>BC0itH;Y-`aHOev)acEBw{P(!pWA@woBR)yz&^PeGReNdOYmZOEbLt*85!s{Keuq
zg7K}))E?ISberfs&J-iB`*w9BcXo*Pp!9+V=GN0jj#CIXRJZZ5-;gu+6)!8qU*;sG
zO@CC0V#=tR>5mGLZR~W^noI@MxZ3z!WC<lSQkLG`h2hn9hxaXv%}j1#V_sA+d^mLN
zS;8LX6Tc;70F?!sUS91HsvyMlIEdq+P1byQrZPt<1JLxko}QlkR?8AwVG!-#6}p2|
zH*k=I)}9NvP2~7Y6Agnk>u&v1qXqO1Q)pn?^V(~DrXTGRL!X3&cyG_lX|>dh#3@?d
z(7#wZz};6NFyz$?j2aJZl=uwg`7UVraL^F6iR#bG!+n-(Blb4+1Wn1A;Y4|rAU<w`
zPONaYFKlG|F*h<ZRp#%Qb;t_o{SuILNd$uDU8H-A>CH`z9IYO&AD;ziY#KoCnW2y;
z#9mg}%)8yJwAAt#(m}SvWBL}ROr$fJ8RR}STs!mb06i*{Q8>zE>qeDuU<lTW^RAl$
zq&$=7&ry9!&KeJ9IgyXBqkia50{+j$CC-L>;tV2j?4Y(LJeEd$6mAeE+c-<vS2K?M
z7d3i7SQee(L9wM4b9BORa-4uZ&X4la@ygO=e$yBO5f1Xt`1?<2^*rN{fDz2wgYV)$
z2i=f6y!U$sHUAvZz#otr2{ftE(x99wv8_z!-=rDt+hvYOTtS*W_{WKOSE1Mnu;5(b
zA&0s#)edy73q3I#P&ZcfSM~(MU#%MAOA2I<7pfbE$9_H~AfJHtm#f#aER&bf?kVq$
zOV$v&r;>mE6spLssI}9w1y79D61L7?p~Ow%s%XE!kZ#q#Kv|Lf^1CRZWsIWRH?6G-
zbk=x~&C;D~rWo$+6HQrzu4H`A=oIQsX2v+0G~iv(rOeftMWYJZPQz1}Bj<q&ZZ!5D
zp~a-R2*}G=4o%LZ53txx^qF_GP<$Tu0o~7yTF!BB9C-PW%5ZR!h+gV)P?jfAic&{Y
zhYeQ6o)Jgg$g=ePGw=JJeIyWkUnC+EfsQ|K{xg%6HvKC1u)$8L4d7eF-2DZv%9Ufj
zx22KtzNz4>hWt99HB^9c(FNZXntS(dL|idIAo_J5>w|5v^Hsk>2_s)BOZQ#x7>~>0
zJ$`W97vmX#2Xt_LxV;YM1|Tc=8IY>anW)V7x|<Z0G76LCt{Nxvnq8F=$LO}l?A#j%
zZzU}>1l(gf!}fnKKj1;2Z;L0D@p#NBl;_L!Ea`)udhlM%bjxa9ZD5^RU8lAJH|cET
z$C#0c+NPsy?Qu@NL6;AidA`I16Yi+YDG3$vJ9wtuQm$)|$nq$8QRnFXA*k@ZD_f_$
z>m4JHQ94)5%CuHi8)6WcvQ?^2J;oP9otfb=DYLF@XTV?zg#!k9DMJHQ<2>np??xD%
zy_&^RS{;fChNw%gc`OfRqyWFp1T-I8zw-0F`s_TKR6SAXVX-aoXQ1V5CB&KhyC8xC
z)!K`yEAwRsejeq4|KA@#$87_4p<7^JCwTf9?AO=Uz5vsQBjf6DEe%^Z3^HzO_s<5g
ze5?JVuntOI+TL}rWp%<Cri-wrqJ92M-Rs(&hFfQ`BL+d!v^shNZt<rXzft8`j^Rrk
zn8@42j%vd~=q~EKBEgVZd$*}`ur&D2)C|2TE9?mtUr5yfdNNQCEV+S^&K%xs4Y{#w
zB#Zo(nmx9K^`S9|L@t~nA4xbPhBCj}8Ir_y#C{~ZHqs*EgU+&bg}1^RKcv{**U{v$
zYc}Hp_Co*fg)cJk`_7noh153)fkzGB<;VM5Q4H-4?IHYD!tD6+o-xa~{#`$mM$;ON
z@(#{BuLuO-LobjfI&FV*o^`3H{2@W^)hVCuEnxC2gyx56%gFr#JfL5G5I7xY-DFHx
z_^*9>u%x<$)f@D4vWChw-$&0N6ug8-iaRr9{?~|DY}xu(i7SINtWOK9654YJpH}+z
zmkRpBn3MPgE1}fXwfCJQoktl>oGD{WUPk`yWc@d-I&4+(UmJ+ge-D=WJzAHPPuIoB
zn75xyD0)*`D0K75ubZuobZRGIU~GmJ-a9^9K~B{_NUf#*tXE!hs%o3?!Ru3fn2W29
z<j8QjKX8()IY08rIej~K3Wq>heh-<22aY&Cf{3V+&^m<H0B|w4;W3z=5T{o4`|i6|
ze{EqB*$jR|#oJ|v2MLlwD_Wn4m9FY&0ec#CfFVp*e7D+~?K3@L_YZ(ws~j*My#-<C
z_1KtPdg=NLDJPywe7e{pf3@nx3HgI9e<y4zb=YafQ4Yz?er;h(sl7?~$P_l;dCom9
zi58$R+rS(;)qK!hN$)s+hs3Jh%lC~98y)WMocEy2D3J?gp!PC)#N<pcUS0BPZ18`+
zLs(C*i&b^|ZWHk%F}8y^&*?efc+n!R94j9AbflEw<?_`5Sxr%~Je7uxcBl&gp<puz
zX?`vzNw<=c*c_jaeN>=oDKYc7(9Qn~iC;6T>%k2-seb_{UAqV;14XqIbG3V~wt1b0
zs+_A2e*{KH4_gb2v5Nz&Nf`<9HrEezMPdG?KYo==oS-CQ6#f)CQtH4p%em!ZlxlQR
zr{q~3hDz~TKbbl)NY|p5`rK>kY;<^XO8qd$iRDyMk(^LdXRwzWNnYRm#@4ig;fc8x
zDMQv-??Exf9n@xE`)>yh7UHo#NF9~>)Jx9X(v+mXcU@3j`e}wi4)=Y;V?Ci%w%Y}+
zR{omO(AEN-@^$U4R}eT-WOBQ>?K0g1+Nxy;JP*C6deDUE`o(2{x1Edkxjo?uRQ8A;
zjlKdePz$L>M%SO+|0#stI95fx62`_Tl+P*O@0Ho{!;bY&^?1WXIVPCSYDz89=u5_U
zTi?!?ta8{$Z1zxzy{8|Z$H?~8O~rK5O^p5&W-!qy1Jy2ZsvPHDa&l)eg^_iJoY`4R
zIX@YtoPW3UzGu!>;lquJI!&!^BLbU++@J0t*%_)h3ynn#;hZVdyUydxpElNnj7-0|
z@OPXL=gClxY**CsuWmN^;9pJ4J#?$YqR}P%z2Gqo1{ggy(J1!_gH3z15$C+$h2OWk
z)5q<LZ7!K5%hFj^@m?t%lLcU*^Ar`u65C-#%&nnfhgKVlIdwM*ZXt+;^jpOxNY^Rf
zw>Np<5>TvScn?dqA28W^ZKx)QBY)X=Z}k^*+L;vVe=ZprEKav2j5@9vg*#(jT@Y_R
z+k_2S$L67($7Xs3wmEAFKMb+^qr&g;+yK^;V)hwND@n==wti`5^vDGhts<ZM;N%EX
zztN0L#Cm6@2HM7$(%vb5^&~r!B^<)1hK~?X^o9_Bu1g&l)YPq)s_>&Q(&x}S=>rn6
zJ^S9DXVnnIBkHcOog<In=VmUS?#)rmq+yhP<PU`x%+)YTXZoq7f$4|eG2HsEKT$f#
z)={!4W)w5#0Sw<xBT<za@h+CGiEorJ%R2`yzd|oP_1!2q`;jN7r@NEO!J!^R9J81X
zjL^%ECrfN&p3l6S&q#n4rKw_x6l6a{0tuAW)<3ydeM&AZAf5=HaEr<OKM@693SrUn
zMSJ^Rv@nF~xcU1ZQ})~gPCyr7h2NVjXV7_QXb*pi%B|-|UAXYeb^owpf|$mgoaPpT
z1qJ@L54>Hx=j3UDw4NSox$Fg3{y44{H`~Qa;~)|m*J9`Uts;E70asxT$Lr$%+$uDp
zJdii~<6-Xl_^hFyV)x4)m_#OnVX!wZhV7q8rSc}J?3vzC9E-$D5sez#L{Kak-6@hY
zH(ptl98<l+pJ^{3JQUa>qDP?(hQ-(kFEI0h=Y#l@<b`(rH}aw+KLY)BEb_;eNTFRJ
zw?b7}T>gRqpEgD14dF5x9(VQmp(n;Tx}rLE&Ut}Ait%Gt_L8{cI4+4h*Ut&n<B!5+
zc@;zoK>M&bjhuv}iG7W(6lcmI+GEXNxSQ38<3&8qpIpf;mH5@WufI{~ZZFC4T6+>H
z05_wB3*KtepD5@x*p;-Pg656Q_5Wna#)xwDemJqY$0L)K<bc*CE1XSld>=RofHkj{
zXDjwk?_95@P!&^4ZB|B{S5EF=?$e<A<%~aUl9=t1T3R`t4deNXG(L^Yqwv|HK@C4m
zF9J@9z{)qjE4Cfm(RV%2UE||A*5J#Rhc|T;T$V~CrY|5D{6libKG7dhI3dqic+GwW
zLB*;b0`zZiGFl1d<@2;2dF?#jK%|RON_2PONZ^pF^wro3Fb#=(#O=fLnBnAwj-aXi
zsAoIUZ=T%$=hDf@Pa@JbDsKvu^d7{1ZT!QBV~2t>CVfgP5bPV?_L=V)LDf~R8sQ&o
z_ZQi#gylLGp$!LRJK~l22-C{Y_3x#pQuox?4fD^{q!<LkjYxO1O9&vVsksO_lBHHw
z>JR|%B_`(ZVd9xD*bk_4B{qN3A{=nbuYhZ+EwP|J-!R@G&95{VTy%kUNnHC7|Lo@X
z0|zmCDWlKOPrG>kY|MMLr5Kbu2}|gUQgK{~>tya~2W|x<rWUCtjTtn9CE!(f#^0+V
zp4~7&y#i)}8?Rp7f@)Byx_I)97B?u#!LQh4D1Nml>^g858o<SQ<xw>R61npPW@Tez
z31n@-!gfAoCdmN@?JO${zj)pfp))^Q7Gf&dzG~OoJi%TK8+Et*fyhnw-*|;zxNvuZ
z#QOlmvH=iDS@0}8JUrH+TwZ8Vqeq)~Y(M_|OqW48bWs0VypBPJ6Z^m`02RO-D#xM)
z@M_Ut8d7WJegIbg8HV^&@`+-f&Pp&Qr7IcoZW(<7jLsBkQAGZh<6VFAafft25=V0k
zb0B(?qLlpV%;T`oxq%eSB$*r4E3g%H(Ha?$?&{}4RaBR3z#BM=S@t0?+%*~I7@mVc
z`D$i-hVONqF3LujpjBl);1>=qu=)TeFM=_?0<cJp5Q~nnt$+|h53q&zvp=wky<KYk
z)t^e6Ys$-W&|APll*k`@JPCr6$b&`G$*Vq`2P314JMq!KuGi!E`jA6~9OuLVR67En
zd`Z`q6%FDED<S!g^X4VCGc)*>je}ol+6Xr?av9u6T6?YJYk<a@YCw-d-@bf#4cAav
zd9T6y!i5um)8$j&EbOWO&!bxXuyf*uco37F132PpEc9y8(&~*?#WssERSp(mNi^dC
zm;17A0PifB42fhi37dKh?TPNa^$2|ccx{^`(Fs8Kr;@W#xBsUgkUwjki&05Fn^c)s
z+X=2~elslK?M)vk&h|9gwghi1{acZg{fl{5-JNDNBaZL^m4BzKGr~IxmJWz*6u5dV
z{djmw6=7t&%lzhd1+MOy$`2xtATa#)?aj#z56lZZ`C}}@L|K4j1ra_saTx+PC;Un#
zO;rL{9xQy<Mz+D*<O-7b3!o;8NG9-M9<V)r^qJ5muYY;sB8Tcns;`2ZZ}}VA4DS`F
z0P!`CU@|ZZwUlTsh3j-icaDD05GgBDe_v({uRN;c(kTZAb3r}O8YS9x42;?mpSx{d
zKI`V@BB6o#`HR`+-+G)1M44dvm)A2*O1^pXGO%zEQ|din$q(IJ&rwVB+^g=l9pwK&
zH4CkbMTXtw5FK1mb3#Spo&soezFpACJg%;%CsQQ!uq1uyt%urBV5UU|qX7KX1N-++
zBQy{T%o?-?(v6Opnwhn+SS%PjtVE;E%4+CIqJapq^wH|S;=K}(gtrwbE&Xo$rNlUr
zC4$``^8rqRyT<KxfY=c|F4R7<{V?CJ`Rr7BnZ2Xq%p5&H%VgsYR~(lWOs1K1y=uY-
zYInYg{5XS43zm~$V_mTe1>_f$P~DNz(YfU+{h}<~G=+<~3$I|J^hLtW2!b{-G0eK}
z`@lyLgaC`VW*CET6w0aP8Vs&C{Z+i7hOkoXpMYivifY9Y7LnkyC_gaB<HeIPqP<Ge
zf`(c&=;p%186R15&~gNBs0RMCX!OHT;5haLeJLHfDu*45|I0zVs-Yp8-h>{E{`p+;
z)dA?7yPZ=$=FK6^8H)-dWB^x2p@H5z*AQX>Ai6Z}I9um^XkBrzWqk~1Hdx4=Sx?_P
z>2zzy<B(2ZtCVwqgTCn3c<D%;Ej<QmbvlP$=R*ZjIu&P`hvdyq?E#whvuW8$5_v6$
z`iD+6?|9&spyeGRJLCJ#?RtfDzNLmYgfon{8Kvu33uVI)E4w~DBHSbd#<)xB$AjC~
z{ak4&%Qgy{?=h1T0?Pp~U^LR$9|q7>oD#ptzw~3CVH{M*=-U|7>9Xj(VvAPm&2nxa
ze40P(d^k~z##9^E+Uwm3m;OQ*HOzGCbPd~m7R`+Bq(=<Qog90iWU<pHcT~~l*IxqJ
z2$x=NoY0R8nPLy&Y^}ylg_MLeq18TwAL$E^;Y`+WJ%nE?8s=rlwsUE_K-gv3qL`34
zu}^qJF?NPth-Wj3=N?m2^%b0{Q=^Y}zRe@&gfuI}bl$~U2&l$9=E>gbJV~`^uf_43
z;O@fl>})z|Vo>Zj1i(wU{Rv7X4btY0pvyqLm)Lvuvqw8)ONaO1u+NsiPG8!HIwycs
z!p+@BL<9Q;-^vaV9^Se0Co+d4tjupm^FczrEvEYXUYlBzts)8Ly<6n~KOXC@&hT|C
z=o+R{8JlnRT)s}|%V(iebrTaTdl^-X+1!+i6Pvo)jF0b<%0JO<+VTi+%?6tHxQ@eq
zbIz%O_67u(7@eA%Lw_GQZ)0+pG#&&le^bE~T@#YL9!61iD%Kmgj~NN~Z|a*-t+x_2
zCJO`50X^%MI6Wv4V_nMy8y_>(=664i2B*Qy#||YWBeNDpfRQd&OrZRHvyA9IC-DEV
zj0Z;&&vzgljt5zY9IDstfRwz#WGloy&ClC&R)HW;dsXQj<1M|)HaUh@jkOK9%zM)L
zF7Edv3sB~y*u<tGqR)0#F20ybtI%{pYt!rKQO@28TZBJeD=pw=+Iwv$zU<qzzJMY=
zMmK5irn<7DP7U0=ExL3oF7^Z5GIa@?xDlSLHkeAvf#_{@`uMw1->USt9xqDTwjf~@
zzZ(%VWoMglTcRt(TuqW~)=^wwK*>zT*xJ=V&f3>1kOW9?*?YK2Kw{YHaGqU(T$PKt
zUGnY`fwe*hA{$+YR6XBWvh5{QYJK~+$~d;%$ExXcdeI7kd(Y!Tr&7y<>yyyt4o2^t
z#oLRNk`nyivByo6wmX{^l-%OlO6>1FP@p^?QvYP~15yig?c-vF{pdQOu3A+>mA2=W
zeho?sT=VK}i7C24ni*5j0@!IMN$Tx*C-|0-={MDP$zX&7esIg1KT)_J$4<~hW^pm$
z!evZ1X-YeRr0Aa$c6=nDrp{4=9$p_cR~ohS{8z1q7{w`ojIbG(w&sowgw+?s>qnAi
z`}MW2ls|CJwMy(PwiDW%;Kz*6E}iWe4RJfvUOsE{p71(w(C(i42+fmXB(N>UEYptU
zVUU=aA*dXQ?|feRCbV)ivDJZVY`kl9D2U9OLywO=?y@m7W6pWtHfoE;(1^Xe>)H;o
zqfYkk^gDY-Kt;xtgkXHj>%PcqAdV#x?<s%UcxYzhXV?buqsUZLDZ}r4o<r=1sHbc0
zzIXj^BYa>iDIwU4o2L*ql_b$i?Q`!wJ1?xB`sUlBykmTTlL2=fLF#YY9+Q@bE^(5=
zZ|s#7g*-LVevT#^ursh`7UvWVXGX%Q+lMe!CPwRoCFzam;ISs1*u1b45@_pzQ9#J`
z*WY~{+~+;Mm$?wBCv*AF7==bV8;oi4<m2E9r9E`tJrdeIQK7Q1Ku&83n>iP#rU+dV
zd(l(X&3acJNbtSoP;hFT6oOkA&-HM$?`l0wzx_~FSw5dpXqeo@!IWZ1v#zG(`f5Kp
z;pAfU9c=x0Y2Y&V;oN4&`<v{3{ZW#eT*bWceb-``9+W&V3%Bmsf|?dt8H;SBM_4tp
zb5e^0(XeuRk$s9-=9qOisqO}J(-d!M%E5aZ(0%sLT9pPu>`Kag4d1^%k}TfT6V^z%
zq#gN$pjYkezDcK4#w_Pi_{WI$#x*i~WeDY{KChDIIu`n?qD{VsqqLGF&P<O&^$8En
zcd;optvh(M@sirEqvYfm?*xz1zde~i7M}MY+)Yjj!rTqHrRwHM&P&K(rU$a6d#fs5
zTcuiaNK-#foJDW^Kut?%FWu0*ynjABUae>y{0J}tV4mFWIKv(O28Au?m4v~_V=}-<
zH+e%oQdnO^3&=x>bbrxDOGNyyHGWm;)W=3YOB`!jeQs}gV7{F~4_Q>&%<7SFwD#}{
zJ0C1IY~{5@xbNByB^&q0_^IaW1PD38_F)`LiFHZF3bvC9F_p3DLayu{EV?s)#UV;e
z61}U!FbP{ZUiSjcQ1s7>O%l{1yvQRbhJ<bv{t|-g3Q1HGYE~1T$X}t~sCc-5tN<|I
zq&>R^wRCI(CrfRxf82_glSU_CR`hCioCR+~?WJsQa|z=s=S9n=UK^oM`M35%U9&Z}
zC7_|#WUk4p&rB}ntKBP*w3Z|tneFi0gC!g1WUsf{zkBx`eX;nj0%g@0iE1mWg90~0
z)W<^e%WgE0l;-TOeTyiLOk$!@&I*2*Gx*TV60%K6u`4Dku+i9JcBG`ykreZUYey#U
zOu&idpD@`<+~A2zuB(|`K3^@Qx!^ddd1n~Ign!tp+&%;puRysJmP?tn7H9fQwOx(%
zKMu(_flC%E2it9*`D9Dak&lC&u}{h|D-wk}1KbRp!GQx2Ifnv?{ip9ocZd~@VG2y*
z<osyc&;pH96WR^O5;hZ^Li<Vx@6wObimCLL_|<{kYD7)X0BSxpv~1QDTsG)Y#gVsN
zDsNk|8P=rnWx)t49(WPQG+h7G-x(si3gF--K`Y6Qvjkwy;{4sgiuAu>?9Rs51x{*L
zpP&9&Y{Y;PZ)jx1;*!`8;^ddt1|#tS4Z1=aP4iz8vq(FmbIc8Y`T5j)x^Jv%{vqiU
zVJlol8)29z-Ykf{sY_(pk*Tv@T%>-Q>tbhdJ1zQS*j4-=b|y#2$r$b2waZ@jaHo|4
z$_oVU+ABdbRbMA3rx0N2#C=b38kSN?Z!hy5J5sOyU%hiQ-UYlq=@gKqv2>xMN$Ih0
zkBvSk)@}7L-!<D<ujAWeM+a7LUrI>tlm7eqC&k0+=u&#hRvtML7PJ3s)W1GHucp0P
zM=POHCA&ZIlCf4O_ldS8>9y5+b5-XS1q%{=(EeHx-h~#3OGcDU$Po|hNDrbf)?GFj
zOyl1DWeTMjL_Lr*sxXwlcKGpyfTy&KH+rY&BCcp_U#_-(ntKMO3!+*3ijd&~C?dgA
zV?Tr_pJ)L7hTcI#gzik{PgHgd&y1}L(pA3J%l#1MV!PHf<xGf(&T;Z6i!)4I<!)nb
zCU%1jB!zoj7`Jb*EF5!T%%y2FmLz*n)izEyJ_*2(s{IfuhiE$sEn7g}@`Pna3f?Ut
zW^VV%8pp==(q{TB4Qjo6<{F^1!r=)E`5$JY=B8NDB%wU^l17|1664e}*XvCNlEgB3
z$Zh=>!q+3H!!r-+3Wym*K`V`R`W(zw0zEw1Y6L28jExBV1+B4wJgg&6?i!ufSZ{k|
zxC}aI!wFMU)7ImK_e3s>u3NX*B(;Thp;lgY+g__C0kor{P0sq;#>!|P#poOwVLDgd
ztgiQ_@h01a?atp!-Pa4(`qU@50_)SsPr85-P+wgzbOcaxqurTTV~%Sd@)+t3c*~q8
zlA0oal+V_TI%c<bS~99oH*L?JDl?`2gpIdJD&>+Ey1_ns2RDuGk@%4`>XY%2G(+jw
z5&cxpIrNp%_kp=dN!t_I?fPcq)GX!vcQJk5^x)99H6J6D|Df9ssp~v&Hh@K2w-=jQ
zWwaMP4I}bqvK{4Adk<}_E}w+anj9i&-;Sw4gi|w=P|Eod_Fet)3XkQQb@=u)Xn-Ms
zN?3YmvKmj)1wW$P1D)#WCx3PU53?vDD`X#(?~$LWVhH<3v0=uuC6PSGB~|H3t@r+7
zbRJ?AH$BSC^pe$!ynky|=jKTWqQ_@~iI!>d-k$+qEphBVD)+k<xpwqifY_jwe4Ft;
zLS5c;I}Dyi;|=K9SE>u!)J)@2rykf<j}XT4cQ*GBzub1X^??Q$s~TZVA7lTZflT(1
zAO_}aA(f|%4=FlCa=dsrps<c~ki-~_5t+<Go6ll<!plx{pOrX#qWK%52iu%PXQg%Z
zGU^Ik8R5fIjJ{;<NYMo=l3%|CwFlehT}~FTen_wQw9Ia74&}7T@uq9|zg&5548V`H
zW^dXto%Er1F=jPBQx!6ky*pFP-8B??ZBdHpj5V0eMYhDV$DihT_~_dRw`mys0PN+r
zu2h)sQ-+vM^ZA=oT5qjtBLo)F>bl-`bO^z|_Ti$VCcevCJ2T1H@B`vT-RPo#x=guy
zNdx2qKeUjy7tGgLVkkBkP|daPpTD;<cAcoG4ln}2Up^Y;6B6<ia?^`rlZ_34%L&eR
zS2g7b0X8cTUF))@(Re)W>)q*OLTtWW(`EQdNM(IY<BVd5n*GegBi~^yCQFvTX8Mgp
zhb#L)2QY9wfe-yhy|QfK<AX;KkY$;ub_1$-QEnsKl_(lk<$$41$VWbUDwUp*5uA2x
z$0KlVJ;7ilgY0~Ti<xg<!E_hKA#k~Vb1MU;TpQqKh1HM=Qh(>povf0^C+NB=o_PmY
z9^76QRKI*Ztb_swjS&(AkIs$t{7rTiw?=Rgu%lV^^7H)svlT9OBgD4fXZype^3=%L
zz&$|p16_U%Kr-3DI7AyFonu1m`}gl3N$7?BAts2N``A*NjN8~h@xxzh!N+OPvL6T6
zd{tXcNz$ut7qAH;|K<0HK!(P9XV8JC`$O0kGKF$4w?9@L5Exj8w67<MS86h9D=JRU
z;1OITX1R+!A|9)<5>EY=X&$XP9AKpyRA2Lcd{;eiF7j>Emd_X^au=gOary>U(=Y^r
zh-*&78=s~=16PRi>z&Juu>P(kfNEUEoKkG?<N0%;>8sj7<^LJFwnsqOI}b9SBemIQ
zDmVWl9=nW2!U}eSkTL|97KjJwSy{)w>kLhX0gLt$5JjfnmpEd{VB6w45*-n7iZg%q
zI06@8mpQ37Ql9mjODe|<jR^XKIRb<R+R~j^eaBOud!1Wu?@(@^;3A36C^qliz5BDI
zvhT+eT2-hwXDYE%C&0Gg<!%_!V)x$sZn#g9FvkYc)_-HUBShy`o1JoNuRuzW_^JyK
zCNK!uci=JbD(WfWh2Cbx<+TQk)P-O|_v$pbfgR)nD+rlt&Vp~0U9n9o&@uVxf`*@;
z-~Fy~VI`0mm!Ql{8}aOIZ#S;J8}H*bA%_4<z}y$T4D$o$hM-N<@Gmv%Ay;_mP(O@3
zGq~GbwD{uUo&5cvkb+&e4MZ2pC~%3`9-Io}cOzd}o8U(_0tj1j`3o*KWT-^<$lHs@
z+DOa+MBf6wjeAhGLI_W)<nhlHaIHt*BGlKk-?bCU%@C3>Ds<g7%p%;QG_KNVN=FOs
z;$%C*uK+0qygBI-gNKTQ;{411MxoBGj76IKo{M%K&eGEl-h5M+TC*AiZ7oRgT2i7)
zb^zspf)x_zeHOkg{>zee0F;PJ$0qfqV3u>h^)l9j=duCJiP9M&xs>>Vf&#dH0CDXq
zy|xlqwt|MRI*<8SJ@M723xM}H^yCl2dVJG>l>RjoYEuY$&J(EqeH&tp;7S~YXZBG6
zRDCmD{eu3Up4)6fXW$_^2SU1*>~mgT+Z!M5?q3UbIf=`)!s%}TlSn=Z#63ZxmRXap
zKy_K!CmVsHKKi!pOVihE?bJ61q&@$=*Yci~r>G$B4uJ6|nCcW&SOR5u1(c(L;CX4s
zk}EvW1-3W|u@kE95c%?H=gL^*N?j-N?VlCW?n+`%uRZtVOa=`>FcGK%gTheDhdK%Y
zr(<Z_K*DCM>I*TpkT^{a0IvNmEc078{#g78-fC30q<}o^^ftZjvTGv)Sc$Jc|In9`
zzY1}9mW^G5SLo-R1g^F0S^mUWqe$Q5CxRa!o*2W!PT3~6Du7tr-~zPG{(g)_;116J
zc*jXq{0bwIJ>+A_^fi)K!5FQ5x&DCog9I=S%Nkmy+e;I;6i8gz(+>P0uHZ{ZhBWwd
zuyB($3MIRIVj3?ks`$OA`QnONcwNAr0kZC>K>#u%5v4eP(^t#qhH?QLw1YVC%!WI~
zD|d*6+4zp&EQA6OZ{Qwjv<-zC`F(%lhxadT9D7WIZmPPvIt$H)z-u<G)+x#Q-`{EX
z1ukUqi3rfqfyD{dQKN<q5W?&!P`@WbPlc21irbO+mjEoEOY;+RwBRW^xS2!8Sy5J&
zjr}lq#vQ+ehEN*U{yx3H6Pg*JCALRJxsO0;JO^3M@`oi<vheuT;9v$2JD7k}uD^ZB
z;AfM{x&K~jWrJ>vsQ)QP$G+E_kcD4v0!A7~nhUKIFLOUG<2R@!$YWe>i=3P&P_*vW
zz5;(H9KPdBo6qsS8r0Fm?*`l^hxMCB1V><H)Vql^RiE!Yov%RMzP{>Z4y1lq#*d6R
z3&jq@oU#bB4=liXl%<zXx><QW>|R%ZK!fF705>V!{re9K>cP4K*A`jyJ%_+ltdJv*
z7AR0&Er60=>VVo5H=~qMPr)7zMC|9lYz9IMXYcO1s)Nv*7>s(*E|9fN0U7fi`d?Nf
z3fwXdU{F6kmPWh@tCs<a>7kj-&k!hL58h=kpf#*{CiF09h3Pyzu)@g5pxLVDlcvk(
zyEeaeroQ<M{^FN9;sg!hsl`^^9E>|lgVs>sDK1DYH5e^$0HN0|9h=luk0Uy$<b7QS
z_U`SYuVWqxeiYYg5V^(9P;|7`%Hk$Gcab?uK2J(?S<3k}ir{4h8wISpi?blE$KhXj
zE*4$H;qcbGmp?Mr&NMg$RH2X%uO9}>PuD4kd#HsMA7C|-Pia6;bRn+MmbkzT*y=g$
z8M-Yv6BV1a{2*?$6Zi$$xnv9SV|A-J9#lF1y&)<7no*x4^zp!F66KD<7Uu?Jd`t&-
z_%Y$pILo(cFlN&rO#Il(^+!_4g+IPT*1$qjUHyIa^T;O>Zf9WhC$nYCd^?;H@-LT;
z=4M@x&zyROw9J<;0*7z$Qah}B*)Am4i<V9TiV^tlCP=ROZ&J3Bl!znVPdP@}SKy3S
zaKGRaL;wr79cvd=KN<8b?Dwa-S;5N<$ZXe1C}yq#<JJo7ERJvL@YBbPc*F9TCfdJ5
zV&yJ9ds{b<&h^M^#V`Ou1jB#s4A`uFtpej2$Onms!9CU0kpYWt@bVeMv?u+ZuAW~1
zLAftIPK8P+P``k*Ww5%oHmyMou`k-1-)ayh3ImPh_Ita_=hJz^ZeXe+dIci@mOwtS
z6OOTn_e@Xrfe6>i564z@z&`aqXPaZ18LT<TcS*S6ycq2TIJ63oNiWn+;O&SQIUwzQ
zQu?h_scWw)iTo3qD%4>RxJapRvJrv`y9=!B!P4s&sh#Nm`<&gfpEmaZ`t}&o^Q?uT
zb^0o~A0|&7p=|URoN{$gMYDBq{!_sfsF0-@<|f;mRs$Fu#M!pMgYR=r7aUnuzX2~c
z7!ZIP)S_Q?h3Wr3+-gZ5d(mv>{z9}q_+?&z;s>Z;(_6t!y;O(49|BPNeR-;cOM${$
zkwGAPc|v6#d5$=pJVosH?e^EahuI5br&mB3RuV%?iC-1D`TJfrD1pgc1fcKi+SfME
zXWT$90-J{Q^O>g?)$SiS4g>0yu}esr=rx3A+cM?KXSs$?oYy!!I|O5??2M210%abz
z-GsOK_r<s<4hku<U3MXaRuRsCk=_(d9p-b3M?o=C%&sj$TRkO>r_)xV<c*Lrqd@}1
zQ)Nv}S-K?3xY3S#e?WRomcySAd@Yr4H}v~6n=Ov2nu}y~JQn32nn}eTgj+cC5Pnc8
zXyAKPBk&O4?vViJIkqe!`*ZD$lQE_77rz}Xd-^oLqW1V!`IJ|xDdwL+P_?281whDJ
zgcHRHu6?xb(-Uva-`^r~Nn*R{%ss3Nq)L79)o+T7067yBVlgQ*@DjLrc;vx2lL|sE
z_bsSjGwH|}mARA(B$5&$tj@>%rIaw_qj5LJM#-*(JQ0y&bq;FgK#-e}?t_h5=zn9^
zX(ceGs{<1j)pH`SRY$9X9qMj~F98q)qf7Bi^Ev+1gK<PPX(j5D;IdG_6BGSpbv4^_
zyva$;po#%Xo@}(CraCx-d&mA;p=Li-++Ee&(-*87_z0vn;6CP`bW;41|GJst+P704
zD3tt4xI!>oTyIInsKFZ-=;t@yT5X)O9(=JD+TnumCjVWIR=u%P&_XuCtV*yirS&vC
z#@E<D5Cid7L`amc+C8)(D%NFbO>-Cjr;$|k*A93DC0Dhk9W(U`j!{;x;zMi$v=cm+
z|57pC)_=S>x|aIoO(=%>0ZOZxbP#q8wE_C#DuBoVgOb1N#dPgjjcVTeFZVr2`bGdE
z3I_klUO|6%_m=+gP%{3KVJY!Tvh9bW;s3gcR=BU+E#IKVCI6lRAXbG0q>`VVNr%1x
z%ZDXhHIkWpGC0QuTojr6zQ8@d(sfeV1>n^R3)N=u?%Z@WHd?q06n?IWj<GD=W&Ih_
zRyf2WhS;ae$0T>ZP;FMb9F54e8pQ=pNF0vaItW`$-BLo1h>Y|ww4LE0FsXt%mRAMC
z9r6j&5;Dxyk=-5^jb4J3qgS5Js+aKX$g%2izwZJET9(u<T8vOOEQ&OheW{x}{C1>Z
zVMyv!<-oFpN;Y8k--%KJsF>xi5eGH=TKn||3uAf7dq5fBU+NIM6Y0624r&2YIb>9f
za6JV#G*bU3lu`t5MtBy#6i-6un<JrVTJvcaL>=6ngr)F6H&kJItdvVj0-fa!(SGOR
zJr`~+X76Wkju2dXAB;h%-rxiUCBZbw&n@%Kx9Dp={{C<O-D$E91>beoFi5)`4uuoa
z(?j>!0vw!YO-)lzzSM$0_s>g*`JY}19s%F5-(z~;bJ7k}zdQ+7P;8-*EU**B`9{I}
zb##b(>abP;${znqzFuW9lL0%8@AupTZ<h92{|zFLdxrf|X-g~~jOgVZO+gyLnB}HX
z+)n^vPF~cXFH*2t%30^zdtJcs7Q7AAKSD?x>g7jT@@{?osZGkiOY%+X2HwTy-=Jn~
zflvr41h{e&2|U0P=yHBdCx@T}R1FOI*`T-);ML!o`DyXk39Ofw$=qk~8=H#1Q2PY4
z`_)pjq^;#FVJ9BD6wrd)WjCumX>Sug9fv9qgA<!Lt05H!hOjPZFgq#orGbGaG!9Vm
zc!uV61aE+zEhKL#aaM^QSF);I3gx(Y7<wA@$O+gzSsGw_h$TY<h70lv{dYgUjWnlo
zKIcylf@!1@7r{2LANOVr*%%%!X%PhJ)pui$tw1LEO#-kwQZw}<aI^rk8}5C|9w_fj
z;=j9GUGrZf-3`j6oL6t%fG?_9Tx6-fckexj&=h(&1x;)`bfc0Z(L&iU!&Hy%<trZ(
zii7#?GQUUj2;Pr~vVl;*;F24Fts-q)-qIdk_j{eGsJo-S@8$1zD^^<44rOj%^$V$B
z;jO8I;o`gKLPBOeWTrk5v^o^fd>3L>vV{fYp<@ZDTm7s@eqgTcy~o-lFbq5>jnp0N
zn8%MFFaDJVlgKFP_<x0sD|!NJfEle0`NviEJzbU(5dV&p$l%%944b$hC>Upw!4a0L
zUz~6US(tT~3wu+kPgm#?ZaCfyes53qfaqn=Tmpx7Yc|L{JTb?>E#-^;(0>`UB8N0H
z`ZMtvP+@kDg4J`6&oi)U<U_-ZP%waXLfZ??CLw2Nivm)@{vN5CtZ*I=4wzF)AkMn>
zv`s@}{pu6N*bts>n!~B!3m2BqDtK&As1@RN5Dxg<YUX~YWzZ^jrw#>>tA;~U1Oz1L
z6z4c&e5fBJ4i55=TIjcZn>dlZ(VpGDQ0<yy{>2yb7HOveXM*T24h1q2fntT(?XJ;0
zJA~j<OJ4(NuG$9<{P6_R2vuPBU2O2GA8E4c_l8pbi7oL+w?fvswf|4Lr{plwtM?MK
z+3C97b7sWQJ<RSN)KJi-|5w7TaVRQ^!YCvwqavVI`3xStFu{UruSzb7%7V1pr|P|y
zH&1Y(v|lYCkMyEhH_z`<yI_qvOmtUDxdChbIaobLh;EArbVU58^dvrD`Akup?)z&J
z>(wFL8-j46he*%@!ZY*>mhUnE|84+PA`5Im6ufY`3*8|?kSzh?(%<z^L+kdZwr*%X
z%xP9uIdq6d=CzdfnWy=bO+YU5CD8PWp%aALyOpH>*FD^CPnPrJ^-=-$j2YS$U?-G4
zMbJkId>2?C8aomOTMsXN!{+mFdIz_;jGW#o@46Nc&|-yZ9O!xV?CtHX#O1+CxA5bK
zBm9Xom2_p)AOAzxPC&+T-omSH!ot98hzTC>p78PaC2k=hHZxf{61osBMfhRa{&8bh
zBBEk-T1t`=$@5IO3A3Sc2b{@@FE>~HlPs%;?q7ARAIJOxuRlnVnM6Ot07XbX%Ha1^
z6KRF9@plEJ+}5l5q2B_zvI-wf;_&Jq+qNZQ4ESf2x1LOieK@r8-xop2@<nY<${SX%
zYV$v>27qeXNCV>HS2F}^gsVMa%4tXO|5m>%AfrxA7x=!tU!EfpErcywwKH!zS>gb2
zx}!D-qQBfQa`z2{ky)W9tTD~gwPmdZKu+=%kQiB<g=f?1GoGmrB)EUe50@0c3%;JO
z{J=DcL7JA_c4!gvX&O}zt>=7KNF4ombj_Oo+QK7i0}nc~zhtevbeCWV`I5l;gY{2M
z%5XIdqOkR=`fHs!$vII~|Mum>PeG@N!*|iRPK6!ezG^37S;hR+eRs*M62$O8-8%^n
z=DD4SUNAOi<J_}ZR$%`MM@T1g70mnf%vQh$hCy_&S{`I<oO?gpOZ@lAbXyPI&<Ie-
zWZ4VHIzlz2)@m6T$f>EQAcQY$aB_{WQGUlQLDaOEpdsuD4;SLj0d%}`7}lduo&EdI
z0YIu*woc=}wbAI+nM%nltqhC*qw2fksqFv%50M>ZlhGt2LdaGbm7=?h5RMVqvgaYI
zQdCl+vdW&>^VmZ6-Ya|W?fhOB-S_wNJNM&p|D`jo>w3T6uh;YS92jhFZk)Ju6NF~c
zeyAUZ_Tv2N7fsaD0QRqZZx_g7sNvC&fOJ)O(|D7RI}*RL@0O4vY%^v=<LK+_8#m}^
zXZL6Gjn&_$fuDcgp)XrAMTNIi;PdOu?FJ}CaS|?%nahE0P6!fpj}vgJZoirg!>uJm
zyiK@^lEEA`TUE#N3vz2n_mfjn@~0-$f5j7O6zeDt0@u~ta899v$xy-Dg6Qw3c)zVR
z6jEUP4k@0%xKKSaRX!@$;F!3QUoH(IyTrY*KFob&3jixycqW=(sTcb|OEeSA5^uf$
z=?IvFhg{cEKDG=$0uWAV*FlVB$k_FN>J9drtM6rnI1*4nX<K8XRj(2qU`>ic3Dn3H
zj@YG}%4`hgoi3oHdPMaL57qn^_Wpi6j}%9Mw2|q_OF^(dBAQCT8KI(OQUWaN@a06P
znWE<6As_)6#ZbZD3Ps#ZhroaUpVtL8M30k(1^e`?U;ZtDquL}(9|Lj?=Bhy1e{TUZ
zStj;PZIVML#ltuBj!pcd*>A#IiU<agB2O%4TWNq0>BtVkRsk;YIQjh*>Jjma!@Byg
zZtx4Fa7gL5fPD(WGviQidp(}At+#)J!XCOoOcM+O7Rmt-{ripenzJ}<+}tEWfq$GE
zK)Dg$y4~9P&#4ti(zTg}H-)o-kR3Tf|KWb@)@0_3SrdX~44?0=P~K7+)|&VCeRN*J
z!dqHf6Z(vuOSJ<gG`{NIOV;C1&0fxqDCYRSLkZete0V=S4PVXe=oLU9z^VhJ%L#Zt
z!5m@Pdl=wk!$|;{LpmuSyi{B0*MH!o9_b!|4O#jyaCEH9g_sfz7b;{Dt#uL}LP70@
z<NL((!tmWWR3yhy$FpMide`u6(r}QgfXPNXz7l{1`+xyl+k^owPGj*tAv;AXRBI%7
ze`_G8ka8d-k;$_0ngi~+w)&-oH@?FZ_Rt-Ymi8h}IDC&Nr%CJsn-JHm<CFpC;V#r2
z*fzM9;HL`pEW`iSv+Q!v36_AdMgd3uH+CMn05mk6h)?kV4ELd5Wd(DI3*gYV<<Cxq
ziljfhC{r2{W~wEs%;~1tOz}#VE)g(5B0Dw;`abrECS9lhcH>rX1?LLU?T+2P10Z1C
z1S~mH+*X$mj?oddS_p{L&ffyLsGzFXW!nO1a?-yhSEF1EXKkQEhMut>&eRp1l*B6l
zMEzTVv%d)nDuiC5!KeUEMOA)E7hVl;eQx7@h~g~RzSi`R3It+*4Q(&5lIt>1^`S(W
zsEGa+-+LQJ)^Onu_dbV)D$4)*pMF(?FcR)5Cc<+1$94lyOUZU2<&|SKDs1+9`88DJ
zr<1Vg`EUN?J;Fipb4)-6noH=+<3)17z}%V+|NZ{Hdp2s-+aM*ig^T&`qsBm^%G0$E
z(*sJ>qwE#ff!L;C!y5s@a+)>Z%a0*v<e&^3O7e<|=8|yVy|4Rt0-$>Y&4iRoGff?b
zPmzT(&Rdrvu&o_G86Z-`xL*Z2ldSCouIqn4$NB*j#}Qa1-g|3Jv@=k913#e;0`-XC
z>9@4AYj1kYMF5WZHd{4|3jiQ^AK|;5i<-xVHB%-KrmC$f{tRT(BlwkjHayf>b@EoR
z=)a(Wr&l_-cyW!Va{m^TmR_8JE-42d4%i?sq{-Pv3V&imI+A8eJa(kc8O2KtNWz`p
zPm96Jz(O@)x0?n~tcaxKS0DFh`PwqbobvGHO(XHBg#o~HUNstCoexk|CRww_CVeqG
zco4vDfYv7Yzgt;TF8vdRs%+rxmhyVJ5Bh#>P?v%;rOS+Z6>QK23jg67hXcLtV$lp0
z&OCq^zn3>5y&YJ8RIP%Wb>(Wr$DOF3a6kF*Wst*!voc0T+2se~6BA#SF3AQ9oNr-n
z&SWXs9Z-~jJ7a#DMsW5s{5!*PGD1r6eF!dy$Ze0V*2=YfR0T;6Fd;LS{XTFE)%@o0
z;&Oq?Tv!hV2_p){A-Ai*cvG4Zxo!i4aC8IiRb5^EZzr;M3V7y)Cieu}wc}L9_~-&W
z@E=-~{$m@xh63zG=&*@@k-dC7$QC-Z2e-7D8SV(_o#>r+U>LxkjY-)AH@Gbn<m~82
z{)>|6MPIumE#mCvHWvYgsQzJvu(C~0((&-{#24fzqPD?lh(l-3#P)N6vNRDuREOJU
z^7VBr_ykJkbnr)e{hYQF^V%^<BGeE{zjwS2#0u?oM*?aTzcnD|2U0q7p})-_N%X=l
zSi<{jZgtD0lp;Bge}~8K<qK@K6eQF40TY1WbaI4bfwT>pu(VT5-vU%barl@c4}zWw
zf|~H&Ztwq&`35Bmn8v@xHh~77P8c{;fXryeMYJIY$Qi@_gL;3zf=O{a6xHGF<9tNM
zPvHTe-E-)diHea`j(FDqI0@zM<st>|88|=c=S<W8EsPLy%othJSJ=(v0&7RB;5%Wk
zKqm*X6yOlMre_RIsG}SC0u61>{X3IVX?;b1pVFMdr>nE`a*+;DpWyCW3a|$r?<j*k
z?!Wc|6n&bJ3;<V|Wkjd_0plGj^fzk|GLVoYKv$`{uWcJuMt#_!N+0TBh<l!YLVz|F
zRlL?Q`1*~FjeCGyy6kObKnZ&A#0o+v+V%fZ?NNC)J?6p*x1}H{912bivUHeJg2h7+
zbgNfuJ`;GJO?*E1a`Ni_9)~PDN=D@H>coGqAAMCWorn)>KXGYwswD<68*VVy^I%g&
z#>XeX7TpalU~&g6-=o)Yxd56muwY`kX&Z8j_}7GZcKm%VXyNmfTKbJs)MiDcuQF{_
zy+MZI|IV(R_)k}lTL#Z};?KbZdZfJkI?%(sbryq&y8pf@zll^H(4aOnR=?6sF)}jd
zQ_ZzR*8rG6_^#0s&g~<7F{V_l3Mx}whILDGbM0;$@C!_P@%hUayXiVvO^d&m8RZ>K
zrxzB3G^1^LFj=(f%5f<C`uj0pRz;A{!#?3Sp9)Ffo>7PBg4lGObhIiz&_Q#7rUGt@
ziQ1N-5Zud&vV$0NO+xnB{|t>pc*7e^@9PU>fLL)uBMQ{SEI9rGu-bs>Lu`%dKCNFu
ztMv3MS)lM8Ayi-O^7{bLh*K+sb(IHWW<*&+$X+}SR+Ep0%n!#c$nW=*h3FcO`=eW1
zTfXyj6D^RA(f7O-Di@6uHH!%LlFg>W;lxqx#`z-&l|XJO#IE*KTbBZyFSSqG0hnVC
zIYpG|ZIVBcKRtZuHA5l(7)-TDaGcG-4Nt^1yYsTM$92tw!#(hY!gjN6HGE&EKWxa4
zY64zD7cklhF0=gc&+=xAOwXsf4tUt0Q+5P=gboc6B1dnGI({Lz)+a3Z_xLm62*%T=
zPZL0gaVrw4Lv9Ui?KQqcIgJdBwZ5xFOcEoy2+;qxEYR34O9PwjOWHl%-FfN3T&TNX
z#f)cDK-k^g&G0{v#k3v1>IHSDNnjmW1x)Z(fV1%V<_BCM+S&vC0OKd3{;-){`EE%{
zhFs<5BT(e^`)9erDB<yE+vT<p;|`_9Ldcc>11MgrUI^0i+}=iJgsK}P5bUwv|APw|
z`ft~0ZpCja^FBw4y5UDhU@lE1)Q6|yyG}q2TPw3QJY1Ug`Wg(#;ne$gOD2b?FAXOk
zg-ED}g8zLrpTp}3!3t>N3{x|E%#Xj3uV}JKB-Ds_s)9nDBJey!oKNNEw1Rf`A*p&h
zeV-;0C|U^5kZbsmE^jG_P5#{`)Y%!>*fuG_oC`9S0B$zsErzl$Sndt52w}vJTv=cf
zIUUEBfsJuWW2;83IG!feL{$ks4_tF5q0Q*HBmM$Jid1Po(aryE`H@1%exF?RI_FaQ
zb|XBEB8W*8gjIjW!iQiDsLrF$04wo`eX8$0lDGe9(Tf-6$PZD!z#faR8_;EMDEip&
z!@|Nyuf{LfiFtVT|IfL{0EW<Uq>~;Q`a;Ij&`}{i>w=Hr5QY+?_pWUuj5Q0|o-53=
zt%fur1?%5=Be<=cBtvzWW*gEJ!4iZ3c>k8+Yp;(td8E5JIfWLb3KSkH;ZTRK<DmcD
zCJZcidiW_E*E(jB1}r&NKf&+N1`*PADPelkfOG#%sKtbbX$d_K)rK<xDYRE+LQ-Js
za)<UDz($zJ{@bOcT^9~7PUpM=9$ODrU+PdQz+nV7aAb>ZdvQb4x2D;!e6p}<@)3B#
zolIZ#9+Z!Xl1*dVGL1~0k%m6I#4Q!%RNJ!au-z92$^JV}_cF=tt2H2W9wn85-_@i}
z&<lZA;DrQI11P(}wvD#ALX?1}dzS@;dVDk-jlr`_T(qa6c#a^9A=Sm{00w@+N{fmT
zgW#(i%wZAnnnj9Qz<(d29t{s%%a<QO)b}VseD44)GfRB-Eq1%fPSp<1+auuTUSg#M
z^j>R7#2N@aC9<){Tflypp6lRy{rq2sOzB<7&_PrLO_Qs)qH89^Rq+r(AB??q6n7Ch
zAKBT2|1+=RN|5SunZsc|!w?%W*^|pvNiq;pfe1Sg=s;*l0TjHrK`6zK*BstE0Qw=_
z1nQb{&@A??1zl(yyVe9%4KQSt1|KAK?DfZ$ORM2=W{aLed6FGnj`uURDK+%?lECZ_
z0x-;-EFBOkCB(xWVeop{yZjHJvG&DK=o2F=E34_Uez%EGKe!J9whYAJy@H4us1AfF
z>PF>Jr9Y0|+3r!(EMRe;Y7G&FvwNbc3dGEhs`ng1=g9XhWtX#kUk2i}6}KaT$`m@1
z@QoVY)Z8481_<Ilef;<w_$e@|QT;1wDVG49ntK`?^La3kX0tLk&jW@2CYX&PP*dbE
zGBd?UeyYFV|LpGt;YWc!Y$y)EfoNwX>4^OF^ta|(nwl$pV68GKyN-G98wf|$Wdcw5
zI?eZqVY^QzRe>_Zd&o^HjaI;8Nh__(eLVuI*d^Gd79F9W8-i6IWqA4M13bN2`wfMZ
zr=#<K0~-i}nxN$0&2Io251H*J=>NTV{b;n#lb~dn@Ys>c+}u8Z;#o{t8ifOdJ>**Y
z!qNr9)Z2rCl9KaK3ha#mzWnc+@ou-w4X%MwFBNPT>0nUrT8p4q&DX)-|JJB6FoDR&
zI^H66z+Z2MTCn6>zmu=6CT)(><}C&9z(BB&^oTr75nExR#{v}#1S1}OZ<L<r-uGB8
z)DME3DH}xUNo)eNBN*f185R&~$n5fg?3Tb2S&O$_bhrt=dvrr{PI?T91V#{Eyo_E?
zU;&tTDV5GJ{C&r?=M$H{@(oj)MCpe@3Aq8imb5YW-ABx60bBw3Sb%g{(;mL5Srou>
zObh{ae@sik^Kbx4d01Sv9uT1haWMZ=n3F%}3Q6K})-J2@cLf&az8NVYvaA1-@L>)J
zIbo|0QHo^jZ8g!Pa0niChdvKCI*%8$phO>n-a~iJN$w4pcdYMcUwx62gN6aU6aj%m
z8a$Spe<inDt^0`h*U{Sgt%Q0&0Z=jiUj9m?(Feh*az_K8Hc-~C@RmXuw$z2$?_weJ
zgp<6&NveJE#t$$L{>u?iC}X2=7#r*=Ax~9<3(f<qkrG0UEMD0DU6lc43?jkxzve61
zDjxt#YusgrLj}-X)zGzGL{nI@Gm}I%5{gE;EYJ?F{$A~x1-`a@gvU+-_L9(1)#0g|
zyO8)NEHi6n955)4pQ`}tm$W(yb!|WVRWotpzkQi2r{F^I=nu`5op))F0tAkQ5Fm7+
zDJU?oA4IQ1%E;KrVgFE`xHMAnXL~XNv)}=qG#ChwL^RO0KpI&HR+d^uvlIIHHNfbJ
za+9;tj?rDgUH#~Ov(K-stzA#&2ouSiMA~VL8)Wy!M`xKVkAZuhF4fc3C<G5Wr1;UA
z?S`bH+HXXD>n%uthUUcyV43cd0W*qJMno}+-psy(#k1vm)&B0LJG<h;TMDYr{HhQe
zP%Y0MgQJfdzUB*e&*Ps59d$rmQN7kD4H^I_AM|W(SIe1cP_2+|XneF0BUX^K>{`o!
zdS9N4LDg++IE2C`<m<`v;u)-8O0@qorwePloW$o7PYLmac(zV%gUjfysm#$Qm8ya$
zQko;dxz0^$F&7-(=p=Lc=1W#X5>P4(Lr@sh9Z5;m@P0`$P910317sUl1V;oi>xKzC
z6!)^APKSwvX%9^zeluL}LAKbzAoZIao>E)G$2O6S0}}FV%GubrZ+b0y4vMGjS#Hp*
zxq$yyFzL;K-Ran_<TszBaEWu;Ym5%}0IhUyn&q-%9dcWJBmJ#$7rv}=<Ku`pEs?L8
zIa(La_Q@AsIsEFLx+M_x2aLb4xHa2gn5$n7ZzzDqpKb1QL<E)!zqK4H{yDZJCKrip
z#>$SC&qD+N_8+#MAD(mUjhRrL76v~GIKTX#KfI_u5&=j}9G46{3S|IZfejpAB@&9T
zNb7k^z3qM;A}+8)B3Q7~%b+oHKeKk$WxjZGa5ajN(1hl7%c`BVd`<Qy26S#xSuyTe
z4bN|=N6jFpEIqz7-FcUjrtYz;&F6yxlMG-%h+lIgbfGzMs9Xql#}vmdMjP1aQXk!u
zy`NR!%NiNP>jbQk2BVo}@YgxD@RF6NWv?apkFo^Y?Lz_=9y<a)nr8=C+EAKHucSQW
z@+y~sxqRwFu5EWn&kV-1f#K+83%l011B*@y$gMb>_dw~e?MkRg<B;#T_zjz&+6~SF
zdk%z8c&uY4NvST8$EXD2%j{@1&yrTZP@QWjaY=SC*ij<1q+yy-y%bMhtX_87UB~f9
zH2qWESgQApa)|D?=|)ZGWVd6M@Y8AA_Nza+6iCUZ?cI%$Tu<ah{svJi*Ld8^R1f6{
zo3u-GNUfWMr%p*72NRyPL&6Gqh?C45QE|Z|+-!DsHvB!%`)NQduFF8YxVQ-9K01o9
z0jP$AGp<k2v$JSt+!iLSvGcd3S;}A!N*uMr=I(}0-@Zm#uaU&(nvDGn0^SyBEU7B#
zPj~yv;8#GpBB4ynK5vG}+zH%}<RSmjrP}kWQTGhnD)@u$*tT5VK|)TFeE)X89w*(_
z*;KiLCb&Sye*>GL!2?N;?&y1hsSX}!yz?nokgOk#rz&rc#)=>j=^lNEg~l+P<^YwF
zC*wCmylNW0AyndQoJm8%Iw|mcpy?&mf60|GsFvSqn=ODmN{*)a43>J$XX|8tzI%%|
z-S7$r)x^an+M<k)Ms(fNspRd-1(KgjyjeH~>bQ%88XrX%&)2mVD0Mt<En`QnEef@_
zVwBnQXBpPr17gMbk+#*Z=gysz>Zfk7G1WS?2E?g{s%s@7-Y68-lE4#=IF*)C;l~RO
zkjtoYI0F9-bu>i5BWw9JQLWS-j2*7~$^qMm?<@0WPc`?)6UFiPfrPs4bhBJuOk@<7
zB4c(zrY+s$@R+7KBk{UJi51w7`MT3I=9{88_rI=pC+@#^F8SW_%|+5(jl5f_tGh>7
zsvbW=xoQGB{4>F@B&FvP(A5B=Y<Iq8?}@0G*bJLOAEMl)_s3kn4m9$=(%uW%<yGJO
zp|&VVNpLZMv-wjScp98i;w>E=e!F8XUgQGiJKk9JDmK-EX;q3z0bRFcU#qeop1%Xs
zHX&YPiqr5ztZmL}yYuYE*-7h=+ft<LmuQSqDriJqTAGfUq|&4)QW?N}pV~xE2*X^2
z)^lTH<Gp+I_Qj#IJYkbC#L7NSMoZj^uNY2Ah>DDO4gZYctme4>xaHWSEYwe4#7U^{
z*79*}w_r1_`e33mujL6<EFm}xWz&2EOMIz=Edxy2(B1aq$!uo6KTKswtKv-??-HWz
z0>$V-^i^U{<XCX*`hK?~&HiJZ3v=Jy3yw*{QFti?ZW;3Od%=Zzdhch=Xr&$!YhctH
zEe|DbKWq$Cxd$r&=h}EHP$<PC_v_m*tg5-C`a$&c@<S4BpxP0J#KfFi@7(YPF9o@T
zes#sNkV41B9lZb#kzESfKxbqt&e0jj!hr$OESr|mH@nE{K=;Ss{$8qxksh!coR$gP
zD83!4FvRCx1f;B%ZAYsI-B6PCfX^<wbDC6=?$lHw?T4eU$}b9eq6hh!p1{YNLFYl-
zJv1x3^RO`;lt5|c8w5g<hGQpp@K6%ec<e}-nA~LVSgS?Ij}#mTW(4GLMt*Q90BZ)w
zw?6M}4!W?BHPW#u#{vj-OZ&6hV;r%qawjb3<#k!olK9pj-^Wtm!1TvHhU>aZvA9rs
zQbFUYkN2Dt>D*e|W9O-#TrwLyq)VK?4b~((>Xe4sQX4=GWIGbtdG_vNvE!o7N?1u@
z_FX|zwL|+&d0+Te@bc6R<QEVY?zBbgYvcV=c0#a03+S3n_s1uLqPM@3*+w4{`;Sij
z6gy%?Jjf(21cPFM7lS=L%OKhi`Vb3_4?3hVoSyn+)PxUddhfqgDEkQ0s)*U#f0%iT
z2OmFHpmpS7kJ-?2i74kGCBMXDNQ<E%Xf+@-UMtve1=Hf-(!iVq&9{Tbyj6B-wr*<t
z@-^+wn&AS3cCCvo4i=dXhVnJJi)meLc;D?b6jJJ2&#+5&ZO;nQF10v9F491<*!#v?
zHTz&NaM>+(;}#}RvU49%ejolu)KWc_#OL2dRQ;ciIFQ1a&%e<CM)i1jP5A#)#wJcj
z+lYr!KEpx^58>^i0=Z+_7zp1CyU#WUNIp^X__J%GkX``B%Y?wW0jAz_C?t~yK_UAS
zJf6T^{+pzvWJBldI(E0g%EPv1MAJ?^=GFrZ1$2bYe3r|7&nk#ItF%+^%W#K7^vb-w
zuc005hIX3ctYt;VY~DbJH~dQDHL=td<IMuPg5%R4jW$?RXSP#v2cJRWR+%rI?zC<C
z>}K*}%;r=kt;av?w`-1y$I>MFhMv87uyEL{LEQ6e4SQv&vNA!YUolk@19S)t@vx!k
zhg=~l0W1Infy+RDF#dI^tr+Kf_%i>EA@z@G4<v17*A1E85MnrSus11f9PRc0iO>i<
zA++<NOAuBrNFjQ64or<W@MWBM<$`Z5fZHTJzQWOkcC!CJLx1TU&6L%tryK>@(1nXZ
z+dK~(*IEcL0md&!Sl=7~hlsYLx29(w#srE`vy>Vg4KUxO9mL3{l}mGZCq*i|_ybqf
zB1+S<777+hic2Uv=qEh8-X&6}q^9nu=_Ab&=qXsGJ?4OG@i?vxj$86Dd?|!KkFXZ7
zcSEAce4kJ7cms5m4pjp}TiXRn-eNYfzzH1H9&q~P4oljvdHoi8+&b;}aG!Y@_h2PR
zbtr2^ztqva3{7G`UfQ{A6cQ8Wu5~zTp+}&wK9Cj7!A6+{EjBP&eStC1WH7Pnj2%ea
zh5^K;Tf~Iaxs7&d6}`hz^5GOi-lHl2p#y^h?So7G>`X%bFs0*)@PWaLhcQJoVp3CC
zNpQ@dsFP+dYK0PhUUN7Xs&;!j{}@WI8MxxmECWV<OF$vv+8tkKAxwU8@jQ$I+!&zE
zRw85F_h{*l<BHm?p`%00*Z)F^4BL1BC0;^31ZT5r{a_hQ{w+m2HN(pe2t7?>&kB(n
z=&6gBz5laQmky|8dT-$*gZkGt@m}i35AwDj-^h=Zmsi2zrCZydW5)VW)pN9N3c31{
zNBS+fWBqx5QXncArJ^Y$y0HmP7LY={RReSI%N{r0f^)!)!#-@QLs5M{14f@H?+>+x
zZt;_AYY#)}*1MIT0ULf=r{nkjDo{JsFMk3(&IMeFX?7yll<et)C}doib~G+b#%3Qc
zWZH_wmy!MPPs?z(B$%>8jqY__<{yZBCk>}LUWfdgCGPhpP}9<pTm&@x{u%%}M8Z((
z{0nZB5uE({^_O6P<09D)?mn<>*SbDjhX&gNw>zXo7zuf88Ko!xC0tC!lfH!%AY#tc
zotUz8$_;>~30e#-sVLs=*D+92Bv-&VWb=OhW8^bS({4ESr9tdc4<JA=k3D{2$MOD8
z1SR_eA=OxSS6A`oXnA^nR}j}d+^<;#=7?$EA@^Dz8G10lh^xf_IEbqJGyZ_P!8h|#
ztBe0`2`wj;2?iq#MMP_<7$bYGChyVJw4X{Ob&WcUTuv&WGuZ~iY#Y!8801zMme>O0
z1dP;uOz|#)f@L)V3Uzc*^OeucaKba=u_Nb_3%T`;^)ekW>p3@!z!$&~J0PS8qa}b*
zh66B5YMI*+_QY$iLx66NG=AWd<<kK#__xQSI!rIvz6V+Jkk$`dNhuh{!P>F26G~W#
zLA?e1bG0jYL05885f61Vlnyvvkx-Uug{OA;Q_5aST!=uyP)|?G`7|~eI0x@X%$ua&
zP0&WcYm0VDbsn+C_ms_CN}%I__78w>v(yJ6zpsA!{97Hi?hCeGAJckDkdgoA(LtMH
z*`g=%`ct(@A5;uL(*q|Xdz=Qh5zStU86YhO?y&G%3r<n~d~^Y>G}MatU|Qy38eSbT
zpz4Jf%>ZWVVKWLvCKrkjhC)z}1HNJsxC#u2q`k4xYj+W5&tGUz^{vi2bfbvf+CvHx
zV0i$D0k&2@u~=NYrzn$oCX$DaLU|DGsP1k<FAiv>_xpw?_Vj?z0H`kdn_522Ob1jq
z0R#ZUct{g^J|vWsdW|{cwEU&}-94rUE>Q*P#jtD1F2USh6d<MCr$!CXBLFKFd4JEY
zh-~d?d1iiq-l}j?q)>@R<o=#qMf^<soujY)mLX$`xpo(81wP?}#;XzUb*KQj`gf33
zH{imA>Vo7i4KM}(Iu0w_>C^lI$QSq2J+oia>5)>hL+A~c=GOGaV`x5W9pK5Vfla}q
zEM`LTDlQ*<vNpuw@BNO(vzp`4s#nw|)Vzm)g{k|1j6bGB0FYiw5SYOIBZ49O!q%23
z3_%X;*ZU5yPto9IvTbCR!f!I5S_?1$AAu`8M7FjMC@Y{xI{ydO#|#^hvJXNj_%~%X
z#k%Egho|{cI3ku?1m8x?U0P3oAJ$cxyz`oblMIn7Gkg^YA7dqHPrYtoXJp_^km0|2
z)oAq#OkHejT88*|c^_SkEba9~ghkej`0y8c4BPKgDV$(;6<ASq)`qS^=^}OG@81M4
zCsL=Vn_L}%O;=P(Dz!uS^+%-KhmT0+k_MOaOxT!J9)?KheBq>@;DBL9eBwkRLT2UT
z(E&Uw;LLvbXw|#_LnT}Ex-9=mQS*jVi0C)$UsgyiH&9i~Rgw=CpzzjRV?XKit|RxA
zuL{r(82<73Jdbu(-rR-h=Jk9rgzK{NmpsVYe>~w??g*G((13M4((Ds?!hkJHvw9K6
zHuQ9)zJ`+kLSmGWV-7TRR-`zIq^hn=d|*0g#{qx{1OfqdXJm3948*f10-u3LDAW$}
zzq{ebhS+$10+E9Lrb90IG3cz2*aGs9y!SzvcpO4|10OzI_l~}T+tWz>42Eu3fILqh
zGeACPYd!CF-q9)seugsd?Jq~wmvX}+#8wyv(5!xs=dtf=Q2$2S+&1-O?nW?+N^X59
z`~83f(#+Mw4x=+rQ7jA(v%fyx=E0sqrw6!^rbUI~VI!+!fGpz)sU6CMro>YOs8ahE
z-U(b2wm+QVQyHPWHaQSv!7rErKm~i5z!L#Lw`&G<Tl5^Ewok-u$=VEw*i*c!sjiMc
zeppncWhAL>=HFHUqQs~5YGx}FDFIk`>rFBFN<*-TeuVE*c63XEuhqLrVbBNfXP}q+
z3sv27iA?&zhxBqB8-Ke_q|`s1bV{X2D_-_0a%G0QM!0xOkrW_sSa7Z*JL0|P1Ehy!
z*G+~kBC;IG9O8e@u)|gQkH-8k>+D6H`BT-hk=9_quvrNh2mq|OA3#PbP6rYT)L3Pe
zl{W#C*Dp-hK3rcq4@hy^+1d06an!rjG`k;^4p6V&%YnY!?3>_k&>>6N!g{dka*Mm8
zdV~J?|23t+*t4Pf^{F8R^cfof`ci_Mg|TrB=p)X{vQZ?10w$n-PC(;ux9DnDO~Mh=
z!o~HD#E3vw*wg=A(+v!}TK0ZK%(e@w3M;FlG!c*<n9~u-KCd_7N73WUz@m#cd20rK
z%EPlT6v-phh^NyVc!&ol-H`OcLii!Uz)4b4IbOl+PCPyVY|_ZU9%Tr!sxa(Y04oT!
zBYk1O0O~CQh-y@q4w{h8zGWM(M#}<>r6U!Y0rz8?JsTVDG}x4o+O`mGAlWVu19m#D
z(&580V=_NH4|J4UFf#6``?L%N_On269*)(p7lV;LP?~ZM8#Q1oZU%9OyrL7IiCt2T
zg9xJYAI@W11I|Ml+7Zi<S7(0|L`fiZPUr{ahqa~ULU{?u>T*%kAxB{+Mc=;VrqEj;
zx8r>xYVDy`8qh48xlp_iI27K1Nz{M5B992nS&t?z)RfjYnAZ}?Q(gbT7Xi)y!jZ9z
zoRNluS@TgadF<cObs9%f`jP}vJ?A||j7{U^UM8Yw$Ph(fzY&;B!j_60QJ}wvGZEwx
z6R_EcgW_a&*GcNb5>WFv4)4WO<ps;&#9VN2bi9?v!E~M@2!yu??U0RI6xa@$M${BJ
zPd^^sl(Z=Ngo)K6q$79IX#s7GS`uwFt*6@yW8k-*iiaXUkP8JeO;B2RCE~vS5QF`y
zx$O{Uy{@*eaBK*81=dh!s|2J$NlEek1{ofryrI1t3FZa<)+l&+b~Og5p;~!^(G5JP
z;U}Pc#&X_=Y0f|SbYiflsjPl#dBAoY<U$#!x7jGc<x#~6Vd&z}LU1?zUZvQz>;r0z
z0cHc2e^P7S__IgcBKrta?e1VAzKRK=3U`c3J7hQwudhURxaoX<231rO5*pN8WYj;y
z-CP8RwJH~_^e0Ajsm)fhLlrMnCCEb?$xQjI0<<p!L_ju&%@zbGH0`tYx_F9SZ0l`}
zldG2@Zz<O0h+&~~j*saN5D!r(%dmz!AOgKb%RT^<8vn4S4^TiXCUwmCZkp-{U6m#U
zC&$A_sY3qF<Lg?>XPJoMq)Om(U;t%#rG*}?XI2pO4sxN;5CAdz@VPD0(TRO^ST~4V
z8i;<TuYcWf1f(dKLFiKtMFqCua2sV|&Ie??yi+a={umSRtC@Ov_*1&K%2HR!boO3-
z;%7n?!T?p8v-1SZu*x7$XT=ZXBGQ~{gzSXgS&5)Hx`y1B(%B39Z0ZqR0XZjNkzDfu
zZbw;r`-e1OJm|s0=SL^FLyxE!OfCz~!Ba>DswwTi1p?C_%}4!qwCoh`X^|(Rq@fGx
zpK=!=rwlskVR)6>{ADnuMSLPzhTYq8gH0D)VDZX8%pVUq*xIoX{g5etAO#gQ8(95M
zhyjC08`ylbEr`s}0Zjn4TrvN9IG}I97IyJ6Cdn%ui&>j`hgF~DQ{4q>#B$RZcxSu3
zJ^t(PQp1DRRIj!i1!hFUvG9})AYB{;<|b)6Q#Cy5y{-_xN}f!p0r1FkY5KqpNd;1r
z=i&6Sf@@8(R3Ca+OBl4xV?ir%Qu?eKL>2cbct3GfLhd)Lj{PEYByAO{C=$~LJ*L?Y
z2PJ^`r&g=539}B^!oh)uPL_+nuq_JtHh*iJ5GU)|3TbrFnp~3J%^x<1={FQoVMVID
zd{{Pa1AawQ@i>77^?}U*z7lH~N}a$eHLbdib}3+(_uTgc+_uL*HLYWRU^j649h<nF
z*|Y)s!USAH`{G)Mx^8~Glse{E3+8nGyTy)u#ywk%<lLf4S1?X@>gfjdL2=G(7!oA4
zV81DW`!=syJjr%2!q(4*+fu;nM&MR4I!^N#+#+tj{a`03bIWLYeK85W?I=1%jCu+N
zggPJKHWdsF4Jl9XTA&TWAZXyh7RNWr3wsdZ^zx`sWFn6v#W?{{f)hd|x%QxjP{kt!
zV~Jojy#i@~Np%=+FieF#U0Fv0lY>t}RJ9JSY}7vX<un*4Dew33?FW5$S|AU$;Wo%T
zZOf>|u=pTw-E~HK1HbwprVVBn^SIC08R<p7+c=v$81Eg4-64(r$1@m_t)Sb=ZlE(*
zfFXfB#5<L&xO$}Ec9Tjy4|4Bfl)JVEXkR-IVu+-gZ0t+u_7-9>@>xyb*J~9NxfnOu
zbqg1W!}aVI4vVD<VwvZQ@m^Jm;00Hc6Wkv5x%K1vwGYQt^IyDI{}6Q994naio$S|&
z+}Z8wL@|yN2?_6$Vn@jnUb)*;-@4DF+Y`cdD>#u_ONsVJotDG1+f4ri-*0S?`Kf;<
z_-4AI7Jn>5>mGiYGL?HLCIjcn%9Fe>z}yZ0?coxcid%|Z)^`rvcASS7;lzKov-Wfm
z!?RCCr=7bV^7KuPcjR7F(O|tjlhMhitAnnK+XgA~Pm|vmhB+pxoUCK+75YGy^`P=2
z-}f#k8Xrzkwu<ruaXKpUX|eWE_)ws4?wwTr5G0`DG`TWfU%OedS^URpKLtA;fg7R3
zgzjzCNZ%{jpSR+`?iOOh-B!bg)@l$_ZI=)>7^>dB>00VQKhFL|J=!hHmMt(nCiQBe
zGR<{6;i$Klgis@hWceyy{w^($>^ga_U9RknyK*eY)Z!uW86T?a@V_ZVlSL+D;$!)>
zd<0==nL=^#1#qJu+5m$2AWY$<M7&u0Uw&m5`Q%V@+3|IOL2_K2aTClVG9C(jg{f;d
z=B3@zaM_wp74OE5kP`&y+{wp5`jC48%e80cY3GSnCUyAQ&PK@3?z*6zE0=rC(teCu
z<vA@!Tiu~#5qr49n1ihe9B{pX|DC?B1+H$dlBO!hj4yqcuJd?EFHTu<{b5^$r{fn<
zn`pXkF5_>WdX4?54Zbh(n*K!YyRU<HzDT+E#w9dxd=F+W*tL5^X4G2LCgalo^&pvG
zoDlNY_SXdlw|2_1WP2S+U&n=ShCB;;(=NT6DSd~Ch^Q?pDr)V=C!O1v<pAC9lZ{`K
zSO5W(-D$o->5Rc{WT&O%)l^uN#zss2Vh)H2%ynfeX&I|@Fi5e;r_%Zi<FCmi%e&8t
za&tFx0eF#?=I39!)^(4((7+l-!21jRv(*aX={aDpda$eA=bzn}YQEnVej-!hEL?j6
z#ba-gJ0SMvw)OF8$nF7c*Q2Q8?Akute2dK{2h+2&cW#>Hb6bUMrH$2>r{(nF`NX{A
zt6IKby7i-^&s>qIj8~h(5-qNtBrE=m@3R#8Gu>JFn05E!?v-vuaaTUiELp7?;e7Q0
z?~5cRt;FbEvuv||?yN)$Gu5x0q<lhOA{TQk?|l({SG3V<b}Q4<@6v8y^oqQ>=ARDr
ztqNDppv_aw+TKF;%v#xITW@v>)KVmgPMnV4ALOzy)akLxI`QdJ(EN*rHUT#XkEwm2
zEIEF)^!l;-+>-SaLu+em-*8FSjV)J7$u*UB0*1GY=^JO#l4FWZ;-rcgSIh66w>r>n
zGLNI$6rIjC>oPS9`J8Sw-k)z<J2hou1YDgoV`v6t(z8c9C6>i$Hr|o&!vlN&JnB4L
zx)*`?<q}T|o&}O!&9i*3oo_QHKR(eAPRnBg$9$X+?m};b!<8ma!ajK)YpRKRr+S~#
zb(<8^kMa6UX*1C-(0nD_`H`{|=t|LfOG^a3K%rQAKbi11HD+<sqlpYB0iiuQr5u#R
zPuwQOhiZ!#g>|XV)IE2Y)1kTO$Nm`d1!eDr4w@MYdS5pepqfa~E_Ug_IoSWer`FpV
z=;#OmdRrV6y|n<<avwW(%)??8TH_HHlPZrTPWbX~7j7bJFWUQ8d!NhIULmJ9eCX0Z
z7I9PRq2=Y}y7|7`U^4p4=K)bV(8OS{>Op;NZRcq7EeL!t>DDj!?DO#qMclWtB~K7f
zE!}axd~t<!;FRmvVa6h|uH}$ocS_-nZ;<9gdr-NTJ~A3T!H3zdryU{pV)me5DiK)|
zEUGcKnaDK4ZdD74hU&Z!_vquBH$dy{Etf1k7XG?2+Q7HDy&x~Vyu~xvkaw;q3fKRF
z_Z8VUBkkc-&eL`Qn?8#Hz9$!Ro&WiBqO$e9<y$_x2Ny9n&KwUv_`SL$hR!oU|7^mq
z=3aD>EZ<RkC_VFo8ZG5JF3LA()JrgEAbCT}5FK`f)#wFDSY>Nw{F|r3O2!{oe_EUz
zW9u9*nsxTkt;`Jce_AD=S1-49!Y{~(Cwa(RgxCiY`Ge4-W`}V$?t=LZ#>w>8J_qS(
zT(`&0nlo#r^`B8HV%wlKbGG_ilE`T_vmM@5(wme1F3W&bHkcgOR6llBnju2NWtGLQ
zq9pB|V={eT1nv454`oKdNoH#H61nl74Myih^1ha{xo6s6drbzOzV=TW@yj9R4q?A`
zZc2wQh66qpU)*yzS(vAfiG&M`<I%jyHSp-&_-@`)d#qO;;ep_o!!R?;p!M$T_lHeM
zY}*yHxY*H~&VM;4<#<MsMRoUi;e`Z$7Ujt|R_2dVKSl5i5i8t}sFZqZ8PLlW=sY6T
z`Kddv3p$6j5ps3z9qUFi*>kJq(bp7u_FkgvRR)VLExJqv&4(Kp7@DeQtr~l->Fxiz
z6ZB;B3VQeV&j;;NeXdd1+1g`g>YDrd!nF$>c)h0U{-h=-V+Wz3T<j7GmZ_lhndh2F
zQY69syZv_y=%og{w0VN-W&3=0&LTZ%zEQm2Fu&&OuH$^~)#1h)-rnBlKvY{eu-NkL
z+qd0;3}a}sG`PY7>&dWA%Mdr)W$(K3r#8$rS9CJsn%kDO%kpSdyG3W`g8SBpfA)~*
z(&_#YkyI^QfBB!pS=2$kZ%I4vgsbD0#Xu=mY5wQtF|=2q#4sy5XF>Uk=zTJxwqf9R
zY%WZRc$^~_{_W<-@FcI|YMv}p9>tYKe|IUryW&M`IKgDmr4p(VGPK8hcGuo#8yOFp
zAJk(Fj$;K$5m%){<K(*S^a`#N@!VND=25}2r|`wPdsFaop2t-4865Mn7nWFyxRusu
zq&vePd&S#$8D^CAH2oEPv3QMnbkF$(SQr|Y_MNx2KB(pSrwdpxC@`~az1-}vUKSff
zuZr-H5tEI{V?O)285ge@w}seL><(KM+dao^v6SaL->wuDSUef~(*nPhY8lPq#T-k7
z%eC>ul4CS5+kxo~6<4c?jQc)zr_*I$aZZ;IUXhq3SQ(m#;|+en*ZR%kWW7?iLq`9K
zSl?%t?q|&PB3u4j>3d_p9q1PHM+_L2r2EIDRzoUx7$;P9cI%D1S$p=rOJ}%{VwX;j
z*6jRtpjG%>P*FlU?R&1X@yr6bNE^rRB#lBE?}ZU;Lt9aSNuN`!*;HdE$%eGEJG;zw
z#ynx`<ur>QY#WcAD8Es*6)G{Yvn=z>_}sN(mj6z%N4C3{j(J^{72oC1x|n{s3{&~i
zLb5*EqVUm%MfWt@*pt;)_KhDW`OUW?_IbxF2Ykn}(ph-54u*r~XDuH2<CG@lXWm+z
ztIx|#*Y+PTtM*@S$dN4Fh)^s{x2l%>V8Og8U_e;9_u4ntoSEEQcaS(oBK>irnQ^z@
z8MbQ&<+$HB`m9DUv9!C|r=3Rvvu~aG9gdvYa8OXN0ZTw_C&kL0+upWjjSX^8ilWnG
zH7cCwvODAqs5|Lh2Rb3#X;RAB{%YlhnIhj7W6rd&bU<~R=e*!*u%&@5YRjnaSzw1b
zmbG!Q+o5lnFV*%pKDPOwYQoXkU9`=T*Ijhbdvdu^erG9q`+khO{<&>x{TjZluOdXR
zea|UTmxOO`_uDq5kXjAyeO~w8r%LVH=}VNV-oPwH*!(m&{U_xO_bSnP9-}k+O-3jd
zzNYCv{)rR|17hQoj~VyAh%b$gHbW}v?m#}JS=cU^X$D@sm+T1k>-Hmxi=-smS6hTa
z_JR%zH8}QoW%zr3P^r*gtOP`&uYYm3fAlpy;$J=wqCQ3l$f};K3RPNsRueB?eIC^=
z#sssXj0Rgv0_&&~0ahB;WAZE_W$z8MBbDdGL_+6ckBM~fX!G+FqAPuWSyO*QM^cf}
zGv<>}Rnyu8RQZx6jEK+rQZ8mPlW8|s+A6hK3kHzQ(^+==kLa`dkCax+<k?h+*7yYS
z^fyoJzO_`Ow@h6scCevaHgq#*wJz(qj(4JPxPC2tIi1<xuHFpoG4X?P^knRX`i~SG
z-^fHVty7e?4GyY>EApIAR=34IzQ6U^11-vwz?O0Mx4^U^VHdH;^Ls?kZEsx^(ihRK
z&mysAvz#iUC_hD-UpdHV`M$E3zm%e$U!q7o=MDLz02GyoGtVz$SBit5O4c!9%isCQ
zL~KGYD=Ng^Vw{sdftEZm%OS&fUGs_?IZ+?CCF?(;<*{!rq?yxXW0eBZ2PZouEi3!r
zX}pwT{eZRK@TbQxW9O|-vybSBkOu0U7>Aew;+--VJ>QcRMbUb3zRsqzg((pkQv5VJ
zFG)(PQ?C?dtaQe+6AZ^1B<sE)VIN=LmP=Mgy;#gbqqP|W(-+RVKN8Upo(iH>{Bzv6
zJJm)>rTu_5JLYs;2;PAPy0-hc&;oiaUuXY}87(SWFTg#BBBEilNZ5De&3Z%B(63+t
z112fv9J3Ag6dKg45TaO{Zp$`Y`artT`O`OgmPsQhMS7S|qV$=hcBW#?PN8-nb)nVD
zZH##^h=|omPfoYu%AMkz-U)?st08Ujd9R-fd5%REU6Gqg`+7`eDZJbh<*_U>#B8=1
z+SHk1LADhBl!}_ik3XcidYgImh5I>Q(dpwJ{sw9vWB7|#sx|E*y8QhO+MleAWLycn
zn<?Oa_65oNE0|ZkLOJ#1M6;*&^|mYR!%N5&lG$?62F@>hMLGv3vi(yQ3^>>5{DPOs
z`|kL0yl&H6k$Lgc5MO32Rp~%YS9fTtw6t{6&(F^kUq+)o3;s9zok}Gv#W%L6H~#N3
zAkMg;C}@#ObugmNuZH@?A`X04mn$}Y$JujLGO3w7`_~_bYJ)#QVE)i4l<CO^DirDd
zPqL;FTO+#m{QFFO>DfYBD9)UoFXxj)_>`F`1kq0V%iPo@MRHx;qsHH4f{N9v-RJ5R
z3%4IxjeKDybjGL7xT{+zs?6C<WtnxM>>^jTSLL1$+ZDXXx97E*DaV*k?cz&(#436V
zY@3Nt^YkZYRT4xK(|6WSSoQ3@yGb`_z)a>GUW^tS&!$uxPJSnh_s0T%S!eERMng}u
zFprhsCnodGa!o?d@@FUOCyR23E9;o`wz)E|=~_LwXfFLq`0J`(uf|H9=X$1jK3bf1
z!jb3Av;rggwBI?kKz)2GXPY0TW{;whi`K}qAMm@O^T#L5l3B>d?n;{%H&CNqk)&KH
zf~)Y#Le1Y}Je$#ImL=U?@AElwjFJ{Zh2?<eU9k*dF=fwk(!6GD(FWhe?>F(HyG2u2
z;}^|`R(plob0sWToRj5HFV@ABXH}E?t9qp-ZfH1+VDCOKttP3Z9_~}ZV>cBhL+@Fz
zyjtgWwm4N`*|%ThW^xntVwwBYq01+B_3NUOi0j7Oa?K~~o)ON26t9eu7&TB}Z{~}8
zlha|w5?<*;qknzxN~lgo3CG1`N{vqzxG!-jZ=X|TI9B`kmS^eryv+VV^P9YOHmUCi
zCDA&8XWiP%H-D5_o#(F)GVpx7NS;aC&KH(e-P>1`Z<4gjz^!3f%T2x1w=?uwf-0J|
z9rdT~Ll;VjpFf=pUuMhc9Xu*{DHB&IWELFhJ7qG1*e?)3cM<(>fnGsuuEUY;Eh#8?
ztgwex<k|)nl3;X8Sr{1;S}*5>YwVH;n41^Y=3J~}@zGjR?DW=BQR+V%$;bWa^5fel
zSj7IM<;yh~o+}e)F5{KDXn9}Q`OiCrQ@OIE5xQ2I>?}OSjbCov`zkiRAL!e}>#(zH
zc}3WHA%F7OJ`(IvtP2U_iPAi4^qVK+B>JPfNH;%<3_4Xz4uI)@$*5RrnPg)n@6wLo
z*sCSnoUwFL{^V63j*s6gM?@}>4N_ptMVAMQto@qKo>rFLw|h3%eFcXDI`Zcacq7$b
zlgsxeDCz><P>;Sjm)4(0xK(LEyfyi1CHMZ@rX~7idC437DvQMB<W!D#LL+|1X>^A+
z&0a{Rb`q%*FF!ePu78yC_Je@F^Gow5M(=FCP%bWLHt&Bj@(TAk_08KZk1P9cEzz2O
z>}>B?6?H#2m+#5<c?tWYZ-(`3t~eHNW}V7;fZiFw@oWD!=#v^Ra}ZQZwWjc>h;T8o
z;(bc(dfeI9?Ya~yYk3&SQXl`ged?oEQF`~9Cv)!8yiut^5)q?Ti<EQ<G3(*dL|2m}
zm3xnrndS>uWh7SjdJ7$`vhGEHv;K|$76&YyK`uw7*`g8&N(p}t)Uxl;@6DnO%C3Ql
znOA0RR_BWLR_aTFWW*a?o^Os8@D5FdH~VK5G>#1nXVkE2*;77!o^yKJTS(ujMQsGr
z{y321(G!~|%<?#k@S2^6Pn0ry*ePWg)I8Ju)<t~AFY*j23Vu(qknSE#4$1m{=>u%K
z?9L;;^zWe!Zm*{QMZITLhC?!kb1eEyySmkCcC7o<&Rw2s3d3t9S@glOxv$+%xN<Xj
zkbUo0K+#X*)tA_c6=Fxu-JAvmas6HMeuHaGWa{0P!|w6i4NAFG8zX0C=PT+}VwG<m
zeE7O3L^{UmckbiGUw5+B9bVUX*cN9M1fj8hQq?&XJ_h7FZ#-%mFKK=zx=xU+8GLhl
zDBDck2pm?nAr$lu*oFqPh&yaGg3&3d*;kEKB@2xI)qAPVq|m6|#Fsh5i9|Vfy`?`d
zDUU-p`$Zxx^rmi}^%)@Kr9K96>>8ym*5fhtA6H_YCG^<%tS-*wZZ{s8H#0A)os(FQ
zP&ED8FMbg-!Bg$j`03^1aw?_A%LN<A*`i8sGDcBep3?W)hHc@;Q1jRm!m^25+@<16
z2LdBEHPJSV<1HU+e@+wSMp@I*O{SozM|BD4s_t``_X-{J!7G;}W<Fv5t@p0BWn$Nz
zxNdpJB(!EE=24mojqpOxM5NTYgI}3%EM4=?yu5pY^kJ2-p~%_OG_OWu$$hCVHCNwd
z<nHby;or+>h!wCe&|&e3;8ZXv?BpiaJYM*&K?1+wR8eO4%1c3lGtMchG$HQX>7H&+
z<sv$XY3Ss>dY1l^=}Uy*MVMGmMw4*{5_kMw)Ef0`vO(XKH%|Jiv=$uokI!AtH~XRE
zEF=0(SZ%31XHkj!1NuA5DDenUj!hJmb&r&FCVF3?(1I{@CDN0$&Q!xgf1a*hc;&QF
zxWW5ud^8L3yxT^Pac!E%dQ!nc%J2=&y&J%g&K$*bzLP+o$mv+G);05*F8o%)JfgtJ
z`yg%W41QfPZ5^7KG1ki>sX0|BEaG&ymET*d`)sV#<mR-nV<yQ;MJAt-zONqk?gVp7
z4eIqdm5pSTOTNGF$6m@~q!zY{lc3UK#a?t?pHap2ZQM#-e01UTpH7J@9?#Wybv>4^
z7(Oafheu<Rwc{_Ak*=GoS5B7QzV-EKh2rv6@&Oo3kIsJfF|`?}>>Zk&pZ7f;d9z<j
z?+m5xC4(!>0iQKQNwR~om^EJeOq?(;LYZ^Q>KUFBnK$S?`N|}Ron++VL&o92UYc~#
z>Nj)E(yo?IMC*5I8>Bzn1!PQ<SEiqeRD^Mx*5X@)v+l7pdQ!71mKr|(7rDb1$gLPP
zGv28MJ^5fnTEzaXoyl`mp4eK0ivGJa-OG%qjF!b*m3mrXBPV&uAAX#s94{=&vjzKq
zJ@-4^DPkTLCH1jKG_B@|`HPjWkU=qpd3(<!Gb8^+R_`zH<M8g4?W2i|Jz@G**7bc{
znSODWSOm#z2`#6Li*2&E;EeQW@qK&&9wKLVini)l$<+H~RJ(elJW=H5nmD`ZNCkxj
zVtbTAFB|RNFipB1(X_RE+A_An>UBlSlTp^{@mbzJs?O~?^^#G{4dN*T3wFu3pY42w
zOOgM;u)dH+v@<Z(En!%^{c<wuvk-yv%OKunw$uyKDHEUGRBw#@7T*{#53l<<=n<o8
zn;<XS=j#xv*(|(r?8CbLq@qKkSI+V68)aD%=v9Z>V;T0-Gc)B1FK_AUM(D<zW?&c=
zGp<{|*BQ(#V);<zV-y~-%D%FTqs_xp$l{MyL@6SG0Sl3@C;ws<rH(%d|LnqCPv*gI
zIf+n|E%n^Zepih$V&Zm{I}})yxq5scYq$rM&giE<8roKLY8A@nna{gscz2#<6e=3j
zyU;z@rZxTMOw8=Tqjs*S+wGS(6QxP-*`_9Wui-oI7|EFLnWAKzzdsF?U+pqwDHTuo
z%<D(gPOSv4a#HCwH@+J5=PjEx^!$;;REHWwI)9YNZSX;Jb1}<pUVqEcZyqW9?n#{E
zNkumEpV2%t9WUSDj||6>i!?qJ^O??K)O_DbR!)f~ti)q}!8zOg`{p)ZCgZPyFm(<M
zOjqG@AF&fhxts-M<S&9>30FfGWw&o0+<2>hjt~<%xb8zH@-wws=F#=fGQ}n#{HJ`+
zvwK!K(q!A1)f$)Qu=p%Tm0p$!_kGqfv!)=?#1Q;?eJ7Y-qF=OHqt&!n);YHJ^vC7q
zh@S?&4fqxet1l+L>355=>rj!)y6E#9lYU!m!d#Jcqo-Oj&q}SQ1c=EZ^Ku?r6>Jx0
zjetGD_I+^6H!C`2LcA-6@ORkaD|9{URn1ZNUwo%I+orn8`J0p3?$V|Cf?GRAN0~WO
z&77_AXP+XQ<s)V1*v~xz+ikbw6H<D@jO$-#googA+~qx<N!%-Q`!F7w?p*lCtGie4
zN@iSKO`2|j{cQ{h21t(YZ6_OLWjKx8y-4^!J}{9MF^i=Aj5~Fm_?<t2Co(^1d1pxd
zSlY&qOB>t_-;mf?pq~QrO`EHyWfSmHEju-jC~D`Keuqo$D!m8IM^roAjrE-d`~w@=
zOF0?!4J|IQPVpVb$f`4h<g`13JNqRvpI%QV4ybbB=`R0s+*kQk<OE*Ww->&Sy!^cL
z^p#QABGw5$5k{tyCQ-dEmB$vz=`${wqwf}Km{@vkck!5q{liQ}-_B_1=@#&VIwCF~
zuaYn4Q8Ou?R9Lo*ROOz+X_dx0e5{JcNo9{)#qZdI>f2ww@p*3APJ^0@RZ8Z`6`wO!
z>CC{pO+joVf^WebHi@-J)1nZ`3sonN=paDLy5@Wos20m<*>2eSV{twDTg-g#Zx`=1
zg)J37^J}JlYSd)C>Xp>{XX_cRcKNU`GC#%56pQ%uGA?<v`=%#{^w{whUa1#mwRv)_
ziCOo)lOT-?@zrIU<mV2o%QDPV+&3JOsmP>LtztJWk!qhKfAfK;;D%H*?@jU0xNANZ
zj|FELgivK4x*SVZS#UT?k0tMaVoU3`?wI$T<Tf);y4Gm87j}l<^BF@Jw<(Pu_eJx2
zXY8~#Of>2CnWPkdQ4>Fv_xOi6Lva|Zn$DA!O_`g_k=En)p&>%8>>4`r?mgk&*kqy)
z_S_ncKbypqRx8i^_SV=fdgsiZBixS4%FELr>AEx^7Au1H<SJ_UTZhv(!|OL-bGS)P
zf+9fxZG+l}gKF`lkQ3S(0TqQA^#}x&jm{QxtEX=9ne`L&Nx!PiG2u0$m!9vc@=P3`
z-8Ra;U~NMX;Hs@e9zi0qy(K|NK6iCTU9FxddywX-{0rYpMXZByw_fu1Hw<!CJ(r?a
ztl-y^WeeEem|f>@%5zpcL*$kplvV0}T0=%ok{s)4Mc|QrE0bM``OnFNN&L$V6iZ1S
zenIFTOirZCs4p3zcg|365m6Wz312B+E01Nvrux-h@bey#ch1xe>f4hG?R<}YO(bG<
zBl(dxl@I0O>v2AjiG0SV*>WA;vC6~|<DaJqu=>*k6nFd0jrLShU#%px2uBgeGS(m8
z_tD+L-VeUluN_+(O4Tk&oL#-bSy>&U^u^?#3d`7Y`{v=yJHc@j$x4Htym~!`<9J>B
zKh$#9n+-h7v=2N;cW*MoFuQZqlkENA2m0j)yr<7y&<#~5Hv*UwXi1C)awur*BH5Yy
zoGMS+3wAycey>Zzqwh)`M#gjJQEt0fmD|tsebT%A?Sj<Vtc?T{@8@=t`J-w5zWY6w
zZ@u=KyFQs$%RDW8yFvI9T1H3fuI>7a@{117<JgL=)|+Q{i9TN4pfpm-{YXMKde_3M
zlyt?%K)Q3R$RVQFBbhygcJFnER^U^r6QS75i<Pek<huIqg`8wHVCYuAvKJqNb}q%`
zNT?XlR#)Y)yzaOYc(q$$?AmVM$9aJfdFHIFtUs6=WX*T@ivL91knmUujyV73J5k!I
z5(cmCmPv0gKc&St!Eb82w7xlvT@2{37KtY&w^QzGY^XHekC<~}!fD}J=*|w+|KZ3m
zxExD4(8V3+V9uID`NhD-65UrL;NkDHaB_2fZNzh)WYYJINx*reDQut;KBwr|DK{b8
zt?RpbY(ua;$FwF~RI{f>BUvv$C3s`(MfaBgXU`REC(;~lshpe~931Su%44OIXI*Bt
z?sYs88OMO+stfu?bXDFR!3#322j`Go51w{?Gtd0XO+8k`DEs`X@CER5u-M&P#5O(d
z8wvadbJG$K8iPgYNK{!_**h;UugC80?lB94q2e3hxyo`!u5Am3qz`i6PR@TEvnDf6
z&=R_*{7vG~=A&Hesfe;3-uAdS<%oL&)mrn=>fxwzL)Bf`PN<(K5<jSR&)uG{(A)RI
zS<3R;GxKoo*@laA?_Fnj6^Rw?*N?`q?Ky-?Wee%;ojg$#yzoxg6P>Xz@^Sk4u`ctl
zVaH<YEAv#BW4{&$Zau<Gi3|v8M~M&9NvVIQJ}^GLT+~2)8ZA~+DsEAbFW03hRyk@^
z&p4!P&S1^9ZCYVoLH+T}={)&zH-kL=?b@ZYmou!-p8m*>8BzGWM^WZFg1PT(bl_*t
z{t+v@xAe*59A=4mQo}tfeeQ~-+oy)MpVI{9n)LbHZ5Ms!$toT-rD+s<4Jo#1>{FCw
zDi$*E>=NH$UHY`G*T<sG%_Zp67%MpY+9K`q<s9DY{jci8`qc8O?6<lUdwgBBy3EC@
zR*sF3RG^29E7%GtF+ENEY^%Mx%#-OXx$_@Vh|rALM1zmg8hsA<_sloVo%!m5(~G%w
zr7Fn|BF)+VA5~`^7IpLe{iQpU1}RZc=|*Y^2^B;Px|WWmk%pyFNkvIX0fTO&SxRZ?
zZcw@emfC%0z3=<`yPki%kPFz|na|9eIp_6$pMb$f5mro#B%AOFYow+gk2%bGLJ2y_
zJ>{V~V{z)x1Jlbq+{h+yqSiUStKp1-oxk5><@>0zYZg#-d1a1HJ`&^Dutyouu|`Ez
zBmB*Lt5rfkBdxTdj4BMHZdi?DHT^`s$3-~M^Mj6c0}-;C-Bm$)vb4S1pb;&cxK_A(
zT#Al3?F}scEZaUuCJCF^<D1i!U^Ta3MuEFwHCdUP=}2db+(p%Ho2Z0wGEsx`We+da
zqRh6G^je0+e6ry?$MzVQ*$49@nNDCEIs{JXA}L@%6!RxLlI>ssn*dzLmSO*Bp;xpn
zm@rfn6sHx_6D4wZ7*p@XaD&<=%;oMUAh0c%)6FmHe+aGS^n@clTVsjzboYxVyd?=Q
ziX;Vsp%Nt)0S1j1VSexWWNWr;PT3L}WZ2Xi%vZ;%ZPbbS%TUnaf}irTTbZe|k<+!H
zzfYwW`Q`2IOvdV_iG67#tV{9Om#+v8wKz=JE}+l?N%BLQrr}sR>>`}#k8qJq@A3ut
zKM`yfRMYMCb*A0z?aOU68a+^7)jjY{p2U+n(sOri7Ahe@_#=xIn;+llKY=yU5RJ(j
zPaAf;vE*(Ug2!N4hSJaO*oApdt@Q_gpGp0z5{&D{$d?V^<YVRQTPGqfKNs!*u!iEf
zZ|<M!Dl13Ae*pn{y-V#p8nu$3g<e3P??OMk%y+q?_FSeam9|yT+Rhglc+=rkKwekL
zLE$9n*Y7;XyxM``Qg19Cgx|URBGJI+4{g?~G0nT$4$Zg18@Dh;ACURv<6P#dzVlst
zy-LswuL<)}E@B*Uf;fu%OxZH->PauMH3f!CWRx>In!~D7afuJ9tz-7A>`df44&Lk%
zx4CyFGZSC-^b92HkfupmA(?vSt8BfH6@xj;^nGNr!WmWvNsBdh>V5aEHVB3zSDS7*
zeJ}7mwQHk#Ju~V+gF>hmIsuYlj%t~jx5noMEi+w~;`K4Mj32#f+M-XQ8(c#5j7ea!
zp93PtZDX_Fl*_;QNbyy}PYb2uQyAN|bd@YKz;vrglOfTrlVPPwM!4vX&$iShQqJ~4
z3r4J{Ytvt{N_aGM6(@@|ocoGlzIlM9NyfW%QFs8+(HV4XQg4EJ8*j2Y%m=ULJA2}I
z!-W+}xqE~JDNptel#|emDo3N$Ts{^&ENDH1!+C}83p|Ac95H@{W!$M05l1`i^YQOe
z`~%L@?5t8QW-8N`Z4{Da{v@{_9Lk#e=#|K}XZ@&+Z#eFq6J+LHS>^9a<5USaOTjJT
z7dE%J`Hsl8qZP%O=sB`L;HX~BY6%Vb^^<bS4c;~AAGcl6b388TH1l2j<YK>z{d~D%
zK>iQ|nx%1L@q~kLLH|}vbpxO@3Nj)S^P4dz81&c8qp6L-qV&!7HD1UO?J65lH~wMK
z8=w2?bKa>hgq$x_L^VHWqBLXFC7`gTG5g2inJ8$3s;0ixbc|?gGF906=$8C7J4&xI
z`D<#8t`cpQ)0=v%0?h7{KKB|gNPalrS-7`|EE4zdwRQNHF8)Y^c3qU77>ss>?WVl6
zy%im!*!GLL4-|6`cItQK&(E7N=er=s!YaXixp?-*YP^4L5~Of^=L1e=UAsgo)0XQD
zf3;imq&#+cOJe5RoJ#<1Z2t?*KC15;Tt0~5h#$vYp%1<DI0|$vM|bz7NoL=vaR3du
z+>W;<zZ!lHUeG$~e$R_NtBipbW;7#%4IA54<4=^fSm!+(su7&H7c>chzk5|gbij~S
z&7+mk`y%v$O7j6pnYJEIR*cw9o*mYHOYZ4G$~DKYPo-@6(@;miTUUMNnvfkGP!S99
zr&lubLf+YsI&o!vQ;X(5#P_q~uBAKu_C_I#VBJJa^(nhRm@PK~{R@E}6%1H^xLd#4
zYc*ao<N8Zxr(tGv^u;e^I9ZPqzvwK;qa6TlB5`(VO{CIcd#+JN4m8oIdUBH%f_oJg
zTvDzKoux$m-4$rE_o!9^UCg-J-dLMfDXPe%=i3Zq<i*Ell2ehBk8t;lmzZjS5ccWf
zc-@7xAxqtM<Yf-CkH_!9?0ay{()-MTiq5Ta0pbE-6Wv*v1)sFr>`(0_z<%<`;0Nfm
z;wBh;5oV^L9jNs5k-nzGHhGxe>&Mv7AyKULrB?iYvkB9%$@u7~6@hO<J#Z;HM`RJm
z(V*|&M1gSPI@Q1N^YZtwpo?8VOm>fq&{7%&5oTH1*?j?W(TMvZ&Cy?szPWWEm{Qg8
za;S6KS{eQTKxA%<0iWu1uj;El9McZ2I5P?SQ+&?n$%I!7X;PPi32{;}Szi)#O#?=q
z1s<qt!MVpg;;4&)@{`QBInM4?h7O{KNreRARY8vm2%^>NN3=;B+7D=~)8aFQD5~i?
zGq>7=n{>d(m>~Wu$saE^et33%{!J(4@$f0&RdEkZ0p@}(ua6VgvUk(iy`!XcXCyuY
z8y(@yzWO`vk*)WICz=t^O7ye-bQxXXgr?y%Q>*B=e_JEyTZe%lznGNNZ-&U(_Pc=J
zKB931INCinY(lNmnxH9nKrH)}L<oz`@3_*kXO_$lJmiJm;5w3sO)EWymMv0La1OC?
zNRYv8n-98q(UKB7?0#Fq&O>S;A9GR^6mXSjZaGx5-n$!`B{KCxrz#YrUhfwyT00gf
zOl23F!-?V}7<aRaom4Tw7wt2rF_Lq8$TfUeuxgvm+Aq~M`D<25jyKKNi-kW>=S+fz
zIhEjM?7;nrFiS&EW)`fx)r-?ZbXzCrM4ktDxe{`6az14|YI$!lR2&Bl7=r5|(%6wu
z^0+336QOedB8ZSfk|_f6c(pTz<$ao@^O8|xz_~=MK&@9)wJ}hNp^RS;0aFV9gCFcO
z2+U<9_#3~4Y8As`IDcmBk-4q@Y{U~Mgus0t{#L8ROG%lb%kqB!QLiM8)gB~tx_7rN
zlC=n3`>~*)$Klw4?l&~qDY5S=q#W)M=tRHK7EaC5k%>9YL>xUdJsUza23|_v&`TmB
zB-{a?%xZjm#<lAJET=?ZV3foO5d+<8>AY@-U7aoS|MUB2s_GvNns_nnB~LH>-)p}%
zJ`y^I76*Xg+^5VygK)?oXca|g+B4JOlYoRiCx$4ZfSCIm%ZZ<_??22Ib}(4UH9pn)
zm=4*4)IwGj=M`{ZkF|kThv!=~TC)3rp#1mNaJ&Ie)T9`(ucW{rXkr9fUK}YY$arq)
z<wFJmBL|!XU5PQd)|z7PnXo{ZuqCd>-@hD5hc3%^Hp3;KLhP;10Z$~iote8O@<}vH
zTf9t~(c%9_?PM+>h_K|+Gcieo0Q&Cb3uPKJCREnXlBd=ovUWf&F*Q4zzSPzUj8t?%
z<gvZ0e12Dh-a0Dnc6iWL?5ryMn+?B(3V*2itEm1R3C?ri77U}2nXPeVA8FAAva1Bp
zDpVoeOIl29g&=sL6sUq$?U(+22TGNc8YG;_6;~7nzdL^C1|!h!>vEaMaMsEU8V8$;
z2nofTH2E{-b6=+B8Fu}#A;#HH!R{CphKKDW<9VlQU{@D7gDd|1&??;RZ6y{LRbRe*
zdA_r!Lcu*c**-;v0YI8~#|m?DiQ~VQ6(tWwY~evQnCc<;&P!|8?WwBD=H__}8#D6*
z0h5Mgg{Zq?kZ`B69Um~?Q<3r5)vFyOZ}@i+tF;OmeeUZ@g;ap6%T3^cd%HJ?f{N;s
zUMVXh<DThDC1Uk|1_k`|&u{Q|rzJ6gN#JFQ`i?foFS}mrmY5tlydQ+%m#zU0DHF7X
zSNL8fA|_VpzcF%KUdIRE!P&<GMV6-b%pISlV$(`t|K%GA2oP^IR{1^F<PUpA--9ss
zW-{%3gHHv}xfwD654xzzde7|#{h82Aa!SgfC{m3eCK_`vrhh-TbaV`D_vEdo7T_Dz
z@~B(;XGfcX#%`cLi38-TP65f71W+M0q>0+}=k9#IChI*|f&jYa53JfZ4Ts+C0qEl8
zEfE}U?105yPn$W@GKyuBGw=bdH!ry9ozTpIJD(-+X#?|aN=l(%3Fy(lC(-whz$~Vc
zT)A(xLwHz`c}Y&jSWw)!-^ubyuP^Um($&MfBwHMH)7(SVP_LXV=dtq|X<Hi;K&e)1
z8HS0%X*$O6t;(3Jt`0PVM)%-1fv3@(hZG?m@JdjYo`$#A>#vdpic9a*GYqr3I_3Ib
zM+g;{&hT1nCF={=YNJ}I0^`M4;MGpKKgx<8)c3kd$Xru-LAywLettC6@Azd5zg<p)
zfV)M6Lcy+jPTw`akRSx=<VdsmA+T|Hbdi>M@C!;U1PVs%bv$-~06dk{9)iT>+cveh
z8ck3HbOV+c^reZWfEWbF7PIJ{{OsiD=w|9IXTFk#g9qh+4+lj~w)=BHBTskIggz?a
z0h)sb`U~=jb{~L=2BgZNQOo!1gX@l$q6E+OVEZI$lO68uQ3F}B*m7K2IdzQ4U0K<!
zVaXXGL*DO_?|$XTDjQv~86&Dyk#f-#qgug>_0-fQ4#^^4AfCQgR@Jh`+ReFfw|m84
zS_Tz*OoPt4tjfa3`lI%~ZeC~qqpz-Y?MNYm({a+K@Fvx%{4t_ejWjd|zQ;y+5$A~v
z!R!ah&u<)4z?M-IyN;@c1kgo>&VVEQ*At&aW+m}fG^OSiCpwUUa=r7aT@18q79V<Y
z?;a9&0p`7NiLGm5uYyLgo?(ollg=)zp(VgD@o#<u^CuHMjL(ukk3OzR(BZ(zstOgE
zqjbMk{pprk+Fc?m)~XPBVwPXTeV^+;_=)+=4Z|zBId;VB>grq`WT#)_Zh5<fr&4IR
zgN<qYj^Rjg&6<9FSBoFm$bfyEDCWOMyc)DJ;OFj2QFwf`&>A|6rGk!k=MnSm?d_D3
z`a4X3401mq^pu|Qu{1L?(*+ys=QPW>qd$MPQqt075?@oaIzIC4({$2yA3Xvvx0GDK
zna3TSrPoDT6`reA<0glTZ8+~ojuhC2<zlIz7eccd8NM60*<%xUwDLD`_N6_yk_Eet
zhLHU5^K+NDP*}^N#Qu|?*W#;-+0_Bf_of=a001SxZZS@@aQ3m`@iGdEX~xRDJ<Rtv
zTy`?$Z`O_I!$|CO@^`PNtcSl?<-BaER~E_kM6Bd7^(Yi{YLuOnXWHu+5@49`dsVKc
z$<ZredK-Q`^pok-cSiJ|WNW<REP*Pf1^wClBP_8=(M_rNff|~BdeV%!#6n`|APGH_
zUscv@Kxn<*s3AJ_$1{1^g)Ow~)cTDiRp(6Z*2P!8Lbc8GlS<Mel9zrIx(v-5V>h~H
zr&gR#PEHVWqXPrqEGAf$fxF2LI|~bFY~%-Sp*5@yA9lP>z-;73e0B1FtXWYtD0Z&!
z1nfM-ZwNWC`;Q0h<P8Ss<vj-OmOU2JAA_1+UNxA;h6W=LwkI`9NJ;4pvw47h_#T|k
z%c@joSz?2x#wVqg;`P148-jgP1S?E!dY#V*n&hiax9EKm`f~Nx$q-oq%k8gd!goG<
z&hsDpocI&kKs2p$?s90(5-Kf8kR^C><fr7#Zh95iGVqHJGM2qD5H?7ew|)3CuG)g7
z{3jUf6`~>XZP(~z>(|!NPc!^>?jls{!cxNkuJDYP$A_7E@7h8AbBp|BoowqQ<3D~r
z>vP5A6cnR@zw#Oz0~cC?bM<$5l}*^PH5E)J)-B)>^PM!~)XmVdkI(~*@-$U%V6f_N
ziMG>xQ#xGibK17q+7+1XJ!P^P=X>?#^r_l{V`+juhYLC*lb+5*f1i1?rUS4qS5@7&
z<yFIoi-_RDhPy#<sabFeV*3NJ<cAgCzz%HmANYNv!f(5kp*;CU8$M$)Fs4I7JBu<I
zm8*8ZwtGFymeP}}{QET$`mXFDG<d>(=zQGbCe&~@bCtoj!-bYI%}}Pv<a|>=;cy$=
zJI^KPqkc6u^ksdfJI0gvW_cr(<WJX2u#nI-;zSm$qSUnZ1oj2@c$D04QKL`SwGgRr
ze5cqH_zgyAO=u9$^dHq;jtK6lsW(-m9~4SWk>^S;j|PW_6I$?-Z}w?m?RxSqO7}s$
zM;CkL=Z+=wUTOa;aV-)Y5J<foO8<LGdE6RAhmw>UUKEj>_xARhah8;Wbm?g2?o?HQ
z+y0WuoYwi-*`2Gn_HugHItl3|DmUzWgAK1O;=+Hc&EfLTXxEd@OrA`t*vJo@gpc#@
zQ4K7y(Hkzv)BYizUD*fcPa%DCj*9hJ<VoRkcapi#lbiRSBp<_4r~f#3aDJGAe<rw<
zNMDP_V!TJwYgXD#PxS~-*5x%Sa@?-qp<4qQFN}BxFQ}u)mVQtys+R8a8WJkLkwHaz
zD0%OZQ`QQ8^>cYz!Y0(bF^Y!@KdIQ6_Bu2!j2n@9ud54Z`cdD1^6ozL+6-V~{#Z#y
zPS6WCTP*UkB#QW?5cT+^cvk(a4jX9S;98>34-fEal<xaews?D(Cv5!(g+`)U^|uDK
z-(Iz@`Xi=6IcMecaOl$k)4GZY>25Ky9#g#<^Ghd_W_=I2#Qw#47XE>1qpPwumu2HA
z0=?|j&NsFyI4(lnUVFE9+cA1xi}}OkEqSIyJjIc&3}ZuuZu(r_-s!-%>&g9Cbnamx
zPN~geEV|TJ+BN0YQrbDCG(9)QLMA>$HMDzFnc0`c1hXAuoUWd=I?F6yo@?;TrK|NZ
z-adKHtNQ?Y0ul;-*_^h9-oLXWbDUf-JkZlu7z(dA`LoYZWg7mlps%C#^CO8dC5}<u
zYjQ&$QV-3SUy3X*itJVesPM5_O?!|bV}v+mkEY&>9LASh{E&tFX>(sjZQR*WtR-2A
z+1;ARnq$1Hqt?^TRbncrJSiW&{&-~Wo!w#2im|pIft2Z;VUyMHiaGD1-rD;wt#K$6
z@R@^x4C^&YBd`HibX=V7E&O+*qJ;<~em;gnq_Ke6Sm~d-?!OWgQhRi(B}0Pgg>2x3
z_v;c%An(_$eKFo(Auwf`ut94&IRPp+0;ty?OfR{%%d#U%bV17kKxI$YdpRF~v%aV{
z&Ze}qyYCoW2Bg2<heY+%sx1&=+_R~pyy9dJULuGH2y2O%OlksM_OI?lL`F6q)3bQi
zE}HYqhM69=QPs9p)JA%7K3e3ynGq>dyNI;@XgV=f8HCWQZFg=Mb~5AYCB|#R^+Hk9
zXe^6T1b!iFP4u;X7@v7miQ(Y;PScRN{<>5j`t3@{rn+vTc-X8x$5&ker3JQK)zm@9
ziZ3<y$G=+>F7=g%RoY}k_;k5NmV0xHP6uHe4Hl(`-<`&xMCFjOrGdk8NKGiR&!;vN
z>T?9K35#6sulvzpCTA}7m=K=Q;ha`d9j!O440qPcbRB5o8EYyPSkiC5GO*}l)aE{O
z@#=~_O5vJo*m|2Eu^_UqwsVT4ogq*})50f%Xqt(bEvr|ERk_dDd)Hw4YOW2RsY|uv
zXU(Y6N7LmkrDcVjRFC8KuA$@dZXUdUA*UmWJjUN`5uJH#E?2r9d_h$rs;S>xOA;<-
z8}WnpOf&ml{iH4I+GByX^IrEL4`r#vSi37@{9$S6QfR4N@1IuK{FVBQr2gZ(h8Y%C
ze1r$It6?t&O>8b(@6Hrf?5bsy@0R*>_dPx*k1Z7_H#TE*5f}<$H~`7ev7wvS5PE&k
z#aiN3p_ywo#-Ed7Y2i!Bq^s|g2xc^_Q&+2=N7pz?PTCwcY3fcVF2i>}ept=poq5MZ
zCcFbPR%2eM;Sb$(gr+H`plivkx+cCqO(Zf*gtIM3qitj|bQ4pOW;}k0YB)GdT^U&R
zZQS=04LW^?Ii5!wZezgBYdm1>7Zmf2LH+b+T;K{-7{&60>E(tl@66=_5mdbi)gj1D
zCA+79P1|w$0O@3-VI8o@N`zJn+<q;1fH%HKZ`Xg2^l80E-lj)5@Yhj#*}hOuK;wxB
zqKH~eDxy5VyHJxVn5CLi>en|LXh$HAzu;nRlIv>n7d~~FYTa9HDvLGS1ak}yf-Z56
zG#6!#+|vTQ#57|GzK094j1r{FVVAy4<^g(q{BI)FMXS@`13lHJxh8XTc?4ZyFS&ZO
z8;|b@&UQzSZ^Wd59MB+y7LU0X+zWYu=g{rSw1M8<$Hc@AS+wXMA9QY9{8v%RIShU<
zv(;j)O4kfbiRxy|DaBZv+@qRLzJ*t_0t<#@&E<+g#TxZ$cUxQA+U90N%{gL3vvSv~
zi%k+>E3fl$v-y(H>+8dxbd9`Dm&2=Oa5FKOrH&}HOVl23F`jIc1A8C}w#__iK*=uu
zK^}8)SWvvE|AAy?Vd_T$Snn~$2q30-QnOHlOrI7qz0zdS6?=*b+pl(7;2FYMtajRK
z+S9KkTMn+}@oHXq&=Z7;*j1LU%h{z$OXPX<VGoVG%vO%H9}wE6?gy;}qREyc+9Gf`
zG}kEyRyxQQTVaYO92dvwy^<)Bqw!wR4@_~Y-2@jfCWVPb-NJ^E&{c`v`SO8mqxZot
zdP77=p>S43->@U%_Jb5Fg7GVe&h%5dCaS>5qZ$6UC2mpW^zuC?qJ_llZKO4|u@1yU
zvwJC}z2(M=7dXXS8XnF)I6L}?_&JZvq+j0h<k0z7<+}ON3#WQMHQT{`=R%JlF!JH)
zHBG%=N-mkMvEdY__u|)J9}cIkuCWwz$!%2KEUPSi!F)<Rw%*`NSKnC&8xDQZR%bO8
zx!C4jcF->bgp@+^>d;)ZWS-vfQs?N_3(CVN$C?<jnR33c^<WQ*b4?=)M!2zJvSYg0
z{I$;T?R)Bl#sd#+P;sTjpJYYhi47i*;{d5?2|;qh4E8elwlkXQDwR^%3Hev2{T^h?
zkv0<pKLb)cqGP@!cO^Ddzuvb_u}t~smrqw*p=riK<t5cdfeaNAYDCrrozWi8lKb&x
zF2p(VIL_=(ubuc#X_+lQ$Da)gz{{js{xGgH6yVLeuhP&HTbAPG=})TH{ALY~anz^0
zRFj^R#%W%sAE<!8XKj`wUA~eShq-LVc!4TX+?gL(X+h%`-Jw3P65uNH37aoJYb9bI
zDGmVQxc!}lxEGNQrsq@R_Tw{zTdy5JoSnDq(DfN+kYp#hag^?}43lN>bDl_QGoF|W
zTXv2g&;QlxOTU&DL(}CCLm>lY$CBPtkhNV&+)QSVsbuiEl)kJQ*B@sZ&+!pzyRsRz
z*Ssx>Y8t-TN$*+syo9Q4*Y{9Qw#W5;VIPqvC1XCpvi3Xr+J2AzO~0PX#j<_oAuc`#
zpXGejGcS-j@0Z#2A1%5cTVH-^=#+kN2;_M6rPk|c_9>t_YynC`_A#-Of5Lga-S#@3
zF@<!NX13Jy-9XOUe{%@fKwe~ho)~h<l?EBd4-!($hfs6(CCfgAe4m|Pjr|E~#`B&w
zBoJ{X0i8~I-*2{z0xq4!?%CqioaP9gH!8YL4<=)VRq=yr8Er2+kXaO_Op=Q^GNml~
z{t|+0f4II>Oj=%+vcPU|d%UYj(aio>&LR$=b|=E{Q)@|n7T~hYUo6^G=2Dzz6lV1n
z7q9FO-_jpuf*^Ax?xVRYiB?W}3R0bDb}}-_fi@3wgUF~EzDQ5eyE;v`EzRed+-<_A
zw{raWG;TOsWGbn_(%RhOz2x|0dfg2@QywkKtV_%U{rH#xc|6xyLLn2#;FvYaTOgb*
z9CT(TiF>*uGywOuaJ-+a+FMeNOQ`ZfT96%i90DstYWUBMQLrRUbixW9WsNx?v`+Em
z#w45CT(}Bb7D@+0GP}}9hMu&?zr}&L5NYe<!{{)6ICQr}wt|XedWDhPaDv{AONKTg
zrYgLw_JaT?gtjRmEyW6{Sr|{%_PU`(2F}9j<Qc*8-fHO0wk4wzF}dCb34|`ju5kVj
zPe~!e(Po+Em|pEc=eshmaR+G6N*ZuDaG&_2_YiT729g8aWVM*yEUQbA<Q||Ybn>`p
zqA$!MoAO3QdcN{OtqLOUUUmouYU@IXmE`9ycf53sKAKTcj?fudq+^L)ol_E=>laNP
z>rb5gxAhWmhdF6IZ;2-AJ)CDc&*I!|EZg_ec$r6stKbumM@O3TI5XUbmZmnQkyi&}
ze#FNOF>iA?Z)*rlw}UT_*|PR+Mwz>o;l`<m4Mi@>Elvzo>t;jr`B<gUr1M>FSJsS8
z41{K2-rjQ8PC6F6`L~qYYFmu;oRO{x)P1<P3dQ7e^W)>cKpXho0eu_}ubn(d{CQ&^
zs|n<LdV%V{sW-RvM}HqzY2vT7tM?f0xXj+0Fa^zOrfWWd#NXqjG|)+b`_}-l?j<B5
zvOA+4c<$@#J9JNs?rY>HpQtL__tTFZV;cw__fZ|KJ7qg{)Gu(0rQlc1IpK)t^Lk5;
z#xGxrIfsk3%6yTRTO+(PoPFn-eTVY!eR9E(<l$%~KDL+^59nVW+i7?@@(t{cFI68x
z%-%P8ppL*2BaqC9^s}=j-mUUUiZl!|-iKyVz^*CL2xc*@BKaFm4-JO0wW*=)!~A?n
zZd%Weo|$S<o3b=x18D09{P^pko8E#$WIl9rRF@H^Vij+76I})(vf*;2un)E^<jiI!
z;tv?RlA&Ym!Qn@R&sVwV5y>11$;uVi`8J)DKMrc8Qj#jBcPJ)nl?jOrCGMGgw4){C
zTC!bM8<vnV#2jv@>ItOX*K;oVkx-RLm5O{hI;#pp5LPe{^B&wBnAh_o6}>C*s4r+=
zS<ig+Ztt$F*^{d<<rIqLdlh%#(~l+K>~nB)J6)<Vo<y5maSd>XU#D{vE8dr!nFy?d
zOUoZmSfG1_$@*N~qMs+0_E*Sq!hgG)Up~>7qW@}hCt)SULXk0EpgQKxgHIycHtMNs
zTI{y@6XhA`31qcbqs7*BbDzYdv9hMpUQ~eGg0T=)nCL~odS237Y<cWe+VW@seSW=J
z=O&gI)dJ}!x)V^%TOOz-Vgn|^D-6vjl|ECW$ZtZMoqgi&%PhwQA4J1k7g6>_v@wy|
zp9=4O%sJ`ooX_?_>Re%Q$4%r-^h@RLbx#|oWav{K6Pddsnjr;z+Fnb1PPx2wk!vT=
z@aeOu;KO83VqRoiwWt_Fm(*h5gh}N3t2zV0U32t13LaQGU&ylf*&9g{Wdn0IL+hCv
z_e6t8N`d$N0|WvAa@-3<SA=AeieTKcv$MQ}te|^m$<f_wao_Qi!ChbWzq>vjxZLl&
zC<mp=KTvcRhL~Rgb!S-X1IXIm0cIXm_r>T@fG#fR?#n2+k@Ll+%$q+AMlXxlnkZWV
z0D7J2LJRH<0!L!{?XmL=#tHvcB`Nx?GQH>%H=Mz`#U-g34*!YDil`Kb>n#JZ_7E<D
z;4$T&Yd8#ri}_5ucaToD=F2!~(dueW5@UF<jtadSs(PSZOd40w9fl&vzAwmT>b@_z
z-tELOXq?fk2RGe}z?Tq>y5QDB5zS=%7NfR)cQaQT?*1xmqbOpxE5dxT&QkGi&$NH+
zH-fT@a>x5}I9b*f(}W+&aQYp>tbDjOq4VL#lrY5<g;|3ERnx}0X=2*9ih(duvP-(+
z_eW_g7n_q=l(37(8Bt-Z8^H(Bm7Qxh&J0!v2xj9MY9C?tAJy9N6fO{jn?g2kAI2h`
zXeqD9<Z@j^AojSNHL7${Z{8UDjS6Gw{BFZSMJg%8$|R6@*_Wk%DSSQ>!?rBM|7NV3
z{3>t!GwX{cws@Ut0W9FJZ(<^FwAICq*cuRQ*i$;#su&o1LAA(EOmPW}DUO>tX)Rlg
zu8y~%B3`^j`Z1C@-ngZ8>!eJU42F1+&AD<rd|iSi_U^W9!4*B{ZrO*hld9MnKH8C1
zS>gb@icSr6B4Qp+#Q0E2Qn2Hd3zbRZ5~xF8y*1L4#_9~K6WZ~nc){Q}YtW^sB-Rbe
z3A~MsjXy>UboZTK$2}=^`sR1C<1t<BNG(yMKy2&gb`@8t>PW)YHJ2U8#lo<qgu<NE
ze-bU!BNqwz;t4ctlAMni=;`g1<bWXxD=TY}9U1a^QJUU(hHJw1JuwESP6=gELi(A#
z_ctX!>_h1%w(AY@g4;;{xZn)h3$<Rq9wt%C@iIJlkYXX{1zR5}qS0giv&zF<vgXo`
z@q`hlr^h|ce8{CJoo9~lcZI7_Jvxa|)}aRtV=DXQuD#Q>rdlZr^*v4~x5K>Qh5WnT
z`yC7p<JtpdDU*CLgjV_`)T&$qzrM}#ElR^5<T$oOXv(#ATay-ygkIv&Z)oeJ?!WiW
zSo=~H<VzW>WB)PBvtBh^+~Cb_-*+Ck#*=BPpdhjyqHvqfmwBvZ26)<?+p4@vEgrun
zcyyY&^FPvAuO)X^J2-?-4UZ*sI@~@~mmv*u6^#z*7lxI@z!?tooDsdh%6tGD>u)<B
z53TN1u+WBEG|ZtI^+7iEQ{^62t=nq%Yj-&SpR%Lej=@<vNk$>}XHdCdW~S~%0ln!v
zwRVPWN5*+;du@j>)v(T=T{(gU<6TZ-aE2)u`N;Rf-wr=99CF&+siSdgN1H{q%VX1H
zV$!CzH?Nf}8i|=$oVi^zkAcI_DwvRic-N9Ss6n*=z;sj0HlJ~bQwNkOV!chQTfo$|
z|5u@i-6CV~Uw^WQ&uIE%PoBG52#0V6-*?m!1){vba{g2@Nt_LmrjbxnvnQj{;WtW&
zyJF-6i&8)31QwBHA3M0h6I~P7$%+=Qi%E_sNe)U8C{?X5`qeV_qKfGPNlcxyJ-H+l
zzh&QdC$efjTQk2)Z^<J5(A@6%H(QB`du_V;R-<z?1+F&;dxk=(<bPuZ3`?zj3?HVL
zF&^OiA%$pD-q@ZHycn^A&v87O7*uXjB(~yeer>}>SH+`Z*L#t}oz0jX@!HoBrAqpY
z1OA<;vO*>8E&0=1FYk{{_jg_>r-h#sf9fNJr45oF@&Z6P;%Aal3;v=2FG{h3xlin_
z7_3)hRr}c(znD15iC7vT=1Tw`E@_Ny_Oxx`eZhjVmoA|UCkMR_@9(Q62Bac$Q-p~(
zifcZUMYn6jCt4ws_is<Daa~O0sxaq3!}b^sm|ZJEo=F58+Nv7!=78N{*IBjsl?3Jb
zYp)8y+%dI>Df@mEL6FB>kArx`Fjl9h1Bjggp_8L+XM~LIUSx{~<8su2?Q)N6>gWfC
zkCOp3t$tBw0ZmC$w|<_8RR}uJZ_z}B{pg7f?jCWUHd)CtWJ25$3UM2R;~1<YZIAyf
zc8{Lo>+ZMMY?W{*@)_6YjvbeB3aPJ(P7Bk+1Khx37l67nOV7ab$a@W3Np$s0%~$o9
zv5WnGPs9~_oC6HVr#_2ihnl$3SX>;BcXoAMGNlI1T+hJVAv7JWCGo@+uOEVp_}8jO
zY33dASzBaNuz0n9E&Ub3CFxzdz|=%G&?UjF<W(lLbhn-<^knH$Y@DEQPvv)nwOOgR
zIt4zbcLrJX%t#N-?^}41Hiz`~b_O4{VF^`1D4|Ce2leFNcau}{RP`Tzo3Jg_e$_XW
zY!Cpar*#Yxar^@Np(HA-uI$9ewQGUipEBrmD{bH;FQb5@R=_T(KPAhg`a0N9%fnri
z2dR#(u?Vmfoknio`y3D)wr%xsz;IZ!w<4!HOo^U_U=xn&FAbbV^XNzpau-$wygH(z
zek)BQ99}&aGxMtVkI@?r3w>nM>(tTivmUoW4M*y&s0ovB4$U5W3JaM~R2KZ{VB{rr
zxP?S{g9I*ez>TFqS7+}IynyAtntdmyZJTYZZ6otk{4sHlZ*My!u}t;M*4|&qDE>sa
zh>|AdZfTCk9ea@JsW`JpBzm_QGv=W#s#-1BJFNcP`2r{pWI-ulHvSw`u~0Fiz~q0P
z3>CI;hB(v0{J^XQ*v9cM0cR+FIny7T&Evz8bg-^Am0c@S`UuWM$+T>Ocw~546Kng%
zi>=d!Gn=yIysBd@+GG3Y29qw?0m|tsA1d@m(z<fwZixnd`ZCk-jiRrvnt9~sgg5^H
zzkUx$hKfHH#aSD>bIJTGoQ&b(6hJ6+$q>-cMiZ3DOgFvCj@N6?T|5*2mTZLoi#x7A
zbxpHwb{H4tjBtbpy%G_Jq(c#Nh##PZZqi+0pfmpIU+NRwQSS1Q3FFQsU=-A6h$3sY
z|CPha;C8wSy$G4|<x@3xrHp!odOPZr8<xts_lR^6Qa@qS_lg=`u8+f9OCtH*HIoS0
zA$YRi!AZdCvLKm}M~x%Nw|_G!KyV4^f!xg@cw*oAl7GbQ<4cyS<cMfh&05$nM>V8Z
ziqmM(oVSV~Xu@1*D8lsSw5+s6Q$}@Q*vfk{6kTGJ>~F-!s3EJNxKk=eO_U=QyfcfB
zp8xT*bVRw;awI0@c+CHK?JHMq(LQ?7S#4TD^Y8|}COdl~jC(7zkZ4AzCHNR8pIZr*
z8Z$R?!^eu$ig3|tcBw4UrQE65iYD0S6@}0{nrbS(@$9wuhF@>gyxFX%iF()$gAKkM
zOkJgRcxaCFR9VSW(XMkl6r4%^NEq5s*Xm~1rWtdM{F9^UL}000r*qTplY7b}(|nzg
zj$;OWSElNK;&Im^SuYOxhpLUfM~&CRoFuaY16(4~7o5|$KM&}9Wc~5bCQ<i~-%GA8
zg01Gw_cmnH9&pcTmmyib6p8t@r=Nv;NHG~-EWX<FpY}DxhSQwhYt2e7RpDA^JjRQ*
z(Qv0)HY^ETGQNeWcB1<xSm)fOq~p>T8(yeG`A)Nv<hQ8f^fi`*mAt2u$21f2IT_sI
zX5u2ndC=IS`?rQ^&y><Dj-bxb#)7?8Gup{4Fw$Y^wWc{#dX{nLMPYPjiQcTcdt>eu
zj*G*ghk~c`^A~H93A+Kiem_9$^Z~2jLraRG_vFQe{u+7#F`wyaEoPq`Q`W3XV_r*0
zV+r%0Y;xnX6n~%HP^NK+X*i?d+LGysj@)cyun>+PPb!<QTEEJY)<t|C{+Ll%HF^A+
z`&3i<vd9P?9|<kVm#JS@oLNk&#U+|lmiaH7r#FNGtN9L@&Jf+ncPf`dRnKXrxg%T)
z)h4~h(z>oYnj`mwTj9qYWev)c708c8sd%L`^fBXGN9D`hoT)hS4?G+a=I|$wNZcw^
zE`Th)dc1g%HwbS67H*bZv8>`0P!P0h%_ip`E9QnF{$4)8KX4ME*3}yfHj<~|3hqfV
zbrs9<H4_aMaCqVP<&Jy8FPxedS%7>=EurUU$Hyf%`Ym=QL?tD?_~<lO|Ev#xd5GY9
zoa@xe_kzqC?LrogPBqNZn9XtDpuZdfCFijjWFM$f|GsQ_VbmsCO9-7+vfQ9IcAxLS
z!z|Yk?3VBBodZV~J*j<|Win*$m4lPw{CQ|82fV=)I4+Pa!>Jm`7Rzco*63iNrnM3C
z-c(Edl|S$T6G>!dTA^!HGYbY=zS?Z{9rFgMOO4rn?Zaz$7f{!wFe<9$4f+7xhWWKC
zNXW@|E_9q&u%9eL1eDyg(G94ukoG-nZMHp@jg^ryX@R|XWXn%HCK~QM!026=!>lHe
z_4-NFrZvKq*Dng)rKqXaUNurelgId+CCFcTF$UJQog=-c>fk*Y6a_IQeeQET^|7KQ
zT*i75MdziBud0+eG;I7@9Fx0*;Y|6MMHvei`DV5w&+Dmr*?38qzxno+9^x5^sl@i;
z=|8;>qjIEK6TK2&B=T0%3D=Yf2}RdBo#TbfAM57}&t7*z0n4^ya;JU1p_k*22PTdu
z&z|QSm%Ru9S33)-$7~Cd=W2B-8N!zf0=-?Oy+RGOvC=V^pG_5g6lJckGY<Lc<{XU5
z`ZeAGtIcQX6Z3nsdxC^BQ~pZ++lPFHTXBw4!c^<>g*`D5nRf3^t|24*e|*%C?(BT_
z*&T-N+~6@oF9osWvi2|561ggRA5I<kzGxk5^tIremh7Nxs5g;*ZwI}yR=T}1(GlW3
zDSu_hweQR{A8I|bCDq<k(96iOt_RlOuJn@armMCoaShzPJ9ZvtIzp&~@0#<J1QDif
z7rXM-zq$X?`Nzr)NhUawak}HxoCZ8-$953QEc1GFk-&&=1ga*9b&vs=R^^6#KMFCB
zA-A51UeEOPvRaA~X-7@f(#BNr7qZ0sNmtpW*tC*DuU&fugxg_`zIvX@h4WGsg<%#C
zkH7eA!wa2l*bO6G_+HNgw-Me=irdpB6B1;BE_@*uH3M$wt79p^dFT8{$a#`}nR#Y0
z-D;}5;mlZ!u-bx*MN5X^mi^&+XY6}(AKmIkrP|FZU7rz_lCu8J&gPits&Lz|zeaPQ
z>BULC2x=ObF=etdGNL|g`bB^)kXeDn^Q?LUGmEj?I}>ZMJAeffC`4F0Wa%-y|BJX8
zjr@hha-M$K>tV>?;Q{8gaohCvUxEF=7myax0Uz5CE91tJ@jaTc1t5b<O~2umu)U)t
zf4b6fzT1p(xt>bdJhGOwDW+`IoERM--d!RVeEF8ibZ#{ufT5|tB)RY|Aq#f|uh^)<
zNj6IX$qf(XEry7TR48HdYl`8*pMsS8@?Sr7F~p&iM9KY<cf2Dnkx8`S;(xd<q(#Jj
zJ^%B*G$2m=Zrd-{82eL;si&WPZr>;|(u<*lp~eqJZ6<5e?_{6m^)fV!K@(NdOv?5+
z`S<dqy6@>xTCBJFUa5B)PBq03ZIEs$%`xhnV;{b5HZ11}E$LnI-P$~8*enyVnvd~Q
zm$`5jmwxPkS3Lag(G}P<4KG>Yp~}(V+RaKbu_q=d|B3z;?Gk>w8>UEU6G48YTc^ve
zm^F>vbzYt0ZH5D%)we#34<jcU8;+%-sY-+kt)_Zp87VtM7e9{|3tgg2(tdfDXj0jS
zE1{JRac0^0gpTMVq8wE+tg~}GtkX<KfS^hv)-J9=Xw<=7uR6KJpL?x|DHZqinXmop
z<XeMdI)bc|?9;w)lA6m7G`0@QE_#QFEjAx(*NF<0l|7cy!4v!R%BB!lZ{tw#lpTu-
zrkfYmAgDH{4bGO6p}k~dc4z_7&VJqs6)UDx4Qi9Hfqd~z(&;$W&Rt+{<6O4#{&uoQ
zenc6y?GcIiGRGD+lfR8fJ`a%z+61Y#-**sMOuq%uOM-8Kb3v9T`*<MwFp~%KoBfi@
znT>o`Q4ctVI-Dks*Oc?O>*2x#nMFH5Ms)JK-)2m+GG-%&^I)c{+j>%%2Z^`+v8?WC
zgbN&UFg0GjT+|?uuv<Q!V&k*k;<vdyt~@5Xdposj%;At<<uJ&)M%SnPpnHv^G!@gG
zUqbD$I_otbaQuoV!+ZX+VR(KX@#)DIKHY**nc~@R6%OOYl?4S3lSTS-!Sq?!{3ZZ%
zOgyc|$ck`2WM5&$RTzBx4}p9Y0tj%<dtI<*H=nf>o3G%w>OyK-!C=`+I9a{qdM_+3
zbICj_XO$c^A)f)Fxd|?d#ye>Czv$sTVhuX8iY)aOqO}{{#1N97#ei;C)%ZzVmXg(L
z{#4#Ng0MwQPoKsmhmqI-=HB#ugr)ZsZh7vyIaZW<ySUF99FZg%HQ3BUj0@1A*fbx!
zFKIwro*kt^9_#9kzuna3+;ab9P=v+M8!Nz}nhJ@RX~>E*#29s+7GH~>UifG668|T#
zCvJ8Lrr263KC{O5=&X4kGY>#a67GIfO!(4BGUZ>clXzmVz0*yuh~@0M9x<l`J#o?E
ztsykdHU%~H)lIx9VJyFxJocMRQo0DdVtOSRaCE&7PVJYfiWpb$-f~My1cB4(*XFgg
ztoJ~>wgRqL_jPp{GzM=1(7VcJZ_%O}t#3HcKJ|G_67a0;zyHlTN5exlZw8kNQP7yB
z+>Rg7Ol&;P1a8ex5_tr=A@g26X1FIw@RL(WI-h_*KG?^wc<B{9vf>HLhz&$?N-IW;
z0<wKoOc<0x&6j<ELL&i`9*aZ*!jGBqV_)M-sob?aBXs9CJ68hv)iZ^2$gVT3Q$|uH
z*)}ab7~*t-u^YD=DnM(}I{9%#LoIknun3WrzkdTRg+gs&N@0P9rshrOrqeZ%%lN-W
zl0N^LZ@z}R8J=&f0#@iYcPoUu#oF5X&LCukyZ3fjkQtOEVF|o*T|z=ad-Q?>3wW*T
z_$(Pf_V6bya}fW}cdob_)Hi19y-Fls;5rfsUEZWn$Vq5b#SOa&>788+GE1Z0CZDn-
zMnjTe_s*lMnQY$uQjVm&8A;Vs=Patgt|ppPE!fVK-#W<P1X3%uJVi3pL2ieASW^W(
zGTOOTgPZtpL6e5xC5mZx#nW~t%Gxq#>pns2<r$TrE=kzO%jYvdZNYQSgDY1PxI~7N
zWs~8PkENue9qs^3wFCg!6>iI&F&kj56ga&}R!j2BuPZGb9G#wyn*TrCeCj54N(jix
zs9$F#l8{`!EK)kYxlj7IKku%J2dQn^Pt}5%YPM+xCu;*`6j9p8?R%g*ii8aobkE@f
z0QXJ>0Jz)Fog5GPL1k?R(C{-~bP9T;jG$gNa5#DM@V9T@tZF(_0MY0-$qH`qd0wMv
zZ^WL=zT3SaT;RH6e)B)p7SG*C!+U=eJN{&8H8a{N>FMEhGb_Mt;BjXCl72GeqYsw+
z&LJkg0MM?`74w2@H-2eWTRR#S<@!J2SW(6lMG6iLfRS$*8ynBz>%F9NOHWIC2)I4n
zbN0;)&|1UfT#Fn3#v(iTJKz4t8arBcIcYw6qyyU^Yo4|IhFkSbSbQG{L&ov-|E3TD
z3mfJsf>HU4oZtJX5Ja^37NjFh60W&8q|A+2gZ_vj0JmBA*qN7?*9~6H4wo-jg2QW&
zC13&=e_l_r$J)LU|4hjh!n^>SH7(5|=#;1f=y4j2SRQWfJJ^mWBL3)$(<wY~2v^OQ
z{U5+x$-e#B@e^y+RlttfI*Syo1oj<lj257$1_vK2Im$c9(S#`6js@D0DWd4X5K3Hr
zEZ)<8=f4|m2+d5ryRkE2uU0CI$`1&%>+ia+X^{F&q8v4YD9Fig0JRTEQ#lsM|N9o1
zDnFJ|XgqyLhGpbcTh(4+wI4-<9EI*rHcx@#@M3NoxSKkp2Ht|)BNfXf;|#0q`p2Oa
zaE~bqTB(}R384Mx<TTRr83#m6RCE~uc)fmVNO{8VrY8C3$Gq5=!Or5Po!X%(e#m{G
zp#TCLrI+PKK;!f&6+$HrQN%*&*mi#54{Q2U1o-&8y;305W6B9|SY@^9-?T2_ztWkH
zLNtaS?vgyxN|%1_8rdu?EQ~|9|HUx6L%R`F@ua1sl7aocuIOU+U%L|QdO08N&#(SF
zJm&m*+be?*F<_Kjl?MD{bwQ>G`?#)Pg&JT)SHUEmRcRffjH`ZojjMuv?<L*eLIswM
zF6iSC#UU($(rLVPbp&8E?@Sx*#NM6@NRrYy8&0#n2Yb=Y98sU6QC-*)za7Ee2@sm7
z?+^$W*S%9P+W}6OT64aeMG?dA2Am~`F$00e6_#=wZ0dOb%tHnrKmX0`*BU|CX%8zd
z7D$CG=XHZD#%1an2yribf6dGo)j7}0BizBHmiRE!nAzoD@?huD{NLv~ow&(EUwks0
zM95{WmkE;>Z5Um&0Q{HDtz2A$f*l=`AvEbf0L`3!P2OMX@7`;TyGVrsy*%fhON`cB
zr_RAvIvS~|Dy<q(OHuM@t1vSTc&N=Aoxc7^;MdVV-i$sH565#=lU9(T9{30cZxsyD
zac(+6(3HN+8|>Fyq7Erf@CK2{5Yw6VuGq=0nA>CapuNTAB~V6BE&Y1KrS_Sk5oz=P
zDJ-N!7Bfl3A=~rK&{bU#AXcTe52`aNxg;VgHvQ&CK$Q!gS(82|YiC0bYASh@*#Qt#
z^9;zH7?rbeT)=!bzI=K+ZsN!PjUgzWYJ+?!%3C?+58zxbfh&|>$<CoVhKA=6N(>xv
zHs#u3KAoit-UmN;5>yo@fGzdAYcigE|Ez{>O&K!C;zwFL91u_Z<PhIp0T6-Fvc~N}
z_qE;>QZWcDhUOYHaHeGS*-psAz#^J~8`$S7=wG3XtBaBbg@V)71|+^7mH-X_wYe!#
zV5&Oj0n8j=Zz*2Xn;!-pzgN{%SDaV|2JA*PiEOqp-*mA;g8=Cz2a%9@b@0@|B%VNs
z7h@aQ7bE@(UzCW;#DNik%-_v3=SoQ2Ro)~)(?^0vwF}`vpdUcl+WNRS2=*_1?Crm<
zNg0y8|C{6b-)^Ud3Mb=6qL{5g0|^AHsEo{}CIU$4rnRtrO@@JG!wn$YD3ar%P)O@a
z5w&T!UD5{$xglinLJ*f<`ei*Gnv>;r@9-^ZdcW28y4ZPBB6i(<lk&jMAr}X$JmgyV
z*bY{Def4^HAje=rKrbWR*8SbDq-SZ7|NKDM|7?(-EiHW-k8`MOMKK8he~aGnp`o{u
zm{t1d%cIs-#bzNgP7bi?e>MK;&tZ%E^eOe7;A*B1x6N=DGeK%)27?AQh;>ZO$vUCZ
zojoFh5TzJ#YV+1A#@fix-Rc2F6cMli-=n0ai74AA*3{BJ`SURYN-rBK)q!MaN(*`5
zVMwc*&ydl|wAQF}fS>uB2uYY=CQNO;_Anz&Zz2Wb<FvqV$P~61xEv#Ck2Lr3iLkMN
znHwCY_%71_-NLrjWYRF#2O&2oD!~7{2S-Ocz+`}1+7FPY#%h2{Y;pm<C4RCK*iqzY
z##w1TcJC&Z`nt|w_fL$f1{;|+A4|Ii4AW<USdP1K9fWwz!7&)H3r&dv8I(pA&dY@5
zUi{>dm1+nvTA_sqmqE(Jf4>8(wfHg{DZxNG+QJ{^#*rJ0*9_*b@s$8^<koDxBvx|K
z$lfsE!1>+XC^FMq5MOP9eix6H9M>CqfxJSB0zQV&mkD%P+3_?x?|(j0Zsn;BS0G;s
zwNW0{0Zwooe*5HeKZNvxxn$!!kT3EXhM1hz=Q=5r#QYgDJ8){eW6>+&X}HEZLA-=W
zN(3N5<q)cYQ&Q#r3jyD`!fp!A=mZf74cuA@o8RN5XUpg8#tn<#LnLE$PuR_W9Umv_
z5%EXt9?@c3{c!)yQcFt^2CMK4oOJ_PqczaZyl!ddys8(zO{1i675(1{RrVqa^4K$i
z`mq&wyf^>TKFoxn<ZITO+h#Yh%7^JH2L|gQ<sC-XE+^nzk5{oS2LQaTCqJJVO??8u
z+UH9Iuqytu7|Cw3*tz<iVM5yHz;b&E0CdA`kyPiKdw3znfSAih&^NoXV-A}LPFyHX
zw*3<7C5A5p>Z0UKJ*Z&qN9i(NzEFO0Q@Oos7jm9(E7vx0l;iN`mroh5JE?ZNfUX2s
z-j5<9#LQ92v1)N_F`cWRL76FClim!|&Y;{S$?S3?ab&p9C1@KlUd(Caj~>icu5wwH
zt3`M7mK5%Vo-*c>9P%}Ed6ez?Zx+?$1P%i~;(v|@whuC1#axs%*=bm#wj=Lf>0V7!
z!^5I;)6?gF^8{WFS2Nu=rDZ^#fN*vfjrH`08@tPlNtKPgdNHt4tQ0wAV0$LXu8#eE
z-uVBN3(vfw1WktiILmuaHu`yOv)fW;*UhZ1uD(uF(>245Htl;k7Ua=|vn_~kV3C19
zpVkd1J?+7=f0(vs3}Q9@!1!6b!q~^UG|P_gWGkS7!N9pYb*&rE`lD_B2Iw1a;!4E~
zhbJFq(O*w3zwS-HXvqkS`d^fA@_0m^*Q#zSNWdZcs?0w}#(-tv`hX92vywS?9i!6<
z_N34;ic1*^$!D{bByD?C^OD79tE}s4XB6`rNFU-oiKMs&-D-&=d)A}+!ufxmGPxkT
zqDR>Y$U7j)e7YYZGx&&-LIJWV2g3X@iEPf#Ayvsh#d#Bm4Ann<`ow8#&{{_|c6ZAl
z5*rdL|Eu@AcVWq-q#)RQ;YMKZBFyBOV2(&o!U4B8&99^O8{9+K!qjGRQ&Uqe=mEyv
za`mTC{0{Y6&|{)7H{0^B(eWC;we)Sd?{L2ZR*YpUAlJD`kDCLDrZdN(9(&a&i9gU0
zmc+q_cj(bT6nq_!G{MiEQX*a!h!fC<?i-hU<Bh1-I1}Cys#mEn5@U_{)e{!3B)v(1
zYxCWUG@~P|=5IK4@7$s{w^9y>N&o8i;y}D0*t$H%GmJ(Dra}tHsi^#l<ZI(zyqlcV
z-(}l;g!=7jZLP|T&ECFK`uB6*ihgZaLPBiXQfo1KgE18Wj*?4fTL>~mqI~~-j4cKB
z?xUnY%{E!@C5T`7R_EZS8vChx27Q{f0>1)vQ!CCbk7rs^5e9F%!{S2Zgllx3KE`qm
zgX*>GY>Ue1X*}i+9MPeNsv)HuaU3rRgDXWs4E~v>#@{!Jq|<K{VlM-SW(e4rq=Q2u
zV3xFiDD_gs7E<TB-1+tBkv}<>%%kPR`B!B_yY%gRI1T3^U}j4vGao&AbjAXZCpug7
zqUaz5Sn`8N8jY}pTrCQ=uKyfBfNKDF^zU_5KUZ)lq_alz(?1iu#MK=1J_J6_?*p5z
zWT!V&+ULbTHDT<IVA)x$ettT0OXxk}BKrzUw^>Cc*+0=u%*TW<d#BmD_t<UhsC4r^
z)9o=nGu+<bI3`}b@mxX<{~7$EUxR@=te@;09Y=_-V1G^gzi7OT7{`ak>_QH3FeTv9
za4xD5q)0;@*oLnM=$O9#YFl|)+~DK)AbROzM^P+(019q#I|6J&0F6FbpG5<~kz-|k
zg_kx=MIy9Qip(qFp~#0Ld&)(sK854C`b>;F<w|noPct~^#Yr9UsnNk>nIP1Gs~i0D
z-q%7Y9@XHadXNg?aEqFOvEO)8^fW?AL2v$R%Lv1m$gj1v2Er_02bl|m%W-MMXX@a+
z|4*d;@q3fgmoGo$+*Z^b$LdQ<A7eZG;3_2Z)swjO8G(?-xY3u+i8qCiBjDz+CC4q?
zJ}G>IATvVJ$_L5=7IAWG;m;Qky)%r(;tzTI7TY30P1dTLG?4?YSE$Iyk$e>wc0Ioj
z+e=~qo0}aGtmU=vEM!_>9bCijCU(|lB(<Y?xT`}F)Dd)gm*ejRPU&TTUP2h+WiK{J
z{;US_6_4IG#L)msXlQ@m6$1pwbs<%cE;3S6zZO{xktbjNm1%MOmmdliG&VaUGi_GD
z8{A*++E>wVye<o(A%t>~KrGnX$9DJy1l-&T@4Jx&?S<1pf~g5X{QKFW1joKEyM-*X
zhi2lHapb(%K==U!hn9G>Me9OUfAReDC?R^V<a(bXr_d<@H0wviE+5|Pbw_IMFbblu
z1eZahDX?8O3{q5)>)#r|EqZW6urW2yE^;wKf|Z4h^l(9L1RhqYD80<A(Zm^uiuuKc
zxY%C-*exG_JWVIhh=66=)rWX%q6A1l!reWNW%Oo?vS+#7fNhRJ%(*l43MrO;s}j4C
zEEF-GAhk1v0qfw$YEM$*tMkF!aqQ)7s=w^`ek*$l8pO5QVgH7!UkV4&2|V9j(HA}l
zO3k22Ap2mWE)9w&3lraCF>vM>QQ~A!fc-zFzB($(uKk*3=s`M%P(bM#x<ODuK#=Z|
zPAQ3@LqSvwLQ+Ijx)G4>6p*f=L!>+AJL9A8@B7EK9@pc7``qU~=eqXZ*WN7lBca8R
z2*LUE$?%gY!qRy$T*(~<MLNob5IMb0JS<M&Ia^L6S#s-D0i3yx20v0SKLj$H#_1g4
zEBYl8|F;7v2~ug?J+rr2{S7XvMP}%Q1BNdIc8Q@kb!}$n40I!=_f!e{1k5m+B}QdL
zDI(Vi<CWF)FA_vlo@~w3j`80Wl%c(Sk=w<4k#N$)+Yf+h8;yVmw6akxE1^H1;u!eQ
z;-x+!{>sY_&B212G%wH&?Ezv)Hg1Oj+3a=FClX6wDoE^4pZwpkxmg`_?la`@2NH@A
zIygAEp6ufZInkYdq9O^p!ZC4E^9P}JUV+mP3X4FzO=F?U8=!b0eszrsEVi;LKp2}=
zWH}msn@ITWWYRdx`u;ZY_V6fq0{Vk)pfNrK(8W&xr+rD4_cg8Y{P?w~sAwa7y?M8b
zGvlJ^5|HBJ<Qk#Pw9wYZP!wyv!oC(Y#JG_pLY*s#JnYfUod?^pbNAv!R1_tlYaywn
z+m-SLD~+Mp+&C%SRxR(|@!?oL0amvc+gVwxC|So!%!3Xr1@7Eh+--+enZhaGwjnBH
z50Tsu&14!dD-<zvsxHWY4_IBzOZL6h<|0G^D;P&!ySM%AX^J`{uK(>IIBDFWq{fH)
zAe(L)&lL?@EbacWA!()1tecyf3h3Z{#8>;>x{Ij?KrFt~p(vfIw>7`s^J(6{zwrK|
zfBT|eNCZOxvIcOq>XotEw&*GS|GAN%jV?0JDi=5!Kz~gKrZo?SHNS%HrO=L}QI7zl
zX7vlW!q5gJrT{Ah-zf<;ugKtI>qw(NuPXxDhYj-wBu~Q~NpfH`07Y9<#$aM*&Y>=W
zzJS+Z*5k4*?W=x~V$gKyrrd86v`sAoL#;5tX3)__{=fm?v+=$<xG-2SB06+1nlfrR
z|KJD)8ovJ_G@-h``+ZI;?zL$|C4wNd@s9TE68}PG%mg4D&wz^7X)-+1PT$c>g>GkA
zFfz!(lQ6~N-!O;r=9);K9CZ?A;vWWvt<b#Txz6O=+_pvtFmfN|sc+8!-eTzCakL`_
z8MAaJt~&ok;$@x<>K+6<PU|fZ26Uwh_7-QA2qqpf1B|{uoNo1tG|ua51JR-4HJ;0N
z#aZ8SC~HI1<<XzSyA1T`6^KmI&vcadTP2s1LVi5HmBxcU7P1ckfqUv@ZVu!B2$uRt
z4!9enfy``9P!e;ehaSPy&e8MN6&33FvFKt@@K2WpEE`lgaF!wwzm{l#oMwKh2;?kt
z06KV&s1x+CW^#O@C;-@)ns>%1=B?u!g#bV6H|RJav;PLmz|Zxb{vIT?t}AKicLzLJ
zJD86I*0ohvy26{HaQKR77p|iGn{LzC3`$t8Hp91abTCQGzsvplXar4fu)@wGOH0d0
zfx(HgM@|ivSiLhHH1Jss@d;`+94vWYlXjF6Vsmy6eHAOl#AhW&+W)(m{pF1%fF%Hl
zd^$+f(e>GyT&9s?y+Fh5HlXb#y0lUC1UMWaZseaA$3~Wn0Z>E08Cd<CX~s#a7X#KS
zC_(=tj`zeVEYF7I*H%HV@D}Y1fc{ww7_tXzHo`_=uU?`5#tJ;>RFS!2Oothaj_%Gt
zhTJwHAt8YiK<Bd)P2u>L6(3X+ntAF+MF4~}qVl)i@)IDy8y+4W#9OMUn17b?<A=7K
ze|yduaN+4{Y?Lppu1@;%T;LCTIZ4Bl=uTp^M3xO8fTEZz`Nj+5pg`AX#0OU9^q+i%
zMMdABRZl{Pauxr9DPjN4^%0IXS2hy~?+tX!R4jqV5b(JGnAjLcGjJ>4a}|_`A}Dr#
zl^<LB-@_@ElcRxD$+QBNR`l*!&H-?M1~oOco=Kh8>T~m=$3b`63OsUM>xWSdK%h$r
zlQ(i%LoZ(3-@d*jv)<_{;m!_#slK>AF!90$D9CO#`aErTUgNjR=GLTjR9ZXwr-DMS
zr#(Yu*b(EOj##@DC_NLwWJL~`a*C8sFrI3?8A(tK-~>0#J@k0)hjy@(RzY5;;CQ*B
zb3}XnuqyuBu(*+k=B~nri6Ftx7)-f;m4~c>eo_<(lfLIRZDTBKi{2;bAIM%AhL;IK
zxNo3;ZRTWxVk(QRp#qoDs|Nr5+%dD~2}~gBmK2kv;km=8Qbi#sJK3K8UCx&|x6kl>
ziUsLb^aUTI&68|E>g-vdb1CoNBg)FFk<!iIUt;|+G`avvhTbmG#tjEfDFEZGZ~}As
zpN%(7ko`Q--PGv!$@RAyQMFV@oC^OkZ^0P{v*o|+^ryFNtgM=)Xn_q%ZllldX+yz*
zvpKD*|G}p+21Z7AD+&MnbM00Dy$^wdukag42hVuy>#JJv=c5kRNTl!YqyG#ZTl-%>
zqn5cxjgJ$OiOE$*7BJ!Z<EME8KuU!GQd%AB{jIv1i>d~_NZ_CRuye-UH@D$#Qvu7g
zzXoiBZvwNPf`jAZMeFt@AUZcoS_LSY8TR1N&;yq=3NY{f!&*L45sg4A$NXI|4~th$
zy0cG6<OO{}fkA-z@jWf@jX1qi@dw&OzYpbeci^C5^R@WR0yu=T{cSFlmH{PK;iROb
z)YbNkW*E>cV}*VF{T#r@D^DHZ^wns$6751n?jKji|5d2$;4mY^RKOktJ1?7J4t)83
z6c$Oez~>2#a>ssu_4jm)Ia2&18l2`nI668L9=*kH{{1~E=#fa|EkKZak@2^~`zX|p
z531Zp#6o>*Mst*@QN~Vl>(2?^Q?M!<|2v~7+xxxyjw)~yt;f5gRx-*S4R8RTE76K-
zP;gO!zT@92%2uDI%2g5$?tljb;7_&$IGYgWAUZ4quyBUP+mA0*(S%hg0CVl7kB`Bn
zur?-_z$k$wHu97Y2`h1^7V>LNyZ@*|<rwAQ%cvd!bqW2uxY}B6yx$*ZZA=Z~jDy^A
z+u&g4FJ9b91`HL|DU1M{|FgWQCFSL>o&W1W*l=Jx-*gB=GeBdADq$Pt^=QN~(AR%w
zUK>Fm5V#~RAP{ocH&PI4#Y;JGro_?MYKQEe74((dApLs!sF{fq<RmBuu>9@7uAfXs
zX4GM*M}g+~a!indf}$E+7{HUoJOIzpJF%AH-v<YEY1X5}c=ZRql+dN7p>cw71FxG2
z6c`OSJ@rR0(W7I<hjl*PKMep(!DeQxtS4n^2zS^(?JyFHlXLRNb=rux)0i464!QOA
z!YzA7wGk@LrvK}z>@mL(>{s9MY}1IlbW6fu0RAu(NYh%M8_825Qv1T{1XzC>Ah6XK
zim4)PE%4CJK`}3mz}trbO!p1Cewr$<)B|xMLm;@e2y+cE02LKIpu>4;h~Gy4sT?D=
zFEhQdyZ@RioRYm<xhdzvL`5H@ht>CqETpGNIfjG%@0u`91Xdj(i8z{o>rF+qnA>bV
z0P=rwG!9}sULU#<sIkb|j)qswYJK{qdjBI)!CP{cG}bn_{hyMx8dx;h_&=z+U9<4b
zxaGj<4S*1@5LL6u%z*Qf06u5WUlV0f;w*GLS1iX$$rbL{?=safKlGa|Xd}~+clo&R
zMT3>&#bd4s3!y$W!L2(0Cr)|(zmIVNn3r<a0e(<(M!DJ(5Y%Y8Y8W`-oD|vi13d^Z
zKLx$df)l;m)Y|6ezIhiK)BdxM;Aw!^ML3IATD=GVErOqfvAMmi2`&b%kwi4P2Y7}m
z;45>?jZem$--t8b!{1Q1_e_m7MV+Hur>o{T@WJymSEj43UsYo!6^1JC;X+~Zn#1B+
zv6s#~_=$c7q?I2gM1D;CBjq|~{KHXunec$5l$5&;Sj6{tDtbXly(Rmn(G>Lt&f|Z7
zG39__^afWEFrE400j}{903ANbClJUt<e=d**+GHs8uZ$PTPy!?9@^K;GEYVbZE2k>
z6!T$@n+i3}CpXR;Dhq=FT}t4)U9u<3k!8$pU{g+TgQ2xabk+$MpXj&D8^{mke_JkW
z!^K|~bi#xb7U1mKr$B2<L4I{6CYX4u$-U<5?mnpb1sFJ7yI%_K{6D{_GoSH<?%O{v
z!T{L4)DZ{-xY*lsf%v9fMH+Ate3n1KSCmIr1Xqa`efw)aK0vV+*d44Qgd+^dxO@S(
zrUBuSI)@EPSGY`7hTpMf?7c9v#3By<5ymt(W^=3kfVLl>aQeQ1WsY4$wBA|s&TB}|
zeJ9tx6V5wwB^=+-jICk}X$xtvpc7bAqh&l$Iw*QRjV<%mB#}Rv<oF-L`q|l*mF`bn
zTwLva_r2%Xb+l5bwhDm?M#y?^P?lp@26;_D9PLeY@)_7K$~KtG@7o@`@1yS0TU)uh
zy840t{ayY%J<i0h+MR&<$$U0Nu`3kMubSKnV7<x7^5Wez)zF<diwAvY7;^Hi7_#QE
ztp%OEW6IQPR98E`*=Kz8%74BE$PcvJ7y&1_R`j!daK54Ys)qv}^Uvo1%5Z1!?*Z4!
zk?0cTdZ)6~haEhklikmh>!UoN2+IIT1bRE#>`BSVpJ(P85D3Dpn|&jCY`;zO95{@P
ziyY1rP8U!nUIV&E((gq&-7ZJnn83n(ImJa_>-fx`+iW=<T&z`52m9VF6UGe(af^j|
zU!};Ibw0h4U&|GN%j{n9q<_|!$}Sd<N}>sDCnSqZ3602${`akEoy`Ud$^*DZlH+lL
z!XB7i`SS|Un_&wx0s)pHv7lS;c`A4-6+ecDDeAui%J435A|u>42c62-0uRM~2^=nv
zNa(5m^NxxqhE-5Rii;4Eg1;%O^r%;OKvx)<MksQ6y{(yB`^(Rb7N|*Ta<ZYe#m&sJ
zQP1}T8~IPfzrtos%pN>vU4)CSbSWyZI6dGYzIQ_;Ey{h~{p#U5g1VB8M7{-jfh^Ob
zjZI1V{hiM=q49Nf^uGa%r-K|G&RTMUf-kGP2&j$gYoF2ZbLbbEWCb~sy!yMdvq{Fg
zClMHMHyiZ1s!Wb<G9KAuq-10qH-JEFbiT;Qs5EPwWdz1G*3ocL_D496ZjGE_H>Cl4
zvjAk-K+tb5{8ys$v%3P3h&+NA16G!lom(G}c&;o4N-ioR)k+Qd1O?ZOeCymvrkgYg
zXSJX)+nJ5pw0dSlxXHIxu=+w3GH>0)YgQ9&$cI7nIdF7`ov*vdXEXn+t(xw*=20hd
zG&TZ0OON0TIEI~}z{e?a?>`<#F$O+wCh+pcpCg<VO?YR14z#pnrK6|c8=IcA16bl?
zVHue%gc20n#wl}iD4k7tPt0jWbYC|)mM<yotGvPL$Y-4wusr$2U~ts5tTf117|DdJ
znw}nBHM$YvAk{7DFJhDMj6;8v>rfbVZ-j`Jv;~C`E<WfOusokthvsqESc|%9pM3Hh
z>y_^#OMzMk<*f4)UJS~OBC}6ed-=A$-p>5|>cbngL-YSN5Nf~V8O?7D0ymtbq>y@N
zlf}+zA2$yVL4u;cw_U`z-)~$b?Vm511$66Opt#;0E;1w~CiWwdAHANqDRxT$6D}dK
zUZg-ogbNX}#Br3M$!1mT6EraYGz$Cr5&c+Qpo3w}#4CG@QZ2<ZkqCl5I>F9ofsXFo
z^n0B)yyT{C(suEsVE55Erbyx&qkX@}E#f~3=AeC>KV&XTj6z;rzZGa*!KuxysbQS(
zY?E-y6!e`SU9N*rbwa?_UsqV00}0dqN9XJ8VmpvV2?{2sr{8y-ty@=Za<wpJ0G@MX
zpZo{@e(w?EjFsO2sm<T24Yr#^sVwW?s&s6W1I>aCfJgmoJbb{>$deqR+;@?nju9*R
zihk=XU40x!k(&VLu{*kmWVuL`DdQlKf1ZXoiAIQHA>6f~5Q9D`k@`2dH@gHqRz)|p
zFrw@l^O&QXm2Yoq-t@9+cex?l^w2VCEn1Z5wgRkfE@|`2$B&|iZN=#2E#k&do|hd_
zZ$+J6sqep-#CZ9P5X~e2vA~Dl!(UEX8>>=GzXB6H-GTQK;i$_BfDCPb`t~a*LC`*s
zru}3HU;@dBa7SGp!~U-};2OvA-Y>WL8Xlj8{#4Ki|NlWU+rfN?$H)A&vJ3Ztx-9M9
zJHC%V7x%pkToKE_g#R}HztFIU_$OBxVHv=3>86Z0l3vSZrlfBIi*a3Vn7B6>iERu)
zO;>whr#yKz00K>$07QX$lm8N}r$t$S?*Rs=_&L<}g-JV_Q_lUF;TqpnAVO^yl`7{l
zzAGnci&VddSvb2inc{u*{TK{b?-J;5J8moa<z;n#i^ND5J+uwh&kN<EVBSME?kCfU
z4j2QBcYbhi(AmsjI_YG<v~~w&VE_$gC={Cu^r8!3(NlUU7@iB4&(D_nb1kh&JASzA
zmF2@56F6PQ?@UhSFCu*mbbL>X>;WRf4OXx29f0rDphka-0(fkIiZCfWcG^V5gW(%`
z&5)zlol<V|Kp(pYS%X4Z7W9<>gKDS*#!UN|*Tv2&*7@nf6uC#(!siThqBF@tcM|+_
zhNh;Zw3k+a@a1az9N=Kbz>~K$xbe+0%4dH?!@lA!QVwU*57rD9cxS8Olf@jNC{JmS
z{e?vzrZ+7MFu`N|N59D4OL~9#{Y~zOAnq+YS&KsG4YQWoGJzzE+zNO3eKH(`yj|hI
z`MuCv@9ulIC~4dQB|wa7-!IrjBno;<Xe&yyj0bjFQVtar*+lOqV029olE!I`K`hnG
zIGrKk#R2>fH36t&+N3WGsDg?|;AlHZ!fXFqxRu;N<1jV)?hJD1Wl$(It<^gx35^Dm
zbt05c+&9xi%kCsY6;lY@>@{@qBcF;sQn5ekA?!oz$FNw-fhRYLeLz_3`T4WWu_Dym
z9ZWEFDb+aFF9)geLo((sE*jbW?j{^vQj8ZPmIh38BTg3VB0(7U$@KP+H_iZyI&}1o
zkR=<0V^>Ycl9}OtPL}9#TQv()0Un#|vjg>Rr9_7}>Y1OdhPy@)5lVfbF{~u$1~Oue
zOR*w@_Q0w!o}h$*krVWOY8)IKuReaf5onpb(31>qB0cc#|GztR#rc@<_<;$ymX^XR
zy1{RIJ_l;;w$H$E^0j<`1T6!@z7g=HPch7tSpo;!6~gr(;E>B#6k)$=E`n1rF7L-d
z;kv7Jf{P^y9RcFAkMlh({=qe(Ck-cH_%-<Xp7G9ig4IGvF|pO2FZ;C{)BK>d^kb#V
zU;Xf2r|iuSEoEMLDzot7XH=Bg?MzAC*%*mm`D1@<=;*KE<@Q_Hkqy*TtBS4zh+mg-
zKYTrj;Ocrt@R<YEI%J-Ic2^FyimD4sc=N3BT)0o^N+ym>1k3j7e1}!R-Y3qrz+Z?p
z<c||8G<&gHYM}nSjp*V0H7S2qU^xm}!v9`&Ioa`3^vT%v5bP6Ka3*nIMN8xWA>;WR
zfbPOh`RzrIol>EAjX{Kxv=0bSF`~uI2h<`Pi(-)oA!K4V=;Lv1-2wd$K%z_e^hZG8
zQ#6Mv1EJ|PIU$Y}XUCR~&ur;~HNouN0C4sF*v{(M(}feL2SE;+7*=1A`363J1nI$m
zOjk?do<@JWCa8vA-6rgp&M}xr6&q}fgncD|ATw8BgsciDoJ99-P~5tk?za$o@30xG
zi5sG%uus#1orfETw57cux_-d!`L7Hib;Qi>)>JnTFl@@91wdfjdpU$`&Exgov<&oN
zpr8ETCP>BaMbwaFEtx6&DIhV%P(OWsfq-@=MO@IEUxjyofQIhr>AT5<5ZddvlQ1{4
z^_0Fr4?9IRv>Mxq%H@;51p&feBa4Y69-GkRU!)@T-Fy^7I0pu*fLd!2?RID69&Fz4
zwU~~WH^2Ofr~u*wKm5^OXcb?w5BD}6eIS(Du>!5(`I_v&U5FaH2xq8{)M7ls;>uhM
z4gfmO_f408hDF&AVfekplESfE3=k%fu9&0D%q9?uhz^t6;SNCHt~5YbpKPmsd!#5&
z6@{<L!S#^hc5^K`9?0NP`PU-ha<nj>Oewh9VfD^|PTJWjwCGWtj_mzo-T%QvR@OCR
zA`2G3Z?U3D)BhOi3&~}mBhyL32ybiwz^YDFVU43cjN?@`^V2dBjM&>v1~^#oWQ=%z
zb*OtN0gpY30O#SY1eqg)!kq+$;fo70)DBru_2KcC^Gm}Y0Vt&0MKlGN$`=hy`u+R2
z$S{0qY)=@oDn*YW;>TOxsHtyRrvlOm;gipx_}@8iMvwWS17+IEppBu8B*(OQ6VYKh
z?wVV7C`T0N?V9CAly$$Rs%f5}U{@`Oq&ymEb@;j{O;iLDDJ85Eas|twserP^3vH=g
zgHUq++a6DUanq3IIAJ>yhq0~?G?k<p<hTy~62$;@!};nNc>A+xYUl5H$O>l$l=4_L
z%_0wA$wUnj>wLE8gU`G*@(mTSUx1FAKE$1bULDARAGn@bm%)0n#&_P0l9lLX;>M&n
zp~p(mtVR8Mj0i)P5KqvNJY^`-1)4e2^{p+L7pnvD3}SXbHe9!YMi_%k4*CHQq3|Lv
ztdyk8$}b_n{LQ2f06UyY2}KT7hRx}27JXpWvVbT`juVB*4RYZinP>`c^~GN<n_n#}
zYgcP+uTeYCeV1v&q%he@<mgspfhr?m_H4~4%Bw7DRze-tLcX9c$1}d>4>)=BGf#<-
zU3;M}Aq^SHRQt^jL<l<Jn9UDjp_u<l;g><k2Z<r8G#D?=qEj@)#E&={1+v^Jo=tkW
zKG0$yt|f@e`Da*cl~_#^Y57~UKozW<-tf<#%L9WLHnO_cgX^y;(hg!_Dd1crkRTjo
z$+NYE_RYBqwPWzqH8qV5G3~SVR;qxj^pQn+hHF|-d(CG6IQya#KUr@!zBx_%tsB|k
z%Cm%Pb;1Yf1&U#<+60>XuAOH23GL-GIT4zsC2BdG+e}$U8NH9`%#BUK30ce%a&|lG
zI^_2}u^h6B9P7(Z75fXzvmZP(@+NsIkTA8KcgMh8j`L|Va+XZk@nIDHD2b4ZI#tw-
zdz>j)AN)nOJpMnd)x~5=kgp*IllHm}HWcVLl7ZYTZ}jjO2p!ZzTzJsHcyvto-ubAp
z+l@55W|B~;5?L*=7jNaxCkFIP5kS*voYKzaiwsa%WI>_hH*B~=#j`G0&763{xmwc3
zD`Vq7>TC|wkK$*`He8);^2Q6#hRPB+O#Sk({t(QbZoBVS5M1;T)mE0rUqG+FS~1nf
zoG|ZXTh;V(+NqkPD96;^=Bk9;dZ;gFX4T4`TO|FO)n+Ieqa~Iz=u2t>Pdz=6&5?vS
zL>5@ifq~PAd5G@_4;B*QsKDwIuN(7ZP?xg%8jj(PAaD6k`ElZAj${kc?kt+P3Gh;A
z_Absg8?K!A(aBDbtn?n0?HQ0bhCS%MJi5lcLo=4=k5BI^By3?;+>tg+>~{2QrE%>Y
zl}U4SqaU-P(nw`ESr}R=FqeV4ScR!?U<})UfdsRis7c@HWf2OTJ=c5*f%ANFti4id
zKRlxVAvtLXk;ttZH$p~lMBsa5?m!pXify(H$)kEH#|c?)u>KQFem?2K;NYkIWi^Dw
zLPciWoP@SjR}b+BeQ!QG&&^O$QU_G1!9NW0@s{_2^P*;Y@Y(uv16@@=)B63~L#QhO
zMgda}(~#%(Y`rY69PqHBI@W#!49|XTYH~N);de95@{ZyU?E($foKUka7e!1DdT76A
zo;^W&NXxXNOpT(PqTp78)#lD&5n^Tx#@#zpm`N50h&9KpBj9TMuAE)%UJmyL3(ks1
zCi8~@2VHlZ!{kfZ3+IQxv4+gyZWC<;&9+liCeg+1^d`-^4|y(%7xQ=?c5<d7vxd*+
zc;x)>8W`54#^*$g?Ma()0VPe)Le|88fLlGsGu^J{$&Z!wsgE)+n}w`n*RA2w=kuzO
z495)dXbLq0!3OgbVc*BdaY-!(#t7fy`w{{ITA)9@3;fg{5YpNhsb9F+Uv}b<)Cu79
zvDq4#+MKDrZhA-Y8V0!<jG(NTlDEL^xVVtMI-EpI`+eLP9rMBsxjN899W*GNbX?|t
zlRX@Z<kuWdOU@WHTa0vdXKLm(=!oWkVPJ~q@9GTpC0%|=Iz*(9>_3tw!{mr7`+UhM
z{9(0%<R^i?E$9%;PVhZC=+<92%<ek8#8DKz4axIy1EVlE`;u{g*G~wy)|eUO&l#R+
z(RQU`wV?bGp2>-_-Y}dTDG%=w$t?bNqeZ4od$M61X1s34ceOA%CjrcnHd)z%F2!OW
zW}*O(nN^E=t3S|~)k7J|^(&-6>C>96pc+vzqd?Ebd$W;tZ`?ZJv^3O<J7i8g9rRMl
z`Ctf|jaOSvlBs-boU-Ni99m$~W1s9dq46ZA&8evVEkqmdweaiY`|H?-Vv}?S+<D=n
zy1;3d^X}LqqCLC;<n%2ToAAdfv>xpqdrMs@THQ}B+i4GgQm?DTx+5@v#GRMYE;EF*
zn{9~9)uSC%%}mH%(BZa361@M!u<6TcdO*M2*st#lw)DuS1SS<$by_xrL`Kj`q12lg
z5oZH?laK=DL{~f~jc4&VE`*cjtgWLhjyHTalY<L}?Ds=46bZBNpoCqIoU)7-DL-Z<
zbG>GA`gTiLP+zcFn96bebO3cKhiH<4Q|=GUH0*7BEiwaXI_sXQZ;XQWs=;{1(fD3G
znUAoJzF7d7$SH<BW~pWF1pmT{xLIy!00#71s1GBgTRwnH7O(Qh{ktJ#(U>^iEICT7
zEWdcG4?fq!uv7#2o7a!nSmG92u!hZ{%3+!J;oplKSi=x%!yw`6+hk0sfc{Haz;21|
z+r-8aRgkd4UiyqvWa(z+hZ5ZT%d0Dl6JYCxJm^~n`haa71Q4eNLw|8}-Nc)t<yveM
z4mFw{(a^e9BB*65p+Q)Fo@>b6bemkv6+)dMcd^rwGdz!%jT1VmIcvv5O<`mRm#p|z
z!M;`JKf-m=JpJ~LYdeiXqKHqTBd8%`f41&Dsef#Bx&C@DzNo9~$@!*U8=Wm-vj8n@
zQeZ)Bl6hJwx#h%xH&`i;JSdGsE`m1GG^SZ9kiX(;J_Tq}VC4xs=l;P;Ui7%(`HfVC
zNCY7PW@~J-+)k~!Dc3MZ(VIHysCm`04k8sS`MLAi<5$~(t5RKhxRVLrYNed+eE(_v
z;AO&!k)m@DC<89&uw({99u(-+-=?+~8&HS(TVg|KF(4`yAI#}Pl<BIOU1hTik_%Jb
zzgIpDZKUgct%$)P5pcvKn-lq>AKO28w$9(Hz2NH@j*f}M<=2LN->dtsv;aS5wh-UR
z;v3zt+#ntBB7rH&5Be;(Ul~l9-;bAMsJ(JiNOQN`J;V)u&~u;Th3;+aLEDJv6km(8
z-bm4p9IW%r_?WO(a^$XMb2TIY3gNGyK?VV$;bGjSWit^C82I}-5~wS3bVDE!55c7s
z35?mwN<wHvn#t^46=^N_NF2iJNFqN*{1uKm6R-ri;mypp7p97Q0-(ErD8_f6Eu*$z
z7j`2exJdPc2me>T=$*vNYvvHv$(OhLl77TxRg0}rdcDc^%A80`iehzqADY=`bQ#5w
zrBxhhG=<Sut(}Qa^vlv9FN;u7X5<BSR!-8~$S>^i^gTN63v8|>o0(berDTkAV0=HH
zP|$1Vh-Tb=FefEk8;*>`<-b@Q<-f#*u*?&?ut5hieJJI(<W6{9VA(iSDcGb%N+CG(
zk1c*b&CLY~Cpze4Z<9Jda_ec6eREfh%dy{i->_lRdYT!sK{sxaMxbtC+O?stM0tGr
z0ImM4HvD5@5-Cw(3rZubL7#A85i85fjAnsytQX1r_u}B$->6#Kj)fv4cN#=B@!}PK
zr<p}z<yN`pP6%2Rkh3tcmOr{UI?l7~{JGg&Jf85*Ll#)Q-x$Wx?SbV`w1hnl5uh1*
zsu+4_6b`}sAGyuZw!;1HF1)kA#!>9@I)<a?jJymwNMyv>syK}lK$@$d@1GC-wcrXJ
zS5ugse`W`1v<M4hA6Oy}WpHk_u*PvM@py35<0Xq<oE-LOx8d^1HP<!1?XP#GJNlB?
ze2;=4V(CO0$&Ii;hx^AEyCohAD_T71w!nOM2e$pG{YI`OvpT!h66qCNFvPs9FJ%0r
z?V>8R4?eS3NO2N-viM}8n4O15SY1i_-KUzT%gL@vI<CEm1`<5ac&+`%_Pd|V9vUzz
z?(htA7dcZ*e_+V<N|$=8eUdPzHl>x>xWc)Ay)HevPbunVZ$q{x?2AE_Lq}z}Wy$jA
zJkqJv=HrRtouD1|X<|F^ji2wNe+5{rbUV`~YX+*CrRbbQ+cK`Q9Upd+U-AskQpxnV
zzxGeqa@v!xPPRK?iu(HUNq-<$w-j)qeKIbvVmc6D{!%K{O(h8bOtA7R56pJ&lX`|(
z5t)s#3BRVxd0#b+12fN;R254DZrgJc<CPua=XS}26)v|jGyKPT&amm%Kiqjae^30o
zqb?D-$mLR7_$5^2C<M&X+P6tr|JKH1(Z%VLf!^=-a@vG+4X1dc?bEfL&FRg^Is|Md
ztAw^#iWkGiWf(izPZGyyN)saS-lHwuxPPP8RORk|zua;=pUVh3N|xIO4O%2a68`zg
zVuI5#$Q8fxI0JLp85bM+4SUBRIQ&Nr&(0s;>9O>~K_#-&vY$CrMEEo0CS-j{g2dHV
z?+~Z&#?|&vH1Py`do7jk)HOFpbG?!ST_VPlMBXFZO&mHrRFJr~XScu4JzsAr&iC%u
z!r6qh$Y?*h-zmc7G+F8l)8`1Z3|@`T+We?Wn_DMRX8lrHr`q=N+JYH2?8djlI}L>d
zB=QsO4Kx@b^Nkl5b?>MnU$g)<iqNR!T;P762t~}!W(uI{@6L}6-c(a!rN=;0*;j>P
zkm7i-oM4gYqFFjyXMj@HV95i<v{jy@nTzW~SHlSn%Iazd*`g1~4U1kGoRDeSyp2he
z6ogD<Mt(lNS&WaEr$^vxq>$zooYHJ>rFuv1cj_Ucs2&owERc-L%3{CUB$e5gmyVao
z6AER9x&305$8ZDiRmHhlMz1b?%i0`SCMHBtfzK5>bVo?X#%!DcOIqYply7x??0`v<
zXN!XGNqi8o8BsaL4H2=o4%dx#vm8eGt}9~vZ+=4~<W!DSt<E^_ED>cL5(I|7WK#jT
z%S+CHtpRrz#uypKiXgd7_`t#gU6*=iG&QrSa|0bR`<1_Rw1xw7b$`5BfXslKNx0m}
zEye~U=@kXxL8kL=kUMrCM7)~Sb-3w_q@j8+9))BMj%08k<`?Cgr#qJm&7`_)Y^R)!
z-eGZ$LqO7_<=mfPH|+K%$Jj;Fm<RqiZ)-DZ_pfL9zBAQM)<AByDK{+`*vsz<Z!Hwo
zSSRbhkW;s|+Q(cEbr(dml$UH<n3esSD7TYPOfP0^niH}RoQrD8#qB05DpMbC0iF^a
z#reZ9S*0Duxt_o*x!zRwGHTTR6SI2TKtCq@^w1387LgDjo*#u96}vsqBljH}nC@%&
z(#c786pwo*1ZJHVOPBqQSSiNXf0HU*c@^o<a*U)qm)(56%n<CZ^DOnM7goC)FT4=F
zX$#kyC!38Gkxfi?Q#5c%#oKAn;Jio(w_~&(uOzXo3T|z-*wpDYuf&gm_1vTFmo^|P
z&@wY)7${%16Wzz%Zg-PT)E_X+$ft%%(^S@58rsTOrrtw1PbiK1GyOKyq{XX*RbE9P
zOV%x?P7DkmF(J>BR(MeGEyG~icXf4@TJmxJVXG6GyTRI*C6>yvB`!@U2>Usk@$m$o
zP>{jw-q5E!*K4_A^5WxmqF7Vn#$+vfeNQ^X7Z69>#OA^xH-&hSZsS#~yc5*#)>mI5
z{9VNM8=M<xoaS5@s@{62$|zu2M8^F>`CFEx&e+Z+Jlb^Gc(*(7)_auQqC<eOwsgAq
zd&D?A(H6*|<6WetI-#RtgbZ2EWd&u8WYTgk9SqJuNZlM~!+C9kF~#eq(}t@tlo3Tv
zD4hT!Whv$$@j;(k@NjL5jJ<N>1XdR8gy{QDB>%~32{}$^=97zqPjZJ?;ZXYKU4GPZ
zLtHLF#Ote5fIZ4GinsKUAx>H*gIY1c<kN3sB#U$RdvOn|hv_2>8LgA|R`}1$3?zlO
zpSEirb}}SJSxY_V7q8?d<lkgCU(Ejga{Lt1L1l>;?0lca{L4$6AD3&YWS6(&q4Q=k
zo(hWzL~MFOw(upKVz&y$GAOqh<pniHxF9G-ot`^!4HBc8Yp%ESp9-CSDV`NZtkbLt
zD8~HEghfEHBA&!KTyN;oEMWg__A}*FaPx!WQdkLoHwkIdRrV3n^wjsDT7IX&Y%&+&
zYWyZTF`v(k&id&YV0!Apo1>SQm1X;#aWwx3*1<}u+i#CcRgKQJ_<>s^li{VLtPHQc
z$EtEEk1Q#7@HrYmZopjf5v+)=!=673BXNwcRVK6)OFkK@6&WU`M)qDJcmU_qg=j?L
zWb}0Hm%(hC%MUk&;^Z)K(&iDGngd#C?k5U@<@`ufD0A3twpIdE?f0pMXrmAz3JcM!
zLiH0>m#{xT?V7r{z$)fcBbY}v6`xkNOl63fTg6+G0{W9DGfN)_NRlko16Jqf=Q|r4
z8w<f`$$w_U*xNF$@(3O(-bFA)a-x`ZgaT8I4*U|{6e(-MMfFEU8`Sdpz>dDy!DQRi
z4_<TrQ27bSv73|vc^WH4wJJL!ysZIMfq2`5bJ4yszy+MUuqO7+af^%V&%&Cv^R;ty
zvs|?394ck9dXAZX3dSmfXswQS)M=@!R|8xm_v$VEXni8aa%l>ujs+1`SCfG@<5rfg
zlo6~4Q!CF7Q%@P*M(#+aE11yA=D-%7`(+X@y^)c|uTsZ8Y1-rxgS$BUw}gVY7~usR
zExnzF$g60NdG9LiQa0&8{7d2@_U8tzpY=x#?VJreWEkVHEicw)&k}jzg%C3NZxN?4
z0^`T5LA09F;pQ>;!HdLJhjH`F``7WB<IfMUADuiCQ5e_48|Rqtv|V)Uxy`dhu%Ei!
z)^r?YS#BG<{p^j~sJStob4tWvugg)sBZJjWkQzSG9EjgKfb5q+UauO|;HeweMX&c%
z;`zhQ!aXf--lAZIc#Wq=FGGtN$E&Blh3sVYw@zMrYaPY3d`q1>H@X0|Lo~2dQ4?~B
zx#-+Om$B-dn$deN^>#@qv(uu>M1^<UGRLnXL;mj9G9m6!-jMYcPqU({ogg?fJP4VN
zw9a6xe5RgJ9LUD>Viw+K<xMdV=|DicQrzEeG43q)o(7(J1lLSLSo#-6Z+%rX$Zf7}
zYv*R+&)6&6XF6;r=p8l)Aab5@=5S6`GlMZjm8qYSUGiahSM~ZmJ-k7EKY+=hA0FnS
zkQ7|UTv=mTt6WvGSw}NU7jc7eyNt0k&69!sJFKN*JNUTv^VD=6Q^3)$-LWlEM*jMP
z2WNosD6BpLM&N~e*skA!iABEqalBh#O9TIbu=LLFZ3OE4>#QXT0bG-Z+=4cZD^R;_
zXV_%Y^B|XZ7tAZ1IJsiG{0!K6UQG67%r4ps@90jak}N~6u!Uswr9JzW#D$%d-R8~a
z79Zj<K~#v;^L=N(3A?GCx9bc9n;G6cLIdR%{?=)Po1U|NH~4wSZyU|GKc{OEk-u=J
zrzH2HU^sS<yH@!!uAyKm&e~wkdSKO*tfMf-N!*U8gU!d)KBLXca-zp+GqU>KpXoSs
zwoeIsVr~xQU!`|i(~77SC&mm7&bPG!Hc~*pThhM1LBdnh7_22qGODaYfEkNbx`!O=
z_o$w$IP_xtjoJe3QL*ak*dW?^rwRYTHv3`s4*0T;Bz?t$@mGPxEz10dFgQ~$-i7zi
ztoqEp`O*<^wrf@gvz@v8PG+g-uS!d2$6WVZcmp>bc_w#^G0(XWf_=DNbhS|wT*Rdg
zxT;H(4U(=|cw7mHd#j4VcZN;pLVa1%cJBMmwwEu4y6;#R%;S?rVQ-6rcZDkB;sK@8
z2|@}Ljf4{u4RtZe1d>hR=28qelKo+XlvNYyQ>(KuUev~6o)ThaI$zrYZqjsE^48Zd
zK(5T|rFL0lwq1SS8+VGF-W7f|Pk4tFLo!_YQ@j@Rswy?Ck<bLnEpCB4bk7oTQ{ts2
zZERZ_kD{RoEO<fQLQ9y|it}hE(77pNy_H0RuQ~cOiDu=tMYUCM2OPVH5QCg=QmoW6
zsY=j-reX`v)hykUoik8O%u>-ZF$n{Dd54f1IEK>`KY|Ri=VQkysa<oP6=brqmF2*o
z<c9g%zFs1TdQTcb@N7O;Ge2<A$ay%_!Fq}=brnvs*L-a%LLtz4+j?^RtfxBq_ddL&
zdg5V1l9oDc!#Ia_8E%MTbNO<BwF_cmN5qJ9Kcb-ds3DKH>AV@<OGqIYd^kBhzG6x%
zo2$ZQ((QAD(k7-p;c({dVcijDkviuce@qtF*HO)wwzIfasYU+YH;R4@)w}pwh23Fc
z{4h8m(5H|-Xhs}y(|JtZOorzgmvi|X?=_6>%?`9{I{{wEaB{JSOn!)8zFc2z74r+e
ztVWdyLC1RWwhKNsju@Q*R1PLG%D~Vzji>|X*Q#}xY{@3qnEzz~6`Z&u5X`WNVkQ>_
zZ8>@4h5(C*OHpYG!l8M|^b#y7;N0_qrWYw%o_L58Ldy&}i3n32%}A0bOK&R6Du&{|
zZuVV#!qs_=fq|-GqGZ?0*}3nGYDMS6mj7(h>mV(&dM-l#1(Qm*xWnC&qnY*suoe8R
zeWdh?VUJ!%!s;WuUu;Ed6xEd{^if$`zrT$WvUet9jAsq|HNG=`5%bY$!oMDBoUD$q
z7Ob!82pq~0bnUqf6FZ-@lr>neRBs_+KUhAWhQMo_s32Ij!IzB9ywFC4<PVL6I9k&u
zSIBIki|wnKhI6@@{f08@4pIo}g7@MIlq>tNr|G9)n)|d*Yn;UC*iWt*GwZFhX$F>?
zDX}nah@VZfcpgk9YcReRuBMQiAa`|g{Hz%VlO=+)hWkL5;+sdqx$}5_$OGzjmt>3C
zpa~fmb?%J?yaq0Sv0aWKF2}%9&XcOXBDh|&k8#nWpzt{f;|2N7gH#sB$DDt7p|m@F
zQ69PU<%FU;Il!C;@L3P@b|TJt0WnZST2@pvkYVX&Tuz!t6)ovml~uAJsf$#4DA}vb
zDEZj_&1niYKIw_DZlux-cW*RiHSfLN>!gK-6q46PI^?|w1%GZnW;jcH6!u8w%MoVZ
zvsQIQ7Sl{USoBn<i3dNwbQZvuI7OV~hn14MCsOErztp>N90aggUBlj0y84jcx>rCP
zXqWxGE50<irp?LRHEV@=dHmXUY-A<JYb)0=`XV7qUZD>|YXR1_G6!=mf%zvHyJVKr
z`?Cq2QP=~+Hqc9@vv;9(aI4e%UKD~}%<kK88AlX*oGW|FJEf%i7RGpT%|5(jDK9}?
z;6#ypDqywfx*xNvFtHfmu-EC*NclY@ci!r7?5)E{o8E}WdEvNdYof<TiTJ_mgu`Em
zZF{ne{qj#;6pVX-g(KnKhD2Yw!5Xzc24b_KMkGTYr$^DO!9f9q>05Hl%ILgkOwv=c
zHB63ov~_4<HZIxp_|{a%B>Wvq!_y6p;b`kH&Wu3MHx0H^+9#o&*PL4B@q3u2e{y3(
zri^+mD(DYlA;#lAA5h$hW9|t@@hh`hdg$EPxj9cBk(bE{4tV)h0xdR|JevsZ*<rUT
zR`YJTR=VY$ByoGmlAUY~#c$Ea^mMSynPzhCDN7WNn20uxRtHEAZM4w`A;OEWbKzb@
zB$(TJ)P_QTZDLeWr3aVW2s!_QAF7wyWGC2V=6=+624+vzZ=g`<sP&Xo*yWn)72|Vk
zq%1Lh2uwf*PuP|id(o+<!)WrC!71S|olA-+)fnN^cGI^zva3&3f<CxxTe-ki)i%?-
zmP4QP?qHO=iB#Cl)x4F!pCpKo%lGPRDYZ81#S~Pnv?eW2wI~R}y--ZDA0l@VE}W<l
z@6nyu<(*`J?%#_Ecmsq!3i70z$)D?kk<GYn@H`L%OEd`7@=v^!>=Dzq<$A@MlxZU*
zhLmHjX{qrDlRUh+NWI!{S%o@EXRAUjWn3gSgdw<|g88UpyU)S<sdE=^jKc>2X~$4*
z84~+-P{YoMsQEM3aZeqouzsPd{0sUqOXdN&b5Ko_0?fkv>=Mwv*oCvwYuPnk{{E+X
zKr9n{wP}tz3p(ysEHkFde<r}xepW@OPXp%o+-=5K>WtApeU9`h9I-=oRTNe%o%EU@
z?(2eh%j2YbAJBe30t0XD?7E=GlpKvfV0_DP@+9b`aty{l&zDY)>%rgeVX~;>2+&;t
zGWK#l0O;PjoELMUICp;sBefR6{J<TcQeZQ}7n`(Bt&z6I<}<-)4U>e=l&r<HX*$PP
zP-MMH9j4~n@NDuelRtAu!Yk>lY3h)LFL58Wldqe&VZL=utytF^b>ov|54MH3i($Ez
zzMHT)0Ts~&ooyAB!<ef;QSr;ziv_z@BRH&BBIF1=Sa9x#-Ux-yXZ%gV?jSCaclZmT
z@J_-x_u*>dX<A+eA3`;wQ1(`)v64IO@rR{~YLt(=!fjK$J%kl#wVsa-A5D732*ZC`
zFYlCeFz-LgamXj(F@EGClR)5j?I>C=ui_00FFE4%VQI5t0oMAxEa(WXGZuV^PY7jo
zDX*O}_Q823XQ%5)o_<6Ayg6r!U@8@ta$R?2l^^wK{HpeStqkpG?I?k_&MV>=S50%p
z#LEOV*Ub2DHGrYb$1aJr%+6zCPkOuH4)w*(@2KdrU(iP2|878CEpeNlKBbAf+49E>
z-ge`9glq8GaK;k_hJy^C7jxD~`UDz2*0pe8+wV6Tg$;Z2+J%AT06X+L1XDo`(kv7s
z+^js<E?U-SC&|tS%~6_Z63?Bnm_uJg1TkVd<8pYHs;LozRPAJb`oirReJOL}7wy%q
zGC}N3;xsOF3-P7QZ#5#Awt0trvN9qwp>ie)=Gv9<lvdnc=SMCLZzravHV0hU=geVr
zyL#`?5dq)RAN$VDe2>g6L`Ue(-9Cv{R90NVs)13`9aKRnLorAS_v4%_9zPb5KwL@d
z?w@R;+02F)tE+o^dvAbaR)8<`q6y6X0~e@<2b6EYSN1c)gUk8xYCjXg%*bfZ>AcGn
znSs+R>zdZEa298Kz%U@auU-J;Q08%8LDKc^z;r-E+Vs!aGA!Rq)I}}gc$?!;-bA3%
zD**pwtRcf8d=BU!zw;^5k{!>~W+lIJrO0hUptez$sO2NNQL48*(htX&d1?dIw!58g
zs1ZRhPj|+zyeup-IS#_h!=cc<lmP;5jX!0cWWqypz9h_V=30y}SP@Btp!<p&1fNb$
z`B@_#5A}tBb{RfA?BpSP10HcGgDaGczr<c`3(BA(6=Z3i(`PI5I+lH=oK0rKrMyB>
z>b@`+1z-DTCQ;FHEN2`vQWb1TkcziCG1yo(5@RV^o$vd>g4aK+?zZ0!Ps7>m@liH+
zeLP21<ZY&kb}hBYtxT%tx5DVL_cjb_UA}9v4;qy$Loe0L=nY-&sq56yq?-5@I)4+$
zr^LBM@jX6=X%a^0Eol031^D@!eiXb(CXFx0QrvXHGB7`8B-Rb`0V*Dd<1-u>V>)^(
z*S5ihb1icrab((N?wR~esFCb39!t36bgaX8v5}5daj#a40L~=)OVTW#B<TivaxNF#
zzFT9qmkMWECmR`;WeB}t#$gCRRt-(Xc4!!cDW^kO20%_mTMAU096G9S`XQtr2E2Ly
zfGe9~$r$}W>wJekH288SS}wm0b8IKF=A)qte3;G~FEz;N&T4#)^IXhHri{Wx%1_t`
z_O?Psr10zy`&7N9BAKEN7~xoELqz6%;XQ`k2tAc@+q^k0Ra*0jZ)Wgcl$53Wh=^0O
zWOjldki3S$la~&ty!j8eAx!e}Ex}qC#Z3bmSGsnM%B1V2!{%Rc6f<k^=xta;!h9wR
zG6Hyo2QxEd!q0174TEXD^q$}cKsyW+i4gMv8XV3VH1Q`tPGUQAcys-9e>KbF6E&E0
zKKfbyOKYA4c7@JV=3b(`TGG6-IYC?&p$@H&XAx=2IIi@T4h~&pd-+G~_A{X%ckA?&
z%CZI7p7hXuSy9}hdUvKDwJUekfvWoS>Cud(VB;$VD*C1uw_O`r%o%~a4yjN(->jX5
z$MVAP_6us360E-`_F|@_dLTiFFy6QKP;1XP0%8vGlQ2vR3d&~{jEu)eM+-Tj9-z(_
zr6#HQ;Yb#|9E%HFV{G{FtX@Ki5=;i$!d7kvG7YHAWcPL11xc9lGZNqX(JZckErK<(
zN??H*JkcvqZuRmlGV{xsbjt1xC*k=O&Dr*hNK3w_#!~jC4tUdn^6yh^n_CI%<aOkQ
z%X1C(N&H>z<hz!UH0KI7533p2Pky!+mJneLtxN!Jo}6Ouxr!Cbcx^XidMxYDrbxr&
ziIvQz?(quv&&z(-<2NQPp;L*!H?E#Dc<U^sRLlK?8U;?ntD@CHx)eLL<YO0QIXr`-
z7ll69#m*VeFIv5(4^(6=)uVTtjCy!Qd#NgL^Q)Z2x(WT;EF`+_c^&a?al9Dg5=n*F
zQ@ho>h)qhRXgb|K%e=6lxL%Y#JYsBS+_HC#;a#Jfv)yaKnQ(Chd2E+{JBZXfx+&3X
zh1r!++wy1f)!qdu<PK&;DM5Q7Z<%)XGf>kRS@o+x<gk+xr8Qu+(!%48U7+AcqaK|_
ztmFj6@!_fqM<JhY6E^MV4}+tOi$Q=lid}@Nz5KQ$Tu3&y=`m^FR0X^3iUfR?_MFA6
z?-$ud=q~StYh|qLk&=pas*o3d4tBa~y4Y9VECG0P%z<56TL71cM*K7X<)P<ppFdMy
zHIDGf?GR{ON1-OpY3!v6_xfoHDyn8DU-7VJvD{O{!{zLZb$R{!aYxA3)cQ-Oz?$(I
zC5s_~Bth4XssND^jmbC$ESg@HXbLs+)aqJI^#qT&;RKA0=Nhk~-iOEbt%(y{FJ-Ny
zuqWbKbh+`AvTJmhY^$RGLgQz{#nxxT3dgPbqkCsp)+2=#U+wx%`y?7p^CVD*L8Kk0
zF<{)RZ67#4lq`{VkQtg=@(P!~>mDKtng<Hm1-a4)vlG?$=dy#768m$-g<6I$o5M(P
zt_1@|Q1X>~v5<9!VV$2x0a5WzuOLKD@noh2ODkr7A{&#ne+`S6TP*U2IgeTBQ1^Wt
zzD99jys{O38h!JN1)8eM5zWgHv9R~sTv0ejL_9B_?*aY(i@29@$H1^S?)Bco00Oii
z{lv%ySQ!O53F5pKdaQ^TB(QdQL+btEl4PSt)_OW5_SbR%({sZ67@p#cq|q%UnOfg!
zpW8|7TK3)}rZ5d!C&SKAxnY8^WJ`<<ND}uISiiYbXI9D7qS~MVbFmA5yqoZ-!lHA5
zjX%KXaT-Z;1RP<Y*2i1Nw(ZQD=M+werA+unCAFwmhea+`-}6mkSm3kj>=S&`9G5bC
zUZzeLMlf^s``%QIXJXiUw#vhB6K>J<ABw)mY?&F8T(s0&)*ER;kFfo2JxOmi+F$>4
zOwBgcN&kaoG(KfA0Un}rsRzSJZo3wAKvkK~Sst2C_0wf2W+YQ&_1fi`8N4P1Ue!r7
zP%(q?;Xaotyz0d9dzY0KlWxPBgKMDG2X!14mxJZ}3386H0Zl5sv71$tor1jwDHi)*
zN#tKnPacGJ-etBSzfH}XTl?cCma6HLvg;dmd$!)A@UyaS@n)tBxdGw}>Qg_QUpUy}
zs%`lV!fms@sk&`U$B<Zw#!0?84>vJlD`NLz^3W;#HMD!bHTzrjmUPD}gy-Ulvq7CQ
zO?l|tD7`-Ekc*Q>Uvnk@o6tV5yRRLZMaN7iKzh4z1Jxb)P1y@1nLgilH1@7L#ya&v
z)x_hl45M`=A&7e6#S%4=(|J#KeR&DhsVeLFHj<@N?nMYBL4`Hu4z*5N#?lM!)l<TC
z%e1RO(&0)aQ&J&j^+$z$;x%saVm;yVL7p?>GYPajJ&{Kr$OlIXhxR((XioBX3Z*V#
zY3v*K$z0cwBnv6N5mwiN<a!GH)2V?x<B=(uQ?dtzTseaY>BF)0V*_m4Syp|E@5t@E
z@EaAy!LGcmKxkMWuEG$)z!!<Od5Nx3hnP7%;9GN1Ik;&WYKfV*4`QZDUt&-$1oEB*
z13M$LBv=;}-O}3=h9FL69!dr0(BcRNf#0|jQYf@6)P(`=d~!?S88W-{3cDuhGD4&=
zTjkk;s3F%`{oHxI3yql{QoVENL*Pl1S^GEd%`Z<VwV!%sU!BA=2z1|Mq?+hKLf>O7
zxudtZbrxIcRNolC$3jmJ*0Xyj>o<CViA;de^n!}@a`&5ET+n$eM_Qk}m`V?3IQmw!
zL%q&c{5>7kj^*4CsrfRox?ewoC#3rUIm6!CwC=K6fycpl%DZ@xp&^<b>P}In#A7yK
zchY+MHJr$>^G3$EqCROuc5(=JvN8tw3mUIeq2#&i;ogTfSt@SuP8_G7&2O{drO`Dn
z-gmRpZFUDhWvsN{t3<*XK6J0LFwlm(`fy!5Cb*-g$;;Zjao5=3-nB^<$7i|mWIti4
z!)x_wG6xbD=2e*d&qy^G4sJC73x{vta(!Ossv7?2&krWj^UeR>B}2O`*m?W=P^Zff
z3r$c-g@GWIj25hZpc>>;&T`ye8n>I49kM&oNZysp`Ih@#|9Ah;Rntb+(!694EQhti
zg`tu+KfU|m4G;Iheidqr(G=6k)jb4LQx=Km*4H~@F0i=>leuDGj&R4}$Z2jevpkd8
zJEwRHKZeI)bDedOUO<C8TA^FjMd#STcj#X2oqI-XxXYbz>b2O4>u<Z&C+WANF&A1N
z5=lDrT-RS+$18xl-ssUicU?&4J5_xvW`lVPclo)j(Ab(-Mz&m5p$9^qX*~SwQ~ysr
z+c%sA+#6G)ALCO4G(4R8ze-@9E=VxE^;|V$IF@mcav=IjR;gKfm>>A8cyt6YwWl?A
z+jMYcSfXs<Wuc(nV#>XSEkmd!{vHVqGim;=R=RXg(C_+HneEtRjvmQxu1!JY5h)>&
z%-r}Mdpr)|sjlB{wky$((5$miJi3ZrOEfycWD~d?Pq;KV3T}{<5<}&&yJ7rfM}6)6
zB=o7bO=f15H~*?LC7y|a_w#*g&NJJNaFaUkZQ>2?$paV1XWsjSLHU_;;fj2G%k+tl
z#Si%Gc;75{&l-(uGkv{W|4!=Ua%a!$ZF<gPlF1LkTbhOn72DAp;VMSiOa?)3jMWrI
zomQVk>PK7ik&j*vuna1lEU5CrfRG!Ug**;1?uoueW1(`YU~_@wYh)C)*h&@kDoEYm
z&Hv47`b}iRtj5QTysKLfd**AJc$%cQW8L*Di_7S0!b{R8Qf9{{F~ax5irri2p6QoL
z+n9#Z4H?%_A0U=$LEPcw;B98ED9!3v>gte{kXN`9aF<C+(;UngvG*kx6zvTt3Pl~k
zKxHC%$FXW$>BnnYb)h^V!IpryemEEEEpUdnQImKU;PvOmLAr}m6D}nf{6DJxIx5Pr
zYa55@ln|sGQjmrb(4iZo1*Ag;1O%i@nxR9wkyc8&Q(%<t6i~Wr2<e{rUEKHcJn#4U
zpKG~T%Zu|o_uj`og5gJq(xGDder#AwnEdK<vts}fPYpq+bYb~<dD@t?_}|~?tQNi>
z0X%DGLzT{M{sqM>4y&zN`lxtLwB&D7KLu1Z9VRwK%~X`cJ`W5Ei1DA{-O!j+>eyhb
zW}HFr+tTe8dP+PWvxIuSgX-&fAZAo2ORVn|u|GoOcpj0MW|ix`S3*r?^{z?bx=;rq
zep2bFC5&~FhmeMrSqULT#^zj-xH*}T#dcScL{t#D_q6Gsr^S85{le}Fyb8*7h#Nb!
z>ATga_u>Rlr}JA{?%(fT2G&P}Uv*(P-$C8qv=nHVu&C$<RPLqm7e?Qv*pRb`p2SyG
zKc=oqNS&6R%%d+iDYW^$`<Q>;)9yME*T`e?`DBxbeHFRMto>hRXi}w0nw@85p;z6p
z{$k^-y+lIfNmFf}ZNI6z_H_y7<&#RD0?|gO(p3MhxS3Y_*gzuTly*28-C*HtK~gf$
zO<K?iTZi;7fdZxLq)InJ1N&?J?DaggMjKI1hE27D>NilkTvh4;joA-3=cq)cY1xM5
zdJ;DE7Pm?NC?Wg%%^R{#jaVDnWOvZwx&e^!lQtgc@8?ySYpo2PcF)W?V{UioQ!pCM
zvWKN&dP!B*!_u<u=hS&gAmFELll~LExff|cbV-?WMbj!Vf&C?3kKpt5Dx31_*vDiF
z4yuat3R*vu%n%V*C9~BunMAhp7+zYa3hyN1t;s3`sQFELkwgQrnCvxU5`cD@_Hmr(
z<BBqT7o9}vZU%90hzcHI?6||5BQZ6?p62cm54J5gThB+?tL&Z|8#T@b+Cwv<O5QON
zUcQ1V_Tg|@Rc05Rr!_V`0B@R&)d}RNWq?(F1ejs&(usLid(7K6_1La1R(K3NPwRFv
z-j-OMte3d@MbdjKQrW!rc`230$lGJlUC(z5d3zLh%#LggzU}Ti73)F?F1l&mp?sEa
zO(=-H-U|2ku}K_9_FhHeemO&RcXt=?@6B4-`rF<Pxy2@@*7Z`0zAghdnk&PF4HmPW
z_|>|KmVrvzbfLGKqI96Z>0c1PCVR&g51jLP<0+w>RQad4o3`87XB7puL$BB0f&QG7
z4EenKyFJ*wrRlsm_{B3hcCWXC;g4`&wt(Tr*4qppgFh}h#x0j>;p@I#z*_BJWi_kU
z>Sqcr6Y{x%vaaLO7pdj%njGkghWa{RqX=eR0%KrDz45y7lUU6e37-#Y+Hk_~e4HIz
z#MbIIJFe}vp`Zf1(+k^n8>q?DvM3p-KRRMt?dDbxb}D%33jm*R{<CXG)Vd^c9X00B
zahk2}#1pL!Jt)2foOKr*LtjGOf6)|8Je}EB0{M}w_td^EdR~6y$_VyeKKOKWG=hdi
z9-)w0W>qUXOe5|aqFG?}`Bl!r(BKPdBvhAPrHl4(zMTfGHsorSnWR?Z^}ZFOicoL7
z{H7dTsqbJb-L4mGMR8?t<-f)LS0H|cabU{E#p657G-ywB$iTmT6>$5@Aet!vYL5=V
zKg9zqzkaD;f`^YE+<PURfIZ~WTcNO^Gs68=@SQ94<4|pA2WdU@*<g<pxeJtI*6&wG
zg<D^up-=oH3@G1wrXX<575~Cue4RJrwd?FTw=>ymufc)rK{HEq{dvV97Ao~@5aF#3
zQo{Uw&PzncpC)LKBiB0%jX3uig9xodf;s(0M&8h|6pyD(DP676N#!kIpLu=e6&3xK
z>~)0B?#IlNN)=fzW~dE~;6R2g+q|;J8=E=z*4Y9CW3i8mPEs$k*OXg@gUTl#wMw47
zle&uDy-;qc5Tc-OMExqGK`L()3NL+EduE62%O5@VIJDh_+_0)Z^zHi_mW@pc)@=;u
zi>#k_52E#ZlvcUxzML~GTk~odGH!W!J^+F49nB@{eD?Qd|JNXP%pBEmrUm*|d3{3P
zWMO}sSoFzZ;`jE<uG72Q62y9iL~-j<)hM9RoVrS%aVNh>arnE}d**+jkjnU-FedOq
zc&+C~>z(kvKx*z}v%Se&{fOIs&Eeu)=ZwM|Jr@xTJ+}LsF^Kt(&eFT`AGL(hMqiA@
zH@7&YD62R4i+C)|B3m7%w$Ti>ev+BK^S&?t6HwF=U2bKZ;;ba1xZr*;|E*Frw8**A
zemSA&D+H}v1#E<C-+PorU#MYNfMS+BVeSE@wEXj|YG-X@pM!=__u0FLB;UrQv(`iL
z<8Jcfn}_07cSz3W2{?k5HeLV@Vb|qO9C$-M&v|==t{7}3YmrGs(s%v8^j3w1UB~nh
zlFe?^G&I6x(R(-htw{c9sL`kmoX1w%ep^K*n|Na*!9ms1r0BLqBH)F7(W=Rmr|HB|
z_Scx`-5;4eaV5i!u8N!WJ5=!Uqu&Eo2_X2?g#!<v&7%s?k<Ou-D`doG>QWK7xP7x7
z7Y(2#<VBMtZEtqu3rf`xz8Vm(dPx2cv#zj6K>O>F#%(Z3bf6j{QMtZXtj8PjTE*uO
zIW$4?oiNqR>1(0;Dd5KOsnggTi%UzoFFo3ArV2Wi;l);-9~b6zJs0PHmcPvP0S|DO
zy{~xDccU?We+ZalP>J^*%mDs8Y}F3I?%ynjQqArO7K__`Sr$;JhDgzk%j@{6J{gd=
zYv#Xj5(ea1naMe)qEtVrCH}fjn%C1>CcWK6Fqt9z7I2RJXr0O6Kz^xhfxo_69Q>$Y
zp2+>l6p=gmW{?#9R`wzw6<z`yL~1a8^C%5RS1g`%VIEP@Qv6@nF3n_FH<Zl5D%~~l
zx5iwd_@ylYrbI_~2)<x9!=HZ%SZ-_GkrV&kuVOKVo8ttQ_^aNkr&Pb7s>aGIY1MOm
zgzHjezNjTk+l6+J6;mp*_&$k1Ch!v7l@LNnqwvr<%&FP5sDna6*3%6%*hr~9lpTc)
zv#nK|udakrnM7daoze(n#50q`;Hq`YEPUWI0eY7{8L6GIC3hh49vO)zWp@=98=LcC
z9SJx}EdtuDPfX~cF~~zeA;*MEQRTCUXf<mWaM(}NZRflSgEQkMz^+C_t`8S~h{nS@
z#Z(bn*=m`Po;WM0|Mlhs;2!MJ+2+kso`Q-Z0zvK!`GWC|91)Byc}MZ{<Cpihm$G)d
zGH5{-bQTA|f)_gf)M9QPEYS}kjXG>aRQ>?BY$U##edn>5&(r-KPihlRu3wigE{zm+
z+Zkt3@mRhd^=N!>e_r0DVyg}Dgo)Sx{efB`L9X;IouoF2Y1d0}3>7mmPq2mDxdEyS
zqXA5sNS7d%p2vfQD*A)!ezN*Q`;^2A_^_$}JhK37U<$Rn-V2TKzUB+N9#xU?G+S9V
z@wACuJ$pV6=o<*ayZBDy-D5)Kkj}&6`+9v34(c$beQFWLR6a-RXVInuxER6a4!=HB
zmRD^sMyb6)e)0L!ky-WGDk?g7`ca3A`^i{mFgcVq7%eJZZKg4!7x<B@>2W_Nm4(jV
z<cJCHilh$z83yyjTHDu|CZPb2FMa1oR9fn|^w@x8EbZB`-7cA^41%jXGi_%dFofS*
zf0+7Er!eH0AnxLAoPZh<fA?PMVd+#E>~IPy`>g-m8%S1NM*$3p!1yyM_!Z-V7$636
zB(aT$BNO6$H+DeFSG^2ioS%RG=-b5su353X^)jOS8mxd~m`bS>Php$L(X$IR0p>lq
zxP_x`9YgPAjm@BI4e~1SAL2vXqx7wY?SFSfa{X3&q-TgzR_$|nxYzUp%~hY9^8t%_
z=!{9d+m{NKw|df)_$dQE1179)p3c+^4B*ZX@t97wF5<pNLGo8XLHj)biVghvK{B(&
zMK2IU%@!{lMzs6nFwCh&2Krp@`Li5plQX34A(Nh*zTeO1`3v@%divIDOF%`|6565!
zf)>2$GoCkD+b{SN6Yhi<KNY5=+`pZ_CSa3pz_o9;5i>>ZtOs_j>MQEEdGZlvW>awK
z?z}zQZvcGq2EB19C4^*y*p&%c3Jcfh!{Z8LS*2*Di|ZW#BNE=;NqWkFdSKCWW~0c~
z1DN?lTlPW?0QbSFCv^dU!ar)3PTc$Do*?C8rgpPXJVL?M?6!Q53jkER_Z6~7P%Q(p
zsuR>zWbRdDAHZy(Tl^Aw_2~%@pNL3nQN41>CkQ@B&|yFH<QM1USg4B~%c+#y4Zwj7
zZh`}2oEPgxRo%yF&K&qRYy6X{<!4CK6ppMND(_5)eQ87>@WHcLxcp?t9MXkoLyi6y
z1N%2VA*W9nV6m52_5La`P)#fVI}Zq5p-3Nol;n8m+G1r=OGn%n|10QDW<ku#T-u>n
zsP0Q%M>pT;_%jkve?0%0dwv(6>bRgy5@{JzJXI$xQ_f$xw(G6Tcb8lEPMb1x6Ab3}
ztKXt{KfCwfynrfb#l0cR^6B5hF=s!pf>azwyx7zC6j~ktci4zh?;Ig|F)v!F!M<X^
zWh2Bd#LgqA)uo5rt_zo2_THK$<(`jT5n~2+wH3Q5yD0SW_zStjn^XrloQFy3{|Pi@
z6~D^|^u`RiJSSs7{gXsR!LOpmOzm;K#;+qIBOhC=u9%xtbOAHr8T0)b;ZZ33WJ>aW
zDz3_)u84VZ1bF_JjqAI2c6L6FZu$q34rrN4qL+zgpCGF)q8@zH;U}>kZR<2SM5{KL
z%uFO{PcVb5gk{}6baaJ}06ijm^$ZJu2hn*r=q#g&Sgo)yDquJLFBbEQ$?q2tSRnhw
zY7DEhmoPC{Abm21Ye+S@Ye?>~3C<c7HsG?(u8a{6XAz~1#cQGXR~5cZtRJ&d<^W0Z
zBk$u&G9^z44wWZ98*z6)26hBUeCd#m`dNFkk}m1_?-wrfb>Dn~Ice4r7IhO+fO^O1
zKi_bhOh2Dn*_K(KVImCnXFqNm5OZ7OKes#SdokP)0(i%^YZ;<_W&w5w9veT62@|<D
z7-GvRTT3ww<XWHfPFOqRA|Sxc28GEWy?_+;93tCe7+vpnZY3eP8;adZVluS;^zL*_
z;nLig{Fo@D;Wqck%K5<p1+@t%0`E~c6Gig}vB?FQqmzXyMn-6yiw^QCN}d$@?cT3k
zVjfKV4Hr9!{&)a&Gnde^p&^$WU}7I1h2$~=mKE8s^D5+Y22hOewI|3@si_AoS(457
z*{`Zw<m%ssWY&*Mx-p??<~~D9q3mo^chYvkh<|uWXk$Yo25}ucuVbh>Q1?f1z;>L?
zpRUV7AI!hd1#`T1m#zUKM-(v(JA7NzBj|_~x@8&+-70@o2n&56f1|HYod>(<F!S%~
zQ}4?YTE>6z1})?1f4?RH;P5T%4m`pJ(J?W{KMZrlJpY+e5EDw7B}um06Ckov2&)qp
z9?uG8V{P;^k{L2a9ghLfxX2HWqnWIBt=9O@@R}@13b!AN`NeOtZxBFo)BQPM+kQRr
z11M&h@Jk=K$5{^*H01XML)YA``c_WYTI~IIDnh{>*L0A)3n9ay!(2T+LJ~f%9##e9
zV#0}!i=)AbFnaHuuUs;|wx3gf+NaHFD0N5Km$<$9tn;j23{`H;8^xfQy7owk%@E~v
z<g+|Kcb`T&SeY1jc5Gb@JZp-HZ{Gp?+p2JE#!k)R-xXa6!EopQA{P1@D?L)sn7v2y
zbeGUoD-x|D0z!N|9C7jw$nBvF;E`@7eDR;>`#-OEI&;<-OS;SY?87f%n?spU$~W(i
zd3LSPdV8@Rnb$M)_kfZBID1aM`})bc!%Xf{hZ>%2D51A`3@iBz_tuv{kXeK`rY07l
zAVHni>6W6l*~lGmm|(__0;+sBxg=4pl9#S}aWOIXGUHRI%?f};i3xmLiPGDLcJ9q$
zT@)qHoS|WRsl*>~-z%r&b-?<Ud6nHCbqPZ?m{p$5u+qqwAZIVzw#CPivGNio>6ZF|
z&+RMAht^5o$tOWZytDE-&a+y%`#Ok_cjxYbbJ2+NWqI<6LVuSdQ&fcFrZf#yOBKDD
z*{I#y-EkyCK&)u;l_~C!=^Z=1aeFN^f}Ka)3%Zhy#fB#QpKqeCF&?Gb_a}B4Xyr)i
z(tIiE09QNuj_AI=zIAa$DKq}cDs%5uY*7;uuu$lKPVax~;RmX10rY;J|NIn8fK&dB
znNSLl+lR0#bFo7fboAa$1Cb4S4J}aK@K5E>DZ*s~p6D8)ew~c5yv0j3ug<7?<;wl$
zej9a{iz3vuo9m`?y8z7s!2yB~^aOLWdvTNX;lOhSC&1J7xOKaW)|yBJ2Efzwa-f9(
zGwlA)unBpp_J&+q5<pFOq=-^^uO*fWhAz!*>T;0WV%6}h5~w=-M5FXvy6P2#B*NI6
z0H-8WYB`EjL9=m0+VZh7zn0~yEg)d;2_piPdUIC@*5Hzj`92{+|IUI#NgTf7_`ik!
z$;S4aiTO7|?%VtQzENKaE&f|)blv|&%z%Go{;9@#;@g_<f6G?vDJY&;$Q-bqM|<)Z
za^nNEAaSV@KtoMcRfx!HMl;Wcd-OUc7~MH#VV_~zzK9QSLiN0g-~qS&levp=u%D~v
zXhq2^OPnOciJ?mM+V>`b9urlTDwp?Bt)sqkd9@Ar1$o{dArFsoDtt((Ohft>QzIZ@
z|0bn#s!f&^TLE9#->{ag4BKAI^I~><K>%s^sUCXO^aK-aNOt$ZxVG0;e+9p<LB5Wg
zByA>I<k_<d;}(|<fF`u{DtM6WCdi7B`50s?x6-nmQ#RKe5eVE01n}+i_dr+d8Lqoe
ztDS`Yf6foP-|3rH9Q24PGgG)EFuP$x1q$L)kiL91Mk`kH4_EEKCx*5z?(_@V24w*7
z_w~EiN>~S>4FgL+$L4l>4!qG+KsCiPerdMLY<K8U?dkt-<(I$*Sf}^*2DA;`09wk;
z46n^F<qguG-ok$x?Ty6N9T0$I_n4-9(b#h}6kZ1y*QyKlFt}Y97~Is5UgN4r0eq!d
zRO_LaBHv7FjCj0oKPLKNgFNQLn+v0#908i)XU9cCQ<SeC&PYcYH7RL8If9q_O6m<K
z&kf_zOwsn`!Tja*Hx`uCU4m$BNh^wTGs5BL4!M(T7~zYx5bB7{qWBNxTHL|TshNTg
z@5B}8zmH8UcIXLVS`KStJS=@5a8fh^3m)5sz4*Ij$$Inn&2VIImE8h%`v1F4!xE!b
zWYPcWdVu5e5KJL2B;<eR>2}-W&W%>6>(}XRbqD1QsHZF?VO}JNXO=HvrVy6f;F}pb
zz^#)mb^=qN0Q*sQmX5P1(elFerLsxr`i+YBpX+V_^Rm;Ak~F0116a%`mxl7q{yE}+
zeX^M&QQ$GUsriPE+LgR7?zadkC!ZTr)L&<~{#`85@M>c<yXW`#FFFPm5VuQ8t@O`b
zt|7@A1=Nl@PhiBd$AWWTvIR%QW3`WCwP<ppeHf%ZbZGo(8(8}>$qvi3|9@*te;N&>
zm;e|sloTBHpgs|2{dJRJ2KX|Hf0@DN|B4TM33Jkrw925WN^Zsszz!=n>T>I8|GzI|
zzD4n0c3MI#22uzu(^J=5(02PCP{PjDbgsN`z-k?a_;&_%owkbSt(|oEt>=_O;-^nA
zSOT5b{Y(C-@wU0uKc%(}m~Wz5a9pyY?vZXU7Ws_qt-hjp;qGP@VGJgJQf~R<l8tbt
z@!FCVEe{^F=Nv0BDK71+vq9eh?4e_!noZbd41it#+7J}!A~x??MA$E>^;}X@@6;eS
zEb#iD$tG~T>jHrm`CPZsI1-x?Sphk$kk19ml>(s@AZFjl@AHgNLoU%|Q7o;JN?g>$
z$+rWC^AZ{#nBEkcKS^VdChUD?&5~TMU-NBZO>KPMJnU>L;T7ZP48O)zJDfL`;kJgs
zNNdlJX)@vLN)L9f2i|cLvE9qbPEYsTTE71Q^LU~n`uv)W%+Y_#%72T2N(;+oic&pG
zC~y`{ZBhhv4oA+uR*?e^6@OB<wI6#wpP?a&re!q@B%z^-zKN8VXAMfm=J*Iag}==y
zV*QzDYuXrb1_#Lx(Fw!5e&S30&;0X@wPxYiez-u8yH-K6*-TpajrZozB`{)pe+ihb
zQt*4fze5Odt?Ibh!{B<m8*~fEs5?AEu+!gH20m(9a2d)P>|`CUXj*zYL}0LABmv4c
zF6MqPBcj?S&=>nU3~t@|mfqwDyPXg1;+r>>{Rc$o#Mwtf{@_4wCez-d+yVO?syh4|
zOpE95Eb<&z1ZU&JZBOwz+2%ax*j=}tnK|=r#Z{l-3n+c~xTp8ZfeF)Pgo2v<yU~Ww
ztYA5AXzzaG!8C>p{z0gS2_9&(9&=+ey#yj{BsIpa?xyAkvYO0RVeA3|-Gm(RjgqJG
zyuY{P?4{J^4&ITI4XYZWdjq+npD*F4`<@3L<Qg#AbIp_+OzpLd!H}mtnM-FyYh4UT
zr(<BvAAUTHf}g3tpTN|qrfQI~Uis<*YTpsKbG63fzv+VaD9ou^UoLN<10R-8OTWX{
zt6t<SvaE{MIq>&9;AzPxA+coC>c+t!d;yqIPd${;togcu<%H|pPN3eNNU4vfxm1Xm
z1PgWI)&bMgo~hbv#73J|xk<Z7Yc|1YaxebW^8MnnIOvV0U{?zvO#~+Od(z5IWGQf%
zkgE(!1e!%|s}wv3PK;v@&4skqjafFzOBNX!k_o*Eg*G#8Akv~Z0$u_Ed=yGzKz!JK
z1XlO?i*P#@*-(D5&)DD`qU!^vy9XnsMywY9(sYbJU5xjW1e$j9zlm5XG~y;KK|f!a
z8Xzft5jJBpDttbjU9J6Z<BN^Y`m?v~Lx?*%&I_BtZkh`*hoAZd#N?;eOzg&K!rHmi
zqBlYEpW^46z4}C#9#j3SYC9QxI6?gps#DnDbUO<Y0*Ic_WYw=o1i)5}Js#csaHbm2
zlT=+zcKQj3OrnhSR@JGZy?6d=nMQF5<iJRQg3?U9ZG0UXZ^00(gi|2PskHn&aMI$u
z!1fe9SzSvwf#K!{U<3z7#=Vkx7oPq~>sk{|z?i82!eN4{_)y&n)GzfT9BnoIQSZmz
z{gQggvjj{!eLO!-e&wYv)+EWy_5n42M)|DM;tRIsN~sUfXts@(aduoea-}Wu9oNM_
zOJs>qTxZrQ<WA!@Vp~uzjeNi`YP92cK!>aw!mH-y(QGB-!yKAd!>-EFzC^U%0rGbZ
zRVu&?jkkzkm)!m%Z{Q)27a6Zpa@ld&Ua=+<&Uk1L6#$$bXNeV{`%FTHfA`+#PguG+
zM~JGVa<5L}Z7@i<7&qF{pky(~E{m;ZUem?aF~(A-=2tT|05L~bsI8GqQPN>NGB=(M
zfs+Yt*XMXrfY0FK!V^clD4Y9cR@7P)_(JZc#>xp$o5B63%S=*Y)~A7vp7K6y=NXq&
z`MMF6rEs!CD<iQER?$EDe<+iBYt8%xwfOLWNiq#*00Oj*#7)$OTd7QHuysGS^u7cD
z-N4=cAo=`6Mg}EKvyN$Uvj=ltQp|Pno3Iy0VGGk!cRyHgMVQ7lfBnBl$AVG-qt{1x
z_23vpD79Mn)rt+_{l!@bClvB}G6n+4nv9uk3F;T@LW{ZqYLWt<j)qAKQPTrR+hZr4
z>cuEOjFa_elEIF2RM#&nj#?Ynrubna$(I>FFV~B3>-sWcZd^IsG$J|JP?^<F(hX0(
z>uW~Cw}RY+ibPSmPOwdE7hwflD|)As<V6?FAv4@uB;FTorfhz3BMvzfzgh{N=p3;l
z)!3a^6nOqq)k@-3Qu=2V-5aqRT9x{5RX%_%#`-Jn1R`a$phu@CLtv^?>|Eqo@j4Ag
zJhsKN2+sIHM$BWB_C)VFjSU}b5lhDPH}#z$MN^LSqlvA##N=_BIk1K1TtXLLZeVO}
z$x`admeWi0$v{P^W|Q~%40@7wD|M+fz5Sn=hWetj9z3hAkz~IxCxaYsM6u2=D1Kp6
zGYq9tzGqC7|EAoct5=c2AnZ~=zU7gEo#RyEJlO^u2P^qAd<6=1o9p6Yp9h0TxHEvZ
zS*_z;>M;)i?O8)3$>WIa+XM$-xYSEah2aU3Z8>B@Pcvp;X3*__`k?^z-Yv9B<1xC(
ze<cklJ;~-Q>OW%Pe<uQrY-UXFacxcXAKyGoDh|X4o_bRPW>xRSX#1X82s3N^E#es<
zA(YA#bc}UXs%S|~{q>&iR667mmzdB4ed|A+qq+1ieUzClh$_phEsgMR+sewkX9yTK
zoi?0mhZy`)Y)GYHO$pxUEOfK#%ji{|0GV~b4ny~wK1^rGlh`V|CGXpp<~`Y)D=N3)
zdBQH)QnTvIjQ###)wu58mOixxED<5fxFMzSW!E2@rf6-{zLGKVEYE^0XQ;u|pf*Dp
zE=Xr9B!F&k73iCUF-g*$x6m#<4jwywmusy~+KSlAyo`{JFn#mQgZs(%BR8S2NC1xO
z7GU72ohcddpW&}L3mjtQ_WNVCvDH@rG>FLy)p-4qSqFw*JAK}yiVw^BNWpMoy3Y6h
zBq!<<lgh|GN#wDW<)#ArfRy+;arx;o>J|oT<c)nnWr#WO8gX05^#V`2;)<YoF373N
zc}h*tuLgPr<OFXm0fdtq57)~-qAQP>s#r#~Q$y*!HWI8d*C@~<a)(lRKsL-n>v59)
zdg&^D%pTwkN&aDHE*vI;CcCc=wHEZ;!8Lv8zf=y<cR|q}QsG_y9qj<1(KEip2>Ifd
z<u?#(oA^QiAAYa#Hjt~w7Z*7&N>3QYts6Grb}qw0o*TOwT)SnuF2A)f1+M$c{X0x`
z>KUJzzGCW^YgSu~g2I@*1-(BI`?a?VC9eo7RSx|L|Aa7&oN?*-yxV;_z|tbr&$U`q
z%b4T3$*6VLUD6g<|3>2U%UE~XYujJNyu6HQ^j)2d&SjOZmV=$#P%E<Vldlp|8XW~?
zz+&03RdQ$cz&)OR?xjnrCQI>INu}D~lQP#K(=H{3xq9%VF3s;vc;%uNgK)dD65~vE
zOhuaX!onFs?=2abncWiBZf<+{aLLj?_@ICu8|4&-EEjzGmbHvhx3Z|U!8?7h?5^P;
z_*Po?XMG^XYM+cBloxCRo2$yDwTRX<5NvSlEV%r=<l?NnRdl7@>wcfzi}fP9gYDqx
zNtNmRFUIreXkfVYyNh{Fx>jP_q-Gv3pLy{Xx22EizNkj#M1S$wU7nw9C5fitg@Mna
zL?+0pFzKVK`;DeYRprs(=JJK*{T65NnRH9N)YGNLikHjwdB<1?CjC35+%9EVI&|yt
z7WQ~Th#7SEWAqF68^<AGDv$XZpK<46;%BHwBH?9R%)8x;4%UU+%~?N*{ya}Jervbb
zdS31nZ|^kZ-b10+z1)0?;pj6z|8br54v6-mte|)mIwY+-{XlxNvJ67g-hLD9CQmH0
zM9YYJ86$cdjSx9k7pPD-jc=TN3D#N`n4i(KLw$1@YVZ5&rMXC5*qD=fxj#gj?t1jZ
ze!Eh4roL)4=I^JRtfE|rKKBvkn-L})8iBcC{0e%2!&rQ3VtRX0?|@i3->VcHn60ws
z%sS!U_pt11i3G@Qy>;Ao)iX4ZGiGV?fyC$S?LL>iLp?NHJCyA%#mkEU!rc07Rf_Ke
z{HYW1u=2)d-2p96;m#bvCA8Tr6b*ACWScQLq(!;ni){H$#0s;D<fP>9nzpdYiw7<r
z?d`!b^1v#X9-7`u-f6cge70;j54iGs9`%A8X-SS!6##jt?zRQqX)g~zDVWLtc2u`l
zz@Liy1$(AbFzN)1y0~3NAz|rticc<ZJn8v0HCvBAGl0VVu*=gSH}O1{1;Yw5M(u?$
z+yK6ReQ&m~cQ;OQuK|f3#A<?WW}TK_#LQyuksBNcMG?M0vG@JY&|G8sHI2}Zj-0iL
z8SwgiN(8uYL>_$u%(uDm!LNoOj!SL6Kn3OMQX%q(^WuSDB09Zf(-j4VmY%R)7<CSH
z(uwztlR`|q&6qJdb&gzfZ)w5w$31cDK*V>HS<VB+W-HamVYR1{YLAoNSpC<j*($e$
z4?qs+_B?hTcBL)A{g*U)p6S>j+}q{8#u6<>y~dn1xgKqog}t$bs^%kGXCmHsPCGW=
zmWXRnyUWOC!+w|Tv1CxFmE|QY%9X3@UszH-XbX37Oq8GHQ1Dlw989g3_N=Lx)bS*)
zBrK3NhzD;Dq(<i56}x{Hb04dZ$!sHo?<t&f+)uumF5{6r<Ty%<soPMtteoPqP-A+h
z0Lzf_niD&LPsg!}ueaK3?WAt7JgQBk8f2ZVWM>|fIUhRJWx#Vp7;WZX41V>bh^@E(
zQhbo}^0$Av$#E9XrS`0%-n}fR7V$<*HMb{eRgRi_#I3T{J+4h?Olj#OH}Mo%FCCgh
ztLfZ9%~c!@+3C8ukMEY1S|{aC(uZ;@6bh5J^!Q68#RRf)(8rXPo5Q(v753&f88tFW
zFO8SM@g6BErKsRNJ6^ioVmk93DvFs{P-9ke?0$&a?Z-8(mhGFvdJ-+q>AIhFA<U1w
zSa{~G2-WUCigYA^2UJazrh1Dd$izWdlQcQcC7(LlW$n36UL?+_WL_i&yBS)lw+@yO
z&wCWFv$p0C7T>7f&eX%#Xj01TZKd1`5Re16H&VupOVd^c*#)$SUITIUoZnQOaS%Ir
z3xRulXKeUK@O^Kah?mZXN$i-W#*RsdCa!2|e7HY9ho2~wd~B<~%zD`Yo2RaQ-(L1v
zuG7=){j2m;BIo>KHS<gD-fUJ4hMknbuMQ4#l#?w*9b(vCQvN5yu5cs*PQTd<>^lFP
zMdQM&08);LCk)XJteOu)i3+Za-2DLRPBn*N==KUM=V9>l24-?cioT3jwrc_qyTxCw
z%H}|QO0p;weHeIt0MM1UnE)p}V73`E<|0mX%LPB-vWgLHyepUZ+h})QQh6{vf^82g
zy!KC$AbOj|@jFcw+ndB@DlF73r~KM<PU2;_<6v>;cU0k{DT#OPMHe}v6)znczWn$|
z9JDYfI#woLHfrx(@D&;5*6g^h1vB4XZiLwhe6SvVb4#(;6RV#1E6D11lX9A?Yt|Dn
z1uqrdm{&nt(!zdQt=XvUExF(h%q@-CS@lA0I%3kZlXuULS6;1px(k_5^p-WOKKg1p
zU8I)zf~Y?0d<59_^M0sEa#x>`>~ddVppe&WreN%2IWwtwrc;rUFS-gFCgHWr7R%DJ
zuJAnoG;W<j<g-J16^0EG3qI#SnT2T-H$8yIy}*LPY{Gc>%fkaG`5p-i7DoL8atDz{
zyg7g%3T5W}`cl}Ry?n}XgYh27hSh_gO{&DbYRCmZ@H?9wBachNl?Q~cicyO_4rO$R
z1mG`Z9I(4+ht&5~)DP6YlQEp@J_cG;$*Cu(hxoN42d*LLT@UmQCY$Bhe19=tHM$5p
zY}xLR%1D+La?CT?p_&19v>7+wmO9Tj0kL6tD8((#UV6UXjL+CD*8jlneHgFLW%7fm
zKqemtsWJ<NF*Jl2(JH`D&MdT-7S+{-^3C5^(yIUT1!Ykp<XV*kA)kkF!YDWPpXEYe
z4J#i7p`R^+GegyVVmzO)**p&4n0}pRp+to?)gw3A0P^RUP@I)#dFz>?)+)>%6c|eB
z!~uWl`&q;wU@_T(Psj2DRRqsxi>^Pt`9%5Jy>4IqH83=^7C!yb&wL_$&jcIHtlWgu
z*E?knrv9k(cAVt;%7d<WQ1F6qA#tAfq|D^44Ebirn-ag0@<|b9hVGsOhvw3@atFhc
zv_((FA*0Mtg0w~-`$yjwZS%jqsnT{3K9OmyHo+Zanx@EWD{`JEvN8g@^B1|Wi?1=|
zelF&1r#1LFqn62^?4VD|s(?260jA|seg2lEn{sn(k4+&~>=lKWWq+DH!`p;ugCBtf
zBUNtu)E3c9Bgq@_7y0g+7VG^DKIiT>uyVDdB8X*f)A14vb^lkwhZIBOo%h9(wx9#z
z#&2F>9$8t^UH~e!fu;t}CCoKJ8UqiEQgR?M6uOz=&&(BjwH?cmbDz}GjhDaGmskE(
z>vPLmL)EKt3kTGVSe2@9TpR2b+e@)PMD;XjTUtIVhEp2bif$F2eB7@&x5R&&q0kt5
zkV{afnF9>|A$T&BpYkQzKMbk*SuGkXWp0=FD=k;}6Nw!DmOi&dRb_(DgYgn==09R4
zV1xirnY;{%9Gyz)HE^_gK1X2IY&}r)+K5ZS5%3FJID|vYSqfP*`_Q~9gXc&CgdBbx
zG%DT5wF&db^-K0E0NZ9{1|qdUj(%@zSJ<ysWJ*0Z<EBi+Z_T6<I{J8V9^-!Ra#e<|
zNEWU3bmOJuGw@#PP1M<a%=VOjxUJ1?^-(?tb^d%kc8nmU`(|z|RsY9<!5}>LJ;?*n
z>gOqc|8dqCd#AdUpD5inza)7kH2-3cd2W~vv7{~?>r{A26V>XmCcT7?h({ovt5kB!
zf6O2rm~=i|3&f@O)Ekc@)GOCNehRq-?(lhOYmEQnfKF5bns#EqTC4S#;4NJe->&T6
zw~lM!wL6J;QmfRmvyZN~b)-qIO+T5FqwfHi`)w)HwdynU=d;hycSHe#2%F2XR4INd
z9RD7yOhyV9zOudqEVObDh|s|uS8JXTw+bxF0H5*HhPq!4ct_`P@YzEa6XOGTX=}MT
zGX*y+0;%O&l5Z(Nc5qT;+`WuJ_|SJPl}G!+=>7lOXpB#AL0x>dhHwnf2>RZ){|Q+h
zI?yBPp~2Ab{c0vd=P!zGjgu!ov9MNE&Rj6wnfY#Cg@+f-Ub`SF1|Z{5f?cuFzI{jl
zH}%`DD^s~4AYSg`BW3-}5c<a?lWr7^2hZ9XYU6+8^g`Ku68^r>rQIzmvKY2E-5M0q
zi*<LNm-k_6swp`ufAc#fbdBAR7pWWu@t#gaOD;;2A?#@+-rE~o8hUKWlEfoxuRLww
zQSFtq8TDk2w(<OX?I6z|!N&mwC}Dn?`KobO5ahFH({7%NlBEuEO8!18G`8r|`=QjE
z;gqipZA>ri+myEI#a!-<l%HU5hCkUOnco;26q+6pk8<nksO&)8XfeLi7Otl=*Vfym
zx|w595p>!cbOc_FcMM^}y5X(|t(8zvG8)!iM?70)iJ|A70-7>HUQTgd!ea3o?;&K}
zEH=x0v-&{x-fXHl7cuqnVtPb=lE0oZ;jPzXz3VCI22f{8Ok7jhT>Rd^TRxBc;0_Z@
z(H{VAS4qXpCUZ)QL$qBGH|&ppVXSe6ZTQFS!KA_MlBZlupQc(IwEisBSxy%~TWWmb
zos01~Y)nP47%ixF<u(^Tjb@Mqv;ynvy@AIz%~nc+`kSjFsezNW$x6zTfe~HpjaZDt
zYrhiXri)4Z{{>rx20NWKHnmqk)Dn`D)3kG4*58mn{-EJEI5Lemvk|#5&2^ML>o?=X
zV$=|98i^5LRJfVR;sgG-x8GPhtzy%YWJft;8{Q`Ma!uCFy;Jsnyf-*b#;YSqkeMV%
zC!pPA18NdUWBxqn23#E;8i5qac2*ao&#l)eRkDD+Evbv8JnsXc%VP!DnZnVdR!svm
zWx*R2La8A+Gy*tP3L?ijAHJP=7yHP&_pQIu6OcUYEyg&osq0mK7iGI?k1qw}U7@lR
zC01LM!fPI#g*n9negEaXr0cPiKgTHP3M2(_TJ;z`Vjb|qRfjbSV)<SH@a*n$mDD@y
z2nH^BNwVIEsv<K+W*(!){cnkA^$lW>D7-VkZ|`7FjeO%$mf>bxl25KgkXF+FZfw%&
z;ij!K9ehT^5=I0Gbg<~9F$gMPkTQr<S(S_QkbKoy7C!>f;=g|2LIJo%EH;6!N%(;M
zW0McxmgoPy*IK~^u$lJk7aXx2(Ij*t+968*XExmMxvSqq<ky{iuGRh#q194Gz6hgb
z&Po77SHe9KSj7(WF6{(jPQf|3K8G!PPtEXbs{*U7O+v7nIMohe_XwyY!V5$aF7H_q
zWwW*MrmL~%%VoVDDW%&eLDCRgGtdFl&4!0cpSS^;vc0G0vrx&BrOqMWXe$x^nI1L2
zKg~LlM}9{>W1pG1JJ&LQP(wP`Zdlr7JTlKdQsWU0X*%`;`5Kj@+Wsv*oLqx%oRx63
z7FD}2_o##?FG|nsd~|$UJTs*{PojNuuZOKl5&cpvms3*@zK5E<#zJevAU++T)d!r`
z>L$Nc2z%EP#GX|lxW}d!7E;0`J7DJwI5GDMjFpbsn{d0hzp!rqy-IiFsUW7JP=x6_
zHPxZ*kUX`S2Bn`jAZ`)M6O|e}1DPw5XoTrXVj<Zc)t;;PXnZHpqA?6n`>EtdeJw-0
zN#a-IE&T3#MR?2)rCFQc7Ku;PibF5-iVBv0o8atvOkM4&zl4o9mmy!w_UbG>jpEUM
zy^}Gm*U(pQtOT}OqO=d--XXY7&Dv4T^jGvVtRzVoKC|K2+v03&+YP>2zK|B1)rH<P
zd^M}*8%+Pym8Fr#v+RwiNb1zY;ao3jVHb(d1b<U0Acu5DmB?78Pl0z6ZlYN?db33q
z{BI9xI*LS!)dI6J*h+>c?jg0~%YP-}TBfhAJSQjtOjsB(x9G7<=YE-}!pjkcz6MxU
zs5=Avcb!>@^AdH62ZJWI(Az=1j<;eLf6O&e`+?m3*TCwu&*?$x&P7-E9pr%{orxsy
zD+NKru^YZD{P?Z<&B4KFw(9pt(s$e?4lGgFo37IP`4+Ct%(C?-89z?S4}z`pfia^|
z-H6%Y4C@Qd0W3mmeY^>Ne?X1vXO`VYP<BnfDrCJ55HoH$ulL20{nge(#M#q~b6li6
zgz#*)GwvGK*`3K)1($XgW%x&4ve-Jbp(Tn6B1J|Wt95ArISiL>IXhs4*8D{9;BVV<
zwHc;dlyWg36bn@X-DC?yNcz<+n+2ML9AjaSn!jc{D@pOMelzN83(U6J!MG%p0HL*L
zEZTN+<?47n8)#==?rD$rnBTNN?7?>~qre^d_uvJ$DK(h;&Dm}ps}~RpQ3g=pVXjel
zT=l`<>@ZgVM-14B)dQtv>ittZA54^O`i}z`Kp6TAJP2+=$O}i*MW#)&d=#ZUF(M(}
z_B9|Xc>Tiy&ggGPYhh}f(Z~%urh*+K;Kv|%4g7`u1rX)7JkVboT8np{=l@l4FQ00!
zn!Gosx#{tR)O#3TwpYRWLKykOrW<$;xP^Y+a=<PI(=vsaK79QIcxWHX8xRfv!~pP2
z<vUQ<?a=W;V5kTswn4nP^EAC3MnTlF;rI~G!gPY0zOT7vB6j0KkSV#`KJ`qmqEW=}
zf)k~$F{qXhJWBU-2;GU=JaCQch|2V`aHq?pzhZwH|3I!5wJY47;t&YQl=#G~nYmHl
z&<ga{EybT{X#zhje=s+=E}h?)`1XTGr85z{r<F-)*t|`DAKu9vzNkw7q+c+apM`iM
z@6C?v!&=S|V@mb?pBwPo*g<`ef_)^t?vZ?k?Nf8@rMZGkweKXhnUy#6{R#cz!$dmv
z)tV+x%{kx@P?|ub|G{RC&ml(<=B{I=T7S`tRI%RIrR|k24RV9hd$D4rhc?@v@*8s7
z)DB+r*GF>U&QbW)9t0OXomFLiPBrOYuw6<88PgJ9r%~DeqEss<d0*SzZzi=t(kr)C
zk2{_&Ieo_Nx~mVW{dOabM{?$jmYqRN4=ihCK>A(XxRO`D)&LO+N29~yQ&f2W>EAJb
z2+|+e;ywGdy?EsBL7Q|C_~tkZPp)5Zr}=blwxdy}x$(y0w(QH#y!%C8**9Rs-lMfB
zJia}j`9$mKrt#(3bJ<<rC=rWF3#Ibl&e7A`k=%2nO;==yoOo2V1(VF1MQVou9kubS
z@m_TXhk@4*9vtSh&$>ol?h@5M|2R6!H^tW^1h6v-V*GlOCzTCC&OZFDwKNW{4?I78
zW5d0Xg6o$(rKvpw`#cHkvm*iaRnIB8y4b|u4nLnb5=#}gPLY=B%-G1{qoHOu;>kG1
z6Ll{&-Gk2$1Q7?`Sb!owBKp45YUYxeZ);;9iFP7!<Ua!(DvIMhP<>EHHAn9$80YAQ
zio)@Oh0^j!C~VAUDVVz*kZm$G4mm~d2;)h^F05dX&7P`<=LU7i20LL}Un8<8Aj_6S
zol3$Oi3s^VULG#i7z4Q(^g{-lU9b9$z7qR<<&En6{iRD2_y34RPKr<`K6N4l9idbw
zFb{i5A8zJ^Ymy`_^W9qixaxVvO!$Gje2<3mw}Gds;6{VZa3|MTjaO1#qk!sl7<MMZ
zZAvR1=}nMx<%FZFv&b<qnFkzu*-R#tU4JL1(nJkA*zU=6%Cfd1@yy_iT|KVKYtj;V
zxq#hgRs$H{M{M%nW<q|~K#q!4A~gOIl|A}vN+BE|^fyac5c=V%R>K*~Z~N|e!8z*c
zjYxm%+R_;;`@E6l=T)rr2VIQ*FIY8rlgFxW=^N1f5+sslU^u_*>}DD!pu4Z(9j_|V
z+}3M(zG#v%>6*hKhQ;%7kAnY%ayOC$Rr7&nC^9q@a&(1DbKZ7ZfW*mZKCx<2p{gT2
zNl7^{_lD_f_Y}N#=Cql_9jEj-#5>=k+qbTZ%h5jYoZgE7vL=5GgZ-MHiDL}+6AU_D
zw<l@vEHyZOx2TrLbQL^NVq}9hRU*(kn`FITTN)N-BGa~4oF+_|`s{B*Pu@D6h+OM%
zLiy%b>4`1#V3D$@crS~u;Vt;7pb8|B`J-8%z=)fcI68|G`^KB`T}G=ffEt&PvbtsL
zwd7B~Y(*L~@gyy)2W_C|j988Ts6xEH_hbBiU&dV_^{=m7%+c|<uIUVZg}*p?(6yV2
zhoP=DD97XW47f+jjazDk{BF)_THS!PkGG|Wxb1OYynkyifkyNt6or8KsW;7w+a^-F
z(Iv$uoH5f>w`mz7j_!uX?uG@CTaL)B*!NOWNc@A1Wdw{HmE4^<I)>aILtX<g#b_<Y
zlP$$E6)#bJbOHqyi~+LohFOzaD>K+C42*-dkvj|U2v8FJq*L4K@y~M}DD_CMQIWSh
zxVl;-jQw+5Lq%yDeExUkH<qelS2~6`u0otb|1<ma1qHJ<wEa7I-!=OPVCu!rc19_*
z4MYt9X|ZKi`cH_#GsyR13ga@gAX4`z_fJ!4|F}CaAku$T%{3E3``k3+ZpF&L<i!}`
zv!B+z(gCgKKDX1ysWdQnJF4WLzph2m>2!04(*aeJg*9iAS(46o+>M|RNal>p#$l0K
z#z(??ZkC3cg>P!$mZguis@P$Fb?a?L!+IH^z;t;fVvt;%MM&k>Q!eJB2Bl&SUno?i
z;Or8iA_LM4c?#xThzd^<xg!1s&FyOQpidO-Z8RKmyMU^N`!mq*3m12eitFxg>c6m0
zN#DE}jC6_)6ljP{aj144ezjT;%@ueznR+t=xyh{imn2*1xN2ZvT;huV7T2IB*qWJ(
zGy`;&ly5_y?~++6QBu+0nL1adnB<DRQ96&uRy7loQyIug__39Z-)`}WKU+9_<2y6f
zo2HJpE3b*Ol}R3hCj{PQ^4>In6UvyBRr_KxLXCs?KGid=|6WxGOiDNr5*&<U3r<}`
zIwDe(;fz?*F-8EB&*|KkT>8Dp&C6-z$MgUV9xiLb$F&Y&fXe}4#k_(6zP*5lUV2fB
zPbphJ+tAy9>*YL=eE(44qz0ViD7J%OITP}hw-y@nxTi3<MBRbs*K0vnXE(0wxTc03
zL697y?J8Ru-0X5Y)|JpVxqqv}_}+qa7F^>-e>3}$CrRR`AwWBq!$@-Xo#_`gM`zzr
zXGx5Si@Rh@r4w?>a|JfxpH*o(wOJUA1KRISh8mJe817bZVehCB63@MX^?Ac=YwPIa
znZ39}K-C~Rz%4m^knY--1HEjW_1pSumD^rt9SG38f$hr0pDI~o;6LWcxX+5K{@Wh@
z+exYMPcBH2oWp80z2pOu1SI$oF4B~v00eq3$Nob%$<pHbK>}3<kd_fB!30<|S1q-p
zViVO?Jp6qwp;^vVG3qQAS(1_|yalN4*Cc`b7JzD~`o&^3(z~fZDqQyexX0MIr-dpn
zoedLVYqLbFJw=~-K_=zd#F7ftm3%I`T>3BT2)`2Gu7;~=K-vs;6sdIa`(E$nW!iC+
zm;5s$SGoy&=~Xfn#0la*?KvSCe=h-wZwVdQ^$jg;Mns^0Haa(7glu*a5!SvohbLm&
zN8)RRLg4eQ*>A6>?LQoHEqXTmjn|;HdxAkZn>mMg!6T{9kI`y6awixV^YkQ4Ot^g<
zN10c`-ni~@$?c5zpFF6`b{^5^R(?50fLvl}KacD8)tGgZ)kbsk3-jxSzrVl6IhZ$m
zKbW0-rmxsHAIn!do8|L-dZ_yACwafkxmb5xw#0E&a+2vWQ?*iuDSt?L9$sl$>rH+~
zks)jCn~6`Zh9V}j9R)ruE>l-(%lzz-<6Db{H8uiZ&Ff7_%Jiq=R$<3m#*IlaOMOa)
zB7(u?)|Hart?)fC&H>xxRk0|JGB~5x;RI4nWWM&TV^Y>D`Bl=wLY@6>@q%YZ?y%h!
z`F8bf6IW&PvmED%S31Tn1J8RNntUGgO-4eIkSSEb(89kdfD>S_8i@;78SuMsyo!)$
z;PDad*ckr}B?7c}Q`rI|&tD#rynWp$`PF3p;<6N+Fs`+ePbKZDvlO17zTs#q+(@+J
zSb&>ao-!q#K>kXykykdbKTm31Yl^y(|Kt2&B$UPb=1RNix8%&@Sh+AQ0}@c9y)ucE
zmI1E?LO=FP7oaWhVN=g3p8;#BYy<oFL(^lnyM6t4f=IZx!+oDwAO*EVqP$}@HNYRC
z_XoIbXL`T{9=8f0z=Dy~%qrRdO(>-L)X{~~r&{-P2B7Jox7>5`+!t&xEM~gd1F#g_
zW<Wst2(|A4yYxV*8{FY5xV1b-NEU8pUy1f3zW_#Lca2#MwCH6Lz~~*0gi0QhOCB?v
z(^`PIWR-sI0*g1bWg_$GF^TivTBwT$Tnu$GhWsmed)-MI;)MBOkTo%=^A+*nKXSky
zA9nqV)j&q#NFlYUZIkCRjla8D<=Oa`2w5*Jf3vKcI(7e(Bt776!&rY$OOlu`zp{*{
z@BRto`6^tKFi6nmeo0UNiLL)Y>!q(mFM(dj0+tG!8w?7R|L4x4@heKra_Ob2r%&~=
zSBn|HYQT%*N{n!MLlbLnKq;|eneQ~r?GiOJXJ^3_ColEo{KG^_sPm5(tO%|dk-%4&
zIh_u3hEqFpZS^M`7Ih90@jXT6>)E5P_2|4p&Ro2*2a9ayt@bP?Ugw|0(f*Dy_BY+j
z#<qCOs~_J>5ViQPB#9}lXpI%6=By=n^EL}H$<TQ!nfW4-sUgUeD!ifE@w|&yTQC7V
zIVT6y+w0kC9m75IF;JeDhjPo({#lF)OV9$<eTy$y4y4qj+_oxY9j5a3BWL&-!YtmX
zT+cVy&fAd6TX+&@SL1cd758qR12=m|YfO1-8}a0}W?21gqZ~MXOMND;U@BOj>|?Mt
z+>7#FPEd;s{r((SV%(BhvD*$lYZ5N7ij-_Z*DJ1T^v~?2{vlj!Wf2)f1d0K*sI^HC
zRuC5yOGJwm`K5R2>o+}{+bMG$6O1qcG&Qp63%yTv-&Qrt?JB%fso>=BUDQu<H88K>
z*q9q)oKc!Q(OjNu9GO7M<ESb<t>xEYBeCQ-*~tsZbjy*YwZD}+DT1VKG0>@>LiGe&
z5Hlk&d1@OF(3Tb**R41km$<N?O=`dGDUbL%9fmmhv5~9h;&!?4<5Ti;@}0LLR%$%n
zXUw=Ixn-aq3GZ}Yq@>Y)$jC~&IM}P2yt7$?^rshH=eVhC2K3B`V8q5xP0Ty|;K`8$
zW^}dMwP0*|1MH8rzcH&>y8ZSbDS-(1sVJNr2KyJxAjb7BLiRsC%V$@)p4CsgamH{Z
z{sk(z?iM*K+^~?z!jXFGE=dv%yOOT=E}#h0zj1cb^MQ|a1ohHOB}n*3&oDPF&nJ5m
zG70sw9p{(xaijUXx8<nVC1cL@Evk>uYZYy_Med4-rW5d{E_F_V?w%c>8H|o3u**}{
zx)e}8dQL(a8gQfPMoKs9S>$gXk3_c~)xKm3b`udSW>FWj+GIGRdlBB+2*jG-XxK>j
zEv%>OMQj92V(Tm1{{>QmMeWW`L4?}?u{Eo{Zka>vTN;DhCxSjN5(I{-9BBkoON~ue
z7}4=Ct@_5+WTI;HdYb=kTJOU!eu|2<q!q_B+fK^8W09j#x%xG!?uN}uWvbu6anytO
z&YtSVSQgUpZykC&H|ub<Mg{jg00?c%=c^>J=4TTRfvap>Qt~$F-|I23UL$`=Ug5$;
zA&^h!40pd6?(U}4CH-a}SdWXBfXy}X0(w6U_2Z8&l%!enfu>_hlx;KJB<lujAj_;4
zo%{f8JnZ5>&?A9)*S1VnpH3L5-;*L144ng&nLy-&(GC2E=kZz@st<L=fI0!%Q^!L!
z%fCQrt->+5n70ajo2q01C-K{nU6;J;lDzu@XyS6OIGYCVKgV{iJ{|83#AXbzEFKqh
z8*GiOM2}jdh{OLcj}{QC24N+woD_zAIZ*V94jVXH`|m=Z^8YRLXMwevNZX%sgLd!p
z)_<KpGe>&?TG5Jzk4n1G@`URnY_pnLDhL;V`hk5`<x8n3Y1Z8dI}|xg_-H^RIbM4u
z#jK%(gf>>8b*oBcyrb1<e|-R}(=rra+AzwDsiqajCfe49UU_P8+I2&=_MapieJreJ
zUYY)cpg+9ww0v@<g9nt^Sh-EyS!9{iIoLV$b#QU8)4kBZgYJ*m-+JL<my`0ruDyUm
zt)=df^Oq=2@W3+I;n$3rmQYXM7w;tcxq46CO?hhn@SeY=VlLkD`eh6@O9i&~rd{DZ
zYbN^Lm1iR}O%`?Dsf`?+r?i({&s^_vos8=a<c>LbPn25=)RzVvKet|#ip@0KK7o*^
ziNw$X$t5hsZn0Mb&_6G1e2H6Jc9|63yguQgOFrDFG@|Q2w+v2Yx=;E4m^#a-s@`>r
zgMg%@l+>m>M5R0abT@23N<=y~-Hmj2DJhNACZ)S$(@4t(Q93u=#ku#Kb3ZwT!!Pc!
z)_R|JK6C!&?`G|;8NX~XbjV0!gUV_9Z8+HThv;rE+<G~U13(jOp!Q39QZ!o*_fI0U
zt%nB-gt8Z`tJRcxcSl%Z%*$dO4tDs<=Vs*-_%sKp(E&OXNz_H&v)Wy(EfG18t4bUd
zb<uL_8*wUIm)~K%ms)&zV4nkYBjzSYl|vE(m+ca?$FHudz+&DX@$#ku+v1Q}g+j2H
zKa}2>-KScmR498uG9$+Uk5^AaP`#uH53Yxc*h9PY*2<qpz0et|a!EIV9Zc}tVWwv1
zHWLJN-5@)EJf1Ex)gt#;mO=mkr-HidTXY-YQh$Mz4L(o~r<P^u#Jh=;;<G2YWBsZ2
z?rD3z^-gRHv|%RQa49rs-@K;V-v;b?*8$TH;r154nPclgiNdBU`sNcp<9h4`|LPPr
z#rqC5-z_2?$}Yr8m*2u0K4U7gGv<*IL~WE&>Xq_=*2)9h?|}KoxdQ`=kJL+ea92$~
zX<cDF&GqG9+Qz23ut^trm;ej=c(mPG8D69F&K{-2S*D~!)~l}HX8To5sxA=wmH2|g
zzTAmS7ewQFw6;52vs-m_XK;Pf<_t7wUSnmTl((5VAK|8PHlkg<>dSkDJJh%;{GQ6i
zUMm5&)JoxA?ZPYFBPZYUXAt^&qwme>xMaQwQJh|lVIy2el9c=XZ{GW^&yC6p?|T0f
zSGu}{ZhS3Ni9c67mH0E(TK4Bsn63zq^2tWCi;+%RC=BeY2f=uI5M8^)S~EMu?M1~@
zV_@Si6M=;qAPi$6;Lj4e^wRCD$H@-UZ#y0_;CMff-P;HY+rD@*%1#jYue^boP9mNb
z=y4l4UQ9XMSo@x#8#TKaU8WRU>#rt^<U@Mz_k_?ln^Gq`s$=5M{RJo;f9ls;4#$UX
z%k`cNoGuc?DIF2?IIj~-P&#t-o~_1*K5}zy-)-`8*Qi;p5BxcOgt6vZk>5LcwbN3P
zrk^;=c*)nKm__&-k;`XWkBVrRkS2OuV9udI2>l2BgZyIu`o#DLb;SMkVfCRgi!qR)
zsxYlZg!CeV$^WfHE@D=7`eSnQ=RTc6^gNe9PT+Mtz!_1^pp2&!aC*<sz8DiKTOdz}
zMRYLj&^*fEwKL3|fByrB-g_!-X7IsRC4ON$WBa`rB31Q$mvP4?Yii+YYPxjL%F!Cy
z-=MHy(!!iBA#t1%Y1+jJ?*uoS{v5@^m^4&kf_RM^!}OpKo6#Pm$5G{$(-G0?74B}%
zEK3c8;`*JDo`s-FipBbdt1`UG_@b-B5q%PW7hbs6yp8cH$z4oaX{*!iD?#fZ$tyc*
zXxjJMDYcr)MuupAQ)CN`kbNmr-PC3dDohBZt!iM6s($1a$<$@o*Z);`jT3Y*y@ii^
z<r9bU;^k*sraQ)C(C<!#8q`j*w9#xyvt5SAp{W{bI6PNm_clByj=%9;Hm;T0o$5uK
z3OSp@;g_j_#93(rcZC`N7Q$3?s#t>&@9)6AhQ~Tt?r&Ij<SLXNu4P#7y-?F>>8vQU
zQuEu$D{FvE(q1IJ3+zV}=eBZr(V8~`E5W0WvCnQTakfe5?5f^)pQ96y7*gr>vuV%}
zcZl{k_u)WRtGnd|w7TOw<W_eNUDsn)j8#u<_P|I>-*~b=UF!4z+UgE-=lWXrYRa*c
zWE_6p;7}b5{x%Dy(T<SZL(`p{J%nr%fokeY3cXO}2P<B}nI*bTzBuGGC7|Jj*$9jO
zDmB%j@>rJGR$KGcx01Q}hI>RQ2y0rFTF5*)YrT9T#q<LuwWfJiOK2WO0F>SHvNiA`
zcaYkLBOEyVY%gL~-7k9efbNK`EZgd+w8)3+_{SEY?wNTDvdZ~H@@O$15|eAyC)<MN
z-<Icpv)roi01M~?hQS`-BeLd8TdHP%cv(2}$wr*?y`bOBnc%tY9b}R(_6_8WZal!{
z5AFg)7kA9qOYM-^Huru`&w<+VaHMIvRfqxSjB!teax7qZEE8$-0yit0-{3F=-gbDd
zXSUov`_9bNra1AW-Be(l9KNGwWqXFJAJJfMICKi8FrdWcC~OBBxB@&aEqC1XyZVww
zWPV|{0(WGh&0kz5?JaGV!%18V<8>{B17DAItSfarl<3YFTG)By>Q%WW#itt=fc&0t
zsapPVsF<TAFyYV>5fRY?dx>MzTnbFrl0=;fT}Y3RU?^>3<hgKlUHXEfB`x}4I8`OW
ziRobGR1MWNAD_$cVUs$|trkf;uc~?ku7>K+b!}?HDw-#W+Y{>cPl|u$hG)ug2U9L`
zT3||A9qJtWXqnz#A)QBBy-q!x!(hah)T&dbQ=?P+xlY&&|GoppSGP8+C6&<oSv<E8
z9N@na-f0&6_Z-vA_aNLm8X?u9y5#PaXWQaUzqQup;bCBU-uc7q3Cr=X6(u&I^5y1(
z?~w(~VQBg$?gy9GMr_a2Gt|#CXM>Pll6Zg+KSF6Xi^J2&ahZ|E)oSr06wXWfwUvut
z&`SgPA4kI2VGvZBf_kSMVF2y16v~M7VoTMU@5dfWHt0;H`s_s-(wyV072kVIiE4^o
zbjXXkQX7una)eoGz&{TY6L%7r(5qe2Y?U_ntKaNkOu+XEYY>VV32I5q;{Ia;?EYPU
zLlZ#h7RN%P&ec+=1%Pox1xPikggV#IA=Pzr6XH`Kz^09#bie`_f6k_VYeM6G&_EF<
zDgkm}=0W0@hdcKH^E!I{kW*2g%NRSLbkWk+w;ctUr857l(5@8B950i98rh|mC$ePF
z>3btTr4}hcjLAev?-Gkv9`V=ZPA5Fd{8t3+)cMGx53LE<U-CK%HnJgm)0RvaC_u3l
z%cPTrgt`R*`=?fSR#K*+z6?m;$@Z*bK!#WpSqbx^meA2Y^u2G{`)&yuHlHCSkUuyK
zzz|zIg~~q^#zwqtWkhC43Xnl!n-ubnz@-X)IR|w1`lunEp#u8S=DPll#2-A$;I6QL
z2c2t^eeLu9EY{IKygwb4$=Ohj!=n^XuQcuI^yX{7*6#Y9{ygpmjfA_ZKbP`3!q8DH
zSfsvei928G=F`lkK1Qvn_4lCQFj63M<XUSVH{Qr}Xo?if=E}Jd2+-fYqw#?!&}PP<
zNqB>n`iH{!mN%gO*OdB7((R-z7nFlHfxrMNGh?ei8nbX%JCd~0zAv5U)TiQ~D6DAl
z3wMyA;K`x-IieOo5}N}*^J0UI*1dRTvYaiy<o=iHI$i2>o(D0nQ_F^d-aknxbTYQ$
zyN>egeFRktDKNG}!BzH&gkVc!<|Iv-b5;{)VuMJ08T>WwZ5Etz`JL=<_8IPkyTPkk
zhF1r~16#m_z`F9;()o6`Sg^fE+WprC#R_pc2I6ph2J)94DTDenaCtsUmaDgHbeal$
zJ+CwyB4rG9N&F-Hkx$j)Z&!f&O=a83JW(BViCmN+)39E%pN@3@JDrofv`m^cnZ<VU
zr2Rm*KHIYj=)loD3e_e!!2a^vaIM#g)0nh+1b&bulPS}R)r+k-;bWEwwAvHJyjoO-
z<Q-nMi5}*(xQWzuA(J4I7OgAPH?ec}1K?)}ph3>QVKL|~)L#a5@aTOLWahO`0)&|l
zyOv|{dM4gYF1vk~gg@n%lfVa3yHGC6smc2CLxJWW!W7$Od(|#q4>QCvlK+}WKzZf5
zgA=<*1tv&`bQnnZgCM(ow;vXN<-c5SMN%4m2INP_#4V|xRy4_At8lS*CfuCEeYU=K
zk#{qIzM&_RpUSRxdDJSL<~{P*##o0ws!ew#6RmyEH7s$`oX3hMTKd%}&-um*;z5Wk
z$JH|CT4yZL&N_MWIP(n;H5<+ktGeS>!Wn5yPl_Z8ps(;xzp3m=wYgF}Ra2{fnT#pB
zmgMwSp>vDaJPFa|60Lizp_~+ZC>KYW$-wS_e6h0NxJY{9|HGN&zdWJBw+gSw&)Qf2
z0?#$+_jKTL$&m+~DJ}YauowDB&&+zjbx(7OhQJ;_&)2v{WD)~sy*@g2?BM$kC`3|Y
z&|1*YC||W6SKCp2hAD}NY~*`_^AYx%7^_W^zzM2a4T-hSmdKa`oeh%=@^X9Ub?|QF
zX}jtIG*y6o@?~We#V;@hql}b*XdmkrhbiokU&ywr-2><Oa^?Wh$oFymk?RJ0iTuyi
z^5S#NLWSd-`WXOu#aV=eZL!b!P<)^3+<C+|vyD#4hKk`K0EnRJ(oA!_<@wVNxG&gk
zpW_ZfvE<2e>YAR_{^%JLI$WrVMhycf7t|Dp1WNa##pxisNMYv2*rZ?6Kn)tMT*K;T
z2Z;v)P{QxEHvWfoAP?A(GI<O2!y&{cxp*O1LWlTklx9<lfyz37@BPyKi-?CTDw_%I
zo%V4jmc>QHM)5^{9t8aZvS3L=yB0x!B__r*RT~5JBo$h0@qtq{*(O%b>+{OPnl0ih
zQ&H$^c167pj8KKN7&?M-93bH<${sy3Zb;6?`JkN^c+E*ZvR~mg%)eV}-v3#_k~YsG
zmTdBQ;e<KDIrbLkjz%;wp;rt85ttlEY2A&E{(lDx*1;&JyO784<#|kQfm|NsII-ZT
zF_Vy_{Y$_Wj|Md$u8|44>|k_8%K@QTLBm@<YCiz@7H|V>mCn^x_Fp&Lj4|y(l|#)o
z)7shcRc{6PyQO>`Ui<TPQcn=XPBlXrW^GWc3KMW9AVXN0Xnxb+`AOfor7+yscXJ2O
zw-aMl8*tz~dcNkse`%0IN(g!geX-i(>|ic7Vf?PCRR5!esF#FE{=VP@x-WoiYTE=x
zgS%dQ=AM?<&iB{O&)cGEmo{G5rYEqrK1rc~PUz7qWKHVwyeJm9tM}o7l<2urbzU|<
z+d%?8;;rRae<Ty5e1U{K?(r9?4a2HrbYnQBh-boG?$jUm9)X@e*Wz;e{4{399d2kO
zc+i8b_(<Vf`>A)EJ_8+kyKwA!HLtveCYtJDG&0LHMUwC6Q$hIXv}FvNZX+Tdid!nB
zZrwVGf!7=QZ$6(IK2y_3a;mJT#}T@;vpgjC+99a~;L$qukvNu-;>Na;tVb3ydY=Hx
z#jiXOFW#nrW#6(khYT&%n7BB1+80mL4#h3%ZP2xdnLPa*Bt8CXtkKg+L+~GEv!Gx&
z;HF>c+!@FsbcPRiEJ`2=0kEne0QX6M!W<fe@%EJo2MEdUKhfZ)yT$9SAJ3<yzOQ55
zJms8#zxj%ZCwBd_t-9lKSv&|y+u?dpC4e9h2t3WLbp<>!D6u`A7pS1TbP68k2LTR!
zZtK{b4gIi9>7{}<^!Qqr$7>Xr?*N_<<$-$}l~_unZc)#>g;8OEdQ3kUPxA+eOPd$P
zXoaRnCY8|>s-?OqoClqwpkpQ(GGl6WufvLyKz#;9`S7388#BwQvQ3y|tW~FOiiZ+Z
z1}KCla$IeMqvEOWXlzf0D3fJ&@ea6+nkp?u1?B!pGOADLWJDS^RJR)p#d9vV*K?Tv
z{06mv8qxhtr-BLe__9V{13tqn@vMiJ?8(C3YW7G!LU|j$6>WNN-psM`1=zHF4ed(&
z_qomDhoM)Za<O#>c+2`-J)xQB!~&hMH(w+lfs1AmX=cy=BP5&=**)iE(0ku*A$0Sv
z5C{Uq&e?)QK|#@r&}{byLY|&aUj%S(=-=K~r9W;<ofDarB!J^rUamHr%|rM7+1@zX
z@h&KdQp|U;^}a_lfn(%6SarbXmo@bH1}E@R>)O`pYCUYQ|B-#BbORPie;l+P_1t>2
zYBz?q6Bf!lZ@OSh#BK6>;b)e5_Cs{}AsdYB!Y<NjuFY0kWtD$Y<djE;3<!c_!V12%
z13M@wXZDU6;w*4H@ju~GyLu&5XC|!@Ustz8!OvWtPQ021HuBl9YobeGHmT&wH2{Us
zhJK>7!yO^5ul;{q2o9dedz81`VJC6<7AA48DS##N!4_cp;=-jA!0!_KQR?g&buwK0
zubK6K?KDWWtgZOqpp!;ufaTVc*^UoT>wl^-XehT*^WD>abi<_*db#Ffrh%$NV|Pv?
z;;Bw?Pe=RFZ`ME}F7ni3X&vxXybkVkvIk~>MENFQWNA^IK>z*(ullJO*9fT_3eI~C
zg9FY#5x9xI_@6DTm=%2Ym*NR`HCr*b9*U#y5_w+cB|_MsDA8y1YrWp83isuC`v%ZQ
zHpL_jd3r<Y9z$Fb&y@Zx;u)2Oc8kipmvoq^SD$&S<@+#Cem&CN7$^E!Cd#KpD=Nv-
z1K5i%3`{!pK(dle&$pbi*bd8eL1PbEaW2~)90MuA5H?;72)kvwmE`(y<R8_$na}v|
zN9(6mVNR$X>~Bz2It3DY-dPX|`ey)hGDsTpbkcVQc%A%c`1t=GuQ)GE4)|Yc{`{aA
zeW(9TSAGi&L<Wv-JX=mWei6X_IDc!U|9JE<WP|^filj1Gns9qtA47~%&lr*lkwg<R
zt7<n?PbUT$RCZ(G%cOi^D1V>&0bq4czeugTl-SvPh0ax>Sg+P#((5=R-3Qs~!!+oP
zG8=uI4G~~hk`AL?l$c=UL?Zr7A(c=!p=B`J{Y7o)E61busd;XMfFibdeLMZ3_`IXV
zW*N&`qRuYSL;Oi1A1`fuq;#L@$Xu!pExi^kxfP@QahLXo5haBj!kbc$ZZuLEB^Ame
zdnYE|NU)m7iA)OTIrfRgM+@Sy&HoR&!M~9ka}RX1m;fe>m`8y6-}**Oj5_3yoC687
z9lUdoFZ{nM$<xnk@$i27i|kq2dz2eyyP1|l?x(X2=LHbAXY0vgN&^e&J0T|s3RoQU
zRz|g6&<rw2Jl~`@ke7I7NnDi;1hb$K{*o+aRbcDm;oC8Q_0_h?qR6Y(j#pmF62%Ve
zhswZUXDV|w=YilClNXBYQr;!_<Yh4x6(KyE-Wsi)Y%iNws<u<O>H#v@b~yGq2f+}b
zqs%SqpQwge;*;<eC#Y<TQyxqH;VV7x+G#+)&9D^VccY{zj!n7h5vF3+q=Zx`1C>hB
zQY%%+{TUF0zj%5l#O?N8(FnOp>|puObWCxd14}L9*<uG;e*>3-UgUohN#fAZDsNKu
z;jg&)GWzDDUjxCiTwrZ&A|Q17b^LofSOSTcNr~#;YBuocSL=o?v{dtCbDurKPtLjD
zetIP(gTe?Fm}m`=_z(tdtAOQ?t49dH$V8*+ui~Wcp!?nHCxSlftzrvO60_ovU@(9Z
z{hiFhD0nz#{&rXTJx>}2q;@u{9>V#vN%45>1^E#{_an07AK&6_r}g&4geYu9>gB_T
z3$GnL-De(k=eBT8!UVi`4G}UQ@#w>xQJMgK@LE}6EUK$+k7ikVa15Px!Kub*uMv1?
zK=4$q4!gGUy#6nVA}@Y&7PwjKrc@8J*-Grun<x4S?Jk-8$#{&O@z&V&S0;&6%=C82
z)lJhNJ=I}(BzpvQ5^ao<*v)~dr6DhmBGh5{C^zCcYrGj>gS!g<@5L<p)$PR13>Ecz
zf#Rt_^4Bbe#$I_a-ITV^`hpI49ZT@;BLe`;2|HkpgPODb^olz`I%|I7nf&&%-1h&)
zzvb0>fZ2Bj;G-(Y_#)q=)11D}t<U>IRwPn>=JThcIb*UQFX21q?ZFB7J#EUFZ%+ZF
zbLurrNSGM0lW7)<tR+hUEmk_eNjXuzyeo38j$@zgzFB=#c>G`<_eSSwFzxs4t+g^N
z^IHZZQBkG&6HY?4k9YQc=P)BIXr)MwN8+g}ASx^2b(dzGttr2TT%vo;Gz^hHcac~0
zczaoyp^s`78<npE3n8DUujU9=LZg)H(c)_iR{WrEhn3~h+TG?atU1sK;&@~aT-Yl+
z^r}00{)~*o_M~4iy$lyf{a}MR)cP#j(yWw+#MP~<;ph#}b?9LEuFNw`{$+rxNu9ZD
z${D~mIH_HT#K5L4byFy*y*FLk&)g!e5PeORJIWhbpOO~NbmV71#@4G`U#Yzp-x`VD
z$6@yPfOv|B<~2rWTw;pCvk-|roAN*ZD|)maeBP`kr2q%o1I-91Z}KpCVV;SJ^B`K~
zU&0Q6DTs_3;FetVqqwLT)qZ>$=SfJ7-84ixpGYNIXwJrd7xVpqkviY_Xm9z+njCN@
zOSFk0o;$9}XUTY%-g#bZt`9P?lwP0o-Fq_+NlXX5)m+$L{-<g_jBmGGsOw~aVt;<G
zC{THh=tgpa?^o%dYtRjNg5$%C>UB?SNPS7{N9lx9m?-W;sh>ev$I^Z&Jsw1kB3D%e
z8!d%uSM6r0^HbBbuJ|<eMWM)>bo)w`wlB)l%so<eT^9>R7G8MCcCzI7H6wkP63MSO
z1~W6Cc}p5iUta(tZd(T4Pj<LNv(Xqoj#jlKMAel!FLOjBt5tPS@fI~vt_ZzVjwU6}
zF~;w6NN4E2^{ZEH3Xb}&PPaxQ9i}wG`2$Im=l)X0D*J0Ao4|6LgxiGDn9|G)HHAd8
zwvTWUkkdr>0?cN`A7~bYwzHUY!Hd7RIXh%#)LYjN1iCa@gL_1^=ddexE&BHXkXoS3
z3_GXNg`(d3)I;t=EF4?y%Iq+D!{VSFtt88H@y)i?LGu?^g6StR&qk-e%56V}ZU*E9
zQEI33r307Cgw-$|uAYQKhW$RD-CI9~@f6EEc{r=FmkvXAlD_4zG?9qyu$ZjETSKTz
zF*u?BQOU#l^)cvAXiqA-vvTB1?E$K74h2zS<Zqt+<NC5fY`wBKG7@x%nN&l)BDN7@
zNVnVse#0+pDPs+WX#}bGUw?^?aG^YzOP5jcxR?K#l|i(m?@wJRm<F6nMnlPxOOz9o
zOrgY{<+#a5A3wk{03rb8Y@hJ@NnDGh7vObo@@HyaB>`wSO3rH#7;*0pt8`-$)8HyJ
zo}e)A<75&WbCUG)QWQSSNZUowy6|z!cIDwv-0IFY7}ZKp-b*teMZq|C@?9A-+<EH7
z1(RrA^thMN#F@%f!ojp0P1VTf$N8qj3*fU-PST5XA$eE-GoU93oyM0(Oq|NA<m_Gw
z#mairqgtX%((meU7OIAjH{Gk>kRTbs%N-sbf6hg5ceUnWI{$F3Lc=rm!gwUm{WZ<q
z)J-7p@lZiiv54%55S!8se<w~s@}cK~l#44o$ZU9_#!>#zsrBq5JnOZ(#n)TZb7Sv<
z*MxrqgeGX&%@WeBU0oN=P`o0l^84gE?;0VojAxB%8Bz5B!LN4^fRKvVlu|3P+ucWx
zJt4e2*8vfX_R7@m5=AWZ$VRe(1q--l@%&1?eSJX3Kp~c~25{;CAeRXh4UOF77NRyU
zj=gsM2_S1$O%TOz7RTWJrY}YQ7p=cPDPt6KXw)WPu{JWOPHY4v8enJ<26^`t@-W$1
zkz?3OB$$JKN+cwvQh}{lD>?qYWb8&qmaS*4=|}kzi@U|PeVFPT{ZTv7U%vVL6+Yer
zO!Q$tvqvAqrl62W)~C^WQSYKm_ad?S^lLkd7{NE0hwj_St^VjX{Dw4u09`x*dQ8;2
z4VfZ!+eMT7vkmq35csd;AvNai`|6A?r*-A0)pH)_1?<<RqM-`Dz~K;%%?EmlX0vh%
zsHI1K6#zY}4a!H!F6W~%Nx~FgYq(+i#5BbK;~BB-G@m-Pl+F>#udxaShuBqK&2DEl
zu}R-UxtDY%&WP#acEJp5zGvg}e}veP^_$5^5|6+R`GRBGGy)ilc1<$1{u#f8dXm&8
z7%3_C8Y*&DMUs=UuJfJUnfPGnoXM>sxzQPa5F4Pf?_*NNd$)r(GC0{887!*#V#YWW
zPY{!6Gmzb1oN+95t&N0ibeykhK0ro*VsZ?5rpbPAQ0Up0JzUmdcYV-CIk=ZP;5n7j
zp3>b=<6$P{K78+U-1i_W4&as;LzRF9IEis3=?zZ-Q9ynd&eG8MnIROLXQI*~MR!SP
zz&N>=APCo{3LKiq<9|seO^Y0*3=Hk=9LTcl5-rbGTAb-gteuDl1PL_&Hxjy+wK<TZ
z)tCg`IQ<pbKQ+W*HkJv1gik%oEEBLGXMU*JcN@}FKj7mq?4hM#Bq($F&WJ6#8iHeK
z>|v%OR|N7gUhq*CIP|WtUCSgcj;=qAtWUk#^0Kq5^j3A2Vv!=rl|4@k1I-XdMOoYV
z%Xnkm<kc=DOF@U>8l)~HmY@;gbF`BfV&=-nBjC0Za#!Odb7guO_tUB9zZN{q*DF9n
z9k;tz-BP1%x^l!n?~z&B`(6Txfc$f^CqUldO~~1>eZ=-E8U<Ic8zMQ_otLH(s*Gj_
zu3tjC*<bhhlj|0LXlD{Uhe(%zema}oBx71+pqkUn0Wa?IIqjo#+p&4MjEREmcW))2
zfmwgvC%Y|P17J5D-<wfWu5jdaC0f>ThB9f6ka1Kp=6AY#L+|M>3#0{=H0?MhQs&9s
z+zKbuKD>HUP9(@<dfNICJ<>om#pSJ;n_EM@V%!Qn2a;K;D%TI-KCd12g5rUgpv>*6
z_fZs}whT#db<nXEf!S*uq^P@Jkfog|u}jb)n-!KY_eA+eT%6}I9yv+CF>fjGFxd59
z&~aD~NrU$*_Y;T1o1GKW<R$TgK)nFV%1|apeyrOCH_a0?{<rOZ!*Dh+EMLAQu{igy
z-9?Tw-g78Rl4FbM06Mbu7dI`EUYCVOS)1STCnG8b3P+i>MIdSIEEy3glVQygDg`w<
zSu<J8nU|;>BUNtW3+z?z`Zp4qd%&F3_uN;e5)R0ty~7f5SkeE9Z=u?fkn&9TW8riC
zsQr5e(2(3SKoRK~WX}PXYHtyd3DXyB9+OIE<UKO6Bf9j?&z6Y-5cY)NSguSBYvjzo
zyrTJ1C(iM2uoLeWzCdvM)bycYHc9#C#MQ^6sy(bVkOM`&{(ix=7F&vctY#QUuM(r~
zuqLH^TmOEXt%W2j38#mTtd}Gvn@#zad`xP~kHM<(e3`yO@m6fNF+Y#hS3FmnY*=G|
z&+J=5X9yGdb9=cIlwDW}<#GeTaAEx~Qfn<r5U2D`YNrMhWr(3yro-K6m=@yg#cP|q
z#h+%*5r5hA?(DLgmWo`5+z=PA!3~IgQFV?zkZaTG)W%~o;#pIXhANv8#rPUlh=0y+
zuroHyT$~z%9)A*ce_N=Mdo}xJB@eZc)adfkJ1b(fgRkDGgS;Wnt}~^ywbMb!g^hDK
zla6ZT4lr9ZmI@g=ym6$>tElM|dhmY&B0btK>rmO~{Lb-&kCatSd{b*ch4Ph+CR3TF
z(p*G5Ay<T&FL+Wft?w*_(aUGecC@=>7TqezbRS_Ka)yRK46Zle5oN)t&5PuX+;KGg
zzE!#kEr&K)bnG;{EL`Y7tgdI2xcg(L0Z*aGLjV9Du;l!~GDfTiCI|p%p}i-!E9;j{
z3Y*8BcgG(Q)_^y$|IMTbQO(K90E%Gb+Z0{#=r^VaxE^zdMbaSnu?ia1k-jH94{a41
zEBxKg6*iz48>NfqbTKL-gYf>=Hm2pWFkEssF;_xE#jw!?o)=%Lbr+jgoAA$w^7@We
zkE6wW8++5Bk%)%wl@HhJ>H*oJzfU+-v07aC%QfXrJvGNKy=<+jXo!FhI6pj_`DlY2
z86fOCHe|>+<;_g<E*M}4oYq;~k1y{7jCxx9z83-V5<tfnz9ph`g7~Gwj~3&k5$~3a
zl{ODYjp}?4fZQtVD?i%d&`d#3K}8j7`?m#y9#gE|Dz~G7B=n94LrnGt?ELcwG9p}m
zjuxjVt>BDa1e+k@I+8{cA4c0#>!4=(O(cbD@FRt+!ng7tK$QwPwjm(Aop{@*DCsup
zKgP>Yh>~uF9%(gZx|zhvex;X->#N6f?Z$N&lMmUT&0{f&{HoO?*SJC;FA0{2oB5Pb
z`FfZlsFLzRyQGNoP!YeF#dIXfC&%W|1%Y-`s$4+?=So8(33NIbxW}O#y@<&hncPHr
zn#P|*iosy18{SIp=id$u`?i(BYk$ma_A_3!8zE&0*8cbx7Vv38*P&S^Q>bx`<=*bW
zR$KL4c*fl&h~dcJt*^f)w)t9o@-ftmHtA6CY`>^qlw@2Gqo#o)A@Pu7&PI~jU{(NA
z&bKHQr%0t`jt%{hNHsdVPkK2doc6J=W?XF8iW8h5m$xfqdQ|_j%w<O?`g(O66yPqI
zdab>F>0M2ks&{HXD?!4JVwJqty_al_3Bwy<Klt>u5_k3cZDDPWf*LO^_M>Y<9af(!
z8^yVlRc+0lt?B`TRS-w0%5GXt3R-ke3iIS#zaWNo{v2j&Lb4vjdL?lr^H2~*_zfG5
z486dyImxkSwqJ?l#0IU&UzFn7<W`6!>Ijvns936-CeBU^l_6|Gz`O6yX67DT?2!fC
z@~!Q>U<Y-4aN+^DQ&&^D3)31?E`8+;efw5T^6*IId8FEJV=L|{ymFNU5-S!e&47)$
zftA2<g?WYLPW#;Aiyl!v=+Qt7T+t%JlBOY-PAO|ro3EJBJms7tRSSW2k?YV@-eJ^m
zfR`1BtKXrK+vsO<VEa9Gf4cD8Ye%bXEAPQ^`&f0Ss)44qVAU@3q^%rpUu?J7f8x>+
zvB!C@y3aXdd&*482SJd&f1~H6cej`DP}Zed*krvg485K4jd&}wdccn^KgyEMoZ2`*
zu#%_EH<SwJy3$Na82QKE0AWRe{V~g^Tus-n9LGL$(OW&gxK7H?(pYq<{s{K?E|v&!
zp5sKvK)~!$v|!)@aolgcBTQFy$EiD0n77V$(Ou6T@ZP1!EM|U{{hLz3qN;lTR)H^5
z?7R?<_=(=AeLtLkuOLEn`8^+DN4y7gZ~7jMZk(6!6PsT5kbZvRJ)iI|tO;P?m7`1G
zV^Nfy@Y6&}pl;zqBdw!sfj!U3HBbboIj)yga25Bq@|LyHcm=l%<w8TnHM><vnbug#
zM|p!YYsyk(GEU*(nxQ_F(d;7*sFEr~GgBeL3Gzo;#ZNWMvGKxfY+~F>TMce|B*M7A
z7jylt1bL?1CtZGj{9E#B`%+r6y%OGqbDcaji=L7|`7Gvmbd_q6pMUmi@%bRWKUxSl
zteR@^mhKU<osmaSh-vVat8}-bJ<;)?X>aS5sl9=c$%yV5K~K@{{2V`Qe1$6Rl?*SE
zB^sis2$}EE{=JxYD2}?}Lph_Dz=UH;QSCK_OC-nM=nFF4Kv1eP)hV6?OwlhIHRY-L
zM9`7|;|s1sPtWAX;fOa^7$J?X@}}zmQuZ}RS8vBP1;2%ep5aWCWjfHRG5Baj#Zn|*
z=ddQ^ujZ8S&#yMCOmsbi`lH!oVk+p1?EsGRzsk-foc)imN&_O!o0RH-FO5|Gqt6Hq
z4#d!1oMHt8MpX<FzSe6p(BUlvDVnP_Fofb1Ulb@*cPf&ap4{+|{+49J+LqQyOOZAx
zNxfi%n*(XP#9#Ey_6Y$dKqv!JcdupmSiXuja;p~jJ>cKsA2unkvk_s?mY}k~T<;&C
z0PTab05@i|<Y<qVtf!>Gzv|D-lDe3bM_{qBvG)2vfx?qL^SzqKC;){5m`m!;+p+uu
z=>x#UtM)`_Pvxo1%rlm>pmvJ-5xw|v>*KOEsD10_EtN-3xlkVF1yzkW&}O0IX}m93
z=qs7^k{bg%_q7UkrcTG%gfMeh+kT!8(=c!uS}wB9*YYI^ed+?9NTPqyn;6d8B^6a5
zqQf<U&TDAk>Q(1b46%}=hSmrO5OE){;H5wo8)B{!8ONo&>eV|!`>zyWGeR~=iKlwT
z^6{uUlfw(BGinzRzD2jv22QcHGYSPlwA7Nf4!fX-96PM+G-7q*MPJ2@S=&#hd^FzF
zREfBRP1X02{PxjU0BGqdYBnw8h3$p%ZdwWBk{xun;34GvsZOZUpT2bD>x&_eE<T%;
z=dfvmQ^!$V1QA5pa|fjC{2{1x=FZ={@~s{D+eVe*e$nMp&iwONLkBwIneq{xD^k1p
z@UOQR$4_^cR8=<Pm4{NSRLJsiOSL~!RX}R?3pIqn(tJb_!Woy%v}f7(+k~ryWS9T?
zKz5UL;C&O`@C7;_-oY8`%cj_M7P~C&2ep;guu5e(x*g54B6j;*WZVOFp)>+D!=@%R
zMJok}feXvzL3<dlV^(uuj-3jEw2b0=r9&}HE4TPjL)=l4T8ljU_K^}k(xyr}cj<DG
zIZ|53|2tx?Y1T^%D{uC?!e1RW+-8pg))I7f%Kw{_sD#L$Q9a9!i&bR){kS|f>+;jY
z5H@7HuN^YiahfSrzkB<0^&Y2z{P6cG&+jWp?y2pp8r}9&IT?T;bN$&$XIIo$Yev-B
z`tZ~bak31Ak-eX~%$^e1Chh)Dw6=edQgp+1)%AU1Lu`TiGgy&rUt;(uRnq9?ceeah
zGO6_<bi{3VtB|&6u~2c-a?M)N>0GQ1{QK<viL%2(erLMIb4p!Pdtn{&qSgxEB8#xx
zklE@;J$s<&!<{SSL4zqrA=<~CL*b%hLqF+|;>dI6t)uD&`r$}9E<9gz(Zgg#*Y!_m
zNX(65O{^W(Mw9>HI%dh4Nm90TncdvJQo0vk)&A--vU7>++pXb_v)%P=O5DvSL<$Uu
znsDRTCf8sdrqq};ewx4K39q#Jo%Bw5f!6@G+Ua+vxgZcC#<_*jWpGEy3X_W7QfB^{
z{Sb#$EaoQF^|q(m+Y9=E8aA#ZYS<1$WEnTd>RyUUZ@7ipQeKxCb=u4_jZswB?vH2l
zbHkRXL)9jCT~8{dPYU)ouSS3dpO^!TM++0{cj&(*<p>1lNWl`qm|d`veQaKy$?6hg
zz<TZQ4!ujzu2rZd4hQS2bx-3vUFzYYbH->~dRxW_71IOYmt#|F^nsUFe(f(o==mW*
zDqI~;#emh!zji9Ubv%XX<W%>Qq3Odss0F8JUIsVy-J__<SJ)t=urqG}2s7G56!-xN
zpjb#H8pxBdesLh+T9cXiC)l`loIvfRqZ!FF*J#hce$8rI4Zdaqi!&=y`RK7=n^v<~
z?ijxInYWE(pGK9Uvk&%))tgyMRkrxlmtct>8Kk|tOvUV1zlm?vM$g-8G^>lSAj@AQ
zJB*d9E>;qz{COL1CtqyyIVO?)>uR`zMgubvfpzsmW0d76csF-J+JT6tnH9;!9w3}(
zbQXI+Z}ErO<a9?19q3z+TSvZb421C!!TDG@;BKa%8o`<Hwc63*>3F1+fn=qw>WAkF
z&Bu9spJ>MLF<e6>hLhkn#uQmtE(|o)v=P4_e?NyTKkoDKO0NB5`dKLHxx5vM3c`2o
zgMMpfHlZ#27R7$`!q)T~yHZc(VKRImol-E^U&G}a&CrE&Q}wbP@7^9MJj4|>y1{q8
z8Af0@bIHEs!V8<XQgwvy$*NfB8o#o+8$M`THdIY(^0Vj?DbL;6bF;~prrN!YEa|L#
z5u|l9Mi4jmeCEbnYu)um=P{jLSKmd6O>0er6MaiT0V$=}zDw|narLpJs$+KnYC)5Q
zXxZUa_MQN%M))~szDR}wL#*%QiI@VEy5=WAKxa;frx>~EvnjxKO;|(J)!`4I8XD=4
z2)JOAeB*kWb755#y{%qr+5>v?nf63<6j$Cg4bBxFtV<D>(<$7dD|>!JV(Eal@g|)y
zwCH!S0~iU~Q~>ok&Mc{8woixF(mg9l$gzi4(IB&=((8Qy-n9_?z!IY_DB$vxIqv8i
zFw@{SiQY*Y4WWXu%u-6SUseA>1<4Twi*>R8!W8Q?A;QIws3AlyW00&(8_wFBIhB@+
zYdP8QvHHFNG%<ajVuuYyyNpww#z#to(IOY>(IKbq7w>v|gSBADw2X{5zp`ktIlrUQ
z`50f>fpfIX@fpYn%w_smhXpDikrMP$<7n2(n>q~nr&Es=9Mgk&vaNM;Y;sGu+lBiw
z>vi=R=UcQ}8eTO*G90|lvjg<xidMD?0lReqv=7=4n<(*HV*yG`65{{cBw^!poGOtj
zgVzC0hP8^zYxG#b5BIp+MiggXGCT+I9GiUxAUqFERA=Z5l>Tr!^8{<;56$HPW6;uS
zoSn4by9|Lr2LAn*Et@~_cj%bk9ZtSG$X1a)Zu;9h_Q=2CdscKewE8mq&TQIC(=g+x
zac_FocmEWbM{T0}jFNYH(lL9GuXYcyf|QwcYD4?|XcZ5;tsgAOv^v|axo#%Of2V9n
zdQFV3%gqv9>j@4Uhw5jrS$2x;e+lND1S$sG$6M?ODmx9pPb^&HKd^sZ>U!tQGN!H+
z_(>Qw#PaLGnh?&aqwIQsiRG>RIc4%Hye2EpF$C=8Ql+|Ia_FLTva>TlMfyAMf#0q~
zxmB;!V>T7NOnFx<`2G!UsLJg~Dh1H+e4}DCI35j3*BnZL*TL1RTT6o7Dv^LU3F}t<
zc>7oi*tJxlk5B=lK-nQ4N7i`>r@Y*;(-iVUdN$wRrxidGO)W&0YCe`+rGPr9YC~uU
zp+BJ#F+W-IU{P{g>7QT=6r0u8o>3JDRkEL%1q!0sCp2g~F60*GhD^yVJ`^g5RS)|`
z$6BcKG^=+-x6wyS-o78s%JwLKOs0@EYJ!|KP?A}{E1~<o`lcMLbH$bnHVL1uDfuY8
zVAPQ5xLDhSH<!a<KMDXB>aCP^7b-AAZLxc{E)Rj?w>akw_Z9n-$0s~dRo)}%<Cdw6
zhxs`>v@`l%KH%Lt4mRYsC%$N{eQfK8)y>MwFMM%vw#v_Rn^!vDG<wl|3TeQJ(sEh$
ze*!nULOVXKxRVP@8t!>N9F*qgy}T;0w`m>P^&_+J$IaqbY4+!Y@5w>02r1SlzP}@_
zpAt~aE%MUSAAd9f@<(~|{2>QBqt5=pkdfWd^uc%I0EAQ*w)+s>sJzN_AQV~;93(G+
zyg1jF_*#>5V%<p8qJ2tSbwlPbGD2g&Y17o5Db=aMGNqQ3o{l-7cy9X*E!Zuw6;Le~
z7TNul+dQ}*J){E`yWbJ-Pg#EkDR_oe%<N}XV~Y%W`TFJvJP{oR`)`~E?DgB3bLAeR
z#49&Ef-6s!fsLE9EXg+EQrI0J77iBc6HJ_#T(7;@HuS~yFbpL)q42Px?ND$DYw-D8
zky5Pp5O>x4rU9nUlshv?;!Ka?^CE@S#rXxlUt!FaYlFgw!6qOpee6?uwaKDQEkd6j
z0E8QgRlij5rM~7`70~kdrZmAIZR}bGcpvy9Q2ra556ztmk8+GaBWD^Kh<|M=!gCYv
zzvR_@Oir`ZZYMmU^3gdpY@lRZoa7Ij52W>RIzD#CA2bH+&1gt31wCI|XiRa9i39L#
z=gp~bNfT_&AKz&eZu=5fBpgtHYvDFU?a&gF_$+d^PZNiJf?V1v6B>5kPHgNZG?ed6
zIFyyXOttZsBY$5h)<{f9eaCj3@Mklr)+BltB=&$6zAv}LOV*v{8NX||{QLQdvPJl)
z>_64oyq=Fed%3JV+DK&YRvw=l)s!Nwc&e~lh$|Z^)07feAhPr#cPRl{m1n@qY$j{o
zSg)8r2UC^f+A^n)Y4QfPH@N2_yCY-~l}~a5gUQD;ytfB<Ajgq??SlPfe51G4_!>5}
zlHN1_SeF{6g&-k_Z`862f3aLlQcCPZP&!wcZYb)XzUQApNAm+^IOMNrr@<{0zS1~X
zVy2L9Gw!l(5pGx9zKJbvxLAVM1m05b)qO`kf2OIb_$yyw>d(o;-<!z*G3tZ>(6dHl
zn(Qf4!<i1ZY?rT8AE}jvpwM}6Z<6m6=P-`umnwNFl3y4?D@=};xluxS$BT?*xyl|B
zd_(%r=1LROS94b5ibGOnl`UE={Ec%`x}QoJ4oLwQ-TQB3I~_8c?=JO&ac^y57<2iA
z*5dVg)sA~mv+)|LeHzds;K1(RpgWNuBcr1Fz3lO9=v9sqp&a=U4rb4=IBv8{6(u6l
z&p{Cb(6vb|vsCrPo4sd)+@6vD0s<s~7;|R!2%vIcXLT2xV)=4NJi!O_ZPAk!A9M3Y
zK4uycDcdL4zPEIpec=-+PrH^_aMm$fsy5gF+6;BapIro;PcgQZmZ(YisD&m19*Q$6
zI4GE<?WAWlK+9PRISozxq;z|bomL47a>Pj+-P=^uJb6tzoU2hE4K5`NLJjUC;a`t=
zmQ$HcV{fd)ycN4Rlp-}nQ>_eeb9wTQQvV>PvnY25{01ofBfNiq7?{mV4xnWHFVXAs
zX;_K(!Bjf-ZaUhDkSX$C9SV}b9wpa{N+Tp8kHQ-6JA1;Vnwh(xT6_M<hSzlLeC<VM
zO9Ku91kXqDRLtb#W3@=k4M6!5J#>>JbRnHCV}8hjc12d*<~CVsL9zh`I5VWpuE@iD
z9A6^PfH5Tp?Gs6V1XN#y==2K>2S;Q9s5ZfY|4b5iz)$VZ<{!Yp<7mq?6a%yN0g#Lr
z^+9fNDk6<_W^|<<-=~}BBq@aIQ!J`-hU<~v_iDg2$DV8Sl*r}}`If}yu?EzCmb}^L
zC{bw^FX(tuZpAPi@BI0GMslZCY{2fdWOFa-OKRUtM@+nBI0O0pQSM3l`xf@IQbp%n
zVtcrtDAnxT*cTrpXieA)f6QQx%=pJ(M(?A45%k#Zuqrb5d*(VIsA`QdaRKF*iveo@
z=HcW~%@3~iubzyBv$Ut+<VmIfD?gYVW_@)MefKzN<b7e&=hX%8&jYN-(<Q%K-VL=8
z|1?;S(B^|)6_&r(XE>AG1&N>A*RwH4%A_t_*-h|g0d+22xMRrLT`9wEhp^6c2@XP+
zKa3Kv^F+*ov1yAoXEv{8|Inn%@su@iXPXcSQ>}7O*3L*Odt=@bX6vFLP{Aep3-fk9
zk(d|*xjt0W@Gjvsp$E#IJi!Gjf~BhGd;|~o>pKvx8)gOX?GMx>OrZhS1a*vFF94Bp
z^2$0csVvxMf$K^Ta6B;}ei=gfXnNBg*}>@oAXMl04LZ~?r)fHM8v<s-Khxc=Pfk+6
zeVM^yEHA1*yBSb<>lC{YD(Li6LZp_b?>kW3a6o7+kDj?Ld4D?&dDst(LFta#$WgMD
z6_OVok-jg|8zHcgd|plTTob?E$&?p_cM>Yl)<+e`wZoPez(OPT2^T^%ihPP^$r&Ux
zZ2&oRIuH2|fl9k?m>aN<6}9*#mH`!twL?VK1HP%O9HyPC)}#9@N3e9r`;$pSy0VqA
zT3sv`E<RM-erXbJeKJcF$;nS<Q-=MZ7!v#_BeRB#q2Pl8hgNuj=b|Slcj?-^y_!Rl
zpFOZ&9|~6(zno+$B8BYzxl)-nkLCcKpuu?*$d-pvbdo7GuRtMztrB=q+W>LS6zl{e
z{Ye4{nmf7N+0=p{c2t5>(d6S_J9}n}MU>r!Yp>j2tq=kjw7pNRS`IEq7J-OYIfvgS
zb0`Y=ECzY1)XVZq9cC`I(Rbs=D|7D1vaiZ7(HGd(v=1jQ5iOMT@!+p`$n|}irQ&pd
zRo@}}Z*2;jPJqh44!$wB+o{Y@O8^jT*=*6TETv1bm_U4jT(lF>;P_k5ddB)-Lc74<
zrWN&jQ@v{GV{&B*(HV2<*UFl*<7~Jq(||$j1>`^#5~q#6>L}Unb-fw!{pu;(jgzXb
z4DO4XF9fRc*x~HF5>mHE*5WH{aZdyS;?42a&g6IMxBKM@KR;kE<Dl-)Hh%lUSM6&c
z+I-A=crJ0}_E+TWarJJB=ad)cZ7d!u%bQ!_)9##1lpcAZi7WO}v*uzZuTtT?eIBig
z=*sixzS(n=XDNIjj^A;Y=&ZwgI@^j}jVMz!j_v}>&kmXN86(<V@2^ih0WVw!<ZwYJ
zl$s+<zge;6F{wJex{J=>sk=?HK>8oKFS{%Y6Tp*YycLMSU``&0ii*h?dT>gyg^No4
zWzKN|Yn1#HA0{~ZP2HxOi7@D8+y<5sWjz^#6uxz$lg!k#AZmrYP{K!!^6)pO&T64l
z56skg#!we4JzaMYm$NEfwX1{+R((GYqro?Jse~EbS2+r%yiQeahdRTf5Q1z)7ma3y
zQ|%j4=g;++J`}I*6sA5yP%A0;Bf(7$<*=R>J68dY|7^}_zwmlwb6o-*x)T0@KnZEC
zKlwJ%4!KM#5??m9IY;aFvXLG)2io|4U(PKXGyUu&l28o+1LGkAy&;N8Ti0=}PlV#p
zAxUzZoKP9;NJXMrXFe(zf#ApO4Bo`0o6LWV4d(0>ZF)1>rGI2ZhiUuW*maQ*pZ6bV
z!(}02cB3e_uY?<C=o2C&`M5Me{8mzH8vKy7=(&H6NTI>@^vm)|jFC4O^Yh9{dNOIR
z!YNvW#!@DbFKFtW-kb5ueW2LUq1ZkcV5r@-Uz0@YF-*5%ZAcX6D9fjjnUpctG)-}(
z5?p(b@P0!zlc8d?5UAZ0_#kB=85dY#tF;DleDz%`5+~{KY-QlJUhP>frOiCN68=4I
zRfq+COMI@jgRXQ=a1-R^qq?sH6G;z|x0+p=D&>g$IxK2O!J-DOpDRJQ-HBh|A!V}i
zW8~I1!Ag#;d+gIr=Rb&v;M{Kq+{bU<0F=zX1~N1ckAQg1tDXKuKL*i5+Nq9se7gFw
z4GIxzVy&u1|9w8Jg=lC@cxQC>w_NHs&YIG0!@{|XU&C!y>+8rvmjHt+u?EL1-4e@T
zt5ybf+x}|KA)2!fk<4S6rM!+LX6_|bsX=BjH-b2ZUG^K8kwiVJT~~zt3VssT1O^eE
zZ#nhm(d<R}CoNRVJoIK9;n`GilAwy6V(i)$F|X^tW*m3tJEs_jEG?*8{Gmv0aW4Xz
zAGSXRH{#OQV@L!j@+vSCK5gIYF)UZp2Y!G<rs#R`tbOn=AvHe6q)P90AE&?J!%~`t
z#QU_uInPDX90U|kl|-To=y`E>s0=WZbf^=9WsX?aY-D?0gi_@a;~luB71PaVEaT^1
zcQJ^`niKw3af!NTfXZtX6?|!MVjyoJ?NI??!>;oWy;bY=qvh+<7_dzX#e`DABE=hS
zW_I;z8g>|(1L|lBOv*>&vQb>-{^Oq~p%dCo=dz}xu&%Y4E&23pEEs1qo<@9K*m+B4
zGefXwL5szw?PJ;sM|H3EFfs>xc=-hbA<09-@Q@?lO+!J2te1(*YlVrP{LV2eNxrp~
zE$ZkS7yIr<k-@F634|2dOzyqxq~X`HVg!+<*$OFN83|q})@wp>S~o@HU$HKy$YL3Y
zCP8ABn4;A8If8As|Jmgt<!h=A<Kz8QXRv^G^xO~buKdW~Z~I3fe%hW7rzn4D;?W(Y
zi0c?^xZK|VDuN`m!8tWtk7Cnbi()!`myTyqB-*XedLQc>yZ!t9Wz#rH-H27ua|sG`
zdn-DX;%o=?of$Hj{g=9cA{1x;YL5T3BF4pQ^txCa8<IvLk4<Vv8RAeTzu`&|Fw-S8
zs+5!|7TIJmi2LAZWGXm!5XmV`@HVK*5j!y>K^&HjJ45rfJ8pYnH$xOgYu`)v!Tybd
zC4+UV0>>epeHFpZ?b{WarEB|4sn9L*73OJ=D2B1`=Nc`BS!@R~r?zjF9l}cxe&Tas
zT7olr^p4-YXW^CO{j<T*J)RV*&18SdKxa^0gRd|S&tk0Ey?qXysIv$H^;l+$$;#i!
z6PQQRH<ybIfu#}odml*}Qs+9xv}cA=rG+BkdRI+dGj9&al1!SneN;^nhg~iF)+kxi
z`LjPzdG_BuRbR>lPXdiB)Y}oEA@8Us#z=QdDlj42I46XpBmsdKVjdfQS4Gyf&t>$%
zA&uRDR|<R~xo}E}f8xew89jHZo$d8QyRa$y@XjvJ<*FFvfJ|ni*C%tHphur2{?bqW
zcVqcv9f)&F1pu+#rb*B0o8PGj^UWMDk7dvMvyvLA?!>zUug;Jp?G}nL>@wLJ*bm&h
zRWA;FDUhx9ceO>oMEn50T_#dux2fFfT_1b*)?d#wqEs0VeI}Y*bYHD;B&lqy$OKsm
zk%&E2ZwdqPz6){7Jm9eDkEe2G*CwQ(i=z@=5Cl4C!P_Zl_z_=`>v86lptQf#Y*d~H
zE0i{1^fi8b`h($6Ecw>k_I0EWqgnBp`d0NfhL;!0*Ycl&Kz)!fBHG9eI*O<=dcd~x
z8AnQ8Z^3JaPpRt$U*BOEggg9>d?7~WZyf_uu?n?iW28v>ftvmoLKhZls$$~&j|Xzq
z(~9-#_bdjF(dYCApa&L{N<<`CF>kSN8J@hT3v2*+DI%nmo>B&c;5r-;{tvev8Un~s
zOau5?a=k^q1aj9M3>=*t*!#qr`oIRr``*9mUvv(hVUsSPtTz_O+bq5`X=;v%kAEU`
z5UYt^Xj{3YhHRJ>^81?wD_EGc_5^?6wkx~nkuoCY;+Pw-g}`Wh|8}#j*M3}o!gE-7
zLtsI%a_9#{`Tc%ZYy1iy!sxk4hE%BS1Rms`V-NR0wj^+~xnLMXd|Y4Jp*%TN%0(eL
zx0(@;UYqnUw(9DOZodDdHq*+?em|Pwn)TdE-s+<kiA{%#@kJ?by$#=PRK14h42ZhA
zw4R{4+!u95?zp6tDQ2sQmo5L`&5-$poRF@+8S%D6=js_-4OlG91^NAqWR7n9;mC>!
zvzj;4eD67^l2dJGw2`11*dTh&bE~h<I6jnaeEjBWscYCY0d*K1f*X2wus$@<Y~O(I
zzF(x<27Dv!na-b%4^;{Mew*QcVGD_^-&*pwpWTBh>?64>IelVpQq{`Tj#tcn#LU0!
zZ>qvix8LV8J$RGEJfH6`;V@HPVF6DRDwD3}+#Lu7x4N%lQkceW8+Q5UNt@mkPw5NE
zQ_nmU;OgSpuiIzOFY53=6nRS;?98O+>?{qC^BLcbWX93H(y|w;9Q$RpI2U)b8Q>;?
za5Xly-X(KePfBAvuzj%DZTkKBo?cJrf7tr#s4Bay4;ZE-rAxZIyBh?gyGu&Cl}#%k
zB}jJ(2-4l9bR(UDw19wgv)_gHdCq;l?|uIfhhu=7>zZq>8NUda-c42)ShY*<|H4si
zEiHP#jnq)7p6%|HA21~CZ$suN&Ln^C(KEwKzqv^hm`De8z_4G!wTpXyLQPh888!h$
z7goca#svPU#iWxb&PJE7?`kd&1f}j0HKy*KZf=k6>gVj$WUF}@SgHuCCLBG=Z5)J-
zj(Piog>k|p8VPgzWBItU<GmRt?=xrYq2l$?Hod~*Q7P~E=5Y~}V(hN?bod+J118DE
zF*L)urT7h42%Q0ExFel$elox$-cwOl?(rF~|7g6VzA$}`Zb!Dg4Xb<Uet(*qyRx6X
zKbPzzVbPzvESTd<Q4%%W06RJ}ljA|wu6T=9ztvKmm(y`7LZ%cRoPVI77hKhFzcV!0
zkP@KaCGFo!DLnCd1S!!$Sg%aR<o+a(c&xDZQ}apgRz^pPKE&hZ)z*&C=*Nt8$0dQK
z=GP_}Z!%Z^%5~t+(h7vt56*$<LA&s;;nJ>Ze$r9_$9c{MaN*&D&d3z3eJ(zWy#B3^
zQ^5fQq~;j+b4c5H*t6F)1W8B39d<rfX!~eYeD0U&oZtfb7QFYPX|7vG%w+(Txy!gV
zwJ)4<S>io<Bxkt9F?YF9?Xfe~yVf?JJ>}pt+b5MN%o1Rt)iN*uEjGR|7%Q;c7#}R$
zZ%H0jGVEZMFd{6;Ss~h2v7O1VgNAlbAW%^LvkGPvoKG><|HHX?4OApva?U}3t6d!U
zoL>CS%YyDdzrKyD^5$JUcr718E+$+9vVhz&CdX1#w%^I15peVEGD7YD{!P!>@4)7V
z-@p+1fC0Zkr!>LU3w~Qz>U-iR`j;G%W>1*2>2cRWlDsm3yv2F~hX|KM#ocE&roiT_
z-zno>76?Nc5KUq5Q6(rVocMHct#lYzr3swWZO4pH>YB|`##?Ngb8h3Ol7Y4t>zV=!
zVPFZ3N|jkep;s2mt?)vUtpS(%{epvgvASLn>QW-1ztBiZwVz2wvVn=OoxQx@)=<jP
zrlJ|fzJsnmwgVekogIxXd6!Y6+|A1ll;(&0in09)fqLA}pITll<z$cU>am;dwpevA
zZ={!~essED4A2=bP}ny<w^%YQ@o2u9ak)%T93Sjb1mCwPt7Qax<L<}ota&D9hB3Js
za9&wipV5aA)e^vB%f&pyWWL{haq4yAv~NkqaDchE`AvLD&Bfh6=_JVzcUPd|h3ZXu
z!&ZA`pLD#xF1Ha;Y^$^A8u=`#yZcjN7md5UooV*;%?cK+=ucjDLDN6<v>-*+@naJ=
zRHIrL?pjGoojHdmWvuGzglDi$)(L#*9rk^Z5ks^|^*ImI(LBKyfx%-_2s4djB4D-a
z^rOhXEw<rOYLNiql5r$#QsE$P0bhrF<bEuW>_hJRo2w(2z3crew}bk*=a*w}1n)HW
z>Gh1=<PN;n9=&1PDzC0aQ%>}stp9|96{4z7A-e0%Nn_w`<ART~J;}W%dwF+D^Q#}{
zQr~%F8k$#K#03X#)wOc+`SXOVgd5Xd7&TtfIoxFH3nZH}A<xD4*zJtk^Gu})>~KEK
zniq&}eo2N{Y$n3K;I}!Ha*5;Qec{VNWy*@CL9tilWwHigP`#~afdq}}b#^T5jpTam
z2}=B_uk=57|0v{*nIr6lnj(c;s#~6pyq`9aH}J?}0TYKbFjJE_3}v2^(ntM99L^e;
zm~4^>`|}st?Dy!UCdEsAtsU0kIN{o{n2z1DKQ-iu?;8hxG>-39x$QSD8(V06sUy~|
zTH#<3stK{CLX$<sJTtQ0`ds%KZz}A=<=C4J581i0JAL^YH{>lSS=sq7*6XtU3hnpG
zMCX$=6E2J1yT`c$pXv@bUC%=QJE~v|zsnzVy(Z``XuW#4?3Abhf`bnf3w3r=1E2yT
zO*;lDju@R|G|RaW4g1wuPXun9n}oRd11u089%C@ak?@lL={o&Z<tahq{xa5pGL+I8
z_3wF3WzvWHPRZU)dWs1cq#Td><1eY;;J(*b52N;9KiM7~iQYF}yKaN{fGMbz+4aP5
zFs8V^QWI^Nv9K^{Ejo4(P_|VKqZ@U8c1llq69R1otoGga=OYn+S_x-a^Nk8mekB*c
zIz3#zco~)eOX~lr-gE!OP+6&-EwZ2&0(sVfOQJe0HMZW6pb!7piD?l#IrckEZdFL9
z7LHwPt0fA*Bs2vfkDBf@mDeZ!Nty@uvlBH{j9U)KVbYEwEe&>>CmWqOik;YI0K=b#
z!)M6<qE!(^sAds}x9=Y}4fT)S!=0Uvyc`QyM&ms(=-nv|c=M5$z?ej%saU!H8qObk
zSensn`ZljNAN|TcsY3_sLM4l;SRdJxf7fxDl|RX%Ag7=X(IY|J7ZP{LCPwt<c#Djh
zJ|K2qCM8VD6Akn@s`-f|URjlMml<3Dlzr3_QDeo|lwki^=5f(=pUny(>UvM|#<lK!
zHH<dfd!v(&l<P6sT$@?7;Eyy@h_11INsXIc0U!1mn}%5@RV}tDEnS?aYylN=0Y#k0
z6&pb&)tu}}^q{SrH}h1SSC%5TVRLLZPUz4+SKEVLHg~cgH40<Tf*iY5q7KEapMee8
zOvI+bfCSfvLlM&8uK${dlE$ats#I-kO0?nqge$8BSB|Q;9s6vh*{TR2n<_Lec};%Y
zXzTvFoygdlgnjd@<NNL__~y*-FA=v-C&-$)zKV93oB_fD;00D#m~=gY5*=YvG+;`(
z&t$}1$k{hB$_{){E-95H5hiadm$imR31<UIW172u{d!dmsAzjo092Ux_?7Ti@})1Z
z-R^oaU$8TDt`>(zjWSRUBV;H&Ym>K?o+ydPB`1rkgvw2uI+UkIq=rx5ILm&bYEd>D
zzHF)Zd>5L0r713Rb8M=AdQ`YcJ7_{bfjua17kOvNMqzMWPMV3H#)R|w>2<N?una+T
z;%n)G8r_z4G3*akp$a{W>otdW+!dXfcT;emM*h?fQg3^FYU|Juq&D{W&xOZWz`>M$
z78aTr=W1?W`xo~7cueAskKM|kA3}PwC#vRg1H&vmdn57lsj}tN#IHBY58+1K*kuqX
zzpmR(=_O#uqq1ezR<T!kk5P-FJ;NIQ=j>rtSrTNlH?3K;xv!sgg|xzWu=4&HdjdPK
zGs+VzwW36MQ)Tht)&Z>#ekH=Cc`Ny<teZ<O7Oko(JEF7_WejNM2j5MZbO!ie0@L>&
z0Ne4VTYs{*1@irfJ^Ag6H`2DL@Re9pfP9$BEF7`Vq=fSVg{>S+2YRf^v?DkzyA4hZ
znU&ZNStArKX=~|5tk$(nHQ~lt;I_K)i3V=I8=R!x$`Ltfq)51QPr>(PcI{ej<3#;z
zeDD54FLUQ#;Qo`-ci)*9E+(wl`@vZQdu)VU;OGY_@Py^Bu^CN|13XE&wX`_b4}g2`
z?&;@u2M?%1nfq5j5EY+L&>wz;OQ$M4hWwLEh5X|=OZ^z@@Dz=rk$@cxxb(jS<x*4U
zT}pKK=N{38JgI@(bR9t|K*;6X_UcZj>ud#qll~|@@dh}6-5s)-wA3|Pbia>;={b#{
z!)3q}w0Ziz4rh?F_i0z`8_g)0tf$re@$o*N!^LpNl?Ru&5Q-Fg7_ogl$Js7NM5Vb_
zpQ&D2Ig8;9LHE{0!yIz|qE`U-(_bnV<@}&=72_Kci)1DZ_N&{Ag9Kzr2Y@03{EUHD
z`X9)Eq38xs1@nZ9{XfVH;DgcpXFIsVOz!jR6Un2AN!Vk?F@Sk@*Ucp?jCvgg_1)Om
z_yOR|uYozz3@)q!d&G;pw+VsVj6YzVSjL**7xe&j)C1>JxrAY++kH~^;`fJfhtBUb
zq5u3p{czG<zdm}TF=Tt^1rP4H{*gA$1T0=$(?k&@3{pmLqRmK!+-b#02;%Rz=Kq7n
z`R|tzVS0M{NU+YmRLvGGR+^1eFm8P6klqgRrQSH07Kv2&8(vC9MA6A(4_g@tiW!ot
zg+h-Q$FM`%j0t0qhBva~e{H&EjyIL9tu%l~_V0~VKoIo19h`6-j?PDdFenf8JzIZ_
zJs~v4ss!?M%;G~iAY1+)(BVIL2k?c<sLCPUg01!vczB#1zdZW+Ex7mL{x<3{ynz5h
z>8%?XE}G;P_m{wBeavN8Cm!gkW($hp_n<$xs+XY~B_~bQcdKiH9I-g$N;PJ<n(vk&
z@~Qv#R$`t+gxvC=fVaoOnG*Gca;(o@eFxl@$1EA(84&*aDgN_-xQvh;;<EsdQ5#xm
zP+JHznaCtW{Jt}yNrGBd8rTGjwU<`3l$=(7^e=Ng>(xnfpkO25>@ws(Sxs&BGFWrX
z+%V_pj|~*whCWBr_YPCnzlcr0h#S-ScWeA^KvW-Q9R}>p55)l2{P+?O@ijtHHlNu5
zNv$lIFpS>86`(S)aStSFbT$4zo);R}I!4=Wz?Dhs_kY+=1BBwz3KOpxonv8yTz9fW
ziJ7pNP@24Nbh8bvM<p*|^XlABs?(SLCaB<!^89uRN*v5NKwxTb*j)o=ALU%*L;f#6
zociqwWWj9yz56V`!Q#YPyBsanvvk~57}iH}Sgq4K`}v6)LJdInIRf@vQEQLR2NaB*
zHEs#b|NoECQuo`Um3|Rxm!S<3p*b92kC=Wt0wRGbhOKw={o?#~GR72&!qn-=TzdFu
zxGJ+z7x+LSCafg5HiY8bmoBbIMU)Urb$nM~XUV10ME9+5uh8Awrhh{%{BwB<5Xvbv
zFl*}o{wFId?Y<(Qf2zoC{`n3qGGG2<-zs32Gm^%fKGE;H8L<_|#WddFgU!oiwL>>T
zjQg{V`p7dDB|XoLA+RT+x>WvE@$VT1j6C2YCVTD+$WDTw7xRRDef4K;?<P+!%7+>@
z^mYdETwda4!nAVvo}B&~X<ulqiH1}ybmQCP$w=FKx1%YhC@UkGKP=HKlm@U&+qh4O
zz70W4x@m69<Pr*4fhkg0LG*J;AJ!u|9&tL9n*4`q6d=25T9Cu78sNz)^vgKpzrUzL
zs-lrC$of~^G0+V-WkIken>cvA;mF>meAyM{CC~m<HA`4WkaUN;YgmQ$`6KM6_tARP
z*mFY8;9dWY_+|6@UTG!!Bl~X|aHe~!B-48omsf9Q8zY<HdXo1mJH^TG71VcVzK{$d
z-Zug6Y*Z*>xWvH6>`}gnk^d$QkdFw$qtf+ZxW5=rh15r3(B=X;F>@*f3Q0pk^X}I`
z{7}%DX)N|t1!{jVI(z*#9GMbE70Cs2f_O;Ku=0Wq=kZ7=eypM$HHE`6wQ$Itu@0{h
z-%UfdVwtoM(Li;sdAleK_M0p8U9L>opK<%$9g$=g!L#W*mQXwOxX5*h2H32BwcA4@
zhj#c9r0*=kqRj^+dx0q3V@5p=eI{UTp_STf(XX<Ry(*Y90Bd$LnX*2NPD?uAcDd}K
z=C)v+V%@#sy%F8(HD{vtl;n|uO7(KZIJk{wxWQ=&wSTigav_%jt=^xqbC1x$<$uF^
zM6XKKAW<|Lm`bhy36%Bo#{nPTuu2BMj>Vh9WdmT{#a|WnzRJ``$E_i%%&C`1`n#WG
zzvGoden&#f#aqr9EF^-MI!2p~7ZGx`(&<c7yPuPNt+ujPsU(hGMQ)t!PMJ{~+u<{d
z(-X=wXMni(w;GV;3bUmDUQJ8tnGQdxrsy6u_h{?zTorBZw(iZ%0^g&|LlNjceuIM=
zA3o_yO_3FK065S8eDE<8Aiq=99mVyt6w@>n3>wr)g*_P!sjyvPU!QCazPvu!3f;Ja
zBXD#73OClgEzVef1~0V!NTH>>F?aT%SC<z~SCK@eIszIt=4;_*IL}jD3D80XWk^)Z
z1tIss|CCFA>%mVjN?ZDL0_-`FJ2`>kE5UemfW`U}=&<N`v%*ww57IZ3y+oE-tgE=C
z{yp?EM#FjJQWK4gX(Du$%^1#vnMLwqVfw0H*$7^-93w6hgN5*fzqb}h4_C^(;w*U2
zY$hC~o>;K&IzlqP&DNy`Avor`@Q;Q3f%%r^Q1eF%2@-<*>(2<_1^M=984{K(Hai{e
z5TgwI--95aE!)*KeN_cxb(CT@{YWs>yV`q*#AjK4G7mv)?tTHAW=_>2winjy*}Rq7
z`E>}hqK1H)a&L5+@Z<ka3}E{Z8oNpz0pCG40AmPBW;Y==39^6<=Tln=tB#Co@=fP1
z?RI=UhpkeP&fxr&-f23eB8XW)Drl9X{cQ5of4#Ykku5r$mxj==*gBSoe%NXXr+Iil
z>sHRhdwa={0=rlWQgvLM8QJXSwhh`rWQTWlNXLN#A_z<EzHjc(iB3vNEAog0E>y6B
zI-vJQAAcFJ!W=JEuq4mEoxBJftHb}-cP7?OyZw#}VhJ}8#WmmPV&(};P;p)bQ(z0g
z8h6o8DEmiX<6#NB=BvUy6AXX90?K39Oxg5kVzDO3T7(!54Cy~<qBhr_61}U-26VNn
zz%g{3V_X+4@kI7<nlSWXzWd6W!MM1^AaCyuRdT?{SAe>pZRO`!)3T_MV0D<aq0-zd
zemZmC%551+`Z!Zs=*K(5Gah9;Q%SBfCw!Kf#Kk7!3-qJx5^Oq8bPaVW<Q^uD0(?H*
zp)UqFwK<)CVOouslWiByqK|2@je<RqB@K~sW|$QEpP-vpD37nTVcOq%)ZmZG0_Jot
z>paP4g~wm!E6*rI^DkO^<<r7CIe1%T7;7(VMy1L3lO|=5^Y3jDhwp#ZDNuO&jEHEr
z@lSnUyp3!u6ZFWyL7M--f=Vmq!c=tFWCDl=BVHFJ|HOKCPz%Af5(;e#ao=+vZ9?AX
z9sKD!!mpX)Yd^kqq^kJvwhb5aBH)Tb)9TexwA-nL;OtaYxLKl8nqVXkZLVs(?&8BZ
z%KuaV9nRHHkK=ny2A({d2ReK%z~gHM3jA%^fWF>KK~|V%w5l{%lI_Q$dij-Y{HV>1
z9DrLT4}T&>hL?IPhnc-2(0>aQ8ocSVJvXv_^)J88;33h%PBxzCb0b&?UHJp2JKeSU
zKWgO&#~Dq?{Zcmtwu9*L20f@<xX-P>x@6NhC!t$Zc0SyAx3h7{ThTR34h_N|ww;bK
z2TEQ$X+6NL6$cl(6Q+fD15=qwy=zD6o-fXVr6cZkTKta!Cg+NGc0$Fhf<WkjL&e>!
z*Trg0C}2sLTFnl^!k)d>xTgR`YhYKz71H_WWvyfwqI0MFJn8MG@>Ws6f!CH40$sK|
zL237-%V5%8KDv^qmyZ;YLSsSEJ+cG8Qx|TSRU-M8@gJ(N^%PSrHGaoM-RtrTtNj#F
z!*!Bf+?2(_AvwrUTzvS_-sdiNdI~MN!~Y43ZVNY%+!RGd!CYbj+71ew-qpw2t!Vjc
z1#5fwQy%1}$1*$F5tc^X`Ln3etgl7{BV-|o4y;lYzO1`XAe4w9UaP7(f*kRDaVLyV
z<Gv&$?^Z>?l-U}wJiqYX5m^<I&emVu)^G9Lb;wxXd)=yr)c%Yq;whPd3bw_&P3bn8
z+0nFW_w|miq^F4X@X3k6<TA70+%b_3GV<?SIRjvvjs2{-xVYS~WvRMO1H+4G;4~uZ
z?ps?${}GOh5ehOjJYOfKx1+Jp6eKqFBRE)Y_BaMRq~wtOVL&ymdkN}9OOV9O@E<zO
z&-Z5bLDcXA>meN7?}ebKbpaT#&itKc%-~8Rz>FGZZ)HvAISebx_Cd7~ul@b39}IM!
z{UzHR2Ud8PH34GHdi}Wnp-1#w(7N(p){gHBCG~XHugIT|e!oE6)bVLi6`eDAV}id8
zgdV?4c3f{~lwLW5{?t25a48XOJjLuFGf8h~ZU{x&)ag^x7luhHm7$<Eg@6o1yOR$|
zakePK9?jfZM7SUK7Lr@7ngF4v)B#jrP=h(gw&oKV{!I<T0h$F*lgj}@VRNY~-thrD
zuLPeh%JSR8)=E93$>Ck{V>dAsk)+k_8B_RpdF$Y1W|_(S!=~qgyOvtb#lYxj+emm8
zv%%EK-{?n`aDjUvDcdyvWX<5Nr^&thkHXR#7-pKK6b01^qjueg8H&$dKmRFoZLkP_
z`|5j`g!dO~75V&4_S1g}8hZK(ZLXlf|4Y!oILfR<?OzPyE3>T0ZibxNbQl^B5i{&(
zmHE~@5LHB<(N{+Cm*?otIwB9BUO2{pP1H)UtMv^v<-%#zpk$VC^I+%fTdxp@<GV++
zyniK;+Ah)hcMGVVaKnd4s;@mW)z_0!<cXLupmjFN;O_E2qZX}IxcMaLD3m6gk@y;P
zmhfk$RCKydJ!f9|i$@dK6>PIB;~v1JeoDn@^K**njZ^4WnV{pU#V!2OcovIO4*<6O
z&6WD<jGd|BF7LL`EUbc!%*CvLHjLPaSQl~%T{N)F?q|f)Sxdzqz)_OWlb$9)3OcT=
z%&bDd<zKZFot49NZv6_>-ROH^!KMHyih|<)mpp@k1>~>9f%}fEp}>l_Wzx3T<ua~y
z2OwnSwf$__uPEK@68^ZZwX!(CR4M_Web62m(qR27JGc|gi<+-8*;gtzFW~1Cri+ro
zIEPB>XJ2mUWHZ5s_WG!!8s(&z`t;%Z8>#}dx`(J%Awh_Y^9+jJps+S7Yfmi4OsS;)
z=0-N_1ZAt$_9a{6GR{YN3jey6Y<PDpQ}#ZD3Mvu;Yt8-V#wmAqYW}hBD^Pwh{1kVi
z6!7Xg6@AlB_D0)D{$?KWSLKY>WVuJBwZ&Gl^CCA)1G$~0sEknI^|}wqoJEP*l4?0?
zi)!X1Y?20X<JnSj?Ow!5ozK?)4F(@aU)pYa)5T5ngTh;n<zW3uaM~E?8V-CuSNr9E
zoEUpY<tytTWGIrf&nk}0Y$DftyQX_E9N>MyZ4k#K!N`nSTftn)%|H6S>54m+!|iHu
zr=&1f&dyH3eR%I<S?~Ze^5qusFF?6Jw0(ICR~Gb#rVQ!BGY6s2NsWLjG9LX32{ppP
zr{gue+IUG0dEwk<OX=&r$GwDsLDmU>mJQ;PX0={IlCFR0v)uHiVV3%-EOSu=u@jsa
z6<vg3gq=4Hy~J!8d%F|%Sg$qwC=Ae~WUaufE_j~7fMI~U{s7X=n7xGk?GD_3K}S;G
z{P?gLtUgCfKPI4KC?^UlXHqMmHLibs3xAwe<wkY{n1J}bEF1&Q<8FvBRPSV}Lb7%x
zL+~gkkuz={cfoRBV~6SPvzcjYy^iPvRH>P^PI!@pBxzFu+}$atL+JGM8IQW%RT2xO
zTBvWr+hD(e4(B(Orgnv+=DYWF*T@Aj{>);{Z-(ApZN41C5kk(v@!8AWao?oG{=j&v
zy)C6kNxi2a0P7z0%oarpE2iwuhn|7vddG)2Y{-Y%Dyc4;wQ#C%(tD=Q{kjJD@+P3u
z+#8FRJ4m1n3TEB?kM3DF6~F|Fw!on6C%QSspT7sSKK|oQF|>ZfbZ@0E;Odp}%NYZY
z-E-6GTuT!Pxo~}W%1AtPgxuKK&-5`0LmGawd?`2wGfiVCbB&?6QK5cWo|v|*Cz6~)
zAxW9kYucL>EF!T+Iq{@l+x_Ll*v-j8ZS@m!m8qVjwq@%icUK{5R#^6*;0!9Tcb46<
zW0SiY$u<l0UIRkE7&?(OWKAf0=chO%p|y^if*(`$!EJ<4c~WgG)_wC3E&K|%V&kUN
zzVcD1yR_f;@-W)=A`<2}(Tci0tM8)o`~PTP(+P<_%x-cjBW$FgEC1>1?~jTm5g-8m
zavAMc?~*}{_*9x?AB%``B*?;Gbik<xR{-}-S%f+I^W^7+@Ywp4&I3M?7|6`Yp1f07
zyM-~Sk50C#r~<eO!&xVVnNu}yujCfYrEE&n{a<Dwov7fZ$@dT&?7~i)kdRdo6uSd`
za#0hwjIx0NcbuTA^O!en`8R9@$=NqErJJOPgU<XDYNiGO>7#zdIYU4le|GTS;txy>
z*>%hGxd!cH!s)@dDbgYB4ufP4KOeD_u#a0sBb$NCSyM?g*)z}9>iT)c0jwI~dDGA9
zot(}Aee#krtmC%o<O!B^6J@Epg=FImD3X$UtQ=j=fJD4evb(IOMY|lr+ba6yH}KF6
z3h32hJfpUL&4;q>Sc*v{HdyrTmoaqmp}f9BDXh<=?$&-9zJO6Wj&||eK-v_TUWN9q
zq<vk`NV4lZJfL-?LZd~HPR95d$%?^DlSetk==>`@h~>j6%9!9g63WP?x8Zrzdm~@+
z87qRqN4^B*A-`iq9bm>V4`L-ow~_KhE;zb;P|GPgdA+sL(kPM@`~LF!URCeMo|dfy
zuyQ?}KII=&0~wriFo8z3T+S64Klf`Ng8$F*W2Q!jMQ_bNQiHZdS+8FNIQdsNEY)*)
z9+nx@rZ>p<_=hC)A@`xm$T;+OK#KxJBfTZ1U{Dd@-bzw(Zd2}RW<udY2B|nIm60`I
z-~b_l%`6=B%fp^^DUO@3qrU!v@9NUZxtZ1$;Ev!k#L}=lTyEY)PJ@fbw!&V|W2@6j
zCStOB`8zJ;WLeR_K(*Ssj*|O*{|z;%M#?l3s%Yx_lHr_iK2}c!reeKw3bX8kq1k>B
zVrym7HciX|x{9sd67B4QPOZRQZK!2dVhz_;6u*4ibnv180_}23?Be6c#6tf2X|cZK
zhQg_f&-I-G?Hos48B_~P(#de1E$vpNaur9WahUQf9My*`{*KY{$d)SpCCAzyTW0cV
z^lQ_zg6T=#O4PAr*Y7GiW&W@>W$q?axQZV4XY9udBX6yvz&V~&nzrAp<ROB7{60|`
zPT{h|@d<XIJ2_g>>pFJk6E+I|0s5BrsX{MD4QUHIIy!{BU^}+hTnwZFH25_FWGPSR
zW5Q*u^@gOqC_g@dBf<HA+3^vUDQlv$+{7b2TtYA)_a?a3tEI0i6phdmje?qN-!C?Z
z`|TGh9QAsruZQ_Z0vvU$pnrbb4@{eciMkCsCLLIdJ<)`p32<9Vo^FE09dQD^%KBE-
zBgmi$k3(o5)-f@^Czv?`D*UQ0R|Qg>tw8sF^m>A}OF2uJk8FR$zFe)B3=^BGg=wOW
z=QFRNdRwH7O^5L3uzeb?6a*$je1^SRJvd}q;-FoQ0ls#eF=R8R!V30d9%3gY`rcPs
z)Hkt+F63od*W5{v#*5jQf_g5Q^QB_+av(<=-iZ#oM}*HZl-V$FC7mJt!`}a*^51ub
zEV>;#?XJ$;SU;4!@)o2hQy_BVGmvhhD?)JsYej!i_W5CBP&{bV>n;+3`ZHRkx5jkF
zC^HZs@7ME=M#YxzNqx?5Ipf|FPi0rr-61FTS|Cu%idiYv9UZH9>rLma2~X)J?Ih+V
zMI5}lU%gc!@Fbw4!(utI(S=jAu*3-WP~)X$V}!AuoCzm_EkVLAV&rg{R4I{2jww9R
zd5V+22-i!GO-0G;idle2N=r?+g5{2D(=WKqkGH@6Rvt&EHso`c9)0EDZ@rt&MUk-^
z*V<?Ai9`mZYi&mDuf#WQCDa4YtP13VrFH*(ZNFG>m|%{dz~jo2nu$8r4AQf87K?&H
zp6b%2x|d)#y#3(oFSz&O)}0;v2UJqwg0PgDK@%~UwT7C>#Y4Z~!ih;DVPu76?c;nt
zge|rp)9=HBvTGw&(CXpoJ6U{9Yho0;=OHYCE&|lpc3l!ZpVrdt;)~e^1a!Ux$PZ6v
z>}hO|%HG9AVso?}OmawL?b_)Pyx4ig?Bs;}g(9KowZHO#q0J;eUI9HK$^kgj+9gHk
ziqik2g1=|%Yd(p;zyH=Xn43>w^Eq^`i8?Pg$$lTOip8NWfT^s3&lJXTc*=(Ts;+nx
zQH11&Ahtba2Y9bH*?EWr+lPy(bI*l__)M|GfALhy%BvylUG(BaNuCPE6>~FnpaF7=
z8j%b>ZAJ&N^gIN_aC~u&DY7Kidwr2YM-<Girw(}Rff1xzQ{2*WvDy;U3XlY|#2n?=
zIK%;oFW0%Ra!^#fqU^PtfuYabMg{0;1@u?UTp*CrAD0~<clR@x0=2@U)<0cnm?F2o
zYj=d{D48S%9hdTD)@eC)siu5(kq&U5kQe(JtiGz}*==-P>*@mvW>G{uHoT8ZoC>G;
zJ6_wdOoI|6yYh+4!1V%-AuChW@%+3%1X#v@9#HB#yr8oTLT=NSsa4hx1=G|as3n{u
zC=koR5TCkeNNEkrcmC}JQV*$036+<(hj2S{w|0^g<qy~BQHYc*_Ovj}ad@J%sQbyj
zj)SbQ`m+?1*9K{(6^aJi&Ex*gs5w<`nF$hc@}i4dDs#{C!f9e{<BUtzBvIexs;j7F
z8LE?&tl?rD`%s4{2qfZ1s!<0VlbpJA#0YO0nKjn)^vap+H!7&v%gp>yK!WV}WL;Oj
z-c`@`^TpS$px*m{h(}OBt;Vcj<d70@((hkjc3`ZYrl-j4<)pHGT0&pp)BMKddj*AL
z73_>3>>}y;9*X{6>0awWxJ<XoN2G(GlMpQWlbn&-diX7Vp!&KwtJnPG-vs@0A`}Sm
z7Htq1ImXShJC)b)@>n}$V1-P2@%I2i|CHxgIs?hH<er4PxMSM%U_pW=pTf42tSFeI
zf3aBBPFb<3ZT^Vo{>SB#pK6oQuZT7=!1kTu;_~=renotXF8zH=&e;ntr0}YcL2_-8
zk$TEuAf<dP&rBhQ87oBD#dvb#%FmEIB)>hIxT*|i5An(~rGzGiAwNmPzm7uz#_OAk
z+Yt|^5>St!%7F9Il$lV6-84t1Z8Y}`myT;ffd#9CDSG8p*RCeFjg_$4*QaLS3K`7;
z5VXM*#{=ugMH$Mf>aWE~Nrijv6w3ZGdlF}QF|++tr+7`kR~>K8)c0Vh<&Rv9tOmN4
zxnQ2t92E9mv+$boH&dG2f9^2z?yvr9@y6muwJ7U?zIMbeJGdiG_8b8jqp4h$QD9Z?
zWJl7kMX!=xm(>1@3W>LSS=pnOklpyISl4{I%5kAaH!!dh*^rIpViuG*t3$Xuo8HIe
z!A>^}fvra!zQPixBRobfzDrA*`kB7-N{&SAhrjYaI*;Z^NL=eYyF=s%ydIw7o7|~1
z0~>^`d*jPp8dD1Km`bdHq7z@BRh0sz$q@kPyVw);X9W>Wizb(so^Sz)ug4T6EUwyM
zO!U$f%sAFOC?GUq%x@0q{DzuQA1d81&dWth9B0TAowq`pv?*Fl%hm4wNc0Aq<;>ZO
z9!MHYA>z|pZwv?jX(E&tyrW;8X}Zc$<LR8icn^P~IU0PULUsaYxX|Z1bMZp3qf%!n
z|L*FfV8q{7J7bM_>=N^?jwSHhoPd*p+wJ}gXL!!pcM1R2i~EsV9T6>Gd%eyO4HXgV
zPomf2rEPGFp7ou#4Jyybdn%!~uPOc(4(31J3gIo`kt7@f-FqXJzXw^h>at(vx0w6v
zHhA|xK)!3NJ}n21pdZ+76u0RY5ihr2%QpDo&I%bE)kW`$`!Xc$X4Lb4HiDGnNx1js
z!pKrw4lNwH33l}^(BFoD^-6$GBkzX1-8Vb32AtP9lMysxj~LmK8ImjR66MBW4!7tO
zt#qc0tk;WnxJC~1yeT^F4b@Nyuedv)k>x|Z-&;oFAz|S*vOm~F1<_1vWVTll%PYg(
zQt`^=`yIv6;r+PAJnFQcDd9mxL_BmZN78TVY&btE_iwM8Eh|NWBOxv4n<XQ5ZrdBS
zj5^xs2y__}#~d4Ds9DvTJJjIM5ce0xalma3b4%*T>Hjc&xy4(U=5XT~ojdNL9gac%
z&y!-6Hft+5y?Y|(1Cc@`*wu6F>N+v4u~JNzRZZtD2GTD>+u(Fh*m6iH|4x6i?A9;R
zuo`gNi2qh2R9R@SEv^FMp_>(S&6p_Y`Xxyr3xO{7waw=O@eP&WW25b^JFx=T&oTD;
znwM)2_BU;C1AqoCz6s45;T}|Lh2lOJp(`*|5!7IR+~ElKYa6tlHON%1mHt-9*(*&D
z;<&@1*!@&dvSp}(2Bm>!Rorr3o3zgsqYtQwXsI0ReeGxX&Tq9>mQHx+QUoXSteem4
zx!_FG{-oKtjIf59G<jyrvBi11UQ*Gbug(+Xs}Ak<6{f6%J^ap@n$p6-Mw;&xCTKI_
z%S_`3>j%jU#jMy80c|gmhE@pd!wOVvke8U={gdpT2|WOxa`TIVXHj1>hYK^D4gZ#>
z-!UYv2h}kAca_Y1wpJf58fPv>^qt1rW-ekR%#U*68;Zp^ExJNxMr~^A!PNu1giJB-
zKFnrxF}5t7ww>uQM)b!59Tg7USu;PqTV7go{F`;H8G0Hm5`j%Khojp|;nFIv$yGyr
z50TH1-O0~tfoo`H-j=FLMfHruHU%`tod6U2!*;pJO@giE>pFBVOyX`$;KtMA$LID4
zYUDYtgsqWlZ)!A~x9oLS**};b1?p}FA7y)w()b*7m274O4T<X13DyN5vTMk4SmFpL
zHgm@04im)MP^SIReB~;j5!adC0?a?#zjcXLRaPDe^&$p+-l>tn5ZZ(=N?Ft8QhDJc
zJHFy{wlgbww!EZxpLL9KYW(FacedMyY)>NfzD6wj{rRY8Wwc^FJ=9UTdF~MMBJyjW
zV&62-49A>r8X`6a1WPy>>jN-cvh-8&m$EG5feP5%D*RhxX)nyRDIDX_iBw;3Pn{u9
zdZ_qv{jOD6E^ODoT)4mMbg3QX-$#S{-iM?HQ^K>02Le0)iGq0QZ8xg{!wGibH}C69
zo56o>tul)LT<jlp=NGp=T|7XxKt8~ju&sCE#9R)9-p@bjuD%w9k?PH+gU1SPvJE49
z{p>4il0fy7I-&B>vt%AE>rRbK#qHXwXah3-+1lL<gb`J@yHS?_j|!*o&N{7hC!PnB
z<m~ZqT6j?+g-z-)s&QA0h0PFL)u7FjA9*6|Rc8-03@ZimM*)|ug-&C*x->=kv`-}A
z))!?k#in~`)wvX4ZY;=Pf0fmarF;FZ?q}~GSp-!}LSAK(6gAwYyJBRII40@mA;*}?
zuNVT28O;x*tY&m3Hiy2+VXaz}&IgA3v$27W(Kn2xr??)1BzTW`=~%_ZXG(0L%|OYC
zE`jqM@)={;%w@-G!K!DDjrM_lLh`G(2Gy`@iczF95>I82C0{#A&!-7_*vJ&NJsWRW
zv@b1~Jl&CiLLfzglrRPoE4_CGIXpHa3Qn0F5+KIkDpNWN#ao{gap{H(C4S+00cTI}
zpFYkKIo-3lk^?983zwqRJLIS()6L2A&q^tU8wH99lgB_Zhw(RE>)&hylY2L%n57uY
zt@Gaw5d1sMlaZ)V{-v^m_a^`(`9h8)5dyP^XAoWJN-~LB`f1gmJnvf{-&jK6Z~um6
z?J!_$8_~D^ZF*G9%g&iUqjha{GQR5@HvN8;@V2++O?Zlmzf9l+$?M=NniI^+d_=hG
zu-|cq$`6X!iUL+Jq@7M464$k!W93nsCPzMVsM@lEVcMJyvt`<dA)|c5^3*S|I|n4p
zfhR!ftJ|RF>uqtJr}04-qla79i+(Kqm$z5M&c{A8B|2dSH{u4OaGMlWgY+3A8>z#B
z^>LI?(Hq#~e$s;rO%Fc=72h8MA^~PY(9v^366D_p-!IhXC;9qVkV8!GkxnpIsGzR#
z{k7RDCu_E)<qa<^ex+YTQDW!OKleL>wAp%<txrfk!2Y+hw^>t^RK|gDZI+^&Y@lKJ
zLYzemZkJXcbP@Q)>v)Rs!IRv_P4$Ooj2$e?6}Uf-)N9L|2aB+lbUU<vy6wO3AQvOe
zi_7Yim}k{dd*^)E9X(;x?nmEt9nC`>I*EIn@+-&|MK~Md@~criYIKs{nd9kvQQpqX
z_MD(`FsWUS!4r9*L*6wezi#*9lUTl9jS^ImA&XbX4$&Y>06WRuN0G&MG2#lI=_~(f
zf&pcmPnjS6oE-IJ&>{X?#{9J*kt7RxlLLOcN!nC}qa!K_iYm@Pw!oFlw4^nSUK#{s
zQy1@Ul7K#;9(n~yYO}K!g~%Vo^xLJCgRiDmds(2J-|k$hDp%UlL>FoObE;7jj6Y}@
z24;XjUR?e3G5>DL;cC>zV+?fGnoBk=;kW*Q<EWD44xw2QNtO*R{}%ny+1_-;lgYjt
zUK}a$Z{=$6GpgddoT9B~FY?J88)_$FP?5eOJo6$B$(5w6>UfmRiI!{UeK1FT^kM4-
z!tPN;;^)P?i)psm2BZO3YyVdc{*CMX$RYU%yLL_451<jDwf3l}C32QebbDWBt2-+&
zjJ^l9I899WXe0X8)@b6XvJ>=i8r;VW&7j}qTfpl)XjrOXwKqRLxOnUzBAtc=$iaAk
zzJOF)7~HNM9gk9Ng{8{DcyBpZbvzl!6I1ydW=Ufhp|Q@Sc8H8#SOSrhSjh$JZ%;mM
z)oQDj(7+fhR8UqfaP+(@ARi~L8HqsAgsl<HOFo%e+YGL$X&PhT;&uWQEe?JxcT*}a
zHZ$PbyLGxVzM8`uZk{v~O$p1lEG7j<yrE9E=oZ;b5-Am$V+w0`Fo`Y&H?$=5c^yN(
zIE*V<Aug%|V|tux$J)UQ9ox61mj`mPxjBv-NQpPGO7$!P!60R<x-Esb;%^vIVm-5r
ztvh(MeWj28aQB>f(v&?xl=UJb&aEEB67rG$JuZW)<3dm6JgC^gjS|YFRag*x0mc#Y
z-_5_lGT=~eXfQtfPh6YxR{Naq)zM$ibw1QD>)Yh}0FVTH?CUFl0e&M;Gsu?cib&~f
z)tmf&Kw7Ta#vjkTVH@~Ls02_>xYqe<%qo-!mBmTteXCS{HCQ+HDD*Y{XfcZKg^<nw
z%7FXi3X+Ayuw2<^7b0>P8uEKWzQ3#G(<;FN#-2YztsVMs>yn&@wPt;uS!bY@=9)bU
zM;D8f_T=XHW1z9a1DfX3t-i24Kh8+%0T30F#9Yw#R-4Mv==%P@`9Xd?jl}*s<VL}=
zbV&jFR*D+o*uC#tpmQH*n#E3D@udI}fL4A-buIbFz+!EZ-jI~dOkk;{??*qW$4HH_
zE>p0syvp!p5MD$9%;r+8crF{9B~CLtZe0JeLb&L%Z%6%oXDwf~b+6Am7mqsmn{e^p
zV+EbO9s0K_{uvJ?0UeGD<~7_F?s6O@W{@^ziYN|Xvt(yEzbD#P*ipTeY?K!{qqzz+
zW+;e;{i%^9|4IFQ)GwCG{K{j~)@AgUuIY+;Q^@%3dQ3eW0MA7ECjBCw3?VoAsbhmJ
zWEH$O@1CmLLlWg<!T%fnfjIcc#hWpzs|#a4FKm6B(s}n8jG^Q-8_a7V03r&n*@2bz
zyoXZ!oosu<GhSTXir{T@FB1oA9^=n&u}CDVJho%X^i@~UEqwrVm$7|FCg8lxo;B&T
zyEJpy8gZ^GauN4Yd4vfZAJ}37{4~j_mo%%uLk@*gK`!F!#&pPJoM4+YCMr3m*qJ(R
zt)!7ty$<e_U1G-P%4B3tPR^=#G!IM^LwIm;p;I-S8OfN~)`*9ojCmMLU@+4xgD>+_
z72PdJ5I;?yYoqUV@bZiAz0X&DpyDY5j=qtg{yBPgou~Q$sD%L+vqmoWZZ&m}Pf|B=
zI?vIh-ue<<odXPKRh+&pV)qx$5cTAE2GSeV6;veZ1c}-yZPrl2Io-XoN+Ncld&}W4
zXKfMH5LibhF@PCr*2K^Kg7KEup9^=(a2A^J0EPH5k762%sBO?%7M`yrfxscVy>DH;
zKO6)S!gua?9jEtf3V~Qrzeql?e9&P`jtH{4w}6?cNL;f31GRPhtpM}t=Ul(JJyvTu
z5826KLr|*z8T?sdK;UNoIJzmy!7<p1AY5o>nMU#hF)Hf+d5Ql713w;RmSe+$O*vb`
zJaxIH^g7JqtM@-AG0Ob6qpvozBn$~ddp<$8_%sJ((6v1&H*=l44Vg$*VxtP~c$^k_
z!zD&DD>C*b+jk2y4pHqCc4;V5v9t`WRKo<-Io`Qy%3Bq~)l-f{xVdnBxk)hAh5KY2
z58=fVbzdZjHIdb?KFOS<yTeb#7?M!Jl@1xiri0*ZakTu(YX(TBTQ{yR?`u@&-TKMY
zHj#_%_RAYP?jCt1xQ~aeQfsye{M}`>j+ZR(_MoxT6AXV&!Ecfwp#LDgBJ(}A|0dFL
zNaebkGvo1n*^Cvc<*X#`(lANjJIoG!hU2~JUc|t_FZNsES)j?t@X2Ua8f9}pUq|$?
zO<!t6_LO7qez3T5u}TTpc~Hyh!tjGs9|}HZCoR$Dfl^ug{TTPQE>f}(l0H`Cs1G{5
zl#p^#G^#qO<=_F!-4}LMZnX}=Wl)tkB2H{*Nx(CgXADFf*7h3r)H{tvyjP!=cL;-r
zlu}K6A+K}ReGbv?dl8>A!u+SPiBjP3Zc80-j7nYSck3bNGt2$D_k4`My@_*e<4I#m
zgwg*NVt-%c2l|_vo5;rp5>fXS4y%e!Db0)+ptiX}qU*c|`*>}>&ZqXVMo$~I5phaU
zDB)BLNEmklSb$K~C-wwkY3j*v7%PY3M&(q_PwYQZE8hhrXbW))^m>I08R&#JAr{Oh
zC^B?w!1%-@1{AQ$rc+g8@jJ9+s^y4_UH2!ZIPFCt&m=t!GDO~m0>#?pOkpp3mJGNA
zRP__fV?H()21Bl~1FFH{)~)fOU+1=&ZheZNf}ck{xwr$>>q;1y`i=IajmGg6DyL0)
zhQw4{SGlLx_7WJq@?W}jVKeI>rK24}IniO}sb>hss0+P4>Xf(+Wwbe9&YG%FPhqa9
z!DH5Hj}2l)XYBRMRT27~{bOx=hvl_jYiMKJe0ZE9X~DI#M~>-g37Y}e`xBA2fk>`q
z)y|iP!3XOuwm0MVE;%n_VW!bb!de>8+_qmu?F8G~Qvcqpmfz`B_&K>E3^b!M>bfQF
zch%^m<nMF*$!<_X_~Qt8J~7l=?rU8dQe^yK6BjUTsM+nb0uqA9kFvdUP7Mp&on@WB
z?E~12K+8^|CUJk(>Jg~WNJuvQk-K>3F0XZca&7y94?6xM)?V@x%wv!AR??g`uTJmj
zbyx&7hm+}|u6y%4#|CK(I0I*a|JUiA6}eJ(1AP{YIz#_m%GY#jolol^XQ>oCHL)er
z&VXK3#`Ee^Bt`au<~TjZK!XOhR=}}jiI_QKZx<+`4Np$+_qj0Ho0A-P)YLo;NqbJ8
zQegQ2lfcVQ)$(&p<Omc^oG`oF9yzzmcmuKq#f(l5GUkK3EW`9HK2NDemBB0`xvmz>
zLY`oihrf6ssrrPmIC>e#sa29l1l;XM`mi>7wr~6l#>~C|HgxwMgq>R17j;GLNq71k
zoV`gy?4{?4Lt+bbe00SZ)3BXoE=IR@s=%|c_*3o!4RzXp+zH3aq>+FFP(aB&n4~8w
zJ+X9(;!k#QnC|%~{M4SIi13G^X;?-pFRrN%To0;;SX%W^z-kVD__oOTr-wXwS2ZpL
zE9v?zC!zNHULR?C)zNXc3%v(_@0h?hJDs!-3UTr~7`6l^=1!Ys0Jn5d2mB_B@PlQG
zgh{hd!d?U$cPqw~&pdbcKbw0}wp4C%cndnp(*)Zb{|m3jU^r?6zB+-9{(tJw*qhAR
zd!+9qpTd36T3lKaa3a^KZ1HaR@p@_SdS#m7BvlXRLH(9nLgL+B!c_goXqwe>MoTYh
zsJg`2Thr0<b3(D{iC6#L(Re3l>_ri7ht@=I9f`X)XG2suYLzb<=3hp6{xjwHCl-EU
zBOQ4)pu~z#n)94}L!w~qV;+FdaBrAMJ^33<K}a^GzrWw?n?Vhg!E<G*aJ?T7eDKgr
zk5y!zHdGfPG}zFo^ucHTg<f=)@RbPxLwnL|l)r!2YuquNr5I{epRtMggfzfXHw^vc
z2nguZBTz=!o(OatM>m7fV<<e)7ioRFM+3LPvqYx?HTL%rCO{RIox-!Gu+)`m8;gF2
zy77<1&@e8<vAt0jr6+rk<qwjg%}^rK7bJYmbt;Y?i}T|ZcEz@($%`|v%^Q~<N(aN4
zIo(QAf5;DXMh0s*Rq7W8Z7RJEbMZIhKtoAO{IC-mfUI4AdvVp+Ff|X<dT}iVwpCDB
z;)1lFZ*r7o6`W9`rv`VE5^X1QwuYc$S@08QPgOs+D9nlspnoHoy3qKGES8otZ2DJx
z<AXBmJ5moB`m^6l-#BOsc%t}ZiSN#LnlLyJRXDtKdfbL2$nSeO2Z-BaO_`6qXjIP$
z@p0nM@9FPX({AB*@4);(uuMNgffqp+N)fPfnteGw+o{`jx5d%fzg+^Y{L-HYRN|b?
z`jQ-pD?V{Ox5J`h+;MobSNg2%<8@l>%qqKiD~7>Q5x^sMlUYk0Ai~CWa0lF71ug-L
z9`=s=izO&}=WKvclCRe7bJ&5Km7$iW`V^@JXKZE|E*wnZ^|Dt>7GY$njLhefhK}qK
zbNzY|X8u917tNkx-Y&L>fd=-!ooHb!gHI@ZHdc_g9hY9fsChzvvL4L3b;G+jJ8i^&
zw+H4~UvEhfh{CzSe1h?DFi5aHbp*ZbggUgY@#+TEz|&GLjVM8=T{h#QO_z*WAHVa@
zJR<$qr_p6FJ>=!&K5QdK7KUi20;bJjDh|p)QfF~+3f0fW3eUpwqV%xe{rTj<-}bps
zOXvHyvN5Kj%$mt;t$NzrA8%Ig7aa5Q+2K*bo0=$iUP3&?dc%mngVeQHyB<{qim*d^
zYtpW-QX^7NLTc6msS&GZ(c+M5^$NZXl_$Ged3<>CAYetLAj{3=32;Yk4P$31y>1^r
zTS5st{)Aq}cjVmvwpBqk)D5Gkh$7VN7U;Ylg~Vb2*Bt50;=2?!quESeyLbjTKCT0u
zvmh|qU`>jv|Ma}0h)Ty#en4Ta-5rOPa(0vpyAj~7B1befEolN@m3qBl_f4WB<AO|^
zJ*5a+y1#9zTD*R%U0r$mL(NZzI)a9Z%yfDKe*4nNsp8f>021c==BUsRL5QgoDdG%H
zd}dAj<nHau*s^If<PGH+h9Tv%z&(}}6P^S(J4=SyCkWR&N6?2O2}dXXr1tuaZSmXR
z9uR?(^z*fp336FH52w#ti^#iadSxo%3yrVx@2onhSY~hreueQ9Wcr+r3UtbDpx^(f
zm+M14(NTg~v`SDZ{L*egJPxhQSWHpSg|vOn%n)MT@|xc;LOckLF3BE!h{pSG$ZS*k
z)~+Bt!)cuFeGVH=NDN(PnpZNownlev{il5V8#emTpgTB}=OGlx+*sD+2L;boj7lLp
z$P<Gr22qdosAz-vc!+yBHwz5it6<_<!_>}6uW3VsqLYN_cO@3S31SzScDdAbQ>r3K
z6pD+&cDU5&e`K+J**{5li|G;YRjFLIQ;p`bTV|Z7D9BQ8z2YI^#*$4@5%^Kp`HcQ|
zwh7gJtg6}t(`>BT3!ETQTH=b2fQ71RG7lU!jDjXHAozB#K*F(ZGIFf$brAW1cD?gh
zMM{7Ul^>0}xMX5=^&?S5Vd(Lxvuq?tU+13_BWAdqkv}1>f2<FtX1V5t{t1&{Ekld)
zb$r<De#QKhkRE{sPn~giy3h*oX;lEmRW1RJV%*$Nd!#mf8l+b1&ao(&htxID?&U~A
z6svzF<05Vpr6K9zWN6OXmrB~M&>F2WDhj4U)$24(Z3Xh|s<<S-#k8PzuAUt<uNiah
zd(9uhg8fIy3SG4&I<jLV9=ws2@3Y{7?rH%%GpENJ#sa<HE5In7opH~NQkH8mf+tD`
zr-w8GEy3mhnd?53C1*Bwp{x>5EZ(+ICF6C8^Qapp(P`Q0Ogc>Mu@(2_05AEbh(c8C
zx+Cj;!G+f)$;ux@g#eiWS8B7x)U$_|RtSP`+bDi<TwMsJhvZWJUsb9#ut}i;s1`7Z
z9j*(OAH}?@dn?@Ir|TWqObOybw&Vy}2jsGOYvxJ+Gb(ueat<HP@#Q82b&NP1E2Nl*
zpSr*gZ@UYG&Clw$;0MjpLkP@=-rE+;ifBYiEs&mI#G-J{N-TtoW%LemTq=YHLyzCm
zO0EUdFiTShNR~+{hTW=92T|so&nPC)yS*|Lw#N_R2Mfc;2+2;sjZ=18qkK?68F-j^
zoIq^jb%!L4RxGOtC+QaB$JyLndBP6`@tL(Y@{4Cgl~t((BFls#!&2k<0VTD}m(~xz
zRWI2M>wf)Y5ZhI}Y&kg#A=ZuzFePkET4I-@U#LS=Nu@hANxjQMm;4#0$gx+<UWS58
zKLXB%ms6Z=s(daz9X{pfC<x*oiUDc!cL?u@KWGO9X`8x3c&!MOOC(=Ia`FV=hASN&
zkYEeSZ$8efI`dshrK;aN&y!44;AQ7PfnEke=gi(D%p8lx@u&w)oRcT|U9cez56$(f
zMPcVAsXQ-+dK6S#F%rLwNm_cFby)xU+Q6ZaL2F0wFu1M{`wb8Z2xwP2y9W@YMZ7+I
zyvoRL?u;0~6WKF+3FTpXHpET;u>UmjTgyHXBdkfl^;YX7bmnMxUyfbR;S{YUbi&XQ
zjx~<8NF}4M?bdrqz+S{uKPxage>$n=93@S3zws7>Wfr?cD{deB;G}hRhdPCSVN8YJ
zZE$+f*g4qko;!2sls`N?oMD=#Q^8T8WSH6D>U)p57ynP*ct)qKC;<sBL9RpUp%@B}
zM&aKR#Iy#ZJ1lQc_$P!}mP3f%(x{s_1N1;|#O@kq#-?tGH`y*-6F&r#R_OBbEr9Uk
z`DiHIBS~&f2n`7)$ISB08Ecio^b}r$rcvO@lPu8l57Vm3SX3)wHit%ExNY<u7(T_t
z3Zmp#cpvC)9DJ4UO-XElssPyu&%=b)UfIlr-Y)|d7ypl)nUJejXVx6P2J$E4(EC+r
zRvW-=ue@WP0(`H9HgFIVq;X~GL|ojREj(#p+C#WMIhOrSPZY2lqbSLvoi;B|KLhA3
zwt7@aBCN9X5uzqcEpy|MHNLh5nxTaH<IELLp1o^wEK$k?7;NRpvgD0vo3Y>Vg<HD1
z<07El$gy#2&kxRFiglLdTo2#3$etgk*e8T)e^7o4TCFn;&K@FmLAl(RD*h+cbf48w
zIeT*#RXAk7<d-|Wfc&a@8B)SUup>?|CVC^(LlQHMACf6{F`sV-bul9UqWk#X8Mu=5
zTUDIq7VUX(=O(YI!bsf%1<p&rZ+9&z-ZJ*WDnf8GF@Lh&ak2#W=G0AgNT?x)NADo*
z67}HdOgetyWfa?8YV4iS;?CmL{OlQ_wT=IA>9%e7AkUi>rS?^)BWb9k|IZJq<o^#-
zU-=MaxAjd*Nte<k5&{C!-3>ByNT+luNDQ6Q-KeB=hlF&4(jg#H(j_U(ynF8FJ@+|(
z03VoZ@3q(Z)heAv$01YoD$MU`91WMK!U_J*oTDmb+PtX*6po$7ENZ^Uohj=>qa0j<
zw-mBpCz?8#`q@1HJLXm}F8oM{DyO@DPelNw(~v?-%B*1-{O722^Z%Gm++mhPMpXF<
zua8y}hBiVcmc<G?r04}`N9%^VWr_jUl2dCK=GNO|nOkBN$s<29#-P?jkd1uUZa&!p
zTyL%jUc}|U%bBtAtJ5)<{g4;2n41+sP?%*?FVy;o`I$sAB5cvFSE7j2!xHHiK3)>x
zw;a?vFutyZ`HF;n0W(ma_b|3ltm@YwKO7${xq??qE4HU=%WG>;Y~}_>tu7(Uf%nC!
z*1`&9g8>3$oW={b^HmKms!K=b5!*Xq#&c1DLA?j$BNCZkleKkn7VDdS@9$?b@tWOi
z%x!|kA4kLS^~j5?5e=o`5l9g$%MjIKpO%UfOLcuZQ#@!xKd=Y&FP)#So`ee+%j<g;
zXI60PTA^qE$!5g4S~<hb95@TG;6~AZcQovarIzW5q8o7j<;PMr@sypl_@ugo&Yy5r
zT@05Yw9o5VFbWh0UJT_G_HzCYG_zk*vM=hJWWNA%9TpZr8*r_hI1~M&$+f{e_pMen
z1sL?4`@)DG<GH`bw4C|Gh%)=3OW$(DQNO14S!2-;4V=T{f*k7&>q-=YdwTYYRJ4Au
zn|*&JcLrLKn{&~=BX(?ZhPA7ttaKn|4f!E1CziJCT?2P8{kv3cD0tj(&9%SzeITy2
zwTthw)r%!t=7CCLES7(<Op>#7ilRA=`Loda{=RgNg@bo)2|rjLx-m!4by-EAy!`J8
zdQVV#Uvm?_q>*t&@yeUmoa&P!DtLyzhafsV{~SS(ddGitFYm&TI)s){>4v9?MCA6t
zb-U27<vNJ&=W+cw+*9^Ru9{OGJA?wF&qJLW^+e*?>l*OaDOQi2Dn7kNU1uVW)(>$q
zq<O<C9|-P|k6ziIp}t4+^rWXouVoUD6@B^l`N}v|jTkwxSVPxG+TSGK*Nt-eCaPv}
z7}POU@&Wi(FjE+$<dbFwPRA<Nf`W78bSf=r4>=}y<JxaVL85*R{Ajl-uLKDKPrd-m
zZDb~EZbYTtLcE$vNhGxB2br>0nd*VvCO>cJSa)lr<VvJK6CQk>9IX8lu-+mWGR=)7
z8pRhq`I_1wV;fz*o~kR{J@RlX7sk1o)=dBES+mcKby~hQXX$U(yeOeYDy;J3fIAiR
z;gN%<{m;#=j#tA(8-I)(<?0ILm*JN!jE^)a-9-027(O0huXZeNM?eA9T?f`&Uj&lp
zWKBLDGAkG*7y;uBsTZNqEAhcgqokyiU&XNNeC<zr3Cm_&Xr)^^d<>Z0VCSgio*s*J
zuxf#d<xZ@?>Vgi33alHE$u309tm^IbT|D;+VW>4_tllK<XJkbV;tDv8Vd1zS=c^I+
znLk*pKmOo{*}EDmZoF|{_J{j6cPX7@wXUp<K3bAd>R;Ac=V2nIHKb{f#<#GVB;iFP
zmeadd^mZm)mnQPU>lB{<0xaRkkt_-RR=?OIS@+4?&p)Ec8r0j5`ea}tNV(dW&Q5VW
zjuNCzfp<oi&^bP0rCz#ek+2yC_vax=ga-7~qy?%U?Nou|yZ@Gja@64PNoC@mIEi_C
z=HnTtD?{Ic{9h-p-TW8!Q!%pq<{o0%_$q@H71N@7rJsuDSkGq60oJ){WN#@(-lM?`
zV<JNOEGF2+-3h=1u_Defu;Aw;je*$9Q_bo@Pi-vRRQou{uLkHpIJ`kD?B6<}I$6IA
zey1#PVY%E=?Q?{}@AY_z!Q(^eoKl#6j(@b#Yw^(T8=swAJryKCgG3>Pj$ZLuVLy~)
zW1vZah}Kq6#A$z&g)z8PR89}fOxVdF;ONm9ieIRGQ2-!^E-bO`pT&ZzK330vm-8k7
z1fu#UPta4F4`A~>j*}BB*6(ysQY_qvhu&>W15rZ4&Z65>)#o362lFI0=KAs&^s~R_
zldb!W7UQ9OiBq<HVv)gIaR5WDd?voQ3n$x#*Vl>kF7=h{_tbVaaQSDQjbF^w@UM8!
z)#o(^`{~^q!LNm7X$|Cu&}wGXEAN?6vVS1#dMfEHJ4^a0k!*cx!gQ#oTzlV=t%QHz
zKd#WdADr@@#)n?_KE1fQ>N)`q?SQ(iLyx&)I5mpNk);wcW)FR|_}&+U$}_sn^(lZs
zDd9ahVB^;D+cSq_UQ^$0923{-Lw3@HKo*B8_|e-gmEyT)6|j#FW_rO^On<Tw!&bj&
z|I0-T>FKjKu*z4e#gjrjIb(6DOmyUzk^kEweW*rDu>AwrKiw?W#lEI~Cc>|H3J|eu
zB=-N#;B+tX$v*f%lUi~4GkadlhJ*g73}skWA5qN)$m+13&zMeykeuOK3V#+&P@&sb
zY>XJU>n<<+{WvF;K^YyZ0M|!6AyhUri@>2U0XZ;bs;HD+Qg!{Y2LQ_F*@743ueIFU
zlJ_1eI1Sl0#tyKX-i#PZt5YKy>5|At2nH~zv~Z0D{*#3(6iWBfpndW)&h%O1w-J#_
z9CCxxp^4PhU#uEFBdG)dcVfC4S4;2QwNA-1f1}z5uVrWw+hZq90jS1doG_MFA|S5l
z1C~@oqrHb($z5`aAD#Y*BNUud5w>hAl$TkkuK4M7tThY~M%&2}EG!0Jl&?ObX+6wB
zR)NbXnFiXWjf<u_VYvqv{Vo0YfL}ti?2$I<>m(SUTaPN`Fh0KThmu)yVc16s%DNko
zi-N|9HsE`Vi6>VmZXDoKj^Dum6g#QADxkE5`Sha}cd6)1EMqMt^q{jiwfArIx~1|P
z2jtm8#FNxTpQZn|wV9JZQIPg#NTC?;SWvo6v-^UsF51-0NuB$(cl(t%KtYZ7_<5t|
zKq^8kA-Y_P#TvOr6%U%LzvWI{SrGtJug-6YH0tA?;+Qtuk4ChP{<ATrcNSx|qzKvH
zaV~K3f7uz!JU<G-6K1(!y@1~OGCu>BD1^7O^1!ApAwa#elGgLZJ-UxA05a|{cQz9l
zZyLB89BDJ8%VP%jHr)3$)Q$!hGgkY&cyL*GeF*r4-VysTAm6z8Gco<oz~<`SjHUXX
zNod#9IO7HOC4{nk`oI16^M?gTz4AoaVN^1Qwi{BjvihYcfPeV95WMzne7l0k3gx}W
z@{mU1!#Obnxa@8T1>U?TH6N)5hY>Bu{Rie0QU^)MW5Xs#1IUczlLv}VP=5`9-}-KO
zkAGJ4@+KdClmALlVv;ry8eL)68~zvIIKoAb=$}(>s|6YuE-2DMOm1m+2P<?<P1kbT
zo|8Y*cV*ul-4lsbP0-Yj>hoOn*`dBh4C+RX3(LHh(Fj@>9zI2Ix=|5Fggi9DdA}VQ
zlG1lf>D;nD*Y@H)2*-esZ02tR;SlGPI^=Xc$8)%1z87D@5Bf^~X^v};<B9|4EFbNc
zETb5v=U#g=7C^i;{P58p#CZSsSi=dYk!Ws8CxYQuB%0^tqV423HYc?ku=SeY(W5t(
zu~)Yf^=CIXons7Joc`)hU?PeN{WJriOK#y8b~F>-v)AxlnkQ+}b}!WKC9F$SROowZ
z3-9{E{F^l)j1!n)Nn&qfG*Nc_r;_tLd3HmYq=h_{Fha9i2~_A{LzRY&pKq=QC14(8
z1BnUVc3;BZ9yhNATuE!obYS=34>AxhL`(6g5~E~~?HdR-7Iw9I>>Mfk5e&XWA?gl0
zJCf=sBV#!}=z_y=KpIf0;+xkPRI~8%Xj6vOQ)d*-Y9lH{iov#iK>Xn!D5ZjUk2sOf
zSUN;}mvJ-s-QJw|_~azLlBRrT+(D=B(oHkGvOsLA^HFmyR%f`P<okVRTE_)nqmAhQ
z;}(Os(K?+ID_=AFsfK4TEn4M))HG5i)6qz@zVt^oqiJNOegyI`<^QD`AM*%VXCq5p
zKSm9_mhoSA^dQ^{?cpc*2OM&2m(;=U2{+3g8-9_FWDoReCr(oOLpw@@3@+Fu4nDCB
z>#8A7X44$mSnh57Q*8SI4^J0Fps{3St3@prTfwZoI@z{s3csDl0SP4DiY0#}PNOt_
zjN&!hFsP|q)vJ$Y9U?3!9^BHB&jGU-^Tr2J%W=%N_<lB~Jm>K#a|0=;8WWpYaf165
z_0C)3XEy7&n<s|KTwUM@!!zYJKRIf_SV-jSdS32wCC5@ALN09Jy%Kl5A1*6ae1Xs}
z3K-sRuHHay2>=OaLyX5nP58)_Or3YK1JdaozI?+VB3`DYe}8|UoU>MUK#!WJ5NUvv
ztV9s_{1ekz{7ezuAxY~iDHIDeYH5u5!f%#W)cWa9hbS?qT#?WoszMKiK|$u4x#{nN
za4S}^)J1(sBhi}+L$WgWi|s(}VLHf>sPZMPlzqdnrfb8x3TT^p$})=)5G*D!yEOm3
zpQUHYI~0@QZlW+TyHf1pZCeD~pe?zzs(tNyhL8vI_B}<s?~jd6`>w7`EZ!L(rNW>B
z`M<(jDO${+*<a_X<8K#mO22dp(3LExy*q@Yn`BCd6k6`mbwtU^KVEK6cBNQsSg&yd
zZws{0@ak~JnQi-kqBVAU+hu<Set26r8E{$eVFI+8`KF#oeXJvsBSg|Vy#uRhTa~Fw
z8MtR9{Dv531-DjrY1Yx|H7!TOY%&M-xRHJsL0X}c775ym?l<akntvi+{_B=1;1c`n
z9*L6tGH~XJ0!g5E8OIqD_p%(#Y0Up9dPK7bUQ1Zge!xaBA(lk3?Mhrc%F@h=1p^Fx
z1>s|X_8NjKW;+n1o&$2qVH5gSucg1vDJ_o8AJbEgCip0#dIW+BZ=y3}25`b<biUl2
zv?*1xt25teH38~cteTv+s_#<SBne!=Hg~)AQilxGI^1)^x<sdjwcFY10Me$Hnc{hg
zLifY(AFo@J=2%%odQ=%16R_S2cK%&C&a1Qg{xO-Old_^SZW*AmdFW*rgRNUPaw}&S
zAnM354p=R&T*sJJ3t=G}@N&KCDn5sXUOW-U<AA0*N@+IKw28E*TKX+pLVXY72ncv?
zo+bwJtUv2s8Zno{t;qG;0LZ=bD!?CHa)Hi>PY%OFFX7qqTF;%_xBTO#?g>v`%1qTh
zqNg(vTgTG4mQPg6{?G$?_?e|>EmUo-+l5)|39p6_Jmo^oYu%-J<;}hBAlE*@mDn3N
zl)N{vaj^QhY1#Se9Vu-jU#QMoTC@TH#V`j?g1ecNgxE%(JzcEku+5)5HvM6*9?0b(
zViCSBE$iXrv_OB8?)2rbDSsIN2qtRT{ZwSHjdbz2j;ttDp2MwwD04B9>%F}qVGLY>
zpCiy%lQEhp{>8zduPhg|H!}3NsXRh~tYSmXX?bzjlAHUa)!zNwo6X7jDq!nJKNUU1
zEflk`{kw_N*zSg%Q?af+W>Sjkfq^&?GCSM^r(qEYl75T{h4S4R^LGjK(Qb4!hjJUA
zkNyjJlhLCW{Mi5!BMw_hi`(AtouagAs_Uhow-%j0YohF9$QhIh|I3zqwIpoU_#ho<
zk4v@F`^p&4(Jz6GK$dQgl&=I)EgeNAQ$?XUnBk({ny;mb&{Ja_DM~}v2qrc&Jgedv
zdB1-^PwbsA3Pq;c#h8+ZC`EWO5t~8I%*RvIE&v>U*z@thHaxJR#v}{&YpA$A?E51y
zZ6CD#J-qp2>IDb$0})z5Qe?8gJ>|`Yx(1q^BluK}R*cJ`rWvEcTeu18E)U+jURPcp
zw3msx9a64c5Bx}07v8mPs`9g{#ajR?&uTBy6j4?W(p90uo~fzpJ#DT)LP4p4r0f-6
zm$=2tN}fm_sXB&y&5{QHl+$H3oYa$<?x4IVtIU)sm^S6M9!5UV_@>_Bm2lJQyZw2C
z8xyOon_6M0o{7&Ea^^!#wrNSGZmFiPi*N@eja;*<dwlbW9HIKCkQVyj=(s+Bj;xWe
zD)tqql6}^3UIN51bY>R{nj};8rfV0@@E`={z)0Zjxb{&gQ_^qU&P$UrZg!s}@<~F#
zHSX!4F~g|jU1FK=+3Wkl%whNOoAaG6Um*1}-IqTr3t16KZ;`WGAA0lzWm<7Iy8^G%
zM6l=KX1>KYS%X^%=F8uVn_+7SFrX6QO1^nCO6G-4YfZ-<6Q^u5*DP@hMApKYDj|Mo
zSdq7ZXeqOP6bD?V%V);R>d&fPVGXJ$lMr2KKjFc8bML-HbB`a!c5A|~kxugCIeK_9
z>+_Ytg*DE0b<F=D5ZoBdqV9o8iE1-{wxrtzHs6y|{&Z5<x8_m}{I7FokYVAu74Nf|
z0Gj&(=f$5zRrKg#YzPR$@rN1l5`S()La^gXz2HucNBF~^Jn><^@V{#kf!GAtk^qk6
z8WHqzTrGSQvdE3e*L0fGBT0&3@sOtTEVa6#Vf+9+7sZZ0I~lPWr*H~&9izlcuWB}P
zQ#x@6c%1LmHA4W9EgDn9te&GEKD;flNyQ5P8MyU9*T)uYukB))EA1}v!N(&CQsFfl
z7c4_{8;>IhqCn`_QV_E9J7Lm96K)X8MDk!yVkBKr!g$SdT8&$v4}M&YGkEq8S#kTj
zAwi4BZN#;VP*}VLec%U}mBUu0YNQly3Bb&e9(Pyq8R+f&7<s$)5vL;01ZcuqZ0B!k
z>%_NG!Or83Os1qE&ID6BL#x@;Lc8hlP{XJCBCyU#N`~p5n7qUx5Gn#4**%szX@ZHn
z)#WGAthumL)Lz#iF5USx?`_`vRytz2thja=;n%%Ep~)K4Vgxr!gsK&*vL+6zAn$(A
z@SfJFg0bRo@`-v+kz<q|8Z+z8do+YwiWG9sJwHb4mR=~m<WdAL;qEq8+6Dz|*_lHg
zN#!r8$M%?z4x3UaZrR9X(g^=+CzeLFrCDlV%20XbJ(q6ces?-JtqZxAoEUj6@6gCa
zY1FB)Tz~nEgfQL>X*!kxd400H(;k1Uyw6MKUz~z<h@UrR&SX1nIFZS@cK&m<k>iK@
zt)~j@o2}K3|D6+maw8AX`QbWKqU`3ffMX*Pc)c+mvN#|^h~Qon9uV+5qJHtiJa;rf
zwCVOig+cCE%wOq3Yv}!sT6ZiC%eyI9CXe1I6WryGTb$?j$f1{(mf{Sv7bdW3J@CO@
z+$8-hzKUkx0A$tVq<jm2X}%1;4jE}{oywU5F@xX6ndUzN;pRnG?G8ktpIl|oYE%J&
z{3}y#$?CRb2rVu}ksWcaX4sH80IQ;_VhRbdReSVHl37^Ese}o23tmzqltjBc1D&@^
zfPQ7pc1*%VF*ton=yBNoO^6BUT<Z>@!_+2^tMt(*c4|@Kn1L!v?4;$B^>N;NfcBlk
z!Dv@tgaf4yHRX>R1F90~&{?}tZJeaJ_2t20$x_ZIu4EI4kj(86Q<Q9Ikf(W9OybWT
z9Ip0YSFB#**VinMNYg5QLn5g{O%<gWYCU-mXRs1{On|?l`XESB`&S9jc$B?S+@v1j
zRA%2ySKt09$|7=9|2Lb!+EIO;B+3b>!AfB-iYzX`jzizL8?oX?==w$($!gK5g+hA?
zJUe#t5o)V-{BGwGunh^$0w;YFNB|Xm^;mkW3~uI@)?=&skTN)I9UuCr$(^Jy2cfWV
z3A+oSpx9!8kje^4E^it-XOE}1Z$81<Q+)m20GI``VY36XDR0i?#K9NLbJ01E9d7#p
ziw0CnVWBMTn9cQw+pE`-v12ePTo#i5?_(Byz0Tx3O>5<R(-Y>g*w1+uLznz=rB^S$
z*IWtX-_!I}KVr<U_Urfq%hG$a1uJdepP~pnj1sRYvonoNNSVCJpldGcNhpEQ{$_&?
zH(V!=++pbXZoo`19WHWNA?or_IGVI*LhMKj-CRvKp1tfm-Q^DeGBu(V05t2?Opy<I
zzi-;{xW)o}oW|mCNA<er)zh%ji8b)jfyR((NMhuvy^bgWN&pzzkNXFFUkQSqa!p5$
zlaZQNlNtGAJf_rQXyy<)O9~Ya7~mMAHG{(%JM^fCZZKNT=SV>=w$Up=U1p76cGgO{
zxRS0@9e2Zfilw5sn{DBLri72%&$ms0JY}*IgcfdF&`cPQj<nLx(uT!HRXA^VwRQgz
z*TH7b6ipfuPhh2Mmuz~D@f~F=bpS|_n_XMn3Vxj-vZad}cX=FpNTUjeUO$6Wc7NDo
zNG+%k=Y2+O(i4o1(<#@k>nwKqtm2jbK3}!ZxHKk%VCF&3>6hjE(i6$MZV5E;ay=4v
z3T&C}+TUD%vH=9}+qa)3NL)TsIz>}RIF&LbHC(Ny_6#nxo`9d|?>PZ)O#kFZ8q&w#
zs5#`kyR^J|*<{{GIV1sIfr(KN6!-H5o;hc%`z94p(pHIveStq@5Mor<29tWVpnC~F
z+v0-yI5U%JN{rizZamgAaUXv2MLN9xjv9`rt8xaXWxJ}e+^fT527A2;;<azg2X#5)
z{}B59M~mn^)6?~HkLp2#iL<$CZ=MZL7<Pi1d~%0nwr3F*k?FgW;OHN(|0y^BHy*}I
zYmfVd{Zc8w9x{WVV>A5od_A%%O4hAb#v^z|cY!n~A%?{gk%&oSKwA3aIoVO?-y=_1
zbabznii|i5OlAfnAw2%-WTH52_X*MSF{6F$cQ5;IKpkk;Q&&+Yai|2wCno{)f>eTR
zGA<K8uUv^`Oo<mIQTYUvM7461KXVZMYU7?n8qJUdB$z8onT0G-fiOr`atO{2oy_Fj
zdDYKik*vnQTgsF&8wgqX0UoNxP=xSzvd;Yxf;BeGyi3kW{T?_2rAsADtBh&38Oz{y
zMMz4n5LyhEWt(g#&Q*|T=+fNYMKgsgOE)Az<snSuHjtS^LH1JVW;!4CXB9M>epEVH
z73x|^?sPs@Js|JGaO@)U3$(?};O{-XGCPCIf*&*WBC(_nbNSW_t4{1@t6`$dA!Tg#
zru-VSmeVAKNb1a)87+w>&pSzFvAnyDSIy7qQogyI;<)uU8l^z97~o_167X-|A%I&6
zjGQKpixemq{$3JM`Oy>P6dBuHT}AmZ@~AWO^3|VdXccxj-j=IEbYH4in+mAwn0vv(
z1Uh!rVwOs=`DCjYOa+$`mN+(_QmS<6c(RrtijFB1I90@F&miHgKq$}EuvT(Z(~Af9
z0e-_u?Y}aq(M{M`k+5a}c|Da*oqB>^K=nrX^*YJ7Hu``08Hy2d0~eI{Tox~+Ui)fo
z^=G9Q{tq%hBX`o5|NNZvH~OlmK0y#DMP~OFV0)N7u|P6}=;nbO{~U+r3_`|QY(5gv
zOhO+TeXAkO3};I9ObI>-7kZ5OMC7nR3rCBW#=xmmJ9ZdbQm!+Nzp4vNU{wvV_eRka
zq5uu>`%qb(7R{ft91i2%KQd@?Tx3u+%XJ@NO`o}OKr}^P4(e=&naFoXw_}xU-8xD+
zAD+W;Mjk^nCX7_J^2XDPTzSe$D~PpYok0|r49G?hDE}SotSnChxQUDujR+Q^#roz7
z%SbVV-B3^b?xdGGRgEQkzT?O%`Hn9$<x>ZcO0wn}iQy**C_YG=zw(A({@wToUO4y~
zb;rn;loMx89Qcg3>v}+-vvv)neqD!E{6G=HkXA5du4Li~8)A}UMt182L!){5&>g^^
zzd)F9SReWXW2-Y~vY=+JCM|Mc(g0rL;NGh^cd2`65Wju|=e7JREZNX5kVs~nGaCHo
z!r+UNwWUI96&lN#l!3+GXm-y>Q^|z&=Ejh1z@U5~ntz6`H{V#xCJw)uoNV+~K}o*Y
z*koBV8B5nWtF-`U>Mm?A(pATHQH8NNUmDwtAY1l<wn5~A02K;><%6qR9xY0U@KCy5
z6~qXEbp45OcIqFvDrrB@Jr=zw{S=p_-0}Hd#yJ=>eYs>vDxs9Z$In?YET-1zMih8W
zr-e2rEnFRsZdN$|JwH@;G0shHxsDdRQqoN`Cf`Of36jeWDz^^g{^#NP^g!wktAafk
z6EW%U)B5DPW7Zj}^nhtJ+MwPhHTqe_TMN8!4}Y{W+x8jPrNrRN1<QCV>G!U;fBzcA
zkaMNo;&1q=oGuM`uFtE;F`0ALf{fdk7>b2$csI}{vqZVr6nTvqinSimEFYNkor(ZB
z4O<b@D*$YJe~Tnb%|A-dPvWDMV>=7f%r`=0^Cn(bMynAS@Zgh>>DIH|D2&BI18$IL
z@RsbA>t0!j`0~if5YU_En*2dZ@hv5O%SsqeCu@C?pOkWO(u+UOY0-5FwkXuyP2*MM
zD4$DGRaRkm=OqL8a+hB^zm)1Cf(RQN2G6D}rIIq!qN?uXk04<A=c>8AzHFQ~`5O-+
z9-#f%Yj@jn1jdDm$+PxTiTea1vK4^@DOlX&2pnOdI4AF_eP_i`^P9b*^<XBoO0*D5
zi=^(bO~sVZYuOwln(!hs%d7j~c753GLHoW<FYrHI#~9-ge7KF~d#xSSV6}eImHO(8
zowP`v|1?eU8AF}bxqhhv^_1HE&Q%xuzNA8e`VLVrBmOAoEjoWWEKV@pV<%38_-M_6
zS9rb>Xp4b3|C&fj-v0~JW@I7bRQ%W<(va;gk`zo&vBAj<H{b#4QrS>~Wwd)H1Y#@j
z{9++?D4gE=i?i~p#$9;k@-yfC(tIcXU^3aE=@Tr)J*7Pt{d!ls=K;KzwinI1%x{X_
zI)&%nO8>X7-c-_hmzj9C4my%7aHxcc?o<weFRa!#hq-T7$>M+LVjZ;8r_Yx#|9QYF
zOz%L4r}FuQkB3M%e;RR6FaPm$2o>akSx3F=>)(>H`1tU<^x+zyXqvDc&(cYfc`4Nm
zmVK1WCQZFGaZ%ersBsqMa9@7(xdQ$UlqdV;ruTcvt-5a~fqiCc&CCY78C-2c(gGk@
zp*>4$Zns8g4L!J#(WC+|R(3>pgc>(#BUyp&9j=q@)MRjB$^j)IRFv%heKyLqR-S!}
zUr4*0qHteiZheya5kr4Py-rwZN7VG3SGO-eTqAva*SQ?W0Zc8~)`vscaKmy~MIOCd
z;~P-Pp-$xCvpN!e`3T&w6%e?EswkQj)Jm1u<@+TD*_q~Be>_Dx{lVpLS4K-c$eQa^
zAyzi%E_$K&L^|QlBUYIGU1-tOoGKY%qGjYROW7v)XW$0?Pe>CLr3+)u0a@v)kCukW
zvC|{wy2+M+!c5z4nt3`F?k)|C9Jc=o9&f;M!nYBeZ!A)y^yZ^P<!DC=F5=Cp#!OyY
z8e?+I&k`aBHN7R3)co;)Czk7A(?_H<;3*K=2tp<ZET2JpAue?{TXG2>=)`@3GtM^0
zV7qVavk0JZee)L28k?R!<8=mjl<z#a8oq&%VVp-c6I!n&TCmN_Prt_p{E6vk&{EW|
z_FdVps&CIdtp_?$gUsLBR;14c{#yM~f$c&GP6|=b&K69)&out0FY;gM>0|Gpvli+j
zy0tI|)~EJ^6ym4M394lEvQ`!E|68EAaroo(CGmb~nEBI1B3xL{Z)?Ua6`2jQL;aG0
zKz1(S7uv|S3Gxts@U)kzpPOeip98WMx8t*zZ<gy7d{Sn{wy+wo&w+lPKGCk8+V3>R
zw0(_#p&HmbeJ>C6KEOhv)u2#l<r(H?2)J+XPAKSa)@?UBz(C>S1*0c62v|*l@{5|k
z9(ey)VP?f4pjvtyBUqC3%}TnG%4Z24+a~aacNP3jiU;R(cbbV%dJ+hznxWrOMTOYP
zVb{>+AN6T3W{ISMobb|0(Q31wuxBdqT~WY|;AJ#>RfY(VEYCOM^e%mOpZf+b0J>6G
zQxt{Lrz(Fegka>O>VP5|Rie@6bu2=(fOn7ZWh2SPs6tp%gLvpm+ilL{^3>db0@z=V
zm2-$Gb0~2v&RQqO$`Ge3b4c?u+HS^dq~ah)#{kah?@AZ{eTIETRw%-9O7`~44q~8N
zTGE}~V=L0zxvZA83HoWXrCrVhRO$Fqb%eVm1{L)16tpzn2|>#@0y-54Mo#S2CT~vI
z>6ILQjqB6VKK-!v>9^mcFgV!4gVx}%D}pLnOkylsOsq&o_|y2uuusm1IGSlJSh(x~
zCw))FPp1KlY62NZdIxb%hoG}zS=<=1og>)pD>z6b@H47DEqKrX9^)Jr|Fbs0ljrz>
zde?D{5ViaOH(X$`{>=XnAha|V;Tk`C-^MLI)c^NfdG;*YZ1)R{Ti0RL=r$z^qp={J
zPN9B&QxDWC|Gzw$Rdn+sPub8@nkT#f5=$(?ppP90=C18ib#=8i64CR1bk>Lqb;U=H
zC@QUk{PC2C#Gkz#11tvC&TBQZvO-&8^GYz)2;j~cK5dNMn(GM*@k;{jx8ZHVU!lF;
z;e)A0fG8b*Y`a@{aL3C9Fe6*{)wMNK73P|YMTeMf|J?^nbVHI&Wl*&hu_mQ}K9SYa
zIN6+G8{g+}K3~wlX_S4L9NDLeD-CrGb$v3GI_Z&^`t~}1NII<~cfY6eYSp)^!dK$Y
z2mJAOzlig_J-?&UAw_Lk4(g^F<IqR$vj_msPkS0tXx2;a(mURQJF^idfI&duN(v4V
zgKx2W_x{=}g|*7wt;-mC#5y{EPJ8cxU~$6HWM=Yypkzij{sr)<Q{3!T{2PE;Ojr6%
zG+g>)!Q}LZt?=$Ht?MvsHec(+iy{Vy@)>Bfl)EA$`(DZjx6oZ7L`yK)hygRo)nfNx
z@h)S$o7|8_GmLdul%PlW271zs;Ucn~VM&Meq^rN6wcUm}yXbD&XAJ=rbj^fW9$J`B
zn9{qyKg(Wzv+;P+Ti)r*6F&$1gd@6qK0tAvTskZ31>a=<B1y-t&XVb(ihDPWs5j;G
zAyF^nS4bT&#d)q$CwQe;?oZ}Bu(M({dwFOve#amRzt5cd4q4{=%}7bPHvp6=<G%no
z`{#QSu+#YbN9ukoDCV5s1}^GN&XUsa-T`nVeX+&w4hSO89WzmT|1er!07FmCn81>W
z9)rg(Ha5vh6UBG`!rt2jN_c&=uVhx|vXO|vE!VwHH>~Yn_D3c{AW8ps@F>}3`vUJ!
zu~-Ne63jj&;qKA>!xs+$znR(eYMBueI$a=eX+CB_l0s_*mP<pRUvlo{4>NK^5#Tx5
z7YM3Xe#b)|67phmPDyizbv&k4_cN|%oOq63N2<UVqmmr=kyifg`K;?&TsIQ#1tzF_
zuEgkkqi}jzHt1jv-naQKlu8`6Y`px-iiN`EyEqzG_GK^|p45haQpmowSdMI6N3dCF
z$j}c`h1eBUc3}vgio%uhM<fKFpQH@YMN+oL-BlP=MPWmPR~hm=WO}0aHtLSoeyWhn
zipL1U<+Qzt{|^Puabs>zP5W9e;Td>W9e8maC~?0uvm^iZne<&XR(#eMkD|@rm=?)F
z4%XC|DA4$9_JcuyWi;^|*nsE~n`Eh2=U6J3cvbKv?p!B}3nzs4pN%LK(hM;%#HH+U
z%Q3&PO16Z&vG=yX_@`hTETS!dk+Gz3+j2{IBH&VLyNq}Kfw^Me<2#6MU$&Culb|S%
z@~gOAePAP#KEvD{B($Cq$2g?0z0gyMu76&|`CwQAw>(A+l-^llH(Y(nd}G0L=f!8H
zT1<Iu4ZZ~h+7B<cc#a`bBV936O_36}rt2huhOH|_v;e5Lp6uhsA4p@26Z|!(OU8oC
zR~J<a$&KbuT8<uAE?khMY(D+t=}Rlp{D{6n^z9<xl-4>x2YF}K9gGe~Ojj1z8{*72
zbiP?Ce~nqba;NbY%bZwcOvVRR(Y9jz8`u^8=v({4eF{h`Xt<phamEO`+8;*otqwf+
zAC;%0r&(=!taOT6FNxOA#0O3U=M3M;K;1LjbhS!p91>0NDnx1k?hEFU3k{dEX&00j
zl0N3sa+8bCo_IcypTcI7>>q2JfRuQ{toOm%&!*y^GFe-wZjA9x8r$#ac@2-QA?mYe
zq-Aaw0&9yxLc760rxPKAU&q6})pF0UfNW|h8(?)XOJHwA1WDm=<VMWg<b$r|X{Nx<
z+3<Fqpp*8L35{IwX>r@qdV&nz4K6kU>>boJa_P8Wk1-GSjgfj%@?a8@iE=&&0)twb
zR2>gR2%`{w=CP*6&!4YA;O;Kfm&-i$E18o_AO=wbj_7Bjs85I@C3C>umd|s~=7{r7
z(1yftOKg%csS&-h2v8*Cdn~1{gI@J%ObzNfI*(i;mdG7K-SUGt5tV2dAtLQ^rA6Z+
zw6_vxOIDa_)r$=plcJmqjVm5o>9`qpF`0?oWc~rlewQW<9j5^xocHX4M{bQ6VhqGe
zd{0atX2nrj@NoRy)!zY1DcUKxw#{N{7i$Cpz-=<}jW1Xs0~>IDRRB}c@di)>T8ow&
zu7>d@TKiwaOnQc~m3czuUS`NKqbQv!Y%>2O37q<#d7wh;-391QlLd!+9Vrq2#Zi;X
zPvAkMS|=^Cd)h#asYfLzO|%~CU80(KHi3A0^V#MI6aD~HtiZ)G8vps_CzQ}&O3SW8
zpVM_;RN{n*hgS2hA^%Yjk9GUUCI#3UmCD$NXT4Zd;eh1%p=(-UeGB~$SNsoxDN@+h
zQ>?=k(-HJFJaDGeE?Wu>5w^F=4cZo6-Qw?06b0=MiL|&fkiH;v-6#Z<Um<~CE%{H2
zZoVccNhS5!y};&=bn0z!?)g@C@~A8M@$=<A=St(&x}iN5>lTKAng<TM*O2e%KoX_(
z8Ven)Ju~zKa~@~XnZ~-}Lx4va>5&#7z?QWeM8jF}RCFDS_Vann?PNc>sb4DNAEuY9
znP@X-Kw$IGva-buG}}~SROqDZ-~}1Dgxs92lP)$G>7q)n+sILKNAuhO03e$ry$KNy
zihFLlNM-B*{zP>3Zfw`HD^-gD{%w`+{@W!Bmxv2kI@EdtI-%Jt&n$4bP2_a%5)Deh
zw$FX1We_v6EV6PAa#TNQAAYEiqZz&#e4(eogr~^VPqCGggcK4Y8_X7aC(Yo-R3Hmm
zZ#GVhQkmoQh1A?krFVMzGM`5_OgFe6gJc{K+S<ZG9G0|L$&kG^!c-%V$C#)*cI+Y?
z=Fy8Qz%t2jPh!Fs!EFuH5(p2W<(7i@S)u`gKN5)eWQbmu`8frqdaEqUJRxMbcx4qn
zI>Oc%bf<NrN&9S{b>2vroK^Auao2>gX`79;AOk5~_w5-5{rMxC9YHOVSM5bhI*C}0
zRETRh4FwaHzg;03Q}^D+B0|uo;&h<FOjm@2b_p6x2r}OM{$I0y2STBTozrR2%~4pd
zT9iI^Fs1KYN<)?!x6u`+GP3CYhvyx5pz3$3BhC~<2Sel6^{)3cCwm6YR$Fi0u_HtC
zS@_#`Uo|p$<WTK!!t!9SfHKJ!F9T1$8QM`+6e0C>G)3k7(r<A!hp1GqhJK_x{YbY#
z>LL3wSljI@GR9rclyN!A3@+JZW9D7Rt;Tdw>*;#{)_z&h4n*ilj=|WnwywVe>fVva
z4nQu{Hc8Kt$KR!H(kk#jvLJeYclnvD3smDzK;7=4&5Z)k%3fkFLxYPFzd#%Jmu)7t
zhS&!Pp|M(yAmO>`@a`?hUt6BnH!;zATU{9sU0IS*f-Sx-uOz}6-(w}DMx-U+>>oAr
z|HTKU0L*CdSS@uS>$#~SmB}hbxc<u8n>hp9C#jEyC@V&7dF0C4&JemU0nkgk2f1n`
zakt2?v^ECJ!HEf3%9}|R3$@A~_VE$g*=@X8O_f9$-T-b?;ig{YEgFYWT=v1Ww{3$<
zj4)zNmNmxN5}w0W+!q0WCwMysM{KF(81vzZl7WnUZv;6jv!72EXoiy&q+!GMn|ZQ+
ziDz-_9!nD+O?qnGehV;2ld9i8BX0TA9Wn-eVkc4Z@ptOPV-<Uh+&vf2JWA~GH(`R@
zR^d%VZm<u6+M_R&Djv#t+<gW%w93Tst3z+z^G<kwZ_7YKol7?z!8jz4bh<NjD6lo2
zw4qD>mHkw(>Aw`6QVnL@=)q2!Nu;?Vqf^X^wn>&xVy%+h7c9++kN=(hVzC)uKLzp8
z22kwEOOd4>{2wCjDQ{|Oy7b~|yL4e_oR%vMdxr(7c7PQq&%ZgJ>xG(=1ipMPDaH~J
zrc_IoJqq3jS+Qb15MbKyLEL(TgunAVz`blB_*NcLI81pM>rmbCCRcUk?iYENAZ@+r
zHl(HhC27I{(8T^ZvY-ySoou~f*L<mo^m=Q9fRt`)I$}EZ`E#Nz+Mv4mR$lZpk|0+|
z$4-`*o`aI!oXzD~7s%f;_S-jF%c`H%HKI24>;^1MKtEWRqjH8nU%~Oh4u@T@$}tbf
zU7Ozw4;E@bZ>LLE04DX6#%o4X;=l&x1iQO2b>Cx!VNRU_u`NvHJ1TJP!oosRm1M&r
zWpDJucWQJ^hn1yb?-E_V$J}shSMd07^j`s|IP*oeM!;F}{F}BNaNa{wP<JcWv0P1%
zOCM>YzrF+RsJ9A4YPyDOsdhO^UwEMW80AjQfDt&9hz-3%1!(MZ6>LF*%+JhYj<m&3
zQNE$#i`MWoyUj+a_9$W5MJmZgN(go3olKqCe5HH20v<!X=9tObvk?vdJ+129R5Y}1
zSCC8~xN`fIZ#11tf_ge6#Xp-ryWpKD?0SRT;D+WrIsb0+rONVbKc<=g>#EtwgwyVU
z6O#N`_>*p}jrOOqjkwkSzh!<T^DUh-sd0;n*lcK>AvPvfd$BQ(+fx2rZ5{c?Gj=kr
z$B+M~xkhbIQYL_+Sd#J>kjo-WP^A%i`N$PUHd>~`Xb-U^A;)exX+2J`Dlcel_)t=u
z-?Oqt2&SAPXH4KnFUazyx<hf(dM?oGtx1lM3o4S4&CPZ=f7C;E`vt0h#~k5%$S+=2
z6t9c{DGX}Q#(p2QTD)sORCsbKv+{6QKN_-LAJ1ykr(~`s2x>R@z>ppzHu{bSgOBLs
z1Dk>(&bA@LJt8NBHFvQ=^K&u~TFfUwD()_O*3yie4fr3Fmu&2*LXpeks}Z3$SCMy?
zlZRHfI0`;ykb_SE{83g}=GyDY1d4YF{cL|ms{&zYLpCCeX-8-_dn&2{HEPpn?RIX&
zWGSP_R}&BCMV<S!Bxf($Y{`sOUGi=G)9@$Bx<KQtsW%lqJ}I|tKO(Emt!VOh^!{qC
ziwrCB4MI}9#t9|(8O`Tpx;oNe?And)bbef|R5ZelyyXz<d}vKVS8pq`m#_vN1xpRI
zf`2rFvpYON?2SGOHXlsWK1<9{-jk&Nbxb@~Q&__HM__9%<$1Ekh_)vfG2T}{p14LQ
zv;*r-FlfPGS+b)N`$J&#wEPj1vyVqWEP^x9Gs?mj+j!5L*9b6VE?kc>;~=c(P-I@S
z2~o>d^0a)^|HM4}{Eo^jc=MzgeLs`S%$x9%tC!zE*|bp+IdYihvf(D5i7~=_UI@{@
z{NMOBhvVI4&P`d5<BTjs@MyY#!%}y^KNpb~iHtEYsM_@Sqc=CuA{4&HGgt7QEjQuY
zG?|kV$-v+ch%n$95B*4{EDc6PLwUqUPl-dM=3v`R6)NpUDzV0~Y$#GcVK*ZI==J29
z!Fwdcv$^w9C2=G{Q9{{+S>}b)^j%A0()$({a5=6E86PNGTVZw&W|I*SDsG0TKDYDK
zTHQtSJ$mK7=6~hij8Sd9C1p6w#_w>m2x7dedJeQpB%gI8b9LRF*{;v;RU=lQ#4Q8j
z%|Q(s<WSYRO%hisiJStJ&0>2%YD4th5=d-!NInH3LcpiP9Ck*^^%~X%3iANQU41~7
zS9$tW!T`P0weKOJ<sEmb7yr#xl$rF|TL1xYeP-XMT4Pw^-a>d$212oj1&`~Ye9%AO
z5c<w`U98vBwYnWG`9>$N5!ik%Y<Y9j+(M>1#ocF|J93T?NJU~wZvI8A)X<4#z<sCj
zAx{=%WS#<GIgayZs0bf~#S!86${{pnc<meAEr_X_<)iu1-uLoHYrF6SS9QVl(6GZ_
z>AQ8{_{iXBqV$lw;(n;Vl;;E5!3o{W@`~ZEGfti?xIbuBII=)tj|k_rSp^A)Yh3Ok
zfoN>#f@8eyx!gG&HI671<x#)?HQzcY5=%%7ugiIZU$~$14SP0{N*^sN(s~3reYRpM
z*Sn4-FTDR86_lXw;gJ%hMXm=;k(8M4`3jH<`DwtaHIUvF>U5I612Vccze(TY7Yx;b
zm0z9{OCSlaRO0ui!3x;75n6?&Y{7;?0{Ue0Qlt+|eedi6wAeN`KR;i`H=QP+Q1llu
zLtV#SHk{_@2vZ;!`q^GSmk{g`5C*<tO4d)2G!1_C&zt$O*mVtDx3@qbQr-U?`DO>v
zB}m=o3hb+RNXe~gSEpr;mT1dQ-2f$ts~fkfr1&+!*4(1Eu3*AY-7cI|n)0<2no3QX
z2P0K?P8V*Pue>$<ei6r;bs(@Qac6J~2T5O<xdm(pP5MlrI7F!VzxV=B(xlK{ZsO@I
z02Ob%l~*1jYJu;97s@A0i#>>LT}dKLE2*}{<(RB^oc+kw1o<??wcUVObxt!Ltiw@a
zkh;eJOOJ0>>niny?pioa620i)Br>UH(ev%wd|ik~;0g{l%3QS~-kg;4NeOrjqKes`
zN(_lNoMU5^Y9mikMco<Q229i6@`!85o?dSYbhTPAZI>YQ8uf@JVx~qr3O<8>$alxQ
zGE@ts+<Pvhkx)7(sLfp}S=<tu=$<IAk7Y7Hi+ahEZ|ltAJ_%xwn@Bz!_7Q6szpx%j
zNq=Tgw>f6<XaO+Lw&VttY}r%}R_I*Em5EWBtQ@qr-y&?llGZ;5h-HMfR}_<AXUmy~
z>WhgiKK5DO5hs=w^9S$UsCdm5buBf|AF>dlAs!o0Ml5l+R2Up>GbW!Gw9+Z{0Xo2A
zD3n5I83bzgWT;==RO9|riGGv%4Z{GkT<u*E#3hGdTFF4pw$liiXEYELu$MXARJ%ub
zz!`C;V4%@!(<e`eAGCmf#6#qz;D0%y-K|kT*~@rQIeFr=VJGWvFB1}GP6DOD>B|Rm
zAqip$%_OY4{cPkHA~)4=zSRb2qyH9-vZn7GAiwNIpC)Jn8qC=dUNEO>38I%2O4E$E
znaz}H3<UT7ukuBD(NA^q-{wx$bPj$ok)p`3eE5{(Q{v_Nm<E57tqxsH&^LEBrdR;N
zmf*f2@jZLsdW*sQ@g=mB1&Qx9f57O)H!#NY<xZ0?%06Hz_8=K%d1CdFFV{<p6^SoL
zS>67#f=xI`li+GEpN|bN+t}=ao+alSi-IgT2I8lJ(Rbg1uTf>u-kk&PjWS!n^GO{h
zfokV<KUe2ohGm?Ac7<93L0QSx=tBr{oL@A7#l`mmb-Fkz&^F;5z|6~#R$O~=OL9D?
zlwv?p%*vm+sc)mpRaP-D)p=4-;W}04+NDLFm%3bEaipFn?6p@bN3P$o;ybGYH~>@w
z#>{(&upLHI)oR0zmrQXT%OE0JmbxEPYQ^jwtHfWU0KAu(_==jvh*erHZDAr%*j=j7
z!;3I0kCeL6&HO2ss<rSLC|b$O3`MU5AxCGEay(1(LVkIp2_}AHhVE}o_B$HyrjlVB
zWuRS}#{<h$O-T)Q2Q&Y&x%;}@I3(DzKyUvd)H1p-jw%DrN^43t*;>!g-)D$VsnGvC
zaJLSmK7rWk>#rDOGIQmp3T;VIf>Y(UBYn)q(*ucyM2SOI3@)T0%*V37l@!)Agd&)R
zsfbG4qS|`PCS94@a|Y;v0@e?LbcU^mxPVHCF21%SVfn-Z3{u9aQ5N>?e?mD315&CH
z_-|Tcvdf~kXV}*6aSV<5RnA!sVA4!t$H$_0%%3%CRP74UCD{@(fBnA~Ry2#QRe$2%
z!Y8d!?ZD3eJIX;ny;7!bFBW>icMM8SkVwYPBxlc+zuWxQcp5GcjynqO&2Mza%l2QS
z)ryvnC`sb^60U&Z<c>S@>H=#dxz2hcrgao#eO~sE;rKFi*Q^h9h#G+`r5&<(Ccx*W
zB^JtL2mIkU>Ow409i$k7Bg8#m{RZoSi4-+)*Pge(V`ROg@*2G(|F;<$f$;IGf0i7}
zj+qfsLi#>E2K97DOYClC?f#Y9cezH|>JpxAi2zfew6ETx<(U9-y);;Jr)v+^Q<5g7
z)FlGicmnd>Q#6VpscV_kZhnkp3H+*c%$>vs_H-Oggqn`e2nZu@X_Wq!Xq-=!om$Bd
z%6o6``HXr*bH}d1|7gHd1}KX{Hg0K--=TY8rIPL*q@{gV7CGgiAy%*6bep<Slqd(P
zLnPcx<~p_gLZrf27ydvHn!b>P1(?wp$?t>4?AZbK-pN9TW><F8EsY2p<^@D@A>lm;
zVS!|I)p<?xVU5nqzIQ8rM+9OouH^uOEnqs0gY_Gv7M*M4fdH5M>H;~GUm0pashgP1
ziz|}c19|uGDW{M;ID8O#H(0(3oGzT6eVNW95;BpJJOU~EGSQ+4uVRkTpGeTQLNDz#
zd?`Q-c(wnbL-SiUa7*tnwPbH`?dg*Pls)8qI@*fbfwW4f*^?Kw353qj82mvhkJmyV
zQs_6LsklsZU%EcTzm9Q4c~<`G1!Ae1L*@8GU;4nd+Bauh#{eQGOPs8rNQUiT(wUI5
z2pJ6?E4eAMJ=?>Wc&4kAQLvi(m=&tZL_g07`SKSbC{ucslTb``TJnB$$#azW2MM{X
zK$T3wa9<`vHrl7dk`|#~DP$_WhG==fimr4h%l2X>eyI&C^3j^yPc6V$-$At3zKV?Y
zb?=T^2+Yqt#b%NX)3uJ25BmZ>={A-c<y0L-WbhEvv(MYI;SfUWAcjgmHbi&2+Vfoz
zlKe)J9F{LvomU;pdjF{UcYtRPwusm~!<{?uc;x%GKZr3Ra8iVWcq!50fyhrB{%dVu
zA)To`?DDRc7Iq>|851B*^$Wk|6h0&5vF(@QvAo9SBO;1=*79l~KOa>rjPl<n278v=
zxHiw{@ivQ)nw4W_hD+nD?(SQD<TU0))z31>c7IM`S6y8#f2LGM*GlpOgt@w9s7!^I
zL)%YcaDo)bC^xqCLH2);nk44)ugR*k>}J!ceu#lX&dl@cgU2`mws}4_uT2$&&mV5x
zc!TY;UL8=NA>f*jfZySYhd0N>H~f^J5+6DSJ6B)%?P=w+(UcebV39BieI`%2&x^Qr
zT3!1d2Uh19C%Y<+47^WQ7PhneTE5CtP=YlvG&q81LyR%DV*3VSH({P3aLafn`01@y
z-dW02CBEdIRN3#sWOZeGW{w<>@p8P5-*Q~a^I(Pb3V#kNo*><Q^}JuTMgks{{nCOY
ztt4)wI5!n|wX$Fw3=84EcL*%$Zje@OeVotR2Tmn&@?zi1?EALwlco?__wyEzvmEXl
z7Wa*M_zNz8{4sgacwhx(0Qis~lLbolasrp*c-@Pxlny>ClxOTnjoxodKR;-qM{eX%
zQe?I=%phfaI3w3051lOT8u|KCoh#=yTyL4>fsSxEi+cO6n#=9@KhYTl=2t&pK!SAI
zks||kOsHnOOyc#+AeAc^0MS<MwD~|YRSm+}{&pHYd2#ahAC(8}!W4cH2GnuJ5bM*=
z5>)iw-h7X$kv_HGh`yVB6tLXl$r+jpG~Ira3Q|vYDzCu@hQguu^H6GC9jy-);^&!@
zImUvG*&i()3}@FR?Inr5)iu1&(W+o{RJ;3xn7X>GC)bK&FIwbvq007>H)Z;kHf%zB
z)E504G*>Me_z`GU*8aF&w&!KbGe=bGwvlCp(QGd_059EAX><+1*X*T`B}apB9^~z*
zq#?(Q#2#9&D){nuBg{an=7ff~(Qg4+HdGIs7kLMaD6!{kT5qkFn?3PJ9EOxQSa&2b
z-HQt;{<+t><K6}$?fTd+Xh5<=VYnxN!7AG~lT_M>dhGI_=KGzQBXk}NTU$!tncRT^
zM_-j3$}K`0TsLbwBGSb%uJ+cX$vT^OHp|5b#Puq(!nIQaN(JHwPI<7n)d;MaHJRv;
z?Bn4gTc5PU`FA?nsBi4M?k|0l21swv8+s8W<67;h+c6@^DuSn2AATKo(d@y&Me7F|
zj`n%bZ`~UC>nmR&0<T=gv-tMyR7UeI1I|vN*AdX`IUtCFl|5p1%-^*1*qIPZJqL>}
zqEhC+K72HZWVYemHlZI^M>!d+idKm$@~;AmZG_zL>%ilrCJ<;~>j3au`v-kEmCd%}
zIMoy2#@-jC_p6g#H6+q_TXhFt*s;H>h<}b66pQSrF0R`hE}U%=FLyS5ixP^S7tyH-
z9&`~Zo`+YCL+|KUbZQI~+qk)jN-@|T>U_gv=`!isbim-xpVwRX6n4?7iT`0DLL)$c
zxkreSGJ%>VhL-N()#755zKkFN=UhalBuT(a+RsUE=#T+H@+#_&R)3C=$5ME|*t{w9
zUS6tgF=J{9>krmI^>-eeCh@>u_{RccVRsol_2dkkgOo1qZbM>}#K>+f_K%Npf_<cP
z7T>m*OHx>j(Wp3}ZHlO-q03`0qiIA_JIdCV#iAtervi_yna&9z*qdXBSDA(4k=^s8
z8>8RT_JO0MQ@VHHxTaz08*UTDMfL2X{sIOyr7D6<)P>^Pc!VLboh&%+DM~Fe91-v8
z0T7sP>-^!XrVm#l)X@kC@#?Zh65t^8bogn0`w)NsnsxTU7limSU>E_0$sjo1<CXdO
z=24&w^hQin7pXkiTPd1J=fz!gf!Zl%vY3xiG^mjI;oiwkZO~Rb)H5Fd@8?>0UF10u
zeID}Jc<lEV=<Cn?*v~gKF>Wuaq5eM*$0gk#P(A9~UB*I9R5zcVo%fV2AT9stYSG77
z@VJcNAG}=vF_F&&=4)(S+(CMMW&1Ej{o)@zVl6uY%V^b^ZZ}xVpxDuS@C-y$S2Frb
z<#jhqAyRXfh&4ntxAQ1c8zKp2687TrG1?K6&x~4k_&Ytp$9Z4ph@_bE_u<NxO4uQu
zzoIM)5f@hQ)2keWq}jsv=qa&YYt^(^+>dbVmk?AowrCmkt<S0B)}*Zu4IwBakA5z7
z-Hmop*<YMfM@l9@;>0fXJ3?cAGY9Lo6=%1q`*i+9=W4kGX&LW4O4@o3(i{7G!4CO&
zi_3D>WSc)K4o{C8{b=NAi~av$0#`vZdC8X^PtU|n=-|pfF+&viOzdjMom1_C)Vbnw
z4zKt}wigBO#{HYLpN`Uc6Pvhiu52GU?Q;>QLe`R6`SS6zxlAoBf9=lYubB_N6$J|@
zVAY6(3ii*~c0U~MZ&S%ulViO4lAfrjXNbH#8YHc%TIT(jILc0~RG#X@L+AshLpEwT
z0lpTu|8HUZ`be4|nP1UC;N)zSK?04A$;o>D-Fi>A5GS^z-*7O>O97uBU&B#N(ZjL7
zG2)Q<C%mN{57Q+(Q4kpeeW`atP%V)M!{NY4?9C!(E3sGCV4dM)8`3oMzC-;<Z9Aco
z>5~5JLro!b#@*VF*Sxy)VYI8{<#um5p0_0!Jm>$m;OfjTP<5R8*i!O~n|!ovypEhs
zo=8Q%H|ftol)_(;(l&I@i3*T5C6r~6BN?L?A%Wi_VrdvWZJ!jxP2u~rz6fJH69<rF
z(2phH0mvr6bF|D9H+GH`VbH{phOCd-8W@gxIQ@ueu(14pOuc1TRB!mMEg>l#D%~+4
zC`hN$T|<{jcL_?Pq;w1=Eja@W-SrcY?iy)n83bgI7;4_de)oUx{Y^i39DbO!*7Mx=
zd7am<cRt5axPM2CyS;^QKLab%EUmlLZT3@DqIG6Iki4Drk3vdv5N~xA?QFnVrFAeL
z{l;R1Zm||!Wh`5_NmM^~!|RGZ&yr4ErcXDUaj60SYpik)mjv$s{-#CZGVQ!8Td-yb
z@I2kktR;k?fm4fTspeP0#JRbErP+KxS$|zC>9>4TCT0_^^YW$qlq|lT_dg%x{nzJ5
z#=>JjBQ}3F4ix$#&Ba^%wG6aW4kwT~^^W3fuh{u0NT5C;7+`12j+?a?0`wIx`T%88
zi?cW5^?R2@ec$c}5n}gGyoh?B61uz!2MH=Ks#4JT{Oy^kRnL8rh-png4w$Il)Tt`4
zg>8Fk{NP5h8u;BLNlw6w*l_hOI0-ph>L7{0Ec>sSOP_~7kY^&SbGc^N6V#F1FQKZM
zc)WKtK(Z~Gzd5wqO_z-efxu(r_--3ZJe8z)EN)@BK^?L{T)-$R&=^!w6|ptepWgpe
zE-~g2q|fQqRD<{B@cjt?7NA*M$`hp0fc<&Eb>RB-+A(ys{oS)kwT}5y!9(iu?wk=}
zb4y*O8Q-0nAtLqTkAqV1rslKwZzT5{qf-=gq!8?>FYCLCthC!GNoup3{<N-S<h3cb
zdjMu~M%?clvlryJO?zZOh*J^Z0)N4o*a?~8qX9W&zzs!Mjh|WHt^wTHx=9s|>m$=Q
z*TyQxz|6!rS?){*5{i-*H*NYAvq@(EpX(#$|E?Z7dnyUkeluBa%v1S4>pWgZ%Hx{F
z?eg4zEOA5Ij=(~U<d40>!$Lgkx^1;|cVeL_c3fJ$WwjI+1?t)?Gj3z}^VVp=Y?HCy
zcC&MX)7m26J@P4-5(96(!Qp{CB$qa?l26^OWkD7<`?3>&8)E&^%~*CmL9VpUa;Yr}
z(#3Hg(L8G0@iGnXCe3K(*Vgo|y=7KNG2FoFwhL0dd9dB{Sgxz^>I}AI(&U<c+<sni
z4Ib>fr8Gk8(bs??FI$6Uz<SjUR!hc$Z?BpwgRW|&ENh~0V0NY?<*R4yjTbX;apN{W
zIv1Fo7$tZRlpaks*&=9JlPGn#dGXeGkkNA1WaD~Mbx>m7si{+0D5Kh?z))JfQuEUz
zd}ka`v9|BZK?Br`)H&^NrtGg|<f|oRo6ZBf+}|Rr0Dx+oc7>%&56j5Tk2I{P@||pt
zpPly%raxLZj}jIzAZ<l9z|C6=EpJ@A<@4F9w096rReE^``OcRIl+CE6(Vy$?j}Gm+
zX9?-33<vV2+>VN+ulIag&?+_Pe>RFWPS~9uwOG^ICwqV#NHbRW0Zq1c*|)#t7_Y?r
z=VR9XJ5R?93|SvC-W>3SsPeBuKK|8dcNON&TON>a9~|88`$L`CvqoBi2EGdw<AIDp
zZD6dFJ;3f@#kacp<~Y%<hR+%@>NztK-0FOD*FMr}F2SR7$*#k$$IfwkIJ0?>WmEIk
z_>>hpeG(r5bxF)amA`zjIl!Ew?Yd$p>W27=n0srv_sh_+>P>FCsS;U!=KO~k&_7LR
z&W91}axd8IN^Pcuji3|#QII-wT3Fywo5Rpg)5zWLg-2aos|_QQ=$F<9>HL<#h$j=*
z&6_S4{3)AOtHRvm6*xe51-bhZ{1%{}rSWOv70z}pa4h6~_GTv3byc`J_}vWg=GzyL
zMq%7Bg-a9t9=-UX!|s#<f2Ta^hb#+Pdg;lV5luU^!SY1%*r#;m*bvc)7dQ~DC!D?s
z0H&EVEZ<jo_3@o1UVkALTuSKG23U7QdRS54=nKWu(jgTchNrJ{hw0Bai&)ZvM*ixx
zQ?PO{Qx!cZ7qM|Wk5m0$)inXY!+nwdPWL22TGTR^6U|=P12JUXd0g0O`%O)sZ&+QM
zGi5mK(aR)i-i>=`5kFBHHRP})`C;;p?dWxj4iLJy2>FG>+{#?aTwos^CAZryaNAlh
zsCK_wB3CSQX~_I!kr^4o%2uS-R$4*+6)a2CVWNPmezyj|%|W|=8YV;TfU)L6YVXy(
z0emB<1}T|h<86UcvX1oq???91Lk@0LPPU+;JA+5C?<Ijs0yu&nzY`18N#AbYpP=&Z
z*_?L}@7DZ-F7PeIB6r#f9a@~DM~Q1}TXYTfZ&|->fOjTlo9lBLxEj{~+?rpgvP|fi
z;ak^`hk*L7EpeoMV*f07E-f>v|Az?g?~k)~*+1uo_J)slGOh2j?|oU;z^5nS_dQ%1
z)%gnB;Hm-I&1(0$Tll1$oG|9!NyiiLgKr@@ZKQF%XRN)zcY--IDj{vX>4iIL17Kdw
zo0wCr(mO_$sOE#@z@~BU(+9gLpqN6}GeGlk(sK`9&ps(YiJNDL#MS|DvPQ_$oKIt6
zuRhm%F;F_NJv6=j77rHRdg8+RKLOz<E>Gs_eKnb^?BBjR)gK$JvPyLr%S!oE_70J?
zu1THp1@g$1;^(h7DUVWPqGQ<EN@^<x(4GFLQLbQvo=b(VPiU}3*-ygPowE#8vj+w@
zLIXo%>DxXOxZhkKTyip63~uZJV?Adx^6j65S*qXV(5(P7p#P*j>EKZFBTv`%(`bzI
zQZSu_^Q`ek;4J@|;$xtM?5$XXWk^cq58WenGWGE76RF5yjH>Ydpdk96ucp6u66!zf
z>JcNm@KfTIl{o9tFVd%|SvQJqD)7WeIjy%^%~D(s9Frm&njpQIiGk*AmM<f|cPALo
zLS8i`RQ8ZF9jY8wTi!w+HGLTmjxgqA=2^ci*HjaBsyOGHDGxYxd%QQQh43Z8$R0-&
z%gV28&tDsN&U=d2WE6QAgD%?rl!79Tubn&U4YHGsMiT3t9Ih%DsqxY5G7&`qU^Ke+
zrJtvzo3UcNAEM281MQ`9XyAk>dwi!BmsBH}@7oS1p)Xy&MqDDC_+7*V_(<LU^Gq7~
za^0S=BY&t=g0%^k6+{-ktWDu&!@2knAnFuU6DSG|5{Iq*<->HZzW%0ndtfDz9@?=N
zCMZ?fA;}d09wbcQlU<F~*_E1GhwY!^GR<RY=hz}`=y0SjnKz)_b0HlG(Y}s|azl3u
z4}`Ik%T3R6YZV%MQgf#2M0fI=^J)dNuIv&uhwIU)-60JJIOM9}%2C9%^as@q>^9=M
za!Wz*?Ez-4jT!i38ne&bd9c3^1AI}Z$+AggW(s~>nc(;Jn#V2HdNK_rL6`7--oZko
z0H(1sD;Ee3U7f*2js<sZka(z;m7N1(E5&?Zp+z+#g7pm#;i@O@)~}HKD`o_jw8?<r
zIrd)3-tpbhaqRu@h_jAB-U2;|xtV+)D)lXyYzs*HsK31@)iw9Ga$Wj|Z`qul4}OmC
z#du+FY?TLe5uwUz2{U~PcC`x`R3Be7vh$Ef%?#s#{J&Mn0=JzHB$<sr?G>+pLW5AL
zTcfoLU=;{aUJe5VV4Z-H?wEQxgZY2?<aO$LfTCNv&#K*K2QaOf&AlntZDlXdQ)!n{
z-EK(G%)YAP5pl)2jcrrUG@H_`0Ybt~7A)vII)8A<Eyr|O6!e98CVNT9ceq0`ST)C!
z?o_G%P3P~Ii1LCYTT&~0UIZmxaQ9U_lzqaHe_FbH^;X^|y4`DJ(iG-nnc&lxO}5{a
zDGupr_gA8c&qh`Hdv^q!oGK)s^VUu(Cqd(<BGD{Na^;7(O;0iKX}A2TgX`qb?liIS
zXzWkESoACLY4O2tfZ)J0my4aRoTu^&GK-hD|KZC%@2A$nFFlQN3sIm3i4E#u{O=dK
zZzfellMQ-Cm^GUpDiX%L5Ng_@_KV6o@S;E1?<7HUqbDQ2yq`GJ<l#wI6#DW;l}=Fr
zTbe5OwR)Q=ncjnUxFwX?*ua>d8ZKjiS3--u!JQT|5@h>&h@8qbwxG7&iB*SG)oC1k
zVjEjFdTKVr0ZqLzp#3^;oiF^_(Q&)8@kUyI?>J~r>hXQ5mzgIZq6sSK3Y=e67NviM
zjI!^C%TNFFa<EIcz2mE7`NE-}>M$gSsRSWn{$kZ}?A4UI><=^z%RPfKN%TfyLfKsP
zlz|!{GNX^D-r}Q^N%yrM2nIk8LhKV*2z+c=s9u@Pw-3;`%oQlMsv;n=4tE;6Kh^6e
zihxMg;eEM}Qudqy%(UpPI1F{ndfNw;A!*ClIziK(RCEe_jz4<*owvM+U*l$IB`<ka
zE~2xzT|YFfttPghi9n7A*Dk%V32Eh&3`;=`9vcIe1Vjj+oscCLwt;orud3E%&gKlP
zUA7R|Grv`}cr{h!D}-rWhJu{P9DuDkltDb2Cz~cLDvPJ&sM7wwFqwkKb|@Wogp(;L
zaxcC6@QWvjgV|ILNMmnRbFL{o;dtGDi+;ToK`Qm<uiB5dx3FwAEojnWXE6{p)6d7+
z5qAy_8G7Pj<1f4?m>pha5dOc*zn&OOjaFN|cS8;Jmpcj82cNS^ty$UnFE70Z&bB!~
z|3>hpk-3}5Fqdx7L~DARlW0-y+reznw>e!vwV_TEc5xz`POoX!{X|vc!yRD0c15jz
zt~>hfK`SP`J6W*4Im*65BDRtY_i9X-r53&T`OcMSmKMhxC?(#5Spe1mqJmZ#f~49@
z<`Y8ySEY72p$a#~H9nK~4O+XIFH>~PA6W4v&HqcLJvwpXmJadB^9(ZeTrJl-G1}70
z=Mme)>W{>LAk2wfVV*-d_-7llu=j?29EbDXyRzv$GwN5TuZ>3<dUq=h`XzE-l01gt
z6d28vpPM{9L8D5wjFuZl+ToUA&h!r7wcT=k<nx0AjhA4D%KMJSyRytkmwDO#W9P4G
z1s)x;>z7-SXRp@5c_2AwDhqCg^oFa1nQsB`-89e2TT0BzdbOn&_zHFcwc0^g*PPSO
z+xYTBKiBevrZ)*DbrN(K1w$<WmM9>v5$aBmgEI7|B>Q#qZ&rtyQoHGpcLgbK+@;-q
zo3(S@+@pON!f%i>clk_LQ1)5(t-ie>255f16_*d1ckyK*LF(Lnone{U4U$6npH6c9
zI>@P&YQi|n!rZ=G&xKSXmSqNm0xwwBoSEkFgYqi1e0n^}VF+g_{pGVlO)&mEW<UGa
zR%1d_^V?C6mb+3^#lft_#hLQY!;uQhpd0v=p#=nbTnv(v!}G_;CV`5bt+(5ebp~>0
zZdzVf@87o<)Xs}mVrFILy|j1q4{h=W{vdOUNkNZg)<u$>FM<%K|3xqFn=V1+u*TzH
zldaCTRLmjsA(wJ?gL*!-?oMW10V398Ev}zBs-=LUq*Uu=X@Qzx;LfRr`2F~%`vBfy
z229vwKo9n>8uHJoP@xWazDEAz(Sc(x1|7rSRg1fYbF^tY>F262cqtNvEBVbp-~X1}
zuluow%3o}7C_k95U9#j3fy?ah>Zmz!TA=zp;66zgH7_;+ZIZ8lLSRtaM-0O9gC#H+
zx;{WvqAGpV+0Qm=Dnss1p-o3cOqb02n_@d#qcfRO2q^Q8vD1!Kx`IgFWr47R_Odwd
zpgS6Mwl_+tl6yasHGBJkkNfKDjQo>EwH-?YnfR};dXf{l((i*Rd4{t}PY!3UfYG)?
zbqM~_c<@>G)M)Dqi|0nX+A?Cdxka(akL6xvtHQ8Z3k#nC<j=Af4Of5m-&;C4edwa|
zD}U)X>LB8ZnV3H6DwJIN5YV#o!I#u9@47|7H@~o*&WRDcE+&=k%QD4x?_E)F)uNnz
zy}YD+F4_$3I)i){j5X=V6$iY)&j4*((;|@P>_58txFBhI+D~J;$ll?d(8y@!Lh#yY
zb?&N9ytn>TtBTPh*5(j$`DZD^Oio0z>7^FCTgmi&IkAaK(>N-`=d^zLyXfqPkt45N
zCXc&(pi3iy`)goop4@Pv&hE->$T!9U$B=^LTkgR&jN6fygl6wrN^8t4d~($3cgty8
z1{cTC?)H|erv73|{VM4o-SY{Q5Mz0eo!IJ)<|JmB>w47>Xcbr&K#*;W51)W)c$2nY
zp~n(~z7c&3l7*(~pz7H-et9$P?lw+Nc=6ssnm#OFyWEef3+^H0XTRsV0XEvVLB<6w
zsfsRPir!AgY=C9AJDynZal;RNzV7aN!xu!VHo$vm)$VObkN-qzr+&ub_<{tY!9e=d
z+wwShYca*<uB*5b(<YGs4XO~fusYR2m%<Ol6N*1{!=2by3YJCpvs9$p4ma|Xm-&6$
zec)T$7OR<O)smBL0jl&9hpqfnP1fmzZm--XEcuorm;AJAa+j2l_-$Hem7U&CWd&N~
z3NpEkmk!f>k1X9MS59%y^fCntdIopS|9<=c$CTey`W2kYn7bvs;JVO5x|#WzF9!}A
z#VaxF02h+v^FPan{OeXeQY(6PQ%ApNz;4Ce%<k6vY0!Ki1n{ZSOa{9Lz`jq4V8s^Y
z(DBsh+)T)NXJ`}WwQ2nLk;L;)b@YSc?mgFy%o&51&9+nj!?HgwOSV&twot%B&=RC|
zS#?YQ(#ZG`_qYYwZBJMg`uD7}yMN*Fl2xQ~$R$!x<4I;Ash(OgHqNg~Ia|cTIr__`
z8BtgD2987d&Y&NInVn1#gTXg7#&${0bZ*m)5Z;!^(a(YnuAk~^l_nD}>fjBNvezX(
zH++W?#WgA(K-0~PoHfXMb+l--0E4pj?`7)5fbs>4)Eq2j13qc8`d?mE;5b3Q{!ID$
zsk;_@wKGWjM#JAP5h7T))&=^pI`L=3b7qbZWRCGI@BVX!I>YX{HSTFdI0qUnpW0h2
zeYzPHysOY?@|xHe3`$2XOF0?b2GHQme3G-?1zCFpgw;3?8#j>w{lz-4`s*<9;11NS
z#t0~^rYxPg6p<rWSOuO$8c1F^&G=#>pB<`$#6FJ^kr&K4UmngLZl&$ZS_?wH2pYe-
zZKj7=f4)W)GI^<EJU2!Obh{y(ZV?~DG$lU9_bbv)A<hp62t&IhGk6n1_)p6!gPx#9
zjcZoN0vf}64|Wb*(%X>oQ;1s__d24p-MGVnO1J$)<7d0dmR^l@)CVEvqCFE|S0@MM
z@K#6S`SVKAUj=>6v)iLB2Ixc1Rb;sDB&D23+Lvr!v{^S?r$s~RY(n^lf(`9XkpqDW
zFXkhUCgcHi=76Id897)dfC*6q{}a?60T>_4*msTEizL?qpSM&ba;r=2XaxSXU!D_%
z*))%lld4!MoO1qHKSC!GDKugB{WodS+h1+@pFJ%Pa%O^cR&)Y#trqZcBmIE!-TE`F
zOzRN;w>d8uXY~!`Pvo^8zJU>+nlgL`N<qP2btHd<;i&u4C$T3<3t6hLmeCE~AF=N_
z(q~9{3&DWtxEYBN#fb9vxk0F5-jLqg-pAd#RmAt=92;5oNR6!cx)O8bE8kyC)&fiw
zh(b-pc9}$p-7M;m8vFl{Q*loGH_5VduCQP2$P^4;^|spC)_8K!XN6!RE$B4f1Gm~7
zHK8NJE+f{4cZa=joU&eO!82&!PzUOje<jIq!6tQy>ip4Sn7{ZZ@5><-S^fJ3rkRFb
z(Q0RumsYU(Z(q_il6b@Thq1;ZFUKAt2jmhy{3lm@a~&~v3fqG0Qqh$wQxP>>h5RW{
zD}Fl@+j)(S+&s1Uxaw02lmFdU5njOkai=zA0c$IL4LGRlML>*a+7dWPG{d~s01S>!
z%$;Fd6&y;pctZk`pFf*QwEqu<nIUw`_BB|#1y)hf>P#?koPRGCv;kD>a|`u-uj$7l
z4H6DsnC)yljyA>MVD>~8ia42<!-Fzzy~Nm=t$i>@Wdy{ABSg$KPg?$9j<q9Po%ewf
zxlh*FyHlBJ_C0TH7#q*`pT{LHztz()4aKUMn)2N0#J-PJ0fCg@eeb5KvQZ|g8$+2o
zN{oX!<?0nY{JgG38-`Y{i4FhdH%xW{x!b#SK*~E=7tl5`b4gs;;^V6ApPXQhdE*<D
z?(e3)I5_g{OT)VOoKY)RBzIy~f9g!Uv8nn#Ykclq6eJt$uvnwhAs67A(?l&~dHw9z
z_?j(<*<EyYr!NyNsL9&2ZDC?)yr6cjA?Ijk;I&WZH44env4J0NC;9O!u|y`Ab_C@o
zYQKnXe9KlHuYwT&Fe0mDB&?r>gEo806=H`{-zh_Fhe9F^hJojLx7`*d5SeWl5@cR|
zmtmHS>?pc3dDUmhHyFOMJL(O#gjH*xK^L=NS)Ln{Wu{-nxGu}pu8A$2nKYm9mY^EY
zn-T$~Anno-W|1}U@?r8h^zIm(Nv(4thdGsFh8bXOhDI^pZgb1|pWSb(=*%CtFXeO_
zwAp2Xf7y!G4B0Ye+XVqc@e6$3(0wb-*JWWSoTB+xxc`rMo}oBfZ9Q2_n#*1DxxZe%
zh|82_EysJT^N=`xs2T2pR0Vy^bHhE>RHY83p7w{!cT8%0@;P~jN7K819Ql8faBICT
zkDP}s(s+<+2%*gQs|6$*{*L3(##L{3wNK0F*M^P0tIo{W`%2q%Ab-{6|4ic9ME%g5
z#?4aJ?C0vS5LV6_m##7>l_D;A_P1CVA>&M80NDJjY{OPm`E1_p^wrxY7ag`n@Tgu+
zrZch7-~gVz$RB`z$-LE7OwrycO?ayl1uHZ7-E2B_P!=cJQaLrC>sxHKYofdahgd~c
z3O(h0TV`;{bSNsPOli;kj`U1zaq0+sv{bUD`(&alWywj<EuvGehRtWlRi~!VVu^z7
z=U-NfvxiM+XJ+h>z8>?hhH?k*0&sa&^I}YxKx7`0(>aYu&SyxEgL+e<Ckjt|US^QD
zh_Sb@7M@Jy@TPr{Oc+JRt>wl>kE~`!bHj~T-z~K7K7RdTr`%6X^2L5L+)-tKO8Qe>
zW@F_oNqIGRxoSvWJ%?aWD0|8MXjUU=#GykHwcY18*^2b3Gx(aN5}P|S4x!o31SEpp
z9Co#ZmYk<xJ<j|__WyqE#jq!;?&X)@Y+ws11GnYe%di;6{Qq81f@hD^*zY;>7y56y
zD;b~SQ4-OY_YGsB<eTEpmeX3EuN!sYK{Bnz%H}_zKEH|Be-UZOsq3rIBzx9ja2NFT
z3kKeC1iFVBO4fx=j3SqW%baa#tH#R=dL75UcYJ#OB$M^bacncVDDR6|(QJ^aZ)II6
zm1%=}uGwRrPQT*^#jkGmsTVx^%5tIR9?o@)Cw}5i<V^dL1h@|(h{K$6-gyd&RT~Nb
zO#yCKMz;;k2K524MZ2)22M??9?B88}B7Cv@QsA~B+aqVh>F_;}_aBxEt<UblO0jpf
zkxe11cdGEVS&d9P@{NdAymE5DR_p&vw8(8aI;hM!_L{2~#8o`fsB7;!HyUrC$68>U
zrVFZpJkF-v6pLUP3)}D3BzUS1_pdhPi2f&s;%TsFliE4pM5{T~lr3gEfgpaFcTwy(
zoZ<$G37TxGDuKpbAA!$KaCuX4`293I9B`nZ&+jEE#s<dZg+hcd4&DvaF;@h$1s4`)
zJ@w?$yM(7gDR8>BKT&gaf-Xp5DxDdT`7~}fLu3W(rbb;<yuliGnh8+OxH}Y-1>Xt8
zuivjwWYfzMqA9g$SmZxgLwqRBH8*54;HuRftTaUQo65jkrL(n43Ub|#n1^;!6B7x9
zb*oqz_CM%}e|v(Cyis8M!m~Ltn}g*NBX4+U0GBB{V7m}+2u^@4%2Hf<FEc0eN*T-A
zb^9_SI)|Unrw<vz0#zg1j%+goBMGOYuilY5ZRvq<pwF+np@A&IF#bQ7N@C-3fodd1
zN!z;kiMqCd#MPBCGtG3>SW8#m$`z29-Bc3ATqj0;$kEI*y|oAi;F;Wiz*awmncf()
z!zt)LEF!=^hH=t?rOZxTrfHs#JbJ_-!hA4l_w~>$T!QHM<^A=D%}e{fVBjOXDda-c
zg!upQGnYSzKnq%25e?AR&;<?mVzZv>`G5Igj|6(!&44acw^|-2DsC$)^SjY6|3y8F
ziw`-`B=$d~J-K=3R-OQ}(tR9FdsXs4XhwYDaY_F7-S>jlQbhckh-b=4xUK;T+eNu7
zSanZ`7AwrN)rz8}!Sj4k#1tWoZ!|utQ^nl?FD23?YRDCqTgG1{$cAdj-$AbM$uwjf
ziup^bnpj1`0<R`kN>Tf>`VR)lQ^p+!-{$JN3tvvdmD5(fd8+uF7ROGrMZU*A)QKQl
zar_rI9d?BqOpC446dzq&%dzvEHZp+oX5Vxs4%4pnnxbamY;le+D$N~zY?u2}cWRgM
z?BREvt&ynDS1)s#SCQ)KVgc^Z1ZSLOs^0blnq<e{p~ZC@RVenm>5t97P3NJ~)PqqB
z*Gd-KXt)E_)<S#oi;nbL&!On~mnYiaqxAANb)@8fh5f@>#1f%daeRQnvnA|}e59DO
z)0uOnBdAMvKpoEnt!3r(Iv!9)nHncEL)la05?)EdT{=E}RFI0ojVR75%xV;HR_m(Z
z@c-*BV8@$yNFAdnY0w_ja}NQL_s}6aKmWe^4B2BzMao3@K(k5kS9dpoLy9?;Dl?hu
zpQ&6UBIyGgZK;g)Xlxs%rAvVl><A}GQQ#N6hXGbGv&r=CU1vtLiuj5T-nccopCT4C
z@c(`QR0U$CPd=G;N|!w{xf}-!y|1z9YR8df)kUN~cZI)EkPKB+Xp!Sb5Dww{zi3WZ
z<6(2<5Yk(7)Y(q#L>GYh#rG-_0#k5Mb^Q1`@aeLyn-~ZyO*Rq5P@4TneN)1v;vEGq
z2cJV>8JH4oAye2t_gVMXSQ(8#5XBp5y>BVQ6!|Yxe%<Yz3jK<CHrz8(^40H7d_E;L
zBDv=A(T6^0|4Wu=+xpj%(Qh)+gGc^;5zf@u7}m?!v*#*-=I2D@jD9n;ZQ@1BZxin5
zxao4RFtSR?`wgS1^;`(r)a*2Ky!-3RkmhdjHe4=`RL`RSTF7v}COG3sr$%O@@lJ#h
z@-hRNIR0FRjTA#X{W%BGFUy4}zHl+)Gf=p)?1d7fsE!Eb-|Ws<!PH+V4{tZs!y9^a
zSW}Y-KEpfd*s$yj1#U!3?uvz|okl6Vf@FUOLdWK{8@{E)xa_Z0QA1|*SjqfnbW*lV
zE46sKGV<qtd=23!Wrsd3{VTLs%P**s$Q+jJXrm9}qh~f)656-8l}mYWdI@gkUi$K5
z6>O$NJEpG8`Bb&Ax-CS!WWAE?GHICi7-&`V+xP<HjpB*9Ov{Gc6#JD*Roq&KHX0#*
z`B<{rZ>~-5%-CE~fxnywsoH9v_t1r;RgE{W{EzA}o_G84;QK_a^RbWGkMA{C90l-)
ztbw20zGv9?5`;_Z@KmA_K9R)x#TDm?S}Xfdbz3s5ZI2ER@Mb;A<oPxKNco+81><jH
z)%Cc)-)eq!Jc|ktDW3ieeplkSHH&-VWck>!^igU37QwJ0P$?WUU)H%EZ)nxESUjyb
z4>rt`n;Q3MIWK*DoY0mOZ{LBvgll5G&5(3v2xklZ9cOnoKP^zX@%d)P*zTLI{B(Z~
z4H7SSm5i4X`==)%MIUeUM#yxJ?DNzYVB8FVAd4O0C-!OHaHmY74e%Fu?_3;@ZWQwn
zsDv>!%d&X$1!rlwEnPc8tPS<50U(=0dQp9{%xWz6?6WqSVFIsShl;r6hDiV&oq)ef
zaSQ+rvG*o&H44YZk*}UCx*rWJlev|{A2iCcZceC<zUpVqh6FT*p~8|C?w)&b#Z)!G
z&(zx#%5=peG?p!l?TR)Ye5Ui7aqogkk(HLKlNXcSi{9M&7^}S$rh<Bipjb{vLi!?$
z?mj2(L^%haRRXMj5{vfdo=^XkrGC;7R+1u`$y$2p@YZOX_miX|*F(;jLVcCHlY5^p
z-lgY^X#A{M#Q+@0T?pS=0byYwDbe7o_t1(4Lb(VI1v68P`2d)Kx|6?wR6b9bDTiop
zmp{i?pg$@}n0<%vA?K?hXip4SpV~!q4?owm6n6&yRWC0(hFo7#2Y1@vDE8^=HBXm8
zL&IdhvNF1f&KYuJRw;kOtZ$SmS9#+}yl~K>3P+*7Qh%NXBadY`!{)qltmeo_N#Xmk
z?JudSdWIQLCgD%-<agUTO)H7M5AQ)MC__8_OEup-CI8M7%_*ce8eQXA$&vbniksAy
zN?&bf&_aLytzekvzIE=k-=P|}k<o|>)B-XrsK2LYSteTba-)P2*Ndk`Z<T%aU8P!$
z#wjxQ0*m*$@Lh3p3ZeO$|Bqsb!;RgKG8DT*uW^U>Hq=Pl=4r+lEVg8K909Fq_p{gz
zdc5ernR$#6IyUC%f@lbg)^}Do%+ve-g=w`3zFu%%6mI)rMY{2v>s4X|K?GZ}@P()@
zBM!lG+Mmm<^pg4+aCS|svmwf;ij@yt?-9-FW@cw~M#fv=+@37^%DOmd<j-S7_9-fG
zsnMy_TGmsAf)qt|Z6#9jw`u0-|Am^_#7@7(L7q{u1P`;-vf!TJBV0viiJP=IH2i<K
zB3cQgQB&XSxqBmMHy3vJ<W`rRPIau&9`V+%0)E76SL|wxJW2K)N`tsA(DW-v)O{k}
zk5UQ@J~6{j=kx#FSi9tM)%ergko&I_8>wgx;-L^bmjMTZ=|_8<EFl&_wuk;PSub<1
z=tyn5%MJXUX07ekhJ%PhJVAr*wx1H}Jb1K(P7tK*i}8Al@X4AW!-WF{P9jw-yn4>t
z*Uln+FVdU3<*g(8<<T=b`zqu|0V0N~!5Uhwt%v&bV)`e}`12jTN6jg%tXENDb#ugv
z{d*0Jl5X~JGTk2O@BqDaQ)}G<xNzRiXzcmJMP)aL0|OE~Usq->L3}tibVjtv9kj_b
zo}l94UP*f367P&JCvfGj!2M51nJ-uS(6Z#S)snqvbjp~+-}I2XDQ|*%!Q#^M`xsrx
zT^~br9&e3rq^9_*Dwh0d{m1$eP3(^GMn3}&n~Yyjsy^KXawTt7Xo}p=>gzsVMLbck
zd<Tm=S701+U1)#s4j}b=d-)l62)-bJZc#o_To#5DW|Rp++pq^%?+Z#^70G>jRFZJo
z?!TeB=jY38@OSJ1J7>78zK@qj_eUG$a*4zC?gRh$or|LXvQ(fj{q1q<aWNpNfX&OD
z9gLMsSJlIXO?FVob|+r?^_=1-#tu9F;@N`EnH&Tt;B_ijc3*aS*LTGWLdwQhX@l{2
z*}{kD+=YYX`}5wB6b<HJ!@jD~P1$#f?SXA)6ph~UitXK&1?x46BpIf1vtYoGP<;lr
zs6uxRp)lfxA+AY90$!~+iPuA6aXp42g1An-k>+0?_}CXkWj*7=BcxD>!P5^LF3HMZ
zzk%!tO_x^WfpqmfK=n@rYfL_WB^h*O;<u~>jqxzXwh+b8m<|u6`4BPs+;s-Tayty;
z{xmD$j!q@uNTu$f3E@&EVJ(x_JUts~qkf0NF95>Rz7uGC4wjHv(UKd;XmR?iZt6!x
z4vJxJgwvHZR{=*4;J7`rMe-Gp*`|T_e=mJ76-5WcT9=ItrR6SB5vicKH(B<7K!a5Y
zfz&1~jcaLjS&;3iwZe$OHcQRV9VBSAyxVjiv)^*%>rQMZ$pF<V8`GE2J=fnlDQT~6
zUIMMoA`oK#Wo?hYLw9T3PCFPH(G@5%jGk5e^G~yO`A)^4)LbkGlarihX-Z?g2%Jd?
zG0@S!;{_aAD;R_I5`LCVUY9?XMeidxiAO&G6ZfYi`47WRn1$a|8J=n*N7xzN;;rM3
zss7J1O`0mMh^1;>$C5URNtVa$Y`p_Qgz7}{U!N@X3w06Lna-`rrV~~f4>c;3YcXZZ
zm}Wi{3x4r4@llahkslYADBc+^Er-8TIywo|YV}Nt7Rn0qteML&;jl#9T%t~`yZp?>
zxo$5jK_G&;SE~b6_{0};<+Rno*_SVy%zrT-MYSy9T4$@jRo(rr_z2}pe#e9?v22t7
z&*bsDFWqxC3hibEH@lKf5MEBvS4*V|XY%xVtBo3&G5-3BOIh;4X?N3(#!N7U5w~Es
z*ow(!;R6KRDw<g5Uy66;K#IG``d0p!--(FW)~u)2O~vH3!|NKSa~nOWO}1e9TX|oD
z3s;n4<QZX;?^I&H;dsx$7wxS(M`-UEwp+h!Y7P*w$Q%2h%XHU1F|W*uV>lR4=v7D6
zW|)(~E~3<T`)?6+QqDO1wso6j{Fx+$I`fx0Yc8?*wS!$*i-R3g*k8#VgVWFM=!ie3
z|H|cL5-gKncpAz(%11VmUb4oY*};j}9^z6g5p2g!>tk3~3oSn$IMe<CNE}U$q?FV+
z9*v_K&<;V@+~@#Nj0XR2VcJ)7pB}w5^97~z$Ug-%N^)9mJ_;$Nb7k!m8;Xy@f6WtS
zVQ-E81(M=&J4LfMZY4gR1IgN_PAr?#ss%n@HC%tUweHd!4*X0Yoc|y*?xd17q-pv)
z?_E_F*~0<p1+z58l-ThNKt|YHHO@`-X6emdp9;lCX^OT)+<r5jgR(n1mvV7%<j*l?
zU^2+{-wcL@$!=Dd^DSPgBA05TV)79Ej@3ielDwulof}MCRn!((+)SIX1WYx&mv8b-
z>l)R5G|E+@KC7;;G;Hr1t9iv+PZU2!T>4TTx3@@|?d(Z<+L%4BtHV*%zv50+wI5V^
zAg;8f(yq?3f35!>XaAh`-pz~6&DSU7!3cmra?f<gd-)-ei`!z`%#T$Ry!N}RMrOQY
zWn8lBDTlxFjkUS}L5<yUB9$fH<rD)+XG5*<HlOTxbz6FBpIDLpoKIC>(<bgSz7UR7
z&2zOqD>Y@($ft?T9`bpa>hj5|ieuis62FEd$%BpJ{;{X()Ri4(dL`TM#I0u+rq2AC
zi^A(n9S2y|<d9-}4uJN93wa^T;nmcMHwM%SgP9<Ich$gjLMcd?x4AY#59hNu#}D?U
z#uzzMI|tP+bu6gKECwIsm2t)&DPZcXYieSdezJT6f5|)~aV-rqm@gVAcb$Om40+R8
zOFtdr!%4R-)O2LfMekf|ytd*pqk+32r5W?o4Ncdqd@Cdq{d+Ao#<IL@rLoELpTs>)
zJM^Eb_19_Jv-8ncmERBl7?T&k1Re|^|G!WE1l$EpGYWvG%dG&h8Wl8+oyBprj&@0W
zj?<j~d}Z8*8f@a}(qdAX(C5e17eyaU>rojO$qz!wQAmf0&UA*}@CN76hDE1cY`A9e
zxVg&LJB|02Xa=4v^Eo*BnB=7E*SB>f@YW(T3s%9bOY;<O8x065qM*{XSfgbxF_~<`
zd{!s1&5AJ~e}(-EUryhA=dZB1zjHeP%$0iJ``yG@j_sDf?8YtA;|8hm230za$KcD!
zStMD(2#ow1?KWAYHS?eh5+fXxx?OyXvF7z?9{q|t!~8=6ic9W-!x?Ea#S~cYi04%l
zb=Gej{SjSr?scmos6jv_BAAh~%tO#Q&Emk93hLaf6~T!t&y!$vd;e?F!^l_P#~B|v
zzNZn~+hUq`Ew~dLbfAFs#k<fI>XX3DHcJxSkHf>wYwEOOAb~jZ@(@TC#r9W-wfcuO
zPdM1_Ky~t3oI1eGnmv+PL5BBBXJrDE;VJ&VNa-!yyIb*B80LLtJ43z6Os&<Qr6(Ph
z!3m=KRbNTh%ZGc0*y%DC9Z!N&{9aifFDUQ#MI4-RRCJ2i2lDXeBJ1IQj{K08`Tq|3
zpfGb^VtNdDj=a?CCl~r$?3{umkLS_(HNrEjsTl(wu3ptlmbM3hawRFn;~JBRO`gbY
z#<0(b+$e~C@27?F<|<VDR-Sm%H%w*NYOP2>ZF*^4Gx?wP-E;bfCeloV&@%N0td_}w
z&y9D#Xz1JPS*cDA%ANzR_U&q-XO7pktOk1UuGDYTQInYa#Or%SG(joDOdPvggdAN-
zc1qTh$_2f0$%FTKbruoA5+lBrYQ|xHdwmoy+$_Px)K-G~R8IG3q`-3bQc{f#^=C(y
z?NzGI);)lLRozP-s$dqam{Y0r@w^K4C7t;A?L)ZxBx`=~yhKr<e@>{}$?u(~<#jc)
z;)Z#`Mrz*;g@VfclXc<>$j}a1p)G)8h}2L-S|(7kDSYFr$UMWqU^&?nWvT$9_W{hX
zg;$1ej~wXRQuW^yD*-P&U%b><%ph{U62W#>c=_L8k{Koiso;hi?ow{|bLBXl{Q*dU
z__2Uy&Ow9yxH|ngk9*AXzT>J?p<hEJr6W;uFINUaUmM||w!btE3xwwP8$1G4m-xWj
zYSlNxAaCkH@tSYb@2I<tF&kprOrwJjBCt~MbUzOdVlk8zsR}C=RjKO3={4S}?)=vB
zmoOf}H8Xsn1QQ%di&6hU$N7Zfp}uShlC6{}g>ofW-F!n;wp(3;>P_NHu&q)d8x>tD
zT7n{^vtF~?it=r2(FiXNtOKN1xiROTn>s??;FS$F{0g7Jl#*@{=yb1*25I<%D(g86
z8LY`Fr2M~;*%!A?Oj}3WZjQ>N{h;K1n3^)P=DAzS-&1LsGuLFh2CAf~&REiUQGq?@
z-J^64m?0O|fp@;Z2A#ruY3xXf>~Af5n(l->Nxu0EI&HPeZ)OG`BLzYfE<gQFGyJ6A
zo~NIwnd`3v*I$h8G=}&|Pb)>#3Uw<R{T_)`uGU;qSL8n%c12doqq*19dLtTJ0gs3x
z?rX*vbl6yj1f`*xfPw#BopYf&E(&ux0%p70zAKc~BW-5GYnS$NeY4AV5ea^%WEVvK
zsrK~*sBe6|t@r_CS2AM~&wqe{!$#OvH(f?$myvEX(4Y2y3nStQV`!eyLm8~kV8&;Q
z-^RpqyQW@SuFqLnh&6nfp*`PhFV)H~`^iDnr5ax`QA@b2nKL)uoVjw(7vU{Ga$D>*
zkr>{I<AjeF$n~7d-X+~UzjOQa?6w=Aj?9}|5%mwJXVwAAXsVv1h+0$-|8i%i@G&{p
z#uh=&dP%~1#KEg93uD<BVlEk{4Kb%3hR|jn^Q(r)tfpR=2JuC*%Bn*9k|q8~%ZCyL
zI}Nkeg2q&?g2ywZftLj%@irO%X`L+fI=Hnj&r|dS-x~Ebj!&XO(Jm3J@PM98y*o!8
zh=@vWb%sZ|p8?5iCYIeI-`|7f!lV|1j<QD({A1U?T9-gK#6acAufY}_bah!;Yfvbp
z$M3AFTb_=vKwJ$U{nzQ-4Zu@nTPM0=`>Zd}dh4fdc^JN=ysI!Wm0%M`1RUm8NM{X%
zEN1ndN%a~q>#cohF%Jd-u<Eg%N`&Dvg!AH+tlBc?qmj((V0yg*cr%5ycDF!faFgT&
z`tn8`0ksNfvtlfVxwR~*w95z*bgYW2-prpP2%V4TJ(uPQ5y9537p|M#&Qcy9y5QE}
zTjN2OU(1qC|9K^Jk|%mB&!5l1F^JL*%TPQzjW&2l)am5wb*^~_*x612705Ut$GOAz
zcC_V1g8BTxyzHvGMKj4c>xQ38@nOCoNMRfcf`=?4Dp0Ww>1J{)7zsREoD`nF!0L5*
z+&t1|X@0r`yL#JsY7=_qZzyJ8DbTj&rU_o}bJBDblQkS|hS#LJuUiG9(Lv4(hyUWY
zeh=c^Sb6=RQPZ010IZVls$T+u*-7X7l%5N^y4@yG!hR?iux8pGTpiR1hRWS@Kz7db
zYdcNA_^a8D-e>rpHsY-T;GN-pvyP7h_&uvLTX~z?Rw$o=rw)xkgH_1_;Hx)~th`ez
z7k#*Bk^_K0?E_sFdrTo)nbN4x$kN&`aW*0=_o>@R4e^q=AWFOo^o=#3QrroSFsRN{
zAd_h<4`6kjDQgF}2b*2WIc-Spqwg!9N|;VYeQz2&qQ&1^o>h4puiQz#)w9nVV7s}x
zY4OP$NyVW5rHG<x0V8S2snsY_30Q|GOP+h74<anJ!ad|bA8x$COMvmSN{AUmyhP{E
zEwIV`=;*{(q3Z*^*h|0Pm=LQ)(s=x@#K=|La*5Yxi^#!!?b8)xE8@Vy!pT^?zvjep
ze>w~9HD3NhZgx04lqpRmUzn&I*~9oRq{@M#r}Fq=-mXLm$uH~EBV+^Y>TaT;c=g(b
zrfZA}b~>>!_o-n0Z|Dvu`EQy9TC%$HhFe;5*Sc!PmV0w&xz<zLIjwrF^)FR+OX#xZ
z{SGy&Er!8%ZZ4}o=gNK$9naq2RXtg8bhoE^q1DSa2Gp9`NN-RjHDMYPB>}t8xT#8$
z*14KNxprPv(;P7Bakm+KT9PedIOE}-QC;0jly5^n>vQ<iLuEy}Ey&HPTh=%+uocm^
zNHl6a=+RAT{?YGTrE_^p6@ULli>1Ki(~O1vlI+I4e>&qkQrX2QQO>@6Zi9xNY9Fh%
zf~KuQf&y`$_Tfp=9M}5c#ND4MgEA8nUP*gdp~n%-r#;~S7<@f!K7q5(H7=~?Grx#w
z9^dKAyV;Shd<3&IekNwE-7c7JEWn5K=ny@jT=$dcK5Ur1^$EH~2aI`5o}cVCzu?fe
z*14+?w_LIZb>00wE|<9qC?hp2m=g>hUdd>*%gxi7YeTNXr@6|^Fw0+MvzA+D8oOLP
zT$)DJ^V0{iN8<PpPu2OnhNc%{j8&TCN+W|LdS-8KbN4zu6fV1~x8Gl0sk<#$EZSR2
z1qZoztQ~GAt~9V;>@}|(BfI|e-BsMd>WA&b`C7scy#pM6p6yH2m>W3EslZ#FJ;f0r
zZ9gF=%ztm`n|1vj)?>l7yp38HXz4Lc|2KYaqt#TfExB%W+t)Nc({`6NAQzc8S}J$(
zLGF&^DKW2DX2xOVp+rmgT-0!7p2zprvCA=Ww;t~2?hP1VY2@(wMXQ_<m}2gK>@P$C
zZ8TDJKSy2qXm9CMfA+R_1FP{I(O13N&a+%m<3JbU`635Q;`#F_hl}SDn?FC?7oynQ
zmp+<PJfV4ih0-cx2xzk=q7QnC)RNi982&w5^@KdSjMWud1JcG?)?OdfbH)OOB5<uQ
z)hO`Z>sS9iS9;eG)F@nPXoyH5!m0>Co22t2FiUFL*H_8vuLSMYOF)G|fx?VTzHd=-
zBk47-Ul_~_Xj9X*GN<9U<2P3F-Rd}{ekt(tRqu4Rz8Yzux9u%O956XgHttyUfDfAz
zG!Da?SE?BU8<c(Tz#jVB&;=cC)0<$atWWHd5vGUiNDU_EgRXOu$m8X@Zt<f9F>2=h
z3agroChCkZYPQyLL`@=^GWxG8P7#An`<V#Zz><RbVlF{yzV4f)^&z!G%Vm`L@#=t3
zH<yan!^@h!`8!pWmb*pwc)fz(bC~7GX$^Fk`(&A)?+o;IRPk-iU8PNxPD{SljeEH&
z-oG&yG3`fUtFmLxIZ&50m|*tLzlfk7*f;m1DK&JprFD(0N=L$|{^AD4s%UJluTpM5
zG@!Z3g?+7nIf=%aCWL=ReEUG>;_@G#s|<c1;qsn~xJ_t{jU)GET~p>A;$UU4yk?2J
zea9d+l0O$k^BZ{SLEtS0(<zk1$&1xi-@7U@JApx%z&LY})o0WMfcxid*1+~u-J-8y
zh-Kcr=Sjd@tRc$IIsX0hz&+f<O~X2)5V&TSX(<Wo<ypNn2x(p5wL)=5vd(D#T*IZ_
zXfz=0Edalh{_P^`CM(nRmF9q&`=VL+Y~aifB&|QS54rOzYg+oTaT-xif>A-PuQ?GH
z=)kvX($Hn?^(A9^i{B?bM_gL%=Amm4y!preMl0Qd;PLPx<o2w3?z|{RMN%TY82qQt
zq>NPJ3w`E;vWel#qe0hk!X+8=XkmM!L74j%B)Wi%hh+XDtz)^OqdBfYk{LGfu%qZI
z7g_QZ;k2eFhW}(DxA|+CANtNT^Wt!0?v<}BHNhi%@~}UP=s5cZw5Ji=<UVUn#~FX`
zL&E_iT?|<ONcmv5O}FOz7>P6a3J?a{<DyLI^)8E*{M<BqUsJDe{<*qZ?DR!ScvYwf
z6VRI)HU4Slj8h}yrJF&%FE}OfYxC|><2drY)i#+>Tx|N&JML563C%h3Q<Iw%kfx}0
zDMkc^iM{DzMSCKj&j)3~*eWUuO%${3gss)EICE&}yqQ7tv1uYUrOccxqYl;+HdIt*
zv>pa%BQw*`iCB4FvWf>g>!thr&>eA3NXhf?D^es|#YF2(W^E_LiT$W5Xcp2Y*dw}D
zG^XFW_7Y;ytE2KGFa15;V!VE=RF1T>IJT(}ck?2hk1a|0#MTynl9g#i#r6w65ieIB
zZ8$~2T#|S2OK*S9oq}BZUhT40-O1EmDxekxhv>!SFi427*&!@elW213y=llU^L+Z;
zfX}tSvgldfXiZUPhtRW8BaoCpaCI(s_9WjjjvMjo2KY{JLI!GtVSLG*drg_W5=^3(
ztjD+$z<15*wA<d)Q(qw2`$kf|ZG_jHrrqkriJ|RTHLLF*-Sf8|&DwTlLaF*XMwnMc
zaRFx4sKSW~zUMXrk3z~l^_2P;Xk*3w@=>p4gk*PK#D-|lJDW+oG$e&rgC_0T^Sq4=
z(b4A%JPYxBa|dR2d)GFkH7SD~-kSf)P}G?t6iv{on8u}?&s!2<*$r$tdVL%vXmgV3
zV4&n1AgnBk#`W~ucFCH8q+KZK{(n8+bE989?r(k4FRY|Q-DYNo1mPrsUT&yOXQ~BR
zuBa88LD?MDix*EH0d0`AC%sf*0i0(4h_<g&I*;wbg~&~eKVs{?nQDAU&zCnQS^woV
zb9E|E22b)(barv7(j~lc+E+x2?x#4`ezcOWxuU=Th(-2IVinbkk|SA)unF<4c(%Vo
z*i@Et!+;MyJ250t5?N7E$@C_NXL#j{XyLs-+vYzY*A_A)d;RA$?%fo4%6WP08KJyu
zm<{TOXovAJFdrXgm;?l$_$&{GaZR`$Y|yO|$QwqoP<#S5%L}Z``b$?%eWF?P&5J9x
z4S7xAp6~7lP%RCI6ge3Guuwh=+s^?}j0X_-;x33OVPlI|B`24Y_9_hEkNwuJW*u``
zTpQQvl%Kx)krYBDwW@&@uxx*6*}DQ%rJk;jmCP$X$QJi{H$rcVO(4EKoX@%R(?i@i
zhG1J&R_G!4>&?3cIZO?wu<8#MbXmHVF6SGhTFDdnn^?X~hYdB}8^0aXM%JB2+t(VW
zrn#eFy8bB5As#~cNcJcDD?dy*?MwYkL<&kU{+q^JbfrE!rf8bs-n5iC0U=&hCvE#B
zTUjEZ1f<Dsq4({K2hn^BTbbo)4`9YfS7g!g_HhPj=_sR|C|HO0Xf~DI1))|-Q@SAy
z**)(`nmS<qyQ~kLH>PNxd60xAupfi|^#xU%LTiLp6K}SbT|uPt*<?ALAA7AfV&quT
zjBYe$!iYbp=A7ETZ1PdTcCix<#DNfUU4lKbF5cxT%v1P80GDc8X%Ns$VBu+N@tGVl
zEU$IY!Mi@1@yvkP$sXaU_yhSQYo_vLtVsr;|Hy}p0oo=F<VqUj=-<<y&pAjP==64s
zGxqH#`Wd%AN7e|LR0~Zv$dBYfTJrHl{m43zhBc`YgQ?_SwLXzR<5>UPs{-zS!gaWM
zJ8qk4A;)!tO#4H|La08)0>KAwrcXb!(toF+AO0l&OE2+0B)+e)%7Ot(0h!1{O{$Jc
zz&IwjQh)!$iIe}8^5Bq+CZ^p1_wY$m?0?0?<RK=ug9%C~G8k{~edZAuv?TIi+dOXU
zyN5}eY)D2V4<R1dF5$A{yKL_KY1cr31@N!P#MO6jYdZ-kBH43RD!#4*Q6sfT_Rv2(
zq1Bz!%jq|1GU<vBQ$jxqhHLiQUjtVP{HHv(1^%8~%;}0maEH%IY!-!Zn*-Q>u2wMA
z=$E2*9m&yrHh-<zMcuv|T5AI+&Wm`vu~n0f$sD55X0#cSVWX7Ct2?C@jlhP4-W#<`
zGJsNU8H3sXCY9Ugl!mDGO!autIg-9GZaCz`?z5&k4mu@(P-S__IJ+bWkX3|No;E?q
zMhZ=e+l7-)1vzuJC;9rRX}lxYnIRW6G^Hi)c(P%Ck<v<BJJgAVDPKr|xuh#Sgn6Ih
zt%4IvbsH&|)QW}+{lVAJsyrWTENjtr<0^1^FryEnM1M^0wy<LR3H*naT2(pNF!K5L
z4ZsiXk9FJlc293Ap0z&53%c`>A=&<Dl*T-I;M_F3q70T*I(iIcqzx}&RuxE=#AET5
zzo~0B8b~pOjx-iuee>D<)SSdhQwdRKa8^lHEcwRH1~E=PIaAD;!_0}Yo>m-sYcKDt
z4A5EfUCWb7QPB7VYTrsD0!PojWWX!C+W(b^W*)fzmoBU>7D?}-FH?kKM<v01N(3GY
zTIJqMg+g79N;UUS8wp3O+!SxeF3cqm1wremL$kwY=t;#kZ?^rR*C2y*m-hVmH1$og
z9#)(kSrAHRR0bzC6jdbqg_05}ch2u<xWGf{pGGx+de0ilV*R7_e;3ESiGNjf{cb!?
z6D<_4DQR8rIZ?udHnZ9_s<Fzmf(ZLafyr?`4U&I^t^j^>WlKFC^4}4DyI9Pl$>{!B
z9XT1s{UrW(y4uO0=jB+YnHYTRBx=W;tcXt)yURRBpNR!jxl~`@?oB_WwOf4S*z!h_
zHcbDKEybA5aL}BmW~!l{2!i^ft-Pgv%N%#&Rr;cUX82pK1E9pimEt$!zcWBnU7C;y
z1L}%d$bU|~3D&nsF%HFAx@jW$y8r|{z!tzAlw_>4cEiObPt7o0%eqBiDeY-(=c`=N
z{KF8zM=AdwPiGm_X0)|!N}<JCTw2^MK&ha`3B}!=put^Q+zJGDiWPS!Kq!S0w75&4
zxNC6;_NC{%=bPb2W=IBp?CkyQweEFYGn%|S>-P=wj_X#mg-_Rleg&%IWFC~pZ^UuV
zQ>EP$lf>xEs7}qBAhYj%*5oqUD={<@4PIyLZX|>Cg=X)O{qK^vqbk2A!23w1{sH1P
zXi1r4QK>KLKvOhqJ5(e4u9x;Wp8z}Y8y1s6iq_J(N;!LYkUdWM`{%&<+PYk90(l+%
z3Nq|2&R%aK+$a5pdfE|kH^cG@VW(+I<{vn%+Fy_0X=Tt5;+-!{2UJK-sAZ>s%hD@2
z>N(<T;v}O4s2~!j(sCAq93qz4vPQC38nd>|1UiKl1&`z*0}5dSVb^pxFwwV6e(}tW
zN0LTTL_rh`Yp*x3r_9j~GlZJ`rSJLYczzXXIzD|N%QW><u}^KOJ9CmgjDgU}_lI5C
zpFEjvU#?k8b>zvW3gsY}dC6V*PP|b3G%HfEkUfJfgiU%`V?N=yl0eg9(vqE8FG1$w
zef&a%PLyq>oO0K3(R(VNqRRaPH4IT`9z)WP0pH)g298g6Tm8vn=Xw%^$agu?fN}#G
z*&CmGRgk|Z-!hSVI9k$Anhq~^XxzJiHYbM6gNA~@iwR|dge!@#_cef`CIfJ@lsJqi
zm0xX}bof*tb6~dY(RqmgTyE<aeQjeM74lh!viKhHO&ZcBg@t+fQTC9k!6XB1%ErSx
zBWAefzq_zG&Jia6ebaAcp-%q~6VNuQ1(a)bSoVg|2qIY94%nanic4%7^sD!|@gnd2
zMU+k(!+kGF4+>?L%?GMTY(f175AhbafuX?}4_!Z@pZMGfOAOsFQ#2ObPPc<e10Lh!
zJ?Uxa4{3Vka6XQiEI!u;KbX}G#}YS1Ik|s_Qd=afuApen?5L7<95V>JI|=0qFJsEV
zpn3Iu?>wBpjea`j`9}4>@=dm^aZqDWGT-o=?mv;jCv?;_rpimdT?LcRmfFN}FD>yG
z+KgZDn!-b|D~4ax?hblre#U!hf9(oayZ!kyK0y2jRMYR{KjuyG6Bm?ANxAr!{fmpo
zhAXc+PfhC_G2>gRvo)Q+ks=RJ^ChBDV4PX-iIMnI=~rbg6<@z62-88a5@ZO<zM|ce
z5B0=%+Q47z63WHPBsI!}E;4niC)qG1zAB=OpnDCrp!#+VVquA2Iq9!Ae;v*HELY<Z
z38-;8Iq=XvG`h|DIXZuPeIx5}DGJr8(m&RM&NSzgoS`Q8m48nwyEq1kw8)oF=>8zm
zZ+0{~e1=;m>ppB@Bu5%)S27W$SQ!|3v&eS7BYWP-TF70$=7Yo7j<qRuH~v$dfIv01
zJBFD;T8tp<X=k>o02>a^T9!*KT>5qSes{75wpO+i2hOwNq2La($IWkp`n&A;Jq7Rx
zya8zo4aleK%2SP+*}l_wgA%&vMBIF~cI<KKpiddPkJv5-&0xM4u3$|PBgdRzfsnJk
z$z(qx86>wvbeT1__ujRlUs)_9T_w_9XdJGT?KD6a-T?ZJY=P?zl_3}|jQWid*Tg?c
zh#1V8IA8x={R{KhpNU1Fd5pA5kR&Q<-E$@LgVp_{JJq>Vqn5Rdu>zvfa}Ynt^Qjm3
z>$J@Wfn-sdaVG&75*~V`4)Pnp{gI-wcN@a3IQz0#(iBk2d)fu1!wD`AO6$v%S6433
z{q`LqJLUUyF|e4<BfrD1%UM;ch(e)WP*SB^f)|GP6s5L*xkol#Fw;xB`{K{W$KA`p
zVRSQo`5&@k_wWf-D=T8<q|(S_9C(JE?CmV^Os=NO4VkejdSZ+1H*qT2qV2>v@!lSt
zwN@GdpG?~WG6nStKBKA<gyrMaFq$E)o0r^lbxfK@_<QXTG}+k@<zCEm+(4>67plGt
zw#sFrhd8IuzcPx?8(Kb_in#BLy)XBt(XOCe-`#2W+}f&^iP94pp=}75W8l_kQ_vZr
zZ79CRGE&DCCu$Yg#!yctBo?g4+Ynd}Z5~e<E;P88lK{YjyCgA%|FN#y{30TskrD}Z
zeQoZqyOi>y8*yzm>3VvC57GN9yx>A*&3@B^f<*O*-6V<mWMFz2;;w>NqbRH@di=@!
zLw-;io@%;fy47FTIxV;B*P0!hBO(Ide~qH7MHNq(6f1js)<27S%vKw92FrLTlg$fH
zGu$RuZfZgfG>D!Ms@&nZ$hRfw+ND8Il}-`;AM8=xZ(}B`u=*%?<;^O4rpP?kV1qV<
zJvackRaNK8GaMbE4a|zy5zntJmUJa?LowdHdzZ~tFRrVG%g*#{BEO?9bTY+RPc||*
z5)l<o2$+TwRG;0Aeh}3+JJ`{u1@f9DeV5v{qTNp0VI`y|t;f^!Jy`13SNsNne^b}?
z)_hLXFo%r)&P1vvoBUL!^c{H>xd%~#V&2&f#i^qqG|W5YDm|4!gfCSm583+}?~$=u
z0uXdTQTb3i8X+5uNh<AtwRgSY1r2F&4E#_^hXLnsxj2|jXpuP_PfhCP9Dsz%dUjMI
z2xvGp&cP$>F6w6S6kJUj-4Yj%jdBQ==#nKB6HUEwZLpMY+yaRtsed0%ES$90Bg>&<
zt0CG!A=TeDL1(R+yW4C*a^i9OkZ0s#Tb;YQ^7?CSw3l`*X<s`!rwx*1x?wT7OsZ0l
zRIRj>w~TmS(ek}zZ_Ze;Vy380r`mTbX(>xkp8R1eF;~iOP{!28YF3?!Cy`x}<)Za%
zhvCNXs~}Bh(mrV5zBpiA5a9xdBeHXr){U8kV$#{&v;HJ&LF-4YO_!`l#wF*k#~&+Y
zlD@X?ek*sxBSbq9OAYka2;<kOMZOEe{J!@r=6-TIB=G;1Gip7BbuF?H|7dyQO4auS
zLmc1=`#{&{lA36Ha(S8Q)PA#RdzVo~7Gzx!w#EHqY^KVf3)EtCZrRx!K}JjPmt<T?
zC5ahAHG>mhS!RxDv)t|%5deRjUi<8T8A0Ay-Z+&S=&X|*#Y9r#qxY_bo+DcJ6I*tD
zDoEm2yaH!Fex!P|bFrp3rL}u@cZb_}K91!pxEujUf(lgCDT_t)n5+IkfB~deY|&-X
z7MC=v4+j~(oX(GAd&qdlkUG)&mFROMn?CO@1w`B^|D_%}N8*LwekvzUQYC@hZbs4q
zuYo6czE23}sJIfCwc}Wx6h7T?CkGTB-&-;ynVzbyv-sV+(NXX@g-(7udJ`08EP)l2
z!ivFnvM909<KHdn3la?TCTIlbl0GRrD(L6J`ZcEmWi)1~o|HB|xJox(><#OdzA~;q
zA_gG(2k_BTZ03tqkv3n5*vei6cY|4!fbKEVkvCOc+BZ3Hj(Ea{sTqjkLTLvjziybz
zA>Zh?q<NFqb#ou{(o{P>?WFEMf@wb-jqSZyB{R?2lg%x={&ZW7!dkzP0pcpJzKbdh
z#*+2;8WCrHAdv4(WM-!GL&-!mu4DI0?K2XfPae;}Kw>4Do=c9j&mA47SzVhJP4o-5
zXuJ1=JFRc9Br4Xel=MRRcqG`!g4Uqo7pf$`)AzlaW7h>@*A=NwSOC7;W*(zCBKE7#
z8d{&=@SmML(|781&!=5-_FhH3=ikqW&y(tQ-AdP!xOD+CKyV$J;O-F`bzcUc9CQC~
zq-;o-1x#iF^o{|I%ujEJJD)krcBCQxnw9(9^BLh|q0MSKaAPg2h|F-1E_$Pl8IE0P
z#*ih^78phfH;0;|kTz}+v;-ctHcGFrM~=ty3BftQmQH`Zhfgb-VSUrD;MnllOt@A@
z*fMtCqi*-um3O;fY|N_cr@6SnESnFEx+A~xu|T-em|8RzN{q>zlt*E;cwNW!14Kpy
z!}M%*j>VuQf{`JalP-J1#@wpCxEHgsX0+24j|H`Mo?YQD8sx=J;{AJS?l+!7_*|)(
z73j1LrP{Ef)?jsXZ^=jXUgL5TQS?u%-v2(KVm(nI*<s7&cvR0Vq@TfDE*qWSfkz^<
zAQu(&rDvfFLjG}JorjHj&K8?>{>|w-li2_g>@ZJaF3jQGbeo&!gwoFUz@MZt*MX%h
zb==B+qh&|)1heB!Ww!;N;zq`ev8)X}rg!7OcyQ*;FqP2PjXyZr^(KPZLi~x0zR;tW
zFEBV}*~AG2C~DY*G^+T=kvRwB0%9ZkzWM`cly33B<s<x@3Q~2xQjaU?<wI8H9XXT5
zpQC)f#biE|3_pWdH2#_M2cNC-Q;!~(FVEF5A7xBhA3WO9618InG44v=N%@r3)XV+t
zZ|Ult^BM<|V<zCP6E4qRkBGum{gbKv(%!~N)_(q&*FM#2PFuS^p0$_&rhT+iob;BV
zsl+T`!%#Pt5=)xq34@Te4D6u4x#P)G8JD_~x-C&sBdbR*d8W8jH^y>;f4esL7pSN(
z(|TAA|F?%xS;K3i931Zmp5#q!TSdsVc^8bn&?xyfgln5udj68%N$_3Of7fE{dL_WS
z;zN7Pu0ZU&I2a6O3Jw%R=R<9SYF+3x0IB{I^+s=X&}xBx|4SY|$L02Hpi|}dp~Hpd
zxEmG9m`eM`-UvA%>RT&ILgQ+@+=#$HH!y8*VSm=*AsssC6X*#h?t$-iLo6j>6P$D#
zU>M4Sly;Y(sH~}t>+#aFu3J60qKE|szyiySI1`Lv#FCo7tlgP4Ps{3ireC2)+rHG}
zi4Xs{63iaOGbhH3dmbnoC<xYTG^0hYvVAmcY$KWo+Du^k7>EES`=<%B`7`0`>a1zp
zD0CaSjZ?q&&^AEElalY3%Uujv0h%zzRT`HjH~EwpsIt>O_e_&K>TDt+FIW`VB(mrR
zMSAl!9ah6WM<0II{K@IR$F47!k2hj@U?}o+2=tS^xS**m|E%vC!Z!Ckmqe|N*gwsZ
zdXIAdjheU)!qf1g2u`#w+T!<s@<<DhPrL+cv==8kLYsAE@~R0yrkj1O8SC#_(~@xC
zVu(TiDv~*DAmk;B=AKC**4txGHM59uJuHTCqBkXBvRJ8JJ5o~yi~J?dx^+>G#ZxS{
zcKp3>mDzb2ZZ}-Hj&S>Ao}jq%G0bm72`@=#4VL7%gj0$i749@B24#t)z(X2F;VLtq
zr46rEH;+$;GTtSdv8H;k+llKcl%G<c(&A6HkRXVCVh$UWYbMCf3jH==R?gLeB;!R!
z_LL3ddup}G(vMw06TD^1Fo;-jfc~HXy`P#XITDww$~9jZ@n((ohYC7fWPocQ?0;uw
z_u>jk8}=D0D>%g;w)n<XD!u)8pAwCgt|0eG-`@W=KAa$+A4_!wFbB0tOK1U8f8P?~
ziX9ORp;jBii4-CES3OOuMKdu-3*fwgE>`xt{`Cv9@*WdxW{cfC^Dy?1?>%d=E|_Ga
zYR}DLKj6d;>}(Y$4`y@tHB9G!As8@CkY;#ERul96>8iBuSZpvh>=O>_FKEKUZ2MZ)
zG>HM9ya5<KwMG$2UMPW%=dzii1CnDJda)nR*0v*S7$^{WFLM_{!M4bsNN>yrG-Sxr
z=t-8wi(tP_=6t)}Ug<eZW~7xeo*hR@BHK+gz@+cVzTuCj7HFs@hY=!xCn59Em^(F?
zvmW(W@3CQp$An}@aS6J`?sy=qK$6q+&*foUNRd|ceQ7mGf<0+310vth<s0H2QfNfP
zV?j}Ae4p)Oa$P0kIPoECL|&-@!ooe9^t9StmV#u|=*Mj0ih{O>{r!Fb_EtF*z0zR%
zFpKXOq`NVWtvl~%dqW8g*Qic8m{V|sS>l`F=bmN4+fcW8z6iQ76#!udpKj?Py)=9{
zXF&2^@wQSortyRk#Bd7yvMD?&=t?dl#8jSV&!nI4@4VjY4-n8xvub1y6`4uN@ldb^
zin7~IW|f@PWmc*m^@DtYBo`?xB2ZI~sG?w59QsrjH_Ix)X-f;BI97=6StpU2mW;-^
z-d?OXA(~u&&)oM$In&a%-b<s`C-^rh+!HwAdyTT^#V;gC?_Y45vQ%ZW;Uq3V>F}be
zpZt&($2!?bs*eKd)#dUPdot5gI_T~u@7H)giSMYlH@f*#`JeNX80b4z(Ick*@e{e}
zll{@zrO-ag{8)p>|LlCIoht<!a;=DHy+*y1FqMd@>#7PDjD06xt2rXjg&P&YAH`N^
z+D`lg12Q)a_fBhlzWVemw-;UUV<D9+X5rs%bEDqc(mT{j##qIlu{sF;LP8S?MDD0_
z0<6~apXEKL-0k|HcDHo#+pu!+z01cwE!;)3qzXpA`WgXiFk6d8l)+&+XX`$WS;2np
z-`~Mvj>*p0()xmFi_gF(RGnzK<4{$$@Evq6-%syD|H^}zs9mwc39!6W#*JnGN2wb`
z^3{V;ZZk1k`Cm%^29Ug_3r|3!Yl$eI5TabK=^;3P90dq)Z)j9UM+?^?s0raThVOxc
z+?FKhzkg~tFEf!F@nzQ|rM~6kR@JHnsI3H}nQ^!JaTb^|BtP{iZ&PKlS36*o&^Fp0
zS0Y`Di=Rb3Nj$vu4|iks(3eqDb>8m1x)vnwQSVeD0~ahF_=-6YdnuN?MLIBjFL*&m
zHC}v47{&)R5P&7;D^H2uI3lE9U4<cwc*c$d+M`N5Kj=U!1o^T<nm*}IkumSp!e54I
z1!(@T(4gI*vMuNl#1&gjdS7-}daTCZD8&bBg%2l-ZbrpEZsy?XxQ~N04!1b;J<D%f
z4G(t%rp0bI8B}x2mv@>tHss)3*a7`%F2`EkNXdACuhW!#h}J)vHB?eRKPf15W@jRk
zdRd|CdyjgV#-{{f8uY&Ij1;E|=?tv_Qj0RV2^B)20eb<iK32D;jqRkdeMAl}BV49`
zys$ZE?OfS)vKpdD2P!x+$Ey3|ddu0?I6;}!TrFC&q4jA5Q<&oaIV%;ZWbP(cpHOJD
z*aw1)S>6{c|Cw^P)%(A_Ew&+l<y8>Bz7H;f+g31ky)mpV1e3Ct5JLj>;Vv2OUkn#}
zRUU*rYdk#s+K>)vy)6`yM`asTL^|yLl2!lvP=ROSFM!TmDOjblg82BK+vd%+9DtBK
zPXWdYTFt@qjbvyvgQ82kyk*`?ko_9wL)LU-;gb0Vi*=49O%xIbB(o$j4?T`jk;IFn
zjd+U7trkicn-&;+e!Se#L8f23;v`My`Yu$rKver?<7!8{l1xy~1qgLE!NrMUi%3ZC
z!NMo#po>k!Vo8?zw%oE~@*{yG{~ApqxLb_qq?UABTHH;Ipp(^X%Nb}@1)<Z9fYZW|
z997OCK5nO_zKJhk>g&XWco(dzFINe12(^QGM47*-J~%9}<^Pp{QzIfpNm+6lk_i--
z1#6_`l3!#Z@WIJ{pW>=Wdf0bUw>04%ilY-@2cuSg-rfazrFfNIgO#>N2wlW+qr`Ly
zQXJ2O<>+U`mzk)TsY`<T6;PZzm=>(2pJE)D7U=mqydM)HF8<oZqZigMcFRV*AZ9Nt
zoql$?;53T(tm8+2t(I<c80AkAYU7J&vhVTLPPT@R@kt6#mLNWnT!qyIzSYW@_oa7N
z>%i!aIC&RATo6$@R<Z}6u><P5x#n8+7=q{Lcth{x3JZN*+v<|F40a?0!f-{9CI^|T
zS$iRfYm@tq){?9k@aCMJp5a8g%Ad&*rAK_rkhxEm!E{mYZS5ypbvd>g|NkXZlHcs(
zZtvGAB&%Z~Ol^yWVqYwMBeb-*dfB~`yrN^8pXLsgisH!eNA7}n>8_D8&F#}dA6Z2I
z0WZndG4S~yO2jwFrK@%wO=3xUZo7f0e@AL`(Kib{M~X@2EhDz*ppafE-Ci|Xu|8Ua
zt$y=?!GTCm;oIoj2p6-wD{#w0kL#yB^f~aex+#2=cNSFFc6T~R&)xTmw6W$NZLUYs
zd%vnViuP{hxmiI~6Q%+v`jc-gW!L9$QIndC*oMV^C2e=cF7C>KDYsNzw6)1rzIq-}
zvfk;TH)U)1l638iit(m!oFLugUeI%N46ZeWp)OWQD!psdJQK+@20~>jQQsEPoS18-
zEjmRKKG{VL`IWB6JC;>U5SAWmJ(*^*)#<Oth;QY`W>5Y^h~xMXH3@l+;AEG>HubQR
znZy%!=tq>E558Bsd&AioBCXmxOt|)ZQ6R;2(}I7K`GKaJC4w2H;6miTB=gP3Orv8<
z#OjP74Bjb;m;n-SN?%DDks0J;F%;sTV0jd|>d+Jbi}cfp&j?R7vWU;8Tr@4kIP+2o
zNl0Z@3eTnvgRiGYv_|f<eE|{Wqm*KHoE(Kod?9~B1WNh$R8!3YTV+0e`gta{>|>=)
zY5L-cnld3!y!;D7%|6ZpsraR0KgLbR!D&SI+qWd|uPxIfQxBlmdyn(7_+~>N6}hm=
zPlYR*3^zG-f2h$~bYOfc#9oCU^Y^ra$+0~JWE`d<46T^MB}zk7d-W|6;|F_7+D&^5
zkW9n%6HNPt<JnqeCqeGgoJLP78Ox5?AZ*ErZ&<L13vjzty`n?vaio{EvKJm|_=+x>
z1}zU7f`Jo#h=kB6?YYnjDeT95f*P{tKtf}JnUm~~-J-9NAi^ql!e?qUppT-Y%98Ci
zs4PX5q*&w;ttHG>*_;AI*Sj+&o4@vH-D48^>wlXg$?5Wd*PoT{X3f@>t;nx?*QQ3d
z)-hY;xMxi<4bi?R#2@!RST&}SXuW_t3Qa(&W8|Ub@_2uB^<wmC3S11;%j{|S)qRR$
zTv1IljbS>)u6z3ut#@S{qp0oYK>I!yWbjJZNpRf>%G?V`%|yu{S<Mu!4Gr-k0wS#A
zPjc*tGI=6mSPdr$VA{m<d46+t#nnZN8nthPBFC(DA&blP2`WhD+<|uvlUoM&Y0J+D
zrQ#SDOA_!;g=CE_szSovHP4L4qWpN(EhyNp-g`EhfV&e=9$o)6YOuw~cNN!!?Vlc%
zJocTvO~uvH7blwvlyT^<c;5p`tby-9ygG{N^wWfj-;K^_*Y>8v*V?uSdNFe@T9&w^
z0lz&$>QeV1J{bcpS(YoPftWrm#p{ueFD18>GWk51a%$fkm-Q^cbzkUX5hXcyfXNbt
zUlZ$E#Nr-%2<e749VHRa%HoBpO6CIE8g?83$r$vQ%h)`t7$971){WN4d)^UP3z}$J
zlx2Po!Q!(pw^K0}Icd6Pc_Nee=X{10;G^_5ISlwC4y2S0CrCb$3-!Iw#|s(*qN7i+
zjpH&<=(R<X#RabfVfs}LsJ_$|C_0@iUM6tYC47FeDx=_-q8V_|%$?1|u_7EytLMcY
z{exxwZ55e4P)(alpkXbIt$oimfizQ^3z-Nd?N$PkIPCJLP>a#2N1l+{at^#3<*#3n
zrnoeyOD6r=bKPoa{c4aG+Cv-4Komdr%wjd{UN^byGOVrt56Ln!U1W8qq_2F)p4=fB
z>RW^<9HBb(>AH|hZYpH#D_^;1AIw~=VzP&Im5_a$ECxzhRM+S@ls{IQj0->(aH$wP
zS4#)}8I}JfC2X41A`j;div#5#py^Nqkh(&2ishW0-_X|JAgM(W+;G3Ff0s9;De7{t
zOXPO)+hwX`kyO2Dui0LgF!2K&lr^%zUbq=lX6t98t=+9DI^JVoW;i^3uUtJ+izWS<
zaE^Hf7K|0aTlTFW_Y2B)69R$mC5e9IT#W<p00+f90_cZla7f}!PIH!;nYrn=SJ6>L
zLDcP>1xKWi>?BBs`<Hro<|rMyWKm3w_N5m8cxRvIMZA%~`V)M96lU4MWj%(UECjxB
zsG%Z)+WWT|?gXMhY)>cpLjFpcN|2o3Tf&2{P^c)P2Wv`9Zh&i6%2Qlf)c;|^%Wa5C
z0h=k_p=8mTfM?a5A;u>E;v{cgCWZH`m~YsueCxg7@~WEppn64`gmwS-W;?g0=Fj4K
z`$;dQ8Sl=opr`c9=Q^DJYmX`QfeL@rIzpT;59U=x9p~NNcpfhqeMF^GSB2pbO@;Z9
zs7O``%4S3vrM9XaMupf*QW1Sc*84o{HUcF<YxUmA`x=Gfz=-~*VgFR`2~jlfbQ^pw
z0uQ$2Qf1J85xd`u;++`?#5S~PuFHGt@#>?M*Z2(itl{7|Kk3cq!~HY#1@r`6VW&qh
z?LB>T<uk6(();m6+uC|Zt||pKLh^Y_Qdv+atYw8e?fp#RKvrGv_@-5)N;i?ceq-}8
zw$vRUXJ5kwtoAV~Op@%trI1G-nX%0wi@W1HYrUs0>mq%nNN+^+gq|TjFfU?_Jd&Q^
zW&c}3Gm8Wu13B3_Gh3ZcLST2Yi5VAz+^@X1$(!_%KIQJC`gYvYA}(OAJ35+3?o3-9
z6J3U=-6Nsgy`c#F;9BW?uCUcBwxe%Jo6P2&k!=R!%3RmK4imaLTyHIaFNr+L+U8l!
zG6oFMsXmxs%UTGs;5acMu_XyncWWN#Hrq2CGRvuU%b-u(EljRS`@(jsUmvH9u^Bnl
zBUGcIdHUT9W@@Kx+5?G@nRjc}Y2vblM}u?u)0qSv9;kR$s;QiVj$}343XTKWYU-YR
zz6iGER1UL#Qs7sCg3@BL_1_-Gl?9T)yaqZ*n%e-gfm+q2Yh@$39oY=9ubK}wj8jug
z2d4UUuNi?QwV=K*$>NglaYKGayQiAZie1PQ&XKS1CUT!?K+2gM(_12))y^p5q`dtV
zhLlToxo3xtbn}-m!f$0pNol&=Mj*D7GMC#ADsMPYEu8;UKczdns-WoI)GBR0_#L@|
zZp9jZR6W-+pSOt+lRd+uHVh;cag5I@T1U|sO39&Q@bBnpYS<t|uqrF`RO%bsQ?h%q
zV8eiUY*U)#2sh36IJv<3oa9EK5hmV&_8#5dYpAZ;(<{vGqy~c74WYzZEN)$01GXb|
z^Yb13oF(Df@31ku-4@fHAD1~{Z497dqrtu0>mh4VjY^VdFxqaeID>mV{q~a>r=f*r
z0<&Jw$aYq){amft_rJO?;T+Q_spABcmT>GJ+vvOJpl%434HatoZO_`K&m~-?QJ!Xt
zStaM=t6t_xI&BCXli`Kwc$+@evGXH2CN8SeKo*ce8Ix*C7Am5h%2aOMMwc2f!(t0z
zmq~xaDuKSr^ee$eMq6GtbXN2*4jlqxODzSyh+sR<eiLPokG7UHCV{(-um%ziC^Qxm
zNk1hbh$qL!nYi0+N$)e&3Vp9PYYG@(lu7*Fr%zG0OekPOnCtdetdCwdF@+&}GAf;o
zHk&aj6h}`tL02l(zyc=iVS^zd5fRAA%7^jHb(kp)<obh|Uge{XQ4^A8pL-+sJy`6P
z2_)GaQXA|(5SCggsCN<#b|n%CtN$J&i^r^%)=e2T+D+K55L)1x1f@0ymMClhsdYxb
zHVBD1NRm}w=U!m=#r1jWh14^A=yoE){tYAzrsZTxD&jV;QqZ;&`lp83%Fh%T_9zXQ
z?$hJ<jpE0N#K~rC<-@&~;qH!#12T9}ld5(1Jl3Zdxz?gr*#Ik=7%aFPNdIVuw}#3H
z#q9~rBtX}+w#RYW^8;&-&cI8xGR5^$=M?*OvY5WfN$m!Nw3ZswpKiZt+*(%FN=ikN
zL)gyO1oSo%?Ii4O<o)_CnPEE+?w<p;_v~$<)ejMGWFH&&EElVP_vn_jjtS)R1~(P+
z5iH331QObCu9p1&CZ>Bsw+1(V*vG8B@Hoo;YXbNSeLuwyouo8TKBb}_dz!B>rMo;*
z4+Z>wN#C+9O_<o~umX@g-HUgwf%~~(ty*qWC9f7Olx&w1D@xULcVAg9#y+i&?twn~
z{%o(qiu?POe``21ZX}{piy}X&2>l9#Ldp^RgC&QLW`$Kq^hmQ~1seM92#mz<tf1rB
zZBDl^G%IJ%&(AA+<j$In8%pAl1!t&4r3MW2U<I@i#YcXc30%7}b&#s|+E9*sPnVo<
zEhCA?*jol9!r{!rgq+OuP%z-YBq#i_KUdE6<M_>48*%Ikcj!TcP<h1mq-ITB)gE5*
zFp5s2^wVNrxw~Kj83t<6i$77imEUC;n7gqCq+CWO6bRT#hpv^jBha(-OBwf>fQ^d`
zYWNK3u=7MZ3GV({4u&*kA|47agBct(ou8<gi$+kT?iRgMy{LKBd(v@`I>)!V<%|Ya
z{3!k$JLQgwXp)ZD?IhPt;oYds*LyPgw0bvc1~E(Mk|GU`bSGKTB-)CJO%Bj98zo!r
z*2GMW`BJ5Qphcut^oL5iiCRh0Zn4X|`VCCpDkFYUB6N0Rgf$6P*m8>Kda;UjgruN)
zubQeQmlbB7%1K>OH3AV0{akoifz+BGe4*E9`@W{S3R3SKOLwhdkl-!vrvOgt?}@sY
z(qT?d^mv<61;r{ne*N_QNczJ}*kuAukzmulq$Q||ZC*4&iw--;UM#ugs~fGDe_Inl
zsCa}k)~Wqt_hGtW0lOo1!qk%em)LdEVdjH0)rMscQ?36th~7!`BUOBbiyHmQgD59a
z6Caqk;<SF}YHEKh!uS^jV!zt5><ze)j5z<+YZ_k&1BBa3y!TKlT6T4MLsYUh-8KFF
zuZ;A2sn+iT?jON3C%Xnog(mqFF#0+am@8P2O$_GR-;-UO>l~^EV;8*@i7{{y?{KB7
zvZsn;erdp?JM_JyZnQTo6|;j~?0%$2P}5(@%p=zLkPY($-$k8V3G6W0Zhu=yb>p}{
zTm1ESgT0+=f>cJbs`%{v^x1c38cxx8%Ti6YUjIz1O?nUJ@7Jy!P&vrj(e%;A{$f)|
z<K0y8ME&8{Q|t9ns6(dJC2_d>1xJ!GxX!@<_k#bz`ONy(rpB4iIK@CHwsc6VPiZs%
z^5ag6?DE>2v0sJB58IH_Z~6Y{15z4(#jDtmO%f<;%pv$yy_iUIl|nyM17>9#WpHEr
zPIQZ+(CC8lhked>rDa<;5$eK@CNA7HyS+HrnbeVfxoBQpnT|<=U*WQco9?<7rTu4z
zg(KjC&?}3f8JHF=?2fy*YN63hbj7fZFz&n9&p2yd8avv+!CZ;TFU|n&plj4=HX8Zt
z+6X-zCDJbbCvDiu{$xgipNn&bLK{x6642G={zWPKj@s_YPJxC|lsYneetgG;WoZgL
zr#H9DkD{Tkx-ZBjsVYwhI!-&UsO}yn6nMg}<?L$S#N%F}TuHUwC=%j+?avYGE-ZuC
zrs&K89Y>vsrlgs;iLu7zQ-objm}mYass#%O)zB-gjtDV#YpnV*?ZeIW6Jh_EdqB@}
zTC@2(Uxlx;VvYZF@#BlA0cN1jcdo*1vyK77&55bl4C@stKzKbx?w1GROMmg%hD>CO
zzvGvm!y-~8qeVZD5~%w0Xv)LPMCB`!7;UPzI7Z7pm-{G?6~)nr==YZkk_BGB$Gs<N
zz;jc7*JkmXd>>sA_h{&+HspX>Z=4s51vzr93dLevYEBsks?1q;*|?ajMXY6Ql48FX
z65`fB*rAa4#PxTqB$P&1r!G}1e@?=Z1W*(I)BBO)p*9Y9o?h~%h6?j}Ugc&Yd+(%#
zeZAc*cjhr{55*EpP*rpj={=*Ae4ZlVqI|82D^R}P#k%@ip;46BSUYA$4Sti72H|eC
zxm<(r9L))J0kaU10Q4ufs9TIa5f_Xt2Y~~rtkJEEk8-E1(>at^@KNm05OwV$-7nS5
z9P_$oso?P~F`RndI9jY=rq$llhfc+b%y^gT0dET+k<(pOVOu}%QH<=29?P%DCM~W3
z(i_{@O_{mBBU?-H29C1Z?jyyTIuW074`bVz3F9ZIO}w?KjB<IojCQp$%DBpS80;lv
zC6{A1U-hOf`eFLjMsWA9RmYMpWPDEds@%)stMROGD~&77mX$6#+j*yN#W98dK~(cz
z(_Ga^^fIYl9vL7KURt^Hb#E3KbfzvN|3xui$7>oUOqA#1J8gYl4?}1?CnUI!^Z&{g
z;ir4v>Bl%)5g|}8_tm4++3+HumZe*CL2Of78O+G_Iv|-GyI=EadhVl6qj%jOE;LjL
z6V(w^b9SSmRqVRYp^=42L^%;#)Fm~J*sO&6Z;xd6Xz3Vz7(K-yPKfw)u*T+Cah>~@
zr~MkFW2i5?N#QT`QL04(FzQURHWu9RK#QUGW1K<wM&ZxWU$I*#fy`&Qis25A=TbQW
zGPvd(<U=AQ+Km0pBPzb#oXsCXnQ3~I1Riu2!LMxcGX&hKzig;WZvy>XMZ=)DAwv9_
zN)4y*IwBFmufrX&MMI4Qqh9d604Oe${0m^4&X;HKlTgRR@J;0p+RYTde-XJocZ5J>
zSCh)xN<b{5m~F=t<;nO~ij{%m0OzfTZ&VfI8iVo#lt9zp9(GqaBUfs7`l<B*ox6`H
zwXMF)sbhX(4P&#j*uT?jZ4BnHpd)f7XEf&=YDT*$Atd|s@v5O#(%<2hk%n5q*x_cb
z(b>@;97$Wsc=@3y?7E-zqJ*!!RY!lKy~N)E)0xVAfzwB=?SK`~7mtsPEBDmw+Qi)I
zbsXIxhua?OA?^JDRA*UTXetf6%gZ44evMUmQ^n?E9-f7tteIvmpTB_>2V?EM{I)vM
z1Mj5xUS&Nwd!=#RrK5%PYcD<@G}3<)v_RT-WvA10SYn>`)4%jUQ>BTgcx-E`82pZ-
z#GQ(T%H?vu2CVn@XBl9s`h)0ZrOF2*h2`k#y@LyBKPk&(yIT%(Y#$PBzY*if&qgJm
zI#Cxn{QxJ%$_De&UWtMCVQ+r++EZ4~dSix6IdwEH`1_+Ss?W@1IUXd~PEjcN54v|N
zNzI!Jt+A4Y5)0xaD77|!s7em2KpdtT+Dsb3Q@WSp6a>Qvubwb8@wL|zrd<TjJN}J`
z_WTRF=iCy~I)A)9ZaW(x2zO8H81*}HyQsr*JNkLG6n}*>!2h5>gtfVSJYj64bHE}O
zsD2Te^5a=fNkp!aBmu5Ro;$}OyDm|^rJP}*(n*50p3{@;8o4q0yk{=8YAlzqI3Z^0
z!akfZ%`2)w!LqZ)LpoWt`MO>2wGzPO{XqeqC`v&=9&pAVK)jc<{QG#e{Ss=Aj5M(n
zf9)aKt`S?P24Yj_Xl3QPQ_+w3dRGjl_iGxi7rUzLhGBimntFOdm<GiH-VOXf0Q#Io
z`Pxf7O5dyH{6sF(#mh{TxPg658L3-m=J|SWWNA^k%iMdwMzfOe1Ek{`0<yAVq57)8
z-OKqUw_-o8SIkKGi&21kNA*660R7In!`kN0Iv6l};aA4hD-=5!RqGAG{BFA{2%tlm
zN*7k2lO<YC8#?A+Ct*<`xgVO8Wl322U+9w1V{j7t)|ZZmGQQlapX+={R#~SGXZRsa
zIPMzhf&X5`kmQV+Q2MZmvsZ5*3b)UIlM|=QMOTH_$!7*^kw$73PyRy>!f@j2HuEB>
zo3>s)G@edB2b(N9+9QFEA)-11&T6K~Jr0sjBV}Gstt9&-N0)a-GLG}IPyfomb&?4p
zig4cT?tS1d;ADh(CWbNSStqbbQII<s-MT&+a0()08vERzCq(;e%*$a}@u#@h3(s)r
zlnEGL&q1|kk9$4RNR!G$rk5=Rd$E3=%Q)X#z3F4Dt%Va~t7F`jed-C>k?wO56%~y0
zQ;u{*!o3*9_vJGYmWp0~iZA|Lrv2=V$tImBqm~2Y`+xG2b-#cMatgaOja-PNI@!1p
z*~y(VuBHr_1iyi5M53Op_yQ&cIi)@P2Gr98t<yG{_j5+|t=0Xj4B(59Mcr<>+W-=a
zu=NiQr6w9B2vA3|WxddS{SfJFx@~8cVfN2gf0kYi8tN|Mqz0Y)obQYa!tf!ESCSnY
z4|ozeYw(G*O7ouj3Zvg;)EqS&&v^ly&j0Bw379_}&GW2qTqAg|qQn1ba{9$2=JboH
zu<79`;Iz{0-d-{IPq9+wj1Gi9%@K7KE&g1))aH4J;L^ITs?e!vuWTj!lJ6ca?~BEL
z-0}F})A4WOdlOYPB5l_prZlTy(UQ8hWoY2E|6r!4O<Z>I7+O`%8|sI$lKg;^ogCs1
zqNJ=rqf2i^Ri~W+W;a!|IGIO`v|x%%laXxBrz5}p{hM!uoL9uN`ELzAj8k5gY|lQe
z_^v28Q>;+S6O-m%bgOCHWbcrXBr~q*U;c%X$7XFUbNSB7k9#lGuUmzZ&VSF)M>R))
zFKpS>M@j9^20YO}lXXH`f9|^aGrdxGC+o?0j(cSl|3q26hN10K&yE3j>bo2Ihep7p
zC@+@KD5^pv%(HyJ8j#wkD8~t|_Yjm_R=c17IF>W%`CULuWzU2Ie@$+*<Z_|r1wjW~
zowiZ%H2Y{))F8K8X`V2)ks!P=fy}_u_RO}#mVbcw5V$(MHR-BG*)YbM%txnOl;K9m
zv%9Vv<5CD4PXFx!^DnPspf+(m-!mv=uWD!vxRCTnu(OjFzCA`cm|J}{`E~^=|LzLp
zUxLrd?Go4I2ZP*-*Li)EuF8}O`|P3}_B6n`jdPwoH=m)LP_39JzKJGq7n&ICLJ?{&
zO%<?^U@`k4-=hOEVx;TQVIUYOyAb5C5LGY>or?YKSvj&Pu_{>7TmIh9SLe>5W-=td
zPUz=LHitVI+S*$;hwP7Ua&%q&eh#NQT<J~RUH<Stx83LCN#^t^G=7|YM4D`(=1oa1
zO<aF7)3@8c6}G=xbW^!jdTcNXxWAx3K-K5wp<>M_QKqF?!)<jta?d&E{m7z^vCn2o
z^*Rm81LR|N@aVPZ@`=x3*Z;KN>oTGJ&kwJ!e%&Pkw7!2kPf<;^<EXEXg1yBlkzQ-p
zD17b`srE?;*dCFb>fSM-{IQYn@+1|o+3A1Su-&+Mj#9adE}-%QP`S*itM@ebR+ADL
znxo-o0~<#_j$gVIZpydMJM9ZM=L)G)*}mI|tCwAfYx*ZTq570L37aoDo$$}BG5k|<
z!>S}d_^-x(I^ZLVst)X`EPxO+0_1%QZ3{@|fPv>`Qz~+~v1&p#efLNc$6T&`i3KTr
z>kW~^kU}G{riq&WGlxFUp+<90WM%x1hc`<XtxJ2xVM?<;!jAk#xB`4viqn_vOD<Wf
zXJ@GS4Tu(PxBDQi)>-nS#Xa&Ox3qU81{KV`W-~N#u*;aVa7^+U*?ZI)^3l%K7z#?=
z-je#tflkDGWExo<?N)smaCV#QKU;hcY_uTWMupY|Cd>zqZvMnZS`QR=<|vpsw7y-&
zHPA-pYz^lu=dkvQ0q4&GDnn{_1AZ(&)EvWxQ_YZ>vD4Zy%M~_H5#{FGQ@wXy7e0iC
zp~r~x%yyjx%&4zT-Cle}3maw}8od`*4>f0YgVL6kU5L@e_V*o8Ixd_3&6c^TcE!<@
z3v~`oo+dS)>o*hj$r0qu41cT<rsMl_?zt1+6f%)n6KSa?)x%bMP6JJ5w?C@V3`OQH
zb9z&{1#3h$kcJw9$!D{{pD!K{=FIlrDg8Kfv*+c>Th4eOM$#?sdLhdF$aStX$<MM?
z9QdM<WvHQpMX<ho>pSy_u|B{5RJ^n5=)8zW$(%;G$DaO+zs|~{HM*?#DiEM)-PYCZ
zp?@dL4-@?1%{76oG`99VyKRUI8A4Vy0o=|{=Rs4Sd;j9j1dk0Qi}}ejPa&yZ+h*$h
z%{O8+Y^62C@;8hRo}l^Scg++$K`1)6!4_3!CIyShZoXeN3diT3M>r8_N2#LWBc8MZ
zao0alCRSp=B!j#8Xi?80hp}-1w$|X+(2la|1Aln2rJ^904BAw(*R<caYIok8M>iks
z?4lbbHBsj4{S=l9h+(#VXK*cgra$g)A?s?Rtvv%!mf?deWEj8nPsyPGKZ}Gi9z9{?
zFa#0Dm1K+#m`LGf2tw2hi}h^}FtSF0^UJv1F1THNj)65UEUa^;0m@_QjU;Fnw=s={
zyT7pknHb`s4n&N_>n_A0jhu&r*&05Ix7r$pWfZ+f&6Z0|aqm;YdVN#E5PB$yPj!aF
zWr?4#mk~=1OlbT%zT(*ZZXjirj?IXOQT^Gu^&gX>wJk$~07k|G%t-Hp7DjqK$DyWK
z^v&j3KeYv<1H<s(?qtc}dS9Fu*AAn=YQQEYZ?Msd^+`J$0^5Lqul9oYC7q4zx)g?K
z7s;ztS&lbgPPF=MuD1-~*V>M0Y@JaAs5y-HMZqlC(umZg(^&<y<YJ=>Qy>wM@?35C
zr|Ak26W+iTsgpu*VdaDni(<8+jRJ?8L6ZZfI3M+{;H`tww(P#9hf|m{>hNgS?1MG#
z@J9x@I%sdpFF=P`w;TN4=s4Zw%)|`54pORqEV}=!i%OkgPhOUvDgfne`?P<h*!6LY
zqPVRMc8Yeb4;$6&(etpAB!P)9RDVL|c(q1hFzc~JKhUIK(Yipv^CzkwSYZw*JG&7&
z-4=I7pM|Ifq;JT@Hb{Wco=rw>zV_OfB1mPP%e()<cq@zuXtw163GeZ5=&+f~ec?3F
z$DO|4oZsiO*Jw?)+<+eL-%(<j1lUk1$|Tj3jW%tTCMfjziyOVu_dv5Xz-%vz`9TSk
z3y&}yc*}Eb%V^JWx|X3VCFqeNk@SY0^=<w3DD=1Dg3V%X<DouQDluV7q&J|c3N+TP
zx7A~tZS42vkQR1{C{RM&eQ3Hcq+SqG+#kMMo^Fpq{e`Boe6N5U9Z{f6%X9^Il2A75
zrThYz0}ioMuBdeWbg#7T4t<2PJ!^eKx<N{dduiV>Wd(GfETiC<Y%*vlcmD4bhH8Gt
z*2=No?He@{5jL-p91%*Ebv_3~=qsap<7%THO>TQrW$;%oS_Vp4m>{+%oarBG$jadU
zFs05#OR+ab+~lTYmoC0yvtp)yJd1YiAQMpw*ry@$-l{o)Zl=Y0Cy9LfuPu02_R!g$
zBVZ!|%YIkT*aCflN~3hNi+H4cFOx{|#ubZytyv8(?;qSv!R=V-ixD4ZiF{wQ+f0Ns
zbcbR@Y0>qAB$d6xV$Qj|UCpJXQF7_xGm+fWDOBx@lEpFOR7b=ui>pLJZJ~sAB~g60
zwz_gEwowJV6@Z9XMBhA}9*w~@4?H~HX#QQ4G4PR#6F%stvd18ClGvX4_F+)N^+Nnc
z-%Fd%5W%8FQ^<I@+@y$%aY`2SQ1snPn+{f;g*kk4H8-l}D!0Fl$>7jH&amx#c&WMs
zULu#z^#5T0l1gCgBES)Fi0PNrD!U)iR%^2LKpyO%vxY*4VdcX3${vz$m1e1@iK~G&
z?{aU3thd6d$hh{89d5C14z<YaIdFR>i{p5b-G_99-1<|Z4)-~Dj)=)VXCH-83k$NY
z3m(}Z&S|G37d`Y3<`fO1vAZ)V8yq^+{asAV&nj*iV8vjKj(bzrtBv1DJt$J*o*zo%
zZt8q|_OF!mxXHry(|C<&uYQnwu(ecvoB|L*I}2pjG4b=bj&Zy1d%UI%`B8{6JpSYy
zx|lUFDT!<(+RFKI#7>3^a#QZz>29>k9@PPGAi~VCtV)FrWu1OxbDzHt$wDUjoo1*J
zAUb2dy+|dW;z~!@W~vZXbsk%$VMe^wL<DZBb&ijf+Ggs^yky+M&o5rG<d(ozEn~rE
z)21VbkFdttIPc$_F53t|bq|`31AB7J1Tf>0gA*F&zRX$EHUS;I6k815jHUdrE9eI9
zhnf!%iXwLk)=-x~&T`;A$kw*p2ELT}&dPRZ<j-Ttx@L{QA;n-iAZ@as?UO5&wON*^
zU+Y7=|2^`r9Ie&Mv;G9eo+gI{Ay;1F?aAO<hNB-F#T5dqiWC_*{jKTjqcD!W^kbl+
zN*NFgo8b`i{GusyrJv2T#JvyHqF7}0NMBD8=3Y-#bnzOvIZBqlPwsURJ#;F%soJN=
z%t`N1-)8j7Djab7<T$1%LL$$9du{AlA$BcV<lFOi_4yhk_kw<WSmpXTKQI%;(cWOd
zEB85yUG&-&l&kKmRN#h|?f6$j997C^tGM|UD(r4QW;yqyGOi{HRS(jQjHeAm`%ji|
zy<1Zld{fLmRc7dN!meW||L&*><d@7x9i?&*!`-3yGrZ-H7m*82D)RVRQvdd_>rw)m
zQ0@Jk9$W!tc0UjlrsY@u(NWN<37bP|E-c>G+114k=jLoDJ5ihObEd+$lGHD3_f*{a
zEh{S~TC3IXPJBHw8F<biijU2k8JxMXWsp`;`yZSj1BlO#?Yev%5(LPM=dbzzoONnZ
zuefEow|jiJ@ARlzJUh7$!576kf|HQ@L2bJ<_@d)~h$EUEO61eF)}~D$n9&#9XsA&c
zR8BpAZ1|g_fCRqObd2U#$~S6%WWzGeSh~{B*Pb~zI#ydq9-+b#JXzzv;N-!t_(Y^@
z<GoO!q$VL_2r@#4ESQX&92Xpc|5jq``|}KUQ0iq*D3^~#qAsq5g2#h@yy!sad0oUH
z3M{~O#JXi8#lav)&jY}D>B<dd<OI?G(GG+X*q9`5qpnI?(N8ysU7lPNe74H($W1S#
z)fVp&WXb_0q`jREB|IE#VxJzDM0^86USXlzcx6G5_7Lee(N7^<km7TR%sNR+Nnyii
z3JDPY+9do3S>O(B$L*hE_%(f=ga#GtoY1KQlc5JjaWX8q&g$1n)=cUcLo6?Rm~p!G
zx!9$OmV+F51?sCQZY(o`66Rl&vqnCL>dsBQ)G+qDnEpFo6Ssrtx}H*DDsYR-f4q|1
zE^s`gV3WumUaqa4RC;5~^PU@pDr@DloU<A_N;8?(%S0abq4I@4y2S#qo)hrzBw>12
zgK>fAl+y2OeqQPmh|vX)33mT$)$gsNfSb6K=xEq16K}8_=UmOgF@tf(ep(Y_ahQ^T
zb=js~?dC^cKg^H%H<76T$RfK-Rj}0s@I4q^(Rm<<SBGYXwZVMGo<Tj0UnHoShDFcE
zr1J2>5U=i;o?9vg&?(^(DnJhd)*}$S!GLxJfoFh+e}12*f1K!BsGqflzf(T@eIIp+
z3g{YF8vkrnz+lo{SgyBJ*#5iP<>rzmEpA3Q2QVEaZjXMAZB7&va$jN`8236XmXyyT
zwjzvt;{Du5ze@gcptw=TZVL!&14BZFZi1H~LSNjp8~XzElkl+=Kp=w=l=OSja3~3b
z;KHX$Tnh4_hDI#SYv}gjxnr2bu2*HJmYJ|iK-n@=WnC~C_Mp02Tqx-{gB*Bk{Rf7=
zHY#7B7j`qeRin^o)ol?bt$EM{Vi-{Npg&15B7So+GJjrbpV|GvRt!uDAm-%cQ%RLh
ze=E<Mqhx*`Fm5yg6<{YlBB6yO+m5Gn3pe4#5ELsev>*dXZ|2Rb(3B75w`0&#V@Xw+
zUC6i6UD4>ZvX2dQImgrm3)g6qUK-G7N0U9o-Ip}p1EP*vN7#e#;k1Vp$knWDDN{i6
zeH~)&Jl)qlvCcw5k@Uai1Y&9A%CE=LdLLZ$lQ_pLG+gn%I9hx!m2`^jaMFD--_zQ|
z=x1E<dUgT;9Nx~wa0xQ%+nxs9mfhL4SGW}b?;@v(Gcl*u2DIM%**D~z3t1iHR8ola
z6;_&wG-Vlu#W&HXufx-2`#FNh{sfKoU_DRnGi$6dgG)A4ZC6yc+K#6d>iVXT(yeqR
z1JSq!23kW9DP!o9puwG>=QLQ_3<MZsvE)dyD}kw$0gRxL+Lj4jU|#!;1>A!EFw^r-
z@$rj>nyY;F2Q}=tRCL7ZNVag70SuQk_=TIVJ&0nK)^6N!jBm0j4sXIZEq@UZoj^2T
zdzTD+zb9&0H@mBrCuC>fA3YnraNm2tcVncOU6fA?nXs4)SN$GSl*>Xu-LF4>)$w>Q
zLl_b&Q;!VM4ZhXqWC0Uf>6%hwBC(mzZ$Se#bEdGZ3X^+Vg3Q_%lLHF2n6j2mTq~sq
z-v%u5QoqQ^RY!-@CrTWIdh0q|p7hb;-%D5)oRtqD3hf9=3s9;~?qr{u2maVnYDRsK
z!XOB>mkGG6NfW$#2?rg2@bO=1Cz7}Uh3&_#1F$z+J@&5~XRP5~05k{GgpHswKxGOt
zf|IHbc=f?$Rg5*54N6K|q69g$jJqB<|Dti-(s4lASIfH%Nc!lxsl$NFNfg=PVc&Xq
zav6ZFN+j`Bniz_^<ac{HP3CeQ&|}ybuaOplA^OWdHjW{r7C6XIHU~CtFQAj0QQJ!H
zE2P?6PpW6Pe~9^B5G|SS0}p5GEgb|M_s#g(Lb&U(h}Y$3pBJL;)xzKm{wWva&!p6l
z-x?W_ZsQCwP3OC`Cw5-K(A&moOv<iTyjrjJTV)qeZBWsgy+8Wbbq=@{vM#x#m>%>B
z(sF`4#UCexDu4=L!HtnJ&!$=3diCWzF*)z&y2lcRI$3TVua97;;Iqmwki1o5r{E28
zL}sxYm__vZ@UTg<=(25xcjSM0Lk_5q!XIA=sI%%a%wfJB^9*(|Jn`lDXG!KFY%!B>
z<nI_I0E=?&nM+<Fu&6jJKyTCr{!P<lNV1u%R(BCT9eLU~+oGSa5Adff{#&wq^Z$tY
z%7Cc0?r#hP1W5^LL`u3rx<RC*yCsM28k80(>6Y$hfFYF>5RitUq@{C)7+~JRz5n~X
zeBl#whJDW2d#zus1&(U&D78706kRRB4mSOBkz8Wl^OxK5#iWFF@j*jbXKck;)~<3}
z$L{CXpyzsfv~1mqU+7OJrRj40=;cVh=|x)QF2>T8z8%)A4)McszJ`ih5Tw5`{K7zA
zR4_|19!-E@=UNfNr4jw61HgM4+wF|z28pSx8=J!_Iv9m=S~7O~3@FK8RfXgS!2P2G
zxjAl99u47<sulXv!3)KI4;%E*9`?G$_cuicyj9Z_vs<Lg+AUX#XI7R1AtNExlc7T_
zp2jUnX2~&i9|P!}R*A-y-<aU6zY%*4J6C{+^gHer=Jr8MuBaM=G}Hdd7OwP5m#{UK
zE)Bj_db$>8@)9ekM3sO_uYyU%oPfnl=}EI({rgX7-%QiG?)JJk!eiL#&)ssvTBNNR
zlqH9sJtV3u{9Pi?(3p^hUcr;3wp-2)c{SZDq_2`6lSn=E&Xd#IT^Keccp=p^@}4Ox
z#C;H+x?8H$TkOw*e5h&|2}mrDa5zRM-jI7w#dZP1#xDSDCa;oo=A{+UZ4S28rdG8N
z)xZnqa^XR@0~ll#Ihe@Q_9Pmx^%?9D6dlg5S)2%4%Roy#&22FC=+xuJ1T>O`vESGQ
z+gcZqFe>^;wMnL#^-2_pg&(~UfV5c1KCyl+pg6g_Lx(ne&^)LnCn0b4^=U-qaM?=&
zSC2PKI^K?pI+9b&*E<TDK~L$e$Stp@LlB-}Dk#oYITdThP7VUf{JciaUUtm-S5AXr
z2`!am1ndjasp{-NM2Lt4oa*{T;IGfz1(6ZleyWG<LRlz=&O{eQ>6h8k`GQfgYrddB
zwpOG6X`m98zwAjxP_W;1{mqZ=-d^pA=s5y5X`A{=KIi_&M3n%nizwM7cnKFFA|8)(
z-m`>!@BgIrlqk2oXnFYS<7g8ePYzZl?2nBLVW%B5NS^AI(W(5uwS5ww7gWz-XU+QG
znQ)>#Z!4XQ?2OJfDoK8Z25@d5zJzrc=|PKLc<^L+a7U?Rv3<wusrpPJ=kCjp9chs=
z@jj}`W++nb!=|vY<cx*Cq18czxMiQ_Iro~BRT4r4P6Pd<lxGYlVzoW7;NC2CMWX|9
zmo>rB1ogHAtuYSL6Zt%Yo7rymi6m4Ne&*(PBVUG#rNT^ib)f<(Mqi2wO?^STCDC#_
zKiQ8f#D@E(UVUUOTGY#6?J-(@)$c%V8RcI$``T7S{H;}*p;eOJ7p_9Xd===kcX<ay
zogkWo(o$W0#oBysGvUgezn$n(IJqh_P!j)aYKC%={@+<-gDDOR+?hA97RR6+rjV%`
zbmbSASl3Z!4EFJQXtNqFM;#X*s-TL!zaOvRvt>5cS)Bgj9h+LwKSm+DP)L_7V)?nV
zc`lHV(lh(KZ6J^XD>o9~Z4Kw~Q^GItPu6HK2;v_r7c|z(AZf?kc#G=^F@u>ii+K{h
zv57fBzXd5(zycRqk1#+hO%9<#tw9w=9vnm5v+}|c+Xj)F)T1io{YtjeBoNC?L{Q)*
z(8yq08WWK>_!}!Am)drq9uuK6vF@Fpv`+!aN0{#rd~Y^lEQUfbT=<<H#9n(g3mBl_
zFX6>YEKce`)%}8o&{c`)^TTe500UOm1cN#HJgHlmMzee$hMR;-CWy~hVU*j~&ta{P
z#pNu_?H|etZ&Q>VE9VM3D6h*aat1ylOfbUy-br)&SHV5f@3Ju^#>%yV%NoB5dAyJn
z+kBF7XJh>HSyjM)4{Wanx#_R(A*0S<<N`|orNat<;)y84QCHFAr<)l88667FbI;{g
z)v)O0yC1TODh{ex4eeql=IRanNtB~!EOPzv)&0k~htp$Rue!INo<LtXh$Osz<uP7D
zGTex1yOdLOsLc1G0=1wQpomWPxnQKX8iL5<(@$m8d1tY*rofi(5-_kCBSv%b6(bXm
zL|)U|_!A&t=`esr;=fAyGuPy_@!Vv4w#0L_JHPaF$eAtpB@el5r2q~=7>M`NsVefB
zoef)0CD_n`t{y>u@m|{V#}TyC4vDu$5H+axyXe>4$`c5B?5u?gjMEPqJ>g4+!A!qq
zPOs9ayw_Suy0g~2+g7#7kx2rJ?8O-(4P;17Id2c$40u{0XA|3etJM9GkwEV=74Nk8
z)X_!`{;OYrPSg;C@Efz~?NHB_THtW2>e~fo-wmP1PPb$!LP{rmeI<Ob6E-mtTZi9T
zY6ye;H`C6aMFjibx+rE&2+fA`RrM-Bw~ekg{}?s)Xl;}SXsEsAJdj)G0EKrdkX_@U
zEX$N%PBaC|`fBUXo%E%Ifo6e~+KcwetXS!5q&w}0KgjzGbE~eDeeE%R`?15R6F_wU
z2;Q)(Df27QW#O%{CA051S;ps#{WNw0uZ)y)^4w)oNR{cwVa|!Kt%HLQbECsQ_6pLN
z;?~v?qT&FDuqv{K4r70rC?HJ~oA~o#UdUtG{lxFm=8prZ=%R?l3twV&y9DWHJ<xw!
zXHMYuH>-@lfN@sY%~OtYLwkqu2s7VD_3Nd=Ow63~*>MQX%{Or-Lx~5ETs1mB7vz3Z
zJel`_Q|*af=iY>@X_HN74_V<qm|XH+p%Q07W_`yVW*49$nFu-VGbn;?WjO4vB*}*g
zSfn{EPXv6GhY5pdU^5*>Wln=}w<;j{gABEyk6dNnVnyATgJv2s;u+{+dDk>M8h6%t
zihS@ejYL+F1#fs48;{a)Dz%`92t|J@V_rc{QSiwx@wgKS_yi)12up(DVe|TB=CEV-
zsB2bSS%1iA2EW56Np+H7GA18rUB=kPGV?F}Ll~rDFK2{9h_eWr%f{}n)gr%AFHy);
ziu9|~I*uL-N;wOS(#X};%B}NSuXUkq*7|zlPSU8%H&t>cm6<K#6-eFZ_FnocUn%&g
z5?hv7D;HY-wQz3-gxRFE?1bBuw<bv6G?e>sb$-jx>#EJ5Z1Y)Y0#!6S&VPd01VVy6
z?Dz+TGy_)}?-{{q8N|#k(mDc<CMe%S{;f8tHRO+oGnl_lLmYK;w(4CDF<@rJqZCp{
z-2s93DcTUvj?EvaeNte|w7kAb(oC0bVm6%#oqNXTTz9dPULsGU8>g{!>DFl5>LeG(
zUi!o~Noq%Og1iKd?j6xL5u;Tu8)4_CWw#p&tMIMh(VEkj)P~^*qZ{X8z`T3(S|S!=
zS51OjzgbjeP@1XBLD}P680Ma6ns;4mr#j50>)f&XfVsy0q=oW1gi{=3qTTF8|79Z2
zukK(n1q2Hkj0<wGpWQIDwz){;+$}cnz%|$UVAoZ5(7RPcljK~zKbN|f**&8H>qMF_
zv`!4W?oJMMRbeb3(5=bCvW+PYTA$hPWdTFVMN4TG7`0d4((H^tl-7PGM;*AEf!71F
zQjeggnkY!%R0_5)1A93hB>6lmRHLooq{#Ev6-a18mYi?-xT`;nQOH|!W#V$+u2E&-
zq%Er0HGAZ6_A-4Tw?8p9CZN1piD^CSy78dkCU<LgCegR8!buI<BIopl0SG5S2Q4I1
zg<QU?!G28>WLfY_OU;Y25uV)?m@L)hq7wK@mt+V2Y6N>*%XBLdbya;cFJ5^f3%4J5
z0m)np%H~zcT*73%HZDQ$+VO!@P~Lo4Xt>s>aj>ds%0XNdJNRdEXQJG%Hk<jnKzpRK
z?E|q?doWz8H(JX<$b(ff@%!2;;^02-`v_?CeOHxw019o{v)Vqd{RW`!#5o-gjSzaV
zNWjEmdY`EW?~I`KV-D>A<ZRtK?ER@V?Wb=eb1ko`FEO2a;+OBGZmjS8Mt84X_4fG+
zNn8O@;Y>0@h<T5A-OQjhl{2SF$7X;eZM(bOt*F7xL?nDTy#cO%!Bzv1h_kE0IcJHw
zcQz7sy5#d}WZ7!S!3q`D0en1P-At4OY8#c*(9p1XFS=;`;?Wu8X+NAUq@<upHk5u!
zZ(6A4DW5S>4>Ygm_<~5x;R}(&7W$hpAWKgTbp`zKy?4kl`9tzLpwT8AQaTU^*?{(z
zi^F1W4gm`!D=s1tyzs&OO4rbLziyy)cL~8ew3riDyRUpv5m*xV@u;`rPC+;^*Qi~9
z2HM(u@YRxd`4IRes&Tk;S9}ch`sHjtP~K4NakFnDF>C^+?Lev4H1F_Y&gvm6%?ARE
zCq11DkljIJzhl?G<lHB~nHm9OCY$VoPEm%<PD>K{T|u`@<##QvA3l8O0i?aNpruyN
zXJ;7;&CXqszN%Xy7yI+P#$oBNC31+SrR$@EM>XGx{I$nhW~8(cO4^>u+4U@a>6iTT
zyyJTE#wjklnOHd(@9{q^|GVd#!g~_dH#m1S^Wft@KX7$|?{DTPfC#^t-dLGRVK*$k
z$4_^Fga?);@0CFBa=-66fJk}D170h33y}3&HR6Cys)^Tnl?`**tA>$fyQ40xp#=>w
z!l<A8z3Q>flMM^m4Ytcd9Zf6rN0rfE1*%IoG89tC9VzXEy7fqP-}>(!%2#_oSL49j
zPsM&#B<LNa&;54%M0#MsQk&6En0cvJg;FIYd?KLG^;pEY^R%hlXfV>m*Xfg>Y26}k
zsS?s?sjzExlpSQMV(qXrT-4Q&d$tjqDAK+d1SR>J{P<@wYw2R$hGdt02%FgEwON;7
zly<7*GKTAF@hRj$5xMcHa)pdm=!pYmV~NxR9kx)T6k7%#<Un9OAx6`4F^Oca&BW8o
z8jsWmdiN??SOv5_^u-zyWceWjZ(*5lxzTfMy26<y2zosj^GJnnQ+vD7HtW~H7+l8i
zgWWX}?yGKEyWU#GH151Oei_-9Bz3Ko={3zrL$a3FA=xF6*p{<pJE`#8H1nj-BsIx2
zhJA)y8-|<FzfpYK6lhlU#G9>`g%#J{fii-D6_RN(YZtxf2(LFnNQZbfv-<13cjOf>
z&GC=P8w!Eo*bF!tBVk+3y0>djFdV4MrfINKKGYWGouVcsZYN<Dinwg&T4N9I5$)^n
z5h`rKMHiVsN@OL&^9f~xq~ffF0s-@VVXT5i3#G8*H{j8iah16Io7tAG>r+<nNS?r*
zqSS8h(P6!A-zTmsR+Clh?so60=H?n%sm{5ZusPdnFTtoI6!HDEwpJJs3Beu08P!yg
z1^cu~#-@4zyi7Ji`d`+FTv%tdsGC$?i|sdTRt2ojgav%OwuHYkxCi+1md?aB0mC2m
z36+RfCC7HqA;fWM#dUzn*gB~p&1&!CCA9kIgm%|if`C4BFni1(g3v7?`EVfr>rfmI
zgE6cmpbYhFf;6edsI4#u)};Gq5d`DjQN4ig(g;vZe*$y!^H1+yP2bJz<!H~c_&ayc
zRc)^nZ;zSGz5t9EV=K2yD@%7aV1x~4ws@eQ6Y!=rO!GT8k<)J#mz3D3WeIUN13?YY
z-8Vb{>>L_1P3P{9*vE3psYIu3CIN)l4UVCGEJ*O$Oodk3rknQm|GZmRU=NwFE7@KN
zB;ueVc?NiSj{sE!MkKiSgN;o|ERBS?wn}Z)T5}?knraPTV!j3d>|F7H%UbMUdCY2I
zy&Jpr(>~V>vzM82S&uMqpR2aXS#4A5pfx6~#}nHNjn*D}LHPc7p}Xo#lCd^hx>arC
zJn6;=<ynp$Q!5YqwFU%bVy=;OUS!}XplOMX5o1e96Yupqu#}OwM@MsZww!pwx*kh8
zMy^$&{S=n?cDtU_u4@P&?bd|olAOBh-yQh{g$+k^M^#i*Mmm8u+<khi!LZ4ZrDAW>
zh~Gvy;;+rw)`)w{ll3|KL-%UYZH{m-+^uj$4-ka1(Is*rRR04RLj!0Bj^IJdwmpIZ
ze^}f6)NxnhXe3M=7h4jV_qMDo>ioWQWR07xD7K^SkRj9023|Zz>by=N15_WK-NH<^
zd5%Um_Zrgxe7$;j{jbo?$B(5)|75-Ke66?bax!*>{)t8w7f@XMxW-(W7u**#w`O?a
zz#AuVcPW_?lR|zPi}^G!eh6KeYxD};l1^H%Uw*)KR00^yJhEst2>AmLVy(ij1wpW>
z^qd@yy1Rxzq?ha`c+6yHAo8ugRH}daeVwK6#wg_j{f`l)Jr8CTG>d#x9`WaT`=x=<
zVymaaHb5Q8!H<o8jgE$|r<qw!%rni)Kl0R2k$-%)$|G`E+?y?BenO0mW3PZ|viNyQ
zm>DnBQ&r@BDgm%FgW?yIj3dxK@*a}9>Tg^KgnaZ&v^QtnL;TcF2ePhGR8qP(ZhP<~
zi~zs&N|`bDYEJneF$|d8L1#|q0Avr}Q+m=Xt~%n8Xr<1ipM*!R`heL$!{w-mA2g}K
z!OZ8EC+qWan_~Wm&?|vRo$+CJ)1_-5Rw|a4hV(xPZ(4+5uY{L8bP?h(J9T%9?2%B2
zrDUlXoE#l5PzXV%Eu}73CZYZ2H-`|k4*$iFYD6fm|4Qa&eFmHrW=3kLZ*?ye!``O6
zw<NAMK4PVEOATk0?tevcsGuJnIgKy<w9}HMFqNNRU`GK~4MYq(hc)dV*aHUOnA74f
zu3{`L948bP{2X^LaAYMG{oCTrH+w9s-~rlg7Y1*ww0CE_?mS(P@IN7VB#EE;DfKl1
zfs!KH(7A*E%gH%SC>^$E*w#DTFA0rd{0=iM%3K4&YCswmVP~$8Yknk2@EapdXpV`;
zxE$3Y_+*WqqB|E*hktqb?Vl>z?Xo-d-^`E*es|<H_-<QM^s#PYVYdCpyaq7pP8A}=
zOS}}UGV<%!J6*i->}M1L?{o)Lw9Shvq98jLD`0Tz_3b|=W2<lsUH1lmVk(E03rR>b
zy-nR84)(Axqz1<_{hRv3y-;latiE^$UCj3Z0hH{oFErvPSYH?&wk|9s<IM!=6;d`C
za<Vn!z6_AM=^4gcH@m{{<^ai2E}j{X4s|b!(BfVJ!9g-$H}0h&K(w8?F2tI;s}Dy2
zMN?P6_4&^HZU(oZvBWm8d5!5@<ZJ@vgH1_s@z8zF6_Co*(GI{!bAl0=k(L!#V=i>@
zmjnMwxP|{~;AKBvDjarQb`jZRR4Bdg6<bB#&%4!DAyW%HA6L)>$}UX+e;P<Zc)-oX
zj8z!bv=gT)$}tXD{_i;gV#|)rq@D`OAD%i`hZNCZf#rXEd-%=O0{_A9Z|aPC=%;s(
z`X9Rk0B^j=khWf_es_3ucZe7R-<@&R7`Gwz%QQ>2W@=0&bVqDPofcbM4-cAGa)51l
z&&V@7+y87ta2Pl!9zXaE96!Oo6)bZ9Jb33`!13^&CVYRxF>!C41)}*rgFg)}{C(6G
z0>Ll}&`!*!szm)78A0d%eX>3v(t_5u@l|=q{w1`Mx|SPa$YXx+U-FQPWRg0&5md-L
zth<3UMM?Z5O6{?0cWJMLDlcYqtp^`3?|OB<4iNt@Un?E4$u!`q!}v>Sx33@A#ZyvE
z{Os^g{yf|Vb^>z~cVOSAb8K{4xX<rUzxjC`7Y)AuZjAq1X#yIj`R)*&&YFsdKgSd#
z!MN0-bNT>;qc6sl8W~(3v3)H63t0R~pdJjQ8Ur*q*#C&6fDa+TOHnFEg1j{vA4>i0
zQGOn&ijVeeayqqvs}?7uh;BDjt@(MwsTo^eMn>CvkF4bAUXfqgFRx`}M>^RJo6NA-
zZoB|{e8iajGH<|rx%UIV)ijz4_;MzflOO-@Jy;AnSZZtDi}D7@TJ$Z~t4`2@0HgFU
zS?313wh-W2OKb7M{x|RhI0S_@PO(!}Mu$EQu;--K3iR}Qn>tcT;NO{HVbbBlH*`Mg
zPy-$`qa7huJd?Lcz+TdSY}RozS7+IGe(n*4{!JzVm#+43(PL7D?$`akYx0S2JV^le
z{{JQTj{;tc?5ytbUJfdw{<N2SsVVj<f(CGxygAZaHi2VU{om5)Q?`_?f;_!78{BGV
zf-XG-O%oq^ZUWb5Y|-w06WOK<ti})EnusFV!?IogPQ`|zJ=zj;eLxZrl<oe2gsq?r
zn+y0Xrh)$w(mwsATW0Y-fboY_aCYkA4O9Kv8U=o^eXh^#z>;3T-MGK2=%0o;o39((
zzPtUBBQ@UmluI03`LK?TOxS(v-QSu~D`5X*dtg42HsYE!h~6OfOL-!d!13WN1-4{`
zPSxvJN@2pv3`_LVR)Jx3y;>g=(C2<rM-SkG$xn12{BwzPtxr3EKH?%p6mtbwCcyrB
z;t~KvQ+YKxEs;})-=C;7E~guV*KKWRhJHct3R7YrQ1Zj75a<v4taIR=p)%})iO*`-
z8W8pF%KiE$wy%Nx&)LEYF$jiuD$&phFnxQuzQmHDfe_|E@pBu<;WlOyY}^d{;$MgY
z!e^fO>S4j<gk5r_J1-jxQ5C;NoBhd$!eg38p(QDo+f~iWuY)doXh^Wb&^ep>zMlZ;
zs%~{;Ccq$IxlPOW2}ouVTH~7rQLbXP^UhD=^Vkl=whT}V<fwP2<_*wNa*isvV1+OA
znYTQqNJZ|sMx5@<&QjXom){KsSf@2i-9C4sv>qwR0A}oJ)l-T3)CPU5%Ru4e>dE4D
zb}jyMl1=^>vzg9(9_)Xp-`w-a#m9EJ-ItdnSUSyKsyHhn<LN4(ThgLw1LPiSQ)QZW
z{fmTWBhEn$ExY9vpR+~0N$!0qz>=AnU)>>(@Nx^DNMRhDZDl%BM@dG6tt~jUv7bLW
zZPWt75ToM*07quQe&@|5XGDOy*KmiVl)+p|zHyG4dQB2bpw-ufJz6ftML=PF*2|!b
zj;&9gO6~LK<II4D?w8bndUYx4(gr1CQL7uK+t(P6RRZkyH$(!dOIabBLx%zQXm+l8
zn<p1w)Wr`mbP_rI;eUc9s@o1**8moglVm8h^So#+-6n^Hq`L-uySH}Fli1Pb^c@4n
z3P=l(J26H<5Knx^*023M@DumPZ5{#G)7yU1VWeeE;BCKpciESN886EG*fNLy10_;F
z;1&ZTQRFVJ0756a@x>w+N2qIC7qxE7;hss9+Q19O_M}T-Nm6GX;-6*J`<cMcTwIsy
zEEPaI3J+<=d!$=|UBf+Ro#Xqz4=WJnQ}P9`-<;>U=^QcDV@V7=YMd3<2mMSBX_5FH
z008y!de|!klaUyF(Y6A}2^+Z5k~)B4bkS!~fX1Agje5y%ud1)q{6Qv`3ki?HgOg?8
znWu+vJhl_j#|n(Ax1=Dg;A&KukV1NdV;mq76sWO4mjO^6uEXEesSb`d?^+Qshn_h>
zMRL74ruKg2-F+s&-qUMbqR1KTJM|;*Vo6sNx!+*CliDW$TTj+Cd4bR{ajXw@7ne*|
z7yr(Wz8Y7lx(Fa6eE>%A-Vr!B^_caJ<2Q5eAq%pke-aDs0S$7Fw*7hw?f^tX?z3D#
ziyT<@RqC>57(bfeR*$UBj{Xb7_qpR<BDLqLyk8_DpJCLAM(Jr-Cj0?cGlT?R0ta~Y
zkJ?u~+l5kHHuvHuSMeUbcZLR$%C-M4{+0xMO4B?*8JWAzmNHqQcBX;tWAy-&bxRNJ
zjoXG|T1(}Y@Gx-ngu7^<^#<4yFv;%;PyAER;5a?_zm(c;(K!R&76xqn7PLo<Hb5t+
z<1}Ai)Z6I9&#m*8Zv(G?xaW$|<OSoqq1cejG!3acw;8RpBypEN-+#&qv%G7G`C9b%
zkuWRu@&y2=w^=>7i4k1ZtM~HlbOjQ*Nq)XqPjQ#BquU&@$W!6PCK%3+3k&9_hyvqZ
z6<SLLl@?@Khn|55;`@piXQiS$yn@y#RxpA1N0Qxc2ff*&0c!tBAE0a`Wq(Dk`|3uo
zvM-nNoQ5^Y-H+a!s=G&E9czsy#}kUGr8w}+D;0Z}FGt%ev2ptYgN7~3o#RI>Wj%hX
z*}99^dXRsXoZ=nZ<`+WN<wOy!%1jzzw?fSkyKs~QfN!Ys&%W5=PDk?T1P|Fh8{HPV
zKkIz|m$B4sa2Cb!z4m%?l`cI{#B2ZW(>PYH<vG9mtPbY``#mnDEuloT=-9-4gQ90?
zxfg<Jq<AT>^=RF~AKi{F6s>#6<mzGFe(IB7^s7BiZ+)-$qjm5KXGY59ivKAq9h=8$
zH@31gEq6SxQHsIe)#%Nh2yO?h!)iu-%#8pXOTMvaKrb)Ft#rIUar9<ih&5qn#}0}%
zS*_}Mi{qXF0Cm`B*#J<>VQuXSWJ#NkPJRaG!*l<wTU-7)t$?hMgyUjmK7YfbUUafV
zlj*hRYClA2y=&35*o`~{9Ov+tKd+|&d=c@et@%U3L<HNzMqi>ij@R|HvwI-fwXLc^
zajXG~Isxh*PzdID<4S+o%H?RcS%%jEhX3gE?w`bOHJ6nnx(LFL9eeH0*iZ26wncL7
zVAf5>o3(nRY?L)_+O3rpsn18*1)1%P^%{S_HFEQnxvSIbLG?QCNr)*_i<OEy-W_mT
z#C!e5c6iyPYm!V2|JZ0UDSBSdW<I%4p=L(+l$98fX0rXtxZ@Pfe&9E2R*degOleGr
zXR77Jf}d8K?U{g^f!7;GVy2C?de8Jd??&Z?qY0lziP<i=VP-u&)wQvu!NLu;2*+Hf
zwT3Z*!f-klIUQ297i8IffJc5YQSazqr8v;mG<W@8xWqD};|ct8+bo>vSqaas_8|hM
z`MgiG`8`5!foW0*)V8NPhRv=JtC8clqBt-i;0dUz=T1yLlZO2dGnQCY*>is5UK?Xn
zVpldb+NpsC#KR`}O=f>JRxux`th;mxq_=sm1_`&8kYPyxPO%V%H~=m!y<Eiuld+-E
zVOp3<U`8WrhdH}M_v)j4&KbpMoz&YYF91XE$O0Z^k9<1`LJZ(iJTK3^DPrBX*HksG
zg~M;=d?wG7zKxT_4zTk?N2AVj?<V^#4=zg)=moWIvk39eO{D^g(D>BGU)o^WXqC|Q
zusDyduvXs#$ZYpTaZ|zBY3A<7qolkT39$&3NgC7%4QbEAkB>L|c|RTw5<Ggw6LitN
zjI<niHp`1THN6|=7|%UWQ?dSlj6J{*5Jj>uiTn4-q(8E*t{+RF;G7U&oC?2Ah~@50
zP>vWXHU&GA%VfYnnTSQc@cS;fbL@ot;-JHu(`}4VW$ZoZX!am5M=YFMYDPKpkmcI}
zZ`5H$X3me4HIqSCn6yL{v-N|&KsU|+%1x!J@cjj~9EeSB>;g)|uvE&~8dFo&Kx*HO
z1g@1b)Y1eLIBybr{<ELD%ATkxkOY@wti5+0<eE1YW5#fY>Y>an!Tb+M7K7{3e#ju0
zN%=;-Yh}A%@pDD}Fsx8XQR2&EpIpIwQQf**Zbr;#0}pS3Q@EaGA7}7cp@7LGB#7G$
zCW*3(lQslV1R{}RG%lIBn+r>c3~{gsZSZ=~%Y<q$HGG<wxX*;=7}{*-&)fR^{mmPi
z)g-*4XO#<_jC8^?cca`Hi?6EBFQwG8HE@$MRZ@r8iFM+sgDfpRV;OI%!23(q7&u~e
zUz{qz_*q6uMsgWLmDEO`5e<~%2zTv{a0C#NA}bBq3<re0^@XS84`g{ZEhdZ36HWB_
z-e1-6OT8#N#Bye8@pKC65mTu-pAR#epxYy15jZN3cphun1#{KB-9D9mGbQ0>!MFDH
zdvDIL>RdBuAY)M%T#wwD-MP!ZY!TH?{eE?DWs9=QRavmsB%fZ!QdoXIgRq83!9K&d
za)A)Op#p#l;FyjXG7ePPfq0hH@mDEFJ==Vuw3)O=zfYe{7_tG2IOrlT!IaUXVDeR`
z*l53zpEC;5t|mW<6d|1f7)QS%4(*xUu2z9~lI~K8t!q4U%mt6zy4A}AAgHTyfKJ4u
zaF*Ji!??$Ty)IDES~kn8YgFOdeLbhvGJRLrn|)ZS)zS2K+JL<99(mE5?Tg|!&4IGk
zwtGCFm2xm>7fiUfSv}w31E1F2J8E9`a~KbAn!$4P&%aCVYE;`JA9vVqIM5ADJJn8y
z1=R=)G97%|5tjok=DRK|x4FcEFC)NYR~@J8aT3(M5^RpjIKlX(q-;L)!IGlA(r+w2
zW$A^XpVR<#^{OBn_IwyPheimmiwMIU3~-d8wX??F#wWw3cWx$c2#gj1BP*Tgiu?9G
zz9}=GATRqMlwSOflx>3Oa5DGK<75_mJ4**37W@AY7&w=?d<}J7AX5g;!h@BYOt5B_
zkn2lPQoF?l%jACAn7CH?IfwCDbsE*90=Ekr`}LbH|BFL)T*qAG;<mjMmU?lo()^$&
zr3FT>*iMiXv_YeI*2rDuQdJMj@bU(zu!)A^R6sFa`DYa|$1HRSv2u$)oC#}iu>0At
z^7r8d2Z4@6=YhsOFKRqu7J**XrAE#W)rGo1k$5lr+Sn%U@<IiwZqKQP;(fGYcUgCW
zx(yR@x{ot=BYC#d&I8WvVwpftk7K3VQs=TUn2%o`cewZ%SqM7rT{FJKs+K@u;#uJ~
zZJfP7d4rE#6zXGOlbEuiyg#GbPS9p9_p1>m)FaCa)4NSm62RK48^~_&SNwLIKg}z_
zBv)#d^YDfH*e=QF0CeZVsK5hUa5jgu>?|4MYz1#jjuI7KXtmnZUQB1Ddc2N7n3T;1
z^jI7wQ`$V3ni;&`GO&HEPTK9kRQ)v7oA*N+T-0E~7;W7~CI9r||J14gTA;x3y-^$Q
zJ7z{n#o*A6J<q`>0AeuG6MJRa2wG^Gp1y-*3V;ku15H}Zd&1KJI2dHo=5>&=i~7e^
zxeq8%)sjZle=zy-*O}f&V;LhWq9hm@hU_O=mlepmPoE@imX+i@HLn;vJiSLVNSli?
z0&vVLu;!{=cA)z~;vZW8suh3DO2V#^v3;*mj_B7WfCifa)8HE5+(XgbuSIttS6klQ
z^L(sh(6hQYcf{KU_5waO*P>Ne_Z5pwa+?Y%inRlAvtMu{$FBi{#92luZ0e~<N4RZh
zdRFjQm}XE9iCs{*7J}ZL%<*XWO{`}kSaCDeXep5gS4je}xCtasrB1<BGPeXzeE|o?
z^Z@ZT<4)^Z38kW7Cg|w1Am~hGW9<oqZX(|c$9}+zX4?|1DWW==N<S-+aoUaA5uZqJ
z0)?sUeLOD=e78MxpljIl`*5;e7uj?hwc-y^PIjN1D+$W;nc@`cf+fJzVNW!Lax5pf
zKdZ&akS|Pd^O1s`D0TGbU6U>+g_21HHbc~s6W166d&|yn+^T4+`9>&nV^3Hbr9`S-
zordNR=o9g=o4|u@ShE+WLa{p0l*ip`;-68?@R?rlup+>*)wTk0jq%!F9MtIs&uUYJ
z=i6m92GUbKLQea_W+ogW4(OYL=A3J^q1-PcCgvF(iOMG%4;5wJ6mP+ZRwrCJsF0C{
zc17(h3cHyu0n*ja;H|~KKY-faL+4#kcPl6){x;x*h->Lw&H<>+T2x*H^)76zA2>7H
z9GCA*C}u7Eag8%8`i@V3=gG`l&W-s_@cjiGYOvg`umivviRb&iy{7BV4+^}?_$J7C
z#L<drYMly(IVj-Xhv|E@nHu5Kcm%X2SXbtgCjrYq&*ItoQyD^Le6RIhZ97$j9b8>@
zn5OGshpo<e;N+u9owp9H=f*ld!=#)jokFh7{EVu*Y;UH-jVU}i6;O8(z$O=8bKfn_
z`?asfigX7V>Zl;6gFs8~5BC8-=fLju`%LqKm}80D*Wd+Je+U3MsilJKM7%WQ&jZ8M
z2Ck%j^Tzj^8k4@TiOgN$6Tdk^-F6L2+^piAU1wagcq+cA%XO=_e&<_@x>rR7%HGNZ
zen(it`FF>fZas3VN*c#1RCl6pM`s%o?)Xd)W!cPC8_A7@AU06R?t)kDP+xyppnxis
z^Tk=&P5c-JO#s)_gVmo6{q)&qK)aqdnt2UDlw8cVJ}H?MR;;lTp33#S)oI@mi-x&B
zJ>U*heGp^VnzEB475M2S90hO3+7*QQ?E5HPhr8Bn2!SrI0F<$>+!$2RBvHP_f*QPr
z?+J1{>w{7q0hnM3;67(`RyaT08#c>psx3x&N5QJegYCBe&0_#?`ou5PPRjIXYf>$+
zJ})VVu^x!j`JSA`8^sJ3a9WJ)I83*%K$o1}diag5Aga@2^?_S{R#vUFEzgANA+eY&
zx{lSj4q$(yk1-?)(b;$??25KCqS8(3$}`cw)cChT>C$6dICYD$PAX$YN<GVt5~^gD
z{E>t%Pw7`dz$RmSX6z1}0-mi*k37itm^`^flwdCq;&1FS5H}LbB@owOLL!npcnsA$
zq4h6b9TxjduVsRovsk^wr@?Qqa%G4RcEVpt7ffiG(1zG$nH`<L+~3fcji2kHnz5fl
z#dGdH3@dFblk$K6Jh|_iOyh5&uHQ_@v{rwzeH{gh8qFkXLX&<mk>BE;FOfh*GLOFf
zJXzQ2mzJqw4e^czk*{5YP<90;(oog0$W8k?qgsO8+v9eS-D{q&&{Ad+q5w~7dVzI5
zaaJ<04KtdAHz~=^%1#RDr;OZ=-px2vIxi?>ROi`?-1f61%Pj=W02|bkDEIdhh{r&A
z&F&@`^^kwLIIwKzj)6FS-t}H89RQ4`+C}%?bk=%E%ldshyfpuBo#I%&SAst6QSuX#
zpOfvjbz;wkeWPVx<-bv!JU?&-`<u+q^#y>~MoFWXB|$ljMXQ4pU3PS)h8#{H)MXq>
z4}d`;;CfkYD?{vFtj;?SWy_gwYhM{3#E)hpQjI9IDZik%$kf3zKRc1IqP@SXY6*?;
zN^;;WQ>PcJ0ZkU*qv_`(Q}@Y)G3|Mwb?Jdkpm?TG$=86aWZHYetK3Zu-Q9k>X@8oN
zc_1jzaG-gqrp5hMd`XcA^eiC`!OihfwgE&-MYKOx)+BZ3o-ZHu#m%D3BVhPISKQq)
z5(W`tvg`$4tD#u@#q3&-oa`wGXU}D<a}chFoa`zOX%XAiWh!fh#r{ujQ<f?IifgYw
zv#lJ0_elY#V#zbiU|<GcM^#4d4eAS;ttA8$$;tf^%^;fyEqQxO*7%-gTR*q@U%r%V
zVoSg?glmjp`0<};u;XGtwwS*_3o0W!`x#QuaZX(;nxYSoQj;154^CC{if*`7#3(;Y
zuN`O<s78CwRTgXK_sdx~aS>vO13e(1G*p=&E|BEVc`qn$=ePMuiNn>+90^q$$}S-l
zT=ucN?0qF1h}LkV&Mr$D&7gvTvXrLQJZho)hI?u1L@DW{;MbR0u`QK1qMq`PKQ7x+
z>)=}k*P)vYgSQ~d&<ZV_xm0i{HRkB^BO>_pOMPyf36E7bw8~+Dq11rF;zMDb564KU
z6$UnItKk^&clrk9gBR7P={R{gh&sMF$hdqA;codG8xjcpTl-rL*sn{+8soOE7rxmk
zjSWMY6?S<&m&^uU#cF1kXhqYS6Af9yE`mk5am(%^YjnF(ha(mtFK5A#G8|TX%LJ<H
zCKPTv@f2l^9Sv&RT0)A$!c^XT92<-Eb8bh1B!rx|k*)NqP_-YMVI#awVjIOAo_h&1
z4W1o|ISzAt$^3k90*HU+N->{6a&C7KhqYgVyLO8@tcl511YwuuG}JH@8}zH=>uJ8b
z#u2$Y8R@=QDizZ``!29ZKY-l(^A+1g*&Qf_NqfS5T#2>VgS-#AkcVv{4it-MVgMj=
z7TW_M+|js(9Ru^NxO=0J)SKwuVxaXuWV;Up%|7E@$le?KspP9a`aDqr^g#aISFQ^o
z*fgURej`O6w~2#FaBPQ@9&HymzUOH9^Xd3q57W;jr|MkpWw$t~%-?}w6XR1DB<{wI
zTG)4aRIsLj%jrGJ!YCVoVcI~E&HLleX-jLXH@Ve=FiFs}=u|0Bbt7D<dJoN8+Z1&@
z8(kFauzDZiqQ0GET|J6H7ufj_D*1MxF+KgoqNB}T2*N?bS1`HAGgZ#i{}w*GCluM0
ztNgu*FI!^3MglnxW1!`DY9~UeW~!4>2A)W5O>a2B{yRV}!`3_4q~~TCImFhX@KPnz
zd7%dGC{0m-w_uYfFm~Oj6uWBj)%`1VKbpVueCXoIX?wbKR_};sVpDF@l7}c@ux16-
zS`wc8-iq=k8>@_+jJt<w3=S#{o2w<yhxC5jDFU%SO>Y2Yeu@3XVyWk^tkO2rJvBw{
z`XK&aVnr^Xhe7o6EoN^h?p-awD@<PjjOMOf5<tv^jy10Yi3C)ec8OC4U)sQTr|*h?
z#gDJqWcKl~w+e<Of0y%2f9lYWRW$z8RsLCG(z|aw+`}8p+aIKu1V2jPRQ?_~EErA4
zlz;vmsx-zd6>K%xpr!abzukV#S1+DsNNw9}!uY_x?6h25zRjRA{)>=p;=9HMW|c)K
zmM8l)Z+N09JMNdakFEL?vr=8<*RuM4ANgck>P45`s{1h`wceT2i6wbvx)$hWD{9da
zSak`A*skP>)icX1e(`3L=U!%Sa%S!fdf65<3*-cXLY<<ClbOdFwWsMe9VW{?;H=nD
zCn<?R)}>*B{g);nFS5BXH>|>NsRhL29&%)3%j*Z!)=V1p)hvYB<0<=du|8;bOI=9s
zzHMO4w*`xo&<_g_gINQ<ZKArd!=<*p6?|RVA;~OmOg7j(jQkAyB+^#TNak`}r&P+P
z8<>{fA@w+vOEMqr1V})Gi{{9APpGy8b<<}b0pkO4v9B<3@G11Av|is3*h@fzioL1<
zXV+1|gnz#|yiMxcK8sou55C`VpgR6-Edgm}=XNM{L8xoU-YRoWg2!0*Wp{@xZVuG9
zSYA|!4IlLzwbKx=>^98a_g-eDxaR8<xPP@8xj$KSa9vSuWJImbtET6QwrNkl%kg6n
z?&1*Wa_+<BF3uzuZ2hy>$z;cSr3^vH%EcO$g+0TCmKMQ1{zIkbBIP!A14`-H+0(Ox
zKOFdVU)%`;=Ab&?vn{v1nJUk@TjYgzdDDw03qZe;G`(oU^c4J$R$`rxNBdt!^BviA
zkJIe-j}Q!B+G=z$6+kA%UvQMh&6$;F!5(!^AE?}Ma8y9}gzX8t9y>%as+k*dtPDL4
zcd|#fn46PhVD#v^CpZR;86#6I#$^u7S%wX)D+J93_n0d`*jgAnA2%pAX?@}u=DJQJ
zNoT;cT%}DV-E{?GzkclYGNU_wYB%<r)|Pty))x;Mpt3&i)}d61e#iJ^NA0%%B5b3s
ziaG2qyzlw$yXc=&1#DRC;Zpryn*uG#0wbHs&^aam>ZkD3!M}6!`2$GD7AN}5=VV#K
zo_vr$`PN*?iB8J17QAmYe>0>d>hfvnTyO4G=N4sBY$w1$FA{06AAT$sy~);TSSe(S
z-y&$9kh7lSyOnO%A(O%d>pr=cEP`G<(LghNs|kBWY3rZcdsV9!f%f@~PV$fV<2rQL
z+M+cYWv6#~L*gl4+u{t~=6#XWg5MJ?K0vknDbj)4F8=rtHwEnsdAMAvRD7g;lIOzS
zwHv^#VmL_ZRsUsTw8Q?y7Wxqryzf&x^;^DHy;!`<VYb@u-95J4CZ74*$E=EyowyKc
zC)&M+IlCs%&92X|8Dx?ojX`iUK3kVmYNIV%FDk;3!dl&uPX;7~Y)fr%Q`+d!{xod(
z5W|Ls?jZi9;vORIsxg2(^$z;cP3xWxD3n<8(a+tTrCa}jhf6U2<52VCp@7JP#~-_$
zq2TBp*PxLTKXkf`vHDHB1~azgsO|5y!pg=*tO~&dO}?uXRVP9AOTqy+l{q`Y`q|z!
zuByJ^p)XNd>|Y)cNf$6<WUFD9uyOIcSUds^nHRY8Ln$caM9jwDI=z>N{>(=Q!w3$-
z&SGGM;d0gs=lw2SD{M(bz6r{?ixiOkwu7bxX&S+5N`-Kvv-mOdT(xzrNwRMO(0KId
zuv#GW<9NQJa|2g#CG$Gwv``d5L=1U>=dmm>`?OYPM(=s5GA1-xkGT-QrK+M!gJx;M
z9LRIc;vGI-OPshKPCb?BI#J)&Y)v_PW4Gi8__HjW=4>m&nk)?{t|3gxsM-PXm}a-k
zaycC+#=60XbJMLEbe$;oQuZ>oD4Wqwze%4Nlc5?=kkdLPFc7y5PQ+AJU^)a^suRRl
zM#j%dg^}xUH3GU2gXfZ>ZV;KEKL7?Gwr&rkV;H@mxi#6QUy1DV!ve$3dH0?;l}U1`
zX4pm#GssHcgtUZ;^F&@&U_rz3V<yyG?3$-6h>a<%`90I-{JV>}Rc3iZB^{%~?qtQx
z^=+P4V=TP<f$RD1j-QdPx4`)|=(b-q3XZ@2(_VcN8Xnc3ZnC{$g3C&OYm`6yj1PpC
zz;Z#MLX!91W2B9zb#F$QRdnT?$Yn1Gx|5?c8!TX%zP8J737KI{ov<izUnU9_IhTR9
z7aquAOX^|n{*G&MUKu4b)VZMDtg{?=vnaxYXTL2Ca3z#X5&xyx%69kgy!@s>6WAE?
z!iYLNJq<(U52cu2k|5#mu2ky=yV!E9ew!DFD|2i?VAN&&Vcjy}ei%t5tsqvZ+=q_&
z>e}Ayr{Np&^u}6x<%1%p?4%lgk5*nv4RGcCN|G2Ik&P!IoD8GsW^ZCs>{`_NNTQPJ
zN2d@?`Hp&fDCv~uLxvS@P}ymjk|#+7#HUS5y{pmsG_&EAoc=i>dEs39MkPvbmam6#
zb~*iWEZdoEy%%7n$;C5Co=q{O4ppJu%38j!&gBYHL@VUmT>i=UWujVC0E@BFXJTvQ
z7<|HcCwEy$Loa&?Xl$b6#IH-a+o^PgF`^YCElEV0l*|$xjv9$csz5LJjls+!0Eg<f
z>X9P_6S<Xth^rWvtQYR)_=e^$xtsyUPESv7Q?5~VnKMW7UyXI5+k%))QP`i%KsI)k
zgT~C~vDzXp`sPY*;z>o8-@a1FupM9{ah3QbJt={-K~<7)DgLxDUjcUQX!D+z*Q9{J
zvVVo)@k4#x2eK4|4~k|!UYi>Wtll}`KfsT^prjWf*^~Q*?#0SABqcPlEI%cAYgYC%
z=Lmcgha%{_a0nq(*dl4=Pr+-5Q`*S1=&KIRTbV>0h>d)ES#472y1Ax9u^kp~{!v-@
z+ZdgJzP-oN$n=gyO`OipC6Ab25MHA>wyBr#*YjL^wsiNR=86UUb=;Z!QU}C%>gH~h
z-M*ECYw)#bck%O3p{F+bjw|0GRAxnNq^VRA1k~rPsD}>InxAq6ex7F4a`5<f+&pTu
zgMBj^F19tLP%hi0DU={3JrL=L7!ey28MXLx7v0(K9@hlq6My?tw#B5}Kl1lsWdpDy
zm`&UG`Lz}rTRgxdOZ43#*xL@fFR2>;|7?l=UQq4h=V5qf)Sv2Z8mxy?j;XLE1LP&<
z16RD<NuDISynAn3r}WcGNKyU4yN3o1Ya}Gtk;>681e_{;YJ=H-JVPxs6F`p5Nado`
z662xhi+%ZL4RghU*$jnd<8im3x*eq|Y=V-BTvgTAmDy>@!}M&Q8nb`BV^R=~4a{hS
z*lA_?@oH^1n){ivYyRbBG9#REd(=%hWH94qi-BOb?PHI|G?O#9C7E!fEL4)_XD$Ez
zaF|P0M*!T*Uy9_MZX2m6Qn}_E9BX;orn2C=&>Zw*t0?uD;h?0csu?5`s(s7cK`2@X
z&uYTR=G2Yw`t^6(gxP<Hv01$s9Uoe=J0K0y@Wb()O{1R;COrG;m)fs0&9W)2Cq9p<
zfO;>a|9mj&bE(WkJO%xER7KQ19|#O|q4^Ak*W79A;gmQkGGQ;Xy<h#T=sM>RMiS4?
zHldyaBF%T(v?qnwt`L5Rr|BmxDq4XntU6}u3Smh`<@%FkniQ1{mVXUA6BndDe?#LL
z5zPb_^N*<q&Bv}r2kwbgo$*x>78K6DTu^u-JZ3>FRxa4z#z+u<Xu~{gv^3vXDmESj
z!1M<&#48dJMA6lFn$3V=Q55=bwV=~PIvUKwV01?;GCgK_$DTETPo$j<idjTMeC(<h
z?h%jJQivpGz<zn?jwBORVL1A0-@isfoPMC*$|Q!-ZbDKqOIVzDUUsehX4-u9F#%#w
zXc;y8c?k*SMgG7G`VH?oJi6BR%j>i@r|<YccQ*-ntui2;=gftebM5`y$6lzgYE|`i
zU~cb-7Gx?-fK~i64n(2T!tg4H_6sZqmL|TCf(@ih`y^ljy|8Kv_OB(w-^I0`Q!S2e
z7g~pYCAY!e`o$DdXZ9}jhVXyu!<?(C5Pux<?Zi5d#QljYono4n74u2nb$kEIe$`$v
zul)`1Z7c<ERM@@BgO+eZWR+PWMj1g#?yQL6O2E0nR=;`L<MV3P`dn>v5Kv`9&@>Vu
zpNfQl+2EQR>bWLA8<hMyblYlQN+B!J>y2!I02wSi{$)6Q2h&UkVP^GF>n!9V4B_jM
zcJUUF!d@7ibLW6BWrIP2TxXf^tW7`}H%zY(8=9?$b`7*7TO;15Jca-CECBEY%ztEF
zlX087?6eun+1W*&1HnHWfPQNr4Dc8kjx+)9+C50Vrk$Z&p|qC1>plsCI5bxRy5>DV
zh{`DvaCuBr#H+RJv;J&ZOWIajhsenqqDawXZ^6D_!H7R>Pf&>q{`37Kehyc__NDz-
zj+?QI;ugq>#DIQzRJ%)icYLfpA$Qhn@kf{GUSBGv?P=kIpduB!Qbx7y1B}>ayGf{{
zxZAeo8xI`hd`WwJ&}MRgB*g3mLYpXw?ir<;Uye_Ho6>@ha3|?!O}N~Py128FlT$E9
zu0U1c-n>oj!H{lswH9^2`zCwR*EVafXqw(l<v3E6*uC2e<?2;he9OD36kzWSJ=0EH
zIvced)^>%tYj8F#gKn;kPfCsryIOa(!G#*|@nR~X<r!@2uTASlV8=(kdDU)nt-5cf
zwi?yoGNQ17BLVg%c0vqS`%1HhTQ(|EA)WPyhWsZIoS*=EaJ8|4mRI38LK$w@2U>`O
zJv3Yp=nlG0nJ5)Vo8V(CI)SzLg{^}}<(4bZw_0No20V<KZ+D#Uww$e+I+yQ*`RWb6
zJvA@ibJu4tPo940r_XK_78ro4LBYGiFKuO@?pvphbd*=>Vz3}~$J>k6>Wyj%yA`{q
zB~6aQ;|P_Bxg=6!`b@<IPgn}j%DLm5l%xK>nXh;^=^Apae(8auWn9GkrC%{QgsRIQ
zo^VcHe%8!BW|ZS-T2eI*o{x-htG{j6C8wRunedwM+Fut{nf*aY>Aa9mOEdk@MHkgz
z2tgC$969d-lrkN-XX`X5p>vI(^+W)Lxi=kMx7^D?L_PkhBSfe39rW4X%&tyw{|Il}
zOflRQI=GrE4}({)M4kaq`%{!I_Q9(6&}$%7@<haL^tN9(NqkM4a^Hr=k_ee(bEmdG
z2k2>p2JWLvy2}<XO;;mjtcz=#*o0zNB9*t1!(BJS*LS6$%$c+S6!|(x#IY3*2u-xi
zlUv7F{aXU%CYV4z?PppT@a(9Y_3P|{&lu(zWx~=rVu5LS_Yj4Q|2Ib#85oiIyz`_a
z#kx=T2{6vK_`U)0Bpc0iQ1+t7xn)=a1Crc&732A!8h?yvDow4?FCtSKlY!}g!5C*a
zVOhbpQh6Y4Q7rGU!BKqTgmjoBspgtzv$DQ%{Rwi1X^N$*LYxnmAVqEZ=st+TcO5q{
za(%KX-{&AGyGA$LUNo;Nq1Z^`kl(A=5@%q+3-+9&gLC52Wq`^%^eBKZl}aX~f3ne;
z`RM$S$cJ$WM}Jf<>J0p0A^LiccI@Gs@V)Y!ldGKN+&N_Y`7%dG&1j!gCgiqo$CuZ;
zrkB^`?V*Vh61K=HjC;>yZqnQxN90(l@IOKM0s(1N8JRZ)02g+f2sn_z`MV{TuJTK*
zInZ}od=*Ee+ynZ7)#d$j+S=f>a#eyYDQxoMtHb-Al%z}OpVpMOEEGvri86cQ4a~7_
z&z>oxE-q2ce#7qxOpqA`gqbCP`>7c4UwoYIDck+w*Xk#<b+NN+?td-Vbv0rdc$%2&
z=$z4K7qb}fw@NB~#>tO9sX5si{i9%(zdp`5MJbQk%JY(m;37<@Ks^WMIZ1BVilWV^
zY)hr-1_Ha|055CuPT=QNr8Ty`Lanp*-iV9?gUr^1`zBhul)j1{iOR7^3Vtc}uB0#M
zv+mCOD_Ef0SYkuQ*BMYomyz(t#W~EqoKlt;v!yELyQ$E?Y7-C@Gp;{1RRJQqp*!Dg
z=b}w6&>Y`EL>gqW<7i(KZ8s1S&$?%n;ThxrQMzqYncuv|9M~KZWG^@mP;qSnrM?zf
zKHaEtj#Zh=Kt!_=?Ww4^UVMJ!2DhrBgqJIKXe<qX3W?FImiS5Uth(S)9%#PXY4G@2
zin9;JQl~424{vt;nm3#6PwiMXkv~mD-Z}PT_ShZQ0U5Z%$uBCT${nt$oQs-Ys9hI*
z6gUPfcj2dWM)v7dpxd3S+v{(;p=a>&ZNV62ToKjt=&rKc3eF~WhaxE*7Po_vvN-$?
zza6{`t%RclBu!jvQdkEBJZGE4;1tLwESf)Kn)Q~uV`gb?$7zT=zVn1u7Mra~bF@f0
zIlsT}pkQw!ippwAQe0u-k6=-d#Snh%N^_S(z@H@XY#n`I-eWr+ne%*YSf7MWeDsGQ
z;)Vm8a-(DLEB?;qCMWnsXJWPec;|4D1_!u_ZU0KE6MQoOHVU{q%jJ9`Wr@E5Ge3mE
zJVp+tQ$2E;EK8mhxD$Y@ok7d(!g^|od*P?e*5!MVFlj$3f~hlQ&W<T<Fl?Z%cYF#r
z<NHILu9BI0m+emsStc9TLK}zPSjyMTHbZ+ryRUY=glz68dEjrFC|<zd7g8~XLaf{^
zv;&cO;k#Oanc_8Wvz-)9EqRA~EcH2w4y;gM0X6k0*0MgUfmn-X=hD9}A8q`M0onPF
z>I*9mDEg~bKLC!(%+!ctK=1~*5c8ht2|6`OR4<e<w3%$=XdmzvFnBw2Odxm9VWNM<
zTo?QqV$?$JU%oL>J&NtC5}JFPl@sbd0y?$)|1ovdQBiGepYD!fkPhh-m2R+5LZ!O|
zln&|cMoDD|5k#fCYlxv76s3_Gx>FjyJ>GlY_5I_zOD}rP*?T|xiC?_BG8&nEQ8YBM
zp1k7*AjI!gIiKTZP66z+(a4JxfS)&Az$$)!Ov28QRVk7dN`yu!i~bMr7E)&z*I+pF
zn)mu*=-Q76^E<fBKY<D4>=)*@(vf6L@4qr971{urk~&P{#}}^VPep_+UtWs3(6Z;g
zG(1AH05JjFe+Aq1$Ik)UceEI!FBg8(GuJz`7bv%N133;GG^ud1`qBd2|4+sl5q9KQ
zGLTAn6Ao9d)VmgMQwhc>N^hb_7J`1M-i%Yu>btC*W)Qp?MP9VB1Aq58<JElYE71I$
z4>W4uvtPx6BJ3hu63<JkY=&xyuJ;FoX9GZhYyOY!pn>7uflIgBQe1k|O>gt-vebZv
z|N1jG#`BLXmpp##K-b}8K-CI}IfIt}@pnY@2In5qRlq+c%EcV9JWd$<n!AoE>9-R6
zZVTw)l>|zAtf%-J_PFTC_-r($pCI(*HZ%VSj8=PBO}X^Y&-gK=o!sB6kWBcQux=u*
zr{)YC+DYhMi7o+X?#?TZmkr-ru3e)7VSSM{$>@yAw_*0`Po3jskIPxmNo2rJoeONh
zqcBbjQ3nn{rJ_!4m#^P69!>%{Z7?ottJv`uI`-d3Xg<nM;{Vt=U)=NL|0pEW9|0N8
zNR62ueITXarQrA~ZOlan>+wCdGzQM*s@s~QdKczYI{>gOgvJ`<He9*FTrfQaKT>Se
z6ZE>AeZ=KyLwLaELkIGKGdCR?wNid@0K_c@-7fD4k@)QFNI<e5+HM5ya|b@%1SqEy
z^6PndngrDCP9u(Ev(S)KL48SMKu1^spGnZ>#S1v&%I2oM&B#~no5JEIetX?V&D@qv
z#LZ}Y<=y{nw{TUr=pZlt_&N(OX|9^=;D<(jGY60<kRdibHjqX>id2mWV9iY~!jL;!
zE*JCp8r`~k3N)3zdM!kA18}!kg~;BwsiKcqm=stX2$yBI<-vEmqbICRInoI~nX_*S
zH!Qwg0Chf*MQ&kEKqJ~=BgQ5FTT2`2Hroa}8i~G_TIN@9QYC*bMrSUqj;&{GwAzx6
zGxg)G25+pK>zejAMA)TYS#|~7sWQZ*UeyhpmO}EPzlX*JMyM1}8tX>h%)}f3h_}>N
z*XZV=wqTI^`!HgHFuhzWtN|c4<VL1{;l2K)u<?&t#zGuf{|PWhQ@n5k$UC2R($u7u
zeV=C^sG0#a+j~ZSkOUOWEp{VKkjduIDById8z>n*MZ@69XDM+ck&mnZ<pTWdw>x9M
zwqP41?2+J_J(bNssi2RQ>hC~1^|zAhEh?g7V$T=>X|f9ZvDs6CS4Jb=QUGWzAP<z0
z!sh_4K#&FC<r3a8cz^-K|AV`7%5AN0L4jgg<x9{xEMR_1iA|X%p7*YKxKk7oG;Lps
zf?@w4gjB<pItFI-3Cl&QDSjS@!fP@KU5iB|kf#Yo0fMTtZj381+FUde+8LIL1Xu`p
zCl(!O!*a1{TPqj|5fdRKbAH5z$FjvlJ__@w$51w+TM_7t{|ykxF#yv?3lKDXMW<L#
z%-GL(QR$PeNyT`7y(FCbYX24;)Zza1-7<HETB8EJ)IRx$Y!eyEDnvT#5qp8w=}&x%
zz-K*Z<^`lrgsUBY9-L&NOcZQrcT^I~lkOUwVW{Db!2p5@VH_g4A{*ry;X+>fddt9H
zaLuqBG|(5&N{=ATXo7D~)d_$0&m%4mG6M2)C<*l#!+%8w7oym6S+6R{+njgj6y@M(
z?hFkma`*s&)7w&P9Fe+|vmX3=HVOS4Fx5)NSOwV65)c<TrV*_GfsZET{oO<QWcB3A
zQ8724c@i$eoLDdDBQ~@fFsQWy`IbgsfkyrZr<?4#>MO7Xd^)q5JMMK?=nt^y{NKbV
z+G9R^N;piOTO)gu3Y$sRr}_%We@{mg8#mnzd&p9YZqOm<Nx0heF$`W>;r1G9N~};<
zdv9C+UPn{>fB`G%&Fv9DZCHT2An79Z_OVC%DJkiR6@sa`)!hLjf`&_)@)`|tA8!i`
zq`2%V8E^7*y066c&v$%MuQK)b4Wql?H+AD?TsnY9z8LCsbH;qJ`w#Jk9&2C?3;tU}
zVud(rMk7m#cDl44*lL5PqO0dJPfhq%rhz=g*t!4=MgfQ#twu(hN|)vF(BNPS;F6Kg
z)&WpDqm(-jPSe__On56`xj+(S_M?XEq`-3c|8H_ePTo--cpXrTNvmt(ZSD2(1t31o
z&%cXY2R!vUJrI@j6wuGfXtPIRiRJgfjI^6B6P8N0bpbF}%rQlTe;)`}FSP4Ml4%k6
zgCV(2pQ|XHzE_wO2Wj>|aI+LwP7mYjvV?L5AWG7JqqM1VAb%wKx65Sp-*O~By3{n1
zCGbR(X<PvwTZV!TP2oAZNBTTji%ozWQI8Qz-glMTtn_(Z?y-arZrj;NSqwTb?bWed
zpCAtYB-ifv@A#^v^_cJoqB%OEM4w}|x_?9VGe)t`(Y(lb83$P8tz5x4=?2%AA+8%^
zj=kd6gFVLu>Zs4G!kzs?7GOFx<zkURJx6RUIh`npd^)G|mt6KR<W;I^9XO9*>&37=
zvrr_aD@y~NG!av8kXEbTLFnrYeVo5WkBgcy>`FdJqxU=6f0vAliu~9SwJ>>y_;2@T
z_{0iW#0pVCAPtxLLR`M?mGkDkvmQy{Trhr!Z(XKSt9M`59n-7*^jOfYC{hEHwvgNC
zE8|r#^E~=uy)oSDGQf+Wl%!;UM%X5$nG=~0H|hytQY`rcU)ON=r0m1G^PM*NMSq$k
zn^a+IbXE#M5jh0AvX|IN-cg+4k(SF0D2$UocsKOx(p=OcH9X%X<Gb#NXWsxIFzX4>
zy&Oxyb?}1esc*=`aTSn{!dg8Rx(Ms?=fLrK%&1q2y0Khpkd=xDzdLzc{@s5DkO)I+
zTwONDD;8FNe4M}81DLK64FfM*#V*=BcV@_h+9_h1z&*)`SPTEJ-_3*6Z&L02$!qlo
zQv7Zj1TGIU7P)CfoUTRcQfl|&yf4hPzn%Wzgl5)pgBC+Qn!{4C2w>cTr7eFZ7kU_+
zijUa{zH*r_hhM_!S}Fce2Q;veetZ<W9x}8Pw$H^R+3RWG)EU<NtaYTzNEE<2HDr%|
zDTLe(lU;oCCnw}2x{hKEfAJc$C`ec80c$ZPyfW!F8Fdfsda{h5c=fA(3r2c;ObY6~
ztF(ryr*o~4^cwp=%wy<-z(tCqFxY+K|Gw%e^iP$BJLV{^Tl&cKi_2@UJ3@|J1%^TB
zOI+D@4z*oYzKr+*ex`5XKmPjL;o`VC{LD!67TS-jK)^{5?1M_g3Uh5%pXC=-ZUQDC
zX)LnS+%jD8i@m@kuClp@EvMh~y#~(BUkpd$k9xk8`ik00RmdEGPk<x(C`RCtN4-D0
z(xlky1!F(e{7(^u-fHN^Gt_vg*SUug#QmOG%&bcqW3hgPrW6@m>hD>_o91u4!)j9?
z@_0l3$@7DBb9FZmdX8F+n_j1`#ol`%_3PVT^0NN_D3!rSIVX4gDsvNw%fS(z6K{Iv
zUq*KgBygyVg0*7{ncVD8wjF78AOjBmJuXOH=dq<jJWq>(r5jGq0b(73f=d*1yWoX)
z{{R<9p%>5roBk(+vb($j`^$_5EBC8Y$~5*TM!+sXt8M-1Dfg)bB#laE$K?m;I9&MR
zKlDs+@9Z5cRsoEHHm9lDC(Ev(N8x}qJohvhf6*0ai-(Iz@i?hq3V2yIU~TYA1}DJx
z?o!W+z9Nz2=Li8Tiz$AiZHW!_2c_jt_pr{R4ehXju~4SNuRM-^jXcZ({>UffIr3L~
ziJixHw?DfVhaapO=~SB?*C~43JT`2Bzlo@ZO(`|8WjX8@AL`lr-b^sDb{HDrH==Ht
z)UF8fqhv9Ee%&&;$h!0^EMe^UQ2fUyr_cU8er>lWMDxZnl+NqS->>&35Qe7Q7s|1d
zue4LXKr`jU^6w))+12^CI2gG4kM&5~`fJv{{P~q(c-Vat^bcdfKss_K-T1Y>3&1am
z_W&Q{>qak-1BDpYqca6jfq4q0c91LNkfOcMXoXu2pGK*ffBMuo`>Jw`Fx6&~%-&F|
z-pEjk{vgvKuv5Ty<pQ@z9`prV=l@=13vceQ3W!z}96Ke5A$Q>&BDnTHfBy6n5uf-V
z43qJ`wK-ewVz~nPk{wvz0q<6t3UiMUu9is1q@wW82-Ni?EA5~3;=W&R$u$B?Q;2ai
z@N1+ybA(z8Qx#yQ?MB2kVK9&iG;U8fh&|SPFzz;@tvliv5~Ml?f}Z4N;MrQCvR>=#
z>nR6wly75w|21Q$MI(;XMNY&<st~+tqFWzXatT51CFfjl)^GhdeNZ=i46MZ<A43j#
z%lr!CzDDOJK{8GIQ=BjE`JCibQ>r8C<^lcEL?VIoLx?Q?Y@eIY_T9BYCTE!3Pn0(I
zVq&~Atf-`b2L9&7dXnnv?sWK03ht81MME`K>{-}NqxX0<)X0too>#;Cn2HSO#9u0~
z>tk(7%=Z-GOfH;6Di(rag@$2u?PC~+u6lk}^>Es$ykMk>v&lk%k$vVu^F`TVGTs$f
zRbBn0*MwhA<i~b!R~{gus{Q#*W0Ei4F4Lsawz<V!IVC%0MK<bAVG}kDU;0go<WGDu
zL_t?Rkw4>lWGKI=6SoT!r<MH5^rO&sDg2N^-SXpB)srQ7Ynk5?f46Yp>A*tM?4=Me
z*>>_nF&w}z(ZtVf;NP@>mKM&-0ZQOp3=kKJ5G1<OWPXlzB{l+>@OiHRG%UXsl-q0s
zL2}0pL$s#nlVfnJX0F9Pa?AHPvWqvj=+@g_@~6mN7tKCP==!jiS~*hxwKe~4(V6-{
z_K8nwi(3HdpDXf!RzTEkwwh);1&q;2rWS1D$}E4Q_WTY2Dk&YE1ROI-xf67F75YT1
z+s?S{%(OImyMqD`RAW*9C5G(giZE4b$ay)2JGe|XLwBO7xt%fZhEv!A2atJix?hc^
zw9ehS!70#wiyBP<HLpm$Mtj1PCx)9qjA|s1DhR-Hq=dYZ%<k64VIwN@(l7Q0)x)~K
z!0scSALPSq6>n;Ylo}tfBqx1QO&{`G7Bf!skYI7CriBaO2r?#n8b;)Y<JtrS0`gpE
z0Q><@yV3!$c!q~*G2tVsl4b_5a8GZ-)|F!yl&tpww7a_2N--xtdz`b?T-11vCr9A3
zJOGz_H1~5X70LYJ<AyBs<@86Ny)o;_J0VOrIAL`dJtIL}Z+o_FRJwCiAcL{-*Zrv=
zNs(LwY`~?^m@*PROwP%}+E$6D^8Uo}Cub2)$Udi>p*l=C1ltg4C;8>^WK4Q-DnslU
z_e$>IR4wJOy41~KjNyCU`CvX?@Yt3=g=uX$Frfk9<u@dr)74Jfj@1gSZJ@Ojpib3^
zSE`qlv&%(<3*067vuTtJc|1*~c0cMZ5yG0k$KBLcRet{g|FmC9bWeLV6W@~-6`l*^
zDQ(2vE(s;6o3@pf;tw)x4<3564w?&~k#C)HUDBJ^V8gK#Ut#1#1rzw5Z`I)sD26F_
z9V{kmL|o4Uxhpb6r50J2nnalLg@(l4$&fA;0=|H~Skth>TVzimi;25B?y8f#PV2@?
zMXtl+xKy7ow<2!U0||d625p9<-N>EV%{z{b7`=V-|86xVLUS~uc=^TjjU=%@Fj?PP
zC~l=X(#U#*`_U`RRR9{8e^K#%heTNG`H&=2m%N`&Q>W99TaB~N(V6eTZWBNH9t1|<
zsFlV){tol=P_YJrfCS*FI5;@y?mh^_PNnrQT+<->-z#*q(bnC&U&3_-vnzRsNBM||
zzX?=VYC1GjCJub0fz$@8`ouzJ^~Y;=+Y;WK7lqe<zJa6Pul3&khQ9kJMtiB6peGG|
zH*Z+y?KlY1^5(qOVp)7|o8(s&Bs8X&uSUE++DLJ_C~g?|)%Vq%0z$}o^gxUOYdX?o
zOQp0;z)o5@PSN`loM&r;`|8bHxYT3Z8=D*~qe{{J(?pKHOmR+ivkJ`ZCDn>QRMLjl
zH&<ePF}I*=qx4dEN&1l0{Y`tUl<svooGjtVRD6kAf3T&SV+m)*Q-1;6>e%Ws!?B1p
zuawZ;UxIu2X+Au$cO9v$aq(@R=_uUP)m`V{>kK@1x^~cIjPk}XPgMBzw{l)!NmA%-
z#87VMP)uyEp)+?mJ_6*M+nb%TP(4vb#N0M@MvAVKgEV^}L3bE@y!G?W7hkzl7XMgR
zwjHWO%6lH^X|nKqtwVa7$`A3wIsYUApfc7H7`rFOWCNqG#bqr{-H<+xXg>&F7AiXM
z___i^{@I$U@L~=q%NB-T*c=VsgSPxy6;DNH*^vLTY^~ldL8r#vLx**&O~4Jv0v#eV
zDZ0SPQGrr<#zd$9teg<?VXDy`ix5-5fM7`QGZ{O^+i()WX5xY&1C<}GiVLO!mHES*
zd|Fq}-jL<b<3FhrD9m4A=z99)dp^rrL&;poNs30p_zy0Ajmr98VbceTU2>OQ61@3O
zwhNxGjK;)GI`Oq*s_@p9h_iLjLlT~HYR=10u_Os^JQ9AA+)uF=D=4ooW>MuJ#qC9(
zV$^2DL!d*U^&myX|5KifTB*AAo1R9Kw@2I?_mDAzG_?;oKkYkkG}Gf%a=qC2-uUhn
zzsghn{Oxns(G<L!g1#d^O)p1GM<70njl`lzAo~$wi~mYi?@X~bd4Jq8k@oy}hkTy$
zz`3~Q<YRn24ITwGW}7~p1-a~@=E>p{*O5C8?J=&!7zsW-N=YiFIx-{Am!Dil?xz;y
zn5VZ?xth7)9g|hR(Q1+17KkGjs%Nza%@uiYJaCG{kSFc3j93JB8{9o$E|%jC$#jsS
zM5>M<PzS&VVg?N>=dtX4e53}A7qH^~QVfSKxJCmrh?mC88~y=K5&pMmZ_0BmF1_|d
z2J_gR5MAAktXGl&7he7(FFZhNs2>^iJw((3r?|P@q8p#8n*>|`<U6~(65t*_+aq4n
z5bTJ153?qU4I>UE_==}^TBD<_H_jY!lek-PqU~(GXkOYQ*q6D9jl_Jzx<N(hoq07O
zWbI~#B92OC%@RNHqfnw)ftGbO#~6jBkhw>8N)&HDJv>EJK7DrjP^J3$s6Afz#gDPx
zDW%B_+CJXIlt`n@rS+#vQ)Pj7^x1CQg+;o3@`(BzC#7OGiWi+e?DC|IRQlU4ps)mz
zFWJ|DTKcAa)N88}d`b;rnr(j5(?^znDJTTW&1jDhfQb5l)+vvQ#7W*y!M?nomTHSH
zsYvIbz%JDlHmdZUbx}Y>u<PafD%aE1kBK33B$!EJa&s^7%=ry#+I4^|z?H(aO-0tX
z-|F#nj-<WxHutPrD$t%WXV$7MCqcyJ=oaav9tLO!>VEO&!%?vIw79r=A4ERx*x5C7
zAWRT*f$}TVWEA>5*q)<faK;2Zq}pB9X1kxC*dtOC?OPgAO1YG*12+dB_R{_mfu^mh
z>d;$l0nxdq$7Ygs57ktYZ8>ZdUt}biLaMEg?qP+SM-kBA?^QvGVrdIWl&6&%DU9^!
zY%Adwr@wasbOmS%s&YIi^(Q{WQ3Q?O{!uu5`-uAMq4bVx$bcA*)Z&|mgW-D6w@LSN
zQaG?~92t&SOTE6Gim*^IA!hT4t%v^7*{r|&2$N&0iVpbtI-aDo7qaM)yu=<2=;aXV
zD!=Ux3JVCi{DreFbTYZi>;|IbGbP1_*-e506M}FE$7ls4BWTY}v&atFAL^U?QjuG)
z-1QY63O7w2a7<Ry0vT6iA}fM?+eV6X>5wOLqd_niYn81EBhYL=sRY^<3E9y_l7mPf
zy*tnuNe&8mG{0Qd(;Eo>CA`D8PCz%Qz-Rqm+0;du<GDd+>P66lMe)LA2qyVc()W-3
zB}N?Zjr@>WX9o{;x%2M!5zv3Y&zT4pd#-11t(DsS9AX|B4p}aF^|iapy5zFFujTD@
zXoZA~{Q$kgcS&9Z?14G&^xFz3SqkP<xe87{IXjnNtzr5r-j*)GPJ41#<cV!rrHqOs
zhi1h}e}gggr3zzznZWnkAAGcD9NzQD>;HQC-YSbHvgZBBuk1A9en<rl#1S%;R&tYd
zzwbIqo=2Qe;i;O{W!N({>ju@eSC58RkJ1`<KRO*%=GACEA8nb=pGT^t1)j{{zzM=+
z%mh#KFAfXkNpqsYB=G7i^v->Of<vhDru6Kox<B*AS^V9gOyMJ^c)COD9?3B2&d(da
zu&7bX<zYa+g&h<j8aYC+J<JYr6sC^+;5jx3GYB(GTOc~#A(&x^eM7h$YjNzU4GbEN
z@%iPft@k4wr?i)3VuRX_Q?-H@rr$i%WK1_fy<PH4<#U*V&jh;Mb`c2h+(7p#kzE}J
zLPL!{bHBk5Kp%9MzT&nbfso8|o!Fpxhj&1|={4Z;KRG$L`^1Z<l<O33cq?4Y-AeMs
zI2NtoaKF@$#TyU2FwFV@EuSUkxbB6e^10k_t6stKS1!IOX|ez>NfC2Es-~hamCJ0c
z^&l<6^)w~u10j=!v7io))fCMh`=d8WSmhLXx0i<bidb4S{qGdeViK$%Yuqxq2vt+K
zMzn}V)qjy|t9PzTcPdzX?T({%t>WC^H`}<MmbJJ}_!+;Z30BS}ID0pLZ*jq)QXs$e
zW`+I@a@0>&o#@*y9)?L0#opt~yaudtwb7U4r41BEtiy`1P~2Q}EimD%M+h$&8__jo
z3X^SchAA&(qdQB+kZ?!fS=xv^B`s#SZ}vDHs;$%PJ}5G9-+IVPVakvU^Gnr5xrmA(
z@X$fwCK3tkigA?~)S#z44;3#$38E_C;R>kG;<YRZ7x?cGNq&e?5SzN3_kO;LELs_>
z$tXzsAS-MASp5$7_xXuWJ~KN39Dfz0Zk-sH{8J|4lXvSKRFF5LF||urajeaPXk6JD
zuwVen+`c!HA0TZj;5cE7270ESZ&EeY$9Ui>HXCeOYk5+<q8CUibZq4eutWX%YBwKP
zk)~6whq-tso|qDUt<ug>%ITTZSwZrJ8bQr>)y><EHTYoyQjzN^&8$JWLWH4S;n%+U
zNtFnWx8>~6hBG#~+JK`sM0hl9T@oq5#q4i%klevk+XXbA=m=yv`5uKoNg=iCdikX7
z_L_`eKOco%?pBeo=Ids`qPuyn?BunuUx`s4pGa2Z{_awmYF>{)r7{;(n8Fy<n7%j$
zRn~YvmwoiyX6ng0RSasev2WDoSu5>53#uhW%Pd->hqigHFE~nWI7tW}@n9BAruBr>
z_7YL-B|hT(?4~IM1T>FX`xWy;rG+4qlt<;?uK<21!jj^Am%$vkL^YH;I}gboyN7eg
zP5ZJDu(O;oJ$;ijxTu@FaMb$zGxu1uu91uCNwrR#`;$tC9|17|TUtv>Oe;86F#L37
zT>v20Yg}}LL{6ucD?}f$*!b1&!ihWcTANNlzlAi8cA9&Rd61sPJ!|ReU~{4>992y7
zRTR;PLF@oKf7p&Y{#Co^QE{fO<<kbxJq}Z}zN2Ab`eL(QTN&N2`QHt%)!SSmSA;u7
zMQ4V_Q){%=V_3RCh!sYxv>d4D(m7?GAH2w6uFRT;hlp4YVQ~{@33!D-*7Sd+m8-^9
z>vVOpe+k3Tk?4Z+VG%|@i}D2!ctshuF=MJElD9f4RIe*cw>w;8S1RvvY~1uSFi+m+
zU<)>0)x9cK$R)%frs_BAQ$AH1SM(c_zxHDqC3<A<U2tC0`z;{6!~gj+11s%r16@1p
zd0vg-CnmfckWotIBuB&1UmquN9YW6XO&)&SpCwLEEmoZQ#e9;&8q~<Svp7}DKay%3
zcK;WLXi$IeCrq}8;YZoF2*ysOwm(IFC7Eo7tzF!hZ)EA#@*E0<LWiCGCL33v{1zP7
z`NU81YaZphKFxV9IgyV0Z2mFPsb-U|uTH}wKOBciaXm#A>a<1e()UqQF`S%6l@2j}
zpZpa)%))Pnt^71Nc<Sx!IQc2eqD!MKefROvm&)o(D1n;q3wiHcBi?80N~kwA?wsai
z^Hv}3Z}%4yL^VHS&evkE2Ji!^RJY_P70X>#q0gK33Z^xvaHb}A_2EHDiZ#}8w%;(i
z0ePxR3^>zeqGpsxis211HMzTtd&Zzi&~Y?|hR7K3;85Lo$Qfq43Q$6PuXkpQBSF!q
z8lF<vuL9>^PuSP_U6e3>UvgZE8(7QeF?@6=z<TmwLs2;03Aw146L@`j9J)FzNF7I~
zw>uXQ<Qr%Tbptw7Q2Fwnj+6P(pdMnC+G!0oJXbYe<WsTDJu{F$)?-wi*Ly0~4-O=N
zu`Vd%qJqFIJ@F_fL~>}|yXLmATB?g12=*}VljQRMqDt2pl3y4E6+$f5!3DIw<}(?d
zD(z&IXCt9v*BZL$|8RMxow2rFz6P#&jmu>Kd$~rVUYgsSBVxL^sa9-raPCURa!`ro
zpKmDv&n4@uh}rS`&7qBMKSJzZwiNV*zcV5$(DT%SbiZM?EEzadf|ECtbZF~0ex9{z
z;HsN#RC@F?M_N2~p<dH~fXYlkUNnT3MemiMgO(&F7IrkRz08v%j*9m+Aso6!4S!Ok
z(=SV&oVv;^@SBBbgixxz=Q_$XdQZdRa>UnmcPT}A?Sb8T*;$Ec;B%iv2y$C(K*xe6
zEB5xvnQf_%Zz{eem6QH*f2nS(!zAaeXYZGgg5TO`1M(e@4yQnC@J8{k{L`WM^e2v=
zDB46`RC}0b3=|eWDLCJfq?Eo`y)VxP)bXH@-tBr+!tOil56D+#Es*}R2nNShs>A&G
zatfS!+|GEtGid}n*4uMY1{S9c7Wn{~{2vL5cHSYA?;SY4;$O~wx)My0_5WdT@F;L)
z+`K{CJ&im}ekA0{`1AqXD|j5AnAzSTTwZ`Pu_=gH6n<*^#)@kFQ}jU%5@&%#zXB@m
z4BW~HWG7&Ip>jR3#zMbb)3AD~&54H4O@iqwG|VpG%gatTZHDZUZ9{<0XaMvuxq<bD
z7qt@H+wZ0-Eb&JJm%py0SH3@Al(bJcXWUjkviOU!%>Uo8oSpL8tl|UEi~DEL+&v{a
zGWG@JyB>r=3x>CgzV<DCS!c_<E(|;XIE+*<rYK}6j-R{BZPN#Lf$iaL-1$;dqSYQE
zKwO2wAyyc$`%ONeTA8p|{MhJ3Y{tmB1Gi&%C6~BE2;+vS5ytI?VopqoB$nx@97(rN
z&OPLGSdwa(!s;YHagAv(T8wIb>+@q+pnD}Ypo#ue=lHH0P$IhL@f@wkrHB!R%bI|o
zYFu!oM3dW+J9py1HfKb<lQ;}|MQ65%We+0h#4bTlk3+|>OAoF-^bIWu7%C!9ECsRq
zZZ13}(A2YK5l@@^mMEYeTs+foVzU%NfT?S$7Yu}5y%c8=EyAPIetTmsFs=4+cHIRz
zWE_jpM@pDW{Od6@<mYzlvGNWJ^MogvcRjuyq}E?gw)*?ZBETIn9r*A9<*1H^A(#~N
z{e37Gt|;5}+K)T5868_b`_`0XY-nxm&H#u*OyZ^G`LjwC)cLp@tJdgijR(u31ad$4
z1SeMBufJwN>GvPfehKxvy3~u^PZi(ofWB~Cx|;DH<nTU_O~WlB@AN}W(K8d*oPm!}
zMWI*x*Q>=pi1<klIgUb9@FLN$OGMw(=~r{Nyiq;z^>@gySeEaQ1MT%qU<#m<BX&%0
z>MT&=;g0@x5BCcH(K6&BYVj64HnqQK1JmlW5A_BqncRmH<>tyKfgtC+TCYVxt-2S&
z=}dSWfhIqCW=st)NH@75N0}=F1o_oo1V<3=x)?f}3TaWHxbhy>T~$>ooOH62WX1;e
zP#d+@kFX$I(r)y?-o1Ng?IFE>o5RyV59j@Jx)7w-Eh1utAZJpwB`|U(IliO$%>e?W
zf4{Ieg1E-gx&sF07c46ZTWW9q7H8yj7>j?CSQV;pg(Wcho18#rv4ZdsevA<%qe6pn
zUUC*WBMZ4Y5ertXu!XQJd0uJt?t>wD7D$DD`yW+%#5)p-YcmhLy`h>h6T{fxG$O7J
z#L|{0S8Mt(7KQaCm?4F^xJmZU&@&MP>P5}}q}N!Cv0*f(lmgXdyC0U4N*&(qY)$Sc
zzWPr^rHnSBaY`8OK%Y?#-o<r%mtY7WRn|f6FZm7KpBYdSYT(@L#D%i68in-T@cB#c
zCp{^;g?<^-W4?KFI+pQvrD-668!Kjm4C4kU0rD}d9N@8%_5>lF@C--%uFw_Gam1P@
z^!Jp+;ZftQUqiSSST}&@lM|q61?@)j`R;Cc6ftpqeGeKOB!R*RQR(6I6u;B@fFMjY
z_ht5HXIS{Hyp?$LC@2fyH%8o&tF<$-vzNnr=CB5zehbX@rLGj1klMx@1e?MRF8HrX
zZ}cyrR!$765o}kWnt9^10(5=NElLf>dA*Aw9<nx2qVE|-8|Qo0c!6wj&kSIFA?J$4
z*j?h~S)$=}(+!brAaw#VqA-_`Jv*?C=1syjqCxSZ@tMv@U>*{;5#5yNj;9K_AGvv>
z_E|gw+Hwqju>|&&!4*pW%2IH30>Hf~<aM`dXO4S05(gQ8{f71lXCe4>KmRu~RawV3
z!%+a2+uC!Wp+8=cHz`$r%7=^&>j!&{cP0<LiwobM{BUaivf|YLck5u)qy3E-Mo>Wb
z5T>Yb61p1sO?4hcIvU_tF$x|xQq@N#CMt;Hodk+d=PH9Cuhp4!c?@DhQO`~P34>t6
zJZp7eASBo3_3K)<#ojlrKzy|u&}TZQx!khRL>`l{U!=vey;4Z_&u0u={$(Y#{6$;C
z^~UC{ZTcQRh3OK+g8vtRL&Oai7=(`Uz9le8_pf7SOk@J4?yTRzx7}Kj?RJ7@fZ<`z
z?W}12V1uLdch8UzjG1wDq)!>Y9R}i&&htZy3bQX<MvXyfC&tUlg~n=?<K?F(!1i$7
zKr)Gg!3!>m+ZVlw!lM@t@<xJ>axL%cgl##dy>yywxHRr^u{HkOvl|m%W?d_j1V`<+
zU~hBAcG?T9&M<e4AG<zWIPo-If{IG7;MFFb#FV-8nCqPR1@owfr?v)u_3t=+#DHW3
z;q8Y*wpNcL>hH^fR>jL$ctU)eg|y3v_j#TFm3UF@P{YdfS3{4T5(D|QUo9Tnl3*Ti
zYyy56n|$>xf5s2aXoJS4xR}mk$_n>Xct>A?82{VFW_)I9{@6wgLI2dx9erRVkecR}
zMs)WSPQigOZ1UVef*~61F%a944Ty+_o#^--u4)DHqlHpo%(n<4#2qhCw{cZjimtS(
z>-UDtLfKyf6It+^;4e~|rA;|;e0~eZ);>sAjeK_bSBLNYvc>lekLam?Tmdj5<%)n^
zqSsv(CZ>3kz;U`|Y19tbX3>aOj8jr=Qo}1!Of~^BnUYAV?)!QFEDcjQU9Rl~2VFgu
zW$xh#IKwag{{CTtq9)S!M7WTwXxgnarvu-K1R#6*b&8!Mml9AU!campoG?#%n_cr_
z=fl+>ww#+03hLaD_1~62?&B2j9u|%P8i?YGxNO<Qky?1=LQYilO?F!0Ob7rEyf+=a
zXa$DDY~7?mfA1c8sp@{!y-GsNKPRX}M7l*QHP&NBIX{W>CE=mO6##Oc->&~VJ;pzj
zzJT=K5yx=-$|}PYLt{E3&)B;`ZZ0AN11J<VT#}$^hVRZnZ$$7E2ARw$7A34H@QUfe
zD(rmAse9xcIGE3f<9vF0dJK}2ldF)tG8i>OmL|VsF(lPJX<R#X`_!{ADOT*?Hq+i(
zsazq!l{-Ug%re@1p0n1A!EAb)Nnz%isYW2uqUkhId6W6;PY=H`OHVXN1nK%Qhkt61
zW<i4Y)`dB$N$jL|BQf$2<i@-UGeHr=aS@`-J-)dNSdzSP+CGvdA500h1d-2xfU{`f
zZ*x77J9kney}uDRpZi^)Se%A{zAH1xT=*wrqeBJyq6$Ybc*;LWl-+uQpjVkLEd9H$
zlvPC)R&I_3yzs(6>oIj*lLLL^E7AgZgWHNhG2e?@kq3Be?$PM~mqhG6&Q9cqa0U!X
z$RsQO@$Xd|FV?{^Fo&Do1>4RVGbW%%$ScET$UQWXBp7P=d7Ba6mYitp4ogOIzQ1*M
zi0ZPGC`88Z#Q6}Ts}-p2R|iHW240|C*f=8yz&Bb^O5&#PeaC~fXWBXg2EQ^<hKjn*
z#fq!*#5ia%AE$S!eUD~I_hG^C|5lt2s>z_6Niyk%HxrJZYY)bVE+X=Bax?F<vyq=Z
zeOd^fuVch!B@o_xo%<ISk7QgM;q<B-J9NH5mYb{Wy-;)*iO)5w<<lTe0`6&seY`HW
zBFzhF?1VcwaNCj2A*mK43@zYOPbZC*i7EkKXz|0h8gN19Xgq#wCGELA2=0x?zT2kv
z-2A%F$$fCHPLHpzX61ElFx<gtduu+!<|y!ux=H?oN$%!7Z)EPg*gr>ug!V47lu2&@
zn}Pz1gj@l7O@S5X1`x%<JMu33J<37o)*<p@t%m<XDueS_dz_5AIBo^Zq}F@nm2v!W
zvn786=of5>#Gf@nVH?xItDPbW*9O|sgwI{5i-JNVsIVS8Yyk9KNr_?It@L*Q9YIR2
z@MG8vV5wa8f8G!xkiNezF~GF=VfTvqT3BhxdX3$z*{<SFK~fX(Vj^*cusug(z_J8(
z2v}|OSr#i++3>-eB$?d9z$uQ>udq<{(`RO2==67VuOjWi)?7vhDRn135QS^?>W_1l
z;z<HSLO25&?<3}eqCI7}?Z?YImH=XgTiWUS<D6c`@Z;D{Y!g#xXnFl0X>gh_bZ7pX
zbE}zv0t>}Vfx#g@7!o5v_C`ZWz{Smd8a3OwbDAydyTI$EICe4?A?eDvk{S-bcW<)o
zgM5;;rg)G1e99J>awM+o*~JAdaNp`1bv>3x2F-s|LnnML5k%*%MT*B=T{!$NCb75B
zyRQv}Y5Vij6Ot~sK+(T}b0&0wXz5BRbcN;ks!GPCGiP4a1n}N?z;&<xQlxaE-sNMW
zQv^vfc_Z8R{THpVRK>dcB01i2pT6_YC>sFpi6PI;amwoo=AjQ6#7C0qh=-rO?!&B4
zLMb)OzyEBUk6_3ixDm45!4-9r*`#5!hS*8jkzkPohyT{!M})D#TPY%gU;CC{PL8#{
zUM`fswDUXXQh%M1WEUQtQQwFA`AJVI1$s4pN_&-7@|}T<p&t^`ee0GhUaZ>+(i*VF
z;$!ZLpV13tVBD8nwsZtr1S!(fLEIZd%b)kAh#`f9JWgX=<h60l%TxweK@R8&0Fuf{
z2V9&qTkFg`ui$0Hf%+>!vFmmnTLJO<<Y!lxN&>=-r#ZeJpA{kcoPI{nNgjHIBdJts
z04^a%FvRC6!fwIJLEjG%o?a;SZ=Nk1#vJ+9GS@0hs^$zS4a%&Av*;g2FG3m)N!RiA
z@2RUmSJz5fllKQ;C}FgFi;-)@;B`&>-*|Ko+4m|%w<Y4Cvku~%b8;WkvJxm%c8iq8
zO-!HI)H|2SgZKZ90@0AJN6-r!&QF1-=-5>wGuMJ|xzb?P^WYSq1oHOCxA5=XzmIA^
z1_0p+fV<x>uNg`{W@$ZddV_)$ibM=N_7aN94z$7u`$5k32Y$^#R5KRFn#kZTb5B{H
z@{AuB#S(Y$IQtf2jeGlFjo%M><@sZL>1hj_5sDIyZenpk&dE)nWR!UfuO`5JeX=_b
zOO-5t@$ClHZg4&NT@IloVcoVLbz{isuLlv`tzwKKca`lT5G*p+5}o+|7!g7Ix}_j~
zxWKkuoD@1qkHXm~hLmNnzKK6h0g>M<(PsybWV-Xh3N~i7`P@r5dS;-ou+R`7Cgb3V
zo(BL0G$b;1dQ=uDD@?*@5FSaHGwu!(c(z)?L#?PmK^jajaT6>SX85&D7PUKp!GjC?
z@mk#irn93bjG43%o<^m+gS4XN-Sv)XbVQMGv7~{|KgInH|0e1n+fWYbmJfEPNGvjH
zSjEv{MWxkAh}*D#LoXw2CiHFSilZ<I23QjBc1B)HF&)_)DUbg6zz7<v0N_}HPBapJ
zVlR^R%6=i`zV-5jeWwu(a|o<}c)y=L>a@9P?(|mNN4>cWjVDi3J6R#(z!QpvT;csS
z<3pLadSX_aiBLw{H%{g_zzVE+f3BsF;CRI6Vh>Rh1VyosguS#TxWq!d2xrFf<}6`v
zp)3vlK$-bwsNQFSjz#*i%jO4oNC1m{wAg*WR3<w4TcL%8A&8xm3)V(OmO>4SR4l=N
zuUjlO4TUhw_xz9ZEgvlQ$g9zXpZd&))8%0%X(W+x_pX9DYNbVS7CHd71Ydc8DxxCs
zXz%;(J^<!-?<K%PCDo`&az!U!-5{e!wf+i<yao{~B|bjB25|gKCDmnc?2`OC%qHT4
z7*}Y$=-y;wY=)S}1%QTGmL*P@jo=}^*R~y>axeSJr}GB9HM5J46jod`?*<CNLM*QS
zllHN3Wb^6P)ld8VnXs|hA|~pBY3sK4?+@b7p#wqH9L1kpLy;RwKU7bM#kur+%ode<
zv1!chTiFBZ-+Y+yi@QWG81g$}!Q4Rz#b@KJ=_NuEd~&$!s7CHByd?W6_{WUE&SLYm
z$WQ~QkWK<K#^QvPyf7B1Ik1&(6hwPLMG)S&O`2Xq*|PK|KAStLJY}N*^kt|hFH#9i
zjqg#D0WD|NF5N?D*j^GzFx;jYZ|v;~TU?+La~@sUfxat;Y@vMpzbNa@M{1Cx`U#TI
zEq(0u-OBi>X(-VqK#96&-zpCw)0F#r)l@m>mctctd1XG1l^Cw{;HV|t9!zJrA`#y|
zLq+(2w~ocfQ-ESMi097Zb+UxxcT)5sRMg040;TA;L`~n(_F%paw54{@ydx#me{}%@
zKvi=>nD<cg61FgySP13K$ID=t7jx{$_a-)9m4_Rbuo`M509)%Z9vmow^6e1C&*xrp
zN^yO=4|2jkH}*>TcixXhe`^#8ZTQkfu|i{adn*%`Jt%%A78k8#kj;8^ikRU|#(zT`
z1QO@-p6{y&i6VW-m>m43L?`(p!S$b=eu7NX8=yv2zczckG!v9Y2F3FBDlZ5>dTl3r
zp(nyKC)Vq7Ap>-0WaN5ZA3|Kg6j7p#HxwHVnK#dW&~}S410^6%fv-PK5yJ1Mq9J?6
zL@o=!{V@!b*t-{<0gGxTweQ<2@W~jV^M1*#i*%N(rAvPxNQEB)tOe+2mq41ibg=$z
zJmSO|2ZP;xH~~)tMrL+)LK`hx`=g&=m;>7Mbs{X09SS2jUi8rG@(+s!4X)PDT~A*g
z&xf2TpUxLerjtQ0%)ZxIglpUc6XQdMo_ld+B8<B>Te}~3&EnGiH>F{$k-uh*mMDi}
zpdr9e?amERnjXTcI6tZ(_8%vhp={*X%L2Md;ox7tGWEKSmcoj2mB1;Jhi;i^awp37
zj-8x%@%O&sAXi`<z_N@BQj+R&vIoN^KH*^`zz+K>j_x18CHVsrsxnRtoBqC+GQMzK
z+(##%bn<S>sm(u(!puBr_N}UX+J)lYuNw>u10ok}I2r0o<jK4Z!it{g)1Vr>B2@HV
z%h5eliL>0?Jt&X3Ac|iFkGjO`#ew<ga4_L3tML{a@P;H1B1EqQVP~i#LLWJ2j%bbZ
zotWNz?JViJZ8WvoGF2hGBGL-qjiu=I!kDbKdj_kr5)zARa)pTF<+*f#$uP=0OtK%z
zfY+cJT(zkv9`xAkgj#Ouo-3}F2J6ntuuCP=_A79Om=}+|6)%+vab)vZ4oRAMu$q3r
z{;iqdCtVB4JTA{7n_Qgr;WH>^!-wpu)sxkZzcKiOQjh$^DYR`b=kJZ%Oi^_fPhked
zoX6xLK^lVW$<YCLKPmc?C}P5f2L54t#D;R!t`JdgK2E~!Ptq>Z@g~T_4AMrvc1wfw
zLMu1!d4hcs8cUKdinTBDR1KdVtB-?=VaWQJ^M|R(;Rh3ui+4NYbngH#cnkL&_}#dY
z(85O>0T_GgT-4Ew?67vqF;>5Cf#wSXt;9gOk|4!-cXTvioRh0N7STJKmTNPNE?9`n
zwb?~zK&}Y#OEX^EfF=(t^B~Jz<U2q7P?dffFd~@ulLiRBh!Dj^H^HPX+yBe-b)fmL
zj?_4Lc=mIR7<nyDdo0m*9{3X*V`YiLqv5gB)4HO6WBNicJfwu~9=i@(2)It&#WnR9
zq4&{}dN-{0*0KZAxVDeLR=24)W9;(7pRoXy-Z0z;7pv#zEj-s9g;@L@5hACl*gaw9
z00Q3p>%HZhpwJT$u{8#?D>1<Ki9hG!;wtu}7L0NqVn<f?KzFJE=07>Iq{jEyQRccU
z>o7BXZ-~GoP-LbfbLiJEnzp)H`-$Nbsd+tQ7Coq__jSCeUv}Q<Q%)N3a*(02UXk@^
z@RRcIxKHq3j5*FZN!4og*zsQIiiU=YlWgu`gsBE1+vV*2YIX5M*p`V%(V<4)XqR&z
zs3BL{JmMYJ>gCmq5MbP1vhfaPWGmV>ZwK#ql9aBpEHk~aH{6wgn3nzy@0k9e<Y%r@
zPH}H%&?y^udj%jcq9g|Z-d<IhLn>ld2_(=%#ED#6yQZh7B;MiD12?`MU=xS!U4@bm
zdS6%c$op9gcG@I+6D9zy0q66#VXGXBP`engBObn(!jrH2{o3&2G5oD0GH<@h;@|fn
z!qn;d{w*d|NblsnXQm(GiKExUL}56|FmMCAy-^TE`>oaDH+oA$=u&8)b1(Cn((7;K
zd)BAtED^ef&L>8Wg8ZA_5qb=C4!9B;eC)ioNSL>oKG$hx$N7t%nKL%GTh5(?gshYT
zkA~V9%|3L=)5D^C+1(xA?#F$;CqzXqCC{>+9SE}~cg^j^fKJZws!?3M0<%N!3}5Iw
z7!2ky1G?0ft7QNJz^=h?!-(i38~yJkuQejO<$bKK8X>^yVbqs(U!`z`B?~LPrF|4P
z=mKG2!9@qw1hMD6*hzAoW>RFWEP)q$tF2-r+ZDS`Z8#_-^;koXTaxczrV~uA;~@Rv
zQTQR}vri=EcVvht$!TA+rO<hV)TyK}ft5QAMi8WQ%Si&8q$+o_LFyEk%T?$%{j+?$
zJt$@$w3pOx;6pPM-}0nNugCT7A)Q&!6Fs&bb0|3vj@}6`qKaS!DazB{j`<O*#POF*
zA?Oke(4KFH_|Y^5KS){|1>jNx6#^&=i<9rQqGPq57wD3gNMW-g=bs*u_X=Ip-J13R
zIR>F<8p^KM3lr{^Zgu;G*nx<dI*T**KlytEkv9fkE5bjftO*<iTY~3Z$MKL;o+`bg
z+JH+Rr7+c{h`%xU^5fWt_Vx093SNb3DW8T9&Um*D&E3f52j~`qD=PSLK^G=X$V;K;
z`vK^z?w#%kkXy}t<0=-V$Qk${5<nqi48g;djPUltpz`AA_-^y^B_DS)g<B@YOcntt
zq$S#Hku`BOf4*l5>3Z)CW=wYn6vO<scqO<Xbj-tk!ZSy!hU7Ad9^J;Nj14c6@IN~o
z0_F@NR0&zUpfW5#AP^`|`i*(qC>G%8v?yWHmZTjx@%k)8*#Dot?&osUvOCGQuTU8b
z(UWCs$>!VXH|L!Y=%oghl0?NUA`>iJd$*=H(QRHW`krgG9~AduSY+5JUz2|1-+t%2
z5*ToB+Pg%U{DUV<9AJrh&^5~dMvuwiDU_jJylaUVW!%#e7nsN>Im}FK8CChfybQt=
zAK7p}{#pZ&RS}5G#xa0yR_Vm)vA}itfC8IyiXLtotU*H040f39c+lPu(9Zvqq=Zhi
zCr*1YdhZc22c4+gZ^tr^b0sLae<Iv`tw8BhMhRW*^QF7z=S8z1T^Um`1G<MOmoQ8Y
zBbG`7*m}tNA@1?NV}<e`Z|PV~UdJj19A0#Og_<Nx1Y>GK=k9alij)u0e@3~mk_@|<
zR2t7Op*Q`drKnQyNQWM)G5xpk5ZWIGwBHK<klt7{W%l3oiV9ISZ-xvsy%qB_+wII4
zr)@{SKe-I%JT9drLHHw&G+}E?^Y7zh39(zPilOJ<p&1&#$5<00-z6H=yc{W3>M}e9
zsdt_h1dj;HUw#czxG<`i^Kl|<)_|82l26DnK@t%c$rKl4Kut{zomFY*=%kx(lSrWO
zRg|Yt_QqvWoH`%k2DW1H9%DQ*ue%4B<ovv>0FkZ2QgK$nwt}^=`S~~JZ@I})cnT_f
z^_PF9QdLa6`1-+2!{xuNp72Z6Mzl9k$R$=$uGIab4hP8~3P-`~9kK#x)9qW)-*bQF
zpB({_rqQF$fK{<|3XJkRAW9N>SDza}qx0dz&g672VhwMSf4)`o3XQNEK$omo76PGc
zNr~Jrn)t{MgAxx=rv5?^9T!hU{0fUR5;<psZL34Y^LEu~R=7nU&rw_ADnYi!D>#@#
z@mXEKgs^T`zyflwaWApT{)2`B*Ga-2xli!#CeIbni{yZQcK{7xa{uvO(3KaRjz-Y#
z(|Hi1wW!5^8KXd+J;VZ-tTjO8sdh}TRP63uh;<@v@4U~xL>JZ)ta%d@VQleP&o(Zi
zg^G}Q3wZxHkCAY!gc?V7GzzQ-p8d?BLWw^k5Sez3AdLO|hB)+S6zDsncw~9x@+iLp
z5gPxwzb<e7Dj(XtgvhaZpsd<q7{~CQY39t!89^S=O`;cwcjVQIi*es{v(X;~D^&BY
z3}ypc(oY)t`RAghPKqxh{rXRgd*nOG%ug^nzbFtlbV7y2A}|4E{v}HyX6HZUJlxMl
z8b@#bh!axEfGIh^WVK+t<D(0^M(B}w&x722$`CpnpO|=`+#uY(rZbT8Y8Op9zk^YU
zrz~JXv~oXDzS~Lby1k}SchQT}h@X6HP*k1BHPZ&1s6$N98b&9?HlM%agiPD)V;Sk4
zB03I1*)uh;YmK8qAcD79Ts;3AY((^72<>1E!`i^*;WctuCb_}$n*P|QUKpKE6NTeS
z`=7Z_Gup`YO4yDg{<QQYAgnY&li<A(bCAdaFNt?vhf-3X5p$~EW=7Vr1v4oT(U`p4
zmo<qA?=n5mUhFzR63o{Te2Ls+oXfhuv#LVCGc#d%QU=sOIDBi^+CdWJD&toTW+-VN
zO(lE|ZBts<^YxH-sPgs_uh?EHn&T`=#KsI^{C80~7h0!L(PCfPF15WJ;WK&ba!eoC
zNdPj&8YwRBL(G#doonyi4t#H|*qkA`bNgih#@<K|24nmpgZIos71kcTS7;t$wPVx6
z*#?UKLokIKh#*~uHSTb~EF=E*baj@e2q=PjYVDWV9ONDVN<`N;eV;JG-<v=T6q!au
zXY5Wn?}YlgZ!UWE<%XC5t*zznLzZep<=u%bXiUIGr2K{X-N(*>z$WduvLI;v)%bcY
zoec0wpBM`GQ#JVIMa68ilyRaBE~?^Nrnv9t2Z%LMqRUiQfOAa)(b~ovOr<28qID^K
z8QJ1NqBe<#)9r4nW)j3`L!UfQkN1(`JPyb=_+H3(?V6<|gOOvMtc|FU6Q4W~KOIWk
zduWBpP7+pDvWsrECMMP$ky9K}`E|{rQ@p-c>B35{&w~GJh(6~**8D~U-H6c^r7g@d
zW%?+>;l=3eLmZR2QP$SVv>z6KJ>jI-;MPs6+qJ_}D6w4P<o{}x6g%z4t@Z|Bg=TSj
zR}`xFu&biJt3;Yv6%UW>*G-QMzO9ojAnV>I2lU?S4%~qBcF)D_hqGTI_R*dP!bv5H
zVLpYVnk$znZX_-|;`<dzOSLp-;(d3mk6MpgoU~~6iyZ|sX;^SF7%u=7GO1<TqikU2
z6zTawL+;dSS%4`!;B0LZAUb+y4nK)ovs|v;uQJESrH<h|V~Goj!0lm)qhA$EzX4VJ
z9RDNow(LsFj=$6N2^r6A9+qrTqF^KZmG6lMj5pkeT{hBzYN>t3{KOZRTgL~#o@rPQ
zV2*HXWqr$ew<IFuaE2Ty+OT6Z8Vg*N46(sEW?qqKQT)(`Lri<Rcv-mnoOz<z+pQJA
z{6<$-ZA(4N-Ls$d;B4dey0B~ClX0L2rCaQL+b#x9oVJ&4NcqlwaRlgip)h$ONQhTz
zLS*X7qAO-VxwtXi;3n8imIaU%;T_rgtOG3MotuZ){~k@GrdC&7b`3dpt_bVU-|$5z
z&2O=Tl!~WAfp&+gXAUT<Fg14?PM0%LJzcUyRz_uVyY1L?jEH<-qIJ?!OBI%0hBje$
z^C3=t{0qOx<UJougfEzjU+ar<E#Hn3+681f@VCcU%|WPZqDG2VETMxymOH}>O#)X9
zzA42B*EZk+aMpUpM9(Tryme`lbYAz#Rg-&)7?*l3j0jrojQN<X_4;xraW*|9ILdA2
zvs!X1I%HP?CX+Nkv)uQc6@iauR0vLqsEZWM(nqWq)S>kZCV+Vb%aq<T&E}tX?UG^S
zaYar3315uplS!rA=<CRCP2blXzNgGeGQB)d9%rqc7<hdg$P#ap<!XyM93hrORyss%
z{NQR@lP4gI5YNpW90bY|s^o6#5^nhdG#jg{JS^TxC4OLhExJjEdM1aacaq|P)<J}#
zVk>Ai>#Xwci;zXl1m8wlI{xx{;Hk`NqfhOQRf4W2<_X-cwH!0fZ5Sgkzk@pXBPGSI
z{UUvI!dzag&{uy<Ku42Kr2dq+LxkPqIm`)z;`w@ES`-HYO;^Nh3f&@Yma2Jqx+KzK
z;l(uimIbYs?pTK@{}<*LKPQ2E3gg2_#Q?@R>d<trW|AKLwHNca)5<}DjPGqznnq~2
zn7455denpA=uPWf(Fg8D-=DW=19rq7@8jFg%5L#}l@4HgLzh>874dvX=HRhue<h(c
zo=GU{Y^;_^)|t3B_9~sWYx|?iTe#2VC+U)%V;d$fLRl`%P?nJs5?$W7@E?8viUg~1
z8sA9M6pZtrpC#+;a($Q168C(Se`&;xH$+S0nQd~S?4NPm{xip%0!EF7g<w(KZiEGc
zmALtrqnZ}4v|+Lchl((Hu?_v+TNXy?weK1dy1jdxw{v}7y2BJd^$)B8-zvsVf{HA_
zxV-VF9JEKjh?2)LopLr)=Jc%I&jA;efMF8075gfVs})Y@DUcbcHjN_s9kdwx-FQ!W
z$SlDS^luQDXNQM}2g?TDUd+qkd&a)}0SRjhm=6$Oe$}PX{JLiP46%mo_-_)ZX|B^y
z9Ul}`G{DNjf4%EEoo&kmS}02fbnv;>tOQ?-b#gC^Jxx=jMMy`tg^#HIwwYBWl<gzl
zo5rhnP4Y{=Og>3g`Oti4#EDHs_K??smMs(L5cjVa%;~F8EX4M`QmP?Q%YdBa1^9%z
znFKfLl@4u~he#Q`jMzlNl`_|ATv&#nanN0YFhwv3KVlWniVM`pk;?+!-FV~*7gKl1
zMDTEbd?d(z4Cde6d5C&pnKnc3nFN8`8(s)~$MNotyzivdOYEz7ld~YbzBS-%v(%qj
zww-bX$SR`#@&On1&1Z{%X{~KrR*MjV2hC$Xz<Z$h+HGHZ{Hh+^U-2S9JClNe(VIU+
z?<|s7NCV--dj!lu$ZXk6vE80?a`}j0N#Pk64^kn8SXv3W6BDb9xRgB1n+>g1dF3xv
zExu-yBi=@&Y+2ilZ<y1hmA2Q|ZHQ-n`aQdtz3K5(RodIq<Nug?>#!#KKkOetLO{`5
zBt%K2ag=l;-Q6WjK)So6l<tPnD4ioD6m-Bqx>Is=*NE+R?Y^Jy^Lze=gM)3?KA(4-
z=j#-nS>`luaCTsU?FnA^@~JGkO`;f`RZf0cXF*IQma<ZcO7^HLU1Y}n3l|FG|6W5m
z^e4!^s|bri+B6MVl_P8SU#W<{eO`C&IIJ`u+Tm!BHxYN$!3t8J{7^OM{;`1!P6fg-
zZYXc(aa*>(HBBw8%I2o5mfpzco7wh{)A&AqH|NjN)mFwk3_R`$7AbdC{dWoE8$s0@
z+OP5bdzrtSVg$to;E^!Z{khGD>mQ7el}R{Fdfm#!dDom%KLN7w28R<%2Q?nGJtnPb
z4FNDGUUZf9Voun&0tJFP1_s*j*-Rqi-R&|+UaEMtQM&lh%Bh2spAmR&{qSZP9msn|
z+hyA}_4&c;P!U4y{brv6|KR05w^V-Ymqw|PXZqEDn80(}GpyQg@;T*orZrIz0913;
zp*8>GO3r7kq0;#Nwu^Dujm}G{=F6-!76{m*%(MU4VoWg5`X3}F`^nOqEc%+zN@1xl
z;ahzt4E`ZGP<C5sbKF{~tTDtrTO@g#Xbh1B`*4w2j4CXranQu`n7LM&FQ_7sG%1k{
z&%I79b%;ULDy~$!;Jde}#j3npJZ&T2NZ%ZfOWjQN)M_pApJYlG#UER9k9qjSMx*Oh
z=KizXyb@p4`D5vEMB~e#vSIy#yIh#Or?OyrUB>Iw_(qb_7#*m}hID{Xv4{OUp)&`(
zWzgIR>=d*+F<i3tp=tjtSJsx7rML8Cp@OeS<n6ZF_+=C@sQdj}hmc6tfI$w!<oJG2
z4&wvgSx;WQ-j~jvXdOHFpu8?XB$*p>0Tkew5c_9%5{4TyLO{y>>i!cLGe`t$!}}>$
zL72#G`dZ2lH_}kSPI04m__XiHpI~#o|82)Ag#F{j`KoFNXXF@|p`5%$cvC*=H<~Vx
zjyyR&KDKvt<%VwqyT&;&{ysZ4d#+z*n?eL-B>&s$MG&64&O`q;)BTWuiF>0TfQB=r
zg6jy)fpv+2Z)d|1r_1O15Otm(ujtX!KGrME71eF5-vK{oA@*YRb0(EBrH+p_t6FT?
z80)UL7#rRAS_<?e|G|)Z5R-iRZX&r|&b!Y<7e(vxOxm-M>R<%Q9drvruG8hpZwjPF
zc95SW9@K=^ub7s+s`cQd0cxU<y|)G-<w9CMCFk!967-B`cf}x822G9+`6f^^dtqI3
zB*+c@l0QvZOANiqj}XpX>pB*B6OXR$0OPcyZ~)a<C|^+<VqA6P)a25>rovrw8f6^M
zdu1|R6gV!VGvDaIR~4$Qp^oS%EpOMlif!x*wJO^afG1nF$g%aPh<;8apX6}J_DizY
z4;62^H>S7LxE<K?2H{E_MbfEN4OcQj!$iOC<#BWePxe#Vx;|v-5sbe`y---tD|6j>
zg}*M@o2aVgWRRpV)XZ&r)2J;r(?XM41vd(4zo-!JRwqwK26H2T67DmeFs7)xC?E-7
z_8ZS$n&2}H!F(M@TS9f}G3M>ny5iotJ%oP<_v0c935B!FVSh$PO-2tQLQr*h_bz|}
ziGxvg-OYE2vJH}UbzF8F#v)MwdN>=X3dN%k3H<w@?_#D=1X>Y=QT~zrgWiuWe>1+O
zxRiU|R!Zsu#GoM)<WkBtrxIyc1_t6@lcbO@>p<-%zFYx1YRbb%wVklrBy=gb!nMG$
zpU76dY$BeP<D~ey)VM_rW!(TbC9>^574l*H(`cN650CM811*F)*nMhS@fuqd?w$4b
z{B%NBlOjIfD|S)my(|Uj-}`F6)R!%4qWZqTU$!<38(A6L1;d^|<8>fqsCV^csFppX
zAz$^_xxF|BD*+v!;?dc5TP*MV?0=MNH-BV)(K^V4-lY)jh36?1|8^qm=o4&{gEHQ|
z@F>6dbJ_S(lg11Q*L(l6Zj^CW?q=Pv5yI`Gd8dhn#?C@BpvSC84M@#NzRApSG~B?0
zwk1gTKm{`GUzTGvSXrM(<T+Sq9pV6a?#3JLTCnhy9A2q-a5k8)CJXy2ee>dRakz-<
zi#uCGatVlp$w*|a0$;^WGs|-~_vZ|A*As4ST0XY7bjS&P<^b3n7i7KDeotvxN;FYi
zbR6*%t{p(N5of{1-6OVx@Tl=KsbuKKum33v(VMDKlHFoJnpooO$R~8d@NXSs#o$ZJ
z!H2i9KJMI&^<X8F9etS0b3|#erEm07f2Do#ol){-RH*~rtny9#*<$0kA1?KldNC08
zz&}L;Mgwh1g$ZcFWRfS*cT~{65toWmW<RWv-8Ppkws8p4C-vT~|133tF1wHsE`c?r
z_fy>KZ~{n8WiW&8?tEH%hCvTF&f{KXW#vXv#lD9aC!P22Rjtu`SZjj9B+<tGr|~cx
zCe<8?h@Hyvc#C54vj_Y5&+5H^=FNt<5h%;2fbm5UJ}qp2rIjLnO|aszxr3L<zjYu`
z3c5$sHQ*g!AU|^5SV7@X&OS3ryv2&{zkcU4GZa%|yWOvti*Ei{{OAM&Cy?a|*xw((
z+@-6jsxBo8i!x0}8zY_9V);#v<}Kqzb&*ETen)+|1zN7wzx)@AZo{JcXo$}yrRm8V
zd9&#aeny@9y>*af4xO8U7NBTVI_*X8kr37y+@$uN`PwcC#9fVHHi34Bh`<4O?Z+UU
zOgr&uh12dpc*g@USSAZjvS08<JjEg-Cf5V480lK)Q&~R1Euhw0`qiZ55)I?;<T_wd
z%cZ3$w>&roka9yb09nEt_0nr$R8?s?<W>`6>$9CVR*!vBz&C`n*YWs;Vw|o>VksF2
z&}U{iD0!6XH5>5N?5~!O29?@w$Zpwrg-CjdNgBymQ$VPSv_t$_0>?(k$=^AD*DmNw
zBf&>eDPw$N--5J+R5qeSiZ9`<d^E;23W6R<IFm{SW_pbC#?kKfkm55IxyhnblDIMx
zR*0gWYtbDr+n=xW6ciQB#f&|X0CVK}_Tc+rT*dB8Adt?uZZTG!%l~hfXaDlufmd%p
zx>=wPs$VUT`(RCf$XfjT!?^jf(b7rUMQ2;Ai1Uz~*h!+nO)E9B?q=x%+Wb2J*j?Hj
zGN{3qf$9L2A%1}gU@zHT0wSti#C;~k78xK5@nh<9w$E=N2PDZ!F3WyPr+F7*Cz%Hg
zm-YjyNK6>D^+w2{<meJ=nR>oBr+*qVn(COjW2HGT@Q~}Mc&I)lxk6bZV={lD*j#@y
z0t*~l@7xougSd~kDUAQ67QE1cTx;)ljN#d5Pa!XYcDmC<pHA@b@R0YhpGbGTrc6<;
zQz+d#?)y3>!Pi8Sxrwevg}N&Yd{UmbY|YzO3r*rH{o~^sr*|&1*F5YQeGq#G?NUc4
ziS<rQ&xtAC6`ok#D8t`Y(X2O=2afw{-K@W8vRuzEUz+?dsX9qMi~4k7J%0tr$Iv&Q
zP`Z}D6K`6vW7rD`3h)gtcZrN^-jMUr@N^4t)6r{uC`!~4x9GI{&PVBnVO{l3f~i$2
zNWN?28_3dZ&g;}~&aCt<>Kb>aK@s*~HwoHx7LdP9p)ovocFWDI*I&BM7XWiL+0h!d
z+i6q2=<{N|+!5Y^^@(&%E*oaD><XV(roGTds+*MFF>KRX+XmGj0)#%)p1&4~o#n-=
zEV3sq@l~FGJHyrSM_LD+wi&w%q^i!KitKMwFYwoUp!Z_$?Vn#woPTB7Nk38Rb=;N>
zDieDos1&3IZm?I@p2XLVJ>KNLIQ`Syig7Ot?0T;!%Asfn6&#5iPV@kc+D-XU>+8N#
z7%=6jSq9|MhMU}(<HR?5T)q9qh+n^c*<1y^;$Mm0^XfH-3%iIf%T1ILlTA!L@_FKW
zZyOKR+Y6GcPN+Gex(-oU>EPKR0M`4L4XX9mz`pDsyNRk7RAQiq!(}Q-lYqXolBeF6
zYkD5QRLP8~$$#kCbp3zE;_4d2Sw%O>WSxJpF9Go6aP(v)hprsp<M?o&L_$kTt5Vr6
zyuVyvME8ZMyxzP(s8U9LOa-ffL7p$#T*mVGSny<$MZN2k%ZnbEQ^%3BrNy&?6YJK4
zw%t|hHVE|NY44%EMUuyqqLyw&ty%@hFILy9Z0QRI>1yBU{**pgs0SAWPN;6&Xr6f8
zal#I|4}ARF!rfu#xJcrsyT{4P!ams=+5d!%nd^L1FaG7L<+t(uFG>K<eknE0B-Lqr
z(qp~5tJ1y|SgV@G``w>Es8Tj)q~}Y0qRZ~43d-N#4QwGv#b=Ag-OpXK_fuaYEiZlA
z=-_uK#m%xlD!1}s=_rE#*X;=2SGn-9kOlU+v8cK>|3Q2o>;?zUDx3p1u?=2w8y;5v
zf?COSo&78{i(0<21G-cQ5j59)QL(Rx=bWiFZ~4|s{Tf;$CqNMHKT_`0EoehS?eK|P
z3^*Bb*=oc)BI@LyD}F+cKPD#(58;o>pNK)?YzUt_|L8~zqC!bsO10&b@wPnx7jRO5
z9kO(;Y^hVMC1(Lc6p6Px0b$z(`Z4L%aq{G~?N&PJ94`3VnT-0*@7qN3u>ui-2Su*m
zfs?^<7O%vTj5P6-a03sZpP(z-=tQZKh(XxiZ)+Vikys+c?w?%Em3D6c{*v4FvA4lr
zl!4Dj(N_di)MIc`s$s7F)N79$|4py+-eO7QY=Sv0NZd9^vCY@9UklGxzH{3NnQM2y
z<g^l@driE{`=K@<b{{lBQ%cR|4!ICHk0unK>94>)k52zme%+ME80;D8@BGLEemCvY
z_(1X4Q&`7OwP&ifrkZ0JxPp!YTl8XWC8!Oxt5td}^L?AC@mOlkkh7$IZ+s>jf<=xi
zCmV_!?ccO2-QZ6?wRkDR6mL0YnJMzsKurv)hSTm=;!)uIB?m-evN-mKqK;~>MRA`#
z0H)bXB61}0-Nfd_S>=OByWW1Xl2~@n==Ry;oZ2meKe7S($l7750;mKe6HYL!`-3ND
zE(Atw8}JPzVY;ucMAwkjr!q^SyQW6Prv!ZU!|i5KDu-V#a)bG#mwZP*jP0_hWSd=M
zRU3pEb^Z0-v2LO15XO_SNugX%LMY6|8`=<IkaxFvzKewr9SBjmTi&^CZiVP5{@`SC
z(c0NROJ)R5CrCwbL!^lM<%3%X`}_O19@G-to045pUC968LVtn^rL$8S9s<;xzqYXa
z#W6!%j`oYcuM@4+>BN!19I^M_<=I(dK#Td)iB(Fc4U#*YVclxVvnLKD65g*^RbAsv
zRL%4g|CJf75mO?1OnTGTa?;HhOMzjrYj-e^In4uLX|<{Gu4iXv^rN4BR@UW`kn^Dr
zp9Weh9&3SoR7OT|p2p)Dh0zItce1a*$x!BCfk;bDoC4%#{1;P3O$G7X88F1-;cysB
za-q~ysAigxy7Mzx$9+zd4vFoOr#B-NcD#}i&$-(aG?>eI&%$;nN>+`TwH_0)-2ckM
z*d^Qw&?DL_2fyltd)3wsKTjiQQmg*PS9~#1tXf=Y=PIi5mw^cSNAWlvY7p1p08K9j
zGRMEwegyY=CgBD$JY->J*HJVp(Me+rAh88JAgsHkD}9^T4#^j4UvaOoD4&<&iMer<
zwbIXi`)EyZT2j1G-T7wGNt&53hD$xF?EFg-{%iG24TVguxFG`q%~^?`@_iH%wmN0M
zYTz`NX-h;=TlJRT@5yXok|Ur=*^Qb-cp7A@5h5jE5DrZY?O3BbIv0+;@dh#Ql?nGX
zz3tN_mEN!Rn|4Q*bx~;2IlAeT!hgU}8Hf5uafv?(5c%!vLBtAh39hgwBgO^8=Ke{n
zg#!sLG<VUYbA(0uQ|WzJpRM0rR~ir2h5e3rr3H~PC4E#G*LJM}j^{gW9S(SNp+V8+
z{}+ems{_8Ru$GZ3xH#FuY*HY-%|>%tM;*;gt(9e5Vc$N(0UkDw4cIwR&Uo{qmO%zA
zOVjOT^<YhUzibFj?BQ*Fe<#k(s*<+o=}zcTP;s(Y=vQf|P!Ei??Ipv-CskRF3*>;8
z=<c|)4&01i9hE|Z_ww64JxcIhZK`lTGpv(^dq^{P;3zFH4Q(sOEuUNvPe$7JHQ}<c
zl&(<VkwHOx(_vb<_*m9JMyIkaS^b}s*e<I+eGk!Sl-xJCKhZEp91-DY<<my|on#jr
zk7BWS-z1j=6n<<7JNJYPnP7GDXyO_>F9n)b4U9Lh(|)xYee4F<BwPxUT8Ds{>k|~4
zS*z>orTW!_y>@<aCDSnMfyKvt1_z{hd-{(T_^`XZA9Y~eU&I<N&cW^We4^}q;Z&(4
z+>WDqVvo}u9FF#BS$PI}-ueEPM@T4(+znI(;2&qiZjZh)7l{J<FtV5bTZ(09ys&5A
zHEOAP1R5Z3zvaI7+ln5Z4eYBMz56|J@>irHIF)PReh;1&c*@kL;Oi)&Ci)7}6G%=z
zF!}b=5I#-e;x=Z@zTHouQJET`lCL5CsJVBpB#F;$&TRC6$nZ<dJz3C0XbPWp(=*E6
z!LllKvlCzsSN#P+MfvqxEWeIa-%Qc=c`<Xb!yKQI&v;r1@y{6<!k@qY0`bpL5N|$a
zo{^8fDC423Pp%~$nz|G<>ZWc6cS{dbMB(IfiPuly@3<>&Qt-onWBH`4(E1n<TMeG4
z2O-n<ADl>r9^=AgiG|c93fA9oW%_z=lcg9kv(NfEoE3@`d9RIEH#X;sq-v<`H2r+O
zyJdRZsSf@%{)JnbAvz_HyK;wVf$dx!u~G8$tOkHaraoN5Nd>jNfPIzRPCmyz4_AR$
zb7OsURc*Ef;XUU`rToOV&GyY~y(0U%<WEthY+l<jY|_p>==AOVzpbBE@YfuDuxy3M
zw#k|b+C&CIjmCWo9&HP6cWsHoiSf6VwVf#ZS0wKr^6d0jEm+2e`r;0I?hvVogc2Z&
zIL^ASvQJ9lK^38``3RNNpN!{`D`XC`coN*ig<W^?=worHXznozHWTOh8i)2ezSJ_O
zUWRrj$cmPwsN4~D26n$O<ucnG$K(7&ps3qU`>W0<l`f$jYh^Lgv)e5JN>376I25`D
zz$9`5HrUKE8zl4A&af%bN3&t0qoW3B2#~H0zfY}L|2~iBjEUVjrxkc$=Ob`Ll4qlk
zi8i-uc``X*RbJGnxQHK+&zQOobf2B%%BreRPAqI6EbR5oOJHGPhtGuJv3s{P5>Oc%
zvz1EfD|g~&4g(&Q4Dv(T*332S&i4W;yBfm)L*V~zd_vwAd-wl|dTj3F%`)_M`z7ON
zMZGRk$Mbm{PwST2gNcoO`g3zFsIN<1EnQCWD{JX5g$XZ4Y)_h5mo=|IVfSRk;fm^}
zhR8*hU$auIWaKBP$wyiAYI=m>7S9NXTsj*6zz0HO;)|_zn|dpSw3)b_x5<3+x53{f
zpD0qv<Yl%P5aWV8Bq+Gyrg-vt0CeHIskSPBW-x~8&y3JUKTu@WO&*Xz<%ehxvaM5E
z4^Cp05>tl#J(j}bW^NGniMA!&?qiTH6KN1KTl$!SFGd+uz^s;8aiUTXUoJv*J~p5R
zqJ^9ucZbn0M9BR-`m5sPt91b^w`EFL96GWm*Hmmi9#z!ICI?mzx><CMwnU2=1*En=
z;0s7&;nn8<>+^}b=*=$i99fbng(nYGcZM&vNlT6Mu26x7A)Y6U{`yoLeL7>N+hi?8
zJeEE>oXCeLS^2zaH)tSh;QduHROI4)&Y)YESUf`B5b7rBVJmH)c9-|5;DLkmVPZ^^
z1GDs;kmZtNY<Uxf3|-w-aZTdARb$wh4*TX+1^M~ED<13Tc~8q@=t)_%O^*r2r+;as
zfJa~iLnonJRI*=GVuLV#f6U^1D1(GjV}{cTuZDi*QsA)&z{~NI`06ax9uFP*F5@*U
z9%mU7bRQ<3|JWSN8AouUchl{5vfgiLVYmB)cSu4PFvPwP#R3GDRk`Fb@mOl_{K+E3
z8)5(^Vcq{PX=>eF*IEX2WSSiIl?nZNmHLTKK}Pm-jS8XX0)IDO3%A=_4>{BIP{!CE
zDJHQBR^C%DdoX6|i&tl}!ThwtmBuMnD8u<p_N`9f4k@zZY^ta}D;_`8RKmp7%)itJ
z==ZaN)6zdVY8Xthm~9p<H0EW)6CxR+=N?}Uc6eBNGhCu|z?z<-DNnftl3cQ4_T}YP
z@W{rsChSa4v#w^pIq+#@oh#Nc)+kqwnGL$C)4;->L|}7!ru?J3@ouSntI1Wv!d<>u
zkx}@LZ`ux?Uq47dAaf%Xe(@1|TFz0Ox{TU&lSo#u?_P2YbG-rGaK{++X3<_Z4z{d}
zCfxJW?g+^d5;H*DyeA#WOOi!UMfe&oxBZft#seMzZ(U|431eU@VqHkMGbza96uH6#
zBg_o7UV;L)l|=b(HN;2U_blU^SMCq28{SR4zlindla7c9rigb@qtNE-FPn2s9mV%Z
zhib(Hs=pt{SMTam?Als4sM|*R9$4OgHS8v0H|Ct&A+cXx9RQzKDif1+l|#e4PUcxE
zA;e9bzx>Wd<>mvfAgFB!%(v2x=pt*8JDqFwJ-xxV@>A8dKcqXs&UxGk*)@`>d7>WM
z%)hb|G#(7=%r#sK#5T3+!Fm>bx9jlECzv2Hv%ICcEsMzK<7~zT{A;&J&h*PDRv}7k
z4T$$gsZ9zq+O=<bQj_4+cH0+QfDcjJd_fjXwn_V4h@^%tCoa7b7>y5IKP<wQA_RXp
zrmz2uIPJb6$qOpPe|ib{!ZjYv10a|eF^=Z`{vz2~S#W}?-i9qeb91cU?Sng872te3
z5QGHHJ8tc@{6h)TC*i~%Lje$O*r8FgV^jS$-H)8kzyDL*aQrS$SEdfGZS0jf19W?Z
zxMHEsrg@ZqdDQic9Z2r+<=A{meIUmuX2njILD5tYqgniwHG4*di4(yc0&m*bmrL%-
zPc6_Xs66va{TXW9d8zr6v4?ET)ZU4j3{KQTD8^-9>!T5%Np7fPx1t};y_*t92_39R
z$x6BOPq8sX8f`9qwsY;WMY#`85FtF=0$vXIfcG=+w$CeFyICLVh-sR$GqUniN|xm3
zY+KC~o|c5w4a!u5&BxhDj8#s51Q5>AE9&>-c>E4v4f|~jS8(?;JCn(^O4_{`GcsV6
zn<60C;E1{ij98Go_k~O1W5yU!(W?Uz8H)NJJP$W`^Vo%08ncb{2+vfvXU;gUC4H2{
z`fwB{&Wuw$CPJmsN^0x7v<OIugPD6+*C<(hE2L667}2*t?9LSuh@bDA7$<_^=Mtyt
zJ478nKAmXX5Wnpaw~y3kN!~!Rx=)f6Tb8Q!vT1({c;qQuz4J@zIbQ<PH4!}J7<cUr
zEJo#~1e1PqoSdKzJ_!@ix51exvyv{j@m<+2HqxF}*(oX)VHS_s3x9~zzfjI}GATEi
zY*Op*JeU3Ov-X{<9F1I%wl%Rt$G14aJk&D~mjpz*t2nT#QjF{4FLR4GgW#B!44W5y
z!YZ?V*vNy;j<B|?1%w#+zzs0c&qz;aZ^G^NPwi*69Va72DXFLTm5Idf<SHLJojr96
zSWX($a8lHZmY87rGkp`k#5MpkBO3i6)S+h+)T~X3t#FXwBoEe;?d}5`<g)Qv@BHC(
zu)gD^@JeHJdyBfa$=Z`+HIJjN%dY#Yf+PY5@DkZy%2^NP*uI`l?FjX|=b9!elM<X0
z{?ogERglL0KF0C*jzpsGAG#mFboU={xOIsX0vEX}pik`Tdpq$>>sZ*dt+HKVS)Jlk
zru*#|bqRTKA9O!ayh-NT8P5MI#x2eY;}gyYQ-nA>0$H#>OriVqLrx-C(f&SIC+Tay
zOOiFss|j)JB($K06tBZ$oX70)t@0gaYAv=2^?alglX_SscWRdc$NUvt%=nN>fsL-b
zIw%YOA3n@=V<JT{lf@zkmKqgeUn^yqIUx1wuF}oQJ3qD3<7*DWuq=gS<2N#Fw9ZFE
zP!pnTKOiISvyK*eP3}?ntN~it;zi{+P&nDdT(rrPSbeGxeWSVbjUUCNtU%djog%%+
zOy@4TvsYeG{n1Qq8pOutbF(5);jeWgzfr<+g59Hw0JA#qCo$wZC{lw-!LhsWT11&F
zI4QBwfj^P5>FGw#X2+L%1@Hgtwn0_WG@v_ktQ$IB329H^bVjNl<@j<!$8@RExpH+*
z(ii1YmB;iF<GC4n%TH`I4?a#eGK?X7G4)Tq6OedSr!vo}trL}7f5&Z}$o*}|PD#g?
zQ1TPKW)$OCVlx#Lt6~?wj)cX+JCwXp#9MnXLdhU)Q~J^>)toy+3dupD$UMA%xAmN&
z!5MUMZT}6QbSwos-dEB<b!m3}t^7)Lxr89`w-DTX(sy;%<LcDkHMYLx*bDIZfpqA=
z?98bSEwnKYuT)!)#JeUbsh!1{#h>jcaR&hL8IAFY_T|e-bY<(M_Wtj|#^`Yxo1DZX
zIBjpe8Xir)wa#pd;u6Kc^*VP=L>rS&T!tD&aXBj8PaSRB%y{>31g703B0PRA^Tc5{
zJpj6_4Vhpe)gR}Z-)^Z#Wg@VU3cE#n`jaxVr$XoKW!CaL&k}1>MCP-eV;6f=aYad)
zcw!^1wY)();iz!mpZY|CnjIrF{oYRmR3qYdPPL)mEQV9{Oew{|%2plNqcrfX<i_oy
z>@Z7qHnghcJD9U)jLimKmhT*!FylT$`3OadU6S}*%S)}*@LD5j%4^lUrzteUUm64W
zw}V1F^PNp??=-p^zp%#p&q3nq-a6(~jDC-)XE9<6;x69tR0i3bOm^ta9H*Zz;pq<T
zqg0(m$5{Mo{swW-2RlBr)0C#|=ReWm)2;O|{Sc;*YZ?4aESQV>4$DCW@7MGAEkAMT
zw?ayxNDB1l@iMh}WPc7{AmEILa)nsE?NdG@bKe>%m;y|!vf{1n1-(xL^2QBHM=pq*
z^pAtut+sP}BhdBKzLki|=r?U&*OcagET%JeZ{3aXL{r@j7a|6RYA+!EkGW=x5m2;^
zcQdp6t9Zsp6)AsXnX#F0q9`qhaPCF{LBB~OAo5AIsNY#VK6Wv_UpZS39%$nf?4VP=
z@9-$}qRMWnl9Grp{rG5p1CXA2t*Z{tG&|8$P_35>kR*TdQK#4d^e_5D@9?@JAB<c$
zVJ1%t%N+kQsq=GoGU7+@R$)!RrX@22ghG4|N6*%XoQf*9^{(|>di(5oSC!k9IoDW7
zwVa5+L+V$uB#-|&1rqrV-YRPkvm!VjP{kvHPK;Z^JM#y1$lDmV*<KE<1s#~7Pdl{o
z6x254@>=rXsW&P$1A!ZncH7>8T0;JscyOl6LXkON#oc<s18Ib_ieDZ)(NodXU7WQ`
z)t%KyvSa=NJRiu^$FyBi49=r2yGS>!(W27zWl2#e<1>;mTw>KbDex>5l0THWc}-&5
z(NJRxu>glP&Q7GgVlW<_da_-iLf9Yr2M4ho=pOHJXEX;3eP3dUV!5eD{n(7>eQoW5
zQCRHoyMq>-m}cLwJuR_||CZ!&QQ=s*P&+Hs5P-F>x8X2<ZiYTLLs-y@IEr8WBsl>n
zOnfLZ(laiT3;f^u)TC16d)7pRB`uI;WGwHQQCs4pUgno5>!6JFfzZO1+?srXK5=Bf
z+9r_L;pJzh{<wGTlWTcEjHo#C_qiJf)TjF0Pp(t4dHZ$ta2g|u(_gzTFHs27{-?bz
z)YD^ix3G@+lNL1UX02{PsZ50V&zb3-Y#ZhevJOl+O7_1P;9-uk6zeCyv>5*@^rFmn
zLqFAe5!Tw~HH4lh6MI|XIMW!fve66UvfyrBT(a-5D{2RdJHQ`{xi64vfJVeqyqJs7
z0fMetn2J?P0G*>>u(i^@ymng0n^hXuLDSE!3-=~PmLtNi6~?5}9P%8x9B#(T5&8yZ
zRyVk8XxlFJDYLIM+Y{om+{%zHV3XLAUk%^UtIvf3&*8q*%_QIJGFziUwZAX+r;k5c
zeq0k0+Yj|PoXFkDa@}Z6g3=iUzOd_+fWFaA_hn3gR@uQaS)gVIyo_2|ALG~4+fzh|
z_8YVVUT=&l95AaH1vLX(sLEv)y`f3;&Y_?hw;J{2aG7gPsrAhtRv!|@MWVctBpNn7
z@G!J7wsd$~)pFvDa^M_p_2pzbP*}DoNW-KwAOWg+h$oQ+U{Y+h8>Xjlx+((q8(<ed
z!2xd9F;?Q+ifKaUJ@yNBbEa=)vq@4+4A9>?J1cYG*LC%6|L7b(+x8fkQ=Sy4D0h&U
z^b2>uF|IfW`1)vl1K4P|rW~qzFd4k_tQss0kPr&AP=1xEGq2S(Vzu`-+iClvn+UXy
z31||dp$4Lg#PvIT&!L>+NVWo#&X2$ZDIJe;u5V!jkm*g6oo2RhnEe*9zH0w0sP-r5
zL--|RAr>&s#8~AgeECXFFueF|jL05{So5G$vKxIErlxz(qNDA>%b%E&rbyNG`O;!1
z<rzVZRQh8pcOpdCF$>#wKF6hYA5mNSnw6kx7Z=?=HXmA${VZF37NGB2BO&-tZ54If
zUNNK`YTX$rc}`F*)+6D!4g?G^=r1*dr=KKlZ*RARe__U3VpzfT<INGi22lTTs;a7}
zV=$0|ptN}wRzLFW$Bsl5E&EN?V6qyMzKgO=WLs)V<!65Y_`d3;JL%=xQLV0S_*22O
ziN4E-R199IlkVYDO1$wU^clF4z6u_y`=0e(q^`%@+Q3fOiE8}l4tMw~o1|%062_Ac
zDTS%Oz{o`Y;Bx<u;cOMFJ3I9;je+Ag>T@1o$8T-DjSKRSi+4s=zugU}HAycxO5jGH
zIO1E4ox~iV>>L{!NX1j*Nv7hvkn;%!HN!>PcmZ?iP?lU(hZ%axM11Ppfxv7>MPG3t
z>zj+~Bi9!dsY^+*<!$zcsyeRuH{&SAjY7Yl19Aq!Y{?|y&1}i%^<qEZT9fAl+x@zm
z9dZTU?0qd#3IM|df~gePq~9NZ*G(`wA}w$ujrvvEBNkrFOl0&Ec_N#*Np+=?=VX7y
zuG@G@Wm^v)DfIu_A+^L!!Blc7``r7Yj*h4C5D<nq(hPfu-OLWdYW4U?iU*F3<3(mT
z?Nh$Nqw7_rT_@<A*iHte<r%Xh4#Z2gJp|Ce(l+pW416s4GQR$9>W1i2t@W`dwEUq4
zDl8Yg_Wk@vzUT5cH5+a*x|cB7J!}70f)$G7hbG=W7Sefp6!}^<%>A^*!>i>$xa?+v
z7qy?7&ajpVze>$`M#%CJb{OJe?7h^uJhheF{0{Vbe{$GVAAC!@OSjbFJ9Dx}AjnRs
zIQ@cyFx+}Pf4_Z4r>5<%&-<J4`Zl&*r+qgC+nL90LQ4^!H?HcrzRcavi?s2|g;jVn
zTlj~kC#mj_L&Jf~w&BEA*Nmu~{GtOPddQM0eEk@{Fl98?+rLJ9qb;uET8Vm;b!Jyd
z3J4&AmbMJ$tOlptZ`IFZbgtBuQe#Ri$vf2EzSMH90!+~+e@Dx944C6p(#pjI9Ec{O
zAKDpAQnPzMsQx&-80Ry7T3|0?qWfWSLg!kQH=VCRecJ9?OdFqiqw_e{>7A1suyRiA
zRUor9n|Pa7Qr>=0GVGV{wB>2MDnQn*ONYZ3vuJ!Z<kfk4uza_;9I%?C^d|F>tx6=<
z>KP#0g&+agLn)|jt1vSZpM;)R*?-7fS>C2LSJ(@dAk|vO`1M3_RY2+G8O}T0A0w&5
zN6Jy34E&+p6oK~-#U;~Z|796i?9s_~&lEj_QB!QRkFeZ1-&%(*1n|Y|u7<L-^DA5C
zzX3@}ez2YaAS;DANw2MVW3;TJd^Fy@&D#aGr~kL`|60pt{C)(8p_6oRHY2W;>kb>2
z&jf5mjh44OfW4%LC^@F3pm~J_<I3G2B7C26l}jqygQuw0J>X7QAb0hU%GZYOB)E{I
z#5mP8HbH=IFXEK&+sd%i`-j1KK<zNMR&{U0SbB+=J_V-$`$4v0i9e%ps?@v$6HdP5
zJ<ETjHi4fAf<H=6mg?i=JHifo)cJLYU2{3`MB)K?XwpOaFnljOl5jcL6+vrniyuqu
zZcfR)l}=8P?3!Z|bF8yCulBVY07{$(Yr(?FPdFgXCJyfQYF|+ym%ZWv%txaw`9~j#
zkW%qnFRg$4yiw!D@}2&^^bGeDV9t*|wgGnARYxL;_tbfBF=}_V7$8+<B)#*jWcq&Q
z+%(H^*Uk4Xzh$Ren3Ml0a5;|Ob~!Ez#RQge<vq0h6V_NbIt(b>J6$*6nVfIpA|wFg
zE!-5)b-^Mttfn3Y=LB-1%ToV!+^GhAW;3fj>D}N1^#J#wP595ZpiLKZ(YJ3W#VFYB
zI1^)th6M`NiAg+l=oKSMiYqbxmQA?~``v!U1xf6l><NZX;mbSiF9!dO!8mRhYUzy)
z`VdOL2|QdDngW4s?>`*>xWX6m$xFb0ZH?-?!Y}Cn-0b{)<IH{02_ifeBE3AM(rqQY
zP`8L|K(Qzj4;FPyCjQ5WqW$Dsoj4vbkRaoNg~`X70{lB4C?7RO{RG$1j^Sqw)#J+P
zW1OSBjex<1gzmafgq8;*23a{j{QEQXSU)D{704Tn#1uty=`(8~-OgoAj*D%|b_wUg
zrr}o;Z$0;Bem3z)U8ikKx{zf*%l!8p8G3Aizd(Vqf)&x>IQ+OFfmm8v&SE6hU2duw
z@1j7{%vK8oHUd8$3czv0zh@{>U@VT-whUgk!29>N74lFxtb$hgH$G5-?E$!QFJa@y
zbRdF&V@y8JcK|-u5PrXhy4yNsBP8MZ`U(RLQhqbXnoAT_Tx?<D8*p2j@BH3dpj+SA
zQZD>uPj;$b!rsdiwvAa{;{#0xz-R3~tfOZ#`KTt^g3)44lk@(2w|EKFE=-c=i)9W@
zAMd=OdceufP~e$~AT}bx!6y?TGaYf`2Z(r|&u|<<$Bq_kFt)Jg_W+NRWqv3EVh^Bf
zTo&M`>pC^Qlc^pL@H73|?7Lu{eRRH&qoW!e#(zrEvBLKl?pK2dU9Lm2H85^z0PE9O
ziF*eKDk^E}&LTPc;_-3AbpSlmfG`LieT02@_Som%>hFGxAX<|X`#t!LY-i6Sm?*`f
z|9OR3>{2ksMDqJtIK|ozz>U!LH_wanpcROhd(+ng<gt)H3`N}zqec9Hgd&Kbfte^O
zUqFXh0H)|az3xSbM-i5~_5uLT^uBr4L)@+Y<U`aAeGak3XvP*o7#vy`<%iyWNwG0a
zi5{5(^b*xqCKmpaDBvI2BDdFvaW60=jDyY`>k`}|EdsfR^y)vaw41200b&t0i-^@g
z*b)WLUkxjOHnT5T`WEE^xD#57E^CgIza-ux$c{W#^M<Z_j}vk~3laxhQ#UzB_C6kE
zya2*54m}IGn|0|ty-kdv7WQO+{`W~CC{?sO4%ff|WcUzC`(E<)0CUDUx&P-(c>Q~T
zOBY3aVAOJLl|MXi{7tJ&*3@^q<O$w2pbufNaP{RSUZTu>iuU65hwb+QaZ)s9p0nU)
zt09TdF}#hGg-@7ILY3(V``4?*+8VOn`5}zi>B@xK`}*g&8pQ1O^FP0&19Ky}m=zUL
zr0%rk-zz6RKkBo5PuQDEX~xU7PQlosMj1Cir2fns@Avm#w4q}mP`;QH$|4OW72>*x
z0>^TSO`%;}5kCW4@z3@EbIc77=Q`36BHmcVIlM+4l7ou?Y#C8&2jSd%sDJMj;M9Am
zmLnG6D<r~G+QZ`{6w_c0@N~+!*a;v!bR;}02HZU;jDIFHpO&BZwq2ii_TsZ?7>jET
zI6USf1}FZNd<OGnKII&vq~pdi^44waUckBzN#x}FVsZINxq$5oty^Vyo>t!2Lvhy6
z`QfS~-^|>Yzvt8H2-6^~9o=0fApJqmbz}kpWJ)Wtc$1Yo91;l)Q!ZKhk3RwLD;c<9
zOUYO@SLXMBtSpQR`>5<{NJ6}Ak~q}v{R#KuctZ-jzb#0sBoOiS+A%W@K(1Pm5q68f
zF{{FO6y0%>FPKx*A3v<Xrc@Up{*?am^6ZrGj`&<hmLE3S_sf-_$PkRR!7fG(1<<Ih
zn`7eU&UVtF07}49AuP}X4<F{~?QYB-zhX=jI?b7$8QwaW5e`_-P0bf|DJC|<`JdqB
zE6048VryGtm*YgOBtQ1??tkyXiEf}U2MXxpjM|z25x`MjZQNSFM&#(-DG~tK*qH5Z
z<741T<kYfU?y!c(MDfvDu0DId`*vo+p~vxKCr4(gUCv!!{(JPE{f4I*IJJ7;186Pz
zz@fWgc&^00gmJa$^#Hk*P|=->$L5${ZE%-V2qVWMp<Fq`j)5Nqy909Wi`NsF^xHLo
zn&2mohruyo=?%RcWnP?9(sf-kZsF|}So@UrUuie_AFx;@$~`f!9`8U43{Zy8WMyR7
zSTK|4;S0JJg%>m4*Edo{Eq2{_QH3tpZ>1an{3TQf?k`EP*Op=A(aZ7FqFETuUAn~+
zq680WJbwTcWs4YS=V{9kiUu4d|Ho*_3F<+p97ewe{kr-+$pq>pJ_FysZ{fVex^TH!
zSuN@E-<dv!UorwuWs6**N@%#^w4h>4Sc}laL<zd&{CxjA>e*=UCqe3Vk+o-iJ)we&
zwKJwc5_mZ6kdeS+-A7^1-Y>bjyYohn67IJ)xgk_z2;aBV&=;%gdZTSK{hZgZt!G1C
znA<Q|Qb{n?0?;XDDqyhTV!?TTRx0Q*gao}~c2{9|30*M;^z^!7qil~q3KTy>_tp{^
zYzUwD0&|rYB+}k3Yy9h}cGulc%FM2~1^(-8Qgyi!9DA?9z{?_&3U-)lWWo4Q9^Uf|
zA*cKIH_{jZ@EqLm5^sHiPUdm)_eLt<p#S$pMI66$6ZQ4H@gBCtCc?GhiQYd4&M3wq
zv#j4=j)P)+k61CJ7$6bStqKsuyo+bNjd=1n;t}InI*{u*kmc`5+-~FDU^iV&+-jk5
z1QZiWctW4l{nCL0D%Hal|7Fj3IEpp`{k~`9QH>jSr?l=dXIOy-<(KxhX9)mnME<|`
zw%{Gv8Sz(_nr{>*-q?zQz=7E~Vf`a;XM#m{*14Xf6GK(BrVOFOPrf~PFv1dg5i+Lk
z@Jr7Q<L@0hqAPkt+$AcKp@oO{zL5kLa7S@Cn;_}UGW?Ha9xz)HN%$3j0c#Y*zRSST
zi7=wZ9yA!D#gdU1v64FZgr84Ai6z}u+f>=izAm<fw=~AG2y}ypuA^|!3lQqh#=Xz(
zuQ0geIMYC&7(D@&eNDqUeVstHJEtCCu!-mQ|KJOv-q+^#$Cj>|MUt;xeZi-tLPbj=
zVX;*6p?4Vhg7GmXz#3!IzDI#4{K)*O$Eubz-0|w)XRjyz?cN6Rz%=AVJ_oQJ{8mFv
zZG^zj<_O2KtfQ~>e!^+^_bCJR?nVw$?dbutOYo||0RCKOA+}Yx%fkp)Nz*xyE5+Co
zY+}*wL<YIJJU`t^eHWjyMl-<4hiK3v_B2dV8`F6Hj_OAOsCYT4j=H`LcvD_DnY?4I
zMY`t%{w<>Z?_qjGC4C9N5aZ1-_SUou{cFn*vtQS-WY=L>4Z7%|lQ8c;?W91mo4CFI
zqh6z;ddYCV??8q^;+MUj_%wsp4>x4<Hl=h#>(JHT51vO|>oYT_1Jw-3Eg}@z_cLE2
zNOQ8xImlDyV^@KbgjiMz5@_sG1WyrPnDY97TL}UVC3v$$6L_^UwoJOY3v8WZBgCmU
z?Y6mW?vhKi=IseBi#LR*^M{c;dR@;4Tqs5byy|KMi7jn*QV@#cmY9!?c#o$qld5sj
zv}=Hsv@#OkXo>S;w``hb;OvZ-#-~l-Nl!7L%4`(9#YB0@5O9j*(FnPJ)fo(eK77i3
zX@9`3Mc4zOcoxjjC!d199{$)oY-GG{3wsN_qJ~;m<EzxKE3_o2%@@C#Uwy7IwSMoj
zi=4Ntj3qr8)l)dAU3$nW`~|D=G5`}ae8)QSX=4yL)&jca{w;?9pP_53Eyq@mxi|u>
zkB<E5f9vw`V^liAreIhR{r)Jg0ls;*J&r1Dk1?;O>d9cMZlU+vHCoORJsXjJ8E?Hh
zN{t4JMSd!)mM*{rEXKB~(R;WaP^Zz#<s#GSVRseGJ&<;zr6&4z*DLV*Mw(GQNzhf#
ztZUdwu`vLchJhXKzui*jZyarf|D-MG3|F~Kgd=Is;}3!4!b1NEmft;ACZ0er_h6<l
zv&k~Xz<cPA5N=?C_;XXe;;d`|5QBv`mmq+Y-VoR`63Ml~8Hr3HHuad);X>Q@G29K&
zQea&^r4%H7kG}sgyKhKN{Cd=0Yy>pE%+V`^9*Go72>`U*gPj*mHQ*j#$UH%{|CG{H
z883i1)}FTEY+hyeoCktbPAQ5H*t5*!xs@05CNb{w+*$dV1{zF`iHrLXO6c$pklp$M
z!C^4b0$9v__-sk^AKWWFuJEgJ&pCbk4C_!B=!&Q;*y%o*=0CG4_W)G?WQPw9y?ceL
zE0x$@pwEB;YObIM7)OzBJf;K_lS2V(w+bK(0hnre3>Ahc#tF@)Pt?h^%Rv9bib;pZ
z1d-wquN%4n(&6JE_PZWh5$bBUBdk~ISCyt6LT+g!-r;Tg(D}l`;s+FC&LUBNEU-#0
zG5+2RGu<xEpTnXcKGx<|(`>)L{<<xxE`Xi)x8=VgTtO+MW^am`_>LFLxDvz5oy|Dm
zgU{!0_nb-kUO1>;G6*`&LEbQ)JxLLV<T@XUpCaxKgMt7(dj|*AyS{0_P;_vW`^C`b
zreOaBjk&oDE$Auz_v(7*T>BeB0?X3Z(kysQi$xqek(+~Iy%fwg*_f&Ahh?QrLJt-6
zAatPx5U(}>eTzuoqo*QDiHm`pTb4FfYe2B){!R{NPdST`;$LkOi}&@4UM@7)3{z84
z#|%GX)3q8Jv(_iWdffK8Rtj)rd=0LZ@?X{YHTb2?`iZsRm?9Z&ZvduOwD{}>TwWK^
zrU}_I!;u_$wZIt)sEtv8dw<UiXh{5?xFmX>VHL~tdt=rAt%^Rfq-ao8R$f0*Cgs_T
z@KuEzCH}{5ln!S<+Bc_}&Qhi@u)8_xUcg{jd!{sBI1GsbqDpP-T(N*Tvy^nYMb`C5
z$&mQSN2c6Wqr{3o0=bu6D}*3^3(Zbu&>SBi{Fu9}nN}R5nYmcH?Bw5lO;Jevy^PVS
zPH_{jF6h@)V$~y&dqSsjY^nH9Hex3;!;pqiw4wIQN`4Ncip$}bIi{D<(Z4wx{~*T>
z>rBOeVkJ6o(YBN3ec)W!!M*eKd^AV#95{~;0UKk@)=FFI!<Y!X$;XqKRCfs^-61Ov
zJ_ABfw^4~#%&t7m75Z6WK0nwWexC%TqyriN7+U&fIP?22^AI0pm?uRkCJU!zMC$jd
z9F=Y#>QG<+*Jt|6b;y@5U#0*9-TSZAv<$~s-EJ>MylcZnp42PR{rDu}afU@|b%@M%
zY}@uB4*p~h1)AdQNcU3!>wpMHOfoxh_x0%4$n&GRfU6s-{2nW8rJ48wkgd3o{2wL<
zo8WOxbVge%-m-ZrE%CL>s6tC5r?*oVbB$@ooZRwI679p}4FOd*b=Nh?0Ryr2+mivV
z`xy<qiOn>yfZ+GT+mEhgq>h2yFtNc2fDsQ7?7%51M@IZ`%K<JlqTOc%AjzRIY#EV5
z?9lrT52Jp^?fa;FPp|?AyMjbCPYt<copUy#+V}FG3b<_&n|c#4WzhgHkb~-MyN_J9
z6v*n{*}As{<iy<ce78!Gi3yr%23mF~N`ffH!reV(_tzl>wZ&JtmfD2Kt$WPkhi{nO
zaspQXS~2F5qf|7E!cEJiIpUdNybnx)dsihy+u0F71JCjPBv07OG3^5Jo80V7hnwgJ
z=KM5x^PTJ0DsJ>0*+qj(WuR6DCDBvrtg{ip?ZfWsPt86fs8Z*HP!ciyEJ!IL88p;n
zJ9{KZ=5sJwXKTY$QZ{+F?R33JO=N2@TmObl=_j(B>I4?Rd(27;de=6s>fTmX$_%;A
z^EJ?*-V2z&>xRyj`|o-k#QLoVO=kXHiu|KicEixY`|zdHsjluNTq{d&E-^4$i8+H2
z+<m72)xPwwkQb0e==9@EL+iCX0#d_MFSVyq(>gp^%`{yrMCWc;*^=7=L)K<C4KLc5
znhdISCW8zp)lp+>O<jsZ?i`C=Og=TN*{vgu;)*v~J9P@JbEji>_TFJX11<sMZBEDa
zWKG^iKt4;(Fbt_kG>n@o@<inBZ2VaNYg=g`Qx%Yzz52;=HgZ)Pxp~DM|A4td@X=AN
z`i9O=Q>RXF;n~jE2v?h<PNoY9#j!K-G7#``XpJ$NwnMm&j;_{d&>7AT>Qp9Gpq@N<
zPgEcr7YmMg9MR7_C&buZT_!mMen(yJ3SUHn13XxJRq|fvBO+nZ_PO20<skKCUH;A5
z;`9Eu&rZTUzttLl^zx9WE>LyUoaMM#>^`5I>c1QgLY;c%IT-15>GH`=wNzF+)!0?&
z6kEoXTYndYz7fy&491T$L#CQ-&!nrDo)K-M8iNkB#dEJGF{`9mJs|mApPU<;{!ITR
z1{=anD)q7GxpYba>fP{hIihJUpp0AF&{%8uveB$=EwcX9onvc)>8*n$OG?vNiL!$k
zM9O5w+9K7s95v>4URe;U?zHGl@o{c?=JNU0E4ke3p?WSgRxRLV>rTO8j?iTrA<rs5
z5J<_$=i6?@TUDpAGJZ;?%W}~Hw#Tw--f^$|*{P)`4~IP}*UxBn8kY00fl(|y*=tz4
zIaVX^9cVE#RpeyPe@QLiOxu%xuZEuDo`wDosXk8p^6e3UzaE%Dh2#xM{o^ijjeCV<
zl}EQU4}^j*qG|I&2onm}LMz=#Q2?e)%%D$efSo>W#Objju_z9jXA0;k=PNBa-z6QB
z)Efd+3k*~)UFtu0b4uT9x8sxO@52H=diNPa?>GsDfnxbXZjaJiM-c<cp#kW)Q8BMn
zLG=S(7WWw@neU7{drsTyj5inzN$=t1qL-N`5YQ|Gda3Kv<5leiFiot0?8p&ZMA^-5
z3lLm5=VP&Ut!Y2;)8!(o{qw3%lt{ANNlm{ZTwz)>a|?Afai6=lHvWtmXN*zpI#;c_
zNJMk<cKE}yWW`8zYJaAe9nABmDP}_(6eoYqg(Rs3B31D8HDBna)*UGLeES~phpCqp
zLUy8Nz)JJ!aKUS*U&0~M^))C*&a{$i5{L++8ea2FdC+?#j?ma#4|kg>rmfx9N(bV_
zt#$PRlPFJ;HgoONRauRis7_Lz(`w)uCx4M*tZsGkQ}dYNwn(<0<<<~vfN;|VLHCoo
zNaM6_n4FTVn~X{-_^da6qJ|G`Y4W)>uHjENiUM-Vpo!3c6Z*dRRHh9Rk0Sr{CZ|aT
zL`Ag#sH#X+-=Oe7yOb|pR~NY+v`9nMo6J9t_!#ujzSOlz_H!|KcLXXJxVsrxevo*r
zL0LMC=LbmwRjW}t4|@dsgZP%`u<Qgz0(mD6%j1z^X9Zu0um9qUXS@Xzwn#-0YfR9~
zG*Fyv{R}=Vmib!D-?6RY@H^oz8WY;gnm9YQrmp!9q0ILCupeFy+%Hyzqeg(#A0bv{
z!3!Y9X0y`nUte!;K_g>8b+6017ECNyj>shbOpu!4W9ox0FQRGMSWIQd70XS+ZH#CR
zx@j&dBnxK;%NsB|`LjChF*y}iT(6!+o87(_A;X~|bz@dxCK>uE|2a_h#8}oqc*0F6
z)uHKGVDp5ik-)H+(cY=q8m_3(M2)K{YZ+0<$yaM!Bps;DYaajWi&<;PJzKLsWulRO
zn_8AFjfdc_>wx~Q9SQK%whui6!OMYG|K>X|WlBvRQ{z2hU8w^xjQ7-28?i5gN8Cqq
zBJWokkmkd?qJQvYHkHdL^&i6%xghgcN}JsUs!QgQw(GYC;ZU0b`&MyEk}XP`Z*~<P
z@_c(4MamKG>|NW)KCj8Q*$$VtYN&qUfUxytDFaR2vnR{fQ_XWX+lLc1qR92+x);Ld
z=N@;gHwySRG-oO**Ro^3j>7!%MG|VtFQ16^ev3W}keqQz8B+%T65}7|iiQz^Ep2X4
z-GWI^Hp+Hp)eP;q%^NK_pg`(&X}$ke57=JLK&zD1I=V_cFWbL)SZ^ot;<#<P;|;at
zionolL&SByW45pB*iDpt@2?Ai*b-hm9RtF7FGX4V<yqUoqCl-R<-lnQjk`*jHCD<k
zn?ak?3Pk++Qe5l6fyUuvG5F@pUD>hM&=;XS2M$P3F~U>2?jjcbKJHSViZc&NQWK4@
z^e@>r01pUfpCoibRuvLP%)8JxU64f}m1~v+uyRs3risbRei(A*B3P1;rv6}1{<Q6@
z{u;&Q)3(oQ*Kfkn!2IWP?<%e+KiAGe%MSxbdDY-r@4kqaYK2cRbU^@rTz6F#Zeijr
zwqdahOc^5Ux&z0=fdcT&p|SBlmS8r!a0`v--%KmBAuiN;ZJe@EKFI}3$i2-fObW}t
zbB`fT=Qnu6$2`Pma<koNwoj|ug`8Wal#K0f9-%E)8W`<&yCs68DJmOMKG@B`0HSl!
zF_7P7Mvb=v2msU`BwHNgGAS4SnWJH>TtjiviP!~YWDGa~4b}zvmU_o&O3WK5!B>&D
zo`AOIA~4P}DB~#G!+$ccBN$kneb{H(=M92;WvLP(wwDwTA^6lbha^$K20qr1gUHxr
zBt!)NwW7!&z{s!-B3Fc{5%s1mCLgeIC@m)MF#ov$yt|2*^d3_*#?LEkamwBzw>n*R
z{^xwG{cGM>d-^1e?Y3!aWW8Pe>_x!|i=8E(lRuM5?yxN7mYBAjGIV>P{D$;)Dy*FE
zK}yw_>Zw)Dw+pNJhyxY}5ZJl0BTZ!-{sQt*+}|~32*eh&f2cimtCl@3c2aRs=3BI%
zGATTBtwX5*wdsPB^nTm3M{7^&rKCP^1x&%Hve;sT*GC$b95q3L`A&O5BZH>Pvb*Bs
zB`<?KLCBx(yE)JKZ+|4qphkGxWz*V%2AS)D9^&g%ty+*iYs#egda>UJOtBd2k55MJ
zKq&VA$JALzMcK7)n-Y)^lx`5E1nF*2Qd+tNL|RH1T2g7GyGy#Ik!FaYJ0*sY8ajsg
z?s?w#d4Jzp{KsOgVeWhHeeLTy&*Nk!0RR4#ZT<AFz8!D{*FDVj3m^MkwQdR{-M@EY
zmz{?WPIkwVpVy_9Axg#%P>;gj!k0pRn^}VP^MuGKxnoGsAGS_lWB{A%e7HFEfZZoG
z0W5kGWXv|wU+jp0G<54RBL?Lqcn*ZdUap+`Jj^}hjN7h-!E(KK>zz5GUuFw%DlHvt
zX3bll4O~q6BBd%Hw?~t>K^Av?oPN&IR7y*si`EOg)jw&9;M&F3$|8OnS49xgMe~`u
zLPMb{D&eh%DT@W`s*2h=`12bb|8D-F)}y!ZY+$7+C}bVFJJ8u=GkaYYK-9%s9S{!L
zT0Tuz>ihze?RyL4#EyrJVSg6{3>!)bs$E8#_p2)2J%<9p>=Io^&_%0SuiNvz`PuiC
zw#rr(?;C{o`;U~fH4^l_BEjvIH2d@Q@Z_QNed!Ck1F1vP+QOQEqxcq$)Ny}x(sSkW
zr$2-0kH`IP3tBp|>JM(UXJ(L|=fy9%e0%vNyi2N6ji#5>b8yHusNxD+96Aa8Sj=6&
z&o~-0sl2x5*5<%0LfZVCQyVgVP7x>Jt-UHX9Lu_&02d>;@TrHyu%&Jw-XF~m2)lpw
zFKwIW)+u%gsJ&uOY<IZw`FUJtLAx*IUhJF;e`00vMgb5!%FkbEPS$TKiziQRrgtP4
zTX1aa+7y6h{3v)53LO{@nXJ_LRaFn(Dws_2D95M_<Xlo*3i_W3-T=`~R2NS>IPT>#
z1%;n%`vC$>q}#VX+W`=f-6Wpe`~*e`4v!%O?3c4nD=j2tLCW2YUcg~jmIB3F(<MI3
z5_0=Qk`CaG0?EzIc%S=9)l|Ish(u9IpimeflR`^~%y2jBI?Llnb2zWHw|ML=fP2$Q
zxP9oMrW+0wq-uUiDs6CYetw>^vX6h_Eq&QrKe-`8$8$13rHcA50aN`48Lmmk!$lQj
z9a9jm)}q`P9*vdLz34w{;|chmqLKN`enqdIH7p7nXO23Tj}sdhf4V|_Wzw+UV6T1c
zL$6{~ANswI-Q9YX504z$zJc%bZEd?j`Yz}>V^O|#yo*z%U5MfUfLMP&63D}JluteH
zq_I#dQ}dnq$%<~ueMW<+RhizxRu64YxExH`L<CfAp7_!*O>Oo2u#85mjzJY$G1Jxb
z5J#JgTCCh+zut!JnZiO*<v~NBF?1N-3M;;pPp$c>zoE(UN})=znGb(EuU2i?V6`?u
zZM!sG;IWF%nHH1HH74i@J)J?b<5^H!iG=+(+*ZmI?OzG92D3V|=aQc#wsSAT-k}`I
zm5of@<^I(UwfRI`v7_y$Z91(+Q_ik>R(bc5&cIyGz(;KxARp{(943UqioG?OOCWW%
zU=MG9+f86QX_66}W;n+C+2h#bHNC<JQn<sN-05g8(g{;u4ZgKr3<ejlAKN3@X?spB
zVQcrJYa@YZ+<wf|gFrSJRi|MUO8I#b)dTTZoON^#VYCS&Hbd_N#P`VcRB%#r@R=AD
z;q&g$NDXqL=$<>&&Zj1Fxi79&^~%+J_qFuZZTr?9yM_x=AHb!q7)}BLbVG7jG8?it
z72?G<fIK?%UrFGvcC0US_l--465gt}H6i9aV9OZZ)Mc+6C=g@E_p0YGS;GRg-*y8?
z;dp(F^>#-hnZ_*X3p?#Y^{ijPlN{cSTz)k!F&SUH8VA$U4+n;`IB=u7GxY4&v>t(U
zDB|VRdmHa;`-O9?6>snJ+nPO&wB~dcc0GpL`sMe|f}!Je{SgJxGuJ<DvXwLAFdZ0Z
zJl2PD6&1)poHZ;7-yDVqC0(+>mfGZ^TXGwS@`2YKQ~p1VX4Vo{s=$8%pPMbPKHslX
zm=Bu{ypPKNS!u4(Uf`f?v(TpGxHTaMUG!GXCBOiON#vDh*{}URcJ~!GvEIL(anyh>
z@p*V)M}5qm`_a=ZR@EGOD+U(vb#y%D3T=cg+?TW$-bjDZ1WjE(EIeP{?+1nAZZF&-
zDGsx&NRQ>WY@Lphxu2iy6Z|Q4I1_t#e(8c=`^tUx*NHxlZfJdB#Nf+#(kf%FfyGAT
z2Nk<j$vWLj2@_FYnP8gMEwt#Z^{@jq)XhK4gMCG!nK>!#l%p?9vXbN%yqgc>uT^fW
zvSCu!?78(*)*cJqPprCln;bLnyi8S>>K02l==^kz4HSaT0AtKteU%!`eB0vPEkMwS
zGX}=3HU8bh^)kvL@UJ%#{V;c6c-c~A5&#S>mrRCwgvj#euBqQ+R|C_;%Nn4u?m$H_
zZgLusm3hVXflNVUtXA5A7F|_h0_)`O0+5jI7$eJ!0;_BQlow^9h2B8NmHZ)Me9|XN
z3{(qGZ$s!oynxv*X!nd;JqEFfs-R!Lpz`36@wVq*TsfQORpYOj-fbw*0y5YrY<35P
z52Qze7k9v3xH*g(f5CE2J}8PC#)L5ytDqUF$B4z6`?sK&iF%l+lz&f`OsCY4&ql9M
z=qRbymCsyHpfp?6O=-xgCwS<hg=sn4fpAt)j_Maz)7~JqA{bp+5G=1ElsuztfH_?z
z<2T=?@K`%3*)dLLh%(z*MWv${RC5#C3W|P(YiLGdy~jV~ZQJ!`p}1dFTW|AanNWUt
zTG8(t0E*`Dil)HcF;M3F=fnDUe5q=SDo3(=U%}1gzJv3lq3FSEj~o+g68D=*H4?N%
zzSuhLrxR1krg!fs2s@ljDL&c1eL7@o@UZpUq>RXYPH8IV-s&^<&ni_L2v(w&zHw>h
z5;Qc6V&z;>MZIMYp~Fhegjoj&m029!xlW@4f4HTXCH$c1<B7i}U(N}xXK0@n!s;v3
z_I$-@g`*OgMp7v!Cq~UFOT{Y6&8~3#G=b9&<wb!Ri8juRYJm;59m`kqr{=uKy5U;#
zN>+j2mn@-`Sdjdo`sscImx7IC{<yyi{_Ek$r*HH{gL!&Bvg$i{7ttM_+t<K%zgWyS
z&wq9}nh53HqHRrVIQNV)23syuS{H5nOe?_GhR07j@VwSEvHWY59Y08r8<<w_zxdQa
zf57GS#+7EQAjQ2t*z*0Lf^_atK;v9}l;L&<e(Oh)<z)|j!x_)gqtq(yut>L73fF*s
zQkzV3%P#VFS4u6VPvy1J&Vl>IzEKVV)2RO?<YA%wRLS;*(c1;y&b_miIk=Lx=*;|Z
z-WS2O8lRPhDZ+GZGi<q~T+=yWv7r4e!$YCNf$Qu>R^k2g4seZCzuTAc^hui$SxOuZ
zJHe3I2CK0K5b45+k+uV;1M_T&0%mZ5wv~N}#c<^Q@FeDv<K7$?uLQj4#MwV&btUDS
zEMDg+H$I@xSf=WpbNAss@bvLjz*DSEvi^if(~O&mdOQkAO@c_O12a4|mTEt4adDcc
zSR8{dr(YwfJXKNU@b{fk?%2g*8w}q51~_`w&0lGykkLR4)VlYk{Vu`V-QOGmnD;}>
zyO66f-7twiGnte4x534@nW+7ez$C3liXgV3``{&9h1Qaf01`l&dmHe1K9)S`R<>)8
z%JIiv<aiE1dbZ&~z2+K-obeiUD-1%0p-(Y4YA>6(SmU7&er>T_`f|Qpr9~t`?=ot#
zha@QA1!X6xVh06XabKSheYS5;TTjwZEk3VD`wVcM^|bud%SYsID%|uYnhE(>1#`b|
z-K=Ucm!GCCk{^yyPLxD(*SxYwy~&v=CPyi4SLQZqm~6otV}!6AxY6z@G|%#J!gxZS
z=k8r-$0R6fJ<=w656vXbT#;I3u?A)S@zcO|i?=Rw`#T-Ra-5);`IPiRhZ)_yQ~7JP
zdaXfd<Wc!t!y$eYE;KN~%F4<-3Z)DWn>1eXHeWJa=>yYF0}pxO>s4$p&}Du1W$0z{
zn~)wS_^gwa>2)_*-bREN$$E3ncj#Bu^+dG%=fr7r_v={swFb0dQc8zxp!k8fBJflQ
z+V(5ZHIOJp8WpNO_~+%L5PYI?b3C#{F_p-woOCE*3Gm#*>_zK+Js0X;UfdQo4xi<u
z`?b==N)jhW4$Keo`tJK=kGh*Ezjt&!v`CQ5LTxlnnotsi7>z;UU#-EN@Fs)+8%`W6
z1(^S9BYTy>V6vsg$js+Q`tnS>@|NsZWd5gQ3rJY39CRv_V$JM+R9w@<r^q7rrcrwc
z$AV76iX~abU$vcAfc5P8kLT$8lkfq=HJz@P^8O>bn?d<JYX&jN#EUXl)J=xS-(2f?
zk*wYzw9HqRps0+AEB39kmgsuP`UH-m-8WVJ-&m0Y6rbY)$AuEIt<p+Ie%i7guX#4v
z!wxd{7Zy`Y7H=#mH&sD4R@7zOu0(FfUQc9Zng`p&guW=-eliSeYrAmCD2INDw+`#a
zfPI<6=;s$RwEPyBI|NKZi6tSKqRGM+T(kxETzMbfIf^^K|LsYAQho*ql4ofl<XJV=
zbl-{Mm($x)dDkeuangH|)?is|5ib52LEdjhoReOKM807ZddN;m8RSA^yFJs{wOGOw
z1U!Ha5JZ^u-i*5q0vU1qAac&gaT{~uxcKEM6M8$)@oN-tTBRn+NJ|U9>po+ZCwSVQ
zz#VKks2suaNMsKGJj3tLzwL85gVJF&2C~yYLNmNy8hrY5zdklZO<53E%4d0Pv6+B*
zDk|&ypRiiR2jaGCcIcMr43A@Y2wsi9z>p#$Rg%tu*=jn9e9TQGF(@rf%zMX`9D=uR
zC1H=v2|86wG;-H_#C!2Nbq^C1IT`HJ1THd}i`rjqxyvT7GNEEQb4=*4@zNf=lb+()
zd%IRMA1=1I07%_Pn0wX9M;oZqe|S0WT>=rnJwz2JJ^cRhBm-8PkMUx+Ns4XA%T-VC
ze(Rw#z5oey?FwJ)YFVuZS;tGSPh~&2y;prm_dj#W``QgizDcjNW?`@?{C(3F2SN8k
zuDAU}UX9~e`Z4Sg7m){#H1qZs2G2sR2V|hW9ih`W1gyvQ^g&CG_+BI}AzrOWZ-YeS
zZkm^$^w<`EsJbut;d=@mHyk@{%)NE~Z)dTtl@~D&6O#M3@4D(V8MZC|2DN?N2X$OH
z3{d0Pybq1kCbk_g5#^W4lh~yjeANlx1MI1R6yLD%;*m90u8LV#Aq=W7ntjp-yrQVx
zGLlsX<K)R+wX1|pWVytx=DGW1=;F7JhxpvXM`kI0gINlWQZ=uhOb>hLY?nUfA=X4h
zFHd}F@s(p6$*JsA=Tm7-=h?knR9S7Rke)VjK9(AdeJW(}3H+UB6T#FkCY8GAw%<ix
zmTeNi_5MS2?FrAMX7*qQAd~pAsUQ>3fb%C8$00#@j7J)ie;2L1nC3a!;K@fHpEeRp
z(M1UWj9Q<v_89Kukg>*PGH>dx(!YaD={&vfL2OVuFc!!VFa*7b{A$FM`SpKsEFzu@
z4e>AWVEhy<76VUY0ybU?4m{5$G}GHVTN;XIUh0<#Z#q1u1-*^q#t4;oM{39z#?!QB
z;7gFnwD8xt9n3jhv6Dfd)XJ9dUf)k7Watym<5IWsyBlIEm!F1d(}|y+-C9V1p7Kb@
z<|<N^xx8Al*|urAiG`w0$_l>&LEZ{mL?wfDz#iR|u*2Dt0Wa;6?$8dK@PzivvBNJs
zYoSI{;4?@3LSmkBExJ6Oztg0Xi4$juFE5g<_%!6)(f4vKw<U<Krg1~}ONV~mgajn^
zsF;y(;ph;5vIo$i{wo4)rQM-~v9)xZ*hmNe{R0vUl=Q5p+esyM@|i4p*)%dPowCYC
z95s=GdiVauvoVFBJQz{dd0V!-5d45&MGH&gqnn2CX^)iB%!cGDEiu6Bd>adVzxBV&
z?8d$PLotWDrHG1-YxhECFy$tvrKClzVc7A`9@jj!1b30pLRq3Yrf8#vooDqW9u2Kb
z%VXbx3$DLC!wTBht+laQtlBUZh~yydQs=`QLc|VS$8^qmp?otB{TSb9K*pqH@r1(4
zJ@8-%{fR@QmuzUsa6N~adbbmG=eQg~eXeSZc@)_*mXPI3+SC_KhW?Ui;Mh59dD3sP
zOyyo6^0wxqZ0jY}K5D9*+~c{ha)t=H+wm}wtYQIH3kdN{?xOEXUGb2&Db0R<S*6v$
zw?_ZuNO8kpGsnP5hP7Fgk||H$*P8-V&&qACD@|hJ554VY;H4w2r9n)CqJ)qbU?=61
z;7mz3sQCcG+>b4$1Ajf`$(|Jo=WY~p`4Y%SEJM15UlLts4fzO1*}MY8`SNOvAs+eq
zw6ZC~y=6CmCHez)_4tFK`DRKRJ*{0^E)bpiRRM*g+g}BM4sOA%fjK4jo2=V&0E_|z
z3ko<azUiEtKp#)#wa&VqOzv=_2K{NLi5&%)$!~6OAW@AOA@!TqPtn*3L>@nk9=hV7
zzZ8VI-A4V(dUrdiEh97OduZTNlpQhES>HtcriDFVzG>Tvl@szd7e$@N@MXJ>QC%my
zTZ|5Sl1iKHWW{&qw}SDXmDFe>cG68KTv*p$9K-km0t@Z)G#F6!)oJFn=WImIG<p>`
zW{0{IKB2W~nRtD@cowAjoIh^^2q;M~j&GY`4ILhLpAOy8tSp6=J5B<B<(k&0KV}Z=
zn6t{e%pIp=buD!T4_q>6Gsypp-Ox3j=VHAogGJvDRV#+aFuACQfPa?18{|})Fkzb^
zPWm7LTjOXM;F0B}3N_D72vgCyQev>Mp(K@h6<=ru^{a4RN5*E9EK8Sut;H%NAi7iO
z!FZ}Fr%?L6mhvV4Ce`HzKL&PH;&aB}B3jiQbfQenuAC8>)Sggzyj`o-I`}&xbSm+n
zGCZQPMe|#G)&tr7+X=_pZz1Qu%+BPEfhyee7>DP_Pt6~;rp9`Gs)ISy=uaiAj3me`
z6QUUi<OImS@_pTmD;5c2h+K~Ku&f8?ze|jJTstBMBsIKPQc)Prc5djN-PJdl(>c|d
zD&^EMbeuFj5FvjtNRO${CaMbw>+=$r0ZN6h4|9~Q=Joj<7O!dFc+&llp39M<VlV}q
z+;Mjq!)M-=p*rq9fS$?0zu1w^_k4mS#+^1`I{UMvO*YE{%7ukCE=~)`x<VEr3_7jd
zO)aQx$|~BzSHSdF87G&6NN;!ky(xsHDrZ+ZH<GGN=lbYXX?>{NwDk73!mLh61y?v`
zI3Ae2);pFOF`m%5p<^Vs8?Q}R&*C1R_(e`2^!Jrkk|6)M;=oD4T*19U=l8D~Rp!oU
z$C#zLKO#XX!y}Ozgt;Nu?(eCm*d#U)Km?`!$1Q<pC@#Oxkg-KbS9Y&2VBSu^dwX+z
z+0^N4wM!sU8T?oz5Z=F}_qs>y9Q%i|?=u6uaZ$?<D4ped=3yd@+}6)GZnvTTzS9Zw
zL#XA5o8CX!^R0U8)_wHU1X6l;#jo5}(8s%<_u<5Un8lWrd-Co+v4Z@42}%OWUhk{;
zwEK@!T9njPkENrhf{o)JtHBBqeZROQA_^m=Y$o3eC$TY*Oe$U_{ZO?uAW$L~=GyzI
zr~n&aGo+eTiig^WG(OQ2FLxWH+k^3>?G#fLGG5TfV1MaeV9RC^ocx<WcJ#fCFZG2k
zjT^X_DbI$=YTF^oJ*7I48{?`AVMVmyZeH%@zdU7>nBKUWUSK}l<>mdM6F+|D#d27}
z0*e?6dPS&Jo+$rp8QWd$mvVK&<zz5rpQuAlIh<b_6vwU3tf`+ck)BAmExpYM!Lnt>
z$^0-J>^-666OyI4Ep<rso-^}E5mVkXN+bQf{=((Bau3Q9#D!zXq2)(2+1z`C?#Ghf
z4b2EX>JcNB0|H2f@YJUdrsnAE<zp2vO^YZGE-o*iwfU!g-uiv2{Y3VC7~+I3Pd7&L
zCSLM8n1BgU`1!TgHyD+P61yj#Sv*5v8?o=hS#~EqJ|3aaEG3FItBELxy);l!hqX$5
zOCeSIM)Bqc8%rr8E6Eh0f$N?%i|G<%X#TfEyghkoJ<UGIbmob6GEdsOQm@8XN88v%
z#iCEL=jg!>HZo1HR4>u-lo5#_EyzcAT64GPBW~><U{~20p_0c5j8@9+KOcw%>LQs!
zA2q6S&D#Wu-I-y(K!0|Nc7X-!?qgDu@Jy%)#R~48swvP)nnPMp{l@w}adP<26i3#G
zHfU$vxYJ@ErpQ8Yjd>HT#3iS^UQxxf7#ChhBA^I+Dz(y#_d4xd)VZcAQFW7k+81y@
z7}e>!BGRK`r-xyCrn2ZaqgOF?*0Oh}7|-oSv3FYkltN}n<dDf2)aeBqV&1gYa`IHU
znTYY@Q{E|&w`?0rQT0s_<DBSkZaSyQ)$%VsrRs$Aadon*Q8NB0c8mNZOTTz!9y?G~
z+n9Wr>E+)DkvfoOAMNb!NDMJ>3<Sqm|8nU05}9Ki1D4u2d5_5!&vdL}<r@l<5-Ctl
zt<@+#H*OI$&R+Y3XnZ16MYgGnyQ#YKlNd81>iBON&kqW>t!*q>I*_>SpT|E=MK`ZS
z$eofv>Pk_8;PuRUQ<DIcprGd%dP~1hg1&xMYfd!orUKG&u_4S}1P<PUfNp2ZCHK==
z&5E7GM<7bm*);ZwIz}Iu+1mjI4v5HcLzV9#vi66sA>d6s7H(u)Jd_AR+6-%KNIsB~
zJ0ikt^y*^-p_v#JHX=m+Ig&U6+=YQ3*8tQ`O!&^-Cv~Ipc_hOUNR2U~Fi8MSnTiVt
zG=2n9kAA_;FTc3XH)1@R(Mz#kcUXr3WIa(A>)+V%A)pkYRx|&U-Qk`$`r9BN4goKo
z#@QP=9YYlKA$*#s#l85BAY+{++rO;viE?`bqu2C9em4k3*Sp!Pf7u4mx2@}GN<nMF
z$@g_J$4Hm=>f_4%df^yEB7q5tLzX)`)wcOro`r(^z$aXyjJoKWs{+^u{{`QL(VZ~6
zcq}+6Qw%2yl#PYR+ZXnZmX-4;-EBy#xGh+52JGzx6<u3+O*N(~p(xs}8?oOW{-JNY
ze6*2svf--VcTeIcc6`_A^-Wj1PGPQCA~4+lcpP#EH3`>NsA-!NNYd0{T5fW{ZFHPG
zSb|?tFE!RP<X>hTau0eLo4icdo_C=aUqoA*x>FpEUaPQA*fzETd<Wex-3*_6n$vl*
zf28Q{RMpqqNK?#{!)HTfLs6>+d*3K|C^%!fAd&ZTbmpR1d%nXM9ywV9ts_`)dVU}S
z(oApSxidu^_>Tth2p$pObp4`BULP!9=>)>bChJXsKBZ?{V~o!h<7q}t*GQ0y1Okcv
zxO%ibQr^hXa_F=QNC&qO+nx8xV()kwt8TKc+JF(;59B0l%pZ_u_O``aOE|0s%Dmo*
z;QOT(?F$$$v#|=T?<+U|wja#b!V|u$AWk-VKq)ArLAB2jz}b-5xx-)8oP+<_)CT_5
zL0Kp1Z(TB9%b_)kq<C2(S#<tuH<||PZMA{<FM}N|(0e05=%RCw#W7eqc8Ia3*E|QG
z9{Lb}O0qUn948OvIkev81XmXFi~|A$c!KzW!<y!-wT)x}q}gp#FYZz;Gi&WW+Gyd6
zNfX0W%WD_VK}D0?!bAtKe>D2CciKquMELl^;<Gc{D-%^5q`yA(hc*G_9R%#Uh&A<k
z>J-JQ5++Z3Scm_DPTQe@h&umLLtuxVW=M0veNrI3k;Z}Ux(n+MT<b|AqNsdts$LCl
zwpgrtaj|GRQ?&|Au<P~%B@$f~gAN|Hm?cZ?sk|ia0XvU=t7Lvu>6*g!w>#aXDzE5b
zh#gqK*JMsyu&jUlvZb+8_0D<eHMn2Sh6<1@9<j(KG$-QDpw==jsJB1I6&rAC+tP*z
zdW#LfsNDPdC8A}44XI;J<FZ5ZC6$f;KvMKeRtrN@o3){<7H$G}N2{^MM-hi-@1c9Y
zv_Y)irW{l~pL}eysS4611b_C2WcEks05JqjtJ&^8Q_e2>t%uWDhrGgvQ|w>LovKW)
z{C=q;<$9+JQlBUnl?5Tyee))s8zCuz{SjO4m7il&Dw8Fc`$k6IjVQ0&L^hM9%L4_B
zaW0Jm?pb_iEs%?$3%F38%x$N4H~JmSR@ec7cQr+(?SP{}d&HGzO_-aTn{vzjg?}G*
z_t<xlu^-HmbdTv9L6)egQUcu_CAd;1-5xr3&wA_*f!w({Cm`5V)-xNCE|QAp6=-UO
z3w@i4mu+v@E&8y-H8x*=+E(b5pf)Kl*W|E7YL#FY=DTIVCwlB=)oV3HfzgJF^Z)?n
zoUM<ExNDD5<uXildaBu&Sjr5{pIHZcE&!rF#(!*584{Ex`|{n&7YZpD<oM8<itE!D
z|ND*M*R6k(M)V1{zP~Vb9}E{>&D=M#s{45a%s|4|f_~J{nB?v2RTf$hyC@InHm|C+
zkFn4+OR7!n1?$|@Jqt<vW+0rs(`wt`n2JR`X*R=Gwlzs|tGySyRzIShRM2B9m!4f)
z%?iUF#{lV8Z_A~*9A|wv>#n&J$pja%XKT-WdbX<YN>G2)6#$)#D3$$ee{W1s;=ga(
zQ6|+4sclr>`TBb{UZ?x#llqvmv``(*RH?;PF!)Vb_!QiR>isHxVpz)^ThL5Lf~z(S
zmB%jGpc{pimGxP1Td~!TqByX$AUsS3{f6b>3=9qzE2Q<Nzp%HwIuM*`aG-<r=ievK
zr~n)vPL(5VIAy|$b!vI?g<TR`Dx4Xym2C;kR{dRn`-RLsEvJ04`4#+Sz*Z9U^tlls
ztyo~5pcgdO`kVhL=fm5!?Ap)hnU-ZosR16jIp4woCZK#rd~#DK{E*C35Th-e#f`A-
zX4I*p>p*({x6JC(zkWJeb^Fv+3_fbI8VNI6+NKV71*&l3k%sIVleb$mBSq;SmdqFG
zY9bx8ITA7xtAJs87IWrpx#~vnzU9k{FFNj-^_4AqWeyYxQKmb$V!vOZTPfYnE+sD#
zLLODls33xy3K93&2v-LH|7iJ$fKlhkOUcqUhKPM;H?e_P5aaIye3$Qk4LLD0Z}Gsg
zt1@oy66aKAxJ`!k`xmUBnqyQd<e9bHVclnhwOSTlhq|J_>k2PKF6^I%$EXW=`sLi8
z?7Cdc=ng<dwtu*6C+hZFXij#}POrtiUaM$IsrA#IgU+{z#4`)(<ZM#l+c)co4`|cw
z`Q6!v{)D=(xYq4^w3ijmaZu^bdlkj}5i%^cP0k3@U3E+JQDT#|TCHX|u7zt~jQUMZ
zp2b)Qk;TaVY<(`~$q|$Oxiqt1&>e1Uytd#rq9rJY(ZDz(tB+8X1h=xe58kQGT#NN}
zB)giVIZkm)-!8Lw%a?eOr40);@82X!#BcTe9J=c^x*Z7#?KlM_$j&2!%$si{$S7Bv
z=gAp)bP|}eOhR7QZ62$Fx;6p*(&_3%Zw~>?5E@sK3>X2{Kv$xxr_szZ55=ZHUhN*2
zt}qe!*yvYGYV~&RyW$%l=`;fvZ_T~C7AH8Ya-gqtTfU2_%ZNoK^g`(%#HT-BsGz6f
zkO_FS(lvN}eXT$q)X?a-vIy*nv^TxX5;Yq!54$lU{V4dGqs##BVbVWj;!hgC9ZaV3
z4|9KHu7ApgD2(E^P;8g-V_>B;X08Lp%Zk|K)HD4kL<=*0ah2!6e-k!Y@B+vchY3sg
zxw$6<P;k(%W|5+QOewtUo~?mTDMGQQ5CwA-zFR<hdL6TZGPp+qG!<U^1lFCG@G3cb
zp~oK&E+Fasph$icmn1=EwJdvL5qj<F;`OX-{BqP-nS1PRGY+|L8jD}Z*Xl_meDdhc
zwOZ#oc+|(|)e@K%)t41=f!sbcxP%h)=Vx9(%Ba3cn1=TDh^*rz<S+8D#Y}B^uu<0_
zf0;F>ZNV5B^i!sX|F9D)&b*>dgsVV`^y+X)7lg;~1L@eGrbM}jD8iIdCb2`|o2%{{
zJLwWq-+b$9n_a!e5&4*(cG|-iJXow7Dq&?dGW}vXUnYXXO{5(YJ?DS^eIVtOQZ|R{
zb#_111mJuqK7CgYsPI!`t5N}5UyT!!{S81c-;|<*7*n3LK8>x*7?&~Yu;b>!lmgP%
zztL!VTGQdf4fq~55L_QY^09@Te-n0)v+H}wjT8jgCfx%84@s2gbuY>%AoX<u<r~M~
z9v%#cN|)SdnUKOp&sk~pfUvwXeTq3^HMRHZ70-WUSR47;cm?@XImm=*vQMP|R^2dd
zM2aE6?u09j8f&eW3W(EAB`{C~gVicVzHDZP{PtRra^AqfEoKE?56wev7S4U*2J(wR
zl#(N_2y>Jd+qmpI0I7Hni{<Bn2!*ai%J|lTSvE6y_A+pGr`B<uw1u|R#KmNWVnuq3
zfW+dk*an<2gF*x*^%c@Q55KlFi}w%NlcUWT$JCS7wRMZ4n@=u=%99J&1B8)K2v@c+
zQU9&OCMu~Ysi}phnCa&oA*i&#36Nf#E$UGjg4JJBQ}Y+7j_#Ki0h-a$!KCNyUNJ&v
zO)XP|WLwqcyY+9b4jaIq_n1Hm&>3U{t#&z?V7e7xAS^~2RPcPdXcG^kM;Ps&uypH%
z=Vjg@Xgx50pqxJyWIyT&5cRVjr^DP5;h?4Sizz#!v1X{=V96*%I=x9&qUu^QXU5O)
z;oAv8lgWe}_6fqYR6oU}grXlop1PZ(=X_7b#B)p|U(7Ko(c%J*OhM1p51%7yV!D@4
z-mO!-+l>~H{ULhX<~n;8%*E&9L5jIAYjQ`ds>l%T*=X_Z4`zE$NcXw9Sn}+ivBwI@
z!F1weP*i8JNDt6JW1?LrPZ#8#*Ke@ZKIHbC+6$U%PQpvU*6#OtwmP-Nk70pH^ULGd
zqz$DH4)X(?Yxp}Ch9T(&kq&{crPeI2wO{di-ZN%g00tHyN^1uhDAsx9-FfBVi4X>K
zealT>4h<+yd;12c1Rd?EE~tTf4`<6^2?lT#iOf~o&c!{J?E4N#ZK(bSgo{0mF<J#o
zB)yPsSf_7F`9qIcyY~H<e3@R~alUi0HP_>49&~lp8g7ascHa^p4S+=TIQB=W)-I=?
zJnPGX9G4_!72PL-_*2~&a3VFaI3$DiJL2r-q=&#-62O-1xET*Pr+uA(0%E+Uofc*R
zr_qs~*zl0wzd4%tVs^_;Q>ob4*?*Gt50E=)So35QJ>kme#~!AjE#cjIY9V4+Ob$9V
zS!G>LpYkUs8n$C~XJLFjK*5*hc@oSNDlSs_Jy%__Ta`ypaZs7`6=^-+ny|1ig-5Ul
ziCAPkl=BpYm_Up!Z?rv1Xc%oM1kc_K=|j)<_&fj93h292Gj@}<1RyTg9+o8WYZ3dZ
zdzd$OOY~vRGlaOI3$cpy_hfS~`PL@#<<DY2zS^a5A*FU&YK)RK2=V#I<m9=VcKZ2z
zjD9^FnK23kmEqvuf)=c#jP(#rTxhp@YW^ZX6tc+!-Q%E#IHU|Oc(aGz*R3ZMzvAQ>
z7x)WcGM@N6^2t;9dJ`zF%A5PUoY`1-dCbt3nSUn>OpAhF5dh%v!RumGjlrMiwTYu2
zKMd+KRlB5+)Vr4(HS@GwIHEZmAbBrECwYHns{Gu)+-xT|A*}TRW!&^+Uki=V=ll6p
zT9luIx-tAEiTzfjumg)i!-H@xFe8)GW|z38RY;U`$3z&aB&B?dHrI<F>wW?90o&N_
zOv3fo-jTfD#{H*3r<NH}9x+Ah3!8x9u3=z9<1=^nf#3g~aoxTdxW`X;H&O*@D#eK&
zvH@4>?z<F72Gg>7N?oLRXt)EAXU^2CZsPgISsC4WNUQ$hT6|Dy*b~JT04G=gtP^|b
zk8;T44d?hTBSaE$@87odL;0afb?*U*NA{B(Av4EF7{(=}4G4TU77Plc*urhz;yqW<
zcoM<UWH_!kvW{B9HLms1SRk{b_W6HEY7{({_vm`_b=)V(Grr{a143<jJ8CK_xnGB4
zXha3_wE4^bc-Z+AC;$5T8`gW^>-^~_yPFzXG>aH~X3}k&D~JB>aP8r6v7W+o{m~~N
zwgzBXv|Dw++o(QXVfjmNa(L2uWj-OBPVH<G>OoocPYXWj`_@S%)bSmaaMLF;fD|1@
zw8NB-itd_dKE`AH6g4-vsJPgW9L3ov1v=7m+)SEDg3GWJ!AN7>9Iz4Nh7yhuKpQ}4
z6nV<b%$z?l3aC}&xCoJK@wHXf_VGDtMAX`KROegy04N<xq`%8%qH@1HHy&MoSblzf
z#dz`7E1h!sbG?037O<OnX0ouV<mpSBfBF)5G_#(?<o6a1*+gXNz+4C(6B9EKcbUXt
z_-$^<wxxURAD!<;k>V~2({T$o3R<LBn&+hrWeX5o|DVI>j1RvsqPv6YWPhr+4gxsf
zmIqO6IslL1m;w9eKfRCfVis3@x{t}pdaLC~cO*BZp;5ShY8<h**vW7R^b9Z}Pt^`a
zQh7a5e$diWQBm1#93G3V-HavTcl-Nl`6@EVS3JMhRlVk<k;mq8eMe<?FY8B~_0Ig3
zx_IqhUty0bwI1L-WqC4tGZw*9W(9aAc>X+epKcCpD)S$S;oiSoKz`aJ^594t9_O`+
zKPY;AbG@Iiw^7soZO>eA`8fghEe42@%%K4Py=ml0yg&h0s8|RVeRsC`@{|aWVSs1d
zdyI5IXM2jV;^D!%u}ccicn9>m3ql2h5#S%faG+fyHi!>bz!mSRf-hFVv)%V3u9jW>
zN11uvU{{xqb0W?DFA1bVeBRRZ?C$R3^@Dumj{`hjw-IdQDnltZ>5`R;kN^FzWU<gc
zZz>Uy<!~%-fMF()QBi$r<rjb;H<tHXvLOVxj^CLr|L6Y#_E--pk({Nov|x&VPCek!
z6yMA@8xmw)wlRgu!pVC8(0AV3U2d5G?loZv30i!-YkW>9@H{GX-3Ijc3(gRpONu=P
zj!TUkv;e%2;W;Y(F(U8v3gSHbVJhCo0G&}LfJ7v$ZRFPzMn)k(Cwz~0^DX!HR;t3y
z#fd4f%l(VQrTO@|Qu+&Zf(5A4AMt=24SjhFEaN)4wb_-*f4=M<f>&Ybo~uaCIJDk{
z9FrqB;J*(6PgEuHnxd08IvbZ|D?KB^c~r(5_5ve?pN~!K+wQIN(K7-ma*ALv2#-ux
z&$mciWKkSR4>PX3K@8COw}m`G+2VLLzS!b!cX<f#wX&x}5MDr1X{Y;|?-dO}whv^k
zTz^X7n!yWYJyCgG`x^^-Fh$Q&ED$hrV%luDBaGf3{vTz#^*8ljcKtIOci2Jp%l@RZ
z2;tl=)l88Y9CX+<TEKQ^cK|Z%GZ_nsq5)nj(s%3p=9RC)4sYDUQTthg2~(6yxc~VT
z^??3sKKu<)U4kq$^c<#RT<ReCtPo({U#45d^p}uUe*PjnBEB0tcVuw=9#YYmiRzl~
zh_S`)K6&Hcy%Eyvzk`qm0xg%kE*GpV6u9zG-l?cGqy-~x0k+ixhcChLLB?7VBgK}(
z@~;}2F<eebAh=lr4?(iULvV&#x23x3|IUwhU{4SjOdvmLMs9a+b4OPTZBz4Yw6;W$
z{~tuCwD+=U?@82}INty)h|3viA)15U!;(7z4?5@<;7G4qa_SWK2EwN6P6E?8bp5V-
z=)M@oSh?8}-1iHxkJGY{S#RW)$MyML;u_rnW_5#ExD*B6V<cK-aZ^utxi?6S8B_TG
z9x{=N?Dg1Ob;q7JO6UVHBpD`sc9%uC!{gc(1vD{<^Fzr$ev6gE;VozeN@)*U%IPS-
z3@h|A#B5h+NatX1o5dsj?;<EWi1bjzEwU+xA5adZ69U036Ph*$Vh$FCZNh<dxa&M9
zN7qIFxZB5}jO*U{#tjqg-=c<PZ%d!3kVWU_7j#Q22oxCxJX#Xn1yAhi?MFCgO&u2%
z3sHirdUh<*cQ=4PpIUanS+x^CU=VUKXA0Sm|AiBE928sScM9Y<bIxx1L<LM<(&vXG
zE#?oixQzKBJ7c29kvCS}ySZUJz*hsWF^`<%{8Zeu?4ta)I73&;dE9dQGp87gt7fh@
zV*Eoe;eS_bhIye4wke*+4rTY;<hgOqP<P-B;m!*~0nU*Npm0vD;-LDt3+$A^B4D6P
zxl$`f7+pub?wb}h4%ByXrv#l0Q~-|Y+ZuOT5aI#Irjo3{MY#W+uc`9iQ#KXJ@`60K
zmD+$an|Av7E{AE*YCIa}IFam^GmjQnYj(B1&kP9yBw*h=S;bPl5zd&8{{6a2#!)g+
z8!%_^8n-LZU->LM!+e2mRRx#&fTW{xkOvXki2T+tcBJ(`;nl(6$k^@yiyJu7e+|V$
zBd26Ru)upFobLVAVNLVuVMwxQon2)!Q#t`TA~p#e2T6D85KcO-mh#RqmI8pLUjHD8
zhP^rtog_XVnhbVn292Ytq&V#cI8ND6CjIL@Nur7%>DJ}rf6*<g7T@>C6|k%F`6aE0
z=7wI^A770aR@0&9e4wqTsRd;2G}hlIYtInoN0I~dPd4fB0$(soOUQ9Op`@cj^t533
z1M|hV$C885-+5xmHm+-PBtLP!SOpUKme2|1<bb2|+uf<e8wmj9FmLeIi-zo#C;&wK
z-+mVks`%>8Js+KPi@f5YJ1x6>0OC=Mvox!BpmlmyoB1#X3<#Mk{^)rZI)Nn;wrbIn
zD$P}*zRQ_z&E$J|xRlJH%Qg1r0ct1-92RQ!1U4c)9~J71@PFSvlG8;dA1|HQGDtt1
z3M6!6aPdf)WSsH2Pth^$d)2y-tJCt~GgPaC(f_;OP<%`aJ+Y!*dzDtu=VLK7Zs{7*
ztSIvYfZmWYbYX;I22=cL?WX?DMK@hbE2qiH6kV6V((Rv%@r~i+B)HFS>-orv%|mD3
zy`-EAU=H^3E<Ohe6Mz7^cFTbmV0q0eTY%z<eH+RWGe~OQ2LJ@vkAYTJs5m7(Hzzu~
zQopRmju86)MwjpP4tylGKk&Z7JT|Y+-b5pA%0PS6{O2n4tM3jTbK55l!Q=t=4KT1v
zwh;a)OEGh?{Ujp1R+iY4XCpLGwEF!&6$Z6+a~FB@_gtSUG0*TKi|Y^^bOCYkm51oL
zI6xQBOK2t^O>J{LF!e1mfEb3&#Wxr+6N?O8w&FuT+7O3LYmTz(4P0H)a@{_Pc&TBz
zV?e)hQxcD-CRZy>n)#&Q2j^C?)$>Ph^ez3z8MlHFY<LkTi-~pPDQDOSEBv!aYv4w~
zqGS0_xg;d}tqoEAEWqFSVh9n8LIku#d&i^idWPL-O==Bc)WM>r)*D@}kHYOhrjuao
zyH>xtjq>tZ(G|pOQwM+6*|IC74>851=ZX12lGbSQVBvu6kT}v|p4hSM=)p3h=VIp%
zf9Tl(SiZANEb)rT#MH|eYY(){Yc+Pov|Z?W?E~z?7A?WtY_CMqIYB<PH%)ue`y}Am
z$5;8@N(Vo+ym#F=RSr57(}@MLGow|8ohs+s;#9RM=6&2nURPK&w4a+yABhf?sK{Go
z&id=$HmU^e7uj}-#~j3xuFYiqTy$T208job^GNK3#nZ~~O1AlH>|6>(RBFf-KfD|b
z+t>Cri&y_1grO9~geg!??f9prn2J~?N7eavO8$w&?th0}s<X@AI_EY&C0s;qo=z`3
z_Om{?5Pc(^G2M$EJDL_r%Vm$Wi;t|fdxIpW&<20)k?#nsU=Ql=kB_C&#a$tQZNMBQ
zq2@YyE%iX2x%%U1+Tw|+|CNXTl{=Legc6~Uq$f3UuQ1MR2@qwN+Vn(UNi&f=90Y=r
zy0HhhCn(65(ScZM;EDApiSF>rN&ULT3m+j(x;B@Jwvy<S7tE1<Olj<S8*%zaD&=*g
zyE=RRJEq`K5?!OX6+o4EXrcbjmHMu#^WpZ=k9e_dzVJ?12W%fnCnTrjHMZd?6*tNc
zI-NXjAq4?V_o+uF?$?=iaZH?`drph|pLd&C9d|3ojmKYITUqJGHY5gHAD~k^-}xG1
z#LgrQiK?V<HLwcaru~Jk3Wp+uL%mspT-_Wb+{HUwSCOo_F)e*@XKKWO3D>u3P<1SA
zXPlgEL0+vE{EIDt`}WTkU5dn+_Qe;V{#Z1%*KBHIP=7;$zswGk+MvY5QW*YnMC6+m
z>5D<%c)`g6+R1~V-Dta$Os~AQ!R$o*$tk#V<fK;nsj-|gbw1pussCevtZ<3rlp8V5
zs};zpfMiSbEyjxSg5M=8KCIGWFbp=iXEMAWc4nDV(o%m_>auOXQ?Iy$F;@dmUaT4o
z+RrQZ)6Q;OwHIyRQ8l^F<`Y%}HNq!yrrfNKWXRV~$|({E(f+e?qIucPq)e>?&^-}*
z+SsPbQyxJf<UPD<seQWNbvl4?h|da;l7s+e8Jig|X;pdw{NN&OKvKHA{QznkV)qUJ
z!7N7jrz$_LolHwhvlYMH&95@4`OqhMnDAty(+}$52X#7>==LXxL(BVHVcIESjmo`t
zI@kc%j##RKw>Q0zha;3Bd6(hZ#B)3R?qcuXmo+&h@%2QynkVW<CNn-3P2FJB>;Ft=
zF}KOWk^_{x&3qiL9gNle9I=D0M>h(+l&}5S?KgoMuEWR01s1)$$NKAIpY}d4M2y!C
z0nke1Rs&()$L&q+F&6U!woJnvzIRGjWMx^f0a|bS*#|18Hg1394Ov>kjoQ($ISCe<
zrPfklzTtTkv?;t+luldbvjT!<f@r9FYHV&|5w(1SukNPozT}a)=N#BdT1mCD;9t7p
zakfaWzW$Z8-uC>R>9UZ?g+}k7BUF1%y;+N?1rx|bjn>d#xEuGaLm*RA>FJb|L4Ulo
z4@-Xn0xxfHZ=+&m>75tA@Bm~G7RSxdtV@KgxBaD1r3PT2mo=cZD)Dik{2|yZq(l2F
zX*mKHHdHemCZ5e>EeTzA9(c9#b3c633BaLzxfL;SF9f`?pT)Kd*6Op*?QfNsIs6-%
z5^CWB#{w}nD?e9uJr{%CURd1WCMG9xE~+nLv8WiXmEz%yy;3G);k{hCw47?HHNO)Y
zs=F)`$HV1pJ3%u+v1{VmNan<l22JeVhH%$z3ZcJIFX8{O=I022KF5+70Y<2a_4Y{{
z&2$TZwfg*N5dy?LGMTb?dX%+30R9c{2ins?#+Z9)Pv|02lYPIx*kEU>J)-Tn*akYg
z{Xl#60~tB93hYE|JHn~QmbiEFDd?jRNLXVNAONPdT?&2(KlJ<X;RD~j|5KOWAE6IG
z3-NASq#0KvAcnzpakgBaw?7mw)WMD+EFEc-w2I@n?~Jyik1^uBR}<?_9L$GpyX@kz
z{jdBk_*}6Njm19ftx;a`efGBR^l(joZ<C?Ri@@ZCUfi4c3_hQC>Wc%AoPf&na>ka&
z0|f_*p9N0<wu*<2*H$sRaa-{^cMmOrKz%%ZR3CiB=WMhtdZyXEtj5hx-!sz@Ts*|T
zV~E9yBlwc6$*0!20_kVwF(QN-19P!MSKuAVt&Nq>I;Wg7_AtK701&thJ;d4}?Rh5G
znIeG0^fK4Y9quSYU25didf2FcH@t6>n`tjGRqb*c)dpJv%HsJ4m5rQVSfJFs=`Z^-
z5&9>p@s0SfJYU-b*saCcqkG83R-6*F^B+&0V%Vis%$zv#RX#k|j)rw4%!)%x+pbl%
z--!tL9v=5cXyF`|v&Yyh+6uPl;#$4!_{F&dDKQ%E9@BRl1L#YMGd1n9dfaW-C*B55
zV6rP_hzt(AXf3hma;Z8f2(K*kpxX)6#EbO9HWy2<6b%l;`hS=7a3+(97)585K?9p1
z%gO8a@*P51Vw-4@fI_2JSQUhVb44qQzk&Kq81g~&Ip>Zn<I&!-zU@|B`>q*E@IW^C
z4lYD=u&>z_YG5CX`0&s<c1Iv~f6}w|qm4M*L7MFWGFN3<B~~9Owgb#Xd5tVwTz=fd
zWt5;Z5WJ!P-0X@;`)~2Q%Tj(|g+WZR*@k`c0S^!S7*(fy)+U?CByH1!>UeIC28TlH
zW6oC>{f%T=uif18<XC}l+wM8N?Jq<<*c5sRH0hLhtPTl(aU^@?D0#AW3%H;@N1f$9
z_I|@Mxcr4SG`l7(Z>=VyPTw(Gj+meE&e;vd_EV0r98P~OHk|(Gpio<XWHp~F5KHM*
zq8d#jI=d?G%laZ=WnR8TN!dZZpUqV|RME;t?4%2QVo>R(pQ{wCpcE=><-n3iK`~r#
zSD|4HNPdE=)09Qda?>x1FXO;8H$75ENKf@~etE@2M)&z>GEWb0I>C%#{6mu=<A~p+
z8;>6Y3D!8||91X&8N#kbaZeFIIAdK%@Oe7>Gx|<kX9rx@B(Gy}ptF+k7w`DV#5%)>
zyNQ{-SyTYEHLLVe(o@1SIKb}Z2zmIhO4n?5#CXmC^jWg}Zuk6&wyptB3Z7Sh(+Utj
z96v}Q@>Q!?HO}O95d9u*_(9WllpWB4YD9DbU53r8SZ3Jl<Oiu%g@ynBUc)tedq{?6
zf_c5wrw5?Y@s;71h=CY72*CKEijmc58Yg-@{FHU0EMWjh4r{2Tg>dpDb$OyOMitFT
z*{r^w_=h0oCviD%L1xc#E(+>K1znY}(Xk#uE%40R6BBYpKK-$=<c|G1=+j24ztyk}
zfZgnmd$d#pO<cgSHOj>;YWT@qd91RuaRIm8T#PD27SxlydKi}V+;ly74QnlY`-|DI
zHQfBfBK!Gj1}e*GiL_Y)hhW#;GL``o@@f7<)6m~#YFg@)e5sMvnw{UnvTmeqRT8ks
zQTR2!{C6dcX<DgAUZ?8XyF>vx^GBy!H-H0TjOQ=I3;k1)7^YKi&ovtx33Q7fuFj`q
zZ<tIpsjY_?7@NesFSpEBB?Yd5D|mnAmnSbrzTRiM+raOkl8B@q_=X)HM=1|bSxlQ8
zjrq`UT7nwG=-V6t9o45D00qpwd<VR0TvE0qAk8;{jegHPa@{cT{#_C!>PE%~s3pOq
zI=A-0D7c&x9L=YAK|WU~^<D2NT-g(JAA=TRlgaQnPcWyarE(2Ju6;;$arGsXENTwS
zI?loQvE2&hM!6O2_OnJdnpZ|@=Cj01xSx{iC-^v37EAZ*$U-%dL@EKg&>_*04-+cz
zLG`#xDLsirCC=e`HUgf!{luCT`tcX`D0~-Vyr$T^Is?x`{&xxgieYih)X#@Y0bIgg
z;E@CVM3Dn-kf+-B_%w3bbyiOR-+Kt4>;y$VuXmLbaS4>*iXRL0MF0KtH_sH$5j$i6
zfrIF~I`%#Gt}4Yv@QaJX?+;9_TB^v-&}J2w0Z%o|@*azkzUvw~7{_=jTKfw)gUD^@
z2QBc3LgioM{Rm`loRX2;Flo+^{y&!@`L|)*SQE_dh^}%A^=gY;HEOfSfC3{9%nQo6
zyTP`B!Rp+x9BJUT5K=kt20K&=2i+ZhF*lc0);RIvMN;%3ab6h^BtBfs9;~KytBvLQ
z7L)(18A?nMxWOOR@<TW0CdcKFSYl{aJe0=s(wvTAbACQqbvEv`yS7z=^vy|nB`2qZ
ztMp+L7|7nS7Vk^gR=)Gnx9(9jzN@zSeoEl3Dt<nBBG1zv3m?vz=uJsh{8bcxdsbL#
z{ktes`M>2~-SnpxdZ*lW1hyDR;FJ_h-jSRorj{*11AUQNoUnmP8=!YCBra|&Y-+PZ
z46|?K4%%dYWWdokg+uu90KjxRaO&M%9XkzUy1>#qZ_*JS#(}_U9k^37)WPWyr9f-}
zR`Nb<0-El~OC-nC4|7FEG!yyys(~2M>@c>3g8uJbdctGmi5edC_c`t7P&?HJ0#0;_
zN|%~(W>PMUKD+xUY2Qn5&KlO9_)g0~WkhzcDH|`f)Z^$pG5mo9+NFvx9J^TATjX86
zO^(QkLo?KaXa8wSCouG@<8x?hcZ2Z-G2r0%N6LVYG{U`&tzYw1phs%4!(lji)o+8H
z4@joPw<EuXh@p&<CBA~I=&x9;TO2$9t+VjlT5M>@27#fz#Cw9^K&1_lzfco5-y@q!
z_d-6F_}WX=R?N!cwj>&60-1KMasxKEeX0`9MXc@cNM%fKd|!$=dN_~lo1sOY+hplL
z?H(1Tbq#9vez5r`N|}H*&NtYo|8@y1^?K)e$^E!xt_{*CsrVmDE)$ay5Tdb<X!SQM
ziZudB5W=E9*Pm&3cs4)CdAAu~e-exO<Tve{gm+H#wxo4=?25=Qg3BntCm00Ltuktc
z5gbh3Ax#yWRv({oxp)A>t6yD0gQjJAmef@>Hd94ku(?P{uvP-QPq)bc%>#RW>yl&Z
zA)1p+G_S({8s3U!GbY3VBofXb!(SU)%*$Iqbi_yCgndW7CC$1h;&<=4R8d^VH9sy-
zE~QtH&_6C~!g<bGDD*k9n`r?~U)W5%z@xhU>-~nxqDsPF0sEBEI+gf?&uYtbRBNYy
ze*4jc<zjM{W>zX@xrtLzf|JxJpW_IQuZ$NwNx<4xyaLz`&?0v(I!!gff{5R5yddry
z32EeAC3t@U;o{Vbc2)P7VpgUDH-crdxdHY5(C4qt&KW^nW)W^e(PtNu{q_O5gnPp&
zy*tLVzWe*(XG3J`FCzqoFMg3;6<DAIy@b7m7l3v=qZy+_60&b7Qxu=1QR41POh=PM
zs~onIIV=`Q!_5NnFMqqU8t#Vz5#80WqP9|B7M00rlWa@!K?$(Q+F|iz<-TcvtBunc
z_qR<y&m)1;%Eoa%{QQ|0?7EybUg8AkJOA1G*#*hb1-bv2mJ@d5?d5$n2}6A)7FUl?
zWH}-`&#=RD(*d;S8_iKy)hyj|Zqz{v9vOvFCckcrGc7QBJ-YovgyS1C2p@1EVx5<E
zotOU8g=B81rns)3AP4@D{y^y)AEHA0D^CM*dvUM?MUHzgXk_oB9e;QG;PiX$G9+}4
zMEU>Qz<D6%?BxKV-Chq!jv3y5A`h<mM*?e3*x`c2M*xV3MlXANdzEX4l_HgNfndle
z&|+MAhIwPL@zPuD-XBChxE3cW4h1eU-#OKhyr_o}UdR@*nMRwi08$S${cO(-dfJrJ
zH6|<G?|LoCGQD|xPf(C=adQZiD&Oyf!_I?TT71R*)&O+jJ&hpvFQf0+OaEJZ1^Ldn
zCs53{pm)jeOV3GY%3l(XVQ0o{l?m}pwj{R&Hx=ou1q1-wt}_-`mfd*P!s!mwN(A-)
zkE!<#r22jT$B!8ydv8VJWUs7)6kb9l9D9Yz-rJFt5t5yZNMw%+nb}*Cy?5qutYe<@
zyHBsz`}6(%p}%yT`}w@@>wa9<^>{okWaj0^Ny1Uq^|w;KR?Ap4C<a&WPMU>U??^t0
zm!kZ}aht8Lv2f>O^Q4EvrI*0LC(j|2P1o~!R41$5Xr3eD8^<sI>hX2&-R#)ICuVP>
zv<n?4?32Hel?nSU$c?X?U}{!-y_3^RY1y+=crykFJO>s15i^Nez?Hz?^i1j9F-Asb
zL-W(={3pl01_y*d;zyh5o9hp+Jf8&a7>;uo?eoe&)(x`!o0E_3=*>#2XX!<-4S5UN
zzd4R#yE*yLY{GeD%=7blkeGr(?6C7r1iCp$DSdP`Ho0-;)w0YbkvCTBEHTJQc`{8{
z4LFlG4E8=hd%xSYCZmmbE~ag})g{AxH<-`Y9~e~cpYG$*tRDc}36ml9|D`sH8q`^~
zMQCM6J9l2S+yNvd-u~wiNMIE5G$SpIX<$&!<IOlHU`Ipmq%8|i9jOnm8Hmi6*J1Xs
z9o@uYG-pxkn@@L~vB%B`;r9o{%9KCnTCvuDh~G5s1!_(RnKlPquI=?imr`^u0vb*p
zTSOg`{)x+MayPdxw|TfwNP}&hc;N{_>))=2WxkE#^n4rH5B_4j2{T~ioACMb=Vx4W
z#0S^G4H7@!7K~T{K7}TtckY~afjKpkx6?=5_nvZ7D)^}VFpg|6PhyX`Le9!jBH)oI
z|8c?f`q3IUrQlV|rwAQ|puLP%#0FDldB7fQzHdKPnnIp>bk>-De?P>I_7|7%aZt}I
zd4xx=_pGF!-W9#mM-v~k-&`|$s7@9y_59AXe3Gy2u&8Hqs%g!3O_4`!Dj#~{<1VUY
zKSH{J+pNp4-155ld%H&3&lf0`!*}Biw)*En^}?*$<+^gEtr1b19=BVzVp@Z!$Dp@I
zs$6v0biZX+C8e^GjSC;FjX27FE9>1&sH)o6T}%F~JEb-CYO~8sI=_Td*GxBk;hhxJ
z*wFVOb}S~vQAg{X(N{|oJ^f|XHTuiD<GW;dW#|l_!*lH9IpZJMvV$hpEIfX*2f<tx
zJQWsjLVBsFyVGw&MguOFj_&QfnB#lPs)>0l@R-HetvaP~zcXdUYx24MWYYef=P%BS
zw`b<2e2pic(@ei**KpnBYto2b<<t5{v#G)~>UmVk!;d1CAzbP&KSqipF^=1IUqs)#
z53*6Ex(8#OOMj5B^#gxOJ7jv`DRTYC&bpB?B%}ysZF^ue<iwx?4X^tCc2{0M^vEx@
zR629dVYAXOJN>0+JSYv{*y#pEBO31ZvjyU<#Psy^PhBX?io*A?h1{BGB3qNh;m+@L
zO<-={+{Fm&a>P76JKNj^JN1~Ai3#3vMlyz&@qAG>R3#-PrQbGn`Xls;cuAZ~&{HDy
zO@hh<rQd6_h}l5&ECw;1O^C{HtZ$0S_Fmm<i^X?GzPFndh54=ZGjm>Zbnbn9K5v4w
z*+n?N?N6?ICx~ShYT*yH>;aqxqc)-m5d5ls{7^=eY*C`@`8;XNlkX0fsY7mrQK>}6
z<vK+4X-UtnI36h;{nj-t%ac)XTTvhH?v7-H)Lli4A0B!LL8d_ariP3l8I$51xMfTO
zA+79f$InsY@VznlhYO?3Z|RgBoyIEcj^qt{MnO!UQFpB+ta(dGXN*7=k9p=9gWC9q
zwAyQ(sw9;`>X6?};HM7v_xbZS{n=e9cruP4cvLDmwm%08m&8gq%HmhnfM@a?S@4Xs
z^^g34kb37ZSR@4l6$HoESOh<2hs$R&_IwbPi_r7(iTy}I607S<2pAXU$1MAK949Pm
za9|++@Cb0d;yhD}?LH1Eo^NA4R#&3$FV^k5cL|!IqR*FI!xr#gllc~#H#Rn!5w>HK
zU}Kdel&E;QrnODabW)TH-dbyk;hiU^v^%}~&5u<`xWlNnlnUYN$@aFywY}1xd~^+%
z(dWm=`E0DBg2DjA7{{n-*V|6axkx23BB@;B^2)8wP4J|P`|&o8D%W!`8#ez0P5>0%
zT4Q9g_<$xob|_=3Y`|<m_4mVb6F*?g?p=fy+BUYsaK7{ZbeR?@C3``*R4sPS1OhpE
zFEh)W6Ql5hU?H4gR~$yxqxkV3cvxuisJ@~lbo52Qcvu;fF4|Z$u^_4KL7Y2dce*m7
z5EYne=lLd+3tVsDRBXA|BuK-UNf=^6mnGxcT7L#c)b68{Anor^#C(!snBdiH)yQk$
zL&5eS8CHg`X5xL@Lofs&`2bGRpu)?)e*HSe+xB!=9o(=6b2&Ln!eLa!_e2b~XM-0N
zNsD2%Hhw@ga^c?{#HjM66O=dv*lXs>zEW|4!k4r{+*x=2cdGvuoT=Py9`04xc3tI#
z)MBuoV#-{KJrRj!PT1luqk@i@v~=n)Uu0=P9fknrJACABOF~I}<w_$F7a_?Qr$9S#
ztKEyUKH!}D=@8_EW`}DjWuW|WG9PNcf4JW#j5Qd*&qz-{y<xwFji0-{hTpG4^J%-1
z5^a8=ekadF_dYf2&U`bcy=o-F1uue#Ybjln`HnH$(>F}&Uv5|ZcRYCdU3vy)e;IwU
z4A!G)hm|RBUzrgl?M1>NR(tFw9a+p${hJ!agWJ?9&}^Lf_9@Of+ZnNK&3UjDdzIat
zQt>2bz6lskzXcu1&iWI}SbGsDR{i37`+m;#rf5i{VOy%zTLdrHH9cElYrMkfd)L7>
z1KUA1xhQdOY$UqiQAhao%Y;;`9$GS`LyeS=n&0h)IObEIC$dnKe6YZaw134LYsyMG
z{F!jve6AJ7<zWrGyohuL+Y)(jC$|=Ks<ArW-spH~vXP^{Ssg5lN3I>_YIye|Q8f#X
zYJTw!mlyYLSz_JRS%fT){FrS5|L#a4lg<}$aLmD1$;~5)HJKh1oFi|z$=mA>h3w2V
z%Ki9QP`q;f?)2iKf$mJD1TPY~Te}<w1aBOu*0e@{G#_gwt_1B1NR^kZfz?^*>8R;N
z1>P_?v7XkBfot<uh9|LI|8E<Zeira)ri+mk>@ljvi-AH;v95Sha&mpPpbM7?48PAV
z;hZn)>h8c$)LXE~8#LTfGH@(2E9+hI6>I^NoRaeToAXoK_3s$0&KxKO(!S=D2f0%d
zmeboGOteKcXDbG>ENWA1!F<R>r2Td;6XWT*TIBo=`5n(*_jE=k@P|ewE`S8kt@-8@
zM;(L~JbqQR%0Ih)u3o{UFN1q!VhP5dX`_Z?>N7ul;C99%!J|s{lVva58|jW4qE{)o
zmSMOT!dqpL3n!_>f3oq^?q^PK$?R7U)Wj)@YpLMQ-dFw}aFr5bJ=2qKF_GC#_o2R0
z)q8D7s9s4B!v|e=08;Za-@+komuYhYRQQDBLs4Jdg;gx@Z?qD`6d2;arBZev?4F0h
zzqih&Y^|g5xq5$ecdL)%#$lT+_8RNr{VY&C0>*QnZgbRBQ{z3-_w(}$@O51#oCJhw
zu@dZrD6aAp@#>X$Cw>2=0e`4juwBTFhm*8BanOHXv~`r0BacLmN}TNcv6hyWFPV}J
zy&Lh&-!OpT!h9BUuVtShX8QeTtTjCN-vhiua)d78!K{)z*N-V$x+q%u#Is>#w??C>
zSj*i?^yp7>|G9|i*`({OC6cWxUo~QBxFWSXXC~?zGT((`uW<Nq*;q~|i<;|$#`jy!
zvk#np2Gx5N829s?8lCp@{!2#MkkF&-m|pU8c$&IHN-z}%b;sP?+-uP*v<u<;f@t&H
zodk$FE-tg*d&c(E@{^|7^Dg{1u8XZii2j8IE^#|Iy(X4U-0NI_^wqs_7P|2yv&SLx
z?Z0osfeu7u^Nm`s;<oGei<aVEOZ}6qan**7kJr|A=e^CdXWhn9c399pH(bVd&_H}T
zlkT|B#W0+9lx?BGwgtneLG2M>pwawv^iekc+~qi6lO$$kWd+QGC%(t@rXCw@8vF?3
zf(}38>|~vJYdk0R;V}*AQP?xJ75oQ(zxAv1?~UtO{@+8+=FXP_!F<BUB@hskV64o{
z8q0WhGxUN#>#+RMyYwRiYqYvt$T00t(H@OE`}(oIzP^eKZ?}3D7k$BU+TA|$xD~+4
zGfR9};QI~?h%?>|Z-=i4S4+zu*~_g%M1+BXfg8Y(!M;{;2@CF){4(bev};^^{5ZHT
z<HG5LiNz`(@~B>+<=Z-Q?3)JqJ%~`v<1lGBB{(S0{=s70O0a1aREv~po~7U@A~Axb
z_#Ct&i}zY)5a~ypOF!P7a9@1rcMrIMPm}BT2>JGJ5TkZpe05c(lt^GsB4U|9gfbdw
zW)h4S6xinQPH5l@BlzO7p+)oCMPpuL?~26V71yf$yRmX<MPB-g7q->pk#M}!PWI9J
z>P8oupJ0K<FBx;Ay1H5efoQIQNJvU{e7xU`aB%34p?$#Aexuuh+;mJ$^=2Y^@k+7m
z8vZtq<+S<bsQIOj;22`?{hh@6ftWKIw@MvnXJ;DIX=98i^&3OHsb&PMRSt=XA?;#_
z&{Efaf>FJ~h4<#~0^)LNbp{BS_*4eiZi?LHy7gQF)a#}MFQx|?DsaEh`}x;r?REKT
zkLiS>lqe=bco`YqzX5zIsz@kc`s=kJCD_r4Etf};RjEYh=;;VhY(E8b=)=o2K6Mf5
z*1bKK4d27S`$CBq5m3A+?Hh+%>%i7&Uiw|7AI>Z65b$vTq4%^2dESJWh00fBtXJ_C
z<H?#C&{%Q4;G^stwKLWV;^K*9;GS<g2Cb$lkn65mlf!w%wqRUn|6JWS|DKUdbq15*
zQ)c`pfW6<Pn{*1gm3x?%cWl8v=X|i*P+ksh#urSuoyLx@?^+aTH8t$0^dR{q#inFm
zx-#_dHdB>TzHE&4)SOv$0u`|521U_{MbVk$yZ%8zim}k-1^j*!9vd($=VJ^bGgp|;
z;jr4JYZ;PO^H0#UDhbW?NbNQg1W_^UR^a*JRz|X*jN3}2IrcBfb}l)U)0yFuA@+kj
zSIONI>(waD?^P+5jxnwTg5sB#my<0mN;Jk;($zsMOj=rPQuA&1l#WPqekIW`^%vy0
z9_~ElDmGO)Du#sK8N@l`^>z%T^~KsP!aJ~lI6TL$CQ>5^77;0x|H96%-uSpJT#4Sm
zcE-7WFofZ6K*+tScW>u+!Zb4!QYlfrcb7fuSY6M+mW+%HGe@obQ;pde0xCo&G_F6u
z;Fbn1?rk+lQo1Bf6hieT&Awx_oSf`t&(PskVpmsZ=VMjpvInQ0Iyyu3@4^{Nu=1K|
zmG_`i^We?5^QK{8K17i{;O*X>+_!n{8V1fI?*pipqZ>F@hER9cnUM*<1gf3a|3&7!
zoHBNSDKj5VgZ3Y`qz@iExB*xpLH=O;59!U1PcXEnoAh7-Q!KXE3`7g!kFtw0ceXlS
z{6Cac$P?gf$Jiu_6B+xF2PW!4Ihf%rixR&+7ZlvA;dcWZTH$?W7M6W1C*a44s>muT
z?heWM?B&#?(GZe620^<$#-l%zA@HmgYsDHP=k+t3jPY>^w$`Dk#xNL;6}2~7oL#O7
zjZr{wmtd8srdQ9ItwoS{PHf!M%?LziExuDX2e4LvK9JF-614oR-YPe&@xKJ5mF230
zmo=k>6N)|{=`3wqwa)nvjb;pebk`8P(`VL2<ZMdG+NWMQMajAPrX;xc3~;HC#iiZ#
z+C9l<_CR0%Ga5p|Xc3om{9|LJfOLkCXc7efW;-~~B>3w=*LD+J@EA%yb<-#OQCDd)
zwNiei7+4(;KAMd~i}>TYN1QM-s;L=Y-{`TmF~PQ3js*-EAow!f-Rt7|UTuv#Ez+G8
zs@vCRGymN9U+C`2?HIV1YSte_s*ez(#fy!L`&8D(?Mbl`ppR#<3npe~V$!^%C2_~b
z!M3ROT8?;=E};?}!qYTBtZL-R&4pVAw`zUGBa;&r@{^IdwCrqWpZA8srO%GU4X6pp
zl(I0Gpk{=dn;1JYGiogO1Pk22wfbpDX}Q}l7v9{m;R`B#>+^3?1Ly7&hJ6*pbX^^i
z1|lSHgG$T+P(L8J4CzK(oy_<^dFsv<cBtg_;x971pWE9GYrRHZ;FXtPpSHENxxO(Y
zSy@^c5-lhAv12CGLYqtbF#g}*eU%nl;V9ISMnoGxH1beA{Z^=k>BR{T;k)#74Iq@c
z*Cy*sE@9vB_ihTbAa+bnZ_8Ye;`;PYz~|}itAFEX*dK|)W`oaN??jq(3tyBL77>kD
z;B}+5vH&70zR?4|%-npGCJ!{@iv5kKI!GRt7EdMZPZ~P*>M*J5>1chGb=wT0GQOvA
z_c9^qY$Tgw79_Jn(qxodFdWUV@raWUX1P-n%0*JCeV^HSAmk_;2$(Wh%N<_4=#A%m
zI9E{{Zh%Ly1>?J@45YzEYOCOL;Wm&59WRAR(&?=x-_tHhnkq0B5lawjE3p4$*L!Cw
zIa?{z0syk2uehZ-s_WrBC?E~4P=wo5<V7F-htENHcdC%>2q}1J@j2Hf`=3N63lIa5
ziQ79nNA}eogU7fdLP%QHm>5Gzb=^Xeh&qIn8r+SUA<S5AB+rHDmh6K+?3|oK2baLa
zW^T0qY^b%hwL1F@OwP8@$7t<^+K7Gw|DF^S6ui3Ie+2j1U+H;W8DeqSg;ayI`>0el
zFmumU)$+<-B@M>yrQt_m|1?N?HIh{<BuYCUK6bT>ealIv^gfh`E0p-9y+iSm5cst(
z%(jZn%#jG$0WAj4Q~~kGI;_C+|Lw(x_aLg5jU%cT5B0u0;iX_;V7Qoq5?kUu1ELkP
z3YUu$*E6wd{)UF~YVZ=TKMMInNL6ImWTORBO!PhFWb}60XwAhkHlK6|ey^{e{|RjX
z6%n1epz|Ht<K|@E-n$jVE5Z@y<v3osqqI=)$xUV^rf$IgyKDkkN=$3qZKn<%E^b+h
z|1Aif$4#aS2rm727Y7`Q0Ta&R){sTY=1h>bX1^lhO2SgH5WnNS{&!h=TI=3Z{g!zz
z8di&*{0$NwR{_}8_beE7dibhb>@?>EJ4av61MPNM4RHIj)T^<uu>3PXl(w~OVwG^i
zP5FzA;A4hh)eP&_Z2#T5f|#Iy68Nw;7L;OrwqUyjzfGKXrfZPy1FdamLkkNFR{)%_
zUOX4GxFi8F{lT_0EjI03_*&Olyd0-NfEhoXG1hhY>O~554VBmZ09tO@H@Bnyo_M>Z
zaHTSyU94;Jfro>`YwcJ40VK=#<bq0I*6;Ied~y?O<LakiNs&?^NI!bCfk%^pXxn^T
z8re%*hM@j%r2@k{G=HzFjCcSrs2e?aNSrH7emhj*?=WwoVy6UVXJ;`FTU8(u($ec4
zq{`h7@20tIPl%cXbL0O5^x=<6^3x<~kemF_&rnFzwHEZSb)!HO-!g!L1wsI1Tue?*
z9^wWfvA(OrgkXUI-T3*yQ7UPm%X#=JC&s(^_AOc``5cA@{1dmk>B@v*N7=)}!~N{$
z?#m>ns7Qo~p)pNFZ~7nA---WLm^%Ai-$iL#KYiM6Fo@osOauw!G&0Xp%bKeeqWO2{
zDvG!~v{`d0xW>k$R{|0BdD!v41Y=7>kFhDzO4e}3Z1k<2c)~*$yp(qjKh)GP;)O9X
z*DChYS%z$l9Cp34p^KcQ?r>@ed*<EmmaH{F)DDC1cMZ(iDITOZmIcg?LfOz+r=J9A
zvtNf^3nXB+FTn=aVccv4?_Ml-61@NbBT3lYB@Nnt2ORwC+C38!@U>3*1|<?ye6nN-
zmT>Vc75ghfCESDm!_VVh!y&M0`z|peR8%yf9$#BKOa623cibUddqUsfQM3iI&i~(4
zRcYqn!PrEc;$H;kzDMr4*c$$+t7Er5#Gfa=4r0yficiZCs`vII|NS>)BEy4ljA}(h
zT@e`J$5n<p|I_A;EdW=ECU$QA+}~RdMD|yRlUFs=e2M-sWzAGS)9-QB2Q=XFYb+Zq
zNS>L4V~}dn(xz`Igo{+uI5NrQ@}8l)W~t0IZq<VSLE7k_&$|0B_~_jP{sd1x42_nL
z#%ydnPr}@aM*PM~u|g2jxK%!*Od~bU&tn@o&)j8*(QYr&4=(Ee^e<4dYAoDrP4x>X
z&>f|DUM+F!>ZP5XT`Gyc3m&l1e<W26YzQO_xGWOFJin{+jjQHnilWF*rM_7lfy4B1
z>=o7yact)gG8hmdpyLJDDD$&?^Zn|;jp>>Oo%GkUh`O(aSkyXq8CjRD(`znP08E5h
zs3sqER$%U$07kG0nQI?(u!l?t9rj1&1_XB+RJ&gGW`{?FNd{R1qu)zE7nh&d2%;Ro
z@~qqtL|S?U-?+g2R>s58DXoGbHmM>b(IVMAqrY(?@+&b}mY&Ip*LNbFydqZdDJi{Q
zyl;+=jtpUTLQ)gWh-ULE<EnFFQBnNh^8X_D0T~p<i`W-V^uggg6GSB_t_5b>Go%P=
z4qc!)v8XGp&7Wh*xG*33YrisXa^Y`oY@kx@(lat*O0iF!-a|Ca%r0n49MV}8VRcMo
z_oz$|qc<vOGhhF=y;K8;W>^|N4PNPA#usXNct}Z3{t@iYCS|4YtaOM3m5H@UvJVdJ
zQslTdM4t=GP8X-mA_;3jI3P4)lE(!ZkSq?!0QZ;t<szfO4Z<S0SZ;IGqbZAId73lf
zjcnDNU_JMe#08#P7z(^_Qh^7A2_(Z2bf$LP7S?E>X}YAW#hih$eP_D@Wz8m>*ei1v
zYtlNkikI>a1!0jve-63?9_r{&3Vdf7L#(Z>RbUc{wu~l0CHxs;obTpM0GZ-W-77I|
z@E;2c7G}hGQJtT|ymAvK-~N5x9!$K|R~mkCA{xtFw*|2PgM2RjeUpHIz&9@~oEVSZ
z=ids<RH%RxfyH$SHi&0}fKU^an&TILT*4Sel}W*KB;aXSg7x@LHlG&aQy}!kHDv_-
z=S*y4*+h&0vULMJk3ii179zBDBbQw?=JKJ{S6Dt01N6Q<)kBK@;r`Myqfq%0?DlLu
zI<X8kkKSM%Q?%tw3|yX%>;$aPhL{En2IF9ByT;?~3qW&Uh04m3)p<3jShSR%($+%(
zNcz9RLt#aiz{U2b45xi@l4nX>5LvHnrfQoDS1?d*FF8<-$(8C~r2FNH-mHlu-8f!E
z9n~}2#Vd^X{}$L(BE527um|M<FiR!<Fy5IjXvsT8tT_8O(tCF%9j!MwIJnkKK}l&>
z7W>9&zDdE_7i3j!Ho9jj)xgv4REEwpf^?Ygjh1dZ4Ci;cmLdVi_WY<y?px0;qM1OP
z>0mdoF()?(x5pd&pK;cE+OCpNQ!xZ@Hvl@5ZyyXi_qkR|Gkj<e;66y#_)UV*pdt1m
zYSG<su?zT6K_gL`+(ZzXz;g$vY3;5IX>@?V>d7CQ=?g2l0E$_?g#+S{;uCwX*SPR!
z`^3{V{PSh3ggeuphb5aTIlbF2aQ~Bpdn{T&U;cBmvjiU16Z-YkI=rpj-KJ-ct<23i
z8Ty4ctJ_sb@rl&*U9idO@42R^kZXNV>>C}e3+uAxkkQPVI`6jPcSN8lc%FdM&kPw&
zjFs!0#+;v6Z^7K%-EDWeuyK2@h{pX&v@Swx<6H^bm0t@^OyCou;ybBS)vo`S&PNx%
z%*dd#ky1{hzT3vb%+78jBARa%A3qPqx!Imvu6nZ&NzkpWua7>)MY^%{Ds7aQ)KUxH
zldtM<&xo)8o~>dEp%=x`C(=CdqsglLx={Kl*$xjQINTyRT{6*jL5!5qLJ4aJ#V=xs
zpt4tfS_&f#k%T>G95-6Au93T3hGCW)%N)&nj>gNeXXVY=j@4_(vCm&)CK<zECZ8gX
zvH?EwA2$bg>^Fb3lW<W6n4Q-}B6IR*IB)LKz}dOnaC|?lgVQ+dkH>$(uK*Q-6dte0
z2^o|Uw^Fgrz4)k-H$hRW(SxfEm0b6T5cl~>ZhI{?eQ=%xha)WT{<MaZ{e>f-rJ<!q
zjlE9~QKm<?9~v`^^nxj9@%`cCWx^x%ki2;}z)0O#S$Qf8ZaTCf&lCQLTQ5VNNn53Q
z9FAUxxcQ*X%Z3zrIpbqvMZpry>odaFdt0sqZPf&A(Jj6s6XA!?_ujr##rj8*<#IwV
zYQ+r5EXSyBfHy_5<<<xLQEJviGQ1&?T6h(=Prfkg-=dtZ)3L;O(|fawr>FDWU*){k
z=R&}cL4?b3+s__#I6|ICR?dHRL3o@=6I4FY(b4(as^D(-dl}gr?LQU!r&XF*GfNN3
zJ-ilG8Wa)K%M0ofOe`!aH<CC&e(S12Q<CJPDIi5Ewn>}(SosUtTv2izRt54jrMSBd
zG&wfRF{|cH_0d~6q>8Wt4wBg(8FeRDwqRc}v}6pn=WD83SacvD@1>?Xryd0byLta>
zN|7r|`fXy=1vmo(I^Y0EbdP2tDmM84Qg~5n+j@AoJXtkq0MT5<RScMpTm_;`KSfEt
z(@&^m^@kp-4l`VM+ft>k(GS=v?l0SUS^;@t<MOfpe{jfNLvQ>G>u7knvRr<z0#Ay-
z)lXovUfu`>Uv&N4*4DPc;zND?G}?|wA95y_n6IyW<AT~zE$SKHJqvdL-(jL?%sG;C
z7I+?j7Ztiyt^)?AaVnjJcE1X`C={MgWvzjIJJijS?;jYj0R=<JaqN&xFehb&wFyGS
z(Zl0+J;n{|hc;KfXj5GxAErr+S;c5N-1u)Bs#(U)a1rj?x|jZPGO2apwz)s>`!^jX
z=-{0kg*^-9hia8r8?ZjB%pBT==(KR{qgZ+OiNYn05C6aQ(F<m=PKG-_7>&A067)Je
zoXDBFJM0PQ(9N+FZZ#hUW^PXd*%S_DVCBYiT|TsbGc>4N4ud<Zm_1mQ?@=`^!NQvq
zfO_;hxRr+tNGZq7aV^Viid@bT%tzau0xrdVhu08kzohE~qO;)2qT)nx6oHytf9fq0
zL<b(%8R>4XLy59AkyYFO0j7z93j33@@8tBJ<6MIPfCLPq_%Ws(^UjQyw*O|og#u4M
z^SquUX?Mb7c{J+y?%zNms70S@P%&(J!V>wuh$M5VhZ11(IwCFtMvF4+FC9M<I9xq_
z;u%A*OQwX3%%9TiW&K+T89c+bgqoKc6(5&NHz%AyaN9`KQS?nc4|J|}ak*R_>^L&8
z8bhd@m|B`2gN~j}<vp$#e1_l(%<?yTpsy2kePcM%8*;>nfac1&>)4`d{Hd(+DtM`J
zcjq4w2Yuy-f6g5Rc6Ahvl8~<>l~F_6EVOur*SWI-ahX))*U&-a68by2Y*&rLB-<>5
zhm@GlLl4S_?It7+5zM2wPoc_fEPVXxRqQS}XfgQ%n|qOD>T;^E!$<gI4?x>t-?{=q
zSPKC(jJ;_bx613OGW?O8%K~I4LgK1)vYbfeAk<bRwF^iBIL<Z=8}ztR>gwuPi@sw3
zLHX4jl7L)49Mm$gkwM$F78Lx9CllYx%Z0Z#H}?~RC%wToZk|u(MF`p4e84uybk_$r
zB=ndWB=@lq|2u4?)#in@>yn=RemH*D-Me=+<2r5>rc;#4j{H4hf|`1QQW-nOrk<a^
z%mm}wTwvYAi@hLcf5-8PXlP)eb-Zx1s#b<twCLP?Wy~H(|HR3ZmY0`<DltP7nhEVN
zt40!i_h0H4)`^}2mj?S_)~~lSsP>%~hpnHX=CLu&Co#0Vuv3@P2Ea__8#*vy>4VjK
z?L_y5Fk-_*@p=;&@fR_D9X;(ZjYxY34NV&j2mb$IS<B5J`$H>Y>03{JtKGkU0UoLB
zy-OYI7D?HCqsD*NxJ6KHnxTC2%+?iaV=-C~-Eo~zNzX(W_i|K7Djz@DQM*f3ovx(x
za5ZbAjXXtOoKIHOk;jDbw5bnhSPN<)KuQRA1INg@lF<8JEo8X`fC(E0eV!j7aNrsw
zzGx(b`G8O)ak#*OJ$2eV`{IkC57>*GL8pD@m>w##Id2_i*VSVE_x!YVXqAiQQV38i
z(`;dxZHQ2mDPK-9-NN#-=jO~fpSQzE5cmvcJni@I{#SfqlWJ=b_@i8xJw9f-syN??
zbOz=8`A^EhWFjor$|_5z8gYy0{JCLzuc0b^hPeF+wL<#;>gr?on@GJ9AD*T8*JUq?
zznM}=)E+;Sg~76k9)%ikZG+^JMST*)9fn{UD1;r%R_u8D&+GQ9R*jX{d}%T5TvosW
zKobTA$TfGddpTBDxLh6qY89oRGDC_t_TD@eba6JibhMxbR+l#^?JO*EI+-BTk%&EV
zi`74XP|K_$TjN8fM3P)fWQe6^W&W>LkwB=Mw`MF;O<Y;ru3Lx3R6Uodk07jm)@#&N
zG*iPY(V13RndK6=RLQ(x21YH%`*F_VyoOrI#VacpnQ{GMW3=11$;CSl*QEODKdFnO
z^~_Iu4K5zPU$r~+&TH%6#LYL=iZ4!$OG4rr&7|z_HGAcz1+cjS`Z^CUEl&Ff2ha8|
z0BP;UPK#~P`Zsa;SCoN&?g|(SLTt8yeUi^~lISD$xqAWxnM6z30z8-^AxCMJ$gCog
z>@@P1f|7i^#E<UoVgw(U_1}JPT^FVZYW2a)mHBi4y8Yxt9`IkHq-Q;J8ADhY`2Oq%
zAwZ8mC;)g$BFkvzE&<?Pz5+W@E?>D5c;?aDZmJ4fG%{__rNXb<e_JOxcG+l?y>KQd
z=ebG8@FgGs)O@J9ZJ}(-OK(84VxWY`_Zpkbo63cv{!WIliOBye4gWqZv8K&SJ872?
zvQ-c^sa-%@?<fA#Y_Dp!MwZqY!qQXR29!@U8Oo15Ka31X9@5Cl;zq)pDEA!&%a{N~
ziXumbWpKL3%|@VS&OAIi;w=XqyGtw!)7-?~dz=D=erTDTiq^~I+bL&4jPhjANXFbs
zUmE+}th>SA(zz(qGk_bXJ?75doS}Bz^#Ri2w6$$#J0=PKY7^_wm3d&&nLXpP9NS}#
zJu*L^Y->?SFgWR?lWXj=c=$Dqa~^YCBis|eLxQ?K2XJ-|u;Up$^dY{+q$Kj^8E+=P
z^$Nv4<8x(>>Z)%u7h|_voIBipVEMv$D3-oo-FOsmWwKsiP%h(WT7BvbL&lCm<J$%>
zCJnuMI*Tlmz*N4N@b{?x?LN)k`#aNnZew0}=~vF{Sx{~3xuUrDQuPb$`1ZGN&4fys
z_vjg$Dhx|~@SPfqT+R-kHw(Gj)0qV3AKF{hJ#}z^dK*9Oc1(b){i--o^xe<x%TT;)
zb!rz7Ab+{*-7L4ce~c)knE>YS=T3F2DWu=-nk(odE}9oJm&e0{F8Y%{l+@HndlTJn
zhFxNv*m5F{IKyB78>LAE>@6reUtalRAmZ&OWybZt^B+Z(Nf;aRvwNVhME7|CH=A^X
zsoG;HF|oJCklYW!FvlQkKD^}fqNcuk_CN;4-ZP>DYiw7c{W(z;cp}*h`~nW#|3HM_
zNtoG361dJof1>`ePJ8LKJDbcaOl(EXnriIaI0{4KOwA27sOS|=7D9VQ4a|421wb5m
z+P6>xhTIQv+PjeZI#&n(e4`Ancm5SB_DVfZPhD+L_>=GZrX6*K8a)!~`Tdld8@Q?J
zmsr%cVV}9)qUj*&SaCU^>5glVgIXl#&=-0KF5-lUC>c&L$806)X4al%!nJ_JTL%I0
z(q~GnL+{Vm>TUO6tD*BHGt9@AF_qr*$ba@J`fM+yc0rk1uZcM$iu1gZQxou!3~t~Q
zQya)gPUFdD6CcXQSEyo2JkGxLf-zWI^O7YU`KYSY#u7_rdm^ncc;L3NLul0tf3Itx
z#<|oxrh1V<Jta~)1M@uPBJM4PRB~`|9P1BMLY}6%{KzqXlA_rz`zAb!MzMT~1x1-C
z1hV#DK!Fj^yE8Wp%>mttz*XQcp!6f7bBXh8$NVstF(1l@pUVlWCFoO0N1YdraARCA
z`%l~FdwMiD6|D*2*dLdSt=~nw7P@G}=s7A$|JP)UFhF;Cda|_ki@9imexvVVydh*M
z4HROAsWe(2g!GELtJ;gSun$%7hsG(=UQSqiq_8T#Ik422pcF>sT`MNiA6!{T91`p0
z^1*UUs7R&mE_sEK@9h4QyuI@8n?)BB17jQUqeQ<x$<XdRhGtLJSL@E19}y}MtK^8K
zBpMX0ba{o!7zY%8r&8K$mt)7HMxw-&Z`;g=31?UW<I&AqO~o3VntAsbs?`g;7-LJN
zjt3^TH(UVtyF4;W@;(@lHa}z)ic#E8h)>Ew<Hole-Y#mQy+yz}dPb{nJ%<0Qq9n@}
zxdkubPr0&W**ozMNwDm#=7Y=4r`|#OYKf3S_h)OZ<1V2)J+{QR33&?j|7>hnCa25L
zbBB{M{h9XIDWH24uH{Fb^0Qjx&SM_p%C&Y{MN@=)Aj*`)p|i8|SMx<*b3jdBs(~a~
z+tDO!dH-<7p+3k@7z1jpTjlVRHY<jg-N>X=z=W7NGC&{@v6tYAM*T&Ao8KkdVYR1j
ztD@E=!4M`nuEEMxXfk(Y!hhw8%!tw7m#PFw=T9~#mGjb$fU{KU#1GHV6$$cZH%<<o
zJ?X~(**j81&pDuK#wlA@UCVAEQV`9W`xP=yohh5v%q(}|s}DtyyA!)e#hmP2oE{|G
zUW>U`M4l6{M4PQ1v@9Le=G>KX)Z2pJ?Pok~Ea=lb(U?N<=UomF$~3*>N-yuaGoNJz
z+?Wdcn^wOOh*&h6fZrtFme$R2Q5NO1AYhcBHHJS2b94R8yjL<ct5>L;_4Zt*GUd1X
zqA_8gv>xF$YbFC9t8D^VMN$;ip&rjiCJqkmiWk>Nn5g9GppbkTp~$bDC5IJS#Htse
zA_GUFXALK~xiiin>(S(Gt^r#9x=RXYpSJ2AvcL<C8)tRhHS8&fxA&+Y-ey~l?`V~8
z&F((a>GY;Sy|)a^Su5&)L#9wU{J-KA)sxKusFMRx<b5&x98jk9asNOr(Rz3&L7@EH
zHCT-ySU*eOG*!Y)?`~-9eU?z?BVy<d(=!jYE(_jJJZ0i@c+s_Odbu4|!`s~P^aq9k
zu`(q~U+)Zs;f0xhiKNSB?fNi>xsR%rnUdVfWTkv<be8<Xb%wGzam)rKTu<5dizm+5
zFyLeWnon0+NZ0o5AZF+z)MV*F(1MIChIN&q%+krL=^zt%f{n4Pia)s1xo=i|9*bsN
zwp}!2+c6@4BBHK!;)T@P|Du4lYJe&-c>l_MRA+R1d&<K1^LEqH$y;rQuF%iNCXN~Y
zPKOQ|tHOEPr~34yE+!Y(#4KC=zH>V055|Nj_etL?zUSqX=b`G;mm^heys^+}qgGGT
zoXEO*g+FEFzNL|wV^R$Tp^`_46pfbX8;Ss(;*~Z(o)0Ip_CpOm!h9B?w#WtjId|9e
z+-(Dm3;_$GNdKsj8Ic;f?JhBcN^(V@hRo+#m7y>Sl-Ad<7L1Q=%5#;`pNsD5TCMnp
zJ^Fyv@U+tI$?I2vno#F9w-TaB|H{c~=aefksA@Z>4WpE~{tE05&Wj(9x2zkA;bpZ;
zSDS-?$<5^%Fe*EGYu$UysJwSq#_QT?-=KAD{^KR3^iEj{r`QQfVZ>>l@ONqdrr1q8
zlw85+MRaZOe)mC%L09DRF#pilbxd5BZ;lzq()kbXP>H)Ocm0gtb#|o@g;%Yk76D4j
zJ+zUFIM532INCJ)6j~mzDtKCb+pPQ_g;KN0DnFIcDx1~1QM6s2mv*(EZ{8Wf`R%|T
zztX<gJl1wayw1Pb^|nbqbje-lx{!5*f@W51xSFBhC*BkVYILHL-oAgMo58V}1Y^?u
zWTZOEAMS82X&>{XG&RX`U8T{_-Nb8$&41{(KPUY`;U8#;b18E|nvHH~A%vSQMK*(d
zbMtI2H)^ZzFf*f8%!(Z_?RF|FMPZW(VswP$%t+`KV=|R`3AN^Lu@&VSt_PZxMn}`l
zm(zJd^VoU;yn+7y2BcoO->8Afob<SP*4{M~L)k>mZHF;LNHSM*w){}5bVmuMI_urL
zUMgTqFf=;<0zR}<<2T=GaZm7X{s}5PcoNr^IwWPj!)J7iP1;VXF3-`<?wOCKP4f|5
zpj<rE($XR{&Ofmudrmwf8d^3ivcf{&=5%gT_Q=JVPoJJ8OkV0inf{$!KsM~zZ8*?o
zaSO7{-uif3Va}7|Y&qL!iIlU+e|HWkjvIWBVLGNJ?xJ#{dC*-I09><8X!tBE=P5o4
zO{y_Lofdw-(xoiZcux{q3j;7gGiV(V<W3Nqk5)N>dMT8#zj8zgcg7#y+AU{<#gVQ#
zUrL^2^ENR|w_n*Z0yak3*vxb8EaHs^XNK@&a;RgSK69AkQ1Wu$Zo+)b`JI&TlQ;L-
z+5)@AD}89cvAXmuKOd^7%|5S`p^am|J8@KTV%T)U(WlHLbnhfqL?iyB_M~ZNu9k0|
z0nHkA*KAQ{7YsVZuo)k-vHrMYGb9!i7dC`VVbI&x6CE5FTr`8u-Kz~UDeDPkV@#Fn
zJ4oR;-c@IiQxO(GqZ%hf@73D1zCKV5FsWWQrjHRstINFCH2YG;EZl+CRgn2Mx=yHX
zyX>Ydvw~vsH-jE)$IPpxc<;>iy_;7@Tb+6kxJ(+)?Wb&m!Ntexrr>Uz1bTPzamzGe
zpp0uaMBf?hlRm1jGiT7hzI0)M9Jl%omxbSnJ;-llU2=yGxv;IHIATV=K<8Q>bjbuR
zbx>RzyUfyiY1eV^Ro)p%LN?NyIeW9Y!#Dh^g7>pk1-tpDg1SjIa-SX<I?|I>GwHuC
zk2#`U0zt<mn@#Qg4tv|<<BRC^4kTQ&&x&PQE_3g8;Igv`%CKX@;6eG4+<UZEf)#tT
zeTOH1Orq)apk}!Iw(;WtFPrh=SEd>0hb9rxr*%+DqlRcCbBws_@+lQ(O!jQvD47Gc
z&+J&NSy;%pq1feii`)jdlgeS86gN(m%>gJoSq?&?gPePUzAbwjv0X#Lrm=C}4cGmF
z$>he6Wnka!nx{B~7|7-$T$L>{In-(qu}ZKzG^dk7+1J|~sN*{hpZq5KxVmbzB+e2Q
zxn;wU>UY$fR{NlWz1e&FU09n1sOqW(PQCe-(p0j%-eNTr`Q;Kg?NMMe7qK|z+Ccnb
zllqX=nHz;%#CnJL!aFd8C>)luQ-u~DO4^!|8b6=tQd~n|aq@!i&zaUoPA=~TeXX+b
zJg9Y`?<@RKxk5U)?*9}iS#LXeCn7LrJCg&}TpLI~-sXTnWwa<veg$3rfba0h6VUJ3
z90`}SDXPu3*02*4G(Y>5dhu<Po+a=~>1z~p`8(m_L{M*0xE=Bq*iP1Hi|6JKYOLx6
zi*I%!HG8v7`!@0Qny<G50qXSmVC1sJ5k(dO+&Bq)XFSWfGWJo#*YIe^_@zLjfD%Qv
zX3eeDNB-t6<talu97PS{?PmwL=k9dpi;bV(RBB*l_vyhp>!<Mo*yTp{Ea0?hnqpTp
zO$<+(0O(OTG(1M5(L0mXS4LL(xxIci`!2M+EG?UHxC4aV(t+8A6|HaYUFJqn6+d{7
zRN)NphJOn{*U!%)k71_y4z<TSc0EW11%=Sv8KisP8)GvSLzlp#)cT!1#{tE&JwutS
zj?8l_^mK5s=Ap4KphZpHk(a;V>BM8A%$cdR{w8)`X_6GRT~%wB!22H=L^Xp-((SaS
zk5K8u<M_tK(kI8CPew>`L@n^SSeW@BZn2J}!DGStL`s$XVb@eyOCsfj92bN*_9|Zf
z^vR}JqHnW7yfuLy^3y`7=SpklrYa8P`L5Ob#Ceu<CQ&50XL&|5gx~2n=|G$5K^_Xf
zKat*2k6TVx&75eLW>8L}ikM&4J`z(O@$+pZrXkmiu`;Ridi-nH0VVO_LF46EWoFo*
zFYQK!Q;Naz54Y<Ks_j;yzgh{+rD`8;hY3&X%tVJ4O8tB>QT>9!oGTW-ZFEmGb*JWs
zN_|090G!t`<vOIQO1B}~htu_|$Jdj$$OrsSLwS!)H2nKGrQSRW(0RkqanebU$WU`~
z>ZTBLWm+%l;C+6zC9*yjQpVgz4VkR3WV*u2FQ6D&C9e~pRcHuBel&&#E&7pv3_72l
zHxq+sr=fCW`kJw5Y|}2p)3E7zyBndB6cf9yz7zC9rWC66mTNoe%7Z)K;Gg=AJ5Uj1
zj6%QJWh@pZ_eT(zA?zJ{dO@9gl{~)hd{8sn3J?3&Q&MA)=YGgKD~=^L+77os!D6UM
z-)?bo)x(J7X)9Ud$=mhXD7mKqOYjDb#V)}w^l7qBjF}5u-^X=)*G0`5l#I}|N%!_T
z8M5~_-RzKklD;RSZNLisR@-Iu%NE`cbHwS-SD8~^!eQYWHzLH~4*=G=))%|;d7#rX
zy&=ZsKr8UByDdok<+UZ+uq(%A{s$TJ+vw_{ILXSpll9js?>^=cT6}*aGRk58;vyi3
zQg8o5a_LfwU!%7nbL?g`ACsVe7Bsef->YPmo>q1OBNKle!lSTl`s!KOdMoN9Y#LSn
zv;9Vgo!*0GtFz9f?4?SRSIb%x*15Dz&rwGuLfUN9bf|tPMU2W~?KPu|xv{=xzWcYM
z8@ElVVO#K8qgD1Pe)IMvni#pE+7m7QF-|JH_6>sosgBE%Qu2gv^1A+muIU0oDBns5
zzfd9xVyVgqsi0RLr!32W9B-{amy!lAdA}ZAE$!F8j7y3-i$480S2GqSCCV4!5Ru%t
z<QaV=@81lc%{hs?y>{JxtFs*~g!k}#<UzL;8PcIL>3-`iLZveD*IXVTJyIq_S<y;}
zBn-Ec+u-NqlJHYo9l?1d`h>C~r?uuvMqlXY-=ZxG+RHpgHgk%*gz{~Z@^FT^q`vC;
zZU%XJu65CNhc79wq!ueWTpP2mGLL|Q-h0}~E4Q|{s`xpo{}x4uv!2E*W&5nXWQ08W
zp%Vh>E=8ff0!@X}tlIUL_d^Ml>@|z=bFA!2qV6pXs%}Zd%YEFUc#=dB^wQIf!7i@L
z(q%xO7#-`!zR_Oe&{Eo8r8-k*BpftwJf1g<l4AX;-l)AP_EKMbsUkX5RVw3m#o$WS
zULQ2&cc0qPv2ejbomrL`o~FV}6+wKiEf?WyuZ0XCPvMid*0eOUtF+HQE?Ee*r`&#b
z+a?sx2CbWN^LEqGegHHlvJy{#Y$(eRb($KLWHoG9?BYz`{m5+T#{iFQLIFKEoC2&X
zq9wpTd1g+n!#jC3zUpO>jFv|A#8m<^f{z+Enk+aoSC01izr4egUJZ7zsD|Hnw2)?q
z9rKS*NoMw6r@zOqZ?@SnjWamhXn9FW0*|zAG#uxXsjPY$8YA`0&bN^N;x$6hUoFM3
zuSftAav%9Xvr8Z9kZd`0tLd8|G;*1KeFy#q@=?=}&G?qT6qk8Qr%5?H!ixLBg_eWF
zA7g!nzFu8$kh1QLo`okzEge)=^leJs>%VH0kSj8^Tle6};~^{K$7&vrj(2TZXol}U
zqOxku%sqi{lbpxsYdomcr8|QgnHE7JU3#H(ow)>g{Mr&Mjpi}G{f})<y9$lg<Ku7l
zogcHG_1h^{tA0sLBGKsQc_<pV{N-s>=>^@0bdWa6mG7#6B5Y6+^{Bz+wIOdbky0!n
zy5mbxO>@>nb4lFq7xgWh(l#M;e)FYb9}o_XBZNvHH74B!r=5q$@E+1vDx)UpiIl!I
z!}Yfs3woQ>Qc^n3Zwq>RHTv0<Z+d@(I(4``MjBh_|6V#_n5H}u+0wPiojbWSMov4P
z@&}<6AKO_)nU<Sfs(fJ#xLKUkv7U`kq}6=>v_~8c=_OJkVSVts<;HzNrOLD)VdT5$
zvWgRpgh{LULaO5X$01+Yn!$FyP;c^>zo68+O&f{mKchUIQ&mhNFrJZg+k!bM&=I=f
zSS8p)@gC{JBmXT}Pi{xaP7-s?+zWiJsI_)mwHMO3=70y?ld%{@Khzz08JV=YPNg-0
zv#6~GEz{6R&Zn4QK<m^yj4k~Kab-bPS!ilq_B!pj;h*sZVztCqoIx_ri309PF9GY*
zdP>ITu~IiM)8*{zR*7j9_AckyL$@{x=@o3f@{MM%%q_<7m+>!_e1JP7p*hkXZ+y|O
zY&c-pxxK^l&)JSl>23DD!OvILYvUZ79iKx?G9=<h+B`p<dm6GB%GPV|JgtM?#0<cr
zDr(JtElHO9YGvJTAKmpWeWtIysXY1RTF=rFG2W(GABF4<oWcs5eZGEL&F7r-XeiY`
z&&RNi$3$~lx^Y8GvDDELfx06kUG7qf6JRy>%`B(~A(Cop9o*Ua+~)3-?yV&1oaL81
zc-d%By8W^-p5OjshUGM>GHjqSMf+kXFz{lT6OE)Y?(TD<8Wjd!iLYT^Ksw&z*Ltv!
zwF^wGcu!w?-$7gZ7El|QdM2B9b-8lPL#3&{tr!ioikYZA%U=fms>a{551VkM%aa3n
zB#=tQ^m>arCo;$%ocJ=dg`b?3(;b&x$C_N7DQ>*EJ>5|=vE*dmH*FH{dEvAeXn|bz
zS%m-M6{0;VL}M!UyN{MD%&}+V=hlWrE3{<Ilj7l3vPq3(#cLYH8KdX-B{XS^r;{4n
zdWzeJmYQb#lmzF?K>=>`vJ_7F6&rKzn_9}}72gq{F55XYId{7>h_l$rHy`SZGK*S%
z7{25ly_JFc_|yyA`PXUKGjpu{{&w{cU%5|*pwQI}YxB!ZgYzAop#4OR>tIBn&WWV2
z07f6@yN+7KH6i9<z;^v?3uhh07_Mv<JAWXkVdzg%qDX5!^l4K($05Nydgs=@iOFus
zOjUVFz@*&j<IUBIUpAl9yiyeP=4MmoeQ%~F*UOOCYa32JTa{BedyLF+dNK5~S6{s3
zQmJudE>mxs^0$sJda8PrV~2I7*IP(21$i5u&XB2As$Xo}{CZ<|SNog8<lD%6umSV-
zD@nl8$;p2%M!ga9L<Tnu{hEqB4E$wA-kKeAc0U|`tE#*4eV@B+_&gS|(w%U4f?D3d
z@mRg<717h6qZfx57rtl}1|)u93}(9_3uZ7srds*<B@j?_Hi$d`m`s-&RC^U(^#h$E
z8F=}c0J!M#{?$o(o5g;OG4}$4N5*DOl=N#0RBi4%@EzLV=q0KJi-LQTR$Fc3Gn}A{
zc_WHY0dR1J0AIWA>9c42zL?W>-Er>ZU(Bm4qrO~aqGg}O*vT{VJwkqd=nWQRAHVlw
zz^(FSj32?uKn0#!>xYA6?V+U{8F+z{VL=mnpD*yZ_I~@dWl2|O!D7SpGeMP-n$%E?
zatMw#bZ+yLdv_r&oYRJYf`L=ciT9rT7R5#|JnUj1_-bYVxq#zGe`x5s13vi}$(qCb
zKjF@clNPX&v0!$Q76K`*PH|O;U8tPA-BP=PE`vU+fA()ywi@r}CWBgE)D%}5JLPV3
zw8VFWk{`DdXn8eyH!QOQzKeObL~hYfo3FST)NAA9A(FI|6X&nI8=~y3${LTSc(Gl+
z8DH{W8_;{3cum?wreAVBcp$Id8+-^LQdQu&7s7$LG<pI``CF5$zAO2JkFN5tR5o~)
zq%ZHd(Q>+1-ZweGk%wtFpZ|SDAm5y^Mo9ow`Byfsud;OWvp|)2=DqVGhSIvEL{iYs
zW+{TnUte!uqdo{$9L>JXKE3UKG+`Zodh}w}Iq!S!sHxV^?=vzJzI@-G6CxE0Z@y7x
z3X5FNm<MAIU3?e@2xFa;Zau&0W3V3=P2{Oxwxn@opu+n)QsX@0ASiN+H+FM{A@!s-
zR%z62{I!15b&^$THWU<Ih%hw%%>4UycbiGPNG;!@-mMr0#qpKtcImmP+`fFnEb5&h
zkotg^8~xKp{N+yzz&`5%654kh)6>%#2sDttCVu{WtGZ<EgZv0Gim1`z^Au7VrD|D~
zM<u8{x6Uy|`uQtk$jQ26+3ac7e<hpqW?<E;!le8&ad)P!njgc>c}^_c$`wTEniJrI
zqKpx|Sr@LBl8}%v1x(q+q^~WsF@Y9o1(k*`sWp-2)EyeUsDZHmTI(a~WcJ<HIONmn
zqJv&A1W#-b_X)iqe|10Xk4weRwuL+FoF1>owoc5id6fM;)p~Vv-0<2Mx3xHDOz4v6
z5wT2)pwjmzn-t$lpR#1+1lt?3aLX1-TQ@?rSsTUEula0!DIf?0Y)VZipQCCwS-+9(
zPrOGRFAPP3Ww0e<7W6}JDq;xErQWnTH*}SdPi&ul&6!geuimy?l8-4SP1!b8o0E9-
zFrXRk84?v0^^uy-%}{4sLD!}t=5TRN>$kPY$sln0vQdf?dp!|?*P?$Q)tbeF>$@}!
zEJ$Uh1MmNUs>ewKYr^M&l7>;poK@56CW{o$VE+ocAL2Y%hTFH>t$rkT_I4SO22vE?
zbuABw89(!Xfe!qPoQoBTj(z@=qTI)%!R+>ChYjz+<7B^r(GOZAU*3yAG(Ex|-ShbU
z$IqU^lUJlKzXhG<Z71j%?Xw>e<+o)>=Ae(5P)|$SdEBQfI8XhH?MH$FY)b8SY_ZXz
zGTiCtK^E`2ekGs1BgL40eBJN;nP?*J;VhBQWz4_l$ETz1<aG64#ak>{%^5J8SXdc`
z_q^T!T!#Lst7Q|9$JaM*m(#VWhryM39%(yR_O6TXbH><9o38d^nu}?&`nu*_92d}r
z6CjM)EO9mm0#||NHT2K;?5VF>kQFH$spQ9*j+ngsdqY?o&|kP!zR9$1<(w($s!1cM
z)cCLS!%jqx$<4O!Ul1c$1a=A=VAnn-CIoa)ad#}Q6a)FUU(CH+n=dFZX?=`ieblB&
zo*x<ImaG}?*ubyI5p>$W>?kn2iTZ~$v7d<Ixr2D>^7`{Jqnt+tz6xlG%-6HRzI+^n
zBE!G$hxxBzYR5<EFmHm^27C6kt}}+{5o>K)rZDxIyq|!&s9s6JV{JFqqC&O{6|t=5
zi!nZ{v=R3&n1m!GFXz(d;pPXFyJkF&#|cOVWV;OLcf-F_dS@uqh%H?xz2fmrX^2S+
zan?=erEj(4Q*13<jc(|*)fb<5;q=VKysgEPUYbHLYWAZ94M#}?e01)mAj&EJo?@6W
z-EyZ>OpXtXuhrqO)NI$k?$27$>tqH_L-wK~y~xp==H~fw)<*Mz{rlT-pCa?mZK?3n
zGjjZ%+n!eZllA?#Pq3lu3$GcsiuJQ1gT|tbN?YX~6OI3mske@6y6xZpDG31?BA|$*
zVlX<ThLj*Eq5?xEDIn4yB{4chEV>i}X-1A5F$4(_l#&>X6r=^l7~A)p*ZuiDet%r|
zKiA{BAMCxo&+`?>@jOP}_vym>#H|l*V9J~>cQa@$N`6Dcq?nlMRG-{*f1j&=^%{fD
zfu4=i;r+H2T$IV4dh&zBnmfqlhnW^Ih49;Q_Ya<rH75JZ+X<*D@ths)XfF_Gum5?K
zIZZ`h&Pb^7)yPa{jjwJ{<maYGA(d=c*s28H!zq2f^$ru3y<Yc}xz$}n7z)Uia%_j^
z!K~^lFslp+J#Ni6K*8iwb_G$d7zUFmTnh?P0D&%bGzD^uOh!)}X{A(5s?KK^hpgPK
z6S1-Pn)RIp&Nh{Iqt;if=E#XPs)}-}Fk$x$anX8K={?)ay&)HmdV6*+%X1UEiOFL|
z%d1r5RNQls%nO>LHU<~DQ$p@h<lj)$FfD+)F^`e^(OP;(>BT2LB$It4U-4D@oQl$&
zY})B7IgPp{bJ@2>E5CW3jglYL)GeV$Uy6ZC&@$&tE`Ivt8uk@>sv3XiEhi$8)@wCg
zk~OV5RyI7wSIpcitMZkzU*SR7>9k6;uu3A6;u(gDTcm~g&ReZfew~$-uLhp0X$P1o
zN({)Hwn{By`&5e6G_wfIM_7^-X>YttY4T@$4ta*%cvBfL{?^?h@EH@6J!dq_5B+ld
z;R+LSlj+FUtL=`WO-~Eu07fZLO2$}u!kFJ1@taD)JP`=;*Q&|0xZ^#K)Rk`SZr7SD
zT)m6Cd{!-BBM6s;@ap6aZ9SkSrwW!>To%_vd44itc5%K}olc*Y>A!Z=a>ur7;A8rA
zdvPX*fq}gg3x@NOahTM@2NfG-_3{#S?qAJL7HfANc$G$fga=j~N(SwB(odz59op3l
zvxZM4l_?h7$|-u1J!S9u`@)y)g61y$tl`g6V>_QOO3RvGPupHQ|EH4ZaVAb^?d)B#
zCYfu-t}><1sLSh})yDOPV)<-pmSw1$mPlFGo%s$yvgd+R!^zEOg`!<J;a^{R124Xu
zZhCzw%>lPV$dD(B{j3W36)!LD@32uW3x1+l+e`(a(Bf^0I9$$1=!`&SjbOKSmswj*
z<&;17)~iRbB6MlQuHWngi~QpyII+LKKd|`12sLXbBmLOh)6-ih3!Zo+_OXq7W&0~u
zzsdcF9uSIr=_9nXBN!nX<2=EnR?W~_jkT<qIWgF(T3XLavCevZ49Y`EUoFqbI3q=}
zy>`AUlZ;fOl@<tFEeE_5Yq9i8eJXr%w=FocPW+!GNrxRl;y666US$Js1m9yDA`DpN
zKc+J}h<)fEtIlAsbBlA5Q_P><7-13gZ}?T~`(hj8t7EAwE|ac%@pFBEt=Yq3`pb$m
z?FSAyvm|%AbUUU>3-$yj+!vmwP)S!1FE>mW&dM-as<aTky!u)9bM?@Og{$W%R?`9F
zgIm0DImXF-;8F`yV(~fSU-t_RZm@m$rQj-Esmy#wYGZt-YHqFGGTZLu-RuH(Mq0a3
zg-(l_Bq;sqUSGMYSCJh&vG|>8mvln@^8G^B&3ucdgx}W!K4e+g${0R~GCWh)=J!qe
zjblUx;eP3d==eu?Z@#XiPP|svDSAz_mNVyz?AqR0)Ym;ZA1vO8dQreUTC${qjXD{1
z2E$ase>Y~XO|)bX{jG7n-y^h&LUHp5%Hl1Q7D~KutoF=3iAJ;LCswztTu-HbtXepB
z_LBG_Q!e|tcaH2~Pp%VmLTjDA+KE)9<Ac8Tv@8td9}9oFC2`h9IQb+}N0UuWE}-9N
zcHx8ZxbGP?c~;|2+}b&Q7zTehI5f6iZq)Zxrqe?$u<B2cHXNQ@sIvTcObMNSot<kg
zC8W6j{<(p~U|WYbPr7PuaIZet9U9a5(t6~L6PuJaRQDoE?ms}(oG{&0_b=qR)fX+`
zN!eQ$y;)i^?t@pZ>V|(5xSg!GtIcp${KBu#nTjKlZFGF6B>EtNtgAo>=bg*(Rd8`=
z3GUh0O__hdwKg8~Yy+O{Xh#0?U^p)Sm|m5YmYUJ|JESj}Z*%tbOcS<*ti4N%Y&TB?
zcd1U#)*XDpzWDUvUmVTkofkRU_p^qDqSTn<1CqBx^0V!0p4$_W_8FI|n!wibn?yM(
zZ-cMPQ;ot^`=Izya}ii6ng)FN@UC9E+M#~q_+joSmzRY_@ji8)r+;_mkYV1r<?f<Z
zX`lCx$CkGr|2&a^>G~kLknp6!+ldFV78I5;awR_lRHtv=E4wA`h9-)S)s3tqIt2FR
zI=m0aJXCCiHB!(?gC$81_KxB<RLgw6{O${KzA$md&Y^YNn7jDZ+Dv;LmnO}<i#fr#
z^J^b9Z{Qpt(gcluu+)>fN-GYvx^Rl9n>aEUjXu?Fj2adsPI3;ReR(X%XG%||1`S|#
zc|&J;#qukD2yI@rTgUKF0^be5SlgA8UFeBxz?I~&##BskydWNjBq<FfaeUtozjVny
z$NC{B_vwF1N8w-GS)3i2ou<pq2L6o+<W#WE{M6;)dk!%H?g~FPcJ?*?)2GK4_>TX5
zJnLbTY#B2t+XU<>X*Z3GCbQyAXMY#ueM2mH##|kFh_dfcY7qcRp2X)4dFPgL?f0-;
z#`A{<c}Hd1S8*FE20PMg{AIkspAIVsuoI)~(gz`Zr)@Dgy`g(sS*z%Qfu+-XRi17W
z8!8S*Ek$s?pOF=a>-EX1ww6uxV*3{731xe%OYo-_Dw{#g1XP~=n#NV!y4;tcv;Z$P
zFOeMOf#(iKGm#vN&fh%tg6~HM_>?~N3>o^KYnWY^FnZp~D_1o1L;P9&o*#*B&slS5
z1E)*)D9V&EA3S2HdvBu3^^{WW)ijqbuSl>42vvfrjb!7N$GaB7D@vd|`&|p=uE;Ya
zo`Ql-b&XhM2t}D4ZJZdZzN8$YjGLzA5j!Xg5bQjBj=MO|UDm7E#hYii)lmDw1ApkU
z7re@u=QQv&w=SA9ZMAaM+`y+17cd(-w{Q3C<NK5c;!9plJu{gOUUN<O!zuRVhX6FP
z-wQgW#l-bN_79F!6<ifiawD4-cI*Ud(Bpw>KlC<iza=Ku{e7NB$k@S{NWsw8N-m6E
zN?pQhHQZN8O$ot28W@<q>#%PT%!50e-rtr_;vL=k{bS6x$I-oYI8EZ4ldw@)o9~=Q
zRCCwd_MN>XF{J0SW+rH^X%E+E63(YnRuCpAUYs=TlnO(K7GpQYp6<gr4r8zb=@bKu
z-l-qy!6vC+wtSLz97rWSEAqED9-JF>Nxd6eWNsY?)-mI|JuL$c_d@nlhUvTS@{AJD
zPrVX<q&wO9Hc`_Q`}Qd-<>VqML+UW3YPGCU5^3ypv**kq;FUXK@+ub@dv~_?Q|p=>
zzJ{_E1gIUZ@$YR-P*;seH}L_)k39^YyS$sc=Rq04#V-7?(}0ff&NURP+mq|$XDF2_
zjxW*AIY(&?jDwODiwk~sOe3>9g2H$HsN32~FKeSyYxkc03B>k-jL#F4Ll9<li=ygm
ztm5syH3q<0p$0^6=;77meW&aewf9tTAaAq@=@WNyR$d<F5__pp*MW?r<%n3^zEaPq
z&0%k9(L#kjiLK}J9pp@-mC+9{D>`^W?8lM%{{S4~)<nr=-p-{ynLfPK;dCeKl7)pt
zYI6V*5d#LH_@k};(i`=~LoEptH<MaKz0O^_HKE*OXNjH8GV6k-_Fg#<3UwMgddcC6
z1B<Pdx!Y13Jo~&miAP_2^~H<df7zuQ)R1;Avp7h^`Q~4R%f<g#|B*-jJJ6tE(3gsN
z2)vKlK>RP|w;@i19)j*SXu0=;u@8lOGyxQ&6)7#Zh-w@HYGXOkE#LnfTV2*d$XYC0
za~vdmOr(7EDcc}**4$tFT68eAOHWb>Y$zyj`X0R#^3@JTdeOTo<pqv#Aaxs;?V}i6
zVuJE-e4FYxC|j3)5wK>A6bw0h!@f`XHak1ZJGik?TW6wI5)40Mz{8$57INDRK!`+%
z|JXD6bKN}sFNx#KePOnFE;>PZ?PXQpmF^)T->x1k<?Sb>fo;{3#xFNU0T!kK5gEbg
zv+pyYeqD4i5A*k<RI?nX_^k|XhWE<vG0JyeW<)49qFrHQe+<b|>vD#&ofe(h9#zWr
zW9E*!k)HkcwY`w0KZtz~9nBmvq7zT!-Kvz=2v0{VEZ)CwJB8`*sebaAsVk+Q@chSc
zMYX((1bQ_t&vMW%8pXe=*%#&T$-nAMb>9tzeVsn^!qrhj(dP@HYp3x&D!GGJj`8m-
z`1pX3fmC^BYPVhdOA^|1W2+e+Y|ks;u<s(bZEvpb07mZFcL&r>-*20LunJ6e;vemm
z^HW#-6acFoAWJnS+ht7FdE~*8J)%GEKjQKiNyYT^SX=NZWZgV>7m8bS6pbNdazD2V
z6n{UcTKjC_&5mr}eZ#HkWNyTDX&+_3HWs*nv_BMW()OwyfOn2cMxO>&PY0n*h;@%`
z-$6^1VLz+*I(F<*C9yom@E$MwSCV)9vaS1v*$<1F(xg+Y<kPI8o{(2D<kd-s(;L0A
zE+<M`x==T6E0o_0889&$Pfp}&r06*eL&fBYdLxmWXPf5&9h25COG@>(T-&;8`a`+4
zR#R=xzNhDUvr1C5^~RI{&QKhv3d}76&rep8EI;0|aS;6`wHvoei*Ddco~*kzuC7$n
zi{jvoS{le3*tbW0=)1zQQ7oHgOqKo|ZRr+^{83uf=sa><U=qKS3?rj4VzXT~CNa|1
zhrdR}%5Ki#Qfz+fs>t`oChPHt_T$grJMy#0{cJ8~S=h)U)BB{!JRonZDsiKWJyncy
z1eT<UL#Zwq;$^3YUO(x0deYeymm!P)TeC!)-7Dv{*2~~O)QL+Ror7Nz=<-i;GBYc8
zR>&I>_i6R`Alzj!UUB3%P0h)yrsHwW%=uA5hK$ncU+mG!p8k2Pdq36D!J&BCN0E78
z<&?~B&-uW2e+bIcogQhnslF>IjYYfID+{B)eD_EzDX?~whfB6#$pgE<Pd#--gGUq1
z!$AW|z3;a|y7ujHZ_O|Zc5ZJ;cb=aO*FCEwlo$7SCSNI3>gXVka?lT>?7%1lFxKl2
zk>f$^JNAG49bx&{vewl?^ZfjYIpLob4`r2=;XVsub&uMA>9AKm7LnxUdOf?A7`(9J
z+)|#?w6y(TG_3`^KxkYUs3m%rC?mkW33j87<p@}aKjE_f1xBf-gNb9`v?h4=tsTdE
zCPRl2&Cu12jdEf6&IZ`wgR^yxWthqRPRwT@yKHKd-Vga|jkqGJ^*{OfxAW`@2lC9}
zO_wJNa-SBhf}w`|y#_>q8?eF+E~s1}v1Nc;O-Iv;<g?h9Q3gCjt_L84XV;G<4Ewl!
zMvOkol*v-@>=Wj>^+@@Xb|2%8Y1)O@%+w~V(l8Q?J`Wj42ZWS_XYn!C2h{yjDc{h_
z)qC>O^>&QBLYlzZ4Jgf1z)#~69*Hd401qB}{%ky)=HB8{4wc#QpY{^DXCjWb$R%M_
z;{I3`+V7}Ad~5JuN}tJcdN$55Lb!x=LLi-HUWv{kp(f`TG?~MNn8R9RVK58?U=?K)
z_H&EeKpIM$L|k~qLo@A32qN-AoNNSlCqD~6)|(|n%<5v;W~_p*{9Y2^0$7vqyp+h^
zERPcKqz43%Uk$Cc&9E>>gYGEJw$3yT!O;<BB;0b^7b6<8Ba#Q)JbXMPMBrwGP!Gc)
z=a>2xa%K>P@I~5ze$<+YL!e}q*ju`@-PT-THV(<k_#YS{mQ(4r5ozwqp_r?ch^Jpp
za^LChecNy83X2I`!e*x#L)^qfbCw;<cokJqA0dokE9@kIk4hWM*HcfwIvI}_oVNX`
zu0d$y0FZHyHg=`S7bWt2J?Hy@p<{GYnUNQ+A`=n~(UM=<Ek}lE7dr;W7Qt()Ygt`Z
z7EUg(qUxQ^y5vuzc}r2il7OH&wHfk?+3K}!TJ!-2AOP{6ao3y)Gv)dv9DCwiPiYM^
z3X$MGAF<g*9DfbA(iDmx#q1;nxZY;ZUL!^NhWdS^QXzVyV2*=4UME8St}9Djs;-1s
znD#L;GB(9A6~ln<d3t*QsDF+;{GOFw7M1))rU;P@qQ?6E&;Ahcg&~Dfu}Gnsi*H0`
zIKxC+CnMO|*#|v83F9eU8;UM`=N?~5Oo_Q>+qanY`-$UX5m(6Nxcu}|*D@RZV#6E<
zs1B!(HiUH>`zyRN#*ydo+q+CB`f`NmghtRJ_#8)f)r#D(lw3W!cZT6-Mok%=fSGXO
zKF!YrR#jo_7p(=#&}?I5?<Z<Jyp<>4XsKW*!FI#$>*Vc`NS_0<jN9GqoLa88sDKyy
zI~bjAsr&S_kai}Qizen>Yn*iPK&vC~hs17Fivt*;@x&E%!26Ez<&wtey}SEYgfkXW
zYB%EDj)4ywQ`bmMU2f)?rAym?<?;^toTfFcuy|w04k0)mebJ(?jQnwyNRtX*U=aa?
zq1z{dXIpo9+eFA$z3@8yyK7E>hm=wLo`Ac|3ukVZ<tf`5bHZN`jYIz2l2TM4-l3ZG
z^5^1oG^d%;*YdKmEQdCI*%>gkw;V^`>TAzw$8mQtMu*?>cXTM^YUWp|x|DWOKRzW&
zt<xs8c_-uREsIkwhNfu}RC1>Z=k(6rdIKOjHf>f>M|xj<My-O@isF%B*V3-E3pk!O
z=d>$jVtxqQLnR-$wJ^CBmmEi3eOn@mpq)-34FqXcGtxb6x%NT0ti`jiyN>yty4iWp
zYvU#7s9C+3#hkvnQsn@#s4+yk>2pV+hn%I_qaW*Iv6){%;z2OQ!SmxHh$jPP65!K+
zy}rKQH$A(a4K)h*J2LQI<NHsd9+z+`huOzqy?lXIMZ93zb==*BhgcW~jI_Dx-n=^!
z|8Q_9*;)(NIPe~@5e=peFR-$v9)t*-;33K(kU0Quri8f3d_5<|8yvv;IE^xl>`J2K
zWFj9LeRMn(<y{QR{41{0rW-@GIO;TV4Y<p^u5+J?_OKfb|8thF?A;^)D*;1+uM`v-
zfa`Fd3IR}5_fhx^#r+>VmO}a{74kbL9wN@rPOmbUVIbZsx{yvNNU)?6z8~IXsu=g^
z+$X!;wiSU9kIZXJ{>y*XAN|SkNaY<_X-@9GlCJN;Y?k_KaOkA7Sv8H;uiuSABYZt3
zri1vWZH+^WY^vvioOmu5EBUuq6?Wa%kTbkHG|-}3YBOMe0f&h*HqKUlSuF|%+6GaO
zh1>2~@m(lVq`oec!$n-3Oqhcm5=Sv)Ol9K7x;lU0qz!8O=+R&5!Yl}IP(0vAoCl5u
zc21psi42x=5!^yN;H3A~*S2ohxZ6bsIamP{Qs-iP9_-*X?BKUj(=0nz8RlFs%$a#2
zN;6O})N|kA=m34Rof`Ie!}h?*-Tj18K+X8LMPA+1e#4gyz=h60UIw_!5d^v1Hs=v=
z=5$=)>9ReO=-npc*r`8)jDqV(wo(m#gD8gAbr0?lGA_*V(Z;(loF_1Vah7~GU<K`D
zD9B4nUrnfgAZ*5`GIc@m(X$ef_~D4AkEEKGdq=hIZ!$VocfUzBKt3}KygzqL^CXcO
zb=5>YaH0OE{O}>1nHD%o{EChZ_)(q2mfP~;8b5#ZZ=amX0zd<OD!)a9jt}4olLgc>
zh5c+Q->>dBb?>HOVfm&j_0P0v{+9VS7grLxqU8?j2SUDKVTJL?KmJ^YZ~^~S1c@tj
ze*$%^L^)tI8Ti2xHA094&JJPnRnM6)SXcvx*?CTi5a}8gOYSxZgJcQ(Z|dg7ux~wr
z?tb<8<u!YnDzxhlcmUXqHcFrCF*<vzoy}Q(Rg<dm5vQqQ8UT!40M$KV?qz#nMY~H(
z<gH_bcrHs>>znESoT~z$r6_)aP(9wO%0Bdh{1sf=Kr3%%a`UI0j7<1)xWV(^fPk<D
zHo%wZm=PyLN8*UOTrA-_+;(+v$K53==OOSjcP}gsNhSjSenB~yeo{}mH_=T2#J|7g
z*L^th^GNydBa{$?=H>p^#>KtFUBIrBFq-e=Gh6JrruJ35qdmV-zzo&2n>SP2S7Nt7
zcU3s*fA9~@b|YTQ+7)8UHO@(-Fxepea))B1l{~*B0{xwvuZzsjH@VG3osF09v+>`{
zxLOh(nG$|x%oHjqGgk>*vj3^9^O<-3iQh8A-|`D%(DM4%p|s%^l<?cu1G?&BPo;t8
zscMl33%M@lvijo<;d-^^V|NUspCMg2s9b!a&YXQ-ij0@C+NTmgvOxFM1TiALwx*v=
z-faUOcyg@GF4HVWD$-l#JLqUg#QCqU(PZENMZSmOQX;{=-QG$lY8VN4NUCb7)LrvV
z2fLV7obLa*TTRk`<IU44*dtz^ut}kZYhbG|1uVKOj@mLw-?o6qv`<gpIc&`JEOo+z
zQ1N2&6P;JFaj@A8`#2uPj*+W)Py6p*F`In&kDKAfL_9ofeoJf1;QNG2f(`8XV>9Yo
z`u+mO!R4~#<)tS_IdK9;)hL}!QFEL8GrD!wjz_U9HQ-jK3@)@OnXz3t07kb%q!o}k
z<2<t-{6#g^04u0<BTMj@)5Ibj+bZnkv9}Cuw*fb*zl2hOCgshN-2(!Yv$C^|x+!r;
z$e}B)C8u&GnKc!8`t)X1^888TIPahI|M8F7v9Noa7A3ULHmpbBG{+x;yUMU{R`#wC
zOVYxXszp$eFc0!`WysUNo;sOd!f)Ey=QNOellqzqM_sxz94)mQfRaV~-CZG`4?#LS
zyn2CY^!gx%jHc2^C|pq-u8t?w;);NA-7zp2Mw|fSmMQl`SoIY$kggILLbl70>MZSf
zWkS;J+sU|4AX$ObeMAv1vV?3=;kdxs3d~@^0_)Ve_}_i%e$Z9=7%-6|mxu>9nV04`
zd)iscXir*@IrG^p{zu#4ObkP43+WzhbR$IHva)It&H}^PEf5{<EFa+Wq3y#Zc8;3k
z;3LFwgICw|d*5tICqhP^%Ubwp>Z-!O$sK2;ep6ALbqPQC8bXtl^8twv5OQ`TTl?;?
zju?A}JOSQha(_iNo~VwBifDY_2h9~)e8H?Q-@bk7;7jS9C{2I?Z43$u!pxH~MUR!m
z$m0M<%?JH+XrW$~oMZY}M2PIQ_6-^r7JQ1p1*HodwWfx;A(S(EcdTgS<>clbAnP|>
zz?VS|K+Fi!cssN<lG}+KWtg7HnL>VMljonN|M8FK;`-C<j=$Lj_w8N2V>5g#^6AcM
zHd>>`-kwRUz(Fz2$j7h>1q7%J23F&g=SKhlJ-^d>A2l*+$*S+M?jkyU_JuJudMow$
zMTsZ~Z^zqf+^llUrjU}jl*n(CEA+BY5)^&7#r}QaioB+}q?0tIP`I*;VXh<XBR@Yy
z7A<BRE}m7oBoD1&TvGbbk@k{S1d|ExFXV{-t*pVx(4%cB%J%0~LD-)?QyvOw12l=q
z-%O!1Od2nt$3vP{rJ`Km6oZK6E<~U(>Dm|%fGZ7NBXp?D`)?3?Q_sVzK-%FAJv}{H
ztOuHc*PO&1b0N3j@)YdEptj@91|(6PtN&v`i?YaB^&J~K86M|y-l=TRbMUHssMg&3
z$_X}9sL=O-eiy4q<llLF!9(~*ABgiLU@@mx-5iMk(y=k?4Qkn4Y2tZ~USo~w<eQHa
zB-vB~N<+_Y+`8Jq{A;p>m$B(K^Y6`1O3h!FuH{xi@ODLLcA9t(^Vp)@Gb%RJH$^y#
zMu%j|fCr^m3M-EL6S$)kn?1w7CctU<z^i8$1I9HE?d;kqF^8f=Re)~vY16I<e$}(~
z@{(xn7p^GS<&hoZT(x?S!@V`@Cym#OW1<)GsOVv0z(2m3Ujg`)+(NBzK@S5ANq#5R
zG2LBg@^MKFq#;AUD~n%y(~(XHdMK3Ob3{<+-3RiFop#`Cokv1#>T4W=s~$acxW;S}
z(K1Q>Q<pFG?V3w(Ww3@lVjGj`dt;kqy*8sd#^reI1NhCbxi@WnN!8_5n)KB6-W@g%
z+UmJq0ct>`dRZgqTicr%c5RrwNDhtVjpT2ilW6w6LCAPuqK2suhc^k>M?r^o)f7|6
zCJ>hr+i;t^_XgW0nrQML3PopFr3pbOQ!BH|#pkE7B(%vUY;=6UaEV_8Z`<$g?(UPm
z#-7MG`_YV*V_FT6@Wd!t;NYedBQVpvuM$AjSni0~E%i9EpA3E31;VRS7<*x%!U1W>
zqw|)b9Ir!$#@2XULSaA#CGlsc3<C#p{LzYl;i;(y?{U+mRq^pG8${Ms7_izI^zHH<
z9l={=_pMJJF`Fd)f4yEj@(vdbZBisC6+fb(?Q}0(l!JEaugO0ohY#Ob7P`-!E3_Ga
zkH7e;#;&xy?pOLpL9Qm(>chx|xIpECqDP+}2(`ekYPFunJ`VpJHQv$R>K5jBqFmrf
zwQOSL8Mur0xuXC0He-|bP<Vr*2Xt>!F8a}?LKBci6|<e3al(*m()FCYHgQP85vbcP
z^JHl+Ir0$ohPy7SIiBgEu!Jm@JkV$uUL*Ru7ydjGLs%*XvtAfEK93OZvHq*3m~{(~
zXN-B*8!Jfmqpd`ak<f@<sl4Pl(rLFtQo={^Jz=u#8gW&QixTy<Q3D6asz3du5rGRS
z3U%kj$TGAqSZ0rpLbOiZ=E$c0u2qf~PyQHU4@K_e0m8_i{wO^4-U0U_nMn!azC_SF
zPVdlH%c%uD#%p0`uh}JJr!Q>w8azEyl@qit;Oc-Bqidr(Rghp~NUepmToF{+Vd1Sy
zye-A_M=1ss(~+Me+_0n(r}$$+BXPoi_;nyqS`P(%$yOa5$v&1d9os|iKtDlAhia4T
zQ<2aTK$^5HyTMa>G=Jv%gUWxXk;RkHz&4eXfetts9M;A4!MU~vOl`@#8&x;03Z!sY
z7`3^7iR0i`hOi>>s}3hA%!8+I9{nS<UFTF1>N}S1avIBS%fTK8^sg=A@+CjMSL`hf
z#&h=9a*DI1UWdFA(rEQQZuU@m?moxlEiY)-j9-z(7(Yi+d(CFgw<V<!l7OK7*7I3D
zN0~2WmXjRWT`l;UKPrA26r}_u4D9cB?UbR?>4Vfg&8KE89nY1-mG)p;aT`DIPMBE{
zaj{#XaX-?fB_{2D(QnnR^8Tm`NcIb9w958i?#i9Ju~?`FpIoc2xlvUeAFZ~RwNQ=^
z)g<k-afE*Fx^P12%lgFjqvj_Gy=?L~j1B20#2&1qR5?03INwhd$XB=d9@ZA=h(2-M
zBFBOrVxi!(&}w9$V_8K14=>_sRrGWAnq;s!F9R3z6`IviKzn2{>+?#yr<NLOjD^fv
zUq<TO8f4GD`6gtvaoV?h^(;ocFwO-B+bKX23n+v<@((1jWHr$MTzQR?uVOZDmW()z
zgtj{~hs*lV>*d}ONi=gDPM|yxd_fURg#GyOWBmK~+dxK_HVmPlH7+t}PFG^C<uZv;
zhA76CBW@Q@wy>D6|L;D(&dCP}eGQX$1@C^VzqH6(ps}#A`l+NSt<+-_UDWbTcUAfk
zvR`2|z?N2vmT_|*M2ZJ5YYR3k!=DF&Q~z}$gQqzbwOjIiCO4r1_xF?1f1rhWlyt-<
zL<7CFmV8-@e~bdKw1;kGoeJz+IuJ=isG~HrMNDJ%X_R&_UVcX9kJC;5we-q>vr(NM
zQT-c};uJ1MLleYZ>^D?36IsgeP~-#4sM1TO3FuZm$v8kwJnAgSXG+JEgM3+aZ+Dp^
zXkUInf+r^rC(l5J6FgWk`#PHB=<GVsv(2_t0p}kV`}1_Y5$#BF9TR(Qib8Wa@!;>I
zitWxQf0J=hkK$a)A}E)2c%*U|>EE3kP|^63>%d0oa`<4?QZ0W`t<1sUC!%v)0q<mA
z)&-^9Kd3t*4TOd!=b_rb*5c>T`yYr3H^zS#*3FTaqTh(!`v1T(NnP#jbduqj0vExn
z*b8Q!(4y|CgP|oLUie+-MZ1`*trwIXIsjnAAL4{x>6#mo)AI@1u9EmAV?Yd1FI;sR
zKg!*2S~3LVQD+0v&JvQmRDM*ScUT_}5sQZLQY!q8enT~qGgr&!j|oFU))WqNIv3oc
zTrI4vt^1n|AH$dGaCTc9OCsbpB8NK$fosMsZ8y~s2h_)pqJyP+Vbr?{oEY+to<v0>
zkM=+gO(VEDWu!baT;ylo1|Nb8<HYFOv3gLKTJ0lofRM+C5VcEodDetgxEC{}Io^%M
zVw*GICRFy~Ngr^RIraUG1Dn+ABrjvw(cf1gYIp*Cq6_6e=@qNQ%?jeR3UJ5?x4MO{
zld0!6wmV*}Qd6;c*Q%u9U7q}hEaEYnb3t>Ii@5<J$<}?~4jhx7?sPc`+vCdR?3;8{
znhtoMoEUAwF%*c3Yob|tmD~SKA<jdFt>Q`2T>nwpRAOf%T2OyN`2kBLVJc{2DF0E;
z{k`CLm~#ipE7OyI|E6+kjNsAo^&L-8m<eMxKq)fwYEvT5LOIH96bf7gzuOhoesw;%
zvKT81g>?p=hHgOoNR!HCP<MyJ)fD=f`cvf=X1RZ^e%WU-(}3PA<sYkx&qJx>luO+(
z3!};dRW~!S`)*s88hKGI!9c*%3n2T`p0<v8XCHQBe`yvxu5xPkCX)_~m|xB&yuFiQ
zG0@2lam;#oD?st7<HF{Y$EcHN)Ms+2X^7V@p`Ev7v+A!wgWtO0<aUUApcnXFG4BW5
z_CfLmrn@F_>zxs0(Tu37o#$k}r<M0PUJfhPksI`egH*e!`rF(0h4|Fo4+~Z`3Telh
zLe1CgnM#z~T~<ZP7y@F^Tg#S#-S-^zN80aTN8ZGrQ<M^^<PoV^<y6mUA=~e~#?vQk
zH@pp{LU!l9>iXGI*Z$54Dtp?jj*X2utWzZZZZ-NU?RUJ=6*<2UC|o4UQvTm<CMTF+
zY)_)da<%r&*j@Qch1YpV^MtXDew*=BQF$fj^zGqDfIc=;Q*~ex<k0?Y4Y~K{7gMpq
zF2W4Ok*4Q(m9eTEV%h0De}y^mqTh2b;4L61%zhcs?JG4M^gc0~&><}@=P(x9o-`NI
zb<UsQJJ|Em;$D15<L-#%QRWlT2P^g1gv$bVQ}@K9Kl*N2p|6)64km{_F=)ulDjthI
zm1;BdO?3ltlCdfn$~H7LsXJb;rdoS-9Z)>r+mls)qQ7dU4@xG!-vTRnq9=1!1ylgA
zX}ydF9n#e=u2*Grid7Ns_NC3k+J(QFmMGQGd5OU8Ysh!IOm>0L`6CK8@$aQnlM2Fi
zWBszoIq1eTi0eM^!7H`TD3_htz<~K7X>YV;uSU%k%DKgc4|ZK>ErG=EwfdfX%4^dP
zGMlnMIU}6@pqvgsZK;nGyBJaH&F%8yCr+yIPo++Y%4Nyc3NsB=RhRWwL($REKWo1J
zm^t~?-xIx8Q5R#!bGsd7_u5YDbkz%E908DLeCNPIjiZqQO5V9?Cgip%W=EAm0Hx2s
z$wlx+2M4%MDB(d`rrXg{;i~bz88RYEiet@qwV(hq<u<C-^f->aAD_I+RRoNev2%|B
z-zz)2I^IuV)ak{!tKR29m}3RUMfkz~>o&W6YhlDfknokt|3Sxuv_zRWlgkOBbh4B$
zAk~ysM*|e0ae{BNb9471zh+;5pGn&*{Z*J#oWt(fX~wlgJlEt+)BuCBOtRXx{+;M6
zcIo)t9)xfPIvjViHEbqKO?T2>$tK%UA++?%kD*H~0$y^o#@q>BiO0CoRy0^<8Oh5M
z?oqsr;R&;+vFDg?Du2O>>C$q0i64)!gR<#J`x#{`I&^i>$>O`K%CC=C&5rx@<Ey0F
zJ>p)YQ{&U|o)&1#(|yM!AH;aGP^Rz+{=27`9~@WX;JVwnNdY{X9E!(pGcnI9`NeUs
zY?dd_iUOyx7BS7@Xs5}r&NnG{Q7!klU)<yV5SJ1jo+)8jEAPA7x-&PfpM8P)RiXml
zo`CCO%T-7#LsLoNuNjnXFhe0U3p@|Nf}7frvV>%M5;koq6W}B+<@zBeS9I5h>!d~N
zmYoc-mXp$SIJKcM|I2T~`9jIT!2vGtx1lw$oaIL|Z$rX}FN79w-r<%o6%ipWGMelk
zy3>9R>naIz`r912dUjjtEEYEJQX30`V0ewC0Mtb_RM34r;-hnx{!*v=2rmzj!nHfc
zI>@)OMx7<;T<3J;m=}3FQ`^OH1LPA40GZ$o><U++L&Y||Zg|Ii%dLukhqu*vE~z*H
zxSa{@ei-*j9X`kKXuU`3t2*N0(UxLGg%?FG+c_I&-(0SKWyezGy0ce@nM#zWs{R|g
zGST8Z-dHUG0ti8TEsrlMF56x;+Xj6~Rr@P8t=uAKrx#YJ?m_{ciz*jZ77FuC-=F3R
z9_H$W|0=6q5W_#veftC2FY%xlTmCo$Rk1u@nD)sr$FM|-jW1h0sP?y4oXL4<iy#n&
z_UrHI72`@e>R5&uRc|xXa@=&~HU8C>9jgu({KhO&>;bI^OV#6V=ey3wg)Ad0SYCKX
zS07wb^TDhU8xC<hx%<I|rdtCUa!%y_M618~$a9Uu-Ur_;$t)vCz_J{a361ZBF&>;Q
z2Gc<Vh$xaV)U>D|X;Z>*bq>9$&!U@>qQ#+<@5xHa%BPonJPt0xmAC0>D#@ZcE}xZd
zQ7_?h(FaPmwCrOuPPkfX(>~I#@QZv?=<<jVk}gxDcXRj_$Dj%`Q(65Y9}FEg^XVnc
z`wW_gADwme?aW+^S|g+j9{qlJLAbQ9KZ8XWt!S52#A5?p`z?>pHtUq?*KCcfIXgt_
zWhm<Pvfk%Cr-$L-gH&JlVXj|es8V>4R(8}To6@}}e5XqL?zNTGoz%*3{Moo~wq8HH
zI_`bBBo%UEgxD-}zaW9Y<Vm?Ok_#rM_fA@whCKgQKIHEduC)7uuKMIwxh&{1;nrUd
z#W-(%_m`2DesK=4sdK=vte*}tVzR;@DuWdh=J}m|DJC9OW@HT>E=Oa(izTy*-_xf=
zUhBQev?I&WjW-P~!d!&(<%<}x)$X-4T+*RbZRCO=AWDr|!^tdKiWra+F^U+os-7!b
zDkVe0dM6Z!f2ecmB{$*;l&3E^XjE~Los{lfa}khB7xMMrsO=>-1?kB6U0(wnSd_dN
z27KN!9B0>B?XISMtpv(!UeOfsUDU7F42xxlzr1XJf#JBrXb^y%tq5@S^+{fh)w@K;
z0al;1k7_h;|GOOAbfECf*<a{;#Uiy8)k|Y~&Vb)!78eTPF|E1su>HcMPG?yw8*40D
z>FKm-r`U(HbXSJ9?l4@zc21TnB;Fk~H8pyVvr}?NDp@Y6ZWQ;qY;KHx=!IJ4>5aA>
zZ~^quuOOy3j?`e%P+GGqZE}lymN}9UwEZ=)L=)~UZh8(jhW{0s#-^*u;PJD^?Io6t
zM6gz{v1%%!25Xw{tR^0Jf63#d!`QnVKlc3%dO_B<Z;hHmnKoHA_(7yBkCZ{>oRuGi
z3lhSUvnHr^F$vV>9I^i>0#J3slNat1M-E_64V6Euzkj!_nJ>0$El2izUovEH18afL
zU@7SUG~(m)^B;H#XpJDLy|!(RB@0rC)N75<b(x;ko+T|P{r{%<D4U~L#&!^)vd#E%
z!qHRR!LJR>)<Q&WL7oY_Wb303kAAgY35V0rUX$C3uJ@DemDU9)tPeEZlP1D;m$@v3
zYA;WC(D87!l!zhn0)z<HTHANKCrl;U(0aknzsm2aWV%#V5`H!^=G@~qZV;Wklwbke
zpz7C-?=$R?GHoL&4LK?4rwhk-6vH81Sy|}Q>jk+1j7Bz$4(>Q8EY%|C$|ryEfic7*
z+Y5#1O9wc-o%6SlH_;vgE*EsY(CVPFXy(;-0*3y)ouvWu%&X8k+Ev5hziGNU)G9hI
z$(V|)CwR??n+aCYV0Coq#lJGk03XC_paYr@NvlrI`1^>Cr5ZM#?|f?4!~M41tg#v`
zPnvZZW(C&JA2fAm{7H2$xU;Ec-!EWVT+E7EBL+4Y5rDfhU|EhMHKa*1376=m2PL1s
zMw;99kYIiiOga4X2Reczd5DoSGBb<n_nh5;NXm*I5Tn}K+U{5I<qAL5hMd~2<G79&
z6qY>qe|lyt8JWS|x=7EVHglE@z&Z_|`yP_o#O}A2NOt{*dxw%Ri-kXmRNy#Ut>kqq
zNsUW!=Fah6i6@Udp%i-}IwS6V?sD5+7lw<cooSC#LxhRzk*AxA1qfcQO>CE?P3){s
z36Ot(sYN;whU$fK-7{^QbbcA*cVfx%mw8Rmz0^<}2WA%y9v%=xC6OqOzZ@!cpCaQK
z!pLLBHWIAAPZ<B1X#I@E8|^<)i&ii+#)nH6LSd)M&$416KRwmCytj~YhDMXBzk5P>
zHe%Iov?R@O!srtXp$VuXn}v&^<aq$0z;GIiv(9sYI?YV-YRq9`UR7ItcE^Tk>0Jwc
zJ4Dy_S4WeA&Mese9tPHlCi8?qTVOy6ExdmV`|+;tqNkT)G2HSrx==RY?lAYiLM&<-
z0ogLY=1Zud2N7vP0e~!g<D!^YQ`QI2!UfPWXt5AaM-VRZU-81~iSf|N(2gKN>yaLA
z7x>M|lo?UMgKig~5?plhqUI@#!qz1~xLO;YV?xoErx%9W>}uw9#ZUyjAR<C(l*fOo
z2KxJlD@Z<Ii^_-30|Oeq#CW8qlM_!Vgfc_y&6z8GFjx-CHm)GfqZf6eb=EyNEyVxO
z;`#3@VrbG~Gm%UjpBCw!eTfP`_7;e0akqc3uD%xzXSs`uD;gc+>1BGEWbwrI_B4Ws
zjU>jM3#(ak%ECc}Yyz>22P|DW>?qw7_#23&O}s>U`l=)suTZV#Ser}~bs#`+d4+`D
za)4ZaF2$viJ|_A+Hr^huEZlTyLeTPR+m%=KTOwAq>8<ZxTAnuyT9>*NG}NkdC2B(d
zMSBgWw#8HK($e%WCQe3ME&)4E29@mI7Fm-MOTvGod*yVM1rx9PZHVOyOQJ00xhmk<
zM(C6F`;T+%)UrS=tyFhKyWzB&d6{<ZoK?NlP}Zs%2njy$N*y(_Y4>$gt!3*xn7>@s
zRukthw|a9@a1^gx<`yBfo^x1@!&lGqmvtU_sc%ai{3zkH(3n*o8rhDlUz}5JSKx#!
z-LL=f411uK&byE4q*G{@Wi?IJLk;Jm`LTyL1DL!56<JO8*w&gg36r9%U0((|%X-x-
zx@Eur3cLLQBoWQBRK<1@?+k}%r;N}1cQ^VJKHfDkQyb-<yomZ1Eg(ib4K}FzKolWZ
z;7_|qR8Pz1jnb^7sip<-q`_|CU>P-qCJ`SGfr(;zPR>zUnsw*_B@h_Za%2->paPTK
zO6JH`dnDQVN>}&=(n+Tb^B8QkzOt?_0YLD@fQ$t}u61BRbwClic6&!5)w6r6J>umh
zw!2;UK+4hnsMeSPe+<O#V442kk@Y-(td-rp^%11N{Y5&XH}5BJi(Dl6pbW^H$Qz4l
zqe8#^3Z69T8Kt@Oxn`uN6PCaR-*CeSn_wrxQ1#aS(5~*f9yIFO`ID>yJ(C<6-5(!q
zMIJeb&@iy0K8L%g?~U0{_du59eQY0U#mLg$&d3r`ErW(S(iWm&eix$8p7#lHm`#6y
z2U=|RD_3MtCfTXGLoMUYn!(T2#ktbPG=|heM;vUG44qi1TG!{4yeF5e8vA+-n@Kti
znY}U-=6%+wWqU>m7;OuI`Sh_I3usf}tAd`H;Gp%+ASqSF&@b3Q#H-G+s>1z0_GuwW
zWlsCoV^1u^*eC8=2P-08d-nD`l-@x!z@BI2OkBFzzh<ePc+<|IO)Z2Q#e6PqqRzt@
zON`Kjta|oCN#DN`@w^yiPCL0fyUn$^t|R`BFREodb=}(#!sYz`GJzG(!h_{ki<4%W
zxv`h*QVzg>6tH7V!Wyf!fT`^<Ecbd=U6^vadO>E8@h||Q@=`Z2`$mtiCkyPh$AMS&
zso`a#H*Jp-N<O%%-IxshxU;hp1Ttg&@(wA#cp^kf#+`Bl7gGffUJ4!@=Rrb))4GPh
z9$J!%q%#7f)_G&c;VaubhsxZvki!bn+%y+h(h}y*W;z~p)u_v*Av5B#K&pT}clVMl
zFA^!4ilmO6cVsDzB=EnfNINB`udH|xVeEzf!(g9uIV~eW$ExYt_(hwy${rE<p_g61
z08FSKfR;u6Nduze!-T?(vFQjJX1M|!aioqM&7f)5EVHTvPbyrx!%{5mNUH~+`t*!D
znehe{BsowR#_iD*$C@H?Mb?Y)vPOX5%%HiJ2#}@V9{@@)#T6Lg#{jlZ#7vMu6A+GI
zN9f{$(MhEauzpm1OsjMQOi|_0JP4dId+%j28oO)IwgYA{c)>}ED{~)^5BWNP98hEP
zfG_FzFMs~7o3%H3&bBMHkQStH+s5Rtu)vX!<h!FItKh+eYLQ;!Lwgq*C+TiO4ut4r
z+mh?Zk=$=92FfGh5?;1H5vSu<od&wAE*j_lJ@E1LtcbY~I?8K2F|=gO!=NcfHqg>I
zp`|Ej-8(vogwS2KW<}9;OV<4xhMaKWKa<W*&39}7*?T*B)X+Z_1%(BUcJ)E9LSKG%
zGxF=57m)ka$I$PJoE*BP4JAN>A|U<fyAg@r`|NkCd*{N+R{qOg(Ry;?C$2aS2@;kr
zkS*+iVyn4^n}Hjw&0D0nR&ydFBjLu^u(O9y5KfW`$0}@bbRQf0B6N~MKyEbceAB2S
zi`GqMRbL`|9jy3Ef=Plo)0Xil*eBgwp6i6U{!n@j4i9q03*Lhy1y+0|oCHel_O1|K
z7Z84%r~Y2b$Hqp8mx6A}5+;MApc?^m<Y_#*5mC_<1+!J<r7)Z)bJ|7!pCvR}!85XX
zqRCd%KEi@+5B5nfHYTP-_$B`JX|9icw^Gh*X_as@2Lm6ZrI?RTOrmHBJ($)tgT+k=
z?|(84S6M^}jBW8A>QAIg+!Z=0>T$(9cr_b_Y#H(b2y1=pFRe_`%GSr(s{?=Ce?jhy
zZNP8EC&L0ZXHL#Cc(&+h<`|AwS;FCHRC)Qv<+?!oAv!cEGdGvq3H;8;VH|GbL2$k2
zozc4G(%Ht~#eHFtZT~!+hwF%;Zzwc(KVm@;mnKk-BF&ZE^$8qlB;w&%nCokQH@Z2%
zLu+Q0snr(P8$tHPo-4LFxcFLET-XeVg8u!HUQv3qW?^?+XygpPgchJ=WMpRR9@x+4
zGjhvK4YvvZI)*?_`AxW4{Q<z@Cb4m#ny$OwsVMRm;AxG4)CaQ4*bZS3>DPP|0dj$?
z?r}T#78RfS_xV8!Af5~te91lFE9_qvrFsFe-3}_~H2$cth<Ll(r)a`;xN;2U_gJr;
zFk3yGT8FKyuYcJ#?v=zK1Oj(~YiS!M)C8irp4i&Ho2Z#<gruQp@OkscTnL>l-cmo~
zbsSL3U1C$j&d%Y+Bk$3#h+r4~xox-p=IfxzbuY9nMFs~q#T*kS0xo#pZW_eS_r(Jk
z^)GuO;&|*5Kw<>Fq7Jh`gsA3p05yV7R#q0z1kDKX1gUd<Np|Z$l}h^4P>{7&@Uv^~
zW)g=nhtjlh97aRznhS}|leKP^BELAe92KfS2$~Ke#sK?oY%+LouVz#KoYgJ{d~8}h
z<ONj(?xQu3nSDUhXzP1{ZV$^vW*}-rYId;J2{9X-|FA67w><zR%Whg(s(x#~d@nhh
z5a_`V>(Fg9=Fr?-u5+6MFId~Z#@l5hAy{WkN*>Mwz2ftmd~FM9@4t9CZe6VWG|+B%
z!G1`DPKdz;C^i*Fnew8^MtQv2Ev3h{GGS>U25p_@-CaExtr9w7<v*Pv2uz-Wx-K1N
zn1p$_zJ2G)69!KAW(DrP*Y`yY@q&ZTg$VV;mEt3jtz=04gU@)Cuxs>K(R}s7ZP(BD
zO;LaUjVFYE3D$4Ac|dTDEe0EOY{ge>{cFMay&CMh8%^xI-xqf+;p3<Yx~%z}J~`+2
zt<Pyy{C%CdAV^i*tog!1zDn$iNhBa2*Zh(z!yP_FgdXeN*Z2eaI@{e?FUqOe<cZN5
za1WKu?1`&`J#L!#j#V&Es=U#w-PB;u1MWoRWCI{M^SY0Wj>c|wB_a`Igb-gG67(^s
zc8_*J<TPmDNR+?BU8$iWY1WI3Mxd=QWBI?fVhqZdwM$pVnJryB17ddqJK7Yqh6)P{
zu?o36JLwkM+TbFHg7mjZ+ykM3Cn?oRrc=2+?CI3gQfEo~sQE_oEy>_f4s%!mWr#JP
zPxnV_E6wZERRBKhagGRP$$x#sba`!1!>24LznQ(?nLVs$NrYMZ_67`z@Jb>G+t&fV
zSFmw0(?!7lpffSZZ)19GDin1t3g$dZBqOWhJh<#R-=R*VhLil@_6G$#_&-yjGN@Fy
z$xvIjJbQTZ^XDRF9qq}!`~)1LWmmG*757d%cKd4+id$S5yCTGEL#^wUFXex6dpe-L
zk1dUMb#*OC{30VwZwum76T{MTXxf}mIKL#f8hP+y#4+B>xeBGd9i+W<g<cI55u2*4
zUH<}4;=Tb9lNI=^$zYO~uL+VN3@T{eh|J(B9asl0o#W>R9INhjBmJmTV)>6QB7(n6
zt(et4YgkCP)L6tHJQDFn@I6>H+rN<L{Bxzg3TPL|HR9z>+Y~&Kirs%)!<TsZz;i#v
z!&0EFhIb@%?76O{YgUaQvK>g3WTTwhR7}}>VPfR?_fa2<W{M;`?sFfl{{hG6TNq89
zFT6~)&A7tG^flpn-0<~ntAFn}f1B%-#XB<ME0*ja55e$02jHBr;02A|ee3IkUd>~C
z?&9i_N(}=tVWP_LSZaJ%&HDM*X^I;BKdadM@5jwGX{ex0{nVhLNrXOOoYj5&S^!0J
zD)Mc+#G=L(H>G{+w)}ok_j(D7>c<_#mlen#wvxa47E<hgmI@m2{CFhq%vnNKqe?bo
z2u>g$!I$DMN}dHj(DsL;YSz?@-bPZwo<-=_9k>YzEJN)ljB<BJLMIg-yBjQ<!@TfO
zb%YK)aiVzvR2E|7wksHm;^SqlBo)iQL5rO*$7A};C}KC=e<8pLGg4Qp^w{NC+KtH+
z6bj`ER5?CL@16iiiv=9MnY0X|lm^pftj9AS3xRK2zO^qxNn0*fmELFTd*8>ibV4eT
z7gnfC@Tg_AZ+S55uhCK>p(qV>=nbi%U-dp0-BX)bD?kF#C%DDcP*MOOEj&ZFH`0K}
zj4&8b+<nbg7QHFrA~AA3vqV(#gn8rely7Lu#1VPSv6A6b$yEAoPN=!S#uK;ViK((F
zgTzy%WSg~%@lhIO6jk2?AT{?>r&vNL1oB4r6z^KoACM?a$^~)3C+5GEzvLZ{<rZX6
zMIQkL-?pP0sB0Ft#dyLhXUN5u?sQC<N7P)=fwet&;0O8!r&KY63g{b9!!hhGQ(xfx
zIcD~AS=U<2-dHfo-vNSyUZXg9`2^|s8=@-I9@92wcJ%ZrtaDtE`r!j;896e;^#PLY
z+q)j9hl-N}c*@lO7rDaw$;FS)-6=Wo*B~>FUdgc0e`Bwm8F;Hf_IoJROnPV^X_|71
zRdZY<6sa1Aq~lOLIQsIC3j!t2kN5$CrMpjYd4u9k&}4(dR<gwrkb;d;xZ77%fIK`c
zIvKRt9Mhc&D1go$y*_V05f@U@Bua-z>cD13>LHg(I0--dWFZrh#*2Y$TO4Lc#I%k>
zcf@8v455qp=x^w`dScJ~o?%>#?*D~{z6`vB^KK3Pe8A(Ew0J7bMqUpQc~zT1M>|^2
zIGy`t?A^}umEa9Pow*vc=lU_DgHL%Gdiv34yKyi){ZF1z%?qkH=CD554{&RvCN3yV
zppxOAj?Ak^nWPw(3nOK?ALZ0|6d(H35~a3gZpjwCEdF1A_Mdm@Sj^TxYouU)PE8#N
zzIK>Y1%EDOPpZ-T>CphGZ$NF1Skp}CT1c)gFHde+TL;HG&jF$HXye$mvK;qRWTmV)
zL5!M6CrlA06v`ATve*el{R;v6HSqWElm5<+fW&`C)Vk6pC&3=oKENoV5Tyy^k{@T*
z#p@6kqTpx$rchJZbh=)~@NknO=Z<1I1iu}zHO3g&IT|=?Zv3k071XAWr8WFdTF_Id
z;sY<ES79wOW+TYYQ4Mj4)KflcnSZ{$&d27C9kfq#EPU4+5jN|{!m1eut?+gqF%<wj
zq!OW`OWgh?V#mal4qp+=Fm}(QcknwtgGL2+stI#wp4nu}s%IB_Th;dmNFd^y+YA}X
z<Z>JMP|(jOMiszb%$_*CW?s3x-CIHzn0UL1X%b&b#%?h990G;9kj75CU}(qj6w4-4
zFs7T|wsixiNXLa73-VQvjIuZ_$c(HYzOD}?`~k7M{n6TDB(GI~TZfbYJsg(r|MJ96
zxM<Q;Sw~2@Qn-)^(Q%5hf`ad0J(|XHm67@b7`%)=@#O}dW75ER(R0b9ll^q}|1LQv
zli_HOVd7i(IZ((OUc6vO+nt`CuHSd;^!E**^()_mpZXTiyIg#^B#uG#;8zL9G1$Y{
zq9`Ab8O;&hFMoUjD}HVqb~Z6>a__Tc$WMvn^S!6YKOfgPP0C^1A3mH<MQ(DC+p2(3
zz={z0Q7{#pE{pAgJS7wzNlcSM9+;<J<e|Vdt}*=l@nfzIMeeA-MzD8ZZrY6P%#Vo<
zsUm6Ts(H^dw+mA2D~uM7frUn;F6N0}f8x*$W|W_+K@{9+l8J_rHqG?u@De{Y#xssl
z{t>?{efT(}WowS_)@4VZGu=>NI4U2BrCtVFro0)MS0^)UXyZO+bhFYzs`M^w|2q>O
zA&VL|Q;rSnGQDItdiAp=l3CO%B!h(~j0*5Fx^?Sm@gkhI{nv4fpjyCpOEv$*V^uuu
z8P(r1TSk<8{rz#7@=MfR1b?D``io2Vv)=93ZWJdSewdP*m;$v6^UCx2lb#Oy=7K<i
ziK{=_n=rm`ZN`2i+D=@%1VxM_F!@_&Coab-ynet*dj?HopLF4^5ZU5YZ5!wi&*JmI
zgTwEMx2<qco9Jy@(CmnC*d4@5gH@eRF)US0IOz}Hp3N|m6jtTCpZeAHg)k&`0)Ej>
zJ3?ec!oOkRTAkXOpRk+b(UaP4(b@e$Dvk29v7@7|Gjk)Oeh(W1U)THh?+aZ%6TUom
zLC;@A>)mOQ_*Y+G?<|)TtN5T3#4iu#-sALm$$MJ=-vfiJfkA%~2<0Z;DIWH&GXb~$
z-XW1l^cI&WgUQJZ9vd<HqsDbV{aEgBCHbzWONym8i<drC^$0RI57oINR2EY?yiORN
zXNxaSDF-CqHU0DVR(yJe_xo~hNM0jVRa9&)ArI1!2OWSm+*yuUbMwej1sBsOU<x%H
z9v+6M*c`;}g3c8T9IQ50SgHH2h_P5V%%YO`gze3T|BtAz42$ZEx27BE7KTOvX+gRr
zrMnxIZjczdhHgYaQIwLDZWtOwy1P518D`#t|9kIyd>%jOw=?_fz4rR8aOeb<7nXa=
zLdEL&&<+F8NboRUW3NumiSR{EYJ9Nbtv3fa74wuGLbU9K3SY1yTMXcBP?&#>L@LLi
z&J3{|Kemp41$`mJY9-rIBe$5!85?-)g*)o~YxB?9>HUN>o~JQm_^bdL@@gRaeF5Ec
zM{OiUydvCwJH#RG#`;uARW`zDCU{`f3!hbzNrsjV*l?gd|4L>n+rH-FqkLx12rMxQ
z`|oWYU|wFc15LW8LrvEH9pB{2YM|u7R>;FZ4%b7N2v8-)6&=I*(^pTH)7rAP{8N|r
zBjlss90;At8MCu|!O005d;>J&>;vUM5}#e$3~LM-(W+Nc1tXYW`CoBb&ju~>8G3^2
zL=7>vj}IQrFP9bmO9y%QR`~+t@T?n5%fuljQ{etCA$hpinCi7ZzhMe^2I_?Up0`C_
z=3;))aNYy-Mu+pYke%IYrhgLc$Su&_xC$rYrZUU(;BJclZpBa)MzS-sn{8&}1t6EY
zUp+Gt1|Os;-M!Y>t|Vv6r-NNh$--5>4v0*sxjiQ?6FJii;CZ)%x!quVjB8a{O2Pn*
zWNGOm4An|*dtu0VU(X^#igomx#ZLY#;)r}@&=p@r56~L`Hkh)tk3t3AhmYsB45=$^
zRC+?{LGbU$gt^CpSUlGMCQ+AP|AE?tDEeQcQ^a=2{bgC|z=xcvVqns_H38gJCoGiu
zOzgKFatCmTuIrZpKeXxe&Y<9oeE-IJD|fNQrJbea+Vx}K%nI&9E!+f`NrW?AUJCHu
zl|=Y5A4zS7IxIf;=lhe}o!J|9fhc}+9=AyVwMy`I@TNl0rkk83S1#fGx8zl}mye5c
zws&8h*d(~exh+K=SIW=ojE;vx(p!n#C*jdC+Q)d~wq_5=$<1J4yO`3W06Q~s`E@4)
zoMl2|^5@JSf5!Z2-`{Y0*xB^0_1W}$!|%j0zg{=@2j)C~O@(GQt>RUSB}0QzGU7G$
z#U}Udj|OOXX8^`Ikxx8pW^a*k-rG!n5(n9S*{D#Y!(?yLh8VJlYkAFGA16k+kRk@6
zoX#H1s{D8)U>mp@`W+b=$w#gANHWz>ulJTco|R@uUlhm=B+ECn`J;r8bmdKSG1Gvz
z|Ja78@y{MGCIQvctwKV>;smZ|+A}})5Rw4y*uN7Alw=LePp&0%`C?yq_iALY2|ISU
zZ~|DZlVs&bOX7`U7d<$gxv*s*BY-11<1yB)5={%r6mB~Rs@YEnM*E_<De``)3|YRQ
z#34+9B*QpWWp%O9qy6DA&4}CQVG6Nr4j%&h#r~3pS(AfJ+AoRg&6OH}$d(2epT0SH
zUhNoX`6dfF2^PZ*pg3m$62{sjpB{)~1p(v7`w?UK8e)j6xorE~l-L;FxkbUXJ3KGp
zm-_Pd6sRezu!Y>L^mAJp2Oi7(!ZuFvVl85Gad4k4GCuYkT2i{#AbqiPbiBoTT^%4`
z=zr`G)exTehMXPeE0BDepI$fb;p2*XP3=SbUjFX0qvJ3!UK}fgktgpVbpVI3Ou6c*
z@sDbb48A-pP2fk!$oc9OKOi6=r!_<WW}S*?*rX$Fe|R|V=$y^cS^sgdLjXXG^HI2k
zw*wtbg&$Xv6)$!7ACxP206ud^7NYk3(<50QpZZ256=3u#fW=1~&fuI5<c!z=p^n#m
zKtbl%jv-|6#a0)jfaYg<sOy_gBxTn&fG}sqNhu-*{&;U40n!`b+04XcVt2b=FP7}=
z@S_8z|JW?RzdxaU54lAMH56Iw*~7FZe1OkmG(X^cpuXj*wjwYCy9Db4z%opPgoJED
zV@Sk&SbqY9N9_<N$d4guh~hS4Z{sx@X`{XDVd`~!Y9b*bD~DT@V2$7&@P1SSo4Cv4
zHK9CF%)_tpk!C=vH;)GIiYj;lzsyJ%&)O(Jc3DGYusSmqttkmIwm=N?aW79gW6ZR!
zLQ6_M3DmfI=Vi;POn<~ED13<!iD-z+gn25(PTE#J8!;8A=(qy>BzRqc&_K#6ob=bR
zvvrq5>_$J-gg3G!8;Hp}LvJvL46%0U2IeQHR_z$RA>J~|d8xWK+5C8^#-qJY{X&W7
zYwQhMA+LP5(LV!RbRo~%j#X)X!Vr3DBAT!gRB7Gwe}=?x1OJlPo0r(-fd>EjSkdXx
zsDq+tc5qT@_&IZcn)S*>s~wCXv8sqH6*>}*NFoS0PV}V3!`#Q`x|t*VGPks%?XK0)
zx{&tT_R5%0=oV3hLu$@sfPTJUfNC`4w!-s!@q|2%fX6?rYUFH_SnB4l5BS<g(yNC|
z-()B2v&+YO`w?bc&WDEXO4!6!UPa@>{*%4*W)v0jrGVRT-Y@F2W;(cyYX*zK==J8e
z5{rTIp`RDe6Jx-H@P@+31@6U>>?x3(Jyw7T;sg1)DV#nlfX48%QA&6WVZo7s3bF=F
z^PKxHP|+Upt??3Mef<~6ETsM&Zw8-x|J)?U)jIb<-`?S*q%7~xPOr_S5>tEHSrF8y
zlm*UPetd9n?~{>f<>6t~t-(!@$O<9v)C;v9^EU1u5+c!*C+|IYI^9l;PgQlsQ}gSK
z=Kjc^$Vg^>C0FF_kuAQkkcfvHq3>1Q!`RfSohx;~{!_JAye^1j#eZ4wR~kvDr#f+8
z^%2<<9$_-V?WUh1&s0=z&w78`?!`Xf{F2CD6LbnB?-WM!?rwz7dg)P;jP%eAuvpA+
zL<fyqT=pT<!KIK5{}h~5AH=o`d>fQ2>hq-DHb{(;!jAQQmGxq)ufBza%;%dAgmO})
zBCLeHANx{!u-DaDARDro0&Nam`GC^O#0MBkiX9LB@Yy4~D{Cf%&!)8S*r`#^Axy^t
z`!*_`JGl+<TP{fY-!*oxF9o_eur4!z8{Bl-U!y&Gg6aW++TAU2$R4Os0u0<`wBjEG
zx{oNFcjy8y#!RHbYgzA>i9T1I24MA_=a&KM_Moym{S}?qmX<eVmI&bTbI@muJ=7Xr
z9y_Ye$RUMp`RBcdZtg?C)7PoBw!ePEmpbuhN-Xw9AbAKU+ADoBkodlYXZu=)Irfmt
zY7=MiZ>Qr=qM5HbhW?r`isU-bz`PaQW6*@GTw=ZBE5d?ZCWv#M<J;CP``2<m%_q;4
zb9`@A^Fyk&BY=osJ0uc!0hq+x3YRah{e40n{Fdk4RqEr<6z#<<7}kke<@T8iXv@3$
z-lw@z!q@O06EmGq;^o_jcrS^Aa!)#=+7OPjj(36)2dad2QGbcEEHCJ~ioHlC`Hn5>
zSg>_-(?C%Uo6CQgJ7{WZTAt;^n=!jl2gZ_1{J_-eje>$g^KSl2-lT;q8T!TSDnjrv
zHUptUx&0a%heD|grM|^snp=-TS7>qs83`N^uSy<!do@bzan-MI0|n=1s~+c@N;Oy3
z)>)?L1Z=nNK&k@pY5Zium4bVR?*528Wov+ySU#{}ujj8`m6F%-n+!DC$CA;T1lgvh
zrY^T;`YRZGoB=9PU1uV9`_4^WB{OL@EkucAe!VPxj&#n=M-n-!vLMH_hCWu3{;{+m
zL_(XK*sMImWKVjnE4b!}&dGIfO4B5TEJ6M7c(BXa=H1Tztd2=FN&zMAs7>$Hc>SQX
zM$pwutaWCqe4rMmoz}DO0dy?;mm9t&35!CsSHd8V9R_g3nuOxL@OK$cjq-N3Xu)xT
z6iH(fk})DuIofv-Ev=$OHQc(S?q#P4Uq-z!gR<;)S)AjX*9Uor2{i>y3s>MewQ~BN
zJMB+~7V)o#hxkMzds*#tO}l&T$yGl!_3ExuOWz8A9N_{mz)gaYq<;eymb`$6?}ny4
z5}Gb%)_>4oUZW?L?a~K3c%FcjWxeV7{Fc1rg;&%-T;aykIjg=qTsG5>Tj>IE74r>w
z^-vPyjmKK?iJ!*xa6}F|pc;8BN^I}F>hD+lu-1j%wbvCt2Y<K+wpCOsOB$jiL-#0p
z9wiyEjOaIdu{?R66~=i_4uB0&`o?1&8j}wMD|0g~KZ5=lfVowPEph<FJ#G++duGT6
zbI=k%$Ze5_o;kM-Pf<(<yxNxM{*a6Sn&n&2>1&#-{V>M}0+*79xLG@<fo(C!708x6
zJ9TcKZ9A+UdVhR-+S~{mBt!svMlCK;;MuT;w4MRC8#;L-If=|K-qI=mOoDz!yqFi_
zvu&ryjdeY)eH#vFIldAtU45%5ZFshfp**XOC}Cq5KTZ<Lh_dNy=iV<G5E2o%M?EyB
z_6|-ikzaTDWfD`Uk72%L##(Qf6WIaVTUo82Aa)bsyZ+$gognAw$+l<UrM@=EOS0gl
zW*^B73B?nyK6vY<Rmkf(@ns@odiF9~{386A2>LZDTh@InztULTM%f-86^j_8ie#St
zT%WQ^2QeZJ<+Y`B^0J7YD6=K{I2Jv#SwRlh2p>mALCj8OuAIUZuwB+Fhp0CKy&PGt
z`x)<l%(G%vy5Zg{{HKnpl%(#ooo^ClpKXhrlRRQ_tSWeeTbeRs&?UGQ<a{`!t}KAd
z?QDW4^k$%=BbYYSD+A`+JCbz~&BK<bkz>|$U%`R^F4jCJHa&L)2Y`;aIR(c|9q@cz
zI{dq)2!r8b$3J1;RPXGT)_bH3P^!@(QmU(RZ>?t5=Hp(3ULq>w%q4qK7sVHkrlW%@
zufptORIX4g$-zM7R_uWpP-6N4A_<Hom-h*-ovpQ;%lN%U>xM3scDUMJtz4=vQ0g6@
zL*V;1n!BmS!LcqqtTq;xQHUxS$#eq@ICYWuk_l5S4f9{Qb>RjRA^<+X&Ux`Ae<lD>
zfVJT^zxhwtU<x{r+<aM1MssCQY|jX=RC+*y2f<Zun7iel83OpS=foS+<DM#^cT1+z
zMfXV;9zkVT_;C7%tqou17h1j{TjX(}J&a)d@)hQ+C03hfc%D05Ib|`0DL3_9nBs}{
zSj}@$?1-gxP}GVtwQXmhG3R>qgA$?1so0H%sIuv8L*n|$!=(DdB!6^(oxOdtK~$pn
z`_=Hkr%}RE_4^;@faI^?9f|8kMCQFkP^;3#@lAyJO~le76X{Y4Iy1_95-ZJ&=S@}X
zwp-i=*ZZY}lfJ~~zDl?D>ExU}%sneAT`eUR5sD@#o#Tlso9b1L^MBn=LdP&V<H!fA
zqXLM}RqdRijLF|;S8Y@R8SY(DMif7HqVy%us+feaN=D6*8z5Epy162MhXMXTEA8&j
z$YGcxpHrJ+73DlxbulALhWQ>zy>P-(bzP!%lbbq_^QU3K*2@e48X`u4rt*OHE#OuZ
z#A$7Rd_7AIiT5)pxnVmYDKt+<Pfj*If9!unJfnN{F{0;Yi2!j*fCy@+zW~U-z9ZdO
z%KppI@0<qj6|llr!((!kD08IINX_|s?_jCq1ECP^ditAew`<pD?*ciS(q^Y-Ue1{O
zy#X5MDXyFCN9m3$X!Okm;RkmG&49-?hQ0_`IzEj%S&*Qv`R3bd7C&iN>PqZEdtC^Z
z%O!9?@Ht2t65dY|CR<*znJr#AV1WrQSI=?JMt66M>hHpU4hdkGd!A)}lP^X%Z8%1@
zpu7o$oy=DipnQH?IRhU>7lFCpsJU_@98zpo**R6p<P5Uby1Z#g&}+}#4AxmW>MU$<
zA5Z$yY@SYB&0!fePLZOw)#cAfjTkL>EH$G?msu^362^lDAj0!2=`Vf0Xt!i8E@j44
zSpZYhgGaQekc!d894=85Fy{>_<r+p*t&#|2p>JBxMDS%Dz{j~C#>-0SSKpr7jIT;8
zVP5UKN~#2ee|%LIvMO7KD$iippTBKAt&hQh;pITOoN^ArM*TZ9PuyA*J9BnhM30tM
z-RNa?Aa>Ob{(U7;yVL#Go$UA6>yYequ@Bchdi_>zU(H#pv<aIdP|ssVsFCfm(>lwj
z7V`4*^@9M#cU5sQ`)-F^>udx4amo5}eD<KO-N(ndrcCry*d66GRSpA1+Y#;&2b9i$
z-6t?z$#p92sbtV1B0&oE+A!L7cSsDF9>qt@Lt(b+;qiTLd+PRai9tT)$PL@;AGw3h
zAS<RUEsxPy_4J{ZfL3vE1Bw79tIu(rJ7?`5V5}%zvRKYPhG{9=GcOSOjXzil@@*na
z0?^f(y#JnnfgYy^B~Ez5z28%P^F@v>(0amD{xdFMbPIwSzuSdeIdCFoYh*8E=`7|N
zJ?sJ3`k7_VI;iHZ+YLR_oa&bC(@vuN1qtW6|IiIr5FD72F_>Grl|<e|St}woBLZ|~
z-)4|uPCwH93D&x8@GA6A1{c<COq!le6eGGr*bBKkn7beV43^XXQi`1pX6#g(qR=w(
zWU)F+JV75;uoYi~h}SjM$RXLT$uO%LT4l3UAJ;(F6Py&LgFnVHAAYqicaL?ma6&z+
z3NBG3r0cm(2KDuIV3=yA2vYYG*dbc}^pR)g8K9giTfl`<gV#s{!oUAZ6rsJY@>duS
z29D^qF<7cmL=RNz3dW3LWIkM-(0I#E1l>A;07?`gLJiKl7<qrU?3f-4d^GX2mDVcs
ziUvm$<(?1xL_aEYCyxxFC$e?VYew>fVm&w}-gQu;ROx=H^i-;>Jp&FHH!93F*}8ai
zdj8CzYs}Qr2BaE8{>R<H;8*kvURynI2|lw7E~1)jF8M9^Kih_Ex`<eRgv){z3IX?a
zFu<99z?CX@nJ^yvV(tOxP$$P)y~yQQFXGMjZER^4Dkc2yCa5+xz$9z*I)1RTzLnXj
zsmorwwOnD3?UlzuWs>lrTP&+kq~55W)=E`X)y)mC9euE82N`9<nVID8{#U{A5lwLL
z$#h9)YuWc*Otq$}A#*Rc54QloUFH)I2=4*)N_(8CH>kU8MFE|JNf>}?PUd1FVz)1&
zU$mFlLDCX@ybXD2m7mmWcGFGmAlYya;2IUlXg`zo`g$a}{M(C*U*;wOfJq`;@@2Rr
zr-21E4NZ-}<#C(hJ@fghMKAMU3m;(HjY=m)>NzeyPb37fkl3BJ7b_k##=QSP<U<D{
zR_&I?@`?G=A1<ndE+m0|Af$p(;y0G<8+ow0%zpRkWg+E{&2@hzrXiN%p5_Ge9+OQA
zOCcHog{gOYE^a)y9NsS8t+Vn5ynzMx1M9D#qv<=H9&VtdrqT4oFW7-Rh$xgSf_CGU
z0nxghot<Xkgq1lVF|k8**<;jeOeItfsbe#jN+%MQYy*0C4wmVd{-aNbm2(r$VH_E{
z{Q40zOY~mTi1z|q4p<$kmE;h0RYIF~dE3&git;)!5=c~KMxnC0M{GP63Drl41bm0e
zkgBI_(>Bwzu3o7U9`G0aDQ?JNaA>U{cC8?$-)&tl`wD}@tB>gPGk?xjWUtHnU6Efe
zW7V+Ri~#8@(C?9k-MVFsJg%R!yJ_-EE*Tq<N&YP=$=!-_Eznmu7qG2hA7>eCj00n!
zPIQBLK$~;_>ozy&4JQ&Zxlz`|TWhyWWidTs{|SpY0*Dw;pZ;eTur!^#Cr@xtk=R&A
z95@1E5YILEd!R!OVs(>`{w2;3osWnR5?|8<Uo^pkzLMTW2#r2_N4Wxt;M;H({uNsQ
zI@xyc_P%-nzEA*PbeG3pH~{9vonm@e=ajyFbYgoupy>1D-J3*{I`kP$wI+o7o{jEJ
z{CKd^1FtJ>dqD$O`_G))4HU}TTb{9-dOmFB=R!&;P%LlzdioG_fL3T`F{{iF&MTdr
zPfx>%*tGt!eZ>K38JBY-lJTVESccf|tI`Z7T3T=wDc;`B+fX%7%$a$tgiKLs7xtod
z>ppMk&uEyB?Ll?RD*szEC*@@Yh!KKCqiNk$#Ow;0y^DMDQ!)?a$-@g=f!!taPM{qV
zqTZ0tLM~txqPiL681uY?KDK`%jDQcd+`x0)y3^y`g^8cHNv1DgPX~eCkk(`kTVtoA
zwyz#c21Ho(bmsoOzdR9~doXUlH2%67WhMWtuE^$^ar%iiH^ueJL+HIkKE<<c)?W^t
zD1_<h#y_q4i38TQ4Ga?oJ&(t^ZB7f2-ugt>_egT*>!}TUnK8z45^XNhX7Bylp=}@a
zb#CdS{Th!V|LXm^W?4JgvaOO$Pnj>i_*Z;o9e6d+jy(2vJ7>M^MNm#JrGvv$-P{+C
z(jP~i5+iqM0S-Y4ogbxm#0*bM*WLfY6`3-z$+gnx8{H@u^Tn)8bA^W-zkHSqV}J&I
zP~${O_hVL?*z)pQ@HH2MV_T~B;>Ht3nFQT#xp+h+3gV9TT+Wz+ODWn2uK=o#q8Exn
zQMOshbJgc-e#nk1WPznMyFEXRaM|#;R86V+NV9ln24EH7hT~J+RRHQ!n(4iLu^14a
zkN}_jhk4)&%U5-V>mvrN)>(FQ{Yydxpt6T=fq{X~$-$LZ8(pVd?T5=m58;&)79;jC
zQ=n)B0atq^N}4f@cgEbgxbgHo5bjSNE~(^tX$wqsMeL>JG9W&oTlq$Wa2u?_#U?xJ
zcPtzGL7a|_es2Jr@2I2~9E!pZi0*KCgAm&4;!_dDO{=3s9K6k`TfFZ<;-tkbWhwGr
z&$b7LO_t=H!Hyjj%*SVLRnIyI)M{SuqTuPUy`g_GOiPX+p(ryAKjLh99i%4Unw#D8
zadz;@H7VK?xY;cs9~OM59X8aU<v<BqmzifyChRY=9${Y2>_PPP85aioX5FyCbgmoE
z-Q-TKb0eOC!<4$YR45WU*;r=cO&jUa+;;+7HKR6xdCEw>9r5sVcHvj%x(}pFIR>I-
z?%6Ep4w7P-7RzJ$=LU%7lLs>nWOIidnM%^s*=9C!G($5i=l*?cj0*2|aNI^H@iLm~
zt!U`0<`vi$$yQ+&%L!f$oCI!qZnADa9j;080b|I;5UX#8YDlu|jmf){LB}fH)aZBx
zS7f_TD}=M#iV>pK`g?3Cn=gl-K+sK)>yz)EZpe{j^fgG#(nSEs8Nms|2;k0<zE_zB
z3ldBw0%$&muCF82F6|!(Dihb;Kc#;}Ko98=rhvmb9}sY#T2bA-tXd3JWQ_~sJKjw<
z7hI-#v+hzHHgWeyw*7&4#{4k@Spk^7txR*q0YV>1*kdzsA_be02Pp20=m#LivjKFK
z?dIVEjvLEy2OlB)<q)2T-1c*h_UeTraQZ?Exr5};OJ+^7vWEt@o>5pP;@lj*Y9F+1
zZx^N+TF#@khpzgx57F60kg9sy4hgcOIetSPp>B2&rps0%H7Zf>y!n$Jk_YO_7ihRU
zpZ+qt({&+3=ObRWaL@A8+~aI$F;ushI@Ka<3IwLZeHQ>2cBzl^oB|}=Z*4dBwi#G|
zD^On(7jzpEAtzae-Py%QNgLh!2K#4wo{f8Q=Zx88H>eyw)SBPd!fBivkZXV7WBFr=
z;&BND^3LJTkX8^j&)`_*V6nXPcq^DR8@Kv>*toAM@EfH0HF0B6arSDTGk2XvsOvLw
z?uJ*N1xC6Z$tkoaFjSNpbIJ`2JbYpt%IFjN17lxvjb#`Z(sPn5(hqhy=HLHmDKQH$
zp{)6yQpnfc2dd@22Uze2gfn=5+LT=42Lmz6^+HX2+5uK@(KAA}JPOoKhMz4`^wG#I
zuGYe2Ok*PQZl8w`rh09|#Oc^FDLsSV_5Jl<*u$Ciu>*jz=<C)se3w^tnX%x+9{GU+
zcj5YIvSDg2?9nYiR;VE1D!Uk1*gq%}^Hz$iz^2&ig?}Pxgb2(|uiJMyO@A4C1S7*2
z#B^gb;@8s0Ijne-ot>3>9_WKhz9zRrw7jM=$bL$@niHNbMm^Mk<gr4A5CxbmmpNmk
z6kHwvap$C$IDZ1Hc7g=aAF^yV_cibnWs&3-Ox7R&Qzp7LtSZg!Qoy3p{PNcoOWcB~
zKt?bwk3L1kSSB`W5&+~n7orhPRH@X~Di4Bw68T9Z;e*{#1V8l6{I+&JqC;P;09No@
zu>bkyfagrPsb9W>xw*OBhBGWuBeFYe>XSf2;UJ(%*YZ%hv<F|=KLEAarRIBgZ^573
z=;}9nne^POxTk}Hz;<@q{9J10KmgPgg$yjLlzTBCVgu#@XwtQs&5vKgUP}sCr`*1x
zETEN>!t%R80P-UMKWy9=bl=#$2U1fMqXkN{r}CLM@jb4|*4O()O~kAYBn|G)ZhH!g
zDd1?Ok|q;~lU}tf&V&1*rJC0oy}le9&n1RK$Iw(f;&X7SkQ+9Qqz<bGNkau^>Ew8V
zR;SCZcnpSyTFiWJ;yu%|xP_Xw0pcbR_#(&(8X=|MR`=1*R1b%$iz+#r?yDQB>L}<y
zQwANs@Www6n_3A+HJrKOhZeJ}<(y}*7#yGN7>F7C?G%#M;#c%vNEqe4HkH>@=X8#a
zQ0ip1ASPJt11y9o@tjB_80}f`#wx+T!8*>fg5d0%->T#fd5qKtI1;is;<)43D%!UQ
z>5H`qzG{qgL|(LRj|mEO)eS55R#=NoD51akFCg>9>^vp2B^gF}{*9a4t`Xw3$;A`@
zx7qME7Q1|(ooG<SNP+ZMF^>c16*pMXK|8tc<jHiEZw*zN1AB>OoorBf#5=CeLvga6
z=R`EAGC?ZV;Hef&Lh|vXPgz;3#(6s`c6Q;0B*iZqh=Da^MWWS1#u|pPu(TR7Yoe3=
zLQTB61Q!USd!&*0hDS&BMbsGKS3t;8j;>L~n@HRr$;m|R@z45t*Ve1>XgrEV2E^(9
z)+jY=`UX9~{*Jc4ECwt|@k<X2|H2PHQJ9$fl^zIA3yF&67+WWrhA^Pr-SkPe-9JX@
z96Y9<Up+YE?Rp?~K@VSx0lq(|vsQeCr0jun#zR#bI5OAaHTe&R_U6a)Vkb|jsXshD
zQ$Lj$e<>_H7jc7GrA7FTS8WOqdCb@bj@7-s0a(RuIM;Om>;wx82)D~_Zk$X4suG}*
zzj_=TftVVfhn{(;B-bKP`q6N3e?(ta!f+=I>qba(>U|~n)aF|Dy6U^jQy?gV0gkN)
z7K=;&X#eCK^<m%gsW=4)n?WRBg&e8S%O(r&oKFz~ELelv)vuxNr`&W~Pfggy^BX9R
zXHqd5D42Hc4;WG0XB4TPZp%_a6^adiKZlq(KKyul*@uzl=G60%N3*@!&Ya9rrc$Fb
z*el?W*vD$^<L&3#o^FiFjT=`r!q?2K?iR(w6e^j%l}l(wSIOKS5jJpI-1T?}RL<@;
zs!{?dHAxhV#RZML{gZKVB=b_Grz69Hp$K;+`^r-ODYPjYDcZ0M8UeFNFGyN$WJ#Ls
zd-v*1SbJ%-F6RsGIge*e;8^IpHqQFk(hJxtKcX{zo#SzO!85&zQ1b}^;sR!`^+j`5
z&gUeDJ$edyn#s#Vq{ou#93&=W&@^}>bp6k3jdH`k;xU{7FNj`OC*<oZeS%^zVV&^#
zZwr`Nbsjy&+6v+`lB0dUGJdOZYw>TjrAjwr1K9>i3&A7U<iw@Jlok6y|G_vD5g>F@
zD>1cn`U*outtxBi(#Kz@rD2$zny*6((%4sU!q4ZZ(YPUMkY!lS?K|4fb|3*n{WQRv
zS`7^-T^r5^IV6YcAeo?haj$(H3YBWlvJn>q`~(3f1OF8Q|MdWR8;2{@-@FL~;H3-P
z-1*Zs30GoUI&ZE`y7a}y_#N%B1UDeL9a3*SPp^Qbg0Dv5bBlleBqeeefZ_<kFAn+E
z6639#&W5<q-oO%ffe{4g(PtAhPQTl@+X$86mJ@v1M?I!q{T96+66DCspjLUV?J;wm
z0Z0$FDDK~&Z6@%4Nuq%Ba3xsu$0v`ex5@pn#$Y(Sc^115qOd}BFXrmdBGF!*A6x|Y
zv@^lhn6}L9+Aw1}mtQ*<z>iPh$C8i3rP$Z(TSp7^9zpN9Bo?cdm!j@nPpegMQSW=C
z+a~4crIV7H33<l|*K;dhYgn`qwi^D5b*|T<=;JgfQ0j(EM@4176cvodb625Kx(JDz
z;HCTXjn4vgTX&JUF;SL6f{sZ3^Euvh*m=k}BC1s~r1|T!3HX@^+kVUMQo~?uxoV<F
zUGl#6FnX@tqJG9udU|#=A=0PP8jFnVpPw;SLnCsL<>bia1&O5Rq%oN3u^B@g(atTE
zQ21NGygRUC7xC+<;tAm&>XPaxDc{ORf2d#Y6*e`M0Dq24%NMfqdFhsM-!`Xc&jo`n
z@aV|*rjjh_tY&}_r#Tgf1J#2bRvE98C-PiN<Ls#JYAi|E_?4imAd=|-{E;`XQq)Yt
z1R^_}qVB@h6NgRtZAUXmL-_P~nh49S%=+U=KC8;?|GDpq8n!SAz71UV24ZT|DTSOD
zIlI0%Ms6-;QfHGWgboG~5NmMSGp;n=mt2UyRW#&mXl{GWCHJ{VCH-mfyq2;Y>3|BF
zOe4o3dVfUoN!vYBf9SZMSE%h_(cn)8v^R}HY4<X0I@?bUOX4T(y_g5RnTXcyi02F&
zk!liaj0Q2O{yn9P`|R~Pjpn}%yrj+Z&a#5|hj~qADWwE?Y;FE~TCj=^x`eLR^q)vI
z%}|Pj6W3(d<^CaZVzR?^;B6f16^3Nf6ysJ(e-;Zd#JL+24O_6Kw(gC~w(4WMz#Z=0
zTZuYSBRPHf8;3Hn9r!%Vo6mY_TpYGs`TcvHj<S2BD5#Qx4n?<m&4H#*?Z>;c{9!ko
zz7_<R1Vq(i3C+_+4rE>Es&rd7(L_v)YvmApe&Qfckp7(|KN(HZxw>WQAJONvtZ!7w
zh@NqJ-A>hc%6GOoS<lX|(7k+5y2+Cqh*CcJj5|@{?k!EG`LP<lsBqmMazCaiP=5GI
zM!ekB4Ag9fuEC3GL4%J^kC&4IS@9dbE*%#w+qF4ksoZ6x0-fKt5XU7Tk0sizl`VN=
zT!s7LFP;A(Z)|KmMH$~mEZGV6H9-k=?0lTx>5}t|a}C5Aig+FII>~YiNts9(U`45z
zWFzS30xfeOmAmZav;mV2vMysZM>skWR&^K+vnab}LUTorEfxlki(di|>L6HLrtM=4
zZ~2msLWobXLqvD>rA8``nX4KHlppgxh58qxDJl0B$C+FH=bJQUmkseU%cpbP62Eb{
zC<nzd?|V35){)4DBDvaxUS-HZD!MnAPhC409S*Jhf|HnEi{0+oGD>VjP?%9(H<zd&
ziYusOW%h%L%ii}G*&0DX%joA%!k`wW!N>=ThgPM<jOTl;g=z(h97byJJ^JawN<Lmj
z-Dm4du8h{AfeK;QnN}xnR|7k1SKb@vY1zI^4(fL(<oBbm*54;i5&5Qe6L31~Pdg9@
zQ$N_+q)kj>#DfwhsvLKecb#5|ZP%8@jMeoL@VMlAnt38)VD~?8*bBM+w=`)f`^#jJ
zLMJs9&{?gg(Dv26OjKRfSdsp3Wu6v^Cch~4Er0qMgwHESvX)wP`N|+h{N<~)urp8A
zHrCYCuY@x33jzYjW~sI;%E3q7j)`ucmb+GLXDco5uW*MQeJBDBtwA{lf~~#w5`VLa
z{Eup997gn-8|N@qZ0a<yB)hvMk&=RdOH=#9-Q7Wj<jLo-Cq~hM*#4Ve6D6pXgvk|R
zgrEXKG%iv7T|gd7d|*v7J4c~&yBw@DGG>AM$=9oHN`8wRm}j-RW#W_aO_G#>iE>Kl
z<%{~5-hf_KoLkI75Nq|v7fnuQq`YMYbYR$7L$6-w!_1N8*b#+PQt0`5-AWxv-~9O>
zhI(^epb;xIxoXhL@AbuaY^AGx#M<JNAT?vD##~o9G;v+e*hzN_ez5&DLFD}z;5T~M
zDWNfrpdbq`J5NZjOGRIQp#Sa)ZVXp4G4>LO#wIG_k@IiaYT}5DB1(=;-I40)XWxwZ
zLZEdX+7-OH$~72!UkHgtKhEHw9*jxkf4OlP&T=kCs~C?ZLyXWwJr`g%;Zj15crA05
z<nT*J7?n7DTn8f{IkPu`mgesab-6OiAE4oZw~wYTlHYEl?xpKDhd2k<84GNP!MJ}n
zd@moqH$pZl62DVuEq6C@D&3|$6h3Zxs7Ec#>m%D68+pzpW7}*Jl#4|?^sKL6bV2Cb
zhdo<v|2eKCrB8CCEBfu`(yx;5TcAJ9>sx+26*8$R^;IB6ObR&<$eWGD7@H;&bD%eJ
z+0bm!ZAFwu_4w4~qa+2c3KrWx1C@+QDcdo(_j62HYefv8CF+t4^eOQ=g!rT;(hTO1
zBsQCI%q^B7r2*!=<SLPZC&j2b&(H13?t&+^qh_^da!r5>$-k%fPsqMiu0-aXEME+m
z1sO-GL)W|jm#2eLXrIgRp85JUABI`c^(2FHTB~{g26COrbrA7&j_FB5kmcIl0T9OY
zFaR_JR35GOKoSLwR|^06RqwrkktcUw9F@o9V?o8qDPt;_oXfC!lTW2t9k?~6TXX)b
zTXF5i2j9e~2Ut}FewEWVOY(OtqpU#2Ck4A+Mg+<L9M30KD9HF@61XydzDB;;)~YYf
zp=Ng<a-cN@nj_D>nRwQC|9)U9b20F?jeHZ-TO^!E3^v%jbNE?1{a*ZXQhRKPqD0aT
z^lmOCCB!OgR(ffh=9*XHc%8&4Um&L`LHlAp8wM=L_tt(NQ02GiWzc(t@V1>T5(jCD
zwc<HCE|`%Fdjde|$8Gn=qCfU~`+I4DdBxXI{c6f2Uf4vi5^a~Mj#AZE`oN+Bk9u2t
zA`+X;Ob*6km43yevx6KnV8qk?w>mn!!)Prgj**d&5Ldf|3L0@U<a&JEhvQ=$?nD;2
z($ImIKKAqy?<$$?8xa(fO;Ro*AuWr6PrqbcQw`Kn6QiVJ{eEvkJ-O)X*f+N{u<FYa
zm_5;RfXtLQ`ZdwJfV62xW;yCz=NyN+)rqY=Mn>~4n^+jAE-vQNdu8=Q#)j{RR9YjP
zkX{DU?|YL~C07TMgf)=%H=As>oI~f0XMR$(kD08|)QE%f*uK#}A7f4HrZnI#GoEbr
zQ}j)VgKkB2qKNt)zTBVl530AVMQS&MB629ijgSXM0hDtE=AYj@a#k*NNwroPD|Gv`
zcQ$ZR3<;kR#9BmxoHXuuhJehw{(gg>8VV1XUy*ym;-+Z4lq|HCNB;dg@RzTp#!Q3@
z>sf`Eg;nn()O>A>!qwp_n*IT5p{kv_D1V5BN{7A4D@%v-A;Evh?hCKKpPDNH_E@Ap
zAeagKnQ*|}-S1R4w|z|*#My>vVCX+K6?AB5pZ(yq4^VlR$AFE?orLCo$>HX7Z3lQ~
zYLH>)Kc7T>oPTLE%5^dp5FD%)paMS2I0r?^S&pL*8Hzx$Z>54&b4oDsprjJ@5FLY%
zdGcx4U1CAMFMs#cpmDThIWg&gB)J()4=DdL^>xfmcQxRLCO>YYhZ8=rp~JFdj4<>I
z#-<z)j{`>`yRgqn8GjlAAC7$DNCy?K)?;pdw}NR|8N7boTN1P7j?7w%N!4Zg;%gBe
z@3@Q@ku=)1=Hpz?zocO}UlKvi7G*)0XPrLZV73FK-vxcseT%D!jH1_ReF({Y%KnyG
zzVSj!p3RTH5!cdOMlISo<n4vQr)L_9wU!-`8ro4=t0i)=`X*m9QX^xUsr%8*o>L4;
z9(HFPamC`y$P@a|E6!?#zk4VA#azt5nx~I~c_EKYvlyDkU#+qfs3x6s=J_6Q(B!?L
z#?@zj|7}o`kqLPm4ddw1{;G^lFUp-pRV@%CkQT$Jy$~a{-vaIJ7ok|ti*T}BwsGq~
z*fNv<Arv`d|DHRv{G5B<onZ4CkBWoNHnK6Z;)z#T+GIw`Kv{RK?{F5cWu-4Lm24ei
zh<fTyr}{QI<}_qK>Z`*mwws>&i4gDXkpx%zngKHUKg}if8ur4><sIuFHm0)3!@bCT
z-RD)6+U$0YKaO$3eA0?D4|8elGIfcASyi)mmIr$|B?5HnBayRJ_L+;n)_xi`XxZ4G
z%owuj9V8goh%B__Hpn3xdg|o+KH5EdG7`qZ^z$P<Mclt<3gcIzm)#TldSt5LDl&{;
z_vuuP-2c0H`wh-MbL&O9;>Sof+nEYmc#k$@+&`10L8tHKs<Ir|&PHht?_Jhz){D3k
zPxYiZzAHXTh2x%~9ohos-s2BfM?x%<9g_XEGhIN8D||)|?jivD@FUmTs0h0U31!s5
z>@W3rsp}cbz0<ziYVnV}*gCAMWbzn|ki!bb%iWYG;{;d3labk>C-iOE^f1?iLm9@0
z*;fML`3)mRb;QM}djX4q5rtQ~isw~s$5tS3qC*q4yBH|Xp$WDyXG7D(c+{@W1JNE^
zDcr`UjMc!I!a~bGsgq(Hr&lN$>`Bo0wK}qZ?VW8o@)iXa{j)utrGQ7#bEq=qtzcLB
zIDX%vi>=Pw7tK^JbFyFTViEE^iY<kV$eNg_)f}nN%9wWfig)S0w1S+YTF*?RL^@92
z_&&S+##IbkmY0YoWTueU`kka4+Xdaqc%aoK!%Xy$bsql}j*KF^FYzN;@X6*6%Fg1!
z82Za6M1sFoL~xl(*8g^(5<tbgra&)0ru=~<nZGfpc|PO~kgWdt5l*9i6Gjd{r!J0)
zkeJ9=uR7nVEmg!^I?|RVdnZ;bxVOF_sK-17vZ@@1ph>)MnZqGZHkwiw3WyU)t@_y-
zLkenoKLAmZkZwW?+k<Y;bDb+}eOqJ{+MRwcTE+BtT4jyfA4xWGc-%56ls-tgWo~Yd
z_nA4}tJ98hWe6uNaJNDRF-3lA>4rU>#XO@v|J6d!FkHAlDHBpu2Fs{=FAcIfx6GyU
zK$qDMxmlTyYOs5)p!|nFOc%a8@VK4~oHTs4U0FSBkna9?*(Fa<bia`Qzf(FElS}`A
z9=OGD^`mF;xNr8?sVDSZQS|**iS|~TJ57m6HtiEE%qn+SilnJul9+qSZ>MTLW6sT*
z#q7BCAVyR1(Dm!xgkYV$|HwC`)F(W~r+)uHwMypq!(W_QcU3Ax&!Uf8KcP*AU!acl
zO*dS#i=|W&2$>f>Soqt}ilhgAJU8kJ#n+a5!FES_W}9;{)66ynqU$-#L2tw)CWL}~
zZl{z7B!OtAaFZz`>-d*)S23F)f4vOKjJZf-EII?R^<g{;@93S6KVOuf`I!y1l_JEC
zJOQL!Dv_arteB1&kBMO(%}IH^b&OL>E%HpKi_ol$*rDanmK#VD@&y7Gh8`@XV&f0C
z^#&4T1;6k`&EawAm55Si_k^k@QwNJLC!;ZL<pS4_UK0AA27fB55?ozkgKu7^yI&Ip
z&jzqW7wX)kWx^&yvCw!TA$xoA&WpXSxk*Vl*K&NHWbItn)op5@&<HxpwKuG8jIYym
zvjuX}Rapl+aGqmFmQK1sk)Ei~#3~*V8)7GMiACu|Yb-JZ4mZrdy{M`dohx9NYfj^l
z>i$S=_0E7S5jc6gTGAtgE^#QX&2xa`DUi}P1~;DRnjs-gdfg#DKu1(rCsQL*q-z>;
zK}(P8<L;1moft~hJl)Y@k|ss5ro{1Q&c<IhuoHHzh;xE1Bd*2WXv19IZ%<-cNsL!9
z4*%vO#A5m6qaZ$g2n88BDAM5Tf+v&6rLwHPei85D^9?3#aU%FhTP{pEpAWdc)Ine$
zrA$6^LXLImnA=U(h+dFdR!L?jk*^(uy-tq#Fg2)zOH4Q@y$Q07y30G=yKyhy!4H?*
zZ%8WQkBHMHcqh7kd@HkWMfmv%8y-kP?DrudQ7x=0_Yq$vSCxdiOo%Y!+u{F>&rL?w
z2$Na+0iuNUI!XWk^((LZY8Sm%ye4*M5Os2J&zcQKiYQ5MxR(r5G<$M)8P8@WNxXoe
zKqG>-Ah`tfU3J-l;Cj|>uFvu<QBC0?F+8NBd<REz;=6i&(1zfGBR|ao9gd=}Z-*W8
zORZuUQt?CowxbHscL)x2C)@;;{Dl#77Xf(g$+=v2V;qTf&1S=*U*kiyqQjN&*pEu%
z_anl-0-8_h0WUB4#$-%$g|{-y5(EVeMP*3pdtPq6zZ&z7z-QKduzce?`>N{2kT$xq
zdR_P=jm-KTV>4{9-vFQYTXO5<EXN#XG^6_$bemaq{FX-nFL`U10P0CT?-S9puP#pE
zArkQlLWW|UQ!&)%UPU)=!y-|-;)TA;2NY&>gYcpS*!A|*@W|-Zk}OR|nExn_8OX9K
zlf4Vpi6zB6ijwOw+Gkc)F=+pwrZ0i>u)gk=ILQ8iiyD6#+LJGg5{eNYsRK6nah7t=
zZE~X+p%|%~HzSh0QM&$jZZt?xnYZCwoyd7S#wm+ekZaHDkz`>j>8jmnh;hgV65%Pi
z<d6q*4aTARB^t1N5wCqY$cbs)?PVqB?T@&ax=#_x8vR8OXIgcl3Px!jT|}~r-eB=^
zE)~BWo)U7u2p^O8qFdi}Not=J?T`M`@58YI1^y1raXNFc31lbVn#no)CB;E)T_?x;
zNauRWcHgp7!HmhtYNh>>BKZOJP3?T`ZroT(M10SOebU1EMZ2^OQwp+8sFc&We4O<I
zzxjQtGwe{RnS7!7T1Z+C{@)h)Q=`unY5!T9O_@Y6p<Z7)+Ge%L@fHw^@!zxm)fohl
z2zUgOe>QijX_5J&=Ni@p>s}lhePSI$I`nc!=%UX_X{xHT9S!*p0TjZkF-N*u6Yx*P
zS&x;A!<tbz^w0+c_@9CVmJbDU<~)M@!te!OfgdY{!bVchz;c+w89aD7M7URNJfF`=
zrUEtYEuE}eqm=|SZl&iGhJdP+4d2s8TK+pZ+`4o%z_>3HeUu62(-|6>3Z`a6xF%pp
zW6x{Bl}sCM8&!jy8`sqX+zeID?9bMFBF+=HyoP#9jg!FiuvsB}l}(T%9hUIto4@@`
ziBQ){O=(!Rz&kD61zc$UBrd9=lDQiE`FaNM0p3|EwxZaJ_d59?lRFT9+tAYI<~!G#
zF|b`U@ECdNPb^nv74?*{ULC(wZbz>N`I3g+gZ+a%1e7K&=jc{%rs*d`mM8Q<>v*@Q
z#Z<b0!HZDJdSf%&&a_)%^yqlNYVq6r#u?;b1p&X7pNF8Ky$ydG&Y*Pq)YiwCvi%(z
z39Ey;7!VLtV|vC~bjHk8EXtfm6_E;T#RbbcMISA6G8xP_F%zm19T;9FbA=CymnGwS
zt@;fic{-}jsb$sdiR5_z!H@|cUMr}7Nf(f=BdT8Ofm6$xrw?ULGq+GCaT$aH5LDC+
zIOu1LsAl=_o~%?hoKW!Xe?E+5BOao+)2J(C+}g~Sk!SaX1O1{*qRc3SmDQ&V{T4|v
za%mf_A#c&#!ugP~BmA!!kz$7J&K$op3ooM&ijH=P;tj~5rCkAYlu`|G<t3gNw6rD@
z?L1i<(mlxa)O@_W?%LOz?{^6wROJ+#xxAOR%9B4R+rHt#s~O(fM@`me2-7@%+jslc
z>Iw}sn#OSdXT2LjP@VMO&M5LF;Q%QPLzlgUs+4V?oz-YX?0<Mk0C2sU^jgcgKji?m
zB<AA0=>Kj&Nmco!e*wpOd6vN><$D7wK7TFM;MH^E`~`#!ho1vw)(t$g^H2<ObiYbo
zLlblYT)&s54lxcEC=vI=Tz}I?1Q!ltpKE{TtUH_k&U*P{G<1aG1jT*FwpruWlGZdp
z8YcZB#vw20ZV#ib6Y!wQz}|5g{Zb6i553rc=5LppU6xplzuL^_S^fE~+d=8MDNT$+
zYu3f_His^f@={>!5nXk<)VAR|6jWzSej<a6wNBtb1jZU3XKT81uON$P=Dw~B&aKOW
z;R%pGd5+f{cSs+U2)v1^57vz)!Ah^=oTxfUW(<jR`Z@K8Hu}zAw02c1-;9>Sh%0K9
z-Ht^L%Cx;sWX$I|Y)qVAexjl=ZU6JxuzQx#`8c*H_og*2p0zh1*_obOnD<MxXgW6<
zy2IO8du%eo5M(<+)FR48>~8!Or$*$|W@<&{#T8RL`Aic&GnA@;GZ!TTrJKNwf^Rs>
z^m~5eVPZA2UzG{Q-_YVGr*2Zm-wdTwX!%o~CeMBC{JD{W_vh_<jFKHcQ8$DxG|`&;
z2Z2Gu#)pVYU^2H-KcObNq|ijf22ohpn7+D*dFQe>*93qQR-@aSH<TZCw$W7XB@O0s
z$V9Sh;*+v}rGK_AILD`-lkUP+yZf^E<&QK~g{*TaiZh0~*cmh#6BKYN6Y=gkI+x4j
z{8pUldC?3W&N{PCD4dJjPgMb8uY|=V@*~W)waKD5WmC#NRq|V6f;OULIkj1+Kg^x>
z87p{7TxVwNEQ)6{y!;gjN=j68x|TafsQ^pdHE?jB<=Uaj(D8%lnf!C6A}@ZB95HFM
zC4T)?8Xd&|1dcE<S(9Nx<3#wQY8HayoIjiJ)Qwf(t@R>pXy*my{aeGp&j<T_q8nuq
zZ}c@jDk?6W_{cs#P|*3?u_qOWy%v-8p5XBtHn9Ysp(kTQ7|7UiHiSQ^a{8`99};=B
zvG^imEYVTB5(5bqt-M!_cSdrqcYf9{-`Oo%2~!oa+~@kgi`l5M<F;!NRJ`mzigWTg
zkZ;lSj5;M@mRdbv-DAl#D+7`d%o;A;Nx9nTx8CNHfWO^nANJW53#7jdNex^V99^A}
zzQK;UuYGI0m93?3jzbAZf+QV{=b=269Lep)>jd|;y{r)rv)z!S)^1%ewZvKDtAwS6
zsW0aSJ^(_2YAD#*oH`W|ttBclJ_cp$m??2r4nDQMvuj296&qycdSy##VJAVtZjrv`
z%PVFJO(mj2A(mqfiA;Xg_2Gq39N#*Lk9bs{WQnRpQKT*V`kP%;Hc_unY}P)C?B<FB
zi`o+O@^V(9Udhm!SDG?GFCZ9IY9^;(r55ab2QrEiG0$%#HlSi8<Z?H%!h*G=P)yg%
zH$9hntRI>tss%o!4sH#MWCpzL@>Me&6{u$W<k~e0%mqQ@>=tgXB0Os_B=`dN2>%GX
zQaFx1kYKC=^p1Btkludsu`*zIJDL1gXqHe(ezT@Bwj<B}+Y1uIu0LaH*bFUT#_(vd
z?<5TFNQ24CyyPMUY1uqzQcqz03KG@ouI`$YzU4(2XxZG%UJ<b3j7~3jkU-(v*NY4|
z<C@#;v(skv;c2$5A~K`+$(1ym;*cv=FH3_TW-R&8D}8ZtF>v8|PanZ;s&WClxnuFq
zRYA(KV4p1(RR4q{$J>w>J`3lS6{8=XOXh=B$!<%UULUU_+4e1Ty`DqQ0yo&6+dV?Z
zUiQQ${;1Tscq%H|BL31(E)0u0|F?Z|O71`N4L$7g*+Sd&LlQ=>bq}d>sqyPMQ#O&R
z^1e6Gx$ImX@5Ts;FQ^=9*vWX?-GLE{A0Jbr`mNUOO5Re~(z~k>;D;vVfe3xE^P7#t
zmFc{V+PVO%uknH+540z~eLt_93}-_qGZg}(c0Aos8~0+pt&LrGSd5Kzt~-C~yH;?{
z8Vipef(gMNXHjfrWsWe{6C;FGHxNscL5s(e;WyT9kTv#%;z9MhH^bh_Xfk_!e_39+
zmD0Pu`;>k5elqCS>i*C=hz#71S)*R7@nCs2us>VCgbi$~>*QLn<fHj>$qdwf$<;1g
z?#WitscLr3$Ct8-EoG+J+etgnHx?~L9?~Gg(&P7xzrX+YOS3Q6%+Z_%l@{eMKfE!f
zE(0U(S4N9sG0{HvKq$1&6sFlq2nTqn&|{35;r+C6(JI9is_fc6%~NV=N>-GVB@BzM
z1bN-mb%VV`)=X|%)?s7Rg-?-D;<3;dNfaX!oEF`xSh<>d3y%xdXnNvS%g1H#6<<U<
z>9~zsKeM+G$b>L8s)nIKAG8~#Lkm2RgkxL080FFM`S4xa8@|Q=AO(-_e4gkI@(Q{F
zYz`BpU19Wm&WjECr5j0+Y+aa~M$sk<F6|Fh8P_CT?p^0Tl8_asXa0&uqmBbS*>#*i
zyzk)XWTH-Nc%3<zfe1;ffYuAmR@wGx^dv^ItZkaRoVX>ekVyE@OQ*^5mFK<yO{!Fk
zCvCLxYD*^8XsNtD;Cq?CH!dcbJd&(+Q4X!tXeqA7S?3Bn94Uznivs*B7yHWv?;rU=
zchOo)M3(R7)DEhDIhT|op=llhv?0yytaW1R%-~>@{czS9!_Y*%Nx)eTNwI#qq?APR
z?de%!K3NK{T3X|B#)av-`?jMlWemvQ1K5(iFf?N(0=a<sV8C+qHd2S6C5h1Qm)Hi&
z3;$m`4e+m~-|-b<G-lW-YlZ%2sL7rsY!a2mke(SA=iKky@xSoa%%nd|hO8QQC7ojF
zZYIw3ySG|Bli=o^((;>>vp>~1L1M!MS9p`-*<}thgWHtom|X3!^S_6S49US7ca8A7
zgKNH=#hk}m%BV}-oSpqs?^(-d7*Hj6b#gH*)|Z6X$7I&4yJK_tJ8SqtP2W-Y?u2Uu
zJ(lE~+#D0sTQ)P5EH!A%ed@q{@+ryUls>zL6wKh8*5+9}R~zwG!K;u-U9js38KP#k
z)mZKB-K~V8go*}?f&TfJ=-Cfj!IF%{K!7QII26vjF|w)1NCVq^^<vaF=4wwvP?Jy)
zJ@c0WSP(_tU81(h=n|YhB__=`k&);d5*WsDM}!tdj)}tCSwwoBmpVvBl@^`+(}vFt
zvbDdfX6us?94zA5znQg)8hk<iT9WM#={^!P9YY;q*-;%yN-s~ap3u2M<{Z0G)`;ou
z>AjMydsZDuUy{+G+ygFr;Z!`fdKYO8t#B+;Bg0ixNRTDB8Vh;}FS-jBIqv`ULicHM
z^0##+K4R$Cw9m-z2A4wQt5G+(e2(-ek75$<7vr=7ftk)wiHR54d#?AYw_n7B_t>^6
za>Ido8L%_Zqlu_2IY$Awbq^E8XrbrG3h(&{aXI0jy2wkWFOuZ*=ZfvAWuJ~`D1*KK
zA5(uB73CYQ55shKOLw<)4c*<{AssR_4BahAH%Ll%N|%5jol+tlA|21oZ}0v7-!HRR
zYd)|T=DM%*JhEk@+`$O0qyHN+yq(~-Z1Tg1S1q?k^y_PXEYFaUepe(k&LF?jO0B1l
zrM@DR0PTGERS4WF5c*(6M$?F9L()PZ???1o%Om&GSgbb>+k2a3e=l%FaC#p9R?y>V
zT7eHF{<Rwx#cYqFOD>&TnPh<E0M{-h7%Go*6P<FHqz)52o$O~skP-IDL;PK)NVsFi
z+3_~KtR$(F_s1{$hhWx4D#)KuRCa+-KPhnT5%=82D!do|;b7Dh00w8Q=-f66S;W0b
zG;@ry?pH>|ZW<nI)}Ou$4VUYS<qG*-|JibC7$$g+w)EC$H|&2_OVP#LhkohHKrfwj
zI?x!ddt)*qOl(S<jA$V!o`tMbP>%9x@LQ7#8V6TtyfAhuFN<us`tNy{&l*da>Hjle
zHx?&uL+xb^zSH@&MtF<!47I{q{r_WFSt-<C$APXW(DI!P>Cdz!xL_7WrcKmww+}Q_
zU4Jr-WrklHU5h_k@ukySUE4PK{$8;wc=jTKsh{lKXLG&pU3q_d@hIn^*1638LC8X^
za}`HIPElM)wOhaBXm>(f<+Sb8!h)%?JZqDMj^KIg^$|k#z*BaO`xz%FcKos8#^+(^
zTKpNYKQtU~o-2fC05eWr9QmH%?ERXYvDCUjw~xC75jANV#3|uw28aHOA$c>KT1giN
z0li{QLW2!oImQBcv}Etd=5ng2Vm=0~LrP+l-JBY52XFu@cr<UM4#PYg+O}p>zdDBT
zEERba=@rnM4i3<1&oK5t4lkgmrDTAS;j^#%>;Ct>%|u#?!>>JZRPmjVWf=S6-32TI
zh2!~5%=<_L8F%kuRqf=W#t4C56VNR>-sa_&Zl1&W81g#O@-gC2{0=-r$(Yjf3RJws
zre|?*4AR30T1(;+lGqIJ-_1e}z>;CwvBkpp*b#688VCJ!camgdkS|IH;3sdh>{B3J
z@z?HgP1AId&UWET(~515NyV#AJT5GeuXuV4uqx}}vaZ+N#ATG-T6mp98urajS3%c;
z&*m%~G*ko^<V4xiy^E0PLnGbXb=Z3Z*r&Z8hxy7!B&55!6nBtl0n9q2&?sDdc69s+
zW8@%CBph`OcB-A(6=`UsGPVg~IDrX%GJ~rz{8r1&?P~nrUVS8hwOO<r1Z=Erx_M2r
zvLvT_y&q9i3+2VB>2IiC#jnH0#&*sfM}2Fdv^@)T2#@ZgBn2*?1gKcq5Ys}Mj`ms#
zN`Rw5!a<8&CR*r8v!mbf6yJO;ymPbWdai!qp~-k;p)rmaS~@>?@-!jRhH+C~!`?ZI
zrX{R#>n&^tkoT@Ft-II9wOwa*K;m6q#dFo)waKC%HcMxA)m>7MVzg-M9(7#R((DuK
zZlQyq9??QRX)6C!UA4BT!XKZ~vN~ytV_N5fY6*!If(R%i=lPq>R1FiH*$TgR2$?Ao
zB&-=gGyXT*>&THUL4PNmhAWH@syL>ut)1-nA65f+JsSf~24*224WTAe{Z>cDCmTwO
zu*TKEVi>JuN%)h}nuc+C+HWVEpx&ER$F};{bli_!{X2YK00SU8J!0<q78AatQW6rC
zq1Str?%scc*pGluPT)O>ZyZg@esxwP!`?FhWx!awR(nN*lk80RXh8V@0Cn}Ja0PcD
zx`#3Pck7Y+=gGza7EvE!E(USdr!v^sK$ur*w0DI!Qev5>l{Pm6bQRC_1-!Mr7h|Eo
z9IyV&W#mfxlHAt*U>R~fXuYWL3CORsu$7CWrAz=fjZI206`&4iyus;zLaFQnevYXh
zj<s_jR7KM=`qz()vCwQ}a#{J|1XDgdo!Ei=Bc1EkcOL+MWq}bs=KBjdDNdKLJp{BJ
z4FkcbJA>hsG!jmQFXOK^7m7HV7)!I?6tm!pp)5#-Bu}e5t<nQ8?6A0)_^QGkVe3_*
zMX5<7Ui!;vr0Jsh7)zmuq2n{!*Ca)e2GF-Hc+~KdB+*MFUG=bI9i$Z*^jty<v60c+
zRg~%oJCx4)qA?RPuJqVv9ER-PQDjr5!!~<d7{;wx1P&krxh5H7j7N-k3I2^3IY8jO
z1Ye<vjF{1fyi`mlpog4c5<YwQph7(%h2WMAD7Pu%*=Jo(bKgj}-q}MN6U80;aglI?
zwT|ABQAKAlR`>O2HyG}^Gl-!QH`SBJqEfExtF}#?$56j?7DID}BF}*Ac_ozR?S}VE
z%WX|6l=b;>ITC7z{Fuy1m>cyKveNKAjds2XJYzeI?lyOlYPoiB&H9=D5VoAL<x;NA
z`L&-#vRhe!>AgnQQqT#B2?m*_9@WVBhfl|8ObmnSUMz#H)2F?_$(wO6C9#*^P!_H5
zEF-s4dCps0nnX2zP9PV3P@VjATh^E<<qo|_o;<hbJA?5rhC8@fq|`)$`|kzS_BZzZ
z!0u+z!e7^&<OjuzKUKcQ`KVyv4}J3*S1J11huxWx6|_7(si?Q#0)Z28Ma?MP-)%Nv
z{+OIX^==i>$Ve>b{eKgcuFbE+%IWXhHPIOwh>TDR?zmC?RjM8T!&tu&G6dHpM_9o}
zH&fiEe)aAjb)Auz>--j~clNxTV&j{rJ-!VcdUlhNgm+`ne)!OBR9YzAOx5`^uo#67
z`$&PC+pyLt**BeKWp({(`&!-{^$Q1$`UlWO5s?F^uNr88H20+KA<%Pc^Qrv2`;|)3
zG;9MRck+q2Nm?LEWAY8dLB>La=5T?my@;6KsW~jaDQly`7xvz{UE|}@nh*RpJTCS|
zr6f%;t&@-XQh?7Yql~HQnvK3Jn~kWYfN10`=38cgGA&Pk%*bh8(+TI2LFY+9-fY%1
zMdvL^_{hA&AIaks_JjO9XVG<VV-(8)&sWLyZapHbKwuXMPMuC*{!snFPJ6?@X^M{|
zs!zT$K>HnarL@vWe=&A=ruZ-_(`fvoYl{!*BS5iiTF$r?hz>f%ZK<@LcLUZg$PePL
zif!5`M(F5!R7i-^HO^ywCDHuJ5YLooK25|<AVF@+VQs5P_MV_C=qwZ-^*2@qU~PHz
z9EpEN(JbI<iXZa|+^GpDiq77jWP=zJC}|W-kaj-Lr)u(>LxrXyVTuqgQR>MtP|-a_
zU(X|^kbY`(`l{jVYdna|kjv=>(5OOEXB&R~6Z7`EXD<JaO9ITZZ_^O9V=zEZ7b%~6
zh4tWCeh4v~zuZDzZzp|J*9#l;?RF59{*qMfn7gm@+NaS}ucFT~Wzo?gMTFz=;9aTk
zd!m+TT$){m(sBx-p@Tj!poEcca-ZjA{yroATI7*l<s^YH>kkw2ebZ*bOyWxwby}7N
z1^k!ylJM%W9e{9ftL82SuGCHA&k-2&I6UdryOfHq@J*oS<JNH!#^cowPnc_eP+))S
zUyvU6T=RVcA3=@)`thG&ugOFC{Om^UPUkrO=mfKN+T?Lwc%x&|U#jw4GKYb=eNg2n
zAYVAsbilnwxefUR?}p1ccjn#D!qBCOu@>{XD`DBi8GXPOavSgQ<MKtASoPsS_Aoof
zA{c32BM6~r@o$1x`C7ZaDo)=Ik4JuMcrFIa!>rGhW~Ry)8tGrEyIzbD0zTY#naX#}
zd8L6A|Mvv(&gTi{E<m`C2718{`BJa{f3p`F`tsP(8)Ipjc^acb1714e``W7ZE9skR
z^ajdf*@$Qv94<mP7T%}1!!U+XEb-`185@5Unq9|eq!?427Y*$4v}S-rA@A(K-vgX*
znRy2#Z!!Hk9;lHhSg4~f_XV#V>Prgel>&F6Ci2pSziPWtZcPs%TYBwxmhnqxvuQhO
z<M3WNuVRs;=PZq?M>{OCtW<D44-0iJTp@T16fc+*V#c+-JHWL=$iAljn6iUu^<!DQ
z9@@yS>EbzUI{w2XxzlYl`TOs(8(sry4FvbVc7N4;N;E-x0NkDnxKh+m8izjnQZzU$
zq{P(3IISCUHZ(dn71YyD&*u<GWap$1o633nkmGm8?sjJKH&v3rVzQdGJVB?zUeN=M
z4AK~gCzP7r80Z$o1y)M;DIkxzu2rCrxCvenCmD&gX3AaEYKC`#`45>CMImQ$;UJ@8
znVOZ-lYHI$GvQjY`&$_{GI_=pt^2!_kzwL}ikrANUYEF4*ca|K4~yUE(o*hJ<dyy$
z#N>JdG2boq7#xlRqDdIreqj3o5&D+x70d$2)eP#s9y@A?KR-w2oKAA|1^i5cJnb&&
z!wS|ilNv(;0jtV$&;zNWUFICtz=?0k(Ik*4)~A*JkTm=n{3g3GjkYKaS^UhQ5_c}B
za~XWnPi#{euD|HkC=o?!CQmf(B2qxAi?*qY(v^Zmh9a3eT$x3hLmK(ziOR`tatJ4`
zbFeINt2~bpicJbF*qG)D-KIj6@|@9N)F)vdtfrgQV?{G9c#v!7&<-tZ>|U1t4L%vk
z-6PKK)<E`m>ND2OpNdP09TG*pGsF7iscv9YNowP6bv^WuCq~RD5T-K!U{AXj5mQ85
zr}S4a#m~CMW*BTkt<b4LT6gZ@`XVK{qT_yT)5H0T+eQ72E9p}-{dABFsSu_#gZ6%0
zG#{Bj4bkh~!M7vz7^A|quhaY@pGrvf9{H}In?vN>z~T?(=`HGHZ^^{%?Z0*xOCq=3
zF9MQ__p%j9by3r|eHzphY#ELMEFb5ET{Er{M;m7M#W+wjJ#fJd>sRR#{$;lm_6A~D
ze-X8SsUDC6q1j?AQ5i`68G9e~{s`vEGw(`s^xyvz>orzLK^22^qcZa@=OUe~<8>?t
z2W|WB1izW!IRcTpF^j{*rF<}3E~U7%bODr0W)-jX6kTk)rOUIS)yDx3KMV5T+kVfS
zc?K%PMdzmrNDz=a;G29PuZW<#etqNMh!C!$(A=NoZcF&L!j<Lf&>puYR8$XXqi4H5
zwP`^}m{&<r4F1MZXiQdp%hbFW@y^_6(J0au&>eS;xArk(V&t-GP6QtJ!;c6Z3@>dW
z4n_|$jY$doa#u;wAXcXwGN#Ul#%6t(7$rcL_tDumsN@NE9Motab(i9ey|VBG8Z|o9
z4|w||$k4n>>!cK*3ZZCmRF3?Vly#zsf-KY`qrncpAJ7`~`x_F9Hi!#-i(qVd=)YG$
zrSTx7=>I|y9u}K7G=8bQ<5;o*x?j#W`RwOP*S>}ZIqE~Z&8duv@vaX|1&WM}WFU}6
zkd1*v{!a04J@w+hBNQk9QE26<CnPZ!IxjAy;Et4>F`-tL^zEL<oU!df#1oIwbR0fY
zR8OrjVIv9-yNi#vyY;;1b`$fYeh`E3R_i51+H=*u{L~%zvU<|i3L#Qipuswp`d7W`
zTfLsX{T2`7#so590&guW2nu|4b#3R7hY{NeSah#`lmZe^{Gzp3>I1t%sRN_A>qJ&F
zZXuY)-)UZ&Ch2L`Dgywx9D<NyHo1AE+gq>aI_5;z@`Pq~H<(}{FIWb86pJ+X3F5Ot
zMu=`?Y@Dx|HvONcS@)*f?W|Y<IQ_lPh)ddeR_DvDZ)Agf<{6gCe5Ev%B6~$A^bXN^
z)jO4JYUauyT#K`ezNdX@JQqJWF5pfTh`q)RV_;(lR8J1b{ho>wBdcS~Pjx8IpXyUc
z4wkGy*vm*E2Z`ZOqN$*T!GYf~i=!Z>v)z<~Z{GBhf0AOeiR|x#zPNgS=M4T+;v*0u
zmM=ZJ+7#stwk)`yIJ~X>^L&0Kp<DL5se07Ahtp?(9Ij`n>>RYlYKo|WHkl-E%8VOy
zLOyj9w@0k}FXE{4%6(OL)o{}c581xX6Wy7V!uNmSGH%896#mpRq|-!be?}Ln&ZWfs
zp|!>S=ZXR}@%8}C_86<zO>JG%{cYrnvo}A!vlDSwctuz=)D1H|4eW}6G|FsyjT8Kp
z=Jp5kwZXG!Hduc&Hyo^+#4q&LZHUHh!!3bQd~M5?adA$sIa35amP9a4XkJND7=nAB
z0h)8dUnXiNDO&vD9F9DXVW9vEC!%nU7oL{A(A8{u8?y76<t*}I@Ij}}Pe+LvRQvLC
z&Nta3w0d-HnM)Bg`;TylBBBlO3AB8##Zv$Qv=AHz^V;kJAYN^4rhNIOFmPhd_#i&u
zup$7~ew+=w&<z_y0I1=`EB2k;doo4Uw~s+;xDZMFbVw0pTOx>IA49H6m~rS2F|#Z&
z&T-ncHdNz;7ddPak8En}?^j^d0>)ZuU-RvOh}j<*#K)p88b^r;I5#YpsxcBkweYB&
zY&_BB8mCW&sAvdILQx1e2Bm7HX8|u%0uW&nDXl_#Rv;GmpvT5eSX<F<ekzU4uu<Or
zBSw5`bQeb$28-uIaBc{3Lg^VyO_pgLr@A^c7`=zPUFbc3z>!vgUkjMFR}eUtxDP3i
z;QckKC^9d73A|({^EriRCwrspTE-UVHaE8t+nE5g{WO_yF8@XP!~O@LKi1URo`+4_
ze7-`%l_sxLpvZfG<gk4VX~r@yL})Lk-_r7-JcmkTWh>*Gg}r+zevbE9%aUoAUM{^%
z`kfrm!9}Z*HRfq+o?V?-Sfg>H5rzy~nkr8nHe_ehQi;Jq#{0PS2~Tom#Q7Jt9H~3@
zP`!GH6yWIiG%w+##lDB4Y>oA}rDOl6eK(N=+Wp%uv4ougcoNtrUz(13ckaRgR3iDA
z+BSMf3(-bWF0=}Y{`0`E4RbRx{LBjLJ=(IEn?!QbNF)|SVJT8LEbOmmj8|d9$KMIz
z7#9OB<IL8l+v2>#6FsZu(#hKddf2YLCvVJv$F&daxgtFBhwx2EsM>Lu*uURM9E3{|
zMMaJzn&lXh&)-+)A!Y0p0;hp=jaFPrMSCtM@HEg&PLP5f^hx$_l&e>lHv4t`QQ)q<
z&s_h*`02nqyOY5a*kbglE5^U8W<Q$doB4kzGeT77GXvA8bxp1ti7jn<_mNIrtd~H-
zCoAtT?EzoqFSe;xlEexOcyV_>xu#=AQN}>wF^D)La#Xk$n98FL8n5mH3EG}Q^ee9Q
z{Rj+!$3|OzIb>a;Xwd&bK(<>Q|A1oBReH2`VHOe41&wBsc0egc8cyK#7P8ndnAK_R
zW$g3EP_?Qn*uCFM;e{2y!W=m;471s1efv%P+{urDz6{wbOhu6GuE{`<JgCO~pUus;
z&nvnmIUG&?ZR$@JRHV`rL?t8DD4RO#yNcZmzR@V^JJaYzvAWq&XVYIzsJY%87-+;&
zvk!^RXz6KB@`g49B-F&XAO>A!?yCnGQT*T<oIDmC^lHjDM*yVhJS>9I%#~P?V*fUj
zFY}e&VvMglgmoaY;&KfDJDa?KXdL*^5t2q|mv8Eu8r``cur_{)cUu&sdHdXe0E3~{
ziEl4~E+^%Xo2!zQF*$&pIY<XbB5T6NYrp*Dx)8yyq>}}q<L(oH3D#Sd3*CX?H$fO!
z59?a4@1^tpvVr<~0Xol&Y`v|r$rlw=P%-kuV6FkE8g#R6<F*?mFo8V(D~LRd*T{s&
zNsic(K8@&ZI7OHce?5PF?wfp+b`+kA;R%B)g<q_dw>4DD;)dt$ANoOo%9aR0`qyA1
z`2oq&HzP*8T>=Fbt}y@GFITdx66q6Ed=z<?Kd#Z=sdYYG_r}IGmD5lnOEy}r2`On_
zB(Kvp#!Yf|boE~`<a?iW9Eknh`=n;74Xy<*V+h>+3X>D()a=;bP)<|q#0efrAR$!1
z^ROSo+@tH5`lu%_O7%OiQ|++q`V+TO1@gXovB2<|K@mSay*1S-30kEzZDw86J`}Tf
z3}pLHY=ThCX;CWVB=0o_{0HK+J$>d~+rlE345j$!X&augA={YL{V1#B<Ml+|wYLkL
z+@XP>TV1l`MbyG7mFpFvPlH$se!r)3_*HIi8t3jN^m-d@`YtN`Uv@z+yH>!z_n6g)
zLPvv8W!<r^N465JDwxiugV7a?>>?HM=}&CVk3}hg($j-LI`(VSd_Xw0L%ceyuI9_~
zKZmIdE;8(mKHsLaVhrZdjS|ppBenfMl5*aATM5M4bzwr6tm@=CS%TCmjLd4j6)qpz
zgK^gm7FsrZO7})-6)cE(PSzlz7~UL~w(FxzoO~Z6*3ME}?+Np<xxkI>AY0{FqiHE%
z@2u<mWlnt~v<C<h@A{E{a0f((*Rl*~$j=AvO~>Uuh^d@FG&V+;oI&I<d?%yqe`vGh
zKZjhvz8f1CTh2CQZNCk@+qJ}J^S;GT50ZXRSYmaoX+U7_rM^^j>D@a*1<DgEp6@<-
zY{{R5Tw5(Q*T<-2^HdK1bICco;~bFHpm)6w-}jvJcpFudxo8Q^gAw2<B4TnXB1zVY
z`*TsU6;uDcv&-eGWmb0#R)=yBzGvu!w&H>fC}aN4Vs<~VBxC_at!S(SJ;uB(SqU4O
ziu*p+aR!*~+YE-Eo-bgisK$6Ssne)ZgZDg8-Z+A;Zmd0u`)fQcJnmGbg<*sOSrqQb
zVVa5A@q!9GqtaCvtxR5f6w0Z3*>PB@pst@i>T1z7ZyMnM%dNoMo<-tGcW}N{e<=Lc
z)`yY=RV!heM<EoPAKyyY(-lq#KJ%V|-s;2;3QfaVsO@w{ujn(>fbW2pwY1UZ1_`sd
zZ)*e#E&grsM|iG8=Xa0CRj<pUYWZANBYnNQ071;aOj?9+(yhULCB<p3pd+g<z-KuW
z9drwU3j>i1y#k2$D*LrM_C4^F;G3H3IJ^pv=r`Moz0th2x(sG<E9zZPl@E=8K~pp!
z=xZg}j~IEn|LgC?{8jlIu>^dDpz~_8BELBn8({33ImwGG_`GCl;~h$c)?J4_0Y_%D
zNw~mr^Wuc<XZ3kbJpIcj8sZpkZ4s`N-zUiOiW63Lk%;@w1xgGKgSF0vFQnKAa?DvD
z&X<lQBZx7E8h}BMLq7K(?cj1(<NaHGdP*gUWQR*QXQf{^dp?kdT&Ev+jqiWn=K(m%
z&aB-lw2wn;cmp4<2XqXxIhYjU0(^l(-+C-}md)?FN!}dT%<`E~MHn(kUe4}O>@>Sb
z&+JLVvLoD}ng=aWZmhTb`r6oRF!WJFb^gY{XYC*AO#bmM!BV8LgkheiLEXnCGsrV?
zrIAYduJp5<qRw`NWHF5PdiX)v6k<TYrNl^Ui+}$N+hh2&nf8A}Up1*4nL6SMSbRiX
zV-!sK+}~;QKbIRIXaUQ4ZFj9ogcH!SSoX!NEuX1pNc@6=hE8#ZvYIICU$hnK(7#a|
z`P%TW<B?+^j<1Iy--mkj5=-0sWT}UXColLXr$5VU$pQRrJ$A<1ikl%v2A;Pj@$TV4
zgSM4=`UVY1r)LXZt^r+;pz9q@Qp^*LXTz(^RT8ehrVT0E>>1KMg8()oS_MEQq(l*u
z#lcbdzxd=2vvl4m5{`*cKNa2#5)T)=P22AMQyKdzw6EqrBk#i6VTLG}UKlsyr*?lU
z#e$rqu2N#fl7EufdDsjW0GI=Qq=Z%kZU(QWYjnJNih=Qd<VY#!v~%;U>~8hIx;da!
zyx%wvx~*Mv>2l_GOzwREL=BK7=7qoXYWV>!3t-)C7e4=+laiGYxi8U-)DZKEj7F?)
zSW0EW;G_8%-FF4prsDDop*{-mjPU3Jmv545dc)ly2OkTlxE6+f3C%F4a%q@o5O*Pr
z5HYn&a;qj5j_=?~V-X7Eac%22DF8<d9soS&UgvQwAR5mw`-V0rr<~1m*j_4yh2Hi=
z_^4Mq96U_ZneqT6rMHb;z5Mp@dGjJooxxPu-{S=4OTxWL$FrTvC&5c5dJ0eje>nJE
zi0*s|m(fEMZ4&+g7G}&Wb4wllWXN~@z~v~=)An$<RvCuofIJhXeUx#^_Dy07MKvvt
ze$=1c^^Eo=eLL4J(*wi&txuau4m_dN>qAzaE`QvFltfeEs8VNRT5h{3oyusrg#tZc
zPQ^q`{6(KG2Cr2s{RgIn&jY&hAVw96r71MtSe4LiKAL2yC@TE=a>;(x0;+OZ?IoGu
z=YLDC24K+Sj6qEvV@Lc%(p;1?gU0p8$F?8i^jtmre>1r0=d3v1=DT?5FCV7`qy819
z2e5)(x|X=A2NOdDY{5^(L5d>6fH8@nRJh8*KB%qh?))pvZ3AYJ);K6Fm-2c8Fv?LJ
zmF>~i^u0Ws)12M_=(#`_m4+s>c9&1m6qfGcL!2G?n*sX>{WIVzN%Xd{Z2R~%;Kgts
z6sRVHa{|vmsd7SySuM8}W0}--A~b(PX8Q`77G<JgO}l^d>q@-}{mH%UJ`im>%}Xei
zT?IRuK{k#9s(;E|ij*2uxujJ=uZ${JV+eXyTws=2enE9NmxZS=oS&jThJK)JM*;g9
ziMi#lBj<o>{s&oS($7%^6`lLGyH5Z>MkETF8hAqO|2bdhrA!EW!5a;>-OUzO6SI6f
zw7D>Rk?%&CdEXT%EX4ndRW1%uza7C!w?10uXrZv6=+BY8;PQ3i8j{<+Ruzi1`qNlP
z?z@+gWSHCQaO+>5zTj(-EROzR5S?FS)5)eS&trng>XZMd&wR^knKgy?`9kWPnww^_
zym-a4+xo~T>ReLSU&G>4>1PJ!XCLxrrx^Bu(mUA0sPQl1afL9Y6jzb(>GULONwFZ~
z!Mo;!EJ75}GL=XH3I{LsOS^Yy&BG@^6*mA#6+j*LA^PeTLr$D)`LRm1fmOiFOQO62
z^btayI+uFRy55G~JwUB>ZkzsB7c5U*BAf6~`i==RgQ~#4*d@#m5ubYxKR&C1_=mco
z&3f}i9XhWLXN^Q>4Bb53h|d_ON6)a>dmq9CpuxJ%1Pl3_-|^QdKLyY(B%HTZ4~?EZ
z8ElUExJ8X|R^2FoNy8+K9?i;gcBO!f937b4ReA<@Ar;HTOXpf&t9jiJu<FRk-p5Kt
zm^1r;rBwd&!&unlLxePe`W)mW4WtfWmDg{3-R&GF71Gn88YKJJrcs@pSkS}zFW^0L
zpoeRuzxNrViV|5%ns>V#CR7{x6R(J~uRO%WFgJ8NIaisgZho7~>%7V{?`?T7u_I@^
zi29FH6DOHEIxPla$@rs+S}08YK~MkOsqER52S6mA0=4YDqC0*wiNa?BB$g6ww;-L4
zBIVhl6eYn4oV_fU!k?8_(qe;r1-y>BYP#>pxUW$7gxvE%kQY}ec&A{$wYSiDqcq!6
zxV>}Pl34NGDk=>w)P45;iOr$dwUjS$(uu`Zwa=RNjn|H`BHO+?28fJ_n=4CR8Y5Na
z|IAsH>U@S-K2Ij-y~C0<1vCs4&fwE}&I_>(EpTtoqXw7#P&Bqm3TG}4A%YZ6L%<!m
z?`S9w^HT5gscV7N{;zVKC4(&A9NfP`c%9vBaR*OV8GX4ws!vcCH*--HB9jV$RtBfg
z^sjX~L;ny~$vd?7d>>OFN5Mi?$6wnL!3f*0qmZZ3ldr9-4psZ3<J6rU!lM<xM}#ex
zx@(!0AIBbfXZD7A1f;AVPutFqP1$6M{pk5aDrnG|A&6mnG)$2N?eqyaZMs`SE8NNG
zz8M-dQqJ)oH~2kY8YkXJQ2l*#XTPt1ufA``??Z3Y3E5QCvc&x#1HAAq`O9&;>J&<T
zH9@_-#Y|}70OW*bc~g_nJYMSkbR3&_KD@w4dqqOu4O-5n33MG{vSudMdF<1r7oQmM
zsgrFS(>z4~&jG^#3VO%c12E+*1|wN7^-Vf?gN7mr5s;(B3!e5ET;Kao7g0R_kt=!D
z;}c5>Uf-3|er^a%S*DpwN;>?k0P=ZB_OEL#w^Q099|@a!(XM!M>rGU+jB;-JIrM7#
z$=aSF7Q`kG;#(x$2r%#gesV#L-=pZ>cZ>J*@>i#YLiP*7Zk2vQej5xpup)W()f|BR
zPfOwb-d=M;Kk<^DcCD^p5Oa5My&^<TVQ)4##(KBul}0dZA~W);b<Jf^U%0_6)9bXy
zc70=x`NYI_DqF{>2+>k<WdRGF<uIg(f;t2*_Pf5&F!Md~^Fa9Z$HTIW-m}-Ig4d>V
zK=5CO!kg0BFUcge#<WIgi7CxQ3!PFC*1)V&&ciyVNefpynu%hM5J8hMi>eb$s=c(I
zG3-CBqi53c2srXzKQ8we;+Pd`bX2e+{*k5%@E=i~eal4OaEkoZw&tt1^4HiG02<F8
z8<GN@FovM5F*INrubnzis7ecd>-9Y>qyTE%8@SdLS9`Nc7#@oOIC*pp`++$eOR1k5
zp~JgGFQ*+_hWL@_a}>`HOMUs%np$MlVrOM2`lM8eJbSHj4m8wIZV=S!)L`pdX?s*l
zoxgz2*{m-1hxtK%jh)i^YeXXomYYp_y9z_}l}sAfm=@pR_b*8Um|}Kxf%iZUkG*Q0
zkG|h%XIv7Eytr3g+#^`vE9?#YVuiHC+{XpxxpGIj$+-{@af2k69VdIk^&H(c$~c28
z5W#Or>;}q5U`A4+|HXQdsaKxsp~wbPc%^TRGjFGFL~5sFVrOH$1L)OSB8LyZTEIiY
zOoU;I-LZ8bT08q{DnK<}lNR7e$U}evl^<PenDgj4PL1Oc$i5ZoIE_h>ELF7;P<s;s
zDI#<Oq@$FYMX6TcL3SMr{XjSNQlg&no0o#kYK*0h{+Pfa!qmd_K>>eDMhf}RjaNoY
zmM<ZA{vQsSr*=kjDsfCX^i2c~fFyUvpJFZ*qme8BrnDu>(Htj*#w3{6`j7X<{wUd&
zHm|X~_>Z{G%7cpUmKE_%h?AYas;QGk1&l<QZ*XV)k6wuzx<rC(7~d9S&D<6^pXBqr
z;tOEA{}o!NG;|J(oH^u`yZ?<(r+D)KYXN7`z|uAD^)f$rDzU-9iFsMKo<UwzRva2h
zG8vT*Z?s;f{<j}$^|njRj{6xdPENKqBzF%8T=*)&mj@Sa7$lOx`wV&A;#u2B>V5fF
zciwB>A8Hm!Wu6CK6ub_{Rc-%W6h;03b@)pWq>(;~4_Vz<_giUV4dEHSV~<M<_}<HK
zYs!Wsv|MIVNL}@mnZTEbS<c>jlH(IoXViWVsQ%gJ^5OZ-_<G3|WR>|MwCVWGG@mS3
zvv&a#%PlRlO2mMg@`ZI?4Cw82A~@g%SKMjQ<i`gRl^OiZH2)w)2RrzpAxFk*2^e6^
z{2mU=DOxA|qb^`}0K-RDL<_U3_ck6f3zo4ubZDmgf{va_ee9#-^FY|s$DJ64UT<K{
z%NqpSimda^!`&*ItYR@3Z~pM<%9c+{cwDFp;+>t_uYMkAf?od%G%GxBz6EUa4dHj$
z{#D0akK#RIu8GMI!e*qtYa&2+8Y(2E@*q5v3$ydBj;u_8!AhWK|E62o876wp_C`LQ
zy~S$;@?6&!uFMd3^m2+nF%ipyQz_xydq>MoheCh9!9kB~uQyFR>#mb*ZQXQq=!^xb
zz-)(HAuoEr_v!XcahU{+)$F(W`J&DVFX)R!z8`f0*i7gRJCfiiGobK<I~Dv)fn?1J
z7v&lx%c8P--&{2TqF=7<+mWY|D(ah>IO0`&Fwk$3;9Pwf@z61gLxOWx8;^mvJf<Ae
zaD=qb&5KBW>Bi(SMqNxE8P5<X+6+BS7=?LNYO4NCxk?#)U!<7tLbhc4^6xYJQ)o~8
z0*Qv*I6D6n+tmc*<1?G*HSw$D34uk(q?yKkbexqzS>F;B-O2<b?Ts?W_%pdnN>k_^
z$Jp<)XHi=?Ch#t15;+715H!FpkWIYvb%`R-HL;uFcle~j7qZOFRYR$N@L(hikR(pV
zu#$Kd4c?xr3%rW&ncNiel+P{5B)``fH1%RCD8I7B%g;;cj7|KW(sB95xRhoTtwlZ7
zki%W`v1agfrRvdW<0Jdb)2S=Oe?I=*d(~>6HUiZGv1g+*Aub%Z4@#kJsC#9@E!<mv
zA>NB(STiNlpC5>}8=d!yDp$xf|IP~AW$NJ9wjjsdQSJqbOC-_J{rg-nb2M(?5h(Bb
zITh!4o=o3E#Y(0X-{HLFH*DPFk=5se^5-bG3h#9g%&uI^Cq=0@VhZ5s!i8L5#a&?E
z>%vi{EKsEuL228``v3PH@a|D`XKYL|2O!ebfnDZv>qtM7`t|Juu3uCe?}mQlwSlVr
zxhzk0z*Z!UZsXu)wROY}9<|GYzD|HE|8>KO>(Cm<i6c$$b%fPPWVO}m^ew7Eqp2rw
zc;_y?s2v`_8RkkA7~Wz55CI<m47--}HTEH5Iz`95!=&jrWJ~rtWooFv)=8npAp`hS
zhUjMftM;MX+H!?{K&a1JK5|(BLDdy2R!lpE0|*Q9oo_xhhhsX!h_4k_&*>@~Cm`=^
zDHV7aU51u;B^B|6^?e}aw65an{}FjL?LJDzzw-&W(eZVWA>*|qz_M6~)BvDovef9Y
zQXBF2^85Wii~$PuF%{x=4|ji1QIcpFUqnpPqVtp!At4?ljGL<9)cs~Xte};I?FDpz
zWNRFx(ej`35pfV=d0HLS-M7Wq50~6v^m2TDEF-#pxG+($3%#}|sBV_tD)uDcEKUuA
z3ME95#p>=JRA)rZvUs_u&#k{uH3G<WueQebdWR#wnp^33|G+MyXFTExer3#Mk`V7z
z?$C9hVX9ua+H-razvVo0Iov3j0<Pyf*9$t$Mdto26&n0)5C>s1<#&Zf3A2tK>#1ww
zG<Fqt1^RFcc)+3Z_3l~Dhg{*bN}bBGuZQFrPsL@glL2Ur>M;WJtj;>I+Pd^&hkIYz
z<=v&($7)Jel!bG!piA3#mPT9Fx1jy)Xku6;jM%@4b7)4VJL{&cMV21CB}Fw!QJett
zM+MaQvvx9Sl?&y$#(C%oy(Tnwax$rjZzV&t88M%Ium{dwjVEaBW?BV}S9~>Y9-0Z$
z1G!2|H;6gr{bESo2iU)&8-@m?V($>3kH!-CH}A@mr6|8@xKw(-0^_K5mCa?4uPA{w
zL&V;05e0N~XAnSo_F>s;LJIa<>nerj=8ETJb^xM-M`NwlLpN<d$XawvCdZ}oaOy3>
zdFU;NhyO-|;t*ULSQ_9DJlAqRg>&$dU12uPC-*Hr0~;gDm}spS!7<5V_|$;=e1O2T
zS9-NDXVB9foBjLb%ofZxYUj>8#{-oTR!P28Y9eW7rXXl+m<3lX!Vfa3!E=1Avx6Gk
z{}Qx&=ln~c_L^q@%IW=g)R@CM6<OXuo>)l}Jr8hN<^L(+b>-$y2ki)Zt1;GFXFn>>
zIl0Zo!SF$;-0+Yn)BbBljJI&7aGZx|=ESd1t%_NQL?*F?xm%<ddy-p~)Fzv@zj6!9
zG)uHkl|kP#JbN|2o?3SmAv3!A{mfy1{)Gr?&sjlI!;lJI8N7MRS$r{S;twDfE-?0&
zxN_GBrgVo|Y`^o+GmV(Tj9c;85lf8O+npgz%E>E_Sj8*_)=m6zkXS=s8S+c6t5+@o
zAFR?}0tXN)Y4Ej_X*ddZ(m|5EazYJ|gp_ib^vxVEcxRO)jgMXX?p!vIC?y#}-C<ML
zbMwHx7jr@Vjrml|DWX%-YHuus3_+ZjKTeM)*z`>?@|An5jhPi~?M==<Ee9m&Q&(#L
z$jA5$g}44eQ7XKY{4zAR86XvhrMv%AT3MW}bFc$D*i_VBY-}JRndc9A$4mqjS!!~R
z^Z~IrB_&0AqKkbPWfYpu&##N)(eCsR=(7ds$a(}`MFg>nZ?OJrH_6E2L^rNor>z@H
z`c?^bEQy{0CjS_4Bq^VPTo9*nxX@H#LgQ|@3>elqDzxOtY^-ofbP<5aVE76|Crrv1
zha!bG<VGaojo6y)O*mRE`~wOg*AuW9IXg=xtdGC!yF2TteD*5I^}+iY+BgjZ{moz}
z9gebV$%r+6jrA1b0`X5ZWbNte8N?9&zHN#%u=g;I|3MutmX<IDIz>deE{ajw4*xe#
z>HAF;7P%DpNEj^f#uO1HJKD9t^K*O#p`zY*;}|!Ip#QiE9A<GlkE8j@U0VCY()wC)
z=;)U8(=YQ~KCWYqlS@HEBYzN7W0e`pk`d0x*?aAhTl9@g>TL?@i*q=xJ_SV1_XF&c
z04f1%1??t~d-WwlGa<saBf{N^2o7K>`2Ka5NqNSMh)rCucb#ZfLP=+L5F6C|d=ib{
zFP~<;j-m*<yQ{wrREr5nkluIF&>_-Yq}P<C8u!g3BouRcNcl$@K9%+UKzDNVP>212
zRmD{rW?^?VtqMaLbh9lv-4+F>)Mmz_Tn&oE{+#BwtV{OI9Y`*tU~x>}AG$JEst#j3
zR#{8~uaPg(V1R5+&;19-on_X(Jr+!J7rj!B|HS{-|0&fMNspp)Y`gKxsb*I?wKJ*=
zJ^Fv>>bq*FqpBLtiX1x(yBbFG=qjyzo@#;r_zvKu1Q)C=a_DLU^Mg6cW`y=#6OX?g
z$zvG3hNC90`FH$Br($;8i7Ihr0b7s06MiH<s3GKu8?9~!eUNCXw$q6K!clGCj#n|1
z_S3CT+vF!j_Kv;OVG;nw#AFL{ZL9wh)lVOp(6gq0eK6&9-vw~&)&i}?$rZn&-%P51
zRwwhL!0T;5-j4j81QhgRIc|{r<YzV@peK$aC8%B_0$L*c^9q^~R*;iOM}&IlN=NYk
zRxD@;o!^Z0grNtWt>gYG;1AI`d&kSf-W#e4K|<iYVxS@ErMD2A%M^g+?OcT-BBjC)
z--k<ew_WbNZWtvO?m7~2j4yV8a}f<j^B)@2K`R!{N5-XBMh-MbAMmcBE}&^4(`G&q
zY$J=0#l8hEWL0=jDTt17lMaeITt2Axxt*-^b<K!9epfNkIc?htYB5O($>=$;8E(bR
zwtUc+VjgkDs!k6meNP2XnK`h^QRoo{lN=08pf#dvViri^mxK9#AK!%ZU9WGf6`v5P
zMKIbAx4weQmAt2tNt8k7iA3+dLLiYZ9V@Q@2R`&uu<cBKVA|JPj7j8m;%$$_?uc$!
zD#=K1v}YY@X!E=je^E8Yk1EH7Jcxf^#H%RH+6hZ(qM_2fzgDk9pz$CN!?T;ilc&#O
z2&p)?9_ci5olN^wOl#3ll%OU}#8Aq@Mmi7e3k=OwWadi2f7%gQVu60^=dsemh(F%`
zKKDPc+QCCEbwX<AqWi|R&-!~}btt8xa1<#=@(c`lL)V(!3Q|&LFj%+XvWntqTN3K%
z^rGI{CcpmtQxX3phc;L&+^_NZYFUH|L-8tuW8OD9CIC}JzNExz5gdSj+m+MTYyZ|C
ztL)uUKo5qs&%o;NInRFHp==?I);^Pr6N!QA46+u4L{4}QE0iMQU^2wPV?XIjWm~S9
zXisB=g;!&lP?eD%S?QfH4R{fn&Z5)bT5lUp9!xwMWRoLN&8+qhY`wQw`8Qd?Y~Z&+
z2~Rz(BRJYaY$I_FdWIKM^soHO%Au`Sx}}edTzP!2Du(*MCx>`l)WyttP+}w&ZbL-g
z=2;x_HPP|^VJ^rOw2O3?b~T2{h~eDz8%6428;LQ?#JkeIc@2w03wVqp#u{H{+Zl0r
zsT$j<dj^JarQF%rTP7|GMd-KEo$(;j57-)0i)8Sv(r^wGAHQ>boU*;!wEy{q%;ok?
z&jp8t0ZbNZlHXG5q2VZ)p6}kXHn=<C`6p{K8~cp+5RxmivKiV&8HQ%3vT2+m5}NVl
zlPQ2cw=&Yn%q5-ZhC?4lA%8Jso!b2?*_*l(cv%no$#hNZ<!j)n@&k~;;KO8Iuk~7-
zo7;6COo^Lr^&z@c919a|?vzkAsQUYPCIHMqHh|s{#4|t}_1Xv2UG@b&-Cddy144$j
zDq<AJiV+3q0p{1xCz@S4T1t7;MI>!vZ}+yA?MM<+N}9f|ijZIRQbaJC{GcIJ9O&(r
z-~4@9=IDxa(0|?n03f>w{4WNIFAW!zK4{GBH_Gm(2)90v9q3ZDB2}m%xQ>q&?n~0A
zd!+L8{W?^ZM4XYLr*&vy;i9`=K`)m{TRoe8$7GN<y809It3X5f9f$d~nojVO&upPk
zN+Bg|3Pcqy7Il;=NdLg9PNPH?ed1JuLqEz=#6G6KU^)wzx_H)veYvW(?MWZ)G5eTJ
zG^cIDYt0DZ{zV#|ngMU<VCW8$YYzZ3E56dsqjnPl?her(uOqiH^<hh7sYRZ2g-8rg
zL%dbuPCpOl1;_MY<`kuQ#0A;B6IuH@dmn)q@tK06_smORC#fo5z`P0RGWqCV0TAK9
zk$TLLjEJKNc?#<;e+Z8Vz<9>CNzlwNQHT=8Q7@ghw5h0@<ma$LXRzSS)5e)xenV8d
z3a(U=IPF|J55MT00kH}nk4#||aAatA23G;wspayS-eP}0B87<NKf|h*pXY|F(MbV&
zG(WQhS?AO)yoJ8fJZ_l1d<yH@N2whf)MTKj5+^qf{I?)%^vD}^n+5NYHd=Rhn>0i@
zre%Rtf9$F}u4jnTQXnsV?H^rFuzPiE_S!ioO8hS|eF0OePKz+5E$BJv=U>*TB;P@j
zO(+dM9CRvZh0`d$uvV!d&@l_owMCj+urAWOv5nM;XT980O)*4EU@lx0UIhh6L_uF|
zqe?3Nhii`A$w2`)3Zc?>(pKn&<dg<#jU`H*rJnx_Od2@~?WBEChBEvYQjQ+%fWC<f
z#TOBti!*AtZyH<R8uT~E9a1Guqo=b>hm)bJ0gWV#XjQ@&L~=V0{yb2U%VjadkkH(M
z0UHadL{YyuZJ#j-1IJJGUM9G9-wolaJr%CVa-f8TC#X;q`WOTlX}-8$sgZDhI#I;(
zdRqUyQnHE#Vckq2qFpjg4${AK-CfbxkBVrPK?>m+TqHvPgj(}m@Zl`auEG<SEg$#t
zYo1}I!rl_`h<Ffe!j<18YCa*kNPpB64@Va>)!<hi6MY1-N!F$qU$@_U-A3nrOI@|k
z`y7z__{5)MBEXyP{Y;W_$Zh{hkrQ!QGPz13fbeh#SoJS9gGyroM*C)vr?Eo*!k8!v
zc`5#<D@qt#t+Vk4^+<@1h4%2>9e@kIOg-1~(_A%B^I{VcM6<qOPl#lM-tP0slA6WR
zc&{|z0|&Z>_s|-H<HRyV9wm~aQs~ubhWbFy?nAkL)Xwi9_x@;C`+)7Y1q9l$^!9Fm
zu$OZQ0XoiOuvOGb5iT`Fmpyd#Glp|Y`0^+OL;S>o<SHq^F;cTU%<AoIj;dvHZr9g`
zig(~-_5W<iVjkA_Q>o|-x;a@%`}ZXs9m#15Al^?zmIdTP#?r-57O)2^>Pf}#cjZ72
zv(tcvY}s-Q3d_ugz5{}j5;|R)`G>k!;%Sx-4DXm17Eo5o@Gsxc;Jm#}$cI2y4<`As
z2)z?>1=7D4;=1l9Fmk%|oe2A+;5VS~F(IwFSU|6TE~peqto=BYcKcl8Cw_8q@l3j&
zsUS4|7j@Y6C1f9!6j4@Cq~N&q4>(Gtwj61(>W^aKMG1VXj5xTb*%tW($x4w1#Jnbg
zUvYG2;+5yRHS_>tTYVlAxU)#5ztOL0qW={l<X*U_a%1emk{pE6V6R>Az8YuvDHe|=
z1!r${y13>A2ueFV*6!xD)Oba|s^2*L5yiI{pBO1j&td(}GX8!|+P<8rSVOU5M>Ksd
zr+`E!Q0y{BP2{J_6hlPM(pKwjARaj7%6q-tUC%J5c^`mI+y7pUQh+uu$R;Qcf6rhm
zh<8VMP>ny<y<-T-yecYnrNM(cP9A=c*cQA;EY?8N0@5Pc5v3{v6w=k4<^F>>Myi6}
z;19C4>UZzLWK1mIp@?Uf{ueU}zy=MSus9I1h#|m~zW~q2?v#w>VZA2ZBb%=hOs`XN
z0ULnUEHDkh`(WHml{gvN2f&f;CtB=vlvCy(x5bi8)`xY&yPzF+5x!5ySQCJ>b3b*$
z{Cyo3q(&bHXWjt1C7aq68j!2|mIbGS`0_d>bH{B8k!usE**U()2cz=&!m0gsC&<>@
zV#5Q#EGbA5hbYzqR+@H?Sb$tm$`{Vh@%|hMOiG6b0C?tP&|UI?X|<+ls)#HWD@Xqf
zNOrpMG^!7NStqq8a3%33z|mqy(-1*be&9l~ycPy{yk4!Po|t#^G~03`{@w{Cbj0VZ
z>-mwIXuTeETAH7uU%4`khD{Z!zA?r+ND-;0M33mywj5*z?->)py%~O%lP!|jN0F}*
z%8YD`zf-<6jela833<Xrn1jO4`7J|e(wrrF+|G#<T_KJb`WPppY&x3~`~&tKl?_aJ
z;YTW)D38p|KLoM#fH!N)UB|uQ`fe%&k-U8h5Fldszp3m<F8h;bS}Od)%kl_Pg00t+
zuny&Xb1+N+6;7>z!04hg6U;ap5qp@}T|Xu{-?C>7OkT<$CMZDLA$WB8425a%0dU`1
zAsl{5kF%&yUHN!Qgn*nPu%{UByeZ|+5m^H?RYDdf#@OE!R`03nE|uFEwcZ7bOWbci
zXIz5l5<8Tw23LMg2753{zQajub;vOO+gz?z@N#ekZbw8@!WUVMAqmTTc@tcbJp;b6
zu-h+y1rkG&jBNOFW7+~_@8BMmi!Tkgqpy<(SF@Q(34`^ThlIEAX<gJ<`|mqYPykyx
zJ+^{0HFo9Dg#O@0*ajX#j6sv_^Y?sbeX<>l`rB*UF|phkOM6YHwQYL#>7#I(TSw|w
z0p$AgmMV^cIicdi^9N3U*KE@R-Bh34=1@u1_>V+x@0XSVhJ6WD3T|&Sj-&T35Fpzq
zzz}7`x$xU;-hBjabwwmei_xo-tp3e6&t~X{6;H?%SHOVIig-*6FBl7TKg`Zkr=Zut
zdEU+pc<xQ3!yamijA96%aN1RWZSA}VkTB-?RZ7?^F2#q+nv6BnBdYr^wiX2t)~}pb
z=+cyd!R{Q`Nl-(y{^!ej?fCOtEvQs1(EsH`*T7Vi)C}APDCCRMSVa`Echs;Ou>J2Q
zW~C!%0{-u?g{_c<t_|&E((NDs9-woi>}E`hh*zutX_%cgcDg+I=Iz_Q*TCjc^YRAA
z-Eiv@taiMg9fzXzMRfc1L{0d}ND<5o?L)80LGuOP{|e-T-Otgk7S*vrN;SIxLBY$)
zNG1>`{c~3e-Q1|v{q!>uAKwd^N#;stgd`3hU0RUaIs83hs+PXuQ%qd-&CoLzkY8n9
z?$PDt51^H7(V))qGG`-{zuDsxRnlin`GQ^dz%A}mS@OAm(ZqQuGCWotfv;LRZgpk>
zuOfOdjY*534gd^{vbo$cf+p}5%~@5;FmMe7Q$i>Ol+VG>KnZB0<O(7_c1K6!NFh}V
zydzdC8om$k@Pyc+vr5Bve2z)#*#!n5d<5jP7(>ib+A}tMJYqMr{zXb>Q*aOO1PJ#Y
zQ3jO>*%@%QNqHH_AX3|4!=e>e)Q^$jdW71*MBy2^mB4V`6qCYjOAjICIWFnp^qz<<
z<pK(hxWnaNdU#f1j<;OIgYMuYpI&sz*1)N%<<D1Y-D4yMdLGe7pgZ>A`bopuZ<II<
zxj@{K72C9bq?kUCpU#0WC~perHRUGs&m!-&*=#im92p9u2Rr~JN#F3q(H*C}IQ_3p
zq9-lt;If%Qe3crsbxX40HluD;I^{96iV*!y-n=2KQld}Xv+nl8*+Nuc2m?;?1b&__
zl3ntQ`T>lG5~B2P*t8Uu+V)~IF}zz%QOTamH>FIe*wU=8*kv#*#-B<wdVF^5E`3TE
zjkfFRCG{Z5h#0>Vp%C8MF3RUI8Dk>K#%}(3C<~uF-DELo#_d=01?%WnAf6k{a(`T!
z*6Z>O&{KNzy0o&YsK449n)2#+t=Oh$s&N$hNk1dqM|o>n_o;_rS>|~jMbRH?%gBR~
zXel2rDrlVyeLFdH#*kI18$E>nct>Dj58AQiZioSqYtvdnKAG;=f+#pDZUYz&3aY_1
zGO74(qX*IpKB5*6T`TJCniM;MW$agvg!{Gta05Em^ZJUuxwzwn0rZ;mQ8AAAYrK?&
z!oO2rsvz5b{z8`GLH3@368?}zn^}~_M^}1nFcIPgk_{|*345Rqen-<&JM%`8kLerq
z*I3wM-okFJ`2KbqL50T)K1$>0y**A_`aiB*=iTz^5mreP0PExO5zJIg-3fTHo{rwY
zP@ZsZ#!j)zNUAf<&t?%Zb+OS>op2?as6!3Z9_(fQF^uQk?Yipyb?dTn=l3+TI^t!d
zx^A%pE<&JfGvIq6*YR3rxJsf(a(pQ<lp(6Yy#+fr2?oA0fbPdhoV)J_)S;Wma_cTk
z09-%hJ9&i4dmPBgilOq;&|<hhN0U-Z0FbhI>xEOGG(<5FPD__gn>Ps~Z>GZY@6j<2
z`Hgd9Aw%GWk*AA>!9w7BcW)nF>X9-)j3dv|_BJ*WYDd_^iqEu*7+YA|t-UL`%!NlK
z_<juT!KE*jAc9Z7?)bpTrEN%~uFxs?eEqY|1Ne#)43iBQ{Ri{QbV9?#;sry|!mKBf
z0=@y7DkO3uTmChtCL?R<R!(dAFEsTkL_oDqSXwewVf;|`h=!Bp`}x-WmpEQ?2#%@K
z-uDX<1(M`!N|SNB59mC(dts0H^p2;PO6kGWrQF+Sd(<yLI`XYmF7tlDb?1D`r!E}S
zw}cpfNs9j{kTIMfz)-MSM3E(-Z<hy_Z6DC&X`ZB<;Zj;tw2S~}%34@6^u8fWn-<B1
zB4x6#;Xd;jP(yzu?kpMvaxL$BbJF8BHXk={H_!KYd$i!UQ5#c$5P(+kBP2Q+A#nJj
zXDubd>>&<n?q7Eugk+aAAswQznaoj7ff>;2(=h)15BC{u<PU(;^r#vp9A_SQa*3Jk
z^Ti%`H_8}`pi|bb>*4dUe=}x6o>SA#z4T_UD#iY7U!KP|cLm{O-$DtE(k>|-v-)>h
zfQXGjk;ypDliU2hhC%~fKhF((@sQHVWD?pp$Q!LuY7+2@`~UHDRsmH;YqzEw=>}=(
zPU-IM4hcmX>6Y#eQJMwP-5@Akf`D{MNjK7Q=GuGz$7`>2eRIBZykk7$I*2Q$GWX>Y
z1Dfiyx5C<4iAjhlc#SO?-H2YKv;sj_GFI2qw3r2VrxN3m9wy86NNkm$;v!HC)L9H?
zAR9Y^XCRT*T*v6prx)+VWnhXO&#svMQrbu9dp_mk2Oq8mH6Ije5&Qg=nJiSf2_U`8
zE9dd~_Ny`RQ@@^9-r|W_#<=ie+nhMif`t(#jE|MGiX7)eK}d|-*w@iGO#G)(G8rc!
z6KoX~K6{r83@+V=1Bom)Cn`#GCOw47|9(m76noa6nd#tbz%m$RKaC56z+=?m|8{5P
zXm`>c3X==rC(Q8?OH~{5ua2vw-XN0+dpZnSD?6Z-v6TPXL#m{;Xc<IEwwjNW$8I=~
z$uuIR#Dq`X*KRR)we%+<$a6oln*5iE!WD-l%vBo7xV1%@7A1rqS$q4R{M*Inxz4{0
zfbuo;W2JLwo^NNV_1?>!!oCkf<Kc(c-b?z8QLF2B>x-j3G0%0*^^o`CNdZ)koSNx~
zDOk^@)TO=Oh}M{g=RJfCLk8)gHt$N-(gQeF2)jsMl8S;bjvFR|#+L%idNdyy-Fe$I
zX`%dNP8syP<b;7?urZRaIpA7VE(pDUtx4TFn)(-1G;8l6p%xtjjqyGX15&D88vq^%
zhp+MVHCsPPM)&ke;uKQ9nd(^mSFJ=(V=qEYz{|<_L3AB^08D}3uCX_9qZLZay+dE3
zax>oidRN$!A_bwG<*t`LEi96Vg#V=p)5=4eQ^l3=>=DSJ!H-KMMy(0A&lp-pgY60^
z%JaYK>b$(n!++;42MvEh_vvfdeEkrqsJin8@VF^!Vv5qg-7~0ucBjcnh5B753>H@i
z-&=q!crNy`M1tna&8{H{y)I@{3D2M2DDZ<6UdsrhUnN=8VDW{h5M0!8q#mBqeclY*
zpMdbIQODAG;OJmYH`KhYDuWb6^f@UQa!FGp?i8L<8{3305bRY+TIs{F=U!|Rb}kdC
zI`-k@kCvI$QyW|wgyuwj^N23h=Hb_!gxj=m&iY0yhnUdiN6}FR-?rOOmBMz}FzzSm
z;976J@|O7~V+9+z7@p&1miFTfie+FXMV5Yw{vlKc4~X?&6zuwi+O9EQQ5_tvy`RJU
zP&mR_;m4ewaroHw`MzB3O_eV@#&1K{pziZ0C`fho`sqpF^68{uLaeu<nwA3^+}GER
z@D>kEjWAJU#f_<)?h4Q)X578;klZ5PuIWHJK#daD(_0<Be?!R_2`nkEy3cCSda&#y
zh4P&smnhXp5Pv0tR41@VkxXv>JD%gmcZ7ONub=*76vihtjPih*0R@q1$u;{va7TFU
zb=8ZuWd66n+xWntylK7)EDw~IJH_K1ChOr_kC|kg`{Fo?M~}`Br|*K3;-z}O=d=bR
z+22bmv@8ZJY1N{y5}vL~n&>{*36CI5|L-frB*vtxFhhJ5F)v^WCNb*uwex`FmEiwO
zoZu&YTsj?z3_inh^t<u-s*(GZgkMP;LScj^dXi?z@q{!nRhxn=OL4IyjszB3{By;4
zbf$`59oHh*ylQ6L?u{B7+C=5vOSF!?zYRMsz1gJ8&rm;2faKRRt0`T!aKDTe+=B%D
zfiw>Q&qCnG1)?>JiQ7EF$h-ybJN1|Tr$2Izo{+gMvu|+q4?n5U4Sqqrcex0!$KhAr
z*eFD*l$CnFzN#EXNyd<HpH&*8ge#Dlk}|~+PLX<02c>S-aTmRSEiEc(P^#Y)PiM1+
zX@l<>Vk5v+V9?zs{R909n-Aes#ApM=(?6&aV8^8qn@k5JQF2Z-ILa*qGBY+rSER98
zW19o;MkM43o|Cx*Nh>+F@<&A+`oIT_MjEVwq#ui<mD0V~fI<a_|4K-~D1)6wuTR8p
zD_Pz^i1a;13-7o?FZV!c>=gQOtP5-e9LDjOU_x@1zu0bm=w17m+ngxHnXAI%S7}6r
zK#iPJycX$=w>+%>6ph?<lGyO!7ltL>qZTvG18?o`lS{!OwuH7RV2o=pu4#OzqyQX%
zVp<UaOn(ss9*l)_NpGuC8`yRNZh9%jxG`|jNSNYXoEai{j~>hDtn#~x>zUp}Iu8as
znejm-SuCT~Jpbp%>!2hr7EQyRe)Yqo1PWpPV?5NT8;h_^Tx^Z3!Ve_@<06SmTX;5#
zXcB6~_L;*>dN1?N{QBKYK1(iUgv>*S6B4Lzd%-fQ_C~^tb-69MTFbQU{<wqXg21Mv
zCg8}v2*O|FJGl}mi<|CY-A(?!NB4V-2paqdM{lM7;5O(W3gE?n14(mAXNC#QP0P9)
zU0f-b^~e#mc5jksn?a$!z4OQNbmy&^2f+i-({IEJ5AIh4nUf%QTXRuhaW%1+zjtvD
z5t<MqgJeokfJPT?XZk_cdl8zsT~dbr{+%mtUcgHE>sX~Kd=3mwA!9_tlD-J~YRo7$
z(<Q28X>du~3wd^5WX7kZ+FT01>O{V|&1ZkJG%O!u^&drvM{kEx^SbM5waX6Z*9?ZA
zMXmom*BthqX<ubKzhYJ3tDJdK#>6fpq@()wjQzo&M&VzcHK9TsRv}IR{!rw@-~^ww
z^gfdqHg)y>q6{qKXv=>>L6wcA%8*j!F{t(H7e~crAzX_G>wh-~fP_x_snOBuUBHC2
zDHq5LHLa)O(fU_<kZ57%63`97Od_A7ndIp-y?QNBzC`y-LMe-qpHsRcbMms8BAV+M
z3Byl??qGgOX*pQ(!EX3bzYu{=9ji)*J}Mx3rF!!<>$2zh*k_EF{44I$dEfr>)!fF#
zuLo|&JNs{{3Yi~w3(j?M8HvDq(l_W2G%d^+oxh_grX*a>za@4pI4`<M3e<YolY1I=
z>H<r6J^ITdNeE^XWQ%j(@{cqH5<J;=0u-J{`o|1nB^E^vD7ZtE;~y5&oOu}<w!J-7
z$u-(0kg+J_t=9KZCQpZ1gYaKEh!*TW@t=mRcTmfsZ}<amm!nlEB-FDF(S)S9SMVp2
z{XwH{Ikn;E@$`?&E1SGPH>ei1Zynf+0WD>$YAe~;$Z5%(i|_N&0)n??rH{LZ%t;(q
zqCU4foc}>mFbnZ8+X?&ZLXap(T-C4H_tS6?UKp8lEdoWXtH$P8cnh^Rm{d_Dw-gSM
z$3h<$qjFmGI_Jdy?K<~+P~;i;Th%MJSCAo@0D*xcHvRy}oEc(sPR=LeS(P0WHATOF
z1VE%Vm?<&6Xy*i0Y1{<MXa@{!PC!QWrR9YCRbMoodgF)dW^R{r(9-FJ@6(eG*-Fj0
zqf!zpgps<b*1{c4^RGm6pMpq$i_yMcMAjGA%Z*V_@~-|NaVq}Xva!!2cCV@l5`X7$
z)b{R&y!&OvEk|M+nfcR8<{<{~p`B!VQhMowv`0sa!hzJcpx??^fNGLiu?(9b`Ay0M
zcP@nMWm4l%_hzDapzF#GMCIE_z{!^vS$(U*B_W%$j=nQ|dPFMnHjy8iW}Ej}@dH?E
zj!y{WaJ#*$XMZCCmwI_6nds`4BXabw6$}mifc&+4(7}skiWoh5P_-K|YHBSxR_;Hc
zQIB^U6YgE%bbVBk{@lBISt4L+{cn@u6&M;q(ogV)C>h@Occ$F)9;4!Xt^OjpKdT<F
zuYDoXE&I!!`T6nD8RTTxX&y_L-4d!n1n6Io<%GX4F#?sP;hpn6$MZQT6HNR%3JoOr
z9e#U0yWE==mjR6n-~Dn@f?J&pwfNj`VaU;NQyh8uC#fcF&k7j$gi%IbdIc>1EhGES
zcU6Hu1-ohX{aw;ZkWHsS=|Kri2kie4KL)0ndNO<AebN9liZsBi`=Zvqoq}F1E#n*g
z%}rUn*T5#@Jj{Z<_PNpqAuFzh3^AO_slEY!M65jFp`T-(LV5J%QQu4LQW!)p<X1$N
zYH%@2^xPVZ$w3<ejL)c}nKo0B{Im=AG9fepCa@?IbcoUNc%z#9Zd2+ez(NT*?}eAj
zP>RxWWO@!$I{}e#DF1NCApBP%9X5gB{OO3M!}NUnFYlr6B^Neny-8R&n?UmSp+DQ`
zSbIDc31@&0G}u=wbz!lNSR&C~mmo!<-@trN@wiOoYJ%i2+X{ik5E8MZ!;X=orO=qU
zm!(^Gy#mTlf4s4KXycTLBNJdR=a`IUTq&Z~H~W6hi7SvaqC6x%`EE4OplP@vUDrQG
z<YebbK4~(y(K9`>hyIfgoYu3ecqzO<eL{q|@|Pw;3F#Uu;?9MVP2A3h>Tg$zHB~XG
zBoQ^q_61PXzz5K(vrPLNVXv^$^I9ytA`hx~9=zQ;k$r*%`@r1_j5J)lo?z}_PLAjF
zup}sEV>4$=vlVaZd^+#Ry#XrW7#-Yrl$OW66!n!4QWLV${4uz~5FLegp>54AkyV&F
zB9<WRTKmz#3e9AMiCn?B`fw@`=s=l1FHYP&v5};;%$e9T&3yNG=FI$#)-9uwj2UKd
zuq)EK_4sSb+h>Ko3ZG%<HGfVj*>c+ljL$C?6L<Zb-V$2ma{gQ8*i&y@;AqhVJm7v5
zf5vn9T&==CCdT^rpHSX8beAvFlT?jrX6A2R;HyiJPyx@k^*7PW{G_{BzE~?e|6G=0
zTRCnJTv^@<GalIQR?jn9mdjgX823-?FDB(Ft8_N&647T?>^iN44#94dmWb8B<qn9s
zLTQVv>dlzS(`BW?rk1fnR-gLqJxgJysv)_*T{e{(R`wEDJSGUPhl?SDWmNWtw-0{{
zWn%+zB2Z8q2*<^soSDR<*G^)aaXfM{5AZmViQ3=g8G<Daahq0j{zM=!kPl+D*0(32
zR5DeXVf}Awji#aT1JOX-8noPSywZRv-*ieiX%*TQ`2R|y6iDnO-5fBo*j8qLm;Hd|
zV9c*Z*5X)6piVCNl1Srhy>-9<4?m2|3w4%@5bbpY-<7CC>y_y|w;x98gB8Q_aZBHT
zQV|O$dQfy#rnh%E3mZ<5|Ci0GH0-p}r$#Nfco9j+=JWjhr_&l#`1%7&`B`uNav8wq
z)$wN^Qi8x&|AIWgpUHcw$S?z|KfIYWFDhS3paNEM@reBt3tk}fQu4T@g^``YBAfm0
zQqBDPPsBq6Mj$pU6@rFgMO}}^v6FjyPuyp2!WP+^v)ZL&v`V(#C(!RUscrZMIN~UG
z<nAJP^sNlagj6Sx-T4qn-c@Pdnuyb*@+_~eDm(U)oxHP9_4k&8KLlN8JG$ZaIqhfF
z-*Mv`8{STcHJY1@{Rvd$2#NL}lxsc6CyvC<D1Vhd3%PhFVN;37`zwimUcQSl(Q?J;
zQ<BZ1oq?r9beLQx1ME79k(+>qG6@X^XOxxvcT`j^145jS8fPDetdtKwow8PkOkM57
zP{4(JrR{5Gf$`w|<C&*)p6<a|GJX5BN%`Cw=~4aSMQCukW{=ZIYcB2xBm9-vg9rv}
z8rNu~@_o*n**<$U^_!>)Sltv-*2iYoLfz?M{p2KQmh+qEipSiVJBuH){SmB}UVq?$
z2)_)H`&xY+hGIzaqx)EA??TeK4zqCCAoa6FHmv}v@B<jxyShhtzCwO@3We${jVoYX
zv3eOi<pQZSm(P{MpcE8Q?0_M=Qpc<Q?ad!(GxlyXT0cp0kSDNen}<vG2<>imirEc$
z=;MAZ{Sy{qkW+iOc+ci&o{{1OJwkF3l=aPHuN$sQ%dY2Y7&szcXVv(Cwf~h4ZoQzE
zxXec0dE#~6DQnex91t<aMIF-3b+No@3jDVPbrN%UWQRdWL7W<zJYk9UEnV{mPpB;H
zPN&R}<RdaK;4e2{iS1)3rkX*tlvt_Kz^Q**=75J#A?@_fw_fA$+!rY-m^gb^`!}Lc
zE;fR+)E}AT{aPrNjEa?kHK2JOyuLUrjLU=lvz4Ne72eFuVlo_sZHJ#vDaxj_#e2M1
zib1#V{7(%8zb>t#-hX#yBXL3z@EZEb^t4v81uypEx-9fy|GUQ?GFXAupB?wsEP6lP
z?w~Jacl?R@-W3yI4<6Zaj^8#(^<kK+Q>!+<tUcH^ED5q$L1;GS1zpkgEwpCpio^Ah
z$XFaZSZe<;3o0+OH_!><DD+W*V)S8&u7T#cb1N<-qp9b4FWy`8>$9DN=eqR`lAeL?
zC9ypb-<&^2`p?lL;`7<W&PdRKZN<aF@OV;UW1~XjW>^WT9ai9hr+rxp%s?ZS{~!3t
zpG0z^*Js4*XjF(U-N2OC`H@7;FFcP}oJ{Rzvfy_sWzjh>OV)k;2uQD!o9{lkv&GB5
zA+FIe|52O3MNo7JN+^%cfEcw`(fR>UMgoROA;P|WHVy{mQ`k!HU#G{%vgGz%Kpz%o
zn*;F`I!!Rzn6na|@#s(1$>EWz##-SZKI0&LdOH{NIQQETJ^r0W=prT~Q<S&#Z!Ugu
zV6YceG|DiWoFQFG$yZ+vF5c4`dZN#Py+v>orfu7f5qD(B#6PeWW+Weph<c@a10MIy
zd$wO3ufB02L}9~l(bA{YErb8yxiISQ)xvGr&Z5}E2x(T!n6F7neWnx{R`fh@Akm2d
zhgP&x+|X$#z#r;I39PZN^dD=!?r<5-sBIATA00VWf2)F<p@op5Lz~~LXrLfGHGHw+
zxJ?$+by>{ulPQ%)kbSNG;rdQtso#z!8k(C8^+dGYnK*ODY2(C|gP>X0tj_2{aE210
z*C>%Fh6zDJ<O2`!oOwvp$1W$qIy&Za#sp}8z@?C-;oy_zswl_TQd!I|{Emwa-^N>f
z>AE_~M(}0wYtzPv)@(8+0**h3M)PLqPc$N%P@lIHaNaoI{+>hpL`CG>NYr5a^R6-g
z`^elwY+oGe5Uo;6h@GG!pw}P#s3H5nOpxXYe85M#;&>5FM4K-}PQT|}(@?f;X!`4Q
zzxrDcblBJ2!fs~|s<W>B1XUT}`dwr>Lrk_j)O%+dK5Nlm&_~gIVyx*ufC@<)z`Os#
z_@%zj_o;O@C~C%-8m_(3!GGuNc=m!!JThQ>^1>G#TKUwT^3yndrEDw3FCV97*V?||
zui0hTeQ2*A{qK#%LC^W2^@UG}Vei<>@gZ+6N%JPPwhDWg|D!h==xPjxa||)(Rv=UP
z+SS)BEG??E+CE%?{r6kkf81BBDD0$I1a0&y3{)Fb0v0r|TxKjC7|rAj^qdRgxZY!O
z4KmDP)yLBzya>0Eii=l4(H&<oTcB6KvP|n2?z8#)jtPA!TZj3ZXJt`A{44Tn3>=1N
zJb}JfG9got4~Lmy_Jc-G4rfM(vnnEv!f8kV`}-fYFk$yKv$QD_ZO+!FMOI0*Kb<r(
z6;jzprI4~pQyaz%97=<o5^8v{>tEmh&gh%3Xfyq&Cc(j_tuS#qdj^r@O5S~=O@4CP
z-L2tN`M|$Cd2Ljeurb1e<R8Y0nsX;Nvq<esdV=4`^Adl-xqK?GJ!+%%*}VtFErL9d
z>-bTC{$Upd+}0gK+GRdR09xe9Pz$U0+s7MWO^rw?$&Bju7(O{m5WH25TJ~*M4U-^z
zYk@{OvvFY8A6ykHi!9aAP5LrLLkNF!6|<P|zi!=)u6WDhCgBGeoT@YTQ?eau3nqny
zbfD2X0fpS39%pRo{Q>a!UOaFj<S*lA)6vk=mYrLi20{1LOV~pUA6iy@fl>P|A-f&6
zLxcXz-evQjL-+k+$0OJH3NWt7jeX`jI7oe^Dpa`tu=em*K!4LH@ht`4d!1$ZwtRmL
zH3%U+<jJ;*XI3G-WOq#RrMsNKJ85>@kLYml?BC~|Z}mkYA#8i6W$<J|ra{A0T8uF{
zK~J|6CN4h^^Uy+J`iSuLQ%Hy?V$9aS8X&js-0y=f@f9mF)U}*f-zd5~GItUw^#t3h
zMHfWv+`80ULdUx>_^izF?J_~gQWStrrtt*KRFx^K1Nb$q4`BKz+7{jZ<w&Ux5Pba1
zgv0o=0$=YM|339PuRCp}%gqs5x)#{{KInGT{H5QdEYY{g)uTMn>iE>~Slw{`FIGM1
zZu&yz=_4a;6MJrdH1|(tM4sAlp@U9g!P~)+GkNj*g$XmmVi8`D<2UzyLcnqIC;7XM
zaqtz5!C>jG(%d)+^WSRh_mpvr4T^#lNy&J=P;`aLyMITJ+!#xcDtuh(2cEPQKY)HB
z3f~U?)@=;&2*&@uOG%|&;YsyRSyV@m$vNvfZ-K4RQY*&ya#DWj+*vgzy>z4hp#3&)
z9Qs0mZf>jZ)TQDkhP)>wGHcWpdgCdS|4+o<4{m4o&tlC|e5ep3PIZ?uSa*a+q>6f-
zWIiA1_`;83Gv|9WdtLWYZ(;b9kPMaQAGFwT#{nBdlu*>)*uf5!jfg*X`D%PrWBszK
zYHh4~*vP&nuy;F*iKh6?H@ijAXrPnDSHMXk#0)n671KgMi(X7H$6M~g!*$d2=l6o0
zO;W}B0lV-ecu-RchwJIH#fu-qriHTSSg}~b%4~roSk%z-qk@dt5BEK<zj0WifzQ+p
z3h~@0Q)dEqX)Q;i@}3qXc2aTEV%na#U!$#=Z`wd!i_lnlN_V{n<IAR&7bEdb@$qQ^
zR=_)_bfrNSv$L2vqfO6Iu-5Uk5f|Y814&i8qrU!Rx$C(+WnoH!zr8k<NBsaAm~*rV
znoV2cNs2f`wvwc)_lbyd_W(2}S7{O4cvhy<{n46laJ+tE)xEQmkOd(2*!!`#!Kylf
zd;apKUs3HHO$wYnzaH8q0-V%p8s*{{C3PNM=#%OX%?`=w1`Z8YO&%F?cXC1$ZWPl)
zASy-AWw=S{O(TuwU{~i=qg7EJQhZ@>GA5%H!J<SEMm`$^RSd;HaYD;IDW%4ea5}I)
z)9WTGI8mw1`rNC|ghRa!)K^crZUZE5m#uy7C(Az^J$7tEpJpoZZMX2Y%U^j2AE#*O
z7Y^>y9;DymZD6BG%oecWe@^nd)ZTLDcUt-u8_VQ{>Las5c<8Dhg{p<JL9zZUFLs{1
z2hG1|7QAvvC&)g9%^JN{v_VA7I{gZ8NpXSe^A{A3|9aM?+00SVaHDlBOk`QgPb82k
z%MTDLICf2Ae@!<wMlXHS`C0n47y@ZT7>V36O?YN=Y@d}cBa_g_nBtk~0cAow3q3)n
zz=U}B52VB|d@`P#54|uET7iu$o2r<cp@$ce($9}R2*vm*6|)OF+bb7oAKe~*WSrv=
z4|+T>Uwf&<-kZ`)U467tCJO`9r;fi$Tt7ASu9<AHhyT&hDb-xW^7EZ_EbBcniTwV;
zS|#=jRat&Y)59&?lP_hbAy`ikFWF|6v7z)o-XT9y5pX{el%Y&fI}+E|CgI*{G<wyx
zvQx)I^r^o6@1Up@E`&f8hooipbI7|+(`(jO&k9I|&_4#I8gq|!pxNxMmg{%x?A9ah
zhIeti{YDe5TKQk`Frp|>_})%Y`DFytQ-p9xIxd|%dC{@G6kYN-nvUve^TpU9(Imw@
zsGv8peT&!j)zNCb6qe1>tqji(f`(6Y&riUlfI!*ygti@>Ns47V6?DGry8P11da(d?
z6Iwk#_^;j=&Cd5-?mN8)XcZf=ggRW30c8ATJSIkL$LzbI{z!ahC>&`3w1}_NA{BaK
z-h*+^u@2>hdvNx!AumEH>>hFLX$NVk=Gl*%EMBT`SA3eJm7T6~Z;9qI>8C89>0v=f
zzxn-apTAkAs1k(Fu4T&fZAU-m{ecgz0OG1VBg)A=M~w!(60$*kxzNBiNK)QgwR~WG
zd?ScWFqMEHQ^jnaS?Z%O8R}osAZev+R<xzTzpPY}B;wMdsQXTsR?x{_!$`#<e;gqP
zz3thpDK8^kT!@+`vXLrVQqDEPO$j%~(p7Xq9E>C4kwhrf_^HgNGPnr}5?hZ@Ajmyb
zPSeXdWqj-G-Afjzc-vC^Vx@a;3#ROI@a~&E(CK>X*d1FXeSIus<FwdlH)v;E9|yM$
z&z-f8m`)i?#(6#=^bXMn8!k!ISa}=G<3*H>g6Y1{Ih!E$*i@?pdGcWNox1Vy_Yg1k
z=|rZsnDe`0ONzhG<zKKs&?HKRaAHtry-dSr5ePfZO`9zd+hN7S1&`y@FSkClzldgG
zo9fII{*JG2;@bc4r|*^d;1M*&mANwB4HU!Y-GA=1x_ajxk~Hg2ofCRk?z%AbzHn|@
z!h8mp83?=v+3r({er;}Ak=$Q8##nMG;8uWx$;DV4PItv?8vr2McTan<@{I3>n1+lO
zyMST)eVb!L?cY74neLaK{^sqsh}YL&rHuq{Pn9k>9nndbM;D_ePP(6;jF*F+AM;uc
zoYDC-^^8)>O}JUCvan_fXdEM_u!Mg`!6xY!!yqVT*;B>bVWfWIU)cR`Z+ZR4E}fjL
z-UUaA0dd^cJgdFPcAoYBk9D;DwN|FQQ8OJmV!#({3cp0!%<5pmU$SgLPVnzboz>s~
zYC`r~&ve0?Xob*M`Xv_Po+heEjjr<%udYESGs$RaDZGM&%6JAY_Suis0n&ezZScKn
zgF$4<@i7wogz?N8Cd=RS_i-!Jal-`FyjAqlxf31IkGE-^zL+wK5qZ*>1T%H1oc3ue
z3bm1QE~GuuBj(%WLLo#}9<l^&RHR7Sy`)=MnTGc7BE;GKLBvC{<R>W#X=Mb4gKjO7
zV=jwF-}7-HVvpLFa3pHYi(rLc>0=i0L-sbGysp`~)Q){CTtT*rf-(cIb<hw<qrk3c
zX$H>n*p9X_#bNPnKI?p7)-b`#z{}|Jf>L(mV@A0K$)|O1d#C79KD&G@ehAK||MxPk
zFlADiOar5t^)9h{QU?~rJo{zhjRQ9?y#4aY2~iN!b6>3Ki(kTMu1mw>vhos7@|IM{
z4F2C0{u0|88&&RQGpg{M4>*dpc%U3t6eVaO`8+_~MET_(s9?$tr3RAxa{i2n{1_(5
zNRSr?7uj3=aKziUApe`Sztz&n>Vb&Hkei!~Kqnwi<JEbQbJA&5dpy`~3F6-3L4(4p
zt`!iHCUXP{eV7zh8&+v|R+~7l4GRQ1YGJIVd~ZMu-up)7L(QkyWxNpcUSsy`K(AVh
z#&FrQP<?r?oUdG31|eiU(49i7mq6d-$LsjMZ7t-Fed_i=cHbegd~Gq|Ie<jwa2gwU
zEAu2&SH8~PhSrmLwIm$iw;Kv@#}6bUk?BVfBP2^Fpe*V6osX-X?=dh%ig<uqp-Y<C
z(TvC|=_BODR^}hH`ik=SaMkchl{5!@uk<2<7@v#3IWF^-kv}gU(4v|37wGk+k7uA-
z^|sqb#GygZ6nE5Dn^rrG?>cx86>;tc4upUMx_!X&o8O7Ca$R3QnKSkGC_QN1(3HfU
z;w$sjmYR*V*LQypolaxB!N1kRKu@V^ZX<8E<}nNt!+ZT*;a&28q}RjVvRi(}?8>Od
zPRK{J0=SrEnHn$~o33E0JNvYl;nY|5-#u@p(Ed32_>swgIH`wi&2(bL!4&)dDS9^H
z@!w{JH~^p<YseVMswhtTGX<h$xFG0DDphHIA!Zhv(?2t_l;jWbEUMELX&Xuyl}rw5
zl}qK$f>8LwHN~$qvpx`7ef54PfjTsxe%oyg-SNNiY<`#6tA>Y!BBO;6V?QMF16ACq
zg9Sgdl|2Wa<vekOzga0bXE^s;t@;IP*@mzuZFAP2JtYMZ=|<61x$WVSX!}MYhk93V
z9S)3yF~ey%&~4qt4oD67m-&0s_Kn@i?MI**Y_GV`=jL+u`a~88>bgu?BzK%e?@Is&
z(CnoX-3$9q1L11D{sm4SM|z>FL*vXy1k3B7OXIb>*}!4e5$_r&_79Z>2~Kv_4r;?x
zy#5)v-Na}(^zoxWmKE)vv25gU*M15nCNM!%WL^91fhVW=8|U5b>j?s*!nBuDA>6A{
zzkl%^$2P`O6Qrn?v&zsqt$XniCX({)&n(Wu<fR6MknLElcHjtmQl*TC4vBN2IrzP{
zlay1MiOVh~?+l&FaQnsdHM_nv4_8NE835?C)x~bNlynJLj3;)ls98OlK)sTtFUI*W
zG<!=gyjnnoSatw*rYjSQw&B7Zz-DnaQ-DPkN>{F`nk*TT%61G++0-7lV6Pp(?hrT2
z;i;>aMNlSQkX?}=DeU@AJdx6FwP{+iNr-e_zw2F})9M^MfrS(I0{R?}>6AWWVbx99
zr@~4{%33Nz=fn9p|J27IcD7e8^g}55ZDH7k56LzCzIeIuhVVB~m-6_glv$$B66{6S
z=neyq7kjjN5>0laF?6sEZO5|><uzYraQrT&dfGMGPXp*9^|qUhSO(+O#~moH#LKDk
zY(Si~t-wAeiOJ3O^iIRh{zPR?Py~Rt%HTAlmqcR21-69h$cDPXA)c!+&#XNhDL<X=
zg2tT`^%{y{FdWquhi9o^2;5UPk8vck%$S*74lo_-1+}3kS%Hq)Ok%QT3P0t$(uyy8
zjp!y)SY%C8%WIj`WJP5kpzN%5=xm4e8ra{Qo39?N3XpQai}1^#Y2E<;F$^{Qx#g=Y
zqwop&@;idjP+n8Mi|_?DrUmT6g60)fyU3-X|Fckxk;`!vQ-0zbJ6s1LLb@BhQtcNF
zG*<t82Mv@b=oEAiQE^xkOw1tLQ4$Li9)xwmofWegE0=q}@Mq<v*l~y@NJA5nNcmAc
z3JDyqt6OTd9h(&m8d8>C>Y_HTpO_bXKk7iB((W8j{@N}2cwHu+-WJc=^4!z1yMfy*
z38<ebj_O;K44C0MD)|m`%EQ9!B9j@8TKs4Ob?Gm!9O8JCZ%dEp@<oon09yo3IjV$C
zM!XC^JLx&s-?o||?-4M}tQH97KR!UxeK;U76bYV6PnMXL!JIX%8!`Q}#Oy^bAC)tp
zJ4P$%H{|JyAtszF{ue(3Ob^{d`FJO?T?a^>0fkF`Ts>~PwwY|j<nJG)G18p6>H#gr
z$aigjLeO&`M?o{xPfi5vOxgs&H|L<30ej^Kg8s3^BQVjhNo&;&+&57^okr3c()^@s
z)|7@}glQ{irh3jl4+}x3fKAKQ&`|jCuT-=yqU<0>^lYB;`DU<sgn8DEDyioWheezx
zVtx{CAXVIV&WOWaxb-N$Em|QO)|*$wJUv%n5@nmx5cXMZ)`__xsl@%=>2om-O&+=I
z0hG(ZTk73QA!l$6U4NyE`_q>f_Au>U9Ix=l8~i$g$~=5mTfordj5xdjo$1Ly2c;MZ
zBH_taYE5!>-CoI;gwmKId~aMS1%LeqGp<BHaH>#d4Z36Qz3c(+iTikvQFf^ANU<OK
zM(Pb{`!O%l@rG%J#P`ujHVr|AZe83sH2)R`G!D=Gk*{pmZ%Sd#P)cDQ!9$VFWK<F+
z<a-jMqO4TtxtOVvhw|BzncFaZ>@_H;x;A>?U>E0L?-@v>3~EH-KX$6fDjjfV9MTws
zPR@~-8P-F$t)*yc29<7ewl>reRsI<pX(MSvs=#lwL|K8tT5Uu)O7u+q*ov#6Liuz8
zyk}lepjG!VARGJX+$)XP7U;;!r<4fI>6`i3%(>T|*OuX#$6%2#EgAS$bHZW!yuZD!
z`m@Ez^rrZq3$exyvx1ut(Z)Ckn0UJp(^QJ&-JCo>oe=qn^#`c2@AEgjUY#4cjVtHW
zB%W^4YFAnbf-QTX>&ilxstO7&mVuN;K^pZ<Zo7fiyvuhy`*mct$E=|M6ucYx+tmxH
za_ndG)v5NKy6Ja$h}ak}5AEvm_sE6wz@%czzA?ASCr|=JAV$af!ZFc2RQ551_ftK`
z{{JpO?tS7H5)|9%adAYX#FYExFf-K6|8qH6SH_hdoHw%j2wBa9zB1v_Lo<wwzCZuI
zk$PFQ5&zq%cEMA#WABs8us0LGI0LL?TC}A!T+h{8{vU*cB!l4&eSAs524hcCJy!#Z
zhi;XbLwY-#Kf{rcU%8B?N|#?1x!PSdU@fIM1pQb^v3xsqQ@g@2uyz>K|G~0DXL<RR
zsdvaP10K7Luu?gtK<F~SU`2Beu2M9=gOFwNcX(ujbP)!b7)?{2(r4w;PU;AYu*!mx
zUj;Ws0Zg~@OMk!~My$h_3L0fIukbD!OD5f2Shb9#a2ljnAx4P02los2Ez~y<SDSW&
zm+g+{5<mSDa~@nMri?w1h!0F^P+uC6u@UCT4919f-!?!2dGpe_{&1P#2329o9mRZu
zkiM<H_)i(7)F^Lor5`LmZlyEBDDI)w6Fo^RWUvrOn2jDSLLc+uUa^Cx>%DWBs}f%(
z+vxuh4vGILhO=pWp&TtNDJHM!6ue8@gL<ZrPQIH2xmLy;bu(@PKgCt8Oo(LHXX@Ke
zf67^G@t;jwF1+=4GR&E^q|3WD?MZUJm<?<SBOAi&t3aKFo%Ypj5h(m7$;DYpAqgZr
zB~viY+i(KD;g-VmVRSY%b<a=tl)tMguX>>xbA$VVM#=i)D|1$Lp%EMpxM0C6AcKl=
z*Cl84-JIa2YGo>g#&V~YqA*QBR`HP@en{EA%K@KHEFp)PKlR{IkzIoSAak5GlTNR@
zN_9D|eyA3opY2b+xrYrvD{9J_Vaa;}O2}nDR^Vx9jX9V-y4Vowrf8Z7aDo~sK*<ls
z7=Y;P=X#71?Ev<f_#!%yF4`u@4`i)Ybft}!)HbRq>Us-}d?}ub6Klyl;BXvlnsb!R
z+1Tc6xBmU8L&UJRq#=S|1FrKRR}Lb3wXkF~4at}~A=_Uz4H#3$(Aef@5!Gvk80jCn
z3sU=ptkK3Q-GDgg@pe2{)bCfhA@(4^F3(*EF(43xiAuB^J}{4BpjoLgVpLxix2N_V
zrC~tYbFnItI`J4Q+J4lwUV(_=YTx*C*37m(bPIB?4%P|JJmZ3!G2kM8X_9$^2k+2A
zv;wfal!0Jy=R!`we1x;L&F`YE=R88A{4^Z7kIs+RyK3LY9RHo(aM2SIOq~8U`|W>p
zZ<W$bArRRVTBo7iq>OHFm_JBa`u{W!{{I$XR}iHrMkC@33~+3|IHa#6G48iV<|mNc
z2WW{fqLy@mXHAPpMucJcKI$k5+XkR(^n{^=JrZPE=smfh6N*N-1T}OQn+X<@CLOxY
zJB_Upp-Pm(g?~gX(?XU4n2J#UAj{_u!lrQ@4(YZROs~RuY-@OvPQ#)!*e!m|<W}uy
zYlZ#i*!Y#GH8yr9XiT|DAs65|QW}Zzg(XQwp{-X}eB%v8w)iy~d8XO1T1l1cU^c7f
z!}VrWj_2YYKStGdE#b6Q7%Y6iJ}G^x6fzl^L+uZ&{ghx0|64#}=^T_qrnr<)h}!~h
zyQ*hfnMW0+%I_`@7kSSQSsHFLG_q7>lHj-d7kwqSNZ&-`sjl^bo|XO?|NRRL1ar_e
z8v8T&zA8<^!u1xZFIp#h_`Fmjr1l=!>j!>80s?0Dr$#1t;(DUv)vY^J38WvGpXeTX
zVAkJciL?l^d(H{e{b=E}YdcR|4kVDX_h4nM?hl$Dpg~U8rPZQAQIbdszX=r<nxA&l
zMpE1ZR)~8EaV^s0wgjR5(qS6u+NYMF`<4$t7P;-c6zKuT<_}^HK0NA5w9(1pbTaV?
zO(?=Kf!s-J?CA{=#Xjal7B8J7wWuGax&~}AO|QmUy8cxq{?>(aYcUsI_+ZWo-&P^w
zQObPwRDrR671<PJ^?gK#?zvXY^dd@Th;Ozm%!2rFNy&EVq6=nw^oqg_yv71AFQ?Vz
ze=2LGl(Ezr$ZL4!2oj5kzUkDR>l24(uh`&H&TNAohczpJk;&0^Ii-y5Q<Uaj<i9Pd
z_lS!dLVW;TgI!SlV>N2rB`SbRvI1W&<zc|-4`lJrjIw-HtfCEoDzT<#vZyjFZfQqh
z%y{PV0I-{nmNhVysgJ>5)1%^Kh3s9rtPQlX;;hH$FpH*i+SN~}?L2@v*B#rEQ5{N<
zsa8yLKoc-Xn*))n#}<x6rS$Y1WmZbB1rRcuc=fzJ#iF~RbnpjT3RzN(y*3J+P6++&
zKG<EqXM&CP2K>G-=dUM02K#?iu75Rnr5%Ac{_@(%OBz+zszv?)I-%%#Ds`>ISJop=
z?^M7EvjW}B5*g&QHi=%8Ky7Msl>ylyA*R4X^}Ospt$MNqnm<ow4l(@lV%vun6BOu*
z9TgS(E?H6xnWgU-l~F@0Z}VlR2)DVOgX4D$DYTQ!vg!&CT;qow(kfy8r^5tyN&HWT
zQATYo`i~B?`Tup8SHHUV3embS#;!h6yt1wov+$oA<ipWn98fg0^2!nRav~qJb|AS&
z+sr+m#m!K|WlwyT)3@+6Q)ZSN=0ns(!cFqCkMfjIkc+$MzG|v54PpB=;I;Qjo{tKY
zBG+O{!-1Z8zI;IaZyqCOk<ACaBZb(m>qdF=@s8|j=dZfzr%^psX?-%_>R*pOVW18j
znL54-<bFbT@E2aJE`|%MFZGjxZUqgFG;O@?OY0kzM9P&l>ZIVfHv>|Yh?;Q8N~7iM
z?#1Jpbca-VE(b4uexDTqdU5kS_~iy_>fwKHeIGxpSZ$`6e~7CxU@Kn37TQgs`qiNK
zLNl%gm_MF=fFGO}(vCFaWE1h<6-0yH0EGeX74Yxw=K$Eusa*aUl%(f_0U)?J4%Ya8
zM`d6Xr~9s&vhitpz3+jh7W7ki?RGp~U1$%oR1HRN*<9Q3JGdAD)KFo*7n|Jnph0K#
zreOu620N$(<S8p!I=9)nl{T~(-6UkRM4~c}-Uk5wa^O$sV>dqVJT-6G4R{GS8g~pg
z&i!uo9jIsCMl8}}vr*0bit0TE<L$Fi(z`9BvCSy-+E<utK1XuPC4A>xHHzBjUph0U
zenPGOqCbOI*PRZM<zL?ZE&1Z)8xct&3~MJ;eB9jwGfY<>Lw%Wl+#8tq;Y-9bSgAS}
z@ve7C&^nmo(bgQ<`^wuH7?gkKQK=5@0wP8nnAydj0^-)}$eEN0Cq4))Sf`d1q<+E^
z`4+nUuN^vzoA-`EYizHdpbb<wHfb-k-n;DN(%5<X5W3Q4NNyMBtsZLezcCP4_1?UP
zj@m`iSQ7rkfO(uLU3it8FAbNXhU?mP`}d32lG`X7*1q0fDoc^eU(!TNXR(Y#ThVwJ
zjPjf<v=zqH3yjiTGC_6N1D&kHUmez;l<g~|KkG%xcwnQz{iaW28zJ5v9eK-Y%sQJK
zxBYWeUxh(Om~+{0u$HONoS14C-%fEyu*`f>X%3QL=e<g>mo_U-{-Iv(j=g1jT=B&H
z4oCh`y0Z&(4^`jiUU$Ad0Hf?%KjqZ*+~#X=p&otC@mg&Q-A!rje{b%)S8TlGv6Fex
zKegUcB%k=yxIv6GlD@H~GD^C42{;4Uj&|R4Uz4+RFF~nki5Z?P)AiMNsuP$vKTVa3
z|J4l<Rn;4d7e{`3YsEmudVG-pVlA;4OlNAhn(n7ZR@R5mw!w=jH`KQCS!3tND=?&)
zJ9<0_A9Yz(Rmy5D1K*fa5O|!FEO}%?(X}R9+Z`&{tldN-gTE2=lAnL$b&;&Cff2w8
z?>_0~eM=*xs}`%S;XmxMs+R_bdy|@a27V;_RPfP^eGPdaul^-)i<YvD^%BNM9H8*w
zL+}_p?rYO979?Tz<sJ%D@?RjJ;)aVDvp3c@qmIHZ2O5$!EJ1I@sJV$cb_-9GmPW4*
z`j%kAXJY5&4`+2TTdc}cgT$AaStF|44Twz329d4%#JF{uy78VNo*(-c(=4y*UXM*%
ze=6>+g?c44Omf5jH~Mo{o@kG%;zE`Wg{U@*5xV&NyY%R{X8CD1`w@614~T7_lfN4@
z3zbV%V)#s>SJ>yGV!wp^IR(R~b#C(6n_%BDU3KQV_BpZ&GVlUkJ9510`||VenO93R
zTk=Z6nJ(E{+-8NX^be;wH$PKy^CqsJFJ}E~TxYn;1_m`Yv8+ntCik&ZTNW%1jo1f2
zeLq@#RoK(M@a7BJ+(6Lgtt~C<6@4nuk~e-y>ZQbB_c6TsvNRt=Zv6MtQcfXU^1`z<
za(}<UD8pyDb6f~rc%+bqk~`^$!3U@^Rvs~ub*+|d=N*cTDlvP*TU8jJ-m3c@5f-JF
z6v>b5Qyc>FLE~u<@xUGB!yjZkXxsXPVSlHn+%$+w=h$El1+~En572V8BkQNV^LZ%z
z*k%1LAz~c7TZKtOf}Sq&IMAX$iU)LQNzbM2Biw&g$>Kg{bM_f6nbr74irYh<X>u-a
z!fnZ!7E8{s%B$6*{#oWQ^Gm&Z4ymp3!HfDx(mrjq*EZTbdI|qpdD+;#3{3tWnEV!M
z?<+FMhUxoe>{R*o@jA>vy0=XxQ0OOT2f{g4N?@(;H`ws)B^LqHy1K|xNolOtz0m?c
z0fZ&`P&+BO5nCT)44sHwWHqjflB#g)7Dx%Tp~ctaPoqbfn8!^@2>I@&#A&h*l1y^%
zUku@Fz^4U3-`2F2hyq8n4KC5vHq}|U!BJ#`R51photps&CcdFwXnAC-2>L9hh_;6m
z7Ns!464<FfbRG`yUb`)M7G|Nm4L?szRiQy0yr@fNtnRZ4bWTrJ7`XwehT9*guDtgP
z9_qXPt;)Z!wUy$lr{umzm0i5;3gW3>pof3W`mLkHRTeN{Twj0D3{;cyUC*(XeD6wQ
z_+$4~nWhm9loO&6QTGfE+UU6{oXwZ3T=CZ>PcFUwafzwH8x5(MG@m44lrFHXMD05`
z5F%{vSj$2blvYu4wo(es81XPVisPf`0=t%Hn?^_2EQ76odxCbm7p6&n9c%pL$G!-h
z7$}FXOb4_wNEei<7@$R?X@KhRp6&H0sO*9a-ch#tLzx-fL7n^M6@i^6UH7ZWt31?%
zF)9X-^q~YUiy-yKr$a4K?LeRol_$TCpX)%pMS?(vcqutLPkX8c<H-aFbp`w)mN-CP
zK))rEAxl_TpYF&6%|v7GiDn}`D$`dDDl}z+V67g5>E2ko`=8E%A68mGg~=C#oGa#u
z#J$-PRjdLR`+3InL_H=^_q@whOdP~2hv(m`H3AXrpMa-nU2VwT@AF`%hUk8uh-lE#
zTP+!Z?B<mMPZ<h9pL6RGIrEtUW)Toj{YnvVIXRf)yI-b0U0vE0QEL~Oxw|>GzeBHt
zC8m=D!`M`=li@jpK=sk^<*aRg0MFa;ILB|r%E+)oV&stv$TkiYyLsLn|LRp>{^QSs
zIvuDniwVlkZLK?XVD`ue)&tSRFEL$ta!?(BQ<fWcw>TDHW_*%SB}hn=e{}q+!ID`+
z#tj<SheweBx{;rA#LcEvg>nk&neu6$C4UzEym77e!)W(|G7E(^TjX5iX$qRCjE!eA
ziF`l(r&l`l>Z!~?39RB#TeVFNNV?#~$qSfw#YX4!vygV`%zmIukH?Rs6FagtH@;Hx
z%wKgnky=vJa8yP<p6LlJYqW?Xm!%80IUCIV^#=Ir<cshB^ZLrz-SI6dK!TllK?*}M
zqc!saC%DozW(y6nWP<qa6Uz%3_`t&P$u#>MnSQB=orod)$`0ZcWBPu~wv?$0cSe}o
z0Bzi`G|58J*eDY6v}7G?vLi2#I4O_8YmX$!9<5F9g0znzF&Moz`cg5{q#Qw4As8u1
zGBK?vfk7lk=q-lsgd%Fnm*Vs=)IZ<Gzf;~9r-4Z))i7v~m8Zfeg`pN!0Lg)fZ_&bB
zDCSAu1d&7E6H~#+ZWn_H`-Uno43hW(r<iFdY4T3=khmlQoQ_RY1y5iywnOZmvdC-s
zK=tUFe)^J+qf~O|QCl!MY51E&xNy;N-#mkk5@UCQc<8pWIVB?Ac_vTj-@f-6zOLRU
zqwy}Lqk7aQ!5d~p?PjdG>SU+{$bl0S(bNAdw*bTJX;FiwHEl?onw35pA=%j9oaJ^+
zZCSX#pP(rNBEwAxdAa>r6@h93Ye<~Uqo)!+Lc|8Bc3JVRxe0XF@~|lS7D=e-kx3Z0
zyP6~yo%W1un%tVCK94j4L5Q0oX$llfTr55e!oRb^!gLCG3HA!9s9w=!7LMaAfH$A-
zu35q8y*UO_u?*5kKh(dq{x#QkU!QGl4a?^k<e7x*fMxl)rqO}!Hd{<uUR2Mw`h}F0
zfzmlsMRrqTqQ9Dg6U|Cv3NLFaxAv6!?Q6f3phk5ixjjEExh#aOx#F)1^wl?c%N0~G
zO#b4tm#qW{`E;fpPFWU<XXB7-g$y`Tos^iXq@#v$A^T}Cxn6hHYrQ<)s3bq!JaeK)
zlSqa^xMh(0b)bc$pt<|zuM7<ZnR=a7T`u%2UA-I-=sGLpM3@(K{&qgX(rxFOlYz}o
zTlaf0gjilo;Z_2@8ZIpbP7{WPT#UW<JF>ltzJ;_N>{N&8D;OV&X`Pi6W*A9~Cf>pz
zsg)Fh;Qz=3X6L2$2*r;lQl1k-H<7(}O|E;9CJ{Vl4%TqLl!>xn8qaC)z~4j)_GMts
zeUu2$^o&odd*6#HA+TV;QeB_%&Y$2*?5jR$|71AqTtaBmB0Xlsz^C`%Y*pm0zi&6@
zl%Wcdp@O-xXuy%Xr{X8Sibk>KuRz)&&vRKI27WWk%wUv0=mZrT5T^^@@?7v|TBCEC
z550Q8Tdx>)aO7&#I>oLt+~f;ALcYoq@JJXOalIQX)TyoJ$5tfKxiK5A&~oN5>okzb
zd&ld6m>faIRkS`IpBG-BhbGQ_tfl!iVw0}3HDfX2*%>nEin<jR4Cl0b#L4-!TsmLn
z&b3}$K)Mm5lVT7*H;THfN9H}<9FG^*ssJwHXPcxxrigUrX@!6&cvQP`6qX|t2&H9`
z-LfMdB=1f45c*x>SYD5-o-^+v&BRV{6i&3L(mhnNAT;Gj$)Irl@KRafJar(C8%CM9
z#5rZ$sP{5{iExcr?73=Mvv&8JHg;lx+U9$FRU}N8P(maWHm=oN<dI$la-}G2rZZ(b
zlU9?>_N`@4qXY;$eM(pYJ%s$cEUWYxTd(1=v!Ck##)+I6gvPN%_90v=pd!;~;G3=w
z6(6;>dua)st6{`%NP<CoE4TI-*3<$)AdN+0$HDhjYy=8DhEGlOOp2>G2_DC2^@uiO
zC+bM4a^WelD__Af1pmyta9|2W8I_ug12;v@qytV_q-D#O)15llUHYs#eK;oCzJ`0f
zm}(^LoNfSCAOz}X%7j{3i?aFy0K#AF!1aCFkTC_bpcd@Dl!>;8Zgs2|hvu^##6vk{
zho;TW*p66H)5Z<UE(y0tDU7LYg&8F|CL1L`n%Sf+(2)UB8DXxyY<#Uvs?apNsoN)A
zJ*#vQq|n2Xg!?zetHrxJO>O%vhVo3rMv(Z|%BLdxH@QIoSMXUZ=;^@}I+G21I#gm}
zQw0OiCI8Z)L$N*0G^wJ&@8allb%d=vPK`YNYy|wow#02hx_0O;Vw`MkUe}?Np)xlI
zis2={0uPKG!l2`goM2*=CH0l~Znr$HsjGt<i9ST@N+POl3AC-EF|i@7YtzwCg(pk+
zHhuJt=*6Tz9_WxBB%TSj>N?C?A-d|7aEt$Jtp=1yZRYw`zK^Y|WCN35$jPY?LO%PN
z!hapN03|`s+dPl8fVjVpOm@Mc&L98%*!BuXH6rt8^+(fw1|y;dYUzMJzgxPo4WYI%
zH=3kZu7e-i@<c>xZ86A}5b)ZlH#yg*Lhaf_8GI9d$Q^pV)(M_+^&3ds6nwoo6osF*
zLDcI;UrCdo@-X;FbftWh>V>MF_-8^xgluASb36+H$Psl$MI(2!r-rv@<ZZAGNXWRV
z?&#YPYz%wVwos$Scgf4_{r&Nms${2<0kTMEa_`BJ%cP`+<JE*;%Oe#2p3&0Bls!J$
z;k9w`qID3U&zQHMcWRbuXYVhf`bZbCo<tmBjG6_SZ3VPi1TD*OI+9C!6}U>IVS7zw
zh7C9bEGQ5#^_lEmqgpC%AXRR2hb%e`HxZ&q@aFR_XVh>}xWfMxlimE5bble3y2j-+
z;;irgzV&m+2F2WdYvFj$XIOCs3F4}mn^z;^lRG;@$+X(n=93dU^L18M@Ej2wcCv%W
zl#ohO$r3=jhk@KI1hsiHnFRaX$+d8xGF39oDbmjrH)51L7q{a?E7Bk%Fi=5cl72TO
z<9U3}&Fud+<(BdHU(nM|P+_jS$1bd}S8nl&u<MKtO+=%%l!Daxo{M9#3&behJ;una
z+NgT|x0`_UmhQTo6EF^FI*v?r6(@Y!Rx}PYKvhsV1Sfey0`1`E@n0qEb_#Oby0A1@
zb4K=6L$ADuKDc5|QeiL(@gb!&pE4Mi!tXsQCeoh-DRo7C{rXQbS|jzZjgp?Su0uQ1
zgL{&3iV&MetZr$&yQ>vF{y#OvHYSho;tS9-VndMc=FOx<kpHGb#$D5galaL!#-iYX
z8eRCXY`2)H>yidmQ5*v8B5!fl8pn0-ijVt!apb3)dzQkhk6V?{WGE1dro?dcwXbcD
z&L97o`H*@v%F-awk4XPWY{9EH(wyL7=|gQ|OC~+~<{*5=Ky#KyK8kKlwYJu1zj1GU
zbV+g5m4F!#3^xO+*Cw*T<|7N*rtwCfD(1SMjmkbs)(zfvz4>s(vFydQA?Zzp)7J*w
z8v_sAr1KKmpZniOy*vLxlNtVN9c?fT?ew##rE}?~!3$@WS1N|Ej8Lz|COzgIg37yH
z<gV`eGw=|_u>H=12c9q)JUBoK@0ZYn@!g|gfvM^oLIWe@Lb$UW-w6Bn%Ac{TB4gD}
zeMfJUHS|t4;Z*u^7p=<cua(j%1T9N`B8=)_Mk(fs6_DX-^v=v~x)SDPuO<D&-oTyX
zMAa_8R2e`x27Ayj=l*c6ef}_N(a_G1`RvZkh0UFroNZ~*d2Y}2>Ue0eR$}AX34BnA
zzH)YV&tzqR&sDWQZ=@S``O$!0MOOK(9Kiv%oIcE6FM&nOhzOTM^YT09nd}TQabs>y
zdsoEho=--TtprYzDYdjC%#@af{ds?$(TU89=~H+NaJSRvu^AvA-@rzHY^CiojeAaZ
zPa8XB9Ven@YUMK9sY{FdH|fF}>i=2p*so!T17H6gglqhql8><M36AF3<%PZV<Egk3
zL)d`uQTDm3y>cA#ZI0O2^E_BPrf0z{x|E=(qHx_bYEoZ9QlG2nb>#;ID^mB_q+pnR
z9uZ|Ug8{8KZ+^khzP?u^N{^+Zv=-q&c^%S>C*Y##!=yMTw~+$STFF?^%549Sr>~A`
z@(=r_89i`F2y6q1(Ip_A(v5;jBPuB!(%q$`G}0oW#OP*}v~&*~NQZ<B_Rin)Jn#Oz
zxBHy?oO{>#Uf1=h6`o)B=E}CUFZCAij(o@c#K>uDb*7oC??A{DxC8g_(-*5M1{!yC
z%5)`9k57@W@S|TEFxvUuiJ@1WWIy?0o+f@k9qw4gpp_7lL*^7P50@ZG7kDNTgGJaA
z-x*6bb7^~WQM!J;7iXPkA7paDoaRvE^`Z$Fs8OyqgD?<xUOD~7mTyE=GM;s~cXC(O
zm*cbKT)lXeKS~Lkl7f0POrQDh`d}6^%F(<^rdqSy0zzMlAC~U<zbtM`=V?-zV)^sE
zH7agH3GWp1bqZoE#f~Z0(VYpM@>kDqH7gnX$l`5V_T;w)pZ-<M(sBl}lI~+;iJpjC
zNuJR`ImDu*`ea^b*qqI-H5R46z?S>LKibK%=t*i|D#%vnM$@)oJ`!tF_j@9_ErS&;
z7{^M(o%OW4@vz&MRl&@6I}NPzlk*&>8i5rhcL?lbol4&|yuawfx@FvCDX(yqvK?OP
zO>UTJO|xv8Gu{V>B|kEJ$^z(LOed>_7HN5W#M39}Q~dHWw(GiJrZJUV32+@J_&<e{
z&>|9L{6@)UU^t|OprOT9_J6rc$dcF=f`KakOsJ*9N14960rjK!3hR6Ks8y@0>2+y`
z*qJj9h_!oCoiw+=%--y|5`pnDoDIZCnZBnXi{Cg~R`_**QT6yRL>_eU;&`lEdGgV$
z3BDie-ZT5X?v<=Tx%mgrdE?7}B{F|_v;{s4V@~!^I}j?zSaKS*mE^4r?*Frmj*reG
zfc*UE_Eo_)X+!qWOwp`DzjL-*ld=+RLXxbe5R209g{Nejvf_$QY=oo?g!OhrUm%e5
za<+PDA1H`Wf|lgk3FoZ7phycC<q%Fj<5+Jnbw{+W;wd1eCoz5(n&7S|%>@e5c$Gx?
z*=2Fp#$}e`Z^e66wHl?L{YPe4rJqnZhO2t#jx{Z{m#g&z`c8Sd0C!uSJ71M8kLH1%
zyHx_U=izem2NrU;Kbth8Gqtw|l@SbHgLOoNSd7f6NPZun*M6-2Ai$WjsPNrqoxVns
zu|Aa(L;nQ<Pe^=QlH8rovaTxZ(RmBiiee1c4}8_ii%G2UhP`|qu?9vlph)YOq{MAB
zfF?9Dkv2RmIT^ogw84n-Ur4rhIO#veXQyUfVQ;9p3cY%wH;_X4(|XVXA7$j7^X23X
z6*L)hNO%9q`|h6m*HJnQH^r32ZOZ*I(&xgtG=RlwQP7;Z`R2`0UtRi75pFp`{r)vf
zs7JX!KnI&x(FbMsJAX(TG1dZ0O%(rdmaZ>m!-xG#$*JFQfh8qN?Q#t`NWbX}sSn+(
z=_iS${~dR__T}TeuBVBp-TY*5?HIH3q1gDu0u_D!*-vuFaF;15L(PP6vh*BkI{Iwq
zLdR2I=JzqxejoGC8|F*RJ@TY?rkn(&lnwbbBpP<+z-<jugKc=Jh7$8{HT&;I&px7m
zbGehKbALs^=J<Z=lXKq5Hs;J2h8MP^zGujKdV49>3>gc+VohyFsfIcW|K{1K1>ZUO
zE2~?qhK$+s&rjncn~kII*zL82KUNdc&FJ)SD?d>+?SbrHqSSY<-Ssf1b*1j6R@J$q
zG_Z9M%}BI<sjwxuQs_r>l5F%fSGd1&K#wY0Fr1Wn_GjO#aQmqLU4e3CJ~mYqifCk{
zv&8x>*$Vcy>pU)5;}c)|{~aA0HVJ%(&XxxAn=FAr#60eklzrCgX>N|qIJ9-NGSfbf
z{KaA|`XeKC;6$eIL&l07ON8A`z)SdI&;2k`Y6ms>PcuJ44X8C_w0<E<5uU(ciG1}{
z*2}AaO_PR%$tO!-RNZSZYWOy5Ke^%!ut{oY)u@;l+0CBu*0<_Eaj_9FSib4`H9RuZ
zmsD@hQoBDs=*g>P7u@?aN;MC-rQ%Nvj?|yhyb?|CHmQDMP(s4+?jC-STC{xk(aU6M
zP<qroT8Ks^m#~ERR6vZd=7QRT7zvV)3jbAMerF8~Sx@jXd77zkL&<QDEaz?g6x_a(
zXV61B4(l??Y0u=^ee6Iq?n4v*(m@L;R?HCpeONbRBF<rk@vV`W9p~zjSqmhC5%c+*
z65^r92a4DmMWRsj_FnqEAkreD-=IS=jt|m$90n5h%Y1=+<jo$ukaU;$$UKQ};A8S&
z9irbteN;*{2tKcHWlI<=*drCUe=RL-(U!ebIReIbZTK^D29OW5i)}a+hXxQ(^8(nQ
zS^bx&e{gUM77bW^bdGb_xq5fegyB!H*o@?5XWG3ICKVsTB*P!XstxNALuisM!c$T|
zD{l9mDF<3S_#LfqHz~#}nu2``iA5++-j7~pasFE@sU-f0Qf_?%$wDnnY5+TkS^$z8
z5poInz|rOm8;oS{u_Cro)(|g2=$tjKn9LqnX7#0%+C{Y_l?7Bzq;_Bwwjc+ZLtH{u
zX0U;AikMBUFPh9#vv++?R$sQN1wEg0P3ewI!%A(6lBeD1j85eK)J_>AKEj8eKGiR~
z=bcs&t~RZs_FQ9x)huQl)4BC}a<3UuQke?>6=xL0$Wo&ipmPweR`mYe^k4Z)UYL-&
zUHLp}yYwkPeoNFMM~RZjqE5g242#+ce}J=qW<<6^kDG0ST9ww6^r5@(YmcMBo1r@_
zJXorsGRc>@sow5?wGlP$`;W!7ffa$Axqbm(e)B&3n2n8ceg1Dh;gq^Gg`?by<fAPi
zvcfSvr55XB{DLqPcb*wKF*S9c%)`0lWbWQ44|p4iI~Nd^RX25?`rZXSxO`bv#1Ibl
zj9ui5mItQlJ>jO2)Q|Wd9j^~e@xV!LE321*hwL|fGkw%BH@2Jm@594W3!Z_BaDGe{
zd1iRrj`}z!1!?8ES7!LsbHIQBzoe6QO4A0&-_-&!&z=t<s}XF$8rnO26ThHeFo3LC
zE(zU09~P+n61t(pu3gB(6No<~Eu_5Q!dGV=JYw6_HKN)y-B(=3SERmR-PfLfTnly8
zeQ-(3P)VV#9;;UJ28(<S4g!7>6ugc8Ow(V^v7K1lZD&~(l~B2GS6)4+me2SL8XR6i
zgoNO`xv&L%TdAulo|@p#&)_B8<y_zl3$m(Dvl0(4;cu-s^TJJqZ`!L<aCzeQNA_?v
z7sEE$@x4v#C(<;(IfvETvdS}p`wP<?>7HO_-qyU)H4C=Np<NhYT(Bjt5}je4#!-{!
zT~t-#84!B-fFae)w(Kh3OAPWCzVtOcBc#CHU>lsGo{X=R8pF!a7vMLr$E7QJ*x~Hg
zCN)KAY-E6Io&TVVZDSB=kSsxiY#CNEQtgIRoqKv)_KOq__X)|=sF4hR@AK3p|GwW-
zt+liMmy927`DNkz8?ZYn*IV(zZja?3Mif$rm(Gde8Wp7&{tb)GANFC)4`%{?aF9%m
z@p)sIRyyOOliPKZBne^`E~Zc8Jnj7i4B8aa<YtB~sBIF*0Q71m)Wc2G=-DI6)3?8X
zjAF-%md9b8C%Kv?)m^L~R5f4q7CWbmbf;piED}g{Ua6<Pi%o3k0ama-jU>rE3Ti9f
z`lNkiCDL4~{~i-|$ll~?2WQoe1+o?Cm{e*!EB?B?oHi01)zo((;A${LQ}QuyO+B;j
zFvOJoG$#64tmX?ZjpB^@F-q8Vsq!jpSVa-N>tmtJ#LaV(dRhgU<&uq!JIrr{#<1#N
z%kWRl#u$J7@J;Xic!ApopqbQS`Bq2wG*>iwra!?%e-+K_`1mC1oB7uF-v<5EthOe<
z8^0bDFJG<3N@RSX)l^#|DzQ`bOX0>X%nN%^i=B<cXuPYOo#8JB%Y}){KSBX`8DA0z
zm<L17d8QT^4*gnQw*7_v{i^f2v(F39fYX!o&pnhp$3qz$@NB($o(1&34i4MD&0xI(
z1l{RvvBbPI-1GL|<v2fKH~)7k38>8EIzF3|u^*@;8HibNX52tlQonY$L*E_+C7Iu=
zoyLw>g!w=QaU!9@Zx5zOin|fdJ*he^9{#P3CLquwc2mi_zbXZ!?vho=fgW3;!U(or
zmF{qme@L1MhTPU#zT1+xfb1&*SS{mH+tpn+qCE6oaLE+Em>JCL{I_hBoOrio%V5J4
z`RMX1eNv1|$}qexeKVf?O!W0(hw_t)o~KEvlKvK&M7m#l4SG9LIYTXsfmZ0hqGS3D
z@<cy9)W<bR6ztF|Kb|Sby39Q$>>i-#jhI}bnB`-rAE~x_B|q1$N#T&fVcVai9K%r>
zG7|(!T)v3jN-Zy_pKg=S4Z(2XOzL4BpnKz?voZADLyugo@>5-xDNOLg_`AB|mc*}j
zL3OGp%ART)dPLZ9|E|o(D<#DQZeFR3&d`FKoa(5c1=8yneS{L)-4&Lti9>9{BTQLy
z!Jff_7cD$3p}YfiAEe;c1(PKA4*F<Kmsa{4K7O0_qD?QtIvJMc1Vd=kQawPupRfb5
z!#|S<_a{j#?b#)NgkG0-Zeia7=8FJ)Jv8X3?C$J){_Xyv(XNW?hn}aEG=^@_lG_Aj
z*OK0!EK4yC?UY>OL?3Ea)BwiR?>h%MVK^yCjfqP!i>eQ^aE-lVAF`gNs8p{HpC&un
z^kv*UUeooxr?0dH_(`T&?(T!}--UGUWQ{ljhNgu>9zx&M8z{z<nen)$HN=lPRFbDI
z%Y~0gHl}f1g8szvtbn$89{y3wa^%1>dcjZg;nOnVz~2$|Fio0ML#&HY-sMr?T9J8V
zI1SODoc_;|)i3FX6*krNhRbplYkxY`@Hg|5Maeu%jF{Ec07}pwa-AJoMZ1uz5_@IX
zMz4AW;Rz=cm-fi%l(OuSKRTTCt~_T#Ry|k8^;nqxLp|SV%DMW_VDw`$V@Fff#aOiw
z#aq%k!%DdpDo>cbzuVAI>u{))pfOJD@!wk0$fcq0CF6@~XYxn5M?q9iLy0_VTUTS}
zVwt#3Ib2}Rse^hfQ~Z}3N9K^5ng;d2WK)J}7mAAW$}g4w9Pa+*M&TT|{-fl$B-aUt
z1iobMVXQv-4e$Iv^}7$Ou$pYGrCML)nUi2g44L490mFA?M+N@c;Dm~S5M7REHi)y8
zgbOl=uabosvg$R$&T<4d#-Uci>Oafo?--EH(7bo;bX`KbJORsnM=#!a+7j|tWet$K
zS~VcfW>T9np!)8f3T!le<|1a>wWv9qM-(Q?U^AvwfNeg>dq>_gCx<f0JuBSYt5e^W
zb^kTWQ49nyVnsG<$Y%OEmLRli^PM7LLBh#+<IDS$GFbx{^f<<ao0KLYwd$jA(Z>V&
z#6iUhZk#3AL574RN1MTO&*l7bT~VRDN<J;}-hPpmlx7%fvcQiS3Mz*bPMU@SR`ZyX
zXI6vde4pQKm~-pvMUM{#tQ=R}(xc*TlxAG$WdB;wH<bKJq3?KUAl)sW^gDqe;PX43
z;y*5N?3ZTn*M$lZ>ictITh?SIpBa%=kq_|s$4N*4){zm@T@zZ2MS>gT+mZJ|V&9~O
zLtTLiYJC(l+<JH2on<4q_qQWaTg}V)Z&EP)M^VsbsJH>tZbrYjPLS32p~S*q{2GOt
zT51X=sl6%b>$%L4<Pjq8lCD$BNsGD3wHH95ZAkMxu0Go+w?HG}M<ctUVdd9Kv7m2+
z><U%$Y4V+G^@QQU+TUMjRK$KzQ+tc};=~$alwRV>{<a_?gg1*6Hk+jG@H|uKpED)u
zAm`1|(e|F-xF-vE>CG?i{gaVPHfFh`{Ij;sWmMqdo?no_zQC9+2yoTxeB&tqi{jQ5
z3Uk*bPIC#mU#FD$q%h;)W0_{9X>@3+B;fp|J@Y;y>2^NpR@^EVPIYG@+lUc2ejhm{
zi;lt^gYS|$Z<{a|);Uj_K!+k@X7xHriH6!4kVCnPkq9zRpul{<)?6L$$C`k&8ah)i
z-mbi(d#%n_i3)+-J^IvVmYpR;r^AISSUZVlSY;Wv<PGH|E_d+PXJkuusEuG_qNTvK
zr|_WUDPp^*b(aq{A{TFPC}A$_-S6EZzFTjPkHmct<MMqTQYhEEEgQQ_I?Xdl${Zm%
z^;w9Wrqp%i+LY4Ax7TR_8+@RPI2-pHLsj@DUCE?azpsKQ+KHD5ZClb$IaL+;42;Bb
z0|JKsB-zy}+N)$!(RyojwXfUVavj!7_scpnQ!P7<P)6axq>0TBGu(B=C4$7@V6ELg
zo5~^|ZWd#A%yj?|!j9on)4xJ07Py)Dx2#Ad{8_paoksQ_c>3NU1G-V2zuHl(eZ%8U
z{im$^x`_8}yr{o%aN)Hh=FWs`hFTQfI3SNX_3W*SiJ4i$!g^$++hh%0lVL<a&1M~9
z#`DB~{cfOv#F|6eW+-2LDZOl;2Sw*|ZQ04=^PCJ-lQS_#i(6Oq#mmvomw(i1unCtK
zlDgJtO&96*_$6`By>OsnG*Zn_uY*p58KT3O$9mIsEts_Y6?+}v`azG>;)Ky8n|+i2
z?aLoRV%d>ZfM8f{@SB%h%-roV^_8om+5vK#f1S<`S6X8fA>IVmRfquwvLZF&Y3G#|
zTc^2bGH7Caqg8aM^nJS}tNWCIz)S|bD|9+T@d8JZ&poM}>D-;wc0a9`7X!@N5x`B+
zZ)G^q-J+m<J^h|SHoE<11vg35LMK$D77~FEsa7M`a|jR4sGhsNvVwpF<(D(pX5-|5
zltKYUEH(bp5%mV?k$q7@wdzp4Q_LQ4hF4CHyo=Zy6zd|nY{>P=1wlvZY+z!sa@B2%
z(?rnBK%V&9lxRzcWf~LiNv_Np|M~^fq2{(-!c^iQcWEq4!J0r0))+zoE}gU^p3A7n
z+WCg0<ZBGl!Y8UD#vA$iY=l6Byi(B=G^PMTfe1w|C=?4LuQ>J5VF8LAdeI5BazdRj
zS5JX(1>grgiO_R>T0%RVZkK(|W$ShSZk)PSb7gNX2UBmWND>hG(=>HCGxt`5MVQzT
zzGM=?N%#*s0%FjodD-xDZ5P8A=n(K#NFq{74gGO^`^bOa27J>Q=2A>qEi`nQWF6gD
zmaEAx%7aIW>Bx!WN>!@~2m4&awvtq{g%fn-Z~LTJBY0k$T`usk9>Dc?!+hc{Gc9an
zb$wV4B!4B5FsvI9>eE$I%p7U)h2KQt)wk)2F)=b0?EsYkA@-ypAINASYFlUP*0npN
zPsdb22@^lr4<y#~s;CL$m|4LVO)HukEMK^EHrjVC@l}+V=YGsR=$9NC*N@$N6l;fO
z<e&>$XahOH=|2M~V9H2ob6L-5ot|1ikc%vgAnwrGr(+$yIlT*is;tA+)QsUh+8x;5
zwubSnz{pTe1=%|svHB)=PY__z+RZv;p$95OKXo+tZVmuNOcJ|B{Ld<T&Q_qWH|p29
z`}_)(<hK#_mmwIjlcvhtPylZ`4H-usv7GUv5jWW=?0u@yj2m}0u&<}?mUGeL4-L$$
z0GFbGM<-R5vZG0&W*}?DneEOY6|Vj@wY()rICsytUyr)~P>jFG?nElQeIwv1LA2~$
zu0*i(Vrezoq~WxAV`A><nK!O&;?e{om(=kG1}9fvFex+~h)6(Jr){?WFkf$aE)&(S
zj$g#$Px+fU$=hV6!ZV2s`-{!u2?x?OekaFGa%vkMoP)jSq(Uc<(6dsU5sT;Pl=baw
zcchbK)(!Cj-*V4@;qs0SZ<OBIHK|lZQA!Wl5IZ6Xu`9vGorCX<<eRcC4yyZ9;OJ1G
zVNWT<t4H|o$|h0qt?Fxk8l?e#lIcRL&UyYEFYotsiqRq?&0(*P@kE>VVzrePQ~vz%
zbchHEco2SHQ&UrWE@Uw`cocWgj97jotheKDB|&YNA3^BHv^bL;K?SHDHD|NLU}!VB
zuwQcim^`^~_C5SkKj6n|O3<JY3$W={hay{oF1%i;g_)?5kDkd4JoN>f<>iqTT?W#T
z5t{hj6aUSOu2^q>dh^;<UqgEiVo}OGJsv(ItpX1@7ts1iSR%+rK%JT(_8t-)<QOEF
ztHUOZsND<W!rxQUdqkXxq;mWz9i?^M?_li9EsV~e3zIGwn)X(~O(kqWQc0!uqpiHX
z8339@C!JDSCF`uOmU?6WQLN~s^;WD3{sc5GNAMu;kUaELY!Qz+alUzE9$un#Y)i_E
zN|F^>B8fz&yIr~4GK{D5x#=ivPQ?tq+U+0jyRo%vizyzc!7krKo48?b^TQ4!g3DCN
zL%-=i>?OvBa)**MhI0$eksm=bi$IKELe84fqv-%bVn{Y+TBBjJh*7ig4&GMfJHQw>
zTu0&IuS1<}3B56Sg7DiR<o)yUxusb`6i-#gjSg;++yi|RlV&O4%QUHKFf(FDm<av&
zi#5YXM%yPYH=Ex29wr1lb-WuFkNJulioR%j)W;OD9~#4s*5#F{pMZY!iM~F0Z}<?2
zmqm%2`L1&Xcsnn_+-R_v#?2jZ?gwfsjy%(#?MwOLPOD=71Xz&j_RE0nr*Xr_Y97)=
zuD{=%{+{Ti8eV%g{MkMk9@n>*kae}-rh9RpuGL4zVDSKO-?Uybyh{J-Qw#c+-smv4
zV%#^EkvTSu!;ebqH{EeknDS^-L-YlSQ%XB)vjF9*A&7Tt5o?2PHDW8pJ$LDE@aGl{
zKP-?z`*N>XY(+<G+Llk+!iC$Hj%>yWQuKXsRVo$8&0ZN@k31YsBn>eF6t3ToJRAJ`
z--*N&!{2;UnAf{m9O`!o!38e8OZ}w-z*Z7xh`Hg_aJQikdU$a&O98*&qs*ewB#e>y
zWU`TD;*it|xXBltL>QI#*HhA{1Gk2E-g^g|&BLCB@N<ls;GmH11x$OhA3^d$yF)#@
z5JJNDRZnyU>B?7b%j=;^S|IP_+^@SjsSojJ6ahBl)kYpfZ%YyKddzlypPa$KbmcMz
zi3mO3b%ljZh=MpttkEgPX$*BXFIvidaxUCJ77!~%RE7joB@YxhkQ7Z-KnVnv?qG_<
z-kNrPf*l9DsSwicGTQXdJEaHR>zQL!%(J<hcUQ9Y&2oV9(>9MKIy#^S!P;Y)gW@lB
z2bMC2dIo;OqGb1x($GQmCSoI&WQ~~L)<%$ms)!vzU*(g}8YfhNMz=O{SYRG~HPDs|
z*xy7ftH`U#g;{z?!TaZZR#|HJ@MfI|qUyj`T?v3CrAkh6vy*HtwVu0m#0vAPebpR1
zNN_BnDZgMM4)$b&eRhez(kqA$eoO#uR{UA%HRYP-zN!{sWYAV(WKgwX{+2j{xz)MN
zqDQ97ujm(WZmGr<aT~HX?uq{O?(P>R=RL%jRQ&F*1!hm~_Dl|Qmi~9d?8{<c(vy=E
zW=#){&15i3>sp31Smg>i#>SBzJ)X&|EL#R#U0*ygy=l+{VL=8G)_en)k_!tsn&d<#
z0*7CW=gb-ld5m6uIuc(NXhUh3n=C(A?jRdpEF7&9Rrk;uvL&feVJI~o|0W}~p@gDc
z7P(NTP$14XlXW*qvapcNX6{K{Zv!!Z-gLJZFv~Ovk62D$dsBzDzxlrAm15J}2@&oS
zC7;%L9D?NCCR*w7Y4@$NQ!R*bo0rYZ8+Ro`B_U*_rQ=cM(nw(VUy)~HWW&zsDbmDw
zvQ^SbcmB$_FPK&Ir7fgi>mW~az&un%4WOfUqfs~Xh;ZcDTCzc@_4_Nc+P$IEkUhuZ
zK27PMgj;9vemT%lII@Wvv*OSySc!htzorqJE_euQ+-#4U@m853LF7+3gbTdjxae~y
zwQ}ai{P3i(o`BatJzs+)Y4z<t``4qup?sqcay=lmNQn!w(1#OTZ2L_E(~{}Jp^Dve
z?6cY}KMju!V)BHqzJ?9flSTdY;>A{18w|jBzUXeUo6@IFm~h)JadZBGTkBtOZAwfy
zw5x2sPFX{0;oLhUba1dO^OZMd>a(8A`y_`2?><UOy=VD$#Tnr=6Hhxm#O%}(zjP7?
zr@FYe7PO-Twr4vG%fz(~c>Crxv6~h`Vlz0JZ(XYIT9CpT+80o3>MU0cyHg-`AAe=w
z3hrsv+&|C9J`cTLBfP*RD%bQ>aeA6xKfq4mJ*nb4;A2p|mMNYUacBa0k6%|E!J;9+
ziw(FthU)|tU?tVklnU9RpLu7~Lj0Lw)X7x_$RijWYbhRD&X2Z>^5A1m<nx$R=Px}8
z_I*wjcEa@J1PA{J25^J71J|A1<$zlhtOYd3s5+}9^7*sg-OQvltNh0+_>&x_mcb9^
z$mU4E66<iy@Djby_w;ila}=yJa5h104K>`?a#b#RJDX!P6%{)XT;ZW$KnSp)^eU<c
zY-DK?(=FRo!FotFn-oBLt>_?$(7U>)BA@404G)(W47~v&)%?N^dQWiW0oy&oq`gJi
zDsAt$>V-on`yOrFIg}V%$9e%>Xiv02xca8Su4}JB{___>XhaZt4|5`Shv>|?fD+fy
z1#Qp;ZXo^<J?^Nc5(S4Y$iOWkB@od9uAwC8>PUmGfHgexA`Sr_Bc4OlD{bHGJS426
ztbQ=73uUO$201=D%pN`xYCWoDI#jB{-*cPPYlp+<_3gsw0hi<*y#XI<zQ+tfLW3uu
zYpQ&v-u|_n*DXzL%jM5!3(%HXNL!+GJN<p+T&>E9+9I`;rQcVdA19`*1trU5P+HJP
zC~KSb!bkHoDcjYpac^wY)QK+W?TNWt$aD33+qRkubdGVh_z?;qvXd(p>1)jWq%2kq
zy65TNG7y^GR2O6@y6JVrUbj3Ha}SSP=c73~Y-svfl)Hw49_cucP%BW!WR^XUZp;;=
z)Q=QEsH;9+3%t%<Z%(-MA!UW+^+I^9AFmxe7Z_7_Wi;~>TxnW>o@><%-}zWf3Smhc
zZ?aL~y{^ZqzOif1y_fcCef!->ns}wb+E)Aqf{T>R62cOY1FQu|ZQ>?RC#7w>M3X7y
zv@~<^#<;y{KJ^H3toQ1AL<8w~%-1+;B>`O;m2e4gUiH*eS@$#X5@XnI-^S??7W&k+
zxE?lkq%V8aee~y_2*Yg!+uP770_wm(%=whNNvF-`!?3?E1t_1nxJnPg)cz|zr?9_%
z0-pB)S81z8f?<RTs)1dN=I|_=Xded2$KQHAqZ^Ez*Y)~!K1Hd=KUWq4%6f40Oh_Fp
z`2&vyOXI1m1A%|nedsZt)wnY6K{!lYnL%_`IR~B5FKu4>F1?LAa*6);1igWj@<#5@
z%%i=xT*F-+j!{wr<t?c~uCB})kOK;HgalEBp!4F~_16cx!Hz8GBzd<xN~9A}K0|OZ
z1=C!bIZ5nr5;a~0i<b6N7yH614#4ABLk$oCJKegTr~<Bz%UMkKl~@y^i<>!7agl+j
zWyA-Bca34z0p{^n{R$K@(GoIrLs7SA8+C^ecl!|SxKcvkCq^$TQa<z#WVOIBN#{be
z2iG{<j2^E;xWf2(P2Myh@jxn%09!xN>p_5^ol$&aQppy}Ajq9U7nR(q#544cVSJwk
z1*na}wuYKe!%kJu8rP+zcY+=NlH`zrR1!VCDU<9K{!|-ka;<DdU-KM<H(~X#dA;zr
z2mYqFN=~w=Rxk!L55BSa9&~whw*nqT{l>&1h&IOm$=EU2z~5=PTbpZX-j+RGb(L9{
zooH~2Z|bd1P0l+><$L^YT>KLJp$qIp1s_3o3NN4%@s>Fn9*Z)HqO+rj-`lDcRo#SK
z&+vSY`fn1Nt?KfxKQ+2vPj$F#D8__O&;kzi0|gd^AcIFb#vF>D?=jqYqdqle@OV^o
zds=>~WrbTZ;H8k~x)iZxk!fby*Bn&zFY>cgAkP?<z4lF?yvZ(weAzukj>+mP4;)Ok
zbC`cm6pp;<zIkwSKV#$E#s5Ms*WV@2BysEPElMPVlMnFMKWGDOiv-@PGzlyVTunTV
z-foivZ~I(J|GnnE8FPOU^@wz_Wo2)}pH|`i+{j*xm73vG0)J5QGlg2ZaI@{^La9WH
zC}E5D?5{UPSO|q|U$%MsXESf(=Z2s^&74SI%h+R(;xk8fQm<2+%@5PRrJ)FV9!S1E
zVS1X|BOIH+WzM}jS~L-L)`AmvR^lS-IOry^_JBh)wjjPBjc1r=v2pYIb;s}DX-)?Y
zlm6W*GVE<kpT00zlxI;=6q)cM&hoYhJl@Lhp9ZX52JGI;zf%7D+qm<S>}B)#0_LA|
zZMsbMPla*_|B%4ZE_ORz^}~DdYAU1S6>8%%__jPICmd)kcZDsQe|r$g_SN2Y*?Wrr
z>hE2g`5uqP1`m$%;n0#f_4i??*;(1FrKe8OUMoxjUo!E?>+Zq#aKxR|et4~ZX7w7}
zLQs}gFGb@w-_rvfOgKU&Cy9$7No2GcVDb&dEvHsbk)L#hWFHV;zKGiy-dBwN-i0l_
zl4CF0k_vHs2{tt<DY58aQye{AUEQV?->%S1K#xeY+8Y2BdDCw3hQekeG3xQY3;Ahq
znKnu?*_k7j$68O$7a~EVqa@gvm`JHVs5D1H7Y>TbP3EtJSIUca&B#6NC5cSD2P-DA
zk^h89Gbgl(GfWnkCbjFc_r8J^<!^<!jfJ`9Xp+WTL-JA7xbNYgi`Tolf_bNc6g+Ut
zYfBXA<{0GQriqE{=DS=KT|38J4vCQZcNxxd>8zud-3C+gq6FP0cQYO-)_(=)f(4^r
z8k&T@Oip_ctU>S<C*^%?#plz2w|gWo*H{sKz#WpQarw5i*KTOsePrcD>=h?QcjKw6
zSC7p4m=Lpdn9q2`3G01z1wfwzX6|m$;^y|~?(pbt#8+w>h<|&oi#b;v%a_9_{gW|u
z9;em#+vbi;Tyv5J^#m{+?Q$g+z(a4=PWI(ZX!?n@pa@YN{<{zy0^hewffOTudY_yI
zyxJs=9&#}|t?gBRSl(?|8!q}%EnjYuQkY+LgW)hKGc<9I9t@XN0BjxVUgVak*dxA`
zExK01Dt1lRr#5)g<v`((gQsz8?s*a{`L1~=2<fhiG#S6<_Fu%CPiy_>9`I*c<FvE7
z#@U<BNF9-{rSuiQL8YFlsvc!AhYp#<D1uAT5!)*9JSE+OSJj%p{B`NG<!3d@h9L5+
zLB2fHdXF+x546_zO>nh$GNvr2%tiW_H4<<1bhQ6;t>$@DHl<3LLi9A{xc%dI{EhZc
z6&z`Y&sot*mDQDo#UMZIn7F-qeDf9k%;nl1Aye+04nBNKq|Y91Y`emx3o9QTS16(v
zS3DsjpmTAEUE7f0+EK4j4(UIMO4Rh2bgz4+<@$`ES;1uvs>TYs!W}o(rdrtQouft0
zNX4};j$*Be#Brdk11WgqHwx5x{GA##nf}YPx!E6fq=0`Ek55yQ{QFKbf==Qrv@C8G
z=l1cffF18hg9CS>0tbI#vhuI9JQlAO@^2T;ug8OANuYfS1#>O}hjMCj75_%NFqY%?
z;<~**&Db3zG~DOq`KKPbKR!@5DSo0^v8<&KA@fDf6xXnWRu`Ppndkl5%tH5%w1&KX
zvK=i)U#um2jVyXCjO`^J{UYt#XIX`{^@U6DMIcMNhAKWUNloWb>o~*~{_A%)m(4AF
zVu26dEV6@ofYAlXPY#EeQfs97jB@dv@UN__e^ZN2bbX@?(ReZE%gz0=CeCm8qB3^|
z%D$c13P|-}HJR;HwOsJxB~EgTE?^sgz8~uT_0~^(JtC-|Dzxe<uX3MBqS}kH>B-m+
z$vex_pwh)|VL*D%V;m)_dDdiyGq!>Q{wEi5WqvKxhf14|2lrTx4=jT%J7LcP{KRD5
zeIM?ACgpsWJn1=TJacgXLfnt8SVxE1?f|<zUK$!2#_V=-{Vx1_AF1^te2;wj2O%Q-
zj7&(Y`4F@u?=xxN;N$3G6+&j@YF4mAtT4}1@OmVdf|?-y5C{ww%p@<%^si~SMuM4w
zD>GljB5>>UWM#>&HqHB7jcOc8c;v9^d9SYaiBpGQ2dQ;d3Q5zxLT!|1p^};gdjpjr
z>q05|eVNNqTCC}+Sfj(GqWK(7jrSe7%Tmyvn!BgPe=DyPgWbpe5NuG@_=281r1U)!
zUSR-S`mdCO7TTF+?fA{$NkZT}9$l$dC{Q(PTgDaI27Gq?Zu*vZ4sSc$`0j%R{)4T(
z%;nO_oIspeG6z+bIAePUQX=c;_(DLu8@=u_=99t|)p_u;MH`*F%Hl9ystT}bYZpJk
zjqtL5g)R%1>5T+uIzP#Xl3<7{JiEZZ8{=Z*Y8!ZP$jL=l>7UDEY9qJSHrDu+Kh5<e
z<y_8O$NRK&So)*wmQt7T1yV2Nw7Q~~%}WVs4D(=r)bzgWtH<58$uuy40ENJpIQNY4
zr3(jJ0akkJpozD-A%uz4<8o$}5Q3h7u(S9h$m;o-<xT8upX_x&D3WE}`wrb;abOR_
zaLKA~z(<;k;E{HDp#Vey4u|=XzY}rW^2VcjciMbox@Uzsy8IoR?kkhX(D5MnYmZ8$
z7m~|L7tDTM>yK?1#=ebbz;=Ja4}D}L!jGd^>2!L(uWvi$;&XT%o*vcadYi_fb7fH1
zZB&0BA6y;SEYJ;Tw#df@yD%@SAjaefo}P%yWKcJPwNL~?7R4zn$+U@i7PHpP2EL?%
zXy?g4J6K`_J9q5ahjIKo45N&rPlqe{Z+16{u5F_6yZmdBpi&#jVTb78b%Jm|e9XPk
zr5p@aj79|wpN~V|{G9gx{g_vW44&bqo`I{XQPTeJ4DE9z_>*d`f>y-w#`$&;B#9Ft
z=2*Ym!*?&Y&`H+o(>VBE`;1g~b<<)w!=^KcKuC6?&LW;~t<}4x{*3b-{>7C=7We=G
zy6}muc}r?}fN;4ZVdZ+XPYUg0*@t04M{O=OK5VNB2t@-E1Sw1?*G(p7!xC+o$$?7b
ziVDd!t)n0DPeAGuLL9!IxUy;SiYCH36GzxGHxmID%n>Tr7+iwqR#H*dK*)H=izQWE
zd=+AxmsEI{z%_Y@LU(u)r|v<Tf1vwUfHfscBp<RUMk3Kt01r+ZHX_T6!aAhxFik?q
zNpDm_3^rv;R&bq&5=K0Vce?3-m<ebP;RCglr{UaM%>*a9K#O{_Osi^1dR2{DP%toz
zl{`B5bYj`kt-m<*Ds(QF71w_mRt|5HFGs?fw9raW0Mn~=*}i}+sus*d2H0cyquj|o
zIsHjl!J{u`7R8)r!K_o6&vo>TWKEAld>ymlV6=HHrd_BG;N_FAf}7A9SG@kqXo}Q#
zxJ9`RP+-|d2QE17jvxg+JXv*UogiCcmJgQ62a^WHnve;Ae4YnOscP}jGE4jLl1~xa
z(+PS+&v9|NqNrnEI5H*@<4H+pd$@*{<IFukVd-zy12eLHW`RCmhp!zsX{B%QE}?{P
z`TrIvJ=Icpb*9+&t0(`HBBTb0#NZlz5K6pB2^EbF)~nvKsq?ID3lX&T@TeyYf#TP5
z8AC+Fk7K4yR>OUV|ESmG9Z*uoWH6+yNu|XZ@0-HqqwQ+B40tfA3S@Ver==?rNz6sm
zj=hA@prRSxIG=pC$FZMG<+IQdJEt~9FjFdci;62rI5V8s#aU=eG+Iu7Oz9kP%AyGI
zM_+$;M=3%`1)lR87Lah}x#_reT;Wk$*!##%kDVC}zseCwkCJ#sn%#4<@c7gr3oZu~
zUmS93BCa$Z^KRr1a^{H*D8k{9#=vskkbcp44!m4bkw@omKcS5X1ChG2lnVEW&?~2L
z+;t191q>p4j|45Vn1bZ2*y7eqN$V7!TaFmU|JokHSqTh<L|5P$0u>g8K}M5=lsCl3
zFE?!cLEHup=e?kMwEdy&UDsb~lQFLgm&>JpvJ6MZ_Pk0Z1RXZh!vVR<K_Mel1vtE+
zD9VbCe@+Syv0ZA7{4K0>Wtr@p>9GHiO7uq@0{QZnEFe*(Tx~oE_IpJp)%Ua~nm7+X
z`9xXAzj*o8dp$n)fa0~;I%bt=_+rKeN?`ASCy?7sJ@?rXQReMIQ1V58^sajw`OQ~0
z?!fg9BuS1%EarbGOg0vk*9Uo#{vvJPPk9|C@?(6QYRl4po1dvshk)rsDGk4umYEG0
zu8OmYpV`P8c0%r$PT>t}qmKXeO|}nnf2NleI^l>RCZ=lfG~y?+7HlW*+`U>?nB?k#
zb=!I`)t*F-#1VQb02W`k$Pfkh20mP)BfCFMGFTDD^90eMJgIBwqe%Se_fy8aPh(O5
z8aDczWf{V5lTorsqS=kd;)a7GLrJ+Jq#gbeI99|{QC6!F5romfygy0J<Z-HH8b_d|
zR{4-+%bK9rcbgr0XxxYz;z+4O{AZA3<Pq+xdt4hWEo9oReu~FZ;HCuBjU!~u#>F?J
z9A9A_*J2GP?92#eSkS9|+BWs5=O~|M^ogKMUXXXCFqdGL*z^|^#gf<?>e%tA#9n}@
zF1?4qrScuvx?-4Fikpf&HB}l$u-&Yyzk@^=;r$83Oi*y-tx1y76@7_`d&9M9fAh$}
zuq`4r7;7C%4Xm~rJsFk{aL@D_rg>1<N?!l~D4}(u9>5bfR(mh}-?Ba`jj>_a%9J?3
z29bDheD~!tQfN+<{+ZJ{+xLx2pWq(iHtX9S-U+aeb(y|jp7)J^=SQ;2{UGm;Fit7i
zCEGIZ!|$wpr>Hj5{M_eWIj@$pDpG~Slw4e6SZO*jUS`JRP(UFz)Bq{zm*s@Hx#r$2
z;o8Ip=1n+pbY#}@2Jg|##zC79sN``|iKJgNeW&9p3d}`qkdDGIy(pYvLY)heo>H+0
z0gqzjqXbkO5}r=M`M7#15<Z}y_LM+Qx(v=iaI?OrrQOD>q1|oie`k^hNn?w6bj8<y
zXb>G0<Wi$r7!il$jum$8Yz5AZi6>Iq7GN%n&=ftu?dUjao1@rIl-9gWW?gSDxu)8n
z?JVIMTs&x-n~Wg$MIhPtc$aRw>#rwPQ4;0GzjewKC3_cyw!anj92u=%$ah2$yHNe|
z^AkMUlV3F+70Dd=p#X>cGfcVD#BRiiWwVvnuFlKka{py>EWBIqyz$0V_wEv}X9cTq
zk*casGn7A;8^~((kV8PKh|jFR$uFv!$0We{`OY`J2goo_%iNXagxVng*-J@&3Gjv#
z9Mb>i$!4Hfz5}#xm&g-6(fvwSPuJjBK8M59G;rO&oJ|wW@t0zF#k?=$-N)}Q4)enu
zzSF(AZIblDlXdQ!4+Gv7%-!7fM38w9(%~H_1|5FHhS|JBdHr}+P2A)r#m6`~i8b@j
zJ<53IZ0y9Ap0Omh1j2#dr}_43re-?pv^?fH&Zo6U*2+J&Kb?6=%zbBbz(N^y0{F!K
z7Jioezg+6Or15;o+cu+!dlKuBJyv6ot3tO8VuQYVsIr39k9sZo&0b3=!aaEG4snXM
z^rh0FqYfpmSmJ;9?WoqYda#L__eY3YakqV|AX}+MPZC$4Q3@;3?)UX_{eg|)Ft91P
zkj0|w@>`Ml7<tZRR?}D0zlbZGkB36~@0V@g*1FO?oxen{&CNZ5WbIuBbo(}7ngwK6
zH#`2`(M6F}E%CoL_olqx1TF1(pG+CEYh?h$$UEYT6OlUmP_&u_5je=OX9gre_|p;Z
zfipiw8mJ3;Jd@_)i@-!7pRb}WNuJd5`>!j97rX#rd^#p%4C{Rk^?2VPLjPDYCf>t!
zb(}Wi8hzXww&P@O*eT%h^`)%y^jVx_Bp+tp^Eg$}$voSC_2nU>L3LezP%E8Ggh6(q
z7W^U;Yz^J#nN=b#uM|lzmMWJ0W(WLxb;se|@V50Pi6jV4N$_hUe)A>?8I1rPi5zCH
zXy)V{aV}Xz-(P-2nC}I`Oq>voOGLbabMCZk;_+v*aDN7Uq}^_`n4>IAMg^~U=HB`*
z{M}^@wOVyv%KeNzhQXI?HFAdyrq3JC!fukcsUv;F)*bOv$P%fL*DQ5Z!?ff=x!a`u
zLR=Qd8)pL!NvA|}^r&PM$d)kQb6Kv9zfii)FZgU-_Wax6p(bybXEC#Qw!t&YY^{+<
zhY0AATq@yJtyZOZbHwwk!GK?$35aN_Bb9Up_$pV>*|j6m)H?c2#<p}HGySI2DB_H1
z7`N5?6wMcZLsr*5ddy_agov~`M^*KoMcmx)tw(y$j_2pHNvj5~E&3uvB9Xu9HnR|}
z1*YL9^}cOa>r$Nq+jpqI=AG%r5Kq4ai-9_R{-|r2Kh_65`C|EO813KmEru_j=Zy>1
zz>YAHSBTjW)Wo#lB7E&q<spvM{SoWCJ8Q{{sJ+*ZGnds#Fd{0DVTga|Raxm3!m!}y
zo!?W$?d7-7P~p3d`3tUCOa8a%)bBQD8T;k>rh~IunTLr0hS_n~ve{SF8S)=}L;`=k
z2^@$7Hp!oV7`aV6f(~OT$LPDDL-%|UM6JY;amQ)ed5o@q&+G{{a&O^R?-h2Z1iP_p
zgB5gRt|<4qy|~)C|7M?At*9AayzKn*lH)~>|NQG^0Ug9eoepo<ADhR)e~>}`n4dL)
z4Wqhr#kXDGq-DvG!t-+bn(kQ4qb$QbC<7>s<-trkXh{8B!JgXy*X5mtK*c#HsJwGc
zKaNv%gSSsZV$mVatFE`WSrQXN)CY$9yk-XyMN3?Zs@b_FNo1>m7Lv^aC&^-tYgZQU
ze?lc+tE6110-*2LA-H-l|1h5T$Nqg?6rm@1lvMyJL1jI9XDBcj0#JwQo_!2zTO>DP
zt&M>)aY_^e0BcZ}e6P@McKY9}_sK+!^Ee2V;2x0q7)!yhO)V0nf-zYw8$4S&P3JCO
z!6*Ar!Jp{DNd_?XzP5>Z)>gqe8owt=fAew(zg=Ny=^_<&AMWhT(`-T#;!2uw+#W|}
zPgP)J;W&sRHBLBIVP;9U3XzD%m^m8y*_XIwJyujDqKQy25g(&Yf1|-2>}d$<+M|jP
zZcK1Uf;{R}a*-T=w~ORL<LU_^)@!LgKeD7wAwWcd2-!^NLOZmyqYk!j$_`iySY70C
zWMjpB%we@X$*h#*uDUKPtHhuSh=i_CM5{@bAVpDVJ)4-_8Mf8N_f9(3*f+#GD&Oz#
zk}B<8i2~p0Zcrsgo%t>nZ=oVX3s}i3y-aOmeegC*K;gt~swX+hR@rf88jO!66Fr*q
zV;?Bp<8J;;AC0W{47ZHtmxcfG2su4>R^i>bRIAv!Zl8|CfgMDLI^M$XmQ{-ZVQLYV
zY!SS5ZQU}V+i3bF5N{E7P(8#p|EXyrf$hzCZmW>LakNuh7ctg6q?}WUYQ@_<8Iq)R
z$IORx>0n@^UaF!M+hMy8pV_hX<*T;z%){*`&AMSY<)uD|5eg~d%tY*1=|p!z+s!%l
zfRK~-%vHxlCm_J<Xx&c>@jb-J2CVm5K@e4xVZbugPmBs5w+5~015_sU7O8okH^;vb
zW|C^O*{lYIo6dvpE{qgXV*`4mO;~OQ+-CdDv}#PoV2vt;uwP*}OvCB^{(R<iu?BUA
zT-c-;dMyD~XcdA`vJu>&mAwfjWo&nJIzuBr9W(a1WgdHjz`6m(rXwcK;YPtuq#<ou
z-&{+(s?1{^j@)W&+>3C7U-%O}pA|Rwxo|e_KekJ;PG(W{8P1cF#tvj|<|%v}*nJDw
z{19DstyP3szeLAbpslaLbHs}2&aiHrk(AO*Vty%?qryF^a6t@~(ZPA+)Gbyk3wXy0
zoI?LY&75vbSat^lj|6U~1ZXEIQDJ(!XZaZEz>Lv~=uKz~8pjbI=_2}fomlSenN7Z+
z4lY&c3BEU2=jhiRZTEYhyie7N9{fEWNP2ADX446nGiBnDbZO(jy22&2AvjZU-*s!o
zWB#qM`t(n*I%0g3KB>jz!#M}d`*G``@17G^j>S_9Nhx!BZDILzHm`nMCkfRV+Q;NZ
z-U={leSXWOe$0m5KKEgnI^|xcJi=<mzR5pKji<(vKz$Fz&OurYWYWCsRLjs>mg2;2
zG?1X*NFNA-$Y-=cR5cg?PeS7qBIH@$pNhbvuj|Z<#ZP{wo{Op_g`PjMQ-!>;LmX30
z-{?`t)pKi&heF6Yl^`E??WT0(r#qA^#fy`L_ChknINROW6(gz>jFf!am^d%-&o-{E
zdw*5f@ix6N&wzPlwQwBLU9#Uvh)rJzPK<%HgY7=~FGuDLe}Vrc=>AcC!Ub?^%H5i4
zg-crAsx|Z!h~WE!uwV@pflZc|8iQ>V0;CG1eZJsak9UqPfEAb63}?8>x#geU%>+{Q
z5EdO&xE#~El~b<2*u+LfZ6fi)KYT#s8hmKIp7(E~LVrphj*6?POcty76_B_$Frx%7
z<)<u{zJ1volpIK`$U;yeLy=_m`+S(Bd|3&IuP+#mp>CtvO?J%9`&5>=Tg3Hhu($I0
zq?>oTn<KwutxZTU&RR1Ppz=(NQfMJc_8j^kDwEi*{nXR$=Ff)M@E?K%^jGG`7Aq9d
zWnLMfxtH&N&{-`*)MdK1&9ER2^uhEjuC9>Hb}ZPC45?+;kBS|an=;>!(&dSIQ&&Wf
zKey1&pI!tEr7dRfyX`+EvLzjVbi^KyG(St#2WA&vq0c&yLT(nJ5A?5Tblz&c8L)c4
z&HuE3=e{A9xs^2)htMhGm;K&1{WT3G8)UJufI0(@^Nll)*wQ7rnq140U%4(lR;D6e
z&ahLRf3<h!u0NIGJIuS<OI|(a(O{KDPbk8F{%zNv!<E97Z`UYN^tu0QUvsl#TRRRR
zW)w)ks{W5Hqfnl)u4)!~apvT`NXe%R>I=v4jK<hY>i*|k<0sh)b$Zf7qkEknV{G|@
z++p*5f4bg19I@zpcfiu^+1*a-ro1Gaw>cUpwVoJulvzrN*T1!`)qspOBG7{KgN#qS
z2ZQE#=s0K#IfL9GGtJ&d=B?N0PRi~ljm3!<smVi4L+7c_BDWn(MYNd{({?Xs@b`}Y
zt%;wvvH*Jof81A=&->D9V{ZBdj5z^|r|8_%K}etYMSJTVs?IS*d(`HZW-{z``2!DJ
zWK+TOs-eP!cufAp`qUT9`Trb1*(tbDWf0<O#Yx{d1l|T^W7HpiY*d>1P4|K2gJsI@
zQx8KL#T@6;ciy^Zus<0RU)Px>N~c!Hit&5e{s#$qFr)dNn)AycYfH!#rKIW9kErR-
zpQ#r8-Ix3#F6H~oCissQXctW*T_Zh0AMf4>U@3qp_=NIZhQgi%o6wnH2^>h~eZR}z
zo`tYJApTQ86&rA{UK&JApixV6B@IffmjO8Su&&$5aKp9xKw$D$Y{{{fZz%t!b#aHG
zSWFt6-Y2&gUE$)I(QTRNrQn+TqsI6>LG&9*t!DF>c^3R(z^panWiKJ<zDJE0`hc4t
zF5tmMZmayfn3<q;BB6(Umk>mLKk6m6Lw9YTCyF5TSg{(e@%gs$wFDrxEL3<=kfW{Y
zLV2U!O@}u^KBKr#ZF*npJYp}QK%^02>9N}3G|t0q3(gegCTezZcFmt88SrxP?ik;?
zdDiik7azrD!uqVkY}s#!@Rirs(`JT2RONQa6>bh{_$<1oJ8ZoT8AO1-m2w|DmhU9t
zr_U)H3~o)3gYyHW+I&u|A<+)QLhxEE98`DGy|M?ew*4ob)W8mU%ivE%U`)paj*Js)
z+*R44`eWm8n#_FGd$Fo;U42J+1-!!fuA?uYmG)&%&PQf4=)7`wm$mdCbCqy0{m}@k
zw#c?b58v2Lk<u_tDeEGyHaYZTQJ0k!=0TUj7uPJC%FAK;U5Y7W1FoIc%SUEQPq>ma
z?Aaw_9|{<wUz{y8V#1;cP>q}4<4M}`1t~WyK-YTbO0M9MVy-9F?@Q{>&}9Q>Nq*G_
zc-hryuXTssjC@ALkcl2N|7ynZ*xhW7bvE<aDDX)dmpdfRLDupThHwy&wCV{3(B}C1
zP}W(%iDC8XQrqvSg-?99d~0d1eNXMS&C38uOB>gp{q!>&hQ4(_sgn@^$Ck(TFpYMh
z@<T^`z^9ArEeMCMwP^n_2RY(49WiDE#RiwkX9W-A#4u-jJJsknD7v|5MPBk|nbmRh
zT1|7VSf12!P@W<Ur6&Fzud#xO&G+{V_bmFfOz8b=!q3K2T`z8sp$}VC^;SjtZO+1<
zzRRm=QIgJFCgFYerYq>9))wN1{8DfAayTiDLhyaJwDNIPcO7vNWAS*A1hI~+%W&bu
zwf5W!!BX&5DG7npqzZ8lV<}FYCFAUaTt6<-!$z6XU-s2eXUKU!Tu*+qvlYf>1;ARg
zQ~WSoA{X*Dc)eReo_Fk$2deYHM_l3dZvljH`N4KLJGKdqM#}#`rrtWN>F@m?A31W2
zP!Jdc3_x0m(W3;V8|io<A`+v!OOQ}Ox=U0_x*L>6RFGy!sYpr3zGuEazw7$_<Av9?
z?RlQ(-0`>{=MF(npFD>40+x;6*|S`{wJo<?a{s1r@b=buf2<QT>b0FH>CZ{(B3E_F
z1iI=q;YcAwZ!h$CyMVU2qVu9KzB4jTGIohL6h(YXhFXifJuIo@zbW`WXE|-ZOj0`c
z<?;vL@q6rL={cl}*R?YgOjt@bG0|)#fer&AD5muQ)$d`e=~(Fg=VeH!DGIgIBccF5
z?`5!`hH8aA3N_0uEfVRWkvQzjw&gQdpG%+&<hw$BL~s^v2S=%lr*qN=R5>x?rmNT8
zC%w89X`lF<R)`_!(q!W}DJ4HB31wH%z4;Gb(NkF$s8#(UE|3oukD=meUAly9Z&~R1
zbURgZPBuaVYsFIB)p;ZBY~FsTU3p+P>s-Wl$NR<tJ)CekE6TsKf+zy2z8<y7v|hIi
zoq{M3nQ0YCbszMPD?jcth&&=*8<1HWRlJ!5<DxE-==NbNG1~;~^Rj2cCvR#nD#@u|
ziOMg1eY*fzK@%oiq#u@Pu*x%*WD!GntK{B;95I?Bx<4wciKRc@`MT`;xLPi=Vw-vo
zA|S+NOI6|O-y<C%;67E9`3<*a@XgDzmR0vHPST%D16&LKH%fwSGlUk5LXM>SF_yY-
z!gi&f+6Hf0(QhLeHS+=-?#9z5%nr<+m`y`@(vF|6gzxwH$MN)>H;D>U>d7}9hw<bN
z21aw_dduQYF01wR8-uGfOLz*GfJO~*ybk1uEGXW`LeE$$9cFxAJYHrxd2f?OwBY5k
zoaK9>pOs=f3iNYq|MysM=2&*FAbq9K6_&{e;R{=7`;)op8pa{pqVBz94=1@`e%Uyb
z3ZHm-Gu1lb6e)6{rM3RNe5o!%jrr1BIH|aNcwpQ{5+%E>p5Ko<8Q$^j8qm|95w)37
z3r?8%6QvK07JH49MwXqlyqtS6Fgdl`AW|JL;LVE7SoT|HUJ7~yMpUn1r#IMpJ?tI0
zB5&wc%J;VL9+=d<DjEGu^5MD7prBUd!%^}<+V?C2{q7@MEg+8VnUx<4u8c^X-7CDJ
z7eWvle17>rogm6T4Tdg@8%o=da~%y`ipH{%nc7HJ1VJWXBtM{`TZL@lfw9OUg7C-d
z_@TJ|3v6cLhbCI$DuvD><{_Q<fh!d@w*V1Um|9DKuJFXxPR8|IS>W>b90sHiM+Ay5
z$pL~$pi$_yt7e4PtBl`^OCyl{RDci<CLRCw4AwaOF?5)cV~uk;5h$mOMAf0Zck-GC
zV|;R+|L<xlObC=C-7B{1BWJ(WI9=!iNfP2^)md}9-{GCNUJv}e*V(S2qrgDmOCijn
z0!fpfuBF#*fbd40w9ui}P+`q%j~lF{O8g&G(#@$rWGayY(5qG@a7gGQ(pOD^=ZPl;
z#*klyj|Yg_Zw4~<U$fGba_Hg{`ZJVlyNeb-Y8ydI={}t}Ay{V%H6jy*Yj@WvK)%g;
zZ8Y12#cvFTNJf~FGkchKNet}4EsmR?&Nm)1Q0&aKD5}$v5icw6UGU8I_;K8h+Z?F6
z=;t^3+}ayR4HJG=Ao81ruyvYiPO5dl$4Poxb3&<wW4g1c&dgeeK@k%gcbmKMgJY7k
z=vCREHb-aZRMb%8WCF>OjNJ<f2lgvWgui{Kz4{suf?-=8gnL@EPGH*K+TG<uqf>RE
zC1+g*wKN|p<nQoBORwLpr3L8tfnNWa@G?(V%!f0I^>pAnDCf8s>`&^-x@8OoIKC|(
zF>Tkm&GDJqP&E4lH>y6zrf@EFB^}+AWgsEpfGfK)2*{u7xNodJ4|MG)IPVsbgc3-a
zS(`GvT59S^8bkH51ZeK^t-CK`-Q&;V!tMyV#0t??++{f5G5OGHlTI5UuzF%I5#c{Z
zBI^`;&z1V2*s_UDj2j`6EWe66xiY|z=W|a@?60itatcnZfV3cfX`It*qRaEC<&#p?
z;w)aOCb`xHiL|e7sXVc(8BIY$CtWAqP3i(Wy-m+-xEQCWC6-;N6X-i=k9UrUx<7ND
zcen0-?-R+=dY{-`aeOXLEU8S~zX*MO4UoONd#A^3x)EUlbba3Zu{A#C9CKZ6#yMEz
z;`Uyv_S`+_trBdJ8sqEzEyilvQLaHwMv{6J6%`KR?m7WGX5H`kX7blokMuI_s7NB=
z?@umFCQ10Sj$V4bT$RbOr82)Uy*pPbUT7=fO{nHUWGlhC9x9cAGE4jOj(iYFX3PB~
zlvi6W-%(4QyneB@ZP<HU(r?~EQ0Ob8SqNk<GWk+1riMTl$3`4Riog1lYKxuoyD~!l
z@5<$>#%{j_yIvH0KE~6swqtUOt;g`4L7$k0m)pJBw|cL)uC`nO>gKlxKgvVuISHBT
ze<k~vdO`~i0*&oS;qd-MMxqyNd3+t3WEF}+bd$qY7gUn&7A2YaL?qu<2(M=j5apTi
zA5B=j1&MYqV*4jsjX}ztk<5WwWG8Ql?@xj2mmm9U?YfrpQ1r@DUZhV5l<C#uu1r$w
zn%z-`9a5k5a>%+0=4DbfjC5v{R+nY+)C-M@m>$c;)-Z)o6Z{~IWbp_ra35;(Kbp}=
z>Zvsqn5))TpNo=`nf{p;_N)MT=nQhaH#xFRqJOEma=x8I6!5T>WoX`E5V7v4vLMac
z_u{3Ha9tG2X8l7cm$-Vqw&c^azVW&1R~JTZ+oR^~MwY@0hIxr3K(8DJ{>Kw)?5k)8
z8%U~j*&^7aDEpf<I;7`kkeQj8LdnQSO@rXwIDFO7;P_kKkGOthYhd0kb{0BX-BPy1
z)}XKG(YI7Bfp9pk!a3i4m~(fOvC=l+vW+g|T)N-w`hxwfwZW<S5fS&sjt%0^3?$k*
zy$o`#DgpDWK^T?1gb%S{;sL4K9kHVnjmRckTL0PAqc^EC%B|>S=7xCOg@w&bamJWj
zRO2NoQC(|e)LK>Tv0}&6pnMdA)+h7U+l*1uVv47t6nrli9n}fGV*EJ%+jV$-$z2lG
z-EPgK=e3J^IJ)<6?IdI;dT2mD@bY|CvXN@E%n~Y#LpXGw`@Vl6AawXLRF&@R!Hb)t
z@_cc-bB!CfL<b#mT43H1vg=IuI4CC5PTF1N`0YOk>W!9fGY<Xib(<NAc=>?Of_`*+
zRc)ZI3zhIffm?n5Z<<+j`Q4)8o;t_<hU?Axz7ND+ml<%|{z|(PC?c&9iJ89oIT})A
zWc5TL=TT8-FWKktF8N`-%I|w9+@%6J?dy5Ue6!_?he`(1DkXlsK_@bLV*Ts&nY_k=
zz!5e3*_jWl=T1F=*dgXp+|rGOuOM?UuS?s+rehXDg-HL1sycp+9|NJ)CVnQY(Tnl3
z(6Q^p68;hd7|BV9&4ROl)G=)H)1jJ9|8^CO)xE*@VZtGy*~@>adUuSuq8{LG_HM5C
z#W6xlqzU1;H|tfXt-J@(`c^&yheV4j;l7c0RwaSC*6x5)_1=Z~!If%c4gnz{((%`S
z{#-M62xcPZ&D;2TP_Yqm;Dd*S>xN1*mE(aVAg?r3xX2M2_WL+TfQ7b%D^!R(G4-{k
zx-I&Z4Tq$s&(3!<=uU@JODBIZ3TbuOI$sZEbfnq%<`HDwnF6CRW}G*fD=($mERi=t
z42RR0Q*T%(sa$8Atp%o%>|5ftOuQ!c{J5*cls1v4F@~W5)~qxx8aBHcWOc34#7C&(
z(a-W9Ae9EA{Tt22K>CR1Tiz09$;Ho?e(!)=+wA?U+GJ24N<-8>4PAhG{P!#+r8U^;
z{n&OcCw4dRee)L5o4=7EWv-OTCeTCDEmY;cb+3ExS$BB2Q;9<NftJ)C#_|npum7#)
zHme}X*v8}cb2N=KJRh;1|J_E#rb&}%DI_6AS<Ki9*eC+niNkiF4qfo~UgF7O>s@y{
zeV0dHNSibD%DJX?p|VxO{0%ZIZcOm=F2n^`_{3u@S59IbI(!f(=X!pcQ%Ex;&LjTM
zSv3OzO{zm9Y09tc&+kMcfI_u48jwKCBw?FO5w<)2-BA<5+~98pIX?em>p$kPTN}4l
zRuwW6?nvk6_)&Ic)>C#H!|G)0^5V}xA#Qn*#ma#4!?lGT1~p+j#_jvw>hB7FQLkHH
zi(BVJaen8L<g%U{`s&7Z<aa5Ilw~?v9o$E<hSFtsN{jw?zvimhleC0)C>CLJCR}MD
zGa_NfI`)1^fA^&_<DFQJS1m>-?bA4Ut0z-8n%rpzf3bh#vAa{ji(7BsKVJ@TmsmhH
z!dk_#+t4ury-{nfs*0rqm31l8oQ_xL7nF89iIqi9;>xytE>2np_Bto;&+Lw84-diJ
zkC#!CQ(YQ-Tghd1GSje10un7B*=`B(f-{;Sm)9hl)cGh0S)6>DF>6TD9U4Unk+8{(
z&t<HH$4-3*(`rkvf{&j1Fm09}o1v|~L=-TG)S5%WGH=26txhg_<sgf;{%N@tGPJBX
zmy2&M#Z${5cl9aua{Ff9&j!~AWV>FQqA9d2QIV*vzkZdx)M<FtSh)Ho`Y$Ke2w}lW
zJZI(p9$HvTBrVxc*dsJ!+Sc<#JYTEL^0zWRw{FWhf^1yxdUpsLtBp_uJj9trIBj%E
zg0PZ`0_(52a+LO`?7yE$cZ&9sWse(TR2%>Ny?van5L-s~_z?v%2=1yZl%mN5m~_`6
zD-qlPbYCcM*i+~@SD~4eDjZetn~|t~8d)N?kCu+qxJ3~g#`Y&X*z%A!Hi2EzdRzv@
zFLXtVeC;lGq9cQ{7*+SZDI_CKU&r-TxCzlQ(wSejOi_tp5<?Js+vau&@?rw%bW$f`
z&o(E{K&M?xPjZ8dD*C{yyw}Qzhjm$~dEC|i)BKZj+1j(Psm@A4qV?4*y*F3%hA<{@
z-{g=0w_V7#L`iaiYWE~ty5qA_+7IsJrEI7}D^M0iHD|hnP{{qEkjH)5B~o%;0Eyx0
zgBJ~)zG!~V6Swm$Ol)pnT6W=xC+5oW@Xj$a_SxRkfpz2*AMsy*&jar6Tvuu-B}+4-
zo^Ky)5xcTWGRhpLdT+YV61r=aVhj?vV!vbChCO{C0LKlriw%)bXt~0CgD%(}>o6sE
z?{6o_D64+nI!P>0T+ETd!R;sJqmIN#5XW*Q5<M5lAyd}q)EcjVlh)b`)|)x>vHQmT
zua3_L+=q9M&lP(=EfU~vND}%sebjf}dSoIR>%0`9SWT^*gmMwCOLb`}8BgxM^?Jx7
zuv^$Y*9W0@j0m-*9W^@N>TEWjo792b?MtUj_|0l95uh;BlQAGAD*Bb8?3*q;@n!||
zx{mQQL*E|TkGAyI=RGUk9}*NhI%549$GG~Wj`QBD3a}|<pp%jFvT4y}!iC(t;*V-K
zV%N{+OFj-B)oqPArT6chY0L*VcS=ti+Q-Z$qTdiShy+(x_}y>fv_ML(2Vm)QH*OnR
z{}e<Kc!rnNEfB{(+Mx>gTZpU^F*!!(5$RByc{MuyzP{EIWD^tE*J}I+F!TWrxk%K`
zoVHVgHdCKon2mu#3X(Iqk{v8&%R69BFeas00=hhhPXo^lyg^Kd{SltmHCd`flSR`O
zwR(Adl%j26yNz@Kf49bQs!_RhA0&4lhQYRo(>X#~>P)5VosY^CxQxQ9X`*we=?DOn
zn^qnZ!*FO%Ra5DSDjQuRBS@no{{gXG4Sm2ekc1Pr-uX@<hrkUS>`2iZr>sgK`)z-c
z6rJyMKK@>rl+k~A<ndn$G;s*kzVd;J?*pU6q{*(x1VLHT1xOX}5HYr2SPxxmx60Za
z)g>wke)g+Gm0<lkg?mBI1J{GH3>=pcj7zKftH#GJ2M@<C&l1QDec8AD2Z~E=v1J7|
zc727NjV`3v%hSU{21v21AnAneeolo?;?m60W!FVlt;BM`pJpVsY5f2~^?utsusTRf
zCsleLG?7nO11{Dpt8q=WX@$q@Eo)lE`Lqw!72e>g&>#6LG_1is&g_?=rck{gj=Zs2
z-L(ECX+6KbSM-Ug1LRl{RzXD3#%bTSPp;@^ueR4U(MI}GuUAif%nR>o?*}=fj8k@H
z{w%({9pgZ?i;*|GvaPjHvuw;;(h<8#H)$2Rwm*+*xH74;ykIk<P_k0M-a8;wp++C;
zdmOy7@T*bq;iG>05S%S;#dEc~snFD@p~_fn+^zQH+*?X(?$ONsedEEAfUK0#5ATkL
zg=Madl26{-4d_dLk(GPoG{evI{^Z;p3Hl@8(m5-xd92qx?|`<F#{V+iH#Tk;F?Z$U
z@MIk8sqoEk_^x^`6PfpHfDSi+n*6?dx#wZ^Z1n{t{m@0+-zN@S=J^+6`k@}D1S5Ay
z6eSt@R^mIp9_Jj9U(y^+p83j`15B7R5pZtUzP8M+TfL0ZS*tfG4^2tA(rUhP7W&Sp
z66WmWL~YR?;JX7dOAakhL1xL$_Zz3AN+J->D~(&{<1`mZ7dZTFaxXu8bbO1{idpF{
zyb%rA|J8B%YYk3ZO=afCKHT-UGH}aL4DoAA3}MCG9!GdhT2Zz1%4C?eX__E~Tb01D
zN;G>ic^dRA+HMz7Pd^_z_pD;&SXeMIbe&)Tny)S0?ku1<$Cgk=Uf=WK>bf9B3aFW-
zA%^*pvvoEJ;6`t80KJf9as8B%S?JS|=Z+S%8E*LW@B)D%pL!%Xdg|hxn!GX)Rb5?u
zqxX!!LG|btw~{ug67&fNCk|_Q9+!K*jJ#Y9_FWyk(m2=PcJ_#JH)oD?cCUU~OwzJI
zk54kg&)*$!7a4K<j2I0R&uiDjm($kbJ_VZTqpek9gjH3jl_aYe7CzbXj3VG9!NXQ~
z)%aYlqL7D-LVo=%&liZW)hO;7<k3=csF%02@C$XbhRQ`va$*z%4<;9txGheY=s8!p
z=9PK&aXUQZ+5W&m@(L`}`;R^ChKSx1(O$XMid{*M7-3G2&0WY-s>{-(*kZ-M^c_Sx
z8}#+aqw-V=^=M-r3i^z@*qqoSXrIY$#sH)qdMQ<}b;OgiU&0-at!Yd+*R>+poO88S
zBrc>i9@y{YP(qUt+enYO{Q7ui)6L#^QG|$o8CxNziikSdJSQ5Un^x@3CMxSsQuu_>
z<4b`@GHA$~>J^Q{Uncvv4edXSxO*%|d^l^aTi?cG@S=K~<F~`YlnxxO4AOK?0zERZ
zZO@(dd<w`)W&`IKnmp*G2s`Y5pCob$Un2V=FU`My`z4K=gIct3`%!l1Hv3Wu%djUd
zc2xTNTuN081Oayw_&LC0<3D=k7im?gOtA_dT`hF^qJ_1j>z$`w*;KAIUr2kYJI22E
zF+Xfx%kt8`MoW^dVXYqk^Oc@kkAm}y_GzAP#f7Q7R-vS%G!WprolFn^WM#rY%+JsN
z-Gyj~ZkRq&&Q-Zkk15hvnvo&sltcIFz*(_io8HfRIgWGDCymf^@2|vZaLct7){m<N
z<RLqs?D&<?;SyFNNmIgU;cDS0jW<DKUJV^iJ!^b7Oc9KR-tp&vZ;(h?je)GTk^xDE
z_8v*$2&U4^OjxI%(4sd;c{D$ZvIFc@z2(S7sXv^VfWzy_=;YRMm8DLS(h_Tg=Xm)W
zAm{r$1W9l%7UF)Gn@}h{#pg2$%xiSE@YHu$fb7!MWFpS{F-PIV=mAFZ5KRF($g@fH
zN;~?W+;85IO~m8XE%=Yt<tMq5Szm_qyCzK<bz~t)%Nz}3^=`B8n<f+?O7{MbK6gsq
zIH$!I@VU^HEv~{QM~cIH^Bk$j29_Mj_EJ0D^|<M>Z(&b)K0K=sx6U9D5=K-&=EJbU
zNw5M%9oNV=wmT`aOQ)}-=6bhRss|wcdbK~!9uhy8C+r(RyX_knR^86Z$RI3l)4fA7
zl|qE6?nP6b4s3JoGAq-{Gf@9lF+K`C`^Hcl8MxJG3G!YVX(xC%EgUZst;uqx<oWa`
z5jR;aui0y}?N3VFF#19Ym-ZGXq|{sw@u+KUHCtsIdtzrtLVadXF(*&_Ul_YA9h`{6
zj(U1}8XYM}vYsnONce_<Q&h{sa<J=EEbRCrZQPcy9c`A~hOvSUJ)$sdJb&%t&!Tq>
z7ZxL?zqZ=iF)H(wmtn1FN&oA#h5MO-BANdF!ofvig{Wu4nYgUDM)mde&09|$l4<;7
z!<b<Lo1VEiXJ@f|=?^^#t4@<6F{}3`m!n07j@I^D#`ay#;3WF2Vhx`zRLvj9{^!Hi
zoRYHJdR*TuVUThrW`R2n+-JUr&m3%drryOym}TzlWmX{(JX!pFfF*1Grw>BWw`cK7
z>;U5wW3P?}>j&Fs&S;MZq3mQl-6%F<xj9ezOP`r~hWXSg=OV+E=dDNQM>2hjg<qoY
z6zCkLo)Qgu3i|I}KoV9!PJDQf7WLX5LpL%;XcclJ0Rcw@{?yC;`SX%KRFzEN!91~&
zLd>hK{q-@O202&R1J<kdDP~$~v$KGqC|%0%=}?7u1iXN3{NN-=LY4pZb5ZLRgb~8f
za;JrIr-JUUZXrURlF@2ACpxWq4SPB7clpG_(wfR!GzgL^Ir~)rjsZdz7y36!$Vu;b
zG3+DN4clo3Y9I9Y>y=iHQwt^8tZ!zyP+F;yRb-nOt8=5^oF-Z947^Jp8U3*<ESZ&%
z)Ic~MCQDXelcf+-HQMX+Xy!P4JJ4iqd*-Oxct7%>*Q#cVK5XcCalJZlSr&^s56s-(
zpL5F;p7zV@zGc?`MT$%ybw5%=<g=_NyizXV%9Jy5AXoDFJ}&1lJ^`h{_;M|1X>R{?
z*KcWNFKfTOGkS_F<#yJ-kl<|->4Xm!&b$lTX-H=#ve<PiUn%IgZ{oK%t-cQsv)(bm
zR$J4koS7{pCuu0z4Cn>8Dis@S1ts65`8H5%SrzqnUMNmACb&w_)qtGf6q|r8C=uKC
zmV5oExypRZe?PeL>0w*<cR1CT_|38*oac0E#!=2<4PsTLVGAR<UCM2?6nzAFHYT^^
z{&T%yPA_1Thje$}yu{r%AaVQ9=W>hf(ZjASG*$PV3SV`zgn|CREwOD2%?D@FI7D0x
zYjDG4my^+H(;8+cYbU1{x*jsd)82FUlRfSJneVfLk8YMVtj@8)8Do6G?yj1RW_)*j
zvX9TB@1WW}l!dh=ZjG+&r>r)@1Q>&Z8)cd|BKBe&Cf<6pgqc(fbnu@2=&&>s*Yo%e
z6-+$#d4g`$zeN!wl*7Wib#t<`?!tB`Pd)S((^P81#GhN2_m}OyY?rscrd=jU4Qt2F
zK||>hh{9Au?zK-$=={-Id^#B6)1kz59aQ->*S2*^yYjv~R*88v0)`R#Wo!?o@ZOK9
z`4~yb=$BE+_#z1pf0g7yVmcW0qZ!+hepOcoezuW!baX79Pe$C4DO8Lcjektz9EJNb
z$`b)EVA(zz$ZvEL3GebJd2xau^4#_+S==P6-(GE}CD)`!$OUlRoDeX|7x+UXEHqqe
zB&uf`$)IRZH9gA<X}2HDU-O+_G1JG$t%w~xSh+Gq8=;%lkbS7R{guY6NggBDB)H3T
zG;`G7<hK&|pPhZ>K4Q$Wl?yAe(mJm@OL7$JJXIYVR(dZ(yrPHLTjH_NDkEu8VfCg5
zp@L-9TD9w(USR%F2=(%5c!(G=8jjOOGY}p=JFymK%eHMM7Y^tcI?0<IVjHvAiXPsb
zyytQ4ww;-{QC0<I^jX^`0|RB*qo%*kJ^WnF#mbDe$rjn?-YgE~%wxeSP1QyZXBc$*
zY=0DabT-AV^K7}xV*T2N=RL<T)oZ@&^EnR}-m$u{siA0!)v2bciqailo1e+xFbn<r
z$fIi1ok;h(p_}|{mg3Fx*GJ9>dz?2#3f0)MpQmBz*aK5b2Om(UzDcMJCANE@nmEm2
zLoxO4&)%7(_;%fq;{45<Jc&nO{2EIq#tFd4y!YlNCJNVvM6AMHaiNsj<qTF>{%{6c
zB$y<uCMhKHr}F}|C!(2rxs~!+oeXnlqi((GGt09YSQtB)Ff;AV_Js)W;^n1naF;OF
zkOV<Dh-A}80@W--zx&IS;|@li^wr2ekiV6CfqQovEIFel6;1_3bb1K5J1Fbj{YyLt
zv(nS$DTHb}>cj5_%x|~?u~6_BZ+L8`=wL$lR`}!3S>DC(um};E<+C5BnT<gej#GP>
zEQOr5uqNRcmfm|Ql?}G0tc$;rCV6!_1wzsLW+I8#f7=gy&>8>hoLZ|m!tUpHC14x1
z{UeDNVjx|z=Gp0E8~p3hxEN~SZ;E75{7<i-g3kAUUJ~A>nB??-7FPg)u#+JsnK<~V
z!#3H8i<f8gR_~33R%sRyzk5s{TWggztZ(U~GqQMn)o4pV!6#p6f+kBkDQ956d*&zn
zMp2=GI0mi9H^Gm#^wv7?Ea82v^Yq)+$>PdGCs|w>5BKx3nr3q8LldsedYX|B?=#WW
zi-J_~i{Uc4xDp|5*;gYTi2?1#hT=n?eV%U`G|iR|ZyuiM`}C}L{PJTSFznS3&NfN)
zh-@L28?kkM`Ysb)9y>%-B7H+$M|BAvA!1!dU^a|aM@*}0K?{cTQv<i&9S<08ct-eG
zt_QM&jPq>oqhU-Be<}xP_ctHgTLBpm8k2QB`1w_yJfwG)l;<>QkFq=G#S2<`TmTrb
zcwZrAQlpY!q=rqJfpCmGCp8=`=zmbl=o0(?2RUR)pZ<L75ClQ59|2(=0PV<2qbAtw
z9)s09F?yIg^!*i4TWR4E$f#e|JzyccPg!0#zHi|;chC)ceK_W<Bk!R(?aoqmms-bc
zQ9xMz;hUd-#wYoOT8*l*2)5Q_e=FNAHjln!9#H3CC|!l@qI=p3iJK;OZN~O<7WUe|
zne)+R5|S;DW(9Zn=kX+v7u=z&@40rp5rUb$Vip2V>z8xA3{~vw?N!1MVS`*V;TNuw
z#Bv@N@_w1E0x`i!r*RV2{0B^ghdC_uWP#1kG_jZy;q9BmKmFmj<cZ~&Zwzg%{rkD7
zU_JH^1N%sl<oWhr#yC?yn3Ph|Tw<e(KUvBlz0vCv=ApJqTmSI&;HjnroY7g#&*t)d
z_M;Mk?t-?6Dg;ai4*5(%m1h<!zzOGssIT~(Bkjl|Bif}S->z2elyY23*WM}Q_-)e_
z@7Ayv$oA201uagX?Hu!hC<!HoJ`Z1XZM;MigUp5t(AR-UCh9u}I;Mu=XG7B;uciI4
z(>3qFDes#c3&i9=59uJ;W;Y;or7tXoZnRG2N_h*A|5HT4hK2^y6Y)Z70_`Bs>r0UU
zRH*m#^zb*<+Rr@Aq~0aydjd4@_a|#VS}gQqPy`lkd5pr@CskdmUG+Y5zJ96KHu%~g
zY$uCNj)6t=h@;Jo{q~vuw%24?&z+V-Yr#f!21!gXR@%A)>vq@y4f`c@fr<@A&r7ez
zyB`{Ex?QfwmfYLvAg<2bkG591%^CZFyIEd{IV|gZv(Y}Sf-<G))2I8AryjqfOONl=
ziAOQu`1tvET{q5cvB;udUG+&N&=iH?&X8c&tO7-q`Npw~qrd<${e0;(;}d}+|5g`Z
zV4q0iS`3*gv@nL`qo{z(%%gQ)(UEt7Wea=mOxwjMYW?|9ql>{l-oDLU<CQj(gR+L6
zU$QuZQaE?)ogwebvLlqBe{5!Rar;w{(R*&iItfByA|WN`#{uF}QjT_X77XTO|H-I;
zs3SQ=I4deY73oUyfddg##fB6-@^`)c!O7eGt)$Y^GY^CApq_cM1V{DgMgWZ;jS7x>
zI@gvp)YpH0#ijKU?!qDh>poDyA~{A$L7$wLVoRVD12|OJ&zC2Nqs|j;s0_EkKlZgZ
zGYmBBz~;_965LJnLA>v2l(I1NNDJHdd-wIjy|4CTIR+dhwKYlNjfPUxD-_d!huw$`
zVvpD$djHfH-mE?rdO$$@MF*qkhlp|Cqf{*GT-_xgF54unZEQ5w(A2y|77(CnpXc}F
z$=jY?s51c^*T@^a6;-->p8>~iynUv!4p(A*8}#g^(&EONk0EhTrFy2<GreB&0^j+c
z0%e~wG)?8nzG7UyWIJ>nst<hJgcdQ^IKU~zCW-IaJZWwmo4bdK@?bbB&6SI-h!ukI
zbZU=s&T}F{_MjDVKA~*G)Z*bMtA0xWP`E(=EX5S%=`?`J*>k~5gg1I0mQH!FtdHeJ
zk4us7Hh(18IOc@ry^3QE>2)Zasx88sojyd!<rUVDy^iu<Q<bR<RseHsvC=%TY!7IP
zoYrz)uVuTjzrXL~5ma;^{ZTTHDHP-wn7=X5i8&&lB#!(deJG#DI?4>kS;@w@yD3wb
z`EXBnsf8LWxj~v69XeMBrU+hWIr{p3pOXM|t_SMUtj(`3JKES1!&u-C?Uzy3!m#ZI
zzH<HH^LZq_RPnzFSIW<#(xD=ireFJRmTzY0d1`&XI^S|EV|l6mgML1mQvjRqeytSr
zZzwvZn2ej|YNqH5ENszXj4moHxW0M=F-A71k;H;@Dv6J$c83hEmZr>~*h%8AfK>>>
ztlMIO+5bxdKn$@Xz2pw}srSQ7{Y$d&G55nH-D62NlkNjk@43p`_I6hWidVR?QaL<?
z!tB4)b8H`M9Gf%8+m`A!LBP*#L<O+|DPbTGhR=I^M{CP8L*&Vlt3^az3A^P$d@dGI
zLu1C9)=ugy2Pr^mj_q?AyV!7+oMYR4B$0(`6dc8SblBvY#kfV;1erdK7{a^_CWc8r
z%w@8LotVGrD#egRBU5#jGKG*NL?-w$08-yHG&Dp60J$sf+Q%WPP7-dKt^F;RU{e^L
z!hvO5WK(@{H;&PC3xsk0AzE*7Ta68j@Im~*hdM;#pOj%}P{{C(g(JsT`b^=kf(K;q
zNP`!*Ru>f=J?l!Ku)ZVxG*>RTJ$`g0ZFE{If&ZZj#wD?Cbb(37-Wu$lMsl)#jO@}V
zi)=GJS%>?&rpio?nS8h|i(-t2`uBKt(OzkBmxTzXj}cM~#7*M^$qPTa!l7bXA1|I%
zC>SF{6j<e5pZlLyzBO%T18l*~l2}Le?KLuelJz_S!H?<&uZ9w^un0`9@JX|ycgX`6
zB8uPu)&ey(OVSrNEn?kQo<HPTD!x|6F!AwdZ&fW5X(z}Uf)1L{1n=If1EKAa?>xcV
z1Ic{eZ}Kp?H&gc^H}JV?K`&=F{WG*Y;k&n%+C!H_8|-u+8?GLYRy+{I-v4x0vj{Pv
zHD8`>1oWPL?<!+~mVPCl@Y4`0k!%s6gfAlSjiq3ezEv8_@yI9W1LqQw7LXfBolg^G
zOhc@|G$0hIuj71?W~Tq&VbU}#LQde4Cjo)sjzF>eeqr+*IjnoP&d9AgPph(ED6x{)
z^WkNA*UGa=_D9`tPIf^Rr&HiqO&&hv>3-ulRgscyL?QG~Oj)V??rYuHO@z0|x7DQD
z6CF%hgnNMZjDSN!fictk59sXzjYq=ZE(c3LEc@}|Uv;|3d-mHVfABY~&G{M6;1{7@
zaR>nx2FOGT6kSCWO%asTPdT~#lSm%k&q0ArDr?{CfS*qv8UGp0mJ*GWgEPwi?b*87
z5EkJd4c+r58H$A4GfN)#T1TsLBUbJZ3HDqnJUvTHwM_Qrrg?FdHta!>o|&1MIuObF
z;h7ne>c07znFs&QV&WaQJg9PQo_zQCtf+(%uU);ng;SE}fZ%=wuOwm}5)Rn=@$7=8
z!3_nOZ^ZP>{0D_X9si3)m&CBLyltiT>6=a*$bCC5dm9gF*#T{I(G|7|pVdBJdGeHg
zbv%VDIM$RVDhEdO;7>-A8OLELoSSNv?6KbYD+k+$&(X(3Q^@DGQgz|DHcoDk6NME~
zY$%{m7&7ahQ4>^7Cg$n9r=s#JK0ZE;P<^!!$cQ3TCfc&q2eTBwC}5^NX3cR3*{<I(
z4~F}EOFJ~c?>qKlTy4guc;||XLXb-B;ZTxfLi)|O(KN`C;^LcM9NtAnM)ty1Vz@Xi
z=_PaDY3PAh&dE|!h-shr*!IN1Q(L%Dk_C2!iBp?;7q%A4O-A7y8=AL4%2Z(EeQ|p5
z^6bjK4Z=8wryn&krP1d-PVk9Tmkc9moj&Atb@djptOq3aeR+9tem+Mga^GrqC{^%X
z>T~?UBikft6l9_!r;)^}<9AQlmk4|HDgH@{OE+LY{2we+(ssZrDG?!^YiqYi5xbcH
zBs6Bs)}EaBx}%Sb>1O13b1gAQ@QVHg0#OQoQ;j$8*vF=&rYNvC67+Gf2Bv+c#3>$!
z({zMSLy`J_6*4NbsULCkb=U9YQ<$ZoIeHx;%7*4HN|S5&6qg}?m%765;06aDFkidI
zW0MOgcf<VDco5uT9<%$n!Z#%Nz-gWlLGvukJ|tBXriNtW1K(bYzZsWmPHI?<5H~21
z$JJ0*uqnU95ZR1fpFh(fMt^O%B^-{yS>7tDcz~4_5Rr#OY~0nD7|{%@D9R{%s8blO
zHFKZdP>;&v?9j=vy!R+=tsobcN)f;qsjM!uHv55N0N>7-Zm6}zdwYg#a0tA9CMh(p
ztgK8#SU5De+=xmygh#v{Y-u5(=8ZNoS_TxnK-}+sb*Q9GrMwh)s6x!GHyua1sT&4a
zd`hnj-$lyL2hgx05E{0&woe=0?*$rjkT9{1A!P%Meb2aT6%71RsPPA}ffi-pfDtt7
zDY0YoZ)YaR<TMXOO?-k9B5^q@w~q07_n9m0Gm=kh(t|*IKh2x)-Mp-L8FTF*tX&!o
zz|YZkGYgCUp}TA4Nrc178KQpQpSrmGQho@wEq~%2nS2>h#6~=jh$9h8!BNwHXFrec
z6fMTY##X;PI2c=JTA*j!KCt0qF(XK88=Kt;5;kI-RUtQemv!!<5qhEWW%04hdY(<!
zwN;$r_wVJ?AOws*IU4?*qgHh20Od4nugi6geQ=k7yj1p&9{t9p3R)V*#l?w9rG^s0
z<pnb>!d3By_$$mJ8$`A!S6NgB$P$6Kg*ICXc8N**w@C;8Tb72O#`0|3-F&!9_m3a{
z4LW6r&PZ;0$jZuEV3qSV^fCC#cyo!=2zWFFiG;e;inAPIKMx!AfQ2=f`?M>-Hw$N!
z1*Nq0Gwb-W02(zB4^0}s9vvO!jI_B=K)Ofio<daRd8t2K7;gt~qB^9ut*xBV4*X`c
z!e#uX1D*xM9-ynr8NK<3!@scpTT<I+M+!>`pV%YH1;z=nrluwbT;lWRUmmxxB9SWg
zFQ54NG5=Zfv8)xbN*j=p>mP>i2IB<~Z<AD%Jl39tA!w{-f#bM8@<j{|Ek+pS1E<p+
zA~h2tRrX!YZEuf3aPW6s3X99_9}`h5J^lUne0ACbPCiiRgP#e69voZv!?tf~qj#29
zhf?o@zHfDoQ%_^;NxPE5b7;sy;QB9mUgI^yuXu`~{f(^$5iFvuLNUu6+rs&?5l-N1
zKTsg+zq2IY?7LqQKQ=ZtwXx%~KAPQ_@gSWYAB{wU>z!6Rv+<t6jI#Qhd$bBM;bm!*
zeCgVBGS++~)2FA+Da9vtO*v_4Z`_tjN979=HpT$J{-Oqg%~7%q^Y3x&rIt&jWvQTN
zAMTN7HVhNaIv?pn5;0elx=uMplT+Ei0cj4pXpT_9i@+JNO~#zptAv*px-kXwmjFST
zcPIuHPaQ!pUcQIFuSwpVxu7P1|4dlwk7p5MWo3OoQH`;-=9q8xq;$$wB{5vbctpHc
zh$5%tyiW#pvH*WQ#d=-;A-zJ(g0<Bb%b<6&4KA~B+rX9lDlab&Ei2>sF{}wx(C%8R
zexY#5X6-FttpA2Z9a}K(Co-S2@u1n2Tv|WfeQqyD5uHHsEEuoJM`M`so<jaj)Spz8
zL}!`wC5`+w-H;|qZ4(od4-8hW5YRTO8P`dI$i+Khg_uC?ci?M4Id6EVDZ-w%l8udw
zcm~ky(ij8ZE!cZf+&uF?=lAbZ_<t~8I*Si~etjqUIoP}-2mxFFIy1xEC+#W<itrk7
zR%A!+wULHWU+8eaLQGRi;PE6JtE2$U^*{Pkw@etZi+3%hTDdbQ){t@DcN1qVqk_|J
zIB<S<BR>Dax3dP%_>feXgBoEcVQTc+G8svBQzsCUkRWGdXUWaY9T<8_3$a@YTQK~G
zDb6^6#Nyw8!Kb>IUm)ZdDuAXz%D!LP+5i2$<|hDZ2VcG<j{w6A23I_>we8UjS?)W<
zla%08zoY-xv;utn>f4^U$>&lK>)Ju56lLPxLrsq-#CPxB6~*Uy$=ci7zffd`p}#fh
z03;RxpHF&jg7==F7udCm`9JmQ_7qidjDp`LCnvvRu{KlRID@;cf>nWouH-hx6Iejf
zJ0ql23HmX$-n!%NU^X7innqG)0muh}lOB(5dM$wE0-ua|rP^m9yxqF5Ibgbdadss2
zh?Rw<hD}&eQISUyn%@ANPRwNDXDCQbqX6y#{O?i-g-VM+m4gkN;jT1qi3)zVylkDB
z;81S(PM=$bByATAM>I?rnek8sEf_gsbVJBF5=fdp_({<$>;@xGq5}q^Y25k_)$WsF
z)*MKU#wq*tLW(oRT?_%*uNo>3r_?4P7++g^qyc4LoBhA{LjG^HAn%O`TfeonrR$(X
zA(Wu_rKYv@Y2k_9b&~11IoAFcr|&Al541d}@L-9P4v0enCGu15EOdDPCJ+%2i!UlC
zt%A1xEu8#d^ESbGIoQ~6)|r&oe)yp4^7QFav1Hw>Q>F?&6u^ij5hcN~Z?t_u#iGJr
z=tW8FB*hHR1P`rKhE|R=&m_;9yy@EBo*V7qTzg;(8xpBiQ&Uq`u%%`3O)vC5ph@61
zjQ?B1b#VL^;nO|LVvQ$}Oy3&UNQt3&Kgu+X3=KbTY`kf+8esj7k2+&&LjSkZ|C8hk
zB2IQMEFHF%U^lT8!iz<c`R$!KW+GU+Rt6Hw!_sGEzrT5?8+`v9EU<v(r4A*BCaXo4
z!O&ZHH?a)<NPWL&r>9q22kD5tGkcyGA75NoS4RwGFCx4Ce@`Ra1D;yJnFMSXzEhxE
zVD-JsA79@Yeb0F)<M;QCiMcs{SPqniO&^3LwSq4=p9TcXl@wCf&UCdG!tsqfW8T;)
zknI|xS4D#S9+u2Ir}{cz(j(yZ*ZfbEDXOHr|0F*<+FsmFBZr|u#ARp!gr*7D?Ljz5
z$0y=u7mPsN)?dIs{6bMP2P+cB1U36aI|~l8)}d+sLpx^W-ZO7?4UL=L;^Ik{zvjIc
z>oAFNX~wGmVzuV{*PzYX3v`zz!#Vq7oTSW${Dc7^0s3#H=yte$oQ?Moqm|pQZ{-QN
zWe9OpR8&T{eA^AsqWhY>ye|lL^3cUVQzqp8w%pd_^|*P&VD(M5sku4U_<mb$?SD?G
zt`NV|zh&`-E7xb_Y^9a63xUJ`9cdyT36CBT2!-*Msn6~=J6vPG75l5ZG_zBc4D+_E
zwKR?=w0T5GLgL|Im`Wns!?CoHkr6*fM_yo>P^Ne(Mp5X0``;UPyu;SIo$RfietN~V
z8r*x=d9Kkq8{zK%C=e*@=Wi#+yDLAJd!oPfKl2%68_5HQq$DrO4e$zWBucw<V4M5Y
z_h{bx-PD`fATB;jo#UPZC<pDW2gEmec_ObiOlVLUHbQ)>(+QtCIPmZb3c3qtB6&J1
zEZQ=FJZJH{5j_DC*K<!3fBH(eB#3I3&0Aihis_F)x+YIgC0Rr0^!(buY4wV&t*`&u
z-Nj@sJg>$teO{aQ4IEpAwySlH4Os|0nrALRW-g~#mHL6%V}7O%QJX<kIjx$_!P<Xq
z701Fe0r;VR&F}L~2i8e(gnuJmQl8Ga)l$5_WG4g|w`^vszD?f}P#Ow?nRr+ZtZdBP
zurMePPqZB#_)f^(cz>nznj|E@hI58@@|`+`0|qmp8)Dw<QI?aQZarL>t|M=VkKmiZ
zWh5Lc^acwDU5Yhzgd-nA3E5(O+{PDfS4jw2BEA@Btf%+80kIV4pe;G^I}X<1cwrRA
zL#%6O9HU2U8MR4xb?_B4A-g1mgJc@m*|#7+1lWg{Ai#HQ)nEV6I~cLG<%EZ&n0wmV
z7G#)dZdJU|{mXb!A3He=)Q8`Ka97K@rq<iA)^hD|SVUAb<?7X|LYaM<U?b@zrTeMK
z9wQCr6v4iWf1$V?u^}Z)TOJpLs%5@Sf)=<Gme;EMwbm*?__hj`;O>u+`vEAZ%^M|<
zBFJMeuX^bnppEZSU%&o&zGt?cYVZHh!qQT3vF8y8=!gC}nk7(~4gP@9lkng{>LsCk
zM8r85L(<mfgkas3x9^*K<Pe{wdhqp0-Gj5$;bHZ_v%@VqM{Co^!_9cSBLWCtc)@ns
z-*W@IFQ4~|j4IH#7Cv2>qS*A)E*t5|x&8jl^cp0%`vXX5M4pc-D>D#$ZJ#G#yndfr
zu$Slh2Gz;=l<TGZH4IR`CytKq!icnk9Pses0Gur}iI7i#3;5~Zd7Ys^iX^->HJ;){
zutQ#kZA(HS>nb~QVm9480oiU`eX!-apItnI6>Yzq+w7xRse6WQ1i-jYP}hY~aGa9z
zX1|Hy++r-jYzWARDTT0gBh^cfp*)>_bHnYcuce3$)TN>vz&Eg8=!fY2mv#%Nj&fI5
z?P|tISXfvNb=&Id`d0N(z#Cp80F%6ddy9U?`adUkol6TdgSJ;D+)a>z6o36{5LXU(
zU;{zR_F6G~*y9yZLgcrVU8$zBfp?=K+DA7ylonmr5%dc}2SyP*9ZO3@v~b4E^z{2}
zg!VMVJ6*s*O*sn4y(hL+-A&YZ;|LyyvOA^}nD2kUj85j#%9Z8c*HBl#5fj2D<EKwU
zLz5XV@Vd+1-``a56A-niM$klezy&X7^d#K>j`ezIIcn>Nu}aD;UwIG3j1(6a*9ZaG
z;;OOgK<i`Na}4NT2mHcMLY{~XE_fbSLtZV8<1~K<`iB)bsw)vv5~?)IiA|nA(CS~~
zh~Vp8=S-)2r20F@5dDaE^RY-Cut4Pqvnf%%kmX$P%Baw-j9?EBhBgPu!O+JIym*9I
z_*WX(5Cs8SaDctb>|jAo=r8qcZRVF9K^K0%KR(5qQ4?ch)l>oVpYXG)715+KJQQrx
zrhEf0aB1A&(jit-VJlh<`$dEB=bj6VTph_2e+TH~eBCp|-$7Y2;=^jHDDBRkEuw;g
z)}UFG657{qtE}@uq_F^6A&YH8Y;EiSGD*4S2C<xivw*}j0}xXkjstI(B4P!qEDnG^
zz5-9IiT0zR<bY9<aN+l^hrrV(=IQK~7adk4gux1gVimd4zAq~PoVkDVvAm9!^W=MX
zsv^FX?+nssQ<_wyPKE!HCO4v*xyU(A33+oMFzI8Y{0WG4bVt$0D+GS-yP-+Y2VQHn
zGBM{Lj^qUt&(vaKY$$|@FFA-CL3nxwaL1LS;-*A^xzs+oXaDREr=B%S(9+a2p%7|}
zj(`4q+T+Jp%}X1E|12=Fs0(n5Nro~0AMjyiquYy{y!Z6guv7ZM>8YQIsi|UVe{F4T
za!E-EA1QXxRO*(bjQ`y?VfcXTP#GXirA4$5TLFu)j!n!L%axTCQC2?`4Y53YtGAC$
z+D99Jo*X4KkUB(KPEM3#(g=+_yjSTB*+6GUT<~BJIfo|l?AfVX6XAqa8vt2~hcTf(
zj~yL{{JwLOfE$4<er+!OBw+lQRIRvyP_nX}W?w0dpS$(YyveQjTuxd#3%IjTFrkWh
z6B5y=l2H8RV@0QNG%)2DI35+9l9&e%`+wGRy}~~FDaC;Pw+}@n0SfnnVheq#58_{A
zIaeYB(XjmWPElHT@{THWEybGb`7jCDsN8!7Tae$ZOGu8P$V-dfB<=eB`{{^Cc+Tzd
zwQERZrJ<prwyXgFu!n)F1SNOm0q|p@U;}Bf@x77%#MEuMJMu=a15q}8X5L-VD1Zd*
znD5-SlC(i^^y^4U-omR*D2SM1g5bQ_<fC#-(fl`iQE!U654dnHlN?L(H(!@^SUINi
zwz9}Pwf_NvC?eJMa3=*~VsZ8&q85)$-H`*LH&|h%KBfevX+a4Ba*UtVsADt4w@J?u
zgfTMz{kFC=GZQ(=1)k+}qEJO_ac!-Hf2r;1f9XK0?5Rj-03f>8tpFB+b?tI-a$dZz
zkacSuw29@>a~^u1MEIQDu)C4mh7FTGKJnd(>pu7(XMxEpI5u$QlfBvqeK)cZGfqPG
zM-IN(Sq)7w3fjpoy=2}HB>|NXX^a)}4qSn0<>EzGYTQN)cGn0aJgnMt0UY16-oD!Y
zquY15<HIKC{qddy4)U~a4}l?fMe*^7?B#FY41w{*i0SO0$tGNG@G*exgfWt_kwT%b
z;HB|^eC6=6;psFqG8+1OzF=}UC~TUd)L+G3vXFNgzp1=WP8byahQn4Rl*EraFQB;V
zqKxQf0WvR0g!D0=pkOK3kDnkl;Ov4;?9TH}Ic0R35*LSL5c)CkBYS(P!)R52Z8k&4
z?)C=3*}9#m0GgD)wo+m3lU}hO=h??#1u~QVIY5OjBH&MSP6hEhxYGo<W;!f`b$o^^
zghK!K-!xn9D@y2?cb!|TlgvDww~KM$t*ZZF^;5!>b&uK5Ga56WJnatO{WZv?N^=F^
zw>X#b&uG@hR-ms{;1KKMon=MRzwf|}(5xGrU;^{l*}0<GeI2Gtm@dT5hwph5`!WbV
zCOOC|je`@exs_U&nbo=xI&=cl9%1uVcbf?;?4L}Mu=XVr;^$GI0)8}dX;MBeRhL4%
zozSUn2W)^w2WBOz?xCip=4)R-8O0K5|Nem=YVkW7FP-h$TUIOHf99%bQ4nEKBUt~e
zw+GhP!XoNy3|%pu!M<@6w0-o=|NCfa$NB1J>u?C~oQ9H;lzNDVmBg{-MBv9rbiK<s
zw}CE@&nI2(iHx=(ZUlnEz*IQc+1-p!NO*mcMEDzE)6M@6S197mN{6<PE`Ght?9B$Z
zEiue!KH`cW&t0r$PER!-6Bpza7Z(G-W3U!Y1fP+X`K6%pR1sKeJfF^t7f?kE_2lmG
z=;#dDmrYmfNBP%&*4Fu9o;OR@A3Tk$wLGzHa?;TW1UOO*R3v_kHWhA5EG4LM+Evqk
z{^Bax3dcbzn1qSCNjz)X3Yl_+#4h?LG8bL@alU#6u<QR!lg`drezFWuUv~L?yuI--
zYxdv)#-dE+-o2l!`&D9^0NRa)GFZh_=Z(-4=CLZ4+2S5aWP?_a8&UuCe*DEHWr7s&
zlH^yuoE>ei+zt6+c|1B9^c^+nBM(U)fbOjy(adPWek49mNXT%6hn+U<naW?GVZReb
z1h0P<yE`|RRfgqIE!fwB69Q8z#4SGeb?9<Ht*RyAJC24;x{ATd*Mu6%F7RrIlqDLV
zE#RQy@Q*&CG$Yf0jR)B((LvsQ4*8o862#P+Qw#S+qGH@TH>Ddq|4=;U{)E3iyhwtm
zlI^zVf4#x5k>v#-+{;*KO_r2*MPWf~h_wC|h`0>gWzK|!g?HQ1XoeJslf%!_9t~+|
zX_?M|svz1TNZbj=K;kO)N6!Mk2a-r#hG`Hnz51;wfEx#b;Ub{V-veABx_IgX)v_Uu
zCfg1AKb?9U3Q=|F>~&ZM;(^$GSyv}|X=%d)yh*uRR^Kho{!rMoFnu^4w^M(84JbMy
z0VzD-K0-pcU@@4I(o+5lMz<*eK|#Gx+a3@nU0EIj(2&Lh((JQ~6^hdDy`I7}8RD5f
z|D<~w_!-`^;0V-}s^J(I+Fa-b`+WDFnun-}$bXjL7S!Nhu->o3ECh%%Wd~KDA2Ee0
z9Ua(YZObONK4#Hn!}j*}1Rs_A1W}r!fMY;VvbWPpN#aM9`Q!PV0wnset?y%(`DTM2
zPkW%rQS{LFw}pv%<;Z#y6BAb~jZHpZ415me$jjxe4|W}o60m4JmLHC@y8QX`twv!F
zROueZq7kn1oS0Ud-=P&=N{E6?ki;a4=6VvUQ~`DHv$D#&_x;rnOJ+M@M&B*HeF>I$
zSFOSbcp4x2C0SPx?)~Fp3YGCea20^*PA?yqw&E>7I1wDnR&MAxb~wlmd3%AUB7Q62
z)lg1|LrXtjF@Ollz5{LxV9{)i7)T?o*RwU?#O*o)?ff6&o-$Kcz*}s!^N;@QtSr70
z%znKStIZ8EB6fARQaH(ZBx*U2%9WAbe?qw_+&(ZMAgjWXoA-$~qQ=h6*LKmo#f!h#
zNbsYd4(R89mx>tufP)>ZH%Zg*pLix_N%uKG6vT=kLtDw;#3cUb@m~P%`*ZH~L-86!
zZ$e@hb@o;v(0!0nzXdEmiJ`PReBs{O+M3r$4ZtpJfaR|y%;c?C{iJuh47{Zb0uB3Y
z3_}_^yB9YO{`%qVSvBy!il)iUOrB|JXqp|U63JJX80-adFclzD=@mm5pMXGyBGVv#
z#M#rQ;{Y;oL{y!=GXp5z1>`a?f~^LnV=y{w>|_YwP^xMBrIHA#oYI*(f^k95?AUv{
zq_$gaaWyi@uuc3zmGFCODGz6h{R=2kTh<EMuV20}u=?$IVtyN&n%2zKCzO44cMaOj
zI{=pofBg3Yu1to=Uy~CPi~3??06R1tIa(XZtVaSe@5&(&w_F9hl(Kb0;Y)O4OXBza
z#C5hYxj_OH1XNR`>?s6XoO-epR6q9jm%`Hnv)nO)5kBSu=FK;bfXad4UW8Egi>q<;
zn!r*Z7w?;nD-XY#m6!zaIq#U8c8!b(&k)`Y1ZsD?fko%FjLx@smn)nu_-`Ai_S}_`
zp=N}s^$~%AJCeh;l#W9O2M2?oBY)H9Sv88P?LN3Bo0X?$N&)9A0V*iOw844HL~PoY
z0$8g6jtXX)17O26{<*;3=v^r?(&(tD2j4NE6yhKW<c3>!5d~PZ`n&*Mo$-exK4@$W
zWdAtg^yz*KeQXo1QLm{^r=W2E_!#x!hQ0@c&{YaI9xdAo8@);?&v)<N1?!>09S5MY
zQNlhk!9o#4a5FLXZVB%{ti5t;qv86}7-5)$%ZXISz7#OE-<Fn^j(&KWvLktV!L8%}
zqw1^UqU^S|hi(`oB?k;r5RvXsP*e~RP{~0=ly0OEWCTQ1N=cDYLQo{7yHljQL%Jm9
zTf=kCbKdVCf2afOd*5rXxUOrhJ%I>lwkPtqLHY_@iM1ElN7N^Ra0*=e2Xn;f<Bt?t
zR1?qzj`JqyBOI5e(2Qw>Lckj1IRtMxz<*yEWAtXq7Z)956=TD^-_>248~pK9Tvg4o
zULAqvXO{Q+oB!$g8Esz?#+se3e@Z;6YouK?S;~I_-yB3L?X9n`Q>RkZN)awpphlI5
zevSBq+Imj0E|pm=>-lW!RghR#PF~KKlxx#Rk7IXMhQxLW@KJj8nc9N2WDOog5toQ3
zRr<%}J@;~x*H*!3W;{|5tnBRB6UWalSwPi%rU6H!eWx-6Tb@LnWyWP&VI+?y11X>Z
zAQCvi`$OlXWy~-;?ZX8xsXN7w`m!H5mp53mS;PI$V``5-L9eC)q(cFZaXbq|-c%|6
zM5jTeRQej=S>Hy1nxt46#ZlY*`GH|t#qRF$=+)8@`HNKjy}i8`167c8rt$8@r#jUJ
zMN&ASkjgCL>=(umP6Of9)X>7#vpMm6RJbY8XSyDgX)OudYrtYf`8hJ{;l<7aLW|on
z1krXNl7uTS3AfKb!zscgKPTOMD-zl8n)5*=+S&PsCw9DwfbP)b5VogpfW<%Q&^G(H
z4W5%)`NtVBX_LRg<i6l81WA21XK!k>5V>+p=bG~;*z828xAcS{9zT2b_rS4EGW+Y-
zbev)kUy=Pay_ve$3-U|dua!s<T2e1$XxW3oELc}3w6*^#krB>`M9A17syAu4k|+pn
zp52@8IupxePSX5gSY3w?SJ{vzSC-@UoBm|KnE*ZDVaUIh?1+BO-*7AI0^NE<<MOf~
z`a)mvfC4mi18%AbIyYQeYfr_WV)E!wnu;C48*2QGPoF+9R;o#J2(}m$K6vn80rd7`
z(k2fUChI~}><}z0EZ?sGdBrMmN}wU(NtRh@2HV`xC%H%3Gy0f!uPUY;ev;C3ojEU-
z;DeZ$Xlztheh&e};~3O)=SX2?U4H%tP(}kN;IHZr8&)f#Dx^4>A|fgIm|D>j3+T9$
zQ+uy~fPk2^Hi1(X@oP?ng0R<8v)bS3z^b6N<I8EN!TgA(b~Al%-MFD+hiDdl$mm4F
z7=6x}$v`SW!RMG{0pT#y&*qCTltc0Q7xC(a3rPCNdhE3Jk*OgS{d@t~hl+u`DsARM
z!tVR`@5wu`#g22$6ry)%E<vI3f_wuAmdD&oC?FehdxGJ&a)q62=PS0v3;<Gw#ndO_
z<Fcz9O--xPVBq%edAnD8_27<sy3T(IYln}Q;KK8ySB;6Rf$w+$!4+w@zgw1{eW|Ib
z`ylf}G1KrQ-YA2RTEiA&Ec@6)Dp!FGtLAN>>jFr~(-Z_wV-j?RmPk>%iNd}F!;O*z
zL{H!II66AI4G%M;Ls({wOBP58!SmB9Y29we$8F^L71+qLez#hiuE;-hbL;=c=5}Ci
zSwp$b@K6#{of!Ypa8L#y1kzt%R!2$6xx~5=%-l#H;B{Hk=^8+Za+8Nz_twJnlpKF1
z;Ozt;G5ae|`SeEUnQR*V2E-p_r^6(I@Kuc~c*wf|zrPEiIDXRMZkS*x?d=CR#GouB
z;0(>|g3le)gzI5JJ7<22UhoAEi>OkSQaibVl@-JN^WA48kN?$l)u&%ohtA12rue#%
zrx}+xk*PQp{dwG>bC3p4b|eWb@T8aas%l>g)@~TD&}KxLpM#<nFo*LP$MIUYPUHGw
z&Y^>@XiUYAA9u0stB37JG(LMZ2R62Lc55E;o9{a)v6I5blPrXa1{}9I;eHM={>I!!
z&`gVPb?@yJ-HqYWcEAhgZ&Z%6)0%Z#tiqH1y~p{-3`Ttz5iunJtJ7C3n|le<$+ryd
zRsD1Z;w!8x2i5<2jOGyXh<0&anrU8K_+ayiY2SrX`Wj}6dhjfOG1_Q)(1qR&i_Vt|
zdlNo^Dzv`OY7u6e57Gb(b^CeZWPM%;nn;f%T}sG?GW^NZ(B!$0th=^?79mg6F()M~
zEX+j`ajvkeHF9vfmjIrgWpWP)#JIpGSqc@?R7IOXcxp&ZJl*|*mICk*EOf^cGfcMS
zcKg*Wc5$Zm_Ov}uNNK9->xn&jD5s;BaW2hCMGg~)L@24I;EG1B+9rgv8<}gJJ;^=F
zVZ4luEK*A^FS!}Fmr@8o+&|s<bTbhc7-sT7rFp^yduC@l;Is00zEI&XB>Zzi-#(*?
z{5GliGjP@R$hWtf&N{c&(Tr(#eXww|+AA;zA&&gA*FJ|+oUAM?mw32z!rp~E(^8t1
z1uY@_zSH|-ff5Etiq5+YYzqnRV1dBP1Vn1%P*_lKxjCImTtcFa=*DL@SokstKGq?a
zZgQEM>%<*z`0lAWyV(z077pDl*IdGd6Pfc%aiMQe@02AvcTP{Th;#Gcqy!_lDx-@D
z8IWE{Os!})`Vw^%-C+^g4YvKn&8_GK0WxhS$x}I%DG^XRucf4wnf-DSm3}j{yQC-7
z^m<t+xbsO5HvjrCCqQle9rL<Cg5>ok;I|I@7`W+kWup>~42b(>yW9n%nbfhVOlI&~
z<v#W*D90IY9pch-9y(HAA%mju0LgX`ZRmkBO?`FBItpW-bacv|-X+8P?-rl5?4W1y
z%6IB})Qgfh&&~a$4RR7&{Vr9MJk67o35ZVk>v0yKFXaHfTqQLhK=aoOy0KxwtDx|~
zjwe~qG8M0`>&Q30j)ffd3q*IrO&H;Q<fkluL$?l`@@u&sbv$A`WPo>Wjo0Cxy?dW!
zw8kEHe9P&Bu@x5_s+iM=r;7Pb*6rOSrwDOZvY3}4M)FTm4q26y^cA}Nd)#5Pb1foN
zA+dJSgG%cOi|zBl_VBs+;3rB@twK`*sh`_y$`#Zxgo<C!Nob@WsU{3TTysQ_zq`2&
zD+PXhl|4Vt;My_s@N=!Mwx#P5Hp9GQRaf5)1t=%jsP;=R@ioC3=qM9B3V(_*p=5{N
z96DIl)YV;)d_LeNr1w@>%dqU(ud9HFlG-EGiDoNUA-6~P2R@s{J-|Dv!B8N|-Xa@l
zYp-r3d2dXU#WjoAyo$@r%<L<EhDKK(8v~dNFY{Yi-#AF#?3BJ59Ddq+0pBb4=EP1)
z?n=+i&Go=Zews4r#~aim!ojeJB%f)vL5~jEdM!PGY|bc$*T>fT&GV4(qeOwm1z?2K
z#dJTOT3PVv1~TFvF*ly(owUjdNakFz-yC@0;%H6*3rO2_i@We1!xbCFEM>g7Vx4TO
zz14XTtZ8ICk}+O`UK0{iu3PfOhU&>i_JXI`*lLp;NKmzpHR=f;N-8oEIoXuEZ$7$5
z%$@_cJmpcjBKWJhz`Rc65t#By6Hli}-@O-~3!{Krftf~u`vNJ5&3tm_oaOuXIY^(M
zT%k;oh9JOBCmz0|p`oIJa002hPB_o`^R3%wN~mw2)9g(WsBI!K4=lw-(3|YvQE?+B
zNx~_8kgT%~AE*4(?!7xCy7!qKPUIGO?II~RELiwD6F2-lPAKLPc)wbpoUT7el|h__
z1S0g44)|Pijz<!Rgb_r{11+4>DM^Z=!sYuLY<_!?w*R_8@M0ZES|>^S%8w+;>?sJ3
z!@WGBDOw#a>^$eur){>M5FKNEre7bvSp}Ap0aR?$(<yh~z9%M)d^p`ySHACk9q(){
zS$&;CD_+zvUgL(TikllQ;Ud6%JFl6^MF?<nrntEH8rsk(95N7`^>k6(ID@kH1!hl@
z(4feU3+Ia`o$&C&hh^(TY6s6tNJzY4=i+L?8<Od&I^8}CN2kB|{Q#9qtB-azGvL6$
z0We*K$5;zaFSbAH`nxgmPLaJ%Zl)*1`1^ojUCaPU=jZS+k{>#fdnWUimE(kj2Q7=Z
zEUKAd<nvL%`{<)%{VsM^*38^jAjiu*t3v2&sB-SK|5;a_x6(!!x?9mq!+*g@36OYg
zt*tr<&vKvbZ=@Fc|G0mFl<19jr#!;F0P>Km6Lpgu0o*REiKAY;HNoR>5)#i);#j>n
zqw$TPf+c|Zc(}p{0APgQZRev*7_ieGTK2elK(;}AQ6pL?Qj*w=mBS~`V=(%57LM2>
zSuE!bn5W2iTvB=~*s_we+d(OYKq3qf&S%i|B&0YCDsseh@%yDiWfv2cT<}3Y%q?a^
z`HeRW9mcN4wrVNqjvHg>$Xi%7=Sb|0i3;=R6MQfT5m2#R4ev90ac>my^Wj{ybr}jy
zg4+dN{I_)B$aI2UvPc$HobNeOeE2b<d{WY{{Uu^D@i6RV!7a)64|txmZ*DF0boUL|
zAugRghVuec+I^tXt}qBB((?Ab!I8zEZ+tQ#`AlCVD=6GFIXU^e2M=EG#6h0yGt+l3
zU%q4+a$g(w%TA1(9vHZHz;Q62jK@_=MuacFI)ffDxVUnBbnq))#&ul!(G;&M>afaH
zot9L~C^v3B+KPb~%-4t&M}4uY<75lUaqOL*0n$Ia{a#KXhIww&TuGk?{k-1C@0YZF
z@7}<R8j_S@^Hnx5OV>-0mcpHR|NDZ0NH4!hP95djr`!D8GJa=5?)eudy#XzZoS2w7
zUu6+x#EJpiPL$qPqYDeg<;UA!v7<^utu2(;!LLVyyVNu^(azN?1d-DV3zoWX>9p}v
z**#jpjofu2r2+BH?b)+Mcry+SszG41eSLi{Wk}fQ?YFR7>sPf1Q;cer<7C&`$(a!U
z=%Bs_Eg~jkv`9#jV)Bw8x~P_(*Y-7as9Pq+SXUCow+uy}v=np^kwGQr<+tcaJT*}y
zs-R%Zp9F_nT!lKSKc6jBxaCsA1-(Fp#Dn3v<D?NATejSRtvpKp5(7@cs~Kl&jtH<S
zz5!fuN?O;-J$7x*L0)}}iGFtkv?pfLszJ=$D=7bbgxu4Df`S-)LELe)CBLFLU&a?8
zd3wB<or6Pn6(_ozq&&l<Xiu2|I)EoDQOHy%onm8n3QcwAJ26(|<4{AI`}G&Qf4xBo
zuZr-W*v}H#o}8mZE|l?W0#R!TMFq3%C+!d#{$lkOxNSJ5a6ie{XJ>ifh(J6fLVk>9
zU5mP0$GxmzB<6{gxA$n89InJw=HO1k#r?}fo^E)LJ}9Ih&J+*xO}*xj>yFI>Z=k{@
zF+8XSWulbN@z1zYFbz^uMMO$|`K0x!9#^HLTW}}kRHKbA_3OvGst0pWCfr&5K@AV&
zpYclt@)OjkX`ray)g=R|Y#gj4D43p}E}*aXcX=CXEMlM}1axh_8dn&VVlw>qNQ6xR
zt32uhwIFursK8^PJN32wfqT5TwS&XAWkzkh+eqL1hdB{nXMlNcs!JS0zYd8uj*?Qx
zi)x{cr71J##rIcV1LmfH)IVQ8h>aDNyG3!BR(YGSLTtqa(3~(Dx7C`1)J1RD#Q=;V
zJtZx2FnJ*AENJZYHs+Ool$RT!Su3Y_A0K4R&CW{Nu*Y^$-(MjV?;W@e&O`64Eu-?*
zJMD#lwOLUAG1N&EcRyk1d-;+~qbJbPt;)aboF4@ee>3ZFw({sV&7g_*?SnNKSm9%T
z_RGkFY~4r#;a^)@`A0NLh$L-!q9ATaR0%s|<=w_sW*6(`5@)E`d?C(X48{s{e9!&{
z$qKNAtEQI+lZ7%9YL(e&#{Y^+OY`GYdk}8?pUHIBO?{I7>86qN?(&e7h9}WIhRT(p
z!UbX-5vmxRz$>7i=GS8!&g<t^vY4byu9vtcHY^zx9c?|hxVY%Ol;`d}qvt(ioX)Y=
zlz7;*Iw#FX2r5B-@%ISb_jU;U?OWE+TXO5N6XKf>P(2#%HFF$)6pGi0<sS1Bddtov
zrLw5nxd0b#+X5^4OWi|ug6RXYH{V55c+Zo*_2f=ArKCSXA{CPSs9U@3FOxobIoR3d
zUS%^kHN}h1lJRFoB1Cek+TWaDB1s=Yfq-^P{eGwb%Gnw(lBzviwbE!9vSpy&L%_TB
zvf1S@_W5Q(iShA_v5^nxbS9OCj%s}NXkrn(Bzqy(<!u}IE8I)%xW1GuXF5!i+xveU
z4;L;2M&`5Dtch#|+tB3*0uc6#w@0Hr$1fB2(iuR(U|N+>OUkWIdbYL;uYnUdit3so
z+%DHHDT-9E`PB}g!2#blFjz(seKgyIA%)ToH_uRaV=}>xkT0HG1m1_%(0RTdukaQ4
zy|CcN)ZIAR41!7<iv?>hW&2d%5`gj*@zf@dAJ10^Q_PKfQ|}Fh$-1p2wTeneSg1(S
z*&CnOb*-_D0Mo{~>GJw5&`G+aum>E_)a&W#$rxd{E>V_Qfl*^r&XD_Ej6f-2j-T&J
zla?;*eVRMDJ$;p=cVdAwz-a@d{_0?=fcQk1p;EIQp#0&|^$+WL_wJn?;tOa!#)8Bq
zS)}^>!#WrS6}uRN|9+L007u?WapDaLesqAA{Qebs8@6Kf{c>E%egt$=*mX<qmy2Jt
zE$rld7NN!9fW&%txY&_1jA0ZGK~7IvF{?U}z2Xfza4GKz3q=l|JMbvXiMRjkZ%V{M
z>K@!Oy>a%l1y0;wi1(Zn$)iOXfPIq&bjh=EcV!ecyV}|fXjb%!ex<R83qu(1=h7sq
ziXc(ZUG<%3cBXa~WLOPK6DY3W`SavEE+vT^k`}oy(e1Oq0o6qw&l79FvtK<)@3U-Y
zLk=nu24FcAybY?{Ns6B?H0FK#hHk0UW>9jMBub6nG6p3qOYUN(@zJ8fL2=?iaVd$F
z>s}&u)8}|XVV&o=R$_g%wl?6N`RvO3d0xGwA@wUzxLGimSL&F5;ia(OSThomzkly|
z=`b(ov~ZoejHH}gJRmeiA6uJVUA`;ixM;xGyW%p0ud06xubv+P55y)#PjF@Jp!dlS
zE4GT;dp>q{o!*-f&lKat?68|&R2@VKc(N3p=eMXqiG$mt0EOFjp?|O2cnD2_Hr2>(
zo#wB$URm!`+6PVcjG1hoj_Bf97lIR92Cx1)@lYfu9RACfZsUjuf;9p=gtGU2L`yRO
zi#q@xBJelV35eA=bhPAnjg<%k$S?Fc&NN4o3n}_c2p<O4DPZTYhgXdrJ+7dd+s3-O
zuVIz=UOVrXGix>12+<wD(+8~z8VmIhgHK@FksZRw;7t%QPjU*YlnD3c*0%`{^Aq46
zk^+g+3RlFiPku+~;gqt<Y<j3sEyF86g%bX@pgHYcv{}Cw_kxN+ndhpLRXetTRuga3
zz67c5dk#LG%zE+=S1EIF*D}TnB=<SUC@8$XY_PqxwT1Awf=ay5&6$)O%vM;;{j_E7
zx^3IG0WeDSj^=wy?tfn|7p@#0@c^gjZSL&MfYrT0P@ivx#4}}TXlQ67%Fv~{hoQUa
z*%kQqqQY-6L*MY7RmfepA<<j$U?Tc3jtn!i!*v?smVNRE=2PtupNt~;MgL`DNH@QN
zWb8@4eS2G*sYBo%xy<Dt@!NHh@Zn`;LrO@2>MjgW6=8u%{jf&N=MHJE1w(gLl@e=C
zPEHg#f5abvY<DWsu^YecIw!0ykyuN7J*Z(;)**aD!{5DU7wdi?Hmo!pnUP%asE1aS
z)c&x_ajDGkiF~uVD8_<q;h6Leb#m5efTMr^{>^nM3w`?Cf7gjy>?EdtboA<+MXgG6
zK9GO;j(wr=op_`x@q7<u5T}meBmFcd=etHAVK!Igr$2e%Gy5saANLuweQ~`?$DAPg
z14iLV5dyCW`1I)}I##&NU`$pE5m6|2xc$}VXiA8ZSINtYuG;sf*R4zl3Qsk^fs&Ai
zrhNMErcFUHa`(#GvI-%tueF)Qm+7e_qUw=^m{9@_oBQvcPUbe|y>Z&#FfX`y{}JIs
z^))N9z85cVwE+vbBgf|J5L%ZuR_37>{{g;<4Rb=O`#1As@p9q&cM{vk7W?04^JQdW
zx>-kULG77*{|I6+V`GD4ox(Ve&jwFLB*8u_iS<Eg#X+e;c|k!G;07*tee=8uTk^fk
z%-<it_1ioz*pEhU4ZKM-&ul>v>3i2dO<}VFS|@@k>Al2*e-{c%4)bSY<)c=Fwkn5%
zROe@^bCyn4DFmIZt(4MtVh@U4e-_;8UmOPdA1!=>H%ErQB~f}d{rQR(2g6;85&&7!
zfomkx3j=D&Ci5}zTw9ifqvNJTH{SI1%?2P%ZeGxoP0x`+e*6|^V4@n$t$FXfk}r~n
zl6)6+IB_|JJ(RDqvA<tmc|Z|TE#VWM<iA^KPhW{gT8TFg7@oPb8OywESy55UINSu#
zea^`x3sPp<vD~n>$mj0A@}QwcRpMlUteH;LM5ID8#oG4)AR_Bja9cy&ym|8%9UUE6
z^L7zxS%|M*DVXESxX4PyVKmm^KUL7-*Tcw)ORd<CQO5W0f8ml2Hc2!<=&U@XfqN_-
z^3K<^TuiUBrvw`915T)#?TME=gqt_~U+cttIxC4-Ikh?McJ(Gn60Xf5XeCi3;bRz%
zRyYBalgE1VPLZpHLCn*=QTk3GC(R`2EjzYn@GYmY5};ajSg!8RFqXXo``t+VctO+W
z@4J{phFK^vzqbZlIj>FN9yoB^u#0TbfTo3}nwB8#(LK?T^=_ClXs(h%q)MI(4Q5+e
zd>y4HTEc&qrd9`68a{Qp9zYO&=j+$64~EW7^3L~$-s%PCDN8WG(Eo-dKF8WGen;!1
ztZ@2A#PxFD!t`bn`63Qb!PqlLa56JzG}PBGml`x(XtA=k{^1y2{^$e8TAi@B{S^EH
zfLC_5mwqeU;-c*irRAO7Ebk99#pP5t#b_i@d^3TP?utcBY_`BMDe-x3XgHi!ld7RN
zaT~o|kQ9B>dmw60^WPN%MsyY~u}B^q9nBfRYn(g<iUMnF$<-SKr>U4b6oY2fL(6a<
z{s$t|8}@3b=gNH_8_VkJfIBL7BTD4CET7%iyh=xM##{Z?4Vtng#Kl{yo)_E7-F)2^
zl5_;zj-O>EFrE*o72V6oKKlUla*8czm?*<cZ@uB}<`*#vdwivP&tHe^KPg8}-Af;0
zHu`Y854!lAJ=)J5<C4DrzIZmW=g*(_@pZBLUjHk+`ct2+eF8y0b@~S0)ren^;QrI_
zFfSky8BO6k2totrC0+EN`?xL=3+i@-%a?Wh*NyzLZ`0217FT<KEy}L0RqRV(XQu#S
z%Rp{5T!zW>^Q1#OSr@@&6bAFPz(pvWJ5E)|j*ImGCz(@a*{^4*Yy~YK@socx33sJt
z`4ws5q?`Y)5L4(UgJ9^iS+I{FU-^Lf)Y{sr{~%2!ku}u3kqn6If0ihDdA!k&3!IZy
zc?zBi^#es(q^X^^qvN|N_8<M6`)@e+pOub`s*|kw(Rhx(D>o#>3KSteb{|3mN^qE}
z`VqtKZBl!O%8;Cj={~!4|0EjW>UDEw8#8qYbrKY*cep0&7_`_m$NYz*`*(S2WYY3y
zsNeciAYVZ4Hv5E{1myrdP+{g>LSJs-4$sb{0SLxb5RqEJR+k!0DJI%-_QSs{K?@RN
zsKvQmXf-sCyY6=Q+Qch|9$Vkp*{Qi)Xq|%hz|io>7%X-i|6$}KZ<1e!z$@SVFu^=|
zOR+$XJREkB!$Wr}L@2=$b8t~gVX9B#e1*E69pcH4`(n-h1}-2yqmo8c*+}3@+W+om
z?d|X(zLq^`^SYP;0g6uB*L^6>ub>Ur>w_)M?)k=ANp=+PI%+8p1>c2M0M;@<k{%{M
zmQvrb{`mG8IIhfy+2%|t;DSW5Am_axrkOL}*G0tZ9?n^GNA2h&JNr#y?O|dv?oqM+
z%GQ&4k{eqAXtxeP@0-7%`q41|aKO`Y1Db(6P1e7~j^jrd`)B`j1MJN!I&n8F2&e3W
z5q-bE8W+y+^5Zb+|E?c%CIto%e1W!^B?O3@VY|t4W)bW3PEj_Jh?8~>v@y<wvXLXP
zm8JyvtS~D2t+axIZKN)#y@}b&W<h3FRt>;pe>FB@juHv>v??B)>l65%fqam<M`65I
zZM*gDNa3#<cAm!;dJ6CnDcGu=qz{^}^3n7NDV*L59}{NUMbx<YkY@|?J|RJ<hl{v%
zrX^?YpC<VKtuyTzK)^Dh9|(|F<TNxiF!8-`PeXecD5Ij95F$*P*t>bwI`CkRPek{f
zNtx7fQZXM$sAXe_8D!$z&!0b^g{BD6Fs|2GfqY~e1ccQ=DB(X$6?=8BzyQB;=C1&F
z<`p*u%|jpJ;<6Ity`&Me$Zmpl8J)PYZUX_^93;>4Sqh<LTant9i!VA7<i2w?Gm|3t
zh=JmCCB0NA@=veKe|I-57;+%WMI4>M7{EsH*&+6vj5OnK$25c^392Q(Gt^ie*O~KA
z>PJnbs}52EdXtQdb~uY)I5PTaV~mZA#Jgw|v`U|Y{^_nAUNgf4OLbynO%M%sKxs(c
z=lHMzi@RxUtmXQ}00f+n@9fP7TC?!uThA<kHE=|&eZZp1IOFOefot9jv*6@xe;)lP
ztmQ<T@?Q(K*U5*jBT)KK%S#=bQY(gPm@wb*6;t9-uQljr`{IT})N#$FV72Hg^!}Xv
zcdCgnRl884-q(`Xd%ToO+3m|9f;?|3t*XctWY#dY$LeEN5bd?s-ypxEz`fl8jY&j#
zT|gpONk?qPkxZt*`BTOrFnzh68L~{wX(I8)^m|;}oT@L}jydI?J={Dgm;N=<Noxd2
zQa>LpwIXv)c6OwThKp6G8+q>AHkA8M9KiUWH?AnRg*#^79i*X(=1;}Jspu<=XjJV6
z#HGRh{);mnX3oDN1@yF!d$Hr3htIc-x_u1+P9%B%H)u)m&oI3HUn4ueh%~-PQrNdv
zwb)%e76CofosXe@jcb5L+2MWb_1O!fR^)xaB4>7%`2S|iY-B(KU!;CJ#mvarH1_F?
zqviLw*x2t}gYqgYxrWv_<q;u{m9Xa}9BK~6PZ}7|tCt(8Re;$XX$G7uEd0&8xe4Mg
z)Jcc~J-=F3dhfdW>;n5bm7#x!QtRXj=wQdl-SkgUq0Nq>uXB)-`pOcC8<lXEq3EmV
zN#Gh|TbR={Z`_C>=!AnPx4NGy4daZ?X<o=6G5U8Sas5$^_Tl;E<q3d7tzc(nW}ZEJ
zR+4{jwA^cGQ0~3CUr(2k_N_Ts>_2?BR+0+I<Yq?9?CZN%Y2$(jIw16Ce<NS-7#~O7
z{bT9m6cO1kE$uw*TXunl3Dx<OC710GE4f32?<*;nMiyKeKTXPAdoAe+rIHs|r?kQl
z0R9)>ba)GD{-^in-=$4n&{A;UNXfq&78<H=FbO;i#zLnt!FK`lBVTd#?2Nc(sKgZG
zVn0Z{lLc_q5;YM`K~L(LeK)mKdLc!S+FM#$HXR!q8fMpgd&5oc@H?y*76ekvLrto6
z%?7s|9lZ=$T)-S0xE!#l-A-X2w?3C|#$si+E~@|<n`b-A_r&DnUVTe_bfVV%?>P>T
zB-R&1J398%gKg?Sz^d=M$725uZoMu#*1@^dg0_Kyfkz&Xf1L}%ktZid#XyV9nFo~_
zTK$ngC1qaeoXe9Z{4iUFJ5}%ABQLMAnj?}ar{gL+50BEh%O>sv6FvvF*p-H<zW^0x
z{(Oa3f~b<G<3@GF3IOoc5QpmizCpxCOvYZnmK?f4)Tzv5Q0mfVl<Rmp*~0MOJ%k)-
z`r_#N-n!Y6WE=ExMx_yG5w0Xsn*0L}FXLK=F)Bn1dMQ|RILH2zkM}`Sm3CK`Hl@K1
zjZTg|czxF!xRQ_$BLdZ8s){~Kwny0>Wy>|3e^q?u-vJ<TH%C^Fo>0+~FdZ3chDG6D
zSH{pO@$&GeF{uhOQv%nvLXn1eU}TiDv1$DEpXmk%Hcy{wbd>(r*FfBvv^KGR_dCaM
z3d=AkbW)#^(m5QanBh5@h(~s2N?tqRl}_Xqo$esMZAFmc<C15+#s?HZ)SkN_)6wXe
z`aWpq<kb7Zy*$6T_}*M_?$PTl<6{4z7t$Pm*eecODt>lpu;jvlKI$DijP-GJgWgK6
z8Ri1Aab?1A6((+ca<aD@bL93}1Ma^^+zoD*7ZHTt^!?71V4Z>>Kr(StnF#511KUm*
zxZ^qZO{Jsw|2{y*XNRnsEm?T=njj09p{TvcjY*XSWLXm1$;TUmn`n(>Kd}NGeOiFc
zY@EUP$@xJ5Fk>oHTtib1e!T$lm4@dBZR4I^FmEi`S8a{Mva%e4`=PDea*f^Sj;0b}
zxIicGE<f))$U!3^JI%tUq7Aoxs3v6$ga4E<X2i`TvYEWbS_MfYl!>PJA2}1;J&B2l
zmjj<Ye%zR_WDphMgp=d^H-eJd2k6Jun4$WNUbcrI>`ytNuM!jZ>R%5t?QJyib<wJS
zKwkk*`H%RVn&JNK@`FF6&Nsdj%}5hURyB8*t9(fSdF+52b)Sl0#C$(qQs|td|L*Re
zkpo@oHCwiPPN{yZf}JP8*2)})MFG=ZybR_TQeIwlSnJIhew^gxh^d*Wuu06G(|2tS
zj`%D>_4WiLPHUc@qF+h9!~r4yE?839<;OK{B4$-NDVN(&QU1on0?yhrDB877n@17a
z&};mkE|?Re4peeY`HfEE2zKWE?U?!_?XB07C(XmYPzA4jo%wd9gd_9}(;o==@d~qp
zO5=zv8tjCE=g;!;V;_!uPCz)Yd$z~3w#NwU?qw4sUL=bsAz_B1nSwQsjvwP>zjC3_
zAq?jGNjSHW`XMn<Sh)5fD8_1TQ_hgRxK055>Hk|bI_su`qaz)As>~qIgY3SX7*(6i
z{C=WAMZazzu#1172sOWAr^<UlkvbPeMa>v~L(99yF9K&7Hd$QT<=7cR%^buKE};~J
z`4hh5!=QAG{IK9rzMXA*q)@h83wLLJ)I=9SXDHT#C70Z?Qj%upjqZmp>J;{}FD*e@
zpq=juQ!_lJhwH;7Jgls;NdM0B5{q!D2K>8DSg}1lB{lW^M+CLfYgnk#2HNj^FYA#J
zPKUge+Xd2qq#ceo+qb4Nq{Tt#GY=!~K+Bw@a_t?#mdFaD!(ah){XHRd1cKvn&l_UO
zNc|MNO<%8j#FLzqv_I9%_cf0`D{K$B?`;$8;B8`uLAWCvhEsO|%@jo(IySRXO_lLP
z-}1|;3$-GF+$h=1yIM<JWhQYn?%$P!?pR@fu_nSvQUBfB+S~s1t!(MJI~ot=)j6Ik
zra!K|3f&%W@LOkLqLPyvA?87VcqhM0_=)7=BtWqDX)JW(MRR(F6E8#jZW@u+zn4uy
zOuX3D)dfM&C~d|$|9t_Eq>sM&KA@Gqe2%_iw<VtSzn)Myu)r?!aFO~>Aqf>B)5{!J
zB}CyX2VWZN7-Uy@NN~1Rq|VrB#WavXXpP?FrEqg`*5|dKbC*)}|I^C<&%$eOtB@qI
zEoFRIi7008(e}MUg7Ri!?|3IIgoB+)aIjPmbv7Sftr&9PqJAR5c3be%AJE?kOdkq=
z@satxPY!YZCZu7C6>Ag~cETk40HGK_J6k%6)OV;8ByNj<a)t$8){ZECD=!U>CydX=
z{XrLbw7<OUSR6@mwLu!LW?8!Tt_ArZ!jka+2c(qLu24GO_;f>Ma~9;|#eV@<8K6KG
z`Vw>w4;wJdW|n>bF^rq8u#B7803&rGyT=F3dYH3#py^W;ZdrnC<Dea884F#J!QV|N
zX*l-Tm~Lv1E*?F|toWPBDiwnrT0j6AxceMXsfvT=>I6F=faTs&8bnR^1V%oBgGTNQ
zrG-GXh7CO-iydQ&a1%@sNPg)vjK@nwMK$2St2WLCn*INo?Ih;$kNdbL5b-~JmE=~d
zt=1o$!=ft}ewKJ0xV&m5!aNu*^I*!OkWSW1sKN<f=5dn_YH#0WbDk$9tfCr`PI|1C
z%R%mn@kQpU1-g29jg<R9nMC$HhM2N)pM;uY55>?gQL*1<ykxGn@z;l3g)}VuJgH@+
z*88wcMZyRdhlN2K9<JIv|AmURsu0`!DlopSh$>NP6#kRhx~syh<yP=+|Fh&n>~cJr
zo8jGog5UDjEV-;-be~c`qsoiYq2=RFQoO55f18#Z6U@smnS|jbS5~n5t3zxde?{>$
z8!tw391-Y$=?PnS@ZcfRlC(bR(fp0r?^x%GfmPGp%a%QSH)H3@b4JQK5*nPcUFDYG
z(jIh1lA|bJCAu`I<GNv|N-R-r0i7cvSY<J<gPG*QIRj9=LMnfZBT_|lVth#=rNfD>
z2J<a5`tM{3@>SORXEW%_NJ}H}861b+l(dlNyWf?i=D0jAio$=k-(q~M$fl5+Lw6e5
z@mb5aQiXpN{P=Ot@7b>}cgX@R+Z&n)6{~)2DUpg~jjt-5=gnVbpha#@jnTsjeDs2k
zU%k^s?nT)jpdDS2{}(I4d^G9JxZQV4c}{gu`thzWfHibAH#|H%=mrI1)Z*w!P~Z3-
zu6O(*RCrPdyV}KxJJ~NnTR)#^BhQpXWS=jww6+#Y4}0-~`1_BCMv(MoeExiG^ST=`
z%PQYl;RgkRZEU_)6QUimn@dV@YHegZach3dF}g``X+SX<0f*1wI=;(?JT2>}4>@T}
z%9Na!)-^}*FaukdJP~Te)0S##K|J*?A|H>aOg~hx|IZSYNk!<x_fhp{FBrWf(2{zn
z-guP1{ir?8QehskaGGNJ7`PlX3RgN)^8M+1Lvl`rYDfRUTVl$^rKJ#zUr9+x77Fl)
zSERhDS_XIT)@4n0r)u2M_AxK5qT=13WU6qxBdEHYwIn-P!ufNfSzxI@EUqL4uSIxQ
zS!@!Yt9Gphv@=&c>`jOlDq9CKKYsM1Df+4#mv&84^Yzf;V$DC(D*jn7C0|)tnRwcB
zQEJ7}^??!3!J#1)b93{-?r!w=h5Th|MbSsC>fd*Q&n~g?(c)}G?8HV=9`gNwBjqn(
zVs={15@g`7Xpg7GMZ{#NcKc1WdE3bguHC)+i{<+6)12b8xeDyjsw;^-hZs-1Q#b3z
zW=UzOh7Vnt)(SqsfF-%e&qkkj2?VTjxu5T(56ZIDp#!CW?{854&0qWL*RLJdhfQzK
zJ^BtkhyUAR6(VcSgtkg{Uv#PJ{POY*o*OYH>$jxEZzagSkFoHNEq2vy=bFIv@Z#Z0
ztGp|U26PlT3$-ul<g8!IIH!Ouq`vTS7*mEXM52i)1&Oqx$U`ri=+4jVc6jf6kF7>w
z0_O^U{r>HkrEO%W?N_(?&64fP+c`mBoeV~F%o{RtjU4pA*r_wRZ+q(N>%|HtR<F)-
z>t1KawVD2#S;fW%2a_k}?+{B1^!4`Y%aF1&gF>?Ltx3yl>w7b6o}RRuOW%*0&>y|t
zEq(>iJlO|l6;`ylnNGA?jR6WND}Mct6J4B~VoGU(-Rcbu4Rx6xJzJlw<D=S3L8u%~
zaia?AeocLXF~mR3TcYH0a~w0WvSgQWT1->-H<d9WX03*#Jhbg?fkgbbDMUOQ1#Pmc
zTly<{1c_oMlI1s^%o)}VD}{o-?%y?o_3C696kmF2&E&W9D$lIpe%#yrS{ciCpqIai
z_NaSeP3x4rV?|W_C|Ktn1w8H6NuS@x^JROJAtNj40qHATku*{^w@W-em8I{ae?IO?
z?!L@dd1?K%6jsYF%&f)dph4kyeWNO_wOwY_(;I}69|6#wMoiCDoAT;g%smaXWB3xt
z%rRZ7aP9ngN}HfkbX_puA4q|A%K~qC;R3d@|GUX5*X4=y8*3HByO;`Z2=Mb~c?Gn;
zN<qYmTYtE~^8jy!{yl-#hq|i_Q#eYL_{2xB4f~)?e^g2y-#|}@U6znYcbsjl>g(?N
zhzfNKVnRdZtpaC-!N18PgaWxqizgz?_(3DkJU~&6(`)MpdcZ1t4CnkQI)A!vwi0Ck
zp^;CMB_{PX{H5<Vf3Xa$3$={(SRt(*X9*EwdTdkxKy2wLh$&ljDDN)JFD~+v`7xhi
zo3{PGF;|(As8&E_c9d>NGA7c+)ioL&1r3u|38#mqW#nI!?~t7n1j7<R;nrWk?9PLV
zSiX~f>&Imin2aQD3x4uSfFcExQ2sV7o)+6LZq^XCeJZCI!A080H<yh#N>@0t>=aVG
zS0$t5+dDiQN)dj~h8y33DJe@U`|S_pgP1JkWg8Q5VY=n)7ZhYi2krcQ3vbV9Sh@eP
z1(fH1)<H>@ck{V8bu6@-lEufzn^p&q!Pu0UrAOBE^2RGT_uUtK{0XUSMJAgXb);yZ
z!jcHb`U7uXX=$l%-OTq6`3H*Y96{CoL=<mJN~BpfC@4c1FQ7+KzI^$DWZir>>^(A4
z6X!Qs&XJRqWo7W23{0c!Pq+$oF^Rd?u!VhloRpPuik%$1vCAthob(T~`D)j=G?wZf
zzU9nqI7g)q0N_VxrR#*j>=++~Jr8Z#!U<dTD~F}G^Nx0g^jab5h`aXgd^}Fvh<mIv
z<j+O`5R#>|c+AWu`sfC;r4?1jBh=MJQAf0wjGJ2d#8oSO8Ze#I_hL``n$$Slr@idI
zMVk&6*_Y*Ie_~D#q2sx=9IxQxo%i|k%Q4dicGu-|j>>U2EYph?(qdy)@w&2_l&x{>
zk1lRx4~C0`_NLLHs6{*5(<&Zkn(*>;95-25IAlwn2V9W^gKRCnJ&H=7@{9gNw4aka
z<)3+_30DyRH2EBFCT0>l-YP=CrcB7wBdIUiLXh5P`+4op;kg8QG)1*Uj4NJpfyTLh
zN3_LcVnDCAVt5DE`{CKcGSce{I2QfCZ<1O0n>b~NMt7edffo3c7+C+~$B%QJ8{aCX
z;ZMfr-|4(2H6+_KsP~Wl4kjf-Y-J-)o416aS+lwCQdjx7m$|5ZPdB}5^CM}|ATP&R
zU$x-A-5E<k<{?|{eVw~^vkQF4J6obIh~DnB0GWPla2>j%r2X@^ZyUMLwanht+p8np
z=0+(~;bxP9FB+Y^eE1xRZh3RpCOfLdwQ1}v-<`Dnu>i227r?kgRB&Pb#=-c>O!_;Y
z!+a#VZz!g`1|sj@hZ5;MTU1}S0}Z|1f}_{O15#jLU*_GMjALAllk;$4F-sa1dUGA8
zq(EEi5JQ%Y4}4B){(YVVH*Rj$JH>Z$uZ*;l2P$(x^wH$o6VlJEWI4KB%M^0O5$1!D
zK79=B*nXGZt`v@qMyyE;+o|m09xBsi&@%mX_EMZ3UU1-&$42_;j)oE6Ru{UDN`tN&
z+Wi!Hfp)u`noU8ZnCrQs=FRlS9Du~Zv@MmxAwNW8!6)rk=iCR?{`Y1eXnjmdPWFG}
zY?NkrrXJ=-%Zb=X*-zG@VT8P$o}=xVmn-Mb?Iv1fC8eDNIB3j8hbR-kxWl4;;=Na_
zn&45dfBao1?(FQ$C!{Een3%2-+Mrgv$DiwoC%NAWs~)K;LDZSC&o<yD{}v<a{9UCz
zc9y%xG*mU9l?YxzF(y(K7yENzzP<sQFL83ZMZ6F3zgrEPj&?-9qL4(Gzo&lN-hS%=
zFezFNV(IV98f)d9ytk;s@6D;hr;?3vq((n?r*GoS=L-x5puRT@rP>RG$yvg~#HxxN
z@&{HW4l~!EF4K4gPUV-B3_6bF<k@!kw8Tt&c$%|NyjD#?GJ~H#6((cU+26lcdQKyX
z9)!Lj7&7E}E_}3<@^i_4Q-A2B?B|~5FBWg_CL45J{CvPKAkcF+Q}<j^;LR9lxm`eF
zZHhef^<fUr+z_LR>LDwqP3elbLrhRkj!<kN_V^%3qHN*j`B8t@vL(Zb!KYt;IG01#
z^0nYdO@4#c(SarB5N?XfTUvU3CQPzAXB}iRPZkDS+~;J*EU|Nus}_YLF5eGy%2$`M
z$v>*SrV|`){1G_7DZT%*XAfSCj*jM94P1)dp*IOs#<M`JqF!Yd|BwnjE&3>_fW(#u
z_u;;inuM|Digez(yfFTC%d@E;-I^o#t^`Q7z78}NSaxx7VO&~VB+sKA+t@XEca7y@
zfTAQ`UWLA|IK@r!?#pYUt8h=-;oWFs?|lz5(~@V_bMzF0K?;X!H9?$Col3jh%F3a&
z`>k<OqU(<5N03xsPu}+=A0d}_^la}8esxq7<FnSY#m?4Ojvrw@)?MK}G*t6-sAJHJ
zAXI2IJB|8dZ%?Vr+%4w~cg0;;A@OUqV?=Dbw%fswr|19)Qa|s%J&D}+1uj^eo@A>K
z-+9iv82QyR_2$^KrR-FXP2AV{BPN83q+vx3cEk1!fpGfJubdByDd#-?m*VARE5=@N
zAM#H}u!=p=x!!Pf_RU9Bedl#*#XtUk$`YT$Y3ZW5j(0wwKUqsRb$pSiZ=olB$TQ9r
zmsj=tbA*k}N`D@-Lk#omp1ojLa@pP$28-w!I{!*0qF^*&AXXB5Z0y_iNY>kL6Z7iR
zO9|be8}|~KU<5}2TM<?ZFKq1T=f2jlFc@7DP{A&>Zt^x2amG5S*F%MHk~2UMa|8Ju
z^`hxW?#F@xu<+*<tM<=##Eu=#=8F0G&Mtq4`!4>XgmX+k?1~8&m`YcKVQ0O$qR_3f
zY~kY5aerf7+~i506FZ#ymnmS2)4*iQZuj1qSoOhrxa~~@)yVA*)BP!$3R{B;tGm7e
z6v8z?W1QxAHve&L{?qIGY7t>!)FC5`A$6#L+#Pa9o(@-?vqa3?Njp0(ajhD88t5mI
z1nwk@S%%8E_H!;`Rb2eJ5S+g8k=Ez$)<RPR-yOSkb>K#$xyvnWY;M84Av(c}w0L#F
zkCe^d)i;0m@F8ORn{2VpS-LnMW;C938+i?>pP+TWiJ>o?FdC29_ZHMc_6_W-uNu?{
zbyAXENxpQXeBa0m<Kc&W1DK@^e4}S*^W7oX<=bBN{z@jK*bX`P1;Zqn43o@|=lVOY
z+?Y0!UDkCPZo106GzD7nO}k1yCWLi1%D~|_JIa~q&lUGuGAsFSV`-KgzHaQ+_oPII
zyzFCARVn}K(17xhKbfj{;ymYR(76<hf}~Cns$1XfCaRHUY2rs)J(@$8^CB4pbjNj0
z6%5(P#Ga489oi58wd4@eEX!|e`C$3GrrUamaj2Oi5`9*s!CaFdDu}uxkLv8pvAE2c
zEO!4aGE!fM__yyo=N`jp=6;QXJWTO~6zNT_jnD~TblnW|AHVsrZ0274<kuJ9zj9j)
z&w6mF&3bl{M$WLw{kYyhMU3w$CMI`N7N(@l4h8I&c$dKivnA=oe&oRn7+7?jS?sU#
zo3kB>wsTiaOIwdD#BPIA-+YTb{ubf6@RBDXrjr#05EcvQ&mwdb4g4M>X}MaE#3dRr
z{j%ZS&2<X7;vyj-zOwB7eUxa<<3u~tw%zjGGBHBMndDfor-MwXLlpU-{yNQ`*M)S0
zIA{nxaZP9wWcA^01(s@awoNpent0eM!;$uR%w@|{>n*w2xehbUYv4PohP~AD<UumJ
z20uzBltWJXGIWxIDGm_Im9CbTlAXT#ipBhQhnF&93oQS|pFcKqq(>FlU92F3xH31J
zjq!T0UI1>u$3&+J4VA}gS)sK+Eot45*mb#(vhO17$qk{W-__fO<(u&NmmIp>Bft0(
z@Gs@9lVKAVu1DpFSK)!y^>J3E4CH+<9FWcLn~sTiVzm%!CuVi%Z_L#rNFT*^%4(=(
zBFL+sJL3hn?0QVUQ5(%0^FA=tydsgHao=V1yz=-@i`Ez}?0v2R%Jat)GPQV(M06tk
zI$tC$+D*@M2LOlVA@LqpZUg)z>c3XU#d|%;)_Uzw{iB#ZvI!MeCDl0MXxAq-i8*t<
z0ezZU*4?h!bZBq1-!?!Z!G_Y5^1w-tL%}sFI>e2*`i@&M1#(X7&sxnT*HnD}kM4N5
zzxDTUS~ZlAx=Wr1Aou$+Xvm&gj*Perwf%XWe$*@@#ML+HIl7f5F|cu5Fy*~3W>2ZW
zcwl<ZXD&R*dNVoqxX;|(h^_AXLpcTURZ`2Yjf1Tvl6J@34xC;X_fq?a?G@0koGx=m
z{(@@{3%!YOMN9rK6=aPS1**6B?_y?+q3Z~PH}+sGHkTx?{d0N(%X!TNwgl|qTr7gr
z0xs5i;&{Xt#7z0Qx}RyGqR18gL*asXzw>WH3%=_9xhfJ)w$b%4*8nhLK1x^M-1n#7
zO{_O?O1z<)Oa-4MN}9(d2<XbT3*|Rf&{;-A)!7o`h2Ly&p$##ce0Ix1R9bl!H~RqB
zPS(!CRm;djx4xIZulM!|g#=BvU)=x^e+=Am$DnUAc}N%CWtUi6ZSS{Ymii67+@E*t
zJRyJhXwXcapF-2UC-(;veU6rl(=|U_UU;h%r?>mndpnbf&9PM^p7f2@NW*m>5yt#G
zsw6JHf^#{b0T<aS0yTY`$ukHPfqP|xV}1aro;_~ktqm6S5hfS8c$XHdd(rSTmT|4{
z(?u}(*L4*n&-LOlN`4m!f=-i6)Wdj3_C69-c0$H@2wll%8TaSa6rS+q+mvnV(#_@O
z$PDJTLj<0CJ5J1{J$er_MtX&<?~L2hfue79UQA*Ib-_Z%O^b`a6J7DpAB-ZF$9jD6
z<|<_sXxdG!cb`|%aC5f*Cc0=)YTMxX=N(1f;ptqV<kKDOG^Ae*5CP-$t6y#BloJp0
zVmjnZhklN~JOZU`H3y+A+iQzDxrYkE?oAq2aTOB#bMw1#N3-$4hwtZhn`A2#;wXL(
z7?()lYy=|<&07T#Vl}7Z@X&(Xp_dC@ScoFeY`>Snpw;Qb*sAg#<)Vy~viwPB;ayX{
zmfMMW>E|+F&O}#>dQvq)Y_#(&I#AeqJ*3ai^l8v)*wf;}jg}RTWpD)(*0vrG+<s*m
znSU-7ufO*GU>i#PuEjj4_g`nrV`>iWS;U(=S2#Pf3~D1YXZPWBu1vg9;}F3^vH{$t
z>&l4sIw`Y2ZnL~<=5a;jI8jM>4*gMU{*{VI{fqg>!>koS-1lhF9;6i)&fr_0vPyg!
z9Zn9qB-M(Hxl$y$Nb6Lu<Y)|L?-8Jn*MOM}#+PS&p<!8>`>xH}mRkAl-Mi=15<KM%
zYZazbN1uKzD~E0=8C&+bn&MtI_vtsBs-6K9T}Ad&-TmV)c|Rkg8SL2C<4T28k;;@*
z?h~jrS8ifc@^#h=cfA41dAlc3qdU1uR3#ALFO`1Lt1$NE@Yw84YGrz+^rAade#)-v
z_I@FE60V0>Z{jmB1&`C$77%icus75R`)ZwA{qS8J`EeTLJQ8Qysj4W@v9f=3F86O4
zA7X2qr|WLTRU}R+=4kvGeMhp(HETbrX!3i)ll0+1-o_^FAj$x}JlA^EQYvJ>A|yU3
z>1`xbt*jWqbaAHRy)`Xmq>PIFt8&eX*X0*l>`whB%fM_0((4xWc#acrUbJs8k2YjX
z@cwJ*IJWoqcLfKIL<-apE_3=J{UB8Iln?0;zT~mzZt2*MJu+qS#g4fIj~uCOD=U_5
zcGqE%pF2OkQsKIQs&Pe7?ov+a2mR24m*b>`NfU(5e{hiBL~@7_Ip^UxNj6>c_HScO
z_($&$u`|SUXqA_%$a@qw)`AI;o0zZRe?lsF@&hlvrX<_1kPte?`=JKDjF}Y2fjnT-
z{B@-+xQca~cep#|^{;cmt}i5I>hLf|GFD8i+ad1<M<^<0K9^{JO?tFYd4q7P1B&G2
zi=+^cock^m4tJ}{+YV#Ue#7K_I)`|)TDJm{lnaq6zIt{&@<c`pv1%!EW4tKFEU5Ur
zShGHVr#BJrsPjYjsC067%q}*~Dc^3Su<1MB%M}<=TDyj&`Xe$k&2F(Vm!SFThq$b@
z{;}t<ToBg**7^r3EF{1Hl`mwVSd+K$TfX0sP0&5>R&nO7(QAA@i5t6Pcd{dGSC<@(
zH<qR+IGzm(2PjhhIqn&=-$Y;dPm!R{3GnO9m<>>KN)J2r-29lGeId@FnQsD8`k&5^
zOjsJUrI{xXgegbTJN;%gn+dx=b1x{Ch!T=11`FgAR?r)>5`3<?CB2Zcw*J~@SoNx;
zzyxWnT!YdR$;wjSiwi$D+eN#W@<{%)%y)fSaW}TBBAUqf6h^LW#hb6!Y2)|QAk^Z%
zTFIVu1Ul}Xj5?VnUR1-7jz2_|+gHuOZ%imPwb$Hvay$1N74!97XiIwVu`n<14ZTSn
zNM{%sg$!bfD3C-moxd}T&t_}tBCak!pC_T!s&Z`$7WP`u@Y!q??HJ}1_z;w{l46H9
zXp!h86a%T@0fe782M!FSe$>o}Sl21#q`6y$JF&`EHb39CjFEpu^k~!*De6SP%h5@C
zw}CpPT={CH>^!lik=FM-7-~Z5-x-J!oHq363k*?hj<*A)r(?XM^E$PX{7xBHt^!kX
zkpT5UJ13oeNJxyN4>1#|HO1bxq&uFLe1#n2+EJ>WqZ)T($g7QNVZu8pIs^)RX`W*z
zu`~cVBra0VjMIDvu-g9Y8uqbEmRioOsa{A=<e-+@(xThf(b0*KoU!#ecu)kPwT+!2
zI;;>*lCIB?Zg;tT{CnUzA!&L#8Rt1-eaDY<9yEHNQuRtFUa$(v^|!tkEi8&5C&_@6
zNW#GR*WK9{0Z5Fy?^MUZ7}neI<2f;w&*K68q}_X7=SY3gg5S5|>k7huvDJNujm>WR
zsDOve!0`^MJ{b|*0nE4b$%U~>b;67`*-8q!DLs(%o&|in;MVM-X-}RKtsaVwz)cu>
zqDa;?3p(fvX;=<LnUc<ma~L0gi!NL4bdCoY@zW?Up!PMHM%!No4%=ly11>dian*)T
z_$xUQyce~&bqf0^qWq@zu9&#^eH0B(5=<}R9@RinXy>^|T+DNCq>wOCxpJAnk2%1L
z`&dyHf9B8SC5oW~?`vFj-el7@88HFY1L?*xXw**NX83d8CIZQ<-5l4lr?IryN|VHc
zzvZ0!+pa^_60A@>q2ph9{TH(u67OZTdsgN32xM2{G{2*F%T~RjlAEt^U=)ubM~zWI
zvY&dKqyQ#XGc>wW;H$A;fFFPHWpwAj+g^(l?B9*(il0qOx+1se0I%WE`0)aPIXJ)`
zk6|e)4n|g6EiE-pl3UM%p)u-02um#OCA~cg2Lm1VORNZ4m96lv^HpN>E<JB=51rZ#
zhmN88aP4oWZp2A;iKBKF;uGY~_(`9^wSLm1BIuMUDI5ZIV|RMxB@w0yOXJmatlM|8
zT<i~$d}E)IUUp5;r~Phy??q=25yt0|h!&q$Cj?qgERdJ0oUQvSQ1USe-usq<q!_H~
zXz201-5f?$Wcf$>VHscTqqCXIvlUX$eJQK>lafOXB|1H53UirF`2X$-uXoH6fl(`B
z*39n&`y%ILp)jR^Q|2NG`6}@1Lehgs<hwlMTIm$xGuyrOgwidBPbC{XoB4O*nGVNe
zL}Rv$C#BqshUYevPG-7;ZPgAc+HEvxdS8N}L1P!!I{>n`Lenq4FFG#T3);hLS8S~S
z-;bev@!D(IY@+v$<`3%)`<H%|a`TW_lGDg-g_GTUAyBI`y7odM!W)-L7B2nVpN*{v
zW)P@O3+P1`9kJO};_bxt-;^ho)mgJba(K<Fa9*0@G)S=Heb(VIYWBI=t?%a<kubsa
z*ZmJWb!o8$Deqy9l3O<!-TAW&3=DkjvraZCck*pTaiDO4QiQZB|4}sfE58%2Dhs%Q
zDD9_E?~-vR_DepgP5_8QV68i2tg|z`BvZ|*Um}kthl3K5A{SQ_-I3O9i{-${8<Y<l
zLSFskWN&q^^WU9-5^78#U~!a)81s%9q!ov#fPT-1V-BBxQ;ajesN^ONxz1^FDDwuz
zxHanb=alZ<y9~9n>BFzgFY=WTf2W>|0|2Xi=cQYk0>w1d1Q0eED<Max`r9a+#p$!E
zHn({GtUH-iiWHtBNvaC|)~EL~(ntLH&7=PcNT~f^<2aoOD8@b(k1T_MP6!z9Uw3PH
zFp5s*uz<F|37N6|uwS&FJ&;Vbv~#s|nu5g+S+4*ByO%Y&H}$%3B2=_Jw-*iG?8O;i
z)y}&~EoOXLmawcu${9L!UFoAeRd`n0%)UdM5nWkpaV?!__^Gzv#I&pq@=VF`-=(%~
zvNufj=H11#GTs19WIHxV&Bd8@#BV)Tw&E{<^P+v8aJU(7VgPV`ZS9V(H$nx0F}&?P
zNgjs+bnMR>)WvXeOnuyCF31`xf&BUxQ}lN|vP>e${~uFt9u9T;{{LGBW1X=@h#9-=
z5n~@iMTpcbWl1AR#MrX0V;PhsLe@x0Nv6ce&Y%sIvWFQV+4r5_HQo37^ZosEA4kXi
zk7Hi1*L9ue^L#v?C-Gvn?AB{8rfWhQMpJ9){C94@-|Rq}E|!JYqs@gXKOdD%crX-1
zbPAhsI;Y?n&~mA1=f^wS4~pdI01QQV)`D%!RLl@c-2M=@%8G3nDfavGz3j=@@}lvT
zt5>}m-iwf9epSYAS<F8Ec^8i8O1g~ezbstx6EpCpBExQT#MjbIdvWD8k;@30v@^We
zG49q(_w}sf+ysJc#lO00s}p}VH_<2l@t)ep&0s11p`FwKo0adkg5bXY0Vu{=1T)Y2
z<<n+*>p=aH2A-_!-|<0Ed%{tM3KbFqg~8}gDebMNfb+_03tY<{v%OYLN}wK&$i{!R
z8{4t*{noM{|J|BHLAYY>ZNK9k16*6txicJ-#7@yS?vEbB);F@iOr4VLoJ`EP33VkI
zjJ#QA5<pNj&@9T-8h2iS<vlQy;11z}zScOcV9e4>%f^vDKsF2)#fu7U47!Thfx~W6
zIk1IY;b$&9H)kt(()oS?!`*XtP4}dEuqG(F_KnmS65BB`H~gb6$@x#a{Io9N->+wG
zi9sRuiie^%ed4|QGkIFRXS?<9f`2e!eHnb{;fdSzg3wZ!F<N~s>&c!RE1s%ak@(<y
zfnna2c}l!kcvPV@25-BiQCfV0sZjwHJMekw9=Av_H3^;)M8wn&1@sRL+{Cm9W}9j2
z=v*2uSTwMy{$X}Q%}7X5AQGVz)L%FHHqI)345|V5N&Wcgrvo$3+OKx4xm9pMHYOzf
ze)({$RHrRt(ba)LV%$sHtpoLHZ)eV3Wq8^U%EXuuLJ|#VzHGPiYF*D$YjP7AAyyk<
z|AIY|c{o?CsVAzSAN=5U!B2sBYv<NzAXcHL{QHC2my;5LADd)eg-*&_pgVNPe!vg(
zuUrCJr|-Trz#-O5saA4t_Uhs5?D2=L1xJ<Y=1$D|2~H$ci()bt!#C?F1I{ULwG}H+
z-yg#3QlkUG&FZelMNBN*pL3O##i+N1b3a5898FX;?2*+8=__)jc|76Z?uoMmyREN*
zmaEcbL{0m0n*Qy+^2>J?!HrfEi|5jotp_3?tl!@Ep8p1z#~%AmB=yrI^cl_Qg1yDP
z(B$~+#A%<t%dWAHQ}l=aWE1@RSPEd#Vj_=BZpT6AelCUw5LB;*oWY4RSVz}Bu7c<C
zjFi}W{0=;GX0h2`6h>KOy$ug7d?@v9NEEyS9Dm(rl(>_BE@a>1tdwejaqgBdIBVN{
zOd?Wx>?89ANIkEy=b#sPn7)2ljGeZB@`e4QsYjmu8qnQfADLurR(gO~8P6r7lA50-
zw?t38KTYB6VFeL*x!H}$N*``%RT=>gptk?>$&WX33a%3%52c??@L&HYBc9n<nh<Oc
ziAGOIDF-F23mS8f)#)!ngoBo0QCykRh662oKFcf&!VpJ~MPRE(U$<@)3zs+|CsX+P
zbIKu&l6cGKTp;cdM!Wp_1|lLl9qo3MD;|&h=;(cfEcn0@XJ1cl=uRsBxS1C4^P0l~
zayZkgvvDxl+55AuQYtlk>L(u6IObgOsZep(MZd+juZ3Iga3s5METuF=9u~SCGP#*F
zS<jLObL-dm=L+iI8lGHD&vmk-dS|G=@dyA&yxk+ufXybg(^nkYb=GR#dzb|5;RT^9
zroOR7`XPVHO0VdVPho%`J(llU;odKqHt^W4@Ngqlq6A-5P6Q3Tpl~dIXXHXPL(l;u
z-tqp86zvUgX7MhR+Y(zLY9*`ywJ&(WHWA(k+Od=Uk|1BFIt&5dpy|j@#!ALk{7kq!
zmk8cCr=1_K!d*IZz|KGaEezc+r5=1#hKIrS2g~vWlYGA{hdZj=yl#V}4neVMcb%2@
z5{lBP0S^VR7oyO~8i_z$%TV`&J1dzwIOI1BFE3vBIF_Km8*R92bmUN>U2WG7o#+Kv
zKwIAZX+(@*vg9_KxZ=L-h%<e5l^tte7SZPt;X$>e&Byy28yjpQ`k+;~8C?K8_n48!
zRIL~*HP?Mf8~b@L(U~Tz!HEMy7meJkjxo*7#HpfL?OIY#L?_$fC>VDuimSI45w;5|
z6nK?l&EHERQ^9*=KiQXo)>_UVq;@p%GaZ~JH`^g?o~H})JtsW4dEm&0#XT3dsg$R#
zByI&f!h-T~+8l^QbBH(y`558kZ*Icx&Qr>>xjyWwiR`CVhTnKiNhl1asylk5SUuJC
z=imL6E$ma#xIgqQWP5!rOWebk+W*NHCs5qQ+UYYbwh+%=t8u4L2|n~?8cY^3gf!NB
zo(pR#_C?DNnU~W#`j$MHu_gLyEXxo#k2qe^55&jX$xORB&1C(<&4@$Sd=_1$_d1)v
zORAR_aj?CS`;M&@{^#Z_&pwJYF}~*8#;Iw0Y!S3~Dqq<aek}%e>UbOgL7cCm>0k%<
z{rs8Om;A=+C1)OA=%6WyX1x~iFMPQ4x5k%VdWC(`?&I)-ao_M(20~!dLsVjh`z6Pq
zCyGXhs6e)UX_4G>`rE&j!2kMboxTsgm`c~v@o9^p(>i#cKa}kyuBE&1o%*ShuUNAj
zgUf0SYF{iBpGsm7zYDsRe&Z|nunkN(?9GiX?QL+_H7LiahfIVdIM{gIby@qCY<2$p
zdHYHyL*V)+3LYxUC5!3_P5XX&B`|#ETdwCjx3~5ow?e?F`X99=AEbFq=rsG_00dpK
zm+)XYhWP-zDv~y9H-9Vp-MJ%8Jg-%hRwyb#q}mYp=cDWPtp*?a^mqj@CN}k=nzou5
zVIo5Er8OK=zpyTwYDD51=nM;hL%UR6`~FjfY>jL8bnA~3*og@rjH7RaeOd#Ox-CLV
ztZbXAc^P4O2S5YYsN@9x(EH1|FA4M{%wC-pf!>stu6<q}#97g(9Gbj}g^1ICSvtk=
z=w%i~nywWzQn0du=H4K1w=cfgLMUk%?0ijWJtg44hYfA+KFss&R?V{MJEi~)$2Dw&
z-}(09qCn$P>=FeQF_0Xk)=irt+JQ*>=m)o1^TI_zWwiu~hz^KG&>69B(GKC;lh;5-
z-9mt!HVd)}>1ZZ{{N_VxjG5KhTzxlN!LA%iVV@7DcBluh{a(tfsh8RVU5<K<)W}uu
z)yw^FT9=QoNZ1z!8kpL3sC9Jx-Wc|(nV~6h)k>I0YTYPj<A_e|DwW|8rl|6Ghs=!A
zi14rqoZ;(Nl7P%Am~uA?1gvg3@VSMc_u8uc&^FVw$g^2mt}hw)^cN%}fK~+vZCQN5
zLvIegcHu|SBk2+!pnUfd_?yVbB1f3spF+>|I7A|R8D3{x0~3b2l8TCjhFNVQ>D2<z
zPN|RdHU=I)@H29RcP6TJ4GOqm5d7rWfwh6LctMgG_K~zdJ)mz`I}naMj2*E+W5_|N
z2*Vlqsbi^$TU~03EVSe|@L*2M^3ZVtFWOM>Q6&b1{Vn(*LZn48Zc9W-6^c$aI0y{s
z#9eDInxa)yRTo|bw#$2Lqp=ST5K4x}j~mNt{`5<)-M9DoAmwL$!qDulK+XV!C0C%~
z_o=CzH=u5hyUlMM4TO}i{FCmPdMwtr)7V~)Sj4-O`>uUGGwh}9<9!ISLcPj{4uFhy
z<)b?p1+pNjx#WgOg%MyFYR(Zu`tu0Sbz<|;0a`MqGHE}ICaQ%*fNT2lakb<&ofTk`
zY$lt{!C1s0PC!Ks8OT_2NZlxFYROtwQtd(+Y&Bq)*2DDs^=^HCRtaVWgF2s2CQx7u
zk0erbR~iL#)mab_^zyFk3Gk_GXsD~J<aY$r5XN1>D}Cw&Jg^QQpxZr!;Q2dL$+&P7
zyvTx7x$uv9el~apm2+sKRh~FqB0aP3_=h7Be6O27fuX7O@o}U~@Mp5Y-s$sR-DtS{
zTviz908w&BUiT0AOBP(}0t56r|LDf|FAe{*MaV$820ucaeV?%fYH_z^uOu%{Zg_2F
z*m;rr0Nse8<BlTv$lp8=UDA~JZ%zUJh+Kvu(5UEgSJY1B+}~nR?Un%-5{}G$CL79<
zB@kmkc$=&>CFl!jy>=svY)6&?+gh$0KR+Ixj+u+$Jy$t_)J6W}lS?w)U&o8>IprQX
zr0d`B&}>u{0Uwg|>lO!=EU_5W<YuO=!a4n*Kxt6r<tEsZUXk_#b2JtfL7ApwCd>?d
zZt_DTb&JL1Fm8fJZVWDnT+#w6!n{2$?hN0rZUY)+b@8@v`g5TuuEjCHZJ04)I|Os3
z9U8QRRl~smv=#J*S9w3FO2-Nnt1qw)<C?NX%i;G!V&2ojG;Te6^$La!ym0<J<u>n&
zs0$C;#$cnD<4L78I@iS!e?8RyR$13rWBWh1bP8>nvc!E116a=oAVOOocOmjz=iHK|
zp1CJ<>cGx=2S6=v6Y7@8A1@?ApS`lT&$->Jw9~RLBP`SJ5a6&0>I>XViD|mh<$kS>
z)*TAi>*U&gcB0=@i*F}}rCOP6phdCdp{?qXZexnxS4@l$X8ZZ`=SEliM<2{Mp3Yng
z6~XlHR|P&T4>ha9GdQ35xBYQ1UNsI)QBtGpV8@s&_0}))K1@Bqmd3`V_A2D(?B{)#
zuxk<hS0lpyb~t5ZlWqT%4>Gyz>~2I8`3*4id#J`fQ)=RJ(wacLT-OP`{X6Ez)oGIj
z?gca#M$Y<K8qeH_Z_nH5`(s?(T{NqnxKQA{`&IX21}xG0NO24ZjiYCY0r1%HNFn?x
zLM3>qg~b94m|5t%faL+n%l|-!pA)h>UMum<u(C~^DmrQ)QV17&TUC|q&b_Lq(Z0Ou
z{T$3>g?;TSvQ!rpHox>p@rIR8@sLrAg5(AuY$Zd`cJ%62*N?KET~t}PT+a?23hbQu
zP68uc$%ES~=Q{h2YI8LT`+ES2@LviqPSLS;xxN||rUFRank#2pP&R+SZFPT2#s<Mn
zfB6;fE9j&{WTukCS^D9Ps3CnBY1xkT`wbgIvvtIk0Kf7Q(RUTTcVm|<JDXd2EK!u0
zKHCphEUY4LCagXHICk#64Bh$As|Dh4cCX`P(1OGYMj}r>VtSza2otHaYxl*=OZfji
zs4%O;2=I%y(OSi&^uoOo^+M7J(CN8F1IME(SG#rM)6Z#th(WW620DFkxDkfzj(j!^
z?wY4sZxIKE=;&TpveG4c?^9dgYPy+BrnM<%ZWX85$j+u_?RrmnU2B`!S~zCvKmxRD
zQ^G9#g%$u4S^*oAwiGQ;?{qKhHIUK{0&=Gs8&@8@QuqERLKh$>ndk2EIV(qOf4aQ`
z2tGMQnRNjMA|U9<qfxN%B|PQitDvsn1{leJqS9VBi4}{{kHp1i^G?UZ+0JuqMn;W+
zPF8GAFY1$0-RFv9L_Ykh>89EgLfnW2bXr^teoFO*zV|CUOdmy{SWcbwyvKwxST6XI
zO!3qQ9sy|7%~ixM{cU8mL!SnZj}jW}SON0fUj^c*{Mx$^%RF^M&eohS(`!-u(q-XR
z?WIKV>$CU73`VV^i}F$)9M6klTVNm`Jo|iJt8=?^`n+7ys_wk)^3LolgI&<zH2FG|
zHH*Iu0p<Na-g`NL`mD7L+_Da#%kAxRBMnwcX6KL^+*<J}mbF=5J|%<>gvLYk0lIYI
zK#5G}gmHQwa_M~8X$X0YzUQIR-+PQ!KECArv!PyW0P6RtjTM^iUv>ALfoc>W7GwJX
z0iprs>-xe!kc8~EF3mBIna6(zI1gG(3C^kCST~D+7T5hP?5pizUrpo5yXx>}`#?&p
z#?L|tPVb}No^HQWEpRSt8(>~G(jt4)2B*0=7L$OtVA@vxm2y9TzDQv6*fp-6UEabi
z@-3>^x7!rmm`4QX^qu*P3+FCNgzdc>w}&6$&bkAS)LRVdQB&obuIYCSi51kW4#2x#
z-<mc!bQ4#Hpv!x9iTY*J<Z8pdBWamhbW)=>%iu3R0-%wQQuBw_9~GKI^3Tk3g3Fuv
z--4p_dvgzr?OkuFrKMUa%tQIY3g!OQ+Ltf8j4`(Jcl`Y?Q#5V<c<3mbhZLdQ_pWyJ
zo;*^oXJNYnC<m`mK%i{q+ivRwILQ1iYkqnze`kG5ZL%I4+wK0y?c8;%9Dx|Pu({Hc
z!cx{M#8pW{L4qK`4Wy<^6DFdON4~r{`#-f4TuQSH%bW~c5G0vl`(A2vl^N;z-khs}
zS}C8%MU$e{`&sqmJS;Bia^c!JM#CH#YsIwZw?I!Z<%wT~iNlOd47OTetzZJ6XqUz3
z1jYixnz9W8)pVHbsAg3bdM-q!VWjWD_B2ekb-TClfbX~82Va?vq{r5^mC*hoFsc8(
z;oGCPIp8bf7{h)(JRcbCddO!8HK<NNY3yg-@d!g6d{!l>PLSJnO>&<0S{mrh0XN>%
z$OSI0e`p<~g)TXSd!mQu@U9ikldV?Wae*$TPEec#kRW#ZjwaO^P{N;`7e~6gzi0Sw
zTa>`xPeRC&@kjx0S9ULpxbRbFsSi`>yqdoBXMyX(16U_s%0a}5;g`w@4~STgEoIVD
zCwnJf#v4qHU4!)9+?*Vx`MEjWV4!l$nt!u6UMYBeYY>#!1Bq?#!Hna=@i1cX!_V2O
zZ7I$YgT8D;?_bBOHv%GAM_Q<3OlI`V%e#|{(fbwzBl`0o?Ehp02iwCy+5cB3%u;~u
z<{m4qAZY3+FT+>c<ZMY;ez@cQpG)z;yrD*uL#61upTZAEz?MIXZ{e=}79ggu(c;z-
z$AGp>0f3g}*4LD9KHAxo{eoRQHK1`dpC@1qUnhwiO;o*PW_N1nRTSBP?7=;UAVv2#
zEckEOuPU8`h6F0(;NlhoA7lzWdM8^8s;f10Hug8iyjmraLk6zJugmvc79fN+g6=vF
zd_<o&K4~o}&4Jo{zhZ1?=oVFS6lr{GF}T0ZoI~=o(sqU~a5^4u`&r-6@N-Bj@D()x
zV`q}4?nKu2&D|U<e({)=F&O?=wI1<)k@AhhJ_2*~vB5d?8XeJ1XwTUt$;B;mWm;=C
zUlOdI*Qu@qL1cCXx4kM18k0-uo#*5_X&O>E*d3Hy>kOa1ybFZK!{@fL1|MB<p0cYB
zbQ$^aY*QEy$%S9MKGE+0GbeNL{={{j!_&5l@-ocZ)*gO3IyzxCa_fcv30{DP<AU3b
zuUMZye~p35Sdbuxv!Ra>Asrx^gJ#UG3Tf~YbWDC454{5Oi!a8aCHvy-e9KK@U?f9%
z{-WYUKQiWwS74j4<iQLJ#17DLnr(nf(%Ze43){Q}>M>!QaEt-z5Z-I3!aY&-;tA`-
zAmX>7`6~Fc2S;L*YJc&VwLD;nmxf&591VGu&;l1d=KuYCW~RFlvLfbp{I%Ol$q3zd
z^VP%VCZ~r~zr`bMcqL#5;V$#=g13mWmoMLLFuWEeb5q4W1=E2-PHO6MNj`Fs;kxki
z|KCqN_d(#M_i8P$FPJ&p!R<D)@p8kJfS?H?J4%5&MtwtI;&^OMj*vX7#6d#rpZn{b
zpgun979;D|`&d#2TG_f`Dg%UYclX&RcvGe$oBrgh2P;{Yi%o|Ig)VkvD2cB2cc}t@
zwlNyxAyTFjGbvv;;MJR?5MCqAEPm`N2lMhKqO78#x*0zFiwX0$(WL!H@F3NCmew~=
zAPk6+hy$P&^k*XfptF5Dj=IKxft|~>3z!@ttzV~r)=skpT9ymXf!iS_1sD)y6Ho{m
zqJE_seWyGVGYMIL`zox<-j{Auj7;O5sgc8oR4``JX$2hwwkctI$s=KrPPO3b9#wz>
zvN@s?BH-c3@<D(I*bKwORgE#1u7>&l{{0*Jx94=A&2C$#p1yeTiF}R2zQ^5hRme9j
zN8QaDE|EUq*&^%D^5|635!xo#J_>hH57_kh^0BX(8T+xKHc-``orhjNGhvOmDAx?G
zytU4bZAUgF8IDG3WU(n2&Lp#c0fz?TM%EewWfNFf5<ym!+o@Ab+df@PH}|%d-Krb3
z4gtDtW0(><mysy&=_A>|2Kkuoo(bWi6R~*fw^R2?(Zg17bS~mDwq-Ytp73wv|NQCO
zLsq0l>YP{f%<P^Q1_ZdIN~?s|3{2+i!WdUWf`jM03^(>e8gKu<qKe6?CxXVZh^GqT
z*+F&N@FbKWMyn)T8z_pOuQ^}f7M^Y^zx+mllYdvLL9m$LSW2XDOH!^3_b3RM;*^#x
z4aP^-05&`*k|AQOOOu5a=f9$9vN7A=q2qr1bXP+Fcq9gY*-lWqNhNVg96VHY?hvAi
zfu$-v3G1j);jyjLAt?jXJ1aD{4ruBF+E4UBec<jOP$OpD=HT0PQd$?&yp~`YDqg?U
zuFQocr++!1o9MVF&l)tcuG{zq7&OSJsLiY`*KaIuc7)FUi}b_(T1k$aEek*K!p!=>
z)^WtG_bKwg^nAMnT`|$XhB=97?Rfnic*acVr`fK-fW2zBeSg~Rst?`A%GNtin=L~{
z<ab=-4SD1%#~S`Te{pL+K;fB8ZT_(AuZ$fGVZBqHyigwdUdfF9MuYQ~U9&p<5t;DZ
z?<Ks!Y}OxatUN!V$LB$DX!d_cjRu6Q3A&j4+BUj{qa|^GV@TI<a}X=#%5%YOyLoxR
zz$5hv1S0{LvJR9!mCO1b@(&7>nQZ`PXnPuy%`($<uvTjDFx|Y{A@l`()DiJxWb1{F
z&-+H?Q*3Xe(7HzNl*k&*4KlYcNoPW7h)UP~449S}p+GTfzPDOGt><-bANQHY%~1fZ
z_#`3Dkwz}kOrO_4-T>EZQekhqz*P?=ea*4Z)yUb3D{ns<V`w^_z`_1vL@sWICi$cZ
z_8aiw8bDh`12`1yNni3^``9ZUdNs$&VtcLn<Wv)S<nHynACdxwKeIu`_o2<%ci^2m
zrmnrWoWYMlWd2JwAAkQ3?g9i|upx6K+$?s)7RXDQni3ugm#<M7Vx({-wihlKJ?YF$
zXS?hDw5le*lg^NbeN4_d+_e}9VWfZtIZ)k()TA4}x0Uj0)_&qnUBgnWa=pjb;!~xa
zt3-9Dhd1Sd7JM>FFA?q`$K;u}x_@(~UzK9M1gzy_c6&Oh-<&ygJKu>!R&zi;Lc0OH
zb3iMg|2{0+tME}oGrhe%ZXc=GA4kw;j<#(DSFy9)3lp)o02I11^bF8}A0UcQE4VM>
zParU^G?_ZY)0G~DoYNc)e9US>YOJZBRFsY!6dFH3Ms81OHo2Ac>Slh*7Musjn0LzH
z275GbUKXvq-3^-~cIM!@cF~{Pe1pI^p_N5{iC%bz_Yl!)SdZCJ+%Wq1s`s4EZM;Yz
zyf@Wn0ko2wwBpv{X58#|bbmOlpbA+51Jt&PO=q!PTW}$bs$9?iDjK$S-pnFCiD%i1
z>;^>5fWYD5(Hq#~)>ALpt;Za^+xaO`ETWZTG|kK?EG!Hz3|oxS$#jKJDDceA{r<gF
zeeWb+gj?Z1R`1^`(iUMN$wIVnhk@fb_fPdWY2F{%2ttP4_Btq#5{ceT;x^qTtTuD=
z^KY-*+vK@iALuQpb4Nk01-DJaoJ>YPgudSZOZ{B_%mus#b-ZJ>Q%iJK%2Bl`KxQn`
z$c*K2JnTR!xhYPTzQ|g)N4<_<y;J<i&k0km`EV=VbhXp}Qe|qw9FDFy{u0MpwuJ58
z!EODGZxD~IgYCwjw=QuUBOQh=hK#Av!y8rwU$F;kaaD~Df%Vk?KGlJZW_pqHtYx)`
zj?K^8u3!iS&E=s+fs_AjZ6}UHBpiMi3Yv1YOLimfqubp9aR7x3v%)5>(^EbI)1(@2
zZEAI*FY-3Or-B`xj*!hcQ;R!?kzEH3Vr12v^mXbGymg#T9gfmPKJuopdKUm%_w%;^
zO0)0egG+IO0i3RR-f`gKaa!*L#ySOmVXSy{SeLt_bC0)?NFYik#(*R8G0YRQANBk9
z@Yq2$YX(VxP(zw33cdq<06Ni>Y+t^y56L<UH?g9|GOE?by0vE&%<O73;7twyU!>5O
z8sKwkZ14S^=HDA>`(;>oYnZ3-e4>ehjJUaJz;E*82ar$pa$j74_rVrm(8!UrRef0Z
zwh`U>M`po_c?MXQI+Ng6s28Z9mFt%K=^bo|Pxi3C7Z#MPA0_v;lLVJ7moB0s5zXw~
z7YQQ{G27miRStk~+B3-;)63?4SzcbRVnZr0@c;82qnjehOHT=>a2dUx;lnb%57XS(
zbn3W!)D6@F^H0~98DpevMRY)I<gwzVYexTc(Tji#OmJeMaP{ITU?gVRwCc@6D}88u
z7VQZV(&(va0BG!kaH-t*3}my81lJ4E1B?_laV}~+G=cyVk88dhtM24l5cE{*xyP+#
zSgI#S4ga^RNWNxbTp$ZJ>LoqInotFw1p|@~WNTfWlxd&EzNr|z)o;*as8Lu&K=DO6
zr5t=dkeVRVs@b^A>3hAE`+d6s3H_i=?YbCENj)YkKux#QA0(>?GkDvNc%ce(W>U|V
zi&%f{U1r^s)-ENEg3iFi^#_voi#<@dDd3vc=ocefleX$7jxAPBjQM<0%zVe8IylrE
z##$;BV?>BJr!|@JRvT<@a~{d0!C1CCYSvBMk9m92%-V0v^D1#jSO|NYkzLOD`ug5~
z8x*6kkpMOM+taz9qFEkZ^7|evw_J#7kH%5?vw>fikDiWy*<8pgS?Af5(NsOJJeCl(
za&lerD!rnzd13IMvejhWmG@==paANL@xLG}9~(f!vy}D5BN?@KKm5qGc>2c>Ne-so
zsnI{pfx10ZMGm3kv7J$FP7OO`mOG3Vw5IuBa#nlJfRVrwaJ{rY?Ps1{-xOh$Ua2X3
zl=FYjtcB+22nXlmu)60_s54I6Fz=0=VIYkG9Ey=8n8AI%(7U{9*kGecGHu9skrT3-
z0z#YKg-A}`T`W2>I?&~Iu@vaI&4g6?4#_h5*E)@ts+0(6Us(Tu_A{6D#<L3&RP@D2
zcFs)?-wvdA{&uTCqZ0#9%!$IC@1+VymH@N!a4G7dt?D`L@r{CN_GP$vf$ks#J;E;H
z27i)=Yh|q#%ZuH?hcxTa<_jMAZ77)W85+>n7I)&-cUc`T$SHCTV76*bl8yZ|j7YJ+
zW0Nga&$)Q&(2B)fe!1IR!0|o5m8ZNp4<^txUDG2$5hn2)?<G=VXlTS8PR15(!b4IP
zZQ|axJzeOvYcCusQxdid^mNa24&>i(WE$H&RDK}WkeJoVl9G2J*w=l*{`uB$TaD0I
zRz?V6m!J4~pdvL`1F|avoa$gM_+Od<@t?Fod+CQ`PyVrW*kdG$JI9XN)|xmo)kQi;
zH}E}k>cFTE-{(?jVI`M6e|};*)z-8O;e_rHVxxGr&-5y^son&aNBwb|JlMUatD1z>
zpNcl+2FGN2r1))<`D746O}-dr{()FQh-W}<PY@@tg8D@jGLg0pW|sL6nI(zh`AapC
zoDPzbaYxA7kfv@htM^?*3Z7mxRp{Nt`@>nctI><v1&S>)h)S{!8j%pDGnY#zL4QFc
z9*UdFn!YCH(G#2pb2gAMIK%K!zbkuxy}!3-GhPZcd(4~6{o<Gag=ckj%V+9MeQ4wV
zUaH0n<C2V42MDgs5E8A^^K=S0>ExaSi$5jE#`4*J=XAEm<;#^k8>7wqpnnAm@WHyZ
z!o>*6_lMZxGom1R9w~uP@ClfhMZ8r?<MnqYi_xy_Com(N(H`S@X6jLDuK6P1Ni{sU
z4h}Y(?DRy_xa0=m=e=K<Ot<TiDVv}Wy8J?rxrNKEKX4TNT!pHGVgtSde`ze{B9O3l
zIY_VtwXz|USj?60V=4MOH+7U$uaVD_kKmXvB2`M>Tv*8%3mVMd2Cm?NMeUIYW6P0<
z0>)NOk;Dyf@o@4S;y4$$-e}a6_ykUIkSjsZpqbl~Kv9$`k`CKc!XRuyN7m^Hs0NEB
zckcz>LJ%L|A3-VHW3p8FQ7u;oPa_F<l0&c!!;<a!ySIG~c}FeDURC}yGx)L|;tl#;
zMY10_S0R6IfEN<H9|K=RX!}l?=RRF7Tm~47HCty1gOQ@;6A7C;iNN}5K11KOL1Zv)
z(UP)F<sB`#d`j1!J5}t28UOWI-{YTX-<rO)!jVFe&)Y}XVqvfBYgfu&yUYISjbcUi
z<ys%tYn1T7nZ6Z}Z?FCma^$O>TsYpX+@ur|1c&oLkhp4ndOqUvuXcSxq!WUruznU6
zEwU(QijHY6GPoMP8_Gg~8J^l$eyZ6ZmwM({$Q_S&VNG|r1+QJbmkp(GI(N@j^`3j<
z0=&t2imnAo$pe}Zb(d`lTJQQg9fP1ndTUzRWg`^#Hnz7#aSE%qv;P+nu`EJxTgjI;
zc@ZPu{q)Y8BFED?asn!IuRkeK+QbejfADhWms{)^eNJ61Sx9nbEBgp94+Uo#j5ZW7
z&o<0sa24&FhmAx7b41?~z|e-hVkA-c@_Fq9*ZV@8MeH*Lgb1o}vh6sHZknJnki9Qg
zYoUL~Y{m0kfLa39P}g^)$VjsP?!XMKsM}sUJ&Dkz9F-_2=Isagvo7z*_>S>j<U4(F
zg>O-uzfR-75J>c@(5Ij<*~IP4lnyU@AHe_#a}uEFCu&5g9qtox!k#KfScS$Is9;)$
zDh_E#o!0bHcRg)}>zd4XPHTks&jF$6qhVg#`hD%Yu7uQtkn>zK#etU`N+tqxloq6V
zhAF_y=d88(4ZWy}k*;7&6I$f&xxc%BDLxqgNj(@}Yil&vtnGQQP-~kWsQgkf`rL;q
zi|d|P(@>4IKy%x3^-vbXBfQ|eD5;PIT-{jszg44muGu5i%tT)NG`Y*@xC&eML$s_S
zAKNKogNxw~d+GnY>$P2~7J9(W2xp8n_b`4EKhY5s3kEaqWNd^Cc$iIHTqa{da`%{6
z6a&7LF^PY9t=8;5SWbsWZtf2Uq(5P>f6Q}t6}CM{&w}VU=$Z~0By_>(br~)!+%jtB
zf`3xUFnZJ$auOMLEhlQ*!%SIk47U37Ui<{2`<mz?(=75g68?uO6r<f3F$Rk=WGEL^
zk+S_%#qJHojsoHBNz3%4;TQZkVPZ$M*0E2*YOep3$`MrIfkNeAUys>;y@Roerf`hl
zL%W(~K(D*LfpR=+a>-9H*X41JwAnQN-clchu8OjQ`5TRdJsbWB>><+XNEiNm>qstB
z(E5`6MLrmXP5`it4Lq)p`77Mkh@qv6XBiEzsK;m!+;NJSKupeYvec`vdH4DHeG=&>
zO^tJ(oA`Q0>~DR^YOg^)88liSlv%*O%&Yp(w{WCxt0}807sHW1A4~M@g#DIU^a#7K
z5>ttA{1(gdk5~c6n`PxYygyLTQn(le5#!FObe^C9f3_q-v%n6nzZUg0nq&})_dQLD
z-AYpTB<;`yNk&J5U73nzH3^qtz;<DkbSL3>=~F^Pxb{)4%fTTb5rHf??_hvZ&j0K&
zn%1xn)xAekFI}->@zbGS3|R*Kxtp46*<>U)dUPuoTM{}ytssIY93!UG3RU9~#s+!H
znCd9|&;iZj=bx0DMn)Aunx#72m}r1iFG2J6P<rGA#uVBWCc-QoGU6DmLT|W}bu?Ys
z48ZF){5J%n`s@mm!<_O__zy5k6cV;KJ1Zm-85(@Bw>=ZX%8R2v`;!S+?n11FB@U3B
zg8XK7-C&E7B~#|*dFh8Zgw|3sqnIs7$joXRfA$mT?_M;-#KDZIr#DKfmi@!GoHB?q
zS^ItM9jVJgmESf&$$QbR^45>zD>t(mBaFq?uB@Q@-j%;;f67#oS8t)(DkQ*Ii@I?k
zvKN+7I!(3ZAb75H>nSx~JK77m$vO~pRz-l0!tkrN(R1_(p=lQKVPx?A^6Gn?W81ZX
zXNkH%N*s=q`}%Jm1ILy`znAJ*KikCZ!;#T=(-|!o9mre+D{CZ-osW<gnEi!Z-+Gee
zc&nIK`^l29DwILwn-X^f8e-%MCnHH^R<Q2USd45`BtcuT7-o;hg&Ud}zIz^JAM(s~
zf^U`9M{Zc`NRcH*gf}dYD}KAtVmG>yN#kh3-UdR8;eU!qZ%0B`yQbLQG|oJS&*CZw
zVQ>uuv(~}Z1UNO9SbSHIC;9SSP(7b#O0J>=Mts4_4~v`=5ZMtOh{4<@KOhvePhA~h
zTwuXSLN1e-9Dq^dPO_>}{gsa>h~B;y52dwj)lX9j!H?Rk6frg<AFZfgIm<hMd&#k1
ztAXUx28O)(hYaF!<N39~+TK<-w(l8oNGgS<1}2xFeJMv5tVrC*;}Zuwol~Ndv2G&0
zy^oPYls!0_sMN}{@o7=8)Ny`fs}c8-nvXrY%tkh;SBCa}jJ4L4_*NXYl3rNldOAlV
z@4=QQTy}pUpy`d<sGEH`+4tAPgQId0&N%<XFJSXx#SD<0@_t+0-K~8ove?jh`bQ=L
z1OgcRjktMPqQ%{OYkUpQYgH~X^rf#aGq^>FKg@<+;+WOfSpCMArOY1%3e+@#WkEIV
zm24;5*C#{<zX(CdGODgUv8T(tj?t>SR??e=mwzPIR&#q%qws8xL$m!}7L$dCRznFk
z)%l+8Fm^TCD$eotWU+_<g!}#b(xsv73Al&<@;R;Wy-=7A@ELo2R1{blSIH1VWwOVu
zY`vY1H4Hycy8AEg0~T(Y2S%c#7tQfsoNmh{Xz*DJ1`SDw*u%rhEpX9RkQ(6_ao_3g
zlN2(Lh%9&`1NC_0`N+!OL%2&2R^FP3M-!BLnxi-S0r<=!79&V%v9gq`IA5T2_qMGV
zXuOn>w+#JSyiJ#5;4Fr$7zv01)B;{Le)Cr`--3Mi+dL387Xne5O;^fa-2y+eJ5_9f
zX`1|2ToS_<3zz9|n-A{G++l}5LI`;S5mDPCMRpc|5RZP=`TI{{blXoNeI5cy_EEav
zx)=Eb^s(b=PJcFnH5o;P^71{XTiXNUMGo4sySAF9{oB4R-X`v+%m*ogdBWXhgor>d
zE}gl`rR0G6HtVbhb*Fv;|L4@uDnJ@OTBp<Zw>JO)ZPr2%jFc(7h+xbf4Ti~rU<nZf
zHCzgulW4Hu?szlC_lsrtO8Pggl~JN{MXv9-!yvetFYSioFqpXsaV6>x!rMU6&;V%G
zijq;@q1fS8=TZ?Y>^(V1cab)*hPacYy(`FuxU1qC#TT7kq_@lU-|R;)3C;`YUM&E+
z=JMzhKr&BLWz!=;$^VuZ?&ArR^QWn2lg{3rDo_9NNQAw!9i>EW^~w3C+<MN!8Tn37
z-h;`S!9^>hiwSCISYCeQb)p!1A6TZ_{Xyi+S$?u@*$%F}1OSP1cO3eII&P;B_^Unv
zKiN7lFx>P`-nWy#E^+Q(gv7vm!s3szj&*}>_NE%vNgQd?5g^9saxpJm!6a%{KpZjB
zc;Ba}a3GY_9PgOSczyw1h5U6aXa_$o>cK`lAJHjInw@Fsi>;#zVpA_v3V{Fj(h<_S
z8#YJlt_VpQi$HxfPJW+-W9g_Y*4UR8*NqwVis3P8<YVx6sTlSmwrJ>xE^f>aRGku2
z=#jP)EX!QcMSx8vL*&UC-sVNgcPp8_q2fvP!`#J!<RfH#`;4gHcrb91=jKkEVhcFZ
z%|y@4@F=uXpby!_>#3F}+)L^xx4ebKzAQma?A7)OW)UyCl|=1;PT?j4x3OwT95v{r
zVwh0si9eZko~)P4`^YDumj+~t#qHhum^(2fqiN-li;jmo{kf|!BEs@^-22$oj+e|)
z0yE^j94)0y&VXaqj*~^bJ;3o|ztiR0vd(<|L8mx;VQG#uz3uMeK(->p!1=b<DLk==
zq|G@{o?ZKEDD6oNpx^4+UNtuj>j=pVh;DU=U%O5)j$9}8L+`I3%BkD;l{mclqQw^x
zu}}{{O#{!yW<(n>Uxo0hAjexQ5(D_pNH6G|Yacn&)KlLt(i!W9+DrB1G~~sCj$lE;
zTky$?E9rBKi7rQfFE)7IylJw3>=p<`fWJo4<>-e6mo+pG%P{{zD1w6Rx&$bzurH+N
z)9YkVk=M(b%a;pJ5mkS%wHF9z+bmeWy564XcIDEgtQ+UhQ$qI>=shCB21(z@Aq`(1
zKPhK1r^e3Np3kiTL#+tOBOP9x_(vcUr;Qd!98hi^rg)%W6$z_t1$Ne-*YzCW2ZNgi
zp!EnQ^VOemGBZmGGbcqDa`^G@?WWKts?VN$dUgelrdy>kjcrVwSzqx9j!BSpjgExQ
znqwy8Z-`0;v(XbLI5tqw0{A`-2B+h;k`(-(v5KliLqwK<H7_GPtL~HMag$4vh{_^f
z3VLt5C!+eD$jqC_Y~(p@s2F?;(P#)aa>%xYcq(pxzw+70KB^fXj9gGRpBTjp;{E<1
z$io}QccMw}d$`j~M;|hu5sZ<5+M$$_lVoGhp`fAm2nMn>?nBW**RuB<r9SL%whho5
zH~qIu3&XW(;!?HcpM6v-!lXES50r;8^$Y&5*hO=XLHpW?&}-JB6=LT<ydxW+J^tFw
zmpM1Hc23ST!AC3ifm-ikR>Xvo0?doIR1sHaX>u~%-KxtdEoAjIgOQ#KmU?gfM5yNo
ze(-g~ukoP)<|ugC@Cr!sFwQgR$#$JBzDFZ7DKvXtLZ}JL2F*ZOJ?Ti_b9eVcICtd!
zR;Pg@C^sj@D<)cxH^RbQk2!OWMB(-*dYF>-NENnz346Q=EZ&LW>l`s6R*^oPkd#&`
z*H)XonFIzes6~lQxy2509oheN-h?AiBc-i)_VKuskjY;^yQIytE3Zt@QI7}c$ZX6k
zrfQ$0vDCtUrvT5rTkh6P|0-8$xMt9PJUy?r1aiyE%km9dsF1vmTR=cfl9w!6;0@c8
zeaClxZbIx6(mciDh058Fzw}r~O94;QIWFC$=3Owx*FVN=s+;u*JGs(Mh<KJ)OK9O5
zy+p`*Pzs-w{-EQ^UG*CVyZfM&?o&iBb`|}IK<5-e6~ldnwP*yRJUPNSHhvTer}hZ{
zw%2GUvb<xqTzt@Z0lz#N%tq|;_WW;ZNjzy}p0Z{gIY3{Uc8}>ign@;OL_HdhiDpky
z3)@*cS#3zh&%#=HzJa@m9)bXriHvzU=D9Rk2r3JYsO0E>Sii+WWM*JXrkvA-hMS}t
z2dn&fAj01N04zA^y#{o!*CCN6kQ%`hZ-hGLW>mIRhh`fMC0YW&eP5m*_+hhfps3Eu
z!^2s;7YMoll~x}%Shq@UXrzi6tA6*=x@4@wa?H;PHCz71oUScM{I22k7(uou?wQKI
zw+1mf+q)@@oc-+^D7KfJ)KVIB?~uEgGTXMyd`4_RY~Ax|Pz271x}A!>OM-u*v88np
zgs10F6bSFlO0m(C)=~7c)YI)j%X_w9I%lknVnr5E9A6*n!3RRcCCIAZ54qWc{wU{p
z!+#*)5=x(|$!7+VcVh{0E;Lr8jn)BF=q&`tE-`;SGHvQH3z(m`TAL%dHqIx0n+g-b
zIQ@?Rk~SdvLeTXQB-7;rBr{b{>fTS9w!N!CG9bi}u8zP&qH)FBU0&hNyPN8F$WuX%
z;HQi|qpc%wSb1!we5LzTF>FZ4-uNU46_)Ji_y)pIfa80#Cgu)@w&u4A%J9<McSlgG
zVO9S2rGGxyIZ)SBL3Gs{a)}Rrf!V|ZYg`BQq>V0|{s~dssO6n4*iCVlzZsj!P)^Vx
zcug=Z*F$ARTMzEMR;b8LJtxZ*3slbS=UcmHuBBeQbZN|Idos(QkWHZbRFA{C!sj#8
zB;~%bo5();LJ(rIH8sO;w3zLKWExY^%Yh2rZ%kPX2wNFS;>0&gwUk7m_l%afp~)|m
zgKES!9_;^AX1%pSqPux}`c2W6{>;9ul0H>rrf9HGEwywHTd&pqzs|Gz4z3gZg&u^-
zq}RUjkX0|>6=<%F*B$`SsVT3)=UmMm$cadk>j1b`x{ZH?_ig^ck|p@Zt9)^$#iS@!
zo?DgKSa7;9B76({)}FhDsS|P!;Sq>Rv>$!~*2?iGbvn;C`DGFb(!z|DBqIs8;7f>V
z<PY9;`|h79NrL$8?^>n;aX7{zCL+w<(WK>9g(59kAzy$h^6i|rh_N#HOrJpVCaB3q
zAUe9R1qm*+-#c;UNHutWhd;&djZ%%Tu{=#Ky{*%92z23g5pZnJ>WW$02MsBV?~JWv
z)?}N+qf~nS0EgUze9h@367w=w)2qgvTf9fpDmc!=8Q4b|E0_$A^sx1d#Hh`|DD16D
z-<&C=HZ`L?%#J$5vc42rIRJC33!H-11jd`BPvPv1QF#LWgzP_{<9_Wd9!M1(hqika
zsBYq23BPA)Vs1i!Z9IytC*L_(8%1>(+v?E#ybjGmCiiGj(PUNbcx0kB2;pgaSu=Wz
z`Ua3QV+#_!BkZH>5L1tyx|C=4+^2;|G77%&2<)+XuM*idCc;`!q)Osq<m#F0GB%w$
zQo*Mg0@jxABn#Rdf3lm{)10~N=yHtkgaK4bM4Rs<g_r?p-0mmcH?BQ5POI*k9#;_n
zFXijJsd=9UT>d}S9yuSml+fE@9UnvGENuH;L|=4b)r*HSgl)VjY*4ZJQ^0}Onf@tl
zk>fWFBIPel>m|v)uS+^FeaocPS6mutY-_RR>U_M3aDe+>Y%PN4Fpc0+8LzG#l|SpD
z4>jg~=6Ajuz2#GIxfU0X=2@Ld%L-uiQSAaLD9+A>mX_w^tNX0pm9A$zenm?N$~p|Z
z%iIkW^X25&lm6XFB!zb;HH#Zk4@SbE89s_Z$c+CfxCe&y(NL@rIu)&##%D*kP!Rk_
z&ez89F8+PX&&zPDz>jiR+Gdie*U?|7v_bU~S4{TA>_ipbY684Kp>mx3b3mMxZZ-77
zIB-X?uQ$@TK!_0`7MDt&7YP@q?6fX(b0Le1l0R$ECZ)8&0(N>51H&eixMTLB-@l&_
zA?Uz0xF_~#?)79v1(`5Gajrj~2=Oar&zae|&X78A3-)U3PTh=A>{y;}Y2H_H#@NAk
z))6frfI+P84oeYRg_>@ze?mM;%>EW_(z@H#V1$ZshjD2robj8S`HB15qR3KOOq&rP
zJG|$^Pgpb@OS@Nk+bAX$74N!Q+Y{CuqX4~$yN6L%2Vsf4-b;DjfTKJ0PJ7|xawLs^
zkxn$!je&PCiRlUy==8WW?Qf_FNENW+l%Sb`3xwzJU#T4&^ql>z-X^9Uje#9`0>u&w
zZ<A^Xrb`Qz`o$-^1<rFvi^X{5Ni2%bG!ZUssZoD=dU{sxdoR$0XA8cVNa(VlH~UB;
z{Ot0mR=pSLpi;R}pivFGK*)s?Rgbt+^LY}yS2p7}Ayhrfn>9{3O(#J(sAZtiQPV!p
z)L%Nrw7loZzgdGCCNF;p%L_dubl9V@k5%7Z=KW@+n#44%ZeyHo`=Omlwr@JoRKZr@
znLS1US9+054NqKHOQ$fo^KHl4n#kyZ2$t6uK|bw4hi2o~H=wH*6OeZfXkT~l^Z!PO
z#7@pn*+vDQG<aj*Rc04FWo&VLfc<=2#Oh#86!d*GKPfUu>ZmGwHdq<8c;3j$q`Ed2
z7Ne|mgM3=3h@HOM2b#zo>GRvv6rI^Dta2lS!4^^l-=b^i8puQ(b@q5lpVkE=_uI2-
zIIcC2WfNynQ^?ynPJ+lpZ9}d*q_+7~v@q%CF;2I>-V2S<&tvbL9I;Ia+wl%PK#R)?
z9F&_8z&4w|B|@=s*bxT&I{ler#=1~3oTK3v!_RPT7A~3ZpL{syre6C3%pzxiu}0ue
z9;yM+Z0HyDCGK4z5JUfjsgL(QOF^?PGl?HDMiLYUSc;EAq@bzrGQ=Zq_?5qAOgAk5
zU$Dl7C5@+*?N3pO(+&_^tcIpQuc9g=*3Hr>ZtpiB(;p`Y`3n7{6(Dj87aIg%04HJ^
zXG^;k%~#2K^KY(0Ag=2>o|}qO`krs<Fe(1rKWc)jpDoW|K@VCr@*wPXs%X-zPk`7+
z0Jm|i$z9i0-|1s?#+JIuBDYZsfbR+B-3Sa;T;P{`5xKKR19kh`@8t3JC*ip;$cQ7P
zSp<PnD;`aKDDfG2I#vxvbS#ia9i0V8ZA!cTp4Ry2ugZA<@tZ$u5B5Vz`9EwDhK9iZ
z&>}(ZbdiM!rU)E0pT4@Ko#h($baFF`W)bL>%YKRe5F=#3oulgLy%z^Wm%q>`2_4M>
z;+W-lu4H3$5`0l_mlEb=epbBzh7~7jKSU@@>VTysi?&DJRCRwQU0Tk!$k#r3uc!7q
z_ld6Phe6Ybw?~0&D|?1!`O%2d{51iga=wa`AXs*?sfZ(D=ua7=+p(&r=*Uw9Mr>@8
zp!`)P567^YL6YR!2Q9h>k1%IbG8B#p@>f;cY8@^)hRm<;t3avMXVx}097W}g#F8Gg
zWh7p6%>GhXmj;)32sXJaFXBb5*6tSx*y+Qg22$4H+wF_GitOkQ4(@7(bcxp-GIUll
zjI2Jlt3lF57`$nTsEXt5e)<hZnr4XcyKszXA5ze+v3saHZIX~^Z=2!zXxqc6GG)TY
zJUPo?I%-^m#rM_!$%Od#v8TO-I{TTu8S>2G<>OpN4xFx+sdu2}CSz*=TWGevPOl{W
zonk8nOb6AE)F>d8=vsx$=r*29I_T21KTn}LxU)q{gjx1o<P%;lU4kr1DH=hRgZh1J
z@$NV!pQpKgHqQl~S3iH->&<Mt6id{p0}^<Y65K45J=_?DMEU~8%o5V}NJq@a<0CgT
z$m^Ykf$gf?qTJ4gx_A_;jBt!}fzT}Q^1Y~C<Y4X=Kyr!mR2=^ED)_+@(v|+z_1lMw
zhX*|)xhPRCi$VZDnf36&eZ3vIJk?RGtM%}=xE}Z#-85RErBG3>2|j~M3F3m@3>_=S
zlUQ(}trqd!XG-voow=h0V$`5ba28byA!U&wlZMOyBE|zBm=IL*ZRbn8{&lQc0sn4y
zov=hzEr15+4k|@Ag^Pr+!ecUv+cY-z97b1c)IXr$sxY~KfQ3Ok`9qjg>@c`cU8g7d
zlgC+Ql&J0_R~ye5UnF6d57bh;lAL{da4J`Fmu^Z@Hzl&7l~0v-1jOF_c*r&RVTj#&
zNdI*?{Vg?cX8f0U%zDDiR-k3GjA6&blryGM+9t<ZfQ7_vRet>mU-@7~O^xRK%#5j8
z7TlMy_(a<|?oE)=!W9(Tu#WQ<Kuon`>R36S{U%TB9k+or@v$!y3Vz=1^xa+p^xiux
z(>zbNz$Mm4=)y}IW?z+!#RfN>#%^UEzJt)e1G69K05`Ptv{v}AX-=lTT;tU+OFMeT
zgqu5NW&bpSBui9o&bpSg;oFuH)BnQj32AKW!Fku}-@rUk1ZTM6FP-h{L_J=WaccAu
zi#HpC2w9vAvDBL6^Np7}lFg#I<eZ|{_jE>*;Dp~#i(@rpn|Y@D56?^n{MHwfo}e_P
zgk(j6BJO7`h%dH)M7gt<rP_)Wu~q<ce4#Eu2HrHzb|QQ)&}==%iq%!jU;zj#9&-8c
zJMeVlFL()VEW0ssgf~V`32RvI4am`faF*GQHyWf;)H-REWA~Ifek&HmQPD)eF-wek
z2P%>8&>Y5fEKpNYAwFu8K8gd&S0JyXIf>x~I9Diq;JP<**r51$1v295K&G#&LwABL
zPuV*Y*SPo6uvX53uGUy~3wWE_>G4>`^9MUxqCNE2SduS5V^$cXz-E&Hx?;(NYokR8
ztJAeBjjxaGQuegCJgo~(Csy5n-p18n&>eT6M7S2wLj`9LSOdR4Pm2`;5M^z{;Yd^H
zagB;B*Y*J8TiV8Mq4FZ>AwINO$^I$SKjAN_T6=?906BFl{2G+A)QF^;xctlH^+qyZ
z)=T?NlXeXdw_P3;+{lisKKlCfzN9bxYYguFw}@@DOI(!`kuvbE9s#*R#GYb`owb$g
zl#)!~-^Y}12^>+pl0i;%YGE=^jcnFf01E<F%pup~J6UCIDw8fUI8*8b<#*jg8jnO2
z>JGRQ9#r)@$Ik2yZVMBwuC84?b0_NfKoWOyM0zrNB(_;Dp`{Sx>#No@AJWyKK}MWC
z1s2#K!_yy>tRxw=gXPgZK(hTdXh=XZw7~StxK+5TbZGwdKhgi*pc*jsFVjDb;w9A2
z!6XF-G6#hUy3lvOyH1T?$ID_bV4gpr1z=5i;7Rnq1EXYFE<I4-a!r;Z-5lR))gT;)
zJC85m1DP-JdD$+)HtsbutFlLPStm(+lofa|9)o|+><ts=Cc{UwQ(mAL9tpZv`WkW=
zD)0c+WqgY)$Zfs0$wka_Z~KRE(L7HA%Q2o?yWAnH7|XjEHG66+D)82YX5aS9ao=4^
z-eBm!_KR=lz4M_soCW6n8-4ifFMVsvso+4HAmWF2-K>T@)NGnt=}AZ$OBDBF3(dZ)
za|9~~4kEW5{OY*g#6w@$s?zzOK$bvD6T@n7?hGvl34H2z0XuO~qT+AX{hdCF#go*q
z;$*Ekc^K%D?te_)j0t3nuBq?+;)K?Xw@UQ7<xrtl{{jVDUO+Nn2<^MoAVFtX8|ZF}
zrm9E$BI<iy+%zH>dDV|KfDmlAy<F?NJuhnjo&Q>}s;cS>7y61yhulNhP0jI#FYeLy
zbE5xt#8Ws|IDv^ODKD6disUmSw&su-s(z5L=rS<Lu;F39D`udd5S56@WK%%0c$K3h
z1ksTbZ`Fr`GI=~s(x)okW!kj8cHEj0L`#)f0EUGTOJ}LISiEl7al11erzwLMo|+Re
zp$}h{e%}W)uK?Y$!&1K5Jrayk0A3=eS8(~yv9>|yuyl{%ECO`Mofp6|z;SZGzxOe0
zq=nE7Tm<0S77Ui86KXV}t6G1p1wj)~I1)1d8#roiFbEp6kr@e}kgbM+QK=C4_V|_P
z$myjvn5L_!u{fTaLO3uS_XfuE?8kT8^v)n+jd&Ok5Cn$cujbxYo(?Rh?{~3w7%vdY
z=TC2yr_|9@=(Z=^;U_e#06*X>waCrv$d;jsjYL=n7+>0@>GDyjEQP@C`B>rbCF>11
zU3=>Zs@N?3*O8ID`@TBN+#c<=l}h4#gjf&z$Zvv`CThzm^Y}2O%da76meKc=u!ZFT
zDYYCf73e1y9YB5`AvO`%*j;))fgr*QDLM<J!j9<O3cS`KX}(MKnfEWZ()<m9@DObk
zfkR;95xPD`TE9abe%jA729~;n4SoHZ_Pwu9dX4-zi*M{L`$ml5Sx11q=Ptz;1l<J+
z(-2TT{?@7>95rWr17G(Zw5?))16z8z#8oW=jPG{0qe%<nBhe@q$t0qN)aci5y=lm&
z;u}7D%boFptLg$GNb>lHxAKBjGAbY<iuijKuG-<%JtXqfvd}X>*Y{XV18)_u1N<-W
zx!NSh@?q==(Rg^q%Cby_K3D+*GE{xn67E&XH6*~<K)ob>&~l%Dw~J5ak-|Tz^Zo4x
zlv;-1KN?L7&<uX^Z7ol9Y5tunb{r=4+y5U`*By`b`u=%5@)+^R&U#Q*c4cO(Y@(r%
zO^T2$dp@>=$S$KH86}ea7|AHgi0lX<BYXU=Pv?7n=bV3>KhEcz*YmkQ_kG>h^}gQM
z`<-`R_pRK1F$-a<zh!TD1rW{2FUuL%p6bix$xirOtY>QEkDRbPE1f3e$~!7at#mQ5
z7uft2Q!ip-iyc4mebk!pTzpC##w>x|Yg<N?_>k4;qp@@(V{;BXoOkw-6%BiUbAd9E
znjPnaJLck{bQMi14mG2^mj$Z~8@_;_Q12|f$<E)M6Fr-Pwbaj(9#Pimbk#Xj>c<T-
zt`%2~fwm_mIFWfH?_|0A4Uzd>aK3=ZtZAo$cVrMH<-^-P$q5(IyWMtl&#K`q_=GX$
zIbK&)CDG;D>TxxIbGj|=@zaQDfX-Uo(!9anx{)(H$<5r`?w%1|l&}zmbhL&Lijbkz
z_st41jHR;w8$@rn3p~fK)PZi;o~LB@oxQG9ah?D_l^FHyQ~urgFbj1COfyj;X4J{w
z5j8vYh1NGigM+it`X3oIh#CL4B>;2y64(|&{DxEf6iyms59AvWwlW=u`Wg?RW!w>y
z7uyldXytJK0=P=5rx3Z4fKQo~taR(rOZB0^zrJ|5=1q9flw&94?L1^8qqC>>!eLe-
z_mN(?o3enw)iO8bij0fq;H{997mbkkt*hKSl?i7Rq*2O3ukLen7zTy?tdx#TQlmg7
z*%!0rJQoWm#T8f&oi}uM|80sWTt5dBi0qsMz2ec`<A=zD2pB@M;`PDbr@WVkL}XCS
zPD3yuT~OZc>TjGrRgDbc{k`KeFJ64YnT$<Gb@L}g#6`a{_F{8wj$&Y(>?k{mc4BIa
z4506a0oYHXVQ@%>r0Jt*yEmOORIn7#0_lOV1>C;4jo<n6WbHoTiJOH51-u}QeBl$j
zmoxR%w{8M;(IV(a9~V_P*@Cc##Kmad;0&n6YhXAvKyGnEYu;tCx_NSR5F%*n(y)8#
zV~r8wv-o@G9?s9HaQuW3-4vhZO+n0dOFZZ3()!+|ihtW@Sn@|MYen0`?0eGmCl6Yy
z%;zs2P)0m6g_x~Y_a|nj%-(OTKBmCRLyvHP84|$hwHG7|`R?=SQCqdd2ymlNpV#Sl
zwbcc@JUu<{K9%iMQ!;XXJ5dW0g=M3aL|j7k$N9}LQc{WFiIN!i;{(`MY<n=D(J38M
zL@GBuc7YCc`<8^!H$sZd>fC(3<>I5HjkPdim0r$Nd>saOD^$S$BOmqr#S5J~LtjsM
zRR6Q^kmn`|fkwG07+D`(1w~Sg@_wh1(IND^Se48Wc+tO1Rvg(s(4B%Gd#b!u+pa4k
z%`!7BpHgM>ej-K8ER3e9Da`^+ykpsJyfJKgJA@Kj$0U4hYDZgxHAU`RR4UO%c2AHM
zamFYnXyWazi2f5!IS&U3`<^_#R&T|lQ>XQx1c)PnXYm?ZyK1X=`vFEhM%wG(WW>va
z0}(c~U$f<>X-{|eFwkwm)-~+D`A4oD_K&Jcil%6OC$54HdjEvfy4S}O_9@A7K!7ZH
zBBPX@=i_W?4B;#i^3-II!IN_+`!p+E0lV8mXC4>?#e$}EGdTw2FMEx~M7WQ%n*>IM
zsWkM2aN*1|jg+KZ5;z|VW$FjxFnqWItDxFI4F4LrJ4I!ZiO+046WG<Pd=gW~5;wcn
z%$H~HIlL$5*CL<3t!A(rO-qtI{O-qLvYh?CraeA7;_vM5iVR-RoBwO=@wt!Qym>&&
z9-*~*^X5$zJ3Bu16s^^3*RG+`C@rhcPPphf^<w<qQ-5ZJP5;OY;V;BsEXON<SQ2Zt
zVs5M?P;_Jlo?%Fx83M~#i%+h<CeWeg_|InJGUKta4}^`UxpUsB>S-heKC657to`#=
zB@seLmq%u;Mv?jQx-jKn%pacVDkxMuckQQR+IRL7+>E}b)<t~l^=JR@V^fe!)y8k`
z9U^$m9Y<tl{ywq;M+g-tR=Vdu7Z-KG7odX}19Bxow^=4L*X8EXCP!7LV~RHsn~1-B
zn=F5!N()h{GTmcO>xuYqEmMQdGNHNI3!PgLZr2q$r5V4<GZ<;GP1)D`GVR6<4UUdL
zXkrj~_p9+NLa~vHZl1Vrk$^*eg=q=9<|rlhI)Tj@_BaXJgis~R^y3d^WRt4z5+_^L
zT4V&s%E~rwE>CJzR8~5T!&JmSKN_p5QCkzVPWlAKW18je-o1MtDA}Rfq@@duDSGLW
zofFxJ^F#%{NHve32(P-0n9LLK=ub+Q&8ZPB`HSY2M9bA6oNff^fSUd2r%x7^Sy53@
zmUec9`NUR6pvNvle2>}zjH8azegrx1Z-<|_37G^9r;**#%LoLI46LpaGL|_Fq-w>x
zz1vZNM~@!0MJ7I8@3tJ~&qfJlAJxD+9zMwO`u=UZ;tVNbE2AP<7fHv*d$GuM(P&%x
zKkq}$&Zyd#0?ewSa&8x`Lk5A(9++s;M9^4^d!_s_NQUX)jdB_h{3leQXyBvMp1;lp
zqA4Ir$cwV1C7lB|3^Nmln>Qs~XizAMuf+sD24?$uBSpr~TC1gt1adr=7TIMKUygM5
z{vxDBq2i?OJAR-ZRq+j66`V$}v>ylUvcIX3;)D(NyqdW%rLl?mH79B|d>{MPt;I!-
zij-^bmcukjkL1AIAsOqx2R@K5QbDERz{&4^88%P_xk2D-@S*W#3v9bAc6Z&uxKD4_
zERzihKYx_iX~QVpZ97tf%Hw5-$Jv6TF)BGmIg$<CFr(*C13KDZ(1EAZKT0{4#n@pI
z2>!uF&6HoIi5XVCJ>eLnOlJm`d3zkq0<ZdzxjIyC7h<?J6)sKu<@0CokyDT-Dsxk}
z7ZFYrL|LXEn?YSXvPy6|70F<g&I=<+BE1ltF@tZjT3)6)aw81yzs~^Hl3%07&m0VS
zG-8&9++r+vVfx?R*f?E=NZ73Q9es5M=$0l%ha8!_IAaE(YR>>sKncAUNmS&Vai!A?
z2KFnYT}kdBbB19pE$2dI`F};{(a$X`2#=vYfBTmC_AzGm-GEuj^an$~7cRRdM@#fC
zU9wqa6usWD9tL$u@j^lRZJ%C{Ko2m^)gL%b6<6RT;t50RHQR_v;|T`h51#b%B-hEu
zjJ#bEvBq+PJB}}9M@5p&*#eCi>pnC-yYyU>VXT7~Z$nz!yII2(*pjdHw*u{-*R*Ui
zs&Ke^WQeqf`LWxZJ3K97z2IsmdyGs?Nqi(tH(l~Y60j2_$~NmJ_Wm3gWa@!d<9cd{
zv2K@mE8{8+V|onO!d&>4zN0r<U|$CQ2!WK?x!s~1$0kJWh3WS%Rwi7^$%G?9tR|Ue
z2D7b>LdTg&_d%Y;WdwAT%dYDx<?5lQX6rQ{W#h<ju){9h(V|w8_HJ%>mH_V<>$M-B
z?AO1A$Hm2=$#TG@$ESB-Ly1(bZSU_C5;-uXq&U)nfl{j`m_j%Cd|x+1+T}I9IlKal
z-n_E!Jz@~(&3f*u*-J!eh+Fl~sXz8IE?e9xT*nZ9$RKC|=1`hlCR_4L6C4|Zjm9L!
zi79r$W6dN`=o>I@Mmg=nEOWoLWLdVoIP*Zn^dZoz#bfF8+rICdrJ|=?BXv;JQ`}qg
zo=>M1vgXb~BsF(tdV-GI1mn0W$cKLjnvKVf-kuYvHwqh(`2G8L{&yJSt31Gcru=8K
z!BzcvOfyT1_*{p?$8lzL;>%aBrcK;dfP(>s!z>p1bK?6kCX!<C2A1xB?h5PSDzfGH
zt2emUm&2e<MNMDE;!Lls9Z2~RZtJKRtK2g%Jb#K-ACQ3evk{J_*jH||28Srtynn|g
zcL_}KP__32RndXD*u+vJh^opi!L)C{B*d(VecNV=#`LmPb(68AFBBI~VvXgumSV)0
zqy_2`FNviM5Lr!xEUdgec2sX-9-O_6^N&6dd1?KR4<*#J`k>WiAyB`v+9n|eK+-&J
zcxWgcR6)>)PuPwgZdzj}%+s8@%HuG+(<3%SEr2KM-8Bv_<rK}fVKqyxYJ7W^4JZwt
zH3+(}8As}FIHH#-)}W>cSWE?VO6KDJ<OI6s@c8<DI^y5or`y#Ow+zX<$=w`$+XV_=
zIR?_{JD#b_MuaLj-(RBWAm*PJz;PuE%)K8DFd6P$+WGlN-fVPck|;^W`ROC1R`~ni
zGamsWEz4o%`!I`FqK$^K!kV|l8<x1DE8aF@gz3;F2Qy@f3(5bOKk1u`=*1>S+B)!V
zxnCHZL`^-dPaPc@xvi@Nt|9y~2cYD<W;>J*lnIfR27+SV=AGs4GMf($?*Mmud{v#r
zt`V(8nxZo_YHJdhS{J0Ngy9sa8w;ki^}0Rw^J|C5sRdOA($Y(b0iIjora!{@<6Vky
zh2YM1%VEa8DYc6&aP9ElKOA|5@Wj)Wi3B10TObgm_v14Lv}*-~3mt={>)zP#SBS#y
z`C}0o<0WxH$^WtdJM)~6Z49ea@iC!#V(_sP=*&2)PI~z#?415=xbwMpcsf7A$<kp4
z-z}R}iPn1tK4NGE5zM1{UBQwL0e+X|_~;O4)K@I6{+a%0k;<{)6HnN@NQoajmVQxp
zVEMd-y<%mwxR7XdMEv{wsytW6f2=r#8(`CoF6|<cyVe{zdlum5n$JA5HrxAx<d}<}
zKaF`fqG7^(lZa6TFM*}6yhR-+vnY6^wHYyWbVD2>!CWR9&Qu<X5^5XX&Dq&m@gSOB
zSnd|$HrEyIBjAdcT2N947D)wkOvGESq5}YVvz~++t73tvZnL@c`Q;be#zr)jVdG6q
zpjn#@;{or!nP8@pNq^I0jd{{s9~2&xExq#1gdN|r9%fm3W4?Lm<S)nYTBi$3HUDfI
zaLelb_RZ0XEfDfe$A|Rh*2jOjLuH<2-I%@7)dAmza1-g-VUJ7E@@m`*%LxoVm4CCK
zbckSj%oQc5n<jDmD!_y;h`|8dGM(vS7AjnfJubv6DqiBnX6CZ4?8;+wApG-ioqeUs
zO--8k9<PvyR$1wbZbh)=JAL8EADM>z&oJtA(1OT)*ul*sdM$qbu1k^Fu=|MjOwCOw
zp`AL5dwYYDM@hKCPgi*|F30=v`98+~mT1U`Ub{>u3!Do+d3pJihk6V)@MHfz6@(OA
zzlJo}ZVX7bNUG-Q^Shfk0E?{vU>Wev>opD3`~dP#$o4{<xv(~4ag!57MW<Q#t$9Su
zmGB|kS#IWoy!NW9s@EVaP%A>c-E5>U>hnyrC66SUr1va=Y|9PuFLB%<%NPv*kkgU=
z<2LtXh_+z5*f*Cit92Y&pa;rEiVv~G!p0RplLy_CGXhnzPefsj8M1of><!kvDa3Bv
zyvc1QxvDv#U{(SCp85)U|2`X%e5HpQPNIxDBq~m)lIYjEie$!V5Kj+cum>L%h%o_W
z?hM^bNEwP$5`?*=l^+sQq!RRHH947(_gz2Xc=Kl2EO;Z)k%RkJgMVvqbw1h{lEQqH
z6~7|2HL1T`k=}g@sy8_uTu-2s&>b56nU$5L0xN0(N|;;b!y5<Tze#967FE8C#u9J6
z4%aq0c7?t)*+R6a?gPY^0y}M^Qp>QK&k*#E2kF5Q$$nh_`vd&B=c;BG7Hrfc14DJ2
z6at_elPrGnMBPdojGn(YbdE~KEZ_Y~b*3D!G0cTHuqELl5LGfClFNw}txZL}?o5@x
zTftC#VGMi;hx@?9R#;L}k~eKEN6exTJse2!WaHM&n^E*_w2Pn;4!5mJN-#z_9wt#a
zD^ZTn1;-=R$ik3eh|P>)j%C6zja(z4@ENF4&9*^BCX-;5!PH0N5O;IZJu}3MTkHI^
z_xmJjZHL1~g7Um3L{np3VI=zNC%I0WnVPas$gsUbjm8oFW_Tex4KJ*8WOC1%s$>(Q
zzVKC2&ETwoE-cKh(pe6v+K+&vS=4vA+)iZ|UwHbvI+q~iTvjT~p^7q0IJ!2mMvwb$
zs!%;^wl&LnuT16T=O4Gfaf2T~E?(#+MotDlU!HWzmXyjisw@nQ!?lGeL>BIIA2wR_
zvYm;P#{b@o#bapor}-}yft~LG5cS@<L)UoU)+pc_m`s|nZ!8mzO67F3s54;1fATMl
zH+r(vX{5J$vXIrjP=QE9z5)<}St+DIdEm9n?GJ-8L(0BaXzO0LSGmskyY=L0*db#%
zNFcy-_fZCW&ao6@<#LFf^GZ*jNe^Ov+TD@c6kBaXB?ZhqEF2}RzkpGYGu*M1E`OuX
zza|0S`^UoE9Cx{rxGod0@1ja;a+!x%v3q&qi)j!-nlnFYu}~tjyPs(8Kt&0dtAg1b
z^7jNW@JXi_UPPlGpO4pl|3NF4jW%H+$7zzD3)`5PmBpdO-jYyt;KlWAJ)}3Dl2x5F
zg$`Av-u7Tf7M+Y$z)5}u%?|%fkX+ka09DL)T$kBA4u=#zEhw<<gEVu*^y*a^xq!|z
zI(_g;xhHe^_|`_Ulf>n~&PykBC);gmY}CnG+QB#wzv3_ivaco9?~h0tp8b!_V&2E`
z2b&7m88$_K-_qeuz82~GP#3-Z#b^9llrD7wIS7Y<r3{!}tif&5gN2)SDMs<$>ZFp8
zA|<_26&eNQK>fMGC%*+=?dTgDe{eEfm>jvEPh$K+zuN~N5a<G=cF&wKYUSMSO#TM&
zHKG+!>yQJva*n+Pr+~W-rAEFIMVvYiGd;s<Uztz)Bt2K+&n{v1m>PYrjZW%HJIR+O
z>3H<%mV>{c;r&?3uwXwcxN>~r{|y)!Q&}c+9JDTrL@%V@{R#plBnuQ=x9;PYb&VB(
zYiq37fAy;PUDyRA+(7kJDGKvFDnv0L!=+EIrUasT$LBkt;CWS3!%hqZ&w{<sy9a7Y
z5RL7HUKN78dQH(gSh#5>$U*01e6>h@>q*;Apj~9&8w92ODg+cDRPk!Dxt6#GXts6l
zG>iJX`~+pe0M0&6w9=a_&k^tH?*N7W%2-XnHidVPwq4g%yR~J54{Gm!`QpXD06WO2
z^YM;{p6?Yn=2lk^6@U+N0>OjSq*J&e@`KEW_v-rRt}QYmwYT)2P$}CM9hjOWZgoza
zdKw){i6!y&azR<L8w8y`eL6pF6))U+_(^#=9aGM``qtsVvLrQ0#hI1+(*}W{FCadV
zy^jQPq9^)7jFg2yNqUFCssn%!>^T`7-16&%I&kq?)t&GAc)<yCf#jc|$52O_Faez3
ziUqYk*d<#QKnxc$D#5wAyAQhUikv}2`u_?0R4n3)*P}|~LD%Tm1dF2oJ9jU{mIZQ~
z%R{`bM1qdzO)i%DAYX(F`65)*ObwyF{z7_W=eXF$l{178g;{02(z3E1HTlQqVg<p!
zGe;T%rkZjyDF1cOq}vW9Pz!aM1Udx3U<0%ZO0JKPVwUwxT4bkDNtsL{O1GIFx_Nps
zK~P8pj7t=}7X1Z_6m^y}4iL~Sdb^tDnF(H4XZndvulE%ZgTN|B5rO)s=0`fMPTiM(
zcl!Aq6#t1D|NCS41h=2<{<FC%LkPwDbN0s%^;r{>+Wmvw?t`R>+?emk_4`+nhgVKG
zp<f944;0@zoM{sP{b1gSC2Gq=PzkWvwg<`<3X0^U;Xv@}i`Z;EgjUGgrr66veJ}~?
zAmyjVM0D)&U1kJv38h`^hK)*2<$*Pj3oFa2s<uijOE;~J0&Gn{<=+#jhsmXKG8Q#%
zD_KS-{=OsNcVB^%EN8Pe0^C9dfIe4iWG_jU0}D0;oj#`ro`Zjn!XN<=-+5U4z3*;z
z>Tzl%@o;-;rH)(n_T-ScinqGr9cf2oykAq_gHQSw#7DrrH#whJl#tn?;yJ;claRm7
z&A?o&K;PwpQb7|E@=4152*0u0p@>}^s@eN&&yiSmIYyV@e6%V$NoKDociNK)*Aujy
zK7vwU&vHFf=7yl+3?N}R_82CK`&lK`(Dd<sXn_U@EG~i!l$S&Z&bS?3&80H}TdDQL
zH^2$tVuCQK5#%yQPITrkOn6@Q3345c`S-4K@DLOfbkNpT?7#4-)XOI37B2w81(T(F
zagNly5SJmAg#cuODfO?srKhnwIT3OPGJ;dwID??hY{gN6VkL3&1zK8tUR!>V>+c3q
zxG<JEOhh7zF@F#b(?Bfor;|8cV;IhN0gb{gE0Wtv5Ff&fG*X%3tISN6+DrCNHIIL_
zEcHS<!KSxs(e#$l37$Faa)#dV%sA3iIih>07{`e>fv<~&yKA2V1o_XIQ6+ao<q<u$
za(3XsAT!86%(W>>0Ku3aYx6;LOUL*!@43u&FR6<BK?RV4I&?t23@)^%_54pFI%?sh
zLy+gbeGDI%8jt0t+slK{Zx26&)&kX~j0x}^sx*CAwKFhg8FuFr$}%S*(q%%Di<Jjm
zmSpa7Kz>^Z;s$ggH!s@R%@j_QEtX`_Q-sA6RvoUtzWL=8ld1L7)Qg|6#uOjWEmG>D
z%xr-;|LFCa3s+l+@$}}9HdS=o?fa$kZ#;^i|7mFGmX+lkL14C?b#mPT1fOOhJPUV?
z^!2s071*Clm2oX_R5@?$`NM8!rGpq&1C11TSXQF2TcQqzzs?19pW@Cj!p(TPfQsrY
z1f?Da1@4?zP%||rLjo_c0f~jE?bCW~`d41d6Ny+1Sxy3Zux|{E)lLzVJa*wkT`jZL
zNW8>NagjR}@Nh}4k3jr!`3`Im>Y;=r^LqvD?d{c2eNWwGw^qr)5%d#Y4sXjz`)#}V
zbR-dOKp~oM&lZRsva#P?djwqm|Nmqam@VpB@htn&b`!p#P)W2wpz_Ev+q;uxmKn%S
zQz?enUh0zi>v(oJ#sW-QT^(9L3QKFY(lS?GIZ5f}BgE4dlFl%=a34zBH3X9ug=oc-
zyF*yG(x!Gg>{mu5-}^Ybx|&C0mN?Nho}-QOHvj~!%uMQux{!w7$v3!A1nmbao7`;}
z_}Ja`7;@aGD6x1YVph9*X?gR7%(9+Ye@N}!N1FHnp(JD$z%?E??p(DG-Xl-~3{ttA
zb#ihdUS<Vg`BEtexQLm`fJ>e$LZJ2d-)qM3tJAQ}Q&~udoJ1Vx8`Z6Dc}bFp8)T=^
z&40@)C2yjYC4-DN#TJHi_&C9HZKHX>8tEp-mg=-L1B^Q&{qe$p1cq>+6$QhiZUB>>
zmF4KAP4lzPy#FU^{^cr+Wo>nBe~`fgay-XV55s=ffwUMqNw1-kluvS^3r^?fZE=i+
zt`dMaMRwFmR9Y!Q%PzChMNngwopMEK-f0#6eFQ(xq)x^dV#|B%8dM0Bk(v{ayt3q>
zv|J^d6jx-Cj43dp^=6aGfdb*}&*5Qm^<*0HDO}~P+qXsbZr{44_2g9R*yPbAo~Ntr
zy|e$>$<qY6wR1hpZ{B#-Me~6%y-?g>PtTDXhImzbInM(N*-<Vet!hI?iBud8ncO>2
zJXlqn1sF_oRp3=TbVT4o9|kFDs)9MQ67!%)dUeB4Oq(IYy-6u+Zf-r=Y5N8fOentL
z%YJ1#fkKTdUDpF72@^?ZXY0#)>uuWD!xKSAZ|gt`;5jBob4{_-3#O*u0NmM`&R|V6
z2#)LwuUk@>Hs)cH96g#mA>%qd;Iq6__I+&yIthX`34pEpvTn6k{QvHSeeB?IXW3VF
zzIb|<)9R-+b%`{u$PA=Ij2mmZt>aZx#9#vsBCCHCB`tYeEU0_)xK$$cf_4!@nqPN8
zk9rp5UaqTkG=W4-sv9^P+fHg&a9j$2_U@vR_7L+>w>J8s2`D4ULW?&Y8EFyyKr4zv
zM_K9ZBtO`lq)xJ4Em8>_<8mdD7}o<09j%BYL?0fJ4w-4Ts^h<`P|E<{ta49pLg8iX
z&am)&tT{K1=_n~^v3kEbvBM_;b0}Y6+U>e8r`8gLAk!bSv&)XOJ^!d4!$%oNghU_$
znTv=RMe4{yI$3AZbmOFnym!kJ=!i+1hai{ygXLpNBXa_ExrQkxK>Ws#mJC-=?q*Ib
zj<r%#im_5w_y)Od2Pu>*Db!T7`by}eg|8F`X;{4PN(Bd8iB%-ub(;h++EYCt#}^NU
z614@0UVDWJQah`o6C3FcDkqfi{j=wO{`5Tve+%s`e>=8s>`M(#7tzP$3`(oo(6*SR
zpKk)pmhT!{nTFnmo8@>vj;Z@U+fYB~gm+b7#3(2O&;b6T0XcE2^nD@Kz!%_{5eZ=4
zU(H2$k@slPrzgy8yE1@9-$R#{LpG$_0s;PPPtc{ym%n}-8Odr<sg3jlrxu;55Dfme
z^Fd^opDWq5cV49n0bo!sf-Y+aJIuw0YM09&^GbA`v=Af1sVTXPGH8pMRF;&0Lgwx-
zkn`}`0|k(~Rs&)WCj#j{W~YdnjU;K27EnYE9D|s1B7)vLZ}5Yv5Ab}<A$V1I|9b=C
zb8Sw0t}q|Gk)8o3;RVl_Ti1q<fSiGJcB@6K(X>+O1qio1tO!VHNjEWDk3Gnv9S(%Q
zX%ykUHA3gnQ*(asX)dfwNlHFs)&HSIa#@qKueW!y7ate}0Yc;XvuE0E^>;u{BB6)>
zeYC$3-)*bedS^ORMqs0BRfwZ6h>=w^uWr|a(~;!BVg9lMh;bb8LuRyvo*&4ALI*A$
zyZTnfbuenQ|0aV)Z7ysdEz-WhK^A8sR4qGh^gqXmiWD-{m9FaNq#u~T6T_twu<To`
zH|*`j$#MqE?H<Uoe7K1~nC3w6!Ei~^<fG2m*PG-eq&rz%+|46_-zo^A8D}WA;KNS;
zprhQk2MnXMxVURL1Od+)x!~1FnimWRe}wo=LNEGr<e_;E8?jMfaOz|!<U!hNy}iAL
z_#I)wBm;a`$~^QCwDtl@?%h_xizysA@7X$@X+y2{ti*w6d4K$w+gY|Od{g#h;E;hK
zv$FM){=?~uHp|AEfSz5~B<}nCnI6)0hZ^mRZ@%t?GgDWa{_F08DXYuHCidc*6KgS6
z?-c)c!06_*0fiGTmH|aA;{dp@?fafePg&;9*+YBTQb{lb$vRbd2^wX0s`gfq2+6Bn
zUq<)EU#NcQEkd@}|6N{GTI%w8PaBNhk?I0~eN=L=LjdWh)1^zv3rwDz{tqZwon<XJ
z9z_^c)ssF6H0P&7rQJ`ELp6XHrSy_zULdRfyA&G2>W-<7PUlvbibellS($W)5#%w|
zleM(yWHqI-6YOluwKXzp-&(&8|J<AWHC_2Ld0Aoqcnn(~HUYB1x>ND==CB$kX%q5^
z=0WDo<|;*r|Hi-90INzWP!IMe%)Gi8Hx|g@-+!6-Zp}g@Ma*3gZ?5j*4iA6-BPA!v
zLr<vDkE6s2`ccdmf6Yc9p^q-a6n<eoXv$_G_Y0-Dxw)0l)N^YLC7=Fj2!*u%+P6t`
z61nHQobIw$@5bT>px<3JX7T!!8H93DwjgGe>^A%>jY{HsvhVxS&v>uUAQC=SlF;$&
zxp?)e_Z2p?YTvDuf?>Zzo{zF^CjRP$mxsD7r@tNTe|ne)9ncEq$rhs|0`(Ic)*rw?
z*Gk?-eeV+3Y^|yjBS%PJNgKoT+4$T)H62Dg6k8Ypw#vP<{cM3yR0-K?2%T&>t);8z
zhRag$d%M?W!=le-ilFpA6d`OeA5F|)=67lKpT>kH+f6ivLTi-Ht|i#N3>xKVG6ZPg
z?$TfsGD<)=b^sY&E}`aTUvI6zd#S8@%F}%w+q7ytIvjx2{x$S1$ntEH;1Q8f{D&Uk
zY@`s*W@*N}vcktffoD*puAwCfjGs5nvwDs>tom6?P#f(gdg;Cx+`EUfBAVEf5nii0
zD2mN)x$9-ZOzd@3Y<~L4XeKnoN&`u-qo}xR2x1RL*eiSV6V=xm-ZXyf?QMEvh+i_X
z**!$zvL$n$S4URve`|4${?yy%x2nutAID)4#V!6pk|KZKb}eO&8!LgiV&jKb%WX4#
z5#wqmzPpnLEH&b<23aT5&JG`(0Of2e-*V<5QlWEo&~sdmW0ewVX2Cn4Yy|43_IVIy
z!XH3aH89#3yIZ*l{16$D##bu7uCC<_1BJSo*9e`*7&jen+_-^3%HzuyFVaKppQ)0o
z54~SW7u_GOC_p3g8WXgfth*GcwCyZ${IRqL35*>9tvF*Y>X^>oWa6X{QFQ@arZ;hZ
z1uV*gv8=m`-h1cX5;xe3i+Nl*(-+f0tKRrIC`}UYu1@MvL0Nx}h<E?}Z~xqW?YEZA
zQGiwgQN@_-6EYkv%*U)XCs*6La?$&rng$YJnMm>Xr&{>5CfE%EWgxQk38Z=i4P3_#
zFAopVtMqa8@SfA9GJ-whgZqO75T_kg1ku#+LSap(x3j!SyZLKpK}cMRi-ts?0eBoe
z0M)ovFI221nG0~^3I-8eb4Tzk21AV9X>8`BBN?9yspoSqB?*x`5X+Q7aXsQk=;K-8
zlv26Jw8+9SnEoUc7_}u2LT+TF(1L-_P;dCYJ_o8a@~4h>1xPqZ>kKDqW7fKi(!}39
zo{>Ejqkg1&k}XT?OW)}>M;-0tZ%w=FLsV7s8uHCqAvYYMUAn#iyT`zuH|%;_?SsS*
z7j-xPw)^|D8mfnub=a0Hg?jzz$}<!L{PD{N2Kr|zSd7MC<E3qN5j12QNoL^DzPQi1
z(3K4J`ugaj-KW_urKx3M944xlRF5nrU)=H}ol8R36C)vB&@$FIe?B78Rh=xHzwr6<
z6CgUQi=B&Mm+KRxi8)EDXH;fQep~StM!8KYhKQezG}$1S3)h|zs!nP9VM4)?E#4}a
zJKXnLiPz7KE0-?$In(8l-imE%b~zZ`XxFZ4voe0f>C$y{>AVMP9KPwBg>y&TP>tYF
zU1!_3CdWs?ZGQ6~_Akw?S&r)VohbPD`SV3DFsGy3ulfAt3q#o{bGXj%LxbSCZGt#x
zBIm{u{fOSYi7B6G$maqDG*pe`@`&WX`F5%4y<*EJI3M0_a|^MmE|6B%Sfg@O#WGnZ
z-<@iai{7F)uSzZbL$}*T1OQ=iD(SGj-nnpVfSiqdYCg#jjM_$55+MUG&FnXzn+1dc
z<ES0IKFYx0x+)-#6jfC8p=GWLim^s0<et~~JgKV$GA{eh9Kg7&0#cD>iqO@G14ScQ
zu@-UsB^-OI+y|U&RO|7YMB(@u-|z6h-*^i|!V#=wT!FL+Yy7eoTQ=hzYRRETFYIf}
z&XI~3mM6*H*#y;T(ORjvTG_U5y3s>^gbj@-p`Pw7i#v--#>c-esis`(Ua~q;m!@>Q
zs-{NX&CSgy;pOhbKUL8GpBZLN{LD;1tJhszh1r!WOi1fDGeCp5MdItBAN(Dsz_@gI
z+OlORW4;<LQ=LC>hB%>etcm?9|0_Gxp%ZO9n+<&+di{ZR8xS%&;;S@);o;#)BSf_?
zi;G3l;~0WRK)yQC58l{76OIG_89t1Ji~cl`^~}A<U`>I>3E33Jj^3aPxj1$sNz-~4
zevbYO{6t`{<~Xp5ouX&fgS=`ZZd+dyyAjp&+C>RYNztAAx3w5p^*&va>~4_}2RBa@
zJ-zPZx!qj$VjcMIvPjS9Bv-1zyD6LdZ~89Y`u<2@F?MJShz`QdGAH~+ceUr|=N)S{
zi@y#yy8j#2wd8LYSB&df>52rX=oLvGJ3Bk$Mu%lOCRF{fZK*|D^}7$Gh*@~RAIQKs
zu*kXg8ZmoN_)u+SdSrB<{!ahr&#5Ja03v1}-9drf`~Dxk1x5iXk~bkJ0=YT3wYp#7
zMcv^_=(Ib!tT#<zJu{}Ol*XE%ye+2aNKlF~#f0+c!}DBO=^N7O$W6s|r;RIq5pG&T
z%jWMLI{auK?ll?ILPcz3p!V4PJ#C3r4!X-1O1191e!Bq@#NQyRQS?iwE@qeaS$k1S
z<1wj%Q(WwOcuiRJnjn+drxS<Ba6au2Iv$efD?ai3H=1Rs&T{%@k`1O!c0SnMiyiQJ
zfi{iZY!{HlL^v8)GFgw5uQd1>rxz|rW|q#mM+5&bPB|t@Xv@E=>3phz{05|8mp{f^
z(MbtG^C<<=|1@^~nnSP__o4Tj`UFg?+SY9zWk4swbCw+Piu_sa0mEkwz+U`3ZD-#Q
z93Apb3f0KPB+~4-fJNG!LH7zdR70(qzFZ*}cj-yKa{a0+P?!91w*&kKPQ7ZekbEP+
z@%Xeu&9Stx=Tj?91DQD)4nD6BUIH&nG=5{d$pTB*7{3J^`5A?W+2?IOt)3m~dQ&#S
z?e}~5*z=`_BnjWLH#6z)Osas{d)b}u?JDQbpU(xZ@5jNxtF)tERCa9zCn_X6GUYZh
zz(pgI{eNf-Pn6Mv!=?W0;U`PG*pc4VxueES<t+Gn+Z`E3qtxPz^x-^tWK7WP(upz7
z+65`f{aWVUpRvo|Mm7Vki?Rnmujy{NZmrwb1*p??-qY8g$q2HPQ+~SY%uxkxNf?_$
zB2TG}0K-RDT`|dcl|AT|cW%=y)8Jll)zF3o_@G|Bew{{#9YQ>$H$hB2`jokS(Wy%F
z!ZwdI^}<T%Ab4`#k;)n4=JedRh{0fjNKsse&?+KFDP*K_n1{>6=UbHYf?gr0s0P)h
z(ajP{(RU?<PoK_Gg75Cfq`#t1R>8*^^qSh4>DS9=va>S{2d-rVo%zi;$B^ai9e-Hw
zOLG2eO)na3u=ua){QU1HU3TiIr;V27w|*g3LZJui7q5z(`7jeV@{m8EZ&<XJp}>WR
z+vd9MQ)7yi=Jr>S;S$8G>KMpf{)t9^SQ%HT=o-LvTf6_umqF>4&0e^I35J26#8Y(}
z$Jo_P*LarWAsFrdscS047N1QDJXA58<1<_vg(=5o?b&S0-x@*L?lT=}_W{_KJv&vu
z1SCN>aF}Q&rDQaUCn6|Kw#FCED2WffiFa8L&jm`>rH3-RMrXNPHwA2G>n}e)gL~LU
zP}bn3kPye(*O%p<TCi`JcpC;4iprTnm7)Q9#3%2sTO3qKDwlYVpc?D}==VOuu~96Y
zk&=0fd2!0|n)mdgISHf_qWL7N;@(*&tNX11Sbh(xZasSdqP^pzN(4CY7Gk?D8`rd>
zW^<2=?r6TnJbmLpb#}lAf}aK5C7fC`T1$1I#XdU4beQY<2Q{Z>$No*i2@hp{V`p8e
zVKS*AqQGKRp9?c61;*E|IVWjFlCBOJ2HF%a8eg(Ag5#=+aPctWzRs;#3Ew3JpKjAS
zia{zZds~Tq_XP@j0>vAQ@8zAdcW@ADiBgHeVwOohK;|6<-Ki|r%2ZbM@5zWgF^kIO
zLFX$tgFu@ZgSo5F1=nJj4iQ$_Y)YlK5y5bOF@Q?az}Wa!7qZTJSQI-%vDJ#9+j4ZM
z7uR0Td0O;}2~+pCj4w-PFvcJ3j$b2Q`Rq`&W~`y`ooQ^dsXPl{+HZD?Cz9o}<OIfy
z_-e`G!L)K>SWNmM_`Unm?lcqQ+bu`P`K_M2peBZ#iId~2Bu$DZtdA~f%??&$`2ET9
zvrfO;s5&$B|62<-S?S<=w!k7+5tsIlOdRVTL3z2kT&JLUwMYbPC5QQ6@p4r=+ekz8
zf6ju0Urouoix_%|AiU1xulwZejh~+y(vmQ^kf@;5G{yR!zkK;7svZ>Ydb+xFnTXS{
zH$Whr7ahew<w~ML)sP@VT;=yfj#%E)!2YIv1D3doQePx9QKvO3nlfnka2sSuXlQ0&
zyYsoTuG~SO0We0d70Ftiw``snDY3sn(M=vy962K<Oa-c|lf{boJ0)(-%Mn4|cz@jG
z^+Z6IQ37MkJa@bi+lAPM5jle(L?-oo$tY53C`HLkSGNhda(%sK@MKUrTkh~ZHW3X>
z{w7Bmy>|s5O1so19pOJZrytZ!{%4h{8cavo1MycyKz)89MZB;2nr}*1y&L`S(W}y@
z?(HCF?~lJPS2)Y<$+TWcBVi(1EH_ywD?Sjs<)bk{%+4e$N#?*>Zw5vmw?KnBDWeq9
z5o2@#AEk?ihE_Es6CNTc2`+36wFx?@YS*aQ5=;OUM5<6ha>NUeK9hP9QC$7bv)Emz
zgT82L>WIRHDhaicW3Hq?V7mNn>bPi?6SUf227pdy{79$@PFk4SvvpEl*{4MMRG0<M
zS-`V+ylO?;t~)E1KSI-VpN(>HlP=q_r>CdUEokkswq4WC#Jl1KHo01!euM}9T6@MI
zmgPHRSrg01=*p@aQ-0Bv4x;qmzoXu(-FjZr{htMrd2h1gGEM_V;^M%0lU?N%&&sZ-
zsQCJBMVfEfSoWOlAj$u#Duly_w@~MGcHYST+{{hCVk)N6{ut1iAz6GNQUwb%I4d;p
zCbgp(!Yc<rWFct435tc-$vav*VMFnpC(k?xkD=G75MnL#E=617rtP?KJP*D;8|y7S
zGP#-v7bzV%(EGXp<5lkY^yvZ=X#C_sk`_0`Zcz9YD`A5Ck8Jpv3<O(CzK~p4l%t;D
zG;vVhY8C@Mmh|{ZJ>LBWl;oM6pXCU3m5ziR@N_-k2v4ns$atJtybVJ;^`75M`K1D4
z-OMeR4Mh@2YAJo1#!^GIj&MI+>692}Wvs>w{4FB>r(C6C5I@)5COgq1E~PuU%^^XC
z3#oL9A?;-uux#e|aGc|zCs86el>HsP!v(5PdpBq6+4ROkD<i}`a*F1-afj5DN*nb%
z2ujUH_v%UUS%;dni7s}mkWL<&s?%Ei(8cF2mGd*>2$U$7Bpup98NiYLcq(PEpfhRX
z;U|TKtrdT9BF}Ih+E)~;#NL3wpK{dUdwa4}sLqG<Nxw~vX$m(-wsjg~tlEjZk;d4F
z8TBxc#DvA@pd|CWZI#{o<o-uOg+U~Pm@I#Ld;8c(VIwqgmR~fy<!heVEI<nFv(2>q
zTyYKFQ_bpE^%5<NgWT>tq)d@M5b}GNd9qQ!r=4(@aY8QaM~tV#Yrl^l&i%0~`G0Uj
z^=ypigNYw*S%=do6{(fJFMG-EN~~|zwW_#Muihbs2vmB=AOeg{e(}ARDNk~4ILC_<
z_>HcYY3V)3#Sz)dyRL>-rnW%Sma2@eYKH<PEmpc!ki#L~i0^rz*F#ZP?MN%nD2uy_
z0?(i5k2_ys=!@7)|7@9OQpRz3;9;VV5J!`TA^7py7OMe8=*6XLfZu5qpIv^~gP6Sa
z1Me<N5&R<GM0Bd&V!IvPbY)`MxCuKpaWo)Y<a%U(<gZpA&tE@%{j#{aX~y-?<9haH
zd4|TY3Ae#!V9^KWYQJ&5%(cZ9e*Dtcx8CCk>g+Fe+cNUraobM{u@96KsoQS6T-&$t
zP>L+nQyl<M!1`&AW&YcG`SzYJhKcISw4?7S)a<E1AW`1#Kb)H2ZTq5IVdL6G=ObWd
zDD)qbT)w_)mr_jAJ;*fC0K)flJUl%=g?L<Uh${?goi_<*KCu+LynS7E`8JFrNX8vJ
zpg$ka(J39fJi&bxHQ*0voZE<SbL??M9p(a9`oTB&UGh*B3ahu#RLMjwcpP@Q1j~h0
zITDJcg0zh{DOK9VGLbyo0cH_&Rs`N*e-LsmHG~OPZiUW-DoN68aI#%odD>9l8}i*Y
zA55vNlOOs%D;?`q01iX`nwL3o+}ZCcInc9evO0dFzr=e}i>;P3BKtP4xPIdI8<H0g
zD;`CmG4D;+ro9Mv@PXK^3IpagT50{K@19ro5y4P=2(#k$kH@W_`}+@^#rTfI2j~q?
zw{6xY`P|b6n$U?vdy(coX9l7{YqmrQu1gK17cqqsmE2mVuRMVy7n&Chc5kqw=ck#b
zyE1pg5!@SzbIjiAM5lc35#5+aW+$L>#stRwp(jz*NbP3_VV+2}ghoS^(%jY6HBuQ>
zwc5IAEAC39SqL=9#KXAg6Em5Ce{5p@G9$qn)6y@}Zs~vQR#TMZB*SI5blL#levPVx
z1GPpERiCjj>umiKdV1Q=Vp*`Fw55juGap}eGiQrRG8Y*Dadkl%g7pLk)2}IDAmWZZ
zQV9MPVV@Dwc8jfSmrzOB9HqmhMRV?&n5*3^G@lTJX*do4*?ifAQe5583vnJrE{mmu
zk&RkU_2G3tm#w;{f`}yZD}*3=i-5Q$hI9#?)b#lQMZfNk)06wE+oAvhIzroKuupmS
ze*U)LE0}EXQ`(#q=x3gExKD19h*aq7M&7%9=3U1*4)Aa(`KM0$%oS;CrzrMYXcXTu
z_E}mHsIOmQZ+znA6kJF&IaHtg%opJV{r^oeF#It{QZFWg%w*Z>rxdW*a(He88S!PZ
zxy0CIG9P#{xseCJ<3$XA`VsRDYEqTuq1s+er<$Ox8@)!Pgh5Nc{df}YUU^b1G4g9e
zmEg|B1VvHdd7K9=*rZg^*1_3Ev;4r_W-`T20q?-)dx0SVf~)1cS95*`Eq{XmKC<#Q
zF<)+n4*np(LBTQy2=aq(^SD%ZCslb-689)oa0F3M*z@TIux=~Ft81slRZ&2sTFQX~
zyFW%1g2gC*eC?9TD4CeydY`;<qWm%Hfo*b?!Q9JDUkd4ivF+YZpOp1Zr^nCJZ14ci
zVkG0HjI}QoL_Ej+#7C<6$XrF1{VJV7R9S~DeHHV3s5J$xCDWQYPPoZnI&ye8X2N{c
zyT5$ntr{>3{#iV@K!ndK_{Z^_Szc#eJ#C>Ev&6fV%A3i;0^+W<z0+c`gU~x4X#AlF
zY`lS}WtCbv)RwOg##*3OMdU@&i>T_DLUa=sX^=*nK@gXS%LNTsIssv$A9O+V+tl_}
zJ;C?R34{(G9GBh?RrsVg%O-z3wUBt#u)FIn+=YlV-bv*I8M^O%lvx}?uI>Wlxf8D!
zwjY7<?=B?tO%rdc!#cZvetaPKQ*_xYfaT}8EltGK&M0Ssu?(6dGR{O%-7jJ0#mGk?
zZ_m=$->#c4p+a~h9$1C4$^%ETuY3iTvHUp>-(L+6>c&V#H@9%zvoDwZYw5?S8cVe?
z7t4}<b5<pp8)x`ZloZW;II8+CfWiM@Le3Dli7F$;;ZbmE2sRAMnMGhOCU^et>xbE!
zpLF2YS%LbB>q#hW1pg}};`x0g<~=fR^j4e6%AvYHbH|FRZlI^fprhHrQ1-rUW{6hX
zVFdV)`9n5*@gNZs958&C-!-{3ins~s$y%G&z?A_lF{lj~qJY`<O^{v)vSU#IiU;(s
zT(O&A<$QuqI1+=)kVBQ4D%dcSpuo8b?=Nv4M0&XfocVH0Zi=P1(DE<738cf$x0<IN
zjE0WoKY}`WOy!uGC`QJ)9-(#R6I9sfUfvo3?t!PRmDOae%ic-J$0rg_LOBus<y+7Q
zTSS4oBmVk#K*m~J$Q~3VKI5gkLCO~R@Zm!hh%*z(2}}osTW@|>(TH@cENsc&9+s}Y
zB6@f5!(#l#Mmq@1Y`v2nd8tJk#dWmlY}6{K!Ch!fpc|xOE%Qup)pmXQ>!)$5gpKBV
zV*c9xAeVP`71Rwzg&i+6|Nmx(<1HyiXo-9sVRC+uIsN$F1DVY?uU-xO^p|`c_wdL*
z5??WYo#<wE=S1zi3lAf36EFiLv5_HQSdf=x3qcPGNiJcd8;*{rY2ypg&!0TWNwm0q
z1|K-U*qW(LG^N6&rsNUxr!AqFhJ7+M4JvY~74ME=q8QSTxuP|hH#;kl&);AYjzx)|
zYYXOY?uA+-YR1snj(eI5Z7Hi2Z*yA|_Tfe>Fd<(?_rL813ZWCTgKSZ3jsSIG^LU>$
z?$Gw?HMH_&@yV?zwG)zAvhL5S4#e2AV_#@>*^OoS(7c84uQHPM6cVls$FkA`>IY{2
zTMx+YE-bSIY(lh<$*@;bdUx{s{M3R?1WOhf>$vfRKz)1Uk}h06>rw8BRhRzLYfivU
zE<WFjTXtf#D>aKhYz#%myV~mtS!|l&3rC3IQ6suP>vp2$%RbfO=f;5-N~UOfiE(o7
z93dy?hnKiJ$ZtS<q*>^Vvp@}F%HzBt%W5HpE2RYmEiEGJ<Y{Ae&=8gctm)OMQB!~1
z(yPW(F#VlzLchT<+C~NEN_tezqbL&kK5YcyMdy&s*0W-8gSeP0ri?s&{J04%j*!Oy
zV_WjJYtj6ofD8kD!Ur{eED10&#S)xvv8kVYT}NrJ-Wx6!Z2?Hw^M$}QGcLMQ%jxq)
z&!3+pJ7(Z()4#ZZzQUSu-$cx2V^zy+yXO(&H1}Cd9bsQQ7p<B~lr4ao#dK`fnYcZU
zbN5Vm2o}Gg@O;W=TkdZ5p2D5QJ;(FUUj52&*8TU63y&EYxh~uO@V<iXcfuX6mT}=r
z7ACh{bWA4vSSMNoiTI-rXigM*!0ppS`DYDT8)53SGpW1q4iu^Rz)IIGA8z2K=046m
z2`!eNXFJLH_k|`7h0<YFaB~cKq*gJ}?J#zAM%d{6VLaCwd4NMe9*dQBSUB-`JY~>I
zugI>lkeY0XwzbL?3?1>Z99?DQk5+<;Gzxaz{5S<+n^aB01$UacSV>3^jLYr=L_FGh
zOAawqxWW90-opFg#II>-6WRzxS0^6Ny&vZl-}=Icgi}=iuH|Kw)UcC=wo6Bc_sHh2
z6gPP?b}L#hs_(j$CKdiz*|D?Cv5J$i)g9gsZpg6q&8lYi`H{<1#=eBVBIH`h?l{mh
zh1TE_eG)Yj>-FBJ4d)QO<Yv!0GV0JH5~%5sQt+RJl$5*5H+<{?s)zs`dKJcWQTOY|
zMj}^bmi=V+Y?lu%E+QkPe_Urn2hOz>jz=*Bhf*k48HGfl7!IL16ylT2@qq=}X_mK@
zpnAw7J(1|-1*-VqF#?F<d$-cU!a}Lrm(~8%v?@3~(s0ZZAoQ9B4fu&`k=d%`1PStD
zE*nL-nUBi^otvmLotl{7^uK>J#@-|dY;d&Zy>E)Cos4lot5DIueC`b9!RtRk;zkNQ
zmu7z>e(~$E{UBb$NW!wLz^455g;8$x@#|Krpl49C0uwJ8(2#zn^+42YKX-b1x~Ucn
z|N0<x>|Nz)K=s}AAl$tTI;R(E<?1}LJvNRJ&fEn|!t-*Gk;|xg*NLp|t9ht&S@)aB
z-X?$a@J!X@Vb<Z_?d*Z-`6=X26Ojs1?}B&Sl2fpkuxq_U!_|>A&E0_Y5z;f|MMbNo
zJ3EP=kIxRP(_-wkrDRUBY31a4Id=tmV6hi{j)s~?-*9DNNxmf)^I$c`@KXEZ4rRw{
z-$hiSf0>^p!(ypVDxobZjZ8uV&s!OO%j;!N<lDF?lI*lpzVFmmy}I~&LG+TT=~LtV
zx|zY6B`~t8t$BO1=C|3wzgfa%>A1_YR*6+436!Om2_7`;vY`X-R!hCB`dT9?U5w}+
z<x^t0LKDLEiPSJ$SGXRcwBNWlD1;s{QbnW1(Tw=Ol9>4TXzULFfv&<x@7K{$8YWyG
znl6YYR7stZark0Mb|J~hdHUJ<l5bzX&S_s0Q$DNYY*sonXF}H#@;-kvUQ|m>QT=eZ
zA0`Ortb9!jV^R{1Y0G|g<EEHtcUM;<gStWJmX9h`5|H=K5tPrzu~p50_3YXX$5z|<
zeMBd|^PpF8H4z^~KiZ{8LEKgAx8r{Rn&&?bb|Cd=i{Id_bB3T^J6gBov?;qk)vB;w
z+R7cvK+wBUEvD|4>zJ6JAbe0RpQo>-u>C2%w*4hjS3ZY2>3WxEZF%`rQXbl{KT|7{
zq67b4;xpwVsh=5VypN1lQYC#M#;jM(5fK{1|CPZ`8H`(vODd!_Ec*eWjizFI;9U{z
z%Z=yOK0dN6931CNB+JFGw#Y!_PHIqO!*ERr@={@}Z3Ew;#);5$&Yt4-S!znC4f+nD
zzz~XcvO|Xwfeof+sIQ}|J1ue&h<Dh5V*pQAt;R*$aw-))o}mB9)6CT8yiQInwDnq&
z{l09u(iAO0X+<`bC3jK9`6z|W&28~Qf%hffK&Ry<%iBIjvn8rW*q=OKSTa0_2)c-5
zFvslZ&Us(<+c2&F7R=0*+R95ymxYD){rJEQdMS4AyV?HtfuWK0iu^VUfdHphA3(t6
z;LbtTOT`CvpKrdd+ZyNGAD=M`*!$fRE_k$QgN`6cdZE9$#oub%(Ta6+4FI@H4N_F&
zsZKo7iW;)gmC9TBb9KEpo$o!{c6u%=F24Lc-iyF<eg1#(`z}S^w_jFdo-!dCoco*y
z!`CM@Hyw|bUI{qa9A8E2>hgdGPeQBGmOpI>HbBC_6YHHhk=$MoZ&m<`gF2n9dAIQ6
z+eU6Ls;XpuFKZJ_4LP6di4VGXc}aiS6q+c5ap<FB5VLIl+SH1XEcAGO3^(;pp5x4n
z7`~GDL9|hPT-@}d%#xJ+moI7TUmua49YdSA7hy0@E5~%LvQ9j$E}^3gQt=V(^ro6O
zq$MU@j?X%Q4@}Ud8p5I)u41TF=OpuPOFQFKqJ-F1-QR~PrfQ7Or*(FBH#Ml+UfSH&
z8nIy)vKXpMci8cC57=!D7+!u=D8C@E?|slfQ}0hO+aOt#_zp!4mQ-g`a<>oWjP^<q
z$5T4R)su>=!mr5uBXAzuIW%hfJFWswuCA+!ijyqen>-E?NiJ#A4=egjqk?R`IPL0g
zDPoJ2K8CN^?7t~isthNM(^K9xT(0x}Vn!|XRFG8Zuj=ckBR|nw-&~>}?O`aK3TBW6
z6PN|^cL5`<>9-UZ50C4m5vdPv?j=$mK5V0Y_z*GHvb+z4M;_&}IVA&sugG1+YE3=T
z!%G*rQq<#6U5Y$BJlwTGtXRa`Po%}(-v0gAvqy0<3MKcqi8L3nQ);S)8Y;4)w6;&g
z$cWEiJWQ|~KZuThK0!IbDbVU<H;2lb$Z?hrRlUP@OPV++VOz5u@Z~qhF^P9h+gyfb
zR=AIco0~cKv`7;};T<W>TZ#I<<TKsDf;9b{N?*QQvhv@s!jk!cAk^KWfDO*&1!p<~
zkE#zCMd@8Gp<3aru$(@c{V^KZgT-iPifd+O2PsaiOMajsbx{8rT-XQdoLUFlS4p}?
zeZb^#M{0lDu&Jpj@v_#1Wt}z|KMk=7&b<X2CV_=rsq}`LXFqEb7&~cUDgLf!+nQTi
z--^FKo&E9IeW~BR0Rf7Z0|LAYmX^Gh<>Rt7ywyoASK;voQuIWyn>o0C9IIFfsxnc!
zN5hEw#mvI;o{U~P!cDW`<|!67w$KyW!7Lc&(6Qji$jJ6w)re#6eQRrO`QXx(VF@>v
zm^$rw+?(U=>TXIQt1XAs56Ma2U<*>i<lR=XkfSVCjC3JRbbPbGc&w2p@6gF$J{_8r
z*;?u+CE?8c2|0_euj$N@+2QgIHBlR=kF#?Ty<L1eUpq@<;Z0c#Aj|dzvqJ`9^3!+d
z(8Ojl9@6{f%fH=d61vWxnV=1r>+k-h#c0rCe>cRW-ksbo-F#Z>k^Os|d6QJMleeFr
zeAC8Uz+>MOPJgEZ9fLj9e-;Q+by3}cjn0-<D#BHsZGOCK6d9DJUa(4!EFk*e^fe3f
z^u80z3~<p6$dHX%7BSGb?@&z~mSmo&$ov2;_sL{R{M4z?SDMbK;4e?8bRRxkQB>#w
zijxLqxFaS2(u30a3+FSuaA=C|`=ql~(5jkZ>j`;XQBeT=ABMbV6i*xSvIKV<R7+ma
zvAtRxh)~BEEhn6uZ3>=Gkbm&fPd<U0>i7F#ta^(sS7w?t373x14N<0%3yT{hrA60X
zyalnM<?Pk!?53Qb;FI~ox7{#nh1skxpwfg?nTCFpL#p`2i<<5C;Mu`BzCkk~R+@gg
z-^7hJA<n(@#psJH!x=$*KuNgq7f|C_OAo^89O_rrpZ?bZaZMcw@^a%Up0oNexVc$L
zklEwDFCjjDf&G`G17ay2`BWNq&|PXO`XY1S<_xEV#Np+FpP+(ist(yFCpdXII8Z%p
zFrZS=&6Ev0r8PJ;WgR|D0M#yV|8)X<Gn!OHR=~tvFj@0icSu|7gRq&x4<9}_&uFO1
zAA2c2d{>*@5EC%ALc)bD?tNuW(RJ&q7!&&3KwttUTK4c(f1=`2<IzXinpmz#xeE^q
z7)+;UW^6budEfk=vChBz{F1G$EzTj)FYkyPjDV3+vIY0`_dl;&IZ;>kWAtEYV`=oj
z%(wc?{MTDA<u}3a_aLoy@t}G1Kx%)`v-(7W-_H78KV0OhibPz@Py+YK_D&t?mK4Za
zl~}ygNFan3Ez4WhR90d>vDBWVC21a|`~RZ{OZZdrC|RrZ)l3ubA0N52Ws@hJC(VqF
zwZsH^TWuDsM|vD#;nc=Cso}JqVmA_*Q_?&x&t#zZ-ku={_l>EqguB_t*ViOe5*DkB
z=7P4KUOdJ|WorU;N>OnMy7wn+ofES?xx$#%L+BD5covxYBpFh#7uq)p-D5sZDI$7@
zs*&bR@_Lc;;e8Sd3_;^9jUCSHO5P{U<uiG4KtN7f2|1Zy61`?{^5n_10`ev~tJu$m
zwenN4KUHH^;tw|C6@TI3c$Mz6a|{g+@ACL7Z5Rc-?KPd=^xSUclb_YlTO;YB=S~N)
zoaxN2Z~4P#k5R>O8EO5>Y~<}fxJ`bj)j1h7vjV*+?d$)Kt1l0PdTrmg48}h8B{B$E
z5|PL<V+*CSRTNoM5{4|vI)jK}icpA{l1QkmWs3+=k|n#yzGh#4_voDW+xfkJoWIWd
zzT^2k&%IptbzQgAc2TxgCk<Po^|`I{@j+_|L2GArlHRrd6RegwakNXj>DKJW#>%XZ
z-(Bg!BBz>*Tc0^GeING;_^70hSJ4X(n=E9V4w#5faxESIt&wZ>JIJwZGu8Jk%(L3+
zZaYT^ZyXj_G2OXr5cxAPF>2$Op57%Y7i8V9=rKcTpfK*c#X`<C!3;PD31x~b1>)2P
zX5?#B-fV|tPw?_|w?q^MVwI!-9_<ggBFnatfN$*Su{?^w91P(^UX@Fu58<#tmsb@O
z6o@c7Vk;?;9cbM|#&kihov}*Lct#Kuxp<ALh_2fD!wC%Snh|F6E!83$rPBvrb(&qm
z(Vn-o<UEoV78a%xcA|3@J^(p%>YT#SR;wUSqP6h$sD@x|6k<OI2gifHzP<)nY~1O$
z_jh8Q|Dtis&9+(cLflRIoxL%um0$#n4BD31^xOFXGjzQpM~+mC%PMTTEq5LaoR4~S
z)MGf}UFr@u>8>#6Ydd+Ld!e<zd>U$<^{v7W)7DBEnhM7=FW8>FYge)7uWW%V;YBwy
zS4oSL);kqyVhtW9UiS3lj4EBu9;+jNsJm$t5rFVLLo}`kzX)EX8)D%)Te(DY3M)lb
zeF;T1-Ctp?qo&WOq^!JOD=j`g-pn-Qb5oQ4RXNM<Z{MgjQ8n1Ep`mmxDqAJ(7tXQi
zhEThoO4T@^mG=GnnVd7LqUmY8UIGMXln%C2sXEP)Gt`Ad|E)I6(^j92yEW{Lzq<6`
z4ZGw!9`Yz|3^rEL7KIo*FU?S0=&t?Z%7h#;#6QXG;>M2-Sxdj^w?RQ5Cwu?4qGIQA
zK$3cwkQ)Yc$uZ=8YzG&X0<$Z&X9Fx4XV`~=viA(;gt$mkQLRsRdRms<UQ_b$q?n?s
zq1SN&hUNXA+ub4BrW$*mfw9r6Bc{QBXIEJo++Av*BNY@%zDM;h&JR{E9kt*|TvdS}
zV3PKU{I6bcI9C58>%ml|$b7e?j;3<7nGuQ*ir4=|C*_gS&*Lsxg9T%^&RbrRJ?`ke
z1R}!eb(@%;$+eP~Q}%~`3M;=Mts8P(LkIA{Vv;E!n^<%vTvs|^j`Ffm^`T|Rs@8c&
z{gv3wPFZ#6EumoXrd7C^?HantrA&0Bnxm-+8<{s}SuF7Bx2me@J=!MCVc_LGxRAfT
z;t6H^4Y!kA;?v=UmF{NZ$ncs&8+<J{J|5Y+*@PLjzap+SiP_5BX<LHLvUB17sv7N>
z(S88T7U8Dt5X+FOrTQ-pkva*DEE9VjA3Ho!a+MCTjGtN__{MZgAz;5ZT*{t%qI$zg
z0=&F9DJrVffG@X-1ztNhgxddGn~-x%!3DJJowqRtC#EcV8v+c?5$X{s_UQ)%npuT3
za$?=t!aw_8yC`mV{s~H#{BrHa$UPv5MNk>LnURiG{ZL86X2=^Hp%C*+)ce@J5X)Lu
z>FER#O^E21#l<(nhuUefs(=|>!-r(_*yHSL4v{L1(+2emt<KARfmJ=m891V+*`7Ib
zQERSJ0%J{*G(gMQ{=ld_S^KKoNgnQ=;QIqiW=q{%7;LtPE^qVN&4yNxOq3x8A3<R+
zLoZ`_+0pTZ`OoD3Q~s*p3tZ^VMA)w$<E5`odylOle)Qe^T{p`cn?HqiDt4wTwu)xQ
zrl$i8Kv<^`@O}fcImn8cbhh635wv*eeIx7Mim_QMPaa<DU%k9H9;^8t60*@k(1HoM
zJjzp<r;DIO-(m>IdjH-%HeY4hI&KohZx`kcNj@_={JE4UXp#R9hM(fD66-s4DlVWV
zG~it)G;XEP!a4Z+_t1<6+^!N`=C8qclmNe2iyuo#?yZkKUzIrZ7V+VMp=pS1zspl<
zQ#PZU!}a%?SWO(NG#n4CR-K4!vq4eWic{BMP}7Txiw;%75<HY%-rnu-&UL<IG%hR@
z<P1`gB-7BtmEO4dD*lkno^3@EvXMYdG!5tX&C2_zzHKRn^pUdt>S-gzNkH$%a9iHa
zi+3K3453+B*R(uCgGC`qUSgc3;Yr=L9=^E~$R&fK3w!&<1&GCMj2*D_hn3{7b_5w$
zvxW4cYw>Nq{_*kVu*6OaAPdVrn`@~{jX%k2N$Ub8pe^eP+Uf|}N`Y{@Gfo%HF{3G`
zpzvE`$FHG@qm8CcOG?f?vXt|AC$dHFW+^aEy23e(n11lGU~vx@Tt>ByD~mV%&E2)+
zY@<Y0LXOM#5mNPm2tDy8^$v7sqjGEt*TfAeA-#~;$W=75>vlDo%IUFUFMFN{`Wk=~
zY_y@+zyr<ds5{9=y`*%H%T+X^sj9JbB4}kQh>sB*U#6yVA_!1HJIu9qbv>NG(%PZp
z#_4p;Pn4jj)@TT6oLXr_ZW$hGO&P>IYvG6UazkjgZp0CES9qGZOvxM_i)OK`GC~a1
z_gr5;1&>B7Oj@cT*o<(~Up)qXiEjM<{ToGpChwz41$R|U(CpQhXR}{~pyCJQ_AQ01
z>gnpccE3k1$s#S5XZsJn@&)Sc)61BRE`Xzi)}O4bDs88`{r2{Gyt=&FE1@xeJ5~Gq
z0WV4uHdN>lT)%vOxPq*HnbxYTN1d=&<^r{yMYx-6MPCKR<n_o>)oeYd&0qJD7-dj!
zI79v`r%hrG(vvVYJWM*8e7Su@VE(iM{kL0VfJqRkb`McSTIvxHmv6g<<HH}v;y;az
zU11PDhN8ATKoBG?SNlc;%SCAl;&CimX@Id_6SXq^MW=S3pUD+_qp;$f00GJ)Q!iQu
zEi@PP_sw8~9(<2C;GlvYdF=s6Q>{mGCmF?OIa<SRqmd^ZK16Er)nK@|5Sqy0LIL~&
zr!8u1OsQR;?^oe=4i_70M*D?a&fu{S`_6D>{Ygr9Vq_3ngu$sUCvpF)1ct=CL>~j7
z!VMErx5ramD`1a9|MGJ^^@*ZpJ&NH*>$!^WEmn|_b_7FC?{uHB(NtAdj<{??d;H0%
zRc^Ukwd^(6GI6Sc@sD#d@PFdDFl?Ygn{N^nRPno?%lpz<CX?W4$CSV8aT43x^UT>Y
zkCTy?ZwT?U2nNd0b4XUob#cp132$e;5IUL!RBI>XZd=_<f3oc92Fk`};7NOi5_4Q6
z0d5|lad03+vk}6xPBFC}bX<FQdG#eEBx>2NI66L~)k8<X6(WeDLNSbtjOIEBgs?Gc
zl_Wfp7<V@yB6w4z8S5&oYtAo#cfgRSV@qvSNi-aT#;7mD&d9*L=c^wh2p&9p)idqV
zh>sf?@D6xwlz=~BzkYjERMZ3X9GkHbj;Wzm`_V<ir2gCwUTYc?Q{C;`4<Gx_!KOnW
zFiIHJ^Y>H#kU|HE(RwwzVm<pwo!T$?pgn<&H9N8kFmE9`HtxiGxaiZ|dde;kyx?YY
z1X~vB>AEJb#=7(+!2g2z>60gKKR47pw=Ss7#N8A7_vsDaANW~Ru<Y)B`+}XxPeAJ0
z=6g<+8+vMya>=(ZQJm~;rba;s)^Zexvj7vzn`WV!5~q@bjr2l=i<iGV(e}_FMYEqv
zg}A~H%8#PfG#jEjqMu5WZK_;EGBq_dK%vASyOv}yO~_#|F;#3jf)nu>)IvzYoPa@B
z*rJUrGU4pmv!1G5QpajALr8>s%c&VTR2L#skP9{b)}oVJ_c%`QzM1)8*ZJI@%q4mP
zI{)Tj=7)*vBhNQjA9M6oh27Ln+&81EiHIYwB%OA<`7P<<Mqar3RPBt~+;qiQ_txE=
zU;Ud&MHwm54<g&dBAkti7<4Y+D62IbpX>)rgfGxfS(_&Ou@xI-)~epO;I+%Yoa)iX
z3DoT6nYVA#msrl?sfj-(ZuNKnUG3D5V6ClFL;T9E7jAe&#GK%ltLf7=RLnp^O{mZ3
zNg)!7^3bSH%P<_k<LPKc4HT*9$E#{y(q&bhdaNetRQ0j0PNC@vGOKEUcAu*{4gqF-
zVc93RmrZ40#(Q`dLAj)vCK9a$Q0!zizZNSA@xjEjE)Cw6A&=L#dlg@OIcxhz;pcPF
z+li%%^;8LH0oL)_eY(6gViS82K4~}?vEzH<6Y}4^%W<k9-5Egdi+Yu<cCbgfI)k{J
zo$l0#M*OG<stB2EvEHn;_Fwd`#gsQ&`%hlzU;h~r5;9xhg*|@=nKviHq=nz<6+l>O
zegROe7;F1A&eAm@=gJw>B^tFG8dwIoVve<0dTPgF?oYap^i(&+3trmE{<n^PPW?Wn
z!j3(=CY7zM2Jz$k%XlUxCS{>iT{U%MI`5QC-seeJ@^o_lZnX0?Lb#tyAyR3fnskDt
z@AQ9G)a3=M+B`v%8&4ncGg0p;rd$(qadI*Mhg)4H1e@Md6U|6DuC3vr)U`EV$%@yn
z6`1YNY%8l(u_WZTMVp)cmoAA}i>fDP`IWQEv&Ji{Ctl<c@Nr0^k!PvVP;$GDqB8jX
z+|&rgFp|!H+2r;(m9SB9=1}3cfKN;3_cq8ceF{@rf$iLG>XQ~NH-q3-SE#ZA9FyBW
zGd}KH1rCS}^lG9ch3jXZhmIPaIwcO3GJ(;EDj@~@;SguvfIEXeV?2V5*o37YAN0O1
z_ehnc<Um5!rfLn=!r+^t=3W<a^^&~Pw>mBGcj02`Fu=r`<EK_xbBreTiq}wvaMyuR
zFF4wB8oLKof_{$DH&vi9rmZ)Olt$tU1_y1s&Q{UV9s<z|OaVlpGx&m+)9(oYCsBv-
z+1XboPoK_&{&t8KAxw7TgZce|At4zQ)d5-AXZrHbw9v&=nyYNI$DB}jG&4_Y+$XB}
zn4{EHTXZM%N5foHXuq;HRG$Ba4{NhIWb~oXJu`oZoo(*Q3pp>kf@-prxZ)+{gU%IZ
z)o)8CjZiO#H!3#DD*UDa<*D<(P~Mh82VaaMXnQm$@Y~>r@cxid#ARVG$yPBR%7qp-
z9`w$}K5sd2Ree-8hg}Ux6{vu1bY0c@=PDGq5^c{iwZ;m+?SUkj{K1Dk(}z(@iX{$$
z)c@){o-n|f9$NAbH7BB_orQcJ9JZX7&u5#NtgJgK_Ke;qz%Z0)ydwFwG+BE?vw!!6
zYSN1&9kr$5<dtewb|2EYn)|8u0+GMzpvd}s2*2Q1geXyH6`I=klqx}_2xQOC&CQM<
z@9w`~ZVnu)2G~>BvU&dn2k|KDfrAGdHF|>4w5<gpj6?=P4oZK5N&Yk{CPMkSj{f~H
zpXP4?54Q+OG2I?)4c~&Y^!Jn4O{-#F=W1&DBkEET%GbZY+U_O;ENO7JU|gnZy_n9^
zySV_%uTqU<d;I-NxMXBWg0Lv4Kl--Y>8uZcHF^NHsuEMRztzRId&jllEDu`n&W!kZ
z4cZEn;1kzQz2hpy97`)JWm#ES)#|)v+E>E*(Ig{srTcFVAX?Scoq?A9B;~Vt`{Gyj
z%$fehzwA{FpFN;2@-7s!3Wk3%PII>^?iG1$mo~r<XO~7*MH_AZi^|f@b5B+kKyh@+
zA`N&^BWGu6lh9B3cs!*6+bupeW!7*Wfp8S^1dgTwx{gJ)8VvNicI{uk3TvT}1g)EL
zNP>q%T3#D^+rq-)-l%;yiOzKJv~BQH0@{n7p)R=;L6aZDD66?JdQfLSZ%>%V_h|`w
z7BvGL7yH+kNRPaCgUoJYD_$FwOC8ob{hMWP%joK%BX}>gIY8$&Jvq7Yo(xqr$`;eF
zDJ6(CX|c((o8aL^p7HnlbQnkZ=<#E35RBcYVsceQIj>c{hzwTTO6qo*J4qQ4Er+_r
zc<+*(omM-%mbGBsrA3#~f6t73dc$@ht8zo10h&w9*)QKwQc~hyAd}p&bY6MX{w0TO
z?14j(LGbS@rth}BWx<gO)rF@{86}xa?Gx9HvlOVo4oOkVfBEvo=<!bHY}6M7WAw{c
zuS99MYOwdCUjQdXvq1uBie_5qmhw0W7@n}DI|%uC4aH#8^pL^L6C99Sd*W4%sP08{
zvkQIlvypSGH){&P^S7fGLhT>AUMNB<BfAdwSu|1zPoD)nMYE!T@+j=|-6C&cJQy%6
zD&*U}h778#sj2aU_;s#)4cfBR^lo;l%<=;xzNj5=(fFh^5pq<EVwix{PtXo$;cBRH
z8w^q)d7Bz1Jfm!!^1(eZzQ-o;l<>SsGZ`TvdhG+{7|cg<&t`v0FRG#(vqQ%HePlZG
z?vp(a-T`nBLXG;uX`}IxnFrma0kep`dsv&-BQi6U9-k5>_g}mW<ZEZic?Y%cT;Dap
z_>(HP@Jv0HI5q(*^siu1l!>aKiU&eLq!ryP$$59tW`9vd1xE9c91^o>Bl+_C)lX#g
zW?0SJk1q5V4<QKyEF=+h@)b9?S2D7)zr1u_><{3kwO^Onq@!YI3{^)_XC)$sQuP;O
zdFM|D-enVZ>asv>ayEpEeu=ucnC=`1OLliy1Jr|hQs~ML#A_^No!;soLvE&n#5Xh(
zd2an0zS}>3@JD}#GI31*Tg>>ixOeV_eZnWcDe?&koja20;NYNx&_#J<B{pt1&rsQh
zU7#2e@;|bAYA%V!J<*?4nUyXLxcQ_**9U#PgqipJ71Q7p<P7AMDQu76wco=9?YrHn
zG&hgCZA@LG5irHYan_4)pcVrU`nWBF9NbHu*rr^UKD!)YetgIsp{DvnU>9#EH2Mlw
zS#wH0w(*O^8|$-)XI154=j7$(DfQCG4s)%9!$*!}l3~@}?ruh5qsZER3CSuVzu~u#
zGuda%YiugdeEY4>@vEgHJ|W?o&C5quOXWy(ALJ{V2^=ULjFWi{y*{07@kK#AB<fsx
zrw>Dg#)EgK>^I0)inU_ofZJNlT4WG64^PEHQpH+QOVBTc)HS}iiu`=xkWcaP+$3s_
zb3zf0Fcgr*J}p!~>q$M&`r|O^QdGYtn2HAU&>W-DA3X9Y#+gBGXYa!u7BsDNfVa#5
zlvw{4$f81Pj6x>gef;>FJ}$zgJ4$|>P2MB)D_L%?#s4RQozSw#wPU(S*uS5-@R^+(
zInhjr=_`aWLm4j>hSIOa@**{np|wIM25CuJXcEnbAFPRJ+T&Z^%%eu}n1oxU11c6E
z8j)pUsJmow{``G0B;JA92c7f5o4-b^V73r(T#AYvj|#;qhyR@5L<kcZLKZEGN6!V0
zoXag4ee4(AcjM<>iOtGa{p#3(_21;h6+0@PV_zC)iho9Lycq{MjN;Qoqyv~Cq95He
zyLfCkHglW7sS>@<0|ahE&#BRQT|GTbx=K({97207RlMz{StuP!%9kK&HMfF3osgD|
zwu?-O|NGrJ9Klno*~MwZ-{~b~WN1hK<Q14+DkV}GRys5WTk@-t$mx(_w?C4V^!{QO
zEhaTl-xNpdh15DPCj%9I1ob&|&{4rXdm5t!R77$$ad^Bcvn3u)dlgDBXq4`8AFsjg
zcY|i>*-$DR7trCpTO6~*oADwv0gOXFm7;3BxhEVQXBx5}$)bs)Gl8Bl@J_v+AfcwV
z-bDpDQvJLoaQXF42dp-p{{%KP2_?U=RzZ&!NfPhR#b~Zl=d*J2)L=B35c4sNS(P<3
z`Yjo!DoGb(uU|PhOrkAM(e<?d_FA*}X?1FE;sZj#%RFR-3PS&hhCU^2Sr535A4i;k
z^Lx}R^Xks8?!RFSV(-VgBzZ}B&8F{1DJW|~*%}w!$;gnUN$}n1Xz{>%ydK!xx6zt#
zha#TthVlenE{_@o9`vfp&Bf=D!G~h|%@N|lpE*OZ9$WSG5u6+VmmjY>Pisi2Os!Jf
zZiD{b(UAZ(p~%U^Z(Ur0sKTfE3roQ`Qd!xabo3EbRp~kaBV*Ur)|gzCWt+Z0lsfG>
z7nc0F{<FY>!sGxGp&LO!M}**-Sm&g0jEBaboAJi^lZT%!J54)d&9QEQzms4P9TPC+
z7cxK>jagHumiOg`8^~jVcM?Rr;ZVLYhn|?06Q#*G&SU}&(C-jqr;Y9HZA9T4R4+o9
zTOf&j)B6Hue1=Kq?fdxyV0rk?wXm_Wl7hAomX4kCaNg)Q2~^mWbt=8IUzd(NUjFyh
z)z?zFA2&R%V`wUIk?QUfk@)eSxxQ*%puXp@6`M)9GN)EkFG&TD)Pz=WH=v&#ORI%b
zd413(jT&!&dgu^Hv2Uf4^4I$0tJC?RoVGYb!?%zu1*7^5CcQLI8#p^fTZl@J#AU*4
z5Gzo6HLStq;B4I7^q)Zt6BJO~#WZ9mDgelENcK9R9OG95sL-QT#`|lhSV)YFt{5Bx
zJ6#%?*Wa<efblIKN(HkSzy9UIqOC;^;8|eKeT}ictl1MA<v%6Qql2m1lE8C(fmj|d
zgLF8=C0Vt$|4k49pLvu5KR@sO=Ith}R6Ronw`H>IzU3sOot*j4A*+4N$&9kcP#!Sx
z)_i`ZICXcX^6w!LqnK+j!ZhZ4S@oK@nwJtgpI5r~*1d?8<5RLMJdBSY5`y#m!+IF@
z*mpXXOCZQ2$~5ULgHv@JkxJ@}JSxZdu&#NcB;L#hN5Rf!ghD(8cR*d<b`(PR46lja
z+S6ZA1~7V8ILUE~W(1JPD_g_70(h<W-=HCX^ZK=EZXN$n+Vb+UOax)E+;TG{&J0Jh
z(6U`i-Y&Y64eoj2J-)bpm;<cA;@zE+SH7Q}%Q;&84N}@h>S*MdqQmV)5cfH{Luw7X
zkwd)F#HzzmX%CZ<V&k03n_cbf(mm7oXh}5pnqAZS@iW??h)t}8KxE!@(7`r7r>`|n
z44zQ`4aE-I;S;6o?t^DEe@ke${~=Y?q`E7EmKYe3NU(J;&tFlA=Dku7mi+qEI{C?I
z?G~PmkLua#E!c?Zl4+jeh#GYqT{S;733NmyERrwsp4Y<|({JG7PdckC27+hRPiS=p
zW@4+j>JN(eKYaMm;6tT!m^QILcWu%cfCxVBVua>u#*($AWvGJDGm&&O^8UgWTK4^H
z`NsCxAZyU-?5f|7UTOz&z|9ca8jH#;n<?$zs@KyH@%?1hX<vBhtEV+=`7ynRvJCQM
zUJ)ufP}xAEg=)rPLtKz)t%?tnI`|~3oIZ^Qo6%qgSAM*#dalM;QQ;-Xzh{rMC4vr3
za{b_~|5;o>85bPl@b`PtrIbHoSQ>hRPIkVs?f{!<GmZMz))wwU%dF=5!9C93>0j@{
z3MRC>!8(_>sq&dzu`wO5GNr955<hh~>nK&0G||fJ9n}B}LLP;{Qd3h)CExS34xD=+
zqMMlOo(tTWYIN3~WI`Smt#IT>LM9y;VG(f18LS8`!w}j6YQz5RE>MYG=<yv$-MC!T
zcXRS2dEZ(^Xes*cIn>hgveVC8u{SMe&j=Iyc-jlxbg+3DpXGR&tNB!v6cl2y$V;Zd
zly9C25ydrwpH_6aKBZ`!c3rZF3<|UrV!=|d9Q)eD%X0reZ5y+f7^`IEJ`EL^eyhac
zEE77#1cLqVoGp}}XPZB5NFZ&1hMV~MPY##9e<hw8Au&<>Q_(81lwz>h)&3*GB+M3n
zftkCQO86~Le15)s$=+rxK*c95HZ;#U_Tsf($VJ@PXJw8<-Ur0aNFv8eh=7ixkw;BT
zcig9)vSsz_Z0x1pck){;*<|Zr(3rN+`g+CoWW~ipEE>-f1UC)Tb2=~E+iOoenZYO>
z;G1D>*7s;&J@(p0PkOxJjS(^#?%YB+VvsmYx>eaw^!C@&co&}57%Q9mbIgjIykPJ#
z(vp&zn&6|`@b<w2uD|yM2=gRS)3G>!Dy4Zv_!mA~tzF}BR`Vj&&`XV9GV-Sk{d-e<
z<KZpjivMX?bu&bWdDEUKQn#&5T+AK9e%(U7W5>({_OWPo?&aramp7_^B}2t85MDnb
z%<8MpY?lVMai6f)cDA?1VL+ceJ3AYW(l@!ari(cINS28z4Xt$i<Z%TOgSJYHJ8Llb
zYwc{2d(Kao^$g6q!2!J#zk%V5kq>KhFk_m*nA>C0a<Qmw{rBi?_X{l8!#l}~163iY
z#)uR5`|Pa}=K{+QER<^MKXu8eYfBl|O85HmP&RRk%9aOfb(p3Tns)^)v68)~j%^?D
z{5Ow~gQW+(zJJddC77P{R9900idj4Z&AdjIyrJcTpAq<@@Jxnfc4<w+6T&>ycr=xX
zbDPYto_E!gW6N8Wk`+8dLdhX7r7EWw1g>i$Liu>4?t>pGYR}nX22I={W#vTlk>8Ni
z_Qu<$#XrkJh7h~?R_q0P@Scuz(Y>ZwW_x`Lc>oH7c1Va!I^2GZd(J;`KT+2*7>$HF
zCo9z60!2A8dwXZq+2nm6O=jAcKuO0Zh<kShR%Y+6ggG0_{(?sukv4EAGyuaJcH_8*
zi70boPzAW4WVjX?&BtutTK!CnWUgQ{38qO%&4GQMpizPV9mvY`0*pC0nhNG;KWYBH
z#1MMP+_iX+cGElhuj)3N#*3obLAOR){q{%I048&jVBuxI;d-{)vqQzF-n5w)k(>JC
zY2;u_%;rx~x#uE@Pku&gYKj(AhL}*=f$hx5s#dh(?YSg3DH1`j)K3U&v%7zYX{AyS
zIXb|ksG{;vYv0cfed>7V1)`*h?Jl5%Wl^2QbgM!q7%&J6S|?*L<dZS|%r+e}lB-q<
z!xtU(p>=y65=F?EUYL4u`@zG-yjjl;XfXO)VJ<(nMG0vz7j)mM@*7CW*@#IW%Iejj
z`yjPk?M63vulW`p&FH1gAQzDfdsG%UZFtSXmkCMibPcM(N+HD)AjH1T69qdHCue}<
z@S+TsX!V}BxWEo_`w?=ve7!u#)3Z%|rKF{Ip5K4Z4GA?m#@xEs4ds{r3aPS+kZLTz
z!agEM?klH!-ouA{Djog(vvObC>Yi{ImYR)TuhIIfbMDkNGNtKH5xh)Q0x0mg!88Va
zxMjj9=%{Tj=xQ>whBC9VUN$F_D({QSkdlwf^HLY{I8|>R4O2Z;-z8&*j<{@w9H#TM
z>tBBijJMA?%ByDcWcfmc`Y^o3?N?hrUInmj(6I;v<HUpp;Fo=WFRg>MWm^%-Im~R1
z+hj{X$1a?x#fVU}wpj<F9z{hFb8|8?^?<nh^01s7dIl3H_h@~E$C&en*c+?9a@(%E
ziZ;HbM`BwKxbd_xi##RXI_cOTBO^0BYWq5>aNh{l^E!<E4M1M*DIZKhXD6VnXY0FC
z)_<TbKuBfsJ!<=T8l6ab%457U%6zTqvW95mbW#6f#u(Z5GLRSkQ|J-j(~IBGstlot
z<qBvrAtXm|bzFU`7U&BDQGXGsFXsDq`%iDeF7?olR$8aZ8xWtx)vp<P-}0KRLOgfC
z#!j*af9%*X4?H97C37@GwM~<oHj`-dQB-Xu7qY|Yk&G8L!x{a11rtR<8$~=C8(l5i
zZ2;wLT(cTn|4k-qIYA<H)7t`mL`qpZS~nr+nC!N(aSS7sP}!=Vv+IdY(V@r0b?Gxj
zLf1AHu9o+3GDc6TxFkVWEx9LMEF!`3tDTbZJgYaFw~CP5c11%l@#2+hC4&zaR4bp*
zM;q!_f#pbYIF4Sj5=Lc$Dypa+@-Sfre5>=z60tSZ_~y#W;3?6kJssuChuOxbLi?^y
zzAP$z{X|4adgjA>6y*~EWy-(C0|k4`vcFf8Y6d9cuK4rE>al4bV~}ICvoJtj*;D7o
zfQQ3v`;*YrqmEL9O*ajnmQ|)2f7|)dhLQRJ65l3?bVk~sX$e;}zd1rJ6B#UbBjh@Z
zr4tB!hb>Uw)c}Qfzd_Di(!iJ8wi(E_-kOLh-(GrE(U-84d|Bi7!~Sb7E)R}Z<<o{z
zrr%jXQ?=@*+-+N<i|Xc{81v?D4SEU#B@qO}WVNr%wx9!<wKXb2!p2SxY*X(!|Bmr7
z{^9-`6edAoVqd*Oko8sqBo;8zgGoHclC~;Lltz|IwyhkD-WL?4uecK}sX{TRTD2MX
znCm<oq^-!3!CQMQVX_~+@+7x(DwN@lkt5UkftejxwY;z6uXFNvlJ))Sn$l276=gjX
z_>rQ-nD^p|oe|)-cI&WRuI-@<+&b9XeY0?0MC2|kgaVFw@@&WeErODWydXDbav7am
z=Z?gKSi=M+b^Dcp>(isEp^-}v5cZ&AhcR*wtSes+11_&qzdy(<i}T*SlkrW%v*kqS
z%1q!73j`AwiE%L6P_Wx;g<kEd2*R}ApOGeQv(LBSsp)FgGT*-C%4jj9!Afn9&&<TP
zT^gLX2nq^Pl9v~rr8YJ~sT#;$eTU(GL-XTgM;V^&+Na#0vs8n(3QJmnl;%v5n;aX%
zCW&ubjqvuw36xyxoL;;TwBi#aF?mc&c+tX7@P7>zQn>6B2-*l{OMvyU&rX2^#ek$t
zmvEhND79>)5Huje6Hj)#P*U`MtHhih@3V4T#r2gZtjN9gU}I-zA_*BHeK*ns$25Ws
zrr=3YJbAB!PXWW8qur3>;O=g`fUy@E5<;GZtk)V8R%)ZVR44rFWDW`$jkP_{p|zQ@
z#OifgTcu#Sv1RCubvet!$e_HKw~;|T@p<~R&-F{f+Aef<Jly~M$PYa_QkgK-50A25
zk89O#Y0ky6_)c-2kTF0)b#%`(mk@eoOXjd&sL!R6LwLbmni;JleK+hiLx2D1C_n3X
zv?_(J2lR0zlPzWaTdqD&l#?p;Q*W>TU)Vu;Jkey3Gn_Ij@=39zSA<o2Xd#KllnyS#
zW8V{{dw0>*KQU*x=Zl$5m_VcOQh_DK;A!*hPH}uTQs<Ctgg24l8Z`5T+Wc}}ukZPd
zj*iAIFMA_#Iypl;k~_d3>VglfSbOGKR%K7&m|i=)2oEM_0flJH!^ptR`?M>2xOO-Z
zSlqU;JYpGCF~Zvh!rPi#gNmVt<gsTuIDgN`Mr0Vpcpj<2JeoPm<Sl*U7l<X<Cq&Y-
zL9tfTac*zlw{NkTlp(M0AEmh0OKtZ!6X3&{UrBD>Mg4(g5zfSmlVS&bZ(kz=VxM%e
zC<;ntWlhrWM;-5e<&3{;4u4JWzqskD%JzRRhWH-P%{CFcHyZ7e)jG8<QNK|_Eb^V3
zdzD|grSwH>hkv@qNe)C=A(EBkNAtTf!g~mRmOUA_52NtK(<aYFP)MkymN_;y7Dss;
zZT>JN<$<D2o`2Y?9;4|KHpeg<?}%qF8M-}~bu^yrwZLr{C+xKdkGrTpf9Cg!&DTYn
zM+@17Z{CD*THrSCy|D%^#ann{=W*NlLqcqvnr)$GmvJfu2Zb!}n4#WCuT|Vxl`3*D
z88}YrMwtuK@ct-<k|+9ug~4Rl@&#*aYtLZ<V0|~fCH2KIIzRrMJX*{eI2Tf)tRJQ{
z#(H)xV}s{B0x>F_7Of-Cx&2o?)H@8?J&U$PS*#&<bEk&v9fP~<2bc3Z5%R;hi$jST
zxyh>ER3U{q(CwDZTCz+Q^&fIV<oJ>`(bShYPM!>_deldOXFw?7o`3b*3~pgKv+z(T
zk;`LlpvrRdCm|!|*>4j~AS0M3T^Cu#k4ca=*gJ#-;DVe;NJwy3o1B^o?bJhHzh6BJ
z5~>G^)`1r$8AnCDIHZDoOz6_y$;%SBrcbH75<aBaed^>%m6P_|Gk8^EQvp8ezS}{D
zU|G3Y-xfd8mhkFrJTFW2-ej`lVNb12Ds!|D=Ats)JgY!tFvH(CUJ213nzLKfM(L83
z6yl-YK0fven(xd7g9qlK4H7k;Jvgl_1~p*wpXRVWWM9MyIaH(K$O8sD*oX~Lu5x|-
zsE4uyB+>#_AO4)O($WEwpOEczH($SbvrqRY1_;<g6r^-69><%!N78yI0h-$wK7m{P
z^v!Rrz@(yWQ(>_<A`s^aG8&jdd`2hY=Q5$bgF!5Q<21uP)`e4|(+NU1o&hCaWSx(X
z&)D|vw-pR{k34>Kji>v9K=7OQ#;nMfmE<sW{=+gb=I=v2hI~ytf3i6Vcxcqd6rT9C
zxp0ik<Q~`JCyVa@JzXhHyfPuL%uyAF1VC2oLps`p@2_~t^N7`dfSNr@C;7;+l=hd>
zO5$$@l@VBBmPd6~-^Ehk!sPEtN<u9uw2r<wdX7IrK+XtOvXGeSm5v;_M1&ZA4`fWw
zsGK{V3rMEHY{KH=#dy3Wd}p9i4D&|>d%7Q6&B%J6ceYN*%HQ`bkyeI>7BHvpK-E_8
z+N!c)Z^oc@u!vAkI~<e8g{)eg%@Ake51Ha^{Qz)vx~hw%Up|xg`ofiFXBRhX38!;y
z?l_#$-kEN5!T3WbXNSAZT#+shdjWsph_*Bun0d_+<Ja@EdAzijf|4^LxNmF5XO!yc
z1-JL#djmJ7eFMH&|J6E|5Lb(Fd&70EvFBS0HHM1%2Qr%khppyErF63Syp`|h^|qFP
z*6PwOjDlJisC<5+ZU0dUSW|T(@6Me&_4uz}zYfn0ewf%66+v{CXl+7*kFBIZ7PYjr
zoM6a<LV(R^P!mPz^x|Ogw)v=#fOe!D)82en@ZwmTTuSz$y8rb2OD!gZ?VX4qAePt6
z(+vq>zHoL3om>km4PU9Jdmy#_Nu<^kwKL^C@#^Kc?4XMHR-!<Ek(*HKgAv&i6f?)8
zqAoaMaAqbmu=Y+&&zpwJsup}FKCPQP{h_tvHy>p!lP<LLK5}3bgn@C_m0d4e{9h<U
zc?i$t5Bhbqw=V?L1hUZ`W6103>e{>k^Z92Y=pc=Ao9LMr`R0EHasQ->s(VqV<+iof
zrHg+KP=wM<h!ftJ{rve;M7FcD^SO;u_z>NVLqul)VHIh39fNJ~=DMcAPW*WTv~hOy
z)v26zsd+YgoXXKu_v5S|Q8lshz6N>m8!~Mf1Ljk>Ey!5zs0A<f`P2HTVv-fW^q^1b
zQY3A8JX&CUj;wD|`y~5o!1S$N;ub-v$mOLWlu=IYn>I%wK|G_lU}fd?%CC2FW@+>x
z?G#md#fNZ>#V4)50f{Oo2i`ksL|BY>f?D%$K#k|o`Ipb+_35vQEIaFawr0ef5kpZ5
z%Q6;S7l<+m7Bk$@{T~ren3aWX+lGR6p4HI~u_B~$o6{zoRfwA|t*S~h9~U<83|dkc
zMi7$#Gizg`39Y(7^@PC@kIf;_4DChwLJ(;*Lz1e6A_6RND^<Qh2U~A^-$b)f2^p-6
zq?#tBrncxF1&0S97{CYcNPU%>Gnn?X8tVyWKc_cn<T~3Ht#N%-s^JeM${sIghpLSp
z*1<l{EIpuE6RPN3OgnvdrSFiF6hj=)?q<Q+^@E}f54b>=TeL&<)^WlrxE$D{oVjIj
zX@M;uAiBh?hc4auJ0sY*yU%w==pKD|`l0?NH;1MsSQORB4D!DcQ1RI3L(zIW5yE4A
z*Dh%r>5Ho$VB+VE2x_AQHzIw6Bu-nC|3Cx*y<IiM>_vj_h$(h9&-J1pAoWepW$iJ#
zQ7D63uR6@DyuPJ~w1NxZvXkrykq|J0si|u&F#NdXX<aOi3_64iLO-Tods@3h=Ty=5
zb-%~Xr^OWE%@V{=>QR3`ab8~PH-~|H>@bp3&oGUgZ-WY?2N35UYpDVyHUmjP)6Uk?
z>HPgd6U`s^kXeO!=KN2Yx)02~BUcVX6pK}?fnU@|Ra)HtLQke>`!~QfB;>H=ColH>
z%RJoN!)kWLxVwP$v;cPrW%t<jkfSig37%bX*gpXgZHCBjRpd>sx<^}wPS0OU3PC<^
z%01j4PK`p&Xbdfc;L+TqwQ3FSAS;GJRslkujZMT7RHrYf(8UAj2RxQRu$oYw*rd3W
zaC95-#N<VL0dC89R0xiAi7s7eqdDPfp3^nArx&kW_tSWnIypZ6brOh|Mz(o(Esnf?
z{kq?KA6+%C^0{93I>7?gDwbv8IF)k)&#2i@CeE4&U~~5D+)sF?W9f~%ST*16T6Tbk
zVti>-3K=;WwLrF-ytQ=3w$-b{YLpC?tbk9)-CZ#KpJOS=_6MQyb~CK$^jC&t-Q@3Y
zVwXHY5qjf*NpKY<QvP(!B`=X@?5Zi`=~wWC5&UyllN}*<-}?AvyHG_N9LZqQ<^agN
zIO)*CxMk`R(%EcyT5Dc3D;q8rd*n~rT_#*PH3n=f<+~5AW&ey3;%wlj*5hK-M20K@
z+d7%dA{0JW9l&cyTbHVqsTlm5wFWb>oe_=EoXcqOOrVlhW>{kD?*WhN<NB2GX<J+4
zFS@T*9EbU0ZIPFkyL&!+bmLI}`*mRLcI<3R1T9GPk4EIhuF}qEup*>C&i9j`&uR?5
zk;xQs9oJH#mT|9BB9J>2bEBwEea2m6T_s^*H&@hur~ha!wuAJsz#9k)pQ(R5^gr!p
zos!(Ak5<uR!*DT5I9GQtvS+iu*KJ@#uWH<pjEd=+I4|zLe#3=%z8eNcZPp1O@2h+w
zD1YAlN)c5WiuEa3|DZ3pOGOf9eOwb^-@|xuj>^5WY%;e@ikGxTd7g$42jRuw<lFpw
z<A=$~hW>L|RBT3xgZEZ7Q;>Me)!!C0SdCTs1fea33nn3a`7An^-1qOTbTsnrgsol<
z47}KS(-s!ZJ#dCq>yTeqWXK`}e8wxD1q0E3&zUrPUCficXQ!@PFv)yX`q8IfcFR5^
zBZI3cavpETMzL1qK~`*X?evLIfazQIx_8d{a<+iljl7B32P2t*6Pcy3pjCc??#J{$
zU|WGi8pYT`7*(1y54qbUCD+#0?u^^NsTe+@yZ9PtEcEAmxG2^VU72U5AzNmh>Z_?a
zDWKhSwzo_4viEL-+E%qo@~sa+7cbWrmhL<crcLKprqFbthTuZ5Y}WtqG~^9z1hUY6
zmvKtNwb6M068<y<BsJ!`L(<z-L1vpAGY|MgmBXuSp+IIBjInl@i}=ZlrJX+w%is4Y
z7=QuzWNtKuf@)81xquNJTH25y8pG{wUQIyvgFa`d+u+oj!opH8bZk^2G{6W$kIb;#
z-fbNJjT-edzaZmo6m)%N*{ilc-_USM$FLX-lTTCLTAg2Ay)hUFGB|Q{y&STO>kMnA
zi^SP{coe#5y|(rtoOQIC|4V=W!EXJ}hhc`<t*?t1-TT)6jOJ<7#`9IWI#Y-o=U-V_
zTGq(0l@w)WN-SM^23#Ab>(>>UM_01v>R8e8*L9+Wx7e>a7>9F6oFW~KLfDCWb;>K8
zkY(f|vZ<<YiFYm2;#3|bC&w*bCf6XD#N!7}zkb%Sp|o-TKNKd$CcvvN-B!0dG&C{s
zqGn%6V_9-)Qc|O5tG(zQ3VjJ8xvBK}6ZX`QIp3ua3P(|UK>B@Liq1z+ot2V>`<iw#
zM9-Um_Zc(N-bDQdqDTY5zI~96aREc;Y);xF54DZYz8FD|K;T0MSN*1?qq~H6xrW<f
z8;qgrmO3TH#4o&_pNmO|eR>UNRUK?zd%U&pQ8iQai5s)q+kqtYSU;fgj0jA1_AZzG
zntT-iasKZZj`E=F>g+6D;R%}O*}?Q;a03)QpA>{L<2p$(OVz@Cz>G&fzTi`F%AYCr
z^x?-3lTXTl_QS#LpV|%`L3bXN@w_|c=p@#Y+L!^M3=gG27y6Sk0#}LY4Q^4BtO#|0
z6-4Td_0U|~h_9#1Uv*?PvRVcaCHRMgikX<1nCgGeSw`F%Sf`$kX+IDV*V?I}#3Y`=
zC0No(bYSdiS2|b4b<IOUTzubm{vUNkmkNrDpR-`S)Bu9rGI{hY>My(+r6r4k)=+;(
zOulhzW2G^lNF@^^?R<w%vXZkV?z8vImE8F+jfWjiK-6vh_fJ6Ps-OCHDJzkd5C^MM
z_bE^918)H~wl4z%X{MA$s2OF^xlbS<RWL8t>dC0f{(hCYS_m18>x(38PCJ?ZJj%6A
z0wIEA4d!{cka@%P0b)kf$%kAyfrkXuCTxB9GNxa;MAyD4dZPfnP*ank2AW0kyIlRP
z-dvW_SRmest$+hX_<#AAXpNn<mJ>~14flN>px`VVF@Km?R~LKfu0gU!e3Fw|8{Z(g
z7-Ro7Oa@Cm`mQ{ZNs>Kr*#VRgk&V$3RzMN4$35eNOdu{Uj?<=LISetwJ2-qAVYgSE
z_$-T5MmT|@jXa7DwL!wGpo>0&+rn2O;m?ZR6v_HHu*!irBsnqKc<(2#@?K1!ntKV$
zmC4SLJLN$IR>n>z-W*|JWnmEqPGwj^Vp7s|=tNm$u>&xVF`->>{UA(#$sa1{&BfmU
zM_c3mefs2|x`4I-^76Zp_zUIlfP^!DPCykm5L~>2$n;RT1$7~d;ES^UI#pc?PVtnX
zaxMQv2nDyFki$LF7d6(z_&vRo(*~&1^g2g6Z~bO+bO8&7)|8`O$91sqYf#e;Ft(>(
zP}OeYAZ|e9W@p-TynK1^hbSRc@uU^hvoCmFL;-UMXvPJChyyHkLKn_WZLE)kob>&2
zw)eV(h!2fXeE<6D{7;nHllQttG*8Ze0>F~4PE_Dr=Dy*MW2z$k-Z-}7n>Ib~VJYk8
z0=U1XyM6Qi&tQ#}K-@kt^fm%Rd&J{*)jID}C~%<e7~mG_`8hfC25j|uO}0aCh({YE
z;U(?6^#?Cu41ShDRTnMT*hYgK;!yr(Q%H-wDTNG`BYvQ&dkpg_@YIF+Hp`lXDqdfN
z1=>|35~g2cgk;*qB_zbG60I}OpMvf&5<d)4G&0V5Vw2->O4fe*X3WEU=~hn1nM0@7
zE*T5Qs6Wf<*enyj5tMY5StJKc$cyswD1^BkJFY}eGqGUJHwt4nW`SZ{@&A3dwGWuh
z4@K9mU8`3DW&!uZRrB1MBLO*wD!5}cz4pjEFxq{V+O9gzLp}<fe`22glnqGunQ90F
z;(Pe`?%6BT@t`s0u{3sqNHf4u&2kRO$q}`tGDK3*4EF;BShGGH!q|jXO7QFqTtr#}
zuv!2c<3yHtEkhJ(EY6yYwys;#hw{nZr<6H$j=K*7?0ABAWhrorTz!OFmLUc=m$J$6
zR!kRm{{dgfHx5E@sM>yRZtm^DlR(jbU$v$8El61Wp_Bi0U=ig4pip~!s49YIV>Mr3
zCI6I#bB;=M7&&mu|0yqch;ob>uKS)51dwJ#1|~Z}rfp&&P@Wx7;V#lMAgU<LZ&$Q_
zG{H!XiKEnHYtX)#k6!;oqh3rqqYR(=<e3PE318i2c6tR%k2*2%csPYF1TB`EwL8U+
zo*u&i5@a^Gm>vgczvp$R-<Y!@aN59k^xgC3%^QbQkX0qXj8|jo-#>-?_YAA8fg{Op
z;T+-Rd3j5B(YjEbntk#rU&C%k-h3Z3dEBt84u44~)_`qNw~2!VJAsW^fUffY;>ALm
z@#oXLq2t%?Akz0Bad6J;Ug=c>WMaF?8CxNRqc)R~YF})RMKB@dyQ#IfgIywgaV=2M
z1|HPGpt!=Waw610ilOhd0S|?%P1`ik>JxXqcW_ifRawbPpKzpp`|{2H85H$xBvP_+
zZkyM^K2I>m2bOBnp(BD}LeR4L85ZAry#7x%rHhD}Jw@iJ1%<fm3D;F)XTidxssQ$g
z&ycm`dt!Mh5m*iJ<WT#FgZ6fr<o|9n%~7(_OPJ@DKRVM6UEDf0a1E5QuMa!4({hu>
z2`Hr2UgdThbqx*KOV~T<g}J5EuMF<m?5};lUpqB>ynK$yGG+w+2H!_AKPfzGN5k9K
zv+ElwlBVpHn69}C6Sc}t8XDFw@v8lN3<DkCosp4|DF|}PVk^*^1AWk<|K{XNYrO8O
z|NbHM@KP}ETwrc*7n8V1@885OefI=|W4fr_M{@}rUN4!KLqEW<3yL{A8myy;)Gpb%
zO>>vyG)%=I;9Y~K6A@6qvx6uS>iWpUg7nS1TP0u;V&RGLSo@TpRgT`Q!hXRhU~XMb
zQna|;K6#aDHbhgdFoc3(T3psZSxH4jk_G$r{7bq0$F3)91e_NP9_H22{&5j>%yoUs
zWGU(Czrp{|WKrDCTE5UmK5KZdjB+_oYe0#d0mljG2+qDdYxUIRo-=?}9M@mwu&val
zJ5^Rb(D)P!E$s~U&rhztr~2)A=doTV&v@DzOgoppAU=;(FLhudHbWM3lQ~oiwLPZM
zU^*Y8ae=<&Y+b5!-<lpoqGuPr{Y35Te{>88$gEn@TUHZ4D8?($R14Je?{1K&$RNxn
zt0(2(WJ@(v`R2&M3PESDJ**BBTG0l#KMuY_Wlzn{`rs(4mu!cwuv_+C-@gfWy@2CQ
zIQg^4%9MPI&i(%6;~^!b_~#r(o*J6`(nx<onizgS@73Xss4+SbAuqn_LXC5-J?zw0
zUesF1;6kRm4AB~`vgDG!BF!ZhK=lT2aJuB-aR@4ethTF%WzGayi=F%?p0h<b9DSw(
z%nSl;F4n4pzVrLJcSBrT0JCrC{d35}FYJANReY%5TRJ&AH=1(Kisgp(KV$P-I%2wM
z-VM{I(ndBR9*DOE-IZH)J1TRg8XptadF`2<g^GF>Pki3#ieEpW#JX3_Tov{pes;4r
z01UMi1|DEkV$Hyl1~wp^`8GnBQ{O4~ZiwYu|1;&={WuN@Mo0ECHG6&ykREftAd<o)
znWHui?C%$Kunjhz{|Ql{?st;$;}m*3+MshAXrq@Nmj)P(A3UC;o}L0HCuk6tmX{mk
zF~q)7$wo9wfy+L|sT;k8QKrkkj#T)zCd>!^C-+?*JmBWr7z9wQH=uoFA1L8zo}mZk
zA1INQ*FPUV^yyoj%xmyvzU_R<(9i+Wu*cq59Xt$sT$;W>(?~S=2Q`=RZ8-4x6B9nt
zYrLw^fH^+O&ulD%N;s*Hp)NSrJ+=STTg&TN<{vIjD_}wJvfX!uj-<ty^_6)1WGyz#
z+Z^iuyKvUdflLY~;M**nw;<9oy@RV0MCUj|_R08PP2yDfex+~Yp7jp6VO_3x=(K*Y
z=E~ujh-or6Mnm=?u=Wj@3P9IW!7>T@g067${WU5yH5y(8S$4f&$!%^}kTN+Ym+7M@
zTt>2goNsiOri!dmLHhH59z#|q80rNK^7%Qg>vauqyHK)mSq4AL%#3~d^y%>Mr`QMN
z0)68+fKIWQ6u&nffIJF34O)lk+Rj+(oH51Qb{{OJ)f%6uudk2kg|V>PKhzasHtjQt
zGJji!JZYY16r!P1XEswWth}EA6mLznZ$8>@OSU!8Ao5jSe1LjkX{ppC@bJz*H8BAH
zma8y0aDk=ugA|^tbAy~zY0kMN;(G)IAKXq;I(tp~Gr5+&y-Vjn6+}Hhrq^-P^19OG
z;nJ~^lm^C-_xs`!rbntC8&IC@pv4(4Py=snv+L#-EMHW54Fn^L4a!m(*dK!1zDHBn
zlC1J`lhAf8^&xz4um7DmIS<Xle0yGyOd*}Uej)#dVsTWIX&K{u9T*T;3>dOhje%an
z)?~D%M(0Tr@a+z0Bi)U5;nb-=ddhlT9lEQwdA|%x<-X@ZHYyeD*Zz81{_`U*GlmfR
zV#*TW9^GEOeD$hSMFs43ajSsOY4hMA-y>iCJYwb^5wuU^fuc<o$A$mg1$sk6L;uA(
z@L<9~YR+-j&71@V6=y8V;8=+Aa8(GMF8a;8cgX-o47*$3wPImmX?QDf`f(E^PyvA!
zytSxYGOy_kxC|uD-G-caLTBINr`~H+54m>YdS9QrO<Pv*(Z-zB2FDcD1HEkH$m(ej
z2O#kx^Je9DEtEHwr(<0{e`S_H3l@{@>Mq_S8xVE>r@iSpJMqeTHO%@3hd7Fsy?DpQ
zPB>IUqi=tfu-BoCk0Jq6tp{XeI?dgbfVR;MKQ3<d7tA{xgktyJqcUV*<<KF&vSWYh
zGomz$v(FyOU^$dGl+-v1tw#shsF~rfT7vG4wiBw7wX{+&Z?+0Hskq;z481Tz9vac`
zDyXaRqW1#G_1aU({HTAwZ2jZW!$9MFwYk;5vz5*mJ%rjSc3BZ}r|=LjFD@t;s`j$D
zd^uB~j#OJ-u2EtGGI&r^>^o?^%h4rX-*uY;^@TC?@!e8XCZi+}l{FC!Y+@P9EHPK&
z@ryv>N&@W+kSTo`@<&E4@x|Hi;eJ=#=fYh74S><>I7)_7*ctlMH>y>kS=9KCdyZfH
z!JxIqqKcn_vx$pI4^QrVZ*3)XrZWWX`#44zgGu{gAIe7nB}2O)w#B1^RrX$;v$X*4
zuLcD(3Qo%)26<z0po`lT>H{loe*<kXFX96OPl!Y3&uVcVG_yHW=k5LdF+bss)z<35
zbU?i5mPji^5JmIf)mwGHCS`|bx4Tlex{iQmYv(`3&y>ml`*vKW+Q>oZV)C7TMr65)
zevF_GkI)4p>R*zTQ2u+c5udG5Mc4wBQiAMlrlh8poW+X_{S<SQ&Ez}wpV{j!W&&q8
zhV{v;%4K<6_wnO`JsB_R>;L+dk`C>@ssbq_Qgap1-vaof`R+LL%ayHCs?VG*UwnG-
zz}Cd8?Flz@-7c-`-%mTmH^8!;2;yHW*%~Hz)uPp@dCej#ss2?p+RFDc?u3QWsL<9e
z09400Bt+U-IB_-AYjMo@ZqTjo-U4R!8E`=&!gi5P_+>TJy>b-oPIBgFASCaB1Z#ed
zmX?+svziNJ^|R1sOGB@O(mdDw<A>Dt_C!O&@sUbA^_gq-&^W$=0kBzbym@J)ADokP
zAo`%QK+yOJ>mNQF(?u0s{VQ_+B%_k_xgCm8z({*Wm@H3#yU^@1|G8?nZxQd;lO&xU
z9mVu{Cy2t}1fCZ76JNh>4SFr1^#;h^Ff$>{W!}0Sf?8eWwfiiTJ>6aO>Q=zD4a~Qz
zbgX;hwvIndca8{zFv>MT+HQ%42r8-<P3o`?3OIV`5TWjp?|{PBCTk1!p(p%|Pj@xB
zlz)oU;Ycwi@9Xm|U`)$SqJofHOVE66=?x1{)DpbSKhWqq_U7c|48Qh}qky#D;z?wY
zNRxBcbDT%;p!s?#Caq>mXTQG+T#^RA>RF$EA02!nVs<>_lOW&a*Qr}cK&_vTDZO=>
zU#|`7WV@HHKR<r9YzIhW$WY_(VGz#pwFce2b7vpSN<GlXpu#xpJ;tNEM5=~A0}A1D
zijL^y?jfq-hL7toqjR;f!A3(Ed<uHB+_Ey&knggz-@)JA!r3_+>8B`EBt%kWY6Ag@
zgS#+IC%9J)8xNL@`}O^Pya5YZl_JRm{M{xD{!wz=!qQS8i2Oqv4*Cx=MrmlkF0_1a
z%{j0c#5XpW1U-c_ep9Dg3|CgPTjT8QIJ?9<iNd#T)87T<$wCt>JsN50Se1wfBioQf
z{4ZqGyuN_m{A%wl$CPb}^oKzX2%DHn-YjwZRs8C^Xk~ShRX{m-(zfhEeHSyJz`dfb
zSYSPAA{Lj6Dz?gj^l<nUiTthp{jJ38C_k_dbxU2!xvaVQ8tU+h;=FcFo2(eYXGd?N
z?Dp1hYcu45<7y*$FyU@k9A^)ReOy2fAXwJ8RAjK?jD`666BHSy=G**$C;u;><9sxE
zzNj&`iU!V}UgmnfA0%K0aOLVIn+zQXGYFE?qg5|2TiYj*&gU;&$lm5H%!dD*!I*~|
zm6n#5U!132oq#IzJL{D3Ez8-$&^B{+%$L&_*IN^ow{DNZD`CC<=ctK|k03l26&C)I
zy$llAxfs0bD|fL?rMsQk6%U8%+FZde#3~v{`;h*8(>BSwKk0?ez5C$i2+yh{_H^Pt
z^A8A30Ai;<+&e6!7dM?(xuqAa&19Bkb`{(M4&~2*{$8@7@_l0QSgLTku%V-Xpx|2;
zEvir~gJ}?SWL@<C-g)Y3A!$Sbh&$Abqk3!}CV>v31b}%JXe?gC5Wa-fsd7_F7g(R4
z>puwwYIR9EP8T2GNmEqQ>IuRbb|lXK9tGKMY>WRd1#5qh3j{R(HHX#8H75_}Ho-Om
zez>f1NcQiTkF@w2*8H4Tuiy!U@^YT~2@GdhWs0y#1+N_-zU|mB&$mEE9DesvDP&IK
zv><o%*B<yj`r3ag&w8#fuB}i?H^-PY%7SY#Fsx4F6CpqGdJ2CKh9o5?H^KPnH7vm5
zGxG8DjF`K8>5?w(i1IDU(x?Tm?opdOA=>q<m))ZpD<x0M%gg(9f-C>?i}yn-mC(Np
z7jOOcY5$=zpfd~0K94$u)KQZ+<ZS{4mVjN1^0V=ZJiyYQDRJ@sKf2xo8tV3q8@KPv
zltgwdC~H}>(@GL4`&LL|tRdTsB_W|jma>$jWZ%YaP>hg??1QmJW*9peGxNVk_5VHZ
zd(L~l=OE|daps=;zOU<ZeU`yk3qa&Bcv1#Z)~`|Cqhktc^C)bwlk>K=`vvHJsR8kA
zJMb;T0RP5<8O1LJ{_I1`pWoCWkq)-u_b(=#yu>_HZf|4rB3+|&8F-Dz$dqoqTo*@I
zYhLft`)wH-J~<Bh`5h!^`2Nq6r7H^v8A_1U!uhK_sZTzPmw4(s>#XslIAa=~_&{9f
z%fL<B+ws~GX}5F4C4}T;Wor%JKkq@K`TBybz&S(_ONlc`C<X-OXg4Y=Na@cs{Gsi$
zy8;R!-P|yjA~{`}po-J6gCyX1P(yQTG7}834#_+K$G@{+)cqQo-?TNkG@r#p6odDs
zOWSp|St9Od#)q#w0cSOS9<~f#=T8=mivxk+y@C2~Q#)Hex1LSe6Q$bwzz2YCX@VG~
zCVB1&8d^)fyLT;Go2ymS<Cy(|zO6SDDjUdl50Dluk0HPeb1m*6IDURLH|suj6<dA)
zoIt+FyBs}s`_&*x@)bjRJxwnybzdLbVFpPWpcGIuWU8HJ$aQClP%weDu-luoOa_73
z^D6x>D#zjL@GyUI0RZeyz*g)5=kTS{RsZ~5;wjiO<>GZ*Ua2f<Z?b8cd5ho8!lyg+
znUboiMeF(tZ|F2VL!4+wS6Nc%>@gjmnFQ6Q+5hhFD?PyJXPt6+Ue0w-N1&Crc}e+y
zO=a5XepC4j)ZO4hbZOq4Pa-cQk$1LXgl+O!p~w|U&Sh*ZjTC;UUrPwnPP&xzfs8Kw
z7RAh+_tNk};;qKg(x-su^ZD#Yrfo6*1B8Wz%SFVbB<VcU&2q@R3=8~^|I>keRfv8E
zZw#03H|ufueFZ!q5oKkl`5bNQK2k%&$;sK$E2$B>;|;3Or}Z>I)2X)W3=WVW*fJOr
zeF#uUQgRgMP5ZeOAOTJLMqi9N9Xqsmhw9>r+P9`tzEA(3?tiwg0`$B>ws3pS)g&yR
zg_n%^-V9;}?si|MVp+%Y%H9hR%?AqSJPx2zQ&NsEv#fI8ehO+bKqZ_c^V~GpI`HE@
z=45j}t(Mt=r&MGhApCE&RK_p)Mt0!Za623@XI@3q`U&$pZ*OlqP0DU}fBW_xK!j&3
z9qjE7$J_JLwA88Q(p~x7Y|FF(p`Q|9U{GN1kpDfYGfe*>fC9K84PM^fE1XpGH#n1G
z{C`3H*_`!jl#Od}WhJEzMcCOX#O*-i=(FM^z7G8cdBs(v<^<pEsH#$jC{X?im~EWC
z_(kvn%|nA&OGwiB7C;qQ3kP86?dcp3Zf@>#lP?_4I2pV=(SGE-F10^!W7wDGu+-+5
zqOvFHk{QLH#=^zu*iIsa3h$r(_=p|yP!qE0I0<SVS(SQF4h-{Q#zDj8|Jwjujbd~8
z2_@=#0CAjEjBp%}Z)0M_KM~^5>;S`k5aj`wQG3dO9}Ooy0x}Kae|MSl(C_6yB$3sq
zC#2g+WE}-|+<dAnWbp1-4-`eS&Y$gh>~O3LK*A)*(ftl?-iOeTbLSW3ZE-X4ZXqEW
z(+S4os422jb~OKqt(ce?7tWzIaL3m|=5G}E@v*}Y^SV?hcGE<HYSQskT4aXd#-%jS
zRzBz8<UEmfbB4JeKr_4t^oe@)g+LKn00vDj0W}P70j|AIZm-O*0be^JEPpp5$OVvx
z1h!mO=_zcTE3~v)DS&>(MEuBe$lxV7O1^L}`&A!xC36LUN>YcMV&fU)15z_N|Mp(K
zrk3{h0c66~vTu8mL565lO=J7Z6^zpD67rqLqUY+tbr5)V8a0*(DOc6|RI<9ddW~ul
zz+Vf*1BC6<>U?AMr*B;=IT;I!{Bdo0WoZWPO&<enbYWt<psc-iy2WH0oW1S<@0@0P
z7-pnYXkMVqLPZM9YACvUexOF|M@ftW{+g!Kg9pQ)ep|@B$S0wk_jWgju{=jKj~2Y2
z%X$87$9Oil0B7iF-A6l@jtC2X1MR6o^Tk&s{oFOew&9g({@X1a!W{kQnmm1I*W#`B
zK2>=MFp;9eX>7v_1tFcRiXqpBS!3KQo|=t~1E#El1`rCn12g{AiD}$AYaQKxuCujC
z0JR8F7A=swS)hA4>Am-xr^dG)lKT0#82RgsJ^HC@-g{+b+Bmx8`lx~(DltV_GZx+l
zfK-`WlA)`sYg<@DNeLRjtg*yv5XwhlQY;*Te7M4l5+j=qiTY~;9+`d*@4sr|%VW4c
z8P_es4NOIe9q*Tz#{rjg&rxGFYLj7E({fMDRwxv_`}6W;ya{oK&oen=N~Rbd##ltf
zn=I2fkB8rnkTyxXb)5L@7-TVv;lmsJXHoLXwK4C{oYz)cB0l^@13DOExO7wH@6*)z
zQdNYr*WY>SWCIIi3YoX$LEF&HSsr6o^|NT9A=XgySsr$nGgwdc111tIyA<qDYuNNI
zkoDXnqZM+=hJ1W{b9KPN;C-4@ENd);19TJeQ9G{SdiZ?)0!z65Vo3#C*fhTsxJa&F
zd_g^xSZe9wnClbz!hbCsdFS-)J?EaI%^(2ExQumc`nfw#OG_>-E<X2Tv9A;R4thBy
z+wgnh+|`x@&=<zPzJ29Ne3(cg;IuP}L$c&i83&GuPda)$TE~=yt$$O6w|c>+4Xy=W
z$52`Og5+@|G4L9U+WI`8?8Q*Mo2h>Q^+PPxq-~R01LGWa0ANg}Ub47bbRx$2lb13A
zpX^Ao`_x+Qy<l`DMDARQ)&bDPm2W<^UjF{d)ES0s?896RHOhj@7+h&{2n?j;&X-S%
zo-O5V>gUfZ)aN*py>fY#Dz5X3_#<1b&56ql-+1t~$>THQU1#UxdZ!fp>8!1+^7;A1
zY$dt0!Gv*o>qVa1fWr&WtZo&+yd3~v9;r_I^)#PQ#2Dh-)07t_;%sa5FdWAXZw7tq
z(vBk^o6(d#v=08)HTW)N^`WHZln*%mqQG$;Mc!5U+bIU=ey0Vz3ocy?IqLSot7uCE
zQpU!{cBZGNN#4Jy8~E8zcPq3_j41DK{<5TuAMUoN+fs$r%j#d{?X?B~gtLXQ1IqeH
zY$yNMYH7dzXvt`6t3L3z$pqJ(4@K_?l{j)HN$BkJOyCyJrOU;0;3f?NxM)7<=hmf(
z?eobqr2ovCW*_H8&|GHz{E7H1UFp>o;&7SM(Yn<r&yj8V^-f^=ivvbFVmB>7tI*xu
zeH^HdZzi+SKE=EWGGoOYU0c<2<0ai7IW|S!aD>Sc#bwj-=&#r&b9F=GU>O)PF)f2#
zk5!uMU^o86g}!L5Db{N>KdHsF=o~%!kS0)A!44S%4rH9!ci>EX4)s@YZ5ZD1g_1cw
zvKr~B+FBRUKD2zFLVxzdFCFhf0BuaF)LB>p6BX>mk^DyVW_4^y^^y?Q4}tAEI7CY)
zro(hUgqJ0JZ^s&euDa^fx%<U<dlXyVTcx&)>Q03C{ss)-`$$jpw{PPFijgH5+&8Kq
z<uQP=u&@wDedDDJm|~8U86}T)MLVTS=MjBxt=TQ_@|-2pu!L+h#D?x=8~j%3d+_^#
z;}WQjj_!dSQ3(u4IgGao20pPwh>;_R+&uu&GF+60d;KhV5e&>?-H@fiW1W7IZ&vVM
zgs$wD{l3Nj5HSIb9p#axMY;;mDM)Y{w=#BcxAN!=r{KzVS{_U@ue=0cd!*kr5QGa7
zV?{fPcHqY$C{djbRNW^o-5U8ZdRmhvVFrUT_NTFtk%ABgojBgThfB82&gXRv(u!{E
z5MSpV1pXcV2Ojsl>=7%^IqFx$WN?t@c$v$cx5dBFknF%YIJ&!4!|KB^SA3d}45y2`
zW1d*#sgnix2e9lxEK31C=B>Y6KdRwU#wS^JsE2$4=1TUhDCKDEF_`g<o<!u$<oc%K
zP}vW9BU`EoU1Ps&K5Cd>yzlwJtGRYp<?FQ9h_Zwt((B+v!HNjy;$5W8Sn7v4MHCxl
z=59aNY6u1=I53h<P+q(g7Y282>Rrk5N80RZBe3O^3W}=KYf?4|j;gDmcn!sYFaOVn
zQjVt->rv2#%kfCrMhQjKnvz|O$WbxTg03O8pH88^ay68G;QPFO$nn)ym)vC%Z;HpA
zI}*S#rwh!me*i@E0|*-CTGsiCrc5i5QtQYMk38v1@i8(Jc-Bf4t<PU>+rNNpTNXId
z#1OqlP8<9A#JKlgv}mRgRH^sW;D2^Yf-91yqYHS7NY94^2Rl!K{yHmvzzYlnv{!)h
z^XEd*bduA0xVxt}C;#vTSKeC*yU~uX7=*h6j9H9k{V#k!%HYhV#~sEk2#G6UMXm1v
zA;8@IUgBn!+K%g@6TM83nB1o%&fAOD^o2gnhV%*oPY2u&YPpVz%NNWB3Gnw3Jp>PR
z4un){e~jlOw=a2O+6PA}FIj12ge9irBeR(rT5rQ=^hw=>OlGvv5d&Kto{lctRn@EA
z+qaPPjSfg=!6yMfEe{VUa;0EqRGJHxgobqBDcUIBsE<J!=>gx}HzxY`26wOGw0uI;
zY&`GFcuC7*n&AEI>G`Qk(m`QYH4a6#n5OTB<Oa*!t3STzy4C2R)7=dlA>=@N$Y}65
z*kTYa6jw^1%hKX7Wn};P7PJN5e<;F>Q+U5&is*d`n)n>iNP4tsb%KP|#;}EMyzXjK
zkL?oIN|p1}Fi(w#D-8_o?$&`@n-aC2lu`jKnbDTk)}4hr%*%kFF19%YSTy~Y%;2{K
zr?Y`&Dkjf-<CvgI@k!=tJ2VxG7M>F2-@o>zPhO$FgIJ#w9DKzDXa+`u-e3~wUqd;r
zM#Zv=H5M8A$H(n}Y~+HvLM|n;ASst|Ju1|P&f3n7S5-`up_%@KRvI_k@D0bsov5nh
zIB5Tc?In$x+u@x|rXHQ8ns;5It_KSb_O9;ih91shGP%7mTJCT3V@syH^@*OWMzO2y
zog*h`+aCF!MomxNUVe3`(N!G6J9NSWBbGcK;1hJh<%^;^`%oskPgwE-`GJZH;@sKy
z{)tkdlB>itB3r}_vzUgGbQPHb3%ii^q2z)3*=^4qV^=p^-F*6X4^~mLpfc$^_6=u$
zJrk+05P#7>|DB$LyjI>OS4@w&JoR;VT?Xrcr~L1+89EETPkFvu1~y*>g>a8jz4RLH
zv}O5KV+4UVTzqr;RX-k6>9DwU?6$Dc!e;^EDTeD)+!8c(lY3F?FAd)#z__BSy823I
z32<dN#KQ_~a?1huet_=xa1KzOaf@&P3Fzt52i!HROfmiKD(e^D?Q7ndY4$;RfGY5y
zAIGiTE)cssh|-5ayDMA51<zKWre_YSDZ@J7@ee8o%=gOrdYeuMYimQ&q`eFbXo{8j
zp9-sa(|GEZCt2yWaDG&%zf8~4Vyu>Jmn)|y@MKt~=YFTF^l$a|y|t|#=c|P`N{P`l
zdOx;23icXUbKSxvf4F}e?KvvlEx_S2c$PoC3VO}8i*24Ajo6H*3t082?{0X(x!}^f
z84cy+c;xcIDr<DBr_x1R@SErB$>g5lD^RUXTLYTD=re3fj#z2+tP9XQTAAOEjK*#E
zy1z|#*VJKkque=1Yvmr?NyHG$v8p;=NWG9TUW0Ezd|J{~5lssrMX#6UA7lN;E550d
zwSMH?O>tAp9>t!%X94|iBU_Zwd}%xN)w-3L55k!|wqWO*vptqiNkufue*Uvo)b*;M
zXlzlg3{w>UZYwxyf9nx)=7+Vj(g{V&8CrKH2FS2F<0XL{(S(-hG}~`SP|ITEXTD`c
zzna9zz3!7_zugVDxC8ooV0t>#L43G#>~@Ix-Z7txvG6_rT4K^;I3%0nt>J}$+ZOBI
zGE`z;$5~&`gZuUlPrEYC@QLAQ4js~y^JP4UvBMvuAVibr=K$r-am4}9V(;_UoMV~g
zws^|Lq07=gI?8t1zZ}d9UG#v<NwYdf|LLfY(_PQ})y!GZ#*xw{dCR(|EZKT=xlrf4
zPiBj|L|qpD{tR7yrbY7uVLm7P3d?y32{m43WM`z7ib9%bQsl*eM^<;T2NuX5o1)(o
zab_v=uD8tVDR6#zg;UnOQCg>>r{EeHxr(ps=5?*)ozSR5diOA#Wv`g@821p9_l%0&
z%T#uBrF$M14|C<||Ax_EC|bArVEw2FY5&fpX6Z;|5b0fbd3@BEO7r2DraKZdTmC1o
zc4LQ4!_O#ESj6UrC!PBxp9|Bq$#Lzx+A2jBg=IH1ZD|vWUK7M%Lp2Vwq?QY`JI@2F
zu|95s7b3=LC@7L8-2Lx*QT7^#De=%RVAbHycHwr79*utv%0C~+CzdJxn@LSpIFsZH
zVPjixwY`qh{=2;-h11uN2{J~*=QtGD-4Afw@)ec9wfw&H1NM6-yN2?x-{IAo^o7n6
z&=$A=pb0`VhZT_!)ZbH7SAV?YbXek;CmeXErKWe>MbByM_jGHzZ|)`UW5}HCn;$&h
zWX%7#C{PL-<+FBsVww>&KuI9A8nxC5j#{S3<HBj&Tw)}P>jeW!oR$X%UjitYCD>Wd
zP(kQ3q8LoWd1B#Xh?Pq{zt0F?kE#`8@U>|boks`@%=A0<@KTn|tA!a)LLr})384}z
zDOeunqcd+@kKw~ipPoFujiE95MN*kOgm_V*rJC#&RrQ{bgO(36|3yq0N7iOODw-mh
znp8k)9uopFEe*LclU3&$%fBN8_C|Zzu!C&_%+t@A2tv$naFO0Up@CauHML(uycQf1
z81<#$;=Ih;8l>_%XBVvPNT99xe7TDE=AovqJ9eEtsf>EiH%jEhD_Ir--AQM!oQ+<i
z-de&$9U>)Q{NJi{b^2+vkR2!@Y~cHU9ttClvUS$#tJfi9fo+UGWT(UD>Nf9S{y2A{
z&S1JAQ8}}JeyGZuV>)|`l?6zu$dh$qbe%v{)CXqsK760cfy>$f8c@2Q;e5f}mSB78
zJ#DAo!+qe0`{BMxEyS1C^tmJ^-Ad`;9?Mz8I?fS^W1cG40S0IQ4?O|AdwDsHfhZeT
zUVyU_$m&1*OuBixdAkNg$)%UQyOLIQ%w3J{H!U2T%yRS;F}6OjbCDw#Ahe7qQLDXL
zfy7%&w!NH}aSjK^dS_HRUM@j$`<e|znoqKRI_{&;bwTf~+IN0N<)!X|<7^#=mJ_0`
znL^6s!UY&}%P-Pad&93EtQmc#riQ81!d2eN+!zTcTDpfpFDogtD53N!SMZt;p{#6A
zPmOafy@bs3Xrmm0m~sTNd$5Jc{`D)ilvRTpu24xWi^JVU`dU8#xV~qX@!NAe;JZc~
z=59skBhlia^rC1)rQYX@gag%$1>EKsn2YObN*Hs%V8K$%D#6t?cy#w?h3cm2_YkAk
zvrD`KB->qN<s~6!7fOlyG3o`UFSuV_etMyeDgL*XP~wR2|IW=4Y(>Hq7Z<2AW&&om
zx_N4lm1hZ}(}k}ZT#}SII(B+GTP7BMgC*H&NR*cegt~O99QG%-RC!Y(sOpEyL}g&a
z;Sb<?C*D4o-d>bJjO8(fScAB?6G1|zr|xBZTYsd$BTOwv{7(EKM_U}wm}?tssq&1$
z0Y7FBk8WW3;!I~V0njF&X;zTH+t3GEyf4POmaSFZbkA}9j2+Be&jFhk#91UKtd%~3
zNZEeaEWT@~;K$J_X2qQPrY^Am{;lA!&<Tc|=S+Gn$43VzuN`Fk;Q{IC>8OmbnSV@c
z$Hz=tW$e=|8Eg#e5sB|KG%7X4VwfZpd8Dow(mjkO=D1?&PWaUJBI2<j6>9W-DFlxr
zrYi$XBG8dlFKhD;YLj;NHboe*hS}9tIySvbY3q(QH#~*-tA`{(*^?<?U$8kQ)3YPJ
zCudqey5*AxwcRlG*RLs`ERbf^Ox66{(^={NguZ=iR4vwiM`XJ0H4Z2B%fW{@yLnO?
zQ^~%+rI1dbYAo@(^ye<4mXd!SWaHBG_8kh`grp;#?}gu~xOw?`?005DPHXnZu-Tx+
zwWzS%z1Fg)i|m){<nivK^0~y;s#9C5KAJw{vj8%HjRB)RARyWS!<nbXMnd5xD}es-
z*x=EtU3Rw?i2IkSQ)Jc`2P=w(MiR|N136Sp_CS8nY{TV!jJ4zDMW7k9(=}lpRXM?b
zJ$y>YHk>Mg3luxR3~syFyB~mx<`owQdKGtS@FGL<4vpR%kYUFeu%_%x>M?ri!s;KB
zz?75ii_Wk)$hF`l4<EXfw`@%*_dopboE+PuS)xFP9)!VvFszNqqLc0-rxXKeEPy88
z<c@*2GS@<T1X7bZ_y+U1eD`7L5c{to${h9=2&NBoY|s#oQ=GXec3u-jCfUy&eeKQ`
z^M5&Yg6$`7qMO~!d>ifNPW8!rr-^n~_Yz^)hew;rs2N@Fz0BlH`Q*3$I(!15Gb)qW
zF9$YlC$JMvaArTdTNm>W4oI?Yf6!nR%=|^qxqI`M>c7<x)xk{gc&P>lG<*Z=BD(c&
zHwg|73AuuWbEU`+x|VEH>Y5H2yEjPl^)RGn>wl6rvp*~=r{)uX_fnhA+t9N=o$mi4
zlZa+&L4xzywh-#r?^dP;rMssm5Adshf#{&0PLHOaGR%v9IT-Wk5s;p`o};;sA1>o)
z70rAi^>QrhO`7uJ`aY;}R`lRL)Z+W{mh0Dr0Hw6SW<%hU6Q(1Ts+<uHRBjpJp$as#
zFJ=MT>}cmI{cl?a2EI3-T+J;i;+z(#2A&B=0oxu7y`{BdA@Sj*H*PS@Msa)7eR^1T
zQ@_y#Iu;JVjr!L=Z=f?HR<b9#X1l9`N<Ymuu+M4CoJx*fbJh{6cA2F;X(q|H{MG2U
zfm&9+m_hcfPU<&>Z20QAT%7Y{!ip8qrT&j`Jm|EpoWSbMDuVr}r?qDdY9jmm(js0%
zCD^z>MPT?brC22O7WSBr>FWjmp1qVjt;Nxgrs=B{cB>k_xbkw}?sWl1#U)jf;363O
z-W+sPPC7p@2OBr|jV!n7*BvtI+J<~by0h3ssSygf`c?H7=IaI0yJgj+p4yKIwg!|W
zEP9Jlr;><i&l7N_E>;MFy4^rqkVtaKZu`5{94r!pME-5Yz|CYkT#iZ{5k4jS4lAuu
zA<NXaUS2XSY!`}`-7Kr#t4aDg^?=h;Ygp9{d42^nXpu7~GeRSYNi5+&Kz}_pWX}&Q
zAnw_gduXVp1~9SE)W{`wPBJ|V6Lmkt{^krSyWv)V_x>P8geC3|M9Egxnyr={U?f8q
zIg^yNuewTWoXOvzZCt0{H3XD-U_~st5MTNM%&({EX=*O@g#xhX1aPed7yzw-b*UKB
za~ufi0p{AwK=I8g6&v~7grI)<DeL#)z&<Mzm4*3f-PBs_NO%T&M2-|ha$bO;;Ghl6
zK(|6h?4|(z3GUryslS5Dag~}oQKrSmR|Ja7^zzk)Yi2amcsvs5vriCiZcm)p^y^_b
z_iep15~hLpAUkwH?_M=2WHh9FC-X{{lk3n(bMUVU0fx(pJT>y{_NW#IjJCnMHGOY1
zQv)<}Lu;|A>!XN^UO+}c&2yUfoH@&f!p*1EU%hc2GxrgE8D{eyX|WfE@>ljhNkaT-
zq1g%4UH9L|3;m}NAb3*HT}sF+cLrUiwHuM8D#%-d4YEv;pRXOZlcy7jh3VJHf1z{V
zZ4hHK3>!1v0!`EpaMi@ZmF7~Ddx1I{$Z%#`kE&5XbcG>8oNPJ;1T=f2`7{f_=E?0K
z9$qf{@){YFdX~m?hk7iwJl)5#pB5a_2v1~2PuaRP&+V8SD##oegh5J<irK#2*xrs8
zlRQj2H4LO%1I#QyP6=|oyy@At3wADTl@%QotD*lD)-#vilHtSJ7wk@hVw%K<Bs02h
zgt=(2Jsu4S<hXI_M8rF_yOlga->Xe&P9?u3_!!e#@@({OmFd0jo4j|($W!Ta#Y#iD
zij;J<-qZ48{PW3dCMouoI)1@7ex|yz#plKbT{Z_1?C8hzu|70am71i(SHr9DBR(st
zaPzOqtLyl{Jm_4{pqwjlX?nh0k0{lg?O?M-I#1i}7ewh(e;I~d{ms;}Si$Hz&P762
zHvQ?H{kO}ht=GjlYFUvzLrfi{f>qdmotZ-;$$?R;tofriv>&mhak5gD%+nXl+ZplW
z+Hh(cYV^KMBBtK~Le|~z1Fj4k;GQ_O_qF7bp}aqt>RRCh&cNsTRCX*^kB*d14NJ>!
z$><eeQ|1RqPehopS-7(AZrKZdYB{k!H+FD#-&@2sBKcd+$s<Pd5npC7Zq3JaR5QXA
zytA{i+Koh5VZiE2T-Z{eFQOL2Xs~hseYU|7Fw0V=JUQgnBKDJN4ltu_`SiCK9Y{ck
z=rq5XE9cGF7p%YVB3kLz!H)11R36J`PME`ay>FX2*>nQkCs_}+4~@Qg%#^}LTcj3#
zhdwsAr^KvU_~|Kz62nM6b&V^y)MSP!fq^oJf*h;DdkOCXw1H9mtV=sIGEl8TE2<ds
z@ywDHA47bkiHh#hG)*3cP3h&!_e&x=(#6$KZo$hH6{20ENI5C~&Z?n2)AS&3g^Z!V
zE|2<`{q^4^PP9xlJXvYzS0>9<Jg3PSmt$W^+4K>de1dKx+`{C^G%x31yKAK`-%G><
zx1kfFCJ{OY^~!9?sw@kmzU#VpV+#M|A`x!uuwMdFmT-SAva8^?zostarMc4m2AeOt
zYk$8X$0_VX=Sez>Lu&Qyvufj)IKC~%RK<pfb+4{!kT`EoC3%4H6A=v9j<WP6J3vU2
zYAIl7mrHuS3u1X5FD!sbeLfr98w~<Z$V4z;6C<U@mjTngJNadX`^-~YmcIlMdkHSJ
z))YR)`)l_dX`*(3jJEDINM{}U`BUPHwgKRC7P?oxV)HKt9Kb4`!*7$gC1!ihS(X$P
z#fe>x)_tqZViGF|GCeGvuux{zwSGr)4rlC1q0d!4OwPJOnjCtsj<Y$p>lq0$$aeRa
z)Ap!6wK*8u=a^fe*JE-=ptyI^K}6|sRCceIYg92}S?-hHokfqRD1(N<y1P~qQm<bH
zR74c+o!v@n^16TRt*5ENXp@Zq;~tw!{SsDOd5(8Eeo$b?_-cJSvZTpNNV5lXl+8O8
z@gB<KR|5Ufs(7_|oawM#XqZsAe;cr$8BgC;;|t@?GZMU8xsB4hC8#7D>ZD>KfaMvj
zUwI<6ll_Gj>Zhqpcy*ByYx1!x{h)gQ^w_$_&z9dGDXxF^V$a0C^N=9)w<r7CnR#wg
z8oJBlLTWBLS&P54m`EubW}c5?xtz#Id-YZs3X~<|#d;g>h9<`V$?A?B+~f|(rab){
zUDEbjGJq8KMd#>VT$_$JnYCEQ;J&R><b4X5T=};AD+m+0a%SE{-tO}TCgwDe^pHDC
z9NgSptG|A^SrH?`rkU5(xDS|s&@|vn@)cB?bAZysT8sleOB?op5%>~Nrh#!$S>NDb
zij2Ixq;~VuW=@tQZ6J^AECjMC3GD}B81Ey#HYZzcAvAGLz~@t!;}D%lkX?}!3&vBL
zC1?Hu<WS-W@yu1}yhw4(@wYOvl8QM;WwFt|H^Y;eU8dK%{eQz6gvZVJDii2*IB_1!
zU0C@#iTDY5cET*aesp(P_cq<txJGpUwc@zWAL_^NAgrgfazYF-pAV8mc9%7(Qr&N4
z6~Xt6R~7BbWCaJi$P-f!z<~-qFw_eha=|+M3TZ=LQhQI^Z1|P%?s%_aMfn-Q!ga4!
zp)1n?<=D$(7ZId@yYE^9?YEZN(Py^zvBnzBEs7AeC(Cr)FFgJfjnt25f)k|#WDQ7G
z`rjLEDu$;v_?fTS4b+nOeYnT!1~w)6<{$dGK|o7Sb`;HT$~Zu#F5JQEFqcIz2j&)P
zdA8;b^b_l=$ZixxY$d`;O@d8-XC}1UBvDu+Kqlh#18-hFSD#pzQMc*n_jbvm$(a2%
zoA2?LeZU`2i=Q0zs8`@m)irQ#!`)v=wBwi%XSsghDK|%R%O!+(Conxv4NnCBVw3`5
zvsr+!_^wC$D;Q>(wS+<F#I=SyJJ~!-fC^iIN`jSRVq4ZVCPXQ)ph5QM2Ei*p&|epF
z;rzK15g(mnbU!Lxdnfje({?e)LUdM|p|&%!;Y7<&oo*_twOe`+$r{0EoX)v3O7mP+
z6_%JEGpHOFX<#K(%04uUIWgCcQ~RDWRCav9hUL>my+Y9I;n>lAbr-fJ^SG>pV#iK?
zw+|@FkBN_b?9;4D4r5!oM@WdQ_0jl3JNl);Lg-MHUbDXUIKutV(`xK>yU81vv5X&H
zC&*AXtnZDBd#~q^A%{4=AwNH-37is?aSNF@Y=ZufQ28jpJUVk)>_58<K4twEbENJ)
z_-gg7{Y6EVlCT$$aq$z<iiD!=+ZyaVbG~Is4jR0qonb(iamJuVOrGTJc821wegWDk
zix;WetGc{oVDJ|!^%01w*|~J5ccc8x%wEVmkoclg!$<c9fLUJy0F*`G@d)eRM70as
zY3e=8p$=^LUj1D^Jtf}Msu525)i2%OX}1VhzOJk&_y#$>$=2<TiUL&ihsPic`Y%Di
zRv^9p$SJ1QGa&C#|BVUr0p@&ZNDs5P$%Sm!j0k+r=FkalHjqZ>&E@;kl1w*M^TYi>
z!}sPW)*4n7mb=?s#R<hjG*39oN5T^ZP1njW?!9|@-Olvp(XJ2Ob2Y=VFIIf$Toh$~
zb-OY&B!TI!xBQ~8&JXPZJ%}_{_u+{Xl^6P?AbIG1>=42~{=kC~*U{}*%=bZ!reafX
zg{JD<1a@Q$wBjPxc<gX+V~PtVG)ASEeKEBk2{EaHzK4oZn2L{o_ljH$!d77GNtrzd
zon?i7Z2u^qArw6eNpIVVPkEl+Hz~7ZDV0PmN(RNLzw=+8_UAJd)`Ev=P^%X(X?u&+
z-T3Aj%$3B3y*vTGxxllv?j_}M4u1?&_hxKz?S(u5t#$xU8ql3ncKK}|RoaP<^F7pw
z#*Le^DXLLwzJC3B$VXe6eA0*PV@@qndS%Gw$-|@%cpIuExrmG_DgHQh=-)ALeneM8
z;^fcCp7HPv&5ZC;kt0V8sNU<#nrXKf#DO5%k&YJ9lMQN625ku4z`d$Y5Sexe3&PUa
zBln)y(@o`apT7aPs~3clq4A-PW*O`-{cs?)!#tNW!rhHB6mP!MrW5@p4=Un%{+z%K
zAB-NqZ2fopys>Tuy=TQT(zWdu=2SKBL`GR(9Dh=OMt~*D<Be3==D=FdmIo#!Z!dH4
zhFYHD58E)op>eap!*bpC;|W#%1HrHAZsr6Ixn>lJEPKowH3|&8$EP&FPOonB4yd}B
zG$F!5OGM;}dFZVk^>^R33sy3opIIXugIyEsP$C*0WK?)j?$wI08qvV_2L|kD{VC>g
z*gq4_zhxt?VuaF#j&Xene)r)&z!Zus$`j^bWk5;YW+~Q|`_i=0(7+=ED+QNCI4_|?
zS^Lo=C5Lj+hdQSqhUZ4*t$>WNVtIMF8-@Gwjrk-J@JOkWWVT-J<x6!6qRjWT$&y6s
z=<{)0M4A{2Ef^lF$0<mIpnBp|rmv)LqlD9_JlIh6y3_j{jV(yPo#!IHJts~aZuqSQ
z=GD6Jy`9xoY^Jx6v2NOLdT~gi)d65tP5~fPhK0BZU>KbN+|&C227}!7@j1|=8)tAp
z;<l*h$IDNTb`N5q6k%h;F>$jdXyoy&U70$S_(Z;m)44}^Oj0--9zts!N)#(f4*EgO
zuUB_JPBl`HgkStxVVIO2e5XbBr2BU+Yk4d8@tL*22izy(F;beU#jaN21L^8DPbZ3s
zm*0jRT=x{%G3@s0E#-Wtg3hUXnLt}^lG+`rxWL1^k?=gA*L^y`+g0OE&)m{G!r?Gx
ztN!9GQdd*i&gfoXT(+R7*G59k683#@V`Wob!y|Nmh)3o-!Vm)f&a3)KD+MLcU}h(5
z8&%iF{BJMO65(%)rg#7BBI-`co=ZFX{{to4Lo!VkI2Vk55-^#wmShRbNJ@VXxWerM
zWeqpbQ+EAJm$rRcQP}IEFU|$a*9L$=HM`4W+%-V>kRwNw-lGgY)Zxp3pW!7d`I39*
zXTpj)B(t7go}#i^#*h915krzIM($mTT03tSUdYelsSBW~Na?gA3<tggG6(Q!d5RNb
zQuq7$BzNo8t5=3V``{=3w2pR)>O?$PuFI19tEJKq(Q}#a5lxJP1%yFw@^i_Fa5~f*
z2)|FyOSH+4a>xx<#k|=x&dZEM=j59#)@jXGY*Uzq7CmyR#!QA<mBm2lXj4iNy4=5P
zJ31s|P#%_gag%dfy{LdZv6bOw##hZre&_!f>wuNFo$(;etS!~!G={NXm|{0x?Tl|^
zklSn8?cK2h_D)^B>Pov;1u8QY(SAOYqcFwbMy4a@>@p?_{41cv$k$N!A}8|764ruy
z4x6N{=;_KA=9E(I)jnvK?N%~`o5sqK6QCG3jbX1Y#EYPq*6kxC``^l2s^5L5%a<Cr
zD95PPqBZkh#Fw(8`sb!{r6hIwCH`yPbQZ{jjlgPXMcvD~u4N6P{jSY||1F)UAL!1`
z$9U!sqCxVxJALlJB5i%f5+qqSwfl&ExI!cn$AJSi@K{=D*#%Xeo8@O=79JY2SQv!;
z#sQNDKDezH$co?N_@EE-R4}oe{Vy3rD~|Kc@QlQpWA(vC%=n)fMsvLpI$O^UdfdI+
z0pdEsc<HCEi(dZd$n=btu7&q<cG41PDGaz(bab*StE;<w{Fz$)0p!t>%U03)Mw5p3
zj+WIkKnuxnynCBYx*SR$w=7hucWKrPwZ5d7Lt`y6%)UJ+{6pQ1WLR9CWby2U2g+ZL
zwYV+f{dszW-YTEWF)o5L?%B}WLSvVf8hVU=QQg|H=ib*2Gq$iTeV6)f8(`a2<ua;L
z2JQWrFtZ(-gwtqqdAXO^GnUOP^{uMTfdx<aZm%Iyy?Ls>xJ5@m4NTMo#ziS|ra=Z@
zLk8_^4${bOjASm_n={+w1<6Cv$1^HO*t7FJyA+zg>#|P|0LLET532F+WA-^pl9Nwx
zk;o7^$?IxnSm|K0{dG(4-H6XgNiW=F<oSN@SiaI^ZxzJ@rjH9CVbuaYst(}h`l5lm
zEpV~%1klsDPx5MHni{h1o|74Ds)h}&a8^N$a`$_wT#qHwAFJON6=XeNnE<MMWiu6p
z>Xuk3g=bLV(O0$a=)`CO#Te-OIayF*4Eo=jnOU4gYtdl};;Su;)xc=ts8}xZx*l`4
zg#M>ewn&JjyIr4BQ8Vwy#>VkMRqo_nk|Bg?ZXTNXOuw7ipmMo93Cui)4%eu5XMCz>
zLM@%P1$ClTXeP9N$G%Y9q+D^nvPp^^g%1jW+e#Am9t6De#LO=?B4k2}v|Mp-(Pf)`
zYn{v0{*^;+uZLAip@~i|OGgH-!a^E#<gkd4ciS@V>?hQ-?uN_4N_I&2O`q3aDtMQ?
zgmr8%v_yf)ilvgFdm7OM4a_f9`TC!>6ZyT{c3ZNlyG?>&+z7jAuV1#fd>8(L^+LSe
z^zL1oRFWKZ`)pZJKPD`;{2ve$n(US2M8&1N;7NW<6a?4Q?>KBvP5`f~sL{g;E*;Cy
zb0}2T`IR5Nz0ZE{q?=WXiaK2RtbXp5ylCKyrF&Jc;=?C*6hTk|8u%C^&W$R>Bs*wN
zq<$bq4oi+aW?f|OboaWMFXi!g8`?;PJjVY_#~$K?JRGNO<y50WX%%5&H2NmG<Kd2+
z9x{=0X<)msE&%*wm{*T`?a4J`<4-k`Kv(^&eBcBN2-(o26NnqM8q%JOn0#n1$;Ui`
zqj{(=R>PvqrhaHt*VU|c+T+{#t{;=}1z@y{SA=|QX;SBR8wt*4OEc2Fl!$A3oRLFn
z^(%xJVh0A>8ZMcy6<gJOFlowvmr~^4hsb~Zm4E00Mke{D^`#$)tBpMk?st|emaOh(
zGc6r)>iV(Wm7`*`k-1bqvR#HWFsNOvHm|lDWcq2hRs~gUv`6Z!Up+MX<w96XXo)}4
zYC{&a<cw*485&|>;2>3L7PafTHNF|>{d2n_SxYrop05#f=s8Q43sH~CwW%vpvWdoi
zqe4*{|Eh?84Ki4wPG<_dnS}f<H%bt%(+g!!<4@JZvV<Mv-J8rvdInMg3;ja^0?ac)
zN{ezt3lBK0m#N0W%E8!a4q64LkYzMgk=(#x(OG?!dpa9J=_)TQOt-T;)v%*R-8HB0
z`ckPj;vpFi0{X0qWf>B>weK80LG^O*;qcVe+dDP{0``od4{7fl0V3hfAeP9|WgPCD
z!qL?h)~oD49nGFB0YM@Iq7AmRHwsu&0RaK(yv(-{Jl_x9M$}zC@#u{KOW~mj9{+QY
z3yc@0b~P7rj=sD5=yoIx8=b<(5GgFvy)`2Kv|09^fDPJ22lKN$scz=T)`*&DU+ynu
z&TNY<k)KC`NSi^YcZ=_S_}=boi#dmT8zIbD=w@ZD6NdblX^6Q-_;F_Qh|68UR{=%R
zW=X$fZ(*6<tzEN@a`y=tS<|;^(=*{i#vqcQG2at|-dNN3Z>c6C*`Xo*ZG-5Pc<fg)
zVk=~DzMU|zU^fE|WA5)-Mxi=)pBKez-RV_d48a6cVyl-*5X-CU9&lw6a#`>;=$Wu`
zkM_xKI)6U>m-hw_+(jbXKVG@h_3&NNAY-w1Y=}6SF;tVotudqS_ktJG2T_mhtu4dH
zC19dlv!{kkIppx*CrBau0Rkh8`rM`V^ghY+l4<<OaT9jq;U0Uk*$QdNYR9N_+}Wdl
za9qgkXDz|ynLi7R4>?CV%5mU}AeZ|hqLqCgN?vBqt7Za65&|JHB(@MfLr+g%&Mgj!
zJZKq{ZV<<98_Rz;I9LEAlv^^yhzY%jiP_DU>hQ$W9kZmnp^%GtAPU!FxVUCNWh;`#
ziW>`);<BF10@Ihhv=p!GcPMDsi`<EF4AcFb;44}tF=|qn1#4MU%8|uI536ANt}pfH
z2~QUa%WDd~8!e4opT)|^VFm|8st*r5NEwv%G~**Z+OqR_ozLHm@Y*wW!LMYhehReH
zcsbA(%KUzbf2a&^wOfC;exdqqHS{$`<=#rdp^49->;jhE^iL3b<-rSKavLvp>ZLV4
zY=RO7b=B_uw^qN*BAdOC3s}=}VrrPp{<#-eNu++J)(O<-Z^fQE5VikL`1USxMBWHS
zp9UEMv6GlnEESQWh0tL6LZA|M<^=IQ&wgHs)=7Ia?{xo&#PaW9yGO&q66>@q;iZH9
z4(*$lX5i^iRQZ<s#yAzpt-t!G{JtD<_i0v|9?YtE(^lco@=IuJcq_--^Yly*`d^JI
z%4zIy$#vSeFU-f*rm65?zS)O^-8bk??EnoBa8gdTjS`D_92FcKe0=x~op>Ab`GcI#
zX=>Qoh?5?uN+{%hi;7U(ie{sE$<Uh^?GN~%;0F8=vF@>hL&xy$Z!QsfT~TxSHrK)J
zBO_anuXRZt_>pozr@By>HzZSC-R<>ML)eF%bZZ0@dl4Bi$m(B-_S(=GR(V{KgvM#q
zJP+vGszU0G^&k?a-B&!d9aBexQ^TY+UKT-fHcR!?IO*<@0QsaE?a_b912gPZfX6%`
zSZsvEV(al53Gn!utLQ=OzdCznd-#{-*!~UVqwx=8|5qBI(3L~K5cco3-7t^36u*@3
zHEG)no?2^ps7BH%y=cq9^HZrYRh#F<Vk9Q1!mX*5K~wGiJPJ5D<~Qvb_JxdCiXeO@
zzEFH=P10GqMc%E%fHw90UlrL?rY})DrLy3~35jQiBg>D9;g4Obv7e3NitCYyw7isL
z<0@7PNEH|eWBxga2?#u9=@eZC5x`k@PC@j=&a)mB=X{k+7XGfr!8_<OzmdlFRNy5q
zvu%;dS9{l9T@zc0MB=vLbnurU_eO81?W2h(ESKK#b-7{V>D}Ziy}j=80QQb;$dD>5
zwPw6BD*%)6;tY^jZm5<cuh^E9ySBS55MPqCU9gcwAvfl`)h$N?HEgstMr-5{iMxWT
zyDCsYT(v8FyPWVN<>p%Ep^07?vkUg2mS^_OEv@9Rbswv(agWz3_X=u+8hdgg4E|e$
z{pV{+c|aVl_hS!r3z$;mq4PT<w<2xCAH6><E4{|LS^~6?+-0TRsIRm2Yp2in?5vhm
z91qxCU9HA<JUe#%PR7qGGrkbY-8%W14YSKPQ$>~JtUNWysV~o-+CPF0?#Bgym))v#
zI@?1-)>5sq5n9p<HG6dBi6A6JjNy5uBMsuSw!*XKN0#)5APjDvzS1mfdYpV?kzmX>
zlQ!in9Chf}q4Jao-z4sg%grF&@@NYp61UW(l_<1mooCPE;1!iMSljW_RbCo%eJiw)
z>$aqadr-ondso}<%tenRx5k+;qIN=OIof?=FB5p()nRs(>#FgvH~Ob-yhwIFg{ETG
zB}s5fjc^xiz8vuwqt+zXbQpVgPcFbFF6m`udME`UT-oC@J~NNm*0Mpy;l3|aCshkp
zMGXF6)>YhNLTGJ}rgw+Wa8OSX>>!oqOnpRAf3ScNir~wCog>nQ<bb1Hv0H4yrZ~lV
zUBCo47C!sLUZy<0U8ZDp4j-jF?Lp(CDoySsDh=?({s?6h6s<nDS0ba8$;(1TGE*Nu
z-k+k1Yusj9vs(4eIw)g+FbjA28nC<>+Pkh^z#{g2a@$Na_VPI~y0aZ+N&b(*8P}c@
zXHMRc1ss;#w6=#~!~8QaWG?wtKeOI-mT;;kpeTmr$z%=pr`#IJ?!@O+4yDFGlRX<O
zqyxAWoWxs$Ss9-j>)InjOym;96{3_6Q^sD^n&VT-61Mx@LnqH5nb6HDS@|ySI5aKz
z8n2;ojUVYd?|FLmpl2*YGd*LlvPg^U1gBvHx>u!l7pJkPF%wo9I_8DB(AA={{MiS3
zrATzbw4@ie*|3b->{Y+CttN{S8LImgz>+n$*}4V%2JQj>CG*!F7}%;c93I9;Tpm4)
z2<^AQd17Q4G8K#7k)TV8o7%Poo7IH(F1WKq?JbSIGpz)1_9k%>Y15|lG%+;Hexcld
zQ+4y3N7$0rJCu=?+ZcJv3c*2w-51^btPPVSVrCjdq;aaFD%9QZ|9VnCQBYwLUy7Bo
zZhlrd`~~4%GTvUz9wYjtWko|2Bz&Tri%3E~N?(55*x_kzs&tBdXYi`z=~kE9sJuta
zaAu}jDr(Pg8Xgx%$$$EI-~BaJ=#NARM3#5<MV{0cCQE?u!K$m=c|E!`sLb@Y%v6^x
z2KoMzmse2-{n@S$iK#J((;Uo*$}MyZ!Q%y*O{HpB=Fm|UPk&zKo?qfP`7PZOYubf&
zH9qp;=t+z5$KDfJ>nOiV$3o<qh6YidPSEvQ-0zi%o}Ssh-E{Yr;<&n#>GOl%#3~4H
zhQk_lI%TtmeJj5~YZn)D2m7s60na!db1|D2`2xz5@dHtTtSxeQ5Yvr_TE+y%6(?b?
z5YTY+bA(jotv%ryh;4jRSKW3Jc4Y7ZR)<W2Vulgl-SPElh?0VL6HcR*3TCCIVV%3-
zu#nM<2$}V;*_O}c1f}9Af7Xh*_H7I{_3!=xH?hXL?Y}ygFihzxrj8P@Rb<M0`LJJ?
zz?fSUckXB=pb1cRzDR1XdJR)bddMaIew@3MDJlE+E-k$%b*Ez!jL*>2fQl-%utza5
z&yLEPre=S(;aT=&_H>k-6&DEvz}N8_@@&}AFH8Nj9nns%36#@we4rcYiu;2;KV?22
z6#*ZX;iNkhX@JT9yzYLU|4<~iZ#R>K(i@kx7hO;lf6E3t39i=BzJ&&nq?Vu>o?C(~
zDdp>?i{(Za3?x=wjm)=iN`=5|z4%5eOtl1W;Xb(Rs-I|a$;Sg8cpRpvH^}DBSd$Af
z8mic6fpe{%ng6&T&47GfzSZxJ-`q+gF}2oxZ%=5-Ece?I_7@%!CO#NiK%8Hy3%utC
zejqNS6BfT?S61RL<^FjgM3&UFA;PJaGC+`lzPL+Mfv+CR=WZwU!vtNz&T4xtUf;(2
zL$*|d5%$#6Nwk_u(L(y+DK7ixR@cNc5^|@Q5IV1+;Z-yBC~()Z;~T<Al&_WuvM-hu
zMK(WP$}ER2fY-d8>@bvdg78rNgk_9cYJ2_pl_>WoE1hk`Q*2SgsGo#0t)jK4+~4K5
z8!Fh~QoGb<qE?@F-w?bb$}!~jcf@9i^yAPoRS*PiG*iW6r3EosR#}?cVxnUmuF3gV
zPbcbeJZxsnh`J%<Jfu#~=04_Bjb<v|oa?A6BSKd6_!w?IFJ0;^t{6%-{psPHgu-Rs
zy`NMC8$7cyURt7v@(4Rtzi=kv<}XF163x+?!mHDD$xEoYHbTrA)vWOGU@e|BbH-oA
zmR>Ud5wzY+YuayqO|T7Wwl(1+m{qg{tz8yU8}c$vYV&{6CFLHdK`brgRt`=H+rGG&
zfP3irt6GSFDy4AqP9%W0E)w7Ph<fmI;wk4ivlXcXU^F?~0Y%30gTYvK6(5nZwzif4
zrpfTdK<3Wk2$lt^ppM63yKd-Py|5z%t4PwRI4$?4>@;qdp??4+QlT#z@4tXBrg}MK
zO8e2Ailgjb1;T$b*?I&u7KXxgWymc)eljC<&Rw@H>A9vX?d9nB>L$nHcqG?C=kDEl
z0_6-B`*@(orA7SmS~@X2ZY)MQ@>C6zJA-MdBSx;qIBABgQ1EG4UFJcG=Zw0H%h27R
zt)Sh|F(+KkW`FtpBL7mCXh*wG+rO0S5H6Ex%QK@8&F3VLDV(3Tsc++UL`^jETKZY+
z%8^|;1P6tj59Kb3$8_ptd*S@+2AvR4ZzCLxv^n$v(YQgXx>|PEN?oxBQ4Q_d39MKe
zT@bF63CnA`GU5g0Bat^6XRv20gYIEWKu2AT9&&wm6#$It$zhT{qNUhZP`{!VS=;m1
zF^O9?-*KB-n;Pc?bDoqFY%my2teYJ)Y%_!06r3dTW37_%F3X4LKJx!M%=s!P$ju_J
zrH=#m;2=VC7ikNEJyuqqi9Q&c5!nU}LP#Cu!!B98{e79-c+Ys4w~$YTRHMbcX}4WF
zH~iJu>45aJ_OUptmL&U2`<leA%uj#rXYN-ssHCo(2wJtZozDiA^atpF`M75ApL?VK
z<Kc-Zb-vE8W>Mn&bEz_g<7U~r{j(s#5YcUU&T)o7UM9?{Cl~|MitJ}j)G+Y5vjIge
zV2PTUZT79It%z&yH4A;nz%4C4qr&BvkEJ@!AEBwqTv59hcBD9pq=;`e4NQKoi1hZd
zl?0MbC&2|6OV3yT7DfX^So3Au=apGoP2SKZ0@{H1Yu($6<@(oMEke*Wd%44v`GY?Y
z(Q>;YciB1RMz+7#y)n|HhelRG<w;?cOB+_!gwiBO>l_!H|8A%z`%r3CgzU9!BCvBi
zOIb2`l=AMjA~6dgQ^`ER;~q+}mRP<dI7zD1R!g)BhE)8jl476lDlS`+5$=fcvd@lR
zzpD{?Nv*_XQs_?L^oX^C)}!t7VM_!@q#cxxNS2}}T|rYj>L;Z3&5Ytrt1aS1yUHvd
zhd%5zxEb^{kdBY%la1B9Fjol!URSWJoBAYtVCVjR`yVRu?<;uOF2$m0?IlVJcsfv$
zDY99=dLj(puYFd<hOVmu2%Y?O5XjT6ZNTH=qsd85K_1c#6&a{e(NwRNREHMjkCMx0
z@7(r)Y4l<xjGBKuu#;OZTh$~AfBMcm|3B%gZ#PFyXhQQjOG%9kl;`bY=`k}zjhI{?
zRBM@D=;cD4;eF_ZB;`{>DG|_+?g_!pB57n{qK52NP{PE?ro6(jow|$AzJ<}1Vt*(P
z((Fc(;RxaOXu)#R4mopF3T8pnz;7hFpa+6qHaLu1V^B@ZS#AWc4I@m`>h_Jn!`8(o
zf4mIi*&<d9q0r?}^R02EMfok#^!5`%JkjBuiVRUp5OA%%-rzA>*<`OKFL1e19t}~i
z0u-8xRQ&fzLONi~r>td4zV#&40_i@kGGl6LY7rbKpIo5S+k(P7M9KU`870`=*Y-@R
zXdmoWj$Z$1`|J14e(<4T6#VJ_?A`XfhnRTJF%bv8L<8Mpxd&f_RnJKzd)P^A7jTw|
z_yy=Be~7_r?RtdWff*&m5U1T0*F~(PluCkai-TZOX(C?Uc83}5JjQ)L<jQo;*#{Kn
zCT@*3T(z5UmXrIOCEZZ3NVo^8odlejuiY&S`LK&WVh#*@)QhjVH460Cu3UXtHO}QS
zU}v$`WVP`vHLpXuAjCk}PRS45HiSY(oJ3Y8x@`KJX8#Cq+klRo5e$71Bs>#%HWg-S
z?ztg5N=A}QODXkC0FR}<P<)HHVag2R--LnsiUo2~=?*3JgZ;uN7>LPU+V;9XkN)TY
z<0$SJ{@o(F*W&!(ftpsA7M{{upWH~{?We5&?Cl!c3d|awmpB1W9HvMn_XD2DEo<tC
z&f>t|b6rlrz`)aoQ{VZ-^c%>b^3z(Jj>BS%%U8Nj&l{PXkH6nGX=tBfj!LIVV{bWO
z27}3rW$;bwo3v?K$R`rM8tIlnq&g9I`NQLIZe3N*a|b>(2wzRNiiM19mC>RbF7y1B
z-n#?nj~<BikQ~?1z<yU3)7P_l3$0huLf7BQ^;Fg?ZpP6ggEPah`daViT}&~2@Q$T$
zKl4KS>kqI}HRju|H7vHdFIa78kJ`%x6B@piFCBqL2mkWR*}9gq-O(lMmfD?;ZOUB^
z&gOjR`cwD}QTBDP>MrW>PHnIZ7U7b*vH1nY16rn5>J6zQ??mBFqRI;QU(?<F$}h~7
z`W9vHrA$pc@4r`NL;7j)f?1MGdkz-FsRDG+i=d)Y<fX6O4KxRZNFk_VQsXBuh>(M#
z73gn^(VEd}ukA(cc#za|df&Ele~XR_7wNfFR!j~m7<EP-Oh3T(t4a18VJIZ0{J9j(
zO_to(x=wDH;{hhpWwhoMqRc(E2Bjx-yh{ArXfomn${3%?GjbTFg@B_z65+08OE!ZN
zrj7-8D=XWq#=PUPX-cQ+3+)lItuQ;1?brGdFG-2r!!x?hQ$YwYnpETNyyXAY_ABA`
zgfh3bYuk~c=t&U3(S%rm`DB-Z=A_d9D}LMK^>JzPOr$i<^`|xw<9q^Yw{taz(9*V<
z5J`x}o>&BJCelP@pQ?d$<JqFDS@_~9(IG%@bhVZ2B@hMFmN6uqIx0m#$CJIZre+ve
zs`cs=m>0l*25O8)Pc4*Cc1tMDt1~F}n;gWiXH#0pqT_x?HsM;>k3fiK7DX1NWLb?l
z<kaoc5C7`={~dF9tMeVV&r4Wx|DLNKSzb}DR!(osK|jd~E7t#S()Pdq9HPIaa;olZ
z06vX(rr{*U<zCh3>lGur?h4bQGZvEI4gc_|7VFF2eQ^1IA94>cKD&B(N@-G+664_M
z%@+YUz#mAh@_VgVVeL@MQ@;4&(}m^TxypW~hH}(j@_+r2;Qy+5!mavLmGx2;EJUup
zCN%K&?P+mfpLMgpMV<B+!pTs9`eS&X9X|2@>*ue>_zW8W(l|3P1EaXY0z2&J`ji?g
ztc#ieP2H*X2RGuXu)pBId%^u0c1!5*e*NDc5i4CsK5kQ6RZ7YLM)L3hyQ8bzA8(wh
z_Vn=h|JZu-cqrHR4}2&mjgk{milLPeT9hJ2DoWW6vR0CP56LoGhEoa=PNK0dBL>-p
z(qhZLWly&3TgEcm?|M3))A9ZNe$O9g&N;7F-S=}p*L^MT>wR5UuN<_Jy|y{fQV1s9
z1oI9+)`KTE@SiT_>t5n!NTP;ZbB;zuNuM<9gLLc+TUg4tf>lGzDzE1~Yez@s1Kesj
zZdVfnDdgIx0~0@yKV1DP>HiE&_;t2HDGhQSQ-%rYdC)y75G-Bjg5A5=O-yFUTNY!M
zH8KXKp8|iShm{xeKEW|iUOpCDso(8{#-XiC{_2}k_NII@`zUh_IpHqdf6|-l4m(%%
zp5Y&MMPoOO(SlQ~>$<wFcD-Jxqm9r5Vb<NlqkNZTpKG0D$mt#hD50JO84R(vvGJmI
zWi2he&C$;&o3PRJ?#4{+gI*iD(DS;!jpMJq|G#47+RpnCmrZ|W>F&NHSHU#$cm<Wd
zJ~J>d<>z(t(Gz~-KcJ!dDYwxtxL4EVP%SlZ=fm#)xoV?K4^NNaFO7|uU4nwPg2KXC
zH|85N_Q-p@PMG~(@bJq2S8(9eOia_1KBFxwsdkKGQL%@h=S{^-o$c~vRl^cFIk}RC
zk$xwb%E)5t^qVvuC=r)eZIMw}>T2|(h7yAR@`vKfPj7iIAZ_OUlZpTR+wjEuziw>j
zuZ0bHCfmqG#~yN?UhOC>UmAw#8h^5ssvji7%n6zsiPqax{Cs|Q#r*CE(6X`qT=ro}
z$+8pjs?hM&ZIg+A_KKB2jK7I9s#Xk{R{#H9$bjoA59)>9Rh}O)g_Dirt*HZ3#T^2D
z&ExmxHtiLz7#NB=Hvp}`9TkjsLDSWNg-+_)NPJOM=kyx1S#!EIR!yhVTVq|=Y6~{v
z{%<4Y--{V+y83)Z;;)+}$d%4r+?a(!)XG}8qr`|osvL7=`V|c2W|7JW_b5|YlML2u
zw|r-rXKuKRsKdeOq;tbN;v>@j+G{@-Q?UsfwXfni4t;+?cblvKnr>R{fnCEQ?3LQD
z<4hiFiCsZy^PH7ZapX9Gi;GcurqyyXNuAfVqJIC?$z@-{A|op+>3H}Rr|>UtUxic^
zPWpAd?3&ar>0eyU>xw_3NrTygyFKMQK|G?kh?N&U-I!PQe)9PNpenC+R?YVcJ05W0
z=;-M&7E)HaZtKHYy<)3`LZQZTu^Zs$*W>SI7Pde7Ol@#Q-H5B{sPHM5?;j8KBlC-Z
zY`!Qf0RPvF?d7T9L?G@Ocpc&`dZd=z(m3N$4$T#3p);e{>u^3ahs9Vuzk$j8^ellz
zbFz1GB1}70scPR|u_92d25i8EfaZ1rKOvdvg1HTy6YCza{kuN$%N=dsP8!a_Dj6JD
z4#h4Q8pr}6=c&_bG8qTWva%*La}4d5@jg;mKC}>2BL%kg+Z8S{dny<`PTdw#1vI-o
zEje<54XG1KHNwy}n}s8@-werIXeabuJa%tCys9&I-LBsY#^@%9xqfKOP;1Qhph}Jk
z8=9N5TAG@g8c&=!QDzG7dm35Z+|aOEQc7wR=`jjyg=a#dx5HTx=Bp8-pl4q7H82>n
z1VTbqmPXYNLp)!t0Gfjs;fkSu+eFD-F1tpJBa<iaFt=cmtcU&FpJB&JUIG=+UaY*d
z@4nLSt-!y0tq3c{GLp`<J425<KZW8zSkSB!`ZQhBq}1Z#CmK0C%pwTFNoop2<-xtB
zuWJ=z$-@?@Q9jTv(znB`0U9^ZzQG`zebm3D<P~09OrMtXJrNfK(|uo&rk*ikSb}5}
zoY}~^10w3-Up#NXk_~6|Q0)Ki;nX_~e)~s0o8wHRme05ad_PsbgtU38JrHHGuvTBM
zZlIlNA{EG^o~4H^CM#TT>+CGeu7{Zd8N;pZ?fG^~BnSox#$%?&#&zu-9iva3dPW+b
z8DG6x!)ViFw57s~PuAzDvx+1F9l9a43uK_1Aj?y!DLC$d-*5~zF($^Y^zU9!V*#0p
z2IWfzoE2Y3K3KVifpcDQmj(f3kt)o(Hix!*HJ@B!?4a(jzOiwvec^Jd3DnnrQ1W0k
z8A+sin0cIs8}Pj^>kSl<UOyzdk|?4z9MTx5^(+NC6iG1c-P{&WzS)Gw;|Wxx%i!i{
ziXOJPy80qtc{pStml^v#^EZIFoU)pemi@h{O;O6Hq`oDLH(+JS_j#-4v-|wI91rDI
zHL`xdt}xK_lVvU7rmn6ocXBL)tN0xP$z>THRspGznoA7T;6#bP<)ywE^Q!2ZJ(^nD
zUk`Cv{XXIOzY1Z7h)L$V=e3t)oEmxU{2UzAb!B0ERsbnS@dovs87mS|#keJ8*3@w$
z;XQk<R37xjC~`i37{`Y~y({)d|95hmu2|DXGP;tKBX)C`!u5A0--otvtJ_Lroh&Sd
zf=Dn<T6h_z{r(JxX^GD&aW6V<Jj1dc&V`sqZDkD~8zjXHQ0MxxypVQC2DHw$wjv7|
zTRXcxuP^#>V!30@)e6*{5XOX=@xAo#&HFH`)dt;*V*s$LLsM33j!69tAW)||_5QnM
zdoFf8#-R(uek9Ck!fX@lK+zI(MlS5XyE+nuo4$$n*ITl>etl3A=v^#q@Q@hqVb^xT
z6Uq+@A2HQ?LXr~CEso&{m3~zrn2=Yn`AD~7lOd@>M-^37$jhG^oT*4j`P^5b(7(bH
zn$ZN4pvd)P_9U$q|2~!#z@`MBLN^0EzHInc2lIG6EF+^KS^pZ<Tbm;;kHe5tvukqy
zA1Kr}|3r44e?Rm)w&ce+#kO3@kH=1&;D`S1CD$4dW3>v?F9%tLaGHvxX9TF)?Ib8}
zAVEo3bq};6b3@ai0I(!IfXrNZr<tWCR)kiFUkhn~Ui8uWjLnna8q~YNBvsQ4)>rSV
zKG2r;t}e*Rumq}DBvipnG{FJyFM~fI;=QdIx>_>_vX=`$dl(+}TY-t|lY;Qk&*_wJ
zhfTga9f(@D*FVXNX>!4stg;9!+p4}nyrqH6nKSl~I5k-rfl;RYKAxV-PC~im)O^a)
z+vT#^>8T$-?$kyYn0aM12pIW6J0TUQ!ItvZ#YTK-X$j+60bTyLa(vw5Guk`d-Q90N
z_eZ^^&GE6lA71w<RspW3?#Ft^LGa;-o653T5{2ysnf*+d2NtbtbeT=bkA$H9WD&iS
z8;3P)E98Bx%7qNmTsMN|z4qriT_d9Ge1U_Y+>9CMudO%0@*Auk+RcP2o`$Ev!K0x6
zdKVDH$e1v@?B{eH+LXhgkCPeDZLm1f98Hsvk$D)Wokkxr^2>bv`eA{2{4q@<wu|p$
zzg2Qc)5rT11Ito3yBQQ!`SRqmE!Np`L>36Q=Ic3J#QWdQ3=R(V%*xF4{j^RQP0G&?
zge&8;3$E$pMx-Td-3c<>#EJTCoA#g-c@iVdA5lz(jEtZG=YBF17(do<y?WQ6Ac^CF
z$%+-|qT3!G(a_t@+Sj))fAaCrSE3!?+6xjXL{Lyr`R_w{KWkrRlI3Sg$Sa9Fp~|P2
z9xaikFVbH&jx9bd^^Jtyh>NA4HxXVVaAxllWhFH0rqR9hTCJ1LNowbtH{n*^XHdJ*
zuMvBK465MHK!-A3^}?k3<k_P>ky=-4Kz{dVZS?<Fj8WX27(JIobdEK-_9U9M6Z1}c
z2}8W~#Z<Du70r5RNhBz{#~#_*<5Ncw(}kh3i|<MM-&BOB)5BM;!;U>NQ9om6eN@@v
zsy7kBv=~*=sbhttePbVRSq#G>gM4<{T4x3G%o|yC#Fb7Zqd=I8c|yzIILBU*ID$g?
zZwUH7VycWovk?o-(X6zks8N2`9Nx|ua%pK#+O&bHYM_miljmgnLY)DsHll7sW+}lP
z+F%yn$SIQi24|H57diSoT%fM>`G~ufGtE%5u;~0|Q>U5tv^pG_@)BnLtcbwj+%b(#
zi6%YJG7r7m^Iy$9Jk)yxhhxcl7n|{2&^!eZLT6J`C>Ptfyl(q`-w>#5c{EU^#lZ>Z
zrnmmwP#k)E`t$sDZIxKP+)JL#IJiw$I9X}kjlh%KELj2V4+@BWP>t=HtRrqULuTiL
zj^$Pv8<NNBFM<cgSKF-c$;gGi;$py7ZC3bU>ITr5U7!iYb=4(|EX5AY<3Ulwq}A-B
zdZ-q?%o-V(qglaxN`2F3OZ|4AOX}2~(R0_-29ljNjaDk@v4cY0gpc?wi|@(>j0mfb
zPiVu2lH0+Cl38htD6Sf4O;+pxr@N-Prz#~m`2w5Bae4WdU?Oj`kw8#?zWsEgS-qWV
zr+OgfyyUw)jrXL(_|bV$Ar6o2-hF{DOreTr;P&^Ak9g>t*+_ZBzq2e3bXm~d&&lWJ
z88sr!>_1s4OkR~PrZ3dt3VPg~Di~B_=pL02A1~@_<zoHvR_b84cCNb%;$<~yvB9DK
z^IRh>#{caw2}LZU%7;CQv@QqqX!C=nTOu{BWu&LqWEvY9I@8iWb%M3zq(7X%kqg4D
zcVeD2mq0jdFQ$t3Z)plnL9>Hgm>T<c*$oVbT;|)@(zJGj5`W~G6I+Uhh0WyAfyZC+
z4}!Phvdk)iF^d^6Mw@b`@5J;Ns}kv9Xe>jCd*1Dzj@Gi~xK&W75M<2(TAy2xUFm<j
zM4@Oglsn-KG#f!3m}~eHKo?V*w8XC6yMv%3mm8Uxm>pz1{y>t<v^XYN{`k|4yTW)@
zjoHbKjxzWWA<V~1biD|#F#CMrQlILn8-9MwKyV_ZP)X?lMvuhjhI$Ca4z_HOrzxdb
zu`~8wDNSL;bCp~J*JsBiVCpI(W^rKUv#ei_Jzo6r)RG(Y^0x6lZoavC%a$!g6FA$=
zw_umtJJ)S?lYgbSJQ-DtJ?T-zkzc6u?m!-EJDz3Z;NU(;f-bQ3?k}@76Hw}DbPFHL
zSIY4`$_i+<bPmH3^+61WtIq|Ir-q_&RxoPlK&f9RT8XtvVy(t%jjL9zqO=9~qT2~m
ze|_*tL-EasPnE)Gf=K=w-~)Jno|>B4J!Mti-e({7g+ieaYSy|)^cvFJe3$?tC?uqA
z97!Z!vW<s^RB`dMpE>S%m~BF#u2t+qfdTmE$z~O6JyymFUbie*imJrLBe!4GXvymC
zU5FE7Pk;`|T8d(q1#iE5>b}ya8%JYsJ>Ml3MB^L=F>VH&VhvNXk)-9fV+voU-Xl%a
zovg5oi!m<(I?NqkQjYM^&`K^;=9KTa@Ed$k!ey!AVf9rXW-~JCUb-H_8u%y`KkF*!
zb%h{YBYXimoEHbeDbI&1b#3EED~x%|Em(cKjP9|a{2$z3r@a(YMIPT52Yq34Q8mIY
z7krPtlld(4B$)layyD`n6{>j`R;dOgn98S}5*zgryD<qBOh(z9-u*}JBJ7Ow`I!}%
z5c{x;*taatn%l<8b_Vr8^tyq=mr5H<tLl0;sK?5Bn|IL`9cp@IHs02Ie{qqzcplE7
zdD3jT<O1#LlJFOBSsF)2Z^<Ys3U_%|i*HPF04*s>2bw=@=4_l$dn6n(HGf@9=c@_d
zTTceR{oqD_z8hDKjf23=YX6Saj(9mg@6y`e@7Tta2)5`%+xz+TKd&3PdHwoX(HEyK
zZC@7n)Xx6JfK5%@IuU)!HfJPbs_5~lTM{e0M4n)w(;WBmeBN^iOm#CSVLlWtFC4nH
z=#NK#rRbJQ^H!>s_eCjR=)#^GyesuEX_A;uK_%(m(oWY?`|10&F}3kU+C+12Zw%L_
zaqsK_b-}|r{BbbLqP3@IH!|@8CX{c!F5+7;vv`YL8(xSe$R+|mzaIY$?*etgBq(on
z-U|s_(dNp4VD$L0V+oc5*V4&kwK3=(6Ap0`Ks{38QFT(BiBxlR&2zN_Ll2a)T!X0w
zJQw3J^6K<9Q)5w4qW>A9f2Bg2T&R3UR!=^AQ><tIDt=(?vgpf?h1A;GEUtSZg^sH3
z31ar0zR{Wbx7O~q@Mu|BBq|p6nB)EV0*qh`0p7r%DjshHWv%j6ZEbpOP-6sr<L#4U
z3Mw^3H{OIzQ{|2Pe=F}jC|lj+BX9w1b)n^oHJ?#)0r(Gv<)x*x=T#C)yaDrUF+!zj
z41FDJM6cdG!3y&|DP3NKE8X0$3kp0sQBBZrxNP?3jOZT9$s3Lj7sY>uD|mjDZGHTu
zo)&pC9v#Ys9Z$p#C#k7MJK5Ske&U3IVOQg1QJX_Ve<-hU15=fT=)e?9`Fi3J#F_L{
zLH$<M-%whU6#JbQB;V;3tFZ0JM{!N^+mAzc>tzUrXGF}ms=nXZ3iG(Jr=_kzXUgYk
z+d~V8{+fSpJBuOS|6<DT*>Vm18lti&G=s%4j(e|gj;>8oFxo{`fxai7Zlkrew<q7j
z#1=w}wK7cpDth_P`?zwB7m2m!nXgPf?ZvaT94SYKk+!v30|iQO_indIy{8uk)4{?l
zo8GFhBW6}YxbuJ1iL=tfBag{#8`0StVN}L5BY)_Wo7SxkRjH#Lg?V}Vp>=WAf=024
zhQx$*G5kFboo*2C`w(B%+vkfArt{dFpfKX4^o}6M)t1ZBefevRfEQQz_PKY~Ps*X`
zP<3AHt(B&FPlV`~i}$b0_t`0y2?hXvuTqZa4_*fj?|pphGO??%eA*1EDn2L_qaqmG
zi4YbzB>U;P{PM_nHv0b(UF09sVz93K{>rF}5q3WQs?!-)U>5dEgLfD3{xHSP<S#IG
zGO;gTUWQK<4kXj2+RG9C-+6v&TZ&+Qy3}>Ucn>}+_OmYOdaj*XO`o|vgP}u3)eLnP
zn5Zg#dd`RZeY)9I=7*@6Z?~Hd9(w4X>+t!>Hb&9l1Ds2|mUEqighbYw<}Cv3m?leI
zECJKP;Ahu{=Gi^v{X)8((qH_l9<drWvxENg4f#L%?^|PYqG}<BHbi>ue;n54y!bvE
zx~Jn&YI<zeP@Iq%c^sx^fI8$IK!3rrw=})2RO+sA48rfSzJ6U)52aQqH}pXHmITjD
zKF$Tn_bm|GtSOZG1|UvvhUod{HbeYm+Q%1<aq-<+xo#82!Nm9u^DKrz8Y)RCtY)K^
z9!Irbz)xZ2mlSZ{Z<C-(?4o2FHsZ0dev#U~9>=Z!Z?Ql@`-Z^Br))SxIE<8?Eumws
z`fG5IcIC6_^2brB9-ZhbY=ZJz??opiCx0T|nYw*^qaO?+9$H=XDh#PSD~M)WRXdwy
z`nQU;kUqpkJ^j>z1|LPjyyG$fCL=xBiP?GV#YuC~w!|ZvCpm8xU};Hsf=r%y5y3%X
zN08vm8=}|K<m3Ya`rYaI`S=0VlGl+oU~qcE6sg`{^x2Oo(!n5RQ`SX9U&nm7vc>Y)
zdGpi2(z*@u5nZ7E?Wxcsc1h^@DRm@~j9c|F!~6F(l|$Wbj;Vm1G5Et@4{?9U3i91q
zjYp%ei-1yAG~Rl#m9&;l>ds#aIWvAqv*dkmdwJc~{LY2=S4D=0OO(P!4fOSudBjRz
zH)$HVU%Ura^^};8=8PZz6`dtaUt-o#z`P0;bR@E2;DAL%;>EM#9DaPSa%m;gP?*xg
zj{C<UJ-gl^-JvYz7hO=Sv-=1h1(5?<JfhmkfL}zmA}41Ms%}H?OOyQ*d7j)qhUS1%
zD0WN7|BdCiBsIq5_DW#Lw6?VkHzbRwTc@`-HSvu5NtLgBXBG4?D6e1p<d>KC=QCQ`
z`qH*-w;^|!#@`Kb8X8g71i#y-<D+!xDu9m;(@lA#Z7cS6Y_|%OwQ|Y`o@G$PzPxMN
zlLxf3gjn*9YbgK&0W7WowVL1A&r-eBDKB4uTRmmG9{)OJ!jn=_F~Fgt%pV6+8UoC~
z>)$J{H+T@SET5~YOq*0B-@`4pF#l5wSpLEMf9P<CY|Te=Es{4T!Qk32SB}ZcPh#0E
zAIOvhV;8N<Q&L8&JWI#nm05}74Re~-^U0_XN<VL)<<L1<sFQQCmfw+O6J;tdgI}Ac
z^-q_#<$m$Ke(8IqMm&3{;sA_u${7eMmBn8nXJok1$jL@UR{2-o?326u)A~HW2nf)?
z{}G^LgON>Khx;NOuHw`6!k#^Q_H~m{SaWl85=2?`o)8@{Y;A47!=Of43Qs8e+30}P
zBYe+uN<X4^u6iApl@+*uN=nOZI=|D*KBVUa>UOKTtZ%n{KC62NQ+u~GhX<I|Jmau*
zG+*H02V4%jf@qsXLFHLFjeT3WZOnG(lZ^Z=8*FY_S+y^G!Q&=={3tR`P#rK`QKYS{
z?d9<2%hRdG(tIH}m{Q&7532B=hZ{xI^2lR%Ys<BTqA~o(9No_CS3vN2@$BH51%m7Z
zbeq|bMYR4VtA&mNAN>X%-7=466BkRI3sIJdhICIVzq^c7=~S-i2b?SHK3I&dE5_GS
zs~Ao00|%4*W9WnYCAdOUlrd%8pb>z&9odt;9@DALp#k&pqUydEFX~Q{0#czWw@>Eb
z3;4dRG?+o{fovT{0PYBM&|`u5-o(Zx^1nSpWLsUBrY3=)smYfjz;h9JqJ2Pw=${wz
z%VRBAbm81UjK`j}-IbD#<q+rOyMJu^=$m$=eb*Q0-u3EjkMFBfE;oh&IA$qxvL3pn
zxkot-j!^6JR$T{4pn?oWs?4f5{PLzAC^_18rqZm8{KR(-Q#TKipny&`_SGx>G;w{J
zw68Gn)lV-~6_s99uJ_`s(}fZA&C?%XmsAO+CC9(J{pQbk_PN$pq!G?DY{x?$0Jya@
zBuiy*fNcS;twMGL$Lr-Q3kQe#*mLg%h!1iXMYpu}^<~zc?be*mO@OyFDJn3s?i!4Q
z_Ne90>PDna_bK%F_Cx;3OGfX9_N25rKWbsJSG5(Vm!Aq#SR7<i9-l+c!MKF|Oq1wN
znT4Lp(yWX3kT)AjbtIH(8kIrKh1|yI8w3T}pM718v1uHJD>Jzc?QMS?*83AK=2uGE
ze<6djvprXWSj_fHESepUjmUG4s60$2CtkZu-C3%r|LqfIh`ce~)bQ&}2FDAS*XyZ3
zw1Nv`fp5}YIkfR!RvESXvIiGy#m+}=qc2~QI2ijfBR_ca61#``07r<eBzh73KyXd@
z<6xT0`Ew3$eNH5NolSffdS8)j$Va2O>pJxO$<)65hKK3GcN>kMK4XB#-HwQ;T(*N_
z=0;)HK}8~69(pe{@Y<Z2H&f9Z;!S%a)J7a<iSVcNgv4~T#5P__f))XCe)KzeZ_rJn
zqbany5%MpnWz0b8?OdhZ7b(Eg1QfnQ&a(0Cd^-Vx&9t;3EQ;u1Hkx%Un2RMg$BSLK
z38B&pC~40Ve3pV<edwi~ED~EaBT$|yQ=K%@#LOrt=!i8J70XxWa%khbpF2P@inXk;
zs8j+=Ik0!#;rfd`zfsUXFQ&x18u~cpk<opdL?`2jfcqaC?5<8{wJe_#-IKJ4$MW+U
z1&E`P7?5B{fVvz3WH@hIHF3u^&t8`*cTjN#F*9aRLG2{QhxR?#>RPwS-(*fTf>1l+
zy2r@gCc1IVG(Vn)InPgcVmg~rvP~VPQS^CUTMo*NPg5G3>y#nW6BnO^gp|5NJQHa}
z_RBj?4`1be%JSRH0xZe*>5gk~(*Hc0{-Rt=R8kxMpmcElIC^Eu-Z)|_{h<<+-^bYr
zfh%Ms^F=@ObN-ge>1lVGHSOzH!=gy8UNJr1%99ZPg&Z%1p$zoL!4SZPpoz*wteZAA
zHT6A{#p4i@7*it6MT>Z`R1k~w$P;<5<Fz!sy-Ts|#Z95X1{u;@C41aHmX8>8@5s!^
zs3Q{EzJGBeoj!cChhSN*Ux`CbcU`pW{O)0a-izAPUHW*9ixjcyM6FQ%Kue;DjLfV=
ze-X?X4b2Ehj5H(%CuTp<z#Tmr|M(0*H=p=-mkb8%7Pd+q>6=+ZsHg_~^yZ`By$zNp
z=%f$dax0GEnt@3;sSfXbdZYvvayr$OIYjWYh@k=<Z?f}Z58oD0!Opr*!PgPk(vkyB
z{d1_z#Zxl+J<>v$@(sQ!^%+}@(wK=r20>jgo}rc@=1>(6pvb?6tWh8t;iSvo{eU>_
z7|v`S7$8a6nPpZgD_xxQ_0GQ7j(Dsx3E%{}K_u&$1^r;GCyzbCP7OoQ9hN%fL4X0L
zLlrAQ6?Z;#97s5o$CPVlqL%=y9W0lZm+!m3ZAR?fP$UfCGdUuj_Y+{VmZjd)Z3$OI
zMN41rxHT@2V9`dsyeLYCVG+H0B!j_2zJP-GKlrN}Nf!Nj-m#^U<z6U-axG5TbL_x&
zJq*?2+(KLu-3Sf&5<Y$UWDU@@;I3UYP!uo>bKdiG+W_Bg&7XO@*dVQs$15z{UY5b(
z2(Q!A$31-~DS4G4%1Y6lx4~h}p%tkqfuALX;_LPm@8xAb6Yq+&K1%zR=&X~Z)VQ$V
zs*zdC$Bxc>J#hhG&7luDC7U=1KX;v@Nt?>*sVod=hpqNov%zsv71oD;&hpAwbneIN
zzMTC#Np_oQYoS3@{0R{-di?%v+wEX@$-^Dj;yI#>{Gp-Q-#~mY%{5+8h3@Yaf|WR1
zR`Rzd0N@LJ`It4m-ghN2E00d#M}&!<GGH?MvX>+E7mEQvJXx>r9(Vgk`84x024iPV
z44}_L{%J0R%!D*g13$YGITQ&@xp|l)|5=GMBOA^FUe#3BfL0=Bxd9Le9h+_?br^X>
z!z?~VEJPZ(uIXMRPv7`<%2IlFqaIT`|5XtLRRv?3aLv;;J|A9O{kl!yqc)c`(UY%N
zo2O<a@>*A|0>D|%D$gW%Z|&R~aZd(g<ogJxGInwHXe&?&xw#K|`bzc~rE4RI;gt7!
zhm4T?{sp)(VtT0U95%V~<ok`_W9eZdvc66y0U|6bMz=`q!SZ%l^m#$B7>@Yvu26B=
zlf%o)`^c#)LO3-}Gp+adnKM)5-Qru4((fx!`z?sRGE*)&*o`)3Ju*{A9nER0Es^G3
zwYV366tMQkO9~ER0KnAZS(mIJ#J*<NNZN7jDu9Yof5LcfpV2Uo*Qyt$(1*;oJCM+O
z`i(=mOhtA!50PpPX*HYONAgjV6BDk37@{lRuy)g-jb2j<B_}OK-|=?eNhfQ5Ri)X9
z{p78@f@WId>H}>~(s^f$`9pm!?7t5x<eQS{It4AvbydKetqR`(N%KcYYJ`)fuBrJ_
zRbfKAG=MNXgki0uPE1ZFLds^SeXY(KI26UxWE3A2{{sfR*4Ae%ganMXuU%f=Ua1&w
zYQQ-qmd#grru)|NQ~s6ard$d&T-XX{{#}BR6hT;{(RiO8A+0LzB_mq*!NYYi;A#!N
zwD}7}f&1_kFQTI#?+_5!M|9%*2wjC_VY-~QvGGeA8=FTEMG-6u!x0DP{B*@J0hhDU
zI_b~#*^B_?Js!`9YA`o76$*L!^o159wXjguI95zg%r&z_xlW4c^@MUPX~(T-gE`fn
zbNO*fY?um7HIlp=X~w6^9Rzk02b&1|{CfNsL$Q4T7Nb9l9p*K<b=78xR8w;)|L0@H
zg=ZmC=?p-VTegCb*vwgZd3ABP$(Um!TI!&@zBnDrm5vUrRDt$!DbSdGnYY`!IQCrV
zq4~;7z>6S0@KF-uZujLIZI+X?6Z`t+4IE#iQu08cIe_;d8FA}Un=ysTpI*Ly|2|D8
zU2G$t_(Pb|cpV(bdH@mjaacfNSCvjTYgi^q`&@@QyZ(BJXo_rd44;52ZIWi?;?n%Q
z&Qf4ad*!o6pJGYmli=W6A7rz_LdyJJ)3#iXZOS_Q@E&}TLf;(@%RPH57)kepV>L^~
z=Xe{=t^lsO=lt^{zj4)5jr%Wcx2%*VGkL{PH)Ye+f{pwyfYvWY+_ybd&2X1zg5_sc
zs`{`f2YdS`vL{a}cDy>)u>b&wT{Hgh4pY2PW~ZT{;YB122G_0#O8=+jPoLi9>FHU8
zM!|_b+oyU1FAOw>oNaSON}2^XLb{A{99H!vH4g4ZAxe4EPRV!wd>!~_12_&t#@4&=
zEP&JTG|Bw$kNN1$RB#X9bW+VB<48JI-e(ZWeiB4A63-^q<i4=#bAvKoAVD9ZOhR7T
z?ctne?s2-CoIG{&bXk~C9kRlDC~)y&8gt+E6rJ?*pkN$LVV^Q5PmUVhwkd|et=)Ds
z3Nq350m#6NV2NJ5)<x+I!eJ??gGjQIM+Q<OdC+kadMsQj>VRn~1&h!Ick0T@erEZb
zv#<6We^S+z_AwJ+U#NQ6sNRlzc#U`tNDKb+yz~0F$s!?9HADsS0R{a64nXTbD?vWG
z8t|v{Q1?*W1No6U;1`6P>GJ{>iIbhR^&NZ84kWjFBPR{5Xk&ONs?H%`E;u#>yy{+R
za4<KKc+$NWjEqUTp2?}|e$51``3tP#Ll0O|<33vHe@g>Vf+TaXwX-v-fVG`S0EJ-k
zJtZ?!a_tMi`DuNXxCJENVcIpK93N_SZn`2@@*Sw|7BUV-1l_uEqcVSuoSEr9seEFu
zC>^4)Z25J*YmBOocNWiUmk2@|yS<CcQDoq+I6ZL!nI72;U2She8Brln0_YQtW4^!&
zTl<Pzd4MazFG6|*6^dm*3aJXlXp4&ASG51C!ZRQp@pN(Zt;&r?4BYr)>{+VWcP)l0
z|6^roX(JDas$vBB{eQn#!#*_gW+g7T5_jFt-u^I6pgNIECX)uHV*u$e_o}&U=K8Yo
z0(e0)cjW8;@CXYC_(K-K4kDLA;OgU9n`sAtR(7c<3I>sPCLDIFfWP?^2fNbm1;+j~
z*HUHMt!}bJf}qVJ(2mjG)iqvF<+6u?jBrafk@Bo@9NUAzV4x&a76d12Aw+0=1h4?)
z^C}{_iFO0n%Xf*j{U!Y{Z499?ZGvR<ex~9O&_)bUVtQ=gN4=|A7nh%Ej5(|c;gpd0
zU&j>{v&d(fA!UbHX%7d+0c0GUlh#Tq0HT1ANoND5TIQJatq~yP2D?Krbh@XOep7<=
zE1UN1=emS+%ptya%`yv*qTx>#mZzpxNkV|X3qK5bRD-lJnAkYYUmEKMX{fJw1Je^(
ztH7Tr(h~cK9G+`=t)@}?p~Eo#G#YLro^=UM8NmrY_Mh8M-Mwee7Rh%PnQ&-R>qFkf
zbAl<_G--S<%yE4JvCLk1C&+@dKbFv$q(JKbM=D`0by<%wmh#e3&V%ewzNVR5RP>_~
zCkWGu9lM*G2P+lPsPTR<o4u}3)fQIV*u?z>7Wvk;{;f9gC7cFygAY=gwHnDfN8x)q
zdLt02qobn=@M~<x^6gO85Y5wJN>|I)>&3vb0EK!5KGE*M1vDd#T^qhn?$DlRWR|tr
zAg12fg+L&9;IM3nu>HX%0xSM{{M}3-eVU;0y>1+mr|h!ur=(00MS|zgzC@@tnvg4s
zn)2v}4{Q;iY3S=)W_Pq8H+MUvc}u~zCKZ?gfzZ(l%0Eqwrz<K?Lx^_f*s<^3gw+mn
zo1kM+I~O7zY=MO|9<4K=#nL(#ge(bsS=uxT9K38^4vY&%P;PlL$JYnKKjQ>uMv{O~
zquN3>2jLS<;}r<HAixxlP%{=-W_uMGxkJ{$$w?NRn;MuH<_can9_5-@ou|$g_cJB2
z`l0`y$cj%1*FgmTc}`Ukd7iSLfR+a~sEd<RGSDnK2E6hh;CCj3`29>Y4e|P7q2eK*
zsxaCLrz?HLc=lxrR>4D%HlAW0HSAh!xEMVOKAlE5e78G3J|?t-@I|uNLxXn<3O+s;
zv6mo>_z9?~^|`Xs_8CEuT+Qdp*|mP~3>x{ldwPz6sGK0#IXQ*E$m4=S2orHug^MuV
ze!%Cw1#lTO11(K0EG<8A_{pdx>rC}{CL>5km!U%y#2A2BH6%e?51bA4DY-&FXXhgT
zq3h*{#dN~b-}2VW56xs{3~-M4di{Sx06#xP=x_69EX>?YoxtH3tvE)6*yGw%`7Y3k
z4v=08QP=b{xLAc}H!?HhW{W$e$9nPdWe|ucFCG;g6LW<RrNa>iQI5bbWOGn-NCGu(
zf`mz>>zRagCXZDHG5O3EtzX0I0Ba29W5Rca{KF5?ZC=%lvpbm25K^F%hUQF<Px_kX
z-_j9kj((tIGy7XxTE0`a4wB#=B3K<{Ne)oWt^l9vYdZ&FZwn3<^Io5&ITP1mWSheu
z>Fw<eo?yt!*{LZRa7|N8q*%>n4NJ&8w}30gM?2MCYl+?T)Ly9qyI4Ymv5)yE-AU=h
zlNLs)sL&L6cSo|CQaK|kLw`5}0Whv@TYr|Ndr66p__D?)CxZa=H$|zo6Dl=a_NYQw
z)L8TDdQ`5iu38{Q)=78H3MSh*F!FPAbKT#IseyyTH+2*&tz$93;C+;m5;^WMY*bxN
zcj&HxHHoRApnr7QwUG5ICMy3aL?ldUt*C+p8GEG10N3qw>W*vOR+M%^Rt0knha~u`
z5aywONTe@^i06Bq^qXzWx>v{ZINWFu=Iw`6hAnMGSqV7sS?pTYtab=n!Al%G1!wsC
z`Svzxi@J4Vax)lF;Qiq}%E^#7{H$RIRIQ1rydy`C&Ii>9LlaX!&@Z=PIZR7-m2gY0
zkU-Ze*R(Z!I0uhzTh+_qmZ>9vzytsTI4oAWTbp7xDGY&F218*4I$Hb`=uG^A0G`)E
z)`MBWHGfzua~;96=6ef(4h_Z?=G1`!pXT>IJ&V+Pc@jZe;{n6eV;pi|0pO)fqa@|z
zH20~xxxML$tQ)z#&&A4WY+UM3A%(lo=eB{p*|i?fan#u@ncwevFIp{mJAC8ftzbs9
ztr<)6Aq2WJ9^c+L>yZm$*&|g!U(h5v0|n4;LIrea4}qiDL`q+RVlPi=V%BN!au8*3
zM~?6m9D=;}(P_k*Hf&)N`S%q4-JUek&zG--AOZp`)v*5leus9#_fx^bpu(6Sh+dE>
zp})AVm@t9cj%A5uzj^!C9uW*GjC^b6tRk;zDv~ty7^<Dq<Kve;;1DOSdtd;gjQbS>
zo;pY8f^6SE&%5GJWi0I#)#*IFY1KNI_V|ol2~_rV)0xk^ozBp!RTUTHOJlX#32=q{
zRM<rDC>>N9c-$*$3RzqKj{R)QmVyfHkUo4^48;d_?;wnoaRJ_ej;=0m&*FYSuP#BN
z=~`G>;r`8KwP{TFXwIM4e>BI<R|WGsN_sv6#})k3&mV-T*#>_raJCcR<M1%G=Tuvp
zn3wteAttJ?th{gRXk+6-6Q>_Pdi2>72z8p9wev+T1Equ)&(c02(&sihy2>^6@5>>-
zr<~HK4TjIj6yLjd&jfCMe}e(=4)uG|RUBXlDC4PY|4R1FZQ$%V`VMlLuV{IjsK#sk
zNTX12NnRB`&tlCC5AW!?oUCIEr<h^tn3I@}kU&zmg46d2GG_O)x<IC^I@=+7#`Z<2
zjQVXxEPU^|_2IT>+TO;FC(;{|I?N-~4%mkP)Yr@HoylBG#4vt*MN(j&*4Ea<jAK>#
z@9FF7U&%3)0cPur5pWPLL53CB&?Y08{ADyPV<}1n^b+-QV|cN7p*1Yz{CWL7-<KP4
z8w#5Qp^bFXAPJoHLUo5C#nl>3VMwd^H8_s-^!C1;Mpiva^u6isj^8&w2xOtUtsH)k
zUHU?&zkRuFIlOT!+(assYJLeUmyUr!Dnt2{_^zEh|2noz`t7G9NBiweekLO-z{ozm
zFEW-gGd`X^J~QJnT>+z*ndN19EKu@3;oW|gMg*ajx3Ok?-2@m6wrQ1WE&yt?05}l{
z^IN4f^L=obP!=O9wu8L&h0}$Uf}2?vt`<3+LxMto@7J}+Qoo*WF>z$v^>PYD8Zcs+
za`sR%Tk$x7UPaiGm7d<^wnX|uP6JoWmX^GFg+m010@D}<Qc*!j7*GNz+I~`FDb?Ia
zSXj7Yf6g)=a)np5eySdi7eZdEVGC==Z_vj1-6~p6g)O>C=dvz`0}_zuvvlN-l*)n0
zn@{&qWUcfyc#Xw+GP{za%+^L>6fklrGIePb=SxIFWK>kRPI}Tejo0pImUSA(-(@Oi
zPMnAU660s!ea=H9($dp2*-hx8J$5Hh%ZHo?Ze>IudziTw1J>f7=iNOptMSpn+h}Q6
z%_OpX{90pWWu+T+JM;9_B@(!ux8wiu(PSXul~We1tmFtRSu9YO0gqxqbxRRVdnFa(
zmzn^={@(w%*6_DG_it_|(A)5<>7b(pJ<3Z!Nkhb5+R@Ni<#Hx+>izKW@JlolJ5c}T
zmgjCq)bv}^R2OZi5h$z^+?Jb|A0Iz>-?g~ceyk2anWr8`0Evph>ydA3#m>YR78V*U
zBXLw=D;;K;Yb@`XflrBA-m@+w;XXyQ)?=$~PyrW81@8fV?-gKr^eD>7O^{jVwQt`k
zbW2}rBr(TH%%?_#*jt4cGb?2D+7IcmY#bd=l9@oTd3EK=m88N{0^mH$KpchM_>K=|
zu1;5QA}(pKJiYEeCC4_}V^!>_2+Z7MTHOGIrq8+w5KCSF3N2sNyt?;hRG-gcy@3KC
z9C|d0L%SE$Z<zv%pkm7F24ss~@3<BX0QV=*;=qr8#E+^STg>7&EH>$Ho2M#%FE1~@
z>FnHu-&JeYO5#G^l!r|Oettdv59-Ti;r4J|#{jYQhcXUwz0H7f&d5UnjRZhhW;s1z
zkW+ztdQ`3ef)1D}c)~-FUC#K@KAcnI<b51C#8O+5=0K-=E+SDis4e@(2+)3?5SLL0
z$vT}1sY9&-zfTxJADtVU*|+>}b=0?OXvvBMEiEf>?)p-w<_OuF$(&^|=gc6WeE^PA
zy_`PY@BAR?HB5Z~L-P8W!{mtaSqLs{4v;{>eGDXo*{>YRW418J41-^1`>lU)Ano4;
zfIWwac~tqfQYPAfBTi_#!WDw`m6zbwj?H*z0C5gzlI;Y(pXn4zr}=)(W7EZ9_CS`s
zJLTT?UE&pqqzUOkS&+Xz4?HV9BSV)ck~j@M#>^fNj2xjy%9p`L#xHF9WhG}0tP834
z9ErEp;AAIum|r#W>~Sbmu$3Oftaf*nQ%ey%|4j6)2d5wPMe5VQ%~u&Deg3Q>fVKq~
z?Sr2n_%b!{-+IQzlVp}2mLFtQKv{`w^!#Se<KOoWdBL%W{g>JlFN?<ZLbpg}WuZ!c
zFd3||t$ZeEx~!)|cMf+w09S1rl*s&BI8&KDDK{mTS&?RV*vwkB)O0ycC%vtssmb|X
ztW!ZEkQVaKCc=073i-wXupFJOt-2P4<7Q+q01Hgv6A51!U?aaNzN;|&y^}phM9=Vc
z`vczOV8?I=q~OPHAT<UBefqw8*|psB?T`@8w;gZrbT@0}VuU{+mQO1J$WR??*1G?7
zs|=~pY1Fm&CZq*tfNz8(s=<_>ZzsSPg46~$*1mxS=HseI;dP5T$-e~$#l0n;5e7hv
zBNq$7bHMy*gXviX{*f;Py!6Jh7$*-8s*wB#9Mv$Ne#~P+YL`?d;bDg<IH#9@mOJ$U
z=eVif4$yVvbDr`xw`GhNMG<MsWAI|{eE&~n#a~XV5s*)CVH3eHUD^qbCF3cc0C|H1
zWg!k#KV!xdr^_Z{zH|t=9bFT+TN&R&GEjMM-|opsfMUTLy=`rLSX8kMsMj+vRT2=Z
zL%>=>W+G%T6R)*=`}VDXr}@$-tn4hk9)LzE_fTE~>8*u$5Bv=%Q3rn8%=n1w>Q`Y6
z8^`k1(F~+jiLbSn*VRE1&*2vL0z6F{RXsB_3UQjrHz=<V1&`zrSeWlf+kWUWKRz+>
z7*a32eqe^&kXi8{$Cn^fE?@{C__sfeXC0IWNqR?RPO&@|Trt&BC>SVrksi}s!eE#+
z#6@7C$EpJf2>gG2uIwgqh933>`255>y|Bst9pA^Nrmi3W1B6hW%*&JD?+ucKq7EY1
zlQU*r2sPy?)ys?h0gPAso>Nf3fbbN{CnG#aAG}WwZc?1PXWpSFiitHIOlVr0bQBnX
zU_T)Q%PK-OL5pq3+iC|%A4jNe44~j01ef>G%%P^TfC(H`(DAnt_;p$MiMRehyz|n1
z>I@&aDG+hCgLp3@*?7?!Vfc~^_js+M>X2X%_H$H|K$-U3*x9C&@@3hEhYNaa5Esi1
zAc&w?C+Pnq)nj7;!D2dm$EL2X^kJ=7p%Wf@ljZPdZxc>)1m%8!MZYPkasea$pU0me
z3CfOdWA5TDpe4aQI1Xh%ZjfH^=rXxGp3Hh16`sD-Il$-}D03TI3&*n{V-2h=SQSB3
z)RqA=?mP&yrBCE^YP78(Ly6#)YXE6T-PANThgLe|sgFfZe}u)H2liS5GwPowTT^^4
zvD`e~LH`FE<VeTv<G^ooT$M0it<A8rwKXe_atnU?wCraUxGEv5wr6HmK-0?NIWI=N
zsk@Y8*ml8mlG4O}r4_O)2zg4xyT0B;DoPKJw_z1Q@!NDouM1iXCP|m9&RwNjiEIR9
z+8MJh6`H+m_1zQisKj1P&JBPmy2DGq>GppCDK2*)eGcQ6T^oS$whe+f6U)X32=tB;
zmCp*jcLgM5+;Un@cI!RT5mMbqZ*B^jf#jKjZvvRfai9K|M8snoJG;w#%uC7>RXlXK
zJVm&X{}crEfccziX5MoKC}~M>zm2m%x%~jPALENz1Ao<gB_Mx;vIwxV!wkJ9M&~V%
z*fMOzOK^}iH8OIYt^g`tt2@LCH9*IyR047`?w~dj<5v?2^s<BTzDS|d435qv@b5vt
zWAd$%aZ)ImW5>25=dlEO)T(!FlG@`$Xb)k04Jm8g<i8h#QXAkWIzwY-wbxX0kBX%D
z`1knb<^m#-!(l*gQX0>K@uOEHSbzlXhrFLw7@76s43rTDG19|%ZXzHfBk@0<^P2fW
zyIYH`+(BNZ_9Ue&fB?K0C$2%v!1v2%Nn)++U+^1qCr$2D%~%0a)+3$A0Lk?@D=e9@
z7E%Bf83Ykjt;ve&^*EuZZD$Yu%2>jO`j6ExC2cc80*F&!ty#^St-79cX;ON%2kI`(
z_0y^XeM~qJ#}cBhm8#iMs9c#yTMLN|K;y*o=@1sUE<z&W*6rJEQ(NdOv@4Zmv<cip
z0&;Gur$G(;^Y}Av7*h_z-wmjV7Gvz?0Dbgjf|%Ufz{MAU!pW9><B;Ad&4(T@hOFx%
zn!U>*2Oz$c30w{6RU?LKtJeF}#Ke6wplyJvH3X5hCpVr2<<M$;^!a;nGDSBzS+G#=
z?E05FPL58*D!m8q58xt`xY2;!jw|`#Hh(XRQO&G?_=kCzm-&c(1Z42K*owvDPYD5B
zvyfkV0nqas$o9<~0>yLboD$&tk1BDX0&1$O|H5*-0RO1ZYUeY=f@}y_hX5+Zd6?Af
zDBN?`Dm_`BlSKzGs&x>Qqrvo2j4dPL>J#M=44%=<8P%Y1IXSEnC&j5J6~$}LQ7vgV
zF{Tc24mjj5zj_}hGsDZWoLH91*Er#wmZjO1;OC#mio`X#N8xT;S!s<v>lq|x-xL+?
z%+JevYe&hfaD<u-1LP!&)FsQ#<NbU}DS2TbqwWs!?#tJfw@#O~u^--?SphUob;#z`
zj4i^Z_<}y&xq0&=%!Vm-%UIJ4oqFp9EA`HbRUm8sdYq{jAc1O|c)&I}*|{F78e?b^
zP~%B1(`NzWoTg@HHz`e99OYv+zhzefc;<j2D#<xiS)m3T%-5iycYH_2*#SP)Ft#}V
z^JgA42nYha`78t*t%Fb$x!%CV+fJwuWreS>tH7dnQ0vohc*PS#+mA!-%QP}g8*Tu=
ztBdKHz7x6sy9%^-U_o@=@H01y$H>r!QZJ>gCDzgAG`AZO#OaVjc#c%=`2*3zJFIc+
zDF{|6JI;vmXVzqoU-9B9)$$kT@s9s`n;gW~f<V>78)SkhX+xDb%vw_*H((3g(4-JF
z%C>>D4s(x=d|urM4AB?DWfRV7%4KP%&Z=ne^rU*Bnhb(2TMB$m=Se&x6`<f<LP96N
zGw|eE7F!IrVO>CSeBap4Pha@oF{Aw7D7_~&9lTt;i|8*ynZQMJb937YLN?FmB&iYS
zCp~5Yyq3w&pFbPC%$(EI6XOHUat!2K9Lg&*#ioX$AYK+|Y-~IP!4L$p>`DMU!DOF@
z1y$he0|Heqlz~>FDu$OT>Le^~XM*(J@n5G%g`Ls05AUBArSBs%hd$tL`T8>O-dmxX
zs}r#yIN-h7tf)@5Q!noWSi%#UB41q2fqVv}+yX>G9kC4~uILTLuxavI2+;DF$7N*r
zDsfqsS93qbcEB5cV^dv6L}wfQAp6YeWki<266UE|azdo3CWTDC+iuqA1>|hTvS-<(
zDHos*HbK(f!49;C{voC$hxQ007lR=403gJWSw+4G$w-l^7zX&%$A05uXU@d@1kPSn
zhWpjDn|vvV99_fzSE+iYi7(E@1~Qh~{6dlj*ocem?f?>V!${x?H_D-xfD?@TDs>zg
z8Od7+*~U6w{#`S7s9S2vV%Za^PT8HE_dSHd95V71M?Ej=2eFztp--cHVdyg8Q~vji
zm1{8$J%KEhyL~md%Ole=EDUQNlj%Xi?Dx*g&Ytt|?tL&-1n!2Jp%|Z>4EPA!y4(Y0
zwtjFbt)A)3x?Wg#LPjPJ&>#e!xK(Q62&%!_&Q1bGnG3+xnVc@^e)Z~A^sgAeoPVa(
z-aY!S%CQ>#V~E|@5G42H_g=Q~5G`{ZDiTWX-Xbc6J{ns2;IY&S?mFVnnyuCvD2^{d
z?aYlFLp@H__&o*;V01yy+0K1MvciO4q@FenT=d7s`3b!~fGnmIj3I_ODJA7#!Prv>
z8hc&HJN{P@u^${vLG%&vz?<~q->bvF_`5~jKL!PnB3cCt!0JuUUBpAH2GwPw)kDEU
z#Zc?u8v^oKZNMz9ZZPM=vUZvyx_-6FfK_}%moau9>Jp(`SZ}q;Q3Ckg?YqnwRT==m
zmek?~kFSX6rm=$`;{Rs9)$cW(E4VUqA*<f1b{e+iC?_M6WUDBh1;Vvt*0_x1P9vm!
z2Dz%95(b7cm`SsKQ*UeZP_C28pGffC&$s&k%z_WAhU7qOthzEk1fSf61SCZTJn{XD
zr)TuX11E5>nw0>X$iIvF)2>=G4nWzzdd3KJA3qQAG1R~GS{9qk)O#xoAXQZWC<bnw
zcnh@?kcaSS%{Cn*9l@_uIkw8|W<EMWiJuEr0l@Rd?16M(9s>^+36GM1)x3GS0tPv}
z_AoCY5dWr+K@19?SW#)+Rq{*8{sI<GkUdv7zuA@Rm!68M8`(CyWCCF}%k}c*IucQL
z64Nyo(vc2ihx-a>*4K1)+%4cuJXcGWS>a6qL;;KeAf|y_G&p4h&lF$+;V@IzP+ae@
z8m@ZBuQX7M<wpO1Um1L&XHE=DpGj$1ike)s8H{I-Qv7jt+uG~c>F&B3=q}*y>^yfM
z+Mu1}?5O^MJ~3gN09_8&LMU{wvo}tzSmd&aJcYb2f}y6twy3*+l-mkWJHnpaOgeWq
z?q<eo#KivhG+Y(^oA)yk1G^TGS;I)I>avHhuWMiFY%kKsLNyA2J^r9i9`aI$`OpGg
zi|z=vpWAvadac=}(A~N;fZFNeK{_cf1+|(*aW#m04;uX>466{3my<&SW5m6$uP@(&
z1ho&Z1m!bZs{0G);}6RJ=WW7foTV<G!(E@)Amatud0AQ3nbR8vVD(qV*obbv(VVfO
zra*7Lh4Jc*1QVWW?m{zBQOpiNt23c!BtIu72eQzzJ-)RbG68d%fT5JJD}hsoAYdg1
zpmn>Bgd<)>xwhr+*LEi9xbMlYYPonU*|kkBgF<QanR|foahHnnt}$zrm6xXlU}!lQ
zT3(l}=nnp%3%nYo$Dbs2n3tb0$ORy!!`vv?H-qxktg{{|nDOY(XHHB_-9Dr{Nr8|}
z*T5jEfQer217MyunVR_pmd(Zu|M$W(#}z||jBWyX;ylRr)0+^|07K+7hUo>@sj#SM
zr8COJwdSRa`QaVFP~sua4TCLA07xM*-VXbfH~3A@_R<PvrAOwoDG-f2mR3TUgCYU}
ze87R9{-~@G9AnX(Wm}}ffTkvtG-?g&UTEI2Mu20O+PBgF_c6@u>#{vlTL*O?PF%G<
zGj1gB`4<lndPI49bMrhIsm8z}S8EK|MWTD~H1M(tC;9()%+H)(jys~cXY>Sg^w$6y
z@DLOaaQKHkdh`g%I_g8I4gr!n^?+ZcF~QE?%9zl+D+F$<zb|p&KSjEHFLn?E4)78N
z&!*EunanDk83(c{rfYH)>7=m%v+|BW0O<bC%Pz9mbFOwG-_N5=1#q#UBsE^^uX9bH
zS;03qHZw7KQa6&Dfr5ZAeofQeJ)et-(40_6WgPc%92ih+^)MHzIP%tYVR(7khIMe|
z%qH+D<c=H(MY<kUyoUM%Q*Q<RK@tR63g-q%P%9Dhd0`>9CuIT$cIO#|8Gg_OO}t+z
zm!<IcHdaz*h4P9O<g|$d@BmF$tbBZW0lzx{e(ga3){2$qRKbO_(vGXK&;Ro{to_w|
z9S}3aPjuu9tI?~~9>E|;RT=bLDt=v3vgYPt+A7?5f(0z7K`&?@^rq@5WkL7wj{JVc
zr<p5t(hgjrq)dM8qzMHnx<!GJdvebS2OFECwhZ`g&px`m9vb4I0_5g4wi77VrGZQ3
z(ai;uu=+JZ{JNG6z8520`IyfTn8_3ZM~4b3{1-yP;fK~stxQcYQ{cYat>(XdJ9S?P
zI*Z&D&u1(+yjT8K^^lBH+%g>b;coy<dwP2M{NTH}fJV2Y@sn8yHezcK>A)C~K;nmM
znDu=k%Chl$4rPW7VOfY)hbSQsjGm&M=Xm#IF-X#Y^N*(ZZQ}Hy2MTc3L+najk>-O7
z@dpeznJex+DpFBynH7*Fo&?W^d_EBrO_F!ZT!`4pP~$ke`md^kuLJACmEH}Cv*BC6
zC4rnViw_NwAT1#qsg~UIUUZ?;r4G<U(T&6Gr%U{x(yJ7pAg`|ajIfXzy$uU&aSoDi
z`Iz8e;*&9jy%78tKwz5k9z(mj*9f^td$#1Eeg|SjfzLy<wGJMhz@S;+UL5CU?NRhu
z*-EBE#ous4Mh<WYbbF-hB~}vu?DiA?+oJHm3%e@n3Jim6{`w3?;C<{qL~5)O-3TO(
zAE^9Q;D_u}4KC8Z4q3Y__ZQF|0}2p1WntB8grR|MIMaWg1}*CvevotnbKiU{%cmjc
z><Z*Y<|*5R<bI;%>p^Yjt!Y}b?Z`_07Q(LN*AGQoOqZeq-dyOlkH0qR@GEc`0x%eH
zK!hQ7;J*(S*EBy4jD`$Pl8rShV%7dv!t3kU`sCiN1bfREfDlXOpqkUvef&iL;^R;Z
zR={zF9Bd51YDE=Xuyb`s1**mQ(2gZ=0yjG)=*MA>Q2>E{7mEB1ST1nCKvQ|n@Gx^o
z`+8cQP|e}JHf>yYJE<aheaDR7@8P(4#hSI08&x*7pd3H<r`sP$4lG|2Kp9qa1Gt^8
zOu=zIkc_qYQoD)DQ{;uj^lkzu?!vcuc}Yqk8B7RR_<+fH0CEGKc8ui5X94a~X(vE_
zF<dSA1|%uImnwem7(;g=?%sQ?b*92dbm!1HCC9$tIe^Y&rk8wx4Ki@I^=1E0T)lqw
zAptBCC|s&k6Gy=IHowORR6{hl{~@80+O#Io>w1z745nB5Od#}~fZPV8PQWmeQ3s4M
zhkaDSGo2Avi?P0JP)d2?P^)lVJ<?hrajtRFoVAu(F@dKTZE>go>D|k5mydb%>Qz|j
z5*+ZG_oVYQv0gAu)H}RJJ^-0RpyFa@m%+ulqM>mRtgqlLd;2T*NEajSBME2dB(<y^
zw%>){pA$)D?lD;hCWPyVseE#ww>{Nb9sBr*w-Jzo52L~l3H@^cvPE+t_i?t%$#Wr2
ztdWMyrjP)!Z@gr7%MZ8`g?#2h1fk`m8IT+tNj{3RRA>Nj+?E9Zp#?12>j$1&RxUE<
z&j@irFZskFLGUI{HWB#w_4w-sAw3(FPe<E|p`bK;wFMAt&)Awrxr3Myd!KevX;}s&
z85*-LgB{f4zbIL8L*9Kb2J&zdxJTqwNI3?0m_sdue`89wACL))CXiH&3pn`4fM661
zT@xU!PiF4-v!x$C;15f3i?A!f&p(g6Se%8=PN-tTaf^ynOydy;b99Rs-J&smu2K1v
zC&E3AifUK+0!FI3%1O750)dPWP)@1%WDzK)8NsNZn*$S|!B6;Zzw`>qEDaqh-~~)p
zQgzbz0|Xhr6ouVYOvc40JPS@<17GvMhx=_4wXQ)0_#~rlkmXth3xm^a2vr#U3_0yA
zkV-B<T3-rn!|n*0rp5^HqdA`bLRh2MRyA;yB|%e6fr*`4g`67O$%|cXGCj?})^GXR
z(V?Ha_z8;Embf!!A)Arkii9;2@K;%mWzc0j!x|y9^53v7|N2gQrwZQL2fwE<ZV8&&
zsY4?uN$3I4*)Z$_8oJZ`cJl@4$3uqkFJqi&BbBn`8EEKGc&wcewzhV6C}aL1`3w-8
zy8XJ`K0@j>Ye5rO7a40n(?F71z!^BEsOZ?Xc6n@KeEcY+41j+6H^RZwh#=6HdOyN(
ze0!JpA5ql*(uSi4jsH}={sLSc{Ol@SVKd9*&LEMcJBTUWDNcu`JIe48J{eN)+A@+O
z&ExqEthshn;yf5BmAGz2&@g~Z2x6E=(X3(D(*ip{n}YM*$&|=r!UiruQ;i+V%gd8@
z5({p<0+ssi{pX5i`2FXx-+XV6KyWj?-N3vLDj}Co%lEkdF?JLZu}-+#Kbj<<9_<Qz
z(}u$CTJdTN#AW82IV#`Z4!0T$i8>`T>eHti+V_O;Ymf5b{rI3+$vsRxV1|83)0e<N
za<P6wZzP`Pxw&k4$7|Q#NlKuGrF;zL0<lW}ZUOl{^;P-8E0BShfY?T8%7$ysBB?ht
zLHsj0Jum5D0-3=kBk+yE>n{}&*nuVnP5o%f?%4(j-O_lkimVS#6%hKRSxo&rD;Fa4
zD=9B?72;Ebdh<tVW*gMcLjd)97Fv<LsXGCe<%EaPv?`K+cPc1RE)of2`OpuzfRMOx
z{+H8u=Ovl<O=pCpB~;Z=kpx-IMUR5<D-HSJu&#Xw+{Utjb4j`$buNR_M3r!uj8K60
z2Ri$0FZ|MGV8^c2y*jiRDt@<~qX9qeV}HhOdB;OA3F<f)Imfc@7wNgruxtn72M}zb
zVe>|R`1$p`^OAV^K>L&m#GeE90s}W1nuI)i=M#dY%U8C7tV*pUhJvT!+6s}T3@7xl
z!DMD-MIYG;sv<W&M&?_h4dfkiv$I40AS|rDwPPV35~P>+!~aF#RcNIHN>V3X4=Kxe
z#bd3OOFCWqll99AtOHkK4EU-y4*^YX#`Mv`5wN%JQKrkMOIKQspBbPd{RL7Lr><`+
zRSX^iCUULB3P=WXn2!mjPrCplg9*f_gMPL?U#q6lW_Tk_+erYD7``X{KU}?cR8v{^
zKMW|NhEZ?;u|d>PQ4nImf<PjmqN4PG(jqF-K}A4H5>(14N-RTBN<gFq0qIhsprWFL
zDkW4ALJOS~(%v2C`^@~-d;gfM<yy>2?mhRMy+3U~d$s{9b%PFE!X=%15DfDJ9?Z7{
zAgkVha8EMj7NZ)FADZwVE$e23|2ot}Q~TLXP>>tAa{a(|(f~D-f-pPrUHRF~^<_dH
zRm8JI&OM3@xiE+<!VcFv)JGDvkbU(p>4h=Guh#49S65PH_+r;XHuSGFK0jn*r&tCn
zw+j&T2UspZYjh~j-gp^BZ*Ja~HzyvcSD6eEI&Qm`AOD51Z8rRWz6`3R)TZW-Xf=rw
z*Ei#^4i19A%8G_W$#5ci_MWNk;y#c}o`S`pSuC)aQMFpXU+C}^B=ok#a6^Y-<Z3KS
z%+^={_<hmj5{*%df!5jE-MuBqMo>>Oll=4$bhgKHsp6wr>>GeZsz(y8H881J{D*h*
zHT%z3eWafI<uDy8DlIYP)}83ofVv<~D8%tU;B*-W^8>%V=t8VJk#6x>nrO9{2|;sR
z0z5|*;YBr&b8&XwVII5}Xuw5eaCBwKGEi_w!N8NA8$0=z0oXo^#l}EDhWCYcP)tJL
z#y!4^2}a9{3ahly>%Xr0NTjpx-e>I&{vmDA4c|7{UbqlQ2M4S0loJ^?dmG-p5Q$IU
z)H{bd5<DAFmFV22G&7Ry@8Pkyogi+fFm1~1zgNNLDF7Mg6OeJfp-|MCn`->YV%HF0
z^EV_@;4Xk_tkxy-7jRMj|JeKn5{K!I<;S9TF4e;Vn`h36Jf@%~1U6R|IAx@G2T%~M
z`c+66Oynot!HndYnQavROYKsMmD=tBdAje*ty@Y2pkg<z!=w&(z)(?{Ie1CDymD>B
z)7y#r$=dX}s9y@Yz|j9-`Xh{8{68pju3UIU0H(2j>cAcWQoy^CGWI*|FcEywdL`-U
z!%Y8ukR~N3j)sKO=*>w@`N?}w#k4*$T`3IP65SmNSd>vK^jxns;5%u7fWTqBtGoLd
z{VgE526oeMk^B-sSFbWl8!l)#fRpTTSsg<(`MxCXt{E!-*~UVB@83B>2{`~_yslKU
zvo{ypZ2~}9gMZ(1mx8&zxqnF<VVDi7&sHCexCS>mN;*_aV_lRx&)Hy@d`<S*7fc1Y
zvp-IT$$^xdn$%Q%ODy+#1BDN|(<eaGfHqI8R7;&9(ep}i!XqWZGXR}DsKwZ3(h}Tw
z!xTv`#be@4r2GNm*spC2{xe{IqpaANNE8`Ec@XhUZ>0#rGVlYC*WWM%X|<XC-#a@;
zy9wFf;%tc<kiupHAX{aSBm_b$by<L!VyuM)JaBkG&Pg%4l!0guZ8>uc0R}ZwklFXN
zw-1-*Fyk`73(6H2)CV-!Lx%rwMvd}(JLEs#;#%@+)XVm%j7#;cf@1Zez{cpUI>Nr1
zJp__u=(1g~zsu~wtumrjlb+|g^leBWlSOx7A(jF7m6${VbKxM;3tkBbJG$whBy0|n
zCRlM*&(<B44xU7xPBq)>zY*{vvsJski%B^f=`6_kfy4Nt`vmL?%HXO3Lmuzo(WB2n
znjszWLfqsGnXVJgGW>AjP}8@8xBqvy-fEkm-ZDqaiZHK-rYCRJbg2l}R&OUpD0g(@
zi5HDNNW7IyjkQT-#zoZb1@Kd`a_p+FEd1ZOivWL4$7xnCw3N|L*faxk-Za+`8ETM&
z3MaN)HXL<<&ZKf()CrrhdK)1~D4l{`dFgiXz_>A~#UOw0XBlIO_KQem%#kBmtg8XM
zqqSV|;%eNqJoKMi80s4@I~UR$Em@>E*A=CyBm58<A#o9B$x;2XP(Ftx_E})Di-ARK
zhNC;+{l<{Vmq{2C?}2g9-!7``V9<la{s@_6K%g3h8@yW`P87FFi{xTRnGuxy`5<lh
z8@vKX=yU3E4dvJ1o}nfF1_@ThfGHFZIeakZc|web&dK)M3c^{k&DNBpT=6D!EqSmX
zQb@#CsPA9-p=%ux>TeHRoJvY#g)HlumwMZ^&KCbH_u{$dB8Xvx{y89_(ng#96eMnC
z4k5E2h;sD>G6Gk3aY~`q^3dAquvpyHiE85)&Xo=t)RydFH6Ek_mB<?N3uRW6l$Lrw
z&y_9AWp;p9_{BOLurO2HP2Gg>FPM!83GQXX_4i#4iXZ7;|2@(z^ZR=^XB3x>^hFY1
z_9su+iY{qaO&*fCR?2NMy``Dm?v%CE>J0U-zYt<n%U=`~&C9~_xBxMw>Y}g)-jK-#
z;KRtzFBOc|qTPGbOL6{a$j)xdcq2|E39{nC)AppJ&KYuy>VfB}h+;1;mQSdIAvJle
zn4395{pFYx-=QM|A%4kw^G{Qe>~wbL?54pTzHb|@O1S9%9k^x(ba<v!hq1)Axe1(b
z80QFvTuxNkvt0I0b3?<r(iw=<{c0^Rr{{l)B%IwTQS9d{EO%v}R^S)ZKLf9^0UDZ-
zEhJlln=4M52yuqMO4AA4w~ye^I4y3ke{ta@OBSQ5A^ymv({W<KL8IOBQ22lg-or40
zf7ta0__e~{dHcC(!Mfk#$%nWF329ezcC6pJMZ(4KC*7f((GMG~Wx2ie3}eHH3hdbb
zys933$?6RCtP>zr5T{4gVMexly?v0+`g5zqPjY15aGYM_x11la;kxo_YYo6XW*~O$
zo(3N8)eNck@YMMDeh|0}!S`(af`J|i+;Pbzso(yLA;Nci^x}VY`n6->a*g0@G*o|{
z2Rr?U-ez__pzYL)xb>LMXzyUY^!3dmjDKs7W+cnU)6?pvgTsMV|D7*1)`#-USN6U6
zNg_^F729j}drmoV>e2Jw)!dPU{5K0N#{IwoDJ1RTr+KLHFLw+B9B#v{C)esNm{@ZG
zO*5ZSebo>_6kF~<uiG@PUP|*);(*Y(od_pHFW2wuFVmf{8G#j^E|sf=4*PBIzu9_6
zwuH3bEB;})QYcQliKBLO&sMc2Uh;;VR}!>3B6}GiPX*I=gWh@KP6c$u4Ui9J`lKDW
zTA#+$+qLJV(vZ95)4sS=>D8gUc-hJ~D;^m9#SN+HNBbmSoJxfQh8jc%)$bB$)k<Wx
zF38tk@18SmJqrf%C+Z4_LC0;xHBY@Hua-r+W2UY$uLBc=Xz-?_QZS&(I}L5ST`6to
z)}>1Zk)szXa>d&vbWo4+*7bl<UP)$uoF;pT{n7usI;U%+#yvM}<QW{vgb12|?Ooyc
zt-T(&?KWL;4ecz>_}*_{ZF)h?+UwteOq|k%f(CLuYxc+*vh@#ckzg0hJa8)=BC4|Q
z;Qf2|A3DVP2?)bSs2mFQ0w6Nh+Z!PLx6#&>J;2kbSb<vl;N)DmI7wMY?~0KTY;LKO
zujxm%iqG-7E^D@3KN_j*<&V#4^vcwzh)#<2V*-d|0qd#&(9jg8j*c#KdT+0TN9Mu7
zKmgR@$}At+k8n3S*T{=;wB`T8X{_?E#{I=DhO7_MAPwm5s9L(o=<Mv|RM%sKvxg}q
z4`am<ir_|LZ@VxLOYS*M56a9czmO0<^?7UYGRWORU2t%KIA=q}ZRfDhwprf0^F%>n
z>fu7UOLbdxf?z>KTb$D^WJ6*sDR==y)6Q7lDn%mH#%(P1<(|;)_Xe%TE*1Ql%a;fD
z;hSuV=!&`k%4IKjK8!06`-bHJx$}HuiNHeUHK;Y-02N(8b7C@BknG`WbFidX(9y`i
z{PW73_+O>m**|rr?TRh&^vZs5s4R9p<L_K5Kv@0If(YUe+|IZr?Q<j~X3Ei%u0->8
zG@S1i{eV8FeX1kid9ZsSDwhYrFcAF<_I7q=aI4n*oQi~hNm}hg54LkAxvasbAnkL{
zG8Tsm?lKo~(@v!TWzHYn7_{z?me%M|+cjHLw0;MYyXX9c3-=60>&pZPr?2nJq>U%h
zny-iG;XA;INFM?LWyhScp_rFWC4(#=*BB0qo-Ald#IOcM3~Ru?FcpH3=F%RmUjD4f
z<g0i^Zde{F{(uckpuXJIK>9DO1$ju;M3eIqM>hNRi-c^P#}viYNvj0)Jq=Xrr(im?
z`Qi4aL(;e57S_B0;ODz#Qd><Gp--o8Ho6WW>2`rVT!+!gv6PdNdaa5m;kcZRQzk+*
zar%tuhaN-9(tI9}+V#LcMv9&q00#$Qx5JQp-0~|%y8DuGDiX_Hwe=)cVr~$5PJT6U
zmC}3YHMTyIhs?u-=bC%=gt=p`gA`3yPcKP~mx1O+>=T1mA-0o|uhRitdJZ2@I8aFB
zaMDs|OmEdJx$Jo-uB8$cM2t<pey&7k<iZc_O&P0-Td3>(MPB*ft`(aUF&;LU!7B{&
zMRKI>&#hEvoK|JsA_=foNNO`cr2@(BeCwsVLf4R0%nt~Sb>S)z29><`XJ%D7k%AxM
z3j|<P%)O+aY8#%l?NL{dcAm#v?Z&sexhW63uN;hPa4zAtyfIQFzDFl`m(Z$|&=8g=
zyaYf6NCXH8GJ-7SAJMV6$N8i3T!zn++)E=l5&%L0ZJf<2s4sVMFf_cIGnbZRHCs=J
zeeX!eE;SRLQ<!nd)dY;qpbL;vcEe=oG>+45HT!B=otI(j|60eHAT9mpXI~^EAVw%B
z?(N2)eXl4O+w2)yJ(^Wemx&O45}PlMVp))bcMVnj&4IYv47>M*IOf;a*RnP7<arld
zvJs6aoL2%sB2T-$oGHVM>%>p9o}jCW*L1v4Tp#*Mu3{hB^K#}nR+sOuV}il^Rt*(%
zUY@XB9A)b(_TklZ_Vi3r1g<bOA%|&$_C1FctkQUEUx~`K1kZq8#Q-Uyck0ezFio%g
zk<}Zw$rji(Fj#h9%}<&-eDL6KEd=@;ybgTb9ZZ3^GzFZzafnWMCMR5l!>+Wvnz!oL
zla~DV7q4pH3%?(70OM-mjA!jl9goJRhH$eR!NxxOAybd(Ru=I{9DWk~uDYfsS;msr
z(iKjaY<u{+acbf_kq^lO#=xxZ)@;6#-XV*<XOK|%RUj`VH4rv_HOP^JaG{kAiNHvi
ze~7(}lg8-PDC?Q~8^9Hu7p?kY+&n@!8iWvuqnz(!Y~w&aQV#rJ-{Z*;bowB2C}+`i
zXIN<4obd$gU_-#(NfUlR)+0C`2a&5G5iAR6aNuO0m^q(oZ-<O~g`YPysKt$Fn!~{@
ztAnRC7l!Wst&O)K$cbyEw{Ek<ivO!7@jH2UbYEGvlRak`BMCl@t7T<XSv%MXOydzH
z@}w@%DEZ<<?+M7<P@L*I7&fGieG|ycrzk!zLzRm@!I-MFr^@0)^*+%YPS_yB-*>un
zb-d#h7qq4Aw@(sBP~qQgujU|V^GvH$vZgPpbN(wzLu2d$`%w5gzts=nn9qXz97sbr
zm9v_;xh5$tcrPGbMhJeVThNr}Fw)`66u94^69QI>{}c$A?P8?Ch}I%@h~KeN+y!|H
zq`E*TX?hESBIt~lcKL5jU7uw!((^g75hQrVq5o9~owyff+N#T4!Ab|pdT;{PSVe11
zMqLIyW16TYpex%%>%f8e9pOaiPQin(^l@R~=F$BVHyx8qHE!Ifh)|OPNlAh%kyA%Z
zkDFAjjKDVww0LtmV8gl5fKYQAbuLBU&7WC2vu)E6SuP_qxbzpmr%CM7q|$pDW@rGK
z!z@6QXs#aWPzP~s^rC4F8ZTtfSEx;F7SCddUs;ewhMwv(0Qo+@P;B+l3X=y9co*R7
zu$Nvc5n9lp-w7!}+AO-jZZk**lcXKZ6BG!;NZ#)x5OrxN7Y!ntOO<J+@bmv4M=0;q
z%5PzEkK$@xt<m4a`y<f9P$8+%IU28>+hp?cnkmHJWaBR+t<j)?`YZ0Izc!<TF&X6<
z9%_GNluejsubXU`@i4jmEJG|(?c&|DiaGUeYi`xt7xgkhSv@G~cLwL)SI+dj@Y_J*
zOV6lonQ^v=3lK**QEkL=C9_5xgd<Az$N6J5b?FAuDNW-Ip4d${Xm0@C`&1?X-Ab_o
zgh93=`{x>F-=%CXUa&|fn{hKi3R)s?2dblt&d8Dxji$g6_!1I!tt<0^kq#$XZQYfZ
zlVdCnvtya3SYrDW5Ed6(JR#59LM`O__E5M9uU(dlKi~?*ANRs(wMRJt5>ySz7R1S&
zSUNbl%W#@;l|QW*K^)M$5EXtF)P;u_IR7qQp!ON(qJ=t6n)5$;k}9Da$)dozC=Q$s
z?&sNLRz%~+`qHy0f1EzF9D->3JZbE8yt&|yc}q$<HQsU1&&Ek!Gx?%xq=ipbKHRSa
z0Mj-*d;2N?otAb3Jc;Y>?EEwlc$JJos8<9!*kC^!Z~(ii2-NXom~BFp@V)@oyuH}y
zrhcLs*NCTyLgkE;WVpNdY1w*Ib2<w2ku&<r9ZL;;cD7qxAt#{VPjCkN0i2O$9i8g%
zB6$MMFUmdhB-M5!{Q4<LsblZ~*IRU|Qb*8+%@oXEc>T$B23b3;gdm)b4w;C5YAsQS
z`bc$F1^jhh?dQ{6sVlhSMu5j^>#Uwgo0+pWoEP&!yN)m1x2d``3w+WvroCGI(G{Gl
zQI{X!a30Sg^&<umG#1@kIr-+h#1RH(OH{J4z~Av5M)1AzYjw&12z|dy2w`+g1p}r^
z`*?sskd{6ZQbgN-*x{c6BNadnUnm7`ah_q;j>Pg#lPw_+^WL3f&p=JwCe{lI)+2vM
z#Dq?Uyeh?kSOOHeknVKOfsW#ZMAz5XABHKzUS4_Qz-}P~aKDCuAakg{LgtEpz21M7
zn`*7`K+}>jsHQXwteOp4fqXm#R(S{zNSeznaEzy)HUVn*$x)<Z#DsLY<}fX8jr5&`
zA3f8+U|*e}A~SBM<cAEa=d&5TS1(`wvylBnhroZ6WAf6M&Wlz7k29t>ap?oKTQaE-
zzajMQpSrloqKq!hHJ#Uslm#OSk{=F0#d>d|W+5FV@GLmbmzQ4K-m*7LaWSN|>dpiI
z4wxd9{lnB%kUp-b9Zoo#@$k}00Yshw#CpiFi}W)`_-4SwmFrCQD!`-F_)j}&8$qPw
z{-((k9Q{n2Bd5Xt0eTtlKp05pknh5a{(||q;<iEOO1KS2E-w#-54b{$zEXAjOHCl^
zcF?GOn?i<pu!gh;_{$wq6F`My`CI5@)Xze^_Ef2Q&*lA2WH?2!`ymaCrA64-n4>i5
zX8an)@!l(g`2#(<it!E%1AXWWC{jNul3?6C$qMJle;qp*?z`;BErZ3qItzBxQs@s|
z;Kn}S{orsoPodbyam1M&)>y%8M?<*Tr8k7q;SP|*F7Yi+AWLRj2=3hURQOerkWn!}
zf<}BPEf6aP5CAL#wfiK)7`Df@pnWV}<v0fX->1)=dkE~hyO}3BJOD~PXRNS*Hs3U%
zZhs)`ABuFq@!w#fNm)0!k2P}9Vk^XpPS|7PPv%m=oROd?Y#yDQ)E)jjDKlOuyRKaH
z+bHf)C1S%zn=eg4UNq}(D^s@&<w!ZxBiwo``xf)cc&tm&Ng|HeVVEngYVs3a^ano1
z>!ucOew?hY+7a^8O#i(^C%f<+Qb!c1BT&*wcA2Uipjko)LGqkDW>y|&JyVZf(W-V8
zejqEHay7#xmiTcPy0@Nr;2{;HTB@WlLUgM;#DchdK!%4{E!JP5h;}JtKP2>@e}}{r
zS8Y%exhANIZi1hNwPCbztr*cvYa%6&2`gKxWC9}wXwkvq<9}+cP!@0;@%0+>Mr5s|
zCK?UD4tCp@5@w}>xNc7{CcOOyQ8_p3l>_!9O<r+tcgC3nM5d4&qalmIIqDA#x!QYa
zuB(P~h@d@-qCPd_)-pXwWQgn~z&?upP;=ae&w<|VUL2J_>`MuCI$V#C96NCfUd*|Y
zd_0rE^g{<fp(hj#od&s-;Hv9gd2gL=wWxOu*DfOGZYzd|IJ(zkN6;(z%Mrp(M%M&k
z4u-x&f$g5fjg?6yd&-$>APkR~)Am<(>(Ti|>Q(~tbRfhDg^ENV>a8|>g6iS0@Vxm4
z6+K=H0@Sul8`vtu!KB~8@K~7*(p$cKa$t>t-R2ri+&hic!Yde`EWV+b2$5hb{_9+G
zxo`{hDqGDExIic-1&X%5z>fpZG)0{_XJRrQZ)f6fQX&!D)!=CT-E$?RD_)`he2MzD
zDEm!){ZIC4RG%+vDep&wvbO_t{XjORnnHN7y$FKaee_WiB}5~m`chHfd9|1t*J(B>
zAmlsI0fz$>Es?zQz&YI9bjYmiz+@ry!~HJG!U2!^&~o@1(DLKn2v~HH9r)j$0%!IE
zwVMN_Lh84;h-Cd|YR;*1q~KDwN>~l9y^S-Z3<NLiE&ScmDgWmjhT|n#LIiQrw*$hU
ztY(cMtzl^{x5~Z&rSk)lZk1S{!-!8TLjuNvc#|?TEj1C`j{)?*yXKJw`wJ=}!g<Lp
zU{|%se!~U1UScigIdan`%chTz7gHJ6@4u95nZ!O!7&@$ynT;>Vy=GeaC0u4H?5*j}
z<qA^zQ|oaWyS&&CpzXRpHL<uPx>ITBF@8gGGNxFH_l(Sah7pSAKy2a738`yjWy@gN
z0&OWA-tkR!F5e=^cV_PBhTWCWo#Fdbe~u>TC_r#j=A|hJ&4JiN47VxO(6oHAu%YHv
z6Ul)ot{?%dz6!%-21xl4vDU(7A^PjC$9ME}4DOCq`K-vumXX@MkmgisO9-DK$qb8K
zMdRw=!fX8YExVRB0tbHWv3q!-xQ%pYD}r_PJ!^9T(Bcfg&D{jx_Cd<+U#Ua=9?p1<
zpZXA?CRW(KLC%O${;$q1g1n{0OXqW68z^p;zTAd5I}bjX=EiZ%R*9Fai>wce<nFjG
zlx|l!vtf=3z-Ndb$m`0L#=E}AZ(SIwJ4OjBDAKU`L5u60-;uiiWQM`Xql>w3dtReH
zJr!rw5Pl1&a?H!Q6QQ>G^oVr%=Mdpcb(lva<yi3-Nfil%p!4%Q^HxQ<>@v*le9pY8
zIPHY`(j`Kce;khTLCHq|M|+>d5+{#in+&$>=BJOCmF!{I5z1p=4UtXrpXCB;RabQU
z9a3+)_!T1|?{emKSjbBumcz&ZOFLRwQy*Y;htpD;pslWb?u{Seu1m)1=n!`--vl?{
z+JD-#YwO0O=Yetz-VF~1SjTZ~@6qAHSlDJiS&6Pk(&KtFUrAiS-Nc-T38}4Fst0LK
z!cr;D?Zg(G!=IiQCfz;BCn%`<Th5MWoxu;F&gd2R`}qw|x||Z}yv+Cfd2*%bF9WkB
ze$WLKIJ*5P5>GfYB=Cw~6M-X6C$B_II%tfb*N7nO6dL9k5`ngrFK;Uo3(;djbLju(
zK<4l`pZ~O!zu#`_$+A~_L4kI;G&z!f2eb9}mlTZuACWU8<pSk|k1IBpyt<a=!&ZzO
zfF!;Lz;KH-5dfBZl3gGw3D(@<r3OzZSOcf1rh4?WvjZ+2jNPy<uKE1yoM<fc96f=0
zgzW;oBX~Nr9^l6kYqXN%<4@hy_5VXG8sz@WZuG!i#PQ2%_$fw6II^Vt9zSZvOmK<b
z;963*iWlJ*v@fqz$3N>1>B9N*e}O@(S0=dnr7U}G24YvZ^+njF#>%mu>j-%>QvKC?
zY+j$Pv(Y_6CreWhF9nKgUP#GZ>z_|0mtC<9(d&=i>5GJll*3_`^-tO2yBK#p78OB%
zVMn-n^<xPSkl6+<<4hmN<-Y9FaaPyQWMxpws~t=2wQ*%ahaHhD{~X|-3TvGIxYSX^
z;qkx>H5b4wQq?X@)*aL2r#;T~zB+xFh5dFYheG+|A@oCFRkm-~3w3S;aiIr6+y5=n
z{p!bnU@f>$Zv|n++VBb2wRPP4x~ao)ml?jGxv}lpbt>)tQE&viId3UijN{q2KM+T!
z4*^O`(&^$dwQE{nw08r+ynaVb3v4^2U^f-D$;n%%lWO+Ffg|L|q<lmyQ-<H^Xq1}v
zk9RJ&jO{gvue`q@=sFrED8yd83h9&8M`W2d7HaKL4T`Mh`+JcTH_r5ZIk{`7-3ymh
zX|IO@VI}dde1)oq-;UweVeIE8T`<8l;NPEXuYCb%>nAkoL9zoJIaBODh&P>Q$3`qK
zp~`NrfIKp}Wc;9S*zk5ct_x${xB(&HNSNJ9E}w~xRa&>sz%E}d`axZl)I*BI6|z%a
zdTO$hn1|`SCW#cDCObI^ppb(b^Hvc3KdSbcfBE<!aLYTJpdOdJVx6Z{$V(mT1}pd1
z>d8`6f^V177^U`?uajth?VWVKPP?>_*)L?qA?M@kLr%;Gt*UuS{Ok>53`><5QzQI_
z1z_k+<V(IZALaefEkMn-Zh7SRx4OhjFM#hTTOM_fgniktRpM{_ZM2rwPsh^fSIhr)
zOMhCOS$sc2cK@#TDQ+wGhtx$=JKPpaxL&5Oht}z!uacAxKw6y8WPxrrz*t2HB8C%g
z=GsB{1ff?I!~N_*U<43coWPRn?&a0)`=vSxWT@9uPvCm%SL@lm`h>yVKqtmW5JM93
zT_+aoAaG<rRj1vbIbj%6kncaDmf%cRQIq(4m1sLui>rhD!x{0hFb<EV!J9mnlhNf8
zr(+Gkp?eW6?}!~!HEf+B-Qb_IUN+@_V?qXAtyByUtLn`w^F24cdi;288buz8*{Seb
z0RA|>OaTAg0tbAb^BIS$#|-m>dnfWrQHc$zmC<-N0RsieY=ptyX#%^7sGZCi-#9gV
zGux`$-)<?AczVhjavr)U&(}J>R$uuNq4Kfjm?`c?POfRGlo6=g3n7}RdOm4-4+e(H
z;VIRka`CE8kR{CAt>>3mtvW@<RNtQ2=74I(pGdh@b8T9Yd9}1wPX}vK;OOX1Qhv?g
z*ey$}n<UR`7Adj<E3_A<2ho>_Y}{+=M2FzLDgS+3@hd0+j#3aAE_ZO5ZZEQJS1lQ)
z&7A#gwQya*`YZZR;MWXFkO5M>vt~0!8t;ySHFs%MB$r`+bhYHk5?)J@@r2>E=E(I=
z%@*s?aX)4}EpC}xh7)VGHrcinsTFH1(6T)hx4^<2Ai(4ZpvlFT%W2kdY5wN5yMOnE
zIeL{!y`U5`huA9<$m$Rp=iUSw`UYg?4K40>Xa#a`c-X(U!PGAoAO$M;r9;|bkW5A6
z3Zm6o!+G<p2dObNYLT%H5-@?Q%p3Qj5^-$!MpyNzjxUgr^}c4tG{>uxcawQj>_<0N
z5i4c7^DvVbwgyZ}BneTx3pJ1RGSQX0eouG1Rgf1q9`ra*X`D4*^TBaCeWWk&g<k(7
z$;P#i3iqK0JDl0jBWgK>108I86-Ch5Upz}oKh;hse(JNB&bke8r7;GWyf4o%q~N~r
z(y+nutYah}NHW=FIi{Msbh#{3A4$czE-H2hJv;jWS*B?vX!iZmmv%?@I%uB1hfmqV
z;4xoUu~HUdeOuu5H*t0*V~f?r#MZKh|FWxHX=e^k4F`bS$kCb}_sw?Nk>FB?u>}+R
zzSMM+nUTX(u8-sV^A0{Mn<4>&q579#xX$ZqW9e}<&518H9^y}{xJ*x6nWrQU;sz4T
zBwYyvM^x*%Hz=&C#mZx-HjsILgFM42_^X*shMan2FbC#tajyCJOp^c*tenqbKC?{;
zmotma|Lvt9uY`e5E@vk@nX>brSzlU<nz;Um^OiPzHK&%8p*Sz`*_u~C^-1e5Pd0L2
z1Q0fz5h|m)G(gJv=}dOh#`t;F6gx;B=k;8t9g@bk&8fFeHJmf#Q9VD9zw#T^Fscs7
zZoFG3BZeYe55WStRc+(OIxcj@2zl7ucLbg6Vmt{x)aCNGj!(w9)YDVr=A$Yg|AbW*
zx?-bf9pcx5lStf=+7d3M2}<BGVvePBikScg(w+4xhV&9>-k;!uf^2ye&f(YEHX1Qt
zQj<V~w_jM2S(%~7dI-9xz`OaQX=gUy^O-GS?x<*V>8NzZPBa|~7sq!$S^X9EX$Wyb
zNbKeenRu4vNHuwt^|Iz!Lebb2_9Yxg)PY+{$8EIOA?JWY4K3c$gTW&xI!~-|V@!Ju
zlaIwjsxYVL|874z8C0?%xJLQ1KR>URu_;))T-N1HLC59L)-Llwqt=FR%XURW_+H|X
z*;!M<+|!OK&IeR7FvB-#>Hvn*whM%Y>ZtzYy>p81ABY}idQ}xNYxd9IQxoi3{?hN6
zJI32Ci<5>ge#LES+-t=)x2uEX*()HHeddDooZh!uIC>#n!t$Tor=e&YP9{k1A-bty
zu>2(#9)_o1;UxR#T};?2aRq1nAI)mak8)%G#sfLf&P`H(R6hV(`92s+9^_{XsZGM@
zC(SpPaPF0qjV-;sg6Qn*?99%%4oon`qdRU9RXH4M_a#ymNeFkiiK@n9*I+r<d08i-
zN8o%d%yTOD#|3q%P$W)UT0XTUmXp$yCRltr`UQSaIG<Ue6ihZP>JW4^`FjF<YZ0aF
z&_GyIV(8mX6I(8E2iOiAql%ty&Xk)RIsL26;l$te^F&b&0olDSQ&y@a^b&HkrA)?7
zstJ$yH9C#exo_FzHp^b4q5VaQoU#3~Rpk(8MeP^nVfw%#b3zBi?iN@S%u86Rrn@|m
zS<D)a!=HR9xrLd=xZf?~Ug^VC%sv4KMPWk3u}7RkxGoB2E9YtH@E`pwbq8w>VAOI;
zt8Sl^USD@$4|Ec0DOWP5p257pDToz1=uHM#<w#-&I?^iq+m(DV0^MY~izDw$$8&jG
zI6#|*7X4}>#OpaxQFww|>W6qY*@L1_88iK0Dh~ZiYF0_K<E_Xz8YDv*;V!Xpdow|w
z#kXT|20iktS$}Bo{2eJXLloy-qnB}y>M2ucOb`>f1@EQyGUa32$BmGx^yg>E=W^cy
z2dLsl;l1V^%5HglM{*;yCR69Z&>t{3!ZhaDB=BOT);a8Ky|gQg81njz3=Q*nAMHr{
zD&{_fM@TQSqj=~@E>8(5CuM=)b($9psX?7Rw8FpS4?oeRdb_XR$w`{?5(OP(3;<nz
z0eyiCViEP8A*_NL@qG1+L<ce~>aSh>fsJUx1@Eny&LSSI%jHy~FvAz!mbMPJ(YxmS
zo{`BWt<{olRFJe>>;1HXa0kXPLbr-sGC%bx+&{#beB`S-MCD()s{T4{#`F~<mLdey
z<Jt=YOpU>XOC9BIu3RW&SsSisRn7ERDi*%C;az9PuM&CY?1$Y}BJte6Bz0rnry6?`
zyHG9*M>(_>lsq}o=RsDREc0$-^);LH)zvrID0;8V;@%Qe?Kg3f75^3fo**E&oFjHF
z3V)!4KfG8fBTQ|1<Q_z-N`0Ph!`7S7Idpk}NKbR+m1$$i9r9|DZoTi{zgK0-u%1F1
zG!93^ojdnU1b({QFIx-H0k^m+6e+<xMl_!fT4id(q<14>MOmkZV`(J*8<fp3*AsG<
zni|)klN)CjpS}XOErvbc<?rS|5bg90>VI7?3VRn=Z?ibIKLA9!^A01E2|8kG96CRw
z16$lod}N^6<@2m(^5HIxV9xzqtny$XSQhBI>Hd<fZG2FWG}_2Vg{)WAjcW;%CV(@_
zPN^1_I6RTmagxqkG=?wyIF00u>w8z);<>(+5|1z@e_Goac$s+^0Oynf-PIio>)FrJ
z@EO`?Tf**JS#GX8#bo&|ic^F&4sLp<%dbrMUrT(4aQN2JrE+mjn2L(EBH~=HCiL3P
zAX0QZV<bFLB?SiP%9vjvzY9MEt4wdzuI?AI%5XP6?}+1n@Md46Eza3gk7Gq5C~5nJ
zt>PRDWK-0<+{mhTDnvb{g;i{21AVdAd!@KX^pR1}EU??PvqeT+%3%?w)mL-<^)mpK
z$5w96KVv|g6+3-NL=l@voSFyD*M+HvaVon!87M0YQwS$qI(SNg%nC-{*$)|?Y$UWj
zODQFjEbZYNm7;m(_33>_GC859uD$7F&d-K5i^?!a+3iY81=Jz-uV-48SF<!8Si)}k
zjrZzvc5jLS#@4z7*&nnw*EVB-L?LD0i2u%Q0-S$z!xi!gw;9#tgs;6KgSlSeox=R_
zr*nhk_cp@o^Jvb~$<BW4&er)ew4I{geR*BM0X+YkH$gVo)7$F>F{6vG&KYzz5n0D$
z>L-idCE3vKic^}q5KiFRlOvXkIRV}p(Ubp9&7%>rPvRk4XMg4w`JiWc$G(DM;3fFr
zKlok2*&DIKt8$jV90IYMuX~+y+`PNw&YE76@qUq@pUf9eQKm7u4Z-Ee;5<7JI|%RP
z6Bcubi!W96#;m0S_tOj8b*(Pcg&liTtB(+Q`qgy>&8kFK&o}B&oja7#U5jn*pZfZJ
z)<t~)`=#{l+O~d?B?tg9Ar--;{mn=y7^yppWqIPXs4mbY-71O#;6({Wz4LQ%R#8ZK
z%3cSeV3B&2HaqonGfPE>V0b(9>~M+)^Hy?K<yM_!1>4`ohyjJmd6qld<WJgM6<)jQ
zaGsi<Z4fJ{4(Sm(Vw{L5+<GK3fH(uWimj7A_U!}(zD)g9%EJvvj`_8dJchwcQ<=~r
zJh|ydgPyE`9}Fn+lv%#}y*%q%pLcw75FE?z$k+6gGrim$)_1RSC+d-k$@xE@h7EvF
z+_f_KFsn=@Z}2<J4*`WGAEXCUUD6<*SC?NhF7=M||MgCg|21PJ?%2xtGpOs8{{c`~
zgH|is;Db12d2+I?A)q?ZKjyHNn^9YydevVY*;aVNiNzZ|H3R;rY_Vp7I0uvFsIy<x
z^ZD_3ZNg`7b{Za(h(v~18#@h5dyPn(?(tMS!?esbftq&*O{WM>#l!I30)yo+Zz)6g
zLFksBW9{Pp0k%_rJVYqBngk?Dt&YPHxE@S)EJ!OXLyg!oyNXu$Q|nmiRG8b@c<_as
zL{q8dX8*wFuANK$FjV!xD$%JAYp}=)?4XoL8)B38$nQU5h<-J{&Ud83WIxgXy`mQ;
zD~vo82as{fr~;;`F4N7l@}OsYeEcV%TPvGPv-nR}3$iLYz}8?pUoK!U7!H4_7IQ%O
zQPvnqEXDE*sBSjZMyV+f(UWUjC}~hYi+_*yDP2=BK?{E3u;v}I-(t_~MDH}MY_a?M
zR0C(g)Rmp?3^tO~-Z;ET)|_eg)g~d!??JbwyIrxy?2yX=+FnAOc!MhA<m?b{Pf(9{
z$#c)hyA7-G_8-kunuHEUo7d7UVC(RtFfhSyidBG`@P&B8(&2?|j*MB2q8?$5H0i2C
zaDw<S{-K`t=0^!M@TU7*Ah3BTiq$hs95qBP5dvz@hReaAy3k`NdY#aA&Acr}TboNX
zQA8J#$M8@oP;(zWb!_x-i2ousBj|i}yR#lxd5X#cIz0U+(}x(`isILzdYo9Sax3jo
zlHii9^l>K%o-&o*H=m#M^L4?l`zo8)O$N;3i}a2a+EBe|^JQT5?>b|k^VDMb>c&t(
z|BD6_0?hPgu>;Zs4*2VklZ|Zao{)vXoQ&EcL$7Lu?QK<R54nbIA5A5xr&3{}s&-kS
zy=D&L!cQ{Fo9g+=NTbGTxZYFG_em06aFf0yHZ;E_-O*u{<%F93sMFtBL|iF)sZql(
z`YP=oGSCc-<k4VKLATuag`s8o-qixHdH{0(fLu5WUH7%M;u&Y?%SFtO_KJHS%FXzy
zPa`B|gT-A@jgj=0U(Z8gU=KpknP27DW<)V@;y3ty1M5fDIZ~~bc~<FV-1kkqLiB9=
zk(T*z_sum9(K&Jp6I9_uS@&4JST#rO1$=0(x^%fbZ;sCZB%LS}j|2FVS19m9NR9Ck
zka^OL&sKXhvN-3^@SIjEtD~3%Ah~(v0nv-Tqy~a@$*lX)Zv|zL2Q#7Y1W~X1V=d`T
z&*Wpln&*JyLDIweAIq#LzdzCW#%?_byfD9#%B%Esm%lo7fn%hJT)+NSzM8}$o1Izq
zx7Ui39(yOl2`j{}K$vnrU+nQPwZ|{E&)Xs?OP&3Xa~9HEA{`z;n`~8}j?my~Sv4Eq
zMhc!;en95V4<eIlnL~8%bf;t(C=^5J@ikUgn0yRDClmN|@~7zITeo-tz9$EYXtX<W
zB+js%Y?fUQ?D&ik>71Tu(s!qI$-W{i*NA+efcE$M6{`*&tVzGPu^40@f7#wWAx>xv
zR}+OzTS}&U4Vc);Un6b@%>L(j4=pl4#TzymYP=0G&bk5|W3SP>co0IFU2vf%xK_WC
z9VE{b>VC44uxL;z!@=xzIz)SjW>>Lx@E1pZ&%O_SvU&RSo1y5(B0f#TSA>-j6z&3;
zL(E|XK1}%PrCbej*N4UNcmz9kDzXdYpz!((nFhR~Bz8{k$ecE+?+h$KEd>@Cv4YOI
zYiFcVjNL0C_c3O^U$FbG5i5AArHvr8NeIp}7MV$JIk!l~cRm_JD=<Bug<0MQjZ$Oe
z^cjunnv0@IQMv$+gWOfZ+%}$F;Cs-TItpJ$>P-ruSn_2k^36XWK@_j?Rk-dT92%IV
zhd(FD0tikAY1&v>tmS~w1oM;no6DlaoIfsT7IVSb_nfvnMgERncLtakf21X}7RoMp
z@`@(tA>{}?$`TN%n?XS|>pkA_fz|!oW|(|_f{A}GyzocPa9l+7^!Y*Z>pr1y2+F;0
zfT}{S*f0P6I|X4u!|8O3Rdo)>V`^ZEM3e8~;vpH@MUnll9J$bC;r~K{EYFzu*Qf+M
z?^$KFmkJzhys*%7u6}9OdaU$nx{)N(yd7D6s|+>vwCT66k;E3I1&9f<^eI9O;ud}-
z1_2u`8-GCI&M|<IiTKIR0%I%l?IF>Cfo%^XXi?)J4(Rw8!}^iY?JdDc4JH9SPy=Js
zCNHwT!Cwx;m?10u(b=n{1&3X_3R1^6LPJjZ?GI;qJQH#pgSjA~=wl?bT8RqSi`KqD
zaa|s}XND<gH^;3ha?25^dmo<NvT_5fQf8|{nWw01dOu@5mTjI;1wcR?3<To;@au43
z{{^>3l<}4%I42rXw6QNp=?@i7dQkdr8(=8junToBxb0d<TSRcO{GiVA*Uldnr%HY=
zU>F<fZ5<ejYn6LM)llNVnPDH#W>d~!#;RRLioB}Nj%>bu)!|1S%!=R6Dj&90>JIh=
zCDvUG)Q|<$qW5dcOtv29T~Gw-Ip9&L+-7BEKj3s9G6VjQm6gpoYW4!SY9VLb?sSGU
zSw_?}Cj;BoiVc$g+r1|58HC?!3OcE%W|duA^U}Y86;Ab#{577InbrHymem=z6r?|8
z8<Jf?%I84R0t|mHp1kfA3=^l?42)v#Ci8!)_PgT}MbY@J!cRaoXXSQOX)l8_hPo7{
zsyp~pEL4=uS&Vj!SHGFE<=CyjJnoU`0KI&@KI!!a@u}6-4w5OYrMnZ7lB(Nn4qcZF
z_sA>HIKlk#Ri$hGaJa;y?!VkR+w-<Hjn&8mKQ!v13BOo+l`(ij4KQAi&76$aF3A&X
zp}$omcgt~)-J#2QU7tsUK?=8)(T)_2t$)49zO(5xB<Rc-TKKX8Zd^VzIp0ho6xZ3X
zxlC|++b97F9Y+us*!s5*uNItC-~e}PHf*$&EXOHmwFd}b6JX-wXl;<wcZx$Btt4;6
z;M=57JV7@ja-{V>=J`^SX?LwLvnB+<H2}b_)*X0mBeQpi9<=*s+MwNE>8VIeJ~V?f
zq+}1^z!nRV{c7e&cXSbp+bJA*K$)rq0!j;bwzD7NU|_)?6WWxh&i;5A!D!h?j=+;Q
zhu=}UppvyD?#Ay@{+BP;skCq>=-M^2qQ_F=x8j~`MwrrgP*?sq<joadrz<X)5C0Cf
za;R{f|9o<aUQCjef}vO&aC*a35nF`z#-)fF7dycGZ6rn{LHfcq#B#eD1nwB#6F~!x
zQ>&EhnR$3TJY?n1(H+&q0z$XMBMOs~@@Q3iSg|IVMrNsaS1*2-?!8kJ1?2pEai*RZ
zZ4jA1c~@cTkd^lF{>6_UBWlXZEtRjZgFk1NW?yOmP1B6X*+ubcMKd8H&yq=RYqKit
zf0p+&OX`uZ%tm@!|D8`e<O<tQH`;U^dzSy#-|>}qe9g0Bi)(7U*GNd?y-SFPYTW8`
z!MrgY!qCBmd_0hR-MCY~Jzon;$Ak}R9Td{;5|nBRO@FAnXd@cO4yRm9VL|_fZK4TA
z@G(fG8^BFnOI7JVw72_0ml1E*XqvS2O_)MY%4)aCnv>5!@WZZ=Y=g67Agz{bjYF&|
zXCh>}e0Q=EKSmNC5KYptbqY)S>;QUQ|Gn~9G$>^RxfO!RX*DnHEQA}h&8NjMt19%B
zL2JgIQ5e}tJ0Tv>S8@xFeuL<(P*^lyAZB74C6|Z72V9{=stWtA%OGyMI{5hbY+MpM
z+u;kl`we#!ckhDdC&r-sKgZ@=tLMBWnIv0=Ka}G)M?u@Nrey6rW3M>6!>0t*)$iky
zU(|{Nrx~$0Zp$M*95+=KKZ+4|A{ZCiz6`lXYEs<2B$*GLpNGC?Q$vfxAED!B^}{CF
zH}-?*g>v=B6Dgrid2OO3(&9${Jj_aJU$c9)BuC<jwk0rUB9EIlt=hwGM%$SNtl?2V
z3_~kW2C?O*yzUh@il&hi{qhu82TdEl_9!mb@d<lmm!V<16lpNH8u?={FI-rqzOc>!
z4P8_j6#acSK*-T^<Ab7259RHB0?mmixM0~--*^)JU_|Xw__3$G8S4V>bqDPpP4k0Y
z?s2}<IyF|jXUs0_Zw;jdGE~u5-**~0XU;?ZrOzoz6)g8NVU5z#?EKc5q3Bjj$bjlA
zUtXA;S!YH&`qbYbF3@`eYb^H+SP@f5IVL0OGjE(rc!gAtvR5u=Rtk5$%53iKW#%P8
zYT7tSpjSR%%Gom*;Ox&Q@X6V4z_tHkSP7m~qxAAn_<$?4=u@PQf!#(W|2N<$={>}|
zL$CJi@9Z>d*d#5{6I9(}^FbCj_UAKjIOa%<ohWtW<VZcrDj|*F{kE`QIK~`<2tC7`
zge$;hCgp>Y54*OYl?^%&99zuS*f0yI?zk$9@FrP*YYLfHPUbBO#-Z8@YZ1@YvMx?@
zi(x2T;iu_|*aPn(T47@48xJ>ySTOjixHN`NUC?+sSzR%GLL+9OTJ0jtw<37>`7J(6
zY?LO5!>o26ivjp0tYD~^@w&suqRH4v`kdi<gZ9t|B40V-Sr{Fz7Rwp>%H0<B7NT(M
zs4(X36e1OQZZRo4#tz#qV38{s3gfev&w4Qx7MjUk!M$9NP5J<smNXyd;NPXub&X^Y
zywn@vEC_66ye8IcD_O7{P+jh)aBWuqkP`ffp@6`@zJ&LdS=#kR2{7VME~Qe0DRzE;
zK-Sz-t|0P0Ca=&mt2WIKx{Jp?6N=mclZtcikT9)HUdqB58K4PLd+ePSiE~FH^9Jog
z%7^#1>x~O1t3M1L;RV_^8Kojcd(1{*PAgO-h;KRHIz~scy1>*mtqP)?1{9W8(7LO*
zqqUF|8#Gpg>LLCAU&rnAmQxLA{-E0B(GS&*-oOa<<hC|UgBZm|S^UJRx3jlyQ5tD>
z3z?~B<|8%@hF4;Uu0?6{Im%{1$gO9$Ba}zOE2R+d_8Ip3F!FgU=q5J@e^ocJS(^pf
zKiXntqHv%+pHL!&nNqIo_JzQZ-gO4cblk{tEb|%hs8&S%bBA3DgLSK$p#-O5ob$aJ
zq$-IQB)9Pb9Zvkg3-qNNyOK$%DZJSDs5(xR9t;WUO(GM-%dgWn1e(0w;{crI-ME*(
z^b)bNpj$D?pj5d>TZ6x0C6wQxAXQWtUnwbDa;su#JjbUB#3{n_JkFU5bm8wz`*l2O
zvj%~vR8v5GW>?}#l<^j@sUiUv`bLAX=UHHv^Jb6cu(vxU2>KmUwXn?Q7nRAiX!Mng
z`<7Ge9K04ecT~O>e_K|@E9cQc3?~0A$$Y@ns~SdY)}b{gGvyw2fr#2g|EId}O|XTc
ziZs5kolpq*iM8rh?9Wz$(*|}Z;sd&B@yb>-P;qB4A4MBh=dM&lFGwC{n*#;IRsjTK
z7=i?o-KNg#5f=o&Wa3NTQ^LS`IL3A&$4ni;@|&%kwhAt+Je-E#pIhDXHoo>|m)K7%
z!UeOXUUoS21qz9dr*qZEWi$dt-Omo){9{wNm4%m&MctnERi5t4+V*7cUX`)_d}4Pm
zVDc6x9#3laJ=}3>Z?f5*<N<{P@1G8=%D$)?-?n|b+)ne_<x;!DuTPdrHkj0Vm-S|8
z_?2mX&!s&RO^-3Om)JSpT&edK6TIxB+U$wozPuDRgCQBZ`11>wcH;kb6XU-LJ)}dX
z2+0%DNf7W`7_Am{yb>(f`qHZvmO~pN`KlsPO2VzY-8AqPZ??v@{4&5SnA(XI90=%y
zR1s=!#AD)3AG*_+(XH^?;yIdqVgRGetGjp%m+yxJ+JCxYs$#-QI&-ys2n+}dq8sCu
zTKdm>@k09OfX-p8G{J^T8hDTM?s+rY?vXSBEf5VCcaHMq6nfgF)U#`j)-pe!Q9(HS
zwD~s;gOy5^BPG!gcDPW7&<)&Fbh97Nu6Db1ixbe%t=ivD3~JADT%>wbREC=e#OtR@
zKa3j3OrWde+KJn${$Ni@rknv`>qO-XwKL{|9W@937}PdzkLTx|IH6I}=Fvv+a(Ab!
zW@lX@WeoK)*Zi@&^C`wsX6m>!vbnhIX=SMGV4!i;8GWR(WrKj{!P^z8#J2AV-V_$~
zmUI)#F1Q}jzo<;&Zac1oCBE85Lgjy%iH^iq<Ws$LGSx5zUk#5jL;A|BLqVO_txU6N
zbF)rp?5|9p@>;alQdTV2J(Wqzf)T|;<Rs^phKpXq<+a=@LF&}>t->ztu0yMPf1-ch
zAs#9#aX#~?*uDYR+o+7n?uVjyuZ7D2Dhl?m0|lq@kRKNfOEdI}(_%5!*gvJvYnT6J
z`M$Ujo0!ipdv~KeT=7d__$COzV{1U1aMi@uX9vh<JUT1<a<GH<n!=*5|NQj0zNM&#
zsy6%nywlFrnWp6As!js;Syd2^#cWriaz1qE_Rp9m+O%8Dl^?xMz;3a~QtKBD(HQ5s
zwxS8JZmJShlpp$uWOZlW3Y6$BLmwYvUTnFavA7{;qnXu#=6Rdpgshc{gGw6el=4>r
z=d5^Z^Osv;8)Os~ngX0Z1OU(wPFT<d=Fe%mEO{0p20%ow#T*3X!Z^&>^fHUe)9u#|
zW_gN(mp>vnyIkW)C8_b#Kc{c!+QjU_t6HVkt1nv3CN&@YyAHw*Rmr}FeHqXTmC~j^
z{Z<Y1fR^jgK7HwdAC)NsBpXii(M>OENu~D?829OzNE0D?)b{9elZJjSh0{nEj`0Jk
zL;SH_zo~Z<cE~bs1@F!EvGeDel&A@RQcoBo)@T19#VQ&O)o0BgVy3uXMz=W*XMRr^
zgIT3ViPpvtkPTHb$SfJ>5T8L&O7(@Isppgj$-1QzvrYCxifI-3C9AiIVYZ7&|9Vho
zwyCKlwDH)})1&pC*n(3ZWEYm!+HXx+`9OiEw)_g#{KXBEVp(H#;;6Uo9=Vv%ABiz)
z_g(i-=dZK(Qh(ivb6OX^2}1G|gIwDVWoKr(eB;3!E6en!hdLKN{YlalF2l?$%kd5#
z`TFdHwDL{l#`+r$#G1wxRs~lyxHSP}7}r?`H99dk=(et0DkI(hjGvWlxk$*%1Te3g
z5t1l&I8ndT=^jk-O<ldBkO!B=!?f@Py(fp}H^WS^*pu$7*2SFbUaiMz(P~I{$_tY)
z+!WGMnLB>oy!}H?Rn`v@R@hwm!X;y@6GgO{bU5laZe@hUE6jbSRR9Z1&$>Y>>nThz
z?TXHUEI1S9;GRb>Y1Y$a-`zG(Eb4uocy$nG#d^H5ZkS#7afy)qFfLkga5GW#d}aFX
zCI<Ub|2ZGOjy~Lm#;EC2Le0)XSH`e@0Y}FyFr2(IKS~YlKedwQTHcN4h72j<yZtXB
zBm;x<t<jlM$CmQOr=zM9RF0n&au4q7G#tO_Ub56Wn`RLkN%X9?#k;+t1}vFm?T;;e
z*hKoyW%NV@{-}P#o2uMIG=1f4kNvyhOc((k=C$yY{{_;`{J4Kcm37yzm|$W2r(h<D
z;q}a>_O;rvjR5?5hAfOW7q*b3)}D5f6pT*Aggzj=?5O%Ks73J&rt$1vHmx|<=AF63
zI|?al+v&clxdGG6-#7IHPgm!67CJXP*LXWuqML&MQz8}Lzx2H<@4`98!dPpRoAzH9
zV@}U4o{xDF@(|%|Uo2$?at1pH`9T+6ANu&X{X1g<ca~<rXwg=T{zCWp>x}v@vS*K;
z5u-7wQlvb6tA5C_-~_wC3Ff%giIIxS-19OX%s33W&(5d11Vw3qIKVD(&MiMM;Kk}h
zsWp`43i|PF*j%@2HAv4Q>P4;;DGcrkUc-Gh#_iI1c?RP?k^W9ykTq^HtVpo7nljHi
z$8)uv4%W_ci2Lr=)8CKFE__-#PqAh)<YGcz+$WU{PwbM5jm?=VZV!1e7u_eH&uP6k
zJpdWsR@?%2y`?py)ej0Ne1-N9HCeuE)r&&XijeL@xUrC?%zKYat1t+jtK(e*{q79U
z*<qfYbaI}xV+ja=?OqhrYA^9#%$VA)*|WQ?=;d3}<)L$ID=?vHaeZG8Lu!yQAfV+S
zbzY1qE1EGS5WI}{DdPs~j!>o0=$9)c!e20LEXCOgZxx+-MY8{Qq7GPeD35-^L<d+6
z9&e=xQ(0#2UM~Z&2hES^r~dX(?_$$$azAc4N`G3zXgB<d<iA5!E%||d%7=mM!x31M
zT`R=H8xD)DbhsuG3n3M__}CS7Reu|nY3BSCvc>y*s{-dYbySeVfE;G-<KY@}4Jsw;
z){oowL>cpbKBCUcr0QVyR4-L&9-%#Idyqg2?rY_FP+1;C`q)kX45f=fK}#&ym~iJk
z@B{*h;lW3Sl;&FeXg_OZJ~rUq(W8MWBVu%Q`64&!Pf_1S$yb?V!V>C`SNB4l2a}hM
z!n?6OaJ=s9kR*yp>rWT+9DF-alqE+jqSQ;YEhNsqi&**L)6u-;R*G!bG%KsZ-Bcxn
zao~rS(FT7aERwW+uYMpdjOSLqx<rz~Kz$Gtw`fASZ^f&Qn!adNs}|^&yR&c1Vls|;
z7|~qPa4>)3;TN=<_CV|pwABuyhCly~yHCvN;N^cgIu>#(-IkfyOUq3(?^MlDoLL2u
z5yjgJYfkvV0AiJ;-8lj+_v!RAhVHY&{WSkqixo=B4I=+ev;z_2S;^T90c6ji1)E7@
zYN2nAKI-$!iAeXqwPMZYCLS)1ttk2VN$oM4w`{S1>z4JuW3e2sIPR#+sD60PZq}e3
zwQ%>A@Vf4>KK9&X<UEW<;qB`sUd;but<xM)AIVyAJ)Gz$TI%TE^ln|arFa^M=&X78
zdrc$#71(txDff4Zqj#5*gT}KlHRm~uXD-Ry-m+?@7b$ZaKaHa5zR$X2vG#*EMlF8V
zLW<i%42=2Ntb<=#xDq7Un51)9AciLo&`Og4^3zug)xA}qKhN!veaRR|jZ|5x!p%qM
z=3G}r)<*}-{rrr=dG?Ff8~?E`rRpGd?ophyoeF-TSyAMl!>(07k-qpvy{DKx%1rdM
zZ705%GYz9d8o@yrzc&|<Ca=-{;s@!saDr92Dhh_JYUT_;*q=+gKVNV9xSw)$<v!)q
zquBZ{hA<`fZie5KYg*<ssc#u}t~tfsqF_%%v3-}zUCNTebX7I#L^wG*lGx3*Y$x1*
z$Fh7|Z;0L)aG%j}?+j+&DZbYX0`pm2>cnW~XU408-<{w)bgD-DgtUqg^`!ijR=i>?
z|1;YjBF;Q6=<VHmQIRm`i*3laB{nE5eJ17?6LyPwvtg{sxQ1P68;H})0I=?#D=mp6
zK3^#U5VZ8KzKsRxW{JO<itKkYXW`j~9{hJUtK*fmA-l5M9}||-?tYsvngM-^e;VXf
zWo4xvI#C+p<fK2iCFf@va=3MlG+!$45svuO*vAkn)W<ht2)f-4*yc5Ry5)BNKHFp{
zE0`CjGVv`yW>3aVst6ZMMGO5Di~Fp5DPab3wgGVLV(YZb-+jtY^SZ3ybT7n*Y>Ilj
z4C<u`71nvnL{%wyxAHsp!!?R0d&+%j*{eHEg+EORCBNUgb*yd#-pH{PsM6_J4Lirw
zSS!NR8A(+5g(srQ-0rtAy332b@2*)J7WEysR%pJ(<TCd7{pq`uOS?nC0z<hZ9<rA8
zAbk;0zngR5@Zk<?o_V|~mAtO)eyFJ};d_#619naG6ZPMG*1AkbQt8;@SL)pX7wDQL
zu~D)9w(GF?FDa%QLZW8u5{;*wHq4pFsQ56Qt=<_Kc6~R7G1*@s(;pp_yf2!ObG?{*
zf3Mlx8AF8d)-ZC@9RB>MYQIPE9A$oSVmeBY^qJnq4Wx8~PJA6_!{*IaqehAZciDa4
z6At^7HqoGY7Mug4>rhqCZ{fr>D!QFF%a$zuzxLkzAIkNQAD2uyQ^GN$B1<}jK`ScD
zSR$3gFk=lNCx%JNHnx$%F=CXhL-u`a(ahMFM2gD3&1A`vE!$YKjPbdqbKd9s`2Gu@
z$LIc`yYr~#n0vXd*X#LuE~C;2_D1y`jvHpUx76_8Ysa1eY?3QQj$0F)z|n9rYkU8F
zl<qTDW+n9liuW2Oh;lnFh?&<nK=@idY4cGU?<leToMqtV+kM8XoI;-4Diyt7@$J#3
z9vhy{gHfym8+l0}^P}`)#X8+(_Ysoa3z`l<j3Tf=wxGZKZnPVQP{X{=k}4T5vix|D
zLBpBpISPe{sy%bq{WJf;yX}!(w#JA4ikB&27w&ygTXxV`clh~z`OPWr6#Vz22kuOZ
zs5^Bo&wOFASWnvRc1xy_)Y@Wo+c$jTJ$ZFYz!i7We%o!hX0w-0aB{l#xR{swWJnO~
z0V-P*Qgi6or4Hb@;%Ze@)X9w<GJ1Jsks!!LhW%xtN;wb9Ub;q!CN8yuF>&Y@Q1yy_
zKv5<5R|nph=%&8xuTE5B#S^h;=SoL2(Ju(O&Di7Ahqc<S<Y}R)waK_MZVAptRz<v9
zFuOFGr<wOaZr%@*xcOS*y*_p=fHg>tAar}b?+Y_#=R-&U5X`J#7boXjk+vq*Uk(EX
zEs4A{u~-RSPl8E2MU8MsAG!#}Liu#Vq6X4FG3nh}WBs~~Litr-8G64rfa!<(CJ{iR
z+onEZKXVCKKlhi}mh)o2oGxmaBRrD%Paj}&*U_hiFhHA?#^SRi-bWxbv7WJ@bL{@~
z>E^h`Yw4ZoVgVzz7V=QO#H<1<b7o|#Xv7!Ke!g2YH1%1dm2e53{*)6Apt?I-!k$%X
zS6lgHy;);BQsp^Uf1_Rdc!qz<?nMMy#}Ov+V_n>T>219YZp43we6?qvtjEEUKkZjI
ze63Qz;v?lueQUF2GmF6Uxu9kRksK^@j3DQj=V|w+Ek%7PSpNIMy%Z%M51?h-@1PM9
zE@c#3Vmn{2vWZ8!mvWgH8n*A|l_Gj&YBB&KN}s-v0-STOkW=E%oZcOpqtdT?H=LOE
z16iYXb}}IkVNqQVF;+~P&lYlervPw7`LAOLStTVUd^dIVRjAW9bn~QhFr_VWs{@oq
zHGIw61ihppWgawo-dS!lYit`f2mc<PW|*?jWZu%P0(p3w$DjV1v=6f`Sn{Jg>I9cb
zF~7|@CtVl$NVuADb;(3gU28On42mT<K{0FPxTGkI_3_;cFnj502R=CSi&1oc=R&Qb
zx>fJ%-J3g6%66s-*Y;ffT#%h!tT$g*HS+lUMxL{5!ls{A^%-#g?!bGRIixahoaT!I
zW%H?EP0Qk?C)%1|klDBX;fkiPaCob9=Pi8)h<i_ze%vh>XyU(xjht0h_A>kVTl=fa
z7x1$^`TLatE^uMjX_v_-s(gEBNa}|@j9vM2*l&dO#k=m2rN#%n=JX701JSw<{mVrQ
z4pV-W+m2`a2K^N0--fp4p4hnamgs+Gx30YWC&8CChhOc~TdV+p1Ttsl7e#fGlLK<k
z1(%dM<WXmOV07YM$G+E6I?J39D8_I7$7W1K@}k@By4x;^GwHGY%P-O)_Hi*7{@IEj
zIkGX*r*hS%KX<<O{LIp~cWc1Wg?i064u%OJ(yn1cvOs-bAacV!#nZ9!okefm?&gKp
z-rDo^t8Bp2dw@3eB<#<aGz-j;<#yf_dxMLBYLGv~px16VERRN^j9TQz3M&dHcH<ZJ
zBu>Po$~&2$>G?z)BR~om*%61`0s@Dt3S@_O258GSG$ILyO<heWi-?la0O>ImrPKW_
zmqzLl-h<n{o}?{t#&!YGMvxu;WLmw~JpBq)auspca#$ud&(swaC;Q$v;l%2R%?m|q
zc*NHuZLkM&R&}1c3i68_>!ya;|JXRUxijh`>0)u1pjC$oZpmc_JR3C}7?hfrSY~=>
zYfqq;msfKsP~Xh&X8~sh(WxEp60a}7cydV9d%?erhGPW&*_~sc!SZj^_|;$lw}rqV
zPM)ANEXyd`4ooYOdCh%J!d*PGjGBQRsI=+j-L{C?lcqC&G-`BSy^itaFxq$JfEmQ$
zYVi<49Y82|qbOxt9dAkr61|tlZmZOXYHVd{B;skw68MSdf1BjqvVfc@xzQbZGb6j3
z(@NcIfB4LsW1Sw%=QRYSzCs365tZ*)=KR$DCQ&N{x@}VQC*N&;HO3NY;hZp;2^3ml
zYCau6CHWNivak;gC<_L4Q-CQw-f}~4g?tT|2B&0lW1TC{8(O{9dotWk`5G^0**Q3s
z3%xR&asLW>E8Ns`Qpv^0yyc1(rjxsHa!)#M<zUr$nZpd(pq#gIT-0sn+fUsK0}?`C
zu7?5BN2`T#6~Y-M#dD^fK=dt3X7z}VTD4vo0;wakpREL;!Y)H`#lA8+!+&r@9714@
zq+0d{GVj@cqp~UofUX>1C9^>I90y)ZT%CtaZ9A0R<TsBSF~zO@N|535@!|;rHx?X0
z`cFc*&_m5v1O$1FN7GTf+Px}0!Z%g`S|Q6%`wWz9edQW20NXE5%shth!3@q1*&}W^
zq6?z(cE1Gx`F}lYpan^r#-KCi6Tp-23Ag>T7XwQ?0{G;+823E2FXJSQKvH>onUPK>
z^F!kqE1E0HGsR=E_NRDTi~lwdH?HlfN{ojykAR!MO_yMQlVF$hTYC?Qfd*{(SV7H@
z?z?jUeG1f`TH+#o>7_|^uYy1Iyom`u?e$F5t!DW+Rdgi)p<(m28lubba`s=F_!vWY
z(|3+J<uM0#*!plh#3F;wd<iT2F|`E4g^kyrEG#!_B5sEh&q5pUqG}<!tAm603a}Rd
z19^U`@Lui`i5{5GG~{vbX>1$$$V_(HYbCgKU3_BM-Ktkw`_kAPW5=O7?@J8vfgw+@
zR7cKC-mnR6$+#nzC6Aexc5_HSCT6=Q*#`+)PeSqqOP~B~GaK=Fnh5_k<*|f9#JWvj
zAx-HeH}YK6Wb=8^8cc#VVA3mXE*cam+lu`8=bx_0<Q*TEa~MR#s9jM9pw0Pgw9qSc
zJEW20FZ)t!@>t`&&wov1xzzaoqwJm*OxY|YyjfYlxK8NV_p#uvM+V;uZ2>6JsrJ42
z)9HhU4$*pzU@DhDLeUh+9?%>CsZ6Xj|4+lKVjo(p{Xw~-0p`E<z5b@oap<o%x|b!E
zRfpF<6wfTO7Z%x5i`#XJjGag~|8cj#+1$Wcxz2}ea=QacejC!{84r&VPRZuSiPG&E
zmb2Ag8GXVpzReMWshx2FLv1dZ_w_5P^^dLu-mj<jK@gWHF8#&jlMc$81Hy_%1J}|s
zmwHSL1N@8n9LU!wz+9tzrs~ChGiIsrG5xk4%bU0wQ2VkcK+4Ifz%$lOfM8MYyH)_)
zG@%bCr>x|R(zW2J8GJ8kCe5+DVMSBIcP!w0()R8@<bi(M^3Dyz69gMp@mnv1e9qW0
zBM|CqSFnU!2R!5?Cb!HXz87D^B%uTpQtmzVWmzUZtgGqcU1?%2Y?=%2Nwu%eDexR1
z>P4%W!&Xo`(sbWA#(O0_)eHPA%Hkc$WQ@~1e0zOuZP05IKgbQ)uVkuA_8BpCS<Y^C
zuoT{-1B{2v7pvauT9t0FT2~S?#tbn}#ZBDjId5NzG`A+_%&A#(4hr}jY1BSMPD#I^
zNe<1B?0EZRe^J*bkh%LbNCiwhO@GsEF_Mu&JXd2ay<2S6nBB$tJ_gA%8ar+EthVy6
zf!p&Dx=!hQ^*S%pc~zRK$h=6(w+N{Xhi*YGA`ZsIG}RY&WeOM(1v)^P@`GiwCS9B@
zHUj7)7i%UJ+%`#vD^oS9XUPR@gVO2Xj<>*v;BN`SJJI2#{ND9lj!2H+&M`Vgzq+Wc
z>3AeVECsY6BW>+d(p@6AUR`pZ;|LJ=uUehNn4%iAzd^<1v^90P@|L|Fti!pCC~r+R
z4B*kLbuIx<M-GXppg|LYhH~K#)a2FNUA)N?WGuKPJE9Nhz_-BY#k*h5P|11z=LIs0
zlAd&aLx|C`z1V`?i_}e%jxX96ZmNTBPA3w*Z02ddFd8IuEAO+7W${K#O-Mg+$$;{O
zC>aw9NX=HcP&@2=cD%Fi6u{X)oaP;3s|Nk*qTMn5#Z2}W03>JooS~{|YizoqGL>-|
zKYJK7-N_7EnZ@$u7Nt}54V)5YRQ1aLvKmK!him;+=6LHcRi_Mlj@+7VdPh9;?ABwA
zoE6f#MElCFvN}I`Bj)F36UW6_2+YD3H=Cr9?l<F%UzmNDWt@@)<#}{SFrVdu-CwjJ
z<FASF@O0v2(q)N`zxr+~Kn_W<V&b1@6i^=-LnK9QmWgHuZGQ|iOQW(6SZT+RFV-zb
z+HQ057;P7a&DuDdp&M2dv*RvSa?_!gnDGL2kVD3=(XiHGe`Q;yhrcwdI7tu6XGUtn
zZ6FAI_$$w(mqwVEyt~sWD;cMP6=GuAtS4YsKQ7i7$gSqInnB;>kqrXPaFyKWj%%Mi
zXZv)34plvusx~164^W&RSMC@qs+2mIg-hbyX<9E$PJQ<!vy|?GcT7J;_i1+bw^68=
z1uUGN&iDG`3+vYS!dWAl+DHM0XdIV%X?SdGjHql2OjP<r&T2?gnPm>ng`U_&rHdEu
z0e&T`(_Bju>}K9YxRqWp_A>1$cEz!6OdSK*Sp`tG&dFTk!S5UbQG<8O`+qCTQDdQc
zqMlOhpS$cG@>Bacusrn8LBF>;UJcxu;gTUi=%OncO)Y!q*pv7q#xH*nPqyH04vs<F
z`Gl1=o&JTnFhPM^&*Uh-x>Et8h@_h>#J^%*{YRv395CK9qi7O4uD~&<F&lqm<2eIC
zw(~pr&Mp1<imrzZIea}HI8lXq*Q>Y&W0as1NHEISlLmUlb{Hmv9`w9?^}J<5>R`##
zJ;LH}t)Fd)BT0?<;R<Lylj?-~({O)ShR+<af#eZqWtdSQsw5qBqILx2u)<LP3yt#a
zl6v;mE;#^QdwtJANELG`t096sqDVq+<#D5gHBm<jodnBMeus6k+fq_N-f{gRP3p{>
zc6~b-?t-eSi-Vg5Ms@-u1iCQDYnZ1&u#8SsPIGb!F*D(fnV%8ipKPkOiu;ykf19?5
zRa^QqBf}6inadn!Jlh}OD(W`g8~A5upMF2QEh91^k8b!hb<D;-5L9l^O{c<+7|0V?
zAaJdEy>638!XjVP3&~lw%(&^GUv<^6y_|+qi-1~Cb^5V{Dy<P|6Yz-!ApN+HO;<Do
zH)Nk^EMJs?^UK6>0x7@?re|#c&Ya(NWp(HqFSRhHC~y>$e-0(4w-QIrn2?w)QZQDr
zU8~L{%XA+40fbj#R9(y4w}1GY%~;t4lZY_j9q3E_yz_Hp*9ZA!3~09l3lA>K{CI7-
z@&1Ws=NQ=)-$Oe_oYfFt&2R09Zt|-88dby<jrcyjrT#2aGZG_)AhUI-spfsKHrx=X
zTG;G@;;Pxt&U_%U_#$#66O@(S*~NX<U<rz|OUqjoIxaD9_B5<DKt#gITpCe5;a7%0
zfQZVAyOSIPx0FcHi&0JiHtb5q{p$H$*0i36N@{Pl*E~6Mix_-_QSMe!J8K|@F$Klv
z+-c2pZ^o5B;`U$bxzUQ;51M_S2yg53a@HXaP!5beS_E#MjOvtlM$n*Y&W_iQfzCQn
z-Ryk${Q4i-YPt=%%YC;o{%52bguW#kQRd15s%dYQP)8TSaX^7^zbzv!VWa@^(!ToT
z&sJn<2|`@gQ3At4kQn;{?}A_lg^3<*qu#(5X3&Vm5(B@8GY57ird-<K$Ownn`DPfP
z1?Uk-Fyn63nf6D`+ea{;?5k>!oO?B5%@f2qbIQo1V1e~TAE=JglEhc|vkv}cvOp$T
zBKgtO7tH2<7S_k7BJuCPO9h&M?Exfcwu%;S4HkdE{m>=PGs>;*T$`(bwi4rScjgpS
zTbn(_Q!IFVGgOH5C%TeOaRF^mO}VJaUP4x;@EzzV41*^-m1cvwXxE3D>P6qHMf<@3
zIvB!_`T5$wqOh$&z)KR-*nXq2-CM>Toti1TSN-EIpHh4_hHXIoDqU14;_yvy$fd4a
zg|0lg++}caX!UohY1Md?Y7}-elutBX5&3Z9n!2LmU5o|A=J7Murlnsl%VMqq1-UjK
zr)XW2D`3R)5a!>lj#w35^hNI>dRsrC2f-KpL<9BP_N4J{dce|Vd>0FNzc*E$=olXf
z$>IG;Nl(eJCqewxR=bTG^ja1VZRNcnaU+dG{j>7WJv!5RMKxnJ(DTlzc|S6pLju%R
zGvjUM!<pONpm0MhIka?FXNBi6GiUDr`lxad!UVdb1DtOH(RTTTx3h0(u)W_SNcik*
z*kcKRqeAcFxnvNREjDuVW`FHqet9wf+$pZxWvhFu_N(7y4HQdE>Vil)B_+pdA4ckd
zzz1fN0+8#i#1n6=gsB)5amlbcoNeemcZRxm#nW^~8d#gy$X&{M<UF$AfM=9U^oz%N
z$p4jjobCty>(u+nvH^{eDgK;@4PaS<6oLm<F?=>X7{hHXk^7@9#Rafxc|A7wZu>D!
z{{&5d^P+mnq#ly_yqOg6!y!TtYmwdh!t%)=1tEps(8HJ^_;(dk%FGSFrFvQZ%-u#a
zs?W1dK*=(c47<BcP}!3ZYa;O?v^CH8miLi1ZFA_9j^im?(`{u>d6Nq1K0HLyD&c35
zQjz<yE8EV)?=(D*>5W{NFL4i)a7isb@%7E4saprUoGWvvwl=x5hRQ|pR-4FK-Y{ng
zOn4U`NG_B4!*ni1sV{Bm<$5>8_DPPy&7At*fK3RL)dQLYmG!QLp=!@mYNH#z4v3a8
zX<f^n)*x(j77Yl&z`Lj*+Jc(ub6DxsnH#;PJI=&=|J;QC%+ec9$_Jv)B;>2KKHj@u
z1sWoA%zb0&TNGVqQsSp7bPv!QGYA{GV5Qq9kKlqofq1uKWuRQiYWOmtZ^tAUl@3+a
zSW>(9Zo`O&*&!xTQxJ+J-a#R*Xb09|+u{|(_<8bwH)`3diJQAnvSkvt;#{d>w6zqb
z;XltISB%8;MYk_Uvf1p5hZU;nUN&QoQ<MixJ~6hWj`hSUG#HzKE#Ivs;|9-F`A^SN
z-#`>$2T{{kwD{-GYG~AFO>SPGG=%2#zPP@JFXTLP%35!u@xG53#%vjT&JjYUcrOk|
zg$21*B5ZUS)f2mq3x>Thv}L>>0S%W%*eb}&J6Xr2+A<Q0oer21p<0n)<K&m7kkkn{
zzSY!RD_vY{q{X!J9@u4u=3k?m^-?E^jv`a-*6@JDg~^lr>)93iscS?qrk|NCs!e36
zxia#WPM{`R<gAa@ChX@IrwG`gW~6nSC8!$+E5D+?F9ikTW|dJLfP=%eWcdHP1x_Sj
ziwOXlF!CcO--i#oEPv)DhJ8OFBk(N<c()JKK_zrHv{s->K1rFhEs~`VJUtmfUIE}(
z)<e8^koI<;uFo|si34wAagFwjp5D`KKO-7$9yND*!e3fzwzmwSiSMZ4vs@q7V2^9W
zo|e)em28%p932feGGr=SxwDIfZRgKh8<&z4<Y+jeXAv)2*Dv2`FJLa&=2u0~FE+n1
z^-KaLvdQm)MNr|oW9rxD<ebv)>Jzno=3y^DGn#4*Z{8f(PX8GIJn!h1`M*bp*!fql
z|LvnBhN*CdQMy#KwBX+8NNL2XlS*jbi^*R9#0>3d4D-6~q$D47N9IT7_>`yVTfN5$
z7)j#Wk}Iy3{Q~2x%8TGh1|y|Z+iJ{0_$+c5ajT`jx-M&bh~jKg)L~e+YuT+*Z`qPR
z`6>m78?h&Hy|2Z^c--EpU0Nb(YkUT~pNU?!L?r*QOKH)6lXob%{o?`Mmx48QkL1aQ
z{mR$i@<IIv@1C}63%N)>fWXNdNtc+`g{z?jn+v$C9~{J75yXgF6qS7l7m^0v=P`~2
z#qV3@y#!~ki}!VU6q5REN|VcBF2r%2vy$s>d*uZWwT@R^vK9Sf$tV)T=yZo~gs(wW
zb(W;pt2r=!f`=d&TK2Q`DJuxX?!Y-Pn0V^1I0OI#3-m#9o8Jv!yr>wpZriLL=fGJX
zsJ_O$e>7S{sad>k(~mH{Nx-MHV8<+5`3}8UCjQOo>A=?Gjnb%)oFwFlklRdEx4GWg
z8x9Z);K68b_cw1ANa@IHH5N5qUcVDrK3>+2N|)qw)IS}mUh^i)h?H}pBGbX?6{#AA
ztA0^l+dB1Te5$=CUTz}O<*zjn*v7K5jc3Yz2441u5FoHkv|D2U>KCKf=cfVcx)o5A
zU3nU~>T3UiAmLh_(VP$xsJKqEk+t-5?w~=roNGxYlno-jJ`A&)!ddry+&j2AlWK5O
zG|BR0xud_meD$hu^+|28B;Hklq&Ok5TW}@pkVWrH&W;V1I8oRsU@JEZn~&~k%rl|v
z(XXoy*6h>%D7UTiAeR__r|$G76O1R69OF_h(ZV9=J8iT()<q3tUrimIzzWoxZ<4Dr
z9IPMrV9bW$5_L~#1;iHk=>@Kt5!Mbk^WFRM3NJOXI|rAVB`<XA2;@2KIJQK3-KjHx
z+hvVnh~%*&*pi;mP^P;1$v^5xR4jw$2TC127PQIKlue{ZTc#hx;87h{aIcuNmT))b
z)crWin)4AM7iw^QRlnKkj2dX=n&<pf&w&SbRk%XFF9zHL1qjph&U(u95b3AG{rknZ
z1Hw}%MiIzqa;cB|Qg22UM&ljDL%t(I@b=aAeo0aHQZ+6zE;f4o9#`&<&o(la@3{AB
zvANL(x-rcH^OEDIhV&>*;{)}1vnK@)nz&pF7>ObDv&2xNEi{u}8O(-kd%m|GJWiV@
z5VjP)?gF)T9u_Bt@khkle)c`U31;G&gY2fN{JJMx4~{O4YQG`uvZHp*-M%HW_7WIf
zE_QZr<7HVFl$3fwE(#gwO;yE_(=wj~fWMuMCu?IlijH!&(GsI_%V{ea!yhLfINkO{
z0oR*~<_T7mXz6uDu9M4!lcwg$V`^fMAWF@_JtucBeg>S8pVDC3722<{)?>n7`(3G|
z(rgaswa6_J1lALd%STeT2pG0)>^k|S7DXU5P|kU^_Z3Kz(fbL;gNNk%bb0@<y~iYK
z49$PG7sXt{GFNPF$T6;gDXQ_cKM40dd9=_ox<x}Z3YNxx2*_pF*QK9n{-FuAWn&ng
z$FOT3(VHK*HO24F$V|V`Fg#E<liZ)imz$dl&v734#uCc|j3ovhf>kut)WamehChz;
zLh`XB+~GD%e(pj3=Bc6`3{|fidZgLo=m+Bux!b}k)Ipu2>!<@4tjqff)~r%YqYbrE
zZ#aYmj&VU>$!`1s-D#>m?yI4Qd@vfsR(5h#=#knG0%cN%;rL{;X@O#V{7AR50LKe*
zwCg`}w~B*580BYzHE^CV2{SOUz#M&Q<RqzJ1_NRtYSgUEv;ZauG!sxRYPv`WLF%c{
zRHUi3ZnpS=y*|^qI3XZ*!jHTsb%#1Bnnsj@5|?r5ka6f^VuOLGFjF#`%;m{?1<>cQ
zuYkK;vISVyl^V}>0B_Q5WSa?m0s&6#J;LD7tbS%I<!!Zp|D0qy1@{x-U!oM%5hX(~
zcTs72FeK4P@2kl(_0>1_^<Y2_+lOeBq>i{e4J?G11hTOgvb~JgK)p@ZuxJ430q8Z|
zxBQSG^q}r`L599Kc9&(wQ`{H9yXSh%oFizJEu=Q$Qy*DDK8yt5jPpgJPjP_A!j8yb
zO>%|M)L*SCx{@CdYq7mvjer2#h@7uM_VfPCduRwMtnVvLoA$MlCzga5;I1q@2O&@Z
z;>p@<eWGFdO-~CLG&Vg!Dn}tS*grCo&6olhtHIm~e!pXh&pLX23lI=+>2J&a7i*ai
zh9E!sF;rcic|#lu0c<%(sJ6_pZp?4lZvbcra6RCO^F`l=`Fn`8imKO-zpxr{jhCU5
zGF-6n^SpnMZDLGm%LuuY0gARJbh}B(1&{P<ZOb5Dqlk8w!L~Oy70@RAYy0>IU6;0L
zX<-O%*^1R7w}81J5PP*&-R9D^E$^k0oIE3i-kAad;@z9CE(B{ft7q{pY*Zk~TTZ^Z
zMl#&mr2*%XiLKY%qnt>>^YtLjK~k@7fo^q63B-LV4~cPgUCyl1M{^N_^ekJzzG6C8
z&C4}YR|`q`vj`eJ%=fuzyJY4_*qeLpURCX&thg`!qx6P)X(Zi4H(DA1!$r8>V!2PB
zJ`MPZE7VjKY&Lmqxz>gxh@H?zmP!s^pfbCBA^ySp1IPe}c_b^xl35kHPIa2=-EnoS
z#XRTq)WzuJ|3H%deQ;RlUo+}{>y&hX@UvQISa@`>rBHtI^B-UF$P*^CEn>$l)Ze)?
z;^;}e$HJJB<sf}gY^V8KVKKdKo6VL+d2pRy6EEWHaDI~vg=Sh}KU>8#w;L59AM&i{
zd_mMBnY)j+R%d)cI_GlnR7{Ej>k+7D+kyE+y!AQY7rC!w!a<?R*lhbWzn#;jaSBZ`
z%FX3U;2}>nem;CMjcRIZdAMbD2`#F~krYId#8m%u2qBDJMz|W=R3pC1@MI7#>TXCQ
z-+98nF5S6-wkmUk7Jq%zt}eG=GG9muA0`Bx5`m?l%x}OwR>l6(5(UXpeNaqu8dh!d
za=%FHqzJlGujR|OVyP?G2*P)mDxxkn-Pn<AQyeJjsqdki6K}t-eev1Q+mmY9ACp^D
zl!VxxRs-+-deromr^M!kVx{R});8`5a{CBaqcD63ZH?t;t2K(S_R=UUs#GRL>6-+&
z>UVY|x&FQEx5rj91JLtEOD6)CH2gPSQ?-Z!Mif3{(LXR^sG#GP$AI!RA&e4G!xu+h
zEX*6tbmw_2l_s<&J`L}-jqw}M(@M?B+n2SZ&4V?TUm1-^RyE9hXtUiyomOEkyOg9k
zXdQrHVbK-yGzR-7oY3{iW8rJ%49U^C5=>&)#JS}lL(#KD7uf_o&1+XE3y5Ik{Aj<^
zTM7PMik*yGglWs8)+>H|V2~4uOa;O71xTT{3IU;8@+(tCTDajK7UZsoa!+!NgoUME
zqSJ2n3~!BWWta8j)jgLYPsj)Xs16G&>r88i)V>5AnV1?34Tklg9!M|VkBhfAT1#OK
zDmW+av;FgJ%7EeHl$ZVPp8l!#$6i4<Cgv#7B*TjU8Ks6!jD-6qFW<Lvxfl{yT=`uj
zNdqj=kN`!~4!u3%5P!v3OkkGklF-|fvRbp!8rk>+yNlo&b0u8n*5sTyu=#27`)jNZ
z5(>|yU{a3TX~3xravczbVfHelT=E6{>lxmxCOmQ7TG%UGGkU`L0DGhC6k;<=>gzZ>
z(6w--$%9he%IIzOpI@Ps#Ai>&+tHH0Wa4TQZ~1*0;W#?%h7mTx7~PK^0J@Geay6YF
z$mJFZyB=zpY93}=`RZz2v>%|KhZEJNO+tO?$7zwX8mJ+eh0Dl`_52v6t`!6JE7y_X
z;o+W<krJqZ!RBQk+B9d#gxp}Q(1eY!0dT<ET76Dz_~e_JW^$DGhAve!>1XsagM{AK
zF9>zZ$$xpd34W0c)=~yzRGQXfaol2WitFFOYJ$g%Po@soIuKInT6RUCc5B|wYX3yu
zoM<mOU0jL>EO=_xVzKs3!L80(r^0}YTB~Q{+r|91Q~kc)?cDceqiTI9s>4ufn!}wb
z^y3KvCvXI{y(8W?1nceDG^4-BT(YhYwpN`F{074EDB-_hVxRM7HVw#e>7Go4w=NOO
zXUpPsfq|sE<)Jc49H9mg#ep{*=Fszh1Z$qF1vRv4$@^jU4Y+wc(_d7eD~)E?sd6(e
zD5Ei|QIp(s0VJ{{8LBNe>2>SoG24sEhqp=yU>ZId&Ks1qf(fE88LB1ZEySqxjF0om
z>dKv|7PqBk-7}`it`M(zQgl{mPI4(2w5_qKGG<rSsx*J6=f@9M;G9CkQ$0-%yass;
z>*L{PuWdfh_Pp8-%&n`)w$yKj4dztSh?lkw=`_ER66iPe>8j4<ibL#mR*9cU1~b|x
zs>(Xe;*r$T_)GG%h|Np4p86>^QOKLq+^`?vMx<ihm8x3?e$n|+L?j+B1`ix#x5nFe
zj|6yIv-f;xo8=Ai)F`))|J7|ifc)pJe0xkv^7r}Z8;%Fgh6tn6b$YM&AhGX4`69Vb
z0tV#aV_iRShjlbh!qXp1-Rv+Ox!(3I^%Qx1gPFriRRl>#BJ!(UGaj>`T0Jo6q!QoE
zR5L#yk1KJ+Ul7Y&Cu-uHu4*Omir|&RLxPZ7Ga&YjPuehrmBjqs1NM~`@ojH6!Zu^K
znRAINgk_g9xx(HL54Ry|bRvo;v?L`i4)+zv_RUo#zz(5wQ+cn-@=WYWJ?Z9Pn$Z4n
zYTl;GGHY-J#LR+u3Ij>FMe_%)kd`QCUk?w;&L_;wRlCC|NZQzrd4d)xj}3Z->QU7+
zKQo`4yr)9PB@2o(ogr?p)=m#`<Acy2PO6b>w`6KEX}874!X-(yjLwWUl0#7yk$A=H
zbVz`GA&waIqSnf$GC$k}_p1ESo8t)9h8{ikXYY>x*pPhKFCc|TJ;y1a!BH_WKLYHk
z9O}x%x|*7FvW>1h)rQ$z@|=yO9^gC)d>DhPJvKK0B|#38f@+XNtUDb$eu7_+B7HfK
z<>QCM9AE+h_r=aHALKUw;#L=t8+ZY-dK3K%@v1qErxT+*e;=nDdzi-(hrjN4N^Y1Q
zc9F2^(CUWLzxs?v#^AS#0MmB<b9a9L7)A!zkJJSiHmL(f0br%NUYoiC6Xx!6Z(X-{
zcg2myMY%G-XvAswPsRB*5rVj^WuB+{n^P$k$Mo7VnJ=`BmtS!zUoV4Ye11rh%%`~1
zjj5QpzI)UJpEH?EL$FN1c$jBFe<Txv^QXt_RiBN-=sLHjsMBuEzgr#Zyy@?))?p$$
z5tEC#T)@Pt)2z|V@ID9kn<Y&cXZ&DsfzvnmMPof5*#)iC<hrooFGaVk<6fyj(D0G#
z+`r)5KFa;1E1cy39COzPPu+l>GU||QJO~J}Mx*J*qGzd*B1ezT^mtl>CCq8%3mB$R
zLHsn#2y-a#l4wDq(NBD4Yd9IQ>A@pNF2k5xga8rA31^T3tF1>y#<mxc)i5^0`;JiL
z`@%~|y%<~DRBKzC;Z9G`+nos3R7T>Ncj;B0E^D7Iw4?D~XMB;IE|R_pXq(5fov8wH
zS2Un|@*9oN>){Qgg%aKswBTyEq@nzo7T;UsU^LQ-|Jq<3*jLCtvFJ^il!O$MXBg^r
z2M9sYhaqcS4k?D|EZ;caHuG|ltD}lP6xRNRFFY=UBz3#n+MvZM%;K68xSAL>RX#^K
zr2rC4fVf6CZBw5H#r2UY_?#)sk=T(^etxCR@+d`afkTYpvJv3c<eb4q<d}A_!e=dp
zR}_u<taCh#!g32t1{~|j^D3U!$?ASIP!HLCwhX%ZO$4Z1;#$_D+aXg?rgl)8Q%yyM
zla{c-8F~30T?pWN<ilrC4O&xQsV-*3(h28+ml@F!#R`4RN<P(PH!#6cS+VV%C{JO?
zW18E@{htrUntrQpFS079uZ#0^UD~{0<dl>7nzTRYhbb<*{2PZo31(foR%aMFc?;c9
zJC%yf7o1lQj#c&66{==srx^~P(jCn_$j(C;-|hzPtQb+_H3_#}3<&bc;pGCp-pZf|
z!dhYcdXtocGO*{(jOU~Y@q+A1$%B+WO6*8dmq^=b-sS1)@9nCMYWW4*bj$P<ny(@C
z71s^Q9H$Un8oK(wgs6&xvEP1&@B@~6cR2avaPhU?8-)e~z;#h?&x?O?hhFeAAZE-V
zl0{~iWM%~@Px^%A$uTmcnVUx<$_vZ5BHn`m;%Cs-7!;I|5ZyALV%i-su45ZyO+^qK
z*uBZ};<qfB8942h>2fm=huQ>$a5{*Q+><>?XumDUO{d|k(C4vo3qD8kmWf*A4To~_
z?)c+$r=N~*B@Fx~!LrMmw(#+z(5g_IcqgRB-lT=a#qy~fyg|#O-V4T;5Zsz5vFqsL
zALXQEx$bTQM{Q+*$eV871H!Q)5m<kL7Y3`3L6e<{2u-tB882>$9%RmV#dxr5%@tmC
zBd(~sKf^?MYfXo(-{w3xr{SVPoHJ*Jk`ngF)p&O*#c#nmBl5ZSam!+5)bLj8cTRIG
zgUUN~$N_@|=u!q*9d|@ZTU{`(qoz?FJn)!Ts%P{atIyzuXFOb0$gG0^J`T^Q0*1^t
zFQ}-{W&X<Is2SFP-aXresBBhuEB!bF<YBY6dTE8>9WTmzZv-Ysl9@gN9~L;=8I+(5
z-4A24lS>4S9fz`xx3}!=JU7cs856H<G^{+0pG-lc)v#(GGBrsC`j;0UOE7GI3MsUY
z`9qPqj1uOGxTvT;hYiwan`kC*{kWXLVTFdVfC{O1(gjZmV~?=qvQN}zEK*DaH}YE>
z%)A@OUl%HmaYW8sY*~-rIcH8CqD%Q<S!x8gLyP6y`IZRsaYS9Tp56pQe3&+BG-n;5
ztn3p(wk#^7)FK8aaPgFzb1Uxg6q2PG-n=;~9mg+$ybU;ZSddsc`n(Yd-JNEEsYAZf
z2DR7nJLZ1j=Qx@PLk<%9BFw%=Sic|EpFc+=tC7FH8B3p-1ccr<rZyi7CVl+Q%)fyZ
z)v58KU2IzZBC92?E8F56C2<Lh>V1sOoxu4-#p%nlfl8)%h*0xlyZ&Np8YzBe&_yG%
z7iutHw_3Roz?jOJ0!i*5%NqjF>7G0A_>8e`tU^KYUBMjRy1A4|pAqUWHpply_Z~^k
zmj^%uv(v+{K;&8Q@eHmA#QO=y8Q|qkvpFsbLBYPDJjJL<z=hgHZVk+aEH!oCiW|77
z0npg5nrv=s+Gv3YJ_{wwJJSnxdH|BU^D<Z+Wvyo?%-7j>qiw}QY|lyCV)Dg#cO{uW
zGGE{1dC(IIYO=0PVH>Xnut5#%6eK5v`I$aN0)lVb3Er&NMmz-KRK8#Fjv6@{4X9u;
zg_PLT>tb4e3=w!@)IK>pNpU%tcqUlivM)5uLn<U2L@&`BVi8iZAmJ%q<KnjK+GXE0
z2?m%SWh}LW#3%cr`r@8-Th8|kiu?b%ev<NhsoO{$g4`f;Bt!YmF!UzwZ6c`QuG+oG
zfJO(Of@YY9h(TPWZpZXn^oq>S;mGo%8RQG}_bt>gi^9Zcaz9}Aa}1Y6U=xG2e%?hv
zB<^dQDm_;V`__D3W=G9+ugSnBv`#V%=Q4l-@u;!iImmMs?Znf}_&fTjWa-orpuEIa
zNE^zn#$>FSp?SO5bvEhgG<rMmBS?VB8#i3rBZ<)<a>ahh-X;-|^m~BHxPDBj??Ufc
zRaM66{x_Wz#0lqPPvTuvOJ2lEosHXH?H!T<o9?<dRrIy6%!KXFI2+T~LNN=@fd1M(
zB$rdeI9CB23E?@;<elxGAX+<}KP1S$P#~Jz1k9WU$^aJ%1APwC+pu-Uo=5*qOeCY-
zbBgD%K#<j3&yW2(3<P8<V`LZmizAe6CcU7mJ{>K20hj@B1+qQK##t^A?v+Kf%K=*+
z*`vnDgq@a%d+jOn(^VdepzutttE)q_d$aH!l-oaZOA&i;BXvVLaLy{3B&M1JpIydk
z2~T|NH!8?}8Ag!b$b?=4wppfsOCvU%_CvfuX0^#Dz3j{vWQEDO;?}8$paaDg%{!>7
zUku4cSIVZKTr-!R1DBv<Yn$Kw3f2zkK+>*W)c@s;%vCYATz~MNGA^j?X_)m*p2w{M
z(ci(;pyT5eU>B7F<1$Xuap3P8pg}Wq&guf%Ng9d!G;}D>-hd|<Tp@k@<t+_p?nbFg
z^2+GjC-cf=n{EZ$q)1Hfcd&%!+b5krNO}FbqjSyq!&D*A`jCM)GP%B<a78UliU&Oz
zpb9{ZJmQptT^iUSWqH9n3TVpm8!_e72kno3+m+eK9F1vI2~-!JKv6S+5(NJ9J3OHk
zZ*5qe+&2{<R}y<SU0gyMv(u^U8|Zrq%07nluOO0dL4D$S39JjYowL6X_Xm^om;c;j
zuG_+}8?psl`4Du<txo7osk0fMGet<2_w%cs$vpf0Z7g#DH3Y;kSeG~e$6`ZldR`Rx
zZSxlERF{T_ho5Rx{~cF=roLCg4?=deGS+7fLGf0v(dbVo-aG)+ml<^d7R&gS9K@%_
zJ}UGJcxVCAL=VR6rp2~k_2U7Xd(P}BK~YSh-s50Mnuj*X&#DT?>UG{QXnFBD>0)l#
zLlWXhGei!Sz3wv9E)Q?-OifQo{hR=gVGSw@vX*b$l12W^+cLTJt3)imE&AV59g5gt
zP1>>@*A5ew59d2UvTvLti)0ed3tzkJy>NT0)vWGC;B;7^Of87_!B~;AW|cWK2?ZlS
zOiA)u_-X+h3{Ucr)Yr|c0Q)S_ybt)mLN7r(dg$wb$o=<vzTy{##pvWm=~N0<NrgnW
z4G-4fM{eAS3*(F$ul8q^7M~$0{K)*qiP^}oM^$|b73~5FW!>sNpuRw3so5?8fLLDS
z`M0*Aq52wnGR_}XgQ~a=j}kGEQ1$xMcnP`-Or73wpA%u0qCe;1-ej){3U{sf#id%t
z5oq^^uzQZ<`~aS1*&FOJvZ(@I1EVfrj76a%R;G{Y`RKKqeoHPWsiWsCRxj4Ag0EYK
z3j;pDGO_(u@Z*tG17uW+u25=BiXD2lGtl?GZ{OClHMPvK7$kw}+pQWcD-i$d0Wni%
zcMJUUsEnQ;$Jmnd*cqk2a8O`tAw@oxIjbrn_u7~?pyIQXX5jZ%HiGV>R3{(j5dJ!X
zTTvzcJ#<kgJJlHJRxM8!axOg1tzW8!V8FJ?0T$UVK#%)I`3?wYfI=`>gB-u>ZM((J
zPqeRN_vZ*0)#ZR|e>LPWY)g=z?NkW~Vg}*>w;7NQ*FZ<zI!^JN>pO{?gA<I0X;EI-
zW_JW3Ub%!b*1^@-tMoZn=e@{Ub6m^h-HC<AbhWmB{oXcfI2IT2&)2&2Uu=28QT`o8
zL2hFiowiI2ni2^ThT7n#Q3E<!u+IgK35dSf`GO3~NW@%|v%M-RJJDRwF1~QNp_8b5
z7dTBng{|l^$h-@R<zF90SeLso_C1z5l8LLqSm@&_?RVL1U~2JZ61pbC8XvE?s&FQ^
zXwr;%=W}CYFjYzP*fCd7I{>I&vEI2mXC1k+iTgX)5USbyFeGL5Cj4p_MO&4l$rft2
z?9V6-^HmY#B{syaNBDhW{K2m@_{bzl(GBkP_TGKfyS`pLgkRq*`xd9Z1;>NI@Fhc|
z4_A9VVdCLNQNfy!0-MZli7v&cjb?3iM~o=M+MWRt+br8w&S7!64aD-JE^0<uj}!y%
z7yKAkAiG+mlrWy)voi+1lxVCwzq<nM(m8ty-vRu(3y+G4;nY|TbD%jq!R3If0Xgim
zU{C0UZuo?xUb;Gt!Fwop{^%YV83`p&zJcml!ECM+s1yDK_2}}fhQZUcRo7K{%FX`#
zdxcX1aKDV%=kFbrB-H1459(609;!qMrKj?`$F<*ZP=DtWCC-&urONqAY0bOW{sl5m
z+X}xJEO)b&Zj?gt<)KZ-!~5<C2?=2Y(fKvnkq|c`LWz9aM0X(f;9M-6@WQOO6W<y{
zDsnOvCd($YP*UF{htGZN??4^-6O5^oRXoWT)YWnDr%X>X!643zabwwa5Zoj&H!$*d
zc6UFwX|7OTIBN(pn6mq9p)gs2tYsi)3L$V7MF>IJZTPFH4#Lt~31uN$d|`pQUD@&o
z!AR0orSWda$V^~fsj&a1w3j=@^&z{*EQ)--bG{B2uR_DGGpH=h#<gDNxC&;wKh^WM
zm~VrrUDxf%0$7A4s`*^NFk&=si^P4gAZ4R5+VB-4SVx>`p^#@B_btAHz0mPY<}3&3
z#`^lI00OI`hy>Dqp!lc%Vant(i{%g8Mc>SQ=#C2u6tVr2`LJMYT%qR2SCE^)sl8hr
zK!RVv@qAA+^y~~drw3VGR)s1({oU+o&O+Vx!aB0o_w$u2kztQr>wJpi2=PPhmHDRE
z_x=lX{QBWX&mV?APy}(Qp_F4%&S7dLj>%x`(zesO<|5WY!o*D(wAa%s=1o!vppzA4
z`HKQR<f_D(`yvt&BZ|t(w9AHW;$mV$=g*%nQ!;cD6%nDQw452Fy7V84+`n(1*E$eY
zVn3|ZPI`!YVQXpNo$<de?vg47d_Ea0A1jYTeAV8I3!RshrbRpqM8+zcJc0W~TwCis
z3uIF9l*ijD=8?&|=Tit8N5922%FW`x`p-4LBeqOb#GI?m;4||+P;71{95*vuSGY8O
z(%V%fdnNbAnVWvefyD?ipaY+`st1tDEC|#SqfQ~L9)l#B!9Y*z@^42B3W^eP0E?Fl
zQd?i%XL?ZW-t8+0jcw^;>$mi<*5?^>W%FhfJrhVqnZ5Dy*F<o;?j37ujdvPqvrp|s
zrZO*7UW0QS7Pz=9d4f16P=9)!rauLpA;0SrIlCewqsr5@OVRDk#rfOEhW4Z>o;&xP
zSpi^5(_~feV&j6-^=v?7yTk!-1)RLRXbAetqDy)_PC&xruAwY5kqLov6$!JQtGd+#
zKiRuuPS4GDU_7bUsz(RCsq5I*Ice6fz0>FPf6g6MIRfEjC!2km%VLdr%;@g&XF?Z0
zDrHZ`l&7D7+}AmNEQAmRh9T)M!47?q+%;YexEW2W;C1-!f>{lp1>_ZaJMh{l8g0)p
zNSYmR1CZR8E8r)lVK;vDktG+3bA9gP((>jkXl+%obL0W#&@nuNHq<Wj>%m$&_8$+U
zSk0in;vluq$zn~t_OA@fTReAQ6|#FTY3)hogiUrtg#z_?Rc@}HR*FiaCX`#(rR3$U
zHn4c?8$^PArEg0=U1~mo#5e}TGEwPZwy^%AQ)z&zbD-pW)~Yt_F}XMX*SB91OaEWU
zdeC7LhLryCw1DmP!Fr4LAQ`;zJwTiCycUP8lYuVB_<`QI({IWuDv63>`wQo)j7RVN
z^WqJhhXg7fQ}Oul9e8#=2Fbhb1*}Xj2MeKZsS|d|PVH2G{8P_gcR1k`x8|?k0JKKY
zpnISm<rPA3<&YoHd@|aa*!^BhqgqLzWi62U6vG<14Cnbh<gwI}P`9P{+w?M~A%c7y
z@X@C30|H7v+H~h%K(_*oyZP^@0+WtlWx>~_nk2Kae6M+WZ=O;DVhxn;isC$Fd~hD(
zPK{JFmABiUC!lJt1^`oNB~jT9a;rctDZ?_ci6JE|da5e^`mj17o}hm}wZ;jJxp&$2
zO&L8Z4{F4GKr%D~OKxcuO8;zRx$9upD;3XH#P)<EbSpNj)RBJm0(1ui07rojjn`$I
z(P&}bYCCKq$O*ayqt!$Id)&Be?zS?10Kha@6YQb-*2N}g0XOIxn%g)J*luKqM7K*r
z0^hf^U}jnn>>qS$K~#VgONdE>@&dzFTs`FzgFr3%`0tPS&q?h7oX*)C^c?u`D7}?t
zpLZ$hesnt!%G&$+VkC*=)<xN8;9?=JytQ@U{p2~1PnYywl^^@3bWHe-ttbD_#{}s=
z*1jlf`8Z$1sL)6^<>g4ZTWYX2dG*cMi1K3PlsINRzZFovmg5r4z;oq%2z2+(Hoyq4
z<ozTYwUg_ro3noRmm5w{8`mDme?F7zj7mvGW`hC4SB_f?x)aMFTPJ|}fbCQmM0yY1
z8%_^x_IP!5`@N(f3)S$!iqO3F@4IkY`M<8T;x4S$o4l~eJKuDv#ASV9h+#2j4w`C9
zqoW(0{yY(58$f@6?*|y=zyHsFPG_Ey_Y|Ge$(Dq8sfaKse5D4KY?8Pt5;tdG%`|te
zoO~&kYrc>3cN-k@|HsT6?dqXT5KChf-X>1IP{)au6z{kuoBgyvbxI?4d=9)0C2DZ~
zMNr$||LE^r3DL!8qeAe+S)?F69LG3I!qun^Wvy5@nacNThlIBN^A2$S73W}wdr;>P
zCTf^-ww^`$l#PF@mw*27|NZ)Z>lJu#a%-_ArlE8ouX2*}9k1)&(ka%y6a0SwSkIBe

diff --git a/frontend/editor/src/core/assets/login/Firstpage.png b/frontend/editor/src/core/assets/login/Firstpage.png
deleted file mode 100644
index f12133f4f70b11f534d26eab1b50a886acea02b4..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 215942
zcmX_o1yq#X_chJXA*CWP!_bl{Aw7hYASFslNOz~y&`5_!BOxHA0z*o7BO#q5NSBBT
ze0O|*-`}-dE?x34&%NjDv(G;J5cNd;5gG9<Vk|5yGG!%sEi5cN6!@J6Aprlvg-c5b
z{vdKzdhUjWMREi48yo9w76bT4Y&We(2&~Ex#%=HyJS*A9vRGI(@g#pu@v(4KZ!62o
z>Ud-CUXr-8O$B_9Ie4h`1zua|sL#3ISF>=x%f{!{t}wZ`PY6q(keBS6mFv8p@X*H`
zo&>${AoB>9EQZ>S56G1lZNjk)p1TD18U$h3{PyhT`$5m{VgI$h-S@tVKW*Oi?i`ht
z*Uq@_PFCZerrN-%KPf+yz6Zpq2T0qcmZ|Gz`<ANjnFO34ta2eBTsW-<e!gGJA_jL+
z+KDKk{0LLhobN4#5Ge91W8>l@gXM}@bZ>Uv@Jy#_<DwptQj6;s9t>&mnzn`}mR^$g
zlj-bI!Bb>~qk_`IPG5$xPPyN$H>=Md>(9UY{wJCep)>{EYZVX^`!+W*(IK2`VfL)3
z{=!V;_x@)XGJ#q)IEL~gUtI8xACHlnfR5*TT2m6aa+pN`!Rev6ZTBZ00cV%M@f9{?
z!T{^&dUbV?jdGDzJv%i~-38nL{GWN>Us2-8dy>$?lqW0TQ*}LXHVXCf@o8vkZM{;B
zh7!T0fA8iM7#CXqrA8=SxQKt!`7MsqT-*9#7M(0H)?sa8WMq`Pe&O`OKm)>sPlJL$
zZ$@pkhvmD*?6<c(qS9jM8}<kjcIN2XqOFNh<cA`42zo<Fm`!op%wrs+xKgksn;%gm
z4-mg6HGm^iLXa>dC83?YcYcoH%j9sa1z7hQOj6=xGWW_o;*yb;S`Gp&M6NXKkPG(~
z*Wl80^J+;no&`JzVsu>kcK1{^bM$8}rPf_eXDS3vM*-c|&d$BjsG_1GM+Lcbn)DdY
zgQZKGfcXAF9ercITg~7u^a~`c4%HO7ak_<bX{Z9Kj8Fl8e)^F!OYMe5)83p#-#|oT
zGsBSy0!i{qv8G{aYHH05MMax|oakkiqE*)4VL$G*w6v`8TKA9|u^<yBsE%SE<bFq^
zmzq6xp4MFy!V9%ZrJL8|#P^ehm%}jU{A8<L0V0T6GN3NbJM#7QrEcu4&>J6PD|&a{
zau9Gp-mpCzqY8l*bq9<*ghmw)FMqbVG4HP>L><+&$NYDN(5p?Ga=7)*#KSrW6mEif
zQ_`f}$;Q}BX#uI$!!Uk#Tl0;}=!A*!My~_o4c{YsRDtY-`xqt!CW5VaJ9<v@#?UiU
zQ#HdJMTKW%PTrlvxVX4PkTP{yToBC+#D>TO=T_E8(w?oLqw%j_-D6;dU0-KruG`OB
z&s(xXLqppGtOvaX4TC8W(earlW3l6Cr{&g5PX(o@@jE3V(!W+hD?m`JHM~>=;Y*CP
z6@zxI=xAsO>yYB0(p8FHy_arPrqVKF=imt3(+fP)Bdlydzb#D8?36ZejsgLnk7BwP
zcb-<#9o`uDyCl#z6~qZ)iF)?$TDK7~D;W*;%O^cP=rtH}gG3U<n+@~@glcDdTd+a&
z)z444Ew97*xai5q$gVwKy;=&T557^hRZ{?iB55d;y&|P4>kfyelA{8DMFhUc)EMab
zxi^1ZL8tpTqAW89t9qCNJQSY~VHT&Y(0}>^Mo1VmUgIz?e5<k0{_E7#<-pJoDZ*UR
zKyl&SIUN+4f|q<kX}ao-E*PH4Cbd6N{+1wo-4=|CmWow*r~!dCAV7MWQ64yZJKd3f
zC4v3Ue6sj4Jr`mCPl7N!BH~8fqx1pr7@7>uQ3hTC&d(PH^^Pr1sI=G%ha<jw1_plN
za&0pN_kqZ7Q&5Vn@u`2B<g&%|DU^_c{e^{^x;py{_pNW@G|-ob<xt)x&%LtAbCYbk
z25MoQr{gg(;C><^4Jm1QdU~4QJ&I>XqtQR8qvT6qg=#2=)+_5de{UB-UTkO~C5R$w
za~4OjaL0rbYagGRlODc4<*>q7cyfPNUmv7{b|{8^fAGova|8s654#XPa}ypPA5U!i
zq(`M?+0)zmII~K;ws6?0gbrHBGW!NRtV7b`aA~f|%gM~eMX<)aH%^{AwIEe?AiDKC
zwS$90)X2z4*XikJ4zX23!8CB^SCK(jve@RI&-ASiIb9Q7CnqM%h#6Vr>2k9L6cCX9
z7+(cQ6ff*n+pK~HA9aAbx_U=U`2K1kj77rp`$#s?j>7xKrY21zE``u^5Oj}-2VU4G
z`(>)*^WOgo&O7$=MQ3Lx6F~rf!QP|LgC?8%AbAXCwdItCYG8VYH#=~AT~?Ll5@U3N
z8nsK*eGWN;R%330%$Aa)1Bm0Dr@gZ^{;urZJJvp*F5z4qEOWd4rIy?0IsLdXhtIna
z_mBw^;Eo_fV?C7-hw?~n>(EeWbm8uOVPRj$^Jn_{#B&^(?oX*ef{`9AeS9;5N2;x@
zjR}}>ht};U3L9-pEq<%D72tdQy9~DvBq%}KS{Ew#+laOz2-m&7PC+p-8wsM7$D#rP
zd7!q?P;3jxm>t~UP-hU&D=m!zIU;U-;&S~uF3wj@PR_<bs`CaB^rEdNmXbP!c=_YY
z7>d!1>FKAe?jUnhGQ-0Ooc{dWQ}VX&c$vtmNIiT5^U)#+CQ56otAny0$v(sZ=(UhH
zTz{TD^X*&df^hCRD-_QB4_ROA+UBc1R#Ow8CoF|8jbw`tUq&zrVz9qZG|wSjotF#U
z{@0+87_u*2;`<SlDMQTJ2&!pl5cW8_x!tQE)}n$Le>@aI1KdL<bU5c$IdZ=79(%F@
z+qCrboL=y2)K-lm`_V?JfKVC%bqS7^CnAKHCNx8$6OO69X;@YTUAwG<2PxPT*^!h<
ztilrGkpxO;NePJ$kWvA~XQ@B>-w29|_9Z+=C@o>?8eZG%Vy#`epzy8Rx4*e54vZ`;
zEO5Vj8f(<OWC&gy;?o*V;=QHL8%<QWYd>H2I9tq3ac{P!lSTr7Iwt!dL^2^7!ID;m
z)Yj%R3tlA}x#Z}x^Ycu>17+~_w{l#MnI7D~&xsfydszGS?c1T#{l%u?XLJ4_bR+%?
zT?SOX35fiwuU}IHJ)ak3q}+Dc{cW~OEGa2jR#i2+v$yvcun8!>+e#bugNF~x6crU`
zU1YeGov+(N?Rw+xG&2)H@ntChHpN1o>B}6x*zE`<DbRCs`}ABr{-%~AWhIt93c*rs
z>q0V#`M-sbJOuA7c<H&;fTl+jd|E_>!-Q+?Vd}h|)zpaNFdTYl*TIh;#H3M2M=rz$
zh1?)?MMOodJ80j$$N|vNx!M_#Xt7jPRVCse-HoRuJF(wVVNm~ev|8@l{td)&Ff<xT
zX)e3PWXLSpxHW8KXjoWtdu{u>u};`nt6j<5vPUp%hk9crNy6}bK_tCUE0PMKw7TN+
zdm~xHcW`hpI7C2Pyc|-BRjzZ_)0PTB91K1YUQea6@cj7r>g(9pU(^LkBd+I{6y=B@
zlm|V2rM&=*4nafJ7$mr_v6yLxpy6@_kGzr*4QdM`=UqhKu5thoqXqTX(X@APco04P
z_iu9qW%ncIfUkE8#}pv_w4k<8uCNl$^e1y%8Z~+Pm>p7UVM{PHVd2mtXiRtC;?vZF
z7-kvM!y3neMuRl6WO`VemYz-vrEQZly=k-Tk$LcLQG^7;3yy=tP>?9GiOd+v?$uRO
z^CxYyFP->GY363n3PtFZ`km3?tjL5ALFh6luZOe3Hbhu*G|FL0H)<Li8zr{Cg0%3@
zBcz8466Tu(1Oza}8tJ}cWM<N|;<j%#zpi5R)1^iHsdUr%)A0ShzNMq%$P7+8zhwQ~
ztS-n~ZPX(NHh_!Ji_o<@OcE&fk~AWU%(ria_M{~(KU!H@KCRzzvpJcYw`~gGd%&Td
zC168@mua1I4u`@y{-J%Bw~Q0t*6yy(+{%Lsln&YWc`4!4)~vFwa@@7I{G#VCV_nG1
zxuHY2Xz&w!h@tSf1ep<tbV?m{#S*&ax(dQ{iYf=+e#_C5WgmsbOBr9skwEWLY=vmT
zZeE0vlz@C<0t4>4EUEs+N(c(yyuP8~n^h#NlqM;Zq%D*L8r^rhGo2qikkQ@tv4%!w
zhfq>l5I{^Vl!Mg6T9!7mw+>SO!40*!;X1Y$>Y=#!B?#0&TU!+>EvQ<@bNY>SnM%>8
z+Ta}5f`pmPYj9^v6}a){{5AIF+-;#q0Jcgw80_eIcJ5^2>n2E{OCx9rZV2yv*83y%
zTq%cRmpqXfWuYnznv&1`{r%f_vQ$Cirk2f%cmVG6YVU^Yv-RyyiJ)R~!7&L8=C9}4
zs*Q||$*Fxmilpn{z%yo8nWHRCcMC-5nGF9$j)48rV+rlYP4U7eHywfzIHe5jEfMOx
zEDlm(dYD7$mw*aB>S&E)l8lC*T=n%uM)))KTO<+ibBRxf@=R2}jKuI10%T}wtJL+c
zqji<~^WyAB`XQoTw)wEN_*X(nlU{KY*Y1lRiYC&fioI?;&TdPY4|UAV|6b7_&d~vM
zfN<e~DDPsl+kIR3>HYh!)6?kq*RR`WD{ekmt?aBX4tRB_^rbY220h`mugBb&|0p%{
zw&QP$jlUFk8r6+_kHXr&7xy@Dvwt||JS>FaD1aySll(C}TNvoSckf>DaJ-#<NN=vM
zqU6MN3ROe&Fl&5(oTTJo!9c30u3AoJruO5<k9+Jg0f1m*cvP%`f@TFODpNl9aHXtB
z{$$VLdtt!HSMj+*zv|ANr%65B;yJE)uZ`eYXXBY9PJA0HbM;QlbmQ+5Koysn^K++h
z_wxF~p^+2o!7$5uxhx=88*Gk<n6A|`%D27q`9w>BYEKHu*Wc7X2C!aA03=kGGeA)D
zjkx%D9t3xou;*)85>~xq7m$&de8FwUTBDOd5fBjIn381cyQ~il8R|wG;KVtwvm1N7
z&${a)65J}iUGW&we;Y%Eu{Kr^k+9+niyWO>%0lr;t7<}k*eSH9Q+A8er-@x9pSfA<
zQbU}jZ;kNsKdS&&ojmkEbWFfvXu8j-R3wWE@pe{5;rP1!11!_L*V5jHc@f`j0|HvU
zR9Caa%>Ja$h=29#(y}k@dVM8AcR_}nul=#=i+O+H-^hflf8{5rCT3|tf8dLPFx~X*
z1Acw#%AllGK(pUGGRF`eJkw=!bMvdQu>>C5qYIS*a`}qJ#)p$NY&JweQ+2ZduwBCe
zzQW0rg}yX5f9QL@|7vBm@8Z4t275^0syKi7_cKa#^GMt?cq}hLl0|Dxji7+NpP!%2
z259@JWFQQ#&QRWV0I2m^d1*u~%H4-66|X%pT(=dT!GVD?z)+iy;H$gi?;btwclLEw
zNG|<)p1PP`NMzWTK~=kNJp;N!R|^Y^E;}2W#Q5TY642^tQ68>@L<&eq>_QLFfDbN@
zjkSH}DTP>#WF0}B8w3D5g`2#w$Vu=v*J8{Q(K~<JPm19!_uZ8hs@Xax5j4C^<=mLU
zqLg$I7Z=xNmzkh~bHMxgqVdzz{nMul1swqQZ~n`ONP?~5se-gBKev}TqukMjh&Nfc
zlPs8&P&j^Wpj<k$IOl8ISy;fm-ve^W4J!Guqws?VMZ=TlC8Oj3(^@e^f&tgd*LQBR
zr6C8&IWfzYiqpgA>xK`{D5(KGTiA_}TDIJ80EXoC*DJ*hq0T;<gMet>#vra6WloTw
z1ZpgE5Y#B;u}nKT8c8Hio`q;N0lyK3I$?qO+}FhQ-`9^-cG?*Lf^PrGJccrf0&uG+
z!8+HZ3_6NRfP&$iNzs_LgrNzddHN54X1Sw3dt!<{3e*|UE)pep-C*Gj-dLomawukF
zL2lsw>uTT`z3!N(vzy^lP{KdzxDZVUjgf2s7s0Sr5yoh^^)-Yros!%LUP!G3$o&7B
zAyQI(5c;EA!(oK!w>xB%#A=|?vI=ZLONLK%0Q`1PQmK}4{t%Y7-T{?oc0V~9yGa{C
zGhV82@V{e&FL|5EGfMh?-B`D_vpe~gtjZlmrg@)V-%*O3#H0<pyo~(HkF6~MbDA_8
zdwYu}jREq9wJGDqk|xXX?UIordcKaBqyiBv*z<Vp+v4ILKR>@8h<G(oRc;k+?PNjM
z)%Hy!&*3Jf>*)i?dQ(J1WYR5D2d}>!ziLm1ds8`+;!lb($moBe8Y>&0!9dy98!YJN
zoXFjd<gs6DoH{r-5HU77y$kyN4w({w5+7!Sb4v>go>A~6TQKDf_r6&&0ACOCQE7;Z
z6<j^Y)3#`p!jP5XQ#QhMeX9B`QyD<vLezOV2-9zBJbrxiO@+HB<DL~xzQ?Oq#>CLW
z95`|VA6!M`Do7n0U7BrPIqpdQmWDQE46I;|f%<J`=0y-2EjBcIb)et+1SFx41|Vz&
z##D$%{UgjV9Wqkz5w8^PB0FgT)ex`%oj7r))FVlE+o<otNkfx%nL3mjWt?WS^-j4M
znz2f97t|dIb3+O~cothB_12Q1#yQ$oNt8znC9oXM$&CR<b2*xT?XMjYfc9(6s`Cb#
znRTRh2wh%Y?v8;@n+)@r55jps?Y<DTw6ZE?Pl$F#58b>MUQ=$;5u0kq^XeG9TLMl3
z`~)jo-}+=#vh%y0W7f>Kn*E2;x0p079PDWoG@9!O2?+&{zhU^(KL+|qF2VV!+`AB+
z*y7@17Q*xtQo?@#8@9@xVPb4-9HsXa(E*z7+^XlU0i#nt=E^Idd9`rl`1X*({l?Je
zr>9E2bby2ZYZH)fobhAD#l=&RoI=cmr7S(~6(S4vhK(}%F)Y9THWeugKrw8Y%=ioY
zlTYS>GZ%_018JkoK58vOzsg`Y1$C44hEKr>AQPGao<RgLA?qc9f|Nqs+}s4LCu8*&
z-|fsZ8tx8*wgo4+4P*>Nv+MizwoRa?=hMVm8|ib#sXvcI$_y_)eer$ry7iS-;?%6L
ziSp88P?%|+YQo{@Stg+y#gWKQCnqP0N_jP^+(@dL7rVqjSIHSAJpq|`e}OwXh{@0n
z*JY=2$w1efX=Zz9D66sJ!1%1K<Vv*aU`9xoQ16x!CSWcQn1+B9d6(1?6(VB}SP5t<
zl!W3L4Yf3tU!ZV625bDf`2!$;o!g&YM;%ap-}~RZBVOt#?q3Bf7s%G1K(q47YG_b2
zlS=wJ{9lee@ElJT7ZNfn<AfQ?Qfb|62DkJ1=0v6{rq~?!4!4I1n<Nc^0O#^`utLj4
zR1TKeuKDJbt$k<qRZG0z!9_HLs;^J?<b=Zc|AAk^ywX@p1N$|VpPMpUFkw1NO9OaE
z(7Q={htCNwhtAaPe<jW-J)MhVpO23EcHAYBqZxl1D3=)YIgW=e4X`5Oe{_OOQ!R65
zdb$`=N&~K>thAJCcm<#mp=$cSr-{T7rrZ2V^wO5cizX^>I9(%gD|_>XmlBo3<Sk1T
zs;tVQj9&bV2fpurkXk7lvt)?miGBTAQ=WyklRb-UUzMThaK$Xi2V7We>MNXOBxj@j
za%=V-2sA<G%3P#HBQ=^3yyP7~)h+P*+c!J>lK%hGro9g}i_~wUT5ngj`7;(G0Og2h
z>jbF$OJ)U;X<}kR(LU(yQZp>A3Z=dA2|tzgkJMS-t$@qIXfeeu*Y3MJ7y;m4k4<g<
z0lbvC8K^bSZoGew_a;76Ckb@#_omm%`IXT(5kLp+#t(bh_Z&2|u_#@o?k;=Tm)+8T
z$_b~`V!OK=8X9z=9~T!FjlG$mNQ-}x7P)UfoS9H1ymMATfepcpf9%p$t$;%4>7{d=
zb3idHTD<}^GLxnF2RA)!D-K(8$_HSMM8zN15`R5?DzA@I?<$luR9{=0@kBqI6ChGP
zKqRwxI?7lo>|l}}K6yR^hp3K_mmsYYPcjkw_yV!-rX>#^OIP*%-dbAFCE(rHNFj}A
zAFRd)$w<M`-@Gl+_SxH6bA|gA`1n4)E8QQXZFR#rQj-&{K?h2V0SLj~XacFEp?IKb
z2zX{@X6g!MSR7<@8nrO@+qUpD@eAViQ!Hlg#PoqwRFc?1@^E6X%rtqZlV{r7@trn_
zv0>xzd3t)f?t-j`9BJyD7h@u&!soL?bkahm^}%z4aBz8~ATN7RJ)MBMq{1^IuqE!@
zlY0=Ha>rqpU{XtyXqA{j+Zm%%B*fvAX2seRvPBvsT}V3lzU!~o9R?5wn5c;SIPYCK
z7f`GDF|}GGXSf}o|K?;SiJ&RCLn{<cDIRDHKi8-Z0<}v8kDJ5%gLti)K909TZ^f{a
z?LzUA*P?EjzAVbZ-2aLL{Yt(hjn4Sn)eQu32sni<h9=NN%9dI(G~K<aUKR}cZ~|Q#
zB22F!VGi0!d3k|#6kS@w&mTOo2|AD4%6CCZmN%|*(@xuoQ`Vxtf8Q>B3}g;8hQXMh
zgU;f|Mt^d<gs*d=N-*+MUoZBH-JhqYn6nEr?QDj!7e+z0zDC=T^Ffpk8h*QK4-3#6
z-~7AU=<{jGZHiXx`-c28vsj6GwMdv~!0*oyHaeOM|Eo2a;uxEV`~=aKmm-H})^27<
zV!lhLKO<0@Z>x<unwWr+`X2OL8)Ucq7j0Ic2gS)2Qq#uslqo+CnpjE>Vq0I?E_(dz
zVu^T~cnBKXTs3yw)l_9PP_r;{>e|}t*ROr%>z(3@2<cTk%-_?MNn$%j9VR-{!R#JA
zil{Q_XqNQ*`6k*#e?<!k&<ZzOpP}6@Gk>}8mdunze^Z0aWN}KX$gqFuAtv1(y$J;m
zW$l;nb;G6}nQqjq(e%{~taK=e=0OoYQdE>s79GsNh(x6BjL6&~>ywh=;y34!I?*f^
z!l^1@k|=Kz>i@{KVDF~~om2(yk9vE1bt^z)R%WtdD}A2zEL<c{gkB7V#m(J7Wc4i*
zFvSb=+<dfH^gusEqpKN>wv;jed{zwgcd|qy^D|yw`%BAeZ4gTwm{<}MfUUISKYaL5
zVm`CnHsjKW{=HpQBSQDyj0t@_v5M*En%k%7j#+$amCk=+7Q+c+c215W14>yn$cl$#
zFhM0$owxmG3n20%|N5iqfIpts;Qo6;Nr<eH`z;=O<>tFiNZ;{$@O?me6RS7PZnH=q
zM+}9xJ^Zo*NWNU;TVFpK&lC9eqDPvR8ce*>7W0+b@r>tXT%9xUoB4^LJ~9}cTgGYs
z@UZ%5MgQ5eL)%4z;!>B)#_LLrH$uxA(&q&joGZHzQT;ncHdCs~-}<DRR#`MAX;n#R
zd1+~%wZB=|x2RbX;1Etw+ZoV^%0NHf@6tEWFBUQo^ZL}6hXJGT?A;OfWT<k8U9H`#
zI<@wpY4}fMPk3X#*rqA8FcX5~$|SoR{aO~=iHj5?qP&i)F!|Y}v+JWB@i3mPn~j+;
z)-c(kwWz2&wC2y&yZDJdkl8S3*h{QAe?Y5=&E~v_G<UbRpKI1_)q*Av7o!>JXr6jF
zId+g~emIjbGzDQQlQ<B%v`}2k{;sjEzTWSU-JNc74)dTO_zB3=;^?)twE}%(<EKa+
z>Z27Lj5vS^-UNowYCMrd4sPz++S&_1U!z+Z3K1;K5k!wcb;NXUPJV7|{Sp<%;M6G#
z*`BCF7=UQR7BnNQb)(N}W6|B!>0=9+QIKMa;ZQUo>fr3`EMqh~JDaj0b{wOo33%@O
z`0=&)ab~P(4DyqfLLv~?O#zpeK-uf#00Kgb?;|1@J|iqae7-ktg`QV`77aLYmJ%mI
z$=>Bg|GQ|I1nPz1eL$Y`SZHObN6c=m6618xT5o~yxdIgU6OA%@wVh2FePj>vuavU5
zMH(Q$tvh$f=DbB3gD4TM|5!SKVg&=0fahvE{#sgKj1E0S6Inx&fDwN3rg{9pvq}?%
znU&GwrEFuNF**>F`irvK+Np&%5RJka;r~Q%#1^ew8G(Vqc(VK_gF5>o(_J9DV3=+(
z+Y_V?6;Dy~S<5zfqyJ;%RSb)nw~^d=(J*K#;@HLA-5t-#3}8DbZ7x6(kT8GzN2AI?
zOZJJ_^Qf7+R{qE08f<9*umRyz8gh{^A3{Qmhk9kXhe7*L@3AwzLh!QV+m9Y1sKdBi
zJ=4RpLw3o}+|+un3L?@^1wKTi7gZAl_NEg0h!mN}BoK!T^jpFbm40#hzOby6xJv^7
z?jL1|Yj(&JIS1)x>+jE~jLra+JX&T9f$9La&A&?Q&sE7JU+CNu$<-oD@g@Ih7cZiN
zlq0#nYWt|=_p6Jjzd2mqsT5TCi5AB77daJKq&0(+*SA6QCh#SokWHybYwK&$cbs{D
zgpx7P+$harjj(lTOz|c$r)oY1GsJFbpsvh&!&6z%7gJNwfeu42mObh{bB-@SDF{uL
z22R#*9mSs=+5{}Sn-%||R*ipsj7`A@W_sF6EU9Kdc8q0{r(!Zpvd9U034$1t=xa8?
zgK`Q*o0~5wm<$Cxx7!uCBRN_c_9bpLrM90{Cni|>PxHgFeUER}!t4b}6E|?=$F0s<
zJT$kw_8MT^Tzrn38^OWY8gu@j9;J5Br74GE&^-+EY@DG%JJ6t3ZE?wQ4}r#MNYZ<)
zD~g4gFfU!!hbq6FjLj{r#b;-_g0jAm7J4yW8ga0*O5j(Ok>S{_Lu}MdIP;tY!p<A)
za6;zanxujSI-ZR5fquZQEr$mB{|gmJqCX=$eQ%{v6TDyIwUHLp=Nh~H_QfVIKLO91
zl~0~`%oxSQIX&gcG02Wi=(zZ(-@nWbt@7+zFzi-*H3&2pB>^WiRGvx<Woc>o%b)Ef
z$8LMk!Q*?D<b40B1b|HNSAyOW`AO(YetvKd&>T?*IPa#>E63k54U9Vq()@F>vKDGU
zj9uq*Iwr2Uj!sNWC;$~W@%#=Kxnrc6msfo}rGj|84Uy6m7B-#v)fK3I;CvDo)_=wU
zz4W#m!qu4z!5zxa)~S&tYDzr<%TjE9NW&#|thE{$jV@wXlhf9oETIJha({ghhq=>p
z=8L{Z`g;NCbhifS7uTTqc@yZ9xg_Fb&+B$O0}3Yb+W#Pm(k#IlKUf!lPJ%xpA87w*
z>IPzYTz70{iI<o!$C-^%l;Dm}kSXEnm-Aon6*N9@q;ndbqB*f0Ge_Ykpv0D>Aptp5
zYW>QCP+Djol$(pejWr7ANl;<A5Pc%#f4;wHd5g&~+BEtlZb-;ZcNk;9mgdZLrUnl}
zC6exm)79|u-{H}#HU6tLuA}=O&tZYr3V2_vVi(~jNFAKT(oJz6kzt9A#gt`fOoo90
zaFp0;IsrV(!O;<*Eisa_uC6Y8+0te&4V!~e4G-Vx#S0df>&x>m&jVZ4sI>I;&v(C_
zT<!1gceRHS-cVQP3!kK=^6pkKy;%%rN$uMEiUZO7nyt^B6(3KD`1p^5_O#yhJ{-eR
z5{+Rr3{vDTh3{Wl-58me<rQ2l^MKH5^Wdb<0CUEeycXT5<geR(6c2=j*}wSI^O`m3
zVEq)y5gu(AL8ja(WE=Y>?zsy==MNw3?QJ?`Qzp^>6Ly4Y`jIU8BJ``ohZwO@H9T1*
z7-%uWkKxokZM6uJ7LkFVW-M{1_9ZYSyy4;D@udL5g^QYT{Brp-8#L2F$<@!<v-q*<
zhaZvi>8Kaa2$#a=>l{d4jar{1hN}LXLJ@*ogD*w)h7$%4W-rgq_ATAhqAHAD1LIwZ
z2sIQ=o}TG8B!<A7sHao*i#;3+=g<5etsxYYGG@O727YgA3yOL^@g;ClQP!>YoGlmE
z2ZmGUZmV2yu{U3@SDPmwe(&AY%)Qa~fmcWI!`}%OiH?7IwQ9F)RygTebeeN>bcXVz
zs`x-O@s9m~T!<M6Dm4qXG!RlSoyIXsJ6cwo(UuY<gxZ;zAre2r^7EK-h<@XX=9>gb
zO1l5}jsPYEHEYv9FiBq@dwVrdJ=q+jm|FMfuz9H8+ITz58a{jW?8(%?4U@~V-{@qG
zTZx1CCrbg{v_Iy~TlMxHo*OC%-!(?Lx_WtuAl7L?<lxHD5Jibit9CYvl2TCI`x~lr
zt8^*-r%(*N;ZkN%cMPAll>`b**5MgyYsPBUtKA!Gh$(4bHyZMs^5c6mun?f}qen+Z
z%52wTaxXvlt~p%`Q`Wy)9d;5nHh@{Tm+$y3|4xJ5etSqUKT}YbYkCuk{DAQ*L<y>E
zZGX0C9UdOOIzIjgE5yNL>lA<Z@Gl_sDolLvY~8|B7Js6s&3Gosw`2UbJSHb6J)#qY
zKE51G6WR9T&!5kyp&r@!Blwd3D6C$Fh2{r2E`~2Xt<_^h@<N_rg-jD(uTV@Ns8`$1
zTATt6F6SQ1aB7Kfk?Zw0L{UkK{NFs|#t7)C@JkDnl)@ljPP6_dH&>*GFKNV9D>{Xm
ztHzRmSAgC5^6Wa8$*}OlN<HA=H)3L9P=wl`uO#|=bu=+3VR&KQ^5U|+y&Vb9$j!(o
zZM3s-b(H+`AtM}hb|k+4j5Zu%%9D(GaP@oVN2bYj<L~zCtL3u%nsNX0#dH&<j87!6
zThqNlq&+-pBvx+-;{`?Vw9;083Gj1EP<JqT|KY#>_&j_)C_RJmQE`IG27PCpU{7m}
zR9*0T&*vDVy_r~?W|tHe^hsU3M|I#gb~LNkO@w$kzK*7R2_5kuW|9lE;rxG7pvamX
zoe$rtp)UkB;IY^}FJ@Wbw{by-$8R9u4Inf>!Tsm>Bj)aaG9?>l39(QsY<U8n`vUh<
zQfMO$fcYe(`p33aPzgStLUj1d^6~*||6edgq(#W+ree!NLP)(;_4L%m>R5jM9Zqlk
zY%A5p1u^?_CjKQ^%7ny*vSX>@Ji_Ma7OtZEL@!P-86vTXbj2_5=e9=4x7&R;33_^a
zhP*l(IxYMti?PxI(Ieu+bsaC5MmU-&7-I~X8ShO~SxDafa*~`&I_)+}*h`RKajUu@
zEgpVieNZ%9pZ}TW<Nv=_RwhGA@|>>(6I)xHNyEPn=f?OMY+128$$A)NC@deGJxSV?
z?LP#=0g9-2s)AX-y$`;9B8>6pC`_Zd+3!T)q>kh$2-yVeWJ9)qke-W&@+s)MZvX}+
zt6*}pX7REX$3>eul5hsp&#!>xBJ@LSeOgs&<r7p5$gx$rcq7fe{M`BCSgb%9LixG8
zf_LIXRiY=BBb{#Q@aA$bmd79FE7J`jQdpM49g;3~M%+03@5lpFKT*X<!#3K=>HzO&
z4ZU}ltTjVY7$c5;PAn&nNa`&l?O@50^&$`221&nblIe1S`C|qE!}`)<NU$n`1|ulC
z{=@1=D&e7^b71DL>ucBjfc#|gcgPB-Q!}VN44WXGA#e)0L-sV<JT(9IR41t#wUL82
z?3AUr?ai5{!Z?}c>C>;z6jVr>#a4N7UCJveh9~)3mw@_+&!^>idLW6ts!PHTnzQ{!
zxfH<#EZO?+lZb;=-=`s%t|cTG)xJ*<#GKPOciw^~$pTF{)Z<WWVDQge;PnA6l&D}T
zqUwv(Gqh)xEJG6c1MlYwM24FAsfSq|zl9>(kPd@hc)L61B1_ixRO^ehQ0G;D7W;rh
zbf%t9V$}CEKhjy|x(H{*4<|?5lqmS!@s@L79m8-;lGjgxTdA2JbeR0q0-m5b)!_<W
zWve_FSTTI}`IZbnN1Q6@tQjkT-Pa(y5NG_|WisAKlC5EU$0~=wK<O4?l~|ppoiX@b
zctaf|gvU-c3<XL9#9a;xfe>B!k{Eandswhtv{k9Qt%s*)2k-QZ!&Uf~)+8%p7N=Am
zx+o4>fr}PIet5_Z8=Kgtp#IfO@1%wtjf{u5MXaOvy_-x<#U9;?uAOA}jtrQ8wQ<*|
zcie%#3X7M0IJ$7D_a-mtd(;h%*)gDVgaZMui(y+Zv<5VVn9=(cux6=J7jX7#Jf>Ky
zZ>9D2Y&UAn&(F6lgQjXf3&AE1)o$*2B_L`Yt4$;b`Mwl+BPkxYfJ81?CC1MI$`0&N
zYu&>TqoH<%0Wv&3B$u58k{4=0#AN7CP7{vgj3%U)A+NM8&&txs{9ZSov^>zAO{h_(
zLirQzD%*6xUNh?Hr^)2#%KJhi@6(V%UG|=o%Io2#ZRmYXF`pM1Ks5L#^*{+y%pOI;
zNLRErC1k2f7|ba>Sgd8cg7a&i&IWl)C~p=ZjurD}v`CxO=KH&Ur83?W-RFGgD|wjh
z9GCdzV&@C_v6Bphlz;RAQfqpY?W^1fS0+7~eN!YXt9kaVKO-dy%fxn&1TP$8OM369
z5FDcu0t{VUv9Ib@t|kk3@c5#hY;>|{WJ!dhMaZfgbi-IQ(t?D==RMV*RY|_Bbx^Af
zQkOci=&k9T9MpN_p49(6)Q(4o2cr3*yqrWzZYYh>aP7GoXruo}FT+(ko-?!o4#ZE-
z78sSlXeh8-nB^gw$c^}E(ST)6zx1L3Vw7|~P@w}iCHy$*e8$F*7O`}~bnkV5vevVp
zy%&qlZ`y~Muf2^C=_GMPGl)2BrDyoQUY*~A*5g&WGPkpgo@lBd=r#gb*!qJ1#uv!f
z+0P8qMsjBgJLo^i?YC5opvejnAvES=;VUCE)J^?L+AcW@5Epd1KERRntItZ7sqcW%
zLAs2yK%3-b9Nihys4tTVcVOxHwo&M=z$+4wPFV-#mVFDcsuFovBfo$sVV-jnqyKz<
z0Wtg~^%Fmz^rE3GqoF}eBWVaX@*9{ZCdU^~)Pqq8;|svy&0=?Gam~GEZ-s#xT}C5+
zGqsZ8c(gaZgjcSL9q-l=B{hWrgMXiPYQ-uCEgf44K9b=Z`A;ZY-KV|nuHUmvbvx+o
zgz64MR|9#Y<oD~p)~uwPR6ZmHnB9!ENIw*7ni;ucVe&?i+Sri7>w1>F?jQ|H*zh5f
z5Z!}3r;A;D!QO&W32#0PY4JNJD8OmnUKz$Xz`!qKRn?e=YdShQwWH9^2#QP?P4vd=
zop!doVg9G48D=ZKeyXnqI2Sxe_YR|NL!opE6$a`BaqW^%^%l7Cwk-zP7HYIWO&tDP
z+=)-l5T^#|r^if28IB@lrO1Iyu{GR17{-k&VAh@I=4WI&*4XlvLgF~`C=a2|&EUlT
zL6hWehrS|XmjKat=egkDsZa_6Wvj)@7p<Ak=yC;>QduFgYnx%~37ZTXC?Q>?A-Wj|
zot$pj<BoOWnYF(4_)HsF-zI#><9)I9xrV8fYDvaVr?E}C=@!h-_;3n$6gb2>u*%d|
zpH)j$Qn^OcCaIG3RMP3f4kW{QQpgP+PZ_S{=R@It&h!loUW;VI3WxdzEB{Q03ka}4
zqnkNMaK%vmrBCcg2EC^?+VK~Dl4U=z4uvO5%&`o~&GYS5WGXGyGGje7g4g)x+mL_6
z@BP94DWc`$l3?U4o2NXxsgq<E&z<>p4_9&A8I_MFTw{qiexKjH>x>{21WGFoAdFA~
zZ|7_YAFbE%@#U_p`=@-c*~s_nl_adw-n?RnC+xu_;aLn`NgKvNqM?^7O#*kJ>|uTy
zolH+Fy{J2=UIq}+BHMX=T0d?_rG8v>B^TuY2ZT-B<1D%=frJx1Phor+{LGr{rT;SR
zE{n`+){&%+iBNA|Rs8Oa8GSr%dy?F7RlXTW@9M2Vry8cG>`sw%oy24s?lw+N8mgi@
z8}U#DMc3Qke%PWLHPqC8LGC=)*VjU(+~!5$eF@}k><EqNcuLjg)KXPN;S=Y-{k5zP
z4C@@|=X9vb)N;5>v{jww<v(vzPjl=v{luS>5t)+VYL_xCc>!Ur@*`E;`uH6ps6u?C
z<d+jqNLR--L%t_WJ*-NY^?7-d`uB0SC#w4Yq^Y>Gg&;zD-%*KEG#?)y?85$=E0e-a
zXV_R<8_BtFqfe<o%Tp<`nagEb*MjLmcCR$=3{xYb6O!BryR6DbDedG1q%Pl>y6!So
z8PFO1Y+90fm)2y;<Z8Tnpi~ej;*Qtm9Ra<QlgkfgK!>-qfE!PdiPP;GbVe8PQolLf
zoKq<c4K5j#PESvNEni=qYq}$#cR$P-`zrf8ljO)m-eh2S0!*E*LY1XwD`jPjhB$aU
z5F^bcwF&HX&$38wi{>KxRLlDJYN+J$lssMq!h{_oUZ01H=FZ)mEcnLGjtmj_AMM*~
zJ70B)&)1eFWR`3B^uZvm&cL?z<})7XnpNsA><@r23jFyAZ-7(?EV~6IL&?Zbbo^O2
z@@Xu}Ae^w64UYkOk=>evz4wvp2q!zi#J?{DqE{7Y>E69~->AGegQIxQ7{X$#?EQ}D
zakb*LLDs_4{huGjIA&PV8DGdy|D-n)eOE96RFV)zL(V&KISWfm#<@&}Y~6<IgZy74
zYF-Y~1-iNlp{6y7u8FuFyw8hdGz6j}r!S7IqK~j@BMkptH!nrUY6f>XCj)^4OrGZm
zMqq6&RC})&GCVADo8skj=>c(rXM^uZOn+y{SYPQgB&smu&K;j|^UB3`_&OSEh%Iqe
zZPmsNDm0fFRk?c2>*7pMzo|0@ex<&C6-FU9U{60rV&*u6it-v7@kE;POnfhrhtj)0
zLi{L*)*j$NEi0<)&$?*p7rar3cdC_@zl(9+?c)#2*Ac*dQ$7*x$WhcGAFVxu>aY4X
zNKUQpsqB-*)>Pi^frLJcuB{CH1AOT&3;S2AcOn8%4Xv&UK)yVLF%zO!ui!=9y!~<T
zlPGya($#Mu1g2sY(CxPiUy@RIv?fTnh*tocH6cC52CaKf>u!<GPI`20muR{clT&_b
zwrUiR9_i8qQ~kLd!Atxjmx{4Q?$NA<*pt6sc07u27}8_wf=7E%x5K1USVBl8s)_q|
zXvpz7zXqjHN-_GSr0a6Ec~H8LbWG?YjNarepy;T(gUBOn3O5C6R>QxsNN$R<M;fe+
zpNRxs&ip`2Uzw+Jw3EEiIgmr)a8ZB~JTw1y-y`0)2YHQ5xn+|JW`ddV@lLHiW_MOX
z?4my7K}dLXH!Tp;xW@BXHbjQMfB%lvtHG2pQ(6T?WPkeuNlAwenj;@j;mWz6(cUf%
zfkOii!(GE@iSkKeUNo#Z-kaHz55sBfrL8o4vn?LBhVJ@}pGhM+YZ5-O4-=NHMu>*$
zJd8cAOp^b3++y!MItibhfu)~P(`z{z$1Z}2Bt=U@T>-U1+VP9ZdlD#to&yu#X=R^`
zj11l0h(}*}dW|2fix%XvwtCY>5vKEo$Plwqk~tf#w(G{Z;~_0%9_mmQSX<`h;c*9O
z4Y7l^{9lJm)zUy*)LA>Ld;gu;f^R4`L_di^N`=KG*oy`M#yHeHlwK<icvXDf@CLKj
zJ0bB0tDpL<UUpuvD9Y-{J%IKrhdG!@$+OI;s&SL4(8442XZevVA0l4vyC}b3qxj5#
zt5J+VoEA9OhXttqD$dfTfkm&raV9h5=T&RUtqC~4wVK67RKe9>Ss(mFqe1bIJ(M#1
zI`IQX)WPu2tm-ktjLb}ueMyEU0bd}ZKVq#Xm5~U_6TN@mqVl|}3rR%(lDzU5OK>O5
z>C1=Ki-r2wHd@QT8T=mugM6BLo+brrSimmhH@e*H<2L6nl9jd**5D1%Na2pI#xE1>
z|Enl3@u8eE%1<|xQXzJH`kl5ag>@i&is{7he}g7G{@R{4Fm3tu3q_>Isc`oBJ+~6&
z(*ne0;jJWZ9|c|MuAlPmiCv{ydlax4r|07&YZ>roB2age-&#F;SX4DwKVz`xU&)Xd
zYWC7f3Hy(vtP>;4X(|cvxFbC%6Joz-y4`{H<lpsW7)pnqIOg2Lp6{$pKj}F_^mRxT
zj1cV%HlpHsKJgXU|Ixo_`PdC)P1CJtdion9X-vq_6$cz9!@B4KA95DvbQqiY=~?oR
z{p;gu-<O9Gc9rJ?E9I8nh1a)#V7v|gysZRGh6B-pU|vWV+r1I44Y#t-Cug<%&!tPt
z#TQl==mO#!V0*h&f4hR|{~xgmuC)}A5pOI45ecIA%+T;I=g<&-OU61?|19*)2fbm!
zK`LX8{=rqUaAQl>5v07J+V!^*X@_I!)!D@-Qg`JlIU)CF)4Wro^t433)6~UZni+iL
zYep?_%exxFe!e-_4p4O9|IysF!!vJeoI)4z<}@@lLGlwn7jE2o$_b5ORmJ;i<x=&i
z18^FzL^&e;9Ba85%XzQ{d_}#ec#9A^`7dW3XcZ<i%S$9<9p1pWplicX$SX`an%dfW
zpFvThNn+%l&P4^h7kN_GW6KJ@_AkxccME~jW9cn@LxKepf2*)s;`s}z>Vn`x*rCEo
z$Ae-pa>3)g%i3mldrxvMA6T33_feIDDJG${0425Cp;nAV4wyehfi~&!@0WGz6q#W3
zUEln3&Mw!+!J$Pxkqlp=%kjEX`hEu;QdG}bD92tui<(~;k}&mk{ln{TB0t6pnCMQc
z3%h4F!6FnJv_qeQ^;Q#`Ob+fLTEcVp+2XHXqB;1Pr*1D!vb~mkmL7{No;Jf2@Ykjn
zDf|^SNf2~U*D09vpKqi4<NQrtwVyxVwO?xXQI0VhY{a#EUa!p+P*u!O@QfjXf>~YS
zVk6l@zpv6NQ-eE-?&<RTuwDGcnlMjhHa{w<gs*Y~;jEu98##CY6rco`Yb;KrOg!8U
z_LNBwC{LM$4~oX8c9RIWNlv#^ocIV9GgV#6k)k<wa^M*lA+*W>(4Rt7^I>*633WYI
z2W>8sca5c+EAZ2Us`zHwfhKu~9-GIqBp}V=3W&?z4)3Z-n<0s5SWgx(%SGj!)YNWW
zK{8V0i*h5;Di4AppR!Z6Run_v(%-E1o9{hyYH=PQesR3Ra$i#hg(E4fLh|Y)Qge5I
zUpUtzzR`zoXlUq{nvjWMg4@o?BPIj4?4BM1kL_;yx26>WT_w4Gnp3cmm<o)Y1uO$i
z((!0PTIq;~A28m$DL8X8TOU)gV1^a+v@{sOlIWk*o#ajj=33rLLKN1!j)qV6s5)r7
zKD?Jd#2O?SPS+)VqM&)Zshz|gm^u)zM4#$#^P(yt1|jLB)=p06?(vOBYXyXQE<PJI
zPH!aiHDzXfM|IQ7&kX|_Y~6F(mF~tvNt?k?!)kK60>3aBzk`H&=wPvF2B3gH0Zq8W
z!6jHDT6^oOzajML8#<YI^;>gh@q5xae}i9r^*^}+55OStpKq$AK||^SJ`heAj`uqH
zH5s=gOos|KBW-X%*xV*FMveX9maN&up@g?H_EK^Y>t7g{I7J$)=6Gl^K)AXn@w<38
zzCNt_WIpwA$FK4!nBqS8II(uJ{Hn;ZlLlJ?1q}I#99mIWs>hEIG{BJ$82JRaJ2P(X
z5^60+`;xQ_MSUDFK&8PnH;f1NyXo=V(GX=sd;`-xQj1VrC`l(l=S)k34K(`qD?=Bt
z7fz1-loWi6ZjRh#1sr!Ie*ixDw9s4L$CN0eix+z}S`$Z)-Kko?ptW@gIf__WbITJ&
z-O;}Vs8%60%Rw=TtK<HBy#`PkF&0ta@RHBzYY$s8JUJd)SlHcRa#K)ZbC#nCepR|T
zXdhJr&AS4VheQjeCB~(Wj*y5P5A+H*`QgF<T(Mowj@O0c{!2<0Fj>;&4JA)cOQXB@
z8h%1kAB{WrcYIv)MnUA0C%~ddJv2OwzbDznhvY1<#jMy!m;%d^SzKoG?I{1v&0u~i
z%v|}A^Fh8yIyCxa`w1fBuTM+N;N)lvr5LmF2GqIY(Vqr!*6+C)+1j<lWq-gtONmy2
zPL_)acw%SVJ?rYiw6wCVH3xxGGE-NPW&djZE}tBvpYY$IdOM<uW)_{Ri;CE$$vHOJ
zm4x_-tgy)zKfdU=5lTTr9ZkT^p%_LVvQuSXvJlM*Nsh3hVz_ln$h^J+*1-D31_FU-
z0!Put3N=_GB~E<$tY>J<q4n%8`~M<HSuPd~mDB-a1S>UN$H&Kg3t2~sN7?j(H!88@
z(nD001)ZpY42`}8oI!8lCoG9dhrI7(m;!%%>$^By8W5KKyR}nNP(SV&SElI?;tV+q
z16n5OPAU;}{!wJX&<&@@;1sjKep530GV8-y!z~5S4r7KSNW7M{t>HUNOu_{C)FU|(
zKCTv{Ig-%{uGJ`%sM(E?xA2Mg?~&E`w<{Blw|aDihVV`Ld#zqw@9pgYY4G@%g+3hy
zoV8xYaamsimoK;tgf<Usfx*W%v8P8-=Y&*>RX!1>x4KdvC(N9hteLIVTnBQ=HB{K7
zczn8v=zGOE9f=AUqyN*x7_A8eJUyH$1w92-I}lPQ8KeFNU_B75+znrbV@5=@qtM&J
z-vtfx-B;#*0xQ6>bn{E4BN^{C{r=5Qo4*b<zzxsWsZMcwHz*|eV7Zjn*UyxU7zs!{
zB&%~;-e)D$Gcd^Hces)~UpV0f!yZwOA1MvX?wQO(z>?>15+Dxj1M2^xn&sypdR?Gs
z)^ykGYIpa;^{jdP<Kdwpuvq%i^u>!6o7)A}zHZv3DPVH`bi3yz3PD6Qo>x-RYiN$-
z91wb{c{f%sPT~8~+zC1^tAix){$Kr#zqxkvrM9mRodT?_`$7rn<)7uMcrCFE-Nx-`
z)#Rczp8s_>KQCVT>Q_q6XdJH=T~5HyZ`Z+sNkcp8yw_b(H_-JCpxGbjA69@szjc6R
zF|#<bKgS*isCatFCIby{SYBxa{+_%(N~>?)1WP<@7A`JFwb#Fxuh%IA$jtS|&RIHa
z{Mpm_c-gnV4SZ^opb$_b=Q|ISJzh^WuTmWOa+v;+LZeH#pt+4Q2UYS(Zt7OQ#e{p?
zTAe&?cTG)=%vXS>S0ChIe{$SypZ^893fip+fA788nJcG7^cQU^EyNi5djH^R|2kO-
z9!r?M|MmED-{u`r=O7&5a$o_gz+kPjr2)M;9c?h+>x@s(ll!+nS0YiR=-KnAl$3O1
z-)-y-e*`&sGcsR94?$Cl+7#^fx1kzm;qD!um`H+MxcQ4dbUOd?<F`U8FJKaHOmBaS
zvA9iCUyY5R0ajSa29XO!PR2}&rHw^o(EDy)R(q$#M%_ivc?Yn4*za?(nSP)bR{?s7
zJ9q9RrOBYRcR}gH*h`c!D~YcK^Znc&hnT#+J`cP;*XD2iwN^p{WkZk{aJ;%m54?!t
zHK@Z|`vFz}r+{e!%q}}<w`w(gS={ATrbn@>T3Qx|+}z$J{Qad#5WLe-x$Bw@jhF!&
zLu{_!nwDG=%M>VcfZ5Kx7}}Qii)jDxPJe&;5>7&MCcw|ncu&<%Ju;nomj9wfN(cxE
zufYsZK5sbiylMIJfx9Kp<}&`M*I%?B=+|FpX@`?ZL*Z8cR-53XQ3lx~+hXVS4)bWc
zai|A)$v_7)v$glILcG66%-2VR0-mu(Zp=TH48sI&ouY;I)VFJt(YQcYdK?LJbKV@)
zPo=nh`<9Nd#N|Sat)-<f=HoV)Ou>F#irl~dX5q<NJKNM1jfw9`kFP^Xm_Gm^f|<!V
zyesjgqqysbVqzCY3Q9!3e)URU$x5mWkB+|cwHiYMHzLcUEQ2XvV)<v1>8k$`>?CPT
zS(z{quAt&OEzk@$z%S)a8@UkCk#yDjt=Ct7Tuh1to`H?Sh(kUZ1~TKGt#)1CC;8+s
zjC-Wvs;^yvm^Hbrw&dhBclp7WS3>6AYhdNVf;Y+G{z`jT`aBrU`b~!p4yD(rBsRA_
zNVVdcpw1h1a&qcDyYC={-tk<Lh>^bN*I=^D)QBdV`%B2=y;9rVt>A6FZcOrOQom3A
zkHbC2jQ<&2#RNQ!M#*$E<nYC-!S;cml-8)!pWTgKsh>5=lah|o+DMvUFbm{2^xZDH
zPR~(m*M1UzbR3qD@fCC`g6>p`op>iN+dJK`_*;N&n$+7lu|w3&Qp)v}Us@^!v(N7B
zn+pFber>cj_4;$*-Du}R$`E5Apxnhjtg6d^UM-KmSQ=(k^L+Cp_xi6L^X1kf=^?PV
zPf{{`o-HgrH8Ft`JcS(k2uS1q{K6@u^}0V|6Jy}Hb1Rsw&K?FvumvLNVENlE_s>F9
zy#EHP2>9^`VaF9t0Xs|eEqe|oI>7jWmYO`*1sBi$0Bqeh6TjFsGwR_;V`}J9+90bU
z=XK8<?Q8FbpIqE~D8(f9rDcz?mg#*KD((EK@cir+sH4IBtzqlF-R>S9rC>w%7g)^}
za`2av!|fSt9M(X1qrlCYG+m%G0rH2)W?oO%x9ZOQE&OO4iaG#sqV;2Jj8cLm0AoZ)
zU>0j)6aNyJscz9neFa%|R3IBax4Ua^3r73`@<Y|Y&bVQ6eP;6ICooTZ5j*`+UL{oq
z=}!b6;K1#joj-f3d<`4r`l7)ucBDp<@Uy|xjHL!QD`I1ON_~4>jc$L&B0^}icSGC#
zq#;)M8n8<|(~M<liPn)~xqr0(=Sz}{53iq-LNE@e)^_@6a7TiG!iE@viUJw-eDoW9
z&Oeg;uu`^{ZtgEXSTq2jvZR!GU3Go-<%)Zs<MRcoeysH6eBceXJaN6pR`k&W$P-y$
z58?Y)Q<SuxpT^D~!nJk#M>K5L;ia!%P(foUk2*;B)oj*(-NXF60}65qitA9A#T`KV
zM*pr$U#(k#d8FUfN#ND!b(OID(Xquomp3WrPJdB4nA1Mo%oTNkJrEV$65s5|h<}G%
z38P;%@opI7XKMG5azn@V!cV%bBoE3*rB9#rjCG;Bo${k$Nkb%ue4qb~hOi9>0n07$
zg>}fh{{DgP^W>cGB2jQ$MT+AIN73+gzs9TMWg6%Xi$m)^N(d|~e*PN$CiN>$Sq%@g
z_{YeHm*OS>-rGK3L~>Rm?snV%Z!-bQ$Mn#_Tg%qW3|87ru-@=MS~{Ld1Skmdz_!<0
z8o}hd)phYb_xgJT`5oVb>%Y0zCvNNO>-_ESHIde*gWF>iuMR_d_rF|U8Pqw<d)B^^
z4I`9MS!NY*Pp_!1{eYhem%y*BZj8+m2Rx*Qa(bs^b1kpNz!f;0T#rhDY4XjEkt#GA
zREQVh_CfShH#8*Q5kr%eYUwa8`xek5v8LDN`l;JD*MB}NaKCL)e0Hz%v!*wbfPblg
zy)6zE$!q%bj~$`Be92!&H(olB-~sYUbSbS=FnqAP`!|Nde+Ae6q@TNR_<G^HlvnvY
zdcE}{_!$>h(La~H-M*#Zalx~^PMm7wFzx$UG$pk`S5UQX>dLKs@PiQ+kat<W-8JkR
ze^>r|I`>AVh?BbYIy|3@cJ$S<gxu9m;ANHcq}&%_cjoe{Dm|ybKl7Qdj_3njn)Wl~
z9^7q?_ZG(M@Yiq}-DMsW<n6#uYuXtUG@H9Kc%JZ1+1TI0WH#J>^1=V3>aC-y+`6!D
z1u1C+L7ELHol;7dqzKY%KuWr6(*m22E(s|q=@9Aeke2Q)>27$}KF|BTV|@N`#u;bm
z@#c=T=9=@mepggx)h1i}g^3PZIqrq#Itj<#K2`d!_psT0w_aXO*2&g+pG#=gz3qN&
zPm}K4UfpD$RMWG2{hCpS{e73Y2c^q5pS-5QW(4#}p=qW#&-~}(IUP9jzLjavI+#nq
zrbBdO8`F+RhJ|Vw;eD-^?Kb{hHs-CNQf=<`1;8M(+MDC^P@pbYLv1yG*D_t!48-dL
zHEbQlv)B7PNaIOKwdG&s@TxhCS0wnL#Fz)HVEIFb9x`;DAYZ&pLo3SD=7)XWS*%}M
z>|h!F^<@y%{N(I}!djU0X)pl{2d2H%=BOuhd)WT!bhtFZ;Bet;(3KZ)LZ6*?3ElJY
zobf4&<fRG<a9Q-8gi|sluOLxmUwdo&**!IopScBI=p<e$bIz!kM;XT?hi_dE5EA|8
z{|$$_gSl3L9W{3A1P~B<f*v8W<YRyD08M9VaXOA-Y{C;Y>qEIMl~i8nAreyLhmXtu
zJQi;jUZX1L(4wJ6a&{FRJtLRca-@#q?-OK>OI)9NIZ-|P&3tm|Y~CyX_lgXM2)usi
zlYY4_u}6xbmD@gNz7zgSO|)+F=IRZdBy!6!=ciObx=K}4<OxENONo#YubE#{L#>=4
zzxJV_3f=priMc73_$0M1vt7Xf(S_Z8RcMn~+Jd?hLe+hB7ksrI7yD~HJu*)-%3)W2
z8HMU0xmT}U<b&?+l7ViB1})(OCMDFsUjAp6B%8(@5`_Po_F5Zf3B8TMLxP@XMhNEN
z5>nkfr(OU-X3wVRvgRxP#f>*|pc~~D8ym}5arNxkv%c#Yi8$G<9Vl7`*`9Doy|>G1
zsM*Q0_hf6}O<hd$zQ5YcwbqH9xHs_I^BJgm@HT7mq*_!I*t?Hu3Zjl<0|nW5#SLCf
zg=joE71cYBbn%*9o=NC4be;Zs+5gSx@U}5t3)Q-dMkb4!yEJH;dGKX)qH$N%x`CaE
zBN}qPt|3k?Xi4`qgOKD$#ILwOqaS}vMJiZs8{;g41Hwd(2)S;Y!y4f{=eK3P#ecE&
zUG>vESjwq5f10Fzu+7<|tk>RdRN(feKz{Rw1E=X(llqIW`8Xk$=|Lu=kEwUfHM57Q
z+i?w&a4guOm)nOzdk+ht3!in89Zj3IXS;4M4p_<lg&4?U=GOQsD3$CtN|lzdFX$Xj
z4I@qd8N5`{aiC@pm;8b@33e^JV!k>w4b3@%Ov#e68u~S62Oi$n#+3`JU_qi3Jl5=5
z-*k5AVEfeo4sCO>kE{vPk)_1mV2>>={Rkq5l4SWC0Nh8{NAS?xQ#;~Wb^1><X553J
z?s@GAspkvUi+<-xdp;~PJ{LaplWo-tGiDF=tJLK77%K=GK*ht)fo``JkHXyCS9#wR
z*cHWPXb_Tk$tdzyKOHEJ9nA1CyKvjO6l`_CX6?QhUvcy+FU+X>Zzk_24r}){x?3#D
zH<t^?Aw2O;X#L$JLLU2q7mj1sgP%GGt|IEmyYtBtU|Lk&29xr&JF7Pwhr9fHHSrof
zPDQ?-XlMPSj7q<GM3gtHUf%BV{*CXg+tKB|ahp!6CU1&3pZWBVKkVH;$wGh9_P}oH
zJ<~93pEGCqDWO(R+rcxjtI;11WsW-(ui6QBKgRp3E>MtmxPIv5{+b4z3*w!O;B>!I
z(RnVIpP7fU_uZ`>w)QKRi_O1>UZ9rit4^y+MUS&5OmbcP<7!pU75DGo=Ciu;bK(od
zvkzNcODChq?EhB1r^sztvu2Y;$0$ijkF!HEhvo#O#7b7PB89(~k6V0X*w0AsC5eIY
z?zs5$3Re^3>!GrfH>PdJJ%SA~=d%7no|#?G<4xW3QLK6p+x%8>5usaSd_Y_q8IK@h
zaIt28H$GWu3@AwBtp!i_$n`yNmb)XIvAdXXd$ejlKMb|8)wq50lOi#H6M67qeJ1ds
z{*n>Le{3g)K59hg%pue~QzJH1ieb=UT4bC1O`%?oCXs5Lex)dV1BZRqp?jZknj@sb
zS|;*GeG^6Uf>M8w*CtE5U`khk5vGsJP~UVAd?Npl)AVS5sYVt3;tlF6E62QPN2S?j
zt5=5JGtOmwhYu$b-T%^pY$to2g#S7+kD@Dbi079}|AN!6sP19LxxMh){NkOVm>Kdn
zO~`{zP<ajuh;BDFeGZqz4yJw?2|L)0KXpA@sDnUF@Zi)A;Ss4^Z6n&U%Ocmy7x_Y|
z6imdV-00Ar9TefxfZ|GmX^FYEqk6Y$>fmL5`-Yo(whsWhkb`g-jFVn&TQ1Lzu3!qw
z2@9)GuhiyPz5QbPHm%y7%lY=w-uZY<c2x*1g%I^6d#<)yNir{$9@HXdp!Lm5Dc=g(
z%aV!=m+yN%dzBAOj>3Om1l+V$>&^b;$CqR=L1C-7fcUj0V^ZpaQ(x~65GI*8+D?D`
zlj0wSCqCg1=5>++NaEkc07E5s4!yMj%z1L8*y4yTKIW@7K5tRMt38E~)X9kI2OUZ!
zr}v%VVPmOsF0=)vvbaWyVW}~HuiZiE(&&*nYeW5El#ODToT{!Yt#3xvdK;zuN;-||
zO;t+|*1>G*0cGKCdn4ukuU`9_o3H!}J*&86W0o%_OE}4RZQ57S+oy1?`2tc{uZ5%1
zY>al>YNVvz!;t>z&8>5r4zldcR9a4NEXm+tV<$O}B$K6(oY=)-udRv^Ns)zwExtLX
zw!Tcj3YOUU3bkBsLc*(_kdsUQ`V)&L1Yr!J8Y=wvt(EHYt&Ne9gtR^L)ZmYW2+Do|
z%BISn1jDN+#55u32^xjzuGt)Zo3(4Jel_7tE_oJc%1A?g;G|E>OI>>jO0f?HoF*uk
z<_9~wyaW+4kj$|Hmyo@OKkhuk_csyL8}3@U!}}7C0%~%s>Px$Osw?51B|rl#D(1fi
zgikRs5lhpi>1Pxf?*(Q7E#!Yz|EM(GHG#)l<5HUF1Vfft8tNy`2PNCR<KifS)g06!
z8mYXVG#2!dYbwlFb<|FYdeZ$G6EaT+_(pksy*?>SyZQRQ(5B?^s_Ikqi9dLA^Ll5>
zh<lTHr)IXxd#~Yj`-nTO+hCQKY@Ka2^Q`ju<$!SN$>IE2%KH8py1T-jp#Gq2eC>^W
zgqpzR1newjC%$TK8ntS3);jx6f6j7qe^$t+9(Pg57E4oq5jRn~*A47Ld@;X&|0a0q
zTOenHgG2W=zT-H%Au+_F#~)%4axL}bLRoJ7(R460sRwMan<j^s+VWFKFIkR^_<mxj
z^Y4d=r{r3c)McLd?EsP4cZ>?f>nptNdGYe@{0`#&or43V=|3SGzneDX@hVQasg43y
zz8NvG{^OkS82y!_-oZ9xE<evZ_S>3d_5rN-cZc`8&PQNc@<Xb4Y@%4_V^wgN`3{ZE
zw*B$x_NZ9iHu!M;a9Ae`hXwROm4ko-M5&qN(tAIqq=-pIPN#9$PU9m{V!*^6!9-;f
zbO?*ajK)kJ4a7!WZ4KafN0;yH8-%_webwaY!f}(}=0Z-=?SA(uDb;1twR*jNryz>c
zDqLb{p16ZV$oib7D@91XKUPnAD1^85ybK!AE>O~vS1DcKA^6$LW53C9ZYthW#9DV#
z6HFZqbvZ>PHpx8SZS-B$PQI;Znx-lVcN8?=+)l}YG8=KwTB$uWn^?Kuj{j*yE^W?!
zF0B|@^89_&B0Z0=a72U6O650k6#87N#%Zc{!ax3SIJqDU52H~C&LF3Zp+>t#>p%pt
z@pU}GOU-N}09O40dsD-QrW3VdUk(9QPqJ1|7);Zk3?uJqMd!)dG*cS4iYyVNdLJ+W
zG}>M|z0-U#b2|n^c^^sX5|y?hp3>T7G-@zg2ZBn})ci)h(%*%0_91-!zOQLbbL9S}
zYF=sEg=)D-c77w*ia*o*L~6>fns@LqKGN3k-?oBsw`vA}{Ru%r^qNRZeDMoD8%eUw
z7w&*&$~EG^+@@h^xpNHWshm!LY$G@?pZoTJAdT01fVlG4GjG}RJ;9uCY8F2KRK0a~
z+f5IWKG$DOOYi&Y{&4;*{`KwXEsdX1?AfWS7sfQw^_<^oRri|B5V=TG)*xx?{!y~C
zomW|e&_&r7JSeiMeyiZsZi;Ce8}8s_NwUiVm%i{ja*s>W?9|YD-6Y!~W=*QuF~4ta
zG*Tpm+DB_K*)5Flm!eaClh4ITDq7at9s6varRgy4q~fEqy@vJqd)1yDmeWwvX+5NA
ztb0!PtU(-zm~0*cZz=I)WVyooNayGe!n@&T8ZVWmdU=|OQNQl~E?&_Lrv|4rI|E>k
zAc5jiNIex#`&F_THqdD@^KF0MMpeCImwJqR$PS%Idy5O<++Mx8^vRg-ZbqljvB+V?
zsA8?L#+!Zk4oV*OoX<xMTKJXJ@D)M)G_!rOii_)u<hT?a2isPiSr@aUy*HW6K8wKT
z4utsV80fFgD;h1jmV{u3)L~O=N2}d5dM*62djN6f#z*khbzd?uGuOlA8R)rn$&8@B
zFMDyDl$Lg0!D*$JXcD%U+3<RzyMe=<Lchug+nlrC)3a)af#l<s^2CYfbW=*`E?QUG
zuEa(!FXWue3b~s~n0I$5B8Pa6#M^;odC%}|Vi0GE|8qA#>!si1p^p6<4eQ@~FLqtS
zl(*BG9fbmxYPjhworh$rmMKer>s`L_$T&cw?*@yk=Ok&>;kEqs4RTjWBvi+6ZHCeu
z&TzR>OMespRPMDyUr4Pfkjai+G(ULFdB|Z-Z#<9>&X+GoYg}?Y!dE2tQ`!x>WqE*n
zWAlw6psa(q>E!tPBKE81Zr3RI0?aS9{z!s2C@9Da9SVElA}A>93!g>9(2~q}0X4l7
z6irV5@@^lfg9V+3wW3A6*;rlZ4|UhJ%ZGO16_f98Y(L%T>+Cgihd*R!>CbvMRoswd
zabs??R{RL?K-Ei>k%)4_LEdqna13n&*gP|iQ-8deKxURHbEDI?dgPOeG7|#j_9bz4
zR(C%9t{>qgZyN9r=IgVv2+CIUbEio5<Ex^XgtsE2Z_2Sm8KPG)BilEZym8!eawsA#
zAN}zz`@WztQ;BHk$2hjyZw=}FT>WNUyVEN?DWF7kV;A{i5jXwqMsJmU(Pcym8o0Uj
zDW!M|)kW;HPNh;~JRxt?FXmq7gQFoM>*r-XQ6z1n!_3=T&=mH<P!uJ>+PJv5xFH}Y
zRCO<hlGdAaLS5&7>+x}LJc{hUo|u?W1od0;LH$8fBj2LuiAVwIBfr?A1yW|~V2JqB
z=D!bP--!rN=wf~Jht&RqI#gOUGKC@$^vlyr0e5vFCZ#do!mv@t@9>TxKy~zRLi?ku
zEvPls;C2#2$qwj_^p#sk>_c&@S_&b-6<01ZP7d3q&f+tk^9BZO&pEenSlN>lzH>GO
znF^=fU51^j6jwZi?D<$%JzS<i$zZ3e52a#AZcY)|6=eZ-<8iYav~>8XT7TC<y<VI(
zBbXT(0ix(%J2;~bM;x*7gLO-Wolm!ve@E;aC{Zgtb)PYK6d4xAKqBx+y7aj~oVPh=
zx(R8TkRihkWphgnSV)6<1&d0tU;W1U>1);3Isbm_zRk#>afnOFuDWn&WLGJ@w0eTq
z?!5!+oO9b^<eTS3tKLdg#0&8rp34WdoBNO(T-(KxAj+u<$Jo0!vySb=ak`5^KLUn0
z?4r}#U&dmicK4jEn}pCj{ni>Xg>iTMSZUzRolfB-J7cmF?)}EwgNBoaWShEex60OD
zwK)O@{Mru`NB>Wc(o;!^_v60&g0@f`%f86<At7i|QJOutWj#cP?LX*OIMS1nlOd4@
zwmTO6v7yLLpg1;}FJTe6+5LU^=!nsdC?VJr`iJz<pTQv4TrD%9I=brE+<<r7#pyR`
zv+sZC4v(7eJp;S3#lw;Al-u*)6csnuX@|Jv{GWtrqXoOR`c+J4eJ&OZ5ztsBghf+w
zg@nT9J*Ls4X(rbun6s|q01rBuZ_78o7Uw~M&BUv%USvb8tarmNA=vIB(LrJt|6WME
zxJs-*H=GEtr(4AIArAblXH#YA2v4-GnT<VI;;zbRHaf@1!ZNCUHF_6O-^@`i<T`)o
z)>A<qOXMP`(D$pytu~!Ad~JaP>)YNp=SYgLp7V57q9yOfIA<GZe2>1~y`vBj-r1pa
zqnO+4eY4-Rco@jXaN%QKZEy|%G!*2_g0)ez7(&&`L<CZjXGz9YnNv}858w>YG}kVw
z*U!s!6{54WkJe<^l_bfAt~KOyL3DQ7f~ke6g49L~y4^efye9AJENo}<y-#EDe}@CA
z7B91}!k0W$1Lo0tsnZ!52ysk5z}Vyt#2U|s5PtiR@!|+7w^JiJ`(=}_jX1|2^JMY7
zs(Se<P1GaORAh#&0(T{xuI#R~@ti6+6>a!y&XCyG>gOBFY4&eqMjI*sh=LHbUExKt
z4EWaCS7zNiUBSfKV~0+-^}UlQtEkdtVKjEs%}Ow=EQ`e^uh#n|?7%D0iN_O_LQ}Q-
zM6ZoJiFbN=jXn0yqgQ214|=aT`mLRND!kAg`j;&Yu-zAh7V@lHYTAGOvG4J2Uu^$X
zyZQLEPrMAe(fh_=?yj!4)tX+M-BWM*<Xt3_`}(@4iO>FnOx3y#^2yvovB!Yjez`&i
zORedt>9@!3)@met3ux@x`{i~+_tLav_B&k?lliYI^5PheZnYsART;rau;tm(#0)&@
z;9{U^;f<*Ym<2<*k+8Fqr$a2U{+O5jLmFJ-lRPQOeZ`;5XHa^-{+tb=o6)SOw3%%=
z7ZKhQ>Dt<T@)x53N%0L{)nA7OrjT)fR2C%y#yld+wK{b7wT9oa+XJ2lRt*v}RpO8&
z;y>+pBvLzPm$e2=gWjX@q3D}M)l3Kek0L7=aI-4UDV%MVZwboTusX}Oo;fQln<(En
zHz%0S;|ZLlNT&wXv+{Y;x4$vpOy8cm%+yx<;h-&kaXktAoS*^kI%nVQR=wc96Nse@
z4;oXfzPtLq5)Y>~Og$@L7PgywrB3hUV{)i=(s(9XesRXcSJHi7a^iSS;9nDf*A=d+
z%t@Y^r~fAbhnzp^FZ;0U4u0FF^oyRToj)I|_S7R>tCLGVHn@PkLsjp&$n(8sm^I3U
zlG)Ae9f7!<v^WqiJeT~clZZy!6@eVd_QF_AYacF_=-i%}l#0_vo3h8edDG;G^~d{t
zU++rE&Mr6q^G*KI2uzHy_LI52fU0duqfZrbiK!k%<+c}{{b@dziEDy?tJr4;%lcib
zpE(z0>=baN>Tf+nxui<Ws_*k8tVT{v6s!jGORJ#t2+^fs{{a5)Fg^z&skNHArp<z|
zzWG~ifU7Cea>k?lU|^5Adr;Rx7c%su>S6@9SzqY1_HCHxH}-?te-2)rRK4b8WXf|6
zNq~U33S{%&|5#VeFr|~3v{`clbM>rEwO70g(nFRV8F=n4dp_SacxS!DWdsn#Pj4s#
zZ6}X~#A=1JIBKC5@L`NuKv(5WxZ)-_(k5OnaqaQ73#$?u_`k6rQ|{91xaZcL3}bgm
z!s;p;q0-|clW?W*AJgwMQ#YpdwWE#IKod~?fbR_Y{7`Ri38crE;_8WcYez|vC1)`e
z5}r?yX`ZeSz*+MRVK?2vald;|ju5Plk9?Hc7y{yI9ab%z^FEWWc#CQP&;&3jKYjZ2
zh*p|XHCSQj`p}{CT*QIQ>H&Pnf`|_p%;uxGu@|^x$gyxs0E|El6E0O!$wV6{Rbs`2
z7xD!~a*As~{f12j_<Kzf(-nnT&~-EqmTw*ubUnt2z%FGnfB%b&+dX`_=9dqC2QO1k
zE6U8wOn*&%{p^~@F;_ko_$$!A3cV%(xDGs|BWhnUr3p|J*4wzaxSRl0#{b)A%q2FK
zp8CrLQODM-`=vnHJvY~1+neuMH|H&!4c=*aC>Y%I<eoJwbocKTeNRgIxM^X(w>jfd
zAY|*E<v!VIX^Xk&vqCnM_$Ty|t?d;}MSxUgc<|a1_^n!FRK%5Abz=ZG?0G(I8msvp
z7f^J;<skl1)TS;cwO;(@&OVfq)OB}i<S*b=?*lD^W4@Bi3-GHp_t&qZ%~P+M-^In)
zHgKJKzzDt~Lt=Sr3g9Vt1Q-ZSKOB%N%wZVH3OOnm06$o6g4t*yqa{m60D3t<zn17x
z`uq22KM;)^oVd^-?)htA+6A17ME|H#&=`l=B@Ja|W!<l>WdrOICMM=-B8>@}K+UO;
z*?uE%qAk8m(og`%Z}2A+{`b&=#bex5mEqm$9v<~U2wQUuATtAMK}`QDC15Hbel{)y
z*B#t?0qxg^V32DLvjSY-?^o!`a~0;XkZct&VnqD>QD=DoC=Y%g54y6T=Ve)L=M%b1
zUV$2F2O7y=@g#t_;lBQGwOnwuSMO4Ar#mu^mhQdZsdn<6v<iXX;BdJ6RuJr1xM5ll
za+$S^?|l1;ws7O%A?M^jWu{?DyR<1#W{mn{C}m^*|E~*R`+9O-3DG6F%D#-{i9I!Q
zy3MY;xewA9XfD5r30wIvb`3sWW5Sv=*uNKNf0isBTRhykN<M|Mn~Cj4-`f^_e?WZ3
zx-aPM*6ne~UI6uoBx`UPFB-8FAWniOi@@H1A59$?p#dy5@23o>uPPkio}Oh+O-*gd
z(o6YBg{vWcb{Yc&zy)!y4j0O!^`!;!3JbZZz<*Q4YX<TpMW_(CF~@m8!wqDT$p81z
zA?K1Lbx^_S-zz92l0&~r`XQuTFwoIgHhg~Y4sijJ2-Xbv7r6okB)UXfb5P*{F_sx~
zR0y~tU`6uH>m&!XF3>=Df)Kf*({#Xn&Q4GB0P6ax-u2)dSW1`M{pH(;EPc;)H}imy
zO^@dR02ad*ziKz<+v{|ll{W0ERQfEUX!)3eL%8FcpPqvTS%2r|imI%p{h)R~+j7IR
z0uJTA{dXCK2wfeGu|(FQo6cF@>`B8b!d|jqv;=)`x257rqi!4@d;5{X9Hx-HP3cex
z%jli!yw8c4d7g>#XYGjpuOYJsDS`ujC>TR_{mNTLznK=m+0pZrNn8N2&R8N-f1>W}
zuqaKiIEY;*BXkWzoDdBa^|rNDjMk!<u<+zo`*;aLhB@c|-kaYsvMycrTy#!_d8n6a
z=ke-$#LGQK^53ns;y>-17IJ@LUpPDHSL0j=xmvk6KfeYqZoO+MB%3tx`}bpj#|du<
z!IRRFiuSYgp8M3D>dv1XM5Qx=_(}6$01byY`gCvuIp@K1sbiD{?N&6P=OpR`Ex)o5
zNInTGE9+-LK#Zi7#780)s&VLcw{(8TLizzb3>obIzMCHDCs$Q3#ZR>HtMX);V8D*C
z0OS%DwzhoSpc8!?5P<UZY4$EqXC~U~=#Vu&#mwb1T)=0wz-0!{F+1>ox4Jz;zn|J>
zp7>XuMs&(A1ATO5g_DWDeg=jB;SSVbqf=8PFiZ21@i2VpLYen6_z}TUxCnrAcGv&@
ze3pZ4M}y5vr9le5-M*vvBhYWT1@EJjOl`D>gOydkX9_q$|6MVYt%4S+AKTPo?Z^xK
zKz!4ri2f@)3j6EX3Td#WlT37jXc{e?K^rjGUP>W2&P!_iJUk}igsq?#qZs2B!>z1W
z?DgN%6#L)3>yd2Cn>TECkU19>Jp7O!aTOs`38aYR3b<HU3{Ro8295+S(*NHbQ$g@=
zqp+X0S)IzymC5;h^{;W3kqY97G5agt{O{ktThRRdC>ssfynmfsT-@D10NGv0S_d}%
zNg@<bx?~0r2s(5cveZ1|-sTLM3F^ubK#ul;GuTX*cPhP%rR-n@KnN8ZmHaq-D6pq0
zs9b?nk*`+p*?_6<fE0|u5FbG*hmW!R?*(#N%ICrVK55<VDD!;FG9Vg58F>3SR*(d1
z22%vu$)VZ1bOacV61;qT9x_}9YXQg#uhS{!@lQ~<8o_&*9go=4!3%8^JMhlUUbj$&
zt>`$++`=NW8Y`bf=Cy5Xzei8&`0Q-o4W~zDOrHoMrz46K!A6BgX)k>ZcH`ri_H?0^
z<irvu97+*b<phdr!s`o5n|@GNT%+NTM<vHWCf{uBxX2X0XA>#%*?b3VxOgh<|E=xi
z%VOnjm33Ss9mP6CTEt|TdDk~Lx;cG7j=Z)8tXRMo@q+t#Gy*2iY+s>l!GiJZ8`N7A
zv3~I2fJPWPO=a68WMe*4X5xojDy^AYPb)n}Ge-UspanqC0=l1uOdG`ZxxQmDbO3}p
z8Xl!a2uLB=c9zD$Pnu|uEnY*Z`+!TFPlWr7KtB*Pp(yoKc&|!578zog-;K#Fytr^3
z4>3NOXb&}RS+Lz$kchbgqEc=u0C+h}j&k@rHD%TXv{y_a06Ng+*7rKkX+=9UZ%#))
z^rOSoHyyfx^E!p%DQHC_I*B@S)#Mk-w9$6BNAvJK#MlS{Nro(ws02pYJNr`rI*aMH
z>Yz}@LBiw8zkT=6OK+stbrYz)8)we-O2yu-?VFFKxD55t{fB^JK~9nlK?&mo?{ydW
zzF$fz7kDvkENh4E2fJMqkaiJOWT%dez8%w=-GNB;XuTQ#b08_$5V>`eGqh*?WdBYQ
zeVQMEoQB}h*z`8^onC4Q-IoKx%|xyaZjF9ZwtB-Il5!vC3?pxm;#eq@FLt0b)aUZh
zpcHt#=S(3sG~mz5jm*ti3DyJ#1}a>#2vtvf4qrP)F6ct947i`3X0A%0Y|0Jt0Er{z
z!a=8pMqURk>ORllPPNTuj`-zA2$DAno{OmqsU%EjE=GoKUm3nONFxMIR(R?2E|MxC
zsid`2uhXoEc=C%jD+BHHt$`HR^4a<MN|)TurG<sXikCDK09`5^8rFi`4juscr*30%
zw=I@Z9c=yH-)JIKr7-fi+XHitc9(5KkM7D&rg#eHK$)2)Y}pLU{qM8#$B0XidK8{c
zqEQu8o3QenF=_&!;hHBe#tl4_UeGQOeVqQC7@bF4r?b`h?Zuo1z|BA?FVO)johP9W
zA(e;6B?F1-;@J|!(jV&2G^1lKI*#}EeENJS5BL2huAm)2)rfD6wO=@+W#vm+NU2KA
zhDL=Wz_Q2GACZF=Oy(INi%MXX=Rf`DF+j3wIBXQt7@YKLng3bF^asllH9CShox`Pn
z`}^@83Lrip5l@PBVl?rU30N9mCI+Gr7c!LefpsNfOvT}<Y_h@WeyS6%+U5hC@bP@>
z<vRFfV{%YhHlP$88ubt1#}bI?ReQ0|^Iu4azxRvm8mSP)13=!AnrKHIF4IoGfovSD
zn^FMml%XHsP?KE~ew<wP5jqLGPG<L#4R5}$g9Ok9U}uMqvwvqU8PSHT857O0ZL2ab
zs~PNn<ne=V)D!7HmSpp4CRg`tiiLdC*MGPGs?t>DzC_$8a1DR}&-kc@Ep&^6k8d(x
z|B0;zoG@M8+RV$%&hD@UEQ3b^d-Rb4wGgl>z?y0ezRK_}>V{$@ggz1{9DUP>mzfuU
zLZtE8^z+z7(;4g8P<#8vNl6v&*}49`N#)L*<LE^D8~xi|(}7cwhs*ANtFChyG6q{!
zugAf6nr02Ge8Pc)gYW5k;|VcFDL8FK^-B^|v6ofl<A&rg@oXn3LMs|&7|rHENh^q4
z`k`=-EzHaVUnKw_x1z}H=2pK^py~1hwN2orItT@MvZb@v)(ogVjas4580AUF0_VTF
z!cSrbc19*4&p8!1Nr%oN#BkW~CYeGOJ&$G2ev#R}ZX^21*&-poQJbcXtsP90lT}>I
z3aircO)q-+$MKd%O#&Wz_2aQ1?C_H~CZ0Zc#n8Qyb*m~W#=-}!up;h;{!GAC8NtHe
z>uaZk?O<bY*|>NkbV}W%kC4vF&m(N#r>7(mp%GX+4s?bK*b2POq>NFVyu2H=7>)Ru
zBz$ypb`u+4{JJM}7Op2M))#NDC;f*s&s#+<k<WCRPu_l3c>3!0@6`0Pxv<1iX1C;<
zYi+TL1FQkciOKEY0{pfM|Fe{frrUM)cG?RrAlejj3iLkjdF!anV<{Yoo-Yh`)EIgj
zLpKaXI3IQl*TG!v2_GR%PA)j%Ws*Uj><hh(>{3IuVptJ1<3%j`7)Hl4)M&)Q)CciR
zll@L}1q{MR<E5yh=zO<@XjHFPX(L5!B#ZQ6C&}Zbch{x4UYqk8&<yXr@0RKT>@jUE
zeOcZM`37V!Ere>eIHTXI?&m*NqlF)*{hZbV;V>rM5Jmw!Wdo1prdS;5ep4wa@q%Xv
zvX8vg0vZM;_X+iDkh0+c3ff*pSuHa&Ggx!eW|}|VV_Hmh&#JJ>At*GOTH)8**SLPC
z22x0ClqwOh;hC9#G-#6m8K;^ObtnP*T$`rz2=W}280Jm`#}~a7Pb*RDYrc1mO~)M7
zeD@GBI#GMR_~5}E=t^?Veshl?x-g$q^!R`1v0S{-JGra*V*1^CA|K31PoNSc#gvIl
z(}uBq?*eo$@=3*Jcumq3%}%Io%x~nA^)TFRqsxJmw5ktmlj);K8h?`ZPP8Ot&Jea)
z7CSJLCKjV*!NS6V>EFyux>(R!Hbb(p5Me}r*4B(y5QKa(9a+~Goy9T{dEahd+i0#x
zA>I(dS+?d|2LSx1nJY|0q5;M16UJc09XAsL-J@&wi}i$D4Cqu>YWl4)-ab0Db^ykc
z64P{^zQy8;8$ir?i#Pa$t|Ev}OA}To^?8@azlC0n(E7eL4kE6)UtGG~_qxae&M<TZ
zN`3mK`?Jz!#q`Z&fC~CiQnIh%G@Cf=k^t%^Ic)=G86vS8uvQ_6cv{p#!7C7>PFDD(
zdjiy<R|+6~9{b-n-R#fWpN(sz|81PY5Lz-Ba+TC1)xweCEiE1JvN#K+7RF_OB$i>`
zK`}prBVw>lFhnq$noBIsj~}J=Db3d_IF&bo7UKdY51W24R9iNf$zzy*Kx6Hr4pvWG
z@#h76nK85-T#q>SRypx%fIkTHdc*CdQL;bg&>P`R^{t3RSIKeo<wN#hojS)?zV;xV
z1u(;So!*@X00;*LtIbsm#E(c9BmX@(Qh{eucut)!NXo}-M}JyQfxr?0n;5_kreaL?
z1=<{29!nyM-ejeAl7HG9Y5-?NBo&-vUz7<BQXMQXyILZmtcFr9UuXI`{8_jr%8>$`
z?a`53Lp7Az#z45CQW$nJ@NY=?ZhPr%EqS{%JwQe+-}07R%7y7V$Vk0P@DU$Jw+X_2
z0wdH)N>9J|;PeTg;D`aN9o|H&<5ZuRn3Uv8tkE`z8P82jOf!zyn;f19^=yfa#V&wE
zmS=UoSuIk3{tP|b4mG=hWFp@WQs^ZiMPKj3o3b+-D-*5mSz5j5)CiT*h4(stg+Mx3
z(dCyVj}Pno-Vwvu_|`a{L2P<?btQ|mE#LN3uOk>&+zzvqGLY!Q9Pt-FO+d?F#2iA+
zbYVKMwm{(f?BWaES>Pi8`Cl@R&Ja#gIHm}U`xZpyJvF80{+BK}=#C!3(zuC{PdUYp
z7xT7j7{I+{QuysN-~Y;d#>hQWc5&L6AgV`7Hyd!o&hE7<)h{y^y2u*xL{w1p2nl8f
zngXaaA@)!F#%#TokbnAR?u?*NJJFol3C$TF_N3B_rV#kb!PyAHpC1Xq9L1c3?3Nz2
zm$6<8M2?})<A<WEhA-WwD{7<f2t<0&_#%nau!Gmw*xOt9@eL;B=}ITKI%{_E0)*$s
z*q20mt9Yc5_aCTTyJ}`?9dk`R9MKucfCV4J>mca{#~_5`wo@&Q-DhM9ehhZ};u(fU
zb$sM~ng;$5w1hd}&CA?EGS~sj9X`6QP2!Tfo+?1uybwJ8EJor#Ous@>MO0EFGYFC0
z0C1mbz$kT#T?;j?;P=UnkLkl)DGxGz7UOvUf;nb?8NCDT0Y<*-H2JMTs?pj!l#5To
z%$m<sbPqdIqR2(rGkMAzz*&n#^L4q*bgNL12kr{farCD&Y&B!{m6<tW&PY8dGs&ta
zXs#Ji0WhnB9dL?!zNB`_kjsoxWGh;{PF>_Qf<qt`_$$w2I^{`>g}?5sA_4kwMa3m-
z0f-cs%Kf~%T>p(^fKy*SX?tM)cRLQJ4N<^9alSs?elq(;#m31a5zn5eirC>uZW98U
z3I%8g{x{kuW13z@f)w$szrPvmqRWwqufBf8!1@XTnH<?IeEWhP_1(U<bSTx<RmAVz
zs4ouEC~9p)Hfk&^ln2xaGJgtz8j#^tlxBZe;dk+k%#fjfa1eELI`|`A<s&#-5jzpl
zB7r|saKINAB1$M?UTb6tgH28PZyQ6RGrqEq&v5s<cP4KB1r{`X%Fj>O))qiM&|7PE
z6_-z7QxUXZfxkF?>wCmjNfQ!+r$T`!6<F{jFk4u)$Yx#&D*L=ndkwyNKT0c-OLu~0
z<DaIpAv&)wCq*9u!EUT(5M~f!>WJYkv$D$u`Y@s4>o^BY!79}c%Tzzr6yY57G=bD)
z(NAf@rYJ=jAgC~3<vDH8h7oV*u6VAasK-x7lG|dk6`tstUclLw*}Am!iKBRvRw1kk
zaHy&rIY%ZYKJWSvrj!rSrGxk(Roqjs^<fU%ZA-H}M#lWM!_nu?m#FC}CG+A}W&ysI
zQtBIenh+U+lAgLHDGnC1`5!(*LB)@r>saM*fyWNYFKjoWYNimpoG3E+C#<0F&P*=t
zyVp}iofsh0rhrr8+B6!hXUqe%Eia+ZM{8bjcIYnoRp(PW2Y$xgF`dL$%lhGnU#sMs
z9r%G|UxMk2>IeAU;>d`>zSx?mn(4v25GY&~WK~idQ)H|1h_~Q9tpZ4f)fms~Q}Y8r
zw?w?1BaOiuP4Jokc>TLbN}lE4Aw{9st1r+8q-$Fwn7V?4m|g-CF_ju&v_JFvmcIYi
z#tNto8(x0YTV^ulr%3VW26(kg*c&*9sQw94U`xw}6oMiRU=S-S8M9G7Jds?-BLBb>
z45OoM&Q`?0pF_6yV2dtjBcr0a01;DhYoaDF2+cSOaF=SKF+PN%?mFE4^<N-`@v*S5
z<N?MfTm@M0FdQO-eSKCsFv2d66Ug*G7M@Ja{ZMys>LmDzLP|m+N`nnrG<lg?&#UQ9
z&_!;S2KbVJ|EPlzE9uz5;11M0O%}optxZ>FrOE3(tvr^6NJt7sFD9Zx!eU^;&m0u&
zTQ`<ej8T%I!b~Z3O5^-6w#Tdu9^fRH_FP0uF*c3@&H%DF+(50W4rad=VA1ym7FYJ#
zm6QmGxC{z7^Y^?7#t)!__B=*9K!wX`9-u~keGkC7(J0ZD068hWCXQQ8qGhZL$^=2)
z;=zW{l{Bk`Kn7B}0}v?%_?X!%ax_=vX_x;r!tKs1C!t1y?QJdX@-f5pE5us(N6W1|
z;AkqG^*wWKDa4+^W$Y{Nmgz)Uf&F1~P<KBFE)fBGeyxi7KOG=K>Fm!hsse6qM{OrP
z#&UZ-)1aA?pE%>*`vOewWj0qLDBdo$nslh=e<~(PlaU!mV3(YM{gh;agxc;a8u2i8
z8YDZ#?5GuPW){se&=ZuAvy5Gf(^Hw_Gm4u(zAOy$CI7%FSzz{qi4e<GHP|m$>G+)_
zGu`*@*H2hoUp(P>G*rwmRL1X5cfu8pCq=C%$oYO_j)JpvBc`vuhLW?aaSlhyg)JTj
zT`N-LtjHY^{z8QvX$-{`pG2hUl<YQ1cB1gH(;pv0MCO3@Qx2qf6rh7GpvZp*HBwKK
zWIFE$7boDFCt@)2^|Y>MV*9M+AAy((FZCCF-)Su>TgHoh4vOs+cx{Cq@GPRyLoew>
zqC_d(s_^_6WH<09xZb`cgA11s$CJ3?W%Bd#eil?6x$mls$-MWXR2k`APyfIZf}XTh
z<2xVlZ#?GNx8<)n2tQsy{lP=X(VRAJu)eFvVVV2?g$S&!j0BK3ba{A#jI>q-9qUv*
z#7Cz<DcSSpM{A5Uru1{Y`{DXIkSF+@S^N)H5yKjF>uW)4Jg(WrMceq1!yz0m41JZ6
z1?}nr62ApgI76F%Un;IrYt8x+({mZg2gFH&)`~_I-*EE5{alMX{>iC~8E$l_G2j-|
z&4=HFu7V@0h44ju*E6w?m{4#D2C;-mh=?Q*qP0-e!Ae}@(|+Ki0z#7fLLN84hT1{9
zTE*+Xg%ue4aed`+592w*XZ!oZl=$3KY;M1mh#M{K=t=5_LVJ`z!>iVxxMP1<5avvw
z&WU^x{=CKyF>m-xenAcmK#Ionrz=3it0vvLOC|yjBM@A^e6bTt=Z2W+e|;j-4?H+C
zZ_p2x4^`cVh^d0XD9DXv^%ywO$H!_E!<*8yZtHG*OB0WP5~e`=iR=bvmsjvy?qOQO
zAPC<(L%f|VzR>_AvX}A74Y(Wo{fWbqnc-0m)R|09Y$Q-1iwBqJ3qQUlg^-UZ@{W^^
z8lMm>SP0hBOWGSkTt>dr`(~<p*QgN|*U%$1hu|ysu19vz)HbZ4c04qJ$qM0l>*kB+
zCJan?#hCyesEwHD#Tpeh?pa;Zh(Ajo_L~CY<dW+_e_WxTKo|StWjm4e5s@P<MAE)5
zp0(@VbQ7_Bfk94h4Cq!Lfa>HYio|=oK)+}?n#_XJ&!N#MF#Qb$Fl6D6H|HMzaR~WZ
zzWF(@u^E8wm@sB^9=oBcg{dHG9u!O9hf=C=X5{9gQ9^w;!%_!aN`mJmTn`G|WT+on
zbbX3S4r<>h&c&Ee-5uVHOI$4elIsz#?5uz2(@<sg!;ymT$!|h7XnGs8M-21r@KxwR
zOOQ@}EeH21;)`{^Co3-^9?-qqz?dcuYlV4ZIzc3c>_WO<qWsE+h`XZ2WS?qIsiqX@
zb3snpla(A=nvh3nV@%S^Uzy&#w&!P~{JBDu72vu!&<aA<8p_%Ps;RZ-oi8WU+SEx{
zBIVc~5NM4&9sr5?^<YAJ$^5~IK3i@nSpayIuBx*)Yrwsp1#y5u98x4pV5DL-CZi=5
zYzVS*dfNj&aK(sJ8Lo(SWLm0)*-12Ihd@M0c!g?Y=%WPX50@NfwE|ytL25l8y&;Z9
zK)jI(qPc`5?O|Z?DE^K%QlPBAYW1b(Y-G`6vET|pdoSQwstjm|1Id5?&BTs5RvKl%
zX$Y~_m8lU9ymrUuq@<$CO%}{20o=Fa<(Ifi=E!15VBL;+tIQt8XJ%io*7*b`_bJMF
z5Gl<E?DOAR0II39)K#C_=qTm4UUq86bh|rDyc6ry!}qI2z%9qTB@9Z4#Ln@;*_{0o
z2r&6u%eNJ7U=(Sh7OFYhH|OylhixGgki$W{K?}|DL&n`xrmL1E8!*}t>fe>3TSpBP
z6123l4apstn$rC6K6Nb+`vUC5fuJAWiH@EPi*|CXYfa1r4dEwX6WYj87Ocs>3s>ga
zB!g^VYnF~``aU%7biTSkWei(wr`488Q%rURw1<4pn&a}*KVN$~iEzA%P?lN|;~LnI
z2ZBkR=JoPO_e&HL;)J+EU0cO5KRWvC^(S7*Xl!kC5_t{_J%Muzj<L+>kFrs_j~B3O
z_yBv|ZQ071b0PNXs502CIm6J;Ni>Tzcg-o*<13hA&4F!Oq4zEbho0|2g*=6RLWYg1
z@K93mP|%N<YPNdC0R(K0Hz17H#~F8X<BQ275Div8JSl6BD?qj`Xl~a3{1NfufWcx^
z(HB=NrYo5|NlVK@+@Zjl`d*2a>ybmtmyyU_%L}5!steOuL9V)<8T<4NAEIxgZ^5t<
zQBCeEQc?16$*#$Z>X9omU)ju+Nyb_U<6xxbpj{vLu`5w;hVLcurul(Fk{fKCDEQ5Q
z#g~`41<&skTdSitq->}TRO@d!*#ZZA3|59iEmc%fvg&-#sgs|4-#bp(lruG0%fL;n
z1SV8MV@@?fMT}08+IRw$J;WD>Ic#HoBswjbo0e)SPApL?X82gL$X57*mDU2p{InM}
zUw~03_YVtP2SIAn_OnUd#sVZ<EviWmJAgF({9TRk1kFI?n(r=3`_Ay|5Hb_0D0KiD
zG29b97YujNF^~1VuhtnsiRq^3&$&Pbo`;`zSem`E6dPDP+KT0J-`d~CzEZk|y?pGl
zqDrNxO)}ejfJF2PZ2HT0;2UTKKK1hUHNF^1<M}Kr(%<~*%91t9LAE!TXG_udDILXm
zd!k$arTuh#9AbzeJ1jCcH$Q4qBQ(DxmQ+37uw0F@682oAJ_Q{p`tc!RkonAbmqMlt
zkHcUsxF5R%qcJO{?P=pdp1ZKop=1drNNt1g87-4^(RjSrt>OJgkPVhVa6wgo*yu2n
z*T6M>`>zHmYYaBWPM~GFv_Dz$+axO3CB#J6O&2*%tlO><(a0+0*3hUDg{G#YyuP56
zQ)^dDBa{v_K3P&%yCK1+>U@ev05^q#7ljkJ@@F@;J@#h7<9)<=rgXoi^!}4}1MCCi
za{&%(nsDs{)et#0pY)Iy$IS`k(4O`{yYc*dq97G;JX%M+VgO=aF#ZISmO}%N=`G2H
zNVqBnqC<#ta?A&KR^kMmWq!orY3lZ?*J*_V9~AKF&~4d5pgTr|45W{dWMbTw0-d88
zg59GVq{jI<hNC5((1dUSQhgo?571KS!IlG>HQ;f+AZkNG;p`}E)G&}8Ow5}Mp?!J<
zytSUL9ht9G`&%Af;CSH88F&~_wyE(TfCrH5In7eB{7-unLhi52s(BssM1PTS#<zO!
zkF^)O!=Sh#=NLzK2RF<Y?KD0)jSi#dd52Cp3~~S{AZeA>_`Whm<dIgkj+*;lJpvKE
ziFSDxnAYbRkIq6Dqw!vfZ5mv-&2U&W7`@m_KPh>4-5hOCv1WX!al`h3dxm7-WeWZR
zl<zKAM8oyWyMr$4)ksSZh-w24K^y8$v4@59;bzy4joLl+LMngb6T=@nH@$_0g(u2S
zDFR*tm%@g=>%8;gU-oYwuNN%U;c-zz<{%Vi#Fr3|l9?U_m-e*g1Qk@1J^cX&q0#&=
z6ROWMk^=X}LD#gQ2IP?md5IwQu7-8aiBu6WXJ<IWitriVr=!p^JemU&_hT-huHSh&
z_%VZ0E*x%<GcO0p$m{Izn2T$<=EY5VI}`q`=R$LS36DCdp2+6TCQ+(0i@<4{MvcDM
zSCST;U(&rsf^8`WMt@Uysg|OpwDyLZ+f=e-L8NZPQ@T@XZN4oE!*jE$$z$x!=L+Lx
zx;`?Dug4Z_(!ji8n8$%Dx!e-Ue47cr)q+4@U+{G%c=R||0N>vyVZj>2Fg>BKba(pq
z=1Y)JPC`N9wZi^z%&s3hgcu};0dn4<pE!Euce4fk-ZSExwPU|vRE9%j1d#@)(2oIX
z1Nn%%gyikNT4JZ%B}O%?C0Qz|kL|ppM<f?*qUf`esiArj68`x=&6sg)8HQ9Y8vERc
z+qVYXFJo3b1bfpYNKS7Kz3Pxp)o<qBpKKI#*wW_Wbp}(xO?~ish!2f~$klI^qbj$@
z+7r&a{BP)4ha@!*3!d-da?5ZvgHh085|sz1L8F}%i6NrwO_B~sMPx<(%eXnv<c^#S
z>2WSSx`m8P9b!9zq+rYiY}nPueq?2=OqN@lJF7aGaRv@Kjww8;#iaC@q2`C1=7-?@
zR^beEM*Q^av0ULuIk!X7juUJ*)a73x96U!$DwUWW#daO-cEuhMC1Quoft!L_k10aR
z@|TDr<8T6S47iG45tS{Q_;~WC@w{7_-t`VdXqB$-S_-RN6BH!jF;^2OMLM{PA3Y;q
zx&4?m&py8VwU4()s3Z+Aq!$OYmcGo{Eno3`122Oqn~F#RWgN0T7SHi*F`7juO>|D8
z=c!F-KB0v2s<tW6Dio=^ff~a!6_=Sf8k1UC2ws9aZ>QUJKn*=&zEff(2;Y~&@}>f6
zl;nn{cX!%@N*~!yc_f4XSILC0l&&ptUD+HS0a!?DV|FJh{PX3*Uh`dbZ}UxkbG<IU
z3KFnYQwhQ@=3Sc+XLCo~wvR{#<(h%SvTIA_5bt6FqO_@8!w^ekN`5<08cF3e*_rbY
zlXo~)`IUdg<B*+1&%OS&YPyKNjFrW8W3;Er49T=%AGi&NG`tI-n}KohlM5DJvMD{y
zas+4Ap(#~0U;p46o6<iWbx0cUzs%`x&kn;vO3uY)s>uJgUu<q}zTMlj*h4u=!IP4G
z%_zHJ`FB{{q#YX5w8`Y)YgyVPj;VXlcbWRC=_qVJ$5SoZiLSTdk#bx9nnZ}iSm-)y
zl~L|zF{O&8^oEECoRgH~w6ws-DSxFy^M4*u-M9N(?t_f019dndKC2$~?qc&p>p(K!
zsxXLx8s@d0iE9frc6D`q3TY}3vvQ9d9JWH=`z6oD4%XB!h@?Bh8;%m-ijprv9e#Y3
zMb$kTDxZ|TBNyYA^a~#j%+?|78ODGRf2i;Pu=e~;1w>wXqi*T!^*xm~IBc(!6R)sV
zFKDT*(6Kxn4?(hq@5;>uNI`F&nVa*}E*69d?I?dZx`pmX;@6tfN#bvTBTz?)Hj*JB
z7RjS%L>AufKec6g@7b(~OZHqTn$&=CG|>(4^eno-hw-iFK=63#<G+#;OhN(q%e2^z
zT#oWxWS!_XQO&5PIEJw0K>EzRx7nEzBz%H3w$#*`_^nviNxNAw6hA93zu5nyIDmCO
zoGCq=DzO3-gpNoaNZ?`3yg%ggIpKRy&{D=+@B>w!uq1ZHT^_W^B0X<#<y8@%Ig9<S
z2+R&8{JZzd7fS9#5&)d=S2!JHg0VGTimTzYx#%(;`>4Go$PC^@5ZO^HZ5NxcS6g%X
zGtdNL1o?@V?&R@Rpdeg^-mCPk;0>9@em>XFGp&zHA#&nD#*uaQR~2B69nvRt-E?g!
zbpKFzN+lMRP^bb)n0tuvm%o6Z>gkjaE3z(=a^cm5Fgnmgwp#}s=+ZmfnO*XnffAxf
z8%*~}&OffnNq}rSDEhWoa3<xPA$qo5)6c&sY=>k8(kN_BOu#BMEa-!e1CoExkcG!V
zO8MAUw;ogeWWN8qf!W3Tb9PSvUO78ISbTUaC6m^0{jV_6B7=~3ol6kKdayc9VP{k4
z&rcK?Y#f~UaZxs6-jvl39hp;suj+m%j;4lgJVZP>!K?XfYHGCI>im+<E-CxK5;jO2
zD;FfKj*PCXdfxaXKoc<UWW?YWk_+i6Mv_ev2x4gN+hV-u^ZDqE!t>V`4xu*f$`v3x
zE}fkRC{pmz@L*`S+v)d=?nxx^GIFhz*C_wgcN*8V`u!|=nCaRcyT<~qyNY9D@L?Ij
z0jro~iD3Y<_}aglv4<qy1E9O)Zj4rL2@TDrmBu_4eZ<=2PR2O0jrv$zeab&`Ht^Xv
z9T22-+{En_pBHaMjjgV&tU%<tN%2<@FAK5Hg{x2XJ4}OzO!VHztlFt=!00WKb-;Jq
zWtX0GV_{%GQwv60bPZX{0_e8m(b3U_4Y@Q+g)?+a)r()^bR(Hd=7T`<abDR>bdi{6
zwpOMf9cY}gg@T4_H3zn7ps$D;K8nq?okr8XV;dWqyZ{L)@TO*)$-N64c1Th7*a6ed
z`qD9l@8g{IXERGCep)JAb5#CbTDS%5s{cBL8uabM(?PXH6H*!Pzq4*MB2XH_>hRSx
zzAyYm%%G8wx~jsvFrPJFQKZi#_m$t%f2vG@RAR{UapPCGGah6X%LrdO-S^2+#ybb|
z21LCOj{Z19UQ28xRR4D6E6^+gm2Z&GCFWCIV<Bp*#?!y@`V)S)t$l3uyM;BS@$vC7
z6GoO=i>|U>R5<`Pl{N>cBLooUf({ThH|8+Dq666w%9eT5rp76~2~wv-S$_smlOY`d
zlit(RP!;gpoG-FY?jfZgH@Fuzs{uk70Dvkg{<+5KEU^Z=x+gJSm@qExXkb8X#5wFu
zJH(cknyv<H#kcoV;c+-8M#EjUNbK4r#2S?VrI4Q)tS4!0oUe^E{){`iu;(nTkZp1@
z&mep+XVXrU1j583eRRAO1z{Fd?fmU-XxLdR)BMOikK?BdW3b$@r*$!Xa&=>a7}5-2
zgNSR&Y;W3wyeb}^w{I;4El<l$u<+=|LV5y*@-0hhHyH0$t`=r(o9~bT2;m|kEHbiL
zvNcq67--K(uUi4gV`@|QqE_cj$my(;SpRn2=eFA?g<z;fF`1W@osDfpSWaAWe9uCq
zy08~O-^Gj-feJNy&RX67o$Ie*ky;6hN?oC%p`&2P<LiLA3R^>ujJv{dB#~@)u{Xg$
zBX)8t77Pi|Z}IO_DZa?UD0~7-c$asf(RBRn{k)s#0jr9`sn@w}B$Y_omw38Pl0Qd!
z%}i(sI)9Y~M9}Y$&ndl5N0gYv<*>Z5fC$KSO9%H)v~BF?o0U#Ao7D;D1F1wwQ`6j}
z32DACSA_{xc8G&Pu~d~nEg;qnxRaO~g80Y64c%!kS>uu*AJSW&@p`s}(%^iijiLU2
z23A3a-qrwe`tjYD&C0)eH_%RvtGUTmCW_tpi!7d8Oo!N6SwEpIO$JT$XpkwUXmMnr
zg-HZ^IoaxOd9pDeE2|nhq<wf?ahYDX8u8ZqlGx{nSYl<nU^5AXndS6mWN)HOgr^<M
zo(UGw?i7BYl-7DqdSj8A@YHJ2W^{L!GQqZbS>Q&;SvF<6!l<mTfu+f4;`e5vi%`m0
zW8R+J><W~4k+Re_!DHVQQj&Tjba5?R!u~*IdSkx%sWjmr#oyz;)%lzAyyY@^5Y#nT
zyUS5NQgN%$I}i-e9V8^$%b!=rzk2mbk%T3rPSk1~si4$)cxlc;W-a6xHQai=;|veC
zM9bYN_UR|gYgmj2pcssYtkTmSoC!Nv{c{nrU+ams0Y}SW>$8AJ!Q-A}pX~(i?e6P~
znDT?Mg0X|MB*7X5vrOz~{%=w*r-3nw7ep+ppdK1s9z5JN>%&vT@iaI~wU3|D^m^80
zeq=p^Kzz5g{o=~fUL^$U^i+PsfU`@xS?(>mdaqqSaHXYAYLb6Rq#otn&bN;(<+bf5
zg)l+$e$L(K(kxcpG<h%NfDr+}Bb(dz!K}<58_JSh$%764nitBo03}%p$g;9wbN!NM
z5P<z`->kcdTLe#J*OkM%>wI|bz#z=}XUe8s8EbvX+w481jnFdMS*LU68=Qkh*K@{`
zj}9q=ngXkFDY2eIlpZrj{F~MdamEi3!)tH5X?K`6$-jB%8mFBIX$YRQchhxmdp^hS
ztM-4Y%O~Pg>~~W6(5KqbG<VY)tnIKUI`$WNpOL#b023YBTUAv>*P#Zp-M-;OB+i?r
zD6%b5{Mr(h`pa*(^yNjnKc+wpDJdx-&AM~}gPaZqZiz)z<J{`s6?LRRrn=Eb%U==U
zO3#`PF`K{K4DibfWQ2&(NC2$$6E^&6C@ryl-BdF#7u!d0+_r9j{`C0Qe}|DE&0O=d
z5&rF2bu`}46M+crKgdVdn&%Lem(k2R_RJr>OBD1B?Eeo@SJ@WT_qCNAdT5Xi=|<_0
z7(glM8oH&sK^lfeC8U0gAks(<&Cn&KbR*r}@f@%Ji{}F{TxXxN_g?E>cW}MU!2)vN
zQ;jL0+dA?w@N*cOrsIkRp_<ULq4L0H&XS3sdx_ik6(>}r%>47-W`$9?ih`HEi~syn
zHOga1m2YPeRy{a^`k~C$=w+Xoj+tr3QTHrb3+`s|8DR)`=Fza=a*C6TgxfTEXb-js
zQl$1*RsXtL(Sr4%)B%69g~o)av`-^l9k*@HakUvuGuKXTxN+O=ZE+3C*8tVPEkoum
zS*>dk2y@NQdh@l(gn=oVf}W%26J}eD^F-swW^R@24=lyntC7?NX<+I*bWD;BTradH
zx53JcS44-9b@DRpJ5yPIrcIjI0CzuR5INRpoC9f(#j|<ttVEUS7mJS&sgQ+x*~yQ-
zJuz2l>;B_mPz!)yUb7~~U@g;L^xq3VSs(2TutCeTa`)Tfx$__EGMhdh={PZr8kzGG
z(s4)`tYw$O$yW<$mcr{_`5s&T=*DT;r)tOCF;I+T)v?ST7(bBa`lq!GRRPl3Muyp|
zU!1HEeb`5@;;0(f{MN$ZuaiJOs^dl%{U2~CI3?4swh%Vfrld*$#!!SzD_-BCA>u-)
z-8g@z3V-I?DzD`;F}_vme<v39E*W7`S>u>)u3x`Q_|s|@o8zsbtD$!T)lzyO-8`w)
zUH%2?NzbhJL`9x^;y?}^bwf=;hui>RcB;2)JJX%|tmUT-_SyPuhd+KLH5OR`2bv?n
z={X+hz#eh<<XItCCGDmAOj(T9y25w!Fu<T9Hb8RHKxPQax`3I8h`h5R^lLa)Y=8A4
zUpdY|`IyAf#U;APjA#{?EjK@mE$ho&4VipkR#&CC#kd@dVm*ZW=^lvk6(j&0P9M$0
z)0vbWj*o)xEO(=_r0jcz7caLAwzOVyZf~VgDnI`I(Br3ou_VwRZna#rdoFkd(3=H9
zFP(w08P=lTmp8T&V%*(sh1z9Ah;9Trh_DOU@i=yNV@Yo<*RIt1_G)Yr`K8`4)%GuD
zER;T@-jBWoV7clui%C}2Fj-dn5;i6}Xq3Kpi?hO%1*VwF-CT=I<Xn~+76S-j3lksi
zi-;y#0Sio^LGO!*%@J|yj3EUC$IvNRG>OJEYBz`RC@vo7r4~wA^6v?@i4pv;4s&!~
zCV%$5#&5bU?ehAa0x_1MGtA3KZ|h9b@%ZVCVULDN-H7zs2XjfRq%J@d{t#T{)SOV@
zI1dw8^Rtrpv)`o5xF$NE9Ms%rl{Rn5e|FH=G(9@pFwJgXnZOAibmMLYw1Hdf(*%3s
zYnt?8a~_}yx9g@s+q)pq5o<!e9LrbJYN8go4@;?MPbp9N<C1P6`Wl}9#u0IbB9T?-
zp*U+~-3V)6Y{o6BQ*5}qg`VDYli!pO+jPk`z$t|x&|+h~Y@7Fxg-Vx!kNuVkEAEmF
zW~Gbgd5;S-&ddRxtVshQ9Kg)iYDt%_Ladv%`|ke!UP6l5lggwB#LndFytk|jYy>P3
z82!WhVh;>}&ZK+tnil%rPooa4K1Jvq(K$B#2F4W))c(Zs{ZvPJcMw~C^OWk+Jxeks
zN;`Q(Y@`QZ(;QIS5m|8R5DTT7Y7Hf67)0%~&=|nHqL(E(Q2wvlxgB?r?fF!k1HHvK
zK;%Q@Liy(0Tx8ZeDFA*<j#yn;-hlFLTbEgj3*Vcvk9PU(O?HtyOjd7>-*ciwM||U+
zGk=RlD89_~JCFRJ$!0D%?P$Q;O8WEx;?ov5ZJ^%CW^J$nVO~zRbiJ~coCtG@n8s5d
z5;Y9v)wk(^L$0WM=6@{~c^n?rlgrKb`s0k;a5rx4s)^6zPPxgm`m`3}<}L0~c^#zZ
z9AIoQ-ql!4p``8InIo5oac+YRz(>-7m{%#zis@>3Qh4T^#YeAwoePsON7_WbZ?qN@
z!ds;8NU*A~Vt&h#0D6R;@T3E1T8sO>&cBvPo=0wJ67Yx1V4VHt#4DJ_0Rx0lB?C3u
zsXjmhi^31LIOh*&!n?XwQy;{lmZ`1!@QRhQ7USwATh9XmsHL1#R2calx*!dXjF~Dd
z`ibeEi5FY|w&u3=$2FWfJ$JV+l9<sTK#}Un8#AC6W|;vTqb9Fz^>xaV*(Ht@r78JM
zpuk&kNQpyyDHe7shb6elwS&LE25l$5VM~gsf_;YlARjYwL};j*dHA4pw#7hiX_Wz=
zJXT=OX8lnRaCc$YcXb0qT5itH&KlB139k80QRv*7Z#wuGqo%}$Yh$RcxpE~0%5~Ae
zdi^OIHu2UO-jRYgiN0t9wPjn5wn%3^`7bLX=lAH-rTwC6l$#rfef~1T<--7(!~sd#
zD~X(=0xW6Wb*#K-YL8=MADSaa-|aBTbck)sHuc}IRvVm=E8uT(e%`gBZ=HpmN$a~-
zHZE?4-ASkXP4~c@GIBs-8v%|UdczO!Jj)ptfQRze@Nj=0s<6Zz!Lo}#MQ<Mb@;C8k
zl&t1T!B^s+KGGVMUB$YzZmGts0l8!A8`;3?l6X4Mn}R+9W3TU@Qp=J620{$n*A;7$
z`GqKrPOntNw`XEotB`NDKo;s}(tDxWH0>hDl-NSjScZ0N>>#p`c`GH@FB)Nu|Bg`8
z2JrqonaE8>oAdU5Nd-2gT4Vtdp$Y34OgtoGGSMogopPfB<tw0)4UZcaT9k=SMU0%=
zw(fud8ku$v|L^l94sM}9JDqAj9ZM4^$2!fb@Ayh1;K9wzt(3us_!n9ns&Mt8>yv{F
zub?bB#;+C=A>KR&XGfsL0x92~wd4wggXk%urRDg#YKN!uw)hG1tSNhEa+~pRy`^n(
znW{66%qbIloNZ0g2E3~hN$tXp=8lHvt=)6aszVG$Z(7*;oZE@_`(_VY0vxL)MS~qt
z&-T5t334h4Q;vf~)qO$|5w&*Gqr4ShP_jFZd+<mT(u<^$Gt+w%8Qhnh<#E61>lWlj
zFcW};;=~x<ni$wQJDUL4;&3V%R~mpIM=|&TLhS$i;R81tcQU($hJoJ~!Td*9Ndp^Q
zWj_uEBlH1vTEqc>Ujy;n!Q7<R>@Njzx41Zf6pMr0#;X<NOYJPo^lBCcS+-TSXVIj-
z<BrR1k^l_J<Z3t`9*gm3)Qw<ZbKFg1aHP~fGugz5yruu|e=EhZJ_?#@uI)RtsbUX&
z3KmAc@1Ctrnl@^1PQ-N75Tc~h21c;$_M#}HmApOz6698wBoIHprMm!e3!(jyfkt~e
zYXhuYCy_^OB%&ctZ8#(bzW^TKOWtf&o<tz!kU5JWn*1ROHZoqf3X(LHJTdDDnw*|a
z@ALrkX59v#jbi~ilP!l7#zIpG4eN1c!pS|>+L+ayEz8b}`s6`1!(mWv=Ivc+q71L_
z8NYW?j{?%uSCTRssmynJVU~9&)S4_@Wil#hKl`0mr)J?`h~ljFKk@?as=HG@0!st+
zisFE!+sLlKX-SOP+_J6Qq=3Xz$$dZ%oQpd1Js{pa@l?87w5cyKBsM@rV~bo0Kf8#U
zwf-PC9E2~zg421Oz*lk<O_C_rumLpb84^Lao+W_iE(z}&LR3%@DDumZAE!x#O?pXG
zmFOKlgv-L$0@PUP%DZi=#s{P?Z#>ASc*($GFYEw+Y9&DQLU_d@OR|atFe)j*Wxpw1
z9GOS47U`X>@)%qdarr^~Lvbfo7SDhqBonzGLK{oG3MFpDk5{0Vt&<o?N?&1rQ<tud
zeFj#jMD?c|!!a+8S;4NOL`iqYb&g=0GUQz=Bv&L?2?79J%-^%V?i*Pidw>Iz!pQQn
zR~ut#3I|NnNhL)Sm4S1=XVR%F@dF0`pG8}4iN^QFgjX*loL1bz0ez;O!Bp>KD$r+n
z6?LbQ@sXu`D{X5FejZL1K<1cR=;wPpb8|+qcVx-8^iH5Zkh>tmUfhK?@8Z10k^Ia`
z(ot@zZ)QZ0R?feLZT|Ddr7v0b%~|#EthaBDnWQL>qhgx5n8fIaaGzNcr-+LvhN#Ki
z;!2GN7qW3~uaWJ}1E|S!sJ}rSnxD*!s(G*O7akB>`zC@uZTsYwSBCSJ?nSC2eCso*
z5>|!_oe!xIfI|#XbW~L8+{$awhJUTK_GblCYu?1jF@UfCamlC@>uHn_uH?Q2WP=$0
z)(!aQ$KM;ZprzhTxsY|73&hhbsV)Qp6?21T=pPj(WQ+Tf5g@~G|GVHZmL|bY&srR<
zjivv^YH5=aJ5B50<(D`94|NRG%!=Ce!YI8iq6v#J0n3Qqy>wCQfFcK&k8z8%`y*fi
zpP{Si&z-_)>bAENO3vgV)8WCTb!|m06Zg!GG(ItrLz}wGvoVCqt=s6W&=UaUIp`!<
z9B~R3Ln=t*K~Ag%^zVQef(#CSkkOyt6ub<1M5!Z8>eGMzkaUhQ|7?0|C?zS`8Y6#^
z5pB=v*G##83gJ%Uj!Mm-3PoFnZ09U4!IvIUHV1AgN^1rd(&eFU4Gvchz1}yefqIE=
zQx~G6%#22)tmZc<79Y&xcRyC+qWl-Y<t`!6?-w<~fH0u|lkL*Bx01QjkabOq1o9B+
za?HD8`bfJ6x*IQeRBu^761ZnySJ0AKJ%K8_Kfa#=D3%dLJb!7&d%0zeR7bc$g+J0j
ztJ;M)=WU-9zo+Hew-TPwYBCd-K3;(|ti;nLk4M7F$-eZF&_qwuS)JrjpIkJ*U6D+p
zMo#KOG{msS_>+!JoHzjr5Kt?J->Lc7QL1;2-KTCVWBFh@S5nFn)UGn<PylbLnh}LO
z7<VlnWt9}gQRH*|A0_n|FSl1GT@?;3RCAg*Z&YAJ<tlYK(RaT$WBXr55w~6C%S~^*
zbe55jquf&&g1T`Zu9(RCauMb1_R7A^72|w%=4b4m8<XK9$Ne%3^HABUzqA)b^n%HA
zXH;Q(LefJS2sN0Bs--+X3wSHdn@;bTE#~zBYmL0uKgjo(f?q|Q*I?BW3w6^{^!rcf
z6p~_S-#y0m$F^Ntoc(Mfu0FvK|Mv1AyqUle$1;Em={}qLa9Az5WEOAju5u}|zA)@_
zE~Hwg@Nila<22BAY>+m<KhQYnRdtrWA!5A`MXjOToIl9C;P1T|@=CT$KN#}zNiq&u
z&Ta@uSa_h9PJ{YfW&AY0F*OS~^zy10sJ>4E2EJ+M9s>)Q*MUIRw{=jG*~5BU&|R|2
zP~XEh^xw=T;4aaI62A2!`tuuV&C*Xp1bZG5@cys#s^}&YKrVVpHlfi$ubkxW;Gy#H
z*qx&At{+|gl`ek&of64Lu&@EnTk(i7`E~J5iF@x_k>O<mc5wt<U4@mV2_zydy&!?W
z-Suq+1_*S`udlb#Q5eswTCiXjKI@CW*2f2A`gHSj?=!~dFGN*peVCqZ$NLnnOh<6~
z=7%8~&z^?GZ=B`ep3hlrmnEEGetg-qw+l4AXV{XFH!qYcsqf5t-$`X8Wt(RDGyKIU
zVOx82adHCcbc!Xww*y_rL&+Wx20f@yyx&<>0F+LXUFJZYoe$I9_Q`8K-p2N?Jc*Bx
z!5ihFA~QEpNpX4pCcftx*gNt5Wom(5iN@*~)zUEr-B6wH+TPLE13PoHNoq+07k~$6
zBWaL$WF92yyidG0B*CtlFk0<I9XFhQV3Fm0XCsw+=AXH<&>^*vvGDg#rz*H2><>PI
zXD$&tQRayC8oxf$`jEfz3*vpI^3*3kA!{_E`+!6Kwd;-h3!#S?hu!AsXMN#8Lr>3^
zd#<t_Z01C`p?=<XZOuU&^mnNaymy~A+!MF5J@D)Ix|DJ9CBO<B!N`Y#9&T&mj$4hJ
zIc+C5x$c(d5XPUm-!_9gB&|LT4+#i)ilXrP&UiD2IFdpLAXUedqq?j??<OTG7w+SH
z$@Z?&R%T)M$*|<pzYHOaZ}5A70Qq$fytxn^tBKU%q30_EFNk8G{q1#W7OG0cKXu4m
zdB3_}@Xfqt*Rf#^B*#M!rt&>`Zun8F4g;<1pVNv!?EO}fgbh(!G%*l~E*nD&0U1!X
zBG}x~xwyGAZ3QF{D=bL`BW%s3m<#bhBSi3z^t!VE|Ddu$B)bHaIkm-#>yap~kHM@J
zG6DXXT8(7DWkzBw001k@5{=sk)^~MA_`Z4elQjDah#`Z_4R>$trX9Fg&uEx0dxWf|
zQkUm1Cfbs2GI}Y7tnR!eKczjt>v`O`-{=2MllPEoK(`h8v-&c1A7{DCZPk~rd{lfU
z{V~x1voC4mFnFC};U*QKzd3t$>13g6J!&xEv+=d*F4-aS@29^hXRejSP#-RzhCLH;
z>h^ubf8A?;uyw#;eJ6v28j+tcTD^_jsH6MMVGJY)X2s}xRaKup@LE(z=sTzw&6iGr
z6ynK)eM()%QXq#ty2P3nNaW2ZW^qhw4fAG~9gHXGMt-zy^bBh}2;qOLEEY|(P4_{T
ziW8vf{Mn&9`5qY=`Rf+56(Y<QQbce_^bgOJ#O2*JSq~}FO~uc0#gAySW15c;_&g7)
zm+puVswQe;ZFP2ccmEA&_gKnhT^<j8+VAL=PSY9|%0I;an|0pa%Oyd0!i%O9rSBi(
zv378t1CcB#IB%5Vn)@&IYew7jp2%{u0Jn&-s3At#kn{ZlUqwFYw>v*qW2AKfKX;yV
zxn&Lh4#K9uzAlH!4}(8nFL-6|{6}QoU9GccXxZ<9$He-S?J$jq`gG*E-nf*Qn+I7P
zAA1ZBir$KxN<T|Qw_iTXewV1RmAm=^ZHq0hXQ;=(XYvFwAM+-W>9?O%6RkUq<krk$
z7{q3tBko;H-Q)1Y^!m^TuZwP`+m;Zclz9E4n+WIm-D4B@e2f2sRJ8%`9Ng*WeDLE|
z$fGVPlQUxHlYQ>tHbn%tF8*UuIGx&E{DZ}l+geTD!+v4jbvJ9`H`iXE5P$#P+5qSF
zZN#3XU!6qXIwfx92X5ENokY0mtw$>vLdYT1A?}bl=qFGVJ)C|89QlD6g5+hdaN7wP
zNuG>}S^@7He6<2Lwn_0gAmHwve(W!Xj_SMPUAi#Fg3b&oU|9GC$T2x_Olk#SQbSQT
zDy^~)pMl9UqveL|`d?sl7Vdzpu@{<c7!-2h2YAXdJ4v1T1f6#s4c$xb4UleSL)qNv
z-)@e7LjdFjb)p>21r7qC+4~^EIDZ|LsvE3D`IWX|kF@f^h7~TH2o^$x?BxF11My|8
zL<(XqkA@@ML)#7NboWHgz!r{L=efs&D_xq9ZtuXY770ZVV9r{x;M90my{2<bq3uiO
zo_P4$r^56aI)PEP1#_evVcLD#HBprI<c+AT3&`c@y8Ms>NQep8t67$2-?=Ig<gc^>
z<MeyOQZrQ{d|#VRrgzD<xg|u7MbR!=7`{zRuk^o1ib9mo`PvC0GUt;G!YzN3k_wC0
z^ULoiA&19cRPyLRn$H-4Il*CVhJp#P)69S5yxXsNSaZwyK9r`==L>V({AqEEq;0B`
zD5Q7IS0tPys6jVRx?YNY`fZw#ZPIYDSo3bZsrpV6pe%i4K6Cw~s0Jc5=Ju541qk`W
zdlhw7XOUI8$%G8&KiGb<|MvOJWKv#t;Fu1fvBmF$PtDl$T4!F;yu`Pb(<d3SSqwBC
zaTf`Zp1*KNc%3>#z?MoV%u01yN3Vl^nrApOl2Q%ONC7LhQZbizC#ku-Yskp=?(0eg
z6e=ap{=TYnnC6)T^a`gnb3V7JGw9BwkS{XA#~I0q+F<}CPY}onD2k>-O%-J%kJ-}c
zjZ}7bea>G^FYw2Z6q4@P`J6!r@G|dG*zUZJJZf=7;~b98h~(d7C?fAJyLx&&P*_R5
zH#x@m*8fG^4h*Pp2g(6_g7Zup{d{@Gq7{L`NY=yQ7zM6oX^<b@)3Q?SE+qymEvRg$
zH4@^IQ^W9kfN7Rs!hMlI``kVcA@0g-k_Ejh(b$ou&dbgeeG53Mn{=8ON9occ`=fpx
zc_H<$By)RvtXSlAul!&lV!ZPccwlG6z>avS1RD(GB$1CF;1vU@4LpqQ<*Y0+uKxZj
zR%%Pouox(t!2wHUbU*rG@Cqm873FmInYkSL=%MCCMDlB7+y@`KCGOi0w@T6u5CcC%
z8nfwQ8y*8e1$1K(jC)980v_K{6;)Lv%X*v`yLkP!p_!$OL|BZrQ%>A!_o7;=-&}No
z1w9A&X!O?LQ28fnyZqZt)KKM9`ITsYz{r;lh5Vy9WjDI)U_#3eIlIWUxCPgGu}`Ll
zL~BCh#o8m9&ZFkk{)9E8jo6`#dWS%lMgs=Y*iXC&8s4(KODS!kA67E;02w&zGk&j}
z>>`AKVg-fehsEJ}R9!GDxvxQhIVf#JQ!oEMHhQo^4rA)}`{5$3l=Z&vs{NA{VPgjQ
z*pi50ei{ki_W(|zk|Px)=4uEe9DWl~85{wKZ-n{)YTH6zIOxu<Pipk?WpNiKU}E7W
zscqJ;<cxUN+Myg{5fs!q>jR_{!-&C+hfhQ5KO8EXWWQiXaoQx^V~l+Rt&-oYasddV
zx_0#q6$t}#y`52^R(VA>=unH<NF^W&UoC<S#VH_@k<$%V<NhD%ZBq6-qkJ7M8sk5r
zr-vzHyG}?*h|W^<8YwETpiGMmh+SCd#h4sEk6+r=`T6JlU{7?O8e)wJFddf0^Fu48
z%W_aLAD=6IN18Z#I>;#%_urs_IWviATk?J^fA0^fPY~Ry7Y|ag?}~1=zA}Lq350~f
z27EZ5r~ZoWB5Zc@C1POC^;8_D8WS2;22?qoYlt0&^Pv>`<+T^^>)cXay@Z4>NhN+j
z$CjlwDiX#w3pOA<XA@r2`M#VJ_BRYOA-Kqvm8}>}Nx<c>6=36#ygGkb_l{ku6dog8
z@ik3_#X&egXqJy2GyR$R7k534&#Bv>r%qc6gN~?^+qH30R<LZ$`_5+k<&wxEWp^P2
z_#Ft9{r44{yY(nQB$3xMjjJH3=ZN@KcTpDundXpHg6<?_TqQFaFaWw&*Hvp!eOiH5
ztb^5Cp~#STc#dsU1Q$O<!jq++7YA`oYD31Uak5c>p}y)PH%kWVm+mOGuRAFzggfz9
zLjdmlk*@2fWuMBVSP<W4Pmr^7;s;)!YCbx)e6t`TfjvJz-xFS1<`=b~@Z8)CVA@@1
zK-|pDk#fHJ<*b>eaSwMqd|iqc=Ro|YP9^T+`v;{sO~I*aY8vrEyy~2ipZPKm*|bM~
zXH*xrTbPm|Ptx4_GRdhh7|-xPoe&Uoz4_R8B>SWW1}yhItwrIw(Jz<&%cG0Vbj(fm
z%@4T(H;BvCL|@db!~hR#LG~T+75qpWLQwzDE>B3Px4u<eeO`_r=n((n-p6FBekz-T
zHDKwF`6ZnmU}{cg^eZU#xE+wK7Jsk>&ZF-FlBXYtHL;lU#NAy10^QNYf9r2I(S7^3
z8I%t3d<0lBS-(8HqKT*Sb(L{NUqkAQP(w%BB-U46(9&Ll+v0BeQS*yPMLE4UI{kWy
z_jO@VKeGfbLCIIIw7+}_T#HZ@lKyX^D>d2iQ5T^4MI?(5ehGJZ16ay1z`mOkt6R^Q
zxNRAeoBmMp`>8{McMOxo=gD8#(V9YvpvrHEq+(wHt|2QM^4;Z{L@k*^$|<S>N3s9W
zA6fyq&JCK3!MNM4U9}O|X*c@uDKBGN6crUEi(kFylP~I#m*@Gn|7^L7f$kT`jiZL*
zYLsEaJ4r(12xTq8Re9)0a~Fz~MmjD5B55E16h~pEGXjBjnCbPcVd-A$geBbp17g0b
zBWf+`JBb=|u?38P))0tMJ7r^>OiF5*^Q}*RM}d!4F@`@}*|{loO3|RqfhB=;kc4C|
zsEMr|N?_F?0o+p`E-$@JOW1mUYJ2_6@Bc#8L=IT=N!sQ9`ge#C!halTNR@I95!Q*#
z-UH%ob)~YH!Pbk{PPPP`sjnvncG6N@930L7jO3s74YT}DfOb(;2ejf>sT^my>f#yy
z@^yTR`i`*jVZf5eTQlTf1J*bI%`M!za4ZvE!sZX~+HDL=9i{%%yGMl+67>K+D$(+>
zB`7m=xkuWkGE3zh;W&NYm5`qe*S{9$7u14vXb2SPZdT4`N|UdZxrC;t{uM8z49q;h
zaUc!{%zp5B^j1>I^AP}J`3pprq$hl6&LoN>K<^UTM=EbUTPp|Bh`(^bJVK*@Pr#EW
zLYdD1I!mFpXq{dpn{4b-lUM1@$8_J%B!JsjF`6?ksw|0{=?A%@eLPUGud^JGh8Vw!
zL>ImRsNr0skugw*AcBNhApa0D$q0C*&`KcAYqGA)y^jBBtrrvPfvvClEo3WN+tdAq
z6|jZU*67y1db|UGj6U&VwBwad3R<Yr0{%Qsp3~#+l0ZEL6Q`EZz8hm&pv^k`|G6NB
ziY4MMH2RmjreSvAAuY8WkjyLfdE4L+I2qD?BR+<@Ge2WuHX6GFCa27qdJNO^?(}%!
zx_OdWM{N2eTO6=LdeamK0C+9AvJ|#i;E}H|lzoA|4mjAtC7MgQ#_jjVrk`Gt=BV82
zLO{h{fccK#m2N0P6oCfte!e^tMRY&P_K7=Ie&9I_|G^c(mMaxBw?3oGkFxXjxXpEb
zH9+;tRn;_^l(ghA+yFnnl+5E&7f9!jHSzH!`j9XXjrzq{J2gPyS2zwTkg~!IkQVoS
zfrBdn#4i5h{N(B970-Kj<Bgmnsm0Wndk^t3?^zNQ<@9yQW@2ooRM<W-2!2|T8BUPb
zC5!F0#A^h%e^j9trpMC95(Zn!b*@0e3Om*@V#S4~nSD@vT(_c-6l>)41kA7nX1I*f
z)R6z>x66me=1ZUR$qKE-$?}R4t;wfl!=ln%iOboobHDwE<z>{(__-Kl9NJrO6Tc=L
z{yZ=$<tKh|$tt{`3wB^G#7J(Ua<wnLy@|s=W`E5yU0_Srqp9&Hzx5ZP>@At!<<bgl
zkvN(rlhn7UCsZ{e8sx<Lv7VgxK3NTw9MZi)^pnj>Lq3GkiT6EAsq8#i1p0Ju0+k>L
zC&h1E=^k^3uH~X3m=|PJ4vwf0>f49RR*^XfT?l?aMoP8XsenZ27Dm54zS<f+MZbO7
zNJ;G+h3KcM5s($bFd^foH%5?|>j2_>;XVjWNJ>OX(!0Vn0P+>c42y%uKq<KqbKx*3
zL$GdWWeW`2-hPMQ;5krNNB)~c*RZmrW%vRIP`kJ${UYOmf{1Uxi1CyO`q3hDzdYHX
zTIbkOt0kc(4#J5BlGvF$3h3i*N5>}MLEVb?ZkP*JU}Wa%cCkANZgjjaZvyg274FW)
ztEHXjE`tJo+BAAi$NzP-A6`ld*<PHe%rH7Y4V%~YnyU&1k}VXEd>&wiuFvrfzMYWH
zyDhJyq&HHUy$nwb$ao(4>zCjs1x@^9P3?B3I7a!GIswfqQD5v!J}hMP!+lTIdg2qx
zE+<O*Bgx0L*QWLwo-BO*&T+m%G`JDTVEJF`J8=CMU`HuDo+Nxez-HhU*Y6U4psykf
zatFL2u@bsv`>*#LR8&+rM{k<gQq_oS*rI0sPzgKZPSc^ypkm@91W@*>f!10;Kij^O
zOPIiJ%C_T;aA&5Ye!Bu%(NVJt?XCFLm~ie7Bg~*!b-H`yt3C0MfnTJ*V~xyqsvV4_
zEfWgC;X??vdUUFAP8D}S`Voz`-`;v3lWjU68V_FPuOmNt3T3IWYCNY1RdchX756TC
z#q|0?jq?x&{6@wtUcdu#SNDGpa>$VpZFWYg2-*?mKtH36eqF>=)5&rjdeM@(wF*~K
zDhiETYxLMUy_B9anc!tV_yO;=(UH&IyQ`9OeXVkbMiuN>e)nzp$>}Pw;qhz0B&Ym(
z(_`adUAyb2`G+hQth0&7o`;Z=jVO`!nnF@HoQG_JgTo`fa`IG_%dW1juM7>`(|=L!
zP-(saC1}J)PlSEw*H2$^Myc=PDA7}TdnB~H$T*JlhzosKxQyJ(o1M2=4ZXi~s=7Uy
z2G1JfA!74F9@;^|K9!+dFvO!;uEfqO7T^n3i-X$yVQT3%Lq>`K#;u-bR<8=?Rcr?)
z<E6+NWEHY?N_El6A!uJ&H)J0nMH?Y#4&_b*jQ6zO5y`<8KFF44n#K=fn*l4Km;&7^
z6UX3>{0OC@STbnj(4dv1sRQFJn2rkurFH(oIO0b^a4tv?^!FsnZ(I7++1ihbf!4e5
zq>v_OsoT40JSTTOxze?%qoc;45o5-ocevtK#w7C=26o0IT{*E-<^Ve!^o;CJ{mIEm
z8M$*5_`mX=H}22KZ&lEFpg-P6Rg!_+$~~J#O%bk>cU_kvQ{LCa4O9V(43AS$cvPLg
zs(>0Su}$e5lHYEQjO2pN^}Bnn9)JW%8*g<MP}<1$8Ct+&D|0P=g4JxNVqA3FE8kJ3
z)o!j1LZ5Ad7$nte2dUrLB=t+Sji!{!E*`!v49rgFHmGL)7RR`Q@gf{&nr_ZSc*&Q^
zCY?jhe6A>DJw>t8g#u5BuJ=MvUBVA>D2!INBm23f<kbDDu>H|6C-Hc)J!q}u7EIFc
z!f!Lv_ITX2vX&`0$4lc}RUWnN%_fC@)~_!+mYi?iHy`oRdbVOiNf;1}MsKqx$H@m?
z&C+Zps0UDHj2LU|*t#hry<#b#farDgwoIEN@pIgE?yKx!g_RrQMDPSJ33@u6_j<|u
zJ-@oS=nDx8*By65*OY%}V&K|b_eC`B6iaeIW;I(>Q%4xiTH1O3CIspf!SxosFunac
zDy_ctkTnE;cy;4JzUY{bn2hONNwxKjDRsi+o+CVEB}dc}^YW%97o(90y5fb;Vd(J-
zG~CN!qVw<(U;U~M-2>ALQNIw=h&dRHlZT+8WlDQ&s$7pK=-Otgt$!t0Ba0Fn$&)@>
zg@c9^1nKBVphG=dIGYEa5y`o%80pKpRd$t3dXW9|9~*CDLi_=ReaPkhY*jWHw1A4f
zzXg|PbDCD3ISZ7JtB=F;F&G==SF@B0U2gjr8ymM#(@b4wb>YR*hnfRnt%VQxTp%~@
z&Pi&+Pv?8{EV$DKu1FFJ<mrDUNDGWKK_zM45-L;1g1<lDaeLsfQY?Yx@pPpWuWv9z
zkmsO+?iO-r^>6#rVbhE|xMk^N%Jd+>4QJ)+ZxOJo2DH{Lg$^ip`DfVCr`><5fB!>s
zf`O66TENQ&Ykke-6h)}GiALo^dZMmZ0o~z++DVeJGI*%iSpo(nn}TB@JeFZ}s#0hx
zy0e^ab+*bWW}f?stVXl1^g|46KKbRWP5tSx!+szi&*+qlz%8gy<x;Zk2vas?0h7JY
zbf|1iqhXnFD|4Vn)BDky@rp&R;o~VTI2@;KzjkF8-}h$!sp~45kg6ra=1gE$Cz+AP
zjs9aivyB}>o8t=~QRjZ{1|vq+^3jXMj4}RyTifKjCSMYAV+)KYkW^2ORsoQ%t(4Pw
zE*t|=oIlo2m*|w5-4n`xOC<_>A+sWjTk$W2(7cM42R2c3G%v(hR>e2tgwE1E_2FgX
zyxd!&#!MF5Z;02g#n?i(gcg1+k`9$$Vr1%>@n9%Zg0TL5Gn_fa6U(^M4_0p9!_Ov8
zayWh7c>b5yzF|6Smz9aurf$F@+@W&ivw!_oqcmWeX57Nqa#B@;b_zjQasX1A#wDGj
zFTo=qXa=+zm{;<@;7T|ZhhgMBfq@1}sM1CVSMz>2Ma|MJCSBkd;Ey8ytzSnhS(Tp@
z!Ex$n&|`KMan9oYbm-oL+&J>Fs_0)Nu_S}k<rX0zVrm*>5X5tvT?`$fF;f{Y@BNvS
zK3)Y=46nXt_R?p9yurc7VfDa8)J$*Edf&rq*Mw(bS;P}t>ECk>&yaO<@TUh2J%m5D
znEtdtkI=ir&GSfcKx*TdBLT?a&_C34xvte!isw}N8sO_TKErn9<fz(MKJ+ck;+~Gw
zm-896qoUqRzm;DJbKr8u@LVJ3HOYRsPI^M{>>74q@FP}uV!2>%<S{ag#AL-(zd{IE
z+T)QrYG6l`7wKIU<8yz#GcQFZKFNoop8ScjdXZu;Ex7fI6K1i)e>p`Rmi~eZVKrvF
z?6AYiK=aaY^zNm?54KMTbWbyrTMkN$H?R985WXiCrg2^1?`0k6W5Np8sZQ<3gHaa@
z&gSoCtAZ08&|ya9<_m*@-CD2WEG(`YTe<f9H`%BklllLK^^(CW#dol$AR6TbRt3y~
z-V?Gf7s;JfG6qoN8Ffo_6qSl(m~gH@)wk4AffQ4bQw!;zli-O*PKoEt?ngoLQiooz
z$KBb2mpISz!mM+df>d#NOxg8c?e}Mgj|c0!Vo_SSn!BbXtA$^t8M-oHkasf?TeWHb
zr#7K?GEq4ySNxy!?@=Du%8gO({K`WFA4}fMm1x76)6oEWdB7!&=hG0?k^!4@D6sfN
zMHew}#A^>A3}?%n4MiQPWYnStvv5U1_^mXdH8!eI6wpMP?_#bDdCg;s!>PZj#Z|mM
zU5FuAoT|q0iBWvJAR02bJP3}7usF{buXI=7G3lKEJkS~UoF73Oc#N!SiBBlMQL9}G
z6Ni&Z>oUwpq=`-l$`6&#XK~S{Vy#V6QSaEo!iJ74U2hs8mK9$=pPJV$<9{TYum=b1
z{VCR>>}Eo+rSW%2+;V|eEI@G*CK-576O}DjIqio_mqzXL^zZYJ7F5RGA)COJ$#t!4
zwB$YIna|@CDO3Q;Amja%t$#DF?$;)^&M+Kos%o}NVB4yl6s|@uuwFiy8k46!{?2W-
z$?2@s>yV@1Ujc`3ent6fUS4sSlZYg}1Ol->z9~vf#;<W*?QGg}2AJkIKE2BvuR&5d
z-tm-<ZC4p1r_Sju!iQ#ob&t%3E(aX?waY1@tQeWoc``Gyip7p6>g{I-F3rT!w;I=v
zo#}0Vxb2aHxO<l3$1Qn}_6>)9!H$C$Rn&VahlIu?H3?M0o8fWh3b7buubF26N02ZO
zs|9phD_>fWj;Ie<z6f^Edp+WGe~y&Bk)$Vf;8{N*eLwWTNLQDTHLb=EH)6kub^c43
z)zAKwLi8~UjV12E@udz6IGocEEcOfWjC@W6K0O|l(1rlcNtsQ{k`F))TEQ@Fa=lPx
zE{70Fh+|~u^&uUWtGa<PwRYoimkF*bwQI6x2+JxDU*_{8fKR2UX7g1X99t>l@uawD
z!SQ-9y?tNm=4Vpmj%=W`I_723{ExBMlm7M2KRm?hnoI@6U-jSbPL@hSNuDn}8?t%r
zV(Gd{Y{7S{3f|fbM<;({Ap+78OvuTBGwN}CZoLv-o_O_}v8P;tkL_pR%_+Rw(P=!B
zEMr1$75?2X{xh|>Hy42buP~~(T1DE2&z|_uPgN_j$$s6f0xY{U5JlPJSP}3GYJ$Vq
z7*wS8WWjHGoWukfcfiv#Nu%3tNr|%}6(ug01-aQEYUp-B#FU6K75KehG6lIY|0XcK
zt~J3Lokjm`&~<JAG}HHd&y*l<%6~8X$WPswKkalh_bj{WaJ2n)QnkFZe?JuR2k4|0
zH-^&B9JChghd$b9eD*fixxGMUpa<Rdx7gFkuKV{Hg>a)~v_J8-?LV#tC@xCJ2TD_v
zyvdfOzu7W<T1YlO38HH&Dz4K@d6|xFS9}d|E2U5!{4dCcDtxFebRkSxT;BEh@6Ygq
zg_A(r9Zi$#-=PktnYOuD)7C`E72o7f$TI`!5q|ogWJ06R$=R|pB{HSAJJ71xdY4<s
zhSW6_eOXaIU6JJF*@%|;(fSk|#Z0Bi4eS%zj5-qd_Vvt^&H^czQXxFy!$!hL__Fo0
zG$U{cJ+!Xrk(|z#KE|we_p67*ngPSgJsc7jNNMR>JQEd+10~7X85+eT?;(lNaG9+$
zMk^Lyc=9@mUJMaGc58SdSf&e>yT^uWf6_O42Rs-I+C<Y+UM$o8xIXY{=|%a9m{W5c
z<42sCwVpV+h=6V>_qQC{?iVWx*IRO<-c}#r=z6|jCYEeyR-rE&om8Mm!-~6#j%rf}
z;QVy`*@3V9aRm;{k(NZ&>y$UswtIoHFA7mNlw$I{;yaTTS9@1Vu(d6+#awYNa(Z31
zAO7PxY-^$r(!&*_$Uz^(im}Oq3NEE@lB{IWe)S)jtyt^c!;uef;DB<cfTPcot@K|1
z!ZQt=ysDM3X81^wQ>DNK=5DWeApvQyS@P1)WlbdxT~hup{pg&0Fe9yS;Cdg1SXT2R
zpyGC4AMwIuU)fr@*yAG;&X#=IUM_&GKEUp~EtCDG?bnoI0)VPlwqzGD3A7#$i@U<y
z5dl1WSDTFLN^H)<HRKCQ601%$gJE1BP5vsWg9SGh*Iz&?_)OE5kCc}AA+CN+to4Lh
zl2j*&Be{}PYmLLCrm?fps}n_xL~Hh{k=TlP_uGn#4<V0Rt5=>f8|H7(OG`2xQ60gz
zHgDD^u=W;j4}G?*rEibBREHoz@6&De{u{A(<Xx<=qvGmnbm&3B@1&W6h(g>(J(p_|
zxTBoj*W*2g)V=v529U2=oGM!mfZC|@4nag%ZXvsv4AEHZq|gfZ@SV7EC1_G*eGcgA
z@)55kV~l8S#}B^q#96dZcJ>eeH7bQt3&ZzK;8xoES42A5FE$d@|3^gbHrf_`Sh{@u
zeUBK}#TQiRQL3b5QGm*S+wP4b&6m)@z~8FEeh#nYl!QMTafJ<+b^t9KCIM~tpK;u8
zR#W>Pbs|zz-27-+w*T!eJ!4G2Z>M)$aIhgbdzzjmu^y#P3}dw?Ktc!)xzwc}UWM5-
zlXB|P^Xz3uL{}Zge7HF8;SFRU*M+U=$t>K|s0Wn<=Q;}NlyL&E$HNNdUIZD)s=r=@
z26ED1_<YI^vW6c_j$Wtu;1V?5yt_aj{*2|KTY^jZZ?HL)e!PszyCj04C7-PvJVuk6
zhricLfkWIke%+#7j~(@Zb8EwaSEU2nR*s9G@^#|D;|8ZGW!pENAA;S2objvBr$MS^
zks|&9dRpU<hl`5%ZZ6oWILg{L-pS$&?^czX8N+QKCX;E_%b=0Pr*u>2uf{1PpD;2N
zXBbofUwQ8X`i2$RqW-V3P74VBg=a5NV^#2+V|2fJA61T81VqxG!CpCHtf(J0ow-ik
zF)TMUu?_y(1?`Y2fl#bmJLglJHBEr}N$QfEs|kRW1_$fI{O)M%aonm{^j(1|0<LG2
z^@PFKPi?WJ2J}_>Zi?K^TwqlojlzjOUZ&eVEr?Jyo;1Xh3dH@3t7t+DZX!r(;~8?9
zL4W<`Rkg0UA$hrNN*zgBF~WK;bXkP%SDMT<Cr2N~x!!Z!v$Bs-P4<2eGV`4$H5p3q
zrYrS_aSYcAw?Gf%&hMhGi-yA3dArOvG=yL}^Jq8{`|jd5*uwi^j(74Q3V|LhWn=A_
z1}p}#W&1|Z_PfG~DJf;SWIz39^!*YfLS7mLub=H;D5r5@kwKr4MaJMwLj+gA%Su{0
zRA$aQpq*DQtbDqn@K%XK)!wRWtoPO@AUCnt>D)~Z-En!AHC}~#X|UQ=2<RJK$v^uE
zX(x~65XvRx`fApS=JQ6M<8@6{rx3?n2hrOGnHDZ9(QKIR0<jkT{u|Fhbe_NXR(oOo
zcE-oCmb^rTwJM7WmO%#ON`ceX*V>xT3DS(3LiCNzACf{g1(DU*KfKaUd0m>=r3s3U
zZJvBMB9M!kkqV!SFEo?|yyCJ^1rqvnCg{)n7I6Vs&G0XsLSmEj^=RHmh}`h)FtXiM
z(dw~i<M&8W|Ky94IUHf^uwmA-t!(riTm&1fsCzdZ>^YgajAgm55|g6BBRh0O(0rb^
zW#VBtE>C(x41qkHeG(NWu2OBMXY#!9iq3H5vu-(T+7pwyHG_JF&&AW9Q9!5x*vjTK
z!V?w2Rsn4kfM&%YU((G2#M$EdOOUJeC)=T_z;foem5{bR;2Y{53G?$2pYR?#^aqd<
zS)jRCLDAcT+bt67C_S&T>kRZds?n9_7%>alGXb4g<rHT@Ahe%9HO;D~lWH{RTn*Ut
z<yZLM8e!d$XmE2ATr|Kbr@AC!jGlbgl~#kx?%;+B_I}=(*lN3*#c!b1TSms%$kF9M
z57(YQXNg`KCO<4mNEuYjB_(^|PdPA?jG{f1&ygN68#5z^0W5F+7}h&x8daIe#PmhB
z39Lbp6IJo64DW@{cm9roJJ*1V>6Kw7%K5kPBI%GesS!G~ictzTWsQ`$Ll}3yc~uMU
zh^@_1w&|zFjzXKb_W>#8_&l)VS@fy`w*vO95mV1)iE|&pxlNr)-`U!|>~>f4-i=Et
zu)eu&oJuZ&hcJA|i-HCMq#qo005z3hcjy~Apde!q817+XWDtbBFo?m#9O?yQ!ZnK#
z6j_O*drQx0*53&bIKu*{fxM>fmD4X_5EYg&o3Te&K0C0uwT)n_U>+_+S!5cvKnF|>
z>{|8%uEMIqF7)PBItyZE{cBTX@evmGLvB43QHYX5nyp4HO<R`3^~82yc$b;lJ7H*n
z@}cPPlfTsOmGgHR`}}|OrhlT4vkXT+`~DQi2sD^NSl}bpx<3=$XulFGbw+Z;w{$B_
z4(gJi3VSy*E(4B>D_{OKc;8AX*#FB!yrv;({Lb3DGAOwEV$K0sD2)2YWC5(i4$FGJ
zhT?)Tfw$h|A=EDcCGj#KS9n*wO}jJR-^s=pmh+BjXcY3FmaGl-VJLvaZMe}V8^3Fd
z(ua9+9^oZBsXv;=^jR+w>G97<FciYsun(m$(p{uqMB|(on)M{r>){GW+aAWg3C}Fj
z*XWseciC0Ch+%;zPX!Xua*DIA`VYlbW|%w6<Yq7`Lmy`N?iXn}brxweY^veR(KuyR
zv%Kj&##Bw{)dhvq4Vc9!)<sAQfTv@S5TD&Y>=a>dwy|Y4fyv^^phCPUX4e;$-8~-T
zCX!q2ZKGd$^iUe{;E5dKpVpb6S^(V}Os@k><VU<}Hh{Ij2oqUrsx)fgS&)k<1?@pE
zQors6D+4%tVrsPLHw>PrIR#;^2`8X3Cx((lCN`V*XmmfP!a*T}B82UbkS3Y&A^Pv{
zJqwCHlIqQc_8yr7uq+2Z3vKw24`FR{RCKf!PKBt4dNy{#!)I&(Na#$F<@fo5S(+^K
zzfr9Q-LzhM5i=JR-FO;rjnOoO%a<Lyn{}%;$a3OrP$+g|Es^fo#QGtmjjVG{RceB9
zjim!{5r82e1ptTYR#o0FU*da5-O9wvow-U~?l33?omA3!1Hh)+)i1e_<to4_+pq2J
zMz3Wd==yJ7uI7Tj&W82j#e9g{V1^O!@ZEoJ<?<*^-e*|kHE}<rVc_um(kwC{@ycY9
z{8jz3wP?n)#dqAE447BQwlILI1T-f!_PDbKFyrOVY(UUN<cqiD9XOrcQ8+v>f$E$d
z5pW`-o_grB#NrN}l&8OVry+q0gtARo-Q@s<7R1ffJal6KQX%7XW&ruU=r$I-eV*`O
zwTQMVrf)U-1#W;6E<(JBXH;PscNn|#2u9HUtaZix(Tr_S&*Q3*{dVQHv4a+K0ZmI7
z5)i!K^x}w9KW9M9A9ux16|Lpf<qQ;sya)I)fm=12fX@3L04kgD-xKsJ#g93u2)(IK
z>QY#7g2Hs6I#YL2p6cM-uP0;E?Udh(KO!yw9Nh34{{+T3T?V=(YRTo(|LJ`&SKqtx
z;>WzlE8B%8FNZd!48f9RfgM%XaHqSTS#<4v0fxA>flsVms%FL{;;}ZtAAurBaTgwQ
zt@x1#wt<32_iA@@;=auh7au=r?_Zj&SR5*mB<#NZSe=?jzZSUAn^aQ*)=U(|P;Ore
zeAE)QKqc>ashkF#WJ_#fE%8l734J+AM6tNKyZMsG^#xN2h}2<B=%)cimNi$cwc%cw
zZfMoF3+*A+9-Ei<Yp4XT9F0hZ94e}|2=40dI(?|(r6q0ZENZqEn^;i-D#kGWIKn*e
z7D~r1fs&5gQV&&pTc3sR87vrPPc;%Jw3Z%4=k9W+-Y#B<n8emyK%ttd%+YPJ@b20C
zG5wn<NrLEh^58{s<q$k3<q5$3t&Tkuae2CzJNHczk&!rr<hI!NcD94kbaUGJQ;suL
z!N1P;%8UXg@BYF63!{1_yJ<X`Hz#S&^<BB42)+=Cz9_Xmx)Bz9G%kb$TE#YeMws0v
z>$PJ=Z+0^ky<|NGIrodq157h#Dn-IB7kwc>Fr_uKYdmIN!F=ZYDdfyp;~7(gCq;MX
zr=)x<p+iNC^dm4oQXTY4+6p>SVME{7#LC#FMF>`=@3$-C@Y0eeldt9PP?Ww#j<t1E
z7k7U)_4`Y;7yx)>9Mgm@>iqXMyvpd6*{$bc?5|yXPQXuy18#q*@Jl!5Mg(799{GhJ
z3U`L}JHfJty3qp3!A+N2m#kVjV$9~ZM~cl?v?|#y?;j1nK4-wU=F*ZpVwOdYMAT|=
zY?Vps9OpT^SLRv+eAwqrIob+!pC0fd3jg6ei<7A^BNz-?yZ#{u@GR~wSHOjw1GQ#r
zc#pxng{whwxmvkafdFM#SR?JmjnN|{V>1i@!O_ikNe~P$=Q2OE3dsiNMX{u7BPt=s
zj;=YM0oj)zgBaAGerKCzt&#Tj<%DD8onfkiIbl(>FDUHZ*K$gALCqtZaP)S1-`nuP
zKww_NQTq&d-<u-Ja)dt)Lj3Jt;=>r>j9ELGBlp+j3bIODvj%)e!LX4WrnVtjThIY7
zE>GCm)~IbwT`uonhaOr4p|Rc~3BQ4I8I<jldsQ3El&m)IUy0pV_01v!BRcy1R9PZq
z7Q^WIMMPEP1JV%NNf=kxBCG@TM6vvP*~_ms(%PjpjrH5rTf8wYy)YGYJ}RnV9$=3<
zO_SzO{h``A|3r7E@BGW9h8<45?^BQ3;Huos%7p;GqMFhGBL=@B#k@4+^9Fx~k8yz0
zG|gsC=S&goXlc=JyiCy2dGSKHRUrShOY6{OGfodz8R(I7=|3aj1_psiqU}DrVZ)ZJ
z2ujy3#?6%PB*qiprlbq5#wnoB(jwi1Y>Z*Zjh`-7YSfgJSU!JYq@2|?wxc6)goLm9
zANSQCnO~8NiEz~PM-ocJr^53E=X=d(|2KI{h7cm<x?1U{Sx{Xrgz|hYP{@4~055Z;
zzLcxS<Wj6*c2D(vu1o;YzM>5qZZ6#h=NlidvN@_wriD^`a{@Kf0%>xcXmRv}8uTqc
z00cs=_+!|G&VQjDVSo}T?}LWbU$t4T&|e?zruHdnp?I_|n0N1m_3iT?r^N93z8<RY
z8Q0P^bD_&l#-iYqR&nJ@?<vGs_TA*}K7|Uj6LTNF%GD<nNxXXNC({zQMfjlqM`!eA
zGOT`jd)p4^uD_6Q;TdCLl4~?@pJd1OlkQF(8IUmO7dpp+)5H2}+f1zdA1_9|=7U$i
zM9vbM>iFH%-og7P#m2)p1EbN&p(NI_?S<Sw_g;hzcaczh;4RalFpBXc_G8!prm1@R
zuIwCQjre9qc=lG4Jz`CBDpJ;H3D2BFp1-!%JM(flG*RdTEj2G6+~!yhrA0arFu~%;
zxCblc3|%g`z}3zk7thNH9osrTPDOZT!zp~b+<6m4CJ6r&zMC_tk{ICItsF9wlm>*S
zU=c%7(XR%#5oU*PlW%s`tj)6+_X^-nV^gw5HXO>|b~<@g$g`yoN2-D#kx40=X53*G
zPz!c!`F~G&x<t>1F=}g)Gr{!Ub)5V$rnvmhz*w77fbBAXtcUmELJsc?*3FH+8tvVF
zCM~2N6tp+yvpCvved8>~=Kc#;qTz&V8MrmPfg!x!DtsnU1nQUUSGOV?&y*RaoZ*>W
zB>_MW6L__5mQ?%{2_0T@32H4i8h;dYJ^w~#w(JT2`D`2>WLR1rBH>=(N)?aR=|0$-
zp)@{2F7}~l^K1s=o1a!@7p5C`#r&XD8GG}g@>bEEv#zc|imeC5K(7yijZx>~_F}Kg
zOEhnd>zsJ}z&->C&jBWI_RgFc4a+HsDfMT-QZ28-w{J<Dn(qaPJ>oy3CLq0law@CG
zust16rvwyf7DqJ6#D`}wLP=8c+wyLrQ;wz|6sXH>*3wSzxksHqw&&eX_W?jBDj_Yo
ziwF8!3>fEtlQ?-kC<h{J$e;`u=^!J9IAdPSOxD&oi3qtUqVAPW7X+I{0h+89D>s6X
zp`ZN{U|(4sVe+D6@A-IkYyDO>qGz+0z>MqluVPA;>GwZIf=ewHqww$y0;_n|SpO9M
zjdH!59VN4Ybl)B|pN%w)>n~zfAvGB+7<lA>JgyGL^63Ri%ln1}h(>s9YAyz{^mpQg
zkl)fG5+NPoiP5<1-PpTw%H&RP=uyD=pWylVZ}nz?m~<Y*B0}T3Hx0&VjqhF2bi}Qg
zdCS}5MQO|;cgmnYxYGCawZlDNHX8MOA{d=fbN9pbDf#l)M7^ut{boKVd@9L?O@2JJ
z^z}L=Em2ghIEG&S4wkdNzAHl<qX~znAHyOFvc^qtrCFlDn53b}O%=n9(?+Arh|fsy
z#soz+878BvQoW`d!|wK5l_4MrgQKS!{^lqK(0Fln2Ys9&h449se=PN;s%z3b3&Be(
z*_*GOFQ>(c;3*dz{5tZv-O=hK!4<HxSD}K6X)5}sZ^J|Y{B3CM0C?%_*x^Is6B?fM
zT9&T)2QN``S0x*)22$ICmLCSQmewy9edy3D+=*}L0ncupJ+F)&Z+NdLc98$r5gC+y
zD2>OvW_95vGp|UOyYU~uzn2(K?RA!rvHssk7$@wfhngH&&vumcRj(TH4)zDp|KsVa
z!<u~maHS`W0+TLLkVe8UB{e`mx*6Ra(%m3P2uLa&N{o;gqZ<UIyF13{&hz>^=Q{s#
zaRKi(p6C92?us(U!9{Ow%=pi&cY!oU@io8L;-vY>F4+ntNJ6gaS33W5CEN0FIF8&T
zwVF`xz7%U3&HyXfAaNJ%ar2nNelZLWZ7?Oi?c^<52*uj_<o{A;G=BCq+D?|-&2`Ed
zP(uK)9ZaRcoQ_ip69pbl%hdT=zCEvzW|w78H{>#dkTXlzlhbGmw95#v&=TT^;~uJk
zg@Zr0Ts#0s*rq>Kz)M_{kPC62a^u4+GI}qJSE|L{K%aGA+)VfN`~aj&v&|G`6T6MD
zOPVw@z=r`<V%TioIP~kx0YS*1hK{i!c#I?GV(%x$P7xLP0YREZN6j-WeKu_vzN6_q
zc_`l6u<-Ip3U~AQc?FSV;*eXugc?8ATa{7{h?ytaq5xK2axM1ncI|RuQ#l$A(`18b
z>`w%aNpBS`2)@F!yE$@nNl_v?&Z-N0c*d-W2qu_hrME1|Mz9fJq5(<<wpxqA3RW;6
z9py4%WFO;@X2)G+;FDrtN!lq1{V`wf)T{jQcxPZkW|lC8qq$BZ?PgD~Wp=D?N|Xc|
zi)X@?0)68;1XkdT-EMJQL?n=a4Rv_}4D|Vm5HFxGk5Qtvh|QSLWCGy-v=d?QfKVqH
z+USgPcttl7&jVL$2ZcP7X1Dun5zYpuE|N@nP%`u2??gO(Fk8dMrS~y;FCf=keyA}U
zp%%?casCX#Lkg%lB%&7^Jx^yBJL#uV_#{m@5<O~;eP>7{=Ry`dopE5K?7$nynKPx2
zD+FP5wP4dK1EsHQNqK?P0{E^q!KN63%svf2+r9zxbe>`Q)BVNzCV<{_zI@zFJzf4c
z(63(B8CfqKJOcX`;QI2JWHa1?Ve7e0{x<J_7T@j-Z2dExS{fV}BGtx|@C7l{qSw07
z1}G@_P4GF#$kg7u{A^}yxlz*p)ukG5+|DdmAp44r?a8G+6Q1Pr1p*#jHr6Ofn>!Ay
zyyxhR^EO3VnnNQxhH1q0c&(}xhB2A^)9m_n>|c6-X#m*8ORg90@0NTRSkUCIc(zy!
zVnCT>vJrB=-<RvHa^R|YWS0xs1nm;8&izK)9<UcB$|v)(SiSW->bpq?zi%~J0yc@9
zQ97(3xn+CZ3{4k-k;KxtySec%@C?4cwZXt!1eXA+Q&)lEHn~@fl8$beZ%mZohxFu9
zI39TG)cNf`P`Tkw`6bMFnMmYF9DCCH{^oo&>zxs?c=L4CL7+7%kQ;%=NC=kZ>ef?i
zN0jP{Po(Q;kvW)!&a_^q=%3uv>zls4><z%_42yz<ynq78(m9pOXsRcMsad&ZjnX4_
z>SZIfnG4AnXEY_)mj>WeLlm$$ZG64Gm%|Uw_!t&3Lt~ul-|(z%{pYrm01n18YObNW
z6#@#19#Xck?KteZvFJ_xZLaJN5Zfa2_ovx+pN*@qF1z`Vj9&K_M&I4>VadQTa}lsZ
zTmKlpbhw3a6xQ*U=6<&h)%j3a)D|-R0t!$`3^Y9@h`zngaenx`%dtqFiNe07`fMs)
zVg$F%D=Eb{0lIi^uC$PMv!?5g<@&8+*~KZwQR&@flKgoTW&wc!%R4jB+`jD=7#!!$
zobH)<hdd1Vr>^-V^TkCld9cS{U|&wVQetcL!slkU_|(JXy_M?A!q?+Sm9Bi^#~S-p
zhKU;&z`V!MGrF_$ld^nc>g_!~W{H#NwdVodvr?8Qy)@bzpHn#0*`@2^)8}aD;d2t?
zLU_!_>0K-5VS1QA5pd(sXVu30`*dBWpSJiLBzXJTiX(tnvG6$IHy!k+1^O#<p{49F
zS!bYB7S=3&wpk0{`X)k!*a5><^itN%VX^aHca61Y!0`Yl(ksGyfT8WVFCr9U$GiF@
z8=`vojrtQuL4#xOhzs6FIjR!0Zy5|l#}M<@@3W_Qz6bUbMDv$&q8~<rt?*&j7;}C?
z?n&+K?IOm)*o&(VIHi(dku3V}=p2Y_>F-#$&26qy12EgSmTxniTps-*T*_BcuKw2F
zm)PMDS3c}q2F{}ZVFy@=xb22wfsR*&q(y3>qc*Bi3ij$nV}qrH5QeZYU}fQM{=!An
zv%+W~RUxY5Y!Z^0V~MltW<|@y2MEh@^^p1DUy<wfFL4*JRzt4-u>f#P$-Xh;Q{vVH
z3lem)F0Lr0%6)|M0rZNHWWV!rL0yLvlOy@FyUIcM&cSE=$SHaJf!e#nKI`-^3lY^^
zXSu%CrN-8TYkRxn4G+2Lg=u2Vtt_|#kCfWf`M^toXKLSQfCVU&W*`%|SmQB<XN;I>
zM5ZBZPpv~qYo$gkb$N-f-wQvTi>cg^^{vs(tbT62z!3#`<I%l*#iE{Yt)d)8BMC(T
z@0$0nl!S3mB{$bx)Eky|{wkK96pP(4<^%2e$ByLSo&HIT{9laqOCAe??z*HdQf=Q!
z#J<|{FbPU&C0E5Hc;tgc25lK^jcYJjA+f$%y|iOmDpIfLVw=N<0rTYaq5bWq5n=H9
zXj<dr@9ZIrzxh?iEy9O`>*l|x@}G5a&KCWw!ePL(&@;SBOobbHk7u4N&k({s+x~a4
z(@C_wY5D+6z7m2)qjtoX;rMdqqc<sM;D2D6e}Dt4eTxm>?_=M0Re(`eM3$>P8Kp1P
zc(Y`w%8n6u@j7s9BtmsWphKKyj`jCvDfvG{3lIM`jDMmoc8_UXY9R}MMp7xMs0Luo
z7jxbg*C5YMZB4_i7Vn+IMeWw(u-nn&;?T^MYUb&P!SHE<`>@;VKMIR#yH<&HiTcj0
zs4t~I@Sr|SZ9|Y?yB7?LYaQWu-qje)8E-un<RPJhX4UKl2)<ISQW)LHlM{$3>6VH2
zsC8l7PhA&0q*PeO8_wxWr)GYT1tPZRRzA4)g{jjog?s~Lr2TrZiNCu`4S|BadQAWq
zI#SPE6<V2d0a|YI{w*AE=d}YGi7pL{YTvqS%;>X_c!&g6cj<W1dNa2)tQg)+A9S1>
z*rxsz9u%0h5jl|8IE@_S^i9&u6ln7}`&#?1{#Hc6&K{!3p(d)WIO$yIQ_zZ%G6G5P
zE~Pg<tUCsbV^&h5ESk!v<Gd=&INu3z5yL8A+Qc9-xr&Y%*<+~dP%G32#wyDFMg3E)
zD9e)rpkoI3QC-1loN{+=c`9#%Z8_^C)`_*uA@jw2rLX_&q{<ZWRd<}~8IVo`+7L5p
zP_+Ji?>$U)WsddnQ50W5xo?u;a+DJ|AOoZi%KhV#(VM1;X(h|I`D0Ae+vv0FxcHJW
z${Ok23MqbmI1CZv5ue9<&JLe&sH4hNFT#*P<Aw%nr%doCJ&4?##U(gC!Q%u$#ow;i
zA+v0v0Es)ec1>-7f`nqmgwX&^Fw||!Br(e<^hZGO4A93}xMoVtS?{{}hyH<AlYf_w
zSW~kvQMK!cbr`kZ7L1`u5~T1PCj=_$3`w>csVw!(4;f%&OgwN2ODN4{f!|d!6^hRT
zFDnEOHU?+W+h3u;o;A)509xY~suv?{+dRYcM{;&&$hEeIuvaR@%GxJFT4vjFIO?rM
zsgQh&hN-{Kn;`>i(Hup$6PqmceR$&Q-)4FF6a+4`Q@`m?jeknvWCL(sx$D1KG68aY
zgRGdIX<PhrvJ}LxhbBZ!<YFQQ2oX={=hWcjBt(SSsAwbY*Uk_@_Q#DR<%mpRKQ_Yk
z&5feVK&R28ymn>J`n90}DT5<JjA_jh?qK8#XaUqK$<^G=jg&QqB(#+6ps|3-Z;8L>
zX^7@DE%3o2<AM7X8UqYNDyG|*iKr8>^<sx}Lg6ca#NhA)dEPvzj-)A#j%VR2E%7|5
z)?U=Crr_i7qX>JcRDcxzZ&*BW8*yn3YyrMhe(0l3{8=)OmL!gz+yCxu_ODW^L@YF_
zKWO4tV-_qptBh_`6Kq3S<sUxtk$ep~KZrk<SkUTHo;)IbXGvBS9fz@IG@FQ<`vcgN
z_NjpK6Fkg=8!0swBo|Em_L|Z2(SX;%5j~!LM;=hBRSeg?d|QT0U&rqLYcAP?)yz;`
zeTztXfPAD7bX<4=lQ^G7S-z&#((kn}S27@_v7sPP9QGpBCdwLk0SQCG-cB=QPy6?a
zrK@>%X@Ud}K@7hOS(e%Xa)3+FYB;M~c6Z*8c$KtPPtAo*$6?V;U9K!&e6ae14?X8E
zc;RRF%8zpaYJzecVDuzdqy@rh5j-U|E00iSdo_Dr#;n;FLetGryD)|j&#@)mJo|1f
zv;UHUBnV#Ei>4Bo9D7|yySN1;nH~VDrRzia!n_py!p2t&EfQfEYF5J+47;zYlq*cx
z7Oebbp``0dCqZ$qmA?1oT#PXWx#11LbMlE$_;P{-QBGlsVuZguAR0%hoCdh2V6%x@
zLf)5i?4Qj&`ua>({U~<-dK@kdZM$cagbppED1|q!ME8M5&HbNtaX@ORuEV-DATq{u
zcHV&4*?!83EInW|)@kr9`<(mN&y*rJ=M~!nZoW^DtYmd%c1)FP@p^V-<yKg4_SFOD
zH^korY`Q1h?9@%^DI&3vZ>XQwb+_>43v>yAY=8OYBJ?{tO562@qD-AyHd91&RdU_+
zQiCSRpWRtkUhkliFEb7Lr8&cBgj_eGz%FbtF14bjRL{q3=&$mXTdha)M&e~Ghdq2O
z3W0fD?ik>`r0TF1@Kxq-G>^Nb?vv>5t<xrY{e+H!CLQ(%B5UIFkQL)wZ9g#%2>7ZA
z>BPPaer~W}G6O`sOtHy#S>lq!G`ack$?1Oxm~l8)Gme;-sR;BB0qgcHTLD3tQNSQE
z5i;<NwLSg<kGs848H?=+nq07TQcr6&<H%F*Y&L<EZz!h%^mMWSjf6LP!#%wvzgMCe
zY$onUQgV^At}B+m#0$oFtKNguaYOdOXh>eNZnx^H&Pr%^`H_B0Dl_5q#>PunL)MXf
z$S5wLE99m%VV8X0qc=i4_Q4)r3f$Jew6*3B@+U&r+}2#)wn0c3!4m=vxeA_dS8_{<
z3`MBV+eMyBQZ8RT$$Hb4&-_KK%c1f?<F>XPtX^48GszJ9GlPxkl_oT1l&rK=SKe3+
zP&_lbt`-|1+*plB3)TVca+Tbd7*l#|A@_pEC@m-;fZPiMDD3qA>d6Mp_RAAVmTew_
zacKL@xnE1^6O%(Nkg24f|9f*)5R#(DBOxbmfL^Z8bi-T;1j~wn6o`{mvQQN{bk#~z
z>I1CF1~s&8B4-L36KXLWXR^jF7K><;=<N1joY5e%=IB4#WmI|H(b^CsIS1EsXH_>I
zF@9_?e_s>ZFK0})e{!}wr$dU+7&kmJ9Ucj@5{)+jK<QjPa!EH~pPG}?5pYv5L<z9N
z0b#z)M=k{n+8Zqq$+oWQ&ye;xq#0eND~(9sF{7zso{U=<X1*JoA_%*nvs$U)?_NOJ
zSX02gPvko&EbJ0{H_$ZU8sDY_us61dGsUcFEr$|%{SRv||6i;<{>*H8QKiy)=IdAv
zN+f;7VGRi15t%at@frz?#A)Zso2ijm2u&Cx5srP&-tlR$B;-<Kn#;bId`r02XlbAU
zeqR>ZcC_o0YxrTs2c&7sQ8<f>hQ4O!&mWpwds59)M@l8VoLALqxu#}4&G9Kv4mhw~
zA$G9uN*4-xSjX)n+7g4@J<E)X8vw5ioaVr4cx9D@%z#uXu&A6fTHK6ULL+KTYga9r
zTvx_qB6n~GoW)-YX*T%-t;1)qcmi$&l*8sVUAKgnYsYFMU@13M4Hq_ck1)63!V|?{
zEbt6~Gz_}zs+B(<r~~lZVh$KE%Bz1H1LR;TehpeJs@5GjHOC!z=ig%PU<vv_X-2vn
z)5SrhfIFr3A}uoLd`sWSK@VoB(B<R2h++H7qCCs3`5y(*LfhseFrIrZ^wgyzPndDb
z?iu|P7lncPrB_o4Il8S7NaZXg4e2-i6tQR093=G}{Gcj@?R<ST0T(>?XA<u!o`(#s
ztA}CZ8WgY<_}|Fshph(Z(TJY(F|Do{0SeP1iI#ydf~Y8ahPIn8sU%H<M<=6TO|Per
zw+kz8bX|jCR5=V7sp18sSgr<JtWLt$jGu4+{1)qDG5y*3=Np^CbRXj>MiYTEsyzg+
zFA7xs)qHd!H8%BO>mbBin1;bzufTxkC0!#f`65d0R}?wVs_>lQ)kNL$*fTHt?{MCc
z*=M$e;VlE@hXI#gFzKTdi91F-M^Mo>1nnHWx?E%(ZelmIwuOZlhkMZ=a8KYDp5Zbb
zD+ssyr<w^118PdwxBs=|@g`SOpp_Xm&oRIz|7ig)w9+{Wh}m@Z2J0Ah-;5+HeSfDa
z$c4xqzOGGgWSIj$^^5-3AYZZH2ra3J*7YJ@Z^vtO<NxJw(b48w7Ku|_wEcrn<gSXK
ztXqYXwyoTL8uuqg2>Tx1AF+|i_wSpG&0AVjj4c<~NAk|Mr@?6iI}xYm_j4{{Zgl0z
z%N)i$wZOK;`Mw`ySh?a_OXycz(T~Vf2DUhTZ`5<tc>~*OBNfF!yj)zd_O}<P2LLj~
zor!`3;;$qG;36SI+Aruc6KsBw4pOD~ZoA0J%hr79|IIQNr&7Uu^`SibtiHCg+WNaO
z(o|=oCGvdaVHz#aK>0W09Ndt;YcA21Kc%V%6MKivnBoRB$JKsAeik}0^enqBK;ZeB
zqAAmS3(k#!t!h!P_N!pK*=mc*h(E;BxS=s=+FSTjkza_P2Itxv>Y4{I`1=U*@+P)#
ziue%RcyvuU0<e$=PcXDcB>GfgGFbakTI30;FQh2zWAJB~|IV7p=g3Qq{MTNU#jwyc
z!PNBUs0a6#KXrwmi-KxTin$0T#^Xl#20*{i!G=XMvZ~j_i_w2g>g6~<ALU1tl6vz(
z54i!RTk`^tjJ^+E#s;t|gd~=o1o{>`{V>q9@_M*Yrj!HDN+>MZr$Ne3e<7?U1bhcd
zEZta?ZVP~BT!fq*c~4RHHHTkqNJ7u7Zw2vs;_8}xyfE8kvCDZ_%I`5yk2#|8uA_BC
z!GOw=964JSMov~WkvFKPHw*0So0Ec_&PXcD5%MK+mWz~C!|5O>Wd|gj|2thWnhRmC
z5qYozAbO}Uq!Al6lDSil(zoEn{_Nh~Rt(4~p*P3JF6@>}U)`wf+%Q}Qx>jrzPT;^+
z+DWm2f_DMGPXoOGeY1KgnhPg~)#*GKx=|E`lOL_G17;%VvwcSUUHvLP@GO*WFxAY!
zK6LbJ1HQRaIE#Pq3Ul!NS{l8;ZooG_YyZlQXfD#L`@_b=7UPVvd=anUi1paD6kKbQ
z^nHvFiiKD1VLjNb>=;MW5GI)lS!gy)m}nc&kiWSrS%JtEM-lis0UQ(%KpU-p8tIR9
z>hb3>@EcPYDdQ!M^h&PzMO01T<$r2I_9F-Kg^9zm<lTmt9SL<qlR|i=gg4BPC5DWk
zH(p6yD`$1h6)2yYWp`23>4s!dS&}8Q;(Dkq1Ma2{8xP7#m+xmYtavSB@wMsKA<{F=
z{p)s@9Oyn*EhCbg2V0xi@R;U)GZcpiQB7iov)wvsIq~lxjj;sun^Zape}nK|IBNa0
zgMVJV0fL$pAnYJXt*-Xa+P;q@MKIhhYX8c0v@g7B3PqK%A}X4G@^2H2g}<;vIewNd
z*55Se2Y9)VS{i*dt77$+5JP8bt<BnV1o7aDolQ+>cZ(6or5_qyTux25ih0JfCy}KB
zJjkN^bi<Cqe3hMAI6KRbbCR^U)0c=Zv9VZel-@4yB!!+r-x|N-TC=_4m^SxVj}_b#
zmH1XV9L$y{k{V&q+(_0{K5sF%4q||ic9&3j6x8J0hwmTo1|@lhXaTO9ffd~liJf$O
zP(Do@nl(t0G62&b*Dr54cbSZ=*v+2<!@-A5vJjbDmheNhD6a*x4id;xi>Xe}XG8Z>
zcjj4gu$e?4+U-P(_MUG3jF8|!;?Mg;VoAu2K;>22!zkUTS%v~r=qxc{W3)S*sWPKw
zU^HefbP1EU>?RYd?|NVsUxcK60wiOx?X`fbqRZD)uwK>9niyX2JR9<<r|ipC>mH*u
zUCyd6sbkqYv+)J;!hHwIih(P(;`}$i{o#^nzT5gsiPHluq^d^3A*RS*67=On&1CS5
zNd+T%1Q+`>n65JKM_$0SS3|PI3Ig~Ya0+585SNh6gf%|4pW8kpuc*cLmDAfP4q%gM
zioT0G*9O2s?&vf?L}F6KbWgZI%GTdB{SIid<O7V8U<;~6q#SFNE-Bl$=*VxpmZ=cA
zG>1XGnoIS|<_T9@#Ce6Ks6jmi1YPs38nV*z=ZXLggN$qNq;BcFCoUA2^25bXpZHs8
zS9_%PRA5wPF_@48kk#?i*^VkvD9H%nrL@XxXOq_|dD(s^{R<G1z9ALdTm_Dr<UD*v
zh7nUzEBh6XtAhIIXmRysXG{4vwrK9@irp{EaO^m!jedLS;reY)S}p2T{3^^G@-n?7
zLh?|h4st4EsCnRtgqi$>TMlJ7i#pC!ws&@LFX7YFu8dI;Tb@*XB{OyY&$5ikKwL(w
zC0-fMBG06-IN%Qq7+?SX9-dr#s$1Vh^#Vvzkc_7NlAY>n(e+g=&!OT))Qc=;kP@{i
zO}o#-$>x9+4Fk=_l)e+e4>NOB4KRclV=z^IWlZcIXrs6Ty5dD{JfhmWXW9!Cyxdij
zkv!vra8w>=45JvZOAhwpgi~m2ycr@WJ@CrWo%*V=lTLt&lE4B>!-d}rb^Ydpi^`}O
z>lRYbsPoO_W0y-eal)BPuB^J>vZavy$WHL)>2H~FFiy{#-YQf`MVPj0Vs_QVfVnKk
z`c9T_rs}i&mQJ&_LA#_t4To??Ck3!n?URJQYvSHm`dMek7nU6J!v4W=dd8*qpLnWD
z19uDcsh~z04|a49AY>4ifO#dkiNbssDO|4ir&cL^sT$ygu?8gFRVUcPe-LK#(!f1O
zie;DkdsYw^b9OeX%0h9_K!yY1Y8FP1TFV{>FrWr3YKv;c`pt7CBhM^i_|oEYdm$P=
zLq|bT$zEKPGMuNQ$-Qn$o3hM>Gn_MdHhQ)KyI$MKO*Dehj-LbETjJ8m2Lt~l>Ec92
zTMtvDd}IBqMKTH*%@%Th1A-A7@=&4)u{zo?;c;>4IQO$KhH;S1RJY!gwhEP;GZrlN
zy}kaRBlze3D^5DNiSMpcbk(kNDQ*z&z%v$I8`!=v1pOxo%KF?0b#cB1c2C0TxHy$7
zLbPw=2E^?zy14?5?fQ&m<z6QUOh0}(@V|c2c$O+^ih+TArXv6d?k$HXarF!Aa)$Gk
z0gv~>T&-Q_rN^Qm0S|mcHJ*Y&o(v$QQuOE<D$Vw?2~<H6V`%Id8Y>|q&!sCW0-M{b
zOVfj}804@x_os2yQG?u3{&O`g<sdiW7JA3rzaYxbs7a107S2>rItwuT43Y=nVrfoj
z5>4!$V@P^L=D6iYX?)n@iP6JA18@V~np`jWD49!I_Rs#dYGtAWNN-G0NP>4#f3aH?
zy_|1?O#3?U#Au;I&t1dwR!+V&PnzYZV<tdcfVR?QmtLCX*7GU-VM2WTGfO?ln0l1l
z88diYXI0SD`Nw~su(enxl_HgFu)55<w*kz4>Sb~iZBxHF=!cHYUxHVF2#e6P<>xeP
zWeR;}c*C|TjLjyFUpkg@Yf1lu;m6Ca|Ng90P+4KIkxg5a`I>%ZCJm$dQIP@_5A9kP
zti~;IE@btLsob@ede!k_01wQ@UN#p_R$!mwyI-$s;9yBs`^+xIM!FnPqp0JnTi>0~
zQ1H1>r@oREVxk*`9Pg&jhe>sP1%ln4=<W}`dB}bMx^5bo3NS?OjyfO7vbX>K7}(~}
ztLf8z^X*HD{%K-f+>Jx!nrqnLrwuW9J6YpvLSZ!@MSPedwyR{L0=74`sq=?knh#nB
zz(E}}?0@j-u_9nv3^ZqWT+b$DsSM#5<UV=|hMegdvj++Nt*1ZT+0Ju{`5@Z9g&Rf~
zq7>90;?J-^%ol2Tf9Wk35J*o*EmCtfyA<bJ4EWPLF4{1Nysk*sEm`n<R3)2iGHj&7
zSTz+VKayz4S88=&#d&9hlkmlihoks1>FcEI*&1W@B!>9kjG45i8GkL>4b7a?TqH!@
z)HSUD`q1n*eLiA<=zOCy%-y~YQZ|p$Xc8ZyaB=8>kgVM7kI8)qIAvHOS?Dm|=;8Wy
z8V2q^y!(5&;JMNkyu2dEX!9Bf++KbxG`cBt>T@R#04!{jIuz_wt74_c@_lz`Xq%gl
zgr3rD)~mkVlh7AW(}x$dxSi;LF^VpUgQxS!_PFx<AAs1P38&dD!MJ-<?BO{6arbul
z@!>~Yf&imK`C|*<OF3k+Co0?CtXEzqOJ(?7{A{tMqxrd6m_?~}1>xoMj@Ch(5zmOD
z<Y+z0x!#DQbUXXRMh!0UW|h|{r(xNZr~D!!)HfVCG?z+%K}txTa!@$2y=>5(1ex_t
zlbWqjF`PZt;#<#t2jZV7p~#|rQMtTzUjSk;#QbkBgD8u9=NP3%*Rq`@Ir>!a7i~SP
z;<+RDcN~^J+w^c==LL9``+M8Th~>(oH=%H>v&~>UI?m`Qyka+>f-cLGufQtx^ONQ6
z^-v_9(N#w}lWd${56PGeZQ$K;eB(}DjCk>wad5v=ALkn`Jfb8wJ(nSc1I{$hOeS+$
zCR7;1^^9hvbt_Y$?0R;d5hLooQ>T>lU8LAqZvOk5(Rh}Pq`DK|)=S?<VKIJj;Na}o
zB+9wpl*gV6c4>Q#l6uL2d;DcvA;J61&O}1fyeiz{^6@%5aubDq?_mu}oA@Lz(MsKs
z*)y1>{8M`hur4`jOmd!NC4A`36g_Ig2nC2TeZZ|39{yT6t4W5OD>3eFTiV$x9ciL*
zWwX_x9fn=ulyY8a@bgBWRAC^53R6p`Z{(^e4W?BEi>-8QJYPKIT!@d>{~^+{n_zcn
z2N>{gnQca(hH&TAG-%{HZ-^j6?04Hi(&;LknrIvNduaz+k$}6aw$IOBldsW!osHSB
zsQRf_&KWRSYFK;lsRLkY1%xEG(f~K{9V-5QCLWcDJWBk+Xqcj#I$fsw$s1ULJRh6M
zm;s_q!)~fmZC-w@$=-?cDls1YSb5}Hz|pm`d6}VGiSHB2RG72!h(VkBI2s#whPhKP
z&^Gi$8rDneYu~=w83`_fHk@R9{`}dlU@^RII#2ijzWyKGRU3}j>rl}F8ir3_K)R2Y
z|6&6@73LpK+S=Nf&lC#s#a_iowr(Jhuu`DPjvikmr4VIt!-2u*Odx;jqH=Q#cOw5&
zv$H?@+bC&$X5)qwBxgH=R`pbdW=Em)@>x@j@xDtfHk+38yr+@f(irjdh@fmXRS(-K
z+HPl{BWkX;p2Mg`WI>n_t^`Om(fn`v(_Yy9J<LR~M|0vD+O{*3jRm>+kLqT`MwyxU
zx+iKm3dJ&GM~95%FTp>DhEIj#{a#Y8Z{vSj3%0BkQpVJwlYLdK)GWu>$wH|o2q_iQ
z88XJS^7EsvN&rs3)}wH)@1kBuD+kl959g1OOy-0nqIMdv`^!JmM~rPC>Ja`lgyLHJ
zS8ovSt3S0**dqR4uEU_R2Y9e?{%aOGhTzx*rMNKOD#M2V&PRKV!0jKNaetl+i*os`
z;w|rj(xpZ&ZbpF5^S?;XSI|#Biwt2zO^N`@W{>VMEwT3ktp4tM8i2t0T9nJw`PWWZ
z0MD~=)}7Oq>nZ(ERk=B<y4-}3%V}o`A*WXdVYbxy?jtJV?V>!NtIFM^>~>zljYf)7
zeP4%aYkm1OQ&*tl&Kd3VNhWX+(1ow1Ea0DcvocIoOk=NV=RBJ)`_hapbV#gotWw7V
z|KjA`yO+B>U13Cbfj7Q!Rb49c$%u=qZLi{CuOdLo&?|5S`0D{r2W&a{>BZ6Njg+4d
z)YsKX<2Ww?Sxx!&%b1VdgW814a=-DZxftWLKSV4dahB=CZ(&=Gi=;`R1{K~8VRF<w
z|JPag2w4iIhQ9pNv$3)9w)Hx*^%_a{c-7l_2s2miY7@qOQR<vtuJMLJTDtg_c|6yh
zWL2;RZ`4X6n>M)F;OVnocidR6A8O|N=yvRiAnJ-`6Pxg-xdFuSjgwdN&QcS+8eJh0
zxPL~L_hde^5~wW?e;4r{BO)LO2b3eR$2H)Bw<8}C!QqcUZB{~iNK7(#DB}f`1Tq-%
zU(r&HK+?<PJwAUMt|0L!VmRNdgdaD~+CY~(I)H_jUl2%;<!$1l3z&vs!jgy^?f@z_
z@BQOceM{|0ao|ny@;;~mccd*bwawtrd)T)H4~;A@B_`GfnhHEMUKKpyLU*ckuU7u6
z-2<?JCu+R;;zC^S(eIYZWFDYO8tORnHA|Ai?C5jL(>VjL)*r&2u;{C{$}QlY)hb`|
zT8|C9+sTi&1TqCmH^&MU-osD-3O|m&7CZiYh%~MnoD$GkYDx4+jR~$+n7kOPl=`Z;
zy=ywX-L@vbt{|lm5@T9=Z+uo<`^6nO-55ws(Z8<8#7=B#F^v83t|;QQ`0c(0F3E(=
zocl2TOW~*4z|B$8ywCpa1!i;aP?6y842?CJkV*2C`nT%R!k_yIG~`0~O)SyJ-0d+t
zqV*{iT>*=;gkl0h6CfXiSbvuQcjX%~4d5042b{Fr9{8q48NGK48$^c+|0~M8rFy(E
zdPH);z5G9z(N5FA>OVkz0a^nT>`4*?o=;}|$iIu5&6QR^PQn`>)xKFz#y*FXQ_js|
z2DC#&*|PDp1P&d5A8#Wsw2A69&y%o8Km)Op8@Ur9Z#e{@I-+IQ0ghIN``Fe`wF3Uu
z>-nf~k4L~tTnfi7L>YZUs;y_Gl%NVHM{h0Hdtx~eEO`#ImndmC^PIG8Wr7bdH$D?9
zZ_~iM8J6RVd|?n}5F1d_(-Fb&p;QaXn!&APKmu&5U+tT<1O<Bs4Z=s+N;#&@q{tzt
zwoEuDX}vt5hRs40$hr8r<BKbb%W7pVPM;{fN!!Vu6<i?E5s~2^t{nCBp9267%-N*?
z^Le=Q=E@h9aBF*c+PRH1yhOAH%+D`*3|zKcHb3@~@M5&wE*{d}HDup52sT|dAKnW?
ztpM|9?pI(kUi)D4UBhC90aP|-{fm+FgT48#^cL5xxzLZnMh1i(39r$N0k@M*Ryq@q
z6R?xn79D794RVa0yO4~E`rwU|Hx%w^M9dg)VHJ4s+sSX8s(#?f$a-7?d3svfyUVNf
z_+_B9cFy4T^6;^xrjg$IS0z6~X`8F_Gf9#;i=(Y~UPs1J1p9xcFL2K#?g3FTpcQ#5
z(`qZ$wG!fmIocPo9Sqdh;7X>xGG=3ptq-rZe<cm4OPockU_aaa3Q>*yHCITmjh>1<
z8WBV<C`D_YmEahXi8jr!hL3iY<mpoIQmRrt>Z!H;uU}0QJRm({y0sXUZrEP&`}^Hd
zAim=9Aam)gXj)>Y18;&v?FlSamd@X88EEt{ylmPQJ<R9D^_S^ZQ>-F+-vEdSOF*rY
zGkuppm<@kvPu)#Tl542(=}A?q@u;J0-`zhZOiNVs@6nNSWya_`s7sF3vy`FgcQws<
zEIh0Z6^9i@tq&>6erwO`KUnRx{wJA{(=pY0qy1>x`>()Ix&M&+r}exMF`}TEA8kOQ
zOC)?#q)rp>SGDeN@p<r1<B*MEJbK0U5e#fP8){oP!{3(&-#+#U{J?r)L-<8&O`DDb
zUhTnbRjErF%F2xy2EeB);O@r+LmK*bPb3i`Vo@$Mk{cm&zJOr&76^QDV}H<+@Lzeg
z>k{AQipLl_;ou7FMU$SSK&PRf2n-`IT;CIz^RSHlL-}!k&U{bS?v@`<10RODy!sUk
zUGu*bi6~H754)Nh@(KueC{b>0OE-z$bv;*Zd-=fQ*^OITlA`Y_`Y{U5&xuqruDJnJ
z56@juifeOH`}Hp}|Js!-&Q#|1@dru>bn`u^03%cW6B)T>#_4NLZEEO4fUHmAl_B0T
zo!3fm!iW_>I(KwFk(BQ9b&(W0vi@XovPAvUA<=?S()`5GUnAiC#aL>~nVFOC{Ji7c
zuk4#&L-xKyPWJQ2e=qI&KQ!`S2qOa-B%M%nsYU4%D-@#m(b~^|2}@!}avl#Oh8R9_
zk=WjSH^*+0aNU$&AhDI-#$7QN`NoZbmLJ&4`rs`y_|>lM7H~#y?2YKmWePapPFo6>
z(|rn7a8l7J>LbXsnG&*8eYwbpV2Oz2h4p@8)Al$Qs*#|oXgolafE+2HT?GLWQ9)0C
zg9s&NIuNSVe~n(9NKz-qm+--j1s*ZC`tit44NexZLk7)T;<=32hleHZP!1F>0Y&)=
zUlpfoPiy>qqxvrphn27cplHEyeT_%y{G{f*Z@=zCgSY6>;`gK)s4xDtl^QrXiR<^a
z;9t+JtLl)`*)y-ffbajsAwF$oBz(sKBei1POKjKWTjI^!(<PY<DRo~+;IB>nOVDrw
z0t;f%Mvw9H3;g(=3J^J_+Qc&zv;r0hrwS&~m|7VLoDbN~O09iO#7Pc6=n|5kqe`EW
zaD}unACAzw_Pg2(9KC<&ee~K|jih^^x_%%7&kN{`bYHgq_*Q2yb`kHG+P!>@_*=7T
zdXI9Msnhov{7YS*ayWjUS^aw>ZM-g9)Tr)9M&0U(&r0KeEq=n|TSH?PdH)4^7+PMe
zD>mET3L6Y(n&G2hGuS|>)!Zp#LBs{PWq|(T-7~5jRCutAjVHse;7b(m`v!TpoKFBM
zZ~v%zqhg3H+j;*y-ggNt7mpFF@)a+5U7rMQN#z;C7lavMDEiy6<$8;|g2q2}0m75P
zxi?&yw3F8dDAbTEGEuX5ji$|HmsEyf&gxwN#U8>gwras5xq!)TSI~~7km+J$zPcGD
zxc@Gt^w;ku@lYhAVvYeSd{1*CitFUgBIepfl+Nf+2Kl^_QfjYjh)UjRP1(EI^H=MK
zC5zd*t+TvNDU*{Nv<il=wdtOhI8y0*`Yu>z|1Gma7Q~hyZf2GB!HU*{JO6z^=5F)R
zhW^;bz0kk>d_MFzEReYWpWQp`)Az1boY(xp*FNQaR`7@sxTLTsqD4s#!|ntqn$~<N
zBpz)GF0VHgjtM2fBz50$`V@A?^FOi1XeE;<k<2Xs-42Opgf@V*&dHB-<orp;G*9ie
zkCsSH@YJmXyFIki_JsvoB89IXJU!^@h6+1kILA*6{Pjy<Er<&9MTCEmLw$&=o2c)d
z`!>_8GGOq1sOv3v$fz;Y)Gtc+OLF*bgPeT~cDUsK4zv#%+$#!e4l}$W;NlJT0K=Gd
z<B+U6e+SO7T-a(_S8{`SM=r+FCU=sO%d@}h0iiIeH)rkEZ66t0F7TY0?6>6KQQ4Kr
z0x<jT7TR5xRh*~W_W+a8kQYA42297^E|{gyLAb!`>PGR|7!Rjm6X^NMk%3c0noI6F
zW9pKhP@>mL8=8(i!3tI+37w6b1*5Hn)!*;I)*^%ooFt7<MWY{$@%@)*4aNI0ui1ct
zJC4S|6Tg;4PDk}iNwzsL3jP{`2E=n)jxU2^r{{^PwQlCaDcSlCyPzCaVNpYl=jxi<
zugMKzKgEXj^tt!aQcZ?G3Pq=VDJa@rIPm-v>FNsA)OI3E6?|5x`c3d)CF2D~26pa*
zLDd?iQLXJ{*Dv+rSDOJp_dt1;<eGS#l6hp{1rqJ_*-~PA+5u{Y`+k671VRa0JXPy`
zZySKv*ge4Z_xXanto~>>g+qVq)$7-9Z9FZ28r1P4!&p?g1e~)2VOajXGDPoMaWX4?
z{jyc?FtAan)6=uNgQYl!W+TagioG{cK(~`eQ9|n0Cb~{rimJ?d`5>B~qGeh)ZudXd
zci?m~Ootze^L6b$Y|-I1x?=yOB$VMyM-j631b4a6Xe3MQ^K>nB@OCYQ_?FeQz9Jz~
zl7`LwZQg@!0)2)R&(?oq7bpX#&2xXpb}W<s<(d#DBs35^MhWDvfr07C&wxtNFjx~j
zHSTakb@1iMDNJicEtuf^_iZ|k7pTljY&}Z`pK}Cu+k;@izGQQo+3a3D>InLe2}(+n
z{#NXIG(JKZv+VXd!-m!-#66ZjowRZ5JuJ5L>eG{UW}sWvFq{SdlXqHwg-#V?l1$3f
zbc}eg7s(Ae1jCBECkk|oGM1rxe_r1bgbXXWddA6n{CB#$ZYtTR{)6G2_jO$r@g-H9
z@<7adWJUkQ?f}nnkHEV%p3TWBWY77&kUN2xftHG6!1ucLnDd&J8-w?%N+Qc9@8^y_
zcc{HPya}9q49=nxc^>m;iq{}N#;UVn^wjpTRW;}QFJH&{`PbL1;us2HW84`mOp|G^
zfPy%hl>R5um2I7;l;q)Chz(;*RbmZc)Y1B7B~!t0)RaEJE2BIMimRqrymkTdgDG^z
z`TE4dd^RgNPIzg07Dz^vjCfZTy5E70`5Egf*^?dm0%v3^8pT<Rs!(cvEPq$fn;dOT
zE<9X^rXHO4)4wKX3B~=Mv+*NBiG6<ehNnn(>F?M@BF)Q*i(gvfQxIf1N^PEV+<We!
z%jrI=PTyT$)XBz|Vn+Z09q4S*DT;X%6pf$MvE=6@I{w7-6T~L&WeVK;gv0o{R<4T(
z_oT6<UJV++V>T65h0>e@@@ok0NzZmIjQNzQrvc~HzpSF|DSgnZ_<md{?#&8h?OE7s
zb3F|PyiL}50M8=ar^}7910Q#A-tYW#-i_-;i8>9Wh&*Qsdv})-s5MhJ+@Hc_1iNhR
zS+UI&hl0&%bAEHGSEfnOi)y^e;7dW*RCPfkW37O5pLYaDnZKn=4z3WnGQRR#I$kG*
z7quJizu<50`wl2L7zNz%pSR5)E;b4-e9x2AW&mN3tq}*&BBkr)$=ID+3HtCz2{;_g
z31(7jqYcz`f9_UG!~3_>!QKWKZT9(GS555t*t8;u9|D*T7<~ue<&S0+j*msO1n2Ra
zH|7CL;uENvD$;?|D#u)W{Qxat;t3A$*qD3tUf#=I(+ZBoVh-V$ZEmM8-Db8rTZ*C6
z4}t4d+s|Q6;EyPiW-^RFK;Rl*CBUye4Q3nu`}9%=ZflJ(FcCw%$vMs9tZCg1xk;99
zZz3^7HpkapYEZPd0c3C`b&CF#bRd=kcY263!{I0vqgGfj#JiWUBV=H5De2~EHDU83
za!w|CR-m^|KYC8}!c#A$k@05(%U1Y$TQ&>54TUbXj@?fqk=HFhX|%a3U<Nu9e|c|f
z9o{)%d;8C&D9*LD-?lS{&f6?Hujr+SYU#J?^e$jML+0O;b#s_Y5y4=f_lyn|E;ha&
z<!)(@-Cq-vqfedIp)`A*oZ{{QR4wI_1z<jtI751Neha+*qmAu?tNTpzyZj>A=;OmT
z!Imm#Uy#!4f_TSpj-Yc@4+Ix#TFUnw1Nw{`0;4XNEFGa5z&u5;dFjpVtK<C7g|_zY
zrNG2PW~Lcn(Ob7nNW}@`yc^_O^VhAk5nVoixD-som0THfud8*={d$szMsjQ*qsVJB
z*v8jvM-FX^6Y0kzBq&B}&@SmKVB~78BrL1bD$_x$8qhxOy~XPDhz$DaY9_TnSw{9P
zTqZ@2d{y1BT2JPk(p}2o^}{jMZ9FWV;56xL-(6u0Z;gFpfIa?%u9WUEtK;*F;@%&8
zEhi|Xvig?8k3__#yLj{9!(Lqsa&r@DB_gPVB;Dr!j-eiCB}*LpP2W0a=G1ibzT0Q3
zBeOh|v;Oh-*(1qgV8atIl}2uGxJ9)Raoq^KqZrD@FonV1VBEk=!0xBigFRJnM@YcV
zcT!7Y9Y0L6)=}$>_)vN65T^w#c>Fif0ccLy6pM7J@E`E~r<)V@yE@wV7v6~&J+Vcb
zGvt*Ey8tg0?;tVpI6WaNxEB45aA)J6v4?>K2CIX-sWlBJ*L6S4qy?-7l;%T!;%)5~
zJDkGV96rv|x*(k9FD6cNZt<`t$`H`9-wKyz^Ja4`3iB~~SycrJI5o(*GQAcDyE%`{
zDcyM~kCmw!DtGt$Y{>~+0MzL*M&!|u&lyBDgu@-LIOdfd7vLl)*axT+2rrnJxmI0O
zY`Tjy=^bbN*`X&M=aT_;YfNXZFqOh%7(Km&afZBHM>SF43PyVlHu{9dym+YB@(<6g
z2z~_Nmf0iyB!lGj<w8<w#W`?<Drf6Eqrq8h$;ZkFOd`v$v>%8yYCVAy>j3~xy1Gu-
zAYHhe+%h_{9lvU211tYw<3?up3a=Z)e`7h|Mv7zEHZ~#&eL2Bj7Vjm`TOFnOy0E-f
z{D7$|s7*BT1&OsWL6;5*#))e;p73wel<uaT)8#9|w|)*exwIY)&BYF(Xs0G~@rN_C
z%P6rkiTr`F>#DL!qedc*<&<B@{9F^HEfrPO*YxalxX4>~XBQ(AGAl}>U8$-a>K&f6
z_2Kevx5b^mDxTC3BB-!lMwYs^oi&0*j~~vKc776u<q}9-+mSpurmCIFp&!v!#E|3n
zr2(tH>y1p=*Y>w@#<$fOJxOChgaORy_3E%pQQ|gg2LC5z&o<3i(nT4kuf$|;;;xqP
zV9`AJ?n^eZ5uEHvain~(z3bEM(TkElzV7sv4L!d9ML~;xtO{K{3<HA2!MbC6UlxZ}
zmR+arI){Caxv8p9p9|qRx2i1nZ3!f}{&G&KcE118*q{)_#g;Z(Z7*75|HO$wR7rHp
zt<ej1az8JiKezQ|!<04!>4P9n@vn}Z_DF>?(dw3v;G&~#{u83G1AHQ2l~Mv)>xawb
zg_rH<q#xsVpE%A2X>0N6J@sd$@7>+P`+d9-;({etUTaxR1kxJ+tW}<}%*76b$m$Sv
zuo3e-KVEQrjaQ^YuINv)(WuB7okGlh5R9|4H(i|5o=0Tb^kjWsO~=_nTQRAV4%1ay
zi!7a9dIxWQz)F)68ftCd@6T81wyTyVM)X4c8lQkGnE@#Y^#CbxWnV{8wG1>>X1}Ae
zseVhAcWfHJ{PuSMaY>Sl9{I4Dj*)>_m9jRm0{VQ<&DB-<?xD^y;;U%+Z_fDJQ54nG
zq)?9!{M|C=rI4PTjO=fn<)#IAtF!&q!tUi={eSg;vlQ%0d(*OBFUq=7yH7Jx>iZD7
z3p3?4Y~0;k1xlFVhT^m<(rQ6Z)Cf|buI2P>R#DeM?5f<KWts2?%HW%W{JS7l`ckaS
zKxoU7u_e>d9jEpula~c_Gr)*9^R=a2kGOl8flv)FYEHupgjs1`aUCk)zwqgj51Axb
zDz<j|FmET`1w+H<L+A-h{_eA?Ggz6seHfm9H<zVWL-TxIy6#7!Q@lW)u3$}jB}`$?
zMbF4V-PYfI8CErvKQAuwXFC&hDp0gopFTa}F^*EatuisH6WeNhySc-2dq&;$$zIT<
z=)m0~^EBV$*QTF!em;ts=AeH@Nmfy?W?qVyu1gpq2g3X&%PzQBPXpaA6nJrveQn$h
z`4fp73COvds~3h;TWuoc7JyjDID}iy*k8xpAU)ji&fE95vo=En-`?L&6fcB-+Q!9b
zLh>e`vN`#vi_vXnzw==4y6wP}AlQ{;faOwO4VK8qxI5f&!R3?+S31m}1;Dx0y8?>m
zu`N?{=z2vbZ+zJ6{>~82(?`+Njr-@fT*dKrczd6hDww@VH{ADPn2Yll<axEMdl#Dq
zolFZS4Q7#gV|OhUWc)L!1ITp6{)h7@wNH45%*1n6Eer;wpOjKjj76dow=)ffK7(z`
zPRB1Bu>W?{_%I;5PM-p%#Me=#^iOw;w78+U9W#?=f=of|s}T3IK8Ouc6aVs3gXw*u
z*ce4*$?f#Aj%@rQpd_}w7NUz~Xw0ImD9=wxr>(dzzpY2w(3l%uJ?{A27*M6V{vA6_
z>UJ1I&JOSs2Mk!7yl{v>uBN}W;+yev)&%klRAtk8%+5xl^+(I<C-Nf;NcaE0*Z=0p
zvIzXnQ1%9w>O>spMSdF=8*IcxQXh*)g~7SM(M=`85Ez()?t_}Fa8}6Z4-M_Jb2&mh
z!s?iX&L3p2fkUrWw7}uH!*A<bwyEw+p@_OnhXHFE+`Y_Uwi}u^I(A9n6*E6*lVUJ_
z>3NQmm)rT;r0)s|Jt^t^HBVZrUrSpj3XZ4CGcmaRIC@$zkC@4-osQy|&I<g`5Tv(?
zXb%{<2pI`?7qFk<{w(l<9nFM4-ksiYwndgp_pjaBJIGun-~b7_1rN&wy*s48NS}9=
z(gj2OO)!~h9}qk-rmT~O1@}!x(yz#D#|E(>VNaZ^KdJ_K8eqHh;zEhPg*?K(<AL-k
zH)xIh*+a8Aq?xG_l<osoGxcA#nCP3^sI(d{VxNn9|7tMn!(>3ufK0cZ8yuFzKrG`o
zg(C?8gKN9U$6VXcgWW1?Z;L2{h}35QZF5eJ$plA7aK^xP@x~Dxj7K7C)1QCxQ^>B-
z`w;ZqlcN7I`$R!QnUHGrDn#20EoO&|y@9xXz!gYoCg#)J^7Z4=Bjh$}#jp=W6wdEl
z)=(S2omy#x<+}&zveGJg7(q4*2JD;nZ{XP(-@@<tglR?TJhCC@BiA;aMYI1^wYt;X
zF8)=Budr^;yD6NG4S*RoQ*LWfX<r=x%H@(V9jUT%TXyUe{l9SL2yBDkN;$bdV%jl4
zVE16D7m&bw-|m2Q8nHP?>rzm`La8`@$uMV#zV^~WHjY}NPOPSt7>6vqoQHsZ0~g)F
zj)KvCqFHMG`hg4mwhop4YtDL(Go$1_5B1K$YRC0<zD^<<Xco?__(?lQJN^h66&m^*
z|99Ly13!*DEAni{rOd-nEntVQ_%^{}6<&x!6)vKTe}zAUL&0ed<(pFI7-#RL7fN~}
zsMZd)Zn<uA@@PFtiRoFw+AXNnGj<avRMz9%a=s7J9D%xC`cvcYM@sl^<Gvj+<ev&*
z^K_{W`0A`GP0gUqOOM|^2g)PDqy`zHYDClq*g+rqDuc?NzRqjASgLOoWgi#XsZOAg
zz^q~f%M(D0$#sZRD}P}3M{*afTxl%$tST5L>X%7qg!Y9`6huK%aBYYmCWP?j(aJEY
z6uUY0>9h>5V*OXH<jK?Cj}L}bvL_RYtr=R_Hm@P1M?oYlOs`U7(7*G+k6fw6o&COW
zGGfF;bu;|n$Am#*$Tzi&8O`Aue4!M@O<v7@TU=HKT#l)aG9xa2rvAxx_3CR1)NA@P
zIFx=b3dfeKpr8*8NZP$8^iwwXDvm(kQ!>f8B9gSV(F;EpKei$W#Y03uA}SMmn}b9a
z)24EEUg*`)#@u;aG+8gIz-UAN#sFU*|C9_>@K)qjf26P64XANMG?&+B*)68hnw3?=
zZ2$R{7QSq4o+}~7%lizLZT*Z$qLi|N6<op9`~a;#L>r?ruQfisHOMCpTJDTXShCb_
zZ@P~=WB$dg@g|Y}$-6|0Zk-RBHlA4ObTy4D7anIjqxddrz;0@kkY!J!_WZtLe%|B5
zSVYOZR-j#`%0Rut%lWu;+mV4Op0_TYXD`--az$#cN0eM@FKm_^$9(35if(I<t5jOb
z>lahgi%}gB9;K$kRsR*I$4Xhwr#^AmDriy(jM9f$G6S*lJNCeZ6Y_elqM<v*!S_6I
zl3cC=19}M~&;0w<^u>5%vkn;Y1mlg)N}kc-TsnlORGHt%r}W8pmZ-OH*2KRD-x>%@
zTvL(~=1uAwJ>K}G5A8%L>&T&jv?1uJmR>5VgqyZ{YPAnzC(d6?Xh=qu{E+4Dw;F8R
zAZMF4p~1+?aEG$1LM^iy!14XCc|?;(9tPtz!C;6cevXOe*&Wz|bfPkQV>APgI%epw
z9&w*GNM%U+9A!Y!#i_GS??E0iHZV|o6p#ewlrb2g@5F;UQc&7)A9wMV6F#g!VwKa3
z%zPUS`1)aNMyczKY*9{@_3dJSOzeE*MnWfs@uMLjWpY)PHxm)kGypn1d$Z<cFyzl=
z^m>sl1?e3;D@>`I;UPe)Kt5!IYUmqIr9B<<QnsdX6QgvureCc;P`<2~H*TP<m{J&S
z=9K+U@6}$AdzIlr_Ir>0G^wqReAxVkn14oOUQPij^Rmcwu>{zsRy$I7UH^H_8?#F9
zvHZUC#sMC<h>JEhIF~#ZRoLF<)O0Lk-q0hSKVAn`0sm(cYBSF|=rnz6G<tzu*1s=M
z=eOvD_)!Cvq(a{`t44JKAY=e!J&$2ga%DC>SqGl#bX{~Jg`X%-48s~H&e&>1ZIETl
zC|<vMcVfwT{LS4H#!At;aSs#Kd5!rh)ylEcg`>cc;I7G1?Z{>8K%03ya%LB29!1;c
zO+3kf<n)^Nd4{?Is_1|xeX-#Dy701;Qm2*!8{8(weS&ss=+>e_0>ZP9Ubm3g2w{HC
zUP%9>cKoIfS8k>ral1N>0L>i=1SA%+bfWK7IK~k-s1OE})@r^nwxOv!crW11+P27B
zyFa$f0-iD*@5V*G;x_q$E`AjYR!aG{y=ZFWwQHTn^JAF1Br4q6*ktQ`+9;l+r%dhF
zyCy{jKgg$@5m38d6tA3r?9+i9k4^-yz=WiVuWp35i9fsSEP~K*%_}Iay3^AD$C$?c
zA2oMZu-7u^BR2K?{9|gk|E`CQY+x}mC(Gk8?e*>C`H6*frOp4L>aByK{NDdzMPj9q
zmIgskI;0x}r9rx+MY<alkWM8<L68uErD5sr24U$~x}_VQv%WvS@60pfjDK+N9Vf1H
zo$I{9?{jT%C~Z}nFQu^9h-ZsXE&JnV=Q3vaGn;~+Qi9c3=d4Bq!`IowyUr`t7pMt)
z;mhN-OV>XXNzuBF&sAgWn(0<~5!9_GFTQTAb@Q2Z%+7xL)=HAfqRTdUU1HP!%d<`q
zXbU#<{F80u=1A$a7||2PBIE~>ithrz5FnACMt^Y0zCU~=Uh!&paHQ(ngz;I>%~sX<
zpBL#>XRd~YdD|Oewt`iAdbxw}<q7xi*2XUq07bw^aVE|iDnS&(Et)=g`dc{T^xKBm
z4%gB*+EY@g&yz<e!xQD}1~WsoY=cE?UDQp~p)44?e}`{J&-Kn_>adLHoyLVE6=u#G
zM$!9BLp(lI758N6cz=vJep*5sEE%Y0k4U$H-@HkYCE&Qvyya-zDs2KVeu>07axJZ|
z40qm+|0&Rk-;|-``skS>5%pTlrVtD5<AbyumQUkJ=)IwwVGm6o2eUsPbW0<<V)IaI
z$9j~cDwL(p6!FsCl&Yb$_TW-lmcthz8>#q6$TWK+^6>`uw+D8L?ICX(qoEpal9EEz
zly?X%CU;jDQ}Ua$X10Ru5Wn6*AdoXbeg9hOTRCQ|?JNS*K6PG~5H|fj^)x>pTX%}O
zq0N%3&V#)5H+_|>n}YUQjT3G54(mBHIY-BLmM_tdEW8c#*8aN6J#o1wbem{SU08c6
zAmxp1jKvQ0;9Z*-jzVNsdOushlv@|+ryu9bRuqJD8G7B3Rz}(i%a7DfR;jW6WVctU
zwJZ0|9t*+~BbyH16b!SIioUN0_pg{yal4*)gt^-CdypEdcl7RI<ILr6&My<jGmZgQ
z)d3V$)pz2=b*E2u$Fi2YE~F<3E83RXx$R=VwzOB7du*e6t2DnuYi1)2hwu`GGi0|l
zFJho1>uLUm%t3uv1Ae^AP^W(OKt=3g<%g>>!IppKn>8dhNme~`2pEX0SU~%BymxKd
z^4#D-iC=0_r4|G6Q4i1qqiYxM!;S!5lpc{SmBJoGYkuRX2G!Ht1&Gh2s?rn1vvFI0
zZ%X{VxXcms<c!{4%ysElx8L3@H8A4kPb{?y_6+>3aKJ1)Q@|o&h1CNn7#9IxjQ&CY
z>G<VRYUfk3vRYIa5rgxFlSTe{W;9p1k#vpIP5sCh+l)GHCJqOEquQq2lflP4V=Hcv
z2%yZbXg`oNp`sFhVW-sceTp4k|9N-&F~es48<Dau;=bYKqqXZbH~GPW=K>gdNq!Pm
z`4qtBVEAp!_7_jfSE<4M51p01JD;?ywJ4DX4GcwW(0df8R;moHQczk8JMTHodoY%J
z-M$)gPqr(D?KRygxoywix$Wj{PIJF3`StwguOi@!^U9}qadLFodCg$;M4{KAs^R%N
zm)hr=*7%GRYy9~({?KnWBAK=MEH0ft5e@UVtz41Ke6+3fmq(oMbW3cf%4ENM`2zn2
zjEHSUo2FMFoA*XT@4i9ws>5?#y+*QR&9YcBRm7(T#coh;vhaw1HT;z$0dT7<(WPPv
zlqNZkM&7Zv944P~-MGjqi7W9R*g{zgd2dOWAcg`Clj11T4EEZ(tTl0V_nWg+*<c8z
z;pa@PY;!Q(23bA(%n92@n@5rTFKRKXRQepzR%@~@`SZ&&a_u+ILN2FHB76B}E|_Mn
z@?*Gc>^Il*ghH6sD_Jc47Ir9euils4Bpg9%Ucc?A6iy9ACMndC)4%bp$qmwpMy2Ws
z`uFc@s|H=|$m<;RUzS&Csnr#dztZm~9WPGYO{)-0OH$))dS!?;WIat%>6Xfo9r%Mu
ztJ$mMAo}4Z(F<Wl#CePKu-=<mK}*_;@8ZO9x+odXI1{LJZ0?5{Y*oRrpFi2$->lk1
zb)<O1o0LNQ^{w4FF8)lP-k1Ciz3LX}Nz3aG3!(-K_4}o+Ou_i-xWFw*J6>)J2jo)s
z5nAuV1*8;Yq#zGb0e_ZE+7ykTnlsk#>8R!#4Jma<^avcv?)SYp=QlsfHQjb<gh9i-
zU|QJbM@!R0J?Z?MM`Gh_C1WV0rZ$<llN?N_y>d)4MR}O|r*(iXRGW2MYgo{{t2QTK
zC-_<yWw49Pz)dE{qcgWN7@vEg=RG-LC>DtwI9|j>O8K}2<4d97<Kp-23};HW1U?_^
z%Xa7xBih8|)RQ!@GZ*_b(wm+lVE=->eXO+kcG#1@Y-}-0;Kd7)H6Y4a`ZSmwCw*SA
zuuK<|j@bmI`x&HK#71)bp)D2BAI9hbG`LKdBVC-BsdEo1!Rrn#;+9d{aM^d9{`Xq?
zBm8LxAX9cfPT#NLeUM1pQWpO1#YYz$hfa(7=CfCI56=md`2&Hv-ilCBcb6(R1)MFY
zk5Ecp=1Lx*(gBDr#SNMi7nNj?z5FiDi%f+|)SD=E*H2MkX<8BhV^L9c96|Z%63Cl0
z%Z;8yOk+8%tsCEL<@PN_B(sO690A#i9oR3I?YjBII?d@?iP_g|zy4AjjZ5MD($BFJ
zx0Rh8EyMSu4opw_iO?#)Nq%T<lKKqBNS7_#?N_6ei(%pYI=2fSbsEn7J^m5F9E@7U
zvTe>LnIZf7pRP&A)M?P9758q;kf-0^zH@NgXlCnuR#-DYD7D$j$&(I~831n*_K2^m
z6}w!AZ|RwYgEriv760Pt(~ap7z|#G0uP;J<GaPSc1@FY0PS^sjC%G2vEHy|A#Ys=#
zegXU4@qZf>7rnm#0arjom?+jQx9k8E3rA7*_7j%K8Ph>|NGet1#3l=ZMJ2w#wfoLo
zrRDCos3i3jnV?nOXBW?62D=ACpP7bI>Exy(io^9|`2_D$ntBPOUQ6!`;n`1>tv)`^
zlv&gZ7fU?e<d2Sxz5DVsTUzAicno7C&$!X|Vj8eU*}6_(;6ET!n5D9ibn6?0mdxCc
z3M@7Fut^MVlKfC6luNXp1?7y|Ze{5*6j$BWI-piKjH48OF@QPJmBZ67w_gfiO3FX{
zTS;&&szid<)2<wFAyIPi2LZq)&tu{a)rp?l>r6jnh^e4x7qv->LOF8q2#!-<v_XGv
zWabEZombdxD`7u}^*FofLu3{TaBzB`(MUxPml#omF}KR8du&*<N!JEj8c2*jz<)5h
z<h{c8N?y=&fVVF-r`TM^1A2oNY3~x8kes#c(!}unEu6RSVuv<c#*=UcBDn@incq8Z
zMXpq`mt{yh0F_ksAYP8TC%LjM?zi${>%a#xxvgRfkCc-%G}2A-Ye0f&tE{#jW0Hfg
zFiNu(N`EZyB|=*bA$z6Gpe~e^v!TlEBQu?MMQQ!KaScUi&c%c{gDN-yBP|T;<#Q+M
ztD|fik)wW|rOPqah#!W!L|AOF#Vkl<>X)Y~h`i8(6ozc9Zdn?rnn7#{>z@l>c|!Ha
zFW25tjY<L*;*$9bp<k|i^cLBiuzK(zzY-J4HZtN4fxX#1_6T~;5^<H<Kua~5I4?If
zR8HvoIyCJk2G?ONIZer|x>8&pT`A4?MLhPt#Yz?EgQ<PFb9i4#-pe!VliTD0%Trek
zpgW|8ulbKHs~^6%dRAGoB?dkdXF`^M3%0@loH=!M!1}=%o|FJI^_><B(*TnTKMpr4
zCMG1J`CAn5LE}f7=KwwIon{Es9{8yG3J|JO<Ck0?SWkGxIl*2(WPPiC;6xlW@a1!9
z-P?Jjb~A^Xj*R>GrU9Ou`Sdn~E~mNn=`(<ocjtWEi~!I&5unnJKbj#&yX&a-Izx=&
z@#8}vSypBd$x*Ad9%!&wMo;pFuU#ZUmq;2LT3TBA6F9c06=@A22qo7{TF_d?(X$zX
z6M{C94)yrmN~~Ptn4J@&&YPZ>1y1ckSnhK{HU6n(RL8Tl7saofl_>J7**?jBvl4PI
ztRNb29s1hdNwlLQ{kQIrZ?bSP=s}%?R~)`fq~oZo&{mT@7^tAhi*t=;BFP3z_rJ8B
z$IdnbE)3$A)0J?eG<`?ecdz8-A4;yj%r!i8t5oFgas8?2Ag=}dn3R!AMmUv$RPDeE
zfVT3VjIVmzUX*D*VkEdf6tAM_IVdjYuQ5xXZLaf^IJ)JN*E7zrlD}?p@}Zt51;#fe
zoi6ZT40(Du0T%lrA^Cuw<IT;&ohTanC|BcQVzKW7_J~W)5ZO$zY_m=@(2t}g5UDPW
z+%7YBo(KcRr+Q8}q^#3GBuq>eC|rix5RQfE`}}3ZeTS_vNuPZkma<Cs>=)pc19y4&
zAB~VW_rsqwH_Yvh24&{2sLiRd@$fJ#ux>7@EY;dS;W2J6wge5<2Iix|o31?W_Dn!4
z5CRsXUjU$^{Ke~P6F^OsBauZ-T`0GTwKQ-Hj&qidFR)^Mgl!+WXA<oCi44o0Idx7k
zj#2y7a|8)p_Vqh0q2tY^MB<?S2YCBroZQ@p)^hS`7hBp*-V1>K^_LH*(Cb&@0`r=p
z?Ft|~^JX|M6PL-%&C>iYoY<+wZ{KI(N(21D3laYG7LxH|8HE)_78DsbA4IQx5x!>x
zc=A+5FnN!Ey0dz?1ENILkWHE>*{DvA)9Jj>lzS~pyAA<YdDbwg=^i})zd=Jydv3*7
zA-6`Qrm`hZC?7v|PJGR1Ts#Mad8C>-Qg~WT(Pdm-&SIzYKd|NpQfAZ*cehtfxRT=?
zDf(Hb2ybk1Qcxd<Y_c&spP<UNtQjvuHc`|Zr!-5#_QGATJJ_Tyu`0u+8vT4i8VRFN
z6TsMin|gP>E*`Lkgm9;*hEzo3`E5vNkWo+s#V5qV4d0rZx8vdAt#4Ph1r{iC1qCLJ
z`!=Cl=#}{2T(&HC#To-)y3exerLq7@IDiPH@js8|pLJ|=5R#g1)&@2<XS1$jN*Q0`
zL;AQ4^-A8hSk&xwf-|ZYjbKOmiab2Um9P9I`VxJ1SDZ&b`vr_Y6{n95^_l-{Jd|LL
zAj3IYcg)^YV&4=Ky6)!;onP$M99z--2vgw~<hD`;qxMcUGG#I^l&cRVl?19&YPtl#
z;(Xj}Np2)Pt^*!TS92aXI5;;E0HyDBJR&E~irC6v*Q?klGYCn>z`)@6E*{{oNMiCe
z&RQMX)Z-qePdkuBW=g5~ERmKr47LhR-%|_h%jz$YkVBq4m5khCvQ(E9ZweBp?Yo$@
za-2pWO$MY!b~&w{1XqyiIVUEQ+4=)<QoESAK@D@=5@6ND5HSt8Cz8OL1(TJh!M{32
zdOT$s(_Cqo)cRhO(NIvhAi=bE=RnydU>%amfJ-HG98kYw!Eq&CT(kDo@q3ROKMNuW
zAchhbN=zO=yJlrefejO|1-qr<4|+r2uLE>C0!KA-K11&9-L(ar<L!TVp2}bzgD<&_
zu^(`EB_6e{;E(R|67u_*eakmB_z9new4NiuXprj4Grlv@{uuzq&;BB_4T8d{ysvwl
zAnp8E$?WTlnkyE2g3*8<Dl~+>pKiwi%j7q`#2Xr5y2W#MyKr|^oemNxHMwrhL*y9#
zB7QR_e$xfO#(!bIUk6ZUfVJNu?145FCFL;yFhhal^*Yy*0R@@7zm=*F5{9<gdiD$T
zSrEnj#P;B{rRT;My{R7c%T$0Bz626-N2-RKU5C39B#L&S>tyvk*Fqrd)As)P!Lq#X
zqLU%wvOh&CJ}y0kURy968rIfhdu?p*5$qZRh<I%={SQH)sRK3!9Fq+`)zyBNV|gm;
ze%`(@fb&d%a&yUNGf}@A{xtnOfx(<aQBm=m4*-Sl`7Z%FQV$Rx^gdoUsbP$~2Fh1Y
zhrSDIi+UYq(@;?r(X-E<?#@W>cuW>n01c8BhN54xN{@eHlA?x*-!6;a-cotY9=v$g
zxbof;2<_2aRo|U1>|L)s6~FM)=1J?o;kq9wDdM|&Ddi|*;KFW{Jg@iok(4)Kgh9^g
zQP2Jul&g)NZg<58?Fgt|?frnsc8j3&EYk|mT5BK2<QvtxTB{eq%oB&3nwCN+#4gtO
zo4i6Hj{sc0q8k}Jnl57R4#XRmto+xkaAEK884)ZZclc&D&YPn-@0nMZ=+3(tVkK<e
z+XOT+cZ<BK{0M-<*z#!jw)5yY`q`43*$Db!w)&Tic(*6UcPHES^#`3)^shzw2u4v<
zy#WfZIADvo*t5gxXR9!KhM7d8aZ=iS$+fNw;IfGyrTk|;94J$IJ^D$YhdxL2aMO>>
zv(X^s?UBG4e%)!uxxtf<l4~=eJy{SNs7X4!Msn~u6mHnFbG3TiI00OSQFe!<C7P38
z=WsiMDzN0H23wr{M4(2VGTUddtE~5x5&pg@on2j|Kg?qN8;*eu?{%BF?-Iu?g5$Oh
zXyDxRp@H4FOEB4RtT=!-1W-^@-=^u?*PwMOYo><YUZZ|)qbsTZA-T#?Y}DXw0IfLy
z;`EBWe0(f$bH39}KVi!9(MLQD<SSPne%UTr#$mFH_+1|JaXSDs?!6jGXiGG06NZz<
z4q&7%Q!Jc!X84T&R)+#ntvrvTwC~l-g4j7l(*Xqrh<{7vYO_)=KG8awNTGKC5kfAn
zA2B@}t>+-Cd+Nv|a=sY!W$mMqQ)HajM|$m=4=~zwzxH^R%;s@&+FEt<2Jf$7`ksyR
z?MDjo0h#phbWtCC|95ZulGq-E;!*`J^`ekL<pWqD27o^ybtiVbIg-)ke198_gG1M0
z(TwJ55{JXH1?vTeVXdofx!)3@UpdU!ST$MwY-Wdxh|NapZpt3cl3Q@4xP2zQlo?7b
zbo~*}cX5AJsD;(dOE$m=N2@csr8nhxvuh|_RQLriFE7$Ppl2Ie2lWO7$KOd)F)kGn
zP1(1xfMIb4sxRi<Kf(m$OGokP(Vg(KoRr$_I5owOQiq~?QO7ERJb?57mhtUja?_&j
zkoSb8u0tv%C0empgb3@9DA)yrTC6PoB~%e{(s?uAwHnfGR!ax@E~4>tF$rSq2x~!H
zB2A$<lRx<&fEEiu6ng^cE;*3<i4#NFix_z`6@j(|m5(oI151HLAfj(v8Z_%It)6c2
z`&Ch@8BO4v*%eD8*Mya&Nqpm-%9I@|PJ08rugjrW#`;A}*Rl%7&v&y<lqn<j)t%Cn
zaV7^7A~}*iG;o!g<n4J>U+W8Q4x*I8eN%E>Rvy_tm(41m*+spYwlJ1xw=I?kQ?CxV
zPO|fLp2b;x>Q-<S)fJyiu^#HYTy^1bvx}%v910R_ycXEuBE1ec+_e?`I$rnI&*vLm
zVO)Xk+k6-w`PI?nTa*dC^`VRmg9h&ta}o3=;75nAt&gKMEgPizLkd3M;1h&+{(dG9
zP|$H(BNTA)?ISpi>tDWEkag5><%`F*j1J<oaji^y%0p@}87s)*O)!l$Z^U^q5I^X0
zLaJssmuB$m!o5elK>0~2|EIy&t3lgT4Z{!a8P<l!2*p95LvA&wX*6Vc6>gDx^2ZL-
zVT0-DBp@L}yU6FTsn7Ppa_(4U>MoMwmkQtQ5S^{$B4%#Xp^pJ|l^OSENAd-(BI721
zgZ7b!%#HMpnw9nWf1IV{_oWorM-_$xBacy>zwaf*iuTw>=m#I;t4-DpjDKzvVL#hb
z(kRr2%T+Cf0tdn>iAz1Kw?&`)MGIls8F=f3fShJ$(!)n~b&{#Fzh&l*_ilko{3}Fj
z{#2v#F`Azd@f+XKI}bF3V&+F_9)d1D(xt~$O0iEjyR6W%bWQvssx;K2TO%}HVp;1Y
z6~KuiF7K3vba`;vCx-r%DyKP}+yoRg#a^9l^woX6{|3MMZ9@*VuCrluu|bV9<&E$0
zI$)j$LP!R#oj(>7kr-rFX)BH&2F3R_M=%kZ*dV<x1U`JUDQ+Oa;G`w4dRF|h4ZeHC
zlK$h(kJp+KR-cH8s||K(G@?y)D<!_;@PBHMd{e^xCOV>U^^&PImAGz88AkjyYB<Mj
z<Yo<F*it%?U*P@imEfk6rV{b!QS$znE!?q@umc`psh6%fwR`(*YM$E1Nbbr}{_bg&
z?e#vwqk){sqybGqf^>j<^<yN(z4!a=wQk!?CDbTm)~7Ox7vW&#kYA8gV3&fV3WI3E
zz}=7p(%n_Ly`_kP4*J=(_q%keE!Qa*u={SruB99hepz4Ak9}-L^<<rB<Dk~@%Swys
z#`~$M%$&Ui)iInFAgJqj(DAV_3#$x%61+CN<JGN>nY1d*O;Sdi(Dl00gtKkj>5t_9
zx?AXX%(Y)YJ1G!84ZLl7zHtXv8@{XlD$DNPaT^fdq6`p&RjkC->I^@#?;K+D{@#85
zhUK%PNnD-vRLj1G5l(t}Ojv?%P-@!I4v-0f=ZsRx#c!Ua7}OP2OWY7YmJNE+siyfX
z4OymPvQ)L}lHKmjMv&X16EOSM|81*<uGI<S-}RiztUWE3xM1Zr{uA(qj~yOaG04hU
zGhF00l3*E&m8<s6?R!Pko3K%e-f?4ze3q;+p|5Gh@B5V4VN!%GSuSCh(<dZPCXDsu
z_)i8VRBvTIlAA~PNw6|kS-K2T(v-O`X8uM=u6yKzHKAWJ{q+M3O`{XU`K^tOjTM)S
ztJ!CY<aGArF1k|k8B+0)_)^exu<c9R2vL-;32!CYTYCLP6P)n#&&(fh-T-GSY2V%5
znQCo1XDTsYPg7tNri>as9O?^9{90d(E}VflKg!9yaSvC<hJCjSLxDYY9oQz21h2hZ
zz`uG~@11-+^**z1n=OOZ{hgqb*KMk;HotLGSFJ>3cZ1JgQ8tD-<(7l()5klM+wIOr
zC!-6s%94hd>s>cQRC3=Jv)9L=W@Z+ff--(-38@*8SuQ`iQuf+9?iAGKmbn{pj{_*6
zgd-oN0;sdJuCe{RAqJz#8425kAa_0dZQwFa;ZV=TXWu(*QNkTJs9OHgl{2d&N-hT>
zso4DqD`SrK^~OgS85d24^RU^72%DnXDpv2j3|p;#N|x+Uc0%Z@zSJlZg=hYX?QUas
zPnR87@p7G*yAqNE;Lf|JVHepJ8`m%;O?ah6iua%KmOng{($_^NLw%fAkdtq}@?|fo
zYQM9IPpPD*((2~@z6vANYAk-Yo4fGT)~giPt&2QBWzx+tebj8^E>`gF(`wh<S+Ktp
zSu|XZTGby}mG))`(|NpBtXGK%9}SLTQk0r}OievVGwf|P;tduOboyl9db-pidN@uD
zzLdNMGsuU1nsL-}XDp=p3or~_oUnEx>?1W2NrUs>jS!pCAXUf4i}b6}%^vK+`-J}f
zc<9GNP$PAxxE37^{}a7vzZN*bMJ;B?tJ<7>Bh>!OqcngN{=J!~DR%o(2yeT~t`nSX
z+2-`@KP;aMW^qv8{=8R5A{S5({RXo)Qkk1b;EJE16ZF^5sCCKQem`d`Xj!(Zl6%#1
zA!R(Z!!JG$+e;B0e5W?9sxA7W18R0^amV4d-UTgY4}(!33v)BQUZ4s`bea?fo~V2m
z;&a-W<kE4_q=O<ZrPtb($qIR+TXJYglEbhcfK`)5z-6tUb~GviQu@}}*;z8G>l2xw
zsuyW*G*HqG%7Wm%M02Kn_90bGL;7OmSS_)I_4h|*xQ6URzlO!gSMdp!RBwore>vg0
z5>-TkR>9j#9satQy}m9#UX6%tqAl~QdjA8F4X1G`pRDG!ld>+`Aq724b^eTW9~bH)
z7d_W+Yj<B#T`bSmcMd)6D`L*ugMj*M4fDO1Je{->QnQcTJPcmqGZA<wK>5P-&#7k#
z@u)?}W+}*hBI7R5%$(!7gKWPXa+zC3tBTOhg@E|iAp6MJMiVRT2bF8JqKDG@d)vzs
zBS1JQLF1~DUFij7mCcs;c!J|4j2xPfbN!(4_rw`XK2b%{LyDJnkH5-4)mBJYUmW;^
zS4h~{mlt~!m`GONfOs)qNLUr#=i1<^ukUVnCq5|W<#rQ*ld<y6W(z^uH_m+|^iC8}
z>*ePfP|KR1F=t%6&pKrUKYK;Ba~R_Cb2Y_o*Q-ES4sBgj+{)c6VlMC2*sP(RWu{BT
zT&XbP7aE5+#PQ3BDw=(G%a3(nZQAlz7Fr(1r`Ex?oWAk1$3Xw`SP6~2NP<Ko>UTHe
zZ^~T!Z@BcyVUMt6O4~YU0w;QMgYat+;Z$Ky89ihb2W|_y6Cz}mJC93=U0P&*z1JxY
z|B;9#xfj8yq2phE_;n!7J}vk<SH6!;C^xGtkG4E8OBBO;N_PGC)CKQqh>F3v_suVS
zatCZ2e45d)PFt*TW_u;6+13Ht*BpojrLfVoNPX+aY6}nYEg#akV90_s$QlQ^`r|S+
zPC!Zc$&)tiYm)aJoNoF%h1Ab@NeNrY<82%VzVZbT5)xto$5CN`wH%e)+{Wv?6_tUq
zCgn)3^APaQg6*f2$$5;|xgn?c+oTH^_V(2|xw0Iq@Z2EuOR|lB=xQyL=VsHKX8upP
ziE)nzM-v6_qq$<inEw7TyDe;k&vv8qBgIszc#K7P=`{U37DCAzFVHNeVWzrj-z#T5
zsSTW=hs&H6>n6WA@wjIHO7mvCsuBB*Uj>*pB$ua-ufTr56~8J3K%;EnP#grwMD@*u
zBdy(DA1S5*lYrqpEd!9B_sT4`^3pC~AdzTcir8hIs<^hQn#O{v2G>E(>QZlOJ?YzC
zDHOJG{}j@5D^cF9+}25a6j11Fn>ernt2bO=PR=hYSiNwidFkceBT^uc_slBkSx&9J
zI;p<0NveBY;Br}))%dn$m)%ez&oet7*;;$yWai!~vD3ScHr=z7EzSyTu$5eit>L&V
ztz1XxU;6Z>ZsFa0y7_N@(-&U4Tk535OqTk8QuLYPe3I>>x<Vfum!ApJ1&3iN-=YK)
z?d?eHI&xDs7;pC*Y#|!fnkw6=N0%oQ{PvV&R8&+Sl9P_tF=*?%t<ql+tjg2S011Yt
zRdP}GbFs&}2H!$s75#mV>TnBf*0&vmo2Jgrg^yjv>@XqQO6AJZbIT$b_8M>UHrM!O
zlq*Rnu}m`<XRNrWzp~|}R%(p7h#HC#72(|$E8QAPe)w|N;B97d^Zpyt(nrSfw<+q0
z{&y=QKjnftNc?|_<MkE6l)CCmG3U;A27fLR`*$k3FIj$IB<&|&wfxYBSX@~#hdl)L
zffzabK>gL<Oe^HROG~Jqq8nE(sphrZ`nb(ftMVsypLkvaSgEp}<s4de-!Y=R-Fx!p
zDtoX|*RS8VNWp)0z@9`SHcM!FSs}Li-2x72wZfqB7m5Ot1*NU6Wt^WA`Y<PFQd!h*
zLE|KWJ!YUj5%qmg$LHcnn^c}G`_x^~UT>e3PVNoY3w*llwttOnx^e+I%dG>V2QeTd
z<<QpB?K$&lw`Y>Pu%5yx{p82bXC&zP_Xi;XO3%vMmc)+68{}aR1_;;0D18bUY=i`6
zZ$V+@;&gOjD2d%LqSz#T1I0x9oZ*P)f(i%)P;oR#-x2gh{0?&~RnoJ({+^WCr#_OG
zIb_p2%<V>_XQf|U&uYkYG}c%jc~at5P+&HjJLU9(()hY?=EVe0<cVW$|8@Bf>iKWU
zx$Sq+)W#!+B~2(p`6AR+26&ny0dWEjNT#6?s``^qtebPN)?NN#Q;TgVK+#sezg|2`
z?xn~sSh54;zaNmY8-Ub^w6X;pJD?Y^%|d>kBhYoq%zHl6ls*oA#M0IybkVrHuPEks
z-M)V;6TEu<s2XQA)vnFA&aNy&C_|UE&BNBl!?bs#Hu%KO&yIXjyKMgtKfKFNP{YW`
z%5W%Qf8e0jwTYWUq3U35c4hV5%}L!{o;~SV2DSdu?eVuX=QeJQP{#uV(`SsV<n3nZ
zKaa`CAcQh(v-o9tZlDZDcaI8%ruF@EJ$pV8N+A}<4vC3aV%Ep;*2Ri#w!Du<b(x(B
zq~t{p4Q5$ru0BtBvd?$BW75s#d_SnP)QJ@`x!*LB2VYg&c^oG;buSnS77tGw3qVAr
z(5bfn4piRBS?fm2{u&;CPz^a=J-jiQN7`=XU)t+DokMRLuwu$+d{>us!#E=Z;nWka
z+j9k`PQaAwvZ5ZzuiUJay(+gL@>A(ki7on7n054aeaddkk7S^FadOzI>kRnT=4=3Y
zmt~7|IT|A<UNFn=2!RMxbfnp6W3`daZw5i_WWn;?n+q*es8ENJL&zTsr?Ffmx?lBS
zh7X*FQ<<AUHBcGCuAKJ0bno8S!se~4d|S`xzH%c!b+GMIQd1`W&(+T=p)_L|YfrWN
zN-XkLiEZ~Wd(YIyPfKS@qM_Pv<n-?<d<}EgCE+S(`w=6Tf4)C0XngI(+%~naHoLao
zwU@W?Ef2t($IOPyoCXgZTS#kg>qTe_PD4HjXEC>H5-L(7k`%`0|K_xnR+|TG$n1Z$
ztn`c7iwt%piZB2N-e#Cikwel_weqgg!6lVN9ZDf{taJFqDBHgi?G_s6PIuc5Gcz->
z14&WY`#-2*i5=)qxQqt$VU;(HS&%@U=oyXdrzU)|*w8lhVUvS*<>mYmnJI?*=O(cr
zj4Z2pu7a-&N&1GG%qT?pPbXECN4!QaH_I$f9Nc&G0*;H^ZnE64ZdEb|Ygt9bH(&fB
z6$3Tnwsqi<k-UvEp?~{#sjVeTL57XE%Cz!*R+4D-_nkhgv7)#)FJ*tLno$O08kTHD
z^wGHssvQOP7Ccq$`*<&80jLHAW2P(-Hf7@Wi8J4|bBkt5B<F0P6>YyubvNvX`w`t#
zWnYyx?KXbR++NgiG8$c0C!U=UWbez~8%(FD!!21a*bq>&9}&^Oy(QJuO`meH1w(|R
z$fuT-jX|($DI}7g-_+()nxq3{7NWxvU7h1Ps?9HZdX-=^5KM+GT+0F2vdEFWCJc@v
zSZKaS74uPGVk;TsYN2U2O7A!W@9Q^11tphY<&$a(0Q1DlYc!*;k8q?dIw~qSs{}Wg
z>sq2orOC{zHa%ep@f5YPerM9S{Z@)bwXbADs8kWck-CT1q~<UuHo<2s*B7=eH0QxO
zw&`SAW4Msjw^M4Wzazc<Gec?X+dh0kyr`Hu(*8?2A#3%?_zh74piQ0p;T~HaJA!6B
zzNYTxTLiv<m_JE4E>%)u{p-0@M-;;ixBFC{JKkSN(H-G0-}wAMRtx<M)HWA`%`ao&
z6!(&h^q^sH&*w_S8&peXW%~-4zb<7UcF|(oRx=W<1*;TO`b`2#zm>4vmZs#*bO?>l
z`PLeid*>YO+@7F}cvZ0$g#r*{-E>FJ%qOg&Ka2~>q8JA)__u5Va<V7mM|oWZC!=Mb
z-SR}%jsp^JIS^hY{MK_1ur+)+y}jO{n_xB8oJX~+W8NeRv)Sq*6y7HnSO{2uB9J?i
zl@dY$DN(m?&MPuBu{&@!(~0AhyzS^)G-Y~qTA9&7Ew!=E!0bm<Pbqf)^4eYW_|Bw*
zA%oMP<fzR`2#=hSE^b34Sgh5-HzFi%sLP$1!mlgPZ*6tUV@}N8s_&ORf02fs(Q~4r
z;-lOdV<EhzRWhV%B6^l%LUE)^BK4Q7nPu34b+uiUxF~#+Yx3f6VMML6PRv3|tj#@B
z5?2}uv*(z4m!jL2cT^Qm99hupJ+w0W5{**?wuHQ$@7+qCCj>ldT>m(Eps%b>onV+e
zvw!~Q{aX+Bbbpog%~O)^8K3vYlJqMY=7ZgJN9rqf@;@+dyl<J3(n8aexBHGgKifUX
zoS!<UJv*4UE>=V#wj9J#-j#o(FR0bPvZF*|h$nqdnx!tnM%rIHP1nY4I=GZLTTB|7
zl)6C-bt{1W3k?;-AT-2Xyd<ioc8xypHF`eOa79Iz&CpNZI1#3JWk~voEs_Hw=HOot
znHrs$eZ)<u{!-YUPWY!~e`ITl-kJHqm@Mgw<l8EX4)5UIKdVXwq}4rr9S+Nuo4bwQ
zxYCC&r(tI98M%$A`Pyx#-nOSA)6QedXI%bX<#u+4N^{$db>0n392(pCT_)SVlHOEN
z&JFIhwfFWW4(4yMFBDk&^;c%Pc3k!55U1eu4E#7c+^?1AFt|!JTI4GE4)^+vx#euQ
zFsRb^KuzR8V@LWfQ(0D^E+fJ6q=fVjsE47KsLWN*Q6H7~jo?rXX-^{MlQkPucMp#}
zPbfG1cLsiMznDoD<ri9*(5)U5BHgW<5*)!$@b*6@TmF68k~p>9u7{TNYVsMq`!5gV
zY*)wpH`}p*ps&MQ;UKV2cjs@PLZo$h*@yK|t#^P54jXApVdPi)<Ou6p13tE*kUIJ}
zUK~~XtEk@&skhk*RU@ybFX7{GrH@XlwgUchc`OQW>&c7}g~x-EBfjMhHg<4F<<XN-
z?lJB{BeR%3rOJKFKJT16vFG&<X&sopXQY1lGQ{6^T+Qyl%y5yO{G7h`16$L(CQD=M
zn?s?L9_q-ki&r=0S%+9#Y0z~=UD?$dCW{x8p={+F^{LD6PMequHNG58{B3$)nLaj9
z-eed{=LYSr7^)uB;GSEvnRpu<Cn&R5V2E}$%VNBZ{YXlFDCkt$7n-vJFf&zzGq-q`
z6E#Edc1|hzVniOn^N6IJnRDy*nA9Bx!{Vu`q8%PKv)|sH3n^S>8v>EN@3aCIn2iR)
zw1)Hx)(hXwSkBamF})DjKjgb#pt*Ol<4MS!=ZPGIVvJRM>CZen=k_3UcG7#Ln%ujm
z9f&fA(Y?uK8?cIjqQU+n;mO#G39n(7mBcu~HVu$*ACrTgKzeMmwO`p+I~Yy^5YUY1
zCpIYv-Azcw_bY^)$Q<dzn)f0gRLEy6B2VGeuKVZkOYJ)dkk=^NrtBT?co-K7NOcz;
z5Y<5FL}T(m4&N1b^*#;UPN?Hl2tc5`ly)4eFA=DYZnLYvzM=KsqnSa-w-!%7sDywk
z3Lbp7Q9%Z!z`Sm7Xv`%7&WER8*LR5_^hv8YH~P=@kYB)q=sR&oUN#-^?=pgamxWmQ
zB40TB<~+5ILu_@kQC`09Uz>aeU#>2jnsSDGyHpcl3cH{>W?SToYljy{&kp|aJ1|1t
zEw=;tLJ0|=Hs%Lx70g7IZIBnOHp7FVhUuX3`dQNHN$Il9J;C;|pS+P|+nwp4lKMER
zSQfmyD?0KXYeXubz@|<Q3Ny|po}F-d@V?#{|Nesg?=L6_AE8x%FG(daF84S8?~Sz&
zT#cWYEB{3{oMAg@q<+a-Rsj*6#v-{fDAqwX#jjcCNG}4PW{3RyT$FT>sPlBfXYm0c
zGji7m`O(RLwP#87{g%Z4eRnhRLtNt~C6S#F`M=j#qw#m&i##hOkXRG`_Z<(;zv^rD
zYNS6<4*s)bV;@$1mD&YI_@p5p$-jcuG%z&i=hRKWjrXrd?b-n*!(8uwjgn37zqS{t
zvv2eQ*5ezDY!xbGt0;yS*U-&xTag*}A)C(pcBwd9-M_bbFo+u<^ZFT(1E`x4fgC_Y
zL;pGxQuEl<4ADr=%ancyTHy$SY$a|C<jr^&i`(Je{na70bhtpm6$}shYvQwxJm2lv
zK6La{ynmfr(2RtN;QsGs*8Kjbdy(Ln)h`O!RH<l(QLq7U!4u@IzP_UPLdOm6gYWFt
z{<0f9Q|jL{|99>EL)*!zl~k@3NUGfbnoOSjFL<XXUC8FF_}~D{8+0Yt&~9J*7UlWc
z4CBOumZJOKHs%+PkDPlf2SnA~BAq;qB;XNJ-VZ^qa}WJ%JG4deW~&FOvFE8)YyQJy
z|NYRS1^lqz4A~@ME%5dt`T}C~9wxuY|Auk!F$EZM=F|ulkQdD+AST%5<TI9vVRT}v
z`a$+#-~o_L(d(UA()gEt-QegP*%<vcU?Om<{N;%)K1s+cL5|8eqb~R?>HZ;@oY~A0
z-ngK3<Gfz^!bLS5?-uqTn}i~B_z#h<`@Vhf&Wy*FY}Xl_iy()`5$1xyERfjVd~n_W
zsp#sz31e=wXtmyWP5?e_l;PhavA`oo^T3p&<Noiv*EmYeO1g$-{YnuK7D42l{G!1y
zyo~cS+&|@sEOx8=@6GVl86xh3DEP5p8GKqevYj>+kT<jXU*khk^?li}#uevC_fJ4C
zFd}DXcJW`LYIzzu`0k5^+7h?kvCrwqJ}|dz$8FyQ?Ujv(oJ5=dUJB#?-DeXQIaXD?
zYB@fCUW$~3=7B)>G%Tyx4BV<1VS}<O=eylX0`>TBwn9>EOxvQst*l<jup?0k42pF2
zy8uW>`M)tnxB3Lrunq*oS9p(#4Z%1)hWxvcmF4}|vr$9a=g5&C?27Du&@Ht-_@g}F
zFt8!`fBhOa--#SBU>XoE5VD*JO1%y#w#ZC><y(Xy`d`2aP9Q}F4B(b0L4>7F{gYOr
z_y2x;+ch-m7yq3U{I$`Nz$F4f!a~uw7SjFST%tR|3Fz=E)hxfsLk4U*^Law>xy<(Q
z-2V$Dbiwz;h0i*!MC3$}e|@w-B^?vTj-32F(Z#ZnuE;l!yZFF+S#>d0!|}ga_hR|K
zI7Am*5dkn5^b>W-Ql!W+v-a57MY?`&NThKBS&l}|tN_Nh+Zv5-)CtyU49GEBgZaOJ
z5gb?32{%C5J1RO#$h)FP{@haD)@AnpVns0i=(F31D+KuUUe55pv77(*ztD;=B@~^}
zaD`x(Lp}nrg|HEwFx8iu!w;oI-Ul=kh~u#TyR~^toK=sUNRa?!ljZ-OUWNb*0%Vi+
zAoZsf4Kculi6W=5me(+k7tX(%Y?2^DJdm>;ilq2#r3e<b*Z*%S;*a)uf~-Yqjm%4I
z=Q!G43Hf{C|9=<=PM|<`TDK<cP#~-Sp7mk<uXeZA>}^6Rq1gZRJU%xKGMofggkWmw
z?r^GD;OIHMoc-KmuL98NYVR6B@(`3hk^JwAvf&5iF2?l(W4|Ng8as_kCorWF6^HV*
z3Sw1`d|^F?1l5JZ;~w<MltX%{MtcyJhyN|0pfP&Dd_hk4`WAp;z<jQ{3q%Fq+S=}P
zYNg`<EDXPipJJKaxs2d}$3mEaGo?7=n4Ed-6v3$MH8Fp?_5Kh984$9cU<-hDwWI4R
zBS^JR-V{7M!r>O3Z?&v5_wEP7H?FZILiKQNcfR2YsFjlX>-ys=RqwX9%S@gExHVw@
zi+JV!V$?D6=fE;lKg;+MTisXDPB6;&X7Y2fN>4?XQb0gVcZGKDdN*5*T<#e1EJHi9
z8FV_8#N);*^IEmW*12~9SZQy}Yx!en+kTsL6G(aEhN=3T?NuTOg@$S3^BHYodwP0o
zJv{{~;Iz(5gi^_2=0@;vZ*3L&b*oU{9Y-()Y3A@(w^_6at8(l3fxXqkAZ?;5uvi*!
zO0a+#`jJ^@_p^1LO-lqrnM&@>XbQDEz%xH6cowFDUlT(u3goYb{7>^%&TK5zJAv-N
z9TI-H)kG5i{CXbX)$ps3rAV>p;ZG_%Lv_>=gFSlMKImfny2ogOAsCc&cAaoj3rR<4
z1+3?Wdv3sklMYO55KyG#NyGLceWI=qj#z2CpC3XaV@E)Xs+$?29|%@hkLAi)KC|CE
z9TGWG44Xq**z5p=(Ns$ihDir;Z>SrYOhw_#&5oiC<r?M2#x}kP{R<(eScw>&OJI00
znhl$doo4P7>V&SNv;o^0+y*SQQt~zb+SZV%mZQ~;fIX@R#z7BhsO6Yf03)_n8v9;G
zzCPmo{QUXKvKqWL$C4_n#ci!W6<?LQDKs>+92k4GY`JATjxBICjf>E<Y(3fz_+q{L
zW+wjwDcfRMHl>tha51A_=|N?#i!^2YCT<rp8jWg{#7jWv7#T3NX3T2`ke`??F-L%d
zZ(;9N>8W472C$+dO<tP{#+P?XS3uO*4IoO8?nwR@hpR^I>`i`G?jFFKGp?6y!RaAu
z&7Z^9L$3<w3zq*RfPQZxqonlx!3<3ilv(I=>XKhi`9y&zQS`ZBXAF*;4<<pDYPhqm
z5QgQh#=a5A@(l)rvqU6<MAM_TfT)_Dyb#6-aCo2GX8@{_yK*IBFT!oy(eP!57;&cm
zc^eJAFg*gNu{LoRNceMoIQsR4po-|XzWM8wuTvxsx~jKAU_;|5T?;Z!AVKp6^>*+$
z)2J)@cBs}YX(%O#y_;lPVtIjsNQp<yQZv7_v<ID?on;3H2Or;8K9+$>hvMRN6D3(M
zdi`LJ*F958YrP$}J504o*R3{b3#slaOdiU{hv<Lh<L;5#G`k?Gk*5MH#FfGJLFHn|
zIXb33XyB_7r{TQzPIonizi80YRyoBu3Pimow8M2Z+d;rCmmu|adc5p`U-7$DBZz^B
zaaf=xQ1@mJ(VMl+_z5ELF1-$!WbhR5Usmbe=cv=|oOy--=+SwO#tm7H%QSF){9DoA
z)wQD5>&P+yNb@zhZEM|unnttIh(3RZy=Zx~KK)>L6F3`DVKu5hhtKgIRI$=;+^jZT
z@ZYU*{1wIY)T~tfqOu*H-?i0!&D2Or$Gq=cRB1)yQF;HTUsTb!U%$(Pv$OXX5$2Q|
zKYtWw-3`&ntx+(n9X-@OvXn4p4A|(h$$k2$FmAB4Ilj>p)5ON=+q0NBZ#BYbNV`wq
zbDYP19(7;IK6eS1M&rrVV$PBpDwRx=8WQN&6qnAk>(b27S9K$EZ9Z++>}eYk!~{|n
z{fEXW3xC&xm!up<*b{(w>t;L$b6WlYgc)n3G+jl*Bu;DQUX9*6Q~Tsy6Q)12>JpxI
zzeHVnLcX1>&4FP5Z4WUbs^<B0s{g|}7jvW5bG?S}&5TJMZ+Vn^@sI2t<JJ;#nu|S$
zGMP%pg><9!_3cmDb{sS`pWV-lG;LB%crDz>%j+}N0IKb&>2cpxav7XOZ_I0lc`SVL
ze}Hb8lT0j1*~ClI-v>a&>td)VRk<Q6l-8L_*qxPviVEk*)g(vV382z9^?r&GSJR#<
zDJ#$Kyr&u`57);u1sd_wwQkQ%qdq;9(ymzPHKes};1h3I9K>F>F<IPW>V$7mPrECA
zR{5b6ZpDPI6ASzLLDDHw5e*t^2u;Fq^Z48zd_(kT5pCG2J#D%xUa6jWjlP*Jwdrj(
z;m;>HTK6d#S!lo_mc9E2O+*}=$NmQHPy6I#WU%qda0maRv|_IoETg~thvUWi)%NO!
z#7M;Gv$AKkU(pC>&+8#}Mny28gD7R;N8mu$xE27pjK3TmpztfmOkO%5)u!*%0|4x$
z4ATaBvJDSi{>Vrg%r2@WhXwVLB$672Hq2Er1^y~=Bb~#qi}X`|5{QbfPNxnM6-x{e
z6{Bs_Fyiepd3eVKAQ*Um`}JmhVIT}51Os{bc$qM|ZIO@UMr2#OIzc(dUftK7$WlT{
z2#W;GrvpRbCy2h}85aBdI`&0CrcEbe$;VY28_>uY-`D`dC;<GQ(4Zo!-eUcQj1Evj
zg01S}m$T}?piktUw(LcJQO(;9Mie~(Je@rKy_D?o?z?mJ)Zz3`9i7zt4KO~|F)ApD
zfInVG(H{3F7~cv=$qF#ipW^lUm_o!yJy5Qm9T8$0h$<pHzSSwnFOwoBfU4{42ODdZ
zEzB%>Qe*1X>}Efw+LyO+1vPnMFG1MeD&?w140Fm*qJC*=sZ8zZd9~xv{D)D*h3=kV
zqpu+BK=M4C-S=_OnA-<~cfddPD&I<UTNj^L50_~Ho020UksAY?9JX>vt+awFXoT0Z
zk^`zg8MKXBuF}5!m6nx!J5U(i==%cmU$l1ZMS@D5l52d@0P}V0OjJ{L+|caNejS9O
z?Vte<jFz<b=-preI}i8{H4RPill<vdc=$!N?mch{!-3y6=3kXU45A!pqXVx@@r|X{
z7)zy-tR-Bq>BCEcC)KISMZ!=>1EF|8?Amz|9OOJh;rnoz4_TiM#<eAjJkU0B8Q^oF
z2OaYZ9PQZScaasroa3?j=+^Qp^`bt$yhPQ(=V{csdmGeqm16xuOaL@(jV171lszlU
zkh)jSd`kODXih|R86amv(J?R<wjtIJ05J3X4?xD2Y8p}Joz#|V863NC@V`2hH6M^+
z{nE>uX3}8y)lV&VNe7qi2#rFKnhW|jW_N@35h@Mvn<cLUKCFuKM|6|dozWCQSTtKY
z`EL%_i!DiPgE|w*Ne3LoWIjkGwQJW3%5(@*E(2jJ^cQy1M2M&!NJD4=0`TUwMO`;k
zNy?ug0$M*DiQ+EXoRCg4@jAsFT7}Lo@Pre*mhbDfIE_FG0ei+QP7Mz~H8HlhmB4~h
z|Lk5-FBj;6JTrcr{T-W4ziQ_N#k#Cn11FQV1KnNm707bCD}t>ar+YYfkELma4+s1F
zSSA_8hYe<kXWVs`yCWUTuhs_A+VarfVmSS68DPxs`w3B0FrS~1wN2A-!jf1NazeB>
zf9115U%6@qC!8h?e2yR;xUb_xM?yLgNlrZDT%XM&!{46T2@hmEbRjb?_%?ZO;nj7~
z&gqOpz+iLpJq*OFndXxdBp$f3bmb6RK>Y4U^LSnGh%VoVIDoOn&HiaxgIF^_a<Aw1
z{XKAA4t+ETct90#A~pTN$@tHYV}>!?&v{lMSg$Hj8M2GRzL(7+B!n!aK|WSapy;2s
zje_qB4jaGf+Drk&f2f7yLgdFam$l1O+d;WW!N4BlfSZ#hwxjgzX^D!(Kw-;`A7P%_
zlUm~f2H9tv2bG)yyp0oLnEI<7xSqeyqx>;VQQ3_fzadDh`3t~7xg*6T%Lt=8tx>F}
zuHzH)bcv4z9uK1(W}5-^LBHaiS_i?Xzm_2Yk~ZbukLHpN5_C4t_K>t{F*gpjfZwp$
zYQ=AgeL<E^M%yN_!<nkaaGq;JulKq4fAc&TOnTQsy!Dfwlodvcip)UVVkiZ<feE=}
zwa=NoAMVgA>3K}~4Q2ztM5_V#)N)$;fmiiK^t?9N-_Gv)hNgt7M0YUSQ78Y2-%qEe
z?S$9*ksMUooBI}}KbcMTOv)+_v`Y9}4tzOy1O(1)VDpZ1OVy=^In_NPA5paNOoI5P
zY0H2c_ya(+$UY(2gg8$%pu-Im;W3?kA0iBVosPveWV(;_JUaZG{>|J0zXKMqb2gG)
zZifkY5|tCsCw2XV_CfFPJ(5^;KX=WG0Ma6)f<4+(oSQrFBYU;)g>&pqU=`gyG~H2*
z6Enuz*ViDZhr`Kk4Hzn9`aSCsD*;}8wyv(clnK~tUS4+~p{Qj(Y|t>xDnWxA!RT74
zO1TG^@T*R1zfvG}xkdNnRS2ZD&7avXd7S{io>Bza%TKQNYL5L6kqi<058bN>VM87|
zVQvmE#?s8+??t9*zjVaN&g@eo7$q=A#ZAH{54_1*LW#UD{6RUsKs-hERQAKkxStcC
zHS%{a>vqBdr+}rY5Q4^Ol^&ZOX=@n1L1+nVMghO<GI+toqTk#gs&yTiJ=hup%7{Ds
z{@YZL{g+{LRsX#LK}+)8Oog?^uRcJ+recLFiO7R<sJM*~GIa4-Y=lh@WA)dAN^jCJ
z^#1bnUS3-Io9C2tR4DKnhFFnD_1{cI*wcPQ??;M-f({~(li}S<lK!Dt<Au?9oWn7<
z2<TVNI8a|e2Y|L!hK48{I}H_~Z~UG#CW3M7Ihd43D4v0mz%j}*Ovyr0HM9w)JHz1X
z8G~0J(BNQe21p$1QVci1p%>D+2XsuRSYdI7!%%Vkcm;}^ukoBQ-o^1phfS3XDZV_8
z_3V1FnaVa3g-(y(0DF`Yt)L%y_J@P*3Jh~k!;35X1~?m&7(}Cq@j2h&V@PAj(5_2}
zY?2)gdf&&EaJ*R(;@#&3Hg_M;fK$hdPJ(te-ko&d_Z6op|G2s+`wf%%;Q0Z~-2vT&
z=j$RE0#X~3Rh~DJ*G|UVcDO&k{GQ>EES~DCDIsecL@eFpYURQEjWC96)Jci%MF4Rf
zlB{Rb=H~wjzG;o*^<lpo(r$WGS7yyTltulh3HC_bwsUA{va?(Er$REj-RIMe;<^_g
zr$r$#csxnnbRdd84o;r}g4He@eIL6-J$OEcW*-J+vfNF`Pn6V-F0PE-55A=ZP92xe
z9G{ALA8#}x<2DOxoHBjTn*xx$538Jd8aICis+E!HM!Pq7Aj5zNOFir(hhTX+8Tjm0
z4mkz8;@9)O0LIOzS_YAi>(Kiq!!`r{_;KmEf$h&R{i)!mb9G_@WojqJC;|qzz7^48
z@u0*V;G#mw3X|D5q?fTMJ)q|NxTgQojQPEz-_&}a?5tFMQA~t>uGoVrqp-G0K*4PC
zI$EnenN-_kM*}-9!fIRJBEaIh#NxrHxnw3oO<dQIC*cBfe+W6ohM2tMaA^e}8kj2~
z$eKyzG5~Y4YnavxrkhjB4;WM4?U>-L$xv@_hVXdbzEvYLBo>Si8v=>wCL`}8D-%vS
z`+@^;=0=~rxAt#n84#WG{k6Dk9@nCzsQ7~+wb%^3RnNXz4(s5rXoOjD($U9uK07=n
zV;NU9*RVD>Kp)%zU6;8Wbs=EXuGw-390<MLMCrbFw8Mo~^+1_Y4<w|<6*qZj4Cvxq
zkY^8o^$G@XTYJ(dht5S7yCC11HLO{B2dD`8!JPv3>b&m`M)93&Ks_Uh19wynC@hn4
ze|c-pt}7F7ll}-~b<X{b@~<NX65gSH7dE^I?BPc{$fG?6Ga3AoTw^P;RI6bB`tC1{
zu)A$|1&e!6p>`d+3$V@+dCp<LJu)$3;ayLrlNw$5I92peyoN5kn2)M$4-|^7s5X5}
zNv8i&P4FCYId1*QzmJKTJqFxoobLr40JuDjg!+r4+jXCxLnhczYRRA%oyjj@lKi%l
z_dc4a$_WGRy%0A&y^R~#-##FF)fH^<!iX|8KqmQ%;W@P-!BQhP?|`Ka5XQ__`epG2
zU6nNcR`77=l2E&xdFNqve0tNiNy{f4;4$=B*}PIce`R}<OZn47W*YRtbij4t8_hj8
zwwPdoTR0kA8lpDPx_$@FA#J7u^itZp7KG&>xQ-E2)okvQM;E)1vQ@5;Uha$tv~WL%
zkpjYVDmroY&&38hzr>G#gtP*uz8rRv2t|e?yl>Q!6qztVaNPYBEL9fIY}FR&zoT>D
zTtL{%&Z7qtV<ri*`axovQmP|grwaEUIK{M)B&fz$Y(#j6fsM5{fp4HJA=s*8V=zgn
z7*f1_=A>Yz*HN))GN<p*;Pxfq%3T}9NudV#${qc<lt2^pt=46zY-=5S-399#M=hiW
zYA8h2YczB*8Q7j7H1w|-mY;J^jRZ!zQbw=-g6_gzq&j){gXLLnxRWCAMXyrCpG7)c
zQeeGnkUa)?m=;21xcsu_y-vZrbWX<Y-M8{(ub-FJK~iyQ6zCsUjShc8>-`B0ZduX4
zA2_r*me)|rj1tTmXT@o%zPcA8JBgdid))RKRL#Vzy-&8FXkRigbqXbiA9&Yq{94q|
zXj&F{)9jkPD>JgSXMS2zP=l<2Kg{C!|5&;XN2ve*Z|`x(nU&lb*<0E34rLVC&Pd3}
zOl4)$Il_@$WEMh3oE=g2Oe*WF%<LWdy?nmE{sHga_j*5H&*$Uucs?FUHlIW<?l+|n
z=<Px1h`J23_(``;S1tH(l{iu@3{GI6*C+8nc4VpzX|Y{e2L-n+FOGz5MaJ)*odZ(g
zO4kC12$h_aMiGybZPS#4Z4jEjZvw31S+xfmMRd;}^A46NM?^&Y8%t4255j(vf6Wr!
zCk(pd{bB5PmC&_c<kzQ7Yqm7#2D3oua%fkhH8uZ?5IZ6HfT8MxzyD0+dmIK8?U>0C
zyO|yDV|IG^iP@YRy`sje((2y{rso-!BOuB9n?1)koI-mm`y0`#nv*}C>=C8U)p)Eu
zMj&?%z-@woC!wz12k$xG`L_Yb@!+?V4krP)gF@cBj|pvyH!pRe7@KZ5dN~)Ck|)iq
z1VFL`Iau|J35DT|B2D?dHin<A=S}Lb<plYx02`ryrBa&|X7={qyNU>}Bj!{7Rq(tf
zWwrFVQdU&RTKNtWzXTBx*|w%w+-_5$S&?&XOBqNY5$P;bd5#TW49k+T^djH;eTALS
zit|ksD4_^@3|>CI%ejwS!-?d+C$641{>SgukhQwtwQGy>z2(}Sq9}@*olVnE8my>}
z0wXrmeASXHOG7`G;FZCT2#>Q`;d;DdSmy_V`<DM@@$kOCzuLTIS}t~a1o4!Tvn?H-
z=6%kgo|YiulIX@ENV<r8N&pC!m-};~HGzf$<r>236^;A*MOhv`U?n#CT_SwwVGY42
z(l@CODXDe+HojL4FiMFY_wKtAp2@4I1V><0y>4FiQKl2A1x-~RiNO<4VkS}B7kVC4
zlTq;z7={}`ZpOmI&m~`2^LdnB>&C5(Br3by_}k|1Un>W)zIb(N&b@pgL2@&7VF5(q
z6d!hFHY0M2g{m;zuPjp}99(3Z{p%nJ<G7bt^1Wxvu~QSBJom`b9m7p%l}PVIiSrQl
zU7~n?EMi4wI$h^7z#A~-zJ|P!zO;YLS7hYn>w!cu>cb?bk1_)q_7Nv`1yx}IBbE~C
zC206@eGb>H<|*OJqOi+JPd}1BMizC9#99%4xmD1MVddgMAcbq+u$P2a_sjd8iq|^$
z3js4(A4=8iGMZBG9w8&A(LhXbbLe*Jnq-qe-X&FA&Swnd<y>$Y8jil5;WwTA*ytGm
z!Crw+5kN<iVW}r#StG!!HZ;HjfZXtJe3JZ)Ka|0xCpdn;ZQ(8HW}vy|vM2ueXL@Il
zU}SKAI&@E7WbI)>+d?39!hFhM++)>m?5bTOtWE^;3=}SL=M9L>ydCCN89OU-89tRe
z`)jxF*2v)<!Yb6>>xY*n;x~m2CvfVg=6My@hEkv}*G32a+72aW>lnv_n@B@vLel*k
zcX_X(_dbBoZ1B7X*5AD6^VqX1K{SvT5UbMtA?^!Yz-c#q%<DW>lkh)2c>?`wvl2iz
zpSOG)m~krf_%sDy2mpuUW8{l0;K$SOf?k46oMb!+q<%SDr=b({Jv*Bx<#Bhs{ycgY
zx5r?k?Kqp~JjHYoHP4Cfv-7=jh4J-Uo>c%0dOVEgrP`>Q3I00-^nF~oiVE*%7)!NJ
zsLC!*l0jQ4m1VSjK(EzwUfV*>T0kP$9Qy9Y+G$d1>R;mzaj^NN`cE}*lZ5}P$!oXG
z%vjOxDj6PKLlGo9E$*}Dl}{=(G4n_1&=~)q^&c2!-B40<H3O>n2z@GEuW&wfl1NQ^
zW(I%4(rsQ+{#vB{qnI`}rTZTw?PxDuI{v~<Un#=QyQa|4r}uO-<XPik$xrLm>=mwl
z-=`)ao4YR?8XFpm8jMW>H$5x%%cxdvA2myS`}+4)+_eJvAvdT?2S$Qi2Rh$z&4o-w
z_WQ;}ow&_gXf*G{kb??}kcWJ0z~lIPFel*~siqFkCxWIElJJpWBMwp_PiSnQiqesZ
z8ETv27}zH}8fI0H^Hh-(2u0LMr6jS33t{m~c|tIo(r%?sc1#HpHf*@w`1ttj(Vst$
zosyYa%c#Bn+?2zOjE>F+izB`l^s754J~*OsA@NfE?hG~o%@lZmMKlDTo~Oe}K5{ra
zD<>znJaSA7f^ith%U`~srv!S^-n2^v*O*51K1I-;-vGJ?xOCLu_osp}HVXl1?_1g&
z*o_U16RX%-C>g~HF!S;oZ96AM$ESt-oz9U89ZjH<Z+Oi9#_mI$(WV+tbhCxT#AOZ6
zI4p(0`G@;o84l4ER<IY`1yD6Ra)E$QA*{L1!9A>f07m9L6Z~WZ_W~sr;DvJ{!bPcs
z_X7S=?+uQ~nQ`%0H9aoYib!x)L9OHAUKlAQof1B=>iOdjqWJAEmmbVK8dUZ)XvC9$
zOIO(Q-@`AdD0I9xuWS#XgBNTQEIS?xB1lTUcOJSS-!K_@?w#(sV~454YB_#BhoS}B
z-wJ3+SVS>?-JbtyjYTNqbs_{}zPHCI4BY<w(^sQwZ+1iQm*KvlmG#KR6u-Ewqa~TX
zA(D)(&j;j<4qj}ok}qWkZv0C!IHlF2phDpLz{fvN+ykO>@`1`S35N3Tm70o7{Qb!`
z7D}UT$7J&t6GuS2AX>WmrT6vg*WNr~RGOc?Z~e~wl%kQC1Zi<1V=KN9e7!>!!tQ0K
z4pX<a&2hvc;0_I2v+_7BJ7Vt@ALC5YxN?!Kdb|@ElnOB}S~t0)0j-<nKU^T^*L3cn
z{Kb6qVh(tGG>*4N2$L0;OdkzHG&r9Z#e0I<%hCkN+t>hnoc$gx{|hpgs%fuj6nj;3
zmkJC&60x?hMoUGryhp6%g$u}+USA&Sdf%XUb&NTRe>XC5<<pEVq<I}l$HBYrG^G~|
zlp;cU<FoG7?h~~$7w##x!gHoY?K~1;;TT2}+1`)Weoeo(ZOx8g(a4M>1k`}3=Ob{{
ztNPy=jCvI^T>Lhhvkv|~?+2&E-Zk)jL=HlYn7D-?BLWJFiq`jYNg4YvUG)}KfPOO|
zVHy6Y8BkX9>@f2?tS)hm*@YaX=b^m+?e6~&-RSoKUZ&{ymFgTIWCXh>l|TgzeezY?
zi$g=_{_q-$pq-C<gTP&+*S)D%@{jy*NztJ&loIyGs?GeVLl*9tfL9?^U!2`{CP6GF
z-LNV(Pj0VwsXxBWI$A~?e2Cs;YzmT61Pq~-g+=$3x58_Pl%p3T^{s)=dd+-&3)e`w
z&}L}w&UFyv_`r=-)Y2E{LR_P)j*THn_SZYeol?KY{7+t!%0&s1{h&Y7L~6D>814eY
z5ZdL)QH-C!RQ}Vvh6wxwnlN(jBMGxHA*{tM!$|yo%ZnR5KBTB}828efu~pvC+}6m%
zWFmL4Dbth@lpvDOrTp7+wEdIY8c6vbZk##W*cc4@E$x}38ghOs`I(5`?__A(7C|H9
zsoudo?y|LvA|0Liw#QVn944^OE%3Xrn>=mx7%H)vD;R=(;D2x7IX+hnI|p{CUu_F1
zgj&Q9jJ(~P2X~#0x+Jk^eL4!X+~LCIxNix%NVC%F6+kP|a(*Ol6>Z|Waz$C2Ya=Co
zSy(SNd2lKJzc9M7i!J*#1Np_5()w-?xP8Ae6nAk;v*Olt42^@x%sOOH8kv-y5}RAN
zv?jSrpMdsKzx2`GJ4Fgp9{fdAI=|Kr8;7ej=#|`p_kv3Jp%qO^30f#R7hia1!PUm$
z(;}BQgT0dj;N&(wG8h16*z%hm7p>8DR4F(^vvp(lsT3Alw?Ww3W=ITvOzQl;M24AN
zNdhqqVtkwPTt&z5TbRrM2QzFI9w`&)_bOb*9t~pCy^pqL1)8$E`$)ZM@0W;soH35}
zI4^ccWDaTKgy-)NZb2c8L&Xu4Y@7^qG!RrWIf$MdOvPCB_{O5~EAyL52OZKL^?zG7
zJ7dc~&&>6GT~I@Jej**Dq@d^n?^f;;cciiYa&O+S)kv*-Vp^77Y-V>_erf4iYx?)k
zC!HCq_d~<U1+lA}5tw`Wu@AhNH8^QEX7O)<-PD)Ms=-PJ1DY%-o1A^k&a#{ya|#kO
z;aD_??t8p63-+JqTcUF?4>Ik)tVr-a=0*)W#HqHPh;Brq4a|*jYx8R}?y37CWdT_~
zzTdxn+M!f?#<4q^^M~o4TTU#jG<DP<>%NUh$Y!T_K-lRNTV`6$8B_I<*?>d=Rfh?O
zU&^akcCW674M2wxbBEcVr5?C%d^-b?k6Txf9r&KaRLbo8UjnPt3AacX#psNOeuD>)
zpvNXg&!I%Fd8tQ6bHAVhhCq^<tC|8Hf<j)+F8zf?<dqn18TG$}GGp*#U#39|k_0pR
zA#3_T9WBf3d(aj^t1<F*-1dejV%+`dUIyjW0OQEAob=>2Y6nF8JwsM;h0jevow|Lf
z=A{_I{#sEAH4i><bb4lHFws^+=OaFlvLmMTw6`?~*S9mH)hfzl$DE*5s?Es2U=Ok0
zf}+c(a4{(uLqwzu>uY@I_;9&(BO04$I~bR%5E|njhYQZ^3UD#OxdFTYr<d9xxGs_L
zHT<Cc&O(n&(`*5m3_F-@MD4yCwY@LO{NO~)QtuTZru}gRi@LYE&{1}ayLo%#d^6+F
z9Y2iTe|uG?ZpPbF-|(IVTq5IXuon*x&$eAk1f50~8FIBgs%?l;Wh>0A>!E7@!cA)S
zbg&rm^`mflUxX;>uS{@5TV>pdxjRQXqg|^QDFb1ttNAgM#HTxX^7%RAC2^@lg{|z;
znK}O1<Qn@1M9EVGid93nDu=rXQTBQz<|jb#Zhe9kK3T9^evzR^MGfJovXiRNd)^hr
zfeq+0Qd>Xi`z@YTT7LZI_;1KbkS?{gtCTot0)907gYQh`y<R{^X&3xS4{1tu+9|lq
zp8h65`sv1`9141t9Tpbm445d2;DXFN%%PkeykHioU~0%Hrmz0CJLp+%mkE;p=A0z;
zY3VlRp@37?e;;+5b-Jrmf~!WZx@W3Ra#taDNoh)?n4j>`vbuiONAOl(G<ClNM-5VA
zHrsp;Py^$=pXsB)-=<UG=HlYg!skR;$RhAW2z(P|n&YAks3n_|?qd<OYY=tPw#;vA
zSoD0P3G806z0SoQ%k^G7>QB3fccuL&A{?BS3w_h+)`HQz-{f9p(?*iX_LA=vrCJ+w
zM8-3WuI;2>eqf)JWiXlaTDl3qA^Z#0GV*k&sHv~rpFZ1osyTG>)WZBlxL%~2Hl!_T
zSGzd~2C6JS7lJJxC`OespR_pjXUc`^{*6#civGrdMR&q13h?vwm@*|sE3(YKw`4iv
zHcU=}?WV-V_MqI;WiZV9Q<+IbYrn#khU4GW3SknIx8sgi2#-+J$Jc_5o~R~qKZfGa
zM;lq?c$v`@wvR)^i3TsGfa?}5Wl<MOr<d9PHmg}B)eZ8D&drP)o?LgCZpyx-OOy>S
zefyTO-Sjk<TPX1l1Du|BkMOJV{&V`j&n^1pZjwUk)qLifS>l$wr{Uoc;Mmb?ae5T)
z{!my7%s4OK6g5%xrp10+RY>+WUN{*&d{(gjcMOAGbP_KiPhqO$9-$37%)OdH=~&FK
zL7Nly^DO6mWBciWaP?x&x-$ONjh^=w)sqc?9b?sI?=$2rSR9@Rt-T9w)n>3Dhncj$
zg(&7!4uQ0dO;3A(brEZ99-R^Rklx^9wD6$tMX;q$NN`k`!1QS&&i_pvDm!PAJAB~1
zwqjM*FgN@8dH(tNIZ1wS^+g*Cv56xkCH3I1W+4+hvN-#!`YgD8(3r<ZpKU4jP89hI
zVzT#*n}4Sxv#l_{e;tLWSUtV{LBUY!O=!0g1y^L^chm%*zS;KN=SJjYLmN;4ZV`-<
z{WHvC?x3K9j#c8>QHM5Y7@o>SBAtM4eBxdM+FCQzHqgI_om8<5m#p<0q@u)(H<6Zk
zuOe#SzSW+f^$V?%xcLQ~J*HDNaN4OVkp|njn$K%A)4EGx?a&eCVI4iKG6Y*~%*)Sr
zUJ0E%YW~!8gwhob2ocnIY&;_-W0$;GHGejn|Ftg%{Wz){vh7bfyg&J9P&P6#wFo)c
zo{wRI)J{866%*6x5hQ6qXRhEv##SPL@Nokqqv>7!pc?MGFlrZx)j^?g=K`BH2)jdH
zyIXZk8#_6Nv_<dr4CTODEh24z*9>z!a2S`0eyI^A%m+w0Q`+##r)FkpS1w%=E@r^7
zxI*h*x}wTA&k5SUHFJ*EBPRlmv9>qZnpc}{j$YEtrKRscR?F7?``Rp~WWGBq9lC2S
zxA^kzq<@SMw#tkDbs{T&I?Ep+7)@RGni+?NE13yQQceZL>ws!aXd{2J{$m)pn$?nw
z&QZH?y+6FG&eD1I_pq^-+2x*)OyX~{`{|&^`=sqv|Hu>g^9(p}g(1v!YA-(PNpc#-
za&QcEoW%2ohYiP%do#OFjXOjOIdN;JGa^Oo2C&DAdW(*24+zB9GYpj?#i-1-)=v8L
zZOfgtDoD(=kYY=1<Y8lj@3LB2R7`6S1s{h5GVw_zN+CF<X0z-Ac8wyf%eX?Pu@6o|
z2t}e~!L8{XcLt!0<%~P{SA#{2FyGq|9WQf{HOP|wYU1e0dPkyk@(0<RX*B<|Zo2eW
z$9ZrKDnI|x1MB=AN@5n^1w}*f1og0&5=bw2q^hnlk4M|q*<nD)--1%%@NOg8%ByD9
zyKN=PHA8pas6T4W4Zp#L6f013614UP_F^AlTNBhmZ=o7edIVCA*<W9oIl7umxz0O>
z^s--FE~jscQ#4|BM0BFc@3V3}oT%;ZVIt3QbQICZBs!{8+3sNWenKr`Vu{-g*<JK-
zp^*3<w(=}VB-V=9dxG0Nx_-T?m#$mIJ-UE|j`xki;o;%uO@X8gy)4;ee~d|Tj1?qf
zy3#`*ZC#mUmWo9yQashim$~Y*49n^9M+;(ppX|*%vupRVEfAg#{@To6))h+1D29SY
zFi@3mA=}~<9-zR6vsc+#xDKa9d0HT;FkjLN_lSzYkMWh|<<P^_!19$X6%-DL$mz+(
z1;tRt-?XrZ?`?{VP&5#9%<li>7J6Z8sXjSUdmprt8?q&V0h?M$-k^o29GC0r!;A@O
z&^TSM{=`;0Et!ko2lpWwp(CrYP-6NrGw|2L>htE!^r6pd(pjxavn{gH$3fHF%B+Tw
zI+qNG>T|Eqz(vD$RoeH1K@uXBWtM}5CshUoSTb>HYBq%x36L1Cp=1>Ee!<_{UzxZ9
z+Ol#peKv->FlgK3y=6lz4gH&xPSH0%d80JoD*p&9eKAMtnqk7qc&c(>^^3%$Qj32V
z@$;H`^0fo152+JdJ^RD_{dQW{{x<!1J^AoG=Ec7J+;^y#8l+OVu8-UQg1%pt5BOF9
zE%<7`6-HGK0dk`xci$o#j05+mbjW$oWK)Gyq~29a&f${oCWQ2sDNpp-gQ2T)n5aaG
z{6FDZ7OrGzv-=jQlvhu18G@G9lSVb+OaHYu2tuUJ!NuGe5D<WXHlPF8^PEQ*no3&m
z`|;S#f87njJy_7sV$c%LzmkNA`#qigZR-*EgH><AZT5;8%Uz+~Fw94By{(BXmI8sf
z$<G8*a>fq~Ca`8oHbtpO2S|u}X+{&rrAvwrzQ4DC)D1{R>hZj5U_J08ERl+rx3#Gw
zy>c00E+y2@u2Q=&42gY;5RO3)HmNY5o~b^Y*7q@U3o)XF)qPQCLDgJcoq5LslQ-?Y
z4#OMKAj$h&5m^2|f>_(roe<;q3Yg`Rv9zXuDt*1!E|zeuHzNl%?e-tJt+!7OTk`Gs
zw2r*Ts+ygM1hJfLQPKCos37+2``g$LJeoSuTTm+@e*D%sTCA?Tx|(^;Gy(2#QVEV(
z%$<FjWPhONd{Hpvz4S)wIgwt81Q_MNFw;-~w!8+Do{PD|g|V_UX=Y8Baead~p+Vq>
zf(i0Uc%q58i{Ct|i>?UFZ0WOlkFW@jt$^g);aT1v&&`Pt<AKu_$G_=uwAFkmC6`hs
zrn4&W1?z#fr#|k6W)j&UgNifg?K8`|ac9t2a6FRDPz7VIsMEJ+`E98YiR%#Uhs03W
zFNdKjn+@XkFLj*a?thI(U9|sam;IFI41aO<wQI90<r4+~x+a&Qp_BZ^@Ff^~7|TI9
zwes_7yPE)`?i4LFU))-_)*v|m<`m|y#$`et#06allkci^D&euo+Z>=*4ESJ)GVIpS
z2`;ptMJkRVJWObfNURIL2%*Zy(pnlG!p7s<9_W{W-n+sqPODT_=>0HvxEqkX?o0~|
z1HhT=HcXSMn@-^`gEy^<ofOYZGhp<ntYng}N%sJ<-TI{j1urGTWelqr+8LOk&XoY;
zSaSZ|djRqP-Q(=XcY^n(BVyBc=2$=ZQQnVCCg<SkQlXaCvb2~~u-uc2zq77(A`Y>7
zOp=Xj{qK3b_;;7T!LQKq@3IFK$fKY)j&GST&-iv0imeu#as?d?-&DO@+V%Kc*fzLb
zp)X0VkOaY5d8-)ff}PVKgAXVpy@03BkGw5nf?7mkALQ`d%epu2)I!ScI5jszshE^=
zJ8YRzui(vKH4sA}KivO#qS7$Pt$%^A+^RpfefspqNZf0?sZ~8*5B;S`l`jTDJ|C;_
z<UpM={|gejY^xU!dLfE=ms*aC$Gx>Bz3jb490nH%aUIbqTo&!K*E9C_LX@z)c7@gp
zQM;?Y4*wMOGv#U1BDQL?P!OwI>K8p$mYC;E1uwq#E@_!UbQ<gfvw}gvnu@X`U56M$
zSY26Bcg>4+(q=*FowohOB@2V0Chq1p2QC%=<!cC(;f%DXUUP>i3RP~(S_iwTzC57n
z=hfXobs9dp_D8cM96XlV5`Fbc@FP&bUCQ!~elQOj$4^^6ipdaa{ZU=9I%q2FqtBQ0
z5Hawt-wcB}OahO_hb^tHmfom&!yNHW<5iX+G+u_Pn_;|X|6Eg3+JA&dLT)$)mfpt$
z{(J<!u!nV5pUQ=S@PaZ&N$L3^w0zd|dR9dpzEJP*2j7b$7z)Y6zt2$1cJYp|LnB2*
zc_dD<IQ~>Eer&L1lh^8v#am<S!iF!pOiF(~lQnkr6N(A$kJj?a9j$sWm@S7I9;(45
z)-Xj`hK<vDY|+B$)kk#+xd4iBamxdK%@#jo)931Y!f4?7p;+^+FA?2Mte@Mh%3P&p
z1iWKm>exJjRQ8=Q<|V!_BPzmJckO6UCZ!xqJFF9(<!Y+#aMmxIv|4{}x)QYAdsjS7
zF@+=66<O}{!m#ixXK%B6rr21XY5Kkk5&tgHi!We=or=3cak<OwLB6_9L+FR7&M4cS
ze7$VnSj^NlPir?S7rOG02ym)?!<ongv33)+?&UAQGYEn_ib2r+YE~W#*hE8ex2f)N
zewi*?ZbNyOZeLao_$JFB#~2t8unv4aXe?hv{^b8z^f|G{?u>|+nT@yUoz2tkk}4In
zGej(4%>QnQK=>bqKa#Tf2(zja9n5u|hQUX-vmA@spQ~*DtXdm`NQrVQKLO^~+i_Ds
zS(P|GKoOA$gVKyl>$N<XZt_3mEaFZ2!lX^jgMyO6h!`&l`1rt^shb4?RcG*mwl_zl
zP4N&((t809ANDQy$dBGKW~w9l0!dNAtkHk5U_W$Vp(=%#dvo>3W5OvvoCqFm*T8>9
z0SuOeE#K4-`Hik4O2*6({j9t68fGptlWnYbAUhyq$`Vn}UC<mv6S7vTxKWm#osqgM
ziYgUgpr@~Ylmtl<GoBoY&-Nt>bo~7~*s5TbyO26r0H}vde{rxC^PO=$%>x#vhyxya
zAps+>hP7=D&S1}lyJHbchR!5npZpJ1Ug+a+GG{E};%*tyTwr^vp=qoW$bxz?Cq!97
zebK=bnGS?3_V#z*DeHQC7C3Xyb-MQ9Zmd-=?NgW7X(Lbaf^J}tDiAJ??fX^P$<2F(
z_ioJg>96>BhDqN>Iyk+S)3hkRVN-Wd4G2C+I&7viqq{p#?V^M!h;$?udcE=MqwtO(
zw#Y;YADwVn8jO6*nwb&ukA9oK3c(OGkoQ6zvvBU9xgo<?+<E=@I};QQO6DC^v1C(7
zr->ln7U*NvBg-w#zwfpS2HqD0li5ct&$d&piT4iSIkn58>3#Q~SnK~Tl>VI57+FAs
zu3k+hk>KuL+685}U#puy>dwG_@Cmqd&hKZk-c|)@E$O}-(|c3Hhb)X@dXu*u9&4;J
z4ye9<IaBMNRqoVz7zZ*-Uxuo8199Qhdp@KXvj0;WiT@v$7X%V#y6NpyVWAVFGjNIL
z7Jactcve`x`;uJBdc9|})EExMS-D`RNi0!Nda{8|VE-@x=%9s2!I){!H4*>Q2Nq-C
zdoUUr07^#YK(5$eh*56d(9cZB$Q>_1(6xM5*2c~a=YKT0K1d?)B&t%gFvcg&F!lAm
z#wcCi>ty#?!@o-4%6=?Z-J2%<v<<OG=mEgCQMg$q4;5O%Lix$Mxs!tL(!bxreV(m5
zEWg{H2m7`M3dx*}{_}5@cQ<&9v%t_a0@zNUJ<NoDl+Oo#^<U+mMa|U8DH+qdZ4aqN
zv;ow>UCV!0iwfQ!;Yze6qCt7Pql^u>@vK=zgA+)tewEUlZbY{xof^mre7Vq4m2(Ep
zuX?#M`;v|4Dd!t%GPVV@`s^p{VqA&@VC${e|8)~JfK`}wO@W~t5jfiU<b=cXT8r<a
znOu(hWPbp!aO#gC!U;G_>qG;_<d)j!TtO_DomrtW5=R3xoAoE6EGXV<G5}w?T<pV7
zWr!aC*QscrU?O=wkz62b(Ba^e9O5&^QV!P>)=3_-cuXgUFo=PS_(s|=J8PexRQx*;
z%Itm{4z*|z>-8A52VarP)+fd}_rSo$PBPo{Jb|U^{eFf{(WF~Jzx*1NP;&GN#{W>M
zGf9gi7Qx!7j~vzca!^%$DTSkc@V<~b!4qqh^bzalQekrk-C2Qk4y|`k<qJP3RIE2A
z{33oD<`Q5TD!*Z*JnxGH@*1uY?(qG+fK+o=n;r~u^|>}Ixf~FTj9-?J2{GE7O(&R&
z$~2ohX`L^Ws7j2s86(T{mcG+7W34cg8Vi=3xG=3#^fSZI3WN4A3b;O*!Xroyv|0B0
z^;(<qnGi{tWX~rIy*ryl<ej3oc_WgksyEe~2(v72O<?nk_mui!s3g-SxhMt}<HWS?
zonVU=fnGDm;~N&&dw0|=$`i>=GS07B49K8zX)WXoKfI2PctVj^-J-QXmnUHb*6Lqq
z5419u(_aUC(gn0eL_SA6@`-|if`G!+msShhvNi;bTvSnPK*&VX(&~+I<s{miwg<w6
zd?X8mx014kxUlHJ$gUD7+7czHn{soZZm*|GJ@t}9y+JCMrVb6&sP#}r;K9!ajllo+
zpE&r<$1jbnt9=W{k2UaU%10$|DX*T$V_?&Dp0<-q>SSqPK+$4ImSMtJVfq4Ih}b4C
z4(dtTmrlU0!GrZvd-V*D0$z($B$3l>(mG^3U>ZgjQHOS)f~G`7DM3v*qc08kaL<QQ
zzIqi>UZ!@C3>PH@s7fd?)|A!~AYe^g@KcxT8MmuWM$B#toT@pWjJBR)>d)c>^<~u-
zPTnT8hFHeUm9o?m_zp&?IYroeTJKMBCX=^2mjUUHxw7_XJlfN`YOnjQ$eLsQ0Iam{
z&&&NadU*c}Z2yLQ--7K{I2)nJKLy@DFkh6ODraw*rSptS5*JP-ru3DY9EwiAgVT<E
zhaC8l3?s#@YTRA770Dz#!n2E|Ee73<+gp`HLFsx7@16*LzSa3wpjHW1&ly2gYH%9W
z9VC|a$Q?5nZJ&?3m=wvVsF%A|+{)~qGuW{j!8EzO^m%=9)sF!DsTfk~iYOWSFu50^
zs+2ou_VEHg;vG?+Y!7xI?_>Y(>VcBRZ(Y`xPe|`cS-cKxiu!3N{*Hvj23h8DT)Fa$
zyl-LAUtu@bDwgtWWXJEWYgXJXu!4Yrv=yTCtE7rGESZqDqPRtI2MhDgr3V>#?9mn*
zY#Bzk%Zu2l-kjlD-u$d}x2ge^Ob&(n&I0}uVcAcC9=3+FZL!Q)PV&E5m+a3%n*-OU
z2wnZ()v&fgJ$@hJBP)33TCCN-&&H%3d{ov~XS}S}L!xSQWUiZUaTZ7T{R7y)wdBW2
zPF(5a`2+n)BT~Dz>;TXi^WaCa0k-~2LAw6<I#Miv9p|Ju$~5&zUb|v-eI2;~rlS71
z%x+Z=owyoF9K)S&yzHR45yS%FCwzrGd`!OTREvH_T^^s-wNqNe4xp4Z*j>HH4}CN3
zUx~&E^a82X7m|-kK20t{v1s$wBQsWZsb+4Jp)vuyl1@gMhN;B9k(c+%7LY^EZweDL
zbYpcmRwm_f!o6zTnTii;k1vp#BaXfxHA480s6kC+W*nd;);u!kM7L=_AMpzLq`19n
zKcoE7>PprqL!5jJsAx;f`z-<|2S>~$8kx(2Z1pAj^9}mJYj5EF?OO7i6#B7qx;6RZ
ztf_5U1@NdJzbTqGE3&>HOki=f3xo@6YK`UU%seW{$Cjs?HrKq4VW@)6HNBt%r(@R+
zZI(m!B-Wvu3S+Rd8dvgRn|Cdtds-N)*KOA?aiq?Xm3?#@&jkB0_;a|}Z9lKY-Q(0&
zEf$t~-@MDrf6~oW-3Pk=k|!GhP;s86=IR9}x>W&C-=?Tt9EsUQv&qEG$$i#)$=?cE
zClVxx#C@5_Xx71P99FTkdR#C~2JDjLZPbFXkYt;dIlkZeX6S&C6-@bX1_h4x@7)(~
zQuzU@Fa79U9)`S=u?ga4WN<qrXHB*s1AjABeKee``an$IoZ=i;16^;DRgI{ce6U=%
z2qAV$d(~LCe|UH`Oi(s2Qc~`V8b`5#<q+sfoq{AhWv2={N8bd{PZXFE-@?#XRdy>)
zJ1@v4uKz7gp+Pt|u`zAG>mqMVX+0Xfad)zW6!5(-0G=1UXF)IP5N{uSugf{Wi!JZO
z;7$HpK`j3~TQQCP81jL-uZGOH$#~Gv>B?X1O6&#XogviO6CWZmJCh}1E$KFA%C|7-
zV4w(pOg5fn^C<T%S)P^7XtjQ7BXH;cnh<h2ugxZES+n0pdG)e7c`cZQJ4x;Jen&Zt
zfjQmxn!>;?;q*pi4b}asH!mNzsk(kG&AlSgOyO;fV0j35a*q&hqrltBOhh<0(A=qe
zyHSAVyUJ}GkfK|Js>`JgSG52)d~~Upk`3Y1(9p0BBnW!Kq0vO=CXm>cqs4#kdeB@c
zbk?$(s^0@I@X)ufulE87S6t-8LsUU>=9%-LO4<Sb{+7jqqa#{>Yq5aRJ;h{gA4lA$
zh+dNey58EiuPVBH%HRdZ)ORDSd1>?NxUcJ4wLwE3k*L#Z?cB}r?`D5G?Z0%EW*aO|
z6UdE%GI~Q_1G-1M1&c7!M_-C)t9}L0T6)(RwXoP4$X`c}RPquW*1G@OzbZ&Ea6?^1
zl0)(D_!FZguEDtw0c%ygVxv!Z?6)J<FOc4&flCUHx87jD^2t;uM}Tn+31&{CC+Eat
zto{B(?0gJm$X0rWho#{{d;R$E@GOEFmyKC9<=ED&ABH`{^Y4hQra9)r`#bWBJ`TNv
znaM(1tTHooyh~le23hlJ`Eznzh>?AqXFtBGJXxAK|1-0pG3wnT_!bWnw(yLAb(T<Y
zUw)td^wP<nLiz%>JkB|7{l_LSVkF@A=9J0qy+{wcBHQU)UW8{DVo(OqrD0+o`)mMz
z0hAlX%FIgyMQ;&yk`b^vDLV4<J;F}Z@Ex^Dp<SEaH^b<yx=iel?A@BAuCbp#Ez0lR
zQH3Qt*%^zu&j|VddeFnjPT}b9CVVL~`3sY2kH)(*U{wySU$n`80b&tQ3yR)Q9;-|W
zIvu#ju--I&*Z1fJ$Q>BpY*;Ig@QF{=!*ZW|J~|+)aAfLK20~xCpZ|u9lT&kI(q?8{
zNkUe)Q^*bJx5pih?NV$bh^In&cHWD;lZnz1qe34qJT~^MX&$bnO1TXeiCpQ7{Kot$
zSqIlykHKi{6A(Y2bD;&*n@vw2@@wpVHq_O9vTnTGurhk}3C{ZM>+eTO2d+x>Rcc~s
z!u3zVad0uT5S-Ycq+QC)^OnzM%-nug_DIkJ=R{nz<A)?>LVD)zMwb*}_GAkz{C<5f
zvhTYcyp#N|i4acf!RGBIcg$r3!-e~;|ER=c?E&0xf%nQqVe?E4ja7|=@VsSy>NKxA
zvmB3&SZt3gMGkv*B1IJS4G9`#W&<+BokYQFN_cJ~9%Ufw0ooqkYbubo#nR1GJy_DZ
zdYCZES)0K=Jj5N^F5Xk);%K~la{5-)cyGmWn@KtuFZ9AqtW4nD$M7x|y{xY<o}YYn
zEF2ES@bxNKa67-|>lL!N-ZjGc<!ON+b-&@~N@a>uANpE&fG$~hEr9uJH~Wc;Vl4!R
zdGfv|45<8FZ@JKG`aXR4o;x<>5sN4MG@qOFKHbUG&G>VAV6Q!3*CwL${r*<m0Y&kh
zy%~fc<uz4A)%C8OCl=X4yBSkeK^Ccly*{lXTR)F71ZjTbfhUJv#4zn}4^p=VWOj6E
zdrGpz$&h(UZ4RhH(cU)p;mB%zKN~0Z0~#X@Nc4;tiCLrXi2~SLQ*eyl{dN)U!DtJT
zFwUFdlG+PJ2l;<gB@;YDz5sQ=ZLHJoU9y#Ean-+k0|n=&W-UtPe&OyKT_p}06^^0R
z>E%Zk84>$wXrJz9Kq<rnX1>sF7XykP{v5sw7Ui!KGf3zCk?y%niA}ymJDBODjGI(e
zI{J|x#%jTG*>xA5V3F~;SUMLnnPkS$neY8KW=@9`r?=yY=Q~C2#wn@0vglRqB77H-
zO+DRfla=?se)&D{dTn}bdAX}QDea(00;ma3PmgzLF;3d|nCVRKgi?k?{9(As6Kn)Y
zmHdEI>zRvnw77@8FVpvOBgL^xwcYMKQE=MUtEI7~!%6P&vCrKDa`!upwm?U(%$GBm
z;{$f3H+vs9eS;WLA}3F><8c4f23nymieHcq9~U<jfn=yy0X-+G0MMMhm`-Yodj{l)
zHP}4d&)b>?WQcFa6+ux}Fe)QVIp<CabX%!=Qog#s;<QIY`mpAw)6dw{Oxv>*au(gA
z7W{)^<_|(KXp4h|qyZYPJfC69%MK8!YUd0$8Co66Fg(CiGfpvJKa2BbBcxmQ7GwDr
zb?IZGBX{d(`(uYwKE0wFetzD<9@mgR!rOvozumn(w!hIlJA02-((T{*S-JfjkXOwg
zE^rFG`+(BP+<sOhS#LXkA}7#$TYs2|m;@I%_|jB2t|G^2)e|%hWpiuafrMcm2EFtH
zf@{b(fqC2HdDehPCS$`Ifga5&dQiDSX{+>0@6RGwaKbw&>p!|nNvMp>ivqLCgnR_I
zA|^mS51>WvUN&Zy+C2g@eNnqPm!NgI4+|?4Ncw)TJM&-NI^7-I47|u%c-_*{qFIj?
zTdy!L5a1MdR$pKW>rMBb?FIgxH>TrjBnNoS$;4~qO@*JI`1%(KCViWanlWsJJt_?{
z>5ws@W(h0h9(S7nkieANx?-t7l2%x|BBDm&wwwsqfqyhM{nN?e(v#3p&B&j(`ml6#
zba)nPYwPmLWCNax5sEy7S*gEIx81MTA?$txXhi%w3_P-r4&Neyr-anS)p4qgbzH#z
zo*!>!4aKXI>l?2P%vYUe<>D71vyYde*lhd~Fjmju9vR*<%xqENu1%Q9onb2><N7^l
zM$@CgZGZN@`$mj&>@)&)pGfivcC6V;^4+{bu7!e9T<%b=*|sR{^}pam)4^Y;#a^}x
zC-Y+jg1`R(t}6l?;mF4#eM48}yh7QWlZRXpW`Ti$r<X|?VJd3mH&n9*c9Rl0D2A<c
z$R#`1^h^00Zejl(ZfgJibkN+Qw9JN>^j~_N@ETmmj2D_WjF$IYO2V|y9BbdAtche0
zavv$uO{^>=fDMhMZV9j8ze0=NDxi%O2M94Ojrtn_q(panFuYiCmiKC2-5nHeC8ms6
z@e@G7_=Fs9UK>R4(dC{L_`fq<Q1ID%cT;gXqW7|rpM=fxWeo-ystk^rAu86_a7K0B
z3QRv$X9C!h9Op+6O&p#ORWDU!+3%V5l1d*BKHGT2XcM&EnQ&}kI-o!C^Jj(`oOX_t
zZvF*Z<ANfjW(O=civuCj!~hVNfSegNuqTX8RQFNuC?h$ob3pKUpe1M-hkjqk_g45L
zWzz5HseM$?>zJ1p%I%T0mWceuq4$z-de_Uw-e)MW?=yoJje1QSox_~euMuLI0{L{k
z1waj_8OxO2zO)q*(S;4CBqE1wb%6nWG(l_Ymzug(Nh;mm>*c66vLFswS)3sDF|qPe
zNSb3Ed_eDfr&qjnezmkB`sQ_{S(?X>;o;l}E095LpLaOp6PwwqIoUoB_CBZFYQ%x!
z<dN<A%1R}m{Z09g?Zyb@#Nr;qA+d@4YWZTa<aBv59WF?8l_=tc+OH%aQ~~@1P+Y%?
z@+5v22b4RPIZZhNJk%Yy`%!$jwY=%wzQFR}*lv<7gSL5KX`ySxWHE+K%ph)HWu;p^
zBO<wSBi32Wn6iBh$elHoH5wVbOQ#Yu$nsb_L{HqQ2f-yY!~&FngUyH2iVwexLWgZD
zg?ux%nf~~Rt12j9--*3g_u1@?v<}{wtS2|VjokYV;9GEG)<y~C`sp2cLNzi&B?7LZ
zZbv$APB#xo4?;%d&<*bcyoe334p&VL^{88BKY-0L>^NMRjwFrFna)KlX^f?s*Mm6Y
zS;C!4eF`|ViS+|R^f-G^)|*pBz-Fnv)$4WP$SKEQY;65HnzL_sX2(vp@4IyAh4~^+
z-2J)y2w`u<@Pu&p)k<>1UO!xKtkr7cB2py1XZ|twLl%-;;p=HLts$*}qNL1qqDZgT
zfgAOe|5)!b1DZbQ?*jG>d&pG#Atq6aG?#^h%?LL9q^sTg)|Y!^W&r{#op2UZjx?%L
z-Vo=u&sQ<<5>GC1X|5D)Q6OL+O8?mn=`{?(Nix(cL^t90pdMEVWEb8O8MCvq&IVdW
zxml3RZpz7kwXzB1WPlv3ZtF5FQrOSEEkt)(^CJ=jM=X2?JkxZb=OVW&T-Gqs0_n{X
z?iy>#Z%6~FTL`L4*8w8T1Xd?bF}QxXc=RGd<k@PI#Rog}n^<-@ef!6o(+=5xv}n~F
zdHI|@0z*PV3UdEl)Ut@LROP?P5#tw976*D+Mift_^Du%9MPdsZC}Nhn-_fG!*TGFv
zjU!t8v8W(3H8tf|JkCFHxI$ixkx4%Mq<4N1b*6l=<DC6ch1#@pE;ZqkPhM((d-vL_
z?c$gduI$g|Tom7eUt2MTU0f<B9OG^3J)<B~l16TmrRK)NM}Q%b38!^-Xbo6~j;P7Z
zO|>nTeGe7H3KDB*q@PE%(FqA6uwNh}YLNaYZKT)!{yv9BS09Aow|Dcs)XT+~;~*~G
ztelj%0&7CY*S)+s*0Wl@VLg?t2@>yHd4inXY)!ZG1L?>`S*p0h`?HlBy+8-p#MVIr
zRQ?e&rd-7_0tGyShR^yh5CT>kG-lf9Um3yD?kWa+T3-e62C@z2{MHC)3qAY=H^!mv
zfBKPE_kvhl9|zj~#Tm+d&SKg_APW@=BGf0PVrqaV0JV@`v>;ZB$h(aE5}ig-jza-W
zo_}G!Q^Ba|!7k$RhiB<r+1F)~6T&i1L6v>_9AhQNWzZ2m$jbU+Qo}NDd)QpXhj#E$
zW~zYhED+s5YJCu26ozSk?__2Q%&|sF7RcnaBWMKG2pYLpVo7K%`yyAiB4rryPrTh-
zU-BW&eqQC(5AA(o#3*L{^^x=h03E4+;U+5YYhM~^gS4S^@~Q8_h@HM?Oc-><L2S)1
z(<2-^+1Xr&7@b?_!0FA%al&5c^wzVgIQF@|1(3=1WKeogNqW_+__k?VtfdEFyGI4e
zBz$_62Qp=Qo3BZ)$+L89VY)=A&^zXdH<N#SrJYNCwV7KPq$Ds)6qWc}{ckXaK=O;9
zLxZ#9qM*%#?H6mSu;66VT>hWYfPcjd)oWV#HT?kBKL}oHiOqu-K;MKffy!ikY|T#8
zE6*WW2U<bm<jXA@CQSyBjs+ojVlpGx+0x`1@Kw4b<;d;4pOyCs6$v)+mEvy26fJ)=
z8M+k%c}wEm8)K#-DjBS-ps<?v@!Os0SS#;^)Z4l>pri`xC>p8l%evU2_gK#<POnHh
zAIS50gs?ZGbRIz+GTG|~c&wiuNkrJ*od0zETnKA9JbIXmsD=NG27`-+;!~Ay;T;!j
zq)c3Sx!55ltd>qgZkfA)fncd=+zTLqJJ{xjLR5EQZ|St|KkeRWf)9AEWxACgAArob
z!e^LwMm+val)0b`iD7$T<f4~O9>T8}=GT6(p<jeQoIL~efrVAXoIq9u5~=VtNQ{+4
z@s~)hha6jV5^D@0S4BsAmqj%)+0d<0#DK$RGts*$HbUi)C$3>j1tcU(1EMa{=5Kf>
zB*KMJZysHX$UKq-aw*^ss|6&heKqrw-)KA|6J4&Yzq)67nSXbKoL^BQF_9RBo_YyI
z-zCZWK28sShuuNdRz{~CNZr=2SgQ??F2LUN_a*Y0FZo>R?o?8khe3Yb2SC%wJYDF5
zUh|5<r=*2ZB3dS&YIxJy2ts_|4~sWhS!*OOr$a_wzVf<<^(%Afi~M#)FVZg00hE5{
zIz)}IWkKXh_5TjSB`W=!ZJpgP)QG^|B*+Q%Zi*MgM)qB1pS+*Q2t<}<l<(xmr>4rp
zdG=p(%Mwfbo8H>%QnOn+Udjm>1YQ8L?^iG?KD{WbVtnCBj7>++v2Ta@LU@K!cI=y!
zh<AKTWq*}UYmt*igQ9g}ag#eOR^)VAHP&r!Is&~aUjuLga~Ffl!*tna__gU~_9sU}
zFy`JD8d(8C+<yX>SeSGsr~!OnmBUabQYPGsf=oqF3UW_7I+25f^ce<?|L%JQNlC{`
zxF-{Ge(JXs0-TF9OMsY@_yXOy55D*5rx$KUt0-U(jb2E-C{Z#yJ!C3YZ?gkjMLdcb
z*&;<VATf8DQE^e5tRqnC&Q73*WrGwJ&an=7Lh&>gi{XMX*SnrQ_^Y9_o0le3zUbAg
z*WiG#{QXXEedBCVe2T{<I4BS*YX0HVrvc)JGcDE;NV;yZJ-|MscOyC3k>wDMNp_9Z
z7k#yjS|p%U38<fl<muAnQeTHV{PHS#hw!RjYB1tgntTMM&kItyO3%oc1-QBoyQWtl
zH6Zqf(_RbwQ~h^5=-GI(S{mZ|CBNVmzR(c8T3_fA18GRK6d*~{^65Ocn%xEKmi0n0
z=63vyt)ei2u+V7OQ)6A3c@vJQnQ5TuT$?=dWy&4`lpSUa5#K0;Z4mn-xcl_kAGhDn
zRgc2_SHG&pkDvXrc#tuEdcK)OYjfs0id9><o9j7Saf)@(;(p&w%7BZk>Ijbab0`VC
z5XvEj+N?k-qIAY{f1bPtc9~zPE<OycX_Fl!b`IELu$KD&dF6P`!AT9v+CjvjRujVw
zy=Q8~Wr!LsnTb@o;b4@A?Rtr1>{~$nI2mATJwh$OI&G|WFgl{weAN4-Y_`IO$cbqU
z&21(}ULp_C{R{e%S1N%>QDJ`~>Cw;S>xR$hBN+9P2ug>4VkT4>w5VJ>f@TJl)7E|z
z3S_>Fa4rLR%U}CKHYWYs1I-WrJzKr|Ta}WsKgBaJ%SAT$=xnobhVlB$lPnh_f|)C{
zjXcLl(-JJx3X<8AD4A_trl;Y->omJ~dNT6h5twoxo2qp&xHJ_7qYmkG!{btmdY?k!
z4I(JXG}H2@dvlun$~DYiV=JW^9qT6~_=bt4kA*9mb|wy|12;dI-jbPqL_0Y4K$lJ2
zm!%1xqHT#N;cNH2(17!qFm21bh@)@K0ku6XqKoyz6c}i(rM9_UNG`Yg0!F^#lKCPF
zNYSP2$?vTjuP0HbC*=w77Y40IT=hk;sl8-E)I#c`9zT6{wq~%9IhxnmvWJ&Z1b0C?
z9n!Y@tw5D^x7-DB$?&kIWJo;ZxHr`>4@y#6ea+e2@}s1S#vO`ZB|l17ROCkuy81$|
z6D8<SUhiD1&?lo{Ymfce4NevcWNY{cVha!ny*qE<@!DMe4qq=#Z$&@92p=52Gbx4o
zybM;3-hJ6A|CK9P#KX$%;Ua|S0H0p;^XI#}OM~LRPoJ_KY|iAcL1{_p(!1sr-^F3V
zqIV}ox<qXShmTqZ)v4fu<YTJ~0SP=07N!#$;%EQVO)|yG{rhtxWb|~naoR-cT+J0>
z#A<tD`_Jv?=JQ~%O#VfDj43`)$UUUQE@$tliDD5=NbJUK&Y-R!+pgDvkU9xT0p`fm
z`Ii?8D!wBuqX9B8_M3GEgw4Q>xbhlZ#91k0h~F>IgMugD7*P}w8|aQuz7=}lp=A@~
ztIHc6s%wa}+ya7lG_rz<5poUE=1BOQ@`V_6CG^8S9v**@9GYMoe7vaI{>YP`5#8`6
z;g!)n+QHpv&)!1b9%WTMUEjIyV0e5r6a}uyIvF3@rE49Mr}VF?zi4}OAEURRF;U<y
zeYt*#r;h68Rra@jZ3-GlNj0(;Yy)>Y&z?Qo-W8rXKd92UQ@Bl~)acQ=4;XtYsGW}E
zsb}lH6<<zNV)WqL86(gp<Cl(tkD8yJjoEgR{7gGP&avKOKk9g(8W{eMrR8s7$Z;C;
z^mDbSO5<f73e(nEdZ+z0TidD)@#$@b!(-KxYSl*}Y%ZBX*n3xMub$UFt_ZYlsyNE(
zkB=|D`Q(B`2qH_fN@S=7oa&7sc_T`4Yfs<BPcIm&+0&<-O_SS-N$%0#@H#DbMalNz
z?TQx_M?23Br`NcK{RVtrUW#Kqt$*HQwnc=M36G_xgiBNYBHFZC2*qsz>|?@CiqVj0
zF7-J{o16{`d27x?^Hs*_Tb2D{%9(%Xhi+4Qc%wYF>N!l=C%4`h^gYmTn%)uV5~<hn
zmX|*M|NHxnJ-;~fqs%1pp_j-4tXd6NvvcJiJcvkqnK!-(HWp`DR*aU^f0dkQkd1f`
zl9!r}$+UzWG1C|?C%BQpA`uvL1yHIow>%$2|62+PZuiq|ecKK_ITG@^_bO?UwQq~~
z%Y$5elzXW_)S+(<_Xqe$@uW(dtq82z*g@BV<tA;ie_0+z1vZiX-&u3+pcB)}ppLOy
z7p*Sx^WdcJxO^jv`^KX_B?rN05PB+3c^Qu}tO+DzOF8JgVpYJa_$S{{sRG8$)xHdh
zCV)-oVIYVwyon=q({Lg}HXgY)Y&2+QvN?6*&ZBBSv2l5)Jl>v!r~#lUz1!BiljU#{
z7%hFC)@gY&Y^CDbQ+U<YHIK$j#Z|Xc6#1}z-*3iDFHV?GV=`%T2{jph#OcXAp;_R$
zT%F=9p01#w)1!W&@(vixH?|qd?K0MN&AmkG=S@4K`JMU;>PPm8KU{-0jJSI{39E%E
z3jYx~?&_7WISZXY{<A?zV=Qtdq6S?eSx?(xr|z#mh_lg~y5wwGePA%OI%;fqal31G
zD5y0fzgFUU*igxz%O{2-sv3bE;pQCCi-#i-%#0Aeh*;RzO^FZcF#YBd0oUbXF}ydA
z5AC~I`_y!77{W=BQ=P}@u8i^%XXma$0WqsuJ>7=tHf{%sP<A2+afEA(`SSxJs8rKN
zPdKJ51T33g{%?4`X#2ID`5AGv@8C_;dJAwHxV>)n(&-%HBew_W0{a&ptKZ6dD4x(I
z>hCc-#)o*%+@6>ukgzp@E#+Me_BV`O5{GjTq3$@4Oj~~goT=|wJGh?<R!<oI{`;sm
z`P}6NBx$cPGn;D2wnD}xJTda6dJyAG8(AZhsgLnCjlJoQe~hDykMk7cv?BaiX`Y<a
zy)r*I+f19fwtk~Sd_5uH$*jL0ddo7+X>NHqUkt_ijF;^B(b(#?juagasMtjU0Xg|p
z(g&b|KCM33f1k%b-L&WQ9HupSS@IFCZ=M2QKldeWkg(f*x(jLUo^wLGXXa!|uFec?
z>ig!?|6};HwC`Dr%WHXlso*+iiU%Q=IKSol=1b|cjt9wtiL+0xNrmZUZZx*C6o^D2
zCiF6P@+%?UV;Mv|nUG?Bb352WD)?x;R;}HEH;5zkUeZ%^r)s0b5O&7iTb@}KWCVR8
zWmMXFiP4)NG3=!%0+W;Z&^M&GN2iL_7g`%BFVUmrvZk6B1D>?)tON4t-8_7iZ{NP{
z@T3jtd&{Tr=or*K^PG5$d&84RoK>U)>D4yJXF|^mn++_G+s1$Ue{G82prHOLz46HL
zi*9$Tm5b_Rtw-~i@>g>bl9z!Sqs*UMuVQT!Oog@UZ$5jdUH9649o(V1Mlj-Q<kbKN
zeHq$@)$;oD>m%(I?Yfp>{#~JIUVU11KF!Y#nD->Z{4!E>b+!zz$<?XcrNWCxW{4L1
zt^&r#@ALXipPXU8<vt2Br9MAi^>k0UM-emOiFSk$7S+>Pzno->q!Y!*sbtP_(rQPQ
z1E)m&!(Tl+&R3V(pBX}2ZZMOuA*dE7KNAUV)R1wZ>HhLLWEwW#`bDhgYp#En49^7(
zuVCh~3G#643<Vu)-E_cO?TzLY{o5I8-;%zP46x;3sqXa#43;%%d37g^3&m7B_4^cK
zECmfCzcp2)W2iJR=ncijr<+fTG3o1}jEo3+@0L6t6ZU$R<%);GRKPIJ__G67I0-+-
zai_DWKSEf(7){T2KTRqnPIgD|)u(JBb~C%6h)RktTnbNyDs|b9S<Xdeb39o<-~~{@
zch~*cxY(RqY5T~DA%u4;A@FuGwu7+FTg&~@Ke?S-<h{Nu`Q)n?;IKDxkMh=P;KMqC
zlTE!b4~RC~E*q-;Gs@tYZhUb2a(ve5CAHF&<#X3`(Uyp_M{5f|TzLv|M%|5>V%wwF
zA~(tCuW+)xR`!+_*{R!0S2G`V7PJ0f3;8@`o-6tJ>E}E5l?~)PW-Cjtv7_f-k+C-c
zQwj&CAsw5(#NM-+jQ+Lv4pbZRqMV<ij5`_~{HGxg_<<MN_{`xpU~<!@LwIdS{*S4*
zjEeIA!o5YLbLfsiQW~V2p`=StIt7$QX-2w1x<QBjA*D!23@NEdC`t_}Aks1PJYW82
zJ!c(Xxm>&un0w!Q@9Wy13n^e0J{8b+_SOgyOae|zW2*%4twe1FK)g7tt}L%Z-Gkl9
z>YMI@LL3KS=o$@2GyX7J>)1@4)%GM6Hna_%D-Kb&;0&$P!`-RWAM6+7w-*n_iP}n7
zzKMksAxjI-{xnM}ztWxk-R@ui+zTKcoo*A$T-O@d^P+*_^mV|UaBUi0!=$UEP}QIW
zhGeSB$&=&$J>{W^6XB8>&HoxeI8wcMxkyqKq4rOED;~n=CES!Du7_4hm}W`cY4Lt9
zXVn3LIHkD%j70EBq9pFZkL&!~u3>*Ul{g|^QifCXnm3u$<!i?*Np9|GX0J!nRbE#9
zIga}_=@9MkddD?0cl0Y7Nd&d#nXjf_)4}%sR8#Z7gY8X31dnQ;dgL2=<p(D0K}27w
z&0|R!XR+BLBGnS?A3%|zN-4UEMt_LozpgE}INh})O03|xz^P}qe_|srq2}farhEOQ
z<hAv)KaO+F?d@{}w)?Z9%4<KtyLRCqb|V`oA20>apTf*(Z^lY-49I&p5z@OFT)I^_
ziFzL#cxUR>F>=ShjTCFXOTY{nsnJhR&LzZj*qgryE-P0f9fKUtm{#+G%mO^`OJSm1
zz=yJKMV8-`+^WNAl;*L~n3Q;)K0zya=SmX3;4?m^4l7z^Wi?i-y0EE&6%*NcrM~G-
zVI2t_N@86~j4!|i(EW*O-?`UI#y|vfHof~1GF<R7SBT}pFq$`tJiNCc%v{gE0)L>o
z%<M^s&RxpkeP6z?EpOd~XUR%a4kwoVNz4y;C`5f-Vu^WefTz|sO#RM8M?jR&>i&L%
z>%&)I#Ml_1wYk~_)RL=t@}sp3{oRXX)LF8u$?Xix|F_NQ%LC5OnK0=VpSW4Vd$r$#
zYu>6K@_Fo_kgPX}diWU%TGrnNA`&coJbFzQ<!2J&lV+i150zv-#1YidWe2HN2t*J?
znc}C}rRhAF)=B&B1G_w2@2FF8INyrPCJar0I90613d>J)l74~Z@|V;hOpLWw-%I)|
zstM=KD3QAsSW?N&A^!E@gA+U!OYl%vH(0;d_#0x(n<JT0z>CN^cCO@f$C~!l<uEbv
zOJKz|<W9O<L*uR~>_Bnjj<y#5HHBP-eZ(EJje;u%>b!YMApXN3mGhn)zJr|%SBn2f
z6TUPorzm>J>ne(pFcmUE6=!_EZw+y|<nKOKl>buA2z+ia=wO}FqkB7=I|sTkQh%M-
z0sS*7;0kQ$F%U#MHnNt&dz5iF*3bec&I0<ly1Ik1WB-YXb`&ZbzY+&xuyD!e0mw}3
z0u$x;?Ujg-0<c5tSHGQ}rdXAd*6M@-=TsR^_e&wD88AC}5P51g>AF(2vJu-^zWd3R
z`^&7I`i|kSles3wQogZiJmuuuxLH@KR?zz?0=E#4&q;HTv~q~E%ooiRPvPQjM`^C%
z1A508r4C~Y>MPQaO3So{`0fDR>-YnUMxnQPI$Pz}D(zIr?68cqQ-TZt^uIlCJSMk^
z2WyLiq4Hv`qgJinR_3S)SZkiC(V=SOsn49Y(Xc@mg;rm{e1mt!k4I4Usk}=C>f^mw
z>7yU7V=Bw!_QeCSbnxQn(v(SwnXE3}vzpw-P~a-z4D5fZ2#@<^>&^VFK$0wjwYtXq
zAvNqheb>=9Sw)at{nztiMqt4r8uinx>o9B38gntD$gKWCc|OAS_LJA^``~!a2a!cz
zpS{V)xng)hyFcd>VFvzKbBPl|ZQ1jQHW;BT^PRx|k7!;Zi9IGuo;5OA6ODQ^hS*8*
ztn}(^pCPB4%tlnP&0$AmtJ`o6ialj}G$`l>N8o%^c~0?q9FU4+y3dFVpS)`|^|;GK
zFX2WKdHpE=>uTpy9Kj?t6<IoY3B7wSys*Rv64SVw<X@!zj}?LiQFhkhfO%98hjij|
zl+<Nz<l@|U=ShX{Sr;eqU)i4=F^~H45BU88om#8v1%+u<uu>J*hmx!xrPujHVoHpg
z!ijryzGpoo44={k4%6WNC5G;QPeJ6AePv8C9{W^WiF;H4d0<B1gPD?#^yH22%KMq~
zvaSa-6b{q26;B&e<vD~nSZf`hQvV;t7S*<%ZBdM#c>2Xm%Vb<&Bh?AG7g$ts)IF9V
z>W5Gx*W+wTBy4^}8-rj&REuTgXeG%ZKCX2<;J5lbtuhZH?v(iKnLcsuC`E~%*uI)4
z@sZADyMGx_AU~r3{ullWs`HN=?&U-fQ*-|r%2gH9XDf8+2L;WLZ1FoSQAzB+v4`9m
zqVnpfOe)&Fdf!CwjuK9@&!5BfFuc<qwX*Z~kbrPID^VwkRo)lAh!>D6_W*v5c36vK
z7Js1(IXacxDe2Y7o3a0G(NdtWD695Y(qw{phA;mlCwDLWTF1pdSzPE}kExd2{q6#h
z>>QrN>SL^0ykEmEZqiTEl^+^oTNaaaqG#NX^0(`sR9XpqD8|H4RI%t3kgVQ3p`HdV
z+~lDVM9>`KSC*0C;!iKUAfg<tJ&~3Ux4X?GR;6x7mYMrT%5M;H)BECNJY0934`(cW
zzv5v|Y%nLZakCK(<p{mrf)AVlH|HDZ&Vyvnt8WYbD0!v|=*5P27EH(|8e;L71FR2K
zrfK*%WqPzro7ZlN(JLllV3paZ851W!-O@m|Kd&s#&XRGd0W#;a@2gyNNS^D-Z$_%J
z{kMKZM`@Z-S7|ym8s6CJm?!Yb@ukjjOT`D>t8c>zUJtQkwj2x#H7@jAMx`Jn-Y%jg
z6nA~?IGDB3Og9=8;cSFjYWZc}@A8>cz7vqpWeFQSNFp|F<iE0X8KXnMh3L~v>sFxO
zue=seUaXeWX5>MZ6l$iCn>3G|bau^L6soDoRMTA(IZbJuaJdV4AH~qdURr2htPZbC
zmCj4YKM7IA&*NRWly@E!`Hf|W6&YvnD|}eaIWZNS1%CKqtS^7Eo+$Wv^YbkrT2Vhh
zn_X?9i6K?)a43aHsAInv$nkxDTb#a3Q54awcQ%W2id2qw4rV9*I$U{d{VlJMSo6q@
z54E^hoa5d$J{pLNti3z7wmeXtW+9vryFtn&LGi`&1sT4pApl}Lu@}|X<al#Re9blE
z&j2juUFBsDZSR4j9VA2y4K|>SWb(%bWsx}?8Y$vBYY|luJc7xh5#;6Xn#djAa8<P}
ze(N{Db;$i{NcNw8$mz#M;mEzvvEZPd_v8~#@QX|-2Yp;*pv}=C{!w3gzZ-V;q}y_-
zC9@nbn<!4?L9V}X!(93lsy8eCB>z&tO*WUDNFs)bf7Q|;<PQ57BN7W|MX=s`NJ8|}
zs2~6N<3@co;Ua>`)w1)`0Ho#Sha-)Q)z{Y~Uop?pZ&^b?uA(Rl{bcvSK`oE)BY4A+
z<>1rgQPABYtUYdOQ5Use16ay9o|Y8<^5MnvpZ6Yg$gvLETDAV=^KmL1m96gXnt({`
zpWLhkZXmO3^6L1w+4N@U21kqK04#4^kl(!F&Rw$}vrT?BAEuSZE?o7OcgF?FIQeeh
z)F%eux}kfh6WZHPr1QsH=ur(G?JyM$*AaQ!l_l}ihS=>mr?RFYG5H(zD5ijZ>+jzW
zl|`?fstSD*{tq9Ktgco)flwD$?wB~1k(;4X=X}z`F=iDz>>%A>-9px=`5-DPCRNLJ
zw<^tq;ZrouWyD_8CDksOLgaO|V=gNT*#h@Q2`7qx<9j-sb&x}jE9lBnuN}^E6ZXOe
zr(r)Jwzq&m;qgbLF%CBO8IoO1<eu1h6wpa!opLw7zl6&5b2h98`E84&v1PF3k%!uH
zVYc+)7Ymaj3opKuM!ct&G$gZm#*#Y>-}NmC-v3k|y5q3_TXewT4zkw#S43dP!Iy*m
z`3M(I#ABw$^?_O@L^Jtt^h>+x>=3~gPn1HOg<!2AZJY)0dqhrjoVdn6HlCbNJ0QX%
zj%s2H+ELyA(s_3r(i7d(@V;U!<BvL*XJPB#()myNRE-h#r^^_xATPV@&dyGE(YLOw
zbab1UGex4Sv*+Jc$vU^ng+jMb1@tPV1#I1!lqtP_a&fX+#wy7X5p<Dgt`RIV<Ck)7
zyjE8W4ILhnQOr=%Q}(NlUE{XvYNwLk>%14J(VYyIkB-x{i+#`bpCr=+SEsT}U1P7O
zNOw^Z#xL*nNgP;F|4XM9tW3PzL&A4%+dO8-=af-f*B34>Jlv7Hg`@#eL+p-02On2k
zn`hUaCJO(aK%r30AS>V%L}Yf2;a{$#r*(UrmATB?(GJ+81{w6HmUEQ@S+{5}WaE=0
zD&$Bg3H|Q4I-Wa(#!v@yUV;gnAhJ2@9pEYjU-UmQYXhhN*I$S%ZfYZt8!||KjJZKy
z0HlS@ZGh`gfpY@N2??_Rr%J*ZLREQJU<lp;TT4PPAqobF1?D91Y*@&>9&niSOhbpN
zJf%%udJ1?0bKnkn_SRF&_;O>bvLq~FzC=Ikauhu|&ywcHP8o`l-D#Stds8`BZpBDF
z@vtS}V5P7yr_M_J{?x73*){g6fY1_zRsPG=dtNEdP$_q{-v^h<xJ%2fb#ZZF4gc+w
zvjFs}G{d~FtQkG0Rm7i<0Lb4v85d6`N=JxJ&h{t7z2`sEnpw3MUKuRptw8FSEf;VZ
z-#Fs)dKnbH-R{b45I1zV2?BUAXfzUYE!?8^%+5XUr8=%@{qTR?IREd4oj2Ls*t_Qb
z>_{cwXFphn`gC^cv=LdI9JF~~n%}2x&57LLbzVoD#bf6#_JlS~VtR6O7zy+QA1LY5
zx{IrU<J@Hf%Cf*}9?xCeEmdv>i_yz_4T41erqH(DC>5vJr*%!{CYAV3hOI{qIW$|)
zNAo6ZvD0uEN{?LH1Me;Qq^9^WErc_MT$H1#HTqF`R|EnZ9N+;l-djUg=9R=(t|NWL
z>*Jq5<2`x`esO>39_pjD-_84C@^pMK*Jwq7l_|-NR%%wVGR})>SW#L`T89Psr*)1N
z15R(90Rd^Dk^EuR`G^e~P|bhfc;ABh1vw$0U-Rvp$u`w_!{>(2-cKdp`nuv<BtMNj
zdv$kF<bH&z4FQYgWSyE$<@oLK5)7e|*6yNT6B#bWuGQqm2pCB5;N=tYMEFeNR;BE?
zR`pWS(5;g-OR(y9np#-csgpM`yyto%7q}FTr*JX}L{&@>r1I?#3QA~>={WCoA$_Xj
z2-W{q7=WoK|DKwoul(c3k6^mlpY4UNP|?(8(+TZ^m;Sm9tseLRTmi_&5%|>j_0n|V
z=?mr#Ya{O}SkxIoPqD%*;%0j(0^I3U@U@^j8Om!LU^`rkUV7vn44Wj8YrXXpGCVlW
zy2JIHV%0TW`4+R~$0Op)>gPw_qsDNzLeXn?cxfo!3fOn(?x|_%(*WoiB!N(qF;bGE
zIFWAInS+d3ChA*Z&D;EDda$vF*T(VL#I$5K`@Tz)fu^v%Sca^mT<F;`TNe-m{pJ=(
zkM39|@eCMA(s&+iZ*Bc`js1lkGmMYYL@QI-*#%lcyG)oxQ4}wSXg1)5l*D%9AZvkm
zgI{@8tY)Kn`_-=fG=n&RZuA{r@bwTqWD58jdNuegl3&gIh;hs(RW%AHeNlGg88RrA
zuE!7broQgBjZ!>(_Lu5&cLx}+Vv3rlEeqVZ;8VJi*G#yF!bvk#0z!WDd%V$AoLA~{
zscidaGiN#l>e&^{xx<(q)~lYD-LA{szMFu4Y7T6X@ryyZ-9GEJks5S1zGE~{@j2XT
z?kEbJ%&I)H2M5O17Wkko(0GIxbE9oK%!{kUd6<p@a$)fCL>oVw3Vt3{TWss5y~#0W
zSx+X+EA8iNaAc_>Q@9J=+1iQ+AOhEWpdVBtbNj(m#shUH9GAWWb-d_#Sw11QOf0RG
z09^$1u&|Jw_|~)p`jHaM)duRxC$}GS0Lb~Lgpsv+Z9pJ-vNvM-bA&oS{T{OXZtDA)
zp^E9Fe;>z5ufKR+ePM=rkOX^=tG!s3Ml|dfM6NDH)hNyTq{hvIxbMAT7>pG0xPfX3
zxMjR=EXk3;c3#x_@?xt}cD%M*(>hw9Hg_mkmc0xrLyz=Xe?)XiSjIy!$<uUk3~D4t
z^3q}T>5EZO(%W6DK=yZ^kEfa(<{bfz(qUJv!TK`qW8MTI(kNy%yWh~I(h;90l)R7w
z+7Q&zX0xzo^&a9UIElB+7dE0YT(bjbtq{4^$#lfoW@)NN(E0<LHiB{0RDqHRI^=2E
zQ@ehipKZWcvn-zxo*4<szO24gz;g7Qj>yvoDYi$5Y=tinONQELwcVa*aLLH+p@mY?
z-B<{QTCxKNDd<FQBIja4e#S@8C8^A-Jc3%|@y3%bjuWu|Sh|GMmB4PVu_sV91g>;a
zWY~?Sr3=67oap#Cc<(|iHMPKU-`c@8l7}IWQv|rf$Ht<!8mk_qC-JdI=_r!3vN>x3
zb}3eF#AP^4>%v^D;G)-ay8w0dM}yrXx;HyPx`M~{32Swky_rjHo%3IYPitKnf2h>j
z;2xCT+jf+37F>2bdjkTrKccHZ?=->0$C+>c$e!PWolpDc`cexgqEZZWo<DD{FONhs
zNYX}C=6n15yStT?2L#UC?Is8wKF)_mO%rn2-T@ClX<EF(gPjstvNQz#vgx>f`t7x9
zY``mqA{2liR@KyuPDUn*Gf2}~CD?m<dX{ww0GJ?-*s3OFA0kbn7=I_6^nQ~)xy-8y
zf^gK&ScT(v&xP9meeh)1d*BqpQ2ZD)S;uJ#peuk0^uQK~WZhcpT$8G?oezP->T>r9
zxSz?8q6x3=`az|;3a_+jdTLL~8*?awXQ!QAsE8|lO=?5|ipW|qhmSUr4C@6ra>mKa
zZK%quTFK_cO>93>*Ifq@YbILe_&BCi5NTD-($}VuG}1~12@+(cR3vlFV|`QunFe1R
z7t5;x!V`b6X<BLJkCrAtX_y&-<*F(2)t$7CxTU9UK2C)dUBK3>6SO%ve=?KAVhL>~
z?%1~4yFlG`3?3b%V{6Ik9_MPwQ&!XIang_P2{0<)7O3@PY5r7mO<an|yZZmlgNZ&v
z`RQ>jmeHEYwqn-Ds{IW8@|aw776rt;-1)GvVV#vowA*hbTd@l#FX^>eLE>yLD|oy}
zk*VEk4DTt8O6@Bn(LO4grY?^^veuh}>r?eo%24vB<zHW@X4#&6{GYw(k-@T3v|yZt
zv*j;)?#yXw`T*)+VeoE|5xcos>yCTl%2i08qea@;Wm*1TT3Q-DvlK)#J&UR!<`#2^
z3b@|3!N6PG=U&l8Wb>9J&@xt)ekh^+KwewEX!-d1=4xYMFS<2)P@KS0U*UYM?njLo
z+#h7Ums)T3{XO%~_ofU@Hu7D`mYdN?wj9;wUQ}yW{!XzxA`k7g05l}nvk}zPl*1<@
zAW9diYW{fLO0B*agL?#!g93JpPErSY0A`a0<%FZULhIb+ffv_`P=L!XA@5A5XPi&R
zPzUn#E57X)YiB!9!0%vdoguNP<nF}Xv%N>lexmFQ<;Wc?6(#@guUi6C=T8Ai?r<Xh
z&BPuYa~YdV+nhw}qT?!qNR*3cbxP>XR_AM*mW3ROlaLh~ANY5E&tMQ6`Ja+p5_<ak
z8ng#vRlF>zQbrG|5;lLHH;sK4XMvjP8B>_fiw?xq7D}d%1H17ZV5xy9)iMQ}82j<Y
z|7}^9J^yK@As${S2cBtyd5sP)mU`Kcvj+CEw4r;pQCci=Xx;>H*8-MQRN*N+MpO_1
z>?8H}#%bZ8#BHz=GH?2V0SZAVic6kvkIN?N@9+OS_N#>UQ%zeg<nMYPh=q9wAwpN3
zm;L%1RcU6E%-aMRHw23rQU3-zeqdwGmTb-b+{OHc0(xmZ$L6L~*nX5MH8JQ-)|q?H
z^HD0bjzWE{{_XT30clzvhBh2;?S4HoUT+tds<+OEP`5URwd-baU?{S>M@{*AnLDbG
zsujs*M3o_=B>x8AmE0p~g=3z&`Q@$cI;bIj-zJVIo5ixsaA{tZA*ljKt5SW6hUB&d
zU!UR7Wu4+n&@{Y9-cqLPwN0Mw$uJ*I^mWa&Rk_TFu6B(zErIs2>h#EK!AHXy?gRGO
z@5h0(C3_Xp+F5}UW&yt%gaa0);z^CYL+F(tewY+#mk~nj>r4|&PG$NCDZMvPTR0zi
zRFxUGr~2#gZqA%wzW~gGgqT>$n`p7<#`CjyKbz0!ho^wED%0HwtC@D4>j%ad9={Lu
zIuG?z3dBg|0U6+5?OkdHUf!PIf4S)~U?F>FB3iTb1ly}P1AuK5CUIxz?h#sg(l{UG
za?Xg`u|>pc11Qjtcmfy)Xvw`onkX9h{sgddiyQfOSp=}AJtFtJy66Sm*;P&MhvT&2
zc*u#7(t@hz&S`&uWebJ=BH48y8yXrK8yZw$iV`@Pn_RsER;}CZD4{__8NzYWR~t8V
z_ZrxcWgLP+SY6|Ntf_3d>P;ycS?!#__mfy054yu1{r>K~@r6ouezu52D6Q+gF67dG
zfia<+@M4B^E4rR6ieB-ETa*KD*0<;Vz+8quJ2$uB5RJu&ryVuMCZkF!tX=2Y3oN0&
z+kn=o8svG~5kGb<SQK3OIj$?>MpWZq>{rH_4<lshXR0OU*|uDxKs3RA`KXZohYfv7
zpkPGqzw|JACOkIh1ZqCj2>4z_z~H|uPu`*f+$V<5-!(XW2_0V16j<#X44Gz-Yq1<b
z5HqlQthcwf7wvz#J-#GXxu3aOVgt&n@=fy(J}~4bM6h&{!sy#Tg05hMiYh5SQAAd-
z)Sg(`ySMfC-4X1yShvs2CS4glAQ=NBOfFRS-|aXisH({vzpxgGFG&7)6$-dX`4=_S
zPA){vo~YeAMZnqd+a$OC0?|A96OPAnHVvZxCiTyGI9IQmSH$Ivsr=dgu7%22Tha^b
zASoLkeVt-=ls@vy8}p9H)*t@(Ssvy+e7Bx=>c#&(5kQ?dAKE>2zS@iyK+pYv6Q}a|
zMdKbxah+Z7&!ua{6vkQPr*C%QAqAL(YBPCMs!n1)lXiNFai)=r8r$Ce671F1tQmEN
zA36}C03RYZ;&xoAUkg#am!osFsof0!-$jEG(nR-98bV53e2sw^<|Th~wo28iX?5O9
z+qLg_#=!MuadrLPL?XG*VO6*sm&}{|xR-p^Rl^+^9-Tk#^2Stl|7US9OC;E8`{368
zGjis>Zt^|6bseYZm&0hm5QqIJfdsiPo5!*|jDPujf8VP|NN<f|qH;^F6>J^i^+Q&=
z5{0_Xyv01;r?wR0Wux!=+LsU*k$rM2L(h){vep$ck(p?WRikL2EpLij;g~Rg;?Q!K
z$>S8zNzV78R8d&kblpxMB^MW8?d4mpBT?(XN$|~<c^ZgHr~?qk(%}<BaED2E%LU!S
z*=+hRHa36E<~GoTGs{iInUKD42OL>-QI&W?o9&fol|!7YW!c3d_mT!^bH-rmb1k0!
zAJcR9$s7CPx|eZjpmDItwwlB^FfJ%wlqv>Y0viUpingWU>C}$pC)lcdMZ?*n_-HoH
ziSk8uH*Mp?{VID>nmB3m>3TQNGU~AzO_0IA!|RrNNygTM+Sbx#7cUplyOYffspOXp
zNbC6oV@lI`u`c^Ee$K%j*2oTGQb=u9#!f4hn#m)}4~|-P;Odkn%>s-(x6@$ud?FF`
zt5ja_xYA>XD#2(*ujL~4Q(pc>a=K4b#=MbXzeaFR+=3bF0UQxDz=+nYTU_zIlcnCV
zPCv(mq)>3Q7fi;>0QM9Y;p}Ckn%o0L&*NCA(jH2<N1YKuvQ4Q7^5{+E)SK={C4s$L
zJGJH$kP;OBAWl+F&ax$C4m8%Rotp>{|0e+BJAV}am}Kn}-`fMO!+>cXPJ9`LPvtDe
z6)wfQG$y#ye_#95504rtJ!P?0U5hy5$dJ?Z?F$5ig4nv&m4x73aQI+HS;l@rr5nmz
z$>f#=GtNg;XF-b^Zt-Y2#k?y{-!$B**D#Fghr0o{a27IeA~;?KF`tL~?+*j=ZjT;-
zSoa~FNC`rSrGlD>M4raT)f6Z?ne1hHAv@1)F1zXxE~7eO-XFME8vqOA`w*R<Ef&IA
zg#~_f0LScMu928xcE=dta(lL`{tRa#lCFQna+=()Z<<!cnQG5BHq%ze;0awNG=c(~
zAa`uMNOtCeFF}mY@0KNP6ZU)5`jl75ZQ##VfYAP&%salfyy|=dh!k4j1K}((+z^VU
zk~4lE;@CMzb<a<7n@}}0`LVG`XH|{l<0nYW&1Ffp#F-syEm#ULu|9kwsr<Pj)%L;J
zNE-Pm;Ztdf!M;l8&wJhCEGsNP)cG{;t12YaQiXbKFd%_wRl~35ZY8O=YH#j$WO1i7
z`XkhNJh?Y4zboCg(b-Kd8mY;;g2#H+jaRJN!z|<@oe?-dYiZY>Yj<16y#yW&{&>i+
z=xB}dv3^i;F<lwfEv_ayrMcmV-n-e|TYMhU=LL{<En&8{-D<RMPJ&>k{kVywd!>d)
z<-4%kCQBGq(dRtzyx6>s1dA_;QePM=MtyaWz7Va&=MV5i27@0BI3JoXwXAbAiw8ZR
z31{=@QDU9T(m*p1MG2Jz8Q@P*F%HzWEPmGQuZ`7VlghJ)StxV-)-jL=-e}__XVB@f
z&>D+p_z!ADjf4Oli*({Sbe}z+B+UY63w!Nlu;^A6u>Oa(<S+jsS9yx9dkKOfYmQ_h
z-oAxc&I*O>wrzNbMU4rILf{27#S;W)KqhHBnoKSKE$Dn}d|>aQOGEH5ThWcEi(2gc
z3<Y7h@@GKRy~zND<$NMF?AR63Hs2Ni?AYj5$6*S|@4I_@EyENOU>H#*N@i0TEEsFw
zCRWoR58E4UWX!E!g;Z}l=YxslHUQ*R?r^YS&5|)iQ7(r{3PWYPCWo$WR4%qBubf6^
zdVXao9~+{%BRBH6&wQ*0&F;2*6M@20q-_c&?`RMrpDADcEAwA|jO}0Iu{F$!(9O#3
zt$9RPzmBSHJ&Y(yVHHQQ%w;9u-r)U8dz5Qs(Vw4z-r6{d8$vPSdRt{2h?)j43gcVg
zJj|FOY~JjMr6f6q-H)1%^zxy!*3dMxZ1rO2g3bq(2>=%%=A2fFUf-EQr@sV#bKb(L
z7&foVUyWy}ub=wZ&=2zMczHzPYFw8fh#e4hns?GPShn7fhPD%v%Aog9@PzlpFZo7(
zJqiAAEc>d!?+qrA-7#OeRK#<!V`gaS#XTW4OL;-;RzqpLLC4owvX}op9_@$Pfu33{
zf>IC=4YuOD+*}Lr6?dTdO~aFdX!tMErbL5D_L3bbzs>LdYJN}LDzM@#ZpZ2R&aH}q
zr52}<=zfDCU|Kj}*m|jeqYwTPMjErp&>0O5CoJ}-z%>9&N_i;aZAOw_WNs{#+HdPi
zP_gFLf_DxXh{8NCK>~n(R-7Z!`R|>vHEg7S!`<;(HXlA#Cd%#7--Pc_G)CeFQ)`$p
zw*;=A!5ER`rytK)Qt<MFAfE~wqBRN7vD#B&0#icx>?i7jye_3M7mYhOv!!}%l||{}
z8~SON$NX)mq9CyFt3NM7ofnbOt2n;~@jxf;o`ItlESU;Xg&u<o0czQXPkg|}+ni82
zN^F=XY3ULD<hzHPOMjoU_TcQ1%011q!uYysk}|4PKnjiFCuZ;yjl-s;am9^9Y$2u|
z`UD1*p`>>!G&0U{*)VD~m>%w)#$x1y)52Uq5Gq&_x{62?3}PHx>)fPDv~Zrc;InR0
zVe7B$)(Lw7EXhyl4LDi~k(v13Ritqvug~ATW8ct@*5u54&s$ZQm0)%2JW9I@bsV_l
zp7Rm=P@xCf(vG8V?O@{t>5Op*$3gOHP7tR?CXNxZUi;=C;;3}#@q0BDQh^D!8P*RD
zg0Rx8&aQzT)mnb}F3jTlM=y_i?L(I$>}7RTwo7~3r1%G#oM@pUCCpzl<i!IYR!lzl
z-~|4yu2gui^0QBhR&D;nrfPRRWpqHckj=MOjnP1~`urOG=zlxyvZ*<C?ALlv{1g1b
zR`VcvoC@o8?YlumJkx*<Gu3~qkfTT1{9D8sN=5H5rVT>qy_j=SMt@C~YY(nj`bA2t
zMiNMgf!*Osq#t=<<SRCnd<4Hc*jc{F*{*l*iNM)`!W_0>CR2WDUh)^4r3KdKBW4~F
z*3%LSIO9apKMRHiCmw;RA%Cb{!?SqTXdjl8fI^QFK<PucM93q&Qhbg+3u&Y<xq^gS
zwWg<xVeR-qXURL0@$NZj85mo^0e&4GxTE8BwQ0#?qn@Ce5;-ZRO$>=spK`EGP_V$k
zY!a`fA$Tu~HL_qP15}0&{6Q&(xv+o!%4~5KbLK9C6u80~Q`%;mOevv@L0hY6Mot``
zOSGl7XkSkAqW|dy5`Way``^b;tn1=O{S8u-{b)PpjjPg^0d(hnw9u8WYcQntA(YaM
zgRWka)y3o+(omY!7o<~od^4kK)<KO+fKMbrZjr_YHN<k+t?U(@qLPvmpPz@#QT|NG
z4oI;$XH*^1f=0G1dxmaXux4YuRK#uUxg#Lq|K-lu#wSV@XVMwQ$hYryZc$;{I)5hg
zx+9;<$W?popu7i}St-4rXYdkAn_C&Rjo(vA;iayfhApb`_Q(>h(CjjbzU|p4WD`Ub
z))0f*o8BR*FVwA1$YM<10@RE@FhTx93o9zxC{{>|<x9c&$mv+0iW>F1TXc%=SF+V#
zaHePsdw<sy^lV^dB?~1*3Y65DzZt#@7)RenRDbn~^zCJ>E?+eRgQyP~1oBzY$%yhc
zR-7S1-_VcR-SF)0QyMu+HA^pdod5b(40mHsZ!Y%~{f0SnECqIch{e3gSOcdF11-S&
z|ER3<voG;Ru?`#c5_J+`|Nfy)Nc7*wxBO;k2(`e>mc}40vsFNLKqHoG!ogUhIFrrg
zeym~$b%-%ByYZckZ?~c0ir1`|Rd|S1r$bWeNOy#<CkR!e%lzz10l`UPV{`n2|BOlP
zpBHb!etCLxcc=H}clI2_W(|*C8+Pn-j4JEJ_fNMfCvyM^y9UX0r_|~$4!J#>$N6RC
zV?4hstVolNi2PygXJQ*Qoc|GYhSe__?-#y_cByb0&88OC?Cr$4WJCVAW?3LJ*)STX
z{p}&1Val=Ga+`H}&Imt?g`Z_6JY9@@zm%#>7yYMSUY^CeJ0TTMu0>qe_>>WC_>2n$
zG=z>%w(nC{K}?^y)M}F0o7t@toPL2Oj222@-ZOBVGfJEzx3wFFySw#8KgBI`4-Enq
zB0t>x_pCV38N4tOmae41LI!gvi#q?tE{`OCD0s~_!{R_eLg}D+Ft|bA_Jd&`F3lPB
zgJo^yMaH+VOR#B_eYLl^GfCwnZ7S2NX)0%0%yFM?TW0a%XN#Z}GVFTJ`WQibO{S_z
z&E~T@sCaYm)4y}uss(`!t#Q1P$<9!BpyEy7Q0r@f(7#C@Nt&nQE3vcvIWv<p<L=e1
zHgp^z(XH<TgWetBO*rhZs#7fEYVL8gzE?+@N9~#M{G%@)`1c~Lwo{DcRr6Q?LvjAd
z>dg`~W!l`D<4qFnt1&?Ebqx#z#Q|6HLnzFBSxgW|e^wag-sY}4)}w@PPimdmy?#pI
zdLBU4NK|p*t~s3P&SqseCGw14?cjE#Zvjq2Pa=)|;0T9zkXkm@{O!wCL*SBm#+8a6
zvmX%Wg=;rTKfHaQw87NH9>gzhPn71qNM|->8dw5;-Xyc?;otStc0-wO0e246ZS`$b
zYFp|u+SE@r2oWJ*7l%CVB@zlLnCF21AUDGC(UZUM#GHC!e7-)Md6Dr-ntOwCcGeJ?
zq}iU}WOBh&DlacDohJ@VF$6@lCQt7G$W7eaWiM<jdOCBSsoR0SeBh<?ud_UFzicEZ
zFmfO_^)NN=`=`f(yPl$mM3cL{G*_>Jf`e@^BcME&u!ig_Q#~-SDY7Kb!V+_o<mr2l
z4;5S@Se5K^xeE;Oofr-y5Uv7{L{w_8w}o@>HH!L5mk&PxUU;8j&Y2+ZQFkJuSxUNU
zyd8kEl(u0PNik5l-&nDv6}+l5b^XlBNl9+76Z^{%pT{{>|6OPn+vZ#B1Z2&`qp(v{
zyc~}_nSrjMOr1w3P_ES=gFQMRyA=2@z?B|`1=3>6#X5&YSAw7mO3m~34fU7vLQbzP
z57f#*e|yP!VU7m}7BnDRoc86iEZ}4yv|FTm?{qK<5U9&|d*lhw+*gsoG`n^@G!gdn
z;5t}P-ilk%Yg~1${=m?R)+XctK4k9v6+B;GQ&n1pqfG8>3|1;$Z#^%s-+yL3KN5@_
zZGBBNYZ+jH7{`hXq{n;~hnKh_+<7BIM2RuJ#u0y-M=4whtm&jih`nOR-ndZB@G=Z=
z7HyM`rD$S9Grlsr`(V4|Xgs?)3nvR%;zXi@k^U+3Okt+D^u8pnPaO9j@?+Q704BVA
zYS<bF>$z5L7$uB#XiHp%YaG(}Fo8Y|oKqXRihnUUd2VZ~^mU!6E0WTCA3PN4JUuL0
z&jeDI(w{>nbeI9?z%xe~)^1tC>{HvEc<0#m69ARBjLW0vbpz^LUvmj(NUru~Q~HQI
z(cc)EbGwttWc~fP62$}_i^;r3rLmrfouLgPxBIE$uyc9xox(twex|E0ZyC(aK);4=
z9#yESR)GGTUEg~pho1MHqUkxgW$GM&d;cqqn{tvVacqY`c@}TN7T%ySDJ*?F-|)PS
zOJcb%>4VtTF?^@Wn|-WcrR?x}sMdDIB}E(G^%1bQJS_0E`RwN^i)bxF1|}pu0eKV(
zv6^*y{63gW3){-X{;c5Vj9>WvSNm#2e?$8U*M-u8WlBFkW!jp%TH#haAMRGX>Qj`v
z=wrRve`B*VYv!2C7DQCdHMt8g8v_mV<~Y>xPQ9Kw7sS#{HH)^zlrRCMSaw$^p-l6)
zdf3q%dS?!=Z&m`ly|Q?>UZ}cutEFCjc!gm`^Qe3gBNx+Q^9sUV)+9*`Wl+DWf}@bn
zUKYV^23jcbn^&8e<vyb+=bD$p?#&7QCR1$1M_L>NY&8;Ma9OS;5Z~WQpBKEe(J|Z?
z=|MlbX~yVYOmd|>8E(#iYfPZ%cb|JDy*QK|Ud=wU_-k5<F*|rR5@Lfi-rwFg-*?rd
zYf5&FiXmpRg5ef(3}{A~`rptCdC>RKLsXn8Ix(vMCSLlGtg!6Kyb#6S4QV}I{qce_
zt)OM$)f~z?a6JpX`U#10S<5Er7ue>=ENqRwybEJm1=E~3Bt?x`_eUS`e+kn2IqBEY
zRi*}tNdWN&_NZ#ll-CG*l5rwfuD(Q|7?;s8nsc#nf?~`=Y%h+FfS%ZVOIKTbH`qrt
zcSl!idL)fAi#3_{(%|0!6*umRLwMDDwyddmiw~V0`V+8opB5`t5=IRV&H;f}BLwVU
zAK8lTv543z`zh|C_MfXgYS!sqd!r%*Cb`bZcv~OVq|5W-O%QB&aSo6-a`(qsHBU>h
zE-{?QYDf6781)6_qFp;hBM(&^Vtsho*I39>B6?|bXniK*&A%FYfcoh4B}*b8=~_v5
zg2<$_W#w<bPjOoq-eO-EG~a-ucR?N4&jP{rg&eiz|8b#;3rCUSN%C<L)0O6x&gXVR
zrKL#?Vv{u$vqtS_X1$DlA&uK4;@+j|+;V&zA=EnGbED>_3J{Cko&H+!4S!G%HaA`>
zUis_OeTtHt-ETNUGA?TBpCw@mK8IR3mt-Vc^86V{RzkdMjK9|2^`RQO8ccTMS<G^k
za{r(#^l_(ES@Y&wKgNdBTN`P!$&>tR=p3u?xo{b!C|6{c2xyOfsc_@4Z-7dV<9Ua<
zfZ2En>iFmT&;`KLA!JNne6EW~ef7&$)aI#ey`1I~q&m4Ww~kdy_>ifA2;NStWLhdm
zrtO+r$aH#>bS`hQ?xqttHoUrHtmE?z|C0~>3#;rN>=6VidYeM)rJs7m<rwjU)YSyr
z_F7TkwCZ(A&6PkIPksiD^P!nd=!w4vaA|Ht4ztL!1X7>xZ-SL7z6ABvm58@%d;n~X
z2Ju_PQ;<mma^)rG&H7M^r3zMa;}B<?k>`xQR9l*K=m~z{%CN?;lWu(Yn!UetCv_1S
zdcUq6S(;unzvt@%?+?HU9hH#F3AVLZlTGb1$14WZz>J2}8hc}^(|GxR7`$!nEzI@}
zLZBC;#@@EDPltzmGS|Z+r*KieZ=M(BLbGe^!+P>5OmKd$Y-j_yaY1?G`Ft&#u~HLd
zPfXAKA&l6)P7nIdJn_=UAa~$@c1_Ovf<tE&F@CtPiMPfAw9*Xm5`L!#^kXSYLD{(d
z2!0`z*VpeqQubfz>fqFvE9;M`XBuCsV!gk=GFnK7<J`w+#}*Q;IF9>~w0Vp~z9TJG
zOlWwsPNfxT$3c6gu%Kc5$NxTKQotXsUpZ_4bbbDCJQ9x^#;tloMMZf@!P3qnMasF|
zhk6n5yLdl${n4}RV{}wRDG39or0@xIQXy@NaDZ=ejJoH$2_^dAvw^oGIlQmz6ByAe
zG>l{_&bSZrV)1g+WtU}G85k1wsKJ}rrDFI$!i4?fJ{0B}1;>C)r${?1+IiXePqkmR
z?E2HeNx5loQ41A|VdIdQ*~^HO{7Q#E*2en{x^dF)keLcG5rxRu*3(h_KZOk#A{u@#
zXil8bf#cWVJ7VWR&PYaWZEwpm`Tcq5^B~2UXi8ic#Hl4%{B4PT;^>;XoUsKwXy*yT
z;Y$HZzY?ySr{V9DK=p@<M2TbhSf38{=>>LJu_*FxJVUbgXC7l0y?q_Q;{*4<HpyF4
z!ce+yL*%HgBdVSx(@7}U(>Y}RdOVPMikbU`QLMg!)9GewUol(N&%H!#@g%SDRSjiH
z339IX+rF=KNT!_KH0UNqmc)rCqEU2|>W1ypu)Woa2@4s3+9Qf?Je>UY$8d`|Ey}K7
z1i$W|YQ{NLIFXSme1hN$P9i=7y>M%uL)8z_w{#hL5AP9}v@@Q#HCwEy3ln~t6AEOl
z&NvdAlJ?X|o%tp#wJ|lVb5QZmNbvY$fQ@4033HcYkjr80_?B;d*|z`6$<0ype(0)c
zpm7K0Gjch{Qrx=yLH*n$auv<KhqizhXt(s8CX+cm94N4}M$-P%?$E`Y|Kfi#v)#3=
zuyt@SXq;NoWyXVEuw`A<kl(#AA7pO{l6z^>@!MBnUeAlz4|OaR4HvpnoEhJg84F^&
z=Qviv?I4_$<Lfp(9+$+P!@M`j&-8PUB&Ouu)Ds9;5sDPzmqmz1G3So;`7v|-cO#Zo
zvXuL#<mR}tWypW=*3id1Nm_bPq%kk{P(^EisdG=|S8ph`Yd{>;X>UuSo{E!FvdLs-
zzrol+76lPQd6W}iCBGYge1Mm!jwK~Nsl6+khQIB>+%MpI`KU|A6hPWF{4Igc0v!d^
zZ7w@gm_ISwi)t-Vnv#n6p?geZ+-L0hvjGmFP2-wVa$ZZX#byShs1Uz&fIxw^)5;%S
zEgsR6a#i_xIrsyBX4?oGpBI68f%Xhwu@hCN(TQL~NN!C19PBWo;4;*JgqKc8b}7no
zp;sC$U+bTLYsA<DW00krH3dY20iOk>a4#+o3RciBEi2}J9z1P8aSp1s<UOFN7(Q1}
zyYi=cVT18JHZM4Uy0$HyrRK3c9ZgC#UhyXS#<`W)Ix{Ib@(#WdDq=O4zu)NCK703;
za@>PMzon#si(hv^B{SCgmR)J+4j#!+t~eKYt0e~%<t>RV<Sf-VO65sB%t<Tgqv~BU
z2o3<z9gVEJVr@$I<2}_cn5teQTs?c9&7V%Z;dP^-i}P-?MX88z-MqgM46KC~ckQt>
zUcZG5MPDYMdr^Cy?`MDgx#CyuPz)fO`{4k&p}}0PAQ_n|y?QQ7FZ@3l&Y)=K`?YV#
z#sVCFRM|+<+`u;#a4=?#0n|6AjrIx|VV)-F9##!M@j_w3@M8d85q4whla3xACAPG_
z_GR;WH-V3fcp;3RCk;(rQ|7c{i_pB{g66|?8o@<-meJ|0pEpb;3V}omS>chpYkSQ5
zkCIRcizRR}==VkDuFAY6_YK()+cVy`+@QWY1LBbmpVEJ)x^7!}6rZ2n`p&#!j=t-!
z{Jl%zCzZy#vb$2mBqVu2`GoFph6F!Cm&opQ95sToioJGyxr2Tn<yc;*vRzeouRAB7
z_|ps7E*pkfm~&1r7u*sT;>?KuI2zDud<gU&We(Ocs1AtbY2FX}n~JknT~@t6VbK}?
z!@Omf$ZGrgnI;iMit*KRfS!^O42evp^;1bBx*mi0N#V31KOYc$d7uoJ*mZ~{y2SiI
zV_quuxo^L^mJ*=732TAo5Mey%0=#+;Ca=+Z>lCX^=?A5|&l=zdUC}6Q!La$i-^g-@
zFIUVsz7Sc8J`w-9uu!C$9sl@#Hu^gzZptuOq{+w?0vZj*ZB=+$#by*9KKUU-M1QUX
zOKbdaFh@Wprw8onxqshx#^gn%h?9fhi@*@BE9=(UwP#K5CU=%T&c4P$B-D|4+V2`F
zR-&dtrx_c<9=EL16TnkZ9vz;;*CfrdG`sCL&I>L5!54Fn!nDsWk3Iix@1xHOS{L6B
z`bj{^Su;@HNHs=1OdCZ0)kU5cvJb_yE2*%DVk8*H5~sUquTl|(Cin3mu$;Oj`69J|
z2dZ?L?{yE|)A1gjIMFz%2Vkd3etryF#UowBe9Ieqp0EOAZUJiMS+<2oV0)ajWPwuC
zfp*Wh$Dpgfg355`PfgCUrQxu(j=T;^A7Ic6vpAHNbeR}mZJ%r$QzgzJeWuKj)%20z
zD1e`GK@7phN5x_a9UG_zlG^s-aYQk-_i%YfE?-Z;U&@lR{?Oau%pqWBYHK01_G4~(
zpo$EX<za#@OJANRng>1h%TnPzlWPcH<wa^BnP>}2ip7nm<mxL(WACisamm8omdv%k
zSm7eHs@3|%8f8niyhsc2&R`Bc{pa0_4|NyTOS|Oypl4Y^cQyz?c`_4RU`mx0i>@&l
zdze&RFUytCM=5j1xm(SBnAo+(pR4)iy>DYdTj6J!8={Y9CYtpOWSTfqzhIBUA02i~
z->zAbQ{C6dbyBgb`LqOoHKJ+#mX2)+g3U^Qr)fCpRl!({?G`y_C$lNF(^mIgxM1dT
zR%-jW3l62#T8y1z(OjKE&fwYJyE0kpQQeAu1G)2gI3Dh259Zki*B*zE5+V#&7v&38
z<i_G)@IJ-V_>w2hT<^hr&_c`FY5Jh>d`ev+1=m)X;)(;J<lu5OEOHmScpEhx`on$m
zG{WKOVctI7->@x*R+0tDj-0F7;p=_)cqmukm9DK|eeAtRQEBcKun!Br?+-RwC&}L1
z5a$%-|IpufwK##cH8cj9cR2Wk8xF%Ibf0YOn+)FoONPGA#Vm_KnJqR2o}#XDAF_a5
zz@o25oel#;DQ%dn3tsOflHtdoDaF@T?;!U5Y#)eaoQbG4ek77AO285W47I9d>C`>7
zuSZ^Y8QIGP|HrKRR>8PJB{Ln6;xfGUy?=w4yXUAkoM4mntIM`0;uU14!EbXf3klB}
zTe`{5y9azfns9VW*GVmhv*nuaB5Qb+Qy-NstTFlr2M23sc?3`omaoG%T0Ie;MfwF^
zV51^m(_Ez5HN<K>oI$^{fb5l)<)uv>Ga2g`T3W4}T{!)wo2aZQ*9`C;pcMbm6o2-e
z3+*RKGjZ8EKPL;@?9DB=nx#b->)^LGCL9#^c9Ajb|7pP3SYQ;H+BxC%9y5Cua@kYv
zua_hT;oNd5%Nvn<SuZ4EinKQ+TL+|=QJrcG4Ph(QZKMoW#`F>8Z|wjwnmY|R`zw!o
zD!H=HY8sQ>NkHMCgJ<}RhxUc1ckom%a?wf?ug^JpLunbviSM%c*eTt&aaAQu6u)10
z&@E9WGNIc(<3mX>(>8O_wsy4dyWVBtYQ@<*{`Y9#Q}5L33b(9Z=fgt!_|Wzl7tc0F
z$7u;kNl8PIDEu<&n%}>JOO|CAWw9Gfxf6?VH*5<{NGSJ9`w}%28&MxtQH=fA__?rc
zR%)N`s2VfBMe|tnCGPpZ0}+Q(<)I{s^YFX7M|x*ki`(E$cSreNA!%FloSMsdu^&T8
z`{Brg`g0&C1ewTW)RA;I?=wSeph9c5zJI05T?6y;@fC?qmib&NMGs>R&pOa>{;G!P
z6k$ZO-{2?FxB9wF7-dS7*a|9f!)1<bMN6ZZIV(~%d{lp_3D{Z{;feE=*5W-9%TG=d
zQJ0;l_C4UKXCWDjPtG5{bg5OL>jcOizO(2-l>r4v-Lx%=z#>S_;KY!~Cn}4hvoXw)
zcd{>-M+-+m=6NK)ndy0!vN6?X3C8rm^o)avfO|f2b_W2-*)l3m?M}-jID0Kst~*=*
z3es*l!JjA9ZO*9@RmXd}z3_+c+UgX;y@!cKBF7}`Rc{C#>b^H%qQ)=Bv+*Bgh57n~
z=B+wjV-g3<2Z$^me<RSL0t_dXZ*+sL#FVg>9Lg3I@A3c5Bjr`C)TA`zU#ZI)ntI-t
zIe(vXR9_$o+b;sSPc6gASlDbK10?C+-<<8yL68Raiwk%5=aH<Ek9`~(1DL~Tw)f*+
z2Cd>FYsUM=apzJECKcviwUS*}^dSpEiln$a+LwceccM3+jb3*V4$94Qqs6b1c99-p
z(iVt0{V)_<$b;uNAZAb-SwGk~4;C1&&RQstR;ius=NtogSzT*^?|>DwmzaM0HtLCi
zc(34fQ$GczBb-U+45OzhFmyh}Nj5Wb$RQo;Az20u8W)nxV~5h<;<-aLTUKvKdo=0}
zUbVeKvCsV5Sl{+O7NjBOOG0k=(>yS1Q(WfAoc0_A(vCpcFKH}|X2wbpw{lqSa1Gc%
z3Ha$u4EM`pQ?r@^hJWlzfVj7eHB(U%ioiHD*&wEy)AN(|GYPN*L(QLqC0eHw0>AFo
z2&ixA)q|rbyn0IPecz4kUo<txYSm*!tT#kZtL1}t+eg5l`K=k>`*D<jS-xezK)cWS
z$S+IQ8`u2ws=)}fe){9P`gJE2K7Z|p-ts>U^#-8K^nYTp&>VQb6lYhZkY#Iw?rge5
zTRq27|0lz<;$wXdMLjIT52>s-0^swogBf%Xy|xIm*`JRZ&sgnVYEQE<JM`~!px)hv
zt@f|&X<ad+C9gJCHMWRaMG^{y>M-HQ@Z>kyVH!P28n8iwc{h1b1~OrB)fEy_J$8Vp
z;NF$gQE-s`n?kY*^6o(|n`Y>v@2@u{VAD#ah>FgMj=-aN6ff<!AW*++e$=cTrD2LM
zQ#zjQ$BjE!9Li0;Bm@{z^g$K8bTXOesxFLd{KRv$=B(i2w^u<t%HYttHT6RJ>f63~
z)aBc4zEE{IHm+Ql#eqU>edJDNN9CaK)%%;~wLSb)Sr)^HCk%HOU+6y*p6B?vz1Poi
zI-&TK*yMV{VEKViGR`*+;xWQm+xyW!yey(jA`2BeE2P-|p442dGd*=0irRdMbo;><
zXX<?~M_oL=`v+IV%SvMW*|OD57%RQp(#OwD@h+t+kIjP?<e@6V$QYYUN?*1Y?2m>M
zrD<@uVfd-n<-)!R!FV#c!Y{K<xl&9HBLdEVNt64!Hf-e!fsrVkn+8Cun*)&ZcjvZD
z9oHEdcAxleQxUa;<~fhc8{m7r;I`d^WUHrsskxsG^E^M{hI!y51}6_=`Moa}P`LoD
zl^a*;$r+<eDbwz_BX53G8HvUFGV|K+I1&Z+CNpo@^9HgjZU*!l19}u`J_{=-!)UuA
zH-4I>4pPui_t4#Es&Bw3x?+%Pp4p}IXMFQvhiJ1|^#J~tNi;X1?`IAw>-0k;ZfeaP
zL;n8MVjV<`hf6%3g$L+cxIa@()pyP%R|<bHa6g)xnq@kN$gcYqTlV+IiuQXA?QH(=
zU*#&a3L8HQ5PZAMiF<A`YHdjRFs>IcKa1rch@NG&e+PH!LG!Wf@Xo65XV&Fs*Uj?^
ze|@d$O9r1so}|4`#l)Z_(N8dWLwjcYca}pJW|n-_F%`QdHz_`IKQykBJhYLlEQ3DC
z9yqr`%yM(DL)6PNrZ5MuB<(O?9-5fT+T<vfApXhW?@!46-Oj3rka<R_xjq<plu56~
z^IEZi%xvG05Jyv3Np?b11ljJ6C{Nt<D6DSl)%>bjfLq45w@0Fl1DSsOg1uT@voV@N
zdppb7-P(Qevx|M$h8B$?GDf+&A~@smHesjJ^n*1>Dnw=yZ9Ms>Xc8{je8c2FTN2CC
zToJ)cJ*Hfol+xMEhjXYx9m6R4J=E1#)cp0WS0snL#jjI;RQ&HJ9PbDF^9k3VuC|2}
zMr$?hGfq-?%PqA;`+2}RcNaV7VqEh9-$>mZ2R!q7>C#vCzQ`DdUf3gf)%`>gBprTH
za^yA0OnMW3ZzP-*#xPJy9-Q5meyq&eY=p|Y#!y~jhObFm>>{Z8Y~c$s$k5Wg=u3-T
zbZkkDxS-~){z_}H@So$k=0sW{38+Vp!hjp6{U=>zrC0();|XR`w6CljXp>kYUkza4
zlC&(Ju+r$^xfAVI&)>)LE&;=Sh;M9nIK9t;g!6jej5V7W*aaRu4=si%CdLrXRUa#K
z)sOeNb1O2|4L)BGJS9sV4y`%vT-)B?%bvq+MuHTCn!VW6_2#rIi>$7U5Pbp+ncKN8
z<+V+wDn?(JTy+}fTcTt6$NoDHi>(ewa)Uka^X^#a*!3uF$UOPXb;g4$HA8QdZLkl4
z@UoEG3bPd{(oRe-ERYCMni<@i04N#rd+NX-wi%+U<2nbJKGZEQc>cmxsj-frYc6HR
z);BDOmKVTdDWLMs6f2zerCX<2W`NhS<WMN@B#J1Uh&K=59BV;95p;U_R)4X%yqH0T
z^?PDZU>Pn+JL?!28o}FnsXrOK?koTQc=`&cs=DWGML;CvA`JrGOLq#=5?5LzrMtTY
zDM7kB6{I_*J0+z{x<jO;<9-|8-~U^SwOmUM=j@o7Ju`dedCUsi{QIMGlg9QGpB>HV
z2}HVd*iIJ)3y|A0J);j^S)!$iov}|ZolXfpxb6RzA^)D{32lLoEp~@{lV<oJZgy6d
zpvd)R4_&Em>Dei}i9VwBW+@qc(&IxVyGH%q4nnSu<pwdnMnb-3NBWB3qLrtmB<^g<
z4`<cF8&Xqr=TRA)FH%#@jD}Jg7KK;ui!q=1ES^G7e0KE5gTA80efJildNJ|xi<cxM
z+3%ODg{Fsh_{e5t{Sc*dlk4X%vEB*?O5CQd+#%1gG5pxxI<4QQ5Q;pYPrB{-aMZkB
zBN#2;?U+8flszYZgLTe-Sijz)%16G!j&)axOX@twAoTm(dFk)L#c<N$#pQ6kR!`qj
z{&jX_1FMLU&$Zy)ml4SlTuHQiE4E(0I4Q9&VIsU`Lmb&m!9K4wIZzfZ@VY?k+^*H4
z&8Ucil!#m7@pAGa4O;f~#b<Se^qB1~(w8xjO|26Em=xo;+e3Rx5RcJy@7>hItR^gq
zd3@Awm&K}${N3(<O#qvM1c%{ub0EE!Fymk)+f2V3MqCPClY9Oh{UR(>QMW;1twyhq
zwpIPnh{Hf8eJu$S8@mTaL=fc37JFW1k6_-uoetHUy3YNzjEFv$ALE!QxO6%t&1E%7
z5Z{z~Zoe^y$@BIox}T_wNLb`R2=^?u^N#r%p>m3#B(tSPyuE1VXoW5=tsgv%RC%Q{
zG5t|CcI_piW%gU$k;S1mVe6Uq(&c-kub;3(rn<JUd+5c1eksI!r~V<aJTr!_s_+Wp
zgGRv3(%?t6B=)EZT)O*uv0hwrYbAPMihXi2(G*MQ+*%PbEBx{%hx)9DYPe}k=&`hS
z-(5iZs3&VJ7BwDbY){F&d+c6f3(Gn2?aw}IYJ^RW=U21a0NkRK`W|!=LQ+f)sLMQ;
z*Vlr@z?`M>u$yeZ0y2H+$H=7s@U$yFzbYz-5L`{vOYVs|(=BnEA(x#_CTN9ZkmPsD
z421Hdl;jsK68>i0pcH;7-50EBhS9%wt-McKQ{`)5#X;d}2Py~S5_uL4|Fro$dM~nk
zwSw(^@y)4_!gnc&jAuHq96xoyJ%jOVP85%{kb0Fj?9_8Z^8H7xpWt5_+B5y;=jQ^7
zAR@EPn53HtHc15V9wE$EP8s2^^7_lHxbYe|LTfBn7&!M+@#admk-_cD+BF*%uyr7)
z(CrT&{ad%YHQ<TriI1P%Z_QXQj4OyrOl>@;^u{_Gg04kO3w4S=eTTk;4QG?f8j)m+
zeWmMb#*Ul6t+48zQIO3%o<xmkaTl(@mTKSdLoJtGpM8>_mN>I%v^3iKp~DO1I{R9w
zG`eKwkOmPU{7QkSq2zk+oTu<mGqa052qF9z!CBF|!ksC-JM%iq;%HPuQcT^nPzLT}
zxh+>|m2mP$L5zml{<ij#Aw+F@zw>sEkV)-ZJf3#f6exYZ2CSuXaENbR&gxV0wd3Vz
z*5>f;)V@Y#!Ej~Y*0_{DOKBKGQGmfyZjz5S@bM_$MA<%ZbvHCEN!t-T`04UkVKnTb
zd8H2!RqWs2)_0}uG;;i{Jh0cuEhBn@&2pZKQ*Z3i4II}2_EEf_Gg`XhCC|g$!{tYn
z5$tGQ4)Y5~<8k8nS59M+-VwG$Zt~P!vcK|nX@K+xihEBgZ(qOpgP6`iq(4V=;{X-s
zX=i67e)NM;{;z)O;VbIlV29R)IO0eWQ6xG$98t97XEkSB;z8;RR%C411gk@Ns{Qy1
z1!SDrFuRPwkBvOFa3kEzuX@}EidW+6q8b$BIJbUsYHp=-)d04R?Zf^&QXvw_0js|m
zHIBn^3z0vrLkFIKoK)AFXPoP_3%{y-3WOB#j<iB^Uif0*`@p~aJ_POc$9zM=h@0{K
zR)iOt@*X86<=f?BP%i<~sW)RgUFs0Bm`Ly@OX=Tgs#5{P757eQ#k*GKAWcxh7UAFi
z?hj+EP=@y~L{z$BO-Q?pV=|A`CT_!}2I>b9?H|=ggZf1=JQ;(~a)x8?@W_e@&|AHO
z5@yE8&xv)n&?OFJ^hd#~>BY66m3?^rB$Tl5>-{ghj;qOL3pAN=5#)jvo)ZbDqgwv^
z`!<O&LC%MB96mVwErHU(4C}AWzE2HZ{3(c34Hc!-z&Wzob~`Sy^|Uks1jl;-Q9p2p
z-vtAffP;e(aIqrv!`xrt9XmUu?ihAf?*tFhlpLLJ_4d9Y`}O#PfbvWS>PugY*W2S&
z=tE4nip1$3>xNVh#{JK^R~(POdUgJVi=siFyvmUTW$}u+NdXs9N?}tZT<b=`NW#z1
z7^oHG4s!vymCq7Ee_>Wgre-luA_X~lgm^Ey5>{1Z2Cm+HbA=|P)~L}RkZ)<6&M9(U
zetQMK(dK`&QTK8I>5ei;Q7i;jh*+(K?Y&Dld*NFohurj(f1h_#p#Fy4@*I|U_Q9$3
z>$k1jn&aQXCLz&QEO6XO=&9?Ug+{`jtYt=*ddV6G6;sNO);JD|uIZ&kvZvAQsd5$Q
ztm6w$pnmU`VW3khnLZnOHgJsJ$<?((!&1=FPI&QYv?-;mGZo$BBxsd{gv22pAO6iA
zmWU`lS>#yrB7sz|ZWn{a-_42xtZ}~J$_c-)IOW#YZ)evDgKt*Yp5_E_63d-J?Si-0
z3*U5nmhr++WaE!&38G_Rb%5X17F7tr8s-l^nFUHRmpli3WSlHEycHOuc89+du{rRs
zm)rfx#EkRWZe|J}?D(^wYx#Xa{<{MP%Ypw-C+L05gMLbEOXci}E1REeG*f0XWGb$L
zQrTI+QanSmDo>TE;#U{~L*k8==wgf8b}^U$3F~4sJyaZN*Jc2nKzkG9s=UhTKfxa)
zqpx8g2#cpVULHeZ!KsN#`vq;yS-1|b4+&wL=&69PONXBt`e1-;LfwX+z~vX*8a*0N
zap_QeTq%fub1Zr5_h9qqDTYQrSx<Lj1?$Bv^Bojj(@&O>c4d5Wcw1i-%^bvdK#}b)
zh#dzL%DAg@po_g`CCStZQoSk!c=p{-cwhohK^y~l<fF$5S`cq8ZJZ^X3RK_3)8U`K
zC>ZmO;qSmEaKLQTOX7n53g8UQr*jKAFhZ>+;mgO=$?sl{Jps^D9lP*Q0x0wMg**e8
zfeeLAW^MU5gX|y;jSTcm0`8J%iy>KZ-$d02JRdghSZqcKgWB~v!l<<1wMdKL(O{J}
zG$`k%bXSo%fB=@rVfKSo2Ng72MkRcr0o{CK9mt;pGz8?Yu*M;~(v?;`nFV@>Pgfq}
zsOkZxZWB8@h>pVB<=JNU+E5KqXE;t3EJ*$0xkr{b6Gzb74oh9?QQ``*KMJiSY!(9t
zV!`<;W&NLKu(J(A>hP~k`z$e{pI#$<_iQEiRas{guQ9jCydhukCbXtLAbiLB?8h~r
z&4#ZhfS;7zPTK)n44OL@hXK59<`07+$!nqjsD`+!_GM~?^3M3AVF-N$TSd>gje#FK
z)XylLTMP}Fz457>8pEXHLyCb);UYteOCwW}QPd}Y1x@ESSt-i0IPKlRnlOj@X~|~X
zm2UX+;5uXdkcc?3Anu0OO+G$N9?umthrFeWkU)p6%W^FW&LC+YKcqRwyOvzzsd(1A
z*Poa0#~wjf`wkp-U(ARsivs@8j>I>H#Ja>d^g(y*fzB{1(6H+tCw}Rr<0l|)z3~+E
z%X5j-+O5>BxW1n6sIm8WR8jT-yQ(cz77G;9W(&2MV(di;2)<89ExhRGQ@>hYoZRYW
z2j+&@9{@r4RY4@h;x@S58kX=p<!EH!enBY0u{Ol-nj$!t!#gG3!WnWelzC~Zf-cs`
zaXe9g5)jimLA#$8xTuLY1<S32+IP-;G|=%xSYPdV?SjT<a}9BLJMW**Vh|Bx2AS+I
zqYrYu&~{}p_=;Qilw4pNHe_TkN{Gy&4JkqK0eJ7Mw5#os<f{oxyslBsA3pGlU@GXp
zdOIU@M+2)Z*S;yyqkyrV5r=31UTfvIamHT-1PAc^OWUPd#ux`^>b*XQZXe(2fWv?T
z+1=C+5@YW{vdX8fV`(8H=GUq!Oj(^0(kr0|*Vz$`7nx4T%7l?eQV2&l35oO9Pake}
zWCf|K5lXo4phjOkwx!R02y?(NcnXU%3iilWTtN9c@)^VHy=%nnNx+G<WT&#2XSU%-
zR+g>Kjn;!giPfEGN{O%_4f`(qLMj*s21r5hD%J#tM59pPm~?<1km@SY%q7-bs%K-M
ztE<GqvtgtL%Hc-o*?<P6B4zUp1%sA`VI84z)`J8eZAySEe|Jf4m$_yN18t`K!;T5S
z4xxv6kXgRY$<q9Eb2~`GmxpkS5NZYGc#<A{P=~Tgz#Y>6DJ20-1Y>Ths_UZ!<H~_~
zcQ2bSMzjTFM|^&4qD{?C)L2s7M5L`F3r&+(PR!2-0B(S$KSxm4=DM%QO~|VACu~EG
z-M8dhM|$MEV#aVuXO{fe>^it)?CLln&giMC(wF>Xw68ZJ;?p#`X8sT$IY5h<F1Wgc
zGzG7Xe=SosOFFI<QWp9&1hH7F$=Y`mY7^oVy%W!+yd+{eGW~o|yHn$Qoh!1v)RVO&
ze4Z-4{2R|_cOoq<O&xFser*N?!o0_e^WcInZE;~iP`9gy1?Q~6So<9K0tCI3fVb(8
z*n?mR$9|W~>e1XYoIO0I3sTqxbtJ}FCvuNJB<5LE09ve@reLJnl@pGrq=h~{I8FN=
z&_)N;MYm`abX*mBMq`&c6gV!j%20+!^>4u<?>hkfVB)SjsCsX)x$sBBFx30ZN&?<6
zTrLqx6hil&nJ4LgG-gTUWE)#*cIO$x*UzK~4)V`2Qo65m$o+e`*I{`XaYFlfiJ;~&
zf?XWsJ}`UW1mSv)OFWC-gAh?ge|bT_r72XmrXjq!-n1tz4iWTMPS7jjyVzS<T`Iq*
zzir8q07Zkn#w^A?p5A4?D7a0uA3Er2n^zwHv8pihh(2_`n$S;L2rYwA_7p=ni{6zx
zKVnAQ;O)A1`pK#<HlaAnMOb)Pm^f%GQvl5#fQi%^HyT4UEwu6(bRcNixak`{V7Dhy
zp@arN!`a{3cd;K8r0k!=;G6<3hx5n26y40C9HQYu+IrtJ<bfr)-&xK_<B;GZdXHQ>
zr|trO$r1o}CUa5GhR=S~V19T#PQa96^NW6fUh;jML}Ddf<agub&l6%y$Il0zw+>D@
ziF-T_&80F(4OW(y3tgvr0VRI3&st<@CBdWqZ)cP`he)A**?upuaBwuYlrO8jfTIww
zLivZg?|3RX<+gSW|M41K@uAyswd$k4yH?Fu>y{{u`2i<E;&Y%m$h`%mT+INu<9<Eb
zduxE=r%F!g7A8LEumnekkyrat$(~1h1;vRI^;u3z-fC)4<FHXj$B7L|;QgtS8j6&_
z>O;O0YHr7yo3bF{>UMGd{@<Malp~#5hTFgOOX#bRmN-+km`Zk*!yVVY-XV<gD8zqK
zDbQIYqmOEMEh)0M<L|pejPX-9JDqgM`6sD#C>uKHnB6?3&0rKHeb>|xR-CltVxk5f
z$nwplri!LFg6?8=OKF%M`x<E&Ky3v6X?+TwrmX)bc}d%NU1Bb{cL}Mn$>k>~RwuUW
zm25%Jz&EC?V?-`@Q~pL~5u|S;tL}@sP-eXzCiX-s#;Ce$_|~!dxt1T>=OE^!gEjY{
z*<;k3j9)ER$qFklTF^9%M`;!>qOLlcNT2#oA@23n!9g;wK_=m}=E{tD#B>K^jB94B
zw<HQHV8ZW>3INPIjn)ck8*_Hur>tD<Wzpu+U<{i%9-gyW7B*>$OonD7303B4A<IXC
zJm%E?2RG6=L*R=%w+?`aN_HN7HFItJ!v$xJ>Kk0fLGgRGY1$Wd#PHGT<>Q(pf|Rg%
zq@-U<dXjQxT==kJQSagr9!A%aNyq|BR5iGVpazQfj$WZPFP`?4KOhSIV)uigfpa92
zCtiIe#;j^p#qnRjUl)}YHks@C_D@we9os+qBdYP4e(>qq_i1%iF)Kc+QN|Lj^#xS1
z+_2}ZGog&d$OS6c11jO-aS5mRM4j8Lnj|IN`OJ!(3DH{2;mmKgbxbW!b~J`hKL4|3
zM$ZPgx(4;>Z6;At*?!8Sy{|~Z57D53bXgUw2tk!P6xU(7+vCPXgbi&pX_Wu;gbG(J
zJ;2PeC?LoOFRMC*NXEWsf93_r0P1SIlyU@@NVe)>N>uC*@R#IEHA^N%dBYAJA^$#>
zjkD8RS|ckqNOkP(6rWQ!X=kM{g6_{MYVurDeSNjL5v8L0Z}-odk1iVbI&&Z2nDlU9
zv7gLj)~Q4|2SCQ2^`3eeCcC#$Ccxeg7=((xXWj|Dc%Iqlj`^QF|MV>pQ~_QseV5`q
z%+J;8GM_9&%TGxAzkzGd7*rAPRd`OG>o1s2+dqgCVghzR5=kaHRQ40|Td&EOmKoXs
z3*hU3=OqQptMj0%j;T!J5T($YC2h?Wgv(dpG;rY~hY5)V^+a4dsm$5V^qu{8E({XY
zyuzI`EebRbB5ot-9&|v|HUk+6Yn1;RUoUUP;fH*my|J#mw}AJnK^w~a#!}nVQeMm`
zL<F@wzPrQ`Ov2Se^GGuJ8U@axNT7+=KwdHVy-#r)xa{CBstxiI0)h%PngfiGWb8vB
zijNXtgvm%Q7DC#)|C>LqesX{$;EEOPohXlomy%*aarJsU8(e08w{59af#HCug&FpY
zLoB86x4(x?^;6X})m4vkyaWLZN{iet^-ZD5MF_`}g#RsBwyFoML$fgn>_{y{6ExYk
z)w1$4!&w}j&18;DniiSH8fOFl5G>ZN9+=3yd2&FK+x?pMav9J&M4NYv<$;49e3R}z
z$CFo*CNyAHlF&wA+8q0*3a=I{f=^B_JQs)GIlYwpzhxf_XCC^vc>gw|An(xEV457U
zY9U%iDHYvP{Qr}RDx~{Zo@lVsEX_QK*)Qk5o%G*YK>tj5G<*aOH~6Tz&L3A2gX&R@
zDGsa(>Z7gxT#l{IxA*JD@#y}AsL?0e&t=kC?uQrUWC)g4a{Pjzo1nWyqW=qFB*1d^
z8>GSw(t1xUn)~qop8Km02G(Vo95B-{6Wq<5MhH5Ydk844`{jB8!0UKO$<I8Dt#uli
zjDOS47E;TF#?Twwcj%-b11X!p`M(!!wi9GkbF1I~TJPVlG4Fp(%%9ex#%xA84M3*A
zBpe)OjyPsKUpoCbynm8N^Vdmk<kk~_nlW<>Bh*PZL`#NxG`eQx{C9-)4&DohYpU@p
zK`A}PP|Z}Z5L^#+UX|n3OH!6sUpo27C5Zkz?0UOq3`kb3UpiGL1xPad8=s;t*a?!b
zFP25j_dXg}!Q6=d6HqN{w1Q9ft1LwfB+eYkYEMX;|9_8-_0P<XL#jQT%b-R`R>t<b
zZ@@mvg)y@_tawcsq7_iKFfZr<i_?&>1ps|Ow=1fqtk|FLlbu}RiZ5#_>#Ey<^q?PF
z>+l|Z>w%0tVEW(JLuLx{pl2kah5t0!=zjIMpfzVw(gY9gwLy~m(6{rWrY6a1_#ez@
zjcCWs=l5G117(7<jAj4N_Ghb<%ZgDscY!^1fc-`V1Eaq;OJH>9+S9*gJsPG?Zm92H
zrexS7w?<JhIc`c^0)P8Yxnk_Wn_`guH=G!krZ&6JC4yMd#>0J5z+B>pY9NPbQ8CXL
z;32GQK3*}=@`FqOz*)1}GY^Wq-*$7+p{$~R_60+qF;vUyz0|n=&N%#D+Dv{#<Uv(Q
zOHi(uOgDk5gs!UcPJu1&W2+&0_!Svf5^R{#|F>=&k3Rm>?p`Ou&{2)*T&RuSmY*z7
z!hOp|cg04Q0i8p1ZqNTTExcnYEg)!Er{^tq@{{|oquB#tr|Q1AGX|#8v$B{Q%omsv
zJzytNAiS-mC3gEIoM7O-$`G_GOelT(KeM(q-{+Ek|6r^^=y&tf`$>Iarr``>MlanM
zYSjTN$sEQ^VcgsYiGkhg9FSzzXW(%valXez%;ONLSOXw{TSPz&?XB2<Uqy4AOMzj;
z1G8}&RFd{TIUH-aUnsnP3ecN<KhDqhHu8Qv;197pOjl}1_%Og0Vzu9!^Qgj#|7;rl
z4=~8Rs!5;W62ql<@ND0UmhsTI4&an~{&^ntMj!BL@iQwyK+FnjX<ky_ysKY?#5nx7
zmr+yQV2SFMJ|F`_fz|Qv#q?|NPhXAqv%tEWl*2QMhE<1Y2GH#8C*%n<#XuJ;TnJ1`
z>A#Um83Nlz(0;$-tHFbqlsu7=<tvT?{R4!3V~jG9-fuNxA5}h&+fZO~@WKq(3QptC
z=4*OY{Wf7bW%X1A>$cJ=&TzpN&77^qETD;{;^Vsnl{#UtR8W;QTGT7qidM2pk^KTv
zEGThD`T?ntTRiX47uKF{Om$DMe)YWYlSS)#!fMn#Y|XA>@wr6EG^L8%vxdm#xxb97
z4zU9`4$OmiG{CyjbPy;#j`>p+cE5D=hQxhv4NMS`0b60D;RDG)g4Z&mYfe6GdGgB~
zSCsHALn@?6gKU6HJO<~V+$6K#t5W8_D+dx$NlU{4iCOWitgJ1KH&)T~igbA7@qyos
zo(xwc5Y+u~ec2^p@hZ+UA^fGe=*?wQ!60wr_`jt!?*tmh9QI{v>z`5<w$s3@!U$hj
zDX^PP5b&zI%&xw!&B>~_s?cv~=fH|KLe|8q?SE1od4JwOIQC}xVbdxBQ3P$ek5a9z
zcS3h(SfSY{<+LBIb{cB5Sk6^tdjD3O%v2Z#ty}O$58UtUICu>guZw|w=oSlLV};bb
z(pR;q3<HLX-pX1?yUv7L9bMbcDD9OsW+W-Ml^H+43g8&%W#+j3Bj9?tjKn)VYek$f
zV1&kRL()2~DxYp#MIiMMs9WEIJAwTt1Zj;_FM+K3b^V*rCoE8c<I`rmQx7)@63wvV
zA7aPNW}H3hZJ+p`y23PepNmPNm*dq+zA5j1sL)FzCK&>3G8)jeJXTeVD;98iXPYO*
z(CIZNLEs|<A;Ua2^Jw;r{aYu~wbj+yw!q9sPzc{Oem5Q7Pdxbvs7hP(<_lhVv8>ih
z5!bxJK#rYWWN1CkXX5FrRQEb~c>lHT@;f2*kI!sR2afsD2B_pNMC9l!R=jRh!N(7A
zjp|qfaWU%%%VJJ06~rVlR<9YS`;IjLnn}*{&p<wNbW2l3#H8DZ<a#XbDtcNc4J8?U
zxlQbHuWrdUsiI=X1y^Oe#Q?$?)#{WcCX}<c01%fof3aLzZ1LoO+x9M7uEoZ}qpH6;
zcjl8SY5f@Mz?=H@D=a9z0h0YL4R89t1J3y|EMY!<$y&Nw<FC|}ksuJa7}sd@+mqcJ
zBUG9UcbW_IMaO9ftWCC}Ovp?FlhkO!&o`mz&vA4{*=Z&p<=K-VLNqOsD*N;=jQqD(
zSEwa3iU*XnFN|f810w*`Tdlh2@3zCk!-M|%>3t;wrHyXmytIJcAD^<HY1Ugzn}|tD
zSI8<*5oZow7T;oPynq<YzpR`c%PWF$kD&SHOvTBM&01A<JLVc`*;+C&Oq=As{+7$@
zQ`FkpY7J1CtdShgq_nsH{Q08|@OtJzt1u;n2%5Aaek#^3=^Ldmg8~|hB3**P!Zhku
z%SYq2k|Y)XR54d#zbADAnru)MtpyCu0OfS=US)Aio@uf{SD#TaXZNmY-p_pbM652R
zuy&^-TS}P?9QAzcC<}GdkS$CY4SU-3A12KKqE;H80o2Ryci1VQ8%aD6n<4^WlxCit
zonc@>ogZw?0>C9o990~V?J0FzZrxhD9}MMdlaTX)fjL=ca?RV^ZBL(#H|UyFC7_<%
zGX|U{eq4mW->Lm&Km1%&gCv{$N(j@B<-!K*?QuN0I=5TK?rgD^47Vhul4l!ho#{N|
z09HUjP_~QRklvpgR)EN&p=T{nT*jADw24*<P!KzikWtaF06|o(I~Y)ANy#4meV2M*
zUC1gbox}2@`V^S&0KqsUy3|)|70cw9R6v}GD`r7w<~NUDcG8nBX076XVj>qvSkFzP
zdY)uJB^?R%d(|}JkBNb%4GDNmdnp~s#M57?q*Ng*EfrRs`P$D;AwBmhQ{7M5VBsD$
zwk+(t(Zf$=Qny%r**6G+&n}7mx$Q-yH5nP1vYFIE)QRogJrUz~(3*{k;8Cghdt)Vu
zoESN!L6{9K<($lcW-17Tng>xa%ED}{*}$=sLg1aA+Y6VBe@%2IN~lP5T?7(~pcW27
z_RCVyPmbu5`wH|JhJ58EYfdxn`$e$~61|H`w)S{;Pdr-d<r6J0LsfYraoga+sTz>`
z;dU#VgD6S>hQ|@+EuBU}b;IbQl#%Wo@o|V8y9S1WX0wXNo(m^1YRMf0edsPt>mKr}
z%=eZt<{6y>jv{|=TmERCWwlg+d}6J?ea9mX^YznH2o)xD98F*m!@tA1cV^6a{A(uB
zwOgk<MkGj=jLyucX|g1y#^?(|m2v=x1AqFk1n3;~xSlG}%mVFFtIxx3S4>FKL3k%{
zQ_Y<;I|kA10jI)CI^gt3x_s+}_fAM&IA!QfEK}+3u!D=K-PF@7={L3y(XgkrKahEC
zeH81(d;yz2y$8M+_Ko`e-h4(+-7-@{Zc|3*V79u*b7w3kItUYBH&NPcr3qnArxJr=
z7;UiRXR1flUg|H*oH@Zs5dV5!8ol{GN}$RC&b85R*NojCB%Tf2Ni=_V(EX7;pW0&#
z+;4I-)M#^?5A<%AO8iJ5tpBSO7QWSq{hnFcA0O}G7;XjmsHVTD2&E}n0qNa*=o<-%
zIn`n{9P5P!6~Veer&vibah0e=sTL%h-B=R=tRojO$u}9m*@gb{hY><)<va3<QtaFB
zH~A{1J#PTOvW>DpNUpB0=Rnca$JyE0MFX^C5s+70I=(w^_4b*4mTaJ3Ul(F}@k@iU
zjtf4TJh0_ZkA~Fg^XM_89qto4fsa#@>3MxtO({2;{wI2PSa3x=odKlmTnQMu*}=@o
z>V--<{!M&b7Uobff(KPu^=!~FEj-`({qpD9IKF1P-XJy7d#4}7rdpOD_F;AZHE@S1
zqUwuLI`%EWC_#S`>Af1gK4?GL1T75U(h;ivcALX*0!Q5LXDW~UI9^sf<9oggOFr4n
zyrh7-5c8ny_`}sH6UWTDQ`LXs#eCy=8yh?+7yy>wW$fWjA-AV}EMbF9zUg11S2eSB
z_J*2KG^o)l;B4mm<S2(+TC=#QbGkV7w=1RsA$4gYGST4xfKEXho^#LE;2Y4$9lneL
z02H~u8+3>4a3pz`6bNEfEJ4O#$g8T)g8s!SQG-6)PL2i>!7@sDK*jc4Gb|lJif%d?
z)%Oz;GJ(~vN@EdC&A9<!O<oUGzkkl_kd2k>S56~}r*9^g4SO#~uC-$M)4S{ACFNi6
z-NyyNui62$nxW52Cg{f)4`bhR5bbD?+|O^U;UXUwoZ+&ZPtr?+#|V$=MU);RVYL+|
zed4+YZmZS?^^j$N{QC(nViU33dbg|o>RepUT1ilPSmx)eVtTkjYc}f1J=6#e7pTjD
zb0tEv(}LQJ*XKh4k>G(&ry2Rq_wg<hCA><}`|BR5P|9-;S7s}g6M}oE+#H7nQV%eG
zqGCI)fxiossE@tpjS?-A?%K=&k+}g#4qJ<5umTLXdvF1FyM3r5#<Is>a;=(8G?wnI
z`LqX0cv8)yj-{Z?R4^pO5>on#%=HL;C-BOZ1$?Y%jWKvJNiE#c2>;*Lm~S3530IJG
zyKw^$Pbu6Br>~Yj#tE-?@takA%#4hvd<l=iZ9hn&I3s5=aD4*6S+&q@X=Il0<&>1i
zgcB8~yVLx^vfRJ9odA{xVfW<Jn}>-LiDzdnoB{%2jw3mY0NqM-DW#Mlgs9h&WHk#o
zY!B&aT1Gl(bkj&oazSeW^(X|t7B~QYQL4z3%Q2qW&cFdm7J3G*wK<)s*b*gj!$Ma9
zJ%!mgOc#ih?}-g4tJ!<?SYKs*SSm0A!7pnq{;K}^`dUt2UcL(OQ|Fs)F1LRM$2Zo)
zoeG#kGC+Z0!YO3<)({w~ARrYTN*|Psf288}POyqrZ9#K0i@`<##ClN#D4x{jJj;ZB
zE^A+wnS-=k5hVZ=+nUS5qf);Um2s_@TYTuA%Jx~b4`7tsf8k&U5LHH7Jg=7@Z4snr
znuT;CdZ&yy%20J298x19o;Cu?!Sk!C@wc3Q6Qr(oP+zbim&pyBnqBXU6axIBX7gXz
z#DBg&Tp@uJc4F%cgnj<oy5X3)4+Ww0VvkU(qNdy0KH(DU;fRI86m7+o{p%*d$?&X6
zIrcK<r2ID;%a{3#Ui>$9WV{Z308}z#nJO_EIjBqk`$;n2;mq%XRmXcn;n#&6treLx
z=7PMl-~2=3L*I#r(%-$=89fT9s3gAM8UpD18@3A}ubWp)2D1+J&jFULwhwc(K$VD*
zc8iA_xi6zfoh<u|u?5Y^yLw3b%U7?6%I*=?m)pDZi4{NGgIf>rEC21Hgw<g}jS9ag
zZEXF^vpj={J7Cc)qR%Cet55ZfZDj>KfyzBqY<mHFL53;9tacBo&5c?Y_3@E{%8=mJ
zLu?9`HAeT8f|NlF?)*$5^d||luL^h;jTQxUD~*ErDW;3n*K}xM_y9Usp`@*wD;AUT
zYrxl*w%27qbVv>r)B!IRm0;yaP+HVxPk05m%OJ-top4QC^B#KuOB(33@&bp;zO%!P
zZfsl5QSc1F5}o{vVax6tdcQsGM&vx|evFxwwEg~~ek$L2MJ44hRWEr7^m^$W4zx_A
zDVfNljjN&ALnGhmn_Z(V%R?g16eVf1>)Q`03>m{JjEeEir^0~Yn7|dj`v3p~)ZQ1X
ztxN^3AyNwIt}N*G3(&NvZ2`yiCsmm?$Mt1^HB&D@2)2qRITL%@Xx>IrwVvUKM8UJ{
z<&7|{v*@g|;8tnuMr@@O8&$Y6DNfk%DJe)tJo{(|O?o|@{DL|x>f=fl>cR!ZLlyw;
z$77oA>C$IvQJ5L@czvnxF`?|HU~%T_-*1(>$X~s~q!~qH(S=8Y98a}lR<Z!!ZY&q-
z5X~ZXUhSYJ2q!r)hlJJNb>q`)kjk>-UsVTW$6I6_5amcnI^sqmaAeB?hW-Us1VXA=
zq1qWh!|&rL`1c)oPa-8o#ste7h})sihvb%o!|^0NMcN;^+BrKr->V%Xk2Ygw(dm|;
zZJpmlFEVO-zua;1E@mIYM&>!U(g>9^(s{bk#4xX{z6|rNidO`_+Y@t}Rd#&eCq{!C
zX_OcKYu<{s&(^$Y8)$kEwC<|2%h5QT*`<0@5AX$UWfDI(I`68U&x3rF9~Xqk>h=1^
zBKoKA%B_Czx!Hb&CU?1$ohG>Lf|!cz5Xrs%q$H)ve9UA1eYYv<2IA|^uwOPFaVW9q
zZz+QtTcaD>Sg=zlEPmeYMqYMyBXB1&0oRcY5f1U_iPWK?w?*_J8gLvnzCm0E#TNz=
z1mgR}#{-(iJ3LeaZIUgt6*f_bgX|$ImhYvBCMP>$`(yy5YE=CIfYawn^dN!~aA3sl
z_Ve;2qW`#lE`((hv3d|MF|>N!=WDD}RbuNePqrGjnN=02!jYgM`P&a;>%Ym;4NHik
z6{I;RaQt0_Id@A$oh7=37L4v7kG5@O9;3>!GbD{_`elDwztH`m^V~E#07jzhhX*G{
zNPx|eLrPSA_n=;jC9_Y!oa)t9)MrwLIy8l_4qT8I>GgAs%u4IB$PNWk^;@1-|5QUv
z@$uMOPm62yN^m)+v;?*K+P(cwbWFrS4L<?_@*&H;(UkXwbt)2J?QpZC&{;F`goU?H
zpM{o`N8P||_{3o(B6%fCLQd7~C^R8u{B5e?SVSaA*tg|Xz$|_-qP{CL>)_%85vAEG
z<k+>zs~0dwh6rV21-6moQoHmuOom-Z(cbBBn4v)nD0%N53&Eq;n8w&>ND$Lhb}JYl
z9uI0ct1g4ej`B_or}D6Z7?@^{KIFr>_wc+|PxEHp=SEq^!_~ALlT+$4Zo<<vQ;>k1
zA(Gwv;>&M2#Z>zg8luy^A(sdSAj0=Z@VLBmP*YZ(DttY5v#Uy7++G3H>O}Ent|9L3
zygnNPv?A3ml*FILl5hx@<7B$m$QPzi?+wiFuA{`8-K-ydF87u^{M{~pwc2P9Z@-NV
zM-;tP@Ph@QxJ3ZJvjL#YvlqrdWto0@n4Bd3TtbX*X}+09x+uB$sXKo~K~s{SPZIY8
zD}2*!92`A;^oduXl7)Fp&xYxH>2%&WNSGDi^4;|~5+nFEVZwK&Y$9YtR~sjr6??-;
zbNkzz2Xl5=xIfvvdahJWGXE(eg8^MP+9|izV|?b4Wn__c)uNcQr81uP>&yN1<{ruK
z-hc`jN#|mg@B2U@9{GHTrKc#Vo&_1Q0>+gKU8$1`;h!%!FxSq{t(!&#E=D3{i+mms
zVwHAWPyhn(yAK@+xnomWaQn^xto@3tEJ^~%p~QM*a@E5P&Yw84<0ujB(QzLm`hHG+
z?dxMe54&H>;OOghKF7@Zn{Q4KZc<T_VcLP>M(LqBfVl|Gw((o@M#CgB&2hd-CpOA%
zEH*7Le+d!EUoDJW<^ZwB{>z)y*K+hB@4EjYKL)La!Al9kCSyMg<!`zmh5?b!IhStR
z4Qaw(C}M2ozPH0^$KUCb165+8{mBE~V~{cA3kLVw;7LgBeex9Q4CTEeRDeE(Nv>T8
zW3(miuI-jNE^3uXzq*rf(tmYVHfyBg@5gqEVJs>kA+a!Lu572-=V-|R*-v@{h@iFc
zv6WBaNJ~{vfbd8fH`ROCCfAy+%B2LCCE*T_Pp2G{Yp)|r4|Lo96!r^v-z=y+kz$xe
z53Vq@8h||K-&rvrA@!&#xWE+T{PxVtdZb4<#=;r(ah$k<#?__Rv!qtOAd+?1j!m_1
zRSojv3;3ZzgVe8uN9b=@#xp$GesnxFe*Da#NSQ@t>ks0pRO4XCeM&v=_m}?q{adfJ
zt%*g`z3WovGo9VW#n4PT>3Dl}Jd7&@AXUj~Z<_Qiq8jJt+nzeL4DE0An63@IT1eDx
z>OhUcKH9xYG=Gn19mSOwmY0aYEU1HLEq?x{jA&hD3NaZA_<G@0SCYS+;4r{%`Ac)V
zp-5QPe0`JES~|S^akcZ0FyacF`eN*TP>x__GK@vaExtQdqQuDpSBM)c#)vz$uyf1l
z+s+wnU|4u&UG8SOl0z4gIT7{j*4wf>hd?VQncY+47cn;Bhvtg)1}(3zmjYAgN?A%@
z)TwNsf5v{+T60`=#}|Ciw6e9WJz9F<kbw|(+#KvZK)k226KQ`*>bUV^Xd8qu3M`2-
zUz4I#Rh$|wD{}l@<IvRc9vIjqM`Cf8fiL>mPiYGJz)7@p%o!k7ixclBWQ6Bv#mhiR
zCS1WH#PK!+9MeAZ^Bt>(JrSe5y=e5O8=3njq5S|yZCRkWgWJP=Jl}bGcg%7DzY*R1
z3gHq$q_v3)#X%}lD$veQvCKJ5U{jy?wkWOb;~RQ)k7!3~^c0^|WOMSPi~^pqY{Mht
z;X-)WShnB1N#o0zCa^==L3(7Jx8BH?n<&3CXI%B_yICTWR^3yAwF<?@5s~7E)^7*8
z_EByRaJx%OOS7N%DB{9%7S|nk`TbD{W%2aoE`Ar4%?6g!t44!QP|NlTDtsPbl#>e9
zJJDmN56Pr^Nj-rutwJoR?av)cDr`eNB-}Ja5EQ5^AWg`!jcDx7s#xh?NXFo>-O5-#
zJ3o&_<D;OorlXf8Ye)0NRVzUu{O)yol|=CaysKYokkc_I*~zW@b~E{xOvqT16<S;g
z6s~}mlk0lxeeEw;H{n}k-}bU1F3R75NuDwHZB540kGBZ%u&<I)muTqwfDC1=GZ1?#
zFfb5jU52?XuECJJFgU-#Zlz=9a{2gk-HWxnOu7(*C&5Ub*>rN4#dU*?w-4}9Q`58B
zH}SzPVVvh_A<|_LOI{LDwtEPkh%McV$)o{_>puCN5S7Gt(iQe~`t8(L2-Q4M&yrqv
zwD^}2fYcx4X_qITPA=oE1ux(M`Hh;pClp%vwP4?oS?WAK=#8Q(#%<EBziEsB{}rcU
zc&$E<2xR#r>mq&m=l7BvwopSjYG4Ebv-|4S@GNF<qrivG3fDih@)6DRe^|TmT<zpu
zp%OOIb=+XkgtW+HHqbGIf0Drewj6_7t%b>guLXvV{v`MzcIuXyFunB2clLJydM8^^
zV5*9^FHHLGgaynd;1vQ9&xtGdeZ9}N(ld(65CYb}7YqhG(mZ~<T^%o+&pNB>I%eVL
z{cvO#a9F1^Ci;b_t-EVA7Oj3p6Y|au9u2;V^$=UzNC6r2G*vi1Q^%VWQ~-MuwEz0o
z8^t(+wx;Q$$^#6h-~a8H9YXiV>nVT)LQqqB(<SFZ@~m3gM>Yu3Sh`dmP5$xkQOqv$
zz6RH(7eUj$lQbvD%2g?iBWjhV5w$0{{h36w^_df?Ai9eYor<GZS_M4FGj3jo3_woK
zl4rzLmXE;>mWcI!b*U~`a+FlSgBS2sB8JH|a}i|$$keY1I>8i0yE_uF{Yu?GQj`;D
zLoG|=30vI<_k>%nZsXpJAQJ5m6a-pdAQ_o2PG)+ozIb?_PQHIaPZFLYqy7m0EI3_Q
z*Wq%NhdGl|z}UITI_blg4+L@t+vO){5L(_{>>(yaqa(4|(=n;^1!A)CZQqlj+^Wx9
z8G1usV)teN)6Y?{kSo}kx6d5pCuTIIWmbHD3R{}wXu?Py3T96Qftje#j)2B>gz#}w
zJ)Y=%5$#Ue&n01M{ej1#gvIq!o@a$fMa<in)7rQC4F^6F7|7*2<NVv5MJ(jg9YrcD
zcfwqB5f3BpgqiAkPZ0wIbwCz&KV#r_1Gl1|;hm98&W2G`^=ovkeAoOh`PpmsQ`)tF
zHDC~X<C2W_JC&Bp5qd+RsY?5mcjLz6zg^?B{@*bcy;NzCS=d12wE`Vj`sK@LWSvhJ
z5(AGij|eHLeN90xy<3rtj>2L`U(g23tRik5BGSs)i9@NG1Q%_@6mh(;MD9oyByY+r
z7^@@fUHbJgq|@tmY~S~;WjMe0RHearArIZJD71m~+xLWK<B6GW4?Sc`EaNeB4p-4-
zQGvR(o=AyY1Vy{=z{GezGK-7C`U^)OZ^0{RXpE&y#tN@TYLB`~Ag%k}^-T5yTg5rH
z^!bP7+s7!STRJo9hqq+jabI1FI86p$3x?&r{c6!F)^3ao5AOtnHBcv`+nroKmJS`0
z$s!0IW5#LUY@FOs1v1?54S~&=h|j1x<0?^#C{xEnVKX9@ndh_ol{|HUa(fkX&Bpie
z>gHVVP;!LY{;*eJ_Ap28&ANu>^3Q6$yPdO>h-W{TN0_7P+2vS5^WF0UGZD7eH*d>A
z7;Bb&gI58eQ;A!cokG|zai+a6{6E%A5twp=$~f^V=ob0&!w0UTh1JWKggQ(dpSvRI
z7~6bh8t9PnYj>w!>TcTIjn-eXkdXOI)j@x4e7Y7e{oU<_*UOhlH`yj=`4K5}LQuh6
z>i)p7RI@KRB3N;!phw4VmDjeK;)$+lu6$bCoaP+NShe@^=@6WKXDbU~d!=)9c*sVd
zMWA*#hW?PT#5w);zz|&%Q@k*=LB96Z_3y2|@|xkJ5%1eM)pdrz$Kf{Zd`QJVeuU0V
zGL)kb?#e^7fY1)#B0>!8hz-8mS9x4ISZ2QRzVp!R!@`m6qI=Ya{0@nyYiB$Uza&ta
zk37dOpV+`VbnlKIUA!2WR27(=;E}SvY+1Lhj`CE+I1*D`6g+y|uLE8&I;ENM;C#sV
zSoAw)0v@9j>HCnjiBK<+y`%-3&2-08>Zv!0iYOnEj6E%ybE;lpD^#?hFqZPpo2yhl
zZsp`1DYuN&mdtX_Nv+z;LDLdw6(X^AZ}#Kh-d=W7d~lAS97Rm4u|?S0x^ZpipfEC8
zTC3={KHt^-a2oGIa!m3$0|V3M2X2ubic2~#59)Qpa^#TB<)4s|FEhRv&NzQhPrEA-
zx&>|c_2lp8CnxctPZQBN()&WZ#!bsoqQ3cAFH2}XCDeBH^4TClX4&k^OJ`I&|0CQR
zaY|sSfQFK68^`tz=1%FyEZM)1O{d>rrX1AvSbj%1@WDz?j8eNy@&o93*UxM^<}eKI
zB?<on6)se^;^wqC*%!zqk_n?`RxbpuN6vo3;7=SQu9xdaErm$gmbbNzC8b90yq~;)
z`8PGvFxW_e@^?`fVL!`np;n_}<{E}rRE|R=v0n?i4H-FxPVlU*=btf*y%4S841RKW
zavPgm88rfo1X`2G7G*ba{dJ%8?4Qxq+PQT__P-Bfb#>?V9e8A<@F^6=RQJGlP~p*X
zKs>Dtl$(fT&h@u7C4Oz(@eX(T(kq3D8v6Mj7A9yWgEUTV>ECzuTTjE!brj>Kw$5Jv
zB2nb<!K-y$?!iKL9yM#+)y!T^P!tl}JRx;Js(-GBw^u$`(^>^whoeeSt)n}c!c_(1
zH5U|tmKUmm7riwxbMci7V!vwrRo*jp+<KRO4s*&X>Gd6Geq9_4bLkh^#0qMMOJ9ET
zEos^Ok?Ejpq-vGit!>NXp!8Q8_u<5<gNMgBvMe60d>W=@scU~6J$vfl)Ifi?t)4wc
zK$b*g%P+bCNNt0p0?m()O6jWP{4ReG$$ZWh!u7>3E2DF!wEAD=pC-hZT$yntL^$!M
z0*7H7yS93LBHl2Luvy3%u1wR<_dZgnV}A(dWkZ9)vX7t)T?Gz_F(SQk5rJ(i<Y$a8
zG>Nny0{!`by}{$>gBM@M)Yv;IKCat;?4kG?@5gTeA3>yZ?PQ1f-ys^DcaLv0OD22=
z&Pq*&0E1ju*bD{lU}wa0-e<<ty&fe#eHmqSFq&y%ZCg4zF}uqiuVW(-;;{%595p*Y
zwZheO7mTW!h(iU~wF}#MOIc7zcP)PA#C4z~9z13GO%0cNSb9QSxoXkE#3?;#f210-
z15AR}&wr0gE0xtG-=QEoqSv*Vgva{qnN3&>oFeE4ZoU6@i>WG3;?=g91$2E6>9_x*
ztz%_pcaq3G>N<b^+EUY=SkDUo;Mey+z2#NbV##HL6TG2Jv<dMF0fNDFnY<1Zo!|0Z
zi^nQ!#p<@~LGAu8PV5xE0RA&3i4zO|s>~G}aS6ik25Oh+Oyxipr5<vp+*<gl2Am}a
zIpeKY8EWEt#W!@$_`W~W#iSXII27mTi#NfR-n2?}Gv`Pr@wuE0CUdri)Ff`dHyVop
zW0tx``1=*tT5QOvFnkjb=SH|oIx)`L^n{*`cf2+Vmp(-R3*AAXW(RG1?!p1+T+vJn
z;*MT8u07;zQ<D05`BZ+{_rUsyz0$ND-(hrhw2AL|?efgqPa~glr6<`>_c};zo9xLd
zXX-M28}eX@u>WF!-)Z^T=%(G1glbhWamp*$ObrI4)~>%N3J|Yn&lC&8aBNjmYo<xK
zbyk<Bl7`h92cDK^A|jbW%4dC12(J*E<O-_4CK0x9<50oKA`2foIMi!T-LBobLQ7*Z
zBowZ4Ly&`#@duHp&3GAT#iu4k>{86G*T1zUc#wB+zW65fpdn{j=_#B1b4E2X<SGl~
z@0QfBLSdhRGqY8H$%{W?j4{!Kkl!7%A}Rwr*lqDP;@GkOrcRY=&u#qHhB@sxsy!J2
zN9A;#xU}>y2%T7-a*3NFy3S`;LIXYa!~tl<YeITytk-k9fXArD=9NtpyZN1|)OyUV
z_vtK&v0eVm%z7A4bF{_74t)Qs%g<u|PkyJlUb!(OM!lX!Kg5Q#wgQC0$tif(a>w<j
zYXts4sa89{s8D=Y|FYM^?FBP!sLEQfs!&U6Ce?ass!J5yN0$YIkVTf^)g*-7!BBX}
ziFdZbP=d?tc%4*A!J@ZV{d-Hj#bjZS+@|)#rL5_hg0J5^E>BcuHiUNm%)J{@`%zK~
z#Vc35s&$0oa;8UU%A9X*Iwo@>g7+V`Ye~TeYY<X~*56{kI>I)7Fp6LeYRtJsh`taH
ze~k14kvLGsa-nSCM$PN6uEv3Vz>*wgBT(+eyC3#5z)`N&8Nw2R>6I>^t3Uw%gx=!3
zJB22)nX%mQcsiNRMDb^{SLY8s-gz9>MpyVTnL0MlLZkm%lpwX7N|+J*9RYbcnjKoM
zY_j5^Z$W%$rfc*s3PLYz$a8MnMa&ODEQ)a?NbkEzZR+&*=N8Xurr(`k=<nxAzpupL
z=v6rSjy9#)oK3fbvR~U$?oRJ-=tR$qTD#N5B|5kJcU*qDCQ;GxMdsZqVQbw9;E?y;
z14!JpArY1z6jYb*gg1>5!UKQYHmWl@h$`u-yH62&k+wieQ3e=X6ynHeFP7h?aM2HK
zI9MOHQ?ruGrW~zl?YSB29<DLwO9TW+muj*cwtf|Az6kvM$tARrKw;`r=xP`-rvY+u
zVCd@5SAIj}<jzWsCMP2{x2-^1x%dxzvy(2f=6TJLcsWl28~ES;`&*uNi>M;~1QPZB
zy5c8sr_q_&q-g4on<{N+FBq7^zAOG<3Y4x`C79KTrIl}q!OJ-ty!<SD@%cPss2ylH
z%8WKUr>Yj{*RNS6?^#w%301TS%lYIr60#CLf(Wd$xI$FyB4`I_)-&l!4D{Nm2^HR`
zUFy=3)7>eHbPKxg#AF_SPcUJv6KEqfwzG>`_`V8yj1`#eSu2txtVh~1N4avWH+yoC
z5)}ytfxLob|03!KEn%9>1_l#SLM<UYEzJeoc;z+UpSDk##_E!oBcAJhC=DJ>VAh-!
zLR=1iNU51lkII~Qs5H&OWnGrv*vS9vi8lvMVCXfX`st&rFMNc~>AGhPC503(#Bl`b
zE@~gws;5gE+I5e$;;@n>(N(6Z5xDlu4d*hdYKvB{hLyq%3kwkT>J^NuC|kxnq})t(
z@30A3v?Qy=Q4@Rqf^D|t#A0HyxCU*;t}Nyj7CCRLs;j>)+`B8<oW*ro_PHdQ(o&)o
zwO50jmFalYw*q){ng#8fnuNkXvIkVjlAp@WdEZ1Lj<gix`1DZ;5nWZyvm<8?pF`Cx
zEb;#$M5e9~B}k%F?HrZ@<!_l!!!$bgD>zUS-G$W{!rN7%c%Qb3+Z!2WzmPMW74iQh
z8Zz-k0*M%}ZIuVV0kfm}sKN3_Z8kZp+6|mg=QXDQPxtpk=8R$_z=%Y5rOZzdT@}$T
zuQyq!g3QBy@=4;Og|z^qbLT|such1l4@)=qvm&evtcw<}UQ~Sj;oBb<#W>7QdMBH_
zGZOx-kDAh_Q-(h(Y7k84T6SI!RW;vVa>GqNomkyZ=J#^y{hc`^Gq16cG`&eJ;p$bs
z7lLA6ALOvIxd;!>KzyP>O4+1LL=~i|mWRK9OB_^`|M`Xt8uFs!*tXotC)B%+4O^$e
z0415Ce&I40mzFKOlEA2C3^PdWJQG8{8J4lC<D`GN8EF2PKr87fCZ_n;uV1G;5)7ZI
zaE=Hxij0}*xm~N*SgAYxnW^BWv~!NmoWMDGcObsth?IDXrT6=HGwOQ(i%svP`xqBc
zJQ_W&qjzyP4w9)&i%aNkTAH1)_|bF?8$V}Th~OsEQvTh)`7@ROeVI<PE#RfF5}_~^
znMbOV{EPT-uqbz5kaNVZj8R&lej7~sc_U-c|J=&!)4uz1bf$x_xi;@>#~F_;W^T?k
zLt(cVuLVRUv-j;yy;HlJ>9}!XvDuE^#mE=EcK;<ZgZoQ+)-zzO)$J<$U+d~pfSVT)
z*>VD{SCR=#b#a?wDRk&d7lqAMT^NJ=q?AF2-8|o|6<)@3!RbGPdZ4%Cy=I&gVK3e&
z&i9Lo$vk<6&QexU8&~{L<h)3kh+FTe@6XPT(6|KOC3B)=9$(Qp&;dG<Vb1e8#d`MO
z-S6-n$>Eo`;g51}Db^k((h*MZ?X9YgAtah8gV4*<*l)dWu_8pMgV&?J49UOi*}z3v
zG>Pw8x4^&n6?rZO@JPGW@s14l_xA%(2sx&x6PVS%15@$HYda;dq{N#|LEN-eH3jz#
zMDEu1b6qvK*}d_a1#N0N=1lx>Uh1g!DXyy7caNbp4StWM-`FRwinbG7ODb^qVQ^D8
z3}{P8%Y3fOGjmV&`D(U5UvCY1tidt=8-4aVw-pEalp&Z%Ysi7>bdPO(DlEEU=x;S_
z<yR&hmJf5?-~q=mSW?sbDEFNm)Pju9i7p@%MlbyclEC1lI$S91lw%eU77oPI8pu&}
z1dQQyvnv=EN1TQ0@8~jNZoS33BstOK)sHXhnqm~VQTrQS&Uje1KioWe>&VIts)z=I
z1ZTAwZ0MbPf(oOFwW?Su(UdxZy}sbTw}@89t4EZHY{t`2?I7O&^|fPRQ_$7b^`qcb
zwyL9Jkj`4h!A+t|Aq;2!9IsL>q3G((=I!)rx7ba9M4c}re}Z&EaOih1_TZ0STs(VN
z%sG$~#6CxCS{n?DrOfErf9_90T*AXgNdiHAN3|p8ZPy0?0l}JR9SSd?6cZEM0~Hz8
zTL*yhdPSsL8TdbU!u9t*tr7VQSSYvNYWSia@gU0d9W)FHmqUpJ5^b%GhZ87cXh$E8
z1UP`t=mu_-Yw|)c*$#5=@8e0g@dm2)8Ba}IUF*nJ83wy>9zB#2jvE{U-VCSpsHv1f
zCC2Kov%9h7AisMSZd=?`+mBZbH^&2%HAy}wSpC&|ITNImg&pOO2>#;CXKL9$vr1D8
z+eJ|JHif$*M-Nm9JBvGGmNsto>s<;qW8-yCi53@wJVuV$Lbt7kxHNkyV)zP|tH8HG
zt){Kphy2#z&wPG8$!8gJwBAfm)(Kz|CkpIRH@-P0DGRm<c>9-c7`!fT%gG9o)@Bbc
z>hgTFgcFDnj!nC7ktM9@XMkZ%1Mg#F<7OL{KvPF)-!z|?wWp+KerVeDdw>7!tX}y%
zhqW*kN7)1!nr80s=>5^EZYf&Tya))=3>0Xt+8{VlaGX}bX#{N!7oj%M(?hSN+eo}8
zTBgjNGJU7<26|d3JnED+Kjsk<m@Gp~y7oQK$>{3L+`9Q<GP(Q!QK8W>9o_$<>8!(|
z?7pv0gER^ZVo=hJbb}5cpa=*IDIHQnNjC@%-6f!u(hUP5B^?ryQbQvt-OPJ<zQ6Zh
zxx5(eIrlkxul-r;1Q%-y8B*pWS5q>`Xm#`0jyt3rbANcBwtMwYs6ecZvVY!hm-P1<
z$m{3a6?xQdq(RBNQsB)FKBxYWO1*c-!rk3-goX}1yn($vfgbPOlC%mt{xurhC&k<t
zXt||Ldk3`ty_(6rH~!OD5JwC;gR9T`KdJH6iFopNYwGnyJUUD(78Zkvigt3?!ub&d
z)hocOI0~+?sEx}P#DS5Re#U%3s%luH9m-Z-cbqeN6cW@g^Bj?b0eg488$QRg^=)*e
zXL~0#X9u^Qt>(Ncw(^yYG(CLqlh{+Qo!ZHG0RjWv@Sm#}pj)`xA_tzQAl4+h`+Mun
zn*23d*^shSybg?i|I|Cats>?(W`h!wl8j{OoW_k_wL&Sh4Xlr7K*f{Gu}rIrdkMvZ
zsyf-#8ok*h!J|~2<7InB=te52#^Id*7-G;YQK1C%bHXUR43U<5$gQ${>e4(oxmW&q
z#qOyke1x=w>4Xf=6}WV13VXm(Ohe(9d8IP)Jj}RXAR1BoqXQ^Z^mr-u!8wlLaD>|6
zeDmh3;21}jv-LFHYbfzw23OiwJbkyyg#eS7pw;hw)fqt4Wnv#B>1GIuSOPjKK`zHX
zvUP;=xFVpuuwE*wC_oD#3dT{9$afEPE1m$3G$bPD(T~^F`vc^NALF(+=<7T-LhJ~I
zw<x`+f)cz8M-ow_P<$bMCE-$;b+?`kCC!vVhV7pko4TDOT>9BB`k@P7{-P85bG}{E
z<ud?T?KM6{u*4XeS0Cm4+>RqMTFOe@PK&z9frmYpYuAgZmO~POzu4>Zx}lhsQU$rr
zLgpU%I7`$ih%#TjHOO`}?}hfP5L5UGwg+EO;@DD2y*3`T4crq-fiyn!ePg{7-kNDU
zXeGry_{vmnVSF6=iJzuS{hbu}3V)w)d~>hJvchERq&z~4MdS$ZYa3OyOa6?ePRtz1
zpT5ia<owZx3$#Ty>LAK=K&8ts5Er7Lp|=lp83~1?y6k-}sYbbd{XN~E{F<}<(K*nf
zVN|BV$*bddmIoN^JPH(Y`WY<hZ)n4cFDaIOeu>Lp(q`ExXy1low5@{EfigP`+oJe|
zjThtkVJEeLfhuB@-ngySAAJ*4l^CJFa*7^VR}63rVbl21;LP*=Y|gc_NQF>3LJL)t
zn5W@&?XRyLhYRUulxL+&`~I&gO~^KxL_ox5G%xwmZ75YbO8V+10tm)ruag_Lm#CQM
zg!D1TRDRjDXI{PATZlPsorrLtjHAq-{~U*VXfWn0;?*`}oZ*Q`6ujrGHY*F}RbXVc
z5J?&Oo!rg{x;Sy`{--cS=j@rxd+*;)r<8xlc@s?>TKfYzVT!E%S>9X_=NMY?@*aPz
zUM0G`M)=dzYtoH~n-=ckv7<aCF%-Q^DQ$%HDswK!JMFgGazSP1VywlF)oicQ1ek?$
zeI`aL@Y)p3QV2y0w|H(0@~91zf3$_)SNQesYOdNU#y53&ad%Ui{cop5z}5lc@<lZ(
zhcY?DmNU`E<PrPJC>4iQs!m#CBO5lJ6YUziX@RYr)WG*CXzykE!#L6d&ZwYEbSs$I
zjXhnb;~V{LM#xEx!AY(CTaO}Ka?;S3IkR?KwT}=vp+8w}Z{rk`uSe>-VM?y`V}$8}
zh8@cg4`OYx>|KzCJBwPD!Rx(Go@G!&N=>z%+9EY<OU}O3BXG11Uiy-PPr?eHKA9RG
zeywsUkvP%Wz@~89o8m$EUpnD+Vqua|>noiEc*5YIu)E)a-ivQxc3P6n=Rv#|2UA6w
zf_8fDX;q-iE%-&JrmTI2oN?Q?3RNc=-o5WIn<`G@BFR-0XG^^){j~^Ox>hgsIB0-r
zswvut4cw_r)I;BB+=dmco<kCqxE$1fibGxKos$!ZSrvg7G>A<iynto5&@818dk(^*
z;#B_Kv)!i4pQm4AH=yM2Avk>wb8gtSPqdtZ#<k?4-B7K8O4Vu9)$8NFM^{9=8r(Dw
zmFuO|c>-@*uA@~CnqEP%Ae07mq_NWVHhq>@i>xF|YRR&!Enp<y6=4Z3mey`dO1gTp
zh(nahNQ(2FtqNHj#RYyHw9F1hf0KMD6SLx?_u>&l3J1*bI3b5^8Iu7y!>MnUmG)p9
zt4eHNVgfNrOy6_W9!m5VOjlpbx!Ut8Gv)tD+CW>SJ#Cyf#^vty)ql+JM_&06>Zav<
z3f2L%*SH8qj?*Ho;y<W@&_{A|F1nOLJ)bn(hkLE~;+G64O>DHr8#fFnnW`5ECL+FV
z8Jq^D_ky)CXB7t>@ttf;bpTV+j2G&OPEMGsz6?Y>h`BsLW{++$NT-syx@zcp_-NG>
zrW?*D#q9;I4wSPI7sV+$a0_iEo^Z8PCZdtsu+e_VZVM(yd-!00D%zX8jn<(JCc-?9
zS2b*RhAQeLerRPP+%B-dnMyz1A0%V1L@^F(e-#V>+lNG`Cr?Tnlp+^mBa$@4vDPs0
zED&|DhMrSF<Rq%FO<mDyq$fRTBQu}`+@XZtH&B}4wcejGX~T7g^0?cVkDcIOEj+kD
zZ?ek@znD4t8+CZ0_pkByQ!1HHaao!L=$IEFH!{y*Jmo+(d_@sPz)KsToXrA(<{uYA
z@w3g~3~gAOH(65NjK6Y}5E@p1H?aQ^?8(#0#;Bns@y7Kf>z7x^u6d2bzA2?nZG$-;
ziNev49{R&@cW{#+!vk|8^-YrJrEP6(JvBe#>ty~Ijh{TU5rz#oU;CfX$f9L_`_gyR
zG=m0;Q*ivj!{3j+{jOu?h(Eu&VB9K%!I?9Cd=y#4jGq4~)S$(vO5@`(bbMn^#B+)r
zWC0uCLFBQK;5bwYoM0}=e%@U^FJYSb`}0a|h(EyvE8;>)J+aEEvhD&aLOXsma_aQY
z!D{~w<VeDDFg+B>N&C3nX{9GN3cIG*zdloE6F*Ghg~Tr{(T{EReqmQL5!G4NTcB;$
zwwBKkADE;i(AOzx4B2fy{xE>h_c(cGy|(v{=jak`fuE+hs-U=Vj{3ue05JpMr`yx_
z)Utui@Qv~_**Rd*!3dJ-@)$98{h}}>{%eT`F1NPKb(wwn*=hV67u{3w0->=tNcB`J
zK7kp%Q-km(WsW<#j<<LMG>sgtd4yX!UXc0SD0onWtZcyqf1+W5AB;?hH(G-@e*=9(
z4~&5aEp5I1y2}ZZzx*bu&*z-?fANe<r7GaBJAH+aMgAZtQH1eC?%KC;6Wgmrg^CdR
zx!i7T?8n${WNDJ>kT~OCd*~Ey_(xUe7ipd&Q@oow-vnua2ouqjzZLb4Je+7h>Q8Ku
zS8qIXm1N(=2JX~hpLC<uA@<SA?;&-jwvAq`;sr-qcgHU^KS_wz{Ykev2L$V?LOc`Q
z(q5<;kL={JDR<IOHJuwCtDC?*&%DcpvXAowam(1Ppgb*y@vFoWExQXZMf`0v)lY=+
zR%4DA4>d15hA!<t(dTbIe;5-HJn&WQrVuH;HPXKGtHcVNp26NH%h=C2m;4&QoAl1h
z^kwLN4!?xvZ{z&M)G*rtr|^KM>Lo?}T(qz=_@+8eS~nY`mHL1<c|DjTS1vA5%l;%=
zKe&p9u<v{}Y1<7CZ?j-|@kmPp3X}oe!^i%~l+ZLbGW<Rs=KQ~?VK#vX#-5xA#(F2^
zkNVQ5N7AyV_MRb$n;7c005cK3VPA4;bHU+9(%<AsO5%WVkz?#zb=sf>beJ2^TXnYe
zS5-sp(_i!ArR0n~`kS+XFcs;0T?--UM#(290xfHX{?Oob+$#=TGX0qSd!-g{v(ITg
z`%bEY_O^iM-S6u;ySA1YW0gFw3nugt&hL&ioGQ*;1gCsl7#6HP%@WG3$xZw*qEQW5
z)y{XSqlZf!Z7k=#!SA?%{&+}3Q?X#umV|4Lru$f@q)r>|qMmr|AAgOmGNi->5uBD!
zIxW?n!_EAr*_5R|Vx6?oyZ|yonvj0pW;-UenP8Q18*W^GC#tXJb3kjsARfMfp+Q(c
z4CtdmEsxqKq}~q+RmVML)`{c9O+{P8{13xG&w#B-m8Rp5Kuh`Hn}-XeLC$pSF9X3O
zv)*yRVaA9+AVyR+kzYReW4MIZbSI~sKK}i=lcs||8(!s<W%zMKaur|Q&3Rwh2&GAS
z3gAI(0MQxu7p7@t#ma5in0T8>)`!tE@kj;$<`v%}V;)H;NcI%59p?cq3-!JK30*&E
z-LW7+1J61wAkfJ;gkZ);4M$@{4-10tfkLbptm<?1+Z|GAd|2Y&qQx9*THUmI6s@EN
z&6~$jY(AU5q%_l9Y$~3#`>!9lW2z{<ASuSS0NjAG&_=##VDXHk!n$?E`C1^iA|En5
z(2cmr3?3(dgTvV|7Ed1_SyfMEuA#5|pBR#|*IZ9;hx12i$}eXhsqj>&S)s+xre18`
zAl)RSN|1~`+0?^h>Qz*Q#TH$pBpVYTCvJI(?xXXa@2y8a!PrreYd7^$;a(-Gs*F#<
zeRpikN%@(H$sHC14~l`(K>i`)VWD2DVp=ag{2>7(SY;fCEThfJ#y7Z0BqPGSRBkS1
z|1teG<KM6d?6^(iuexpj4RZc~I_{G|xEX{%m<%kVgoIku#8At>;v9htW+y+VWN_p&
z<j!oW&B9Q>&N_Y%>2SfF>J)r@CVNUOZ9%1fA6Ea!7P*xP2;mTNmV%hri%8Aww)~H)
ziIy1DA(~%b)gD%$z#6;LiIT7Ap8M{8DPvx`4FIHZdVFtJT}npqK1O_aM;;t;kE<er
zF=MUhI0t+`SrJ}$oF?PO+}+evNxn?!|5!uMs3CIRM8q05eMl_8ctjOB&@X^wd++LM
zUNp3C%S(xalV8cT%HVA1YO?6OVDBWE<-Z7RJh&&Kd)oDSwtU1cN~Ts`FBxk(cOkG2
ztcQ$p{%(}AXRPND+AL*T&I>-R3-rApKM_+ngDR1gI@r#shz#I?X<{xcOXTNNdJ<a7
zhH?Bz<F-y|Bu|2Y))teIL3>dD?u;&67h-t(f7dG>Kx-CEl4m9-zYd`iF(B-O`i`Ih
zS1<Ztqj01S-c+$Q5oCPg2kZ#*Q$J3&p+B;};=Y(}748T0Fc)@=URO4={=GPU&`)Yj
z7Pxg=nE!FgNw)K*@Q!}n*X9^^iJot5u9He?1mnx2K@~80qDFp>KIf$ceO&V@rOzU`
zwMk1GUK}L_s=v$Z2o$2w7b&xU<Z?8n=9li1wXn~~K8UG6fvLdz`gEj69{b5oZuou7
z%q^bsk_EReDrh0kmy*19o#Qyjv#;B<Nr`k~&QE?<`g7KHVKt+)2w@R()#sOQ*vX_0
zJT|!-P|4x!`a?{TI6d-sw$td-pXOlSXsdpEGY^_x1P;%98agL1E%joV;}}nF&A1bb
zuLuhllD6_GNWb=?haVXkK>lUd<s?hD+L9r`x@b#EL&g8R%sYYXIZyt6D|BScSN~KL
z%JX<PFE2FKJEv>@o!?sQD8i07kzvY5gguI-GE32epr+ek?L_sXzMrf+%q&U-wSk}i
zcJ^3-mW;q^(vhuhHb`YfORCuV(6D~ku>K}LYM%=69XF7Z2>VL~3OF@@{0LW9y+ke1
zT>IO*bGTV~c!<i=^+1v=&@CE7Ji2jazrR#HB{=!!6rQNis?Eg{A^%eR{0wuk6ZffS
zi==IuPvTnJ?I(SG%CPI)(1m(uZ}7FTpR)_@1opXL7p5P>oJKZ%{<*vMrJ?<)XRnRp
zZs;Bm{4pda#V|#yg6W87y@kE;b)*QD71wOdc_8B?6i+^3FW#doV_w#bKN%Tn7j;WP
zHY#M9bO?8#{{Xf1w$DSvT({;Xz90T25FGLTab+Rf_1U$*_h65?8e$aVAE|NdcH39R
zz=*ekvRx>7*0%s<^9mO4*5<;HTk~wD&h!BxY6{6N>LF>8?8;J36A^XI)e(#(kbT3!
zF8!?Wz^X7oq|filK_4%yRl~Kz&j<r<#h#Z=wf6*)@KE*3Q(lkr=Dg<DODr5K?-Mb@
znVT-E-+pGz_TyoHW_-rG;OjW71z%;(e+r8F)d*8Aha|)~$O@C;g~5~V&g(sjzHMXu
z(mK=EH91duZd!<bo0jV$h!GlUq6s`T7^IJI&VH!BANnNma%1HuehOd=SQivZbby{S
zkK{t|PrhVB-u^&GI<olrfZJQ)s@D#F20&Q)@PK+drw4o~6P=Rvjci=$-@HxlncS#J
zSvvm`E%sIEjGJidtlv6B?4!3B@)zlmLIprVT<tPkyLhNmYGg5g`3Tp7JP(kR_pZUv
zu8t1p!zq~lhkVmuq~fY`XtvkvT+*)EJB8>wN$rmvCMp1|j>!zJ-gobn6J3vPe+MIJ
zWzHDYG`id88(QWIjR9$gggi?_s+J(&`go+ZBh{(iGnlIsbKDEX%EbCl<gp?bgQH|S
zNO&|wY9H50e`%cnV9K~_;=O=}OCXu7mim9S2Lt@_6=?~8$%mTP#l^)1PMd>mQDF=I
z{91ju>zR*Snav%(U(QU>s$wzh6bu<?Y1ehVwkxmEgWs|9f94gPcYh&$^a#yl9zS{0
zGRk&#9pG7ayDwMa@<czQj8Qg=%YN}n;#`^O{^Q3E%Upy8iiOG{2F+8Z{9E8@c9F+O
zPcMtPtUYlXa>X$H>djuNqC`Hes$9*Vbxi#ms?0f}lDohAgx0QE4&H)&NMrCk*0Ui}
zpr`!pAH$K0@TB83TWJI5|0GYOs6ckZ#ZT?mn#xc4_{eu=8xo#9d!0^k?a#^bdEuvt
zo|5_|vF)pGDUy4qXwF)c>C*uk2R#A-GF(WRz@J{7O%e{bCEKm>7CmsJeAX1K0`WVi
zFVr_b4&?NJLU<>tL~wa_zOiY^?~rSYIe%JIR(TWNw)QOOKwN_sI$#f$U}Xg3_k!0S
z0=7(guK945Oy?T?N(bMI{>WuQk}kP2Xx0sNd(S(THuo_<iRFIPAUZKUZS(UPeFS5I
z<%rf1nj0|Qi_)>e;z=JgiqJA2IWRI=-$(KD(r)E=EOmS=5K+JC9P(3m7U;6gx75)z
z`6Jp74Q6`|r$aF^M*G6Xdz|INyy(@p)?5|Y_1F7!nqsI~C!Ut;K}YLy3aa(A%bN+A
zt7l&8-+y8<Ic>j{JWiA%3pn&$M^NFe4@?Trd;as9!jGO-{jBj_J(M7@&g$1ET~x6C
zU`o`}gnGBPmIs(XFfJ4!5ZJ>e;u-TzVbQUX(#G#|V9mepIpNdT4=ayJ)W)8s^o6{E
zISo2trE0K#B2qqh6dX~oM*-ZHM3t|fu8IZG|NGLq4@iK{u3vu+H*H@`>#7VroUA3k
zB-|k@i{#|>6VZ~lmeH-ck-yR$)BG!tBy5n~_ls$M1jJM>0SeDHoH2h<)((oM>$&j<
zQb4Ox->o@!XQqB;?@Ug_n>v&Zjlwr0d`0dkeG~^oWhsA`?nh=0)d$#g1PE2p3E0fR
z$tr<?%zR_g<BR!I1Wu#>eBEI3+slR_DgvE_^EHtj;V;)H1E*i2!gcH3&NBrs>+DLl
zTCZ({1BtY`l+^nj^fU`pKknzWg)7%~a__@q;^f|NbZur83u2L05IDKdH+fEQO-g1T
zDxetiYvFCH-?1YeGv?oy8%FOsP5gBa>`$V`LO(t9-p*Y@@97=tswvMIL!iHH<XVDH
zb|miO_*z@DX=00k#;cT#KysFh!93|6Ycc$7ObTUv7h;?W>+(*f4tsHBqVZN1v1m5#
zmM8H66ZK>1jnf)=^xGG#WoXAA1ijaf`FqH8P7u{>7oQVi3gHyF+8B%^{^GM__mW?|
zy<CE*AdF#TThEl@XJoGedjzTN_Ngu+yPx@=x@%XMIuUh;F;f%06vgLC*{Viba97XY
zyuVyDYojHau)|m-PC4&6u)J3vP;FXyOkU6qm>Ex4MaYt6CLwt}{Vvbj=GpY#>TmhE
z5M`!TzC{%3v+qrMoZwPpIS+zcMJZ_;0FQ$o@0AHhRw}ogm(b^H-MMz`f5G+n4F%Xi
z0)tKRhYod})I*Mw_msnl!;%o{7`q`EUUY06EkISI+AB}gntuMPn5qqBO1(&9aAo+j
z2JF*6V8i%Jst2+sXwE8>=_%x!In4|3(~XsSM8?FrLqk4F0*8V6BfYjS5B-WP@x@f_
zB+CK=rHLVdDtVIlfKq2RxWKw?x$U4Zk#i9yYiG7kY)Zvdo7dBUHPbD9-kUIa5KK44
zj>B#6m2w0&yL8wgw(s^cli&5G#r3aaw@a_x6B;R5i!LR?ASp&t^{CmJZL$xVS}KA!
z2KKVcf7|FBa%0N<WY|N`K2p9u)hX4>Kd!+2|9pP)M}Csx<2C<DwcK`m{LFQlS6kzm
zrEX5z250C&icS}xhn5~};_JiZR^(@hu1R;B%-JKBjvok9Cm8}TjiYW>zTmmJ>XBSi
zX|b2KdOiT3V6#O>O?t86TZ^Q>)rw47atq<t{t{$PWb;o;$Iv>XogSd3GS@-27;`AT
zKBF%s40%Ky-4&71Df=)8)e&jcDMYa%&0u;?{iZn_w=IJE$9$umZd_=p)cOMlrRHia
zT3I_@y6u?${wS&mf?<sIuRngw;dwuw>#%;yeT6z#G*jS>_bv8xun$0nD$G5Lk$g-X
zl<t<Z<oc1KJMgt$G(fbg|HL`?#bUJj{1U3pTsyRUx?m%1t2L{P`{m4i6K$xN$1EK*
z&~IVAY{4Lj6V!Lf698$t=Gwx8-Lcl3yUKs*y3+GnPR!IID#^mB<nRD{UTv(XBuVxy
zwq{)x<T_fkbiW?sZN>(=IAV!C$WNO1rKr*S1{iiqxi2^WJ9WDj$=gBa9fMzx$Bzob
zg9p9~e&Hqws?#ClN{7)0RlF$^)g~2Cl8RQ3ZXIKIEFjQ&1#23&KoexPT=C4^&meKY
zU@$C)|1N5bV3eKf-UwAktTvCov&1rJ@yoS`Ct)!K&wi`sf7}HViTE6pYvKgl5yA;-
z8d_f);*vDvGc8GY7UX4zHQYzXD*um;*MQ7^=Xy`wPr#SmaH`*f`)|3Jv$}2x^VwUr
zV0t$IbQXykX|qpu=uejB*Zg#<AMQ4;?DzeucO;RH+bj$w3Ozo>$LNvr(9bwd1auz4
zS{yuDL|b>(+6jHvA1r*c*7tB^h!(CRV*c4rJE{c(ugd#Rq2eFtjaFvO%md1`Lk;)E
zIo{+@kVV|lm3v9qQ10BxY!ipuw)s@Y(83?b?AjxL>&bKeJN}Mc+aK==z8~(z=TmpJ
zcw_(XU`dp`XXR(Bq|WsaCpJm$`dg1UhvvaZ7E%)2l>WH3HYP>;Wv&{B<i#^b8mQp&
zVr{Km)6as`hX%SfEQUt>K?$evVE+75ckvjP`Z!iY&A1|xOIPV%@Gx5%zoy?(;d;dL
zLS;h?lS(b+*&uqMiRKEDpc()3U2mJ8_NP<q&Hb24AF$`G?mVq{rHj?_3?TdPpmIxm
z-zDC8kKAk7*FmBoWEVXfoRjTDwvu`CC|k0P`or@N7yr!cGlU|0-fhu8*P#c?p%WF9
z+Nw+WFK3Z7IjwGm2tO&y%qCEoJITD0mV?6XAxp>^!}(cd>k|zW2P=&fwvNJia6nZA
z84gFdlOGo!>3iNeinNZP0bNfaiH((Nggy}`HK{8{aApudj}<rljid?SeN6u0`1?ED
zG4YX=TJOxsquBlDxUeUQ&DB2%+8j|tf6lf(Q_Pi98ABAifx9AhnV{<Ffv@WZ#@Fr_
z^G|Fl-gUf7ZQwepCw43k!Nc<9aC*tb?C>&sp1%MY`hF^<#gA92WmzXMUxu5bH^`Rp
zDS*<<{TACp-}mL%{xJj-_L!3b3Ti!;kz`fIFh7az#5Dn!#&z?E;O6~k{BHSgOxE}}
zPWccWf}>;q#k)O1)tJiM6qV(<8vk`+cjclm@zX>yuaZGTPN_wn00L13w#GbVHbt@0
z0*grx6s^NdP45kip=kejG0ap(;{DX;(}O04O}UVt&R4?~k?T7LEYU5v!#(`D1O^QW
zqR-3XHEUaMVvA@$$1%^kJf*<Tq5VAK8k6z^pTF*x$L|NKxjR7}k<FB_)8oVS(Y^>y
zwLh`Ks!aXqi&e)<z=O4<*OjeV6hp+b@Ca5DNC~wO<(aywb`|)DA&WYHO!%FTLkMF}
zNUXx|>ddJRt9e`;r%<^hZ+H4C;E_^dB&&mouPwiSo=?R2N1P@{Eg(YgP}=kQh)YN$
zAm5Ddx(nX-L(3>E5Mh^&b->XOc)RE>Hi(4qRG_zc{<eOMzuP6F<6P~Dry=3T&vM}U
z3Q%R<MGogWJB7a<vB;0s>wMW?F8Yn_+Y#Nxh9al%@dJ)$4GOq7zKf&Uq^qzGQMe)E
zKIV0btv6kxUc~F&ft#@w6f(4ht|H%CasR~!21&TAsfvTk(*FWf?&~{7MM9ITe%<H)
zeuDJ(kAe}Vo~_IybT4o+RGGGc_ux+YkIUA^tsoiknP?iz`{6}g=1vHM4h23pnHGn+
zMkQ!jGCigDmPynqup8l4nO->6^Dt8(H?fHDti8pE%B(?@eO_b~-DcqV*``c&;Oet~
z^k&RU)IFwW1mP05)lV$c37E-eD^D)F3Imr>cX+8Em_N?8+(q|G%Uo1f`IF?56BscJ
zpDJY2TrVy}OS>zOm`MK%?7)f)WFVU8Y>q>ccANjCNHmdHK;mq{uee|)i$5(M3g0o7
zdBmge_`#ym2x<57bu>gXGKQ&~;<EePOoH<hZqtu+3M-iDa;p>Ce<TMwBD~12Q`frc
zc3^gx^N}y!d8y;hyL`bf8ncTC5p_Ck8~F_#54<Ja{3K{2^8uMHBMN!;d6cQ*F@A!T
z3U@$Xw5O3JF3;)mJKWRfV^U4l0iM$xjMC4v-U@E#Yz(*%1#!M3F58zg>!*8RPHwif
z*>WbY8^sab?RJ{t@J*EOT{@}@Pc{hGN4r!n$^4WdpK60N5wH&G=@CY>RJrTn0yr6a
z6RKZpyP50bsSWtKkRKwy#h<iwc4m=>Vz#ckHz`?hd-tc#eEC5|{A%IQ&zAcwLSu;<
zj}kJFZM*)=Awu_|N8<F1i5O$LxlJcaTJUg__o>5H+vvM%|BhsyuQEKB19z#bP>gJ+
z!Oqdkp*Iqy-sdwHUCa|+1NOnPC0y|H{Z{g)k#Sg%@~}fC93H0K$kjhR-HXd%raqPR
zkh03OwrV=Jq0YeiYyZlr6LkM>n#<RZ<1;T3SO7$I*t0gy;h<Myyo9a3`39?|w{<%o
zr|e^E&b?MLdq!=8yH^<IKKu*z@xiNy$4}NiaU1_wWzv|MAcon0*#(V1yBXuMLsCvW
z#k1({B)2K4N!+xQX`eBRx?X;C?qfpyl)c+s4G&^#>tZ}Yt3lfi67>0A_|9wr-9lfl
zZONAl$l>8}LfRhqFmGJ!k@B}H8GB8k4u+@fm(xCz+zQ4L)y7i9l78n~3k4;>9i()5
zx~JCsU?dEGOw*9ng4lE#?P!@dPTj#C!cIFhdWVtfK~Sq{KcOCDp@GtsDfu4J)nD&<
zv-(9dmEz*c=m`6~IHF$*dRiZsQ<}7C#*l8;_CECr)b(ey49$z5Fn41pC(<e2x(Eb6
zj$1&N_Z)?k!Z5_o!=K^kG4vSJ#@#2pCiE<-n0bPdJ!5!{xf(NO8O9bT;Hs2Lewp)_
zNLMs@ws|^uvhpM2+G217;Vzc_JuNi!o(rCO_;;natweC?9<D}E$dZE=cE_^U#>jR-
zw-8fUn{#AE+$bSHhlNg(a|Bt*aQloqg~Af`;+uv@>7+jm{Dj{6k&pMp0as#rmuoR@
zgxsDp8~<g-w?w3n5xGZ;RA*%)xwL!`OrN~bM??{pY|*Agp{*Y-5jv%h!GrMi_5DP^
z@B<U65IivBS&m*9n~c2S!Qr^?PIP^mA$|Qf$gc^<_bq|6`+|FRZF&$Nj*bF>9ER_z
z#(u5Ib`Wfe!23x(=5ptXWy*`cQn-@}iAm1+iLHillbwp2cSXr=cyOf+Sj#9TBVE=G
zNtnBBwMFq#HqiPUBm$299S2Zs&SY&u0T~K<(n?#p%L(VzR3-R@bE~w8x`nTK6g-rj
z$Yw$fV)H7Fc|=uRu9B3<gpb!JqrU>9f;7=q`t8D>NbYGkG23s9q#x-yhTQPAzjZv~
zoYXdLT3QgOaKb{Pn{AED`YXv<rn<xt8Ur)q-C?&$pVW79$%d4`l9^z|_jtE|mdI(Y
z(M=DM@enDjUU^Ktal150A$H9%gmVZ6htk`L(ikEysvd;dUphSNrlmFrS4jxPks(0&
zT}R6g9kXV8Wxc;%v*7gO-t}6xp8h?AH-{hRR{4oI%#YwBFzHRC1}>NDUEk#7$qwyI
z+0?5%Z7}#nsH<C-*iA2UAyqnx4x{KEEXeM^GllWM6=k-pO~gQWR#`N>m;8Y-pR3gv
zmpMww+~50KbeHVt9K|Hoe#D}8YnI*J8&dvPAD)7u^V(k}A8WFg<RxymAW>i)18Jq~
zlRyj{r$TCZ^1TOZ(GNX%%riTa$dUvoTDo957a0A{Z(I$S&=~#vVRm?Y@$GVJ_tRKv
z{tN&DNr9M$$$9!&zTvEt7RTU4ZX!Mxl04!$l1)!EIDB-hg!DgyGt}mt!`CIGCtTA&
zO?eQ$S3?sVVadlTe+8@y_rEaQ;}wTF$$dWHu138&gVB{B{q&smVY-IE)+G4&%ZfC4
zSC<5DwvN%9iY{1(A7~gk@gQP7k``>{cRDO4(O<O#N^|Kg<u-yC2qNB`MWgd614S{s
z#mYhl2@J>se>m`FQR~N>5T*=j2!dns6c%1`I~xG=DCSFa5}`q_lCqAD&KQCp`3m<c
zcVABX`Gd)#F8(5VJ-OKSn3&Rrl?GXM%Pszl(h>HtgRp+tR(WP#=B~CS6@<s&ZWc{@
z_$zIXB|Db!yA98;8uFseC`ZQq-R@{^MiU9pRU*Fw!!$t@7gc@wgG2P+{}4krwKs`t
z1w%gMF)EGBzebD?YlCN;)`H<28}1#}-V8lH$;Lz_`=)8iz+CM&@%+A|b0i0DC32MX
zJDdE9^Mt{j@ojfOrhnuC8957RM`qZDsTp~lb5Lq0RtjCfoSt}^pG^7Wwk$r%C8g{m
zvF)AIXbY{0?Fs#Z`VY-5U`v_`idZIZaQ#8^;^RO}Q{h~Vytc~f@Fgl(kV4ekL@3rq
zb=sWVg5isDSw!C;=1N~LrS70h8HB6InHpLYH`P(l16L36E~}nbrcTHa#1P~H*ooab
zFhPKX$V@w<|MR!84Uz;6X4GMnAg|6m&*l}C$K_Z%-L$O%s&g9$6n_GnFh$F+1PNXF
zl1bi;Y+=47fm}ORQxYF_G1SbL-S|KFJqOpJ=M?^~QgA<9PhqyojocKHGCAs!_o8(#
zwwmovz(uKf+v?B7P*hp>wZ#XiuTvKvNu-T?$G5Rk1~#m*2k|eCw|6=#yY#4<h=7R%
z(rYt~mEv7E6{RhDDioRbNz{q)y^Z{Me16xP_`=FWf@Bu@q8uYaNT&xtxcTmvy}RO`
z?5V1Tt9NYR;uu|37_dO00Wi{->y@u>)Hr(EQ}Kp}QFzju(i$rc(^bq%BSac;#kzMI
zSRKIVMGq6_(E%<GPKHdkq<1!Reo+MyclaczwUbf4SU36&Hj-p1I5JF4^7`S9myJ8)
zdxqsjAam99U$_2S<~O?#<ji`Z1AVw$rJ|ik+54FI$+;(>n-i(X&HapxKhsakrE?>Z
z_d<YxEkKuc<F7(6NWel@1tNsoI{M8qJUtX@<3;ZM%B&WRrlNZ&w~d|#Z^JgM$5tyZ
zg0U*CF|y#Z4-wBuuVNPgjJTuyIsb(0jPegBr|=To6yh3^cmLwq$>Gybe$L&7q<?uf
z9*e)NE%PJ^r1armb~C#C%{%7KK#|FsFUG$&^q7N`XTdQ`3%EIye=nCHFTROVPbwd(
z2NvUr_NP9H$RXa%9QVT~G8~`(>KYg_<#v4$<@(#ItZFF@C#{kp;6=qRQ{HM*y)=F^
zyq$#>89gNY%Oiv5_XS{9481Xv=$H&cYlS62B%}O5pfPSSi-(}xRNNPT^EG(|OR0_%
z^1jVL%1_4pA5;;m9Y2Fssr7RzSCea0m-$p+U4d(h2zIlNF8_S*$CTU$zGLE-!}#$=
zTvXktr4&N4uSiwr3RD#f;y-!UzzmZMIS^4W!JGUfBPQE8P#}7N?;YOg{8YO&cEop#
zD6Us=#ZJg{YJl%2PT=n!H2$a(T5I@Dfknfv6%6oRT3`v5a_o<Vs^de7`}-pP^T(IA
z(mtLz(?NGa;v*5TljZCyE^Gc6yBOVoxw{e)5<9MdM-uLl>?q|zvYFytqj8C-JHS6h
zq|ZSsf0DR9+c@8!C_PzbD$NxAON*b<a)IEyD_3H~Usy6u(~b9Zz5m5B=%Wf(#OOcN
zH3@etws$Y^c5tbhjC2LjU=3Ecb_UT9nG6!@8?*&Q{D56?A?#OoRdN2*@guJ~0l9(^
z_0aV|Y>H{NW|%x@)9iGJAIay{mcvVAq>D?E`!roiHC_70&uH<2`;!$h&{$82s)8kL
zm!+V7cYNw&(2H{i6R|DqQJLj^2}>+uG;B6+!Pccr+Qbs+j48jV&T$Uct(a)1FW?Q}
z4?owkkEpWj>_k<ybFM9lnO;0f#D$MsNl-31Yo4MR4Cbzq%5e-yO2ey7Lk)RK3(Vz(
zVS-Lg9R5G_+OQ~pwxO<9oZ`O_8bY1kuDJDynv42Xf49uJ`GN+Y83epOJ_plY{IqT*
z!fu8ti9Qe3w}mo1r0M|Bf&Z4DbA5DOblzSa8`{`%>-i<TGY;#>&gBaJFoM=QW&cy-
zNhGy@bVw2v<~C9F^l#C4ak?_R7#BVmkk;h6`)9A<mBM<Kw}V^&G`|oA`Ol1v7>#c|
z7)8H)tDMW<n8*=y0=avY`rdFfPWU<+*2uvzzL>L1WIa?|u4NuaX0lb3rIko!Kn>MD
zRc&EXSir9IFV6h&<No5UkFY~l<`n(XJ2Cx!NBM`<_{ef0Z7ku$pL&GU23MJ(^of^|
zNqHpl>TD*4h0b_bl(RVJK29V)Ww5pG$#kV0(fJSerjjxe%kKX(q<o3azWR?mXeFh;
zoj3G&-9Cp(t1{EaNPh8ig>d=RGQCh&-jWVgql*j1n}_V$D~-FGoPWhNHgQG%oi9d@
z5JB+Ud06t<;s2$A07oEO>79@gA;EVIfS~cIul}b|gz=rtbl%m-^hoOUr}qqB;^_64
zZ{r4Do=Wps)+xaH{5{4yCxT=mKHo6lL9hm~k0jWzcX%MdL|NGTAXwF2xKsNty86<j
zLGTZvaP%;fE$K;xEw$)#iWYo&<i&rABiq=<3O39U^B3dS=6}jed{_yk?(pAB^oRdK
z%L|H=AF_wYgRhpf^i+9n5k??z^Dt=O@KD!=15k3;e<-vQCptR+5Z)Opeo;sZ(3#d&
zal}ZWP3X3LX`jTrpRj%NA+?0HCvc1CM|gAy)uz#=WZFP0y!RT#s+T5!7M)oY!3f7(
z`)&6l=?Fc7FQ2_oBU6jc6(oKI4~WbnH>3!=)y1k%?FxKUEF*>4Lblo=0WpIPIp6Zg
zQrQrmkt}dV9P0dcCsl15og=x5r4diql{4ey*1-Hb*bFqLG}FKONdreI|L6B(D;;<y
z_^y*#*Cwkid(`-FT+Y%FRHenfm2EB|GhWK}h0wY#ZTy|m`%f)l{qpbCpA)}9jZM8d
zxih<0VN6c7Yr^L|a?_&W2u@>3J%&MWLjGm!Y1&4s^*|{K+AC1<`2FGfC3?1sZwoo?
zatQG7Krt6T*7h#F+=YpVw;T{aik6fV?bI1PiWhL5%_uta$A_Qfo;-eZ!UBfk7QL#C
zO{Rc`ynW+|xcCP5zQ+)93oce6CwwLnG`K~*GX`^dCJsR`>_xmLEp&;|_5ugQLq*ts
z*<yXICr3c+QJH$<Z;p3nw%7&*(^ep!>_6iq_}%``v6?YZ<qE#jkH^IRs%;z+HTv3s
zRi@WcBZB@gRY-<WaxCGR5pS}mN6B&%U3N1^g-c&bbsN&~OYelbk3*nGvIIh5Ze)JY
z`<yGB+T`Wuk{C+p3v9UN_DSErjJIma<BP*=Jvr8Y48fQdZ-?7?hqD7EaE%!WuU_>j
z0tC_qTG6g8pN*vbX8zVxTZ^i~Y`VC(F#Tm6)ED)txeKMSNwWFyyA7uBy)w%yZu)_h
zdz#z?#JW98)n_jq^VZ$3IL>cunc(1zB*$j#$AZW{BzUj>Nx*_|R7CNYWJ+Qe0A9<9
zxin6nLto&-HLp1SFSex^zxzgRA-KApfs61jee@{C@O*pX4BFbeVJ|gL>>TqHZU5Qx
zC=kTDQ07x0Z~X6?XDKAKF=Jm*oog@RM?nTbI0F-8dt^73G9R-QKZUN0Pd$W+X!Lj@
zJTEJQP6NkjuwlKR@up?DsanZK+Tg0;NzYdb_l6M*);vLM0Jr!SV9o-#rACrxVqzx{
zx}_v$u|mHD07a8pDgcvF8{9&8<TXDKe{|WY>yc>3axxRWv2ReDCmYzF*ZvteznHx%
z-aM2fz=F)yu)IvC{0Z>`POiFyn7uqUx0Q7n^tnUR>*3z8k2w@sro!qab#zSw^zBPL
z11?|azlz~OO7e`k^9AV$T>Ek%9!Rq{B>Z<7Nm|FbTyKYlQ1#J{E?M3BzvRCdRukb9
zhx~YO;9+#Qe57%-glb1<@O}cmenrNPn|$KM5;Nc%vv25P(B1?{8#Ulm0;eKJc{pdF
z>IGZS&-SYP|0zG;&;Egj1_r%7Em!?554+yD9^|?VNu^Y?X}?@q!lOFD4^8bfSoF@?
zRG`Kw!#z~{3f$>Wc07-T-r*If?S1A74!cC5j5~H4Zf$<F=FKno&_TB{g?~6$bR-o^
zgg6=aU>L1TA4smz%7i=yB(xa}j#<m7P8(W{s<P)9d#PG{|FV7>CCq#wi*b!!Tr}}6
zr8PIQp>&R205{L>Vrx+b6Fq2?$FM{IcURhBTa-h~^-1=;_Z}#)j*ZRD%}?E%4>O<f
zX+CEWqb0#ms}1ny1@Cv!yVPE@m0`guMgkIDYjc~%jWs69%ht5@cd_SP_x|&&Q8H(u
z>gRTnO8Iv_ME#0V7lV@1;{FE2HIxRXRxOb_+JvMrsK`>>{!LKn&v20^byEm>aDL2I
zFNIs*QpYjcg1WQMkaDiSquChNM%8hfPEGdAl^$A%4P+I6LQT?|9{}^#7g@~dv8)+q
zq*V0-N#Bwh_lnb+M%n(s!_Z<_nFnk+!dDN7uv9a8#R8$XOxq^>Kcac9Rx0lk2Sr%e
zzmd9>Q37MBnD^APR4Ls0c(w&oo>6%X($q)j<NB|HcWLVBpAUn`Ri-qk`U#p9Jg|z4
zWbmX4US$$K9rVBbJiIMe2SZA1wFL=uxe0H<UUHD%xxc<*DwF^Q`IBO-yQ8<~(EA62
zIa8GXzf*l7^ySPeCEi&Xex(Tr>V+N3%m?<~z_5kAP_eeOy<?!ju0S|=w&QgBM*e~m
z^E8q1^^k$%77UqNV8d}(3d0D)hdE~;PyYybn9)+~%2E88=YfYHAX;u<D3w3g_<jjY
z^tWOyoVV0G8?G*xgXMqAmh8eam$?v16|%Y7D`!O{(Re1i{*cg8VL@aQ@D$@@oR%UR
zGofDv<UCqGn4zokt1JP2ihK8}0ym{FMWDj%-6fV8NDNTl99Zd1Fhh1%eH$?10?2tG
zu1;Vf9~Zu8YYId2(WpwcIN+gw=dlT`0ROw+aJYf%(T4gKNW<I%DEl2I_VzcaMYu9k
z6bl4S^uTR;uajnj?LR7x$UF#FBRz0eRyW)8gCrm;^QiwP$ti2Rx?>Jzu##)*gBd9`
zy{>R|8=MVyc(>Q($qt2;<5yQQp6GG3PGTc)$-?%r#-L41d}I*l?k((FNfkk4YR4($
zez0GaCTyRsHGFG3UI2tQlkpEXkk0HgH?a0HQ)P3hwG{(gX5jWNNsbhg8l0d(xJ-Hb
za*X!o?8kUy?tjH2C>va>obrz=oj|PGE%{a@%cipV?zdmov%U~HYN!Y@^~tqd11S$c
z!nE~4#!dx45|z^v9C4q3r0v>&t20Qn<4Qu%mtG^$tDS@TJDc-T@Eu)vZwlenLk7#V
z=~Qg{46=iewU&$V^5(0Ew^vKTz~27vde0wS@cWen$$p)28`a^r$6QFT1Q7u-PPK0Z
z%jRcBh=hl<5*5IoKBnR`jFP`^b->`JZbz`@KVk;PSxznI*+<|+E$qh4*gL$HkeDrU
zfC$jg)|m&lwhjjt7yuo0*z<;jp{8VPNCk$j{cD~YK3sy`qXnz-k?(u;khVL5>?bHj
zk)B)V$1eJgI;O>0t0A$2*@vt1^=x$g?R!9`q+ZlR#M|^w2VCkdBT`*iXzQe?7*-my
z#+(pFH4dWpJ;#xo9FR<6I1XHL-M@^D1aqySfVAs25Nr{1UkE$RCq3<!%>pz#*FOBS
zoe=vymPF`C4SEc!ZbP{bqPgwng4YSULseX2J!?1@JA>Y{a3Mn=L{eZL!3#X(ag#>g
zJA4JR3nma~tKl)i48Bji^k{K4Xb9}b48kiWaxOrahdFl^>y+R00fU^s96|$E)%SAC
z<(Jrc`Rg>pNBtQTlHtXki6+lYfQr!M^<1mQbdm1$6CXM#UL0)DCCLjL0>u%BA`A|N
zK6sYhhmLjm1^*ANxP6bzBaApmg%|SM)>u_XcY`7rpNBjPBh@A1aZ`V@ISAex{*P+|
zX$fOeOc$SdZx#6PTf=555&!VTci`V92f=UWAfOywbrmg5PBgeOf1m1jAQV?+c5W^+
z>>J8&nEb&3=-c|$(gbjWp54%)_vy&EVHGI<rn9Ap(}bK)SZdPeD?6Zz*cBPDn-A9)
z8{>E8sVw-CAd>V)8a{1E@#YZ9q-Y_U5L1Cds4_)R=4Z7+<L+^#u9pZ6%~e^bgir`;
zKspuv=Wdg^1{<g4Enn1rBCf&lp_?iy9K@qL?alw#2dNU)7e{}^Kj)5Rg7Zc7E)fp~
zq_f7VLIJ%{%UhaCU&;!Cf)5XRdU_lHKMKD(+lSnoIHFJJJG9K>6&2KsK8UA3VPJO;
zdl;sK_wPgNDu<X41BJD;6{#JR;E=p0?cmD)j0|nE9OHMCJ47etb+qt8ouf5eM`EvG
zJxlGTH~XshwC9fAS*m#IGsB-g0GbwHTchw+>FO>jD6DY#S!;O!@_1tmsXIG@z#sZ6
zb=@{Fc6GqTo_v@XN5Y=t)3G+2W;zH>Nwgb%z_vAEe3%q`n&zTj!&?V3V1e#*_bD<J
z25-yw_`-9BGaj?aM5_0?q)_u~yVn{WINk#&YW+U21EMy8wTi9rx&F$9Y@N|74)?HE
z6w88<XX?*h2O!CZG9^UF<odS-tvD`vD$TlCGJy?MjLEh3WtOBEI_tD)ePp~?N9OXQ
zn$J=TZQE80t<%zR9vgE&#c{_yH9OBe?}bY?F}Z$KMdSO{1*t;~=T~6iE*4nKne_?<
z&?}5DL4)Z?pVt8RnCXNf?SkZRR%vi0$tySz7qt5G7S%7ahLq?27L3S_#`{6w;!i)T
zGjLmF{&Oddn$O_Ts3IsyyO=v-WkZQCO{NH9_P=!T^?kEl7ioOB^@9DuV}lNS9t5DG
z5gq{XE7-C48t&gWJ@cqg3n>~%5j2oXhEsf>_#pRDdjIMYh+DnbTR3e#wJDLyUz_zk
zom=Rl+{0jkQ*lKYC_Enkn=vLeNyRm=CzW&toCmIh-5g(~?9<<kby#HUJB8VxP}l=f
zBq$Xy56{;?Exz~2eb#B$|3VG@H`DSv^V&)>KuT@!*wb()d<$}JE*<?ZXRNZlHVdr)
z6Qd?=hA`9AIVd32l_SC`qIjtYQbSC)Xf`tnCEz*(ZSljnsrA%c4vAliGJVH<Nh_wt
z$CL6{LsxTdi|;7!a7D`}Km8P$R3hz)@96m6X?Se^*^a!o4F_UH5M=<XDXc{-{kGa9
z;CkS_9||o?L>PMDx!zi(YaLu2B9-qW>rzO_D#3-z;Rbcrp(EZ<8%htOwpQ%JPaaVU
zmyZhV{P*|B<)0c*V#YsATljJ<W#o6hD&xJHq?45eE(h@h2j&u}8`ZAM(Z?<C)iQ*+
z*N6`!dw}ixiJw0pLx`<51(Y4^-Wb3}XfQ=4EuSL{6czDHkRO06;DeD&#~lL0I0{bG
z=#-`OQK6deCS>jMsbyAwM06k*i6~`qgBxRIWc`Z}VomBpahL<|uhL-OkJnF97Ng~S
z9#)nI9e12l(x0T2EcabqPahur>P~L3cru~(ODBtUf^0Sn=97~1YI|3%&Fy>Du&~dK
zk0I{q8`XrJ?kU#Lo3A&%jQcHa-I1N*+Ov$Tc4-$+u_9zO*A;+ZA{{9%EGn8Byh_i7
zW71}UGuh<P`{t1ql_fXQxPgE_aPGYj-eh6*X_C%1e$z1-x}wD1@0=HH`t?!4m&;2>
zzo!;=aMDDEW@vID3M;i1yNhLG6s#M!A()Ay+aK*N26J#SeZmZsa^>HOuq)d%&f&Y^
zwh4H>AXezTfO3;^i4Gpi_QcEcu6=(|U7Sp^8T9v!Vt6HD807YV(h8d@Umc}uv1yD0
z0dYH6HnmDg^l5Q_ZFTD_?y<h=D2TBvpFSGg2$Q*5oRs+&NcOEYe=HItJuDy^Epd1*
zGea$ZvG5l596dKr_!%-TAh3ju^=mzH7^9yS$yP;`Ld7ybW=xYT+TO{vheMKe(7g-s
zhY>sdJ7~J655tKwB~VJvP%{cwd=IWacJEf2FjGgo>hfGVhY|Am%r`wM@9w6UiM#qW
z6K=cgs~;EEN$>8<b@F6=X(Ht^a@FnM^}Y39mjmCI`+a+D6J|Q(1L8TXjpk+C%L#u)
zp~IFuaM$<Bp7IVQ)W@AFeEM3-`pb)`?Bh3ypXA8b(c&Kp)g2H0qzcEaEAF}NH1$u=
zqu2Y`4~7@6ANlTgJ=pnb;BigoIH#-|jO~+CW_A>`ENdNm-dHXEdLl)bh~)n7Veh*4
z=|egLRu2l1`H5;N=RW;o#S5uJ8L#O#VcWir7V>Rtld&3i!mpq4NIsWzoR`%9#)D91
z3K%E2d-YGUfW|;^hLd@ygx+KC=Q9P`yWw&?Pf{bwn-2QEo`7JmD9U`iCQwfLd(XK|
zUdOjzJLrq#E6U~TQci!GZ4_m!sHbQ+`2AI_K3TA$#)$`^^ps!HZFB72+U1>agR%i0
zk@gR663b*A{H%!;7@dqX{zKKVOMM;^?86nvB)dJ|*VIJ&P=ux@d-|f!Y!hV|EU~v?
z=V1Ol?mBlgXJ_^&NfGx?pPCdnsHZ*X#F~ZONh`_k0Jy^gEr!+$-Oz#W`bahXxRN2L
z<YX<=M5tFH_dGovJDgl@(0uS8Cmyc`XcxspV(!&%TLJ6T&$WD0TplEA&Mvs}R@5JT
zeY$S=C|?h?B>RMy_jk|I!mB6MAI&LXM#l#4bq~(hyXjc-Pg(^ZvMkZO!0yTEvH6tr
zXW3Ns7>GT;q|`|tqV8|e))}q^(_QLmBz_#Rke(T!*$~Sqk==ObBs^+;#s8wd`sz&|
z4i?0K5?H&5$m9^C1c2toCMv6`|KSl!H;IU)AwN}JVCBVYvU|H9Om~H91XL?oY|a~s
zvBDVttL4+!Vyh>_UZT@qRD+EB3$dOviB!f0QbDkMe%ceuPk@T5bT!%YoVZ$L`VMvp
zlKy>M^|k=4m?vCF{-JV5cAR<%ZVdVRk_v_piks*m0wRT#J4y%3A&fWC_6px#+dWu3
zbUI{On(F0W5o@TTQ2WeD{;z3^GxgxaA*<Xbgs`&#JSQW^C$3RVyq<d-c^gUhPNVmn
zjEsT}hQ5EjIX+vDg`5hpo@C$4fuM)PU{~Sf6%{gL6yZ5_v*9r9C!JS74+}H-fy+QO
zlkSzWP-zx6_&L0>$HvRngoR7s90pN&hz*o`mgHj^gKZAj=64NW)#dhAKQJOV9L7`J
z0tJ8&rHP157P`8TdA|*VL?QG+Wb7we!?ny`ZoR^9rmx?I7jl2BUfCw%(tDw-`|mTe
z04#UM0uOReC9Q-EGy(VyA5$4`{(`n5WD=RYsGd%6DcM!a*!$^h=ZiYV7f!O2PXDto
zf6=4qA-|L5f~bEI8i^bMjYogg{4bUZ93HWJjrdF^4K~j(R>%Z@%d_u1&tWHZ>92=o
zg~UrtNt`gL1;c|w0uC+rm8`7R!~dQ=ixuU!|0Bo=Ly|p@TrS`@<97M9wG_@-AB5M8
zts}iu(!TAyz9uT^eD~(pOpH<+&MH&xyN>WFnUsA&R_>5bJ?&fTp9ri<hgO<B=zLx+
zHHED@&ntZDuc$VCu;2Np-tU!N0+;*c>hgZ=`idvgyL0l%*Ip^gQw~U@wx`V8kN8tg
zF*0`_=@<$p60rs~k?e$1=*?Sx$0AHHcSlN6)cxZp`@NX<)GGR+xT`e|)t|_fRrlRl
zo6^2bA?KhDLWS0sv@_L~g9tu^=-u$4Wab;snQzd889@9>Tz6`!jl?#RjZsF+fcY>O
z1qN*kZ>GcE-WrzKp>V}`e6oM|$t9NXMgIg#g*Qd`i5J~3pPdYXxO%pCDRsy#wOfZr
z1Ix>HKGFj;DG`qcMr%-i4Yp8l?dWShBoe+TPf$+Ljq1ZfYE$2%cb2mbKw4zYO%&lV
zMC>A$qXWSqZ4iZHn#cAPql0@aAKW+7@|f=;fU3^;jgX+AIXCj3;Rg<9`|-YNHm@hV
z)Ht7>wR$qWUtNR@>Au47!w7%x$RR#vc+|(zHrnrF97LWbP-6Q)a9ET)HmhFfkeMvn
zA~#*B?YzTO26yXcz<~X|LxHRVzZGHA|Hso=_%-?d-yi8_bTc|+jBX^QLjgsQ(Jc+q
zCEX=RNC^lQ-QC@Y64I?SOiJo^@&0@tzyDy{z59yuI_G(yRyMuZbSc*su8m@!yh{R7
zf8|}nKP^dHLcoQs4I%n^{MrI3t#JPIKq2k&Y8$!H5$12~&H2_(tjYJSe$=rIfbMv{
z+R?oQa>00x*OCvvp)(uD3)<b%fkw_>D=|VeL2&UjN-UVJ?0|V}={x8(<BeNCq2by5
z@^!Igg*PmcmSy@+27l=7-$#ek=VD?J<YSmv`+>`s2VPSk0076)$Ws&>kOH*R;~93D
zD5VspBpt(%M+f<`E|<1Kww^T62!GKgu&J0e7N;4i)n*D>4W&9~p6@jqiM<J_Q~zfD
zGEOOU^jtfi5%fisweG5Zp#qGwfg;ZMkUT{y#OvkiiL<Hzcn_nr_mSx>NW(+2h>Njr
z{0l|5-HS)gHg9*zZ(nsRq}V$(tVSfZ{?T;)SN@Tc{N%ej@6C|{^xs4uN3OSdd+ea&
zqh3=XL5n_o+AVAv(tj%|@~FJr{<ArC=E2+&nUA<GgPZ$Q7~~j<_Zq%^v+u!vDbn0!
zU*2l{d@&&*p+$S)SNur?se|BGM6=yUO=hC7XvBn74?(jb&GXHeDzx_=4#9@JB2xpJ
zK9Y@6nJ1nH{=H>f6#cckgN~Py>HKa%Ev;hpv(cU{T9a*?!e)*76tTM<ffk2N`)>7t
zuxaF>rmFmK@2&T;h$QA=);QiUqt@m5bB4TdKG%a}g!01pEIo@7g_soC=#Te}@3D$X
zdx{C;J6_@O*RPyln~|j%D#?apq?2cX;OOmpubsv*_ph%S*w?x(=R$TVWv()F<Q?SM
z75o{M<T`M15S({oqU{EztKp2tvu$M9vUd~bZC-BB`MSA7gL;y6F-TNrE%2*c!t}zw
zorR$)I)5O8;BqDk2+@rQHVzAMIx#DLc~IPDlrg+H?SBNekoS00v12-NX}x-6jrc^m
zmA%_VA5mvA25$Sn?cb3aK{i>>7l3<z6(+<=+xCsFn*kTO;hdcx)5@2I=w+jshkJW9
z`~?OJZhg4o)lMMskcBz2eRp06z4<-o)w*jG<n+(8oI{a165w^DuUZcS4h`*R%5EBw
zDAm7EcGA9Bh(~>Kd6F&Z<+Ox<#Bz)sSMouww`-m;7id_#uN!lIp?P;g&8(7SKqhJF
z^}w$Y-~G=QTj={_+!>@1!=X8%U6h$VlD%bSG1gw@2^dUaa_?0xTgjegFcp{uU^CrH
zFI>+1(8ZSHtl`z+8S$P4A8yg@Yd*$jFB!JF^%)GP9_YJTMXukhOQv02x$M4eh9;Ay
zeq`LrqYNJlJ!kpk?{xc!ASYC8+!A`yc5)gvmQ$X7*M9JF4@)ml=<CQ<&Xpy&v->2J
zM&L^G@g)hO>fW{>$EscHLHAvsM`$5bm&X(jPKR|$OTeS=B3=ONUkQ0m?!8-O<%uiW
z+w*G(`zigJ0gC;%_Qv&u4M|vi1zpH<E_E1}li8wInLht3;VoEi6)r+hEQP2$SZiuw
z;1%YG1<JHK6JD{j+5>GfS)aiEZUQtkhFulySJ>!3$^%cooqxA=IWwg#!T3`&nGx`v
z=a>#XD>9st%ff8F@rZ;!G%M^pm)i8Pca**n**m3m1DD#bC^GPqx!6F6d7>O*w$;xo
z5coJNKCUJSr686Wj9*60(cNs{UFSjhr=WpX^UHxV_bO7EVk|}Llz*OF%o-o_pOyBT
z`SzP?VuhfK!6$(y)DQ95^FnPXNrtIQP0>9Z!301Y-=*U>M#OW_!=;INK38EYkD7k{
z0O`;A3@-TH-hw3)DjkU82&s?jO1pny#lH|Eb*k1Vut<bi_yuZPYbvTZUMa;7BAyBK
z=8ybfa06kNHG$g)?@yVxDePvjq!cs5>U;AUn~r?9vNvwMA4zM`=G45c2qDRXnszGW
z=82^bM2ippg9LfsffULNe4P3!ZDxyQ9Bn4VzDwlfmpA>k+RF+3q;1B;b#x(gFP27v
zJClvt%WW+!NYC#qaY{+t?Smka&qv_aM@3%IxqcMf5FW|d!_(tO>J%N_@nU$AbaGVz
z49;qLLb!*&d}ZRR#Go{^Z{1J46RVs!StKhWpRUcj$~L0xs6DnfxsYd0Qx$8YgtbU}
z4f8}7QKDClBRt5h$hUtv?A`+H^;j~-7-VQYS#*QH)dA|OZ(%BW`Z?{N&$^KMgQndw
z(JY(ucON-xtrDm+_eI95Bel=7ZF$!_YY`mZvkxD*FJ*nXn0qk!Eiv_N!x7~7vw2v|
z#d0?&hk5!??Gb-hTuuQ4m<B@G*)|!sT;ICj-3SN{0%F@|M{od!K;2X@l?s<+ej}KV
z1b%(n#~wriRN)0wb55r4n)mL6H@)Sw)H&cLTio562F%wU;8PyPE~5?ptN7Y2b%r+4
zk3SlD#&+I)ag{RvL8|77&uvjcq7OG?1{VkS3X;=<$os0Ytni2UpreJ^gRcH{`(FRw
z3kp|j7UnyKSHsAp8MgXOzv1)6A35ELkIrVbSOR~2L|0MS?z)vFsxXVzSPX6uUTd4b
zSRYuyDTfPABuAd6;XzXyaKUVIvc2+zxpAqn*QfA%*Lx17J`5J8O-h(P3e@Ozk6W>h
zp;d2`$vwYD1N|sXw~K5Iduvg`^I>{(6;)^ZYH0LS(r(s?{(<g6_o9Qoy#Af$9vTs^
zv2quYu<OW*TjPjHdU<%_{ut#li!uB7_&YXwgKXf5nRmvI6`PwtmTRXWk6ZkR-6vij
zF8w<7_LH`GCgGL0@5S<z+(-~-QuQ`*gMTy7^|m;KBMnh(X3s660by!t#NvEdQJd=v
z1SEUiU^k4ksh8cit;NY!<wVTsw2B{LU27DkmAI&6{e2;(Y#4B^h~s}6%8Z+$u+G^k
zylLa_@vgA+z7iC5gPxl1SdwvrYiZM;wls`i=oKA=w#28b*g=~|y)JGNGiot}YUE1t
zSFQbvEFWVNpsZtQbf3PQvc3pfb=x<8)$_e7>1B%XLyCr`QQ^^OrD~ps4<37C17H|%
z6@|v%Q;xwT50gPT<6yac88dVH&_Gr{uOp?`(|-ag(B4b;?^K9}w=rG@o24h;(R5Hz
z>!|Dce(py(dR<;Y<nOh~`l%(Z=R;|GE)0oN3Y4e@S6liZXuc17ML?Cwp*IH7Y3{S6
z(Z%(K>%Om(wCA}PVYbcW4ep-(f>p4eY4z-oebRiyfx(w6-l*O-F?}iH6A=yKFrK}!
zABAQ}Nrh|2uy&e={M5^vxs8a4^br(?JsfY(+th$>vjM}SNPfQBukXdZ$23ZD>utt!
ziIFT+{9Q8@f0E`#LXq3!^>gH-=cGytR3emO4#gZJRipq_I4Cv5-y1nR;>m%aE*Bly
z&Ag%SmlBY8AMw_RQrF)bdXYivMW?HqONR#yGJ=!#Yn(BSr>76@Umz;!t~!2{N{&#o
zjrQl32L(FOHxrCKr|S<S%Hhc4UdCIZT)0^fKJxix(Y*U)jPzXofKpeQ(&vz$_Ymta
z<u3B1E!KVAzUI!I#c9r+Z;eBm<=(64fpHL}v>?A&Nlx#9<AGb)Sn!s-H|7hQt!;M*
zo~*y14BWo+-A^%ygDXZQ&Kmie{c86b=@vEi^F5s?F{4e!MT+4?c5c(ZG#(5FWW<&X
zQ5w?V8ueeWYAfg%Rs_MuufPxcS>|K??KBObVkJ-avYeXi;5HHA6GQtm$4Zx3<mYj}
z!Bt9K4RULuV7c9?P0S##O@kqS__$(a?c$Rw=G&_t4#6L0D@>kF-6|3h-YO#20`csq
z)pLjO4dH=bdE7g!CeQxZKARY5zN!4Fr4w=JByG@N%F&J#scdIRSFkP6X2O6rI;XDt
zpNzeVs;^#N^i&lOO26t8@M$ym8I$yqPHz$O+{@$5`!?%ryg(~X<hJB<a_iOtl@5|t
z)@F!B4mDqO?GEfF_O?c=XX|zfUtGPGH-R0NW}J^tE=jUDbiNwKH5A%8d$pTtM~R;$
zk!J7gJWlN@&T*FIJv;c%SB(PU^hveC{bY@;VNz7zB_C-e$ZMLJS;s_`<HM()VxiC6
zQNM(3l1wbTcV^A7l}KFDVS3ujjJkFFRIZU&VfG_on)K7DfT=d(R11@$l}(p->o*p-
zR=MZ<)3Hyj6C4+Ju5X%<bwgZvl84<!iHk(ff)M2`#b7WpS{CX?-9BRUEg<9Q%pc*C
ztKYxZ%|LY3BVe3&NSTL*z`hJT_87j3`*IC!SnoNY+m|{Jgr*-pfJT<j<%k|PBJZ&J
z`|je)>E{dIt})@v$Z%H85;0^KGg%0FGWt9S<8d3r+Tn2!cL-Plo)XRH@w*-rh)m7r
zqjRJ;voG;&^kMHbwKK&&yI;^}EXS5c{zl1IR$trFeCYNw#v{1unZC1X*mD?qnFz~9
zz1)A}-s0QQ!1?*5X{(*3z!#|;HnJ0I^n(P?U~jv>+CSoAbKRG{3JhHVS2?F@QJNa}
zvbMFD4M}-;$#n<T=a()GSZ{*cl4||F1&gpqH>By&w!D_xVi9bJYJ+%qda@6HcMu<^
zsOgFk37J8OXHO1&N6~dZsR_f8M>zHv^&x3g`?JmDo39vga%wS2rVW#w{|KddBvsoE
z#a3-J*E_8}7wT)n9l8nd(X)zXOF_WvcqGnArqvarPWQwU&CK5E2jn}HtPciUTpf>l
z=;VhRn6qt}<QejMo)5~@^B+dGD2YNPMfJGHGKsoKHnYho@eq1^!uu1%EHDM&57~~7
zNbT>q1)$`Uy-~KH&`&TIez#9_hOv*cAKGm7+R<sdmYh<B@zgs7tAr)c!Ym<C*`dYm
z9X?3eRc-o~3qHjT$+0RDSL$)WmRxk|0TdhC)#25B7knDc_*ZC4cT0yixkl;j>kA8&
zB{;%)+++0f%n<0%#e%ER$;**8=916=bLt`OzW)Ah(krvc=wY8nUI=NTwSd*@3t!iE
z?*L=U?S9kc1Ahyjo1%mV$GBJ9Sdw>8MvX=!&o82~_&bhS%4PR$-wb^vIZ!Y_?8kE1
z?ov{!l(6>CfV7&*l7YhTJM*yf>wGzDi`U|!ijDpQcnQXYMIjS5<k&rQccZ;4%rmnp
z9xUIIGi<c}kGK<fuA>Ht*LOQ!DDnQcco^sfe~ficE>?OqF5+=0UPJj5YqfZKrz{4W
z(|L^kAWC5NnohUwJIpUC)iqPpId^nmlu3Xl9{(rGUWW-e2E3-I&3irG^R`YiONYtD
zOqT2%M>SO1bHDb7n#<lt2+x7Mkx1E-G|_-d5f(niTjB$pX9RzFlvm75G0jRjD2w@Q
z`G?u%Qe`V#XviCxXVTRWl++84IlNgFH~ylBZFYEB>IfsHYMqi=7Dkl?^mxiSRu5Zv
zpz5he{{3U0<!d9S;cd1trq?Y!y(#sZ0aZ#}RxQ$P)fMdLSiuvex;4B$CKrg_z#BjN
z#L=0D<uj?9y{`KbT5%5>lw0W18P8Ja`tR-r_7|SLtd?7-(ldlxF!%7Fr$sghn}=C>
zKiInO_ROA4bkK0JMAV6@uuAvTyh5Gv?g{^s%R(8o)b}Fk0~1R-iwhO%!Wwf0e5*0L
z-eVGJ2V7OE9Wpk;6pbAgo{iP))ku9JWCQ<Gl*&>sM6>i+ybnc_i$*m(FH!16Pvk?f
zAP2Nc%&X3(u5eCqX>&ERm{Wa}u74+i8Sb1CCLLEw;%S9+NPnJLtq`|1Xa9p)%xRCV
zUt>#xUW=-V!u?hA`3TJC8x7A6g3QLrXPEBFTky{Z?(SUu30@Z?9C!{svNXUhg$i7`
zdxbIv*NqvU3qS4*#UeT(64X^W@5yREc~`J$o0R_mO|+LNV1uPjo87|wlA1yx{<+;{
zxGD0`|GfE0S>Ec(EeWzC5e&Y^!%Kv!XgYRe4WLEXyt(YTr;c0HGiQCGZIvlxMF}0C
z&i?7$?7w#4M8rdjebVlV#tkQLklHY1$CMWzxCZechwCY8Y@$v_Cj7s0aci^rKVwMW
z_jR`FIkmecIRN8a2=wo80cT1A9fUH;pF44xBfd{PhDjEU(v;3vQluyDQg-8&;BaYC
zI<bfYqi;R$9j1~F>)S4(9(tzSii>9}jf~;&+p+BtK_?l-;R}5jnK(aJ+AglP2Ez+n
z{p9&4u<>+Mb9(UyLy}LLM*<QzFHiV4&UDD!r)HNEA@AP$t&NqhEH&A=waLR$w)Ggl
z4%*}4xK<$+C^d*R7(Du3S~2M|qiYksKzAL!-ijFIAg)i6BffE=`Dtl+QQE~C^-Mvn
z@ogm+wRkLDv`P|VeG$nn+vcrTqtUaB0|X|!O}gl%iyC_6L|fl`=&s(8Yu~K2c$wD{
z87C2gV1*O|54_HsX4iKk0MgGTA@d@QbNu!9uCFAbA+wT)kAn%a-C1Y_AuFbD=dGWu
zt6pSO4HhSR{L+2$$RnKi%&8FnL5jbSj#_-jjrXozmL@Ud6;sdG$lHU%w;D0F`0^K3
zySFP?7=<5NiKH_|s-I$-{=1vD8s2lQbauL^UE^H&a*~pFy>X%rZ`^>64zG%>Q8S-)
z0^YuRMS=%vBQD}O=##wDG@Z;UB(r+ble#=ABr)`>4z!@1l?UDIsxN^N<|E}89S)Fc
zx>gkAJii2fNPLSL3b}Yq`dYL?{iUzW(jh}xgSQ<8<P}HEY{3@SO-GP@U`DZ*aoZSR
zW$`ZfBxD63g+a#=qAmIP{38uKVIvb28eLMqM1o#nwy<&9m|=zbwXspu+iVD=<_CnG
zktJn*R6wPPwcq>qLd|mB;@C}wrEbBg#7Y`+F`GlOy<&KXtaSeO_tSo0vP0B-aK0aN
zV*I*@LPKmkt!Uf2Zr;Bi<)eEzNGB<?$7RG|aNT@&dnHcs^y|EFfeHInm}69WlnW-P
zZK-gI0_V?t0O3xF8xWqmww@ENT&#I9AOGfo**AK*->TRMSX`r<A5@cCK%mdOb=HJv
z*Ys5z$9A;GQO>6VnA?<oi7u<opvC*mN~tu%w7o>s`slDEu!xadt=+tpDhqOI$?G_M
zye2j%KIG2hk#N$mbi>s^w6<XG%7Dn-%Omc8QWmLpu4rE0K5N9=!;>X`47^M#LXjHL
z({4b@`q&^0xPRDReexX!oAd)Hdm%-EzjYoHcRh0x{D^_ttd5RgTu*7{7SrnVaw@^=
zWEE$RwL76J=+a2)4DgwEF-YcQDPww_U4TqBM|=rL{`}+ihJ2nJ=XrAa@%Q#m+TMSe
zC}v>cgDII9S`3Azc|hLUd2@GH)ODvy*RT~4YTpcq*ZZnnqSV1!$K4T)*3%&)>gSJT
zXqiLZC>mxpi3y}f+*zVV4;~~2{`22U$<v@wfDBMMb%fUqqHYD}p=V-Y3lXVnG@N#w
z@DFX-n)4U{FSllF0|xVIZj{YpnNf36Ek5<zUx?6W+B=wQ_-kmQ6k*D;SP$)1et5go
zrDdp#nZh4TzvOOJybraY%A~C1?v!kUK)p~a4&v0(aKJhe$R?$=;=jb(I@so=q9(&1
zNMaU@+mtnZHKp!(IH!bq(oBcl(*&9Ex98PwwFqkC?ClTXjC5=$?Q@~yPpxj~3+s`@
zN0>ia7QpN8<rf=EqpLt~2!fdo2CL04xnI%Q2gRdMAe3I))IWS{=2G=$IUSwOejX*A
zKg*0kPexxfec0gqG1AXbbR2mG>VfK*q$%SgxT?lISse89@%Wp;IVL`%y;;Cd#j<4M
zaDYzh;L#fa2bQZM^GD4i^r7Q2pbf=%i?|s-(=EV<h}nnmfa-DYVexEE=%a*;C;x_8
z42@r82NifkT_riN2zsA1nm!!Q%I4f$<~1HeigDDJe0Dw@OWzPi3Zs`b{`PJma?RyG
zBwZdo?J&n%(_8wHnEi#@r)NGS1H%=MzcH@io$^{En|j&?@z6jm+S@zLfzQQG@R)UN
zwOQ<FItw0NrkEZJSYh;@dWr5+y*2;PelCv|ondZ$rJ^yPkOJ-B85XxD^2-XFqparf
zSW32fCHj+XKpX9GN(r&p`hhN_B>RO}Sm^NtcGYp+LMT=NnGz$@vzzZN_>&d#3gNV-
zIvsDXg7H|>R9~QAo7i$%2}eCLr^6>CRDwG}*WR)Q{#NsFrJ!64R?Olun%$=AUjkYA
z9t_<Xh^aBTZc&-+!aa$*gf{k%6jMr7?MC#&YKXJmO7U+z#J5q8RaBxR5_EVB+{szD
z!;z%!Syfjoal-`sxSQ|C9$lR5-&)>4{>udSj>^e4`6%pcykAfA-GighSL4$wWy8-X
zoK0#*9MD$dhAV@dnq4_@-`to(A+-<V=_7W{m`0Z76A1s6Uba7Z9rTkGxFDT;y`7sZ
z^}leem|68=Qoibo34|xpbv2qAEMb%HTN}~(4cBn&y#{ic{F>k%R`8$EmPNMWt!8pX
zL}vK#19PZF?(l}MQ&3C1W*NoH8O>6akaY{`*HS^t{tlHyv63cBCY_fB+2z_!-Tc`K
zSL<#*3@r;X<sBa6FpJ>9<%r>Hzk|c&JCgx{!&!_jz3APT#hZ#<1uQ-fCg-sA7V3ck
zsI>nqK!`hnj=#ri;@F>jq70*i_vDR}rL<JkZE1qlwck^Vr1VQwJ$esiu+gpw+%iC&
zHYkGCvpV>~<q9_xpf|QIH#$xcwtV4f`N?eSZdL?w%xn3CyF5tMo@j7(*uj=4Ffuj>
z`n3@Kag(>iiq9i6nVF^dD@MA`3-fd~3VE=vGf(~2j31x@F!RGg`Bgf3-^5D?R<__g
z)!}sBCx}dq)+j}X^oY)B<%$JV+r$cCvL2@8?_Wq5_d3*eo!icY?a472_bv`X{iRaX
zDU}FuI-L^oM-m|UE(!V(b#q>A#{|t~QbERj(=YZ!1{`^_If!%$j0U<$5Ak-9Z7zY|
zU-FO{hbW3O3hGof2v48>NVWxZN!Wl3-MSc=s93xT5$pNl%fM!_xv0zxuW|dH<rpAo
zO<=0S(MsGPJr3yewEQe?`>_KxHvG2sf>SKPB%tD$Ml$$ghdHUEi9;k;9tmuBA<%*P
zjAbmPfv#VUI-&Dwb=_yidb<)jg8b(nctEuQDmhFXy0?Q5{pqDtY|A*d+`C0&a|{2j
zbb0#w??o!oH3pR^jOoNCcFrG*U!5zY#a<B)U+s;}Yi)YOc&HioC#R%k5Au79FLSpU
zJ2>y)l1y&q04hq&$!CSF*1X96RG+hLN?zk^uesO52g|mF&$Wl%D8~`25K|yJtO^`r
zWIw5$b*K~Sj-dm4E*$xJx_^h{Rjt#9zh=7xG+z$HZFbY`2I>>viK}V93U=3iyr{4+
zJYWU<1l5yWQgocnsi~+9>-dz4{>l`J2P(o<`<u-is0or*>5{u;FZ0lv+5VM9K_V~w
z1_B_m8SAXFvV>IshVKVus$dq^Rr&FGx{*ng-@CB4ror*yf_=EQS}K19Urdu?b6Jy&
zX9~W@{@J*doc<biT9L)D)fj|+ik=I{mLQVrBHPrwdX3I+PAqg?J7e7aw+G<qwWzea
z13~!0zo5Dr*+49ymEq@$s#|SzvKWxSvILXP=oc8V*qN3bn`dHdw4>!1-t^_{cT3H@
zoyRdInx|du4fGb@+6>%q<saXUI<#hxn~3!BGwvH6t&CW_TooJ{UJxf}4xroi0pdb~
zXPcA1i}Xc<$0cIV%lL&;B=Yqx<pNRay3}Q0mgAm;f8KG<cywa?sS7<K!tv5~v-ae6
z@ln;COm=7sJCc4o+++W4S!#-35#qBK)Prq<&F5@HPV9wuEXw3`yb{1ErTaMnyf6i+
zI5Y+>DSSCH=(>-!b$f!JR^iM%(s$vnSUFkW<s$807<PJCw-kb>4J}IinEYlh8bZnl
zH%&bSJs%QO#Xrcg5nZp;`~0{DgciI0e*f$(t(@wyo|z)DJE7ZYFh1`|*~W5<TRhMb
zCm~NDZ~ZonKR*dOvYX?_FHLP+<@|<ckg(a97zKHiYxk7p{+ARa!$AHl3!~d>)2Sfx
z(F~l$U9w>jR5!1P#G+i4$h5i^8-u-W4A!H~8pa8l#<c;*yy;hX`9xyVq<0Zmn3!)H
zw6{bFMf)=5>!^C(A>Xv~A{zMm>NvOeSByd(LUd62UBznR+Ibt}k^%o<_={J<(eLO@
zA2)x*5>bcG1Iss?atcd{K~hVUyyxS1vJS#C33ZwA;k`4fCMI738rRuo681M62Q2up
zSrbe8TJV{4T9B1@GM36ccNyi8cP|c__V4EKbNh;6gEcslRQ!#mr(Xa5d?E!x0bJab
zo1*eNsoJU6vlX3GS5uD+9@;dRfjRWU!0ify{;S0gKgiKDZH`V{TnRy!@IT;Lf0SCh
zazaAL=iI|%7zuni_Ou`W<FDB|0IN9~!REj?>hp)en%t|P;7O#~zC{tz`cI|ugL1d)
zgT?d52-}Ysl+BZ>>5`1SdAc6DbVNQSNl7BPoX>eonJ~RnGTBJFOo~+BY=~E>h%Nb^
z_F-fyS8+uNh%Aw<<t+i9Os0e1V2>5TQaT&Ir%qK|gmQ?I=cOeUJX;YyU5Oh1=Y=cE
z-wYlPV!{ZJMXXWYBXg|<o^qzoWU1ZVN=`uflRDc>51&r4nr&}S2%AYq7M%s#q$6IS
zM?jGh8*Z)(+1K#%-Mo4!n>#wI#%q}Y_oH$3Z2OZt<RKFj+JTEV6D`nY-N4T56UF3-
z$x0`+bk?Xi@Gga1qao=#6|jSGu6G0uA3TVc{S=Ks84aTZi4lk;gK6pj)Jj!hyPTTu
zyfRkFV(sGN<RktE@g7r<N`55>8F{8Tc@Z%qJ6_`h);J+v!1~p}tm68IN?Fpd1(3U8
zj~74&4LBjHC=l^o^-mvKX_E~VXNWMaxzh1@a$Aay<_^OP)sjN!V5@4q`unyYw!^Ad
z9&##pV<+|2rMDP!NDYjHE_lVvRh!P&IcC4*>k0@JhTvn3Jvv7;Ly`2GgVM+JdRf?+
zE9j83kCn%5kQL}I^=e#iGImHzEJnoT>|WMF%Ok?#7Mc2-MUD<>F-)%MZnrv`UXfYo
z7_B^gdf{l#m4&yV|3YAN;&xf&!YRkNC|EUGf_#j{oQ>1RlRx=0=pR564|7^L{9!)$
z{`~?zL7M@+;;Y6;>4nB$hqFY7De1?Lw$}&z!rdcix$!bVNg2DRoTa*K-Gax>f&P#3
zsz=Z6|EB^F>yx_R@Mk~ALb$hJRNxn$kd<XrMmOuTB`a}2h;u!+00Sf5(rLp5Dn*5@
za7trF2I_F~cn#%J&eINz-|_dUp-Ou!6<v~elFqHpd(s`XGI~|rICSiTH(<B#ZcTAg
zDiZ!9EW26QjzOo?7m{0e>l9-VEkIhUvQ`q0(tm=HZ_;$}bg)VI%^?O>qYU|l^xT!%
zFM-kbkFhBbpm{A}lo1l`Ws!Y)Mu|rhsKH8H82d@l;Ar728E+bjbw=;{#`SNvr4AiT
zq|2ZxzM87~AbA!O%~K4vbqFBOjf6IDHUbpKu;6nt=;C#ZivIjd)7chsp8P%<(m_jF
z43Wd}6BfO&gvCDQ4-LkCge@lZTCA|OlQAQi@lAgjZyA4o_iQOB);7<gs;kLn>-ynA
zkoMoUP5bn7&a)~S_bP5_uX?(xnrYv8Eom9#L6TVi>>|gKja;!7zscE^2?kt|8f$W(
zis)e+Gb(7L3~~daT2~o0M4vyrk++y8=-by4{8Y!{)R67$*BJ5+=pT<GFw*afwmYIO
zT+Ave6~wYq1@TmLcg*#}KphukW=6NqwV-+5(owkJK8w%jHg`^o=}og)Fi_@R@eJ20
zHA0cH|F^lQBA1KmDvtTs@`9`KpvB;Rg$cEav9)7Z?1vF^&T8T{DSNBao@x8rTi0vI
z$@O`HuRPfs)3XMOY{}xly2p16Lb&>3>-2*Z^4Y3S=S>tV8`oqZN2tg0m|xQ82OKvA
zmd4&$w6?U|bw~+1i1YUUuxhLc5zpni80$AB?%S_kX(_^ZY3kE?tK$8)LTm&5t4bQO
za`73i)?i@c0=>+iNOM1q;$yG3+r6m7P?OyBprwt+>|Rp0PBZ<FSc$M-m1P@gfB7Mi
z5px%?aTAoXD{Vl>#%!blEB#wvgbMby$o*>^s9BaG@md;))9er+$e7BynjXk8nC%Q7
zNbVGP?_~JRD)fRzl+l3wqEzM`4cfIBl!lJ35PNU$43N!Oq3)kH+zPNaV%8xsmF_ff
z?WEWKUm-gwZrJ&KtO_7rYds3VdFT71<m!Ky`jf-adV9qKoxh3GajzQwOyw0Xi-s2I
zkLejRsl%gmvkf5fvyv}LDh@KUS0TDl2r-U5(tZXSIt|#jiZMVJRQ*cs!gg)r?tq{i
zb6&c>)a&3Tmx(Qpws1HWX^?^Jxs<ycG%x_Nb>Q;Ol5)d~i$Gx1An?!)i#4~gv4K_N
zeQS9B{`f$B;6xMKVBImR$ChL*>PEURaE;`Ov-a=<d9sv9e7AQ$r&ZCju>foyZugsp
zo^$?l?LqPQN+KF(=q3z`cUlVer=+g}viR^yF(*rQC|mOf<F1fcH0!Q~%wbjW=l96Z
zPh{PN8Ia>5b!HkQcn8@Pzi^z0M<k&HK3z^F_N^;n>77Q?9~;jWujX2^2fvPm=B2Fv
zs?}aG_D5loFd8r^qf<9vldCX4m*@WHf9N-j@fNK?0kU>uE}nMj6k1#3{qnMti2W+^
zCxxNOYKz(;)CcNK%QZ0Qu4Ju*?R`;Ut7mug@8z3wHq<esDd>|Q4S(svrA94gVk;>F
znrNs9oCv2s-50q8M^orLXThX|fk04HM|^VMii8!y<?^7TAd<7UA;FRsi_)mVR4%M$
zv|<f_nTwVx?7Kj~!a;{J>Vi&IG<>`<{u#{HBg@Yvp>f)Vt6OZw?iawxbjr{leEWf7
zD%VS)Xwh365>-7@f;TIVXZ~~4<T8fb<0&R_<Ray9uq^p64s<B?BiNBCy<I1IGS2i9
zNWH#Bw*)7ifkdTZI<LQ~J#P^8S^qHDh@<-Yw{|VLc^1%uO!P6iVLol&f0FK6h?@wO
zcf<4JYnIkvG2Xmuq5AKDnxwLZ`3I%2KnUxh3)hg?#qIil%7b7$IH|xzsT)aLg{#FU
zy-v+{^3}EtV`?UzI_zo#ZUv%hprNSGIlGYQ5J9G@O@p&kkBx<L{0?JQ$SlwcOAWxP
z@+aRQGavVKRGJXqk&Sa&YD>NT{ZwJewW#FnkP*>-K2gBmLNLglNC?pv)|>E%lFz@1
zpyHNXeVq1A;!J<$+1RE02yU;KJ?mcDK&T8#w1Jp+BX~T)V8t2|Q=#nbjwDjHwQSu9
zv2a^4EJ`X5IF9|>OY5wG`r+YE3^j@!2CPgkvYv<95Botw1v&*-_|{<!Z^;&^GL^E4
zW!Rbugi!Uh+=u>xiIh+U)6=?Nh+VoN&Z_-d5c?+-aSXrsLr}A(T}9ANN^H6GLp_V&
zN$ECuQR7o^_3V?gE}v}+@SFT>R%-6j8P~d9HN3aI!(GOisYYYHuTQzPz+}1>zc~u{
zr9872)XeJIEMjgODst8o4_PLP1mKIoRW{X-z0B%&W()_WAlF|#Ui6p)#0|=09PBH$
zR13qu`t@BLMEzIm`pX!b?{E#{YrzMhn2bERV&hkjo~5!s{%^g{gi{no-Q3(@4BL~3
zs$&X<HwdS_3D*!RDk*|=kPfRmmOmpjS6<0YQwujDVw3{a!5m-w_)@&e=!SX#fTUQW
zp@s1zwBgIQZ{KYR=_M?U$Q~?^9>=LyHV{{lwWbQ-hk0EZXNfu+3zQ!}d8ZU?18L?i
z*x&3@;EegsdVh4X>bQ}%JTa)Uj3y8;8NM)t)XYjm>1wA}QLLr@RJ)nwhT+m+c%4AF
z?Lg)UjD*B@F?AmHFO0vl{=P|mo^>^+KF74>kbM^WQWdnL1osd-<G4`trp8{hZn<}G
zD^y%M4RJ!|jsq<y6|HS;RRs0934%jMhG8+k4s=qt<U>ce)iOVr#Zxh2d*Y=>&sE!4
z<i2`fXvoCKRke4$_T|%FBw9ThMQ326h4M)bPYn1`pfH=6p5?Q1j$z{K6v6p{8+-yn
zok$-ag=e(fvYgZP+k(NTmATLoGG_YeReUM2Pxlbu8n1B%zg+#iaj%wu%k$(zw&`~>
zJTslgVv^(fSN%S2C;?ZCKhWAfU6{Da2Hct)wJM9BnT)<(bTGO{NM|bP#W5nmDK2)V
z)bLY$X>=v~(`n_o&ZZV-+HK&Iw*%qVy1;z?@-z~)(5Sf(b!%-6ZuqPefa2H?x1DQ?
zR36rYF1b10`+Y)gOHxAOFWV;}bju1Qf3><5)K?&tJ{pdTh|$6H_F)2p6*!nm<5M7j
zv%Y-LkN_3$;-;(&brL-U2Tv7Zy~5saDjpQ{N&N}WB3;pJ=<9Ka(@GnsuCO4d!j9d?
zrZm$>=t<|LgMBZdWhwe&E7?bKuk0|ph{xzrr?%s;!%$97vb_VMl*DWd2+b0vUJT!u
zLBBT<?8=)qow?_659~!DyM3WFG!IpJ>3_8c`E%npox1MNI{%)vJPTd-|IGre46&*e
z54>)0v=yhUmf|8`{SOl2_#qAw|IeJG3&gQ9eXSJz%K*Uc2}Gr(we`^@AvoI!<(V@S
zm;-P!!kzJrcHc@JWy$vW{=7}EmQ?zWfR}cxAX=PA0Y_x~kP~WswgLVgaz<q2MH-Aw
zID(f{6bR)w?5SzJ#k}OW`d&Rn*sH;eC(~7f*ai-hR#ReGhZhyKBzQ(BYk0g*O6q|(
z_P7F$PUG)AcMmaEl&1)zg|9naP@U-Gql-rw`oq8Da&NdryLa+?2enAYDnZgKc=h9s
zJ+3;JiaIQHwQ03+pd*F&s76tT{_C`!GWj>^>M)<2YnhHnMZxSssXB7fMUkHxKKspy
zohR%JioH=oIK4~0vqCSgxL6tzSa-D0?Wq;*Fc~dfl7RN55|(6*_Z%R^#<`U$E^AZy
zH=6O+ilKKveI{5S;m-kn>`|eS&kgr~1h9V%iMg<FGmJhNohAS!to(6&%9s8g1lE>(
z-V}9=4XkDEW17i|Fp8X~XO;HlJhPM~HM22zS8v|ELtkcUQaP7*KxTd`qj^N>F2z+=
zIk9eNAMm>ns)^2oGsJjOkp&$~!GJY7<AgEk+nX68xW_Pbqm)h>+)Tb#Y2s?k62)5j
z8|@MPfztMedQheh-&o`>;vcX2{R0D@m;>=xM@a4LOT2!#M<P3J&vT(F|JRm&@*v4C
zq7(7P7KJzn1m=$g$E7R)Sv1g&La}J+V!Sd((n~3-8-sYdB?igm)vaV6>r{@fXSB<u
zaDfwO+Ue0_;JGWC@SW3oB*QFE6SS4pEL$z80qh!D?forzC8Dm{sUl-6&jIngHox~E
z8uC&fVm2ARNcJtfh7gU;;$bvWSS$l(p&iN7dwmmDLGgq+;+<65LjA^*Wn?buH=!j=
z`FCVLEv2~sj18P)t)(FP`_A1STwOA#UyGR+oyjn?<aqRwQFwvkcq(*>@L36~Au?9!
zsGO`!k!$Xbh4TLpg@yRRxvc2$DgDSK({<PUKrS_wflar%fSB#f;R5{?!c;fFM4G+M
zhGAy)-_giz-8azO-KiAI$9$KCgsNkafc*zlMk;<m0qwV^r*oL13+xE|vafBwXHl_3
zqR3P-bkd%Da+9KqEbV3$Fl6jc4Y7SbYWin=a&l68@*m7))pwR8es!0dt?W6Peo194
z>sm~uVbSZm5=;QmCE$rFRo(gP{X@%`*7zN<+mjKEJ)Q_fwDUM_eGw@s4e&NvnxnPY
zH#apgBP*Ac<G)PJcfRi2GV9%x$vSFH6hI}K&gfKZ_@V?hwB`e#?RYk_w?Ew>Kpkc|
z#x-}*%o4c|-oM)Y5ZhUFs;&JV{r=eq94W=6WH72&Xgv=T{C6ycPIAk~G-+SJI7ZP!
zMc6^O%heP2_0yZ@PZ(+3A_iYRcyP2;?$1`~7CI4rM}6R4TXLAhKp!8ptT_2omwpva
zYC}9puKz=s8lB)TNPzaMr@^94sj)HbIWf7_xQ^m1yoB&Msa?CLHT9`=L>^x!#R`Rt
z<|$Bz7=6kFj${%6d(<Dq_gyIf1g`ZMzYK8M6u;?}RxJzr)fNa5-7mG9#N~$d33X13
z?^`+nX3NsDr|IPBJJT6)Y<__$sOkA*4F&#>4>7v%Y|#H&yc*O9#&4c|KBZVi;j#y(
zJ>Ox0<}0B*AgF9~F%d^HABYNY4ece9TAgeRg1(m!2*{TbzHEBUC4pMuFae9%ybo(-
z6#@O`PXxi!c7TimgoRVgX>mYMA&#Z4SaCbByB^c59oYQ;KrNp%0TjbOoqSt~x4#pa
zDJ_@M2nYz03xsf6Xp6jp1($SY6cz1AeuSuN525GC^aRT)&@T7Jmb~JvVf9;^Uv>(I
z+;uaj#4$a0a^Udfx3t`nlPT8Y+#)l7c`QJU-9DEjcYI@CMxh#4)e-R4O2jFHxY3jv
z>nj(bme)24rK0|VDFbz%5atV?jH@62ISe!1pIAN(Vq^x;h>!dY>|;pY7L_dD`U&Bg
zpj?LCD=tvD4&~ZJ+ofx<08IhZ;&^bwTz=8LiE7*UMhtgO$;SozR;8Dq2u%?rpupk#
z3t5%WKuduT^uGhEEZ>nLnoyO-HW8dmyLM!w$gco@WK887{7<o%vk*!-xqD!Xhy7bN
zK7)gWW5$?#x?%BQM&vq3NX!wIy=Gd)q<&y98$8Tv^L)ecz2aYUew>*OYIbov7T6b;
zL@n}LnQIWF@LTkM(y5tuThl6YEmINlft2;zCXF49!Jt(0+x+BBjSUa<N~wFKok8sq
z^Gx#NYaR*>1p|q9-|55!9^V&m=>@GRH3i-%`5sL={@uM@{JYtFSZkFbf1%SCxz3$w
zcl(?ePk<(1z)HTyD;oZ<)%=>%kCR1qBJ2p>_U&C9VBO%ucMGt0eHu8wf<i<gN`PG9
zTwl?7Zg|f7@hiwwd~igFQ!0XNt<G~A!|#tOQ?Hm{&H5E)qP_PG4u-+F9T<er)S$6_
zv}pr~r~c6cm&MR1%+By|eu_YS6=Z3A1-vfQJ2YUh!F2F4)7?&}!84oV0Ie*(JhRe(
zakMs1O;2G#_g2P#Kh~ti3W8#`*~ecmU-|tbt!?ca3`*(6#YJN2GJQ#u_51Qo4Qh;W
zF&39OMx@fysQY{n2E2!Mk`ZZvHi_Fcjg$-&-tw*3=(6d&p88X8fc#T{H~tBuTrwy1
zy9<RPMWdxuaoii5w@`;$9o+ukYV=R5E$8h)VtrbX948PwdmU#;DBjfAn3lwT%@lL;
zN+e)3GyJDBxfJ#ZffCADp{l*#0>v(*!`t6TPq5SUAzIh7h9ua6FsaIS<mfr}GUtt~
zV<`k54@#O)5F04yLJoNOxVtN8^~&h)`vv?X-(cor?sf_c){Au=yGl7A=WlN}yv3Xy
z`elF17k4G~k~Ax*5fkmYHntO#Z{z9sBUY9Lv+>4)$5YB_XSQPv{ma@ui%s8F5-kLw
zZ$CM(Q;uAmam*4Sr=MwhNaOnL{Twe-iyEZ>x~V72;;-*CSW{H{`D-gDH(R-9IuUX=
z{5gZ(nZ&QmsIgbc<|I_PPzxx~dGzf%-M*2WwKR?6nqOqs?(yjT4p}KmwFX^x{3Uoy
z9o8cuSn|^}G_?!n5QnyT1MeaVn^LRo$unTn%_EltZQo94qxMNYMRGj@1t2WdwINOx
zpAcq$tqazJzndR8tyW5Ce}RSVmlKV_zH%aiqi9b1)JVb9?WxJ#=^b*qzU_1v*nHPk
zBcZpvFA%Q1f+_5p68s<uWHxmHoojU8#-`EVY2%mPl6EXyTN$M_g~`tKg6@)+wGVx_
zGHuxDrTx9%`t&h1UE6^S(>C=C!hMu9)s@lm=7K|}5VZ4nBJ6pr|NTv<Lg&->xbHJ<
z+FSFQS}Rjb^$0v~UJm&An$cOfnj`MBt2u}dbjMQg3{fZJ<qT-xTyFXFGN+>t^4(_Z
z5I%-CXwj~=wtoBeEx^Ua<ph-2vnR&IY4{xXQkDmG(=Jt{krioOpWods-yPjk8@P)Z
za`{Xm(|Jv#TfC3gu7P9kq7i@-NI&p5kXg|!aGINUhQHo)+5kFcRJR8pZX{6UpIS|I
zRC&DB+yb6}S6}6}`uqNCEZboV4;?YwEd_s1!}_X&f`JF?<<~u$o)WnY9udT!%k({P
z0@}|-{@vC)6@sc(`WbmVJtG$rz>*rbH}%DWeH8!DKrFQ9P5_T_J-ZHOz)daH@T>3%
zOkWLhT5?vrLjv2>0T4=9f^KGl;?LR~?|AhqPzH&V(DL3ZzpZN}EAn|tsR+bCGhz!g
zzLaWzA(kP2bC;VbnVYHh_u6y-U1HkvQ(^g{Pn7Vz0ie2AVu4+<av1V0>@}II)HKGB
zuOJ;FH`vcS3s2xlBoQ=%`)SylCZNs~mpu5!-2jz7OF0Q+*MD{MCp<_4R46z|*#9xa
zO<R?ehO{y!+&B7(T=;W|@ja@jY#QlbwxQq)Rn}XPS3&7%B7?`IvaQ6}N{k0Q;~Y^~
z2s!=ktHxEfkFm=GNVpV=gNNWTFM>D-o8lL&t$+*EaTaMdOv-dX{d~Woto<JEzazs+
zGPO|I<N%35&Kj*#gPG`m{y~?&zbAuw$+|*E+#;zE)c73;;xXTE92K0^otxC+|M2nP
zs?)HB|B935@`C#M256ovgcz=Z?ycWT%}#Ywm0_HO@SvH}AUl~1DDQw2tT8Fs^;B4t
z#ua8rP4%f+Ke{4ADW~UZ#=ymDQiu6(+)D+nezuFs>WbXuX0LJ{aOH_<2l<CqSztTD
z#KOAs0F}`q$1#bRnJ>Ui^}p-7lLiZlpi+`13!Zt1k!KHv?{c-xcqn+KR$c&N%pJRp
zVid6xIvS-dx4pwXpU#eG8Ue@VOXPwz%$|~4j)vI3xSP#=QZXGOJiXQIly5i_5Cd=a
z#?U<c{Xy*w?YhSc6IFn<?$u&SjmJPxowxj>vBC*#M>Q*YU(1NZUmzp$wgTlJxjOi_
zGZ%R*pdAnNAYD>D*y;qpk{bo^tOH}niU{vXB#D_1lq4JO`EP*bvh_c;0et)kE~TX8
z(Ls~#KcDh${lG!#=%|}WCS3cmn>mF!8$Xre53tCS+}AJTqKP^f2Dvq6_mLjI!4CI+
z8TAb#7>~l>CrTOuGQ^lMchgoTapmX%x}ul^bN_2uLbv=LGQ5BlWmu0zQCgT9awm9K
z4#Xp;uPyk~0YE<pwOYOde|-M_L?~3h(!5uuq3(sYB)7fORLu9ido^Oy%*1-3Bk=U+
zi*@jl^x0ajDtcXRrr(XkJ(Sjr(NT!YIGvzuI|@%9<uu0^yu7(OpFiQ!EoP195q?Ls
z4x|4+b{#6DS<<-n)pNN3ohZ22p#v=+1M@Q;3o|*s>NGR2C3(?+vxh?x-u3U#Vdr!f
z_<UB`@xfIGHTS3Xyznp}OmX0%u2pq5Iq&@Va@^#x%P<2WRx9-Zp9CtzOlduN7BhKv
zPcJp9bC|2rzt=F_^MTSF7wTt6-qNr&o@a7I&)e31ch%mWMOLJ=;nvt~ayj(kX}`H(
z3{|&ATXi*Qd<hjnK;>7Fs;;oLpMR6zqHsUA)PC&Z<F8DD=2(;1M5?zFq91QzP5<Lj
z6g7OSs3bCz%ruAmg^B6pOEs>~Xn@U&K`CIzyo&OemjQ8ooEYSPbf3p41q=(+>HA1t
zYvO`?KM0rl)U=A7eR(;~t%m$?{~^)ZYb;Tmg{mMc^Kr~uqcc<#L_udZL1)NxW8Xi{
zs@ktQ?rz%e&U5cQZE-$5!KM(b5Z&k8W<V=_7p%CG>rL{S)uN{X>=rioGcQ;^6bNPl
z<qJh1l;38;{csf~b0|MvB5YT?<~9pT{tAA>nlBp3+INi({{;~-NL{!Co{}m04?nO?
z;d0CUkm0TXu0Tr1@{i8o>{*)&UNt%Js&SESw^>LAVR!h0mK1wMi=K!U>ec8clKVB+
z&tDkT+PS#!8Gb2CeP0c}=waK<zH_AaE7~(~ruNAgEX=R9on)T>9g-<E{ZqS#F<(qL
zV9WS4#aym+74skHpJ!&}#WpB^sMh+1_Pt*&Q)n&$@f)@Gn>N|%QQBk<xm|N+x({;I
zU7lFY*y*ReC8eD>6PUUl6<uy2OcVLY`FsORw=TYUwO=g~6$TL5^Mpn6^&W$SYD66+
zKvq|C>&<u-6$s&g!>yW658Y!o05Jl%|1AJoN$z~<l1XWD3$9kj>xnXfzj<%hc%|L<
zW-FJI3!VjoKi=IA2w?4|Hx}CLq~&y3bz_%$lFk26{RN`)r5|>5C_YL)^_1ko`7G+9
zy-;O^hw95QhzHqq{NJ2{aX<>(KrkpDC)oZ~%s#b2{GRjRDvHzQ5d_(dN}v9@&R(#^
zZyEV4MH^pA9yD02+*=m!ChF34csvi6ZU)4+vym^XMU<|VG?4dL2M?mOG3&<CEUni7
z()S*Vyn(Dp%5+J#7-?f-yVYxrXEXX9*pJQ!vl2{i51J1d^uf6F=dTGJEpnj>c<bNq
zcXEXUB`xm514IM_oACqhy>>U4JoB9jl8Y!1;Tg-0MB$;sGLK_=rfJbLO{y$$Iz#Z%
zNGf!4KoKjrTK_pb<i#aVGJ`lQ)vxV%MhoeLRzIvAda&?G8@--Se>|z$S{kTO^p-u_
z&bM364)eReCkyYiV%%^u<Z=%I<l%y%=8v5azUorVpZ$Bo@E&9R@Mi`KQ|x)$dEh_#
z@B3)95Wl|$@IElaNf)K>$Tmpp#)E8L`0pAn`}%+l;4tW*al1`5Mu!QwHAA0B9rw&=
zpzQ`Z&DZTiXbe8(c)lEi4Q2X<bJ6JgSR#9*lt}46k`ez$;gd3b7_7w_GE$8}xrW~r
z!ks?+=cq=<D=rBN<U-nUQSK%;iuDqZ#;dp-4OZmlQmkkQucHhbJvcb<fAJzcVA+)p
zfafM}1@efiUyT9a-k`_mJ#I%CAehh{%RwMlIq$xe)>(8PUQ;_!JYJbJ6dJd6W83|X
z5!g08c59A{I5i{gbwzgXp!{U3$5{5_p?e;5VblaLB<hG<n2Y@5KyYtuyhm?kL9b@}
z;X!|j(gQ(y3=?S5GS|*``|SZ6U3k3LxtBCqzLvE5Ww~?XK!irZZ}k}9)w6_!Q4%5g
zQPs9$92K7vQ&A^mMaS!-6w&QEG3pt?<`Sym19M{xWdO0`Oje9A*wYuExMro=$3J?$
zkwq$n)rZDvIaHuhHg+odw_T1pxB1_*;BI$K?*7$UGoFCHR9C=Y+N&N91j~o-%;urb
zxE}+*qWI+5kY<jA@XX|7vPCdn<&()XlFBD61Vs6qqoM!zbzRqg3DvmsX)m=0$rOt>
z#APP;5Vv4I$relQ9v~`l(y)NF-$RZBcP_&3*;detP2Ql(HzEyWI5c{nN$>tXxqH1W
zxqLaMzI44M8kApOe{S`IO*F(-x!A5I-wGg&=+>N>&S($&<C$Nvd`kk%G-Cod6cbfi
z>EopBHWdP8T;l%wGa{uYIa58rBbF|wTAO~U#^lf`?04qC%{Oviw1}0+@aR1l;ZPa6
zZifBTy!~Zge$#t>i7Xcmm4PbG4@a3xs%q0Moc)uz+rC>c+nL51lRRv3zWw`2=8@$P
z=`c@Swy1|gPi?cC^%0iil{c_I!<_6efj%I>o?O7W*(I0Z2#dNmU5>_<5mY8yk7e5}
zMYHTf7y+0GHTl8j0>oLASE1>A$uG!8+AHIf50^UNw*u6+)hE9#P)bg|FTX<4-Z`;o
zILYS^JDip-^|@9h-3HR98D89yW5TYa(Z4SzMj1S?jFks{vgs?G@6K5}(oS^io4@In
zDTUR>;cv3h+9g%~;)_0O{r1h^?%KL}PSD+Xkjy<8fc|#Ot1Z-<iLRf(gN2$cjQoRp
z5dCovk7UztjSVD(6=5``m)5;-2gkLc&^_-#Iq3|B#kggD>Hf<3Bl8bE{cF(Y{QHtJ
zP_Z3UdK;kq1OwQNwtqX{(7hbc-(v|}c=!2a#E{y`{xEsM)s4T>Vg4;=p_v3t%4JG9
zDyp+nu7!4f;-Fv>9i13<J8^(|hYY$MryRBUWT+&%;L@F0yf1==jQ723?);oV8(me}
z?Z`2Qx#qEPCUsa}zHvHm<7Swgu3F!u<5=^wdB}Ob(eGVJ|2Fq<gVYa(bt|_Uo&86R
zc@thf_+Es`K{wV%)<^a2H~Sy#{Ft=h31$|*V~BpeSl9}w2#0ak8F_+@t~tTZeUqPR
zBO!T#TZgQO>wZ@C5JgYGWu3qJs68^%ZK>t=et#Tmf(DS{XbrlpHzFC`%p}q6JmYbM
zn)c?Qye|SfB__F*3h{>#-6LhZiHFnN8U19t@<Q%NjH7?If!9{XnXO7b_^z<V!w`3}
z?Q{pISmcI;544Pb=qjf7(ea_e<Z+98e#hmJ59_(!lCpE2|FtWZtE0tDVoAlHGw9W}
zQ`>rw?IJvEbGm}KK0;B!eglN32eE}UHj+=rqRT2huW>>3&FPm@J=Lc^zeZF%!&qrt
zv@N;eqXqgw)*5+AFHTFUkbcIC%J;fT6}p!bzal<73b8duX_s_~>N{#fAOF&c-^gXu
zlfu}pv#oH{WAh$vSO+F3Oqe9n-joH8dZ$Mnix;gh;8R;MM+*W|vl>2+@%H0>rx`l=
zOt!|R1R&kME?=3{1;^B-49oYwn?Lr5vd7i_kxLgl;V}@P`k=B$VxtzSa9;OelzZNP
zb8lIO!epIl|NE?cp}E0WfKB=gv1r8rYC3uS(}Ye%QD;G4w`-neK}RnxHQju83|JtY
zgrZH%D~ErF3UxLD;c*Q^9F-d$$VFp@=R8k5HA~Z{lJx(Wdds+|x;I={N(QN+JBE<%
z66ppBB}9-$knS8(x>F>i6fi-$yE_%Bp=*$a0R|Xg-p%tr=lz{e@B#K-d#!ujeP34&
z)AkdR?Wm85q)kxgiJW(voTTj|bEH)!6CsxWdSH!I0m43rq2~2$s9Rfh*3kLwc_qP~
zRlKl-iZL(pAd)r%-g^yw)el!N9iKh;x|zv=+B`Ci-nc?4<@xO|^<+<^P2?cC8q#Jv
z;e6v_M=KmqIn6~8^x{?Mhb;7SkHh+@$N*vCg=b3nVe;|OAASMlRx5H6%-O{zFMx7R
zP5Q~S3WEYcHUEqHoD6_DJpRGBX*4rJzJ^mg^Bxg*ue?2-e^<7!y8qsGk}GVd@nx>G
zmAF@4!LSl$bek)q756{J2fXupYT7r7N?l2t`Q494>Kl*be3-y&)aWPJpqcJx4@|k$
z-+7umbLBwNEl5CJq}`TYv}k1N+lLw~ZYM6u#Q&%a&LKmkwE4ao3WQv|^k#ytR5R@4
z2TrwJlnY&1K#}kLnU({pld`?mDTiHd71}&}@Xm4hse8u7JZu0^gC-zSux4;-i{k3_
zwd(w8I3E97`8&|lXz*@ySBV3M0{fHJeFAl=*5S`O&?eunTGF`#!HjzDSsdp=Z7f<^
zmvfXRk=~1F?;~YZEAg*&RZdJ)DOz+LLHvFeul8p#)>uI;Y{HJs@&~&rB0a5+l-2fk
zdc4|ny3>g&^Lww0hV$`?!R`^51>0eQoabxHB-N<m+S4a#ZbF9Z0h@zwyS|s)gr0^#
z8PKi%9sH?WyBg-$Vs$KBrexY1yVwaP?%JY0F4%`vmCTV&EGf*-{)7xa*)~7R*2sFb
z=ys?r!1X28G!>ewqAQ8V`#s~j2Ve+qyEh@@MMm`>v{eC`c!g5BuI>B>GrvK8vi#MC
zrj<6!z+88kmWvbs1yJ18)ph>^K$d#%6u1_ZNC+Fd_qWCWWvX$kpf3`fHP-@@R?wRV
z39a>cwU!)EqW6#Z8q&oJj2N$z$ZG=!ozyfQf2hw`zj)mxdm}tGa|SCL5{viUjBQ*F
zM{FFZw3M%gb|MpxYG56q6Y8}BCx0JVN*g7)G%ZEheqA;S8=3xW^KMEyCK^)0Z`ueB
z+eQEuFBR)2g>gSuydKki+7IuY>hEYmI`AdAKyxhCIM9?kAYPx?h?6!_Zl@eCt+h9n
zP_q<Ed0=momOzH_K45<$&SG=;swLRtkw~Cy(B_P``8s&SKe%<UDsL7Jb%^TfPP5BN
zYb|Lz#k7h`85<xUIKjyrj0;R_EC~1NAq1l;4}In;P>Rbws&_vAa5{wSrRidob%Ox#
zG(OjSqs5k@z%Hc0;fVH@=N;3WS0-BXL{7_;bP27-C;-10DUX|>XH=v#!7d7m5*D#0
zES2YRbx^GmGG^ce#vH5O89Az88;xWWv3)LnLh2r<BZY4+(NJDA1K^sU?Pd9Ltk`*L
z)fk#2v{341D%@*7cU^4%?X`{dyPcYpef)}*T7m2DbL_ym&g#d<Dhs+9c`!)%jy@v$
z&b0VdK98M1a2o*xcGd`jnyQvjRNYb&cQt<T$_4im^1JEP+rruj?8S$WSy`^ROe9~*
zz@EOP;B>yp@Al8#7uK6c3Gsd9oZhadA?jH^yc^>54d<7k?Bx)e#IuFsp{9gD(joD5
zXV|riwTC&*1Qt{dYWzu?uI1L)i5G4a#-?i@NXY6y{*ZDEVOLU9^XD~2(Lod&E<Xvr
zq@M$W(f{df`0>CYncx*3qDX1-O4@qH+sCKRKC$N)N7hK+*9hv|EF0^17uwec;HFV&
zS$fuPoh?ndvs0upHRW5<Db-l@MRjg)@=Y{tzB54@&wEr_Qd|*&c@{wO*pYa584?$*
z@%st+UJR{e+>3tos^_A5;l(M|usJ8}bia=D4O9{<`ePqdS+9i5c1Y}s&=PIl6qvjJ
zr!T0}UWC>V`iFTUCm{We2f*{RdhJMS1g;0uvA8`A1~*u<DsT3MJSuCfPW+EO&|8X&
zy{l%-*nR%!ZSB(<LSK*;DVOZa1euEc;uyx@ypWssg)}5~oQ*`v<u#f48n0T>q^!;P
zI>u3ajSrNAL4eDpm*M<r-ENr{!Mm9KkcU6I?-%N*W979+T1~&uk+zBJuDZ>Fxe>9D
z?i&PSl)VrhCJ;p~F~5nt{LXLas2kX$TZ)uBs$ss%aw=8P<7AoYN5DevK79r+mViDG
zoN0WHsW6T;2%-D_Nv3ypBSF(sX6hmX>l4laAD7?|YOU_ypp+e2c3@dD&2O0<mSc{Z
z3wV|4{z@5zf4~nixjf|EcDdmb@t3h)KsMdog#@hwlXq=GG12ZA2n`@{bf5R)BC}9-
z|9S|e%9cz?UMo^bIJQn48xigY6$9{pf)1(?BdyY~sqf*FQA-|z1`@O`bY|;DzK$14
z<<bsXjn$i9#`X{w{Ecn-r}a;mmK&s#v*8;9tuhy5BW9I1HZ;j_hT;dav58lv9zkwx
zK-;bD`fL0dFT%8NT~#Qt|E}A_*77ZlQz&`k1Us5|^R~i&#Yn<EG%jTTnIl(jzO@)M
zE?Sv-9fUpq8K^PgP#Msjkt_Jzr-H+$r>Pal%PFgxIVdanU(A$tZ4LDQh0sY;#o+^q
zF&5S`O3<3|nhyd_5fr-hVfVEc#PTL0#g&K4S*VgFu#C8{@Ha&%e^p@_vxr}}q8)rZ
zKMmUP^W5+Oc7{ZU1;|)<PI|kA3n#PGTvaAlL#5wZ1S?ToD7t1-F<OoQ+lsEXZuL}d
zDAp2OyC6AI7w86);|<VtSwXXp=p1sdU*x*X#@2^B>#LZz@KC}HC;7b&WL*)d5=Vua
z3Q|cGJqJ8Zu25dxei-Gxk|{CHf&&hmWn6}IkIm)rE6Nc>(K=eK`uY4@Thm<e9}=$b
zre3?{Tr}l38@Ub|$RwtM@hN%bVLUNmDzr&06jEt2P2X5#D~dR^!+{vdGu~YZzbj`-
zs8?DzwTa4{@n0FCr0CD+=xArwkyfo=Kcv@HVxx1D7{VS><DIC8e^QTC<m?<|uU8lu
zbfIf;n1T-9e)O?!aEWwL7d7g=sMp$;7@CZsk*%MTg{~#oZYIBU*IxEn=m#-HOyp1K
zE@o{m_MXo>tp%<vecLp>Y<a?w4)aGQ96e_n?-HNs^}V28XB<Xp1?ku)UX5JJBHFxN
zDWOIvt7&i&Ag3`z48s65J@MO<8BxYCZL`#^R`|#7JuyUfZFRzx_99%iVRqCloFAL#
z0i@Hxj+0UMXgKW?|IP0dxt6*<-13tP?y$!JAp;fP^_b&tufK#APnZU?-=|$`Bf?mW
zl!1sGHq%yK&Tm50z+AWb2owLM#iE50m**JeNuzWAT%{Ejug<{(l6751Y5&P`yWQk5
zXBT^k?q0T<W|z>Muwq}T;*r;GO-O&?t)A(fTPEnlR7vpG#fMrG8`KcY@KCA#hq|)~
z^Yw8Z^q_K8=zC?`(5#s|(~eCp&!gHQe<qdL-9r_6$K2E4<Apb;jcE<MzDT|+x!7Rx
zJU7dZIm($}X?d5ulpl1G1l&cpw#&h+Uk^UO>#1f;n!O!}uo9LXN`dAP?Rem5g@yJt
z=>;TW39}^x<a%+tMueh25Kay43&&2__Qr`LFjZ3jh}$u`nUJcU#V0nV)pCP*|Mne+
zC%h4M`)V{%9&yA*`-I*P6XBTyn{gfR=(21UNQrs)Zc&a2Yp>~z%ANR=f;_mFHw>78
z{(amnHWa8<e!?=NWK5^b=q!*jGTS@b4NExR7wUtiw)!>|NM(iJ9&5z890b@mo;D#)
z+E7ljUNB{ACXF|0cj!%_MuL|h)`+jHF}Lu%zZR|lQXZ5w`*oIzh;V*m)9KFV)|ADa
zS=G!hxsQHP%ggc7tJ9E8GwF9M9McB^H7RiGyll^?NW!8UL?n+SHW){Dx9Cuxtg(Eh
zGA(3D&ckouo{dkO{)(sBXX*7YW^9+Oasnt*5+qN^<3JUWkijDU`}-&M!cdU-N`5rF
z(5{cdqY(ruxRkF1Mq<^7KC>id{}u<3zzTsLow}ld>ut%meDJY%Z>FcFtmp)RMpheC
z{7>{<!``WojY&jD%f$<}h37%$8iC_Z4enCkSLv};P>2O4Uv|(?D_`Na8-7?)k@U8B
zmWkn{Dq=y8?P3g`Lxs$P`42%80%;uOC~D*W*`S0e;dF5*hQNW8F|?fc!C}dP?XGGf
zZydEjhKm4ec~3RZ;n7hRUNC9JgK?m>qeztDzL?(230BYRe%GHlrd$uSK^n<fVmA}E
z-wL)cGBQRdSlg&lz!o`6mS$pUNy^y$Exux??idJ5r*M^VEh0BB{UsB;s=xK@#of-G
zr`m!>JP2OBrTTc9oic{HNPa^{WL?;rY$_os=SM$^c#5}9yAOR>p5#yG;WG5}P9_cc
zZbHq}gnpqTH)XR4d%WwA4%u(!$9BY5KBfHz&4`#@oG^05ozxXUdl?NLi)ySLY_E;e
z7KbH6;ddWJ%l5;R-&pkh!UW1!;;DL+_MH_*RYioX2Y?cbt){hM>{|Nv{D{*X612}D
zCx$tDC8~S)FZfeQW7OsAS+iTK`x2IF%3q{@^HG?Za~^-;J)<hpIpm#e`}J)Gj@E!k
zTvuP57%)*o-Miq~wH=Ia7<5!jz8V!*c_hz<QUJw{2z2DZ^u#Y)Nn{oz3%--^EdWUN
zbtL*R&ae>>O`3@W_f-4Oc~l|H&suKiyvh=bWc<T`Cqu@YVff~F&7k&#9LJ;D4fR?H
zhAQc-ss+nd;&ww%MU&O$^bJp#ULGBEK)_x<@Su9Ijvc>Ta<U-77G`WNV3A9wthHbc
zR<JsON6OOa^%8Ki#I{m2ujYhhn{4O2M~-`)CCJ7A$$%+~uSHs5flq#?*3t9Q%KU$*
zW3Hr!Sww!$y;Th>io&N-+;QA+A+hTfZT${-Wg#m-=4<<X{=;@y;}g?E0RWtc{s|Z%
zd}`kBX|~Li>D5H8dGp3Ho;R&E)Esx9Q*!7H3V<@^t9#z0WzI3d>Mpl>i-Hfq`(_8>
z;Ya*6>{kQeSvNAQK`-QlMV{N{47;qH$4XpxF*MDT3T|}=xA!i#qBvS=p|VyaNXP+z
z<RA?7x6B2(UV%yZCOW)ogmqRgLA(^BHn~7tBMbk^HR<`wJzqt-W<d+9BN#BP@3qVd
zop;aw-^wziJqX!mXm5R=Hpo3{wpBa~yJyn7CwuR*1vglxZMDdCv!Cwnb-WPPp{kd3
znm6J6b#n;h=67@K3ZSL`9ux|O@8PlP5NzZ$y1>MHc?=ppJzy^g^S@}5wC&n{-tXdm
zq@4UCs#i`GyjA}y*CDV=X8g5djzY1x5ms}UYHi!T>gRd`u@&^3>dfp56OL)~bsrTv
zjrxTB_A7Gb+?30Y{ZA>6^fSF$hTKGkd~So|_XO;7<HU`0>GbP$Z6&{kNR?+qJ$0jt
zm*a+Ik=8a%E{p36>(d!xy9k2PvWu2*O8E%{6+u0oY@%TF?55Gv%I}<GN%uW~*m&8a
zh#i)SaH<j)=bWonl15AM6eE`UDluVUYpi0$GsUKy1u9|L$^v(OMe&`-+q(TZW0tN-
zE`vFvh>IpuexbkpxGN{8+gzAxtg_S>G3Q%PTN7vf_SomACqas=L@QN!NQ}j%V<^n0
zvR$g7grt8DarGvce&S%ooTt4;QZl(`0Pd7=EZOn~hVVfONEWodl_ffgNr|~4n)T?r
ze)3gX4c!hT15qwVH1%04S9wq~=pDEkOicv`Wjzut18N?24GJ5N_{#w{1b$VLsm^L^
z$}&pR{j^x1PwtmuDVA+8x9bO7lTSsuDR5GB!41htnfp`}oC;(b+jG9k3VTex!!S>(
z=>a7A!mHX|MBB!;QLMM)GJY}92MCRs2V1WyKYgBPf51N%#6<Ddpmzrx^m<l*_?S26
zz^@k^$s-5w9Q$sKA;pb0fGP{t-qs|elC(r^2RJ1G+2@k{x*aW);<=v!Q}JABm1#is
zHV;AF1GVelROZ2gs`+B!67Gu6c^6_0OE&7sGC#LP9|g&_GFE67wRH__d9C>X5WU1&
z#=kGp`4c$Rj{W5H1saf>Refz*3(|{*nFp_$m|SOvE*P+RV?WMOA}&KeFGZEb+S^rq
zkMgk+OZh=<ka+X-+d9DHD{-&AxmH`^o2+#p^d8?xl6d~i4d?Vz(!O#BU^o+Z)Yto5
z%qxAB7{?TEa6ydpsE35ui2TtI@B>=H;MR<Tfb4-EpR6LN>Wrxnp1oY#w{IA-w|k^b
zuzjAZj#h@gd-I7NWxa+Q_RWLWuiYp!uR==P%`Jtg`LQhJc9k4+%EW9Btoi7o+1<3A
zKaZ)9jJ06{6&ak1XwV1DK2(RGJgOpQLW8mAR&HM=bpXH~JFnu;8u5B_+#%ufz?zcQ
zKqDP<I=>Ko16S}<)+>cE^EU=Px14&YH>@bSz<Sk!S>2OHLFw04HK#pgD^iBtNRv!q
z5W<^KSrxv}^RkLI?8pS8ku!a7aXonWBugFdM3CZ<>8jqdw9c(2?#H(K&4VY{x~|JD
zlC>RzbFoM6nwu`k3{r+?rlseAN~T{-PIsZm;}~xI)qMal=bv~F6Qk!z#HDFsh<34&
zdhVJ~&pwmp^2~g~t@Km=0P3uwtEC|P{6(@;SH?sHEX%d6#ASHvt|O-bjyiO4!eze-
zx~(sjPI-||&Zr&<6In2KU8&0Ij0xg1>*G^#AiU36=qo=0vy2c6)F0Y<_R_e@`~L{<
zOQ2E%i(PIdKA7kf3!0mj-9G)InN?K9)YTk=wA;oX$3?B5V_c*h_!qXek6hZ%_DP#^
z5Bbni0`ru7l9db<3Fno3g%#2d3$sRrBaY@`@=oiH@7V5y{AJJ|Uqt)(ceKhx3d$0j
z#<U9D)d^o7jwf6$-a7RMD}8%}coH4D{6qpB+KHxWudt7_LN5w>4d`HQDo%F`mDFXT
zER?Giz9f~V1H?I90i}f*cv!Qv06`k-N=~VlyT%#ccV^BmTBohPBmO|S=QlS^LRm~S
zwA@Y3?uoXmL*EKZcT8WW0YoaFvEtt$NbK~yi`7c70XS0lX9Dq1o!8-Gnyp=h;VLZ5
z{-@*KLVE9gY;qOrt89RNI&`bW!xdX8+`Z4*s|`v1a)&|hw-yT&VPP<e5SZ4Xra5k*
zgtA=I^Nyt`sO<AuSvGnygngh@p}T{hkm7saGUo|TsWCY>UOy{o>w@ToUw5~wzK<KQ
zPUP_Fpj%Z?srfta^R7p)?cdi_vhyk@?0x`RXjF7FMp>{15v`)dRJNS)H^c&7u)%|a
z=_IYkw#&XMOuYCmJ+|d}o1USlNk6oy65M2cVOSQ~88XG`fI#Yw-z|37l?8Jk8>ZWk
za;NPN4+)dJR&Jb_JH`iv^`2QDPPnaG2dMu5y_$HOqkGH+G%W9Di_qR2`rNlg;dnfh
zlzu{vmXn$7Lqq?f)n!9x5dZv-2h*yNRckX9RL)1CvMqO|><w+FyXd2A*s|~J_LE-(
z1O!2Sv9IypqS3HGx}C=H(`Dq6NV<#hN-_n7+B<ixk?MuWY3*m8jZ{%BmVC0Fc*uUP
z7|bEeal**-hnNnQzj`VEaf@m*6K?gmgkjr1cbfWe_Hpw?qjoP>jJ!Pf_eaGdYK(aK
zH0P0YcH`gn7s2R?6+3v&FPYzoqO=+!=#|&7z==D5WK2CgcpELtG&c6@Ld`LPqM?4C
zshc_@i5vXhW`CnaYAsFH`e)>e^TIW+dV?UC>K>YG;yrv(()Y!0pP`HF{49UI6Bmy_
zk0z%f<YG76Ioq~Ssr}9S3ytQx%ixdf&f`HY+fX?WBo}-KXD><o)RWjUJJ9BJvsf{F
zJ{K1%zMPsq$x_@co+%~n+wLB>Cwli30R`h|%>IO>qY_upq_Z1_><10gH3=5_-POyC
zTL*)G3WP=?yLde&`Wx&rS?~M?XCG@kmgcbuhSUd4%Jxvv=n3wk<%b`cioJjTUJNMZ
z)&VJDlY2~Y0Kg2{!X)+*B;B|UtxR2H&{)P_+b(#{OH%}Tk$=MXs%@M-4;Pf6{6#q*
zi#JYFpsADova>~toke5&+t;t#Wu0PnedUQ1O~L?odU<mh1X_j8vT(GM)0&$e&WlV=
znnMdzSEZMa^tS%CcHy-}@Ks0LNWR}^onOgjDF}O=ypXt})O|JPxrqwo^$GgyGBB>t
zl92i+3=$uiL9!IqFQtEFIw<>y;b+xmdsLplgwM8%QlUhlN9s|?qqc&ra)Ak1tAedd
zF{%Y~7R|*Pu8hmzKZD#K<#dc@->6S98z^O_1%7F2k~A_h68wJS_>(;H!7_T1RkEou
z75%7a_8I9o2L@yhwi4K#w=!?FyVo#(fqQEBd|FF8U+C`xPxpC0U9`Kvu2lU(<;3=h
zyGJ$jMcUBzt4`H@w3qBa)|<jt)>7>Ax^a7mgF@wky|F-IJh;FveH5d`J`&&pRpd_i
zDfSu<66x&P`mI}&O#GZiPjv8k1U<X@aDt=ZH=TS>)zH>wFU7)4O(oh;zY=DYR<Bi8
zPIX)eVS8E-`N?qii=8*m$=O^nVy!;t=<B~9>5BU4H~5V#dg#hykR@IDPEI@$tf(HP
zM9i-U2-SxYCTHYBE&dJ`W=2zh-({-vm6Max6A1|_gEtf^W42kQJJL<5mgZiw-#Rw8
zD|XvOkE-DH2cnu`&ywJN1@NDcXDZ5UH3PM#_8V^dWjBxF7izkxz@HmbFy`#0?a)%J
z^tv3mZdH5bwJ=7(|K6+^mH<{9{MvK(Vz0KwiA?<V3xo#~65rnaa&mc@QQbV<@nV$}
zoP4>147E`$kSVBPWSN~l(^__n21#kHhnG|3N-Vq)tXOGZ+T4Jxpwh@@(tFES{$2Cw
z|Lc7(v%&BZ$}#kNwdGjenc*Q0r#p!v=!X$?kva%sBl0`H^3Y?mP{@Y8G5sG%cd^DU
z1=7T9KoYmbPSUzvgAB3NWeHgOogm<C{`#ceH2?`4cQsL5#LSuxu5{C*qw;-ux8h)J
z%|cH{=VeW)NKT@v=}~HV2ndf0PPeNP2oh<)N!|$ja8@N^D=S9M4C8rQo3rIGF)>Me
zdtNC1!yrC996;%A2wrVgu_k-h=`$ASYPPwC1KE99;cq<N{6}A8o7Im|SpUxmd_gf#
z0=d}6DewxiZp1#hxVXO^5fK4VB!{>=r0}ORSqKRYne09Lf8WZzPrT@KP$mLg<GW8S
zv#Ec<XBQU_0lu=YZEZ`x?CtGAz`!dPr$5*;d*VGlv}PH>5n8X_sObO3lsquNeb5x$
zmGY4z<i=*%%Zjd-ueP+SN%Liw2djvf*w(hX@bijpiuY{S7H>L~Ob8&6V7;&xt1OY=
z>iNdUR%V3|p8l9%h_cXt$;cg8=kLr6?J2!xoaym+GrCL7bEYd{&usQ)CE+5<-3QUt
zk{`SEQ#b@6<=TBZCR6ARTVJR2pA~zhg7=Rn2jCeUG#QC6cTE<2t@P;O(DvB+k!q~T
zEG;0hC74#}(0j>!SZLZVWu>12yp|)wZ{#>LCoj*t6i_nVS65Ia&#+GHv=Kc0;FY2I
z=#pcQ<}@ZXH(zpMf%@p*^WG_rB?Hj$qN2aG81wqf&dzs~{mM}1OBwl0s2%~@nKIO_
zy^9UL1ALpJxY*f$-<YF5+~!kpyCh{l_*0>PHIg$RJUaTJ5^=c=v*(icEo`x*kJsO0
z={!e(Z-Hr@ytTp*Q;~kf=iuc_l8>D7BOkM~-68Rxs;Z{gfd(+Iiv0dJd#TQMU!uW)
zcnba}rSs&MtwKw9xrZV)b@I}n7eA7(lH)gCE(wSrZ~q=hDpE;Tr?=LX2QBf81s66i
znNFTt>vPT_|M&$BnqDou`si5v;|JI4!@WHb^2Yc9j@+yxb>1FW-3JOgK%W?}5a_Z2
zM`bL3UNJt`tWandU6!1ueEQG(sk4KF#|LtnA|q;WvmiuLx|=fXIsR3{diV7FaX(T8
z#Xv{zsR0)oMEG<qQ{@6GeR4eXkAW0`$rhHc<>%J`;aNAAlIc8p2As+VBAox!N>s_Q
z^7b+}hAi699w%~o=9h_CJ8P^7NSCb-L*XY_m%F{tz@iMe!Uj_F&NFSPWMpK3U^_WF
zdN1>BuX2+HINe`c%Ku&49<pew2IKv<DEC}hCBvi%*nuKBAjkQQ4~WZw#w!urS2^!0
zRXp~1e;5q6rD|(yW2BFkwz@Ols~ZpmZ!+Ru-@IM@80kYS*c7A@_C1xAQB+iP(j>Z!
zPF<83n52-CCn{HCghn2*0#dDb`aca7{g|LfN2*2KimZoBGm=<$6ax}J*Gq3|(^iQ_
zE+sSp$jOyWO~&SW@uv4L(uf3X5Fjs4L-Q)jQ<hD>^u%y}TwXT+<sCKH6_sZiohtm_
zHDd8RM<NT8inaCL0OtZ$B=~Q~=n8qrW|r*KhZH_MWw*x}>|)33z%wT9@9*!{dQ4Us
z&T{{!nGu*&kjPX*P3q{`k9|X1xDm{av#IG}rfSuRYzV+kyV5Y4rXS~~dg@tN9Bu2V
zkbIC?Yo&;9f!zPMI>Dp+g^CMn3~l8EmiDSsXWuJazCRHOWmLccs0$utk`!_Nl_mV|
zuQC6p$kg{!<|(E2bmpe*)PLXsJ&Dw{b#;<B3et_>BK5(5sp;uW=|-SDV0y{>#|=0%
zhz*yKN*b`?(Y<%s3=J%^3H$2`Qf=LNgfCmOhPGxSS3AS7J_pxJVp#xA1pzMWUib90
zLCM>L`I-S>%8MqpGWsR?{l=u@{%^Uw=A+G&BeG1h8_^l`o2%997`=S4xPY_(B0!iP
zI59Cnr#P$)xD(kr-*nG9q4x?O63L7EKS9KNoM|ByL{wf`Q6XT<0hbh!l|8KgqQ})A
zl~#R!9E#)^(v3h<?!7uw9MluU1vVJ0NI%$xBc$+3SL@p!0z6h*l}B{yKF|G0t?%^_
z@bLe;HV|H5K!B%o-Rsw{2_So66fbMe&(Fte+`YX;>FMdEO=Q!Ix9>lt8vDP!1e4ky
zQE#qdmKCYb<kr{Mt4}`#CRy&^2O9d{a!ZE8-Vl5R=GWvo&QxPrAY1+L$b_B!eeXhu
zyT;sqGN4ZX-?o6l?7_^qRI<!RGnbc*CT}TJs?Fs`tBXo$=;^%++i<CR{<n#s|F)rI
z7*FY&?UsLkZEfun$mja{8E`dY=X*fKelOZt){dOI_WN*uS8PcBx6pNE{z%TE`1S5?
z%r=|BW??Zg+sBU|FIF4qo@s3V_-}{V(rE9uBGr*Yo}#b4z1=>_K-VUg#hCboO4Zk|
z{c*;^NXbS{&-=q*BMJELUwZK#0&_DUT(6hpY3SIO<U;|eV{fq{Id*LjuY=g{w?QNP
zUckYMED(jCoCQE*qb2ZNj3s(Mz?eLbc}D`a?^Q8yO#hi3#aJ@nWh9KIfZ*!_o3+;m
zFdbt0dntG?0TUpbYen5E_X|}1Pq{*{yTdevf#zQpw#s;5m8mw2{>0^gJ|<x_le9{>
ze>sHqaSjLYODq`)V1NXP(;}Q)UB{VmXWu>-M*oUo5?=|}Btaw;-i~USOl{%_1f=Db
z-$cj>N=?YjrY6O)<;38=va|d4-+3An{qK~723@cP%7IFWh`4z41V8R8?hgyKj3S|^
zq32J-G_gM8lg)Ho9k@wUw68x>5~l>$t#<vrzftu-OTCg*6ZgGF0YR=lb>4ppn4~Iv
zetw=_fhS+bZ8%Sj_@+lrd7V<a&iwXzw#7EqL{2hbI#C8ymQzq5ZnF_q*?RzMXhBZK
z|Kb+_sP|&X8j0wiSl&NKG5!BM@z0+>SPBqjBH*}_Q&MurOjS;BQ)ITcVS9UHYO;48
z5>(8tx2r8HX1@dR*Albc^JIOwCi#s<Ce`v-SHwPS+-!Bnr|_Fnj`(v3P2KBR5JXeq
z-oFF=@C1L{>5F)<ENrL+(p4d0nSHC0Ambr42=(3~X>g}kq+_?E@*i?T*F)ifE4iHX
zR_Kb*^U`q>t&4$>!ISgTSM9%pqq8rNh3HljRin+LySpQ`0XXd9J^GT^kKqAkeo&^g
zwGoH(aSGbLJ!DgT{A#VLKBq?@EdtmcT$2XZKH+Zi|5Vxkm6xA+V7x|NKvR4#iDg58
zUV6jCozkJP^57_D1BD0StF`ptQrAE<iuJR)yp&Ps$U#GkFHY@km5G~Kt=vMFB*aj`
zw8xiZaUI29r#+*DO;$Csl>4kXd9T~2HzmS88a%3a7|6Qr<xT@^Lu9Jr=l`7=p02n0
zGG8R;%*@Qku|XhlzKEwUf9j#&9&V@K4wfY;tz=*{IbIAm@}3xw-BxCcRRuS_E2GkV
zw5(@OR|rvO2k2GEV@>Swttqg@9jK7(>y)h>t3uH(M#N!+UZ(m#%8N~zhoq$&@2@C)
zdwaXGr6pJL-U|g+v;B9UQ@J_h6N_vCG`+RS$rpms()7&A9wJy(YSKU6;j>G7_G-^P
ztWw7}19$emdDhGKE|{57;U?TNI=E6Nv+ILffPV6~jEhrl3XsP1EIvg0kkGn-NUisr
z*_jlz+AePLoh5yA#M8tiH@Bw+Jom~+pHhYykg>sq_rmw$`@<3ZIaaU_Fohi6kf9*<
z2cO~NN-=p4O2T#`CT0C!<2~h)iDZj?CEQ0g-6GBiWqVEK)-nC*wsAIxNR#}zh)mod
zC9%b#7O-Y-Z*s{s%#;7L0H8Bv?mse>dw?T{c(v=ihv`o6btu5_s+}95>An^%vAEjH
z?{C(%hldGn%>`fkeWQqBdrsMTgEecG)gaTx1XghVbp%NUxyZxeKSfu&qQENuY4>V^
z`(0yaB~Th#`{Vp=jA2FD5bN1d{_oGq{u0!$YdyknUp;^R{0s^V!;VRK5tTmy$ALeB
z+&Dmr;1)KEOam!wa9Id4T{F`ex0kHDf`dQj_TnH8#y0IK5>9XWRGGxwl=4jEhM$W}
zV`ZtmBJ?xl?{H%<hiRNy6>6@7Oi}#N{Q^`zCz-j;S<+a~)cFQP<(oTx(^2}#hzdEI
zpWpDk4n3HL&#Lqbs#FlF?DTY)?qdF@u>oW7Lo{#l3+bfVURx^W+V0qq|3G!zJP9Ue
zfn|DDY2FT^t)$fH&(=IQwwcOQf=Pd<2X(dY_ald^QQ3mcRs18_!*8gdP^Q}fn-v|9
zu|PI(tMxd;B<w}07VzTibr$}S`8NNaJZ7Jma`{Gga8{Y0JdcFGE<1~MOMdaQ6+L(j
zW>zL)Q3QIjQ7wZjb~VwQMd8dp>33hqu5qZPsE)9ZI|%S=EVq+`KVY+YrxeSydV2aN
zC2#L@G<C$QywcBzJpC~EJ-{57h~9mLAv%NnipX%K?+|@AI;!<8Ke($hg=0v5zjY?B
z4l8Z{h_>vk`+G<s0m@%dz3CHRz1alTt%?cAgbV~f22SdPI)k_pb-XTOeq*5Sm|2k%
z+WRrwGR-qoJnm88#$-mB-8+6hK0eoW8YOaFE?s4AJcS?yJNW#B;S16uzE~5|?ifjB
zRyNy#6L8|amX#vW_$gGRSG1oZ4&l}CQQaq=5Tv@Wp9ni|SPTiAu5TBQBr7sw`<W7$
zPVp#t;QZzmE_XB@RdV(HE;caTsS_$*YB!tFhU@RH5zDgk?;l>-;0Lji&E8hWleJEO
zGl_^=@lo-gOW6=t*F*F|we1Ko#M{9tAy^txLVs`c*oxGaTGQ5N3MIY1dhN~pLc)Bg
zXcgnX{mEna7hITs_dDe*ntsX5!h3MGKqhc>bF&0rx2&RqSiBgQs+R-wQtu!5CE12N
zh!o>l<65T4=zwe6Up&<(k3$w`e_65t3g+>?fVs5>N~tv<?zweJ)8=hBCp+_%OzW5-
zW-kv%CG<1lY<U;-gf|nvVKH_Z<rIxewX9@3aoqd+6Uz5i>%cB!r5As}1;kaLBgJ`&
zg<^#K*ibP3fvd^oO`<qM3RuNd70xOJRnH`eNU4KZ{*W#oT17+LZnM{x*tnz<p9m~z
zJGNA?oo~39-SIA^oK=Yda7jH$lJzNphq(Ex>=eXl%8ctTOfS3YQ-W?b?E1KQl81zj
z_q&CjCX!gnC<_M@)nd2_)mF$fFh}3s!eyzV*w&3sKoL7)!Pnk8=6pjGk5SuLSKXCn
z<y0<wJ}J342VF1q^@}@*vu)ay2ho8t@A_m5GC=TKJ5*{x2?lRGu;jY%9?Qs7`t|78
zXTmUt@ol|b(a4Ns<h<X$Koxl6M0KMfXcaBf-2wOwdd0=XKdP##7641VaB_0OS9saW
zG2Q`i$#np`LUvD;E^8Gv(^1(yv)|j>YYKR=Z-Mz7ujAD&-c$FJ7Aqe%JfaK9hSv&J
zD}bo8v*nJp%YAsZ^lSFtP3}#H7KlqsOZYh`E_Jh-+q4Vn4!Noo(<7p#Z7(@vw!kI*
z+aL8ZnlF>&N^WIlhVmH^KVTJUWEuyz)t2S_-HkmoD<o`e)qlJ3aj!zHRg{#lq+Op9
zLfCubO_(NZgqNu0(|q<}cn~K%z;BFI;z-XD-WLo&9<4A1UG^}w&(LzYi9}`;WPbce
z8_DyK+d$|?Cx)@ostoQ#HsG~BcuB6NsyaIKo&zf%6`SfQyj80Bj6#K6{sG?KAPtP(
z_rW8=4=c+acqAQcxCus<VbrIfZ|>&?40!`#dY&CsDIAd*_x^3Fiob0aP5Wh+iHS*I
zDa0nJvI52fShn)2qg=cKuZh))IpGKr-;-5GH#ap3mFT#1ADkm5z>yEe(E<X9vRLd2
zK4d84ZP3&F_Azj^ueU5P4AG+CtoZ?zgk>C=n%={Phy<%G4jwBi4JYq+dzJnHS4Yp0
zEH}(Ey|$=LfJE{aWAktSGYUKoI#GHh+Y^Bg1dQ2ZKxAV;d7p&oCcmv%D}(ST#4t)(
z;Y%XFe*3m!IXCcL>>*<~;Nv!!=>EM$tH?1G^Z{`f*S#Y^Qk1@CeW|0P)6Lx853cU-
zOmGScYDEq6RP5I<DLG;H^gOwSXr?)hbrG9KhBblvs;Y!Uq@<koSFq)@o;2&s;Lvz0
z*iIzyH*?k=J(jJGUw<@dF7nDE*k>3Ws+KHsaZ*BGdvibax&_bk8fV>hUMVl-sJY)!
zf@n@sMYfYNk#{~UlX9pUIVbIJf6y(E5`yW!f7>vNezHkYMP#WSEo`9CaA~_(ljGIl
zw>3d`CHvE}v&GdGoRW=T{uId$V#65aFs0Fcc|&dOG4xvy7gkbI5*iMG<zb=@|E(0#
z%R?eF$N^tpZ>zVPbcwznH!?a4h>UEz<9|>w%7sWTt*kIzTwFYB&wmFY*y@U5j|sfk
zSI{W{OEwDU5R`HPrzqLDAGmYcvnJK0b9TlV?$1O_?81~xpO~2F4TB~COP1GCVRECQ
zdeJ%P|6D7MkvTF|Paa5R{-nQE!g%;Fkx1$%UEWh4?w7A#sf8tE5Tf|aW0|VW%*=Lj
zG5yKnr%<Mc&}zfZ2z+w}AT1`jmvbNd0x5$-IayElt_aOQ>i6BLvgQdU$3<0&;@6je
zb{$sxcH6PPuX%;uNBRFW0i*};Z~?C)<uJPar`~FhydHq#ps<6PWT7Xn_hTCWt)1N;
zV4Pfg4VQWbYQ-}=Wi|Mb`Q=~GygFbQy*5`_c$Bup<4^akZqLrV7ee6egJ8YK`+;*e
z5}^nQxFxgZZxa8sgug)i#(p2~zf7L+*i`jt8)-C=5f#m-E~ROfAC9Lm`qScj5Z+0<
z^MW>Bz$t+|OP-oqmWY^G4VG<Fkdf;wPN$`<owL3D7Ad*?Qr#^DQ#U+}Zcvel*b2kS
z8Xq4Yqo4*-lGwV6BVeDCo2v=rB;c)qI}y|YfQG>V+>algXR$P`4XNIgm_5MEq5jN+
zZ9i--9>7>)g!qq*k3W5`XgqO4zXc5YP<_@^2n=jNnLi1>7WFJXS$kh?t@5|VL-S`m
z%RAh3E4|(DG!_Ou<%dm#7}EBts;YYAjp|KR-97;!A+mqx=l=n>3GD#B&(r8V0#*+u
zwd&)$NtGvJq^5CDQqQT9Yt*}315PwXTB!e(LE^Lc_jNsYlk!CTNEyr4EP|h$!njn%
z#Px0~hj$Z7`{B$Ruk@YyNSW?zd+F*sI^=9|oCz39Bx6;E3GW1y=DH0mEK-mHqBo)1
zATG%M90)=(7#O)|;wxnD=(vu=;*v644X^wdPLe37QnvT+9|>!A8RQOE5VY16#T|dV
zYE7Y{=lYm~Ba~}d4Q%D;=(vfNi#nuW8QPMPk}|Vrx%LlmPxA!s?q2UpDG2VX46<af
z;xnAkPEx(Tog4b&jId9ugv;dhQ)YP?bUfeXjXWe*k9D4bl-w!fO}8NM`+-taN1<?J
zMjAkLm9I*~FDNcf*<ETBNSWTPyKM3hnj+}Wd@F^+ujiT?Ix?PmBoq~kQTBfK`~C(V
z<jXriW|U7qGSh1rc3p1m@N-FljH#KJ{3KUX{c!Qp(x`JJ8)q0JIiICNgX%+Z8}24Q
zE4{x^J4uC<Xx#uTWlYs8IIiIS5US2Sb@8g_+?YSofw9uC7t*$q6{tyNS<PyGQ8BS5
zKVs`rit=J)YQ)d`D+t7V>mhS2P2Patrx5Pe!u^gT2~si&$lw=RI=cJ@%2sgz<~Au<
z;D_rkq4Zc<Mz6~!!ouN^XdoswGh>i;WCZLAM(ht@p3@|hfVey^4v*^VcSZ7lTe{eH
z#yH2RY4o{9p{JV~K-~gJT||uBbx@{JK;l0WRG*^7AtmI1cT^I8(vO{(@L=c*328J_
z{n*%;`rQy%Mb8(IjAR-`viukf(y@e-5v0e#G5bQArEDbJG%zr5vr9}w<PE?ZX%RdC
z)_YiXc{&F${w`J@BrrEO+n(vJ8DGl0V3sAHihBrPZuueB)~slHpPd+|pFfB&;?T)+
zXEZ(j{g&xDh>QK+ZO7=Qs(iOua~ZTd&E@}la+2BBE+Ak5uM}wG7X(IbUGuqFb!NbL
zSPazEg5YMrz$vliRFsw~#s2AdTQiTRG)RlsDNb4L02**2d0Hk6os)iYDn^Qp_Pi8a
z?~2+2AbP$WhqnCs#djQG6rJiB!HGdq-5c@3v-dv!)_ZiH?I^-7?4<3;p1Ne;!|YyT
z{t4m?daywy=j?D(E(3hR0PkX*Q<k(766>l9mnn~$p8h5sVndjdpU)5iphYmRRUR_b
zT02>;w1FYMcQJyv7V$k%@5F!%26ZoK$`g(C=jxIgU-S;qf)A_S8EC39JqHx9Iv0>q
zP^TzP!fT9slT0rS=+yCug#L$I5+WiZ3Q9^5fk!~QtoNz0(hNDW4A}NG1c8;7E4!yV
zp2V{MM%KX&ssu3fmwNzBvD`f$7g^1R2OHgQ!z#Wz4h~l;e$MUDq;miP)}%jv4wOO&
z3@4JP%V7m&OG^bP4*tA1u^ta`RQ;@OuDKo4@#9jf*JT<_3-W<EC>lLkW_o{O{s_Ai
zCc5-*6L*|==q-yo+x7d=NtftUvCa#*P;?k^&?<-j?Eb)HeCg>O4NriE&qS)V-^nM^
zU%bWKUks{PZDcx`4T0*|nejCP(N9vvXBdE!^phHmHN$?Hp*MEC8lEO3BQs_}Vj~0U
zby80`#H8(TiUHxZwY8<kKGpi7r}Lr`Rt*5-d5u&AA2=~d`tHw#N<?O)ir9_c?B*W@
z!R-#LIjt!pT}h0pQf@%vqg^ir@1#UhpVb0(5^tctU-1Ysz#VV16pMtPjj}~%JOX?r
z14(Man9e9iA0Qz=9^vHaNy=ziD?Zq489Min^NqkDu}QQ*8AJQRM-=~)fHO|d^T>sW
zkw@V9rlzKS0QjR?06L_37zFf&wmX8jFu)D2&Hujc-NDf}g`C!@z%$3jM@M5DX??xD
zBf&<H_JAY43vHaD4w1BIOG``nM?;NvJ1WkK!|}s4G|V<6`2Vdd9>@*;cx{8Njm_Vd
z%sVl-<ALZ+DHI+ExzI%HRc&m~t%_`)O(*7j{Fr?4qhiICc6U!J5GJ{OLseimF5~x2
z5`e+>>RMhAWfOn^)x>gYtfR-jR_j=QHX7>dZ%8+`4t}UBtqy6)?buNfxc+k#3M6f)
zOx?Sr2p~M00Nb+M&2fy}O`1T^8h+26jMq^%gXPfIKMqKubu&?$zEyOk!H*v186fX$
z-{)xXmEd1jop1poy>Lp%k=iyN%EC_lq*F66C}@#F<b*L7sB;Mew@R<C^Em1gPS}Xf
z!r-T_v>2dFRsub%V#=uqMYKpN8p>7@e@(OdMeTbwWG@q0F~Z;8sYCTq^FY}%40jgT
zXiO$rxVr#P5A_W8(LV?#OJp=Tb~K>iB|S#slkhJFj>8#Tp2Ipu!f*9?Zvd*Z<rUep
zNu`cE0rXZ!YmY0MP)VIc`tEYWq7lHWK=-!?(s*6uk1TBANLgeT6pV{YNGNR%E3PUg
zt3S@R5K{QfOj*iVP7rGX)DRiY(d13>xQwQN^_~iSThb3yM)X+jiz^=9etv2r-;3-+
zEvY>zsjHE4XR*+UvCy}!vi=Pw{K|{3%g5Z#f(OoS`XF9Fty0Y5FnBV~vX?!}7awfo
zjpxxbSt8bh-tl3fQd9)6<g1Sh0H}j+AYz@M%Hjk3ZAlVd)W_M@?azA^9d{37DF9v2
zAs)%wb9{W<P~LX2AXm9Q17|K9pO~;as1=luXn5y08vo^Rsrsl8u^t|yW?^CBEv=Lj
zueAOYLTb%#l>j8z33PeW8v*`AIx;RIvwS2l#y*HK(#4~wKJ=dkVr6Zb=>(<Pv=<k%
zrgFz`@&eyf3578&y(L<L?IptM9(+y~Os}|NePpH@XLQ1busHy`>D+9P>9HQAAwE^H
z9vpuUyG%V<7I!7m#SHIlLoTBdDR^YvqD~}$TWf*h#3qP0Qy#Pt{s!DgMs!0cs-Yv`
zYQ*BM`5tV8>8_;%)neCcQd(b6*|fAMyv)PX+_(kc$u#G=>8(C+Q7E<IZ(o1szKTE8
zIB^*o0+<O2yIAYB-afuCmf2xrBO?$1_Cxj^lN89`IRb~IPQfbYShcvc#6Uzu^fZO0
ztn`8nA^4VfY1XOW$#n)7hhWCqd{kx3E1!;01ISd$ETHma8q(#QXUX#eiNhtNpQ@>;
znR!C}=S0QD`5#0+R*cNf&(}7#!i=z)@-Q3}yvH^|S0XB`Zf&#7W-LQnMb%N)sK;@a
zzPIy_TwL?pB31S__STtu31O9m`xUTRFP?JjYKDRNz##|ya;0*Wih+~rj&?@gH&XRO
z*Cq8?fsEH78@&~pasrZ%|IJ;Zxq@9z;5E}?LrtRg1MQmMLILh=t@Wi;{kik>KZImD
zqA7mEkBsLWy6y-U0RT+17>;2Zb&u7fzkmKjfcrjmbgT?AXNIm^<-cYg{1V4C6lj9Y
zAI(FVvblN+UB8qiRWu}2a|Jxs8{%xh?m0N!d<8(bjGfeA4RhKi`=DzXK<;1VaATR9
z#2nr}Q$Vp~QKt77qPvM|P%0CCdkZk%&3zH!fNrR*f~eF5;&Zr6Ewg*u-a@GskhlB#
zy0Uv0aX`Fn%u_J>_wU~^IUttIZ8)->0RT{iw9=fCV)10ke}60#1ZUQ-VAXAGY}8%2
zRolLO+aD}v^oibz=8@V0{~Jbm`l{~8IjXQ&I!80ky@RI>iU(va1Ez8EVAb%;kZQ99
zk|5Y=1lO~I3OD0&fwh~2h2O9<AJjy7aG5?T`c6`LmJ9as_gS77{++DSxn#(=%EUlJ
z(@su*xyXXRid}GFmCsW(lhmW8LEqqCjZ~q;I*X@6n^db9_A8&S0A&wF(V$o0Wvjw&
z$ebE9I)BwxrJUdnt(mMYH8I@csIKrG{l`J>FW}p`RE2M576N1Qp#YmGe92y2p%X@H
zZhCd?4l*Tg%G?$yyc+!?u@Z!+0;;bQ^9p56fJ?+-kCH9;93Pqb^1ibq7T*GZ00vR!
z+gc^9xLaFy8_-eb95f*&tIbWob<39vBV#yb0_M76${@4v?U(N;erJ-ltPVvvHEnbz
zeZ5`u(yGHa!t^H>4zfC!3J+sL9337K0X{bs5Iux{{`@%#2y8%{Ts+E81fHWBJfa?y
z$*0wYN7iCglxI+x=SjTKsw7F{p6=FWg!CW8gx*|~Q8t~0ymr<ALu=>A<1EbG(=NP}
z1s#;?*im$RHvgPNCh(+KP9t~k6hkK#G$FA7H))kTc}InMEuygII%n5+(^$h~SGIb$
zCZs>iQ36gg7_tlH59k-d5U~plm9f%V3?G@j0qWdqB%tT~@HSf<*M_lnH~jTBA7E5{
zHacH_@ij(!YGP^8lP6E8KZU9h@$1olk50UMQaGscynL$)J&RRnvmAW5yXy&Uls;Q$
zi7cbNFLyPjvPJS6ZAjd=oa~jI&>8+A#-lEsUAdWJ@B4+2k{S&oHn+R`hwt|k%a?sU
zvlc6CzrCY*Y0=|Yl_O)Tt=v{Mk%xr315oiQALMD;-$ftM7D>PP<Pim6RM{7e^x3K{
zP%%r(zk8RJMA5K)a4p$_&Rb%7G$`FE-0CK1tkAQi*Ue_-V0i34GPj*o9DF=~lv`6K
zYj@smkLv{z|D8<bRs;<)UO1aAgMA3D-VLBKXz`Sz30`u{msJxF5%A344XAEr@CouR
z8-1hyIHc{w?hEYC#H&LkIi>w?<E+Tczq5=esqGtvGnrDS@j*mi;DfbiTW(%QAnAsE
zxN#)M0@A@1fNIFzps~{d5GfcK8OImUD0Th`G@?|#TO-)sF1t2~JSNuk>S2ENdnahB
zjX5lfx_9^AzcrLPhzsvNn6>WhRMB(bg79BS26g}YDfon$QIf<#)L1!ufKm}h&SxNI
z><g8J{WCn}YAK@DiAA8H<CJ#vFPrDs=qPq`cY5?^e5aH<xfG_pOIdjp6&`tBqcsdn
zwYQFr+;4D>C1Xu}MHv~N)EL4(M%Y`mPU5gNq<@rJ8xgKZ|0^|xbLlb_lD#((Am?S6
znA0#ajt@HUx6)Rwhf0q7SE(!@TpZJ!%;N+RAsx`*kkIx-q<p#${@pdz^f~{|-Ur(p
zWy@1UVgNtlX<X<HbnyIo0?{ZdX}*vwC*UxFZ|vy`eLRKujk*?xujAlswo4=MLV22w
zpvD4l5%cM4vW31<At}3)^_kXNIXSn!KTsa$2@|WpE~4645L_{{HxM6<{@3=B-rqdC
zwR7vvttNGJH*E0yha9?+uIyPj%d3zVG!zj=4>Y!gVsYrm3qJn;Vdl$ZYVzaN?xS=7
zaJ9i2h;j_DM&eA4%dgKEn1o-oUwnAWr_jzvJ$f~+&&L9UdHMKLjt&lZ3ozJH%Nz{0
zr|S35qq2T5WvwQGpDC;KyS>_M4G^^%^GJWHHv3vv_czYeFxDITp4njT&1#Ye?n(C}
zv$Q$eZ<0Am*b&VbB+A=HM{px{>%k(8i>zRwp_3}aXz9h7hnFXR=v`CLfF|88?K$)u
zx@{m8V0M$8=QM?+?-;l|FMYECH?FnluH7j(bsibiSP#VwUb()up4~2gp8Rq`Yo-Z_
zd4yXTzLV#VHui8T2dc!FS!6vxn*e2*|3{T6GNzBbasd&JwBB6oyE!V|fKy7=*Znd)
z5)tZ(`;F6+0#})jz<RBXo`wcbSEZ_=V&axjMF^-08uN{I0YMV0#+QorYe%*m2>{!x
z;_2Qx(DF6R<N86$ikIN6fBdZ~j0iE0qU2~A@L3NanK2rQgCFdaBj)DnoT#uVYy6JP
zu>^>c4>OtYT*6l^;rKvCl0S%iZ-0f$DfD}!aRNoNo?+R$S?vW!YJOs>$A!fsTf5x~
zA&l4O+1~__-@MjoYsp%cFK=xbyZ@=lVga)^2P$5Ys=i4pS*}b2JARrAv2|2G11C|+
zO)aPN97x;E<zpHm*K6}L8FsU8cl)q@gnP`O>>YI1X$boEng%13Zz_1OeXbn+aQEqA
z+cQ{|9o@AP-nj?@R&6*P&&|O?PI43<>?dq!KcuCl)hMVIYckm4bGD<~U_p(l(^PnC
zJ17-3{QVNm^MaR`U~@Z&w$Cc4D!Z}G-4!OuU-6c7bm#+tbmP7}-nBmfG5$bcEp?p|
zQeyC5&_4x<2hh^I`j3D#)e>>u!OIs-#Qk=%J)(t;IB$@9D>vnm;+L988c6hU`|D)u
z<d##P3elE>@9q=%p>5yUB+HSSZNxc#X8KKid_v6$C0h^H@WGA8tb`8*RmxA9R|ro_
zdt$b~?E9(s`ud9J6%-J~#Kf4bAD^6fIBU+%&I%a);&JIqm<Gx>%<fIf2;X_=vQb(O
z^#|p-5F%%jDak5^!t=!=y6+PS7rHP^ffBYhwghgjVUOSC507XL$!0lGKb?p+W=W;S
z`8EQlUGZ;yqSVXxVX@^Z<7wWZCr;yDZTub|SGLC?un!XEXF-31rVz0%6Ou6<zJ9+>
z4tAl9b`dz_v8itkR+#!&C|C32Uc71{9NJ+2W>VkQ#t=n7S!rQnLdX61ZLpEGD5w}7
zO+I#ai^B5nJ_MR>WaJ8MWDP<&isU;2(Ml=VKwPs~tzwrM!Sae9q?;j%eY~B{hB*G6
ziADkrDeZre&|u0#e+M9mN|DJXq4))>N6g|<Ue<$$E05#@(bTw}hTSXAMI5sZ2O^*>
z;xW(%UG0h)v+eK;gMIs5xemhSNA}RkwOih>IA<2OYz-vDvqUnh#cSTU^tn^%{GOU3
zAtEHS_1m9IQwb^m@#Dv!7ye&?U)gEZibn5#COpg5GT=OrJ(0W^At~KQtu7NA_qSj2
zdNt{+s9MfO1r)M*=bkt{04I}{kByx-*_z!nW1mZ^8U1z{maTG1`uW(J=3pd%X*}28
zWjAMYQ7P}TZJ@r%>;GfwE!d*!zW-sG0ThPr7`j1}lpHz~LApT{l#q~a7<34UK}4ky
zl<w|MrBsmak`8I`zlZz#{I2H>z?pM)to5mNy6HCbICZXbh|%=Di=lYUzpoX0r-~z3
zdaIrHp9HNx+y3X2l)@Co4^)HA;@)&;7r)?qT}70k|Jn_tA^S3sgpnWEltv=WLMXE(
zZ8D$@R#jOB43$1WGG}O;Zq5&_vZaMZdb+8v#)lCl0M=T+odMmupDt{4#4Wq))6jSY
z{LzfqOd{0$mQ+BrxpS`N=2sv|-0dQ(U8G0=i>8FnD^k3@JcaAp`Z_0){AGl49Cyds
zUY-U+%Ro>*e|ukH?FxM05oSqKQ$Qdvh#eZ#y3`eaN={w_5aoRTJ%=^BLJ5&5e@%m*
z9})>R%Vr{(D+2F-xf^(Y)xIO(_@efzNX<><xWo73l#}!Q$+rF9+Ph(YN10aLECOzq
zGY&{tOeTmOc{(N>=g0(YyN{+#7tDSc-xNz247u1ll$2zyo_ekllVnFNM>QTRwj#;?
z;CFGcfL;6HJIS;fXRbM!-n*T17CYlYLp9aa^_S+}hJ`GjCP463J76l!M9x4gjG(-H
zm*!f~GM)-S2t|!SjK7zO^_^iDz+6Q-F|9X&&iq3%$*j4XD^YF!07VT0%69g6m#43S
zpwsv_&>Qe(qWRzUH{5s-%iLwCa`YEYf`<^=Z(Po87=uX#15R@1*^*)s%Wxu1*OXwF
zF3Z?7VG`*hmqA|yZ#z+8++Oc@9BGw8%tm_|ncDs+Z?FFHeI_Lo(QURJ!08xYe5PHn
z3mHm&Hwn-)a?Us+!XDGMfhy~@?npX_jQJ6EHz5n=L0PZe@@aYc=gra{>-&?)_Mcm8
zEX|AwLnKt;wVWw@ld3Tz^MS*Kh2v8z^+#rdpQnDNmzlqesv!*;d*SygR&$%VrTceN
ztsUnO{=5VN_s`*m=aC)5<~aVo9W+Rgn=r)F)#p#+&N~s<SEhCofH=e6NxhUWtl348
zKiqeo=!+YL1+Ar}F`dv_Og?`6cyBed^=UpMf|YeyZnot;%5CjndR+~527rgB+XxEU
z5wR~Y7Q{QO8z9N%ks6XU+Oj2&wdfXt2u>3jCft@2JsfYR{b9vhN+H)|!<Ei#T)g=#
zRr#!z<){9q*6>p9Z!7qffYew~MNm+3u0A_m0|7@cw=Y%`*Kb3stHmJn#>}5+fLj9x
zfS)5?y~D$C`-@2(gp8*Q;gx-M!5$E8N)p+^9#4c)zm)%bCwZc~qpzLCXPX_v@G+$c
zk326i6xX#br;iyR6Ygv646IBsU4eVAKc=T^FGw(i1)v7G#v`5FV$Y|4bDpqX^tsxr
z9(RfMdn~=Q*=2j$RaqD`wnMwI#^KcOvp6Jot(9|?-SWWS^2~3cv7A|!?c`H{it(=K
za;L!M2j#S)=4M&a=0_Z&mAj7zNlZyAH|q51*l%OD{<A}HPqvihtumOE;y$Y6uw)vP
zC?y4r<L`~ScUWJ)+I{;Rd&RwbhoXjx4a^LFv^H@sf0PS`D5L-{7Mc`HrM?<M)ACX4
z3+wIM>@g1xa(xH%O9t+k8Nx5>?tjxT+L16c-~Uwb%{=|uX3%#UU%Hi-=Ll#lm6TdZ
zY}i#fHx;K728b-;#ghta<T4hzRt_$V_S^LxJEpI5i2<-a6YGGq9Ce=FgoF}s(thuW
zWx98Jh>72Og#R6))Ay$(GgnVmK$GR=UDTJ)PU#pjafjGjVU5D&LSu><37*1dwmX^i
z23xVV8#?zzlEe;uOcrLr$x(4EiCcEz<+KH^iBwI?7OAfdR2Pm^w#iPKV|8me#n|ez
zkL`&zE0O#`&RZ4J6+bqYCpI?|H`^<^M5L>iQ{`*#;0QnjQ7={f>~w#d(C;<IGDx!O
zQz*X^{q-q~C~HjhdT|&v`|I!Dsqbg0YZD6Dn%|#NTbAa!l|gLJGHMf}0c9OO(ByX-
znBat#Vc)FNxZFrq8qf_LYTVZGKk|!GHHAS1)(AW{x~QeX#CMcAtX`d5;s_NcGEw7?
zpG;gdm;a91<RkfbpI5jBKTy5{+D&4I=!pNT*oj9;#T9DEuI63FdT@>Su#gZ=4-xl-
zbDJCu;AZ8_FnPCiT)n;1qZT-7r+}dF5wf*>(0F?y=I?277|olZa*N6FZKNUQam`_h
zrP=Q}E+t}@=wsn`n*&}>tz3H4cZN9(y4PkJyi|MEPb^A)oO~%!P1jzfHh-lvSaEQX
zrIFddH6e7}h`Ju)NHv|Su>fbV-@(un0lx<Hmk+bY=#_FJW8WX-n+mLppg~HeV0=SS
zELS3*JBNS!)=TElJv6<g*BPshrW!B9XCA$2I3c#4Ua{D#J8ZPvdrJDA1Tfniv}lCC
z-OuHt26kpd#H{IsWy4n4UY75seu)R`V=`f6Li9o+Q_{;h@0Fe>VJ-I_|M-DhQ}!_q
z%5!NoW<zMqTxt0Bcv&}*>NDcVmlht!{E_6>oUn9*=EEG706}rpbrXN{OPM$?HlEH0
zvUqmdJF-TZ9LcX_`MPoHBa>3-&!SNM;{_g&ajgZTI%0+>=tK60hD<I|((e|Bc;^E8
zsyZiK?n*v7j@l*J3sS3z^@D$SJ}SAKc6paD2j^L#)7gdcZm?kDhWqnyf)j=k<fq4s
z@oA<G_`F8v_i%P9QVml-aJTEpx)NdQ?$#gYb2QayayVxS_2@aJS*(xK)6v0~6+7kg
zk!xFXfEx=1(&9X~gSs#v-%8e48rhX;wr7;iC1g}kZa+yb4obeS5`6Lt-BB0&Z}Vve
znx(J{RiHf?8|jqq6>aZ^KH?H!h<l5PfaH~O2PH|vl^<sLwzN>GW_jv0WKAet6kPKA
znpc)+AcT5W%<S6h9yB@$sVJ|-`;m_DjXlfV9f^9D*-S!O^RxN<!|9>Xk@VjH+`2>o
z5BiDhwT$Z$#QsIR!;iJNy7Pul*=xnc#(wz9Hb!X|gnyg&Thd_;uaO0N9~3`u%ZK_r
za?+<rBCla_%+wbATFWt@p0<)mC|$A554gS|<Du(Rs4nk%n=&L~PoKj4`n|@zz?Q2f
zE~+BMog$myUc~c$qTq1fhebycw{N}Fa$P$AJ@kf`lVtqcw`hex;!EMf*QJ^^&NgzR
zeci0-)DLAb*`8mC^n{0}OtB-)2DZ|F9Fv{I-?hvtYTOoZk2c<!O!6z<Un`xi5*)E;
z`!`gXVYuF$?T^zRMTSMqsi%>aob1kI_UoPPb@7n@9i0zwwM9mJXEQPVRuiP@NL9dj
z)av7)>xC4B(iaK`j=UjhP`CjuTHZ$rvBXe-&&GTwb~9&pRTz(=F6w~n>h{@T;^ZeH
z^}-q6xUbPaeONyWFOYY_`}60|w4a@-mm*^pgm*iY9VmBH5QBYveWxdOMgr=qyFu&L
zhn*u|sfvX3rm=EAAbBF-T>{=_Ts{ugSLW$ws60*+Q`66^jHvNgwC0KeaME$SDr>Jv
z<BoiQ??>Jlp+WaRQ^a}b{Z*iICk1>Y^TPLY0LO%5-N6$pJ!*X><>^qvu?M?>4uiQn
zJ2;A$8|j8It$<$)y9C3aK*gILPlC+`(03MI8Iy-WF}#t#Fr-VEy!YZeotSH{i*O@M
zF)kEtMZJ-vN>C({lze$H?_np?miC=dNm1DrY1xZyu))&TNP!yJ+yEb!2N#@**^#7A
zuzr0%-kw^MuC=-)E-Knp@WshDE?Q=AXYerVDS_NDoF>```4GZv<luX~7<WHOEX8`S
zc}@HJo5h7YmVsjE$@tF=+Q&RV4pJu>J-4v1(EIx@L6c;?CQu<lPxBLXf9aiHy-*kV
zw^Abg;cM-;%}A;QrRDbdq)MGF3>v&&!Y+xOcDq-Rd3fx%+j@J|YJoRmjSO!T%}8RQ
z8A<p%w<MA$Po7Xdw`C8fO8M8mraHh}clc<wR9?>#@w?I><H}$C8EJh6pD<^*_(Odw
z1&mS<Rt!2Z-5WE(ANhZ>ckbv=0t~_>{92T_G0X7JM*&u9)M!cNZErg+$`2vXq*qOp
zNWT++E`$}C){HuU|E-Ju-zjdvWQ!=<X0n-1)ijwh`&0y1y#``nxy)pMS9Ktje(@91
z==SX?DyN>mhR~e=X`cgj>Dp;R{jQkT!Y~8{q?6y0_8u3$p}V`gzJF4?A0GikuK<(P
z@D62MLa+p9n$@S5{uR79f_Yh+k#wNR=YgSVU|nmT_4RcKFmUjW?mZyXv6u6DlT5vc
znJ84}$iv-@?ZA^+40qXOhEsTLPp<ItFI;uT-g_+s<U$Lb__%SeF#@EUH4A{9isytg
zpY|m}mi(+XZs{&DUgg;66aUXv_+@5DR_WULoVU`+z(k~h0k}vABtER*%NI^10#}5P
zmZ3eE0U_*}prR{Ey><1V!eGmSvrnL%hyC82vTr_$sd+3|>>1(s)WekT(FX;rD`fWp
za3}1IIy*Sr{RPcJ_V=k@ao`lch06++g0Apgp6zfC_AMLCqkY*SPEgy>-4u<eU;{XX
zHG0{71akA_7p%|O^@Ceqfvx)8WIx}~tUkN-INwm(F0R8q_Qz~>haMU5eJE&ZYTo-4
zHDZp|?m&2m33PDw=CRh7_-4X3r()3`X>(xQr8M7YzAOBZGSb<%-4|%8`960;;rVo(
zyse@Pu*fg{5;7i~Ca>cGN_11k%L*f3UbK2R(2Zg|p^{XHTbH$vVrWlhFYl_(j*B7^
zk85i-dG_oX9B4lmi^8E@pyR0D!;RS^gR8l+OpxN0#V|<P_@_M>A2+PWA1_N6Do*il
zo2{bHHR0iVpx0uo{`JTD(gP<ar`poexF=qtn#uq1?SL6%Q+Xp~^=h21Rak=e;Z~?T
zC5a)@@PU$k_JCkrtMvKrShK;RnbaZilAY_T&i?Qm72dlFt)WQ<9mi7c8ywWD(PC?w
zvZjuChu?9~{yx}9BYQINBIq)JWZ|f>9NoOgtA`KhZq*+xCef8Q%l|xpMWQ7)ppVp5
zM2nH|7O9kqLDe6|U^a$9{7Bi=*;(+Lt;iQtaMI6S`<?piO9tq>F+Kz)>vTc=koq@L
ztlc7^6TxCg)rB%+;(OcKl{I;k4+aVF0h|jb2eUPT|1G_~1cqqrG+PD`3nqMj#y9GI
zKkp@ei;nfeWiq9=%YqC-oLW|s4hwug+#6WyvpXG-y8uBWl2B7Pkne4_(#~1*{98Qf
z@6J1Q_g$yxEi3AESLov~x=Zi~?Bn@}$-(ot%QFi}*1k%6@OWW)b1I2%9o|2*wdEKr
zn})Ul<)95A`qARA%#n*g%z9UlT~0MeUq?&CF#%2^M#t*RLA%vUQXS6=PYkV>N-`4%
zW)wh1P-o?$zR`mf6Q0?{f3y!e4+>H-mi4ufo=u)Kc&0A2q-bo+Kzt6!43gP;IEnhe
z2EtSXwSmoIw-RSU1iY2ED01;kNb7jMy;4W<68aw5d8kc7%;Bs$SgfIl`o^Y2YD2x+
z+vah)XALyt*%GgEmO*CZ8%0G$%zW;w7IDh{-U@KrPW5J9dZBN(skwoob7Wfqy2!}8
z$6n@-`p`vz^MB$sf(tm-<fl)cfOY66ZA;=adlqZ|fGeAkosr$EUdMaFZc+ZG<Nx|p
z4<k);8}**o)dZi+_uE~f4Uyq&X(fv}GvN0mvbO)kJJwLuNq&KKR@2?n<35%d^cD2P
z|GUTVyM<8So*<~tB&{w@;)$5dD4*K1^j(6=TYylrGj}7g#QZ|q09urGefDT}o9#2#
zw~ahnzFL`P$Mt1;OFy5SBr3~yTC#DG5Q;kRo2{1bldG>{o_pQ03DGFZ`W?8lXnU}3
zDbD+tVB8=A+vwB#_f+CZ8hu&{@(>=%8x&sY?jEzXxmEb#e150Wp<(mtKO=S~8P_9q
zar5CSu|)Fp)BS`&`U1VPW@xp`Ox4AM91(DJvLC{LHZNH-+S2{_3YZvmaYT?F%e|y0
zv_4`wT3<lVR``=Q^0tpIzvIt$I4w-(47w2tbsEZqeJn#?^fZp){1-kzB4Q0ZLY>yC
zUa20|w=Ey%0srJ;r*M~0&<d=AYWm-B$LeaBR}$cH#tk@DmxqmXG|7ggmZ*)eKd1<S
z!wxGi3n@EGY=aA$YRXMwKW8RVA|C;9y4o+<hy#7y{gI}y+$;#}Jum_Or$|&&0z1L}
z?W~KZXZ0fL8+J63wULBL|5Mf8BHXz|@g%V8UFcy^rr%7J;YXt5;<rf?Do@9Y%^$8y
z`5xuEi{1m)iAZ=jx616~tYU*r%j1#pC&GM!42&0N!=HQ{O5T0NPgge!3Ivl7tE#G;
znTF6ucupu25YIyN^z)BM?=4Sh94yvv{;=eIPBuC8UVb{XhgP~;7H}N}8q;tr6JYq}
z^$!6T4r%W^hBO+KwaHnV$D-busjxS1)Ll@SAK8^_wl}}1Tl;WM$Y6_eczEc%<L(l!
zrr0W*2G!NLDKF(Im6uoYJ1<SaEg`tPdaAptxN1Ib_SAsrz&W$YCRl+;@b`s{;Xdi1
z24kCf<VV^h$8qC&aM(jE*Z=%!m-2Nb1;;NAH>>+{Z+r%bVrtc-zw!?VXv+J^U^een
zALt&RfvfFw%hri~pPMJV4U{xmIjDzU6>r&8Rad`WMBjfF%QirMWh{!mcO?P1p~d-x
zm(trcU@3Xd_+9K$2tKn|%SiQ;U;32kOlD>Rr0sOlWxP!yx;%00hiakxo4^(&-;o5~
zHwY-DtaU^1A076#>Gv_2C7JtM+k6VXVD`7|(1Ts8%z2UFcL-iIC4JI(YHi&{iE6u#
zd}>Uhs)+s-|D7PtSa-NVL;e)3@lS%*wX-VNHb2ny;G!6UD)95JP6ZuGBQV`>N0Oo@
z(iY74G;KgXwJk0{QvuL5I`$mGI}t{7CD4AkB)vD>!SO(~lx{I?xg9w1t$0&`pxgzx
zP6RsqfX7M$7p*^{PfEj9Zv>+ux%jXgAcmL1bY$OG4}ZdCi+>@_)Zt@g>9_0lAm#Tw
zJUn{a63MgH2_(>UT~~-KBbK41W%@vc@y2t=y(A0&g)EP++ZYs$wPW;VZ`9XEEq+~<
zM}BX~fj~dmU!2;{6JFgf07~NjWKRq<lt5LR`3`!r*{)HTMT2imcy?f>u-q?RU(awh
z*;u#c9BDSN<mS|N`U{*AL_B2h-aiU-SV#Mb3|SD1zmb~cQT?q^d}&!3)2#`YG1%fN
zXX4>+$z+WMfj7@bjNm_bA0dJ5<>n@WE~WBeN;<(IK2!K5rnXju(Au5zBkCw(yWdW@
z#o5D<@l``65!>f<bac0Xq)a$)qY3N>KDZM92?yY9{@|76!!m0q5+ks8^J1rc>}M1y
z7q*L(1-)PDEAnEqfBafQ1+y(e3rG^#RPdy0fmW^k1%VF5BHl9w_K>FQFlLWKo7!#c
zU5%q<lU<#qx5W9}=g=+;SR~C1uB^I<Irxa#5Mha6XxGk;^T`z$9WjV;CH+NXu#KaY
zjW;hy_0ESOPWDV8ahtGKi(IkYA_-sv{h!p<#%ey&4qzQXPObj{nN^z78_uh`x9kRc
zEhos|31#aE^8U3+KE-+lCf9}mrDYcs771Ryb5luHFR3NCf1#x1EH0SpiWvFoTD^vP
zc-V$~50p#En674H$;R)~FVDZ#e~iS_r?@j7Agv1>F8H5NP<KTQ<-`BE9mO~!`m5KC
zm0JF~5CE)B#XdtttJiOs?(}Ry_H^09<>XIUHABf3CHdmQqR=j9T?QbB6nFwH0Q*(I
zP!r{Ysr>Z7N44l4r9#=fv`mm|Zz^8|uNpryrjV1KPBbM7T=b|%ParV;DCV}Vb!Tr7
zFJ=F#<`bMk6k4})Q7~ox8w)kOifv)^W@r0t%*0jJ;kPp(|7Oi+7xYf|w;BhfWlpsg
zd-v+r40<5j8VblPmTn<87cgLpChC?Y(12r+#sU#kTFPHFk=V${FOk8m;m!AXW-!LU
z<&yUlzs>+_lx!M!^XrdS%;vvr&OOVgyk!F-3RVj%c5^F~flaUw?M=}WhgiCFzYGd$
zX<Od`@-T_}_f3DPbT<??^{;fC9vCv2iP=%zdZraCdyL>gh&Qh$zFx+MMH(!-$u&Zo
zgP((;ZRH<*&`Uv{{T8X@t$4e`pLvfnDNuPOB_;K{qnpJOyV51;5BHi?<O07l&%8jp
z`JLnf&ho<n(eZq3<1N7eU8EVO5{y=Bw1@3>Na}hKm`N@Qy!+XaA+;RcIAp^%N?xEy
zD9U}!8>t!cLS=8YKPkhLBO}%S7iFKjS|Bm776lS3T7&b!;1-->q{q-bjV&8;dWgNN
z$&bM%y*J;ndM<aCOT=L&cw2!C+CSfPRV`Ql{rl45`#m7i%kNJ~nRVy0cXIl^vBcvD
zjx}^2o@XPBB6>p2WF{O~Ml4witQfZ>iEspw<}|KX-Qq13`Mk*8`qlh=byia>tmrMY
z-GT^cJk7ZU`1sN1J2FWu?j8<A2SE)Su=(}7dZcy4GvmoMQX)z`<7-m{0b+PxJiTP+
z%#Qu2`RVrBo9C{t$ya|51#T!6d?kW*v6Rjnw{7N+GW9;I7`b0lS_;k36_KvpOQR#U
z1&@e<endChpSNI<z=NV7s;^^4Op^(%pC7^fOc6?b;6zDy+_Z6C^GQ>vc{ncAB@@Yu
zSyXV`N2m$b^1U6uAIJL-rGdD!isNG}c0AES$Qjv?1N%$r1818!zQG@I%p!oDi4vqJ
zgSu|MEoo}Z=jH4U$qkomCkK9)X(<Yn0<mC+Mjs-M4BgKlpUgD}tO6Ngrnk$8Dd)$5
zLbdP>&M;^gm$}H9T{@$?3Rqjwk}@(&jg9OJ(n>|*%{vGA`Ehz!aD)(qw@(`E7FJ2`
zJ(ly+*5mzLD{3E?rxg?VR1}?x7prLvhAXM&kiE-x`EgvopdV23>dHzSV0ZNhEm)ox
zxj{)W(4aH^jjtVRrA?V+=xK1K#*?Z_HA-dD+QAe_@+*udF~s29VA%H!Zw*&BSYn>)
z!T&{*MWdR})uCAs*Dlf(+9v4j<eIU`-`n<7*<g7-a#m(J@UK3_empBR%vK-Gy!OXm
zGPsfygWDFuBMz<?1*ufx>~=CY7waYxo$Ow4{^GLwh?PadMSz{&)jBY6R$s5slSJ^g
zbY0p&%~`I`;`-xfqAV}RbEsQ>Hr8L9@Hp~pHN1g~#Gghom;s?ONl`6jeNrMoVr&!9
zKxS(x1RQg_Z7XgpwD2)Z#4yJ4{GZ)j5-^TOV3BH09sD9J|Cd>@yC4GtC|B!aOZwRl
z2VigzA5(c2Pg!?;wVoh|i#bZlA6|fJJaH89jWp2=lVxHu^AzTL#~UfzC+(#DKQVCx
znV&{Dhaz@ZA)Dtb@uQs1&t!}9Tl0d-=zbMzyhW2((EGU`Npb#ATNMQ~mwjzjm*qj*
zIC0Qq++y$>Pat+MRY7KfFG<$Ma329(UUkXBM5~ioF$K^@mrmM-j*bpNf0&87E7+=$
z-GQ-q;P@xox$Vjaj17vtQo&GV_K!)Ck)Yp1JF;%PAe|v(i~RtS@~{SdtPV#GaF!3R
z%`cLOfM-I@&d#D!4$iMTS;mfzDq*%wXxYCzZ6}<0NP+)<0`0`5L-$%`J)KT01P)z`
zZK}&IOFK1=H}mNw1G?bEm`lwM&BDG41TN`b5Ou*w02Vkr^>yp%bviguu+aqv4aE3^
z)g`bGfY2pdncRW`q5v$DBwGvm7KRxP(9rGs5Pgna%z5zAsNBMFrvBI8C5X<?O<3n^
zhCYDcV*rzVcH{_0=f%av-!E}k)W%#`%WK0Rr>0&q;Tt)CKYC9%^0_^|yc*ylo*1wX
zA3n662dl5D*8zR{?d(V!aI9Qjfovl5cLKeQehl4=GRi0EALL9D*j24A344dig8l{8
zXx+S5#S|ML8^eZ}0r2URMp!Ankea5mJy>5V)pM8mz!5Z1Jm}1WJR5(c&0sy?s}y^E
z@7%qMy(Dg@2adZoV=qNtdQc;W^m=iQLNnrS@p3%zaCfgboc)4N%_DB{GxC<U_p7#!
zVXlwjfF3uwp~vlGLCizHtw`JYI=8^Ba%X_6SyMG7fn7i%xVj3it3~7+Zme52sZt)1
z3$wN}v`kDfZf<7`W&p@BAi8<Sa`p6C8s^}kCGOp$Fs9x#R^I3Ox6i!#a<{JMfzjBF
z>;3xrFkSq~kgNmp&YbV*!n(1O?Vi`g@1mMdmX}+01KWRQ+kos8PdE@{P!tk+_aeYY
z6~w1L5Ab%e##W?IuLD}s;2GNJ*jVtY;o90H_=aGeg{ZHBKA62v8s3VA6r-cSH0n=4
zKS*h)gV<xw`gwfrd)UzO@8XNmaCZ%pPp3f3a!t^ElYe2mf#cG9B>(2$!`@B1U2H$Q
zD=Z_rg5W0gsusWZVXkQzmEvd0<2`mzIP24K``PEviyn9HwkQj|;cFnz#KSA4w1l<R
zdmKri-;ez7q>^_G403_fD-!R9m0xqC{$d44$6a56@DMbT&k=&g1!BYlJJ?iX03aGK
zvdBkSJD-PrN3r&B7*=sO?f!r#*y?>{<CwhB#kpb2pFy7vff@>rt?_O5uDc<%<d!5M
zo2k12FZ<GlRB+pwlr)jP;VhKzh3g&G+JHFX`6;MZc@_S}fSof&Pg@G73k7fydbv=d
zgLG;y(a4OmakM23GvEG)ky%su#wZO;92i6k8ZMkj1i4pRg4Mq1CeO{mNm|2VyTGJ0
z>^5ttajQ^oxsG!2J1|95^nS+J<y!qVq;S*2n=CReC45T;zL$<HMq8P-i#IOl{SOyG
zyFLHIdHX}`F<?aMt6)oFy@S4d@dBQP$hvI>5kt{$t|VFRG^VA@|HTio(&*BFGZ_vD
zH5!`Uk*^I+q6*HyRe1P@y?*=n%<Sxo_(zSkn~;Zagzea`U*W870JU*&DA?H9@l1by
z3DB?wH9D+iab10i+ioskjrK#!E#_w`#l9x*(OOp;AfL+pui478sZ@<VnMb`4YXim7
zh{5Z@WL%gAC<`pk+V?u62w2G)n^~e)rl`{%vC_ek5|HL+V?s6G%`0TYacI107aD)B
z{VEA+GVPW^a7E&iO`;gAeqW=5AC|GLBe2}UyLJhBR_|N5#Vt&a)NQ#NN7SzE%w03G
zYduPH9j#jlEE_5)scqjDBDiwh;cI$C`!Big?+STosoXISJH?Mk(~)xa3?~PNs9DX`
z1y*n}4TtIFW+9=<_mPy73WXWX&1rKvw&wD5Seo-cptVqCZ`$%8;Fr81!^K0`GqyK3
ziL5V8toaxi8E+e+!Zh2-Ek}Q?AXt&if^GGb4#iq~i=lfsm>jbz&6g$*tq$7bsr(O$
zES>2G1s18}aL$b0JW_+mn&gf;DSYeWdekK|5!qLUyP)<)6pJ*CMXCuze+bnIm|^o$
zck?}5Ja=JsU3jo#7>PZ7e0`!i4m+!0+1s$oDxsgX-*34)7%oQmy#?6dsIz}Or>g^}
zjYemfChD7J%!AilV1Hcs0Xwf!v5U92L~!d<r-$l_tzhx~XN^&yOl~DK1J)!fD_}yD
zl!{b{l7a@YpyZd^&$ES<_le0W$Mtv)Jq0|PSe+FlLb>r-*sqq?M|$ZAuqdS)Sw<xm
zdWb|dBMexNLTnm~_q48$6VhJ|3`X_Kl7HKm-ZNYFB_gd`Tzv0sr2b2J;yNBoSd7m=
z`gMtMX-#at`5p13s`X8aKqtRfz$_8*TJH(J0i8*`(^NGSoZ0|nC&4Q_1}0;xdBT83
z#!iuniVB!A@OiQ9QmsO(AErrf<g-`A-GXJmLze*=kq<xvaVLyy5ncuYT{P5LJuvR5
z;Ruo<aRi(dN<(_t=e<dN#|Tq}EjmTLz8fGTI{6!-H$dzIb&=oNZE^mo>f;Z*-F};C
zu>t%hulLw{7ANFg$aIK@JnH-npnsO7jt;}eX?L)#qkiuk1ao+gThmK79{E(dym_Kj
zY4XP;a8Wau8Wp4osI{2`;1zqMJOXkqc!-5;!ewM+V0dLfag!3qqHL?1M-h&zYXGJ<
z(&aG3L6xE2UWx!NEI^=nNSn?y`BN<U(@?}cEkH-w3@=249#2LX68${OsjSr(tlVSw
z`GW9=q4+X~t6i>hCo?EZ7u#u+Br@Y(#IQ<e$O^oD=vbo6_dxfdfVUHY_p`GYN)|#J
zW&%S2Ds&hP_4|1C3G{POoy>rV)CqmI^L>=3(#f33-w*r}-%(x=ullP{D*t<^I}Pq-
z9CXe2fTa!^xj&D>S+%kQ#<(gD_3t5iqu3@|z9A)l^qg6mBZ9HZZd;h_p(2S~3zXMJ
zO(Ik5vJlzX9^nwPa&28x6ir}WHA=eJCB@rM9m$qv+H6M^k*4hZ(%1~JiWr-qjR*Js
z%!R$O5nT%!$&*Sab#v*e0U1>9=s~*;f~2zGAT>mn5baJODDs9PsmFn?@B8$$nNIg>
zDv9iVs}!(cA8EYIvr&LB6*Kzeu(vf5VPF0+oT*N<NG4Bg#831VcG4rHoX7DFQea51
z<Mio3p~h6tY6!K2OWH^(fPB35nmfS-4-MS9_>Vf*AcNw<z>M0XeNa7bhG;7Wvmc)J
z4gv;M7eHJ95Ev_=BoihAZV#<8q}O|Iye=*Ugs=d^+qW^F{^CgH?MT1sZ9Ht+{l5Pq
zw6{vPG9yQ3{5@PQA$xB)1={}_@3Fn#K4IjDWMgR++5UqxS{wm&{u1(KBEG&BzzmX~
zk}cw$Nydd~R+rV2fxSRnf3nB_rJ>>e`88rsza=J2GrOKt$mwX`T($^zR{wbaKfh%h
zuj<<TAMirw+w`??l^N5Jd!i6#-%<VZN+{>1i+`DgQdgYzd<0w8TeESuvz+%>p)p9Q
z;uqFwP}#z9ctXnk=RxMix@(dHZy<(?AHR^kl&YEIg)6zns?`fInMh6RxJ6RZrr85d
z)oNZ!XCQWmE-$M$-x7Qrik%BRHyYNVXO$syUu_xHzW&h34D+sK1r_*>4G`iAoF=bx
zOL0hwzkK-;sybRplOXgm0V!Z&6ra6udTWT8G^>=PeI^n!&Co=NeB_qXMn8hiQSq8v
z0L&d%&ttG%oX8<>6M9pug}mrsw_zEKxYRfLTA=>NF7)p~VH}%Q+TCJhuHA9_OyR)5
zI&rhG<H}KjwIsy@=Pq1{{q`Rg_5}pmj*pmLs5Vi5@VbY_jM<O<?tMr}xg~WKjE7gY
zE}%GuO<ILMSvm#5HLJki;i3#zBd{U{?HhJ?3FC|h=yfFs8PyYn??Hsl+GkkYkn@<X
zIQmz@ZF~e-1UL+N`49ut1!1Negb&f{K6Nq2TtvOE8D+@I5@E$Q`*<>0i%9PLe5AUP
zV7Jm=V)x5Qvp89T%iI7*Y0q8KkeyA{m|B9hc!&0b+cncD_vpbB+&1EI#Ae4C%uT(R
z-|>f2pG<dws37hnO8TjHphQjJv%OGq1F|#-G|L{hc$lt5u+JaV!nJ-U&WJm;ZYQ92
zRMRoS#GFgrxu_^A`hMHSIJ2z~SJ#S@U?Vx7^eAC+a0Gc(*+kf`0t4FofScSuvDMbr
z;6o9mdzkp;06s>0he1`v9eRCzJxoa0>w{BPzyee7yC*;?h9AqeuNNAO4a0xU;3lD9
zHQHSYQG}u*3Cs~jVbuwf@WqRl&v*HSDC+(iFpOFl|2|%=X^~Ma?D(5y-Z#Lprl#?!
zBxF9!A-I>4g#2A3!rru`<8GTrU)?foM(U|YpJb^}F~P;6g;HfC7h)VvJ2@Jv2a_lf
zc0j-zM>Av9PePqEBht=5zv1rAo}r970~QeRdOtwGM4E!{D=mmWzTydmz#<<vGk-Ao
z{1d}jST+1-k3vguv#K9$3B_*`mb{nzR7a^cUo)5mMHh>jDGtmcX}u>MftwiM`gcg+
zJe=gi6>;b)K9L+A7sdxjhWMlXrJf&S7{yhe8>&D^o~bs7C5vTz+R$HkXAze|TZ36u
zIvzv1I_}@|947)+LQKYoA9pW5uzw7^^SP)ig{wITc7mnwJa2Q<Mvo_7>d*1wTBnC%
z24ZdMHuHHL51zxc>>OQ-JAm*jOsgIHz`l951$o&`*KFJ%xeNis1I24^8#Yk1d*6>s
z1jK9s=z?Z!!e0w$%l!TMeaLV2aMn(vcW%~Qo89Gk3H!`fOr);wqimz$*}pG+qD)`2
zRGAD3dmE~20RL^v+&em_mi0i1YqR0>Khrsh-7{Wu0TV?vv*-7~-_H=0la@{?E1(|k
zd5pdhu+T{kUAbh7#L+uhh|~3T`-jB&RbL*pDf`*2ko!kczO+)JdO<_Y`>E(ynr|Yg
zE<lr!s$9=c=ekI`uKhhG(4F+Q7n?T#P-APZ#WFtxn5Cd_LYz>{W^o-gm3;2V^>81t
zWb+@S*xnkOvg84^-gX@o-lABBnP<X8Im4m%axlW=e1nPCx(|a-=-+cBD&~Z0^pRyD
zc_VvC*Tm6jA^&mEcWf>vN6b%X0jc<Az)^Vjq54B1YrhN%3pHD(xECM!NCBG-(gELs
zU9BP*ZJ8MS9_*EP`T6$c3-6j@5MH+h4<*vpI}?Ge+GA>+`vB>*vOWu>FVH!iP1Oz5
zvx@fvVl-1t$+k1($mrqHUtiI%OuG8W2ejbMhjVtybaCK3Zme6{E;_1f{ruqI)gQkO
zk0&y^*uB1zcCz=m1K$n~nA|q0x68-N$ez4A2)hvab^Ssi?ZNN#+;`KHlP|Vd-XlxC
zbtwNwVdUAoV)fC}+1lL|R}+x~NxaWQXe)H$mRH+#6LI>^v9W38Yz%DnhQ576^bUnQ
zy%QKB?k`ymAbq}!hK8vK)AgmbwYBl0*zrs+si7|v0V8R8s7=yPs>U{!TI5NR$`pR@
zlkn!XwAjFVs+D9cWY$3lQ5!k`n3}Kd$cWbPLsrC{H0`^yvl{Az>WKAhK3*c-6#OA}
zXQBmKPV>(yQ;&MjXj_6vuMFr_>T!x=UxH+O$47)97en_Z7o(d9PtadM1KHuhz|lEC
zn^nsoWh|-U#y8>7LWVT-<)>oKT9;SWMsQ<sW&pTg5xQUn;4)`xM@N3g7cU6Gg)yeA
zGrSmo+&>D+NhQf4*4+pkS9Q0?)(zy=jlntidbY&Lm{VQYw|W$WQ8xGXC=!;B?6n8k
z)?%?U)e&rtZ{Cz6sBB_z4hqyCra#{Lk_oG)mZne9Z2X-vzt%M2`oLs96iQ>hlsvm!
z{Fn%+g>f(+ZShD0RhCPPVaxU39mz~aX)ec(>zr@+0A&5}S+|_Bc3R5&xjPi#=DatO
zlHR9c!np{wd~5_aut($UO_$@90xh!xWNCbD9-Vqdh(DLCrf7v<K22>8wD)+#)75&s
zRbMRgp-xKo-0E`PA#rpx5aixO%8MxKXVbD4(IIhcSrpaQ%%lajE#7L<c<r6Zn!z-P
z&LimCPDO(4C#XNIZnx<O7O-7QI4gxL9uMdn4C2T9qNIX7!<;5pl40aU`ngy~T^ldb
z4tS<A$){x^=(DaYZxOHRX;ZlpUD&%4Z^K~C2-Ww#k4UletZZ%B9UUE`x3r0E(A*Uo
zbztag`voFe+QW#t!vQ5g&!ZHtM-A4P4=|A0uDiVg6qy0BbZrc?obwm|T6#B^A`g^L
zo(2s*R)6x`e$0Bs@t;uYc)ZYC2pUpTRAT`uc$lJOhtDQ%`IMIeX+83{tCLBfFmnbz
z$|a9PMMl;NF@{21AJpV^36NGs6RvegO#q$vb8X2!r!QSSr+2&D!+Kx0XyzrH3Gwse
zRL261iRd$6%f4-s2N(H2tb`%)geAWaadv}w$<Wf#5dtSh_lP;L+ei*-(uWzHf}B{l
z%y3Fl*UC5VSy&@AUo#yBqq5gb;&>?b8$&ZFhMwr(dh+@6NIB%OI)!gcZ7weRk%(Z1
z`eHy{>4%^1gQ1--eMq(Z5+Z_g`4l#*=V8=C9UR+#{Dg49xjh(GP*o-RXTVtPHQ+?i
z_|FQ$LbUXA1K#HbfZyOTnbGs$Q|IxrDgZ%~`7_Xfy<;$=s6p4BwylIdVqIYakwhUw
z6?Ln51nm1#2u{R4W)fSzyb!-NhjoyYk5tSXyAJ~clm#D*2$k;f9!bHJHiXp#q@T0s
zE!0IAan#kao82Xzq`0$NebO>FbGMz0qfz$_*9&X@jruNZXS)d85fF&%{k(w!ht3xy
zwBE3W$h(0+io5t;$C@Cb2`I_N2-M{_;r3gx<&R3xx)T~*HBM_ryz2I<!8Q*04{bQE
znw*TU@nIZ&1?te3pW(Rd>es|9kW8{H2Ko|VBZzOSHrY%G9@2O}#af-ElYB_Y%{BtU
z8LF?_04<ASXBxstGu}BTZ|r!r&Q|?=zd)<@<Nz4A?c`E!>)77F2|OS%z!SuIE)exL
zPy#aawGc?Hk^;ne&p`*y;#+z2`w~WSz#>7u)+v)RrE<lXWbM6rqiBdwD7*ff59HJt
zuk5q7sJWQxzq&tbD^MrWJ;U3r{Hkka|HDQPwf55_*bj9P%4L9hW5@upgx2h(pzHPs
z8|ZQ=14+Qog$yZtlaCNn6O)uAPY_~aF$6g7@)zjc9(>myBoo6GwQ0)-Q)B}so5BEe
zy8!yWG)=M|s50oV2wfu;kgTf!s?F3^guWXHBa(j<k8=PmYTjw;4xzF%tCCAkAhJn%
zsK-pQNzT6f2*D#@AK@M51Rbk9%^B%IB008Uu8k=q<3%#Lr6i4Ak>5!SZprOiJanFr
zO{kU6t*LV;XHD~tXnV|O3CX&Y$$k((QtxJ)r|^NF>>IYX3+y&#Dp*oEp=kL5H#%VO
zzSqtzK+{;UI1xHvt9;N?#ahg=?6v2b_yCfuYME^Ss2#k|2fKxamw>Peq)mYoP-~fU
zZ-^c=MTr7#DWJYQcX?c+%1U&g%E4H0;X&#=Or=!dFn6j_!(^ce&90uRHVgISP*bn9
zMA3vlQTpw6*06;md$l6ea5(KUAfO}5k94UuC`_uh3bRVrg<(-TGEC2bvPAP0$r+rz
zOfF3*rtR8S&SwxkusC;=4WWz-W0kOJmn9SYlh3ngTr9$Vm%!U)LV<s+?J3vsCg2bi
z0KJk=!+3zZR8vuL*Tgagr?LREn_9)w+NFIMq4S17<!(Mh7avw4xf%Hv-K22~0bz@o
z!}IC2Z+LjS=C)hs3}%`6$Le4)L4=XGAY_#^YyJIZk-g3!R5_#Rb+%LnMj5Vk^nM!;
z#26a0m`FYHeo&JmW3EeV=DoL#f>OsjoX$)>a@1T@aQLQtZ90N4>%qip4>!vk_6?@J
z6p*XVE~Oy+Zra2xKxCm#o;z%YJv3cfkr68*z?FZp?Ys(F1K4c<!TeU>_uK<Ns7;6h
zoV!S4fE%>Mv#E}P&*F4@eiGb*lUke=f5BX)x}KPF^QU4o!mTVn*E=gv+VK7-*fd=t
zy2gSo&a}_N7mU<cC)_YQsPF`f3C62Q%Ya+m4$uQ2S!NCNH<B+^J?{d8khz5asms_S
zkZB%g<LV=J0g~#fgGwYpDBkw;bjs#Zy8l66@(`GpPX8TGQR$=qFWe=2lAT%>?3bK{
zKh%FEVFlD8ZPm9a>$Q1||6Jdr+3Jv|YMik^B~SIs;HP^3drcC+y)V7EQf*+d2dc`G
zr@MZ07irZ|?%UhjhhQ<L7zRi`CIuJBZJ@J)5u*V=>fgQk6duh{-r?+qvQu>4Q`-=0
z;K7spr@~<wp8pm>S(7zl4)Udv@NNV+d@gm8fLm&g{{f}oE9K{~puFFUV`@|PgmB{P
zI||mpjmBr{X@<2H-roeC;#2Tq6;mDU8`zsyrePcX*D*uObE8i?I}sDP;NLDjrfJ>R
zQA-+FV%#-4J_Yxr%I6Y@rkcnX4t#us2u+{_@fokJEo~;Tlz(gD>hS_I#)amnVIL8v
zHI|^>QY7Et`@1!3ZGY#b$ygT-oKL4|P(;{ucMlQ|y6fVRR2NIqWER0sQ?%E365O%2
zYM9_wvS@Yk<#Jzw&S^V9n9YB)z6IR9F)i>G2`ag25HPHOz1WYBDD<x7IQLJz7t{nA
z>z!0ZVnKekp4HhVzZo(1Pj=|TQUJ|ZxLIidwzt%M?I93Iebnl9RC*=pVD8xnjiV9E
z<Asj3<pjkmaQifF-3{Gr5ws*OgQUkND5A={4+A$Gy4Ld`W;!2&MMdJZ45J@zVeb=+
z(+VXLmlCrYTsDuq9y|#bQ|eXZX2lT<5O_F$FrGm^=u9D8?(lZ5HgSO22Hj9YZ~OZC
zvV!z<R9TqOf-mp@IpE_Ju=B`t@*n*Z!T9=EymhQk{E>k(;1Yrb`ZaEZQE0JZw_#2c
zjv(I)T=ezG(JB6d2}fX=f}E8FFP-7duu5?J!+m@BU}UzKyL6q@{Zu3N2qRZ%>AKDi
zLV)%?tox%lOD@Rs@-@=*;pGbl_i=XpkJ&ObMQ%)mJu+5JW?v6g4u^1<tnC$#la$Iv
znk|;yetm4zsf%|*JU_Zv<KtgpPe)&I(47l+P<Xb1(CGG%kdO*K{dihkS}XYh{kN3?
zGFw>cA2SNLioMcXN=xU@4}jV82M9|?;!}4Cz}50@l18ve+W_mMTB!5t@^l}{WCo`5
z;t9YrZ&%yIkj8Q_d?hb*5aQi(*9_g~;%M&@M#Qm4EGvI=(@%D;g>mtd!a_A^6C~_(
zS$$LZ(zK}Hlw_OO2*Lh4Qfo=Y#NihxQq$-$n^7$4Vvo<Emkbbej;9xu5E(nOgbT}2
zD1VU^xOgyRkl`AA)v+XTVGf?2V?M65x~{FVZIx{V&@7OzMdsOsS|Eq_zEG!ytBEe*
zU^8ZMZz`Mpwl8GYk%Au~ylJwIpM?r1zGJuWQ^4$-sT$oRt>iMe^f#FvWh>iB;gu|y
zCCPm2+fr4$RcWAhFp-%F<0{{oYnco9Qj3-hV-C^G^u)%*)bIW}e=sQ**N?$u27mdo
zgunczIYW1lGp&5xW&wYHwUs^TnI<G96?<`trIc)=%pq{ju1^r!i&Mgl5no_-#`FGQ
z2ZfrI@_L;?KCxutamvbB*`NnM{|=_AJjeb3{C)lC2@e5M(zPo3%pmP`-$(2_2wcGS
zChupV0?C6n{pw0<_`sS3JUqwh^V$k@h^H?^AL85cef}5Xk&+g)&aA3yyhZjUJit*k
z%g>yEtfwuRC}Lk6wsRHb=kWLF$nn%G0UeQ_o5j6I1qu+~;Qk0TMHZuY&6B@q+k3(5
z8$BxZtxDI0_sO3=i4`WFYU(xPc?(j)rKg2rj`w&uYsO82amr8~M89Hgkij!>z>Lxp
zop4>iAqjr+rXR#;g#%OLr-0AZd8+!sfy<p&K!s-zjNk_T;`XqCd*b4U7w-y*WcwQF
zJ41g{PJKH;{a1<Tb^*Ok6EVRm7boX8Q0`73*O&94FHvsK)F~A(3C6?I8D#41g9x;7
z)M3$l92=AG6^n6M^`$M1VDgYK)g+{^dg$zngV%{6YOj<DE<o&5?Fo6rD#$<t4U1~?
zU6>1q0R+G56E|+#yKQ`cUbj5%s}J@9l)`U@zhbnJFdB4{`;FE-pJsoaY-!vPYYD5J
z1b&QxphFzMcHgnv^oZoMUW4G(wfC5Ax*R^D3*LzR2q^BpV-+lV5}RLL%amABuJ}PQ
z(ZGrS){}^fC8qsbZm8j@E9K6~VmRh2?=_9i8aH78jIzq%1CU@p3a1jJSD;yf=v!8q
zvFId_yC0)3q80f6qXip>%4pFJwWfq#{DB*y+X_qwK|f#UzF%jgEQp7H28`Q?@o(+z
zp%b|*wj@l?pk6FLS>}Gaq3e`~5HcMig6S%*9~v@W7S(W-D&KA<5XMOS(^X&jymbHm
z%pHkqz#Xg=YZ4jI)lp9vHV!E@qAty`$c6?2G^Zry&`8b%Hz0X&!8DCv%xGvA2)T4Q
z*_ruGagI8<7Yw9q82-$=(pE*SD`V=!#d&YH`!speT|hgq(Ap~RJ)%sVYVK;V4En}$
zx*Nn9q^Kc;G7u8ci*M<&xLL;E4T|T4#JvKE<ZH`Cp{HTPGNd0_Nw|>mhGt;=O%2^J
zUMGK@An8}azpHSNXRM)62shmcER?5|qb@cb>xg=g56+eIvw7JdkV@?~dEGUiF<~X&
zN~oi(1Nz@eU+{$7jrfKvlC=n6AE*ep@C^Kl@&G`2+uwboodX|z9kp)2odYw+DL_dR
zv9W1hhl>XP0J>^XgGafv^z;Q)$<@HLJ>!297$YXZ`Ue9dHNX*>1eJj({q`#2<<lrX
zg%|V0G<U-fLKm(%=EmIC64t85PAvHihChLe&V1}NwWz2lwV<FN`6Un^G06D7YHR*#
zymd3Ei09VI-$=}DJs_$54yeYrjJ=a!#6`<W1Xr3jc+m~$R9XVQ!e*;y&sL);Yge}q
zQc|e|>({fsEp)u8xbc1kgVI><&i*9>$o+H<c=F^kk&d*-pPzA*wck{}{_fo4BTX@Y
z!(b6-+{bh<T}t0(UCvP<4xo8eJiiOdj>(pwmcx5Wr&vJJ(Y_ZNayU;W1l00bkv5zO
z3dJ3kASbkQYild^j%to=WAgf(K>Ri+Gj9;p&O4Hlw4mlwc@v$*DCxG`0Ln2@#Jez%
zp7ZZ(YTc!&6<7(~^sVTo&=z-jzyX0-?6*_5R(7$|Fa*^lE^Pf9&2Q=|N~nWK-B6^!
zyzd8CJv36CPvdlS&Ko(nt{l#RG^?3*8@LOh2X7*T3siITo>VrkYO1O{Mm%q9C9WCi
z<C3+WJJYlvAGJRqok`Z;yPeos2A$&y@)Iup+1BOcbltXL{ClQO!XOcR59j}P;2lR!
zfSC&D*%B&3WW$6lmn%Y&jhbUAKo?*q2&(rWQ9F0VdTR1n)8nRS3*G-jz3aOVj`qPF
zFX*TvmM-DC*Z@YL><#_99D+XX0KfeWSr$;~FNyQGE0Tk<@J9Bqk8E2P1j42J_q)RQ
zlnC|#Ll}-ucWbeQ7(W4u_S6Ma(3>eEvl^4ZnQ+^x<{SJ*j(A}H0-q?W4SRVWwY|Qy
zk@sNilU;hi@pWwA(Pu>vItC`NK$U-tj4aG{0GZ4lP!YiJ%l^O5gGnMduj<8UU<P6K
z-)oDoyj-NV6hjn}0v58vYsO>TZgG>e83Tlc)19&(>fH!E_nHXy!SIMXm0?B-Ao$+&
zC4N~7HApqqmbp6m5o8B3R`h3%Rp3AI0dE#$?#CT%{GWzLpBRBn(*o234}XX5JE(er
z(IqmsNDGPnO$A-NOb>xrLyWPn59R)W$fM?q9oXgX^3M%BfI%ha(&9}dTu_FP2&Qv?
z>}UWb3{JC)*6{ea-6J);xdNl{;o;z2(=D=DmyX+(KoC6^iOz6JZ(54EZx-rvvD2nG
z^><~l&0}v~VgDwt@<uS7=f=XI_Lt7-vj3UZn6NA`G%SR@jw3t#c6W%OZW*O{?F@!s
zG&xMwyd>e`;xaEczF)uDDX1Q&bz|INI2-JQD0q2!RWb!g!`rS{-k(j5H;e7}X$KyB
z2@elfS5zY?+nq>gIlSL;I3ZwKtyG=E-03zz(|Hi!--}j}qXR2-SCDN$vvchNz!7w2
z$`!Iiud)yB?>#j&dmJ#(0|Khs35~VQ!GvMv^z?L+8t0imIK>+q&w1RSAi{#HpHvle
zbP|=STHssw4@ouRCvC13oyJ|w<I9~UfPA)~C(PO!-JoL+^cWDRnPwNuxnj`Q=)6EG
z=r0HT4e&>+_Wl=O88#xKwa5hKvD3==9N3N-*7Xg7u-kZ$<|gL1-$niJ1U&)Iiym$e
z5zqsC=;DnFGjo@#;@S&6iRP5FEno!EcW^t=f6qY=f9PThkbWQEdjX&h*tr`i!~7kG
zi&NYs{0fV!KZeX_<3U&BQ@3FSIM_z$49o_(zj@lQqhAv!Zq_IGW#zM)Q_8nNK;I_o
zjjZnm>yAt57ZsKOyEsCbOT=-i`g;TkIHDdd`%Vm49Fs7g^{N(Ev9*AVy~1GhA+QI=
zeqOJ~t1>C92sZi?jn$f$cJIPL8t29Sui4oc)bRvxPsFSPtqUPEmL^X=%0^^;>Bq(^
zcDKyf6Q(I=-|r3<hx7Mm_hSk`x^-fx>~$nxvG-7>;+wRP8GFO0;7bs~M16-;R8`ru
z1@kg`!NiiAG+5x8YzSkE7grgzx{P`IRua22rc!dDjh=H*qO7|=R8%GKJnf`$tx4``
zL)-5*4A*9^phxcT<IuF#Tvbb_-?9t=6+kaiPTp(FCWqrM08ioAHI1Tk47c1H^jr(p
zJ()-w5tM^Fh!zW2^L2Glkbb^xHP*f+_wURO#JvXoT8fps#w9e*el*+@bX<{swKR8L
zG<QDmGU#H89MsGEvJ<ki6DaR-kWO3S2^DPs;2fCdBsn!TMNd$QmiWBGst+Xt3h7fU
zvhU0?zV}MIRVL|}L=9YW%U<`r2Wwkk!qGG8s`1xObr&7KsHcTPtmc%@ACiB2Bts47
ze+q=qnSg;HTK)%<B9b+sFXehgDCn#x=qxGdjCnU;*DuIQj!g;AW<y%cG|Y1r3@N}L
zca%y^tHK&@WE@GY`P@M3C_bAoe2P<fQ$k2&r`H5{5C-@IFm{sI>er-f^Vspe=}6C1
zK=rr5!K~O4QM(K8qrZ6$#dWJbhUOl>l#|RoCjyW6*<+6ONo0<O|J8yN`XGD5x)45h
z&quEYPxdRSW78{aHc}|7Rsm)TD86m?K}kDnaHCFiydi0bQ$F7Pzt3q{*an#ded}Xz
zq-ipOG;bLR3CL14u-^o3{`~oqs-Y3L6;iF@`nD?MhYiM(%d%!Uo(llkkG@d19OVef
z%rT8y8OZY}-Fp5cuR2mvyKMYjWf0FU-`tvR`KRh4HPNSE`&5|&Ud?O&JJL?i&ueqA
zDTmf<`L_|7L2FX>9fI_}PYhLfewqS(#3eWlR~zc<sgA+jk1+)ABYm@nOV<jHM2WIM
zrhyHxWh*J^M~@q7#sY<2md%Zu7Ov0ZRcsv#0262NznbiA&s)!MJtb?w0Y~?5Gw7<s
zPq1;XU1s3#KHrAo?|;;@JH99XhGZ|cO8$-iJGaDUzWCjfhU$nWk*n;f$K-Y38+<ua
zPkD7&$jIK6F=poAu-S-CPm=~>(z=CP=&OYTal@sG1S;OICsG`{JnfNtm@e(3+gSS|
zk(&CRVDy#^f*Q|d(%CD`Y_$+GrMz3X(58}rjbktUFqLVl<J1#mCmI$0=ncHS%#?kW
z=ef9M@}kLEHU072*S_1C1I8`Wl4OIF-gj~{)-q}~9HQgF98q^6k3s2ih88cjpvNt-
zG$lIR(E)ZM$1<O4<g!+`V|mxw5+8nD+lu9fm@n3?z-_i0-hZznxKUzIOg;wFCvZIH
zSpxq2%<GLBINlvhAPTsTSN4i|7r%U%E9a+Ivm#*##=lhN(_R0G!Rr>ci+{Ni@##XR
z?zUSjRGmf9)HPYMvkwoCo04m=9J-0K1b-{&-$2d}--1m`{&uT<SPgbUdf<ACghU98
zqRIx+OzX4kLYf6$5o2pskrzd<rCVH@{qzMq94-=J%F**UYy#1=raKihF@b4{q5G7P
z3Lk9Woo|mg(OITykM+rN8b`ZtHZ3sZ`Vszg-G9>YVLy4O_WkC2&*(~r@uyG59Z_jv
zzRoH$+PN_V`t)uB>L<+NuU2-y2K~R5t~?&fwGAuTDMHpTkxs|nl#_kSQc1Mhx53zk
zjO<2-NXI@RDoacvYj!eb?0b|GW0!0rTZ0*zVdi`0`@Z*&_wV=j{NCqz?)$p01uG{7
zNAl5BJwoGgN}>MEhlsx3g>Iz_ZtVxRitg+_m>FOuVBc>&1B4*<*5|q^+E!QI?t?Z{
zD0M#}V7|a?CHdY707Xv%e<C5=i;AW=T`8wJzqbPkr?+krqD(PQL>6SvqY{6L#Kh8}
zNnC~y8Y5wy(P_=tmXAGOD2mpYuEOMxfQ{?%y#la6UU+$X4_F8I6kss0V{C4Zc(v<h
z+44|&toWfQfI~B<PT-bQz~8HC24@Rj>9ow+U+Sr;sc>M^!3wTq`9PriM6DUWD)!Y<
zO;P(N;LP*rPeW#<Qr(%$`Vq&XCjt_&&vwKjt9RWNSJk}lLDwQl2zqw8m24qtSLKSh
zL`x4*cW+gD<WFzYsT<+}pO>U7UgC{KTPVaFQp2*%tL#Tb!!4dC9C_YcwfOUo-~D2(
z{Pi1J8POl(EZMc<o8qkI**;8#ffS3rz(nB96<f|ro?WA|NK^P!D$9k%ExVO}p(1-M
zE}k9rWaIgL@;2={m8{?RK>%I!UiJ2$6o$uLGQ(v9tAWDux=y<9ZT|W)Y}Qn`xmpYG
z!%Ak;H(VI*`mLl<Z*oNNe^M)m;rF-`aI7t>oT#|?jZ?h5`gNt%7=KP!2|zXLZt5rY
zCkQLYwx{g9N52@%IkE`Aw2k)#%sF^Vh5J`=;t^l%8;<>!)KhLy60g5Ey=V5`Ppfx=
z(AzUbAV`SC1=|Tlr9DCv=;?mh7jPP12Z%d@E=iTz(@mVpTt`P_`RtF(l&BZt<H{2e
zsg*`scM&5YDx_7R(p3?vz^tP7@rC-hgdEjKlx~VS47LcOD2DaT#$0#~1lavqLw4ME
zJ^*f3f2xJC3<{fjhZ%$*z1^j-M*<{+%I8VK5c~Aslan@CiG%yw7xUBG&Z^AQs&Smx
zj!=0~9mK^6hJPvDsZwokKb^cTw>=&c3MY(>0n<^BM^?LlPg|K9zyA`%?1DP;N6}|y
zp@n3QGJaGp42RasVtXvSd{~N|S+*ytF+C~cV{I&RI8+25GFUV}-{}0C+ct~x%X~&^
z2}m3~1Cn*A`j>jE{|t+{ZSmA7roW*7b0QiR+siwfgZ_S^bCd{s(FdzDA$a9MDaqH>
z-z{Hl&Hv{}-|SLHV3aEHi2I-*EpVG|Bd-e=q-mWO-6+tU`-4@i@PX$%$6t->GQJQu
zNa@?>TwHL#t!QQmD8u2TFrWO~9_}DHFGm6slc26Lc_zjbT@IWaUZc?hk%X2RyN1+|
z-_7M;mXQHd+m9~9e4y(rzxg(2pGY-0|LN)kV^ykb%SU#f@uOOPHJQEUuub@mt^UM7
z2UOw+i-Ld2hXaWH5<uf$@I1BCJ!*^bhYD@`0wzh?9cKFD>4oHZ&)5)<m}LOaEWyf+
zK09vqZE)*26AM4Nic2|Avg@vR$VEcj`OdDk3%^NEvdmiS+>*|fZf?bj78079r&Of!
z_<!a&i$|D$Z){mCQku=1dtc?Q@uOFXkm88%3W}wRDTX;}D9?Fx1W;`tA+{wWV*b#D
z@S!_$8-k^QeI<UJR)cg)+mGA*F-HqahNsaO3~0__#cZNDV3Nqg-^l;TIqtsL1ZvB~
z6R>vs624@zx#v=rI>6DVyqc_|uD+sOi;#ALv2i#0;_(8XtbOo<vviz)(2JjXF~_Nv
z6vmqtM(XIPP#1-Dng<hG330Ti%-ZPdrRqAee@qLxX((79AN;tQ*$AFzDzUo?_?#Bm
zE{ZMd1aDZE;_=cZ9|fy7p4)#0L4nvt8Klcr!vZv=)+9x)G}Fov#s`BD)|T6bjjnr^
zy)<G>E>m~d>+Rwf1*gz=%_72E&k#D^!IEt59rbmMD|w&FuihZURg+CBuLMU9x4PI&
znK${#BF@)g8e8B(dhwd-t8~|WzrFgdk<4p{uU$8n4~cC$lVRg@Rc;i~(38&*zUP|a
zRvUcw^svWfNo5kzBeO>MpThtDL)6gtd-rD={hbD)E)@ID=hn>6u9?d}?dNkYcp_3T
zXb~;aQpb_?b&%^wg~k|IV=RAi0LpZz6-4Z~$O>_h+57-DxI!rMpAhvE%8~$nB5>~d
zoHiW)uiD0Rlv9Nt&68)(`A~>ew1DpcF{UkZ=Uf&vwz#<X77*(#b%RqLW{I+DtjIz{
zOl++*@kW%ltI<OnZ&7Ne4N<vBU#!lgN>nP<K0IY{S#z1X^h&O-ATYG8jb~3YXSzYS
zWPNzjRLPW95=;)*I_;M0n?+Geb;8WF<T$m^2Q`DX3ve7{^VxZswXjlHA^zsj)v+H!
z7Lwtee??IDyw1M<2plz(v$AfQ1a<%FF7Z2bPy;-L8-_!PgP*(XTFS~4^n;A2o!+4z
zNg0Yz4*(H8^l=f&K-||9&mR`>fqpI{>fRF%hLhS6{xJ6pnZ)0eW+o-5U5k#Cx{ro*
z*hpOR$>Wjc3%V2b>;e#pGW&UE-n8-%bJX-;BBo8)8ls@1t(`>nQg~d1U06?Y3W`i~
zmg_OSC0p*Y*<fR2tJ~6ig!Ob2X4*`%0ww3U&Ib*q7wXwFgl!6a&@i<u1QkoqNgR%U
zzkw{7{(_L-$ltHUd9>=_{5t{%rh`XOz0(9*xACn*z74ACn)n_x3x2F~yir<5VMcJO
z9@8|OIEa(}H8+rVHJ~Gz0^nAUBJ-=K2W02Z%vHyxu?=|w*1s9o^F+IIm!Dq{d0+=b
z@^;GkD~E^J^$|$00de#Qy9srGj_O_DOMB&}auMvHIz}(~$99UwcssD9QuzDE`R*?#
z9Sw-wD4Y_nV_bST3oYDu@W7pUvZMp62L5!TnLv{rq?mAxr)hYu0B-@0l!Iza1!<kv
zX{aKtU>6~lA)^=cQ)s1U*eG&*H7PZF0B5bIt9$ZxwIyOu!;$y$7>=}>l+s%xGhK9x
zq4AASvOl)jM=hGVDSkB8+dC|wBiN$r4PCRRI{qLO5&EGWkeXE78T{v?Tc;bE*LP(p
z1yL!auOYv+`qX|-&29oWzSoa6bI(dhys)z4wEM#}g+Jahy}!&}(shp=a`PD&AG}Wc
zUa?8#iDVcqrR&b+RMd#NT@qXJzX80txEv^2Iv?k^qw9o4>fhZaO9xUffK{nwWJRRA
zN6c-2{xhkb%u7Xb+BV=%ZN4pDU;kRQ4NS4xai(ZOR>*V$V{=v=FmeA|FUz5uqCF1x
z*?67rS=Y%Tl{tU`d_FW59V-O_P+d;KLV@<VuCY;Ks6s%fjWgYS1FEShPTh>o?fhtX
zzu2;YRq`o0d!6Fm>d&#-KbaD&YDybb-fC|+JB!J2O8MFs^cEp0sE4nMcb|Q4pXFzl
zlDQaUH;R)i+lO+QwU8Fc<nJTJc_DA72_uS8vo(^8h!Qw4585EXz?kVth&COxz*0u$
zCipf}<@Un>SizI3q}ZE2Brk@$3@}u;WX^nrKLt@Q-Dx^}{s_`cFu2)|Yni!#IrCFs
z%HE8aOPnU^+F7FRev7YR%zpzrsdYx<S86?N=4~dgJ!I7b29q6@4i8XBikJOKb79W<
zc)US0tz4RO(p6UO!r0tjVaLG#5(Tl95zu*Xu3dXYl&xn*9HeOf@$pI$#>zk^zCAWl
zN;UoCNt&zJwA*BY>{iV+#befRJuMht?=*#^kwHdU_+-E?LwnOY)Su)S(5N{`gf+)s
zC{)zp)4=c6IYv$xKk4a!d8AVK$w#-YveOpqgIj4Nnbq`7y6)^Lf#!$WDnZy5lV*!B
zWzOn0_=dtDX}z-=IeY-kY}V#rH1arOf8gAlbY3eR<Vg61fgzjAlP7wH0<$PDm%;eH
zYjdo7fM1xllcqw*U`P#@emjv3b3S(!#8#;`AAKPheNT_#FQHG7ZHUsYC{EgwS}z)-
zFK-tWDc8`h+-8rhQRDQ+HWm5yAH2N?3QaDi=27vwp+&M;nkDU8Kan(<GUIY$;`8Up
z6Ai=J(FX3x?x9a!f!cwkgJXQLww$A;oN!F^_N7uqGpz{~uNFTQE|fB4ZRR?m@m>T{
zi4<JzsKaC5c=-G|<tt(hexaB83+-M7jdFP4%iYC4wtj^wMTTp`B@=xpE$q}o61<Af
z!GGh%@i4__F38Dn@mA1>I_CUc_^&`0{*Cd*aot!o%`>PB`c~@xhYd!)Pe?6=(H7xu
zoZsDJ<W~_&H-|`Zmu;E=FAtFI9DU=G!oP(<E6qzgA7T*~efXREOSsJs6nje%7mqX+
z4ssgy?B%`e8dYdSpN!q^s+;da-%xdTa~}dTx)1B-YcR6L9=Us!YP(1%$&bhBwdU*k
zAI^{(mOhc+RcXw(%GC*X&7VDD3Iiq|b>TXn#?tl7h=E8d8-<ZM#^{}oKcL3qHNZSg
zIEn-mfhH02U9EmE)jZ{HU%Pz6cUb(IrhP~DGX4z`seV1w4%?~<=^Cwi7{4NCd4)P5
zcM7Ab5g#jOa_YXsj`or^eK8QTG&plN`<LRGO<6+T<9u(s$M)Jnsw36Zse1VRw|Nfd
z43Ot5jHihe056kx^Dc^CZjUj=qv#*_?1<s9#mK7Np6C^1t_}F&|GmnV85|aclkJ^5
SBmc61=en`QwMs+hnEwE8tmvQs

diff --git a/frontend/editor/src/core/assets/login/LoginBackgroundPanel.png b/frontend/editor/src/core/assets/login/LoginBackgroundPanel.png
deleted file mode 100644
index 4ea0e0ccf15a4a9910aa414b1d16b362bc640adf..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 5426
zcmeHLc~nzp7XMxhyFjhTB2=(gu++*TTaiEl0^-QxLX~}$eU&|IfwV=3C3Kh$NZ1ra
z5dje)61J#dtSq7|5yECbmV^ih5d@<1VrR|~ic{Nj=09^zPVW28d*92w_xJmK_uli?
zmS&>DJB0xNqUMJW9R~oh7l1801o`0=$9!=k_(v%Cux%&+BHMXi2;}5S!;4VpaWf-O
z(J40#Um(3O78n4k2qJ5)d;myL%@1KtMnUW$Kf<2p(bQ-4git&AU<7~b=i4ynqw&qb
zO_^sd3EG;9S!PI96Zup_namf=FblMuf9k(37_5~|kc*!**xCH;0G-Ral7DY%Bw>MQ
z0RcSc#k5b{^0=~=Y?{gt2kR*B>`c22aF|ujYZFyQaj3xse|P42G=#fY|1^GT$z19L
zf)AWiv<5iczh-nJaHra-W7yf5>z((hTrv8s08~H@w#q@0K-eY$n#P8@yNjsiS41v5
z=jBQeGSQGipNFQ(F6Bf7XxX+GpymF+2$2*AGf(ZSZ5v}EzVF_`{-NHRzB2Qwwn@6H
z&cxIjxKQK6vDh2B)48eCNQ~wl*o}ypalzzoEd?S1e?~)qAt(V9(m&3?CE5pS_bSr@
zzJWKMijR!8Jw+Gi8cew{$JneqNucKaHZCSKl5-w*ZSy@x5B6bVJT+0aJKJ6e@%*oD
zy_ADHJZ&`X(+#^HXAPFq1A7>Ts;VOCzX}S2&&&z|2tmGQ%sf^9US2eyHPc2P+;A@#
z9_&eZe$(=PvW&p#TLFy@<-UjEyJzlnB|YoXXT0xTHXZ@i_DW@%v)g*HaZ4u(LGa0-
zc27=ctW)OWtLdc&73Nb)N>#Jk7^{s55l-?B4n6*ln#%|k`%w&N^!Bjuxy;Vk)tzK(
z#_VcVb#)`vd=kGPl8B&$bZlXa+Y4R%r+)z<!l~CJgBMKR+XNP0trfrFtTmJzlq;_b
zps$Q|Si}wQ^WB?T2q;ivWJGN@oR@TJ<l_UpyogPOSxqh+70^yF-RSi1!|<n9C{SFT
zU9W+@{eHg@gSw^)<K^**k`g{3*B;ayZ#&y=#SFVyubyO6UwWnE(kpgRSsObpN3Y<h
zuX6>B72vOh;47?DDmuoE)ho{o>2p~=TU{ze4_aWct(r!5ySX`&qpotr`=VO5be(F>
z?qD#A53DNXj_yVZqpiYsXQ-&>PDv$T*5jFS%$9v`2}ZeGuaw1!uiwZm+U+{Xq5$1%
zlWk`j9V!V;Dy9AD<NN5f4-~9{F4<F-|Nj1{U(EE^Z?hRus*cG5{6dhFlveX(=dFZ>
zy3#TZ`Nf!5w@)LgfVNDjXYAJ@V*4~XS-sbOx(fphe;@&^&`w=?>m9ow81iH~U1<6F
zt6}3WVW69(N9T8qKk$-a=X@MZ)^m#gO20qTppTvq8Tu$QwZGg4qEOb}Ft1JNC~n4Y
zRL$+lBfl7*t_`?jEGU7?U-7NGe#WIZ?AfAQjY^bYTPlRTMz0>T?Uva3^Lm<n#|z|Z
zkK<lrL-EdmI>Z%hV};G!5#{)7_`Y;sTF4U_f~l75>N(bdX4E@=;=b@f9UqW^CFbDE
zX0yS<7q8FS8oT{tADDTtP*Td`kj2Vn>*~IEI*;JV#*}oT#-UyF8~FGcb&o9$nu@TD
z)3_ivZtq3vHY2%tsNb+r^iWSir~zd<`nw+474Mk50n>ccf)u|RD0+NVZ2CsznEK0e
z0;5oFi^!@glJ7U;SpwLE^E|KzpCqxu*>)r}-IB!hl!rZH`pSNO$}Oqc4fz)}`aiGK
zbjJw<f37-{42LQHmc^ZTAqgCGdnlbD=PT#6(7|;nfQ3XF7g1fBRc3R?S{n1ds(e5_
z(*}SMH%zZ_iS(e2L;hY?_DQ!htj0#DaZ#-P&K-*v{tA+Kk}BBS#|`t6uFUf|`p7~A
zcUbjQSrYZ(rb_vzC1SnMetP`<W9L&eK1E}r^8Kzh`2><rAo&E6{}T&J_)yw1Y0O_e
zju)-W53o6BYgE8XY0O2M5}job@?@SWp3xSg`GM-;5019RzCJE$d<1dBxjSi>eSkKn
z*VhJYO<7-GZGL1wy_(jjCqrO`#iaSZCFi-S(pbJaL`308YT=Dj$$!u6TqdqUT?xY-
z{bk0jLf{@_n>b;>L-SgJg_71zw)W*fdTm85fe3EPEAG|zU3jsr$9ri^f0q`dpBj1W
z16|bm0&_#BrQ30v3fEK=YZ=V6y7D|i?WDo^&HL9M&B}e~zJ5#O%L8DrAkI3fr;lh6
zSLYxJY<Yj4sCT_%qAL>VB99b~=|wShPilmT+ejk#Tt3rhxK>Ki(YDzHh(hrAef@<e
z?upUZMT6Zmu6L>w0Z-E~d=CvfJvkGxPSm*uALa$oX5gaC&p9`FI^;>TyQ~?Y1ZLxJ
zDpI4aBZ2W(?;7sQzq!%RZ2GT1?-yR#_`CS9wz33+ykYhz(W9;(?gL*2=8FNYJMu??
z*RB4NQp$P#I?s@3Lm`P>9+C|hM>kz)4%>j=vH=WKjbw0TEClYyA}Y84OzbF$PYAaG
zYI{tr5xEvhOK=MHqjrdb!K}>z@PP`Dck@;i>w%7v^fS>dF<U5I@RdPOPSFoWQl^h;
zmzpX|0$5EuU6B-E;fH>6({9KyF0{spmf+wd3Fh9me?*npS*Y#Hs_&0-Sm5=q^a~NM
zad`odixl$6Ip@wvPT#8|b756i;a&=&R7JIH|MDwKJ@ZOF9M!yVPDjZsz8wiR3^k%M
zT0Kvc?#tqzQcb*zkF9a&(@;B34#rm5?Eu^`lK4a7LUf*$QVoppaFk!p0BPFWVK%p&
zWEe>jejc&<Z3A8Ehgs6_Pn6y9B%r^)Tf9KObm>tiui>mKCG2mmh+7$DGz{mm<HZT2
zNo5Yb(peG&OOF}1m``%6s|QGNu#r|O8VQYNd`tj7a%}M%T{;U9XJC{V4BiTWK=OgB
z=-2l+oKE*kDfw^7bzg(g;1Vr`0-cn45iq3_$^+n7TnByGk2VpqR>(<=7q2W5!hQ?%
zEyoCz6}}^6!Ikk9^73lFw#6aou#1b6Y(EI+o)dpI)Nv?WJ-?^Pp@zjshRHPS2q@oV
zdYB+V#@#)(?-BZ4_SVASc6#2G?Dx3#ouIjp_;>7m8;iA@&CTuEjdI+_?55KZAi~R<
z5GD47GL@_hw&uZ&-iEo5%%Fz5(<4K8nqj4^tOcuNc1~@%;o#sP7l{j!!9*7ii}9ux
z`b{EVfv8{5(Zv%`$jfq{E<Z>Czd5Rpj-XKG;stBPo~YC2A&pKnDviduLMI}?Pkw8x
zg%l?^Q?VNT_j@wom4MhPZr5yPQ;P%$PMG*J!wWC##G3>D%r40QdsqQPVTLp|qP*3@
zFpGvMCJ?CCDu<%`G$W-zSJ21r`%tmQ;BK7>m?I+}DsuYWj#;3K;jD9~U)6$98@ygh
zGHuDNuAv?%Z0Mjj55@l=cxo2Wg7a%Q9Ugu8kBvAw_1Rb%EY@eQM6F^Woa?F~O}ceE
TBl2ql0DsI)EDu!}xg`A?d2z%S

diff --git a/frontend/editor/src/core/assets/login/SecurePDF.png b/frontend/editor/src/core/assets/login/SecurePDF.png
deleted file mode 100644
index 6184440e925eff36f249dd9f823aaa7b3d6f5959..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 234488
zcmd42i9eLx`v5$WR6;9duP2nX4P^~U2qpVivt=3k76w_{EKw98Te1$rjAe|mWer7U
zj4{TV7-NeWW(@DGr=IWc{R`gr`h05K=iKKy*SXHMpL0LEXQ0h_nC~zM1me`WbIS+>
zVsiw6_7@*K0JNCDJn9Af9P++n;Rgb7oY?!v0?K%Q8fawkGt$-oRrCwY0}uOM)b-Ut
zpsFN}ZF@ElYifedEp_8ymPMxPOUJFpq%Bo(Y8P~%tn5okSvjpRqoD4Nbk&7#aF3UL
zVs@-Twgf5kaph(~g!kp_7cFSJ6K{FVnq)^pTv%y&;N~M9tk~o$GgbQ1!v(jVpS);V
zO<O9d_+sftsvQ|n9@yPBbTl@dF|xK8Mue&L**V{Se|@gq=<(X_i#g?pV*qjgU%^Dn
z(YVRCHVym#5a1cl&5NPP7P0Bi`}vv5&aJ~wd!DH!v;FC&PPL76M1E^LAN0)R%_yB4
z-tZmv>!k`$J%>~Qws*@rXu1{!#gItr<eiUyh6LAbJs+U(w4uBeo46x7nezSJEUpLj
zI=MqI0Z`IGFU~UV^RFRmW6O-DKO=-LsfrN0dwrYzvtXWt4#8UOgZXX*6r5yld?pmt
zK|4_vcb^fRe3J)wf7AawK>EZuLAo)_hHIP}ko`(2$T=xT?bW4{8m2*N=J@wsvvuDu
z5m_UFjJGy6sc0yKaZ3H@-Gl#578(Cwq|sU(J@|mjJeXX(3+oXa3<z@}C=T?p9LyiD
zAfU$`Z;)9DWthd@(6R`IpO2liz#lrt;#<*z{%TkX^?^<UPH_MNo)cv6R&^94Er$e|
zhj*$r+FxVA2g3HIiVTfQ1DH6G4Zr6t{34+{e_phHqbkCwC^lNed{7pHrnqr91eK&f
zuu4H1d-%t$?uP^K+bBVA_AcrLHxDB@mpVc)Rg^g#ZDF~j7L#kc<4qXGpxUM!^eZxt
z?v0@xc_IY@)#0dDU2#v?;J!goLny@fRYLfV13t$L$s9vyimrVV!|DH_Xpe(q?u0h1
zLWa~;v81<x`@SnU3WuGdP$lr`8B(K&HYm#;DgXRS3PGsLGP$mX(!ezSrs{!=FVt(&
zUJOS!QRZY7ESx<E11I(YZ%<_F9s+@yRgTBmSDWtlx^wb~{J6X`+Sco8a@bc0w<GB_
z!4B=XaU)a{IV$8&ap1>}P9Vg3@xON1jR*D+uqXYdOOL>cKg7Yjc5+)QmC!LGuc_0u
zJU`pG8{TdB$hn-O%#!-@+9Agc-@y0)bOCL*p-HuI&m1(foJ$56O&g?s-Qe9J4|4UY
z_SjEA4EdZVi(^00%T3UU^G^3w>n~%nd8wi7wk(2}4jv@tEHD)0sUgAv0xcC%(Du{K
z2n&%=!jl=Uj+v#?snH1ko8;w`=+Gr9LWuKW=lR2410JYw4NO=pmVIwl9<dF8c3{@S
z`0L48kKl{yvCp}mQ-+(ZRev^GyUg^X=VeKw?&`!&uRGtxChw+ZcCPy_olxZh22bSP
z`aSO<(tv+xm*ONwzBE}yBI&5DRs-|#b;;Ugl#&%`@y1S*O;cXF182G?F`ajNHUJ;n
z^wDMgg>*GISXJ!)2C(xWP_7fOVRb<U3iY0?5fH2-5-cR8=R3D!E=zi}xfQgr_I&IB
z=Y346`n*>!_7`NJJhp}>Bhd>Sww+3S40-gRQrJbRk?0QQ86{r{T34n|?7rMx)gKkz
z!wnGnsz4pzJ1Ngu8xUKoD9hd))htF1*IK%l8jzi;<X=l2hJ`MQ&@7f2Sz=^<T(1SX
zF<gnT#*kl1XCTA&*{=)H15=qd(49;J@@ymK{hk8vp|$^Dk1Hj#!haDwg-JpmyTvD>
z>(g5=j42BW-RzpjJsyS8YA~LpC({s5vQ=sT$>-i_Av+OrPCTVUlO%~%vwfkTHa}_)
zg+ahecT=4_vUnCS4+&nrjIGN0&))Gu$ekOmV*{VX2%*w1qsFWEgbV=X3$5Vj4nKk?
zM)Y1PVWJJ;H@VXY9|-6$Nq?cQ(d1p*`Aa9ZkJXVdE*J}+Y&ifYlsa^_L2_M!-9cV9
z<Mz<GpipS*g(JcwSL@00H&u*~_x8qpDB=hg!JU4cwiTAOnzX7EZad9=L<sSW{O_dR
zu$bC7PZ$Kn+;E;8QN^JjL?Tnos8#({-g70r&Rpk{HwfVY@sLKTpby=2)%)P5V&pUK
z@VnJ^TL?j{Ler4%WFO@SpT!;GDS7UUHt3Q=_1u>Kh_ZK5LVWF+g1A1(=MFyi+=uI8
zYJdroB4dF6$M^}7%CcUJdc31SXxsyP;~Q@FKi>)*6&}Ycs=dk1Q$K3HLcg7wS=O*-
zwRx!IT97wk(l!+m;U532Iz#_^;B9J=k49~l4VXZy4%zyFBvYW*zBz8CXIKT*bO+2i
z(&n7*%GUC~OrrQ^qB}iEO_W;nPt8$WShAAXzpHMh9LzKvJ;iQddS;VS`B-ith-$uU
zFq|6t*ePja+`!3Wv01{=iF||6F9Yn6$Dn&aQUD;8oe<hQrx%4=3E2zp%kHdTE}4xq
z7B=hmLKt{N;K59@f+pkulfZ43CCP~Bx8YpA>u^(#P5R$C19|1upiqp>xD$FVux{Xn
zunon3VM`KK_A66q%tiU-zE(da$b+SRKbmeGYSlaEgh6c3NKvi5iY$YYO>n4phFmaM
z4#Kn&xCsMvhMc>DcT;y@XB!&b)aL8rv^#*SU$M*L$fr%c{dYc4LhFSIt0QXl)k<YS
zMGM_#+Z5CW57a3>V98&Y;|OZ|%CwS{pV>ZqT&JSYlBe?6Kj)8RnvErP1Ae9l?-h67
z{Q6Q(wKI%?hc4l4hN}o!BxFB@AmjxnqQ}#x?bow|>$@Sa9@VXY5%&E&6$A$r-f=wU
z+3h*zP6A+Y_dp0TIbKa#o<*U`LL0l+NUn9z+GnqA@b+0SIg3E$b$heA(5_G%Km(KD
zbt%+2p0Ql|aO1=xj&e7Wx~58V4<ih~C{+np3D|lUIq$k!Gd>|wAnA?LNl%1XW!izc
zRwZuNfmq}Ie^p4ip%vZMrX_q1eO%t_^2#U|8Dgq(WBl~3*uJ*m5lMY){ezK^z$8k?
zQiuo&qSnzygjRPmZSa&;V$05$fh^XHR&Ptdll?s73H@>wF4az*Na^Z1d8V%e1OG$)
zV16>z#<sLTkXx-Dx4xDFEO4SJ74USCD3^!ngeIZ=>a}|&(QN(Usdz6Bu(L-zBRs!5
zAmS7GEnw|lj%7Pf4hxeNZM`<PdVPf}p@Y4bnN&$%vL8=%@~=fCSu8`UmVExc{r6qk
z8}Im%-b;tWy^4B})!hLn;3$P!G?Ku~6==lKMt)f562gWsO|~@HDo4nc3VthKyxRiZ
zo-1Qg{hRTiq<yv)Ba8m)-tn`w1Gm)x8R;{i2)WlW@7AHrGRl5grOx&*I-sgTP0ymN
zPn(#?ml_er%@7v+@wh+>FS9n^>D=Xff;Yo_r180*a$|xGDttHS7u>c2AL{B84^_iC
z;;SINi$4nEW;4(^OLa~y;>T{oCJjy`P-YP;AWP#t=Jek?yXU|7N-urywWvqz^L33!
zHP%z+z$FUM4>e4>0@CEFeCY>bFZF|)4sPpqTi`&C&~QNxkFAO8o7be#z@d4_*_llJ
zr6%xAoVlE`Sgom4j;k**=9WnoM!GLSuHI84kk%nn3yp{;%l2kH&Yxre0vi){xGZIC
zM_<nP&h8{+5itAjY4#fyfG27$iu&!#IUES#*(3J#Dy(?H3WnBp0=LLO4~0DHVB2(&
zhQS4)eBvLh1aZ8hg?#CYTK1X`l=2oPOsdv;49KcgwXN~I?1X7mI|Y^)TaV5K^fgY>
zE>aQBy<J6LR4+X`-oMm&2Hp6h)MH>TL0G!D&jJMUHj5<~_|XCncZg+-MR*WQ9N-MP
zr_yy!+E3WLW~p_0J;7hNX;PBEGtgo&t#kZ*3~}d|c{T3B%aFE2iVq2hnUE{%0hlBu
zG?x-vv)9rz{m_;p?F9{jd9o;rWQN_Q+UyodaJg)NIb6yWAFDAG#P;ur0!`p|2u7en
z8)#f_QW&l$CerYQid60ys$502Mcrn@B4%nW@u%u`1!){0du%3<yy1qn8}LNUZ-|w;
z^L$T$fODAJJyZtepRZv<B-;DM<95qOC6>QG{BT(S?L^`)aq+^ZtAxv+7#!nYRZxmq
zJ(1H9W6PK%#568}%}1QnOsX9;E&+nzJ#e&ZAD}FdvhD!X25oysh~~vpCb(ge-6w|4
zNCvlk&eX6Gu8^iw5}n`V{Q&#=eF!q6_tIC^hT}@dfq2=1`7kvoix`MIRF5bs+tNxU
z_j>?d<kw~=y!JBwpO?hX1}zKiT%=6mzNtf7Gkml{i_^Q(k3pN`tuCS^8N{7%i1S@!
z6n+RW7m=vnq7cR>7FZ8~slreAx*w&b*zh>TPt@qlLW%(8ke5a;-t!@Ajx8_4bJ%AK
z<CfF6!?T8aYd0Py;Uye8k;Kk42A#{~z1Ow+it&E};!W9pYyi=$2jlTwDsM+3#Sh~-
z8W$nRpH5h<3BxQJRc|cXUko2#ypi?;!attO{uGu0{Y=Y11RgjMI_7jYuNz}SD9zf7
z-vC&;%J=jAA+G@E^jW|PG2Bv}nocYYlycG@qbKRh@)mQw46C`|HfX=R73M-v3z9jW
z^w~Roq2rR9SLMizY9Lb~(0tB4$D3qBuzyzt`08;-{8d8QjdETNj)B-vV;}nLL)emE
z=-f7hbR;uWO9+UE#s#@)bLwxu?nQwBh&9UDp+z0teRKRcd&7g`17wztowGQN8}`mg
z=ko-6!22tp`;7w`BS^+I#g(DPS_;jkKbG<7(UHvfg1J_x@(&34#)+j>tNGbCVzmLp
zj&SJIobfWltu4gH-Io!ZN<sgS)fY}xc5G#`S0lgdsVD%=Olc3Ht|b%vi237?aN%AL
zms2&?gfy=sR-Hk3+^Y4y;wmxPGtKtTD>7N*f=kxVLSz~fDy7C$?huz2g~*Dy8C9y)
z`_)=6?gm@DlXYL~oZ;BvhlJ^{!fwj+<PIM0u$Fw7Cj6y|dP$A@_lzL!*p(j=-OFPg
zP$_dFWu0*u^Cb`So`dEY@9kWhJRtikMDu#U_;Rl&4Ihxj-ooxoT4nf+N9?-QX(Lu;
z$o$+iYL6;*Xf_Adft&CLY-<eTQy?ep(N%BM_AlxhS8Wyt%|$uvmRSAaOtWhWp{o6R
zwgG@8Tl<s#SNs^zb7QDet&(dOS0^cF>U*ijx@6))V^+EIy~&!-(C;~l_p-G;po)9g
zaJrtI(OWwR#4ud7KVcCwQ6rSrNBa<~-a&wl{L4d7rGhQzV=Q~Ji*Vsl-*}0ySEDjx
z814=$mUj@pBXd9lvW|8w<!~<n!eG`rm<FV+cHD>dMhoem(60zBAe>x0e=zD0I!p`0
zR6$EoDo5Vhco-qQ{!k9OHaM{|D`t}I!iE}kK`aJ6vIoX~6*vW?iJ)L(xzhCljX-YB
zVK`~j>2l`jC4t;O^MX3*pXG}e!%Ql@nk)mu(sl7#=*IKFpgj<RsNNl0l52r{n=6y_
zP*u15hu-riK2CxQ?!*6zGQ5?8GNT@J!u*M=Ktk5~8f`u;;vWY{^WHR`19N40rvD-X
zDTidl#z!d~Um}`eJ^6uB%x_5Iv8}2nzMV*n38lReoO`^NrU4*ySt%yYA&T|b(zsdR
z`#HXUTZ3a3kDksxCU9B<Fyp@=G46@%v956_{e3o3^tJW(Ue`Y?U-9P1w<&r-*w-r4
z@}&AJqT5gZ0$}#`Kw0<N!7zM|qF3%jZxpH{9zK1R@}~<lu~hx_&AmUl2WaWoe-qWk
zQ;+ow_VWIV0>q_T$GBxXcW5uA+JgxY<ycSCpNJL|8J*uke&_8%I{9xesJZ3a#Kxjb
z?qcsB{(-Jv=WA?&>s<)7{PPNkT{{|Q7Ie_DbK}bY3s1eE2Hx-g4h!6RKH}W;m*bJq
z4k`{C@H)*4jJ+V}H*h5$fVlvuc<06cE{xqHU8m{i{~q<*aKDsd;Ie=FCnn58qrB(B
z;YELB8|3XBI4`bLkuLLRi6DXZ*7WXh@ZU+;J0<L)S{_$j0Ac+N-riEd#IwmNvVWc<
zqY--KsPzAX&(*r}Q~KrqgU^!p{a-<7Zh^1JIY#{*T*oL=dE)h;dB5#n?6t0&bltB1
zJ<}+cTg=k`^n$qhWln^l&;4)ew*9uo-GA8Dte&s?-=3Z=as0b!Lb?B^nbQ`d`R1=$
zjIsW2u*xmjzv5P>9ax+K{rd!BcaN9A`~0__GV2n@fj_k)(1ac3o@l7SU;5a4Lpql3
ziT2Le{9RA7RPb=`!_=G9Q~x25;<UAe9Pg6(tJM>Bm+SvZ+?eLwC4iMn;=j#8WIRDw
zp?>LFYUrQA%`5~bU)UbACxr4f_7>Z$DSa?Xl)2`dn)!bO69G_AvnM;WlfR7vNQe!H
zI=|1*_cC8^?qfhu09cHlTS&G(F<Kr3z+P8$@HfMhCB`555?x3CGP0Sadcs8Zg+9G2
z8z@pnhQ=KJ&6lM8B;-V&m;!pwiqH=3MLeKL?L*N2m~L~h&0EUD^DfZ7#3J!8>MKzq
zZ@<c((D(dzM)5y0x;2qz8s`2Jpvu-u%7g-^mONnSZ{XtDL)%>R>|cW{bP=`wO64D*
zE9lIhdGA-N{+8$onSb^wKcJNhAwUFg3#=g$^>Q!#1U2V>vJm;3ivpT^D$X9qbs`j+
zhh)3ES3{=0__MC}A_vn7w%ToKPjy)yElu}f297l?%!>Zqys^7&L%2-iuBH%v+Va|2
zk9;lE-c|?RjQy7b!&%f<Oy|^D)b`)?9IdAA)0c4Uq&+58E3JPZ;+TJMO}v_7VC07o
zNsNSe_Ujk-iq(6deDvCW=0}^RY0S7O3Pk#~fz&WTGsn2>7bXA5Ifz@5QyqhrJ}Fpx
z7)z+z-4bhAz+0#7{@}8gD*r1~%44lrP`?~n1iBk)OSH#lSqeyv8yr0H?<64Zg38Ce
zPe!)TQATLytQd{4#MPU)T$%Ns9t#C3?Jr3H@-^_$#_x-&`e_U*7db-z&+v)+xw${*
zz2_E&L%jLqi_<uRJT<=#SAM~J&s7HP?fD)|+@Fdb#?cNsN#9f<&NTIn3cdF<U*6;*
zEA4IG9;|#?8!np;-Cs=_3(WbYpLT=n#pvfE2W$P?4PclnwH#PJ){_|DM7%lD2&bB$
zx0eiPr~dRe^OQd1400(yY{QjlcmxUl@V_0-j78BRiH4gE#Q%)(BLmIv6_?!9y^C!A
zGe_gCO#Mwn>T0s--~FnLu>amVVHM2y8!vz+sIj4jo5Md%{t7{u@8piyHs4>JZ3ZHZ
z>=pOF%LcKFd#Fz0{@bnV!A-GGOnSrPbsGPW{r{(*CEh21AHHFKI&hvB^>S;^Q3$E(
z?K~Vm5@n|Y0_7+Ixm57}N1)K#nD^M;bS7@kus7#-?87TCXOrYUKsEnlJjw-O2N`nc
z_isM&?J3+NM-~cDY>bbo26-<7Nl3G12YVIid+(V&CQ@BAWJ!Z|)BqOHm<do>UP%^t
z3h=*~<?YcZ3s7AtU>GJ?=EQ%}k+;hC>Kc*Jc2H+bMayCg2*hQq0RnML*`5luIp_c&
z^RDzbH}Z>4`vL6p^?Q5BA_vtH%T-!#pkMBd^<Ei!XHE~At7QXu+dTq|7q`f+_T}L{
zJ*hJ*i)}HB5-~pxY8E`3%ofT1GOh}CNP4f&8<4tv%`6`P*ROmt%xUp=khi2lmJIDT
zl;8ku#{8ynGPGmxBk(pTM~uU1{vrn`C=xI?LLk15>|xp8RsWTFCGrbkZ8;znU{R_?
z5sQiQ>3$(+_9Sp($DZj(Itprr<N~&QDZ&(bX)h*dX3omdyZ1Fy0Am)(c<W{2Z3?tT
zG6vpW>I4`jZ^;8{hTdhx`{XL_ahe7bMK>PZ-vaQ48VgvlI>W7nk>Boj$rcNbJk$i5
zkl(8c&@Ptj@oOcrQUdRwepKoZ$j;Ch*cj;31#<w6^35{cG#fam(h%UGcLY5HXajL4
zl1_n|oA&k(Dt4spGV^x{256RHDp6ko6YiC*X*pN-ER%BZ1qo0jRAi6nf!}r{cx5F>
z3be=ySn06{gFVq&nYbYsXAijZK&`!j$9CDJew%P1<85gUQ0VWm91+a`x(W3TQZ=ZO
z9T2}djQ8_BT@!M2*asRpwTI2NV?WRk>>Y3zWM}r9-aQTi^uj$^K#R|Rn|u&R;3VL9
z?6`scf5AIxFB|?1%__eO{lEXF-O>I1d-MDeubmqQ_XFa#x2)jinA&jR14>+J9?x#J
zis49&VbxBzPDiqURw_B9Bg==+mzn0nb{<CE(ui^#v~F+W-nY*Z5Trd9q<pXS65oEj
z`2`8PZ@V1sJ6MtD_gIC8<!2B}Znmor)#4E`;}}z6b2in6ggpH9_ni3zz{9nD-Vs}g
zxcgmKv{*`3&ndv9giJP)KAGoj>cwGnQ3qLbr$@%xI%R3m|EzSb6llU=Z#hC2c=E9R
zk&X_zF(Wk7KBHHb2r2u*bHkP<60^@=_lg#qQUW>L^CO2l47zU(au%d?7ZeP+>WB`}
zp_XplFV9C6$Q0DFKMQ%Pw-*+1zsuNx-jmUL?4%_Rvw8D8ynLQ?luCP2`Vvto-}F<M
zo98>vVmRIJN_y(pWLt`w|DEG>6+pW81G_Tu!1;-*NJ5LtBi!d$$>U})>{y|xv~HpC
z>lC&M#bAjyheIyv)SIW=V;y;Yp!|^FJ-p}}gRQCb3(4j4>AL#MF1em2wMON2cJf><
z)$hv0kUBa}g!8ZN{tVz76nh}^0dXoeWaK4naJErhVEy>$K9DzQsB*Z(Rzb!#ZEY&g
z7>l(65rPGRhGFy|&5@&BicRHDOukk?*I&K<SX4-<>OAjssv6r5s1o5Ou)mupAtoPU
zQoJb#qdxGk!H;vsNhOwl?=g~rbp7afep11-u(AH^u%!q->_tJf^x*h6>34T+28+u|
z138bYP6R|>5Y8A4Nb73Y-Rg&Dl$c63EUm>E_hfqVzv)XkneI%?d*@;5D-B8Mt<{mo
zArUr2v-HpOE2EYo;PT^9<u)~kO59mMbu>P)+2<G_b%EDk%rvXGGf5BNt!N-aLF65t
zRmkB5=&LDHZBCLlB(XiVUUC^NUM_BMC(teu$X>j`djV8VUNc+Oea|zuPZjw{;wsM}
zrsAYz272lA44XH}WpOYFgqgB%*L5W$#aL!e!o1YJmDoLcY~;hmnrm_+HuZd)mDl`t
z>&@lPm^6R9a>g3jMs%heeg0X$I8D+>;$%Tx(^+z_q*2N10*u$qXuN6n3^)K^Q+_rv
zG{33Fe#{T4x(%2zZ!i36T|?C*z17lvU+Kd>{~(lVW&NvTW~adKGmbNFnQ91kHQ34j
zAn<%oBCkSryiPJAvHQ%yw2n?;RI>aKPW;))Hg{0-j(0l<6xK7fGU$9w2KC9`4`PzW
z>s(lJ_R*C$$p(UV5VZk%=ZGc89`)ST_+}kdX;VBnl3|AvxV8{|6oTL}nK+>Cf4znQ
z9>Dv{OV?W&SrSSzIMNGEM_+5W>ZkF{6&PiuArrag7x}*4yIxAuN6E8S2qA?)3UPpq
znDF#N+m@PKgjF<%AZscoH1Lk9vfUo?mUohdsL%?GZI7Ow(Zx3lZ{Qm}BOO$>1T_Y?
z6}hDxab@r(GB3R~f!|Z<8I@YT!UKx5-cwCgxrz+AnsLaf;<OhP#{;2GI<0P6SL%6O
z$@A$RdhuN0DXK9WeFs_}t(?3qxyptFLmxpvr{v#Pm=nf@4KT3!%;@p}x^Sv`UO1W)
zdA#_g4SaBP@M3+UDt^p7Ede1~A5KYe9K7KQp`;{ct6IyKzYw>sjx9g6SMuvHtHNFj
zMjUGB;cGX=;)nw#9N==cCnY>DzD=#(vcXl<FJS4U1FE+;p*iL>UaeMIQf)I<hRWjI
z_<qOZ#IsSRwd8(l7gtZ2!%jo<nHtt0PzK;5L1O_tMxHQUAJz+;HmnzWM(KG{(*5MR
zVlfKDdT@MP)Rogwlk>XtBlHc@ktu9B0qZhdShAlpw+xE%O!X=&ug?h$4b5kMd-7VT
z{L%`EP}XxCan*ZR)?Q=ESkB{92;%t&lB&w-qEv8i<ZA$|XKgep9CHrRK&r<I>3pnS
zQk^s?ma+$Oo1FLV`X}}Kolbb*XRL<%^l`%S-zN~x>Sbyp9T2v~K;FDjrraF_qb|H^
zhjpwOW_AnNYVNB1>*FNssI|*P^ysIo#_-@$5?CaYvYamR<{{h=)SSJiQb8soD+pEP
zDwf2!s@c{IDcQar`j3p70HmI_cCBMIC8V0`L)51^_oJJKY6OJ)E#;nb73h9WDM)qI
znV)chI#@e@ERq|uP7PC)jpq^^ylke`pQ9$*i`6t>*K=@ixN_-|$b+E=YwK4B?wG*9
z78b8q1aFES=i}t%@RWRKY#Bjit?+hVrYOED;D0#_{*}^=&@(H)pjVA^viH=5mzE9=
zt6eC*`@-<UgZs6kmnxb$9{~w|v-rfmdn#1acxA|9g}M7aPDkn2oTc9!KP*j*Ue`&t
zo@R8X&COXiTUuKBcKYxl>4!%<4x!r3I^+!&Oi1x{QP{Lqs56lkQWaU3N6`665@CS=
zE_=@>12q8(<N^Ph_Ud%TO*f;9yiO1wU92h3`628-(QV@A(_b98WS=~;zyZd%U+XGa
zXfFOC=^zspc3;NODs3{?{zk~mr^el#P<hex(kOKBYMzvg3>JJUY@^inO#xSv>h_A}
zyZ7&3KNfsFEMZc=@=be<DZG7iXH{*db8wg_z1;LG+X@q6A`~%o=#1c*H+RMU>3*#*
zlJ+%VtLIEm$ivn*OtIr<h;udT+}W>NJ5r=%?sjju3+rkJCDkBk3rz4v_>;`!FB@+;
zr^n%YCHh4(a|s=tB=UW|D7oT_ih5mhMySYB@xjB)m~7Q#PN<!mgu6RDa6W}GUg9ME
zl+$WA=$V9*Q>oSyB`NS`sGcD{j<uHCe)^_7mzyLX_2cO1w#9XU2^Nr&-eKT;YPCla
z_Wql!%Z&Q)b?U)Zh=RpAa9YCf4U4z+XJ>uYLk`3jqDu`2@jQaK_ULpl`z86W^}e&u
z8#kz6cx9!?tggj)I2m%|@l?!A^$ndzc5by1Kd#DlO}530X7=@b|Ngr4rAolU>(b{4
z<o@XB=q0*Fu85$Z;MzBB-hxl84T*^coOap;#!|gX%Z-x%#A^ra_N@KL^m6Me$@Ni`
zl$Nf4WW}46bDEPr)+9D&C-tW1P7}g}J^0CiK1rjCkUNU6UK<aFbc^N>ojYN_Ub7i^
zIHszZX|JRCI)dS~TOPLh!uGXcPq=N^N(+0%akU+MIOzx{XSaG4bDOriL+WjBj{ygn
znWZzJfklk*p9u=%-sB|VPRddyaiD3m3Ge5vL{@x?oBR+)Ly?BL5Bn|ogjp`uSI<?h
zsyM-drd9D*sEv5D(A_f(yi7tb9vZPriy#qq4>7-94$n%Ec1fajs_j$}(xe?ooiOW0
z;lL_J2NKp6j?`=9B8<=Wrq8a=4=E7m0!iSGQLfkPZQrNX0iJQXPxe8r+bmBuOAu%Z
zO}o&bFJ435>k+%89fd72hA#Pdapbbj)-%lb&S%*f?S`?uovg}FWWnzdMKZTG)R$^@
z7$FQwEs=B}V25=&MzBr#%f_i1Bow@(t;Q@KtMk!Z%gP!ojtCOCMc5ZANC`lY{-Hvr
z{oDosX>Jj&BTwTBS5;1sJXO2>!sEr7Hp;!2xj-b`UVjpZIA^0e;=;>}hNJaOI;Boo
z*t~yrhSMS1_yTLbwkQspPjVrOh&MWEtt#F!#hK2|%|*yi`0|j5T0K+t?rvivcK-C)
zp5an>UENHHed^B1_Ocv({DC0=DgvIcl`S_hD%|heNpp&Ih+nI;el?zLWAP0p->kdv
z!Oh>_*x=DuB?Sd>AZ8pTC>0pXbZ>9x-5r0MvXPMRb2XN;@AUfIrFVlZR;B&{++>lJ
zr%F)YwI0!n6);_W_6V?Ed~M7yNY&aWIJk&h`Qg0t6CHu)<_80cJXH9+yWU-O8ADEi
z7DcE~R7Yo(?do)`_l0p1!5T*lmdY^}@EzA92&0$+Y7s~^SQC9gpYeTj96r%E&QBd4
z59%BDBkfRYXOng}lZZ6xaN2I0+O{SQtwNJUucw42F~^sg+2DBSCs*<_9Fv3dGJh?p
zE)i!NL9})uSI$C6n5{l9Y_yd_Z<uZLpy9dP&W*bf7)SQ_^ZA{W_i^RLX=y)M4TRej
zLp)SJGIn}x=_%XuIm~w)CXk$LDAi(XNNx8QeJ${$4bF~c7QSHyP%;#e@(z#xxwIPM
zU!PQ-hc#>JIPr8e9)*S3Y{%H#PY-*gHh7c4f!WIRrPt5RutFQBd1c43q4?}J=f!{|
z+pD2V{5cO$ec_2-3JJ?+z;n1JDk5{A50Lmp10}9V)JIE6_pUR0QD~V|e{WpeJ0g>H
zaJ*REBiR@Ika?G{c8u0D?Cv|ecIq*`xahpSdZ|rq6Y__K8HXWe{j;oYxlyXS8LYQ3
zNmeH)D7|q53%;VPEQN#FruX+7+z4EJ+n66+g`u}_TiIpy{V1p|w|@QxUMfQ-Q&Q`<
zZdiB9T}+qo)n5(@-mE-OsZ}37-B5!>*7F?vY;?bghF+eRZxBuG@0!D`=ndk(&F=$~
zRruS_xZADz=?>P*oKYSV>(xuW;zP+>rwXSm0k>pi;EMj$f$X`<agyMoYev!>V-I*d
zM?PzCaFjgcxh<#?@;&x6j}V^5V`_2Q$riJk;MIl0>;wb}bHHpuDRN3Eb(`=lCtjO`
zq$Ct$6wdRuomTyV&167rw~^zn2b!uh+iSZ6=O~$4hD3Or;Rs!%y_I&yfxoVyFbtIE
z?i2+4)zL%Abn+36*&o#O4~9v=P^f2Za$?<)DhyRFmqnlUQ~pR*FpTI-NX!ui7g6HN
zJJYHugh0q+R3B29{U*=$;(0E1>FdvFL?LjaCpcckFaZ{=B90^l3KKj9u64lTt-X?3
zgi>RTkOmAsH7>$#Fm%<SD)Jlllv*cJpMf8t^o?xz91O3;J3O})CRC`{5VRczUQx9F
z3AKSd28%UGbG1{NR^1&v>NlA#i(5$~;IMP^aRMu@F7FDLS%S2~uGkcT4|gmc>GR1G
zrq!4ojP?meS$~@RXx%Q>rh7hvYKx#fXRB<PZ1bF|5Xnl*3!mWoGJpz)ho3#PQ8$Ji
zJr_YOija_92qkZ>PFFM_5eSn5*1czyz@nBIs2#&BV#91H+Nv~}skTn)Kg2}YyZOR*
zl$r118U|e7DiuB{r{I#pH#N6hb{BK%O9*L5dFIaUkJeFM+pzoLa}k@uGrPakb_do(
z(aXCu(l-A*ZcZ}Xi{R&!L<&bjpW=iu7zzR&p@~8dOwn#{zwdzggym3{&k&rq8Bst!
zv!n);BS2g)wO-0aRO#O1?eMJV{_>^3gGbNz(dJWse=510?{3^h>wd95xA3K%j5wHA
z(_@>RA4O^bPk!>M?mp(!W)v7zbfLU3(_$+P-jh)t9-duYKc8}WX8S?y$}I!Ez3*fX
zir^0XW4qbPJ99&DGwjFJoPeSh)s6L`wJ%o(>RN_iyL4Eu+9vz%O`(WwpJL+@nVNvJ
zJyY<RYmEphJGK@p@vtnXj5u&W3E}p$->OEZNdobyt(^bhXpC)&zpZ;p8gfbf%o(M#
zrIIhMK&RoxlKgyPxGtL~jGF=?7UthhN44kPv2t?mHUH$)k{es@GjfvMmg*-Ef?tlW
zb{W939^(K>x5HONx$Z3n0>bGneW&Iou2qX5jw-(ls$paXM@;pY69$40Y}PegZb~Ze
zrOK&7h-nF4wa}zep=qb-<`K^qID3W@<54Yv#=~b3d@{aZ71seB(-COJ`<-T=q@Jb(
z`3u;1!EPs%%1+Pq3F!%Z9NnP4l@fR<>@a<ij<njQx5E%BJSbHz-f3?soBkztnAtXB
zRmHcq&78m;nmA3<6cFl^7GAteAbTyBZlawQR|!oP1MB7vB80lKs!n0EPx9d)J6M%8
zKV}#CA}0te#&vue(oTNVK_%Kafcvq680r!NJ6*mJiMWKgt{_ehv37M9bJIR*Sc6E|
zc#gOyU(WD^T7uW1xR7mgf7OH?a3!}FtBOqRJUc96Zh2d9OKs<8QeKa#it5162FwiD
zzFozoys)J>Roq%BvUa_S2_N?)(^n0{rxNGYwpNo05oqfJT!OwWWsmzK%pVFL-K~zG
z8xpC&t<`xFPsGaZPDD3m$9C6jYoLMn4=by$Wwcf3B2}oCW-Cxfz@%@I5>+BrF&Jj!
z01&M(I&<roC?rlf+_rQ145}aLD*SbEoel#0AW(0LWOZTZeIYLSne$zC!-7}`-)Vug
zyGVVQq0YVPLlt?2cSmN9gu5$Tx}vziv(-Y2n4o`?mXU6VGIH0kJ5|E-R!A*yY~vYZ
z`B6~Ig5Q9uxVV8pdK%W$Og|IX0=A97tgmnA8ZE!~>efSXReFe|^`9?9AhfbWm(JAo
zyJUyorqk(pJE6ULDFbr_<!JrE`5NV|_SCiU&}E$<!}PcwLB0y?Oh<waPCoa?M+uH?
zkNziQ=~7Kiv`oIbXS{%rY6<Ir{yX4AsW6I5zEA>K)au3ggcj?tkQHk93!c}2oi?F$
zXf)KFyUIo3!wq?Wt0=iIAd*}M_@nhX;8MyjqK!HF7Uw!1BxjnS@gW{JP>>?%^U{mc
zm7nmw2}S5m;I^+5AxZKoB!a*6YS0N-ThpjR6~ywopjoRtL7PKt`Y@J~bU8dR@Nm@>
znNpvi>4CBxyM4~axmNxV)qHw_?g^j!Jg!H5I}P*sTtcai4O|_tZ)3R{&ZMXuSNpix
zKv^!@yz#=Tc2>IbMYIQ@qMXpwv3v;JffS4oIcApFxrj)@*$<cqAV=Y=7|~FvRYu2#
z3!?kR3$2UpM^TTb<I2J}bITeT6&^Nd33ocw$9Iqo5eh$4bM2&bU!ND^RPv*TGVaoj
zr(mXn?mKi?gw((S=|FlJ+Y^&+F{o`28gesfi^@`Iy+grlDOB)bOI-VSo7P3Q$imD!
zALYJ4sxbU<@v|{I=t&?PAU;gekyYEC<aVlr+3pDM4(*=j-S8>saXPd<cwtB6T)4_q
z#EHI;eF`VkidHe7J8;)3G7?BvS3i%Cfg;lGrD9&tn6}U-9kj=`L+T^*U1J4%Gh<$N
z+h|K2UH2DP0w{3*njjso-O9L}a>aYP_2E@d7}qa(_gcC~mf|Yzxa*Y`7`bxlL*JLO
zzE>d8W8IG>-w}0mfNIi1LeCen7IzAV-em_z55l5zJOz_o;PV%bAarWhA3pQG@l<0V
zhWie2*8?;wW?!MjxF~-^TLbql<<?;9==%eoT+MD=yLNp>;&sn#N+Xl1)PQEG4`;@y
zW^>ICGb?whv6&SQ+VFv#@zaO19=+$y;&ILO>!Cat)jx-<Z~9@W;0QmX<J!gFp7TO1
z3^VpsP4@NIeL-2Vr%iA0#GekN`-ahLp$P6LWxo9~Jb~t2uEKP4)CrVI(}<%Y@};yF
z=IYdVCUqElCI{<9xZrkl*!-C*MtthS@CbZ05JE(jZ`S+@R-*)>+8M`o1>zN{_Sks7
zgP+e<F$Ln~sKJyu61|+{n;x7Z4o;$!s_-!IO-ZE}DRU8PhC9ztIpsrXu8roG)@^sm
z5#{kwK60fhaluB_b+AX<R-@q~4dn|%)HX5u=i;Kz#Ruu#hT%q-5eU@^A3pkyYnOsy
z)`pmPE3=qvTebtj-oMipvB|xrg!!ekR7y!#Ie<#if9*&jsNx|=VPtu*@N_q9YL057
zzvM(nw5<-d^-!C_RbFnc1{CC}xcUoLH55_Eb{Z~kk)gs9YU9BKWIC;i(q4XMD)|yu
zG3D_y@#k<5`c-*n_Rwa)GtJ35`p9_vDyC>IC)6M@@#UTP10Rb*LJB^xl$o@f1_+lW
z7>12iFATq2@;jG`cbl)y5^|T!%)B32x;z|wgCi7YYBmeoVA`>e({01PA%r&x7$$ft
z_@UJ<&wP5DxS{UO*R%DP6~w1VWbO4fqO9wtoA4JKbfA97x)(_2)`?)|8f^P{*ayPa
z^SBJsx4BPc_N$)`3~|uwk_2u{^=DTxYq@>Ynu71k%+HeP0^IZRs^4ir@t#9FXu>at
zfpjz%m9L!{K8+jMkscwRG5m-H3LVVx%DJyQS)bnwQmduicRM_Yt07Y`q;#llCv37P
zQU?v(xjC{0no!MqGA>D<&0GT=lzy3zr?0>Rw@hs|;5;H}G;Z~3YyP6n9JtVBA~_Cu
z(YiyG^`+#){O8B{k7N(2*K-PFhyQTJ@ynO9cofB@yStaJ<?IgZJ_z4RkFW?~(61$1
z2eIm*h$d~{+1+w&UDo|H@*?Ywk2HNhKOber@q|^O-qh}imo(R-)Z-m09<0J+y04`P
zJ0_)a#m2o?!d*3f%+2NN;)}BVhp#SUcAL1?KhAL2Zb#K1Yr8*kalx!nGOSGW;4pqZ
zJM)tzmO6k0r@Fan^6)x4RU5zF$vxKnk+A*iIQMNR<3M6Ri0dtz3l@wuu;01%dAMWM
z6{lpfWyuCNF&U-#=sjg__Lw!Do9oX?)z)$-jl1o0JzVY6&sCH+v*Go%{pBO=Z?P%O
ziS^j4rWkBlL>bJx@8_y2Y&qd&TwX;A;)!5-c?0s(Sx5C~>~ln#cSPi^P6G}{Ywl6U
zb9ANrTsLeYvpcPE=GsXE!evV@@G!TDwa8+6fbb}N2ae6hnzW8KZDDTkVS*SuW|Ex|
zsqMUkii#qwoLy6NyYz9YLlN#5%X*w@j_ol}bK>bWmS*UT`eDa%QVFMWS*2F0aZptF
zQPaYjrVG`nIMGzE)QTteItB11u4|Jn=M$IQf$E-nH9r^}S>@2_7~*C*I%+vvox?2S
zO4O+LWo8JdUX$W6w=66x{b#sO43g%cR_$|iYz!)X*wKASjU)c^zA0aIiP@3^7;J|~
z$z4w3&Uv}ajp5?s-*;aOcUsDOgTd*I2ReCrWELXl)pqB07bUE?gjLV`{d%!RRr2aJ
zjG$lLir*zhh#M-enqL$0i>`jel;1KlFTI0kJj<bX)#$7G?9JUzGiwxj%r)gW;PkM$
z<%OYrQ~Gc=it+*vQJZ3-v+k{ihrCRttJi#BS)g|c>zTBfb7;41$}^7QG%Pq2%8Saf
zreK}Tufu=hsqH6HkP>Tghnn0>hm};M-FamjystgQO|u%++U(M_e&UvY4jdw@m8yFz
zt=QAh2)#->g^Yt=Xo0m5Jk;t_rhkji&$j7Ithnk7!f8=ebu)p$+fD-4dE}PG_9~e&
zR2zW`sU0_Cw~h-Gc|hj-y4Kl>!=Ftec^m^5;%Wl@bwZcz73SY?n);7SiFIBvF)QTb
zyjymKYPOdotV9cU%^=8YzjAiRvUYGpyr{TA_Umbf&M{y4=Bm(<<_k^^S4+b-pkP)4
zGGX>wD58%o{HBRydH2FX-WS;~C@09TVt-vaBfbDp-o|}c?gD52tTma9B-b1@`iXK=
z8LM|kJ2ccdD_?!JXYl!fY8^8~=xV;+8XB{C^~U417@I^r+Xz@$c|~{6!gKNi_sQzm
zI>d$gv|9~Yboy;aXKKTj{+GSYkz81#a?d&IIxEtl$0ymnK}#u&iv?o?;bAFE(Wgv6
zFJAdXx~YNLN=vym&K9HkqVA%ICHkU@6)1-sm<)mdT#;(@{jC4V^{ks!mL;~581h9|
zdETtCKaLScpmo<Cg@<eCWF9Rmm(I9;7w19-K1^Hh+`jd-avxKE9C!U?0`ARIRXb#-
zGx?b&;g;1mvO)EsvFS>kUaQJQ8ZRjF^xkpXi9^h;&cipQM{DHS{I23eNrPfpXicNl
ztNbXN>I#i(XW#g0b%=Km=a~b_zg~iqV&T|Y%GX@YwV71I2C}xcHaWNaSwE;u*Jx-Y
zLkuP#TrDE!de+7Km7BfR^TL#w(U4nLZWO2K!5gm0&g$ylj!)8+Ax%YnOGx0v*;eG$
z22s}=cB<a=iQ=tn2a}Nxj^lZtR_{J#xu-tsn6g&%555yVtq|U}kqv%pn=;**RBusH
zPAXIB*PEV}DWfct{Z71y-QeN)CVD4kaEK_Gn#zAgDO58qKIvy)J)Hu4v_f0d)aB6K
z*fe{e6#%s@KX)xxSR+mD=h#;VdvmFVOV_Sm5-CpPDxR<UCe~iEP!&AXYNGZn{rrig
z%`^0FWEn!;B#EpOaY@GYG`Yk>Zsw(?IZmv*|LyAJl5{!i6t~~Bn-wwXma6O-bO8!Q
zWJ+yH8|b6B)7*zgO%d+sQyMknbkccFrdwNFcl+Yyc-0Gms4^T_%iGD-!i|-U_W&#C
z>r>#UdF5Hm{d8lqB1>sl?^^3?uJ<K;9b7-V&d)k0lqK0}6q|L8mW^N|hLxG?LlqhG
zRh>e9_VW)6Rc7gjKb9@r%F{Syc9h>T`bmtjoSl9_%D4R@@=pPgA6&2da@XedrPMe1
zhG7QqXPy?e;8%mr>J1@r=Zns|KX%Y+8>^|o+uiFlAeZW;^v%jCd%j6PJl@*O!o0$U
z-HuCCy9j|QzP*dQ9a|zt>iLkHf72X6J>)vSMDa;|%vPjv(e3Lta~YFMCi|5itRU8j
zi6`YGC&^m*7Y(R}(jRxv+exkDmTjczg9|-&?cX)3%Dm949vo6yq)&L72%Y${547};
z{ZBCaypL_PN$F16&&w5!$RAPP>NLJ*=|5~K7Lpv=SxhNl%cY`sIPJ<0={8tB3?Gkw
zdw=3gj=)3axF)BA^d$rYPcsz+9D^T`4$Z*^+j<^;I6YqFvr$$)RD1TR_=4|nIo;m7
zwcqZW9r7Uq#_(ji66FJS7gU@QFt&~5n`K!c!|r3$X4ObUrvu|hIs#g;K&Pxe0Iobd
z+B?VJytNNkj93Wilz|!ORT-u1?AYswg2N(A`Hd~??*ip^e4h>EghRs1mpzkh`D;J6
zY76pM$khX?l7=c<uZ;s%9u5~^-Q|woKJjo~*RAk5m%owBdrl2b_fn^eyu7m=vBJIU
zo0)J6iLTreMWS!?bqbMUlD&R|-$pBP-CvY_u}R@rX5N8s$vmD~hv|g6q@R@gAYBH#
zW1xwD-Ipwo7ND}+HPtG5W4m3p`|G!X`Q|IaoLp@&ul1am_?*O_y3wf>4f3ha&bcyn
z*8K+NDTnF<H-PVx%X$*{6=u-1alflVm}I(#u~xpJ?qF8aJKv;oQIbsCKmS~j3((A|
zEj!Q%H8ofiJO51UK~c9p8o2CNC*B%7_2tsx+tM)`yd3<}k!5Mm>GrOcDdpwgs`?Y>
z@MSeWSNocHHb%VOl%GPIgWTTKU>(rcl*p|;^g|a_Uk5N91He4g=Oz;iNU7v<TJ{Fv
zX=qai4W=Odl)!QR_=f3WtYx!?BZqZry_G*Znkcpjw}JDtBL$RxRLJ~XB?#G~_sK6g
zxU0L5^<HS|9~ImTC|r-mJr6%^m1Ffq)vChO3gO*QOH0$~0X|`q2QGm$i$8o*rT8!f
z(dT4gVUaeT&BCdobiTwj;edoZ^^>uGrD<`)%CDYNoRT<s$4A~>2#Lz(!4OzrP0%f-
zGk^cl8ti_1gb4Y?5WK!YOeI?T{LpA_^jX29v04^y8!q5fRbi}+H@f|g=qxu+UJ$Uc
zNVzM25hAD}(@vD~==t#@?xckJN%{eud5YTkA%%*bj?w2czaWE3{^s($GCd31ob}r+
zhJ}R=Hyh|l^N|wdkd{+s&Q1XVx9RMOcN7VN6g#UPhbP5xU7DKFMp9`r18UoTu3ld0
zrh;!Rxh*)}%Z7)2(?1xv{_`!^R-nR?9GjLVGe2M4H8}OY!01f33&9`y81t;s2e@rD
z#;@8{0~!jcNZWXr>!!?-R=OXdYfdv6t154-6v?FLI-06IEz8M+u?KLdK=Nctk8@6i
z!}xkeH;_wpyKa4AhY^QOP&pN~*A(VP&zh5?>gGJqg*UAz5^$jKOR}lio!b34Qer1P
z-yjd%tnjeSDF_W2gYcZ5)7H)pFpn%HAgHX!@Y2@_rH*73Uy3SyL@EqvhabJvE`2hE
z?x&N(>JGD`1(2VWI&P%6xdYb&9`2Py4A1jLoN{ut?=cBMA~x>4t!&ZGYl_TjikNKG
zdY6^;rr<zDk%5YsD5tbxw(`ZCtuGu#Ut6qSC?&wE?A?tgQx5jRuPdD8CG8d$q&%L-
zve@Xus%7@Q8GH_;6d$5%^t+L??%e63!u;Jzk4L9bc`ZM3H62p!I0YmZOp<dQQgmI$
z3M|eL2bw=_4sHYl(0Y5;YGj7avT7&xehjxog{$i-UVmTjbAPmf9w2xI7m{mb`C3wV
z=axLLSJ%&H1CK5#&tRty2M3T+yFc|s>ffPGy^z(7=la^w*(vw3qHDJIglE`hd#d4P
zR7T~_k=t6zXE+NOg`c7kTU$Ce!Zt^+HwTBm#q9&Wi=GtwEL9Ks##SXMX+)5Ebk8zT
zYzThUqRh4gdb+q%S&7`H0XBQmP<8h6ylb)LsS-g#fHhCpM}Cdow<bx>*G?n84%0tl
z%Lcz=A(X=@-(o)SfV_xj>*`^pUMffFs_-TEpPDB41!jYZieyD=EfC3<hWGt+s7@YX
z>mU-B<jIfS87W_ru^VrPDLARS8!aBKVr=Avl*Q(oCuPVEl{agBFjDs_%$3+tIk8<$
zu~BTjJX3>-2SG>o?ly((lV2(BnVNceph#~1oA=dMU$mk>H0O+d%Kw02;s>lRJf3Pl
zq`-nr=;rqYP7uO2zcJR{z{0c?6$#e&_(fB{Wk?q09r&b!x5|3`jC<G8^hbx&%1Y`t
zUv(qRk*F^N2D(=SyC$cT^ge2`hnAy#nWIjej=Y6ME;n0!b)pC54h?Qy2vhMN94LN+
zWspC>jgobJw6N(ePJwGFHAsZsz~qS(FY;>>&Hz1kHj9j`SK}=PwSCyT<HWfIZMAQm
z)@lDFVSw{<FXMdzYQplLhL}S9O6SOA{<W6)W%p$8V2*9_WLsN>#`RZEOX4Mm;c;Jd
ziifTI*wL#05Q(f;Zpg{>>iN;b7N{x3A#9#8>H?sN$gLrUHOY+As1z&IJbLWWX;+p~
zwiKU(r8$bXnGPF@N>^`{=|AB<U)q#ZR^BP$B<aIeI*zm4Ul)mdBJIxN1V<B1ns1vO
z*f0gD`#;zJ{z7hifSy&Wfv?MxE9T`eO06#=-v?WOgIavivr!%!ZxPMkm&~xUkO+eR
zZkbAyiZhO38f{vd7hr<8dX@fO3KcNNC75#83s&HtL#D7#?I5Vz_`vk^eEB1$!~9-^
zeHPXjqOH*p3=8NOu(6SbAH*`re(?G#F(xxQr5`!p{Lf^5TSn&l9s>ufA@%P0p`t=m
z5%>VT{9J$*T=COmD!#}XGxEvkyrMM5^hJ}{108gP)(>&no}Ts2bBfK~79xC){4Gj<
z7K%u6D6H?u;i~1bzN^2D`)JMgC@_e#j%jX%Y<Xybf$7$Al^7MjzoR%A(#x}m6sdXK
z>1en4Hj(Lef7bA^bxHBdnu4oFgI|$#*JTm?XAi*z6-Ro>#A+icNY9sH?n1AXx*F~p
zvZ{7!k|+`6D|rc#6G1VH&<8TTLNr>xHYZIZ_kv_;uhB)bg6jMSYtoN7orc1xE`oE;
zgu>d;dllB0vRc}LqNTO0P0o4X#shm#2x8$fmhBl`{UOAGn1%I9wfZa-ToXAc_S3g>
z;h}nKUR*-)Cm1RgE>kw#jQB|Q8?H7z<2G5g<H1rG`>q03Le%z3YP-uAH_3Dpaf6x?
z9W4_~YJ3bWXl+Pnk~nsdGNNeIln}|*j<q>kHuiMM*`y3BsXC5arts17%C{s;L%F0p
zIDwed2NzqxbJI*xW(2W()s#ZOKmIjiwZnLxGxH@IlL1>yC<(~tE(WSssyYPV(vLO}
z?u=w|bBZ40PAGxbT@v5&u<@0)=E-+ElKIr25@(07EY%$rgMVd7jD@42Dn?bRZXwp0
z2VQ4cXK@zsjlTVKo-C=ScvSC>UT8emCf3P`8fPqTR*3MssTdk>727}9S|jzvCLq<<
z#5CaR1IyHxT;X)>!NDPgyh+z0ju3*}dRZ(VpVyb}#)_g+w04jEec-gZ0IX^1Zk_yn
zV%U<;+&!jsp}>l{sgE~*pW^HDz~~)U@%|U|3!Q~QE0s%r1`X_7y$kCxC;ioUU1W6_
zUk^dcPFcKt_qr+fK2$mIj(&s0NEw$*e7v?*ZW7|E`S9FCks6cVO!|GFqqQBgegJA<
z35Iw-8nBoU<L;ePD$rzqQeBO6wEOvX{6@+6vyRXhz!fPuPUZ`}C<Cr;>{McVP0lYI
zA~SxN+u}k>S<vH4W<;sFw)^K^Ceq|oDo{gP(u*~x%van<gc#F6dbs_A*5Zq1XEVBH
z<-RWlmhZFbDkTqa{y#LGcOcdOAMeQ*l~4&Gqe0oFP=qAeBRc1Bj$>pyj+K=eLZQei
zWbZSK!#Ox+DqH3`hhwk8F(Stv_tWp*```KF{P#KM{dtYY<N0RSDG5W-v+%yBJX2g3
zBTTsHVRSBk`R85K9m2$6$6G|ww1ge~^0H8LBpUpE>>|C)V9|5*G3m)Q&!Hik_)e9l
z8Ohz$^R5W2NCYvI%x1+z63jM%N3RBs8a@7X$_g#w%N4>rU}qf=>>Oel|93B{3IS9`
zazJJD$n<?gmXq-%W|X)fMyjt*JNJ^V(aBZ8n)!l_xW{bPQ^7mIe5yg(S+9QaJqSH+
zuxRo!A1tk|MvN%=Zk4eA9ry2xdI)eST^WD9mR6fnn=T*({=6wGm-ylJ42P8-^jj>k
z^L`|+s8ZSuE^zdC&cYer)w2*kzaN?1wcMj=ZjtrTp4~ZKWiM|YrY!nVSJ#AT&^ti8
z{fTp(XRrmUc350ooQ@cRE57h>x=c#)C70J;X0tD;mgJ%%hg9*Jf7hq$IQ99`S&+FU
zwBK5>zx|~yPjS1Cnwz%g1S;BvYytjN-XyC>k?E)`R=wGos!HKdv>`PpOm40U$QbD_
zHWk3}9#12t{U%=-O$N}U_Xa;T&9|B>(@p={>J)7bs@=Xe$2*k@X8$;*#DWnLhl*(f
z_KshxggUnHHK+h8iUGB`p!f|i_QglAgk`2DykO`Uqt%kL4Khbqj>tfkFqEDj9_s=>
zqkVhkXLXR@B12w&B%8v{epgW;uL<2GM+&HJa~0$}s=I%8?vyE7+lSV_&c%Kea}X+=
z+6E#J;<x=Vz?TNwW)Q&8h4<Xp_FU?z!GcgkP+&lG7YIG+qvC<3hp#^f{L2M>X@jM=
z;$M$}7{~0a_|J`nJOTYEERijboK_g6Z1?jr{L%gwZ?bartSwwLhC>9ivrO#@-`WCB
z`?3j86ib-!>!sb<eY#E^umH^{p;em3cg8mF=jj_5x|~l>$^8l(<_w~!{WvQ3jlu%P
z`9AxQO_inPRk8?a+1-cXv)jiHlh2%KYoA)%(m9S%z?2bXC7IZZ?^>+9DVlM{&ht1X
zs)oDN#i_2LHm3%E@Mn;m{V_FF=z;hB8LEKY%gm5#2?gk7@ug`eTdatUoU9;I`@P*>
zJxYJcmawWANf)FsY_LQ=Bv_0j{3!I{yZ^9gOsBS~x{RLyPOhlEF?3h)p0?XZjbhdH
zfTgF**a6H>kO33|1{V|;Yn{zt2AD@;b@i`>WfH<<kP+I&5?6Ljdt50=9UKrCZHM&H
z@xmhc2bW*V*iExA)ZX>&3R2hTdoKwY-#G)hlkQFW!mT0%^+7z`NH);6pRwtB44Lw3
zX>AwbjwFEJyD+*oo}iydpMI<+{#m(q>T&;*Ygx?0kqrwe_N6Y55bBP3x#bu^S?Me6
z!6HGX9?m4(?9E>;r@?S-RD5oA_53MIHlMk!G1$tb*J~Hzs6-R~4lx*Xd~Py84)Lr5
z)i+n9n$1HXw&(Pj7ByQzx4!+ZbuW|t-Rj;rviZyyfX;{ixmnxinQ=Ts=<Qk}Zdt-i
znW~(p3)x_<Zel2eqC0q-{=BO5T}}TI`nTcX_K5A~){v3TQF5T-I)%*O6dVHODGM%`
z`Gre9t49ov5g7K_I!DWq#?IYlkC2qaHF)bNDERcJ{M2a*)($u@>}pwbUQ*k%xbz45
zDBZ=AR9YsC1(n9UXRaC~D=Zpf&m9^@DR5OyX7v(uPderXNBzta)BlTh3#ml)=)*rn
zcCz8>9u^|lMaKqZGF6xoyXJwnMTfyP2O4GO^V(Dq3-+a)nquz3W<dcI7s9|#<l)#p
zN8jFdVF)CxW~j)nW@c^<5A|tlX17;d)TXi|grxow$^1z88IsoEsdF~c-Wk!mhX>4o
z&Jj;sZG}jrfTD%48Sg!pjzuUNa4NHnif@xS$@>^610u;q^x}Z{j>4<dW|iaq0p?hq
zyf#vH*+kfr8SDwPQs?U|LF*!D4D7wvx`L^W`|z}T$yZ@(#0kqKwfO$SglZffS$`1i
zmJPq<5>_#pMYcuLeeewTRHG)@dD`}G4ycILo8=%ul{_BxIt_=>gX!n>s3=>kJF-WO
z2dzsu()aP*=PYFW|Htx%b#BpB*K2QCOcw@=Fy-#rfsmRHUkBHo2S6TVoF2CmDzkER
zukrTV>6kWd?&<02TIinpx3Fz4S5vYz&U0fVs0s{UqWrRZX%9A8N~ej!*d*O%(I$1j
zVqTCP9PN6==AhY>`b%^}XLe1!L8{yh^{LMVFZZ16$&W?&+cc}xv^vY5$8d{Nx@6Av
zirsaqYsu8*%M4HJuoI<;NmjPhNi56~do1d&cHdPjs8(GF=wVsHNJ;hSYMtB>cYY#}
ztRZe*Zm#Tew=hC$;y3$5doNzIb7A#fPr-MUU016QLMqEy#d@D)I&mBw`_WN$&aZSr
zHixon2^>Z$$8T6h@lH~X#cnQt#s<k^0%*O#MB3nQMXS(<xmI^CNHbVlVWR8Ru#>GC
zXbHSEN$>%iCZtiqGZchAtadR%f5smmU7rMl1Wpaq;z$PH?HLQ7Bsq?%j~(-PgsPbt
z)6gyx(M7&JSn7W-bRdE>u|HnHP6(Xm9&SvQGDU8keX?0}Tfx#wF5{yeEbvmR%VmKY
z{aVMqT;@JKJ=_BoY5R-@J>iJC1BFr6MzBFf1p`IRk>~l?U$@oED|<M~RX6M-pr-P#
z{@)+cT0Do{-^D}<L)1Y*m5DxIF4Qoeo+#a^s;UCGOJSX^?7>e1Unl-ejq>xayX9f~
zS(ESVm|jbMPiJm~v%>lR`1)>ZmsZHccGCv$`ae;E#sgdC8*HW!d!JX(b<@<J9~hVT
z?#m!2@|8+@h()ZqEN$=hosZ5?+DQt=L++EW*5P~Zq5CR)4<1ULED8rt7@)XsW(>ex
z${NE#ebk)3*8cYFV0G|s7P}A^i<;&|mT+l!<Dl~X=Xp8)WVcIp0h_3E9Ns!jjooxK
zUfmAw)M$@<Tv<?_U{FhUs4{=xvwVl|%9TOm?YxGQ$%DZ`sziId;HOf7q|K4ec8d~0
zwYy}Ny!u8Xv755p0GU=zFt`2!7@=+#c7mpIA*c!HfXMBv&t0G|`>Fr!JLe$GrzPx%
z_}I1c&l+zuTFxD`bD2hN5V5+?*WKF<0G-4IhIZpt7M(&_2iv<&Yfy}9xR&osp|p?}
zW!R)Atj-5az2Dd<5e#Q;A_&pU(P5swHP0$&Qg3=WIG#3|o9=|1rUk731Vo1)u_mN;
zhuli$?`2SOrqFXAM$Zuckw_fRC0Jni>~J#Tf(>K!?r|;o#Z_U*1R%_q|C>e}4fK22
ztVLD(Z0UB<jp-oqkSqSHRPN4&yIxL<6~Ll;j34UebXi#fAh=`JWITfebk$k!l1<4h
zcX-mtCVb8V35r95S0%e+0VKaD*F8F_-np}et_PX={9I2Hu7DE4o1R*|7ebTI(B2iQ
zapTPod$D*h1eTEB>zq2&KR!8Wrp)iYv)v?>A4f%%Fu{}s)v5y?p_xns?FwOm1(2Gt
zz<EA)b49p7L<^n3rRcQMIqyBCXlG*s-M?oCzr3CjGx^!;YZYjl$D$B%t>X!TGjB+i
zP3eAB2(B*ZXE0uUg-Rt}^64KXQ(p}E)tyKg8#=;7v)7YTNX*X8v|)TfFygd?3j@Oi
zw*Mwd|B%BUsV!FZ4`<3unLTjH%@s;oCA92>;Ejh2vbdj5^l>*%plrC-;y&JXQA^Ms
z?n`|q>B7{k>X#|_+dJ5qofkg64C5dL`5-MC)8CG5?n;=V^9=S(_oYu8`uWuHFz{G|
z!So0#cyVO9xr!ys%8bn>V>_}DGP^vDao4d6t7M@NntcN5RX#k2!R|f#Jkbm3hgwa>
z2>qS-&w2l)Cex_#w*@0QAhxOc{Cj|K=HnZCy>xbn)DU@qn||-Tu0tMyVWFhArDO3z
zr^DUN!@qr9k!-@<v$J^spR6gl*$p`>36K!Bd_pP`o!+t4KAbvD2(u^_t%B-j<gc?u
z+BODdmIsk686b9N<wEq%TkmZl@@oYe^@dsVh%Ww$eG=Y3yrKoPXSQHO>OGg~Q3IpB
z$(odT5E7&hQ1$t<xo^tX*z@Jg{isFk=i#LHDn)j~kgI8_cB+!1>=D1+EI#5RV-wH%
zw3vzOPA$GgUnxs@%=d8fjZ~TIV$N{*5DFvPr{`&Fz`|m<I6aKAzUbCW3=EjxVw3IQ
z4EX~AN-<H0tW{ER_A6*2Q3aAqn;mzWTDjx1IPK;Y@Ju%{k7eKi1a23v_A$qXkwHW$
zs}Os$R86Kf#$ZaK<p`5&?deN~yZE|R-+oq({!u)NxV0GmLu7e<85lpQRyILg7bPKZ
z|I3g{=(-sKl%Pvw7&LH5A@}1&*HIp{B=D%}k^-8X)v`u|T^pGPyFHdcCz8sM#X?Ek
zM<Nu%xf&4##d{@I%J2${b^N|_$mOMMfiX2UIJ~fON|-|ERE?wCyljk&c+%)t_3hgl
z?H8R^CLLj*>LB%+0L-xdEdH;smBHx9OLZ@IC06@w>nIJ)qM$!^-c_AxN>sX~cf-_c
zV^;IkX6eoGmLJs1-pe8bEaEzf2~~``=H%3y_M4j-iFzq^PAk=099KU6NYl{~9W<c=
z>wKDU=iniCsjHi|+{aI012^T3RZu&4jnuYGl2dr4-8H2*=AvcD>%~kh$r+jEHI83V
z0yjkG=R3K)Rz{vZ2;P6?j6{}l=3)3rECmF2+VQ=g4IG3-Py1Lk=Hc)OJBjNL1f47c
z*VCnX;R*UEF~zbb*@$oan*?7yOO0jkovWQbTSUu>*dZ>tm#c~1gl+AnDp4x0K+h5p
z0)Z6Pcb}T&@}hV7?EN|7w0HK@F;qGJ?Cs;HdE_G~Xy>?@*!>HzVTN<+HS$z(|D4V1
z;&DG&KKdt0P8C;AI+8xfgL9Xe%>AS+%|9kaR`M_`-}#wZWx57GV64f44u2XCKAnbv
zG!j*DA#$=1A4INgLW%oW>vxyBd6Wy%Jfoy*|0gwAy26`O3kC`NE+tqVjGh`@u<tZ0
zC)o{4DvXjP_H1nv$sUx|e0X*o^mtsc{b9!U9#j~87yc!ytj6c<&HGiq<&p87;Vbts
zz-F9e+k}s;Ah4Ao-_YmZAJ7z>Wf>X#z5iKJz88q;y%o@Y5g*GaEhFM_5xCF%<s9x-
zGG2tdUjV(oKh(S@0C^X%Ij_T4ZMr%8H44vDa>+h;4dvRS-|-mnbe~hL$i@*mSjuDm
zC3CRC#~}50`Lc+Esh83%fhz&}9NCAW&a3<bU(LypneQ>oEjvv+Dz9kRnt8O<5$d15
zutmxrU?6R~du>KZNlSME#(=#K(ttWPmj5+Lvw?pcdimgH=;qDMjdtN~fX$YFHM?>1
zM#=}n@;D81HWTH*gZWBcRoPE!=j?;QOml<89xH)Qy=!?KVv2>0CvV;GsNBtTDSg9^
zwnO{0A?s}qt>*vm1?5C`I}dAPD2%#rQ*G~EHQu+wQT1=Ql$1=@!Fp&;?#9bOG68hQ
z_Nt%4kQf3@)*^JPK;DS}J?{6U&v!mEy^aRgl3uhM{+9jO>rzoO^RuMl9Tuk%P57C9
zI*(x}{22}I!lhf+GJMKRIfSa8=J^&KmO~SOm1-W@aKRko%}yYG0gZV6^P%Cf*>(t8
za&V(j?q$K7^vg@sOC|n~B^5V5sX5$y*|~pQCo<Cd0-Z-cKzwy|vldxq4{Xk2oYin=
z%frS{EZH`~@RePVK$TO7AJY*p*{s>_-Ze?jj<?i;laD`CP7`u+-C|W)-<>;}VVr*U
z&+{G8?2U~3F<Zou?vmK~>(I{fnWh1Vl~*Sem4(0gIV0ocS4?E(_3PL9{h!X1AkI#U
z9pBP*wzZT~f2NS?IPu1Ok8CKowNMzk<yi_Q7dkpU=}Jjt!3hoysY#@5e^WBn*UOo4
z$>V{rzU#iK=+nP@v>s}8yk&Iq9N-?WsD)T``35-L;lDvWKCBPjS--auWaZ#(yajB*
zT^3(aK|@pqvP^e(_h$C-P^ee#8kf<-tHp+yiFW=7s~S6rn}QMT^T`|v5XUkdXQVmn
zN9jbDrPMt3>Onrij1>6<cycdZe1alxZiP2}q9~ezj77cPTGAGEtpib%w;>@5kiz_Y
zctAklynA1^U$Fh(R}(cN{Qtq6pBb*#S65>g|3uvw%7k$WG5q=CRFWD8q{8`ZI3M$4
zpdHZk>{y8xTmdWC=b{snxx!}&nq1y{y1fQR47l6M0+GSw)|T*RY-g}OkH)!tVUi5I
zBUE2R**l|ZIGY_7u$2yO5LKMpjnJ*qpO&u{N+Y;&bP0I9`+4U2*$60Gp!76;Xb1b_
z@!&SrMtJSOdN8_OJou1IA)|trg!RX43H@XAY5ZB6ql%G$?Ns`=>Aa}QHT>3*E!Xj@
z3e-Xzr)Oy*^J^_G07kHefbEF{+zq(WB3q)us8-(O`aRW&=HlXZ=3HN;V>*pe*xYRO
z;ff$VqH1v~6cK1lYVpdqZlvg%$Y7U6JWYQ&C=@o<YY`6)yw90=j-f&F4L#l?uEHjj
z8&1>3f4ppY*!1$7%E7Avzk2xgM*Bj<{vk^{lYxDpCFlYMzH%U-=vMpM7l||o`R5Da
zpH=kV&yP^6Z^nyP9H;=R_s!k8cz1S_3>|`Q*<6X;%ZU9PiHjqct|gw*#n-MOo=+7%
zK?)m)BKW~{(&eQQA5)F7bbK8?eKsI2y+5ov5*yhYzNQ7$nBlHzCK#34>1KcGXOBU)
zWOfpC<+Po48zkz$Qv{$>{nKx&Z62TP8xyL_)Q!XQ^>bdB_zvSKN!5MU;rL0{8x>e0
zoCsxh&`~>QaG>xXxsQZ;0oN>=D7P6Dht;4LF_5~a?Z0bxT(6wInF!{~`0zm;2yPT6
z5`D~=(MK3YTkLb+#urIVU3by#!4O8oSpN}TwNi)8e@=u9JvFK+JSCm<LFEzV6d7d`
zAqmMlu5`P2&-2KZEh%Y@?opl;IprxkwV(F*UCH|hOLxY=PN?D*{S3qOz`t$z2uM?7
z(4_K4<^=f1g|^=^F~PQBzpV~`Saob|d0%Q3dT`BZuM3iAi8&)saIgCE>AaXUV~q)~
z&k5cp*U4VbB03V!#edNCM1slE!xrYB^!2j0ghC$juhd-!Eo$`sDGIJajmU=Xb<5qk
zGZRi}-q|_MVv7WRtDp=SDXCgAgWAbnAN)MxzyWzl>h0?4YKp4hY4enFxMjeSC~t?D
z-xs<WtI6@b?|B>zWCyW=>N=@cf($j=f+-5YJpy`FN)l*iyDzCPdIL5z`%G;+1Qu=G
zNsOhS3!(pPwUf0N7F;7!aH6igg=i8wWOMbj#R)aYP$DIf4LyN)1Y}2X7S%GVYsh0F
zOTh-t#kg1@VW~gW)_o{b>G3Mg-z)wv+7kots3#z-?{a-)wx|0j%H3!hdU3aZ2&Eu>
zu9|R4y-RFSSCboWb5G}!^m;&z%gCY_bJYSM4KP;(z#j6MjeF%daOV=^A}i~1uhxXr
zhxQmy3lEUR+hcSdC^e-1U8@P__Mf3FUbZGIj%0bAYrlyobH4^PT}yqCbzhnTH3z=1
zZvl;ssy0~G6b8~c?EZDAz*|*ESt?H7;qOJ3T=Z7;vLWx~<@+yOU3((mF6l$TV2GV5
zs|}LhADZGQccC_wHT8Ot#r?D-eONZfPwI_~9vyS0iM4GWbK-HXg<z-=n8(paS#WdY
zZ?h2l_^hR$`n{Yp7Vc&zjhP(IOd1p0v9e9KP5?twi-Mb89LSfk#?w~Opr6OI(4+E&
zyV-kjhv-mxxrKcBJDBvyDwERf{lnjC>#6ZDzI&fM#(Hb2I}d*mgAON+L@y*41kS&?
z!WY=aT-5pGsjx;Yhc(+Eb&?i7Z)Y5P%9-7E)qB8I;Wzbq&(EJ-cm!qK+SS?S+2r02
z*k<^eqn@5B|87j}?>aml{_FS6{CA*1^Btu(>`Cu{<RM$tH+bWpkChRE*6p?aiPCJ6
zrUB#CoLAq&*HQ4Jc{AS^+6h0GYzlY`QWuP}YitXc(ZHCOY$ZWb<f}PdkwB6#SykZ0
zEl20tcrWW-y0&kLBOj1Z5M+j@J<{7m*Tmv)?(K$Ga(C)~3Pn#eVJBV(J`@yOQ(!|z
z2&ydx-5&j$GSDnwVT|mn1Yp&}<sE>-1hug!8fpKs<UC0?>t;c0^k06##2}>ducyfz
zwKiaNShCY?x8t+IFKwFfS{hn3t%!Z&=jZpj>RS0PNukygeX6E96J?e1qwc}d;&Sr0
ze50<xd3$yb`Sa4;cJ@faGOJfs<WxuRmb4U&XsrVG-4c##L$G3<WtRN3^n4M8vTKe0
zGkNHKl~>Dl!-{<prVr6s_*mv@a3g}dl&3)<3QG_|ui+OagZ>&&Sa*a0D*4vL#6-QC
ztWxcYT7X5W1F+>g)J#j?twW~*1N;Z<1&X3WgQA&xzDvTYxnaH_1&UZ99%0OCJ78U3
z^cAU^?Q`%@^^T0z)2H-Te4aL*da?8xdc=JzZF?2>)vW=q+*_mGv4N_m6q#ayho<GZ
zkT0kuUt4{gmx3qVs*r?OMB01#-%n@grY@RsqdEUbUG5cBx*-q{=fhpN{k0%6l)ngy
zcOK^vu?!u4oO6k}lqaMOd1lL3S#<K$AWmp1?@Y-l-hy-|lkyl?F<#f>stp2BtxEe*
zX0^H%#1<o6f^R=xPI+vGh&TR{mZBe;U2ya!&8>0Y%p~BIncBT-Yf=_3f_=tPiygcw
zPxw70VYiC+`08U}FLfMYhtMnNcGz;i$lJCVCc*G<@Sj1hj2pVB7@JYnS4tBWcv?Il
zfHp)T5I!kcWGymEMK1++McG&CtO|m(kBe-Lv1r^%J;xcZy`Fo4Ph}&n2VQ@JhVI5S
z++UJF+{MD>JQnZpJ=oCW?;$+39gPY;6Lg<%U+0Od08N1AwJ{g#b=>>6j9a}p`+30~
z@Asi@;5`=_?&xTSGxXNf!Q_tjNmSvmv5j|ZE$mT3g6r7pxQEAjn;QoLCeYfvuPX&o
z^Ys?ouBubgD$yUb4Vx!x4=XQ$c^5j8uu9XtWXI$(5Ms?!ZD;(Y+qFBeI($?`2o4U1
z)7#xL^o#D6WvZ)xn{=%=SfP7>1Q=VswYBQgBwel+MW&J0@u=p%k^&hrW<INDUW|o5
zU^~RL4vPijcpebSDqdW5kytigmW07+r|Ql07}y?RO@>rIZ>hXkRT}#MDuo(59ZWwq
zS2O>N9@#>kzQ}*RXmw<+PrnrEfuRu|Q4IJU!f-+_vC{FdXqF1ndxOyJ_TJSu;n6Bi
zTVd5I&D&qv8ehS!CvFd<8N~1yd5ASlVGuu_TxMf9{|_fJY+c;yis3j_g<TCvNc|&i
zr$G_)eX22n<KW2-+SEx)Pftv%GiSdJ8_z_xerz%H9xg{q4&f^Ob&B*}4i+&r<=Ps#
zyoDvBjw#g4q|~+iL6!cSNR{XtQ+M)q2**|GLmRqtkNQxS&3__gJG6v@=L1@{_d4&)
zrn1~Yzj-g~d5acMx3mz+Yw3}K2bzu0Yt7q;W-&n}e|7<uPm1hP@R{<XFT<5?CQ8vC
zI&G!-%+ni0BoRve26#<r7AR5PUnnW1kmhB3=&1A-o|1drR_Qctd*?m)Q{TcwldP<4
zy-s^fWFA_9uzg160PC(agR*0b1TB@&m+8P!<1w|t<pGj99G+SNv%|<!>pTv`sU_8w
z>a2>~bxGpT(jm{JIUWT=T6m83D=Ro8IoRL3(!0FTM`(O?L}X(!4VYSKd5ws)Zm%q0
zCJ?aqrK+n8Vl;VI#DdDr#?;2#x)+^>p<m0Yj0fB(bo+v-$V!<6x)qkB{^zw}zt2s;
z9Q#}UY9Z#*miz}8cP+|HIH7)dA&N2r7#WQbo><|P2Vw<4ZF%-zZONKTdj};wQb01D
zMu(R&%UHj+?fmeQW3Oucs8o64q+=l8YqK&bv2&hq%0R#aENLPoqvve<G!^V<cf9}h
ziV_`DpuBIF6Dk62Du|#!%~|6zW#ZW3<>bbl3M{tQK*WK&kmo0q7Ulsf{O}HT<q7gH
z!OdvVwyWT78D|;08Majc5m5rq;_@RFvkb}a1cPyPLVQ<(Em)EsP!g>*zESXa14Zqu
z`i+m6pH|5Ys%_8`rp=1ka0|$nf-z-pC+$>7s=ZB!I@H@(`Tp%&@9Z8k&9XZ?Bb`4#
zk`_0IYuT7;Or>WM_}4ij6d87(@Adb#8c<RnMbw3dm@P?wq^sj#>$^YZVxGf(q9g^3
z=<XK9nYk~zhl3EO{0PyY_T|dL$^7S{^xZEM29jZ}-;o2|7gnCB>)xmfKQTl2B^cIq
z=~LEPB-~an1yWicttaZ}+1qP&@e_#$W;sq{F}}M+@RzxH%oWPx$G1FlccybLZ80s~
zf9oTB`e3qgd!LmDdeCJCFtYGVlMhFWX=*e{Cm<DbdO#g08EZAovR@ZS6q*dM;#8Td
zB?d&23xB+-d#HN#pP`Fc&Zz`_8<@;e)nRFR<vKkkQ2R<6<tBHLR!Jb<6BUdFxB{dY
z<ys-0&-@Gjrv-X=+?7yuCaB<ZvDtp_ov?R!-U=atZzbW(1GTHVRqYoI!oB{|-Cl4t
zx&;M|!-2XA&p9HV%sw~7fkeqEt{HUA9yVYm{UJ(3)`FMQpIN@I;&4RqAMfSO)9TA?
z{zetRl)Ufiyi;(Df0%CEL$J-=Y;6s<AXtW7tfjfO1nqAvMM<+J4o=rX@r>T)8n8h9
zcuUQT4CA~(rv;)j$cZ`k?_Mwbp;=mn)oe6h9kF$^x5JeMzcw?IXmUq~V5OvW2E-Z%
zIsX$~lVAP@g*c;mX#>lTn{?%sLiWxSoMJOYK0sTN5=b&@0V?2{ktZ2E|54k50>hoW
zunlNxwabLd!^+Pxz^EE}%jw8ky1&=#AbVKm+mpxN-bT)mQy-tOc%^*jX`oK&y<1!_
zOkcn5YJ)Ktbm;RV?H{^jZ*}8ep^$Vz7KVox|GkNP6iKPeEjiC|4E+HWPo@7GKPBVJ
z4wqk+J=v74FIV_VIS>vKp(&kTU0?G2`l7dQIpy@=;J_gIf}O4ep1qV?vCu+FTQwt<
zv?u9B&lg6NywdpAGnZ&6YL9+K<2V>Go^dJO0}yph!D>T&eQkGl_r}cv^Fmi!P2F*F
z4kls{0VK`%vhs9=ti8-0yOV%5GR~tJE;EcRzfo2q&gVDR-B6SXz41-!*L?rGV$pog
z{Mx!aMsIatQ?N;$p`d#W(U@#t?7)>d%FxK88yJ`o_g>KFK>7atX@Y4#BkUFo1S*Sn
zm6#*I#3A2<X@s9G><nvXrhc_W7KS92&5nP`kV5B8v8w97Oi4W6ojvv70FHG0Y__`;
zug(*dicR;O2uP6CCDwNv%-ZkB>KhVYQ}A53w7A@s7~4TVs6N{-ADSmehJw#zjF7iQ
z)?hBM8iop7!^$=ZWj)bk?oW$<$-_`gB<8yqHfjw(0*mAyd8=1SKhYjZrqL07NsVMT
zIa&5P`X0yOcNfp@Xs<#k=HTPizb+Z~do5*Y6ofkRVX1(P6cC*I{~lK%8O49jZPDy2
z2lq1(0hSO;S$Y^tg^}73#-i3k{i&8#A&iyxm7s;000S@2{<KMJay6bq$8YLc8gaAf
zh7WW1-`K%{F=>eEZd#9F(>lxN;D~RDNF-uBqR6#TA=k`=_1@pVf6FAuD5$Ju!{Yu|
zV!I6pV-P@<&v5$QI-Zus$NL?cf<0;&+N3iKm-&r)nrupE4pP)^4RNh^;yF*Ax}&t)
zr!TN)qup{q1_bS$+$0$Q26Z@fCP?k;qo^nrcn%VIcJkG4LBE54m^)STzmP{rn86|r
z9Bd)|X*M$#$e|lYs@|%ai;1i#jAR!7`ID?Ml=0oBILf0;S6-E4FQhWp{lav(QYbkp
z5(hdua;KHmb=FJBIAQB1^UwGd=>`u<A>LaT*R+rIuj}#WKvMuyf(sUwrFINGfzmvo
z<lr*lDSC)Fx`b5DL#C==T89W}f<nGCIW#tbos1u4iGqRyh}?36vU0t|{qYp}UBaI+
zOCz+yhnp{6uIJL_#er>qUn6}7&jv(l{@>QPHbvl&G;Vz@^QZP8r^H+tGYNW&Qa<HD
z%Kay4DX)fTvI;v-nf_##Y+XEAxp(rUN$;u9K{%%D6a9Cb-NoEXyf^Lbf8olc5+-L%
z2k&kre{iK1@~o^s4-z=EXbyqz9~>-ne7ye8(yi;P!|)<(OWiH*j7i1e$A10#WkF+N
zvpZSoJMM{WU}9oANEf9_C+T<R+V*uX&xX4$+d{t(uOS8bn~J<lIOLs#LM&LGW~JJd
zeTyE(*A5e!gxEeAEm~6pMyPX2LAxGFNYQaG@BnN|fnj?32PvjWK8(4-x6*ouId5Zq
zD$2AEaeR;*Qeh^^4NpkdE`&e&E!KhKVIo+fmGBiqk3k2cMkNapFMR6Wlv@}qN53!I
zK}Xi{>@KYWAKcZ?XYvcvV+~vp6kF~F^5fk55BLleL~$T<MDgg@_R8?9BNy&0awu7h
zS?`|nLBz!9-!w|Iy4OCn_P4QBGfwq4?UPJhj`H%JK;%kkD&RdMzXo{*Pz_pAaetJ#
zfu}+rfdDC#VSs&6Ves(kC#PM=aDx02I`DA!d7jAM{#={1;jdZjJZeC+kY9Q;^E-J+
z<}zh&Q%m3xxDe}TX84e<X<n-!Bhak}FppB5t~KZ4ABuh}&iZ5la}UNzZjf@7Q(i;q
z=uC3xTpK%YmJkq9!HfguZLKyRGXmS!E?H9L$VDw{wz+PA{>NrlGZhL^hbpngcaK!r
z*Lf`=M=jvV=7OhL)4)rMLP^(cjdb)VCC`zGsV>i0zYpAi57<lICUkaU21kbZ9s0MG
zXJmLfz!D1?Ype|S8O9!uBnq+Vs=oC}sqmzu1*e1Xwu|wyp4$ANlr|cd^8*F3v@A<;
z^Lhpq)w-sN{ja&8Z$winQ|M%*pzsQs(`+ur43>>9!mmPeT!aIlx6q7M*c=-d$ft};
zJxx$_L|n+Dx?FYZSI(W0Av~=`fdP58{tr-H`cAu_2B!PN)!1IpNNEPtL+em44UGZC
zV->rr2;xxaX&O5JePkur98TY<q71dZ+>pM#La!lnE0|yAt^y`s|M=j0e+*t6-OmA|
zT|_dd{3Xl-OWW^6mLzns+0LaFiR^;fX0i}A`-#h~EXCV};KY<4I`4%f2gw7H6A{-h
zf>A(4dwoejN#Z&jz=}Q?ij$<Aq;$K)q|ONN-(0yZ^e(U&>O%u;z5*C)%Bs>W_@MgY
z^z^jBRaaZ5I+gF$U`9x}r4NVzSIWVcgMI2@AmrT?T>}lu)mNL5fI^c-X?G1qN_uU5
z|2s&1kQ4DIMyhwBp8@)9%#y~H(XdoGzIFB=<k9-Iw>&n(W{fI7+$t!{3D{N@9;8;l
z&(CSU!1h9thA88H{olKQ`@Tc0KF9Zew+==<8Zt<=pDDFm7aQD6i3d-(<gOHjBrI}N
zoe@qXBL6EZFEN-E4Uwy86X`QcSPmcCRYG^+k1Lw2TwmFbMt1PDK?~6;LcDAH61@dc
zK|I^`TmH_VdbehQv5Ov3b=S9>Dr1%k3?}W9>I&};9JHwFlXhN5?%Siww%6IwQNHWB
z_opcbP-b6Z)!l$#e-+?Psed?V3ET4T{jt}wF0lT~=c1Y<N-&Ib;q-#45GRGVfP0vZ
zJ}yOKzqJ*o;G~R<I;gWgd@9>tyw6=pv2ZN+77Wp6d8*~jke>LXR1a72P&WF5TK<f?
zWnNv&#SIDH>V}3DD7#rC22|_o?cI?g37H3yMG`Ab9|#CTl03+m<wrhX)=8`5%}=74
zy7jta&4=C1-i%eC?lq%ZY^M8{KNZdQ=RR9f3(}<q#^5l0MqrIasB!XA_j<>B$xn9k
zivVwQ_dNTb3~cGu(@pj!xanW*rx<FPj{Se_S3na=o2!uFWhiD;ldb~FKaMBfaECK*
zT%KbvDBGPvY{`6jF%t1iRe<<tSj^pv%gOw7G0m4mAiA2JnV_2=-L707W3BD1^A^O5
zr0)*Uzu@WeTbF$fa)pzr&TC;&A-*v|gc=H63a>lf9~}tRLC}nL=ymU!F_2Qcx^-Sz
z{kO*>tt)YF_H)Y+vNqgZ+cj?umKVkhYOTkkXSR1f3ie@NkRxl;oMsIVj9XMsd#v+W
zUT5$x`8Tdxp4CC;5wlStSh71?@DD@jIMhoFJd8O{VYh0V5p0v*>G1uRGso;K7_bDP
z36Th4Z9w=E>R!x|8xTtisz+!8f^J^W)*9!;Yp?m?m#~Pj{paAC7!4bQwDr-8z<>Y?
z`!Y}`R0J_ofv%na^9AY&FxYbw2w(7$74|C#n<^2#Sb)fJ_grP>j~Mu6;{-~4muS(n
zo9Zexo-o&U5>?<OxZi)bO!MpPJTqVDI{T<p^1Wo$$*tVcCea{mnA#D&$e0`|e1jlS
z<Qo#hz|cFgq0ww+?V$eIpx>U$D)L8oRAI{E)`p9`5(i1G<L_Tn;>lkv9kyZMeA3U4
zZH`5|zJEMA+f&Up1;CM~6w%4mbD7L|ay{PO?z;hlJughl*Qo=f4Lup~Z>>lU8Cl#O
z+llA)<Ix<XbJv`w1blZ}45>Zyb^M97P7Mb_Yg#OB5GfXXVy3fFuBGgj&5ZRm{_xF*
z?FD+f2`XKe&2+>-tmGdx*cE*?WfO>e2`r#h2JT+~;Qg7W!2iT)nl&f!ZQCb#s||j$
z(0b!UC5Gx_tg}kc!-JJ7`fJ>as>fq=rRj4M){j~9%gk<-&e(xb_;9H{%S0NllHKm^
zZ_$$Eg6cch=Y)^U$Plr@K#v~w+uzbN_nm|H2;1|iD%D|eYm}azIE0ZksnRzSFW?XC
zBn!-L5koMQuy4I@LEBU%3{Jr^I(U_~p43^Y^WdS^E?I(9bkQv*#V`_gUqxo<)8tV5
zZnc{k>tP0)*W942-OD{92YFxg<Ikrlcf4MjxgMCDku1}~usL$UW>yU1C(6nrn@&k`
zIP+CAwtNUWO`|fox;?$RGMI>d5_hx9i@#OQZ{_ci+5{+MRvPkZIn=j3&tJf^-1x#&
znO0~#;*q0tfI>N(a$ezPT9z9{SET$Zh8~O$t`s3Sfv`mP(J)5dE>ZakA0*e-?xh-8
zk1?dvd+SC=>2risW>0QxWcdSlG+xYu7ajFJaB{Y+%4MYbnB7LbnXP>SVS5yUfRToe
zM*!|-k-qQj_Iv?Tp3+#nqLSp1(g$4e@bK_|v$V6zC%*%`+bFcx*YYDyQ+|<}C}G-H
z&XbpS;#h=`g29Q%rNq|FWQ>$W>W8%uLI3KmuAUf-?9w9;YX+RCKfTUHRCl{%F6K8<
zZXnoU*%V}M=|95^5k!pP$;>=<GSad-5I;yT;98Jdf3{_z0de}yovV$FjnCG{p4_V>
zcLIqr!sf6V5SB`>|A)pmS66#?EDy4$HST}#-tp5j$xixFhsF_a&jd6BYLjlPfd$Vh
z=<qvn`!uhNg-1#wAr!n6IQ#uw#^d>tWr+)!7X^fg0s%ay82IlUx>Zk;92(1|WD%#K
z9(Si8F_9$~2^;553tN(B$#>o@#=W_Jh$*L(#UC_Ke@w}`o^~~mUSmaI*}#x{w~?^`
zRj%>qz-9Hq>}@jitXZ}>o2_Cw(937B1qX|k1q<&>nEB0nj2S#7l?MpZ*btyfaAd|?
zw9Q_{+9b~RzkO;{QWC83wI*RwQnlKz9NqYVXY*!$v)9T2&fu0ys1beZ2^V%FOp@W@
z)^5iohKhU<ZPLq;fQ<ysi(H+H=U<RAL29S*%Z9W@-d#c<cqyGyfp^?3;J5@UsHl_>
zK-@JEm+d$lmse~<t}98Y9NoN;>Gt06+qrz?%Dr=yNDKy3tMfhTu%}JIpOAV6Snquk
z)2~~)^PeK!{ypn7O=&taE6bPmR?=ih=`>KcR?s97HS6V~k3{Oos(hD2^yTVg#JM5%
z1`+1s?j652G0BpmI(Eth>-{<ajb%QMIjA71er>f6lmcgFR7vpB#EXr33`mtB#_l^W
z87tXr^N~yp4^Qd`4RWfhZ)8BqyP`t;YyJ(Uio^;VZm%1Pa|(PL$+0=rUYmE%O{W6c
zNOzYGdat42DJ;70gOpxJi5%_2eG2HX9qvl9L(5}jHd}1FYl!zSGfF1suZ_$2i=0W9
zmh}jb5fBq8Iy7}tIzX-7-NB<Dub{oJs~6s26pfdz&>i*1DYj1{w%ZM*y-DR~rgk8Q
zv`a=}5Oi|>GW28yu)SxrfGY-a)HSj}2BxNK_j;YI6Sh*WG&xjRBB9Nb`&5$A`?ycK
z+7c6D(eWzf5pjv*wO#|vsK{0#hFf>gXYozk5^_}~x&T_XtS;^yypcGNnGxdZG*;aO
zw!P~5(4$g<q7lu}87&-gEBoZ|H;pThnLT2)%^0ZBtEPt}5CRk=t@=zCCR4qbJz*!;
zq_ngDWBZL~()B1an4j2~gr?vw<sw$jYek$-b^8lPKW@LetvK`P4ic~&hl-8rZ;$SC
zh?#a~w3_jH)fW$kuczO*Te|<U=d(b|^*&*y@i*rC$~Ae-&C-A3n%j!sQ$lT`Je4m`
z2^5Dkaz326BdrvB)wLu!CE#SO!m{!5cM^`YJDw2bBY!0jBON{_%x;Iw4v*?58A57e
zX;x@jl?$Zi3#Tjm<QcmS7gjp)=R$sG9TX;7IFpUg6M4)Km|dYWDrH^1#EK;+KAwFy
z^W>1Vav)GfyHN99MfsjD-?pkQo=~^ruA_FI@LFL3X4LNmu!ENW)-)_l^6Hn_!4V?j
z3yIk|*Xo+(|5J5}+i#&Ry^<areEIyTu#w(p*H2z%$(v6#_oEEE7J<n|A=BqhNv=f1
zYVzdQxq#w^sbh}7l8B60UfHfce=5+ou<jJ2pTLCWr~_2f7PeyO`dF4tBQP)kex5(N
znI{g~;mY;Koc8)VM?@}m8HMVx2(=nqdUH<YIL`b1m84R{CwqHac#Mr<o6t#KTvmYP
z;GSx*8J}>O8>o4NAf->3CN;$~*&RG^!&|GrN@gA2+QS{a%NAytVGy#}R~|swNb*~c
zJ~0Qe%jqfTd@{Jdgtq4L#3M9PXyi9=FuTC;&F+{$JT!w3{ha-f)qm|<L&jqxtFQd!
zeg_m0rM~Olj><O*8X9IL9FSJ4XuMR#nJ=ya3qW(f41r9b+NB}V&Y%V!vh#UFw-}Hh
zjeqEbh^GqOR;L_wLOGm7fSce(5KffQgAU=b)kcRYiexpNnB0^#dK}^hxAz<{koz?J
zM<qWrV;*z#<lEE(hS$+-z-%~2{oXVt((S2?PN5vGvS~JCQgy59>zhnBcTf=zKeU;o
zuQ1m{&gdh%CUPk+$jKrbwHBT?!5xarx_Y*ffk`9SBn@m{yAc-Gd}0cezHhd+<CkBH
zPSr{d5L|2;t&q=HtM&BsHuajf^ytgupChXYR{y3aMEo87_umX{4_s*#zRatFtBUk@
zc#rDx@;+vQsNj9~$fg+sW$rdLaIDvAYoF+_Pc{AoHBa0x#G8HG8>Imyn>Y|cJsbv@
zThaShmgMBs1pKbKq|wB#RVlFXh`=tpN^?Esh_6jOUv{&+JOR5Gi-t~4Y5~7MZn7Rp
zY;n*wjK+y(OhqtO5P0Zo$t5=(TQe^V{FyPYC4C+Hd3ZV~)SFFzB8|&87Vh5cHwRYq
z9j{oGf8NfbYW)&<M(Q3t*dETA6-8zx$WW*)#5@|Sw>%9-leDf1h|{Si5E<%n+6P*P
zlVS0hn{K>loc?Gf@ZPme1L+c*@(zDCuaDBw2PqgHNQ=Vr=Qo2|)+`Z6W38x6Y-mNW
zv_<pUWB;8HgQx9#sHQ&Yf@0tT9wEd3{dER}kHX3?ca5~zh$m;z!t?aZS!0uul4K66
zr*URdof~sE=NAXAKO;S}W`ePcNNSqHU>^x&Ou<WOxqI8m1)FeOlX)^2zS6d^Q`m4v
zIt9<@7vRuu#;{x$h7&f0CAfsSgocJztFbdZXS)Y19LGZh)j}F9M=wFXv|+-xyA~w>
z7xdRp@D$|n2MVsU6tQD3u8_zkulu!iN}y;xrPtJCYFpx^7y;bv2UjENI4V!$Lw9Sp
zwzp{TL0la{igf$>DEa5DCj{g&zXT};5pS)I!)sTxJB-yB6Mi}Faqt^f;crvI$8JB1
z{~77~he0R+d<N0{ZFM*l9Ytawi~Yc5Vag!r6TyiQ%a)_Ic(iQ<R$`<?%k`f4i{}pn
zkk`try|eL=1D<`L(l(Wj2^`E(@eO-%K4pw=H>C0dGM^w{nS||*^x!8H$tU>GhJ*d2
z*$xZfJR=JLtGu5;{SV%hEiH6q8w#aYAz;?I7|WH2h+54^^cTEs-7$NTz-13o-*!!W
zquNTN^Gu-S2}?!lCAU+zANw=-JN@fU(%-(I#6^7slbjiyT*fYZld!>_pe7t<3fcKL
z_r7$qqSc=xll2#;>xdF}AyXeEGrHycot_Z)wF<B*t71QOpZ~=XJm42+qLN)S&qSc=
zL#O{5mGTORE;m}qS^@j)DHr^ti@NO(7w>?RBqP<O)V=ZFs=raNISEr!!kOn=O+4X0
zWqZ1T=th{|l@Ov9u&4D5{s(ZJ8j(P1Ou6573JP!ym!@$2d~80kGl=T3Jkcfs+sncV
z@l~ueu1-n%WfH_b#Kq*P(U;T)_J$;a(KGGy>*Xq`0|U=``SX@92fERczV9krB(o0C
z=kb#->FMSyE(}61crZ|a{eXel(ZbNtA3!>h^VEjd7?ru!eRU_`Az$il3%>Fu<|Lt)
zzU{i(^3%;|_|wM{eln!1?WK5BQ=xuvAOXV}z_gL%Kf1lTwH37tW&1tuyc8f+u?&G}
zS*j&e<&aOAXMFBHMcohKYE$uFaldeI8)l^u*hkDEl@U7YrQ%3C5zK3^j;0lzlLCJT
zU%r_~xC{)QWXjY$Y+E>iTbuqtlx`Oylg>bv(zS2EMSqhSZ4n;zM54sh$?=XofP8>_
z+%V-j_+imfSExilD8f5I*Y3tAgU;by&9vrC!d84-=Kz<{+hhg%{OVk$VRk=VM>&cF
z-tO`28l(C*f_~k<InB5QfAf4eSl~9Gs}cV5Ty(KnHVWC~0>ayf8S~wzY}sDSNtoBi
z0}+<%<dl?@sP-$BH0iiT@1;aE5s!LKkq~i9pi%GK$opfKn5a*imgv!aWhxvSRcRi)
zg(vatO&?`<9`^V+BWVM_TT+K^%j*xrZkX9u0>J-T14qk><3ZE1Vemw{cCSm71PP}(
z9x$c<jn?vr9k@y+^OrEF7%EH3%Z!}4spR$5@qF-oo;Ktu0teTC`;YtQ@RFElwDfOD
zi@C8IS=Oaj-@a$|JTcq&ie`4%KA5TzcRD1|ezrO->Inq<*V6C1%9Y(N>!Q;LJZ!!v
zE7J*VzXnxQo*9k6{GR+_!0m(ue@1fuEG_VH^Ga$W9h}m8t|?%&@+*YAkW|-jT#H#}
z4uxImI@o!*&dT7w`|t6j<HBs^(o*%IOs$V~?s>YNzLBqR3ScNUY0bwpuT`r2-VfQ3
ztKYsw+im?xkV*CW>XH+kW=Ak(iTcpp`dwMB=Kj?xF1^H(OLo)!T)>1<JU6OIy$DXN
zkM_YXEk1unk^5@+3`@<@2C?1=J^mefRqb%Vs#Dp$8Ho4BZq7st6TiA&fwpl2u^ro)
zev_U^wts1+dn=A=v{N9q2eKBmA}0&YhrBiA-AcCzzHEdKwVZB;wOA9<<FV}Ht>Uu5
z?e&wRX4!unWV(B%HTLpy@Ju2fAHRwWmvEyr@?8V^1D1z8Ph9|18pW&5@S>Cc3!T;5
z#CBfdJ4+X!17+^n9v_{zd4J@QR2ucQPOX?wVV;oOB&1;WSH5cPgfEZLe>$>h3RQls
zI;0{p&Ab#NrNxMR_zbMEP{O7k(GrdR*mhU&P;mgq^ZEyucc+2hD74I`5u5^aZPQY2
zDI&*P8~aTo>nm*pW-ueH?1{9q#X-ca(}W5V60+`|l9ZOU1{|q@(QK=K{#5Qn(U0+6
zYt-2n_v$iek`}S5Pbzr0XTZvAihQ5(HiMikT%(IXF2ivQx_VV5W&C#!is3aY%m0?o
zXDDSN8J)zgUUC4)*n2<Z+68to*G)<Et)usVy5a3zt#>WcJHoEpjq90C;ym=gZoaaw
z>#2>V0>r`2*-bZq$f1KT_=xm1j(YmEFw|O~$I(%Aig*<XkAM}gjRkm%yx@YH8wVU8
zz7qeGFOgKcEH4z)zIp~D9R^B2Cc7V{q90<3X=O|lG^useZz`C=O!x=MP0%+0AAH`@
z>S!4tOsh1yQg8+11roCo0SMfT*qTeH=tBQU6^`&M)x;A7CZ`tGHr>*@3n?g|t*)qD
zjc8ZBzGM+!$a+z%bzcFghV_YH?jU57cedZ%%qme!6>%GZN$PpN)WFs8C|bu-fm?tg
zWY@}Ff^A{}+Sk&|gY<@sz}o|KS*ie}OdA>8XeocWjmzl=cloS_q}4nADWT!OiYP^T
z(0eM+8(62Sg*duBJ$-^=1^FAS;+~G_4wn<IFz;9<FMfJC_MQngrU)|(?Q>LCvX~mF
z4tbjv2fH{u<f90CynBX<xmkfPJxyPa*1ohz!5l@g;5)+@cPwibu(||$@9(Rono~6S
zBjZ*o<VFqN@f5?uhyRzsNoD4FTvpEO<LXj;RLt+jX0f<8VjEv~`%b1oeVA*m*<d!%
zNF6xI$p~C>EIjy=<YmDs2$5|Njg76s)e^-zp8z)cht7^p$9sP;9eBOwgtbXSXJ^FF
zcqOR4OJTaKF6KF##K}SE=2Z8>JIPH-=#ecYKm?ENx{>uAT~h-&UQ#<M-b6R=qrGPG
z*?<z~T?5s-@nl!{$W}3oEPON|+!@YsIOkDaIY=JC@hn1pT+2BMG$?l!3=1{H-DNuG
z3u_9nqLMeW_U#{dZ;7YXxdl7M;wlMcUlEo8T85n+rG2`vos$1Ly|)@h8xaFdhDJv9
zt8J@Xm{pBI32Q`{JHj~ju?6~2n!6BNB`Gn#i8xyl&-_PZv$<Rn2p<{dq)WX4t_T@-
zJ|?%?+dZKgW};->NKwA1&{q71GkHz8edWe`&C>y0QFxbcsC<{_^}}6-B|C`4ZzkN3
zLSi-=M#91}PluN{)|97Xe_Tapc+1U*jdd*^7mSTf5HZ=SZM#n{k;!?cJ<^8;OLBF9
zeZ07Ft1vhH9!ouN_YG9<38}{(;u8RoFv7|~rvwyiK4nbnO<h+Xe>)ZG(NHQZXLi4N
z`zz~Oqm!_zom38fXXyJIHZOR#IlHd_1@LA4|ECl<sMy_oApTQE7jKcAoKZ;)__l1V
z!Fq}329)zTn?4rQq9q(MZ}_7I%vhS7Nm$Y_gc%XxQEeeQN`Xeebi!U7x%`M|obX{y
zUB>}tZ@-Vj^fVMlY+}6G<8&eGI&k;r$PAB{sDk;<o7o8`2PeB~E@o62wOt@WeJpIh
z3@Td2;bsV=)=cfTDb6c~{#BefK3Z`P6`KR1&i+(yGib#NrA+N*PI+R_VuHg!UBFyc
z4OVW>_6i8Pyaq7o$M8MglUXZmBcphM0+=jZ@g3xH3YO>BP5ZrNEt5{i!tLEp1%B2~
zcpTice?T9c%TCVa>eHE;F5#$^dSY;3-c++qI<8{yeZp$7J#OAN_FQ80_GHY>)xqC{
zf*B376brpc2*<(T=xucYa|X^!Y}qkYRb{f6NDR-zAH~NoCsJNB?_YjH`6wf>_~&;K
zcc(6j4CmY(nvfRwBwOD_by|4VOuny==j4{g_+ULSKCdIIxTnC6f`qBHve@zxd<@we
zR(?ZS>BjI>FIZGEB>Xm;IdT@89BD^TRdE=Z^Jsj$dOxwRu0p|)%V$ZBP!^CPV?!;@
z-_U>stIWNd(G95Fc><o&l5UR|KBU<SLt&f&><isMqs6T?4!LiiRJ*jptg;4capxw3
znJqsz<c7I+N+X0-pVK3LqYTyxr(k$2a6=6z=RdYf=2WNMU$+W#Z1Ro58P{55&x?qW
z_r2_O0QCr@(M10frnMB`d^NDK$q947^5_;dnzF!zDPbE$7_7{aJ;=r8Sqy(aOA5Pq
z8K!&ike%JF-J83!L=Tl|UczWEk&@aM^6M@TSvME(?RdfJxKQ87px*bC!d@!!peOC_
zreyP`q|6uT#hf<jyDF>uc&L#X8w`ls1HRfFD*i8v?~AgZq3ZFjEpHoPk%3C(|35T+
zg<q5Z_cjemsdS@ArzjvGr6SVZ9iujCG-HGah?F29B7z_}a<Gvjr6r_cG)%fX2G9Kd
zKF@z}zh3t_=Y7s~u5(=`U#{{+p}m@S(>{=%okTlCG=3Bsv`Xsxn@k(gL^UPlP)++5
ziL#EmB<02(LW<*7KvN?w3?P*u<*~EzOKDp2%!W{IoSf8T<#R5T?u6Mfl?jEI@|OYj
z_R8@3(sG{sA;Xu+N;=lmF+yRaF@~M=#}SnuqpE&X@Wfxa&TLFi|M+44j+Y^=YqAq+
zcjE6ofE}cOniCY)ijl40O`Kg)t;8ffzWY~b8%$Sz(F9Dj`B6z+WE2B@=n?!iV5*Mh
zhJr$B$#|BzEhy48Cw=mY)UV*JxjF4Gvq%xQJMzA#4d$K2hSug}<|h@1$U`qkj3#Q%
zOw}YdE+S+gS@L0#=2S5nTy_VPX_NumyT8RP8U$I4fHoQ&@1@igmZHwoVq^72ptWa~
z1-SVd+f;!=!~PMErXn@BQ<Hoo1&JxOy)Pt<Pnangmp}g{G!741S|&CYhFly1&c;g=
zSjO8w(yGJsrc9D?E!jwYQ&jmY=D+j~fI!_+r!q}5L!t7Iv=b81LT`nW(w=)#V27W(
zf3`_2|7S4)6Y-UE_r-H_BM~x)kI-zKFTrs}70I21eaad}jbAY!L$F)c=`B~8p~in1
z{?57ig#ufK%fnp-vcR?=VfI;4B&p$K1LqIxN#nJj^eOp5ro}0e4!#HhOSy=ViD}_+
zGt-Gl27tHz<n%nR@I{R*K$3k9Ew3^3yQiB$R5diT1z0tVMz08319iiILm(TPOgh}P
zlIn~(+9KbL_K*ZFjC0+)>JULmmmOB*aD3{t1wp|=2Xd{k#M4b)uguEaG%XC7D=MaC
zww%b{>voouRsSd~-6Di76rK<^wi+|d{4(Rmajfn7jU|Yx0W10)WpwWh+ew-~`biyN
z!IuxS(bn&#w6ph~SeTlB9%+Afh1WXoe{yfa_*M5F|JIzVZ5e`rj4B{m0^-4Y>_J1W
zCrlw?7P_i7Mz|nQyK_|sHoA_c+Ld$q(Sp#2tG4yg;k<=3klDKtgjh9%1l|kQe~)$J
za5zAGjimd?TYuz_)Z-Y3KI6M?hTdj%E=t9eZ-qg)8Y-pz^1kMGJ>l~H6LJsr+`30@
zmUAN^>qWQ@tY@<wz6zgXKKD~Au46LnbX~8nmw{~!yfuojxs$uopj7dC=g#(s#w_V+
zdnEZ`8!1O!Z!4%J<T#I`w*os;Q7?&KzWgf)e={G}2n*p@aU7@0m$&@_)pX`;te082
zYavvJ6Q02-5&55}=UaGomP}i4l26X3kEgn1WM?N$gwu>nkFRjFyoJ7e2Bk`jV^1AS
z5W!JM!E$bmWdi-*(V6dz<{WLO%M=#CJq4zpOCk{xE#;g!IJMV8QF-B6`PPwzT9FrU
zyx%;HBcFOpbat+CZ<=w&vE}iKo?8y42t8?6`y8bdVpAhSlZmSaKYZq#hE{>*M5x;r
zsQmt9<c;6tmEjpLj3Wr6qGH*iMcx2Perw$3ieHXU-#<ej$#7UMxp8@&YHDerQ>FgB
z+15z7ENiUiUY)1qD-+1=ROh=Bvsc_8*4^&UEz@py7P{Ko(RFTJ;Za!)<v&rkC+6tF
zBCPHs*K8XO`l+j-TXf9TeRPNkaqU)m>1{$XvQ)(BtTt3uSOq60wYc=pUT-RO+zz>}
z7yx#Csg|F+IudvgW0Q4aiVzqIcqi0o5^4<Ox<~!p?H+CiIergrUXHpg*RYfqEt`x6
ztgo*md+d#0J<f;hSEiga@5m9#JQwXdK8MJBQSIBGdYbIMaq<+j*HrO?8nm;uy<M7F
z*B|uD%mhSN8G67Fx->(3eH3~#WC;t)WG|!)Vm_7l{#fYJl*8D?vOMJ6yLY1*iInHY
zsQ@~J*s795YvWwZN*?=W#GEap*8>@zDbA&EqD7*$n{vWE<Yi7IN<H3|TQo1fTg2Js
z1YTEl=NpLBL*u^h)iF=KTP&fCWf>V65pc1T_ZfoF;uvr^>*h0qR~}lj!m}?mU~g)+
zgozNG<0S;b-w^s0@dG$&U!^2YOc_nMK4e5!XA5m1C9#OigK^fdFG(t;g?Q3EGazel
zHL%t+u`aX>F2ZOXO<b9F0&`VQ@`$U;vkMjSn~J()zbZhRn&oG+m+fm%PREGqvyUgP
zh)+-5)pN3czJb2SLLN1k8z^P&|7b$Z_clszd?jx63qHfX-+}(UnXjZ4JVvdRk3uU$
zU+vOZFL+Nuopa8-;uE%ie}~^zwx2bvq3+;O%l~^#%RwXSoLQ+URF32<u;l)YR^@B{
z40QXS=f7sh@K63Ro7=TvcJa}aF%Cu~Z?yX^mjV3NU(*pAcP^Y=%(Ucg1AA+a)gi{&
zr5+PM3->DB>xBBf)ALPCk|Ze~LlW1+WHQp$i40^>q8lZ8b2i-0&VM#hxcmD<)E-nc
zh(hxDB>wLvs)?Ib?VHzD!3WBL%Q3vqXb~Mb3YhV6Oq6>&T+yA%5y)JrWffvv4!tI4
zl0T?P$k0+f+xObAG)ogpN_GXjqF<|M6hk)D^Ynr;<5&YVE~64Q&64%TZ6s_XUP|$s
z3~0{dd~!VMcU~NAKNT+u4~NzHrq-C#nWma4tI53WcLXO>z{^vWW=q0$tMGQ~qtsr(
z#A^CplH2aUBJIkx3to?hAzu14AR03x?QcSM{nIl+upfvp5JugI(&Womupt7eMebiV
z340b*9%60b>B_*NQ*ZxnK?SI3vqK~V@*a<(bW-|tWk(lt;3uH2E>Z)O^X)rH&Od2|
z_RT}&6>9}d?86HpH^xsWi>02Aq(4su#*`r3z>+}o#l1au<o92fLFPT#vOauwHTMXN
zmE7FKXJ%$eA0QP@Ll98-S)rk0BXks6CE$6r*ov~oM$^)Zqzh|LoE2)SIU2U!frjGH
z<=}rHEn9t<#Bg|G2%9|E!m+DD4PqWmMBg`|-L}BYVLmibUoZU+1cH4MPLE9<a`Mf&
zf5}va%gL>D`@)uzHm5iA<;{YTn;%KC_SP@6lb0R&vQS(yI<Dzp7hTENem%2>hf*R~
z3z?v3?os*Gm7b4#1fTW?D09gq+;eU4ONrYGeQZz;5sV6W)$>T4U*0a#LA=3f!1$XP
z9qvLs6t=6*=dShywKuc;-r{OK`hgLHMBLo)T3*QyU?WaQ8{Y7|Eb$4~=w!D9E8ko7
zwNDfYa$Fs}3S7M!jdIS`56yj{AdlI)A47kd(CNTQ_a3wdN)X%fgtPa3sC-9}fOO4G
zReo;NqVk5!v(gK113Eu_GWAE~i&pzBuPpBsaMYRN5JKBs*h#&RnewucVR59UE#d)j
zh1a-sM^Jl|&iFx@bFOumu8Hf9a;S%Gv1WrqZG)OQYM@<s>%!$~MZmeEa-NB2f2ow%
zlpA|*kie9@v6NYSf9I|cClXtWwoKH8QXu0_E`L)}&LKRh{CVUD76dBF_F$Pr{Q_T4
zBykV0{BaFCj2_%jE?;~+@zdSN*Hu_zQ!w_OdFE@8X~y#fVx;!zcj0x2@c5r4GmEJS
z@k`qXs0W8T(ao#(T}ak)FxtJkyVmqW`*bAnBuxg+H8^1ZV3Gtcr}+7=xUMc$)k3pb
z8$T%2aK>9$N|*%~dVkuw^3~HVWWyM&0+d=V(}>+)3c;*Cl3=ETvspv`8vjH!TBkAa
z%oShQP6=cLtEn;1r@1Oq^1Z@IG3ZhD!<(Py+m=zioC(Tp_GoD4O!e79FiPOgSY)ns
z`r9WMtey+s_TL`frg(dN`<&lN=Z{U|Qd#|H>%__;`?o|Bdna!90dciomB0j?h?!?<
z)nejy;M5ChNV?mA(vYb@k1Bs8R(<?5*<)w4&C2vLirxDPJr`=w5S5@RfG!5c3wW-~
zM@>|?ySZ8N@QC!cwuZg9z4jI#R#+5pWNEx#*C`=ng*F*Q!*LhNn6%^6D#kF#uXmid
zRXK>R%7_wZnBRPxe?{rU;e2riVWB;_K3Sq5$XRNgyEzplhFrS*pkUs1_734Wjx?{V
z?0Z>SXI)BC;QoMze7bbxiJ2|xa^kf6<-|uTjbQ7{nqGl>E2AxCGs6?Mbafl$<<9hw
z_Ngnq7x<aP>*d;|QAhNp=Dr|kt_aXPr60IH&3+OpnkrFanTXTuLYBbiAfwv*fufhU
z4HJx#F5h-P6ZaZ!RafkF*MU#dHg}?~xPx(qN(%htm()z)XzIp0n`Ahyep{C{D_&SZ
zZpq*}?d5y*yPt8KJ03w`|H#N(ad`2`3c0&kvoa~`ko;9?=5e1jOBvUF;)H{ZcR#4U
zRJ&otgW<18)RkifpO!WBU$-|232CT@dK4ZXQ}u41#O^*rE#nk%8}I&e8u=OV@t93!
zx5U6Q@i|9Ol*oBJi3L)$P&?bt5RL(l?__IAIx;9k#x8W1fKFs8O^}Z;1A(UBnng_6
zrhJbn8;vMkpcDv)%o=~6#)jF>eC3Vp-Os1<_zaTfbY9{~6L?Y{)!yd^so54hHL7jN
zyY<1>2fVBMOZWe&Vv$VsGe1adsIp6WdLH&N8wk6G?>E9=DwD~N!-)4c_6tuL933qp
zU4?O=)t6!`SM!#f<&5pTkD(l4oz*?vG+w53Fhjvh9U-y~x6EUlM$QPgtfR?-CN^it
z?2gGj0NtnX%v38v7^n+NqWu_}=p`jRYGlp^;}g2_tYu%k^lfzQG{TDMbeQ-z)XB;(
zhOEByfqldsuY9NIpH~Q1KrKKSZI*&$nCBZjtrWIv&SKfJJ6k4a;i?M}hJ<r)!!q|R
z{?Ns3LencT#Rcn57OB~0)5dotsJ-pI{JD3A3tYAE=D&jB<mCfz3JO(lBk%vzkrQ%1
z(y&ZL?Y4l-8-;`hdjD?X<TH>9;w@>BS<(tR2_{n+aU}Pb;ra_(2<G@0JyW(1g}M6V
z9Ur%(hh;x~uD{?n{c4$f(`FBsf5BDltu8YRKXJ^j5f?V*ogcyP&85h`EG4?2np~6A
z^+1_5y4=>b+bUdWjF$i<mMNBlN`?);zs6F1yqt2xTtY$x$@M2OQ}#n@!%`)-AT0sr
z=dAKUY7IeG4({%HwdqNN&G>i3H~4huU?XZOfv$23zF5-P_ja-5-sSNTaw<3}0NllL
zqkL+dfK6_WjL$go^e9=x<DoJTm@a?%6R*{h&Y1dAHEOna(a*I-^OFPqml&r~4>BFg
zeL!lAQPO&7dS~tISatQZBs6F19o!7Tt`RA35j!+isgLW&hhLUv1~qQ(xo_!jrH$`x
zeU9kFx~#->EMuL??A&rIK>oGng~Ot!H}u-9YggC?YJ-)Svf!!RdBM|ONBb$!KakeB
z-77})!8qbs<sB4GVPf{%Dm7cf)gFGPgBIab33ZAvpPv%!24q`i=&>+TTNhF=GLa#P
zWWTa`k7F$V-y=I0d2>qud^jvn#<l}52?qhMegx^592I_f)3!Wexij|174axv&vay?
z6lPQv0*`quQ1Wf0t*dYOC+@~5DJSO#&@6p2+{oCvqSPbB5~IJcuFB8r#63E{Lvn3O
zsjt3O4L)ffdW;?skW<M{6U+EBp8r^8Tw>|0)@!*cr&;0TAORgR4)uL10&F!CDeFBs
zu<jZA709;E%UyisqV%e~(O4$x4d8g{GrY3yXaCGbM8kHs)H844`n88ydy`?OUmVQP
zc~9)t3+F~ek0y-Ix>Crk-R!Dx?f`+;2i@HE)gjUGPm~vVL}0i*lbh+Qy>cxmSc27S
zh>07Hw@a|qzX9nmy9W%<hrJ%#7o=(}b;^f5s&W0LmLJj*q-~OP8F!|;pW(A}clqN~
zrdDqPB<Slo(oEP&6-8YNOBlz(Tc0V&Jn9YZA4q-Q46gi(e(?UL15sC|RCCjcNUQ35
zZF~pz5Y$j1x;fsfaY9Wm+i7jx(MnpJicmYA$E||$7SNE1w0K^O&r&Huavv3Ex$olk
z?zqlP$r(q;MI~B{pIA}=a01$sPmLCaCj4@q%Wj=IVMn-CfpuS5hN%N;Yqcvwspa2l
zZMG;~`G5X^W}o_LbC!dXm|EQZ=ajr1A?h|B2CuHxE^xO<(*#-$&zmbqjF-sfZ5rHG
zV+)m*kAKHmG#pnsJo^N_%y7y#B;`VgxiWnsb4?z|2L!uXNERrJ;g1$jAxFf==lSO%
zRFoS?@_$AYQL!l&!X?9~9;bSwg5(R)*<<_1O{<Wr{CtSX!~{LS{jkKR=I>9K3h68}
zySZ{%0fI8Ig8;45?L^F9D%!XF?WAJh?d@<?Q41`p!+TO8Ma@f<18v(|<GYchS6dwM
zeelK>r^Y#f5ro5Y(Ks1!%m5vfQKGlzxaY@8c2fC`y)FbFLh`Nz!d|Mdn>;UCOjuD~
zE+UmNnKHoXj`F0rW8KCb(k`;qVUl!`&s3Z3P9Sl&7LWBA$H#`dCJL&?s)UcW{<su|
zp(npmzk7F{vVlOX8ys|njn_UbBDJ<%ANus6eX0(lh`Kb&ZT@nigPa()mn`>-GiRAH
zww%zkap1UdBiHWe+HAAga=O|KsdW_oFi>Cen!Kr0K=M!N-TP+><d1h!LSa;vmfkd0
zYQ8wK?aj^Mo}qs#j$lMrrHb+x(8l{a@9xI|49p=lg*`_o9=jX&Hu$kzN`+<isMlJK
z*o@ymQ;%Pn!=?rus-@(3w!%SjDLV@;$XesOpFiuJ(0n%KSaVo8#4U=b{w<1(l^%T;
z>TmD(NyR9WpXdG7k*A{PPZQOr5jXdd3cl#F7}+a@B)`wW)BKmQ>VnDr$R0Qqdz!KF
z&rU;W)v-~{+jQVwI?Yh9uKVf(xY$XRK`abj|BP3#A0{49mlIJ*#lOYr;_YqvYT9pO
zmm{gT{1qJegck;Ts%Mdzj!cm6<>`aV$UZb43Vr+vw^%$M^B$SGt&3_F*45hX+N9%W
z@Xanz_yl9dDe#N-O|6Kk2^@W)3Q&VrJrg9JbC($vkRw##Mo)8%S3XV!D@pD=>sXB{
z6&dWCIZR2BWRTFnDMq^KkZ6ZkMJ2r8o=y{?WO`7}U9PTYsf{kd>25cCuj;hZ1=lx`
z1N1}S3G1q-S57;Wcej|Y2h|Fxn%`+`-rDVH+X?l;k2UuDSbX4t--D?VpFB<0aO5#@
z_K6^LZPSc!5Uzh1LvnYv^6fiLodL?;a_IeSH+;?9@XcM#aEHl)u=!8Ue$}78B}>0{
z2zVV(m)SUQlruVd_I>Q)29oeX*Vo%W(_r8?_Bw;P<dh`o>UDX~(be4TjmkxJhv@rP
zKlO^op7w>i7`PYmjl2&w1lv;9ym=@rZ3CT_T7H7(=5=rESlmvA6y(r$7*zn%m=b34
zfZ!Q3Rm&-&F~ezaSPng>+sQ~i{Q4A4_hRS%(2C@*dco)w=h=E-H?LL-=BblGk@_Cx
zhj06v@pRKI>XOprtKF6|`afW%1J8C_%C|xhgvikh9=1#A>K&V5x(mBT+B;kXHdAyT
z&_mRE<cmr1L$Ad?`C?|JEoF~zP^-c{dY%5G)!!m4Vt<do!prCLO<s9%7klrwM~e*v
zPPzobK?132`OR;VZjJNs!r;+~tfJKJAx7*9&E^T;OoZ86&BBm*ww88@gvV<NxAkcl
z50G10?LuH9Yn4)GQx+sQ3^izJ5Upjww|Co>Em}B#6A~D3r8aF9>hS4UN80aH&r}Zl
z&N#JfK(!vSVkYf%{WkEdLjiziQ#jjl)<Ysp@mB@la^frv+1LT^9VrM+DqIvRjY2RH
z3(kEp<O=Y%$>haW5ZtQ#`cNT7P~p}eFsiuwB%-l!(6R=9{%xy`J;ZL<7s1-Hj|K0d
zIM%B&jmrh>mLfQAj56G{cd8eJ&-P{(U262H*yPL-vI7fQWlr6h5{xz%wR}Ne#ihjM
zvb0YwL@k>fbb|6{@k2EH`XGC#Mshs^sV^@?0dol(o-X;U@?K`ynN#nR=}@>3i2XpJ
zRWgPX20~J<f)?ua9}3<}#mwaeQEyvB<7-@)tG5GLe?R&>zT{YU&DAJjhqoG1_SwDf
zWV;P5X?I5r%l=`bK&j%n{?_31eZ>>?lHTepw#@asDaO4vRdrVUMYSZNZJa+ijRoqU
zed+fF@#{WHAok*5D8#Xqj<3;aS&t@b-Z;-1atpc)`@VB;z;>8^IPe~ot32reF$+g%
zspNKPMfxA?72++^PIa%9jj-3-h;Wq;Q%>>ke89*R+Jb@mElFzmdc{&&cO3Np#eu{o
zokt9Tpro_3@6yY9?<*swGIkL`LEarhUqvyG!gsYR2bH*`L&5bQoC6*1GB4|JBA*-(
z=u$u1<eT*aDh>JjE$u+cru*P4mQ{dvLMxqSEp&in#oTxMg@w^$JauyFGPm>{h<|_C
zkb+=$0vkU^$Zc((Z$!Sm-5uH_F%jOOX6wPGlaTt$?%S#t&Ay1>)9PEHb+a_>O>Yh4
zUJBYcM30Bs!~ANZZ{uh|5EiYS7Wh=~RRm=}iLYqL8Yu=v9a09G!rN;*>BqTudjovd
z$+C+m63Wx^c;&@RfR(LbpfY;*L@E2WyUQeDBVmauk|vj!iV$6#dAuxU_y+>~_xCjT
zaJ6?cfGtj9-OQnbK*13JKggM__pbidcw8<&RB5XB=W81usd=%%CKFv1k*qABpHnD_
z$RNdoi;zB2*6?f@88uLYD4O^nuul>!P?RP5H?o0yJZwDBxDFO!;T8|m9f@xQ6TU}$
zUy=5FYyJoscC}PPzh);bMcm|ByBq?21Uh`A9q;CWSyq<j?LIYAoGh2*d5`@Y(-h>d
zC*?P|A(*IeSwwLDVfcf_a>$?OmwZ^q2K_noXa*9$Y3*w(_f<Z2hdcIkXNpL8l5p4L
z^5(Bo_V^1(E>lkwH@sC**lp!#nW&2&vKp;mz|#9EOZt;0E)2#pi;3X4Fh~t@6;A7-
z?3?-V8FTPAD!f}35C|f)Z5xf;AR0bzyV^_hpKmtl%HyW|fV*dN(DA9hK4fSSg0)Bs
z@M?W4<sAJXs%22(L%p-5DiPUhVjgNBNs;3|-)QzXQ%K#dZ)b~Q(+S{czt<a}qBS-#
zk7)Aw*>n}Lpj#zkvpHv;ou=ZiAlfZbI*sStINNmHjcG%%08XYhz<+l*QvE}B{QGP!
zicrA@j<T5m2RC+f>)O#!h?Nn^E0(5#zO4S!3!}u;)I6vDnWQ609T^ZI&#Z&&iO%n6
z1U6!m4?Ufc^2fOzC+GE>^YF*v-pyQ#=pNeZx%Xcm)9O&s>8dX(#QWm+>YOvP;7={3
z7$GQDxu9HDX|P&$^gAov=feN0q#n*(*9Q(+I~~ZRYiB;^x8hW<ypx{gggULZhOr<;
zHXQ43e^4t3orRqF@2~^*Sg8CO9j~UdP}jz8u;PrBr2;p5Cch@qZsC0)8<6!WGv3x$
z&1EQ^MtrXlYZYF-rwmURRC%*rllqVq&o+H1TXgGmfmS!HCi7*1N1#{Th~T5b_Ut3(
zx%-`%upHVMGs)*On)KT%Ys0@H!VP%Xj6mQ_D6H<gk};l8ebv{x)+!(kmvGXf)6g1^
zld{@VkkC~yuH2)F)i^W%<^S3}s#FAc`Ft9Da+KIVGcpHW?}^bP(gTW^Cp|2o3PHMw
zDe-Jake>Aq$zPgEze!3fpub6eHSx+|OMD`neR?`ThkfCubhhDe6nu7B2!LRJkSwY9
z3j%h26@$08W%Erf`M1m^iyFN1C}wO;%}qss69xV)XXcn@Y>4Ncd*JoCuCz?H^S;Df
zM!Gu3b>%ntBO~dcO<{yL_GSl;01)Qvl!*)WBloxf@W7VY<|7#VWEcq~td&Mfz75*l
z*_#Pb;EPVk63xSO^u-wRmxs%?n%zwuSQTG6f}YP&_YZ>f{>gc@T+dWs%>wsOXWLK5
zhL{N~^v}2Ev6%n}L~qa{NJR|!=lLIbbG+%mUIJ@eddCt39ah`Z$R={6vqi}EMM~6l
zJa7V=8pa8RW#Dt5<Q28TEb1M$Jnm8~H4%~-dP;1i1x2IpNh}3pIPhDKf3^RZc@II3
zX@K>B4Z&u&WbvZHlOf;tr%xN`Gs6rar>Q~21dk7~m;1KU&0eUu1a|#W#WkaO?WHt{
zFd2DYJ*fQbMAi&@PAbGNr<eGou(v5w><i6;Z6f|lQmYprYvNCG;GZC?dc7{cGJF8J
zO<FHasFlqZ0?5`D;0gyJBt*yN+D}j7O8X|ukN;AeN}^A~+)BnkE9-?hJM)-@<Z~G-
z`DNlV&re2^bWBCn8(Q^tgo&9_9)i{<9eX!9xbSZp^Sb!WS>RT|bh-YmUEFPYCfLG#
z?z(2S`2Z$v8mcp3Ao-<`aY7fpR<FJwtPbRTmNPRyC1g(GxhLOj`qw|bEdy7GeWYc~
z_^By%;>s;VWX&@HPBUqvYYT#(r*mdeS2-F^XSB+dO+j^~Z1M&P72ikKg02_U>fuLq
zAcY29$DM>7h@IGlS;ox5K)|>ar2W*h&IsskhCkhVs&#Q)Er^*YLt|EBXfPw_^gibo
zDNoa?MlX)mBEJ=msxnb^ob=KE1$YBdAl#5US~xhpX1;+ZVSqe|{1x##30M0blIG6Z
z<4YRE6ygn!wLY*h%E-unr*$(IWK=p^a!t|~RPN|d|K_2nRW$&QOvgZKL<lUUUYX-4
z^+6a=OFpqeZg&yjds%Dt)lyLSq5%7}u3q=ER#V93dQw{Amb49A2`;KQ{a&x)&7ZSv
ziw7)Knk`QmWjp73e-%JE^g)zoPSrzN`gc@n@fVpQrBJti#GABPe?-LNurNf{_LvE!
z!!6~@;Cooc!jem9ox_=`ngd*ZK%(xZ7su>a?S)?s%7P*OpD9i|B;q^R7Eul~(|NC=
zo9n84q6%?!odx!PKmU?ht~X5;yr_{7zfw4uJ`mqcqE(Uh)M-I@CADKb^3f-g*tWRz
z^nU-A+YWexU%rKySm0`pEk1gvJlM*8>MG=VOF^W6r6D*wwQBp|ylNCP<#El?mv<Io
zFv0PH?{n|id}tA?wAXA{5#^Ves)z*_CQ&y2ZmsO<7G41IA_pYbWXdjAXUslj<7n?>
zWW20Z+lPgaFhy<k#aqe-HVIX*iLM+Rh%*YyS};0S`YmrqBT=!q`oF-xmAJ=JH;1d|
zBD{$$ZhO+YQBCuBgb_c(S?yn431z3?+=o;5g4Y@`#x0k1FW~lvD;&3V-((?53ebR@
zu}&lWSO5gP(0b&AIkzS3=^mO|$-7K}1ER;n(W?Q1scOQn{T{nd6^ENFauYWYG;BHr
z);Hg)b5S&6O7T7{l5_HI?t#pu?)6CqUr~o%j*8dDlv24XpZFg-knSRPl&Oxhsx4F6
z0xZ%7zX|tCKIy!|y_#p+-!FR>r$J^vOwfW|4xxl+0WF6wrq^g}K%3(qyfq&3!#{Za
z1j~oRE!%_|eht3X8oDoCbXvW)_$~D*NoZ~9&`@cGl-#0q6Qd<VVK^F%=Bkyt{XUN2
zjhA&u?N@6&$;AR?seJ6n`KE|{i0wqJ>vDinipZOS)^tP`2!JO%DK+`#gDPWvP_!JW
z+rI{Xo{ando_g;OfT9RJL3@h64Da;56IgnGmU(viQ(QuJ<d0uk6i##j`Y|2U3MsE#
z?d?&eXvN(X>uY%M?bU)5Bakq@_w`U2&i;TV7OG6?)xnO;UUsKv(P1L{;!<fxScH`E
zjgGfn*l-N=Tp0!Lj4JRY?pg_(f8K$Ew?TntS1o`YNNwfy?V-wTRq)N9P!aVA?H!i=
zLd=-?UYfTD7FPu7ok9M^FYoxtw^Abiwd)nEvV<mhGI$xrplzul#nkBSy^R_p<q*$X
zTWPQ5*V4d6Tlws?e?l?+ALj&FU+l;AI-o41IOQ0HQfVe8MyMKBCZfp8*qf6{rVTdD
zg+%R$J@uZoWyuPh6W+_KqaLDeB7lUF6#6>l<dS<1z9CYhUHrI?hqZEOTP`I&6lr&$
z-yy4`^CGaMeaUaR+GgWoLDDbSmz%#xU#S{N;l)AFEICP+l@n9wSY$$cmwrj>muWF(
z7k>~extXe_ez|j%(JTpg(8`1Np(AGjA^Z8#60}y)<~zW$Et_;BU3FCdYvqc~vh^+t
zy1VC+a`Ls?ajs~ZRhrkNcHXBf!rv1Lydu_$Pjgb_8$Fhpt0X<4V)##v+95Tz8{4Lq
z<TXj{LA2OqiB|iWE|0M7^Ho*0vtoS9MUhD@EB=3-y(9nsO?cn63E&cE9?#?rw6f)_
z-RJA{*k9CHC9o-&N1d7=f)1CJd`(kxF_+ml%ixO@g_~lqp*E|+k0&Ee*-$G<DXBi3
z3a(}6gZ=M6a>7Le*(P4H9yz)yc-Na^INbQ(A5_jZAL?GLI^8yd=2~(;gfI2QfDeD0
zV^*ajTJt)XuPuVlx&b%mw)Lm|3IgWl#(f>6>HU|eXw2N+4Fl#&`06G>UTTv4TU${U
zo#kIyXYm#%-g0m^%a)M5;5FI3^lHfummLb%ub_ihl8Q2p5qW>Uv&u+MJ(H{%Qf#Y~
zHSQa9FcYy1UhqSdJ}1TeDbOo6ST!fG@t6~!A+;@Ob=M(zThPlk6f^!lS>=8Wv~V+L
z9!3lx{1x;g&r%xhmTyuTx)_Lrxdr|O8F$X3$KO~L5{fQvuJ`<b`y9Rx8?o`#R4*m|
z$QDew;~|H1IBU!*zG24=lu_4`Jw!zI{Qfdnt14FHXm^jXp%6YcF_h+ERnff58qgG`
zY&ZWY<Vkf%gYQYnAa;sJ;B0OQgtnIPEdg1#EJ^>0on1m&2b7;pe+}GOOKyqs-+mFm
zIVDZzzZarOHszO2(c>O`no;f*c9v!d4BJgTTJyDBKcDs}ufH?s1)=tOG_Ye17@x0p
z==MV^iUihhMZgC(T~+_r*XRBB_{&SU8ILo1);9%}ev_YMPC=Fa4qxdOoe6U`u$zWL
zsY%KTg7@3505Ws;Ylw!IAEN?~3c!y3pif@Qzk0zNBj&z$tYYwWpSMi?ovj5%6lRry
zclvlSGZpdzXmghQQg%_C5wGyt0#;Yr_aJ&As)NL@TYw$ub8b<8oTp&^cVz{$JCL1P
z)_vB8k~QwH!6ss4^HRab$I5PjVm`+40-q^2yB&T?Rsed~D-=W&ZrAg`r?d6oi=(0b
znHe={r_kF)QiV@PXTrd%jA|!8=|(f_yQOW5AY2qT7)nZVq{K2P@CgdsGkWNeNuO@8
zi54cc1-Cv>w)x~}r|9QOV<c3;4sxHlrc5G|>*;Hu__*PrC~!|gv84Mxo|3OZrl!BF
z3nU4@tkIDUBDOynlqpj*F0{LLiD9Z7a2DcwLsgKbLui+s^P|m7T)`!qv$V}5&ECI4
zTV-1?eKt3d19rRg+vttZ?x^41dt3dvs!OZP6V#X`vTAVe@US`Ccv1f9t6WIUmrv`!
zA$xoP&<DF5#0d{W3X0oj$3p(>;a9xA?|j&qAQ9?KDZ(^n<Rw?m%_FpZKIqAZ)&|~U
zi8#A$`w<`2{ao*51Qf-cz5O@6tNb^;U%T3cb%1a3;qZSGOM~g|Jc`?xUu*ge9^&2a
z;g6IrL(V%m1VZUdDkC$a+Pa;K@^9W{L=?=1p69T(KapTf{n4S;Nt+VhXo~lsAF~~K
zw&NS!?*rGxsgCt;{-BW@mNtvxO2bm3GDx^*yqGxTt>>=}ZkxY_p4(2FwE*G}xHe)1
zQ>nCQ_OJ<wc<GP`@Eky!alU`)aJ!^%(|ve~_So78J@UBGydV!<5=~KO5G|h5G*<k%
z@$tiZN8EVee`^$YzV9a;y5uHHuTtY6m8u4XaCh^INE3?VxBBfWh>0}{55Fg@3b<ds
ztlrZ|pj-!#yERnDatVGWFzc%;PcRBAc6WIqO}pFrfqlPw#ZUP?h3*psr*SoTk0d)w
z1hXi`8!h4TmuZkt!{2yA6;@3q>24~&Uv45EKsn(tTuvsPi%r=lk&V^IM-g1>@3>F>
z_tL7u2g1WIu~C^CTAvJ?TqZS^F8Qp)L}n&D{C_dN2C1wFhHQI-u}NDWtIzs*=&Z~#
zcfJr9N^50R&n56CIDmuF!%DjoVP)6mRDp*%y^$niI15eJTQ>O3K{w(ayDn)GN7lb7
zY|`q#{}_Du{GD>M4Hq9|wa2vc&MeA5k0Pp{#JR(*FDGPamT`vDnlO;?OW5GRzySDo
zJ?RkLawJRQXWW<9o!F;+d!E>zeICES*WVu@l889OL%-V6$(iB=?WCaAQjYLROc7+7
zqqUhxDpRkG1l-{Fd2eP&S()e=ak@xnO_YG-L;!8a{Qd;~1%kvraR%>5`<5ZJ!2$)&
zZ-Q==9k!C_pY6_7pK_$GFbo)K{K~SIS0rAQ4+*elYQUX&2uB+w>L32jlscPjd{0w6
zR{KUsm*m%S-_vtC<>Z<dvmyP^bukT_loqcBg3krA`P@iO@Dn*^yh<Fs`fO5(G%KKK
zTAvfPvu06?ay`EGHp{A^^$>dMPaCx&IZwls6)(%3`QgjOp(+oQ-Ht)8qD&@7tL4t8
zY3aPH1z6c7v!~A5cX^%((-vTiNKR||x13edJ@3r$BD9pp=GTv>p>5+^lbub}=}x1{
z-&BglzAghIS*M|X-$oo0hQ`o&^mQzLkU|+-I>PW*(>GjBbxl9Ftf;K4$k&mQ1fcLn
z?*F}_s3-q_aMp{=#y4A0>LL-uoF6=8?wCbEI!I`@FjEKm0Ov&NnTN0&jHlbIoJ{Sl
zxuvBDj!brID(#pKvQYuGaonyZZXb-p8{ih~F9LKzZmDmo+lB*i2Tf=F`LPTVi`gCI
zQC#T17JFs=-qEpuI!n#c`tIgaTi$y}U8GR?IJ3Uai)ufkiAkxxGV|I#LYCEU(om#D
zlg}Sc@Mv4y9`sykdOpBH<eRL1^U?h6ANhshnc>q@LxWlJPcK;G3<59PvdjTnICkdl
zGLEgjV<H@-H>=CyfeXe35WX>9Wu5Jgl;OyQ+}Rg=X`Aq`b(Z|)03G#R!{}ndxhp>z
zClC%5E^1{=B$Pud8>nsJx%T)`PW5c`EVvFf3GPPLpb9qbzVii}<P*fQ<sH4VJ+J~2
zE*7;FOKGg#W|o|P&)e%<XjBXq{VefOo8Oy0fRER|82amyF0yF#Z%v5Ql=eN39nJ_w
z6=@rji=OY*tV8}8eM@nvSN;ccEP>U*?iQO8<bfRCrqX`2t1=-LyOV=%+ca!TUlN<F
z9%VoJ`kHCzwfa;j$3QJ|XI^)OA_bZ`Y4s2Hxc}epOBcX2Bh@kMN%|yC-I%U2AWn$t
za*UWozf^!Khli{V7Ry~l!eeYaxvB*af&(IA>*ciQ1<lNu(>bmeqXBk=pJB!oDf+zH
zsjq<1eKlFB@zK<M0WSp9`&Y!7mnGd`{o|yuN0K=m8h=P<cnQ_xc}Yp^*G`*@2<Dt;
zkJguhE>H_s+L!|T>7%uw^pox_%x|WMK0#QPwDb7Q%^&K}$6-ylQ)t2l<k5K7>H7#L
zbIf2C3&0zj#1^fOOU^03uGn<kGQtBHW+<duV1{a&?8RQ0(a$lzUkbsuc<5B^OU4z}
zIpPo&hazni|G>SXPGY{+K{Z1*7#IBLuE~m)p%Dk!{*1$DYgpMSM}KYy(|RY$Px(IH
z`xu4&;JwWtkjy8#uvqLTQu4S=k4f(3U`hNYE)})S0s1v-XwuQe<JQT<%AC*<YZRFY
zx}ViZSLP930=w{v9Mw*`aJ>ViJ5`eyYuJOzKHstMY2=P{(@A-Nw^U%;@2YtqHgE&)
zE<iX--jeGMDBJbpVWtye-$Wlhb!<o9)t%r%5WP}nLcA-=>J(8e@X1Mmi8vV-nH4P$
zdj7R_n;6xtBR9^Wk=rFRX`g`NZ-^&tb7<p!VU`!)UIez0IH;(H^%aznU)l$9{lRYv
zb#bW=-h(XQ8kBEhj19W(3k|~20$LM8BB53VvQL%J+1IPQAIWUOz%wMzJWwZT$VRuJ
zr2tFE4Xdr`iv0FTTMwIFytSJ-2uXqprjBy?k%V8Tjo=C=*kxK_7?FVSW7v=hUM&jU
zt~XvOQLv?A2D3V5V!9C8Wt7$6-S!JOczueX3-{$7$R<VO*AFVc1(7m5q>^te#(PQ{
zqU}l;beC)ZW<E%?&B|t`Z_8of6F-Ok+Lr7t^{P>dKR0ahje%0Jh;f((2NeHzyRV?M
z21@|a$?_}vVB6P+=1uFmE5n65ZRWEdfO}1O3w3s0fAQbta+=`&R3#fDc?un8@W^2(
zX~oCl;a_1&rchEOLP3_+VH%6n^ejo-<}Izo;!APQxKGYbjKct1mnV_3$XJC#R)_5O
ziwjH7yCuju*-RVpo33WE!+S_fyjCVa&NI(p^&=<5md9kD{4l>W;HUEtz*b+Xc)fSw
zyfsqFN5GS7)T+Ff=l^Qv>Hkl<9Fqr(x9)Nth?EW>Z~yu4qS=On!1{(0RcYVLV4TA-
zD6)cGaF{OnKmo59Z(@^-AG3*oVdk+AKnIEOY7Ki8{#;pR?dtsHiS_LXxSNEV<Mwa`
zeENGDjzAgW5Z6%SA?&(}f<U^6rGS+CEFVYcbrtfg@MbLg!4#Gn*NTv}haC3u22q@|
zFtY@o?=0N7(J^1)jydQo#j2EsHmwTdRDQo{gF7zWjz5_W4#t7dUgOAGgTXA6L7GuQ
zO1+X9NokBA?oSpGSirwcrOSITzgQB%|5DaEnstR|M4DgcgpmOd^sr~+I}s(N5a&(N
z%$DyA8hARcn<nYEQtlCdSW^5o-FM{$6Su{5qQdg)HvSUSJ~xw-;o&K6S9)G^`Ux2O
zbV5OU?Y&Tb>>CpqU$ydX`45^<@1L{AvMt_MH?SN}>P7GFnoE!3axG2~Ed824O@)$G
zimP+$J<_%228X-=#>s~XmTA|7W?U@Oc?@5BtWJ@y3qUNMX+looS#B&16Q}n*!E#=u
zyl1<>cllQpAD?T@^UxhMc(z$?puscLhCLO{B*vomz5=a2i~esbP?oAFiNg@|M3u1N
zY5_84(y!fo3?_`UQ)=f;1t%*)_1rCQn`#Ov#@OWm_VIkqnCbU!dsvDOd^x_`MPVB|
z=-Sl@Y46k0s+b?~6$Q;N{f+zzWZ}p@lb4P#rC4%?K^8^JB(Brlxkf-IiFh=KlgvTR
zZ~M#5&3azq@ik69hasD2EnUv<3&razNH=GX>|T?;El4ySx$)@kEb&jr>M?&aKOPnU
z<fv-4wmTt9NF~8MGrE<Akf*Ocekg+~&0sTrl6{g>M6#8vzos~?TtnR=3Qr`AuCgzk
zU63@nU5*4sA_xO)ti}vJF;9QU5{!Uk9dc8`@p^L)p}@1BKeQj<Y<_Ix8TQY}HHaM^
z8Bb)d_{(NaqSI!>sXn1M!9=UA{xZ>Qd!!HWXSb_`vK2%b>|RcJAU%~U7_akM2031=
zr}dM5A;lZX?mopbCDA{3@bYv=zvstFvKAjdZT*`7WzhfS8myQ^|8Y!gn5o<c0hKvY
zy-Qk?^n;a#`kH;>j(sQn6eOBdhY#4x^P#rFN_e!_FC9A@AbW4^mAfU7d~$z@<66<J
z11mc>TXZx%3)!|3=R)EeLmK|A_%;zn1k<<;j~a?dIQT~_@zu_wZn}HY77}kSl>&ot
z?RUVf<FpCRVI#ZQCda4jm)`B1tDIGiFc2t6qP$?l4jKpt_8-uw^cQABafmu~i1w~w
z4!<c}P;dpjJ8N2Rm&l<|a<E9uVt~^}s<&wLEBl5EUYoNy|Ale;Fk{xLIV<~Nmoj-D
z=ltuzz3Vi%=N4YEuv=nY6s*>bf3Q<;J_}y&)iT=%8C~q1oeB7X+q}TnrViF;9ldJ)
zA(=(&O-tV&*Uq3IhzAV{LwX)*j|d@r&X2<Yw?_CJc*0CsnVI>-HTw+(j?G%RV##xR
zv@DCt4PlnL$LfcG<@mYmW%f}bygZ$Ukxc<m2YUhs%5?(YjttmKja49$POW!`(X^_Q
zT#_k(xS@>k0~_<(&s?HPL$xn|kqfZ|7iQ}Ply3m2pE8O4y&8*E|Kq_!V&OzWgqEM(
z2GA2e=RK99Se!MsS=W7dP1>4#VyTRyn7-XouI@1|;N%-NnKa;=+5W>S(4Ybex6B@z
zoktx|S)W+VR`_L6Lfc84JhnPf4Rr(%Q2$M1)E9yTxw8i~(5(V!l<BooI@qE6m+(|Q
z@P(7izbvdM{O=*mFS=-N`8r5sMtV-dO`?w3Kkx?B1Qopq@@ceaJcz|j2nXQv;a+%+
z&ue9*ng3VGq*rU9lV!>IMlB5!6A39Cx0fD_adZ3~e_D}Vuaz5lKD*R|F*vB56ZpdF
zPn|0|j8Mz$5w&D5xTYmW5O=E>!s(3v$qgOCFLG*p1nSPa%tQ*yI}QAFTdNk&6a@VV
z;lUhmMGR2ynVTo1bx3}&L=G8TrWQ-nyB+=FO2dJWc!;IH9<ow1Y4|*FmL#xL48xT8
zqRinsUgI8K4G9>j+2_3BNowC=$QZ`pFOV@2W~ofIKQ&`!T%(d84Ph^eg(NNDeZlRJ
z)48PZs9N8k*G`%(8p~zAz%&Uvsm4xyT7Q$@acMcdPR7qpjb-Q?iTR8GL;kim2b~;+
zQopVH!8<X;UosukC7?^!?=<Aci9C2q4&XvNI51H*+&t1+7csEIM^etXZlE-CcMEw)
zY+_V%tOb#+mW7?M^Zbn`>oI1>{Yq}>G5zn~77u!N;(1~dvgNNVY1mHLcgbHrzqc2j
zc@8W85#F(qu_Jnz2ZKP3cr})p=Zl|E)HEKm)_f)6m;jpSlKW+?IBWldXtw@?=w}ps
z`>(ig#Kb;5Q(2$coL`kf9wMovwR>sBZLu9VGpD{8TNdlFeC&AMCd<Lku!3UF6aurj
zR|#yg%{`H$HZXn_Dh^?Vn}bARiAT|==La+dwN7q$ftSY_;&|6H$mXLgYC4Z$pCrQh
zd8JWu#P~#iIm6hqw-AnmxiUDa%5-<GK7aDt3$Hf${yWzw9L~=aI(`YbW3P{63G99+
zJ*+$qx?KOkusu`KT5WvpibR-_yW@ujus#<U){phoq#W@ZU#D!~yYh9}uFbe>ou`Mz
zBYVa3c(LF94pEZl40FJaMJO^`iFU_z>ux09FQRor$Fgu%X;L=4t!9_SI+uD~iSZL>
zw55!<<9$^z#>a6u^7zUx_l^UNrJ9HjvCgha#rZV6&#J^E))n@@tpt=`4Xn0re#GM;
z{`>JPtAQ!|3y}dc->)(?4wl^kKxhoJsX~`-A7Vx`pbkwd_8Zau_|D*1n&i;d-EUpw
zk()Dl>+F+W3(8l%@H6}fDFv)S_dBST+lT{>o@3^@EodX-MMZm4Jw2yPo6L&pP&Oc9
zPAeZaqb0R~-!><)e7VDUtNOnsYDMjT=@?cMmKpb?E3X5yzJvffZ1@Cv-oB~#KB|V-
zzzwL_qz#RXv{IG=ihmn&e+!?@N#XkvsZTU@@m{VHpt#*h&Tw*Oqr+AUlr(vGX!8q)
zTy>WkQnYyv`;}KMSuGB4V^tz6eZ$65rX8w5?z4hhTmJp0gR?VGIIFZ@LmY`9_+TO+
z;xuMQBVW%W!Sfrw1ChVyTv>%N9(i4xYWETTKtPi*p7ZItE^$8X=p&xig{S_cnPEk9
zTdVK53R2hVIhcy{e&SUSclG@-rq@z{P<d8E*R+i5-g@?igeiP{xNl*K8Q;}N?Pc4!
zOUhos!6wI_lLwf_D>?|cZ}}-GKiNJ5aC5fnveA^Y*7uR~;Tmwef8tF2^*xX!szhER
z`)7q}T|?e*=ItB(k9znLXe&vecKn$K53S?}ip%{DEPlUcmIb3(XqU8zlZVhkVz3eE
zZ0lc2pf)YfmK}LOYdKf>Q_Igt;br;ek*w|3K=78)K#-r#zykX8%b{P(_R)x=Wugiu
zXcED`pLLtI)WTDg!u*7!=1!qF4d2?}hVSux8?lygl_~2k`hPqw;D3oHbI*_$_+0a%
zF@%^htqb#OBOiRezHxZ|2MfNM(X=P4?JKT!>KETlaO~`Q{>u8&nv^agT(;$VP2!Ea
z+D1E7R76t6HgMI<@LCBmm!@0IvOieh-DY7Gomb|_zpPgkz6z>-5#-tOq5+~}*b`&%
zJa7rb6mPs5#igBwiFExK5Y-r@kE3944;dSZ6yVc+tI{9xr<4+MZ!;aLXVfKmC$f9@
zaR?qC!S!R~G!Q74(o8W1Uxc;fUGejSCbINhbG8p<>TSe+y`jXd1g=t&4QksBm;**!
zB@~j7$2Zisacs<?K(}c|v!vyZh4Cnvc=&IQ^M9)p@+bX`Pn#;C(elXkUGqz!sH{-o
zhy|6x(o1RRY>t?F|G@!G0|{={ud|O89WBgG<MXdS|DIM`O)9(564udMJPNotE{1dD
zTDA`SV0$IJM_pSLE4ge#DFwp&d(*OZ&2#vH>^^HD-gL#ESzg_SDf|}sK!r1!`gbkc
z%y|Q=&!Ug!!b?Mj1moQ1gi+v)WIOdbk42O3CJMUYqT<1FLGNFf@tETVK7o^<|5$2P
z;Xx6P+9LABt=Q97@(|$bUm5V5eZP7y%txg`U1`T#D^ttrCrhqOcLOGt=5wUTf|uEw
z2?TsHYP195N9;S8aK4Idi5prOAdj?@vTn@ooVmbY@agY*@RxU%r-m|kr_4}p4kPp~
zQdTsBE>jIv{}Iz~;F5iDxH1vzh;I>9ry9;Zo2fSN?U&aOq$eS+2k+TgXd+u3k%b#u
z?wbT|Dnq){gL8t@e2|$x|L!Lj)!FbJ*h$elTfDgsd}NiIOxb<KzI+t#J5BG{&@65V
z3u~huN&kHO0I!lHuG2-;THs?vk&V8VtL)z6ZzKL`l+9l9XT-Tz?+H!YpFR>@=XLnH
zt3fMWX?JV1#K-z=mtqedn<tiLFuKUXLp+1`9dU2|uTwfDqY>{`NKJMrx)}SLwW;fU
zbcoMAbGqN7zN?+ve&Ob#k7Up$42<b3$3Q>XePBtfi)W8)r!=tJ?PRC6<q*rNuPA%(
zi~Jwa<;kF`C&<L=^dSa4)))r56t0EKc*O=b^mWCje`F!K|HcB+QnIu%!mRQxIzmap
z%7G?+6)h{F=!EYgxZQ0k?jS!U`pm<{v%0~rCqygd&&b1w>Xo|>8p<RAOVPslZrKHN
z)`yQ+erocX<LDTu7a=~AT^;5CnT0AzHeuXA{vF?rkcpD8JPGAvRWP9O=kBW5NJ5}~
zwH@h3oMyh2^+~I`#`gBtpI*av_X#FmbOF|M9$WadvW6Aib&;k`jY!4xIk*w{$d%(2
zNivQ<$CEahyMqpTA}p+%V7Zb)*e)WPnnij>?CAXPo}p)|2@%~LbaB#McKa}xmWU}@
zRL61AG_TG!yvmhJY$}A~Es4vfI=3R31^3>lA~Pp_jwD*V5{W`=`Cdk`7)^T9;?^Gd
zRUU^o3j1UU?q8E~^+@7O-)SH40VvTxGq@Q;{OOrcc}4xJp{}D<FE^TvDkwI{^lCBU
zaHMmSA@eu~+8~0xbiLB7vHu8^n=OpDj_u5jWf=4?h<#~lO=CX%+Wpz&cS3_5ipgr|
zJfQK7A?LO_G8|3E2b&_m1HR@UUUfX|Qn1#b@)GWTpSVlfl<*rz6nv2Fl=AB4-%n#p
z^<Vop2e9Q3e7zL!>gok-geSGVy=9Gy!t@+?Ne6HLjJGcUc-x~uAonyCDUXyGN~3Pc
z*5@JH0n!c;Wl6KLD-CY*3ltEv2;EJH?S6!uqnTX*$y5N2%QJ1Vz(>t7D`?MhE+Q<9
zJ8wqdYH6>yl@<R=Dj?iMI%H<%=HW`8AJVf+l1b;28VU*C7f^g{5k}ZA>N`g0`$9I^
zqGt!~ziCN9Mt;0HKk7fF%zf;MT++cHR+82RC$=?}Xc8I8#0pDI#LH_*1)dSTeMC>p
zNQ<_OL4;LcDOibs=5<SWT6K;)(R4(8j1phsXwrv1B@tDG<M1fYPo)bV+CE?~61*s(
zX6pV&k<raGx=gPQU*X4-?3^71-`ylU3i`~TK|5T_<G))Jz^1<HV!X<7#F||!GHv}D
z-$%Kc<oOF|WGohPG=ngEJ;=GLj@!6T5zI90?8FZJNrA(3%wEU&Xv^rN$!5eDH=cU-
zQVnI_9%6}q{e6+T-1&xqMou8k5#2U-X^38ATu$D7M0d}PQfybcNu#FH&CZa|N-}%f
zS(*AQvi^kslJSc5<Xg@EW^icA|IOePZ>gNn=Z&`pTY*(|Z$XL(gTAEvSD4{H^^}s5
zZaKBwij9bRUEC5)$U7CwoVH}cr@~0w$hXVQ0ArO##Wh|SG!o^yYfSWy*>r;>Q!`VI
zmz-t2Pc=-<WevJk=+OU<tFH`;vTLKA8M;AQh7bXf28p3TKv0lwhL8{hhVC3hrKCha
zN|5fZp*v*&X@(Bz?(~fB_nr4U*ZKGS-p}55tb46>FNDLaZ$Ap}3;c?AOGY;v&Gq-d
zbZid58^hz*IT!iz_mt{XF$ll&Vn7(!U8Sekdzrg2ME)x<s#c%s^}QhNO!yNTMoK3w
zE6+?Ur&=-nlGjCpodzbwDtZEMgNp1))WwU-^+dnQK!J+}AKjYmRp-hExxCp9;`Bi>
z#lfiYqPUF4G?6yWa?QKY#Q-S`iWkn1?1kxJiL*=4^~wnHs4}RXY=7d8YBA?~L}3`v
zGm@a;SI7p;Kwv3vPSZs<jK6#efG3XQD5HRoNb)LK{KFCd?qH_LB?o-J?|G2}h!6K&
zUJ-&6Kqnd8iRyfD)E}Sd0*`M4KUTP~qO7}X1|+ktIC={jC+IxOKgH?%sr@qv_!2-L
zqm$B)lWW7+TkZ-@+}GE%SDC7#uPWJ@8W*lDyYRv0CN_|@lnNAE`KQ^|`fsxhlH>&E
z>oj1?$rVKcf90%K`dzXFMGlOo&|Q90^&AjZmdrz0SvUNhVD`-jq-y}O8VqSkBh8tt
zf@$W;Rv!;q2|_v0PCHi9pKV!7a}zO&2B0u^RBi=VywAxR-^+bX7b>F94&s~Yqm0L#
z=^#*Kzr7%-&@)oa_EDLA9T~b9N}I>}gRb>!PS?KYZ1AuCgOSQ{0E6=brwt)4ty&L&
zzanw<TFgm@yi4=334l)_=+#gWjD7%Q20$2okIb5qeZ4)QjMcC&U4DO|RQjULAhBxJ
ze|UE*utKF7B5iLsDts-lXkj5ftemGxuXN7qutR$Td?iMjYw9W)6DFo_z@vO>v=eAF
zRmvT%;mu!!Pm1dPb$6+5$fX5jufRI>XCpHahG_RxQkSN9kdY9*Ihwe$Tbb2z!`xtP
z`Gb=DC<jEs-SDlJRqhM@8%`Ly`SY<l*sRQ_gs>29!<Us8&qU=?_8NY-OdxzPj#pxY
zm|DEADzDp4@0*b?iwKRFA3{u}uBzRxPw&@G|G|$x{@<6RJw)CcH<Wlw*TK*A#`zsE
zpOAR(M@~+BWwl2(ai$@*vBo@Y-k{lX_`8)r>~LXyiOrfH{{2V$!h#X*S!y;WamsM5
zf+^+YPgrfoC^Ld60W)mn%b=8Sj0_)1z$xdF5^f(*a2DZN$5U2IM^Y{az`uNe6*P@A
zQ^D{ugB@swZh!8)j=0<P!M6}%qJ~OX0+V8P&}`TkG7H=32&fA}9wvEAPMsyk1{H_0
zDm9xh(|N4MsSOb7d9>zh=U?27dI9rQ8}E7UCxr6vmf=Wu>YboQU&!HRkgk74#C*9_
z)J~if0gLviC_=6V>rSwQ8Ua47G<ZxtQCo4fm1lK0e_*S*Y}H^XL}oWtgzrb&HGWZZ
z7lH%#SYPQD8?C5jQE#z=Z3K)eV95XAb>yAmExTzDCT3>%;My%pKeITNOg<Etwq)4-
z?nbB7FXP}iX-p`YWr?Tv=Pc<F3B*jN+R?p4tmK`D0uXV)zbwbkpGj3b^v|$!`%LRz
z&j_7|a!f4F&~|#hM=8vPje{;nyuS7$5i~Y~acLzSZ8ct|t@ZkUi2S2}W_)$)&($oe
zFdSA-Ly+r^V#3v!K~6~^QRlBf1MJt4#DFi7SbzsVSp&@WVt^y73Kv9`MmVqa%=pgB
zE<rL}<r7Oo<85Uw^k>k>C*Kg_q)VVB+H)qg)l!3S)*-@N^`x|o5EHYP(%Aa>*9_gE
znq}#mIB`aGoS#{JIuf^~3sNmtOEsIzTDw}MW~@>@?ow9N)%ar%JC5&#EDc&Oq|Y21
zTj1ez*qU{YbLuJZYINiAZpeA@j>rW2XntN7vS)rHezBie5H#>D)axC{;RPmqL-LvP
zpwN@N!VL~rf0${bu5sUe3m_fsQX@%Sfo1BxJ5LVvWQ-FUYLaq5F(Ka|L=eX;8ZpHP
zrwXn#v3Z!BYM_9xq_|;5{P3rnM35O9^fonxTl|Se=;u{KWSTgsqWj+y{{DaG%P)%F
zweBXJ_eXc(j|wcFh1a@v`(SN8v03nigb1NKBBqdJmv&V)p=Yr<_YggQZx`+a9V*c>
zxJIyIn@&4xYGqR{j@-s~T3VeU?@ustHPTUly<Kgs4uOleGY>5Iu3S=vbL1<tB4noT
zKAVYr-w<3L2NONB)j2nW6i`V%w4r;ibkM9<TV`Uc-FSczk6GdP;kU<ktg{BcagXH>
zdkCv5V%xlv>-7~rb$lCY|FoBYVeD?5<^yy&b)XylHCgTYvSLLLkPmgO4#5q+ch`~*
zS?zDnjL}P+5CcCoR8lmP;-pItEQJXZtC`L!wkfFokU$CVWpf)ZOPb~V`CZlZ;Z>bL
zPZrhe<s7ywu#gjg<OLRzagJQ_Z{pwc1GNj~JYJo)>mhW5mQ2+7u7~>q8g6H%JsD?j
zTH|$gvAWj2)CBH)w?_HQ&^G^*mIMAvtFtRDqxmXpk<M3pS-Je;gp$|x*LCu%W>FWf
zr{8P=HqX1S6-jD7x29=}6yF}hsZ&2_NAw~T-;}`l&ml>P61?SWWusqAF=$bB4ii%(
zcFt|EU_P1Hn!1HA;;*B0FzBm7YBK#Sd$Il6mp>W7)?#rvcDn@31+0lmi6!JHHWtjF
z#ve7z@{jy&MFq-+*x!rjLTIq=&`z+tN;`jsJZJqpYj>&5302yJ=N3&7yLVRoRk0Hy
zNfd_?zYD|_^pNR^7;#iC^B)Lw$SEq;Ow)attZm11A*denueJNZb|Lw}=u}tqc&_S;
zX~Oiv7vtzQbq|7!$WRhCGpEc!Z$hQ@_Q@xT;Aw1`bVoJ8Wi9x!n%FsLhjP1i8FYU6
zzT@s=81q~Sb_GJwFW#=^EbI}q)a7Z}<n#B9Md9c7Q8$@&dIr^C#T%nLR`B^hC(Hfy
zk9#5-?ko_|7cE!HX%TYiQ;(o~O~fa`A&&hrsA8Fm{xjiQp0cmrRmN}jnm|nO7uuZZ
zzCykkPf(}^pPK6QK$8f^SRwD98AF{o*hvgD^=J4S9QgWa9(1kO@y8Y<&3_hn^3qZ(
z;pCn@#PpXV#7r?9h}H3`jlOU!o1^-<kN0F@EC8Qayof3)Zs7bi6R-Qy7difGlY+aY
zci_}EZD=t-0#Q4!K#$rHJOpVG3!vb2th$b0iILm<smYU`o4z;rJI#`7ycnn7Qe)(%
z*hsLye^hbiz25A4mW+6NDykD|-_qASfhAa+@hmFnAnOJe?JBwQoN?d%Lu-b1=ui0W
z2<o+^OyVD6%bsoqq@`y;(R{bw)TL;On&(<fx6YrgX;4UJgNY<@&`CiUjdX9ad?jA`
zy6c9Z?5U3CQK_2LXtVv<FV^noPSLcd5$RXWv3ml}f;GPQ{Io~l{b}@M#=Vr7<u~(R
zTv;vWKV-4LXFjF1mnqhG3?UL;vc=l|SyxN+IZ}r!Z$9a(?x6+KQitYZP&=LgRje8N
zNW}JPy+If;-_m0id44XO7q{PGFx_eXhY4?`Ts<?J@6}6+OJD8QwnnN+aS#2f?^w{k
z|IA)1_vv@NRLEe$Ij%14DX<IwC*+W<3v2x02SYS3PR#b=dGdz}oU#Q?CmCv)2ca*d
zf6#n|UrnV^`!e9xpWokLckO?j>1n|4FCbA^%r#vJC&q=mVSZ!HKMyfwNwTwTqn{4n
z<YQM(pQ*clgVG7&D5b;K)KIroud>IH8f{<ecy!~Z5;flcMU%iQ%(B*$>(h+(ls)<W
zqGp7dJF#}7RDX63?$jYG)urYmLAF=B*RzN~wHw*wpB2NNo53WQ?-=iPttWtVhbR;!
zqB1sJS)y~`BY~+?KGNSD8-VhW4?-R}Wrt!b2?bV>WIn-`Iy&wWM%_S&T~Q?JsVh!k
zi}m3bb3x+yI$wAH8JsHm2m7XFAQ*jgNk(|)2~Gn38F_#F548ACn&ibw<-Y_}GfA1<
zToZj~=X7jlrG7f{VyQEuARKn}D}YkcaB<`<Gr8s{fTC|3122Os<E#Dj%-lljxTv9l
zPYI!tFZY3k_p`wQ9Z3eg%(-{4L`tK?rw92&tE*2qriI`_zNboX>}j#H)^}sIvgER6
zC`RR$PQ>J?v15VWW1Jir?lVc~G<N5vILNi@<&t{!3B+%JbxB5x(#+yrQ@cJiBPEg7
zh@{XUi|b7u31D?g?yp#h>LY6B^LbcU`*HYEW@W@y-p!07AWucLOA0e|r{<*_FrCP0
zz#VZPVd~{!KeGquc_bDch_ZItC^&w5MSnH8ua4#6K$i~{CcXNVNpQ<R8nyl!dX%bo
zvz*);UurREaW2+A&Ok_VXdv+^$Oa2s+8EW`{AmXbOE2xH-mWMhl9w}3#L;7AfKt<m
z5P0`M?7E4~1*7O`iE(w^0-fV_fMQ_S`L@ZX>QWDVD`?(>F((@R0JOKy)c;e%{{zxL
zGG&g8aB?~Lo>7!)Ns-O3-r-^#z6AjH1#2HY^kul9al)-{cLhoZkw8}7!a1Y4NWTj8
zJwpVV9s$F7zD-$851>6jf6#z}@?(P{E1*>XB7j5tsA1s|iTW?WV0^>GXgpkkY=!g3
z4p5X7Q+7*jfpQ*E?nr=6fEw=2b?C|4jR$#;+Fm1COu(wj&Hh)SOoR|Nrkk%1Tu#91
z&?*_l>*DWKFvk1)i$;($kZ2}Q&u`$-!r@5rYf`Z8qUH1FcP`R5q~z3`Meh?!OsU_0
zc|T}GuVN`GImH=A>Vq<`2*i13$KbFPZut(>#im{V2~+&>!;Sz9l^`TWtAk0;hE0=t
z0)8y5O{*jMWB4(7>zUD+P)k!fqw!5_$j*k@5*a3_%o1rR%@o+sN@AskS_O_-tbBy!
zdo7ve_cPY^cKw|7Y&oGwFEdcloVg0HUuqO@SYDzhrjEm6upskpsc>J>VAc{huKbJl
zZT}Zo`sbU1@}~jzE~1d~1?*`u0Qd}O&J~HBi*Mh+NyVN!ux{C3S)9DS)KW~Bw*yup
zgLg#il&3-pWA&KCr#voG&;T`g+mL+(*DU@TrgmokcLUD4U4f;y#jt(#i8*=%Pzf~9
z$NG-R!;+6jKq=(|bJ>eMYR)m&1!2N2hk$bfS~_-K6N;BeD^HU_vdEhx{PQlXB_Dso
zs}?V5av;2kJ~(k(v36cj`YJ3ntNY}|#zM5VQbcd=Gf}Rvt&ua3Aj=pfpNez7|9D$k
zHt;c7)RZu|L2A_LvXf*`PAWul;WY6!WK8h-mRumV#^3aK*bY9VQcbunCVjsG7+oB8
zZ?>OWX_&Wg<Jki*DgB1xcdRx<3oGUpQ*UmEyIq}s6a2C|E=?ZG5$<5d{K+o$p4>kq
z?BQ8n5L>F7eP5{+-5hxfW}%4fN#QKcCM6B;S%AT<RQ8m!y(D98x`v7h=s<&fZ*k5j
zY5H&2A1~7T-=%No2&eY$_E?JGsH5W=5qKN&jr4>53$W@KWd?Sss0<bA;rQHilBDX{
z6`bt77?;9%PNPpGkdiyTXA~cBeBn75-VCet^j%o$vFE`R@MI^a91mj(%^5NzR!M12
za~;msz9D*u5eS#@iSBG3=hUPaIBt0oBGg^6drL;kM`CT^tXRB3yd!z~q%HOCbt|Za
zlkpNwH^AU6`4bfl<}nK17S2&q!9XINHIY=vULL#JEt%HqeXs0Pi@DV-hHog635j3M
ziKcXj0gC$VUXSw6-|tm{1)+~O!;P*swipQbIE$__e4*sDV7r?<{6&qW!LmB)1nZTk
z{&}mdR*{f7oqfsFvCQWIR<Q*0oQ0FoZ`vf4a}T%CY*uGvIzA@IBCBNICe8O&Hn?&2
zz!4)IJX;9^X9AY=>QhDU!Kfa%bNyG~wabYQl|$P;4^2lF->Gk<@v5G^xDhsj{4bkn
zeCNk4Z^vIe?(gZ}7wKh0g#YGBPb+oAm6@2Ea&N~z=6HHL_BjRl@gX4by~(Y~GhBh_
z?E`Jf-X#3fr5ZRMPQ45XEV%F#UD%b^U-&)cZDUTga;fxoC=PgKpsnl~0tVCqWr*y^
znA@pCI%Q0nd+zBG$^N*F>1|wR6vtASkj|O>FaSRNvb@z*^BF<q`-rmwp6?(Wn|fw?
zDh^#h--~u(R8LhG)dvd6^0#-ZHbX$26Xu;UGp-73*XSAbn{UjAx1;*sO`6yz=PZcN
zhgb&#+$1O7SWqBr{n47e-^5H?JDeV{6{dw{pTlo(2hdw7&WLT39FSusb$!d+yP~P<
z8qgtj0_brVl^1Q43+0H#`wxVZiqUrR_)(VNUchU5z2-{s9uA3~V9;<5$cQbDaAjb~
zG2QcIARd209OtMBW7wJS7BKme7D*4ETo~*5FdVl}#*p@Wv5R%^72w#1a>l$jgv<OK
zJvf}1l!e5->N@}Oh%>KLJSJ$)Z!&c0FPnP2=)a)NKYyYhNUQ-U<RkgqZEQpO$c5A(
zYM#3)4aoLNFXIK=!{pI;RC9XjtM#URn$X#~{8IfTodTq8v)V{CXl63#g`VY;)Ec1A
zOb9jU>X}RP18Y*9X=Q`8XU7r>9+SFfqPY;xAOu4JfMSd!N`xVhwzOsZgi|1lNM;W(
zoVoPt_uCCF3a4l4eXDS{bzk9};P0*>mBx&K{Lw$V&g)d^kfUAEHV6w5K4?PNpV>U|
zM#zM%celx<nXCdxS^QBeUP4pW;Kpxwcii6)fdV^mY~%$`_Mz6Tr%?x&eX*5p_f4f2
zpz=M$s|l0z%TT=JK1gJLOnJ$Rueei>F7UxWhLjt=+jJf$J+tb3<K<tzwep~$c0f}4
zuyf?PIZNmB%Tx?F|Aze0lL~HLL#l%;xu;X{7myFRM5pw}?^E*n++ck}wNo5{$pHiY
zpE5s~6f3Kn#9`F<b7TtJh~+r~0?s>k`fvYH9vA8SFW?MnaS?dp0{FVaXq5j1<qf=J
z5jL|zbWG1QVH5z>#T92VMt|9WZMhIweD<_o=i?{vvn!_tBgMd*CBdWmwACOvt60XO
z+6qU{o)@3;+CK84O-EI#rFG0aahM(SC~>k3_Pek`0Xo`XE`i7XbOm}WIR35&))0fB
z5=bS`H`aQ#yBBnmvYnZm&XXpUbs>NMgtp5kDjy$NMP0YTf3~&3RftuecW`=B37$N)
z%3w{(0?axk3>u4-`X>m-KTMNJV9%h{+iN*%c8bMd2pU_yb@SXRRnhk?3I8%5XjXn)
z8>L09L8?$O>oj|ejZ?l)Ly755Y77=${k(AyPe5(*icG>vEM3B&7S`y_{5B(iZ$#=W
zoG0Ojmv1<R-#qy@k;>tr#kQfEi$!X}G(?;flZU4Y#M49imuMxUjD$@5eV4`h)47wm
zGOzSndb8OZ#P>QWjPf)`$F1oq=8Uw-DO>Y_h`53w5yu3p@W%~WXr4V9;(hTS`uX2)
z-q#!fSeVb0FacV~M`nbZVFV8P5p#rKu6{Dk2x!q<Ur(Z(vPlxO%`LCNWZffj`=a^z
z%Sh{X{NG~w?FvSIqHZ!@gw4YAc%oUiBIP0syYhNyf6l*|84ja=D36_~9;(<nPt-`z
zmTeLSNqlxd2Po)cVKammPw?<U<O2masSMi0&lysK4Z{zVk5go|jAzA5n4t1%e26wn
zIclTB&l@ey86=x|G+%4C?i`nR_Iv2#Veppr>;S3z+Vld9x7VA;TVqyRKa-AsVR>;+
z=x~ts-9J{FAz0m`oI3x7sG4}a{c*&NL1HDt#C1Zn(0;Bm)E>8<ZmLk~2|qbDnW!#A
z-t<zeGY6j(t+1uSU}3fz=h_$Fl{Tk<A1p|*MSTJXhrY>(21pT2RyG@e=@ws{)&<Q!
zW~T@l6hV4ZTl{h*O)L{9xog?s11EaOmzU2|ZHkv(_11Ub#739sV7iO*Ym7P_4EXAz
zV}7&1f6#-!@xM7{jag`#85cV=M}}J2i~iNPRn>&^B+@x~0y?l#E;kJ1@tbivS~23*
zS#!<>%E1}humy~o`H-a@LY=Z3Z^<viRAy`*8`Oxy^!$|JRsve<C&al(TdCsIPXH2}
zewU7iDq&U~aD8x8MX}^r`1s&DrfQ`h)Syd3e!0Z=f`f1_N&AVtGvOxB?qoaT5wO0>
zx$oE~p^9^%tyUy`cYJ+u-)ur29<0R%X5SSQEEn;cR8c)AsF!elF536r&pxhYFyI>m
zx1QRdn5~-|;)Y&~=PnRr{(8W`ACLGKuiZ`?!P?8}(R0?RqlLuP-z<tVt}yr4vpY_4
z94?k4Ulq;@#Foi;W~DGAmB^w9$R#KU=)Ac4BJe%gRTsi8V!!>|vYvV2;pVCPw7!S`
zKr-56f03G9S5*iwTZ@s6a~ajdp0rOl_v~DCPQoI6=EgDV8EUQ}z!*l?-BPdjr2?j2
zTR$kRi|54f#Dhz(uS-=i@c;V*l8q8_nhu=dmrKvHHAPFiwp6*H)s+qG<B!$(1=}=&
zK0?dnsUb1%%#)nfl*J@)NwIE$0(~VLShm>2Dje)aTsiyUkFX@Zke9G`WWYAkiqyR@
zY<9fkU(@oWHr}Q{^-&Cb9#^+l`16&JsiMT*H=EWtb!Yl~_Nc@^1Om=cTNs_mvc-Ya
z(WQV6j3qx;70jO!PpJCvpcwZgdrcS*@?wP^B9(CN0Oeur^{mVogr6mg;P2lfD2_m<
z&c>JW&&RmHDce&j6qjo+Alga#-^7d4e1v%p9i=G{dGweU=aT)8=*k$E-tJLX;p;c$
z_32!EV^i3js~uDLDZ2(hA+VtYkcUeCqdPIROZwbo2Aav;cUg(fMk$a3`~ZdT<u|@(
zB0Lk6jnYe+Z_VMpxEF-iWKM32Oo+6=OdN{z_U5lG7HZDv55dx<0YNuLaTH+1KoT>W
z&?d`0ojGMyj=zbOQ{#W}er)j3=ecr|)QH6r@lI^JA}c<l2TVHWc5R748}!6>kC=mU
zoVqHEaTt~<<e3r?oh0kr51}!uoO5<flLXu~8ec>7L~<fHNWFHfG=+l=p?UAJyhxF=
zh5$l+Sxi|O3T{pj^fKY%nen3dHu8_ln}PM^L?3?TC8(wfmV4KO{E>A2<5j^ZfSu*L
zU(!$8ek(U+RW_UR&nA<IoiH286iq}>PizQFUCG}`;InW))HWW6h$Mc;=&N+RraPFw
z+^uQ=GlW8I{o30ey&W>L0$DE97+j_Mu{q+TQ`c=2!VYp8YbEQnM~Rzjsd*i0Ipxmr
zK*Fn0-LL07OE^*EK{oNe-#R5xA(afq<!EhS#_lGTv~`yZU^NdVK7ZdpI9<QszPooM
zTg6$(gik8Gs)3c^;itRcQ>04a-P9Sd_{{u9MW$Ha)JiC5iQ_`ju5+^s4;WaQ5@yX_
zWRptoIkz^~iI|GN1N8g_)UFNx7i|0ym@Kn~8uP|sT%I~LJ}$WQ4ni7c1T+=e#)Vn}
z5DV{m>#l+I?WpkwsxJVbn6HHDbJ5Enw|f2yt|3Gtjt*`y*LgvGaA|wZwV$@w!R!Vq
zbmjSL?OH}&#EqkV7G4xR`5|rBgHyNYW=#bkw^dB#E`5xpnW{nd3BFQZJ$*ENiNBRy
z)wt#Kul4l8Kqn*-JHF*Hg@4p0{$BRm_`=J?JN3htJO(=$gB)M0OIVjJe|f~D2Pmfh
z_P;ooT2arkW;Aq$mA4LY>e=*})5VU>reuWPqqxiRNPJImKt7<~$(tLz%97SO8TMI4
zDuJ$qSfDJ)9Ii}>+gaV)&iTd&8uG*p8xk~3ST+yyeB!%<^pugfVC4S8DEUWSc;BLi
zeX>b!og3WNMI$)B;dm!S!<0OXBr)^qzU~_#xS?OW%M|n7k#ty6uWt>UXY?l2x9^P@
zp7lw%_=&{3^M2QA&hrm*rRKlf_rK?#IfuulmkE5DLEaq#*K#owO?@|~!>(u!(4Tt)
z*~WgI1aqL_5-)vq%B`~%BusG@J`Dt@S-N0<Bicxm8_&s7Tt5UU<9&_#J%B|S*=DsF
zKY*pz^aax9z(9)SB@V{puxnlG18G-t`~F$Z8X(dMD%H5(IND)eZ!=5>{(j0xl~_m}
zR;WB^bf;2sF#2ar@NP}dgSgjNUY0XaxU{W7k}?W|&nMoO>Cxbw`+{fa^KS{T;4&^z
zl1tisxie=}>owg~kBXAlBITS|z-?0EufcfO%|m*r?0e<()EoD4ME5)y9T|3Tjuj<c
zmSnJ#{Ol@RE#YVM`49cLgiDl%0kbL5=84PZ-G!Yz9yu$;an)+yS<l93HUT*oWOL7X
z*3j<aO8ymOV`KlCo|p<bt=X`_%)ul@)N6C|`*o1KfMGfg{1*>&C_3<r^Yxk_u>r~?
zh?~+iqMqWKAkfP`SinUsm9&^~KjiV%)2?O}a?DAG*G$g5_u(zQ?sB;T(tfJzR7Q<@
z&S(2T#NQVoMzbF1{C6byxBU{s`k;g582pCo8Fs#kNF7J^;ZL;TDV=ih;}gx1@wy3l
z4^Bh`00aD4BTS;w2#Al}Bc_<eD;f<0A#@kL^NJsi82s6-5)j#B>CNIzPw1SuPY9k`
zN~smk7yS{g4Cn!EvfFmj*`o}P?NO|9WY%=*T*l^QNrVq!^YuSiw>6sZyS<autT`&P
zTT2{A6cc%&d`>g2%?*R&`CA>2h`cbIeuWSgM@dk}qvhmyEoWKWJ10fhbXn@uF=&5F
zB53wV;x*Ml)n0T7W5FMd&qZI4CG;bPtKGKU&=w=c{z6QgSM@GgQ7_U~jTm7KT4j&S
zW!OD>PoT<Nuh9Uz-_2g4X>tE-mwSW#h|$NJT^yQbb8_0YnVUcNo_j}U-7FCgXMH{^
z6{shLeKEn_Te-b_LMQ0!X>fp-7Ch<r#KUy9-VXu3U%1%L9(We+8wF>%`26h_Z*%8k
z*R}U#q@pnZ-g|!4i~XkYu7x>9H1M`w0?qE<rpOJP%?6h4^V&tr)SlTz8Q1@Dj~2-<
z>VKB;k1rXq_Wx>A<0G&c0kP~{dCj+2AQixRwYwUeV4LK^_2azVZ-;n7cm=Q~L*HMM
z_uL5b=S3FJJ)jNPq;YR&AAJFMN0hL<0D{{fs%2xc&QA`b@0HXao#O@2c(J_Kl^Fib
zu`*tt64^BRR+m5mIP7%EO)LMPPYL(NC!!x{`qo&iu1XE_r+-+Z8s<o^?$a+;<@ATu
zP6Rw~Q;I9ip5n9apdct5O*#(5f8P%rbT=Cw)x&9iuXrjQE)28+wsoI;>L<d|MpmER
ziCV!Prb8Zu6eN6AL~dtnNr}LIS)UD$dY!(wGlOk>x1yDbTJR@3!VD;OeoO#GZ7}9L
z85&S@&nERDz(*J^^|Om>NiIW!I&|dEP86Ur8~FPe`oqJpTM1j{z95d?2-oAE>f;fF
z10_Xxsj`XmoZh9}7bHjma*<mGY?}b0x$JOMTg_|J7EiTa)z}B;Rm#rum(lp`-lpsK
zAzJ#PGyj>+w*8C1p)C_+^)cuG`ZC3U+(zvFP0XO5)-{`vP<YE{n#6dHC=7unTgi$2
z4f0{(E~}k31$23uFDAbke!4UX`sGt|xB`3g^bp^nS26}L?X)WrSY>b0!j&O+3v^O)
z8k)t3`3C&p&2Lsq+ef5~b;=sevT3HqGwR>`QG6CT^Lr!xV1RZ%we0?(sNz=i<R9(O
z!DZVa(URohx&EOY|4Os-OXo;1;5WII?6UAR|H#07Pm(Vhpr=yR@+I-7IBf9WGaT9#
zBvt;}d#%X0<!wSz@B2I2Ha)2SeY|qw!0){DNpmeIXEh?-moOu(&UoJzC+(?Jo%z)C
z`DA9_<RI0@&RxUKAi7d-De0-i6^vbxVP5=AgeeWFU71mpMU{E48di%v-40_QRJyTo
zt%y893+1tq-+D0l7!#L-DKhybeH7)*dXx0vS@E1nW3S5o9OW*(SHjuP`JOHvo0Xo7
zXBVa2bm)28i#20%SsB!0)lb9SSELdi@L_q3yQJHB9(?nH1*4><(0GtRJs&zy5$pc@
zB+wh}s{v+f=X={9+^tRO@j8F>9y^ZL2diY@*6lhmLGYnixx^Ozwa|iyS7*TXStpV&
z7d~rBXeG5=)CTYk@pupR1Gq4V*YwN!fU8Vh55e9Dwp6sh3ulRI7xMrDK^pa|_f_0)
zc8fFu5!YI{7j6_y+u$D>%M4R%8Cwa}oOR>K8(at;SnzUOe!nn0kcbK^yNT#5ozigh
z$wahdY4E*#DPM+Q>bO0LVlEpwgVa~Ln&-<sOVdXV%&Um&L~*dSOU_ts8a}6U+_Qpq
zOkA_%m!zf7Jh68m%VM5+Pllb1t3KRWZ9M9AFIeq%7NEK7D_yPeT-3qrO9<MY%?JWl
zy-)K91lWT_5sHB6x?R8R`=zV;w7Bz^VA1av&jVrg@16S}e)hY>2~;Nz{BtuK?V_FD
zaaIa76R!jB?4d~yuH*aEcG%CZz>j%HCQfe#?bt<s0M{Y4NtR3l?J^g&?Nd$z=Z|gb
zO{(9+Z&&+O_l&-CD+{WulK#^=<NViO0o^$-x``gDKcWdPGZJys4Jn`|d-wv&!L*jn
zp({U?2e+%$c@H)<_3mXI)E5J$msG61%a#ea_yJ@5_TElaTE-C78>MHd7gQo!l8V%{
zIhMfEwn2O3#*}XA9pyBh(^;Eyc{9+RVj=O6O}pVI1$laHFNfDZ2TJeFEct=9fd0nz
zvd(-Enu%%rMJd((%_^BOqU#j#ipP^o;g&V~JS7V4zvqSBh`hun^oSa48zuYl0tPHU
zgfmkjD9|=z)IaGZvb4}xh|Uku;GkvPN%uaXo*Fvu+-f7(d_ft83Px%_^6X;i6J|Nl
z-M1!+EB+m(GR4%Nd$T<S4R7OE!U2aCNdJ!=dJy5Db(e}+S1_-ch`|U)!n#aTgfVW2
z?`eFfJ$t~yV=CG7W=fjCL*G`t_Je*ctFva$otBmtU_0=T%mw@B96$TvhYltezSwc3
zYt+8gKP56HlYP`+PJv^N^JGQ&1X0{(R3nQikhb;6lg6+c$G@4ISpI(xA}oAG&?GXY
zNg)BB+OrjT=eYydcBy+)hc{eh-(3FMn8O6;67b_~4b_7$&thL4nHZ<pz~OScbW;gX
z8?;3WPX(@f$i%$$q1j)a&9OlOUb-Jg#)Cbgw%#u&FVjSYBp>(V_o@RdEzWY}KpDn1
z>Zn)1(=u_zE~=PE_8U}(Q$3clWznBpYfUY~Lc@oKrFOvC^xr)Ba=@DKuZ?P*A8BJq
z<onKKKj0`7H!$nu*gP<QI;*O|yK@59hZdBat)iiwz<?00C^M9B=^4A=<cssX#^9`J
zZSfOxAE+9PI~%7d)zM+|K^l#v(W57#8D|mU=U)8Hq2BB*YNba%=tJZVn)9swEQjh~
zJ3?OHK{3emc#Sn>3#DxKGQ0sdp;Te6(>t7Zd%%gX*N+M<Pqrx;p4v@DwND`=CDHm{
z^81+u!2&+|r1H7EJBT~Ejm(S*gQH$PVYl<SMcdlLsV8@3TW4o~E2h1&e}|L)acjgv
zONo_l4(1AoIf4}`<_vf(+M={xEm1&>9w~A~yfAk6^xUYK|7D))RHHtb`dR5%@M`(&
zUSiP3*`z?73{gRhjhO%k07>Vt@;R179P_!?M2I^|&cDv;tg)ZjuK8o~;bpANsZI6U
z&eygGj3Lqt(`VRpJKEF|w{9piNdQmloB*2B9OuhdUBR-E!!|z3i(y4eib+ZA*U5Di
zcAR&0<1J&GR*j~L#XV6#D|q>Ji5dWKpH)8oyT;D=$5R1EQ``VhhFUrgIq$D=519w`
zM1o*<;u&JT5Y8H$^=V>QXT`l{gphNw;sW;l9$Z}NnFe!7FDFIdya`c>q>MVW8-6`W
zUlA-N7=1G0DnI4V6`rWzo1FXp4=IyR|MenGh+i4ZG*?7Y#NBOIpLVt;SH+THQ!W3h
zhB;4^$LeOLVv56hI@%rVSgIrIhBPi^{|icE{I6YhjB#SA?4pZd!4;n`Km<vK7>O5@
z>SAwGbZv)k=i5Zd;YUA?38tjBCtUJQW$oY3-Y$&8Deva5t9a!32-fb;8na3U3Whfk
zY2b)c0sxLpq|;qYL~ZcxJ+-~Bubag_-bA@>cz0cEET#;=41u;rLlY`g`mIbIAe(E!
zO&le>Imaic7WxCb$+C?#TI!H|9<~Qg{iT7&{h*$68Iv95<wm7ouRjc=6E9kFfn6T%
zHFibNB@@h-ql~qCWCq=kHdA@{GYtE-{v_+iH{{o?!Y<m611HkMUJ~6I9lB)HV=<+f
zllo<@DWGz1+P%hKuWbgriD_m{?m})%M_o<r<7B{k!$EHiIm&*{Y5uUCvslRiDx+pS
zlVjzMLX&WrcFV$k&Of-wb`;Zh8+mmKB6lo?k4Q>KDX($+w(uZ2EZsQm&Z~yEUtxKQ
zV;tsLI#dn(Knp>%x0(J+2t<FTFw^-R(0oXmYc!&F9ZL#|VrT;9(iA_<dQ+Dzk?_Kk
z)I%@8&UmTBszO7sZ`qd73$WT(VyRxH1PU$(aWlA+>a5OSJJku-@KC0IQP>$AdCUNW
z3o6y^*zt;15VZ_`gxy8C5-%lU@G|*R2airRjR_QE{Q!RmD1ob@S061@mU-0fk@zz1
zt(SP*O`aE-n+ZQ<Dleb`p_emSXU+Q6ziw`x*Ypkv0vOCK_@2Dknv$7GFgN15JKxz*
z==SK%Q;kQ|7^jbBJ%_w?slUm_j~+6we7yY?@9XtOCKrtc$YU3qx2QgG*22m0rzP@J
zqkGZd7rYEK_Wa$JPRxU1Ufj3V{-I#B{q*FI?YRRCAMf2d0}7`UoUf6t3*x*KZ?uX#
z>R7}LV@bi!Oo5|5NIv`!`-+w<=I~QS-_)rW8r_inQ&zSSNPs9ATJWd&|0GDq@b4XG
zluW|RxDCC^Lq@4;wT*M_rAiN&`rl}x24TgNXe#wV{`vr!H!0;JkOe-8L$c;IhFZ&}
z^Hi|<&0s*PY}IL;w_;Y^Sx3)D#dOH_RxAL837;2mf*{<BRGzL(nyM~DV6(@%zm#4A
zuTEzLN~{N9K8>c2JJF5WX`Yhdef#)>5oL_Hh&mX#r-1T-?E+`vP062}zF~dt9wm^u
zecqBw-QZg=P4dle<-=T5gDO~T;0>}yR`+<jaF$I3VJr>hl|a_C`tJx+KZzVW!~Mp?
zyFIt}GL99{h$FewTQhVOh^@ylC9;n!dE<V%KLClG>iQ!%MC}rcYTh$6sTlToj<ksy
zu6sMvjG+(o#VP&~@QDlHu`@tv{6yuu`keBy4jD8HIt(@KEE`<>XFj6*zW^X2PuS2O
zj0M?s=P!UKG*T$HdMUS-$A&w<F6=~F-~%Lq&l{dg#%j^Rhv+}OcHF80&@s6;<?k~b
zVaaeHZ2a*m;qB+yQlBCSoR$K$^zlO87(7foTFw$8AC)oO78=n53d5J0eZzb6o$_Xg
z-e^>@zoJCi1wk;P)Z!RX)X3)kJ=FG}I}dmCg+2FBeYI0GxK`ows4<zKs7pV%B$yY%
zxxU0LG+;JmU4C&ax|OK*b7~I9N#W1N^>-;h%Q$**mzAi!Ds@sK{am|A6Ok1mkD(ps
z8(@9Bf$_DP3SM`ulVsr@?_=dj`h(7z37$q_e0$(+y|e;L|Cqg93%Tm{$4-Q6PtVoa
z-hsO?_3-Ch#>ic-$S8&#d{6+2&6PsBvkT5B{hD1KGjj3bN<`ITo$cbdlQmtYlXcL0
ze65q6U-oa_sykNw$NUscG-w!zIJ2R>oJ=sI=+?_OSIu$hPkgqzmZd~o0j#Jt0KL8Z
zvgB~(=onUqy<n1Lq}I4ob_%egD}9mhkWtc*eFv#&1y|#WgZUyNUvu4fTu?=c$?%D$
zRDcao)xAM4iCT#Ymu%MR+Vr+3cI@C>8`{XeC&2pq8$V{iayVum@pmhO>WwH6Jq{Yx
zQdymDxezLiZr;l&(~MEp*|d)6$4Xrp%GmV@d>T<7tbaUz*&5&5Q1PP$aZn!p@&UNL
zSB*U&yZX!r^ULxBDy5T-cMX%f5SQkqn01B`p{A192LJ;~IbT}QN~`4nw0WX%j+iBE
zae!sr=e{BGQqs=lM%Ddf@KK`^yU2bfFY9xySK5X}7f-<Lehxe2${s3$VHom$odj;p
zF+Te%wj8Aw9xk3+H=~I+<SgzJT`Qt&y_ZoM@=E^zy0f0^Y5#Zxpo6G8`Aq7*?w1`(
z8s#4>H%7GZbFd7Re#8!*9@pX9?Ik6^B+jhynG3vtq>_?+3GJ-+d&#e2%_!JAgWVwA
z5ZlNUW699>kH73Ae9vX6t{Q#qrUI_Q)(|^>cri>FfJ7Tic=AN!b$l^U3St49EWXV+
z7VB&GIhCxoKdhE`8XYIqA=+6|pcGyy9_TK0zy^B7yBOb(88l=qG1c@v=hm{Jc5=AU
zYNt904{s;h#lF`Am@>KHMUvqp{KU6*OH?2QS%Z4<$$9rDs&q)p4_Vq87PPckg!5zl
zSsu(~J*w0Wi516fsETy)gXaJp!t;sdSe5sSp(kSJ#JT-8!c2oFZG(xxIJ)83$(eC)
zcQ0FMln1ZjomhzNDgVBn2hXb1`1sHF^LNb9svNOn$|<-JO+Jae^>MCeOX~#wv?2H_
z$t`&L>fMWAhxa9C9iM%ypy^Uac{)^<Y^(LT>4B)|cYp73)xY&uGjWGdPsWT40pQcE
zBAg&l@dNx*FSZWwZAl}s2#+a`YdHPK)%bP~!X`S;#s*iXwV61VkrfUKZ8|h+V?!9i
zY-%)dM8y~G|KY@4P>;b%+n#Y%37rY3;@;2}Z**<@-==`xG$nYfE?F3GxAol<K@7$G
z4f$R=G=eW%4V}M>TEq2sl<UiZcO1v(%OMl*8m9R3%#A{7RQxuO^Y~YHN544hYj);*
z<a<u2k~*;PV#c%OxQsnXS#fw^n=rcR4|Ja9W^pSfzRw)6a+*eBOVeug#s}L4Af$@i
zqLuLZ;DINsWeLL(;?z?sKj)7OzmTL>FZu}wJ@c$v6+V!GY#^%?k|bznjx<oF^>2tP
zf@Z5~U8MJoy5YMucDBLLgVc?0sWVxVt~rh0K*O2)CUi3CO@{mQlMdHRPHB)34a?Nu
z{#ma|4-{@?j$9f24O9&>t=P_+`RQhxy$mj3K_`%?g^>Cv>q$Mqm$9M?Xvnap>|bd2
ztZ+P}yp1ndid@HiQTzAyTv~`+Ve*N~P5afWTuW^O>T>rwb9AI;Ffu7@8(RfVE_f?q
zID`YAMv%jE>OP2+8^BBZTu%w7<6SofzJX+kW#OIx=2;#ZYco%DOSirZv2*4GMTb7-
z%V4fsIa)Q=IsEXnOrIF_*h7XKaN67(-RK2eLSFYWCZel<Jy)d*E?;W{fA^(Gp{E%z
z=Y0&MqOdcB163<g7s`FOq7zx8L%dM>H1a$w#m!qymic;jv**nXbf+QUdRV9#HuZbY
z<h<F&(a6Io86+G=1c9&5f$i92*uUkTw96AH4}>uR(3D5p7?<^qkCh!=p_094`L!5p
z-~r&|Tgb*<jmt>OraQIs6B9uv2Bwh!XEg(~ou5GEPU?yw=*ssA)bAJjK9M}Hn+C_>
zp$0b}4Qax+Pe_Gy;_D~qmtz4ccB^;>i`=Hst`|#3x|M7<UCGN=2@2;+ad2N)Eq-dz
z+ihas5dAx?zRCTUv5NB)j$J<1&WaS73mquvx)Pf?YOj%vSk7ocVh<N)63bxZKa4S_
zt%QDt(4nbMTkG8`JOm=fJKY{M_GPJJtbITT9utnzJKv--7Xgr)mvk%!HUc1xHivUR
zc{|hOhq%XB5-;xd)8?~(Hv?#sNlKStO@##mtcKOYB+tH3s){kqPu8COP_#n97b)6a
zBJ(eT*zx7_IwG&9Gj^8`{H%di#xe{@?lzV3k?X^R_IsFY*IonRJTNswgDZu&?!xsH
z<9tfN)$O)g%rdASZDQXY(aabfMPDa8&l4G3bom)}P~XKOKjvxjf~`_903acXZE3&n
z%UJ903SH;8xC}*NZNb1kkDkcz_hvUFQ}dJUWoSrrVp^BL2o(1s8W`e%l1Jvyc}#UI
z?>)4X(z1V{en!;Fb6#&{B9**VM5WY}7uFSjx!Og>g~A-+Gp9NZI9g|JP3-4wY{l>R
zLM@(Oo|+Ge@{#vls?RlbYIS5T>}+xT9c<7%eAAW0HdEgsP|Jk=E$2G__T$7dz>aFc
zR1g%qWR1^ii-&j&E~`8-qn&soZ1tN*60Gc!DK_GBh!Z#hQ%i~h=rL-q;<FTKA!65*
z9u~hzhflNTW9e)BD9y<c2wPu}iec<&o10}zOoln?dE_>h8+s1*H;bn{yfviyfTjQL
z582BRJ>o+WsF)f9C%-jlY2Ww;q4yi5fmyhfI^Ogt436X`s$QJsLi4|M3=nPwTxp_O
zu3^3kHO#L1SLKtYeWAvG)_JwdU;6)yXc)!W>IE<+tVu`1U)iUxxVuF4Jn(UONe|us
zA{p|`7j@0LgdpnM9=-x{z{>LVrdkIb^0=nR$R8PgX<fXVo)51!rmYA5d~En*+_z&j
z{SS1?3#=#l4r5NWxh1jFB`VsS$V8_4Bi;{Va!w519--pWYar4u9UkVl&`i#M8X?E%
z$J7?}jP6omB|uh{>uO@_lfRgTTa=%3>X=I{$y#_$j1jr$0(7ycCX|7bx4yM*KUb%9
zMZ611T_Hqq^6TW>Fq7cZuy@)&qNkmI0bN_^bvTZfJdi73O$iGQ;+#Xg(kQvIUy#&&
zgY8{Z6v1(}uS9Oy{u(t%Y@a7yxGq=ShGx7?t@oEM&s3d}q{h}B^fLNq3-_Pd-e@i}
zG8s7bb1uO?cM^Fzti8q7ev}dye$nJ<A;;%%b@~o5yS6>J+dlOw8E^=)PsR+z0}Nlm
z{15{Ec!a`IVOic*dXGdCc87@u2Am%nboj2*R-AHP|HXZGmVYSP|HP@0Nys>Gea}D{
zeDe8MEzVP%_x@_|Y`}A-^dKm>8pgX*?~6w~{PxI47A;7Wd^$*ZXf@Rn#Ff4wR<-lg
zT*darHkNZ1S3kOGI^dCjH}e(hi3#R{jd(0UJxe+{n=5bVN|32jqoN0Q;J#B?qmFS)
zy-T`V>Erh+x8B`!T^3szfiGq%RvLcaZs))Ih;i5UWT(DV2h&0E;^@lE&;oB)>}!!n
zr4D^H*wvg@-#;iT*^WwvZjt`)Ovz{Ke;J~3omkjKx6b)7sACt0`f1i8al)su@{*6i
z4Sqda#XKUDFE}zLercJy_+R3nx2^4FN#7?Cbuo&AZ3ljBX<5yfO((upSP2kfa=pA+
zEJG>`dqSJtUQ+&gS7uHoEV9nVa#Lf98(OP@F8q4n4AU-~og_6~G%}McO5U(+u<7uH
z|EXdi3k`MmGHB9$yVs`L{ejtDFv)518Tw*6I6#xyE)=Ez<QF&JMJ?SV%IcVL-#tg#
zn~M^z^fzzQ=HI@S_A9+N-(wPnXF35rYt-1Vkg4}8JCe0B8aNk>+KOgfq?hM{?aP5X
z+|GVJJWF0Bm6m%Ud-U@5z;sH*a&XLb@j|IhRyc2D;j_v4n2DPG^zJv}z2PUaDs3m0
zOD?8MCbjPCC)?vBxVs-GZ0QQ^zHgv)RMjuxMz%MVKs^OgKfG^u1A%!hnr&K?o1jlO
zg&&i5pu-jSLxtfQdyk8oNS)65g;Pq^n+T_*u*R^7?N${zpSryNySCw6;opE{@+lJ@
zOJwH!3&>-j8`-IjVLBJGnu81yVM;cGP+@YnWJ`qOYqU4*%2%W|*h2@A@e^XZ39z!3
z8`YWHQ>`E^sLdc3?Vn^nW$ZnUm`>^40~khk3HAQAiy(|qrW&nrC{XxJIEP<I8?#!&
z^;(Y(ZhKd_P@u;vz)a-jVBBhwfL<w(MP^2Rmq%hQglBfxN{DK(57afDt$!z)M-kBh
z8}hamcR@J75+gbFswGp)gL#AO;q(iQZ|>sm2xe&oDKl~yXAU;Pxt*x@Ic{pD>a6Y(
zS@&J6F<!Q=NlJ*+J7)<-GrCvMlPQvpV#5A3I4>0t{su&YP3*)Sx)OGnIc5$LnK7u<
z-}c)6{`k!e+c&9h&%Oa(aktn)EA?n_Ixm`mPCWpc5XI<Q>w&RKgzJbpN-1$1&wZLc
z*<OC2)&>FJ0PmHXH(17fuQE-)%>29v7Vv|CUQD^k-To|3>9ct7+?myH>M~nphn##6
zd(+5F>R{cM?OJdn`hZ3E?J3*(Ka=s}|A8(F6jxucx!8Ype{sTYp%D7TR5#9g-^LF3
zH5cJsFmPrwE6D~NdbNd5;JxPw%R0+cs%H?9x~~WS8Cv8T?7|1w^{hH<9gn@&pv3WY
zG9B@9snT_s3Ml9?2It%B<Z*rc*kdB<kM=$3rZ*^<k{=}@qS3UET;FvO!?4U7<B7_2
zSIlC`*V`8G`o@K9$nCMSr*%u4%?4eSX@yjDTL6DYPYIF1b$LuEnEb!=tl^5!>3k}I
zk3t7CoppBnhk=4Z1#KTbyyhxyxpDCS-13KVB-%f=_hD2A61byqn7r>L7{P3MKDRA?
z;6}~{Mb-P(5MeZRQvbB@=P;my_sfY#orKziZa!$m-XN1Di{oHlGQ2hFPGvAc?M*X^
zU!U$<hD=ofMuAZOlsN*9-E_|=gEnCYeRH)<M!@=Ke(x*uFN7C9I9j4lp*T5iccLvu
zki}vT8niMhta14a8wZifcx+{T?uEt`@>G=gD*h@<3KGlyEuDr7*$Y?O>|72UK2nO;
zIDJ`?Gm^E%QEO6)1{5cRQvnOveY)H95Z@$ls)-;dUq|P}$NNU98UPxdmO!d<tAoXs
z0An&N!cDCHOXoZ@nS!8Rx}}D0jR?8uTB%`|jd5Uqgv(P-$|Z-5Z&C(6NPWbUyP9n%
z<aaXGVVRj@{>c!FTt$F!Vm67tIAzOFZ5<{IC?#(~c+s#4keM_ET!~Lck<D~)C9*|K
zwlPN;N&YVL*A*IuJR&7ceD3+oGsm;hVUSs|iXs}8kF|9Pt+AOeZkPvFK~J!)^h}we
z&kVBXpmyRH-@MDv9+S~&Bdvp_7L^1oV<Hl@a2R3w<k@C=v@iL_7YhOZOC`|?4&qIN
z#>mDngq}KP4Cp;%GppQedp&%|p_9#I%{(#;D{aSz0h_^e#Oap)lPj@>Q0LM}@;*@m
z!;?6kCs6VyT@=&)-(Bg3181_8|BffVn_iiY|A%9ssm2Lb{9X}`L535%^fda)WuCo$
z?86{2Khs;d$|w5*C-;5j7ddc-eTQTm`=j;V?lgz@wZ!wnyn(qJdW*hwf)oZW<u~yw
z&9#dqMS6qC;E)I#mB3^VU_dAfjd&ACMJU!i#b<8<t-K|x*R0k~4bU?G(iS1%e#oD&
z>MO<H-Gn`;9Nzwo)LllSt}~=$*pX}DH`WFwdviMefF^D}Z+NGHsX6G)(#OT$)<|3m
z>ei^1!|(p$e6MNgB{`IEzY^-tY(IcC_Py_s&K7V$sP-?{*nN^1DiD`<j^G&6xhlCi
zxW$YDLf(n&Z9<!zqj4{P!~GesFuYTVF8vE2+H7NnSa;u#8-6ono16K0>`=o`(Pmy{
zGdZWUzADa71N?Nj!hPe#@3eUJ!a2(ONlS}1dt*uFPua*q3v3cNQoBXV!XBDGpM9wF
zV9{vqvF)G3(D$0H!7H~z|MbG+E$sg>yGIkv^!n4X2(^JP$(f3&B{V#;f}Ucx0W^q0
zVHx7-`)){nARaKbmS>$lGJb|yRqKemjReV(kl=gT#)n`1VKDMmKX9H&CU!3m(~RH=
zlo7t`Jo36^2sKq|=OjfF-M}$tDCJ;g-=9Ik^eSrFt+Pc;atj)e)>H=U?BOtTUp(>0
z+0Fv!;<u9(J%VF=t7r)xG>S=Z-J2=n63IJwYUd?y$|~p8++dON@mc%@@JT<Fj&pt8
z;{EewwsSlc!ipiQ1Vu&rHsGr$;}jcpR`0o1c6QeTeNMR~j?;6W3~E@nPSG4nlOT6l
zcfE?U>I%>m;C5fU*YKp<|D)>^<)fkv7MHguC*dsbqB*^84QOlWurlUL^6s{lp6<ev
zSAWX!k|$l^I&Po2-pO!X5aQo>OTXHSrVw)7Nno2;S&UsR`4y$o!grJ#Pa6rYwj`l$
z?V&VoW5MO8n9RfZ9y@n=5zVIGq|Trr#DTB(H=frp4*VHVMF$pi;WNwW`9Q!-C*Zd|
zPkGJN)dq;an_x0OW}sMXQ_u-3fV9l8u+x2C)c<{PCae3F>rSwZOcFf2k(w@=#l{ci
zf;g+>@sy<swxD<h$_{AXn#A!j{!y+QL+nLWTAS1Pf2ev3zb2!;e|%$fihy(o64HW{
zw1TKK(%s!ij==zxl9HAbL_oT`n@I|c94+0jQG?&SpXYwQuiw9Lo$H+QIqwX|N!)a-
z=|WXDw2E91Qf>_kE8Ddv`5hCRGq~4#9%jm^bn4ZM`A~}pwo^?p6P2gfmhfN~z=hHU
zPuNF?30+IaWRXMRSJa&*-e1aL&)x>>*xI{2l|@Gu9ExAh;x*+-Ex%Zi)bQKlpR2mK
z0Yp8s$SYimltKCdV(*=Mpck!=ruPPTj)OStK5Ndp=JfgF44=|RAUgi0?k{?hX+9HO
zY=2Qv01I}(p4c);DD!WGz%26|XvJ@Ia>54j;`k!>^#RQHYN(C7l7li=z~CCcK=x*t
zI4$8{7nd6mV?CE`2$MR3D))>)_7F5o8(T!zgxHEMVrU_IUgNRf`X9z(ljpzxxi*yc
zeyM*F(c%l+pRnS)>D`0}AWMWOJRbRXQQGVu7?3il>FF>Xg>aIj0IPehb1dj~`<<k!
zbI+p$>X;xJ!3|4LBajD+<Hi7z#hJJi%v`CfAAH=2duRoc<b)j`lZU-ma@4hLo;NMK
zT^w2RFMesPf=lz<K%{f1`o2&`w!JlQv#eowFxq3n7wXUJe{|g-KeO!w;Y2xC*SH%8
zm=*BtE)4%EQp~uHe{J$-UQP6wVI2gOkN;W5LGGT1)c%IH5^twB1(YdHO6XN3wZN%2
zg&F9lf4uc2xq9+e?`d(6PZV+_g0EBLCbMrS`|Y8#HZH&5Xml)4A$2r+TAAw@JFpBz
zDuA~=I%h&o)k`;Pm#RFQjmHbxZ=wz~p~ntAu$%IdE=1~m%e25+L9_`y+b%z2P9H5W
zmGv-9--y;v;1?RGxO#cQzxN7*GdFEMdr^Z^#AlOWBtzrFKOZ6cpDG2|{}~mQ1Ayk=
zT<6>vTi5s(+x?YeF&#g3NekxqAl*CN5LU2iLtu+`LwX(#*JvH}*V6^Yx06tySFyVi
zrv4!M-3gP&ILQx2B&NkNg%R%q&iJv>r=~^k637`%Qz~(*hruv;Bfsy;S4c_%T9S>x
z^m_mrD?V~T)zukfEh$RyfPcna9|Zem2MnSF*Ld-AI?B<nL~~$$UaA+Vg2DovA+~mT
zX(TN)+)(ed8Zj?X!eEDtf)5mwp<+l0_v4dnjC|rCw=_zNwzDTICOVN9)^8>0Cj~f=
zj|i$@NBRV&x$i_}CQmluY=-)FvYRvNbhu}eesk?sI9?o0hh72k(^Oj6>dga_tb9w=
z9<3T)Y;G-Ks||*LDe*S!9OVLft^o_tDti?;)y1G>A=8HX5AEr{<4YtmD-Lzx-s=?j
zQ9LV01|y=bU=2}SkD|0E9+GG2xlY36b2YnSGLMU#dao5DT?$|Q1Cx=8S7xjKb9J^)
zW3jGEVL1}F5!Mm<0wqYa2#l+zGHkkeFB;$g{#vQ$Q{ffFmb6@;fW@agSGlPJwZEzH
zEd@!H5__Qm4zo5dxH&8|7#--G2TmvbN51k=j#jy7=GtvErG?h^k{$<IW1Xe}mdHbj
zMoH4c_VqX<5Lmr*fjD;q%Qb_#-uQI1KO4X2&>D)4l;0|C#;+yyNx(LMf++`+OZ5%Z
z2?W{fa|dG<h{S6ZW=bM0L!*%Db0Z-eJcK%qT{;)byT>W_sV`_*;k()UbC5*p{WU`k
z%^%-DlTE=l@WZvRx)#PtU~WUhuNKPOKtLkBG3uN4<Gjw=4}VLcrQc$262PB8Eo(T#
zNhgk5Qmmwn1LS?s4BAVwB8ntw7MASmfWBcO058gS36!+ATOyDq_gFS_NS1{+URutj
z(?H;qs_#1QGF#WV_g8dvnlUdT*ng=rTEkJO+v@564CDVr2c{Yf8!y}sV}{y@w?#~}
zGjI`tEPbl*01H0cy0f`jFY(vUehj8*TQK^z_)Gw08k3`^Q_=Nuf(RmP+hPX=7KP+<
zChQFG3~yg!63jv4_2E;e`-kz-emJ0jPD@O~T_q;M(eXyw$(>q%I3hGGS@OG)88<@F
za>bJL%|qB0x|OKb!<FQE)!8+hv!up1dk2q)n!o5<b4mjlNxg>RQfD4v@249POX7D1
z=Q}~Q^3K96aRLc(16NY?sRB;Hm`qRZE&aaScLt5u-F>Q3AT%-;S{mtutub`sED11u
zv|@ngR0%a;H}1SkUwRLN08*tMH0NZrxOr}Q^+-JVwkDXs2Al6#yf)qnQg>Kn9FjKQ
z%<^^Y;`5zZ*V0AsCW@ZR9`fM%-M%*~kN7&yO(N8B@S<#)5y|*$_2&D8gq<QzBA2l;
z<^Fn$Tw=s(#KGp^Ygzuo#w@(bi|wdy%<WoM{D9_}3K0YOdkJsuo7ew<{KWqP`Pco*
zquSL>`Nz8Im`2I)HY|ws+ehKAJ@Mwe8r4F?dD-JO+dN0HzR_TVk4>#xqLvgw%1sf@
zdzHSVANg#6jhFQBCkr@#k!#r4dwE~$rPXXcr1*nu?Z-B*FNEv}8r!mYhYHpQHfIxs
zJ={XdKUP+}&i+GS{~h}9xHQLX-c0l!hngD@LjaO2%)F<55gzIn4jW!LqDf{b=HvaO
zyS#tUv4dtj+N(~;PfG%2yPutKw2gT^Z9*_%lD1_y)eN9KnB?of#D4m}=;PqR#d0|^
zT&cF=K2%14_@(vFF$IXFiv?B7UZ>rPt5Iz@%kewqR+JG0ep=d}YJd9qCUStJHt24C
zu&)n?F;T8<8;feq(xI6VRi~UfiE|azd-0fS_!q&AMIUaZvBr!QSFK|huiiakRYdcP
zX53j;cfXWgtDpRE+uZg;6aZXt$PRRAy5ILRJ-05rtA9&xQlk`Wouv5x|Kxw4Mp^hH
zxyP~XB|gN@?R$`rB0DL&=u&VJ>6N8`VYbFq#6h%AgrPbG0iae<`y~UjiiPuTF2&DX
zSFEX`nQ@vCb`A!LAxVsT<Twe_b1S-0n@gRnBKG<yo3L$6pYMkFla8-ry*Cj?o$|#|
zN8rcKyXMnJU{aX)R$S2a`zG=oiUbn+mE}PgwU^<7;>DQ@sIbHu2+}eQ)jlUmEjX}K
z_W$a&TqxF+Dye6`s~8j|OZtcHUH&<X=hK!v@~D=#A=UIbfq72Wn9g6|9ODhIXWzB5
zPAjpT>OIaaL+=lu+)V6d+ALP)5gN;{J+sB^L2;NNIG^a<NDQJK(o#w@wdj_sG6k4;
z`t81IFAydtebf6GHt9p<LKH62Im0FZb!2PW8=!jab?0J<$Jxf=CZv45LW#m#{N)2#
z`C3RO^sKSFE$fKw@Iub3#TD@P7Q^;xh#oXg{8+L#)_XO3MPy%s&yd3~v9Uh-BZ%w@
zVryNIu7nMY)vH&p7l$Ki)p$QZIw%jq)_iL*g=`pDKmQi_kNn0Ev@u$Z7CP<&D>!Ow
zz}$nkv^nDZ?yOulR4We$yH*;dy?^o4Vk@{5qCS0(fb>~>2G@Jz@x-#?cJ%0k6;l==
ziZx<vR=uK1iCZflf=)(a6t(5)lgBg4kH4NeWGG_74Pk)H5Y)^_hRwyABFTn<TJ!0Q
z5s|Oa3v;s=tj-r7b@(ymmzYp|@2<F4%U7`}{ozi{C9zD&M^;pU+Db?Ao%#VXP2S2Z
zI>-AsW5VdDLG1b0KjaiRYqNRg6#AW*AEbT)E!t0F1TtQZzI7!BcfRN?S-42!yYB)w
z#GdzxQsF?3%;t?eQj&QlZRWo<JYw_Z7S%6Wte7OK$qmNujlm2(G3uSibC-`xyk!>z
zd_{2D+^G`pcPT{4Jtig0!3NcUITEM6UuZ65H-adF>B!6IeG640Q)mvZeA68!Xs1j~
zS5i-WJF*g3ezqi1>(vXvq}4%!F9=UXn1Z{-^n2%P+w{pf<oaQ-=}*jkJA`M^`Q^t(
zy+0l#Q=siu61b!WysNC2L#!WR`UJHdga3=#Oo_ddBP4O{ncg+1yd-&w=#!(7``ImS
zhVz6Weoc4DqWCI?9@pRo=e?tRC8?H0K&CGIz4+)ZODn&s+vXROU2Z#2*v|y2Xo@KI
zBJr7`G}pKq=j4~_eO8ZX-hj;E7>3N{MJ8xduYxNSXEwKkb_)A&!VF-?oo$207vpxV
zd4y+m60|xxHwmhR*g5|Z_<;ju`!lfujx5*`V7XqN*~%$_z;NY5sxiT11i0RsSnSX$
zfz>!4+}arUMM~En^_}|wez~%S<RUDahKF@sT28TwErXVuXA>!53LjO9Rsb7;BIJzZ
z{9WRsU@Q7HVepAe9kY2XjC`<3J?brOljTtP-}XnJQUTs~&HaqktD|^pUdywa<%fy|
zKad8`G<$kM%d!}4Y9nFkL)s9dWT)Y~5!546UDGk_FV(~TCa(fVXGd$)Q+NfEAJ2_B
z;~kUQZ%Rg9X8wE>V_kr=@aPy5D#q{$WH3VhiA_hl`cU#(!&+)R)AaGZgr4!g{Mz>a
zEq24y5hOvAOGufaPv~=kSmPh-KcC}&PoIkw4#+Vxpk2b7Y!x6RC4VJo|2m)|Qzc_z
zNodn{Kg{y<hBc@Yuc2lz<YKc(yFt&DB>`XbSo$0RrUMK-^rqSqGN0C}gmpd}6*Z6Z
zbbVi;+h+V)o^sEM*I?jc&ab!cIW)TG3qko`jE>qW*tnDT+Oz_yyTJ2zy2(}flc2b3
zA@YyD8BOcpq+iAFQBOO$C;SMT%o*I62KRl%1fCy5;kMLI__InH4(d4-ZF~e6sB+r8
z8~7^BFceHOXN%`ao{Vhln0qZIeH+Q=?k86nzxVC84TlkS=_PM%hVw{}wmje*u{G^M
zpvMY`nZ>#>4%>R#iliizt0)~COyIKdxZep8_Ec!Hd*GIr7bE~&E6kQhDCN!4vFM__
z;+np*<R4P_peM}IdLQV=_+`0pkXvDWBp~NNHs*Zsh8)kkV{!%4@uMOok-rsSw})+X
zd@nPB6d~j}Sc4*hFjP!bX!2wqV{Nu1QKy+qaM1F#=RdgT*MBebfSL_hdk^Esvty#p
z$DJwC2;$FF*BbWrx~Xoirfomvg+Qaz4Ty)CT3_VJK2*hxjL8aM;02w*C~!PbpmU0i
zytX#I3*%6)U6Wd@DtI(ykRs_aQtw^BHARL;K~-kwJ;!xqW8R9ciJSU4?Tbh$ahZb>
z9y_|VXjSMMdOCN4BB+(o26v>`?`3$?i{h99n4I$4!)}r`uZQnM@c(SWKEJA`JSwT%
zHj>NG|HhBU&#$#m5e060^S4lPJ1K{dOK6Zt0~b*SIhLPm#@s3Oke|smn_oOh_W2&v
zM(}K-|I&flulMG!N`pAEk2Y6bXOX%jcWc9&%TSeAimM`q!dEk&!ydx9m8(NiLf<p7
zS>9W1`4_%ejh6fd%0$Wg7t7VV>}h?-`UCl>&$d)Zs<S0>y19+z#rq7el%CR7%TcdZ
zv3nMsiUOAhmp@e`x!k~o(<eHF-YHB9%5Os)wz^)mgqOmHBvt9EtF5$h>}(Y7B?;{J
zJU~EwBhwyq_!oVSyTRzXBLxnz=C#Cg2Nr(8R8-<8*PHLM<l&ttN(zeehvj&E;jKSf
zcmF9`Ax;0ccIZu4olRA`TrGZHbJ&tB?>e3((!{yyi*Y=@_$rPn%@koNR=hJ9GjtNE
z0YhohkgGTgf2BjKWX%6AD-aZYtCMpxIh8mrg}dW%TS8y*;l2SFck1iZkTnXIcYd__
znSt9idpMc?hkGrLaGp09X){HjZCaLB;rt$oCsryH+0de*4`niEPHT41@DS`ys9)D^
ze<`_GCKs2UwP0Z_GT(%U&D}9w^Vmq>`cuBEU(ursBEOzJZT#}qMnDT&M@l0HpyPbu
zpHbX7`}!lE8f++Q!H2|Ipwm&{O#gX(>i31lSEAgZJKwxC=*tb)#QjwGz2hEg(i2+_
zNwjahSX8g7s4^*B)axFizp6*KE*~z(=4T+h!d8n)6E<7Nrnen9)trn+&gGZvh|jBP
zjr|)<rvxmCwD8zeXUP@id}_0(P2MZ`5+6trD>eJ<qC16umK}LP2=ZLj9j5>*GlwKt
zJ3(fe+u@7nJ*2H<tlVKkAm4T@vwW@}hZOrp6u~9)j}EjXnJb)(xOb;#UVc@e|58S#
z>O!x=Bt$;TuyXM)8f@A2zm~>}>tZ~4Yzq$tV4QO$OwM;j`EE<JsL#LlYR(Sp7bxx#
zAothoBdR_!=JGyeTU-O5pVNwz3%19wYAx{6y4meZm@I8CmI97T+c5#icJZBR$F(%b
z-uJnPOawnBG{9#SU@h5MICLOsVsk!2)I#iBNh<ffadfiD%Le<m1v5|^v*`}sO=Ckt
zUPcus19ojzzww$5nUX%=lU+KSHZ1Otr(eL8AcLS<qS>z?4eZLvWddh(5)B?rwC12;
zH>p64n|aT&QqozRTN2YLcIEyjpTb<1e#J`UK2%OGL-$e(YCeNl!{JqI+$!+riJX9U
z_cSMQ2;`m}k7r!}jU%gzH?5Zm06f5{Hk|OTG%Sjd_ILM=KMP?)rAb8<rLmmEDHtuX
z6kbNAZEv*eznR^2GhjEGgnr~w!1WlF!gUG1l+Nc-NSQag$XrwT?UG33gu*kfimE@^
z1{~sv<ajG5`b6R2AHQSnaX6w~b#bfKfK1kdD5pgZ;Wk;6wMQ8iB~GaXtQ@zOYMIZ{
zDLfu0?q<74RiqC@%G)nVOV&84RHhs$wnsZJcoC9)RaI-nY;DY*dm;G$R&ek;9u$9z
zC04>5{+!_><(#G9{7m=D+mX&h_GV&7oua``UCP$TUsJ=sHz2$R>=j=RRClY#Q-II;
z^%ui=pRw<e&30+2r)Yt-LsBB&r@@$V{4L7Ynqsg#YRPEqK=U;CptB_Pw}<%xdoy3P
zz}Z-@#Sz#c9&5Iv>rU*WlDRo+FRBz8b28{w_@TcDUwxu*k?}H@Jc{B`WtP^>!L1er
z6KxJYlTPu{?L#;l$;nuP0G~h=Y2`x%EgY|T1#o-Y<bqe*8i&K%lfDJ1-uFO;+TjRr
zg>ztlfj>->20yczNc(zOmASv)OWLrdBw0;JBE@*wSuc69F7PHKkBC%TW&YALSOyFo
z;X0lUcvSmM4N`aV=0W<hTzSFS7EIjJP<bcn?m*8dgX<JtZ;-i{JJoWi!}ay@0f%D*
zQ{~zBK)ZI|z=s-kAHA@(*@ZX}v1jv~n-4ThT>VX{OGE>;DhLYeIVkL?W>Q|GN#B%6
zdFJvgE1whij#FoBJH2b$vagPB#Lgq|BLzsBYNcG8n?64I6*B9tXE)=HIUX5H|L=IL
za|9>vwxuN-%klzk92#-+3V2E>NcC{zU(svuC#G+o0Og+H4tP>FM?VllEaEi=<n*Yo
zvg4NW;+U8gKcFslA05T&{m3?xPnu_+kP;f8Nd*+1KZ;Xd7haJ$g?s@x@seHqeuq2c
z==(AmuFNC}q-2*(yX(Q=c_^9hXX;%HzR>wF#<ZCBi6kG*^C4lK5b+J+AmCv0doMXA
zA@rkdw{h#OYjoeF<+X<RY{20nHMw9)P!an~tZH&xYhAHVxp8amOXFt=<5cuK(t6Hh
zx(8UbKpXU#Gy%fX#l0=x9ebTdc6(303J3Rl$e2f~r28Xy2aC(ZMN7brWh!ILtDLi9
z*5KYEcYaJz0Ny@Z+6cJ6tLWmc6O};d<*yxC9VZR0i*97$2FTGRvfup)nBa$yB`bPJ
z0g5;jW;rOrH3Lf;K{*6+9f(ivcp~lQ?M($Yy&oX2H1WlE@v^Ue9WgK*1s<I&j&qPk
zygmjGUd~QTuI$zasVv*v2gZKT``7N>^?xX^9=DA>-C$Y(GJ6fT^%!69qvM$2w;|7i
z8`OnSH@SkvL);`NoKc{gjq{+ACr#wI2uP*hwYgmp=Ys!pmgNz&UoN@pbdjf{0T^cG
zAaP{p@InrbTlK1bL}(gu>V>GV$MKzWG!U&MNW*pRA=z~8opR#7CW3w32@7(?>x{S6
z|K7q9^GZqn#uQNmGMH*M;?Lv81ZXGKH7u9Aquy$eR9d1VWk9!cO%Np)nsG9#x78*f
z3JzBHXd|<r!=R7CQ^<nZP%!G;zwqqaD~TE;kn`zjpGY01=KPyA{+3zbsQdN7Jnz8g
zF*LSDNpMPiQug;pT#_f<HpY7ud1)HGj{tSzq;=m9Tvzs+vY~v3d@7ZInpcYgqB3Z0
zxU~7zcsMgZhq0Dh_U#Qj;qu86_QurQ`B7oQ63i~){oz*Ag;TPVGDR>YJnHCSQ(?GB
zxA|NLULZI@7E#|8$#5tsZeifD8moUXU=Y)m{yH-<IOlo$yw%FWnn+E$Dn9?Tlvg>Q
zob$S3r>D+8NT==py!IFGup@w{@#&E_Z=T`czA_B|L97LQLi{9kH1jFjFF5^_HI#TZ
zig40XAOYmG5VdCH`Oty$>{Fru3oUJJ`+h@YNNKh^%Cv(e*6!`=db2%cC8J<dOohh>
zoa|ZGh9^tWzwrC#p)Vfq(?1yncShA8q|ExFx$aV&JjbW&cHiW`GF%<-sroI;uri`W
z)-UCNnu!B&o)J+G|2F4>h%Ul~mj%#Y?k-rXaL9AI>T5UXXm;Y$W!kO}TS9xzuSQ_0
zdt2Pu6V78|ZT6uvAj|cDJsIEL7ndE=^Z1DuR!hw#nO3BOtTHP^{A=i>EgvkKx>`x&
zW0ws+?O74`!Jl6C_e}jKaf1XcvL0?)x}4Aj4qHkh;2UMUHK&SiS1-!?kZCNvRLYqC
z5)qDt>9;TF7Q9=_j%dn)I=klUTh>)>B}={im`4K;C8hdfDKk-I_lGN?X)QgvvP=;2
zXShr2`&;qA`GXf8v`y3R<DPI?7l?UVh7S#QeHT$}{^B1ezp^@cdiW;c-+cG~;#TVJ
zcS-a?=7PsK<*p`ehIw@04NKkBiOR5aDcmXZ__rH!;u=?|jZqWO6B+y1+t;}cPqXOj
z_)!cWXrY~n^4iUK<EM1EtGM4Rq4cm`95bBw*>`N=i!A1@#ZWz%Y9vOf36hI##D*{}
zHcA{ryfy@NVOs}*U%d=(tjT)&cfM@yUoeAHwyEQuN3@%*VjP?c)5+IVa=O)`fLA*?
z|MY2myju?x9~2%Tf<o>-!F&Su{k)5Zb!1A+XN2SR1WdIN&oGU1!>VfES!T~?{;pLL
zFkKi|6+}myFg$kK!x~0LLFTrAwx5NwAWR!Vjz}ELMo&wLx%qnH=utj5LHXw^k0_zQ
z1&1rNX5(<uZDTw5yvW(4g@dIfa7QafQ2fncW&n4wI+hybrH1kyWbNZJqaXajahZ96
zLJ?Thaf6CD?N>hNsdE!sa*T2>XT6qF@!`TtJEB9zz<k1wat`LV^5v{ghRDX$3tg_&
zyzIcGj~t}oDX4K>LW9@ON#PCivwI~iLH|&N-Q@p!%AzS?978{><M$G<=$;5QUgR0|
z5oNIeRdAar`>R7XCX4@w&<mV$_INvXvf&n<9qh(tfsv--26N@PMUtjE?_sG7Vlpg`
z{49b2#)NKEzJu2fr)IpIZivdKO&2{$qp=NJ-QV$oXS{YIz+Rg;6}rnoEidM!?kxZI
zZ9Y<{`Y^gDFgKn(A{w;>sOD-pd8^U8F0%2cp##XX(e#<exKbadL-)ny*-K_BJ=E$e
z!_bcWz`r<^z}FRk*O<hTIni=C0e$Q=?(7|7m+rGqSKjKMOPS(qmRyXoXB|Crhmz3y
z!VsCxzw*Td4VCDkS^cLimh6^8O$-&rXW&?HE3<w-1aC`r!0CELo|f*14zL@$x*`Va
z<ILO7e489RrqHy9IpaKy*-beMN5vIu5xi$y$AcS-ontP>H8BG?#JAwQm?Ih1XSd)e
zM1H&FQ5L!SX|Ab~rj$nPylFy(`{5(siFzOe^3_UZnXP5^noicyR}J@H4xLlkfAt`y
z<$;29VMgXVv0)76oBuMvY{N8~;)!(uZ;G|b-|a!^&3UKuX|=J+u$%+hnZi^u9UGl)
za5TOFN>;m_cE3&z9__9C0>S5;|IX#ML;A~VzKy|&U5pNE%f>{a<%PmN;I3GK48plT
z_9Y}y{pv8l3IMPH^RTLB?A)caesiYKz^O&0w@NSK<ZIF>kAuWlmcu6HO`yzx0vI!C
zf{}xU-PvwkwHGSZlq|`($z2|xo%mn|b=i>lO#pZ;maRy%u^HfeOGi7uh5KXz@m<MP
zko+Y*Mod;j>McL#fReB(4*mnG@Eq#@7!~{)&3!VFu{3IxTWYe<7@FJ?sG-Sx=xHL;
z)3zz!pngc^74C}(0mq(5aY&S;Q387gPMhBFDhPZGdvQcq5g8a7fA+ScpCFbkpuYY4
z=B?@<p6v+X886)hKV~)EIJR+LK)J_F?D|m?#BRIgGhAGXs*+td{NUJ-!*EsrP6g?y
z7sf5WMycrS!)ku8(Mxyo=(Tu`9*C7F_+{r=diDuv%6%E)3P=6JLVt1{&HfJ=W*Upt
zi)BI5iIw$p7?H7WsLL1s?k}U7JOI-vv({H_9k0{*XQ@DSIqR>YHcg|@<)$4*1HXAQ
z2N27&3y{?*z;qyg`amV_Kov5s;KK|uZL_FCUpKt^ZXZten~geNUcgmRUOy#NhzkX0
z|ANLHew-C$ClRl=D&aek%paNiG=z2<-c3s<IB@o9i`4XkOMHxq^XrP`@s7GF^sbIX
zM_ub&c|z5N#Hn$H``<Q|tqg&VxJ)acZrHFwSY^diSJM>3)N6^5>L_YKLFt&^b8CJ9
z5ft@1GIy-mxpP@Yb7QG7TWm93an_W_^hz9Ozz9*ktlnhFBNnd(FjMZ&FZ#aoe+0U(
zey#tdc>P8h7Ri4y^pit=jwcby@gPYbi=m42_0?$i)w_!Pj)rI7S7NoxXG9N=m@Fo!
zN}^f8&R|3Ua45vMuJ7jMqAaDb(A=ZTn73U`cIjsjnuYZj+Tb>>R9#0vaNBqmhteRM
z=!vvKhZe%K6#G9!Fnz(TK-j<Qq(Ez|0$N#h{wD}p8TEjLj)kGP^@E)yi(|gmYMnR%
z9+k01Ee}A0*|k3VKx|20pk`n%AQQg!x}Zpd*U9#t*ZZe<8sSgzajHR02H;gd87qOM
z;1_Il);#EPWAb0`xw`D0xeb^uj+M(X&x01~2+UIa{e?%eIbR<HC2~bjot(5Uj>Rc*
zR|*?hbD)HhbOZ-GOEA-CN|h)M_Sc%gk_B8rYHDV+rNcUbrVej@gO(IP?74p*_sZ@1
zw--Ln<Y<eIRP`KPBl{!lEpzK~LK-qjd#bA@lMUBDevfL78g5qF_6=lBjq}B|BDKW1
zSd_7Q&QJ2^MUiiBmfo6Wz;`c?LBvMFZ<t)Shhpd*g;DrT)(7YkOfWIDEFuis7LS|n
z!dI`PJ#in*Sv_FzN&fC6uuzR<av%vbDikcKH*A|Vy6YQOQLdqax6J5cQWPiT-`%T1
z8EVb_a%p)*>VyjFr|WlYvbikVGc6L<ZB$1R816@26=F9*y5xaq-ZM^2H`Zg?%Wt(K
z{4jU%M$+qlhOfE*>TY+_DHS!k>xSigZw{BLy>9ApBUhi$T?>uS(C9Uc$-$aMBC-M)
zI^QYa23F1DleS_40kA7*eqg=!z)eUFx2klaSg41)tOm{_kWn*K<tYGePc)xzC8sfX
zRmPEVa<mOf2(qT~=^nDbQ3*GCmxzbEnC8wk5k4Nc+In~`b$?z&^kblHY=mPW>O{Yr
z9S*9VaAON%GbeMMnp<$w!&?dh(3FFOGDyyUGfDII^eCOXt5kB)H!(AsyR231l4c56
zGO(`otXgfw##oK>gwFI)A4{2I3fLaUQnApX0>$xA@2?re+>$Z6)1C5*pVZQtW#iFs
zP-&CE)3N#3KmD7qW)xte(X28saN0^A<HjtPqh?8YlX-)3>KeF+QRD?I6R8wA!|g*>
zC-o`ZzL`I^Wg(Oguyv1|4b|UyR<z}HSR(jbqUb0o^4iyGq2!sU(yt6ec})3W%7qmb
z={k6r)8_frcd2vDIfDup%jEF+RTQqgzFGRjzIVoduJ#z6Sl)k3PVzhHEX%775*pfV
ztq_Q1=aZGcojj_b=gDZoPJ*;9Igw16XYtrC64D*Qw1l4OAp)HA?y^orBc(bCh~f=?
z;b_zbHXr3}dN*20XH;Ouf-=3qSQ~`qbig4_@?ezB1HJ(Ym#$*#v5HJtvlKM|L~qY?
z<3oKL)BK*?(#>UJ_5vOsJxy@})<Rak(KDPzrQ}bBFF1>75V`%2J}Ad;{;X35YFM-U
zgt5fzTM;h!Ps#6T(kAqkVtL*?f0j#t50cruzTnS(%suS3+^pkejWQ-$Pb*^4o9U#O
z9B@Nz>>=w=fd>+Ho@AcH?)dX3nwq@E)i;5RLXT@O2vk;$8L8r-OE&Gi;x}{bzotr=
zphQidR(+(}gm86PKE8H$HRut1NSE*U%}foeE7uD#n(M2xRR6~V5f5320^6$$ylg_g
zpJZtccc&k~e+mr&Ywpt8<Mx{$?AuJb%hc>$#fQL?3Ek~#On3xs@3Nks;#0Q2x>75}
z>BnvMxg3pbB+A@ww4l#fERDHd>$UlJcp+5&4|$nBm6C*V#)_nnAJIU^p;KMhQM+rQ
zZ-p7c-s5F2c&Aqj_>*pFw#LChfq?G?co{U%uTI4_KSdiEb6ym)8ltgGh+F+-l_Pv<
z7GEdkpSIY^eO}NwG#En@jdug+2U`M8@=~06l!ccnD`K!YAal>EDCJVQ)*iWsZLSZW
z9dso@yuMab&Rydt;&?_}ubVtBnX9F4>U#27p2>KX)c5?lUem@`g7>BhN5&y{h#0Cy
zW-sIbJYEoBQN9V0Z?tY87SalIvrl{&=2OtmC1}xQw;iH6+BIm}fk}#QP613u`{Ayf
z<~718ysRX{tJD{thaF!0Qj2q%E_X7w`{VWSD7;b0J-A45=(ZA^5wiX5OZ5%img7Mi
zYD4!4>!+bCuI3p?`P3bc<&(jXO@#YV_H~)1jC=ELkl-PQIIAIN9>Md-Hwpk$%Eg6i
zox<KTsRVjN07H0gu^9*&Q2*AL^l0^llS5;FGG!rU=wlQ0ZMTj(Z)p3?K16Qabvpcl
zxh+;4Yw!KJci-B1yHUZu-hZgi_pze?vvVMtq&m<_!0dr!gUf@fqR>%WU&V_MGM_q1
z3jN*OM4(5EfcacSTcGa!Or;iRGsL*YllGY$Vh;)$q`S?Vlm`86s@q)U%+bcnqMp{I
zavVExYNZR<+0va<F}tJfR1s8_$XdX93adx+uX|Kv2za~i3g~U!(s6Y`iq<q|Q2MN2
z94Csduyn6)k~jlTe?UKbN}-5W60DrfKUf0ZK*pJ)k>`wgE?bmkiP()Njw$lq(^v`m
zu_`SsBTDj;vK*l`K3RbLD~rh6b`=`&T-JR5#7i<zXF@Om_SUsi6GmiO|MNB7ie*E+
z@Y_j6@k<|i-yXO=R&e0BQGhfxx>OCh_5eY&w<F^T5PXN?1u#~D5+Y&fDE0&4Y8ktL
z?6G0#kIakFTKvqi8WWt6w;BmNd%lS`C>VwY^pzL`noS2U?(q6L_FDPHmbU+q@_7Z(
zrmy(KAoA>GD?S<#T}QIk(kI;8ME1<0(_8xZ7XFyjKxp6q{RdA39%y$ix3J#+0}>xs
zx>shKRG~Tbu+a(P2uErBr>Elj_5YzT+|1ZQe(YZXV!UB*rEye3b4ts##UE1}yeEqH
zyL-alFPah%+dmvJ{Z%tuc>dbC9a^Vab~w6nsSHe1ddz~`-uN(stA2Bo^MGEDf@&G<
z^_<iP*9!E84eEi@w=sWuy?M5^H#zRELyFv({Yh$ECLnRB^k#(+$AdJ5q+IP9Hs=()
z<Eh&QprF7@yup?5@S}UK18huf3tU7B;|{L=?9rrknXRGhI0=<IncJv6-*N;yJ_*mP
z$F=%qimjyL_`&tP4Zph112QF-IWm^L8*D;g-A^Afd&cM0ADS-;rp<KCiSRMhUAaxl
zof4A!&>VO^80Rufoku(`E(&Z7oD6rOFlRhi7~4yPJiDs7+bLW^=U(6wGR!t^r9!KE
zs{lW51|A>L-|!q!M;!`2kZghs1j$aJlo}1G8dgydT_eGv*9@eG28wfjud5cT1GkPD
zEm2h09967Q4<n83??<C}Pec(%iP*PHUp#6kR4dsUz>rsLcD~m9do9EDM9$Ms5(dDv
z$Xo7ZrCuXHg|70*w0-q|o2l%-VgBtSyAoG}7EA43N@}doQU*n!1DA%^NuFtRiMq0E
zh%jV;H*C1*jr4K%Yu>XjFJ%jw$7@UfoQWxMs{eW@acGzVL1x9Y#uj8LkXJIMq>GAn
z#>zLCR}PTi$5uX>s{fNh7_#y1oIOvDGV_!8Jd`IvGaa<7_XFx=+Q+oTsiuD+DH)#0
z1LX#QI5Syf`rH;nq$Be5xauiZn8k`+@E*L%!Fm{LYU{ynHa{j>+>dxo{5iP1KVQO7
zU~u|8vsH!o!;A}s@`gvS6a66<{Go$smo-i&d<o&4^ZPGVEKvny?$if!I6^m@iR9=t
z*#K206g1#or>FHwMq&bHht=-N)CMa#kfWw;)(^haJah|axlu(Z4cxibi&?=)kKbgn
zio{p2Qw2rbaxe0XAPE%%N^IxZUsMN`s_h5Nrtb#HcdWe7-hirV^U|tt%7jIJ4FR3a
zT$52mXO68UP`>bzGtjjIe88B0o)QiSn}s8Tf-o|jMg8)(*PwEPAdqG{ey{4mLhr_i
zFZrSW;-9GJ$2v>_ZR)(keNIP=*FUV0g_vpK8u`DKpIXbJ7u6`J+52#dKT2`Qn?-#+
z8+y&}$p-UY>K%TyGJmUUM%hfTwP@~LMjFuY>wWS-%e(0|`NBLL8sY^vhG25ZPEq&V
zr+d@$eJr%$Kcd_<2Vo2O-1C@t<Sd3J+~B7&lz>m{KflCVy{+OlUAT$VwePM=3MhE!
zj8{E-HE_kyRQW5`6@sZ3tu{PZRNWWpTl$*WvF+wUwtMJlH0tD9vRI63%WPzZd#LsN
zuz>0_YkemN#de2d%aPe}<?_!Ey8*Sr7L)JN`X#r@HwJkt495fm`=s!>A{9p4`ol(@
zO}`fYv`m`I>YY?>v&oU(Hwx_TZJ=zbGm8OFs#zS~ptXgPJxGj|%K~t?-{Wc4neQ=9
zMEO>vVB{qMQkDFPWP1j3_B#q;#1LK`95whEaG4Ofv_CYedXS&ic)SPg_BFmgK>qM*
zc)bDGvhqY_6FTg?h!Q7TDQq#{X^3ixB(}z@!(a#Yr(^X*&!?YQsW2TcX)XR%)dntW
z1~$y0w2Z?+gs0DF@muR;#xA<<lssHcmk5r%QG5I%BdIS&FnxF27YCZLZ~k*xUDpo+
z@jI1c6&5RH^j+Az#!Sqku#XuO`5K;I{*W&udv~=H6;Snq;?1xX>1dPy{Lu5tl0YcT
z!dJ|Z_9<+#%~NDN$&w4?OZ#i`Iq6&D3V@~YSK=>`>h9ut(Ph6|{IGs(_8~!ErbUtb
z0&0w{tfXOgRxBy3uAYWq=J-}Kd_O;O0imGezBgaw#~haU!jD=s8E*xkCODFO?!Gm;
zngcOtExDi6nfYT_p;MgE1D@x?ELIOg>MyQyQ{IAsEF2GJaTh?xLUUbbXFDJCfTf1o
zj@(<^aBG-|hG~1Ze}r-h0ePoC@9JMK{)IL<mObUz?}(0i-G82L`0dPv6K+ZUUY(hl
z1{?8hoyjV1>{#pTZ@dfs1B#6&C1wuQZxTi7mu&?6YTaVH8;|zAfK}S+GF1<oDgv2@
z_|z3hmQ~5$Ka_no)Kyoo7E{K753LX($+zwQYV+HN)hhGo*CnD@;;-BvI*|ue*o<5;
zk^N~b=2)RyB3F8xWNhI2m}ypIdzEDIE05rRE+6gPxBvSVni4b7%#B`SMI90KV})Gq
z;FiF6s3NXT?Xi=(7-0{8f0tZ)(TL4USUDZ`^lZ+Ri=$IA$G0hsP9e40opnwIR4*c0
ziSv+53iZC6J?xj^Lqe`D^stjFqLgZ4N$2fCKd#g3@VKO|Vb4?&NqoV~7k(F+xmbLw
z(7Lk*@6C7K-2r`PgT#D?KXvbOF}Zk%n#YB$15DIkh~VB&iBg>hyMj|&cKe-ybPJzP
z*#%5*-{oG`YK3ru1f!-R?iS60Za?}Ij}-87;Qw{e+cbf5JRq#xK<lb?T$PrGBc*h6
z`IIa2wQhroJW_da(BewuB65-r%&<B<((-Jsa=jLQiJ9BBlc9=p+Fk#2cz$JJgpnTp
z@1XU}nQFIki*o;5jIeV*b^D<Rr#zg#IH>EFd(XVDmUY{%WXMqwv?^hNj?_!{<%;>V
zuSN{{_>B}oj)EGQ$xttDxOBk?UtV1I{BZAq5Az+F>fp2rE%M%yTvq%xWhLa^ynawY
z&ZL0kDoI(hJcr#`t0Tw$J%%7L|I4Las7^A;73gDm^1H0Ok>Q2fAgEZm>ntIBP6(St
z66r93l*2Xc=)AYYK|t%6mYL?4Pf4Az<2M+-IqdlDG+EO7iufq2`v*z=I@C*DRCT5(
z%p`FQdHG99wa$s2Wei$H>Y8^s{?&Ycwa;@3V^c9y<mWvm9b6litu_Hhp}h(+E%)?7
zpRPXF38`?|Ysv5&!cwVqSm;N_WYit&)y$ePANEmjKgPj!c4Xd^rq6+J_|;&B>S&dL
zt>lZhe472A3X$jXl?@i6dqS-FU%`!+^FErDPS=+ctnVk8otF6K0fKmKjbxs72Q<IF
zwsdUSL_3j*?S2;M)8!X-X;^P^8P_Lgv4#c30E$Xd`FD;~L2G>RZCL^UZ?Z+Aj|n^@
zb<SJ1^o8z$qSvvEY#fPPrx!K}1jTS|Y5bBPH&kGIYW>kN&)LA<H~W0E5?M*!X&4UL
ziM%W*$Zd~BOlX)&sne-!nL7wiPpS&*1Ty6{rPSec`@%(f9(p8xA@92;Tr6g6Qml5F
ztfR^>Is~rYN)uo8Hyvw>+&47d8x~f7@Sm)hLhb*Jt!^jSCE=%qVmV{0NJqyFP>KM=
zcUN>4s8}7Pc{~rBD#YVIYx?!3QaLp>Np5VAW4+Owjra{K4ym;mS>id2DAOItc8cF0
z^j}b<N$LtMcBpi|Nd=W}wKDoq?Yc{8DzF3gx6``TUU|>?C92KBUxw0)|0%scXoT^3
zD%xdl=`WJZH7ZkG;$7l7R!ar(EB&NyGYmGym=ohEbna71e01x}O_o3wFzPOAV+xfQ
z56A)g4X7I8oVU0f47dXLNNmNOnwdjUhW2MC4-R(JzhW01Tx#>-;s!p7_e{;IPR&O%
zbu9wTC^YD4q!#1WOc843lE`N*J}xJXCOryj?gFb`vLhSenbo+{5~3M;72HR2J&cda
z2WDN0M{hC3W5fA5cePG<H{S(RnPq+*uB5KGt1)I8=KP2Zv|nO#|8yqZ=R1Irg-Yt@
zd;_<>+3`%@!<Ju949y~%=_=+33}g<J^&p$@O;V@n_bxtq*3nRVSWEJz#7UrCDb4Rk
z8vWe*9b*xg(#1}QqSL7(J#Fg8m#*1HvJI5RzejEMf1SPoe>R~`yEx6-gT1MmMAm-n
z_H9#U9quPnHcRAA4-6`woQa6J5w@<}TI3e98X?n!*lB0!C?D@tVVqKEZu*oiZrS#W
z{>L7TkGF)!ZrR9uT8&HkFhwtVMT4nDqL7G9kUj1Y9alJ8Jz2X}g)uaKXoQ}-p5oXn
zdE7(1hH@EL>iJ@Ts{0sI8xcqlL^&$&m7|TXw1L0%_tP0S5;U$!%A<b1Qpm7uv)Z~}
zZL*a7w!o*8g#tkN3+$>?*V5tPa0K|Oqf+jH@^5iR`I|aYo=kfGWWO;L99);uCza+c
zc|qz0it{kpEr_}QV^Ysu`N@l_VOs_noGX%E&&Y6ghOhmnJ?C`RBZ$h(oI=RRhb-OA
zO&1ShCcTvpU`TxFgV_AquuK`8LHpZ<#I(WMJ7vmAK-YdHXtRYtfA}NQr(?h0!shg2
z`^h{roOm~hG$yX49YIVbLXAGRV8s&N{R{D9JNiBDC_N$>U8QDLq6mrEbU)h&yQ~2p
z{TO+EVRD>KJq`o+kbw>J)=?(B{?P+)+|VGj?n*l8-_5l3-&`w%f}$uV$OyNY*v}=m
zWM6uvMDl?SUskt1R)OU7)8`dBKSTy`@<vPk6kQBYhg#N;@Kv*Vh|(oJeYMcv)`Dxr
z4Cmenb>#8HBN(qt67F=^2yrxm*17krrWj40j;*e~@@&AW(PsJb`)&2LbFhi6xml<1
zyahltY-7ra^P25bGlr+0Dd-?Q!L|*tXL|KLaCz`eA9{a0*^A8Yy=^h|p+jqgnuUKW
zD6R@UqR_d2Y7@ewitYDXaXFIi@J|HEc1xAVUzeb}CgfY@z=Sj+L`CR_mc=c8s)h{T
zz60o65S}71+Ns^f`+7vL(8d|Q9}64{&`8%Vj&F#uw2)&f*Bo1ML6!ih=Dztr)?agK
z0V}0)bj)9Gf*C@Up{IpFO(dP%*>1~`K6t<e7TYEix*kN{36I4&9EwqwrTSrXvjPec
zuz5!>XjSYd%*6f$lBK9yYbOW07=7}X<&p1G$l~>>`H+`ENYx_9kC{i1N!C=w`iqkc
zFDeL8xJ`_yMT76Y=Mm9@?w_ntP<77Iq7n;iAbPb+Q8C%?r7hju>*kS7g<snAv+~H0
zLHCzvg`=O$3mY$A{?qTgYb)|pNc^{;QyHwjWIzp(ag*hu^h{BjWTSCmBvju;Z)6ZJ
zUwW`O5U$1Od);O6+zlK&239U^82+1FV#?S4!nJ2dOyA&PgpNlN&2cluQwGIf;?fx~
za`9RWZ?0k}gxVL2iaLa{uN<cGUG4v>EHpJE=LwOdFXY<Y40|W%TVc5z5POmqDz3sS
z?mppZg_ogV{y_QrTRdP2j-RopAL}JiDb8ti#$eRBrAL<Js7b-I)dy&LE@ic+V~W9n
zOaz3qv+0K5zu95G;-o9)Dn`r~H+P4>!@jRH<3HHpU!MD$;^L&7$R)=ifonBXCyCuN
zC-$Vfi*bj&zK)DAd^ZrbvQzq!SK>oD=Jo&63F%Ow99OO{6KpyVxfb{Wu6bO+%c=r!
zX87}XYjIuc($|`R6CX^16TwawzBgN57HL8T(3L<Kkat-x*l*AdU);R;w9s0)z8HP?
z3Ctw;i#6z6OrX6WaITT`gNuq&Naq2cDqX+GqeQTe*Ib=tkEmfDG<VGn5!BM6<W6Rp
zqZ0TW9F2pVetxt2PW|7yG$_%2_|FP$&2-$R-dErLb-S~@Qo7$}PL@S&-5LAeqfr+q
zvpZO@!F>=px+WMoHr#PZeQyc3$_YG;M56K*?j(b^j_m30H*#(%>e5|K#o|sDVGjpF
z4{8nyr;pHxBk$n*iw-3G{O$(VB$>$R0k%ff$xz|u#8{9n)BOoE%;Bf88g2rq?ei3d
z8Sbft23G=Ohqs(z6Y?V?^yjz@XXygzK7I>+pU&kskk2w1pSO730_;V{e==eeu{#%D
z0#mHvJS=@(2ktI)yo{3k4UCpMC)WbO22AKx=9F+`exMBDr%e{r$RjkzB8+qnD~Pae
zVxXQgRK!zT()r82B~zR|iRoA`up<8r8RTc;R#Z97?0cVl0h2?y?d)zt)iHmQERX1*
zdhhkm93p?)x;@9Z>*JJlPv}ql^GTRY#ueSgxeimdz?yk!&IG9k-^pag$>vIWWIp!R
z?Itkx5h07aZ)GAy1#+Z~EU3vY?YgrhZT$VLv1G#lvlu=^N0<1sqKcxmuMccOn$BYB
z@QPlqf)JtRet$GXt=bmgaRAuzP*pEgUvWjW1{%29X78!5owNZqm@l=0M+<a)XK$iV
z>s`4!h*z4jWx1VHhbZdnxHYwHfyAt4y8QVur;os8PM;BCy_7xapGmGF5gfv#We$1a
zdxR@w+sl<l6RJ*P2YM4Q0ZKxZ|2zx+Yaq=wLJ^;%!-9{=&cgsdga3}*rk{@8U&#s_
zwV_P?$$`SCP?dWBMRV*Me{x1)!Ate~9a+BMJvTI;3(?BZvJ_INuPWj|HpY)n&<MlN
z=Ukq|!6Z}plk-IZSv2}fm(vx)Y+;qRh$f>YKf1;>8NyUUaSOJuxp)%E9n^}d*DyZ2
zv%aquL7%->nqe^;>9JUba!-C`FI<r+<r9W`$F@6cy?c`HH8Q#|To8?=L>w^m9jAIk
zRO|%+ZgWv!+9s7Ko^l~mR$Iz|S35xT;b|X0bTJdlwPtsBUx_H5Z=YXZ`pNN;`*ifA
zs_PPh<P9KE0jHGltCz6l3(F2wIT>G=Lx#-TaTA_H!zEGok48uXSvO1w3;5GT#3DX)
zN+)FCs<0?d^Q!wB*sWnDDdbIxdc}NQ@OH~GRT|Ytt)IJ5^JJ|v-XD1ysFPU$B3V9E
z+h+O<cGW__Lg~RT^mKj&c`9STa%>xtqW7&txl4=<`mv^t9l$iV+qG2g<GQPpf$QJa
z7xe@%)Aad4Pj980zZZKpJpkUsFo4?P-bRI}hkBe7KdaaSmJ}LL)T-(p3TOH4HPbPc
zS%e><#Cp2(`B8IFAT&yPUi6%9GhQIdz0X&pHs7O2QYI*mA>ar?Rhj|T9v)5?zHY#D
z7&XuP2QmNq0~~{s6L9|VG6AmWA=xX=i?b&{adLh==td6a2&fOMg(_v{2JZ-<3pm?R
zX6TaO0@QH^GvdZ(&A*;{!L9`;cjeo;a3?x@ln8wmcj7<Gu_87<4DM+fUY266h=U&o
z1m(4X8^)aS_&k1#i=N1sl6`4&?mWGBTJYOi>pL}CzA?QT={OM^M&F<3Jil!7*?f0}
zUcN_r9_}}t(g&}J4Ub?V4!kioxVRa@^N!oifz5%AyS>fUHa+D=s$7HS%-4Cu&%d}V
z#?-GLvWC}~TsYh@H_pR=F@sQv2hjuIhm=TQEiNKEoP|15o?U{)1#C6eq$A=2lCtjR
zr>~r@p2GCPNDg5ygzz0Y(~IK=&Sz=>q&m{&0KA_QzlG`qL`pX8P)MnD6-A6{FcaeW
zh^rc`sf!-;;CZV2s!&K^1RQ@C0SS?{aPI;wrg8Egs5jPKHBjG2s^}r*r#kChoMz1)
z-hZ)VKKDinS2+n`dV;9{jH#*n&GQK*0)!tFe=Bjy@Tgfxih`<LmcA2i2b`bfEY$DT
zmA-`Vp8W)*h3S<mGn6#00d0r<*u7}eF0dRKf)a6lS?wLz-e=0nNWxERbknxdN}H8^
z*8jk4+V8}7`S_wL6+=3hW?e0-pL)AT<;9V|HHUovtGHYYnH}A<xFMyNY%L_43<s4y
zlCygnt@FUcB%o`64cS(QX<(g_IiLW)+UsZyw!P8%EOhg|0xWYanCrIKLb)KkeQ03}
zs#<&12RbmVcScj%iK3nZob3-Jm!JOokKQrXo_5&&!+<UpuZ3vn$H;NyN`cU?1t_4<
z{k7TsUT7S8^9q9A3r1JKWN*XoHG<FX1SsSZ4*>dCjL^i6E1+j}8MH+GkE?N+0`>7-
zgjsGDxdRkXayx=4c<R6NXUqXt@T9=2+5nXdVd^C9laH9<uw;3V!gXEyn)Lg3X7`9?
zo?ui3S|p_8ez^nPuz7@TxOcfq>_9JU-rwC{2d4zz$=;9AVc+N6-z^K=FWql;@Z9g+
z-!G@!58PkMrgU71-P__BW%wX;Ft_-i@<_@>ru5U58TXSMY+~y=g`|Q4bg2BQd9-|0
z3bbL#+(f4oW=Y_S=g5e^Zfq!O@4W#JDq}!n&cJ!eBVK^f?(`sITqnOdqTenjIXw7W
zX|pT%4t=^pb|*LSaI890)_5Yk{T`CF-XnXhNegm-&<0cm;Z{ymoBJC1;;e9OE8d?*
zLS5&MOPggHToL;RMQSV>+mS)@NG3OM0uYq*hQ^QmVo>Z+(bMVal9yTljuzXT1^=BJ
zTJrC5>^_Pivs-j=*xJC9Gd|<inonMk71;t_Lb8dVmb;DFgSt<RWK<8kZ(Yat;+NEQ
zn}VE!PfVdATk5WgVcnE`6oOz)gAA^KDL)QxS;LR(^)?i*8q;82yk~zeK|?b#ejUW_
ztB%3Ztxnm@3+U5hvLKCEy4pk|aZYzqT~bR4c!uaxd~urs5Ink^53d9yDUfiXa##s{
z>iS-BM_VJRn|w?W=9G5(o>`FVg}%{_X%FfP;p>M6=9XHPdZcA$e-bK6ogGhq=aYG=
zBCEf(godUoX8)Ts;s2ZWUMGO{154<B&FnThGy(X8{BRDl=J!YnlV6>qzRQq?+v$#L
zJskd_ujp#_d*?WpW2ugi@3$N;Lk6Hf0W%d?m0&8DHL(ezTR_tPN7GdXM74G88HP|A
zVWdM)=@6uAQ0hv9bPCc8-8p~)f|OFyA>G}bf^-ZpG>pVBbmxcnzTdy|^Ta-Dul4LF
zu2nr8n%9LTNF9^>_Mv=pHPVdI`a%M}bt?X+#YX|x^mn1oOW5JdwVmrY0u49(h@~h3
ze<B1R@fnBX+WoEMt%~_Z=4k<e>AmFr(7pP|d}d<cpSg!=*!Yq?Aope#FdHIOi-MO~
zXX5qfHhN}#jh^aarRoV`;?7hh*Ho3#p;kx(>0R<pmQi_ceDZ!tKV9|fibI_F2^TZ$
z+YvnhA<!1U4k>)=Zl6e#{h3eDtz!p_=yGbXzC~tr!XGkPmhtLXG~9d?U<ot>BUtBg
z>T0y%wUi8$)Jev#7z&TkF$4qIZOE9XR*VHK@*p8fTWbkGd(a5()&NP``QltF@<i#v
zE=Ll}Y7cz!Wi~QN48U-h^A6>%qzaSg8rz)eVDJ0B?|tF3%r1v7OMlr(G?Yao$q{Pz
z=G|~IXKMR~@b}Xa+sSHfriWm`S#)|>$O~SVK%)jTpm7bQi42{C5P6}xWKnOV4&lfv
zAIfnol5<tb?viG5$E7X$X#XQpq@(*~+319EN$Ze1w?5zO;HxRi>UGbPP)Uw{D8^3G
zBA>2$S?-os`)t7JK2bv^`Y!YLQM7*<qo)gZ#S8d(5{64C6l2fI%VgQQhj`4vDT1E2
zV{ii>-fiMl=n}M^TCP0%fNxPJ>zMdJ=5i-3PpOtjFDHBxANR=0il~VUMyIh{<+;g0
z4ai#@%23&|Yg07G{4#})0G11X1;e>Uq~;(0x(7da60G_Y=ui$_l8hY{ui?U~8kCqM
z0Ap0bwSF@10p-A(vrZOBQvdy-<Xt~f=ENNB`}9zE&GTmc{;nMkJJ`PwyjQxs4mjUW
zXumSPOGMtE7~g6m9d6+FZo1Wh8&TqN$fL`VpNi0xUvC^3hHI$>2b&1o?^n(P+Hdyn
zPBOScTLwiQmmq)weuV-&Uuh(Zet=}}1<&p<e^>2tj7q~LHhbdU66k9Fi03Dwig^`>
z*~b7%uE3%Qd|uIMQue}W(I5p+p4Wiqc2<7J)-k26=DAfSiNLoNYod!rd5k^K0F?Nt
zE66?ub4FFOh;2HR-%``O&vRt%;Ra6cMct)kwaleu2{kVRCJMuZEHnJhDrO`amrqOg
zjrn*;Fa5yD-Ud<{5pLjUfv`7hv@yAF+<rfE_ejP3y~BIA8{(Cx6|4Q(?mlgMV&m-y
zG@UmMf?OD6&jO8Wl_&vU=dC7{xr8^<jP~W{Px=qM1~Z6jUV3Q-(mI=$DuEuwpNbr~
z&$8Q3FSpG{E&37oK9dM+t9W<<ku4>Dt(QM<38c%W7i>Sf>scaPTn1(EYEGaUQuGW?
zz9oKrxGO(Sy$&1EY#l{;irn*cvnE(3R#;Y;@@Ly~Y19IYPkl2qDVMTd^?!L|agt$g
zjBdR)x_BdO>{iqwlmIb@K#$C5RmW8*XP>?NbX;$?`ugl<qz}jDN{!h-1u)PLb3e<J
zf5H=W7ckgAGDFaiQH#PxS4KoxAzCa_mDDPRuf~%%LF;=nfJorfYL_p(FK&BB=F$rF
z%2Q6N{1)F?XW0}G<-Ty>f8F+>6`$&WPG*MUQ~oV)O3?YF@)x44Ql&+3aUkiuz%u8@
zR=t#LPYMw8Z6^(+!s5ZMbkl2%)Jny`=e_Ix>m1R)+i?6m^go8j6y-Q){X%xeDjCvp
znf9vlp-{)TxukaFOPm%GX3I`>`Yau%a|Uwko3}zHFKB@_z#3n|aX`jJ5A$Fn8KS@K
zrUc!OGCEE^I^w?kc9ctQtbTXm;h%p~et%`0c)wqM?|oUfe-RaQ?y&TXf~&JmH)F(i
zz+U?PXdw2;*<`oP&wQL+WnGv`ZYH~*j)k`)Axnn@5{9&JoWy`9C7=P1$g}foL#am%
zYtnKYE$T3mj5J+3xeP*AAvM%?Gp}k=jA@h=xu5D_Jn;&Q!(`i370+jhdHXpN->M)f
z%9KMd<Bf5XXT(fr$u}<iPXP5Mfr?<4Le}5dn9;UZE#w*VHGZ_a$K!!voGg13&=g#;
zIsbW`c9tZQ2w+R0sNFRhT)8~y|Az(Uv~iD#eX%wJB2$C>h7k1@SqK^?D*pq~%+L}y
zG-6`{=?ty1oY2e__6NFVQb2|TWV3!&La!Z_7{c2Iolu*(6ZL-{1ZKKL&ILa7?B=a7
zH9O@(2p&su%kRmpP^Z`VK+|UO`4M4#96KsuhQz&AZ4;jg+OW~Pl}`&B_{wQgr&q7x
z!7nUc&(;RIzdK~_U=?mZ;aq?V{n4k_31jqi&T4AbFSFCfma~z5RNx@o0^PkSN}>k2
zEor~O|F-LM7*TtZ?H3B~q_&;h_;qw^x*w~Muz$H-<C6ybQnqElH|Bl8)n(3pE(VXW
zll!|wM2P-31&Ba_Z*ok)jRlV$J%(Xb$VwH%ilhkux`LJiYoE}dc^3EHD=&h|bU?W@
z{ekFMJe+9>*6#G{XoZiF?L)O`$~9K~6`-*^jMc=j<0BbX&()AS%4_Y*>AD%iPQU*O
z&R_(->dntv-;){rq0zf3m3ULZhWqIKt1{;wi<xw7f0CVFY4AZWGj4xmr~$eC`zKv`
z`~!l47CgQ8{U)cO0mp(v_lI%;@1y98WgN9=%4kLXTWG3NCcwem)i^|hP67_7B{RXP
zj}SIvmCWKMeL+aw%%U4mKjqJ-HwUX>JE>|xZ{AAfh-({{QhOMv2z_fHNkDKrd>Ty?
zTMNPv{n#mS+c?S!da_k;%)vw7oA3G7?Uw*_JDk-mCYBW?DwfzmwUU~tq!HomhB`;@
z;vRQc=BH#9VdL&(b{Czpuc&Hsge4LTtPFnj)fvvi=@KfyWL!HkJifIEU@pmdzrw+Q
zB9x5MCQC=u0b0qZvjGX(nQ*7PQ7`GhC^?}KT8q9z%_)GaD|gY$i`qh%5rBo}=Z={_
zhhOhB|CR|Uc}{pjC2b1BY28N@v9Fo_TEhvG3L~@LkQVV*v)H;i^ymp%CCzKRe`Z${
z6Q-A8HC=Ww(y=HuUtiB2j^i3Bgwgw976yX4Y@t<yUkZ&mB_lE)k7M_k7o-6!S_4?S
zdS*r$!c!L|Ovv|~X=?Dp6vZX-8xZmP@wy({L!C=gYjNQNy1J!N2B12hvSuye?hb@w
zultYTe>?v)%Rz^~hxQ`T9|cACYv}h`MqkO0Nj)N_HUZ0r1Ckr0)uf*Q6yHLI0X2tr
zfb?fGBprOt*192{7*(da0WG0!CxH&WXIdF><GlMHhm={f<Oyb?YqfU*+aAr<tpoPz
zPGsWP06qri<5PGd4*DhdxywaS@gVd;UBo&^v=m@`*#~be+clik*lWM7I|{h_l@XU>
zbdv2nU@s9pOTa1frK|?&H1Lh!dOX^{#+Q}wA<IyED9vN>#iJo5R+R6Q$@Gnakvbv5
z(okjE$^)`iqY+4N-?A86V4Z_)-6-4#e(2%at~pl-W7yLpwx|8ghTpqplO)rrzDv`u
z-P4<Sf6DS6%XNdKOyhpjn6H50XQcHO#v#8-gXc4j6_LqN{?9kBGqDk_HzT50p*geq
z?HJyP8YO8fqubus5g3Na=?e*d#wVu0WI$PqY-hPSN@1NjW4<A6DXKO}v^%FG`ba0R
z(#fF3ik5IeTyUvD0_rbXb-F@qSmS5t#++f|PIejYcPfNsUVRpI?>da5Nb`wQ4aRgv
z8Qn@Ry2cFH_ie*|8%FvH*6S9gs1KVqVfKr2Lu5`ArHKOQH23q<6%f5|PE3_Bmk1<A
z4ZQzp+)`+Fy*-_3{C>_!@Dq5AZVqz!1z8*@N2WC|nAuWAld83R@jG9U*X;A$h~hi$
zD!Z>#Hemy}?G3&KCmf00Mqqp=oYPF*YeKz-Id{Fp2)k{<nu>qmi3r(i^IC&{tc?q`
zwE1p4>t*?E<lQmjqxQM{vB@a2-|zXc;(uKem5Xlb{x<u^@}rszKAl4js{EWZ%;Vox
zZ1jXQa`io$YsEJc*)%|jzB|l<sU^WFYKw96!$;VmMv9Fmg`2>FF3q2(fYIGQS8Iu_
zcDEr@wBHo(fAZiV>VT=U1YD4(%yeT7#=l?KTe*ElO{zI9{vt7trd(+Gh-Gj2&Uxo+
z_;K-X6VZ&C7l1D#UiU3)=_jenggps$iO*D<@O9@WF-A6R%Y>mFzynLj%J!&#o&VBL
z5z}kOIz%6xw5Cxdc?=ufCQt|S$vNM%z$nG<%;fd@a--IiE4rx6cKjJycVGyJaJ>#h
z72DZD8Y<}L+KUZ|LO^gF$*pQ`I)eE_rzPHMl+GEKtCrV<31Le=eU0h|uE;o5NClW|
zd<sTAJU~t0%D~ueROBi2%)DJ{?vCtGBVjYV%IL_EasgNa6;c7V(r!7~3x)Vl*1QvP
zSDyB!2?@7W+YMjSmR^cM*j5<t9hDww-nMWfG8t91bSLk84MZtwR$6Obg<otpeQ-=1
z)#wx+4Wjid0UUTNVH4HgEFE;>V?Sz)azd|B^_;J7O(;xrn~g=ER^y|-?9NVk<^L-p
zIpuiA{_jUrM`#L)*NcSdL6XR&fcQ=tb5~PVoP@qM@W9CqyzBuiOTllD#DbSfy*{1K
zU{FPN9Op*^_yQuhetv_%Tw=n>F2TlNn6r}$LY)3UfiN#O`IK2+GYkCrTXq2{La++m
z{SUt@Ky<)v_E>>%Cz0M0vhu00H#UD>zu;~wc#t(}crB_vPhWfUJ%QXdSJ+v$?}t3e
za&Li;lKcELMK#5a1G0IQpg~9Uc)C6;6Quln)(jfgi7$*|RGIFK{bs%HvUdJYBxsA_
zdujWr-MfW6a2{72+Ggc*C)p$q&6E|eZj!bY_M%P=F$GF$N{FNChn!w@?iz?|a~vyT
zeepfW9ojyTile}vFo~um2k7FL?MjPC81a;#kt^;zGZ`8qrGdWKK1WnedzcW-XX2v!
zCzQBrO4{&2fcCa|Vxixtr_(^Gw2%6q*M8v_fN0>CH?D?dJhzd@c2GZy{kE${cLH@F
z_q=rT(g>D+#<Op4er%-UE$X$eUdy7R_PIU27dz<Ft9Lekt^XS)HRYo7KO^M%JWORr
zz?>5E0p6pb;j$um4TAY<YBLcBtOC?zF4nt;Gx?C^R-tz=gP-SKb+%uq=O^q2rl;zp
z^K1*besaOb!M)+WLxMujy!J1)%@&pHH#sn$P}5*L{vz-hm(i<-IAbInt3ya=3Tk@G
z7EiGW7u@GMb!tEGQ*~J7u)v1L+;_NM8@P&o_DrLh0tN#5nPG7Qagi9B-zNw>-@^-t
zWM@}oKMd9ezML;y1H5zVU`zZ)fq_#suVSKHJ_?Y-dOMvlABh$=r3Nh2;WOAWL$q$^
z>w;;NQ^R1I&gM>>w#}XZS*EVc%~XduIng~KQ%mmF_rV<bxM_?Y8vVbb)bK|N0Hpo+
za?k7sXj2uiQ(;py=XWL=2DW5CsX9)Ll|p-m4hOk@u38u2xD3x&5px`ku_%AV-<bBA
zR~_k}am}ptnf1X~3}3_!e_Nay1LxFkm9uaAOfui<tqHtTaD$a!z~o6Oy9uph*It)3
zm=0awn|IQQHTd5ib#?=VYdMzb9Th45<rZu<{681OE}S))j8j)&%ZB)SiUM-65%q|f
zh6sH6iigDU<2-xzi&H6V$dtWF<2EucK_~D^-LG`Xq#i}sHDMh2mM@xptjeecFQ#YM
zbEAJJq{)>e3sse3Sl4bnQ``-Tg0Vq#z%pKWg%gFxa%gWtYiYuhY3}FKP2J<roTWN}
zE}c%Pc^pDfTU5>GMJpT^Z2hSb+PJf<tPQ}+6+2o-mfBUqWZrq7*!lCRwB%OWsTCkX
z_{`L!m$v-$pe8wam<;u5oRKD2DVQ83Q_0p6wLK$Ba{Gl*dgDVCJ#2bl6uK~n!2a4>
zNN4}?{-3sEj`+1-^Iy@vA?wSsBtM@huM{qXoouu2ANwjpw%ze+WXK}&N~7W4Sj)TK
zf|B`A%&wiLPX1t1rN=`f$x|7nl3#C|R8l5aGQ~~nK9dF0_Q1p@$pY?|bR?XAmIa@W
zCz?7kS=e2a;F=W9XK*SkCx5`k3jQXZ$tEa)UZ}Tyo8S!5ayaj{Lak;JX$SZd{YAxh
zy#7B?Lj1d!91%R0rZS?RJ;u=Jm3*b0V4Q#VmVL$urM^w>`4^gU@PVsFhmT-pCg033
z0W-s6f-YKA2DhW8_L84$4x=8n2Y%ddx`vXjS@mPaU&Mwl6~4cD(-GHD$eHV!yQ}co
zDE!^Q_L5K@KyGjYrG%rBcK<}tk^vz1+VMH0c>YK82igmn1U5?#HmeC-clVvzR!6M~
z33pJ~CzSUZRQy3~{P`1^CZs$QDr?M2m<AJ1G%zsZt7GBqTj?CDj{G$^g$joh#M0Gl
zZ!wen3LMgMgy+8}_aIcsM|<yfE1!unxCo7218`Y}cnO<aQ)%(>HmF{w;ZY#clTf}v
zV(i{)mCqx~qtVe{jmlKmT0X*gqsHB<oTk%#Gq6F3Ghu4i<TO%GaF`o~=p!7nof7$A
z2O$&6DNxT<a2@d>T`!K-)^e@*j1>^PiIHr-n((I;pH7i-HVh~^v(8h82Io(Dgl#6v
z(S+zd9pZriZeB>3@s=cJH_j1aqpk@pMfpUp5aSVD18-vg_L$xh?Cr?^rrI~jBhlAx
zimy9Ob$w3Mgpa$XwbP`Ir{gUSWQ9u>HWJkH8ATtF{7kZ*dG<rgh)=SZ)JZE-8bHR3
z?qOi-^{2_U+1Y%_%ph1(lw>c-x>4;ot*J-fq2m=`1d|i|<FqbDgZa5=L>S>t6Ws0C
zjq(0UIDT7JL@;|1IAcY>_t9sD_0OJTpWi!C)xf&8b@kzV!_aGg`~175i8ulhoU~>&
zC!np32H;I#+@v*mWm;X?i&PIWIF4t~7ksrEn`3^hOxFja*~fm)s|Oz%k3`1i^g|g1
zN;u1T#OL#M<vKYu13j!>yM`9ci;ak9PPmF|{rogZ<H5t@&D<<n5arc~0Tqv(E<pv+
zDqtJVUl_D&t%QTW_QviaCYy4!gL(7;D(I8|>~OyyUlZXjw!aFH!uolw8&676ap#}`
z3xw?TgoIk=uZU}cNdh0OX|{78T|Rb9Q>J>FhHbwrj4`8eF^}$Y%kL_21jSN9M?*f<
z3|7bC5?K|`_s?67`{1JJ@X<(HwU%EEF5^3T;Km(%?1{YF=9s_)cc?*gVu0XyeO&(U
zb2Sl@zr;{C;Q#Y@S#a+uPF5{qS(_B+Qp>p51s!%{_`<DO+nxIW3Vd4~L}jnpl!`ID
z-aDML4nifHNyAW+l34!?WW<A_e1EA2mUb6Byk3c1Dq>!oIOlT`0Cq*qfKpwjCTE%G
z@+s@wgQL}Bi_IE*<+otnaD&-25uips_sVB-#cXtmH!yG9Kd+Qt%$y;tT75E-pk_!o
zlu11pcisL+-e%R3>PEQT3|$hmrL@pboos+%e?cpL+=HQm4#Lu*NM1=S)7k_Ka~D_Y
zr1fuT5A``q@EQ$@4ANPQvov`oTxgV8)-_uf@dz*@&}uLpCa6kM(iYtMzW$QU4>x~@
zFe`^`43YV3cEpy9<=b%r+QK+AhYAGg^+qMW&(wbEDmd*^w7qUeE%P;*GqVBre9npF
z1gQg<6)Gb<-afA+a{67rZh^e@DQmQtj6&9~*|9FHlE{I0run-@JSKa+72%fZkL;iN
zkw5P6E^}<C<sUnk(!eP2X@P0sKjjcVfaq4r)le^$E6xu*|Kru>@;a=t?=^8_o*G${
z-Hner^fxvJczGQ$%d*^LB|O~Mk(<KvZ;%&x!GGJ*PLP&IwZb^bs0*#nXDg*`BmGjr
zJi>61uwH_^;HUzK_yOy{$IEAn4GFmBO{`r_&vIA34A`F2pn6~YoPRg@>+y&rD@}Dr
zs(OSc&{0b~SW9qT0^DNXVM03)^N%$oR41scLZ!O*_36}{hV(lCwv(Xbl@+B10WEV~
ztAJSB^884Nvx*AxW}w$|D`tcbN)^`R2{$yiLFY&kG!UKV-(n~Mp>JyFO;{_j8a@`<
z_&1?@vbL@6je<vu4f{}i`1&3Z@PnY_i`6LII?L15(7~ImV4HI$ln)d3Q(qfCm|W!}
zY`g7HFc18E+`*#sw!V@J`?Z~yLC9nn$5>uXT7)5&SE@guZ+&xl3sd+VftlWe<9I_E
zv3T|yBf<p!gKoD^7mr2HBF-1{A7S@W0?d67&zL23XX=PbY(w6doCyQYI@3S%9+}Dy
z76>%poAmh&SrXK(e&h7=6GDaWzr?nFZ-Td_>>AboO<Hn>A#)z}bLh$b8ZP5?{ORRN
ze+Q0M!wAQcUp>vHFLQ+vc;R?I=R<pp)_s<p_NYjDn%bmlS@r1Eir;D;{5-dhvNUaS
z9~|NGPb90nrQ2V`n#=KjIN;}e$B{<;NK^ix4~nPmE3B$N3lrR{8>@CE?`$Q~Q_BGa
z8Q5O|j2KnbsHn-pelmQ|3xWdskLWW`9>M0lPmzUi=az(I5Y_mj*lS7z6!qSTR^Q^T
z3AG`R+Pqs;_4KmZ&ZSU8^T&)*u6rH?WSz`0=4Ow~EGN=){7_COt|#SP4vWOCQxh7=
zWE#7T<C9#x{biP5U^*XCDmnjAFjwelerLR!VBQ+WZh&DPYw+V4`#7b>rY3Zds=j?T
z6tRHBnU2zx9BKNZ?Hnyo&N>Qt7Zq$OIOrY13yW>h36{4@<c;>BtWQ=C7?;^0g^pg*
zqBz>_W^mM#2l`Jq7VU8*I+D#{#-hKgO0K;d&-lYHDwn)E;sQS|d~tsE?bdEA5*4$C
zPZLyZOtb^RFEcejD+vWTjn4D36Nx{+7%|#0NO^r>>eo*Hw#yw~On~vj>}BzVk!hxh
zDb%zVvO9%iJ!Q1bw1o4zplc;4-0IbZ;BKD)nPH|K{70E%>Iw%Rn;o&qnv;M6_Kg`V
z=<HpJonJ*>?I^QNW~~5ABD<dyD9Mc>RHEh&R1Z4bo`VaW#YuTh;ko5p`;XL;WrWFJ
z{qg%9jQ>&R427Hrqz|dV?IKqX$Xbzz-r@_yiL+5om&-O-ZoA4jpR_e`%_uqjG1(EL
z*v1-A?0rcDwP^<@Dz3N?Lsx0v_1wm3GXwXS*kgsK?)0WL&v-@Q>HJPMsONxG`#E9D
zz@t=tD^QOauIpq#K-a7bd)__5E8m20u06=LKsP!eb8&?M3xHu4Pi}33O{`r9G(Qav
zf;RBB&T4Cx%g1fLt1}<#G|l`dx&=NBZvd6IDC>(t=gwl|*$&M5F+(lM7}Z}E*6PmJ
z;o@PnSS!F2avn%E{dSX6cy7Jpu?p_{ZOO~H(pq^IXtP(EqPzy+ZGh_9ZNn{g?L`cL
z^fry+v8ZJ*Z6E(Yt&M7GQtTWE$L3Eyl#fgE?hg%66L{?Wt7@2?-SBm||M}^s6p@9F
zb>s`BSNXJ9CG2!xo=o;%V}uZtKX|o+Hmi4UoFt-`z4EcGvFS*OgIQ`D%*Hvwf34Yg
z48s|EBv2~0#fzDYulT|92~;0=Da*+*s5L8wmNy<Br-AvHH*n8q(=PTVOCpW3I=1qq
z?Q8ne%VO!(GDjkQkz~D*%sAZ7dgx&u;0)^j`7Dq6{2~ZlA7J3%s&*4Xf_ol3zc|{G
zufrq0rVNeeCgPep^8Jo;?%2jR!FHi4%i5lGh@l3?@Y~xn;WFSpxs2PNN&5mw^iSBB
zqLo`Xaehm4_}Fm9GC*#Ffy0^kRhn12sli$Ldi@exX6^n9?!v|jBZC*6LtYFx9~<Zs
z>3u7dqx*r2qmKwFBEm)hR-U31KC5(jSF-w|=CPCVO9#lrAuR2D;%kfXzPM@;H+acX
z=JxTSw_Q6d|2EQxw4;hzCN=rNS#PxO*W9v&QsbT_b>iA(Qf)(AIOT&==N9i)=5NbU
zD}qF{)jpl@v6fv564#Yk6hud(FjHJ~Le>}_m^iTZ73~P%muS<e{^2o^u^{}&7YmzD
zRlTgG>JJ9!6Vzw6Z@Qljz9zJ(Yq6B@fvO?1I<HvrC5ymWAo&t#7U|vDgb@T>G2^kQ
zh%Xi_f4tecRSlHhENjf`i@xXxwy@f2ww#x`4(!<ZNV_3QQ93suuqD_&=0_jv!&OU`
zkfJRmZ^DI&Ua%&J8juln?)Qs?f039P^@WCfOx~}oYkJSbUy`=|Dc3<ZpajpNS>f-m
zXY;?v#hpu5k0VEycV|lzx91PH2$>vE*^o_O{pCbzE0~t!cWt{$+T5slNPA5S<9mG}
zB3!5Apw|!Xv7t4B6n<e{O-J+(JCUhdw@}qSpw>M>@7nePn=MZzz{Vd6cT(dgl?0b2
zN5(0}v6AoXcpgKlH$$i~O(!1vqz{-q#;{m3HE7#Rr*f0}PzyMcm_Gkh50bukk(Wyy
zlU99-UyqtNVRV69fpMqCXVls~pK^_<&*V#8yWT0^HN$pEqqTLK6na~!xFx2~c%eCt
zu?xspZQUE4nn}V5F8@_L{yl)>r}gP*TN)*7b=X@Ws1voz?n}ZhujQlI(A^7oAf+ME
zji;h`O7&rhHqG87GS^wJ3YyN>fgAH8hg6#jA?9;n@<Y<KKx8K$oW%NVBUY|yHhcj0
zg#v|~B;n-)tnqknvd)o%XrLD<G%LX_2`~HSwjgNAE8AV1`SQolwttix&J7zkO3_=j
z0}N+fF`&>K7~I0*J%Vl2%e_RJK1Eq%(*qwO{l33vsrxFhs3bJisj=(Qzq>QaEMdP`
zeR0!|8QNUM#?b7DcH41yoAJV#?fS>R6xGjV|CyY4-?1=02E>#7!6>>4rdG%!z{~S4
zOLsOX3^EeSo_MCWp<_c;upF1*l-9;kZ@V${gnorV=5w86-h6Nhf=U?TlrEbw&P_q~
zIS%FmgyI+t>rE<J?hIeVZPE@{8J;;U9H=K*g?yDC&A|8kE)weeC<4z%u`FMT|IT8*
z40k~~Fm1Y)H#q~vYoI^s7P+iO>Nt@Bx**l(Ie8<T&oQ$uQx-OvG%Ipa<4`V*_+qDT
z(0G^{;I9q%$^oyfgsh}fJ8<N4N)T1pWG1s-!}30(%8IcH0XeZh9{0HCTLR_@WR4U+
zqA{Gn<0NGg*T0%56k~H7-AaRp-xp?-mBrPuQm1Y>an0vh$jd$5pE`!B$N@|{^zcsx
zrWJe`@;(7+GkM@d4$Sy;1m4$AgeP}5S9Xf0%Vv#vvzdw*aD}ants)xOptm-`kF7=@
zGEZ2)^)dV@BA-jiPfDnb&<Szx@JKYW3<)7OUZ-(cWS)7m%t;bK3V-YY!y7PmE_Alk
zpDzp0epMitnxY-}?kcd&VYiv!U{IhU>M}UAh66-_&*0YEDfZ;U7KsRWMN3d*KkX1o
zEq%xx$M9dotcLo3Y7B9Y=^-Dirf*nycEE!gBh?7Db?4{KX4VmeqHvqZKs_+mktwSp
z34BUnrL=WvjmnjoU2wFkoKC63b^i&L=KGbOO<^`_7uM#wxj|(tNpGU)FRK+nX;)LO
z={Pl8tsI+z4>CbDw~L{nl0`ez%f;jCD-Ah~O$Z_QOH1Yf;as$0@TNnp<fz_9Twb)J
zCK{@qmYhC1E9o;FqA7<clUcHYe~cw`S2YMfd$TH-X^-R7WU3t*F8eu08$sL~d{s$~
zA&G5A=l}CJH8G9!&kp5YSg7_#?Wa|NMK4e)LQ`0rOwI139Mk&^5jle`=ipw5Czp%%
zLWI9vht=iXH7YwN8B~e_`H36}(^_FYr(aR0k80W!wLG*AYZGzl1)JNbLbrlh?3g!y
zMkpTaoHgxT)VPe)v(19yLZ>e&C~HcIFe);XxJ{)F7Sj6g-yltfg;gOs^F?Vm*$?r&
z_+&+6@%>QDm}y90nzl@YP>H4E=4@&GOp96Qxec?CE3Zi*?g&5lB8p}wG^f^H8mbMV
z{$z)Kg*Q+SY^AUo_lP3jVBC9iC<-wgO+oWoLw`_GZ)C>&WZ2!^4cRaLZ%;&M{O@Dd
zPo)qR20_R+F}j>V+doQ@`)Fhu8lKgezlRLj(>amw(`gbDHaHewxKY_d#Q74aCrMzK
zo8LCifwLR--F_QbZ6SQeD94d}QI`mj)6@|dw_z%9^tchbArCDrxU%}bM5eh2k2s7O
zN8N$Sc?poge1xx_cL=)ZQ=vyykqg$SIYj3uaFIB&Ds8V=Zi8*v{VwJ*ju2DUyS@o|
zO&SZfq8PsF!i%da^ixy#x;SZj5{ApIZuy?nmqpHp)3bz1mJ)`s^gf5ZHgH?T2Q|If
zVktTGcg*xmCAUk$9$8}-&)+`V)k1-yigtdVS(gF2GnH8tV>N$d<fh~i)C&)JBL<y&
zxMI*bk)#O%9dZ_=$i_7(S{BOupjFx&Sjusq;;<2p!Ud@a1qdfLu!hpjWdfO^>sCZw
z$t{%=VdjnmdHd<9PL2?4%2o4Q!NUm;l8CWseTli2iYbW%W;<&G=9t`t`bneP$IlaS
ztqGbj0&5<Rw9i*{YSr4d8NW+g&4M0vf)gHcnwNtOeNcuDR&sc7BmHnci67%^E9Qt^
znDRy!p*P=u{DOCAga6><(*;$s^Hte6>olP!88y^1y}8NNRJsuz%*ZCLAx-RE$_rN$
zq~f>Xofr;hwr<+jPUlYo`d=d}OD%=8&G0bQyZ_nB=vCV8DXw8Bnwcs7DxRKi5(BC%
zU^H&BIh(W(SQB0&luZW}4(^itSRrhf5>_uqKQ2@K_zSQ-75GS!nega(sQ>jxn19Dt
zT$*Ci+7w2Ic0oTD>X_$RZ&T{eNrHK*4H+U>&T2f$S0pCWyJd72tI{=gF2CJEnLVns
z+#P0)4WM(m*Yw1*!cd@3Njbpx<p~k;m+}nW`r!||?go3g6Q@9?qNe6!74A8&52_((
z8()$04m{+m%xBDOw`0%VlY*XC5(<CRr;VNfO@lm`_WIh?Gi{&p?2mB(3=yLAh9|In
z$uT7p0*X<$k|BKBZ9VA|jQ)Z{*7c6Yy@fsX8HXLR4X<&0e1IuD-FI*VJ~01W=0;28
zyoziy+I=T{pA#wVgZX(4IN;Fx3Jo<I8`9(2t4b72m6C5ePq3|&Uvm^WuW2^1rXPHZ
zb8`iWm{06S_tZI+>NNaG<~0ij-fpE|wEf$}u+@tGPZP>lrs99}9huARXFXSl$%$_?
zK!Ep1-+;rmKiW;k3)3=NK2|i4jGm`dFdyVWtki<*CS=x~^>ljLq4jh|-R=i@>&eqa
zn9ZfSVKEUUV98Rjn%w8JyOM%~?JJ&Mf)m=PT#=tUH50gj7%g;`@0xEH0uEo)VhB99
z6C#$!s4HY4;(G3Jlui_jDHlyQy&ghs&q5xzz)1-uf|dK4&YJ+v9vYYX`jqgwnpz<m
z9&khF`v9=d@oeA>pA_oKs+>A2lJV6A*vJY^G1i^gVS*DS2ae?(P!WTrRw|M0+rX=z
z%%865E#9FhY9x?eKQnCQG74^sGN>EhjuU+Wk2#%U_>4zS--Uu(isaQq!8`<;HVq>n
z6SkabI_Lc>m%){m8|PBVC|eIB<a2}NQAbRl+Y2s%5Ad5@qk_UFusB|QoV}_%{7JN}
zm9PFBbL(`V&bmxIwoyUJDN45`UBt)64;BPWys%HEF@7J*flU%Npvs}_)L*}FSnCIx
zcu*hPQh!DH{+{JI6o)h$Mg_&@jx?}zXwl1$dHWr_A+)uCl5tyX^FeGDWNo3dSNDNK
zags~Ye|R$FsF&A#EGQf)UVQpDC}HR8|ANolOSpYk@sNi5-rAS5{SsPBH-7~2<_{N&
zjZTY>X6oB&_4gtje9iu4T0=qNGK9qBfE!*Osah{O4Q{O<JS+J=M!{AgL^7`Ysdq`Y
zVPPcsi^mXl7VH7Q>$&00=H>IYqbrBYgd^_d%aNnE4go%1tNie-Te&D2*88E+dta~1
z<qK*gYp_Vh#c#_&$t$`0f|i32YLqxf4DRf@qZUHZHK=<z`yO6;8PR?-bX4Zil5=x2
zdTTJZ->cfyNj^P(e^i~p>2R68KVG?!6e83|)9sQ)6mZdv45q(X5x%~0$(rF40=4k^
zCE?2}y~6n>d|)ef?K0#Rr^lk~xHQA(fsChpG>)o~gOxUmPS-h&ogEo8|2pb0M9?iX
zf^dbQ8sVG_0ZFD#K#ADy(I-Z;6gpdtDxxq-%KW-WJ9do&53>fC5LP3kmEJAtaJI;?
z<cZ-*-ztmiw6F)Q{c*<^DjTt~EGJ9fZBcM7q<Ym7(HecKMckqv%vkfRwh#&KY_xFq
zZ#7AjD=Jt7PMYfbE@#hD63X#@!J+#wQQLWJvhpYB$t}!oQ;xng_61qi@$8pE%McZ<
zJ~}B48-(UP+aO>5*uuP7bmD_a(NDEyCZiST%HB+!;8u=&%7h)wMMO}{*;1ip9vs+X
z4G%TzklM4JS0W>E!EqP#tc-us^EdF9%}w@yv!>`%7(d-U&lrVwGjKSub=Mq8nsM>z
zt_@YzJg7_-^-43Nj(REMelCM^**1n3SC9V{?IfSh57Sa=^Y9eaxQL>O$sJQFfM3gm
zXG3zH1lr}}=>1v0q|x1_%DwAlJ^ihfZp*n5*lG>?ocn=M=3Lns<KT_9#Zqe9n#|xj
zUv!dd+zw|S>~`n7v&^{pczLDWlC6A8$bc$i`EtFa7Aftyt?m0cFCvPoSy9+;fdQ|_
zJN>y}A9wBgS%_eZ6re6Z(fD#uTVlNuW2No9b${_7eesD&15s!O+_^%TgpLuT%Q}w+
zZq_fN?J8JHlQ~|u7<VtxgYWsI!f|H)t3j?fj!mV&7?nwy+dw16N@X4S=br*(S4Ze4
zCJSZMyllna&349dcJyJ-fh$V=3>~@q@DTKY%`TtlToh*y1hay|gf-EarhfM1hgw?E
zva%1%wnAcTjReqO=EN4o-S+eASxGQ+-eI->nJDbx6{R@N$dObM@9Ci?-Tx>{a@Uu}
zZ~vXSF+2=n$tajepI!)14mmA*O63X7G}Qs)oJK+DBxmK5&zAo%e-f`>6JulRUOZkk
zAlhsQfA{Sa1>${0Job>LP|7tA_(OF$GGoLXq0rP<(5hzg4ah)mVCP%$yp37J(vx)&
z5J6Luds+}}O$&3xL7S94tzU?d+#7%VFH0wPB=SgK=r0P<%$2!<BXIx}W_KETqD#E;
zbj<ThXJ)kT1{3nMJfJn*tg(5&t+{1e$zjK!hQp&iaP-UKd;fK~uhQk@{gLq?_e~e~
zfYXK2@<k-_pfecx{r<E)0q0jwP0EPF)gK2gjpoLi@_?)Srp4CLl@X(0@_=iHJEc~M
zb(u(sJDdR3^w$M$Q<<p0ltSm<_OO6kZU0;``;2>y2QGJ<!-al8@xsTBnnT~=R_uto
zXvwRbqj7zE*7DmB2Nq*{$&4B|NzY|Jq@4eT+@O-+vH_v7e<LHM|G9_1T$IStwH~6+
z%)R^e*ZtY@;0Hv0^xe{a{Ql+AKBtO0^!9-@R0JKB^FJ2EGRfc^0m7Z`8vw@Z6l>Cd
zYU^8&oO*j#sB&^Kq(_3ezEIhr(Fu+_zR+1E-GgFIN1NlEHF&&!_O8lL42MNF6`>$D
z^g4Z=CPY-^EOhft<${Y;2N=dA+`IVxEa@fv9-jx7yN18ul`b3%5y+d=PuXqPx=Bk8
zu}6Q;c>bjPV2<!i^EcFD2Ag=MC}JkvvJw665HM4xuRq$w4<DSClM=%vswI4m;9ShP
z%NP)<JuMNxla4etK`8hCvl+u0{@@AM)Fwx6bsLliS)<xl%R`M!&nyP8tywx~*gYhi
z#E*CR*53lkgi$%gGy7(Gp6wUOjF=k`j%jQ9A61hgX}%43x+P|#G-Y5E?aw(c;;siL
z2C<fbOl*f;G0-@_l}l5<NUb<DiebCB5UXNKg`*$xh1V$XUSI%Yt4EmKvbvVOH&RFl
zEk~?K(1hWpnH2E@9Lq-s5810m?CDi?lAu8`YCp^DyA=g9NwId`HRA~n{I?X{H80DX
z{<i<<CYT$n72qdiaY;#nqZoigb0o+>qJzWWds=MFDgS5yw05`LcHKN=dAG(rIC}fQ
z9Mq<clUcS^JuYG|=a9T!I>-I$-wK3}`kqxI`~8oYhmsd>{5RI=xh0SH?+kUTQjjk|
zR6h1ig}ar|)xJyPyAzc}$@}k;tN}w3mc8~m%U5;v@qX@1H}l$URR*?@EgbxhOIDId
zi*I<=s%=-r?M*kFpi0RPhy&95^?MyU-vjx^tu=+gRogOF9H?m9d>v}&?n*mu`EpBc
z=&ifP-D$ax;icPyW|H7Q!p3ncWA0kwE-^q?wr)3>HZcc4cl}lJqFa(faKUr^pAU94
z#hwR(7+psmVP+9R{w3@t9Q`rN!cjEv;eNV~@SFsk{TI}NQIbOy9HYHWI)qqXk*U1`
zm3F=YD3e7y=9t#@1(!EuO`Wlk-^XdEoZo{cO|L4rafDK?$dFuh9r^QePp#Kulr+W(
z?lN}ynE1fV&(UsoW6y*;;sd=O2E@CA_~~gI6Nl-M@eu3t{3hEo)%a7}a*Y6n$%Mf0
z0e*CFdS88h(`&g?hrq$6fba3<(Ec*A7Sm>yk8+*QaJRft<qs9%?!0d2#)bWj8FSSA
zDXjNo>-zfO6&s(;a5#(A)5)9W1!ZSbP>@$hzP3K9Xc})ouJ$Tzu)1iSq8|7Sk*p#{
zfj{I}*JK7ny9ms_w%n9O!`9xp8#E1`6;?B*uK)g~Lr{P9bki8}^qiN3vL>EabC3Pj
zrn9WlSwO!zz1~(*_!kLLrb%G>q{N#1l<dMd)m+!wajcj9t!ag2R@2YYH0h91J*@K2
z`hHb2r?e1mIDriKXO76<T3C4eZae004>d)pCd2}CJ8U+na?iP%cqljyyq@IBiYv5T
zhLkG@qycxE&Ma-~*X`|M?we`O<cxV&61P31NVq>5K6rk=LWEo4yR5&gcQ-g>Y~+8z
z{8xR~i8t6u-rnH5Omy$K7_&rnbbo5;pLcWUaGQ|#>AuzB{_H41^4tX(<+IP}gU)l?
zQfA7FR3;DrXFM5J+C9JTAc`x$Pk0C?y~&Z(yDP76FTI(#UeYF{6;jPx;JJ?5=Dr>*
z=eXW|c^MT-$EHvh*}wbe!uFx8R#^xl12)^Q_c4uYDRVIt7Yar<zM}gfCuw;?T7e}r
z#cQZ}juqB^nu<Xc31*tX7H*nqA(P9L&4;eeW5-XeB|@%;tj8-Hjgc*Rx$%7wWoInp
z$)u1p>No1Ml#?-9+YsDWP3bdQ65OP&{E4r1Q;>m(d*)}5(%JkhpEZ++8H%XfejIC*
z5xW8K{(b!7j2z-c{lkIxY8A8*QT=5>zK(UpTpG~B1s3cRnN_<iXEFVQ_|p8;lVUR4
zgTuhjUGa6UcV8W}Ws02x8wM=`)g|7GAjSRDo2pmKv{HL%nm;&*2uuzHS^@;1ZA%Ki
z|0ptfcvQTtnmIR|YmRO9qPi9|gNMZbGfWn#xB#e)H5(SdK*W(yYwp)NJ)Rh;VLZ$B
zG}iH60XFJchgJhLGhg;TtxsAj?*s_X=nMaF>cyR*O2x_xt^VOJC)ILz*lTa{%sKBG
zk(Ckt+p5T|58=gU2EF*Ez~2B%NvKo2d#y&!<iqkUXDTeUGf2FI+lliTO80VH_vCN>
z{NF|P-=yp&i~0I%mr>W_k78V$(<QPv>>b)LLqONX<1ta24u@#%fVPWp_Sayqas!`k
z)B0-jcwdR;$9>!NqxRlJR9mf^ch?HdmmzZ>`pn)Z*1M_0Y{Oj!?3KCOcZ!Z`fK{#T
zq?{`s+eeK|$Nm&%cZn`!E<5$pB0pn$8hcJEAp@>Ea0c%u0f*eTYupJQH$?YubwN*l
zwZ8uLcH8)Vr#ylFbw#6hZzpfVl?@bO6X0Elx5+v(qrv$Nd~o`{_mIiOz4;XoIFbR?
z2lN6Kg!+A#{<wsh3d8oUm+$Y6Qe$e_tNff=$Nz|U7%azAO1?FMSay?Ht}v5eDjJ_{
zAJlL=t8bQwOQHlQraGS$O04g{IM(EemZ;H?$N6|7h3UWcr~BDEBlE*9h~cZkJne;t
zkfmiDC})w(GhTysrG{hoCZ#1gn6?=zrvb~1s(qn<7!p%xUBpxoX)5E-;W&oTO(nT!
zHu_C-3IcQMNCsBLhtjj%uG4U>xVuEzNoxSQ0(0^~GJ(5f>rGpx1RVT?v0%*)nfT{F
z4Zg<Wr2x)K{$ZF|c^Uko2Kks_d44$C@SLeQ{_E^3F1PEpu@!lT3hdcIH#!(04c2b~
zBfH46r?)}oVd)IG$O}V{Y5(fELmD_qfKf$yC#gdO-;DnsLfR(>y_Mxad|N&PORJ%w
zGqFP^gJz4VB`&?u<l+Co%m>zF>h-^#7>3%49|CR#1FB)aIF!YL1vhpd%L|Qp$4hk&
z(8<L5gd@JWIchXI4)Z^B@b|u-^>hFD(6t@C6ZXH`ozb@)$zBZGtENU08k`+bVCn5v
z!u<n=wf!_NTUtY*>d&4AOKKwsxUe+yCcgj-O2x$UsXs^@d-(644<4>ZI4`2BsaM{f
z&H3!|HI6TuA><?&F5@ImNF~+m?~=<|6PG>BC?$so4iHOc0-d9!3#IyB%mdSVuu{W?
z{7GKHg!)?Ue~@i5q?R#jNIz4p;7n~U5jCi(OzY9Cput+y5j;36`8DeEUVM3`#@j@E
zb7~$7A~RP;rk~A|LPXr-yh=7LcSg4=oqLPVcs{wBl?TbN^YNu}A*)<(O(qnlaK+l2
zeM;ky&;Pk?igk{R*pwQ%#-7Xm4(^F`he0P@B4zK8uIfxwj#=NVslCeb*;BIy`yxy9
zIw$m8BU+{h8qo$VZKbu%{EL@aj!&-z&~l1Au($2B_|2xWBtxn+g9&#z@5#{vX~p?I
zEtkK=-Ju<G_*42k#BJv?+-yG3Oq@g~GUs=W?oX#g6FYRm&uN>{b<Q`(9&yNr+8yDs
z+*)a@F&2%X-;*@kA&>GZ4S$wpLjL*L7mUh%wiR#K3<1{71G^;hoQWs9Rrp3z09sDK
zrru3wfG10ihWo_-qonrE#~*u>eb3oek}Q0|0s4+a+&yxuOnmO&X)a!bJDzav-;PNK
zIPVD{4|GxyJCtr*vRAx6cDS!wfMi_nS`Jk{$WHI!_xtsO)7XrEB@OXI__DrexIeUU
z+ys+Q!C4L%`0+;@8YiG);b5q}Wb-aUsx5^;tK~XvKMu8}a5rzvzVCnDJS6BhDHwl#
zpAw+4bbWW82;%mXx;${Wk-a?hXnC74T1QizVcf7D<y;EI5nNa(;pM;1xH}+947lXJ
zlkqw}_f=_JGzy3ScC(i^WZz`9ZkFNDaRl6Lt0cCcnHy^XNh|v83(ofu4+6Lc$;VNy
z@g0&4AmAX_uzZ`g%(}TwP`8T{aPBd5m)P>t_jdWV8JQ+|`5lQzB$jDLI(hF!{0rt1
z2VHkCd9gSCccj%zFeBcZ5=wVcRD&opSkYKUiN}IC$Yt6+Bau4vk`Au{J;$r2k;k8X
z&O(f0d1#vLn4%ViLhMw8lIE5!Qp4gHM4qh?3Nfd0-&uGqRK$X4GEVJ24=L*dzNw4k
zGwmrYB#7ap##BS8HQbR_)$5E0AI3gke4S<@a`URZs`0nC6Owm&I}ZRxj{rjzN~aby
zp`<GT5!nU+>9t1*__(WeW)(n~+}%3cW%bz{MBL<X`_0olGwwwf6;6>227$H5RHGWS
zBg5>B(vvsc;9c-S{@w(#fro+QGAW;FglLTHk@#7QVW5VOKNZi+9kw(-VK0?v)Z1&j
z^kTfJPGaQUd?RY@8NiTiu*$z!>REt<b5L^-)Lgs?keRnTXBnO}8^TDGB-ie!vGcq5
z^o?Wqi!ep4Xfn0V*PMK6_fW@d(NE<vdsL13!p1P&)WX4JBLj6zAXG)ST}VBHb2D+&
z4F~!W>@eFm;p&ISzqG995#C?>oKaSU99kIsM3nXHZyeVHH(`P0{zcNm<!0>epZ&D6
zby{TOOOMf5RM>ad?Yrxts=$Bj{Tp>LL!5HtoxTs0+tJ)*<{16lG7Wx(!MY%XP}(!B
zU(zGIta0GIX}I(~d4MSB07;8H>l~t{L$nncz}J_*^Cgde;3n_NCZsCl*{^L(#!bvM
z9<6i}vF^K--!9c@a28YR;wTB3n<Wc))n3~*C)oLrLl@!g7ro$#mE;;UIsU2d?0~Yk
z_WaEy@V!c%(#K8=HQ*{@aSzsUI~sK}XQ^keJsm-`(&FU*1rv}AP<N6V%7Sj<ozK#s
z_vc{0{+u=^VYFKTzNgB<23_5T=jT1U-`|PwCw1v2x;{j+=yE5#sJNb8H{ZuIR()F5
zw1dgeZ%Na9>n=62r2$)Q<@U`=O)d~#Y|&cgj)JcT-1PGYSM86zm7wS(yB<&fT;;m#
zm!?qvm{@wbZoR{)_n(rlgX7!L$LkBot4imMF#65uJuyMToF?2O8W&u5U^}{6m^A!H
zMSn+><T$a9-Srjt0dVkdFiIKNBmhL9#tqw`yY06tO%?YFZ9he*NYf<*k+<L7dl`C)
zPG4aYQ~dl=fSWGqj@T?&EE#MqYgr2`$&Az$O=U{xXp89LFGocf;%!m)(8Q>;?8|UZ
zcntH^g0Zoq5he_1ABE4hqGixl;FCJt%E!Nd9|$0X2Q><hRp_hhu6MruT@>HhXsiBC
zeIigNmv=Nk9z}bBJS~LMu0$|pY*zp9F1E>J^Ou$$d(*}b7PLb|5<2Yj2!ic+_w~oB
z=6YLG5#DHx7pMG-aclBTed(YMab%3les60}jYF!k&{Kust8TQQt|1rBk8Cs->kMAQ
z<cW%p5#bA1wCDj>w$0gUH}Xj{<=)#m)eaqWzwoC@eZRZHps_T&^FMAG_&4dVDD>HU
z`_T=iP;ByiXSGcWENTS*D5%z@_mY-EjB@Vm!Cry^m9|;nucA+i`IA7`Cn_+Mkg6|7
zUk2+7iOg78*`pmB$L#%CH*E{WP{Obwp9@7{`xL{$pr4ZJ8-om!;pepzhy>gh2(IQQ
z`DJGagg<I5{G5~0F`o$Ccz4BHfmHUmZcql)zRw(xwA^W&L=Uo^wib1(_S+i#DKQ=~
zbWw8qh3g5=w$uO_o27SuSa4||M0+r}HotpuWg*Vi5$%Js3Y@@y{^0zy$BNtjO5V&b
zU|R~;m9})Qrw3by+O}~<)DhVdG3+BPM`mEg6Dpu`{ij))Cr-e~%A5ZzWLNhJS>$&v
zemXar5aH06Ytdw1spLd3=0RrT4HC{Z8cnts1COHQD94n+9vzU(0FS?a`d{Oa{}~_G
zmHT67XxreVuK9yKd;i&pPZL}aO2@Q2xHI!uP)jQ`(lv_DG27t<=c4o3Vl}qsB|=lS
zz#wktDQrkD|5S5lZ*P&?YPuO^IB58{*5=-CdGO+?m|(+R1(QnMD^<`5$w}^Pl%LT@
zWeMXIMImjbkQK$CNkcF?GFz!(arZ`}CvR5xtHF$g*Za;a6`2RnYC{BBZ(L*D%&0v*
zpT0&UHUfLM+kNXpKsFPke<fzCp(gG(HuOBQMLj(~ljwnEflcd7o~oC)2BNCfp5L5J
zYl~D-S_02)u99K;%3?x>OYKB6@jH^KAWOtJ#B;xaX@P3)gh?Ti_*T9mDdy1w%e|~E
zPJo}9*mlE}X$1}=l#Y>}j{@z=1os>_nqb!?F-y>P(VxO^mGl=YZ@Y}ubiUZ)Yzlwa
zby3`SFjVWW?WFUqp8}FbV^=Jb?>DPJsrtp1LF;BJaND;HJ^YYYM-;(V5*AitFJn??
zB`)$6*QB6)(jR#kAQBa1nbY&LM{kMZE2Z=;Y_>#|4(U&_^a`r(48>k%wWaxYWIjeG
zc0&A!p#7^E|JCRgt^W>O)0(=3H`?W#xH`F_i2>QpX5q!k8Y$>JaN@*RI=y|F*51Bm
zW!!*wZHl#UoFfCJ;$uieP3q#si07%*%y48S+c@asVqrnHw9qrBcSj<ENZ+Riy|k*N
z`u;kFx;W;uZI_Ny!10B}Yu}c~*d5=@t_{=`xh3u{NAa2pOthQ#Hl}#R;H{kjwl*aB
z&QzOfSYG%y;9$-g@=iL$(@Z)nzmSGQmgh3P?zW*!^U<7=s<91oBh!y7fJ?k?>01$Z
zu2+4>FPH=;SPC;40XU&MyY?9WN7P&RHT}K+{~Lp$G*Z$CD&5kpAS&G;DIp-;4Fe<u
zDd|R3knYi)f`CY~(F}yqF=7mU^X2>V`~C;Jot@`7*SQ{#>;8C(mWDj8Y;ABY@CQoU
zcey#8W}p;AVMbYeJ@OjBp?O(%f3fqUJ%aPfP>yD6VvB}glIdbl^kswXz9#R!*cpzQ
zpy8yidC@Xx6R@n6;jp8W!7B8q(x%3xJljh^BnZVIwWKp%7)=Q55t<Cmu|=A5b@j7=
z_Vs<5q3sU9Wwt&`MJ=fqe>`8R_o-<AZzRJ;%-@#BwS7kyfA<{=yeKrHhb(!2_xa7t
zafjNdThO9r0P@Y0J44}Ko!rjK^KFybPc)PCd!0iTM-Pav4jU`)ws*h(TlHbHMo9nX
z;{1U~jQl8F1R!0+w5)EDRj(Gj9|8i&o!yxOHGdJ!GE^2wL|L+LsMhl34VpS6d|tdz
zm&X5;ZOB43*^g%)>ZC~iv%Kn=^ZZNR0ilL*`?gvy-Ck!`d0wVQ`rWKpT21_4{Q(>A
zTaRBUm@NWeYUd|E?xNes1&Hypx+x$ku&8P#ih}Je3W6tbQt4cBq4A}X9n-pNP8`@m
zC+Jn1$z-0b^oCCWAOg!gn)?;+)_m05Afqmc&m`X%G!ZLl_l23nn$k^EEI6pMf*(Mg
zz4$Jj$rzx@BwVn{H#c*_olB+nXJ=3n@VJVE4$Si^y_o=RY4PxCb~}1+t);sLRJub)
zp{X|e5VV9w`RMdYhz81%@htT8Egt8vSJL*+42oE1I==1<*2^%@{g4Fv;b1~Ils{^}
zy7k#VbJRTnBo$h{bVErfl<PZdWG)KcS<5Oo|0G8I(95puAnv~P>7AsKpeW*U8KS^Q
z+;Q&Mv|y(GMqHcAiJg;#Wv}#(lW6gk)>!0tkJoI8%OPV4GNQpWO>0$Rp|QbhA%_5G
zfhD}~?pmu*XY9X2((Hf!cPJ%GWVW)z@K8rxJ|*h{QA5haJF(ohBFC42l+cfQ{4a0~
zwNQ*KKEf-9oQ3c}uB9$#)j<sdpUEd{_-}1>bMxrUoSj9eXnm)qVt$8fjiw+5M7fGR
zJj%AeUd!H}u~}#!X{u(($NyN!qA7l#qAQ2(EXKp>E_2VcY980*c>tbEsa0LMhH|m#
z$9Hd$Q-mUdA|d;~K4%5^OU6hmgC6PlID#QlC#Y6SG1rmT*^YDIU>quuM}C^H@`i?K
z_JlO78Lz>q)w1_0)*xiCgK_c@@#(D4(|voNx}fF^BxrP=MQU*>66XllZc!lkyl@d%
z+ChQe-Q3+DyPkM6HR8DVVdFWf&_sm^?}5OsMcR0N<B1Xa_B%CI-MHT8M<7S{pJELM
zpgD-Ghd0LW$|JvQg6oTxkE0VJl?&#!CEUz6w0&Uox#UE?9SPd{=+Kp=af@}#extV2
zA&N-j_j(c<DtR-*6XhSI$puN{T`VA(UyC8;*sngH^^*&y;+}c?7I2D^0e-~WnVdlz
zRhdpj+m}0))`_8(JargT-st1+EtpnmDOT1Tyoezw<zQNV#+3gbHcxlwvg&%^Ka?K0
zA-O~f!c@lM`8qb~&QI;==m=5Z14t>C4(#CS12?&C;^KSRn=X(|UYjfnenHXsk|-;2
zMlgx*+GB4gp5jt>)b-=QTG7h=r_O<1bqfTw$5(<N3pD4i9#Q|FkhImeZQ<@#3WWpE
z5B3W<5>0Nzzol&wk@t!UWtBar<ohytn7oT-L&6xKrHuEl0p-MS1pLRzD>mj+TnPQx
zkE7S7!2-J`Zt|iG3B`nWTh-ps3D+<TCop*K;sY(_f`g%yWHE(?OG_L$eF1jiiXP?C
z$99=AuJis6BSFO-bsC+t59y>FDH9i!CNzE&Tf^!@uEs5Tb>D^VMss99sW{ZwO+)$5
zw2It}^K*~Ff{P!;(@NCJml_&0QGcMkPZXfpRC1Z+nEdQuP5rr_A7*Y;(iJRE_?<hu
z@j2sr2knUDz!?9xUU_nB4E6(kIvQR_j8~P1-A})AD^`tq<1MURX>vW;TT_MaEdt@{
zNauz7U2j;dw>!{N2eWy;CNOfR8s`EKoP%TwlXihSQ{%cG_ilX0A#nCr`oK+YpM1Qs
z6E+teds?<sr`#_5<=mw_<cOs3o^X~uXfJND3YEvOK4ec`gf9i%Vh~6(^n!n#z1TNq
zOx!ZZ@>!%<iVJ3;iud*;;kIdJQX)oG<Nhfosj<DH?fMZvrw?X6UoSn+x!wS8ap`9K
z#^@5?CD^0+q#GZ>5>tvAj>^fMB;Hk)y-qr|y2XT;TY;OJ8wP)^zT5agvgHt36M>Zr
z0(J*3%-auw5a_?s)p#fNS40J$Dv#iYAPj~}c4Q9xG@2)7j%pHuR9BAoTtZrJZZ_EE
zN@o4`|LXaE2La1v%RV~g2R8fxMwdg%vfAp(j#5a!b^7J+dx0ayOWLv*-K0AWq=73S
z|Gke~@?dO*q~bl6zTaHT(D}Drfr5?H0<S9x{LD#2xA<Dian6_gvBJpu2d2rR78u2!
zF|_xHo}_EK10*%$W=YMjm{>@D^$1k2cAV_?XYIbNv0n5~C_llw{u@sJ-rUvPaDI3o
z_^UpXpRbIIdpa(q_5c@Vu<==cog=J-BSFP0&8hSHm_*vAx$+S~`m_P=NDpyf);o9&
z*KAEIHHe@NWz))+NJ>9B(7J27jE@;ViJ(0sPiY8BEXynm7nOe!a;E2PS_7nOP5ap-
zoR+_>DSaN3Nv0UUvl!$f@pd-qTkAg82>7|11UHTJLc|JEHz+rgE}*ir<ENQ>NsRaC
zot*^H%^@6xFAye{r3KueWRxJ>7+)Hk$1Hn>oZ9In-Im0&ev~e4DYMXY!;)|wZJ1PI
ztF*qxyA*8oI1-BwaD7|N@y7AL`<LeHv3btl-L)fhW|{SkAvnu<ajFSebRK{>Nv5Lq
ztLlE`X8>eT<rRZm+?ZeY*Lt6RI2Nh$wYkIxt5=C}(6!9Xpn0o;y)KuD!8cL?*IigZ
zkVs+IOi1UVZwLy@#qf$EO{bx+PF<gol{2Z=8rmjazN$bpEMJc@4rx<cxY4kw8$uU_
zujf#$2knj5!&urCg3nm)s)wed8t96nlV9>{8b-uYr`q(wi24QnVd~ZeM$N^4va(gx
zXj#Sl>bHA~|8$wzH?Q_?3klc{6i({82<kxf)m9>_rnOwldR(E4mgCFA(XrxV8ZoM9
z%VB}k0~$ClP2~c`!}~B?LHMGjI8bj_fxbAd-!qt)2yoBokj11kjt0o8ktSL~^g8^*
z#FlG2iF6gEow(PW&Vsj<cNs=Twu7VTMZi+S9FCAqP>UxegLX*W4QoLJ+brR-+t`r3
zzG$7)YS1I0>DmO~aF(g-L*;=Aum?^sI(S`x&zs?rr#Z4>wEVe=g1Aj@(5RbeH9n;|
z6a{@d@)P)0um1)TFQG+9>AJwn?)45o=BK;EvwD%jyD9ySof^_DmUWh7p{Ri_*!8pl
zVNq$-yoZUy;~fKTuzUV@WYQbxHh~ydQO^RHB@g(ZpS;?v!+@ch3#zQtHbdCul)>Ah
zvD`6ZPVbNV92-e^KL0cFpV=l%U(y;o+_v*HJ)AA)g>E+Z;)$6>Z1#eT7*_eEtIih7
zh$*w})m57fSi<ZdlXk324L`MS+0LuNKwTzB|6ogpbehgJD#R84&01vvdH&~jbKZ5B
z^G>YH85N9f91(22OA-Zhxt?)JbrG=;XClJWRt`8%9ft>)U#^b_RbHc)F{Z%#&WZU?
z04E_gN6ZfBd?CA&8mv-YYnOl2aeKi$((7H<y48XlzD{kp7eI-|=~*LE5`()w^TQy`
ztCrnj)|e1SsyM>~XwWBT?}}P8dG>f6rohKnhf#9noqoJ#39}dQo8==D#{>O%*yzEB
z&fc1lEg9HNpX{kzV`uOTImyD!3FOZxY~gmdgY~#jeKO=LL+1%!^O8QZ{|i1Xs<oq!
zns94XQnTO{1>R+!_gqzTEchf%?PAO2fdew$<!+kFuu|qZO!0HTY0iA>=OJ-ZsjIIG
zuF~wbJd;brtZN0t9E6%C67GsxEEvv7$CDVwa7ga;60kow&zbV`vB{P<p@5fUk02e%
zDIYaNffy+!ysy6X8gLl1yW|S=<}+Iw2nNji^gbe7L4~F&ET8Qcq>gVitz~?T{_W-v
z>wcEJ3S-Pa<3#Y3b<@Jwb8flK7~;E&B*Jgq$JcaKUwC^fF+b4nxx&;o+$xPBa(#BX
zyYMC?te8FRBg3=Kha059ucZsaJO(Acj^aE;yl8|<xrF<hu%YJ86AL*u0(t4-XBD<G
z8bK?H;l#4yy4Z-+aFTFm*M}<()^vj`5cn(+-Mq-V1oQkSkWb|I{~j%`zKL?)dL?43
zeVV2wTGP7hH-Lyz*{aH6k%2g#)X$-UpnMVru_{x<nRan=$OzKRfN#F8@#hngBBH<*
z-K$=Wz{0kft{o9?D>}TorXP5!TC~~YSI6m{ZEal^dm-1qqUwKwz?E2)z+*=4>x+yE
z<V6AJ?M2kh%ggNLV_utn=eFBv{_Cek_4I$tG1KO}2aV(S?}L6juiTpd?Z1XJj<@w#
zEE-@t%6S53_cde6sJ;_G@Hmbca8!?@J2f7gd?PpNLWgDojr?xXjGZUkRWXAR!&lLw
z(c@jAbopl`8bPnB2GMTc?>!>3z`|jJ8z3Bs9>R$TnYQ%vYLm7x+kV-;tNfRNBuLxN
zE6e3MeN^ZyX!w``xpBWXp^X|g1U<aGW=z7B=PybF8S67iYo{G_ny--0l`<?xQ`{LE
zeDcPDW`uMK@i=>x=`ezGAbp1O2OuHBp=x?+xo9MoC$;~m%Z<=*Ua2H*{bNIZmMkOR
zB1D+P=e183p)SrB;4d&SHp|VdZ-09S{E+T_%)x5nUe&l<GIk1O_I!|ut*cn-6aDz?
zZYywlIf%|@-6-?hmLV_6TWluwn<n~S8DSxLN{fnSyn{Ld6_w`m4I26aV{ZFUF-xkp
zL}ny##$5)~LsH_IfLzYK-To*uay(BW-nUI7u7kxvHS)LxRU?&ne-`nl5ImKkZ=;QW
z_xU-0@T_k@3U`B(#!y~7itD_k!KGpl*4Qy#-dXbE{wzm~*ZkS5cg3dk?-rYlZ#fn%
zUare$KtY}rg7*#5+q(?Gg2V*2xPMcr|2E_PCGDCH^;8U>y0zY&Ca%^{GHcp-Ct>L&
zJnw<>r2S;Z!_DwX)z4+~ZR{txb?}_?Q@<NVxtn!_7!fr15OYvv6fgcKqj29@%-Oqh
z8nPd9(Qs>+Cz^P2gxw;?7`cn^Z#7P|5_eioyF!oUu;f_1y!z}-4cd#=LFX0HIkf|W
zjx{P9N0`dzyw0nv*_0WJ5xI-J15OvwIsaOsS)Y!R+!&raE41-rI(W4}1-FW|k8#l;
z$fJ<X%Tbq^<-hX8nJ~OM`uym|wFBHnjL$O;@&!59^2ncJymzl)RMk(qoNi^Z8C%(5
z%-H0gm7siq=ypGe_<rN%s~KnXr7BaP84nuWd5gYkgZymsZdbULa%pcUU+^2iwAdx$
z&B8vl`(W+$o;P3CBwWn|?^i<cb?vz2=~#Y5mh^nbcMW}j?UDadQ)D=m|D5CE;LwWX
zLey0RjWadr0`w$CpzY+BpF7<!SG64;4a<sDK0YfzN~+GTlcgp4@vnOt6A7HZV?Ym*
z-NhnKe3v`2=64QN5`}U~AQnZz_~n+cATA%u>llW4J}Aq|pKXqUQlW6<mbX&Q+qVu!
zjcZZg@z-X!r^Q4DaIvw(fy6k5^hplC!5^9ifbZ%cv-6Wr;KxK$u0bqvSMgFCF~y6D
zFoRW*v0NJWa*+R`nC7_*#a8^y*B5cF4JgFOjtR`4mHN>Y-E88Iof!D#gcwr!bj6t-
z?;K96BKt(5dd6iVx<TP{5LN*4+FggD+D<%8{suc@`?;C!Lw^-aK8qjScGYp&RuX*>
zYwKON<d*)puky;RW<MAbFKEE0!P6ES6wtg@q86Y8(Cdz?&)(-}2u3hU7Bd)PLT!HI
z-aHi<@D6HLL%;9=Sl)^8GB*ewh9IkGn{pRyO}wV{Y~GO}=5|%LSg%j>Z|v=NBhh78
z@EkvLqnFlEi=bxfP@L%DA4-!KtI-HxN`G984mC?NBk(1#^&0o}8a19Pj^eYwIMAZA
zx}Tfp?r_(y0}hS`5cq{37rJIT0MG}}wm9I%S`3d>(be-*Fd9f|(4W@m%l7;@`b?<w
zZKTW1X6^Xc)-oCvV(heYVJqu&=-QlJxZGR{s-9c6a&UOom23ON+1U+1SM(M198#IH
zMSNJk#e`Q0eEMN2<4W>NmkG=#cmLDe;}}!kPZA$SrY%S$1_A66R=o;4K}vOBd%KYl
zC9L6}N>F`afR77mhfUjRWix`^GLE2o;_rQ&=$`Z+NJA|~g)Q-_GJ2M?e^-PVdgofu
z<1+yZ9h5kcHDp~dD-pCu+Ijwf=+4#Y#k%_>>F(=am8bE9w-aYWtC^5YkcrRn@Ea9%
zo+RoVej&@u1(GI>T#*Qs94P%|wL{)Hx9b7l+wP#Tl7e?7O0{cJgRyoZ6IBammcgc#
z)fMRqEDI$$<4p(8aza4g0-fcw!)+jESXxt;h9c$nWs)7+^RI<L(nAc;o2MV~>%_sB
zKVk2y|J`Zo3ifyZ;%5jA;gHG!U2`9LuQ6ycT-Un>&wKKEJY;up7#)nV9YGUGW6fEZ
z6ab_1*iz4;=T!Q#XR>qJpayNZ-_FYlEAjfO&kcGKX*V~^==fv8&Qle{+43QA%LF4m
zOJR@5WNOHk-0jw}a>y||;;#v2jJIFy+`BkzjbU#q?|Ja9H&uT%jxUalThzdEAXtFf
zu5~)V?b|(eGFM@fx(8~PA>ar$QB;J}hjUy?@GuH^<W1#Qjd^Mr<io#KoF;gI&c0oh
zOR;KPc4k2dBhGJnJNX?nn9KNv0q#Jqz^v*VNAddJ%tendl(4Q_BA?8Kg;7mZ(Mi5y
zSgnCMZ+bD@f%3hOCXO9t$|CXLW+bWOlsacHmCn_+23Pb})w!t`eRaG>_P+clDeF|X
zyNA0<cz?uvD&G0AK97Dmr#7_fY-O{IQxlzSA%{Z(TbAc;e#IF)MI`#1>bvi2@#L~r
ziLQNhs{Y)x-39X5;%GmP_BEHR9$ALFdDEsP&M(GBuDiprl9ZX|ri_YY*?hhd-jL7W
z#Tw>3eZ6r}pZcIp=W;bk=Obaj{Q^0#z(xz7>1va`_!s*FGtH_#h<wS2oAagm>+9>S
z5uMw;PR=j>;W}vw_-F<yUu(wp?t8>{++@~-uP+Be%dfa#FGZhdNgFWnVF{XrwYRYy
z-*+EyMTGfIh&2e_wfYN&NPU%?_4~nJ{teA{*W<g9ZWP0#ykhN1aekl9U3GY9?nOlG
z4tOj%>yo;$IUN{3NS<)^cWJuu2R_ZIbrII|i&H2n+ikA8q!0N*?ezLJrGV5s<i)RB
zl*>qPxV-skAx(PcxzCMr^Oi?r8aHu{w9P>$X8g7se*Ra3{!6y(2kYNVGGnwZ{Rj-_
z<528GI5^<YEDYxvCja}vzT$N}8@2LwKdQNpNO1!YuU+tXUk|`-^u6u&8S~YzyMw^Q
znBFHjCD)?|SQ2`+(@GtrKL2zNab^f54W9?c(;zpzZsIX3?P9)3)qnzdQ)tq8pQM$X
zWl%O@Tm-8><gA)FXwboWI+7x7o!r?nUSwo&3+J80+k@*PX8zmjsNnBym^c@n5X&v!
z{D%C4oBhs%I7hDZ^~jR*pu|~`awzxL$xztMvG}6|#^lzDH<GTDC-c9=VFWLTSA;Q5
zw4-;rIFi#0Ndj)SB}K(zF*v8Z_w>k;KtV4S_;GMk&StH+JanzL3;`t>S3gBZB<>I5
z&lY#9U%?7W1WC0hUAh6MeET0E6q*?&urhGayt-c5`Swx;jRjX-UgPk=@H$ba3r50}
ze)c}4)PA`O3}-WLcBB5$*qasgMUtHUm83>;_%*MyVF7Lb;I8;u0W*q?N88p+(xrh}
zz(SzG`=J;QpKW-pnz)6`G0wI`{?f8gK~1gpY(I+{C&^+|*q0>pC12}kNF^pm!nNS%
zoLA_9kh@*+h6v1dzorwv{SHNgt;q`IY+dLOac134a{m`GX_7ZkXBsEpv5xR37NII~
zu>UG*?GjVX8wXbGMK#7YAGa&DHz+l1^h=z;&&^|JjD_mFCR^S8P@ThlooYQ5X)lmE
z3uKO=to8yXF+sEUX#z)Q?-by2wD-;U)O3?~QwGRo7IqaC6W22Y{duqm$FVsFY)But
z{g8FI+w~OTgGNWvyX>+&NB~r<P7wj<c5WB3&?=^o5Xy}OqK8JZX&=U6uWBljG40bR
z*<_rqfvxj8ThP$Ja?R3E=U%HJ`TopM!Qzg`)9mxA+t-0_c^V~JSkk(I%FlNf!D9)u
zffAm7H0Ph8>;OtW=7k+6b)a;abmOfs<jbO_SX8>qtZ8w%g=_*!MEpm+hrCS_S9TtZ
zxLVxj;*e9x*ijkKTYP)WkH_3<X*@b0t)s;5>+RS_c}Kqg$*n@f=K$xnm#~DgwzH22
z;>m)5{WqmU=BnT$zOV;l;{^Sw`<<OF-flJYkRIYYiG{avXWQc`M-%KjvaWG=1_MJ%
z8$X=8F?MUU?m3-?xtiq1FZw%p^^?woG9W=vch&jlCNW$E))suB^G5nr%pS6UOMlJ8
z@dZMQ98QdUutl)A5$!{*P+5xr9YQFv^w>lA_#_p>kyFrkz5ce9#MrsrxEWQxu34E>
zekz+v$n{U#^7aL<KSlH!Kk=b^rVq!jy7A9w-FQFeS4w++-H)%pcO5x<8vZazxNSQN
z`{(CrG1oa9{r_x1n!ixzTxH2@dFr{)>^rk>(upN#k<UGsY1*xkPsJej3hq#Cz@V+o
zk7F$Mwu`+^WUR!hRS6fbWuJIO@#@U@k^1F_@j{sv3$hK_52IK)8xmD^bn&9`^48w&
zNxdEaDt>F7C8Ttp!<<l{!SrGGK*`=w0O0v}3PJ*yV2{U7Vz(ya-V0RUebDr7h1kcg
zlf|%62E_y!nFHhF21?Us+JuTpxjV{E-Uv4x&W{twtFZ&-%}&D(3;^~w+;fzEnOgme
z=U&SyW`(M+B;GoqKiF#m`Q<B%>^$1o7j4Z^F$TI_ZLvnRlx$xB^qTr+3h|h0?6`b5
zj-kpqd{QE-LBl(c%4J1BvOsDu*Q5SCg5M<J%N%&fQih0H2D7a}=q(mh{3S?K{g07P
zFA1bN+mc1wR)J&;F}LaO%mO{jq``c@2Pt2}mOC?fuYJbwyIiCX8qZkGOrLzn*EoB_
z4;6v8DhpE9r8CX_YHU%nl$fDVY7n(Q`!MJP*j7g`1-!$^?6>GIRX4Dk9P~!BM(<&3
z1eo4`(xgB2KiIZu!6&OK57r7#=l1QLg}Y+SxlIyaz?r<ggV>0?VHXi!AIYb)ocIb`
zd#*uJ{PJ#Y2@jcox-uRY<TvfJq2iatP<Dn2MXEOR;sKwnN{(>MBcL^2zjW07#%yUP
zpgwxcKzxKOL#Q0mdGY>y`$OjU2|mgY`M$`Q=ZxGG^nkhZH5wNl`1%OQ5ibZJMNTgu
zqFLW&h)?KEUd;hr`Sk!eKcw%3mS_U7`rLJp11iZFl$6$hO772917m1G3L6bL3|mAj
z>o3eHaZTlxV%`AW(^uzWy_$5Z)lyPlcJ(Y(aL4AJORT4R1-BBMelwHHa@}LKX`K-V
zGn&b1s2XgwR8vU@45-!M9|o>wISjMrkLr5C9)lg81Tk!VYfaFxeJKc$e+ZQ5_9nKq
zaB<)Dm5~$vLNYWdyPd7$6Hof~?R2~(e#3e1P7FVC-`#-b&00bU4aUl~z_fz=vHLTZ
zVZ2H$kg+XZT}J~u$4<l49^tYvQJCfvO+lLMO7?%{o3`yg^Xd-H^i-%Oz8=SlRp+|r
zbp4@isp9?tFj1|CS4yrbYG!Yr9cXS$;}@(I9i43^@y)RF88adT$7AoY%$wb@GiYPG
zT0$L{#g|-_qF?;Ww-AfF>JHdfp0L}GX@ctr`8Icd`UwAP6ViG|r>NXksBcn{>%vw2
z8;b{g(lOC{ArrA1iM!nHnrOTo*EID!p~P07PN>6d0S_64xE<`5O(#}#l~6@nv>e>`
z-f{_%8kjl9hMybe6Hv{2k1@-d<d!g<k&{@@#BytqOf2FicgV5XI5F*Y)mpd{^&MU=
z`G6iHrAPI|+>h*lMF}49x=lZrAji$zmEsLIdz159#6#|CD_Kv=!%cq6JDNZCLiKeq
z_Fv7!%Ra!rnj#z#5uVXM-=F9LEaOvJ?SdJlcZz7sy^xv;%Ht3B37{g#NtC3IgSE;@
zas~mI;Cf-gx2+p|hMv_wR(LTZ*k$SjV&0L{ViD@}`R{S{Dp%>B+)JnnCmU%7ms<`C
zCQcQ{^DT#jWOkw!DBP`$`8lTiQ%{a2zHrUpKxnle1Zx(*N$yvE0wlvD6E^)~8IT)4
zd}<|ubz;$_Q;3~qalLv&9q<tA61m&;`J+KNef>AVmCX<AQ~D5=)g4MMw>x*E?GdHr
zHF(1w^@yUp%hzgYRJhd4;&<>X^Kjq`w$fOK$grL%EWg*(!qp|Kp5dEgGEnE3JxbQK
z+5w&5F^LM=9wG<Y{J`gJSu<JXJ6)&xrC*@K^1(`gmx5Ksa#%$3w><y83|Ld&5u?T+
z9N@HuDSotGyPN0A<Sq^D!vxwZct&-HS@zO4ljFOY1%}iU!TwaIh0+u7R>+_-pt+o@
z#RNLdVDc~848xC}NU69tm9V-~`qg<To4F@Wme{f)Yb+BdD-Y^VO9n~oG~fThnL+Gj
zc$EgB(Nk|Z3PtR8e4@<hHzMPZIN48`>J@b0D}frGnjJK;WNwnH<%}0yO7+4E4?y9L
zG)7Zwt>Be-Cny)$Uq2i6Q}Cirk^k?#t4YjI3Q%boMs$&uPSLmZ0F^f1vbQ#y+QjT&
z2^r4=YO>uK`348%xml>Iae3B@Xj$01L>caMY<uj=gtY`y@LoLg@-c~I&wQ69d8-6l
zWx&}|_BM0N2fAiNY8VqVnygQrqjeVXH0)^hKT>t!r2$Uttat{Gmu5Kr=z6@H#l4Eh
zqG||U{4k=^OoMJrZrUe=Nusi9<3G&Jsrfvr)FyaEdq^vl7`OMwQX;T<pm<-S{Xo}{
z5$Tp*u25!#nn-7V`{rgvp_>ORUnnr&hn{qfH6(|Bw}OF9_JE0aZF9^7{PQQH1uZLI
zSd2GbadXqGY|?%PZsYbd`6)W@?1`IrByRH9dGrxUEGHNR$fD}q2aJ87;hR)q_eLff
zrPID_Du~gu*m?CE$iFh)0UK?UGkS$Ta$2u@%v#j-#<AXIO=^f}pTMyny4DAk1qp1P
z4^h5-4$iN7ie(74SDUYoojxYm{BPB<w=~=TeF=hljoCLZHy||IpJIQwIDhH7H(nuo
zU5$~}kKLV9yR>+du%gBTda+~jGCYfPs8;-5sHpqnwNI=DiSOnib3y2q?9C}YhiA^n
z%qY@TQJopKv6tbckXsuYF<GrpE{m#sPHts*J-4q?z)r25$XPSTt;k9U1#QvMBt8Lv
zH^8~W$cd|{m2k$_Q-P84KEcuoJQm??JD4qm9r?GRr72+8plIwNnIY7=JfJdD7dZs>
z4RG?wJHYNV6_FnO0z^oGx67{8l6acc7{i8n?>H{(c@SDa_bg$QFV|pk;lW|_9o)6n
zXbF@(qDyRyvopOGSY*%g*08(0k~fERCP{v`jeIK>+OT=~^EBzD;%`mY2`fQ5W&!&`
zj$EmtX>cKchSjpGa<8JI%$K}sAa@Zou2UJ0Brx}5-t%2MqNz|`vV-mV6!L+M#bNdu
zlm)R0%vbRX#b>v)2gaXh_WtejR7vyy+vsi{rK+;>9DLG+c+n45BGc&ShxWOZoH^m~
zaI*FHjP7+#hacz<(O5OA?I1m*x$SU(euRxwS~DINca(558B+Rgj%y~&D)Ib?i6w)E
zylfh_HFA5pbe`6lz{J~meRJ+I*O3skYlYx-@l$EW4x~ciH>AOb;Rwrci-U&q&Q)R;
z4woRLaihsTq4~vAzuDF$J?Ey?$m4jQw)OX3ffv2ZeAw4m)bNkK0M4|t-{~Fo0sA24
z3yAE=-$6#REn!2k{O;vwgxuv1jWmPy9X$kA5Yss~%Uk#OJ5#zNGBX;C>TmIl3$kL)
zueTa@&u+ZM#Unc3J~U0Um+zJZND&HrgyK2Q7Oge~l<JEn*q_%6nxx~cyk6k@;z@@W
zT#uP_hUta28}!Q*@UlGDoEZa6X8mB$a|9}dT+5s_>B`4C`1tNMv=Ru}j}ut{A|I2m
zgXFym7D9?Oshnk+UjnthJuUtgu+PaY`bPn^(>I0&47xF>7<=y@kDN-O3#=SQzDF<7
z0&0gn^yACJPqhhafMYG&n-c@@iTf)Ru)MqgpRSbCH(tNeJlXRCl&mAoPY^#J%fTxT
zL{1tuyCb<}u3n`l?IJnI1=lK_7EUBz<YMDy{po2H^|_sF{FI!yz^A9VE7hH+$KTjk
zzl34l%vREc<eRiK)opD~GvD9%f_cZ{s-y1luYo*uS@<7A$1C(zrPT2gHiyY4UR$Ls
z)cs9NeqT4A9RnV(`qvLWsRivF-C~s~{@X)zM^#|IK~U<=O;X6QhVG-h>^G$@Vx!-=
z2eb=+w^iZOEcwuux2;_vTlaAKaM=6+l8yJ|DPP?EgBys$t?`(JGoiw>J!oIJoyOF1
zrJVFBs0+u+YVmp$g~DTbyI6${=#jD@j1Iy^E*r@nebBILzw_tnhUp`CtX6{o+aQZI
zN7bg==N@&a%iQ5srkBT)7tCwYnPhb8B9YpB76qX{4jpHyUJ(vW(7INWNRe%C-fOn*
zwJ`v3v12i|J8;y#Ojx=g)k2*bhy=&RFSvUKl%nOv6`+XbBXJ4+xKX<g<<7q8W9jvr
zme(I-HEv{9N8H2vx>J|wzbLhzBXvcEmxOCg+)~?dBQ#pxe!ij*Y8YzbLzQ=T`)b9F
zb@-DP`$KJ$P?L`xA!ZpRBaKe8I`?~4VQbY5_%P<oo)Qlh{2CLaS33(VoyRq*Ca!g4
z8rnu?PT8}w#VVGIUaCvN1cW18wYb;){C>=c7<BVDSDKvD%CCs55&Bv|%zVa?Qa$*Z
zxVJKNQ3{kwWWKP39K>fDN(SC}`PDo;iRJ0WLVzi>?%!j1tK>iE;}jl`O(PwpDc*N7
zPK!=9wb;!_TIEkt#;u%daMkskwa7W=kIepmJ|9Oh-}+vbR-q*qS#Fn!$7<D0;+2^K
z${9p2JYi0asj>W>Z6<yz@|W;pInzARmD5@CBLZHZx<%FHlP(bAUU*ZNI>XoRq~gG2
zpj>E9$RU0Ri{0Hna3bByY%ghwXdBv`nqt;2hv;$8_nVu8+nblOi!_H%R=5r?oLmB6
z;QO&x)ncfKS-(SB+2rw<EzzOaG9WXcMx1AG5ZfqQIFOe!_9+z2BPSxmwFHnL9)5Ah
z(B{dG*^a{eX13ry`3!k694uk-`LJ@0(4~#dy%?ot;VQQ%6aJ5%vxUY_<c*$$T)5Ii
z0X?-t1$lQ5DcG9^op#eUxJ06duT+|F+sX8gwyyytqk^Eec;U1{gVU;-b{hG}b?E$)
z(br@<jsP{eO;dHx@99VLA0z2as#lI?Ok)>4z1<5X`0^-tS+X;$Z4H2L_F8z!RGwed
z6pL6q=0K8*JOYoljgl~YWmAHjqCW!yb&Berxv+nFW*jt=6$-zMkc?h~efA|8f54=;
zj6yxSp!3^Y8fVMT_-F_Q-&dU=A{m!T5S^wvj&b_ic*Xv;lH;kjtm^+YVYT99;h)?E
zXnA7jttEIfS)IjpDZ;<2I_+t&Zxvk!beso_;0I$3DM+*P7Wd9>D2-W2J40~Db^eXc
zC93npXV~R-z$In;{`<fYpJ0Q_QS;j~cbKi5@y%BL&Gs=q*ezd3{P3CFG27yk5ZsjA
z@IlwFYh=V0v~qq-v-WNIoxqB=TP%a(3%ocRue|>adQ+^k86I@Lh?t+kuWB-7Q(w{T
z^TyE&ZDGcGT<ZBOgpl(LI*>V3v>0GxEjrEy&9^YLYKjFiW3BKE&JZdEnWCRMs!mP~
zd2%46P81)HGRfg_IBD89>|o9aY6Vl4AlI?aDx=eLH1H$<J_)(aIOYQ&TdAt6jQEKt
zo68pKZ@a6xhbP5}2r}s9^i+3~ls#2(^YvI9Fmpd1#p*QX*R;~3l`G4Lr4>bM3CL-6
z^}KDGAfYDi0tsHh;t4ovIiOm}pcYXQBZZ9$=n+qsp_0^`XbHf4Tfz*s9cf}BQPs-&
z(niJ%C%v}Y9>r_{W?@%nB|Ohn0zR)WS5_UYJv-}1AMlTO=b8o7<EZB@N1xjH_cyuL
z3tNOCy_})QkgNEWK;b3<;j(Ce(mWBD_p}#olw%*^#W`*e3%s&_@i)0t;W*LZf%6Td
z(e$Iju11xw2?ieOGV*f(`9I}v%I_ci%nPXUYojn$_Zrs%|3z+Oa&^iXy`@Pi1eS5N
z-(2_SZ24vn(MT+5W_^gD@4PA->Abwmr@0fbjZHE`>|jT(8w0n~)BXY;Mrf7;JtVAM
zH?xW0!M%+^#+UWolOXUr=WUz1dk+BhyIT!79HGTYKj_r8m>}2*{^oC>CWuiXkzxE+
zuM>>MHTl{=F&<g6^VjJVyp|XwderPlnBdciUUVNgX2>78S*gZjasdy>!(?|6J}7z!
zk?-@0R(1oTQobcG0|{r%%tFzyWXOm4Ogel3nH%6~nib4P+J9#2uN`_FJ0U0G4Rf-&
z48@;W{pn2DwWagL-lNGT)a%<;m=mavgrUp-(fM2yUzvLmPS!vy(KOXu05-qNZ<pP|
z|3?=E`l0fU>&E^VK{O>HWHLa^1_pFxI;sv92|1ho+eT+0<782ClZG+HiwrU;pA_bH
zuIG2QGX?n2u*Rng$&B}1`chAb0(=$I$bz&!8zI$SjI-UbpeFm-Enay(&t1uZB`cK$
zEuR<Cq{>)tE(pG~-JMS&5MB_uZ@@VVZop1*>9!izoeW#_y{9ExwT}1RBF8gPcCAsD
zI)A4F<mQ{YyyVL^a(3c}N3rE2TJGON4w`l=16+v8HHSzN-(fPmh98lx*c7l@5=#r=
z<IVjYH`p$!%}05z$F)RSCsqDC@W*Zb*J>H6&9;UICI_Kkom{M!J~b!YKm6XWtt<b-
zIn8#c?ju~ID<2c==+{iN8+lba!q4A%tkS7_(*PU@IT`6R>A*;J*73|C9pLW+#t=$0
zdsPzei~Pd%l!Mw^ISXtlXK~i@95Z!3(ElN184hm>)gdQ4n<sF^vmjY5LXg9#`-gCr
z*2sb*fCp93{H`{^_*dgvj+tRDuH^T@c9cWA-Lqp6bkz@wex<*bcX+qrGQa3q2maya
zL*ni6I*=5;I>&1UAOtAt`PAyzRGzY$_jsF{et(INzG6vxwU=w$x`JY=+{#(|wGQ;G
z%^yx~K#h3Xc1`Stf@b(^@uGX%Tex?cfuJwPQiGK2JY&`fuZ3quKgBJr&}_5m*JIj@
z;o`q-ci|+ESzE1%1H68~97Hs~aH-iQdq-ba>cKv4;@iCh`weR_;lh~}hqkTB&Vjfk
ztw}ExdhUz2jBg8c#O$pn1z-jrZu#rW!3#ZI03n5KZ-7ikk>Xbf>7gfvDB~5Z@kExf
zDpjF8f6b!a<La~Ry;-MRJ@azBD?{gv=DLxF&STmQ4dZ~UZvZBV4Wk0?{{;Q1lNa`S
z|EX&xtG;-ef{e|%stB`tb2#@Ts^2aCcsQ71&?o!$@PMro<<MY}y!gEn!F<z;!`g~L
z!H{YVt$%#w?uG;LAojLvgm*G%)wSzWpNZBQY3Ko;gH9vWMZ!fD9lJMKZGxhl<thP6
z&U|ZIjqR(%h?>?8mPY!0rAMMI6x1u-9!&$dB7u^DTi#CKeaVW%h}kdq{0+YUxEauD
zvD=F0(LvxItfd4anp=`-4RMEnx;Q3u_+q9vUt?~jFq)wpQ8`WOp-KQ2GkQfTl=hUf
zNN(o#jn>@93!LzLaW#>kB``_WeCBJoqcgPp{@l{u91bd?=ULc#?6g-UjyLr7oB4eQ
z8^2!kpYRg{Gb7ZZXEK!HqR&mczGq&)Dd|kPb?hkAV;CdCB3r7iEaZP~65up{{wX~L
z!yoKs)U-*r=RmC|iN+b=lRJJPfw~+whRL$ddI{5c7U--@RUU;$?6@;3M%IQKnrssN
zQVQj@B=nVCQVGyq#;f)(hY++G8L#H7f6S{1P0PeI<csE+(*N?Y##nY&+E6y=4Ah<3
zI*C;x6?lDV1ZkQq&W*DdJTPZAxQS~25+MFx?!Y}y#ADOcvdnkGDca*LJZ3yLkUCDG
zTZTMSd%)rB&0;5i=h<h{RP;g9m+NCJ3ZUZ>*=goHrer*;<9)&>R?&VQ-Cc!GME!GK
z4NXJD6uh+hP@*#FE}<`OAr3pp3>E9Gw8=eww)*y3eUmE*r|%w_;IHwlxMg5jTl{*e
zw1F&t*IpbLC^~qjIxkua@acG^y^rv8b}_^eTov6E7EAo1?>O-7a(}BtB?Ms<iO3IJ
z`{2F-g$>g%wmpSt;K)j5SYHYH<v+`*$Qc2=%WLNP4u0>I!8g|<iQ`JdRX?G7vpy)&
z?uYjWIho?~EX!YYHzJg!pHK7a-~v7bEYQo+1;(#hBYZbj&amLU3uxJ8-n(b}R*_b9
zkRlWY5d}q!1G99eM&jxD4(37W_R9vLxz-1Hp}QtspBQ4Sub6_KLJWgSQoLwfhH^jX
z#uU5!VfeJ}2qS$lbGh`*!*v)&Di5_1F`28&yNk?hPm+=exTK1CIOlOPnx)<W>?s=S
zVEy#o`z^-dg&^;78tko1qk+=QE5?n(jJs2(?jh@eBM(MJLW4J*(tUA)_%8}RfVZWK
zaL6>i0-Ar&^&y=|4QPpfP26seKn(G_Tg)yY{n&hh^dQB+IgNr{@SXp$)k~&MR4=Qt
z{}yK0%&eCGGP7)ToFcqbl;cwn=!0d=K%2b}Uu?$X#HPOE1gK}G$r4K!-eGFmVyf6o
z4nf%>hI^w@?~Y9A#`wrMjU05I{&ugCxdlx26CcBm5$0yHXEY(7&sX&KdJUPn47;o$
zBSW#oLqCMr(K0vSESx9nK{Z60A`G?VQaABLuk&uFie(>F$KvETfAiIFywwjmuXBBN
zG{0-r=}U`doQDSe_~78WF+$|eD-KAqqBRime6$i1^v&FJgx5den2k6Xga_&yNZD8$
zIkt=34?QiE%@Sg+6h$)*vd!nWBGh#Rc|n7MULlg1bVJRr1tNK1+ry=zybS)@I-&Op
z+{LAAT|Hi+r+xEk(rk95bufDp@P%Dv%DX#YvRxOGQ1KIS+1T@?vM<%+sH81#`U{@d
zon3Blg7{H`u82BK&E&moPxOxt@-GFJj?j<CG6)i9ydqT41kGLlTs0274D*g#SyKve
z4F;Vtia`SL${t5rW!IbNoVTq@YX$6R1A+Fbr#|izBfL_jfRr1Cenenmqzx-`+Szyh
zq)yfPNM6u;X8&&G;{jurMvoa;TFuWvqO#HQqQ`v?`1Uf#d#O~=t1_z@smb|3@)?AM
z{xG&rD8qazh!z|Ce~OdFKgEe%9vbXwBw{ff_oTY4iGq)z2JWf@kFuW`hWDk~t;DWr
zLyE@iMZO<8qH0I*95cce)nbE4?p)keTy!4TrA^MIiRZ6&N32H8o>-VNTJ*p1yF?%g
z`7ytVUCjM9w15o_>`dp|w|oA14xFaIyrGbfCo+4bW#bORhw#*>cLCyii}rX{3CrHb
zTSJIC5v6(At+~BM!aqZ)#JapT&yoZo2@A}ywIp0%GQH2_j)Jp|?gxIR5ptz)BCfsW
zeMu^erLk*~*=fIdTdPybcifc>V%+jMdF4h^`Hi82k39}YVyWwkM&e$!l7-AA(MiC|
zI#WuO!SwZA@<*ohFUSH=Q~WJws)GzHgo+_p{sw}U@=FuLco}gPD^f282_fxbxrzjo
z^WtM&U&IRt+!sjs#v@>sk+Gb!K8tfBF$&Wyj|;mOZ{NXPPZB_~C4#pMxf<QX{P?@(
z`Tsgsc}hl8|6Pxt;4a{xC#ehu$w0w^Y1i?mnL-Gdb17o!3tb>5a!iqBBJrsJTR+oB
z)a=f2jErymqJ;}WQzjiJMe`A(A>WIIDXz`1kJ&l-s+eUWr?>o47F%&1-fi56-#peT
zo7W(XM>vx1lm4L<Sr3{`s1I6H3WD}mx)(WnHsg083Vnp-vR8&)VI6;zY>vjHQnTsY
zaFNclCAE)3mBLB1r!CEanLRS)*T(Vb;Tnu$x4s2rD>Q(gPmm;!_i6!_iVr`2P;#{`
z&xuwus3?b-IRzMe3vOYW?drHs)~`n7>N4i8=hskYCiwk~=3Y*&;2HR(ofrk6SV7-3
zf3HRI7+6DLy=DDp0;q^X<W_M{*b2!;5FV@wV^*#aHO}*zV4`wc15pEfE6@80y(c35
z)cvZM%zydA7-8;!xlnUttJ6T7L-v#P%yDsVV7s*m$THO^I1QiXpFr_#OzdA@RyV@E
ziF6Olq`V2?Ldx<62A;lL{6mV~mq|-t&<0j1cp1IHdC30Dxruxn2yE$j<44iKyZXv1
zCS*gPkR$?ch@LogL~;&?2j}H?P4%Nv>Y?8$UbYN?=Ssm`E2&l@5SMWY{1m)96V$qt
z$S3YkQy<;^Uhjm1`jS<$kb+=S#u_=|hd%ci5$w`7#p;gDyutfLt^`=oqU^Ocfj!Vn
z>ruppiBB%iDhc>HhA)(0Hcni3fFHaW1^m4$EU8huA}<=WMRU4dMvMZJy>em|D(xrF
z`eieEorbK^g1toF*oDp3eG#9PE??vdnPVv;`0d8Hsgzf&$q?_3WOs|(iw!QbG?n*s
zd1f+huMtpTF8HhanG%rJB35-fIG~KX)ae%^oN_vA!5`O(R(19D{=qyM|8I3EWvN7O
z$DqJ5mgA*tmzndYL|~a&@Xr4&?fZYx8?Wy1G-TVrb+{8`A5-_9{s#Ibc_(+G`Y3RG
z#j7Zd<aL3U8S?A_xt-13w*GA~&n~AtipFb~g1mLql~9mc$m5DHQ&_a88te15nn7IM
z7W;u!qD9R=MMsu0dmoUl^5Lz{magyT!l0Sn6ZniK2p6BP-md+t?BnZMX6`hM>NAt%
z1(7BT#PZax8%H#{mh7`<b54!+nvjY&QdTW(wT3b@H1`>mI>AjZ{g#B|t?0bvSmgmz
z>4W_~*YQ%PbYs23f`*VXS5((Go9Qb>9}^Xs5HEDr*j@O8QY;OrrI+H2f|VOEzv%sV
z%HO#xJxR5dQHn<oT08!N1BeWoN1*q0LKQ7|+;GG5dRvl7!KZT1K$Jvda}WZf{?j)~
znJbDukW%k{v|R#|%e^F4M-5?NWBkZAe$o9EaLc=bhyy%+z)NO*6YPuvl2z${tE-*+
zZ*@xve3fs?7XKtaGTsF<%s$d|{AlIvXH+#9*HH8czsqW&ts5p0khu2&O_oSmK;>F(
zshN-+kfVLaqBRnowvAHtJEOnWEg2I936+6uUyr|DEP#CMqGXYr{J4h=NZaOr1+LCb
z7lDtHXsih@$ik;Rl2nW(eM)dG#C+?ne?5~lcOz-!EmEde#cuwz6qUQDtKsZAKszWE
z4X;F%cmSSrDuu(S<L=?miQy4Sh=q)Ap+wp4(B#M$6l0re2BY)+`3zza!xDk^DO+!}
z@=JPxO17fT%rR|y`bPLMQt9Wl35P5zJceXtUQV8I?9GhQM}W=`d|QbgmWF^Gu+l~D
zO>5i3!x9CqLdiA@Q%WBls2IrDz*G-RIpAM}{5FWsaql6#{2Nr_s_iO6LC0h^(0ldu
z*e?EC<<r_Qy$uy5CfbY=r6xf6DYtAs5)vclo?FO~fvLbTcVy1bo;~^Z!o&gqLjN0~
zk#t)h8<m_iZob6t;S`>Ea8GOl<ij3W_o}~ei0<qCj|#@{6fUB5GER4aVh!ofXPn7G
zMa^7no)71w{P|j}16IoCiNrLN_odf;MOTGD#__Yc`C5#Of|&bV6+ee~p`kp3A^}4U
za3AwXZYV6*KDTbS2Ar!?SAiEg;O%Tc3>BCTDMoW8T4}oNcZJptp{7V@t}<T5)m7Gv
zTUf}C891m&%Nd#0IDJor(K`sMmB6Cd(xA^<`~3)U5$wjw6MQII*FGedYoCX8%hk;Y
zC;D>S;dV%KNsXf{sKI;GRvA?r|C*G<V`!vck03zly<+E|dute#^Ceg_GZxj=xuF8}
zepxi80hFm&{@qCX#}XPUq}NWiX5p<~<xmg?j51S@QqYt-r;P1oY;9&Sz?Y-_S%c)=
z%aeu9i!J*W)mAp{k1;Az-XR_TpjQvT^fCcvj@EXrWXorkfl$Rlj>n;47UH&z!wi2r
zeScR!x8NV}et~7BD@Q?a(HB(7Ad1titINsNbsj@;#6ZFq${&sg>0b9))GKoUH8EV<
z(^ZDEcN?~Tz#kY0$XAIkbxm2d#7hI}WaN>wiH}k_EV@TtJwd<v6P?20CFy3sxoDb#
zV$fMgjcPIKqH#BNYSjlKa>AD!fS+1<h9D5&)tZZHd6PGDhzW^-n%2^X3so3NC<p&T
z%E=3RmnIZghUPm%y(+8`6C1>rWNxwp0gNP;NjM;NTYG+(zS<hncMQi^$DrP?Z`nOL
zPP7l#ElyXVUTHR-EOV0L%)w2><D&8DA&F#b4l8cAw08d~X`R3@Zm8TSiSjZL_K-*@
z^H$y5&B<4<blD*qK@0EEMO|f?B8R4n;&=^PbwhbNsmJF09)7agz7UjXGv@c7^=G!0
z5c(#u%mqbcE`i3m-!fJVGM7tVCx%W^wLUiSTN8Ctt43^xpEfr=#>LeKc0UcMM?LR;
z-nq#g2I)|l5V)e64FI*a4A?&WFEJj=mV^GQOSI_`&0n~__SNe!XgF24GV85IL^s*v
zKlI~cCv`pqdNnl_?LT#F&-mR{yb8vR4HM}4IX%d%Q~4%6$hTu8H&eC7_O(obcJ)S$
z@<<03jYBODD-rL2?q`6pDYI_)mCq)3VqkwfAFZbo>~zgiFeHoTXTEYgw5BRH-3ngJ
zFj$ZfSBc2XHuVL@a2_{^#o+JB%Rgr2gS>FpN+$>hq(HDy5VrWo-&?Nr4D6Ysd+a1;
z;(D1Am^Gz{h7PEfL$8NL%uLJh5)1cAF{vc)#LQCSSuGi!NnpGQ`TW%R(O5^Q6?>Nn
zZ*>Ey$iDii)3!;Hq>R(S`}+22Q5<h>u%9hkx`b)%R)Ta^m`C%bx(`ADB-eh+nJfa<
zf3;ov9v?84Dd}2>d_<N9*DnOk47?jBVk&<g+Q>0vSB0PWZLx|m;Pve8yb5WKp(gn+
zLc<1G@yB)gAe(QJ4Jz9Vb<bwRDnNGi!dI-Y&-de_GyluW!F~pNFaC#L3j^F0Z-Lxx
zQF0lHEP(^x;`J~TMzU$?y!|0{N~GqDG6EZ_OxzC@GH!%Jz@(2!9{G~u^^MV2dwyay
zdZ4!2xZdmbdkqC>T6u5MbhVRvfG;p89H7!AA#W+K>%%i^wU@tJKwiMX(i#Ea08m-@
z;f1Q%k5Kdd%)l}A9}>%{`?hI{qm`*I({%bfcdxjSI0q_zQ<z~0(Pe3`)n<HxBm6<g
zqBWg(j%!i~Iu<H7?!o7}cXxBR-$~x*fT=?HvbIa#q^E5E-ae^-rs8OPK7s8-r4OMf
zFx8C%=I_SmJ%Kx!)ehgWnn`#=sa?9&kmCx!8Vq<Afu3rniPys~JT*5}-pd(bjE!Ad
zu!+bKp-=1h+TlF=!iH#4opIsaN=!G7&ktb%QByOm^5{YphN+#)RK#ntakMN*IEJ?7
zOeng$fyTf=yaa?>CVrpKXyJ3HS<J>n%j5kGroGPZd{(o>CQDiU)!9L8|8=LZVMYIg
zO*nBv!r-y+w)J1N^e6W6Jx!eW)B<r0Q#<EPN~tssBX@)6K^e~l1)Q(lLgI+j0YZ3e
z(NeA#fNMOu90PeMX{%-HHT#OqJ)^HAJir(RP$8(W<wE_*gD(?|-jV~~JO!Y!WOpog
zCeJTD&XSaedscht8^uJIi$zFjHi?4`qD_*?z(~AEe=UG1-~MLrn%=D2wSCqpiLim&
z?P`p^7H`xjXuJv+1%+tg%O&*>p9ZEG2W?F3csjA~cZrg{wMZ{n!M=O}S^pnTSK-if
z+qJim(nxoybcrC%KuYQEkZwko!00ZK?vU;nBOP5z2-4Ds(m7K6_PmeJ_b2S^{@wR=
z&bh*y0wc2QXm2h*Dbggr42RXvrJk9@d+|5xwUcu|*5+%1PN>-{bN(>W?eVV+oA|#y
z;>&2hHv(FEA&etN`J8oUyN%m#685PYX)xb<)s{-kv_ae`7)Ce*ZJ<|tfI<V%9K&$j
zaOWaQjc>=Q0j}@ZDW}=8c$Y410(<BwlJf86Cc`;rj@v*ahI(AE=a(PL(hH<8T@+-E
z^JY}{ND0431N`M}b(Y-gz58cttE#@GHJCO^RmYoalwvlf#z?h}gAL4m5zR>H_zBG%
zr~vOJN9E>pScO<&0&MV=Td@e|YGiPNsXibE<$72l-b7k%lW8mLB3^7uz)1+JXeN;-
z)2He3IfWt`k<CQ9YDP%Z-L%hlU5cGTOAnJ3Xc;A8hco&Qb#)aUjWD(xDY3GNNn=kp
z?xUxG<(m3t4;z;ve1oP|2|g2gM#ZDO#0d)Lco}23)#&(Ts6vgB)@f}5p1*pIbM7ff
zrbVq7-!4_qwbe7yKm>PQcL)AM|8vSWduIa|x#Aa@`L(q3Zv*3YZJw(b`3+$<WR975
zHw&i_+D-97c;`M(-85a5(WH&OZsb9V+<uGPqPx>044sqvRQxk5HaQRTS}iX!^AVJU
z+=r7uf1<iT;F33Q%fPz9JyDPo@N-eMGt?8_|Esw**{H;LV@M!*)D>gEF+Ic<j#J^D
zuwytghi4J8D*Yvk{O4r|ez&}ac)%x{rwfiPjwb!1LNLb=3+x)Y>3Z$tlpwo6X&3!T
zS4ru`xxYBnTkh|zR1B@eG`d=WgqeRU2C|rknpcL+4wcWSc30?q8FH#JnsYe<k_mYC
zt4(vdAUii-5qqusWz|w7_vT>;XG-MVf6HS77xv=;n>vrlKkut86A~>+D^31JZyHT|
zw1B3(d<W<VEf(`k+O%6%w~E`^o@#|xr~bMI4VqFaVH7)wNCwa={QNPA+%$z7hRBK{
zk)NcOmlcu-7QQ~B;4v&f;*lD@jg=x>^ZEI8`}_x9*I3MVk0(Bj7=S-2`(^kOW`V7V
zST5T_IFoWZ{*!uipC>Ak^|qjaO<mf$3_+zfTTQCGWu)z0z%VMx%+@Vl+f5e)D{t2m
zN-jOu1P;KQMl{#T4(%lMWv@uB>JnQOD?EzidmaoRz)U;Kpk=E=+}fuG)Cu^x0($Ni
zZ?s%o%kB~I4YSC`k>I7O*3u=^Ln+`g<ijS$cV;#CwU<qc&zgUMIRJ?Ii!MV#p-o=N
z6{dvQl!cG<c+BUpVxI-6pb~ZJHaJFhj@&RsxAAN@;-CDtCEfa)jKKXg<6w}&(V+uO
zo2VbAjgV3CNpQFT_UdC&FuQP-b%Px7!L{ONic~{qU@WXm<#DWv%3E>h*c>-w+}0V_
zYe?v(F_f&Z@DPp2f3H0etv<+9e7Mo~N6CY?I@>T6fuav@Q}DsOv9Nd>?n_#P%gPii
zCw~RIr-owPp_nhDpK4`@;{qMA%mIUr{j?g@H0LNgP1-}My%e#c@j-7RAnxZcFGUw4
zK#d5TrEI;ke>)yC!N6{mR(1ryK0yYGatCd<wJw)@Ba~tyj{zs%OLcKUo~$Sbr>cJQ
zc1t`!$n|um%z1x!a>osG0P94Oj2zV}AIEt_=KLdk+rPoh*w4psetBq3zFVJ1ga1yy
zlZIFhfh0NHm{4Tos?(PXF6BhlaM)n7y}bQpDXK8jn$5&L^$X(V!026-31Wa7@KcIr
zSIV`pMeZc}<0JW^`^SEjOA-|!hgzrW8~Fh*ii6dE5*8|zRkvcu;VtaHnoPhyp(gNN
z9WIn##s_@%s!!@N6AYw)E7bk#>42i|C;r>E?QJ*ZTy3?jnU-()OY;~PqVYas@hJoL
zg-Dbsja!Fm3DM>uk!e^AHPvskxgm4woB$vtz*wD$7r?#0N0uwHC1*+NqT0nbze&-f
z9(S|=184&2K`r^Ioa$fW@YRJXfnw5+-5K3JH*(z}{D%dxbY}L)k%9^LQ-*JC`@PlX
zhkDe#esWAe*~ecc-f0heZVuL}LcQTu0bp3DH`WZ$GN7)T&0FWb_2_sGx3QMXaqLpH
zIhd@(d>J%l0^3^iO=$`_B&^d#l;S*cZagA};$pRRw|Gu=drR(<9=k{#<i^t>ybsxF
z!-Kf=tIdt>4^h0Gf!RW&J(@vTD_TU%d;J#47d6hZDTJ8Ki)PloOOmjoH)ZRT5b7(g
z2E(b2Pu!>jS}9NpBXDPH6U59au2(CgMj*(>y;7vJhb)!YU^*;VHV6JqrC!*v^z}Cl
zCigM6gF}pjaxKsU(D58Y`eDZ?R2?z<Xr3Y|@GYJ2umQ~1#@WiC`nP|2?Gk<18)0*N
zoSA&ecUeraLzvx>yQ0+3{(JBB{xz49D1mH~Vd=Otii+#-^Dt(2D(tje>>=GPBdTZS
zir%b4jmyGmexj?h2YicLS$}Lvef!g@J))CKh3TqBuVlRSEBsXg%Dt7{L(g=vcl$Qd
z{^e!vZ<~VRv+D(ODzM%#OYCW8v_m1AD)fi*YnRrLGUoB&_I5-j?+o`iKMgS!|8ygk
zH|HC3+`?!rLO`rzGhKcE_v8r*aJRjXRr8)LyeRII&9PC?y<1*quWHFNr%yi!8Pcoa
zL-@i6CgP^ezW7K2wI-LPsZ|=+uSl*=E$_hALw{hY>9nA<Q(7U)yoO`I!u;(L+S&kl
zJe|Yw&wJ;E?uEolMQjx+v+NIpcSoG#LW;mAuHApQj6G_fO9=j!Fir@Bq!S%}W}m=6
zCB`(OYDrdF%x4W~hZSkw`3-=4jbC4-T11Xb)w%KD(Y9#38xMYiM}GYolwMxT4=r&d
z342O^{I%7DL76d3XcLDNzqxCcEO5r(iH_R5HvxCM^;3KP^ezqfNY(i6F9fJG`TKX|
z8B2bowbh4)!Sq(x8FvupN;;@bEYS&2FN2~jOWwx92=^P{1dxr&KjIO%<J~J;&9?_~
zG8da$72pc@9zIi7*g03A=STSJ==m9wjV%g+@wL)M69*(5nTJz%Am21ID+jyxX6_9p
zQT1BUaI5Go%)p}Jd-r<~zY#M*0S6ES6+Mq47`+L24#E0R8rxxv$eq8WxaTHtG$fRZ
zF6jAu8**W6lK7~h`#>G;&CYDK9A3g3PC}W%pM06M@(#?GC~#tbTG!cin1-*q5bYU_
z9ZBHQNh2JTVKkTC`;E=E#P(?c0lM|wHh}lzI7i)JyHod8%+mbALmBs%P9qr22gPgu
zAK%DS9X+|XmH;bB#essGmaZ=WOkmgFjuV*TLjY~#3V^;1?!tM3*&5{Y<a6^d%e+1_
zD`q1xa;{77Z}^~fPZNW=yON5H+3(-oBzF9%{Fb5mCUNi{0xUt2j@m|yn$$^qr%sBx
zjyGW{?&Ian|2m9o?{)pnE6X$XCYkj76$5-z7NI7N2D_|UOHiA^`dY;p-_JvK10wZ}
zIQjJkBfNIER+CP$%%MO9$d$O}Ro?qm!BOy{JiiXQwcw`m$|k1-K(Y)+@n7_w`jlHL
z@7Pi|19P^Hh%jNKyL4ZaB_zQlWgnXhma}h<3Ix0q+=Wj`v-luzO2%QP8<eH0Y@)tO
z?NIkHKWo8kT)8t5fHeBu%}%Hq+4SrmRn}IA04%-`wMK%1A-cgY%pP7zy;Cz1Ny6qK
zODK27^}2PAL2^p<zNdG}H|a}>sL&q7_72uj^)z+Q@1<3?<RLH^ZpFGq0Ktf^#VQIl
zPQ)+tJwoMwB+50G2HuUWZ1fA}%z=XrmJy6gD;w2geS&)PAt92e>=tkD?RgGNeMr2=
z1j{ZpQLIN!5JsU6uzf`HM|PX*v1p-=aj#*<vN+6Jtk8TeR9c%?J*sRgW>fOTexdIN
z+{Az#s+ZOYAxyBM8nHGiyNdaFk^LD?YH)0yC*DfS14=DEQ{S2Uc5S$$&*@(YBFd*U
z^}k1@Ptg7)vN^-VCAqpoPG>;gyw0g&>HFvSF}t+~!$&I!AYpE%#vsiJpuybW`C}jx
zSdF&K_G4!Jt_a7n2DrH~(BMKJ11tG{l4&*f)z)T&7bI1a4_BXap5^Y>(G-rnttk94
zXyp0tcbx{MXuQ`mwWCRdgQ3Ft97I<8+G(DQED-|-%>aegllekbKdkq6Ek7UJ*2VGM
zSha3UZqiM^e}7xbXam*r5qinLvv$Rcqk`Yx-ge^wV+TSkNXrDH;8}Uo7fvF0wO=aX
z^UZb}OVx+^@uW=r<WJgQi+DnaIiZ!|!-gT5ftxes)rF)vy6Ey8`xW>&t(^)@aYDQ}
zXA9cm7jlB_*{l??BDYU7wxqAY@|<Cc@EiNd8Q4DIg<siyv$%7(&{)$rA^r54XjBlL
zQ{>hqHmDO>EAbHCyIAslm*9YUQLf9ENt8_FqPL32oh5enG*_yg)-@?M=91VeghUr(
z&1oGRoFw#nM)E&>-mG8c-&jUnd;eOsPMs9a6@zVm|98M6&GmukTsdZ7EJfX0hdQ-S
z&c$rxs6-ZN4Hlnq&}HUa-2MybX1sJwuiaHoSs#C;SCzS1o+v>sdLr4H4Q($XVd!nk
zs*%I#({+xUVk;$w4!*k~NoqS{L{4(5QB}^jIl<M}<m>>#tEvzNNhMCF`4GC~0OVIC
zLGJdx5<?X_b=eSZl(z5kw4_yETifHf)+|SHAVjT_fUO+}nh%3LIP%)+g69j1EuJ}1
z!N`18r;@f{5vjBDZIO3N%K!@^a3ir18T)b<by*C9c!f}l@1%tHK~kFZ#~M1tqm>?l
zuQa>^x-Tt%3va0>f?k*BIIj5ew`Ml2`ZmJDt!<@$SKh)mox#>OMNy>eUww!67UFz<
zEm?(;2vC?6@1y@Vj=*YPr4lA1eHt3>h&BHrzs;j6goE~1(3iq!@(3j0H1(r(>nrvp
z9a04=gq5%%FTL>PJAHgweY3X93O>d#9-x~9b)+L;UJ+*x=;amo1^GWCa&3;w+`l2i
z64g**grfOlKt0pTIdf1}2D}-H3ss<nDhn{Yr;0Q3bT}!RrG!FkkVR}n=~p#?0DPf!
z2W=qh9j#90+SA5BFr|o9NWc*SJsaI=Yd7D~QTk(V*~&bE)+q<T<D!7zy4xFkr^^ti
zJ?I6QkJ$QPiFk2oV6^MqqzJ4GFg*!vdbbwH0ewc%q^DQlW$UPItT2wyzq?1NRv+qU
z{iY`R<BI{=Uv9bp>S(VKwg~M%H+!T!CepBI4glUuVhCXUiR+A{)}5WR#a!ZkPmb#<
zzZI!+8p&NIqYq%Vb*mMg5&J=cW)@R_`6jt}F=+RiAHVC-$r5iB>GC6N5A|n-J5Zrm
z7`}H2;C--eGgV^wM9m65Zn#On{b`*FP@QGikg!f|^+%*Y^WGYVDt375&TLO@{gjZ+
z^-X5251%nZ1F%W#qCSkyqr+~Nc45i2yxMVJ?jo9+O;E;~4<*VeIfWU;eZt4^kD<5g
z;IeXzqR?7*DT;@-ASpo>CD(fYbnvK-aZlvqe_x5)3}GQiW`a-UI~2nll#yPDfsu@-
zIyTMj`w{|uS<zm4l>Y65Nqct{r?UDau98Z3^y5U;LCOQ&r;ug(To+CPtDU9Gkq`p#
zlF-HpEzlC!$4YWCLDx69@%$#${VUKPHA_oQuuZF@#I_h~Hg*!tM6EE;S?Tb$L<gx@
z_3D7Mi4@7N_gfArwF(cWhefeCZI*_%D4|od<5U(bLUfbD<=f3ogx_Ius!nZ{3B_m^
z=)0a%o{KGx-r^XmtXoZEelMfDEK~HHi1KL-292(fQ}VM%`9f>~ql4uw924BC1|bVr
z3<tT%@aX<geTy}x<#F=`vU|;x7b~mu>_qCK-=ik!fZu=Z3(vAc$_tQJsLeL1RuPcG
zLa|28UOfc(>^A%AWvQb9yL;JQN4QZoEO9x@vFK`e)1ZFPBaMumnWDDSB@hWn)}03@
ziN4K>ep6^G1bxeF8cT7x<-cJtVVn^i_SVG7vSsG)5@Xgw@853y^58jk@2vjsJ&`zf
zTa9(x^8M2->&wv+x{CNd#jqQUc6$t5!7qUYg>rf$nCh5Z7k%a_uW@O)JJD%B^p5PF
zrYfs9(Yj3thE0sdj+60;tZc^zmTmF(aXT)vE5?cm;=JNNT&S)Xe_G8xPHzOM+PA%f
zz9%Sm8`x|r`AMWIcIFonC$44;b$7xNynB)B50%XgbVMejG(206#5eV~F23EIRL<1C
zx{T%n)MSk43L+$(C5FG^CZ4VgY}70vR44K*aFN=8FMc2!zplOklcth5WP!Ub_hGYf
zke}B_f4Km}`7G|&m=PRbH^w(u7MG-|C*=h^oG6LX4~L~|wm+kutCbWAQ~r1u&dET$
z+?^IGKm{Xv;AoK9$K--5-X$Hl5lcFFB5=R?&{s3=9;k76EBj}s<K<;VXz00UtjnNa
ztu{pql<P2y%K%fW=F^*?1d{vK%gS}86k6jeXp6Cy-*JO{9~)LSkjtk(UCZhJ(d@aI
zpHIp^UxU_TsQH9+SRozHi!gkI0GWEWHU;Gj(k)3t-F^vAj7YP%qg#!J9<HQwg6mVs
zIGP<YJX*P1n;(j<q@7!N$*f9(^=X`p2TL2~tUnmz_t@7j6u^V|=0_b|X5Xk|H=ie4
zda$%?uzVyb?ND?JvZMXcvQrn=7+Bl?Wz2hQ@oJ=`>IcEWVgC#?6RNV);eHTsQy)0`
z+F|Owh51aHPHo}1{*J_0JvYsB;mfd<r5*qKvW?Gz5RCi0o$Iu`m~+(uP~uRf+VPw%
zpf%rj1$Nm)ZSNMVIZ=1W@R+nbn(8L+NSrH$^MES%)DO(RgtzPIey^V;=4qXvtVrqo
zFtW@RXk`KU&=VJ?GodA>vQ=L2SbxV0Gj(>jHUUi%m&i-B5{=ATHAXed->J87oYX}O
z@J6a!VvN6Ax4C>*ygGC83Hd7?Lue1hX6!YdsosW|g~88BtBJ=+y--}$^Nof$1xmSs
zOCXdM`|oJP|AFIA+W$=6we+BG*4c0B6_VzRb?XTdtGV1C4;~FUa;Tz(6OClf<xUJW
z6B<qW&h}v{W0k!9;<>_&y&?Aw>SmHs_ZlM>70Oo*rZ9HMzrva7_49wD`ocWH_7~_4
zDk2SnqSK=Y`<PHsn58UntyYA;yVGrBR+GvA$GS3dQ+KI8IyyRcp3T&n5U?pegG2*e
z#nD_!qWwf`F!Z}lNkHwV=2be6o+Nn5h6n{EDeID8BpV`6UqD5vdQh}L_L2HAWbVsC
zuJ!RmmSit6p56s=ATRA;OD9i8GfWO=JR(&nQ7k#zyZQE~B}biXzEd-PVZJDu`)*qy
zYu3!%>I-nlc~+<qSUD`4mGto}K;}!Lt`ne;#FlF}6{!?(!t65h^Ar6z|HWp6JJiwK
zwkp&Vp@skE)Yz)up9cxBt!vf7WYaIl)C3I9<=ZL5+HRcNr-C=KmU^}$hhu2a%>L`z
zc5DAdr4Gv=<z(wO(rk$6vY%p~Q&aI2s1~Dz2cT@Qt`&2Z6~|PUJ)R?e6^dti8vB&&
z3ffbR*Dtn5;WiU46zcFW0>u$Ag}bXX{(Fd9)6tn15z7fy7v0?0Pf$}iM^rYho|#Gc
z8>t6h3cV@+aOrIW5XzVv*D24bm6oKKNSwKN+~@K@56TIy%1^d$n;ZmgD@KItjt@vu
zOqD1bn*aDQdCIJ>JXtTa4D;aEi%^1j9xZ?MnMR^N;US$}0zKqcEgbuarPl;p7DYL9
z@_`5aN+DUfeaj+Jjiyi-U9-Wmd~Bg0{THy25h|n<pU8mVSo(M8k9Udl(gAz96_-Ki
zP>h}-aB}XpB;yOnFuTZbhfVz6C0p)2M~Ch2JOLVmdjEPe!WY8f<LM!U%&+Z^0mhv!
zr__OBx30pYIs@Y-KS_K>#v}-?haV|D!R5znVQ_4VWjtXHZjrbx%Uwx1&;6Sxt-Tkj
z{_of#uY;C+9fWoP94$NI+wa8Exn_@j1?0dhTt_DX03R={xqp@qsnHC{0<$zQS7o5R
z#!vj!zJdJI^disi<Byl}t6S*$0#yXxCr&XH-%{~j2n1iBAQ91rSOje-53<@*{DT}l
zDT<XR=^=e)+bNjFfkKOS1{CTFI%{aq_aQWX8P*ba+IwW%7HfJp%04?ONu6ZLWb3V4
zxOVSn7NuB_)gb-ph0P-DTj#wyGCn02%L&fIjTcZSE7J3$#?H5H<js>--yi?s^Bifd
zy=*Fg(XTYn()3!c&ChvA_jemN2V7Oq%{&Xa==`yyn%5!z9^Bpl(4YZ)Z4Hy8ldCVr
z_m8Zp<Lrjj34;b*XCEltNK>fj=0lovv7({{qPc#+ZC*4Bd<dR7-srN<`6&Q*c3Wt>
z@L9{BtB*nRS$D{BHoE>C61G5a+l2ogK^awBtyPnMhIkIkj|ZaRKm-OK2qJx&qv^0w
zKBA4T3!-PP{|3YWhwWngX5+C|Pc|Ov2_wyfpN*7Ye&uQM$~YV?r>ZvW*p&h$VWC8+
zUk``}iz@~a0|-tOLwFEYaL+am<&jj3pFC>;t`Q|*W~_9CP8otT?qV?)5~K_Sb7C@{
z{uv$Jol5?l$>GzMOC-Q(g#&>7-aPj$I5WYIPFl%oyJ-fzvKr-S{QkRZ;aUQ!H$Z+-
zRBP(una?gXr?MuAFSvne6MX0@Vu8}j6vU-wRIWB-5qPTKewdF#TUs5yqd11Y;&H_!
zBR}pj;>!~v&g#acw@envw>2A!9Q-}Dj(^jjkW^KhR3L7MC30}-=QxhgyY*!lb9c7y
zg5=aG<cq8%0jIpi(+#$|FUr4>)jGm$UAtj7tx6*EU28zjL&)YJvRIMP`O&(Pl-@M2
zyF<u`vD(t>3=%QR`BbWvKVV~qn*Y|FCh#$__<wMVvr(0C;;Y(>&PBK*iEzk_wt7E3
zc%CZEe6Tzkw`Btd&91?z5|OYn^@Tun5dYftKsHv3?`QELTIhO9^CZJ1t>?F1#|97m
z3=LiOnR{UWa>O&3_>mz;7g{Vxb<V=#TQ94xC(a!jWhr8Ej3vn~Fk602d)G}?5?r}$
zgm23_Q%d)&@tv@3S`u#VCFmdZ5-k|nbB7++ax@Z~AY)3eH+5T5!1~#5@aCn7Q7xqE
zgS#PoREos6Hi<bn_0yrRvP5;p?`<y?Ey9eA%3NMd?3!+FV;>W4Hd{mzo+kKksyR$B
zPr}?aw7Hq(lg&t=1K1-1j#J1bhejr*`MuVGW)=BCn$B-3DE}fr*g8<X#P^d8V_1+x
z({T1BmR#jR$Fpj<X;fad1S3aM3<d3n^Y5jZz}SGr+n=nljM0n0mRGlZHTZmoYi77n
z#El{SG(;%(rGN1_$Ie(V)j!!h4gq^)wGJy}&xSMAz72Ze2x|l}*Xb9SuJ*nT;69@=
zh%!GQ)AIx<54zC8PpFCN4$wzHzRY!qjq0*m8p;$j!g3mOsuR(Q<>JZ{WYz%ghcGN3
z^eq6Na-3P$`9yXICsZ4qOU!nqk{qwu%k3VZ4O0GCQ!fCn<fXYYzQ6wEdzEMe4{76y
zwGK`aw-l-xas0h~FKV8!X?W?eCy4<#iY<`~DV_OZbUAt4NewjND76~)K8xV}c|EZy
z1Utu4o@*49TYp;4bxI8TH0*3r<>Y!S^_E7{R@-41q2>6JwA&IOzuS9mXrHu~3OiWv
zu=vJ1YwKuq5IbIJz9x&tL`{3f1_DS1(!#4Vp%`J6LJ*?%>BA-X4{bE%z{1K)87~tJ
z2{6BNUeE|k;vSOK9Fjq~Ld1u;?k@4-dJNo~i_d2-)<k6dx6yIH{g+obi$wP<1b>yI
z(5d(}m<(kHldPDN#(;DIIxku&e5e}%N0J{bztLq1uR}sW4r!-2!i&x2<lRLU9knz*
z*{i#0lLb1a2__MPv;dY6Dq0__>LuiReCl5n@YNCDCqi%cj=uL+_RXjivyrLWqrz##
z%JX9*F3;T5tQpWtotD$Sb;^Z<m4CU?MZ$6dE02=XaHkO3q~yyERZ;-QUdFFq(Fi^L
zTAks3%l22s39J=^V@pFOm8P`Z&=Y%H>>uh}OR?b0yqDIW(zEe9P;{@`!0Ez0)O3_9
zpsv&9Rr;yG*z)|tr!&2dP|wQdLP~W+mMU?V0s}WErm#o>Ui#;yb!Ds9YUvpV?<U4Z
zISQ#G;Lu8duj4R0n{2nYHRLkDh^n(W?Z6(@i7rh~rBg9lASx>Jk8QNSKfp~{Q(tFr
ziow=GE<trA)Yg2xeyT;hov;L*3P`E-hkd-0r}ZMYdgP)1CW51gLbCsMH?0DXyzv}&
zZqcwhLPfzbkO-h~KRfQa`5W;>L1`UuUB6h_%sDk*#*R%FBSA7I<0z>YP{nAC9cWNs
zDg{BzAQ9UyI0~1MJgXk{D~+L_l=a#Q95L@N7KalveiZ*UDJnlygq+{*w{}CPQ0mh#
z<-45`32TvSOjUN2|CF*%^02fW&7>gB_d&NHW>au-Y?m=&?lmkde*9@zE_ZwL3}izT
ze7=SCd6UFbwm*U9#5)6^y=<0*Cf+3G_KXKDUdcd;w}%TtZhHpFNgUv+@Fd5uySm29
zt-*T%S=HA5GC^~g`oJLab<96+E`-cN4Kn_CZQ5V{`8+1s2##KLe?Yq#%bLG>-s&sf
zc&u<+bI`DVe`{>6K~j}@PPA|e%UoP=C1X*y>OI)R_R#;G<UD8YoRxy>uW*%-f8#Y!
zl>V5%=<Uv8sX;o{z#J2dKF<m+)=RGDne#k)mA-rzN`Z}CC-LB$b?OzLM4$GG0Q;2&
zJ7Dn)WyU5F=ICC0$x+1FHeHS>mGgnup6_E$pVK}QXG?WUos22T!AFn)LaSXFIF5Wk
z4PJQzu6iKD2-TTQ-cRo=-D>FUkn6pM?_xiXcUaO*9W|M<w0=XD<6pTk=)(jpwRmjA
zFyU5eE9>%**EiX;&0ojM60p%$qEaIEkAW+&#-vW5l`~x~tF_0H-&=;!ev@WP#5tX@
z?VtXXIJ5<DN8+$O{qZbSvU_&Mi=V~stUECQ{9gDXkgN&Eegt+36=`9!H^)`=rra|@
zn=o;GM0G)M9R{bGgaM|<xxWeDH<N3JB)n_3djHv-wkCX1$jqG|7qwIO0hoJE&I+{O
zupf_^=9I@0u-;;AWbZnRdRB=tL*hg*qwz-a-M!uZ-Vq$%wEo3w&SsK%^cj>5%2^FS
zo`93OyUv07OCJ$i_7x8lS}i^D?SI6o@Pufh@bC$adjf5haA|-pVADLAeG(N0&moXu
ztc{7xdKJd4oH7K&Dg<VNBAyAWA2!F3PT4LCZHztbF}D%pM>G26X`T?~RLIqcU&Y8E
z(jxhBjiP3EpxMvJ`jcwM{0g}Gs@Zkh2#HEGV0Hmwy^Sy$3~}KuCB;~Q9@pwM654VV
zh<#6hgHmG|Z-Tz|2vfMrcPty8*&jbnbV%w`L~Up(IDf;*cQ~v^^Nv#D#FbV6hw)k>
zS?N@mMwGLU+60})($R)UFbdx}U^RESwlpX>n@&HuAlaV;=+N%qJ)4SzjO@D_?LsC^
z+rPOPI!c@ibkqTYLVEWYF6fwb-*|=0{D{^rQZYs8H9Ac3#LJ#a|7&WFdcDg3uDlO%
zGuV?Kzbxs+Da0)V`HGxW_P{4FO~D+-&RRahAUU^ELDNE8zHIibEz|&AXH33ze&ouk
zoeWI`E(YXO-f$HsK^naD7!gvP%WKTP(O<zZqD40KJi-WY5&;teqMdETF8y{JL`8?+
zA~)m4tAMOz?6_d+^-hMjP)^}QCJoT3=pS1%rAmSw)U?3^i@@pf?PV9R9ng_Fl6(oW
z2*h5hc3|L<-f7E!Mrr~>mddD-p7deZ??TU~Zb>g-ZMC=W0{9pkAcw825uYoYd2gGV
zvPXl5@{ag{(Lrq2F-E!sNNKMD%_-cMwIO==+1CKHsg_G=#^=T~KAozEyUFt<!J5KJ
z(lnSjT@4w=$QIUhp2V9`IOozwFUs7HlgW1+6p|1h@3NuHh26)a#VgjlrkPX!p@CMK
zzjdU0gkUP?T+GKb&`XpwNI&kLM9AfN<00VJ=|<=y00)%rgR;UxL|9V=A@#zvChI-W
z1;~W^^7|8_uawarg>?ZbhuDl^`(%$r&JIRgIwS}rd8hh&0PM>n)`KzjaVSNBZ&vqx
z>~p0bd+i{8up<rzFtVWOFi*LYEqd<zKtkA91x^y^!>yUgDi_h4h#1I2<V-!Q3QOBO
zbeHt7xZ*tk7E-h6*XWhj^WzlmF-cJTbIBg8F)^K75vAE2;l?{}7pd8iZG9A!+q>aZ
zNX>eFLK}8ID-YbIDl7_|rQONC6m9CoSTDC=%NMWmn9GxL72_(2CIGWHK6~g~Y57R7
zfcJe`^qI%p>i8`yeXDdSbd#sgO-;;#uEhW+d{O8N|H#{UuCw>-kLP^D-)u`%t7lL=
z<|?O5{a;$x|5&S4XA@8VL0MuX>UieTjkzTX_|!)N*U#Di$wd0B7xr}cxT{&!@nxY9
zrY|N0BYojmc!t{COgX0fXJW1E#uO8oZLIyNfVK(N_Ijbm?ydmnG4I|-hdo%3Bw>^@
zI13<E+j)vE6fmJFoojD2q%_<r_0JGY>&klTrp~E)rDqVA{-!5AIwj%Lc$tOH;jMqP
z=z_Yq{fy*kkB9{>o=b{}ShWLE0AvR;JsKbbcthwS+AxotB<a48l!MbN3TSXTZxm)_
zoCR3$(E)cqYVz#%{D#PKO*RH>9Hf5FukV@THt-^TEq=yZV9UvRP^M{|-$C*uJSZ5^
z`_0N9255EH?MF+L*XRc1d5Z;KH(=`Nr?cU1qBHlDJc7I-7VcaHK>C@g_i-CBTIhT}
z6YQq%oo^3P$M1NI*|81x%(V^%{bc~7(%y^ya)28#O}TI@_u517<;bzgh1?5;2y`vS
z+P4c|frrb<IqRp(H|sZJTRx47Vzm5&vNPB_=-9?c?R7lb6t-);wN6l)4fvb8#WoGL
zaZB8hvX!RTTLV(nHG_I(Ud2VuVhr&krKdd>W+o~F${#e}?pr3Mp;9jvZ=1zkEZ7vb
z<Ul&PIip{j=IYe8axquDA0^+uIHx;iZTPZ;;a4(FD9%VxT2{1-w7V5HUxh`5Dj^WF
z1|JkGw1@93vN|`<o-cW#&MFPx2WcvEu3h!|#Q;{*LP9KWZrID^cDrTDTz&)x(Y{>I
zEV9d-0*xegwqbr3(zYzh*7fmfqxe$Bhnn^zeyg$HpxtJXX!Erb)e?!z%5;9VT=mZ|
z^#30*HveTzi*hHh#cs{S#)+w+nSuz6!k%)G47O9Z>*DA7KJ_Fk#A(<KM!S<Y6)(U1
zbu$)#Uh11(igPL+r=+{QL5xn*q!18Mb&C-$WYaXqkS(M}@C@;+@I-_NLaJ8*$mp$^
zctq1)Mf<9ri{TV~>E+}^f`vWEX4~gI%l_aOnEU7iy)dKt;KeadfX`GkGLor{3gUu!
zy9m3?73_q>&(go)K9Y07I8-|P48wX^GVu!4|CCiybj12Trf;Ulox(Z;mCu>!GWf|7
zeemWe#1Zxq<`@?JJ-?KJX$3trCV@5(m^{6`FTT9lc}jNhK4(?Z@f)U}Jd9v2$<fH-
z&R6yW7SD-}k8YB4H)nNgz*cgrcd27sQ?<e)i~nDo{s$O6fMAFQ^$V6ef%R2$Z-QGU
zbLJ@!Wy>(aB>M~W7XmPFS@{G03&+K9@`;YPbmdHP2>*s>o_}2_Eo5>t+38)CJC+F=
zO!Q=?J_qcyPb7dO#1=$aSVXWt?5cC*{+Pz#h@G2sbna}?r!xcC|LU{~<nRR;<-%ys
zfio>H$G?X)9*kKgeY-a)%k|;0n6v*wHEX$`YM7VwePl^nIilBgDUJD2Ciy2^jDF4X
zifDYqFNec;q%O$QuybQ&L{Rn5`FX;A+JmZC5j2Cg9<NY1UJkGH=SCPe$t{!m2XXy?
zPphx+Fi+B*5!Rhun$$SXKxd^dl)BTrP07y7q<Xz$?MUAzZ;S<&T6L^>QXM7EdRU?a
z`Go4|cI}}5yTnjKJ+HTaqw-Xhz|zl6%QH-#DS}=wd1y~#07&jC7ed(@w&W_ZH!1>x
zv2b(B!oVOYQhXL60Ha-So3fXw!8bJ9<pY78j`s@t5eU)bg{b!$HRZnAp`Xe_zm&xZ
znFrjwGoLu2MKdUz%?;s8B%HbFJiNr4ClDuOzH7qD7Tb08nguoMCehcnXBjEBcY1f}
z(Ff_veMA2&A*QQ9+s1W2o<u@~r{KK!lo2=nkd#Q+Yl!qv0gxVa01?2Hap<i!1Uvsg
zgt(kUJoN6nPZ&y70=!F+mfdyA%#Xv1UFXb7;2F<N4ai@LA4b{%i{+dG$KE}q2S#x(
z51b?EVQ=@6(_vry(E}tLMco}R0_ouHhj01hs2Twe&O`bC5xg{QW&RQ(mq5_uLHHZl
z5H$&U__>NfGUoFgo18oWu&6O_)s8_bFnHU+gRRAVTQRRpx$J-?NxKlY!Q|tcTf;1V
z#hH$<v(n`qFzocon{VzZC1;_q32*Gjc_Wp<BxNIWzNyOY?e`u=Kci%1G3zsVcvvlz
z7kPTVf3Nc*>v4D|Ev%F?#NBeaFy8y_x}or!uBLTBAr(L(cPP3d)Se~GY2Ycq8;f40
zasLg}Tb_)nuEk@C?6<1c%_syTc{7x-kUi?|R^*2SC!u7;ifxlYj>xK>$J<}!qCO>t
zPSuwW#>|%KFu6ZhE9TviG)s~!o4BN2j|q)iNjJ{DDcz_6%avkoi!PX|fW9&MXFoy<
z0$=+5hk3mc)Ba~br&-R6k~M06ICfBfQihI35EA6x^o4SE@snDitk#dL;`noX)?5n$
zoBiXXH~*|D4cR`QvtVs_VjzTDtg~O#yRuIvTX)Y4Zed22hl&~!CQgi)r#Zqzud|`B
zk4_`G-;lHtRmR^oc-p}}RhbiNMa{qHe11}Ltm#a(kK`@*%H7yYRTb?f*Jjn%THt1y
zP6Ro(szJGEQ)mTpo3_2Z*E0?l9w%<uXO$P~f$DeT(ZypJ3mLe%)4#DMdh?MhRNj6W
zYue<U6%t4DCgPh5GHXUQdrnFqS6QnB=9Wf37a}_!8BBeI>EZZ1>ho``i{VxaF8T9S
zH%-u_3XN8U^ku^w*`KX!&_RY#Mg@Td4rOk`ZZxC1acHXw%z2%_xP8m=<O$u}f5Y^1
z<^N8V18opU0V<#^!*H}_24vI9U_X$1#-{b)mfO)uvRjQ%H+h{w!Qn$^(3p?Q4j%9)
zHE57=VrOgMIp=D?uq^;@F1cf+XVbqs#EJDwcLMKBSc+0c?*e$)PXv8o78bVBq2ImZ
zhcnFTgn`aqJ}dfV3G1+DquV*NJ&;Y~5?G1(Y_-r!m1RvXwX^5secDiMDL|o)efaoO
z@mg~uso#_Y6jhEdi{}06VEN}U3ZZNaR6dmwq!dJf35r0l)X5qa)3XPEL@<J5LLXE0
z!`;dYda;I5@p-ncVO#7DkR4s$R|Y}Ft%wKay3)%-Tm^5EM&_f5Aq-AbW_dWX>ASku
zDd=#Y8%xe8Z`k;MYfZnhf6;+xpa__0%WW0<h(J|G;^lR5<pJOmlmiS7YXmGlnn`o}
zBnl@RdE3!st2&0iKNtk*sU%AKjek#L;^{_(jK#@QhK>t{4G24kl~?pCmM!D%p;vHO
zOE9$R{j9#E7$zkKSpb6;<~+C%sBmOG_L5Zb2^$-I)ZV}Ap!?UeZtnx+vSZmZT!l!N
z5tF9Dyib7V&>I_esrkZoX8har<zQGoU8ngn{~5DW<+(D!)-PLO4d6+2lB7+bgU0U<
z(jOkJ&y<Ko23&dhO@@9HHggsn3y1AeDW{~S<5{?ymlNE5_fq}CbtuWb=CA8PdidUh
zyn;|MFQ={dy+ka3R$c9$*Br0k9WB@AeXsUCiMuo)@$>2scxZ!_Heu8wlmA}5N%p_9
zsXE1(H1>gQ2qxC*UP%&8zR;0rT;)gtTHjC+A)&ErSE5)N?dx?egy5M`2_nh31xXzN
zMRzM0W!lfG<~ZBZz#xOEI$M^Rl+_pqYmiod;xVvfHF@CDYEi(nv1J!+p#fAJ8}CRh
zkD6UtI0U$MX|!j9t639&x6}5Lkgapjl;EsjtW1U`ger4l{))^kQ7M=d$?D$35y?$^
zxj!?dlUX~PZQ6`^fg&}kGI~o^>TPqIJHfvW<Ao>heuhSI$L{9{m23teR~F9oMG8oG
zPsoVUb`9nadc!z2KVActv`ObJp_Ybu)wQ;SZS*A1Po(iAwIa5!xg?iw&vRS(gUn7Z
zDU$f8sA%bvP2y(e;sU=c1n8V_FB|>6t@cD}{=!Z#V301}P@UvOa!|o1q@jq8PVRU)
zef3l#+P4uqvIYK;3K=s@sa@BecA2MTU(oCW4JE)))@}=D{=0?CT$@;IXO{Z|7)$=s
zd~yVU(7OqZbz%rR{Sh^3uDd$!XX?)C6HiNAPui8=<Hv|^z24IG&IPgDeu+ocW;bac
zfmR!uJ=e@=_QN}xE&+EHfg0Q3h-&b0J7@g?(spkK(Fq4F^U!`k3xg%7an?t{bY6tg
zw(o{mUWe*2^eu_Zf-%i|^zd+hQt@an(FST0rT6I(Y~3MDk7lwKU7&JP>A-kREOX3N
zR$IH^3o;z9>D6~Mko7bAO9=+`qGPsCnat)#E>B6khv-_NTQLf3Q{)uU*lz(tOMYAY
zSpQv7vmPdY$8Xi3>tsiq8WsiJ;59#6`}+2>>SX#leRJjg#rJ5ueFFFt+!O6#SUU}Q
zx1P3)96aJX<{)Q)1oEn@RtyK^oE)Z8xamN+J+eVHv7ou3Nky&hf2)sWA^0)aMmw)i
zG9qB}CWGUdeBurP8AfaRQD?mjzu2>8ta`RP(~C`)9N5#S$}sv&-Hnok-Dq>bhs!_D
zqI|k^O%ObTGV9vUs!7y$*Ap&Bt@p=4y}JZ-k3E(00$K@Fs1^zf<jhLUa|%WM8m-tf
zsHG6Ie`Nk_bc3~BNkF&Wt1%2I&FNQDQnkFwtd;@JuDjahfqV<S?k!PNG@kYnCAw%#
zb2gAsv`_=A;3T{ehr9tAN<LG+bzq1wCdQA$M&(|q{pE{*havpxo}{m2|HKCTQ#=2B
zwtuCi-a24#G48fY=dFW^v#y*snjAKQIjXuh?T=JIFvxb^EB&VLxKjH3=i*u6`$J_S
zBlpKW@#~t8*Pp2@YhE3?Jon@}m;M=}*wOZ={S&U@^B1okC$D_Jl6f3z1$zAxoeN7*
z5xasmIu-o*wf8ge%I(GX&R?_=e16ZH9#4OrlPp(Ft19LAb;G*6o7+9#GH-hK0qL=N
z$;E7=cCe@=TgQwfrlJ|394LTM3E(P)v=FHqoyA#C^S$FEjwf<jHatziFV+qo5l}XY
zCQvE1ApIE46+ctG9E%Mub7;O53w2wD#4{#vPF&@&m0dT(^%kh*cM{PrBhHed&TZmC
zT`T?!<af^r1<J<@(>0%b*vX+E;3qesmd8^vh137uk7GNPy7z3ybfa#6%4>ptI{T8o
zm$tlU#`W#1`21GiMwQ_zaBkq<98LeJA#)FX@KL)(ia4`YzXbW<bZ?&x)R|iAcYme?
zN_VcomryKL9LVPKQ}{~ntr%iKyjQ|^9UR!$Nwpzq({)E_UNfMmPmaV1b)aSN?Lei@
zuxt=RM`?nMi@Fy<{?TwZ4PNqJCHO1D8K%@M=8aD`O!NE>TQ$1U0G#1OGT2NLdQV1h
zn8GQ|qIvK^D0AY1H>PF%m){nNEu$mFhzCmGn__*eDVaySS!E`}_MfF0pN7ts97ldF
zmiiE8Yfl<Tq+&$mY%yEOD?7MpdMIt@z)6mGZhzfcL@NE}1!GEQCEew(htX6r{usHI
z$kQRZIP>l5Q5H$d_GI!WGB3pF(Ps@zOuU#5l%vy$uwB@3P`x6vHEsFo6L|hYC#$^Z
z=C{#J`@D_p0XEZckzz~Yk1@X65-H>Q>gfE&GsBZWeUm4SfFrD{0J$d$v$VqAUGQM|
zOA9Oe+H0l|@r|G-t`~2A<SX55c`2u(xhW4#wpwh#5S;0aYO~y%j(@;RW05WKIq-D~
zjV+HKgZ#r1Vjq@9*~*-w+e^ikmW{X?C=xwQJsZ6~XHx~2GO7FyVB}tZ`oF>r+{B_A
zFohFsy}6*XPAR0Csr@rZVM*!`a29*W@`ijIDEp+CTdTAHg`Xcj_S*|y_DBR+To~u_
zB>mYA#fTXBz>D}6%czv|;|r$~K~qGX#enVEN9(<ZDKHVwa#S1&JO0qR2NwCkyCns4
zxp^#vkck|o-GqJ1@Mujtmg!Hndm2VpJ+<>>mS+2xgKP#Yw}SUqBN}4&-N$k%&U0S#
zavQl_#$h3lFYxpO7R~oBPDSmk@0!B``rX&ir%BXo>bRv)W0c65KvFqf@_MB{&Mk3y
zZ>&?#p97~IWRYu0{r#^th9kD*f{qB!SjL`Dl<0BkVg{ZDauIUIk&=z;3!fecNFxe#
zR+eQ4wOkeyU!jYEYVPLc_v04QA2t<|)qh+l@wEQRFrhvlq0z-gl}g6gPBEEG2AjX<
z8t2zF4D;=?*kJoXuV`X#Y{l1}+yl#0{Axyq3s^w5AI`_o7F;Pg{Gq(jY5IhC;ak`>
zzRGiYz6?bw$`Oghnxuim@W?$}qZ^#l2r!jt%#z#(xfW%k_|m6md|kG^OyT?m*%BOI
zixu6{?lRlF#~Rs2%FZQ7GS4I&M<4I&!>4Yqj<_efgBj%|=Dvb#HqiH53Cn-3^%F`N
zn>~rI+<HPO?kOxkVWBaVPHyp-gm6CGPU}Dt&d@L(-P1r}W-MD2*%+GnYip>)f*8qd
zBwRl?ZF&y}uU?c4A&SCA(@Sbi^}_j8d*Fq7wxsJN83(w$^3r6)nT?a1My-%w3k}3?
ziEwk;y~{!PJGTb-i7BK1<K_k9kt8t9vELqLlpW-sdSNq_Q9rhdAd-m}!<OK>_Pnnw
z-(z+(#>OUoTtq@Ro}Bn?@iauPFh=Geg~fYw(Y6GRPG_IO7~V(OI^1(}?o7lV`|F$X
zpz3s!^9{2u*??S>zB+a<8+M0WxZRf};)d&7+0t8w^B$Cn!*@rrrX^L;h?$JHyG8Pg
zzjkR*MVyAI_rj)yvb4CQR!r=f*o-zrR$y#!@+D8W_hvXgvoawbd7snW>s}W&Z0Fpo
zmMJ|q=@!59xCa$bUZ(zLAh^_%GSyfh=-qly%$6Xx!~CS6sGB%W!GfbK!;V#(hA+)|
zf7Bg1;rwrl5;6tFs4rmBEius&Ibi<iv;(7G?_AUAs9Oz=MZDLUQKBwJbE*zdN*%&W
zB;hznh~EO7mP#x+2~*mAnlZq@yY!ynJd?bR1XZ(eqD^s`Kg{H)gLcHY&Di8kl#sz}
zRWcG=NRc=g(H*)TrLMUBv~L>G6X-2o3s?2Dy<oG>_8=-Hg1iG3hir$9ZkkQUJXgtM
zJxg?_iEWzAx#z(mq{DNjR+g+HA5ToZBW^fJ&La;m>v>?q?1y-p_P_oR%ehGM#UC?{
zuwC7RS1hJ@i=2O?opFG;@$)72t`w9~m7(m{u2=73Y)|~Ilx2t4M3&Jc=d<V)NoIq$
z5Q$>D3H~921%&}eZj*7}FGT8Ep6pkz0u1BFhxt>g4`;+;F%F1k!obulCNqJQ6h62X
zPIvLymkhj4xRGCFy!kC8zL&4qmNKYn)SW8e6uY)(gicL1+P#AM(w+@hxD-2RZHuh|
zqnlT@?oZyv)}Ts*suDA^H0rY)xDKO}Ci2NN`~ouN`3Wy)=R|Db)0FHZkCQ?Pss{+^
zB`gHUO~`7oi9CzVW6X2N=|mfC)h^N!G{R($Fd8{<B&DNc^RuP7m|a;m`xK(z^B33K
z&8)|4HR4g!h(8yK?ODL(8w_69Gi}o+hveR7cBsrAR+O2P%XK#>QL0XN_m9qd3!k^q
z>Dh_NP#FmaCxzF{XWX31Hxj%hKUMC@CwbEnBkao;dnem@8)`^jYjOotwRBlvf!)x;
z2$)p^-GtU9EK{3=6DiylD1ybYb3X1bF$CQsETAp3WE9`s-{v=A-CCw#H%~_i#mDqM
zS=p3WmJE~+4B=Ip?!2b=i43TaaMFn1!6H3U@x#ac-*@Ns?`Nk>iCw=yj#u`xvk*i!
zQ<S>!k`!I1Y+3+c%wHLk2@4l(Km+1NbQ^lTcy)iSf$bi`dTaNLe-`88uMFd_kY08q
z$?G`AxI#nH=d>kgF?%fUlgYNDG)pZm0%{|gM3?qc+Fn)CM$71piE&hrNX?TnQOUJ!
z^fe(Qq*>#w#??7ncRxIE1e0&Qij7W8DVI%)bc_5Aj+c4*UeFH#Lxl-wd~SWxAul~k
z(enyhMTm~yjIxtwNi!(E?rBpln<2ByD+vuYe46|g{%rCM3Jr?55K5~2ce(vRK~9A=
z-sE-txI%I}%yUBwybZXIob8mDrBL^Dbf<Iewdmh609pQbL<SIJhtl_Mr$Z%*#P*AN
zN~;+UlJc`mW6yBIXa}l-?$yF7NXOscD&3F<gjY}_L9#2DDRC9w<eiyg36JL~-;Q7G
zH`Gh0?3U;Ev_Rgs0Ua@9jnS?56h2eG3AMhsUTJfk4Rs<#$?FTH<;)!(w-UjJTGSV^
zG|4BQlqGQTQ;Tr>56&^5YszX4r9Q3Kp?o8yyZ(E8_K%?<qwC0VK|{N*(JLaAxMij}
zi`UX3zkiuBs>FAFyx(pU2m9UsT%TS5lFtb^$@B@cI^+caPrZb{EB)wc+P3EBA;;`j
zeX>X~5D=xfGHaSZ_wTJMFCSV%BoqAzjrh?r=qgXP>uqB_TOYF|{~(oP=#w&X+{bx5
z1k5sW{6Z=ppWX5<G5bE@0@=1u*u@dIX-qjV;>i_!X2kJ%{PB8LD`JgX3r74!|H-2i
z;pk#nR_0`PJeqJrqWC)*)1=r0&SjQ5j1cdkG(8xPY)Vp768)n<O-?7$lTY}8A>FTx
zA{e>L*hU=~Z|S4B<*Ul%8Zn7q&rrJ97In5r*|4|^-i!^gxfNU2>hp2RH<Y3L{UxAL
z{8Df5KC*eB>v7=<&lzx`#$_?=!rb%}Ec)#!(I5pjRpQQ;R*8eFh&~H#vFTl1Sr-9$
zvG?6r8tvq=E3gmp|9h*kr$ztw^eD6OhaUebFF6sGsD&L77oL)ZJm;p@R^sg4WmMhZ
zU1p#VrEX#rAR`W_p-e)^%9@|m)IKd(q>3Xa+jK!Iwsj(sbhQ6=D;#(qK~ZyF9A{z5
z{7}3=Jz!#HH{NY&c~KM4zzie)rC4ggDYFM@+zgC29vEUWVEf$jaLXLZA3fnrZ_ift
zY;=u`=>^X5hT)aM<R;0qO9`D3ly71=RRSQxy~Q2d$nNgNcGHwjVN9b417gFmuQZHz
zBrGLXSkZ>nX5~zZVV3kmH3kwgdEV_3eT*<FeW<x3k?CEZggHBhkMPYr^MLo`7<$ti
zx1A4eJdXb!f2N`E|3N$w92u@+mSW=RhVn;s(pIrSX`?jFcyYeOBC*#qLeBDm8Z6PF
zq<!Qw9Wi{ejDzy#e}WuQIov}UO|pZSZ-se8kq6C<K}#aez4vg#-=~aCsyR}hh`fla
z2^e5SjJneVOEeT}Z=AuNCGp6*x{fxdS6`V`HLh`vE%SU=BfaynH(g0B6`H}BnY5*Y
z)0-BMc-yX&f?&ynUmLz~IwnDXQVRNd**MFYUi~=waoKp5@FsIQa*SyTzvvZy1}S<{
zkTW+9EIwyr`*j@ab6KXeilxLpRX}wZ+j^v%{PO0ek3M~A^x4LPWc8P9gRAnvN%A;?
zq?R4Q)y{>O>xIwL!YI&&`Z6q(|AlWwjGGPW6r7zTDuzmu=^BW>VY0^5h(@BI%r|)<
zin5+gq_FqbR-=<&OB739vZiB=k_gC;9(^~uHWos)Ujt<(o*JahkzX%dO_PrH5<>UY
zW0U2c#A)@+gucOUcV>T1Zg&^M*kIuZU0;dsO|DN0V$^*8;ne`&Avj**;bJC2FjTg#
z@>Q(GCH`B6UJ0I|G_FU*Q=;Oe!F<tMVbLcnQN>e9Q&in?jg(+TxhWr-MAAo&N8jJb
zI-b3xuk#|6!h4b;ByTq<-d>?s+gzg0G;#bWT<1QwKT`eRVf+K}@<0;R+y1?h)KfZi
z;{l7kM2+qL{d}2dH@QD!|G<h3M)AS4?=fALWJuC!|NBMT!)t*_(zwSPPvaJ{i%)!$
z8mJ@63pob|qfhz=(1frRu;D!oy2f^K|HsvL2U7ii|Ch)u;ofj5>$)n+3fU`Mqa;b$
zdt~p(mX*sjQnI<Zir!@JEjzNuwXd1&n)l+m?(bHg??1nPT=zd-uje`E@pzoad7kwd
zz#|Jz&^JKt&PyYzRvtufU(=4XOqrt|*B0HiPF!CD&Ty04A^A1jxq|1!!_skHoO;Jb
zhH>hlk*$bkL%w|b>iayQFF&4NEOeUsnmiR#P+YYDIpYZ2Dpjhvldt#0G(h+}qjvP$
z0eys(OpJRqh52`AlNxK>a^|&jUpojqU-3^^B<(S97yV?ds!?YjDugBS2<e&TJWGcf
z>^+VPwI|=O?iH)c(iPVQz^<WV6g(#u^=Xe(HNu`zC$UvX2;O}6jCJRt8E-rlb}HZ+
zayw$>FH#M!dHWth=9HGLT>F()b7zpc{^(YEor<U!l^6S;rcP%16YXVfF9EW;ys_j{
zf2Xo9%gWQGrfJuN7Ror14|<xz^9q;-{1&IM2g|r8pK)dq6>$5scpRp$wB|s6#1+m#
zR@Utv0hzg!8<ecMqu;L?#kbt96CM@bUPL&Ze$tzWvdt<)cus&}@qJRB_wqa#oHcH?
z3lDd|ry%g7QgwYvy{Tu+v+c`m&R1CKEu1oa&QEGs6~)hiZvlw;o1G#FxtHLd!<4n*
zoLAQ!??S=uNa6VR(kUp5C3?`=;M+ICLj~D!cFmy9n@e|9d*0RA8hfX*`|tm>d-PB-
zY=;!xEMn<aQO}F&q+WvhT++7g@V@XP`E;^G29Cf)a5Cpcmg;M?7IkL*!S&%lTk0!i
z<X<|UxVjcQPn7(?QSW(7mf5&-V)cqmolQ(kco;5c+nzEdtNqwG*3s&?d#;_hzxHD{
zTI}KoE{{6<dZqpR-~z9D$K9z&x=t(oYY-@LC{Mw;K1{#fWwws@mZnk7VBF;&8w#Xf
z1NzwNX6N8~XCrN0V2M-sT{P^LCHq^S2z3>Il*+}UvZ=uR^rMJ)^WEbpH^Hurp${z;
zdtvnQb~L6(`Iak$*K@+d5)~_Uz?hsq#f-9`TZWSDD#<`pSc-(_5cG=W#}qqSVA0D%
zwmVQ6K<-(0%fyY>oYvuE_g|HKev6apur!I`u3mzKik;g%WOM>P&Y@LfF@om`Uu6{*
zn_*3w^w_-wJ6qt2L8dM=S#Djs!-eE^bGpu=S6N}s0@>}1z$%?g&{upNSVm~iTQpRP
zMX&usuu4yO|IwoxFukg*tSsI*3h4I!O0V-+{>!7lx4f^H6Vy;COc6Zcyp+&f{UwW^
z73;e<;(Kf6$1-XoCZg`&G>y6jJIs&p*l8lTOqW`zX$M^|1RDpG_Fc2wmQbpjl$ZfJ
zQ>z+V^M%00mU{Sd)B|3li|SawR080|t4b_7^{Y)=HhW@EW#~h1f+}IZ=_uWk{#*Fs
zzi>`){ynCr24Z$+PLIgR*0OB3-hwY?#D@n0THyBZ!J$yaCx$4o3qi$qL+hO1!$<7h
z1H8jGW8j7wG<JLPs&3SmTjQ^s0Ye~&3scOn(He7RD*#O#E{?bVdEB(`eHY-<*~cv^
z#yjjVi{V|Xw!w$Zv>dXGU9N}mnlydBQV-b^$G|(ZxGuo!E2MwvD?{g>)T0Nqt9G7#
zrIEy6O1>k$qprT*YLs7T`#Xf+BvkFr;!B^|la@=~lJFGQ0OIDR4hiY|`$jrz`_EO5
zpoya34!*^T^O|{(PLu7glCH4%I+;Y3RHJH_N+v$t7gd*rs__evTYRKrtt#_{)|5E$
z5?>jj+)yJ;=%6$=yha%1HIOA)$(Aj7>U0@Ig9xdi2uz!bo$qL}&n|po)g{WfcchLL
zl);Vac*RfMKoniIc~WgCxyqaJ)$@jYQ0pnRX-q-_jPKs_y%~laRFtvi(3iaTs7z{u
z3xY9mxJktav{uXs48n{HA4{W;r4xG~_bRQ%w;-KQ3zFG8M(+3T1$I2=-qFbF5w;YY
zrH=8H*SQS70;tip)1+A(%1YIH=kDoj%U>@PV*rlfHZ!KAcb80zms9jFyGJJe*R9B0
zoE*H8t8438Wa?BCHWAhBi*3Y@JJZewlGotO67!I8i%Z4l8^u!@5SG47(XMfx%@7P>
zO>MimiA2QNB8lIfPrI?xXL?P;zayN_V<kG#QW7)f$g^^Va)q<wE-T+R&QmWYE+;<R
z4O}iDnUhY{f`8Rvb}!fa_k!!mD|?(2feP4~B|4*851W8sOd!7FkY<>|0w#UkM1~Jg
z4uVO7UHr~{H~rnsVnV&N`L4FZMBm{UW_w1D;vi>LRC`Q{*R<pA{)P#A_oo{H?3>ID
zoDSR=f4wsG)Raqmo)HKX&9U80;1>RHGDsf;B!gO1uF>-^wC;@4*I?ez7fYeWKJD-J
zz}(MkcNE{>MtR*oGjD;qT>7~>_Cf68`H#J>$XoO151%e_v~?i^^5GP=0T#}nPAy~E
zxNjS6k%&E*37{Hq?gOSC;?xet9ii1YEdyRf(IIPn++!Mk>sKs1v`$(R`X{n|c}Nmr
zCRbc8es!H)kkTsk5C9RvS+{;?8h7LhQ?#EfFtw3rIQ;6(3(zH<t>p-Br_UYUsfWTJ
z7X<CBI`uN2OFsqilokI*m@H7Uw*R-Y(z`7%JB!mYJBbcFqA}w|(WlO_!@k>d%?{1h
zZ%Zhg$%xAUviOg^wqNQ^=0fI%bNkXIy4DO~22(1Ou1_=Qf>u67JiEDp1W&a&PXD@5
z>e5R!&*;oTr4Ka?b7R%3)k-LVX^Ql*EmU$$s)svG0Eb^iNK1cY;qQmuy~-q{3!7+D
z4F4nT3X7!Ky(lt@@uRckwRE1@4b?<{+U!Lc_>elOHh=fWw%%Jx>weK$K&UNyre~bu
zIM<Mp6${_wO?-!kmnjdmT9vR|=HFPc43_No-x5U8JFB<oFH%!%DLA+kf`*@we%<f4
z<u_#P<uR=8Q_+tV`bTZ<FqQF>&#*8T@P<EOyIQRo9m^^KMg&C+1U{lP@>_}(zK%Oh
zZfL&@N&}jHeB0i$tA8;?s3>CM<{XBo7Hr+9=yZD#Z1DO%+zNSon718E-a#K>&V=i$
zY?biT0{S(RMs;vLK!3d%@ASem3DTV^nv33jX=2)+ZT3p<!Sy?Iz>56QEikdNiQ$Dd
z@QXRW7gmY2@RD|a+)p0Fe=Gc3iLjD21y)=i`N}q*pfLM;vY^Tdc9_BxIMAgdbwTH(
zl(9vJ{2XP2Ym;DKJ4=(mX>Cc+Q|d^^IeaV4&}uRs{>3S#v5L|8W`tq;8(Fi`%YYNv
zn`ylIP&<K>UQ3yWrchmwLk`vn7?jh@zv!6Hpk2)!8_PRhW~b+a;n<<+G;(@#{cQTI
z>uUK&#Lp}Ldv0R?6XIYU6g2)8G;h5W8Lh+I4rkRkN_*Q%%}&P5Dz!+H$VpEEe%hU{
z{Y$pn84Q>Le|)q~RM)Irp02Z6?PpntzEI_gHT6FsuO~nf5zQqSy3jFMu<=!Ut#B*;
zd@(-wx5zfaq~eU<Sb>?d+6Oz8*Zk%MZv!t<Y==fuRieyzpf`1f!%Do#m@_BkSK<+G
z4c8!*MJyVMDieCD6;E+v(JVUG`l1j_YM-l}Yrm}Id4{T>FmCHdCBTv&(N^2i17DlJ
zxkR(6{bfPSkcIL`(qSN%Gvid7Jk%m*<>3Xw+l5=vWhavJX(HZ$FR^I($s2CO5Rn^~
zeCX6RY1;ML{n`yE^-b+rm%^5gSw`*z*!*PJw@e1+c!&l4gMld@{*nZD)x%t>DnCEJ
z#m#<5+J06<<6GX*mEPp8*8rpmf_Yjd=&Y+y0+7MkOmL}x0LY1_cHcyh4z;}3ZzoT<
zpe}~JP#uM~-qz`gGCb=c;-`0J>o?ESl@;$3_Rx*}=V!$vY1LoXBkJSVe=9cl?XTx;
zD-h2HrmI6)&O*c-x5(c{gcpzG6b?kIytk)Pz+6cYO|n8L;e_%E)>5#;Pv}Ma6#My0
zu*S<F*P68`>sf|Ua!cqlB~2>?0*k(?qyYO-HLNg+MTeya`-~QRcP=zvex=?0D`K42
z>0PO43hH?&6TDRl{i%C&c{bXdmCE4EXfMu2yQtzl>xtzH{-LU_cw|L3q=%^>^!}a8
zCDMSdcc-VywU;bdqm}rrE)2<Y&}^FrsA=Pmqv{~6&a}DAsHVKHne2D-#jlpyhsgN0
zlDjg00#z*GzZ9U-6KJSpxqQR-^1BpJJ|nt>k`=hlFk~3|8X6AumOCe6r*+~LT#9Ke
zw^zg5>Rzuu-<+-N<%gT-^`$!M83!cv)tv21HnL@J6=2T2E9mvv!p8~(>$*A4IwiKu
zfo~lTR*lru(UsOw+jJ+X6ivK<dOg#ML2uGLHLm4NlWnq@*H_|N^e5c%Tw|#~#ihN8
z92<KEY^m^k;H2Jopq1QB4~V8O=hM~<L<z?pyyV?(w5y#O&}xsE=p$ZwjmK;vdzo;P
zXj1xPH)1qpgR^LI=)S5?Y^akYm}mhaf*h68;%;SezgK0w)}x;At%1j^0%^{63^f95
zE%;SeR;mf<cd9WuZZ9iTOnrF6@5S9hN0lvZs2d*Oe(fv3xQe%GIBQT))s*o_W0jly
z*q&JWwPH$F?t}wTTz}%$^1ARC<)kn}xDeDl>R~%G!+?Igr1cNf4{o(W(k@pzn39iD
zbhs;`5-#6PIG9&th4IrMWx^z79QPJkB5pDdKc+CkAcPDtb8_Rg^C-xB_Nr7pfvZ?%
z@yy?iUYp}AV$+G%YHyE|UA5n9&gE!-=0=rqYr=+5j~Qqz`Q}P2tUzL&&sSR`#08v&
z^qA^H?~k*1@?-^8!QbDmOYNwAp2)YJ!^3B3$NRzk@=$1~O8JZ)c;P{e3e<S1)l45q
z`6H7!WXr-O!OE@u%a-3<6G&;G;SEq$hRu18G8b_Rp<H-q-uAu1RJ7_yMG<Z)lTk`8
z@b7<4X>9-@E8<%pp$vpjpYa>v1^o~^6=5;BF%NF1kj9{?PHrf42+xo}vmhR22BW{8
zt^Nh7jYwo=R)<F42ROm&iPX5f2a$zV<4y%!GvekjVK6*YbJ6&g%E0fgj>!mj4{|bc
zx^HY1?-UFAWg)vTCX<LVpdMK?<S%0yu@DP+zcbXwo+-{2ZnSmfSFvkMfOCORl}h-%
zrF-M7J$W&>?1hiu%Rh^tsx=~XLsntCH@S^VWz{L%ji2!Q(y1-55W=5PFVzUl&|kNR
zU@<#w#kZ8Y1rN|G9R5ws8IFHZtt8LuU#YCz7NG2s+vY=1C`D@4EQwqXB+8S*?}HyI
zr70aoYlm%dJ~qvU8@=+Hek&;^2d@?$PEv=F)9-qY&{~7<xYXQ8)9tiO_TkDnShi?m
z9tretGC9E1QU5CC!U~z<!z{ek?1cNLO5!1lOal{)KW;L+D7Vmt3JjGB`+-5=i()F$
z^tboGr4LlcL~?=dg}^Xs!qW`nZ!`%K=bs;@gZ!qW_lGTA$2mHWL#c)sz}ny+l7jo-
zsa%!1@D$0*H3KKYWL!xm(bpk=g;%MI?ubvT)bZ@G31xwb;jvYecSV4u*QP^wTRvR;
z5!-DTU=*eFM2UA%AA=yE&R4uC)ZQq7U==wLpH&|?s%sbk%$|VMwwQD%DWA&fMyc9_
z2!s#cYLcFy|J87sR+BRB27CdMidP`MX0*<Ma1Q&0-?M@FBYr@>K=YyddGPU?`KcJU
z?~Op899qTeL4k_Jyme&*Ii;YNBf@4S0)nGVQx?i9to90Xo!jgYEgFQWR>=(ZPK8DH
z^l*KyI~nJP>`E^J(i>9#;AZ!@gg*ko;>@5f&ElGqBT|k}FfIbW8U;bo=G|RZ2H4)s
zzwh@3YHi`%(yI9=(JNlJeTG4(2^eA2KAzpQbY$0-ruHmtjA++!%hsocV=spG0>YY>
zCs?m)L_MK&WY|YB<+dxM^v9NXfX1O%R<SUY)#6iWNVmq#aKak%G)JciSN`)iT;Frc
zSUxH~+*TXCvaPrrYbCPcoGvb>+Ci5mTgi9>Q8NvOP23<awE?spk3I%oU;HkjzFfyN
zP9>V(r1rPQ^+W$+feabhp3?G>SF>(mnLfX7$l#VgYIm1G(iZTB)xth|9lWTq=Zuyy
zk8dps!@qY>Sad8t+1BTTWSu0w=D*r%ODP5QU}Bf~>5erAFSNd*2%d+$dP<fJd0)k4
z1Wv>$93^H>l;@Sul|VzqRg2yY#4zy#P;k~xRepwxl7_ZybW3*t6(hfyL!Im{g*wfS
zLn^3+Kk+(-&$9f~tP3PO_Z3x|CMZvx9~){QhWctY?rpXwJ%qjou7-2r5#k@6L;g^i
zJ5>Mv710fZN9hFy?J~vPXq3bCB4d5Iy{&TXM1+#F;V+ty7?qDx295G;h%YM5K$AQ(
z_lTqISymOX@aajkiEZY=DxZkE$Oq`tC}WlTD&d7#8fXBuQb5f+<7V%8!P}u#t<7%+
zyBL;kT`B9npSYb+qzrB!!NvKp4=F(eYM3Gn+Q*k~XdLn@P?l&*P;5U724%;_Dg}S*
z{eX5idaU(ei$B1!v^zzvo~2p|?x`x+>i31L&yxvQEldkQ{_MX|Sy3|_1<BwDUW}4F
z@}Ih$%-EEn*bN;P&ZR--xPik9?aBTJ6$$b=3M53Y&nrGbAh`Q7Zsb*Sk6MHPscNka
z++^W(i9*^qwvR%cDx-!qMLb!-b8!)y175Lck*J~}QE_9@_R$<z-n-4|r~x<0r|nJ^
zl)NX!*A0w{d9DZzNnF>KQ0b}CM1s36d$`ORfsuwzm*Kgp6)M*{{oaa0#^2TP<_X0}
z;iFY*V!dy22`za|*(7)HZrK&iZx5qfl`=d%6m>y=G@<a6YyU9Rj=Fp)Tt84T@gO1r
zIBogB8dw{L!+~i8HIXhOVe@0PZWh9y<Wv>uR0jIj25!Waa&pB-H2HkJ2Gd6|Mzym;
z>4&NTLDzfwueeY>WZY^AxuhKv-zo+AcK12c<#<j6)Zx&k68b?}a7QKFL0xO~^=b!m
z7w^l?pXN1H#yUlEC?|oaZ%OU=)3I0l?!=F3PBHIPWNB9*XV6oMR(W5`Q71!venT5K
zwo+!-CCHYypuXKm+wpcg-KA`C0VofbF8t>u8b2w+35`EV?c>G2idR3oVujLjD|eNs
z6TqxInLi4p9}{pJDh?>ozGW4XM~;tH<Dq_tV8si*0P8S_+6yPfh2hsYvZH+PnfMW;
zjF$3;%T$A}qPh_f9~H&(6icskkBGr9BD7;-lPG?QK%(;iD*&Xi5c6YwG-3(X`fjQ1
zE=oLCIe`3^4<1OTfcI~{(k{G}(iuxN@1w$R)9|&FX(U&8taD>?E{may#?_!9vh5h2
z)y97-(g(4|+QXHfwAVJC6%gn6Ro#TEeL34n=W|5kpH$#p^uLs*)DAuW3~PdZgSrXR
zvI%K{Uq053foVWTOFus^ER^%>AD@~IbrTo$>wzYzTof0m2(NZJJioSHB2n_7F;Ftm
zOBN9JC3a+v>9&|~$ur%F%O9S}1I5quYITjxD0PbrV&LR4piExW<E0M%_95Oc9-1JX
z842+wx=b>w?qRuNqazs9D%Os1%ZwaJiE_TO@;;XxV*$-Ay#cU_6&9bt*k0nfnq6I(
z!{Q$!9IlIUzTrsrQIp@cx<0fh$60YAZ;!iu`Lggh^C5ZBIT<jJ<1F@X^JA5*T>wQ3
z+Ire>Y*}$1j$)(lgZn+Xjla8Qe=1oMYzxZNNAOKrS>1mi3G|ZN0s`HvIC8)6gh;4L
zUDhrH&fWSJ%W8k`KE>(7nmBR^>$q$#$$s!{l(+jSz2z%^pe%J9vp9ny&{-p)WJp0=
zAWduwd?Dbe_yuQC+p!4Uh7dW2$|U})i(>RAm+3gZ698RnQw$NGI?N~DJ%7P(l^eLj
z#u{{fBI#{eXQh&k%5y)?ehb(+R(|M&f34DXRXF0CVY>#6{~xHZX#B66SsVGS1LC8p
zR$-M^!(>??)Y^Wy7sp#g*J;<yyOAKI(pIM8UKPv>c+*kgIZQ_tQpBw?{eg$K@+hJm
zcs0kCSH66oz$Wt_X?^MZR?BrJ1TQPmK;X)%V0WjZHmn8O;^Ca5=frYpC=C)2*DAOu
zWhsNcV?Yi2k)-$iP7nH8!Y6<+$~cd?sa%_UosKNGqjRMtyD%#EBMU3@(bZ5sC1*yL
zHV)XCA#gM28KP1JXte}2DXRurKK?-Hl8*jkpdlx|e;vw4ipGPEKSGsatoCwGAL9cf
z(0l~n64e+@d+1$1k<*`+!4Da^DNOgT6n?c+&&{KcAhvbwX0ylWOc8L~1#0q-6WMS7
z%&8=`kO2ksGcE$JY_BK=O^zISu&_q`%S&CCvhrKtJN%Z~1%VeMKC{4=vl`;j1#GUa
zh|s%TQCV?_N|016v$MJa`~pTI5rvdNtVzHuH{v%P$1EQd(X<WiKqom5c@&JGPIv1w
z?I!N)mh{7y)Q3uxp4jKN>j`ZA@lyTYN&83*cDQP3Ktc$0@~TlvoGFF%yt-sRlv@L2
zNhtras>r$*kB7<T-o-XOOZ?j1$D6;m%Wg_N9cnI9s1J0KRMDt<vo>I%0kO2EG3Iix
zqInoxPMZgquoFn2+~NIo$900Y6Z*c2iNa@#gljDjQ?Kt3`#}&B=m8fSF+On^va~$C
zoeXoNku~0=sn+g9Oc*gz2rhjsbT&LThIMdV=3YZLIw<>J{(#}Pf!0+Gq%m<<M76qT
zB~g}@0T<6cC&*n)C?C;z(D=79O{!{rCcmgVOzxl}$bRYZ^+o>k%pt9$HGO8QsPNkk
z;A~o9Ax#O_bOV^wqDjx5oyObacZ00qlE@woW^3rpj}ci)H&M1K3^QTL9c3ll4`XhN
zh(|5MF>Q}_IUaK~S2BK;W$SRUG>=4-Ip{M~pq=UX1!h*DPER_#c6b9qq@Esb#Hb*g
z49T}0D%q<qnU=c$qD+vCu1=IHEa8KXGusPS`^3O!tfLeu`OizV;j~u#Nk#=@5vE-2
zqj?UBLTZ0n;N;SJ`!7IvA_%u@U;6ZEJFF!-nI|+|XpymF#9HU!1MXJCm<&yX6jzDY
zWo>XNw%v0;W#PUc%h;qgyjoE<X65VMBc9f#8h8p6s>Q8}yiU9st_RlTw)7=;FG{d5
zIa;X1P@eX_dQe$|s>TIb%gOkb$G&%Iq4&@exlBnH;EQ`{zjY9DH|sppyi5b!8&tLD
zJ4j-atPkten(63~zozu~f#9y^V8vNsN8JjUho8IBAcBKT%HE<EbuGUGS84meSchAq
zf7x^f?O(2tA`3j(02OQh;*&K8*??wKT>209c}Ht6$oPAczp02{*Ct=ISJ54JM@uJn
z>YxXu>2p<NJ4?O43UYbTXeyU?GIV*2)%i*sM`aMof}SI$sX%*z?I!;zCgRs<^&Sx6
zz}5NuT0%Lw-7k^O<onUpk<m8l8!c1{JvuWWY<P3D^@tvwSKO?><@}p}Q(c@w__0I<
z&p2l%EGFR9o=}myT74yLRhOT`-J9djNBNext{(9ZGl}ydN|fLSAM&Xh4W-D;maGj7
z{p-j6_s}QPw@*wPz$Wb>IYs~aOGFatIMUS~s4eq*AYLh5%OYN9zU@+#n(8U)>4;FX
z?A3@J&kbx;%Wc|`-FWP*V|h`Np>~-r;A>Y_(9}~|f|CV<q5?GS`dD-qpSI1DOI6DQ
zhBQj+4~LQ?%w=9M%jUo}=2+IJ44MU%|HIx5bA)4ysV+`%JA<t67W6R_m11l`#gJ?G
z2*)wspSQK|dm|T`R*^#CbEB%AG)tf5RN7UCOc9<}+<$0SeooH$Unv#*TS_gTgSgG2
zEMewGC6Fn)<1kMF-_+~dlH?vA0`QA+(Sk(AFae%>Nq0BEbKFp9J5+=YSbBpw_+D;J
zmr9mWQ#N_gYi^U7`Yr#EI$)+eo*ER8VuxnDs8Lb&m8w1<TOh9MaOCPV1<Vk?8H;%R
zwOfzb*3pIYp>()uQ64(hr$<Z+R5t#u#Bh|U(fs3zqJTgTxi)uZD!$IV0XtNLW-9v%
zpQfr$R2=ImYfx~tQz?t~QoN7<7b{HvVnrI&aRK2>r5&sCh5t&v_AeQ~2da%#HuOVn
z_GxlTP}F8da`V}jnzZ(Z@f9(;RN2=Y3k(Q{H})iLbas4&x^ur-#CybQ=P!s|O@4I0
za(O_SEqp7RzjbW;mgNhFwSpSBo;pL0A;@yw?94=2EW*xl=z;gQU`S#*)cQZ6sH&k(
zNaBy9uXGz<oM2-M6@$#JXNSFl2#T|kY4-5f?RD3=`h3<DUh}H9K5agHo(`^(bud)=
z4rCVW10Q<)4G?mv<oe4$Q`Wb)D`{E9+tFhMdehNNd`=B(*A{Os-UGeoUuKG^U%teu
zs1G~VNJuB`t_V$&2<grCZ_YbiCp66VqIG%<3BhNaRZf#4{^;g&w0kt6M9u#lwL8jg
zsr9*{wY4AN#r3^4e5E7#hHvc74u`PZ>JtT#ZB8x*_nSb8JQI(oKENVRpfKTdGv{HC
zrIEf2kXGZ64_S)X{iYK>T2t%#T`i|W9wyGt57wcvQ2`}=(=WP_P;9R)hEp3b+%Mzg
z3x%A~m9oo#i+jy$R7YpYC^5p8-zrpn4KgvXvmxy}E5f-zRLp3`&-puVju(0l$l)jK
zQo7v(@3=jczyy>#W142c{Q7P^!u?(&x#V%DX>nHiCL*EPH75eMJySc9BxvGiNXUl>
zpq=b%B#Z>=9rrAa*ovgw0(UmoqtIu#Y1e99_!2ZGN;W=ud+^+kaJ_oQ1ChzM=sWiY
z=@lt{T$}u#bfj+45B<GUaJYZ`W*1@3q<*VvxKXJ-^K2^ijZA)zYK$C56JM6k;uXS%
zUbDl2vXR+Ik6x!0+SpSwVB1`~>tHKV@^pp}M#$l7h_h|>M<RRu7mdq&PCV+5ZG=Ss
zfS)JYYw*81VoBv+9kD%0zzF42$tN3=tf>CBNLcpT^-N#$uDF`r@r5wz?V)Gq1>}9?
zEGmy)+@bN~>I@Q)b!)<Dx|W6PzW3?XA|?_ilbftHOizb(a`Q*%+OLSinz*ySFZts#
zjL-O-V0!&E8~LYAx(f@h)$DBfLf2p=va)PNM%6oqr?VeI))ohoIpk(IPe1U!L}^;x
z;s=!|w+UOa(7ZKRP?T5YtZ!NGFtEVRYxhKQ2Jt42=uKSJ=jyEL%V5$`6*B9AP>3JC
znMH^T95UtTmx?`v+k}XrUMUluGe^EV?`%OXFr>;ba+^)(Y84>0VqViN%A)1{06J=S
zT9ekVScR2JffLFmYvhyfk0;%}SRN3(SL>J&o*Z8d`EZr1J)$#y&Nr{|aNI~UMqTUp
z&4dTpRXPN$oglk{Qh>mFAeyN01vv=IUY1_FNc-(>3}Ll6;HbcxAMUIcc8oV_CQjqJ
zX@n;BAm^3TL-B9}Sd9W{L~9y*K9xC6h$pcyd)LXrLj$w7TmyGJaoyETOe#vSho}g)
zGmYk>`7qqPRs7_T8=HIl+Ou}ma8*~%?QHfHPfH|?ML^S1oQ!3~d!&_==F8?9_~whT
z4qKE=FZsU2!YQrMb=)967~d7_M9t~b61Owwd`XRNx}SY|I|Lhq#*tgo4}=XR4-XbD
zQE!#H2DEVy&+$vE6ZBm1(@boDuG%|VvPUoYNxRu?xE6eq?EsYp!CbP6`*6JtLo$sq
zWta7S0B_;3Jb{<dhg;Eyi?d02-1>xmMK5;-cgCDNWPF+9Gd=DSNp>}DW2Rghv$qU1
z>XgzVx6<(#PO9Tbq<??Y(c#EAGtA5B8d<-Uz*&KrCce484LaOgMG}d2T%71!<K*O2
zY@X&zE3RhhhS?M1yl=x3g?IBCR*3{Yh4`}o+2EJNzSBp4_$0Xi?)@u(To5`?LY*t7
zsm|?ZC!;@<9wdyd+bl`}m&OwxT0>9j$gS=^a_5!(Y8McI4A_4p!?sQHs+|{YrN}Q^
zQh=6jEzJvirnbDiP$f?A0PZ$%_MBrdr@90}^O=S}*Rs*vtTVYQ%b0VQgf%;1s>gjQ
zuDD$sSQsb;c%OOj+ki*MzpZo*a=*y9R-}q*C|ZxX$gaFP_Q4xW;G3_5zbf2^AxWQ9
zgnF!dq<q(D;^!%IGs*`xQNeJ(uYy>uIqvR+ar~tfZ5*lgRczo61G0oWUe*$MQiv&A
zZ6Z4RAE#p~kTwq9lFdTIzGSO!n@q`OE=I~XgclRxV+NwmF2Jt}d#M8xSeF@=9E23L
zE9)Zn>eJab!~v3h^NpfurUlva9pw4Xrd_>Y8_!pLWwv4Fr>XBTji!;Or#X`TS~c&=
z+xB{k8-~w+_nO5~Y@3lfR=3<Fk!pT#Iy~?6;7*hyw+^xki%*kD!$C{<pn)Kg7HQN4
z5O`cg+U0c8{f2+JKxD@T7H?l`6(m;OilOhMKOq_py*lmedQOLaCmYnKE}^TK<k($l
zG2_Rn&4bQpvgD@S&MDj~&hIVGi@%Gs+!<;3sby;VU)R92N}z&Jv#R`^8r?5e#wAFR
zed$J|y3Xxir;?0+)DdzPyY{cp0t6ojH>Tl_`}TYfe)qYz4GjFmaKoVBgw;$1yr*{`
zpQ(i?vtUJXBw9t!Slb7_=s2ZdE=1m`nqF?6O$3Y_r4DmcA&;YwCDqL<0^S<HY>wb#
zi*)zHZ?pT{3YL`>DPuY0wo35fe_E3-6(MKYo5e!l#H-}X+7Lojj!KzmlR&S-YbKQr
zF9THAJhQztfwEG_SjCFvz!Nr5na`2^3fw|!i(4)*gq}AvOHEzSw4sLMMignuxq23S
z;A72Wv*7zEh|F&HUiV{9s!8KP(i!;Xz>)N=?Bbv?@5nL*0#C4|kUZggU%K2h9f!OV
zz1*SO1V>pjX$rj+O@{X!&8K=^7}SC_^=>n{dp14Ze2l28+2RO+#~xCzR_*8okBQIt
z=CK28`jOiF(eI8fMhtZg$$5AFYULB(T_YzNbf|ie%^Di%hp%@wn+V1-H`@)!6P_@7
z++9t86p_&M!4q@m{com1A>d%iL+rjAt<Y60LEk!tJl^m7mTbixq&{5Qd5__Kx~_Jb
z&;RyAWM9YAxOgu=1@v67lbhnls%IR;cKwC4MTO0!FKl0X<foRbW--cViqNeC;g+LL
zYV^Q#*Yi2%UJ=B_sS7d5N1Ny_ynLLUUPD~=lhe;mUJDA+|H7T?4&6Tm>1H874z3SZ
zg<-ePcHUSWI`{*L4vO$?dWu)ZiH>gf1vf^;ZJ#o3@%w&M6&m4ITeQ@2*Z#)Pm1FDB
z6~!<f61j0OFdZ4RS?%Nq<ilL2{9c=F46fe5Q{{w8N(#UmYv0_fp)L%Aub^zC*ezLD
zDQ>nJzvT2W*pbul3zs>24C)1<fvb``_EFxifh8D*_THrdIa_9S1s7$-_p)T~$~b5a
zt%Q-?596FTQv4pYX@qfb4LnHS9#MQ7^k{8h8nZ_ybF&|Bg7wooTvkz0iRtM5Bp*20
zYYL8V-B7aoVj{TgD`U*xPTnpEuW3uwbG^02-72n%x%}fuPLc6!hFp4G>AVzJH~cKI
zriAR|rqMZEGtm|IG21y9H#sm>#z}G~{P?If6{;Z=Yvaoq1DlH%MENV|#)`qzDb@OI
z-CtP=8v=iU0-4`&UN!uBPbsN%XFIzw@n`KZ>iJSE&7iT-luo7ojnK-!BG4Zu3;z4;
z@36yD;kIwi$euDapy@P-cJB^t>pFzu7V5vRDp{fLCEX6c(H`LqY=H-tsV}3t_zBZb
z4?C!GawBBfecH<wy@8ue=VQfF^<lgx=lEs?4o-lQP(n34B$MBRY5zBbE=f)eRNVtg
z3h2*!8^1iVK9musc3-40V{KH{55zfBd^U?Qz>uqJ>HD1!p#ZKa@n6}E+1tmMPTu+V
zxH8A0(&D+`W_CIX(Gs`uHqzN88MgKbJZVvAYP(>k1am%5O|$nvC2J8sb%V0g%%FL$
zic&G@n~nkxW!;%^x4RcmYg(yxRH_?l5vD8-gzb`@{MXy}4TNVaAZ+L&a)y-77#V29
z25JMcn0o3~50LSp(lq~-!YA+?!87k36UA=E>r6$Kq~fhUxfbAgMo3+C0M-=`vZ>~v
zd#Ch$b>z1_QD-AQ;Ow^cWP?zfesc3)>JScOK>U5uwv??VFDrO!^lo>hWFhn1_sD3S
z`N5)OP-+9zC*iW|L@KkHlY-A07oiuTwCMZz1rKWLyFvLDfnLEWn1m1J%&`Ko(Qi-N
zUQ&yj8hVByV>v6z)hyer(j01fm4%}$g)?P;5qMc|@IKG>X>zk{bRE1@JLTF6hve(y
zM3oOSG|V9rL?wIfksm}hdl~JoTgu<L*+<R_P|$;>MK<5~u@L`JKWkpE8FqP2dGZ6@
z7e$tuolYVv38b@uZ9NRZbo#ir*=aywUp<D!g(j4DRWle!^yA;EmxpIakaunohpFYw
zgU^0yO+_jka@8+J_ikrF&gJnlp14lVK%K+ag<ciN3JSnVMdW$=y%uLCwtl%&;=6O-
zvmv!@c31y&letNI1i5+L#Bq9#FgruZU7tEAbo=hQW1Q~0y;#GGChHzsIplILcXW1u
z!#$gGG~2sMNI*A@7a7-$&YhBzS!C-8(X9E%$os(2R0pt|I#7a`J){m?0<{W)e-qW4
zSBdcM?UP>gTfcy_i-B2$y|@QOjk271Clm%YX6S|;)u76li&)3GdQHU~+1lXmge%EZ
zYaYa`$k?V8)7OsgJ=o`x|CK6uRL-kE(L<|fXUu6jKFOHPPx*<PFoR~uzH4?{9w|*L
zs05{~>t0#uLrM&IJ7ZkT2*b&XtG>)8Y|;+Ae$AFTyKjQ=<Si8NFi-ta1TPxGKUcCW
z?Z5n!=eq#BREQSEH}_wgavLr`J$X_g60dbR1eZ^?1t%|YX*_TO+T<-<x!K+mndR5x
z;N#JBI+j<_HmyOJIVcZ^6YQ^JQj`i!A_~4;IhjrS%xWQ6k$M*&Oh5-allBW;$wOp#
z6IMEkgWlxVlcMno7V+V@a`kadi8(v9IJQ!?FhKM-Ka+0=d<IPyu&^0dS={l!)n|#-
z`6=)*$jTsKbGJ07%4uCBo%K}Q5F9SwQf0nFPkc}IB6!pvG!v`q+-_L>5bgJz7O(f4
z3-CXxL{GIWD3=!EF~QA!siIvj0HW+>-R9PZ+ZvXvyPLN$MUYYX<33kITOZQYU>riJ
z8QpqRhxbGlXr<%t?yofQV?8lw5JA}B@rzigf%H|Y-mV?>C265cd&zs7p|%{Fnwhn4
z4Vg|hy6md+jsjM2$pg~^sd(Qh52^DxXHbJ_xPjz~A&>lAs0|rq7~7q#WxkoxaBUoG
zhaZkQRQ~^df^sF`e#uQqvX{$!Lk?61ZXe4IIp_V=sbB;91s%L>aXlNnR~h&_hJ_d{
z2^aX`Ce6XEG>HuF#;uPOI(J@kq-TXf&&y%azY*%0v7RxjlW1n=8<*)g<4kLZP+ag|
zdl|#6MnlD7Upb!^S5~>rWeZ7~YFOGa!Wj09$wT&$%>wC=FpQ%#nq8;?NHvm4FRyRL
za!*`nRLh@yd@<Dnr>(zNmY5y?Gb`my;h;3x0-*AQoE5idS&;^3o8NJc?`V=>Q@WaC
z%|M8BlASR=&TFXpF>lhJE^QvSVwKGwF`ymrn(RLT2&Y~NHJh%m*XE5yXhjSt`{Z6u
z@UFqafXvgI;+K<9A~_GEs_$i$DaNS0k6ocuynou8+wo2M_pc~R{*{l_qN5-TPxe7#
zNB*7ATen7<vUAAB3-t*c7BPO+r>@iUiZhGgn@86Zb9h-h&<hhUs!hICR%T|&J8fqe
zsf(sSqke8ez0B4k%}yiCN@{7q6J#d-^k@A20P@u1HVo)gdpY4&w`vr#c5)Nl>O(`Q
z`SgcD#Gu>)ae@LiX({?vVK3q;0&cPSmRGagNwEK)w}z{q<ByyUe-sY2W}R<ca^up3
zn&YTKc8}*8hh#pjY2dgnK>No-ce|nH@c1_SkRo2$cUFLU;SUcQc%;4W17hG&><7O)
zsPcgfRxfP3M}9U%!PlP9Sa6xs0YUz2pJ}(IU6s4S?i;CRl%DT%+B3hJ#6lfovIIV{
zb4PqkVeJ?!DR#y=rF$KX?Hve%hprw~M;yctwPa^V2?hIdsUn|SL_ZDMxVt%Bo~QpL
z)(@2M@xI1+)w*cw=9BcG^{?v(htLnTnz~0iOe%j~)jF?Il?@{o`So#s2K*UL{>X_E
z0BMg9cyUyFt^f;BKpLzT*L-XlBfbr2wdy*f@;*z=(-Iv2l)G<q{WZu6BodFEW>(S8
zo!~wu!%epKc6&vit$3ThhTk_gQ=|^8&kqe*5rZr}oR5|6Y;Rzi6;xX-sqV`Ta^@K4
zq->z<_PZk{9H!!Geiaxo9}8FWbQfNe%=+rc;~)n38sVjE1T>Q=^juI8-$q45yf?XS
zm2-iEa-wOlIB-D0EM5e6YT~n<p`eghem@#*O#PSRk$?34QwANLrQzacTb|@%7_P8V
zDuuuN4tQl6+~`GF3XGp*&{ALx?+D@Lr~9ft$vf=FC8&RSuT(+6?ZN9qea2TyhlDU{
zXG5~(k91eQ9G=!t*YzFI-ewSU&t^RDz{r9YxDf{`&7NWK$HBP3&HDK8!mjo^17qU&
z+Ldxdf&P7KSbfNgpslPbLyP}5$=i2lu5YvM)8Cp7sT#!L49cyt*7b}za_m4lT3}gY
zeco`~(a79;9#t;tA7DO!BOm{*Tr-a-&HCfT3C_w#=8qtq$+ZY@Do`ik$DxUW;jz5S
z$eUD_kaf@1v_HYd@sHPvJ<?7CB*D`EXeqo6P}E|V;gc1i_Cek(XpA9<-KZCw94((G
zYOA`J5V;pZcFLbULDRP`lLsNLSnfOnebqR%&m=!;gws@Og!W7f_{szqL^s#=gvI1B
zk^dbNr8)FTRCotrypVarn?mX?g;%%Ar2fS2-B8y+3!#SB)YKcTn~$`s8}+w-^*-HJ
zwU*;(f4OlR>SG9efmn>(tfC+Cl*k|rb#au3491r>7#bah*tG3ri)Q#AF3<+*yOv90
zkE@ZShAYBjYglacrS-1LArYAXp?+)CKlGie-QeMG7xHIk#N6Cmjrrhsq0!RnAGxt3
z><(jl2PAsYBzn+iD~e~UJ12fB8ymnA{dp%Z`ejQt1Wq1jnI<&`1y<aK42yz6;VP6r
zEl^4z?T-=;0s<88=$*6e=q|gzfkfwbA^m#j<c~kIACFgWX(=2l`oDQo9cVo(EpxWp
z=Dmg_P0|ID2z$rX@&`8v@d`&exI9kcH};wOYIurQ!Nu=XKtxoTCXM;nOxnc|riCPx
zUrOm&w5Z+8H*@y%?+)&@>me2ocIOA}P4;Iz2PUyDQ!k3c4hOa;t+1pP>Mgm2)3fs~
zdGNrb(p+11W~7n~*}C)$=!h(5;KG*9)+2c5xYg{OD!5YuXT8K%ZG_6nHzGucT|6nE
zT)AQ%44h8pH?Ul~Vk07Nu)L}Cj^MRDRjE1Rrho}J=-ZPcR^5-GHs#?X3z)@)#<lwu
zL>ccbIKg115R|b=9)(z%m}fgVUlc74>Tk%y95=BFm<I6;uC7#_*08Uq#fIZmf;i^H
zdtAI-Dx!p+y_5ANJx?MDr0}lM_x~uqft7HbW22hHhGToCU7Kg+iR)U`#&i1IjsxO{
z!mF}L!YSo8y-7)3R^0no+h&f!vsu@bAU2wp_}D+E*x+B>8k>)K@2=hAc;{NbEuL-{
zP$vs20u;c4tIFM&6AJieKB4qiO<pIMkfQY_e!O?7L9UY`m<7Zs+(Y=l6v`J?ve_&W
z;o8iaIh>B$UxfHjyr6u=2gE&2g0Kvba!M;`8Nc1p#VLfcD7^(}-A*QJ7`T>8^b=m$
zuCJ^-=bc|U@QVZZA>uD!<<JJp^7(|ywjCPQI1>)aRc^&+MKo3av3p4+dcUjs_`7>S
z8Mo4Wk`C3JYCaku&5RTGg{C9Je9l(Lbo_kT6N&Hw(INnW(2A2me3K(}Gr>d#6mEqw
zUv1p~R5dSF9Hrz`ai_&<TxFu1g{j{B2SxpAmcNti!xr<LCz9yaMV~9WR!k6=+La^_
z!Mr1yNn7^fsq=J|^U*mgeWy{yQiiz8j6P{=aj?v$*HBsy!oJ%5h6Q^dT>g4}SU)lt
zQyFT;IW?FM?@Te%HPnw4=QnLQj_E4IQ?1Ug{-_-hj}w!r-q~H!c}ZOUiRX^_;0?`I
zr~y~_n;a{~NRt*g&$&#i_1<BNPYzb&^Bd&B0&LvpvmUvFk+D0r7_H_wHIqVPWWvtC
z8Nv4fhNf^P-YR>e3G@fQ^8Hm@GK2x*E0Nv%%5q(k`;qrK?oF=JCpWy=>l#Vk?B;~Y
z$+cQyJpDt@C9O$k+pg0%NNCk<BZ@e7I;9nbnKwu|d^^MV&qWhhTb3lp_7zmKqYqF4
z2>Z#7Ij!2BBq)IjA6q*EMUnoe_A=yUdveE_STK&#Ua{D)jKbWIv}s22bEH{ZO(u_5
zTpbvHMxBr^VH|9-7dcKf_db~yT})h3nDP{Ac(zQp&gr|BJ)yb*Cn%kFaRiQf%O9K1
zcD|jOAn_8~PBO_>@55Aq+?nfz;oh=|;0rR>DOZ`Q=N!tz)C0#f%p7`2W6fo1p>Nqb
zrf!|@b7+~8@3|rL59L%T0B(pDHHZjKdCku&PM3P-9fhCsnRx~aATGUJ%68y9G2ZP_
zkYLqdvvsVTYY>dT*V|?OGO(#Qbxr%F-b;B`*IEwf&mEe;4d?6zSz2tAx#R1&CJc9A
zqn2!QGk(9ZLAPUCHSj%+YXfxRSf3Xex#~PBIG4;Vl5Wx_TO6#gY}Fa@A~J9jUCcQq
zsW_2?JYxeD?pFXB1g%$&q|Y;d6ZSWk9^B-ado?fH<D1`Js*3(E-#MqFx4YPtX$9+0
zuG3MgihnC+A3TOZ==!v=&Y7FhDoDTFgB_m>aV}A}YXxqQ{rktlv78eV`JG<nSjsri
zb}D9I1zV+xZV1rYZ!8fFz$6W%yX!GE%1&Vwi<1u=AH3SfE_r0K3B|XSu^>l!yx2A|
zh<y1zZ2GIEqM1&Q;KXJHvI7tv_3-apwP<S|e*f8T`jYdv8#=8L<Z+ky&V9Jp{@#Ul
z`EZfo!F^d--UGL*f=?2X@GW7B!>q0qmj>h=k>u%^LeDv4LL2EQl{Y15rPr*Aw3kia
z(Tye_prk<iX>os@Z%dPM{vUWYpJnW5ec9S=`7C#natK2}l12pUmo2AHSCN$pCpiky
zmRne-8SCcb5c&xs9^-0uzR0{yBpo$_6AC7-?B2|IIqmcmD602e-yTVh;nq7B+;Ohw
zoi2uTqaHfsc^)DLL9ub9QB+Rbyw6ukhcXBz_RDO~4FvYfpOBet)?lX@$(7V6NFTa}
zR%+xtA!3SGNvG(hSMjoECB%O0+0&SYN^4hh`voDCHz<0kYgti-4_=XMQp>AKH&C;9
z)nE4TfIP~Q%RAxyE6rK7xUT1S(;`!qSR#JiEzV?t*jF6n#b_RQQ-r?O*eExw4&EZR
zWVkX?64-MO9rfRme5Ew=H93JU^-Z0UzzyM*lNau5KXcVTa{fr&pTKVa>|%JIt8K0K
zspg^YGPQiUdw+)irwhtPQajLM^nfHjAaR}8rJ7nRsRw>67muV4EOQvkKi;sUSRpk2
zUi2{dvWo-WR!t3x!6$Zk-LQXLiq^W}t1wJ=DvtGp^4*P>l?NMJFP<L13B~jt#$&Li
z$<?zF&zk#fgu@3adOPIjMwkO~u|7wol!A1t==W7+$OkW>v4}!BCWXsVqp39BC-`KV
zs-VJ#*;+Wv=+P=s*&xQ<)Z~IE`E_ae9v%fw(sO@Vx_RsaDK-*FoYsw~E~tjqjdZ<5
zI&!B|ZscJeB_p}FZNHzqp+MF)eZl(+xGHot5>1PP<14OW8V|_|+&OL}E^s%DGX}+n
z+A1K=IUeJw+;M?ee`MnlI~HEN)m8=JM9)2)%EC;q1ce6@aAN}!B$p+_<r5Rw%G5I6
z+Td4Twv)o|_XEwzfdPKglE3kabSF17Vuk|vUseipa-KA<F43M5Y8_%KJ=hC&y3YJR
z4`C1ujbHX~r-3@>JGZqysl>)Rl9~>iJ~wVnCvF9kLDB!ki15;ox$Ml|;EE2FuX;}&
z?e)F3FlPIdr;p`1{AA7KJ0^bSrSE_Kr3_x#zkql@Ng!ui(pA)E?1IIv7~0G=m>o9Z
zik)-DVCvCD0L$MBXGF~OLXH}Fs4)$B7KMbPR{DwqY+|fc!jIOTh5y7{q2J_lt^adi
zSL)}EijME&TEgh3v>J{Iy*q4@Cyg-sVE@&6jPrmz-gxM<;kI>!Q(9BA$I4ZifMs>Y
z$4FYJFz%v0ZF@w^^Q^BD0<<XXZE^qK*QSriGg+8eiCM;j#)C|31?DssQ&OmyqH--o
z&NH`BW~=@#yq`=NaCPLVjv(2Jl`iFaj^q9}-+v<lZ(B^{yy5<N^~dz1@a-kVUx9sO
z@n9C*gS>HSH`mwegwrs!B)b`A&Y|#9tWo(LQ~KQV{f$;iEIQoku$ktm>{*d%qqHjI
zRDV7sc~e6gN}D>DsV3ql-HiLPG$q=X7%<v)bh|ijAdhU;4oDN(UMQ#05)|<{-LH5V
zUv}h2lsj_guu%;2c%%pR23-s=ln7iJnfedeG|#fy?!WJ!{w=b?v<SnUxJ3NvYjx#9
zZDz~P{i1dHoshFE_tG|O<9?zAX=?;a48#IPGHZ8&*w<}&u=TQ`$=-w$AC7*c9`oZ~
zG#9zkK{c)7q-ExkmzU!*w~9)b&RG_}JC_x3&E3=(QC5@M=I%;kmEv*y)I7$`q(x<I
z?pK&tyeW=Ag$UVylcQCP_dDaTnr;g8Ck6(|oyi}ZhBTb$AG)s$1^G_re{Rf(bgljN
z?sx@%%S%s1Z-l2YwJ)T4Qbi^h+qKRh-fa8d$jC7BTo7~Bq!uYY+<$YpnA}&6CB~EX
z6rM`;W8#GZ7HG8Jt5mGG(pd5rW62@1DK7KH_xxmalc?rvT169no|&|yaP`>NBX%Dv
zPP!O*Cg^sMie<-g_wWY`Ex(Ah+1M-n^(H(R{hWTO=pHJ$%EyfGCKM}FE!?ai)mfX|
zfqzv+{ly~22l+y~iPPlT5jNxuOZDRD?)Gc<aYA3S-U0SFU){BubFb{J9?6BP_z$|&
z{-;Z*`pj=SEK02Hnr|j}%0Bs&2d;l(#qDFq{UJgf!qHu1QqdhmKnL}mAIQvEAkW%)
zwzw5%%%e&ByXM}T=@>Sm5vecwllR&#mw(UzN4lKVtA*qqsM#wojIPGe_vK7cfA0VV
z+npJf%xWHZaWa)K81?x^xF*UZN5b*Cg`CJI^rYu+SoTL=bT#FV*DAnw9-R8$uM}y~
z*8vK=lt9asjI*Z`Iq{R5Bks75<2f!%mZs~0jqH_%je&r2<%#=Wq{-H8zwxJ=6{IHn
z9Ou(DwZcHMD=3A%Cq?(THHmxq%&(-FAHM&2s+(1k`Ma^~YFhm~h2ZX|u9nnAR4PKf
zFsApOq^+ytSX&JOHNU!M8NEcYX_s4{q@n>s86V%pIC9U5u9V#!P(dV2b%^zMq^a6?
z2zi)!Hoa8Hhg^-lbuKNqCAR7BmXKU#G6>_nS?D(Gv?bgGnmFlqUzpBWJ>J4=yfnJO
z84wJy+;2o*i~r(0o||v?DDvQU+G#w+xfNR7O0rnNHD^Hn0`u?v3V4vz%7enUfQ{8Q
zF_@3n!bpc6r(Q)@@MpVsh?%a^JgI==iY5MCFRNn<gu4E&-f_2@{B^V9M%>h~v_t@j
zdrn&cpJL|PGtk^+X#a6!%kNlD3fyyYR{!6bNxIH?k%z}#>5$ZOadg2;SD)s%n7xFe
zoa&!lFKPu={6CKg%U=&z-DUrPWLVkb7IDs_H<2U{kaBgh{!vK6CAn4inO~D9!k9Rn
zWXq^5M3BSN-`V0Av^$lBp;xq#Lhq=t3Z(SrQlqxEqsX8G3Fjando%8<&}7SxFn6v3
zTaG^|a4+11F??L@{Dj(T??H4v>;p6@7ogK%8s!kt8ds?cFBOxy8~SR|!Guzi#>s-|
z?eXb2q<zO{KE$Ue*(}Jnk=XXAg80?!^ec<A|A?kUhliu{#MNue+7<t0^cL03G~tel
z#|i-){#&JfG9bNaX&I*!m5%$-9Z8U=HtjP_nhyrjU1W#!uWO4(WGm53Rlpts$4VL?
zS+QGSevp&=Ltvp?p&E2$(ZIC~&P(GE3(fpo@IY*gv#8fJrZ6sbsO8w)P$;x5m7hX4
zYtfX6HW};5Rr*+xwP0{j$6Ib=XtNKSIyX1Y4BB6N8vaffERA|f8THDC05p_Em0p9o
zmG3<-5>-(6e@uOKTvP4)zX6K!&;lY23P_4bm%vCtM5IevV52*RB1nTsODRZqOAe6k
zuEEGLIz|i_@jLT*zMt3cPuPk3+~-{VzTQ{fBX-|lrhO)2meXM!)@rvZCJ8UsABwY|
zYKuoMWyL>GV5A{*HmL%}iuxbBw+hHDB{yf~^`bM2Y~de%7D)soos+%kgV?PNh>}+^
zGDmC;iuCvspkdU!fwi*!r-;&9<;RB^*S?bER1CiRtsl%=FuSx1r=90lO+J`Tcm5Jl
z;pqLrF3g9ax;gb!KFni-LW~8MqaXUihiG1&+H70H1V8P<%mOlwGupY$Oue`sw<E@P
z20tfY)LMRGR3hxNiP!r|FegTVI|UMXI0yAW_Adax^B<Do-Hp!M)zTsdU(*N)B*xK>
zJ7eTtKUj&#N+rIsc%m0qq}-&8;2r!7hRS<nP6V-xSU|G?W!ci1=%$nEn(O@BZT3H(
zCs4SY!aPtz<psE6Qv_VT%)4(vM()2~*}E#aoEy6KHGI4^!sJ--Y|`yjLc4d&<At+b
ze}{~V@!ZTe=Rh`L`Ww?Qd2!I?4Kf{xDs!2|$=jd?ssP&*Nos~gJ&Uac7<OJG&~IhS
zgj!xFio!B{&1-d^nd_HPC7=IUpS#zGyM&IC`z^0iB<&LDGovj0%UB3VVMkXcRji6p
zoq6+9&AV<RQ6J~HdB5nY)`8HIh7oEImTQJ{p46%Lq;aSq=!Xo^F{mT~i8$<#9)8x%
z$}f5OJv>3mZ&H$I!-cwq4CH$*HYHq3v0rha??c0I*(<mrlW3<R%4_(xM*Y>mQ@+l(
z2-Ha0*)%#&G7yT92R+Q%bv{Zb?39u!1aU>L<uJ}AFb6j;{=P2zNFe)w^6WRY=U3~9
z^A}eL@O`O(ueFlY?lg8t7uokez|<;@5-@90r@SfoheFhj^HZ^nM|W-JT}Cb`MM-8g
zp9sB4%*d$i>l?ym9IpCqcu>cqp-)Iw`uh&t%SVVaI90_mCihUNOeLC((H-;A1(fGy
z+y>#pvx42aAM>iuP=+oyzcmkL!49z<UHI;|Ly8!(lN2vU?nI}a)RO@VLw5uN;HGSF
z$z8YSHGV49>IZ8QGy(|5aU*+!*H`oUz=Multt2jR@v361q{@HEd7gw=VoG@wLr|#r
zh1*gLE<eY!p3Q%0?QqA?WJkM*>?w?_8}ka?aqxk|%`!;o!`)i33)fKbhtS49Ig6Wx
zr6q8huL;=5a+G;XX|;*)Nqp{RWyW3tX9LkS^C(Qy8P2eG8xuc(KXy@nc6A|j#5izq
zp*$qHCWW~25bWB6bf!&hEo^zwx`^YK1e=)jV!AyXUcH9$T!_83il?@lxSZbJlZQqY
zo{#srKJvpP{7j1wp!RAqv3Yfs^*8H}7*_?-bibG-UKW$^ZGrDE1;h~Y@CKa8WfL-A
ziDG`b@-<y7P0Di)p-579H`dNPuEwNi!etE8+?E699WReZau(~D-btP8{}EyjkrTe!
zC+W)50QKF4VT^q2hl~v#^`=VNxj&G}!hc!C%R$xRy_;;k{pn4YWulR-Fyi-%ZM#Y!
z%QDXqXG|41nWYFM0hxM@-48lOXsJX_UMhWl8G+hzn=+=wHw=8|YZ_|bfr<~A-1>Z@
zpP!}D`1*@5h?%++uE^k>S0<4pJY@fS>C359x+1AMAJMU)|NQaKouLlDaStP<6^%;n
zM^vmHa#%P(YtcNsrkD=x{F19y`LpbD8t@VrK^}1|1hi@!nBb8M<|^ScJgl3uDHBZS
z3c+eS&tBbNCg|<|@#J9f?4mxgugH6Eg_}{6_r8WSD&m<o)lF{!={5-m<J#KnIT9`8
zyU6(qQz_}8xxLBgx@+e;z6(S*zC>y6X8J)D?+r~}2xfg=BBPeoL4CrryRQe^FHc1M
z%9$B(tKS8F9Q{BS5077%LJT^)I?^!S*4pbst)kMx`;d10Z|M<N&W!PJ{bs}&#t`b~
zyY2bC(WLJ(74yot1a){$%I2lMfEwx4x=czmX}(7LK?l$rOBV>fg}vs|k>7kUOt*>g
zJp0TJq2aJ=>(E}J;f?J9mQQ4i<xd>To;u1*vc8v8IWf5i_cuLk!xZnC$H<+q_BNvd
zI25&s?@0Q6X*3d}r)9Dlx0l$+_;XYI35@;F=g&f7sR5UH-H3-~RBcDsuPM!m&Wo#~
ztF@-+4FtD$!yMJn7Ai^eiZ}n<9(;nyENF`C1-ru%VTove*y=Tc)I5{@0&7<X^l*F#
z!4=7qK&tXGCx)MrW*He$qw$<7t`}Q5e$=p+P7gA5107flSqi}cUwfM$%IFXEUk9t}
z-yH9wQ*ExO)-^`SQ_ma)5e|Hl-g-}Jft5`Qfe|zb*8a1vq(yb##qRTX=Q`$lrpe*C
znJd@iZLfy6qM&w#pGo+2vh?MK>N?^!%EMG39hUc^3nxssJn&*Z`5kvO*;03AcxCpJ
zy3UbQsx*>OL=#r1YEn@Unx}HK&7}xXL)pbw=Aqm7(MoWEPcwu9e=r54%MpLsl31Dg
zZUGezO>&T8dw10S{v0F2u3Z{EzsiGY>B}&#%tcXByzwk`DH{0!&5-3h!h|42@B`(U
zdH1(RMM2NSQT^pL`(n@R5{SOsz5YqT{+9La`Oh|9Tnkk0lAuE8q^+C5Cuev#+hYw8
zKLu6#*FdKuUr5n7e8e6IXlGh}%E==J2W3OjB>Tjy28hhI4ec_-r)CZ5PJ%jlnMj?I
zRKi>20%PF>A(i2ZPTFdgR4as;PpIw_EZSo}HnqG9U8CJQAz70Kr!lYSCE!x}AlAS2
zr&t2{?kM8+p%ry$h+;@LA<N@TiwG4Wc)uM`$z<xsL7BQT{Dc&$#g3(+$06hT-OnEc
zjV`s`d@#1`IUP(Yj;mU90t7nDReNWs9e@C7W-*3ULn%AtXDbV5O(e%G(<Dnj`TS<W
zy+1Rz%*v(O#~z&7<{S5ZFaMzNAU-%?UHo#iZ~5v|mZDi&NDJuF9WN$9X*!Byk}9Tw
zI+Fk>krBH;XTJ!p5cnnOE6itMg@eex2?W3x5g%D_l&h+G%T<0k+e2xz_&PNYe?B^4
z+}Vk|wMm+Z`e8t(yF?%E9{M%(p>0Q|?nrpG>^PkmR6-$_IH&?H=LK3N|0LdW%Yb_q
znOQ=4tK5KQ9CCZPRbP_4##pXO=wTF1_>VdL2f6^lS=m(MnS{mdyU}<uXYZLOjoq{!
zn393XeAIUcLd#`C2on#Yz9R3|*IbAj;xJHVssE<bH^~FLqx33^%&&aK4=xUK@5e5E
z^4?z`so&ouE11RujXYqkn$!lBJAYiCerPkREfEqNsiZajwtZ?vUCPFfukpQ{pP!K9
z;!Cpm@8PB6BUF(lTUTY<w1a-O=HF|)#o@9>a)0DOe1!gK(+$Ek!Ac9Q%@mVTK2d7y
zwnC}q2EkVrgv=nCX7jtf2`{Yw3MH^(FTCpkq%41S>suz?<%t=Z++)R7K?zk7GD*0`
zX#sIA!Gvf3u;HJpntoJuak0JI4d&WvqC@uQolTwQr@tSi5EeBj>CBS8gG<~Jnjv`L
zj{o^*%ThhhC&g8AHCiLE%Ysf#8O*%(R!Z~YBRj>w0V*Qkc21ltJe{|~1KrjYpWzCI
zs!Zn_I=IqOP)FjlJ~B#tHzZt8@Yc`D&mB#=|FDG?&a}#gsJY`EJiIEVd&CPG<@lO|
zaT~V6V!>OJKHGLC*WV#?zej4IyDscOBagSG_FHZr7`pFHf8r#~vJOrX>x-NEbj8x<
z&QZ-8Rz=10;LD$@_3xw%r=id^_cP?lH6iM^G(n$>@s)Fm`$qN%Lu;0eUQBAxH~Z!@
zE8Kd&h3W?W*O6wH`S0tTJD8X({C#->ha7KCOxi-VmleK(6?j4t$M~90-|cBf8zP$&
ztJgB^$i=gYxk(nXgKE>^m0b*;`!YU%QV<r`D88%AdDk(u+&DsE9wS>t-MPYD4RJ%D
z)hLYqwa}evq3B_H&J%pGwZUpEBXoLg-ZN`}#ByP5%zO%;zlM_~A-+p5$oCf%aDfSl
zGWBw0lL1i<Bo+NP=}*ScRQH)<<VLC8R7o{ZsXKQPIys!3m~aa#>&B)tDR_GuA6|%V
zn;%|WF_6_r5~O;Tkneb}o;vw#k0?S=warE$#i3mcKK;1N&Ne}~e~_!(?a%J3!=~cS
zr)84l?IU*?rfGuoK$Can#5{LrtXH(7%hUp%n(f>c_fYT&eCU?aj>wGKqayqg<Qh!E
zP$hSlc-pkrcbz!}D4F5vF6Gx(0JIg}4Af&%8$X!C0$sf_M)`necqE`fRw1|1g@eHV
zFSjNT@D$6XT~yYv*NlD8I&P9|72V=JW#lo_gh9~q5X@D4d|^-n4jswZW{*S-1nC6(
z^(FE}lV!b3<0lH(j-bI+uWPIU;9WcWb$f|!Rrl`o`Q`BkI6#FXT`ng>mj<M^icM+<
z8T?jbm}aHSVEZOlm3~L8jO9i$ElqY~Mknt{^+T<m$euWo+GhBzC37?)>Y#qiyI;&1
zF9D_~bRRDvJiCVd*J1Z;wBNS5_SSk?>Ab&x(O&mR*2$7u%Jyy8r3^NhX&kygmQfSA
zjWSI4WVv4kCMX3+z49~o{3hq;A$Qx#N2bLANeF5Oajzr)R+O3BLC-DmX7))+@J$UU
zYwRhAe)_l7@PaXc5S{6oAV}r88Ua5U6BE$K8dpNdlB-^fqLdji!4>Y{jb1KQTrB}D
zGJ!b2t7;d}&d(^}PmB$DeB7-Obx5;sm<H{6a?+J?8rZaS>`<mB<7woy1<?@c*rNRD
zwxK3Gb3DaUp5fVNu<d~Ze({F<&?TFDSW^q+7*E#9V(d>+McwsCU8#AE!P4ZTh>JC0
z_@@*16elDLwxQIYmABXJj8Z3XN2OsK-Iv9LMe_MQ4Z9r;jJX)Ne|CKWV5Iv@E^Qkw
zh#bmj0dU*){529bEe>6?-Y)NAtPP?zdH~-sI5V6o(xZ^xgV(BS0Ik*|A4AE_+3Uf7
zzmBKnz8^eWjL3|4d!$NBCv5N2^eP2x)t9*?61!#Vv~MH!>zR+{sVD#*$QvVH@k>MW
z<=?IPWw~lG37zv(Yb)N;NX*kf^AHEvq%nP~8Avj10`#nop|{PEZDghmsRit!*5tKD
z(I5WrCpk>#SHuwdNB{VQt!vk^z63+IwyT!vTz0y*XM})u7f9#PMvd@xM)j{ghS|eZ
zwG2V7HD+s9A0ju&`Yry3-C$$W+UBkKNgBMV2^ms*!m}@bgxZ%)fnErojnQoW3Xi3>
zAfQDo^Lyx#cRUWx1AO}yql(>k$jZ4I<1+TA*kjyTHVw#X{GQfV^>yCtRYnp;do*aS
zJ~KNO5;uzA8KV@+w5*MustY|#d0<0Cs}^!U<ZDOCd!SayuR=xmY2>S7gKWG5n1;pn
zAj_>VP>dj7=AsDy=1I6ewsr(YsgbZg-N)P1kIS@B&lUg-E+jJmcNs51LA7iy#G$r^
zDT(;*Qd}_=-po(0LoidLdw;TdHB-q+@MWC;4gdr*kCs#kDv!GQ(OqNYTW)mJOIwVJ
zQG{rV<k}<}nyKG0J^ch^B3D_=d1M)j0N8yx{Nn6T4e&n%DV7+wKA8TcyHb6u*;?^F
zJ}m;>uV+nhyKOAs9m;c}eDHPpA1hiDQZq#^^m9hf6p-G?Kisn0tJC_da6%3I0PeOt
z^#;Y4kDUcg)(Jm3VRq+_B~CNzbv8FA3bRf_+-^!$5?d~^zq*oWTG2f3V}f3d0yr_o
zFZH1xFV}%ee}@kEp7C}4)C{}y<;KIOKGy($5zK$cr-<j5_07_}-aAgmp-nyzb<ecR
zZ;8{*D_!B<f2@tgWxwN$vjcRZaJyWQu~Hg4N?puOP!i1`Y2|+bWT3>a#{4T_m*-PE
z*Vl~KS@UOhFsdM{ZE9Z)0cj8FG#h_jGgNa!%h_SF)Q_S@x*rS502K~3C&kn6y>fr~
z_bHSI*hE1I`qfN?uWYOJOCwE;2;$+DMp(HsYYCIM5CbldF>3A2F0r`WxA&7ui#uxY
zinsHk;<DoQLd={>F;jKZFrkP<H8!>f+<M?;sN*9KH2&{7J}Of4v+ZSW#|R8T#Nt){
zs=VW4mT`IQ(XUi8m8lH-#ct9woZgJy-OZOBe6xi>FNU6g)q?=L>E^3QhxWXgnM!N8
z+N(qb{)C_=Tl%z<(G-W8c_7qVtg>;}^n?MtS>8=pW6xG&&uxAHC}`NQIonZ#**Ep!
z2<flntM4wU+pYH&zc4iXF*qbFO)aee1md#X8J8Dc>LzP8Xy~C7InJy}G?)-93{c$j
zj};Tk3H*~n8XK9uKUX#f2*(SHw}cgxw``KdJI6?>x3yAqA8t-Nm_L^Pxy!j@Ow&7O
zYpulL6Pad<dMSP{aW<}2^qAGgp_Jo}`phvK=pI#Ir6%NAO<=imaOgeDf_oL#wA3#`
z|FI-1`%;E>Cp8HDAX)BFN_28OalOdgO(liD6#X6mLRk$}4AvcH?r~|~e)bSgXZzl4
zn-hyg@Hw`avDMYHd)9iO=7b3i5C^RA1NzCDG1ENR?O9Ae0F1QS&q^mXtHP=D5VE9g
z=`&vOKPy?;g=UOP`sP#?DRH6<uJKY1d13EWM}9Zw>FBNN(bpWawQm6bwR2;38Z`Bm
z*2o4Bx9W$1G8{Wel5i_`H$5NEA3%s8;yL`~b!tf0eh4H(urG&4_k9}ZWl+^N>vEXu
zXPJIWY3zPz$9>aBgkXUDS%`8Dp#56DSOa@D+WseV4`PkJHdzL)7zs6Ve|V!<s^%+c
zZfdjPqPdi$G|eP5oI5{bPldll+~utrqWLshvzYhspeU_yl$l>0(=YNKG4m0YtyJNm
zb7S9;J5luE!LzyQwS#po#pYKREcb=@=@^>HAU$1I`e7d<fj)8^w3edoe_f>f8mh+x
zGuc9dG<-7d++=OE+wWwk%52y9nO|ErcIK0!9<b<(2b`*awjK2w`?8Gt5^irRHbOE)
zHQn(5*ELj>)-0dugdDhRJBZ%~W%MQ3s{Ka{URO!nZUAc<CT~bmzU?Hz-6NS)Hg$-p
z#oblcz&f`&XiDL#bX)Ov{6j$1#!?54Rx&4`S<^u{2%fAeUhE7(sY*og_iqc9)NIzv
z8E}L1#v$Mrz{N_sm8#}2)!Zxvc!t0f7KfbgObtIfT&X#m0QHSqg;)Q~1B>diMBE>2
z0X^K^?(tF>-RecppZ6<_gxnvS{iUi7dD=5$2;Ks7GvH1OA&dqNOrYMb=L3s#j=If^
zo5R%pVNDR1keGwy`V8#~;noE(MBT8~e5{3wd2rXxx6m6lp9olaODkPK)gz{P;L6e~
z5$jx-Y3@^mudBojHu`T#qKjajb>#o4SiIP`Ux}{wWnOR-Mv2>2KMF9{b2WUw(ltYF
z(e=4J!N;egnSS7T;8wX9xS>e*!fwj3)he_S#aCYg+%+&MA~ifj>pvcV1FH%J-1F_J
zn}K~z#1zKYK%wa?t$KC_>sbh^u2>@(QP~qjkwf3c1{|`q!zO<Dz34t%=$;4eN~FtR
zC!tGo`WY(RA7+ioMFC*F7yYavK3t>GiR+>Zof$n3m>WvW77_{ql~)xac4|6Z0goq*
zm938SU$)84WEbYB|32dg;aIJ&JlHmdZiEic%L&VsKR0Rpy&+~C;W28(lmVV~y|1Zt
zeC(=cC-3Ny>L<>0yXJPo6PS23YX7j$B+O1e|D_(&fUS65ud4du-*@RmEK0qc_cyjA
z;76!Z_5~pB?9pa3a#4^m!!50YzXX8Exq#gkexU>tYb?qW88@GRR%%%$_O)N#h^eJ>
z>+`wzFje(NL5JK-SSPOB?nT?aC;6rkb<IxW>|>^5!8XkOdlR^=5HSIWvZ)EdHvdXw
zgs^5u#gE!nAM3`P67}q-`{4%4ad@Jj{*qDVO!L|oN+wUDN{BWRgLP^uPT^@(W_F#D
z+NXm;W<~-BW%7hU1J>|PCV5OrtyzDGA|Aaw!qS{9MlKz$XTcNN(x=iz8l?9zvN?0e
zLyhXE?%y||Dv~&P^FP*?m7ZS|7PJIDO+*NBBcXb+kg7&@FczJE=zeFU=qaa@5qWRw
z&eAZ1vIhg#V+xH8aW<k1P89B*G>T!sSp;sL8}1&TeIsYf2fq{MzcfgZ@3F6nDOH~$
zuv~@6{xd(VN;)uF<iJ9eh`%@?<UC(1aMEVb*;VtxYVtAHmt8WnyWSGEj|<aVv;8pU
z&lcBgRdX^A9@)sB+*u{2^>hJ;_c&n);T-G;FpdHf;sk>~-F133i?fZN`k4<`R4rKW
z<3lQAA+7PTd8WRQWt&)zaZ7WaLsgqmwwLdBAYYG9Mo~n(omPwD22>1W>B52^y1d2H
zE^W3rCz^6(XbK<2-8`#q>`-9ZO5wN_JVY2fJjX%g2o=_OFlBH~mlY)ECH`nUQlzQ5
zs-f?G>&)2Emqa8{iH6R`VZagVogD+qNM>h`SNS}ta4Yfo^vu4&^ocJxkp;a<eWmg4
zUv3jKiR6d?uuexaV%sl1scu-G$t%mgLgNk9CTH(<1<UAxA)J03o;>K%q*a@*@_t}r
z5Mgdt)||?;y>-uRn=c+#6olSH&h`+@H||lrAQhMre45o)!J)y0H-gV<SnK9)3->a4
z4J(NI@?nOOGW>_u#2AFqxIwLb<M}UEGdC}aB?<P~C(|6=+)N38ZY1DurSm?wp;%TG
zEpy07<C?V<v=eu3Z(lV(pQ{5n@PO5~zcW)Is0ewh+^_#NDzT%*Km?)MsDen(A~#pe
zWC=qXR!E0}Ln7@S{hE36q%5JYJQn4m80#wOZfjx5%70vQXJ;L$*6mW7_9#C5r7o|z
zUhMOSw36-x`vy<S^b1P+zAJtc`s^|@D_dW32V1MR<*G;4RNoj>r6qK)$<)BELy*PR
z({Dq>@>K*tsN$r33ScH0?g3hV|C@nBHDkl!Yn(>TA&+&^C>^6JY#Sd93knO#X{V^>
z{^(t0@<cfhKE3D|UCmaZHPTJ~W2(SUyDQe2k*Q=v+M1=a({+PVrm|MKex4FrfY;1f
zUeE4hLS<4II9}rXeKf#A3t|J(qAlDkvc=rDiyY&A@l6<<7#X#@G)Z-7`&ie32wqUe
z(-VZYNO|MNd-TU>@}mB~kp#GJRp9+7K}9o1LZqa3IZYf~tDJEpjG#Sj@|O|ONvZvt
zwRwW~+UTv+8wH?^k}%g0utya~r+$UNkIPr+kQMMq#emI0UN+@SLlM40(wBwpq{{1m
zqB7Wwh028U#9;VpRG8lUis9c)W{k`1mxh&qV88oC^Xh?}x^h{`Si8_qVX$zpFTr^%
z^Rj`eh7frAeQZn+A+<ihW3GmWBZ5Zu8QinVpqq2*qQ`M>o<gs$F5M3YgrhmHfdJc%
zOQ)nN{{~7JXvpaYdeE0^EPB4_dSt!O%)b6>m4H^LKfg#VV%L>jQQoxTw2$KEArmYP
z4E(cT<~)2#OLslD$F>nls(TH^{6_9~eg*Z^>nqKg2X)tUDBKLN;eE??Kr>cytbO#v
zz(anrgA)7NhlM9}?hJcLMD>R=aYXgm9DjiS_FKD11=$Z=8WmdM{cbwj@YQ8kZzF@4
zoQadQ7vY2U>s={DG9nK5D$G=wydkqyJph#{`1!{-n_zg&Kz)5Zm_-*LHqfKE===<j
zXlL_M@#>bf2st1mHZN#}?f-i~sbGFb%)AG@K&#L!ZG2~V0ctXwpkP*vlU~4JwY{$Z
zb-Nqb-C|XLW>7S1_FnO`gx1w}$?TAk5d~&<IF5Wl6TjMuWiPqHDsbg!Oh41#!0<r<
z^HW<d&G4Q=7P-Q0JZ;Op!>!3~u}ohGbzBY_W3{(eu@=E0lv6>Q-7uh#Q~Qo#rLZtA
zC)XFE%RTTqH?=fA_cXmAP3^)(*aAZH3RFTG)39656{ex3Q9<wqAbkzwXy=aFnJ&-b
zwO`w#KS2iYdHMEX#=c;I>4nB7dU#oeqbRKB(3La2*0HzuNi}EZ`56+qpYC@hCB5eN
z_K72^3w>UAo>{=?;#@v@i1O-1GQU{6T-)KBl6#aX(>K+JogPCSzpJh+P=j8gg;xDy
zFm`9NI!3n{3D1144F#?G{PuPZT{s9^K#%w4>JF<8wB0VhM?Qr`>(hrzz3!c=*lb2$
z_4f6b`kg&`As&p@O}xSL_uFaDSEZ7vnSqV_6zdv><<ArT>BJT&wUwZw9>3I*e}Ra}
z-l$n)G17t;fDpbvIeWKiI*(?PM>uYMtH})HR-U|V4T{~^iOdW8T1>8|;}gd%m8)$?
zGHc{!wA38t=k<#n6-L@%S~b!_^t-92d{;q;isr6LMg!;QyEKZ_Q2N{3A6VLS?wuK^
z_)Tul1%0?LJ74d%^_rrQ)Q;2+z!GXaopg?PdL7~sqNbW}&1hM+&_S1BH5BL7YbtG%
ze5EFJat5W&G<?>Z`!)8<N>ySb?{f`mxBX-t>ASPYTe0eU?2<@QdIPG80wzf}4fc)8
zMq)aVH`06{iCU>2uMuM;NU0S=8%2a-Tn{t{MUkzXj8Kra9!+GH_G%f5u0kjv#u6Io
z&*HF+X?1S5-CQ7~>o(DZDRJs>C3X5=OTVKtoN0SjcJ{?C&dbl-p73o*a8mN8V~}=x
zNP#bT@UhW5qlf7)8m(E47&bQjdc3fw2PY^qCq2)Bu3x!M<+IpPOnl$K5*>|81TBmK
zn%2<Ju;u<>du5`O2)p6Hx6t*Er}UeQ1?lmjwW;(MP=6siKFiSsC}T`%Ox}MlFsL7p
zeNBt^Ssj79^3OO!Rf~Ds-cj!8@NS)u&AO`?DgWY5gd31o7l0O>SVN1EQj0zJncXi5
zG*1-&tgn@8o7|q&vRBtJcCT+9m~F~7V{BXRjAJbPELeQLnvhSb+o0H8!RfQ0<<v+S
z9;Bd6%o^InY6QoArz;GbZ5A(t^(jbsFmuWz)dAVqERoLyiG+5%R4j`{#(w8}dan|B
zBh6O73)+D%&yV>fH%_+$*pZdZtb3@T4931J-Y8a(2K#Ztu!>i+)115@b@+^;@#f1H
zEc6*<kx#>Q+C?+I>>}%*g*&>zA+;TTzv%Ccy1a&_zpP6Qk5$wfmD-eDv^w`8-Z?Tq
zO2pLGe)g_$SYQ|u*b_J}`{#HSIeKR>{Q1nslebn3PMcr9)HtTre8f;9KN6-jzGd8L
zXZzHc`k8Q{(VL;`@J%l2pnSEf2Q?*n&HTf6NAf)WP`A<3NwOlgrlAS{7&TH6kxy5P
z+%FGxyS?Yf?d{`2Hq~LYXX0QWg=p<~Bjuug^bVxpa<w{N>tJ#zl36b2^YqV9nhv8}
z$giu<Hy}<hgHDCB=1j)M$W&I;&dz}UG)HZs^P$f-J2i{_nX-s~b(|UJh-oYyUiJQB
zx2Ccl-keE{yT20LE;r0nOIF*XquIwmX)J;>rZ)HJ3=E<f<vSDId#K1<lPrSbngSP!
zOll!wN+^3(XBu4Pr=uPAdt<<qZ)qeccl2UG{X|)1Rv#X(bzKr|<M;k}2v*rE9F3ym
z)tQefD0fq-f^3GPtA}Q6BlFLhf3joeAhHo;pr7*%gu&nD(p&IfMW@OQ%P`q0==I;i
zlLRqPcN<>N@*qEG2mZ1mD+y61Q00An&b2(Igo@EjXW7lP73hsgj&yV?|Hto3*<{%J
zx%*k6&cAj*PAtYkpY6iR6tOlAS{d~}?(woEl-~WCSfLa?1fgM+s~g^alT+IoWYp<$
zb{CI2<?uwfLjNI8DlO`xXL1HG+jfHW=b>NS^e!qr{L;8N9BV8kt*~lt@dBg8wF8Xz
z#aRl#T-;|1xBR4ed^7`Rf}Gu}FJu`QwL;>X+QmmgKNWM1Y&RG6^NLFc77J2hYaZV$
zt<}i6Gj=8{*ez$Wd*7?ZiRatHS%S59+L9B+Dwg2amacj(#4kPsYZ5PP73bB8AC?tA
zGB1|!bJyA~BuD!w=s~k9#(y|?BuGX7;@ts~Kl|MZ?KDCxG-L%5DpVR2Kdq-qj5I`S
zEyMh2sQc+K%=A1Vie6IDY+#U<h0SjAEGL2HksPsXLG6<2%TsPeXYVwEh(XVgFU8AK
zGg*o$pVmXahLwqs8x~ejmz&(}OjUe=ih&VdrtuvmL^F5tko~G^g=<p1Xr*@S+rlVq
z3j{rPP6<GtI>QOu#~LB2g^FiuW^OdmZ0-_%45kKBwE{LcOdzmTnf$SAvO@fiWNNsH
z2WltR2N1Ok2-lN7y3kN!(R}acC!*a02~#DCDPm6xD8}j_lOo@e2i~r_M8{_udof0t
zR!w&+m}<>7{*zw6R}hkl3@tA*bj|kFLcnN8572JeB+p`t$i+M&_Gt<(+#9$~j$d%V
z3T^#kIW`KQ3n+)q)0IF{vOt|2K@<}?8GY!R?jx@p-O5slG`JHP2WIwh8Z4Kt*Tv^%
zyC8<$jg;*$f13bAhq0NX%YwF>;|YUA+BqD2yhivkpiv)!Fi&M4+9*ZeSVNRH>&6-|
ze@&=Cj>NCZsJa;3o$Zuzp!Qp5p+$OH{KUvnLQ4qjLKf?!pZb9=t2*SZ_bMAR&`^vw
z+8JG67+Bw!+Bh)Y>a}{ym$f_^imV?U8W^OQd)talGWUANgEd?qgb%DSbV_|$cZmMx
zc5@1XKV85QKF^-){2OXmYxs}DW2-eYj-A3y{}O6M31Tng4^oPm-mRVz-*R*+!hG~O
zRnHz|2rhTFyG3}EwUCR%hCM$NE2P@7&2EyS!qNW%FDLhHr83B~W!fw^+*0^%jE$oF
ztd@I$NHD-<@%9m3%kJCBC(3gx_w1X}h}|YKIAmw_^HtGt9d+XSGHM#Ja0O0*vc?x$
zzT@wXCK9R^XMU6RE?7SK6xIA;)ZsPqSjBSmE=Jd`&BTGz&ObjwYqGwU=N57x`(obx
zTyXQ=MuM<N?GtT+{v$;_%8l}|E*<W|ckE{;@uN#V4bNUx_P&<p<Hk>jI}xl`U##+B
z>KlXPW_ZvE<oiu4y2eK(cJ2I*;@437yqBaL&R4R^ki6LZZ4p{>HRC7b;_K!;S~va2
zhnlxFi_rx(+?ej`#3Q|S%Z3-Pet#|I8*jZ3SKnAeUZQ%2_2C8dYW&qX+SPBi^{S#a
zKO@mVJg(_Y-$;6M5~Zy0Mw6PB*Y{&R#DYEHSD$_DV?`<aCf_DBhM{M33f|{tTI&0n
z_iN(80rI%+w~m`6lf!3|tczKncSR-`x>~t?@05F?yVCGHlRmG)PIIk{_);AjX~w9L
zyT-LXFtf^+G<8a;wO#Nuj6o%T8%hCVt>u$4ugK`Y^qY{mJsJJK=qEO8EIkxZJ*mC#
zNG+(f<u9}IHySF8w3ca?P4s>^f3izV8>HgOsX~oSCa!8E{OlKW_YUM>p;X6cWm0+F
z%c^HrH_^ufkG~`Eq~Pt=XVxxZWadgQGf0Vp$M=5du=arHw-gmbKqkMJ`Fua6N3%vH
zbZDKIaEDA{T_3RMWeMqAijcx5SA99Vlw)haAF9gqIxcT%w5Ww=73X(%Hnk<4G=F3A
zp-Qq1C=#Kk&ST?zK8&xI`8ZdMH-dFl@VhPFce$!(h_bU~OA67ePTa8Gb`Z0S``f=$
zFBRTbcy*^MWIdf$emoG(lc%JO^a|atZZh*Pr5qdM$`ThSh$^kL<)<Po^9Eng<fmDy
zICL~03q2?NPQO|o1c|2%{|u>Ka}|7gySyyEd8c671F&WTtiR+ecB*4+Twi0fCur~}
zq0jQj&3#frPMWgjOx$2C5F68KPX5Uq2JcEgLZH;f(p-NDS_&}O4Hl!6(Pev{z@ZXa
zZhm*`#`d!^`hEEUwiH}O5hpt$@jVR82BMbYuS}xEB%XY)2@QHlX)iu(nX5paPHvi<
z<DsKwQhH0nPOUdlF;ytS0vsP^v%f;m9Dbv&Uiq6b7ih^D&v}esCd^w~kIcz%B7;Ys
zJo>%)8%kz4gf%*xbL&$KTCnj>7M<|${#@*_+(h*K+%&tVCR**DluZfSEGjFDRUEGT
zR~)k11Wr=ueqor6Z0bG5Xol*mE2wy)tGoLwz(b*`%Dcv^Z{gC$#zy(Kx0);o9PS;z
zLBAxT5j;PG;_YKm9CO`gC^Y7NisGe)eS>jlmJnKpm`Lg+hrHvq7yR~q)Gk*c4q?rX
zKO>M{n>agSM^Q^k0hnKzN$OKhLSJk#{<pl}gO3OUn^;53m6@_5cJC;=zq=P_V+e+5
z*HVtuYMm7n5lIZ)v3pr>Oy^L;^u5wD&}FZ>yj74^`783AX9zmo&05|-nqU`6O^l23
zIqT4ZrTol;fdD9Sy4<{L+c4lE7moi9nC{$aL2aRE7ET#p$eW&!i)Q^Hct~5USiXkc
z{<Y}+{S@SCN19__+1bVk(bXd_shRFsUpNzzVp3}OFl)KeO<*SESMyZfuVip@7xLg|
zGD|cWYm>URp1F5%*$a-uB^F-o2d|3jh7q(i@oG^5yd0&4RT(G6{eGWa-aZhV@-Wx-
zkESFmj`yl)Od0(R#4bC=b_0Djk2^6@UrX6T+ajT=j{G&k@LIv_y^6^!pCA#wn7cVZ
zilB#B8rpbCa@B(Sdid*-!3-4!Dj9qB2_pB>2|Su?w(^z6>?WYuyx&XmyDJg*TkRpS
zN*zeboh(V(q)8(x)VDXv$sT(0N63fCA8yOc&ZPLA9ESTP980q>vY1tF0JE$>)+GSt
z!L;+WC83GN9TrEA*yr8_z1_-?+$KZ0&bF(#XuH}h<(btd=md26g>Di8qi<JK)wxpN
z^*Zu3L_v#Iu|F|#2QkXrIckGSH(F^>82K+Rja&1`M`a{4p|YpkK71t1fBj*v)fRow
zN1?aLAR=<1YX8T~4lGIx86cw)`bdv0j;;N&GDJCnbJjjuetQ0$mZJW}W;z+V;eBHd
zn`pke2zzEWNg%{d;CkxL*`XADHO!9lv(#4nu$b4^V6cnsjj*6_-R_W%N?lVZ5V6&m
zbtu`>4b<UC0RhrKr|NSB+*i-sZlOq4VfKxQ1jy?@{G@EH_cd@-Q0V5nqDRsUmfjXf
zQD*tV*Gm4DZmIdh65pn$%vsgX7;Wk=sJK8IPno&d4ywC4mDa3%fUjvcPkw!bphZ@d
zDgj@^_4+Ed_Dm8pN1+oht!WPw+YK5$%l}R{SOw45A4m9~;z)mcRfYO)IWc_0n@5Dn
zNouQpcChTdo(y~b#?qJblAc;Wj-70Eqj4%ir@fZc{N|^)$aO91S6%?f!$n{0<oM(y
zy&|JZVtW<al-l?YBC)T(L)RgAYD{H5a^JP8ctQfWL%T)h=APNaLN|H=7%GO4M(y>*
zT_b#EooS#Em*ZOY?3Qn|qps(N{6mV*G4fjTUVg@kq7GMe8g)_vxxNfpXTmr`uMvc&
z=cG*#utd&vp;`WfsbZ{2$49?^&p5}6=GC`{GjC}Cpmp$FO7Lw@UA+c(i0{ifpftQm
zqT?~Ap=)(GEc*z2XIfGJ1Ts_cWEP*)tHSpTef}9}VJBSS+L%^El$4bGMv_DTd8CLl
zFZDWKHpYz^bbU{s6Q4k^1l{e~CLp2Y$<T;#$L*jd{xxmSg2dJ2`GO7NP&gU}X+Z(F
z5AiGdwY@yT-xrV}{F#c7`&S+bus?A-Ha&zF^aJo^|19M_n^O-wuQS>me@v6n#d<Gv
z7KJs`MeeztIS9A`=pJ*PGsA~D_9s}F!G*--!c)3KsizooUT&Acs@S8r4G2!LC;*&3
zPLnMw3G&%*El_zAM42y#s{R2+E(ZkNAbF*F*5x06_d)cdo&^*MckKey$G64lQ+%T@
zn`EgJ59xtBz|nlr%C0_i=jzAWo(-XwcCkL?)_yQM1A!!?C14X>%D4}Mv;S$y1qLj&
zk^RdEosZ{_I`!%7TzG!n(2WJSw5F~V(3qiX;)dy-g;%4@scn9kd7W#Yb;pP*u<q6A
zg6*|<#P6O3jowV2aTy~z0OoP{RC>-^Y&K}U_bN@?qf=~p4}#jOyT;z?C957+^Nw~s
z_Gf3xL}M0)!Y?lx+OLUjo?+=6q%E-|J#npd;JM!iRZv{du)h4?ZcnGrcRBnQmzgbr
zkm0~|Ey2J(Us{A-#E}VlXY?Dpe~a^lK-W+^yE_0}IPPX(xZ%ZtV|n9!Y^WP};lPRY
z*hBcuE|`MeQtK5iI*74YUtti34IgL0Dlnfm&DX|!SR0aKpT|Xs$m{0!SyI<G1%vC!
z-WzdzLDy-#*6W7^6*x--;B@&zp1)|O2--u`kaWlA0md5753&TvC1U=B;HU3xSx8j9
z0&SBeW-YnjBu?#+i2;iUEUTA)dFH^{#u~sihQ3rBM>}Q8(}R?$MMJ@sBWkrT^8zl%
z^`1o4e^sF&sI-@RLlshZ1!-CE#rPf52-nTWXu7>-T|%xxx~+F{)+9^j-~QK5#@C*w
zOQu0U2lW>rfL9P$iimk{mb%PQh*n0xdUNG2X03}UqhOuH-2T&|CU@UnXxjh}VWYiq
zVWt^6xUjL&xei!f`#WZ8l0#THvZLe_zPVh0t+;K*VM8mQx#kbB^1?6|1C~}{@Vmc<
zil(-N6bLfuOls|oR99kh(x-Ork?I=#wscwW-h>?8E`*bdj4y>JoRM_co8n#Vk>=@3
zjAKJ|&fAAV4;L$OCWOissQ#IaK9i7W{C5lyiQv`Z8VQ);$x6Ci^AMx6ukB+J{^piD
z8yBYijL=8%$$Y!<K8tn3-(l=9pE;!43U-ae?8@;@+}15H&<>lUL<?+)S%ovw&e+`H
z`m?kM(!t=$qx_<F;1Y2N`*T%06{M6g@iylIBZc{4dFapjMjE-F#UY@D_Gk1It@<Q^
zgkf8xu2Xi}KJexx$QZiI{5A}p+VS#}MxMbGdr!Si%je+DoJ}D|Wgjd5f9SBFOpR8^
z2h&fyU5t%v-rqAyxBCOkiAmm`{n0J-HPpTfY%H57Z+H4V-XfMC<oCoG{0qsHpGM<1
zvE8S340TWI_6EKBxAMM@100$KFtgkt5ur9c^A(bqA~i~;+Hk|#j#^hJ;Q;hbQh!Ji
zRr{>j`aCa+-9Js4u=n=S6W)aGclhAG$)xSShJ}p`Wf!=8_8;)ny^~c|JH+WFt`&v<
z7S4+TWNGmU(4LN48YBDp`KioU=jW3X_pR-u`e-E=DxT-SLS$8;|C0Ce?3)A36n~Ee
z;Deb&L_{;5ADJ2)mt_AInUj=e0Zjj2uQG?JE1Ho}n4jv--Mhsw*uvj`vXTGolp<ZZ
zQ7Bfat31&=*woZ?AQGNcrli8U3uN$rlUMU8$x2ainEw0*41Iht@M;!E;rn8KeqM+?
zuE80p0ta$NVBsBBMlRb7qVLDbh(z=*@D%(rF&=woUHkjbu5aj()ga0s#S^wz0JPId
z_Lp0(UBnT{iwQmuAfu<|)+N<RvhU=noihWnZpHpq@pipn%Z?A55A!eR+I7@n+jJr6
z1Lwc=O#X8Ds6JMXn5U}2x0$Lh+p`L-04xkB0Uy|d&Im<EmVz@M<4=BIkXXgSK^5}y
zO?C9qw%rq+jF}7+E<tO94Us)|Pk{GA7tkjOJwu<TDwsBR3VTx$Ghzwj(yed+Aal!t
z^B*HnsWECGg;8l(0!zS_j#P8yLdKg@N5cAmI|0t345@KL8zC$Zb-i!4a32R01N{|v
z{?Cr?UGyHHg9wajG7LZ+W-j8Y9;eBeUrtWnY|za>E9e@jvQbOJ*;>kq)M#Y}!Rwsz
z%A02&pI(7t&ZR~*?r2_oGFLsu3`rIH<A$5oE35nYp5&ve5)W?#zA62~JcQ%=fTD+q
z(Vk+|z8e&X#KUj7DvpnNE>||D%N}qLe&1%NM`{W~oJ4f?45;6G4S9W)Qil@^eiq9Q
z-dbl7^0E;}t|8;#%Tu%1&&>yRT~f1(=bWFC>e0=ASvN((nL2^=&=g+>ZVvLln*C3f
z2${l65>@nRC`VXJC_z^z%2#@sUY4bl;mKwjhs|`Y(@LjEHlwMdr>6)*hO|G_XnaM$
z@(ufjgjmA!sbT{ihb+e1nd(M)7GV<U+2e}d)NjdXfB-oi8nxPbJKj0%_FdxkLl%0}
z#%~8sq}B}HFmdpTm!xPa^$t?R5;=zT+Vg90K@I*Up~Z_9D-P=)=)p!}#y_>Fz|iR~
zMlh&f6W#gzm{Y{%FQi1B6kRTqFIHz3wesU1<f`9O+~@8jL~z|a_t3b&H`Uv&T7PRS
z0>~lZ{}rSp$ATO<iiwUz3>f19kgjk+-9J&0?oS5~D}%T;Nbl4F$=PVu2>aQprwXn>
zf-4Y+&@Gt~qF%T$%JA2|?+zN(9wgKlXLWFCz(YiL3jF|Zv|EsF`325(;r2~!@C^y?
ziBkMagD0tCb;EsJSEa^LiLGukH4uZwLDooooQQ^0s*#%OnYyZVFkc<KKp(LHW(*+Y
zmw&QEG8(X&0pPnR2A4a+)l+7pe*}9f1{QpN8TLB~8(kmGCCeqtYsR5@M0S_#HrXv@
z_4XV%OPT*;Q^$etg5`9X5{iUwOr#V|n<w`_mW59H<cuBI`0(~dJva`_zOn4e74G46
zy|xUgMB5Oy{YJ_7;s@&2hTSM3n-ZnQb;<#Q0R(NxO4W#nO92_i0UTB$@bpGPj!of|
zS0WJWO@--tK(IMqdb;pwwbyaB4rH<a<UTr>$wg9VsOW_x#fAR}eHP~SX;02k{=y|g
zgW87d)>Fa}ilt}_9VY)^`%mUa0xfE*L;058k*x8RvAsgaXq~$<(?PF576?>ZX>OPI
zCvO8X%RV=ekiyhp%qs+{nIH*uJkVq?|Lupb<VE}mIdXF<K&%(iV=_Z(kxv~n&HB-X
zb*de{J{3yzDajRaZP_Zk_v-I9hq4&77lskZM9iB3YU<{=YRG+3vmMuKx+|t)VdnNg
zvfZZRCCfB5W(ir!rO_r(tGq1U?-)eG`iAUJY^V1bfrl2B)Iic<*K#x5CuR^rf);Bm
zuCs<9i0{VGn3iv*8a+D#NG7RgSKD47*LDuYE|PpU1F&n}G<7%hpWOF>Ve61*eSTXz
z$fgWf_)_F1r%8C@KssWGa%lp?np5v+?3UIDM%Vc}Fccf^2E&Yg%17dQ6zofU2Y_LR
z{`+^?Hje^Polp4(V685Es>v?Ek7|#*!^V_g<hunTRT38(oBY6o@KfT?91>CE9f(`<
z7buWbWPV)NVX<w>a6a&mIQ1kHA_U$nFjXmF+eY;szraO9ioZ)~smQopN2Nn4P#wn`
zF_ley4P-iu|8^(bY;UjV=6JM{-gMegKmQ2;4+Fayn_Lw#bsi??M8=0ZC=~EZ^Oh6B
z{KSD@d2b}`!u+uA6vZ<B<&HS2E5M0i8X$lGr`*9EUHOUXm|V*hsK?@r-Cuju{@_Vy
zc_dU>A!6PFkXI_8Z{{`g<)_U803h?fW5z8jwWRlUhi^>+*9he%1SRi=`89p70WPs@
zh%4y}G6!-9h`g}4yu1{O0g@H^J}JvO?cM!)Ro(5Y>^#d8MoxLcU@l;dxanT<G-qA+
znR!3#)^G6w#w=srXRpbPPtRoC4gl!$@aW3ZNJ>inC5umX1QdJwxvq%a^KyU+X<FLa
z8#?fV#AAEfG)33}2xvK6E>4}qeNW5O9=ojdm(vJXC6StKj#-fL4YL>ni;cq5)3DO(
zkiy+?@X>#Rl-n@`Kf%QzKUQwC6oh|7+*#k;thmHtY7GZJj0v0JLR5fTD24m9ddYhZ
z@aKgPt5a7saQhTj*(%(g<}mamIQV`3V^`Qd{WaMCW4YUma`<h3qf}!_HLmTUn%gs2
zgsWlY+o0bqz;15-0tjFNwt-Yg$Q>pL77G?SA@bK`TB5J(4c9>ztJ44%QD(?SOdb%I
z>^&Wm)};1Q>RUVZq5st<9osb)|C4TX%@Qcn3N(A`4WN-IeT1<8)rB{_cPATsf<*P-
zSsjvJuP8InGKQAW4PnL>UK*|5j*6Xx59gUQN%8so`9hRyw4!i^b}!F(fwa@u6_CPK
zW6+Je7j%Usu*8M+@3=T_x$Q9^qADU!_CNS50SSv3LF)HI=X}dQ=^Kx%;PzbU9V;lN
z>GZSGOMuVsvuX_J^+fFU)qV#bkjEMMn&Qwb8fJT!m@XvKh}eu~Y*(kmkS2>Ud94{R
z!@n1Dn^=dPQ~h{vR3O_5_7<vaG#?<8qJc_)m#RZ9L+`4<&dXm}5MGrv$JFOd+|+ju
zh2F`$<ACJwZsKjaYJ5FMySqdjvPteUjKsKDWf0~e81@9DQNXm*sV!zcl)Cqc7sIT&
zUYx=1HBdw6%Rx$b4LMO;oNdb%Vz?~7BDPKrS3MEU7Z>X$qX`FgGSJywo5q1F1h&X`
zCm%i(j9KNwu)m>_<(~TTf>+`%5JY!HzVW@hSXAwH!BMjHvWuu>e&78JxR!Pmp+AR2
z)d_y9yU+Bl%u8Z;*kd8!jHJz9d?(N0ssv7x9~>E9+fJ79eFq}FwI!zhbobQDLha%L
zf8ynteSlW+%U&HSeQ5_?O9G(e`F7#eb~+Nqu5vfe0tl!VG=(h7@nu{*0Wom$Cw*ux
zO1!}VOI=vfMGQ91BWu=Hk?2Qw{nJ*nyF2KbRX0Z{^fffX&&%s5C>P_0s71ieyuM|e
zpKV`i;BRzyaoP0z@tNJ(d2fOcPG>7^m`hyEH4HvvRZqUq|Ca7sCCujmSSzO$-E=7!
zRaM_sADpgzM)SPb_TnD%pn4R&xKJYy9^RYJlOy0~W9tyG_|R3qbjWyh^NUgg8+e{A
zFzGqqU$1f(PkUtCV+K*+h_@bA|8`tzOBih^zM)aAi?=#9nj%xrG~5x{@hfE3Rbi!4
zKMI;nucc8nz!Ysj=O~3JVd6{|f=D^gcDe5%j52yN5>XoUpb{b5+C=2o^`+sXG-+&T
z=M(QZ^gK3xV22FdXwUeJ>Kd+n7&qhq1hrXVwr=70@3)Z&B))&g)+-g218ZbfwAkw`
zgS=wlDcyQ9e4oD#Xa#a!W#kHcNJ(I-%B6VZvM{cVW>S4F2|ZZu;K4#!Uaqxme2^b+
zOf|gW$~ZH!sC~PNkzb6OH6=9MUf|7>*%G}<w%0I+s;`tby=Km={&RFxU73*tt%W+J
zQDawRGLruGBuglv7{XAb?DO|-{Mvgud%~D!#xQ8p-&|7!Ym>GF1%N$DC|i0`%?$B~
z6Ou?y$c0#LOwV#JB)l_L=k#f8GHoa>6Q53yAAY`**9U0(J3Ig*;2!`y2f+4lZquV>
zME+^um%SKGs-oV5jt0*sVI%UuG~x$ui8WGy5gXxck8Wj#N3P0j%jbd0Kp$C~6y@qM
zADX*0XZBtMbG!kmv}<hsp-9kqNe6zgq1+(BLZuPQVT7n$`m7Sjy)*sW$vooLK$G^N
zJ2Qi`)HW*B?-OVH+bAubN&L81DUucOhq=3rC7ep?Qs+aL=9lOD=`JV{q>JRmqqr<<
z7a2NcF`#F56}6*L3{GV?E`<(o#MU=KpgVO`TE@+1Qk{2VMvs~l8L*j7r~S^mk$Cnv
zE0l_1g4)wD4@6bbm&y9hXGm2hsFbG3x52XKVKrQkS7Te#&^q3If?3M^sPuhjhv}O1
zokI%QRF#3iveS+^NXKTZ=mnWAgt&s#%<v(vwwIB$CIR&ZDU5W?b0A2f{S`<K^yUOx
z<w^a)?_4_LFdxe+@m7k3*2`;eLt=CSUq*c|fIc%zvCunBw2HD(jhFXx_%AIlCDcy-
zEQyyWFQ|U8TQqKH<|$zx^2EpgH|d;8N?|XLVv9HITh3gxaY=X&bZ+RWG^`N{6VkG|
zn8nt4`ADckcY4nbF)gR)%a96!3B$Y8wFaRqRIwS<S7#YJw2bFp?=Ag9Of)mR_(Sb6
zJv}|u6@c7(=hOj2?4{=<*R7x@l1m6Z``C|ESC9c|f~nW;PR~QDjkH55UyT9fA({*G
zE&Eszu69wG>o!s{)s~$j6B70T#<$G84{|b@#L0QP?GcSLfe+O~sw@rb);DFH<8Scg
z2o3ojrktE*T<QS^si*CgebWSVdr(~M-Shl(*4QMkXhEuHK7VR_3qrs31blSas*(M*
zQ&T=>&fYO|Q1gaV_8rhtyY#L&uwo3b8vpDQy!NLr)X5{&dhh>H@RK4VMGz1F-_*XS
z%=<aA_E&gjR)OwXk4+a&zJ5`f;SrKoy7e5cy^v_t{M^#6>K4RfRw(#+P2g06+?gbx
zP@Vzbc&;seA_K5Efg3UZM5{Bi-72~_$M)A1$s|*51o*-gu1xFeS?&$}35f}pn<WyG
zS7zZ%Q5<&9jl5A*LKUvpL50TXFa0UZ(_?1)C`6I@gA=S~QvZL>%phSvS%{X2K&zV{
zDa)R+*;*Vhj6DRPO}Y>NRu;}-3clxUz@5nj_KYHvY&`Q_r(kBIAh*DWr5@P5*9yeh
z@&7!hL5cv8I;qAvaAc5j&H`9`0Z%E@x{G7bU5`w#;Z<7^=}Iu3-p%-t^6v?_iGR4W
zmVIxV=y8F16l9c)v_W4=$`8MO6KNQI&Nxe^YZ>&cf#+=EK659~@Oe`!peWP)zq+n$
zYT~b_m!Mw61k=4rCE+_uPHAaf0N*n!FyPkdgxHS9wgw)?VRo+)fMDFKxK*%y-}|qt
zh`Xgov~qKWUCLv<jKD5l@#r22>-o_i@p&`$;!peClSwmiB*eP<<qoxfbrf!mC{dZf
zIg0^5%Z43^qj(6Y;>CX6OoKu9C<L8EY4#4t&HTXsJDm|HxrSv`>s;aMo()D!zw&0Z
zv<WI{!K=wtzv7>9fe3*^hqcPp3BCXC+P~j-`&tUWP_F6WefAbsRLc_fn=%793-qA$
zIWq`|yzpJMwzmLZ^1t1>#TptN>1#<njjytv`2T1+>$oV|uZ@e6f|N8$cZw*|OLt1Q
zuu=lj4NG@RcXxM42rP{tExFQNOS8l~JipKTH@nR4>^(F0`JU@s*L~{vflQCJ*5A+s
zdJ~sa3~Hs^UMPxUz9sVAbF=@>ZoDsG`a1u#qM;jRb{2!T2!vu}*4UVmm91LEsQTLQ
zTzfzC=2d6is(WfsWz&4AsDco~PBwe4k4Hsluz^if&|X!I4UT1V;M}W8vOuPi)Rr6!
zqwr<TJHMe-t!iN8i+4ZJ)4|(K#~e5wlz{r~u<pq;0qAKdL}mh8&%Z#6u0pY=BIUM*
zYT7|SSw>W0zt<&#(4<154_}8eYNLA5O7hW$i<-mke9ln)K77XNzYi`J`AqB}g0qu}
z%jFF(<gVoqaQ?k4#WjKd!_?za1X;VvL<(h2t{Lg2(;e3J^ovA5!Z0Z?>hk1bXZ#KS
z`ww~4+OMggG!*#Mto<Rmxw&nFQ6fNVQ!R{cw5lQQ-c&1<=pLV#7ub4h0oBF-mT(@j
z*n!^*w6$P2CI-~o%ahe!)s#feYFv}DIQF~7T-iDfwT6loU*N%6#{1=epOX$3-5@kk
z#O?9~BAt==j3Y4R8?vfP2O$q?hvJXQIvU-k#lRL{VAI>iaye8d^52CbA>a=*{+K?W
zy$SF}niB!83*Z3OSh%Khy5P#(k(a8P5#$k=sDKm{(kJ{Mr~<~ScsZVb>#iCKFnY~?
zNB_U0sJXTBSqr4m=}}6|AJ)CYC4LS7XP}(<?~^%)1}=B`_(b+k`y0f+HoD%2hP?)=
zX0;#!_6VlMQ9YMb!il;Oh0rq+;IzF2juM)*1IRxGj#_#(tMo0&d8|upy@=MV1ALvH
zCRG9AcBl_*%#)a1aqKv!TpPS^;G4Caj_tMs>+N@*d3aAQuoq9YfeS}&R6eQvy7Myg
z_Ex$rg>#l-I?p^{seYg!;w2f_SMT)Y%datdWx><HWeDQ%a#z{sHsQVjfOj`Cf?L@}
z7iC&~bDHia-Drn^7f<_>WnM+H<H<i!M3B)n3S!gfVe|UtbbvBuGa5}}n~UO$f!)rZ
z+$n3UJBq#C-P+n;Emw$yuG6JQbKN3wodg|cTN|K$fpRI_dr6;WYRnut-gf}T4pBty
zraya{42V$Iynu@FX%gRL)XCYoFAA*!2w0zKK05j?kWKRY#ZIblMR;xfQ~d+-d9XBD
zn-4ziaz8Umm!oQ5a#^%#`ZmL|*kZqKIk2mD<ZL(~1~H;isx<6qGhP5rS5#{jcj1y!
z=eVvS$Z#&xL5e#VuLyvehI;j8QOl0wLOhyYEP~bXepXej3@hWNf3JqMI_o%o!Ea(7
zc4Anjc-H=N2)sYEZNBPyyuUntSni5IZ2e9*xAj^l&wqzGXXt6e2Gr6QMvoWTFp2Ju
zPb_p<*Wc5k0u~U8Sn_$e%D75!W-#4SSpneYXC2LYAA#!*sWcWYqHDudPivZ-j#~r=
z^jfT;f{+N+^`mTXP`A|UH9>$R@_tel1QGy=C=vwM&_m0ZLC}*gQwOU>8H|qy$M?o#
zBPKqnciJ~dRr+WH^D@WBNV(yIzsf?SFYzYUojoNC47FOb+7&m?wjCkgHQc&x_}nR~
zS&u`?&Z@qJ6raL}cgq%ZJF&B75r3w%49u0|=azTKHn-Pps#vC~`;L}>R^nwPJGn2y
zdA2V$*OB1+YKe1GH!%b^?g>*H7g|xvg0G&-=I`$uS~niFcdYc^wVkb?q_nf$Vs#fU
zHNi<r+Opcmk0Z(+a_`KxQ|9Kau^RXx9V_swQHzCLZe+4TTbJW&t9r-pfSst<4PQOZ
zM1{^unI{C8IaOV%sAK%{SS)-|O2VFY3`UH(cE0`ula^rBduYW%Fh_V9-S26w3k#oR
zX+<Lt8G_z~q0R1r6~)!zX`9+BE9AEAwZ=~Do0^$d7K<T&)34Yq$s5P_PdiV%H{qr6
zOh&fA&FwPT=O&pw>PqSWC}yJ_DMv!<HoIgsOcT38?&^I)0GDH>8CO|s)#}Zz%9Us@
z%BwF*^<AYmuv;k@z5D#q{`v3Lhi>K2vnZ<JBb-GttImIOWH-a%Xa9rSV<~st{eAL0
z*_|VvMbvFI^*|MJ`$F?(H8_MqgurBh!xSFdM<6L;M->Ia{mkKfD;#q5Mx1U_$n-{>
zc-ODwef9Vvy6`3!vG)j$zgN)#K;EGa!}mzS^zrKj7s98O*$utp5e*df`W&1gkX*K7
zVoqXQT7$bY=GE!d?eyjt4+Cqdle72pce*!xpK-j`Hm{xY*)t;MWK-X)lbsDq%|j|X
zgbHY14ea<_-h5C85!-^?J8V{5H!hl9WT#gBZnQZ6rzpG!zkEkw0rLKBzM>YAO>XI}
zTbUgq9p>S&U<dQQ>bp7s({k>5>rZfuMcifNAEPZm-54k>%aE~$X}%@Sv2f8-Vy^gP
z#dt&5ecL+N55|v`tH&j!#zqiH=jS#YF54gpw~hkvft~Q1tJ+K-kQ?mw;$mO)M)+eJ
zFj+(S;)eIierJ6SaM@-)22;u#78O(42%Md-Yy+ehyFb|H(T#Efdm;Twb*A-4|3L8E
z>R~R&W7THc228c!^mK0)XVY^9ar_f@|9z=ULKYcBBMUo?c7<voix%B>-Od1o(yjY=
zjO_s<|Ao-8yYkZZ7qr-3u7#6T93S4T+)*6w9dR!FMEFtH<AXM~8Ul!1dThu##x%MX
zTN3mp1(HH3=H(z`L3Jh7UWTDH1(JhbX#ooX(S!EYVDdeiV(j4};oF&!!o%s!S&WSl
zW6=HiL=2=ME6dSry?xk{6kL$|#*oi^&-9E^;GSEx`Cw$xVMar%@A6=wv7F<1@*~m5
z04BA5Oz>>izWxr{C07yY{zIljYC9u4g4Afqby{9`1>wfAzMjTUhSC23R(WtuaU6PV
zLR_^!8k}?)JY*VFO;sih?)x+g8bKaa3_0G*#}b;D3=-Y#*~CJDEfw$tLjLa=*B_)m
z_>2M=h&NeBink0F{Ch&-wgZ?<BAC_UhhAjG0BL?7(>h1(qq!vG>fj+#oV~@yKXW$l
zxCIB<ftV|fKd~-=Ncz<H$8LhKQ2K}V@sVIb|9;9JvimsI8JIY|)4jd5pnnr)JVnIZ
z9rLta9#akAy}SoAI}VN%)g;UoK=ud!vg>@dcfaQ*;8ysmfj;IA4BD20Ier)Rc7AFW
zchYtl=~0;7x8Ep`-{of24ejInOz7tOfm-_mE+fx>sphic+J4*HarM^SQi~#WwDAl+
z;<oq~@bTQ1d+@S$cS=+)y?CG&ic^Jn-+63LXuGd?4YS>M3-1+1aqzbI{^A<TzEoG7
zyQmep+1xP#p~3Cnlp_&KSkNL$rux3vezGw>+dl*^B0hmQtJp2ioP2*xq)YyAjB4Q!
z5rPQmvyBbt3wQEK`D{+4N1g1a#P|VjNAq1iUU#>h4wPp?2|k}rhdU>lxQ{=9j@~hp
z#^0Z3M_hiF{>61$(ku$ifjLHkY$?fM^bgCMS3y3~H|pPySoi2C!9Dv|E}ypmn^q3Q
zfjP)3M(9$zeSoQ%r6+#(j^n$>2WA%}(ESwXZIEu!wI|)dI1tP;Cn+5$b@0q#5K;80
zV`$|h_!G3Dfs#{u@DLT3#c}1bsd=9BVU4r@L41Q9v!cNdUHxQG?Q%k?;`y*9>Vd1L
zzo2dEl8J9qe6)8%=Acdt_ST#0QLaFP$t@Mo1@AfWy?B;aS1~;Zv1_zPBUF7}jJdM0
zN#<r0+b{HuuixcjMr$B+{>jUt_@4b6DmbvjvTJ<UuzJb$;ZtIlcqCufBQP_tco(8k
zJOQ(BmS1goMC3#+rfk6Cma=bPmvwfdH}B1cuZptsVcdqn(p^c%lt*gAm+%qQ7NFHf
zTmSCw0+nnsVQ1Yk1JvCYK&ltj`M@qRR5cbe>WFWkSMlLlf3F&MEy}Pv?wp5SO1~gk
zmn;R<J#}OVM_%Y15-TybbWfjQ3_4qHD{iZ}kl-IxWsRSu>5d!S)iaXrZd8}dg*WQT
zAe^zd%hsJRZ3B(wbv%Uvb6O#slGZP&n8JMLqO4P2q{UeeUHi#ur^6{tR;1A_D4dsv
zQ>+^ywmyl+xklqs&*g3)_FTP^f4qFSSwo}}#;1bViA~N<*Gvv9aw#p+F^j>uWkMVc
znisVZO-kI#!?jKI`YWl|wr#kh*JqT1Eu6T&%l6o_)31;a+hdvJl7e}vcn`Suf0@b;
z?8EKC{%qsb(E5p_=%H*(-Iv>?`)Lxd=Lv0;hMPH;fQX$KC!1$P1)aIl+obtzB}^pr
z^DIY*@G8ZO?5gxBW5zZeZ}?wfV=pv!Ua)&Ug^|&wkl(WppLWrsUqxbe`V7~z{Td*J
ziSy;Z-G8`Z<g6!@k{f}k$1K=33T;yE-aV+QSKyk*d^P^{AxUcWZmB?GxQdIq2-wv3
z{mlaA#Pg6SOt&VYv2h}4C6f})zSz85nP8&O*>X#uKKU~wz9XYn>?inOw~rSJ!G2g!
zTUFKT&vz`1sl(Ni)}3Fb4NLhJp%N<6>lw4N-Xi_S<L&R0rlkA#BWgmj>(A@NvmDM(
zQa?A@Sj<A2$w&@gIC6Yxei>JH?wW78mEWCj)&ax&JN&K+7pb*VW9`M7{L#fu-rH@B
z&WC)R6DC{mOiSegNHZ?2c1*~f0bHW$`S)0L$el8IpeC6s>#!iYPDS#e_LnQ;6_0a_
zlTmDu7s!p^@YgTjw?ZD%KpmHFH<)m(kM;Wy_1VNbL4p{$X|H2X82MS_`<0S(m)NG6
z(;???3~ouZ-nDck@Vd9kp(};hxAlpX=e)KOpOLMtN&279BA>tLsp#D<V=}+=*<>{e
z!)&s@zY&-^7?@a^{ADio0Rb_!)`;ROPNeKin?H{vT!6O1Gc)!2KIHE`ocfFdy$g=j
z<8cqGBi5f>p>@BtRtQXf{4evKbV3H}EVRc<u2va*<z?#i(m}X#QHyU|Gz?9W7~Qi@
zGCwU$v{kz=ICehW>pgP}n#EPsx-rG+NF{!T6lVO*2lL@`=2&5kG)Mb!mFfY?y`}vh
zcjsZs=9f$$;_q%UHU!J!(;3RyqcBg{Pf)q%M&eL)da|el=kCz<RQqy&cO~r(IW%`E
zWUg9uMM)y0{g~V!9&W#qjNmY87@YFB;jnH4F^PS3=Xy6#Tr=e|mVCzWGQHDeU0?ri
z{+*Y8YfMfI4nQllomtTqrgxS)1SuoX1JSD*TIB{;0W-VClf(#m$np|H;J)a*``54T
zEOvZ*tjBsj7nWy7?guMzD>z58dslK0i2GZPl(u8*R-dH-68#iQy0wkNODl;RcTWc+
zi+<bI7}7bRd4HjY<qt_NKL+lt&dw=pj_>zeXf|uJuJmpMJ?l|Imh$}e_g4BL!Z+F%
zR!N@woq)4-B;Z6R2$wO)kSOSV=_}lue@+ZpC02S}=q<`=#QU<A(+IGqISbV&ntkmp
zKOc1>*@*i+j3|imVU;p^>bf*$J+#*_MDN8HE#K?Z=JDKDUPXorJKLMH&o<A7Puu@t
zM%*9-y|XxA%0km&#J2889~e1_t&oIi2e<scX&~U}Yw#Nr98vFI?w=_RzjQ?$PWM5o
zFy>P1MYDjc=}qVCzh%efR}5Fjs?7pJ#~{i@uWh@>jZWAN%tqJ|wlT4H(;;Tq|8afZ
zJ8s0Mekp>_D7N;_TNiTdqb8)=si4tWh6uUbv?)o$qYX?U(LG5t;8fLAF#X2BVG&%u
zEyphVzz+1X6k6!#LXw%!a4?B;at>gq?&qb5_ggr+8d<6TRDF)Rc1`2vh`+-vbgR4c
zHEoHwq<_L)&dnZjh3O|~G0z<Cxere-1#WuF5R2}MKYwgnw^E#-2?hT0>Y4-c^f)Lq
zFA|G6yT%bCm8fJFQQ2VD`>f<+oPJ2v=EETD%4{WTW!9@pS|b@)Vh>WAh}PC$TXUss
z93S^wLCGwS-R(YQ{SH~5V)BO1ZUZ1ULc4g>z{_KQp2Rh?XS*1F#BP6eQ(Ly59kc%!
z)8UHKv{82Knf%9*&QD4V-8$Ck>jp3C5ZP%srmB{C29#^^71?|z*M^@IHB$2H6xGkM
z1z4_992x4O`rP2}8d#lUktdaycX8!$wrulZw!h=zB&@Ba>X85TH#N~&C*YpH>5wAZ
zx-1@lpn%km?R9t_*8{Per}yd?2g1t$vDd23x;TX0Ru(z!E_|Msn~rjiIV@y;xK`+E
zi`Yz5uH+P&yI&B=q6k|le6M*UkzHFGxlo{X*f7=Tz}c9(^VniUDk<kJU1|tUg}R{!
zIR8T-){lMYhh395sxaohQz}oka|L{Mh`dW3D7vZxS3MLHLs}@kb7@qhRzLVlGF?ge
z{`M|+;M5uU(Z55S<jES9mQ~#@G4c77xoSz8RR(vgI_f5D8}6;5gAdAM+?_Nr4vhbU
z#nllwcQ0$iG1y<@uJhVQ;YFTv1^La{X3Mb3#po$8XId^?^qy}$l6%tUhVzmBena_T
z1H)3~r<&gHY}=iSyUpVah<8C2VTbv7#wOHFZg+5s0EB+!>GP>W*~BnyC8#K_@S9-k
z<t|-+frnRv%Kg7$^IYn|qq2_WjL6jYY=dKbL|>y)*@_fnKL*ems}M<a#1^Vdi7^%l
z)m`^g|D*GrVYZ<PKZfIdlX{_9a0(8FP8H#Z)*~Nb;653R9v9hDQOCU^MpOKbg4<hb
z()Z1gNF=f_!+z#j!V8mk5cgug<c<T=#uTq%=3+XqR3wTH_vf~}gUXqvLh8Ylvfme%
zH>RV3tIgG`uj@f)WZ+Q}5!|nPHEah&x7UUHje8B2F~gaq`=MF+m+k^sx?%dWGw2~z
z`x7)iqY7M_q~if3h`Y1#VgN`L*!!a}KomX0YSWrH<;RWh$dt*n)7M@;V>N{T4qgnl
zMC#6ZI3494ulNLxOjUnJQZAt*@o+z*d5beOws*J1qAyT9(Xa5VDK^uwOevyJlen%|
zOY`k~#}Em(i#4@XB$pWp?pzk+cGqKq1B{Adr6a6=Vl|3h6I7w|sqA#pZ*My|cnXbe
zIL)%#R$r}$sJ@>B9Lc5DGm$TC#cCH(Yo?8RZYd5Vrt81&PmwLc*KgJWDGGy|J##s^
z+5ejQasBW0=<-N{h=Y2fiBXvxA)&KT?p;7*--!7_Z-flYkSLe1yljA7OxHQP-To&z
z)roD83^+(X3AgE&R}m5Z_UuchTWEK<U}x{kdGq2aB>{F)@F<;$>a2pm!+|A#5Eyfa
z1U!pgzEGc{^jcnC{zC5TPD=Yrpw-pkVzN{p(8|=~%$q^pmSNo`-Sqx_z`b|5P+cij
zjWBTEOuXnZtsm?TK%1gZ*8hC0c64y|GfO4u9Md{M0JFB#DE~OGvmePF)^_1}M1nV}
zO=6`B{X6dSaK>2Bg^USyH~!fuO4|8wQEe-zEL4(V+jW0ws5)b_Us{}1#%>l8WG*po
z{aR3st<yY`tJjw)J#Cp7Km!W>3QWKn<?64%tgss^+fuAqaF<muR>jjU|KsmVjs2EC
zfryBRte57yf!ArDB``cMG_`aroR6&fT{EarCr`_BQ~RMim-2pr<;1!+%nfJZ1Q?_D
zFa%koF`(RHiMGN#_A6O8y9`y5mI7b~KV4=P$1(-1RGUh1^s1fyFjD=XhEf2@-HNZZ
z44gGGkMPk0U*_L8J&o%RdEpG>;x!_hux+ECl`4C)7&uKxmcDA~bpt%qg7F{SrQDP}
z?SajF%pu?V{!s=4)uy4BUzO>HS7IYmMc4+@LS7EEmn3r)5n|=xVtkz_?xH46q*J=6
zdl2_MV6?+$c$o+t`KbD}=f~lgz_C8*MjX*0tDrqo#{ua4k2qtXklnvuEUV!)TsTW1
z>|0?ia++P%r&)#XBd)sB4muG>0@TayH_V31oGa3+30rQje6C)5I%lq#7@b1-2amP<
z_u(G&UZb8}mw0EoECDIm?brlT&PH;2)eagN?hCh#S{0peezwLKnH5d>Iq18(B=*LO
z6p*O)<V^MNaBY{u?OesTJa27TrY6sNYxNr}S;|G%rn%>dj=~0~)eQ?h6Bkl?HV>;3
zl)I<pg(7f3cPALz6o9R}#sCd^W~(IKoSmTI0L(hH7|=NoCV{P?)VUg`lDq@n>64dX
z%3d_yTin^QPuqm?JEkm>M>NoNcjCEZXoTXxI)pj%)b^0I9U?DQJ50sdJ1ImUyv3U2
z3^5Qaf^+uil+EGGG1|zO-iK?ouLUBK;61hDKzh9MPjELUTYdU1JyYZU^+dt$^0!DX
ztHPguwBnh5Ht#)p_*C+ky{MtGlGBd;*x!J<s$xPC@D5cEt8MMv2a3*vYW9XR>^r(V
z)?^K`6<Gx}oot{g$x)1m{|UXZoLF2>U+Hg!n6GUNMBi1dO=_5P6W#$lv$}Uj7~ilJ
zbfxaK!5j`gaEvTn$5(CvS<)H~Q!BADD#Vvar>R5aLWX0&3dsyn2@yq(XP@jHagK(Z
zGv+>6T{5pjX4A`9sm2djv)#Q}4GJyK6A0~VEp=JC-e{%bQl8>6G%@0h#5xA5E<@`!
zZTFr5LlI54!Ud_0)=L5VOyqxmy4tcYO+gao+VxwF6q@0Gt2@dJBqx4&#!7Ee6R())
z(PJUx0^r5w@-~WBlOaKWn_7|(rN3FM?=(n;<xPpta7UusS(gj^tXhK|m*U|YhJkAO
z-)Ix!ix7_9r3y2yOvl5-_M4k*u1H*htLmtyt(zpfWvEuHhlvd;$J19-{uM_d8b;A@
zf|1Vy2|hW$OAl4da$+PzNVmN=Fo6gv7-A~>!O3R#8VtGwH`)b%xqJdW*k`pd-W5cj
z9C>}l__n8s;v6tU-sq3lK1FO?)G9;Z@fWbbK6rw+gmMMTJY$yUQEPE$^auE-IjXfd
z4h)Yrv{m%8XxH}q;?43vMN$30;;3C-dlm}#p#5Ya4E+j-4qs89`$VP9Qo%Md&ltJJ
zm~FQjL_BMZKJJ`s=wW#;FKj|4i?%%oGGVYxd?%-$K<(q0wJ!r27$V<P^h#h(ukgYv
z#u#ZV@N+u`7}u@tUef&&^kOxYCFx=D;vB>w2l716Sb@}|UDzYSr)!d^C1i<|iKE9J
zcGbQuba8Cpx}4Z~UdTB!{&|Jd@3!DNI`X^JG}_+s!bo8pS3j1xR)PUbh8V1+5#N;f
z2iNOB6dg6Pp#N6qbLx=YpZMw|Ib44y35@W@9XW`pOh1b2*NL!p|H7#aIKw9dbXB!9
z;Vh7~KT>}!a%uOKiYQn!Z)ZA}h-zZoXp9qELLJAmgf8yw9Dl*|8CB&h!M-Co8dr>C
zy&*VroB7P+a>_@aRA>9%Y%ef<D8F-hb;D>Fv?;tK?o+Q!@+$4@{ef0<AWGPZztzWQ
z$s!u~46-46au-z&1=uNh<2i<6g~RXj-b*l1DTZnX4vi3TiC@Ss??B4*s!VSypz@Pc
zr=liahE*FF-L(DlMICa1Tb+Tq6`}FoRRQ|3p*9+pTPb_-@R)HTMD43R!?keMDs6Wj
zx)VG@`&cx#t%QO0rFF;Lx_FebEWE6s<)5x|Vwjfd9iOG)UBivgAOVy~3DPZ7xr_$K
zM*A6z&HfHvqU_g=x!Rhwha+p5Ergn@B8L)|`yo(BmL+`Dn}$VxEz)$zvAd&Hy5U_i
zijOsB<`=%|8VA*rgZlAVqA1FTlaT%0tz*d5Pb*`5t{4RMY{!vvHLI??q079fGYPcc
zVl}))F3o4l98x44{7l9x&|KFO+uk=&Vp61yk7Gpc()4$j8xW%9m80}2FRLnsiQ|a5
zsujou;h$t3QS8fik_+9??U9rbNFRPq{o`F|{!&Pkr#|Fn)0wp2skRz{D|I@d+-LWO
zR%x<Nssooek6{&;^QNyY!KlX(v=?22o}cj1eo*7ZMYr&7zBQg*Yw%&_v6s0)@EgWA
z?LZgCXh`4!hS?K`J;QF_-yUlYKaGp=D&Q~@`STE#eI53iEvhw|cjb1rx#+6%s)P0Z
z$L;iW^ynjHj_@1wsoizfMG|muAm>4$<rmBumlBU-o&9&Odzptu1?WXDGrmT0u^ama
zQT6_NiC3`k_`?zZodfj?x`N9WqG*00h@rV6<l&}HI#MQlv=`Esj-eq)C2VsE4=L4?
zJ=_~YMbyMZ>wJNHI?o)cgD8Z>>5DE{x<p0PX&*PLvvHIP<N2ku#bU#gv<om#E46N0
zm56@O5SyX?rpz;J_@+)lht7l@X26FZdLyaw<Db^^T0cSQ3Bp=y6<A^Gb<T$ddR>#|
zAWy0iT8|_uTkZHVCHJZYC~0M{B*EtkRSB^u6#-GV!qIg{x`>JPw>#^ykgg`XSI!kK
zWgpJ>(Hzi=of0fq<lzN(FSE*(=GZZ85*!Q7|Md|YDJX;PohDov^GN(DOlb2`p}qL%
zuINFb9?y+&SQYpFty4a_v0KAOVA{&qYvkm)(ffE<NX9t0r1{#q_+J;PP6_=IVO_W7
zU2^8x-Y)z=MM73BdM@D`l~>5-jj~Pm{c^3b+S|rsw=j7U*h!M#mpI_uIt+{XvryS3
z4UX`;&il%+lrJ-=SF4Uv&~GrizNThEyY;Id<1c@h8K6=1knVTge|MkC)!&eNn{qBe
z-$pY`Ay-b!x_x|asnhV$thY9(VwWH~%6#YxcvOK(UXE=bEil_67p;|^-rnMyD`(B$
zr*5Xzgt!_5o&d>R<J$w;3aTxK>d6FIoi?cvzOc?#&OhkxG46Ciiejee?<0&6i7=`X
zEanieaF5-Uy1>Fn=O|=aIPpl$MzNZjx@VZ>ga__zm}r9JP}`^G&ZHU5=%N{u)CiK<
z@y{ey{Uqj#muUm9*&}m}ma7SeDNd`IeG)|3t}JrrB_8a>N)*;$=-aWd{89zSE2LW$
zTGm73f3(=+H1_qB?6IB~F9IgjlR~SeMG4M_h-uzkCEKMZ-)BGUX3wr^#6KJ4L)K&?
z&o9x2&kWZ`h>!*eAd6Id#6wMu=4eLpxeoEsjtF~W6~U$hUijKa7K8KRerB%ovhm!i
z>(XkM@}U>_dwy}2$2WeUCezf%PlyfT%&Q2rU<*Bihnd*CUcyAWZa*6<U&NuIvmDIz
zDve?K;?SjU9n@YSZ~9l>A`yWCJ#LC{d=*ZFB!0jNBuAusec*LD_&dy<^iwtL<jq;+
z$q~6`#;5)i9`)l8rHg>-qDi0WCJq0?s;{HSUqojUv|)I8TxMIbeOe9Q6L1uN)nOTn
zsX_8{Xyqkuv=h3f3wvlp>U1T)#3mL<=&-4Oe5JD%8<@n)OZO_xi~=nvZ4GNlucxA@
ziFU~tsaVj$qh(SKaPZee%|;iwxd*2vE)k-KW!8!P9#J-393nztNdyJB9+qQ~j>^BI
zt)3YFE}`kS6#qf`>s!SRS*r1g2FF*kH&MH)I=IrM-V#h|7#4C`Y<iPZySL9~h3KWq
zgobpvbghP~OCf~SlTxY7G2!)!o{8kBYm&ZG(_W2>KR()(R+hX;A0(d3WiNl&+}AW!
zZX?WsuYF3=Dm`!(GVS{qIJ6&oC)rioz<wktRC=(XocO-*cjB=6ILY?(7L!lUp!2}z
zrceX6pVydBad)cVefQ^U!w4kySWOnh=bHh<1#n;gIu(MpP<xxWvn4vt`+S*uT(Eu*
z5(<WsN1&IN-lLmqtI-H=5oN<`hxvM_vEi&nHPGDMgEx%r(MTqgor<U4X_ysh!_n8w
zezAyH2vkDi3wwLtw0G5S6y2j<CxjO@JMwtEvT*BVe$<KdJvG%?IVAN`j6%j0;|QnB
zXjtwB^@w>6U1VX1ag%WB_5MSGnv!ffk4@P+op;wGqRVKG@aSbtaH2fYOvn<xg)s*;
zWoKaW;`2ao6%w18sR6n7T-n16#YV4|ux-A4c!pPQjrIzD!8+F(jS|ld+E|}y&p+6;
zG-N}1PjQ@c+|^6jPv65%36j99w{~<zJxBsZEo2?$(djv=x-D24YmOp)!AQ?N=cGk0
znDO>V{q0}+rz*G1+`;vNJJHC7G*B{5VJ+jX?%N4HtjONkQ72~T!na6pTQjkZ;kGEA
zHy_1=Ala)^N?z(=?0Av&?Gmjnc+aiDB|e4jl>S!M25@8o4dZ84!F0o1+;1e2IJU%1
ziAO+3<$@-pawQ2y%b#@<KnCf>j=9~*Wl*-6n8|1MFWs}c-XMdKk03TOnzglAbOgi2
z->}I0&h`I|^lrKz%o&33Ze^%)zjK}0U~vJ>*2GH<$hRwZz3~ylD|Iq;Vt02*IaA{7
zW9^V(+w&P+mJo=k++AVKn|Qr&ZOsWvQ#Q(;iK<!&2DToyRSRiF8)?c=IcNMcvhiKF
zQa13yx?_PASm0XuaThc*b^4UAMF=XwgT8~x-_S)3oa%(T>B8^Jf-*L=68ma>TX1`?
z(-F)WUQzv?_`x+3)vP-Z`~#{s<yc#tW$vr1mjxKGf>8e!l<RKFyY9qoy$iLyZ4887
z*M%PI?zpN4yl#zmb={dod^qd;hYx&6$Sz97gU2NMyvnts99!CLL8pQ-k#%spa`;_R
z<M4B*%8Dpa%g<SI7cAX8SCxwdIIDDHTL=f8oVJ+F&vL*ixU4$|LWcx){V_STnXB(e
z!;Uq>_6j?pqsa0zZVp!O%>qjMH3iDECw-dSTaD%kzemmEKJlOBL{!SrnCxjQiWDxh
z<rE%K%^oZu%5Cq@2ktP_q=>F~^tF&XRGe^$K0{#<#Z*fU0mZmkX&jw79-Ts4x^d8>
z7r(=XOqz5JztH{p6rzoK(2|84s<PJok}w&|3P}s4pj<*NTcS-nuySY_TH&~rYCfBu
z>Iqc8VYy^Rhm{Z)0ww3kI;O=Hv_vjiC<o?NMiHl&LGCOG*aHyuB{HhvvG+HLPo*)I
zj>-(sMby^iOitg3QVC9Fef&M&V7@RCjk38hkYXNPI!P}-5ETgV4f?sI7%BO#FONW8
zg^j`f#XA<gXZon^R~^R&I@(r3J2Q;b|JH1i+CPT1)?=A`FnwR`-@s)?GjCv1_&CT`
zz?_+CVfI2#lnnJnj27tTPNkE;edF6`N~&2h3czR<&L-tKXQs}#Wm`;i1!y*zkpJ3i
z6JFKD+F)Kpum-r-rxjKiJ;0NRiAA^_{n)?$mYDd++pDn-$dL~<JPi;pv-`0^*}uMW
zdO6TU_dj^!fcyG%gpc$2+qE}q3`zM4=Glzn+W5Ic0;a!UXU~8Tl4x9;NG@{4Y{||`
zkKmelbO8J85JcN3{fCUqzW&Smmuj9>$}TXU?VN`z5Hoe<xTTsR8Jk%ggVUcfRETey
zT$b$}q-H^hi01<L`&ak@<e^IDfA6Mizg~-IR9*q1mpOj(YyUFAu%d1nZO5o@@V*;1
zA^i><SoQ+4pmWbgsKl;GDd)-n?hi%Ld6C&u>lhDIC?dsErNm==ZYN*fcNkx|5|NP+
zpf)6&0<CXdquw>{rHDTBV85W)VA=hg*iOfB14Mbqdzvg!;>QIGp4*#N_%Q37m+hV%
zpmlaObl`OvVQ-$cv5dVGzyjWh$~+FtBDkAo^N5lS?zhB6_;W%|BX$*SJ=8ol;-tSl
z)>7X6Lz`j*-3;~bw`@JtkmD_&$D8rF%@xeG)y{oI0+XA!$TK+Zxlsyx+!f{@Lq5d2
z@GR()&&sEGU$2G?e1--12C*frYKKZ&%{O-D&%U0NSZJpz;NnKhblat`FUB`LY@3LD
zg;|FR(6c6h3SdEddc^KWe)&w!qfbPLwg<9k`oQYVmB|P+X^S(^@K^w&!}kd_x!tEZ
zSL8&RT}C6`>ct5Yx#A&vFiVsC>});Tj>f8h#$Oi=r=RC(HUA%5?Y8Y#$?v0FN!xWi
zsUJL_M(Cbw1;39MM3~!Vh-Kedd^;^IuWI|Yxx{LC8s6Ede%!Jity^<A!x4Ix;W)NS
zin9$u%#Rmc&=8x1oZ^+==2l&2Ld{c}diz7l-Yif62IW+dx+xtyc@eXXopaBL))I0h
z=8a*he5Y>(Sazmx!NrH(CXu^}bJ^BY$=p9V-hq38wK8cA3)<U{eY`S`v_yH4^url5
zfHrzNpx}-dQ700Hcv<e5aG5@t<HxNh7~Qu7#Jsn@e>UxGgBrLLZx`xw`T&iioa#uN
zwcty^IU-QnRll)oFU3MElf(H{y<V1gIo3S10W+RTOs^BcknEy{U43R{IlcII6eBd%
zl!-p0<hxPMX%T~k{LvRvUsDU=LyLx``d~x(8>Z!EBVPDW>*qzb#=}WR)o-9e54H42
z_pqzbO<2Ng(Pia(ubo^|9NDt$&$ph5TGq{q&Qf}Rfq_AGIQmft@1lCNd+W!U;w+!U
z(qTyifAu<N`-#|XKIk^TzoBW>4~;@5*}z5TcGO(Be(w#<;bAk(P)|G@utWH{;>31j
z<hB}AUPb@l7TMLxp!{OnN#B@P6W=8LHb`6eKGa6WTXJQaMUks|SUC%)2Z%?>7RasO
zEfREmQ*O$WIR(k8`rCy3ymEo}urkV5YcJ+;(FbA63UR$j#I6321TSh=%Z_XB1it5o
z#xU)EnkGLIDFhexTdg;B1jX%el&*!&e33^j6_O6{S!Y@4+pT+9imGWe60ljwp0{((
zE%Uv!lYC*ofl_}Y5@wy0QK+08R15&m!c=zebBuAxBpISdbg|<kww*FguyR_6PL-!p
zNGmMc7z6Zs4wip5Q^eMfUts;H@t^t?aovhj^(=uRx)u-3e&6j)WE?|P_sd|<bN?0@
z;#2#m$uXEhy(IEvgN0((cIWU<)YObQf^YvwEb|3Jldb-0=^w~TjH&9je41jRkF>WP
zvj?oIN;yK6eYU3t=zaVA*b&fT=G{{g`-Gxg#|(r@bIu*JVAsO9>f$pfP9h5VKq=>N
zfWw@9Vde)zhaq~_0rlfHV&`rtlHm~VHBJn_2CkmiPh;^$7;b5oN_>A@WEfY~u}?b#
z6GI2QXE?6)oF%frWV}ipEHQX9T-ym~LfmrIld&MH+7(^~(SSPD`;xb1(M}oQm(}kX
zgsT#rt>byegCEt$Snr|5cl++4n}rSx*#}lEymRr*pBD?U<cV4es_6*!TVrfe5KPu=
zb34!dE{osqIT_H&gwlFHl?S(f2ZS{-ozOiMC@H6JNsafPs_@&B5K#ND4bs}IH0XBX
z9N<#mMBV{=Haa9sy-A4_dCm@}O<m*_KuTFe#O#b!Zo+1XH^uZ~GD0BmsTy~7V{_({
z&IpAz<S)@^+QikVbYUjEwg1fHApZw7vFjG;kLT)~&;8uKSKN21j*Yj2XyY+(DFc8q
z9hdsh)8V77GV8&E5a@~Yb3SXYvt?|ky&HZ4(BxCwA@1J5Ao*s#Yv@W`MsFXAiLmo!
zIZ%^2w^`&*4*+@JM#XxT8XdKzY`B^lut1-)beO(Txf{G`5H@YQ!q6ghDtEF;vdUNG
zQJ@HrIir%8i4|E&W2UJm6m|iFj^AUH^ZGnq`E+3yqZ}=?=ZhRG4F7mw?kx9pk!tOC
zDS;>*JKT5qD;}d6j0?|2TLp)5nf3nbn`C|iQ@xPK97=Hpo>_Rn1BV^xUU*Q&Vblir
zMX-f@Z5*<XK3r<8r$Cnds_IsB$c-C5WwYK{q~a*_!r%+;01T^%{s$65A#4`5l-z>x
z6A1B2v<xBpYA>vdgI`6gkgK6v(-i-!#Lul^L+ybVa(%K&Xe^SaLJ&#91phRUs;fxh
z@F7zu#EL0~DQC}cBh_=8hCt0S|H6{PP&Sa(=(Mx!#j^AZ{k0Z=O@#|zwj@`4DJ6y%
zJNyx8b~51Hf4}zUrts*)dCCe?`%sVUVQifV)tK-m)P6XOowz+L;4Cn|bKd+*bqtoA
zz^T2^fW>&j>xG~NzavRR%*A6Nr*~-+Hew18C!N!R;Ixe*VJ)Z=YYFd1N5q{KbW{dH
z`2;^L#b4%It=G#g(0Sog8q20b=e6gSxOKBi52aaEFk%ugHp}2FjT%A`cV&W3l#`sI
z65ATHdjNelt$=^c_S~|O?vY*G?ZfvD4e>0g#P2Fn-A}ot8OFQ9PUskx@y0;l2w#6;
z?-ah>$!|OfED8E6alg@H2|5BgMGJ5Jmfk@3@mhsX{BWkf<KU77EfF)Z^)MUfl_Pu2
z4eKWGKC3;rKlbsl(HP=d6Zx{v-$VOSjR-xtF2x&$SZN;qh;$fHm-|+wE7Y)od@ll=
zz&_xKk%YG=Db{?;E+qYUm;HEl4iGA!6zA>~$a7}0^g=AcIvw70$JT_-K5@9ICylFa
zC|yiwl<##(on^p^<22~-XL9z&b;Y0NKh=AwQT}-gOI^2Gk7ZT1lVeie@rDa%v7e&V
zfOO(t?)EpE$#XWo;Ek}F34g*8u#TQu5f!W-Dl3pDH1a&%rMou9=Wd<V#14C4nt~b3
z6R4AgwpMT#7LU?p2q2kT;@ggV-?Q5kIdWB_+@@R{-P*TsuRR0#R!4=4f=5c3!5KtB
zWn;apbH`e=zsvPsaE#6%kDBNOBqw)8o3}5(b`HgCnU9{d9*aSt^_i9EEXmYsR7rXy
zhO1VFZfvU|H~pT`niEPNwm&3+L+?xID&AAEy~1t*iM`Qu)1MnZHd6Qrf6ER!^V3WB
z%U~lR)QZ2>_4lIff3;?-D)!7-dIjym86AJGMUzH;s^jZ~f&sH_L9){n2dbzk8(uAC
z>yEgGT*PUEUlS`A?m78l8@%|Eiq1>wggKl<b`hFPvj~hr?4j7!@JhUk{b&dB=`HYk
zXV2pNV7;e9%O>msrf{Gm8RFM^PNtXTGs)ELqHPhvRoQ@f^mgjSeb%cm#%T?5pO)HJ
z(sX0}>#hHw-e0@ftQ0C_x&Q^pbPq)yp;!uZk}0hT$v9FmkEDkPp_&nu2SzT}4de(M
zV1m93{17Np!GO1eI|JXn35+A8H_7_P5B&f~Z~|dP`Zt3#YiCq(nZj-7xuvi4tA)R7
zt1IE_rRP+9b-(>>3pqnpb;NZeepP2@FjY@)XYgl)k<*{eJ%21X=>6~_a$Y5}R-=*5
zXgH54LGM&iS{8<|%EV)%yL73Kgt~?g(L@OMAGBhn?n1fJrHj+ihV7k+{N3H+Y{Oco
z;1;`du6Tu+E)ETw<m&31oUgU~o%Q@(pGfPK{))|pdSVU`{ov|9&;7cZ@{{vVf;Flc
z`dj<(8(l5VB#j7*G#-QJtEkkN#*uyoi~GI}wC|zJjW(0I{6u}lqF%FHb`tI19FNgo
z=<A?i%V!-Gc_cKZAd@PRClW4GsqjGiezn4Aq*T6z1SBQKZdx9tYx;XB&>DmFXetB2
zf5LalL|F$MVUbuScmt4gX`convQWk(M+`W@6ctzAd4;6BxCMMYqJ%(FR`GYt&Ex=b
zYat2IWOg$`bTRl}uN<@TM5AQ8^us}^_vCj(*n{?>J!b_?Ezx}x>^h3@6lWjAhP^&*
zr^DHVbV?{M2{mW}W*UqPYn6~&iJ1Iq7(|=s798H@EouQlmxQqVf~#^sY>u%iH-`_z
zuB~y-9x4)@#W8t>8TV<6IOVf95e~|Ir^dyT{j@n*4a?ETHO)sCVrs}0McybfFMqX>
z45wapP~*aazFrIr)T$^5TF`5lPC8z0`VvN7Jzm*gTLW#wpTqB1Q7uT`R;mYX*qBtG
z_tYFH8`GR?XCISCU!(6%TM>YxQpK)yjo$CCY&tuSdYFjLhAOT8{Zb^~pVInbLQGh-
z@fqF=GR5^d-|%jMp5mf6;5ZhTdm0(j)eHFPJch7><Pj&q2WK6~w!;X|mlL95Zb!~Q
zl0d-4?%M+2;JA5ok+r-NEhuf44O8Z(eguUo3`DlGn^B}TT)q6-*q9|zm7wbEJyj-@
z)$hYqA!9=hzRXgrhP@J7e)}DYKZ}3l<njmKO^O0~UGb4kKjfO0FUnayg`ylNEjaF5
zwvB|1ltCJ#apUc8hZk6gL0N8j?yGEnoIGy07=TBcL##aZ%~%0@UtdJaarON|^$d{&
zmOg!t$xvvD-*qrk@RtygZm!|WCz6~QqAxK#68-_oBjLVBI$h78^(t_to(2@@ZYXLa
z(SvW}@5TJcqP7-~qtH0RfTUyd&NlxW?Kknj2u=IUnjBpPaOoJ``G`?XmX?mjfX8-c
zA&&ydLJG1C1WbuPf{v8gbU*iaYg8RGL_^3G?>!uG+n3C6#YnN>%Y+fyfYT!(n!w|W
zQov@0XSsPsaP`80KBuOk@>Az&RQXZ9WJ=8zJ!B2~Bl&v6L^J|K{bg%6k!iG%ej*KG
zXcOSD5rDTzFj5T=2F)CgEbz|)4t1Zh*L`?rl7=#@!p5er%KM7kI@OizSIhJjrnz<M
z*ofSPH*C{fs&Sa=nl|1X$-rZfRne_In&61OyMFHr>Wz<W6rskvhHaX5S-jKVndKLd
zAx@U&q0>ttaHK}71+2M0vnHgkd5lIer@y!I-12J*`<jQl1YiafxhCl2{z0X`9)UHo
z!N39u`w@413>m`)_n*8&mugEoHo4!7zQ5)lBR1nUBin7`VDd&;qyKcR{vNFB@cBK%
z48(`1EE^58c<j(cr9Xx1kHL&%nc*FN)`v{}sbJ9n6-7THI4Nn2Z2J$C{0jB22IZnH
zN7Sbh5g0?a$~2aO*#qpbv>ZFQW9d1bbO!&hFBYDP@Qzalyc!`zncoH)d>)S2$-<|g
zBa`%_jnNtad*qKVEKN#ZMbl`q*`hWmLLApS=r#NK2d6szTr4k0Ft(V6ns$GLCz2e;
zCx=CsA0;I3m~$yt_ml{0tkf>4N7q(vSdPY&+d$h`W{lda0|kh7<8W!Z(eR#AYeGoy
zm})+(@fz1oj}VK5&lc2rC+_9#>cq=r>23Gf)h;*w?pko8vkfRbPhOjKzTr0V2zE$n
zW36HJTH!qZ*6WT)i1~X5QK;@ms|i$-s9dW1tXcOo9ptU_poKIc-}8mwndwIvJ(Z<X
z{<q10nP9!DzkXMOorUK5olcsI+8kf)Zt}0u>1PqaWjr?*Ts!s+Bw0-oONC8Jgw-ML
zAeyv=q&+c{%B<64MCY+Q4Crxb!l@r?T$i1-3|0!%Hsv}8<B`R(8t-%n(A(gYo=^H2
z?lE5QroOc}E`svH(cLJeOIhx)CgJh=LHzu-|5K-G$jD+8RQWPdIV?9JLc;BW3ttA@
z$ye>RfzYt=htp+|WFeq-rzE@L`o)xL{9rxJpX@@fxrFzS><NfDT5Lk0ouW1hk2rq@
zy6)z`vs|@<BJG(+Yq(j>NLMTqEOF+L<*Pkr%9|L#MWJP|9<*VT)#*fyF0(0jZU=y$
z5td=^oHpDMGC6q9+`LifPpN$u<$u8Df8CbCu0khD1aqE>L~c_$$uyrOh9($Sh63Jc
z31j^G6<-<9kkKnL8__4)9UgABi=&YD1--apo+FFuqzuauIEcEC&?z-voEi9g{eZcP
z^i(Y=Q1yRyX=SqFNg}eD^sh+eFSGw^a^YBF_pNkNVkztQ;A#4Ai34eX*-gUNC|YMS
z+02UOn=|xLs5tZ@-{NS8RZ7Zq7v~X6r@lFPad*8QGu}ZWU_~|fKB_bOr@!&P^%X!W
z<SusMJAwh#&Ux&ut|;zT#-1K(_o8}thJxv(0V>oWCH`qr$wk{oRA&}c7C*0de=vv*
z({xr?{J~|$20V3B=1mARy%gq6xyeH+O|-b>iRu(1d&FD_M&pC5Ijz|RNE@tU0Dz+=
z>x##z&$neXX-#h>6%8|Es8i>ig`{dfvAB$1fEpooHasXLDhS@JQNcwXQ)$Zh!t5mp
zce&HtxMkgs<*Z0jYND@-UrX(*9bLOQpWcP_?C7Nw^%}L<Uz_gh+|g9AsE;JhmXWDg
zxL@(imN}y-S1dVPxzXM^wy5zQ=|q|p0R4Mbr!G|Im&HT?LIddhT4A!GTz(Ic?0TPO
zZNCCfT@sLUY0icl9S0tWrU#p4R&h8uu1<^1b!2eSt|ojP4O>dp<lJba2jpF$#>S;U
zs0RI8ekY3(D<FKb$!Wi`d6rch=C&T?EO?#tbGImc52e-RP<K(<dX2scXzn*-kNfNN
zZb;Yc5SfbUZ$t?K^J=a+ygE*iPJm<}-%!C!eZw+hWA`gkgTQe+_gg`?8l@MOmi{#f
zXS$Q}3sS1b;UO*!=Hponno@jrZwp%lqP+HT9;m!eeI8*`Ej2rTvVnF8pA8*M2qO5_
z$ejA9Ai0CB<DekQ$N~JuJ=07|RoSP0@66~%9F(A7dlxr6ikZmdnS*a+D^ngd<x+F0
zqy;o56@e4Q$3_VecR6VLwwMZN@B*nisZU;c9s<rAnwNb{T6I!O;yL7Wih9jezvn=^
zT|goBjrw&JAf0qN?IXs)ms|kGK1FsZcx>VXGXaOl@)%$kx64)+m3_OY0Z*A6w}Lsp
z$gQgLc28G<0wtf|!Wt=Qa?0mI>q#dUkgp8NRPeduc<+d+Sr;+Sg-UKg`!k-)3c%C~
zW8FQqK}X*L`bp|vLO)3GvoX?Y3p;Rts!lREMcsG|Mu^teT($9(?KiHz%UKClzdJn^
zJ@Ui-OVCxduff4}lyX&sXjFWy*X7jTaPe9gL;MYn(7DRJD@9gIjU7j#<nGGdazg)S
z@=*7g&Z+^2l$d92(MDq*6AemN<gX&H!tJ>>?~i^SEB&XdTBQVZRkyqkvM7j-XxXKx
zacQ=EeI~86gf5<&cfbPkSe<`imc_eU5TEqfJu{R12N&%x{|Y|8vZ-BlP@(EV6VSXz
zscMH0FYpsgpm$^1QU98@4g6F=@BD_^0x)!QzGh&Rhz5Fn;b~*hB?GX!l1-8;5@cl7
zNpXEHMQCqP1HP-8FulpLE6lrGLah5@!|w#2I4t{|yV2;1z3^4J5k@LM<o;rA4v~Pe
zn}1-3lLOWd>0`WN(s|<u>ap`#qromz>v5@e;wfZT?wXYKvJQ=-UrqP4hIMu*SrOpf
zq$3;*uNb20uA?kBY&RLJ(F(J#r-KK%=VU??L`aYG9hf)eljaKF6`+k+42Pb4ONKt~
zcRlRy0$^13(~_MydqvMSK!yn?68HahtpnL>aYRh!(bQ{@Cz08cwD0!37-Yc7BH1xQ
zrtMsLZm&SJuo2=7ACMy5ya5zpPb$l)WCo+U#i!rjzk=CbZ}smCuu5K1RZ*W){gV9v
zUidWNa<rs_K#ej<>!JOeNG13j-yhFJpI{;db-eKo`y~ybNzq*-&38OTOO(P!x(0_R
z2??r5eTI#9ih%k8XB9ISo9RW-#s0CN4HQQX2U>cuq^4Q+Qr_KxaySsN_L)koHBPw)
zml&do2c@_BL79lLJ8562CalpatgK8&VV-?{k{%M{JRscDlq00_eIwulD|={pL0rq<
z?UsikY`NziL(V}G@;p_A-*M%cwcvUVeIlLAwv9$>gX>A-x;;O>2POV}%HJ#=;rLlW
zWP)dkXNadWFZ^&CGiQ0dv@NWKSyNY#D8jnGkbOU&T^XZhn1JN|=Pdtriu-v2*FcHw
z-Th}J)oBW7U%=CCZM5BlRi{1+xQOZH%#5DkIf1B%#3(-yrHBZY#NA^=rY54Mq9&5N
z{+eAWi)<sF@tsq&Y-kveR8|J|@N|A-CO!(&V9q0@VaZz#z!7#6<JC#%=aoN=cU^1U
z_#v+uxXRmMBnA$=>uYH-yox`O^%CK4l~yS3c?s=p6w$4DNC>jUxIxw=!;3Y|%-BXl
zYD+E;HY~A;gBfBLs}kvsTF2rb1wKkY?obv!>9KazvTxNpo(7v46IMUY>Bm#JZ^U`f
zz9HXryZQ+;$o5<(howA4?amR^vE>9_kJL+LGQ%3`cY<><;C?a+ZFxJkPYVU?@wx7Y
zfgt4W+T^|2tN*?~<m)G`w_{1bb%vyfkox<Lc9y!R5l<Aa6E_PNgI=t1Ca>D*m?2^u
zA73!_c3CqezR{wg(;5yUpVGwtS{n^r!^<Vu*9ePOP58YYMbz(ZSjPF_tgo$WVk)OU
z;h{Ari~be`{+6|Tg@G=GH7c~B01t^rd8Fphf4_!@P_d_qtsO(a!ZVEMS7<G<q1$Ts
z{_|K#Hh=4L?h#?4x~}Vpt`wkNtDc^1bg;AoI2gZTgZLgQtL4K{GS6OWU3_0H@U^&^
zyxx2;TiMYaa(P+oLJywxMbW7bucDk+TAell;Ic22zsSexlnPSoKT4eS9IAm#r<lyi
z&Vqs;i5o}PB3a%^;`6<4{wwofM?R<C8tsu_CH@xNjS%fam@iys*csg@Fd3HtR?^xs
z`Vsvb3-R6fH|jDspFmz65?Wu!x2LqD)S6prSEkP7XNp41ICY=tIRcd?nJKH~7-@_u
zxZ&z$^`CV<-lT8p2I@2t0vAS*EOC#c0<9%&R9$RR(7WC4a3a7xgcx~A`T^oh*(jtV
zI0CDcIBOTOd!^aXDu9l6OumS{d5QDT4U+k<v-Cu2`Bz+lk(I{la38H`*#hrJ1k7mr
zFh2Y4YX`N&h$+(lv2>LIQGQQXK}wKRx<eX7Lb{~8q+w}T8tE1g1Zku@m+p{8kOo0^
z>F$*7rQT<M|M%;D*r)EDJ9FloGdnFu2+GHSDhKOD)NVoeS&84~B@Gd+I{Hqlgg+M<
zz%~Z~*_wbAXf3tU;!iq1Gl^#IzAiD!@gO$mr;y&tA>w*Rt?}g}9!rpcWnP3hJ)UZh
zR>R-KCzVPmPKi?a#V8Kc^~6V;TIQ8B{G8^Tv80M;TR4daJpQ1y^9B~<A|Yc=s;Z(J
zhA4TS=z-g|AwjO>$g0TOD8kOV_GmElAwRC%m)UX4z@^;K(r7MmOxQtv^57FyQ9D$|
zO?7>;!#!5lv51ESJ1OKSZN|49he;)dm8xU@V}<8ewOh+S>ZFPe+lbN~>h!qn1c~Hm
zEx96Lbp+_!^ZCMJVK%;iFaiS5Y~So5nA{KJJzFWD>`s8yASME!hK!q<-fBym<DgMw
zYPFG_ihYC5bjB>Fhi<CEg{L7gdEoe@G&~P{%-OqJK1;UnIsbn?e*;GAMVU^=@P-UG
zx0X52BVEKwt>5>VP6fKTv?vlJ%sPnNwW8`!-g3*QZ|73)0eU!$X>be~zoTY7F|;(z
zpFUuC-dn9~r^Wc+5kkPM&#F7v`OosVvc0~Y=v$yC(w};{d3--yT{!cw8~YZP0VG;e
z$Bl%*X62Us&Hu__6W@;BiuhmMFP`q*%E?lDMPU6~n@A5$9znndR(z%kVn<lcY45O_
zDT(_oRKCsvc*ZYj<U`L{KOpc`xNfFd@9VuRxcS02a-w1|ayOXDZ0)p0Ojr+`A0JIH
z^<Z+BD7(`Q`d>OKNlo+<d9AVlB>`7`-!qsHnE)UFfRR{d#&44t00jT(ALRjiDbU-c
z*s6=4*4f^W&;itJfZ*?Q5CXK9l{BKKQl;BdDVpqLxnBp2q#7@3^Lx0@1b#;ZBDgbr
zuejP<EpQ%O%mC!78$mc=gaY<~>knal`5fTg_TDO{rNwzP(l;%SpMeC1RSx+#9z)Y#
z2OrRQ5B!0Ws<Xkb)k~niEdTpUQF3L2hR+txgBlzJ=(V7pu~e$#V%LU;1J22&`X?lx
z+PvrF?Q%xLnlIKPIU(xjXDMC64)mOqBI((IYoQI<C-+%C`=#Il5_gK2_aI$`v7U3U
z?Q&4ZKJnI=RpcDOgzsTX87H6Ba>@LY21DoiJl6*ebHY=N_g2q<JtX6-WaQ4L2yT=Y
zRoP7j5H{fXdVXDoD)1xtaj2~^-A{VfSxHI?#h=z!Ld7088gIA{2<^hfChz1Kqx<WL
zwFANx3buh2rb;%%v>0?@uCW*z)ru{fRh_IkTTD2dEt=W6NHvr!kqc3>m$2VX^anRa
z3h*Rk4W&LmS?Ike*laS%SRzCSI}W}3SdF<(sI%>47>1Qur=C98=Iscr+>VW^QbGKI
ztV5ttm+$z}5rWy<ay};H1PN8Rl#Ug9Y&Ie(v}B!&Zc6xIg)E@P-!$ilIhqTsx(9wW
z{xIT$&<@}LNlm8KYItMG`&VQu@iuGlD=(KL<;g}kdNA?(5fgV$0DV{Kz3?&*3+j9Y
zSO$3{=W!;)&LJ94MvFm8m=`*J;_rc1_?R;-zeV!<1HCyaknHVYIASIU0pW<t>JN1d
zU?tU3%%n(ML9d5pPbsnJbvDEZBTyAqzhlgFr<vBSwVF;vv(t0A*qvzYlFT&1`AH3X
zM)hO6s55%#M9Hk)YSA^FZ&8E4X?G0x3Q;6jsFli{WCAfJLQcuG;Z@<);Wgo8=VmTp
z&X(o6+>wL&grLE5>dCdvXCF|}>(6(`#4klK9+RU<=+IscG(2nNsswVZdFPt>Y$o!b
zFk8f3it7?X=rv4C89=4y)C$9lbhM~P7^p@U_WBZEq`hS08b4K}S?(U#9Gufm()12z
zbqil^_^EA}&$sJiWZd?0NBm(*1?^Zsc-{D>MhIEwDCSDb|5t4x;bC)CHAuGK6V%bn
z;~zD^R5D0dxwm3VJI}X$)h}b@EJxeLS3(uB*`98nadS==)KcxF?R*?%`xB7+1QETB
z<2$IbjM{tdh)Gy)-pt-y$~sF5BLG4YyYA3-FdOi5`Ir?m3GfgQUfrmUlO9YF0Bj9G
zk<xR3y&X%C#i%(qL&*ps{w?WnRd2KX1}+Telxp{`D=eh4Mtyd2Urtr5n#zai4R>zx
zJ~?(!QpDC;$o`kQNXW)u4hKkp4M-D>KBs3%jMrps>@D?(eSnG@gxyu@z}An;GxsH^
z9rfaejf->uJzxEw^IuCqN$H29H&SP_22&Li@$A&zf{F(>z(2!J<u4eNSCm0x-*^Jp
zdq`brm(qF_OHCLuD&kWSkuapDdfvlwz_COyZ;5Z{1L8U#HT5h-rU)^zzMIprSK$&9
zSB$`?U^-oBgh6b!7Gkyindts+BE?PFNBF9HJIOENqe1Yi=$lm;sw$FK=iA!-sWi+j
z?9CkB9TYGiid*4cL8gM)fUwxMgUFn?pP|>;offAX7}7j)g<HeEJZ}C_HHK+<M^xQY
z3VBp4)3@vU8NITMzC5SbZztiFHxU{87TLs&VwJUvFaGyiIjGo4J#g%}hRS#M=Tz)~
zsDGlnGaw$IH{X6?D6|cHnz9}HJRcdMp;SuX0W0@R6UG&S{}ULc(h&E$ONbHMe9+?q
z<Kn;_XusD$D8lK`|JgTv=Y>#QDC&-!se`kDnWK^Sjwx_AjK=$`yWO{I?&MTZ+_?t{
zpoR^vn&O@+^&qO#Y-X>KF+<?YSi^t7jnr*@k-mrp@tdpSAXq|TH*R*Vw4|W#2qQ|5
zO!%Yy`BA?K?!|M*gjIhTkj-dj&_eJh%v?rbN#PjpPhm;vxOMz=w$(ud<WV*1!TEd}
zc<vZ5Khuy?%Yth<wK0SY89-F6|6FuO;arDWVKeX1=`jAcR<M4vhnh!D>C7W~r%_xV
zyTv`&JB|O`<Yu454>sXp9usqqocNu_Bb!c-&s=;-J;I5!QW4Mv;u1W3@7vRiQ`nk#
zqlh|xrwHQqt(b6Wi2tS!p^R|qo#=VJv+~bVO+;xG(^lp~-w6mz^A2tF0Q8q0TqH2$
zuDQ`)ZbF#=@92XTD2R{Ie01^eo*Oj!!*Xhq<5D^{<^A%&8p3MyaJfSWp)Ui^o47EX
zH8`#8J0ATCLhci0XJ;=0a&gZsryggeEzR$CQ0kR~PoQ4qjAj7Rfa>Q8S9d+aTkX+;
z&WimL#MX5=&ph5?DZwbFa<34jadqIs0ZjPpc0922C`AUtJp@<CabgW{ekJn-!GU!J
z!3j7C*#lTZ7iF%9ffB6<;>`m@6psU_F5Hegt|96l1ADjubBG5Rm^^B|#Taw*dgY-l
zFhvwT5etzwpA{u(hB&mvjAw_=4TT6Ij)eHAG}j|G@-|w;8<-faNhH^z>jzY9sV%0a
zrZh(Wms6Lyz))0&OD>Ff^t!w2V^tXHH2-F#g!9<?x>@<g&t)Gw0JBh}P}MYaXx>UT
zfHqUF6jX7}KPPhm0SdQ|DIvs7Y<TA2oJmZV-dMEXxYdk-_;l&>1G&_KnSea8@;4x~
z`n?w~OR496UshhFpek~ymCkqsaE0J0?Q|?L!O<rKifsw0-b?N?(H)$9Z+=S?8EM&z
z%^12W!*2$}jE}Ev&%a?)l-)_Ff!@6=iDa#6HlrWcCz}_Z$)u7=v`4;`Ud-;b_D&TQ
zxJn6md36z;`0Zgt1-s6yNzE||NJ&<kcX&QdG$yb!qX+>Y+vt7IFN7YgJdniC?p>9u
zi&|Az=+{aw<G_K3`v7w5k?R6ARIGb9j%Cg;2Yf8_5OhYDTB@%@Xr<nd=5R%4a`iSX
z8D(UXrI7Z0!7ZVFvh(3i)IO{#I^~%wR=Xk;%sv34I{$i+e7307g}21n6{EbTBeDgK
z>3Nsj>YaY(mIy6xIE^f-o@cnTJ!d$3uSH%<p7<^G2}t>h#BP6xmG)@|{TjUbg^V*f
zT`d^aNDC<Cs0E%{#{C_)=7|{%gsWW1HA&Z3<{8<8yK1wez+pfU=tbEy^RRIWZPaz!
z-ctKsum`_Sul7H*yJXo$^vnS^SKGd;w^;s4`$L&S^1M5xEY`RHUv}1Pm01@-&LO1P
zS7O<`gJ!!v-swSxU)z=}Uc-0_r_NNGB&TgQ@Pam3vD%M!iu;gDRVZ-hu&^|mFV6?R
z10JN||H{A<_W*PKoS0dpV3={;(T^w*E=pWD&RHZTCi4{O?#g`ZFdX9hG(q*C4hLH3
zfmLkxMIPm`8s0*V`vY1W-Xv*PCqXYqbR%o~C)wV_uxmZV>dN)=tS-YULXiQMTLQ0D
z%*3hykwH+m0PLD1@xTey`WL4p=>T!FISFYW_mx1hK@<xXvT3Ng*WWK`-S5E~_vEsE
z^djWepzGoIXWw{LquO*x<opKLC`nK1R0VIy4vG`Lkd4Hj;J-=wCM*mSlV?RXMy*p~
zOisls4oh%~s8;%B708^CtVn#+=RHNRHL@aD<+BcNchp)2lBOGs0XYKGA>=r|7~U;K
z?-~F6I3=GUR&Y|dw8#V{fA-IT`wu-UhQBX;ua7EYC*GR3Y5B{qMz06Rhv#vakqlFy
z4wwtnjQjKSW#907OzT+}0c24BJ?@-arPim%J6P<)Z0r;)dG6`&H_-;#if6PRIWYyt
z%o+TE(q?*ws|W;x;<@2fiQW#WPG2MSVm|gOB=Fd_@(`AQZhDApF%_h6LalA@fSE*^
z1`u08A!pSd{HKiN3&<N9rBlGhg~}j;?hKGL=8KLsZYKF}1$DJh?S<dcJ=K!mFyt(1
z65ek{nu`l6UPEGPkRAXJwS;W%?X=dVQpcM?DQ~%44YEmY2o91kOmM96vw_Bbq+8{p
zkK9*DEN!952lGY6CFT`dUt6bM+0=w)*({`<_A9Vzud1FV=fq3myzi|AnXj|Yd;x=v
zHhdY57dGR)1+kKa%HvpniAr#6_CL_>E0*G%N#54v6bLdr*p7(nF9R-5lMa&LVxtMj
z+$8n|Tbxeg598iPwQ=`<2DG1(Bz4bnn{qw!1T_NtR`$s<{>tK<jhribWh<WHEwp5V
zdJeo{^~HNz4J7+PaOzjLca;t~;{s=|7n~j+BdEB{1k}S=GG>$CR1c?~Zzj3n|0I0O
zuQZpa5-y`SS8Vy~!HfpS8veR5*_iz>OO<x@SJg}Xqj{(7rIH&0y<{IsMFpyXyi&oe
zBCSV!3sybz?boPaCFLC=Q&z;N%}eo@#5SiNLUdo$03&&(%?7eXeE0qPh&DJR$kQdq
zOteBI0xmxwOF}>1le6Bwclb{A++-kz;*y%@rLwY34Qc%BKyEybRHR%4cME_y#n|aH
z?j)fNGZMXhoqX>?bw%<{v3E*DfaAIL%$|OpAT8EqX%O#iEUaYXSBB5v$Pce1oTbPH
z0_{_|n<TmHHiF!&!FhcSYVliYif=enRo9<XvG5}}mqBZd(gzOI?G?GeYy@K}O`!-d
z%>BFS_25C~dkM9ID7jcECPTl?tzV+ke{EUusrhBSzK)G>cC`}<%`Km2Ul)1;68y_k
zpkq-J^Hev&QGV@v3TVqrq{G+rt2EocYbKk8zxfVuE&Qx0v<)zNTto)-qhFbZyHec_
z%Gw4c`qCue;z+I@7+<%(d9F+y=lp~dc=Owx^hR0^xoT$?L9Kx|tIgvYYhiCD3A;KK
zVM>I#IUoP*dN^d%eY2h}E_seX1g0<Zcj)rFE=T{Oe)<OR8+8J^UEm+)W2DO4IW_KR
zC?U7yPnyEDmHXKZ?nSCdL=I72HeC$`?KsKL<d+!|kk`50qXxgT2Jd1f)IqQi;yJ4#
z2Q@T2sH}nZlMIL`C*odUEhIwp#pS-{R7%<S@2&9c3AxwF^3{vlB^{b8WjoaYm*wsP
zB}R&)TPZd7S9QsguF4`BVQ>@JB#zp^zR)L-Fl-WUhtg*^kAUsd6p;t16(%){2B-`<
zTR_CO!BsElY$Eu6Z?2$ft~usPIc;|-A4jR7i+nx}?tPZ~C~$n<qV2tIPJg;}Om%hn
z6fz5m_*S>pEc&<az4nT{&zz0*KIe1OD};r~zK<`^QagB0eSC5*_H@peh`c4+JR8e<
z35JjiFPc?wNhiM?0Gd9pnu&PrP`HEo{-st}cruztVZ2LCXe0<>kML1Hi8Gl4?>WWs
z<MFP))>ya5WnJUy9~ap$siHDmp`UJ&2E(3dd;d5oUNN4LJ;|9JzoyJbv(#%v3$c<C
zQ}!Is`^Th{6^RsIkw)xR?iXP_`~EwUO({8j7$07rG2e?2Q^M8wxG#-w4nMk2HN|{p
z3aseS3JYlv05IkOKQRD%0JF=viN~2dWvtv=jh~<!pnpOanXK-e4p_qzqu-?oHjxe`
ze)}8?HzaVKF(98XS%ErLN?mOo#^h&1D?>9XbxKM@xRQ8}L>0QLiTi5K33I$i)M|5p
zp=Ll(I`s$dmA?9&PT;4yi_sAyNnUE>&(Rg1U2V7>{LY|V$yR7mxVKE8Y~I@i$B?ts
zE;1X=GEGr7^m%$(3wuTMu}uQZwef(f`pd?zF!xh9KG3@=^F#BlGN)|7fv*;d$~-t=
zOVZ`nXBQZ69`V<_mWhHKtvo$m7eAd)J$_`5`K<a?Gon`jo?9fE)3tHeh|!a{Eau?X
zj}7xokg>wOpRaz<e^3weU-i~m8Q^s2J;Im{^X~`BJL506m|ip_urIzE^>2Z!CW_=W
zY6ez6305#6N`xkH0fPk@F}Zn?bY`8P`Ipk>b!s(^m-DodMUCR=^yI9{EnS_)NEh$C
z<1Fo@Tn3?^l8XfJ`ON1NJ9VeS!{$Ml6N3Cd<Jk3ZQmDlWr8PIvQ1G6ez6#7s%z)@~
zT0Yt=)Ztdd<-x#RCGm?+y?3<4*&g#?ur4m7hFr?aPE!=U23^c>Ks5gor$v0qw~x<$
zj6*^9eV~e1nm8Kl?}oy(F^eh8cLlnALMoqRza+iM2KuZ=HCob{lNT3!as3I+Ox@9<
z%uNvzcliM(0!*IIi==<m$RuAf4PG;;z11bxjI|58nY_M2q9HWZt|FdKFgQncCp~9)
z`lYlZ`z7iyYvVuloETc>IEr8khfOeCvV_PXXD?v$F#lqVCPz5ZVL!YEy(ZYN<22f-
z;(ADk3JLeq-udpaPsHvd!FUk-{^rp!pJyTO(ARCY^M_jkr|4q)+AF6L|52#1*;D@9
z3oCvvw9{@Fu!o`n?F1lS01}qTs9>l~Unk&ULO?tz9XV}`N&ei-BvYllbbEr6D)4|j
zL=ZKqu8h4;*=x)+l&+k#uX?W=zxgKVazk>))BeI8O`ZB}MTJibK=42jG^MG#Asfew
zy{CRJM_+kHrgs)u;x*U>;VzF#XS-haAL2H+P-Z@r)!Z&1e*KWAP{Uw!c3fUlCI(fV
zt6SOhR1ZMI2%%PEp-OVfmdU%LX-dGZ`efAaQ4FUeUk~1ACc0y&+394(D=u)SSxbk$
z?bbgOKf*S9l>2bHWl1dEpRi(*D`NiUZD4&X&J6A7d*T?gbUy|&5u%95*=NaRx~Q~a
z_}VVLeNGLWIW^&e_X>rQza$G8C}Z$c+fhwbI}HTJ5=|f9QdVsc2jlMG^`0!<AOuH@
zg&FtM*tRT!r)JNGPE(J`Uoa|5jQ<|&V$(c!2^4S9=w~>M=4<%t-WKf6T2dWXJ<enT
zu4U=X<&Vy2;(RJ2PszY+?6?;g6H@>Wd)ogl0*N3u5W&q`UJNb}ZK)V(93@sRYO8f-
znj<IqvK`FweSR*Y;#>SjR&k`6Db0}2MxC)o{?|6Yr0QOQ>_q`Z@f53wuAfG+t?DH6
z<sS(1zJ99G5yr)-`1B0=?@h9t{uUFWJ7VRv8CMFUu0(i}iYd*oiY|3r*Phd?PNqGB
zDQFyfoZ9=(2n}3y`y=`|llLe8q4(*6J9>Gs3FV>2RdhB#3pM>kH>Vp~#2gwgZyw_n
zzd=Gz8&)PguQCJ*JhQX);PTnkAb1g|jOZz!yu_fz%rsAQIGk_7DX81~TN?Ha&rX5v
z1(!pVp7h=bEcn%w62X!BAGs32w2$D%1Ej}q?(&!G0kkCM`syNzZRI&eV1+?;9bznb
z;eE@kVQSWE0TwDBd`YQ`2}aOYhRsOcmDp3JXoVCuYTngRBIHOIuPdGa?HcFLtLUxn
zPSkQ1vIsByXRe8!OFG_6dJ%oCgCo^$vF%ZbXs`ZSf^}MT+O^%aC6QiTAAQ1RS%G{G
z2T$;-XX?P|V@`hFca$k5R_pF~dv9J=@t-&B0m{In0b!6g$@X>l+LWW&ts*st(cKnj
zV2g)2bxvG3Cfn?rN;y0dT=1sO8;RFkVRoCU8o~6m(ieE&|CV*RIQ@F$d^+Q-zM)Ji
zO4FW;0mpe2`v$*wFK++I3z~dK|3;t0$aM1uVScr4-V`h?o1H7(`Cb%If9+jX2l~Si
zg0~BVIV@wMgG#Bx)+Jka)V;ZK#!ozU9xdA$Z_uQh*lk9%f7!fz=lI)5FQBPXkRt+!
z$PNt%&OWC|GX-kK7G2?97aSmct=16YOfqHbnoZttWdh}$BFFkEja+~BBSg?|FA!$K
zj%Y<!g;&*ARUYw}iMg>Tx7@w?>VfwIf$jS(V+*R9UC`~N+_Sx@m4H1(kODA(*9bgr
zyKw3qK46}vX1yu0eE|6D>`ehFgu=b@@l<Nq>{IE(z_m&?BU4A<<cEQ)^5*nmx@GIX
zPX;BOHr2vUi5rNt>rGcrEfsgU>D8|hK<s5&VU|+%nPT+Caw<tK=}2vQrQno`ezvmT
z4_-XYp5O`+j86mgx)0<mneztjq8}K{l~@7GC5jiX@@tpPOtkPN0X$hkYqe$FGjZ^z
zbLQtL6pl!fSL@hFcG6YxCk&_6@?VT_aP<KKkCxMc>6~<CbITwK?F+rH^PzaH^t&jM
zuOG^Kl`y{EQ=rVL|HtW352nsAFs2>U2x}Qc-Hd3jWJIsi)p6u0sQN8GG*c2@Pm^wC
zFU6!NY7^ahoXN1ekQy(sB0x`Q@yAdjdTaOVQRRFfBMA(RbKg=1sneo-%$m8fDPc*E
zVr2(=h&UwaC5$lbv+aM-Qy+c+ehyHsTr9ed7pVvBeg|gN2Q^Z_GF(BK4skhS2)B;L
zKI7NcGh`L5Du9Qpk3ltalYXIMkF}#|4i!ih_b(o2+I!XX8YTxiC1v~~@JaiJldXjj
z{1sw7jdQ%hSK$-(z-T@*AA~o@R!ARDJ!-kG`F8gH6FJ%sE_Oh`PC_yjm`d~?o9;ez
zGBtU$4(O#=`Rj6G4uX-_-q1XctZJ5<Y3F7qtP3&2oLfud#hhylE&^c3&(`n8|9WEA
zzq5KC`vl;%IFJ7<Wn^YvdVqkI=1kFlu1qrM>(6O>ghRgk3g*_u+(3f@N01e6%?s&5
z2+o>k_8qPt_d*iT@Qy+Q@XX17DkG8JTmOK@766MgpW99_tkmd!uB}Xo)iodW3)*_;
z|8kv8RBOj!UX(*pc%z5dyg%eWTdZ=l<O++QTAVjo{~>jBA>gKSq+nLF2)4PJ?~S~`
zHATe3rQ?dKCuDOpRnlU&bY%8^ECL-GZs4o=)cl+m4BcpBQTKSzX?oYM#LE`$ir`yB
z!lZOpLz8;-i0vn9Ot4t}oR(U7fpIlXvo_k$!RZ&64>d?a*DsFJcHHTj0Wsb|!ynp7
z%*){(&W&cGOH5@4Z(W3&Olt=^Vc}4vIRowHVAsCP*&to)WTfg6;Fw-n9WR7L_|F?~
zU~E~x)0nP7!=bELIBL#QDaC}-iHwlF8s|K8NE|-}^i$bDN&Mjw>tlu(KmqvBPOjS<
zbx}pM>BPQO-Wjx_eu}{4RQ=Wo_6n#TcFSA=YK!wqYX<M+Of38fqn0YcAOx_qa(G*D
zwx{aKY69@QyMULhhiI?H!vMG`+6T|PLpPoa!f4QB&y1~0f{qZ^(NT=PM0KuM^+&Lx
zf+uPk^pyQwTuxuCnE_@||EccCUU?V)D~@RDLBD*TFRh@z6j}FTxL!HK2J_HjJp0)D
znVI_uxfBvx%V%PfdRsm-N$@jKY>xJm9)0osP(!>`Ov2|)IhOjGfwjwjRZqxW1K}|N
zas8K%s}d{k_v@Os)9q|&I*9a_I+X<~7<1s0#ZV!j!scN@PkA^)2cCYs9v-HCfuX=X
zJ^(;*iP=Dl?2{?~<J@=v-yeeggPD5O+~YzVhXq*&9yqbAkK%)<H#7SQpK3iPfXEgA
zjg#rn{jDx7ghKQ10twVVij9sRj-`ua3(7|xn0;}l9v2>H*9FFvUexX3?RK}n6>*C>
zU<g(qp6K8obN`Qa^Z{A0?@g#?-w&$TTjnD5EvOWEX8C<06`<^^Y&PeApcqer=KDl!
z75NP`#O1s#|0(P*2&s#7r#gP~n>AX&R}<by1*2mvAqHtaxMuDD)G;=DY@|A9d)+n6
z4Ao9$NitO^U$DnuGw%Y@zsWls;S+K8zt5&?TX-vaA)JA?z+gJ%TUoiA9{?T)_X#o?
zCfw-F=M9?>5uikw_Hv*Um7QU&)XhQgi}oTx_hucO2lcc4=WsAf8>Calbc6eEH3bgq
zzg}w+oAOOgCm0t+(bb!rDdFm(6E2+ESL&R~`E-|Y2Fdu@8@9-~g0NcMm<I1H<#9u{
zE{&XYO`qiS{j}zQjSm4EUoU9*PuC>&W|9po&VSBxkR>;I8xVHgwRIWzeP}$yJo6bF
zDJ?bhnR3ufSM=VZlLOq$K8R$n9B7cSi3FaKFpF?2TfW}-emteIvUFjeEb7d2d0F&m
z{&%NL$Dc=U+_CU@Zm|Q?U*tH-Po{5(F~<;ds3_K}h=dr37&4InqavH<&#R@JC@${j
zA&L;^_kT@uO5vmz@0g&!BHsNHg+;!RfmPSO*Ax~&cfzWxc{CgLh*_V}(&!=J9N;ZV
zbz4girwuxyK=VWZXWzfjq#!G~Fp3ssG~WnOrQ&6qZ_;INWRuz_L&{hVKmTyv$?}|b
z;i@sG>q@lCcEp(M9hw9~lT^P&n?+Eo92Gw=L9J3iyGB#KrWY#$KYl*Vy-5^38gEQ5
ztFBXPqvli)JFP1XU_!2n7q5IzgEiwUraY&U#eDd(_`T*sd{u|<_4K;*j~Z<j1L&XE
z_EU|9dblwc3U2B?bCb#L4q_!AlGXt3q0TUqQ@ywTCELTm(+$<Z-XMU<7u(^537bvO
z<B2<B^2;`l`)zaYc?RrwsyHj3Iz1hBRffJ8#!?hST@ky~6iX7l$itaB4M51xiX}mS
zWe%$uwsTY$$)-8;_g}6EPSc03+dr2ASH3N8Z>pazyQa64Ix!T51D}qc9_Htj99XLF
zQawcq8pdb)r>eq3Hp&R5V&@5anC`rVATa_EYoqbY+>&Lp9HupS&9W&7|H__9s7~vY
ztjq_NO|jN;wSWty&Am->%RJE^?;$F#C7gPC(6DFm=Ln{V(J>J3#=n=y^7jnRXFdks
zvAHkRNS&rRH@IvG9c#L-*S|hUJDKF3am_r-GYsD_I`+|7(q^cDZX;lOpQjM2dy|K2
z1b<DC(|(xK+mfz=O|j)|PJoIxjg@-r#3B0KKBilyKeS2|`^-msg?cUF{YLY?@Kp*q
z9S1b=8o4k{FdS@^(_U9f>21u}aRDXRe;v64btTDRJ}VT2wn<;+$2t`1aC}A25aaf7
zDtmeXH%p2ij^lTaUPfa<4vig$EME%a_&AAcf~xPnEK?*h?)}MO?Ld<Ux#4{Dn$i=y
zW}5Ix29(C4!HhkJKCS$5H3|z%EuPHmlMFOXLq*X<*8oB2vM;y-a7#?_Erv4-Xcz*s
zQErYbqS7z`+FT3mCRZv<G=xY>3ssoh+PtQh6FJXs-U>`wjH<dAa$Z#WK)xet|MfS@
zmkKxje(xBX$9MdZ+U5#mrin7p{x4ztRe%alFzQGG9$^O%J^Ogx$I+2H<Gi9};7NP|
zwNY*X(0+mnnHI6lJ*$&4i4Qa6qJGUPLVF3~UuMf1dhhz+8WdZ5&G7wl9mr1d3ue?F
ztW_-;EaOiB;nam8Uh*L?z>jZLAdBZCB3d8p+dK{hX<}Kp*Xi2#wL>fybxM|*0{5dD
z&RCy^bc<YKvy5bF%#|%N861s>G-vzO((DGE6~d=$`QkYGqT_PiwjKEJjTG(yLr;r`
zJA@(BGIi@a6X$4tXTZRIDi9c!aa{fTVR8JyaEXJNt^%W!ECA4U28tLtccU~?pEmvM
zs3f#$d79~Zywu+`W#LE4s<4c>20%c?W4|3C9VvrHKpnS|g@6escYuZOG#&gbzgh|j
zdWmRexeGwUrU=dT_5~u`$06?_4--UcDn8h5!p6v-WhL*`wIa<*=WC_j@vWQsct>@y
zH{kdy<-ICpAL$5!bIl81Q&TL;?!9FLCt)J3s~Ln(Z+@L|)wK1@gbg6?N4E~=jg^q`
z>1EI^;t|qBz+a=+0|J~2t)~610tTV$9j{W=Kg?5IU(a>NYjYw9=kSw){O9QcVcX!l
zx|e+l#5CI8@v}+-aVvv5z>I+lL<7SZjKfvAk2xupz<F6<TTHG=p+3$PJB;QaF&-=$
zw}(t``i4U?eF#W}0)NcJ`fbv&UWVVW;JR2Yk;h_+2yF&kK*bIUD8UnV8KS&R=7yhe
zMMZ&SzPnU>MVf=z!$R57<{djhgs<&SYwBfPL$z|5Na9jb2?TE2$kVLqYtKhR7mnnh
z#e`i7JnQj>P*GyLxmh&)*j}iqw0<AiQX8%lO!Av<TjvE-v3xze>ZL;GKu2>5U|PwE
z$j$0M@N%9s#sO}iI3c8{s*;4?(5<MurQiLv6UrsA8g>?CN><C2NJE8UJ?7Vt9uNKc
z;kp_5+`5Y=xpz}#rpuxoBvz}^6T-&bQsvMZ^qd|H8BKp7x33s733-PPaJwTm@Qv}V
zaB(uIsnq{PBk8bxi0E5Pk?{S&xuW|Mi3WLu0s8ydT{jw);Twq5LS6J;RHqGi<To3@
zUtPp2`BT<@cbjUTt}rZasGVf5+q`|h8~bRpB<jU6B?<<txnd)`MQ`t>Ko3(F$v@kR
zRAvy!QX$n%5LL;@bM-YuEH=Wd4o6Z7Ov;%D7zQ1p<J0|u_HlKi3yFgZb{CwiE*kmN
zy{*SHF=#=)LuMVyAjVooNZX8it?GuTvS`WFikh)*t3qZh!lSGj<(mJJ;#6bZYV4cX
z{o4F|`nyRzW{1QAwvM3olFSVFq{aiRzl3`#?@WH_e6+st^cB0E#touzY0zoL%W;jW
z9H;Z5zZu<}vN~>c1+udD?S*$7Q=9h1=?hkmeIdrq0XJ26`29ztg@8}~nErwfwO_&6
z^^h|yF*)Dp@eolZo(E7avvNqg5X~bf^iI(^_SogDZW{h8;nUFzdZ>ch)BxUP);#~)
z6!e{(z{l@f4sOTL$hUzTc<|jt9FB3hJ$;~4UeFDMIvpRj6BG|4lTj?{5l#ph?G?DJ
ztoMtdxVecTzNW(9%5rXg1?pFCL06gzp12<<kX^<Sre)#i&%AMWmWSV@rgmXX%B>Q~
zO6l7RiN-DAHZMa`C5`wn2G!qvF}9Qvuo*6fE++;=^wnvxNeH*#CK{Z11Sh#vH*w3&
zB}4Q0R+>Zx?zRbGpZETT86#UrA-~{kLJ)V2+_OCxMjB?vGS2>-e@B;SyC-^D2Tk^T
z2rwoAI>f7Qp9e{c5;VRFhP?dAuGq6l<>O{JJt9dJM!#=@QQ{#YCq((;h_3uNVI)?g
z_56%8B1_Vd!=js5EPPAN>1liAK0`l_RU$C@gm|3p(L`DwNu7vQQ)*7*DK`zHK}?Ux
z_B()YwCw58QdZFI5tPVAfYW835E5swn$7rsIHJMh`cW=XxO&&MZ<kK7qT}oI-0{Lr
zS(<F92fa+}KHYO9!RdO??XZrm4r<FnFtnbURd1pxHlc*HS~Cll!jn`Cx1F~rJ$8hv
zO<iD9HUu*I{nN1s%{Fk0Ez1d~E};#BR+l+NX8;@c9(s0Kwds><ftL~4VDb~Nc&QHn
zm>~x$o<Y?Kb0cP#IZHr6#(nt?7e(1T3i$&n$Yl)+)t1!DZocOJ&lYXux_Ql5E_&_O
zGG(N#yz>N)X~bvhNFvm+ukorM^SU$H0=C9gkVoE{s%k1E^*1xU9N4mpJ;zT~y#BNC
zBeVpfy1l2}d3Io#HDkA`M0q~7c8+3DLeP>th*r3WEFot(IYekQQQb>&RPdRa<57lq
z=s?|_9#7duO}XW>N>4qZeqP09h}!jP`*5^t1N*I5)O7(HyfK1*mT~E{`Cg>IblzKF
zvqXjAi*r_X#H^Jo|2MhbXL_&%%iDp(&3j|4vsx__DdO8S3tLxXE8F^(8k$<1cqvON
z6u#k4<6Y2_6^J!NtIEft@g`>8kXclj_ifaD;^(a1HWghtX8qn;s!I7cvGXn*agn<#
z+}TcLtSv0@WJqz(sxM?LI>=yIcRiyIZ+|%Uy2E=H>v)W1vujN_FzOo6=3jBVv?2O;
zKJxkrbejY!y{>&L{UsV{dHjBKd@{MQ=uAxnfGm5=G;>HNfb=K_2X!;rua4@Drf1Cx
z*<uYSPR>eqzSal}q1UkxERs=+51{lsn@BVN+@0_CeV5Vbc6xwuO1`vf{D2onR-mud
zp>B-f&y7jUZKNgc9Xj8>UKQzQ%-z}Iaw_|~ik(1LqvC_(PXSiE2a<&4>Z3ER1K!!D
zm$3?H16z;zlSFnN(#tak#t+L`Wd#1XQ4bQ2j~d312w+@XmEhYHK7moI!B}p(kUs!F
zXP0CV9L@Dn?G^P09Wfm3h3$W@pUCF*Uy;f_wale57aoATb<!m*l#xj3`&>!gqyt0n
z=PdB(;@PqPi3b=GwFW4=Dw5m=CxSHee)lC+Ch_T2epZd3zkNvLh<G_M3>mW30!Qur
zbMNv?_lf$z*`*<@J{dm4a@YZ}+P)qf$tAe&EHgg8*tC2-BBatXc2J|U^en_liko7C
zQr#lfJE?i(A#qzc%8#UMDXF3&eP8a@aX4kZ&um7gE@p3@sWWjtS}KHZE8i8X3Ng;C
zGMo*abzJyd>5%GO7b>xw`Q=y3MTBi>6=0F2KWgei^CAP{0Z>GIqb0xga$(#(>{FTD
z|4uG~7F`uPpU!=13-^y6K8g5eF1;L+0nZVxy1C!lGTuKvyV#!DYoC`~#x|d~q+w0L
zYCw*ecuJaIU=%%#xQKl^6;olrH2|Z9yM<rfytHEB8JIH0eaLS^jtJ0SWlB!V?hEj@
zRVjUB7)|(aTabLLzTWfD4-Dg|6nqFTKO<PM%kcwC2x8O?vv$Uw*WDrndtzb=t_z*w
zTet@T$uP;9?_(SJIGY=2JC|$w0P}wmBl)`m_oGRY*jLM8$p^`QbS0WSrytz!A6A|o
z7;kW*-3tTMHphJ)qY|@8{OO;!lroDD!PS_l+KW2d4uv44)yGp^DexqyFMX_eI>H26
zyQMiEX92%m_47*Y=h}DFic>d^b^wVB1{f%D^ReVbJjE~R^Se7;_H@1{F^A~KEy-Ej
z;#YcZzlxyNO;9!$uyM{R1_j%TfjZB7azpHXX<RL=JYHc8oLsUT=y4mF6n(oP4Xt8Q
zz>JW)$&_j*=k0CFroK5_RDAX$mlcmJ=xi{a4lJ^FZ68ev7t`|%`TD2p^5^5UTyadS
z5J;JN5bBuW7naf3jn=YDMOyQv5ABe8<^+3<Zutub0m55ci3%V<M@8=!jWS+^glZbF
z;MuAIc|48DukWDNCQN}pEa99=cn<m{c2Efmvk|oI^qzLgfICPu)Xex+VNO8bgcH;}
z6!5&5C>yVW>AZ9bujLsNMk5S~%4!#usH(fW_T7>&E~)-38uKf-vMXTsBhvBF+v~Sh
z4h?#vtg-?2bjFJ#fD#MMU@*NF>TdK)V+=DCX3+L%6`f{)aAgN0+5Iw<vouYHuCw8x
z!Vo1d3s(ww;r7?UC}oic_si)8$tJ3L8=8gQk^^UrGs|flxGx}XGoe@*hc;f=pH{7A
zaRH|9ynr<hAR>%P+V2}>Jb^HLyY@se0FLqg7wOu=j&x<ceI2w-UcjTzS;Y0VfA#`-
zxd75Xy+8nZs)aQMFX`|%#tn;F0Y2raEfD(t_m>TofQ*Uf(~G%9TR;{$dT|bT$W{qX
zPdhb>tplPxF95aS`@S?a%}fqL=tRZ<VMu@K8-?J1)RCX(ICHuBN6~%*%_!#3OIcw6
zNMr}{$gsceM$Z0?N$oesrKk~+z@e04Q=3jsSZOwOsQ%0BL!0NZ3NR79-IrT?%IbMa
zfFa<PbGa_U79e@6rcw~r%uL3f%N-qurX6B@K+Bbgyg>hJ5(ZuM!IdCXSW|@Q12?b4
z`I~J!$rT_26N#;ROUMCNrT~ol`N9<vJAV4qa?dYm@<)s55#H|818$++Wy60P^sn4!
zjC87Lv+IF@f$<f+?F|iD1NDG3P=9sNM)%Vl;M%)Ob~J6^R5|jDsqIoX$>)6g&mKSz
zH!dvze-$PdbSrtJcrEqhu+TJh*U)Xcu8X4(au9&&og^M-Nox1nbBpLNf;%~S0o!!)
zOZDuBC}(KjMsNA^C>a8XiMBbWUVWZc@WJx_jtQWUY&=x$Pc40Bswv4xy}Rdhcn(;v
zhAeyUWU-nG5LN%_leu#DFWmF0c02V2Ca_f&sv}v`LjbtyHPzi>aiVC}M*4kbRYZPH
z4-3Z?1L-xsX~uBAn-j%&pUt{>+`m5RYju6|xy?270>Fh_wD-N5K?I<0W9BSxr(ohZ
zBZGxW+uxf2-VEL?rA9lau`f|)3Tix%?vePEKk@?X)`vtZ5v+Bm_7!)4Z*snF4E#h3
zEFt+XEkjv7F84!6^8Kk1sCbw(FHP}k-*ms^iUc3eTl@IGHl+%@KlOP6XpxuhUxB&Y
z2HKDfyE1+=qC50rb@Ywqs;z8>iTJyny@VSbe6=K^F_%|+;x(*W(%`<W=QGZ1M5HZ@
zGcK8+br|nw0dYz<>}Jj#1}H6My()RL9h2Tgf(+l5<}IypjLWMd>_pKdcJJ^z1evPx
zV`(w|V#tLCQK2+#3AFr9F0<F+%W&wse*`j?_#@%XTP#7oCqEbEonv<;B`l?VFg|*%
z!(6VCuvgpXpYK`a*bVKhudjb^L&w;~*FE=;BP|JpLN0J+z^h(lGXx<T`l%@D?y23p
zJnWNZU0)EdsKSz~8Xtj(`63W>asX5Ry|<z2QA`BPwE7(1N83XvNdaqT(3T!iJ*2a#
zRn@)1BR|a>?u3MMhk~fX*LuEeq$^;n+b5=G6i2!$5X~s4nJb8PWkyoBf`<iXfZ1>d
zFY<WCBhR{<0-qim08=1>9%r2O`4(4ek<jdBJa{7DZxzdaOVIjuyEt(=T<T*|=nJ_3
zK!Nz<!}=<*=qmb1HJce8lRRecSuAx4K9M)wVeg*~`RXIOZvDL_z%pgnW%0e548DKF
zH|NZaX6O(nm>FYx;t$Fx?zbLA=eH_Tcmwq98r#jKYD<IcVN$w{%0^TpK_22>J<gmF
zzrKg?Fg+ANEDjrzyBi;nfT0-n?^%HAVv%q&k?<8a@QV0>U?BBHY;M08eEFL2c0M7B
zi$In`oW?4t;!}or%@0dU`BB=cglfGiiMWr0zkjkInPyip<<t6HofEO@pypSO&+`Sy
zV8EuSm@V^5FTw{NsG}1@hLO6}u75C;_1gE!pGoUV%>p{%YF+GWN$mnjT6^QM$)}q9
zO@W<E*Wg)^muDBH<V?s?PI@1IMlceEPyy7MhGpu6WYihE%WM6!Cj{Pw(3`*%haQxM
zdfaiH-8Fr7Zs@XsnwSFkq-MMD9}fC__tOfAMsmQKM~Y{8nHBEA&{fePE+zGK^7W<g
zBlI==zOx10P(cSqYbF_~C%sm?!W%+8G8!=0`Z{vi=FOti&<+c=#>h_P3%jFO>AE<R
zw4JuZtHnPdeka?K*SVKn%e{5+ylhn{xO={Ol(J_Ya^&cP2Y*Tk&xcK&v)Y7zDNF}E
zkLI!x1fPBA)RrK;#~Vi+Ho*Pmmq_U?5+E!OwHEShfAN#nGn<dfiT{<Hg*JHiibCMX
zw3OQ6O2^Z*8fRPb{Et>XLhFQt8TbR)erH2()^PF&BURaCwtl_|irxsfJrhcgj7ZO~
zDt)?VG1Bcx?v>SxNr2pwj=5wicgk$VHl;}0Tr8CB9ky~LJVoP@8If$RnUR04%&m*t
z9pS3r-y#e?DU^8B#^A)Xh;fbT!pPx-OJ})I-Hs-)qV3ag%=QN;d3G{scT$aTO#8kL
zXMhhYfAM=ZaI;QpSL;V_vmuo1Hp2K$3iK-x$9uBJs#n#=jKo~M0zPJB)9d?kn8mY*
z3mvOU5ozyTq<2ycNE{HYQ790W+ns)(JVl&8dQ>V3{Yu0}6PM2Vgr=^^EE67prKn8l
z{L|6CwNCo`&B)iaii8RHyB9wp6C<_+5{m1ja&c2Dy+z>DGfh@d$;*MaVpSbbhMdOJ
zfbU&y(QLK_C`E*02}OW4ON3YsJjRB3rSwdh1ygwmlw9oXLw~e)%p@*TuC=6-UvgiD
zgalcaG_*LOU#Y-1Q@qt|RnWXuyjJ&{cq)Tt>~N|2f<cz$2bPBwtuv=yvBaV;3x;#f
zAYJEtOe2ncX~m39zjYmz!6ursrj-@3<N|fJU;eDZffHG!;LFtsf*?0_iV*40BYSZR
zB+f&b_@D02VKS20g9|=A=X@_Qe>cA07tBobOPe?aOq?n|yZly)X>4uA^Q##Vo5%Bv
zodY5%36L!Tu{@&iAp4nmlLek{u21($YE+s8<Wn4PxkQ|F^AF2^{N1FlX>_$S@dp-~
z#oztt_Q9!oo+tX#+01sIX^}Q{s5|)I2~d5)#P{@8f0I(p%Aio4QUam>({T|c)#?9I
zG8OrLCF&{6cFm5P>S_<1H!4omWA0_|J^(DTG;s?IUtplH8!&YQ$ALkB?X$$MMDHVI
zQnr2-oP)+x9qb;~eESz&Ul581D<54>Ag-_<C9OnWC#{eie4G)FcxpFNcZgj2on>qO
za@^rl78?Wixtlc(r`AI9QMLBH5z~ufEizbd_P@t{r-mOY?+LyEsch{@LaAVGM%j``
zD6H*P!%lsgm^*?xn6`iH;Nj0a@xUtSCegd^U1ym5wx=_Q5=qYqxNt?;`85I6smxaS
zbVaz+Liww2_mQF0m`fW%<u!^^$I(AH8fe&5>xp%X0&C%>tqWP7M6nCG{=V7pEVPse
zpoxC=7?_gWcdyd8l#*OIn*#lcKm4VEvH}X1N|ylSNf8jAlPhg8<$TusfB&Udqv#vt
zh9Um}(R)Rcpz0Ly;cu<?<`lH5dvy6EnPqIiL>?T7rFmf=VG8bc_kQc?UB9h-65p95
zX)#nGSK))>rrh0??E>hbgQ1e!h$g`|-<7R!LK2SWec<=$I^Xfi^H_lE#dT6*_hW<M
zBX<PwW=^&8{{dSB^m|X_$2~qmzkzC+8Dclv0EU${<9!7IGzK8^v#JyDx!5f;FU|?@
z(dSffNr9T6BCE5pW2$C+YrYqs`R<y(3z6^FjGS80+!88heR(v7jiV_RLQ90QVM4<m
znf0x0dhQ2Ou$$7jWV$+#vMZq^F}2k%$S3yBARAqy{6rYdT74(EUM21NqPwz<i5efH
zsd5@f04xFxl9aAf^kX_v^8ULsyzwf>umV;Mv&vZu@43>Z1!x_W+OHgY`Pts#(_xH^
z>5kNgXtJ;nu+OY9f78*H!PHvEC!=+J6Ge}eT>?IcIad~wF3TeIbUS{~u`-#G&LC(I
z+Y=hK{shhd2XorDe^tnel-2|8MpGH=><{Fb)pyh>&pkK>=Mg!t65qzz2g)@%%44i$
zJa2urL2MLFI8mKBy6q@-pVKx=P=#HKx1FGi(kNH|a2ssXS^DZ)GM%Gp>@gr;i|Rna
zJ%_cer;u>d_H}T%bF<eX9`@nE*t;0a;L~#H?lJlDgY_nttxA;0Q1c%NP4VUu(@L-0
zq&^kb@v>*s7$hPRG|kO?rd17-j(E_o-8Suj=L0T*z|DqmIR<XriYNrLnbnA`Hx?hn
zy3q)Y&NKV^VmPzKO;HeRIPs|*bP6gH-oCyG<za9O9qs#fk_C>!s#%?WBeI@LAwO!U
z0F#hM2PtrW_f_Kl<R+AKpjkf$e}4DhWgW<cJnWNJv|9*>(XKFUfOGSA^Fy?3d-KfT
zAc~@P$I4Rwq4)=-&i>)`ueZ;$3LCH#hHmVvDtQ>A+W%R%F0v1%mxfdaPvL-2gkDLo
z4Fgl5(pWy*(TUSjq%^AU8J{8k)2fd6XV)p;^_gsYklyaOr&zLnZ%e#VJ$0KJKcD=g
zw{=35P)z%haGDh{a00S`nGw^MfZh5v#8Mqh-L~BMjP49G)jSdrXW016xT?tmd&w~D
z-mnQB;1=sy<vEWM)*XyXuIV!Vc?V=DlTgXTCCyi#JrQ|;Rj|axDB28G#lT@?^(JLr
zA|LQ0*?<gCZTyxMHl*K7wDL`rVarzGz(m;W8U+%*91sMD)l%C*(h2kbIY!n2ck(tZ
zf%BJ(ipZP)UeOO_Fjut;oGdo+g&uS})(bGJJ%YQq1myaR+0(Q=CeFJ7_W=|ykjxtB
zW}en#Suj&u%S%s9#3p<j4qbgSG7A;=B)6Y$08g3Z?A4M3`nLL79{*ot*HJIyGQQr7
ztpW=%%EjQ{7_+gLZIqUSukVekt7qF!C^7b1ZWe`Ld&3IHqD9!}IZtRJu$V?)7^z<k
zH?R#S8><MlspLD^*MBZTXxgw9ri;l;_vklSXukIXiGMlT;>Lw4@I|(z((i$GIGV7y
z7qAxyW){00f>7paosF(M2R0Vh_H0oW$_~HV8nC^XTX8ljhR+FNuCL1cePcjWez*^W
z7y%(t4*y`@kh0HR49Z-<J0JapSz^cRYscc5FT84izJUz`zMo9UZUlq+m<+bX7SX$(
zJ!W4V0HZ;3zL*5nV}wad*5~2=S9^+7r~me?9x&ETEtvn{E(!M#95C>B_KCmfIxH22
zHNC<F&oTW=;2|;0gnX$o80yoSc9<7ms*StLf>j*Oeyd1h-mNHqrQWosI3(Ff@sgq)
zc<_3fM7Au%Ldi_<MS|KQ())UsMA22{V4<{xP{*OhU=n6vFa9hVGNXAV!K<>O?(nUA
z39W5mV`_zts>^d@L$nQcVpgF$EAGFR_wU#h_7zsSvIO?x;;Z}L^D1dX)Gd_fWRR%<
z2h`dq&VLd@?YBS$L0(~@I9<cQ^$U0b@Q{O4V4lz3S97vGCt(fzQ2FY;5jE``qcu)Y
zLo4@Tr&6tUCEp^_Kjm`iroIN@0IH&!u+URU(pPtH2NljUdAi*ej!X7ye?S(U>Wm0e
z(~9<A>y1V(8HK`90mHR1kYQ+>074#TZUF^S%i90)C-U7uS3c;9mlW0M848UuC@d>1
z@S{FEy~=N|CQv}ebTD4jij(D1DqhPwVyVG{!Yz{KEaxa5wp#O*4&+lQ&xOVJ_ni%f
zN2*^Btj#1i0ldH}y^2ZEdSs>v`mw9+uINvsKX6SFvL8*UIx0Uv;+#j8fWF%j{~>xO
zQFJ{G*y2RFc1F!YLW}Yr;jxwL21+B5AzUh*)$`a@1%EH4V%`49A6C32Ds!;bH$p|$
z+;S~#Jyr(mt%eD~J_~q2>sUk32?yI?7SN$bM^-n&q4^g_xY$v3%5F0cEu!pXe_U`H
z(pwLUwi>^jdDQqOyORP@W7`xiqm#H*z92~xPIL!sHEuqLsq?F%zK)x_OxL$Qe3<~U
z@%qQUldz<Zt|6OexrvOd=kv0UfJhKWFzoPU8!;QZRk263?-sm@tUD`IQxUA!`-h10
z_rSkp^>DXO<ju0P8QR6nVhwR`Q`*VH@Gb5dA~ISn8{f8?RezlgxmDWQ_bXMw5ULNZ
z@E=TX$-PT3tF2b~7#G^`FU89GeSgDtvVo)g3@FgQ^>#Z02B;Broq&;CuK$h~esWfZ
z78MmWxF1YU0zyR@V7yvT15gCJZ6)bIyu$=@RTd<5tMVRmyw)Rp%t5Co*D|%9$IF83
z5A%?-cl#GW@q?ZPsBG@`t;2j>#x*iFyjO46^$cRI*Oz^dD>t?u8M?j%KJEl&JGSmY
z1hKY?AEHZC&s6o|P_J+(g>`3$EKBOty-(XF;;JOF^P)HZ^EqD)LIaeJ%5m2F*4oX7
zO$+;1JnViaAyi5^Pxm`8w)%-DSz<KA3$;$L@*ZVE*TbCSV*7wo_<Z-J6M9=@C``Yl
zGrG~1@_3tusEMV8NXnvL_dE9WvLq>*$_iG!l|++j#upJIE_WN<3iibi_`=e|;JX<h
z2X#fxw{J8`NPdV*%>9^KKesW~o$B#!bs6wFpKr9gebT_h#Jm(8SVcfN^=kFa&CRCB
z?7gLc7O$Sr;`(?c=PgNZiTYo9!}upa3&+v8wO?Lc1$ZI>@Xsa09O23Ha4qxep%g|T
z<T2^+L(q|S{C5e{t18as)!-!GlZA_ayWXpM=48AEO@2;MKRAyrPk!SR127Tb{1cH=
zvVd$kc&<X?_?24mQJ(YKI;Y_|Sbfep`>b%0k97Wldi<}<8G=D&1k7f-6uo=|7;6=o
zZFfg)27MFd6u(R075@$K0~32KUts5R{=IV`y&04hO+d_J>Rj`=46zGp1s%uIklhA;
zb$Pe<*iYxzn?YZ`#GHE>Sx=gAMs=7KdhiqS9KB~jGAFlENRZ92Jer@Xx(TiPVW9kQ
zx@m?G`q_1xGWUYvJZw_bAH7dV-n=nhG^*wbhnZ3p8TsKGudXrY1x73DEBT)f+k{P7
z!Aa*I!DG&`;O&_G?j6hNkyC*koN;GHhtWZCL#7Bx^2nZ#V72~danHTU<-j?vMb8OO
zd%Im=E)V}l+*`j@^?YH&2P8!SK|w-7rCTH<1ys88PzOZ1ySpWolvYZ*4k;y4lG1Sq
z>F$mL?;Jnh=eeH$;Kd*0V(&eB&&*nD)~s3UzMt%MAnESeDS$MuhYW4$ZBpNvgEf<d
zW|70W4&iGjwWmw3p<PGto<oI;xVMF+np0~ltsKr-p52QTYNyJvYS-3Sh=YdD-+!Of
zb7p%n>s<=ka=2e~z<F@*<%pp_op^`l@c8`&a|yF+x~lf%Eh?5yP<l`uS{^)^`_oxx
zs1{ZyB(KEG65QX*Lp00iwJt#|g926Z=+&94d`cKg(hkjKO7y*H+@Na8XgO!Ce&Dcf
z`aX3I#9XY$N?U%Xiah2?5CdSCJ1-NAt*#pAZ9{XOQT1N+oTu?AZ(?8O%33RS`JB1>
zo(0*#Usa3x^RRYx1e5A(g&Imo(X(D<p0_g$n~EHLA;y??Ye}xv4`9(4+k_<y_&8H#
zBD6|nOfxdi`P{EAGH)-4hx>il*;%Nb_^y8qRVZ)n%M@PuaXhe@K;1;T$W0Wybv+Fr
z;6=5i;|}S4(|de>fBWJQscNf!2D@G))r?M<qn6*RbZd+ky@@{gb+rr%TXn*9CSD2$
zdQiiWzW%#>y>bn}qozKfA98RFfYNm*c4q2vS-LJ<`s+Q)!D2zcJ*;NVL?!jU5-;#(
zt|~~@vsFL4m2uDdTXgbzp`l|mpfs1`#^B7U3@X*@j>t$vCh!hPk4P|xa%R~>3*`Us
zp5+oF*55PDm2x2tN++9g?R;nx5VnX7?(C|tWE8PveGX!Xn-o4m_<@$qcY)$kHkRw?
zH3y#XeO)qES~<?YBctj!CYuZ-0DW+j=IXO7d%>Xj-S;-o4ui;z)r+iTJGs5+K%;Q9
znYbg}Urit6^UcS%xoO@~b}x<QiP0>CY1*3;7MTy@q}ba@@z>k`nV(+MUctoEjjmFx
zw~O}1s!Ta7E0_w(j(jg5O}#)DkOr9f7~=Uh?zBrL@EL|j2>i{+^7qu=Z4h0UO!B-t
zEOr^6Peeo|fJvLqZ!BD7-kJj~#eexEqh-uwl>NQV-(;*+IBn@l!|-dpl{YE2O()|5
z_pD8m#e~n4(%Qdz&~U(uk~y+O$aJ55<cxX@D-P3Z0r)eS?}FQ<rt5X7V%djfkg9ne
z_{X}#SSd63-5gm#g(y%TmIzN==-15*i~RV48SHgvmbVIT&`_0>_rdi+?ewb&qUL!g
z*WIY#v>C-W2NaBsyI-#ho0id^F1Xu_x=3-KjdL?;5&<?jW4tSeq^!f$X^>c3w)}Q5
zcDTT;PT^pgkib5!YyIY}^CLuhPlg?{<jEscV%tB$ic9Uha$isyT7;mcFkcmNX2Dy!
z+G}YMiEcd`RaG48`tBS4g$P1>YAQp0wajwL_TZ#wde2Euv7I-*_H9Dh9Kq%uibB;1
zAfM!+Qmj!qvu5e+hu@tX?hjI2&>*K7_O|0BXSfLyTbS}uWrHFy`)PQ2n{j^d?`0oP
z2)2uMUY>ApWx`d1nNC==$cuc+b?IY>Oy*JeR_0?|Vi|QIj_$Ld65#ewCN-M+a+D9<
zee6ooT6V8aMKt^DbH>K`%_#O=;iFuaug&6nOdZmhrM!=NwUDej1$!x&c^&g^?KXJt
zWU0AaY{~sfIctOkX9{XcW-II&C~cnw(3<VaSsKx%Cnu_NAWI(^-z0c{%{)-kq}(>X
zs5gd8+`}_>FhBe;on%9n$XZsmO<v*b(V?T)!lv62o7i!Y_IchY=qxaJNn*`d8|)KS
z6AOv6jMjWzWQ7BEb`@+vMRW33gYuv;at#Y2X)?3-QzY0cVa!1*N&Dn!cvyDwfRpm8
z7}Wxy#0TiRw0nn-(-JW<=viP`KV{-}`@O>=%!_0ge5(wZy1k!q&F8#L{1sMir7PLE
zE&JhtwvhA+=1fv~fFpT4b4;t#Au3c_35iOKtW*<!h=FUFYpM252CroqwlWihVN&Bo
zSn3h35nkDlHv<T3)$-*}WG^Zeb;C%Aro#dO>p*Ty<J!n5ZiLcn-E9_F5Ve!ck9Og)
zrZ-~I(qSryPm{g?l<_!aqA`!;Enxo89Bm_Ay!(EbF^ipv0ym3Uvz-ce-Xc?`HshDR
zM#sH!x<1@+j8S0?WsBbBF9H(V(I;&p&Y(*2!>f`lCeh6>f#s=nh8jYB^at*1+M5AL
zP~ZOzU&2#4^PAJ#(cAAku^d6BKJNJH^A51DB2nj)6Wmj{s)&=H*et!*^}~)b-i#TP
z!*cwkEA<QtE8Ke{YA!jM{OW@_J8M3>YZ^fUtZBaou>mN&hk)R>Cs$T}X5lpMLvKmP
ze2omH-KLo+x~3)>*y10UuW1IPT}m_7n<?q2rJNW_4Zd1)fc@A^RU5y4%4{KUa|P=5
z8d_S}{D*sA9Y)YFo#9=}U(kv_YdxeS$~Y8@^hRN_QD<At-JI5z!80do+j%8)kE<(g
zstc%9z2A-wBq;VM?Py)7BUMD?@isnD5BG)=9hP~aPuPissL$S3`JN7L)}*(Hy4m1J
zc(~nyJhBbbYyu5f(iu10@x(J;T7MAEa}w;a_J+|ip$fE>yk8N?#2{RCdCn6d_v^j>
zs~nDo2Ch3*S?Q%G8@uAk-k2=Iye}^-cAUBz@D|RS3b1G4Y<bnhu>C6!)=_8E1+DDl
z>3)I$`<8))aI_f3r<M=6u2B3QitzI8IU?_V-nyLcdqZ~KOdNRsHovPWr7-B5DSh^P
zBt<()wGyDn01~c7{wD!s8+4ntPGH=54gDq!8OqY)Or{#w)X&hs4VPDi1_u%2e!f@k
zXsLYv<5jM8e4s+OeWeI_BK_Cb-Ghu2R}V1gu}+&<OB~<V%eskQXM2aKy!zdsys_Z1
zD?gXrI!iKb+eq*}V3XkB^~f0Rvsyx1w_g;SM>rK>Z};2>JuM8))NaC80>oAh{{|9_
z`>IOj_`h(wKIqbXLl++0lp)c|L9=-8zzYyX6vr6S_L7L^#19kG>gF33I^YVEA~B#n
zIvNF|WiyYJYGpL%^iwu<SNy`FR;U+nWuY~1cj_nNkv@Y_!^Ou^oT~Hm%M!KJm1a-q
zgzi|_3i%RMVpnVQA*h|lITYbtM5u!XT;qt>Uldo8*87gSLSn<U!mA5P--bmmuF^1a
zRNk|`oRrWR!^W;A^A>s#Z<}hGC+}$y7-TrcWE>|!E{lx3b~sXC8q0j6)o<2Ki$C}2
zQfoY-@itvO54DZ_!Dc3(??gyjycGxL@0d-mx5MA8GWtGVz{>4|`dUd{1jTTk`EL4X
z#yRz$T&e|`jj7>hUgqS@i%=Oo%NZ*4rNSj*t1O;)8iccGIk14Zi4*l&I+u$5DhreE
z`EG(oCHCcwQ=$i1K}c4bh5a6(35ej36k6X#3PSiytZ33`KqXL%>Ng#Z`K){R4`vB3
z{lsi2&pZ70vZNk=d>>fsc<B#$JbSO(;d|W0x=xYkh*%aS-Ai-weg2_`Hc*x7;1}6G
zM-4kkJ{Q#SJdd6-YPeMTQD6j#Y!*J}55RcLig;dAd5cOYo$G2-divnbgmQdS@oeJV
z<`iiHl0=*!B9+&>LYLKo7ntpLKQS$STSjnxj*$K(;)^W(gqew94rM)Zg>Oe2kJyS8
zG<rMVW#>!z>n_fpn>N8rzG5x3$49u>Ic57sO4bP!inHu7TqzSJjD_;~x9Z+K0*>SX
zMoW2+gl?3Q34DoB#qs_i-N?mKg<&iOdH)}?%fH`hWJDj&L*1eGt_H}l!oPhRT{V7{
zdew+|NY1wKti8ki^4sT#hY1p?Q+F@!r9eNVfDQP9_fOAX_b_3l2ks48{Gpf|r!Of%
zoS|AwWr9sy==O~Tr^Y62rStGvUVW_(niJ-NY~jw#?zZ|Y_AUH}7G?2|*IFC7cJ?tZ
zZ8*}zah^xjnbqaQ^o9;=_Jv>H9W_v&p)Wz)?Mgh)N6^=puG!esxz3U8;k4jQ)hjSx
zVeEE@rx=1r{YdVnQX-1ktXIv-v$7hLe#-=4-kDnu<OoS{e!6D-6?&*w2n#p6H=Ppn
zpj{YOiLgY~A661uQcyWWs;?l|l4tlXGraPAo8dL1a3$eWj(gfGj-P&(1WDg_S>aa4
zo1)o&IV&--j8}!TqV9u)C*ya$1Vw_zBjPWI$ocP*RYV@{$4&^gcQh<psztc0m}}N4
zxE?SZ%DAf}9>y^law(d=QO$4`Ep8<23zKM;Iodi5Hd`i6XfaMGXjBr_7P`x*8qT`S
zovRgS86;oYwYJi7GjZFXr6K<Y79&G!{dS~z#Z_hHsef?ISEi1NH0P$gaLM`K;GB{(
zisEMk{2Alz6v#IGh^g1Sp4vlcsV>Y77ZmnQp(^1eV`EXz(<LQcX1*YKl*7bv%g>gw
zCVP{{l=Qj#(NTZ(p%KgcP>M@>rPr#j>VQYcQk%^Mx0;8>vt`L<lLV9D+(YzDRb%p{
z&(3+>q<+IbPH%tu+*sW~r!R$+ZzmSrZ<pzb7b=W=?x(tT7}M*hp&cn5P<uI)YsK~J
zGb1TN#NIJ8nY48ULQ;PD_ov8?#zpMkk0&gNDRoS(wao9gQF*5xLoaStr{WP<AUP##
zUVo1T13Ha%vBz^q%vxhd8ToND2^LJ-pQGvCO0IQ6Li!=X>;XrDashJF2y<ik#_L=y
zHNyL?SLxK~V7GVVOzwATm6_2Nld$#1%O%SC+6DcJKBK7~`Jik5qP;L`VN-u|?LHQ4
zuG8YG0hv6$`x*gZALzJtRt;H=?g-xP`Vju(hh3Qh^9UR=I==hTb-0=C{%hCHO_@;b
z4l!-&?L12zSA>4u@yuviXId`WtPm)WCK+Bv1#X^o&nfYr{vot}>dH`2ANuH|-+P8C
zen2nH<gstVi@euk;eY)9d^y|fODx>!BxzQQG?yPcb;&>UeNImvexD}OUU@k_R~H@|
zXGcz&`*AIs1%g{S<njIYNBWQa;(;<3m4W>Gn%DK;b3EV5YT;tz{j4n>o_^VFC6k2p
zxpF^ZL*3^QjET*i>ZqXEzJd4b^N%1EB;Z5O_%^0T#XIgF6qsD9`&UEPeOk?ByVpb2
zxZwPGfJ}MxO3v6UkF`k6FO{n>@z6JSo~Tmh3au@#yq#neU-zgs^?C3P1u^NnA|yTp
z>P@M0P>Ek1mu7`~^p?}>*)J92Fj!AlzCjk=YBV3b>f7QANDdq$F>gVk@)(I8ONgrJ
z+{m~wCA17@o6=Kh&W(=K?HbhUday5h@-QU2ZrCR1u|E!1nWn2_dD3+Ga#ryqYpp`9
zbjVqvvF6yS%akt<>aD%&$i2r<zn26Eyr)U&0&*~3wF_^4YI#7Ftws8aD*<-mjlz!!
zU>(nuyO;=2C3^39V(9MPb;BnT%Dg2cwDv&hf-zs9U1h)4_o`O2ts7QIk`?IMxb(z1
z1?^L!<6Q<8=nCFpBMR$rV@Q&kZQSrC(lQhN%wm)O?61~tCEd8~uBVW12sqLF3<wl#
zi*w`?TY6OcTK?7rZLBx=+x^RswO6!ezx+F}^|E<MX0Uqr`<jFexfAQ%?TZT)=(=$3
zmaK8Hsg%Y+xpLy-78>;)mFISade<Nb<Ak45Qxx2Y{!q(xwtOLMXnZ*eTSw?b@gYj3
zU=7#=h$Xf_>f&8zZwVnhb0}kfz4UnA?Ar_*dE>-}QgqK;XHRC1d+O-4XP>t(^BVPE
zbSF2_KH*D$`B&Ux>6;9P##jaMcIx;hc~3!<ohL_Phwvg)ZYB7KgT|O9ZD}yPA!=4b
zua>Q!5v+^mSqR!=?JvsPr2^rpaa_*~v@xfm-rW&n-G}3h=Fkj<AFl-3j8NlN(!oMT
z+TIbAJ{VvW#ib$A!SYtn>c%r<Y+Gc@K7`@oR95=&X8Q}Ul#DiO42a%dzhr;j{SMZg
zd&+M?_yIfpX|yrZ_`#(cp{NjU_=T4LD)puez=sU|okT{xv~Jn;8g|hCFc?lRVD3(`
z<}ViIk41>mo6Ef5YVtQd#BX?Ku5v4RET8z6@p83J>Xdhn)<Y@j#M}(T%4jpZn~LKD
zo$X9#uypil@wsC7&MI+A+u{a(6^MET&v>XDy|?^W7FFkIv=5zODP5ZS$}7%(;l7x|
z^fJDx7u|?_T_N-D!X87-?&?<F>|+o~H?!ahOpqorS|Nd0GDTGUqKzmtKP5c}4pE6f
z$m196vJ4oR>nUg<?h5;O$@$O-&nR?U%`hAJk@J49rxAaBntd72MCkv1lo-@;%6<m;
z!j?Hjiu<>@OCsFAe61@pt_y}+mH$k3R629V^By>AYbw~%sh;RPYiO(RN^49G$v3Ah
z&3l=E(fYYgxGy66ICCI)lmbHmV?{#G-X(2W#P({oMg9`xTkY0d5KOUo4^W#u>vY-p
z;Cm)#dG-uq>|4jur|<~m-sNG=a<~X>M|cNNNg=(nL3$(`Ky(l;kM1WmU06aR0T5~8
zV(cU|>_+yc^l{MgST?Q#aMT3IHP^63?B2p!T0=Qa)a1x&Vy(p{<mWP8Ql`U&c7<X+
z=8Zg=wQBN=haQNz*-{LZe86;9(P}D*`GIa`Mcgz)3(k>G?3nQ!8S0*XUwjp-arJI?
zT8|}<=YA;xIU5h&M%S>L6^syX2M6uAlWL(hf6O|7w_MGdAa?~sWOnvil09?`VZ*%5
z0oAsHTimtO!X?QJ4*+EANI+>dD+i%KjY3QoV&pKXS9msh3LHdG28O9<GkKDCXfZ;~
zE6(LIBvFTpszh^a8G|qD3473`&+UxICVW%_fdeRNLlE-VbuOSxE3euV&w|Y<c#No?
zrXe2L^z0;WWNGI8!lVjbW{EYcu%P+t2IJx1_#DS|AF`v&vC=iv?zWU6=v_>no~=?@
zf6HTW<KRi78tw0l3pRS&J5gHRNQf_=03!v53Vjf#me)`FPPu#6di%0Qq`?VF-{ahb
zN|5o}_p&4nWU~~tf0*$u3B}9<SBSkPnVYx)Z|uwZ^-G$>1U==*;P~?HMy?YQ(+5SI
zIOK00>e7ACn0WU6y|tUANXQPuxl8^>j=Tk?dWp#i<WBV;7YebO$00Azeor(7Tau7R
zTMyzBFvpfA2$igz;=*L+J1+d0ZM7(h<d3U_tb2~E%{jH}Bi6OK)~s*7zBC45X_MCt
z<CS1gCwjr);+bC*t%O`9?fC4>a0d<2g5i{C``fS#OBn0V|MEG@3U$&o{;q&}#hZ)W
zcgaLz{a9e?i7VCm$11C)$N+fhZ*iB#=XU9TTN}1QxwW&|bAB?`Gk5R(h)rP%&pUH@
zySgJ>s?&YL9v)Cs%<|)45$kJGL~u=FN>Sb>!RAv#45!MLE9gg;yIl(1I<=AbIeTOM
z;ucwm)s$khE2u)PGy)ul{$ATxNqI5zgM$0{Y*~`_anZ=Lb@6F8!$eX{ST)HH^DoTv
z%qF}B4~R8>v;Sn?|HV4p-X@x)>mW@|x@?F7-xtx6vZ5^Set;KPAte{o7)RAJAV;4Y
z4DGB>p78Jww#o>lKLFw-CkWC<L3ZTlFM18COW9#=HZkRAE>QvJF}87>KVlP0jI*f$
zECHLE&4$9;`I(ccdSO9dTbDfr=6Tt+S@8ug(WP7;n&q8cVtP^s*}(9kC2Bq2d~!U}
z{I;_&ORk8b_%ks!@d>$~9c|*7`$0Qn^n~lKrfZ(}M?EgY^eL6@kiqdgh$(1-%E$n`
za`6MNy&M;tdnChWK~o(s=^M_pyYUGwb9<6`P?@6Ix~vr-{qFKQ%WAIi)vU)>iMcLK
z<kN2a)Hy>fEv@gqN9t?81<kbv$JWC=b=!_u9RL)qdY6fD?)LD*>CX^Ah?^%`wQ4(a
z@6E%k%gfe#RXh(&lE?#gb`&-ewUQ!q(|#F*ZmicE8|52{6)K$aadTF@nAO8!Y5D5f
zxnJ;QSnY@x>kaaHy3Hl>(|+LeBXWY^EsyX>*<d4<#16fpKeNG{xs?>y6~%};2S(hk
zQ3mVxo-U1X<cDJ?9EcB3ShUN^Mr2uc=WJ<9^kZ3bqgc*(48_KiAN)D&U?dr?^qrD0
zA~KP+=x;k%(s$~M#DZF^wxzc>>IShrk#ve|dpcgpC33pNv)%iRSHG8oV(sv1)xM@b
zlt!c@;&D&syl%GV0mVq-d{ul%@~Y2<SzM^f+!1F5>(cy1eX30Z6RHxLA>Nkhz5vNq
zEb_5wqh{H0-`y&aI(DeFA?;QNfDtyaGwGkNBMZA~yAijL)^fVcgL^cFx;<jUmRUq3
zs*&v4C>YzAhds+DUaaGjRVB90`+dUg^EtUzjXxOE^f!?k%pyAC<;qIKWHpVR6s9Jo
zIkZnCmNz7~yakGGLV*7;nk~mcc$SFNx0eyx<x<%aUiJJNud+oMq76xMcP({#=M6X&
zPkun8AIT5fJH~BJP7IzxZZSpkHp&@zzA(YyH1@H#=MuhHj;qFGqWSZL-!7}>Z{tBH
z#Ryw1>n-)&gQ$YDv^4=-uOVZ!iH;?ri&6mh`N&dvfHv&uayp19vn<%dTAQ3o+C_(R
zEelP*HA~{#;7Hl_Nk0ErIupZRHvwouHsSV>=Tn-Kp;R7b#+eREkB8~~H9^32L*2bc
z-T!qC9pzIdL)i^gx3*<=d^P+WosH)rr?{S|vgj*Hqd2AFYi6HKzoU<to*j*G3^#c~
zuOu5Tj8(r>5G*Gh9ZW+F$FV1bB<bv@016S838%@}e4TlJ%FU5#Q_NYO@olB-f*pgx
z{BFnwJZ#s1K<pF$v|Mk4NF6`FSnLkhs&K4_qoYK!Cq-M$!Yaw4xirQ*!Z(q6j2&Ni
z@mb#(A+0tZ)geR@ReX1M25|J>PCWW4?ot=mQx!^zZI|knWw#wt8tnL++!Yq66BXVS
zP|UUUdg7u%qhlKkw=mn)B~;O{=J-Xu02w!W4FH+Lv-npO4*6(M=eRa-$v<*c*6dMV
ze{fc+_d{cVc7`@U#_a8}#CqJL!l2g}GHpygZ&XVcKz6YZ;*qAVaz5_Yhhh&2kq<*_
zR7Ap9R-d(<T+&e@KmvH})5k3R%lGYx2_J`_0fg0}UrhINqF%huv}DW#!O@8|^^696
zyM6$~H;iIJzFuCWTX6xnyrW$J*<(>aF6ej%u+Az_pV6_Os&k01FtHen5xn2N&o@)9
z5*lAs>~GXesN?*^H!c%(T6nSMqgw=*)}qJX{gm&n{UzzAv$TN^fW-!w;K`?b0K;Y^
zMOTU<+2CROxhkIDie2-_vy@!8kc)K#ws~Vg*GXDSv*o=U%S08tp)v~BxN7F72fH@9
z>2_&IPdxhvrJ0-_s&U=P^FQpYJeeaZu6X|l)To6ZSwDQu)DXMSpI^GZA8f=II`yj_
zt0I5PwU+wr*0LHe<5td1a|lDCDqtj<U3clhZh*z4P-ft@{ap&Nw4plCq|&FapP%&T
zc^k8Vy)_UBP+&`+gSf<w{$t0Vsx3$aY3AYdM4tI#=1qUgm)&#Go0#KGi`%kv2M3Q+
za0(0)biW{FUk{NW^g;lz4TrSyeD9;wjj3mn8mBG#=~te%K8}~3w(hb|R`-xCx3<V$
zo(6)2n_6bMGB<wLpCgL-n(C>;N4d9Kw=$$^=(OhNmicLw4ox%zLe#Hp1#hntmbT|L
zal>InyJs~=Nk=DEk2p3OD~M<_0bQrY;gu#h0K;{^MW8@_v=eFttjC(zzYmu>RtRzM
zA0Ep9m_R8HQGGqwo@QJAqW7u))rjb9MHLCJx(^qDuX?Wf1QRm;7Yv}z;u=5NdlVxI
zm_}GOauhhemrA~lGJe~9vnRmDpf8*LU0#S{8m)!JSx@Q+9>93<-h|fEg055Kc0JpC
z+^yp8uk-F+ScbmF*x7T(PP(L=q;zKuP?-^Bl8B5-z2PJ&>imEcrlnsBP2O=XZ6E*%
zcuwD9L(a!!<etkt>LNA=#M`+RKPnb(!h8_8Bc@(I1leM66L@hWJtZCww@lu5%`&Hq
znAFbYc3#rPIiMxnwH6$BH&e2>k#ke}d{>^B=B~?;ya*rPIoiN4zUpuVZ5P$@9~;x9
zvOyi&c5~6?*R325aEsaWOPtkN(}0FOhPlrZB@_jw#R+jhGOXYaO*;HviW}B6oGqDG
z@4KtI0w~st%NlDuh9{ymqEBFB;V6`LqlLa+cEz%(if8E_KQYY{U#WOYK?yX8)-<V&
zd5I3+%#FuY4T}7z^P8;$X!;5=&2sfmjL1AesY5Q4X@O;hxi%mMsL3(bytBp5?%eT`
z?Q%?7;!paNH03jSM=1nxc37=WsbVp0W<<d@hXzfjLNy~!U`@EqIrhleF=lCfr5e8a
z<m`s$qD4{jS3=+D_DRo?hfD5+ospk*NuTA#?yG+vVK_g9Z}%8Xgz1vSry0SLI_20p
zea<Fn0kAAcFd{1MxdpNucRYG~b_<fgrf?dQlOEv6E)kv7DY|OAGu)RxyZn^@D#!Zy
zfy>CGw8U^1Cb~wNDo1Bqmi4z((-|^@aM=r8P=oo(dDa|`R3cvF=y12?D=i=~`bkpR
zX+@~_$=P$$_9H<$+=}am?IeCn*F=+J*9FnVk}FcL*@^96+M{@#+uod0C!J`l3GmJF
zV*o(0M?lL#7nP^gn0>L4X{&EBibi3m8g6{|regy@nIwINYBr?cuK2vwCNZ@YG{570
z5={==`YJKtEAJ@u!Xj)oh`ngpu5@0_ID2y5qg$ISXNw9iyPa+MAq<T~<q;YR9Z<A<
z0&8%Z8yAOBUTA6Vj*G}kHAEDNQI~`!_tX^I*_NqvB<9&^rxmB+qqds1?HieRZ#yN!
z8cR%_7h5d?QQ>j=ygsD3U?k;4Gj5vZQ3MnUU<831&Ik6yUkE#&_a!dQjytCa<99k!
z1Chz&nFq9CAfI#zo%CTHYnTC<=Vn1ZJ-Bk@j|nxRk8~z6As~sS{cQ6Ooe0=U=dK8M
zkVFKI&-#Lhf}oU(94ENVvCRy9?5ANz;URUMt0+=8RB4hsX73~^%*%f406_4tfoHye
zWM^{jg}<DQKV&ve%-!F1>9c}dd6{_OQN2&)?bg6RqJ|%QeqY04M<e*n&(qr|F9_VA
zWnITr$8|z#LRxg+ateuQc>0?5dR0HM8r+O}SGB5kA0Enc@AE>rR7}}K#sv3h`fL=x
za9W}YbWt}&W`YtkhD<L9ft7e*a66MP0L~VdY7cqvlpvmADHyDOO*x~9@tTh0$pc8G
zzUzODnLak;P3V}w{K1AI#sV{R401170VIYj17*<-!5->UO%zZg66wdOgDgLv=r3sD
z{E@o=xP1Qi>iD$`Pn)p{Q0hL58os`?#ku)pvTsDjf@3v;Y<N|*IX}UQi+Vpmbm=@;
z>WYYPPX`EDsE_ahknqW5IV^oPWiIx{oMD_lw2-0pj{m3WAVAJzIQCv2kU12V7y*YO
z`hcP}nao7W(8crr-ea2S?J~wS^9X!Cid%-9o0>IerK2&!>;V8?|L?WqeGweZbv*(k
zy_0~&@EK~pU?6Wi`OEV8!BWK7ptJeZqB9{MMmnnQ473B~u4CzbwF4jdH<W;Gn~Pg~
z;%w_Z$o8+z{rN^~sGz3lcVtvHK+NvKE82ah4`NckBcq>5#^jma#j^~nDij-@qGF7S
zzx7#`8a%RD%FczgIBfoA$Uow>mH}@VCuKDP)$$kWT}>zv1{tQEa$I^3Ts%>4$XR%!
zHS?HKu2;llPZ*GtP1o^oK0_Z`2I;D%QEM>dVb#cd{qgXJcU|5wA}Kf5f-yW9Et`uG
z!&7VNNqy_<W1S04nl{oVPC|#vaT~j#R5n7lmzo(#r48%fQ0dj)ue8r0+y4n6P=vfl
znIJu>UXt>#@(6Q&LcIqD1RChuDlaIo5-t8svB~NFdr+HYl!DqI$1CAhB**SZ|B3)v
z=`IW{B!&#3Bdp!gPkuamEDCqb8{$jnUg{Y11C=eJ`hB2UQH}#OCzwtp?+J2$>JhQ3
zBdpD*h-%^@xx6d1cs#(Pq)7!_omN8s&)rYpCj=2J0iGk3IG(LH2Km$xft|@>Kng*Y
zYy{~MnEDX{)R1APQ?0=nNq2GZwS&^xS?i*yBh*di4!8{>xwih_`_K})J@$a)*_OJv
zIup1nvm1r9zaKq+Rdl&;m&3_lGMK&_LzJC2|K8sR3pGFo|N49RPeZ;E>APxv+n%#<
ztwR1BAgIZDB5GRS*B@{6a|~E@e2!I+XP9?CgWIt0p}!z{L`7WJGewapGvq|b36Wy+
zjcD_1UF<OYXl>rzYVq(L#raVem26da&Z>3E;M{WwcSY?vw^ftsC<>##?~H7###}(r
z<)T5vhsz|&>mt<`ipL;&U8tGM(hQ>Qc*RW`S=1pYsY=i5%J5`=g50fe>af(0Gr`69
z`h(hsKOMPl?(E)j(|Cl{;3Hfd{h(#f^LWVPcFZ(W*fFvH%zJC7VTRiKQc7<%aCL8c
zM6qbv_+o~W`nlWOuFv{HLy78~?;19Td{xk)<do9fF<bVB<Wp&A9Q|;}qYKMI2apx)
z_*6c^9SUkhAIE`eL!c~oaMUZ`UtQL=q~9D--~N_j>&ALeMCknBz3&x;uSP_LbBf6y
znZy^^;TlBY?>cDSKU$G<_r2h_tz<VH`^oD6sBrpa3*3JC^7~`8*j)KIEDZ6#XG6~<
zhgrY!mYyEpdYxF_sXkElA^h7Mdb9YmA)V#^nc5)8oJ<~zZ=W0~6q)*GwSOO^{(Ni{
zlJhdkbM&d9PQ_j2!sqe*DX+sGCnd2s@57iY%+gc~)Jv5gKg3C{dQP~yW2*JZu4H-9
zwd|z=cMRa|sepZLq#KRK3!jH?2nko>fW97qEcfDn0*3-F1l*R=@aTTBH_vr@pQ_-f
z)}LrIu~pF!er}=fmBU>KlSIC0t7e}bd+sCI$(B|^+H{>9E&Dtt$}#5iIU6CDq<Qs^
zPy0fA{x~vU*3dVy(x%rW2%HhmeIlTz%3ufo%MQLNDEq&${onh<Qr|{DCpsmPy&CEj
zClSjj;pfIfH{?LmHF#T3@~K?YT{4LfIqYx8zY{?{rV-25qx{s6W2j}~;idlCbD!FZ
z&gUf~?1VMYZdrDWOX$LxMX&tYblAMR7BGyx@gzqAM}6EV8kqmR?&s{CbEP+vk2RjN
z;xbqlPso_NxkYI>Q%F;w2|fL!)a-;9ey%2cP1Syv_`oFvv+c8I7(Gtt+w<?b&i9`B
zbXn#BwhJZys?0|>S<UX*=d(4lDszD%MqsUuFd)+*`k<Iv@m2&>)<#DETc!M8(~!S&
z5?_BUba6o4c#Kihs?YML>|-{O6`@$jgUbxE?3O|0K&_x6f3d^YPiQ%tfLw1TY=%PD
zr8EX^y>XHV<nY!mQ8sm?duR`TuG4Hj{?UqjJ;5D-xO~BBP02FLGVCPo6O;c_>B{Ro
zoMA)<b~gQWx-RIiVY}5d|L)Vg|1{4H5Zr1$5nPJo{^wF8zXLYQsLzka<9d{0UMWKH
zOhddg>nUww;y+!aZvLxYg8A?bJ1bUb#XC<V3yatxPZ`-p&(;!_{T@)YCRPhyQ%+4t
zz0_n8<u_Y-);HJ{B$4)wUki0M-IQ25q!$Y#*kzJ5R-A3sv2KwYrvdOcZIYQHl~04t
zm>m;_wA=SITdud^xfV<CPv*vK$h%K@DF$B|&#me=MEe;3A&{#Y?gSP>jgsv+`}7Gg
zi+QBL3F0!5B0QT6d7xDOt_TxkJ>!x%;?V!nDx+0tI;k#8C)?tA^ZbqYn|!h0Dc$E*
zi*Qv1D(&lxx1a9%AMNRSnCsEIs;}@#QLNQxMX6G0`SXcE@3Z&}1`wuZ`vf1JR~1GP
zsH_g%rH(k%$EyTaj%dS8|A+&vU`5fCk&+$>oQ$fXglVK*8Z7Re?bNU{R|56BOYc*Z
zLmrr*8D>j|Z912RLmw8%j7BKjH{=qO`*Qj|qZl*PdZ~&3N2uLoyHK@#kC&1m$-CLI
zzJOeBQJ?jid8w-IPcm+joa8(JVa8`#s(a)UtqAkIwkdV$U+|+SlTl}Wri+wE8O0(Z
zVD}usK<P-9pBtwjVE!Mtz&~61rn~aK<#-t~#<rG3$piOUU>N<;Q<ZQ-HWNv@&VeQP
zPPJArA6MAph_SUqp7Z>4Ub7{*Ewm5+@W3!0d3SJ%6|VvaF{@VR>U&m{4;#sa1gl{r
z*E1~t-8RPovgt}|rB(T`erN<spy8J@bHo;H-|73gpvkl-v!$cCGGNpx{u3?3f6Lfb
zt2QfQ+F>_Oe#5%Vvjj7aov0)P8dk`5#A)qGIIfd?vZ&1P0^e{PHNNow{8BO!u;x9k
ziY^ZId$BhjfYj<0SBtVAm_#?vHeth4PADftq@Jv6vbF=!HTdr%EdlNh&^CW%9L6v;
zkg%ebCyFC0deX^P{M%#X>6k$`vzM0Z6O#AXMh}r65p}@8b)f+CHzxtZ86cSLOy-@e
zN2zP-k~yP783uENT410VPjQ6*h`x)1^(U)o)!L!Ls22YAMRSIO!Gj^TMqUmYFKTx~
z{-R~m!ma4yDgp!GZ1Mcp_3HPi^@8jUjvQ(oIzF-W6}*r4?e{E!ux^)QupY@VW)h}W
z=b<2LjL^l0Cgt(?dhae?35wgx+jE!M&d^6{TWc7ygI!cQOpYUcMuWmh&DZ@cx~dd0
z$R2f4*aunAxVis7Yh9)BPk{wq-2KGd)n;Y;j<$W3hVb2|KW*D*T4lWKhU3;=JkA$h
zmi1om$kssl-JpdS$pj+_fGo%(`?sW<lz`|u*b*2BzbT}|t753661R#Do+AFrYUaDe
zvodRa{pOva`8+`ebr7`H-YAj@c<EaJvGeqw>wxudwTO(h$EkQlRHF69oQe$*e|z%q
zz2mB0vYst1ujyRyRMfiW^#NG3dVn1UWjFsyaj^cIFu!UX`eN33I7Fq)@l~bOkNq^q
zVU+3mLaG#!UL#z1h_xFPGezw)Rx}I%ROb4UF3L5!StC#TaM}^>#3mE6Va5y9H3!gS
z(1ktw;!VM$jz$H6jpzS$&EVhQkduvT6Mou!LJEt&x%YEP&{)}ii$GTe&nN7K^_P?2
z@8d75uf{k;1@)YV-frApY)*V!8x(X@^`<iXQR2r>fTw()rTwX$QFRm~ELJ-pI7cnt
z`fVE&7G}XFzFnWnn_H_+{lQ~w;`VaF*Q~zZCm-2$53dS14a0!MsCM&lv(Z1-_kV7k
zM8Nv*yKBGX5H|~W`U$0O{gp~5roya3iiI_`&8OAXn5#5TY5P+ADoH-wJ)rn>cWXgk
z=%{U|A<btq%Jw@Z3r0&#-=esh<v}mYLF(Z)U508B+;-DM>66_!$v5qyTw&waP;m}f
z+s&W`cX@UF(LJFv7GS6nm%3t5h6@;e;OYZP&wp0*HK7bXvLjF;T&+?+qHSm>=@O6Q
z*T*0lG|U5x2X5rF$gp|vrO}Ig@Tfpb!u00rB;PMo?u)-i6U~|~mPFk)M(=9C?L`Fc
z-EE^uoL9cyRbLgTCHch3{wBC%`{m&zKnBh&><hhUCGM~tD(b7pHe}+s{3aG`_xDTA
zOw(ivmx+F>t5tI{DV}?}!^hB3;Co|r*%AQNA;k3z^piRXDdkM&4(n$8WS9K5IB)9n
z{UNi*MU$=%^Qs7l2#jk^KFeAhm@9qScOx$?k-J-G3mmKdjy*%I2q}<pIHEHLuU@*N
zAE(oS?+I(yU3?uxofGwJdjRn?0Bjsrrc41O);(9$&a&@zelFcl+F`=^&aG`FZhh?i
z0Gu#6!nd)Sy!t{Pdx9t)LNOi^{>FHy9R1u+7ySz(&d1pM-6h*tYOkZ8Glrt?zQcbT
zi;*CK@A_>9XNtxZ{p7SZ&vIj@M8qU7-xU<#yJz@#G&B@~f2JOnh?YyFrbHEmpSqTG
z<{!1PS!AefP2uKfjYT~MqwCGj)bRvAhG??Nj2YYsllqTrS83(8l(+?l*UQOeFImYS
zj;~IxB%A&%wdZM4HC0D%u&=#s-?e<P!$V&&C@+<KcgY^M^u?C#=kkJ!6`$@CO&@9%
z9#OMQ%}dPA>KM^x{dt+2nkTq-rqJGC9d4FI%g<}=+=Xbd`Lnh%FT*#L(F_BAW?nZ_
zBnr+uc`N9^q@|LX2cdilE5^3x!e(>!3YoSeK|y3@)@o92@6Vj}q2Mi(RK{uho|ES1
zzjk}~rs`-HPUZg$!VB=JOlI~ytILkAcds4RlJlE-zV9TDkuXA75?nBm(I>$VA(k|;
zm|D4pU+1H0^eoLzw9AS#hDfW2f`Wb(8uQ6MLX`X2(Jh>5N4w_mZGMm4cj5bjga{p8
zK6yw;e|^*OVBsw1CGA4i#JLGhE5$E;%?lzko`iYiJ0$+HD`O1z_MVJ(`S)ndXpDkL
z<mE(*Pxmpg0{>S?s|D@{Gz}(NHQxj))uzOcqxKSoV;YqwGLO|YLr#NVoormCe*egZ
zX6XAmeqZoPWM^ayJ2(ipRZ^XF;B(D{8nF+|^W)XjJ*%XyUC~uC0AnhpZs$AZN$jIo
zNY`G6rM@ue;fdpyaBkB3g_5j~g$)m4P~8{-DHgMR&0nxtt<SP?$K8t0Yv(>LpV1?o
z!qabj*BQ$qr61z2=3>indw3D%Gq^aZ6HX&U?{f`j_{#LJlJKL1Tx_M1x765d>E*``
zEPm}JG=@l;7q!8p%XIvprkos*@n7TUt%Y<ir4@(L&>N>|PE##~f}3H)L_X_Bne*}L
zR=7CC_;f)!^3{KHVqBN`O+7^bLcDFyNS$M2+4=N@#uG1vZ+9CtiHS}_I#Q)iImE0^
zt%da!ajnWUHR#7G-EVH!dRX}6LD!V;tzx!%Jm^L*9@17s=*ReR@*XjDSmFkaZ@Dq>
z3!2Aash>1kw`RF>V+T^$&mUrjagy+Ve%y!Wck;~`trd&+w`vU8pa*6RoML>yZ|r~^
zOG_}&9j!bAqY^@?{4Q8s6Ss<fmqnsk%dU~Zc9iSUBzmL?s*7>1#D2e|Fu_qrHvjO&
z6UgI!1ARy_1CU-Udj2mWU6hb$E36}QgC;P;yqpVvk6*3E@ogsy%*Ev&QW;qP`)uNF
zbjo+I2WfKY<rbG1l@t;4XnsFYS6*7NL9DdiWnn|Kz7&-;H#jSm+8@_4hrwCa@0%Yv
zBD^4+?BGp?PKO6wNrJb3<+0~{w}&K2>9<xVnr!Mfs>_7;Z-f}+#>*%8<6N8K6v#dL
z6rHBo%74?vT2sVZRueTVICw*V%=1SQ)zJ$XdX%!+r3;iDYzPz(*JV6+!i4zUmnDEg
zz>gmj7+naY+?=vxg&0DS_L>CzO<sZquk{^6EG7hEFfs`k<Iwz~<Y@39kk-6UuTQ^c
zdyQfmEFH3g%Mb`B9XhHZ-UOo<;TlNmJGy^QsZKRGTY{%#{(I_MC@X~Gi!0NAHv-7p
z|L4X^;|OLbgqL+s30$=jn5gUIxeKv+gAO%FIVFWak^}zN@bg&Ayu8A~Gg8Q;L3GQ?
zElcZamGhQ{H6CO#wowpm#Bp?d78AmoY&pB@f;s6mEP1+~9m5VOAHw<IUr>MXmXyu;
zW;0C>Vi3r`F<#3)(SY2+D}R-4*M<w8BKK$IR2TIcn%^##akfG8`?b9cC>$J++=I-m
ztGU)_5Q?F3bWUSFU*tTyk6BmrY_6B(&G*gk2oik$U0_&|$y@UVo@gP3g@vfpWY%(`
zSKhAzuPGgy_LvxE4sV^=Ygt=Y6X&l0J$$LxNfC?<Qmza>?AJFNm{QN~ZgA=5H;W2K
zy4YYYT|ig30?754IZK0HFr+)FphdHGQTsN&Ch@!9QBMJBl^Z6FO*l;Pf2OKRhX<hu
z22++S-9_mr=k0I*JaR~qC|b8U7R}(<0gMU4S>@GgLRk=fr0xGqr#V)73mr0v1BAb|
zPbRpSU^4RaMA)Vl4Xp262h7OdSsX~RxrhO`oIXXNk-t=RqdyYd?&X07G0_$=fE}ew
zu>LUtM@yJl_5guwoD{;J_OGpx20vbg47YEa=6?w<hz94eAovV>;y_wr_t}23zL|cA
zv*FMCs_N<3kvJ5BPrCOSTsqL3KhZPZ8ZQZchTti+zwd42|COk7Rak-%uXW+?EH-5F
zrOJs@iKU(_qbG*!<Dz^{&ge!>9Ah+o%EluIBvppEhaA4r?KorKg=^&hNSd+88x1nD
zss|o)BI?Q8{B6D^86q@~`(9CCBL}@)1=onUXI1tIBpGY%2n~{|fj;HcdIMM<R8ZM%
z4|y}y#2LcWXR(Uk-h?dMN;8`PeAu!?Ti+`LCS*JU4DsaXA+6w89Ii>rX?0nGt<O<v
z@KoZ*Nuf+!qnKB#$>^L+7l_Zj05sS6Co5#@9gus<2ShU~p9#Q`RLe<;Z30Tun{6n)
zkB5SzvI`6E7)lk6A6~y4G!lpUoeX1Cxo6gG78Y&F-q7>xkzG^{&eK9PWKqp1AJS@P
zzJ_#u;s|tjb#uOi2a)?|q63r#0#SX6(l($ZME<O(|6Aj6KA@p~$$NuRy#K46|3}Rs
z5V>%ah6BBp0W*jC`TxHOxpw0uJq-oH9k>HHW=%XA6m3bf?<89R7%J?fx^`kyppx$u
zh{SJ#ZQxe_<<a?6Gz$7#lrN?pWO;Z@18Q(>b`XudbF{W5w$<|@YAzFufdL!nU@?@q
zbMCaJmJL7)DZB#FnO=a_r5Tz9fRv&u;c&RkPZKKctw9&7`R1m+!NG|nIUwCS-oJOO
zB-v{l#!5D?N*fP*B*vYWDCX-jT0Z$*fQnRhNUM|g6=I$phTPQbC2ighMiqnB01WZW
zg0iFA_6gu(U;03j-|FB&iid<jRm0^k<+g!$;{8FDf#Q=v)%6@`n=>=INJsQBDYpht
z1$-%RMkmyNeer7KlE>e2^*5a;gO)W_KCV@&xi#XGwQUVUl9clv;PCV|uVFiSi5UH%
zTWFoSW4*d{Kj+z2_c8tRft}UnxgCh#FFM+_q?YTILqM0(gp#!tu!~}se8STtkRh~-
zs+>6-uWhc@1t8`po=c=H=N*S7w%$c*>gw3=iH7m&9-xX*m)^*q1U`24Q~fp?^H_e+
zui_+rJioDXgW`rTzC`6QSHrZiKYZ!SJcXFs$NIgPD1ghirY2$+D9CfBBA|-9gV)w6
zU4Z6Pc5~|tpiN_oPg@xk>R#2-(OTr0BHfGUtk-AD=)L-#cYAAA>>a!<OktIB>=*T4
z_C|L_Owy-TSJzlGYjE8AbcuRQ=5%eRDs!8uA$e?K>n+#4E%6LO3%DyHXZ4ES<GqU4
z?TYb9jmvb#+9Kya2@-$ItgxRfG58@90PyEwpQ%U{is*^a*1cC}Gxqe!o|~jQ;A+vP
z0xWgoXgle<PWc|qF@QzUc(}A-v+(d!j8{(MwlN0_3h5f9XTa$4K;<a{=;2m{(y5yx
zdFrp3wa>PvRAHubd4(_0Y!WR4hV@a{D&FZ3K3XdgDPA-yX1!GB;~r$eqBSC<Ti~0y
z{~wHji&uz5_o}(;8MPi01ku2%z(|Vq0Nlj4O80cH4UeO^$Tvj;&pbC4Og1n$Ist<y
z7ReRB8Nk=m)+X*PSQ5JHG4Uf&(f4x1+0xHkispJhRJ76SIGeg;9uHNbI=)xS2l~1t
zGyAU48O2VUga8ZS%Bw+l1$X2Y4Ax=`cp+SiYh8&P?y2Oaawyq4rXu3IL~jn9weCaW
zfFUuE_qfw%|7%K?qX}M$C9l4j<;<IZo9R3bHAWF1hJMS#Y%MoV+2=Mivz0=Omu5}m
zTp~_2#(5EsnrJOYDrpdta<<cKA7EF3Mi4Cm_dyxVP0)$G%lKO_<?}8;oU;-{tiXse
zoxM%F&Si&w*g{!y5&`qaE{YLBLN|3joB2M4Lbn%#W%Hhyr||rQY8lTUQ{gS>%4uzj
zxBEc^OxMOfLTB_*C2j$lfeK2$rHO;y`5K$r!Y1d;`!}u&Sf9{|St%?HVt>tRbBd++
z+bMa|UvqM5kseaBLkZuJS4tzuDv;|j9`!+Q)%Lz#qUIp*_!HQJr@tR?n8P4k&^&N8
z2)jLjC4~xa8=iRX4WtY9I+r@82PR%!uZhAmM*)l^HFKO(zomYa%}U&kjBJ)`)0W-}
zKq7o>`L|T<$mjOV*SBfM+^C$~Jq^X?<9ro(9Ig20>I#&NI%DoW*|iHTI32<?I65jt
zZ%xVlMo+zXh*nsDFJEoiHo6MGF)NgGl$J`788`EQpAJlzjVI}s$=4yqD`|)tRu4Ri
zv<@A`r<B$6tz%|c<MgWvDy>uVt%c>?X0}boNA9tXw;-oh`%(#-<T<9ruCO6-vHB&r
zRF32~C@!H(<d0X5E6On*YP0M#dy*4i76`Q2X*aw9vVcIb+{yOs&E9RIG|G2FPU42%
z?(W@``s^ueWx-Y4K#x^5OYuLKqky`NpOE+hQkGZi&8YIw6VHS124~J?o_ZH6u$z^J
z9WiZ^nZH<kj4_@wOPgrz5QE{GhY;S#!a@>3&FtQHeBUvW$hMikE(`D4$J|jbz%@;c
z<r;YbTm3!QpQTf9umAX+jbx%M!K4?XtlgK)s@)s3c5->q@pr1Z2(^QEZDa3Ntpn!f
zGLN*NdARSZgzL+uVoX}gZ&p$?FurimI(+b~YMxt)HBQ;-gPY7B@oSSn;to+9RlEJK
z%#rGGBZ=NU%_aFDs98YiI%B_LmwN1YK6ln!d%bFVV=_zf7f?1iUjT~Rp-W*_82zff
z!{u$v?Rg9}T&_?7mG?d_X5EGeN}5N`&g-FQXa4!Vaw=3?zo>8QgzYr34mO2H=)H}o
zFaLy&vyl+doL!=-!w-QNH~9=Igr$_9|5o&IxQJ*ukGOn%0|w2w9-#93b}!L=_dc!4
z)T^~{1DdVZ;<|P)50<Yn)8lexPr<<$Wf`;(!ftdcnkuSp^zsUv51O{zSe3S3OBB6(
z*8_X;sk7TACk5vyXVCp}BvW7iYI<UPEUVz1JjaxN0ZBiUa?pF%af^cqMU@hd67(|P
zW?&~Y#u28V!u{~f_x9|B4$Y3)xQbxVbM6Q~g#*n#=P57D0T6a7mR$W=n>4<`=$~rQ
zuje@Wkkzl*xcJB!=PHOn=quGe_npX-(B?>a8a&Rnaj>Uo%}adE{c~B~#v$%-4PaBO
z1ao*9dXGzMljc~QdN!|l;zQ}jvT+$knrV<w6dHH!%*B9f>ELSj$;)Lf>ho6Y@uZ-i
zQ>&69ho78%C+LHa>yo0{*wrn^vMp-0vJKaVy<3~pY4(R<l0x6`GaU2e%Z~H=1%R7(
zFHvojK5YQXhHKMx--!D$behs@*D<q*12^b)@Ajr_ZhR)m$PM6_P5gBEprhiR>QfJ)
ztpDc_rE0bP4i#FaT|p64*3X@kYVHEIgQTn3J)aXA4HPE=HhZn*L}`NnFRfXj1@T;-
zuN794z~y>&FFe<SZ-+#sBPF9MDyeDP_~Zn%u`2Lg9xni+5M`n_H|K*Y_!@?y@cV8H
z6uk>=Jng_<p;2h<)nLIyLg75IqELm<7Icsqxck?%G3iP?JH$l#zJKpfGool!H~srj
zEWuPbw%nZ1XvJx<4^Qd`co`z)a~;_??5`?fyo>SSj-n7rdXzKRN*{l>KP@D)a0tU+
z^wdaHL(?yB`UH3bR1H=hrS#`=wqrW;m*dW3>(zi-`f~L47uj?AYq^*SlkyU^tUN_4
z^gkF~XMm>~zb};+FB7?Kx<y!PF8XP6>fW65w0V9)zVME@vq8!QYFUYIxh!fa^lYxZ
zK$V*~0OzRL3#_xuuJyfon?5!F7;b#lLw&x_g-}jhgA>@MLaGn<AR+(uo>oK!9^ReY
z8OoUfnKFH9F7#ea`)zo=D6sDMz01-)@+k_wKo`1pIqI={Y8NQhLFexCZ=_A%^>6Hc
zfOW+4?^@7zGD_}*iY7y=LS@+D=cIU@xx+-~b8>U*SY$m|f;_W&P61`AXm9;mh7O7+
ztii!8HfZYhfcjSXbO)h%n@08P(<w$lX}`hy4IP$9Oasa}HsBodhQmp^U#oMt{lx2u
zx$ce`1!1c;#LOzMQE)Kz?RnQ0RmnzI%E|Sq?XAm`^}IbR)r1D+52-{UdAHVuex7tf
z3YnAG!s}wr98<TKWw(VzTGab~*pxU%WhigsyQFX-{+G<d`210%UZ^x85ZH)JQNqqV
z%=SIx++G3-MqmZlEqCv2Gy_Vo&8BBor!OEvgXD26EDZt%kFh2tP{({WamRh-A<`bJ
zpa-H^5Yhx39<5qtw>~2()ibC(^;AuBp|#4Fl$%0z^@Njnq%1|SRO@t5&L^~Lhg*W1
zzXapnwj+5o2^F}uBPLlJqCbE`dPs1)PjJ#~l8OD>&#Yx1uSH37lDE>AY@2nf+c{u*
zOo}BOt}cZL<aJL|gZSPYWpY5QsQ!H*wH!M*Hj>CQrHRxh8+r^$ZUmelqHI7ae03Cr
zPevQi;jWNk!(r7E;20~;meS<!n{pO22yaLmaohqd?0IL~G0)j8{S`dexj2-gKt?_+
z<>M?++P$(OH_xWyTn;uA%t0@T#Y-SefhL_76U;iZf9CZvLlU5ofRz;aV@nTCq8yu(
zTdpSBqaxs@H^_@e+m1J>nA07gd_pR<9eTcc=_l*-$vX+Lyn`#K?k1s-Ihg;~4|>q1
zlEW-Z!jrScHQ}u-eh|~%EKHx1nVy+|K~oX^x%E$w3pTfh^}zE!NI^i#r|2Fc;{d}{
z!#5tZEuJ#>{))ujERBL=Ip6Vr#y}utt|AH}XrumedZM|eah0d6ph(cuxV*fv1;uc;
zA}~=uKpXQ(^?Lql?rc2JE_c(32TaaQ*6#hQ@=)PoR9N6-=U(5K)SoY#lPLKp2^?4J
z02a!X4duZS1XTcauHCddMWIMajOh}5?m+|%Z~ROZ`|<RSmofE`sAAjn*l|?<(Qzms
zLO6N-VMG23=yxfVREehej;ZL?)XEQ_saqB+J{JyxcOsGJF}H4L1~p(ynVc-kUZ0cZ
zIPl8ZU|I(a5tRKU@#@ggF<ll5(Y=#KG<EDJyA`N*x-4+UuxxF!cE^bOwPfNToc_3J
z{aeH)g!gQ1t$U~M4kT4iVg42jfQDw2$$o)-j=ESt$33M47i`}nK3_+r?j#!C5#S*S
zj&2QJIb;3V^e$5@3P4dV7Gn>|r25^Qhys&Tg8c}rO&OXbq@-I}$HbZEZ=m675qX8j
zD2_<sWX=DtyzhK#a_Qa;eWMf=QR%v^8$p^NRRmr|rAqHbq!U0eASDC=!B<hSB!Cgn
zjRFZBLP9`7Q3;#S1QQ5>fQ1@DP#_Tyawhxt@%#bjoa^v`>&o?%nOV=wTKBrwnl((G
zz<8*h9Xt&x8nkTcS1T?96_D>e@$~@gcvK8BM)->WD#K#Y=Nlx8)p*ThYPC%A@q(R?
z;Peq->Pt2;CD`&A#Qm&#OoSQd-KvaK9*QQ>7WxMq=;8`B0&n*h<tgO{JwY>b8i?M%
z%AX4=r>|d#Y6BpGM|Eus@6Ssox<9faO%HHG&qG20e~|v)o}30L)DtF5LG;ZzNKr{i
zZSBDW2YP|_p#WddOw&A+RMvY;ZD`-$vrnCmuf9I1mT(4Sj)|}?PqzYlBcdjZCjTQ*
zY?{zDUS-Z0O4YvFWRDU_@7F-0Fs635^R)~gpWmDZlWu`0P&HodIc1x;#FZL{w4cvl
z@*zxj=Z7z}SH;gYTc|i0yoNF}1uo90e4SBsJMZ(>zaZ8cv1ZNMqtBsuT8j@}jm)e%
z`SX0qbo>}yL(;lYnog@a`6UG3<gRK`Ev0)IfSg`~^V<s!<`o$RNQ~rF4nVt9e&~1p
zW1QhH0gw>UlytH{vu#<~S!Ec<hgk!UZ+|$t*l|wezP@XR+RjQ2ILZCQpX9@LU|n;9
z^QU0)F_t5u!;*ez^|30w%qPJmPAXd;wbJUN+xJLz=w0?ukC*!we;d~UrT$tL9@a)u
zeju3pu*)(XQNWgH@7;)fKHaGB`ShIyL#VKm0{U>%lWBd{f0+xJ-*xsePb~E>WTkMI
zFy*0MG4j!tUXZcAou$E@Dv~`c%9&_%Rb78|W)2!1k8au5NO*ddQ@U^z?a1v1$<OfK
zG<Cg^{B;4!Rr!4)*3Kqf6l?xN&itCh14#op+Y`8VBSp(DybJv)x4e{1XZ~`)Nc8l=
z3u`64<kDr5Ytw*D^iy4XC4oHHHh&Q|wwW7hTDlX5m%OS(@6H+yA6*e30+~w=hF`Ko
zcqjX8k4FiQM%iS1&iWYcnU`lk)(DJCo}RV&y5#>TTve}Hv0*Ztn%6tN<V@oU%;_@!
z#k9UWQ8uZ^Y7r$v=SRhRU3&AB2OQcPD$^k<l1Xy=Pb%BHf;5d|&+YG_ht3H_CU=*)
zN8{@i@-#(Kjw=t|yzBu!7JnR92Kjf*do+p`|I2}>fA;y=d8RXB^Y4dGhnge<l)%RN
zhm_`qRL)-+c7IH`ES6bT5QZfn29;%6kr|!Wh9lRHs%>1JG%*;J3_`Ey@{Vh_eN*9h
zkN~4bb1hOhc3Qq1Xm4xEX@I3$TJ$?_B-fQCMhOoHs1%q@hG+riLcj4U-(p-QSS9>*
zEX#YUW!VAUp$ioga5+@YH_t@0X|&hjH*=A+LM@;85W5U!+6Moqz3Gn+$>>dqqc-3e
z^YK$cw=BQAET7P@v&j(b;Dud`cw~*TlaH|cinF+EKEC#-pMC*@?Kj?+YX0ND4jS%0
zH!p4oc9pjPC5HHUQg(v$>0z`BA?fzNwLqQ;$P(BgG}&(Ju3!`Q4A5c;D#K;>4ak2{
z%447zi&9q;8qt$gerNn|m1CR39r8L1$vU0TjKKd<0QxpS`m$@i5@jxBYvOM(xN!0B
z5u1G{I{GE@LRM<}rc#F%s3y(s99-%tO3u@lA%!+E=B*R?47*klFi)K<3P+~n6;8a4
z=%T#?CfA%FKN)X8t$s4{&H2X*9#={o*`Z@`gNc??KLN1~o&)X#KW<|te^kEI=&pI-
zyx<TD;~rc2P$ohTfjuYZav~L&R#JIVpJ|$^9<nBL;NBH6DAqP6c?3<9$9Y;~Z5ySx
z;}&-WP^x8I-?ehvzq{<Z0kWJ<!Wmya^kV(k*?vf%Ct`W<f;T2%yUBm6$@rLkEyIOZ
zHW+0&5@m(;<OrZMr~^rqagYlDMeu5CRPCE0(*}&4%wBSZG0AopqaKA~!$(yAY)g;}
zn|tsLr{1GONh?$1m#VH;7^e@M|BgWaHb=%9kg=ZDJCCobO#y_&HyUzROQ+X2K{^zV
zUFcuPB}QA)Mc;13B4tDETGLbS_2lH>4qW~Ny$jh_vhma6Bvof)8d;*JNeL#MaD;CD
zV{j+Bku;GX{8Q)z<C798#B8Gu<0}NQzV8xHcKv5XsZ4d-742Uy=S<6Y{#*mFI!Z-%
zwoQMvJVT$;lw@vqYNLQ`T9)Q-A9foMEA28zo!bg~=`Wv_@aD5{NiW~Imw#Os)4FZ3
zU5wspSYAu&|LeEWy17M|@POzGqiyroVf=jJ_Rn@puf1?kYfnRP;yf#YnMG_f3ska;
zp=Gt(HBX$r6Uo)0wk5VQCKuJmvdZZMmx`S=2mUSJBk22doMumY5azyJz>D4q(dLDJ
z(BGb{zcJPqitSp&$@GxQU!0?q2U}u8N8HcJH!KvQcN!Mt(Fgw6=rSC1?pltr61QTR
znVdSp5<oMmro!;@VW?!>mR`w*EgaFsG#wCF*Ui5j&UY*UrCN6aNH4F+J!2^KGK-qh
zs&K24mw*TxZ%;)aBRM(E6Qc;kh`B-eRpE{&(}1J$Q#mo~vL#{us}r^!Vo4Rf6CRr9
z%vn_}x<ib+3h(-yT3BdfNtGH#Y8g4#3yw~ympL7u3<spmD_2Qt=k*t;|6o?4ET{UO
z<>{7xKACPC@Pap!^++~#T7<%bPw}W67RJY}xj@TC4_e@o0VosPA3gZv9d`5MQg5hQ
zuR|?|L_4;fI$!LfXO&3?jXcxOkFw$(Ir2k9btSzeCkk)&C9G>Gi%MwzsJWOVs6Io3
zDh`_%kiQBrq3^<r^R<#CwE%<CC}n>d@=K4U0+bn40JUk&j`EHUE&12s*McwDz#io6
zxY^OkxRlGRyIF0X{=)327`&eRz(PKnD{EKl4GE#3ggdf7Z4BYYh)%P0mn4H$El$aw
zGU}I|zKp!zlXd->!KwXd)RHrZe;)5sP7J78$330Xz7sCom3pKw?@Yc%$sT=?xVHx*
z?Gp#tmxLLjnUd1Zbh^}G<el2#-ox-<Ij@jn(Oe_D_QY3Jmu4Nr!jH-~N?M|m<aUJ?
z<DBP<V)9(lLh>rJo|><Sm^(@|Na{=cqtlz*s0MA=ZrdutPD@oF;R7As52fNzyFRZa
zu-O)9_&@2v;YWvD=4Z!(OEy!e+^aE@%4B6iNPA;VlmoZAdYnKfoiJQRUY)7ZqDXrs
zh>S7l(eV9{|Dh%XZorkpt;vmtdM=4Szp5XmZY#IHEKcu8m?c@XQYpCo(v@^{?8fZ5
z_9WlnlxF|<s(Tj>1c-v*wZPwUxjw7Q+V>~WwOZ%jSOV54vve1@5T)Ja0WmoJ|8SH8
z4C4QSSj+#BUeqn4P$<Dy1QF?gED*avfqfp;RhKeA?v5G3=hml-Ai858-p0?>8>mn#
zbw|<LQWD|tPO*dg!9!yj_ydqb0pLL8br>SRxF&?yIAB}}qBXKUyam9#2P9{V33m0?
z%6(@px)IdD`O{k9F>RI$0E9zemuBz8#6-`=z8XJ4wa&MR<Hz%Toczo8;msXYaLX<q
zxb_Ztl~)B}?|w@V_I_~|DzUE)P$i&Jp4pzR*_MqYA5RBoGsb+oG^8UN7AzES3Iyl7
zb>sgD>Kel-Uv`c3k~`*T2CDkA?vIu2!ngZ&Y7^SnPzvCVWp~|bRE0o7y5z;uU$5nf
zjd_He$+L?cS1LG>%7*&ZIkmlxP9}%=wwZ+pLB@v8XhEbv{Cv#At>lL4rF{Ri75?P6
zwIY==g`rA?=}1uC8AR?2wV&|^g>9dq#2`u(r$U|3;-uL-(`TJNy$Fv)uHVqEHA~?F
zxrJoU@*zhnz}qh1qv#FoSgebDl$O#3y~Cp*kff4VrWMs*_OU~dpF}ux`4D;+U4yaq
zMCG%DL1y|}MFV+!zbVmv55q`i281U*n;(D#WZ&8;ne>Jnim(w1uv!p(Vq)SRsih+}
zeUB&LR#Sm3)Owas#PTUuwx^dbF_J;t^;z#tvWmM5;fi?<SomW&Zh|m<WEaFL+!Ipw
z!^Z_g>9{^VkV97v@2>mtCio5$L^b;q?}|Z!1SF^S!chjX<rSc^mYS<p5lc=&0mlTA
zf71fKm1kU<P=JQ8XS#HSi7}fA=tiX}r#b%Uq*ywjMTHD%;(<PiN*#v^Riy*<lIa9O
z<sDL&VN2JA0;0fU5ABeEBvUHny9>Ep2F>4rRo;-!18rTxxpO?yksx^^D)m7T#YqT~
z{xAp=Z&V7YyDn%hnu5~YGI1}5o!Jt!AQhUp<KU|fsVV@ih~MJVUGE595*t0oA9=6~
zQVHTJ1$!qE$%AJgkl0_xa(y)*RWHD;K$shop1C(buf80~6)S*%k>xJz$W=KVfTV}-
z>lU^ZXhm_@>0k#<N-0Aa(vkd6M?>iDAfXf1fM6{(=I{5X5sj<kbzXt7vtI8Y8oi|;
z9a&)PAs%xj-`)<)6c?!tp27wTK?-tRK9*hV#7zDPft(NwR`S-)HKs4BGFa;rNc~7|
zHOY5wItB4C2jjE*+gr1BXyeE8ftlZbUk82p0q9@8dGYWD;%Dw}e@}?VIl*0JN`1vt
z;;{ldlT4TXWw72>R5tjrF>`SVo-)@5_k9qyC4(fPGU`UTu}B&<GtJdie~LKHBu?Pt
z>9p-6Zy`uPqs^}t7nH<8GJ?0+Fu=c0!buoP0S?ys-hlZ;3MEedgGK50gpBd5h78bP
z7|0Y5RQWxF{uDA<n}*&nx}nb94N%+v*MEk?{|a_#(P!YVs>%VKVwNgv)i@t2ND7#~
zJR*4!pLixeL95kG>FKRZlvxo)ev(D(DtkV9c`nY)p$=c#R}qy0t83iF`g`l#*Zajm
zZH)qXDqm^o94C=3L^ycfjW#6AuGiJWibwUfEStJXp1Z$DyxS3L09D03IO>ACt)HS6
zJG#4ejp~i=!)G}^J@+JnsF+XyZ(MsRdwY8@s)=*SP1F6Wdshr3z)aZ{s3x+RxUG3x
zm2Gm&K$Gpkp6GqlI0W^Y(D=lm)u?08T0UhLE07fYB1l@$7f<XAsXjATzRWGNGAbw~
za28ffz8jJ1{#@bH&&_sR-5GFwSVE9m1hIaxw{zSB`N%b;GNU^+a8~;EqY>)_l9x>6
z7N_L2l26lwIezNmUD!31@kEbb(h%ERphP=tD=xWrFiUg&$gkYQqCj8FzYtNa_Kb#L
z3UeShaW3xa99PVY$JSEv_g?2Z1%7QoL~in#eO-~Fkb=Dc?gY5?J#0p#d4w^lGki3n
z66SEWCIq=IE{`9jj?Fjb^;?e7xZ{56RXO;Tt!*(#fF+pb9aV?Qt(Si1ZEa?@;P*t=
zXg9WKo}Ar0aWd9-sf3`^RXjy}=^K){i@p%P<y~qCa(oT}^rL;+O{FKHGU#CP2~F6U
zg9i=JBi?02CSkMor&8SJbSZF;(f#`pwuZst)Tpsmn_Tzf8#_Ief>c#jgLVya<$6x!
zMJi21x=*q7dOL-nK^Seytalk(6aC(Yf>Y5H`E>kETZP<NE##3Fp@rh&^<rjW!s46p
zbGYjEc%!#{+4y#S-l09}993AAVC{uC5r(6cSK*X?-eh~F37l6ET&Pks7o9>`C6@Qq
ziKb7EZr2RV+>b~t<gM*x`9*m~rxfOaUcGUh!pu&(Rxf#wjX=-DfU$-&{#_jbjWNQh
z$B~qM<mqa*(x!Le$6LNQ;lmM>^lLeGO{R5pA5SL!?a_+lTFoUi5x;+Oj?>rR(`n}J
zc9Jzl_Z<CbrS7*?u7&)^?OrW!Ge>cb7hp*?-gn-AI4QSHuq*-^=S5Xbywyhzc$Kji
zJVR<YBwsULHP#ZZH(01Ce{0J)Uu8xci#q*#Ae@djqeiWBe2_x5k2iFKT58{3DOCGu
znAGMozN%Olw!WBLi}>)Z*!kg)l%YoWvsgEQNXBf9?~w0m9_hhjx7WTxMNow-&#C*u
z^yMHnHru34S)3ZT@-C()fn8~kbjn*(BD%UZ(-X`{zaagZdB2br-}ez!-+8Z$*C;QV
zlsRzf-j%l!5N#t6#Dp|{&5PA64@%6)!|g8Mw4TmXp^lo3bStEWj%^=AaV<)d-(FpP
z8jhE&kWn$k*qJ%#cUqtgUeQLa3pJB8L(ydEr-So;TCm#2rQu|DVv}<0T%!7DKJ<<A
zn)}ZbN0h|D%Ezt>?XI1~nQ8oPR&o{D6<)6YK5$BqG8FI(<7KY}s^2OtMLNL3-cI;T
zZI0XDEKyn+n{)lfa4oCwqKA(@0J0;+8*kj5q*xZ_Vc$OdkEaARPCn94HU&F#f8oD)
z?0ikT(Rq_rLi_}G-MldPK9;*Uvc%7>u&i;TEe5`BwdIB<4%Yk4tFrJBzljYpEsu$n
zTgk>T6Xb>H6ch_S$-%fR0-FbUHoULd=Ti}>S`q3_**rj&^u=<|H`)EFkMDpxOJcAy
zv5j{4N=+9<lQ&f)x#Hyo#@xr{metj+U9?eJ3V~S`A$-J%l6*3`H;s3D2{T^g?)JKM
zK(uDVDUf_GiMMVZR+ty@fz_nQ+!gSh<j(rN<tV*l7UoxZIvMK1X4}s8io$3Fc#n=*
zXl`)rp}MFthqwL$=vnuVtCjlU%1#S<hxS{L11w>>OhT<|KDxaGQ=2Z2;M^$;!VR?{
z91)WnI-_m1ii3tMlh6;wXEY-}Hw^q&tRYDC@kb$wzI>mgIAMK)P#RoBY=d_g;N0#x
z#I_G8=}y%|G;cIjA%wSvIQK))Sl8dGE-d99xA!8{YvfxmgC95Vbb@Yl7>7x!oM96=
zRmf~PC<WK2H`PG;s57f@=-w?6WL765r|;RG@ER#|Rj544q`M&W=7(hWecjzPds!y&
zed|>VpZTbDJKelVy>9NwV+<N$qK1?-uxPKAV9TuzP@=gcjW@toMP?c9(u7b=7RS2`
z)5je3oxQ)DJlma`JH|Zcz~FRxTHynE6|fpN{T<Het03cn1|5IUISB2#N5C~{H63_b
z$L4{}S;naDAb5R(w1+$5<G8#PH^^TP%(C?S?Xi(oJ8Jr?24mdyxccB?HZ|{?K|tF<
zx6|<pc`)f@zXaEuY`@6GHt*_KbN4#tT@-ANXwx&wSMK9!ww7~t9<-2exZM55MX|?5
zbf<hgGb7%O4y95_{B3-7$Toac*5n~#s^IZWTEUj~lFc*xg#?oA1*+;{P9@4eR6=DG
z70mE^;L1C+W`5F{9V{?OQM#@vC1Ymr)uqVY#@SWz)`*Hvx`V|`m}_R`8W)rT@vgwb
zhfJyIchK2Yk<<0_Xii>Tv!bJ?XOo0`ziwv6cp&+<JLR{DgemQf2wk6GF<+DDPidKJ
z<@t^ow1v`l>S7)AH`n+Dk@QEC-}(q$a28=q*TH*z<2r?_Q5CXnw)#lUW$^LsTwg0%
z`%^8uarKB%)7#$Eovo(Y#q*C{ry{F^H}FEgfjD_BQV|jm+wN;X%YIXu`@FQ<3mA+W
zJKIO2c@C`s0L|LGo&2ad0<1v4G!gDc*>2;lvnKI@Tl992zhr992(U~60MR(VQ9?s+
z)SzBTS98tIZ&CSuS;mhw(iYR77J}h$Ur0Q~qO7`!q<>mXw(1C5t6ceLt6Be3IlZfi
zUUPBR=Hj?{qn_==hMifUciBEaO_$YlraZ7ST7Ud}+f^|ag$W+FXfF+}qijaYM(!Tw
z5(4&#JS$@AvL{TZs6X@1#G8%Cjx(2aA|la_{N+UdXL3pBA?fRaB;^pQ(-gZ1KC*9z
zede3i)a=A^s-*E5Mct`jFs$wZx2a`u#O~laHube@wcQ`BF4-I#2ENI4VgSkAvynS+
zbHYDc)YLWQBh>rxKzxd7<ZBKokesMLi`D0PXtIT1jk3g;n$XSRLlzMX?y+fK+gCK=
zL}NVND1iP}XY^b+A)*lf8E*H|JnXf+>efyWeasu>e~_rU--WlMiff}OLGSQ?rzf3M
z?UC8YxSq(H+r71Ha_qvHoN-2?EpUvr<$#BqZg*Jd+R3%c$S;<jGA;@E`ioV1uY3NI
z%x@8LsaC3a={bIyrWmgYj>{=1*ZjruKeOsbYlNDZFzQ>k;yL*K#G2(#jZjAS1bzb*
z-kKs@g5OFZ)S7>2v8JS^w34F-^T?jn%4i}fJU;mL<#Uca!+~`>CZjr}Z?$PG(cc^S
z(@DV>b2|;B%ez8rJO<;DE5F<(*<+LE7#<87+zgk^lf+Wyp$goTy!)StM;LlxN{mPA
zKAvb5&5;+e2=}SY{N5ETkGYY&9?ir0@j#X&a7NNSVM+X~Xh)n!_mDKLyRgZ8-l%cw
zP^oaaH}cc0_{#$&+HcL5CjB-oQB3w?w70k8*lf4v$avQb)43zYyZh|nJ|A_8kY^VG
z3Lha$mR!0bb^|f5@9(B&+awldGr1D=I%acuFLf+a17^j)S!I3M@DWirz@(+NJw?VN
z8lm98$lq)8Evp{RxOrjD=<0*Vjolu%qC3{!qQXbjBS&a8hmo8G*aW{dF`9C4Ka?Cl
zcF+=Fy0MObF`DAJ6@}5^3Wb(03j?~vH`PVu;<yroR!ZE|=#Fy%;qe&$=KC>2Vz3tr
zvk-JX&Aaw<TKrr1)<D4pSQJjo@mto{OdRm1bfFlj<yw>8kEaU=P=2&eSxnVbYxKuW
z!$!Q=R5{XhaYr>*uDknH9t<plp{e%3>@|d0WAOL}^b4>}XONjz-$h&E&Dzb|{GFs(
z<sd0IBv}BMA~3esc%K)qRf{D<mEw!R$Hg3g?w%5Nn}-pg^|>(@E&K>yVPiXMQ|IjU
zp&4y@$>Kd;m2H|M3D2o$wV-0)CE|8=^{eK~`lnum$GiI+K_Axk|5HlgT?8iAV1RWy
z@AVgU`Y4r26<;e_pV{#9>HISuD%Uy~%E!kj{TS=7kKXM^mX6n&S6HjD^G=^KnV!1t
zxf3^ylicwWg0L=tEabk7?I3&fhhzzbvnxX#Fq~+hO>lEd{$l!t2#<=!a$L;laQcS3
zVnY$BYs0!40er|sb%)g$s`Mu=*N#b(-p=kdom`xo<r<Ptw)s2wTERFw$gGe_@&cl|
z|DlJ5D=oY}b|Kv{;U%abEY|RLTfglo_Dk9vk_+`v)aLsrL}3ujy|oWa6XL7p+*b^r
zK>J<=?>;&kxqBt?R%M0_FNSO%r~$YF0g`{O<XDe)q17Z7xy!u3D1FetO&}w1&b`yq
z;fy?TWc+eo5<z+lzcH-(>!p`?$>yX1e@BQl_-=PFd*2C=qO#5mmy2*7;ygu#TUEYD
z5m#VPH<Id2h-?on<V?c8q(}Bwj(^MR9b*Rf?!v>KTM5%GjszyQ&$gbEXiLlQ-E67i
za1Fr;QoZWAzswASI<CJLrh%CnZ#7%O*+_b+rQJ}{3VM7w<MXxMw=!vMnu(fagdcfV
z!@#x%K{8F_bqudNOSo-YByIWJlrFoWcu(+9Lp+?2-y5)99>E(lIhD%zqzmO$d>h%v
z#1;9O`;Tw=aFxpM|6Gc`M<gh}Q`s#i^>o~_dSkC^LmTzudp{A(dD{nfKQe>RP_+hG
z8!H-tQ03$8VRSBldDF6UN9zcx_XY^O?{j5m;@F&l<@lzv0fm9J4E$6M{yuY9SKHtF
z@od_`M1Kd9Eph3W9K7G58$*!WyNf8Kfrb=dR=P1#5)c`+f4v*#)aoi0JMWdNw5Ok7
zYto)#R)MrwlQ?e^T(`TsfS`FHLMatX$K&0^Gnb%+Gy|{g9UXk+_nU0-LWMw*QGd!y
z$Ha>0I;ugzwaE2=P_M38=0ZyA=(nXHXC!^e%KMP%60GIL=!yrBy8oc!w;!n9O)tfp
ze7sJ%zQv4>LY1b5%0`OzjiUUAjnK(aw$V|P3UB@S`VDU_+lui9Tj%2@QG19R4Zl;+
z0SW$uxP<<8uyf)D*aejCsS~Zwx|*wa3-c*CV*Sw37B$>NI&JsEw%|2<(_Q=cZ8_t|
z&!8r?Qsy6%Yi52}7daKb3V->DA>qoPwTP%4@0mD1eUo;*9>?>V9P!p4+c1(xwjGI3
zFJ>KvcC6lVyc_3mn`RrSbPGDhx}|?-2@Jtg<`43Q?knhc#H=T~0m>U(cbIp3HS6K;
zC2sQF=8g;bM4rZbge<-~fH6+`9kyjT+kmX9G&$_Sjj7LN)(ltosU7GwnC*?5SpuZn
znB%`HZ(iC6)%zuXvG?QNRjI{`<D3T60g)8%S@h|kLq|_N!q?q)xm<AnJwC4<;l)T^
z{xpeKnVCMUhw7du8>5zQMwwKn)M(^1q_lh)T_$Y}a#|<bW$8@z<cdZh@A}j>M~lrE
z4&kfw5~puMZ&jup+?@4{=$h4`o$K`>{A?I~wQKGgODz;JOGy-GjpLt23@)$Yw6Ei#
zr@^v|o5we87qi)IpUk-1gNdtNFHTe1Wmn(RK&iFfGQ_%*0@MYjBf!3|TfTghpM-?H
zw!I*Jb5Rm`Ag7Pe=vCya$r_*3ow^wOYe&X=>MnIr16LJUGovG$ytFtSL@S7)a}Dxk
z3eKyW`qc|DjC$T`Qc9@0Q>2KMAB9SFDqG!2?{s(=w*C_aqlG7%ymKJCsxcAl5ah`=
z)(x-Aj+GeJdM#60%VRc4N49Q;HyQ7?q7iF@cZkJ7lL`D9A=dbaF6UK{Nvyd<Rf@I#
zCZ{7+2x1^55BLDvdAI!`AJ#^U%{gbD)t{YBJ@`<^!P_;2f!Ts0pX9iFldkZXyr!b~
zTg9o69*V)m@OMz;zIWwFtH%`P&m!kH)^4W~2=Ew+FN5-nK{%n1S}COp!SH`@=(_Mk
z3XV8T;=dQa7Fmh&an)Z*AN_ErcQP()=B5Vn3l%lTt7fG~dl=bYTzoZ`GQXMg&VJv}
z$+4Fl^!cTYcW<N!F5~{8HdZKNbMW}1<@Hyn!<qOWzfs|tkJyH_3=w0p&KB%aIHJFM
zXQy*b0PkfUL?gX}ZuX=yuwRfF58$i_fusW`7MmiH4wqVC=dhV6g#+&IHC;~M?koP*
zFf>`aLE1`q+*qT7udFYvDjnFAb6Zwe8N;Yg7~G)WR4?VZTG>me)jjeJMq;_WlQxyE
zZffq7TDIw6>n5)>0#UQY#$<E&_+_0j*CyF2gDUmb(Sf~NI*aS5Eyklsu6#|rgMPCj
z?6bi#hSpr7$?E%IR<8JihY@r)YCkp316Ql~Dd^^f0%wV{W~)mJh0K<L==6r#P?C+c
z>2fiO{1RA95sSX7YVjYqxVzUF5`8A~1s8?i+|@k}eENL0=aS#xW8y@eW1N3e%V@us
zF#Vdp%-Xm!?UkZ(-15Tm=-9T8wdp`t9=wP2h&ueY*9NDvr?Uq8<MBG_8o5+)V)j*i
zYwl|=nE<&Cf5UFBroin^_jJ|FNwR~)U8FMO^`K(e*{;;YuFfZ~-E8iS&^Tu;oMU2d
zU%p2zD#xIFVR>#%IezcCFj7oml(*#yQTJ#IIm&<V{1S_F;F2mif@n#Yx{p2VO*68e
zStMOi{)TP)nNVZv(eyi|v6cgCXnsn@%50nU;I-EJM_dqExx|5w5gFu`tzWH`nVFx>
zsK5O8ELC(9JOn~B$c*R>yzX%CtXsM_Ezw&B)1wqmgi@vM)<Ijg>b`2X8lU}8d^*zc
z;rV{V)SE{zs_M=F5~lm#(JT6$qh7EuSN4ZTFkX_+Cl*Gr_F;E%?_oc|Ya44LIL}(k
zM!r54r6yvZ9Xu)j+%?DTxj{DfqwmLWII;BAnLnH~-HkX(dr}9Ge_^vF8iELkf+qvS
zUD)L|wF_%0Znc~CGix=`j_3SOQ~{6M#Q%{toSZ!R#aP@mMQz-SDw?t>;1KF8Ze>=a
z#ox7yyzqy)yI~b}hS?{1j{x=^g5l*vB%S5?EEd1i?0lIZhW6nR4+0YlluPoW+q6E{
zm2Gx*ZWr2*5^wG<xIg_L1xE#XWPR*^Do_%;KmY+^+XK8V$R-HC1S94aCxjCHhlq&!
z*f-7Z1ouN&wO*=iaDRgC&t1rR>tbw7K&{~QkdDoHd~NgJ3nzU9zW^`4pv0&~6`%h1
g*Z=;n?#ede*Gg@PRgCOg!PP4l?f+9_8IbY6074?BHUIzs

diff --git a/frontend/editor/src/core/styles/theme.css b/frontend/editor/src/core/styles/theme.css
index 11d4ab217b..18955b438f 100644
--- a/frontend/editor/src/core/styles/theme.css
+++ b/frontend/editor/src/core/styles/theme.css
@@ -786,22 +786,20 @@
 .wordmark-dark-only {
   display: none;
 }
-[data-mantine-color-scheme="dark"] .wordmark-light-only {
+[data-mantine-color-scheme="dark"] .wordmark {
   display: none;
 }
 [data-mantine-color-scheme="dark"] .wordmark-dark-only {
   display: block;
 }
 
-/* Theme-aware image display utilities: .theme-img-light-only shows in light
-   mode only, .theme-img-dark-only shows in dark mode only. */
-.theme-img-light-only {
+.theme-img {
   display: inline;
 }
 .theme-img-dark-only {
   display: none;
 }
-[data-mantine-color-scheme="dark"] .theme-img-light-only {
+[data-mantine-color-scheme="dark"] .theme-img {
   display: none;
 }
 [data-mantine-color-scheme="dark"] .theme-img-dark-only {
diff --git a/frontend/editor/src/core/tests/live/authentication-login.spec.ts b/frontend/editor/src/core/tests/live/authentication-login.spec.ts
index af1733ac42..f9d0f6e628 100644
--- a/frontend/editor/src/core/tests/live/authentication-login.spec.ts
+++ b/frontend/editor/src/core/tests/live/authentication-login.spec.ts
@@ -162,34 +162,4 @@ test.describe("1. Authentication and Login", () => {
       });
     });
   });
-
-  test.describe("1.6 Login Page - Carousel/Slideshow", () => {
-    test("should navigate between carousel slides", async ({ page }) => {
-      // Carousel is hidden on small viewports (< 940px wide), ensure desktop size
-      await page.setViewportSize({ width: 1920, height: 1080 });
-
-      // Starting state: User is logged out; browser on /login
-      await page.goto("/login");
-      await page.waitForLoadState("domcontentloaded");
-
-      // Step 1: Verify slide indicator dots are present (carousel uses aria-label "Go to slide N")
-      const slideButtons = page.getByRole("button", { name: /Go to slide/i });
-      const count = await slideButtons.count();
-      test.skip(count === 0, "No carousel slides configured on this instance");
-
-      // Step 2: Click through slides
-      if (count >= 2) {
-        await slideButtons.nth(1).click();
-        await page.waitForTimeout(500);
-      }
-      if (count >= 3) {
-        await slideButtons.nth(2).click();
-        await page.waitForTimeout(500);
-      }
-
-      // Step 3: Click back to slide 1
-      await slideButtons.nth(0).click();
-      await page.waitForTimeout(500);
-    });
-  });
 });
diff --git a/frontend/editor/src/desktop/components/SetupWizard/DesktopAuthLayout.tsx b/frontend/editor/src/desktop/components/SetupWizard/DesktopAuthLayout.tsx
index f5e64f2927..7d4af4fa81 100644
--- a/frontend/editor/src/desktop/components/SetupWizard/DesktopAuthLayout.tsx
+++ b/frontend/editor/src/desktop/components/SetupWizard/DesktopAuthLayout.tsx
@@ -1,9 +1,5 @@
-import React, { useEffect, useMemo, useRef, useState } from "react";
-import { useTranslation } from "react-i18next";
-import LoginRightCarousel from "@app/auth/ui/LoginRightCarousel";
-import buildLoginSlides from "@app/components/shared/loginSlides";
-import styles from "@app/auth/ui/AuthShell.module.css";
-import { useLogoVariant } from "@app/hooks/useLogoVariant";
+import React from "react";
+import { AuthShell } from "@app/auth/ui/AuthShell";
 
 interface DesktopAuthLayoutProps {
   children: React.ReactNode;
@@ -12,52 +8,5 @@ interface DesktopAuthLayoutProps {
 export const DesktopAuthLayout: React.FC<DesktopAuthLayoutProps> = ({
   children,
 }) => {
-  const { t } = useTranslation();
-  const cardRef = useRef<HTMLDivElement | null>(null);
-  const [hideRightPanel, setHideRightPanel] = useState(false);
-  const logoVariant = useLogoVariant();
-  const imageSlides = useMemo(
-    () => buildLoginSlides(logoVariant, t),
-    [logoVariant, t],
-  );
-
-  useEffect(() => {
-    const update = () => {
-      // Use viewport to avoid hysteresis when the card is already in single-column mode
-      const viewportWidth = window.innerWidth;
-      const viewportHeight = window.innerHeight;
-      const cardWidthIfTwoCols = Math.min(1180, viewportWidth * 0.96); // matches min(73.75rem, 96vw)
-      const columnWidth = cardWidthIfTwoCols / 2;
-      const tooNarrow = columnWidth < 470;
-      const tooShort = viewportHeight < 740;
-      setHideRightPanel(tooNarrow || tooShort);
-    };
-    update();
-    window.addEventListener("resize", update);
-    window.addEventListener("orientationchange", update);
-    return () => {
-      window.removeEventListener("resize", update);
-      window.removeEventListener("orientationchange", update);
-    };
-  }, []);
-
-  return (
-    <div className={styles.authContainer}>
-      <div
-        ref={cardRef}
-        className={`${styles.authCard} ${!hideRightPanel ? styles.authCardTwoColumns : ""}`}
-      >
-        <div className={styles.authLeftPanel}>
-          <div className={styles.authContent}>{children}</div>
-        </div>
-        {!hideRightPanel && (
-          <LoginRightCarousel
-            imageSlides={imageSlides}
-            initialSeconds={5}
-            slideSeconds={8}
-          />
-        )}
-      </div>
-    </div>
-  );
+  return <AuthShell>{children}</AuthShell>;
 };
diff --git a/frontend/editor/src/desktop/components/SetupWizard/desktopOAuth.css b/frontend/editor/src/desktop/components/SetupWizard/desktopOAuth.css
index 6661c6a99b..55ab193a4c 100644
--- a/frontend/editor/src/desktop/components/SetupWizard/desktopOAuth.css
+++ b/frontend/editor/src/desktop/components/SetupWizard/desktopOAuth.css
@@ -17,12 +17,12 @@
      own padding-block); horizontal stays in the shorthand. */
   --sui-btn-py: 1rem; /* 16px (md) */
   padding: 1rem 1rem; /* 16px */
-  border: 1px solid var(--auth-input-border-light-only);
+  border: 1px solid var(--auth-input-border);
   border-radius: 0.75rem; /* 12px */
-  background-color: var(--auth-card-bg-light-only);
+  background-color: var(--auth-card-bg);
   font-size: 1rem; /* 16px */
   font-weight: 500;
-  color: var(--auth-text-primary-light-only);
+  color: var(--auth-text-primary);
   cursor: pointer;
   gap: 0.75rem; /* 12px */
   font-family: inherit;
@@ -39,7 +39,7 @@
 }
 
 .oauth-button-vertical-desktop:focus-visible {
-  outline: 2px solid var(--auth-border-focus-light-only);
+  outline: 2px solid var(--auth-border-focus);
   outline-offset: 2px;
 }
 
diff --git a/frontend/editor/src/portal/components/LoginScreen.tsx b/frontend/editor/src/portal/components/LoginScreen.tsx
index f16553d56d..ac69040c19 100644
--- a/frontend/editor/src/portal/components/LoginScreen.tsx
+++ b/frontend/editor/src/portal/components/LoginScreen.tsx
@@ -1,8 +1,4 @@
-import { useMemo } from "react";
-import { useTranslation } from "react-i18next";
 import { AuthShell } from "@app/auth/ui/AuthShell";
-import LoginRightCarousel from "@app/auth/ui/LoginRightCarousel";
-import { buildDefaultLoginSlides } from "@app/auth/ui/loginSlides";
 import SpringLoginForm from "@app/auth/ui/SpringLoginForm";
 import { useSpringLogin } from "@app/auth/ui/useSpringLogin";
 import { withBasePath } from "@app/constants/app";
@@ -12,7 +8,7 @@ import loginHeader from "@app/assets/brand/modern-logo/LoginLightModeHeader.svg"
 
 /**
  * Full-screen login shown by the portal's auth gate. Renders the shared
- * AuthShell + carousel with the Spring form/auth wiring from @app/auth/ui.
+ * AuthShell with the Spring form/auth wiring from @app/auth/ui.
  *
  * It follows the user's light/dark theme (AuthShell is theme-aware — the same
  * screen the editor login uses; passing both logo variants keeps the header
@@ -20,23 +16,10 @@ import loginHeader from "@app/assets/brand/modern-logo/LoginLightModeHeader.svg"
  * needs to collect credentials.
  */
 export function LoginScreen() {
-  const { t } = useTranslation();
   const login = useSpringLogin();
-  const slides = useMemo(
-    () => buildDefaultLoginSlides((key, fallback) => t(key, fallback)),
-    [t],
-  );
 
   return (
-    <AuthShell
-      rightPanel={
-        <LoginRightCarousel
-          imageSlides={slides}
-          initialSeconds={5}
-          slideSeconds={8}
-        />
-      }
-    >
+    <AuthShell>
       <SpringLoginForm
         state={login}
         logoSrc={loginHeader}
diff --git a/frontend/editor/src/proprietary/auth/ui/AuthDefaultCredentials.tsx b/frontend/editor/src/proprietary/auth/ui/AuthDefaultCredentials.tsx
new file mode 100644
index 0000000000..9d7c7858ed
--- /dev/null
+++ b/frontend/editor/src/proprietary/auth/ui/AuthDefaultCredentials.tsx
@@ -0,0 +1,55 @@
+import { Alert, Stack, Text } from "@mantine/core";
+import { useTranslation } from "react-i18next";
+
+/**
+ * First-time-setup notice showing the default admin credentials. Rendered
+ * beneath the login form when the backend reports a fresh install.
+ */
+export default function AuthDefaultCredentials() {
+  const { t } = useTranslation();
+  return (
+    <Alert color="blue" variant="light" radius="md" mt="xl">
+      <Stack gap="xs" align="center">
+        <Text
+          size="sm"
+          fw={600}
+          ta="center"
+          style={{ color: "var(--text-primary)" }}
+        >
+          {t("login.defaultCredentials", "Default Login Credentials")}
+        </Text>
+        <Text size="sm" ta="center" style={{ color: "var(--text-primary)" }}>
+          <Text
+            component="span"
+            fw={600}
+            style={{ color: "var(--text-primary)" }}
+          >
+            {t("login.username", "Username")}:
+          </Text>{" "}
+          admin
+        </Text>
+        <Text size="sm" ta="center" style={{ color: "var(--text-primary)" }}>
+          <Text
+            component="span"
+            fw={600}
+            style={{ color: "var(--text-primary)" }}
+          >
+            {t("login.password", "Password")}:
+          </Text>{" "}
+          stirling
+        </Text>
+        <Text
+          size="xs"
+          ta="center"
+          mt="xs"
+          style={{ color: "var(--text-muted)" }}
+        >
+          {t(
+            "login.changePasswordWarning",
+            "Please change your password after logging in for the first time",
+          )}
+        </Text>
+      </Stack>
+    </Alert>
+  );
+}
diff --git a/frontend/editor/src/proprietary/auth/ui/AuthScreens.stories.tsx b/frontend/editor/src/proprietary/auth/ui/AuthScreens.stories.tsx
new file mode 100644
index 0000000000..9100892fee
--- /dev/null
+++ b/frontend/editor/src/proprietary/auth/ui/AuthScreens.stories.tsx
@@ -0,0 +1,203 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react";
+import { AuthShell } from "@app/auth/ui/AuthShell";
+import SpringLoginForm from "@app/auth/ui/SpringLoginForm";
+import AuthSignupPrompt from "@app/auth/ui/AuthSignupPrompt";
+import AuthDefaultCredentials from "@app/auth/ui/AuthDefaultCredentials";
+import type { SpringLoginState } from "@app/auth/ui/useSpringLogin";
+import ErrorMessage from "@app/auth/ui/ErrorMessage";
+import SignupForm from "@app/routes/signup/SignupForm";
+import DividerWithText from "@app/components/shared/DividerWithText";
+import { Button } from "@app/ui/Button";
+import loginHeader from "@app/assets/brand/modern-logo/LoginLightModeHeader.svg";
+import "@app/auth/ui/auth-theme.css";
+import "@app/auth/ui/auth.css";
+
+const darkLogo = "/modern-logo/LoginDarkModeHeader.svg";
+
+/** Every provider the OAuth buttons know how to render, for stress testing. */
+const ALL_PROVIDERS = [
+  "google",
+  "github",
+  "apple",
+  "azure",
+  "keycloak",
+  "cloudron",
+  "authentik",
+  "oidc",
+];
+
+type LoginMethod = "all" | "normal" | "oauth2";
+
+interface LoginArgs {
+  /** OAuth providers to render (stress test the button stack here). */
+  providers: string[];
+  /** all = OAuth + email · normal = email only · oauth2 = SSO only. */
+  loginMethod: LoginMethod;
+  /** Show the "Don't have an account? Sign up" prompt below the form. */
+  showSignupPrompt: boolean;
+  /** Show the first-time-setup default admin credentials card. */
+  showDefaultCredentials: boolean;
+}
+
+/** Interactive SpringLoginState without the network/config fetch. */
+function useFakeSpringLogin(
+  providers: string[],
+  loginMethod: LoginMethod,
+): SpringLoginState {
+  // Prefill so the submit CTA renders in its enabled (filled) state.
+  const [email, setEmail] = useState("you@company.com");
+  const [password, setPassword] = useState("password");
+  const [mfaCode, setMfaCode] = useState("");
+  const isUserPassAllowed = loginMethod === "all" || loginMethod === "normal";
+  return {
+    email,
+    setEmail,
+    password,
+    setPassword,
+    mfaCode,
+    setMfaCode,
+    requiresMfa: false,
+    error: null,
+    setError: () => {},
+    isSubmitting: false,
+    providers,
+    loginMethod,
+    isUserPassAllowed,
+    hasProviders: providers.length > 0,
+    signInWithEmail: async () => {},
+    signInWithProvider: async () => {},
+  };
+}
+
+function LoginPreview({
+  providers,
+  loginMethod,
+  showSignupPrompt,
+  showDefaultCredentials,
+}: LoginArgs) {
+  const login = useFakeSpringLogin(providers, loginMethod);
+  return (
+    <AuthShell>
+      <SpringLoginForm
+        state={login}
+        logoSrc={loginHeader}
+        logoDarkSrc={darkLogo}
+        showEmailForm={login.isUserPassAllowed}
+        footer={
+          <>
+            {showDefaultCredentials && <AuthDefaultCredentials />}
+            {showSignupPrompt && <AuthSignupPrompt onSignUp={() => {}} />}
+          </>
+        }
+      />
+    </AuthShell>
+  );
+}
+
+function SignupPreview() {
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [confirmPassword, setConfirmPassword] = useState("");
+  return (
+    <AuthShell>
+      <div className="auth-logo-block">
+        <img
+          src={loginHeader}
+          alt="Stirling PDF"
+          className="auth-logo-header auth-logo-header--light"
+        />
+        <img
+          src={darkLogo}
+          alt="Stirling PDF"
+          className="auth-logo-header auth-logo-header--dark"
+        />
+      </div>
+      <ErrorMessage error={null} />
+      <SignupForm
+        email={email}
+        password={password}
+        confirmPassword={confirmPassword}
+        setEmail={setEmail}
+        setPassword={setPassword}
+        setConfirmPassword={setConfirmPassword}
+        onSubmit={() => {}}
+        isSubmitting={false}
+      />
+      <DividerWithText text="or" respondsToDarkMode={false} opacity={0.4} />
+      <div style={{ textAlign: "center", margin: "0.5rem 0 0.25rem" }}>
+        <Button variant="tertiary" className="auth-link-black">
+          Log In
+        </Button>
+      </div>
+    </AuthShell>
+  );
+}
+
+/**
+ * The slim single-column auth screens: one narrow card centered on the page.
+ * Uses a fake login state so the full screen renders without a backend. The
+ * Login stories expose provider/login-method controls in the playground so the
+ * OAuth button stack can be stress tested with any number of providers.
+ */
+const meta: Meta<LoginArgs> = {
+  title: "Auth/Auth Screens",
+  parameters: { layout: "fullscreen" },
+  argTypes: {
+    providers: {
+      control: "check",
+      options: ALL_PROVIDERS,
+      description: "OAuth providers rendered above the email form",
+    },
+    loginMethod: {
+      control: "inline-radio",
+      options: ["all", "normal", "oauth2"],
+      description:
+        "all = OAuth + email · normal = email only · oauth2 = SSO only",
+    },
+    showSignupPrompt: {
+      control: "boolean",
+      description: "Show the sign-up prompt below the form",
+    },
+    showDefaultCredentials: {
+      control: "boolean",
+      description: "Show the first-time-setup default admin credentials card",
+    },
+  },
+  args: {
+    providers: ["google", "github", "oidc"],
+    loginMethod: "all",
+    showSignupPrompt: true,
+    showDefaultCredentials: false,
+  },
+};
+export default meta;
+type Story = StoryObj<LoginArgs>;
+
+export const Login: Story = {
+  render: (args) => <LoginPreview {...args} />,
+};
+
+export const AllProviders: Story = {
+  args: { providers: ALL_PROVIDERS },
+  render: (args) => <LoginPreview {...args} />,
+};
+
+export const LoginSsoOnly: Story = {
+  args: { loginMethod: "oauth2" },
+  render: (args) => <LoginPreview {...args} />,
+};
+
+export const LoginEmailOnly: Story = {
+  args: { providers: [] },
+  render: (args) => <LoginPreview {...args} />,
+};
+
+export const FirstTimeSetup: Story = {
+  args: { showDefaultCredentials: true },
+  render: (args) => <LoginPreview {...args} />,
+};
+
+export const Signup: Story = {
+  render: () => <SignupPreview />,
+};
diff --git a/frontend/editor/src/proprietary/auth/ui/AuthShell.module.css b/frontend/editor/src/proprietary/auth/ui/AuthShell.module.css
index 3e5e5247ea..bb0e418d88 100644
--- a/frontend/editor/src/proprietary/auth/ui/AuthShell.module.css
+++ b/frontend/editor/src/proprietary/auth/ui/AuthShell.module.css
@@ -5,7 +5,7 @@
   flex-direction: column;
   align-items: center;
   justify-content: center;
-  background-color: var(--auth-bg-color-light-only);
+  background-color: var(--auth-bg-color);
   padding: 1.5rem 1.5rem 0;
   font-family:
     -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
@@ -13,37 +13,23 @@
 }
 
 .authCard {
-  width: min(45rem, 96vw);
-  height: min(50.875rem, 96vh);
-  display: grid;
-  grid-template-columns: 1fr;
+  width: min(26rem, 96vw);
+  max-height: 96vh;
+  padding: 2.5rem 2rem;
+  display: flex;
+  justify-content: center;
   background-color: var(--auth-card-bg);
   border-radius: 1.25rem;
   box-shadow: 0 1.25rem 3.75rem rgba(0, 0, 0, 0.12);
-  overflow: hidden;
-  min-height: 0;
+  overflow-y: auto;
+  overflow-x: hidden;
 }
 
-.authCardTwoColumns {
-  width: min(73.75rem, 96vw);
-  grid-template-columns: 1fr 1fr;
-}
-
-.authLeftPanel {
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  padding: 2rem;
-  overflow: hidden;
-  min-height: 0;
-  height: 100%;
-}
-
-.authLeftPanel::-webkit-scrollbar {
+.authCard::-webkit-scrollbar {
   display: none; /* WebKit browsers (Chrome, Safari, Edge) */
 }
 
 .authContent {
-  max-width: 26.25rem; /* 420px */
+  max-width: 22rem; /* 352px */
   width: 100%;
 }
diff --git a/frontend/editor/src/proprietary/auth/ui/AuthShell.tsx b/frontend/editor/src/proprietary/auth/ui/AuthShell.tsx
index 13f9e7d80b..2b1f8f705c 100644
--- a/frontend/editor/src/proprietary/auth/ui/AuthShell.tsx
+++ b/frontend/editor/src/proprietary/auth/ui/AuthShell.tsx
@@ -1,56 +1,22 @@
-import { useEffect, useRef, useState, type ReactNode } from "react";
+import type { ReactNode } from "react";
 import styles from "@app/auth/ui/AuthShell.module.css";
 
 export interface AuthShellProps {
   children: ReactNode;
-  /** Optional panel shown beside the form on wide/tall viewports (the carousel). */
-  rightPanel?: ReactNode;
   /** Optional fixed footer slot (the editor passes its legal/cookie footer). */
   footer?: ReactNode;
 }
 
 /**
- * The login card shell shared by the editor and the portal: a centered card
- * that expands to two columns (form + right panel) on wide/tall viewports and
- * collapses to a single column otherwise. Purely presentational - callers
- * provide the form (children), the right panel, and an optional footer.
+ * The login card shell shared by the editor and the portal: a single narrow
+ * card centered on the screen. Purely presentational - callers provide the
+ * form (children) and an optional footer.
  */
-export function AuthShell({ children, rightPanel, footer }: AuthShellProps) {
-  const cardRef = useRef<HTMLDivElement | null>(null);
-  const [hideRightPanel, setHideRightPanel] = useState(false);
-
-  useEffect(() => {
-    const update = () => {
-      // Use viewport to avoid hysteresis when the card is already single-column.
-      const viewportWidth = window.innerWidth;
-      const viewportHeight = window.innerHeight;
-      const cardWidthIfTwoCols = Math.min(1180, viewportWidth * 0.96); // min(73.75rem, 96vw)
-      const columnWidth = cardWidthIfTwoCols / 2;
-      const tooNarrow = columnWidth < 470;
-      const tooShort = viewportHeight < 740;
-      setHideRightPanel(tooNarrow || tooShort);
-    };
-    update();
-    window.addEventListener("resize", update);
-    window.addEventListener("orientationchange", update);
-    return () => {
-      window.removeEventListener("resize", update);
-      window.removeEventListener("orientationchange", update);
-    };
-  }, []);
-
-  const showRightPanel = Boolean(rightPanel) && !hideRightPanel;
-
+export function AuthShell({ children, footer }: AuthShellProps) {
   return (
     <div className={styles.authContainer}>
-      <div
-        ref={cardRef}
-        className={`${styles.authCard} ${showRightPanel ? styles.authCardTwoColumns : ""}`}
-      >
-        <div className={styles.authLeftPanel}>
-          <div className={styles.authContent}>{children}</div>
-        </div>
-        {showRightPanel && rightPanel}
+      <div className={styles.authCard}>
+        <div className={styles.authContent}>{children}</div>
       </div>
       {footer && (
         <div
diff --git a/frontend/editor/src/proprietary/auth/ui/AuthSignupPrompt.tsx b/frontend/editor/src/proprietary/auth/ui/AuthSignupPrompt.tsx
new file mode 100644
index 0000000000..baaad54d7b
--- /dev/null
+++ b/frontend/editor/src/proprietary/auth/ui/AuthSignupPrompt.tsx
@@ -0,0 +1,30 @@
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui/Button";
+import "@app/auth/ui/auth.css";
+
+interface AuthSignupPromptProps {
+  /** Navigate to the signup screen. */
+  onSignUp: () => void;
+}
+
+/**
+ * "Don't have an account? Sign up" row shown beneath the login form. The prompt
+ * is muted; the action reads as a brand-coloured link.
+ */
+export default function AuthSignupPrompt({ onSignUp }: AuthSignupPromptProps) {
+  const { t } = useTranslation();
+  return (
+    <div className="auth-signup-prompt">
+      <span>{t("login.noAccount", "Don't have an account?")}</span>
+      <Button
+        type="button"
+        variant="quiet"
+        accent="brand"
+        onClick={onSignUp}
+        className="auth-signup-link"
+      >
+        {t("signup.signUp", "Sign up")}
+      </Button>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.tsx b/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.tsx
index 08236c12c4..e83715a802 100644
--- a/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.tsx
+++ b/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.tsx
@@ -3,18 +3,20 @@ import { Button } from "@app/ui/Button";
 import "@app/auth/ui/auth.css";
 import { TextInput, PasswordInput } from "@mantine/core";
 
-// Force light mode styles for auth inputs
-const authInputStyles = {
+// Theme-aware auth input colours (the --auth-* vars flip in dark mode via
+// auth-theme.css). Exported so other auth screens (e.g. invite accept) render
+// their Mantine inputs identically to login.
+export const authInputStyles = {
   input: {
-    backgroundColor: "var(--auth-input-bg-light-only)",
-    color: "var(--auth-input-text-light-only)",
-    borderColor: "var(--auth-input-border-light-only)",
+    backgroundColor: "var(--auth-input-bg)",
+    color: "var(--auth-input-text)",
+    borderColor: "var(--auth-input-border)",
     "&:focus": {
-      borderColor: "var(--auth-border-focus-light-only)",
+      borderColor: "var(--auth-border-focus)",
     },
   },
   label: {
-    color: "var(--auth-label-text-light-only)",
+    color: "var(--auth-label-text)",
   },
 };
 
@@ -130,7 +132,10 @@ export default function EmailPasswordForm({
           (requiresMfa && !mfaCode.trim())
         }
         fullWidth
+        size="lg"
+        fontSize="sm"
         loading={isSubmitting}
+        className="auth-submit"
         // Stirling-red brand CTA; the brand accent sets the colour inline so the
         // host app's Mantine primaryColor can't win (editor vs portal differ).
         accent="brand"
diff --git a/frontend/editor/src/proprietary/auth/ui/LoginRightCarousel.tsx b/frontend/editor/src/proprietary/auth/ui/LoginRightCarousel.tsx
deleted file mode 100644
index 490aea923c..0000000000
--- a/frontend/editor/src/proprietary/auth/ui/LoginRightCarousel.tsx
+++ /dev/null
@@ -1,218 +0,0 @@
-import { memo, useEffect, useMemo, useRef, useState } from "react";
-import { CarouselDots } from "@app/ui/CarouselDots";
-import bgDefault from "@app/assets/login/LoginBackgroundPanel.png";
-
-export type ImageSlide = {
-  src: string;
-  alt?: string;
-  cornerModelUrl?: string;
-  title?: string;
-  subtitle?: string;
-  followMouseTilt?: boolean;
-  tiltMaxDeg?: number;
-};
-
-function LoginRightCarousel({
-  imageSlides = [],
-  showBackground = true,
-  backgroundSrc = bgDefault,
-  initialSeconds = 5,
-  slideSeconds = 8,
-}: {
-  imageSlides?: ImageSlide[];
-  showBackground?: boolean;
-  /** Background panel image; defaults to the bundled shared asset. */
-  backgroundSrc?: string;
-  initialSeconds?: number;
-  slideSeconds?: number;
-}) {
-  const totalSlides = imageSlides.length;
-  const [index, setIndex] = useState(0);
-  const mouse = useRef({ x: 0, y: 0 });
-
-  const durationsMs = useMemo(() => {
-    if (imageSlides.length === 0) return [];
-    return imageSlides.map(
-      (_, i) =>
-        (i === 0 ? (initialSeconds ?? slideSeconds) : slideSeconds) * 1000,
-    );
-  }, [imageSlides, initialSeconds, slideSeconds]);
-
-  useEffect(() => {
-    if (totalSlides <= 1) return;
-    const timeout = setTimeout(
-      () => {
-        setIndex((i) => (i + 1) % totalSlides);
-      },
-      durationsMs[index] ?? slideSeconds * 1000,
-    );
-    return () => clearTimeout(timeout);
-  }, [index, totalSlides, durationsMs, slideSeconds]);
-
-  useEffect(() => {
-    const onMove = (e: MouseEvent) => {
-      mouse.current.x = (e.clientX / window.innerWidth) * 2 - 1;
-      mouse.current.y = (e.clientY / window.innerHeight) * 2 - 1;
-    };
-    window.addEventListener("mousemove", onMove);
-    return () => window.removeEventListener("mousemove", onMove);
-  }, []);
-
-  function TiltImage({
-    src,
-    alt,
-    enabled,
-    maxDeg = 6,
-  }: {
-    src: string;
-    alt?: string;
-    enabled: boolean;
-    maxDeg?: number;
-  }) {
-    const imgRef = useRef<HTMLImageElement | null>(null);
-
-    useEffect(() => {
-      const el = imgRef.current;
-      if (!el) return;
-
-      let raf = 0;
-      const tick = () => {
-        if (enabled) {
-          const rotY = (mouse.current.x || 0) * maxDeg;
-          const rotX = -(mouse.current.y || 0) * maxDeg;
-          el.style.transform = `translateY(-2rem) rotateX(${rotX.toFixed(2)}deg) rotateY(${rotY.toFixed(2)}deg)`;
-        } else {
-          el.style.transform = "translateY(-2rem)";
-        }
-        raf = requestAnimationFrame(tick);
-      };
-      raf = requestAnimationFrame(tick);
-      return () => cancelAnimationFrame(raf);
-    }, [enabled, maxDeg]);
-
-    return (
-      <img
-        ref={imgRef}
-        src={src}
-        alt={alt ?? "Carousel slide"}
-        style={{
-          maxWidth: "86%",
-          maxHeight: "78%",
-          objectFit: "contain",
-          borderRadius: "18px",
-          background: "transparent",
-          transform: "translateY(-2rem)",
-          transition: "transform 80ms ease-out",
-          willChange: "transform",
-          transformOrigin: "50% 50%",
-        }}
-      />
-    );
-  }
-
-  return (
-    <div
-      style={{
-        position: "relative",
-        overflow: "hidden",
-        width: "100%",
-        height: "100%",
-      }}
-    >
-      {showBackground && (
-        <img
-          src={backgroundSrc}
-          alt="Background panel"
-          style={{
-            position: "absolute",
-            inset: 0,
-            width: "100%",
-            height: "100%",
-            objectFit: "cover",
-          }}
-        />
-      )}
-
-      {/* Image slides */}
-      {imageSlides.map((s, idx) => (
-        <div
-          key={s.src}
-          style={{
-            position: "absolute",
-            inset: 0,
-            display: "flex",
-            alignItems: "center",
-            justifyContent: "center",
-            transition: "opacity 600ms ease",
-            opacity: index === idx ? 1 : 0,
-            perspective: "900px",
-          }}
-        >
-          {(s.title || s.subtitle) && (
-            <div
-              style={{
-                position: "absolute",
-                bottom: 24 + 32,
-                left: 0,
-                right: 0,
-                textAlign: "center",
-                padding: "0 2rem",
-                width: "100%",
-              }}
-            >
-              {s.title && (
-                <div
-                  style={{
-                    fontSize: 20,
-                    fontWeight: 800,
-                    color: "#ffffff",
-                    textShadow: "0 2px 6px rgba(0,0,0,0.25)",
-                    marginBottom: 6,
-                  }}
-                >
-                  {s.title}
-                </div>
-              )}
-              {s.subtitle && (
-                <div
-                  style={{
-                    fontSize: 13,
-                    color: "rgba(255,255,255,0.92)",
-                    textShadow: "0 1px 4px rgba(0,0,0,0.25)",
-                  }}
-                >
-                  {s.subtitle}
-                </div>
-              )}
-            </div>
-          )}
-          <TiltImage
-            src={s.src}
-            alt={s.alt}
-            enabled={index === idx && !!s.followMouseTilt}
-            maxDeg={s.tiltMaxDeg ?? 6}
-          />
-        </div>
-      ))}
-
-      {/* Dot navigation */}
-      <CarouselDots
-        tone="onImage"
-        count={totalSlides}
-        activeIndex={index}
-        onSelect={setIndex}
-        label="Slides"
-        style={{
-          position: "absolute",
-          bottom: 16,
-          left: 0,
-          right: 0,
-          justifyContent: "center",
-          zIndex: 2,
-        }}
-      />
-    </div>
-  );
-}
-
-export default memo(LoginRightCarousel);
diff --git a/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.tsx b/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.tsx
index ca8deb3c32..82d05a45ac 100644
--- a/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.tsx
+++ b/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.tsx
@@ -120,21 +120,19 @@ export default function SpringLoginForm({
       {beforeEmailForm}
 
       {renderEmailForm && (
-        <div style={{ marginTop: hasProviders ? "1rem" : 0 }}>
-          <EmailPasswordForm
-            email={email}
-            password={password}
-            setEmail={setEmail}
-            setPassword={setPassword}
-            mfaCode={mfaCode}
-            setMfaCode={setMfaCode}
-            showMfaField={requiresMfa || Boolean(mfaCode)}
-            requiresMfa={requiresMfa}
-            onSubmit={signInWithEmail}
-            isSubmitting={isSubmitting}
-            submitButtonText={submitLabel}
-          />
-        </div>
+        <EmailPasswordForm
+          email={email}
+          password={password}
+          setEmail={setEmail}
+          setPassword={setPassword}
+          mfaCode={mfaCode}
+          setMfaCode={setMfaCode}
+          showMfaField={requiresMfa || Boolean(mfaCode)}
+          requiresMfa={requiresMfa}
+          onSubmit={signInWithEmail}
+          isSubmitting={isSubmitting}
+          submitButtonText={submitLabel}
+        />
       )}
 
       {footer}
diff --git a/frontend/editor/src/proprietary/auth/ui/auth-theme.css b/frontend/editor/src/proprietary/auth/ui/auth-theme.css
index 1da8ba13e8..c1b843e804 100644
--- a/frontend/editor/src/proprietary/auth/ui/auth-theme.css
+++ b/frontend/editor/src/proprietary/auth/ui/auth-theme.css
@@ -2,25 +2,30 @@
 
 :root {
   /* Auth page colors (light mode) */
-  --auth-bg-color-light-only: var(--p-gray-100);
+  --auth-bg-color: var(--p-gray-100);
   --auth-card-bg: #ffffff;
-  --auth-card-bg-light-only: #ffffff;
-  --auth-label-text-light-only: var(--p-gray-700);
-  --auth-input-border-light-only: var(--p-gray-300);
-  --auth-input-bg-light-only: #ffffff;
-  --auth-input-text-light-only: var(--p-gray-900);
-  --auth-border-focus-light-only: var(--p-blue-500);
-  --auth-focus-ring-light-only: color-mix(
+  --auth-label-text: var(--p-gray-700);
+  --auth-input-border: var(--p-gray-300);
+  --auth-input-bg: #ffffff;
+  --auth-input-text: var(--p-gray-900);
+  --auth-border-focus: var(--p-blue-500);
+  --auth-focus-ring: color-mix(in srgb, var(--p-blue-500) 10%, transparent);
+  --auth-button-bg: var(--p-red-600);
+  --auth-button-text: #ffffff;
+  --auth-magic-button-bg: var(--p-gray-200);
+  --auth-magic-button-text: var(--p-gray-700);
+  --auth-text-primary: var(--p-gray-900);
+  --auth-text-secondary: var(--p-gray-500);
+  --auth-error-bg: color-mix(in srgb, var(--p-red-500) 8%, transparent);
+  --auth-error-border: color-mix(in srgb, var(--p-red-500) 25%, transparent);
+  --auth-error-text: var(--p-red-600);
+  --auth-success-bg: color-mix(in srgb, var(--p-green-500) 10%, transparent);
+  --auth-success-border: color-mix(
     in srgb,
-    var(--p-blue-500) 10%,
+    var(--p-green-500) 30%,
     transparent
   );
-  --auth-button-bg-light-only: var(--p-red-600);
-  --auth-button-text-light-only: #ffffff;
-  --auth-magic-button-bg-light-only: var(--p-gray-200);
-  --auth-magic-button-text-light-only: var(--p-gray-700);
-  --auth-text-primary-light-only: var(--p-gray-900);
-  --auth-text-secondary-light-only: var(--p-gray-500);
+  --auth-success-text: var(--p-green-600);
   --text-divider-rule-rgb-light: 229, 231, 235;
   --text-divider-label-rgb-light: 156, 163, 175;
   --tool-subcategory-rule-color-light: var(--p-gray-200);
@@ -28,25 +33,30 @@
 }
 
 [data-mantine-color-scheme="dark"] {
-  --auth-bg-color-light-only: var(--bg-muted);
+  --auth-bg-color: var(--bg-muted);
   --auth-card-bg: var(--bg-surface);
-  --auth-card-bg-light-only: var(--bg-surface);
-  --auth-label-text-light-only: var(--text-secondary);
-  --auth-input-border-light-only: var(--border-default);
-  --auth-input-bg-light-only: var(--bg-raised);
-  --auth-input-text-light-only: var(--text-primary);
-  --auth-border-focus-light-only: var(--p-blue-500);
-  --auth-focus-ring-light-only: color-mix(
+  --auth-label-text: var(--text-secondary);
+  --auth-input-border: var(--border-default);
+  --auth-input-bg: var(--bg-raised);
+  --auth-input-text: var(--text-primary);
+  --auth-border-focus: var(--p-blue-500);
+  --auth-focus-ring: color-mix(in srgb, var(--p-blue-500) 20%, transparent);
+  --auth-button-bg: var(--p-red-600);
+  --auth-button-text: #ffffff;
+  --auth-magic-button-bg: var(--bg-raised);
+  --auth-magic-button-text: var(--text-primary);
+  --auth-text-primary: var(--text-primary);
+  --auth-text-secondary: var(--text-secondary);
+  --auth-error-bg: color-mix(in srgb, var(--p-red-500) 12%, transparent);
+  --auth-error-border: color-mix(in srgb, var(--p-red-500) 35%, transparent);
+  --auth-error-text: var(--p-red-400);
+  --auth-success-bg: color-mix(in srgb, var(--p-green-500) 12%, transparent);
+  --auth-success-border: color-mix(
     in srgb,
-    var(--p-blue-500) 20%,
+    var(--p-green-500) 35%,
     transparent
   );
-  --auth-button-bg-light-only: var(--p-red-600);
-  --auth-button-text-light-only: #ffffff;
-  --auth-magic-button-bg-light-only: var(--bg-raised);
-  --auth-magic-button-text-light-only: var(--text-primary);
-  --auth-text-primary-light-only: var(--text-primary);
-  --auth-text-secondary-light-only: var(--text-secondary);
+  --auth-success-text: var(--p-green-500);
   --text-divider-rule-rgb-light: 28, 35, 64;
   --text-divider-label-rgb-light: 91, 98, 128;
   --tool-subcategory-rule-color-light: var(--border-default);
diff --git a/frontend/editor/src/proprietary/auth/ui/auth.css b/frontend/editor/src/proprietary/auth/ui/auth.css
index 31f1eb480a..1745e1d6b3 100644
--- a/frontend/editor/src/proprietary/auth/ui/auth.css
+++ b/frontend/editor/src/proprietary/auth/ui/auth.css
@@ -10,7 +10,10 @@
   display: flex;
   align-items: center;
   gap: 0.75rem; /* 12px */
-  margin: 0.375rem 0 0.5rem; /* 6px 0 8px */
+  /* Center "or" between the last OAuth button and the input box: the larger top
+     margin balances the field label + input that sit below the smaller bottom
+     margin, so the gap to the button ≈ the gap to the input. */
+  margin: 2.25rem 0 0.75rem; /* 36px top, 12px bottom */
 }
 
 .auth-or-divider__rule {
@@ -33,24 +36,33 @@
 
 .auth-label {
   font-size: 0.875rem; /* 14px */
-  color: var(--auth-label-text-light-only);
+  color: var(--auth-label-text);
   font-weight: 500;
 }
 
+/* Normalize the Mantine inputs used by the login/signup forms so they match the
+   OAuth buttons and submit CTA: same height, radius, and font size. */
+.auth-fields .mantine-Input-input {
+  min-height: 2.625rem; /* 42px */
+  height: 2.625rem;
+  border-radius: 0.625rem; /* 10px */
+  font-size: 0.9375rem; /* 15px */
+}
+
 .auth-input {
   width: 100%;
   padding: 0.625rem 0.75rem; /* 10px 12px */
-  border: 1px solid var(--auth-input-border-light-only);
+  border: 1px solid var(--auth-input-border);
   border-radius: 0.625rem; /* 10px */
   font-size: 0.875rem; /* 14px */
-  background-color: var(--auth-input-bg-light-only);
-  color: var(--auth-input-text-light-only);
+  background-color: var(--auth-input-bg);
+  color: var(--auth-input-text);
   outline: none;
 }
 
 .auth-input:focus {
-  border-color: var(--auth-border-focus-light-only);
-  box-shadow: 0 0 0 3px var(--auth-focus-ring-light-only);
+  border-color: var(--auth-border-focus);
+  box-shadow: 0 0 0 3px var(--auth-focus-ring);
 }
 
 .auth-button {
@@ -58,8 +70,8 @@
   padding: 0.625rem 0.75rem; /* 10px 12px */
   border: none;
   border-radius: 0.625rem; /* 10px */
-  background-color: var(--auth-button-bg-light-only);
-  color: var(--auth-button-text-light-only);
+  background-color: var(--auth-button-bg);
+  color: var(--auth-button-text);
   font-size: 0.875rem; /* 14px */
   font-weight: 600;
   margin-bottom: 0.75rem; /* 12px */
@@ -79,7 +91,7 @@
 .auth-toggle-link {
   background: transparent;
   border: 0;
-  color: var(--auth-label-text-light-only);
+  color: var(--auth-label-text);
   font-size: 0.875rem; /* 14px */
   text-decoration: underline;
   cursor: pointer;
@@ -104,8 +116,8 @@
   padding: 0.875rem 1rem; /* 14px 16px */
   border: none;
   border-radius: 0.625rem; /* 10px */
-  background-color: var(--auth-magic-button-bg-light-only);
-  color: var(--auth-magic-button-text-light-only);
+  background-color: var(--auth-magic-button-bg);
+  color: var(--auth-magic-button-text);
   font-size: 0.875rem; /* 14px */
   font-weight: 600;
   white-space: nowrap;
@@ -132,7 +144,7 @@
 
 .auth-terms-label {
   font-size: 0.75rem; /* 12px */
-  color: var(--auth-label-text-light-only);
+  color: var(--auth-label-text);
 }
 
 .auth-terms-label a {
@@ -182,15 +194,21 @@
   min-height: 3.5rem; /* 56px */
 }
 .oauth-button-fullwidth.sui-btn.mantine-Button-root {
-  border-radius: 100px;
+  border-radius: 0.625rem; /* 10px */
+  min-height: 0;
+}
+
+/* Match the submit CTA's corners to the OAuth buttons and inputs (10px). */
+.auth-submit.sui-btn.mantine-Button-root {
+  border-radius: 0.625rem; /* 10px */
 }
 
 .oauth-button-icon {
   width: 3.75rem; /* 60px */
   height: 3.75rem; /* 60px */
   border-radius: 0.875rem; /* 14px */
-  border: 1px solid var(--auth-input-border-light-only);
-  background: var(--auth-card-bg-light-only);
+  border: 1px solid var(--auth-input-border);
+  background: var(--auth-card-bg);
   cursor: pointer;
   box-shadow: 0 0.125rem 0.375rem rgba(0, 0, 0, 0.04); /* 0 2px 6px */
   display: flex;
@@ -207,8 +225,8 @@
   width: 100%;
   padding: 1rem; /* 16px */
   border-radius: 0.875rem; /* 14px */
-  border: 1px solid var(--auth-input-border-light-only);
-  background: var(--auth-card-bg-light-only);
+  border: 1px solid var(--auth-input-border);
+  background: var(--auth-card-bg);
   cursor: pointer;
   box-shadow: 0 0.125rem 0.375rem rgba(0, 0, 0, 0.04); /* 0 2px 6px */
   display: flex;
@@ -231,12 +249,12 @@
      the Button's own padding-block; horizontal stays in the shorthand. */
   --sui-btn-py: 1rem; /* 16px (md) */
   padding: 1rem 1.5rem; /* 16px 24px */
-  border: 1px solid var(--auth-input-border-light-only);
+  border: 1px solid var(--auth-input-border);
   border-radius: 999px;
-  background-color: var(--auth-card-bg-light-only);
+  background-color: var(--auth-card-bg);
   font-size: 1rem; /* 16px */
   font-weight: 600;
-  color: var(--auth-text-primary-light-only);
+  color: var(--auth-text-primary);
   cursor: pointer;
   gap: 1rem; /* 16px */
   font-family: inherit;
@@ -277,15 +295,15 @@
   padding: 0.75rem 1rem; /* 12px 16px */
   border: 1px solid #d1d5db;
   border-radius: 0.75rem; /* 12px */
-  background-color: var(--auth-card-bg-light-only);
+  background-color: var(--auth-card-bg);
   font-weight: 500;
-  color: var(--auth-text-primary-light-only);
+  color: var(--auth-text-primary);
   box-shadow: none;
 }
 
 .oauth-button-vertical-legacy:hover:not(:disabled) {
   background-color: #f3f4f6;
-  color: var(--auth-text-primary-light-only);
+  color: var(--auth-text-primary);
   box-shadow: none;
 }
 
@@ -378,6 +396,12 @@
   display: block;
 }
 
+/* Fullwidth OAuth rows use a smaller icon so button height matches the inputs. */
+.oauth-button-fullwidth .oauth-icon-medium {
+  width: 1.25rem; /* 20px */
+  height: 1.25rem; /* 20px */
+}
+
 .oauth-icon-tiny {
   width: 1.25rem; /* 20px */
   height: 1.25rem; /* 20px */
@@ -418,7 +442,7 @@
   align-items: center;
   justify-content: center;
   background: var(--bg-muted);
-  border: 1px solid var(--auth-input-border-light-only);
+  border: 1px solid var(--auth-input-border);
 }
 
 .oauth-button-vertical-tinted .oauth-icon-wrapper {
@@ -465,17 +489,17 @@
 }
 
 .sso-demo-card {
-  border: 1px solid var(--auth-input-border-light-only);
+  border: 1px solid var(--auth-input-border);
   border-radius: 1rem;
   padding: 1rem;
-  background: var(--auth-card-bg-light-only);
+  background: var(--auth-card-bg);
   box-shadow: 0 0.25rem 0.75rem rgba(0, 0, 0, 0.06);
 }
 
 .sso-demo-title {
   font-size: 0.875rem;
   font-weight: 700;
-  color: var(--auth-text-primary-light-only);
+  color: var(--auth-text-primary);
   margin-bottom: 0.75rem;
   letter-spacing: 0.01em;
   text-transform: uppercase;
@@ -520,12 +544,12 @@
 .login-title {
   font-size: 2rem; /* 32px */
   font-weight: 800;
-  color: var(--auth-text-primary-light-only);
+  color: var(--auth-text-primary);
   margin: 0 0 0.375rem; /* 0 0 6px */
 }
 
 .login-subtitle {
-  color: var(--auth-text-secondary-light-only);
+  color: var(--auth-text-secondary);
   font-size: 0.875rem; /* 14px */
   margin: 0;
 }
@@ -538,7 +562,7 @@
 .navigation-link-button {
   background: none;
   border: none;
-  color: var(--auth-label-text-light-only);
+  color: var(--auth-label-text);
   font-size: 0.875rem; /* 14px */
   cursor: pointer;
   text-decoration: underline;
@@ -552,46 +576,46 @@
 /* Message Styles */
 .error-message {
   padding: 1rem; /* 16px */
-  background-color: #fef2f2;
-  border: 1px solid #fecaca;
+  background-color: var(--auth-error-bg);
+  border: 1px solid var(--auth-error-border);
   border-radius: 0.5rem; /* 8px */
   margin-bottom: 1.5rem; /* 24px */
 }
 
 .error-message-text {
-  color: #dc2626;
+  color: var(--auth-error-text);
   font-size: 0.875rem; /* 14px */
   margin: 0;
 }
 
 .success-message {
   padding: 1rem; /* 16px */
-  background-color: #f0fdf4;
-  border: 1px solid #bbf7d0;
+  background-color: var(--auth-success-bg);
+  border: 1px solid var(--auth-success-border);
   border-radius: 0.5rem; /* 8px */
   margin-bottom: 1.5rem; /* 24px */
 }
 
 .success-message-text {
-  color: #059669;
+  color: var(--auth-success-text);
   font-size: 0.875rem; /* 14px */
   margin: 0;
 }
 
 /* Field-level error styles */
 .auth-field-error {
-  color: #dc2626;
+  color: var(--auth-error-text);
   font-size: 0.6875rem; /* 11px */
   margin-top: 0.125rem; /* 2px */
   line-height: 1.1;
 }
 
 .auth-input-error {
-  border-color: #dc2626 !important;
+  border-color: var(--auth-error-text) !important;
 }
 
 .auth-input-error:focus {
-  border-color: #dc2626 !important;
+  border-color: var(--auth-error-text) !important;
   box-shadow: 0 0 0 3px rgba(220, 38, 38, 0.1) !important;
 }
 
@@ -626,13 +650,32 @@
   text-decoration: underline;
   cursor: pointer;
   font-size: 0.875rem; /* 14px */
-  color: var(--auth-text-primary-light-only);
+  color: var(--auth-text-primary);
 }
 
 .auth-dot-black {
   opacity: 0.5;
   padding: 0 0.5rem;
-  color: var(--auth-text-primary-light-only);
+  color: var(--auth-text-primary);
+}
+
+/* "Don't have an account? Sign up" row beneath the login form. */
+.auth-signup-prompt {
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 0.375rem; /* 6px */
+  margin-top: 1.5rem; /* 24px */
+  font-size: 0.875rem; /* 14px */
+  color: var(--auth-label-text);
+}
+
+.auth-signup-link.sui-btn.mantine-Button-root {
+  padding: 0;
+  min-height: 0;
+  height: auto;
+  font-size: 0.875rem; /* 14px */
+  font-weight: 700;
 }
 
 /* Email login button - red CTA style matching SaaS version */
@@ -663,7 +706,7 @@
 }
 
 .auth-logo-header {
-  height: 8rem;
+  height: 6.5rem; /* 104px */
   width: auto;
 }
 
@@ -736,12 +779,12 @@
   justify-content: center;
   /* Vertical padding via the shared Button's --sui-btn-py (beats the Button's
      own padding-block); horizontal stays in the shorthand. */
-  --sui-btn-py: 1rem; /* 16px (md) */
-  padding: 1rem 1rem; /* 16px */
+  --sui-btn-py: 0.625rem; /* 10px */
+  padding: 0.625rem 1rem; /* 10px 16px */
   border: 1px solid #d1d5db;
-  border-radius: 100px;
+  border-radius: 0.625rem; /* 10px */
   background-color: #ffffff;
-  font-size: 1rem;
+  font-size: 0.9375rem; /* 15px */
   font-weight: 600;
   color: #000000;
   cursor: pointer;
@@ -811,50 +854,3 @@
   flex-direction: column;
   gap: 0.75rem;
 }
-
-.oauth-button-fullwidth {
-  width: 100%;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  /* Vertical padding via the shared Button's --sui-btn-py (beats the Button's
-     own padding-block); horizontal stays in the shorthand. */
-  --sui-btn-py: 1rem; /* 16px (md) */
-  padding: 1rem 1rem; /* 16px */
-  border: 1px solid #d1d5db;
-  border-radius: 100px;
-  background-color: #ffffff;
-  font-size: 1rem;
-  font-weight: 600;
-  color: #000000;
-  cursor: pointer;
-  gap: 0.5rem;
-  box-shadow: 0 0.125rem 0.375rem rgba(0, 0, 0, 0.04);
-  transition:
-    background-color 150ms ease,
-    box-shadow 150ms ease,
-    border-color 150ms ease;
-}
-
-.oauth-button-fullwidth:disabled {
-  cursor: not-allowed;
-  opacity: 0.6;
-}
-
-.oauth-button-fullwidth:hover:not(:disabled) {
-  background-color: #fafafa;
-  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.08);
-}
-
-[data-mantine-color-scheme="dark"] .oauth-button-fullwidth {
-  background-color: var(--bg-surface);
-  color: var(--text-primary);
-  border-color: var(--border-default);
-  box-shadow: none;
-}
-
-[data-mantine-color-scheme="dark"]
-  .oauth-button-fullwidth:hover:not(:disabled) {
-  background-color: var(--bg-raised);
-  box-shadow: none;
-}
diff --git a/frontend/editor/src/proprietary/auth/ui/loginSlideText.ts b/frontend/editor/src/proprietary/auth/ui/loginSlideText.ts
deleted file mode 100644
index d8bc1e68c2..0000000000
--- a/frontend/editor/src/proprietary/auth/ui/loginSlideText.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { defaultTranslate, type AuthTranslate } from "@app/auth/types";
-
-export type LoginSlideText = {
-  alt: string;
-  title: string;
-  subtitle: string;
-};
-
-/**
- * Shared carousel copy (i18n-optional, English default). The editor and portal
- * both build their slides from this so the text stays in sync; only the images
- * differ (the editor swaps the hero for its logo-variant image). Order matches
- * buildDefaultLoginSlides: [overview, edit, secure].
- *
- * Kept image-free on purpose: the editor imports this without dragging the
- * bundled slide images into its build.
- */
-export function loginSlideText(
-  translate: AuthTranslate = defaultTranslate,
-): LoginSlideText[] {
-  return [
-    {
-      alt: translate("login.slides.overview.alt", "Stirling PDF overview"),
-      title: translate(
-        "login.slides.overview.title",
-        "Your one-stop-shop for all your PDF needs.",
-      ),
-      subtitle: translate(
-        "login.slides.overview.subtitle",
-        "A privacy-first cloud suite for PDFs that lets you convert, sign, redact, and manage documents, along with 50+ other powerful tools.",
-      ),
-    },
-    {
-      alt: translate("login.slides.edit.alt", "Edit PDFs"),
-      title: translate(
-        "login.slides.edit.title",
-        "Edit PDFs to display/secure the information you want",
-      ),
-      subtitle: translate(
-        "login.slides.edit.subtitle",
-        "With over a dozen tools to help you redact, sign, read and manipulate PDFs, you will be sure to find what you are looking for.",
-      ),
-    },
-    {
-      alt: translate("login.slides.secure.alt", "Secure PDFs"),
-      title: translate(
-        "login.slides.secure.title",
-        "Protect sensitive information in your PDFs",
-      ),
-      subtitle: translate(
-        "login.slides.secure.subtitle",
-        "Add passwords, redact content, and manage certificates with ease.",
-      ),
-    },
-  ];
-}
diff --git a/frontend/editor/src/proprietary/auth/ui/loginSlides.ts b/frontend/editor/src/proprietary/auth/ui/loginSlides.ts
deleted file mode 100644
index 86565006d8..0000000000
--- a/frontend/editor/src/proprietary/auth/ui/loginSlides.ts
+++ /dev/null
@@ -1,23 +0,0 @@
-import { defaultTranslate, type AuthTranslate } from "@app/auth/types";
-import type { ImageSlide } from "@app/auth/ui/LoginRightCarousel";
-import { loginSlideText } from "@app/auth/ui/loginSlideText";
-import firstPage from "@app/assets/login/Firstpage.png";
-import addToPdf from "@app/assets/login/AddToPDF.png";
-import securePdf from "@app/assets/login/SecurePDF.png";
-
-const SLIDE_TILT = { followMouseTilt: true, tiltMaxDeg: 5 } as const;
-
-/**
- * Default login carousel slides using bundled images. The portal uses this set;
- * the editor builds its own (logo-variant hero) from loginSlideText.
- */
-export function buildDefaultLoginSlides(
-  translate: AuthTranslate = defaultTranslate,
-): ImageSlide[] {
-  const text = loginSlideText(translate);
-  return [firstPage, addToPdf, securePdf].map((src, i) => ({
-    src,
-    ...text[i],
-    ...SLIDE_TILT,
-  }));
-}
diff --git a/frontend/editor/src/proprietary/components/shared/loginSlides.ts b/frontend/editor/src/proprietary/components/shared/loginSlides.ts
deleted file mode 100644
index 1099330f44..0000000000
--- a/frontend/editor/src/proprietary/components/shared/loginSlides.ts
+++ /dev/null
@@ -1,28 +0,0 @@
-import { BASE_PATH } from "@app/constants/app";
-import { getLogoFolder } from "@app/constants/logo";
-import type { LogoVariant } from "@app/services/preferencesService";
-import type { TFunction } from "i18next";
-import { loginSlideText } from "@app/auth/ui/loginSlideText";
-import type { ImageSlide } from "@app/auth/ui/LoginRightCarousel";
-import addToPdf from "@app/assets/login/AddToPDF.png";
-import securePdf from "@app/assets/login/SecurePDF.png";
-
-const SLIDE_TILT = { followMouseTilt: true, tiltMaxDeg: 5 } as const;
-
-/**
- * Editor login carousel slides. Copy comes from the shared set (so the editor
- * and portal carousels stay in sync) and the edit/secure images are the shared
- * bundled assets; only the hero is the logo-variant image the editor serves
- * from /public.
- */
-export const buildLoginSlides = (
-  variant: LogoVariant | null | undefined,
-  t: TFunction,
-): ImageSlide[] => {
-  const folder = getLogoFolder(variant);
-  const text = loginSlideText((key, fallback) => t(key, fallback));
-  const srcs = [`${BASE_PATH}/${folder}/Firstpage.png`, addToPdf, securePdf];
-  return srcs.map((src, i) => ({ src, ...text[i], ...SLIDE_TILT }));
-};
-
-export default buildLoginSlides;
diff --git a/frontend/editor/src/proprietary/routes/AuthCallback.module.css b/frontend/editor/src/proprietary/routes/AuthCallback.module.css
deleted file mode 100644
index f3bc4e7ecf..0000000000
--- a/frontend/editor/src/proprietary/routes/AuthCallback.module.css
+++ /dev/null
@@ -1,131 +0,0 @@
-.page {
-  min-height: 100vh;
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  padding: 50px 20px;
-  background: #f5f5f5;
-  font-family:
-    -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue",
-    Arial, sans-serif;
-}
-
-.card {
-  background: #ffffff;
-  border-radius: 12px;
-  padding: 40px;
-  max-width: 420px;
-  width: 100%;
-  box-shadow: 0 2px 8px rgba(0, 0, 0, 0.1);
-  text-align: center;
-  color: #1a1a1a;
-  border: 1px solid #e5e7eb;
-}
-
-.icon {
-  font-size: 48px;
-  margin-bottom: 16px;
-}
-
-.iconSuccess {
-  color: #2e7d32;
-}
-
-.iconError {
-  color: #d32f2f;
-}
-
-.iconNeutral {
-  color: #4b5563;
-}
-
-.title {
-  font-size: 24px;
-  font-weight: 600;
-  margin-bottom: 12px;
-  color: #1a1a1a;
-}
-
-.message {
-  color: #666;
-  line-height: 1.6;
-  font-size: 15px;
-}
-
-.loadingExtra {
-  color: #6b7280;
-  margin-top: 12px;
-  font-size: 14px;
-}
-
-.errorBox {
-  margin-top: 20px;
-  background: #ffebee;
-  border: 1px solid #ffcdd2;
-  border-radius: 8px;
-  padding: 16px;
-  color: #c62828;
-  font-size: 14px;
-  line-height: 1.5;
-  word-break: break-word;
-  text-align: left;
-}
-
-@media (prefers-color-scheme: dark) {
-  .page {
-    background: #1a1a1a;
-    color: #e0e0e0;
-  }
-
-  .card {
-    background: #2d2d2d;
-    box-shadow: 0 2px 8px rgba(0, 0, 0, 0.3);
-    color: #e5e7eb;
-    border-color: #374151;
-  }
-
-  .iconSuccess {
-    color: #66bb6a;
-  }
-
-  .iconError {
-    color: #ef5350;
-  }
-
-  .iconNeutral {
-    color: #9ca3af;
-  }
-
-  .title {
-    color: #f5f5f5;
-  }
-
-  .message,
-  .loadingExtra {
-    color: #b0b0b0;
-  }
-
-  .errorBox {
-    background: #3d2020;
-    border: 1px solid #5d3030;
-    color: #ef9a9a;
-  }
-}
-
-@media (max-width: 480px) {
-  .page {
-    padding: 20px 16px;
-  }
-
-  .card {
-    padding: 32px 24px;
-  }
-
-  .title {
-    font-size: 20px;
-  }
-
-  .icon {
-    font-size: 40px;
-  }
-}
diff --git a/frontend/editor/src/proprietary/routes/AuthCallback.tsx b/frontend/editor/src/proprietary/routes/AuthCallback.tsx
index 5d09776df4..4ce0e4b7aa 100644
--- a/frontend/editor/src/proprietary/routes/AuthCallback.tsx
+++ b/frontend/editor/src/proprietary/routes/AuthCallback.tsx
@@ -7,7 +7,11 @@ import {
 } from "@app/auth/spring/springAuthClient";
 import { markLoginLandingPending } from "@app/utils/loginLanding";
 import { handleAuthCallbackSuccess } from "@app/extensions/authCallback";
-import styles from "@app/routes/AuthCallback.module.css";
+import { AuthShell } from "@app/auth/ui/AuthShell";
+import { Spinner } from "@app/ui/Spinner";
+import { withBasePath } from "@app/constants/app";
+import "@app/auth/ui/auth.css";
+import loginHeader from "@app/assets/brand/modern-logo/LoginLightModeHeader.svg";
 import i18n from "@app/i18n";
 
 /**
@@ -125,25 +129,39 @@ export default function AuthCallback() {
   }, []); // Empty deps - only run once on mount. navigate is stable, processingRef prevents double execution
 
   return (
-    <div className={styles.page}>
-      <div className={styles.card}>
-        <div className={`${styles.icon} ${styles.iconNeutral}`}>...</div>
-        <div className={styles.title}>
-          {t("auth.callback.completing", "Completing authentication")}
-        </div>
-        <div className={styles.message}>
-          {t(
-            "auth.callback.pleaseWait",
-            "Please wait while we finish signing you in.",
-          )}
-        </div>
-        <div className={styles.loadingExtra}>
-          {t(
-            "auth.callback.windowMayClose",
-            "You can close this window once it completes.",
-          )}
-        </div>
+    <AuthShell>
+      <div className="auth-logo-block">
+        <img
+          src={loginHeader}
+          alt="Stirling PDF"
+          className="auth-logo-header auth-logo-header--light"
+        />
+        <img
+          src={withBasePath("/modern-logo/LoginDarkModeHeader.svg")}
+          alt="Stirling PDF"
+          className="auth-logo-header auth-logo-header--dark"
+        />
       </div>
-    </div>
+      <h1 className="login-title" style={{ textAlign: "center" }}>
+        {t("auth.callback.completing", "Completing authentication")}
+      </h1>
+      <p className="login-subtitle" style={{ textAlign: "center" }}>
+        {t(
+          "auth.callback.pleaseWait",
+          "Please wait while we finish signing you in.",
+        )}
+      </p>
+      <div
+        style={{ display: "flex", justifyContent: "center", margin: "1rem 0" }}
+      >
+        <Spinner size="md" />
+      </div>
+      <p className="login-subtitle" style={{ textAlign: "center" }}>
+        {t(
+          "auth.callback.windowMayClose",
+          "You can close this window once it completes.",
+        )}
+      </p>
+    </AuthShell>
   );
 }
diff --git a/frontend/editor/src/proprietary/routes/InviteAccept.tsx b/frontend/editor/src/proprietary/routes/InviteAccept.tsx
index 080cf4275a..46431c3039 100644
--- a/frontend/editor/src/proprietary/routes/InviteAccept.tsx
+++ b/frontend/editor/src/proprietary/routes/InviteAccept.tsx
@@ -16,6 +16,8 @@ import { useDocumentMeta } from "@app/hooks/useDocumentMeta";
 import AuthLayout from "@app/routes/authShared/AuthLayout";
 import LoginHeader from "@app/routes/login/LoginHeader";
 import ErrorMessage from "@app/auth/ui/ErrorMessage";
+import { authInputStyles } from "@app/auth/ui/EmailPasswordForm";
+import "@app/auth/ui/auth.css";
 import { BASE_PATH } from "@app/constants/app";
 import apiClient from "@app/services/apiClient";
 import { Button } from "@app/ui/Button";
@@ -162,15 +164,17 @@ export default function InviteAccept() {
           title={t("invite.invalidInvitation", "Invalid Invitation")}
         />
         <ErrorMessage error={error} />
-        <div className="auth-section">
-          <Button
-            type="button"
-            onClick={() => navigate("/login")}
-            className="w-full px-4 py-[0.75rem] rounded-[0.625rem] text-base font-semibold cursor-pointer border-0 auth-cta-button"
-          >
-            {t("invite.goToLogin", "Go to Login")}
-          </Button>
-        </div>
+        <Button
+          type="button"
+          onClick={() => navigate("/login")}
+          fullWidth
+          size="lg"
+          fontSize="sm"
+          accent="brand"
+          className="auth-submit"
+        >
+          {t("invite.goToLogin", "Go to Login")}
+        </Button>
       </AuthLayout>
     );
   }
@@ -186,13 +190,7 @@ export default function InviteAccept() {
       />
 
       {inviteData && !inviteData.emailRequired && (
-        <Paper
-          withBorder
-          p="md"
-          mb="lg"
-          bg="blue.0"
-          style={{ borderColor: "var(--mantine-color-blue-3)" }}
-        >
+        <Paper withBorder p="md" mb="lg">
           <Stack gap="xs" align="center">
             <Text
               size="xs"
@@ -218,58 +216,76 @@ export default function InviteAccept() {
       <ErrorMessage error={error} />
 
       <form onSubmit={handleAccept}>
-        <Stack gap="md">
+        <div className="auth-fields">
           {inviteData?.emailRequired && (
-            <TextInput
-              label={t("invite.email", "Email address")}
-              type="email"
-              value={email}
-              onChange={(e) => setEmail(e.target.value)}
+            <div className="auth-field">
+              <TextInput
+                label={t("invite.email", "Email address")}
+                type="email"
+                value={email}
+                onChange={(e) => setEmail(e.target.value)}
+                placeholder={t(
+                  "invite.emailPlaceholder",
+                  "Enter your email address",
+                )}
+                disabled={submitting}
+                required
+                autoComplete="email"
+                classNames={{ label: "auth-label" }}
+                styles={authInputStyles}
+              />
+            </div>
+          )}
+
+          <div className="auth-field">
+            <PasswordInput
+              label={t("invite.choosePassword", "Choose a password")}
+              value={password}
+              onChange={(e) => setPassword(e.target.value)}
               placeholder={t(
-                "invite.emailPlaceholder",
-                "Enter your email address",
+                "invite.passwordPlaceholder",
+                "Enter your password",
               )}
               disabled={submitting}
               required
-              autoComplete="email"
+              autoComplete="new-password"
+              classNames={{ label: "auth-label" }}
+              styles={authInputStyles}
             />
-          )}
-
-          <PasswordInput
-            label={t("invite.choosePassword", "Choose a password")}
-            value={password}
-            onChange={(e) => setPassword(e.target.value)}
-            placeholder={t("invite.passwordPlaceholder", "Enter your password")}
-            disabled={submitting}
-            required
-            autoComplete="new-password"
-          />
-
-          <PasswordInput
-            label={t("invite.confirmPassword", "Confirm password")}
-            value={confirmPassword}
-            onChange={(e) => setConfirmPassword(e.target.value)}
-            placeholder={t(
-              "invite.confirmPasswordPlaceholder",
-              "Re-enter your password",
-            )}
-            disabled={submitting}
-            required
-            autoComplete="new-password"
-          />
-
-          <div className="auth-section">
-            <Button
-              type="submit"
-              disabled={submitting}
-              className="w-full px-4 py-[0.75rem] rounded-[0.625rem] text-base font-semibold cursor-pointer border-0 disabled:opacity-50 disabled:cursor-not-allowed auth-cta-button"
-            >
-              {submitting
-                ? t("invite.creating", "Creating Account...")
-                : t("invite.createAccount", "Create Account")}
-            </Button>
           </div>
-        </Stack>
+
+          <div className="auth-field">
+            <PasswordInput
+              label={t("invite.confirmPassword", "Confirm password")}
+              value={confirmPassword}
+              onChange={(e) => setConfirmPassword(e.target.value)}
+              placeholder={t(
+                "invite.confirmPasswordPlaceholder",
+                "Re-enter your password",
+              )}
+              disabled={submitting}
+              required
+              autoComplete="new-password"
+              classNames={{ label: "auth-label" }}
+              styles={authInputStyles}
+            />
+          </div>
+        </div>
+
+        <Button
+          type="submit"
+          disabled={submitting}
+          loading={submitting}
+          fullWidth
+          size="lg"
+          fontSize="sm"
+          accent="brand"
+          className="auth-submit"
+        >
+          {submitting
+            ? t("invite.creating", "Creating Account...")
+            : t("invite.createAccount", "Create Account")}
+        </Button>
       </form>
 
       <Center mt="md">
diff --git a/frontend/editor/src/proprietary/routes/Login.tsx b/frontend/editor/src/proprietary/routes/Login.tsx
index a59072d5f4..b21b9e1dd6 100644
--- a/frontend/editor/src/proprietary/routes/Login.tsx
+++ b/frontend/editor/src/proprietary/routes/Login.tsx
@@ -5,7 +5,6 @@ import {
   useNavigate,
   useSearchParams,
 } from "react-router-dom";
-import { Text, Stack, Alert } from "@mantine/core";
 import { Button } from "@app/ui/Button";
 import { setPostLoginRedirectPath } from "@app/auth/spring/springAuthClient";
 import { markLoginLandingPending } from "@app/utils/loginLanding";
@@ -22,6 +21,8 @@ import {
   oauthProviderConfig,
 } from "@app/auth/ui/OAuthButtons";
 import SpringLoginForm from "@app/auth/ui/SpringLoginForm";
+import AuthSignupPrompt from "@app/auth/ui/AuthSignupPrompt";
+import AuthDefaultCredentials from "@app/auth/ui/AuthDefaultCredentials";
 import { useSpringLogin } from "@app/auth/ui/useSpringLogin";
 import LoggedInState from "@app/routes/login/LoggedInState";
 import loginHeader from "@app/assets/brand/modern-logo/LoginLightModeHeader.svg";
@@ -514,59 +515,14 @@ export default function Login() {
           ) : undefined
         }
         footer={
-          isFirstTimeSetup && showDefaultCredentials && isUserPassAllowed ? (
-            <Alert color="blue" variant="light" radius="md" mt="xl">
-              <Stack gap="xs" align="center">
-                <Text
-                  size="sm"
-                  fw={600}
-                  ta="center"
-                  style={{ color: "var(--text-primary)" }}
-                >
-                  {t("login.defaultCredentials", "Default Login Credentials")}
-                </Text>
-                <Text
-                  size="sm"
-                  ta="center"
-                  style={{ color: "var(--text-primary)" }}
-                >
-                  <Text
-                    component="span"
-                    fw={600}
-                    style={{ color: "var(--text-primary)" }}
-                  >
-                    {t("login.username", "Username")}:
-                  </Text>{" "}
-                  admin
-                </Text>
-                <Text
-                  size="sm"
-                  ta="center"
-                  style={{ color: "var(--text-primary)" }}
-                >
-                  <Text
-                    component="span"
-                    fw={600}
-                    style={{ color: "var(--text-primary)" }}
-                  >
-                    {t("login.password", "Password")}:
-                  </Text>{" "}
-                  stirling
-                </Text>
-                <Text
-                  size="xs"
-                  ta="center"
-                  mt="xs"
-                  style={{ color: "var(--text-muted)" }}
-                >
-                  {t(
-                    "login.changePasswordWarning",
-                    "Please change your password after logging in for the first time",
-                  )}
-                </Text>
-              </Stack>
-            </Alert>
-          ) : undefined
+          <>
+            {isFirstTimeSetup &&
+              showDefaultCredentials &&
+              isUserPassAllowed && <AuthDefaultCredentials />}
+            {isUserPassAllowed && (
+              <AuthSignupPrompt onSignUp={() => navigate("/signup")} />
+            )}
+          </>
         }
       />
     </AuthLayout>
diff --git a/frontend/editor/src/proprietary/routes/authShared/AuthLayout.tsx b/frontend/editor/src/proprietary/routes/authShared/AuthLayout.tsx
index 69229639e4..5078de9242 100644
--- a/frontend/editor/src/proprietary/routes/authShared/AuthLayout.tsx
+++ b/frontend/editor/src/proprietary/routes/authShared/AuthLayout.tsx
@@ -1,9 +1,5 @@
-import React, { useMemo } from "react";
-import { useTranslation } from "react-i18next";
+import React from "react";
 import { AuthShell } from "@app/auth/ui/AuthShell";
-import LoginRightCarousel from "@app/auth/ui/LoginRightCarousel";
-import buildLoginSlides from "@app/components/shared/loginSlides";
-import { useLogoVariant } from "@app/hooks/useLogoVariant";
 import Footer from "@app/components/shared/Footer";
 
 interface AuthLayoutProps {
@@ -11,30 +7,9 @@ interface AuthLayoutProps {
 }
 
 /**
- * Editor login layout. The card shell + carousel now live in shared so the
- * portal renders the identical screen; this wires the editor's logo-variant
- * slides and legal/cookie footer into that shared shell.
+ * Editor login layout. The card shell lives in shared so the portal renders
+ * the identical screen; this wires the editor's legal/cookie footer into it.
  */
 export default function AuthLayout({ children }: AuthLayoutProps) {
-  const { t } = useTranslation();
-  const logoVariant = useLogoVariant();
-  const imageSlides = useMemo(
-    () => buildLoginSlides(logoVariant, t),
-    [logoVariant, t],
-  );
-
-  return (
-    <AuthShell
-      rightPanel={
-        <LoginRightCarousel
-          imageSlides={imageSlides}
-          initialSeconds={5}
-          slideSeconds={8}
-        />
-      }
-      footer={<Footer />}
-    >
-      {children}
-    </AuthShell>
-  );
+  return <AuthShell footer={<Footer />}>{children}</AuthShell>;
 }
diff --git a/frontend/editor/src/proprietary/routes/signup/SignupForm.tsx b/frontend/editor/src/proprietary/routes/signup/SignupForm.tsx
index 8b6ef3d272..4a1f9f37aa 100644
--- a/frontend/editor/src/proprietary/routes/signup/SignupForm.tsx
+++ b/frontend/editor/src/proprietary/routes/signup/SignupForm.tsx
@@ -160,8 +160,11 @@ export default function SignupForm({
           !confirmPassword ||
           (showTerms && !agree)
         }
-        className="auth-button"
+        className="auth-submit"
         fullWidth
+        size="lg"
+        fontSize="sm"
+        accent="brand"
         loading={isSubmitting}
       >
         {isSubmitting ? t("signup.creatingAccount") : t("signup.signUp")}
diff --git a/frontend/editor/src/saas/routes/AuthCallback.tsx b/frontend/editor/src/saas/routes/AuthCallback.tsx
index eeeac1ff33..a1d8af049c 100644
--- a/frontend/editor/src/saas/routes/AuthCallback.tsx
+++ b/frontend/editor/src/saas/routes/AuthCallback.tsx
@@ -4,6 +4,11 @@ import { supabase } from "@app/auth/supabase";
 import { Button } from "@app/ui/Button";
 import { withBasePath } from "@app/constants/app";
 import { markLoginLandingPending } from "@app/utils/loginLanding";
+import { AuthShell } from "@app/auth/ui/AuthShell";
+import ErrorMessage from "@app/auth/ui/ErrorMessage";
+import { Spinner } from "@app/ui/Spinner";
+import "@app/auth/ui/auth.css";
+import loginHeader from "@app/assets/brand/modern-logo/LoginLightModeHeader.svg";
 
 interface CallbackState {
   status: "processing" | "success" | "error";
@@ -151,19 +156,6 @@ export default function AuthCallback() {
     handleCallback();
   }, [navigate]);
 
-  const getStatusColor = () => {
-    switch (state.status) {
-      case "processing":
-        return "text-blue-600";
-      case "success":
-        return "text-green-600";
-      case "error":
-        return "text-red-600";
-      default:
-        return "text-gray-600";
-    }
-  };
-
   const getTitle = () => {
     switch (state.status) {
       case "processing":
@@ -178,64 +170,66 @@ export default function AuthCallback() {
   };
 
   return (
-    <div className="relative min-h-screen flex items-center justify-center overflow-hidden bg-gradient-to-br from-slate-50 via-white to-slate-100">
-      <div aria-hidden className="pointer-events-none absolute inset-0 -z-10">
-        <div className="absolute -top-32 -left-32 h-96 w-96 rounded-full bg-blue-200/40 blur-3xl"></div>
-        <div className="absolute -bottom-32 -right-32 h-96 w-96 rounded-full bg-emerald-200/40 blur-3xl"></div>
+    <AuthShell>
+      <div className="auth-logo-block">
+        <img
+          src={loginHeader}
+          alt="Stirling PDF"
+          className="auth-logo-header auth-logo-header--light"
+        />
+        <img
+          src={withBasePath("/modern-logo/LoginDarkModeHeader.svg")}
+          alt="Stirling PDF"
+          className="auth-logo-header auth-logo-header--dark"
+        />
       </div>
 
-      <div
-        className={`w-full max-w-md rounded-2xl bg-white/80 backdrop-blur shadow-xl p-8`}
-      >
-        <div className="text-center">
-          <img
-            src={withBasePath("/modern-logo/StirlingPDFLogoNoTextDark.svg")}
-            alt="Stirling PDF"
-            className="mx-auto mb-5 h-8 opacity-80"
-          />
+      <h1 className="login-title" style={{ textAlign: "center" }}>
+        {getTitle()}
+      </h1>
 
-          <h1 className="text-2xl font-bold text-gray-900 mb-2">
-            {getTitle()}
-          </h1>
-          <p className={`text-base ${getStatusColor()}`}>{state.message}</p>
+      {state.status === "error" ? (
+        <ErrorMessage error={state.message} />
+      ) : (
+        <p className="login-subtitle" style={{ textAlign: "center" }}>
+          {state.message}
+        </p>
+      )}
 
-          {state.status === "processing" && (
-            <div className="mt-6">
-              <div className="animate-spin rounded-full h-8 w-8 border-b-2 border-blue-600 mx-auto"></div>
-              <div className="mt-3 h-1 overflow-hidden rounded-full bg-slate-200">
-                <div className="h-full w-1/2 animate-pulse rounded-full bg-blue-500"></div>
-              </div>
-            </div>
-          )}
-
-          {/* Action button - only show if error */}
-          <div className="mt-6 flex items-center justify-center gap-3">
-            {(() => {
-              if (state.status === "error") {
-                return (
-                  <Button
-                    accent="danger"
-                    onClick={() => navigate("/login", { replace: true })}
-                  >
-                    Back to login
-                  </Button>
-                );
-              }
-            })()}
-          </div>
-
-          {import.meta.env.DEV && state.details && (
-            <details className="mt-6 text-left">
-              <summary className="cursor-pointer text-sm text-gray-500 hover:text-gray-700">
-                Debug Information
-              </summary>
-              <pre className="mt-2 p-3 bg-gray-100 rounded text-xs overflow-auto">
-                {JSON.stringify(state.details, null, 2)}
-              </pre>
-            </details>
-          )}
+      {state.status === "processing" && (
+        <div
+          style={{
+            display: "flex",
+            justifyContent: "center",
+            margin: "1rem 0",
+          }}
+        >
+          <Spinner size="md" />
         </div>
-      </div>
-    </div>
+      )}
+
+      {state.status === "error" && (
+        <div className="auth-section">
+          <Button
+            accent="danger"
+            fullWidth
+            onClick={() => navigate("/login", { replace: true })}
+          >
+            Back to login
+          </Button>
+        </div>
+      )}
+
+      {import.meta.env.DEV && state.details && (
+        <details className="mt-6 text-left">
+          <summary className="cursor-pointer text-sm text-gray-500 hover:text-gray-700">
+            Debug Information
+          </summary>
+          <pre className="mt-2 p-3 bg-gray-100 rounded text-xs overflow-auto">
+            {JSON.stringify(state.details, null, 2)}
+          </pre>
+        </details>
+      )}
+    </AuthShell>
   );
 }
diff --git a/frontend/editor/src/saas/routes/Login.tsx b/frontend/editor/src/saas/routes/Login.tsx
index 5a8e135450..25bad2570d 100644
--- a/frontend/editor/src/saas/routes/Login.tsx
+++ b/frontend/editor/src/saas/routes/Login.tsx
@@ -269,7 +269,7 @@ export default function Login() {
   };
 
   return (
-    <AuthLayout isEmailFormExpanded={showEmailForm || showMagicLinkForm}>
+    <AuthLayout>
       {/* Centered logo */}
       <div className="auth-logo-block">
         <img
diff --git a/frontend/editor/src/saas/routes/OAuthConsent.tsx b/frontend/editor/src/saas/routes/OAuthConsent.tsx
index d851a91a53..f22f13fa19 100644
--- a/frontend/editor/src/saas/routes/OAuthConsent.tsx
+++ b/frontend/editor/src/saas/routes/OAuthConsent.tsx
@@ -1,5 +1,6 @@
 import { useCallback, useEffect, useMemo, useState } from "react";
 import { useLocation, useNavigate } from "react-router-dom";
+import { List, Paper, Text } from "@mantine/core";
 import { Button } from "@app/ui/Button";
 import { useAuth } from "@app/auth/UseSession";
 import { useTranslation } from "@app/hooks/useTranslation";
@@ -225,18 +226,12 @@ export default function OAuthConsent() {
     return (
       <AuthLayout>
         {logoBlock}
-        <p
-          style={{
-            textAlign: "center",
-            marginBottom: "1.5rem",
-            color: "#374151",
-          }}
-        >
+        <Text ta="center" c="dimmed" mb="lg">
           {t(
             "oauthConsent.signInPrompt",
             "Sign in to your Stirling PDF account to continue connecting the app.",
           )}
-        </p>
+        </Text>
         <Button
           variant="secondary"
           className="oauth-button-fullwidth"
@@ -252,11 +247,11 @@ export default function OAuthConsent() {
     return (
       <AuthLayout>
         {logoBlock}
-        <p style={{ textAlign: "center", color: "#6b7280" }}>
+        <Text ta="center" c="dimmed">
           {redirecting
             ? t("oauthConsent.redirecting", "Returning you to the app...")
             : t("oauthConsent.loading", "Loading authorization request...")}
-        </p>
+        </Text>
       </AuthLayout>
     );
   }
@@ -274,106 +269,57 @@ export default function OAuthConsent() {
     <AuthLayout>
       {logoBlock}
 
-      {/* AuthLayout forces light mode but text without explicit colors still
-          inherits dark-scheme values from the app CSS; pin them like the rest
-          of the auth pages do. */}
-      <h2
-        style={{
-          textAlign: "center",
-          fontSize: "1.25rem",
-          fontWeight: 700,
-          marginBottom: "0.5rem",
-          color: "#111827",
-        }}
-      >
+      <Text component="h2" ta="center" fw={700} fz="xl" mb="xs">
         {t("oauthConsent.title", "Authorize access")}
-      </h2>
-      <p
-        style={{
-          textAlign: "center",
-          marginBottom: "1.5rem",
-          color: "#374151",
-        }}
-      >
+      </Text>
+      <Text ta="center" c="dimmed" mb="lg">
         {t("oauthConsent.requesting", {
           app: appName,
           defaultValue: `${appName} wants to access your Stirling PDF account`,
         })}
-      </p>
+      </Text>
 
       {/* Be explicit about what connecting actually grants. The OAuth scopes
           (openid/email) only cover identity; the real power is that the issued
           token lets the app drive the MCP endpoint - i.e. run any Stirling PDF
           tool as this user, audited as them and counted against their usage. */}
-      <div
-        style={{
-          border: "1px solid #e5e7eb",
-          borderRadius: "0.5rem",
-          padding: "1rem 1.25rem",
-          marginBottom: "1.5rem",
-          background: "#ffffff",
-        }}
-      >
-        <p
-          style={{
-            fontSize: "0.875rem",
-            fontWeight: 600,
-            margin: "0 0 0.5rem",
-            color: "#111827",
-          }}
-        >
+      <Paper withBorder p="md" mb="lg">
+        <Text fw={600} fz="sm" mb="xs">
           {t("oauthConsent.scopesIntro", {
             app: appName,
             defaultValue: `This will allow ${appName} to:`,
           })}
-        </p>
-        <ul
-          style={{
-            margin: 0,
-            paddingLeft: "1.25rem",
-            display: "flex",
-            flexDirection: "column",
-            gap: "0.25rem",
-          }}
-        >
-          <li style={{ fontSize: "0.875rem", color: "#374151" }}>
+        </Text>
+        <List size="sm" spacing={4} c="dimmed">
+          <List.Item>
             {t("oauthConsent.access.tools", {
               app: appName,
               defaultValue: `Use your Stirling PDF tools on your behalf - convert, edit, sign, secure and process your documents`,
             })}
-          </li>
-          <li style={{ fontSize: "0.875rem", color: "#374151" }}>
+          </List.Item>
+          <List.Item>
             {t("oauthConsent.access.actAsYou", {
               app: appName,
               defaultValue: `Act as you - everything ${appName} does runs under your account and counts towards your usage`,
             })}
-          </li>
+          </List.Item>
           {scopes.map((scope) => (
-            <li key={scope} style={{ fontSize: "0.875rem", color: "#374151" }}>
-              {scopeDescription(scope)}
-            </li>
+            <List.Item key={scope}>{scopeDescription(scope)}</List.Item>
           ))}
-        </ul>
-      </div>
+        </List>
+      </Paper>
 
       <ErrorMessage error={error} />
 
-      <div style={{ display: "flex", flexDirection: "column", gap: "0.75rem" }}>
+      <div className="oauth-container-fullwidth">
         <Button
+          fullWidth
+          size="lg"
+          fontSize="sm"
+          accent="brand"
+          className="auth-submit"
           disabled={deciding !== null}
           onClick={() => decide("approve")}
-          style={{
-            width: "100%",
-            padding: "0.75rem",
-            borderRadius: "0.5rem",
-            border: "none",
-            background: "#000000",
-            color: "#ffffff",
-            fontWeight: 700,
-            fontSize: "1rem",
-            cursor: deciding ? "default" : "pointer",
-            opacity: deciding && deciding !== "approve" ? 0.6 : 1,
-          }}
         >
           {deciding === "approve"
             ? t("oauthConsent.approving", "Allowing...")
@@ -392,19 +338,12 @@ export default function OAuthConsent() {
       </div>
 
       {displayName && (
-        <p
-          style={{
-            textAlign: "center",
-            fontSize: "0.8125rem",
-            color: "#9ca3af",
-            marginTop: "1.25rem",
-          }}
-        >
+        <Text size="sm" c="dimmed" ta="center" mt="lg">
           {t("oauthConsent.signedInAs", {
             name: displayName,
             defaultValue: `Signed in as ${displayName}`,
           })}
-        </p>
+        </Text>
       )}
     </AuthLayout>
   );
diff --git a/frontend/editor/src/saas/routes/Signup.tsx b/frontend/editor/src/saas/routes/Signup.tsx
index 3836c60ac1..ec59c8cc71 100644
--- a/frontend/editor/src/saas/routes/Signup.tsx
+++ b/frontend/editor/src/saas/routes/Signup.tsx
@@ -182,7 +182,7 @@ export default function Signup() {
   };
 
   return (
-    <AuthLayout isEmailFormExpanded={showEmailForm}>
+    <AuthLayout>
       {/* Centered logo */}
       <div className="auth-logo-block">
         <img
diff --git a/frontend/editor/src/saas/routes/authShared/AuthLayout.module.css b/frontend/editor/src/saas/routes/authShared/AuthLayout.module.css
deleted file mode 100644
index bf06dbfd22..0000000000
--- a/frontend/editor/src/saas/routes/authShared/AuthLayout.module.css
+++ /dev/null
@@ -1,75 +0,0 @@
-.authContainer {
-  position: relative;
-  min-height: 100vh;
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  background-color: var(--auth-bg-color-light-only);
-  padding: 1.5rem 1.5rem 0;
-  font-family:
-    -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
-  overflow: auto;
-}
-
-/* Main area above footer: keep card centered even with footer visible */
-.authMain {
-  width: 100%;
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  min-height: 95vh;
-}
-
-.authCard {
-  width: min(45rem, 96vw);
-  height: min(50.875rem, 96vh);
-  display: grid;
-  grid-template-columns: 1fr;
-  background-color: var(--auth-card-bg);
-  border-radius: 1.25rem;
-  box-shadow: 0 1.25rem 3.75rem rgba(0, 0, 0, 0.12);
-  overflow: hidden;
-  min-height: 0;
-  max-height: 96vh;
-}
-
-.authCardTwoColumns {
-  width: min(73.75rem, 96vw);
-  grid-template-columns: 1fr 1fr;
-}
-
-.authLeftPanel {
-  display: flex;
-  justify-content: center;
-  padding: 2rem;
-  min-height: 0;
-  height: 100%;
-}
-
-.authLeftPanelCentered {
-  align-items: center;
-  overflow: hidden;
-}
-
-.authLeftPanelScrollable {
-  align-items: flex-start;
-  overflow-y: auto;
-  overflow-x: hidden;
-}
-
-.authLeftPanel::-webkit-scrollbar {
-  display: none; /* WebKit browsers (Chrome, Safari, Edge) */
-}
-
-.authContent {
-  max-width: 26.25rem; /* 420px */
-  width: 100%;
-  display: flex;
-  flex-direction: column;
-}
-
-.authLeftPanelScrollable .authContent {
-  min-height: 100%;
-}
diff --git a/frontend/editor/src/saas/routes/authShared/AuthLayout.tsx b/frontend/editor/src/saas/routes/authShared/AuthLayout.tsx
index 84937053f1..71e9519c12 100644
--- a/frontend/editor/src/saas/routes/authShared/AuthLayout.tsx
+++ b/frontend/editor/src/saas/routes/authShared/AuthLayout.tsx
@@ -1,87 +1,11 @@
-import React, { useEffect, useMemo, useRef, useState } from "react";
-import { useTranslation } from "react-i18next";
-import LoginRightCarousel from "@app/auth/ui/LoginRightCarousel";
-import buildLoginSlides from "@app/components/shared/loginSlides";
-import styles from "@app/routes/authShared/AuthLayout.module.css";
-import { useLogoVariant } from "@app/hooks/useLogoVariant";
-import { useIsOverflowing } from "@app/hooks/useIsOverflowing";
+import React from "react";
+import { AuthShell } from "@app/auth/ui/AuthShell";
 import Footer from "@app/components/shared/Footer";
 
 interface AuthLayoutProps {
   children: React.ReactNode;
-  isEmailFormExpanded?: boolean;
 }
 
-export default function AuthLayout({
-  children,
-  isEmailFormExpanded = false,
-}: AuthLayoutProps) {
-  const { t } = useTranslation();
-  const cardRef = useRef<HTMLDivElement | null>(null);
-  const leftPanelRef = useRef<HTMLDivElement | null>(null);
-  const [hideRightPanel, setHideRightPanel] = useState(false);
-  const logoVariant = useLogoVariant();
-  const imageSlides = useMemo(
-    () => buildLoginSlides(logoVariant, t),
-    [logoVariant, t],
-  );
-  const isOverflowing = useIsOverflowing(leftPanelRef);
-
-  // Use either overflow detection or email form expansion to determine scrollable state
-  const shouldBeScrollable = isOverflowing || isEmailFormExpanded;
-
-  useEffect(() => {
-    const update = () => {
-      // Use viewport to avoid hysteresis when the card is already in single-column mode
-      const viewportWidth = window.innerWidth;
-      const viewportHeight = window.innerHeight;
-      const cardWidthIfTwoCols = Math.min(1180, viewportWidth * 0.96); // matches min(73.75rem, 96vw)
-      const columnWidth = cardWidthIfTwoCols / 2;
-      const tooNarrow = columnWidth < 470;
-      const tooShort = viewportHeight < 740;
-      setHideRightPanel(tooNarrow || tooShort);
-    };
-    update();
-    window.addEventListener("resize", update);
-    window.addEventListener("orientationchange", update);
-    return () => {
-      window.removeEventListener("resize", update);
-      window.removeEventListener("orientationchange", update);
-    };
-  }, []);
-
-  return (
-    <div className={styles.authContainer}>
-      <div className={styles.authMain}>
-        <div
-          ref={cardRef}
-          className={`${styles.authCard} ${!hideRightPanel ? styles.authCardTwoColumns : ""}`}
-        >
-          <div
-            ref={leftPanelRef}
-            className={`${styles.authLeftPanel} ${shouldBeScrollable ? styles.authLeftPanelScrollable : styles.authLeftPanelCentered}`}
-          >
-            <div className={styles.authContent}>{children}</div>
-          </div>
-          {!hideRightPanel && (
-            <LoginRightCarousel
-              imageSlides={imageSlides}
-              initialSeconds={5}
-              slideSeconds={8}
-            />
-          )}
-        </div>
-      </div>
-      <div
-        style={{
-          width: "100vw",
-          marginTop: "auto",
-          marginLeft: "-1.5rem",
-          marginRight: "-1.5rem",
-        }}
-      >
-        <Footer analyticsEnabled />
-      </div>
-    </div>
-  );
+export default function AuthLayout({ children }: AuthLayoutProps) {
+  return <AuthShell footer={<Footer analyticsEnabled />}>{children}</AuthShell>;
 }
diff --git a/frontend/editor/src/saas/styles/saas-theme.css b/frontend/editor/src/saas/styles/saas-theme.css
index f401f2cf47..44a016eb5d 100644
--- a/frontend/editor/src/saas/styles/saas-theme.css
+++ b/frontend/editor/src/saas/styles/saas-theme.css
@@ -24,7 +24,7 @@
   --tool-subcategory-text-color-light: var(--p-gray-400);
   --tool-subcategory-rule-color-light: var(--p-gray-200);
 
-  /* Auth color vars */
+  /* Auth color vars (light mode) */
   --auth-input-bg: var(--p-gray-50);
   --auth-input-border: var(--p-gray-200);
   --auth-input-text: var(--p-gray-800);
@@ -33,26 +33,22 @@
   --auth-button-text: #ffffff;
   --auth-magic-button-bg: var(--p-red-600);
   --auth-magic-button-text: #ffffff;
-
-  /* Light-only auth colors (no dark mode equivalents) used for login/signup */
-  --auth-input-bg-light-only: var(--p-gray-50);
-  --auth-input-border-light-only: var(--p-gray-200);
-  --auth-input-text-light-only: var(--p-gray-800);
-  --auth-label-text-light-only: var(--p-zinc-650);
-  --auth-button-bg-light-only: var(--p-red-600);
-  --auth-button-text-light-only: #ffffff;
-  --auth-magic-button-bg-light-only: var(--p-red-600);
-  --auth-magic-button-text-light-only: #ffffff;
-  --auth-bg-color-light-only: #ffffff;
-  --auth-card-bg-light-only: #ffffff;
-  --auth-text-primary-light-only: var(--p-zinc-650);
-  --auth-text-secondary-light-only: var(--p-gray-800);
-  --auth-border-focus-light-only: var(--p-gray-300);
-  --auth-focus-ring-light-only: color-mix(
+  --auth-bg-color: #ffffff;
+  --auth-card-bg: #ffffff;
+  --auth-text-primary: var(--p-zinc-650);
+  --auth-text-secondary: var(--p-gray-800);
+  --auth-border-focus: var(--p-gray-300);
+  --auth-focus-ring: color-mix(in srgb, var(--p-blue-500) 15%, transparent);
+  --auth-error-bg: color-mix(in srgb, var(--p-red-500) 8%, transparent);
+  --auth-error-border: color-mix(in srgb, var(--p-red-500) 25%, transparent);
+  --auth-error-text: var(--p-red-600);
+  --auth-success-bg: color-mix(in srgb, var(--p-green-500) 10%, transparent);
+  --auth-success-border: color-mix(
     in srgb,
-    var(--p-blue-500) 15%,
+    var(--p-green-500) 30%,
     transparent
   );
+  --auth-success-text: var(--p-green-600);
 
   /* App Config Modal colors (light mode) */
   --modal-nav-bg: var(--p-gray-100);
@@ -123,25 +119,30 @@
   --color-orange-400: var(--p-red-600);
 
   /* Auth page colors (dark mode) — mirror proprietary so the auth card themes dark */
-  --auth-bg-color-light-only: var(--bg-muted);
+  --auth-bg-color: var(--bg-muted);
   --auth-card-bg: var(--bg-surface);
-  --auth-card-bg-light-only: var(--bg-surface);
-  --auth-label-text-light-only: var(--text-secondary);
-  --auth-input-border-light-only: var(--border-default);
-  --auth-input-bg-light-only: var(--bg-raised);
-  --auth-input-text-light-only: var(--text-primary);
-  --auth-border-focus-light-only: var(--p-blue-500);
-  --auth-focus-ring-light-only: color-mix(
+  --auth-label-text: var(--text-secondary);
+  --auth-input-border: var(--border-default);
+  --auth-input-bg: var(--bg-raised);
+  --auth-input-text: var(--text-primary);
+  --auth-border-focus: var(--p-blue-500);
+  --auth-focus-ring: color-mix(in srgb, var(--p-blue-500) 20%, transparent);
+  --auth-button-bg: var(--p-red-600);
+  --auth-button-text: #ffffff;
+  --auth-magic-button-bg: var(--bg-raised);
+  --auth-magic-button-text: var(--text-primary);
+  --auth-text-primary: var(--text-primary);
+  --auth-text-secondary: var(--text-secondary);
+  --auth-error-bg: color-mix(in srgb, var(--p-red-500) 12%, transparent);
+  --auth-error-border: color-mix(in srgb, var(--p-red-500) 35%, transparent);
+  --auth-error-text: var(--p-red-400);
+  --auth-success-bg: color-mix(in srgb, var(--p-green-500) 12%, transparent);
+  --auth-success-border: color-mix(
     in srgb,
-    var(--p-blue-500) 20%,
+    var(--p-green-500) 35%,
     transparent
   );
-  --auth-button-bg-light-only: var(--p-red-600);
-  --auth-button-text-light-only: #ffffff;
-  --auth-magic-button-bg-light-only: var(--bg-raised);
-  --auth-magic-button-text-light-only: var(--text-primary);
-  --auth-text-primary-light-only: var(--text-primary);
-  --auth-text-secondary-light-only: var(--text-secondary);
+  --auth-success-text: var(--p-green-500);
   --text-divider-rule-rgb-light: 229, 231, 235;
   --text-divider-label-rgb-light: 156, 163, 175;
   --tool-subcategory-rule-color-light: var(--p-gray-200);

From bc96eed0409f4ddc4455f395cb1fd0e855e6f186 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Fri, 17 Jul 2026 08:07:09 +0100
Subject: [PATCH 040/109] Portal Policies: table layout with colour-matched
 icons (#6994)

# Description of Changes

Reworks the Policies catalogue from blocky cards into a clean table with
tinted category icons and tone-matched "enforces" chips, so it matches
the styling used elsewhere in the portal.

Part of a portal (processor) UI-consistency pass, split into small
focused PRs.

## Before / after

<img width="2816" height="1318" alt="after-policies-light"
src="https://github.com/user-attachments/assets/af7586f7-8d23-47eb-ae2e-90630d09929b"
/>
<img width="2816" height="1438" alt="before-policies-dark"
src="https://github.com/user-attachments/assets/efcc63d9-5f2d-4dca-944d-d470aa689304"
/>
<img width="2816" height="1438" alt="before-policies-light"
src="https://github.com/user-attachments/assets/2398df15-0632-439f-9f23-0a6ddc496083"
/>
<img width="2816" height="1318" alt="after-policies-dark"
src="https://github.com/user-attachments/assets/9a3726ac-1637-4c7c-ad7a-dcdaf141d89d"
/>


---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [x] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../public/locales/en-US/translation.toml     |   7 +
 .../src/portal/components/PolicySummary.tsx   |   6 +-
 .../policies/PolicyCatalogueTable.tsx         | 138 ++++++++++++++++++
 .../policies/PolicyCategoryIcon.css           |  15 ++
 .../policies/PolicyCategoryIcon.tsx           |  16 ++
 .../components/policies/PolicySetupWizard.tsx |   6 +-
 frontend/editor/src/portal/views/Policies.css |  35 +++++
 frontend/editor/src/portal/views/Policies.tsx |  29 ++--
 8 files changed, 227 insertions(+), 25 deletions(-)
 create mode 100644 frontend/editor/src/portal/components/policies/PolicyCatalogueTable.tsx
 create mode 100644 frontend/editor/src/portal/components/policies/PolicyCategoryIcon.css
 create mode 100644 frontend/editor/src/portal/components/policies/PolicyCategoryIcon.tsx

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 4bb5ae928b..eada1744c4 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7515,6 +7515,13 @@ label = "Docs enforced"
 description = "Configured but not firing"
 label = "Paused"
 
+[portal.policies.table]
+appliesTo = "Applies to"
+docs = "Docs enforced"
+enforces = "Enforces"
+policy = "Policy"
+status = "Status"
+
 [portal.policies.wizard.actions]
 back = "Back"
 cancel = "Cancel"
diff --git a/frontend/editor/src/portal/components/PolicySummary.tsx b/frontend/editor/src/portal/components/PolicySummary.tsx
index 9be6ff49cf..9979783536 100644
--- a/frontend/editor/src/portal/components/PolicySummary.tsx
+++ b/frontend/editor/src/portal/components/PolicySummary.tsx
@@ -15,7 +15,7 @@ import {
   type CatalogueEntry,
   type PoliciesResponse,
 } from "@portal/api/policies";
-import { policyCategoryIcon } from "@app/components/policies/policyCategoryIcon";
+import { PolicyCategoryBadge } from "@portal/components/policies/PolicyCategoryIcon";
 import "@portal/components/PolicySummary.css";
 
 /**
@@ -63,9 +63,7 @@ export function PolicySummary() {
       header: t("portal.policySummary.column.policy"),
       render: ({ entry }) => (
         <div className="portal-policysum__cat">
-          <span className="portal-policysum__icon" aria-hidden>
-            {policyCategoryIcon(entry.category.id)}
-          </span>
+          <PolicyCategoryBadge category={entry.category} />
           <div className="portal-policysum__cat-text">
             <strong>{t(entry.category.label)}</strong>
             <span>{t(entry.category.desc)}</span>
diff --git a/frontend/editor/src/portal/components/policies/PolicyCatalogueTable.tsx b/frontend/editor/src/portal/components/policies/PolicyCatalogueTable.tsx
new file mode 100644
index 0000000000..6986f66f74
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicyCatalogueTable.tsx
@@ -0,0 +1,138 @@
+import { useMemo } from "react";
+import { useTranslation } from "react-i18next";
+import { Button, Chip, StatusBadge, Table, type TableColumn } from "@app/ui";
+import type { CatalogueEntry } from "@portal/api/policies";
+import { PolicyCategoryBadge } from "@portal/components/policies/PolicyCategoryIcon";
+import "@portal/views/Policies.css";
+
+interface PolicyCatalogueTableProps {
+  entries: CatalogueEntry[];
+  onOpen: (entry: CatalogueEntry) => void;
+  /** Setup is unavailable (e.g. the AI engine is off): shown, but not openable. */
+  isLocked?: (entry: CatalogueEntry) => boolean;
+  /** Chip text explaining why setup is locked (e.g. "Requires AI engine"). */
+  lockedLabel?: string;
+}
+
+/**
+ * The policy catalogue as a proper data table (Policy / Enforces / Applies to /
+ * Docs / Status), replacing the stacked full-width cards that read as "blocky".
+ * Same shared Table + StatusBadge + Chip primitives the Sources, Documents and
+ * Home policy tables use, so every list page in the portal now reads alike.
+ */
+export function PolicyCatalogueTable({
+  entries,
+  onOpen,
+  isLocked,
+  lockedLabel,
+}: PolicyCatalogueTableProps) {
+  const { t } = useTranslation();
+
+  const columns = useMemo<TableColumn<CatalogueEntry>[]>(
+    () => [
+      {
+        key: "policy",
+        header: t("portal.policies.table.policy", "Policy"),
+        render: (entry) => (
+          <div className="portal-policies__cell">
+            <PolicyCategoryBadge category={entry.category} />
+            <strong className="portal-policies__cell-name">
+              {t(entry.category.label)}
+            </strong>
+          </div>
+        ),
+      },
+      {
+        key: "enforces",
+        header: t("portal.policies.table.enforces", "Enforces"),
+        render: (entry) => (
+          <div className="portal-policies__rulechips">
+            {entry.config.rules.map((r) => (
+              <Chip key={r} accent="neutral" size="sm">
+                {t(r)}
+              </Chip>
+            ))}
+          </div>
+        ),
+      },
+      {
+        key: "scope",
+        header: t("portal.policies.table.appliesTo", "Applies to"),
+        render: (entry) => (
+          <span className="portal-policies__muted">
+            {t(entry.config.scopeLabel)}
+          </span>
+        ),
+      },
+      {
+        key: "docs",
+        header: t("portal.policies.table.docs", "Docs enforced"),
+        align: "right",
+        width: "8rem",
+        render: (entry) => (
+          <span className="portal-policies__docs">
+            {entry.policy ? entry.policy.stats.enforced.toLocaleString() : "—"}
+          </span>
+        ),
+      },
+      {
+        key: "status",
+        header: t("portal.policies.table.status", "Status"),
+        align: "right",
+        width: "8.5rem",
+        render: (entry) => {
+          if (entry.category.comingSoon) {
+            // One consistent neutral chip for every "Upgrade to Enterprise" —
+            // the same action should read the same on every row.
+            return (
+              <Chip accent="neutral" size="sm">
+                {t("portal.policies.card.comingSoon")}
+              </Chip>
+            );
+          }
+          if (isLocked?.(entry)) {
+            return (
+              <Chip accent="neutral" size="sm">
+                {lockedLabel ?? t("portal.policies.card.requiresAiEngine")}
+              </Chip>
+            );
+          }
+          if (entry.policy) {
+            const paused = entry.policy.state.status === "paused";
+            return (
+              <StatusBadge
+                tone={paused ? "warning" : "success"}
+                size="sm"
+                pulse={!paused}
+              >
+                {paused
+                  ? t("portal.policies.status.paused")
+                  : t("portal.policies.status.active")}
+              </StatusBadge>
+            );
+          }
+          return (
+            <Button size="sm" variant="secondary" onClick={() => onOpen(entry)}>
+              {t("portal.policySummary.action.setUp")}
+            </Button>
+          );
+        },
+      },
+    ],
+    [t, onOpen, isLocked, lockedLabel],
+  );
+
+  return (
+    <Table<CatalogueEntry>
+      className="portal-policies__table"
+      columns={columns}
+      rows={entries}
+      rowKey={(e) => e.category.id}
+      onRowClick={(entry) =>
+        entry.category.comingSoon || isLocked?.(entry)
+          ? undefined
+          : onOpen(entry)
+      }
+    />
+  );
+}
diff --git a/frontend/editor/src/portal/components/policies/PolicyCategoryIcon.css b/frontend/editor/src/portal/components/policies/PolicyCategoryIcon.css
new file mode 100644
index 0000000000..96113b7aa1
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicyCategoryIcon.css
@@ -0,0 +1,15 @@
+/* Neutral gray rounded icon badge for a policy category. Lives with the
+   component so every consumer gets the styling without importing a view CSS. */
+.pcat-badge {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 2rem;
+  height: 2rem;
+  flex-shrink: 0;
+  border-radius: var(--radius-lg);
+  background: var(--color-bg-muted);
+  color: var(--color-text-3);
+  /* The shared MUI outline glyph inherits its size from here. */
+  font-size: 1.15rem;
+}
diff --git a/frontend/editor/src/portal/components/policies/PolicyCategoryIcon.tsx b/frontend/editor/src/portal/components/policies/PolicyCategoryIcon.tsx
new file mode 100644
index 0000000000..89243711c9
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicyCategoryIcon.tsx
@@ -0,0 +1,16 @@
+import type { PolicyCategory } from "@portal/api/policies";
+import { policyCategoryIcon } from "@app/components/policies/policyCategoryIcon";
+import "@portal/components/policies/PolicyCategoryIcon.css";
+
+/** A neutral gray rounded badge holding the category's shared outline icon. */
+export function PolicyCategoryBadge({
+  category,
+}: {
+  category: PolicyCategory;
+}) {
+  return (
+    <span className="pcat-badge" aria-hidden>
+      {policyCategoryIcon(category.id)}
+    </span>
+  );
+}
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
index 632e3f610c..582332518c 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
@@ -34,7 +34,7 @@ import {
 import { fetchSources } from "@portal/api/sources";
 import { useAsync } from "@portal/hooks/useAsync";
 import { PolicyFieldRow } from "@portal/components/policies/PolicyFieldRow";
-import { policyCategoryIcon } from "@app/components/policies/policyCategoryIcon";
+import { PolicyCategoryBadge } from "@portal/components/policies/PolicyCategoryIcon";
 import { PolicyRedactConfig } from "@app/components/policies/PolicyRedactConfig";
 import { PolicyWatermarkConfig } from "@app/components/policies/PolicyWatermarkConfig";
 import { ClassificationLabelsSection } from "@portal/components/policies/ClassificationLabelsSection";
@@ -334,9 +334,7 @@ function PolicySetupWizardBody({
       width="lg"
       title={
         <span className="portal-policies__wizard-title">
-          <span className="portal-policies__cat-icon" aria-hidden>
-            {policyCategoryIcon(category.id)}
-          </span>
+          <PolicyCategoryBadge category={category} />
           {isEdit
             ? t("portal.policies.wizard.title.edit", {
                 category: t(category.label),
diff --git a/frontend/editor/src/portal/views/Policies.css b/frontend/editor/src/portal/views/Policies.css
index 021e48d76c..c6095dabc1 100644
--- a/frontend/editor/src/portal/views/Policies.css
+++ b/frontend/editor/src/portal/views/Policies.css
@@ -453,3 +453,38 @@
 .portal-policies__detail-stats .sui-stat + .sui-stat {
   border-left: 1px solid var(--color-border-light);
 }
+
+/* ── Catalogue table (replaces the stacked category cards) ──────────────── */
+.portal-policies__cell {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  min-width: 0;
+}
+
+.portal-policies__cell-name {
+  font-size: 0.9375rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+  min-width: 0;
+}
+
+.portal-policies__rulechips {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.3125rem;
+}
+
+.portal-policies__muted {
+  font-size: 0.8125rem;
+  color: var(--color-text-3);
+}
+
+.portal-policies__docs {
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--color-text-1);
+  font-variant-numeric: tabular-nums;
+}
+/* The .pcat-badge icon styles live with the PolicyCategoryIcon component
+   (PolicyCategoryIcon.css) so the Home policy summary picks them up too. */
diff --git a/frontend/editor/src/portal/views/Policies.tsx b/frontend/editor/src/portal/views/Policies.tsx
index 79440f96e7..2de9122e0e 100644
--- a/frontend/editor/src/portal/views/Policies.tsx
+++ b/frontend/editor/src/portal/views/Policies.tsx
@@ -18,7 +18,7 @@ import {
   type PolicySetupResult,
 } from "@portal/api/policies";
 import { CatalogueSummary } from "@portal/components/policies/CatalogueSummary";
-import { PolicyCategoryCard } from "@portal/components/policies/PolicyCategoryCard";
+import { PolicyCatalogueTable } from "@portal/components/policies/PolicyCatalogueTable";
 import { PolicyDetailPanel } from "@portal/components/policies/PolicyDetailPanel";
 import { PolicySetupWizard } from "@portal/components/policies/PolicySetupWizard";
 import { useAiEngineEnabled } from "@portal/hooks/useAiEngineEnabled";
@@ -53,14 +53,14 @@ export function Policies() {
   const { enabled: aiEngineEnabled, loading: aiEngineLoading } =
     useAiEngineEnabled();
 
-  function isLocked(entry: CatalogueEntry): boolean {
-    return (
+  const isLocked = useCallback(
+    (entry: CatalogueEntry): boolean =>
       entry.category.requiresAiEngine === true &&
       !aiEngineEnabled &&
       !aiEngineLoading &&
-      !entry.policy
-    );
-  }
+      !entry.policy,
+    [aiEngineEnabled, aiEngineLoading],
+  );
 
   const catalogue = data?.catalogue ?? [];
   const refetch = useCallback(() => setVersion((v) => v + 1), []);
@@ -184,17 +184,12 @@ export function Policies() {
       )}
 
       {!isLoading && !fetchError && (
-        <div className="portal-policies__grid">
-          {displayCatalogue.map((entry) => (
-            <PolicyCategoryCard
-              key={entry.category.id}
-              entry={entry}
-              onOpen={openEntry}
-              locked={isLocked(entry)}
-              lockedLabel={t("portal.policies.card.requiresAiEngine")}
-            />
-          ))}
-        </div>
+        <PolicyCatalogueTable
+          entries={displayCatalogue}
+          onOpen={openEntry}
+          isLocked={isLocked}
+          lockedLabel={t("portal.policies.card.requiresAiEngine")}
+        />
       )}
 
       <PolicyDetailPanel

From 398f4733162e5af0f740c97b9a15f31877817980 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Fri, 17 Jul 2026 12:16:06 +0200
Subject: [PATCH 041/109] Clarify portal SaaS licensing (#7074)

### Motivation
* The repository uses per-layer licensing and the
`frontend/editor/src/portal-saas/` layer existed without an explicit
license entry in the root `LICENSE`, so the layered licensing reference
needed to be added for clarity.

### Description
* Add a new `frontend/editor/src/portal-saas/LICENSE` containing the
same "Stirling PDF User License" used by adjacent non-MIT layers and
update the top-level `LICENSE` to list
`frontend/editor/src/portal-saas/` as covered by that file.

### Testing
* Verified with `diff -u frontend/editor/src/portal/LICENSE
frontend/editor/src/portal-saas/LICENSE` and `test -f
frontend/editor/src/portal-saas/LICENSE`, and attempted `task
frontend:check` which could not run in this environment because `task`
is not installed.

------
[Codex
Task](https://chatgpt.com/codex/cloud/tasks/task_e_6a59f78f2f8483258cbe914b84126346)
---
 LICENSE                                 |  2 +
 frontend/editor/src/portal-saas/LICENSE | 51 +++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 frontend/editor/src/portal-saas/LICENSE

diff --git a/LICENSE b/LICENSE
index 971c9d0b16..5579823030 100644
--- a/LICENSE
+++ b/LICENSE
@@ -22,6 +22,8 @@ if that directory exists, is licensed under the license defined in "frontend/edi
 if that directory exists, is licensed under the license defined in "frontend/editor/src/prototypes/LICENSE".
 * All content that resides under the "frontend/editor/src/portal/" directory of this repository,
 if that directory exists, is licensed under the license defined in "frontend/editor/src/portal/LICENSE".
+* All content that resides under the "frontend/editor/src/portal-saas/" directory of this repository,
+if that directory exists, is licensed under the license defined in "frontend/editor/src/portal-saas/LICENSE".
 * Content outside of the above mentioned directories or restrictions above is
 available under the MIT License as defined below.
 
diff --git a/frontend/editor/src/portal-saas/LICENSE b/frontend/editor/src/portal-saas/LICENSE
new file mode 100644
index 0000000000..d268556808
--- /dev/null
+++ b/frontend/editor/src/portal-saas/LICENSE
@@ -0,0 +1,51 @@
+Stirling PDF User License
+
+Copyright (c) 2025 Stirling PDF Inc.
+
+License Scope & Usage Rights
+
+Production use of the Stirling PDF Software is only permitted with a valid Stirling PDF User License.
+
+For purposes of this license, “the Software” refers to the Stirling PDF application and any associated documentation files
+provided by Stirling PDF Inc. You or your organization may not use the Software in production, at scale, or for business-critical
+processes unless you have agreed to, and remain in compliance with, the Stirling PDF Subscription Terms of Service
+(https://www.stirlingpdf.com/terms) or another valid agreement with Stirling PDF, and hold an active User License subscription
+covering the appropriate number of licensed users.
+
+Trial and Minimal Use
+
+You may use the Software without a paid subscription for the sole purposes of internal trial, evaluation, or minimal use, provided that:
+* Use is limited to the capabilities and restrictions defined by the Software itself;
+* You do not copy, distribute, sublicense, reverse-engineer, or use the Software in client-facing or commercial contexts.
+
+Continued use beyond this scope requires a valid Stirling PDF User License.
+
+Modifications and Derivative Works
+
+You may modify the Software only for development or internal testing purposes. Any such modifications or derivative works:
+
+* May not be deployed in production environments without a valid User License;
+* May not be distributed or sublicensed;
+* Remain the intellectual property of Stirling PDF and/or its licensors;
+* May only be used, copied, or exploited in accordance with the terms of a valid Stirling PDF User License subscription.
+
+Prohibited Actions
+
+Unless explicitly permitted by a paid license or separate agreement, you may not:
+
+* Use the Software in production environments;
+* Copy, merge, distribute, sublicense, or sell the Software;
+* Remove or alter any licensing or copyright notices;
+* Circumvent access restrictions or licensing requirements.
+
+Third-Party Components
+
+The Stirling PDF Software may include components subject to separate open source licenses. Such components remain governed by
+their original license terms as provided by their respective owners.
+
+Disclaimer
+
+THE SOFTWARE IS PROVIDED “AS IS,” WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT, OR OTHERWISE, ARISING FROM, OUT OF, OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

From ecddce9944ed5601027a3cabf11f9a7ff762f7d0 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Fri, 17 Jul 2026 14:15:35 +0100
Subject: [PATCH 042/109] Remove agent builder from processor (#7063)

# Description of Changes
Remove agent builder from processor because we don't intend to implement
it any time soon.
---
 .../public/locales/en-US/translation.toml     |  85 ----
 .../sources/AgentBuilderAction.test.tsx       |  10 -
 .../components/sources/AgentBuilderAction.tsx |   7 -
 .../src/portal-saas/views/AgentBuilder.tsx    |  10 -
 frontend/editor/src/portal/MOCKS.md           |   1 -
 frontend/editor/src/portal/ViewRouter.tsx     |   5 -
 frontend/editor/src/portal/api/agents.ts      | 132 -----
 .../editor/src/portal/api/demoData.test.ts    |  10 +-
 .../AgentBuilderPanel.stories.tsx             |  30 --
 .../agent-builder/AgentBuilderPanel.tsx       |  86 ----
 .../agent-builder/AgentKpiStrip.stories.tsx   |  23 -
 .../agent-builder/AgentKpiStrip.tsx           |  57 ---
 .../agent-builder/AgentSelector.stories.tsx   |  33 --
 .../agent-builder/AgentSelector.tsx           |  55 ---
 .../agent-builder/BootstrapDialog.stories.tsx |  30 --
 .../agent-builder/BootstrapDialog.tsx         |  71 ---
 .../agent-builder/EvalsPanel.stories.tsx      |  36 --
 .../components/agent-builder/EvalsPanel.tsx   | 113 -----
 .../agent-builder/ScenariosPanel.stories.tsx  |  30 --
 .../agent-builder/ScenariosPanel.tsx          | 112 -----
 .../agent-builder/ToolsPanel.stories.tsx      |  35 --
 .../components/agent-builder/ToolsPanel.tsx   |  87 ----
 .../agent-builder/VersionsPanel.stories.tsx   |  35 --
 .../agent-builder/VersionsPanel.tsx           | 104 ----
 .../editor/src/portal/components/icons.tsx    |  12 -
 .../components/sources/AgentBuilderAction.tsx |  22 -
 .../src/portal/contexts/ViewContext.tsx       |   3 -
 frontend/editor/src/portal/mocks/agents.ts    | 399 ---------------
 .../src/portal/mocks/handlers/agents.ts       |  12 -
 .../editor/src/portal/mocks/handlers/index.ts |   2 -
 .../editor/src/portal/views/AgentBuilder.css  | 458 ------------------
 .../editor/src/portal/views/AgentBuilder.tsx  | 101 ----
 .../editor/src/portal/views/Sources.test.tsx  |   5 -
 frontend/editor/src/portal/views/Sources.tsx  |   2 -
 34 files changed, 5 insertions(+), 2208 deletions(-)
 delete mode 100644 frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.test.tsx
 delete mode 100644 frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.tsx
 delete mode 100644 frontend/editor/src/portal-saas/views/AgentBuilder.tsx
 delete mode 100644 frontend/editor/src/portal/api/agents.ts
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/AgentKpiStrip.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/AgentKpiStrip.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/AgentSelector.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/BootstrapDialog.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/BootstrapDialog.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/EvalsPanel.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/EvalsPanel.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/ScenariosPanel.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/ScenariosPanel.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/ToolsPanel.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/ToolsPanel.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/VersionsPanel.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/AgentBuilderAction.tsx
 delete mode 100644 frontend/editor/src/portal/mocks/agents.ts
 delete mode 100644 frontend/editor/src/portal/mocks/handlers/agents.ts
 delete mode 100644 frontend/editor/src/portal/views/AgentBuilder.css
 delete mode 100644 frontend/editor/src/portal/views/AgentBuilder.tsx

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index eada1744c4..9681a69f2f 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6136,90 +6136,6 @@ free = "Editor plan"
 subscribed = "Processor plan"
 unlinked = "Not linked"
 
-[portal.agentBuilder]
-bootstrapFromDocument = "Bootstrap from document"
-sectionsAriaLabel = "Agent builder sections"
-selectorAriaLabel = "Agents"
-subtitle = "Design, test and ship the AI agents that classify, extract from and route your documents. Define scenarios, fence tool access, run a golden set, and publish a version."
-title = "Agent Builder"
-
-[portal.agentBuilder.bootstrap]
-cancel = "Cancel"
-dropzoneText = "Choose a sample document (PDF or image)"
-lead = "Drop a sample document and we'll propose scenarios and an extraction schema you can refine. Nothing is published until you review it."
-submit = "Bootstrap agent"
-subtitle = "Seed a new agent from one representative file"
-title = "Bootstrap from a document"
-
-[portal.agentBuilder.empty]
-description = "Bootstrap an agent from a sample document to seed its scenarios and extraction schema, then refine and publish."
-title = "No agents yet"
-
-[portal.agentBuilder.evals]
-casesPassing = "Cases passing"
-columnCase = "Eval case"
-columnLatency = "Latency"
-columnResult = "Result"
-fail = "fail"
-goldenSetPassRate = "Golden-set pass rate"
-latencyMs = "{{ms}} ms"
-notRun = "not run"
-pass = "pass"
-passRate = "Pass rate"
-runEvals = "Run evals"
-
-[portal.agentBuilder.evals.empty]
-description = "Evals turn your scenarios into a repeatable golden set. Upgrade to capture pass-rate over time and gate publishes on it."
-title = "No golden set yet"
-
-[portal.agentBuilder.kpi]
-acrossGoldenSets = "across golden sets"
-activeAgents = "Active agents"
-avgPassRate = "Avg eval pass rate"
-fleetWide = "fleet-wide"
-latestPublished = "Latest published"
-scenarios = "Scenarios"
-testCases = "test cases"
-totalDescription_one = "{{count}} total"
-totalDescription_other = "{{count}} total"
-
-[portal.agentBuilder.scenarios]
-add = "Add"
-addScenario = "Add scenario"
-enable = "Enable"
-expectationLabel = "Expected behaviour"
-expectationPlaceholder = "What the agent should do"
-inEval = "in eval"
-mute = "Mute"
-muted = "muted"
-nameLabel = "Name"
-namePlaceholder = "e.g. Compliance escalation"
-
-[portal.agentBuilder.status]
-draft = "Draft"
-published = "Published"
-
-[portal.agentBuilder.tabs]
-evals = "Evals"
-scenarios = "Scenarios"
-tools = "Tools"
-versions = "Versions"
-
-[portal.agentBuilder.tools]
-broadAccess = "Broad access"
-deniedHint = "Selected tools are blocked. Everything else stays callable."
-deniedTools = "Denied tools"
-governanceGate = "Tool governance is available on the Enterprise plan."
-restricted = "Restricted"
-restrictedAccess = "Restricted tool access"
-restrictedDescription = "Allow every tool except the ones you deny below."
-
-[portal.agentBuilder.versions]
-current = "current"
-historyGate = "Full version history and rollback are available on the Enterprise plan."
-publish = "Publish"
-rollBack = "Roll back"
-
 [portal.assistant]
 close = "Close assistant"
 error = "Couldn't reach the assistant."
@@ -7988,7 +7904,6 @@ subtitle = "Reusable input connections that feed documents into Stirling. Config
 title = "Sources"
 
 [portal.sources.actions]
-agentBuilder = "Agent Builder"
 connectSource = "Connect source"
 
 [portal.sources.builder]
diff --git a/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.test.tsx b/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.test.tsx
deleted file mode 100644
index 2dcafa1dcf..0000000000
--- a/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.test.tsx
+++ /dev/null
@@ -1,10 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { render } from "@testing-library/react";
-import { AgentBuilderAction } from "@portal/components/sources/AgentBuilderAction";
-
-describe("AgentBuilderAction (SaaS)", () => {
-  it("renders nothing — Agent Builder is hidden pre-release", () => {
-    const { container } = render(<AgentBuilderAction />);
-    expect(container).toBeEmptyDOMElement();
-  });
-});
diff --git a/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.tsx b/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.tsx
deleted file mode 100644
index 0576cf45e9..0000000000
--- a/frontend/editor/src/portal-saas/components/sources/AgentBuilderAction.tsx
+++ /dev/null
@@ -1,7 +0,0 @@
-/**
- * SaaS pre-release: Agent Builder isn't shipped yet, so its Sources-header entry
- * point is hidden.
- */
-export function AgentBuilderAction() {
-  return null;
-}
diff --git a/frontend/editor/src/portal-saas/views/AgentBuilder.tsx b/frontend/editor/src/portal-saas/views/AgentBuilder.tsx
deleted file mode 100644
index e6d4dbb15b..0000000000
--- a/frontend/editor/src/portal-saas/views/AgentBuilder.tsx
+++ /dev/null
@@ -1,10 +0,0 @@
-import { Navigate } from "react-router-dom";
-import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
-
-/**
- * SaaS pre-release: Agent Builder isn't shipped yet and its Sources entry point is
- * hidden, so redirect any /agent-builder deep link back to Home.
- */
-export function AgentBuilder() {
-  return <Navigate to={toPortalPath(VIEW_PATHS.home)} replace />;
-}
diff --git a/frontend/editor/src/portal/MOCKS.md b/frontend/editor/src/portal/MOCKS.md
index 84fb8d97cd..6d66b969ee 100644
--- a/frontend/editor/src/portal/MOCKS.md
+++ b/frontend/editor/src/portal/MOCKS.md
@@ -62,7 +62,6 @@ non-2xx). Views consume via `useAsync()` + `useSectionFlags()` (`hooks/useAsync.
 | Documents | `GET /v1/documents` | `tier` | `fetchDocuments` | `DocumentsResponse` |
 | Pipelines | `GET /v1/pipelines` · `POST /v1/pipelines/:id/promote-to-policy` | `tier` | `fetchPipelines` · `promoteToPolicy` | `PipelinesResponse` |
 | Policies | `GET/POST /api/v1/policies` · `GET/DELETE /api/v1/policies/{id}` · `POST /api/v1/policies/{id}/run` | — | `fetchPolicies` · `savePolicy` · `deletePolicy` · `runPolicy` | `PoliciesResponse` · `Policy` |
-| Agent Builder | `GET /v1/agents` | `tier` | `fetchAgents` | `AgentsResponse` |
 | Sources | `GET /v1/sources` | `tier` | `fetchSources` | `SourcesResponse` |
 | Components | `GET /v1/components` | `tier` | `fetchComponents` | `ComponentsResponse` |
 | Infrastructure | `GET /v1/infrastructure/deployments` | `tier` | `fetchDeployments` | `DeploymentsResponse` |
diff --git a/frontend/editor/src/portal/ViewRouter.tsx b/frontend/editor/src/portal/ViewRouter.tsx
index dc580a3a2b..67b7c146a9 100644
--- a/frontend/editor/src/portal/ViewRouter.tsx
+++ b/frontend/editor/src/portal/ViewRouter.tsx
@@ -7,7 +7,6 @@ import { Pipelines } from "@portal/views/Pipelines";
 import { PipelineBuilder } from "@portal/views/PipelineBuilder";
 import { Sources } from "@portal/views/Sources";
 import { SourceBuilder } from "@portal/views/SourceBuilder";
-import { AgentBuilder } from "@portal/views/AgentBuilder";
 import { Policies } from "@portal/views/Policies";
 import { EditorAdmin } from "@portal/views/EditorAdmin";
 import { Infrastructure } from "@portal/views/Infrastructure";
@@ -51,10 +50,6 @@ export function ViewRouter() {
         path={`${rel(VIEW_PATHS.sources)}/:id`}
         element={<SourceBuilder />}
       />
-      <Route
-        path={rel(VIEW_PATHS["agent-builder"])}
-        element={<AgentBuilder />}
-      />
       <Route path={rel(VIEW_PATHS.policies)} element={<Policies />} />
       <Route path={rel(VIEW_PATHS.documents)} element={<Documents />} />
       <Route path={rel(VIEW_PATHS.editor)} element={<EditorAdmin />} />
diff --git a/frontend/editor/src/portal/api/agents.ts b/frontend/editor/src/portal/api/agents.ts
deleted file mode 100644
index 7a0cd49464..0000000000
--- a/frontend/editor/src/portal/api/agents.ts
+++ /dev/null
@@ -1,132 +0,0 @@
-import { apiClient } from "@portal/api/http";
-import type { Tier } from "@portal/contexts/TierContext";
-
-/*
- * An "agent" here is an AI agent that classifies, extracts from, and routes
- * documents. The builder is its lifecycle surface: scenarios (named test
- * cases), tool-access governance, an eval / golden set, and version history.
- */
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Domain types                                                             */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-export type AgentStatus = "draft" | "published";
-
-/**
- * Tool-access posture. `broad` lets the agent call any tool it can reach;
- * `restricted` is allow-by-default minus an explicit deny list (the governance
- * mode enterprise tenants use to fence agents away from sensitive tools).
- */
-export type ToolMode = "broad" | "restricted";
-
-/** A named test case describing expected agent behaviour for a kind of input. */
-export interface Scenario {
-  id: string;
-  name: string;
-  /** What the agent is expected to do for this input. */
-  expectation: string;
-  /** Whether this scenario is currently exercised by the eval run. */
-  enabled: boolean;
-}
-
-/** A single golden-set check with its last-run outcome. */
-export interface EvalCase {
-  id: string;
-  name: string;
-  /** Last observed pass/fail; null when the case has never been run. */
-  passing: boolean | null;
-  /** Mean latency of the last run in milliseconds. */
-  latencyMs: number;
-}
-
-export interface AgentVersion {
-  /** Display label, e.g. "v3" or "v2-draft". */
-  version: string;
-  status: AgentStatus;
-  /** ISO timestamp the version was created. */
-  createdAt: string;
-  author: string;
-  /** One-line change summary. */
-  note: string;
-}
-
-export interface Agent {
-  id: string;
-  name: string;
-  /** One-line role description shown under the name in the selector. */
-  role: string;
-  status: AgentStatus;
-  /** Current working version, e.g. "v3" or "v2-draft". */
-  version: string;
-  model: string;
-  scenarios: Scenario[];
-  toolMode: ToolMode;
-  /** Tools the agent may not call when `toolMode` is "restricted". */
-  deniedTools: string[];
-  /** Count of golden-set cases currently passing. */
-  evalsPassing: number;
-  /** Total golden-set cases. */
-  evalsTotal: number;
-  evalCases: EvalCase[];
-  versions: AgentVersion[];
-}
-
-export interface AgentsSummary {
-  /** Agents in the "published" state. */
-  activeAgents: number;
-  /** Total agents regardless of status. */
-  totalAgents: number;
-  /** Mean eval pass-rate across all agents, 0..1. */
-  avgPassRate: number;
-  /** Total scenarios across all agents. */
-  totalScenarios: number;
-  /** Latest published version label across the fleet, e.g. "v3". */
-  latestPublished: string;
-}
-
-export interface AgentsResponse {
-  summary: AgentsSummary;
-  agents: Agent[];
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Presentation metadata (chip tone per status). Product copy, client-side. */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-export const AGENT_STATUS_TONE: Record<AgentStatus, "success" | "neutral"> = {
-  published: "success",
-  draft: "neutral",
-};
-
-export const AGENT_STATUS_LABEL: Record<AgentStatus, string> = {
-  published: "portal.agentBuilder.status.published",
-  draft: "portal.agentBuilder.status.draft",
-};
-
-/**
- * Catalogue of tools an agent can be granted or denied. Surfaced as the chip
- * palette in restricted mode so the deny list is picked from a known set
- * rather than free-typed.
- */
-export const TOOL_CATALOGUE = [
-  "extract.fields",
-  "classify.document",
-  "route.pipeline",
-  "lookup.crm",
-  "send.email",
-  "write.audit",
-  "read.pii",
-  "invoke.webhook",
-] as const;
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Endpoints                                                                */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-/** GET /v1/agents?tier=… — fleet summary + every agent with its full builder state. */
-export async function fetchAgents(tier: Tier): Promise<AgentsResponse> {
-  return apiClient.local.json<AgentsResponse>(
-    `/v1/agents?tier=${encodeURIComponent(tier)}`,
-  );
-}
diff --git a/frontend/editor/src/portal/api/demoData.test.ts b/frontend/editor/src/portal/api/demoData.test.ts
index a978703203..7a9ab50e13 100644
--- a/frontend/editor/src/portal/api/demoData.test.ts
+++ b/frontend/editor/src/portal/api/demoData.test.ts
@@ -12,7 +12,7 @@ describe("portal demo data seam", () => {
   it("is inert until enabled", async () => {
     expect(
       await resolveDemoResponse(
-        new URL("/v1/agents?tier=pro", window.location.origin),
+        new URL("/v1/notifications", window.location.origin),
         {},
       ),
     ).toBeUndefined();
@@ -22,12 +22,12 @@ describe("portal demo data seam", () => {
   it("answers from the fixture handlers while enabled", async () => {
     await enablePortalDemoData();
     const res = await resolveDemoResponse(
-      new URL("/v1/agents?tier=pro", window.location.origin),
+      new URL("/v1/notifications", window.location.origin),
       {},
     );
     expect(res?.status).toBe(200);
-    const body = (await res?.json()) as { agents: unknown[] };
-    expect(body.agents.length).toBeGreaterThan(0);
+    const body = (await res?.json()) as unknown[];
+    expect(body.length).toBeGreaterThan(0);
   });
 
   it("releases back to the network on disable", async () => {
@@ -35,7 +35,7 @@ describe("portal demo data seam", () => {
     disablePortalDemoData();
     expect(
       await resolveDemoResponse(
-        new URL("/v1/agents?tier=pro", window.location.origin),
+        new URL("/v1/notifications", window.location.origin),
         {},
       ),
     ).toBeUndefined();
diff --git a/frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.stories.tsx b/frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.stories.tsx
deleted file mode 100644
index 2b096b5952..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.stories.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { agentsFor } from "@portal/mocks/agents";
-import { AgentBuilderPanel } from "@portal/components/agent-builder/AgentBuilderPanel";
-
-const PRO = agentsFor("pro");
-
-const meta: Meta<typeof AgentBuilderPanel> = {
-  title: "Portal/AgentBuilder/AgentBuilderPanel",
-  component: AgentBuilderPanel,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "52rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof AgentBuilderPanel>;
-
-/** Published agent with enterprise governance unlocked. */
-export const Published: Story = {
-  args: { agent: PRO[0], governanceUnlocked: true },
-};
-
-/** Draft agent with governance locked (pro/free posture). */
-export const DraftLocked: Story = {
-  args: { agent: PRO[2], governanceUnlocked: false },
-};
diff --git a/frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.tsx b/frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.tsx
deleted file mode 100644
index a411f7f680..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/AgentBuilderPanel.tsx
+++ /dev/null
@@ -1,86 +0,0 @@
-import { useState } from "react";
-import { useTranslation } from "react-i18next";
-import { StatusBadge, Tabs, type TabItem } from "@app/ui";
-import {
-  type Agent,
-  AGENT_STATUS_LABEL,
-  AGENT_STATUS_TONE,
-} from "@portal/api/agents";
-import { ScenariosPanel } from "@portal/components/agent-builder/ScenariosPanel";
-import { ToolsPanel } from "@portal/components/agent-builder/ToolsPanel";
-import { EvalsPanel } from "@portal/components/agent-builder/EvalsPanel";
-import { VersionsPanel } from "@portal/components/agent-builder/VersionsPanel";
-import "@portal/views/AgentBuilder.css";
-
-type BuilderTab = "scenarios" | "tools" | "evals" | "versions";
-
-interface AgentBuilderPanelProps {
-  agent: Agent;
-  /** Enterprise unlocks restricted-tools governance and deep version history. */
-  governanceUnlocked: boolean;
-}
-
-/** The selected agent's builder: header + tabbed Scenarios / Tools / Evals / Versions. */
-export function AgentBuilderPanel({
-  agent,
-  governanceUnlocked,
-}: AgentBuilderPanelProps) {
-  const { t } = useTranslation();
-  const [tab, setTab] = useState<BuilderTab>("scenarios");
-
-  const tabs: TabItem<BuilderTab>[] = [
-    {
-      key: "scenarios",
-      label: t("portal.agentBuilder.tabs.scenarios"),
-      count: agent.scenarios.length,
-    },
-    { key: "tools", label: t("portal.agentBuilder.tabs.tools") },
-    {
-      key: "evals",
-      label: t("portal.agentBuilder.tabs.evals"),
-      count: agent.evalsTotal > 0 ? agent.evalsTotal : undefined,
-    },
-    {
-      key: "versions",
-      label: t("portal.agentBuilder.tabs.versions"),
-      count: agent.versions.length,
-    },
-  ];
-
-  return (
-    <section className="portal-agents__builder">
-      <header className="portal-agents__builder-head">
-        <div>
-          <h2 className="portal-agents__builder-title">{agent.name}</h2>
-          <span className="portal-agents__builder-sub">{agent.role}</span>
-        </div>
-        <div className="portal-agents__builder-meta">
-          <StatusBadge tone={AGENT_STATUS_TONE[agent.status]} size="sm">
-            {t(AGENT_STATUS_LABEL[agent.status])}
-          </StatusBadge>
-          <code className="portal-agents__builder-version">
-            {agent.version}
-          </code>
-          <code className="portal-agents__builder-model">{agent.model}</code>
-        </div>
-      </header>
-
-      <Tabs<BuilderTab>
-        items={tabs}
-        activeKey={tab}
-        onChange={setTab}
-        variant="underline"
-        ariaLabel={t("portal.agentBuilder.sectionsAriaLabel")}
-      />
-
-      {tab === "scenarios" && <ScenariosPanel agent={agent} />}
-      {tab === "tools" && (
-        <ToolsPanel agent={agent} governanceUnlocked={governanceUnlocked} />
-      )}
-      {tab === "evals" && <EvalsPanel agent={agent} />}
-      {tab === "versions" && (
-        <VersionsPanel agent={agent} historyUnlocked={governanceUnlocked} />
-      )}
-    </section>
-  );
-}
diff --git a/frontend/editor/src/portal/components/agent-builder/AgentKpiStrip.stories.tsx b/frontend/editor/src/portal/components/agent-builder/AgentKpiStrip.stories.tsx
deleted file mode 100644
index 9ab047309e..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/AgentKpiStrip.stories.tsx
+++ /dev/null
@@ -1,23 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { buildAgentsResponse } from "@portal/mocks/agents";
-import { AgentKpiStrip } from "@portal/components/agent-builder/AgentKpiStrip";
-
-const meta: Meta<typeof AgentKpiStrip> = {
-  title: "Portal/AgentBuilder/AgentKpiStrip",
-  component: AgentKpiStrip,
-  parameters: { layout: "padded" },
-};
-export default meta;
-type Story = StoryObj<typeof AgentKpiStrip>;
-
-export const Pro: Story = {
-  args: { summary: buildAgentsResponse("pro").summary, loading: false },
-};
-
-export const Enterprise: Story = {
-  args: { summary: buildAgentsResponse("enterprise").summary, loading: false },
-};
-
-export const Loading: Story = {
-  args: { summary: null, loading: true },
-};
diff --git a/frontend/editor/src/portal/components/agent-builder/AgentKpiStrip.tsx b/frontend/editor/src/portal/components/agent-builder/AgentKpiStrip.tsx
deleted file mode 100644
index 0d3b729920..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/AgentKpiStrip.tsx
+++ /dev/null
@@ -1,57 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { MetricCard, MetricStrip } from "@app/ui";
-import type { AgentsSummary } from "@portal/api/agents";
-
-interface AgentKpiStripProps {
-  summary: AgentsSummary | null;
-  loading: boolean;
-}
-
-export function AgentKpiStrip({ summary, loading }: AgentKpiStripProps) {
-  const { t } = useTranslation();
-
-  /**
-   * KPI labels are product copy — they describe what each metric IS, not its
-   * value — so the strip's structure stays stable across loading / ready
-   * states; only values flow from the API.
-   */
-  const kpiLabels = [
-    t("portal.agentBuilder.kpi.activeAgents"),
-    t("portal.agentBuilder.kpi.avgPassRate"),
-    t("portal.agentBuilder.kpi.scenarios"),
-    t("portal.agentBuilder.kpi.latestPublished"),
-  ] as const;
-
-  const values: (string | number)[] = summary
-    ? [
-        summary.activeAgents,
-        `${Math.round(summary.avgPassRate * 100)}%`,
-        summary.totalScenarios,
-        summary.latestPublished,
-      ]
-    : ["—", "—", "—", "—"];
-
-  const descriptions: (string | undefined)[] = summary
-    ? [
-        t("portal.agentBuilder.kpi.totalDescription", {
-          count: summary.totalAgents,
-        }),
-        t("portal.agentBuilder.kpi.acrossGoldenSets"),
-        t("portal.agentBuilder.kpi.testCases"),
-        t("portal.agentBuilder.kpi.fleetWide"),
-      ]
-    : [];
-
-  return (
-    <MetricStrip>
-      {kpiLabels.map((label, i) => (
-        <MetricCard
-          key={label}
-          label={label}
-          value={loading ? "—" : values[i]}
-          description={loading ? undefined : descriptions[i]}
-        />
-      ))}
-    </MetricStrip>
-  );
-}
diff --git a/frontend/editor/src/portal/components/agent-builder/AgentSelector.stories.tsx b/frontend/editor/src/portal/components/agent-builder/AgentSelector.stories.tsx
deleted file mode 100644
index 064bd55da1..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/AgentSelector.stories.tsx
+++ /dev/null
@@ -1,33 +0,0 @@
-import { useState } from "react";
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { agentsFor } from "@portal/mocks/agents";
-import { AgentSelector } from "@portal/components/agent-builder/AgentSelector";
-
-const AGENTS = agentsFor("enterprise");
-
-const meta: Meta<typeof AgentSelector> = {
-  title: "Portal/AgentBuilder/AgentSelector",
-  component: AgentSelector,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "18rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof AgentSelector>;
-
-export const Default: Story = {
-  args: { agents: AGENTS, selectedId: AGENTS[0].id, onSelect: () => {} },
-};
-
-/** Clicking a row moves the selection — drives which builder is shown. */
-export const Interactive: Story = {
-  render: () => {
-    const [id, setId] = useState(AGENTS[0].id);
-    return <AgentSelector agents={AGENTS} selectedId={id} onSelect={setId} />;
-  },
-};
diff --git a/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx b/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx
deleted file mode 100644
index bb01bf914b..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/AgentSelector.tsx
+++ /dev/null
@@ -1,55 +0,0 @@
-import { useTranslation } from "react-i18next";
-import {
-  type Agent,
-  AGENT_STATUS_LABEL,
-  AGENT_STATUS_TONE,
-} from "@portal/api/agents";
-import { Button, StatusBadge } from "@app/ui";
-import "@portal/views/AgentBuilder.css";
-
-interface AgentSelectorProps {
-  agents: Agent[];
-  selectedId: string | null;
-  onSelect: (id: string) => void;
-}
-
-/** Left-rail list of agents; the selected row drives which builder is shown. */
-export function AgentSelector({
-  agents,
-  selectedId,
-  onSelect,
-}: AgentSelectorProps) {
-  const { t } = useTranslation();
-  return (
-    <nav
-      className="portal-agents__selector"
-      aria-label={t("portal.agentBuilder.selectorAriaLabel")}
-    >
-      {agents.map((a) => (
-        <Button
-          key={a.id}
-          variant="tertiary"
-          justify="start"
-          fullWidth
-          className={
-            "portal-agents__selector-item" +
-            (a.id === selectedId ? " is-selected" : "")
-          }
-          aria-current={a.id === selectedId}
-          onClick={() => onSelect(a.id)}
-        >
-          <span className="portal-agents__selector-main">
-            <strong className="portal-agents__selector-name">{a.name}</strong>
-            <span className="portal-agents__selector-role">{a.role}</span>
-          </span>
-          <span className="portal-agents__selector-meta">
-            <StatusBadge tone={AGENT_STATUS_TONE[a.status]} size="sm">
-              {t(AGENT_STATUS_LABEL[a.status])}
-            </StatusBadge>
-            <code className="portal-agents__selector-version">{a.version}</code>
-          </span>
-        </Button>
-      ))}
-    </nav>
-  );
-}
diff --git a/frontend/editor/src/portal/components/agent-builder/BootstrapDialog.stories.tsx b/frontend/editor/src/portal/components/agent-builder/BootstrapDialog.stories.tsx
deleted file mode 100644
index 086ac982dc..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/BootstrapDialog.stories.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-import { useState } from "react";
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { Button } from "@app/ui";
-import { BootstrapDialog } from "@portal/components/agent-builder/BootstrapDialog";
-
-const meta: Meta<typeof BootstrapDialog> = {
-  title: "Portal/AgentBuilder/BootstrapDialog",
-  component: BootstrapDialog,
-  parameters: { layout: "fullscreen" },
-};
-export default meta;
-type Story = StoryObj<typeof BootstrapDialog>;
-
-/** Open by default so the dialog is visible in the canvas. */
-export const Open: Story = {
-  args: { open: true, onClose: () => {} },
-};
-
-/** Toggled from a trigger, mirroring how the view drives it. */
-export const Triggered: Story = {
-  render: () => {
-    const [open, setOpen] = useState(false);
-    return (
-      <div style={{ padding: "1.5rem" }}>
-        <Button onClick={() => setOpen(true)}>Bootstrap from document</Button>
-        <BootstrapDialog open={open} onClose={() => setOpen(false)} />
-      </div>
-    );
-  },
-};
diff --git a/frontend/editor/src/portal/components/agent-builder/BootstrapDialog.tsx b/frontend/editor/src/portal/components/agent-builder/BootstrapDialog.tsx
deleted file mode 100644
index 27b076eb69..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/BootstrapDialog.tsx
+++ /dev/null
@@ -1,71 +0,0 @@
-import { useState } from "react";
-import { useTranslation } from "react-i18next";
-import FileUploadRounded from "@mui/icons-material/FileUploadRounded";
-import { Button, Modal } from "@app/ui";
-import "@portal/views/AgentBuilder.css";
-
-interface BootstrapDialogProps {
-  open: boolean;
-  onClose: () => void;
-}
-
-/**
- * Seed a new agent from a sample document — the user drops one representative
- * file and the backend proposes scenarios and an extraction schema. Demo stub:
- * it captures the chosen file name locally and closes without provisioning.
- */
-export function BootstrapDialog({ open, onClose }: BootstrapDialogProps) {
-  const { t } = useTranslation();
-  const [fileName, setFileName] = useState<string | null>(null);
-
-  function close() {
-    onClose();
-    setTimeout(() => setFileName(null), 200);
-  }
-
-  function bootstrap() {
-    // TODO(backend): POST /v1/agents/bootstrap (multipart sample document) —
-    // infer a starter agent (scenarios + extraction schema) from the file.
-    close();
-  }
-
-  return (
-    <Modal
-      open={open}
-      onClose={close}
-      width="md"
-      title={t("portal.agentBuilder.bootstrap.title")}
-      subtitle={t("portal.agentBuilder.bootstrap.subtitle")}
-      footer={
-        <div className="portal-agents__dialog-footer">
-          <Button variant="tertiary" size="sm" onClick={close}>
-            {t("portal.agentBuilder.bootstrap.cancel")}
-          </Button>
-          <Button size="sm" onClick={bootstrap} disabled={!fileName}>
-            {t("portal.agentBuilder.bootstrap.submit")}
-          </Button>
-        </div>
-      }
-    >
-      <div className="portal-agents__bootstrap">
-        <p className="portal-agents__bootstrap-lead">
-          {t("portal.agentBuilder.bootstrap.lead")}
-        </p>
-        <label className="portal-agents__dropzone">
-          <input
-            type="file"
-            accept=".pdf,.png,.jpg,.jpeg,.tiff"
-            className="portal-agents__dropzone-input"
-            onChange={(e) => setFileName(e.target.files?.[0]?.name ?? null)}
-          />
-          <span className="portal-agents__dropzone-icon" aria-hidden>
-            <FileUploadRounded style={{ fontSize: "1.5rem" }} />
-          </span>
-          <span className="portal-agents__dropzone-text">
-            {fileName ?? t("portal.agentBuilder.bootstrap.dropzoneText")}
-          </span>
-        </label>
-      </div>
-    </Modal>
-  );
-}
diff --git a/frontend/editor/src/portal/components/agent-builder/EvalsPanel.stories.tsx b/frontend/editor/src/portal/components/agent-builder/EvalsPanel.stories.tsx
deleted file mode 100644
index 39d1676dd1..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/EvalsPanel.stories.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { agentsFor } from "@portal/mocks/agents";
-import { EvalsPanel } from "@portal/components/agent-builder/EvalsPanel";
-
-const PRO = agentsFor("pro");
-const FREE = agentsFor("free");
-
-const meta: Meta<typeof EvalsPanel> = {
-  title: "Portal/AgentBuilder/EvalsPanel",
-  component: EvalsPanel,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "44rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof EvalsPanel>;
-
-/** High pass-rate agent — bar and pass-rate tile read green. */
-export const Passing: Story = {
-  args: { agent: PRO[0] },
-};
-
-/** KYC draft sits below the green band, so the pass-rate tile warns. */
-export const BelowTarget: Story = {
-  args: { agent: PRO[2] },
-};
-
-/** Free-tier agent has no golden set — the panel shows the upgrade gate. */
-export const NoGoldenSet: Story = {
-  args: { agent: FREE[0] },
-};
diff --git a/frontend/editor/src/portal/components/agent-builder/EvalsPanel.tsx b/frontend/editor/src/portal/components/agent-builder/EvalsPanel.tsx
deleted file mode 100644
index 4654f10635..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/EvalsPanel.tsx
+++ /dev/null
@@ -1,113 +0,0 @@
-import { useTranslation } from "react-i18next";
-import {
-  Button,
-  EmptyState,
-  ProgressBar,
-  StatTile,
-  StatusBadge,
-  Table,
-  type TableColumn,
-} from "@app/ui";
-import type { Agent, EvalCase } from "@portal/api/agents";
-import "@portal/views/AgentBuilder.css";
-
-interface EvalsPanelProps {
-  agent: Agent;
-}
-
-/** Golden-set pass-rate, the per-case results table, and a run affordance. */
-export function EvalsPanel({ agent }: EvalsPanelProps) {
-  const { t } = useTranslation();
-
-  const columns: TableColumn<EvalCase>[] = [
-    {
-      key: "name",
-      header: t("portal.agentBuilder.evals.columnCase"),
-      render: (c) => c.name,
-    },
-    {
-      key: "result",
-      header: t("portal.agentBuilder.evals.columnResult"),
-      render: (c) =>
-        c.passing === null ? (
-          <span className="portal-agents__muted">
-            {t("portal.agentBuilder.evals.notRun")}
-          </span>
-        ) : (
-          <StatusBadge tone={c.passing ? "success" : "danger"} size="sm">
-            {c.passing
-              ? t("portal.agentBuilder.evals.pass")
-              : t("portal.agentBuilder.evals.fail")}
-          </StatusBadge>
-        ),
-    },
-    {
-      key: "latency",
-      header: t("portal.agentBuilder.evals.columnLatency"),
-      align: "right",
-      render: (c) => (
-        <span className="portal-agents__mono">
-          {t("portal.agentBuilder.evals.latencyMs", { ms: c.latencyMs })}
-        </span>
-      ),
-    },
-  ];
-
-  if (agent.evalsTotal === 0) {
-    return (
-      <div className="portal-agents__panel">
-        <EmptyState
-          title={t("portal.agentBuilder.evals.empty.title")}
-          description={t("portal.agentBuilder.evals.empty.description")}
-          size="compact"
-        />
-      </div>
-    );
-  }
-
-  const rate = agent.evalsPassing / agent.evalsTotal;
-
-  function runEvals() {
-    // TODO(backend): POST /v1/agents/{id}/evals/run — kick off a golden-set
-    // run, then poll for the updated case results.
-  }
-
-  return (
-    <div className="portal-agents__panel">
-      <div className="portal-agents__eval-head">
-        <div className="portal-agents__stat-grid portal-agents__stat-grid--two">
-          <StatTile
-            label={t("portal.agentBuilder.evals.passRate")}
-            value={`${Math.round(rate * 100)}%`}
-            tone={rate >= 0.95 ? "success" : rate >= 0.8 ? "warning" : "danger"}
-          />
-          <StatTile
-            label={t("portal.agentBuilder.evals.casesPassing")}
-            value={`${agent.evalsPassing} / ${agent.evalsTotal}`}
-          />
-        </div>
-        <Button size="sm" variant="secondary" onClick={runEvals}>
-          {t("portal.agentBuilder.evals.runEvals")}
-        </Button>
-      </div>
-
-      <div className="portal-agents__bar-row">
-        <div className="portal-agents__bar-head">
-          <span>{t("portal.agentBuilder.evals.goldenSetPassRate")}</span>
-          <strong>{Math.round(rate * 100)}%</strong>
-        </div>
-        <ProgressBar
-          value={rate}
-          color={rate >= 0.95 ? "var(--color-green)" : "var(--color-amber)"}
-          label={t("portal.agentBuilder.evals.goldenSetPassRate")}
-        />
-      </div>
-
-      <Table<EvalCase>
-        columns={columns}
-        rows={agent.evalCases}
-        rowKey={(c) => c.id}
-      />
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/agent-builder/ScenariosPanel.stories.tsx b/frontend/editor/src/portal/components/agent-builder/ScenariosPanel.stories.tsx
deleted file mode 100644
index 8ae91e390a..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/ScenariosPanel.stories.tsx
+++ /dev/null
@@ -1,30 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { agentsFor } from "@portal/mocks/agents";
-import { ScenariosPanel } from "@portal/components/agent-builder/ScenariosPanel";
-
-const AGENTS = agentsFor("pro");
-
-const meta: Meta<typeof ScenariosPanel> = {
-  title: "Portal/AgentBuilder/ScenariosPanel",
-  component: ScenariosPanel,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "44rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof ScenariosPanel>;
-
-/** Contract Router ships three scenarios; the add-row stages a fourth locally. */
-export const Default: Story = {
-  args: { agent: AGENTS[0] },
-};
-
-/** An agent with a muted scenario (excluded from the eval run). */
-export const WithMutedScenario: Story = {
-  args: { agent: AGENTS[1] },
-};
diff --git a/frontend/editor/src/portal/components/agent-builder/ScenariosPanel.tsx b/frontend/editor/src/portal/components/agent-builder/ScenariosPanel.tsx
deleted file mode 100644
index d3a2822838..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/ScenariosPanel.tsx
+++ /dev/null
@@ -1,112 +0,0 @@
-import { useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Button, Chip, FormField, Input, StatusBadge } from "@app/ui";
-import type { Agent, Scenario } from "@portal/api/agents";
-import "@portal/views/AgentBuilder.css";
-
-interface ScenariosPanelProps {
-  agent: Agent;
-}
-
-/**
- * Named test cases describing expected behaviour. Edits live in local state —
- * the surface is mock-driven, so adding a row only stages it client-side until
- * the submit endpoint exists.
- */
-export function ScenariosPanel({ agent }: ScenariosPanelProps) {
-  const { t } = useTranslation();
-  // Seed from the agent and re-seed when the selection changes (key prop on the
-  // builder forces a remount, so a plain useState initialiser is enough).
-  const [scenarios, setScenarios] = useState<Scenario[]>(agent.scenarios);
-  const [name, setName] = useState("");
-  const [expectation, setExpectation] = useState("");
-
-  const canAdd = name.trim() !== "" && expectation.trim() !== "";
-
-  function addScenario() {
-    if (!canAdd) return;
-    const next: Scenario = {
-      id: `sc-local-${Date.now()}`,
-      name: name.trim(),
-      expectation: expectation.trim(),
-      enabled: true,
-    };
-    // TODO(backend): POST /v1/agents/{id}/scenarios { name, expectation } —
-    // persist the scenario, then replace the optimistic row with the response.
-    setScenarios((cur) => [...cur, next]);
-    setName("");
-    setExpectation("");
-  }
-
-  function toggleEnabled(id: string) {
-    setScenarios((cur) =>
-      cur.map((s) => (s.id === id ? { ...s, enabled: !s.enabled } : s)),
-    );
-  }
-
-  return (
-    <div className="portal-agents__panel">
-      <ul className="portal-agents__scenarios">
-        {scenarios.map((s) => (
-          <li key={s.id} className="portal-agents__scenario">
-            <div className="portal-agents__scenario-text">
-              <div className="portal-agents__scenario-head">
-                <strong>{s.name}</strong>
-                <StatusBadge
-                  tone={s.enabled ? "success" : "neutral"}
-                  size="sm"
-                  showDot={false}
-                >
-                  {s.enabled
-                    ? t("portal.agentBuilder.scenarios.inEval")
-                    : t("portal.agentBuilder.scenarios.muted")}
-                </StatusBadge>
-              </div>
-              <span className="portal-agents__scenario-expect">
-                {s.expectation}
-              </span>
-            </div>
-            <Button
-              size="sm"
-              variant="tertiary"
-              onClick={() => toggleEnabled(s.id)}
-            >
-              {s.enabled
-                ? t("portal.agentBuilder.scenarios.mute")
-                : t("portal.agentBuilder.scenarios.enable")}
-            </Button>
-          </li>
-        ))}
-      </ul>
-
-      <div className="portal-agents__scenario-add">
-        <Chip accent="default" size="sm">
-          {t("portal.agentBuilder.scenarios.addScenario")}
-        </Chip>
-        <div className="portal-agents__scenario-form">
-          <FormField label={t("portal.agentBuilder.scenarios.nameLabel")}>
-            <Input
-              value={name}
-              onChange={(e) => setName(e.target.value)}
-              placeholder={t("portal.agentBuilder.scenarios.namePlaceholder")}
-            />
-          </FormField>
-          <FormField
-            label={t("portal.agentBuilder.scenarios.expectationLabel")}
-          >
-            <Input
-              value={expectation}
-              onChange={(e) => setExpectation(e.target.value)}
-              placeholder={t(
-                "portal.agentBuilder.scenarios.expectationPlaceholder",
-              )}
-            />
-          </FormField>
-          <Button size="sm" onClick={addScenario} disabled={!canAdd}>
-            {t("portal.agentBuilder.scenarios.add")}
-          </Button>
-        </div>
-      </div>
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/agent-builder/ToolsPanel.stories.tsx b/frontend/editor/src/portal/components/agent-builder/ToolsPanel.stories.tsx
deleted file mode 100644
index ed0de96ff9..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/ToolsPanel.stories.tsx
+++ /dev/null
@@ -1,35 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { agentsFor } from "@portal/mocks/agents";
-import { ToolsPanel } from "@portal/components/agent-builder/ToolsPanel";
-
-const AGENTS = agentsFor("enterprise");
-
-const meta: Meta<typeof ToolsPanel> = {
-  title: "Portal/AgentBuilder/ToolsPanel",
-  component: ToolsPanel,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "44rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof ToolsPanel>;
-
-/** Restricted mode with a deny list — the enterprise governance posture. */
-export const Restricted: Story = {
-  args: { agent: AGENTS[0], governanceUnlocked: true },
-};
-
-/** Broad access — every tool callable. */
-export const Broad: Story = {
-  args: { agent: AGENTS[1], governanceUnlocked: true },
-};
-
-/** Governance locked: the toggle is disabled and explains the upgrade. */
-export const GovernanceLocked: Story = {
-  args: { agent: AGENTS[0], governanceUnlocked: false },
-};
diff --git a/frontend/editor/src/portal/components/agent-builder/ToolsPanel.tsx b/frontend/editor/src/portal/components/agent-builder/ToolsPanel.tsx
deleted file mode 100644
index 6c0d3030ac..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/ToolsPanel.tsx
+++ /dev/null
@@ -1,87 +0,0 @@
-import { useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Chip, ToggleSwitch } from "@app/ui";
-import { type Agent, type ToolMode, TOOL_CATALOGUE } from "@portal/api/agents";
-import "@portal/views/AgentBuilder.css";
-
-interface ToolsPanelProps {
-  agent: Agent;
-  /** Restricted-tools governance is an enterprise capability. */
-  governanceUnlocked: boolean;
-}
-
-/**
- * Tool-access posture. `broad` grants every tool; `restricted` is allow-by-
- * default minus an explicit deny list, picked from the known tool catalogue.
- */
-export function ToolsPanel({ agent, governanceUnlocked }: ToolsPanelProps) {
-  const { t } = useTranslation();
-  const [mode, setMode] = useState<ToolMode>(agent.toolMode);
-  const [denied, setDenied] = useState<string[]>(agent.deniedTools);
-
-  function setRestricted(on: boolean) {
-    // TODO(backend): PATCH /v1/agents/{id}/tools { mode, deniedTools } —
-    // persist the access posture.
-    setMode(on ? "restricted" : "broad");
-  }
-
-  function toggleDenied(tool: string) {
-    setDenied((cur) =>
-      cur.includes(tool) ? cur.filter((t) => t !== tool) : [...cur, tool],
-    );
-  }
-
-  const restricted = mode === "restricted";
-
-  return (
-    <div className="portal-agents__panel">
-      <div className="portal-agents__tool-mode">
-        <ToggleSwitch
-          checked={restricted}
-          onChange={setRestricted}
-          disabled={!governanceUnlocked}
-          label={t("portal.agentBuilder.tools.restrictedAccess")}
-          description={
-            governanceUnlocked
-              ? t("portal.agentBuilder.tools.restrictedDescription")
-              : t("portal.agentBuilder.tools.governanceGate")
-          }
-        />
-        <Chip accent={restricted ? "warning" : "success"} size="sm">
-          {restricted
-            ? t("portal.agentBuilder.tools.restricted")
-            : t("portal.agentBuilder.tools.broadAccess")}
-        </Chip>
-      </div>
-
-      {restricted && (
-        <div className="portal-agents__detail-section">
-          <span className="portal-agents__detail-heading">
-            {t("portal.agentBuilder.tools.deniedTools")}
-          </span>
-          <p className="portal-agents__hint">
-            {t("portal.agentBuilder.tools.deniedHint")}
-          </p>
-          <div className="portal-agents__chips">
-            {TOOL_CATALOGUE.map((tool) => {
-              const isDenied = denied.includes(tool);
-              return (
-                <Chip
-                  key={tool}
-                  accent={isDenied ? "danger" : "neutral"}
-                  size="sm"
-                  onClick={
-                    governanceUnlocked ? () => toggleDenied(tool) : undefined
-                  }
-                >
-                  {isDenied ? "✕ " : ""}
-                  {tool}
-                </Chip>
-              );
-            })}
-          </div>
-        </div>
-      )}
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/agent-builder/VersionsPanel.stories.tsx b/frontend/editor/src/portal/components/agent-builder/VersionsPanel.stories.tsx
deleted file mode 100644
index d15fdac6e0..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/VersionsPanel.stories.tsx
+++ /dev/null
@@ -1,35 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { agentsFor } from "@portal/mocks/agents";
-import { VersionsPanel } from "@portal/components/agent-builder/VersionsPanel";
-
-const PRO = agentsFor("pro");
-
-const meta: Meta<typeof VersionsPanel> = {
-  title: "Portal/AgentBuilder/VersionsPanel",
-  component: VersionsPanel,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "44rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof VersionsPanel>;
-
-/** Full history with rollback on prior published versions. */
-export const FullHistory: Story = {
-  args: { agent: PRO[0], historyUnlocked: true },
-};
-
-/** A draft current version offers a publish action. */
-export const DraftAwaitingPublish: Story = {
-  args: { agent: PRO[2], historyUnlocked: true },
-};
-
-/** History locked: only the current version shows, with an upgrade hint. */
-export const HistoryLocked: Story = {
-  args: { agent: PRO[0], historyUnlocked: false },
-};
diff --git a/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx b/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx
deleted file mode 100644
index 3b63fe3045..0000000000
--- a/frontend/editor/src/portal/components/agent-builder/VersionsPanel.tsx
+++ /dev/null
@@ -1,104 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { Button, StatusBadge } from "@app/ui";
-import {
-  type Agent,
-  AGENT_STATUS_LABEL,
-  AGENT_STATUS_TONE,
-} from "@portal/api/agents";
-import "@portal/views/AgentBuilder.css";
-
-interface VersionsPanelProps {
-  agent: Agent;
-  /** Deep version history is an enterprise capability; lower tiers see the gate. */
-  historyUnlocked: boolean;
-}
-
-/** Render an ISO timestamp as a short, locale-stable date. */
-function formatDate(iso: string): string {
-  return new Date(iso).toLocaleDateString(undefined, {
-    year: "numeric",
-    month: "short",
-    day: "numeric",
-  });
-}
-
-/** Version history with publish / rollback actions per row. */
-export function VersionsPanel({ agent, historyUnlocked }: VersionsPanelProps) {
-  const { t } = useTranslation();
-  // Without governance, only the current version is meaningful to show.
-  const versions = historyUnlocked
-    ? agent.versions
-    : agent.versions.slice(0, 1);
-  const publishedExists = agent.versions.some((v) => v.status === "published");
-
-  function publish(version: string) {
-    void version;
-    // TODO(backend): POST /v1/agents/{id}/versions/{v}/publish — promote the
-    // draft to published and demote the previous published version.
-  }
-
-  function rollback(version: string) {
-    void version;
-    // TODO(backend): POST /v1/agents/{id}/versions/{v}/rollback — re-publish a
-    // prior version as the active one.
-  }
-
-  return (
-    <div className="portal-agents__panel">
-      <ol className="portal-agents__versions">
-        {versions.map((v) => {
-          const isCurrent = v.version === agent.version;
-          return (
-            <li key={v.version} className="portal-agents__version">
-              <div className="portal-agents__version-main">
-                <div className="portal-agents__version-head">
-                  <code className="portal-agents__version-tag">
-                    {v.version}
-                  </code>
-                  <StatusBadge tone={AGENT_STATUS_TONE[v.status]} size="sm">
-                    {t(AGENT_STATUS_LABEL[v.status])}
-                  </StatusBadge>
-                  {isCurrent && (
-                    <StatusBadge tone="info" size="sm" showDot={false}>
-                      {t("portal.agentBuilder.versions.current")}
-                    </StatusBadge>
-                  )}
-                </div>
-                <span className="portal-agents__version-note">{v.note}</span>
-                <span className="portal-agents__version-meta">
-                  {formatDate(v.createdAt)} · {v.author}
-                </span>
-              </div>
-              <div className="portal-agents__version-actions">
-                {v.status === "draft" && (
-                  <Button
-                    size="sm"
-                    variant="secondary"
-                    onClick={() => publish(v.version)}
-                  >
-                    {t("portal.agentBuilder.versions.publish")}
-                  </Button>
-                )}
-                {v.status === "published" && !isCurrent && (
-                  <Button
-                    size="sm"
-                    variant="tertiary"
-                    onClick={() => rollback(v.version)}
-                  >
-                    {t("portal.agentBuilder.versions.rollBack")}
-                  </Button>
-                )}
-              </div>
-            </li>
-          );
-        })}
-      </ol>
-
-      {!historyUnlocked && publishedExists && (
-        <p className="portal-agents__hint">
-          {t("portal.agentBuilder.versions.historyGate")}
-        </p>
-      )}
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/icons.tsx b/frontend/editor/src/portal/components/icons.tsx
index ed8e6454ff..d60f86646e 100644
--- a/frontend/editor/src/portal/components/icons.tsx
+++ b/frontend/editor/src/portal/components/icons.tsx
@@ -221,18 +221,6 @@ export function PoliciesIcon(props: IconProps) {
   );
 }
 
-export function AgentBuilderIcon(props: IconProps) {
-  return (
-    <Svg {...props}>
-      <rect x="3" y="11" width="18" height="10" rx="2" />
-      <circle cx="12" cy="5" r="2" />
-      <path d="M12 7v4" />
-      <line x1="8" y1="16" x2="8" y2="16" />
-      <line x1="16" y1="16" x2="16" y2="16" />
-    </Svg>
-  );
-}
-
 export function ProcurementIcon(props: IconProps) {
   return (
     <Svg {...props}>
diff --git a/frontend/editor/src/portal/components/sources/AgentBuilderAction.tsx b/frontend/editor/src/portal/components/sources/AgentBuilderAction.tsx
deleted file mode 100644
index 5e3885e5fc..0000000000
--- a/frontend/editor/src/portal/components/sources/AgentBuilderAction.tsx
+++ /dev/null
@@ -1,22 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { Button } from "@app/ui";
-import { useView } from "@portal/contexts/ViewContext";
-import { AgentBuilderIcon } from "@portal/components/icons";
-
-/**
- * The "Agent Builder" action in the Sources header. A flavor seam: the SaaS build
- * shadows this with a no-op (Agent Builder isn't shipped there yet).
- */
-export function AgentBuilderAction() {
-  const { t } = useTranslation();
-  const { setActiveView } = useView();
-  return (
-    <Button
-      variant="secondary"
-      onClick={() => setActiveView("agent-builder")}
-      leftSection={<AgentBuilderIcon size={16} />}
-    >
-      {t("portal.sources.actions.agentBuilder")}
-    </Button>
-  );
-}
diff --git a/frontend/editor/src/portal/contexts/ViewContext.tsx b/frontend/editor/src/portal/contexts/ViewContext.tsx
index 3c9ebc9fa8..db3a64ee40 100644
--- a/frontend/editor/src/portal/contexts/ViewContext.tsx
+++ b/frontend/editor/src/portal/contexts/ViewContext.tsx
@@ -7,7 +7,6 @@ export type ViewId =
   | "editor"
   | "users"
   | "sources"
-  | "agent-builder"
   | "policies"
   | "pipelines"
   | "documents"
@@ -22,7 +21,6 @@ export const VIEW_LABELS: Record<ViewId, string> = {
   editor: "Editor",
   users: "Users",
   sources: "Sources",
-  "agent-builder": "Agent Builder",
   policies: "Policies",
   pipelines: "Pipelines",
   documents: "Documents",
@@ -38,7 +36,6 @@ export const VIEW_PATHS: Record<ViewId, string> = {
   editor: "/editor",
   users: "/users",
   sources: "/sources",
-  "agent-builder": "/agent-builder",
   policies: "/policies",
   pipelines: "/pipelines",
   documents: "/documents",
diff --git a/frontend/editor/src/portal/mocks/agents.ts b/frontend/editor/src/portal/mocks/agents.ts
deleted file mode 100644
index 6ff7b14910..0000000000
--- a/frontend/editor/src/portal/mocks/agents.ts
+++ /dev/null
@@ -1,399 +0,0 @@
-/**
- * Agent Builder fixtures. Types live in api/agents.ts (the backend contract);
- * this module only builds fake data for Storybook and tests.
- *
- * An "agent" here is an AI agent that classifies, extracts from, and routes
- * documents. The builder is its lifecycle surface: scenarios (named test
- * cases), tool-access governance, an eval / golden set, and version history.
- */
-
-import type { Tier } from "@portal/contexts/TierContext";
-import type { Agent, AgentsResponse, AgentsSummary } from "@portal/api/agents";
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Fixture builders                                                         */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-const CONTRACT_ROUTER: Agent = {
-  id: "agent-contract-router",
-  name: "Contract Router",
-  role: "Classifies inbound contracts and routes to the right review queue",
-  status: "published",
-  version: "v3",
-  model: "claude-opus-4.1",
-  toolMode: "restricted",
-  deniedTools: ["send.email", "read.pii"],
-  evalsPassing: 23,
-  evalsTotal: 24,
-  scenarios: [
-    {
-      id: "sc-cr-1",
-      name: "New customer file",
-      expectation: "Route to onboarding queue and tag as net-new account",
-      enabled: true,
-    },
-    {
-      id: "sc-cr-2",
-      name: "Renewal with price change",
-      expectation: "Flag the delta and route to legal for redline review",
-      enabled: true,
-    },
-    {
-      id: "sc-cr-3",
-      name: "Non-standard liability clause",
-      expectation: "Escalate to senior counsel rather than auto-approving",
-      enabled: true,
-    },
-  ],
-  evalCases: [
-    {
-      id: "ec-cr-1",
-      name: "MSA — standard terms",
-      passing: true,
-      latencyMs: 1840,
-    },
-    {
-      id: "ec-cr-2",
-      name: "MSA — capped liability",
-      passing: true,
-      latencyMs: 2010,
-    },
-    {
-      id: "ec-cr-3",
-      name: "Order form — multi-year",
-      passing: true,
-      latencyMs: 1620,
-    },
-    {
-      id: "ec-cr-4",
-      name: "DPA — cross-border transfer",
-      passing: false,
-      latencyMs: 2440,
-    },
-  ],
-  versions: [
-    {
-      version: "v3",
-      status: "published",
-      createdAt: "2026-05-28T14:12:00Z",
-      author: "legal-ops@acme.com",
-      note: "Added cross-border DPA detection",
-    },
-    {
-      version: "v2",
-      status: "published",
-      createdAt: "2026-04-09T09:30:00Z",
-      author: "legal-ops@acme.com",
-      note: "Tightened renewal price-change routing",
-    },
-    {
-      version: "v1",
-      status: "published",
-      createdAt: "2026-02-15T16:45:00Z",
-      author: "you@acme.com",
-      note: "Initial publish",
-    },
-  ],
-};
-
-const INVOICE_AGENT: Agent = {
-  id: "agent-invoice",
-  name: "Invoice Agent",
-  role: "Extracts line items and routes invoices into the AP pipeline",
-  status: "published",
-  version: "v5",
-  model: "claude-sonnet-4.5",
-  toolMode: "broad",
-  deniedTools: [],
-  evalsPassing: 31,
-  evalsTotal: 32,
-  scenarios: [
-    {
-      id: "sc-inv-1",
-      name: "Multi-page invoice",
-      expectation: "Extract all line items across pages into one record",
-      enabled: true,
-    },
-    {
-      id: "sc-inv-2",
-      name: "Foreign currency total",
-      expectation: "Preserve original currency and attach FX note",
-      enabled: true,
-    },
-    {
-      id: "sc-inv-3",
-      name: "Missing PO number",
-      expectation: "Route to manual matching rather than auto-posting",
-      enabled: false,
-    },
-  ],
-  evalCases: [
-    { id: "ec-inv-1", name: "Single-page USD", passing: true, latencyMs: 980 },
-    { id: "ec-inv-2", name: "Multi-page EUR", passing: true, latencyMs: 1320 },
-    {
-      id: "ec-inv-3",
-      name: "Handwritten total",
-      passing: true,
-      latencyMs: 1510,
-    },
-    {
-      id: "ec-inv-4",
-      name: "No PO reference",
-      passing: false,
-      latencyMs: 1100,
-    },
-  ],
-  versions: [
-    {
-      version: "v5",
-      status: "published",
-      createdAt: "2026-06-01T11:00:00Z",
-      author: "platform@acme.com",
-      note: "FX note extraction for foreign-currency invoices",
-    },
-    {
-      version: "v4",
-      status: "published",
-      createdAt: "2026-05-10T08:20:00Z",
-      author: "platform@acme.com",
-      note: "Multi-page line-item stitching",
-    },
-  ],
-};
-
-const KYC_AGENT: Agent = {
-  id: "agent-kyc",
-  name: "KYC Agent",
-  role: "Verifies identity documents and flags compliance gaps",
-  status: "draft",
-  version: "v2-draft",
-  model: "claude-sonnet-4.5",
-  toolMode: "restricted",
-  deniedTools: ["send.email", "invoke.webhook"],
-  evalsPassing: 14,
-  evalsTotal: 20,
-  scenarios: [
-    {
-      id: "sc-kyc-1",
-      name: "KYC question",
-      expectation: "Answer from the verified document set, never invent facts",
-      enabled: true,
-    },
-    {
-      id: "sc-kyc-2",
-      name: "Expired identity document",
-      expectation: "Mark verification as failed and request a fresh document",
-      enabled: true,
-    },
-    {
-      id: "sc-kyc-3",
-      name: "Compliance escalation",
-      expectation: "Escalate sanctions-list hits to the compliance officer",
-      enabled: true,
-    },
-  ],
-  evalCases: [
-    { id: "ec-kyc-1", name: "Valid passport", passing: true, latencyMs: 2200 },
-    { id: "ec-kyc-2", name: "Expired licence", passing: true, latencyMs: 2050 },
-    {
-      id: "ec-kyc-3",
-      name: "Sanctions-list match",
-      passing: false,
-      latencyMs: 2600,
-    },
-    {
-      id: "ec-kyc-4",
-      name: "Mismatched name fields",
-      passing: false,
-      latencyMs: 2310,
-    },
-  ],
-  versions: [
-    {
-      version: "v2-draft",
-      status: "draft",
-      createdAt: "2026-06-12T13:40:00Z",
-      author: "risk@acme.com",
-      note: "Sanctions-list escalation path (in review)",
-    },
-    {
-      version: "v1",
-      status: "published",
-      createdAt: "2026-03-22T10:15:00Z",
-      author: "risk@acme.com",
-      note: "Initial publish",
-    },
-  ],
-};
-
-/**
- * Enterprise-only agent — governance-heavy and exercised against a larger
- * golden set than the base tenants get, so it only appears for that tier.
- */
-const COMPLIANCE_SWEEP: Agent = {
-  id: "agent-compliance-sweep",
-  name: "Compliance Sweep",
-  role: "Audits processed documents against retention and PII policy",
-  status: "published",
-  version: "v4",
-  model: "claude-opus-4.1",
-  toolMode: "restricted",
-  deniedTools: ["send.email", "route.pipeline", "invoke.webhook"],
-  evalsPassing: 58,
-  evalsTotal: 60,
-  scenarios: [
-    {
-      id: "sc-cs-1",
-      name: "Over-retention detection",
-      expectation: "Flag documents held past their retention window",
-      enabled: true,
-    },
-    {
-      id: "sc-cs-2",
-      name: "Unredacted PII",
-      expectation: "Quarantine and write an audit entry, never auto-delete",
-      enabled: true,
-    },
-  ],
-  evalCases: [
-    {
-      id: "ec-cs-1",
-      name: "Expired retention",
-      passing: true,
-      latencyMs: 3100,
-    },
-    { id: "ec-cs-2", name: "SSN in free text", passing: true, latencyMs: 2900 },
-    {
-      id: "ec-cs-3",
-      name: "Redacted re-share",
-      passing: true,
-      latencyMs: 2700,
-    },
-    {
-      id: "ec-cs-4",
-      name: "Cross-region copy",
-      passing: false,
-      latencyMs: 3300,
-    },
-  ],
-  versions: [
-    {
-      version: "v4",
-      status: "published",
-      createdAt: "2026-06-03T15:05:00Z",
-      author: "compliance@acme.com",
-      note: "Cross-region copy detection",
-    },
-    {
-      version: "v3",
-      status: "published",
-      createdAt: "2026-05-01T12:00:00Z",
-      author: "compliance@acme.com",
-      note: "Retention-window policy refresh",
-    },
-    {
-      version: "v2",
-      status: "published",
-      createdAt: "2026-03-14T09:00:00Z",
-      author: "compliance@acme.com",
-      note: "PII quarantine workflow",
-    },
-    {
-      version: "v1",
-      status: "published",
-      createdAt: "2026-01-20T08:00:00Z",
-      author: "you@acme.com",
-      note: "Initial publish",
-    },
-  ],
-};
-
-/**
- * On the free tier a single starter agent ships as a draft so the surface has
- * something to render, but with an empty golden set and no version history —
- * evals and version governance are paid capabilities.
- */
-const STARTER_AGENT: Agent = {
-  id: "agent-starter",
-  name: "Starter Classifier",
-  role: "Sorts uploads into a handful of document types",
-  status: "draft",
-  version: "v1-draft",
-  model: "claude-haiku-4.5",
-  toolMode: "broad",
-  deniedTools: [],
-  evalsPassing: 0,
-  evalsTotal: 0,
-  scenarios: [
-    {
-      id: "sc-st-1",
-      name: "Unknown document type",
-      expectation: "Fall back to the inbox queue instead of guessing",
-      enabled: true,
-    },
-  ],
-  evalCases: [],
-  versions: [
-    {
-      version: "v1-draft",
-      status: "draft",
-      createdAt: "2026-06-14T17:30:00Z",
-      author: "you@acme.com",
-      note: "Draft — not yet published",
-    },
-  ],
-};
-
-const PRO_AGENTS: Agent[] = [CONTRACT_ROUTER, INVOICE_AGENT, KYC_AGENT];
-
-/**
- * Trim an agent to the free-tier shape: drop the eval golden set and collapse
- * version history to the current version, mirroring the capability gating the
- * KPI strip advertises.
- */
-function toFreeShape(agent: Agent): Agent {
-  return {
-    ...agent,
-    status: "draft",
-    evalsPassing: 0,
-    evalsTotal: 0,
-    evalCases: [],
-    versions: agent.versions.slice(0, 1),
-  };
-}
-
-/** Agents for a given tier. */
-export function agentsFor(tier: Tier): Agent[] {
-  if (tier === "free") return [toFreeShape(STARTER_AGENT)];
-  if (tier === "enterprise") return [...PRO_AGENTS, COMPLIANCE_SWEEP];
-  return PRO_AGENTS;
-}
-
-function summaryFor(agents: Agent[]): AgentsSummary {
-  const published = agents.filter((a) => a.status === "published");
-  const totalScenarios = agents.reduce((n, a) => n + a.scenarios.length, 0);
-
-  // Pass-rate is meaningless without a golden set, so average only over agents
-  // that actually have eval cases — free tenants land at 0.
-  const withEvals = agents.filter((a) => a.evalsTotal > 0);
-  const avgPassRate =
-    withEvals.length === 0
-      ? 0
-      : withEvals.reduce((sum, a) => sum + a.evalsPassing / a.evalsTotal, 0) /
-        withEvals.length;
-
-  const latestPublished = published.length > 0 ? published[0].version : "—";
-
-  return {
-    activeAgents: published.length,
-    totalAgents: agents.length,
-    avgPassRate,
-    totalScenarios,
-    latestPublished,
-  };
-}
-
-export function buildAgentsResponse(tier: Tier): AgentsResponse {
-  const agents = agentsFor(tier);
-  return { summary: summaryFor(agents), agents };
-}
diff --git a/frontend/editor/src/portal/mocks/handlers/agents.ts b/frontend/editor/src/portal/mocks/handlers/agents.ts
deleted file mode 100644
index a5b054c57e..0000000000
--- a/frontend/editor/src/portal/mocks/handlers/agents.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-import { http, HttpResponse, delay } from "msw";
-import type { Tier } from "@portal/contexts/TierContext";
-import { buildAgentsResponse } from "@portal/mocks/agents";
-
-export const agentsHandlers = [
-  http.get("/v1/agents", async ({ request }) => {
-    await delay(120);
-    const url = new URL(request.url);
-    const tier = (url.searchParams.get("tier") ?? "pro") as Tier;
-    return HttpResponse.json(buildAgentsResponse(tier));
-  }),
-];
diff --git a/frontend/editor/src/portal/mocks/handlers/index.ts b/frontend/editor/src/portal/mocks/handlers/index.ts
index 29d7415c61..8163c10e4d 100644
--- a/frontend/editor/src/portal/mocks/handlers/index.ts
+++ b/frontend/editor/src/portal/mocks/handlers/index.ts
@@ -10,7 +10,6 @@ import { procurementSaasHandlers } from "@portal/mocks/handlers/procurementSaas"
 import { docsHandlers } from "@portal/mocks/handlers/docs";
 import { usersHandlers } from "@portal/mocks/handlers/users";
 import { teamSaasHandlers } from "@portal/mocks/handlers/teamSaas";
-import { agentsHandlers } from "@portal/mocks/handlers/agents";
 import { policiesHandlers } from "@portal/mocks/handlers/policies";
 import { classificationHandlers } from "@portal/mocks/handlers/classification";
 import { documentsHandlers } from "@portal/mocks/handlers/documents";
@@ -30,7 +29,6 @@ export const handlers = [
   ...procurementSaasHandlers,
   ...usersHandlers,
   ...teamSaasHandlers,
-  ...agentsHandlers,
   ...policiesHandlers,
   ...classificationHandlers,
   ...documentsHandlers,
diff --git a/frontend/editor/src/portal/views/AgentBuilder.css b/frontend/editor/src/portal/views/AgentBuilder.css
deleted file mode 100644
index e4be384bf9..0000000000
--- a/frontend/editor/src/portal/views/AgentBuilder.css
+++ /dev/null
@@ -1,458 +0,0 @@
-.portal-agents {
-  display: flex;
-  flex-direction: column;
-  gap: 1.25rem;
-  padding: 1.5rem;
-  max-width: 84rem;
-  margin: 0 auto;
-}
-
-/* Header */
-.portal-agents__head {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 1rem;
-}
-
-.portal-agents__title {
-  margin: 0;
-  font-size: 1.375rem;
-  font-weight: 650;
-  color: var(--color-text-1);
-}
-
-.portal-agents__sub {
-  margin: 0.25rem 0 0;
-  font-size: 0.8125rem;
-  line-height: 1.5;
-  color: var(--color-text-3);
-  max-width: 46rem;
-}
-
-/* Two-column layout: selector rail + builder */
-.portal-agents__layout {
-  display: grid;
-  grid-template-columns: 17rem 1fr;
-  gap: 1.25rem;
-  align-items: start;
-}
-
-@media (max-width: 56rem) {
-  .portal-agents__layout {
-    grid-template-columns: 1fr;
-  }
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Selector rail                                                            */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-.portal-agents__selector {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.portal-agents__selector-item {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-  text-align: left;
-  padding: 0.75rem 0.875rem;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-lg);
-  cursor: pointer;
-  transition:
-    border-color var(--motion-fast),
-    background var(--motion-fast);
-}
-
-.portal-agents__selector-item:hover {
-  background: var(--color-bg-hover);
-}
-
-.portal-agents__selector-item.is-selected {
-  border-color: var(--color-blue);
-  background: var(--color-blue-light);
-  box-shadow: 0 0 0 1px var(--color-blue) inset;
-}
-
-.portal-agents__selector-main {
-  display: flex;
-  flex-direction: column;
-  gap: 0.25rem;
-  min-width: 0;
-}
-
-.portal-agents__selector-name {
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-agents__selector-role {
-  font-size: 0.6875rem;
-  line-height: 1.4;
-  color: var(--color-text-4);
-}
-
-.portal-agents__selector-meta {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-}
-
-.portal-agents__selector-version,
-.portal-agents__builder-version,
-.portal-agents__builder-model,
-.portal-agents__version-tag {
-  font-family: var(--font-mono);
-  font-size: 0.6875rem;
-  color: var(--color-text-3);
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Builder panel                                                            */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-.portal-agents__builder {
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-lg);
-  box-shadow: var(--shadow-sm);
-  padding: 1.25rem;
-  display: flex;
-  flex-direction: column;
-  gap: 1.125rem;
-}
-
-.portal-agents__builder-head {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 1rem;
-}
-
-.portal-agents__builder-title {
-  margin: 0;
-  font-size: 1rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-agents__builder-sub {
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-}
-
-.portal-agents__builder-meta {
-  display: flex;
-  align-items: center;
-  gap: 0.625rem;
-  flex-shrink: 0;
-}
-
-.portal-agents__builder-model {
-  background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
-  border-radius: var(--radius-md);
-  padding: 0.125rem 0.375rem;
-}
-
-/* Shared panel body */
-.portal-agents__panel {
-  display: flex;
-  flex-direction: column;
-  gap: 1.125rem;
-}
-
-.portal-agents__detail-section {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.portal-agents__detail-heading {
-  font-size: 0.6875rem;
-  text-transform: uppercase;
-  letter-spacing: 0.04em;
-  color: var(--color-text-5);
-  font-weight: 600;
-}
-
-.portal-agents__chips {
-  display: flex;
-  flex-wrap: wrap;
-  gap: 0.375rem;
-}
-
-.portal-agents__hint {
-  margin: 0;
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-}
-
-.portal-agents__muted {
-  font-size: 0.8125rem;
-  color: var(--color-text-4);
-}
-
-.portal-agents__mono {
-  font-family: var(--font-mono);
-  font-size: 0.75rem;
-  color: var(--color-text-2);
-}
-
-.portal-agents__stat-grid {
-  display: grid;
-  grid-template-columns: repeat(4, 1fr);
-  gap: 0.875rem;
-}
-
-.portal-agents__stat-grid--two {
-  grid-template-columns: repeat(2, minmax(0, 14rem));
-}
-
-/* Bars (eval pass-rate) */
-.portal-agents__bar-row {
-  display: flex;
-  flex-direction: column;
-  gap: 0.4375rem;
-}
-
-.portal-agents__bar-head {
-  display: flex;
-  align-items: baseline;
-  justify-content: space-between;
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-}
-
-.portal-agents__bar-head strong {
-  font-size: 0.8125rem;
-  color: var(--color-text-1);
-  font-family: var(--font-mono);
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Scenarios                                                                */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-.portal-agents__scenarios {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.portal-agents__scenario {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.75rem;
-  padding: 0.75rem 0.875rem;
-  background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
-  border-radius: var(--radius-md);
-}
-
-.portal-agents__scenario-text {
-  display: flex;
-  flex-direction: column;
-  gap: 0.25rem;
-  min-width: 0;
-}
-
-.portal-agents__scenario-head {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-}
-
-.portal-agents__scenario-head strong {
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-agents__scenario-expect {
-  font-size: 0.75rem;
-  line-height: 1.45;
-  color: var(--color-text-3);
-}
-
-.portal-agents__scenario-add {
-  display: flex;
-  flex-direction: column;
-  gap: 0.625rem;
-  padding-top: 0.25rem;
-  border-top: 1px dashed var(--color-border-light);
-}
-
-.portal-agents__scenario-form {
-  display: grid;
-  grid-template-columns: 1fr 1.5fr auto;
-  align-items: end;
-  gap: 0.625rem;
-}
-
-@media (max-width: 48rem) {
-  .portal-agents__scenario-form {
-    grid-template-columns: 1fr;
-  }
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Tools                                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-.portal-agents__tool-mode {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 1rem;
-  padding: 0.875rem 1rem;
-  background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
-  border-radius: var(--radius-md);
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Evals                                                                    */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-.portal-agents__eval-head {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 1rem;
-  flex-wrap: wrap;
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Versions                                                                 */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-.portal-agents__versions {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-}
-
-.portal-agents__version {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.75rem;
-  padding: 0.75rem 0.875rem;
-  background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
-  border-radius: var(--radius-md);
-}
-
-.portal-agents__version-main {
-  display: flex;
-  flex-direction: column;
-  gap: 0.25rem;
-  min-width: 0;
-}
-
-.portal-agents__version-head {
-  display: flex;
-  align-items: center;
-  gap: 0.5rem;
-}
-
-.portal-agents__version-tag {
-  font-size: 0.8125rem;
-  color: var(--color-text-1);
-  font-weight: 600;
-}
-
-.portal-agents__version-note {
-  font-size: 0.8125rem;
-  color: var(--color-text-2);
-}
-
-.portal-agents__version-meta {
-  font-size: 0.6875rem;
-  color: var(--color-text-5);
-}
-
-.portal-agents__version-actions {
-  flex-shrink: 0;
-}
-
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Bootstrap dialog                                                         */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-.portal-agents__bootstrap {
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-}
-
-.portal-agents__bootstrap-lead {
-  margin: 0;
-  font-size: 0.875rem;
-  line-height: 1.55;
-  color: var(--color-text-2);
-}
-
-.portal-agents__dropzone {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  gap: 0.5rem;
-  padding: 1.75rem 1rem;
-  text-align: center;
-  background: var(--color-bg-subtle);
-  border: 1px dashed var(--color-border);
-  border-radius: var(--radius-lg);
-  cursor: pointer;
-  transition:
-    border-color var(--motion-fast),
-    background var(--motion-fast);
-}
-
-.portal-agents__dropzone:hover {
-  border-color: var(--color-blue);
-  background: var(--color-blue-light);
-}
-
-.portal-agents__dropzone-input {
-  position: absolute;
-  width: 1px;
-  height: 1px;
-  padding: 0;
-  margin: -1px;
-  overflow: hidden;
-  clip: rect(0, 0, 0, 0);
-  white-space: nowrap;
-  border: 0;
-}
-
-.portal-agents__dropzone-icon {
-  font-size: 1.5rem;
-  color: var(--color-text-3);
-}
-
-.portal-agents__dropzone-text {
-  font-size: 0.8125rem;
-  color: var(--color-text-3);
-}
-
-.portal-agents__dialog-footer {
-  display: flex;
-  justify-content: space-between;
-  gap: 0.5rem;
-  width: 100%;
-}
diff --git a/frontend/editor/src/portal/views/AgentBuilder.tsx b/frontend/editor/src/portal/views/AgentBuilder.tsx
deleted file mode 100644
index 30a8f5e14e..0000000000
--- a/frontend/editor/src/portal/views/AgentBuilder.tsx
+++ /dev/null
@@ -1,101 +0,0 @@
-import { useState } from "react";
-import { useTranslation } from "react-i18next";
-import FileUploadRounded from "@mui/icons-material/FileUploadRounded";
-import { Button, EmptyState, Skeleton } from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import { fetchAgents, type AgentsResponse } from "@portal/api/agents";
-import { AgentKpiStrip } from "@portal/components/agent-builder/AgentKpiStrip";
-import { AgentSelector } from "@portal/components/agent-builder/AgentSelector";
-import { AgentBuilderPanel } from "@portal/components/agent-builder/AgentBuilderPanel";
-import { BootstrapDialog } from "@portal/components/agent-builder/BootstrapDialog";
-import "@portal/views/AgentBuilder.css";
-
-export function AgentBuilder() {
-  const { t } = useTranslation();
-  const { tier } = useTier();
-  const state = useAsync<AgentsResponse>(() => fetchAgents(tier), [tier]);
-  const { data, loading } = state;
-  const { isLoading, isEmpty } = useSectionFlags(state);
-
-  const [selectedId, setSelectedId] = useState<string | null>(null);
-  const [bootstrapOpen, setBootstrapOpen] = useState(false);
-
-  const agents = data?.agents ?? [];
-  // Default the selection to the first agent once data lands, but honour an
-  // explicit pick. Recomputed each render so a tier change re-points cleanly.
-  const selected = agents.find((a) => a.id === selectedId) ?? agents[0] ?? null;
-
-  // Enterprise unlocks restricted-tools governance and deep version history.
-  const governanceUnlocked = tier === "enterprise";
-
-  return (
-    <div className="portal-agents">
-      <header className="portal-agents__head">
-        <div>
-          <h1 className="portal-agents__title">
-            {t("portal.agentBuilder.title")}
-          </h1>
-          <p className="portal-agents__sub">
-            {t("portal.agentBuilder.subtitle")}
-          </p>
-        </div>
-        <Button
-          onClick={() => setBootstrapOpen(true)}
-          leftSection={<FileUploadRounded style={{ fontSize: "1.2rem" }} />}
-        >
-          {t("portal.agentBuilder.bootstrapFromDocument")}
-        </Button>
-      </header>
-
-      <AgentKpiStrip summary={data?.summary ?? null} loading={loading} />
-
-      {isLoading && (
-        <div className="portal-agents__layout">
-          <div className="portal-agents__selector" aria-hidden>
-            {Array.from({ length: 3 }).map((_, i) => (
-              <Skeleton key={i} height="4rem" />
-            ))}
-          </div>
-          <div className="portal-agents__builder" aria-hidden>
-            <Skeleton height="18rem" />
-          </div>
-        </div>
-      )}
-
-      {isEmpty && (
-        <EmptyState
-          title={t("portal.agentBuilder.empty.title")}
-          description={t("portal.agentBuilder.empty.description")}
-          actions={
-            <Button onClick={() => setBootstrapOpen(true)}>
-              {t("portal.agentBuilder.bootstrapFromDocument")}
-            </Button>
-          }
-        />
-      )}
-
-      {!isLoading && !isEmpty && selected && (
-        <div className="portal-agents__layout">
-          <AgentSelector
-            agents={agents}
-            selectedId={selected.id}
-            onSelect={setSelectedId}
-          />
-          <AgentBuilderPanel
-            // Remount on selection change so each panel re-seeds its local
-            // edit state from the freshly selected agent.
-            key={selected.id}
-            agent={selected}
-            governanceUnlocked={governanceUnlocked}
-          />
-        </div>
-      )}
-
-      <BootstrapDialog
-        open={bootstrapOpen}
-        onClose={() => setBootstrapOpen(false)}
-      />
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/views/Sources.test.tsx b/frontend/editor/src/portal/views/Sources.test.tsx
index a006cbe4a2..2bdda1b64b 100644
--- a/frontend/editor/src/portal/views/Sources.test.tsx
+++ b/frontend/editor/src/portal/views/Sources.test.tsx
@@ -31,11 +31,6 @@ vi.mock("@portal/api/integrations", () => ({
   deleteIntegration: vi.fn(),
 }));
 
-// The Agent Builder header action is a flavor seam; stub it to keep the test focused.
-vi.mock("@portal/components/sources/AgentBuilderAction", () => ({
-  AgentBuilderAction: () => null,
-}));
-
 const RESPONSE: SourcesResponse = {
   kpis: [
     { value: 1, description: "" },
diff --git a/frontend/editor/src/portal/views/Sources.tsx b/frontend/editor/src/portal/views/Sources.tsx
index fb0b14ccf5..385a0ab121 100644
--- a/frontend/editor/src/portal/views/Sources.tsx
+++ b/frontend/editor/src/portal/views/Sources.tsx
@@ -10,7 +10,6 @@ import {
   type SourceView,
 } from "@portal/api/sources";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
-import { AgentBuilderAction } from "@portal/components/sources/AgentBuilderAction";
 import { KpiStrip } from "@portal/components/sources/KpiStrip";
 import { SourcesTable } from "@portal/components/sources/SourcesTable";
 import { ConnectionsTab } from "@portal/components/sources/ConnectionsTab";
@@ -55,7 +54,6 @@ export function Sources() {
         </div>
         {activeTab === "sources" && (
           <div className="portal-sources__actions">
-            <AgentBuilderAction />
             <Button
               onClick={openCreate}
               leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}

From 8b179fbc55d7bb912c98bec5423ed268b042b9dc Mon Sep 17 00:00:00 2001
From: Reece Browne <74901996+reecebrowne@users.noreply.github.com>
Date: Fri, 17 Jul 2026 16:01:58 +0100
Subject: [PATCH 043/109] Support translations in Storybook: locale toolbar
 (#6843)

## What

Adds a globe toolbar to Storybook so any story can be previewed in all
42 supported languages (the i18n init already on `main` was
English-only).

## How

Bundles every locale's `translation.toml` via a `?raw` glob into i18next
resources, and switches language on toolbar change. RTL locales (`ar`,
`fa`) flip `document.dir`.

---------

Co-authored-by: James Brunton <jbrunton96@gmail.com>
---
 frontend/.storybook/preview.tsx | 85 ++++++++++++++++++++++++---------
 1 file changed, 62 insertions(+), 23 deletions(-)

diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index 4f358cc634..b2459cd926 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -1,3 +1,4 @@
+/// <reference types="vite/client" />
 // Storybook compiles .storybook/* with the classic JSX runtime, so the JSX in
 // the decorators below transpiles to React.createElement and needs React in
 // scope. (The app + story files use the automatic runtime via the portal vite
@@ -22,28 +23,38 @@ import { configureSupabase } from "@proprietary/auth/supabase/supabaseClient";
 import i18next from "i18next";
 import { initReactI18next } from "react-i18next";
 import { parse as parseToml } from "smol-toml";
-// Load the real English copy so stories render human text, not raw keys. Bundled
-// synchronously via ?raw so it's present on the very first render (no async flash).
-import enTranslationToml from "@public/locales/en-US/translation.toml?raw";
+import { rtlLanguages, supportedLanguages } from "@core/i18n/languages";
 
 import "@mantine/core/styles.css";
 import "@core/tokens/tokens.css";
 import "@core/theme/index.css";
 import "@core/tokens/base.css";
 
-// Storybook-only: init react-i18next with the real English resources parsed from
-// the app's TOML, so t(key) renders the shipped copy (e.g. "No sources connected
-// yet") rather than the raw key. Falls back to an empty bundle if parsing ever
-// fails, so a malformed TOML can't take the whole Storybook down.
-function parseEnTranslation(): Record<string, unknown> {
+// Storybook-only: bundle every shipped locale's TOML at build time via a ?raw
+// glob, so the toolbar language switcher can flip between all languages with no
+// async fetch (Storybook has no backend to serve /locales/). t(key) then renders
+// the shipped copy (e.g. "No sources connected yet") rather than the raw key.
+const localeModules = import.meta.glob<string>(
+  "../editor/public/locales/*/translation.toml",
+  { query: "?raw", import: "default", eager: true },
+);
+
+// Parse each locale into an i18next resources map. A malformed TOML degrades to
+// an empty bundle for that one locale (its keys fall back to en-US) rather than
+// taking the whole Storybook down.
+const resources: Record<string, { translation: Record<string, unknown> }> = {};
+for (const [path, raw] of Object.entries(localeModules)) {
+  const lng = path.match(/\/locales\/([^/]+)\/translation\.toml$/)?.[1];
+  if (!lng) continue;
+  let translation: Record<string, unknown>;
   try {
-    return parseToml(enTranslationToml) as Record<string, unknown>;
+    translation = parseToml(raw) as Record<string, unknown>;
   } catch {
-    return {};
+    translation = {};
   }
+  resources[lng] = { translation };
 }
 
-const enTranslationResources = parseEnTranslation();
 if (!i18next.isInitialized) {
   // initImmediate: false → initialise synchronously from the inline resources
   // (there's no async backend here), so i18next is ready before the first story
@@ -51,24 +62,25 @@ if (!i18next.isInitialized) {
   void i18next.use(initReactI18next).init({
     lng: "en-US",
     fallbackLng: "en-US",
-    supportedLngs: ["en-US"],
-    resources: { "en-US": { translation: enTranslationResources } },
+    supportedLngs: Object.keys(resources),
+    resources,
     interpolation: { escapeValue: false },
     react: { useSuspense: false },
     initImmediate: false,
   });
 } else {
   // Something initialised i18next first (e.g. the app's async TOML backend):
-  // inject the shipped English copy under the resolved language so t() renders
-  // real copy, not raw keys.
-  const lng = i18next.resolvedLanguage || i18next.language || "en-US";
-  i18next.addResourceBundle(
-    lng,
-    "translation",
-    enTranslationResources,
-    true,
-    true,
-  );
+  // inject every shipped locale's copy so t() renders real copy, not raw keys,
+  // and the toolbar switcher can still change to any of them.
+  for (const [lng, bundle] of Object.entries(resources)) {
+    i18next.addResourceBundle(
+      lng,
+      "translation",
+      bundle.translation,
+      true,
+      true,
+    );
+  }
 }
 
 // Start MSW once. Storybook runs in a browser so this uses the service worker.
@@ -156,6 +168,19 @@ function SchemeSetup({ scheme }: { scheme: "light" | "dark" }) {
   return null;
 }
 
+/** Switches i18next to the toolbar locale and keeps document dir/lang in sync. */
+const withLocale: Decorator = (Story, context) => {
+  const locale = (context.globals.locale as string) ?? "en-US";
+  useEffect(() => {
+    void i18next.changeLanguage(locale);
+    document.documentElement.dir = rtlLanguages.includes(locale)
+      ? "rtl"
+      : "ltr";
+    document.documentElement.lang = locale;
+  }, [locale]);
+  return <Story />;
+};
+
 const withProviders: Decorator = (Story, context) => {
   const tier = (context.globals.tier as Tier) ?? "pro";
   const linkState =
@@ -243,8 +268,22 @@ const preview: Preview = {
         dynamicTitle: true,
       },
     },
+    locale: {
+      name: "Locale",
+      description: "Active language — drives useTranslation() in all stories",
+      defaultValue: "en-US",
+      toolbar: {
+        icon: "globe",
+        items: Object.entries(supportedLanguages).map(([value, title]) => ({
+          value,
+          title: `${value} - ${title}`,
+        })),
+        dynamicTitle: true,
+      },
+    },
   },
   decorators: [
+    withLocale,
     withProviders,
     withThemeByDataAttribute({
       themes: { light: "light", dark: "dark" },

From b509fae0c8f1e3887f4d6311887c8cb250d9623f Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Sun, 19 Jul 2026 18:42:43 +0100
Subject: [PATCH 044/109] Split processor sidebar into PDF Processor and PDF
 Platform sections (#7072)

---
 .../public/locales/en-GB/translation.toml     |  4 +++
 .../public/locales/en-US/translation.toml     |  4 +++
 .../components/sidebarGroups.test.ts          | 17 ++++-------
 .../portal-saas/components/sidebarGroups.tsx  |  8 ++---
 .../editor/src/portal/components/Sidebar.css  | 26 ++++++++++++----
 .../editor/src/portal/components/Sidebar.tsx  | 30 +++++++++++--------
 .../src/portal/components/sidebarGroups.tsx   | 14 +++++++--
 7 files changed, 66 insertions(+), 37 deletions(-)

diff --git a/frontend/editor/public/locales/en-GB/translation.toml b/frontend/editor/public/locales/en-GB/translation.toml
index 10b90e2f8a..431fa7af66 100644
--- a/frontend/editor/public/locales/en-GB/translation.toml
+++ b/frontend/editor/public/locales/en-GB/translation.toml
@@ -7202,6 +7202,10 @@ sources = "Sources"
 usage = "Usage & Billing"
 users = "Users"
 
+[portal.nav.section]
+platform = "PDF Platform"
+processor = "PDF Processor"
+
 [portal.notifications]
 markAllRead = "Mark all read"
 title = "Notifications"
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 9681a69f2f..1589cad8a7 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7144,6 +7144,10 @@ sources = "Sources"
 usage = "Usage & Billing"
 users = "Users"
 
+[portal.nav.section]
+platform = "PDF Platform"
+processor = "PDF Processor"
+
 [portal.pipelines]
 subtitle = "Every automated document pipeline on the backend: an ordered chain of operations over a set of sources, run on a trigger. Click a row for its steps and sources."
 title = "Pipelines"
diff --git a/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts b/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts
index 892d1b0514..aaec0024f1 100644
--- a/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts
+++ b/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts
@@ -1,19 +1,14 @@
 import { describe, expect, it } from "vitest";
 // Resolves to the SaaS override (src/portal-saas) via the @portal cascade.
 import {
-  GROUP_PRIMARY,
-  GROUP_OPERATIONAL,
+  GROUP_PROCESSOR,
   GROUP_PLATFORM,
 } from "@portal/components/sidebarGroups";
 
 describe("sidebarGroups (SaaS)", () => {
-  it("drops Components from the operational nav", () => {
-    expect(GROUP_OPERATIONAL.map((e) => e.id)).not.toContain("components");
-  });
-
-  it("inherits the other operational items from base", () => {
-    expect(GROUP_OPERATIONAL.map((e) => e.id)).toEqual([
-      "users",
+  it("inherits the processor group unchanged from base", () => {
+    expect(GROUP_PROCESSOR.map((e) => e.id)).toEqual([
+      "home",
       "sources",
       "policies",
       "pipelines",
@@ -21,9 +16,9 @@ describe("sidebarGroups (SaaS)", () => {
     ]);
   });
 
-  it("inherits the primary + platform groups unchanged", () => {
-    expect(GROUP_PRIMARY.map((e) => e.id)).toEqual(["home"]);
+  it("inherits the platform group unchanged from base", () => {
     expect(GROUP_PLATFORM.map((e) => e.id)).toEqual([
+      "users",
       "infrastructure",
       "usage",
       "docs",
diff --git a/frontend/editor/src/portal-saas/components/sidebarGroups.tsx b/frontend/editor/src/portal-saas/components/sidebarGroups.tsx
index 3301f567d5..9e51b1b307 100644
--- a/frontend/editor/src/portal-saas/components/sidebarGroups.tsx
+++ b/frontend/editor/src/portal-saas/components/sidebarGroups.tsx
@@ -1,11 +1,11 @@
 import {
-  GROUP_PRIMARY,
-  GROUP_OPERATIONAL,
+  GROUP_PROCESSOR,
   GROUP_PLATFORM,
   type NavEntry,
+  type NavGroup,
 } from "@portal-proprietary/components/sidebarGroups";
 
 // SaaS shadows the base nav groups so sections not yet shipped there can be
 // dropped. Nothing is currently removed, so the base groups pass through as-is.
-export { GROUP_PRIMARY, GROUP_OPERATIONAL, GROUP_PLATFORM };
-export type { NavEntry };
+export { GROUP_PROCESSOR, GROUP_PLATFORM };
+export type { NavEntry, NavGroup };
diff --git a/frontend/editor/src/portal/components/Sidebar.css b/frontend/editor/src/portal/components/Sidebar.css
index 98a9b63ec3..935a55e722 100644
--- a/frontend/editor/src/portal/components/Sidebar.css
+++ b/frontend/editor/src/portal/components/Sidebar.css
@@ -46,18 +46,32 @@
   gap: 0.5rem;
 }
 
+/* Each section is a labelled card: a small header above its nav items. */
+.portal-sidebar__section {
+  background: var(--color-surface);
+  border: 1px solid var(--color-sidebar-divider);
+  border-radius: 0.625rem;
+  padding: 0.5rem 0.375rem 0.375rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.375rem;
+}
+
+.portal-sidebar__section-label {
+  margin: 0;
+  padding: 0 0.5rem;
+  font-size: 0.6875rem;
+  font-weight: 600;
+  letter-spacing: 0.02em;
+  color: var(--color-text-3);
+}
+
 .portal-sidebar__group {
   display: flex;
   flex-direction: column;
   gap: 0.125rem;
 }
 
-.portal-sidebar__divider {
-  height: 1px;
-  background: var(--color-sidebar-divider);
-  margin: 0.25rem 0;
-}
-
 /* Footer */
 .portal-sidebar__footer {
   border-top: 1px solid var(--color-sidebar-divider);
diff --git a/frontend/editor/src/portal/components/Sidebar.tsx b/frontend/editor/src/portal/components/Sidebar.tsx
index 6e21d8b8d2..5b512a7184 100644
--- a/frontend/editor/src/portal/components/Sidebar.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.tsx
@@ -11,13 +11,18 @@ import wordmarkLight from "@app/assets/brand/modern-logo/StirlingProcessorLogoBl
 import wordmarkDark from "@app/assets/brand/modern-logo/StirlingProcessorLogoWhiteText.svg";
 import { SettingsIcon } from "@portal/components/icons";
 import {
-  GROUP_PRIMARY,
-  GROUP_OPERATIONAL,
+  GROUP_PROCESSOR,
   GROUP_PLATFORM,
   type NavEntry,
+  type NavGroup,
 } from "@portal/components/sidebarGroups";
 import "@portal/components/Sidebar.css";
 
+const NAV_SECTIONS: NavGroup[] = [
+  { labelKey: "portal.nav.section.processor", entries: GROUP_PROCESSOR },
+  { labelKey: "portal.nav.section.platform", entries: GROUP_PLATFORM },
+];
+
 export function Sidebar() {
   const { activeView, setActiveView } = useView();
   const { theme } = useTheme();
@@ -76,17 +81,16 @@ export function Sidebar() {
       </div>
 
       <nav className="portal-sidebar__nav">
-        <div className="portal-sidebar__group">
-          {renderGroup(GROUP_PRIMARY)}
-        </div>
-        <div className="portal-sidebar__divider" aria-hidden />
-        <div className="portal-sidebar__group">
-          {renderGroup(GROUP_OPERATIONAL)}
-        </div>
-        <div className="portal-sidebar__divider" aria-hidden />
-        <div className="portal-sidebar__group">
-          {renderGroup(GROUP_PLATFORM)}
-        </div>
+        {NAV_SECTIONS.map((section) => (
+          <section key={section.labelKey} className="portal-sidebar__section">
+            <h2 className="portal-sidebar__section-label">
+              {t(section.labelKey)}
+            </h2>
+            <div className="portal-sidebar__group">
+              {renderGroup(section.entries)}
+            </div>
+          </section>
+        ))}
       </nav>
 
       <div className="portal-sidebar__footer">
diff --git a/frontend/editor/src/portal/components/sidebarGroups.tsx b/frontend/editor/src/portal/components/sidebarGroups.tsx
index 9bf2626b34..7b461cb057 100644
--- a/frontend/editor/src/portal/components/sidebarGroups.tsx
+++ b/frontend/editor/src/portal/components/sidebarGroups.tsx
@@ -19,19 +19,27 @@ export interface NavEntry {
   externalUrl?: string;
 }
 
+export interface NavGroup {
+  /** i18n key for the section header shown above the group. */
+  labelKey: string;
+  entries: NavEntry[];
+}
+
 // Sidebar nav groups. This is a flavor seam: the SaaS build shadows this file to
 // drop sections not yet shipped there (see src/portal-saas/components/sidebarGroups).
-export const GROUP_PRIMARY: NavEntry[] = [{ id: "home", icon: <HomeIcon /> }];
 
-export const GROUP_OPERATIONAL: NavEntry[] = [
-  { id: "users", icon: <UsersIcon /> },
+// The processor's own workflow: home plus the pipeline it feeds.
+export const GROUP_PROCESSOR: NavEntry[] = [
+  { id: "home", icon: <HomeIcon /> },
   { id: "sources", icon: <SourcesIcon /> },
   { id: "policies", icon: <PoliciesIcon /> },
   { id: "pipelines", icon: <PipelinesIcon /> },
   { id: "documents", icon: <DocumentsIcon /> },
 ];
 
+// The wider platform around the processor: people, infra, billing, docs.
 export const GROUP_PLATFORM: NavEntry[] = [
+  { id: "users", icon: <UsersIcon /> },
   { id: "infrastructure", icon: <InfrastructureIcon /> },
   { id: "usage", icon: <UsageIcon /> },
   { id: "docs", icon: <DocsIcon /> },

From 47fe4a1d0600507c70904127e884278241792ac9 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 13:59:27 +0200
Subject: [PATCH 045/109] fix(licenses): fall back to license URL for backend
 dependency links (#7046)

# Description of Changes

This change improves link handling in the third-party licenses section.

- Added a shared `getModuleUrl` helper that returns `moduleUrl` when
available and falls back to `moduleLicenseUrl`.
- Updated backend license entries to render as clickable links when only
a license URL is provided.
- Preserved the existing link behavior, including opening URLs in a new
tab with appropriate security attributes.
- Fixed inconsistent rendering where some dependency names appeared as
plain text despite having an available license URL.

The change was made to ensure backend dependency entries consistently
provide a usable external link, even when dependency metadata does not
include a dedicated module URL.


before:
<img width="1920" height="1080" alt="image"
src="https://github.com/user-attachments/assets/aafee561-43e0-4924-923f-eb4ecf00c873"
/>

after:
<img width="1920" height="1080" alt="image"
src="https://github.com/user-attachments/assets/10a6f76a-6852-49af-a987-e0a864ec0b91"
/>


---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 frontend/editor/scripts/generate-licenses.js  |  51 ++-
 .../editor/src/assets/3rdPartyLicenses.json   | 298 +++++++++---------
 .../ThirdPartyLicensesSection.tsx             |   7 +-
 3 files changed, 201 insertions(+), 155 deletions(-)

diff --git a/frontend/editor/scripts/generate-licenses.js b/frontend/editor/scripts/generate-licenses.js
index 72da16c6a9..4c19a39e8d 100644
--- a/frontend/editor/scripts/generate-licenses.js
+++ b/frontend/editor/scripts/generate-licenses.js
@@ -24,6 +24,8 @@ const OUTPUT_FILE = path.join(
 // package.json lives at the workspace root (frontend/), not editor/. The
 // script is at frontend/editor/scripts/, so walk up two levels.
 const PACKAGE_JSON = path.join(import.meta.dirname, "..", "..", "package.json");
+const PACKAGE_NAME_PATTERN =
+  /^(?:@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/i;
 
 // Ensure the output directory exists
 const outputDir = path.dirname(OUTPUT_FILE);
@@ -74,9 +76,12 @@ try {
     process.exit(1);
   }
 
+  const existingModuleUrls = loadExistingModuleUrls();
+
   // Convert license-checker format to array
   const licenseArray = licenseData.map((dep) => {
     let licenseType = dep.licenseType;
+    const projectUrl = getProjectUrl(dep.name, dep.link, existingModuleUrls);
 
     // Handle missing or null licenses
     if (!licenseType || licenseType === null || licenseType === undefined) {
@@ -114,9 +119,9 @@ try {
         dep.remoteVersion ||
         "unknown",
       licenseType: licenseType,
-      repository: dep.link,
-      url: dep.link,
-      link: dep.link,
+      repository: projectUrl,
+      url: projectUrl,
+      link: projectUrl,
     };
   });
 
@@ -126,7 +131,7 @@ try {
       const licenseType = Array.isArray(dep.licenseType)
         ? dep.licenseType.join(", ")
         : dep.licenseType || "Unknown";
-      const licenseUrl = dep.link || getLicenseUrl(licenseType);
+      const licenseUrl = getLicenseUrl(licenseType) || dep.link;
 
       return {
         moduleName: dep.name,
@@ -224,6 +229,9 @@ try {
 function getLicenseUrl(licenseType) {
   if (!licenseType || licenseType === "Unknown") return "";
 
+  const explicitLicenseUrl = licenseType.match(/https?:\/\/\S+/)?.[0];
+  if (explicitLicenseUrl) return explicitLicenseUrl;
+
   const licenseUrls = {
     MIT: "https://opensource.org/licenses/MIT",
     "MIT*": "https://opensource.org/licenses/MIT",
@@ -278,6 +286,41 @@ function getLicenseUrl(licenseType) {
   return "";
 }
 
+function getProjectUrl(packageName, reportedUrl, existingModuleUrls) {
+  if (!PACKAGE_NAME_PATTERN.test(packageName)) {
+    throw new Error(`Invalid package name: ${packageName}`);
+  }
+
+  return (
+    normalizeProjectUrl(reportedUrl) ||
+    normalizeProjectUrl(existingModuleUrls.get(packageName)) ||
+    `https://www.npmjs.com/package/${packageName}`
+  );
+}
+
+function loadExistingModuleUrls() {
+  try {
+    const existingReport = JSON.parse(readFileSync(OUTPUT_FILE, "utf8"));
+    return new Map(
+      (existingReport.dependencies ?? [])
+        .filter((dependency) => dependency.moduleName && dependency.moduleUrl)
+        .map((dependency) => [dependency.moduleName, dependency.moduleUrl]),
+    );
+  } catch {
+    return new Map();
+  }
+}
+
+function normalizeProjectUrl(url) {
+  if (!url || url === "n/a") return "";
+
+  return url
+    .replace(/^git\+/, "")
+    .replace(/^git:\/\/github\.com\//, "https://github.com/")
+    .replace(/^github:/, "https://github.com/")
+    .replace(/\.git$/, "");
+}
+
 /**
  * Check for potentially problematic licenses that may not be MIT/corporate compatible
  */
diff --git a/frontend/editor/src/assets/3rdPartyLicenses.json b/frontend/editor/src/assets/3rdPartyLicenses.json
index 3b606376de..14d2e1fa5b 100644
--- a/frontend/editor/src/assets/3rdPartyLicenses.json
+++ b/frontend/editor/src/assets/3rdPartyLicenses.json
@@ -2,528 +2,528 @@
   "dependencies": [
     {
       "moduleName": "@atlaskit/pragmatic-drag-and-drop",
-      "moduleUrl": "git+https://github.com/atlassian/pragmatic-drag-and-drop.git",
+      "moduleUrl": "https://github.com/atlassian/pragmatic-drag-and-drop",
       "moduleVersion": "1.7.9",
       "moduleLicense": "Apache-2.0",
-      "moduleLicenseUrl": "git+https://github.com/atlassian/pragmatic-drag-and-drop.git"
+      "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
     },
     {
       "moduleName": "@cantoo/pdf-lib",
-      "moduleUrl": "git+https://github.com/cantoo-scribe/pdf-lib.git",
+      "moduleUrl": "https://github.com/cantoo-scribe/pdf-lib",
       "moduleVersion": "2.6.5",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/cantoo-scribe/pdf-lib.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@dnd-kit/core",
-      "moduleUrl": "git+https://github.com/clauderic/dnd-kit.git",
+      "moduleUrl": "https://github.com/clauderic/dnd-kit",
       "moduleVersion": "6.3.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/clauderic/dnd-kit.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/core",
-      "moduleUrl": "https://registry.npmjs.org/@embedpdf/core/-/core-2.14.4.tgz",
+      "moduleUrl": "https://www.npmjs.com/package/@embedpdf/core",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "https://registry.npmjs.org/@embedpdf/core/-/core-2.14.4.tgz"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/engines",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/models",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-annotation",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-attachment",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-bookmark",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-document-manager",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-export",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-history",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-interaction-manager",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-pan",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-print",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-redaction",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-render",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-rotate",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-scroll",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-search",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-selection",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-spread",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-thumbnail",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-tiling",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-viewport",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@embedpdf/plugin-zoom",
-      "moduleUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git",
+      "moduleUrl": "https://github.com/embedpdf/embed-pdf-viewer",
       "moduleVersion": "2.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/embedpdf/embed-pdf-viewer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@emotion/react",
-      "moduleUrl": "git+https://github.com/emotion-js/emotion.git#main",
+      "moduleUrl": "https://github.com/emotion-js/emotion/tree/main/packages/react",
       "moduleVersion": "11.14.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/emotion-js/emotion.git#main"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@emotion/styled",
-      "moduleUrl": "git+https://github.com/emotion-js/emotion.git#main",
+      "moduleUrl": "https://github.com/emotion-js/emotion/tree/main/packages/styled",
       "moduleVersion": "11.14.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/emotion-js/emotion.git#main"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@iconify/react",
-      "moduleUrl": "git+https://github.com/iconify/iconify.git",
+      "moduleUrl": "https://github.com/iconify/iconify",
       "moduleVersion": "6.0.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/iconify/iconify.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@mantine/core",
-      "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
+      "moduleUrl": "https://github.com/mantinedev/mantine",
       "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@mantine/dates",
-      "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
+      "moduleUrl": "https://github.com/mantinedev/mantine",
       "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@mantine/dropzone",
-      "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
+      "moduleUrl": "https://github.com/mantinedev/mantine",
       "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@mantine/hooks",
-      "moduleUrl": "git+https://github.com/mantinedev/mantine.git",
+      "moduleUrl": "https://github.com/mantinedev/mantine",
       "moduleVersion": "8.3.18",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/mantinedev/mantine.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@mui/icons-material",
-      "moduleUrl": "git+https://github.com/mui/material-ui.git",
+      "moduleUrl": "https://github.com/mui/material-ui",
       "moduleVersion": "9.0.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/mui/material-ui.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@mui/material",
-      "moduleUrl": "git+https://github.com/mui/material-ui.git",
+      "moduleUrl": "https://github.com/mui/material-ui",
       "moduleVersion": "9.0.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/mui/material-ui.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@posthog/react",
-      "moduleUrl": "git+https://github.com/PostHog/posthog-js.git",
+      "moduleUrl": "https://github.com/PostHog/posthog-js",
       "moduleVersion": "1.8.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/PostHog/posthog-js.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@reactour/tour",
-      "moduleUrl": "git+https://github.com/elrumordelaluz/reactour.git",
+      "moduleUrl": "https://github.com/elrumordelaluz/reactour",
       "moduleVersion": "3.8.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/elrumordelaluz/reactour.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@stripe/react-stripe-js",
-      "moduleUrl": "https://github.com/stripe/react-stripe-js.git",
+      "moduleUrl": "https://github.com/stripe/react-stripe-js",
       "moduleVersion": "4.0.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "https://github.com/stripe/react-stripe-js.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@stripe/stripe-js",
-      "moduleUrl": "https://github.com/stripe/stripe-js.git",
+      "moduleUrl": "https://github.com/stripe/stripe-js",
       "moduleVersion": "7.9.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "https://github.com/stripe/stripe-js.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@supabase/supabase-js",
-      "moduleUrl": "https://github.com/supabase/supabase-js.git",
+      "moduleUrl": "https://github.com/supabase/supabase-js",
       "moduleVersion": "2.100.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "https://github.com/supabase/supabase-js.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@tailwindcss/postcss",
-      "moduleUrl": "https://github.com/tailwindlabs/tailwindcss.git",
+      "moduleUrl": "https://github.com/tailwindlabs/tailwindcss",
       "moduleVersion": "4.2.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "https://github.com/tailwindlabs/tailwindcss.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@tanstack/react-virtual",
-      "moduleUrl": "git+https://github.com/TanStack/virtual.git",
+      "moduleUrl": "https://github.com/TanStack/virtual",
       "moduleVersion": "3.13.23",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/TanStack/virtual.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@tauri-apps/api",
-      "moduleUrl": "git+https://github.com/tauri-apps/tauri.git",
+      "moduleUrl": "https://github.com/tauri-apps/tauri",
       "moduleVersion": "2.10.1",
       "moduleLicense": "Apache-2.0 OR MIT",
-      "moduleLicenseUrl": "git+https://github.com/tauri-apps/tauri.git"
+      "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
     },
     {
       "moduleName": "@tauri-apps/plugin-dialog",
-      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleUrl": "https://github.com/tauri-apps/plugins-workspace",
       "moduleVersion": "2.7.0",
       "moduleLicense": "MIT OR Apache-2.0",
-      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@tauri-apps/plugin-fs",
-      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleUrl": "https://github.com/tauri-apps/plugins-workspace",
       "moduleVersion": "2.5.0",
       "moduleLicense": "MIT OR Apache-2.0",
-      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@tauri-apps/plugin-http",
-      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleUrl": "https://github.com/tauri-apps/plugins-workspace",
       "moduleVersion": "2.5.7",
       "moduleLicense": "MIT OR Apache-2.0",
-      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@tauri-apps/plugin-notification",
-      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleUrl": "https://github.com/tauri-apps/plugins-workspace",
       "moduleVersion": "2.3.3",
       "moduleLicense": "MIT OR Apache-2.0",
-      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@tauri-apps/plugin-shell",
-      "moduleUrl": "git+https://github.com/tauri-apps/plugins-workspace.git",
+      "moduleUrl": "https://github.com/tauri-apps/plugins-workspace",
       "moduleVersion": "2.3.5",
       "moduleLicense": "MIT OR Apache-2.0",
-      "moduleLicenseUrl": "git+https://github.com/tauri-apps/plugins-workspace.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "@userback/widget",
-      "moduleUrl": "git+https://github.com/userback/widget-js.git",
+      "moduleUrl": "https://github.com/userback/widget-js",
       "moduleVersion": "0.3.12",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/userback/widget-js.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "autoprefixer",
-      "moduleUrl": "git+https://github.com/postcss/autoprefixer.git",
+      "moduleUrl": "postcss/autoprefixer",
       "moduleVersion": "10.4.27",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/postcss/autoprefixer.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "axios",
-      "moduleUrl": "git+https://github.com/axios/axios.git",
+      "moduleUrl": "https://github.com/axios/axios",
       "moduleVersion": "1.15.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/axios/axios.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "d3",
-      "moduleUrl": "git+https://github.com/d3/d3.git",
+      "moduleUrl": "https://github.com/d3/d3",
       "moduleVersion": "7.9.0",
       "moduleLicense": "ISC",
-      "moduleLicenseUrl": "git+https://github.com/d3/d3.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/ISC"
     },
     {
       "moduleName": "globals",
-      "moduleUrl": "git+https://github.com/sindresorhus/globals.git",
+      "moduleUrl": "sindresorhus/globals",
       "moduleVersion": "17.5.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/sindresorhus/globals.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "i18next",
-      "moduleUrl": "git+https://github.com/i18next/i18next.git",
+      "moduleUrl": "https://github.com/i18next/i18next",
       "moduleVersion": "25.10.10",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/i18next/i18next.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "i18next-browser-languagedetector",
-      "moduleUrl": "git+https://github.com/i18next/i18next-browser-languageDetector.git",
+      "moduleUrl": "https://github.com/i18next/i18next-browser-languageDetector",
       "moduleVersion": "8.2.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/i18next/i18next-browser-languageDetector.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "jszip",
-      "moduleUrl": "git+https://github.com/Stuk/jszip.git",
+      "moduleUrl": "https://github.com/Stuk/jszip",
       "moduleVersion": "3.10.1",
       "moduleLicense": "(MIT OR GPL-3.0-or-later)",
-      "moduleLicenseUrl": "git+https://github.com/Stuk/jszip.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "license-report",
-      "moduleUrl": "git+https://github.com/bepo65/license-report.git",
+      "moduleUrl": "https://github.com/kessler/license-report",
       "moduleVersion": "6.8.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/bepo65/license-report.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "pdfjs-dist",
-      "moduleUrl": "git+https://github.com/mozilla/pdf.js.git",
+      "moduleUrl": "https://github.com/mozilla/pdf.js",
       "moduleVersion": "5.5.207",
       "moduleLicense": "Apache-2.0",
-      "moduleLicenseUrl": "git+https://github.com/mozilla/pdf.js.git"
+      "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
     },
     {
       "moduleName": "peerjs",
-      "moduleUrl": "git+https://github.com/peers/peerjs.git",
+      "moduleUrl": "https://github.com/peers/peerjs",
       "moduleVersion": "1.5.5",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/peers/peerjs.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "pixelmatch",
-      "moduleUrl": "git+https://github.com/mapbox/pixelmatch.git",
+      "moduleUrl": "https://github.com/mapbox/pixelmatch",
       "moduleVersion": "7.1.0",
       "moduleLicense": "ISC",
-      "moduleLicenseUrl": "git+https://github.com/mapbox/pixelmatch.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/ISC"
     },
     {
       "moduleName": "posthog-js",
       "moduleUrl": "https://github.com/PostHog/posthog-js",
       "moduleVersion": "1.363.3",
       "moduleLicense": "SEE LICENSE IN LICENSE https://github.com/PostHog/posthog-js/blob/main/LICENSE",
-      "moduleLicenseUrl": "https://github.com/PostHog/posthog-js"
+      "moduleLicenseUrl": "https://github.com/PostHog/posthog-js/blob/main/LICENSE"
     },
     {
       "moduleName": "qrcode.react",
-      "moduleUrl": "git+https://github.com/zpao/qrcode.react.git",
+      "moduleUrl": "https://github.com/zpao/qrcode.react",
       "moduleVersion": "4.2.0",
       "moduleLicense": "ISC",
-      "moduleLicenseUrl": "git+https://github.com/zpao/qrcode.react.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/ISC"
     },
     {
       "moduleName": "react",
-      "moduleUrl": "git+https://github.com/facebook/react.git",
+      "moduleUrl": "https://github.com/facebook/react",
       "moduleVersion": "19.2.4",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/facebook/react.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "react-dom",
-      "moduleUrl": "git+https://github.com/facebook/react.git",
+      "moduleUrl": "https://github.com/facebook/react",
       "moduleVersion": "19.2.4",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/facebook/react.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "react-easy-crop",
-      "moduleUrl": "git+https://github.com/ValentinH/react-easy-crop.git",
+      "moduleUrl": "https://github.com/ValentinH/react-easy-crop",
       "moduleVersion": "5.5.6",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/ValentinH/react-easy-crop.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "react-i18next",
-      "moduleUrl": "git+https://github.com/i18next/react-i18next.git",
+      "moduleUrl": "https://github.com/i18next/react-i18next",
       "moduleVersion": "16.6.6",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/i18next/react-i18next.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "react-markdown",
-      "moduleUrl": "git+https://github.com/remarkjs/react-markdown.git",
+      "moduleUrl": "remarkjs/react-markdown",
       "moduleVersion": "9.1.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/remarkjs/react-markdown.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "react-rnd",
-      "moduleUrl": "git+https://github.com/bokuweb/react-rnd.git",
+      "moduleUrl": "https://github.com/bokuweb/react-rnd",
       "moduleVersion": "10.5.3",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/bokuweb/react-rnd.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "react-router-dom",
-      "moduleUrl": "git+https://github.com/remix-run/react-router.git",
+      "moduleUrl": "https://github.com/remix-run/react-router",
       "moduleVersion": "7.13.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/remix-run/react-router.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "recharts",
-      "moduleUrl": "git+https://github.com/recharts/recharts.git",
+      "moduleUrl": "https://github.com/recharts/recharts",
       "moduleVersion": "3.8.0",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/recharts/recharts.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "remark-gfm",
-      "moduleUrl": "git+https://github.com/remarkjs/remark-gfm.git",
+      "moduleUrl": "remarkjs/remark-gfm",
       "moduleVersion": "4.0.1",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/remarkjs/remark-gfm.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "signature_pad",
-      "moduleUrl": "git+https://github.com/szimek/signature_pad.git",
+      "moduleUrl": "https://github.com/szimek/signature_pad",
       "moduleVersion": "5.1.3",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "git+https://github.com/szimek/signature_pad.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "smol-toml",
-      "moduleUrl": "github:squirrelchat/smol-toml",
+      "moduleUrl": "https://github.com/squirrelchat/smol-toml",
       "moduleVersion": "1.6.1",
       "moduleLicense": "BSD-3-Clause",
-      "moduleLicenseUrl": "github:squirrelchat/smol-toml"
+      "moduleLicenseUrl": "https://opensource.org/licenses/BSD-3-Clause"
     },
     {
       "moduleName": "tailwindcss",
-      "moduleUrl": "https://github.com/tailwindlabs/tailwindcss.git",
+      "moduleUrl": "https://github.com/tailwindlabs/tailwindcss",
       "moduleVersion": "4.2.2",
       "moduleLicense": "MIT",
-      "moduleLicenseUrl": "https://github.com/tailwindlabs/tailwindcss.git"
+      "moduleLicenseUrl": "https://opensource.org/licenses/MIT"
     },
     {
       "moduleName": "web-vitals",
-      "moduleUrl": "git+https://github.com/GoogleChrome/web-vitals.git",
+      "moduleUrl": "https://github.com/GoogleChrome/web-vitals",
       "moduleVersion": "5.1.0",
       "moduleLicense": "Apache-2.0",
-      "moduleLicenseUrl": "git+https://github.com/GoogleChrome/web-vitals.git"
+      "moduleLicenseUrl": "https://www.apache.org/licenses/LICENSE-2.0"
     }
   ]
 }
diff --git a/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx b/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx
index 5d0de982fc..334e769a74 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.tsx
@@ -32,6 +32,9 @@ interface LicensesSectionBodyProps {
   dependencies: Dependency[];
 }
 
+const getModuleUrl = (dependency: Dependency) =>
+  dependency.moduleUrl || dependency.moduleLicenseUrl;
+
 function LicensesSectionBody({
   title,
   description,
@@ -106,9 +109,9 @@ function LicensesSectionBody({
                 sortedDependencies.map((dependency) => (
                   <Table.Tr key={getDependencyKey(dependency)}>
                     <Table.Td>
-                      {dependency.moduleUrl ? (
+                      {getModuleUrl(dependency) ? (
                         <Anchor
-                          href={dependency.moduleUrl}
+                          href={getModuleUrl(dependency)}
                           target="_blank"
                           rel="noopener noreferrer"
                         >

From 2c1a66688956421896fdbdd6b8ed1e0f22fd6e7f Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 13:59:55 +0200
Subject: [PATCH 046/109] fix(frontend): make development label detection
 cross-platform (#6988)

# Description of Changes

This PR makes the frontend development label detection compatible with
both Windows and Unix-based environments.

- Added platform-specific handling to the `STIRLING_DEV_LABEL` Taskfile
variable.
- Uses PowerShell and `Split-Path` on Windows.
- Retains the existing `basename` implementation on Linux and macOS.
- Preserves the fallback to the current working directory when the Git
repository root cannot be determined.
- Fixes `task frontend:dev` and `task dev:all` failing on Windows
because `basename` was unavailable.
- Handles shell quoting explicitly so PowerShell variables are not
expanded by the intermediate command shell.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .taskfiles/frontend.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.taskfiles/frontend.yml b/.taskfiles/frontend.yml
index 943caaf81b..9a3b1bdd47 100644
--- a/.taskfiles/frontend.yml
+++ b/.taskfiles/frontend.yml
@@ -85,7 +85,8 @@ tasks:
       # full path, hostname, or user. Consumed at dev-serve time by vite.config
       # and dropped from production builds.
       STIRLING_DEV_LABEL:
-        sh: basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
+        sh: >-
+          {{if eq OS "windows"}}powershell -NoProfile -Command '$root = git rev-parse --show-toplevel 2>$null; if (-not $root) { $root = (Get-Location).Path }; Split-Path -Leaf $root'{{else}}basename "$(git rev-parse --show-toplevel 2>/dev/null || pwd)"{{end}}
     cmds:
       - npx vite editor --mode {{.MODE}} --port {{.PORT}}{{if .OPEN}} --open{{end}}
 

From 4230d2902b3c3c565b21a2da5f23d9fa583dd4d3 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:01:15 +0200
Subject: [PATCH 047/109] fix(editor): respect no-login settings visibility in
 config navigation (#6807)

# Description of Changes

This change fixes the editor configuration navigation for issue #6800 by
passing the `showSettingsWhenNoLogin` configuration flag through all
config navigation section hooks.

- Added `config?.showSettingsWhenNoLogin ?? true` when building the app
config modal navigation.
- Extended shared, desktop, and proprietary `useConfigNavSections`
signatures to accept the `showSettingsWhenNoLogin` flag.
- Forwarded the flag from desktop and proprietary config navigation
wrappers into the shared navigation logic.
- Updated proprietary admin section visibility so read-only admin
previews are only shown when login is disabled and
`system.showSettingsWhenNoLogin` allows it.

The change was made to ensure deployments with login disabled can still
control whether settings/admin configuration entries are visible,
matching the existing `showSettingsWhenNoLogin` behavior.

Closes #6800

<img width="1920" height="1032" alt="image"
src="https://github.com/user-attachments/assets/193f083b-3c87-4466-8e91-81a13a27cec3"
/>

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [x] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [x] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [x] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [x] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [x] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../editor/src/core/components/shared/AppConfigModal.tsx   | 1 +
 .../core/components/shared/config/configNavSections.tsx    | 1 +
 .../desktop/components/shared/config/configNavSections.tsx | 2 ++
 .../components/shared/config/configNavSections.tsx         | 7 +++++--
 4 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/frontend/editor/src/core/components/shared/AppConfigModal.tsx b/frontend/editor/src/core/components/shared/AppConfigModal.tsx
index 83f7342a74..1a9485cce8 100644
--- a/frontend/editor/src/core/components/shared/AppConfigModal.tsx
+++ b/frontend/editor/src/core/components/shared/AppConfigModal.tsx
@@ -216,6 +216,7 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({
     runningEE,
     loginEnabled,
     handleCloseSync,
+    config?.showSettingsWhenNoLogin ?? true,
   );
   const configNavSections = useMemo(
     () =>
diff --git a/frontend/editor/src/core/components/shared/config/configNavSections.tsx b/frontend/editor/src/core/components/shared/config/configNavSections.tsx
index 0c9515b68c..b4a8748434 100644
--- a/frontend/editor/src/core/components/shared/config/configNavSections.tsx
+++ b/frontend/editor/src/core/components/shared/config/configNavSections.tsx
@@ -32,6 +32,7 @@ export const useConfigNavSections = (
   _runningEE: boolean = false,
   _loginEnabled: boolean = false,
   onRequestClose: () => void = () => {},
+  _showSettingsWhenNoLogin: boolean = true,
 ): ConfigNavSection[] => {
   const { t } = useTranslation();
 
diff --git a/frontend/editor/src/desktop/components/shared/config/configNavSections.tsx b/frontend/editor/src/desktop/components/shared/config/configNavSections.tsx
index 07afc16599..9a638d1461 100644
--- a/frontend/editor/src/desktop/components/shared/config/configNavSections.tsx
+++ b/frontend/editor/src/desktop/components/shared/config/configNavSections.tsx
@@ -23,6 +23,7 @@ export const useConfigNavSections = (
   runningEE: boolean = false,
   loginEnabled: boolean = false,
   onRequestClose: () => void = () => {},
+  showSettingsWhenNoLogin: boolean = true,
 ): ConfigNavSection[] => {
   const { t } = useTranslation();
 
@@ -53,6 +54,7 @@ export const useConfigNavSections = (
     runningEE,
     loginEnabled,
     onRequestClose,
+    showSettingsWhenNoLogin,
   );
 
   const connectionModeSection: ConfigNavSection = {
diff --git a/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx b/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx
index f9c19f8a7b..0081c594a3 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx
@@ -32,6 +32,7 @@ export const useConfigNavSections = (
   runningEE: boolean = false,
   loginEnabled: boolean = false,
   onRequestClose: () => void = () => {},
+  showSettingsWhenNoLogin: boolean = true,
 ): ConfigNavSection[] => {
   const { t } = useTranslation();
 
@@ -41,6 +42,7 @@ export const useConfigNavSections = (
     runningEE,
     loginEnabled,
     onRequestClose,
+    showSettingsWhenNoLogin,
   );
 
   // Add account management under Preferences
@@ -64,8 +66,9 @@ export const useConfigNavSections = (
     }
   }
 
-  // Add Admin sections if user is admin OR if login is disabled (but mark as disabled)
-  if (isAdmin || !loginEnabled) {
+  // Add Admin sections for admins. When login is disabled, keep the historical
+  // read-only admin preview only if system.showSettingsWhenNoLogin allows it.
+  if (isAdmin || (!loginEnabled && showSettingsWhenNoLogin)) {
     const requiresLogin = !loginEnabled;
     const enableLoginTooltip = t(
       "settings.tooltips.enableLoginFirst",

From 72e8ba2951e6b98f9d84157d6387bf133b70a1ff Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:01:40 +0200
Subject: [PATCH 048/109] fix(admin-settings): prevent hydration error in the
 Admin General section (#6823)

# Description of Changes

- What was changed
- Fixed an invalid HTML nesting issue in `AdminGeneralSection` by
changing the affected Mantine `Text` wrapper from the default `<p>`
element to `component="div"`.
- This prevents a `<div>` from being rendered inside a `<p>` when the
`Group` for the "Logo Style" label is displayed.
- Why the change was made
- Firefox reported a hydration error in the settings modal because the
rendered DOM was invalid.
- The warning was triggered in the Admin General settings section and
affected the settings modal experience.


Firefox 152.0.3 (64-Bit)

```
In HTML, <div> cannot be a descendant of <p>.
This will cause a hydration error.

  ...
    <AdminGeneralSection>
      <div className="settings-s...">
        <@mantine/core/Stack gap="lg" className="settings-s...">
          <@mantine/core/Box ref={null} className="settings-s..." style={{...}} variant={undefined}>
            <div ref={null} style={{...}} className="settings-s..." data-variant={undefined} data-size={undefined} ...>
              <LoginRequiredBanner>
              <div>
              <@mantine/core/Paper withBorder={true} p="md" radius="md">
                <@mantine/core/Box ref={null} mod={[...]} className="m_1b7284a3..." style={{...}} variant={undefined} ...>
                  <div ref={null} style={{...}} className="m_1b7284a3..." data-variant={undefined} data-size={undefined} ...>
                    <@mantine/core/Stack gap="md">
                      <@mantine/core/Box ref={null} className="m_6d731127..." style={{...}} variant={undefined}>
                        <div ref={null} style={{...}} className="m_6d731127..." data-variant={undefined} ...>
                          <@mantine/core/Text>
                          <div>
                          <div>
                            <@mantine/core/Text size="sm" fw={500} mb={4}>
                              <@mantine/core/Box className="mantine-fo..." style={{...}} ref={null} component="p" ...>
>                               <p
>                                 ref={null}
>                                 style={{--text-fz:"var(--mant...",--text-lh:"var(--mant...",marginBottom:"calc(0.25r...", ...}}
>                                 className="mantine-focus-auto m_b6d8b162 mantine-Text-root"
>                                 data-variant={undefined}
>                                 data-size="sm"
>                                 size={undefined}
>                               >
                                  <@mantine/core/Group gap="xs">
                                    <@mantine/core/Box className="m_4081bf90..." style={{...}} ref={null} ...>
>                                     <div
>                                       ref={null}
>                                       style={{--group-gap:"var(--mant...",--group-align:"center",--group-justify:"flex-start", ...}}
>                                       className="m_4081bf90 mantine-Group-root"
>                                       data-variant={undefined}
>                                       data-size={undefined}
>                                       size={undefined}
>                                     >
                            ...
                          ...
              ...
        ...
react-dom-client.development.js:2605:19
```


---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../shared/config/configSections/AdminGeneralSection.tsx        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx
index 5e78d21a22..8a902a0604 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminGeneralSection.tsx
@@ -482,7 +482,7 @@ export default function AdminGeneralSection() {
             </div>
 
             <div>
-              <Text size="sm" fw={500} mb={4}>
+              <Text component="div" size="sm" fw={500} mb={4}>
                 <Group gap="xs">
                   <span>
                     {t("admin.settings.general.logoStyle.label", "Logo Style")}

From c6e84a21242556ba28076652eb0cbe2b749c6257 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:01:59 +0200
Subject: [PATCH 049/109] fix(admin-settings): correctly mask Telegram bot
 tokens in settings output (#6822)

# Description of Changes

- What was changed
- Fixed the sensitive-field detection logic in `AdminSettingsController`
so `botToken` is matched correctly after lowercasing the field name.
- This ensures Telegram bot tokens are masked consistently in admin
settings responses.
- Why the change was made
- The previous check used `lowerField.contains("botToken")`, which could
never match after converting the field name to lowercase.
- As a result, `botToken` values could remain visible in masked settings
output.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../security/controller/api/AdminSettingsController.java    | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java
index 14ddde602a..4bbe7f432a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java
@@ -843,8 +843,10 @@ public class AdminSettingsController {
             return true;
         }
 
-        // Check for fields containing 'password' or 'secret'
-        return lowerField.contains("password") || lowerField.contains("secret");
+        // Check for fields containing 'password' or 'secret' or 'bottoken'
+        return lowerField.contains("password")
+                || lowerField.contains("secret")
+                || lowerField.contains("bottoken");
     }
 
     /** Create a masked representation for sensitive fields */

From 0be0c0839bca51f3ae00397e10de691c56f6ab8a Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:02:16 +0200
Subject: [PATCH 050/109] build(docker): pin container base images by digest
 for reproducible builds (#6797)

# Description of Changes

### What was changed

- Updated `BASE_VERSION` references in:
  - `docker/backend/Dockerfile`
  - `docker/embedded/Dockerfile`
  - `docker/embedded/Dockerfile.fat`
- Pinned `stirlingtools/stirling-pdf-base:1.0.2` to a specific SHA256
digest.
- Pinned the `eclipse-temurin:25-jre-noble` image used in the
`jar-extract` stage to a specific SHA256 digest.
- Pinned the `ghcr.io/astral-sh/uv:python3.13-bookworm-slim` image in
`engine/Dockerfile.dev` to a specific SHA256 digest.
- Removed reliance on mutable image tags alone for these build stages.

### Why the change was made

- Ensure deterministic and reproducible Docker builds.
- Prevent unexpected changes caused by upstream image tag updates.
- Improve supply chain integrity by explicitly defining the exact image
artifacts used during builds.
- Align container build practices with security and compliance
recommendations.

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [x] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [x] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 docker/backend/Dockerfile      | 2 +-
 docker/embedded/Dockerfile     | 2 +-
 docker/embedded/Dockerfile.fat | 4 ++--
 engine/Dockerfile.dev          | 3 +--
 4 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/docker/backend/Dockerfile b/docker/backend/Dockerfile
index b2b7aa644b..82d552ef2f 100644
--- a/docker/backend/Dockerfile
+++ b/docker/backend/Dockerfile
@@ -1,6 +1,6 @@
 # Stirling-PDF backend-only image — JAR built with -PbuildWithFrontend=false, UI ships separately.
 
-ARG BASE_VERSION=1.0.2
+ARG BASE_VERSION=1.0.2@sha256:c7698687f486707ddef9e0298587ca8b44c4e96185e1bdb0c3d119eb2bf9a82e
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
 
 # Stage 1: Build the Java application (backend only, no frontend)
diff --git a/docker/embedded/Dockerfile b/docker/embedded/Dockerfile
index 760b728f34..ac50b7bf8e 100644
--- a/docker/embedded/Dockerfile
+++ b/docker/embedded/Dockerfile
@@ -1,7 +1,7 @@
 # Stirling-PDF - Full version (embedded frontend)
 # Uses pre-built base image for fast builds
 
-ARG BASE_VERSION=1.0.2
+ARG BASE_VERSION=1.0.2@sha256:c7698687f486707ddef9e0298587ca8b44c4e96185e1bdb0c3d119eb2bf9a82e
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
 
 # Stage 1: Build the Java application and frontend
diff --git a/docker/embedded/Dockerfile.fat b/docker/embedded/Dockerfile.fat
index 32219b6bd3..08b6ad35a8 100644
--- a/docker/embedded/Dockerfile.fat
+++ b/docker/embedded/Dockerfile.fat
@@ -2,7 +2,7 @@
 # Extra fonts for air-gapped environments
 # Uses pre-built base image for fast builds
 
-ARG BASE_VERSION=1.0.2
+ARG BASE_VERSION=1.0.2@sha256:c7698687f486707ddef9e0298587ca8b44c4e96185e1bdb0c3d119eb2bf9a82e
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
 
 # Stage 1: Build the Java application and frontend
@@ -54,7 +54,7 @@ RUN JPDFIUM_PLATFORM="$([ "$TARGETARCH" = arm64 ] && echo linux-arm64 || echo li
       --no-daemon
 
 # Stage 2: Extract Spring Boot Layers
-FROM eclipse-temurin:25-jre-noble AS jar-extract
+FROM eclipse-temurin:25-jre-noble@sha256:b27ca47660a8fa837e47a8533b9b1a3a430295cf29ca28d91af4fd121572dc29 AS jar-extract
 WORKDIR /tmp
 COPY --from=app-build /app/app/core/build/libs/*.jar app.jar
 RUN java -Djarmode=tools -jar app.jar extract --layers --destination /layers
diff --git a/engine/Dockerfile.dev b/engine/Dockerfile.dev
index 5020fd0590..b3e7cc30a7 100644
--- a/engine/Dockerfile.dev
+++ b/engine/Dockerfile.dev
@@ -1,6 +1,5 @@
 # syntax=docker/dockerfile:1.5
-FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim
-
+FROM ghcr.io/astral-sh/uv:python3.13-bookworm-slim@sha256:531f855bda2c73cd6ef67d56b733b357cea384185b3022bd09f05e002cd144ca
 WORKDIR /app
 
 COPY pyproject.toml uv.lock ./

From 4cfe29139ac7cc5d3d19a21b44a4954b43d1c747 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:04:35 +0200
Subject: [PATCH 051/109] chore(labels): add missing label metadata and remove
 duplicate entry (#7096)

# Description of Changes

<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .github/labeler-config-srvaroa.yml                |  2 +-
 .github/labels.yml                                | 15 ++++++++-------
 .../frontend-backend-licenses-update.yml          | 10 ++++++++--
 .github/workflows/sync-portal-docs.yml            |  5 ++++-
 4 files changed, 21 insertions(+), 11 deletions(-)

diff --git a/.github/labeler-config-srvaroa.yml b/.github/labeler-config-srvaroa.yml
index ad3b431e57..bd1947d649 100644
--- a/.github/labeler-config-srvaroa.yml
+++ b/.github/labeler-config-srvaroa.yml
@@ -163,7 +163,7 @@ labels:
       - '.github/workflows/scorecards.yml'
       - 'exampleYmlFiles/test_cicd.yml'
 
-  - label: 'Github'
+  - label: 'GitHub'
     files:
       - '.github/.*'
 
diff --git a/.github/labels.yml b/.github/labels.yml
index a6888e7795..d319aaa007 100644
--- a/.github/labels.yml
+++ b/.github/labels.yml
@@ -5,6 +5,7 @@
 # the GitHub Action https://github.com/marketplace/actions/github-labeler.
 - name: "Licenses"
   color: "EDEDED"
+  description: "Issues or pull requests related to licenses"
   from_name: "licenses"
 - name: "Back End"
   color: "20CE6C"
@@ -146,21 +147,21 @@
   description: "Changes that do not affect the meaning of the code (formatting, etc.)"
 - name: "admin"
   color: "195055"
-- name: "codex"
-  color: "ededed"
-  description: null
-- name: "Github"
+- name: "GitHub"
   color: "0052CC"
-- name: "github_actions"
-  color: "000000"
-  description: "Pull requests that update GitHub Actions code"
+  description: "Issues or pull requests related to GitHub configuration and integrations"
+  from_name: "Github"
 - name: "needs-changes"
   color: "A65A86"
+  description: "Pull requests that require changes before they can be merged"
 - name: "on-hold"
   color: "2526F9"
 - name: "python"
   color: "2b67c6"
   description: "Pull requests that update Python code"
+- name: "engine"
+  color: "2b67c6"
+  description: "Issues or pull requests related to the engine"
 - name: "size:L"
   color: "eb9500"
   description: "This PR changes 100-499 lines ignoring generated files."
diff --git a/.github/workflows/frontend-backend-licenses-update.yml b/.github/workflows/frontend-backend-licenses-update.yml
index 2bc36fb0c9..4f0aa5f837 100644
--- a/.github/workflows/frontend-backend-licenses-update.yml
+++ b/.github/workflows/frontend-backend-licenses-update.yml
@@ -299,7 +299,10 @@ jobs:
           base: main
           title: "Update Frontend 3rd Party Licenses"
           body: ${{ env.PR_BODY }}
-          labels: Licenses,github-actions,frontend
+          labels: |
+            Licenses
+            github-actions
+            Front End
           draft: false
           delete-branch: true
           sign-commits: true
@@ -520,7 +523,10 @@ jobs:
           base: main
           title: "Update Backend 3rd Party Licenses"
           body: ${{ env.PR_BODY }}
-          labels: Licenses,github-actions,backend
+          labels: |
+            Licenses
+            github-actions
+            Back End
           delete-branch: true
           sign-commits: true
 
diff --git a/.github/workflows/sync-portal-docs.yml b/.github/workflows/sync-portal-docs.yml
index 6eea2988c6..54ee262239 100644
--- a/.github/workflows/sync-portal-docs.yml
+++ b/.github/workflows/sync-portal-docs.yml
@@ -86,7 +86,10 @@ jobs:
 
             Regenerates `frontend/editor/src/portal/generated/docsManifest.json`
             from the Stirling docs repo via `npm run docs:sync`.
-          labels: documentation,github-actions,frontend
+          labels: |
+            Documentation
+            github-actions
+            Front End
           add-paths: frontend/editor/src/portal/generated/docsManifest.json
           delete-branch: true
           sign-commits: true

From f4d760b13935dcc03a888f9b8af862c15d7f3c00 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:05:01 +0200
Subject: [PATCH 052/109] fix(sign): preserve PNG signature placement and page
 content (#7093)

# Description of Changes

This PR fixes PNG signature application issues in the PDF signing
workflow.

## What was changed

- Reworked signature application to create locked and printable PDFium
stamp annotations with dedicated appearance streams.
- Removed the use of `FPDFPage_GenerateContent()` from the signature
workflow.
- Preserved the signature's original position and dimensions when
converting from the viewer's top-left coordinate system to PDF
coordinates.
- Added CropBox-aware coordinate conversion for PDFs whose visible page
origin differs from the MediaBox origin.
- Improved signature image extraction to handle internal EmbedPDF asset
references and nested image data.
- Refactored PDFium bitmap creation so image objects can safely be
transferred to annotations.
- Corrected PDFium bitmap ownership and cleanup to prevent duplicate
destruction.
- Added a PDFium WASM integration test covering:
  - Existing page-content preservation
  - Stamp appearance generation
  - Signature coordinates and dimensions
  - Printable, read-only, and locked annotation flags
- Persisted image data taking precedence over internal asset references

## Why the change was made

Applying a PNG signature previously regenerated the complete page
content through PDFium. This could corrupt existing vector or font-based
page elements, including the university logo reported in the linked
issue.

The previous coordinate conversion also relied only on the page height
and did not account for CropBox offsets, allowing the applied signature
to move from its preview position.

Creating a PDFium stamp annotation with its own appearance stream avoids
regenerating existing page content while retaining the selected
signature position and size.


Closes #7083

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../src/core/utils/pdfiumBitmapUtils.ts       | 156 ++++---
 .../core/utils/signatureFlattening.test.ts    | 114 +++++
 .../src/core/utils/signatureFlattening.ts     | 403 ++++++++++--------
 3 files changed, 436 insertions(+), 237 deletions(-)
 create mode 100644 frontend/editor/src/core/utils/signatureFlattening.test.ts

diff --git a/frontend/editor/src/core/utils/pdfiumBitmapUtils.ts b/frontend/editor/src/core/utils/pdfiumBitmapUtils.ts
index 95022d80d1..b21eddcd47 100644
--- a/frontend/editor/src/core/utils/pdfiumBitmapUtils.ts
+++ b/frontend/editor/src/core/utils/pdfiumBitmapUtils.ts
@@ -82,6 +82,82 @@ export interface DecodedImage {
   height: number;
 }
 
+function setImageObjectMatrix(
+  m: WrappedPdfiumModule,
+  imageObjPtr: number,
+  pdfX: number,
+  pdfY: number,
+  drawWidth: number,
+  drawHeight: number,
+): boolean {
+  const matrixPtr = m.pdfium.wasmExports.malloc(6 * 4);
+  try {
+    m.pdfium.setValue(matrixPtr, drawWidth, "float");
+    m.pdfium.setValue(matrixPtr + 4, 0, "float");
+    m.pdfium.setValue(matrixPtr + 8, 0, "float");
+    m.pdfium.setValue(matrixPtr + 12, drawHeight, "float");
+    m.pdfium.setValue(matrixPtr + 16, pdfX, "float");
+    m.pdfium.setValue(matrixPtr + 20, pdfY, "float");
+    return m.FPDFPageObj_SetMatrix(imageObjPtr, matrixPtr);
+  } finally {
+    m.pdfium.wasmExports.free(matrixPtr);
+  }
+}
+
+/**
+ * Create a PDFium image page object from decoded pixels.
+ *
+ * The caller owns the returned object until it is inserted into a page or
+ * appended to an annotation. Destroy it with FPDFPageObj_Destroy on failure.
+ */
+export function createBitmapImageObject(
+  m: WrappedPdfiumModule,
+  docPtr: number,
+  pagePtr: number,
+  image: DecodedImage,
+  pdfX: number,
+  pdfY: number,
+  drawWidth: number,
+  drawHeight: number,
+): number | null {
+  const bitmapPtr = m.FPDFBitmap_Create(image.width, image.height, 1);
+  if (!bitmapPtr) return null;
+
+  try {
+    const bufferPtr = m.FPDFBitmap_GetBuffer(bitmapPtr);
+    const stride = m.FPDFBitmap_GetStride(bitmapPtr);
+
+    copyRgbaToBgraHeap(
+      m,
+      image.rgba,
+      bufferPtr,
+      image.width,
+      image.height,
+      stride,
+    );
+
+    const imageObjPtr = m.FPDFPageObj_NewImageObj(docPtr);
+    if (!imageObjPtr) return null;
+
+    if (!m.FPDFImageObj_SetBitmap(pagePtr, 0, imageObjPtr, bitmapPtr)) {
+      m.FPDFPageObj_Destroy(imageObjPtr);
+      return null;
+    }
+
+    if (
+      !setImageObjectMatrix(m, imageObjPtr, pdfX, pdfY, drawWidth, drawHeight)
+    ) {
+      m.FPDFPageObj_Destroy(imageObjPtr);
+      return null;
+    }
+
+    return imageObjPtr;
+  } finally {
+    // FPDFImageObj_SetBitmap copies the bitmap data into the image object.
+    m.FPDFBitmap_Destroy(bitmapPtr);
+  }
+}
+
 /**
  * Create a PDFium bitmap from decoded RGBA pixels, attach it to a new image
  * page object, position it via an affine matrix, and insert it into the page.
@@ -99,70 +175,20 @@ export function embedBitmapImageOnPage(
   drawWidth: number,
   drawHeight: number,
 ): boolean {
-  const bitmapPtr = m.FPDFBitmap_Create(image.width, image.height, 1);
-  if (!bitmapPtr) return false;
+  const imageObjPtr = createBitmapImageObject(
+    m,
+    docPtr,
+    pagePtr,
+    image,
+    pdfX,
+    pdfY,
+    drawWidth,
+    drawHeight,
+  );
+  if (!imageObjPtr) return false;
 
-  try {
-    const bufferPtr = m.FPDFBitmap_GetBuffer(bitmapPtr);
-    const stride = m.FPDFBitmap_GetStride(bitmapPtr);
-
-    copyRgbaToBgraHeap(
-      m,
-      image.rgba,
-      bufferPtr,
-      image.width,
-      image.height,
-      stride,
-    );
-
-    const imageObjPtr = m.FPDFPageObj_NewImageObj(docPtr);
-    if (!imageObjPtr) return false;
-
-    const setBitmapOk = m.FPDFImageObj_SetBitmap(
-      pagePtr,
-      0,
-      imageObjPtr,
-      bitmapPtr,
-    );
-    if (!setBitmapOk) {
-      m.FPDFPageObj_Destroy(imageObjPtr);
-      return false;
-    }
-
-    // -- early-destroy the bitmap; PDFium has copied the pixel data internally
-    m.FPDFBitmap_Destroy(bitmapPtr);
-
-    // Set affine transform: [a b c d e f]
-    const matrixPtr = m.pdfium.wasmExports.malloc(6 * 4);
-    try {
-      m.pdfium.setValue(matrixPtr, drawWidth, "float"); // a — scaleX
-      m.pdfium.setValue(matrixPtr + 4, 0, "float"); // b
-      m.pdfium.setValue(matrixPtr + 8, 0, "float"); // c
-      m.pdfium.setValue(matrixPtr + 12, drawHeight, "float"); // d — scaleY
-      m.pdfium.setValue(matrixPtr + 16, pdfX, "float"); // e — translateX
-      m.pdfium.setValue(matrixPtr + 20, pdfY, "float"); // f — translateY
-
-      if (!m.FPDFPageObj_SetMatrix(imageObjPtr, matrixPtr)) {
-        m.FPDFPageObj_Destroy(imageObjPtr);
-        return false;
-      }
-    } finally {
-      m.pdfium.wasmExports.free(matrixPtr);
-    }
-
-    m.FPDFPage_InsertObject(pagePtr, imageObjPtr);
-    return true;
-  } finally {
-    // Safety net: FPDFBitmap_Destroy is a no-op if ptr is 0 in most PDFium
-    // builds but guard anyway.  If already destroyed above, the second call
-    // is harmless because we allow it to be idempotent.
-    // We use a try-catch to be safe across PDFium WASM builds.
-    try {
-      m.FPDFBitmap_Destroy(bitmapPtr);
-    } catch {
-      /* already freed */
-    }
-  }
+  m.FPDFPage_InsertObject(pagePtr, imageObjPtr);
+  return true;
 }
 /**
  * Draw a simple light-grey rectangle as a placeholder for annotations
@@ -206,8 +232,8 @@ export function decodeImageDataUrl(
     img.onload = () => {
       try {
         const canvas = document.createElement("canvas");
-        canvas.width = img.width;
-        canvas.height = img.height;
+        canvas.width = img.naturalWidth || img.width;
+        canvas.height = img.naturalHeight || img.height;
         const ctx = canvas.getContext("2d");
         if (!ctx) {
           resolve(null);
diff --git a/frontend/editor/src/core/utils/signatureFlattening.test.ts b/frontend/editor/src/core/utils/signatureFlattening.test.ts
new file mode 100644
index 0000000000..cb31b9cd01
--- /dev/null
+++ b/frontend/editor/src/core/utils/signatureFlattening.test.ts
@@ -0,0 +1,114 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { afterAll, beforeAll, describe, expect, test, vi } from "vitest";
+import {
+  PDFArray,
+  PDFDict,
+  PDFDocument,
+  PDFName,
+  PDFNumber,
+  PDFRawStream,
+  decodePDFRawStream,
+} from "@cantoo/pdf-lib";
+import { embedSignatureImages } from "@app/utils/signatureFlattening";
+
+const ONE_PIXEL_PNG =
+  "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNkYPhfDwAChwGA60e6kgAAAABJRU5ErkJggg==";
+
+beforeAll(async () => {
+  const wasmPath = path.resolve(
+    process.cwd(),
+    "node_modules/@embedpdf/pdfium/dist/pdfium.wasm",
+  );
+  const wasmBytes = await readFile(wasmPath);
+  vi.stubGlobal(
+    "fetch",
+    vi.fn(async () =>
+      Promise.resolve(
+        new Response(wasmBytes, {
+          headers: { "Content-Type": "application/wasm" },
+        }),
+      ),
+    ),
+  );
+});
+
+afterAll(() => {
+  vi.unstubAllGlobals();
+});
+
+const readPageContentStreams = (document: PDFDocument): string[] => {
+  const contents = document.getPage(0).node.Contents();
+  if (!(contents instanceof PDFArray)) return [];
+
+  const decoder = new TextDecoder();
+  const streams: string[] = [];
+  for (let index = 0; index < contents.size(); index++) {
+    const stream = contents.lookup(index, PDFRawStream);
+    streams.push(decoder.decode(decodePDFRawStream(stream).decode()));
+  }
+  return streams;
+};
+
+describe("signatureFlattening", () => {
+  test("adds a PDFium stamp without regenerating page content", async () => {
+    const sourceDocument = await PDFDocument.create();
+    const sourcePage = sourceDocument.addPage([300, 400]);
+    const markerStream = sourceDocument.context.stream(
+      "q\n% ORIGINAL_TYPE3_CONTENT\nQ\n",
+    );
+    sourcePage.node.addContentStream(
+      sourceDocument.context.register(markerStream),
+    );
+    const sourceBytes = await sourceDocument.save();
+
+    const outputBytes = await embedSignatureImages(
+      Uint8Array.from(sourceBytes).buffer,
+      [
+        {
+          pageIndex: 0,
+          annotations: [
+            {
+              id: "signature-1",
+              // EmbedPDF may expose an internal asset reference here after the
+              // annotation has been placed. The persisted PNG must win.
+              imageData: "embedpdf-asset-reference",
+              rect: {
+                origin: { x: 25, y: 30 },
+                size: { width: 120, height: 50 },
+              },
+              imageSrc: `data:image/png;base64,${ONE_PIXEL_PNG}`,
+            },
+          ],
+        },
+      ],
+      (id) =>
+        id === "signature-1"
+          ? `data:image/png;base64,${ONE_PIXEL_PNG}`
+          : undefined,
+      async () => ({
+        width: 1,
+        height: 1,
+        rgba: new Uint8Array([0, 80, 180, 255]),
+      }),
+    );
+
+    const outputDocument = await PDFDocument.load(outputBytes);
+    const contentStreams = readPageContentStreams(outputDocument);
+    const annotations = outputDocument.getPage(0).node.Annots();
+
+    expect(contentStreams).toContain("q\n% ORIGINAL_TYPE3_CONTENT\nQ\n");
+    expect(annotations).toBeInstanceOf(PDFArray);
+
+    const stamp = annotations?.lookup(0, PDFDict);
+    const stampRect = stamp?.lookup(PDFName.of("Rect"), PDFArray);
+    expect(stamp?.get(PDFName.of("Subtype"))).toEqual(PDFName.of("Stamp"));
+    expect(stamp?.lookup(PDFName.of("F"), PDFNumber).asNumber()).toBe(196);
+    expect(stamp?.get(PDFName.of("AP"))).toBeDefined();
+    expect(
+      Array.from({ length: stampRect?.size() ?? 0 }, (_, index) =>
+        stampRect?.lookup(index, PDFNumber).asNumber(),
+      ),
+    ).toEqual([25, 320, 145, 370]);
+  }, 20_000);
+});
diff --git a/frontend/editor/src/core/utils/signatureFlattening.ts b/frontend/editor/src/core/utils/signatureFlattening.ts
index 56d9d63fef..a6200f52f2 100644
--- a/frontend/editor/src/core/utils/signatureFlattening.ts
+++ b/frontend/editor/src/core/utils/signatureFlattening.ts
@@ -1,11 +1,15 @@
-// PDFium annotation subtype constants
 import {
-  FPDF_ANNOT_INK,
-  FPDF_ANNOT_LINE,
-  embedBitmapImageOnPage,
-  drawPlaceholderRect,
+  createBitmapImageObject,
   decodeImageDataUrl,
+  type DecodedImage,
 } from "@app/utils/pdfiumBitmapUtils";
+import {
+  closeDocAndFreeBuffer,
+  getPdfiumModule,
+  openRawDocumentSafe,
+  readEffectivePageBox,
+  saveRawDocument,
+} from "@app/services/pdfiumService";
 import { generateThumbnailWithMetadata } from "@app/utils/thumbnailUtils";
 import {
   createChildStub,
@@ -18,12 +22,6 @@ import {
   StirlingFileStub,
 } from "@app/types/fileContext";
 import type { SignatureAPI } from "@app/components/viewer/viewerTypes";
-import {
-  getPdfiumModule,
-  openRawDocumentSafe,
-  closeDocAndFreeBuffer,
-  saveRawDocument,
-} from "@app/services/pdfiumService";
 
 interface MinimalFileContextSelectors {
   getAllFileIds: () => FileId[];
@@ -75,23 +73,9 @@ export async function flattenSignatures(
           const pageAnnotations =
             await signatureApiRef.current.getPageAnnotations(pageIndex);
           if (pageAnnotations && pageAnnotations.length > 0) {
-            const sessionAnnotations = pageAnnotations.filter((annotation) => {
-              const hasStoredImageData =
-                annotation.id && getImageData(annotation.id);
-              const hasDirectImageData =
-                annotation.imageData ||
-                annotation.appearance ||
-                annotation.stampData ||
-                annotation.imageSrc ||
-                annotation.contents ||
-                annotation.data;
-              return (
-                hasStoredImageData ||
-                (hasDirectImageData &&
-                  typeof hasDirectImageData === "string" &&
-                  hasDirectImageData.startsWith("data:image"))
-              );
-            });
+            const sessionAnnotations = pageAnnotations.filter((annotation) =>
+              Boolean(getAnnotationImageData(annotation, getImageData)),
+            );
 
             if (sessionAnnotations.length > 0) {
               allAnnotations.push({
@@ -166,143 +150,23 @@ export async function flattenSignatures(
         type: "application/pdf",
       });
 
-      // Step 4: Manually render extracted annotations onto the PDF using PDFium WASM
+      // Step 4: Add signatures as locked, printable PDFium stamp annotations.
+      // FPDFAnnot_AppendObject creates the annotation appearance without asking
+      // PDFium to regenerate the page's existing content. GenerateContent would
+      // corrupt some Type3/vector content, including the issue #7083 logo.
       if (allAnnotations.length > 0) {
         try {
-          const pdfArrayBufferForFlattening = await signedFile.arrayBuffer();
-          const m = await getPdfiumModule();
-          const docPtr = await openRawDocumentSafe(pdfArrayBufferForFlattening);
-
-          try {
-            const pageCount = m.FPDF_GetPageCount(docPtr);
-
-            for (const pageData of allAnnotations) {
-              const { pageIndex, annotations } = pageData;
-
-              if (pageIndex < pageCount) {
-                const pagePtr = m.FPDF_LoadPage(docPtr, pageIndex);
-                if (!pagePtr) continue;
-
-                const pageHeight = m.FPDF_GetPageHeightF(pagePtr);
-
-                for (const annotation of annotations) {
-                  try {
-                    const rect =
-                      annotation.rect ||
-                      annotation.bounds ||
-                      annotation.rectangle ||
-                      annotation.position;
-
-                    if (rect) {
-                      const originalX =
-                        rect.origin?.x || rect.x || rect.left || 0;
-                      const originalY =
-                        rect.origin?.y || rect.y || rect.top || 0;
-                      const width = rect.size?.width || rect.width || 100;
-                      const height = rect.size?.height || rect.height || 50;
-
-                      // Convert from CSS top-left to PDF bottom-left
-                      const pdfX = originalX;
-                      const pdfY = pageHeight - originalY - height;
-
-                      let imageDataUrl =
-                        annotation.imageData ||
-                        annotation.appearance ||
-                        annotation.stampData ||
-                        annotation.imageSrc ||
-                        annotation.contents ||
-                        annotation.data;
-
-                      if (!imageDataUrl && annotation.id) {
-                        const storedImageData = getImageData(annotation.id);
-                        if (storedImageData) {
-                          imageDataUrl = storedImageData;
-                        }
-                      }
-
-                      // Convert SVG to PNG first if needed
-                      if (
-                        imageDataUrl &&
-                        typeof imageDataUrl === "string" &&
-                        imageDataUrl.startsWith("data:image/svg+xml")
-                      ) {
-                        const pngBytes = await rasteriseSvgToPng(
-                          imageDataUrl,
-                          width * 2,
-                          height * 2,
-                        );
-                        if (pngBytes) {
-                          imageDataUrl = await uint8ArrayToPngDataUrl(pngBytes);
-                        } else {
-                          drawPlaceholderRect(
-                            m,
-                            pagePtr,
-                            pdfX,
-                            pdfY,
-                            width,
-                            height,
-                          );
-                          continue;
-                        }
-                      }
-
-                      if (
-                        imageDataUrl &&
-                        typeof imageDataUrl === "string" &&
-                        imageDataUrl.startsWith("data:image")
-                      ) {
-                        // Decode the image data URL to raw pixels via canvas
-                        const imageResult =
-                          await decodeImageDataUrl(imageDataUrl);
-                        if (imageResult) {
-                          embedBitmapImageOnPage(
-                            m,
-                            docPtr,
-                            pagePtr,
-                            imageResult,
-                            pdfX,
-                            pdfY,
-                            width,
-                            height,
-                          );
-                        }
-                      } else if (
-                        annotation.type === FPDF_ANNOT_INK ||
-                        annotation.type === FPDF_ANNOT_LINE
-                      ) {
-                        drawPlaceholderRect(
-                          m,
-                          pagePtr,
-                          pdfX,
-                          pdfY,
-                          width,
-                          height,
-                        );
-                      }
-                    }
-                  } catch (annotationError) {
-                    console.warn(
-                      "Failed to render annotation:",
-                      annotationError,
-                    );
-                  }
-                }
-
-                m.FPDFPage_GenerateContent(pagePtr);
-                m.FPDF_ClosePage(pagePtr);
-              }
-            }
-
-            const resultBuf = await saveRawDocument(docPtr);
-            signedFile = new File([resultBuf], currentFile.name, {
-              type: "application/pdf",
-            });
-          } finally {
-            closeDocAndFreeBuffer(m, docPtr);
-          }
+          const resultBytes = await embedSignatureImages(
+            await signedFile.arrayBuffer(),
+            allAnnotations,
+            getImageData,
+          );
+          signedFile = new File([resultBytes as BlobPart], currentFile.name, {
+            type: "application/pdf",
+          });
         } catch (renderError) {
-          console.error("Failed to manually render annotations:", renderError);
-          console.warn("Signatures may only show as annotations");
+          console.error("Failed to embed signature images:", renderError);
+          console.warn("Signatures may only remain as annotations");
         }
       }
 
@@ -343,16 +207,211 @@ export async function flattenSignatures(
   }
 }
 
-/**
- * Convert Uint8Array PNG bytes to a data URL for canvas decoding.
- */
-function uint8ArrayToPngDataUrl(pngBytes: Uint8Array): Promise<string> {
-  return new Promise((resolve) => {
-    const blob = new Blob([pngBytes as BlobPart], { type: "image/png" });
-    const reader = new FileReader();
-    reader.onloadend = () => resolve(reader.result as string);
-    reader.readAsDataURL(blob);
-  });
+type SignatureAnnotationsByPage = Array<{
+  pageIndex: number;
+  annotations: any[];
+}>;
+
+function extractImageDataUrl(
+  value: unknown,
+  depth = 0,
+  visited: Set<unknown> = new Set(),
+): string | undefined {
+  if (!value || depth > 6) return undefined;
+
+  if (typeof value === "string") {
+    return value.startsWith("data:image") ? value : undefined;
+  }
+
+  if (typeof value !== "object" || visited.has(value)) return undefined;
+  visited.add(value);
+
+  const entries = Array.isArray(value)
+    ? value
+    : Object.values(value as Record<string, unknown>);
+  for (const entry of entries) {
+    const imageDataUrl = extractImageDataUrl(entry, depth + 1, visited);
+    if (imageDataUrl) return imageDataUrl;
+  }
+
+  return undefined;
+}
+
+function getAnnotationImageData(
+  annotation: any,
+  getImageData: (id: string) => string | undefined,
+): string | undefined {
+  // EmbedPDF can replace fields such as imageData/appearance with an internal
+  // asset reference after placement. Prefer our persistent original and only
+  // accept values that actually contain an image data URL.
+  const candidates: unknown[] = [
+    annotation.id ? getImageData(annotation.id) : undefined,
+    annotation.imageSrc,
+    annotation.imageData,
+    annotation.appearance,
+    annotation.stampData,
+    annotation.contents,
+    annotation.data,
+    annotation.customData,
+    annotation.asset,
+  ];
+
+  for (const candidate of candidates) {
+    const imageDataUrl = extractImageDataUrl(candidate);
+    if (imageDataUrl) return imageDataUrl;
+  }
+
+  return undefined;
+}
+
+export async function embedSignatureImages(
+  pdfArrayBuffer: ArrayBuffer,
+  annotationsByPage: SignatureAnnotationsByPage,
+  getImageData: (id: string) => string | undefined,
+  imageDecoder: (
+    dataUrl: string,
+  ) => Promise<DecodedImage | null> = decodeImageDataUrl,
+): Promise<ArrayBuffer> {
+  const m = await getPdfiumModule();
+  const docPtr = await openRawDocumentSafe(pdfArrayBuffer);
+
+  try {
+    const pageCount = m.FPDF_GetPageCount(docPtr);
+
+    for (const { pageIndex, annotations } of annotationsByPage) {
+      if (pageIndex < 0 || pageIndex >= pageCount) continue;
+
+      const pagePtr = m.FPDF_LoadPage(docPtr, pageIndex);
+      if (!pagePtr) continue;
+
+      try {
+        const pageBox = readEffectivePageBox(m, pagePtr);
+        const cropHeight = pageBox.top - pageBox.bottom;
+
+        for (const annotation of annotations) {
+          const rect =
+            annotation.rect ??
+            annotation.bounds ??
+            annotation.rectangle ??
+            annotation.position;
+          if (!rect) continue;
+
+          const originalX = rect.origin?.x ?? rect.x ?? rect.left ?? 0;
+          const originalY = rect.origin?.y ?? rect.y ?? rect.top ?? 0;
+          const width = rect.size?.width ?? rect.width ?? 100;
+          const height = rect.size?.height ?? rect.height ?? 50;
+          if (width <= 0 || height <= 0) continue;
+
+          let imageDataUrl = getAnnotationImageData(annotation, getImageData);
+          if (!imageDataUrl) continue;
+
+          if (imageDataUrl.startsWith("data:image/svg+xml")) {
+            const pngBytes = await rasteriseSvgToPng(
+              imageDataUrl,
+              width * 2,
+              height * 2,
+            );
+            if (!pngBytes) continue;
+            imageDataUrl = `data:image/png;base64,${uint8ArrayToBase64(pngBytes)}`;
+          }
+
+          const decodedImage = await imageDecoder(imageDataUrl);
+          if (!decodedImage) continue;
+
+          const pdfX = pageBox.left + originalX;
+          const pdfY = pageBox.bottom + cropHeight - originalY - height;
+          appendStampAnnotation(
+            m,
+            docPtr,
+            pagePtr,
+            decodedImage,
+            pdfX,
+            pdfY,
+            width,
+            height,
+          );
+        }
+      } finally {
+        m.FPDF_ClosePage(pagePtr);
+      }
+    }
+
+    return await saveRawDocument(docPtr);
+  } finally {
+    closeDocAndFreeBuffer(m, docPtr);
+  }
+}
+
+const FPDF_ANNOT_STAMP = 13;
+const FPDF_ANNOT_FLAG_PRINT = 1 << 2;
+const FPDF_ANNOT_FLAG_READONLY = 1 << 6;
+const FPDF_ANNOT_FLAG_LOCKED = 1 << 7;
+
+function appendStampAnnotation(
+  m: Awaited<ReturnType<typeof getPdfiumModule>>,
+  docPtr: number,
+  pagePtr: number,
+  image: DecodedImage,
+  pdfX: number,
+  pdfY: number,
+  width: number,
+  height: number,
+): boolean {
+  const annotationIndex = m.FPDFPage_GetAnnotCount(pagePtr);
+  const annotPtr = m.FPDFPage_CreateAnnot(pagePtr, FPDF_ANNOT_STAMP);
+  if (!annotPtr) return false;
+
+  let appended = false;
+  let imageObjPtr = 0;
+  const rectPtr = m.pdfium.wasmExports.malloc(4 * 4);
+
+  try {
+    // FS_RECTF layout: left, top, right, bottom.
+    m.pdfium.setValue(rectPtr, pdfX, "float");
+    m.pdfium.setValue(rectPtr + 4, pdfY + height, "float");
+    m.pdfium.setValue(rectPtr + 8, pdfX + width, "float");
+    m.pdfium.setValue(rectPtr + 12, pdfY, "float");
+    if (!m.FPDFAnnot_SetRect(annotPtr, rectPtr)) return false;
+
+    imageObjPtr =
+      createBitmapImageObject(
+        m,
+        docPtr,
+        pagePtr,
+        image,
+        pdfX,
+        pdfY,
+        width,
+        height,
+      ) ?? 0;
+    if (!imageObjPtr) return false;
+
+    if (!m.FPDFAnnot_AppendObject(annotPtr, imageObjPtr)) return false;
+    imageObjPtr = 0; // The annotation owns the object after a successful append.
+
+    m.FPDFAnnot_SetFlags(
+      annotPtr,
+      FPDF_ANNOT_FLAG_PRINT | FPDF_ANNOT_FLAG_READONLY | FPDF_ANNOT_FLAG_LOCKED,
+    );
+    appended = true;
+    return true;
+  } finally {
+    m.pdfium.wasmExports.free(rectPtr);
+    if (imageObjPtr) m.FPDFPageObj_Destroy(imageObjPtr);
+    m.FPDFPage_CloseAnnot(annotPtr);
+    if (!appended) m.FPDFPage_RemoveAnnot(pagePtr, annotationIndex);
+  }
+}
+
+function uint8ArrayToBase64(bytes: Uint8Array): string {
+  let binary = "";
+  const chunkSize = 0x8000;
+  for (let offset = 0; offset < bytes.length; offset += chunkSize) {
+    binary += String.fromCharCode(
+      ...bytes.subarray(offset, offset + chunkSize),
+    );
+  }
+  return btoa(binary);
 }
 
 /**

From bb830e57113679e2a7a666e68385ce97d6b59586 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:05:53 +0200
Subject: [PATCH 053/109] build: upgrade google-java-format and restore strict
 Spotless validation (#7091)

# Description of Changes

- Upgraded google-java-format from 1.28.0 to 1.35.0.
- Removed the broad `suppressLintsFor` workaround for the
`google-java-format` step.
- Ensured the shared `gradle/spotless.gradle` configuration is
recognized by the relevant CI path filters and repository automation.
- Kept the shared formatter configuration available to all backend
modules.
- Verified that google-java-format 1.35.0 runs successfully on JDK 25
for the Common, Core, and SaaS modules.
- Confirmed that the previous claim about a general Guava 32.x crash on
JDK 24/25 no longer justifies suppressing all formatter lint failures.

### Verification

Verified with Temurin JDK 25.0.3 and google-java-format 1.35.0. The
formatter still depends on Guava 32.1.3-jre, and no `suppressLintsFor`
configuration is present.

```bash
./gradlew \
  :common:spotlessJavaCheck \
  :stirling-pdf:spotlessJavaCheck \
  --rerun-tasks
```

Result:

```text
> Task :common:spotlessJava
> Task :common:spotlessJavaCheck
> Task :stirling-pdf:spotlessJava
> Task :stirling-pdf:spotlessJavaCheck

BUILD SUCCESSFUL in 26s
4 actionable tasks: 4 executed
```

Using `--rerun-tasks` ensured that the formatter was executed and that
the result did not come from the Gradle task cache.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/config/.files.yaml          |  2 ++
 .github/workflows/sync_files_v2.yml |  1 +
 app/common/build.gradle             | 26 --------------------
 app/core/build.gradle               | 29 ----------------------
 app/proprietary/build.gradle        | 27 ---------------------
 app/saas/build.gradle               | 26 --------------------
 build.gradle                        |  5 ++--
 gradle/spotless.gradle              | 37 +++++++++++++++++++++++++++++
 8 files changed, 43 insertions(+), 110 deletions(-)
 create mode 100644 gradle/spotless.gradle

diff --git a/.github/config/.files.yaml b/.github/config/.files.yaml
index 2894464831..64454c5fe1 100644
--- a/.github/config/.files.yaml
+++ b/.github/config/.files.yaml
@@ -9,6 +9,7 @@ ci: &ci
 build: &build
   - *ci
   - build.gradle
+  - gradle/spotless.gradle
   - app/(common|core|proprietary|saas)/build.gradle
   - Taskfile.yml
   - .taskfiles/backend.yml
@@ -155,4 +156,5 @@ proprietary: &proprietary
   - configs/settings.yml.template
   - build.gradle
   - app/proprietary/build.gradle
+  - gradle/spotless.gradle
   - .github/workflows/build-enterprise.yml
diff --git a/.github/workflows/sync_files_v2.yml b/.github/workflows/sync_files_v2.yml
index 38873bb1eb..357f5d5a87 100644
--- a/.github/workflows/sync_files_v2.yml
+++ b/.github/workflows/sync_files_v2.yml
@@ -10,6 +10,7 @@ on:
       - "app/common/build.gradle"
       - "app/core/build.gradle"
       - "app/proprietary/build.gradle"
+      - "gradle/spotless.gradle"
       - "README.md"
       - "frontend/editor/public/locales/*/translation.toml"
       - "app/core/src/main/resources/static/3rdPartyLicenses.json"
diff --git a/app/common/build.gradle b/app/common/build.gradle
index 516edd4897..3ab0369e34 100644
--- a/app/common/build.gradle
+++ b/app/common/build.gradle
@@ -2,32 +2,6 @@
 bootRun {
     enabled = false
 }
-spotless {
-    java {
-        target 'src/**/java/**/*.java'
-        targetExclude 'src/main/java/org/apache/**'
-        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
-        // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
-        suppressLintsFor { setStep('google-java-format') }
-
-        importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-    yaml {
-        target '**/*.yml', '**/*.yaml'
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-    format 'gradle', {
-        target '**/gradle/*.gradle', '**/*.gradle'
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-}
 dependencies {
     api "com.google.guava:guava:${guavaVersion}"
     api 'org.springframework.boot:spring-boot-starter-webmvc'
diff --git a/app/core/build.gradle b/app/core/build.gradle
index 6a55d89304..578ace75cc 100644
--- a/app/core/build.gradle
+++ b/app/core/build.gradle
@@ -9,35 +9,6 @@ configurations {
     }
 }
 
-spotless {
-    java {
-        target 'src/**/java/**/*.java'
-        targetExclude 'src/main/resources/static/**', 'src/main/java/org/apache/**'
-        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
-        // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
-        suppressLintsFor { setStep('google-java-format') }
-
-        importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-    yaml {
-        target '**/*.yml', '**/*.yaml'
-        targetExclude 'src/main/resources/static/**'
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-    format 'gradle', {
-        target '**/gradle/*.gradle', '**/*.gradle'
-        targetExclude 'src/main/resources/static/**'
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-}
-
 dependencies {
     if (!gradle.ext.disableAdditional) {
         implementation project(':proprietary')
diff --git a/app/proprietary/build.gradle b/app/proprietary/build.gradle
index 60f6541c82..d2028f7859 100644
--- a/app/proprietary/build.gradle
+++ b/app/proprietary/build.gradle
@@ -6,33 +6,6 @@ repositories {
 bootRun {
     enabled = false
 }
-
-spotless {
-        java {
-        target 'src/**/java/**/*.java'
-        targetExclude 'src/main/java/org/apache/**'
-        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
-        // google-java-format 1.28.0 bundles Guava 32.x which crashes Spotless lint on JDK 24/25
-        suppressLintsFor { setStep('google-java-format') }
-
-        importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-    yaml {
-        target '**/*.yml', '**/*.yaml'
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-    format 'gradle', {
-        target '**/gradle/*.gradle', '**/*.gradle'
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-}
 dependencies {
     implementation project(':common')
     api "com.google.guava:guava:${guavaVersion}"
diff --git a/app/saas/build.gradle b/app/saas/build.gradle
index d6ae305def..38a16f7de8 100644
--- a/app/saas/build.gradle
+++ b/app/saas/build.gradle
@@ -2,32 +2,6 @@ bootRun {
     enabled = false
 }
 
-spotless {
-    java {
-        target 'src/**/java/**/*.java'
-        targetExclude 'src/main/java/org/apache/**'
-        googleJavaFormat(googleJavaFormatVersion).aosp().reorderImports(false)
-        suppressLintsFor { setStep('google-java-format') }
-
-        importOrder("java", "javax", "org", "com", "net", "io", "jakarta", "lombok", "me", "stirling")
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-    yaml {
-        target '**/*.yml', '**/*.yaml'
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-    format 'gradle', {
-        target '**/gradle/*.gradle', '**/*.gradle'
-        trimTrailingWhitespace()
-        leadingTabsToSpaces()
-        endWithNewline()
-    }
-}
-
 dependencies {
     implementation project(':common')
     implementation project(':proprietary')
diff --git a/build.gradle b/build.gradle
index e2f47e26fb..4da9bb1055 100644
--- a/build.gradle
+++ b/build.gradle
@@ -28,7 +28,7 @@ ext {
     springSecuritySamlVersion = "7.0.5"
     openSamlVersion = "5.2.1"
     commonmarkVersion = "0.28.0"
-    googleJavaFormatVersion = "1.28.0"
+    googleJavaFormatVersion = "1.35.0"
     logback = "1.5.32"
     commonsIoVersion = "2.22.0"
     commonsLang3 = "3.20.0"
@@ -37,7 +37,7 @@ ext {
     gsonVersion = "2.14.0"
     guavaVersion = "33.6.0-jre"
     jinjavaVersion = "2.8.3"
-    jackson2Version = "2.21.2"
+    jackson2Version = "2.21.4"
     bucket4jVersion = "8.19.0"
     archunitVersion = "1.4.2"
     batikVersion = "1.19"
@@ -171,6 +171,7 @@ subprojects {
     apply plugin: 'org.springframework.boot'
     apply plugin: 'io.spring.dependency-management'
     apply plugin: 'jacoco'
+    apply from: rootProject.file('gradle/spotless.gradle')
 
     java {
         sourceCompatibility = JavaVersion.VERSION_25
diff --git a/gradle/spotless.gradle b/gradle/spotless.gradle
new file mode 100644
index 0000000000..efc4096a5e
--- /dev/null
+++ b/gradle/spotless.gradle
@@ -0,0 +1,37 @@
+spotless {
+    java {
+        target 'src/**/java/**/*.java'
+        if (project.name == 'stirling-pdf') {
+            targetExclude 'src/main/resources/static/**', 'src/main/java/org/apache/**'
+        } else {
+            targetExclude 'src/main/java/org/apache/**'
+        }
+
+        // licenseHeaderFile(file('config/license-header.txt')).updateYearWithLatest(true).yearStringFormat('%s')
+        removeUnusedImports()
+        googleJavaFormat(rootProject.ext.googleJavaFormatVersion).aosp().reorderImports(false)
+
+        importOrder('java', 'javax', 'org', 'com', 'net', 'io', 'jakarta', 'lombok', 'me', 'stirling')
+        trimTrailingWhitespace()
+        leadingTabsToSpaces()
+        endWithNewline()
+    }
+    yaml {
+        target '**/*.yml', '**/*.yaml'
+        if (project.name == 'stirling-pdf') {
+            targetExclude 'src/main/resources/static/**'
+        }
+        trimTrailingWhitespace()
+        leadingTabsToSpaces()
+        endWithNewline()
+    }
+    format 'gradle', {
+        target '**/gradle/*.gradle', '**/*.gradle'
+        if (project.name == 'stirling-pdf') {
+            targetExclude 'src/main/resources/static/**'
+        }
+        trimTrailingWhitespace()
+        leadingTabsToSpaces()
+        endWithNewline()
+    }
+}

From 1b3e757686515936cf160a01fa828a1981b7ddc2 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:06:23 +0200
Subject: [PATCH 054/109] build(docker): use Node.js 22 for embedded frontend
 builds (#7076)

# Description of Changes

Updated the NodeSource setup from Node.js 20 to Node.js 22 in all
embedded frontend Docker build variants:

- Standard image
- Fat image
- Ultra-lite image

This aligns the Docker builds with the Node.js version used by the
frontend CI workflows and satisfies the `node >=22` engine requirement
of `rollup-plugin-visualizer@7.0.1`
https://github.com/btd/rollup-plugin-visualizer/commit/2caae97a061c752b9ec0fc5b820d10f0777b4c01
. It removes the `EBADENGINE` warning emitted during `frontend:install`
in the Docker Compose test workflow.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 docker/embedded/Dockerfile            | 2 +-
 docker/embedded/Dockerfile.fat        | 2 +-
 docker/embedded/Dockerfile.ultra-lite | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docker/embedded/Dockerfile b/docker/embedded/Dockerfile
index ac50b7bf8e..4502371a4c 100644
--- a/docker/embedded/Dockerfile
+++ b/docker/embedded/Dockerfile
@@ -11,7 +11,7 @@ ARG TASK_VERSION=3.49.1
 RUN apt-get update \
     && apt-get install -y --no-install-recommends curl ca-certificates \
     && update-ca-certificates \
-    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && ARCH=$(dpkg --print-architecture) \
     && curl -fsSL "https://github.com/go-task/task/releases/download/v${TASK_VERSION}/task_${TASK_VERSION}_linux_${ARCH}.deb" -o /tmp/task.deb \
diff --git a/docker/embedded/Dockerfile.fat b/docker/embedded/Dockerfile.fat
index 08b6ad35a8..b169eb9c82 100644
--- a/docker/embedded/Dockerfile.fat
+++ b/docker/embedded/Dockerfile.fat
@@ -12,7 +12,7 @@ ARG TASK_VERSION=3.49.1
 RUN apt-get update \
     && apt-get install -y --no-install-recommends curl ca-certificates \
     && update-ca-certificates \
-    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && ARCH=$(dpkg --print-architecture) \
     && curl -fsSL "https://github.com/go-task/task/releases/download/v${TASK_VERSION}/task_${TASK_VERSION}_linux_${ARCH}.deb" -o /tmp/task.deb \
diff --git a/docker/embedded/Dockerfile.ultra-lite b/docker/embedded/Dockerfile.ultra-lite
index bdaa788785..50b743ca4f 100644
--- a/docker/embedded/Dockerfile.ultra-lite
+++ b/docker/embedded/Dockerfile.ultra-lite
@@ -8,7 +8,7 @@ FROM gradle:9.6.0-jdk25@sha256:e3905233ae349e72016daf8a0e19f085a1dd89ded8ec88b3d
 ARG TASK_VERSION=3.49.1
 RUN apt-get update && apt-get install -y --no-install-recommends \
     curl \
-    && curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
+    && curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
     && apt-get install -y --no-install-recommends nodejs \
     && npm --version \
     && node --version \

From 99887f77a61b6a1c28816b9b14a9d36781cbf790 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:07:51 +0200
Subject: [PATCH 055/109] deps(frontend): upgrade @embedpdf packages to v2.14.4
 (#6989)

# Description of Changes

- Updated all `@embedpdf/*` packages from earlier releases to `v2.14.4`.
- Upgraded `@embedpdf/engines` from `2.8.0` to `2.14.4`.
- Upgraded `@embedpdf/plugin-selection` from `2.8.0` to `2.14.4`.
- Aligned every EmbedPDF package to the same version to avoid version
mismatches.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.

---------

Co-authored-by: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
---
 frontend/package-lock.json | 326 ++++++++++++++++++-------------------
 frontend/package.json      |  46 +++---
 2 files changed, 186 insertions(+), 186 deletions(-)

diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index ea714979f2..726799948f 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -12,29 +12,29 @@
         "@atlaskit/pragmatic-drag-and-drop": "^1.7.7",
         "@cantoo/pdf-lib": "^2.5.3",
         "@dnd-kit/core": "^6.3.1",
-        "@embedpdf/core": "^2.14.1",
-        "@embedpdf/engines": "^2.8.0",
-        "@embedpdf/models": "^2.14.1",
-        "@embedpdf/plugin-annotation": "^2.14.1",
-        "@embedpdf/plugin-attachment": "^2.14.1",
-        "@embedpdf/plugin-bookmark": "^2.14.1",
-        "@embedpdf/plugin-document-manager": "^2.14.1",
-        "@embedpdf/plugin-export": "^2.14.1",
-        "@embedpdf/plugin-history": "^2.14.1",
-        "@embedpdf/plugin-interaction-manager": "^2.14.1",
-        "@embedpdf/plugin-pan": "^2.14.1",
-        "@embedpdf/plugin-print": "^2.14.1",
-        "@embedpdf/plugin-redaction": "^2.14.1",
-        "@embedpdf/plugin-render": "^2.14.1",
-        "@embedpdf/plugin-rotate": "^2.14.1",
-        "@embedpdf/plugin-scroll": "^2.14.1",
-        "@embedpdf/plugin-search": "^2.14.1",
-        "@embedpdf/plugin-selection": "^2.8.0",
-        "@embedpdf/plugin-spread": "^2.14.1",
-        "@embedpdf/plugin-thumbnail": "^2.14.1",
-        "@embedpdf/plugin-tiling": "^2.14.1",
-        "@embedpdf/plugin-viewport": "^2.14.1",
-        "@embedpdf/plugin-zoom": "^2.14.1",
+        "@embedpdf/core": "^2.14.4",
+        "@embedpdf/engines": "^2.14.4",
+        "@embedpdf/models": "^2.14.4",
+        "@embedpdf/plugin-annotation": "^2.14.4",
+        "@embedpdf/plugin-attachment": "^2.14.4",
+        "@embedpdf/plugin-bookmark": "^2.14.4",
+        "@embedpdf/plugin-document-manager": "^2.14.4",
+        "@embedpdf/plugin-export": "^2.14.4",
+        "@embedpdf/plugin-history": "^2.14.4",
+        "@embedpdf/plugin-interaction-manager": "^2.14.4",
+        "@embedpdf/plugin-pan": "^2.14.4",
+        "@embedpdf/plugin-print": "^2.14.4",
+        "@embedpdf/plugin-redaction": "^2.14.4",
+        "@embedpdf/plugin-render": "^2.14.4",
+        "@embedpdf/plugin-rotate": "^2.14.4",
+        "@embedpdf/plugin-scroll": "^2.14.4",
+        "@embedpdf/plugin-search": "^2.14.4",
+        "@embedpdf/plugin-selection": "^2.14.4",
+        "@embedpdf/plugin-spread": "^2.14.4",
+        "@embedpdf/plugin-thumbnail": "^2.14.4",
+        "@embedpdf/plugin-tiling": "^2.14.4",
+        "@embedpdf/plugin-viewport": "^2.14.4",
+        "@embedpdf/plugin-zoom": "^2.14.4",
         "@emotion/react": "^11.14.0",
         "@emotion/styled": "^11.14.1",
         "@iconify/react": "^6.0.2",
@@ -738,13 +738,13 @@
       }
     },
     "node_modules/@embedpdf/core": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/core/-/core-2.14.1.tgz",
-      "integrity": "sha512-L0lNn5WGnGDPaI1q2wnavVF6C6haRtvPGbMfqhZrjr7V+e0GExeoTO0VjK1DwH4IIBHOuD6nsQFYI89+nY/sJA==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/core/-/core-2.14.4.tgz",
+      "integrity": "sha512-trrFhKePk1JnAS8Vd+NWrS1fU2SIj3sifwawho/MeWKTkferLLuBay96ccA4S/Q5D7glKNH//M58VRgns09P3A==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/engines": "2.14.1",
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/engines": "2.14.4",
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
         "preact": "^10.26.4",
@@ -755,9 +755,9 @@
       }
     },
     "node_modules/@embedpdf/engines": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/engines/-/engines-2.14.1.tgz",
-      "integrity": "sha512-k+HHuhj7dPKZC+8wUvMbpEUbNfi6F5r96Ky2XbNhBxiMQSWlVljBQVfZWcq9Jy3TLslwn5m2BbrvvHw+UVqe3w==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/engines/-/engines-2.14.4.tgz",
+      "integrity": "sha512-1kWYvrxjpKr5QUt16r93pLQOLoWEuzD447OViwZyRECsZ8ePoTnErlNlxHiTkeAWBgwr4DD7Xd+2VkTdMAacNA==",
       "license": "MIT",
       "dependencies": {
         "@embedpdf/fonts-arabic": "1.0.0",
@@ -767,8 +767,8 @@
         "@embedpdf/fonts-latin": "1.0.0",
         "@embedpdf/fonts-sc": "1.0.0",
         "@embedpdf/fonts-tc": "1.0.0",
-        "@embedpdf/models": "2.14.1",
-        "@embedpdf/pdfium": "2.14.1"
+        "@embedpdf/models": "2.14.4",
+        "@embedpdf/pdfium": "2.14.4"
       },
       "peerDependencies": {
         "preact": "^10.26.4",
@@ -821,32 +821,32 @@
       "license": "OFL-1.1"
     },
     "node_modules/@embedpdf/models": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/models/-/models-2.14.1.tgz",
-      "integrity": "sha512-jbuoXKv4jW8F1o8EzCmPIB5U/yVC5DWlWhxL9ZfvBiBgW2HIy68ydcu+AykqOG75eAvCfxqcvF2HzSDsV3+K0A==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/models/-/models-2.14.4.tgz",
+      "integrity": "sha512-RlxazYdS1ObWe3Rt78pVUXSqQEMeOb1oHFA0CT3aolwtVooZyop9XO3WTDWpEaGvGrHXvuSv7WQgcCLZ2zKyaQ==",
       "license": "MIT"
     },
     "node_modules/@embedpdf/pdfium": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/pdfium/-/pdfium-2.14.1.tgz",
-      "integrity": "sha512-4FKhpeb7CYfkZ1k0WyDTq8i2FlIO5MaR0ywIDJ0goxOjenKkYOgHQ4747B5evxRzNEC2H5V3Rk6Dunf7TlIYBQ==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/pdfium/-/pdfium-2.14.4.tgz",
+      "integrity": "sha512-0tDPQEH1WtfXcASNVp5U3dqfzZboNvcE4rDok/P4JCN+DCTaJDG2E9lYHGMo9FtuS2IdHgrzkmPRpOo5WV9MKQ==",
       "license": "MIT"
     },
     "node_modules/@embedpdf/plugin-annotation": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-annotation/-/plugin-annotation-2.14.1.tgz",
-      "integrity": "sha512-YGe/DLL5r9HsF54QYgNnsc82W4E2jXRaX6D4WzR38argBhiSLf3IhTJmFXVR2WlPK4VwW6DA0p7WqKcEYUOyDg==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-annotation/-/plugin-annotation-2.14.4.tgz",
+      "integrity": "sha512-ff7rczmrBUoZFXlxC3fT6pSciMUuFAySOxY27oyM1IO3m2QLmzz5Xt9yu3oNYsanRPuO5a8nsgaifd9o8HheNA==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1",
-        "@embedpdf/utils": "2.14.1"
+        "@embedpdf/models": "2.14.4",
+        "@embedpdf/utils": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
-        "@embedpdf/plugin-history": "2.14.1",
-        "@embedpdf/plugin-interaction-manager": "2.14.1",
-        "@embedpdf/plugin-scroll": "2.14.1",
-        "@embedpdf/plugin-selection": "2.14.1",
+        "@embedpdf/core": "2.14.4",
+        "@embedpdf/plugin-history": "2.14.4",
+        "@embedpdf/plugin-interaction-manager": "2.14.4",
+        "@embedpdf/plugin-scroll": "2.14.4",
+        "@embedpdf/plugin-selection": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -855,15 +855,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-attachment": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-attachment/-/plugin-attachment-2.14.1.tgz",
-      "integrity": "sha512-RdR43Kp/t15/KcvAiN8VEMxhqJcTfK2ZeU95PbPHr8zZ1rDatRltVGmKQ4fcaBXQMv15VLTEPZNbGFbfRgdF8g==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-attachment/-/plugin-attachment-2.14.4.tgz",
+      "integrity": "sha512-ktcv48w5DQVG7LTTt45rsth5X4dyxaXZb5zS1bElF1ULp6g7SRy4a0s3UWBY/UDKbpVtrby3JTsfs5fMU2VaRg==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -872,15 +872,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-bookmark": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-bookmark/-/plugin-bookmark-2.14.1.tgz",
-      "integrity": "sha512-ur5tEu4OaVec8T6qF9c18W9hfMNqg0g6dkVqcuh+qaLUYznJpyxMSsNTMJmw/h607bsVLfA1QCwk4l2vORwNmQ==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-bookmark/-/plugin-bookmark-2.14.4.tgz",
+      "integrity": "sha512-SfFhVsqEA+5rJUQSVTP259+cgMqbWR93G/kK6GhDcXou4jNGKNfmiWLeWSMp8lsnGhbMkWxFYJKLuH44NEm63g==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -889,15 +889,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-document-manager": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-document-manager/-/plugin-document-manager-2.14.1.tgz",
-      "integrity": "sha512-Qdj6Xkmpyt0aLHCkqZbOsOK5xzwI4IjaV8C2ihPiggB/iPDhoyXPklJb3wXmJfxjTIl+aw+FZmmPkmr4IpYn7w==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-document-manager/-/plugin-document-manager-2.14.4.tgz",
+      "integrity": "sha512-1qUKu/RAN9LV+Ih7geig0X/2i4jIn8P1D0I0nQUwSMM9hJmitcyDJ/9SK/eOSsdEs4SulIqt+a2W2IMZOY2Vew==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -906,15 +906,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-export": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-export/-/plugin-export-2.14.1.tgz",
-      "integrity": "sha512-O52WPexZD7dbUJQnjp3ikhNg7D3PmGZJowJmXVcmJ2YlTkBabN799LBppC+FYP7nXrtbwy7UmG6vdGWha1b/NQ==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-export/-/plugin-export-2.14.4.tgz",
+      "integrity": "sha512-z1IGsGzWve+g81KCrNbZYN/jHkb9mImodVhTfL35mJfOjOahRmbN0OUn1TvcNHaiXKjy8xcfabvxHDnSaViGlA==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -923,15 +923,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-history": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-history/-/plugin-history-2.14.1.tgz",
-      "integrity": "sha512-mJUKNO69b8Cf0zpE3zJRM5in/AsVRLZq4bRbuAfK9c5+YG2Z59fYEjfRNSwDefxatzFTgy3mlZ5/fSfZsAZz0w==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-history/-/plugin-history-2.14.4.tgz",
+      "integrity": "sha512-X6SBfpyKgQTHNmawoZOfeTW/nhE3NUeqd+gPLFCUkeVTaYO31qSeje3Z7z7pm17dMp5ar9TsgT69ajn6zlsG1w==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -940,15 +940,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-interaction-manager": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-interaction-manager/-/plugin-interaction-manager-2.14.1.tgz",
-      "integrity": "sha512-eyH45cF3vHeZ5BlcgIjH212EtUhi20FvKSRZeLWZW72noOn6saXRDScLy/XGbtfGFjJoTrzkNA553hvrRpqVKA==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-interaction-manager/-/plugin-interaction-manager-2.14.4.tgz",
+      "integrity": "sha512-y4MeHBy5s/SR5ma4rezYADIUujViAZSQe8A/CKehve4eU6Z9YF2AflL/M6KG24gCsUyW4D04AxAn3bvsXLR3nw==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -957,17 +957,17 @@
       }
     },
     "node_modules/@embedpdf/plugin-pan": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-pan/-/plugin-pan-2.14.1.tgz",
-      "integrity": "sha512-sHc9gjfoWQhfMcJ2JULsTzH9Sg9z6wX76Qvr5cujSPoOVV5bZ4QCB0kF1vgLFFzA1ia7vIBveGtDHIGkQQjsxA==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-pan/-/plugin-pan-2.14.4.tgz",
+      "integrity": "sha512-TAVGzXg9qgfiZHZfZFkHry9jCSQjk/borV1DB8HJTcgTk52phhaSr4EFjBZ808Hj5t+cc9VZWoE1JhL8AAiKfw==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
-        "@embedpdf/plugin-interaction-manager": "2.14.1",
-        "@embedpdf/plugin-viewport": "2.14.1",
+        "@embedpdf/core": "2.14.4",
+        "@embedpdf/plugin-interaction-manager": "2.14.4",
+        "@embedpdf/plugin-viewport": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -976,15 +976,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-print": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-print/-/plugin-print-2.14.1.tgz",
-      "integrity": "sha512-wYuGuxuBhau7l2BfTlD5oohboRdseOn9/v0uVNGwKDuLHUTrv2WnkpzibBYIjv73gttyMBxTXdB3PZfnWOo8VA==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-print/-/plugin-print-2.14.4.tgz",
+      "integrity": "sha512-qk1aQhLS+8eBL6lcT46p+fZaNjvLMVQF2Nl/t78aOy+cNskXHeYsnZi9tJKNYGLHbi+8+Dg2iHVIhFvweFn/Ww==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=18.0.0",
         "react-dom": ">=18.0.0",
@@ -993,20 +993,20 @@
       }
     },
     "node_modules/@embedpdf/plugin-redaction": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-redaction/-/plugin-redaction-2.14.1.tgz",
-      "integrity": "sha512-xlcOgYDNqIKp9u7exT95RtfDGCkW1b+knGikpTNZEA5OJgtYO9RxquTkEZ4rdVZbgIWxs0xiMg6b0mhr33z4JQ==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-redaction/-/plugin-redaction-2.14.4.tgz",
+      "integrity": "sha512-pECosjyBaLlYz1Fgde4gqquV4uQY8LAkbx7TtMwP1EhBFtG0QeoeuhytoLm9I/cWPi84jfaQjkWZB58HPxR5Zw==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1",
-        "@embedpdf/utils": "2.14.1"
+        "@embedpdf/models": "2.14.4",
+        "@embedpdf/utils": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
-        "@embedpdf/plugin-annotation": "2.14.1",
-        "@embedpdf/plugin-history": "2.14.1",
-        "@embedpdf/plugin-interaction-manager": "2.14.1",
-        "@embedpdf/plugin-selection": "2.14.1",
+        "@embedpdf/core": "2.14.4",
+        "@embedpdf/plugin-annotation": "2.14.4",
+        "@embedpdf/plugin-history": "2.14.4",
+        "@embedpdf/plugin-interaction-manager": "2.14.4",
+        "@embedpdf/plugin-selection": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1015,15 +1015,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-render": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-render/-/plugin-render-2.14.1.tgz",
-      "integrity": "sha512-KRjeSZeQRrg6fuyUgSU43yE6bOrRredpEiAfPI/FUCGgniO9nokTHjnFYg5G3UtVteJdnzdnKwzBl5sY++NQkg==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-render/-/plugin-render-2.14.4.tgz",
+      "integrity": "sha512-KNY3EGYf9SRqtDBOEO9mR3Hyv9mN8TaC3ztERj0BX8zra7mkjkQnhGQlMxif1dGOoTD9XIcPqJvaw8o7PWDJDw==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1032,15 +1032,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-rotate": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-rotate/-/plugin-rotate-2.14.1.tgz",
-      "integrity": "sha512-ILu0Y6bXzLQg63cj9pAJ0ime5m5HVDOSBOyTT/Nb47hBfDLSbTWQuvAHZXwxPhGOjM5Pn6gHssKWZjW2WiXkBQ==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-rotate/-/plugin-rotate-2.14.4.tgz",
+      "integrity": "sha512-+bBBHfoSMBMjHubDgPkCCu3o2NZn5vv8l/2gmzH6D8k90UVLB2AOei9VTmfy5xqoit+eoY6iSl7w3qyijNfB0A==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1049,16 +1049,16 @@
       }
     },
     "node_modules/@embedpdf/plugin-scroll": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-scroll/-/plugin-scroll-2.14.1.tgz",
-      "integrity": "sha512-ppnP4t43EVNiXr2coEwybQ7BYucbUEpdTGlcEBm38DhLywgseVVySrcIMx7rHdM7ZylsW7uwS84hCFndTpPezg==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-scroll/-/plugin-scroll-2.14.4.tgz",
+      "integrity": "sha512-0JgPwnQqB9THKJt/mOubgFkiTcCkOI6kFCZz8zlwl88DAJcUbdhJoTwCJZ2STYSfECTLB4ZFjb5fZ9AXyfkf0g==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
-        "@embedpdf/plugin-viewport": "2.14.1",
+        "@embedpdf/core": "2.14.4",
+        "@embedpdf/plugin-viewport": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1067,15 +1067,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-search": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-search/-/plugin-search-2.14.1.tgz",
-      "integrity": "sha512-dAX4aIc4WeO+bUImbcHVm4c32UADYelpTeJA0It2eq6agZVND20B25kyDYpJiWKTl9NaVcJbNic+wreudl6vsQ==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-search/-/plugin-search-2.14.4.tgz",
+      "integrity": "sha512-ErRlg0MKLxZ0c4OKk5RjPOV8f8yCaqFi6zqUxBI49/3yN6wDINKvm8dxt5Q2QGUa740n/XylT5BTbjH6lAjCzQ==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1084,17 +1084,17 @@
       }
     },
     "node_modules/@embedpdf/plugin-selection": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-selection/-/plugin-selection-2.14.1.tgz",
-      "integrity": "sha512-M+omnIDqgME+QgYX3nW3ypjzRvvz2IrSWpx7vP7vUhfd12R4ZJnTkS9AkKbXgHBVwWrxnbibKlZduiiehRLeKg==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-selection/-/plugin-selection-2.14.4.tgz",
+      "integrity": "sha512-8w6ZUdwRcBhNCQjlS8mFvsMXI/wr1Q7DljwlFmKaEQyM9vXm2rI9WGN0z9ffjKHlsYn0yg98pqyPLtTevH1P7Q==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1",
-        "@embedpdf/utils": "2.14.1"
+        "@embedpdf/models": "2.14.4",
+        "@embedpdf/utils": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
-        "@embedpdf/plugin-interaction-manager": "2.14.1",
+        "@embedpdf/core": "2.14.4",
+        "@embedpdf/plugin-interaction-manager": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1103,15 +1103,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-spread": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-spread/-/plugin-spread-2.14.1.tgz",
-      "integrity": "sha512-MychoG54eYqjB+8/1/ArKYF+4eonULtBuGPqU72MO9t/Nadl8nNThaPrOW/eKQr3zQu1Af3KO7ng6tm6Umz4rA==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-spread/-/plugin-spread-2.14.4.tgz",
+      "integrity": "sha512-ybJNbOMXBciD9cS+wwAUM1L5ZZMgF0+8Tpi78MaXGwnwH1wJUSx1Tx90YNsO9DxIKKckDsxUQREwUtTTcwFLEA==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1120,16 +1120,16 @@
       }
     },
     "node_modules/@embedpdf/plugin-thumbnail": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-thumbnail/-/plugin-thumbnail-2.14.1.tgz",
-      "integrity": "sha512-NOaFve83gbD6BUiANSSbiREjUJ1qpNyQrHl2RdMDNLyDaSUARweUu5zC5vfFRd9I+jUf3XGsCa3GNFlzQt+C9A==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-thumbnail/-/plugin-thumbnail-2.14.4.tgz",
+      "integrity": "sha512-80D+R2uXoTsmQXFpGGhtapv3I45WNzTSIkcD3VvLywjS2MHwgCNY51RQsn5bc3HINZW9d/SX1F39qiv4HzPp6A==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
-        "@embedpdf/plugin-render": "2.14.1",
+        "@embedpdf/core": "2.14.4",
+        "@embedpdf/plugin-render": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1138,18 +1138,18 @@
       }
     },
     "node_modules/@embedpdf/plugin-tiling": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-tiling/-/plugin-tiling-2.14.1.tgz",
-      "integrity": "sha512-tvs3pPT6wVh0MjMN7Dp8R1XeoTjguH30j/ToWz9ziTKkwXADfJXdyjqYGhagiamMMTwQeUF9py+yDTMP23QV7Q==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-tiling/-/plugin-tiling-2.14.4.tgz",
+      "integrity": "sha512-++1bzvU0Xqi6a1XeUOLAHU7D/FVUNobC/behSSn3WZnY/wIpYG3dXs5NbhNzeomIGXYHC4jCXbKGBPe5TNdoSw==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
-        "@embedpdf/plugin-render": "2.14.1",
-        "@embedpdf/plugin-scroll": "2.14.1",
-        "@embedpdf/plugin-viewport": "2.14.1",
+        "@embedpdf/core": "2.14.4",
+        "@embedpdf/plugin-render": "2.14.4",
+        "@embedpdf/plugin-scroll": "2.14.4",
+        "@embedpdf/plugin-viewport": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1158,15 +1158,15 @@
       }
     },
     "node_modules/@embedpdf/plugin-viewport": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-viewport/-/plugin-viewport-2.14.1.tgz",
-      "integrity": "sha512-U45B46XoaAFxC3yKnVhBO8Z5Wa+ca17UW7esJC/yWneJ2dNfSnvRAR7309KKP/RpZfDmn/lfJDVOFGCDbR3hvw==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-viewport/-/plugin-viewport-2.14.4.tgz",
+      "integrity": "sha512-ZhbDITPZ/h1Vd9cUbCPShSbH5RXd/biCw9w6fneTItruMauYIcTNUS2eWLJC0Yovhw7nu0TjRVYuTQ71jzs0dg==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
+        "@embedpdf/core": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1175,17 +1175,17 @@
       }
     },
     "node_modules/@embedpdf/plugin-zoom": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-zoom/-/plugin-zoom-2.14.1.tgz",
-      "integrity": "sha512-rVah7XgrWiNe9kT7VGRhNp5mCImf3eMk4cGO9kXIidQWka+yFqBANJw6Rj+FJdtWqz6pamZNWXTDZ1jvQkMKZg==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/plugin-zoom/-/plugin-zoom-2.14.4.tgz",
+      "integrity": "sha512-a5kUjbG9sKMyO8qqDTrtL30VJ3dSEyNHHvszhfbvKtv4hppz/fSKS78vieu3lw48K11BoioImzCAF6Y3R0LMiw==",
       "license": "MIT",
       "dependencies": {
-        "@embedpdf/models": "2.14.1"
+        "@embedpdf/models": "2.14.4"
       },
       "peerDependencies": {
-        "@embedpdf/core": "2.14.1",
-        "@embedpdf/plugin-scroll": "2.14.1",
-        "@embedpdf/plugin-viewport": "2.14.1",
+        "@embedpdf/core": "2.14.4",
+        "@embedpdf/plugin-scroll": "2.14.4",
+        "@embedpdf/plugin-viewport": "2.14.4",
         "preact": "^10.26.4",
         "react": ">=16.8.0",
         "react-dom": ">=16.8.0",
@@ -1194,9 +1194,9 @@
       }
     },
     "node_modules/@embedpdf/utils": {
-      "version": "2.14.1",
-      "resolved": "https://registry.npmjs.org/@embedpdf/utils/-/utils-2.14.1.tgz",
-      "integrity": "sha512-TlJBT+SgRgcSMKH2EX3WBXIm/a/LEtgG2IiZ7hXPhT3t2e1HOeXjkvreJi6wcnvkMt4eYtJh3nocetto5gNclw==",
+      "version": "2.14.4",
+      "resolved": "https://registry.npmjs.org/@embedpdf/utils/-/utils-2.14.4.tgz",
+      "integrity": "sha512-W7BZSNAQeUPQhi6l96Q4oFtg8Vgbt622LQL5ql0oZjyJNJRbYqCJIiJpR+5ZvK6S/x2MadZnYSzBJ/ekL6394A==",
       "license": "MIT",
       "peerDependencies": {
         "preact": "^10.26.4",
diff --git a/frontend/package.json b/frontend/package.json
index 51b2472dcb..a13800f429 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -9,29 +9,29 @@
     "@atlaskit/pragmatic-drag-and-drop": "^1.7.7",
     "@cantoo/pdf-lib": "^2.5.3",
     "@dnd-kit/core": "^6.3.1",
-    "@embedpdf/core": "^2.14.1",
-    "@embedpdf/engines": "^2.8.0",
-    "@embedpdf/models": "^2.14.1",
-    "@embedpdf/plugin-annotation": "^2.14.1",
-    "@embedpdf/plugin-attachment": "^2.14.1",
-    "@embedpdf/plugin-bookmark": "^2.14.1",
-    "@embedpdf/plugin-document-manager": "^2.14.1",
-    "@embedpdf/plugin-export": "^2.14.1",
-    "@embedpdf/plugin-history": "^2.14.1",
-    "@embedpdf/plugin-interaction-manager": "^2.14.1",
-    "@embedpdf/plugin-pan": "^2.14.1",
-    "@embedpdf/plugin-print": "^2.14.1",
-    "@embedpdf/plugin-redaction": "^2.14.1",
-    "@embedpdf/plugin-render": "^2.14.1",
-    "@embedpdf/plugin-rotate": "^2.14.1",
-    "@embedpdf/plugin-scroll": "^2.14.1",
-    "@embedpdf/plugin-search": "^2.14.1",
-    "@embedpdf/plugin-selection": "^2.8.0",
-    "@embedpdf/plugin-spread": "^2.14.1",
-    "@embedpdf/plugin-thumbnail": "^2.14.1",
-    "@embedpdf/plugin-tiling": "^2.14.1",
-    "@embedpdf/plugin-viewport": "^2.14.1",
-    "@embedpdf/plugin-zoom": "^2.14.1",
+    "@embedpdf/core": "^2.14.4",
+    "@embedpdf/engines": "^2.14.4",
+    "@embedpdf/models": "^2.14.4",
+    "@embedpdf/plugin-annotation": "^2.14.4",
+    "@embedpdf/plugin-attachment": "^2.14.4",
+    "@embedpdf/plugin-bookmark": "^2.14.4",
+    "@embedpdf/plugin-document-manager": "^2.14.4",
+    "@embedpdf/plugin-export": "^2.14.4",
+    "@embedpdf/plugin-history": "^2.14.4",
+    "@embedpdf/plugin-interaction-manager": "^2.14.4",
+    "@embedpdf/plugin-pan": "^2.14.4",
+    "@embedpdf/plugin-print": "^2.14.4",
+    "@embedpdf/plugin-redaction": "^2.14.4",
+    "@embedpdf/plugin-render": "^2.14.4",
+    "@embedpdf/plugin-rotate": "^2.14.4",
+    "@embedpdf/plugin-scroll": "^2.14.4",
+    "@embedpdf/plugin-search": "^2.14.4",
+    "@embedpdf/plugin-selection": "^2.14.4",
+    "@embedpdf/plugin-spread": "^2.14.4",
+    "@embedpdf/plugin-thumbnail": "^2.14.4",
+    "@embedpdf/plugin-tiling": "^2.14.4",
+    "@embedpdf/plugin-viewport": "^2.14.4",
+    "@embedpdf/plugin-zoom": "^2.14.4",
     "@emotion/react": "^11.14.0",
     "@emotion/styled": "^11.14.1",
     "@iconify/react": "^6.0.2",

From 1ba90929992d5cfe87b62406ad9a0b0d4a1dbbb3 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:08:27 +0200
Subject: [PATCH 056/109] chore: upgrade Gradle to 9.6.1 across CI, Docker, and
 wrapper (#6892)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Description of Changes

This change upgrades the project from Gradle **9.6.0** to **9.6.1**
across all build environments to keep the toolchain consistent and
aligned.

### What was changed

- Updated the Gradle Wrapper to **9.6.1**.
- Updated all GitHub Actions workflows using
`gradle/actions/setup-gradle` to install Gradle **9.6.1**.
- Updated all Docker build stages to use the `gradle:9.6.1-jdk25` image
with the corresponding pinned image digest.
- Regenerated the Windows Gradle wrapper script, resulting in minor
comment updates (`Gradle` → `gradlew`).

### Why the change was made

- Keep the project up to date with the latest Gradle patch release.
- Ensure all local, CI, and Docker build environments use the same
Gradle version.
- Benefit from the latest bug fixes and maintenance improvements
included in Gradle 9.6.1.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .github/workflows/PR-Demo-Comment-with-react.yml       | 2 +-
 .github/workflows/backend-build.yml                    | 2 +-
 .github/workflows/check-licence.yml                    | 2 +-
 .github/workflows/check-openapi.yml                    | 2 +-
 .github/workflows/coverage-aggregate.yml               | 2 +-
 .github/workflows/db-migration-test.yml                | 2 +-
 .github/workflows/docker-compose-tests.yml             | 2 +-
 .github/workflows/frontend-backend-licenses-update.yml | 2 +-
 .github/workflows/multiOSReleases.yml                  | 6 +++---
 .github/workflows/push-docker.yml                      | 2 +-
 .github/workflows/swagger.yml                          | 2 +-
 .github/workflows/tauri-build.yml                      | 2 +-
 .github/workflows/test-build-docker.yml                | 2 +-
 .github/workflows/testdriver.yml                       | 2 +-
 docker/backend/Dockerfile                              | 2 +-
 docker/embedded/Dockerfile                             | 2 +-
 docker/embedded/Dockerfile.fat                         | 2 +-
 docker/embedded/Dockerfile.ultra-lite                  | 2 +-
 gradle/wrapper/gradle-wrapper.properties               | 2 +-
 gradlew.bat                                            | 4 ++--
 20 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/.github/workflows/PR-Demo-Comment-with-react.yml b/.github/workflows/PR-Demo-Comment-with-react.yml
index 2a780e5d98..4978586966 100644
--- a/.github/workflows/PR-Demo-Comment-with-react.yml
+++ b/.github/workflows/PR-Demo-Comment-with-react.yml
@@ -222,7 +222,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml
index e8e68968f2..ccb85769af 100644
--- a/.github/workflows/backend-build.yml
+++ b/.github/workflows/backend-build.yml
@@ -58,7 +58,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
           cache-disabled: true
 
       - name: Install Task
diff --git a/.github/workflows/check-licence.yml b/.github/workflows/check-licence.yml
index dcd8c032df..40b2b15478 100644
--- a/.github/workflows/check-licence.yml
+++ b/.github/workflows/check-licence.yml
@@ -40,7 +40,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
           cache-disabled: true
 
       - name: Install Task
diff --git a/.github/workflows/check-openapi.yml b/.github/workflows/check-openapi.yml
index bf51140181..26eac3183c 100644
--- a/.github/workflows/check-openapi.yml
+++ b/.github/workflows/check-openapi.yml
@@ -45,7 +45,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
           cache-disabled: true
 
       - name: Install Task
diff --git a/.github/workflows/coverage-aggregate.yml b/.github/workflows/coverage-aggregate.yml
index 277350da93..d967b1536d 100644
--- a/.github/workflows/coverage-aggregate.yml
+++ b/.github/workflows/coverage-aggregate.yml
@@ -62,7 +62,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
           cache-disabled: true
 
       - name: Set up Python
diff --git a/.github/workflows/db-migration-test.yml b/.github/workflows/db-migration-test.yml
index f6c93db3d0..103efa4d6a 100644
--- a/.github/workflows/db-migration-test.yml
+++ b/.github/workflows/db-migration-test.yml
@@ -48,7 +48,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
           cache-disabled: true
 
       # No `-PnoSpotless` here yet because the upstream cache layer matches the
diff --git a/.github/workflows/docker-compose-tests.yml b/.github/workflows/docker-compose-tests.yml
index 1a1c53bc25..ab9b7e99a0 100644
--- a/.github/workflows/docker-compose-tests.yml
+++ b/.github/workflows/docker-compose-tests.yml
@@ -61,7 +61,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
           cache-disabled: true
 
       # When the PR changes the base image, test.sh builds it locally
diff --git a/.github/workflows/frontend-backend-licenses-update.yml b/.github/workflows/frontend-backend-licenses-update.yml
index 4f0aa5f837..16db63afdb 100644
--- a/.github/workflows/frontend-backend-licenses-update.yml
+++ b/.github/workflows/frontend-backend-licenses-update.yml
@@ -359,7 +359,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml
index 88e38c5c97..a97117f74e 100644
--- a/.github/workflows/multiOSReleases.yml
+++ b/.github/workflows/multiOSReleases.yml
@@ -73,7 +73,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
@@ -148,7 +148,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
 
       - name: Setup Node.js
         if: matrix.variant.build_frontend == true
@@ -252,7 +252,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
 
       - name: Install Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
diff --git a/.github/workflows/push-docker.yml b/.github/workflows/push-docker.yml
index eac1fa49fc..03aeeb6b68 100644
--- a/.github/workflows/push-docker.yml
+++ b/.github/workflows/push-docker.yml
@@ -78,7 +78,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
 
       - name: Set up Docker Buildx
         id: buildx
diff --git a/.github/workflows/swagger.yml b/.github/workflows/swagger.yml
index d6d9640f06..0f986a3d52 100644
--- a/.github/workflows/swagger.yml
+++ b/.github/workflows/swagger.yml
@@ -48,7 +48,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
 
       - name: Generate Swagger documentation
         run: ./gradlew :stirling-pdf:generateOpenApiDocs
diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml
index ca00af04bc..6a15c1663f 100644
--- a/.github/workflows/tauri-build.yml
+++ b/.github/workflows/tauri-build.yml
@@ -170,7 +170,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
 
       - name: Setup Task
         uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
diff --git a/.github/workflows/test-build-docker.yml b/.github/workflows/test-build-docker.yml
index ff7ac0637b..44cbe36798 100644
--- a/.github/workflows/test-build-docker.yml
+++ b/.github/workflows/test-build-docker.yml
@@ -111,7 +111,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
           cache-disabled: true
 
       - name: Install Task
diff --git a/.github/workflows/testdriver.yml b/.github/workflows/testdriver.yml
index 7e87fc6d92..aae3ca27d3 100644
--- a/.github/workflows/testdriver.yml
+++ b/.github/workflows/testdriver.yml
@@ -51,7 +51,7 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
-          gradle-version: 9.6.0
+          gradle-version: 9.6.1
 
       - name: Build with Gradle
         run: ./gradlew build
diff --git a/docker/backend/Dockerfile b/docker/backend/Dockerfile
index 82d552ef2f..7f262b840b 100644
--- a/docker/backend/Dockerfile
+++ b/docker/backend/Dockerfile
@@ -4,7 +4,7 @@ ARG BASE_VERSION=1.0.2@sha256:c7698687f486707ddef9e0298587ca8b44c4e96185e1bdb0c3
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
 
 # Stage 1: Build the Java application (backend only, no frontend)
-FROM gradle:9.6.0-jdk25@sha256:e3905233ae349e72016daf8a0e19f085a1dd89ded8ec88b3d8335d3fd0b350f4 AS app-build
+FROM gradle:9.6.1-jdk25@sha256:d25357611c559203299f3c6673101154156bdd28985858ff6f465fc69bd27ca4 AS app-build
 
 # JDK 25+: --add-exports is no longer accepted via JAVA_TOOL_OPTIONS; use JDK_JAVA_OPTIONS instead
 ENV JDK_JAVA_OPTIONS="--add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED \
diff --git a/docker/embedded/Dockerfile b/docker/embedded/Dockerfile
index 4502371a4c..6655d7d4b8 100644
--- a/docker/embedded/Dockerfile
+++ b/docker/embedded/Dockerfile
@@ -5,7 +5,7 @@ ARG BASE_VERSION=1.0.2@sha256:c7698687f486707ddef9e0298587ca8b44c4e96185e1bdb0c3
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
 
 # Stage 1: Build the Java application and frontend
-FROM gradle:9.6.0-jdk25@sha256:e3905233ae349e72016daf8a0e19f085a1dd89ded8ec88b3d8335d3fd0b350f4 AS app-build
+FROM gradle:9.6.1-jdk25@sha256:d25357611c559203299f3c6673101154156bdd28985858ff6f465fc69bd27ca4 AS app-build
 
 ARG TASK_VERSION=3.49.1
 RUN apt-get update \
diff --git a/docker/embedded/Dockerfile.fat b/docker/embedded/Dockerfile.fat
index b169eb9c82..058e824e1b 100644
--- a/docker/embedded/Dockerfile.fat
+++ b/docker/embedded/Dockerfile.fat
@@ -6,7 +6,7 @@ ARG BASE_VERSION=1.0.2@sha256:c7698687f486707ddef9e0298587ca8b44c4e96185e1bdb0c3
 ARG BASE_IMAGE=stirlingtools/stirling-pdf-base:${BASE_VERSION}
 
 # Stage 1: Build the Java application and frontend
-FROM gradle:9.6.0-jdk25@sha256:e3905233ae349e72016daf8a0e19f085a1dd89ded8ec88b3d8335d3fd0b350f4 AS app-build
+FROM gradle:9.6.1-jdk25@sha256:d25357611c559203299f3c6673101154156bdd28985858ff6f465fc69bd27ca4 AS app-build
 
 ARG TASK_VERSION=3.49.1
 RUN apt-get update \
diff --git a/docker/embedded/Dockerfile.ultra-lite b/docker/embedded/Dockerfile.ultra-lite
index 50b743ca4f..4095300ce6 100644
--- a/docker/embedded/Dockerfile.ultra-lite
+++ b/docker/embedded/Dockerfile.ultra-lite
@@ -2,7 +2,7 @@
 # Single JAR contains both frontend and backend with minimal dependencies
 
 # Stage 1: Build application with embedded frontend
-FROM gradle:9.6.0-jdk25@sha256:e3905233ae349e72016daf8a0e19f085a1dd89ded8ec88b3d8335d3fd0b350f4 AS build
+FROM gradle:9.6.1-jdk25@sha256:d25357611c559203299f3c6673101154156bdd28985858ff6f465fc69bd27ca4 AS build
 
 # Install Node.js and npm for frontend build
 ARG TASK_VERSION=3.49.1
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index eb84db68da..a9db11550c 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,6 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.0-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500
diff --git a/gradlew.bat b/gradlew.bat
index 24c62d56f2..a51ec4f588 100644
--- a/gradlew.bat
+++ b/gradlew.bat
@@ -19,7 +19,7 @@
 @if "%DEBUG%"=="" @echo off
 @rem ##########################################################################
 @rem
-@rem  Gradle startup script for Windows
+@rem  gradlew startup script for Windows
 @rem
 @rem ##########################################################################
 
@@ -72,7 +72,7 @@ echo location of your Java installation. 1>&2
 
 
 
-@rem Execute Gradle
+@rem Execute gradlew
 @rem endlocal doesn't take effect until after the line is parsed and variables are expanded
 @rem which allows us to clear the local environment before executing the java command
 endlocal & "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -jar "%APP_HOME%\gradle\wrapper\gradle-wrapper.jar" %* & call :exitWithErrorLevel

From a63ab2db7be9929d9455438e98262dc5e459056f Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:10:07 +0200
Subject: [PATCH 057/109] Add PR conflict labeler workflow (#7061)

### Motivation
- Automatically detect and mark pull requests that have merge conflicts
so maintainers can triage them quickly.
- Ensure both new and existing open PRs are covered by running on PR
events, a schedule, and manual dispatch.

### Description
- Add workflow `: .github/workflows/pr-conflict-labeler.yml` that
triggers on `pull_request_target`, a recurring `schedule`, and
`workflow_dispatch` for manual runs.
- The job uses the repository `stirling-bot`
(`.github/actions/setup-bot`) and `actions/github-script` to poll
`pull.mergeable` until GitHub computes mergeability and then add or
remove the `has conflicts` label when `mergeable === false &&
mergeable_state === 'dirty'`.
- The workflow idempotently ensures the `has conflicts` label exists
(creates it if missing) and the repository label config `
.github/labels.yml` is updated to include `has conflicts` with an
appropriate color and description.

### Testing
- Parsed both ` .github/workflows/pr-conflict-labeler.yml` and `
.github/labels.yml` with Ruby `YAML.load_file`, which succeeded.
- Installed and ran `actionlint` via `go install
github.com/rhysd/actionlint/cmd/actionlint@latest` and validated the new
workflow file with `actionlint`, which succeeded.

------
[Codex
Task](https://chatgpt.com/codex/cloud/tasks/task_e_6a58b7061c2c8325b024980a4af8f632)
---
 .github/labels.yml                        |   3 +
 .github/workflows/pr-conflict-labeler.yml | 159 ++++++++++++++++++++++
 2 files changed, 162 insertions(+)
 create mode 100644 .github/workflows/pr-conflict-labeler.yml

diff --git a/.github/labels.yml b/.github/labels.yml
index d319aaa007..65861c0d4d 100644
--- a/.github/labels.yml
+++ b/.github/labels.yml
@@ -202,3 +202,6 @@
 - name: "license-review-required"
   color: "EDEDED"
   description: "This PR requires a license review"
+- name: "has conflicts"
+  color: "D93F0B"
+  description: "Pull request has merge conflicts with the base branch"
diff --git a/.github/workflows/pr-conflict-labeler.yml b/.github/workflows/pr-conflict-labeler.yml
new file mode 100644
index 0000000000..f6e1016a4c
--- /dev/null
+++ b/.github/workflows/pr-conflict-labeler.yml
@@ -0,0 +1,159 @@
+name: PR conflict labeler
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - edited
+      - ready_for_review
+  schedule:
+    - cron: "17 */6 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: pr-conflict-labeler-${{ github.event.pull_request.number || 'all-open-prs' }}
+  cancel-in-progress: false
+
+env:
+  CONFLICT_LABEL: "has conflicts"
+
+jobs:
+  label-conflicts:
+    name: Label conflicted PRs
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Check out the repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up stirling-bot token
+        id: setup-bot
+        uses: ./.github/actions/setup-bot
+        with:
+          app-id: ${{ secrets.GH_APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
+      - name: Apply conflict label
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          github-token: ${{ steps.setup-bot.outputs.token }}
+          script: |
+            const conflictLabel = process.env.CONFLICT_LABEL;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const eventPullRequest = context.payload.pull_request;
+
+            async function sleep(ms) {
+              await new Promise((resolve) => setTimeout(resolve, ms));
+            }
+
+            async function getPullRequestWithMergeableState(pullNumber) {
+              for (let attempt = 1; attempt <= 6; attempt += 1) {
+                const { data: pull } = await github.rest.pulls.get({
+                  owner,
+                  repo,
+                  pull_number: pullNumber,
+                });
+
+                if (pull.mergeable !== null) {
+                  return pull;
+                }
+
+                core.info(`PR #${pullNumber}: mergeable is not ready yet (attempt ${attempt}/6).`);
+                await sleep(5000);
+              }
+
+              const { data: pull } = await github.rest.pulls.get({
+                owner,
+                repo,
+                pull_number: pullNumber,
+              });
+              return pull;
+            }
+
+            async function ensureConflictLabel() {
+              try {
+                await github.rest.issues.getLabel({
+                  owner,
+                  repo,
+                  name: conflictLabel,
+                });
+              } catch (error) {
+                if (error.status !== 404) {
+                  throw error;
+                }
+
+                await github.rest.issues.createLabel({
+                  owner,
+                  repo,
+                  name: conflictLabel,
+                  color: 'D93F0B',
+                  description: 'Pull request has merge conflicts with the base branch',
+                });
+                core.info(`Created '${conflictLabel}' label.`);
+              }
+            }
+
+            async function labelPullRequest(pull) {
+              const existingLabels = pull.labels.map((label) => label.name);
+              const hasConflictLabel = existingLabels.includes(conflictLabel);
+              const hasConflicts = pull.mergeable === false && pull.mergeable_state === 'dirty';
+
+              if (hasConflicts && !hasConflictLabel) {
+                await github.rest.issues.addLabels({
+                  owner,
+                  repo,
+                  issue_number: pull.number,
+                  labels: [conflictLabel],
+                });
+                core.info(`Added '${conflictLabel}' to PR #${pull.number}.`);
+                return;
+              }
+
+              if (!hasConflicts && hasConflictLabel) {
+                await github.rest.issues.removeLabel({
+                  owner,
+                  repo,
+                  issue_number: pull.number,
+                  name: conflictLabel,
+                });
+                core.info(`Removed '${conflictLabel}' from PR #${pull.number}.`);
+                return;
+              }
+
+              core.info(`PR #${pull.number}: no label change needed (mergeable=${pull.mergeable}, mergeable_state=${pull.mergeable_state}).`);
+            }
+
+            await ensureConflictLabel();
+
+            let pullNumbers;
+            if (eventPullRequest) {
+              pullNumbers = [eventPullRequest.number];
+            } else {
+              const pulls = await github.paginate(github.rest.pulls.list, {
+                owner,
+                repo,
+                state: 'open',
+                per_page: 100,
+              });
+              pullNumbers = pulls.map((pull) => pull.number);
+              core.info(`Checking ${pullNumbers.length} open PR(s).`);
+            }
+
+            for (const pullNumber of pullNumbers) {
+              const pull = await getPullRequestWithMergeableState(pullNumber);
+              await labelPullRequest(pull);
+            }

From b6b5077467ac4f0862a276fff50dce9314901631 Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:10:38 +0200
Subject: [PATCH 058/109] deps: update vulnerable dependencies to address
 GitHub Security Advisories (#7064)

# Description of Changes

This pull request updates project dependencies to versions that resolve
the following GitHub Security Advisories:

- GHSA-wf93-45jw-7689
- GHSA-58qw-9mgm-455v
- GHSA-jp4c-xjxw-mgf9

### What was changed

- Updated affected dependencies to patched versions.
- Removed known vulnerable dependency versions reported by GitHub
Security Advisories.
- Ensured dependency versions remain compatible with the existing
project configuration.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .github/scripts/requirements_dev.txt         | 717 ++++++++++---------
 .github/scripts/requirements_sync_readme.txt |   8 +-
 testing/cucumber/requirements.txt            | 466 ++++++------
 3 files changed, 583 insertions(+), 608 deletions(-)

diff --git a/.github/scripts/requirements_dev.txt b/.github/scripts/requirements_dev.txt
index 0c10203efa..d4b9f19132 100644
--- a/.github/scripts/requirements_dev.txt
+++ b/.github/scripts/requirements_dev.txt
@@ -1,101 +1,116 @@
 #
-# This file is autogenerated by pip-compile with Python 3.12
+# This file is autogenerated by pip-compile with Python 3.13
 # by the following command:
 #
 #    pip-compile --allow-unsafe --generate-hashes --output-file='.github\scripts\requirements_dev.txt' --strip-extras '.github\scripts\requirements_dev.in'
 #
 # WARNING: pip install will require the following package to be hashed.
 # Consider using a hashable URL like https://github.com/jazzband/pip-tools/archive/SOMECOMMIT.zip
-# CVE-2025-6176 mitigation: pin brotli to a specific commit
 brotli @ git+https://github.com/google/brotli.git@028fb5a23661f123017c060daa546b55cf4bde29
     # via
     #   -r .github/scripts/requirements_dev.in
     #   fonttools
-cffi==2.0.0 \
-    --hash=sha256:00bdf7acc5f795150faa6957054fbbca2439db2f775ce831222b66f192f03beb \
-    --hash=sha256:07b271772c100085dd28b74fa0cd81c8fb1a3ba18b21e03d7c27f3436a10606b \
-    --hash=sha256:087067fa8953339c723661eda6b54bc98c5625757ea62e95eb4898ad5e776e9f \
-    --hash=sha256:0a1527a803f0a659de1af2e1fd700213caba79377e27e4693648c2923da066f9 \
-    --hash=sha256:0cf2d91ecc3fcc0625c2c530fe004f82c110405f101548512cce44322fa8ac44 \
-    --hash=sha256:0f6084a0ea23d05d20c3edcda20c3d006f9b6f3fefeac38f59262e10cef47ee2 \
-    --hash=sha256:12873ca6cb9b0f0d3a0da705d6086fe911591737a59f28b7936bdfed27c0d47c \
-    --hash=sha256:19f705ada2530c1167abacb171925dd886168931e0a7b78f5bffcae5c6b5be75 \
-    --hash=sha256:1cd13c99ce269b3ed80b417dcd591415d3372bcac067009b6e0f59c7d4015e65 \
-    --hash=sha256:1e3a615586f05fc4065a8b22b8152f0c1b00cdbc60596d187c2a74f9e3036e4e \
-    --hash=sha256:1f72fb8906754ac8a2cc3f9f5aaa298070652a0ffae577e0ea9bd480dc3c931a \
-    --hash=sha256:1fc9ea04857caf665289b7a75923f2c6ed559b8298a1b8c49e59f7dd95c8481e \
-    --hash=sha256:203a48d1fb583fc7d78a4c6655692963b860a417c0528492a6bc21f1aaefab25 \
-    --hash=sha256:2081580ebb843f759b9f617314a24ed5738c51d2aee65d31e02f6f7a2b97707a \
-    --hash=sha256:21d1152871b019407d8ac3985f6775c079416c282e431a4da6afe7aefd2bccbe \
-    --hash=sha256:24b6f81f1983e6df8db3adc38562c83f7d4a0c36162885ec7f7b77c7dcbec97b \
-    --hash=sha256:256f80b80ca3853f90c21b23ee78cd008713787b1b1e93eae9f3d6a7134abd91 \
-    --hash=sha256:28a3a209b96630bca57cce802da70c266eb08c6e97e5afd61a75611ee6c64592 \
-    --hash=sha256:2c8f814d84194c9ea681642fd164267891702542f028a15fc97d4674b6206187 \
-    --hash=sha256:2de9a304e27f7596cd03d16f1b7c72219bd944e99cc52b84d0145aefb07cbd3c \
-    --hash=sha256:38100abb9d1b1435bc4cc340bb4489635dc2f0da7456590877030c9b3d40b0c1 \
-    --hash=sha256:3925dd22fa2b7699ed2617149842d2e6adde22b262fcbfada50e3d195e4b3a94 \
-    --hash=sha256:3e17ed538242334bf70832644a32a7aae3d83b57567f9fd60a26257e992b79ba \
-    --hash=sha256:3e837e369566884707ddaf85fc1744b47575005c0a229de3327f8f9a20f4efeb \
-    --hash=sha256:3f4d46d8b35698056ec29bca21546e1551a205058ae1a181d871e278b0b28165 \
-    --hash=sha256:44d1b5909021139fe36001ae048dbdde8214afa20200eda0f64c068cac5d5529 \
-    --hash=sha256:45d5e886156860dc35862657e1494b9bae8dfa63bf56796f2fb56e1679fc0bca \
-    --hash=sha256:4647afc2f90d1ddd33441e5b0e85b16b12ddec4fca55f0d9671fef036ecca27c \
-    --hash=sha256:4671d9dd5ec934cb9a73e7ee9676f9362aba54f7f34910956b84d727b0d73fb6 \
-    --hash=sha256:53f77cbe57044e88bbd5ed26ac1d0514d2acf0591dd6bb02a3ae37f76811b80c \
-    --hash=sha256:5eda85d6d1879e692d546a078b44251cdd08dd1cfb98dfb77b670c97cee49ea0 \
-    --hash=sha256:5fed36fccc0612a53f1d4d9a816b50a36702c28a2aa880cb8a122b3466638743 \
-    --hash=sha256:61d028e90346df14fedc3d1e5441df818d095f3b87d286825dfcbd6459b7ef63 \
-    --hash=sha256:66f011380d0e49ed280c789fbd08ff0d40968ee7b665575489afa95c98196ab5 \
-    --hash=sha256:6824f87845e3396029f3820c206e459ccc91760e8fa24422f8b0c3d1731cbec5 \
-    --hash=sha256:6c6c373cfc5c83a975506110d17457138c8c63016b563cc9ed6e056a82f13ce4 \
-    --hash=sha256:6d02d6655b0e54f54c4ef0b94eb6be0607b70853c45ce98bd278dc7de718be5d \
-    --hash=sha256:6d50360be4546678fc1b79ffe7a66265e28667840010348dd69a314145807a1b \
-    --hash=sha256:730cacb21e1bdff3ce90babf007d0a0917cc3e6492f336c2f0134101e0944f93 \
-    --hash=sha256:737fe7d37e1a1bffe70bd5754ea763a62a066dc5913ca57e957824b72a85e205 \
-    --hash=sha256:74a03b9698e198d47562765773b4a8309919089150a0bb17d829ad7b44b60d27 \
-    --hash=sha256:7553fb2090d71822f02c629afe6042c299edf91ba1bf94951165613553984512 \
-    --hash=sha256:7a66c7204d8869299919db4d5069a82f1561581af12b11b3c9f48c584eb8743d \
-    --hash=sha256:7cc09976e8b56f8cebd752f7113ad07752461f48a58cbba644139015ac24954c \
-    --hash=sha256:81afed14892743bbe14dacb9e36d9e0e504cd204e0b165062c488942b9718037 \
-    --hash=sha256:8941aaadaf67246224cee8c3803777eed332a19d909b47e29c9842ef1e79ac26 \
-    --hash=sha256:89472c9762729b5ae1ad974b777416bfda4ac5642423fa93bd57a09204712322 \
-    --hash=sha256:8ea985900c5c95ce9db1745f7933eeef5d314f0565b27625d9a10ec9881e1bfb \
-    --hash=sha256:8eca2a813c1cb7ad4fb74d368c2ffbbb4789d377ee5bb8df98373c2cc0dee76c \
-    --hash=sha256:92b68146a71df78564e4ef48af17551a5ddd142e5190cdf2c5624d0c3ff5b2e8 \
-    --hash=sha256:9332088d75dc3241c702d852d4671613136d90fa6881da7d770a483fd05248b4 \
-    --hash=sha256:94698a9c5f91f9d138526b48fe26a199609544591f859c870d477351dc7b2414 \
-    --hash=sha256:9a67fc9e8eb39039280526379fb3a70023d77caec1852002b4da7e8b270c4dd9 \
-    --hash=sha256:9de40a7b0323d889cf8d23d1ef214f565ab154443c42737dfe52ff82cf857664 \
-    --hash=sha256:a05d0c237b3349096d3981b727493e22147f934b20f6f125a3eba8f994bec4a9 \
-    --hash=sha256:afb8db5439b81cf9c9d0c80404b60c3cc9c3add93e114dcae767f1477cb53775 \
-    --hash=sha256:b18a3ed7d5b3bd8d9ef7a8cb226502c6bf8308df1525e1cc676c3680e7176739 \
-    --hash=sha256:b1e74d11748e7e98e2f426ab176d4ed720a64412b6a15054378afdb71e0f37dc \
-    --hash=sha256:b21e08af67b8a103c71a250401c78d5e0893beff75e28c53c98f4de42f774062 \
-    --hash=sha256:b4c854ef3adc177950a8dfc81a86f5115d2abd545751a304c5bcf2c2c7283cfe \
-    --hash=sha256:b882b3df248017dba09d6b16defe9b5c407fe32fc7c65a9c69798e6175601be9 \
-    --hash=sha256:baf5215e0ab74c16e2dd324e8ec067ef59e41125d3eade2b863d294fd5035c92 \
-    --hash=sha256:c649e3a33450ec82378822b3dad03cc228b8f5963c0c12fc3b1e0ab940f768a5 \
-    --hash=sha256:c654de545946e0db659b3400168c9ad31b5d29593291482c43e3564effbcee13 \
-    --hash=sha256:c6638687455baf640e37344fe26d37c404db8b80d037c3d29f58fe8d1c3b194d \
-    --hash=sha256:c8d3b5532fc71b7a77c09192b4a5a200ea992702734a2e9279a37f2478236f26 \
-    --hash=sha256:cb527a79772e5ef98fb1d700678fe031e353e765d1ca2d409c92263c6d43e09f \
-    --hash=sha256:cf364028c016c03078a23b503f02058f1814320a56ad535686f90565636a9495 \
-    --hash=sha256:d48a880098c96020b02d5a1f7d9251308510ce8858940e6fa99ece33f610838b \
-    --hash=sha256:d68b6cef7827e8641e8ef16f4494edda8b36104d79773a334beaa1e3521430f6 \
-    --hash=sha256:d9b29c1f0ae438d5ee9acb31cadee00a58c46cc9c0b2f9038c6b0b3470877a8c \
-    --hash=sha256:d9b97165e8aed9272a6bb17c01e3cc5871a594a446ebedc996e2397a1c1ea8ef \
-    --hash=sha256:da68248800ad6320861f129cd9c1bf96ca849a2771a59e0344e88681905916f5 \
-    --hash=sha256:da902562c3e9c550df360bfa53c035b2f241fed6d9aef119048073680ace4a18 \
-    --hash=sha256:dbd5c7a25a7cb98f5ca55d258b103a2054f859a46ae11aaf23134f9cc0d356ad \
-    --hash=sha256:dd4f05f54a52fb558f1ba9f528228066954fee3ebe629fc1660d874d040ae5a3 \
-    --hash=sha256:de8dad4425a6ca6e4e5e297b27b5c824ecc7581910bf9aee86cb6835e6812aa7 \
-    --hash=sha256:e11e82b744887154b182fd3e7e8512418446501191994dbf9c9fc1f32cc8efd5 \
-    --hash=sha256:e6e73b9e02893c764e7e8d5bb5ce277f1a009cd5243f8228f75f842bf937c534 \
-    --hash=sha256:f73b96c41e3b2adedc34a7356e64c8eb96e03a3782b535e043a986276ce12a49 \
-    --hash=sha256:f93fd8e5c8c0a4aa1f424d6173f14a892044054871c771f8566e4008eaa359d2 \
-    --hash=sha256:fc33c5141b55ed366cfaad382df24fe7dcbc686de5be719b207bb248e3053dc5 \
-    --hash=sha256:fc7de24befaeae77ba923797c7c87834c73648a05a4bde34b3b7e5588973a453 \
-    --hash=sha256:fe562eb1a64e67dd297ccc4f5addea2501664954f2692b69a76449ec7913ecbf
+cffi==2.1.0 \
+    --hash=sha256:02cb7ff33ded4f1532476731f89ede53e2e488a8e6205515a82144246ffa7dcc \
+    --hash=sha256:03e9810d18c646077e501f661b682fbf5dee4676048527ca3cffe66faa9960dd \
+    --hash=sha256:0520e1f4c35f44e209cbbb421b67eec42e6a157f59444dfb6058874ff3610e5d \
+    --hash=sha256:0582a58f3051372229ca8e7f5f589f9e5632678208d8636fea3676711fdf7fe5 \
+    --hash=sha256:0611e7ebf90573a535ebdc33ae9da222d037853983e13359f580fab781ca017f \
+    --hash=sha256:0a42c688d19fca6e095a53c6a6e2295a5b050a8b289f109adab02a9e61a25de6 \
+    --hash=sha256:0a96b74cda968eebbad56d973efe5098974f0a9fb323865bf99ea1fd24e3e64c \
+    --hash=sha256:10537b1df4967ca26d21e5072d7d54188354483b91dc75058968d3f0cf13fbda \
+    --hash=sha256:11b3fb55f4f8ad92274ed26705f65d8f91457de71f5380061eb6d125a768fecd \
+    --hash=sha256:15faec4adfff450819f3aee0e2e02c812de6edb88203aa58807955db2003472a \
+    --hash=sha256:164bff1657b2a74f0b6d54e11c9b375bc97b931f2ca9c43fcf875838da1570dd \
+    --hash=sha256:1854b724d00f6654c742097d5387569021be12d3a0f770eae1df8f8acfcc6acd \
+    --hash=sha256:19c54ac121cad98450b4896fa9a43ee0180d57bc4bc911a33db6cab1efab6cd3 \
+    --hash=sha256:1b96bfe2c4bd825681b7d311ad6d9b7280a091f43e8f63da5729638083cd3bfb \
+    --hash=sha256:1e9f50d192a3e525b15a75ab5114e442d83d657b7ec29182a991bc9a88fd3a66 \
+    --hash=sha256:1ff3456eab0d889592d1936d6125bbfbc7ae4d3354a700f8bd80450a66445d4d \
+    --hash=sha256:2282cd5e38aa8accd03e99d1256af8411c84cdbee6a89d841b563fdbd1f3e50f \
+    --hash=sha256:276f20fffd7b396e12516ba8edf9509210ac248cbbc5acbc39cd512f9f59ebe6 \
+    --hash=sha256:2b71d409cccee78310ab5dec549aed052aaea483346e282c7b02362596e01bb0 \
+    --hash=sha256:2e9dabb9abcb7ad15938c7196ad5c1718a4e6d33cc79b4c0209bdb64c4a54a5c \
+    --hash=sha256:30b65779d598c370374fefabf138d456fd6f3216bfa7bedfab1ba82025b0cd93 \
+    --hash=sha256:33eb1ad83ebe8f313e0df035c406227d55a79456704a863fad9842136af5ad7d \
+    --hash=sha256:35aaea0c7ee0e58a5cd8c2fd1a48fdf7ece0d2699b7ecdda08194e9ce5dd9b3d \
+    --hash=sha256:3681e031db29958a7502f5c0c9d6bbc4c36cb20f7b104086fa642d1799631ff8 \
+    --hash=sha256:379de10ce1ba048b1448599d1b37b24caee16309d1ac98d3982fc997f768700b \
+    --hash=sha256:37f525a7e7e50c017fdebe58b787be310ad59357ae43a053943a6e1a6c526001 \
+    --hash=sha256:3b926723c13eba9f81d2ef3820d63aeceec3b2d4639906047bf675cb8a7a500d \
+    --hash=sha256:3d7f118b5adbfdfead90c25822690b02bc8074fba949bb7858bec4ebd55adb43 \
+    --hash=sha256:46b1c8db8f6122420f32d02fffb924c2fe9bc772d228c7c711748fff56aabb2b \
+    --hash=sha256:47ff3a8bfd8cb9da1af7524b965127095055654c177fcfc7578debcb015eecd0 \
+    --hash=sha256:4d433a51f1870e43a13b6732f92aaf540ff77c2015097c78556f75a2d6c030e0 \
+    --hash=sha256:4f26194e3d95e06501b942642855aed4f953d55e95d7d01b7c4483db3ecff458 \
+    --hash=sha256:510aeeeac94811b138077451da1fb18b308a5feab47dd2b603af55804155e1c8 \
+    --hash=sha256:5972433ad71a9e46516584ef60a0fda12d9dc459938d1539c3ddecf9bdc1368d \
+    --hash=sha256:5ecbd0499275d57506d397eebe1981cee87b47fcd9ef5c22cab7ed7644a39a94 \
+    --hash=sha256:6274dcb2d15cef48daa73ed1be5a40d501d74dccd0cd6db364776d12cb6ba022 \
+    --hash=sha256:63960549e4f8dc41e31accb97b975abaecfc44c03e396c093a6436763c2ea7db \
+    --hash=sha256:64c753a0f87a256020004f37a1c8c02c480e725f910f0b2a0f3f07debd1b2479 \
+    --hash=sha256:6af371f3767faeffc6ac1ef57cdfd25844403e9d3f476c5537caee499de96376 \
+    --hash=sha256:6ca4919c6e4f89aa99c42510b42cf54596892c00b3f9077f6bdd1505e24b9c8d \
+    --hash=sha256:6d194185eabd279f1c05ebe3504265ddfc5ad2b58d0714f7db9f01da592e9eb6 \
+    --hash=sha256:702c436735fbe99d59ada02a1f65cfc0d31c0ee8b7290912f8fbc5cd1e4b16c3 \
+    --hash=sha256:716ff8ec22f20b4d988b12884086bcef0fc99737043e503f7a3935a6be99b1ea \
+    --hash=sha256:762f99479dcb369f60ab9017ad4ab97a36a1dd7c1ee5a3b15db0f4b8659120cd \
+    --hash=sha256:7762faa47e8ff7eb80bd261d9a7d8eea2d8baa69de5e95b70c1f338bbe712f02 \
+    --hash=sha256:78474632761faa0fb96f30b1c928c84ebcf68713cbb80d15bab09dfe61640fde \
+    --hash=sha256:799416bae98336e400981ff6e532d67d5c709cfb30afb79865a1315f94b0e224 \
+    --hash=sha256:7d034dcffa09e9a46c93fa3a3be402096cb5354ac6e41ab8e5cc9cd8b642ad76 \
+    --hash=sha256:7d28dff1db6764108bc30788d85d61c876beff416d9a49cb9dd7c5a9f34f5804 \
+    --hash=sha256:7d3538f9c0e50670f4deb93dbb696576e60590369cae2faf7de681e597a8a1f1 \
+    --hash=sha256:7d5980a3433d4b71a5e120f9dd551403d7824e31e2e67124fe2769c404c06913 \
+    --hash=sha256:7ea6b3e2c4250ff1de21c630fe72d0f63eb95c2c32ffbf64a358cf4a8836d714 \
+    --hash=sha256:86cf8755a791f72c85dc287128cc62d4f24d392e3f1e15837245623f4a33cccc \
+    --hash=sha256:88023dfe18799507b73f1dbb0d14326a17465de1bc9c9c7655c22845e9ddc3a2 \
+    --hash=sha256:89095c1968b4ba8285840e131bf2891b09ae137fe2146905acae0354fbce1b5e \
+    --hash=sha256:8d35c139744adb3e727cd51b1a18324bbe44b8bd41bf8322bca4d41289f48eda \
+    --hash=sha256:8e74a6135550c4748af665b1b1118b6aab33b1fc6a16f9aff630af107c3b4512 \
+    --hash=sha256:8f9ec95b8a043d3dfbc74d9abc6f7baf524dd27a8dc160b0a32ff9cdab650c28 \
+    --hash=sha256:90bec57cf82089383bd06a605b3eb8daebf7e5a668520beaf6e327a83a947699 \
+    --hash=sha256:95f2954c2c9473d892eca6e0409f3568b37ab62a8eedb122461f73cc273476e3 \
+    --hash=sha256:961be50688f7fba2fa65f63712d3b9b341a22311f5253460ce933f52f0de1c8c \
+    --hash=sha256:98fff996e983a36d3aa2eca83af40c5821202e7e6f32d13ae94e3d2286f10cfe \
+    --hash=sha256:9b8f0f26ca4e7513c534d351eca551947d053fac438f2a04ac96d882909b0d3a \
+    --hash=sha256:9d72af0cf10a76a600a9690078fe31c63b9588c8e86bf9fd353f713c84b5db0f \
+    --hash=sha256:9d8272c0e483b024e1b9ad029821470ed8ec65631dbd90217469da0e7cd89f1c \
+    --hash=sha256:a016194dbe13d14ee9556e734b772d8d67b947092b268d757fd4290e3ba2dfc2 \
+    --hash=sha256:a5781494d4d400a3f47f8f1da94b324f6e6b440a53387774002890a2a2f4b50f \
+    --hash=sha256:a95b05f9baf29b91171b3a8bd2020b028835243e7b0ff6bb23e2a3c228518b1b \
+    --hash=sha256:aa7a1b53a2a4452ada2d1b5dade9960b2522f1e61293a811a077439e39029565 \
+    --hash=sha256:ac0f1a2d0cfa7eea3f2aaf006ab6e70e8feeb16b75d65b7e5939982ca2f11056 \
+    --hash=sha256:af5e2915d41fe6c961694d7bfdc8562942638200f3ce2765dfb8b745cf997629 \
+    --hash=sha256:b6422532152adf4e59b110cb2808cee7a033800952f5c036b4af047ee43199e7 \
+    --hash=sha256:b65f590ef2a44640f9a05dbb548a429b4ade77913ce683ac8b1480777658a6c0 \
+    --hash=sha256:ba00f661f8ba35d075c937174e27c2c421cec3942fd2e0ea3e66996757c0fdd9 \
+    --hash=sha256:bccbbb5ee76a61f9d99b5bf3846a51d7fca4b6a732fe46f89295610edaf41853 \
+    --hash=sha256:bf01d8c84cbea96b944c73b22182e6c7c432b3475632b8111dbfdc95ddad6e13 \
+    --hash=sha256:bf5c6cf48238b0eb4c086978c492ad1cbc22373fc5b2d7353b3a598ce6db887a \
+    --hash=sha256:c16914df9fb7f500e440e6875fa23ff5e0b31db01fa9c06af98d59a91f0dc2e4 \
+    --hash=sha256:c351efb95e832a853a29361675f33a7ce53de1a109cd73fd47af0712213aa4ce \
+    --hash=sha256:c4165821e131d6d4ca444347c2b694e2311bcfa3fe5a861cc72968f28867beac \
+    --hash=sha256:c5f5df567f6eb216de69be06ce55c8b714090fae02b18a3b40da8163b8c5fa9c \
+    --hash=sha256:c941bb58d5a6e1c3892d86e42927ed6c180302f07e6d395d08c416e594b98b46 \
+    --hash=sha256:c97f080ea627e2863524c5af3836e2270b5f5dfff1f104392b959f8df0c5d384 \
+    --hash=sha256:cb96698e3c7413d906ce83f8ffd245ec1bd94707541f299d0ce4d6b0193e982b \
+    --hash=sha256:cbb7640ce37159548d2147b5b8c241f962143d4c71231431820783f4dc78f210 \
+    --hash=sha256:cdf2448aab5f661c9315308ec8b93f4e8a1a67a3c733f8631067a2b67d5913dc \
+    --hash=sha256:d2117334c3af3bdcb9a88522b844a2bdb5efdc4f71c6c822df55486ae1c3347a \
+    --hash=sha256:d53d10f7da99ae46f7373b9150393e9c5eab9b224909982b43832668de4779f5 \
+    --hash=sha256:d9fafc5aa2e2a39aaf7f8cc0c1f044a9b07fca12e558dca53a3cc5c654ad67a7 \
+    --hash=sha256:db3eb7d46527159a878ec3460e9d40615bc25ba337d477db681aea6e4f05c5d2 \
+    --hash=sha256:dbf7c7a88e2bac086f06d14577332760bdeecc42bdec8ac4077f6260557d9326 \
+    --hash=sha256:df2b82571a1b30f58a87bf4e5a9e78d2b1eff6c6ce8fd3aa3757221f93f0863f \
+    --hash=sha256:df92f2aba50eb4d96718b68ef76f2e57a57b54f2fa62333496d16c6d585a85ca \
+    --hash=sha256:eb4e8997a49aa2c08a3e43c9045d224448b8941d88e7ac163c7d383e560cbf98 \
+    --hash=sha256:efc1cdd798b1aaf39b4610bba7aad28c9bea9b910f25c784ccf9ec1fa719d1f9 \
+    --hash=sha256:f146d154428a2523f9cc7936c02353c2459b8f6cf07d3cd1ee1c0a611109c5d5 \
+    --hash=sha256:f5bce581e6b8c235e566a14768a943b172ada3ed73537bb0c0be1edee312d4e7 \
+    --hash=sha256:f9912624a0c0b834b7520d7769b3644453aabc0a7e1c839da7359f050750e9bc \
+    --hash=sha256:fb62edb5bb52cca65fab91a63afa7561607120d26090a7e8fda6fb9f064726da \
+    --hash=sha256:ff067a8d8d880e7809e4ac88eb009bb848870115317b306666502ccad30b147f
     # via weasyprint
 cfgv==3.5.0 \
     --hash=sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0 \
@@ -105,67 +120,67 @@ cssselect2==0.9.0 \
     --hash=sha256:6a99e5f91f9a016a304dd929b0966ca464bcfda15177b6fb4a118fc0fb5d9563 \
     --hash=sha256:759aa22c216326356f65e62e791d66160a0f9c91d1424e8d8adc5e74dddfc6fb
     # via weasyprint
-distlib==0.4.0 \
-    --hash=sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16 \
-    --hash=sha256:feec40075be03a04501a973d81f633735b4b69f98b05450592310c0f401a4e0d
+distlib==0.4.3 \
+    --hash=sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b \
+    --hash=sha256:f152097224a0ae24be5a0f6bae1b9359af82133bce63f98a95f86cae1aede9ed
     # via virtualenv
-filelock==3.29.0 \
-    --hash=sha256:69974355e960702e789734cb4871f884ea6fe50bd8404051a3530bc07809cf90 \
-    --hash=sha256:96f5f6344709aa1572bbf631c640e4ebeeb519e08da902c39a001882f30ac258
+filelock==3.30.0 \
+    --hash=sha256:1774e682dbe443bd60f9609162fc596e2c80dc84ffc2957068953406d0520090 \
+    --hash=sha256:40632998f0772e64183bb819f086a1b9def6be1090cf1dcb9d45f46806ef279b
     # via
     #   python-discovery
     #   virtualenv
-fonttools==4.62.1 \
-    --hash=sha256:0aa72c43a601cfa9273bb1ae0518f1acadc01ee181a6fc60cd758d7fdadffc04 \
-    --hash=sha256:0b3ae47e8636156a9accff64c02c0924cbebad62854c4a6dbdc110cd5b4b341a \
-    --hash=sha256:12859ff0b47dd20f110804c3e0d0970f7b832f561630cd879969011541a464a9 \
-    --hash=sha256:149f7d84afca659d1a97e39a4778794a2f83bf344c5ee5134e09995086cc2392 \
-    --hash=sha256:1596aeaddf7f78e21e68293c011316a25267b3effdaccaf4d59bc9159d681b82 \
-    --hash=sha256:19177c8d96c7c36359266e571c5173bcee9157b59cfc8cb0153c5673dc5a3a7d \
-    --hash=sha256:1c5c25671ce8805e0d080e2ffdeca7f1e86778c5cbfbeae86d7f866d8830517b \
-    --hash=sha256:1eecc128c86c552fb963fe846ca4e011b1be053728f798185a1687502f6d398e \
-    --hash=sha256:268abb1cb221e66c014acc234e872b7870d8b5d4657a83a8f4205094c32d2416 \
-    --hash=sha256:2d850f66830a27b0d498ee05adb13a3781637b1826982cd7e2b3789ef0cc71ae \
-    --hash=sha256:2e7abd2b1e11736f58c1de27819e1955a53267c21732e78243fa2fa2e5c1e069 \
-    --hash=sha256:403d28ce06ebfc547fbcb0cb8b7f7cc2f7a2d3e1a67ba9a34b14632df9e080f9 \
-    --hash=sha256:40975849bac44fb0b9253d77420c6d8b523ac4dcdcefeff6e4d706838a5b80f7 \
-    --hash=sha256:486f32c8047ccd05652aba17e4a8819a3a9d78570eb8a0e3b4503142947880ed \
-    --hash=sha256:49a445d2f544ce4a69338694cad575ba97b9a75fff02720da0882d1a73f12800 \
-    --hash=sha256:59b372b4f0e113d3746b88985f1c796e7bf830dd54b28374cd85c2b8acd7583e \
-    --hash=sha256:5a648bde915fba9da05ae98856987ca91ba832949a9e2888b48c47ef8b96c5a9 \
-    --hash=sha256:5f37df1cac61d906e7b836abe356bc2f34c99d4477467755c216b72aa3dc748b \
-    --hash=sha256:6706d1cb1d5e6251a97ad3c1b9347505c5615c112e66047abbef0f8545fa30d1 \
-    --hash=sha256:68959f5fc58ed4599b44aad161c2837477d7f35f5f79402d97439974faebfebe \
-    --hash=sha256:6acb4109f8bee00fec985c8c7afb02299e35e9c94b57287f3ea542f28bd0b0a7 \
-    --hash=sha256:7487782e2113861f4ddcc07c3436450659e3caa5e470b27dc2177cade2d8e7fd \
-    --hash=sha256:7aa21ff53e28a9c2157acbc44e5b401149d3c9178107130e82d74ceb500e5056 \
-    --hash=sha256:7bca7a1c1faf235ffe25d4f2e555246b4750220b38de8261d94ebc5ce8a23c23 \
-    --hash=sha256:8d337fdd49a79b0d51c4da87bc38169d21c3abbf0c1aa9367eff5c6656fb6dae \
-    --hash=sha256:8f8fca95d3bb3208f59626a4b0ea6e526ee51f5a8ad5d91821c165903e8d9260 \
-    --hash=sha256:90365821debbd7db678809c7491ca4acd1e0779b9624cdc6ddaf1f31992bf974 \
-    --hash=sha256:92bb00a947e666169c99b43753c4305fc95a890a60ef3aeb2a6963e07902cc87 \
-    --hash=sha256:93c316e0f5301b2adbe6a5f658634307c096fd5aae60a5b3412e4f3e1728ab24 \
-    --hash=sha256:942b03094d7edbb99bdf1ae7e9090898cad7bf9030b3d21f33d7072dbcb51a53 \
-    --hash=sha256:9c125ffa00c3d9003cdaaf7f2c79e6e535628093e14b5de1dccb08859b680936 \
-    --hash=sha256:9dde91633f77fa576879a0c76b1d89de373cae751a98ddf0109d54e173b40f14 \
-    --hash=sha256:9e7863e10b3de72376280b515d35b14f5eeed639d1aa7824f4cf06779ec65e42 \
-    --hash=sha256:a24decd24d60744ee8b4679d38e88b8303d86772053afc29b19d23bb8207803c \
-    --hash=sha256:a5d8825e1140f04e6c99bb7d37a9e31c172f3bc208afbe02175339e699c710e1 \
-    --hash=sha256:aa69d10ed420d8121118e628ad47d86e4caa79ba37f968597b958f6cceab7eca \
-    --hash=sha256:ad5cca75776cd453b1b035b530e943334957ae152a36a88a320e779d61fc980c \
-    --hash=sha256:b4e0fcf265ad26e487c56cb12a42dffe7162de708762db951e1b3f755319507d \
-    --hash=sha256:b820fcb92d4655513d8402d5b219f94481c4443d825b4372c75a2072aa4b357a \
-    --hash=sha256:bd13b7999d59c5eb1c2b442eb2d0c427cb517a0b7a1f5798fc5c9e003f5ff782 \
-    --hash=sha256:bdfe592802ef939a0e33106ea4a318eeb17822c7ee168c290273cbd5fabd746c \
-    --hash=sha256:c05557a78f8fa514da0f869556eeda40887a8abc77c76ee3f74cf241778afd5a \
-    --hash=sha256:c22b1014017111c401469e3acc5433e6acf6ebcc6aa9efb538a533c800971c79 \
-    --hash=sha256:c9b9e288b4da2f64fd6180644221749de651703e8d0c16bd4b719533a3a7d6e3 \
-    --hash=sha256:d241cdc4a67b5431c6d7f115fdf63335222414995e3a1df1a41e1182acd4bcc7 \
-    --hash=sha256:e54c75fd6041f1122476776880f7c3c3295ffa31962dc6ebe2543c00dca58b5d \
-    --hash=sha256:e8514f4924375f77084e81467e63238b095abda5107620f49421c368a6017ed2 \
-    --hash=sha256:ee91628c08e76f77b533d65feb3fbe6d9dad699f95be51cf0d022db94089cdc4 \
-    --hash=sha256:ef46db46c9447103b8f3ff91e8ba009d5fe181b1920a83757a5762551e32bb68 \
-    --hash=sha256:fa1d16210b6b10a826d71bed68dd9ec24a9e218d5a5e2797f37c573e7ec215ca
+fonttools==4.63.0 \
+    --hash=sha256:032038247a96c1690f9f31e377c389383c902531b085aa4e4dabd6f57f870e69 \
+    --hash=sha256:063e08bd17bd5a90127a14123de0d6a952dbc847695fd98b63c043d58057f90c \
+    --hash=sha256:0c18358a155d75034911c5ee397a5b44cd19dd325dbb8b35fb60bf421d6a72ac \
+    --hash=sha256:0eac00b9118c3c2f87d272e45341871c5b3066baa3c86897fa634a7c3fb59096 \
+    --hash=sha256:1e874792a8212b44583ea02189d9e693906b2f78b261f372f95d6c563210ac1d \
+    --hash=sha256:22135da48a348785c5e2d5d2d9d6bec5ed44adacbaeb9db12d9493bf6c6bfa68 \
+    --hash=sha256:22693918177bd9ceabec4736d338045f357769416fc6b0b2508eefef75b08616 \
+    --hash=sha256:27fdc65af8da6f88b9c6121c47a464cbe359fcfff7ff6fc2d37a1f395d755b78 \
+    --hash=sha256:2b8ae05d9eacf6081414d759c0a352769ac28ce31280d6bb8e77b03f9e3c449f \
+    --hash=sha256:2c14b4fd138c4bafcca294765c547914e1aa431ae1ca94ab99d8db08c958bd3b \
+    --hash=sha256:308f957cdeaf8abe4e5f2f124902ef405448af92c90f80e302a3b771c2e6116b \
+    --hash=sha256:37dd23e621e3b0aef1baa70a303b80aaf38449632cfc8fd2a55fb285bbccfc02 \
+    --hash=sha256:445af2eab030a16b9171ea8bdda7ebf7d96bda2df88ee182a464252f6e05e20d \
+    --hash=sha256:51394295f1a51de8b5f30bdb1e1b9a4231536c7064ef5c6e211eec19fa36036f \
+    --hash=sha256:58dc6bb86a78d782f00f9190ca02c119cf5bbe2807536e361e18d42019f877d8 \
+    --hash=sha256:59ac449f8cca9b4ffa08d2e7bbadad87ce710d69d1eda5c3c1ce579baa987272 \
+    --hash=sha256:6b2248c5decb223562f7902ff6325077a073f608ee8e33e88ad88db734eb9f49 \
+    --hash=sha256:6d4741eb179121cab9eea4cb2393d24492373a260d7945006358c08cfbf45419 \
+    --hash=sha256:6db5140a60a5d731d21ec076745b40a310607731b0a565b50776393188649001 \
+    --hash=sha256:6e528da43bc3791085f8cb6141b1d13e459226790240340fcbb4625649238b03 \
+    --hash=sha256:796f27556dbe094c4824f75ca85267e4df776c79036c8441469a4df37038c196 \
+    --hash=sha256:79cdc9f567aec74a72918fd060283911406750cbc9fd28c1316023deb6ce31a9 \
+    --hash=sha256:7d76edbff9014094dbf03bd2d074709dfa6ec7aba13d838c937a2b33d2d6a86e \
+    --hash=sha256:7d782fac32985914c351556f68ac0855391572bcd87de50e05970d3cd4c96fc5 \
+    --hash=sha256:7dd683fef0663e9f0f45cf541d788d24caa3ec9db50796b588e1757d8b3bc007 \
+    --hash=sha256:85be818f5506e8a7753153def2c9550178f0ecae6a47b5e0e8dbb23f7cc90380 \
+    --hash=sha256:948428a275741f0b64b113c955425a953314f4b9ab9997f73a72c83e68e569c8 \
+    --hash=sha256:9ced0bd02ac751dd6319b0da88aaef24414e3b0dbc32bb4f24944821a3741a27 \
+    --hash=sha256:9e12f105d2b6342c559c298afb674006bb2893afc7102dcf8a1b55b0486b4e40 \
+    --hash=sha256:a8b33a82979e0a6a34ff435cc81317be1f95ec1ebb7a3a2d1c8a6a54f02ae44e \
+    --hash=sha256:a9faff9e0c1f76f9fd55899d2ce785832efebab37eb8ae13995853aef178bef0 \
+    --hash=sha256:af2fd1664d00a397d75f806985ddb36282091c2131a73a6485c23b4a34722263 \
+    --hash=sha256:afefc1ed0a59785a7fb06ea7e1678e849c193e1e387db783579bc7b3056fcfcb \
+    --hash=sha256:b1cd75a03ad8cb5bc40c90bfde68c0c47de423aa19e5c0f362b43520645eea94 \
+    --hash=sha256:ba04cb5891d4c0c21b6da95eda8d7b090021508a294fff33464fc7d241e0856b \
+    --hash=sha256:bf00f21eb5fb721dbaf73d1e9da6d02a1af7768f2ebcf9798be98beab8ba90f6 \
+    --hash=sha256:c0425b277a59cff3d80ca42162a8de360f318438a2ac83570842a678d826d579 \
+    --hash=sha256:c1aaa4b9c75798400ac043ce04d74e7830376c85095a5a6ed7cba2f17a266bf4 \
+    --hash=sha256:c2a2a42198b696a6f48fad91709afb55176e66a5e566131219dba372fb7f8c59 \
+    --hash=sha256:caeb583deeb5168e694b65cda8b4ee62abedfa66cf88488734466f2366b9c4e0 \
+    --hash=sha256:cb014d58140a38135f16064c74c652ed57aa0b75cbf8bb59cac821f7edb5334e \
+    --hash=sha256:ccf41f2efdf56994d22d73bef4ced1052161958169428d06ba9724ea9e9a64be \
+    --hash=sha256:cd7e9857e5e63738b9d9fd707bc1f59c8b09e5177726d23664db393c59bb08bd \
+    --hash=sha256:d76ac49f929aecaf82d83250b8347e099d7aecba0f4726c1d9b6df3b8bb5fe18 \
+    --hash=sha256:d7e5c9973aa04c95650c96e5f5ad865fbf42d62079163ecfab1e01cbc2504c22 \
+    --hash=sha256:dcf076a4474fe0d7367e5bbf5b052c7284fa1feca729c04176ce513521afd8a0 \
+    --hash=sha256:e3297a6a4059b4acc3a1e9a8b04741f240a80044eef08ebd32e8b5bcdddce75b \
+    --hash=sha256:ee08ebfa58f6e1aeff5697ab9582105bb620008c1caafb681e4c557e7483027b \
+    --hash=sha256:ef3048ef05dbb552b89817713d9cac912e00d0fde4a3105c00d29e52e10c89af \
+    --hash=sha256:fd1e3094f42d806d3d7c79162fc59e5910fcbe3a7360c385b8da969bc4493745
     # via weasyprint
 identify==2.6.19 \
     --hash=sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a \
@@ -175,193 +190,190 @@ nodeenv==1.10.0 \
     --hash=sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827 \
     --hash=sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb
     # via pre-commit
-numpy==2.4.4 \
-    --hash=sha256:07077278157d02f65c43b1b26a3886bce886f95d20aabd11f87932750dfb14ed \
-    --hash=sha256:08f2e31ed5e6f04b118e49821397f12767934cfdd12a1ce86a058f91e004ee50 \
-    --hash=sha256:0aec54fd785890ecca25a6003fd9a5aed47ad607bbac5cd64f836ad8666f4959 \
-    --hash=sha256:0d35aea54ad1d420c812bfa0385c71cd7cc5bcf7c65fed95fc2cd02fe8c79827 \
-    --hash=sha256:0d4e437e295f18ec29bc79daf55e8a47a9113df44d66f702f02a293d93a2d6dd \
-    --hash=sha256:0dfd3f9d3adbe2920b68b5cd3d51444e13a10792ec7154cd0a2f6e74d4ab3233 \
-    --hash=sha256:1378871da56ca8943c2ba674530924bb8ca40cd228358a3b5f302ad60cf875fc \
-    --hash=sha256:15716cfef24d3a9762e3acdf87e27f58dc823d1348f765bbea6bef8c639bfa1b \
-    --hash=sha256:19710a9ca9992d7174e9c52f643d4272dcd1558c5f7af7f6f8190f633bd651a7 \
-    --hash=sha256:23cbfd4c17357c81021f21540da84ee282b9c8fba38a03b7b9d09ba6b951421e \
-    --hash=sha256:2483e4584a1cb3092da4470b38866634bafb223cbcd551ee047633fd2584599a \
-    --hash=sha256:27a8d92cd10f1382a67d7cf4db7ce18341b66438bdd9f691d7b0e48d104c2a9d \
-    --hash=sha256:28a650663f7314afc3e6ec620f44f333c386aad9f6fc472030865dc0ebb26ee3 \
-    --hash=sha256:2aa0613a5177c264ff5921051a5719d20095ea586ca88cc802c5c218d1c67d3e \
-    --hash=sha256:2c194dd721e54ecad9ad387c1d35e63dce5c4450c6dc7dd5611283dda239aabb \
-    --hash=sha256:2d19e6e2095506d1736b7d80595e0f252d76b89f5e715c35e06e937679ea7d7a \
-    --hash=sha256:2d390634c5182175533585cc89f3608a4682ccb173cc9bb940b2881c8d6f8fa0 \
-    --hash=sha256:30caa73029a225b2d40d9fae193e008e24b2026b7ee1a867b7ee8d96ca1a448e \
-    --hash=sha256:42c16925aa5a02362f986765f9ebabf20de75cdefdca827d14315c568dcab113 \
-    --hash=sha256:45dbed2ab436a9e826e302fcdcbe9133f9b0006e5af7168afb8963a6520da103 \
-    --hash=sha256:4636de7fd195197b7535f231b5de9e4b36d2c440b6e566d2e4e4746e6af0ca93 \
-    --hash=sha256:4a19d9dba1a76618dd86b164d608566f393f8ec6ac7c44f0cc879011c45e65af \
-    --hash=sha256:4bbc7f303d125971f60ec0aaad5e12c62d0d2c925f0ab1273debd0e4ba37aba5 \
-    --hash=sha256:4d6d57903571f86180eb98f8f0c839fa9ebbfb031356d87f1361be91e433f5b7 \
-    --hash=sha256:4e874c976154687c1f71715b034739b45c7711bec81db01914770373d125e392 \
-    --hash=sha256:51fc224f7ca4d92656d5a5eb315f12eb5fe2c97a66249aa7b5f562528a3be38c \
-    --hash=sha256:58c8b5929fcb8287cbd6f0a3fae19c6e03a5c48402ae792962ac465224a629a4 \
-    --hash=sha256:5a285b3b96f951841799528cd1f4f01cd70e7e0204b4abebac9463eecfcf2a40 \
-    --hash=sha256:5c70f1cc1c4efbe316a572e2d8b9b9cc44e89b95f79ca3331553fbb63716e2bf \
-    --hash=sha256:62d6b0f03b694173f9fcb1fb317f7222fd0b0b103e784c6549f5e53a27718c44 \
-    --hash=sha256:6a246d5914aa1c820c9443ddcee9c02bec3e203b0c080349533fae17727dfd1b \
-    --hash=sha256:6aa3236c78803afbcb255045fbef97a9e25a1f6c9888357d205ddc42f4d6eba5 \
-    --hash=sha256:6bbe4eb67390b0a0265a2c25458f6b90a409d5d069f1041e6aff1e27e3d9a79e \
-    --hash=sha256:715d1c092715954784bc79e1174fc2a90093dc4dc84ea15eb14dad8abdcdeb74 \
-    --hash=sha256:72944b19f2324114e9dc86a159787333b77874143efcf89a5167ef83cfee8af0 \
-    --hash=sha256:81f4a14bee47aec54f883e0cad2d73986640c1590eb9bfaaba7ad17394481e6e \
-    --hash=sha256:846300f379b5b12cc769334464656bc882e0735d27d9726568bc932fdc49d5ec \
-    --hash=sha256:86b6f55f5a352b48d7fbfd2dbc3d5b780b2d79f4d3c121f33eb6efb22e9a2015 \
-    --hash=sha256:874f200b2a981c647340f841730fc3a2b54c9d940566a3c4149099591e2c4c3d \
-    --hash=sha256:8a87ec22c87be071b6bdbd27920b129b94f2fc964358ce38f3822635a3e2e03d \
-    --hash=sha256:8b3b60bb7cba2c8c81837661c488637eee696f59a877788a396d33150c35d842 \
-    --hash=sha256:8e3ed142f2728df44263aaf5fb1f5b0b99f4070c553a0d7f033be65338329150 \
-    --hash=sha256:93e15038125dc1e5345d9b5b68aa7f996ec33b98118d18c6ca0d0b7d6198b7e8 \
-    --hash=sha256:989824e9faf85f96ec9c7761cd8d29c531ad857bfa1daa930cba85baaecf1a9a \
-    --hash=sha256:99d838547ace2c4aace6c4f76e879ddfe02bb58a80c1549928477862b7a6d6ed \
-    --hash=sha256:9b2aec6af35c113b05695ebb5749a787acd63cafc83086a05771d1e1cd1e555f \
-    --hash=sha256:9c585a1790d5436a5374bac930dad6ed244c046ed91b2b2a3634eb2971d21008 \
-    --hash=sha256:a7164afb23be6e37ad90b2f10426149fd75aee07ca55653d2aa41e66c4ef697e \
-    --hash=sha256:ac6b31e35612a26483e20750126d30d0941f949426974cace8e6b5c58a3657b0 \
-    --hash=sha256:ad2e2ef14e0b04e544ea2fa0a36463f847f113d314aa02e5b402fdf910ef309e \
-    --hash=sha256:b268594bccac7d7cf5844c7732e3f20c50921d94e36d7ec9b79e9857694b1b2f \
-    --hash=sha256:b5f0362dc928a6ecd9db58868fca5e48485205e3855957bdedea308f8672ea4a \
-    --hash=sha256:ba1f4fc670ed79f876f70082eff4f9583c15fb9a4b89d6188412de4d18ae2f40 \
-    --hash=sha256:ba203255017337d39f89bdd58417f03c4426f12beed0440cfd933cb15f8669c7 \
-    --hash=sha256:c901b15172510173f5cb310eae652908340f8dede90fff9e3bf6c0d8dfd92f83 \
-    --hash=sha256:c9b39d38a9bd2ae1becd7eac1303d031c5c110ad31f2b319c6e7d98b135c934d \
-    --hash=sha256:d2a8490669bfe99a233298348acc2d824d496dee0e66e31b66a6022c2ad74a5c \
-    --hash=sha256:dddbbd259598d7240b18c9d87c56a9d2fb3b02fe266f49a7c101532e78c1d871 \
-    --hash=sha256:df3775294accfdd75f32c74ae39fcba920c9a378a2fc18a12b6820aa8c1fb502 \
-    --hash=sha256:e44319a2953c738205bf3354537979eaa3998ed673395b964c1176083dd46252 \
-    --hash=sha256:e4a010c27ff6f210ff4c6ef34394cd61470d01014439b192ec22552ee867f2a8 \
-    --hash=sha256:e823b8b6edc81e747526f70f71a9c0a07ac4e7ad13020aa736bb7c9d67196115 \
-    --hash=sha256:e892aff75639bbef0d2a2cfd55535510df26ff92f63c92cd84ef8d4ba5a5557f \
-    --hash=sha256:eea7ac5d2dce4189771cedb559c738a71512768210dc4e4753b107a2048b3d0e \
-    --hash=sha256:ef4059d6e5152fa1a39f888e344c73fdc926e1b2dd58c771d67b0acfbf2aa67d \
-    --hash=sha256:f169b9a863d34f5d11b8698ead99febeaa17a13ca044961aa8e2662a6c7766a0 \
-    --hash=sha256:f2cf083b324a467e1ab358c105f6cad5ea950f50524668a80c486ff1db24e119 \
-    --hash=sha256:f8474c4241bc18b750be2abea9d7a9ec84f46ef861dbacf86a4f6e043401f79e \
-    --hash=sha256:f983334aea213c99992053ede6168500e5f086ce74fbc4acc3f2b00f5762e9db \
-    --hash=sha256:f9e75681b59ddaa5e659898085ae0eaea229d054f2ac0c7e563a62205a700121 \
-    --hash=sha256:fbc356aae7adf9e6336d336b9c8111d390a05df88f1805573ebb0807bd06fd1d \
-    --hash=sha256:fcfe2045fd2e8f3cb0ce9d4ba6dba6333b8fa05bb8a4939c908cd43322d14c7e
+numpy==2.4.6 \
+    --hash=sha256:001fbb8e08d942dd57599e781f2472269ee7f2755fae407b4f67b2f0b17da3f1 \
+    --hash=sha256:0280e0356c0829a18d9de1cb7eee50ec22ca639878d7240307ca0943d73cd2c4 \
+    --hash=sha256:043191bfa8eab18c776647b62723ac9dddece59743b13f49b2016094129c2b3f \
+    --hash=sha256:06ca2f61ec4385a07a6977c55ba998a4466c123642b4a32694d3128fce18c079 \
+    --hash=sha256:0a041d3d761dc3c35cc56ce0351506a02bcbc25f7b169f652435141a17db9096 \
+    --hash=sha256:0ab0a9c4ffb1a6d95ef519fe4247dba8eb6b18ad93999f76b7f657039acabd47 \
+    --hash=sha256:0c9136e14ed34a9e343a31c533d78a9813a69a3148332bce5e9821cb2f996e66 \
+    --hash=sha256:110f8b71aacb688ec69062bb7f6938a0f8acb01b7c1c4beb453c65b6d234584d \
+    --hash=sha256:112b06a867b235ef466ed3508ddf0238050df9c727cafb5301ac385b899189a1 \
+    --hash=sha256:17f9ade344e7d9b464a084d69bcf18fc691cb1db67c62ed80820bf4926d78f0e \
+    --hash=sha256:1e254a00cdf42b1e4d5b3d68d33af63268d41340d8885df2ab6470f2e1500147 \
+    --hash=sha256:1e978ec1e8bd0e0e4de6bb75de9d30cbb74db6b6a2bb727618613703ca0167dd \
+    --hash=sha256:25c692919ac5a01f170a3bfcd62d745b24fd095c353d50812637d6fcab442e75 \
+    --hash=sha256:260a5d70215b61ab4fadf5c7baacd64821842975eea312125ed3c39a6391b063 \
+    --hash=sha256:2803abfebfc990042cd494d8ce2d5f82e9d847af6d35ec486923aa19dbad5e73 \
+    --hash=sha256:29a287e0cf63ff528da061de6b9f64a4618da591ca1046aafc54062e40ca7eab \
+    --hash=sha256:29cb7f67d10b479ff07c17d33e39f78c07f71c40ef30d63c153d340e96cd3fb4 \
+    --hash=sha256:3213d622a0283a39a93d188f3cf72b26862df52fbb4ca3697f51705016523d41 \
+    --hash=sha256:33111801a01c12a8a1e3721f0a9232f8cfc8ae2c6b7098167e6f623c6073f402 \
+    --hash=sha256:357cc07a6d7b0b182ff02249616a03742827ebb1277546b5c7cd7f7620a45698 \
+    --hash=sha256:38efbc8de75c7a0fc1ac190162d892787f3f47b57cc291231aafee36b80982b7 \
+    --hash=sha256:4081eb135ac24158bd51cdfbef16f1c64df7063b1143f24731387137c092bec8 \
+    --hash=sha256:40fdc1ae7125e518ea98e53e69a4ebc27e1fd50510c47b7ea130cf21e5e1d42b \
+    --hash=sha256:4cfe66903cc32a9921a6733d96b19bb6abf310397581bbad89c228f5abaf0ee8 \
+    --hash=sha256:511dbaf848decaaaf4b4ca48032619fb3138710c4bf7da7617765edad1ef96b0 \
+    --hash=sha256:55cced7c52e981362f708ad635198e97a752dfba412cc03c23bbf3bd8d5cd662 \
+    --hash=sha256:56b39e5e0622a09a25bf5baf62f4bcf0cb8a41ae6e2819cf49bbc5a74c083f91 \
+    --hash=sha256:5dbbdb29840ca3d91ee0fece42fc29278886d908280bfec0a5846c6f901a3eb0 \
+    --hash=sha256:5f9fb9157b4ce2971008323afe46053787b526ef624fea915b261468a8421a0f \
+    --hash=sha256:6180d8b35af935aed8ece3a85e0a43f87393ae0ac87c8d2c8bd2c993f7270ef3 \
+    --hash=sha256:68a5124b13fa6cc2086764a20005d30bc0548146f7f5322f02fce212ca14317f \
+    --hash=sha256:68bb27509ac1b9a3443094260f6326150663b06abe40b73a2f81160623da5b67 \
+    --hash=sha256:6f41ae150c4e32db4f3310cdaf64b1593a03dbabe29eec77fc9b50fe64061df6 \
+    --hash=sha256:7265a2f3d436e54ef9f2b52b5c937e6be778781bd97a590319d7348f1c1ca997 \
+    --hash=sha256:72fbe16c6fac95aedf5937fa873445cec2110be35d8a4e9433d7501fd98dae6b \
+    --hash=sha256:7d92c3819208a60205a12a245c91ad70cb0a85336659b19b834205573ac8456e \
+    --hash=sha256:8155154c7c691289fe18f510b5d4657c68c67989f293f0535a91360392ff6538 \
+    --hash=sha256:81a1cca95ed5bb92aa8b10dd2cdc9a0d3853a50fad926c28b5d7e8ea54389627 \
+    --hash=sha256:89cd468399cfd2504718f0ba50e410dca55a170b61a02ad92bb18c8a65186e93 \
+    --hash=sha256:8ad03c0965fb3c692200e74d458ca28c1dbb4ce96f9a479a8aa041ad5fabca02 \
+    --hash=sha256:90f9849678c75fe7afa2d348ac842c168b0a4d3d61919687216dfc547976d853 \
+    --hash=sha256:948424b06129ce883307e8cff868c31396d8dc7630a59c61d70d98dbe70f222c \
+    --hash=sha256:9cd5ffd25db4e7ba6a375693b3fc0fc1791ec636c17db3720da19bde7180ec43 \
+    --hash=sha256:a0df0043bdb289bde1f62da130d20df23d58b45429f752bc7a8fc5325a225ecd \
+    --hash=sha256:a2c306dea656c12c68f51f4cea133cbe78ca7435eb28c735eac1d3ebe73be6e8 \
+    --hash=sha256:a7830bab239b79cda9c08c2da014761cafb48da6150e1da17ac06283f43b6089 \
+    --hash=sha256:a7c711e21628b52034bb5ab8d1bce291f752fcc5e92accc615778acee1ff4778 \
+    --hash=sha256:aaf159caa35993cb1f56fb9b8e4610d35758e7ca005412eb1daa856a78c9c4b1 \
+    --hash=sha256:ae506e6902902557576a26ff33eda8695e7ecb3cb36c3b573a0765dee114ebdb \
+    --hash=sha256:b507f5c4c1d508876d1819b6bf9a49d365b96320b5d4993426b33a23ca4b8261 \
+    --hash=sha256:bf162abab1c1a736333192707cef898e735a5ca00f38f27eeedf44b39d9e85eb \
+    --hash=sha256:c1a2af6c6ef86344a6b0db6b97834208bf598db514f2b155042439b62605601a \
+    --hash=sha256:c2d37ab77531417474168eb79d6d80b14f821a966818505d03013d0833edb7a8 \
+    --hash=sha256:c4fc99836233ea196540b17ab0983aff60ed07941751930f5f4d05bc3b3b7359 \
+    --hash=sha256:d581b735e177fdcdce6fed8e7e8880a3fb6ee4e3653a3ac6af01c6f4c03effc5 \
+    --hash=sha256:d6da64deb6b8ed903e7560180a92f2d804ee1ba5eeb849ac2748b8c1aba1f6d7 \
+    --hash=sha256:d8e8286dd7cea7895157318d1b91cdacac64c479f3cbc8dce548331728484751 \
+    --hash=sha256:ddea102b48f9e339f3948bf22040944184627a30fdf7f858667673b9c5f033c8 \
+    --hash=sha256:dfa20cc6ca228e6b155b11da03825975ce66aea520985dbbddf0f2a5a495c605 \
+    --hash=sha256:e3e5193ef5a3dc73bceee50f7fdc2c90dbb76c42df8d8fae3d1067a583df579e \
+    --hash=sha256:e3eeb0aabd6bd5ce64faae67e9935203a6991b4bc2a485a767fbafb2c5125f45 \
+    --hash=sha256:e5805d5a22fd19c8ccff10a9561f9df94436b0545619ea579db2d3c35294bce2 \
+    --hash=sha256:e85b752a1e912b70eaad4fafbd4d1238007ab221de2009b9a2f5ae7461239895 \
+    --hash=sha256:eaf7fa2de5c0be8ae6ff8e9bea2ccd725e980541244521d8d4b5f3354a27babe \
+    --hash=sha256:ebfb099f8dcf083deef3ac1ca4c1503f387cf76296fcb3816b66f5ecb5f54fdb \
+    --hash=sha256:ece3d2cfe132e7d51f44a832b303895e6f2d499c5e74dfbdb06ee246147a304a \
+    --hash=sha256:ed9749eef4cbd126da3dc1d6bcb3a57f5eb7ac6a6484146bdbf743f552dfc577 \
+    --hash=sha256:ede83e07a75dd06bc501566c1eca2afc0d61677c1472ac9ad93fdee6e638a48d \
+    --hash=sha256:ef4aea96ce4d3b074422cb4f2f64e216bf9e213004bb58ecfdf50ea02ea8eb9a \
+    --hash=sha256:f3a3570c4a2a16746ac2c31a7c7c7b0c186b95ce902e33db6f28094ed7387dda \
+    --hash=sha256:f407cb6b8e9d6d8c626bc73c945db1706035af8fd632295547bf1c9e46d092d6 \
+    --hash=sha256:f74a575920ab21fe304421a3fc28793d82e299cae9eccb37084e9fc7f3617c20
     # via opencv-python-headless
-opencv-python-headless==4.13.0.92 \
-    --hash=sha256:0525a3d2c0b46c611e2130b5fdebc94cf404845d8fa64d2f3a3b679572a5bd22 \
-    --hash=sha256:0bd48544f77c68b2941392fcdf9bcd2b9cdf00e98cb8c29b2455d194763cf99e \
-    --hash=sha256:1a7d040ac656c11b8c38677cc8cccdc149f98535089dbe5b081e80a4e5903209 \
-    --hash=sha256:3e0a6f0a37994ec6ce5f59e936be21d5d6384a4556f2d2da9c2f9c5dc948394c \
-    --hash=sha256:5c8cfc8e87ed452b5cecb9419473ee5560a989859fe1d10d1ce11ae87b09a2cb \
-    --hash=sha256:77a82fe35ddcec0f62c15f2ba8a12ecc2ed4207c17b0902c7a3151ae29f37fb6 \
-    --hash=sha256:a7cf08e5b191f4ebb530791acc0825a7986e0d0dee2a3c491184bd8599848a4b \
-    --hash=sha256:eb60e36b237b1ebd40a912da5384b348df8ed534f6f644d8e0b4f103e272ba7d
+opencv-python-headless==5.0.0.93 \
+    --hash=sha256:030ca5e0837a2963ab36ef896baa9767eb8d2b83353fb28af5a521e40dd8756f \
+    --hash=sha256:09a872a157c1376ab922a69bbf22f9a95bcc7b658a9d8b436a60212b02b2eeb4 \
+    --hash=sha256:10818d91510e05c04568ae12b5cd120779c70c01bf897b001a6221fe430df80f \
+    --hash=sha256:1e55af3abfb462eeeabe5c775f12bdb36216d8a93a3583d69e6bd6e1d6ba7d00 \
+    --hash=sha256:829717b6a95554f273e49e357cee3b3a2a26b6f4842fbc1bed2b45bdd8f87e0e \
+    --hash=sha256:840bd717c21e5c11cadadc022a823315ea417f961213d06b4df010e019eb16f4 \
+    --hash=sha256:b82f9831daab90b725c7c1ee1b36cb5732c367096ac76d119e64e14eb70d5f3c \
+    --hash=sha256:c6bcd96b185975ea240d22cfdb15a1f6d080cc95264cfbe2621f21bb144d89b9 \
+    --hash=sha256:ed709fdf9aa0bd1f2ed8549e71d19449b03a675bb581eb292285f6861953be37
     # via -r .github/scripts/requirements_dev.in
 pdf2image==1.17.0 \
     --hash=sha256:eaa959bc116b420dd7ec415fcae49b98100dda3dd18cd2fdfa86d09f112f6d57 \
     --hash=sha256:ecdd58d7afb810dffe21ef2b1bbc057ef434dabbac6c33778a38a3f7744a27e2
     # via -r .github/scripts/requirements_dev.in
-pillow==12.2.0 \
-    --hash=sha256:00a2865911330191c0b818c59103b58a5e697cae67042366970a6b6f1b20b7f9 \
-    --hash=sha256:01afa7cf67f74f09523699b4e88c73fb55c13346d212a59a2db1f86b0a63e8c5 \
-    --hash=sha256:03e7e372d5240cc23e9f07deca4d775c0817bffc641b01e9c3af208dbd300987 \
-    --hash=sha256:03f6fab9219220f041c74aeaa2939ff0062bd5c364ba9ce037197f4c6d498cd9 \
-    --hash=sha256:042db20a421b9bafecc4b84a8b6e444686bd9d836c7fd24542db3e7df7baad9b \
-    --hash=sha256:0538bd5e05efec03ae613fd89c4ce0368ecd2ba239cc25b9f9be7ed426b0af1f \
-    --hash=sha256:0a34329707af4f73cf1782a36cd2289c0368880654a2c11f027bcee9052d35dd \
-    --hash=sha256:0c838a5125cee37e68edec915651521191cef1e6aa336b855f495766e77a366e \
-    --hash=sha256:144748b3af2d1b358d41286056d0003f47cb339b8c43a9ea42f5fea4d8c66b6e \
-    --hash=sha256:1610dd6c61621ae1cf811bef44d77e149ce3f7b95afe66a4512f8c59f25d9ebe \
-    --hash=sha256:1e1757442ed87f4912397c6d35a0db6a7b52592156014706f17658ff58bbf795 \
-    --hash=sha256:22db17c68434de69d8ecfc2fe821569195c0c373b25cccb9cbdacf2c6e53c601 \
-    --hash=sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1 \
-    --hash=sha256:2bb4a8d594eacdfc59d9e5ad972aa8afdd48d584ffd5f13a937a664c3e7db0ed \
-    --hash=sha256:2c727a6d53cb0018aadd8018c2b938376af27914a68a492f59dfcaca650d5eea \
-    --hash=sha256:2d192a155bbcec180f8564f693e6fd9bccff5a7af9b32e2e4bf8c9c69dbad6b5 \
-    --hash=sha256:2e589959f10d9824d39b350472b92f0ce3b443c0a3442ebf41c40cb8361c5b97 \
-    --hash=sha256:2e5a76d03a6c6dcef67edabda7a52494afa4035021a79c8558e14af25313d453 \
-    --hash=sha256:325ca0528c6788d2a6c3d40e3568639398137346c3d6e66bb61db96b96511c98 \
-    --hash=sha256:34c0d99ecccea270c04882cb3b86e7b57296079c9a4aff88cb3b33563d95afaa \
-    --hash=sha256:390ede346628ccc626e5730107cde16c42d3836b89662a115a921f28440e6a3b \
-    --hash=sha256:394167b21da716608eac917c60aa9b969421b5dcbbe02ae7f013e7b85811c69d \
-    --hash=sha256:3997232e10d2920a68d25191392e3a4487d8183039e1c74c2297f00ed1c50705 \
-    --hash=sha256:3adc9215e8be0448ed6e814966ecf3d9952f0ea40eb14e89a102b87f450660d8 \
-    --hash=sha256:3e080565d8d7c671db5802eedfb438e5565ffa40115216eabb8cd52d0ecce024 \
-    --hash=sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0 \
-    --hash=sha256:4bfd07bc812fbd20395212969e41931001fd59eb55a60658b0e5710872e95286 \
-    --hash=sha256:4e6c62e9d237e9b65fac06857d511e90d8461a32adcc1b9065ea0c0fa3a28150 \
-    --hash=sha256:50d8520da2a6ce0af445fa6d648c4273c3eeefbc32d7ce049f22e8b5c3daecc2 \
-    --hash=sha256:51c4167c34b0d8ba05b547a3bb23578d0ba17b80a5593f93bd8ecb123dd336a3 \
-    --hash=sha256:56a3f9c60a13133a98ecff6197af34d7824de9b7b38c3654861a725c970c197b \
-    --hash=sha256:56b25336f502b6ed02e889f4ece894a72612fe885889a6e8c4c80239ff6e5f5f \
-    --hash=sha256:57850958fe9c751670e49b2cecf6294acc99e562531f4bd317fa5ddee2068463 \
-    --hash=sha256:58f62cc0f00fd29e64b29f4fd923ffdb3859c9f9e6105bfc37ba1d08994e8940 \
-    --hash=sha256:5c0a9f29ca8e79f09de89293f82fc9b0270bb4af1d58bc98f540cc4aedf03166 \
-    --hash=sha256:5cdfebd752ec52bf5bb4e35d9c64b40826bc5b40a13df7c3cda20a2c03a0f5ed \
-    --hash=sha256:5d04bfa02cc2d23b497d1e90a0f927070043f6cbf303e738300532379a4b4e0f \
-    --hash=sha256:5d2fd0fa6b5d9d1de415060363433f28da8b1526c1c129020435e186794b3795 \
-    --hash=sha256:62f5409336adb0663b7caa0da5c7d9e7bdbaae9ce761d34669420c2a801b2780 \
-    --hash=sha256:632ff19b2778e43162304d50da0181ce24ac5bb8180122cbe1bf4673428328c7 \
-    --hash=sha256:6562ace0d3fb5f20ed7290f1f929cae41b25ae29528f2af1722966a0a02e2aa1 \
-    --hash=sha256:673aa32138f3e7531ccdbca7b3901dba9b70940a19ccecc6a37c77d5fdeb05b5 \
-    --hash=sha256:6a6e67ea2e6feda684ed370f9a1c52e7a243631c025ba42149a2cc5934dec295 \
-    --hash=sha256:6a9adfc6d24b10f89588096364cc726174118c62130c817c2837c60cf08a392b \
-    --hash=sha256:6bb77b2dcb06b20f9f4b4a8454caa581cd4dd0643a08bacf821216a16d9c8354 \
-    --hash=sha256:6e6b2a0c538fc200b38ff9eb6628228b77908c319a005815f2dde585a0664b60 \
-    --hash=sha256:71cde9a1e1551df7d34a25462fc60325e8a11a82cc2e2f54578e5e9a1e153d65 \
-    --hash=sha256:7371b48c4fa448d20d2714c9a1f775a81155050d383333e0a6c15b1123dda005 \
-    --hash=sha256:766cef22385fa1091258ad7e6216792b156dc16d8d3fa607e7545b2b72061f1c \
-    --hash=sha256:7b14cc0106cd9aecda615dd6903840a058b4700fcb817687d0ee4fc8b6e389be \
-    --hash=sha256:7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5 \
-    --hash=sha256:8023abc91fba39036dbce14a7d6535632f99c0b857807cbbbf21ecc9f4717f06 \
-    --hash=sha256:80b2da48193b2f33ed0c32c38140f9d3186583ce7d516526d462645fd98660ae \
-    --hash=sha256:8297651f5b5679c19968abefd6bb84d95fe30ef712eb1b2d9b2d31ca61267f4c \
-    --hash=sha256:88d387ff40b3ff7c274947ed3125dedf5262ec6919d83946753b5f3d7c67ea4c \
-    --hash=sha256:88ddbc66737e277852913bd1e07c150cc7bb124539f94c4e2df5344494e0a612 \
-    --hash=sha256:8bd7903a5f2a4545f6fd5935c90058b89d30045568985a71c79f5fd6edf9b91e \
-    --hash=sha256:8be29e59487a79f173507c30ddf57e733a357f67881430449bb32614075a40ab \
-    --hash=sha256:8c984051042858021a54926eb597d6ee3012393ce9c181814115df4c60b9a808 \
-    --hash=sha256:8cbeb542b2ebc6fcdacabf8aca8c1a97c9b3ad3927d46b8723f9d4f033288a0f \
-    --hash=sha256:8e9c4f5b3c546fa3458a29ab22646c1c6c787ea8f5ef51300e5a60300736905e \
-    --hash=sha256:90e6f81de50ad6b534cab6e5aef77ff6e37722b2f5d908686f4a5c9eba17a909 \
-    --hash=sha256:975385f4776fafde056abb318f612ef6285b10a1f12b8570f3647ad0d74b48ec \
-    --hash=sha256:9a8a34cc89c67a65ea7437ce257cea81a9dad65b29805f3ecee8c8fe8ff25ffe \
-    --hash=sha256:9aba9a17b623ef750a4d11b742cbafffeb48a869821252b30ee21b5e91392c50 \
-    --hash=sha256:9f08483a632889536b8139663db60f6724bfcb443c96f1b18855860d7d5c0fd4 \
-    --hash=sha256:a4e8f36e677d3336f35089648c8955c51c6d386a13cf6ee9c189c5f5bd713a9f \
-    --hash=sha256:a52edc8bfff4429aaabdf4d9ee0daadbbf8562364f940937b941f87a4290f5ff \
-    --hash=sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5 \
-    --hash=sha256:aa88ccfe4e32d362816319ed727a004423aab09c5cea43c01a4b435643fa34eb \
-    --hash=sha256:af73337013e0b3b46f175e79492d96845b16126ddf79c438d7ea7ff27783a414 \
-    --hash=sha256:b1c1fbd8a5a1af3412a0810d060a78b5136ec0836c8a4ef9aa11807f2a22f4e1 \
-    --hash=sha256:b85f66ae9eb53e860a873b858b789217ba505e5e405a24b85c0464822fe88032 \
-    --hash=sha256:b86024e52a1b269467a802258c25521e6d742349d760728092e1bc2d135b4d76 \
-    --hash=sha256:bd9c0c7a0c681a347b3194c500cb1e6ca9cab053ea4d82a5cf45b6b754560136 \
-    --hash=sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e \
-    --hash=sha256:d362d1878f00c142b7e1a16e6e5e780f02be8195123f164edf7eddd911eefe7c \
-    --hash=sha256:d5d38f1411c0ed9f97bcb49b7bd59b6b7c314e0e27420e34d99d844b9ce3b6f3 \
-    --hash=sha256:dac8d77255a37e81a2efcbd1fc05f1c15ee82200e6c240d7e127e25e365c39ea \
-    --hash=sha256:dd025009355c926a84a612fecf58bb315a3f6814b17ead51a8e48d3823d9087f \
-    --hash=sha256:deede7c263feb25dba4e82ea23058a235dcc2fe1f6021025dc71f2b618e26104 \
-    --hash=sha256:e74473c875d78b8e9d5da2a70f7099549f9eb37ded4e2f6a463e60125bccd176 \
-    --hash=sha256:ee3120ae9dff32f121610bb08e4313be87e03efeadfc6c0d18f89127e24d0c24 \
-    --hash=sha256:eedf4b74eda2b5a4b2b2fb4c006d6295df3bf29e459e198c90ea48e130dc75c3 \
-    --hash=sha256:efd8c21c98c5cc60653bcb311bef2ce0401642b7ce9d09e03a7da87c878289d4 \
-    --hash=sha256:f1c943e96e85df3d3478f7b691f229887e143f81fedab9b20205349ab04d73ed \
-    --hash=sha256:f278f034eb75b4e8a13a54a876cc4a5ab39173d2cdd93a638e1b467fc545ac43 \
-    --hash=sha256:f3f40b3c5a968281fd507d519e444c35f0ff171237f4fdde090dd60699458421 \
-    --hash=sha256:f490f9368b6fc026f021db16d7ec2fbf7d89e2edb42e8ec09d2c60505f5729c7 \
-    --hash=sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06 \
-    --hash=sha256:fc3d34d4a8fbec3e88a79b92e5465e0f9b842b628675850d860b8bd300b159f5
+pillow==12.3.0 \
+    --hash=sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756 \
+    --hash=sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a \
+    --hash=sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59 \
+    --hash=sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45 \
+    --hash=sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3 \
+    --hash=sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df \
+    --hash=sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139 \
+    --hash=sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b \
+    --hash=sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39 \
+    --hash=sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e \
+    --hash=sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8 \
+    --hash=sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1 \
+    --hash=sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8 \
+    --hash=sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89 \
+    --hash=sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5 \
+    --hash=sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130 \
+    --hash=sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd \
+    --hash=sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d \
+    --hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b \
+    --hash=sha256:25b9b82bb22e6e2b3cd07b39c68b7b862001226cb3dff7130d1cb914121b39ed \
+    --hash=sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace \
+    --hash=sha256:300557495eb45ebb8aec96c2da9c4be642fbf7cd937278b4013ba894ea8eb0eb \
+    --hash=sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931 \
+    --hash=sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510 \
+    --hash=sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6 \
+    --hash=sha256:37dc8f7bbb66efe481bb60defacef820c950c24713fb44962ed6aa2a50966de1 \
+    --hash=sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce \
+    --hash=sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385 \
+    --hash=sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e \
+    --hash=sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c \
+    --hash=sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7 \
+    --hash=sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace \
+    --hash=sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c \
+    --hash=sha256:514435a37670e3e5e08f3945b68718b6ed329bb84367777e16f9f4dfe1e61a0f \
+    --hash=sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64 \
+    --hash=sha256:5594fc43d548a7ed94949d139aa1341b270f1863f11cfd37f5a6c8b778a6b67f \
+    --hash=sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a \
+    --hash=sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827 \
+    --hash=sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17 \
+    --hash=sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4 \
+    --hash=sha256:6c0016e7b354317c4e9e525b937ac8596c38d2d232b419529b9cd7a1cd46e39a \
+    --hash=sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701 \
+    --hash=sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e \
+    --hash=sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91 \
+    --hash=sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66 \
+    --hash=sha256:85f998ea1848bc6757289e739cfbdda3a04adfd58b02fc018ce54d754a5ce468 \
+    --hash=sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217 \
+    --hash=sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658 \
+    --hash=sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418 \
+    --hash=sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a \
+    --hash=sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c \
+    --hash=sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330 \
+    --hash=sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402 \
+    --hash=sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09 \
+    --hash=sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930 \
+    --hash=sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f \
+    --hash=sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec \
+    --hash=sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a \
+    --hash=sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94 \
+    --hash=sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468 \
+    --hash=sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b \
+    --hash=sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965 \
+    --hash=sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8 \
+    --hash=sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd \
+    --hash=sha256:bcc33feacfaefce60c12fd500a277533bdc02b10a19f7f6d348763d8140bbba7 \
+    --hash=sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c \
+    --hash=sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777 \
+    --hash=sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35 \
+    --hash=sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9 \
+    --hash=sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f \
+    --hash=sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f \
+    --hash=sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0 \
+    --hash=sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c \
+    --hash=sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71 \
+    --hash=sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3 \
+    --hash=sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838 \
+    --hash=sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf \
+    --hash=sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321 \
+    --hash=sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26 \
+    --hash=sha256:f0606c8bf2cdefea14a43530f7657cbbb7ecf1c4222512492ef4a4434a9501ec \
+    --hash=sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9 \
+    --hash=sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65 \
+    --hash=sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5 \
+    --hash=sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e \
+    --hash=sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d \
+    --hash=sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198 \
+    --hash=sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7
     # via
     #   -r .github/scripts/requirements_dev.in
     #   pdf2image
     #   weasyprint
-platformdirs==4.9.6 \
-    --hash=sha256:3bfa75b0ad0db84096ae777218481852c0ebc6c727b3168c1b9e0118e458cf0a \
-    --hash=sha256:e61adb1d5e5cb3441b4b7710bea7e4c12250ca49439228cc1021c00dcfac0917
+platformdirs==4.10.0 \
+    --hash=sha256:31e761a6a0ca04faf7353ea759bdba55652be214725111e5aac52dfa29d4bef7 \
+    --hash=sha256:fb516cdb12eb0d857d0cd85a7c57cea4d060bee4578d6cf5a14dfdf8cbf8784a
     # via
     #   python-discovery
     #   virtualenv
@@ -381,9 +393,9 @@ pyphen==0.17.2 \
     --hash=sha256:3a07fb017cb2341e1d9ff31b8634efb1ae4dc4b130468c7c39dd3d32e7c3affd \
     --hash=sha256:f60647a9c9b30ec6c59910097af82bc5dd2d36576b918e44148d8b07ef3b4aa3
     # via weasyprint
-python-discovery==1.2.2 \
-    --hash=sha256:876e9c57139eb757cb5878cbdd9ae5379e5d96266c99ef731119e04fffe533bb \
-    --hash=sha256:e1ae95d9af875e78f15e19aed0c6137ab1bb49c200f21f5061786490c9585c7a
+python-discovery==1.4.4 \
+    --hash=sha256:5cad33982d412c1f3ffb8f9ca4ea292c9680bca3942451d30b69c37fce53a4a3 \
+    --hash=sha256:abebe9120b43453b68c908acfb1e72a19d1a959ed2cb620ad38fc57d08056dbe
     # via virtualenv
 pyyaml==6.0.3 \
     --hash=sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c \
@@ -470,17 +482,17 @@ tinyhtml5==2.1.0 \
     --hash=sha256:60a50ec3d938a37e491efa01af895853060943dcebb5627de5b10d188b338a67 \
     --hash=sha256:6e11cfff38515834268daf89d5f85bbde0b6dd02e8d9e212d1385c2289b89f0a
     # via weasyprint
-unoserver==3.6 \
-    --hash=sha256:25c360fa194396a89cb79b4edd2735f8e4f0fd8531e59db3952114585bd7df05 \
-    --hash=sha256:e446bcb3638c51880f002aaeecab1cf74dfa9df81035f027f7ff2e081b6d7015
+unoserver==3.7 \
+    --hash=sha256:b05f9578506ac7374ae1b314c3a79528636c542ac78220a9ce99110584ca424b \
+    --hash=sha256:fc44e6808071c9d2957e705ecf1742cea8a582aa5d5cc23babf36bb332ec6e8e
     # via -r .github/scripts/requirements_dev.in
-virtualenv==21.2.4 \
-    --hash=sha256:29d21e941795206138d0f22f4e45ff7050e5da6c6472299fb7103318763861ac \
-    --hash=sha256:b294ef68192638004d72524ce7ef303e9d0cf5a44c95ce2e54a7500a6381cada
+virtualenv==21.6.1 \
+    --hash=sha256:15f978b7cd329f24855ff4a0c4b4899cc7678589f49adbdcbbb4d3232e641128 \
+    --hash=sha256:afe991df855715a2b2f60edfcc0107ef95a79fdfd8cb4cdaa71603d1c12e463b
     # via pre-commit
-weasyprint==68.1 \
-    --hash=sha256:4dc3ba63c68bbbce3e9617cb2226251c372f5ee90a8a484503b1c099da9cf5be \
-    --hash=sha256:d3b752049b453a5c95edb27ce78d69e9319af5a34f257fa0f4c738c701b4184e
+weasyprint==69.0 \
+    --hash=sha256:475951cfd917014de6d4d005caff48c6aa867e7e42b80cd5b16a0484a1609ee6 \
+    --hash=sha256:a7a32f39ca16bd82ef11de99c92ea4b5f14951c9033af035e451ce4f4ee0a88c
     # via -r .github/scripts/requirements_dev.in
 webencodings==0.5.1 \
     --hash=sha256:a0af1213f3c2226497a97e2b3aa01a7e4bee4f403f95be16fc9acd2947514a78 \
@@ -489,27 +501,28 @@ webencodings==0.5.1 \
     #   cssselect2
     #   tinycss2
     #   tinyhtml5
-zopfli==0.4.1 \
-    --hash=sha256:02086247dd12fda929f9bfe8b3962b6bcdbfc8c82e99255aebcf367867cf0760 \
-    --hash=sha256:07a5cdc5d1aaa6c288c5d9f5a5383042ba743641abf8e2fd898dcad622d8a38e \
-    --hash=sha256:27823dc1161a4031d1c25925fd45d9868ec0cbc7692341830a7dcfa25063662c \
-    --hash=sha256:2f992ac7d83cbddd889e1813ace576cbc91a05d5d7a0a21b366e2e5f492e7707 \
-    --hash=sha256:4238d4d746d1095e29c9125490985e0c12ffd3654f54a24af551e2391e936d54 \
-    --hash=sha256:5a4c22b6161f47f5bd34637dbaee6735abd287cd64e0d1ce28ef1871bf625f4b \
-    --hash=sha256:84a31ba9edc921b1d3a4449929394a993888f32d70de3a3617800c428a947b9b \
-    --hash=sha256:a899eca405662a23ae75054affa3517a060362eae1185d3d791c86a50153c4dd \
-    --hash=sha256:a93c2ecafff372de6c0aa2212eff18a75f6c71a100372fee7b4b129cc0b6f9a7 \
-    --hash=sha256:cb136a74d14a4ecfae29cb0fdecece58a6c115abc9a74c12bc6ac62e80f229d7 \
-    --hash=sha256:d7bcee1b189d64ec33d1e05cfa1b6a1268c29329c382f6ca1bd6245b04925c57 \
-    --hash=sha256:fdfb7ce9f5de37a5b2f75dd2642fd7717956ef2a72e0387302a36d382440db07
+zopfli==0.4.3 \
+    --hash=sha256:0087c9a6f0c8a052be0f6d1a9bb71b6caffdd3e10201d6d6166e28d482cebe6d \
+    --hash=sha256:47604eee5c6704bdf0e94d8391fe3b74ddb2abd84128fbcfdc3ee0fc265feaef \
+    --hash=sha256:62248dbf8dbcbd588ee194b210e5be9fa80bce29641f55599d6d394bd2a9d8a3 \
+    --hash=sha256:628c3e941752880b3491db8d44163d0aedb221944e22a17187ff7fc549b050f6 \
+    --hash=sha256:769875152d0625c46707bcca57d4b2233fe653482067acd55fbf6ec525cb9bdc \
+    --hash=sha256:7e9703ca6e7ef66c8d05e0826b6f558b680c9db8206f84f05a3ee93430a12e42 \
+    --hash=sha256:7fa3c35193475290e3f007bbcdebdbae64ba2f012d75c632da0d727e1da50d5e \
+    --hash=sha256:88f4fbe429aad72bc206275d81fab11a097e0f951a5848d1f51083c37ea73073 \
+    --hash=sha256:921c2c9907f4364963848da5ad194b46d68865e07fdb975d04fd09bc42d47357 \
+    --hash=sha256:d3a50f91a13cea9bafe025de8fd87a005eb26de02a4f0c193127ddbf23ac8ebe \
+    --hash=sha256:d4f51dd1ab5312e837e2091284e0d9f1a138188f2e65812f9a5799dc02c45f94 \
+    --hash=sha256:eb0c9c1d40a8cb1d58762d7e57290ccb753e0828c4d01be8acb59aae5d0ca206 \
+    --hash=sha256:f2e0adcf7d36c6fd0dd36cc771ef7f0c5803a05666feafcd90d7170174a4148e
     # via fonttools
 
 # The following packages are considered to be unsafe in a requirements file:
-pip==26.0.1 \
-    --hash=sha256:bdb1b08f4274833d62c1aa29e20907365a2ceb950410df15fc9521bad440122b \
-    --hash=sha256:c4037d8a277c89b320abe636d59f91e6d0922d08a05b60e85e53b296613346d8
+pip==26.1.2 \
+    --hash=sha256:382ff9f685ee3bc25864f820aa50505825f10f5458ffff07e30a6d96e5715cab \
+    --hash=sha256:f49cd134c61cf2fd75e0ce2676db03e4054504a5a4986d00f8299ae632dc4605
     # via -r .github/scripts/requirements_dev.in
-setuptools==82.0.1 \
-    --hash=sha256:7d872682c5d01cfde07da7bccc7b65469d3dca203318515ada1de5eda35efbf9 \
-    --hash=sha256:a59e362652f08dcd477c78bb6e7bd9d80a7995bc73ce773050228a348ce2e5bb
+setuptools==83.0.0 \
+    --hash=sha256:025bccbbf0fa05b6192bc64ae1e7b16e001fd6d6d4d5de03c97b1c1ade523bef \
+    --hash=sha256:29b23c360f22f414dc7336bb39178cc7bcbf6021ed2733cde173f09dba19abb3
     # via -r .github/scripts/requirements_dev.in
diff --git a/.github/scripts/requirements_sync_readme.txt b/.github/scripts/requirements_sync_readme.txt
index b68152361d..d812da2025 100644
--- a/.github/scripts/requirements_sync_readme.txt
+++ b/.github/scripts/requirements_sync_readme.txt
@@ -1,5 +1,5 @@
 #
-# This file is autogenerated by pip-compile with Python 3.12
+# This file is autogenerated by pip-compile with Python 3.13
 # by the following command:
 #
 #    pip-compile --generate-hashes --output-file='.github\scripts\requirements_sync_readme.txt' --strip-extras '.github\scripts\requirements_sync_readme.in'
@@ -8,7 +8,7 @@ tomli-w==1.2.0 \
     --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
     --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
     # via -r .github/scripts/requirements_sync_readme.in
-tomlkit==0.14.0 \
-    --hash=sha256:592064ed85b40fa213469f81ac584f67a4f2992509a7c3ea2d632208623a3680 \
-    --hash=sha256:cf00efca415dbd57575befb1f6634c4f42d2d87dbba376128adb42c121b87064
+tomlkit==0.15.0 \
+    --hash=sha256:4dbc8f0fc024412b57ced8757ac7461305126a648ff8c2c807fcb8e133a78738 \
+    --hash=sha256:7d1a9ecba3086638211b13814ea79c90dd54dd11993564376f3aa92271f5c7a3
     # via -r .github/scripts/requirements_sync_readme.in
diff --git a/testing/cucumber/requirements.txt b/testing/cucumber/requirements.txt
index 87ee6fc0d5..1b8105c8de 100644
--- a/testing/cucumber/requirements.txt
+++ b/testing/cucumber/requirements.txt
@@ -2,174 +2,140 @@
 # This file is autogenerated by pip-compile with Python 3.13
 # by the following command:
 #
-#    pip-compile --generate-hashes --output-file=testing/cucumber/requirements.txt --strip-extras testing/cucumber/requirements.in
+#    pip-compile --generate-hashes --output-file='testing\cucumber\requirements.txt' --strip-extras 'testing\cucumber\requirements.in'
 #
 behave==1.3.3 \
     --hash=sha256:2b8f4b64ed2ea756a5a2a73e23defc1c4631e9e724c499e46661778453ebaf51 \
     --hash=sha256:89bdb62af8fb9f147ce245736a5de69f025e5edfb66f1fbe16c5007493f842c0
     # via
-    #   -r requirements.in
+    #   -r testing/cucumber/requirements.in
     #   behave-html-formatter
 behave-html-formatter==0.9.10 \
     --hash=sha256:c5a9ad3edcac7be5766b14aacce46794885c749c4741fc93f8fc3a4bf2a891aa \
     --hash=sha256:fff7ac2118463701423645ad5a12636845bfd6c8a2dd52097b524b4f290aa7c8
-    # via -r requirements.in
-certifi==2026.2.25 \
-    --hash=sha256:027692e4402ad994f1c42e52a4997a9763c646b73e4096e4d5d6db8af1d6f0fa \
-    --hash=sha256:e887ab5cee78ea814d3472169153c2d12cd43b14bd03329a39a9c6e2e80bfba7
+    # via -r testing/cucumber/requirements.in
+certifi==2026.6.17 \
+    --hash=sha256:024c88eeec92ca068db80f02b8b07c9cef7b9fe261d1d535abfd5abd6f6af432 \
+    --hash=sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db
     # via requests
-charset-normalizer==3.4.7 \
-    --hash=sha256:007d05ec7321d12a40227aae9e2bc6dca73f3cb21058999a1df9e193555a9dcc \
-    --hash=sha256:03853ed82eeebbce3c2abfdbc98c96dc205f32a79627688ac9a27370ea61a49c \
-    --hash=sha256:07d9e39b01743c3717745f4c530a6349eadbfa043c7577eef86c502c15df2c67 \
-    --hash=sha256:08e721811161356f97b4059a9ba7bafb23ea5ee2255402c42881c214e173c6b4 \
-    --hash=sha256:0c96c3b819b5c3e9e165495db84d41914d6894d55181d2d108cc1a69bfc9cce0 \
-    --hash=sha256:0ea948db76d31190bf08bd371623927ee1339d5f2a0b4b1b4a4439a65298703c \
-    --hash=sha256:0f7eb884681e3938906ed0434f20c63046eacd0111c4ba96f27b76084cd679f5 \
-    --hash=sha256:12a6fff75f6bc66711b73a2f0addfc4c8c15a20e805146a02d147a318962c444 \
-    --hash=sha256:12d8baf840cc7889b37c7c770f478adea7adce3dcb3944d02ec87508e2dcf153 \
-    --hash=sha256:14265bfe1f09498b9d8ec91e9ec9fa52775edf90fcbde092b25f4a33d444fea9 \
-    --hash=sha256:16d971e29578a5e97d7117866d15889a4a07befe0e87e703ed63cd90cb348c01 \
-    --hash=sha256:177a0ba5f0211d488e295aaf82707237e331c24788d8d76c96c5a41594723217 \
-    --hash=sha256:1a87ca9d5df6fe460483d9a5bbf2b18f620cbed41b432e2bddb686228282d10b \
-    --hash=sha256:1c2a768fdd44ee4a9339a9b0b130049139b8ce3c01d2ce09f67f5a68048d477c \
-    --hash=sha256:1c2aed2e5e41f24ea8ef1590b8e848a79b56f3a5564a65ceec43c9d692dc7d8a \
-    --hash=sha256:1dc8b0ea451d6e69735094606991f32867807881400f808a106ee1d963c46a83 \
-    --hash=sha256:1efde3cae86c8c273f1eb3b287be7d8499420cf2fe7585c41d370d3e790054a5 \
-    --hash=sha256:202389074300232baeb53ae2569a60901f7efadd4245cf3a3bf0617d60b439d7 \
-    --hash=sha256:203104ed3e428044fd943bc4bf45fa73c0730391f9621e37fe39ecf477b128cb \
-    --hash=sha256:2257141f39fe65a3fdf38aeccae4b953e5f3b3324f4ff0daf9f15b8518666a2c \
-    --hash=sha256:298930cec56029e05497a76988377cbd7457ba864beeea92ad7e844fe74cd1f1 \
-    --hash=sha256:2cd4a60d0e2fb04537162c62bbbb4182f53541fe0ede35cdf270a1c1e723cc42 \
-    --hash=sha256:2d6eb928e13016cea4f1f21d1e10c1cebd5a421bc57ddf5b1142ae3f86824fab \
-    --hash=sha256:2fe249cb4651fd12605b7288b24751d8bfd46d35f12a20b1ba33dea122e690df \
-    --hash=sha256:30b8d1d8c52a48c2c5690e152c169b673487a2a58de1ec7393196753063fcd5e \
-    --hash=sha256:320ade88cfb846b8cd6b4ddf5ee9e80ee0c1f52401f2456b84ae1ae6a1a5f207 \
-    --hash=sha256:3534e7dcbdcf757da6b85a0bbf5b6868786d5982dd959b065e65481644817a18 \
-    --hash=sha256:36836d6ff945a00b88ba1e4572d721e60b5b8c98c155d465f56ad19d68f23734 \
-    --hash=sha256:38c0109396c4cfc574d502df99742a45c72c08eff0a36158b6f04000043dbf38 \
-    --hash=sha256:3946fa46a0cf3e4c8cb1cc52f56bb536310d34f25f01ca9b6c16afa767dab110 \
-    --hash=sha256:3bec022aec2c514d9cf199522a802bd007cd588ab17ab2525f20f9c34d067c18 \
-    --hash=sha256:3c9a494bc5ec77d43cea229c4f6db1e4d8fe7e1bbffa8b6f0f0032430ff8ab44 \
-    --hash=sha256:3dce51d0f5e7951f8bb4900c257dad282f49190fdbebecd4ba99bcc41fef404d \
-    --hash=sha256:3dedcc22d73ec993f42055eff4fcfed9318d1eeb9a6606c55892a26964964e48 \
-    --hash=sha256:4042d5c8f957e15221d423ba781e85d553722fc4113f523f2feb7b188cc34c5e \
-    --hash=sha256:481551899c856c704d58119b5025793fa6730adda3571971af568f66d2424bb5 \
-    --hash=sha256:4dc1e73c36828f982bfe79fadf5919923f8a6f4df2860804db9a98c48824ce8d \
-    --hash=sha256:4e5163c14bffd570ef2affbfdd77bba66383890797df43dc8b4cc7d6f500bf53 \
-    --hash=sha256:511ef87c8aec0783e08ac18565a16d435372bc1ac25a91e6ac7f5ef2b0bff790 \
-    --hash=sha256:532bc9bf33a68613fd7d65e4b1c71a6a38d7d42604ecf239c77392e9b4e8998c \
-    --hash=sha256:54523e136b8948060c0fa0bc7b1b50c32c186f2fceee897a495406bb6e311d2b \
-    --hash=sha256:5649fd1c7bade02f320a462fdefd0b4bd3ce036065836d4f42e0de958038e116 \
-    --hash=sha256:56be790f86bfb2c98fb742ce566dfb4816e5a83384616ab59c49e0604d49c51d \
-    --hash=sha256:5b77459df20e08151cd6f8b9ef8ef1f961ef73d85c21a555c7eed5b79410ec10 \
-    --hash=sha256:5ed6ab538499c8644b8a3e18debabcd7ce684f3fa91cf867521a7a0279cab2d6 \
-    --hash=sha256:6178f72c5508bfc5fd446a5905e698c6212932f25bcdd4b47a757a50605a90e2 \
-    --hash=sha256:6370e8686f662e6a3941ee48ed4742317cafbe5707e36406e9df792cdb535776 \
-    --hash=sha256:64f02c6841d7d83f832cd97ccf8eb8a906d06eb95d5276069175c696b024b60a \
-    --hash=sha256:65bcd23054beab4d166035cabbc868a09c1a49d1efe458fe8e4361215df40265 \
-    --hash=sha256:66671f93accb62ed07da56613636f3641f1a12c13046ce91ffc923721f23c008 \
-    --hash=sha256:6696b7688f54f5af4462118f0bfa7c1621eeb87154f77fa04b9295ce7a8f2943 \
-    --hash=sha256:6785f414ae0f3c733c437e0f3929197934f526d19dfaa75e18fdb4f94c6fb374 \
-    --hash=sha256:67f6279d125ca0046a7fd386d01b311c6363844deac3e5b069b514ba3e63c246 \
-    --hash=sha256:6c114670c45346afedc0d947faf3c7f701051d2518b943679c8ff88befe14f8e \
-    --hash=sha256:6e0d51f618228538a3e8f46bd246f87a6cd030565e015803691603f55e12afb5 \
-    --hash=sha256:6ed74185b2db44f41ef35fd1617c5888e59792da9bbc9190d6c7300617182616 \
-    --hash=sha256:708838739abf24b2ceb208d0e22403dd018faeef86ddac04319a62ae884c4f15 \
-    --hash=sha256:715479b9a2802ecac752a3b0efa2b0b60285cf962ee38414211abdfccc233b41 \
-    --hash=sha256:733784b6d6def852c814bce5f318d25da2ee65dd4839a0718641c696e09a2960 \
-    --hash=sha256:750e02e074872a3fad7f233b47734166440af3cdea0add3e95163110816d6752 \
-    --hash=sha256:752a45dc4a6934060b3b0dab47e04edc3326575f82be64bc4fc293914566503e \
-    --hash=sha256:7579e913a5339fb8fa133f6bbcfd8e6749696206cf05acdbdca71a1b436d8e72 \
-    --hash=sha256:7641bb8895e77f921102f72833904dcd9901df5d6d72a2ab8f31d04b7e51e4e7 \
-    --hash=sha256:7804338df6fcc08105c7745f1502ba68d900f45fd770d5bdd5288ddccb8a42d8 \
-    --hash=sha256:80d04837f55fc81da168b98de4f4b797ef007fc8a79ab71c6ec9bc4dd662b15b \
-    --hash=sha256:813c0e0132266c08eb87469a642cb30aaff57c5f426255419572aaeceeaa7bf4 \
-    --hash=sha256:82b271f5137d07749f7bf32f70b17ab6eaabedd297e75dce75081a24f76eb545 \
-    --hash=sha256:84c018e49c3bf790f9c2771c45e9313a08c2c2a6342b162cd650258b57817706 \
-    --hash=sha256:8751d2787c9131302398b11e6c8068053dcb55d5a8964e114b6e196cf16cb366 \
-    --hash=sha256:8778f0c7a52e56f75d12dae53ae320fae900a8b9b4164b981b9c5ce059cd1fcb \
-    --hash=sha256:87fad7d9ba98c86bcb41b2dc8dbb326619be2562af1f8ff50776a39e55721c5a \
-    --hash=sha256:8d828b6667a32a728a1ad1d93957cdf37489c57b97ae6c4de2860fa749b8fc1e \
-    --hash=sha256:8e385e4267ab76874ae30db04c627faaaf0b509e1ccc11a95b3fc3e83f855c00 \
-    --hash=sha256:92a0a01ead5e668468e952e4238cccd7c537364eb7d851ab144ab6627dbbe12f \
-    --hash=sha256:94e1885b270625a9a828c9793b4d52a64445299baa1fea5a173bf1d3dd9a1a5a \
-    --hash=sha256:a180c5e59792af262bf263b21a3c49353f25945d8d9f70628e73de370d55e1e1 \
-    --hash=sha256:a277ab8928b9f299723bc1a2dabb1265911b1a76341f90a510368ca44ad9ab66 \
-    --hash=sha256:a5fe03b42827c13cdccd08e6c0247b6a6d4b5e3cdc53fd1749f5896adcdc2356 \
-    --hash=sha256:a6c5863edfbe888d9eff9c8b8087354e27618d9da76425c119293f11712a6319 \
-    --hash=sha256:a89c23ef8d2c6b27fd200a42aa4ac72786e7c60d40efdc76e6011260b6e949c4 \
-    --hash=sha256:adb2597b428735679446b46c8badf467b4ca5f5056aae4d51a19f9570301b1ad \
-    --hash=sha256:ae196f021b5e7c78e918242d217db021ed2a6ace2bc6ae94c0fc596221c7f58d \
-    --hash=sha256:ae89db9e5f98a11a4bf50407d4363e7b09b31e55bc117b4f7d80aab97ba009e5 \
-    --hash=sha256:aed52fea0513bac0ccde438c188c8a471c4e0f457c2dd20cdbf6ea7a450046c7 \
-    --hash=sha256:aef65cd602a6d0e0ff6f9930fcb1c8fec60dd2cfcb6facaf4bdb0e5873042db0 \
-    --hash=sha256:af21eb4409a119e365397b2adbaca4c9ccab56543a65d5dbd9f920d6ac29f686 \
-    --hash=sha256:b14b2d9dac08e28bb8046a1a0434b1750eb221c8f5b87a68f4fa11a6f97b5e34 \
-    --hash=sha256:bb6d88045545b26da47aa879dd4a89a71d1dce0f0e549b1abcb31dfe4a8eac49 \
-    --hash=sha256:bb8cc7534f51d9a017b93e3e85b260924f909601c3df002bcdb58ddb4dc41a5c \
-    --hash=sha256:bc17a677b21b3502a21f66a8cc64f5bfad4df8a0b8434d661666f8ce90ac3af1 \
-    --hash=sha256:bd6c2a1c7573c64738d716488d2cdd3c00e340e4835707d8fdb8dc1a66ef164e \
-    --hash=sha256:bd9b23791fe793e4968dba0c447e12f78e425c59fc0e3b97f6450f4781f3ee60 \
-    --hash=sha256:c03a41a8784091e67a39648f70c5f97b5b6a37f216896d44d2cdcb82615339a0 \
-    --hash=sha256:c0f081d69a6e58272819b70288d3221a6ee64b98df852631c80f293514d3b274 \
-    --hash=sha256:c35abb8bfff0185efac5878da64c45dafd2b37fb0383add1be155a763c1f083d \
-    --hash=sha256:c36c333c39be2dbca264d7803333c896ab8fa7d4d6f0ab7edb7dfd7aea6e98c0 \
-    --hash=sha256:c45e9440fb78f8ddabcf714b68f936737a121355bf59f3907f4e17721b9d1aae \
-    --hash=sha256:c593052c465475e64bbfe5dbd81680f64a67fdc752c56d7a0ae205dc8aeefe0f \
-    --hash=sha256:cdd68a1fb318e290a2077696b7eb7a21a49163c455979c639bf5a5dcdc46617d \
-    --hash=sha256:ce3412fbe1e31eb81ea42f4169ed94861c56e643189e1e75f0041f3fe7020abe \
-    --hash=sha256:cf1493cd8607bec4d8a7b9b004e699fcf8f9103a9284cc94962cb73d20f9d4a3 \
-    --hash=sha256:cf29836da5119f3c8a8a70667b0ef5fdca3bb12f80fd06487cfa575b3909b393 \
-    --hash=sha256:d4a48e5b3c2a489fae013b7589308a40146ee081f6f509e047e0e096084ceca1 \
-    --hash=sha256:d560742f3c0d62afaccf9f41fe485ed69bd7661a241f86a3ef0f0fb8b1a397af \
-    --hash=sha256:d6038d37043bced98a66e68d3aa2b6a35505dc01328cd65217cefe82f25def44 \
-    --hash=sha256:d61f00a0869d77422d9b2aba989e2d24afa6ffd552af442e0e58de4f35ea6d00 \
-    --hash=sha256:d635aab80466bc95771bb78d5370e74d36d1fe31467b6b29b8b57b2a3cd7d22c \
-    --hash=sha256:dca4bbc466a95ba9c0234ef56d7dd9509f63da22274589ebd4ed7f1f4d4c54e3 \
-    --hash=sha256:dd915403e231e6b1809fe9b6d9fc55cf8fb5e02765ac625d9cd623342a7905d7 \
-    --hash=sha256:e044c39e41b92c845bc815e5ae4230804e8e7bc29e399b0437d64222d92809dd \
-    --hash=sha256:e060d01aec0a910bdccb8be71faf34e7799ce36950f8294c8bf612cba65a2c9e \
-    --hash=sha256:e1421b502d83040e6d7fb2fb18dff63957f720da3d77b2fbd3187ceb63755d7b \
-    --hash=sha256:e17b8d5d6a8c47c85e68ca8379def1303fd360c3e22093a807cd34a71cd082b8 \
-    --hash=sha256:e5f4d355f0a2b1a31bc3edec6795b46324349c9cb25eed068049e4f472fb4259 \
-    --hash=sha256:e712b419df8ba5e42b226c510472b37bd57b38e897d3eca5e8cfd410a29fa859 \
-    --hash=sha256:e74327fb75de8986940def6e8dee4f127cc9752bee7355bb323cc5b2659b6d46 \
-    --hash=sha256:e80c8378d8f3d83cd3164da1ad2df9e37a666cdde7b1cb2298ed0b558064be30 \
-    --hash=sha256:e8ac484bf18ce6975760921bb6148041faa8fef0547200386ea0b52b5d27bf7b \
-    --hash=sha256:eca9705049ad3c7345d574e3510665cb2cf844c2f2dcfe675332677f081cbd46 \
-    --hash=sha256:ed065083d0898c9d5b4bbec7b026fd755ff7454e6e8b73a67f8c744b13986e24 \
-    --hash=sha256:edac0f1ab77644605be2cbba52e6b7f630731fc42b34cb0f634be1a6eface56a \
-    --hash=sha256:effc3f449787117233702311a1b7d8f59cba9ced946ba727bdc329ec69028e24 \
-    --hash=sha256:f22dec1690b584cea26fade98b2435c132c1b5f68e39f5a0b7627cd7ae31f1dc \
-    --hash=sha256:f495a1652cf3fbab2eb0639776dad966c2fb874d79d87ca07f9d5f059b8bd215 \
-    --hash=sha256:f496c9c3cc02230093d8330875c4c3cdfc3b73612a5fd921c65d39cbcef08063 \
-    --hash=sha256:f59099f9b66f0d7145115e6f80dd8b1d847176df89b234a5a6b3f00437aa0832 \
-    --hash=sha256:f59ad4c0e8f6bba240a9bb85504faa1ab438237199d4cce5f622761507b8f6a6 \
-    --hash=sha256:fbccdc05410c9ee21bbf16a35f4c1d16123dcdeb8a1d38f33654fa21d0234f79 \
-    --hash=sha256:fea24543955a6a729c45a73fe90e08c743f0b3334bbf3201e6c4bc1b0c7fa464
+charset-normalizer==3.4.9 \
+    --hash=sha256:0327fcd59a935777d83410750c50600ee9571af2846f71ce40f25b13da1ef380 \
+    --hash=sha256:03d07803992c6c7bbc976327f34b18b6160327fc81cb82c9d504720ac0be3b62 \
+    --hash=sha256:04ce310cb89c15df659582aee80a0603788732a5e017d5bd5c81158106ce249c \
+    --hash=sha256:0d861473f743244d349b50f850d10eb87aeb22bbdcc8e64f79273c94af5a8226 \
+    --hash=sha256:0e94703ec9684807f20cfb5eed95c70f67f2a8f21ad620146d7b5a13677b93e5 \
+    --hash=sha256:0fa1aec2d32bcc03c8fa0f6f1712caad1adc38509f31142112e5c9daf5b9c833 \
+    --hash=sha256:16b65ea0f2465b6fb52aa22de5eca612aa964ddfec00a912e26f4656cbef890b \
+    --hash=sha256:16d10d789dd9bcca1173c95af82c58433122564b7bc39385124be735a35cbe99 \
+    --hash=sha256:19ac87f93086ce37b86e098888555c4b4bc48102279bae3350098c0ed664b501 \
+    --hash=sha256:1d22856ffbe153a602df38e4a5464f0b748a54002e0d69ac6d2ad0a197cc99ec \
+    --hash=sha256:21e764fd1e70b6a3e205a0e46f3051701f98a8cb3fad66eeb80e48bb502f8698 \
+    --hash=sha256:231ddcbb35e2ff8973e1365db41fe0572662893b99a05deb183b68ad4c0c8bd4 \
+    --hash=sha256:253a4a220747e8b5faf57ec320c4f5efb0cef05f647420bf267143ec15dba10a \
+    --hash=sha256:280081916dc341820640489a66e4696049401ef1cf6dd672f672e70ad915aca3 \
+    --hash=sha256:2a441ea71902098ffe78c5abe6c494f44160b4af614ed16c3d9a3b1d17fd8ee2 \
+    --hash=sha256:304b13570067b2547562e308af560b3963857b1fa90bd6afd978130130fe2d6a \
+    --hash=sha256:32286a2c8d167e897177b673176c1e3e00d4057caf5d2b64eef9a3666b03018e \
+    --hash=sha256:33bdcc2a32c0a0e861f60841a512c8acc658c87c2ac59d89e3a46dacf7d866e4 \
+    --hash=sha256:375b83ed0aecfce76c16d198fbc21f3b11b337d68662bea0a995046682a11419 \
+    --hash=sha256:3c09a49d6cde137258beb3d551994a2927fd35ad5cf96aed573f61bbd67c5f84 \
+    --hash=sha256:3d92613ec25e43b05f042302531ec0f00b8445190e43325880cbd6ab7c2581da \
+    --hash=sha256:40a126142a56b2dfc0aacbad1de8310cbf60da7656db0e6b16eebd48e3e93519 \
+    --hash=sha256:416c229f77e5ea25b3dfd4b582f8d73d7e43c22320302b9ab128a2d3a0b38efe \
+    --hash=sha256:432786d3561e69aeeae6c7e8648964ce0ad05736120135601f87ac26b9c83381 \
+    --hash=sha256:43b9e366a31fdd1c87d0eb08f579b4a82b723ea54338f040d6b4e518a026ea29 \
+    --hash=sha256:440eede837960000d74978f0eba527be106b5b9aee0daf779d395276ed0b0614 \
+    --hash=sha256:45b0cc4e3556cd875e09102988d1ab8356c998b596c9fced84547c8138b487a0 \
+    --hash=sha256:476743fe6dfe14a2da12e3ac79125dc84a3b2cf8094369a47a1529b0cd8549fe \
+    --hash=sha256:4773092f8019072343a7447203308b176e10199920eb02d6195e81bbb3274c29 \
+    --hash=sha256:4b3dac63058cc36820b0dd072f89898604e2d39686fe05321729d00d8ac185a0 \
+    --hash=sha256:4d1c96a7a18b9690a4d46df09e3e3382406ae3213727cd1019ebade1c4a81917 \
+    --hash=sha256:51307f5c71007673a2bf8232ad973483d281e74cb99c8c5a990af1eefa6277d9 \
+    --hash=sha256:51447e9aa2684679af07ca5021c3db526e0284347ebf4ffcec1154c3350cfe32 \
+    --hash=sha256:58150c9f9b9a552505912d182ccdf26f6396fb6094816ceebcbb20eecabaed94 \
+    --hash=sha256:5b10cd92fc5c498b35a8635df6d5a100207f88b63a4dc1de7ef9a548e1e2cd63 \
+    --hash=sha256:5e226f6218febc71f6c1fc2fafb91c226f75bdc1d8fb12d66823716e891608fd \
+    --hash=sha256:609b3ba8fcc0fb5ab7af00719d0fb6ad0cb518e48e7712d12fd68f1327951198 \
+    --hash=sha256:60f44ade2cf573dad7a277e6f8ca9a51a21dda572b13bd7d8539bb3cd5dbedde \
+    --hash=sha256:611057cc5d5c0afc743ba8be6bd828c17e0aaa8643f9d0a9b9bb7dea80eb8012 \
+    --hash=sha256:6366a16e1a25018694d6a5d784d09b046edc9eac40ea2b54065c3052672516a1 \
+    --hash=sha256:65a7ff3f705e57d392f7261b6d0550fe137c3019477431f1c355e0db0a7d3e15 \
+    --hash=sha256:673611bbd43f0810bec0b0f028ddeaaa501190339cac411f347ac76917c3ae7b \
+    --hash=sha256:67830fc78e67501f47bb950471b2dcb9b35b140084429318e862895a8e89c993 \
+    --hash=sha256:68ce9f4d6b26d5ccbf7fd4459bf75f74a0a146677ebba80597df60cbdb20e6f4 \
+    --hash=sha256:68e5f26a1ad57ded6d1cfb85331d1c1a195314756471d97758c48498bb4dcdf5 \
+    --hash=sha256:69b157c5d3292bcd443faca052f3096f637f1e074b98212a933c074ae23dc3b8 \
+    --hash=sha256:75286256590a6320cf106a0d28970d3560aad9ee09aa7b34fb40524792436d35 \
+    --hash=sha256:78841cccf1af7b40f6f716338d50c0902dbe88d9f800b3c973b7a9a0a693a642 \
+    --hash=sha256:78fa18e436a1a0e58dbd7e02fc4473f3f32cceb12df9dfca542d075961c307d2 \
+    --hash=sha256:79580094b00d1789d1f93ea55bc43cb2f611910c72235b7657f3482ddcc1b22d \
+    --hash=sha256:7b86a2b16095d250c6f58b3d9b2eee6f4147754344f3dab0922f7c9bf7d226c9 \
+    --hash=sha256:83aed2c10721ddd90f68140685391b50811a880af20654c59af6b6c66c40513c \
+    --hash=sha256:84fd18bcc17526fc2b3c1af7d2b9217d32c9c04448c16ec693b9b4f1985c3d33 \
+    --hash=sha256:871ff67ea1aad4dfd91736464934d56b32dac49f9fbe16cddba36198a7b3a0db \
+    --hash=sha256:898f0e9068ca27d37f8e83a5b962821df851532e6c4a7d615c1c033f9da6eedf \
+    --hash=sha256:8a79d9f4d8001473a30c163556b3c3bfebec837495a412dde78b51672f6134f9 \
+    --hash=sha256:8c041122946b7ba21bb32c45b1aa57b1be35527690aeb3c5c234521085632eee \
+    --hash=sha256:90c44bc373b7687f6948b693cceaea1348ae0975d7474746559494468e3c1d84 \
+    --hash=sha256:9104ed0bd76a429d46f9ec0dbc9b08ad1d2dcdf2b00a5a0daa1c145329b35b44 \
+    --hash=sha256:920079c3f7456fa213e0829ed2073aaa727fd39d889ead5b4f35d0de5460d04f \
+    --hash=sha256:93d59d504b230e83c7a843251681959a0b6a9cd76f6e146ce1b8a80eb8739af9 \
+    --hash=sha256:9b2aff1c7b3884512b9512c3eaadd9bab39fb45042ffaaa1dd08ff2b9f8109d9 \
+    --hash=sha256:9b8e0f3107e2200b76f6054de99016eac3ee6762713587b36baaa7e4bd2ae177 \
+    --hash=sha256:9bb41182d93ea91f60b4bc8fbf4c820c69ef8a12ab2d917f3f1834f1acad07e8 \
+    --hash=sha256:9cdef90ae47919cae358d8ab15797a800ed41da7aba5d72419fb510729e2ed4b \
+    --hash=sha256:a1786910334ed46ab1dd73222f2cd1e05c2c3bb39f6dddb4f8b36fc382058a39 \
+    --hash=sha256:a4cfde78a9f2880208d16a93b795726a3017d5977e08d1e162a7a31322479c41 \
+    --hash=sha256:a4fbdde9dd4a9ce5fd52c2b3a347bb50cc89483ef783f1cb00d408c13f7a96c0 \
+    --hash=sha256:aa99adc8f081b475a12843953db36831eaf83ec33eb46a90629ca6a5de45a616 \
+    --hash=sha256:ac351b3b8014eead140e77e9717e2992c6bbe30b63bc3422422eb84865412e3d \
+    --hash=sha256:ad41ba96094304aa090f5a30cb6e4fb3b3f1c264c523394b4c39bbacc4dc92ba \
+    --hash=sha256:b5314963fce9b0b12743891de876e724997864ee22aa496f903f426c7e2fa5b2 \
+    --hash=sha256:bcf74c1df76758a395bf0af608c04c82257523f55c9868b334f06270d0f2112b \
+    --hash=sha256:bd47ba7fc3ca94896759ea0109775132d3e7ab921fbf54038e1bab2e46c313c9 \
+    --hash=sha256:c0323c9daef75ef2e5083624b4585018a0c9d5e3b40f607eed81a311270b934b \
+    --hash=sha256:c1225416b463483160e4af85d5fc3a9690ccb53fd4b1865a6437825f5ede3209 \
+    --hash=sha256:c1c948747b03be832dceed96ca815cef7360de9aa19d37c730f8e3f6101aca48 \
+    --hash=sha256:c25fe15c70c59eb7c5ce8c06a1f3fa1da0ecc5ea1e7a5922c40fd2fa9b0d5046 \
+    --hash=sha256:cc1b0fff8ead343dae06305f954eb8468ba0ec1a97881f42489d198e4ce3c632 \
+    --hash=sha256:cd6280cf040f233bd7d3407b743b4b4c74f70e8e1c4199cb112a62c941c0772a \
+    --hash=sha256:cd6c3d4b783c556fa00bf540854e42f135e2f256abd29669fcd0da0f2dec79c2 \
+    --hash=sha256:d4d6fcde76f94f5cb9e43e9e9a61f16dacefd228cbbf6f1a09bd9b219a92f1a1 \
+    --hash=sha256:ddf4af30b417d9fe16481e9b81c27ab2a7cde1ff7ba3e85653b02db7d145dc7b \
+    --hash=sha256:df115d4d83168fdf2cae48ef1ff6d1cb4c466364e30861b37121de0f3bf1b990 \
+    --hash=sha256:df7276909358e5635ae203673ab7e509ddd224225a8d6b0790bf13eb2bde1cc5 \
+    --hash=sha256:e4fd89cc178bced6ad29cb3e6dd4aa63fa5017c3524dbd0b25998fb64a87cc8b \
+    --hash=sha256:e9701d0049d92c16703a42771b98d560b95248949f23f8cf7b4eddd201814fb9 \
+    --hash=sha256:ee2f2a527e3c1a6e6411eb4209642e138b544a2d72fe5d0d76daf77b24063534 \
+    --hash=sha256:f7fb7d750cfa0a070d2c24e831fd3481019a60dd317ea2b39acbcebc08b6ed81 \
+    --hash=sha256:f840ed6d8ecba8255df8c42b87fadeda98ddfc6eeec05e2dc66e26d46dd6f58a \
+    --hash=sha256:f86c6358749bd4fda175388691e3ba8c46e24c5347d0afd20f9b7edfc9faf07d \
+    --hash=sha256:fa36ec09ef71d158186bc79e359ff5fdd6e7996fe8ab638f00d6b93139ba4fcf \
+    --hash=sha256:fe2c7201c642b7c308f1675355ad7ff7b66acfe3541625efe5a3ad38f29d6115
     # via
     #   reportlab
     #   requests
 colorama==0.4.6 \
     --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
     --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
+    # via
+    #   behave
+    #   qrcode
+cucumber-expressions==20.0.0 \
+    --hash=sha256:5cbd4012c66584aa82ada990a6e7cb131274796e132e905d27d95ae9a2ca0f48 \
+    --hash=sha256:8a0434529efd7ca6e2052934ec8d677c7e24edc0fad3b1d1b1bc4bbca5e521f3
     # via behave
-cucumber-expressions==19.0.0 \
-    --hash=sha256:8eb5ae46dd03dd37fec1163ace1510529501d7d1868ff372c1ab2cd5aa4543a8 \
-    --hash=sha256:f452e6c73258c1677043ad67ad5f538c87284d6b502004720510fb6b7452d9c5
+cucumber-tag-expressions==10.0.0 \
+    --hash=sha256:496f4a834e4e7ef9c1ae3f6f9c22f237a32f1916f96c32d8b8f900865f988f81 \
+    --hash=sha256:b3ca4163660b247760031f88797ecde2c5384aac85f9d5908cb4750eddde89b7
     # via behave
-cucumber-tag-expressions==9.1.0 \
-    --hash=sha256:cca145d677a942c1877e5a2cf13da8c6ec99260988877c817efd284d8455bb56 \
-    --hash=sha256:d960383d5885300ebcbcb14e41657946fde2a59d5c0f485eb291bc6a0e228acc
-    # via behave
-idna==3.15 \
-    --hash=sha256:048adeaf8c2d788c40fee287673ccaa74c24ffd8dcf09ffa555a2fbb59f10ac8 \
-    --hash=sha256:ca962446ea538f7092a95e057da437618e886f4d349216d2b1e294abfdb65fdc
+idna==3.18 \
+    --hash=sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2 \
+    --hash=sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848
     # via requests
-parse==1.21.1 \
-    --hash=sha256:55339ca698019815df3b8e8b550e5933933527e623b0cdf1ca2f404da35ffb47 \
-    --hash=sha256:825e1a88e9d9fb481b8d2ca709c6195558b6eaa97c559ad3a9a20aa2d12815a3
+parse==1.22.1 \
+    --hash=sha256:20f0925a46f06602485ac90d751764d0697fd8455aaa97489ba8953a4b66de32 \
+    --hash=sha256:d3a4740ec3da338e2b258b2d69741b731eadfddca59e24a14bc4ee5fce38c911
     # via
     #   behave
     #   parse-type
@@ -177,98 +143,94 @@ parse-type==0.6.6 \
     --hash=sha256:3ca79bbe71e170dfccc8ec6c341edfd1c2a0fc1e5cfd18330f93af938de2348c \
     --hash=sha256:513a3784104839770d690e04339a8b4d33439fcd5dd99f2e4580f9fc1097bfb2
     # via behave
-pillow==12.2.0 \
-    --hash=sha256:00a2865911330191c0b818c59103b58a5e697cae67042366970a6b6f1b20b7f9 \
-    --hash=sha256:01afa7cf67f74f09523699b4e88c73fb55c13346d212a59a2db1f86b0a63e8c5 \
-    --hash=sha256:03e7e372d5240cc23e9f07deca4d775c0817bffc641b01e9c3af208dbd300987 \
-    --hash=sha256:03f6fab9219220f041c74aeaa2939ff0062bd5c364ba9ce037197f4c6d498cd9 \
-    --hash=sha256:042db20a421b9bafecc4b84a8b6e444686bd9d836c7fd24542db3e7df7baad9b \
-    --hash=sha256:0538bd5e05efec03ae613fd89c4ce0368ecd2ba239cc25b9f9be7ed426b0af1f \
-    --hash=sha256:0a34329707af4f73cf1782a36cd2289c0368880654a2c11f027bcee9052d35dd \
-    --hash=sha256:0c838a5125cee37e68edec915651521191cef1e6aa336b855f495766e77a366e \
-    --hash=sha256:144748b3af2d1b358d41286056d0003f47cb339b8c43a9ea42f5fea4d8c66b6e \
-    --hash=sha256:1610dd6c61621ae1cf811bef44d77e149ce3f7b95afe66a4512f8c59f25d9ebe \
-    --hash=sha256:1e1757442ed87f4912397c6d35a0db6a7b52592156014706f17658ff58bbf795 \
-    --hash=sha256:22db17c68434de69d8ecfc2fe821569195c0c373b25cccb9cbdacf2c6e53c601 \
-    --hash=sha256:25373b66e0dd5905ed63fa3cae13c82fbddf3079f2c8bf15c6fb6a35586324c1 \
-    --hash=sha256:2bb4a8d594eacdfc59d9e5ad972aa8afdd48d584ffd5f13a937a664c3e7db0ed \
-    --hash=sha256:2c727a6d53cb0018aadd8018c2b938376af27914a68a492f59dfcaca650d5eea \
-    --hash=sha256:2d192a155bbcec180f8564f693e6fd9bccff5a7af9b32e2e4bf8c9c69dbad6b5 \
-    --hash=sha256:2e589959f10d9824d39b350472b92f0ce3b443c0a3442ebf41c40cb8361c5b97 \
-    --hash=sha256:2e5a76d03a6c6dcef67edabda7a52494afa4035021a79c8558e14af25313d453 \
-    --hash=sha256:325ca0528c6788d2a6c3d40e3568639398137346c3d6e66bb61db96b96511c98 \
-    --hash=sha256:34c0d99ecccea270c04882cb3b86e7b57296079c9a4aff88cb3b33563d95afaa \
-    --hash=sha256:390ede346628ccc626e5730107cde16c42d3836b89662a115a921f28440e6a3b \
-    --hash=sha256:394167b21da716608eac917c60aa9b969421b5dcbbe02ae7f013e7b85811c69d \
-    --hash=sha256:3997232e10d2920a68d25191392e3a4487d8183039e1c74c2297f00ed1c50705 \
-    --hash=sha256:3adc9215e8be0448ed6e814966ecf3d9952f0ea40eb14e89a102b87f450660d8 \
-    --hash=sha256:3e080565d8d7c671db5802eedfb438e5565ffa40115216eabb8cd52d0ecce024 \
-    --hash=sha256:4a6c9fa44005fa37a91ebfc95d081e8079757d2e904b27103f4f5fa6f0bf78c0 \
-    --hash=sha256:4bfd07bc812fbd20395212969e41931001fd59eb55a60658b0e5710872e95286 \
-    --hash=sha256:4e6c62e9d237e9b65fac06857d511e90d8461a32adcc1b9065ea0c0fa3a28150 \
-    --hash=sha256:50d8520da2a6ce0af445fa6d648c4273c3eeefbc32d7ce049f22e8b5c3daecc2 \
-    --hash=sha256:51c4167c34b0d8ba05b547a3bb23578d0ba17b80a5593f93bd8ecb123dd336a3 \
-    --hash=sha256:56a3f9c60a13133a98ecff6197af34d7824de9b7b38c3654861a725c970c197b \
-    --hash=sha256:56b25336f502b6ed02e889f4ece894a72612fe885889a6e8c4c80239ff6e5f5f \
-    --hash=sha256:57850958fe9c751670e49b2cecf6294acc99e562531f4bd317fa5ddee2068463 \
-    --hash=sha256:58f62cc0f00fd29e64b29f4fd923ffdb3859c9f9e6105bfc37ba1d08994e8940 \
-    --hash=sha256:5c0a9f29ca8e79f09de89293f82fc9b0270bb4af1d58bc98f540cc4aedf03166 \
-    --hash=sha256:5cdfebd752ec52bf5bb4e35d9c64b40826bc5b40a13df7c3cda20a2c03a0f5ed \
-    --hash=sha256:5d04bfa02cc2d23b497d1e90a0f927070043f6cbf303e738300532379a4b4e0f \
-    --hash=sha256:5d2fd0fa6b5d9d1de415060363433f28da8b1526c1c129020435e186794b3795 \
-    --hash=sha256:62f5409336adb0663b7caa0da5c7d9e7bdbaae9ce761d34669420c2a801b2780 \
-    --hash=sha256:632ff19b2778e43162304d50da0181ce24ac5bb8180122cbe1bf4673428328c7 \
-    --hash=sha256:6562ace0d3fb5f20ed7290f1f929cae41b25ae29528f2af1722966a0a02e2aa1 \
-    --hash=sha256:673aa32138f3e7531ccdbca7b3901dba9b70940a19ccecc6a37c77d5fdeb05b5 \
-    --hash=sha256:6a6e67ea2e6feda684ed370f9a1c52e7a243631c025ba42149a2cc5934dec295 \
-    --hash=sha256:6a9adfc6d24b10f89588096364cc726174118c62130c817c2837c60cf08a392b \
-    --hash=sha256:6bb77b2dcb06b20f9f4b4a8454caa581cd4dd0643a08bacf821216a16d9c8354 \
-    --hash=sha256:6e6b2a0c538fc200b38ff9eb6628228b77908c319a005815f2dde585a0664b60 \
-    --hash=sha256:71cde9a1e1551df7d34a25462fc60325e8a11a82cc2e2f54578e5e9a1e153d65 \
-    --hash=sha256:7371b48c4fa448d20d2714c9a1f775a81155050d383333e0a6c15b1123dda005 \
-    --hash=sha256:766cef22385fa1091258ad7e6216792b156dc16d8d3fa607e7545b2b72061f1c \
-    --hash=sha256:7b14cc0106cd9aecda615dd6903840a058b4700fcb817687d0ee4fc8b6e389be \
-    --hash=sha256:7f84204dee22a783350679a0333981df803dac21a0190d706a50475e361c93f5 \
-    --hash=sha256:8023abc91fba39036dbce14a7d6535632f99c0b857807cbbbf21ecc9f4717f06 \
-    --hash=sha256:80b2da48193b2f33ed0c32c38140f9d3186583ce7d516526d462645fd98660ae \
-    --hash=sha256:8297651f5b5679c19968abefd6bb84d95fe30ef712eb1b2d9b2d31ca61267f4c \
-    --hash=sha256:88d387ff40b3ff7c274947ed3125dedf5262ec6919d83946753b5f3d7c67ea4c \
-    --hash=sha256:88ddbc66737e277852913bd1e07c150cc7bb124539f94c4e2df5344494e0a612 \
-    --hash=sha256:8bd7903a5f2a4545f6fd5935c90058b89d30045568985a71c79f5fd6edf9b91e \
-    --hash=sha256:8be29e59487a79f173507c30ddf57e733a357f67881430449bb32614075a40ab \
-    --hash=sha256:8c984051042858021a54926eb597d6ee3012393ce9c181814115df4c60b9a808 \
-    --hash=sha256:8cbeb542b2ebc6fcdacabf8aca8c1a97c9b3ad3927d46b8723f9d4f033288a0f \
-    --hash=sha256:8e9c4f5b3c546fa3458a29ab22646c1c6c787ea8f5ef51300e5a60300736905e \
-    --hash=sha256:90e6f81de50ad6b534cab6e5aef77ff6e37722b2f5d908686f4a5c9eba17a909 \
-    --hash=sha256:975385f4776fafde056abb318f612ef6285b10a1f12b8570f3647ad0d74b48ec \
-    --hash=sha256:9a8a34cc89c67a65ea7437ce257cea81a9dad65b29805f3ecee8c8fe8ff25ffe \
-    --hash=sha256:9aba9a17b623ef750a4d11b742cbafffeb48a869821252b30ee21b5e91392c50 \
-    --hash=sha256:9f08483a632889536b8139663db60f6724bfcb443c96f1b18855860d7d5c0fd4 \
-    --hash=sha256:a4e8f36e677d3336f35089648c8955c51c6d386a13cf6ee9c189c5f5bd713a9f \
-    --hash=sha256:a52edc8bfff4429aaabdf4d9ee0daadbbf8562364f940937b941f87a4290f5ff \
-    --hash=sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5 \
-    --hash=sha256:aa88ccfe4e32d362816319ed727a004423aab09c5cea43c01a4b435643fa34eb \
-    --hash=sha256:af73337013e0b3b46f175e79492d96845b16126ddf79c438d7ea7ff27783a414 \
-    --hash=sha256:b1c1fbd8a5a1af3412a0810d060a78b5136ec0836c8a4ef9aa11807f2a22f4e1 \
-    --hash=sha256:b85f66ae9eb53e860a873b858b789217ba505e5e405a24b85c0464822fe88032 \
-    --hash=sha256:b86024e52a1b269467a802258c25521e6d742349d760728092e1bc2d135b4d76 \
-    --hash=sha256:bd9c0c7a0c681a347b3194c500cb1e6ca9cab053ea4d82a5cf45b6b754560136 \
-    --hash=sha256:bfa9c230d2fe991bed5318a5f119bd6780cda2915cca595393649fc118ab895e \
-    --hash=sha256:d362d1878f00c142b7e1a16e6e5e780f02be8195123f164edf7eddd911eefe7c \
-    --hash=sha256:d5d38f1411c0ed9f97bcb49b7bd59b6b7c314e0e27420e34d99d844b9ce3b6f3 \
-    --hash=sha256:dac8d77255a37e81a2efcbd1fc05f1c15ee82200e6c240d7e127e25e365c39ea \
-    --hash=sha256:dd025009355c926a84a612fecf58bb315a3f6814b17ead51a8e48d3823d9087f \
-    --hash=sha256:deede7c263feb25dba4e82ea23058a235dcc2fe1f6021025dc71f2b618e26104 \
-    --hash=sha256:e74473c875d78b8e9d5da2a70f7099549f9eb37ded4e2f6a463e60125bccd176 \
-    --hash=sha256:ee3120ae9dff32f121610bb08e4313be87e03efeadfc6c0d18f89127e24d0c24 \
-    --hash=sha256:eedf4b74eda2b5a4b2b2fb4c006d6295df3bf29e459e198c90ea48e130dc75c3 \
-    --hash=sha256:efd8c21c98c5cc60653bcb311bef2ce0401642b7ce9d09e03a7da87c878289d4 \
-    --hash=sha256:f1c943e96e85df3d3478f7b691f229887e143f81fedab9b20205349ab04d73ed \
-    --hash=sha256:f278f034eb75b4e8a13a54a876cc4a5ab39173d2cdd93a638e1b467fc545ac43 \
-    --hash=sha256:f3f40b3c5a968281fd507d519e444c35f0ff171237f4fdde090dd60699458421 \
-    --hash=sha256:f490f9368b6fc026f021db16d7ec2fbf7d89e2edb42e8ec09d2c60505f5729c7 \
-    --hash=sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06 \
-    --hash=sha256:fc3d34d4a8fbec3e88a79b92e5465e0f9b842b628675850d860b8bd300b159f5
+pillow==12.3.0 \
+    --hash=sha256:00808c5e14ef63ac5161091d242999076604ff74b883423a11e5d7bbb38bf756 \
+    --hash=sha256:04f01d28a6aaff387bf842a13be313df23ba0597a44f1a976c9feb3c6ff4711a \
+    --hash=sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59 \
+    --hash=sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45 \
+    --hash=sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3 \
+    --hash=sha256:0dd2064cbc55aaec028ef5fbb60fa47bb6c3e7918e07ff17935284b227a9d2df \
+    --hash=sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139 \
+    --hash=sha256:10e41f0fbf1eec8cfd234b8fe17a4caac7c9d0db4c204d3c173a8f9f6ef3232b \
+    --hash=sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39 \
+    --hash=sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e \
+    --hash=sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8 \
+    --hash=sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1 \
+    --hash=sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8 \
+    --hash=sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89 \
+    --hash=sha256:236ff70b9312fb68943c703aa842ca6a758abfa45ac187a5e7c1452e96ef72b5 \
+    --hash=sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130 \
+    --hash=sha256:23d27a3e0307ec2244cc51e7287b919aa68d097504ebe19df4e76a98a3eea5bd \
+    --hash=sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d \
+    --hash=sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b \
+    --hash=sha256:25b9b82bb22e6e2b3cd07b39c68b7b862001226cb3dff7130d1cb914121b39ed \
+    --hash=sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace \
+    --hash=sha256:300557495eb45ebb8aec96c2da9c4be642fbf7cd937278b4013ba894ea8eb0eb \
+    --hash=sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931 \
+    --hash=sha256:331b624368d4f1d069149002f25f44bc61c8919ce8ddb3c45bdad8f6e2d89510 \
+    --hash=sha256:37d6d0a00072fd2948eb22bce7e1475f34569d90c87c59f7a2ec59541b77f7a6 \
+    --hash=sha256:37dc8f7bbb66efe481bb60defacef820c950c24713fb44962ed6aa2a50966de1 \
+    --hash=sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce \
+    --hash=sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385 \
+    --hash=sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e \
+    --hash=sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c \
+    --hash=sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7 \
+    --hash=sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace \
+    --hash=sha256:4f883547d4b7f0495ebe7056b0cc2aea76094e7a4abc8e933540f3271df27d9c \
+    --hash=sha256:514435a37670e3e5e08f3945b68718b6ed329bb84367777e16f9f4dfe1e61a0f \
+    --hash=sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64 \
+    --hash=sha256:5594fc43d548a7ed94949d139aa1341b270f1863f11cfd37f5a6c8b778a6b67f \
+    --hash=sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a \
+    --hash=sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827 \
+    --hash=sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17 \
+    --hash=sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4 \
+    --hash=sha256:6c0016e7b354317c4e9e525b937ac8596c38d2d232b419529b9cd7a1cd46e39a \
+    --hash=sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701 \
+    --hash=sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e \
+    --hash=sha256:78cb2c6865a35ab8ff8b75fd122f6033b92a62c82801110e48ddd6c936a45d91 \
+    --hash=sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66 \
+    --hash=sha256:85f998ea1848bc6757289e739cfbdda3a04adfd58b02fc018ce54d754a5ce468 \
+    --hash=sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217 \
+    --hash=sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658 \
+    --hash=sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418 \
+    --hash=sha256:8e95e1385e4998ae9694eeaa4730ba5457ff61185b3a55e2e7bea0880aef452a \
+    --hash=sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c \
+    --hash=sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330 \
+    --hash=sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402 \
+    --hash=sha256:a2b55dd6b2a4c4b7d87ffa56bdb33fdc5fdb9a462173861a7bc097f17d91cb09 \
+    --hash=sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930 \
+    --hash=sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f \
+    --hash=sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec \
+    --hash=sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a \
+    --hash=sha256:b343699e8308bdc51978310e1c959c584e7869cc8c40780058c87da7781a1e94 \
+    --hash=sha256:b3c777e849237620b022f7f297dd67705f9f5cf1685f09f02e46f93e92725468 \
+    --hash=sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b \
+    --hash=sha256:ba09209fbe443b4acccebe845d8a138b89a8f4fbaeedd44953490b5315d5e965 \
+    --hash=sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8 \
+    --hash=sha256:bcb46e2f9feff8d06323983bd83ed00c201fdcab3d74973e7072a889b3979fcd \
+    --hash=sha256:bcc33feacfaefce60c12fd500a277533bdc02b10a19f7f6d348763d8140bbba7 \
+    --hash=sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c \
+    --hash=sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777 \
+    --hash=sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35 \
+    --hash=sha256:d9c7f76c0673154f044e9d78c8655fb4213f6ca31a836df48b40fe5d187717b9 \
+    --hash=sha256:dbce0b29841537a2fa4a214c2bbf14de3587c9680caa9b4e217568472490b28f \
+    --hash=sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f \
+    --hash=sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0 \
+    --hash=sha256:e491916b378fba47242221bb9ead245211b70d504f495d105d17b14a24b4907c \
+    --hash=sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71 \
+    --hash=sha256:e7e480451b9fa137494bccd3a7d69adbe8ac65a87d97be61e11f1b1050a5bac3 \
+    --hash=sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838 \
+    --hash=sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf \
+    --hash=sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321 \
+    --hash=sha256:ebaea975e03d3141d9d3a507df75c9b3ec90fa9d2ffd07567b3a978d9d790b26 \
+    --hash=sha256:f0606c8bf2cdefea14a43530f7657cbbb7ecf1c4222512492ef4a4434a9501ec \
+    --hash=sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9 \
+    --hash=sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65 \
+    --hash=sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5 \
+    --hash=sha256:fbd139c8447d25dd750ab79ee274cc5e1fe80fc56340ab10b18a195e1b6eca3e \
+    --hash=sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d \
+    --hash=sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198 \
+    --hash=sha256:ffd0c5368496f41b0944be820fcb7a838aa6e623d250b01acf2643939c3f99d7
     # via
     #   qrcode
     #   reportlab
@@ -314,23 +276,23 @@ pycryptodome==3.23.0 \
     --hash=sha256:dea827b4d55ee390dc89b2afe5927d4308a8b538ae91d9c6f7a5090f397af1aa \
     --hash=sha256:e3f2d0aaf8080bda0587d58fc9fe4766e012441e2eed4269a77de6aea981c8be \
     --hash=sha256:eb8f24adb74984aa0e5d07a2368ad95276cf38051fe2dc6605cbcf482e04f2a7
-    # via -r requirements.in
-pypdf==6.13.3 \
-    --hash=sha256:c6e3f86afb625791510b02ad5480e94b63970bb957df75d44657c282ecc52224 \
-    --hash=sha256:f3cb822769725f1bac658c406cfc9460399043f3750c2d3e4650e0a85eacabd7
-    # via -r requirements.in
+    # via -r testing/cucumber/requirements.in
+pypdf==6.14.2 \
+    --hash=sha256:3f07891af76dc002657e04993ab9b4de81de29f9013b9761d0b7968bff12e946 \
+    --hash=sha256:7873f502fe4385e79539b21d872392dc0c4e3714327c15881cbc7fbfd1f95b25
+    # via -r testing/cucumber/requirements.in
 qrcode==8.2 \
     --hash=sha256:16e64e0716c14960108e85d853062c9e8bba5ca8252c0b4d0231b9df4060ff4f \
     --hash=sha256:35c3f2a4172b33136ab9f6b3ef1c00260dd2f66f858f24d88418a015f446506c
-    # via -r requirements.in
-reportlab==4.5.1 \
-    --hash=sha256:06fce8cb56c83307cfa4909cdf4e6a2ddbb44e5d6ef4d2edca896d7e9769f091 \
-    --hash=sha256:9fdf68f4de9171ec66acb4a5feed8f8ca2af43479e707a6fbb0daa75d88e5494
-    # via -r requirements.in
+    # via -r testing/cucumber/requirements.in
+reportlab==5.0.0 \
+    --hash=sha256:9d5a3affa84919e1111ede580031266a570e93b1ce388219621347965ff1d93c \
+    --hash=sha256:e4494a0c6623ae213bb856fba523171b2b54a7bf629fda02d5e525a7b899a784
+    # via -r testing/cucumber/requirements.in
 requests==2.34.2 \
     --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \
     --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed
-    # via -r requirements.in
+    # via -r testing/cucumber/requirements.in
 six==1.17.0 \
     --hash=sha256:4721f391ed90541fddacab5acf947aa0d3dc7d27b2e1e8eda2be8970586c3274 \
     --hash=sha256:ff70335d468e7eb6ec65b95b99d3a2836546063f63acc5171de367e834932a81

From 1954d2091043e61d2e0f1b074e582929f5618bbb Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:11:51 +0200
Subject: [PATCH 059/109] refactor(frontend): decouple signature status logic
 from PDF color palette (#6992)

# Description of Changes

- Moved the signature status-to-color mapping from `signatureStatus.ts`
to `pdfPalette.ts`.
- Removed the PDF palette dependency from the pure signature status
calculation module.
- Updated the PDF signature report to import the color mapping from the
palette module.
- Prevented signature status unit tests from initializing
browser-dependent CSS colors unnecessarily.
- Eliminated fallback warnings caused by unavailable theme CSS variables
in the Vitest environment.
- Preserved the existing signature status calculation and PDF report
color behavior.

```sh
[frontend:test:editor] stderr | src/core/hooks/tools/validateSignature/utils/signatureStatus.test.ts
[frontend:test:editor] CSS variable --pdf-light-header-bg not found, using fallback
[frontend:test:editor] CSS variable --pdf-light-accent not found, using fallback
[frontend:test:editor] CSS variable --pdf-light-text-primary not found, using fallback
[frontend:test:editor] CSS variable --pdf-light-text-muted not found, using fallback
[frontend:test:editor] CSS variable --pdf-light-box-bg not found, using fallback
[frontend:test:editor] CSS variable --pdf-light-box-border not found, using fallback
[frontend:test:editor] CSS variable --pdf-light-warning not found, using fallback
[frontend:test:editor] CSS variable --pdf-light-danger not found, using fallback
[frontend:test:editor] CSS variable --pdf-light-success not found, using fallback
[frontend:test:editor] CSS variable --pdf-light-neutral not found, using fallback
```

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../outputtedPDFSections/SignatureSection.ts       | 10 +++++-----
 .../tools/validateSignature/utils/pdfPalette.ts    | 14 ++++++++++++++
 .../validateSignature/utils/signatureStatus.ts     | 14 --------------
 3 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/frontend/editor/src/core/hooks/tools/validateSignature/outputtedPDFSections/SignatureSection.ts b/frontend/editor/src/core/hooks/tools/validateSignature/outputtedPDFSections/SignatureSection.ts
index 285dc825a7..1640067e30 100644
--- a/frontend/editor/src/core/hooks/tools/validateSignature/outputtedPDFSections/SignatureSection.ts
+++ b/frontend/editor/src/core/hooks/tools/validateSignature/outputtedPDFSections/SignatureSection.ts
@@ -3,12 +3,12 @@ import { PdfiumFont, PdfiumPage } from "@app/services/pdfiumDocBuilder";
 import { SignatureValidationSignature } from "@app/types/validateSignature";
 import { drawFieldBox } from "@app/hooks/tools/validateSignature/outputtedPDFSections/FieldBoxSection";
 import { drawStatusBadge } from "@app/hooks/tools/validateSignature/outputtedPDFSections/StatusBadgeSection";
-import {
-  computeSignatureStatus,
-  statusKindToPdfColor,
-} from "@app/hooks/tools/validateSignature/utils/signatureStatus";
+import { computeSignatureStatus } from "@app/hooks/tools/validateSignature/utils/signatureStatus";
 import { formatDate } from "@app/hooks/tools/validateSignature/utils/pdfText";
-import { colorPalette } from "@app/hooks/tools/validateSignature/utils/pdfPalette";
+import {
+  colorPalette,
+  statusKindToPdfColor,
+} from "@app/hooks/tools/validateSignature/utils/pdfPalette";
 
 interface DrawSignatureSectionOptions {
   page: PdfiumPage;
diff --git a/frontend/editor/src/core/hooks/tools/validateSignature/utils/pdfPalette.ts b/frontend/editor/src/core/hooks/tools/validateSignature/utils/pdfPalette.ts
index 1f321535d7..ba2ae1809b 100644
--- a/frontend/editor/src/core/hooks/tools/validateSignature/utils/pdfPalette.ts
+++ b/frontend/editor/src/core/hooks/tools/validateSignature/utils/pdfPalette.ts
@@ -1,4 +1,5 @@
 import { rgb } from "@app/services/pdfiumDocBuilder";
+import type { SignatureStatusKind } from "@app/hooks/tools/validateSignature/utils/signatureStatus";
 
 type RgbTuple = [number, number, number];
 
@@ -93,3 +94,16 @@ export const colorPalette = {
     defaultLightPalette.neutral,
   ),
 };
+
+export const statusKindToPdfColor = (kind: SignatureStatusKind) => {
+  switch (kind) {
+    case "valid":
+      return colorPalette.success;
+    case "warning":
+      return colorPalette.warning;
+    case "invalid":
+      return colorPalette.danger;
+    default:
+      return colorPalette.neutral;
+  }
+};
diff --git a/frontend/editor/src/core/hooks/tools/validateSignature/utils/signatureStatus.ts b/frontend/editor/src/core/hooks/tools/validateSignature/utils/signatureStatus.ts
index 4f46641d4c..2355dd6638 100644
--- a/frontend/editor/src/core/hooks/tools/validateSignature/utils/signatureStatus.ts
+++ b/frontend/editor/src/core/hooks/tools/validateSignature/utils/signatureStatus.ts
@@ -1,6 +1,5 @@
 import type { TFunction } from "i18next";
 import type { SignatureValidationSignature } from "@app/types/validateSignature";
-import { colorPalette } from "@app/hooks/tools/validateSignature/utils/pdfPalette";
 
 export type SignatureStatusKind = "valid" | "warning" | "invalid" | "neutral";
 
@@ -131,16 +130,3 @@ export const computeSignatureStatus = (
     details: issues,
   };
 };
-
-export const statusKindToPdfColor = (kind: SignatureStatusKind) => {
-  switch (kind) {
-    case "valid":
-      return colorPalette.success;
-    case "warning":
-      return colorPalette.warning;
-    case "invalid":
-      return colorPalette.danger;
-    default:
-      return colorPalette.neutral;
-  }
-};

From c19d56de227501829209c34c7933ba3f9f21798c Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Mon, 20 Jul 2026 14:51:55 +0100
Subject: [PATCH 060/109] PAYG usage card: review follow-ups (avg/PDF,
 empty-state, unique wording) (#6967)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Small follow-up to #6957 addressing the three non-blocker findings from
its review. **Draft / stacked on #6957** — the diff shows #6957's
changes until it merges, then auto-narrows to just these 5 files. Mark
ready + rebase onto `main` once #6957 lands.

### 1. avg-per-PDF no longer blends unsynced units over synced-only docs
`avgCostMinor` now divides **synced** units (`spendUnitsThisPeriod`) by
synced docs, so numerator and denominator cover the same population.
Combined-billing `pendingUnits` (units-only, no doc count) previously
inflated the average for linked-instance teams. The "meter units" figure
still shows synced+pending (total current usage) — only the *average* is
synced-only.

### 2. Empty-state: unsynced-only reads cleanly
When `docs == 0` but there are pending meter units (combined-billing,
nothing synced yet), the card showed a bare **"0 PDFs"** headline with a
count-less summary and no split. It now shows a **"{n} meter units
pending sync from linked instances"** note instead. New `unitsPending`
i18n key + a `UnsyncedOnly` story. (Only reachable on the
combined-billing path; pure-SaaS teams are unaffected.)

### 3. uniquePdfs wording is now accurate
`document_fingerprint` is a hash of a charge's whole **input set**, so
the same file reused across *different* groupings (standalone, then
later in a merge `{A,B}`) counts per grouping — a close approximation of
"unique PDFs", exact for the single-input common case. Softened the FE
type doc + the `WalletLedgerEntry.document_fingerprint` javadoc to say
so (no behaviour change; counting model unchanged).

### Verification
FE typecheck / test / lint / format all clean; `:saas:compileJava`
green. No behaviour change beyond #1 (avg) and #2 (empty-state copy); #3
is doc-only.
---
 .../saas/payg/wallet/WalletLedgerEntry.java   | 10 +++++--
 .../public/locales/en-US/translation.toml     |  2 ++
 .../billing/PdfsProcessedCard.stories.tsx     | 23 +++++++++++++++
 .../components/billing/PdfsProcessedCard.tsx  | 28 +++++++++++++------
 .../editor/src/proprietary/billing/types.ts   |  8 +++++-
 5 files changed, 58 insertions(+), 13 deletions(-)

diff --git a/app/saas/src/main/java/stirling/software/saas/payg/wallet/WalletLedgerEntry.java b/app/saas/src/main/java/stirling/software/saas/payg/wallet/WalletLedgerEntry.java
index fab6647b2c..4b64629660 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/wallet/WalletLedgerEntry.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/wallet/WalletLedgerEntry.java
@@ -87,9 +87,13 @@ public class WalletLedgerEntry implements Serializable {
     private Integer docCount = 1;
 
     /**
-     * SHA-256 of this entry's input file set; {@code COUNT(DISTINCT ...)} over a period gives
-     * unique PDFs processed. {@code null} for aggregate/system entries (grants, linked-instance
-     * sync) that don't map to a single document set.
+     * SHA-256 of this entry's input file <em>set</em> (the charge's whole input list, sorted).
+     * {@code COUNT(DISTINCT ...)} over a period approximates unique PDFs processed. Exact within a
+     * run (a file's chain/split steps share the run's charge, so one fingerprint), and for the
+     * single-input common case; but the <em>same</em> file reused across different groupings — e.g.
+     * standalone, then later merged as {A,B} — yields different set-fingerprints and is counted
+     * once per grouping. {@code null} for aggregate/system entries (grants, linked-instance sync)
+     * that don't map to a single document set.
      */
     @Column(name = "document_fingerprint", length = 64)
     private String documentFingerprint;
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 1589cad8a7..49dfb66bc4 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6266,6 +6266,8 @@ sizeMultiplier = "{{formatted}} PDFs used a size multiplier"
 summary = "{{unique}} unique · {{units}} meter units · {{avg}} avg per PDF"
 summaryNoRate = "{{unique}} unique · {{units}} meter units"
 unit = "PDFs"
+unitsPending_one = "{{units}} meter unit pending sync from linked instances"
+unitsPending_other = "{{units}} meter units pending sync from linked instances"
 
 [portal.billing.spendLimit]
 adjustLimit = "Adjust limit"
diff --git a/frontend/editor/src/portal/components/billing/PdfsProcessedCard.stories.tsx b/frontend/editor/src/portal/components/billing/PdfsProcessedCard.stories.tsx
index d7da10398b..e06c07ec94 100644
--- a/frontend/editor/src/portal/components/billing/PdfsProcessedCard.stories.tsx
+++ b/frontend/editor/src/portal/components/billing/PdfsProcessedCard.stories.tsx
@@ -43,3 +43,26 @@ export const Empty: Story = {
     },
   },
 };
+
+/** Combined-billing: zero synced PDFs but unsynced instance units → "pending sync" note (no 0-PDF summary). */
+export const UnsyncedOnly: Story = {
+  args: {
+    wallet: {
+      ...subscribedWallet,
+      billableUsed: 0,
+      spendUnitsThisPeriod: 0,
+      categoryBreakdown: { api: 0, ai: 0, automation: 0 },
+      categoryDocs: { api: 0, ai: 0, automation: 0 },
+      docsProcessedThisPeriod: 0,
+      uniquePdfsThisPeriod: 0,
+      sizeMultiplierPdfsThisPeriod: 0,
+    },
+    unsynced: {
+      periodStart: subscribedWallet.billingPeriodStart,
+      apiUnsyncedUnits: 8,
+      aiUnsyncedUnits: 0,
+      automationUnsyncedUnits: 4,
+      totalUnsyncedUnits: 12,
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/billing/PdfsProcessedCard.tsx b/frontend/editor/src/portal/components/billing/PdfsProcessedCard.tsx
index 794ac39ae5..d36da95dd3 100644
--- a/frontend/editor/src/portal/components/billing/PdfsProcessedCard.tsx
+++ b/frontend/editor/src/portal/components/billing/PdfsProcessedCard.tsx
@@ -73,17 +73,15 @@ export function PdfsProcessedCard({
   const perDocs: WalletCategoryBreakdown = wallet.categoryDocs;
   const totalDocs = perDocs.api + perDocs.ai + perDocs.automation;
 
-  // Average cost per PDF in minor currency units — meter units × the per-unit rate,
-  // spread over the input files processed. Shown only when the rate is known (free-tier
-  // and unknown-price snapshots omit the term rather than imply $0.00).
+  // Average cost per PDF in minor currency units — SYNCED units × the per-unit rate,
+  // spread over the (synced) input files. Deliberately excludes combined-billing
+  // pendingUnits: those are units-only (no doc count), so dividing them over synced docs
+  // would inflate the average. Numerator and denominator therefore cover the same
+  // population. Shown only when the rate is known (free-tier / unknown-price omit it).
   const rate = wallet.pricePerDocMinor;
   const showAvgCost = docs > 0 && rate != null;
   const avgCostMinor =
-    rate != null && docs > 0 ? (meterUnits / docs) * rate : 0;
-
-  // Something ran once there are either counted PDFs or metered units (instance-local
-  // unsynced usage is units-only, so it keeps the card out of the empty state).
-  const hasActivity = docs > 0 || meterUnits > 0;
+    rate != null && docs > 0 ? (wallet.spendUnitsThisPeriod / docs) * rate : 0;
 
   return (
     <Card padding="loose">
@@ -100,7 +98,7 @@ export function PdfsProcessedCard({
         </span>
       </div>
 
-      {hasActivity ? (
+      {docs > 0 ? (
         <>
           <p className="portal-billing__section-sub">
             {showAvgCost
@@ -182,6 +180,18 @@ export function PdfsProcessedCard({
             </p>
           ) : null}
         </>
+      ) : pendingUnits > 0 ? (
+        // docs == 0 but instance-local units have accrued that SaaS hasn't billed yet
+        // (combined-billing, units-only, no PDF count). Surface the pending figure directly
+        // instead of a bare "0 PDFs" headline with a count-less summary + no split. Gated on
+        // pendingUnits (not meterUnits) so the "pending sync" wording is always exact.
+        <p className="portal-billing__section-sub">
+          {t(
+            "portal.billing.pdfsProcessed.unitsPending",
+            "{{units}} meter units pending sync from linked instances",
+            { count: pendingUnits, units: pendingUnits.toLocaleString() },
+          )}
+        </p>
       ) : (
         <p className="portal-billing__section-sub">
           {t(
diff --git a/frontend/editor/src/proprietary/billing/types.ts b/frontend/editor/src/proprietary/billing/types.ts
index df0caa5e39..46fd228f73 100644
--- a/frontend/editor/src/proprietary/billing/types.ts
+++ b/frontend/editor/src/proprietary/billing/types.ts
@@ -66,7 +66,13 @@ export interface Wallet {
   categoryDocs: WalletCategoryBreakdown;
   /** Total input files processed this period (Σ doc_count). */
   docsProcessedThisPeriod: number;
-  /** Distinct input documents this period — a file hit by N operations counts once. */
+  /**
+   * Distinct input document-sets this period — `COUNT(DISTINCT document_fingerprint)`, where the
+   * fingerprint is the hash of a charge's whole input set. A file processed repeatedly within one
+   * run (chain/split) counts once; the same file reused across *different* groupings (e.g.
+   * standalone, then later in a merge {A,B}) has different fingerprints and so counts per grouping.
+   * A close approximation of "unique PDFs", exact for the single-input common case.
+   */
   uniquePdfsThisPeriod: number;
   /** Input files on charges where the size multiplier applied (units billed &gt; input files). */
   sizeMultiplierPdfsThisPeriod: number;

From 0fc2958daa0fa5b01f07acba53799a737d21a566 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Mon, 20 Jul 2026 16:23:11 +0100
Subject: [PATCH 061/109] Add explicit length to member column to avoid ddl
 resizing (#7109)

# Description of Changes
There's currently a column size inconsistency between the SaaS v3 DB and
the main Java code which causes the backend to fail to start up when
connected to a fresh DB. This is because the column previously was width
255, but now it's officially width 50, but the Java type is still
implicitly `varchar(255)` because there's no length attribute. If it's a
fresh DB, Postgres throws an error that it can't expand the column (this
doesn't error on an existing DB because the column is already wide
enough behind the scenes).

Co-authored-by: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
---
 .../stirling/software/proprietary/model/TeamMembership.java     | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamMembership.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamMembership.java
index 08de0b190d..27370870c4 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamMembership.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamMembership.java
@@ -60,7 +60,7 @@ public class TeamMembership implements Serializable {
     private User user;
 
     @Enumerated(EnumType.STRING)
-    @Column(name = "role", nullable = false)
+    @Column(name = "role", nullable = false, length = 50)
     @ToString.Include
     private TeamRole role = TeamRole.MEMBER;
 

From bda9cebc5cfca36b3b365f3c79985d64a535d92c Mon Sep 17 00:00:00 2001
From: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Date: Mon, 20 Jul 2026 16:29:46 +0100
Subject: [PATCH 062/109] Portal ProcessorFlow: proportional particle emission
 + Storybook playground (#7105)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary
Follow-up polish to the home **PDF Processor** flow visualiser (base
landed in #7014). Tunes the particle animation to react to real volume
and adds a Storybook playground to tune it live.

## Changes
### Particle emission — `useFlowParticles.ts`, `flowTypes.ts`
- Emission rate now scales ~linearly with a source's 24h volume (**2×
volume ≈ 2× dots**) instead of the flat `rate / 86400 × SPEED`, capped
at **one dot / 250ms** (`MAX_EMIT_PER_SEC`) for busy sources (~≥
800/24h).
- Bounded the spread so the busiest source emits at most **5×** the
quietest (`EMIT_SPREAD_CAP`) — a dominant source can't starve the
others.
- Wider departure jitter (`[0.4×–1.7×]` the mean, still floored at the
per-source min-gap) and ~**2× faster travel** so the flow reads
livelier.
- Replaced the single `SPEED` constant with `EMIT_DIVISOR` /
`MAX_EMIT_PER_SEC` / `EMIT_SPREAD_CAP`. Weighted round-robin outcome
split is unchanged (e.g. 3 failed / 30 delivered → ~1 red dot in 11).

### Storybook Playground — `ProcessorFlow.stories.tsx`,
`ProcessorFlow.tsx`
- New **Playground** story with live controls: per-input rate sliders,
the delivered/failed split (drives the red-dot ratio), and a
Classification-active toggle.
- Added an optional `dataOverride` prop (prod-inert testing seam) so the
story renders a supplied flow model instead of fetching — changes apply
instantly.

### Housekeeping
- Condensed authored comments across the feature to ≤ 2 lines.

## Testing
- `task frontend:check` green — lint, typecheck, 1353 tests.
- Verified emission numerically (proportionality, 250ms ceiling, 5×
spread cap) and confirmed live animation in a focused Storybook tab.
---
 frontend/editor/src/core/ui/StatusBadge.css   |   5 +-
 .../editor/src/portal/api/processorFlow.ts    |  44 ++----
 .../src/portal/components/ProcessorFlow.css   |   5 +-
 .../components/ProcessorFlow.stories.tsx      | 149 ++++++++++++++++--
 .../src/portal/components/ProcessorFlow.tsx   |  28 ++--
 .../components/processor-flow/FlowSankey.tsx  |   7 +-
 .../components/processor-flow/flowTypes.ts    |  15 +-
 .../processor-flow/useFlowGeometry.tsx        |  12 +-
 .../processor-flow/useFlowParticles.ts        |  66 ++++----
 frontend/editor/src/portal/mocks/policies.ts  |  17 +-
 frontend/editor/src/portal/views/Sources.css  |   5 +-
 11 files changed, 213 insertions(+), 140 deletions(-)

diff --git a/frontend/editor/src/core/ui/StatusBadge.css b/frontend/editor/src/core/ui/StatusBadge.css
index 9115eb6099..62f6fb0f3a 100644
--- a/frontend/editor/src/core/ui/StatusBadge.css
+++ b/frontend/editor/src/core/ui/StatusBadge.css
@@ -55,9 +55,8 @@
   background: var(--color-bg-muted);
   border-color: var(--color-border-light);
 }
-/* Accent tones only pick the accent; the base rule builds the fill + border.
-   The `-dark` variants are theme-adaptive (darker in light, brighter in dark),
-   so the text stays legible on the pale fill in both themes. */
+/* Tones only pick the accent; the base rule builds the fill + border. `-dark`
+   is theme-adaptive, so text stays legible on the pale fill in both themes. */
 .sui-status--success {
   --sui-status-c: var(--color-green-dark);
 }
diff --git a/frontend/editor/src/portal/api/processorFlow.ts b/frontend/editor/src/portal/api/processorFlow.ts
index 30a9b468a6..35adc9c89f 100644
--- a/frontend/editor/src/portal/api/processorFlow.ts
+++ b/frontend/editor/src/portal/api/processorFlow.ts
@@ -1,18 +1,5 @@
-/**
- * Processor-flow assembler for the home visualiser.
- *
- * Fans in the three real portal surfaces — sources (`/api/v1/sources`), policies
- * (`/api/v1/policies`) and their runs (`/api/v1/policies/runs`) — and derives the
- * left→middle→right shape the {@link ProcessorFlow} component renders:
- *
- *   sources  →  policies  →  outcomes
- *
- * Everything here is real backend data. Per-run source attribution does not
- * exist (a `PolicyRunView` carries `policyId` but no source id), so the flow
- * animation is illustrative; the node counts are not — each source's `docs24h`,
- * each policy's trailing-24h run count, and the success/failure split all come
- * straight from the API.
- */
+/** Assembles the home visualiser's sources → policies → outcomes from the real
+ *  sources/policies/runs APIs. Counts are real; the flow motion is illustrative. */
 
 import { apiClient } from "@portal/api/http";
 import { fetchSources } from "@portal/api/sources";
@@ -30,27 +17,19 @@ export interface FlowSource {
   docs24h: number;
 }
 
-/**
- * A connector type shown in the sources column but not yet a real source type —
- * a "coming soon" affordance only. `labelKey` is an i18n key.
- */
+/** A "coming soon" connector shown in the sources column but not a real source
+ *  type yet. `labelKey` is an i18n key. */
 export interface FlowComingSoonSource {
   key: string;
   labelKey: string;
 }
 
-/**
- * Row display state, mirroring the Policies page:
- *   - `active`  — configured + enabled; shows its live 24h run count
- *   - `off`     — available but not set up; offers a "Set up" CTA
- *   - `locked`  — a coming-soon category that doesn't exist yet
- */
+/** Row state (mirrors the Policies page): `active` = configured+enabled with a
+ *  24h count, `off` = available (offers "Set up"), `locked` = coming-soon. */
 export type FlowPolicyState = "active" | "off" | "locked";
 
-/**
- * One row in the middle policies column — the full policy catalogue, in the
- * same order the Policies page shows, including the coming-soon categories.
- */
+/** One policies-column row — the full catalogue in Policies-page order,
+ *  including the coming-soon categories. */
 export interface FlowPolicy {
   /** Category id (also the lane key for the flow animation + its icon). */
   key: string;
@@ -92,11 +71,8 @@ const COMING_SOON_SOURCES: FlowComingSoonSource[] = [
   },
 ];
 
-/**
- * The full policy catalogue, in the Policies-page order, including the
- * coming-soon categories (rendered as locked). `active` rows carry their
- * trailing-24h run count.
- */
+/** Full catalogue in Policies-page order (coming-soon → locked); `active` rows
+ *  carry their trailing-24h run count. */
 function buildPolicies(
   wirePolicies: WirePolicy[],
   runs: PolicyRunView[],
diff --git a/frontend/editor/src/portal/components/ProcessorFlow.css b/frontend/editor/src/portal/components/ProcessorFlow.css
index 5aa7f6198f..7e020d0253 100644
--- a/frontend/editor/src/portal/components/ProcessorFlow.css
+++ b/frontend/editor/src/portal/components/ProcessorFlow.css
@@ -1,6 +1,5 @@
-/* Processor-flow visualiser — sources → policies → outcomes. The flow is an
-   SVG overlay measured from the HTML cards: bézier wires underneath, and a
-   rAF-driven particle layer on top (see ProcessorFlow.tsx). */
+/* Processor-flow visualiser: SVG overlay (bézier wires + rAF particle layer)
+   measured from the HTML cards. See ProcessorFlow.tsx. */
 
 .portal-pf {
   --pf-accent: var(--color-green);
diff --git a/frontend/editor/src/portal/components/ProcessorFlow.stories.tsx b/frontend/editor/src/portal/components/ProcessorFlow.stories.tsx
index e573751ac6..0622b31e55 100644
--- a/frontend/editor/src/portal/components/ProcessorFlow.stories.tsx
+++ b/frontend/editor/src/portal/components/ProcessorFlow.stories.tsx
@@ -1,17 +1,14 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { http, HttpResponse } from "msw";
 import { ProcessorFlow } from "@portal/components/ProcessorFlow";
+import type {
+  FlowOutcome,
+  FlowPolicy,
+  ProcessorFlow as ProcessorFlowModel,
+} from "@portal/api/processorFlow";
 
-/**
- * The home processor visualiser. Data is served by the global portal MSW
- * handlers (seeded sources + one active Security policy + its runs), so the
- * middle column shows Security "active" and Classification with a "Set up" CTA,
- * and the outcomes reflect the seeded 24h success/failure split.
- *
- * NB: the flow particles animate via requestAnimationFrame, which browsers
- * pause while the tab/preview is hidden — open the story in a focused tab to
- * see the dots move.
- */
+/** Home processor visualiser, backed by the global portal MSW handlers.
+ *  Particles animate via rAF (paused for hidden tabs — view in a focused tab). */
 const meta: Meta<typeof ProcessorFlow> = {
   title: "Portal/Components/ProcessorFlow",
   component: ProcessorFlow,
@@ -24,11 +21,8 @@ type Story = StoryObj<typeof ProcessorFlow>;
 /** Live machine: Security configured + real throughput → the flow runs. */
 export const Default: Story = {};
 
-/**
- * Nothing set up and no activity — the empty state from the design. In
- * production the flow stays still here; the DEV_KEEP_FLOWING dev flag forces it
- * on with synthetic rates so the animation is visible while iterating.
- */
+/** Nothing set up and no activity — the empty state. The flow stays still here
+ *  in production (DEV_KEEP_FLOWING can force it on while iterating). */
 export const IdleEmpty: Story = {
   parameters: {
     msw: {
@@ -58,3 +52,128 @@ export const IdleEmpty: Story = {
     },
   },
 };
+
+/* ── Playground ───────────────────────────────────────────────────────────── */
+
+interface PlaygroundArgs {
+  /** Editor input volume (docs / 24h). */
+  editorRate: number;
+  /** "Claims intake" input volume (docs / 24h). */
+  claimsRate: number;
+  /** "Contracts drop" input volume (docs / 24h). */
+  contractsRate: number;
+  /** Delivered (success) outcomes over 24h. */
+  delivered: number;
+  /** Failed outcomes over 24h — drives the red-dot ratio. */
+  failed: number;
+  /** Whether the Classification policy is active (a second particle lane). */
+  classificationActive: boolean;
+}
+
+const CATEGORY_LABEL = (id: string) => `portal.policies.categories.${id}.label`;
+
+/** Build a flow model from the playground controls. */
+function buildModel(a: PlaygroundArgs): ProcessorFlowModel {
+  const sources = [
+    { id: "editor", name: "Editor", type: "editor", docs24h: a.editorRate },
+    {
+      id: "claims",
+      name: "Claims intake",
+      type: "folder",
+      docs24h: a.claimsRate,
+    },
+    {
+      id: "contracts",
+      name: "Contracts drop",
+      type: "folder",
+      docs24h: a.contractsRate,
+    },
+  ];
+  const policies: FlowPolicy[] = [
+    {
+      key: "ingestion",
+      labelKey: CATEGORY_LABEL("ingestion"),
+      state: "locked",
+      configured: false,
+      runs24h: 0,
+    },
+    {
+      key: "security",
+      labelKey: CATEGORY_LABEL("security"),
+      state: "active",
+      configured: true,
+      runs24h: Math.round(a.delivered * 0.6),
+    },
+    {
+      key: "classification",
+      labelKey: CATEGORY_LABEL("classification"),
+      state: a.classificationActive ? "active" : "off",
+      configured: a.classificationActive,
+      runs24h: a.classificationActive ? Math.round(a.delivered * 0.4) : 0,
+    },
+    {
+      key: "compliance",
+      labelKey: CATEGORY_LABEL("compliance"),
+      state: "locked",
+      configured: false,
+      runs24h: 0,
+    },
+    {
+      key: "routing",
+      labelKey: CATEGORY_LABEL("routing"),
+      state: "locked",
+      configured: false,
+      runs24h: 0,
+    },
+    {
+      key: "retention",
+      labelKey: CATEGORY_LABEL("retention"),
+      state: "locked",
+      configured: false,
+      runs24h: 0,
+    },
+  ];
+  const outcomes: FlowOutcome[] = [
+    {
+      key: "success",
+      labelKey: "portal.processorFlow.outcomes.success",
+      count24h: a.delivered,
+    },
+    {
+      key: "failed",
+      labelKey: "portal.processorFlow.outcomes.failed",
+      count24h: a.failed,
+    },
+  ];
+  const comingSoonSources = [
+    {
+      key: "apiMcp",
+      labelKey: "portal.processorFlow.sources.comingSoon.apiMcp",
+    },
+    { key: "cloud", labelKey: "portal.processorFlow.sources.comingSoon.cloud" },
+    { key: "email", labelKey: "portal.processorFlow.sources.comingSoon.email" },
+  ];
+  return { sources, comingSoonSources, policies, outcomes };
+}
+
+/** Tune each input rate and the delivered/failed split live to watch emission
+ *  speed, per-source scaling, the 250ms ceiling, and the ratio (focused tab). */
+export const Playground: StoryObj<PlaygroundArgs> = {
+  args: {
+    editorRate: 400,
+    claimsRate: 800,
+    contractsRate: 150,
+    delivered: 90,
+    failed: 10,
+    classificationActive: true,
+  },
+  argTypes: {
+    editorRate: { control: { type: "range", min: 0, max: 2000, step: 10 } },
+    claimsRate: { control: { type: "range", min: 0, max: 2000, step: 10 } },
+    contractsRate: { control: { type: "range", min: 0, max: 2000, step: 10 } },
+    delivered: { control: { type: "number", min: 0 } },
+    failed: { control: { type: "number", min: 0 } },
+    classificationActive: { control: "boolean" },
+  },
+  render: (args) => <ProcessorFlow dataOverride={buildModel(args)} />,
+};
diff --git a/frontend/editor/src/portal/components/ProcessorFlow.tsx b/frontend/editor/src/portal/components/ProcessorFlow.tsx
index 4b4a832ad3..af9e318ba4 100644
--- a/frontend/editor/src/portal/components/ProcessorFlow.tsx
+++ b/frontend/editor/src/portal/components/ProcessorFlow.tsx
@@ -25,25 +25,21 @@ import { FlowOutcomes } from "@portal/components/processor-flow/FlowOutcomes";
 import { FlowSankey } from "@portal/components/processor-flow/FlowSankey";
 import "@portal/components/ProcessorFlow.css";
 
-/**
- * Animated processor visualiser for the home surface: connected sources on the
- * left flow through the standing policies in the middle to their audit outcomes
- * on the right. Two lenses — a live particle flow and a Sankey summary.
- *
- * This module wires the data + gating together; the moving parts live under
- * `processor-flow/`: geometry ({@link useFlowGeometry}), the rAF particle loop
- * ({@link useFlowParticles}), the three columns, and the Sankey. The flow only
- * runs when something is set up AND there's activity; an idle machine stays
- * still (unless {@link DEV_KEEP_FLOWING} forces it while iterating).
- */
-export function ProcessorFlow() {
+/** Home processor visualiser: sources → policies → outcomes, as a live particle
+ *  flow or a Sankey. Data + gating here; moving parts live under `processor-flow/`. */
+interface ProcessorFlowProps {
+  /** Testing seam: render this model directly instead of fetching. Never set in
+   *  the app — used by the Playground story to drive rates/counts from controls. */
+  dataOverride?: ProcessorFlowModel;
+}
+
+export function ProcessorFlow({ dataOverride }: ProcessorFlowProps = {}) {
   const { t } = useTranslation();
   const { setActiveView } = useView();
   const navigate = useNavigate();
-  const { data, loading } = useAsync<ProcessorFlowModel>(
-    () => fetchProcessorFlow(),
-    [],
-  );
+  const fetched = useAsync<ProcessorFlowModel>(() => fetchProcessorFlow(), []);
+  const data = dataOverride ?? fetched.data;
+  const loading = dataOverride ? false : fetched.loading;
 
   const [lens, setLens] = useState<Lens>("flow");
   const isLoading = loading && data === null;
diff --git a/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx b/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx
index 1d90705c2c..43170a21a4 100644
--- a/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx
+++ b/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx
@@ -18,11 +18,8 @@ interface FlowSankeyProps {
   policies: FlowPolicy[];
 }
 
-/**
- * Sankey lens: sources → policies waist → outcomes, ribbon width ∝ 24h volume.
- * The waist splits into one segment per active policy. Shows a friendly empty
- * state when nothing has flowed yet.
- */
+/** Sankey lens: sources → policies waist → outcomes, ribbon width ∝ 24h volume;
+ *  the waist splits per active policy. Empty state when nothing has flowed. */
 export function FlowSankey({ sources, outcomes, policies }: FlowSankeyProps) {
   const { t } = useTranslation();
   const activePolicies = policies.filter((p) => p.state === "active");
diff --git a/frontend/editor/src/portal/components/processor-flow/flowTypes.ts b/frontend/editor/src/portal/components/processor-flow/flowTypes.ts
index 217d35760f..f8f0edd578 100644
--- a/frontend/editor/src/portal/components/processor-flow/flowTypes.ts
+++ b/frontend/editor/src/portal/components/processor-flow/flowTypes.ts
@@ -3,18 +3,17 @@ import type { FlowOutcomeKey } from "@portal/api/processorFlow";
 /** Which lens the visualiser is showing. */
 export type Lens = "flow" | "sankey";
 
-/**
- * DEV ONLY: force the flow animation on even when nothing is set up / no
- * activity has taken place, using synthetic rates. Off by design — an idle
- * machine shows no animated dots; flip to true only to preview the motion
- * while iterating on an empty workspace.
- */
+/** DEV ONLY: force the flow on (synthetic rates) even when idle. Off by design;
+ *  flip to true only to preview the motion on an empty workspace. */
 export const DEV_KEEP_FLOWING = false;
 
 export const EDITOR_TYPE = "editor";
 
-/** Emission tuning: particles/sec for a source ≈ rate / 86400 × SPEED. */
-export const SPEED = 300;
+/** Emission tuning: dots/sec ≈ rate / EMIT_DIVISOR (2× volume ≈ 2× dots), capped
+ *  at MAX_EMIT_PER_SEC (250ms) and bounded to ≤EMIT_SPREAD_CAP× across sources. */
+export const EMIT_DIVISOR = 200;
+export const MAX_EMIT_PER_SEC = 4;
+export const EMIT_SPREAD_CAP = 5;
 /** Synthetic per-source rate used only while DEV_KEEP_FLOWING forces the flow. */
 export const DEV_SYNTH_RATE = 320;
 /** Hard cap on live particles (matches the reference). */
diff --git a/frontend/editor/src/portal/components/processor-flow/useFlowGeometry.tsx b/frontend/editor/src/portal/components/processor-flow/useFlowGeometry.tsx
index 1e43ebc161..6e0179dadb 100644
--- a/frontend/editor/src/portal/components/processor-flow/useFlowGeometry.tsx
+++ b/frontend/editor/src/portal/components/processor-flow/useFlowGeometry.tsx
@@ -11,16 +11,8 @@ import {
   type Rect,
 } from "@portal/components/processor-flow/flowTypes";
 
-/**
- * Owns the measured-geometry seam for the flow visualiser: refs for the source,
- * outcome and core cards (plus the per-policy lane lines), a `measure()` that
- * projects their edges into a wrapper-relative {@link Geo}, and the SVG wires
- * drawn between them. The particle loop reads the same `geoRef` live.
- *
- * Callers spread the returned refs onto the cards and render `wires` inside the
- * underlay `<svg>`; geometry re-measures on every layout + on resize, and the
- * wires re-render only when the measured signature actually changes.
- */
+/** Measures card edges into a wrapper-relative {@link Geo} and builds the SVG
+ *  wires; returns the refs + wires. The particle loop reads the same `geoRef`. */
 export function useFlowGeometry() {
   const wrapRef = useRef<HTMLDivElement>(null);
   const srcRefs = useRef<(HTMLElement | null)[]>([]);
diff --git a/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts b/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts
index 0d19ab5295..7efbee40e2 100644
--- a/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts
+++ b/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts
@@ -4,10 +4,12 @@ import {
   cbez,
   coreEntryY,
   smooth,
+  EMIT_DIVISOR,
+  EMIT_SPREAD_CAP,
+  MAX_EMIT_PER_SEC,
   MAX_PARTICLES,
   MIN_EMIT_GAP,
   OUTCOME_FILL,
-  SPEED,
   type Geo,
   type Lens,
   type Particle,
@@ -28,17 +30,8 @@ interface FlowParticlesOptions {
   outcomeKeys: FlowOutcomeKey[];
 }
 
-/**
- * Drives the rAF particle loop: emits dots per source on a jittered schedule
- * (min-gap floored), routes each to an outcome via a weighted round-robin so
- * the split matches the counts, threads it through a policy lane (blinking that
- * row's LED), and recolours it to the outcome on arrival. Reads geometry live
- * from `geoRef`, so it tracks card movement without restarting.
- *
- * Returns the `<g>` ref the caller mounts inside the particle overlay `<svg>`.
- * The loop only runs on the flow lens, when `animate` is set, and outside
- * reduced-motion; browsers pause rAF for hidden tabs (desirable).
- */
+/** rAF particle loop: emits jittered dots per source, routes each to an outcome by
+ *  weighted round-robin through a policy lane. Returns the overlay `<g>` ref. */
 export function useFlowParticles({
   geoRef,
   animate,
@@ -76,25 +69,30 @@ export function useFlowParticles({
     let raf = 0;
     const glowTimers: Record<string, ReturnType<typeof setTimeout>> = {};
 
-    // Per-source emission schedule. Mean interval keeps each source's share of
-    // the flow proportional to its rate; the scheduled model (vs. a steady
-    // accumulator) is what lets us jitter departures and floor the gap.
-    const meanInterval = rates.map((r) => {
-      const perSec = (r / 86400) * SPEED;
-      return perSec > 0 ? 1000 / perSec : Infinity;
-    });
+    // Per-source dots/sec: ~linear with volume, capped at MAX_EMIT_PER_SEC.
+    // Scheduled (not accumulated) so we can jitter departures and floor the gap.
+    const rawPerSec = rates.map((r) =>
+      r > 0 ? Math.min(MAX_EMIT_PER_SEC, r / EMIT_DIVISOR) : 0,
+    );
+    // Bound the spread: the busiest source emits at most EMIT_SPREAD_CAP× the
+    // quietest, so a dominant source can't starve the others.
+    const busiest = Math.max(0, ...rawPerSec);
+    const floorPerSec = busiest / EMIT_SPREAD_CAP;
+    const meanInterval = rawPerSec.map((p) =>
+      p > 0 ? 1000 / Math.max(p, floorPerSec) : Infinity,
+    );
     // Stagger the first emission so sources don't all fire together at t=0.
     const nextEmit = meanInterval.map((mi) =>
       Number.isFinite(mi) ? last + Math.random() * mi : Infinity,
     );
-    // Random departure within [0.5×, 1.5×] the mean, but never closer than the
-    // minimum gap — a random flow with no two dots out at once per source.
+    // Random departure within [0.4×, 1.7×] the mean, but never closer than the
+    // minimum gap — a scattered flow with no two dots out at once per source.
     const scheduleNext = (i: number, now: number): number =>
-      now + Math.max(MIN_EMIT_GAP, meanInterval[i] * (0.5 + Math.random()));
+      now +
+      Math.max(MIN_EMIT_GAP, meanInterval[i] * (0.4 + Math.random() * 1.3));
 
-    // Weighted round-robin so the outcome split visibly matches the counts
-    // (e.g. 3 failed / 30 delivered → ~1 in 11 dots to Failed), interleaved
-    // rather than clustered like independent random draws.
+    // Weighted round-robin so the outcome split matches the counts, evenly
+    // interleaved (e.g. 3 failed / 30 delivered → ~1 in 11 dots to Failed).
     const outAcc = weights.map(() => 0);
     const pickOut = (): number => {
       if (!weights.length) return 0;
@@ -151,9 +149,10 @@ export function useFlowParticles({
               lane: pickLane(),
               phase: 0,
               t: 0,
-              d0: 900 + Math.random() * 300,
-              d1: 760,
-              d2: 780 + Math.random() * 200,
+              // Faster travel than before (~2× quicker) so the flow reads lively.
+              d0: 460 + Math.random() * 220,
+              d1: 380,
+              d2: 400 + Math.random() * 200,
               pulsed: false,
             });
             nextEmit[i] = scheduleNext(i, now);
@@ -203,14 +202,17 @@ export function useFlowParticles({
               yy = entY + (exitY - entY) * f1;
             } else if (f1 < 0.25) {
               yy = entY + (ly1 - entY) * smooth(f1 / 0.25);
-            } else if (f1 < 0.75) {
-              yy = ly1;
+            } else {
+              // Pulse once on reaching the lane — even if a slow frame overshoots
+              // the 0.25–0.75 window straight into the glide-out segment.
               if (!p.pulsed) {
                 p.pulsed = true;
                 pulseLane(g, p.lane);
               }
-            } else {
-              yy = ly1 + (exitY - ly1) * smooth((f1 - 0.75) / 0.25);
+              yy =
+                f1 < 0.75
+                  ? ly1
+                  : ly1 + (exitY - ly1) * smooth((f1 - 0.75) / 0.25);
             }
             pos = { x: g.core.l + (g.core.r - g.core.l) * f1, y: yy };
             if (f1 >= 1) {
diff --git a/frontend/editor/src/portal/mocks/policies.ts b/frontend/editor/src/portal/mocks/policies.ts
index 1a3cfa2259..85f3ccd6e7 100644
--- a/frontend/editor/src/portal/mocks/policies.ts
+++ b/frontend/editor/src/portal/mocks/policies.ts
@@ -1,8 +1,5 @@
-/**
- * Policies fixtures. The canonical TS model and the static catalogue
- * definitions live in api/policies.ts (the backend contract); this module
- * only builds seed data for the MSW handlers and tests.
- */
+/** Policies seed data for the MSW handlers and tests. The canonical model and
+ *  catalogue live in api/policies.ts (the backend contract). */
 
 import type {
   PolicyRunView,
@@ -92,13 +89,11 @@ const NOW = Date.now();
 const M = 60000;
 const D = 86400000;
 
-/** Seed `PolicyRunView` records that drive the activity feed + stats.
- * 40 delivered + 3 failed within the trailing 24h so the home visualiser shows
- * a lively flow; a tail of older completed runs keeps the lifetime stats real.
- * Runs are split across the two active policies so the Sankey waist divides. */
+/** Seed runs: 40 delivered + 3 failed in the last 24h (split across the two
+ *  active policies), plus a tail of older completed runs for lifetime stats. */
 export function seedPolicyRuns(): PolicyRunView[] {
-  // Split the throughput across the two active policies (security / classification)
-  // so both show a 24h count and the Sankey waist splits into two segments.
+  // Split throughput across security / classification so both show a 24h count
+  // and the Sankey waist splits into two segments.
   const policyFor = (i: number, total: number) =>
     i < Math.round(total * 0.6)
       ? "pol_security_default"
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index 90d30c4175..c0e7a56bd9 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -379,9 +379,8 @@
   }
 }
 
-/* The shared Button lays its children out in a flex-row label; force the type
-   tile back to a centred icon-over-label column so the SVG sits above the name
-   with real spacing (not jammed against it). */
+/* Override the shared Button's flex-row label to a centred icon-over-label
+   column so the SVG sits above the name with real spacing. */
 .portal-sources__type-card .mantine-Button-label {
   display: flex;
   flex-direction: column;

From 79dc7d5615875bd8381134f716f5060e047bf4ef Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Mon, 20 Jul 2026 21:51:30 +0100
Subject: [PATCH 063/109] Multi node cluster fixes (#7025)

- Exclude DataRedisRepositoriesAutoConfiguration (cluster crash-loop
fix)
- Share JWT signing keys via the DB + require a shared credential key in
cluster mode
- Make policy run status/listing visible across nodes


---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../software/common/model/job/JobResult.java  |  17 +
 .../software/common/service/TaskManager.java  |  14 +-
 .../src/main/resources/application.properties |   3 +-
 .../crypto/CredentialEncryption.java          |  13 +-
 .../policy/controller/PolicyController.java   |  41 +-
 .../policy/engine/PolicyEngine.java           |   4 +
 .../policy/model/PolicyRunView.java           |  31 ++
 .../security/model/JwtSigningKeyEntity.java   |  52 +++
 .../repository/JwtSigningKeyRepository.java   |  26 ++
 .../service/KeyPairCleanupService.java        |  35 +-
 .../service/KeyPersistenceService.java        | 429 +++++++-----------
 .../controller/PolicyControllerTest.java      |   8 +-
 .../service/KeyPairCleanupServiceTest.java    | 102 +++++
 .../KeyPersistenceServiceInterfaceTest.java   | 237 ++++------
 14 files changed, 600 insertions(+), 412 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/model/JwtSigningKeyEntity.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/repository/JwtSigningKeyRepository.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/security/service/KeyPairCleanupServiceTest.java

diff --git a/app/common/src/main/java/stirling/software/common/model/job/JobResult.java b/app/common/src/main/java/stirling/software/common/model/job/JobResult.java
index 52c0826e2b..aa43431a15 100644
--- a/app/common/src/main/java/stirling/software/common/model/job/JobResult.java
+++ b/app/common/src/main/java/stirling/software/common/model/job/JobResult.java
@@ -4,6 +4,8 @@ import java.time.LocalDateTime;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.CopyOnWriteArrayList;
 
 import com.fasterxml.jackson.annotation.JsonIgnore;
@@ -47,6 +49,9 @@ public class JobResult {
      */
     private final List<String> notes = new CopyOnWriteArrayList<>();
 
+    /** Key/value metadata that survives the write-through into the shared job store. */
+    private final Map<String, String> metadata = new ConcurrentHashMap<>();
+
     /**
      * Create a new JobResult with the given job ID
      *
@@ -161,4 +166,16 @@ public class JobResult {
     public List<String> getNotes() {
         return Collections.unmodifiableList(notes);
     }
+
+    /** Attach a metadata value, e.g. a policy id so cluster peers can identify a policy run. */
+    public void putMetadata(String key, String value) {
+        if (key != null && value != null) {
+            this.metadata.put(key, value);
+        }
+    }
+
+    /** An unmodifiable view of this job's metadata. */
+    public Map<String, String> getMetadata() {
+        return Collections.unmodifiableMap(metadata);
+    }
 }
diff --git a/app/common/src/main/java/stirling/software/common/service/TaskManager.java b/app/common/src/main/java/stirling/software/common/service/TaskManager.java
index 790e0626ac..3fd9ac3fe4 100644
--- a/app/common/src/main/java/stirling/software/common/service/TaskManager.java
+++ b/app/common/src/main/java/stirling/software/common/service/TaskManager.java
@@ -230,6 +230,18 @@ public class TaskManager {
         return false;
     }
 
+    /** Attach metadata to a job and write it through to the shared store for cluster peers. */
+    public boolean putMetadata(String jobId, String key, String value) {
+        JobResult jobResult = jobResults.get(jobId);
+        if (jobResult != null) {
+            jobResult.putMetadata(key, value);
+            writeThrough(jobId, jobResult);
+            return true;
+        }
+        log.warn("Attempted to set metadata on non-existent job ID: {}", jobId);
+        return false;
+    }
+
     /**
      * Get statistics about all jobs in the system
      *
@@ -378,7 +390,7 @@ public class TaskManager {
                 fileIds.add(rf.getFileId());
             }
         }
-        Map<String, String> meta = new HashMap<>();
+        Map<String, String> meta = new HashMap<>(result.getMetadata());
         if (result.getNotes() != null && !result.getNotes().isEmpty()) {
             meta.put("notesCount", Integer.toString(result.getNotes().size()));
         }
diff --git a/app/core/src/main/resources/application.properties b/app/core/src/main/resources/application.properties
index 7c1190926b..c05f2dcbea 100644
--- a/app/core/src/main/resources/application.properties
+++ b/app/core/src/main/resources/application.properties
@@ -98,7 +98,8 @@ spring.main.allow-bean-definition-overriding=true
 # spring-data-redis is on the classpath only for the optional Valkey backplane (which wires its own
 # factory); exclude Spring Boot's stock Redis auto-config so a default install doesn't create a dead
 # localhost:6379 factory that flips /actuator/health to DOWN.
-spring.autoconfigure.exclude=org.springframework.boot.data.redis.autoconfigure.DataRedisAutoConfiguration,org.springframework.boot.data.redis.autoconfigure.DataRedisReactiveAutoConfiguration
+# Also exclude the repositories auto-config: in cluster mode it needs a redisTemplate bean we don't define.
+spring.autoconfigure.exclude=org.springframework.boot.data.redis.autoconfigure.DataRedisAutoConfiguration,org.springframework.boot.data.redis.autoconfigure.DataRedisReactiveAutoConfiguration,org.springframework.boot.data.redis.autoconfigure.DataRedisRepositoriesAutoConfiguration
 
 # Set up a consistent temporary directory location
 java.io.tmpdir=${stirling.tempfiles.directory:${java.io.tmpdir}/stirling-pdf}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/CredentialEncryption.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/CredentialEncryption.java
index 96e20f55cb..8ac0ddda96 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/CredentialEncryption.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/crypto/CredentialEncryption.java
@@ -44,10 +44,13 @@ public class CredentialEncryption {
     private static volatile SecretKey key;
 
     private final String configuredKey;
+    private final boolean clusterEnabled;
 
     public CredentialEncryption(
-            @Value("${stirling.security.credentialEncryptionKey:}") String configuredKey) {
+            @Value("${stirling.security.credentialEncryptionKey:}") String configuredKey,
+            @Value("${cluster.enabled:false}") boolean clusterEnabled) {
         this.configuredKey = configuredKey;
+        this.clusterEnabled = clusterEnabled;
     }
 
     @PostConstruct
@@ -64,6 +67,14 @@ public class CredentialEncryption {
         if (configured != null && !configured.isBlank()) {
             return new SecretKeySpec(Base64.getDecoder().decode(configured.trim()), ALGORITHM);
         }
+        // Cluster nodes must share this key, so fail fast rather than generate a node-local one.
+        if (clusterEnabled) {
+            throw new IllegalStateException(
+                    "cluster.enabled=true requires a shared credential encryption key. Set"
+                            + " STIRLING_CREDENTIAL_ENCRYPTION_KEY (or"
+                            + " stirling.security.credentialEncryptionKey) to the same value on every"
+                            + " node.");
+        }
         return loadOrCreateKeyFile();
     }
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
index 71e5b93c4e..e0df6ba2b1 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
@@ -6,6 +6,7 @@ import java.util.Comparator;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 
 import org.springframework.core.io.FileSystemResource;
 import org.springframework.core.io.Resource;
@@ -39,6 +40,8 @@ import jakarta.validation.Valid;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.common.cluster.JobStore;
+import stirling.software.common.cluster.JobStoreEntry;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.job.JobResponse;
 import stirling.software.common.service.JobOwnershipService;
@@ -102,6 +105,8 @@ public class PolicyController {
     private final ApplicationProperties applicationProperties;
     private final TempFileManager tempFileManager;
     private final JobOwnershipService jobOwnershipService;
+    // Shared job store: lets the run endpoints see runs that executed on other nodes.
+    private final JobStore jobStore;
 
     @PostMapping(value = "/run", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @Operation(
@@ -172,10 +177,19 @@ public class PolicyController {
             description = "Returns the current status, step cursor, and output files of a run.")
     public ResponseEntity<PolicyRunView> status(@PathVariable String runId) {
         PolicyRun run = runRegistry.get(runId);
-        if (run == null) {
-            return ResponseEntity.notFound().build();
+        if (run != null) {
+            return ResponseEntity.ok(PolicyRunView.of(run));
         }
-        return ResponseEntity.ok(PolicyRunView.of(run));
+        // Not local: read the run's shared projection so any node can serve its status.
+        if (ownedByCurrentUser(runId)) {
+            Optional<JobStoreEntry> entry = jobStore.get(runId);
+            if (entry.isPresent()
+                    && entry.get().resultMeta() != null
+                    && entry.get().resultMeta().containsKey("policyId")) {
+                return ResponseEntity.ok(PolicyRunView.ofEntry(entry.get()));
+            }
+        }
+        return ResponseEntity.notFound().build();
     }
 
     @GetMapping("/runs")
@@ -188,11 +202,26 @@ public class PolicyController {
                             + " collected, rather than orphaned on the backend. Ad-hoc runs (no"
                             + " policy id) are excluded.")
     public List<PolicyRunView> listRuns() {
-        return runRegistry.all().stream()
+        // Local runs first (they carry live step state); keyed by runId to dedupe shared entries.
+        Map<String, PolicyRunView> byRunId = new LinkedHashMap<>();
+        runRegistry.all().stream()
                 .filter(run -> run.getPolicyId() != null)
                 .filter(run -> ownedByCurrentUser(run.getRunId()))
-                .map(PolicyRunView::of)
-                .toList();
+                .forEach(run -> byRunId.put(run.getRunId(), PolicyRunView.of(run)));
+        // Then runs from other nodes, read from the shared job store.
+        for (JobStoreEntry entry : jobStore.all()) {
+            if (byRunId.containsKey(entry.jobId())) {
+                continue;
+            }
+            Map<String, String> meta = entry.resultMeta();
+            if (meta == null || !meta.containsKey("policyId")) {
+                continue; // ad-hoc job, not a stored-policy run
+            }
+            if (ownedByCurrentUser(entry.jobId())) {
+                byRunId.put(entry.jobId(), PolicyRunView.ofEntry(entry));
+            }
+        }
+        return List.copyOf(byRunId.values());
     }
 
     /**
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
index 2ceabae656..abdb69cb07 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
@@ -134,6 +134,10 @@ public class PolicyEngine {
         // ownership check passes. No-op when security is off.
         String runId = jobOwnershipService.createScopedJobKey(UUID.randomUUID().toString());
         taskManager.createTask(runId);
+        // Tag the shared job entry with the policy id so peers can list it as a policy run.
+        if (policyId != null) {
+            taskManager.putMetadata(runId, "policyId", policyId);
+        }
         PolicyRun run = new PolicyRun(runId, policyId, definition);
         registry.register(run);
         CompletableFuture<PolicyRun> completion = new CompletableFuture<>();
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PolicyRunView.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PolicyRunView.java
index 04a2707077..6d98e273fc 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PolicyRunView.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PolicyRunView.java
@@ -1,7 +1,9 @@
 package stirling.software.proprietary.policy.model;
 
 import java.util.List;
+import java.util.Map;
 
+import stirling.software.common.cluster.JobStoreEntry;
 import stirling.software.common.model.job.ResultFile;
 
 /**
@@ -34,4 +36,33 @@ public record PolicyRunView(
                 run.getOutputs(),
                 run.getCreatedAt().toEpochMilli());
     }
+
+    /** Cross-node view from a shared job-store entry; step cursor is node-local so it reads 0. */
+    public static PolicyRunView ofEntry(JobStoreEntry entry) {
+        Map<String, String> meta = entry.resultMeta() == null ? Map.of() : entry.resultMeta();
+        PolicyRunStatus status =
+                switch (entry.state()) {
+                    case COMPLETE -> PolicyRunStatus.COMPLETED;
+                    case FAILED -> PolicyRunStatus.FAILED;
+                    case RUNNING, PENDING -> PolicyRunStatus.RUNNING;
+                };
+        List<ResultFile> outputs =
+                entry.fileIds() == null
+                        ? List.of()
+                        : entry.fileIds().stream()
+                                .map(id -> ResultFile.builder().fileId(id).build())
+                                .toList();
+        long createdAt = entry.createdAt() == null ? 0L : entry.createdAt().toEpochMilli();
+        return new PolicyRunView(
+                entry.jobId(),
+                meta.get("policyId"),
+                status,
+                0,
+                0,
+                entry.error(),
+                null,
+                null,
+                outputs,
+                createdAt);
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/JwtSigningKeyEntity.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/JwtSigningKeyEntity.java
new file mode 100644
index 0000000000..23cf42502d
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/JwtSigningKeyEntity.java
@@ -0,0 +1,52 @@
+package stirling.software.proprietary.security.model;
+
+import java.io.Serializable;
+import java.time.LocalDateTime;
+
+import org.hibernate.annotations.CreationTimestamp;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Convert;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+import stirling.software.proprietary.integration.crypto.EncryptedStringConverter;
+
+/** A JWT signing keypair in the shared DB; the private key is encrypted at rest. */
+@Entity
+@Table(name = "jwt_signing_keys")
+@NoArgsConstructor
+@Getter
+@Setter
+public class JwtSigningKeyEntity implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @Column(name = "key_id", length = 128)
+    private String keyId;
+
+    // Base64 X.509 public key (non-secret).
+    @Column(name = "verifying_key", columnDefinition = "text", nullable = false)
+    private String verifyingKey;
+
+    // Base64 PKCS#8 private key, encrypted at rest.
+    @Convert(converter = EncryptedStringConverter.class)
+    @Column(name = "signing_key", columnDefinition = "text", nullable = false)
+    private String signingKey;
+
+    @CreationTimestamp
+    @Column(name = "created_at", updatable = false)
+    private LocalDateTime createdAt;
+
+    public JwtSigningKeyEntity(String keyId, String verifyingKey, String signingKey) {
+        this.keyId = keyId;
+        this.verifyingKey = verifyingKey;
+        this.signingKey = signingKey;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/JwtSigningKeyRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/JwtSigningKeyRepository.java
new file mode 100644
index 0000000000..d34f45593b
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/JwtSigningKeyRepository.java
@@ -0,0 +1,26 @@
+package stirling.software.proprietary.security.repository;
+
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Optional;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+import stirling.software.proprietary.security.model.JwtSigningKeyEntity;
+
+/** Shared-DB store of JWT signing keys - the source of truth every cluster node reads from. */
+@Repository
+public interface JwtSigningKeyRepository extends JpaRepository<JwtSigningKeyEntity, String> {
+
+    /** Newest first, so the most recently created key is the active signing key. */
+    List<JwtSigningKeyEntity> findAllByOrderByCreatedAtDesc();
+
+    /**
+     * The current active signing key: the single newest row. Used for cheap cluster convergence.
+     */
+    Optional<JwtSigningKeyEntity> findFirstByOrderByCreatedAtDesc();
+
+    /** Keys created before the cutoff, eligible for rotation cleanup. */
+    List<JwtSigningKeyEntity> findByCreatedAtBefore(LocalDateTime cutoff);
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPairCleanupService.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPairCleanupService.java
index 8745f505fd..ea7245aa75 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPairCleanupService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPairCleanupService.java
@@ -3,8 +3,10 @@ package stirling.software.proprietary.security.service;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.time.Duration;
 import java.time.LocalDateTime;
 import java.util.List;
+import java.util.Optional;
 import java.util.concurrent.TimeUnit;
 
 import org.springframework.beans.factory.annotation.Autowired;
@@ -17,6 +19,8 @@ import jakarta.annotation.PostConstruct;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.common.cluster.DistributedLock;
+import stirling.software.common.cluster.DistributedLock.LockHandle;
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.security.model.JwtVerificationKey;
@@ -26,15 +30,23 @@ import stirling.software.proprietary.security.model.JwtVerificationKey;
 @ConditionalOnBooleanProperty("v2")
 public class KeyPairCleanupService {
 
+    // Cluster-wide single-writer: keys live in the shared DB, so only one node may prune + rotate
+    // per cycle. Otherwise every node runs this and they race to delete each other's keys.
+    private static final String CLEANUP_LOCK = "jwt-key-cleanup";
+    private static final Duration LOCK_LEASE = Duration.ofMinutes(5);
+
     private final KeyPersistenceService keyPersistenceService;
     private final ApplicationProperties.Security.Jwt jwtProperties;
+    private final DistributedLock distributedLock;
 
     @Autowired
     public KeyPairCleanupService(
             KeyPersistenceService keyPersistenceService,
-            ApplicationProperties applicationProperties) {
+            ApplicationProperties applicationProperties,
+            DistributedLock distributedLock) {
         this.keyPersistenceService = keyPersistenceService;
         this.jwtProperties = applicationProperties.getSecurity().getJwt();
+        this.distributedLock = distributedLock;
     }
 
     @Transactional
@@ -44,7 +56,28 @@ public class KeyPairCleanupService {
         if (!jwtProperties.isEnableKeyCleanup() || !keyPersistenceService.isKeystoreEnabled()) {
             return;
         }
+        // A lock-backend error must never fail this @PostConstruct/scheduled run: degrade to
+        // "skip this cycle" so a transient Valkey blip can't stop a node from booting.
+        Optional<LockHandle> lock;
+        try {
+            lock = distributedLock.tryAcquire(CLEANUP_LOCK, LOCK_LEASE);
+        } catch (RuntimeException e) {
+            log.warn(
+                    "Could not acquire the JWT key-cleanup lock ({}); skipping this cycle",
+                    e.getMessage());
+            return;
+        }
+        // No lock means another node is already pruning; skip until the next tick.
+        if (lock.isEmpty()) {
+            log.debug("Another node holds the JWT key-cleanup lock; skipping this cycle");
+            return;
+        }
+        try (LockHandle held = lock.get()) {
+            runCleanup();
+        }
+    }
 
+    private void runCleanup() {
         LocalDateTime cutoffDate =
                 LocalDateTime.now().minusDays(jwtProperties.getKeyRetentionDays());
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPersistenceService.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPersistenceService.java
index 49e66e5c53..adb11936ff 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPersistenceService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/KeyPersistenceService.java
@@ -18,15 +18,17 @@ import java.time.LocalDateTime;
 import java.time.format.DateTimeFormatter;
 import java.util.Base64;
 import java.util.List;
+import java.util.Map;
 import java.util.Optional;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
 
-import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
 import org.springframework.cache.Cache;
 import org.springframework.cache.CacheManager;
-import org.springframework.cache.annotation.CacheEvict;
-import org.springframework.cache.caffeine.CaffeineCache;
+import org.springframework.context.annotation.DependsOn;
+import org.springframework.scheduling.annotation.Scheduled;
 import org.springframework.stereotype.Service;
-import org.springframework.transaction.annotation.Transactional;
 
 import jakarta.annotation.PostConstruct;
 
@@ -34,27 +36,39 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.security.model.JwtSigningKeyEntity;
 import stirling.software.proprietary.security.model.JwtVerificationKey;
+import stirling.software.proprietary.security.repository.JwtSigningKeyRepository;
 
+/** Persists JWT signing keys in the shared DB so all nodes sign/verify with the same key. */
 @Slf4j
 @Service
+// CredentialEncryption must init first: startup persists an encrypted private key.
+@DependsOn("credentialEncryption")
 public class KeyPersistenceService implements KeyPersistenceServiceInterface {
 
     public static final String KEY_SUFFIX = ".key";
     public static final String PUB_KEY_SUFFIX = ".pub";
 
     private final ApplicationProperties.Security.Jwt jwtProperties;
-    private final CacheManager cacheManager;
     private final Cache verifyingKeyCache;
+    private final JwtSigningKeyRepository keyRepository;
+    private final boolean clusterEnabled;
+
+    // kid -> KeyPair; safe to cache since key material is immutable.
+    private final Map<String, KeyPair> keyPairCache = new ConcurrentHashMap<>();
 
     private volatile JwtVerificationKey activeKey;
 
-    @Autowired
     public KeyPersistenceService(
-            ApplicationProperties applicationProperties, CacheManager cacheManager) {
+            ApplicationProperties applicationProperties,
+            CacheManager cacheManager,
+            JwtSigningKeyRepository keyRepository,
+            @Value("${cluster.enabled:false}") boolean clusterEnabled) {
         this.jwtProperties = applicationProperties.getSecurity().getJwt();
-        this.cacheManager = cacheManager;
         this.verifyingKeyCache = cacheManager.getCache("verifyingKeys");
+        this.keyRepository = keyRepository;
+        this.clusterEnabled = clusterEnabled;
     }
 
     @PostConstruct
@@ -63,138 +77,86 @@ public class KeyPersistenceService implements KeyPersistenceServiceInterface {
             log.info("JWT keystore is disabled - keys will be generated in memory");
             return;
         }
-
         try {
-            ensurePrivateKeyDirectoryExists();
-            loadExistingKeysFromDisk();
+            importLegacyDiskKeysIfPresent();
+            loadKeysFromDb();
         } catch (Exception e) {
-            log.error("Failed to initialize keystore, using in-memory generation", e);
-        }
-    }
-
-    /**
-     * Load all existing JWT keys from disk into memory on startup.
-     *
-     * <p>This ensures tokens signed with previous keys remain valid after server restart. If no
-     * keys exist on disk, generates a new keypair.
-     */
-    private void loadExistingKeysFromDisk() {
-        try {
-            Path keyDirectory = Path.of(InstallationPathConfig.getPrivateKeyPath());
-
-            if (!Files.exists(keyDirectory)) {
-                log.info("No existing keys found, generating new keypair");
-                generateAndStoreKeypair();
-                return;
-            }
-
-            List<Path> keyFiles;
-            try (var stream = Files.list(keyDirectory)) {
-                keyFiles =
-                        stream.filter(path -> path.toString().endsWith(KEY_SUFFIX))
-                                .sorted(
-                                        (a, b) ->
-                                                b.getFileName().compareTo(a.getFileName())) // Most
-                                // recent
-                                // first
-                                .toList();
-            }
-
-            if (keyFiles.isEmpty()) {
-                log.info("No existing keys found in directory, generating new keypair");
-                generateAndStoreKeypair();
-                return;
-            }
-
-            log.info("Loading {} existing JWT keys from disk", keyFiles.size());
-            int loadedCount = 0;
-
-            for (Path keyFile : keyFiles) {
-                try {
-                    String keyId = keyFile.getFileName().toString().replace(KEY_SUFFIX, "");
-
-                    // Load private key first
-                    PrivateKey privateKey = loadPrivateKey(keyId);
-
-                    // Try to load public key, or generate it from private key if missing
-                    // (migration)
-                    String encodedPublicKey;
-                    try {
-                        encodedPublicKey = loadPublicKey(keyId);
-                    } catch (IOException e) {
-                        // Public key file doesn't exist - generate it from private key (migration)
-                        log.info("Migrating legacy key: generating public key file for {}", keyId);
-                        KeyPair keyPair = reconstructKeyPair(privateKey);
-
-                        // Save the public key file
-                        Path publicKeyFile = keyDirectory.resolve(keyId + PUB_KEY_SUFFIX);
-                        encodedPublicKey = encodePublicKey(keyPair.getPublic());
-                        Files.writeString(publicKeyFile, encodedPublicKey);
-                        publicKeyFile.toFile().setReadable(true, true);
-                        publicKeyFile.toFile().setWritable(true, true);
-                        publicKeyFile.toFile().setExecutable(false, false);
-
-                        log.info("Successfully migrated key: {}", keyId);
-                    }
-
-                    // Create verification key and add to cache
-                    JwtVerificationKey verifyingKey =
-                            new JwtVerificationKey(keyId, encodedPublicKey);
-                    verifyingKeyCache.put(keyId, verifyingKey);
-                    loadedCount++;
-
-                    // Set the most recent key as active (first in sorted list)
-                    if (activeKey == null) {
-                        activeKey = verifyingKey;
-                        log.info("Set active JWT signing key: {}", keyId);
-                    } else {
-                        log.debug(
-                                "Loaded historical JWT key: {} (created: {})",
-                                keyId,
-                                verifyingKey.getCreatedAt());
-                    }
-                } catch (Exception e) {
-                    log.warn(
-                            "Failed to load key: {}, skipping. Error: {}",
-                            keyFile.getFileName(),
-                            e.getMessage());
-                }
-            }
-
-            if (loadedCount == 0) {
-                log.warn("No valid keys could be loaded from disk, generating new keypair");
-                generateAndStoreKeypair();
-            } else {
-                log.info(
-                        "Successfully loaded {} JWT keys, active key: {}",
-                        loadedCount,
-                        activeKey.getKeyId());
-            }
-
-        } catch (IOException e) {
-            log.error("Failed to load keys from disk, generating new keypair", e);
+            log.error("Failed to initialize keystore, generating a fresh keypair", e);
             generateAndStoreKeypair();
         }
     }
 
-    @Transactional
-    private JwtVerificationKey generateAndStoreKeypair() {
-        JwtVerificationKey verifyingKey = null;
+    /**
+     * Cluster convergence: adopt the newest signing key in the shared DB as this node's active key.
+     * Runs on every node so a key a peer just minted becomes the shared active signer within one
+     * interval, keeping cluster rotation equivalent to single-node. Cluster-only: a single node
+     * always holds its own newest key, so this is skipped entirely off-cluster.
+     */
+    @Scheduled(fixedDelayString = "${stirling.security.jwt.activeKeyReloadMs:300000}")
+    public void reloadActiveKeyFromDb() {
+        if (!clusterEnabled || !isKeystoreEnabled()) {
+            return;
+        }
+        try {
+            Optional<JwtSigningKeyEntity> newestOpt =
+                    keyRepository.findFirstByOrderByCreatedAtDesc();
+            if (newestOpt.isEmpty()) {
+                return;
+            }
+            JwtSigningKeyEntity newest = newestOpt.get();
+            JwtVerificationKey current = activeKey;
+            if (current != null && newest.getKeyId().equals(current.getKeyId())) {
+                return;
+            }
+            JwtVerificationKey adopted =
+                    new JwtVerificationKey(newest.getKeyId(), newest.getVerifyingKey());
+            verifyingKeyCache.put(newest.getKeyId(), adopted);
+            activeKey = adopted;
+            log.info(
+                    "Adopted newest JWT signing key {} from the shared DB as active",
+                    newest.getKeyId());
+        } catch (Exception e) {
+            log.warn("Could not reload active JWT key from the shared DB: {}", e.getMessage());
+        }
+    }
 
+    /** Load every signing key from the shared DB into the caches; most recent becomes active. */
+    private void loadKeysFromDb() {
+        List<JwtSigningKeyEntity> keys = keyRepository.findAllByOrderByCreatedAtDesc();
+        if (keys.isEmpty()) {
+            log.info("No JWT keys in the database, generating a new keypair");
+            generateAndStoreKeypair();
+            return;
+        }
+        for (JwtSigningKeyEntity key : keys) {
+            verifyingKeyCache.put(
+                    key.getKeyId(), new JwtVerificationKey(key.getKeyId(), key.getVerifyingKey()));
+        }
+        activeKey = new JwtVerificationKey(keys.get(0).getKeyId(), keys.get(0).getVerifyingKey());
+        log.info("Loaded {} JWT key(s) from DB, active key: {}", keys.size(), activeKey.getKeyId());
+    }
+
+    private JwtVerificationKey generateAndStoreKeypair() {
         try {
             KeyPair keyPair = generateRSAKeypair();
             String keyId = generateKeyId();
+            String verifyingKey = encodePublicKey(keyPair.getPublic());
+            String signingKey =
+                    Base64.getEncoder().encodeToString(keyPair.getPrivate().getEncoded());
 
-            storeKeyPair(keyId, keyPair);
-            verifyingKey = new JwtVerificationKey(keyId, encodePublicKey(keyPair.getPublic()));
-            verifyingKeyCache.put(keyId, verifyingKey);
-            activeKey = verifyingKey;
+            // Converter encrypts the private key at rest with the shared credential-encryption key.
+            keyRepository.save(new JwtSigningKeyEntity(keyId, verifyingKey, signingKey));
+
+            keyPairCache.put(keyId, keyPair);
+            JwtVerificationKey verificationKey = new JwtVerificationKey(keyId, verifyingKey);
+            verifyingKeyCache.put(keyId, verificationKey);
+            activeKey = verificationKey;
             log.info("Generated and stored new JWT keypair: {}", keyId);
-        } catch (IOException e) {
+            return verificationKey;
+        } catch (RuntimeException e) {
             log.error("Failed to generate and store keypair", e);
+            return null;
         }
-
-        return verifyingKey;
     }
 
     @Override
@@ -207,25 +169,29 @@ public class KeyPersistenceService implements KeyPersistenceServiceInterface {
 
     @Override
     public Optional<KeyPair> getKeyPair(String keyId) {
-        if (!isKeystoreEnabled()) {
+        if (!isKeystoreEnabled() || keyId == null) {
             return Optional.empty();
         }
-
+        KeyPair cached = keyPairCache.get(keyId);
+        if (cached != null) {
+            return Optional.of(cached);
+        }
+        Optional<JwtSigningKeyEntity> entityOpt = keyRepository.findById(keyId);
+        if (entityOpt.isEmpty()) {
+            log.warn("No signing key found in DB for keyId: {}", keyId);
+            return Optional.empty();
+        }
+        JwtSigningKeyEntity entity = entityOpt.get();
         try {
-            JwtVerificationKey verifyingKey =
-                    verifyingKeyCache.get(keyId, JwtVerificationKey.class);
-
-            if (verifyingKey == null) {
-                log.warn("No signing key found in database for keyId: {}", keyId);
-                return Optional.empty();
-            }
-
-            PrivateKey privateKey = loadPrivateKey(keyId);
-            PublicKey publicKey = decodePublicKey(verifyingKey.getVerifyingKey());
-
-            return Optional.of(new KeyPair(publicKey, privateKey));
-        } catch (Exception e) {
-            log.error("Failed to load keypair for keyId: {}", keyId, e);
+            KeyPair keyPair =
+                    new KeyPair(
+                            decodePublicKey(entity.getVerifyingKey()),
+                            decodePrivateKey(entity.getSigningKey()));
+            keyPairCache.put(keyId, keyPair);
+            verifyingKeyCache.put(keyId, new JwtVerificationKey(keyId, entity.getVerifyingKey()));
+            return Optional.of(keyPair);
+        } catch (NoSuchAlgorithmException | InvalidKeySpecException e) {
+            log.error("Failed to decode keypair for keyId: {}", keyId, e);
             return Optional.empty();
         }
     }
@@ -241,44 +207,69 @@ public class KeyPersistenceService implements KeyPersistenceServiceInterface {
     }
 
     @Override
-    @CacheEvict(
-            value = {"verifyingKeys"},
-            key = "#keyId",
-            condition = "#root.target.isKeystoreEnabled()")
     public void removeKey(String keyId) {
+        keyRepository.deleteById(keyId);
         verifyingKeyCache.evict(keyId);
+        keyPairCache.remove(keyId);
     }
 
     @Override
     public List<JwtVerificationKey> getKeysEligibleForCleanup(LocalDateTime cutoffDate) {
-        CaffeineCache caffeineCache = (CaffeineCache) verifyingKeyCache;
-        com.github.benmanes.caffeine.cache.Cache<Object, Object> nativeCache =
-                caffeineCache.getNativeCache();
-
-        log.debug(
-                "Cache size: {}, Checking {} keys for cleanup",
-                nativeCache.estimatedSize(),
-                nativeCache.asMap().size());
-
-        return nativeCache.asMap().values().stream()
-                .filter(value -> value instanceof JwtVerificationKey)
-                .map(value -> (JwtVerificationKey) value)
-                .filter(
-                        key -> {
-                            boolean eligible = key.getCreatedAt().isBefore(cutoffDate);
-                            log.debug(
-                                    "Key {} created at {}, eligible for cleanup: {}",
-                                    key.getKeyId(),
-                                    key.getCreatedAt(),
-                                    eligible);
-                            return eligible;
-                        })
+        return keyRepository.findByCreatedAtBefore(cutoffDate).stream()
+                .map(e -> new JwtVerificationKey(e.getKeyId(), e.getVerifyingKey()))
                 .toList();
     }
 
+    /** Import any pre-existing on-disk keys into the DB once, so upgrades keep sessions valid. */
+    private void importLegacyDiskKeysIfPresent() {
+        if (keyRepository.count() > 0) {
+            return;
+        }
+        Path keyDirectory = Path.of(InstallationPathConfig.getPrivateKeyPath());
+        if (!Files.exists(keyDirectory)) {
+            return;
+        }
+        List<Path> keyFiles;
+        try (var stream = Files.list(keyDirectory)) {
+            keyFiles = stream.filter(p -> p.toString().endsWith(KEY_SUFFIX)).toList();
+        } catch (IOException e) {
+            log.warn("Could not list legacy key directory {}: {}", keyDirectory, e.getMessage());
+            return;
+        }
+        int imported = 0;
+        for (Path keyFile : keyFiles) {
+            String keyId = keyFile.getFileName().toString().replace(KEY_SUFFIX, "");
+            try {
+                PrivateKey privateKey = loadPrivateKey(keyId);
+                String verifyingKey = resolveLegacyPublicKey(keyId, privateKey);
+                String signingKey = Base64.getEncoder().encodeToString(privateKey.getEncoded());
+                keyRepository.save(new JwtSigningKeyEntity(keyId, verifyingKey, signingKey));
+                imported++;
+            } catch (Exception e) {
+                log.warn("Skipping legacy key {}: {}", keyId, e.getMessage());
+            }
+        }
+        if (imported > 0) {
+            log.info("Imported {} legacy JWT key(s) from disk into the shared DB", imported);
+        }
+    }
+
+    private String resolveLegacyPublicKey(String keyId, PrivateKey privateKey)
+            throws NoSuchAlgorithmException, InvalidKeySpecException {
+        try {
+            return loadPublicKey(keyId);
+        } catch (IOException e) {
+            // No .pub file: derive the public key from the RSA private key.
+            return encodePublicKey(reconstructKeyPair(privateKey).getPublic());
+        }
+    }
+
+    // UUID suffix so two nodes booting the same second don't collide on keyId.
     private String generateKeyId() {
         return "jwt-key-"
-                + LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyy-MM-dd-HHmmss"));
+                + LocalDateTime.now().format(DateTimeFormatter.ofPattern("yyyy-MM-dd-HHmmss"))
+                + "-"
+                + UUID.randomUUID().toString().substring(0, 8);
     }
 
     private KeyPair generateRSAKeypair() {
@@ -291,125 +282,49 @@ public class KeyPersistenceService implements KeyPersistenceServiceInterface {
         }
     }
 
-    private void ensurePrivateKeyDirectoryExists() throws IOException {
-        Path keyPath = Path.of(InstallationPathConfig.getPrivateKeyPath());
-
-        if (!Files.exists(keyPath)) {
-            Files.createDirectories(keyPath);
-        }
-    }
-
-    /**
-     * Store both private and public keys to disk.
-     *
-     * <p>Private key stored as: keyId.key
-     *
-     * <p>Public key stored as: keyId.pub
-     */
-    private void storeKeyPair(String keyId, KeyPair keyPair) throws IOException {
-        Path keyDirectory = Path.of(InstallationPathConfig.getPrivateKeyPath());
-
-        // Store private key
-        Path privateKeyFile = keyDirectory.resolve(keyId + KEY_SUFFIX);
-        String encodedPrivateKey =
-                Base64.getEncoder().encodeToString(keyPair.getPrivate().getEncoded());
-        Files.writeString(privateKeyFile, encodedPrivateKey);
-
-        // Set read/write to only the owner (security)
-        privateKeyFile.toFile().setReadable(true, true);
-        privateKeyFile.toFile().setWritable(true, true);
-        privateKeyFile.toFile().setExecutable(false, false);
-
-        // Store public key
-        Path publicKeyFile = keyDirectory.resolve(keyId + PUB_KEY_SUFFIX);
-        String encodedPublicKey =
-                Base64.getEncoder().encodeToString(keyPair.getPublic().getEncoded());
-        Files.writeString(publicKeyFile, encodedPublicKey);
-
-        // Public key can be more permissive but still restrict to owner
-        publicKeyFile.toFile().setReadable(true, true);
-        publicKeyFile.toFile().setWritable(true, true);
-        publicKeyFile.toFile().setExecutable(false, false);
-
-        log.debug(
-                "Stored keypair to disk: {} (private: {}, public: {})",
-                keyId,
-                privateKeyFile.getFileName(),
-                publicKeyFile.getFileName());
-    }
-
     private PrivateKey loadPrivateKey(String keyId)
             throws IOException, NoSuchAlgorithmException, InvalidKeySpecException {
         Path keyFile =
                 Path.of(InstallationPathConfig.getPrivateKeyPath()).resolve(keyId + KEY_SUFFIX);
-
         if (!Files.exists(keyFile)) {
             throw new IOException("Private key not found: " + keyFile);
         }
-
-        String encodedKey = Files.readString(keyFile);
-        byte[] keyBytes = Base64.getDecoder().decode(encodedKey);
-        PKCS8EncodedKeySpec keySpec = new PKCS8EncodedKeySpec(keyBytes);
-        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
-
-        return keyFactory.generatePrivate(keySpec);
+        return decodePrivateKey(Files.readString(keyFile));
     }
 
-    /**
-     * Load public key from disk.
-     *
-     * @param keyId the key identifier
-     * @return Base64-encoded public key string
-     * @throws IOException if the public key file is not found
-     */
     private String loadPublicKey(String keyId) throws IOException {
         Path publicKeyFile =
                 Path.of(InstallationPathConfig.getPrivateKeyPath()).resolve(keyId + PUB_KEY_SUFFIX);
-
         if (!Files.exists(publicKeyFile)) {
             throw new IOException("Public key not found: " + publicKeyFile);
         }
-
         return Files.readString(publicKeyFile).trim();
     }
 
-    /**
-     * Reconstruct a KeyPair from a PrivateKey.
-     *
-     * <p>For RSA keys, derives the public key from the private key.
-     *
-     * @param privateKey the RSA private key
-     * @return reconstructed KeyPair
-     * @throws NoSuchAlgorithmException if RSA algorithm is not available
-     * @throws InvalidKeySpecException if the key specification is invalid
-     */
     private KeyPair reconstructKeyPair(PrivateKey privateKey)
             throws NoSuchAlgorithmException, InvalidKeySpecException {
-        // For RSA, we can derive the public key from the private key
         KeyFactory keyFactory = KeyFactory.getInstance("RSA");
-
-        // Get the private key spec
         RSAPrivateCrtKey rsaPrivateKey = (RSAPrivateCrtKey) privateKey;
-
-        // Create public key spec from private key parameters
         RSAPublicKeySpec publicKeySpec =
                 new RSAPublicKeySpec(rsaPrivateKey.getModulus(), rsaPrivateKey.getPublicExponent());
-
-        // Generate public key
-        PublicKey publicKey = keyFactory.generatePublic(publicKeySpec);
-
-        return new KeyPair(publicKey, privateKey);
+        return new KeyPair(keyFactory.generatePublic(publicKeySpec), privateKey);
     }
 
     private String encodePublicKey(PublicKey publicKey) {
         return Base64.getEncoder().encodeToString(publicKey.getEncoded());
     }
 
+    @Override
     public PublicKey decodePublicKey(String encodedKey)
             throws NoSuchAlgorithmException, InvalidKeySpecException {
-        byte[] keyBytes = Base64.getDecoder().decode(encodedKey);
-        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(keyBytes);
-        KeyFactory keyFactory = KeyFactory.getInstance("RSA");
-        return keyFactory.generatePublic(keySpec);
+        X509EncodedKeySpec keySpec = new X509EncodedKeySpec(Base64.getDecoder().decode(encodedKey));
+        return KeyFactory.getInstance("RSA").generatePublic(keySpec);
+    }
+
+    private PrivateKey decodePrivateKey(String encodedKey)
+            throws NoSuchAlgorithmException, InvalidKeySpecException {
+        PKCS8EncodedKeySpec keySpec =
+                new PKCS8EncodedKeySpec(Base64.getDecoder().decode(encodedKey));
+        return KeyFactory.getInstance("RSA").generatePrivate(keySpec);
     }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
index 8258622e28..cf33de8656 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
@@ -27,6 +27,8 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.server.ResponseStatusException;
 import org.springframework.web.servlet.mvc.method.annotation.SseEmitter;
 
+import stirling.software.common.cluster.JobStore;
+import stirling.software.common.cluster.inprocess.InProcessJobStore;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.job.JobResponse;
 import stirling.software.common.service.JobOwnershipService;
@@ -78,6 +80,7 @@ class PolicyControllerTest {
     @Mock private JobOwnershipService jobOwnershipService;
 
     private ApplicationProperties applicationProperties;
+    private final JobStore jobStore = new InProcessJobStore();
     private PolicyController controller;
 
     private final java.util.List<stirling.software.proprietary.policy.trigger.PolicyTrigger>
@@ -106,7 +109,8 @@ class PolicyControllerTest {
                         policyTriggers,
                         applicationProperties,
                         tempFileManager,
-                        jobOwnershipService);
+                        jobOwnershipService,
+                        jobStore);
     }
 
     private static stirling.software.proprietary.policy.trigger.PolicyTrigger trigger(
@@ -264,6 +268,8 @@ class PolicyControllerTest {
         @DisplayName("returns 404 when run is unknown")
         void notFound() {
             when(runRegistry.get("missing")).thenReturn(null);
+            when(jobOwnershipService.extractJobId("missing")).thenReturn("missing");
+            when(jobOwnershipService.createScopedJobKey("missing")).thenReturn("missing");
 
             ResponseEntity<PolicyRunView> response = controller.status("missing");
 
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/KeyPairCleanupServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/KeyPairCleanupServiceTest.java
new file mode 100644
index 0000000000..c3cb0fb1ba
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/KeyPairCleanupServiceTest.java
@@ -0,0 +1,102 @@
+package stirling.software.proprietary.security.service;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Optional;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import stirling.software.common.cluster.DistributedLock;
+import stirling.software.common.cluster.DistributedLock.LockHandle;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.security.model.JwtVerificationKey;
+
+/** Cluster safety: pruning JWT keys is single-writer, gated on the shared cleanup lock. */
+@ExtendWith(MockitoExtension.class)
+class KeyPairCleanupServiceTest {
+
+    @Mock private KeyPersistenceService keyPersistenceService;
+    @Mock private ApplicationProperties applicationProperties;
+    @Mock private ApplicationProperties.Security security;
+    @Mock private ApplicationProperties.Security.Jwt jwtProperties;
+    @Mock private DistributedLock distributedLock;
+    @Mock private LockHandle lockHandle;
+
+    private KeyPairCleanupService cleanupService;
+
+    @BeforeEach
+    void setUp() {
+        lenient().when(applicationProperties.getSecurity()).thenReturn(security);
+        lenient().when(security.getJwt()).thenReturn(jwtProperties);
+        lenient().when(jwtProperties.isEnableKeyCleanup()).thenReturn(true);
+        lenient().when(keyPersistenceService.isKeystoreEnabled()).thenReturn(true);
+        cleanupService =
+                new KeyPairCleanupService(
+                        keyPersistenceService, applicationProperties, distributedLock);
+    }
+
+    @Test
+    void skipsPruningWhenAnotherNodeHoldsTheLock() {
+        when(distributedLock.tryAcquire(any(), any())).thenReturn(Optional.empty());
+
+        cleanupService.cleanup();
+
+        // No node-local pruning happened; the lock holder owns this cycle.
+        verify(keyPersistenceService, never()).getKeysEligibleForCleanup(any());
+        verify(keyPersistenceService, never()).refreshActiveKeyPair();
+    }
+
+    @Test
+    void prunesAndRotatesWhenLockAcquiredThenReleasesIt() {
+        when(distributedLock.tryAcquire(any(), any())).thenReturn(Optional.of(lockHandle));
+        when(keyPersistenceService.getKeysEligibleForCleanup(any()))
+                .thenReturn(List.of(new JwtVerificationKey("old-key", "cHVi")));
+
+        cleanupService.cleanup();
+
+        verify(keyPersistenceService).removeKey("old-key");
+        verify(keyPersistenceService).refreshActiveKeyPair();
+        verify(lockHandle).close();
+    }
+
+    @Test
+    void releasesTheLockEvenWhenNoKeysAreEligible() {
+        when(distributedLock.tryAcquire(any(), any())).thenReturn(Optional.of(lockHandle));
+        when(keyPersistenceService.getKeysEligibleForCleanup(any())).thenReturn(List.of());
+
+        cleanupService.cleanup();
+
+        verify(keyPersistenceService, never()).refreshActiveKeyPair();
+        verify(lockHandle).close();
+    }
+
+    @Test
+    void skipsPruningWhenTheLockBackendErrors() {
+        // A Valkey blip at boot must not fail startup: tryAcquire throwing degrades to skip.
+        when(distributedLock.tryAcquire(any(), any()))
+                .thenThrow(new RuntimeException("valkey unreachable"));
+
+        cleanupService.cleanup();
+
+        verify(keyPersistenceService, never()).getKeysEligibleForCleanup(any());
+        verify(keyPersistenceService, never()).refreshActiveKeyPair();
+    }
+
+    @Test
+    void doesNothingWhenCleanupDisabled() {
+        when(jwtProperties.isEnableKeyCleanup()).thenReturn(false);
+
+        cleanupService.cleanup();
+
+        verify(distributedLock, never()).tryAcquire(any(), any());
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/KeyPersistenceServiceInterfaceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/KeyPersistenceServiceInterfaceTest.java
index 33b971e5ac..f16117fdb9 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/KeyPersistenceServiceInterfaceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/KeyPersistenceServiceInterfaceTest.java
@@ -4,45 +4,41 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.lenient;
-import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.NoSuchAlgorithmException;
 import java.util.Base64;
+import java.util.List;
 import java.util.Optional;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.extension.ExtendWith;
-import org.junit.jupiter.api.io.TempDir;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.ValueSource;
 import org.mockito.Mock;
-import org.mockito.MockedStatic;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.cache.CacheManager;
 import org.springframework.cache.concurrent.ConcurrentMapCacheManager;
 
-import stirling.software.common.configuration.InstallationPathConfig;
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.security.model.JwtSigningKeyEntity;
 import stirling.software.proprietary.security.model.JwtVerificationKey;
+import stirling.software.proprietary.security.repository.JwtSigningKeyRepository;
 
+/** DB-backed keystore: a key present only in the shared DB still resolves (the cross-node case). */
 @ExtendWith(MockitoExtension.class)
 class KeyPersistenceServiceInterfaceTest {
 
     @Mock private ApplicationProperties applicationProperties;
-
     @Mock private ApplicationProperties.Security security;
-
     @Mock private ApplicationProperties.Security.Jwt jwtConfig;
-
-    @TempDir Path tempDir;
+    @Mock private JwtSigningKeyRepository keyRepository;
 
     private KeyPersistenceService keyPersistenceService;
     private KeyPair testKeyPair;
@@ -58,175 +54,128 @@ class KeyPersistenceServiceInterfaceTest {
 
         lenient().when(applicationProperties.getSecurity()).thenReturn(security);
         lenient().when(security.getJwt()).thenReturn(jwtConfig);
-        lenient().when(jwtConfig.isEnableKeystore()).thenReturn(true); // Default value
+        lenient().when(jwtConfig.isEnableKeystore()).thenReturn(true);
+        lenient().when(keyRepository.save(any())).thenAnswer(inv -> inv.getArgument(0));
+        // clusterEnabled=true so the convergence-reload path is exercised.
+        keyPersistenceService =
+                new KeyPersistenceService(applicationProperties, cacheManager, keyRepository, true);
+    }
+
+    private JwtSigningKeyEntity entityFrom(String keyId) {
+        return new JwtSigningKeyEntity(
+                keyId,
+                Base64.getEncoder().encodeToString(testKeyPair.getPublic().getEncoded()),
+                Base64.getEncoder().encodeToString(testKeyPair.getPrivate().getEncoded()));
     }
 
     @ParameterizedTest
     @ValueSource(booleans = {true, false})
     void testKeystoreEnabled(boolean keystoreEnabled) {
         when(jwtConfig.isEnableKeystore()).thenReturn(keystoreEnabled);
-
-        try (MockedStatic<InstallationPathConfig> mockedStatic =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedStatic
-                    .when(InstallationPathConfig::getPrivateKeyPath)
-                    .thenReturn(tempDir.toString());
-            keyPersistenceService = new KeyPersistenceService(applicationProperties, cacheManager);
-
-            assertEquals(keystoreEnabled, keyPersistenceService.isKeystoreEnabled());
-        }
+        assertEquals(keystoreEnabled, keyPersistenceService.isKeystoreEnabled());
     }
 
     @Test
-    void testGetActiveKeypairWhenNoActiveKeyExists() {
-        try (MockedStatic<InstallationPathConfig> mockedStatic =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedStatic
-                    .when(InstallationPathConfig::getPrivateKeyPath)
-                    .thenReturn(tempDir.toString());
-            keyPersistenceService = new KeyPersistenceService(applicationProperties, cacheManager);
-            keyPersistenceService.initializeKeystore();
+    void generatesAndPersistsAKeyWhenNoneIsActive() {
+        // getActiveKey with no active key mints one and persists it - no disk involved.
+        JwtVerificationKey active = keyPersistenceService.getActiveKey();
 
-            JwtVerificationKey result = keyPersistenceService.getActiveKey();
-
-            assertNotNull(result);
-            assertNotNull(result.getKeyId());
-            assertNotNull(result.getVerifyingKey());
-        }
+        assertNotNull(active);
+        assertNotNull(active.getKeyId());
+        assertNotNull(active.getVerifyingKey());
+        verify(keyRepository).save(any(JwtSigningKeyEntity.class));
     }
 
     @Test
-    void testGetActiveKeyPairWithExistingKey() throws Exception {
-        String keyId = "test-key-2024-01-01-120000";
-        String publicKeyBase64 =
-                Base64.getEncoder().encodeToString(testKeyPair.getPublic().getEncoded());
-        String privateKeyBase64 =
-                Base64.getEncoder().encodeToString(testKeyPair.getPrivate().getEncoded());
+    void loadsTheMostRecentExistingKeyAsActive() {
+        when(keyRepository.count()).thenReturn(1L);
+        when(keyRepository.findAllByOrderByCreatedAtDesc())
+                .thenReturn(List.of(entityFrom("jwt-key-2026-07-13-000000-abcd1234")));
 
-        JwtVerificationKey existingKey = new JwtVerificationKey(keyId, publicKeyBase64);
+        keyPersistenceService.initializeKeystore();
+        JwtVerificationKey active = keyPersistenceService.getActiveKey();
 
-        Path keyFile = tempDir.resolve(keyId + ".key");
-        Files.writeString(keyFile, privateKeyBase64);
-
-        try (MockedStatic<InstallationPathConfig> mockedStatic =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedStatic
-                    .when(InstallationPathConfig::getPrivateKeyPath)
-                    .thenReturn(tempDir.toString());
-            keyPersistenceService = new KeyPersistenceService(applicationProperties, cacheManager);
-            keyPersistenceService.initializeKeystore();
-
-            JwtVerificationKey result = keyPersistenceService.getActiveKey();
-
-            assertNotNull(result);
-            assertNotNull(result.getKeyId());
-        }
+        assertEquals("jwt-key-2026-07-13-000000-abcd1234", active.getKeyId());
     }
 
     @Test
-    void testGetKeyPair() throws Exception {
-        String keyId = "test-key-123";
-        String publicKeyBase64 =
-                Base64.getEncoder().encodeToString(testKeyPair.getPublic().getEncoded());
-        String privateKeyBase64 =
-                Base64.getEncoder().encodeToString(testKeyPair.getPrivate().getEncoded());
+    void getKeyPairResolvesAKeyPresentOnlyInTheSharedDb() {
+        // Never initialised locally: the key lives only in the DB, as if another node minted it.
+        String keyId = "jwt-key-from-another-node";
+        when(keyRepository.findById(keyId)).thenReturn(Optional.of(entityFrom(keyId)));
 
-        JwtVerificationKey signingKey = new JwtVerificationKey(keyId, publicKeyBase64);
+        Optional<KeyPair> result = keyPersistenceService.getKeyPair(keyId);
 
-        Path keyFile = tempDir.resolve(keyId + ".key");
-        Files.writeString(keyFile, privateKeyBase64);
-
-        try (MockedStatic<InstallationPathConfig> mockedStatic =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedStatic
-                    .when(InstallationPathConfig::getPrivateKeyPath)
-                    .thenReturn(tempDir.toString());
-            keyPersistenceService = new KeyPersistenceService(applicationProperties, cacheManager);
-
-            keyPersistenceService
-                    .getClass()
-                    .getDeclaredField("verifyingKeyCache")
-                    .setAccessible(true);
-            var cache = cacheManager.getCache("verifyingKeys");
-            cache.put(keyId, signingKey);
-
-            Optional<KeyPair> result = keyPersistenceService.getKeyPair(keyId);
-
-            assertTrue(result.isPresent());
-            assertNotNull(result.get().getPublic());
-            assertNotNull(result.get().getPrivate());
-        }
+        assertTrue(result.isPresent());
+        assertNotNull(result.get().getPublic());
+        assertNotNull(result.get().getPrivate());
     }
 
     @Test
-    void testGetKeyPairNotFound() {
-        String keyId = "non-existent-key";
-
-        try (MockedStatic<InstallationPathConfig> mockedStatic =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedStatic
-                    .when(InstallationPathConfig::getPrivateKeyPath)
-                    .thenReturn(tempDir.toString());
-            keyPersistenceService = new KeyPersistenceService(applicationProperties, cacheManager);
-
-            Optional<KeyPair> result = keyPersistenceService.getKeyPair(keyId);
-
-            assertFalse(result.isPresent());
-        }
+    void getKeyPairIsEmptyWhenTheKeyIsUnknown() {
+        when(keyRepository.findById("nope")).thenReturn(Optional.empty());
+        assertFalse(keyPersistenceService.getKeyPair("nope").isPresent());
     }
 
     @Test
-    void testGetKeyPairWhenKeystoreDisabled() {
+    void getKeyPairIsEmptyWhenKeystoreDisabled() {
         when(jwtConfig.isEnableKeystore()).thenReturn(false);
-
-        try (MockedStatic<InstallationPathConfig> mockedStatic =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedStatic
-                    .when(InstallationPathConfig::getPrivateKeyPath)
-                    .thenReturn(tempDir.toString());
-            keyPersistenceService = new KeyPersistenceService(applicationProperties, cacheManager);
-
-            Optional<KeyPair> result = keyPersistenceService.getKeyPair("any-key");
-
-            assertFalse(result.isPresent());
-        }
+        assertFalse(keyPersistenceService.getKeyPair("any-key").isPresent());
     }
 
     @Test
-    void testInitializeKeystoreCreatesDirectory() throws IOException {
-        try (MockedStatic<InstallationPathConfig> mockedStatic =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedStatic
-                    .when(InstallationPathConfig::getPrivateKeyPath)
-                    .thenReturn(tempDir.toString());
-            keyPersistenceService = new KeyPersistenceService(applicationProperties, cacheManager);
-            keyPersistenceService.initializeKeystore();
+    void eligibleForCleanupIsSourcedFromTheDb() {
+        when(keyRepository.findByCreatedAtBefore(any())).thenReturn(List.of(entityFrom("old-key")));
 
-            assertTrue(Files.exists(tempDir));
-            assertTrue(Files.isDirectory(tempDir));
-        }
+        List<JwtVerificationKey> stale =
+                keyPersistenceService.getKeysEligibleForCleanup(java.time.LocalDateTime.now());
+
+        assertEquals(1, stale.size());
+        assertEquals("old-key", stale.get(0).getKeyId());
     }
 
     @Test
-    void testLoadExistingKeypairWithMissingPrivateKeyFile() throws Exception {
-        String keyId = "test-key-missing-file";
-        String publicKeyBase64 =
-                Base64.getEncoder().encodeToString(testKeyPair.getPublic().getEncoded());
+    void reloadAdoptsTheNewestKeyAPeerMinted() {
+        // Boot with our own key active, then a peer mints a newer one in the shared DB.
+        when(keyRepository.count()).thenReturn(1L);
+        when(keyRepository.findAllByOrderByCreatedAtDesc())
+                .thenReturn(List.of(entityFrom("jwt-key-local-old")));
+        keyPersistenceService.initializeKeystore();
+        assertEquals("jwt-key-local-old", keyPersistenceService.getActiveKey().getKeyId());
 
-        JwtVerificationKey existingKey = new JwtVerificationKey(keyId, publicKeyBase64);
+        when(keyRepository.findFirstByOrderByCreatedAtDesc())
+                .thenReturn(Optional.of(entityFrom("jwt-key-peer-new")));
 
-        try (MockedStatic<InstallationPathConfig> mockedStatic =
-                mockStatic(InstallationPathConfig.class)) {
-            mockedStatic
-                    .when(InstallationPathConfig::getPrivateKeyPath)
-                    .thenReturn(tempDir.toString());
-            keyPersistenceService = new KeyPersistenceService(applicationProperties, cacheManager);
-            keyPersistenceService.initializeKeystore();
+        keyPersistenceService.reloadActiveKeyFromDb();
 
-            JwtVerificationKey result = keyPersistenceService.getActiveKey();
-            assertNotNull(result);
-            assertNotNull(result.getKeyId());
-            assertNotNull(result.getVerifyingKey());
-        }
+        // Converged: this node now signs with the peer's newer key.
+        assertEquals("jwt-key-peer-new", keyPersistenceService.getActiveKey().getKeyId());
+    }
+
+    @Test
+    void reloadDoesNothingOffCluster() {
+        KeyPersistenceService singleNode =
+                new KeyPersistenceService(
+                        applicationProperties, cacheManager, keyRepository, false);
+
+        singleNode.reloadActiveKeyFromDb();
+
+        // Off-cluster the DB is never consulted for convergence.
+        verify(keyRepository, org.mockito.Mockito.never()).findFirstByOrderByCreatedAtDesc();
+    }
+
+    @Test
+    void reloadIsANoOpWhenAlreadyHoldingTheNewestKey() {
+        when(keyRepository.count()).thenReturn(1L);
+        when(keyRepository.findAllByOrderByCreatedAtDesc())
+                .thenReturn(List.of(entityFrom("jwt-key-current")));
+        keyPersistenceService.initializeKeystore();
+
+        when(keyRepository.findFirstByOrderByCreatedAtDesc())
+                .thenReturn(Optional.of(entityFrom("jwt-key-current")));
+
+        keyPersistenceService.reloadActiveKeyFromDb();
+
+        assertEquals("jwt-key-current", keyPersistenceService.getActiveKey().getKeyId());
     }
 }

From 49cc3f88f943c6c5cf4ab202928a5c4681d6405c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 23:05:10 +0200
Subject: [PATCH 064/109] build(deps): bump ubuntu from `c4a8d55` to `4fbb8e6`
 in /docker/base (#6554)

Bumps ubuntu from `c4a8d55` to `4fbb8e6`.


> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 docker/base/Dockerfile | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/docker/base/Dockerfile b/docker/base/Dockerfile
index c3a2c0d551..ce35373ef0 100644
--- a/docker/base/Dockerfile
+++ b/docker/base/Dockerfile
@@ -5,7 +5,7 @@
 ARG TARGETPLATFORM
 
 # Stage 1: Build and strip Calibre
-FROM ubuntu:noble@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b AS calibre-build
+FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 AS calibre-build
 ARG TARGETPLATFORM
 ARG CALIBRE_VERSION=9.4.0
 ARG CALIBRE_STRIP_WEBENGINE=false
@@ -270,7 +270,7 @@ RUN if [ "${CALIBRE_STRIP_WEBENGINE}" = "true" ]; then \
 
 
 # Stage 2: Build Ghostscript from source
-FROM ubuntu:noble@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b AS gs-build
+FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 AS gs-build
 ARG TARGETPLATFORM
 ARG GS_VERSION=10.06.0
 
@@ -294,7 +294,7 @@ RUN --mount=type=cache,target=/var/cache/apt,sharing=locked \
 
 
 # Stage 3: Build PDF Tools (QPDF and ImageMagick 7)
-FROM ubuntu:noble@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b AS pdf-tools-build
+FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 AS pdf-tools-build
 ARG TARGETPLATFORM
 ARG QPDF_VERSION=12.3.2
 ARG IM_VERSION=7.1.2-13
@@ -339,7 +339,7 @@ RUN mkdir -p /magick-export/usr/bin \
 
 
 # Stage 4: Build Python venv
-FROM ubuntu:noble@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b AS python-venv-build
+FROM ubuntu:noble@sha256:4fbb8e6a8395de5a7550b33509421a2bafbc0aab6c06ba2cef9ebffbc7092d90 AS python-venv-build
 ARG TARGETPLATFORM
 ARG UNOSERVER_VERSION=3.6
 

From 14def378bf5c219c5421e025a1c64925dcfc7dac Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Tue, 21 Jul 2026 09:05:25 +0200
Subject: [PATCH 065/109] chore(frontend): update frontend dependencies to
 latest compatible versions (#6860)

# Description of Changes

This change updates multiple frontend dependencies to their latest
compatible releases by refreshing the `package-lock.json`. The update
includes dependency version bumps across the frontend toolchain and
runtime libraries while removing obsolete transitive dependencies
introduced by newer package versions.

### What was changed

- Updated Babel packages to the latest 7.29.x releases.
- Upgraded Vite from 7.3.2 to 7.3.6.
- Upgraded Vitest packages from 3.2.4 to 3.2.6.
- Updated React Router and React Router DOM from 7.13.2 to 7.18.1.
- Updated Axios from 1.15.0 to 1.18.1.
- Updated PostHog packages to newer releases.
- Updated additional frontend dependencies including Preact, Web Vitals,
FormData, HasOwn, Brace Expansion, and other transitive packages.
- Removed obsolete OpenTelemetry and Protobuf-related transitive
dependencies that are no longer required by the updated dependency
graph.
- Refreshed the lockfile to reflect the new dependency tree.

### Why the change was made

- Keep frontend dependencies up to date.
- Incorporate upstream bug fixes, performance improvements, and security
updates.
- Reduce unnecessary transitive dependencies where newer package
versions no longer require them.
- Maintain compatibility with the current frontend toolchain.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../components/shared/FileSelectorPicker.tsx  |   21 +-
 .../src/core/contexts/FileManagerContext.tsx  |   22 +-
 .../src/core/contexts/FilesModalContext.tsx   |   31 +-
 .../src/core/services/shareBundleUtils.ts     |   42 +
 .../core/services/signatureStorageService.ts  |    5 +-
 .../proprietary/routes/ShareLinkLoader.tsx    |   19 +-
 .../proprietary/services/shareLinkImport.ts   |   15 +-
 frontend/package-lock.json                    | 1010 +++++++----------
 frontend/package.json                         |    2 +-
 9 files changed, 487 insertions(+), 680 deletions(-)

diff --git a/frontend/editor/src/core/components/shared/FileSelectorPicker.tsx b/frontend/editor/src/core/components/shared/FileSelectorPicker.tsx
index 8c8123bd7d..83a249c38f 100644
--- a/frontend/editor/src/core/components/shared/FileSelectorPicker.tsx
+++ b/frontend/editor/src/core/components/shared/FileSelectorPicker.tsx
@@ -20,6 +20,7 @@ import apiClient from "@app/services/apiClient";
 import {
   parseContentDispositionFilename,
   extractLatestFilesFromBundle,
+  readResponseHeader,
 } from "@app/services/shareBundleUtils";
 import { truncateCenter } from "@app/utils/textUtils";
 import { generateThumbnailForFile } from "@app/utils/thumbnailUtils";
@@ -270,14 +271,8 @@ export function FileSelectorPicker({
               skipAuthRedirect: true,
             } as any,
           );
-          const ct =
-            res.headers?.["content-type"] ||
-            res.headers?.["Content-Type"] ||
-            "";
-          const disp =
-            res.headers?.["content-disposition"] ||
-            res.headers?.["Content-Disposition"] ||
-            "";
+          const ct = readResponseHeader(res.headers, "content-type");
+          const disp = readResponseHeader(res.headers, "content-disposition");
           const files = await extractLatestFilesFromBundle(
             res.data as Blob,
             parseContentDispositionFilename(disp) || "shared-file",
@@ -294,14 +289,8 @@ export function FileSelectorPicker({
               skipAuthRedirect: true,
             } as any,
           );
-          const ct =
-            res.headers?.["content-type"] ||
-            res.headers?.["Content-Type"] ||
-            "";
-          const disp =
-            res.headers?.["content-disposition"] ||
-            res.headers?.["Content-Disposition"] ||
-            "";
+          const ct = readResponseHeader(res.headers, "content-type");
+          const disp = readResponseHeader(res.headers, "content-disposition");
           const files = await extractLatestFilesFromBundle(
             res.data as Blob,
             parseContentDispositionFilename(disp) || stub.name,
diff --git a/frontend/editor/src/core/contexts/FileManagerContext.tsx b/frontend/editor/src/core/contexts/FileManagerContext.tsx
index a557a9d31b..338a910508 100644
--- a/frontend/editor/src/core/contexts/FileManagerContext.tsx
+++ b/frontend/editor/src/core/contexts/FileManagerContext.tsx
@@ -22,6 +22,7 @@ import { alert } from "@app/components/toast";
 import {
   extractLatestFilesFromBundle,
   parseContentDispositionFilename,
+  readResponseHeader,
 } from "@app/services/shareBundleUtils";
 import { useTranslation } from "react-i18next";
 import { openFilesFromDisk } from "@app/services/openFilesFromDisk";
@@ -1003,16 +1004,14 @@ export const FileManagerProvider: React.FC<FileManagerProviderProps> = ({
             skipAuthRedirect: true,
           } as any,
         );
-        const contentType =
-          (response.headers &&
-            (response.headers["content-type"] ||
-              response.headers["Content-Type"])) ||
-          "";
-        const disposition =
-          (response.headers &&
-            (response.headers["content-disposition"] ||
-              response.headers["Content-Disposition"])) ||
-          "";
+        const contentType = readResponseHeader(
+          response.headers,
+          "content-type",
+        );
+        const disposition = readResponseHeader(
+          response.headers,
+          "content-disposition",
+        );
         const filename =
           parseContentDispositionFilename(disposition) ||
           file.name ||
@@ -1270,6 +1269,3 @@ export const useFileManagerContext = (): FileManagerContextValue => {
 
   return context;
 };
-
-// Export the context for advanced use cases
-export { FileManagerContext };
diff --git a/frontend/editor/src/core/contexts/FilesModalContext.tsx b/frontend/editor/src/core/contexts/FilesModalContext.tsx
index 9d9bf0bd52..73d1b0477f 100644
--- a/frontend/editor/src/core/contexts/FilesModalContext.tsx
+++ b/frontend/editor/src/core/contexts/FilesModalContext.tsx
@@ -23,6 +23,7 @@ import {
   isZipBundle,
   loadShareBundleEntries,
   parseContentDispositionFilename,
+  readResponseHeader,
 } from "@app/services/shareBundleUtils";
 
 interface FilesModalContextType {
@@ -184,16 +185,11 @@ export const FilesModalProvider: React.FC<{ children: React.ReactNode }> = ({
         skipAuthRedirect: true,
       } as any,
     );
-    const contentType =
-      (response.headers &&
-        (response.headers["content-type"] ||
-          response.headers["Content-Type"])) ||
-      "";
-    const disposition =
-      (response.headers &&
-        (response.headers["content-disposition"] ||
-          response.headers["Content-Disposition"])) ||
-      "";
+    const contentType = readResponseHeader(response.headers, "content-type");
+    const disposition = readResponseHeader(
+      response.headers,
+      "content-disposition",
+    );
     const filename =
       parseContentDispositionFilename(disposition) || "server-file";
     const blob = response.data as Blob;
@@ -210,16 +206,11 @@ export const FilesModalProvider: React.FC<{ children: React.ReactNode }> = ({
         skipAuthRedirect: true,
       } as any,
     );
-    const contentType =
-      (response.headers &&
-        (response.headers["content-type"] ||
-          response.headers["Content-Type"])) ||
-      "";
-    const disposition =
-      (response.headers &&
-        (response.headers["content-disposition"] ||
-          response.headers["Content-Disposition"])) ||
-      "";
+    const contentType = readResponseHeader(response.headers, "content-type");
+    const disposition = readResponseHeader(
+      response.headers,
+      "content-disposition",
+    );
     const filename =
       parseContentDispositionFilename(disposition) || "shared-file";
     const blob = response.data as Blob;
diff --git a/frontend/editor/src/core/services/shareBundleUtils.ts b/frontend/editor/src/core/services/shareBundleUtils.ts
index a5db773e50..a5cd301dcd 100644
--- a/frontend/editor/src/core/services/shareBundleUtils.ts
+++ b/frontend/editor/src/core/services/shareBundleUtils.ts
@@ -4,6 +4,48 @@ import type { ShareBundleManifest } from "@app/services/serverStorageBundle";
 
 const MANIFEST_FILENAME = "stirling-share.json";
 
+type HeaderLike = {
+  get?: (name: string) => unknown;
+  [key: string]: unknown;
+};
+
+function headerValueToString(value: unknown): string {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean") {
+    return String(value);
+  }
+  if (Array.isArray(value)) {
+    const firstString = value.find(
+      (entry): entry is string => typeof entry === "string",
+    );
+    return firstString ?? "";
+  }
+  return "";
+}
+
+function toHeaderKey(name: string): string {
+  return name.replace(
+    /(^|-)([a-z])/g,
+    (_, prefix: string, char: string) => prefix + char.toUpperCase(),
+  );
+}
+
+export function readResponseHeader(headers: unknown, name: string): string {
+  if (!headers || typeof headers !== "object") {
+    return "";
+  }
+
+  const typedHeaders = headers as HeaderLike;
+  if (typeof typedHeaders.get === "function") {
+    return headerValueToString(typedHeaders.get(name));
+  }
+
+  return (
+    headerValueToString(typedHeaders[name]) ||
+    headerValueToString(typedHeaders[toHeaderKey(name)])
+  );
+}
+
 export function parseContentDispositionFilename(
   disposition?: string,
 ): string | null {
diff --git a/frontend/editor/src/core/services/signatureStorageService.ts b/frontend/editor/src/core/services/signatureStorageService.ts
index 018d39cfa7..1cc0ac9360 100644
--- a/frontend/editor/src/core/services/signatureStorageService.ts
+++ b/frontend/editor/src/core/services/signatureStorageService.ts
@@ -1,5 +1,6 @@
 import apiClient from "@app/services/apiClient";
 import type { SavedSignature } from "@app/types/signature";
+import { readResponseHeader } from "@app/services/shareBundleUtils";
 
 export type StorageType = "backend" | "localStorage";
 
@@ -166,7 +167,9 @@ class SignatureStorageService {
 
             // Convert to data URL (base64) for both display and use
             const blob = new Blob([imageResponse.data], {
-              type: imageResponse.headers["content-type"] || "image/png",
+              type:
+                readResponseHeader(imageResponse.headers, "content-type") ||
+                "image/png",
             });
 
             const dataUrl = await new Promise<string>((resolve, reject) => {
diff --git a/frontend/editor/src/proprietary/routes/ShareLinkLoader.tsx b/frontend/editor/src/proprietary/routes/ShareLinkLoader.tsx
index 827161d00c..1984e55f2a 100644
--- a/frontend/editor/src/proprietary/routes/ShareLinkLoader.tsx
+++ b/frontend/editor/src/proprietary/routes/ShareLinkLoader.tsx
@@ -15,6 +15,7 @@ import {
   isZipBundle,
   loadShareBundleEntries,
   parseContentDispositionFilename,
+  readResponseHeader,
 } from "@app/services/shareBundleUtils";
 
 interface ShareLinkLoaderProps {
@@ -78,16 +79,14 @@ export default function ShareLinkLoader({ token }: ShareLinkLoaderProps) {
         );
         if (signal.aborted) return;
 
-        const contentType =
-          (response.headers &&
-            (response.headers["content-type"] ||
-              response.headers["Content-Type"])) ||
-          "";
-        const disposition =
-          (response.headers &&
-            (response.headers["content-disposition"] ||
-              response.headers["Content-Disposition"])) ||
-          "";
+        const contentType = readResponseHeader(
+          response.headers,
+          "content-type",
+        );
+        const disposition = readResponseHeader(
+          response.headers,
+          "content-disposition",
+        );
         const filename =
           parseContentDispositionFilename(disposition) || "shared-file";
         const blob = response.data as Blob;
diff --git a/frontend/editor/src/proprietary/services/shareLinkImport.ts b/frontend/editor/src/proprietary/services/shareLinkImport.ts
index 54860b1807..d498e26595 100644
--- a/frontend/editor/src/proprietary/services/shareLinkImport.ts
+++ b/frontend/editor/src/proprietary/services/shareLinkImport.ts
@@ -8,6 +8,7 @@ import {
   isZipBundle,
   loadShareBundleEntries,
   parseContentDispositionFilename,
+  readResponseHeader,
 } from "@app/services/shareBundleUtils";
 
 export interface ShareLinkMetadata {
@@ -44,15 +45,11 @@ export async function downloadShareLink(token: string): Promise<{
     suppressErrorToast: true,
     skipAuthRedirect: true,
   });
-  const contentType =
-    (response.headers &&
-      (response.headers["content-type"] || response.headers["Content-Type"])) ||
-    "";
-  const disposition =
-    (response.headers &&
-      (response.headers["content-disposition"] ||
-        response.headers["Content-Disposition"])) ||
-    "";
+  const contentType = readResponseHeader(response.headers, "content-type");
+  const disposition = readResponseHeader(
+    response.headers,
+    "content-disposition",
+  );
   const filename =
     parseContentDispositionFilename(disposition) || "shared-file";
   const blob = response.data as Blob;
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 726799948f..2ddece68a0 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -129,7 +129,7 @@
         "puppeteer": "^24.25.0",
         "rollup-plugin-visualizer": "^7.0.1",
         "storybook": "^9.1.20",
-        "tsx": "^4.21.0",
+        "tsx": "^4.22.4",
         "typescript": "npm:@typescript/typescript6@^6.0.2",
         "typescript-eslint": "^8.61.1",
         "vite": "^7.3.2",
@@ -258,12 +258,12 @@
       }
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -272,9 +272,9 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.3.tgz",
-      "integrity": "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -282,21 +282,21 @@
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
-      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-compilation-targets": "^7.28.6",
-        "@babel/helper-module-transforms": "^7.28.6",
-        "@babel/helpers": "^7.28.6",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
@@ -330,13 +330,13 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz",
+      "integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==",
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -346,14 +346,14 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -383,37 +383,37 @@
       }
     },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "license": "MIT",
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -441,9 +441,9 @@
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -451,14 +451,14 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.2.tgz",
-      "integrity": "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -489,31 +489,31 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz",
+      "integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==",
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -1353,9 +1353,9 @@
       "license": "MIT"
     },
     "node_modules/@esbuild/aix-ppc64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.4.tgz",
-      "integrity": "sha512-cQPwL2mp2nSmHHJlCyoXgHGhbEPMrEEU5xhkcy3Hs/O7nGZqEpZ2sUtLaL9MORLtDfRvVl2/3PAuEkYZH0Ty8Q==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.28.1.tgz",
+      "integrity": "sha512-Svl7tq8k/08+p6CXPpRjQ1fKX+1odH/BQbb48fV6fj3CWHhsoIOoY87w1oHXm0qEpkIK3ZfVgp0hed3XBXzXMQ==",
       "cpu": [
         "ppc64"
       ],
@@ -1370,9 +1370,9 @@
       }
     },
     "node_modules/@esbuild/android-arm": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.4.tgz",
-      "integrity": "sha512-X9bUgvxiC8CHAGKYufLIHGXPJWnr0OCdR0anD2e21vdvgCI8lIfqFbnoeOz7lBjdrAGUhqLZLcQo6MLhTO2DKQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.28.1.tgz",
+      "integrity": "sha512-0k2F129Xdio1TdJfzJ8sy1Q47vUD2NnwdhiAf7drUN1EBTfPf4hsFCtmMgu/6m8JSzsBrlmVjudMBQqOfG8usQ==",
       "cpu": [
         "arm"
       ],
@@ -1387,9 +1387,9 @@
       }
     },
     "node_modules/@esbuild/android-arm64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.4.tgz",
-      "integrity": "sha512-gdLscB7v75wRfu7QSm/zg6Rx29VLdy9eTr2t44sfTW7CxwAtQghZ4ZnqHk3/ogz7xao0QAgrkradbBzcqFPasw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.28.1.tgz",
+      "integrity": "sha512-34EGEbCIAgosYz6goLcopX6Mo7NyGv9tfwEM2/7Ce2VcVRk568iSvniGWcUXIy7wEDR1wzolcxcriFVrWYcwBg==",
       "cpu": [
         "arm64"
       ],
@@ -1404,9 +1404,9 @@
       }
     },
     "node_modules/@esbuild/android-x64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.4.tgz",
-      "integrity": "sha512-PzPFnBNVF292sfpfhiyiXCGSn9HZg5BcAz+ivBuSsl6Rk4ga1oEXAamhOXRFyMcjwr2DVtm40G65N3GLeH1Lvw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.28.1.tgz",
+      "integrity": "sha512-dbwY7ltSMDWsRatcRpCnES4F+im88OCUgGZjy52shC7GqHRE/cYlxNbB4Z4UpJswpcc4Qxd2oE/ufM0p61IKng==",
       "cpu": [
         "x64"
       ],
@@ -1421,9 +1421,9 @@
       }
     },
     "node_modules/@esbuild/darwin-arm64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.4.tgz",
-      "integrity": "sha512-b7xaGIwdJlht8ZFCvMkpDN6uiSmnxxK56N2GDTMYPr2/gzvfdQN8rTfBsvVKmIVY/X7EM+/hJKEIbbHs9oA4tQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.28.1.tgz",
+      "integrity": "sha512-TZbWkQY7kvTAXbXUT7uVACR5cMHsDiSz9z7ZKAX/RTq/WJEk3QyRr0wZpNhBDX+/0CtdqUIJlOiodQcta6tY3Q==",
       "cpu": [
         "arm64"
       ],
@@ -1438,9 +1438,9 @@
       }
     },
     "node_modules/@esbuild/darwin-x64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.4.tgz",
-      "integrity": "sha512-sR+OiKLwd15nmCdqpXMnuJ9W2kpy0KigzqScqHI3Hqwr7IXxBp3Yva+yJwoqh7rE8V77tdoheRYataNKL4QrPw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.28.1.tgz",
+      "integrity": "sha512-zfdzgK9ACBNZLI/CyHTOx81SyNbM6YXn7rxSgX97VjyiPl9W1i4Ka4fgKECEoFCKGpvBj5qArWIGgQjOwkgskQ==",
       "cpu": [
         "x64"
       ],
@@ -1455,9 +1455,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-arm64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.4.tgz",
-      "integrity": "sha512-jnfpKe+p79tCnm4GVav68A7tUFeKQwQyLgESwEAUzyxk/TJr4QdGog9sqWNcUbr/bZt/O/HXouspuQDd9JxFSw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-wG2EA8ENdEI0qhkSZMjfqrdY+ziCYCPMmtZjjIwOmXFjmyzEHn+UUxk5of+SYsjtfs3VpnlC7QLzSI5hY/rOAw==",
       "cpu": [
         "arm64"
       ],
@@ -1472,9 +1472,9 @@
       }
     },
     "node_modules/@esbuild/freebsd-x64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.4.tgz",
-      "integrity": "sha512-2kb4ceA/CpfUrIcTUl1wrP/9ad9Atrp5J94Lq69w7UwOMolPIGrfLSvAKJp0RTvkPPyn6CIWrNy13kyLikZRZQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i7dZ9vQgnvSCzi/rYCXNgtF/U+eKZNJBzu3eTQbRgHnM7tNSizLOkRFAl3qzVc/Op/u5YkHHa4pf/3DOYHthLQ==",
       "cpu": [
         "x64"
       ],
@@ -1489,9 +1489,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.4.tgz",
-      "integrity": "sha512-aBYgcIxX/wd5n2ys0yESGeYMGF+pv6g0DhZr3G1ZG4jMfruU9Tl1i2Z+Wnj9/KjGz1lTLCcorqE2viePZqj4Eg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.28.1.tgz",
+      "integrity": "sha512-qVXBOHQS+d5Y722GwJzJUtOLlX7km3CraOaGormF1pDtPd2C/l1SHRPgjLunLGe51Sh5YYWKMFDyV4SxgMQYTQ==",
       "cpu": [
         "arm"
       ],
@@ -1506,9 +1506,9 @@
       }
     },
     "node_modules/@esbuild/linux-arm64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.4.tgz",
-      "integrity": "sha512-7nQOttdzVGth1iz57kxg9uCz57dxQLHWxopL6mYuYthohPKEK0vU0C3O21CcBK6KDlkYVcnDXY099HcCDXd9dA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.28.1.tgz",
+      "integrity": "sha512-yHs+0uc8+nvEAfAfxrWQKK5peSNzBc4PegcMO0EJ2hT71uA7vB8Ihg2e77R2P7SG5uYjPbHlLLmve4LLLRCf0g==",
       "cpu": [
         "arm64"
       ],
@@ -1523,9 +1523,9 @@
       }
     },
     "node_modules/@esbuild/linux-ia32": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.4.tgz",
-      "integrity": "sha512-oPtixtAIzgvzYcKBQM/qZ3R+9TEUd1aNJQu0HhGyqtx6oS7qTpvjheIWBbes4+qu1bNlo2V4cbkISr8q6gRBFA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.28.1.tgz",
+      "integrity": "sha512-d1z4ZuP0ajrfz/FhGT4vv278rX8KnPPJx8i5+AtK7TYbx9Le9F1hyzurZpkEyjkGa9dUGhQow4C1NmeGvqxN2w==",
       "cpu": [
         "ia32"
       ],
@@ -1540,9 +1540,9 @@
       }
     },
     "node_modules/@esbuild/linux-loong64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.4.tgz",
-      "integrity": "sha512-8mL/vh8qeCoRcFH2nM8wm5uJP+ZcVYGGayMavi8GmRJjuI3g1v6Z7Ni0JJKAJW+m0EtUuARb6Lmp4hMjzCBWzA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.28.1.tgz",
+      "integrity": "sha512-M5sRjUVZrkm1OAPR3dlOYzNmN+loZKGVi1VUQGrwuqLcbR6qeAz+famMhjASeH3YVKvZz+zT1jlh/keC3Rj/lg==",
       "cpu": [
         "loong64"
       ],
@@ -1557,9 +1557,9 @@
       }
     },
     "node_modules/@esbuild/linux-mips64el": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.4.tgz",
-      "integrity": "sha512-1RdrWFFiiLIW7LQq9Q2NES+HiD4NyT8Itj9AUeCl0IVCA459WnPhREKgwrpaIfTOe+/2rdntisegiPWn/r/aAw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.28.1.tgz",
+      "integrity": "sha512-mRObBZeHh2OxcBFPWE/FjylkRgZdYuiTR3vaTozquCGOH14iP9oN4x4Ge81CoIDYQrXmIxpFumJBu5MtZpnQJQ==",
       "cpu": [
         "mips64el"
       ],
@@ -1574,9 +1574,9 @@
       }
     },
     "node_modules/@esbuild/linux-ppc64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.4.tgz",
-      "integrity": "sha512-tLCwNG47l3sd9lpfyx9LAGEGItCUeRCWeAx6x2Jmbav65nAwoPXfewtAdtbtit/pJFLUWOhpv0FpS6GQAmPrHA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.28.1.tgz",
+      "integrity": "sha512-slScBsMAb3GFDcdrCgLwZtPYRoH2H/youv10QiZyRjmsP48fznoveWytSgCI/R0ZcUgpc0ZhIUEx6LHts8yrfQ==",
       "cpu": [
         "ppc64"
       ],
@@ -1591,9 +1591,9 @@
       }
     },
     "node_modules/@esbuild/linux-riscv64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.4.tgz",
-      "integrity": "sha512-BnASypppbUWyqjd1KIpU4AUBiIhVr6YlHx/cnPgqEkNoVOhHg+YiSVxM1RLfiy4t9cAulbRGTNCKOcqHrEQLIw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.28.1.tgz",
+      "integrity": "sha512-kw0owk1o0GFETUJyW0jc0G4Yzs0BHZn0JDZ8JRT088vjJYX777BAs1fDGxAC+q831qOs2DTC96mNsG2opdfyyQ==",
       "cpu": [
         "riscv64"
       ],
@@ -1608,9 +1608,9 @@
       }
     },
     "node_modules/@esbuild/linux-s390x": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.4.tgz",
-      "integrity": "sha512-+eUqgb/Z7vxVLezG8bVB9SfBie89gMueS+I0xYh2tJdw3vqA/0ImZJ2ROeWwVJN59ihBeZ7Tu92dF/5dy5FttA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.28.1.tgz",
+      "integrity": "sha512-/lAIjX8aYFRByhh6L5rYtPEDRqa9de/4V/juOXcta5frjvzXO4/sqEtyytse0g3zZFuWu5cDN0MkLz2qRDD2Ag==",
       "cpu": [
         "s390x"
       ],
@@ -1625,9 +1625,9 @@
       }
     },
     "node_modules/@esbuild/linux-x64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.4.tgz",
-      "integrity": "sha512-S5qOXrKV8BQEzJPVxAwnryi2+Iq5pB40gTEIT69BQONqR7JH1EPIcQ/Uiv9mCnn05jff9umq/5nqzxlqTOg9NA==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.28.1.tgz",
+      "integrity": "sha512-u/anNYF2mmVOEDwLtnQ1wOr3EZ9sTNGLWrsYGYwHWzGA3Si84IOkHXlbWTD1NB+9/1lcnweYKO54uhxZydNzfA==",
       "cpu": [
         "x64"
       ],
@@ -1642,9 +1642,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-arm64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.4.tgz",
-      "integrity": "sha512-xHT8X4sb0GS8qTqiwzHqpY00C95DPAq7nAwX35Ie/s+LO9830hrMd3oX0ZMKLvy7vsonee73x0lmcdOVXFzd6Q==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-oks0DYbLwWMmaakTsCb+zL4E+aHRVLom9IJZOAthMQEPiQmydXHkziYEsGYRx0uNV/IjEKGAV941JzH02pflqw==",
       "cpu": [
         "arm64"
       ],
@@ -1659,9 +1659,9 @@
       }
     },
     "node_modules/@esbuild/netbsd-x64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.4.tgz",
-      "integrity": "sha512-RugOvOdXfdyi5Tyv40kgQnI0byv66BFgAqjdgtAKqHoZTbTF2QqfQrFwa7cHEORJf6X2ht+l9ABLMP0dnKYsgg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-aeL6lAnN89Hz43Mlh1G8ARasbuoYvSITDEx0tHh5b7jJnHcssqgjy9Yx430GDpmCa6OyrKoS0aNRjKundRizGg==",
       "cpu": [
         "x64"
       ],
@@ -1676,9 +1676,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-arm64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.4.tgz",
-      "integrity": "sha512-2MyL3IAaTX+1/qP0O1SwskwcwCoOI4kV2IBX1xYnDDqthmq5ArrW94qSIKCAuRraMgPOmG0RDTA74mzYNQA9ow==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.28.1.tgz",
+      "integrity": "sha512-MEFJe5C3R8pwXdZ5Y21oo6m7ePiS0d9pWucn99O/wvyJZChoIQKrQDxKrGeW8F5+T0okTHesAmDeiHDTIq0V/Q==",
       "cpu": [
         "arm64"
       ],
@@ -1693,9 +1693,9 @@
       }
     },
     "node_modules/@esbuild/openbsd-x64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.4.tgz",
-      "integrity": "sha512-u8fg/jQ5aQDfsnIV6+KwLOf1CmJnfu1ShpwqdwC0uA7ZPwFws55Ngc12vBdeUdnuWoQYx/SOQLGDcdlfXhYmXQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.28.1.tgz",
+      "integrity": "sha512-i/ZLIOafE0Z8cI/XANJAixoJL/uRAoS2xOA3rb0xN+KK0K177cMAsQYkzHtBrtMXAKuAc7HGgcWiZ/sRC1Nxgw==",
       "cpu": [
         "x64"
       ],
@@ -1710,9 +1710,9 @@
       }
     },
     "node_modules/@esbuild/openharmony-arm64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.4.tgz",
-      "integrity": "sha512-JkTZrl6VbyO8lDQO3yv26nNr2RM2yZzNrNHEsj9bm6dOwwu9OYN28CjzZkH57bh4w0I2F7IodpQvUAEd1mbWXg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.28.1.tgz",
+      "integrity": "sha512-ge+Z7EXFNt2BO1oAMsVpiQ8EwndV9i1xXerAeTIK7AtPs3bKFXQM7nlRxDSIUIMeueR1CNXxqztLzdNeReKBJg==",
       "cpu": [
         "arm64"
       ],
@@ -1727,9 +1727,9 @@
       }
     },
     "node_modules/@esbuild/sunos-x64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.4.tgz",
-      "integrity": "sha512-/gOzgaewZJfeJTlsWhvUEmUG4tWEY2Spp5M20INYRg2ZKl9QPO3QEEgPeRtLjEWSW8FilRNacPOg8R1uaYkA6g==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.28.1.tgz",
+      "integrity": "sha512-BEjgtECkL3vY+SaSQ6nzVfiALUeFxpawyp8Jmf5PtYhf1Ug40N1h/hxlhts+f1FvSvarEigdxS3BlSMI2PJLcQ==",
       "cpu": [
         "x64"
       ],
@@ -1744,9 +1744,9 @@
       }
     },
     "node_modules/@esbuild/win32-arm64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.4.tgz",
-      "integrity": "sha512-Z9SExBg2y32smoDQdf1HRwHRt6vAHLXcxD2uGgO/v2jK7Y718Ix4ndsbNMU/+1Qiem9OiOdaqitioZwxivhXYg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.28.1.tgz",
+      "integrity": "sha512-lCv9eK/H6ZJWbE7bh2nw54CZ9M2nupBxJcTsdk/QQnWkdSjKGuxmmH8/GWrlT1eMmZfn4dGcCjRte397WqfQXA==",
       "cpu": [
         "arm64"
       ],
@@ -1761,9 +1761,9 @@
       }
     },
     "node_modules/@esbuild/win32-ia32": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.4.tgz",
-      "integrity": "sha512-DAyGLS0Jz5G5iixEbMHi5KdiApqHBWMGzTtMiJ72ZOLhbu/bzxgAe8Ue8CTS3n3HbIUHQz/L51yMdGMeoxXNJw==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.28.1.tgz",
+      "integrity": "sha512-zvb/mB2bSCoJOpoCBgYKKpX6YM6mJBlBUVUtVj41DlZJVEB6/0CKlRYxP5wWl1C1ILiCoAU5wZZ4q1P3qeS6Eg==",
       "cpu": [
         "ia32"
       ],
@@ -1778,9 +1778,9 @@
       }
     },
     "node_modules/@esbuild/win32-x64": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.4.tgz",
-      "integrity": "sha512-+knoa0BDoeXgkNvvV1vvbZX4+hizelrkwmGJBdT17t8FNPwG2lKemmuMZlmaNQ3ws3DKKCxpb4zRZEIp3UxFCg==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.28.1.tgz",
+      "integrity": "sha512-bm4Mowrv+GXMlpWX++EcXw/iLyd1o3+bJkC2DkWXYVvgZCqD/bSj9ctZeAMC3cIxgjRVR2Dufaiu4YPxr5gW1A==",
       "cpu": [
         "x64"
       ],
@@ -2916,252 +2916,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/@opentelemetry/api": {
-      "version": "1.9.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
-      "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/@opentelemetry/api-logs": {
-      "version": "0.208.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/api-logs/-/api-logs-0.208.0.tgz",
-      "integrity": "sha512-CjruKY9V6NMssL/T1kAFgzosF1v9o6oeN+aX5JB/C/xPNtmgIJqcXHG7fA82Ou1zCpWGl4lROQUKwUNE1pMCyg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      },
-      "engines": {
-        "node": ">=8.0.0"
-      }
-    },
-    "node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/exporter-logs-otlp-http": {
-      "version": "0.208.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/exporter-logs-otlp-http/-/exporter-logs-otlp-http-0.208.0.tgz",
-      "integrity": "sha512-jOv40Bs9jy9bZVLo/i8FwUiuCvbjWDI+ZW13wimJm4LjnlwJxGgB+N/VWOZUTpM+ah/awXeQqKdNlpLf2EjvYg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.208.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-exporter-base": "0.208.0",
-        "@opentelemetry/otlp-transformer": "0.208.0",
-        "@opentelemetry/sdk-logs": "0.208.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      }
-    },
-    "node_modules/@opentelemetry/otlp-exporter-base": {
-      "version": "0.208.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-exporter-base/-/otlp-exporter-base-0.208.0.tgz",
-      "integrity": "sha512-gMd39gIfVb2OgxldxUtOwGJYSH8P1kVFFlJLuut32L6KgUC4gl1dMhn+YC2mGn0bDOiQYSk/uHOdSjuKp58vvA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/otlp-transformer": "0.208.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      }
-    },
-    "node_modules/@opentelemetry/otlp-transformer": {
-      "version": "0.208.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/otlp-transformer/-/otlp-transformer-0.208.0.tgz",
-      "integrity": "sha512-DCFPY8C6lAQHUNkzcNT9R+qYExvsk6C5Bto2pbNxgicpcSWbe2WHShLxkOxIdNcBiYPdVHv/e7vH7K6TI+C+fQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.208.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/sdk-logs": "0.208.0",
-        "@opentelemetry/sdk-metrics": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0",
-        "protobufjs": "^7.3.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": "^1.3.0"
-      }
-    },
-    "node_modules/@opentelemetry/otlp-transformer/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/resources": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.6.0.tgz",
-      "integrity": "sha512-D4y/+OGe3JSuYUCBxtH5T9DSAWNcvCb/nQWIga8HNtXTVPQn59j0nTBAgaAXxUVBDl40mG3Tc76b46wPlZaiJQ==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.6.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/resources/node_modules/@opentelemetry/core": {
-      "version": "2.6.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.6.0.tgz",
-      "integrity": "sha512-HLM1v2cbZ4TgYN6KEOj+Bbj8rAKriOdkF9Ed3tG25FoprSiQl7kYc+RRT6fUZGOvx0oMi5U67GoFdT+XUn8zEg==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.0.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-logs": {
-      "version": "0.208.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-logs/-/sdk-logs-0.208.0.tgz",
-      "integrity": "sha512-QlAyL1jRpOeaqx7/leG1vJMp84g0xKP6gJmfELBpnI4O/9xPX+Hu5m1POk9Kl+veNkyth5t19hRlN6tNY1sjbA==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/api-logs": "0.208.0",
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.4.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-logs/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-metrics": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-metrics/-/sdk-metrics-2.2.0.tgz",
-      "integrity": "sha512-G5KYP6+VJMZzpGipQw7Giif48h6SGQ2PFKEYCybeXJsOCB4fp8azqMAAzE5lnnHK3ZVwYQrgmFbsUJO/zOnwGw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.9.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-metrics/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/sdk-trace-base/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
-      "license": "Apache-2.0",
-      "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/semantic-conventions": "^1.29.0"
-      },
-      "engines": {
-        "node": "^18.19.0 || >=20.6.0"
-      },
-      "peerDependencies": {
-        "@opentelemetry/api": ">=1.3.0 <1.10.0"
-      }
-    },
-    "node_modules/@opentelemetry/semantic-conventions": {
-      "version": "1.40.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.40.0.tgz",
-      "integrity": "sha512-cifvXDhcqMwwTlTK04GBNeIe7yyo28Mfby85QXFe1Yk8nmi36Ab/5UQwptOx84SsoGNRg+EVSjwzfSZMy6pmlw==",
-      "license": "Apache-2.0",
-      "engines": {
-        "node": ">=14"
-      }
-    },
     "node_modules/@pdf-lib/standard-fonts": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/@pdf-lib/standard-fonts/-/standard-fonts-1.0.0.tgz",
@@ -3218,12 +2972,12 @@
       }
     },
     "node_modules/@posthog/core": {
-      "version": "1.24.1",
-      "resolved": "https://registry.npmjs.org/@posthog/core/-/core-1.24.1.tgz",
-      "integrity": "sha512-e8AciAnc6MRFws89ux8lJKFAaI03yEon0ASDoUO7yS91FVqbUGXYekObUUR3LHplcg+pmyiJBI0jolY0SFbGRA==",
+      "version": "1.39.3",
+      "resolved": "https://registry.npmjs.org/@posthog/core/-/core-1.39.3.tgz",
+      "integrity": "sha512-oR+B8Q5O61N+W2+HVOBG9dbxAT/+OVxX+XvpNj6KYgptN2EB14JiKQ9Rm7DNpErNTLV7WApZEK/URkZgldOxfg==",
       "license": "MIT",
       "dependencies": {
-        "cross-spawn": "^7.0.6"
+        "@posthog/types": "^1.392.0"
       }
     },
     "node_modules/@posthog/react": {
@@ -3243,74 +2997,11 @@
       }
     },
     "node_modules/@posthog/types": {
-      "version": "1.363.3",
-      "resolved": "https://registry.npmjs.org/@posthog/types/-/types-1.363.3.tgz",
-      "integrity": "sha512-Wslj6BrDwIEkqoahJFE0DbqgoGsB/F9BC3XtzBQdUzr04XhVNriGQ7/lves9eCFwrpSiOHv/5xfSShRwiP3ciA==",
+      "version": "1.392.0",
+      "resolved": "https://registry.npmjs.org/@posthog/types/-/types-1.392.0.tgz",
+      "integrity": "sha512-nctNujXL3FC1v99FktaTMSugSD9ZOZekEpahUSafkU2TSvW+XGKNkQZbokuJtiWvPBK208dwMJva8UfBkChqpw==",
       "license": "MIT"
     },
-    "node_modules/@protobufjs/aspromise": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
-      "integrity": "sha512-j+gKExEuLmKwvz3OgROXtrJ2UG2x8Ch2YZUxahh+s1F2HZ+wAceUNLkvy6zKCPVRkU++ZWQrdxsUeQXmcg4uoQ==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/base64": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/base64/-/base64-1.1.2.tgz",
-      "integrity": "sha512-AZkcAA5vnN/v4PDqKyMR5lx7hZttPDgClv83E//FMNhR2TMcLUhfRUBHCmSl0oi9zMgDDqRUJkSxO3wm85+XLg==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/codegen": {
-      "version": "2.0.5",
-      "resolved": "https://registry.npmjs.org/@protobufjs/codegen/-/codegen-2.0.5.tgz",
-      "integrity": "sha512-zgXFLzW3Ap33e6d0Wlj4MGIm6Ce8O89n/apUaGNB/jx+hw+ruWEp7EwGUshdLKVRCxZW12fp9r40E1mQrf/34g==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/eventemitter": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/eventemitter/-/eventemitter-1.1.0.tgz",
-      "integrity": "sha512-j9ednRT81vYJ9OfVuXG6ERSTdEL1xVsNgqpkxMsbIabzSo3goCjDIveeGv5d03om39ML71RdmrGNjG5SReBP/Q==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/fetch": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/fetch/-/fetch-1.1.1.tgz",
-      "integrity": "sha512-GpptLrs57adMSuHi3VNj0mAF8dwh36LMaYF6XyJ6JMWlVsc+t42tm1HSEDmOs3A8fC9yyeisgLhsTVQokOZ0zw==",
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@protobufjs/aspromise": "^1.1.1"
-      }
-    },
-    "node_modules/@protobufjs/float": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/float/-/float-1.0.2.tgz",
-      "integrity": "sha512-Ddb+kVXlXst9d+R9PfTIxh1EdNkgoRe5tOX6t01f1lYWOvJnSPDBlG241QLzcyPdoNTsblLUdujGSE4RzrTZGQ==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/inquire": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/inquire/-/inquire-1.1.2.tgz",
-      "integrity": "sha512-pa0vFRuws4wkvaXKK1uXZMAwAX4/t8ANaJo45iw/oQHNQ9q5xUzwgFmVJGXiga2BeN+zpX7Vf9vmsiIa2J+MUw==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/path": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/@protobufjs/path/-/path-1.1.2.tgz",
-      "integrity": "sha512-6JOcJ5Tm08dOHAbdR3GrvP+yUUfkjG5ePsHYczMFLq3ZmMkAD98cDgcT2iA1lJ9NVwFd4tH/iSSoe44YWkltEA==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/pool": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@protobufjs/pool/-/pool-1.1.0.tgz",
-      "integrity": "sha512-0kELaGSIDBKvcgS4zkjz1PeddatrjYcmMWOlAuAPwAeccUrPHdUqo/J6LiymHHEiJT5NrF1UVwxY14f+fy4WQw==",
-      "license": "BSD-3-Clause"
-    },
-    "node_modules/@protobufjs/utf8": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@protobufjs/utf8/-/utf8-1.1.1.tgz",
-      "integrity": "sha512-oOAWABowe8EAbMyWKM0tYDKi8Yaox52D+HWZhAIJqQXbqe0xI/GV7FhLWqlEKreMkfDjshR5FKgi3mnle0h6Eg==",
-      "license": "BSD-3-Clause"
-    },
     "node_modules/@puppeteer/browsers": {
       "version": "2.13.0",
       "resolved": "https://registry.npmjs.org/@puppeteer/browsers/-/browsers-2.13.0.tgz",
@@ -6483,9 +6174,9 @@
       }
     },
     "node_modules/@vitest/coverage-v8": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-3.2.4.tgz",
-      "integrity": "sha512-EyF9SXU6kS5Ku/U82E259WSnvg6c8KTjppUncuNdm5QHpe17mwREHnjDzozC8x9MZ0xfBUFSaLkRv4TMA75ALQ==",
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-3.2.6.tgz",
+      "integrity": "sha512-LsAdmUapA0qSN306d8+zOyawM0hFm2m2Hg9IwVNIKBm+qJV8cijiq2c+gxKZcB1HCfIWAy+0qEZDCUQA58A1cw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -6507,8 +6198,8 @@
         "url": "https://opencollective.com/vitest"
       },
       "peerDependencies": {
-        "@vitest/browser": "3.2.4",
-        "vitest": "3.2.4"
+        "@vitest/browser": "3.2.6",
+        "vitest": "3.2.6"
       },
       "peerDependenciesMeta": {
         "@vitest/browser": {
@@ -6574,13 +6265,13 @@
       }
     },
     "node_modules/@vitest/runner": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-3.2.4.tgz",
-      "integrity": "sha512-oukfKT9Mk41LreEW09vt45f8wx7DordoWUZMYdY/cyAk7w5TWkTRCNZYF7sX7n2wB7jyGAl74OxgwhPgKaqDMQ==",
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-3.2.6.tgz",
+      "integrity": "sha512-HYcoSj1w5tcgUnzoF0HcyaAQjpA1gj9ftUJ7iSJSuipc02jW9gKkigwZbjFldAfYHA1fa8UZVRftdMY5msWM9Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/utils": "3.2.4",
+        "@vitest/utils": "3.2.6",
         "pathe": "^2.0.3",
         "strip-literal": "^3.0.0"
       },
@@ -6588,14 +6279,42 @@
         "url": "https://opencollective.com/vitest"
       }
     },
-    "node_modules/@vitest/snapshot": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-3.2.4.tgz",
-      "integrity": "sha512-dEYtS7qQP2CjU27QBC5oUOxLE/v5eLkGqPE0ZKEIDGMs4vKWe7IjgLOeauHsR0D5YuuycGRO5oSRXnwnmA78fQ==",
+    "node_modules/@vitest/runner/node_modules/@vitest/pretty-format": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-3.2.6.tgz",
+      "integrity": "sha512-lb7XXXzmm2h2ASzFnRvQpDo6onT1NmMJA3tkGTWiBFtRJ9lxGY3d3mm/Apt36gej2bkkOVLL/yTOtufDaFa/jA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@vitest/pretty-format": "3.2.4",
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner/node_modules/@vitest/utils": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-3.2.6.tgz",
+      "integrity": "sha512-lI23nIs4bnT3T8NIoh+vFaz5s2/DdP0Jgt2jxwgWljvwn82cLJtyi/If+fjFyoLMGIOz0U/fKvWE0d4jsNQEfg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "3.2.6",
+        "loupe": "^3.1.4",
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/snapshot": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-3.2.6.tgz",
+      "integrity": "sha512-H+ZjNTWGpObenh0YnlBctAPnJSI20P81PL8BPzWpx54YXLLTm8hEsWawtcYLMrwvpK48hGxLLbCS+1KRXhsKhw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "3.2.6",
         "magic-string": "^0.30.17",
         "pathe": "^2.0.3"
       },
@@ -6603,6 +6322,19 @@
         "url": "https://opencollective.com/vitest"
       }
     },
+    "node_modules/@vitest/snapshot/node_modules/@vitest/pretty-format": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-3.2.6.tgz",
+      "integrity": "sha512-lb7XXXzmm2h2ASzFnRvQpDo6onT1NmMJA3tkGTWiBFtRJ9lxGY3d3mm/Apt36gej2bkkOVLL/yTOtufDaFa/jA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/@vitest/spy": {
       "version": "3.2.4",
       "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-3.2.4.tgz",
@@ -7001,16 +6733,42 @@
       }
     },
     "node_modules/axios": {
-      "version": "1.15.0",
-      "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.0.tgz",
-      "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==",
+      "version": "1.18.1",
+      "resolved": "https://registry.npmjs.org/axios/-/axios-1.18.1.tgz",
+      "integrity": "sha512-3nTvFlvpn9Zu/RkHUqtc7/+al4UpRW5az71ap5zccp6e8RAYEzhMTecX8Dz1wWDYrPpUoB1HAQEGEAEvUr7S9g==",
       "license": "MIT",
       "dependencies": {
-        "follow-redirects": "^1.15.11",
+        "follow-redirects": "^1.16.0",
         "form-data": "^4.0.5",
+        "https-proxy-agent": "^5.0.1",
         "proxy-from-env": "^2.1.0"
       }
     },
+    "node_modules/axios/node_modules/agent-base": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-6.0.2.tgz",
+      "integrity": "sha512-RZNwNclF7+MS/8bDg70amg32dyeZGZxiDuQmZxKLAlQjr3jGyLx+4Kkk58UO7D2QdgFIQCovuSuZESne6RG6XQ==",
+      "license": "MIT",
+      "dependencies": {
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6.0.0"
+      }
+    },
+    "node_modules/axios/node_modules/https-proxy-agent": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-5.0.1.tgz",
+      "integrity": "sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==",
+      "license": "MIT",
+      "dependencies": {
+        "agent-base": "6",
+        "debug": "4"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/axios/node_modules/proxy-from-env": {
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
@@ -7343,9 +7101,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7988,6 +7746,7 @@
       "version": "7.0.6",
       "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
       "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
@@ -9004,9 +8763,9 @@
       ]
     },
     "node_modules/esbuild": {
-      "version": "0.27.4",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.4.tgz",
-      "integrity": "sha512-Rq4vbHnYkK5fws5NF7MYTU68FPRE1ajX7heQ/8QXXWqNgqqJ/GkmmyxIzUnf2Sr/bakf8l54716CcMGHYhMrrQ==",
+      "version": "0.28.1",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.28.1.tgz",
+      "integrity": "sha512-HrJrvZv5ayxBzPfwphOoNzkzOIIlifzk0KJrGK2c8R4+LKpMtpYLQeUdjnwjWv/LZlkH2laZk+4w78pi99D4Vw==",
       "dev": true,
       "hasInstallScript": true,
       "license": "MIT",
@@ -9017,32 +8776,32 @@
         "node": ">=18"
       },
       "optionalDependencies": {
-        "@esbuild/aix-ppc64": "0.27.4",
-        "@esbuild/android-arm": "0.27.4",
-        "@esbuild/android-arm64": "0.27.4",
-        "@esbuild/android-x64": "0.27.4",
-        "@esbuild/darwin-arm64": "0.27.4",
-        "@esbuild/darwin-x64": "0.27.4",
-        "@esbuild/freebsd-arm64": "0.27.4",
-        "@esbuild/freebsd-x64": "0.27.4",
-        "@esbuild/linux-arm": "0.27.4",
-        "@esbuild/linux-arm64": "0.27.4",
-        "@esbuild/linux-ia32": "0.27.4",
-        "@esbuild/linux-loong64": "0.27.4",
-        "@esbuild/linux-mips64el": "0.27.4",
-        "@esbuild/linux-ppc64": "0.27.4",
-        "@esbuild/linux-riscv64": "0.27.4",
-        "@esbuild/linux-s390x": "0.27.4",
-        "@esbuild/linux-x64": "0.27.4",
-        "@esbuild/netbsd-arm64": "0.27.4",
-        "@esbuild/netbsd-x64": "0.27.4",
-        "@esbuild/openbsd-arm64": "0.27.4",
-        "@esbuild/openbsd-x64": "0.27.4",
-        "@esbuild/openharmony-arm64": "0.27.4",
-        "@esbuild/sunos-x64": "0.27.4",
-        "@esbuild/win32-arm64": "0.27.4",
-        "@esbuild/win32-ia32": "0.27.4",
-        "@esbuild/win32-x64": "0.27.4"
+        "@esbuild/aix-ppc64": "0.28.1",
+        "@esbuild/android-arm": "0.28.1",
+        "@esbuild/android-arm64": "0.28.1",
+        "@esbuild/android-x64": "0.28.1",
+        "@esbuild/darwin-arm64": "0.28.1",
+        "@esbuild/darwin-x64": "0.28.1",
+        "@esbuild/freebsd-arm64": "0.28.1",
+        "@esbuild/freebsd-x64": "0.28.1",
+        "@esbuild/linux-arm": "0.28.1",
+        "@esbuild/linux-arm64": "0.28.1",
+        "@esbuild/linux-ia32": "0.28.1",
+        "@esbuild/linux-loong64": "0.28.1",
+        "@esbuild/linux-mips64el": "0.28.1",
+        "@esbuild/linux-ppc64": "0.28.1",
+        "@esbuild/linux-riscv64": "0.28.1",
+        "@esbuild/linux-s390x": "0.28.1",
+        "@esbuild/linux-x64": "0.28.1",
+        "@esbuild/netbsd-arm64": "0.28.1",
+        "@esbuild/netbsd-x64": "0.28.1",
+        "@esbuild/openbsd-arm64": "0.28.1",
+        "@esbuild/openbsd-x64": "0.28.1",
+        "@esbuild/openharmony-arm64": "0.28.1",
+        "@esbuild/sunos-x64": "0.28.1",
+        "@esbuild/win32-arm64": "0.28.1",
+        "@esbuild/win32-ia32": "0.28.1",
+        "@esbuild/win32-x64": "0.28.1"
       }
     },
     "node_modules/esbuild-register": {
@@ -9818,19 +9577,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/get-tsconfig": {
-      "version": "4.13.7",
-      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.13.7.tgz",
-      "integrity": "sha512-7tN6rFgBlMgpBML5j8typ92BKFi2sFQvIdpAqLA2beia5avZDrMs0FLZiM5etShWq5irVyGcGMEA1jcDaK7A/Q==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "resolve-pkg-maps": "^1.0.0"
-      },
-      "funding": {
-        "url": "https://github.com/privatenumber/get-tsconfig?sponsor=1"
-      }
-    },
     "node_modules/get-uri": {
       "version": "6.0.5",
       "resolved": "https://registry.npmjs.org/get-uri/-/get-uri-6.0.5.tgz",
@@ -10689,6 +10435,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
       "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true,
       "license": "ISC"
     },
     "node_modules/istanbul-lib-coverage": {
@@ -11433,12 +11180,6 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
-    "node_modules/long": {
-      "version": "5.3.2",
-      "resolved": "https://registry.npmjs.org/long/-/long-5.3.2.tgz",
-      "integrity": "sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==",
-      "license": "Apache-2.0"
-    },
     "node_modules/longest-streak": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/longest-streak/-/longest-streak-3.1.0.tgz",
@@ -13098,6 +12839,7 @@
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
       "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -13569,24 +13311,19 @@
       "license": "MIT"
     },
     "node_modules/posthog-js": {
-      "version": "1.363.3",
-      "resolved": "https://registry.npmjs.org/posthog-js/-/posthog-js-1.363.3.tgz",
-      "integrity": "sha512-j1+MTbHO17kKXJMGDnaiW1EMOiA4AprE8EML6QnbSds+XbqHR2CdHa8T+/zIriZSoXlkZH4R+A4gY29lb5hdlA==",
+      "version": "1.396.4",
+      "resolved": "https://registry.npmjs.org/posthog-js/-/posthog-js-1.396.4.tgz",
+      "integrity": "sha512-PycBmwKQD1T7YFYrGRb8rjQET/UVnexgUy8gVe6UBEhwHXEIhZF4na5VakJbn4zu1wg4tzjt8r7PA4VLu6bDjg==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
-        "@opentelemetry/api": "^1.9.0",
-        "@opentelemetry/api-logs": "^0.208.0",
-        "@opentelemetry/exporter-logs-otlp-http": "^0.208.0",
-        "@opentelemetry/resources": "^2.2.0",
-        "@opentelemetry/sdk-logs": "^0.208.0",
-        "@posthog/core": "1.24.1",
-        "@posthog/types": "1.363.3",
+        "@posthog/core": "^1.39.3",
+        "@posthog/types": "^1.392.0",
         "core-js": "^3.38.1",
         "dompurify": "^3.3.2",
         "fflate": "^0.4.8",
-        "preact": "^10.28.2",
+        "preact": "^10.29.2",
         "query-selector-shadow-dom": "^1.0.1",
-        "web-vitals": "^5.1.0"
+        "web-vitals": "^5.3.0"
       }
     },
     "node_modules/powershell-utils": {
@@ -13603,9 +13340,9 @@
       }
     },
     "node_modules/preact": {
-      "version": "10.29.0",
-      "resolved": "https://registry.npmjs.org/preact/-/preact-10.29.0.tgz",
-      "integrity": "sha512-wSAGyk2bYR1c7t3SZ3jHcM6xy0lcBcDel6lODcs9ME6Th++Dx2KU+6D3HD8wMMKGA8Wpw7OMd3/4RGzYRpzwRg==",
+      "version": "10.29.3",
+      "resolved": "https://registry.npmjs.org/preact/-/preact-10.29.3.tgz",
+      "integrity": "sha512-D9NL1GAnJZhc3RndVs4gDdxEeU9TcHgywMrhhOsnpdlvFjdbx0gAsLUnH6JEhlJH5giL7Tx5biWPUSEXE/HPzw==",
       "license": "MIT",
       "funding": {
         "type": "opencollective",
@@ -13726,30 +13463,6 @@
         "url": "https://github.com/sponsors/wooorm"
       }
     },
-    "node_modules/protobufjs": {
-      "version": "7.6.0",
-      "resolved": "https://registry.npmjs.org/protobufjs/-/protobufjs-7.6.0.tgz",
-      "integrity": "sha512-LtESOsMPTZgyYtwxhvdgdjGL0HmXEaRA/hVD6sol4zA60hVXXXP/SGmxnqDbgGE8gy7pYex7cym+5vYPcmaXBQ==",
-      "hasInstallScript": true,
-      "license": "BSD-3-Clause",
-      "dependencies": {
-        "@protobufjs/aspromise": "^1.1.2",
-        "@protobufjs/base64": "^1.1.2",
-        "@protobufjs/codegen": "^2.0.5",
-        "@protobufjs/eventemitter": "^1.1.0",
-        "@protobufjs/fetch": "^1.1.1",
-        "@protobufjs/float": "^1.0.2",
-        "@protobufjs/inquire": "^1.1.2",
-        "@protobufjs/path": "^1.1.2",
-        "@protobufjs/pool": "^1.1.0",
-        "@protobufjs/utf8": "^1.1.1",
-        "@types/node": ">=13.7.0",
-        "long": "^5.3.2"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
     "node_modules/proxy-agent": {
       "version": "6.5.0",
       "resolved": "https://registry.npmjs.org/proxy-agent/-/proxy-agent-6.5.0.tgz",
@@ -14213,9 +13926,9 @@
       "license": "0BSD"
     },
     "node_modules/react-router": {
-      "version": "7.13.2",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.13.2.tgz",
-      "integrity": "sha512-tX1Aee+ArlKQP+NIUd7SE6Li+CiGKwQtbS+FfRxPX6Pe4vHOo6nr9d++u5cwg+Z8K/x8tP+7qLmujDtfrAoUJA==",
+      "version": "7.18.1",
+      "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.18.1.tgz",
+      "integrity": "sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg==",
       "license": "MIT",
       "dependencies": {
         "cookie": "^1.0.1",
@@ -14235,12 +13948,12 @@
       }
     },
     "node_modules/react-router-dom": {
-      "version": "7.13.2",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.13.2.tgz",
-      "integrity": "sha512-aR7SUORwTqAW0JDeiWF07e9SBE9qGpByR9I8kJT5h/FrBKxPMS6TiC7rmVO+gC0q52Bx7JnjWe8Z1sR9faN4YA==",
+      "version": "7.18.1",
+      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.18.1.tgz",
+      "integrity": "sha512-KaZh+X/6UtEp28x51AUYZDMg9NGoz2ja3dNHa+ta/tk40vCzKhQ/RypCWBMLbmDr6//E24Vv5uPsrqXFozdkAg==",
       "license": "MIT",
       "dependencies": {
-        "react-router": "7.13.2"
+        "react-router": "7.18.1"
       },
       "engines": {
         "node": ">=20.0.0"
@@ -14691,16 +14404,6 @@
         "node": ">=4"
       }
     },
-    "node_modules/resolve-pkg-maps": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz",
-      "integrity": "sha512-seS2Tj26TBVOC2NIc2rOe2y2ZO7efxITtLZcGSOnHHNOQ7CkiUBfw0Iw2ck6xkIhPwLhKNLS8BO+hEpngQlqzw==",
-      "dev": true,
-      "license": "MIT",
-      "funding": {
-        "url": "https://github.com/privatenumber/resolve-pkg-maps?sponsor=1"
-      }
-    },
     "node_modules/responselike": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/responselike/-/responselike-4.0.2.tgz",
@@ -15032,6 +14735,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
       "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
       "license": "MIT",
       "dependencies": {
         "shebang-regex": "^3.0.0"
@@ -15044,6 +14748,7 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
       "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
       "license": "MIT",
       "engines": {
         "node": ">=8"
@@ -16563,14 +16268,13 @@
       "license": "0BSD"
     },
     "node_modules/tsx": {
-      "version": "4.21.0",
-      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.21.0.tgz",
-      "integrity": "sha512-5C1sg4USs1lfG0GFb2RLXsdpXqBSEhAaA/0kPL01wxzpMqLILNxIxIOKiILz+cdg/pLnOUxFYOR5yhHU666wbw==",
+      "version": "4.22.4",
+      "resolved": "https://registry.npmjs.org/tsx/-/tsx-4.22.4.tgz",
+      "integrity": "sha512-X8EX+XV4QR5xCsrgxaED954zTDfY8KqlDtskKEL0cHhyS/P8b4IFOvGDQpsC9Q1XnLq915wEfwwY/zzskCtmhg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "esbuild": "~0.27.0",
-        "get-tsconfig": "^4.7.5"
+        "esbuild": "~0.28.0"
       },
       "bin": {
         "tsx": "dist/cli.mjs"
@@ -17032,13 +16736,13 @@
       "license": "MIT"
     },
     "node_modules/vite": {
-      "version": "7.3.2",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.2.tgz",
-      "integrity": "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==",
+      "version": "7.3.6",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.6.tgz",
+      "integrity": "sha512-4XP60spRGjSZFf1qYH+dJIkK2znL3zQfl9KkOV9MkkRR/3Dls0dxaBsQPTloEc5BLXWPL9vsOxopxyKoMmDueg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "esbuild": "^0.27.0",
+        "esbuild": "^0.27.0 || ^0.28.0",
         "fdir": "^6.5.0",
         "picomatch": "^4.0.3",
         "postcss": "^8.5.6",
@@ -17252,20 +16956,20 @@
       }
     },
     "node_modules/vitest": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/vitest/-/vitest-3.2.4.tgz",
-      "integrity": "sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==",
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-3.2.6.tgz",
+      "integrity": "sha512-xejya+bT/j/+R/AGa1XOfRxLmNUlLtlwjRsFUILF+xHfzElmGcmFydy2gqqIrd62ptIEfwVMofd19uNWD9L7Nw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@types/chai": "^5.2.2",
-        "@vitest/expect": "3.2.4",
-        "@vitest/mocker": "3.2.4",
-        "@vitest/pretty-format": "^3.2.4",
-        "@vitest/runner": "3.2.4",
-        "@vitest/snapshot": "3.2.4",
-        "@vitest/spy": "3.2.4",
-        "@vitest/utils": "3.2.4",
+        "@vitest/expect": "3.2.6",
+        "@vitest/mocker": "3.2.6",
+        "@vitest/pretty-format": "^3.2.6",
+        "@vitest/runner": "3.2.6",
+        "@vitest/snapshot": "3.2.6",
+        "@vitest/spy": "3.2.6",
+        "@vitest/utils": "3.2.6",
         "chai": "^5.2.0",
         "debug": "^4.4.1",
         "expect-type": "^1.2.1",
@@ -17295,8 +16999,8 @@
         "@edge-runtime/vm": "*",
         "@types/debug": "^4.1.12",
         "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0",
-        "@vitest/browser": "3.2.4",
-        "@vitest/ui": "3.2.4",
+        "@vitest/browser": "3.2.6",
+        "@vitest/ui": "3.2.6",
         "happy-dom": "*",
         "jsdom": "*"
       },
@@ -17324,6 +17028,91 @@
         }
       }
     },
+    "node_modules/vitest/node_modules/@vitest/expect": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-3.2.6.tgz",
+      "integrity": "sha512-1+7q9BtaKzEmO+fmNT3kYvoNn5Y71XWAx2Q5HRim4tTVRQVRv4uJFAQ5FbK0OPUeNP/WmVCpxYxoJdvuHVjzBQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "3.2.6",
+        "@vitest/utils": "3.2.6",
+        "chai": "^5.2.0",
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/vitest/node_modules/@vitest/mocker": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-3.2.6.tgz",
+      "integrity": "sha512-EZOrpDbkKotFAP7wPAQV1UIyoGOk4oX7ynWhBhLB7v+meMHbQhU16oPpIYGTTe4oFlhpryGpgpcZP/sin3hYuw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "3.2.6",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.17"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vitest/node_modules/@vitest/pretty-format": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-3.2.6.tgz",
+      "integrity": "sha512-lb7XXXzmm2h2ASzFnRvQpDo6onT1NmMJA3tkGTWiBFtRJ9lxGY3d3mm/Apt36gej2bkkOVLL/yTOtufDaFa/jA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/vitest/node_modules/@vitest/spy": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-3.2.6.tgz",
+      "integrity": "sha512-oq6BbH68WzcWmwtBrU9nqLeaXTR4XwJF7FSLkKEZo4i6eoXcrxjcwSuTvWBIRUTC6VC72nXYunzqgZA+IKdtxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyspy": "^4.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/vitest/node_modules/@vitest/utils": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-3.2.6.tgz",
+      "integrity": "sha512-lI23nIs4bnT3T8NIoh+vFaz5s2/DdP0Jgt2jxwgWljvwn82cLJtyi/If+fjFyoLMGIOz0U/fKvWE0d4jsNQEfg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "3.2.6",
+        "loupe": "^3.1.4",
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/vitest/node_modules/picomatch": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
@@ -17399,9 +17188,9 @@
       }
     },
     "node_modules/web-vitals": {
-      "version": "5.1.0",
-      "resolved": "https://registry.npmjs.org/web-vitals/-/web-vitals-5.1.0.tgz",
-      "integrity": "sha512-ArI3kx5jI0atlTtmV0fWU3fjpLmq/nD3Zr1iFFlJLaqa5wLBkUSzINwBPySCX/8jRyjlmy1Volw1kz1g9XE4Jg==",
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/web-vitals/-/web-vitals-5.3.0.tgz",
+      "integrity": "sha512-q6LWsLatGYZp5VGBIOvbTj6JBV2nOmC8KvWztXBmwJcfFAzhwKwbOxhUH306XY3CcaZDUlSmSuNPBsCn0bFu+g==",
       "license": "Apache-2.0"
     },
     "node_modules/webdriver-bidi-protocol": {
@@ -17469,6 +17258,7 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
       "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
       "license": "ISC",
       "dependencies": {
         "isexe": "^2.0.0"
diff --git a/frontend/package.json b/frontend/package.json
index a13800f429..e460f37e40 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -151,7 +151,7 @@
     "puppeteer": "^24.25.0",
     "rollup-plugin-visualizer": "^7.0.1",
     "storybook": "^9.1.20",
-    "tsx": "^4.21.0",
+    "tsx": "^4.22.4",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
     "typescript-eslint": "^8.61.1",
     "vite": "^7.3.2",

From 43a6ff306604e98f22db0f3a078f5067996711e3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 09:15:15 +0100
Subject: [PATCH 066/109] build(deps): bump mcp from 1.26.0 to 1.28.1 in
 /engine in the uv group across 1 directory (#7114)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the uv group with 1 update in the /engine directory:
[mcp](https://github.com/modelcontextprotocol/python-sdk).

Updates `mcp` from 1.26.0 to 1.28.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/modelcontextprotocol/python-sdk/releases">mcp's
releases</a>.</em></p>
<blockquote>
<h2>v1.28.0</h2>
<h2>Deprecations</h2>
<p>Two API surfaces now emit <code>DeprecationWarning</code> ahead of
their removal in v2. Nothing is removed in 1.x, and the warnings fire
only when the deprecated API is <em>called</em> - importing the modules
stays silent.</p>
<ul>
<li><strong>WebSocket transport</strong> -
<code>mcp.client.websocket.websocket_client</code> and
<code>mcp.server.websocket.websocket_server</code><code>modelcontextprotocol/typescript-sdk#1783</code></li>
<li><strong>Experimental tasks API</strong> -
<code>ClientSession.experimental</code>,
<code>Server.experimental</code>,
<code>ServerSession.experimental</code>, and the
<code>experimental_task_handlers=</code> kwarg on
<code>ClientSession</code>. Tasks (SEP-1686) were removed from the MCP
specification and are expected to return as a separate MCP
extension.</li>
</ul>
<p>If your test suite runs with <code>filterwarnings =
[&quot;error&quot;]</code> and exercises these paths, add a scoped
ignore such as <code>ignore:The experimental tasks API is
deprecated:DeprecationWarning</code> or <code>ignore:The WebSocket .*
transport is deprecated:DeprecationWarning</code>.</p>
<p>See <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2828">#2828</a>
for full details.</p>
<h2>What's Changed</h2>
<ul>
<li>[v1.x] Support Python 3.14 by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2769">modelcontextprotocol/python-sdk#2769</a></li>
<li>fix: omit null optional fields from task result payloads by <a
href="https://github.com/liuzemei"><code>@​liuzemei</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2809">modelcontextprotocol/python-sdk#2809</a></li>
<li>[v1.x] Deprecate the WebSocket transport and the experimental tasks
entry points by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2828">modelcontextprotocol/python-sdk#2828</a></li>
<li>[v1.x] Add a v2 status banner to the README by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2835">modelcontextprotocol/python-sdk#2835</a></li>
<li>[v1.x] Deflake the child process cleanup tests by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2839">modelcontextprotocol/python-sdk#2839</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/liuzemei"><code>@​liuzemei</code></a>
made their first contribution in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2809">modelcontextprotocol/python-sdk#2809</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.2...v1.28.0">https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.2...v1.28.0</a></p>
<h2>v1.27.2</h2>
<h2>What's Changed</h2>
<ul>
<li>[v1.x] ci: deploy docs to py.sdk.modelcontextprotocol.io via Pages
artifact by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2635">modelcontextprotocol/python-sdk#2635</a></li>
<li>[v1.x] Add subject and claims to AccessToken by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2690">modelcontextprotocol/python-sdk#2690</a></li>
<li>[v1.x] Bind transport sessions to the authenticated principal by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2719">modelcontextprotocol/python-sdk#2719</a></li>
<li>[v1.x] Scope experimental tasks to the session that created them by
<a href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2720">modelcontextprotocol/python-sdk#2720</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.1...v1.27.2">https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.1...v1.27.2</a></p>
<h2>v1.27.1</h2>
<h2>What's Changed</h2>
<ul>
<li>[v1.x] fix: catch PydanticUserError when generating output schema
(pydantic 2.13 compat) by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2435">modelcontextprotocol/python-sdk#2435</a></li>
<li>[v1.x] fix(auth): coerce empty-string optional URL fields to None in
OAuthClientMetadata by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2405">modelcontextprotocol/python-sdk#2405</a></li>
<li>[v1.x] build: restrict httpx to &lt;1.0.0 by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2559">modelcontextprotocol/python-sdk#2559</a></li>
<li>[v1.x] refactor: import SSEError from httpx_sse public API by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2561">modelcontextprotocol/python-sdk#2561</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.0...v1.27.1">https://github.com/modelcontextprotocol/python-sdk/compare/v1.27.0...v1.27.1</a></p>
<h2>v1.27.0</h2>
<h2>What's Changed</h2>
<ul>
<li>fix: remove unused <code>requests</code> dependency from
simple-chatbot example by <a
href="https://github.com/maxisbey"><code>@​maxisbey</code></a> in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1959">modelcontextprotocol/python-sdk#1959</a></li>
<li>ci: backport conformance tests from main to v1.x by <a
href="https://github.com/felixweinberger"><code>@​felixweinberger</code></a>
in <a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/pull/2068">modelcontextprotocol/python-sdk#2068</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/777b8d06710c140e3606b0d4598e2aa48546c266"><code>777b8d0</code></a>
[v1.x] Support TransportSecuritySettings in the WebSocket server
transport (#...</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/47204674fb26185c2cf45f065831f27b8e5d5c65"><code>4720467</code></a>
[v1.x] Set Development Status classifier to Production/Stable (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2976">#2976</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/6df3d734265eb49bf758a5e5eb420937337184e9"><code>6df3d73</code></a>
[v1.x] Buffer per-request StreamableHTTP streams; store priming event
before ...</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/32d32908feb7b15eddeb46872774bf95869cc5f0"><code>32d3290</code></a>
[v1.x] Pass a list to parametrize in test_docs_examples (pytest 9.1.0
compat)...</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/0dca751056dc87d04893d53af129fd00b56a18da"><code>0dca751</code></a>
[v1.x] Deflake the child process cleanup tests (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2839">#2839</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/52258a95645c66fccbe925289c3382712b9bc68a"><code>52258a9</code></a>
[v1.x] Add a v2 status banner to the README (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2835">#2835</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/b8f491724c45dbf89d6569364b58d6e8d25d7e42"><code>b8f4917</code></a>
[v1.x] Deprecate the WebSocket transport and the experimental tasks
entry poi...</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/2309e5ef974062748e0268c396eba73cfdb6f5e3"><code>2309e5e</code></a>
fix: omit null optional fields from task result payloads (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2809">#2809</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/494eb11d36b4238226cc0551da6015e1c73f7f3b"><code>494eb11</code></a>
[v1.x] Support Python 3.14 (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2769">#2769</a>)</li>
<li><a
href="https://github.com/modelcontextprotocol/python-sdk/commit/62137874ff26dd74d2fea80ff528a7fd9ca7a5e7"><code>6213787</code></a>
[v1.x] Scope experimental tasks to the session that created them (<a
href="https://redirect.github.com/modelcontextprotocol/python-sdk/issues/2720">#2720</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/modelcontextprotocol/python-sdk/compare/v1.26.0...v1.28.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mcp&package-manager=uv&previous-version=1.26.0&new-version=1.28.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/Stirling-Tools/Stirling-PDF/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 engine/uv.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/engine/uv.lock b/engine/uv.lock
index 3434f4df16..afa5f389ae 100644
--- a/engine/uv.lock
+++ b/engine/uv.lock
@@ -1604,7 +1604,7 @@ wheels = [
 
 [[package]]
 name = "mcp"
-version = "1.26.0"
+version = "1.28.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -1622,9 +1622,9 @@ dependencies = [
     { name = "typing-inspection" },
     { name = "uvicorn", marker = "sys_platform != 'emscripten'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/fc/6d/62e76bbb8144d6ed86e202b5edd8a4cb631e7c8130f3f4893c3f90262b10/mcp-1.26.0.tar.gz", hash = "sha256:db6e2ef491eecc1a0d93711a76f28dec2e05999f93afd48795da1c1137142c66", size = 608005, upload-time = "2026-01-24T19:40:32.468Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6e/77/9450b8f251a13affb6281997d0523c4615f8a8b35d0b21ff30db3a5aac9d/mcp-1.28.1.tar.gz", hash = "sha256:d51e36a5f5644faea4f85ea649bfffa6bc6c26770d42798ad6a3de3d2ba69683", size = 638501, upload-time = "2026-06-26T12:57:29.093Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/fd/d9/eaa1f80170d2b7c5ba23f3b59f766f3a0bb41155fbc32a69adfa1adaaef9/mcp-1.26.0-py3-none-any.whl", hash = "sha256:904a21c33c25aa98ddbeb47273033c435e595bbacfdb177f4bd87f6dceebe1ca", size = 233615, upload-time = "2026-01-24T19:40:30.652Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/5e/d118fce19f87a2e7d8101c35c8ae0ec289098a4df0ff244cec23e415aca0/mcp-1.28.1-py3-none-any.whl", hash = "sha256:2726bca5e7193f61c5dde8b12500a6de2d9acf6d1a1c0be9e8c2e706437991df", size = 222620, upload-time = "2026-06-26T12:57:27.218Z" },
 ]
 
 [[package]]

From f4560cccb9e5efcf77065276bd011dfced52b0d8 Mon Sep 17 00:00:00 2001
From: albanobattistella <34811668+albanobattistella@users.noreply.github.com>
Date: Tue, 21 Jul 2026 10:17:31 +0200
Subject: [PATCH 067/109] Update Italian translation (#7087)

---
 .../public/locales/it-IT/translation.toml     | 1248 ++++++++---------
 1 file changed, 623 insertions(+), 625 deletions(-)

diff --git a/frontend/editor/public/locales/it-IT/translation.toml b/frontend/editor/public/locales/it-IT/translation.toml
index 9c476ecdab..0503fcb3c6 100644
--- a/frontend/editor/public/locales/it-IT/translation.toml
+++ b/frontend/editor/public/locales/it-IT/translation.toml
@@ -18,11 +18,11 @@ confirmCloseDiscard = "Scarta le modifiche e chiudi"
 confirmCloseMessage = "Sei sicuro di voler chiudere questo file?"
 confirmCloseSave = "Salva e chiudi"
 confirmCloseSaveFailed_one = "Salvato con errori. Non è stato possibile salvare {{count}} file."
-confirmCloseSaveFailed_other = "Saved with errors. {{count}} files could not be saved."
+confirmCloseSaveFailed_other = "Salvato con errori. {{count}} file non possono essere salvati."
 confirmCloseSaveFailedTitle = "Salvataggio non riuscito"
 confirmCloseUnsaved = "Questo file contiene modifiche non salvate."
 confirmCloseUnsavedList_one = "Hai {{count}} file con modifiche non salvate.\n\n{{fileList}}"
-confirmCloseUnsavedList_other = "You have {{count}} files with unsaved changes.\n\n{{fileList}}"
+confirmCloseUnsavedList_other = "Tu hai {{count}} file con modifiche non salvate.\n\n{{fileList}}"
 custom = "Personalizzato"
 customPosition = "Posizione personalizzata"
 customTextTooltip = "Formato personalizzato opzionale per i numeri di pagina. Usa {n} come segnaposto per il numero. Esempio: \"Pagina {n}\" mostrerà \"Pagina 1\", \"Pagina 2\", ecc."
@@ -172,7 +172,7 @@ signedInAs = "Connesso come: {{email}}"
 tags = "impaginare,etichettare,organizzare,indicizzare"
 
 [addAttachments]
-tags = "embed,attach,include,attachments,attach files,embed files,include files,add files,file attachment,associated files,supplementary files"
+tags = "incorporare,allegare,includere,allegati,allegare file,incorporare file,includere file,aggiungere file,allegato file,file associati,file supplementari"
 
 [addAttachments.error]
 failed = "Si è verificato un errore durante l'aggiunta di allegati al PDF."
@@ -236,26 +236,26 @@ resume = "Riprendi posizionamento"
 title = "Risultati aggiunta immagine"
 
 [addImage.saved]
-defaultCanvasLabel = "Drawing signature"
+defaultCanvasLabel = "Firma disegnata"
 defaultImageLabel = "Immagine caricata"
 defaultLabel = "Immagine"
-defaultTextLabel = "Typed signature"
-delete = "Remove"
-emptyTitle = "No saved signatures yet"
-heading = "Saved signatures"
-label = "Label"
-limitTitle = "Limit reached"
-next = "Next"
-personalHeading = "Personal Signatures"
-prev = "Previous"
-savePersonal = "Save Personal"
-saveShared = "Save Shared"
-sharedHeading = "Shared Signatures"
+defaultTextLabel = "Firma digitata"
+delete = "Rimuovi"
+emptyTitle = "Nessuna firma salvata"
+heading = "Firme salvate"
+label = "Etichetta"
+limitTitle = "Limite raggiunto"
+next = "Successivo"
+personalHeading = "Firme personali"
+prev = "Precedente"
+savePersonal = "Salva come personale"
+saveShared = "Salva come condivisa"
+sharedHeading = "Firme condivise"
 
 [addImage.saved.type]
-canvas = "Drawing"
-image = "Upload"
-text = "Text"
+canvas = "Disegna"
+image = "Carica"
+text = "Testo"
 
 [addImage.step]
 createDesc = "Carica l'immagine che vuoi aggiungere"
@@ -266,17 +266,17 @@ placeDesc = "Clicca sul PDF per aggiungere la tua immagine"
 configure = "Configura immagine"
 
 [addImage.text]
-colorLabel = "Text colour"
-fontLabel = "Font"
-fontSizeLabel = "Font size"
-name = "Text"
-placeholder = "Enter text"
+colorLabel = "Colore del testo"
+fontLabel = "Carattere"
+fontSizeLabel = "Dimensione carattere"
+name = "Testo"
+placeholder = "Inserisci testo"
 
 [addImage.type]
-canvas = "Canvas"
-image = "Image"
-saved = "Saved"
-text = "Text"
+canvas = "Area di disegno"
+image = "Immagine"
+saved = "Salvate"
+text = "Testo"
 
 [addPageNumbers]
 customize = "Personalizza aspetto"
@@ -309,7 +309,7 @@ title = "Risultati numerazione pagine"
 [addPassword]
 desc = "Cifra il tuo documento PDF con una password."
 submit = "Crittografa"
-tags = "encrypt,password,lock,secure,protect,security,encryption,safeguard,confidential,private,restrict access"
+tags = "crittografare,password,lucchetto,sicuro,proteggere,sicurezza,crittografia,salvaguardare,riservato,privato,limitare l'accesso"
 title = "Aggiungi Password"
 
 [addPassword.encryption.keyLength]
@@ -356,7 +356,7 @@ text = "Questi permessi controllano ciò che gli utenti possono fare con il PDF.
 title = "Cambia Permessi"
 
 [addStamp]
-tags = "stamp,mark,seal,approved,rejected,confidential,stamp tool,rubber stamp,date stamp,approval stamp,received,void,copy,original"
+tags = "timbro,marchio,sigillo,approvato,rifiutato,riservato,strumento per timbro,timbro in gomma,timbro data,timbro di approvazione,ricevuto,nullo,copia,originale"
 
 [AddStampRequest]
 alphabet = "Alfabeto"
@@ -429,7 +429,7 @@ tags = "testo,annotazione,etichetta"
 title = "Aggiungi testo"
 
 [addText.canvas]
-colorPickerTitle = "Choose stroke colour"
+colorPickerTitle = "Scegli il colore del tratto"
 
 [addText.error]
 failed = "Si è verificato un errore durante l'aggiunta del testo al PDF."
@@ -451,26 +451,26 @@ resume = "Riprendi posizionamento"
 title = "Risultati aggiunta testo"
 
 [addText.saved]
-defaultCanvasLabel = "Drawing signature"
-defaultImageLabel = "Uploaded signature"
-defaultLabel = "Signature"
-defaultTextLabel = "Typed signature"
-delete = "Remove"
-emptyTitle = "No saved signatures yet"
-heading = "Saved signatures"
-label = "Label"
-limitTitle = "Limit reached"
-next = "Next"
-personalHeading = "Personal Signatures"
-prev = "Previous"
-savePersonal = "Save Personal"
-saveShared = "Save Shared"
-sharedHeading = "Shared Signatures"
+defaultCanvasLabel = "Firma disegnata"
+defaultImageLabel = "Firma caricata"
+defaultLabel = "Firma"
+defaultTextLabel = "Firma digitata"
+delete = "Rimuovi"
+emptyTitle = "Nessuna firma salvata"
+heading = "Firme salvate"
+label = "Etichetta"
+limitTitle = "Limite raggiunto"
+next = "Successivo"
+personalHeading = "Firme personali"
+prev = "Precedente"
+savePersonal = "Salva come personale"
+saveShared = "Salva come condivisa"
+sharedHeading = "Firme condivise"
 
 [addText.saved.type]
-canvas = "Drawing"
-image = "Upload"
-text = "Text"
+canvas = "Disegna"
+image = "Carica"
+text = "Testo"
 
 [addText.step]
 createDesc = "Inserisci il testo da aggiungere"
@@ -489,10 +489,10 @@ name = "Contenuto del testo"
 placeholder = "Inserisci il testo da aggiungere"
 
 [addText.type]
-canvas = "Canvas"
-image = "Image"
-saved = "Saved"
-text = "Text"
+canvas = "Area di disegno"
+image = "Immagine"
+saved = "Salvate"
+text = "Testo"
 
 [adjust-contrast]
 tags = "correzione del colore,messa a punto,modifica,miglioramento"
@@ -1158,68 +1158,68 @@ description = "Nome utente per l'autenticazione SMTP"
 label = "Nome utente SMTP"
 
 [admin.settings.mcp]
-apikeyNote = "Clients send a Stirling API key in the X-API-KEY header (or Authorization: Bearer <key>). The key maps to its owning Stirling user - only provisioned accounts get in, and actions are audited as that user. Manage keys under Account > API Keys."
-description = "Expose Stirling's PDF tools and AI agents to MCP clients over an OAuth-protected endpoint."
-title = "MCP Server"
+apikeyNote = "I client inviano una chiave API Stirling nell'intestazione X-API-KEY (o Authorization: Bearer <key>). La chiave viene mappata sul rispettivo utente Stirling proprietario: l'accesso è consentito solo agli account abilitati e le azioni vengono verificate a nome di quell'utente. Gestisci le chiavi in Account > Chiavi API."
+description = "Esponi gli strumenti PDF e gli agenti IA di Stirling ai client MCP tramite un endpoint protetto da OAuth."
+title = "Server MCP"
 
 [admin.settings.mcp.acceptedAudiences]
-description = "Extra token audience values accepted besides the Resource ID (comma or space separated). Leave blank for strict RFC 8707. Needed for IdPs that cannot mint resource audiences - e.g. Supabase's OAuth server always issues aud=authenticated."
-label = "Additional accepted audiences (optional)"
+description = "Valori di audience del token aggiuntivi accettati oltre all'ID risorsa (separati da virgola o spazio). Lascia vuoto per un'applicazione rigorosa della specifica RFC 8707. Necessario per gli IdP che non possono generare audience specifiche per la risorsa (ad esempio, il server OAuth di Supabase emette sempre aud=authenticated)."
+label = "Audience aggiuntive accettate (opzionale)"
 
 [admin.settings.mcp.allowedOps]
-description = "If set, ONLY these operation ids are exposed (an allow-list; comma or space separated). Leave blank to expose all enabled tools except any blocked below."
-label = "Allowed tools"
+description = "Se impostato, vengono esposti SOLO questi ID operazione (una whitelist; separati da virgola o spazio). Lascia vuoto per esporre tutti gli strumenti abilitati, tranne quelli bloccati di seguito."
+label = "Strumenti consentiti"
 
 [admin.settings.mcp.blockedOps]
-description = "Operation ids to hide from MCP (comma or space separated), e.g. add-password remove-password. Leave blank to expose all enabled tools."
-label = "Blocked tools"
+description = "ID operazione da nascondere a MCP (separati da virgola o spazio), ad es. add-password remove-password. Lascia vuoto per esporre tutti gli strumenti abilitati."
+label = "Strumenti bloccati"
 
 [admin.settings.mcp.enabled]
-description = "When off (default), no /mcp endpoint, metadata, or MCP beans are loaded."
-label = "Enable MCP Server"
+description = "Quando è disattivato (impostazione predefinita), non viene caricato alcun endpoint /mcp, metadato o bean MCP."
+label = "Abilita Server MCP"
 
 [admin.settings.mcp.guide]
-step1 = "Enter your OAuth issuer + resource ID above, Save, and restart."
-step1ApiKey = "Create an API key under Account > API Keys (each user uses their own)."
-step2 = "In your MCP client add a"
-step2b = "server pointing at:"
-step3 = "The client auto-discovers OAuth from:"
-step3ApiKey = "Send the key in an"
-step3ApiKeyb = "header (or Authorization: Bearer <key>). No OAuth or metadata discovery is used."
-step4 = "Approve the sign-in; the client retries with a token. Tools appear grouped: convert, pages, misc, security, ai."
-step4ApiKey = "Tools appear grouped: convert, pages, misc, security, ai - and every call is audited as the key's owner."
-tip = "Tip: register the resource ID as an allowed audience in your IdP. Tested with MCP Inspector and Claude Desktop."
-tipApiKey = "Tip: API-key mode needs no external IdP - simplest for self-host. The key maps to its owning Stirling user."
-title = "Connect an MCP client"
+step1 = "Inserisci l'issuer OAuth + l'ID risorsa qui sopra, salva e riavvia."
+step1ApiKey = "Crea una chiave API in Account > Chiavi API (ogni utente usa la propria)."
+step2 = "Nel tuo client MCP aggiungi un"
+step2b = "server che punta a:"
+step3 = "Il client rileva automaticamente OAuth da:"
+step3ApiKey = "Invia la chiave in un'intestazione"
+step3ApiKeyb = "(o Authorization: Bearer <key>). Non viene utilizzato alcun rilevamento di OAuth o dei metadati."
+step4 = "Approva l'accesso; il client riproverà con un token. Gli strumenti appariranno raggruppati: convert, pages, misc, security, ai."
+step4ApiKey = "Gli strumenti appariranno raggruppati: convert, pages, misc, security, ai — e ogni chiamata verrà verificata a nome del proprietario della chiave."
+tip = "Suggerimento: registra l'ID risorsa come audience consentita nel tuo IdP. Testato con MCP Inspector e Claude Desktop."
+tipApiKey = "Suggerimento: la modalità chiave API non richiede un IdP esterno — è la più semplice per il self-hosting. La chiave viene mappata sul rispettivo utente Stirling proprietario."
+title = "Connetti un client MCP"
 
 [admin.settings.mcp.issuerUri]
-description = "Your OAuth2 authorization server (must publish /.well-known/openid-configuration). Required when enabled."
-label = "OAuth Issuer URL"
+description = "Il tuo server di autorizzazione OAuth2 (deve pubblicare /.well-known/openid-configuration). Richiesto quando abilitato."
+label = "URL dell'issuer OAuth"
 
 [admin.settings.mcp.jwksUri]
-description = "Leave blank to discover it from the issuer. Set only if your IdP serves keys at a non-standard URL."
-label = "JWKS URL (optional)"
-placeholder = "Auto-discovered from issuer"
+description = "Lascia vuoto per rilevarlo automaticamente dall'issuer. Impostalo solo se il tuo IdP fornisce le chiavi a un URL non standard."
+label = "URL JWKS (opzionale)"
+placeholder = "Rilevato automaticamente dall'issuer"
 
 [admin.settings.mcp.mode]
-description = "OAuth needs an external IdP. API key uses a Stirling per-user API key (X-API-KEY) - simplest for self-host."
-label = "Authentication mode"
+description = "La modalità OAuth richiede un IdP esterno. La modalità chiave API utilizza una chiave API Stirling per singolo utente (X-API-KEY) — è la più semplice per il self-hosting."
+label = "Modalità di autenticazione"
 
 [admin.settings.mcp.requireAccount]
-description = "Only let tokens through if their subject maps to a provisioned, enabled Stirling user."
-label = "Require an existing Stirling account"
+description = "Consenti il passaggio dei token solo se il loro subject corrisponde a un utente Stirling abilitato e configurato."
+label = "Richiedi un account Stirling esistente"
 
 [admin.settings.mcp.resourceId]
-description = "This server's public /mcp URL. Tokens must list it in their audience (RFC 8707) or they are rejected."
-label = "Resource ID"
+description = "L'URL pubblico /mcp di questo server. I token devono includerlo nella loro audience (RFC 8707), altrimenti verranno rifiutati."
+label = "ID della risorsa"
 
 [admin.settings.mcp.scopes]
-description = "Require mcp.tools.read for read ops and mcp.tools.write for write/AI ops."
-label = "Enforce OAuth scopes"
+description = "Richiedi mcp.tools.read per le operazioni di lettura e mcp.tools.write per le operazioni di scrittura/IA."
+label = "Applica gli scope OAuth"
 
 [admin.settings.mcp.usernameClaim]
-description = "JWT claim matched against a Stirling username (e.g. sub, email, preferred_username)."
-label = "Username claim"
+description = "Il claim del JWT da confrontare con un nome utente Stirling (ad es. sub, email, preferred_username)."
+label = "Claim del nome utente"
 
 [admin.settings.plan.noData]
 message = "I dati dei piani non sono disponibili al momento."
@@ -1628,7 +1628,7 @@ paragraph2 = "Si prega di prendere in considerazione l'attivazione dell'analytic
 title = "Vuoi migliorare Stirling PDF?"
 
 [annotate]
-tags = "annotate,highlight,draw,markup,comment,notes,review,redline,feedback,markup tools,sticky notes,shapes,arrows,text box,freehand"
+tags = "annota,evidenzia,disegna,markup,commento,note,recensione,linea rossa,feedback,strumenti di markup,note adesive,forme,frecce,casella di testo,mano libera"
 
 [annotation]
 alignCenter = "Allinea al centro"
@@ -1879,12 +1879,12 @@ desc = "Crea flussi di lavoro multi‑step concatenando azioni PDF. Ideale per a
 export = "Esporta"
 exportForFolderScanning = "Esporta per la scansione delle cartelle"
 import = "Importa"
-importPartialSuccess_one = "Imported with {{count}} unmapped operation: {{ops}}"
-importPartialSuccess_other = "Imported with {{count}} unmapped operations: {{ops}}"
+importPartialSuccess_one = "Importato con {{count}} operazione non mappata: {{ops}}"
+importPartialSuccess_other = "Importato con {{count}} operazioni non mappate: {{ops}}"
 importSuccess = "Automazione importata: {{name}}"
 invalidStep = "Passo non valido"
 reviewTitle = "Risultati Automazione"
-tags = "workflow,sequence,automation,automate,batch,batch processing,pipeline,chain,multi-step,recurring,scheduled,automatic,process multiple,bulk operations"
+tags = "flusso di lavoro,sequenza,automazione,automatizzare,batch,elaborazione batch,pipeline,catena,a più fasi,ricorrente,programmato,automatico,elaborare più operazioni in blocco"
 title = "Automatizza"
 
 [automate.config]
@@ -1985,7 +1985,7 @@ secureWorkflowDesc = "Protegge i documenti PDF rimuovendo contenuti potenzialmen
 
 [autoRename]
 description = "Questo strumento rinomina automaticamente i file PDF in base al loro contenuto. Analizza il documento per trovare il titolo più adatto dal testo."
-tags = "auto-detect,header-based,organize,relabel,auto rename,automatic rename,smart rename,rename by content,filename,file naming,detect title"
+tags = "rilevamento automatico,basato sull'intestazione,organizza,rietichetta,rinomina automatica,rinomina intelligente,rinomina in base al contenuto,nome file,denominazione file,rileva titolo"
 
 [autoSizeSplitPDF]
 tags = "pdf,diviso,documento,organizzazione"
@@ -2158,7 +2158,7 @@ title = "Combina selezioni (entrambe le condizioni devono essere vere)"
 [bulkSelection.operators.descriptions]
 and = "AND: & o \"and\" - richiede entrambe le condizioni (es., 1-50 & even)"
 comma = "Virgola: , o | - combina selezioni (es., 1-10, 20)"
-not = "NOT: ! o \"not\" - esclude pagine (es., 3n & not 30)"
+not = "NOT: ! o \"not\" - esclude pagine (es., 3n & non 30)"
 
 [bulkSelection.operators.even]
 title = "Seleziona tutte le pagine pari (2, 4, 6, 8...)"
@@ -2299,8 +2299,8 @@ title = "Quale opzione dovrei usare?"
 stepTitle = "Formato certificato"
 
 [certSign.collab.addParticipants]
-add_one = "Add {{count}} Participant"
-add_other = "Add {{count}} Participants"
+add_one = "Aggiungi {{count}} Partecipante"
+add_other = "Aggiungi {{count}} Partecipanti"
 reasonHelp = "Preimposta un motivo di firma per questi partecipanti (opzionale, possono modificarlo al momento della firma)"
 reasonPlaceholder = "es. Approvazione, Revisione..."
 
@@ -2407,8 +2407,8 @@ certInvalidFallback = "Certificato non valido"
 certNetworkError = "Impossibile verificare il certificato"
 certValidating = "Verifica del certificato..."
 certValidUntil = "Certificato valido fino al {{date}}"
-description_one = "You have placed {{count}} signature. Choose your certificate to complete signing."
-description_other = "You have placed {{count}} signatures. Choose your certificate to complete signing."
+description_one = "Hai inserito {{count}} firma. Scegli il tuo certificato per completare la firma."
+description_other = "Hai inserito {{count}} firme. Scegli il tuo certificato per completare la firma."
 sign = "Firma documento"
 title = "Configura certificato"
 
@@ -2584,7 +2584,7 @@ title = "Cambia credenziali"
 [changeMetadata]
 filenamePrefix = "metadati"
 submit = "Cambia proprietà"
-tags = "edit,modify,update,metadata,properties,document properties,author,title,subject,keywords,creator,producer,info,document info,file properties"
+tags = "modifica,modifica,aggiorna,metadati,proprietà,proprietà del documento,autore,titolo,oggetto,parole chiave,creatore,produttore,info,informazioni sul documento,proprietà del file"
 
 [changeMetadata.advanced]
 title = "Opzioni avanzate"
@@ -2692,7 +2692,7 @@ unknown = "Sconosciuto"
 [changePermissions]
 desc = "Modifica restrizioni e permessi del documento."
 submit = "Cambia Permessi"
-tags = "permissions,restrictions,rights,access control,allow,deny,printing,copying,editing,modify permissions,security settings,user rights"
+tags = "permessi,restrizioni,diritti,controllo degli accessi,consenti,nega,stampa,copia,modifica,modifica permessi,impostazioni di sicurezza,diritti utente"
 title = "Cambia Permessi"
 
 [changePermissions.error]
@@ -2738,32 +2738,32 @@ text = "Per rendere questi permessi immodificabili, usa lo strumento Aggiungi pa
 copy = "Copia messaggio"
 
 [chat.fab]
-close = "Close chat"
-open = "Open Stirling AI assistant"
+close = "Chiudi chat"
+open = "Apri Stirling assistente IA"
 
 [chat.header]
 agentMenu = "Opzioni agente Stirling"
 clearChat = "Cancella chat"
 
 [chat.input]
-disclaimer = "AI can make mistakes. Be sure to verify the output before sharing."
+disclaimer = "L'IA può commettere errori. Assicurati di verificare il risultato prima di condividerlo."
 placeholder = "Cosa vuoi fare?"
 send = "Invia messaggio"
 
 [chat.progress]
 analyzing = "Analisi della richiesta..."
-calling_engine = "L'AI sta elaborando..."
+calling_engine = "L'IA sta elaborando..."
 executing_tool_generic = "Esecuzione dello strumento..."
 executing_tool_generic_step = "Esecuzione dello strumento (fase {{step}} di {{total}})..."
 executing_tool_single = "Esecuzione di {{tool}}..."
 executing_tool_step = "Esecuzione di {{tool}} (fase {{step}} di {{total}})..."
 extracting_content = "Estrazione del contenuto dai documenti..."
 processing = "Elaborazione del contenuto estratto..."
-ranForMinutes_one = "Ran for 1 minute"
-ranForMinutes_other = "Ran for {{count}} minutes"
-ranForMinutesSeconds = "Ran for {{minutes}} min, {{seconds}} sec"
-ranForSeconds_one = "Ran for 1 second"
-ranForSeconds_other = "Ran for {{count}} seconds"
+ranForMinutes_one = "Eseguito per 1 minuto"
+ranForMinutes_other = "Eseguito per {{count}} minuti"
+ranForMinutesSeconds = "Eseguito per {{minutes}} min, {{seconds}} sec"
+ranForSeconds_one = "Eseguito per 1 secondo"
+ranForSeconds_other = "Eseguito per {{count}} secondi"
 thinking = "Elaborazione..."
 whole_doc_compression_round = "Consolidamento delle note..."
 whole_doc_read_done = "Lettura del documento completata..."
@@ -2791,7 +2791,7 @@ need_clarification = "Potresti chiarire la tua richiesta?"
 not_found = "Non ho trovato le informazioni richieste."
 processing = "Elaborazione ({{outcome}})..."
 unsupported_capability = "Funzionalità non supportata: {{capability}}"
-usage_limit_reached = "You've reached your usage limit. Check your plan options to keep going."
+usage_limit_reached = "Hai raggiunto il tuo limite d'uso. Controlla le opzioni del tuo piano per continuare."
 
 [chat.toolsUsed]
 summary_one = "Eseguito 1 strumento"
@@ -2953,7 +2953,7 @@ message = "Questi documenti sembrano molto dissimili. Il confronto è stato inte
 [compress]
 desc = "Comprimi i PDF per ridurne la dimensione."
 submit = "Comprimi"
-tags = "shrink,reduce,optimize,compress,smaller,downsize,file size,reduce size,minimize,make smaller,decrease size,optimize size"
+tags = "restringere,ridurre,ottimizzare,comprimere,più piccolo,ridimensionare,dimensione del file,ridurre le dimensioni,minimizzare,rendere più piccolo,diminuire le dimensioni,ottimizzare le dimensioni"
 title = "Comprimi"
 
 [compress.compressionLevel]
@@ -3103,28 +3103,26 @@ title = "Aggiorna chiavi API"
 warning = "⚠️ Attenzione: questa azione genererà nuove chiavi API e renderà non valide le chiavi precedenti."
 
 [config.mcp]
-description = "Model Context Protocol (MCP) lets AI assistants like Claude use your Stirling PDF tools directly. Connect a client once and your assistant can convert, edit, secure and process documents on your behalf."
-guestInfo = "Guest users can't connect MCP clients. Create an account to use the MCP server and let your AI assistant run Stirling PDF tools on your behalf."
-navLabel = "MCP Server"
-tip = "Every action your assistant runs is performed as your account and counts towards your usage, just like using Stirling PDF directly."
-title = "MCP Server"
-viewApiKeys = "View API keys"
+description = "Il Model Context Protocol (MCP) consente agli assistenti IA come Claude di usare direttamente i tuoi strumenti Stirling PDF. Connetti un client una sola volta e il tuo assistente potrà convertire, modificare, proteggere e l'elaborare documenti per tuo conto."
+guestInfo = "Gli utenti ospite non possono connettere client MCP. Crea un account per utilizzare il server MCP e consentire al tuo assistente IA di eseguire gli strumenti Stirling PDF per tuo conto."
+navLabel = "Server MCP"
+tip = "Ogni azione eseguita dal tuo assistente viene effettuata con il tuo account e viene conteggiata nel tuo consumo, esattamente come quando usi Stirling PDF direttamente."
 
 [config.mcp.copy]
-configLabel = "Config"
-copied = "Copied"
-copy = "Copy"
-endpointLabel = "Endpoint URL"
-tooltip = "Copy {{label}}"
-tooltipCopied = "{{label}} copied"
+configLabel = "Configurazione"
+copied = "Copiato"
+copy = "Copia"
+endpointLabel = "URL dell'endpoint"
+tooltip = "Copia {{label}}"
+tooltipCopied = "{{label}} copiato"
 
 [config.mcp.endpoint]
-label = "Your MCP endpoint"
+label = "Il tuo endpoint MCP"
 
 [config.mcp.setup]
-addTo = "Add to"
-hint = "Pick your client, paste the snippet into the file shown, then restart it. You'll sign in with your Stirling account on first use - no keys to copy."
-title = "Connect your AI assistant"
+addTo = "Aggiungi a"
+hint = "Scegli il tuo client, incolla lo snippet nel file indicato, quindi riavvialo. Al primo utilizzo effettuerai l'accesso con il tuo account Stirling — nessuna chiave da copiare."
+title = "Connetti il tuo assistente IA"
 
 [config.overview]
 description = "Impostazioni correnti dell'applicazione e dettagli di configurazione."
@@ -3199,7 +3197,7 @@ strictModeDesc = "Errore se la conversione non è perfetta (utilizza la verifica
 svgPdfOptions = "Opzioni da SVG a PDF"
 svgToPdf = "SVG → PDF"
 svgVectorNote = "I file SVG vengono renderizzati come grafica vettoriale per un output nitido a qualsiasi risoluzione. Le dimensioni dell'SVG determinano le dimensioni della pagina PDF."
-tags = "transform,change,convert,PDF to Word,PDF to Excel,PDF to image,Word to PDF,Excel to PDF,PowerPoint to PDF,HTML to PDF,export,import,file conversion,format change,save as"
+tags = "trasformare,cambiare,convertire,PDF in Word,PDF in Excel,PDF in immagine,Word in PDF,Excel in PDF,PowerPoint in PDF,HTML in PDF,esportare,importare,conversione file,cambio formato,salva con nome"
 targetFormatPlaceholder = "Formato di destinazione"
 title = "Converti"
 webOptions = "Opzioni Web a PDF"
@@ -3373,16 +3371,16 @@ message = "Stirling-PDF non ha l'autorizzazione per aggiornarsi su questa macchi
 title = "Permessi di amministratore richiesti"
 
 [devAirgapped]
-tags = "air-gapped,offline,isolated,no internet,disconnected,secure,network isolation,standalone"
+tags = "isolato dalla rete,offline,senza internet,disconnesso,sicuro,isolamento di rete,autonomo"
 
 [devApi]
-tags = "API,development,documentation,developer,REST,integration,endpoints,programmatic,automation,scripting"
+tags = "API,sviluppo,documentazione,sviluppatore,REST,integrazione,endpoint,programmatico,automazione,scripting"
 
 [devFolderScanning]
-tags = "automation,folder,scanning,watch folder,hot folder,automatic processing,batch,monitor folder,auto process,folder monitoring"
+tags = "automazione,cartella,scansione,cartella di controllo,cartella di tendenza,elaborazione automatica,batch,monitoraggio cartella,processo automatico,monitoraggio cartella"
 
 [devSsoGuide]
-tags = "SSO,single sign-on,authentication,SAML,OAuth,OIDC,login,enterprise,identity provider,IdP"
+tags = "SSO,single sign-on,autenticazione,SAML,OAuth,OIDC,login,enterprise,provider di identità,IdP"
 
 [dropdownList]
 searchPlaceholder = "Cerca..."
@@ -3393,7 +3391,7 @@ editSecretValue = "Modifica valore segreto"
 
 [editTableOfContents]
 submit = "Applica sommario"
-tags = "bookmarks,contents,edit,table of contents,TOC,outline,navigation,chapters,sections,add bookmarks,edit bookmarks,PDF outline"
+tags = "segnalibri,contenuto,modifica,indice,TOC,struttura,navigazione,capitoli,sezioni,aggiungi segnalibri,modifica segnalibri,struttura PDF"
 
 [editTableOfContents.actions]
 clipboardUnavailable = "L'accesso agli appunti non è disponibile in questo browser."
@@ -3529,7 +3527,7 @@ tags = "estrarre"
 
 [extractPages]
 submit = "Estrai pagine"
-tags = "pull,select,copy,extract,extract pages,get pages,pull out,save pages,export pages,copy pages,select pages,specific pages"
+tags = "tirare,selezionare,copiare,estrarre,estrarre pagine,ottenere pagine,tirare fuori,salvare pagine,esportare pagine,copiare pagine,selezionare pagine,pagine specifiche"
 title = "Estrai pagine"
 
 [extractPages.error]
@@ -3657,7 +3655,7 @@ unzip = "Estrai"
 updateOnServer = "Aggiorna sul server"
 uploadSelected = "Carica selezionati"
 uploadToServer = "Carica sul server"
-versionHistory = "Version history"
+versionHistory = "Cronologia delle versioni"
 
 [files]
 addFiles = "Aggiungi file"
@@ -3714,13 +3712,13 @@ viewAll = "Visualizza tutti i {{count}} file"
 
 [fileSidebar.fileItem]
 closeViewer = "Chiudi visualizzatore"
-delete = "Delete"
-moreActions = "More actions"
+delete = "Elimina"
+moreActions = "Altre azioni"
 openInViewer = "Apri nel visualizzatore"
-savedToServer = "Saved to server"
-updateOnServer = "Update on server"
-uploadToServer = "Upload to server"
-versionHistory = "Version history"
+savedToServer = "Salvato sul server"
+updateOnServer = "Aggiorna sul server"
+uploadToServer = "Carica sul server"
+versionHistory = "Cronologia versioni"
 
 [fileSidebar.groupsModal]
 add = "Aggiungi"
@@ -3755,26 +3753,26 @@ closeDetails = "Chiudi dettagli"
 create = "Crea"
 cycleBlocked = "Impossibile spostare una cartella in una delle sue sottocartelle."
 delete = "Elimina"
-deleteFilesChoiceBody = "Some of these files are saved both on this device and in the cloud. Where should they be deleted from?"
-deleteFilesCloudBody_one = "Delete 1 file from the cloud? This cannot be undone."
-deleteFilesCloudBody_other = "Delete {{count}} files from the cloud? This cannot be undone."
-deleteFilesError = "Could not delete. Try again."
-deleteFilesLocalBody_one = "Delete 1 file from this device? This cannot be undone."
-deleteFilesLocalBody_other = "Delete {{count}} files from this device? This cannot be undone."
-deleteFilesTitle_one = "Delete 1 file?"
-deleteFilesTitle_other = "Delete {{count}} files?"
+deleteFilesChoiceBody = "Alcuni di questi file sono salvati sia su questo dispositivo che nel cloud. Da dove desideri eliminarli?"
+deleteFilesCloudBody_one = "Eliminare 1 file dal cloud? L'azione è irreversibile."
+deleteFilesCloudBody_other = "Eliminare {{count}} file dal cloud? L'azione è irreversibile."
+deleteFilesError = "Impossibile eliminare. Riprova."
+deleteFilesLocalBody_one = "Eliminare 1 file da questo dispositivo? L'azione è irreversibile."
+deleteFilesLocalBody_other = "Eliminare {{count}} file da questo dispositivo? L'azione è irreversibile."
+deleteFilesTitle_one = "Eliminare 1 file?"
+deleteFilesTitle_other = "Eliminare {{count}} file?"
 deleteFolder = "Elimina cartella"
 deleteFolderBody = "Eliminare la cartella \"{{name}}\"?"
-deleteFolderContents_one = "Also delete {{count}} file inside the folder"
-deleteFolderContents_other = "Also delete {{count}} files inside the folder"
+deleteFolderContents_one = "Elimina anche il file contenuto all'interno della cartella"
+deleteFolderContents_other = "Elimina anche i {{count}} file contenuti all'interno della cartella"
 deleteFolderContentsWarning = "I file verranno rimossi definitivamente e non potranno essere recuperati."
 deleteFolderError = "Impossibile eliminare la cartella. Riprova."
 deleteFolderKeepHint = "I file all'interno verranno spostati in Tutti i file."
 deleteFolderTitle = "Eliminare la cartella?"
 deselectAll = "Cancella selezione"
 details = "Dettagli"
-detailsCount_one = "{{count}} file selected"
-detailsCount_other = "{{count}} files selected"
+detailsCount_one = "{{count}} file selezionato"
+detailsCount_other = "{{count}} file selezionati"
 dismissError = "Ignora"
 download = "Scarica"
 downloadAll = "Scarica tutto"
@@ -3785,16 +3783,16 @@ file = "File"
 fileInfo = "File info"
 fileMenu = "Azioni file"
 folder = "Cartella"
-folderItems_one = "{{count}} item"
-folderItems_other = "{{count}} items"
+folderItems_one = "{{count}} elemento"
+folderItems_other = "{{count}} elementi"
 folderMenu = "Azioni cartella"
 inPath = "in {{path}}"
 inWorkspace = "Aperto"
 inWorkspaceAria = "Già nello spazio di lavoro"
 loading = "Caricamento…"
 localFoldersUnavailable = "Le cartelle sono solo nel cloud: salva un file nel cloud per organizzarle."
-moveSkippedRemote_one = "{{count}} file couldn't be moved on the server (no permission or already deleted)."
-moveSkippedRemote_other = "{{count}} files couldn't be moved on the server (no permission or already deleted)."
+moveSkippedRemote_one = "Impossibile spostare {{count}} file sul server (autorizzazione mancante o elemento già eliminato)."
+moveSkippedRemote_other = "Impossibile spostare {{count}} file sul server (autorizzazione mancante o elementi già eliminati)."
 moveTo = "Sposta in…"
 myFiles = "I miei file"
 newFolder = "Nuova cartella"
@@ -3822,21 +3820,21 @@ selectFile = "Seleziona file {{name}}"
 shareDisabledHint = "La condivisione file non è abilitata su questo server. Chiedi al tuo amministratore di abilitarla."
 shareManage = "Gestisci condivisione"
 showDetails = "Mostra dettagli"
-signInRequired = "Sign in to use cloud storage."
-summary_one = "{{count}} item"
-summary_other = "{{count}} items"
+signInRequired = "Accedi per utilizzare lo spazio di archiviazione cloud."
+summary_one = "{{count}} elemento"
+summary_other = "{{count}} elementi"
 tree = "Cartelle"
 upload = "Carica"
 uploadedToLocal = "I file caricati iniziano in Locale. Usa 'Salva nel cloud' per inserirli in una cartella."
 uploadFromMobile = "Carica da dispositivo mobile"
 versionActions = "Azioni versione"
 versionCollapse = "Comprimi versioni intermedie"
-versionHistory = "Version history"
-versionHistoryEmpty = "This file has no earlier versions."
+versionHistory = "Cronologia versioni"
+versionHistoryEmpty = "Questo file non ha versioni precedenti."
 versionOrigin = "Caricamento originale"
 versionsCount = "{{count}} versioni"
 versionShowHidden = "Mostra {{count}} versioni precedenti"
-viewVersionHistory = "Version journey ({{count}})"
+viewVersionHistory = "Percorso delle versioni ({{count}})"
 
 [filesPage.appearance]
 colour = "Colore"
@@ -3851,12 +3849,12 @@ size = "Dimensione"
 type = "Tipo"
 
 [filesPage.deleteScope]
-cloud = "Cloud only"
-cloudHint = "Deletes from the server. A copy stays on this device."
-device = "This device only"
-deviceHint = "Removes the local copy. The cloud copy is kept."
-everywhere = "Everywhere"
-everywhereHint = "Deletes the file from this device and the cloud."
+cloud = "Solo sul cloud"
+cloudHint = "Elimina il file dal server. Una copia rimarrà su questo dispositivo."
+device = "Solo su questo dispositivo"
+deviceHint = "Rimuove la copia locale. La copia sul cloud verrà conservata."
+everywhere = "Ovunque"
+everywhereHint = "Elimina il file sia da questo dispositivo che dal cloud."
 
 [filesPage.empty]
 hint = "Rilascia i PDF ovunque in questa pagina per caricarli, oppure usa il pulsante Nuova cartella per organizzare i tuoi file."
@@ -4027,7 +4025,7 @@ welcomeTitle = "Benvenuto!"
 
 [flatten]
 submit = "Appiattisci"
-tags = "simplify,remove,interactive,flatten,flatten form,remove form fields,make static,finalize form,lock form,disable editing,convert to image,non-editable"
+tags = "semplifica,rimuovi,interattivo,appiattisci,appiattisci modulo,rimuovi campi modulo,rendi statico,finalizza modulo,blocca modulo,disabilita modifica,converti in immagine,non modificabile"
 title = "Appiattire"
 
 [flatten.error]
@@ -4848,32 +4846,32 @@ message = "Puoi chiudere questa finestra e tornare a Stirling PDF."
 title = "Autenticazione riuscita"
 
 [oauthConsent]
-approve = "Allow access"
-approving = "Allowing..."
-decisionFailed = "Could not submit your decision. Please try again."
-deny = "Deny"
-denying = "Denying..."
-loadFailed = "This authorisation request is invalid or has expired. Close this tab and try connecting again from the app."
-loading = "Loading authorisation request..."
-missingId = "Missing authorisation request. Start the connection from your app and try again."
-redirecting = "Returning you to the app..."
-requesting = "{{app}} wants to access your Stirling PDF account"
-scopesIntro = "This will allow {{app}} to:"
-signedInAs = "Signed in as {{name}}"
-signInButton = "Sign in to continue"
-signInPrompt = "Sign in to your Stirling PDF account to continue connecting the app."
-title = "Authorise access"
-unknownApp = "A third-party application"
+approve = "Consenti l'accesso"
+approving = "Consentendo..."
+decisionFailed = "Impossibile inviare la tua decisione. Riprova."
+deny = "Nega"
+denying = "Negando..."
+loadFailed = "Questa richiesta di autorizzazione non è valida o è scaduta. Chiudi questa scheda e prova a connetterti di nuovo dall'app."
+loading = "Caricamento della richiesta di autorizzazione..."
+missingId = "Richiesta di autorizzazione mancante. Avvia la connessione dalla tua app e riprova."
+redirecting = "Ritorno all'app in corso..."
+requesting = "{{app}} desidera accedere al tuo account Stirling PDF"
+scopesIntro = "Questo consentirà a {{app}} di:"
+signedInAs = "Accesso effettuato come {{name}}"
+signInButton = "Accedi per continuare"
+signInPrompt = "Accedi al tuo account Stirling PDF per continuare a connettere l'app."
+title = "Autorizza l'accesso"
+unknownApp = "Un'applicazione di terze parti"
 
 [oauthConsent.access]
-actAsYou = "Act as you - everything {{app}} does runs under your account and counts towards your usage"
-tools = "Use your Stirling PDF tools on your behalf - convert, edit, sign, secure and process your documents"
+actAsYou = "Agire a tuo nome — qualsiasi operazione effettuata da {{app}} verrà eseguita con il tuo account e conteggiata nel tuo consumo"
+tools = "Usare i tuoi strumenti Stirling PDF per tuo conto — convertire, modificare, firmare, proteggere ed elaborare i tuoi documenti"
 
 [oauthConsent.scope]
-email = "See your email address"
-openid = "Confirm your identity"
-phone = "See your phone number"
-profile = "See your basic profile information"
+email = "Visualizzare il tuo indirizzo email"
+openid = "Confermare la tua identità"
+phone = "Visualizzare il tuo numero di telefono"
+profile = "Visualizzare le informazioni di base del tuo profilo"
 
 [ocr]
 desc = "Pulisci scansioni ed estrai testo da immagini, convertendo le immagini in testo puro."
@@ -5006,20 +5004,20 @@ userBody = "Invita i colleghi, assegna ruoli e tieni i documenti organizzati in
 userTitle = "Panoramica piano"
 
 [onboarding.saas.freeEditor]
-freeLine = "The editor is now <free>completely free</free>."
-premium = "We've added loads of new features, including <strong>Policies</strong> and <strong>Agent Chat</strong>."
-title = "Welcome to Stirling"
+freeLine = "L'editor è ora <free>completamente gratuito</free>."
+premium = "Abbiamo aggiunto tantissime nuove funzionalità, tra cui le <strong>Policy</strong> e la <strong>Chat con l'Agente</strong>."
+title = "Benvenuto in Stirling"
 
 [onboarding.saas.team]
-addButton = "Add"
-createBody = "Work on documents together: teammates share files, automations and your plan. Add the first member by email to create your team."
-createTitle = "Create your team"
-inviteBody = "Everyone on your team shares files, automations and your plan. Add teammates by email and they'll get an invitation."
-inviteTitle = "Invite members to your team"
+addButton = "Aggiungi"
+createBody = "Collaborate sui documenti: i membri del team condividono file, automazioni e il piano. Aggiungi il primo membro tramite email per creare il tuo team."
+createTitle = "Crea il tuo team"
+inviteBody = "Tutti i membri del tuo team condividono file, automazioni e il piano. Aggiungi i membri del team tramite email e riceveranno un invito."
+inviteTitle = "Invita membri nel tuo team"
 
 [onboarding.saas.usage]
-body = "Automations, AI and API requests draw from your free allowance. Manual editing never counts against it."
-title = "Your free Processor allowance"
+body = "Le automazioni, l'IA e le richieste API attingono dalla tua soglia gratuita. Le modifiche manuali non vengono mai conteggiate."
+title = "La tua soglia gratuita per il Processor"
 
 [onboarding.securityCheck]
 message = "L'applicazione ha subito cambiamenti significativi di recente. Potrebbe essere necessaria l'attenzione dell'amministratore del server. Conferma il tuo ruolo per continuare."
@@ -5292,206 +5290,206 @@ bullet1 = "<strong>all</strong> → seleziona tutte le pagine"
 title = "Parole chiave speciali"
 
 [payg.activity]
-docs = "docs"
-empty = "No billable activity yet this period."
-subtitle = "Only AI and automation draw from your budget. Everyday tools are free and aren't listed here."
-title = "Recent billable activity"
+docs = "documenti"
+empty = "Ancora nessuna attività fatturabile in questo periodo."
+subtitle = "Solo l'IA e le automazioni attingono dal tuo budget. Gli strumenti di uso quotidiano sono gratuiti e non sono elencati qui."
+title = "Attività fatturabile recente"
 
 [payg.cap]
-amount = "Cap amount"
-custom = "Custom"
-docsEstimate = "≈ {{docs}} processed PDFs / month"
-docsRate = "at {{rate}} / PDF"
-noCapDesc = "Usage is billed without an upper limit. You can re-enable a cap at any time."
-noCapLabel = "No cap"
-noneShort = "No cap"
-perMonth = "/ month"
-save = "Update cap"
-subtitle = "Set your maximum spend. We convert this to PDFs using the current price tier."
-title = "Monthly spending cap"
+amount = "Importo massimo"
+custom = "Personalizzato"
+docsEstimate = "≈ {{docs}} PDF elaborati / mese"
+docsRate = "a {{rate}} / PDF"
+noCapDesc = "L'utilizzo viene fatturato senza un limite massimo. Puoi riattivare una soglia limite in qualsiasi momento."
+noCapLabel = "Nessun limite"
+noneShort = "Nessun limite"
+perMonth = "/ mese"
+save = "Aggiorna limite"
+subtitle = "Imposta la tua spesa massima. Convertiamo questo importo in PDF in base alla fascia di prezzo attuale."
+title = "Limite di spesa mensile"
 
 [payg.checkout]
-connecting = "Connecting to Stripe…"
-errorTitle = "Stripe error"
+connecting = "Connessione a Stripe in corso…"
+errorTitle = "Errore di Stripe"
 
 [payg.checkout.error]
-startFailed = "Couldn't start checkout session"
+startFailed = "Impossibile avviare la sessione di pagamento"
 
 [payg.checkout.mock]
-backend = "Backend is in mock mode; no real Stripe session was created."
-continue = "Continue with mock subscription"
-noKey = "VITE_STRIPE_PUBLISHABLE_KEY is unset. Real iframe mounts here once configured."
-title = "Stripe Embedded Checkout (mock mode)"
+backend = "Il backend è in modalità mock; non è stata creata alcuna sessione Stripe reale."
+continue = "Continua con l'abbonamento simulato"
+noKey = "VITE_STRIPE_PUBLISHABLE_KEY non è impostata. Una volta configurata, qui verrà montato l'iframe reale."
+title = "Stripe Embedded Checkout (modalità mock)"
 
 [payg.confirm]
-body = "Your team can now run automation, AI, and API operations beyond your 500 free PDFs."
-capValue = "{{symbol}}{{amount}} / month"
-noCap = "No cap"
-note = "You can change your cap, cancel, or open the Stripe customer portal any time from this page."
-summaryLabel = "Monthly ceiling"
-title = "Welcome to the Processor plan"
+body = "Il tuo team può ora eseguire operazioni di automazione, IA e API oltre la soglia dei 500 PDF gratuiti."
+capValue = "{{symbol}}{{amount}} / mese"
+noCap = "Nessun limite"
+note = "Puoi modificare il tuo limite, annullare l'abbonamento o aprire il portale clienti di Stripe in qualsiasi momento da questa pagina."
+summaryLabel = "Soglia massima mensile"
+title = "Benvenuto nel piano Processor"
 
 [payg.docHelp]
-billable = "Only automation runs, AI tools, and API calls count. Manual tools in the editor are always free."
-chains = "Running the same file through several steps of one automation counts it once, not once per step."
-perFile = "Each file you process counts as one PDF. Very long or very large files can count as more than one."
-refunds = "If a job fails on its first step, the PDF is credited back automatically."
-toggle = "What counts as a PDF?"
+billable = "Vengono conteggiati solo i cicli di automazione, gli strumenti IA e le chiamate API. Gli strumenti manuali nell'editor sono sempre gratuiti."
+chains = "L'elaborazione dello stesso file attraverso più passaggi di una singola automazione viene conteggiata una sola volta, e non una volta per passaggio."
+perFile = "Ogni file elaborato conta come un singolo PDF. I file molto lunghi o molto grandi possono essere conteggiati come più di uno."
+refunds = "Se un'operazione non va a buon fine al primo passaggio, il PDF viene riaccreditato automaticamente."
+toggle = "Cosa viene conteggiato come PDF?"
 
 [payg.error]
-body = "We couldn't reach the billing service. Refresh the page to try again."
-title = "Couldn't load your plan"
+body = "Impossibile raggiungere il servizio di fatturazione. Aggiorna la pagina per riprovare."
+title = "Impossibile caricare il tuo piano"
 
 [payg.free.cta]
-benefit1Body = "chain tools, schedule runs, batch process"
-benefit1Title = "Automation pipelines"
-benefit2Body = "summarise, classify, redact, AI-OCR"
-benefit2Title = "AI tools"
-benefit3Body = "call any Stirling endpoint programmatically"
-benefit3Title = "API access"
-button = "Turn on Processor →"
-reassurance = "No minimum · Set a $0 cap to test · Cancel anytime"
-subtitle = "Keep going past your 500 free PDFs with automation, AI, and the API. Set a monthly ceiling, so you stay in control."
-title = "Turn on the Processor plan"
+benefit1Body = "concatena strumenti, pianifica esecuzioni, elabora in blocco"
+benefit1Title = "Pipeline di automazione"
+benefit2Body = "riassumi, classifica, oscura dati, AI-OCR"
+benefit2Title = "Strumenti IA"
+benefit3Body = "chiama qualsiasi endpoint di Stirling via codice"
+benefit3Title = "Accesso API"
+button = "Attiva Processor →"
+reassurance = "Nessun minimo · Imposta un limite di 0 $ per provare · Annulla quando vuoi"
+subtitle = "Supera la soglia dei 500 PDF gratuiti con l'automazione, l'IA e l'API. Imposta un tetto mensile per mantenere il pieno controllo."
+title = "Attiva il piano Processor"
 
 [payg.free.editor]
-eyebrow = "Editor plan · Always free"
+eeyebrow = "Piano Editor · Sempre gratuito"
 
 [payg.free.header]
-freeBody = "View, edit, merge, split, sign, watermark, compress, convert and manual OCR — as much as you want, no matter where you trigger it."
-freeTitle = "Unlimited PDF editing"
+freeBody = "Visualizza, modifica, unisci, dividi, firma, inserisci filigrana, comprimi, converti ed esegui l'OCR manuale — tutto quello che vuoi, indipendentemente da dove lo avvii."
+freeTitle = "Modifica PDF illimitata"
 
 [payg.free.hero]
-capSuffix = "/ {{limit}} free PDFs"
-metaCategories = "Automation · AI · API requests"
+capSuffix = "/ {{limit}} PDF gratuiti"
+metaCategories = "Automazione · IA · Richieste API"
 
 [payg.free.member]
-ownerOnly = "Only your team owner can turn on Processor. Manual tools stay free for you to use as much as you like."
+ownerOnly = "Solo il proprietario del team può attivare il piano Processor. Gli strumenti manuali rimangono gratuiti e potrai usarli ogni volta che vuoi."
 
 [payg.free.proc]
-eyebrow = "Processor plan · metered"
+eyebrow = "Piano Processor · A consumo"
 
 [payg.free.state]
-approachingLimit = "Approaching limit"
-limitReached = "Limit reached"
-plentyLeft = "Plenty left"
+approachingLimit = "In esaurimento"
+limitReached = "Limite raggiunto"
+plentyLeft = "Soglia residua ampia"
 
 [payg.gates]
-ai = "AI tools (AI Create, suggestions, AI-OCR)"
-automation = "Automations & pipelines"
-client = "Browser-only tools (viewer, page editor, file management)"
-offsite = "Server tools (compress, OCR, convert, watermark…)"
-pauses = "pauses at cap"
-title = "What happens when the cap is reached"
+ai = "Strumenti IA (Crea con IA, suggerimenti, AI-OCR)"
+automation = "Automazioni e pipeline"
+client = "Strumenti solo browser (visualizzatore, editor di pagine, gestione file)"
+offsite = "Strumenti server (comprimi, OCR, converti, filigrana…)"
+pauses = "si interrompe al raggiungimento del limite"
+title = "Cosa succede quando si raggiunge il limite"
 
 [payg.header]
-eyebrow = "Processor plan · {{start}} – {{end}}"
-freeBody = "View, edit, merge, split, sign, watermark, compress, convert and manual OCR — as much as you want, no matter where you trigger it."
-freeLabel = "Always free"
-freeTitle = "Unlimited PDF editing"
-meterBody = "{{limit}} free PDFs to start, then billed per PDF up to your cap."
-meterLabel = "Metered"
-meterTitle = "Automation · AI · API"
+eyebrow = "Piano Processor · {{start}} – {{end}}"
+freeBody = "Visualizza, modifica, unisci, dividi, firma, inserisci filigrana, comprimi, converti ed esegui l'OCR manuale — tutto quello che vuoi, indipendentemente da dove lo avvii."
+freeLabel = "Sempre gratuito"
+freeTitle = "Modifica PDF illimitata"
+meterBody = "{{limit}} PDF gratuiti iniziali, poi fatturati per singolo PDF fino al raggiungimento del limite."
+meterLabel = "A consumo"
+meterTitle = "Automazione · IA · API"
 
 [payg.member]
-askLeader = "Only your team owner can change the cap."
+askLeader = "Solo il proprietario del team può modificare il limite di spesa."
 
 [payg.members]
-docs = "PDFs"
-subtitle = "Billable PDFs each teammate has processed this period."
-title = "Team member usage"
+docs = "PDF"
+subtitle = "PDF fatturabili che ogni membro del team ha elaborato in questo periodo."
+title = "Utilizzo dei membri del team"
 
 [payg.role]
-leader = "Team owner"
-member = "Member"
+leader = "Proprietario del team"
+member = "Membro"
 
 [payg.signupRequired]
-body = "Stirling PDF gives every signed-up account 500 free operations, enough to keep most workflows humming without paying a cent. You're currently using Stirling as a guest, which doesn't include billable tools like AI, automations, or hosted processing."
-cancel = "Not now"
-cta = "Sign up free"
-subtext = "Creating an account is free and takes a few seconds. No credit card required."
-title = "Sign up to use {{category}}"
+body = "Stirling PDF offre a ogni account registrato 500 operazioni gratuite, sufficienti per mantenere attivi la maggior parte dei flussi di lavoro senza pagare un centesimo. Al momento stai utilizzando Stirling come ospite, il che non include strumenti fatturabili come l'IA, le automazioni o l'elaborazione gestita sul server."
+cancel = "Non ora"
+cta = "Registrati gratis"
+subtext = "Creare un account è gratuito e richiede pochi secondi. Nessuna carta di credito richiesta."
+title = "Registrati per utilizzare {{category}}"
 
 [payg.signupRequired.category]
-ai = "AI features"
-api = "this tool"
-automation = "automations"
-default = "this feature"
+ai = "le funzionalità IA"
+api = "questo strumento"
+automation = "le automazioni"
+default = "questa funzionalità"
 
 [payg.spendCapMeter]
-capSuffix = "/ {{amount}} cap"
-metaCategories = "Automation · AI · API spend"
-resets = "Resets each billing period"
+capSuffix = "/ limite di {{amount}}"
+metaCategories = "Automazione · IA · Spesa API"
+resets = "Si azzera a ogni periodo di fatturazione"
 
 [payg.state]
-degraded = "Cap reached"
-full = "Healthy"
-warned = "Approaching cap"
+degraded = "Limite raggiunto"
+full = "Regolare"
+warned = "In esaurimento"
 
 [payg.stripe]
-open = "Open billing portal"
-subtitle = "Receipts, invoices, payment method, billing currency."
-title = "Manage billing in Stripe"
+open = "Apri il portale di fatturazione"
+subtitle = "Ricevute, fatture, metodo di pagamento, valuta di fatturazione."
+title = "Gestisci la fatturazione in Stripe"
 
 [payg.stripe.toast.unavailable]
-body = "Billing portal isn't available right now. Try again in a moment."
-title = "Billing portal unavailable"
+body = "Il portale di fatturazione non è disponibile al momento. Riprova tra qualche istante."
+title = "Portale di fatturazione non disponibile"
 
 [payg.upgrade]
-backAria = "Back"
-closeAria = "Close"
+backAria = "Indietro"
+closeAria = "Chiudi"
 
 [payg.upgrade.button]
-cancel = "Cancel"
-continue = "Continue →"
-finish = "Finish"
+cancel = "Annulla"
+continue = "Continua →"
+finish = "Fine"
 
 [payg.upgrade.cap]
-help = "We'll never charge above this. Set $0 if you want to keep everything free while testing."
-title = "Set your monthly spend ceiling"
-usdNote = "Estimated in USD. You can adjust your cap any time after subscribing, in your own currency."
+help = "Non addebiteremo mai un importo superiore a questo. Imposta 0 $ se desideri mantenere tutto gratuito durante i test."
+title = "Imposta il tuo tetto massimo di spesa mensile"
+usdNote = "Stima in USD. Dopo l'attivazione dell'abbonamento potrai modificare il tuo limite in qualsiasi momento nella tua valuta."
 
 [payg.upgrade.checkout]
-capValue = "{{symbol}}{{amount}} / month"
-edit = "Edit"
-help = "Stripe handles your card details. Stirling never sees them."
-loading = "Loading checkout…"
-noCap = "No cap"
-title = "Add your payment method"
+capValue = "{{symbol}}{{amount}} / mese"
+edit = "Modifica"
+help = "I dati della tua carta sono gestiti da Stripe. Stirling non ha accesso a queste informazioni."
+loading = "Caricamento del pagamento in corso…"
+noCap = "Nessun limite"
+title = "Aggiungi il tuo metodo di pagamento"
 
 [payg.upgrade.help]
-aiBody = "summarise, classify, redact, AI-OCR"
-aiTitle = "AI tools"
-apiBody = "programmatic access to any Stirling endpoint"
-apiTitle = "API calls"
-automationBody = "chained tools or scheduled runs that don't need clicks"
-automationTitle = "Automation pipelines"
-footnote = "Manual tools (viewing, editing, merging, splitting, watermarking, compressing, manual OCR) are always free, even past 500. The distinction is the type of work, not where you click."
-title = "What we count toward billing"
+aiBody = "riassumi, classifica, oscura dati, AI-OCR"
+aiTitle = "Strumenti IA"
+apiBody = "accesso via codice a qualsiasi endpoint di Stirling"
+apiTitle = "Chiamate API"
+automationBody = "strumenti concatenati o esecuzioni pianificate che non richiedono clic manuali"
+automationTitle = "Pipeline di automazione"
+footnote = "Gli strumenti manuali (visualizzazione, modifica, unione, divisione, inserimento di filigrane, compressione, OCR manuale) sono sempre gratuiti, anche oltre la soglia dei 500 PDF. La distinzione risiede nel tipo di operazione, non nel punto in cui si fa clic."
+title = "Cosa viene conteggiato ai fini della fatturazione"
 
 [payg.upgrade.promise]
-body = "You only pay for automation pipelines, AI tools, and API calls, the work that goes beyond a single click. Edit, merge, split, sign, compress as much as you want, no charge."
-highlight = "Manual tools stay free, always."
+body = "Paghi solo per le pipeline di automazione, gli strumenti IA e le chiamate API — ovvero le operazioni che vanno oltre un singolo clic. Modifica, unisci, dividi, firma e comprimi tutto quello che vuoi, senza alcun costo."
+highlight = "Gli strumenti manuali rimangono gratuiti, sempre."
 
 [payg.upgrade.steps]
-cap = "Set monthly ceiling"
-payment = "Add payment method"
+cap = "Imposta il tetto mensile"
+payment = "Aggiungi metodo di pagamento"
 
 [payg.upgrade.title]
-confirm = "You're subscribed"
-default = "Upgrade to Processor plan"
+confirm = "Abbonamento attivato"
+default = "Passa al piano Processor"
 
 [payg.usage]
-breakdown = "AI {{ai}} • Automation {{automation}} • API {{api}}"
-capLine = "{{cap}}/mo cap"
-estBill = "≈ {{amount}} so far this period"
-firstFree = "First {{free}} free"
-noCap = "No monthly cap"
-ofLimitProcessed = "/ {{limit}} PDFs processed"
-processed = "PDFs processed"
-resetsIn = "Resets in {{days}} days"
-resetsTomorrow = "Resets tomorrow"
-thisPeriod = "This billing period"
+breakdown = "IA {{ai}} • Automazione {{automation}} • API {{api}}"
+capLine = "Limite di {{cap}}/mese"
+estBill = "≈ {{amount}} finora in questo periodo"
+firstFree = "Primi {{free}} gratuiti"
+noCap = "Nessun limite mensile"
+ofLimitProcessed = "/ {{limit}} PDF elaborati"
+processed = "PDF elaborati"
+resetsIn = "Si azzera tra {{days}} giorni"
+resetsTomorrow = "Si azzera domani"
+thisPeriod = "Questo periodo di fatturazione"
 
 [payment]
 canCloseWindow = "Ora puoi chiudere questa finestra."
@@ -5596,7 +5594,7 @@ imageLabel = "Immagine posizionata"
 noTextOnPage = "Nessun testo modificabile rilevato in questa pagina."
 pagePreviewAlt = "Anteprima pagina"
 pageSummary = "Pagina {{number}} di {{total}}"
-tags = "edit text,modify text,change text,edit content,update text,rewrite,correct,amend,redline,revise,text editor,content editor"
+tags = "modifica testo,modifica testo,cambia testo,modifica contenuto,aggiorna testo,riscrivi,correggi,emenda,evidenzia,rivedi,editor di testo,editor di contenuti"
 title = "Editor JSON PDF"
 viewLabel = "Editor PDF"
 
@@ -5762,7 +5760,7 @@ tags = "pagina singola"
 [pdfToSinglePage]
 description = "Questo strumento unirà tutte le pagine del tuo PDF in un’unica grande pagina. La larghezza resterà la stessa delle pagine originali, ma l’altezza sarà la somma delle altezze di tutte le pagine."
 submit = "Converti in pagina singola"
-tags = "combine,merge,single,single page,one page,merge to single,combine all,stitch pages,concatenate vertical,long page,poster"
+tags = "combina,unisci,singolo,pagina singola,una pagina,unisci in un unico elemento,unisci tutto,unisci le pagine,concatena verticalmente,pagina lunga,posterr"
 title = "PDF a pagina singola"
 
 [pdfToSinglePage.error]
@@ -5871,10 +5869,10 @@ included = "Incluso"
 name = "Gratis"
 
 [plan.freeLimit]
-cta = "View Processor Plan"
-dismiss = "Maybe Later"
-message = "That's your whole free allowance for automation, AI and the API. Seriously impressive! Keep the momentum going for just pennies a day."
-title = "Woah, {{total}} PDFs Processed!"
+cta = "Visualizza il piano Processor"
+dismiss = "Forse più tardi"
+message = "Hai esaurito l'intera soglia gratuita per le automazioni, l'IA e le API. Davvero impressionante! Mantieni questo ritmo per pochi centesimi al giorno."
+title = "Wow, {{total}} PDF elaborati!"
 
 [plan.highlights]
 advancedIntegrations = "Integrazioni avanzate"
@@ -5908,10 +5906,10 @@ highlight3 = "Nessuna filigrana"
 name = "Pro"
 
 [plan.spendCap]
-cta = "View Spending Limit"
-dismiss = "Not Now"
-message = "You've made the most of this month's cap. That's a load of automation, AI and API work! Bump it up whenever you like to keep going."
-title = "You're on a Roll!"
+cta = "Visualizza il limite di spesa"
+dismiss = "Non ora"
+message = "Hai sfruttato al massimo il limite impostato per questo mese. Un carico di lavoro davvero notevole tra automazioni, IA e API! Aumentalo quando vuoi per continuare."
+title = "Sei inarrestabile!"
 
 [plan.static]
 activateLicense = "Attiva la tua licenza"
@@ -5938,8 +5936,8 @@ success = "Licenza attivata!"
 successMessage = "La licenza è stata attivata correttamente. Ora puoi chiudere questa finestra."
 
 [policies]
-deleteConfirmBody = "This removes the policy and its workflow. Documents already processed are not affected."
-deleteConfirmTitle = "Delete {{label}} policy?"
+deleteConfirmBody = "Questo rimuoverà la policy e il relativo flusso di lavoro. I documenti già elaborati non subiranno modifiche."
+deleteConfirmTitle = "Eliminare la policy {{label}}?"
 
 [policies.activity]
 enforced = "applicata"
@@ -5953,32 +5951,32 @@ step = "passo {{current}}/{{total}}"
 timedOut = "L'applicazione è andata in timeout prima che l'esecuzione potesse terminare."
 
 [policies.catalog]
-compliance = "Compliance"
-ingestion = "Ingestion"
-retention = "Retention"
-routing = "Routing"
-security = "Security"
+compliance = "Conformità"
+ingestion = "Acquisizione dati"
+retention = "Conservazione"
+routing = "Instradamento"
+security = "Sicurezza"
 
 [policies.detail]
 close = "Chiudi"
-editSettings = "Edit Settings"
-enforces = "Enforces"
-managedByOrg = "Managed by your organisation. Contact a team leader to change this policy."
-noActivityDescription = "Documents will appear here once this policy runs."
-noActivityTitle = "No activity yet"
-onEveryUpload = "On every upload"
-originalsNote = "Originals stay untouched • Enforced version saved alongside"
-pause = "Pause"
-recentActivity = "Recent Activity"
-resume = "Resume"
-retry = "Retry"
-showLess = "Show less"
-showMore = "Show more"
-statActive = "Active"
-statDataProcessed = "Data processed"
-statDocsEnforced = "Docs enforced"
-statusActive = "Active"
-statusPaused = "Paused"
+editSettings = "Modifica impostazioni"
+enforces = "Applica"
+managedByOrg = "Gestito dalla tua organizzazione. Contatta un responsabile del team per modificare questa policy."
+noActivityDescription = "I documenti appariranno qui non appena questa policy verrà eseguita."
+noActivityTitle = "Ancora nessuna attività"
+onEveryUpload = "Su ogni caricamento"
+originalsNote = "I file originali rimangono invariati • La versione con le regole applicate viene salvata a fianco"
+pause = "Metti in pausa"
+recentActivity = "Attività recente"
+resume = "Riprendi"
+retry = "Riprova"
+showLess = "Mostra meno"
+showMore = "Mostra di più"
+statActive = "Attive"
+statDataProcessed = "Dati elaborati"
+statDocsEnforced = "Doc. con policy applicate"
+statusActive = "Attiva"
+statusPaused = "In pausa"
 
 [policies.enforcement]
 applying = "Applicazione di {{names}}"
@@ -6016,7 +6014,7 @@ onViolation = "Quando non conforme"
 webhookUrl = "URL webhook"
 
 [policies.fields]
-selectedCount = "{{count}} selected"
+selectedCount = "{{count}} selezionati"
 
 [policies.labels]
 add = "Aggiungi"
@@ -6049,12 +6047,12 @@ view = "Visualizza etichette"
 account = "Numeri di conto (etichettati)"
 card = "Carte di credito/debito"
 email = "Indirizzi email"
-fieldLabel = "PII to redact"
+fieldLabel = "Dati sensibili (PII) da oscurare"
 iban = "IBAN"
 phone = "Numeri di telefono"
-placeholder = "Select PII types"
-routing = "Numeri di routing USA (ABA)"
-ssn = "Numeri di Social Security"
+pplaceholder = "Seleziona i tipi di PII"
+routing = "Numeri di instradamento USA (ABA)"
+ssn = "Numeri di previdenza sociale (SSN)"
 
 [policies.settings]
 noneExport = "Attualmente nessun criterio viene eseguito all'esportazione."
@@ -6066,29 +6064,29 @@ runOrderDesc = "Quando più criteri vengono eseguiti sullo stesso trigger, vengo
 title = "Impostazioni criteri"
 
 [policies.sidebar]
-activeCount = "{{count}} active"
-infoTooltip = "A policy is a fixed set of tools that runs automatically whenever it's triggered — for example when a new document arrives — enforcing rules like redacting PII with no manual steps."
-loading = "Loading…"
+activeCount = "{{count}} attive"
+infoTooltip = "Una policy è un insieme fisso di strumenti che viene eseguito automaticamente ogni volta che viene attivato (ad esempio, all'arrivo di un nuovo documento), applicando regole come l'oscuramento dei dati sensibili (PII) senza passaggi manuali."
+loading = "Caricamento in corso…"
 optionsAriaLabel = "Opzioni criterio"
 policySettings = "Impostazioni criteri"
-railAriaLabel = "{{label}} policy — {{status}}"
-railSuffixActive = " (Active)"
-railSuffixPaused = " (Paused)"
+railAriaLabel = "Policy {{label}} — {{status}}"
+railSuffixActive = " (Attiva)"
+railSuffixPaused = " (In pausa)"
 retryFailed = "Riprova criteri non riusciti ({{count}})"
 rowProgress = "{{completed}} di {{total}} file elaborati"
-setUp = "Set up"
-title = "Policies"
-upgradeToEnterprise = "Upgrade to enterprise"
+setUp = "Configura"
+title = "Policy"
+upgradeToEnterprise = "Passa alla versione Enterprise"
 whatIsPolicy = "Che cos'è un criterio?"
 
 [policies.status]
-active = "Active"
-paused = "Paused"
-setup = "Set up"
+active = "Attiva"
+paused = "In pausa"
+setup = "Configura"
 
 [policies.toolConfig]
-enableAriaLabel = "Enable {{tool}}"
-infoAriaLabel = "What does {{tool}} do?"
+enableAriaLabel = "Abilita {{tool}}"
+infoAriaLabel = "Cosa fa lo strumento {{tool}}?"
 
 [policies.toolConfig.info]
 redact = "Trova automaticamente e oscura i dettagli sensibili — come numeri di Social Security e di carta — in modo che non possano essere letti nel documento."
@@ -6096,49 +6094,49 @@ sanitize = "Rimuove il JavaScript nascosto dal file, così nulla può essere ese
 watermark = "Appone un contrassegno visibile (es. \"Confidential\") su ogni pagina."
 
 [policies.wizard]
-allDocTypesDescription = "Enable the Classification policy to filter by document type."
-allDocTypesTitle = "All document types"
-back = "Back"
-builderDesc = "Build the sequence of tools this policy runs on each document."
-clear = "Clear"
+allDocTypesDescription = "Abilita la policy di Classificazione per filtrare in base al tipo di documento."
+allDocTypesTitle = "Tutti i tipi di documento"
+back = "Indietro"
+builderDesc = "Costruisci la sequenza di strumenti che questa policy eseguirà su ciascun documento."
+clear = "Cancella"
 close = "Chiudi"
-continue = "Continue"
-docTypesLabel = "Document types"
-edit = "Edit"
-editTitle = "Edit {{label}} Policy"
-enablePolicy = "Enable Policy"
-filenameAutoNumber = "Auto-number"
-filenamePositionAria = "Filename position"
-filenamePrefix = "Prefix"
-filenameSuffix = "Suffix"
-filenameTextAria = "Filename text"
-filenameTextPlaceholder = "Text to add (optional)"
-lockedDescription = "Contact a team leader to change this policy."
-lockedTitle = "Managed by your organisation"
-maxRetriesLabel = "Max retries"
-noToolsError = "Add at least one configured tool to the workflow first."
-outputAsLabel = "Output as"
-outputFilenameSubhead = "Output filename"
-outputModeAria = "Output mode"
-outputNewFile = "New file"
-outputNewVersion = "New version"
-outputRetriesLabel = "Output & retries"
+continue = "Continua"
+docTypesLabel = "Tipi di documento"
+edit = "Modifica"
+editTitle = "Modifica policy {{label}}"
+enablePolicy = "Abilita policy"
+filenameAutoNumber = "Numerazione automatica"
+filenamePositionAria = "Posizione nome file"
+filenamePrefix = "Prefisso"
+filenameSuffix = "Suffisso"
+filenameTextAria = "Testo nome file"
+filenameTextPlaceholder = "Testo da aggiungere (opzionale)"
+lockedDescription = "Contatta un responsabile del team per modificare questa policy."
+lockedTitle = "Gestito dalla tua organizzazione"
+maxRetriesLabel = "Tentativi massimi"
+noToolsError = "Aggiungi prima almeno uno strumento configurato al flusso di lavoro."
+outputAsLabel = "Output come"
+outputFilenameSubhead = "Nome del file di output"
+outputModeAria = "Modalità di output"
+outputNewFile = "Nuovo file"
+outputNewVersion = "Nuova versione"
+outputRetriesLabel = "Output e tentativi"
 outputSubhead = "Output"
-retryDelayAria = "Retry delay minutes"
-retryDelayLabel = "Retry delay (min)"
-runOnExport = "Export"
-runOnLabel = "Run on"
-runOnSubhead = "Run on"
-runOnUpload = "Upload"
-saveChanges = "Save Changes"
-saveError = "Couldn't save the policy. Please try again."
-setupClassification = "Set up Classification"
-setupTitle = "Set up {{label}} Policy"
-sourcesDesc = "Choose where this policy runs and which document types it applies to."
-sourcesLabel = "Sources"
-stepOf = "Step {{step}} of {{total}}"
-toolChainDesc = "Configure the tools this policy runs on each document."
-typesSelected = "{{count}} types selected"
+retryDelayAria = "Minuti di ritardo tentativo"
+retryDelayLabel = "Ritardo tentativo (min)"
+runOnExport = "Esportazione"
+runOnLabel = "Esegui su"
+runOnSubhead = "Esegui su"
+runOnUpload = "Caricamento"
+saveChanges = "Salva modifiche"
+saveError = "Impossibile salvare la policy. Riprova."
+setupClassification = "Configura Classificazione"
+setupTitle = "Configura policy {{label}}"
+sourcesDesc = "Scegli dove eseguire questa policy e a quali tipi di documento applicarla."
+sourcesLabel = "Origini"
+stepOf = "Passaggio {{step}} di {{total}}"
+toolChainDesc = "Configura gli strumenti che questa policy eseguirà su ciascun documento."
+typesSelected = "{{count}} tipi selezionati"
 
 [policy]
 badgeEnforcing = "Applicazione di {{name}} in corso..."
@@ -6459,7 +6457,7 @@ eyebrow = "PDF elaborati in questo periodo"
 legendValue_one = "{{formatted}} PDF"
 legendValue_other = "{{formatted}} PDF"
 segbarAriaLabel = "PDF a consumo suddivisi per categoria"
-segmentAgentsDesc = "Azioni agenti AI"
+segmentAgentsDesc = "Azioni agenti IA"
 segmentAgentsLabel = "Agenti"
 segmentApiDesc = "Richieste API dirette"
 segmentApiLabel = "API"
@@ -6558,7 +6556,7 @@ lead = "Ogni tipo di documento è un endpoint tipizzato. Fai POST di un file, ri
 title = "Endpoint"
 
 [portal.docs.errors]
-codeCaption = "422 Unprocessable Entity"
+codeCaption = "422 Entità non elaborabile"
 eyebrow = "RIFERIMENTO API"
 lead = "Gli errori restituiscono un codice stabile leggibile dalla macchina più un messaggio umano. Il body 4xx include sempre un request_id per il supporto."
 title = "Errori"
@@ -8002,7 +8000,7 @@ summary = "Accesso limitato o solo web; non può avere configurazioni personali.
 3 = "Sola lettura dove condiviso"
 
 [portal.users.roles.member]
-label = "Member"
+label = "Membro"
 summary = "Utente regolare — lavora con risorse condivise e le proprie configurazioni."
 
 [portal.users.roles.member.permissions]
@@ -8012,14 +8010,14 @@ summary = "Utente regolare — lavora con risorse condivise e le proprie configu
 3 = "Nessuna gestione S3 o workspace"
 
 [portal.users.roles.team_owner]
-label = "Team owner"
+label = "Proprietario del Team"
 summary = "Possiede un team — gestisce le risorse dei membri e le configurazioni condivise."
 
 [portal.users.roles.team_owner.permissions]
 0 = "Creare e gestire le connessioni S3 del team"
 1 = "Gestire configurazioni di integrazione di proprietà del team"
 2 = "Accesso al portale tramite il criterio predefinito"
-3 = "Tutto ciò che può fare Member"
+3 = "Tutto ciò che può fare un membro"
 
 [portal.welcome]
 ariaLabel = "Benvenuto in Stirling PDF"
@@ -8243,7 +8241,7 @@ config = "Configurazione"
 files = "File"
 
 [read]
-tags = "view,open,display,read,viewer,PDF viewer,PDF reader,open PDF,view PDF,display PDF,preview,browse"
+tags = "visualizza,apri,mostra,leggi,visualizzatore,visualizzatore PDF,lettore PDF,apri PDF,visualizza PDF,mostra PDF,anteprima,sfoglia"
 
 [redact]
 submit = "Redazione"
@@ -8435,7 +8433,7 @@ title = "Risultati rimozione certificati"
 
 [removeImage]
 submit = "Rimuovi immagine"
-tags = "remove,delete,clean,remove image,delete image,strip images,remove pictures,delete photos,clean images,reduce size,remove graphics"
+tags = "rimuovere,cancellare,pulire,rimuovere immagine,cancellare immagine,rimuovere immagini,rimuovere foto,pulire immagini,ridurre le dimensioni,rimuovere grafica"
 title = "Rimuovere immagine"
 
 [removeImage.error]
@@ -8507,7 +8505,7 @@ description = "La rimozione della protezione con password richiede la password u
 
 [reorganizePages]
 submit = "Riorganizza pagine"
-tags = "rearrange,reorder,organize,reorganize,move pages,page order,sort pages,arrange pages,shuffle,resequence"
+tags = "riorganizzare,riordinare,organizzare,riorganizzare,spostare pagine,ordine delle pagine,ordinare pagine,disporre pagine,mescolare,riordinare"
 
 [reorganizePages.error]
 failed = "Impossibile riorganizzare le pagine"
@@ -8594,7 +8592,7 @@ rotateLeft = "Ruota in senso antiorario"
 rotateRight = "Ruota in senso orario"
 selectRotation = "Seleziona angolo di rotazione (in senso orario)"
 submit = "Ruota"
-tags = "turn,flip,orient,rotate,orientation,landscape,portrait,90 degrees,180 degrees,clockwise,anticlockwise,counter-clockwise,fix orientation"
+tags = "girare,capovolgere,orientare,ruotare,orientamento,orizzontale,verticale,90 gradi,180 gradi,orario,antiorario,controorario,orientamento fisso"
 title = "Ruota PDF"
 
 [rotate.error]
@@ -8617,7 +8615,7 @@ title = "Panoramica impostazioni Rotazione"
 desc = "Rimuovi elementi potenzialmente dannosi dai PDF."
 sanitizationResults = "Risultati sanitizzazione"
 submit = "Pulire PDF"
-tags = "clean,purge,remove,sanitize,sanitise,remove scripts,remove javascript,remove metadata,strip metadata,security,clean document,remove hidden data,privacy"
+tags = "pulire,spurgare,rimuovere,sanificare,sanificare,rimuovere script,rimuovere javascript,rimuovere metadati,scartare metadati,sicurezza,pulire documento,rimuovere dati nascosti,privacy"
 title = "Sanitizza"
 
 [sanitize.error]
@@ -8661,11 +8659,11 @@ tags = "pulire,proteggere,rimuovere le minacce"
 title = "Pulire PDF"
 
 [scalePages]
-tags = "resize,adjust,scale,page size,resize page,scale page,change size,adjust size,enlarge,shrink page,fit to page,A4,letter size"
+tags = "ridimensiona,regola,scala,dimensioni pagina,ridimensiona pagina,scala pagina,cambia dimensione,regola dimensione,ingrandisci,riduci pagina,adatta alla pagina,A4,formato lettera"
 title = "Regola la scala della pagina"
 
 [scannerEffect]
-tags = "scan,simulate,create,fake scan,look scanned,scanner effect,make look scanned,photocopy effect,simulate scanner,realistic scan"
+tags = "scansione,simulazione,creazione,scansione falsa,aspetto scansionato,effetto scanner,far sembrare scansionato,effetto fotocopia,simulazione scanner,scansione realistica"
 
 [ScannerImageSplit.selectText]
 1 = "Soglia angolo:"
@@ -8681,7 +8679,7 @@ tags = "scan,simulate,create,fake scan,look scanned,scanner effect,make look sca
 
 [scannerImageSplit]
 submit = "Estrai scansioni di immagini"
-tags = "separate,auto-detect,scans,multi-photo,organize"
+tags = "separare,rilevamento automatico,scansioni,multifoto,organizzare"
 title = "Immagini estratte"
 
 [scannerImageSplit.error]
@@ -8820,7 +8818,7 @@ theme = "Tema"
 themeDark = "Scuro"
 themeDescription = "Passa tra modalità chiara e scura"
 themeLight = "Chiaro"
-themeSystem = "System"
+themeSystem = "Sistema"
 title = "Generale"
 user = "Utente"
 
@@ -8907,16 +8905,16 @@ mac = "Includi ⌘ (Command), ⌥ (Option) o un altro modificatore nella scorcia
 windows = "Includi Ctrl, Alt o un altro modificatore nella scorciatoia."
 
 [settings.legal]
-label = "Legal"
-title = "Legal"
+label = "Note legali"
+title = "Informative legali"
 
 [settings.legal.cookiePreferences]
-description = "Review or change your cookie consent choices."
-manage = "Manage"
+description = "Rivedi o modifica le tue preferenze sul consenso dei cookie."
+manage = "Gestisci"
 
 [settings.legal.documents]
-description = "Policies and legal information for this service."
-title = "Legal Documents"
+description = "Informative e note legali per questo servizio."
+title = "Documenti legali"
 
 [settings.licenses]
 backendDescription = "Licenze per le dipendenze backend incluse con questo server."
@@ -8971,14 +8969,14 @@ trial = "Prova"
 
 [settings.planBilling.team]
 managedByTeam = "Gestito dal team"
-memberCount_one = "{{count}} team member"
-memberCount_other = "{{count}} team members"
-memberCount_zero = "no team members"
+memberCount_one = "{{count}} membro del team"
+memberCount_other = "{{count}} membri del team"
+memberCount_zero = "nessun membro del team"
 
 [settings.planBilling.tier]
 enterprise = "Enterprise"
 enterpriseDescription = "Funzionalità e supporto Enterprise personalizzati"
-free = "Free"
+free = "Gratuito"
 freeDescription = "50 crediti al mese"
 team = "Team"
 teamBadge = "Team"
@@ -9006,7 +9004,7 @@ subtitle = "Passa a Team per:"
 title = "Aggiorna il tuo piano"
 
 [settings.policiesPrivacy]
-legal = "Legale"
+legal = "Note legali"
 privacy = "Privacy"
 title = "Policy e privacy"
 
@@ -9165,7 +9163,7 @@ sharedSigningRequest = "Richiedi firme"
 sharedSigningStepDesc = "Invia questo documento ad altri perché lo firmino, invece di firmarlo tu."
 sharedSigs = "Firme condivise"
 submit = "Firma documento"
-tags = "signature,autograph,e-sign,electronic signature,digital signature,sign document,approval,signoff,authorize,endorse,ink signature,handwriting"
+tags = "firma,autografo,firma elettronica,firma digitale,firmare un documento,approvazione,firma,autorizzare,convalidare,firma a inchiostro,scrittura a mano"
 title = "Firma"
 undo = "Annulla"
 updateAndPlace = "Aggiorna e posiziona"
@@ -9340,8 +9338,8 @@ passwordsDoNotMatch = "Le password non corrispondono"
 passwordTooShort = "La password deve contenere almeno 6 caratteri"
 pleaseFillAllFields = "Compila tutti i campi"
 signUp = "Registrati"
-signUpWith = "Sign up with"
-skip = "Skip"
+signUpWith = "Registrati con"
+skip = "Salta"
 subtitle = "Unisciti a Stirling PDF per iniziare"
 title = "Crea un account"
 unexpectedError = "Errore imprevisto: {{message}}"
@@ -9357,7 +9355,7 @@ resultsTitle = "Risultati divisione"
 selectMethod = "Seleziona un metodo di divisione"
 splitPages = "Inserisci pagine a cui dividere:"
 submit = "Dividi"
-tags = "divide,separate,break,split,extract pages,separate pages,divide document,break apart,separate files,unbind,split by page,divide by chapter"
+tags = "dividere,separare,rompere,spaccare,estrarre pagine,separare pagine,dividere documento,separare,separare file,slegare,dividere per pagina,dividere per capitolo"
 title = "Dividi PDF"
 
 [split.error]
@@ -9654,7 +9652,7 @@ updateButton = "Aggiorna sul server"
 uploadButton = "Carica sul server"
 
 [survey]
-title = "Stirling-PDF Survey"
+title = "Sondaggio su Stirling-PDF"
 
 [swagger]
 tags = "api,documentazione,swagger,endpoint,sviluppo"
@@ -9678,9 +9676,9 @@ leaveButton = "Lascia il team"
 leaveError = "Impossibile lasciare il team"
 leaveSuccess = "Uscito dal team con successo"
 loading = "Caricamento delle informazioni del team..."
-memberCount_one = "{{count}} member"
-memberCount_other = "{{count}} members"
-memberCount_zero = "no members"
+memberCount_one = "{{count}} membro"
+memberCount_other = "{{count}} membri"
+memberCount_zero = "nessun membro"
 memberRemoved = "Membro rimosso con successo"
 namePlaceholder = "Inserisci il nome del team"
 personal = "Personale"
@@ -9730,7 +9728,7 @@ minutesAgo = "{{count}} min fa"
 desc = "Aggiungi una marca temporale RFC 3161 al tuo PDF utilizzando un server di un'Autorità di marcatura temporale (TSA) affidabile."
 results = "Risultati della marca temporale"
 submit = "Applica marca temporale"
-tags = "timestamp,RFC 3161,TSA,time stamp authority,document timestamp,proof of existence,timestamp token,trusted timestamp,sign timestamp,notarise"
+tags = "timestamp,RFC 3161,TSA,autorità di timestamp,timestamp del documento,prova di esistenza,token di timestamp,timestamp affidabile,timestamp della firma,notarizzazione"
 title = "Marca temporale PDF"
 
 [timestampPdf.error]
@@ -9980,8 +9978,8 @@ title = "Nessun membro ancora"
 
 [users.group]
 addToTeam = "Aggiungi al team"
-guestCount = "{{count}} guest"
-guests = "Guest"
+guestCount = "{{count}} ospiti"
+guests = "Ospite"
 guestsDesc = "Collaboratori esterni, limitati a ciò che hai condiviso. Solo Editor."
 ledBy = "guidato da {{owner}}"
 org = "Organizzazione"
@@ -10175,7 +10173,7 @@ validUntrusted = "Valida, firmatario non verificato"
 
 [viewer]
 cannotPreviewFile = "Impossibile visualizzare l'anteprima del file"
-copyText = "Copy"
+copyText = "Copia"
 disableColorFilter = "Disabilita filtro colore"
 dualPageView = "Vista doppia pagina"
 enableDarkFilter = "Abilita filtro scuro"
@@ -10234,8 +10232,8 @@ goToLink = "Vai al link"
 hint = "Inserisci commenti con gli strumenti Commento, Inserisci testo o Sostituisci testo. Appariranno qui per pagina."
 locateAnnotation = "Individua nel documento"
 moreActions = "Altre azioni"
-nComments_one = "{{count}} comment"
-nComments_other = "{{count}} comments"
+nComments_one = "{{count}} commento"
+nComments_other = "{{count}} commenti"
 pageLabel = "Pagina {{page}}"
 placingHint = "Fai clic su una pagina per posizionare… (annulla)"
 removeCommentOnly = "Rimuovi solo il commento"
@@ -10304,172 +10302,172 @@ title = "Visualizza/Modifica PDF"
 tooltipTitle = "Avviso"
 
 [watchedFolders]
-alreadyInFolder = "Already in this folder"
-defaultFolderWarning = "This is a default folder and will be recreated on next reload."
-deleteConfirmBody = "This will remove the folder and its run history. Files already downloaded are not affected."
-deleteConfirmTitle = "Delete folder?"
-folderNotFound = "Folder not found"
-newFolder = "New folder"
-noFolders = "No watched folders yet"
-sidebarTitle = "Watched Folders"
-title = "Watched Folders"
+alreadyInFolder = "Già presente in questa cartella"
+defaultFolderWarning = "Questa è una cartella predefinita e verrà ricreata al prossimo riavvio."
+deleteConfirmBody = "Questo rimuoverà la cartella e la cronologia delle esecuzioni. I file già scaricati non subiranno modifiche."
+deleteConfirmTitle = "Eliminare la cartella?"
+folderNotFound = "Cartella non trovata"
+newFolder = "Nuova cartella"
+noFolders = "Ancora nessuna cartella monitorata"
+sidebarTitle = "Cartelle monitorate"
+title = "Cartelle monitorate"
 
 [watchedFolders.actions]
-back = "Back"
-collapse = "Collapse"
-dismiss = "Dismiss"
-download = "Download"
-downloadInput = "Download input"
-downloadOutput = "Download output"
-expand = "Expand"
-retry = "Retry"
+back = "Indietro"
+collapse = "Comprimi"
+dismiss = "Chiudi"
+download = "Scarica"
+downloadInput = "Scarica input"
+downloadOutput = "Scarica output"
+expand = "Espandi"
+retry = "Riprova"
 
 [watchedFolders.card]
-delete = "Delete folder"
-edit = "Edit folder"
+delete = "Elimina cartella"
+edit = "Modifica cartella"
 
 [watchedFolders.home]
-addAnother = "Add another Watched Folder"
-addAnotherDesc = "Automatically process files with a new pipeline"
-create = "Create your first Watched Folder"
-deleteFolder = "Delete folder"
-editFolder = "Edit folder"
-empty = "No watched folders yet"
-emptyDesc = "Set up a Watched Folder once. Drop PDFs in and they're automatically compressed, OCR'd, split, merged — whatever your pipeline does."
-emptyTitle = "Automate your PDF workflows"
+addAnother = "Aggiungi un'altra cartella monitorata"
+addAnotherDesc = "Elabora automaticamente i file con una nuova pipeline"
+create = "Crea la tua prima cartella monitorata"
+deleteFolder = "Elimina cartella"
+editFolder = "Modifica cartella"
+empty = "Ancora nessuna cartella monitorata"
+emptyDesc = "Configura una cartella monitorata una sola volta. Trascina i tuoi PDF al suo interno e verranno automaticamente compressi, sottoposti a OCR, divisi o uniti — in base a ciò che prevede la tua pipeline."
+emptyTitle = "Automatizza i tuoi flussi di lavoro PDF"
 file = "file"
-files = "files"
-pause = "Pause"
-resume = "Resume"
+files = "file"
+pause = "Metti in pausa"
+resume = "Riprendi"
 
 [watchedFolders.howItWorks]
-step1Desc = "Drag PDFs onto any Watched Folder card — or send them from your file list"
-step1Title = "Drop files"
-step2Desc = "Your configured tools process each file automatically"
-step2Title = "Pipeline runs"
-step3Desc = "Download processed files from inside the folder"
-step3Title = "Output ready"
-title = "How Watched Folders work"
+step1Desc = "Trascina i PDF su qualsiasi scheda di cartella monitorata — oppure inviali dalla tua lista di file"
+step1Title = "Trascina i file"
+step2Desc = "I tuoi strumenti configurati elaborano automaticamente ciascun file"
+step2Title = "Esecuzione della pipeline"
+step3Desc = "Scarica i file elaborati direttamente dall'interno della cartella"
+step3Title = "Output pronto"
+title = "Come funzionano le cartelle monitorate"
 
 [watchedFolders.modal]
-advanced = "Advanced"
-automation = "Automation"
-automationNameFallback = "Watched Folder automation"
-automationRequired = "Add at least one configured step before saving."
-autoNumber = "Auto-number"
-autoNumberExample = "e.g. document.pdf → document (1).pdf"
-autoScanHelp = "New PDF files in this folder are processed automatically every 10 seconds."
-changeFolder = "Change"
-chooseFolder = "Choose"
-clearFolder = "Clear"
-color = "Accent color"
-createFolder = "Create Folder"
-createTitle = "New Watched Folder"
-editTitle = "Edit Watched Folder"
-inputFolder = "Input folder"
-inputFolderNotChosen = "No folder chosen — required for auto-scan"
-inputSource = "Input source"
-inputSourceBrowser = "Browser — drop files here"
-inputSourceLocal = "Local folder (auto-scan)"
-inputSourceLocalUnsupported = "Local folder (auto-scan) — Chrome/Edge only"
-localOutputFolder = "Local output folder"
-maxRetries = "Max retries"
-name = "Folder name"
-namePlaceholder = "My Watched Folder"
-nameRequired = "Folder name is required"
-nameTooLong = "Folder name must be 50 characters or less"
-outputFolderNotSet = "Not set — outputs stay in app"
-outputFolderUnsupported = "Not supported in this browser"
-outputModeNewDesc = "Output is saved as a new separate file"
-outputModeVersion = "Replace original?"
-outputModeVersionDesc = "Output becomes a new version of the input file rather than a separate file"
-outputName = "Output filename prefix"
-outputNamePrefix = "Filename prefix"
-outputNameSuffix = "Suffix"
-positionPrefix = "Prefix"
-positionSuffix = "Suffix"
-replaceOriginal = "Replace original file"
-retryDelay = "Delay (minutes)"
-saveChanges = "Save Changes"
-saveFailed = "Failed to save folder. Please try again."
-sectionFolder = "Folder"
-sectionSourceOutput = "Source & Output"
-sectionSteps = "Steps"
+advanced = "Avanzate"
+automation = "Automazione"
+automationNameFallback = "Automazione cartella monitorata"
+automationRequired = "Aggiungi almeno un passaggio configurato prima di salvare."
+autoNumber = "Numerazione automatica"
+autoNumberExample = "es. documento.pdf → documento (1).pdf"
+autoScanHelp = "I nuovi file PDF in questa cartella vengono elaborati automaticamente ogni 10 secondi."
+changeFolder = "Cambia"
+chooseFolder = "Scegli"
+clearFolder = "Rimuovi"
+color = "Colore accento"
+createFolder = "Crea cartella"
+createTitle = "Nuova cartella monitorata"
+editTitle = "Modifica cartella monitorata"
+inputFolder = "Cartella di input"
+inputFolderNotChosen = "Nessuna cartella scelta — richiesto per la scansione automatica"
+inputSource = "Origine dell'input"
+inputSourceBrowser = "Browser — trascina i file qui"
+inputSourceLocal = "Cartella locale (scansione automatica)"
+inputSourceLocalUnsupported = "Cartella locale (scansione automatica) — solo Chrome/Edge"
+localOutputFolder = "Cartella di output locale"
+maxRetries = "Tentativi massimi"
+name = "Nome cartella"
+namePlaceholder = "La mia cartella monitorata"
+nameRequired = "Il nome della cartella è obbligatorio"
+nameTooLong = "Il nome della cartella deve contenere al massimo 50 caratteri"
+outputFolderNotSet = "Non impostata — i file di output rimangono nell'app"
+outputFolderUnsupported = "Non supportato in questo browser"
+outputModeNewDesc = "L'output viene salvato come un nuovo file separato"
+outputModeVersion = "Sostituire l'originale?"
+outputModeVersionDesc = "L'output diventa una nuova versione del file di input invece di un file separato"
+outputName = "Prefisso del nome del file di output"
+outputNamePrefix = "Prefisso del nome del file"
+outputNameSuffix = "Suffisso"
+positionPrefix = "Prefisso"
+positionSuffix = "Suffisso"
+replaceOriginal = "Sostituisci il file originale"
+retryDelay = "Ritardo (minuti)"
+saveChanges = "Salva modifiche"
+saveFailed = "Impossibile salvare la cartella. Riprova."
+sectionFolder = "Cartella"
+sectionSourceOutput = "Origine e output"
+sectionSteps = "Passaggi"
 
 [watchedFolders.status]
-active = "Active"
-done = "Done"
-paused = "Paused"
-processing = "Processing"
+active = "Attiva"
+done = "Completato"
+paused = "In pausa"
+processing = "In elaborazione"
 
 [watchedFolders.time]
-daysAgo = "{{count}}d ago"
-hoursAgo = "{{count}}h ago"
-justNow = "just now"
-minutesAgo = "{{count}}m ago"
+daysAgo = "{{count}} g fa"
+hoursAgo = "{{count}} o fa"
+justNow = "proprio ora"
+minutesAgo = "{{count}} min fa"
 
 [watchedFolders.workbench]
-activity = "Activity"
-addFiles = "Add files"
-allTime = "All time"
-cancel = "Cancel"
-chartTooltipComplete = "{{count}} complete"
-chartTooltipFailed = "{{count}} failed"
-clearSelection = "Clear selection"
-countProcessing = "{{count}} processing"
-countQueued = "{{count}} queued"
-countSelected = "{{count}} selected"
-dataSaved = "Saved"
-dayRunning = "day running"
-daysRunning = "days running"
-delete = "Delete"
-deleteConfirmBody = "Remove notifications only clears the activity log. Delete outputs also removes the processed files from storage. Your original input files are never touched."
-deleteOutputs = "Delete outputs"
+activity = "Attività"
+addFiles = "Aggiungi file"
+allTime = "Dall'inizio"
+cancel = "Annulla"
+chartTooltipComplete = "{{count}} completati"
+chartTooltipFailed = "{{count}} non riusciti"
+clearSelection = "Cancella selezione"
+countProcessing = "{{count}} in elaborazione"
+countQueued = "{{count}} in coda"
+countSelected = "{{count}} selezionati"
+dataSaved = "Salvataggio completato"
+dayRunning = "giorno in funzione"
+daysRunning = "giorni in funzione"
+delete = "Elimina"
+deleteConfirmBody = "\"Rimuovi solo notifiche\" svuota solo il registro delle attività. \"Elimina output\" rimuove anche i file elaborati dallo spazio di archiviazione. I tuoi file di input originali non vengono mai toccati."
+deleteOutputs = "Elimina output"
 directionIn = "in"
 directionOut = "out"
-dropToProcess = "Drop to process"
-export = "Export"
-exportSeparately = "Export separately"
-exportZip = "Export zip"
-failed = "Failed"
-filesProcessedOverTime = "Files processed over time"
-filterAll = "All"
-filterPending = "Pending"
-inputs = "Inputs"
-inputSize = "Input size"
-legendComplete = "Complete"
-noActivity = "No activity yet — drop a PDF to start"
-noActivityMatch = "No matching activity"
-noInputFolder = "No input folder — edit to configure"
-outputs = "Outputs"
-pause = "Pause"
-preview = "Preview"
-previewInput = "Preview input"
-previewLoadFailed = "Could not load file preview."
-previewOutput = "Preview output"
-queued = "Queued"
-queuedWaiting = "Queued — waiting to run"
-removeEntries = "Remove {{count}} entries"
-removeEntry = "Remove entry"
-removeNotificationsOnly = "Remove notifications only"
-resume = "Resume"
-retryAll = "Retry all"
-retryIn = "retry in {{count}}m"
-retryingSoon = "retrying…"
-retryMixedConfirm = "Some selected files have already completed and will be skipped. Only failed files will be retried. Continue?"
-running = "Running"
-search = "Search…"
-selectAll = "Select all {{count}}"
+dropToProcess = "Trascina qui per elaborare"
+export = "Esporta"
+exportSeparately = "Esporta separatamente"
+exportZip = "Esporta come zip"
+failed = "Non riuscito"
+filesProcessedOverTime = "File elaborati nel tempo"
+filterAll = "Tutti"
+filterPending = "In attesa"
+inputs = "Input"
+inputSize = "Dimensione input"
+legendComplete = "Completati"
+noActivity = "Ancora nessuna attività — trascina un PDF per iniziare"
+noActivityMatch = "Nessuna attività corrispondente"
+noInputFolder = "Nessuna cartella di input — modifica per configurare"
+outputs = "Output"
+pause = "Metti in pausa"
+preview = "Anteprima"
+previewInput = "Anteprima input"
+previewLoadFailed = "Impossibile caricare l'anteprima del file."
+previewOutput = "Anteprima output"
+queued = "In coda"
+queuedWaiting = "In coda — in attesa di esecuzione"
+removeEntries = "Rimuovi {{count}} voci"
+removeEntry = "Rimuovi voce"
+removeNotificationsOnly = "Rimuovi solo notifiche"
+resume = "Riprendi"
+retryAll = "Riprova tutti"
+retryIn = "nuovo tentativo tra {{count}} min"
+retryingSoon = "nuovo tentativo in corso…"
+retryMixedConfirm = "Alcuni dei file selezionati sono già stati completati e verranno ignorati. Verrà effettuato un nuovo tentativo solo per i file non riusciti. Continuare?"
+running = "In esecuzione"
+search = "Cerca…"
+selectAll = "Seleziona tutti e {{count}}"
 sortNameAsc = "A → Z"
 sortNameDesc = "Z → A"
-sortNewest = "Newest"
-sortOldest = "Oldest"
-watching = "Watching: {{name}}"
+sortNewest = "Più recenti"
+sortOldest = "Più datati"
+watching = "Monitoraggio in corso: {{name}}"
 
 [watermark]
 desc = "Aggiungi filigrane di testo o immagine ai PDF"
 submit = "Aggiungi Filigrana"
-tags = "stamp,mark,overlay,watermark,branding,logo,confidential,draft,copyright,trademark,text overlay,image overlay,background text"
+tags = "timbro,marchio,sovrapposizione,filigrana,branding,logo,riservato,bozza,copyright,marchio commerciale,sovrapposizione di testo,sovrapposizione di immagine,testo di sfondo"
 title = "Aggiungi Filigrana"
 
 [watermark.error]
@@ -10789,11 +10787,11 @@ title = "Cambia password"
 editing = "Editing: <0>{{username}}</0>"
 error = "Impossibile aggiornare l'utente"
 role = "Ruolo"
-submit = "Update User"
+submit = "Aggiorna utente"
 success = "Utente aggiornato con successo"
 team = "Team (Opzionale)"
 teamPlaceholder = "Seleziona un team"
-title = "Edit User"
+title = "Modifica utente"
 
 [workspace.people.emailInvite]
 allFailed = "Impossibile invitare gli utenti"
@@ -10834,11 +10832,11 @@ currentUsage = "Attualmente in uso {{current}} su {{max}} licenze utente"
 fromLicense = "dalla licenza"
 grandfathered = "Ereditati"
 grandfatheredShort = "{{count}} ereditati"
-slotsAvailable_one = "{{count}} user slot available"
-slotsAvailable_other = "{{count}} user slots available"
-slotsAvailable_zero = "No slots available"
-users_one = "user"
-users_other = "users"
+slotsAvailable_one = "{{count}} slot utente disponibile"
+slotsAvailable_other = "{{count}} slot utente disponibili"
+slotsAvailable_zero = "Nessuno slot disponibile"
+users_one = "utente"
+users_other = "utenti"
 
 [workspace.people.mfa]
 adminDisableError = "Impossibile disabilitare la MFA per l'utente"
@@ -10848,7 +10846,7 @@ disableByAdmin = "Disabilita MFA"
 [workspace.people.roleDescriptions]
 admin = "Può gestire impostazioni e invitare membri, con pieno accesso amministrativo."
 currentRole = "Ruolo attualmente assegnato."
-user = "Can view and edit shared files, but cannot manage workspace settings or users."
+user = "Può visualizzare e modificare i file condivisi, ma non può gestire le impostazioni dello spazio di lavoro o gli utenti."
 
 [workspace.people.toggleEnabled]
 error = "Impossibile aggiornare lo stato utente"
@@ -10868,9 +10866,9 @@ description = "Gestisci i team e organizza i membri dello spazio di lavoro"
 loadError = "Impossibile caricare i dettagli del team"
 loading = "Caricamento dei team..."
 loadingDetails = "Caricamento dei dettagli del team..."
-memberCount_one = "{{count}} member"
-memberCount_other = "{{count}} members"
-memberCount_zero = "no members"
+memberCount_one = "{{count}} membro"
+memberCount_other = "{{count}} membri"
+memberCount_zero = "nessun membro"
 noMembers = "Nessun membro in questo team"
 noTeamsFound = "Nessun team trovato"
 removeMember = "Rimuovi dal team"
@@ -10935,6 +10933,6 @@ title = "Rinomina team"
 [zipWarning]
 cancel = "Annulla"
 confirm = "Estrai"
-message_one = "This ZIP contains {{count}} file. Extract anyway?"
-message_other = "This ZIP contains {{count}} files. Extract anyway?"
+message_one = "Questo file ZIP contiene {{count}} file. Estrarre comunque?"
+message_other = "Questo file ZIP contiene {{count}} files. Estrarre comunque?"
 title = "File ZIP di grandi dimensioni"

From 15423c64790f9462365ba0acfae785f1894052c1 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Jul 2026 09:24:23 +0100
Subject: [PATCH 068/109] build(deps): bump com.diffplug.spotless from 8.5.0 to
 8.8.0 (#7089)

Bumps com.diffplug.spotless from 8.5.0 to 8.8.0.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=com.diffplug.spotless&package-manager=gradle&previous-version=8.5.0&new-version=8.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.gradle b/build.gradle
index 4da9bb1055..e4d6a16f8f 100644
--- a/build.gradle
+++ b/build.gradle
@@ -5,7 +5,7 @@ plugins {
     id "org.springframework.boot" version "4.0.6"
     id "org.springdoc.openapi-gradle-plugin" version "1.9.0"
     id "io.swagger.swaggerhub" version "1.3.2"
-    id "com.diffplug.spotless" version "8.5.0"
+    id "com.diffplug.spotless" version "8.8.0"
     id "com.github.jk1.dependency-license-report" version "3.1.2"
     //id "nebula.lint" version "19.0.3"
     id "org.sonarqube" version "7.2.3.7755"

From 401894a0652c4312142f372336b9e5a54ea1c2cf Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Tue, 21 Jul 2026 10:24:31 +0200
Subject: [PATCH 069/109] build(deps): bump gradle/actions/setup-gradle from
 6.1.0 to 6.2.0 (#7116)

# Description of Changes

Replies PR: #7113, which ensures that the build tests are executed
correctly.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .github/workflows/PR-Demo-Comment-with-react.yml       | 2 +-
 .github/workflows/backend-build.yml                    | 2 +-
 .github/workflows/check-generated-models.yml           | 2 +-
 .github/workflows/check-licence.yml                    | 2 +-
 .github/workflows/check-openapi.yml                    | 2 +-
 .github/workflows/coverage-aggregate.yml               | 2 +-
 .github/workflows/db-migration-test.yml                | 2 +-
 .github/workflows/docker-compose-tests.yml             | 2 +-
 .github/workflows/frontend-backend-licenses-update.yml | 2 +-
 .github/workflows/multiOSReleases.yml                  | 6 +++---
 .github/workflows/push-docker.yml                      | 2 +-
 .github/workflows/swagger.yml                          | 2 +-
 .github/workflows/tauri-build.yml                      | 2 +-
 .github/workflows/test-build-docker.yml                | 2 +-
 .github/workflows/testdriver.yml                       | 2 +-
 15 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/PR-Demo-Comment-with-react.yml b/.github/workflows/PR-Demo-Comment-with-react.yml
index 4978586966..bde9061ab7 100644
--- a/.github/workflows/PR-Demo-Comment-with-react.yml
+++ b/.github/workflows/PR-Demo-Comment-with-react.yml
@@ -220,7 +220,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
 
diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml
index ccb85769af..b06e94be38 100644
--- a/.github/workflows/backend-build.yml
+++ b/.github/workflows/backend-build.yml
@@ -56,7 +56,7 @@ jobs:
           key: gradle-deps-${{ runner.os }}-jdk-${{ matrix.jdk-version }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
           cache-disabled: true
diff --git a/.github/workflows/check-generated-models.yml b/.github/workflows/check-generated-models.yml
index f6e63f0006..0d8f784b4a 100644
--- a/.github/workflows/check-generated-models.yml
+++ b/.github/workflows/check-generated-models.yml
@@ -45,7 +45,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.0
 
diff --git a/.github/workflows/check-licence.yml b/.github/workflows/check-licence.yml
index 40b2b15478..027632b50b 100644
--- a/.github/workflows/check-licence.yml
+++ b/.github/workflows/check-licence.yml
@@ -38,7 +38,7 @@ jobs:
           key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
           cache-disabled: true
diff --git a/.github/workflows/check-openapi.yml b/.github/workflows/check-openapi.yml
index 26eac3183c..c823a3d5d1 100644
--- a/.github/workflows/check-openapi.yml
+++ b/.github/workflows/check-openapi.yml
@@ -43,7 +43,7 @@ jobs:
           key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
           cache-disabled: true
diff --git a/.github/workflows/coverage-aggregate.yml b/.github/workflows/coverage-aggregate.yml
index d967b1536d..b4d47fdc3e 100644
--- a/.github/workflows/coverage-aggregate.yml
+++ b/.github/workflows/coverage-aggregate.yml
@@ -60,7 +60,7 @@ jobs:
           key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
           cache-disabled: true
diff --git a/.github/workflows/db-migration-test.yml b/.github/workflows/db-migration-test.yml
index 103efa4d6a..dfbde51e30 100644
--- a/.github/workflows/db-migration-test.yml
+++ b/.github/workflows/db-migration-test.yml
@@ -46,7 +46,7 @@ jobs:
           key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
           cache-disabled: true
diff --git a/.github/workflows/docker-compose-tests.yml b/.github/workflows/docker-compose-tests.yml
index ab9b7e99a0..92faaeefee 100644
--- a/.github/workflows/docker-compose-tests.yml
+++ b/.github/workflows/docker-compose-tests.yml
@@ -59,7 +59,7 @@ jobs:
           key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
           cache-disabled: true
diff --git a/.github/workflows/frontend-backend-licenses-update.yml b/.github/workflows/frontend-backend-licenses-update.yml
index 16db63afdb..4f7212495f 100644
--- a/.github/workflows/frontend-backend-licenses-update.yml
+++ b/.github/workflows/frontend-backend-licenses-update.yml
@@ -357,7 +357,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
 
diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml
index a97117f74e..69121e1a00 100644
--- a/.github/workflows/multiOSReleases.yml
+++ b/.github/workflows/multiOSReleases.yml
@@ -71,7 +71,7 @@ jobs:
             gradle-${{ runner.os }}-
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
 
@@ -146,7 +146,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
 
@@ -250,7 +250,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
 
diff --git a/.github/workflows/push-docker.yml b/.github/workflows/push-docker.yml
index 03aeeb6b68..a613cfdebc 100644
--- a/.github/workflows/push-docker.yml
+++ b/.github/workflows/push-docker.yml
@@ -76,7 +76,7 @@ jobs:
             gradle-${{ runner.os }}-
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
 
diff --git a/.github/workflows/swagger.yml b/.github/workflows/swagger.yml
index 0f986a3d52..a546996302 100644
--- a/.github/workflows/swagger.yml
+++ b/.github/workflows/swagger.yml
@@ -46,7 +46,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
 
diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml
index 6a15c1663f..62cd0667e6 100644
--- a/.github/workflows/tauri-build.yml
+++ b/.github/workflows/tauri-build.yml
@@ -168,7 +168,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
 
diff --git a/.github/workflows/test-build-docker.yml b/.github/workflows/test-build-docker.yml
index 44cbe36798..0c86efd391 100644
--- a/.github/workflows/test-build-docker.yml
+++ b/.github/workflows/test-build-docker.yml
@@ -109,7 +109,7 @@ jobs:
           key: gradle-deps-${{ runner.os }}-jdk-25-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties', '**/*.gradle', '**/*.gradle.kts', 'settings.gradle', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
           cache-disabled: true
diff --git a/.github/workflows/testdriver.yml b/.github/workflows/testdriver.yml
index aae3ca27d3..fdeb964a8c 100644
--- a/.github/workflows/testdriver.yml
+++ b/.github/workflows/testdriver.yml
@@ -49,7 +49,7 @@ jobs:
           distribution: "temurin"
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           gradle-version: 9.6.1
 

From f60a75c253b0fc5a51e87dba5c871932843b7e15 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Tue, 21 Jul 2026 10:32:56 +0100
Subject: [PATCH 070/109] chore(saas): remove unused Flyway migration system
 (#7100)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What this PR does

Removes the **Flyway** migration system from the SaaS build:

- drops `flyway-core` + `flyway-database-postgresql` from
`app/saas/build.gradle`
- deletes all `Vxx__*.sql` files under
`app/saas/src/main/resources/db/migration/`
- removes the `spring.flyway.*` config from
`application-saas.properties`
- clears the now-inert `SPRING_FLYWAY_ENABLED` override and stale Flyway
comments in `testing/compose/docker-compose-saas.yml`

`ddl-auto` is **left on `update`** (unchanged) — that's a separate
decision (see "Not in this PR").

## Why — Flyway never actually ran anywhere

From a full schema-management review
(`notes/FLYWAY_MIGRATION_REVIEW.md`), verified against the live
databases:

- **Prod & dev (v3):** no `flyway_schema_history` table exists in any
schema → Flyway has never executed. Schema is authored by the Supabase
migrations in `Stirling-PDF-SaaS` and applied by that repo's **GitHub
integration** (merge to `main` → prod).
- **Tests:** the saas module has zero `@SpringBootTest`; the only
real-DB integration tests (in `proprietary`) use `ddl-auto=create-drop`
and don't have Flyway on the classpath.
- **The mock-DB harness** (`testing/compose/docker-compose-saas.yml`,
PAYG cucumber) *explicitly disabled* Flyway, because the `Vxx`
migrations can't run against a clean Postgres — they assume Supabase has
already provisioned `users`/`teams` (`V2` ALTERs `users`, `V5`
references `teams`).

So Flyway was dead weight, and its 4 duplicate versions
(`V25/V26/V30/V31`) were a latent trap: re-enabling it would crash boot
on the collision. Everything it contained (schema + seeds like the
default pricing policy) is already mirrored by the Supabase migrations,
and by `saas-seed.sql` for the cucumber stack.

## ⚠️ Required follow-up (item #1) — capture the Flyway-only tables into
Supabase migrations

**This is documentation of the next step, not done in this PR.**

Seven tables were defined in Flyway with **no matching Supabase
migration**. They exist in prod today only because `ddl-auto=update`
created them from their entities. Before `ddl-auto` is ever tightened to
`validate` (see #3 below), and so any fresh Supabase branch is complete,
they must be added as Supabase migrations in
`Stirling-PDF-SaaS/supabase/migrations/`.

**Capture (CREATE) — 6 live tables** (definitions are visible in the
deleted files in this PR's diff):

| Table | Source (deleted here) | Backing entity |
|---|---|---|
| `resource_grants` | `V25__resource_grants.sql` | `ResourceGrant` |
| `integration_configs` | `V26__integration_configs.sql` |
`IntegrationConfig` |
| `policy_sources` | `V22__policy_engine_tables.sql` | `SourceEntity` |
| `policy_source_doc_counts` | `V23__policy_source_doc_counts.sql` |
`SourceDocCountEntity` |
| `policy_source_doc_totals` | `V23__policy_source_doc_counts.sql` |
`SourceDocTotalEntity` |
| `saas_user_extensions` | `V9__saas_user_team_extensions.sql` |
`SaasUserExtensions` |

Write them as `CREATE TABLE IF NOT EXISTS stirling_pdf.<name> (...)`
(idempotent — no-op against the existing prod/v3 tables). Preserve
column types/defaults/constraints from the deleted `Vxx` files.

**Drop (do NOT recreate) — 1 orphaned table:**

- `classification_labels` — created by `V30` and dropped by `V39` within
Flyway; its `ClassificationLabel` is now a plain `record`, not a JPA
entity. It lingers in prod only because Flyway's `V39` drop never ran.
The follow-up should emit a `DROP TABLE IF EXISTS
stirling_pdf.classification_labels` (mirroring `V39`'s intent), after
confirming nothing reads it.

## Not in this PR (deliberately)

- **#3 — flip saas `ddl-auto` `update` → `validate`.** Held pending team
confirmation; it has boot-risk and should be gated by a CI
"validate-boot against a fresh Supabase branch" first. Self-hosted stays
on `update` regardless.
- **#4 — `billing_subscriptions` split-brain** (prod `public` has 23,164
rows, `stirling_pdf` has 0, Java reads the empty one). Tracked
separately.

## Verification

- `:saas:compileJava` succeeds with Flyway removed (no code imports
`org.flywaydb.*`).
- No test or ArchUnit rule references Flyway or the migration files.
- No runtime/data impact: Flyway never ran against any live database.

---------

Co-authored-by: James Brunton <jbrunton96@gmail.com>
---
 app/saas/build.gradle                         |   3 -
 .../resources/application-saas.properties     |   8 +-
 .../migration/saas/V11__saas_payg_model.sql   | 226 ------------------
 .../saas/V12__seed_default_payg_policy.sql    |  37 ---
 .../saas/V13__payg_shadow_charge_status.sql   |  20 --
 .../saas/V14__payg_subscription_state.sql     | 189 ---------------
 .../migration/saas/V15__payg_audit_logs.sql   |  76 ------
 .../saas/V16__payg_billing_category.sql       |  58 -----
 .../V17__merge_supabase_id_into_auth_id.sql   |  34 ---
 .../saas/V19__payg_lifetime_free_grant.sql    |  93 -------
 .../saas/V20__payg_launch_free_grant.sql      |  42 ----
 ...V21__drop_wallet_category_summary_view.sql |  11 -
 .../saas/V22__policy_engine_tables.sql        |  35 ---
 .../saas/V23__policy_source_doc_counts.sql    |  26 --
 .../saas/V24__account_link_instances.sql      |  44 ----
 .../saas/V25__payg_instance_usage.sql         |  35 ---
 .../migration/saas/V25__resource_grants.sql   |  21 --
 .../saas/V26__integration_configs.sql         |  25 --
 ...g_shadow_charge_linked_instance_source.sql |  19 --
 .../db/migration/saas/V27__procurement.sql    |  72 ------
 .../saas/V28__procurement_stripe_quote.sql    |   8 -
 .../saas/V29__procurement_business_name.sql   |   5 -
 .../db/migration/saas/V2__saas_columns.sql    |   7 -
 .../saas/V30__classification_labels.sql       |  13 -
 .../saas/V30__procurement_offline_license.sql |   6 -
 .../migration/saas/V31__policy_sort_order.sql |   5 -
 .../saas/V31__procurement_intensity.sql       |   6 -
 .../saas/V32__policy_processed_files.sql      |  36 ---
 .../saas/V33__procurement_invoice_pdf.sql     |   7 -
 .../saas/V34__procurement_deal_setup.sql      |  10 -
 .../saas/V35__procurement_renewal.sql         |   7 -
 .../saas/V36__procurement_size_mult.sql       |   7 -
 ...V37__procurement_quote_billing_details.sql |  17 --
 .../saas/V38__payg_run_grouping_doc_count.sql |  39 ---
 .../saas/V39__drop_classification_labels.sql  |  10 -
 .../db/migration/saas/V3__saas_billing.sql    |  16 --
 .../db/migration/saas/V4__saas_credits.sql    |  39 ---
 .../db/migration/saas/V5__saas_teams.sql      |  40 ----
 .../saas/V6__saas_user_error_tracker.sql      |  15 --
 .../saas/V8__saas_ai_create_sessions.sql      |  28 ---
 .../saas/V9__saas_user_team_extensions.sql    |  77 ------
 testing/compose/docker-compose-saas.yml       |  20 +-
 42 files changed, 12 insertions(+), 1480 deletions(-)
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V11__saas_payg_model.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V12__seed_default_payg_policy.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V13__payg_shadow_charge_status.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V14__payg_subscription_state.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V15__payg_audit_logs.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V16__payg_billing_category.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V17__merge_supabase_id_into_auth_id.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V19__payg_lifetime_free_grant.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V20__payg_launch_free_grant.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V21__drop_wallet_category_summary_view.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V22__policy_engine_tables.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V23__policy_source_doc_counts.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V24__account_link_instances.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V25__payg_instance_usage.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V25__resource_grants.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V26__integration_configs.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V26__payg_shadow_charge_linked_instance_source.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V27__procurement.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V28__procurement_stripe_quote.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V29__procurement_business_name.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V2__saas_columns.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V30__classification_labels.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V30__procurement_offline_license.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V31__policy_sort_order.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V31__procurement_intensity.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V32__policy_processed_files.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V33__procurement_invoice_pdf.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V34__procurement_deal_setup.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V35__procurement_renewal.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V36__procurement_size_mult.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V37__procurement_quote_billing_details.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V38__payg_run_grouping_doc_count.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V39__drop_classification_labels.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V3__saas_billing.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V4__saas_credits.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V5__saas_teams.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V6__saas_user_error_tracker.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V8__saas_ai_create_sessions.sql
 delete mode 100644 app/saas/src/main/resources/db/migration/saas/V9__saas_user_team_extensions.sql

diff --git a/app/saas/build.gradle b/app/saas/build.gradle
index 38a16f7de8..495f583a74 100644
--- a/app/saas/build.gradle
+++ b/app/saas/build.gradle
@@ -12,8 +12,5 @@ dependencies {
     api 'org.springframework.boot:spring-boot-starter-webmvc'
     api 'org.springframework.boot:spring-boot-starter-aspectj'
 
-    api 'org.flywaydb:flyway-core'
-    runtimeOnly 'org.flywaydb:flyway-database-postgresql'
-
     testImplementation "com.tngtech.archunit:archunit-junit5:${archunitVersion}"
 }
diff --git a/app/saas/src/main/resources/application-saas.properties b/app/saas/src/main/resources/application-saas.properties
index a6b594dd96..8275970929 100644
--- a/app/saas/src/main/resources/application-saas.properties
+++ b/app/saas/src/main/resources/application-saas.properties
@@ -14,15 +14,13 @@ spring.datasource.username=${SAAS_DB_USERNAME:postgres}
 spring.datasource.password=${SAAS_DB_PASSWORD:}
 
 # ---------- DB schema / migrations ----------
+# Schema is authored by the Supabase migrations in the Stirling-PDF-SaaS repo and applied to
+# Supabase by its GitHub integration (merge to main -> prod). The Java side only pins the target
+# schema and lets Hibernate reconcile the entity tables on boot.
 spring.jpa.properties.hibernate.default_schema=stirling_pdf
 spring.jpa.properties.hibernate.hbm2ddl.create_namespaces=true
 
 spring.jpa.hibernate.ddl-auto=update
-spring.flyway.enabled=true
-spring.flyway.baseline-on-migrate=true
-spring.flyway.locations=classpath:db/migration,classpath:db/migration/saas
-spring.flyway.schemas=stirling_pdf
-spring.flyway.default-schema=stirling_pdf
 
 # ---------- Supabase JWT auth ----------
 # Required: set SAAS_DB_PROJECT_REF via env.
diff --git a/app/saas/src/main/resources/db/migration/saas/V11__saas_payg_model.sql b/app/saas/src/main/resources/db/migration/saas/V11__saas_payg_model.sql
deleted file mode 100644
index b7450984b2..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V11__saas_payg_model.sql
+++ /dev/null
@@ -1,226 +0,0 @@
--- PAYG data model: pricing policy, processing jobs + lineage, wallet ledger, wallet policy,
--- entitlement snapshots, shadow-mode comparison rows, plus a payg_team_extensions sidecar table
--- carrying team-level PAYG fields, and a cap_units column on team_memberships.
---
--- Sidecar pattern (mirrors saas_team_extensions): PAYG-only team fields don't sit directly on
--- `teams`, so OSS deployments running Hibernate ddl-auto=update against the proprietary Team
--- entity never see PAYG columns they don't have entities for.
---
--- Everything is purely additive. No existing rows are modified, no columns are dropped.
-
--- ---------------------------------------------------------------------------------------------
--- 1. pricing_policy — versioned economic config (units, lifecycle metadata).
---    step_limits and stripe_price_ids live on normalised child tables below — typed columns, no
---    JSON parsing, queryable directly.
--- ---------------------------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS pricing_policy (
-    policy_id            BIGSERIAL    PRIMARY KEY,
-    version              VARCHAR(32)  NOT NULL UNIQUE,
-    effective_from       TIMESTAMP    NOT NULL,
-    effective_to         TIMESTAMP,
-    doc_pages_per_unit   INTEGER      NOT NULL,
-    doc_bytes_per_unit   BIGINT       NOT NULL,
-    min_charge_units     INTEGER      NOT NULL DEFAULT 1,
-    file_unit_cap        INTEGER      NOT NULL DEFAULT 1000,
-    is_default           BOOLEAN      NOT NULL DEFAULT FALSE,
-    notes                TEXT,
-    created_by           VARCHAR(255),
-    created_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS uq_pricing_policy_default
-    ON pricing_policy (is_default) WHERE is_default = TRUE;
-
--- Max steps allowed per process for each caller surface (JobSource).
-CREATE TABLE IF NOT EXISTS pricing_policy_step_limit (
-    policy_id    BIGINT       NOT NULL REFERENCES pricing_policy(policy_id) ON DELETE CASCADE,
-    job_source   VARCHAR(32)  NOT NULL,
-    step_limit   INTEGER      NOT NULL,
-    PRIMARY KEY (policy_id, job_source)
-);
-
--- Stripe Price IDs this policy resolves to, one per supported currency. Currency itself isn't
--- stored here — it lives on stripe.prices.currency and is looked up via Sync Engine when picking
--- the right Price for a customer's subscription. All prices in one policy must share the same
--- Billing Meter and the same first-tier upper bound in units (deploy-time CI check).
-CREATE TABLE IF NOT EXISTS pricing_policy_stripe_price (
-    policy_id          BIGINT       NOT NULL REFERENCES pricing_policy(policy_id) ON DELETE CASCADE,
-    stripe_price_id    VARCHAR(128) NOT NULL,
-    PRIMARY KEY (policy_id, stripe_price_id)
-);
-
--- ---------------------------------------------------------------------------------------------
--- 2. payg_team_extensions — sidecar carrying PAYG-only team fields. 1:1 with teams via shared PK.
--- ---------------------------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS payg_team_extensions (
-    team_id              BIGINT       PRIMARY KEY REFERENCES teams(team_id) ON DELETE CASCADE,
-    pricing_policy_id    BIGINT       REFERENCES pricing_policy(policy_id),
-    stripe_customer_id   VARCHAR(128) UNIQUE,
-    created_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    version              BIGINT       NOT NULL DEFAULT 0
-);
-
-COMMENT ON COLUMN payg_team_extensions.pricing_policy_id IS
-    'Override policy for this team. NULL means use the row in pricing_policy with is_default=TRUE.';
-COMMENT ON COLUMN payg_team_extensions.stripe_customer_id IS
-    'Stripe customer id for this team. Eager-created so every team has billing identity on file.';
-
--- ---------------------------------------------------------------------------------------------
--- 3. team_memberships column addition: optional per-member sub-cap. Lives directly on the table
--- because team_memberships is already a SaaS-only table.
--- ---------------------------------------------------------------------------------------------
-ALTER TABLE team_memberships
-    ADD COLUMN IF NOT EXISTS cap_units BIGINT;
-COMMENT ON COLUMN team_memberships.cap_units IS
-    'Per-period spend cap for this member inside their team wallet, in doc units. NULL = no member-level cap.';
-
--- ---------------------------------------------------------------------------------------------
--- 4. processing_job — one billable process; step_count and last_step_at track the workflow window.
--- ---------------------------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS processing_job (
-    job_id                 UUID         PRIMARY KEY,
-    owner_user_id          BIGINT       NOT NULL,
-    owner_team_id          BIGINT,
-    process_type           VARCHAR(32)  NOT NULL,
-    source                 VARCHAR(32)  NOT NULL,
-    document_fingerprint   VARCHAR(64),
-    doc_units              INTEGER      NOT NULL DEFAULT 0,
-    step_count             INTEGER      NOT NULL DEFAULT 0,
-    started_at             TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    last_step_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    closed_at              TIMESTAMP,
-    policy_id              BIGINT       NOT NULL REFERENCES pricing_policy(policy_id),
-    charged_units          INTEGER,
-    charged_cents          INTEGER,
-    status                 VARCHAR(32)  NOT NULL,
-    idempotency_key        VARCHAR(128) UNIQUE,
-    metadata               JSONB
-);
-
-CREATE INDEX IF NOT EXISTS idx_processing_job_owner_open
-    ON processing_job (owner_user_id, status) WHERE status = 'OPEN';
-
-CREATE INDEX IF NOT EXISTS idx_processing_job_last_step
-    ON processing_job (status, last_step_at) WHERE status = 'OPEN';
-
--- ---------------------------------------------------------------------------------------------
--- 5. processing_job_step — per-tool-call audit within a job.
--- ---------------------------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS processing_job_step (
-    step_id         BIGSERIAL    PRIMARY KEY,
-    job_id          UUID         NOT NULL REFERENCES processing_job(job_id) ON DELETE CASCADE,
-    tool_id         VARCHAR(128) NOT NULL,
-    status          VARCHAR(32)  NOT NULL,
-    started_at      TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    completed_at    TIMESTAMP,
-    input_pages     INTEGER,
-    input_bytes     BIGINT,
-    error_code      VARCHAR(64)
-);
-
-CREATE INDEX IF NOT EXISTS idx_processing_job_step_job
-    ON processing_job_step (job_id);
-
--- ---------------------------------------------------------------------------------------------
--- 6. job_artifact_hash — per-step input/output content hashes used by the lineage detector.
--- ---------------------------------------------------------------------------------------------
--- content_hash holds "type:value" signature keys; VARCHAR(128) fits SHA-256 and future schemes.
-CREATE TABLE IF NOT EXISTS job_artifact_hash (
-    job_id        UUID          NOT NULL REFERENCES processing_job(job_id) ON DELETE CASCADE,
-    content_hash  VARCHAR(128)  NOT NULL,
-    kind          VARCHAR(8)    NOT NULL,
-    created_at    TIMESTAMP     NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    PRIMARY KEY (job_id, content_hash, kind)
-);
-
-CREATE INDEX IF NOT EXISTS idx_artifact_hash_lookup
-    ON job_artifact_hash (content_hash, created_at);
-
--- ---------------------------------------------------------------------------------------------
--- 7. wallet_ledger — append-only signed-amount ledger keyed on team_id.
--- amount_units is INTEGER (per-row delta, always small); cap and rollup columns are BIGINT
--- because they accumulate across a billing period.
--- ---------------------------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS wallet_ledger (
-    entry_id           BIGSERIAL    PRIMARY KEY,
-    team_id            BIGINT       NOT NULL REFERENCES teams(team_id) ON DELETE CASCADE,
-    actor_user_id      BIGINT,
-    entry_type         VARCHAR(32)  NOT NULL,
-    bucket             VARCHAR(16)  NOT NULL,
-    amount_units       INTEGER      NOT NULL,
-    reference_type     VARCHAR(32)  NOT NULL,
-    reference_id       VARCHAR(128) NOT NULL,
-    policy_id          BIGINT,
-    stripe_event_id    VARCHAR(128),
-    occurred_at        TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    metadata           JSONB
-);
-
-CREATE INDEX IF NOT EXISTS idx_wallet_ledger_team
-    ON wallet_ledger (team_id, occurred_at);
-
-CREATE INDEX IF NOT EXISTS idx_wallet_ledger_actor
-    ON wallet_ledger (team_id, actor_user_id, occurred_at) WHERE actor_user_id IS NOT NULL;
-
-CREATE UNIQUE INDEX IF NOT EXISTS uq_wallet_ledger_ref
-    ON wallet_ledger (reference_type, reference_id, entry_type, bucket);
-
-CREATE UNIQUE INDEX IF NOT EXISTS uq_wallet_ledger_stripe_event
-    ON wallet_ledger (stripe_event_id) WHERE stripe_event_id IS NOT NULL;
-
--- ---------------------------------------------------------------------------------------------
--- 8. wallet_policy — per-team charging engine, cap, degradation rules, lineage strategy.
--- ---------------------------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS wallet_policy (
-    policy_id              BIGSERIAL    PRIMARY KEY,
-    team_id                BIGINT       NOT NULL UNIQUE REFERENCES teams(team_id) ON DELETE CASCADE,
-    engine                 VARCHAR(16)  NOT NULL DEFAULT 'LEGACY',
-    cap_period             VARCHAR(16)  NOT NULL DEFAULT 'CALENDAR_MONTH',
-    cap_units              BIGINT,
-    -- Customer's money intent ("I want $50/month"); the currency comes from the team's Stripe
-    -- customer at recompute time, not stored separately here.
-    cap_source_money       BIGINT,
-    warn_at_pct            INTEGER      NOT NULL DEFAULT 80,
-    degrade_at_pct         INTEGER      NOT NULL DEFAULT 100,
-    degraded_feature_set   VARCHAR(32)  NOT NULL DEFAULT 'MINIMAL',
-    auto_group_strategy    VARCHAR(16)  NOT NULL DEFAULT 'AUTO',
-    notification_emails    JSONB        NOT NULL DEFAULT '[]'::jsonb,
-    updated_at             TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
--- ---------------------------------------------------------------------------------------------
--- 9. wallet_entitlement_snapshot — hot-path state for the entitlement guard.
---    user_id = 0 is the team-wide sentinel (Postgres treats NULL as not-equal-to-NULL in unique
---    constraints, so 0 is the cleaner choice for a composite PK).
--- ---------------------------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS wallet_entitlement_snapshot (
-    team_id               BIGINT       NOT NULL REFERENCES teams(team_id) ON DELETE CASCADE,
-    user_id               BIGINT       NOT NULL DEFAULT 0,
-    period_start          TIMESTAMP    NOT NULL,
-    period_end            TIMESTAMP    NOT NULL,
-    period_spend_units    BIGINT       NOT NULL DEFAULT 0,
-    period_cap_units      BIGINT,
-    state                 VARCHAR(16)  NOT NULL DEFAULT 'FULL',
-    feature_set           VARCHAR(32)  NOT NULL DEFAULT 'FULL',
-    enabled_gates         JSONB        NOT NULL DEFAULT '[]'::jsonb,
-    computed_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    PRIMARY KEY (team_id, user_id)
-);
-
--- ---------------------------------------------------------------------------------------------
--- 10. payg_shadow_charge — per-job legacy-vs-PAYG diff during PAYG_SHADOW engine mode.
--- ---------------------------------------------------------------------------------------------
-CREATE TABLE IF NOT EXISTS payg_shadow_charge (
-    shadow_id                BIGSERIAL    PRIMARY KEY,
-    team_id                  BIGINT       NOT NULL REFERENCES teams(team_id) ON DELETE CASCADE,
-    job_id                   UUID         NOT NULL,
-    policy_id                BIGINT       NOT NULL REFERENCES pricing_policy(policy_id),
-    payg_units               INTEGER      NOT NULL,
-    legacy_credits_charged   INTEGER      NOT NULL,
-    diff_pct                 INTEGER      NOT NULL,
-    occurred_at              TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX IF NOT EXISTS idx_payg_shadow_team_time
-    ON payg_shadow_charge (team_id, occurred_at);
diff --git a/app/saas/src/main/resources/db/migration/saas/V12__seed_default_payg_policy.sql b/app/saas/src/main/resources/db/migration/saas/V12__seed_default_payg_policy.sql
deleted file mode 100644
index d587a80b2e..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V12__seed_default_payg_policy.sql
+++ /dev/null
@@ -1,37 +0,0 @@
--- Seed the V1 default pricing policy. Idempotent — only inserts when no default row exists.
--- Units sized so a typical 25-page / 5 MiB document is 1 unit; tune via admin endpoints once
--- Stripe Prices are wired in production.
---
--- This migration is separated from V11 because V11 has already shipped to main — adding rows to
--- it would change its Flyway checksum and break existing deployments.
-
-INSERT INTO pricing_policy (
-    version, effective_from, doc_pages_per_unit, doc_bytes_per_unit,
-    min_charge_units, file_unit_cap, is_default, notes, created_by
-)
-SELECT
-    'v1-initial', CURRENT_TIMESTAMP, 25, 5242880,
-    1, 1000, TRUE,
-    'V1 default seeded by V12 migration. Tune via admin once Stripe Prices are configured.',
-    'system'
-WHERE NOT EXISTS (
-    SELECT 1 FROM pricing_policy WHERE is_default = TRUE
-);
-
--- Step limits for the default policy across every JobSource. References the row inserted above
--- via the partial unique index on is_default=TRUE.
-INSERT INTO pricing_policy_step_limit (policy_id, job_source, step_limit)
-SELECT p.policy_id, src.job_source, src.step_limit
-FROM pricing_policy p
-CROSS JOIN (
-    VALUES
-        ('WEB', 10),
-        ('API', 10),
-        ('PIPELINE', 20),     -- automations get a longer chain
-        ('DESKTOP_APP', 10)
-) AS src(job_source, step_limit)
-WHERE p.is_default = TRUE
-  AND NOT EXISTS (
-    SELECT 1 FROM pricing_policy_step_limit s
-    WHERE s.policy_id = p.policy_id AND s.job_source = src.job_source
-  );
diff --git a/app/saas/src/main/resources/db/migration/saas/V13__payg_shadow_charge_status.sql b/app/saas/src/main/resources/db/migration/saas/V13__payg_shadow_charge_status.sql
deleted file mode 100644
index 66da92a108..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V13__payg_shadow_charge_status.sql
+++ /dev/null
@@ -1,20 +0,0 @@
--- Refund tracking on shadow rows. Shadow models the eventual Stripe meter_event_adjustment(cancel)
--- by flipping status from CHARGED to REFUNDED in the same request's afterCompletion when a
--- freshly-opened process fails with 5xx on its first step.
---
--- Reconciliation report selects SUM(payg_units) WHERE status = 'CHARGED' to get the true net
--- Stripe would bill.
-
-ALTER TABLE payg_shadow_charge
-    ADD COLUMN IF NOT EXISTS status         VARCHAR(16)  NOT NULL DEFAULT 'CHARGED',
-    ADD COLUMN IF NOT EXISTS refunded_at    TIMESTAMP,
-    ADD COLUMN IF NOT EXISTS refund_reason  VARCHAR(128);
-
-CREATE INDEX IF NOT EXISTS idx_payg_shadow_status_time
-    ON payg_shadow_charge (status, occurred_at);
-
--- Hot-path index for findFirstByJobIdOrderByIdAsc: hit on every 5xx-first-step refund to flip
--- the row to REFUNDED. UNIQUE because at most one shadow row exists per processing_job by
--- construction (openProcess writes exactly one on OPENED, zero on JOINED).
-CREATE UNIQUE INDEX IF NOT EXISTS uq_payg_shadow_job_id
-    ON payg_shadow_charge (job_id);
diff --git a/app/saas/src/main/resources/db/migration/saas/V14__payg_subscription_state.sql b/app/saas/src/main/resources/db/migration/saas/V14__payg_subscription_state.sql
deleted file mode 100644
index eca2665de7..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V14__payg_subscription_state.sql
+++ /dev/null
@@ -1,189 +0,0 @@
--- PAYG subscription state — the column + functions that let new customers reach Stripe billing.
---
--- This migration is half of the Stripe/Supabase wire-up (PR-SB-1 in `notes/PAYG_DESIGN.md`
--- revision note + `payg-stripe-supabase-plan.html`). It's strictly additive:
---   * one new column on payg_team_extensions (payg_subscription_id)
---   * one new column on pricing_policy   (free_tier_units_per_cycle)
---   * two RPC functions (payg_link_subscription, payg_unlink_subscription) — the only writers
---     of subscription state, called by stripe-webhook + create-payg-team-subscription edge fns
---   * an AFTER-INSERT trigger on teams that auto-creates the payg_team_extensions sidecar row
---     so every new signup is PAYG-by-default
---   * an RLS policy that lets team LEADERs (and the service role) link subscriptions
---
--- No behaviour change for the running app until PR-SB-4 wires PaygMeterReportingService and
--- the free-tier gate into JobChargeService. Until then this just exposes new state for the
--- edge functions in PR-SB-2 to write through to.
---
--- Design references:
---   * notes/PAYG_DESIGN.md (revision note 2026-06-03 — "subscription presence is the gate")
---   * payg-stripe-supabase-plan.html §3.1 — RPC functions; §3.5 — RLS policy
-
--- ---------------------------------------------------------------------------------------------
--- 1. New columns
--- ---------------------------------------------------------------------------------------------
-
-ALTER TABLE stirling_pdf.payg_team_extensions
-    ADD COLUMN IF NOT EXISTS payg_subscription_id VARCHAR(128) UNIQUE;
-
-COMMENT ON COLUMN stirling_pdf.payg_team_extensions.payg_subscription_id IS
-    'Stripe subscription id (sub_xxx) for this team''s PAYG metered subscription. '
-    'NULL = team has not added a card yet; engine writes shadow rows only. '
-    'NOT NULL = engine posts meter events to Stripe on every billable tool call. '
-    'Mutated exclusively by payg_link_subscription / payg_unlink_subscription RPC functions.';
-
-ALTER TABLE stirling_pdf.pricing_policy
-    ADD COLUMN IF NOT EXISTS free_tier_units_per_cycle BIGINT NOT NULL DEFAULT 0;
-
-COMMENT ON COLUMN stirling_pdf.pricing_policy.free_tier_units_per_cycle IS
-    'Doc units a team on this policy can consume per cycle before they must add a card. '
-    'Default 0 = no free tier (block immediately). The seeded default policy will set this '
-    'to the launch free-tier size; the special "launch" policy used by the day-1 legacy '
-    'migration script (see PAYG_DESIGN.md §3.10 revised) can override.';
-
--- ---------------------------------------------------------------------------------------------
--- 2. RPC: payg_link_subscription
---
--- Called by:
---   * supabase/functions/create-payg-team-subscription/index.ts (post-Stripe-Checkout, with
---     either user JWT [normal path, RLS-enforced] or service-role [day-1 migration script])
---   * supabase/functions/stripe-webhook/handlers/payg-subscription.ts on
---     customer.subscription.created (idempotent — second invocation with same args is a no-op)
--- ---------------------------------------------------------------------------------------------
-
-CREATE OR REPLACE FUNCTION stirling_pdf.payg_link_subscription(
-    p_team_id         BIGINT,
-    p_customer_id     TEXT,
-    p_subscription_id TEXT
-) RETURNS VOID
-LANGUAGE plpgsql
-SECURITY INVOKER
-AS $$
-BEGIN
-    UPDATE stirling_pdf.payg_team_extensions
-       SET stripe_customer_id   = p_customer_id,
-           payg_subscription_id = p_subscription_id,
-           updated_at           = now()
-     WHERE team_id = p_team_id;
-
-    IF NOT FOUND THEN
-        RAISE EXCEPTION 'payg_team_extensions row missing for team %', p_team_id
-            USING ERRCODE = 'foreign_key_violation';
-    END IF;
-
-    INSERT INTO stirling_pdf.payg_subscription_change_log(team_id, action, subscription_id)
-                                                  VALUES (p_team_id, 'LINKED', p_subscription_id);
-END $$;
-
-COMMENT ON FUNCTION stirling_pdf.payg_link_subscription(BIGINT, TEXT, TEXT) IS
-    'Idempotent link of a Stripe subscription to a team. SECURITY INVOKER means RLS applies — '
-    'the caller must be a LEADER of the team (or hold the service-role bypass). '
-    'Writes an audit row to payg_subscription_change_log.';
-
--- ---------------------------------------------------------------------------------------------
--- 3. RPC: payg_unlink_subscription
---
--- Called by stripe-webhook handlers/payg-subscription.ts on customer.subscription.deleted
--- (after Stripe's own retries have given up). Drops the team back to free-tier-then-block.
--- ---------------------------------------------------------------------------------------------
-
-CREATE OR REPLACE FUNCTION stirling_pdf.payg_unlink_subscription(
-    p_team_id BIGINT,
-    p_reason  TEXT
-) RETURNS VOID
-LANGUAGE plpgsql
-SECURITY INVOKER
-AS $$
-BEGIN
-    UPDATE stirling_pdf.payg_team_extensions
-       SET payg_subscription_id = NULL,
-           updated_at           = now()
-     WHERE team_id = p_team_id;
-    -- We deliberately keep stripe_customer_id — the team may add a new card later and we'd
-    -- like to reuse the existing Stripe customer record rather than create a duplicate.
-
-    INSERT INTO stirling_pdf.payg_subscription_change_log(team_id, action, reason)
-                                                  VALUES (p_team_id, 'UNLINKED', p_reason);
-END $$;
-
-COMMENT ON FUNCTION stirling_pdf.payg_unlink_subscription(BIGINT, TEXT) IS
-    'Drops the team back to free-tier-then-block derived state. Reason is logged for audit '
-    '(typically subscription_deleted | admin | card_removed).';
-
--- ---------------------------------------------------------------------------------------------
--- 4. Auto-create payg_team_extensions row when a team is created
---
--- Every new signup gets a payg_team_extensions row with NULL pricing_policy_id (which the
--- backend's PricingPolicyService resolves to the default policy). The free-tier gate kicks in
--- from the very first tool call.
--- ---------------------------------------------------------------------------------------------
-
-CREATE OR REPLACE FUNCTION stirling_pdf.payg_create_team_extensions_trigger()
-RETURNS TRIGGER
-LANGUAGE plpgsql
-AS $$
-BEGIN
-    INSERT INTO stirling_pdf.payg_team_extensions(team_id)
-                                          VALUES (NEW.team_id)
-    ON CONFLICT (team_id) DO NOTHING;
-    RETURN NEW;
-END $$;
-
-DROP TRIGGER IF EXISTS trg_payg_create_team_extensions ON stirling_pdf.teams;
-CREATE TRIGGER trg_payg_create_team_extensions
-    AFTER INSERT ON stirling_pdf.teams
-    FOR EACH ROW
-    EXECUTE FUNCTION stirling_pdf.payg_create_team_extensions_trigger();
-
-COMMENT ON TRIGGER trg_payg_create_team_extensions ON stirling_pdf.teams IS
-    'Ensures every team has a payg_team_extensions sidecar row from creation. New customers '
-    'are PAYG-default from minute one — they consume free-tier units until they add a card.';
-
--- ---------------------------------------------------------------------------------------------
--- 5. Backfill: any existing team without a sidecar row gets one now
--- ---------------------------------------------------------------------------------------------
-
-INSERT INTO stirling_pdf.payg_team_extensions(team_id)
-SELECT t.team_id
-  FROM stirling_pdf.teams t
- WHERE NOT EXISTS (
-     SELECT 1 FROM stirling_pdf.payg_team_extensions x WHERE x.team_id = t.team_id
- );
-
--- ---------------------------------------------------------------------------------------------
--- 6. RLS policy
---
--- Service-role bypasses RLS (backend reads + day-1 migration script writes via the service-role
--- key). For user-initiated writes via the frontend Add-Card flow, only team LEADERs can link a
--- subscription. SELECT remains permissive — anyone in the team can see the row.
--- ---------------------------------------------------------------------------------------------
-
-ALTER TABLE stirling_pdf.payg_team_extensions ENABLE ROW LEVEL SECURITY;
-
--- Read: any team member can see their team's payg row.
-DROP POLICY IF EXISTS payg_team_ext_select ON stirling_pdf.payg_team_extensions;
-CREATE POLICY payg_team_ext_select
-    ON stirling_pdf.payg_team_extensions
-    FOR SELECT
-    USING (
-        team_id IN (
-            SELECT tm.team_id
-              FROM stirling_pdf.team_memberships tm
-              JOIN stirling_pdf.users u ON u.user_id = tm.user_id
-             WHERE u.supabase_auth_id = auth.uid()
-        )
-    );
-
--- Update: only LEADERs of the team can update (i.e. link / unlink a subscription).
-DROP POLICY IF EXISTS payg_team_ext_leader_update ON stirling_pdf.payg_team_extensions;
-CREATE POLICY payg_team_ext_leader_update
-    ON stirling_pdf.payg_team_extensions
-    FOR UPDATE
-    USING (
-        team_id IN (
-            SELECT tm.team_id
-              FROM stirling_pdf.team_memberships tm
-              JOIN stirling_pdf.users u ON u.user_id = tm.user_id
-             WHERE u.supabase_auth_id = auth.uid()
-               AND tm.role = 'LEADER'
-        )
-    );
diff --git a/app/saas/src/main/resources/db/migration/saas/V15__payg_audit_logs.sql b/app/saas/src/main/resources/db/migration/saas/V15__payg_audit_logs.sql
deleted file mode 100644
index 1b7e61e9c1..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V15__payg_audit_logs.sql
+++ /dev/null
@@ -1,76 +0,0 @@
--- PAYG audit-log tables. Two append-only logs:
---
---   * payg_meter_event_log         — written by the backend's PaygMeterReportingService
---                                    on every Stripe meter event POST attempt. Gives us a
---                                    record independent of Stripe's own logs so we can
---                                    replay-after-24h-window (Stripe's idempotency window)
---                                    and run nightly reconciliation against Stripe's
---                                    meter-event list.
---
---   * payg_subscription_change_log — written by V14's two RPC functions on every
---                                    subscription link / unlink. Independent of Stripe's
---                                    webhook log; lets us diagnose "why is this team in
---                                    free-tier-block when their Stripe sub is active?"
---                                    without leaving our DB.
---
--- Both are pure additive; nothing reads them yet. PR-SB-5 (nightly reconcile) wires the
--- meter-event log; the subscription change log is queried only from admin tooling.
---
--- Design references:
---   * payg-stripe-supabase-plan.html §3.10 — twin migrations
---   * payg-stripe-supabase-plan.html §8 H5 — 24h idempotency window mitigation
-
--- ---------------------------------------------------------------------------------------------
--- 1. payg_meter_event_log — backend-side audit of every Stripe meter event we tried to post.
--- ---------------------------------------------------------------------------------------------
-
-CREATE TABLE IF NOT EXISTS stirling_pdf.payg_meter_event_log (
-    event_id            BIGSERIAL    PRIMARY KEY,
-    team_id             BIGINT       NOT NULL REFERENCES stirling_pdf.teams(team_id) ON DELETE CASCADE,
-    job_id              UUID,
-    idempotency_key     VARCHAR(128) NOT NULL UNIQUE,
-    units               INTEGER      NOT NULL,
-    occurred_at         TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    posted_to_stripe_at TIMESTAMP,
-    -- NULL while pending; set when the meter-payg-units edge fn returns success. NULL after
-    -- 24h means the event never made it to Stripe — nightly reconcile retries with a fresh
-    -- idempotency-key suffix (see §8 H5 mitigation).
-    stripe_error_code   VARCHAR(64),
-    stripe_error_body   TEXT,
-    metadata            JSONB
-);
-
-CREATE INDEX IF NOT EXISTS idx_payg_meter_event_team_time
-    ON stirling_pdf.payg_meter_event_log (team_id, occurred_at);
-
-CREATE INDEX IF NOT EXISTS idx_payg_meter_event_unposted
-    ON stirling_pdf.payg_meter_event_log (occurred_at)
-    WHERE posted_to_stripe_at IS NULL;
-
-COMMENT ON TABLE stirling_pdf.payg_meter_event_log IS
-    'Backend audit of every Stripe meter event POST attempt. Independent of Stripe meter '
-    'history. idempotency_key is the same one passed to Stripe; the UNIQUE constraint here '
-    'gives us safe at-least-once semantics even on backend retry. Rows older than 24h with '
-    'posted_to_stripe_at IS NULL are stuck and retried by the nightly reconcile job.';
-
--- ---------------------------------------------------------------------------------------------
--- 2. payg_subscription_change_log — written by V14's RPC functions on every link / unlink.
--- ---------------------------------------------------------------------------------------------
-
-CREATE TABLE IF NOT EXISTS stirling_pdf.payg_subscription_change_log (
-    change_id        BIGSERIAL    PRIMARY KEY,
-    team_id          BIGINT       NOT NULL REFERENCES stirling_pdf.teams(team_id) ON DELETE CASCADE,
-    action           VARCHAR(32)  NOT NULL,
-    -- LINKED   — payg_link_subscription written subscription_id
-    -- UNLINKED — payg_unlink_subscription cleared the subscription
-    subscription_id  VARCHAR(128),
-    reason           TEXT,
-    changed_at       TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX IF NOT EXISTS idx_payg_sub_change_team_time
-    ON stirling_pdf.payg_subscription_change_log (team_id, changed_at);
-
-COMMENT ON TABLE stirling_pdf.payg_subscription_change_log IS
-    'Append-only log of every subscription link / unlink. Written by V14 RPC functions; '
-    'never updated. Diagnostic value when reconciling against Stripe webhook history.';
diff --git a/app/saas/src/main/resources/db/migration/saas/V16__payg_billing_category.sql b/app/saas/src/main/resources/db/migration/saas/V16__payg_billing_category.sql
deleted file mode 100644
index f78458a1b6..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V16__payg_billing_category.sql
+++ /dev/null
@@ -1,58 +0,0 @@
--- PAYG analytics axis: stamp every billable ledger entry / shadow row with the category that
--- produced it (API | AI | AUTOMATION | BYPASSED). PAYG stays on a single flat-priced Stripe meter
--- forever — this column is for in-app breakdowns and analytics, never for Stripe pricing.
---
--- All adds are nullable: pre-V16 rows have no category and stay NULL; the interceptor populates
--- it for new rows going forward.
-
--- ---------------------------------------------------------------------------------------------
--- 1. wallet_ledger.billing_category
--- ---------------------------------------------------------------------------------------------
-ALTER TABLE wallet_ledger ADD COLUMN IF NOT EXISTS billing_category VARCHAR(16) NULL;
-COMMENT ON COLUMN wallet_ledger.billing_category IS
-    'API | AI | AUTOMATION | BYPASSED. NULL = system entry or pre-V16 backfill.';
-
--- Partial index — only billable rows ever read this column, and NULLs would just bloat the tree.
-CREATE INDEX IF NOT EXISTS idx_wallet_ledger_team_category_period
-    ON wallet_ledger (team_id, billing_category, occurred_at)
-    WHERE billing_category IS NOT NULL;
-
--- ---------------------------------------------------------------------------------------------
--- 2. payg_shadow_charge.billing_category + job_source
--- ---------------------------------------------------------------------------------------------
-ALTER TABLE payg_shadow_charge
-    ADD COLUMN IF NOT EXISTS billing_category VARCHAR(16) NULL,
-    ADD COLUMN IF NOT EXISTS job_source       VARCHAR(32) NULL;
-
--- Backfill job_source from processing_job (best-effort — rows whose job has already been pruned
--- stay NULL, which is fine: the shadow row is self-describing post-V16 and only legacy ones lack
--- the column.)
-UPDATE payg_shadow_charge sc
-   SET job_source = pj.source
-  FROM processing_job pj
- WHERE pj.job_id = sc.job_id
-   AND sc.job_source IS NULL;
-
--- ---------------------------------------------------------------------------------------------
--- 3. pricing_policy_stripe_price.stripe_product_id
---    Operator populates this manually per row when seeding new policies. Nullable for backward
---    compatibility with existing rows that don't carry a Product reference.
--- ---------------------------------------------------------------------------------------------
-ALTER TABLE pricing_policy_stripe_price
-    ADD COLUMN IF NOT EXISTS stripe_product_id VARCHAR(128) NULL;
-
--- ---------------------------------------------------------------------------------------------
--- 4. wallet_category_summary view — pre-grouped per-team, per-month, per-category aggregate that
---    the in-app breakdown widget reads. Recomputed live on every SELECT; cheap thanks to the
---    partial index above.
--- ---------------------------------------------------------------------------------------------
-CREATE OR REPLACE VIEW wallet_category_summary AS
-SELECT
-    team_id,
-    date_trunc('month', occurred_at) AS period_start,
-    billing_category,
-    SUM(CASE WHEN amount_units < 0 THEN -amount_units ELSE 0 END) AS units_debited,
-    COUNT(*) FILTER (WHERE entry_type = 'DEBIT')                  AS debit_count
-FROM wallet_ledger
-WHERE billing_category IS NOT NULL
-GROUP BY team_id, date_trunc('month', occurred_at), billing_category;
diff --git a/app/saas/src/main/resources/db/migration/saas/V17__merge_supabase_id_into_auth_id.sql b/app/saas/src/main/resources/db/migration/saas/V17__merge_supabase_id_into_auth_id.sql
deleted file mode 100644
index cc6b5d033e..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V17__merge_supabase_id_into_auth_id.sql
+++ /dev/null
@@ -1,34 +0,0 @@
--- Consolidate users.supabase_id into users.supabase_auth_id.
---
--- The `supabase_auth_id` column is the canonical link to Supabase Auth — it was
--- created by the initial Supabase schema migration (Sep 2025) and is referenced
--- by every RLS policy in the Supabase side of the world (V14's
--- payg_team_ext_select / payg_team_ext_leader_update, the public.payg_*
--- SECURITY DEFINER RPCs, etc.).
---
--- PR #6384 ("SaaS Consolidation") accidentally added a parallel `supabase_id`
--- column via Flyway V2 — same purpose, different name. Java's User entity then
--- mapped to this new column. The result was a split-brain:
---   * Pre-#6384 users had supabase_auth_id populated, supabase_id NULL.
---   * Post-#6384 users had supabase_id populated, supabase_auth_id NULL.
---   * RLS policies + RPCs always check supabase_auth_id, so post-#6384 users
---     failed every membership check.
---
--- This migration:
---   1. Backfills supabase_auth_id from supabase_id where the former is NULL.
---   2. Drops the supabase_id column and its unique index.
---
--- The Java User entity has been switched to @Column(name = "supabase_auth_id")
--- in the same change-set; this migration assumes the new code is already
--- deployed (or will be deployed together with this migration).
-
--- 1. Backfill the canonical column from the duplicate, where needed.
-UPDATE users
-   SET supabase_auth_id = supabase_id
- WHERE supabase_auth_id IS NULL
-   AND supabase_id IS NOT NULL;
-
--- 2. Drop the duplicate column. IF EXISTS guards against environments where
---    the column was already removed manually.
-DROP INDEX IF EXISTS uk_users_supabase_id;
-ALTER TABLE users DROP COLUMN IF EXISTS supabase_id;
diff --git a/app/saas/src/main/resources/db/migration/saas/V19__payg_lifetime_free_grant.sql b/app/saas/src/main/resources/db/migration/saas/V19__payg_lifetime_free_grant.sql
deleted file mode 100644
index ed62b34e02..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V19__payg_lifetime_free_grant.sql
+++ /dev/null
@@ -1,93 +0,0 @@
--- PAYG free allowance: monthly per-cycle allowance → one-time LIFETIME grant.
---
--- Product decision (2026-06-11): every team gets a one-time free document grant. It does NOT
--- replenish monthly and is NOT lost when the team subscribes — they keep whatever is unused.
---
--- Mechanics: the grant is tracked as a running counter on the team sidecar
--- (payg_team_extensions.free_units_remaining), seeded once from the team's effective pricing
--- policy and maintained by the charge pipeline (deducted when a billable DEBIT is written,
--- restored on a first-step refund). Because the counter is authoritative, the wallet_ledger is
--- no longer the source of truth for the grant and its old rows can be pruned after a retention
--- window (separate future job).
-
--- ---------------------------------------------------------------------------------------------
--- 1. Rename the policy column — it is no longer "per cycle", it's the one-time grant size.
--- ---------------------------------------------------------------------------------------------
-
-ALTER TABLE stirling_pdf.pricing_policy
-    RENAME COLUMN free_tier_units_per_cycle TO free_tier_units;
-
-COMMENT ON COLUMN stirling_pdf.pricing_policy.free_tier_units IS
-    'One-time lifetime free document grant handed to a team on creation (copied into '
-    'payg_team_extensions.free_units_remaining). NOT per-cycle: it never replenishes and '
-    'survives subscribing. 0 = no free grant (block / meter from the first document).';
-
--- ---------------------------------------------------------------------------------------------
--- 2. The running counter on the team sidecar.
--- ---------------------------------------------------------------------------------------------
-
-ALTER TABLE stirling_pdf.payg_team_extensions
-    ADD COLUMN IF NOT EXISTS free_units_remaining BIGINT NOT NULL DEFAULT 0;
-
-COMMENT ON COLUMN stirling_pdf.payg_team_extensions.free_units_remaining IS
-    'Remaining one-time free documents for this team. Seeded from the effective pricing '
-    'policy''s free_tier_units at row creation; decremented by min(jobUnits, remaining) when a '
-    'billable charge is written; restored on a first-step refund. Lifetime — never resets. '
-    'Authoritative source for the free grant (independent of wallet_ledger retention).';
-
--- ---------------------------------------------------------------------------------------------
--- 3. Per-job free/paid split on the shadow row — makes metering + refunds exact and removes
---    any need to SUM the ledger over a team's lifetime.
--- ---------------------------------------------------------------------------------------------
-
-ALTER TABLE stirling_pdf.payg_shadow_charge
-    ADD COLUMN IF NOT EXISTS free_units_consumed INT NOT NULL DEFAULT 0;
-
-COMMENT ON COLUMN stirling_pdf.payg_shadow_charge.free_units_consumed IS
-    'How many of this job''s payg_units came out of the team''s free grant at charge time. '
-    'Paid (metered) units = payg_units - free_units_consumed. A refund restores this many '
-    'units to payg_team_extensions.free_units_remaining.';
-
--- ---------------------------------------------------------------------------------------------
--- 4. Seed the counter at team creation. Replace the V14 trigger function so new teams get the
---    default policy's grant from minute one. (The trigger itself still points at this function.)
--- ---------------------------------------------------------------------------------------------
-
-CREATE OR REPLACE FUNCTION stirling_pdf.payg_create_team_extensions_trigger()
-RETURNS TRIGGER
-LANGUAGE plpgsql
-AS $$
-BEGIN
-    INSERT INTO stirling_pdf.payg_team_extensions(team_id, free_units_remaining)
-    VALUES (
-        NEW.team_id,
-        COALESCE(
-            (SELECT pp.free_tier_units FROM stirling_pdf.pricing_policy pp
-              WHERE pp.is_default = TRUE LIMIT 1),
-            0)
-    )
-    ON CONFLICT (team_id) DO NOTHING;
-    RETURN NEW;
-END $$;
-
--- ---------------------------------------------------------------------------------------------
--- 5. Backfill existing teams. remaining = max(0, grant - lifetime_consumed). lifetime_consumed
---    is -SUM(amount_units) over the team's DEBIT+REFUND ledger entries (debits negative, refunds
---    positive), so grant + SUM(amount_units) collapses to grant - consumed. One-time read of the
---    ledger; after this the counter stands alone. Grant = team override policy, else the default.
--- ---------------------------------------------------------------------------------------------
-
-UPDATE stirling_pdf.payg_team_extensions ext
-   SET free_units_remaining = GREATEST(
-        0,
-        COALESCE(
-            (SELECT pp.free_tier_units FROM stirling_pdf.pricing_policy pp
-              WHERE pp.policy_id = ext.pricing_policy_id),
-            (SELECT pp.free_tier_units FROM stirling_pdf.pricing_policy pp
-              WHERE pp.is_default = TRUE LIMIT 1),
-            0)
-        + COALESCE(
-            (SELECT SUM(wl.amount_units) FROM stirling_pdf.wallet_ledger wl
-              WHERE wl.team_id = ext.team_id
-                AND wl.entry_type IN ('DEBIT', 'REFUND')),
-            0));
diff --git a/app/saas/src/main/resources/db/migration/saas/V20__payg_launch_free_grant.sql b/app/saas/src/main/resources/db/migration/saas/V20__payg_launch_free_grant.sql
deleted file mode 100644
index d9dc756e31..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V20__payg_launch_free_grant.sql
+++ /dev/null
@@ -1,42 +0,0 @@
--- PAYG launch free grant: give the default pricing policy a real one-time grant.
---
--- V14 added pricing_policy.free_tier_units with DEFAULT 0, and the default policy seeded in V12
--- predates the column — so on a fresh deploy every team's free_units_remaining seeds to 0 and
--- V19's "every team gets a one-time free grant" intent ships dead (teams are gated / metered from
--- the very first billable document). This migration sets the launch grant on the default policy
--- and re-seeds existing teams that V19 left at 0 (V19 ran its backfill while the grant was still
--- 0, so every then-existing team computed to 0).
---
--- The launch value lives on the default policy row; tune it there (or via a future admin surface).
--- Both updates are guarded so a deliberately-tuned value — e.g. a smaller test grant — is never
--- clobbered.
-
--- ---------------------------------------------------------------------------------------------
--- 1. Launch grant on the default policy, only where it's still the accidental 0.
--- ---------------------------------------------------------------------------------------------
-UPDATE stirling_pdf.pricing_policy
-   SET free_tier_units = 500
- WHERE is_default = TRUE
-   AND free_tier_units = 0;
-
--- ---------------------------------------------------------------------------------------------
--- 2. Re-seed existing teams V19 left at 0. Same recompute as V19's backfill — remaining =
---    max(0, grant + net signed DEBIT/REFUND) — now that the grant is non-zero. Guarded to
---    free_units_remaining = 0: a team with a deliberately-set positive balance is left alone, and
---    a team that genuinely exhausted a real grant also recomputes to 0, so the guard is safe.
--- ---------------------------------------------------------------------------------------------
-UPDATE stirling_pdf.payg_team_extensions ext
-   SET free_units_remaining = GREATEST(
-        0,
-        COALESCE(
-            (SELECT pp.free_tier_units FROM stirling_pdf.pricing_policy pp
-              WHERE pp.policy_id = ext.pricing_policy_id),
-            (SELECT pp.free_tier_units FROM stirling_pdf.pricing_policy pp
-              WHERE pp.is_default = TRUE LIMIT 1),
-            0)
-        + COALESCE(
-            (SELECT SUM(wl.amount_units) FROM stirling_pdf.wallet_ledger wl
-              WHERE wl.team_id = ext.team_id
-                AND wl.entry_type IN ('DEBIT', 'REFUND')),
-            0))
- WHERE ext.free_units_remaining = 0;
diff --git a/app/saas/src/main/resources/db/migration/saas/V21__drop_wallet_category_summary_view.sql b/app/saas/src/main/resources/db/migration/saas/V21__drop_wallet_category_summary_view.sql
deleted file mode 100644
index 857e0bfa65..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V21__drop_wallet_category_summary_view.sql
+++ /dev/null
@@ -1,11 +0,0 @@
--- Drop the unused wallet_category_summary view.
---
--- V16 created this view to back the wallet's per-category spend breakdown via
--- WalletCategorySummaryDao. That DAO was never wired up — the breakdown is built from the JPA
--- repository (WalletLedgerRepository.sumPeriodAmountByCategory) instead — so both the DAO and this
--- view have zero readers. The DAO is deleted in the same change; this drops the dead view.
---
--- Done as a new migration (not by editing V16) so Flyway's checksum validation doesn't fail on
--- databases that already applied V16. IF EXISTS keeps it safe on DBs where V16 hasn't run.
-
-DROP VIEW IF EXISTS stirling_pdf.wallet_category_summary;
diff --git a/app/saas/src/main/resources/db/migration/saas/V22__policy_engine_tables.sql b/app/saas/src/main/resources/db/migration/saas/V22__policy_engine_tables.sql
deleted file mode 100644
index b07ad1cebf..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V22__policy_engine_tables.sql
+++ /dev/null
@@ -1,35 +0,0 @@
--- Policy engine schema: persisted policies and the reusable input
--- connections ("sources") they reference by id. The whole policy/source lives as JSON in the
--- *_json column (authoritative on read); the scalar columns are denormalized copies for querying,
--- notably team_id so a caller's team can be loaded without scanning every team's rows. owner and
--- team_id are plain values, not foreign keys, to stay decoupled from the security entities (so this
--- subsystem can be enabled or disabled without touching them). Hibernate ddl-auto would also create
--- these, but this keeps the schema explicit for the Flyway-managed deployments.
-
-CREATE TABLE IF NOT EXISTS policies (
-    id           VARCHAR(255) PRIMARY KEY,
-    name         VARCHAR(255),
-    owner        VARCHAR(255),
-    enabled      BOOLEAN      NOT NULL DEFAULT FALSE,
-    trigger_type VARCHAR(255),
-    team_id      BIGINT,
-    policy_json  TEXT
-);
-
--- For deployments where Hibernate already created policies before this migration (pre-team_id).
-ALTER TABLE policies ADD COLUMN IF NOT EXISTS team_id BIGINT;
-
-CREATE INDEX IF NOT EXISTS idx_policies_team         ON policies (team_id);
-CREATE INDEX IF NOT EXISTS idx_policies_trigger      ON policies (trigger_type, enabled);
-
-CREATE TABLE IF NOT EXISTS policy_sources (
-    id          VARCHAR(255) PRIMARY KEY,
-    name        VARCHAR(255),
-    type        VARCHAR(255),
-    owner       VARCHAR(255),
-    team_id     BIGINT,
-    enabled     BOOLEAN      NOT NULL DEFAULT FALSE,
-    source_json TEXT
-);
-
-CREATE INDEX IF NOT EXISTS idx_policy_sources_team ON policy_sources (team_id);
diff --git a/app/saas/src/main/resources/db/migration/saas/V23__policy_source_doc_counts.sql b/app/saas/src/main/resources/db/migration/saas/V23__policy_source_doc_counts.sql
deleted file mode 100644
index bf50191893..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V23__policy_source_doc_counts.sql
+++ /dev/null
@@ -1,26 +0,0 @@
--- Per-source document throughput, in two tables:
---
---   policy_source_doc_counts  one row per source per hour bucket (hours-since-epoch), holding how
---                             many documents that source fed into runs in that hour. Feeds the
---                             rolling last-24h / last-30d windows and the 30-day daily series, and
---                             is pruned to that window so it stays bounded.
---   policy_source_doc_totals  a denormalized lifetime total per source, incremented alongside the
---                             hourly bucket, so the overview reads the all-time figure in one row
---                             instead of scanning a source's whole bucket history - and so the
---                             hourly buckets can be pruned without losing it.
---
--- Hibernate ddl-auto would also create these, but the migration keeps the schema explicit for the
--- Flyway-managed deployments.
-
-CREATE TABLE IF NOT EXISTS policy_source_doc_counts (
-    source_id   VARCHAR(255) NOT NULL,
-    bucket_hour BIGINT       NOT NULL,
-    doc_count   BIGINT       NOT NULL DEFAULT 0,
-    PRIMARY KEY (source_id, bucket_hour)
-);
-
-CREATE TABLE IF NOT EXISTS policy_source_doc_totals (
-    source_id VARCHAR(255) NOT NULL,
-    doc_total BIGINT       NOT NULL DEFAULT 0,
-    PRIMARY KEY (source_id)
-);
diff --git a/app/saas/src/main/resources/db/migration/saas/V24__account_link_instances.sql b/app/saas/src/main/resources/db/migration/saas/V24__account_link_instances.sql
deleted file mode 100644
index 9c975f1ce7..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V24__account_link_instances.sql
+++ /dev/null
@@ -1,44 +0,0 @@
--- Account-link instances. One row per self-hosted instance that has linked a SaaS account.
---
--- Part of the combined-billing "Mode A" (connected self-hosted) flow:
---   1. An admin signs into their SaaS account in the Stirling Portal via the Supabase JS SDK
---      (a short-lived Supabase JWT, refreshed client-side — it never reaches the server long-term).
---   2. That JWT is used ONCE to call POST /api/v1/account-link/register, which mints a
---      device_id + device_secret bound to the admin's team. The secret is returned once and
---      stored only on the instance; we keep a SHA-256 hash here (the secret is high-entropy,
---      so an unsalted hash is sufficient — same posture as API keys).
---   3. The instance authenticates all unattended metering / entitlement calls with that device
---      credential. No long-lived user JWT lives on the server side.
---
--- Twin of supabase/migrations/20260619000000_account_link_instances.sql (Stirling-PDF-SaaS).
--- Inert until release: the AccountLinkController + device-credential filter are gated behind
--- stirling.billing.account-link.enabled (default off). The table itself is harmless additive.
-
-CREATE TABLE IF NOT EXISTS stirling_pdf.linked_instance (
-    instance_id        BIGSERIAL    PRIMARY KEY,
-    team_id            BIGINT       NOT NULL REFERENCES stirling_pdf.teams(team_id) ON DELETE CASCADE,
-    created_by_user_id BIGINT,
-    -- admin who registered the instance; informational only (no FK so a user delete never
-    -- cascades a working instance offline).
-    device_id          VARCHAR(64)  NOT NULL UNIQUE,
-    -- public, non-secret identifier the instance presents on every request.
-    device_secret_hash VARCHAR(64)  NOT NULL,
-    -- SHA-256 hex of the device secret; the secret itself is never stored.
-    name               VARCHAR(255),
-    -- operator-set display label (hostname etc.) for the "Linked instances" list.
-    created_at         TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    last_seen_at       TIMESTAMP,
-    -- stamped when the device credential last authenticated; powers staleness display.
-    revoked_at         TIMESTAMP
-    -- NULL = active. Set on unlink/revoke; a revoked credential fails authentication.
-);
-
-CREATE INDEX IF NOT EXISTS idx_linked_instance_team
-    ON stirling_pdf.linked_instance (team_id);
-
-COMMENT ON TABLE stirling_pdf.linked_instance IS
-    'One row per self-hosted instance linked to a SaaS account (combined-billing Mode A). '
-    'device_id is the public identifier; device_secret_hash is the SHA-256 of the bearer '
-    'secret (returned once at registration, stored only on the instance). The instance '
-    'authenticates unattended metering / entitlement calls with this credential; revoked_at '
-    'IS NULL means active.';
diff --git a/app/saas/src/main/resources/db/migration/saas/V25__payg_instance_usage.sql b/app/saas/src/main/resources/db/migration/saas/V25__payg_instance_usage.sql
deleted file mode 100644
index 7ab65b8b78..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V25__payg_instance_usage.sql
+++ /dev/null
@@ -1,35 +0,0 @@
--- Twin of supabase/migrations/<ts>_payg_instance_usage.sql (Stirling-PDF-SaaS). Keep the table
--- definition byte-identical to the Supabase twin — both repos own this stirling_pdf table (the SaaS
--- profile runs this Flyway migration against the Supabase-backed DB; non-Hibernate consumers — RLS,
--- PostgREST, edge functions — rely on the Supabase migration ledger having the matching entry).
---
--- Per-(team, billing period, category) last-seen cumulative usage reported by a linked self-hosted
--- instance (combined-billing "Mode A"). The instance reports monotonic cumulative unit totals on
--- its daily sync; SaaS bills the DELTA since the last sync — idempotent (a resend bills nothing) and
--- tamper-evident (a counter that drops is a signal) — by reusing the standard charge path
--- (JobChargeService.chargeStandalone), so no separate billing logic exists for this flow.
---
--- Inert until release: written only by the InstanceController /sync endpoint, gated behind
--- stirling.billing.account-link.enabled (default off). Additive, idempotent table.
-
-CREATE TABLE IF NOT EXISTS stirling_pdf.payg_instance_usage (
-    id                    BIGSERIAL    PRIMARY KEY,
-    team_id               BIGINT       NOT NULL REFERENCES stirling_pdf.teams(team_id) ON DELETE CASCADE,
-    period_start          TIMESTAMP    NOT NULL,
-    category              VARCHAR(32)  NOT NULL,
-    -- Highest cumulative unit total seen for this (team, period, category); the next sync bills
-    -- (reported cumulative - this).
-    last_cumulative_units BIGINT       NOT NULL DEFAULT 0,
-    -- Highest sync sequence applied; a sync at or below this is a replay and is ignored.
-    last_sync_seq         BIGINT       NOT NULL DEFAULT 0,
-    updated_at            TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    CONSTRAINT uk_payg_instance_usage UNIQUE (team_id, period_start, category)
-);
-
-CREATE INDEX IF NOT EXISTS idx_payg_instance_usage_team
-    ON stirling_pdf.payg_instance_usage (team_id);
-
-COMMENT ON TABLE stirling_pdf.payg_instance_usage IS
-    'Last-seen cumulative usage per (team, billing period, category) reported by linked self-hosted '
-    'instances (combined-billing Mode A). SaaS bills the delta vs last_cumulative_units via the '
-    'standard charge path; last_sync_seq dedups replays.';
diff --git a/app/saas/src/main/resources/db/migration/saas/V25__resource_grants.sql b/app/saas/src/main/resources/db/migration/saas/V25__resource_grants.sql
deleted file mode 100644
index f1eab58b15..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V25__resource_grants.sql
+++ /dev/null
@@ -1,21 +0,0 @@
--- Resource access grants: which user/team may use a gated resource (portal, integration config).
-
-CREATE TABLE IF NOT EXISTS resource_grants (
-    resource_grant_id  BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
-    resource_type      VARCHAR(64)  NOT NULL,
-    resource_id        VARCHAR(255) NOT NULL DEFAULT '',
-    principal_type     VARCHAR(32)  NOT NULL,
-    principal_id       BIGINT       NOT NULL,
-    permission         VARCHAR(32)  NOT NULL,
-    granted_by_user_id BIGINT,
-    created_at         TIMESTAMP    NOT NULL DEFAULT now()
-);
-
-CREATE UNIQUE INDEX IF NOT EXISTS uk_resource_grant
-    ON resource_grants (resource_type, resource_id, principal_type, principal_id, permission);
-
-CREATE INDEX IF NOT EXISTS idx_resource_grants_lookup
-    ON resource_grants (resource_type, resource_id);
-
-CREATE INDEX IF NOT EXISTS idx_resource_grants_principal
-    ON resource_grants (principal_type, principal_id);
diff --git a/app/saas/src/main/resources/db/migration/saas/V26__integration_configs.sql b/app/saas/src/main/resources/db/migration/saas/V26__integration_configs.sql
deleted file mode 100644
index c78660248e..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V26__integration_configs.sql
+++ /dev/null
@@ -1,25 +0,0 @@
--- S3/MCP/API integration configs; config_encrypted holds an AES-GCM encrypted JSON blob.
-
-CREATE TABLE IF NOT EXISTS integration_configs (
-    integration_config_id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
-    integration_type      VARCHAR(32)  NOT NULL,
-    name                  VARCHAR(255) NOT NULL,
-    scope                 VARCHAR(32)  NOT NULL,
-    owner_user_id         BIGINT,
-    owner_team_id         BIGINT,
-    enabled               BOOLEAN      NOT NULL DEFAULT TRUE,
-    locked                BOOLEAN      NOT NULL DEFAULT FALSE,
-    default_access        VARCHAR(32)  NOT NULL DEFAULT 'EXPLICIT_ONLY',
-    config_encrypted      TEXT,
-    created_at            TIMESTAMP    NOT NULL DEFAULT now(),
-    updated_at            TIMESTAMP    NOT NULL DEFAULT now()
-);
-
-CREATE INDEX IF NOT EXISTS idx_integration_configs_owner
-    ON integration_configs (owner_user_id);
-
-CREATE INDEX IF NOT EXISTS idx_integration_configs_type
-    ON integration_configs (integration_type);
-
-CREATE INDEX IF NOT EXISTS idx_integration_configs_scope
-    ON integration_configs (scope);
diff --git a/app/saas/src/main/resources/db/migration/saas/V26__payg_shadow_charge_linked_instance_source.sql b/app/saas/src/main/resources/db/migration/saas/V26__payg_shadow_charge_linked_instance_source.sql
deleted file mode 100644
index f79097e325..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V26__payg_shadow_charge_linked_instance_source.sql
+++ /dev/null
@@ -1,19 +0,0 @@
--- Twin of supabase/migrations/<ts>_payg_shadow_charge_linked_instance_source.sql (Stirling-PDF-SaaS).
--- Keep byte-identical to the Supabase twin.
---
--- Widen the payg_shadow_charge.job_source CHECK to allow LINKED_INSTANCE (combined-billing "Mode
--- A"). A linked instance's daily-sync charge runs through JobChargeService.chargeStandalone, which
--- writes a payg_shadow_charge row with job_source=LINKED_INSTANCE — a JobSource value added after
--- the original constraint, so the insert was failing the check and 500ing POST /api/v1/instance/sync.
---
--- Idempotent (DROP IF EXISTS + ADD, so it survives being applied by both the Flyway and Supabase
--- migration sets against the same schema) and additive (the new set is a superset of the JobSource
--- enum; the app only ever writes enum values, so no existing row can violate it).
-
-ALTER TABLE stirling_pdf.payg_shadow_charge
-    DROP CONSTRAINT IF EXISTS payg_shadow_charge_job_source_check;
-
-ALTER TABLE stirling_pdf.payg_shadow_charge
-    ADD CONSTRAINT payg_shadow_charge_job_source_check
-        CHECK (job_source IS NULL
-               OR job_source IN ('WEB', 'API', 'PIPELINE', 'DESKTOP_APP', 'LINKED_INSTANCE'));
diff --git a/app/saas/src/main/resources/db/migration/saas/V27__procurement.sql b/app/saas/src/main/resources/db/migration/saas/V27__procurement.sql
deleted file mode 100644
index 0048f999c1..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V27__procurement.sql
+++ /dev/null
@@ -1,72 +0,0 @@
--- Enterprise procurement: the tables that track a linked team's journey from trial to live.
---
--- One deal per team (the commercial journey: trial -> quote -> agreement -> payment -> live), the
--- quotes built against it (the itemised, priced offers), and an append-only activity log for the
--- money/licence-touching actions. The resulting subscription is mirrored in billing_subscriptions
--- (seeded on trial start / payment); the entitlement that unlocks the product is a Keygen licence
--- referenced by procurement_deal.license_ref. Prices are computed server-side (ProcurementPricingService).
---
--- Additive and idempotent (IF NOT EXISTS) — safe on the shared dev branch.
-
-CREATE TABLE IF NOT EXISTS stirling_pdf.procurement_deal (
-    deal_id               BIGSERIAL    PRIMARY KEY,
-    team_id               BIGINT       NOT NULL UNIQUE REFERENCES stirling_pdf.teams(team_id) ON DELETE CASCADE,
-    -- one active deal per team; the journey lives on this row.
-    stage                 VARCHAR(32)  NOT NULL DEFAULT 'trial',
-    -- trial | quote | security (agreement) | procurement (payment) | active (live)
-    trial_started_at      TIMESTAMP,
-    trial_ends_at         TIMESTAMP,
-    trial_extensions_used INT          NOT NULL DEFAULT 0,
-    license_ref           VARCHAR(128),
-    -- Keygen licence id issued for this deal (trial or annual). Mocked until Keygen mgmt lands.
-    subscription_id       VARCHAR(255),
-    -- Stripe subscription id, mirrored into billing_subscriptions once commercial.
-    accepted_quote_id     BIGINT,
-    created_at            TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at            TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    version               BIGINT       NOT NULL DEFAULT 0
-);
-
-CREATE TABLE IF NOT EXISTS stirling_pdf.procurement_quote (
-    quote_id            BIGSERIAL    PRIMARY KEY,
-    deal_id             BIGINT       NOT NULL REFERENCES stirling_pdf.procurement_deal(deal_id) ON DELETE CASCADE,
-    quote_number        VARCHAR(64)  NOT NULL,
-    status              VARCHAR(24)  NOT NULL DEFAULT 'draft',
-    -- draft | sent | accepted | expired
-    currency            VARCHAR(8)   NOT NULL DEFAULT 'USD',
-    volume              BIGINT       NOT NULL,
-    seats               INT,
-    deployment          VARCHAR(24),
-    term_years          INT          NOT NULL,
-    service_level       VARCHAR(24)  NOT NULL,
-    indemnification     BOOLEAN      NOT NULL DEFAULT FALSE,
-    training            BOOLEAN      NOT NULL DEFAULT FALSE,
-    qbr                 BOOLEAN      NOT NULL DEFAULT FALSE,
-    annual_net_minor    BIGINT       NOT NULL,
-    -- recurring annual fee after the multi-year discount, in minor units (cents).
-    tcv_minor           BIGINT       NOT NULL,
-    -- total contract value across the term incl. one-time fees, minor units.
-    line_items          TEXT,
-    -- JSON snapshot of the itemised lines the order form renders.
-    stripe_price_id     VARCHAR(128),
-    checkout_session_id VARCHAR(255),
-    checkout_url        TEXT,
-    valid_until         DATE,
-    created_at          TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at          TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    version             BIGINT       NOT NULL DEFAULT 0
-);
-
-CREATE TABLE IF NOT EXISTS stirling_pdf.procurement_activity (
-    activity_id   BIGSERIAL    PRIMARY KEY,
-    deal_id       BIGINT       NOT NULL REFERENCES stirling_pdf.procurement_deal(deal_id) ON DELETE CASCADE,
-    actor_user_id BIGINT,
-    -- the internal/portal user who took the action; informational (no FK).
-    action        VARCHAR(48)  NOT NULL,
-    -- trial_started | trial_extended | quote_built | quote_accepted | checkout_created | went_live ...
-    detail        TEXT,
-    created_at    TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX IF NOT EXISTS idx_procurement_quote_deal ON stirling_pdf.procurement_quote (deal_id);
-CREATE INDEX IF NOT EXISTS idx_procurement_activity_deal ON stirling_pdf.procurement_activity (deal_id);
diff --git a/app/saas/src/main/resources/db/migration/saas/V28__procurement_stripe_quote.sql b/app/saas/src/main/resources/db/migration/saas/V28__procurement_stripe_quote.sql
deleted file mode 100644
index 5d83ee35f8..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V28__procurement_stripe_quote.sql
+++ /dev/null
@@ -1,8 +0,0 @@
--- Stripe Quote support: a procurement quote is issued as a real Stripe Quote (finalized → PDF +
--- shareable), and on acceptance Stripe creates the committed subscription + first invoice. The
--- Stripe operations live in Supabase edge functions; these columns hold the references they write
--- back. Twin of Supabase migration 20260703000000_procurement_stripe_quote.sql.
-
-ALTER TABLE stirling_pdf.procurement_quote
-    ADD COLUMN IF NOT EXISTS stripe_quote_id    VARCHAR(128),
-    ADD COLUMN IF NOT EXISTS stripe_invoice_url TEXT;
diff --git a/app/saas/src/main/resources/db/migration/saas/V29__procurement_business_name.sql b/app/saas/src/main/resources/db/migration/saas/V29__procurement_business_name.sql
deleted file mode 100644
index ba9c74dde8..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V29__procurement_business_name.sql
+++ /dev/null
@@ -1,5 +0,0 @@
--- Persist the buyer's company name on the quote so re-editing remembers it and it can be shown on
--- the quote/agreement. Twin of Supabase migration 20260705000000_procurement_business_name.sql.
-
-ALTER TABLE stirling_pdf.procurement_quote
-    ADD COLUMN IF NOT EXISTS business_name VARCHAR(255);
diff --git a/app/saas/src/main/resources/db/migration/saas/V2__saas_columns.sql b/app/saas/src/main/resources/db/migration/saas/V2__saas_columns.sql
deleted file mode 100644
index 74f591c1df..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V2__saas_columns.sql
+++ /dev/null
@@ -1,7 +0,0 @@
--- SaaS-only column additions on top of the OSS users schema. Idempotent.
-
-ALTER TABLE users ADD COLUMN IF NOT EXISTS email VARCHAR(255);
-ALTER TABLE users ADD COLUMN IF NOT EXISTS supabase_id UUID;
-
-CREATE UNIQUE INDEX IF NOT EXISTS uk_users_email ON users (email);
-CREATE UNIQUE INDEX IF NOT EXISTS uk_users_supabase_id ON users (supabase_id);
diff --git a/app/saas/src/main/resources/db/migration/saas/V30__classification_labels.sql b/app/saas/src/main/resources/db/migration/saas/V30__classification_labels.sql
deleted file mode 100644
index 6ad5ce7cc5..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V30__classification_labels.sql
+++ /dev/null
@@ -1,13 +0,0 @@
--- Classification labels: the flat multi-label vocabulary the document
--- classifier runs against. One admin-editable row per team. The whole label set lives as JSON in
--- labels_json (authoritative on read). team_id is a natural key and a plain value (not a foreign
--- key) to stay decoupled from the security entities, so classification can be enabled or disabled
--- without touching them; the sentinel 0 holds the unteamed (login-disabled) team set. Hibernate
--- ddl-auto would also create this, but this keeps the schema explicit for Flyway-managed deploys.
-
-CREATE TABLE IF NOT EXISTS classification_labels (
-    team_id     BIGINT PRIMARY KEY,
-    labels_json TEXT,
-    updated_at  TIMESTAMP,
-    updated_by  VARCHAR(255)
-);
diff --git a/app/saas/src/main/resources/db/migration/saas/V30__procurement_offline_license.sql b/app/saas/src/main/resources/db/migration/saas/V30__procurement_offline_license.sql
deleted file mode 100644
index e7ca0233a7..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V30__procurement_offline_license.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- Offline / air-gapped licence add-on flag on the quote (a paid add-on; priced like QBR). Written
--- and read by the Java backend via JPA. Twin of Supabase migration
--- 20260710000000_procurement_offline_license.sql.
-
-ALTER TABLE stirling_pdf.procurement_quote
-    ADD COLUMN IF NOT EXISTS offline_license BOOLEAN NOT NULL DEFAULT false;
diff --git a/app/saas/src/main/resources/db/migration/saas/V31__policy_sort_order.sql b/app/saas/src/main/resources/db/migration/saas/V31__policy_sort_order.sql
deleted file mode 100644
index 2b2bdbd25b..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V31__policy_sort_order.sql
+++ /dev/null
@@ -1,5 +0,0 @@
--- Team-wide policy run order (see PolicyEntity.sortOrder). The order policies run in is stored
--- server-side and shared by the whole team (not per-user in the browser), and is admin-editable.
--- Nullable so existing rows keep working; reads treat a null as 0 (coalesce), and the store
--- appends a new policy at max(order)+1 so setting one up adds it to the end of the queue.
-ALTER TABLE policies ADD COLUMN sort_order INTEGER;
diff --git a/app/saas/src/main/resources/db/migration/saas/V31__procurement_intensity.sql b/app/saas/src/main/resources/db/migration/saas/V31__procurement_intensity.sql
deleted file mode 100644
index 4920d52d26..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V31__procurement_intensity.sql
+++ /dev/null
@@ -1,6 +0,0 @@
--- Policy posture (runs per PDF) on the quote: the D71 meter is denominated in runs, so a quote
--- must remember the posture it was priced at (Essentials 2, Governed 4, Regulated 7). Defaults to
--- Governed (4). Written and read by the Java backend via JPA. A Supabase twin migration mirrors it.
-
-ALTER TABLE stirling_pdf.procurement_quote
-    ADD COLUMN IF NOT EXISTS intensity INTEGER NOT NULL DEFAULT 4;
diff --git a/app/saas/src/main/resources/db/migration/saas/V32__policy_processed_files.sql b/app/saas/src/main/resources/db/migration/saas/V32__policy_processed_files.sql
deleted file mode 100644
index 3a3e136437..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V32__policy_processed_files.sql
+++ /dev/null
@@ -1,36 +0,0 @@
--- Per-policy processed-file ledger:
---
---   policy_processed_files  one row per (policy, file identity) recording the version a policy
---                           last settled that file at, so folder sources track files in place
---                           instead of moving them into a work directory. signature is a cheap
---                           version gate (folder: size:mtime); content_hash an optional strong
---                           token consulted only when the gate moves. Rows are claimed into
---                           PROCESSING, settled to DONE/ERROR, flipped to INTERRUPTED at boot if
---                           a run died with the JVM, and pruned once the file is gone from all of
---                           the policy's sources, so the table stays near the set of files
---                           currently present.
---
--- Hibernate ddl-auto would also create this, but the migration keeps the schema explicit for the
--- Flyway-managed deployments.
-
-CREATE TABLE IF NOT EXISTS policy_processed_files (
-    policy_id     VARCHAR(255)  NOT NULL,
-    identity_hash VARCHAR(64)   NOT NULL,
-    identity      VARCHAR(4096),
-    signature     VARCHAR(255)  NOT NULL,
-    content_hash  VARCHAR(64),
-    status        VARCHAR(16)   NOT NULL,
-    attempts      SMALLINT      NOT NULL DEFAULT 1,
-    last_seen     BIGINT        NOT NULL DEFAULT 0,
-    updated_at    BIGINT        NOT NULL DEFAULT 0,
-    PRIMARY KEY (policy_id, identity_hash)
-);
-
-CREATE INDEX IF NOT EXISTS idx_processed_files_policy_seen
-    ON policy_processed_files (policy_id, last_seen);
-
--- The cross-policy deletion-consensus check (existsByIdentityHashAndStatusNot) filters identity_hash
--- alone, so it cannot use the (policy_id, identity_hash) primary key; it runs once per successfully
--- consumed file, so index it to avoid a full scan on the hot path.
-CREATE INDEX IF NOT EXISTS idx_processed_files_identity
-    ON policy_processed_files (identity_hash);
diff --git a/app/saas/src/main/resources/db/migration/saas/V33__procurement_invoice_pdf.sql b/app/saas/src/main/resources/db/migration/saas/V33__procurement_invoice_pdf.sql
deleted file mode 100644
index 946b8415c6..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V33__procurement_invoice_pdf.sql
+++ /dev/null
@@ -1,7 +0,0 @@
--- Direct PDF link for a procurement quote's first invoice (Stripe invoice_pdf), stored at accept
--- alongside stripe_invoice_url so the portal's "Download invoice" button survives a reload instead
--- of relying on the transient accept response. Written by the accept edge function via the
--- procurement_set_quote_accepted RPC; read by the Java backend via JPA. A Supabase twin mirrors it.
-
-ALTER TABLE stirling_pdf.procurement_quote
-    ADD COLUMN IF NOT EXISTS stripe_invoice_pdf TEXT;
diff --git a/app/saas/src/main/resources/db/migration/saas/V34__procurement_deal_setup.sql b/app/saas/src/main/resources/db/migration/saas/V34__procurement_deal_setup.sql
deleted file mode 100644
index 186e180cb2..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V34__procurement_deal_setup.sql
+++ /dev/null
@@ -1,10 +0,0 @@
--- Deployment target + seat count captured at the trial-start step (the setup dialog the demo shows
--- before a trial begins), stored on the deal so the quote builder seeds from the buyer's real
--- environment instead of a hardcoded default. deployment: cloud | selfhost | airgap. seats: 0 =
--- unspecified. Written and read by the Java backend via JPA. A Supabase twin migration mirrors it.
-
-ALTER TABLE stirling_pdf.procurement_deal
-    ADD COLUMN IF NOT EXISTS deployment VARCHAR(16) NOT NULL DEFAULT 'cloud';
-
-ALTER TABLE stirling_pdf.procurement_deal
-    ADD COLUMN IF NOT EXISTS seats INTEGER NOT NULL DEFAULT 0;
diff --git a/app/saas/src/main/resources/db/migration/saas/V35__procurement_renewal.sql b/app/saas/src/main/resources/db/migration/saas/V35__procurement_renewal.sql
deleted file mode 100644
index 75a4479c31..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V35__procurement_renewal.sql
+++ /dev/null
@@ -1,7 +0,0 @@
--- Persist the first post-term renewal fee (annual net + one CPI step) computed at quote time, so the
--- figure shown to the buyer is locked to what they were quoted rather than recomputed from the
--- current rate card on every read. Minor units. Written and read by the Java backend via JPA; a
--- Supabase twin migration mirrors it.
-
-ALTER TABLE stirling_pdf.procurement_quote
-    ADD COLUMN IF NOT EXISTS renewal_annual_minor BIGINT NOT NULL DEFAULT 0;
diff --git a/app/saas/src/main/resources/db/migration/saas/V36__procurement_size_mult.sql b/app/saas/src/main/resources/db/migration/saas/V36__procurement_size_mult.sql
deleted file mode 100644
index 7c213cb3dc..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V36__procurement_size_mult.sql
+++ /dev/null
@@ -1,7 +0,0 @@
--- File-size tier multiplier on the quote (D93): larger, image-heavy PDFs cost more, so the buyer
--- picks a size tier (Compact 1.0 / Standard 1.4 / Heavy 2.4) that scales the per-run rate. Persisted
--- so the quote re-prices and re-seeds the builder consistently. Defaults to 1.0 (no uplift) for rows
--- that predate the column. Written and read by the Java backend via JPA. A Supabase twin mirrors it.
-
-ALTER TABLE stirling_pdf.procurement_quote
-    ADD COLUMN IF NOT EXISTS size_mult DOUBLE PRECISION NOT NULL DEFAULT 1.0;
diff --git a/app/saas/src/main/resources/db/migration/saas/V37__procurement_quote_billing_details.sql b/app/saas/src/main/resources/db/migration/saas/V37__procurement_quote_billing_details.sql
deleted file mode 100644
index 3f07f201bb..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V37__procurement_quote_billing_details.sql
+++ /dev/null
@@ -1,17 +0,0 @@
--- Buyer / AP details captured on the quote's "Your details" step: the signatory contact and a
--- billing address, plus a PO number and tax id for the invoice. All optional (never gate quote
--- generation). Persisted so the quote re-seeds the builder on a re-edit and so the issue edge
--- function can put them on the Stripe customer (name + bill-to address) and invoice (PO / tax id
--- as custom fields). Country and currency are intentionally out of scope for now. Written and read
--- by the Java backend via JPA. A Supabase twin mirrors these columns.
-
-ALTER TABLE stirling_pdf.procurement_quote
-    ADD COLUMN IF NOT EXISTS contact_name  VARCHAR(255),
-    ADD COLUMN IF NOT EXISTS contact_email VARCHAR(255),
-    ADD COLUMN IF NOT EXISTS address_line1 VARCHAR(255),
-    ADD COLUMN IF NOT EXISTS address_line2 VARCHAR(255),
-    ADD COLUMN IF NOT EXISTS city          VARCHAR(128),
-    ADD COLUMN IF NOT EXISTS region        VARCHAR(128),
-    ADD COLUMN IF NOT EXISTS postal_code   VARCHAR(32),
-    ADD COLUMN IF NOT EXISTS po_number     VARCHAR(128),
-    ADD COLUMN IF NOT EXISTS tax_id        VARCHAR(64);
diff --git a/app/saas/src/main/resources/db/migration/saas/V38__payg_run_grouping_doc_count.sql b/app/saas/src/main/resources/db/migration/saas/V38__payg_run_grouping_doc_count.sql
deleted file mode 100644
index bc1a4e0f16..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V38__payg_run_grouping_doc_count.sql
+++ /dev/null
@@ -1,39 +0,0 @@
--- PAYG size-scaled billing: run-scoped grouping + per-input-file counting.
---
--- Two independent axes now live on a charge:
---   * doc_units  — billing quantity, scales with file size (existing column)
---   * doc_count  — number of INPUT files (the "unique PDFs" dimension); a split (1→many) stays 1,
---                  a merge (N→1) is N. Fixed at open; joined steps never change it.
--- Plus run_id, the automation-run correlation id used to group a run's tool sub-steps into one
--- charge (replacing the old content+time-window grouping) and to keep two separate runs distinct.
---
--- Everything is additive; no existing rows are modified, no columns dropped.
-
--- ── processing_job ───────────────────────────────────────────────────────────
-ALTER TABLE processing_job ADD COLUMN IF NOT EXISTS run_id VARCHAR(64);
-ALTER TABLE processing_job ADD COLUMN IF NOT EXISTS doc_count INTEGER NOT NULL DEFAULT 1;
-
-COMMENT ON COLUMN processing_job.run_id IS
-    'Automation-run correlation id (X-Stirling-Run-Id); NULL for a standalone tool call. Lineage '
-    'joins are scoped to one run_id, so separate runs never merge even on identical bytes.';
-COMMENT ON COLUMN processing_job.doc_count IS
-    'Number of input files this charge represents (the count dimension, distinct from size-scaled '
-    'doc_units). Split=1, merge=N. Fixed at open.';
-
--- ── wallet_ledger ────────────────────────────────────────────────────────────
--- Denormalise the count dimension + input fingerprint onto the DEBIT row so usage analytics
--- (unique PDFs, per-category counts, size-multiplier average) query one table and survive
--- processing_job pruning.
-ALTER TABLE wallet_ledger ADD COLUMN IF NOT EXISTS doc_count INTEGER NOT NULL DEFAULT 1;
-ALTER TABLE wallet_ledger ADD COLUMN IF NOT EXISTS document_fingerprint VARCHAR(64);
-
-COMMENT ON COLUMN wallet_ledger.doc_count IS
-    'Input-file count for this entry (mirrors processing_job.doc_count); summed for "PDFs processed".';
-COMMENT ON COLUMN wallet_ledger.document_fingerprint IS
-    'SHA-256 of the entry''s input file set; COUNT(DISTINCT ...) gives unique PDFs. NULL for '
-    'aggregate/system entries (e.g. linked-instance sync).';
-
--- Distinct-PDF + size-multiplier queries scan by team + period.
-CREATE INDEX IF NOT EXISTS idx_wallet_ledger_team_period_fp
-    ON wallet_ledger (team_id, occurred_at, document_fingerprint)
-    WHERE document_fingerprint IS NOT NULL;
diff --git a/app/saas/src/main/resources/db/migration/saas/V39__drop_classification_labels.sql b/app/saas/src/main/resources/db/migration/saas/V39__drop_classification_labels.sql
deleted file mode 100644
index 9ef97f9f99..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V39__drop_classification_labels.sql
+++ /dev/null
@@ -1,10 +0,0 @@
--- Classification labels are now a fixed, built-in set bundled with the app and sent to the engine
--- per request (see ClassificationLabelProvider); the per-team classification_labels table (created
--- in V30) is no longer read or written. Drop it.
---
--- Forward migration: V30 is kept so any DB that already applied it still validates. This runs after
--- V30 in every case, so it drops the table whether V30 just created it (fresh DB) or it was created
--- and populated on an earlier deploy. IF EXISTS only guards the edge case where the table is already
--- absent, keeping the migration safe to apply regardless of prior state.
-
-DROP TABLE IF EXISTS classification_labels;
diff --git a/app/saas/src/main/resources/db/migration/saas/V3__saas_billing.sql b/app/saas/src/main/resources/db/migration/saas/V3__saas_billing.sql
deleted file mode 100644
index 169f58cce5..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V3__saas_billing.sql
+++ /dev/null
@@ -1,16 +0,0 @@
--- Stripe billing subscription mirror, populated by Supabase webhooks.
-
-CREATE TABLE IF NOT EXISTS billing_subscriptions (
-    id                  VARCHAR(255) PRIMARY KEY,
-    user_id             UUID         NOT NULL,
-    team_id             BIGINT,
-    status              VARCHAR(64)  NOT NULL,
-    price_id            VARCHAR(255),
-    current_period_end  TIMESTAMP,
-    created_at          TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at          TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX IF NOT EXISTS idx_billing_subscriptions_user_id ON billing_subscriptions (user_id);
-CREATE INDEX IF NOT EXISTS idx_billing_subscriptions_team_id ON billing_subscriptions (team_id);
-CREATE INDEX IF NOT EXISTS idx_billing_subscriptions_status ON billing_subscriptions (status);
diff --git a/app/saas/src/main/resources/db/migration/saas/V4__saas_credits.sql b/app/saas/src/main/resources/db/migration/saas/V4__saas_credits.sql
deleted file mode 100644
index 63384bdd5a..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V4__saas_credits.sql
+++ /dev/null
@@ -1,39 +0,0 @@
--- Per-user and per-team credit pools.
-
-CREATE TABLE IF NOT EXISTS user_credits (
-    credit_id                BIGSERIAL PRIMARY KEY,
-    user_id                  BIGINT       NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
-    cycle_credits_remaining  INTEGER      NOT NULL DEFAULT 0,
-    cycle_credits_allocated  INTEGER      NOT NULL DEFAULT 0,
-    bought_credits_remaining INTEGER      NOT NULL DEFAULT 0,
-    total_bought_credits     INTEGER      NOT NULL DEFAULT 0,
-    last_cycle_reset_at      TIMESTAMP,
-    last_api_usage           TIMESTAMP,
-    total_api_calls_made     BIGINT       NOT NULL DEFAULT 0,
-    created_at               TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at               TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    version                  BIGINT       NOT NULL DEFAULT 0,
-    CONSTRAINT uk_user_credits_user_id UNIQUE (user_id)
-);
-
-CREATE INDEX IF NOT EXISTS idx_user_credits_user_id     ON user_credits (user_id);
-CREATE INDEX IF NOT EXISTS idx_user_credits_last_reset  ON user_credits (last_cycle_reset_at);
-CREATE INDEX IF NOT EXISTS idx_user_credits_last_usage  ON user_credits (last_api_usage);
-
-CREATE TABLE IF NOT EXISTS team_credits (
-    credit_id                BIGSERIAL PRIMARY KEY,
-    team_id                  BIGINT       NOT NULL UNIQUE REFERENCES teams(id) ON DELETE CASCADE,
-    cycle_credits_remaining  INTEGER      NOT NULL DEFAULT 0,
-    cycle_credits_allocated  INTEGER      NOT NULL DEFAULT 0,
-    bought_credits_remaining INTEGER      NOT NULL DEFAULT 0,
-    total_bought_credits     INTEGER      NOT NULL DEFAULT 0,
-    last_cycle_reset_at      TIMESTAMP,
-    last_api_usage           TIMESTAMP,
-    total_api_calls_made     BIGINT       NOT NULL DEFAULT 0,
-    created_at               TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at               TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    version                  BIGINT       NOT NULL DEFAULT 0
-);
-
-CREATE INDEX IF NOT EXISTS idx_team_credits_team_id    ON team_credits (team_id);
-CREATE INDEX IF NOT EXISTS idx_team_credits_last_reset ON team_credits (last_cycle_reset_at);
diff --git a/app/saas/src/main/resources/db/migration/saas/V5__saas_teams.sql b/app/saas/src/main/resources/db/migration/saas/V5__saas_teams.sql
deleted file mode 100644
index dccacfe2b7..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V5__saas_teams.sql
+++ /dev/null
@@ -1,40 +0,0 @@
--- Team memberships and email-based team invitations.
-
-CREATE TABLE IF NOT EXISTS team_memberships (
-    membership_id        BIGSERIAL PRIMARY KEY,
-    team_id              BIGINT       NOT NULL REFERENCES teams(id)       ON DELETE CASCADE,
-    user_id              BIGINT       NOT NULL REFERENCES users(user_id)  ON DELETE CASCADE,
-    role                 VARCHAR(50)  NOT NULL DEFAULT 'MEMBER',
-    invited_by_user_id   BIGINT       REFERENCES users(user_id) ON DELETE SET NULL,
-    invited_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    accepted_at          TIMESTAMP,
-    created_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    CONSTRAINT uk_team_memberships_team_user UNIQUE (team_id, user_id),
-    CONSTRAINT chk_team_memberships_role     CHECK (role IN ('LEADER', 'MEMBER'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_team_memberships_team      ON team_memberships (team_id);
-CREATE INDEX IF NOT EXISTS idx_team_memberships_user      ON team_memberships (user_id);
-CREATE INDEX IF NOT EXISTS idx_team_memberships_team_role ON team_memberships (team_id, role);
-
-CREATE TABLE IF NOT EXISTS team_invitations (
-    invitation_id        BIGSERIAL PRIMARY KEY,
-    team_id              BIGINT       NOT NULL REFERENCES teams(id)       ON DELETE CASCADE,
-    inviter_user_id      BIGINT       NOT NULL REFERENCES users(user_id)  ON DELETE CASCADE,
-    invitee_email        VARCHAR(255) NOT NULL,
-    invitee_user_id      BIGINT       REFERENCES users(user_id) ON DELETE CASCADE,
-    status               VARCHAR(50)  NOT NULL DEFAULT 'PENDING',
-    invitation_token     VARCHAR(255) UNIQUE NOT NULL,
-    expires_at           TIMESTAMP    NOT NULL,
-    created_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    CONSTRAINT chk_team_invitations_status CHECK (
-        status IN ('PENDING', 'ACCEPTED', 'REJECTED', 'CANCELLED', 'EXPIRED')
-    )
-);
-
-CREATE INDEX IF NOT EXISTS idx_team_invitations_team   ON team_invitations (team_id);
-CREATE INDEX IF NOT EXISTS idx_team_invitations_email  ON team_invitations (invitee_email);
-CREATE INDEX IF NOT EXISTS idx_team_invitations_token  ON team_invitations (invitation_token);
-CREATE INDEX IF NOT EXISTS idx_team_invitations_status ON team_invitations (status);
diff --git a/app/saas/src/main/resources/db/migration/saas/V6__saas_user_error_tracker.sql b/app/saas/src/main/resources/db/migration/saas/V6__saas_user_error_tracker.sql
deleted file mode 100644
index 12f6a16b00..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V6__saas_user_error_tracker.sql
+++ /dev/null
@@ -1,15 +0,0 @@
--- Per-user processing-error tracker.
-
-CREATE TABLE IF NOT EXISTS user_error_tracker (
-    error_tracker_id        BIGSERIAL PRIMARY KEY,
-    user_id                 BIGINT       NOT NULL REFERENCES users(user_id) ON DELETE CASCADE,
-    endpoint                VARCHAR(255),
-    processing_error_count  INTEGER      NOT NULL DEFAULT 0,
-    last_processing_error   TIMESTAMP,
-    reset_after             TIMESTAMP,
-    created_at              TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at              TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX IF NOT EXISTS idx_user_error_tracker_user_id  ON user_error_tracker (user_id);
-CREATE INDEX IF NOT EXISTS idx_user_error_tracker_endpoint ON user_error_tracker (endpoint);
diff --git a/app/saas/src/main/resources/db/migration/saas/V8__saas_ai_create_sessions.sql b/app/saas/src/main/resources/db/migration/saas/V8__saas_ai_create_sessions.sql
deleted file mode 100644
index 1b8364793c..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V8__saas_ai_create_sessions.sql
+++ /dev/null
@@ -1,28 +0,0 @@
--- AI document-creation sessions for chat / outline-to-PDF flows.
-
-CREATE TABLE IF NOT EXISTS ai_create_sessions (
-    session_id           VARCHAR(64)  PRIMARY KEY,
-    user_id              VARCHAR(255) NOT NULL,
-    doc_type             VARCHAR(255),
-    template_id          VARCHAR(255),
-    template_tex         VARCHAR(255),
-    preview_tex          VARCHAR(255),
-    prompt_initial       TEXT,
-    prompt_latest        TEXT,
-    outline_text         TEXT,
-    outline_filename     VARCHAR(255),
-    outline_approved     BOOLEAN      NOT NULL DEFAULT FALSE,
-    outline_constraints  TEXT,
-    draft_sections       TEXT,
-    polished_latex       TEXT,
-    pdf_url              VARCHAR(2048),
-    status               VARCHAR(32)  NOT NULL,
-    created_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at           TIMESTAMP    NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX IF NOT EXISTS idx_ai_create_sessions_user_id    ON ai_create_sessions (user_id);
-CREATE INDEX IF NOT EXISTS idx_ai_create_sessions_updated_at ON ai_create_sessions (updated_at DESC);
-CREATE INDEX IF NOT EXISTS idx_ai_create_sessions_user_pdf
-    ON ai_create_sessions (user_id, updated_at DESC)
-    WHERE pdf_url IS NOT NULL;
diff --git a/app/saas/src/main/resources/db/migration/saas/V9__saas_user_team_extensions.sql b/app/saas/src/main/resources/db/migration/saas/V9__saas_user_team_extensions.sql
deleted file mode 100644
index df9b8000ca..0000000000
--- a/app/saas/src/main/resources/db/migration/saas/V9__saas_user_team_extensions.sql
+++ /dev/null
@@ -1,77 +0,0 @@
--- Saas-only sidecar tables for user and team metadata.
-
-CREATE TABLE IF NOT EXISTS saas_user_extensions (
-    user_id                      BIGINT      PRIMARY KEY REFERENCES users(user_id) ON DELETE CASCADE,
-    has_metered_billing_enabled  BOOLEAN     NOT NULL DEFAULT FALSE,
-    api_key_first_used_at        TIMESTAMP,
-    created_at                   TIMESTAMP   NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at                   TIMESTAMP   NOT NULL DEFAULT CURRENT_TIMESTAMP
-);
-
-CREATE INDEX IF NOT EXISTS idx_saas_user_extensions_metered_billing
-    ON saas_user_extensions (has_metered_billing_enabled);
-
-CREATE TABLE IF NOT EXISTS saas_team_extensions (
-    team_id              BIGINT      PRIMARY KEY REFERENCES teams(id) ON DELETE CASCADE,
-    team_type            VARCHAR(32) NOT NULL DEFAULT 'STANDARD',
-    is_personal          BOOLEAN     NOT NULL DEFAULT FALSE,
-    seat_count           INTEGER     NOT NULL DEFAULT 1,
-    seats_used           INTEGER     NOT NULL DEFAULT 0,
-    max_seats            INTEGER     NOT NULL DEFAULT 1,
-    created_by_user_id   BIGINT,
-    created_at           TIMESTAMP   NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    updated_at           TIMESTAMP   NOT NULL DEFAULT CURRENT_TIMESTAMP,
-    version              BIGINT      NOT NULL DEFAULT 0
-);
-
-CREATE INDEX IF NOT EXISTS idx_saas_team_extensions_is_personal
-    ON saas_team_extensions (is_personal);
-CREATE INDEX IF NOT EXISTS idx_saas_team_extensions_created_by_user_id
-    ON saas_team_extensions (created_by_user_id);
-
--- Backfill from any pre-existing columns on users / teams, then drop them.
-DO $$
-BEGIN
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_schema = 'public'
-          AND table_name = 'users'
-          AND column_name = 'has_metered_billing_enabled'
-    ) THEN
-        INSERT INTO saas_user_extensions (user_id, has_metered_billing_enabled, api_key_first_used_at)
-        SELECT user_id, COALESCE(has_metered_billing_enabled, FALSE), api_key_first_used_at
-        FROM users
-        ON CONFLICT (user_id) DO NOTHING;
-    END IF;
-
-    IF EXISTS (
-        SELECT 1 FROM information_schema.columns
-        WHERE table_schema = 'public'
-          AND table_name = 'teams'
-          AND column_name = 'team_type'
-    ) THEN
-        INSERT INTO saas_team_extensions (
-            team_id, team_type, is_personal, seat_count, seats_used, max_seats, created_by_user_id
-        )
-        SELECT id,
-               COALESCE(team_type, 'STANDARD'),
-               COALESCE(is_personal, FALSE),
-               COALESCE(seat_count, 1),
-               COALESCE(seats_used, 0),
-               COALESCE(max_seats, 1),
-               created_by_user_id
-        FROM teams
-        ON CONFLICT (team_id) DO NOTHING;
-
-        ALTER TABLE teams DROP COLUMN IF EXISTS team_type;
-        ALTER TABLE teams DROP COLUMN IF EXISTS is_personal;
-        ALTER TABLE teams DROP COLUMN IF EXISTS seat_count;
-        ALTER TABLE teams DROP COLUMN IF EXISTS seats_used;
-        ALTER TABLE teams DROP COLUMN IF EXISTS max_seats;
-        ALTER TABLE teams DROP COLUMN IF EXISTS created_by_user_id;
-    END IF;
-
-    ALTER TABLE users DROP COLUMN IF EXISTS has_metered_billing_enabled;
-    ALTER TABLE users DROP COLUMN IF EXISTS api_key_first_used_at;
-END
-$$;
diff --git a/testing/compose/docker-compose-saas.yml b/testing/compose/docker-compose-saas.yml
index 880518b423..1965bb5a64 100644
--- a/testing/compose/docker-compose-saas.yml
+++ b/testing/compose/docker-compose-saas.yml
@@ -1,8 +1,9 @@
 services:
   # ---------------------------------------------------------------------
-  # Postgres holding the stirling_pdf schema. Flyway migrates V1-V13 on
-  # backend startup against this DB. Exposed on host port 5433 so the
-  # cucumber harness can connect via psycopg from features/steps/payg_*.
+  # Postgres holding the stirling_pdf schema, built by Hibernate
+  # ddl-auto=create-drop when the backend starts (see below). Exposed on
+  # host port 5433 so the cucumber harness can connect via psycopg from
+  # features/steps/payg_*.
   # ---------------------------------------------------------------------
   postgres-saas:
     image: postgres:17-alpine
@@ -69,14 +70,11 @@ services:
       SAAS_DB_PASSWORD: "postgres"
       SAAS_DB_PROJECT_REF: "disabled"
 
-      # The saas Flyway migrations assume `users` and `teams` already exist
-      # (V2 ALTERs `users`; V5 references `teams(id)`) because in production
-      # those tables are provisioned by Supabase before Stirling starts. On
-      # a clean test postgres they don't exist, so we disable Flyway and let
-      # Hibernate's `ddl-auto=create-drop` build the full schema from the
-      # entity graph. The default-pricing-policy row that V12 seeds in
-      # production is re-seeded by testing/compose/payg/saas-seed.sql.
-      SPRING_FLYWAY_ENABLED: "false"
+      # On a clean test postgres the Supabase-provisioned `users`/`teams`
+      # tables don't exist, so we let Hibernate's `ddl-auto=create-drop`
+      # build the full schema from the entity graph. The default-pricing-
+      # policy row (seeded in production by the Supabase migrations) is
+      # re-seeded here by testing/compose/payg/saas-seed.sql.
       SPRING_JPA_HIBERNATE_DDL_AUTO: "create-drop"
 
       # Disable Supabase JWT enforcement for the test profile. The

From 5e3e89ccb2bbf3b662109bae07059d4557bd8b8c Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Tue, 21 Jul 2026 14:57:45 +0100
Subject: [PATCH 071/109] Fix existing teams logic (#7070)

# Description of Changes
Paired with https://github.com/Stirling-Tools/Stirling-PDF-SaaS/pull/320

Fixes the following bugs we found when testing the SaaS release:
- Existing users couldn't join teams - this was because they were the
last leader of their team, so it'd be left orphaned). Users now have a
'home team', which can have no members if they join another team, but
they can then go back to it later.
- Existing leaders didn't have unlimited seats - `saas_teams_extensions`
had no row for them, so the app fell back to `max_seats=1`. The
migration script fixes it.
- Members without Processor access could still access the Processor - It
was just checking "Are you the leader of **any** team", instead of the
user's active team.
---
 .../access/service/ResourceAccessService.java |  19 +-
 .../api/ProprietaryUIDataController.java      |  30 ++-
 .../ResourceAccessPortalBulkParityTest.java   |   5 +-
 .../service/ResourceAccessServiceTest.java    |  27 +-
 .../saas/model/SaasUserExtensions.java        |   5 +
 .../SupabaseAuthenticationFilter.java         |   6 +-
 .../saas/service/SaasTeamService.java         | 252 ++++++++----------
 .../service/SaasUserExtensionService.java     |  15 ++
 .../SupabaseAuthenticationFilterMoreTest.java |   2 +
 .../saas/service/SaasTeamServiceTest.java     | 149 ++++++-----
 .../service/SaasUserExtensionServiceTest.java |  38 +++
 .../auth/PortalAuthBoundary.test.tsx          |  77 ++++--
 .../portal-saas/auth/PortalAuthBoundary.tsx   |  44 ++-
 .../proprietary/auth/supabase/UseSession.tsx  |  85 +++---
 14 files changed, 466 insertions(+), 288 deletions(-)

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/access/service/ResourceAccessService.java b/app/proprietary/src/main/java/stirling/software/proprietary/access/service/ResourceAccessService.java
index b3c987d6f2..7642dded85 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/access/service/ResourceAccessService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/access/service/ResourceAccessService.java
@@ -43,8 +43,13 @@ public class ResourceAccessService {
         return canUseResource(ResourceType.PORTAL, "", null, portalDefaultPolicy, user);
     }
 
-    /** Portal access for a roster (admin, grant, or default policy). */
-    public Set<Long> usersWithPortalAccess(Collection<User> users, Set<Long> teamLeaderUserIds) {
+    /**
+     * Portal access for a roster (admin, grant, or default policy). {@code activeTeamLeaderUserIds}
+     * must hold ids of users who lead their own active team — the set the ADMINS_AND_TEAM_LEADS
+     * default admits, matching {@link #canAccessPortal}.
+     */
+    public Set<Long> usersWithPortalAccess(
+            Collection<User> users, Set<Long> activeTeamLeaderUserIds) {
         Set<PrincipalRef> grantedPrincipals = new HashSet<>();
         for (ResourceGrant g :
                 grantRepository.findByResourceTypeAndResourceId(ResourceType.PORTAL, "")) {
@@ -52,7 +57,7 @@ public class ResourceAccessService {
                 grantedPrincipals.add(new PrincipalRef(g.getPrincipalType(), g.getPrincipalId()));
             }
         }
-        Set<Long> leaderIds = teamLeaderUserIds == null ? Set.of() : teamLeaderUserIds;
+        Set<Long> leaderIds = activeTeamLeaderUserIds == null ? Set.of() : activeTeamLeaderUserIds;
         Set<Long> allowed = new HashSet<>();
         for (User user : users) {
             if (user != null
@@ -214,11 +219,13 @@ public class ResourceAccessService {
         };
     }
 
-    // Portal (no owner) admits any team lead; a team-owned resource admits only that team's
-    // leads; a user-owned resource admits no extra leads.
+    // Portal (no owner) admits the leader of the user's active team; a team-owned resource
+    // admits only that team's leads; a user-owned resource admits no extra leads.
     private boolean matchesTeamLeadDefault(PrincipalRef owner, User user) {
         if (owner == null) {
-            return teamLeadLookup.isAnyTeamLeader(user);
+            return user.getTeam() != null
+                    && user.getTeam().getId() != null
+                    && teamLeadLookup.isLeaderOfTeam(user, user.getTeam().getId());
         }
         return owner.type() == PrincipalType.TEAM
                 && owner.id() != null
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java
index 2c0b995b8b..02fa1e0b25 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ProprietaryUIDataController.java
@@ -345,10 +345,27 @@ public class ProprietaryUIDataController {
         int licenseMaxUsers = licenseSettingsService.getSettings().getLicenseMaxUsers();
         boolean premiumEnabled = applicationProperties.getPremium().isEnabled();
 
-        // Resolve portal access for the whole roster.
-        Set<Long> leaderUserIds = leaderUserIds();
+        // Resolve portal access for the whole roster. The teamLead display flag counts a
+        // LEADER membership on any team (mirrors /me), but the portal default policy only
+        // admits leaders of their own active team, so the bulk check gets the narrower set.
+        List<TeamMembership> leaderMemberships =
+                teamMembershipRepository.findByRoleFetchingUserAndTeam(TeamRole.LEADER);
+        Set<Long> leaderUserIds =
+                leaderMemberships.stream()
+                        .map(row -> row.getUser().getId())
+                        .collect(Collectors.toSet());
+        Set<Long> activeTeamLeaderUserIds =
+                leaderMemberships.stream()
+                        .filter(
+                                row ->
+                                        row.getUser().getTeam() != null
+                                                && row.getTeam()
+                                                        .getId()
+                                                        .equals(row.getUser().getTeam().getId()))
+                        .map(row -> row.getUser().getId())
+                        .collect(Collectors.toSet());
         Set<Long> portalAccessUserIds =
-                resourceAccessService.usersWithPortalAccess(sortedUsers, leaderUserIds);
+                resourceAccessService.usersWithPortalAccess(sortedUsers, activeTeamLeaderUserIds);
         List<AdminUserSummary> userSummaries =
                 sortedUsers.stream()
                         .map(user -> convertUserToSummary(user, leaderUserIds, portalAccessUserIds))
@@ -536,13 +553,6 @@ public class ProprietaryUIDataController {
         return ResponseEntity.ok(data);
     }
 
-    /** User ids holding a LEADER membership on any team. */
-    private Set<Long> leaderUserIds() {
-        return teamMembershipRepository.findByRoleFetchingUserAndTeam(TeamRole.LEADER).stream()
-                .map(row -> row.getUser().getId())
-                .collect(Collectors.toSet());
-    }
-
     /** Whether the user holds the internal-API authority (never shown in the roster). */
     private boolean isInternalApiUser(User user) {
         for (Authority authority : user.getAuthorities()) {
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessPortalBulkParityTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessPortalBulkParityTest.java
index 858de91726..ba73fd2149 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessPortalBulkParityTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessPortalBulkParityTest.java
@@ -62,8 +62,9 @@ class ResourceAccessPortalBulkParityTest {
                                 grant(PrincipalType.USER, 3L, AccessPermission.USE),
                                 grant(PrincipalType.TEAM, 20L, AccessPermission.USE)));
 
-        // Only #2 leads a team; leaderUserIds is what the controller passes to the bulk method.
-        lenient().when(teamLeadLookup.isAnyTeamLeader(leader)).thenReturn(true);
+        // Only #2 leads their active team; leaderUserIds is what the controller passes to the
+        // bulk method (the active-team-leader set).
+        lenient().when(teamLeadLookup.isLeaderOfTeam(leader, 10L)).thenReturn(true);
         leaderUserIds = Set.of(2L);
     }
 
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessServiceTest.java
index c63e6b8e47..90019c8cbb 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessServiceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/access/service/ResourceAccessServiceTest.java
@@ -239,10 +239,10 @@ class ResourceAccessServiceTest {
     }
 
     @Test
-    void teamLeadDefaultAllowsLeaderButNotRegularUser() {
+    void teamLeadDefaultAllowsActiveTeamLeaderButNotRegularUser() {
         stubGrants();
-        User leader = user(5);
-        when(teamLeadLookup.isAnyTeamLeader(leader)).thenReturn(true);
+        User leader = userInTeam(5, 7L);
+        when(teamLeadLookup.isLeaderOfTeam(leader, 7L)).thenReturn(true);
         assertThat(
                         service.canUseResource(
                                 TYPE, RID, null, DefaultAccessPolicy.ADMINS_AND_TEAM_LEADS, leader))
@@ -291,6 +291,27 @@ class ResourceAccessServiceTest {
         assertThat(service.canAccessPortal(user(5))).isFalse();
     }
 
+    @Test
+    void portalAllowedToLeaderOfActiveTeam() {
+        when(grantRepository.findByResourceTypeAndResourceId(ResourceType.PORTAL, ""))
+                .thenReturn(List.of());
+        User leader = userInTeam(10, 21L);
+        when(teamLeadLookup.isLeaderOfTeam(leader, 21L)).thenReturn(true);
+        assertThat(service.canAccessPortal(leader)).isTrue();
+    }
+
+    @Test
+    void portalDeniedToMemberWhoseActiveTeamTheyDoNotLead() {
+        // Durable home teams: a user still leads their dormant home team, but their ACTIVE
+        // team is one they only belong to -> no portal access (this is the bug-3 guard that
+        // active-team leadership preserves once home teams stop being deleted on join).
+        when(grantRepository.findByResourceTypeAndResourceId(ResourceType.PORTAL, ""))
+                .thenReturn(List.of());
+        User member = userInTeam(11, 22L);
+        // isLeaderOfTeam(member, 22L) left unstubbed -> false: member of active team.
+        assertThat(service.canAccessPortal(member)).isFalse();
+    }
+
     // ---- helpers ----
 
     private void stubGrants(ResourceGrant... grants) {
diff --git a/app/saas/src/main/java/stirling/software/saas/model/SaasUserExtensions.java b/app/saas/src/main/java/stirling/software/saas/model/SaasUserExtensions.java
index d483f848de..036fdd27be 100644
--- a/app/saas/src/main/java/stirling/software/saas/model/SaasUserExtensions.java
+++ b/app/saas/src/main/java/stirling/software/saas/model/SaasUserExtensions.java
@@ -57,6 +57,11 @@ public class SaasUserExtensions implements Serializable {
     @Column(name = "api_key_first_used_at")
     private LocalDateTime apiKeyFirstUsedAt;
 
+    // Durable "home team" the user returns to when leaving a joined team; distinct from the
+    // active users.team_id. Plain id (not a @ManyToOne) to avoid an eager Team load. Nullable.
+    @Column(name = "home_team_id")
+    private Long homeTeamId;
+
     @CreationTimestamp
     @Column(name = "created_at", updatable = false)
     private LocalDateTime createdAt;
diff --git a/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java b/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
index aa678f7cbf..34bcccfeb7 100644
--- a/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
+++ b/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
@@ -380,8 +380,10 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
                                                     dup));
         }
 
-        // Only the DB-race winner runs first-time init; the losers skip it.
-        if (weCreatedThisUser) {
+        // Only the DB-race winner runs first-time init; the losers skip it. Guests (anonymous
+        // sessions) get NO team: the editor is free and needs none, and automation requires a
+        // real account.
+        if (weCreatedThisUser && !isAnonymous(jwt)) {
             try {
                 savedUser.setTeam(saasTeamService.ensurePersonalTeam(savedUser));
             } catch (Exception e) {
diff --git a/app/saas/src/main/java/stirling/software/saas/service/SaasTeamService.java b/app/saas/src/main/java/stirling/software/saas/service/SaasTeamService.java
index 94996ca01c..bda0602261 100644
--- a/app/saas/src/main/java/stirling/software/saas/service/SaasTeamService.java
+++ b/app/saas/src/main/java/stirling/software/saas/service/SaasTeamService.java
@@ -46,19 +46,9 @@ public class SaasTeamService {
     private final UserRoleService userRoleService;
     private final SaasTeamExtensionService saasTeamExtensionService;
     private final SaasTeamExtensionsRepository saasTeamExtensionsRepository;
+    private final SaasUserExtensionService saasUserExtensionService;
     private final LinkedInstanceRepository linkedInstanceRepository;
     private final stirling.software.proprietary.security.service.UserService userService;
-    private final stirling.software.proprietary.access.repository.ResourceGrantRepository
-            resourceGrantRepository;
-    private final stirling.software.proprietary.integration.repository.IntegrationConfigRepository
-            integrationConfigRepository;
-
-    // Team-owned integration configs + team grants FK the teams row; purge before deleting a team.
-    private void purgeTeamOwnedResources(Long teamId) {
-        integrationConfigRepository.deleteByOwnerTeam_Id(teamId);
-        resourceGrantRepository.deleteByPrincipalTypeAndPrincipalId(
-                stirling.software.proprietary.access.model.PrincipalType.TEAM, teamId);
-    }
 
     public static final String DEFAULT_TEAM_NAME = "Default";
     public static final String INTERNAL_TEAM_NAME = "Internal";
@@ -114,6 +104,9 @@ public class SaasTeamService {
         user.setTeam(savedTeam);
         userRepository.save(user);
 
+        // A freshly-created personal team is the user's durable home team.
+        saasUserExtensionService.setHomeTeamId(user, savedTeam.getId());
+
         // Clean up old Default/Internal team membership
         if (oldTeam != null
                 && (DEFAULT_TEAM_NAME.equals(oldTeam.getName())
@@ -129,6 +122,54 @@ public class SaasTeamService {
         return savedTeam;
     }
 
+    /**
+     * The user's durable home team id (the team they fall back to when leaving a joined team). Uses
+     * the stored pointer; if unset (e.g. an existing user before the backfill), derives it from a
+     * solo team they lead and persists it. Returns null when the user has no such team (e.g. they
+     * joined under the old delete-on-join flow); callers mint a fresh home in that case.
+     */
+    private Long resolveHomeTeamId(User user) {
+        Long homeId = saasUserExtensionService.getHomeTeamId(user);
+        if (homeId != null) {
+            return homeId;
+        }
+        for (TeamMembership m : membershipRepository.findByUserId(user.getId())) {
+            if (m.isLeader() && membershipRepository.countByTeamId(m.getTeam().getId()) == 1) {
+                saasUserExtensionService.setHomeTeamId(user, m.getTeam().getId());
+                return m.getTeam().getId();
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Move the user back to their durable home team. Reuses the existing home membership when
+     * present (the durable model keeps it across joins); mints a fresh personal home team only when
+     * the user has none.
+     */
+    private void returnUserToHome(User user) {
+        Long homeId = resolveHomeTeamId(user);
+        Team home = homeId == null ? null : teamRepository.findById(homeId).orElse(null);
+        if (home == null) {
+            createPersonalTeam(user);
+            return;
+        }
+        if (membershipRepository.findByTeamIdAndUserId(home.getId(), user.getId()).isEmpty()) {
+            TeamMembership membership = new TeamMembership();
+            membership.setTeam(home);
+            membership.setUser(user);
+            membership.setRole(TeamRole.LEADER);
+            membership.setInvitedAt(LocalDateTime.now());
+            membership.setAcceptedAt(LocalDateTime.now());
+            membershipRepository.save(membership);
+            // Ignore the result: a full home returns 0, the correct end state (1 member = 1 seat) -
+            // throwing here would wrongly block the return.
+            saasTeamExtensionsRepository.incrementSeatsUsed(home.getId());
+        }
+        userRepository.updateUserTeamId(user.getId(), home.getId());
+        user.setTeam(home);
+    }
+
     /**
      * Invite user to team (sends email via Supabase Edge Function)
      *
@@ -314,29 +355,29 @@ public class SaasTeamService {
             throw new IllegalStateException("Team has no available seats");
         }
 
-        // Validate: accepting won't orphan a team the user leads or that has a paid plan.
-        // Accepting moves the user off their current team; leaveTeam already blocks the
-        // last leader of a team from walking away, so accept must enforce the same rule.
-        assertCanLeaveCurrentTeamsToJoinAnother(acceptingUser);
+        // Establish/park the durable home team: joining never deletes it.
+        Long homeTeamId = resolveHomeTeamId(acceptingUser);
 
-        // User can only be in one team . leave existing teams before joining new one
-        List<TeamMembership> existingMemberships =
-                membershipRepository.findByUserId(acceptingUser.getId());
-        List<Team> teamsToDelete = new java.util.ArrayList<>();
+        // Guard: block only if joining would strand a paid/linked team the user is the last
+        // leader of. Home teams are parked (kept), so a join never orphans them.
+        assertCanLeaveCurrentTeamsToJoinAnother(acceptingUser, homeTeamId, team.getId());
 
-        for (TeamMembership existingMembership : existingMemberships) {
+        // Leave any non-home team the user currently belongs to; keep the home team + membership.
+        for (TeamMembership existingMembership :
+                membershipRepository.findByUserId(acceptingUser.getId())) {
             Team oldTeam = existingMembership.getTeam();
-
-            membershipRepository.delete(existingMembership);
-
-            saasTeamExtensionsRepository.decrementSeatsUsed(oldTeam.getId());
-
-            // Mark personal team for deletion if it's now empty (user was the only member)
-            if (saasTeamExtensionService.isPersonal(oldTeam)
-                    && membershipRepository.countByTeamId(oldTeam.getId()) == 0) {
-                teamsToDelete.add(oldTeam);
+            if ((homeTeamId != null && homeTeamId.equals(oldTeam.getId()))
+                    || oldTeam.getId().equals(team.getId())) {
+                continue; // keep the durable home; skip the team being joined
             }
-
+            // Keep any team the user leads that still has other members: leaving it would orphan
+            // them (members, zero leaders). Solo/empty led teams and plain memberships still leave.
+            if (existingMembership.isLeader()
+                    && membershipRepository.countByTeamId(oldTeam.getId()) > 1) {
+                continue;
+            }
+            membershipRepository.delete(existingMembership);
+            saasTeamExtensionsRepository.decrementSeatsUsed(oldTeam.getId());
             log.info(
                     "User {} left team {} to join team {}",
                     acceptingUser.getUsername(),
@@ -347,43 +388,27 @@ public class SaasTeamService {
         // Native query: avoids Hibernate touching the read-only supabase_auth_id column.
         userRepository.updateUserTeamId(acceptingUser.getId(), team.getId());
         acceptingUser.setTeam(team);
-        log.info(
-                "User {} team reference updated to team {}",
-                acceptingUser.getUsername(),
-                team.getName());
 
-        // Now safe to delete empty personal teams
-        for (Team teamToDelete : teamsToDelete) {
-            log.info(
-                    "Deleting empty personal team {} after user {} joined another team",
-                    teamToDelete.getId(),
-                    acceptingUser.getUsername());
-            purgeTeamOwnedResources(teamToDelete.getId());
-            teamRepository.delete(teamToDelete);
+        // Add the MEMBER membership on the joined team (unless already present).
+        if (membershipRepository
+                .findByTeamIdAndUserId(team.getId(), acceptingUser.getId())
+                .isEmpty()) {
+            TeamMembership membership = new TeamMembership();
+            membership.setTeam(team);
+            membership.setUser(acceptingUser);
+            membership.setRole(TeamRole.MEMBER);
+            membership.setInvitedBy(inviter);
+            membership.setInvitedAt(invitation.getCreatedAt());
+            membership.setAcceptedAt(LocalDateTime.now());
+            membershipRepository.save(membership);
+
+            // incrementSeatsUsed enforces the cap atomically; rowsUpdated==0 means at capacity.
+            int rowsUpdated = saasTeamExtensionsRepository.incrementSeatsUsed(team.getId());
+            if (rowsUpdated == 0) {
+                throw new IllegalStateException("Team has no available seats");
+            }
         }
 
-        // Create team membership
-        TeamMembership membership = new TeamMembership();
-        membership.setTeam(team);
-        membership.setUser(acceptingUser);
-        membership.setRole(TeamRole.MEMBER);
-        membership.setInvitedBy(inviter);
-        membership.setInvitedAt(invitation.getCreatedAt());
-        membership.setAcceptedAt(LocalDateTime.now());
-        membershipRepository.save(membership);
-
-        log.info(
-                "User {} added to team {} with role MEMBER",
-                acceptingUser.getUsername(),
-                team.getName());
-
-        // incrementSeatsUsed enforces the seat cap atomically; rowsUpdated==0 means at capacity.
-        int rowsUpdated = saasTeamExtensionsRepository.incrementSeatsUsed(team.getId());
-        if (rowsUpdated == 0) {
-            throw new IllegalStateException("Team has no available seats");
-        }
-        log.info("Team {} seats_used incremented", team.getName());
-
         // Don't set inviteeUser; acceptance is recorded via status + TeamMembership row.
         invitation.setStatus(InvitationStatus.ACCEPTED);
         invitationRepository.save(invitation);
@@ -434,89 +459,61 @@ public class SaasTeamService {
         // Atomically decrement team seats_used (prevents race condition)
         saasTeamExtensionsRepository.decrementSeatsUsed(teamId);
 
-        // Fetch team for downstream checks
-        Team team = teamRepository.findById(teamId).orElseThrow();
+        // Return the removed user to their durable home team (mints one only if they have none).
+        returnUserToHome(userToRemove);
 
-        // Create new personal team for removed user
-        createPersonalTeam(userToRemove);
-
-        // Downgrade user to FREE tier after leaving team
-        // They either had a trial (which was cancelled) or had an existing subscription
-        // Either way, they should be FREE after leaving
+        // Downgrade to FREE after leaving the team.
         downgradeUserToFree(userToRemove);
 
-        // Delete non-personal team if it's now empty
-        if (!saasTeamExtensionService.isPersonal(team)
-                && membershipRepository.countByTeamId(teamId) == 0) {
-            log.info("Deleting empty non-personal team {} after last member removed", teamId);
-            purgeTeamOwnedResources(team.getId());
-            teamRepository.delete(team);
-        }
-
         log.info(
-                "User {} removed user {} from team {} and created new personal team",
+                "User {} removed user {} from team {}; returned them to their home team",
                 remover.getId(),
                 memberUserId,
                 teamId);
     }
 
     /**
-     * Guard against silently orphaning a team when a user accepts an invite to another one.
+     * Guard against orphaning a still-billing team when a user joins another.
      *
-     * <p>{@link #acceptInvitation} moves a user to the inviting team by first leaving their current
-     * team(s). Personal teams are disposable (they get deleted on accept), but a non-personal team
-     * must not be left memberless while still billing. {@link #leaveTeam} already refuses to let
-     * the last leader walk away; accept took a shortcut around that check, which let a paid team's
-     * leader join another team and orphan their old team together with its live subscription.
+     * <p>In the durable-home model a join parks the user's home team (keeps the team, its
+     * membership and its wallet) rather than deleting it, so a plain team is never orphaned. The
+     * only real hazard is a team the user is the <em>last</em> leader of that still carries live
+     * billing: an active paid/PAYG subscription, or a non-revoked linked self-hosted instance
+     * ("Mode A"). Those block the join until the plan is cancelled / leadership transferred /
+     * instances revoked. An unpaid, unlinked team (personal or shared) no longer blocks.
      *
-     * <p>So: for each non-personal team the user leads as its <em>last</em> leader, block the
-     * accept. The message points them at the right remedy — cancel the plan if the team is paid,
-     * otherwise transfer leadership first.
-     *
-     * <p>Linked self-hosted instances (combined-billing "Mode A") bind to a team via {@code
-     * linked_instance.team_id}, so they too orphan a team that is left memberless — a personal team
-     * that accept deletes, or a non-personal team left by its last leader. They're checked in that
-     * same orphaning branch (not for a non-leader leaving a team that lives on); the remedy is to
-     * revoke them.
+     * <p>The home team and the team being joined are excluded: neither is left by the join (home is
+     * parked, the joined team is kept), so their live billing cannot be stranded.
      *
      * @param user the user attempting to accept an invitation
-     * @throws IllegalStateException if accepting would orphan a team the user leads or its
-     *     instances
+     * @param homeTeamId the user's durable home team, parked by the join (may be null)
+     * @param joinedTeamId the team being joined
+     * @throws IllegalStateException if joining would strand a paid/linked team the user last-leads
      */
-    private void assertCanLeaveCurrentTeamsToJoinAnother(User user) {
+    private void assertCanLeaveCurrentTeamsToJoinAnother(
+            User user, Long homeTeamId, Long joinedTeamId) {
         for (TeamMembership membership : membershipRepository.findByUserId(user.getId())) {
             Team team = membership.getTeam();
-            boolean personal = saasTeamExtensionService.isPersonal(team);
-            if (!personal && !membership.isLeader()) {
-                // A non-leader leaving a shared team never orphans it.
+            // Home is parked and the joined team is kept, so neither can be orphaned.
+            if (team.getId().equals(joinedTeamId) || team.getId().equals(homeTeamId)) {
                 continue;
             }
-            if (!personal
-                    && membershipRepository.countByTeamIdAndRole(team.getId(), TeamRole.LEADER)
+            // Only a sole leader can strand a team; a member or co-leader leaving never does.
+            if (!membership.isLeader()
+                    || membershipRepository.countByTeamIdAndRole(team.getId(), TeamRole.LEADER)
                             > 1) {
-                // Another leader remains, so the team keeps an owner.
                 continue;
             }
-            // Leaving here orphans the team: a personal team is deleted on accept; a non-personal
-            // team is being left by its last leader. Either way its linked self-hosted instances
-            // lose their billing team, so block until they're revoked.
             if (linkedInstanceRepository.countByTeamIdAndRevokedAtIsNull(team.getId()) > 0) {
                 throw new IllegalStateException(
                         "Revoke linked self-hosted instances on this team before joining another"
                                 + " team.");
             }
-            if (personal) {
-                // Personal teams are disposable (deleted on accept) and never billed/shared.
-                continue;
-            }
             if (hasActivePaidSubscription(team)) {
                 throw new IllegalStateException(
                         "Your team has an active plan and you are its last leader. Cancel the plan"
                                 + " or transfer leadership before joining another team.");
             }
-            throw new IllegalStateException(
-                    "You are the last leader of your team. Transfer leadership before joining"
-                            + " another team.");
         }
     }
 
@@ -549,26 +546,13 @@ public class SaasTeamService {
         // Atomically decrement team seats_used (prevents race condition)
         saasTeamExtensionsRepository.decrementSeatsUsed(teamId);
 
-        // Fetch team for downstream checks
-        Team team = teamRepository.findById(teamId).orElseThrow();
+        // Return the user to their durable home team (mints one only if they have none).
+        returnUserToHome(user);
 
-        // Create new personal team for user who left
-        createPersonalTeam(user);
-
-        // Check if user should be downgraded after leaving team
-        // If user has an active subscription (including trial), they keep PRO access
-        // Otherwise, downgrade to FREE tier
+        // Downgrade to FREE unless they still hold their own active subscription.
         downgradeUserToFree(user);
 
-        // Delete non-personal team if it's now empty
-        if (!saasTeamExtensionService.isPersonal(team)
-                && membershipRepository.countByTeamId(teamId) == 0) {
-            log.info("Deleting empty non-personal team {} after last member left", teamId);
-            purgeTeamOwnedResources(team.getId());
-            teamRepository.delete(team);
-        }
-
-        log.info("User {} left team {} and created new personal team", user.getId(), teamId);
+        log.info("User {} left team {} and returned to their home team", user.getId(), teamId);
     }
 
     /**
@@ -780,8 +764,8 @@ public class SaasTeamService {
                 // Atomically decrement seats_used count (prevents race condition)
                 saasTeamExtensionsRepository.decrementSeatsUsed(teamId);
 
-                // Create new personal team for removed user
-                createPersonalTeam(userToRemove);
+                // Return the evicted user to their durable home team.
+                returnUserToHome(userToRemove);
 
                 // Downgrade user to FREE tier
                 downgradeUserToFree(userToRemove);
diff --git a/app/saas/src/main/java/stirling/software/saas/service/SaasUserExtensionService.java b/app/saas/src/main/java/stirling/software/saas/service/SaasUserExtensionService.java
index ffd63b56e0..c62e686665 100644
--- a/app/saas/src/main/java/stirling/software/saas/service/SaasUserExtensionService.java
+++ b/app/saas/src/main/java/stirling/software/saas/service/SaasUserExtensionService.java
@@ -52,6 +52,21 @@ public class SaasUserExtensionService {
                 .orElse(null);
     }
 
+    /** The user's durable home team id (the team they fall back to), or null if unset. */
+    public Long getHomeTeamId(User user) {
+        return repository
+                .findByUserId(user.getId())
+                .map(SaasUserExtensions::getHomeTeamId)
+                .orElse(null);
+    }
+
+    @Transactional
+    public void setHomeTeamId(User user, Long homeTeamId) {
+        SaasUserExtensions ext = getOrCreate(user);
+        ext.setHomeTeamId(homeTeamId);
+        repository.save(ext);
+    }
+
     /** Idempotent first-use marker. Records the first time this user's API key fired a request. */
     @Transactional
     public void trackApiKeyFirstUse(User user) {
diff --git a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
index 448bafae6b..d312b74c75 100644
--- a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
@@ -276,6 +276,8 @@ class SupabaseAuthenticationFilterMoreTest {
             filter.doFilter(request, response, chain);
 
             verify(userService, times(1)).saveUser(any(User.class));
+            // Guests get NO team; a home team + grant is provisioned only on signup/upgrade.
+            verify(saasTeamService, never()).ensurePersonalTeam(any());
             // Anonymous mirror row created with null email and anon flag true.
             verify(supabaseUserService).createSupabaseUser(supabaseId, null, true);
             assertThat(SecurityContextHolder.getContext().getAuthentication())
diff --git a/app/saas/src/test/java/stirling/software/saas/service/SaasTeamServiceTest.java b/app/saas/src/test/java/stirling/software/saas/service/SaasTeamServiceTest.java
index 5f1083cb3f..fc1fbcb0ab 100644
--- a/app/saas/src/test/java/stirling/software/saas/service/SaasTeamServiceTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/service/SaasTeamServiceTest.java
@@ -65,17 +65,10 @@ class SaasTeamServiceTest {
     @Mock private UserRoleService userRoleService;
     @Mock private SaasTeamExtensionService saasTeamExtensionService;
     @Mock private SaasTeamExtensionsRepository saasTeamExtensionsRepository;
+    @Mock private SaasUserExtensionService saasUserExtensionService;
     @Mock private LinkedInstanceRepository linkedInstanceRepository;
     @Mock private stirling.software.proprietary.security.service.UserService userService;
 
-    @Mock
-    private stirling.software.proprietary.access.repository.ResourceGrantRepository
-            resourceGrantRepository;
-
-    @Mock
-    private stirling.software.proprietary.integration.repository.IntegrationConfigRepository
-            integrationConfigRepository;
-
     @InjectMocks private SaasTeamService service;
 
     private static final UUID SUPABASE_ID = UUID.fromString("11111111-2222-3333-4444-555555555555");
@@ -694,7 +687,6 @@ class SaasTeamServiceTest {
             when(saasTeamExtensionService.hasAvailableSeats(newTeam)).thenReturn(true);
             when(membershipRepository.findByUserId(5L))
                     .thenReturn(List.of(membership(ownTeam, u, TeamRole.LEADER)));
-            when(saasTeamExtensionService.isPersonal(ownTeam)).thenReturn(false);
             when(membershipRepository.countByTeamIdAndRole(200L, TeamRole.LEADER)).thenReturn(1L);
             when(billingSubscriptionRepository.existsActiveSubscriptionForTeam(200L))
                     .thenReturn(true);
@@ -705,9 +697,10 @@ class SaasTeamServiceTest {
         }
 
         @Test
-        @DisplayName(
-                "blocks accept when the user is the last leader of an unpaid non-personal team")
-        void lastLeaderOfUnpaidTeam_blocksAccept() {
+        @DisplayName("allows accept for the last leader of an unpaid non-personal team")
+        void lastLeaderOfUnpaidTeam_allowsAccept() {
+            // The old over-broad "transfer leadership" block is gone: an unpaid, unlinked team is
+            // never orphaned in the durable model, so the join proceeds.
             User u = user(5L, "b@x.com", "bob");
             Team newTeam = team(100L, "Acme");
             Team ownTeam = team(200L, "Bob Co");
@@ -719,44 +712,40 @@ class SaasTeamServiceTest {
             when(saasTeamExtensionService.hasAvailableSeats(newTeam)).thenReturn(true);
             when(membershipRepository.findByUserId(5L))
                     .thenReturn(List.of(membership(ownTeam, u, TeamRole.LEADER)));
-            when(saasTeamExtensionService.isPersonal(ownTeam)).thenReturn(false);
             when(membershipRepository.countByTeamIdAndRole(200L, TeamRole.LEADER)).thenReturn(1L);
             when(billingSubscriptionRepository.existsActiveSubscriptionForTeam(200L))
                     .thenReturn(false);
+            when(saasTeamExtensionsRepository.incrementSeatsUsed(100L)).thenReturn(1);
 
-            assertThatThrownBy(() -> service.acceptInvitation("tok-123", u))
-                    .isInstanceOf(IllegalStateException.class)
-                    .hasMessageContaining("Transfer leadership");
+            service.acceptInvitation("tok-123", u);
+
+            assertThat(inv.getStatus()).isEqualTo(InvitationStatus.ACCEPTED);
+            verify(userRepository).updateUserTeamId(5L, 100L);
         }
 
         @Test
-        @DisplayName(
-                "happy path: leaves personal team, deletes it, joins new team, increments seats")
-        void success_migratesFromPersonalTeam() {
+        @DisplayName("parks the home team (keeps it) and joins the new team, incrementing seats")
+        void success_parksHomeTeamAndJoins() {
             User u = user(5L, "b@x.com", "bob");
             Team newTeam = team(100L, "Acme");
-            Team personal = team(200L, "My Team");
+            Team home = team(200L, "My Team");
             User inviter = user(1L, "a@x.com", "alice");
             TeamInvitation inv = pendingInvitation(newTeam, inviter, "b@x.com");
-            TeamMembership personalMembership = membership(personal, u, TeamRole.LEADER);
+            TeamMembership homeMembership = membership(home, u, TeamRole.LEADER);
 
             when(userRepository.findById(5L)).thenReturn(Optional.of(u));
             when(invitationRepository.findByInvitationToken("tok-123"))
                     .thenReturn(Optional.of(inv));
             when(saasTeamExtensionService.hasAvailableSeats(newTeam)).thenReturn(true);
-            // assertCanLeave... iterates memberships; personal team is skipped.
-            when(membershipRepository.findByUserId(5L))
-                    .thenReturn(List.of(personalMembership))
-                    .thenReturn(List.of(personalMembership));
-            when(saasTeamExtensionService.isPersonal(personal)).thenReturn(true);
-            when(membershipRepository.countByTeamId(200L)).thenReturn(0L);
+            when(saasUserExtensionService.getHomeTeamId(u)).thenReturn(200L);
+            when(membershipRepository.findByUserId(5L)).thenReturn(List.of(homeMembership));
             when(saasTeamExtensionsRepository.incrementSeatsUsed(100L)).thenReturn(1);
 
             service.acceptInvitation("tok-123", u);
 
-            verify(membershipRepository).delete(personalMembership);
-            verify(saasTeamExtensionsRepository).decrementSeatsUsed(200L);
-            verify(teamRepository).delete(personal);
+            // Home team + its membership are kept (parked), never deleted.
+            verify(membershipRepository, never()).delete(homeMembership);
+            verify(teamRepository, never()).delete(home);
             verify(userRepository).updateUserTeamId(5L, 100L);
             assertThat(inv.getStatus()).isEqualTo(InvitationStatus.ACCEPTED);
             ArgumentCaptor<TeamMembership> mcap = ArgumentCaptor.forClass(TeamMembership.class);
@@ -803,7 +792,6 @@ class SaasTeamServiceTest {
             when(membershipRepository.findByUserId(5L))
                     .thenReturn(List.of(oldMembership))
                     .thenReturn(List.of(oldMembership));
-            when(saasTeamExtensionService.isPersonal(oldTeam)).thenReturn(false);
             when(saasTeamExtensionsRepository.incrementSeatsUsed(100L)).thenReturn(1);
 
             service.acceptInvitation("tok-123", u);
@@ -811,6 +799,34 @@ class SaasTeamServiceTest {
             verify(teamRepository, never()).delete(oldTeam);
             verify(userRepository).updateUserTeamId(5L, 100L);
         }
+
+        @Test
+        @DisplayName("keeps a led team with other members (parks it) instead of orphaning it")
+        void soleLeaderOfSharedTeam_teamKeptNotOrphaned() {
+            User u = user(5L, "b@x.com", "bob");
+            Team newTeam = team(100L, "Acme");
+            Team shared = team(300L, "Bob's Org"); // u solely leads it; it has other members
+            TeamMembership sharedMembership = membership(shared, u, TeamRole.LEADER);
+            TeamInvitation inv =
+                    pendingInvitation(newTeam, user(1L, "a@x.com", "alice"), "b@x.com");
+
+            when(userRepository.findById(5L)).thenReturn(Optional.of(u));
+            when(invitationRepository.findByInvitationToken("tok-123"))
+                    .thenReturn(Optional.of(inv));
+            when(saasTeamExtensionService.hasAvailableSeats(newTeam)).thenReturn(true);
+            when(membershipRepository.findByUserId(5L)).thenReturn(List.of(sharedMembership));
+            // Shared team: sole leader, but >1 member - leaving would orphan the other member.
+            when(membershipRepository.countByTeamId(300L)).thenReturn(2L);
+            when(membershipRepository.countByTeamIdAndRole(300L, TeamRole.LEADER)).thenReturn(1L);
+            when(saasTeamExtensionsRepository.incrementSeatsUsed(100L)).thenReturn(1);
+
+            service.acceptInvitation("tok-123", u);
+
+            // The led team is parked: its membership is kept, not deleted.
+            verify(membershipRepository, never()).delete(sharedMembership);
+            verify(userRepository).updateUserTeamId(5L, 100L);
+            assertThat(inv.getStatus()).isEqualTo(InvitationStatus.ACCEPTED);
+        }
     }
 
     // =============================================================================================
@@ -987,8 +1003,8 @@ class SaasTeamServiceTest {
         }
 
         @Test
-        @DisplayName("removes the member, decrements seats, makes a personal team, downgrades")
-        void success_removesMemberAndDeletesEmptyTeam() {
+        @DisplayName("removes the member, decrements seats, returns them home; no team deletion")
+        void success_removesMemberReturnsHome() {
             User remover = user(1L, "a@x.com", "alice");
             User target = user(2L, "b@x.com", "bob");
             Team t = team(teamId, "Acme");
@@ -1001,19 +1017,16 @@ class SaasTeamServiceTest {
                     .thenReturn(List.of(leaderM));
             when(membershipRepository.findByTeamIdAndUserId(teamId, 2L))
                     .thenReturn(Optional.of(targetM));
-            when(teamRepository.findById(teamId)).thenReturn(Optional.of(t));
-            // createPersonalTeam + downgradeUserToFree both refetch the removed user by id.
+            // No home stubbed for the removed user -> returnUserToHome mints a fresh personal home.
             // target has no PRO authority, so downgrade hits the early return.
             stubCreatePersonalTeam(target, 500L);
-            // team becomes empty + non-personal -> deleted
-            when(saasTeamExtensionService.isPersonal(t)).thenReturn(false);
-            when(membershipRepository.countByTeamId(teamId)).thenReturn(0L);
 
             service.removeTeamMember(teamId, 2L, remover);
 
             verify(membershipRepository).delete(targetM);
             verify(saasTeamExtensionsRepository).decrementSeatsUsed(teamId);
-            verify(teamRepository).delete(t);
+            // Teams are durable now - the emptied team is not deleted.
+            verify(teamRepository, never()).delete(any());
         }
 
         @Test
@@ -1031,10 +1044,7 @@ class SaasTeamServiceTest {
                     .thenReturn(List.of(leaderM));
             when(membershipRepository.findByTeamIdAndUserId(teamId, 2L))
                     .thenReturn(Optional.of(targetM));
-            when(teamRepository.findById(teamId)).thenReturn(Optional.of(t));
             stubCreatePersonalTeam(target, 500L);
-            when(saasTeamExtensionService.isPersonal(t)).thenReturn(false);
-            when(membershipRepository.countByTeamId(teamId)).thenReturn(2L);
 
             service.removeTeamMember(teamId, 2L, remover);
 
@@ -1078,28 +1088,27 @@ class SaasTeamServiceTest {
         }
 
         @Test
-        @DisplayName("member leaves: deletes membership, decrements, makes personal team")
+        @DisplayName("member leaves: deletes membership, decrements, returns them home")
         void memberLeaves_success() {
             User u = user(1L, "a@x.com", "alice");
             Team t = team(teamId, "Acme");
             TeamMembership memberM = membership(t, u, TeamRole.MEMBER);
             when(membershipRepository.findByTeamIdAndUserId(teamId, 1L))
                     .thenReturn(Optional.of(memberM));
-            when(teamRepository.findById(teamId)).thenReturn(Optional.of(t));
+            // No home stubbed -> returnUserToHome mints a fresh personal home team.
             stubCreatePersonalTeam(u, 500L);
-            when(saasTeamExtensionService.isPersonal(t)).thenReturn(true);
 
             service.leaveTeam(teamId, u);
 
             verify(membershipRepository).delete(memberM);
             verify(saasTeamExtensionsRepository).decrementSeatsUsed(teamId);
-            // Personal team is never deleted on leave.
+            // Teams are durable now; none is deleted on leave.
             verify(teamRepository, never()).delete(any());
         }
 
         @Test
-        @DisplayName("leader leaves when another leader remains: deletes empty non-personal team")
-        void leaderLeavesWithCoLeader_deletesEmptyTeam() {
+        @DisplayName("co-leader leaves and returns home; the team is durable (not deleted)")
+        void leaderLeavesWithCoLeader_returnsHome() {
             User u = user(1L, "a@x.com", "alice");
             Team t = team(teamId, "Acme");
             TeamMembership leaderM = membership(t, u, TeamRole.LEADER);
@@ -1108,14 +1117,12 @@ class SaasTeamServiceTest {
                     .thenReturn(Optional.of(leaderM));
             when(membershipRepository.findByTeamIdAndRole(teamId, TeamRole.LEADER))
                     .thenReturn(List.of(leaderM, coLeaderM));
-            when(teamRepository.findById(teamId)).thenReturn(Optional.of(t));
             stubCreatePersonalTeam(u, 500L);
-            when(saasTeamExtensionService.isPersonal(t)).thenReturn(false);
-            when(membershipRepository.countByTeamId(teamId)).thenReturn(0L);
 
             service.leaveTeam(teamId, u);
 
-            verify(teamRepository).delete(t);
+            verify(membershipRepository).delete(leaderM);
+            verify(teamRepository, never()).delete(any());
         }
 
         @Test
@@ -1126,9 +1133,7 @@ class SaasTeamServiceTest {
             TeamMembership memberM = membership(t, u, TeamRole.MEMBER);
             when(membershipRepository.findByTeamIdAndUserId(teamId, 1L))
                     .thenReturn(Optional.of(memberM));
-            when(teamRepository.findById(teamId)).thenReturn(Optional.of(t));
             stubTeamSave(500L);
-            when(saasTeamExtensionService.isPersonal(t)).thenReturn(true);
             // Both createPersonalTeam and downgradeUserToFree refetch by id; return the PRO user
             // with an active sub -> keep PRO.
             User proRefetch = proUser(1L, "a@x.com", "alice");
@@ -1150,9 +1155,7 @@ class SaasTeamServiceTest {
             TeamMembership memberM = membership(t, u, TeamRole.MEMBER);
             when(membershipRepository.findByTeamIdAndUserId(teamId, 1L))
                     .thenReturn(Optional.of(memberM));
-            when(teamRepository.findById(teamId)).thenReturn(Optional.of(t));
             stubTeamSave(500L);
-            when(saasTeamExtensionService.isPersonal(t)).thenReturn(true);
             User proRefetch = proUser(1L, "a@x.com", "alice");
             proRefetch.setSupabaseId(SUPABASE_ID);
             when(userRepository.findById(1L)).thenReturn(Optional.of(proRefetch));
@@ -1172,9 +1175,7 @@ class SaasTeamServiceTest {
             TeamMembership memberM = membership(t, u, TeamRole.MEMBER);
             when(membershipRepository.findByTeamIdAndUserId(teamId, 1L))
                     .thenReturn(Optional.of(memberM));
-            when(teamRepository.findById(teamId)).thenReturn(Optional.of(t));
             stubTeamSave(500L);
-            when(saasTeamExtensionService.isPersonal(t)).thenReturn(true);
             // PRO user without supabaseId skips the subscription check and downgrades.
             User proRefetch = proUser(1L, "a@x.com", "alice");
             when(userRepository.findById(1L)).thenReturn(Optional.of(proRefetch));
@@ -1192,9 +1193,7 @@ class SaasTeamServiceTest {
             TeamMembership memberM = membership(t, u, TeamRole.MEMBER);
             when(membershipRepository.findByTeamIdAndUserId(teamId, 1L))
                     .thenReturn(Optional.of(memberM));
-            when(teamRepository.findById(teamId)).thenReturn(Optional.of(t));
             stubTeamSave(500L);
-            when(saasTeamExtensionService.isPersonal(t)).thenReturn(true);
             User proRefetch = proUser(1L, "a@x.com", "alice");
             proRefetch.setSupabaseId(SUPABASE_ID);
             when(userRepository.findById(1L)).thenReturn(Optional.of(proRefetch));
@@ -1472,6 +1471,36 @@ class SaasTeamServiceTest {
             assertThat(invitation.getStatus()).isEqualTo(InvitationStatus.ACCEPTED);
         }
 
+        @Test
+        @DisplayName("does not block when the only linked instance is on the parked home team")
+        void passesGuardWhenLinkedInstanceIsOnHomeTeam() {
+            User joiner = user(USER_ID, EMAIL, EMAIL);
+            Team homeTeam = team(OLD_TEAM_ID, "home-team");
+            Team newTeam = team(NEW_TEAM_ID, "new-team");
+            TeamInvitation invitation = pendingInvitation(newTeam, joiner);
+            TeamMembership homeMembership = membership(homeTeam, joiner, TeamRole.LEADER);
+
+            when(userRepository.findById(USER_ID)).thenReturn(Optional.of(joiner));
+            when(invitationRepository.findByInvitationToken(TOKEN))
+                    .thenReturn(Optional.of(invitation));
+            when(saasTeamExtensionService.hasAvailableSeats(newTeam)).thenReturn(true);
+            // The linked team IS the durable home, so the join parks it rather than orphaning it.
+            when(saasUserExtensionService.getHomeTeamId(joiner)).thenReturn(OLD_TEAM_ID);
+            when(membershipRepository.findByUserId(USER_ID)).thenReturn(List.of(homeMembership));
+            // Home still carries a non-revoked linked instance - the old guard wrongly blocked
+            // here.
+            when(linkedInstanceRepository.countByTeamIdAndRevokedAtIsNull(OLD_TEAM_ID))
+                    .thenReturn(1L);
+            when(saasTeamExtensionsRepository.incrementSeatsUsed(NEW_TEAM_ID)).thenReturn(1);
+
+            service.acceptInvitation(TOKEN, joiner);
+
+            // Home parked (never deleted), user re-pointed to the new team, invite accepted.
+            verify(membershipRepository, never()).delete(homeMembership);
+            verify(userRepository).updateUserTeamId(USER_ID, NEW_TEAM_ID);
+            assertThat(invitation.getStatus()).isEqualTo(InvitationStatus.ACCEPTED);
+        }
+
         private TeamInvitation pendingInvitation(Team team, User invitee) {
             TeamInvitation inv = new TeamInvitation();
             inv.setTeam(team);
diff --git a/app/saas/src/test/java/stirling/software/saas/service/SaasUserExtensionServiceTest.java b/app/saas/src/test/java/stirling/software/saas/service/SaasUserExtensionServiceTest.java
index 4bf9b06baa..4ef7569bce 100644
--- a/app/saas/src/test/java/stirling/software/saas/service/SaasUserExtensionServiceTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/service/SaasUserExtensionServiceTest.java
@@ -214,4 +214,42 @@ class SaasUserExtensionServiceTest {
             assertThat(captor.getValue().getApiKeyFirstUsedAt()).isNotNull();
         }
     }
+
+    @Nested
+    @DisplayName("home team")
+    class HomeTeam {
+
+        @Test
+        @DisplayName("getHomeTeamId returns the stored id when a row exists")
+        void existing_returnsId() {
+            SaasUserExtensions ext = new SaasUserExtensions(user);
+            ext.setHomeTeamId(7L);
+            when(repository.findByUserId(USER_ID)).thenReturn(Optional.of(ext));
+
+            assertThat(service.getHomeTeamId(user)).isEqualTo(7L);
+        }
+
+        @Test
+        @DisplayName("getHomeTeamId returns null when no row exists")
+        void missing_returnsNull() {
+            when(repository.findByUserId(USER_ID)).thenReturn(Optional.empty());
+
+            assertThat(service.getHomeTeamId(user)).isNull();
+            verify(repository, never()).save(any());
+        }
+
+        @Test
+        @DisplayName("setHomeTeamId writes the id on the existing row and saves")
+        void set_updatesExistingRow() {
+            SaasUserExtensions ext = new SaasUserExtensions(user);
+            when(repository.findByUserId(USER_ID)).thenReturn(Optional.of(ext));
+            when(repository.save(any(SaasUserExtensions.class)))
+                    .thenAnswer(inv -> inv.getArgument(0));
+
+            service.setHomeTeamId(user, 9L);
+
+            assertThat(ext.getHomeTeamId()).isEqualTo(9L);
+            verify(repository).save(ext);
+        }
+    }
 }
diff --git a/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.test.tsx b/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.test.tsx
index 367a3c59f7..474089f33c 100644
--- a/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.test.tsx
+++ b/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.test.tsx
@@ -3,15 +3,21 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 import { render, screen } from "@testing-library/react";
 import { allowConsole } from "@app/tests/failOnConsole";
 
-// Controllable auth state for the mocked provider.
+// Controllable auth state for the mocked provider. `portalAccess` is the collapsed
+// context value (raw user.portalAccess ?? isAdminRole(role)); `user.portalAccess`
+// is the raw tri-state (undefined until /api/v1/auth/me resolves).
 const authState: {
   session: unknown;
   loading: boolean;
   isAnonymous: boolean;
+  portalAccess: boolean;
+  user: { portalAccess?: boolean } | null;
 } = {
   session: null,
   loading: false,
   isAnonymous: false,
+  portalAccess: false,
+  user: null,
 };
 
 vi.mock("@app/auth", () => ({
@@ -24,57 +30,76 @@ vi.mock("@portal/auth/saasSupabase", () => ({ ensureSaasSupabase: vi.fn() }));
 
 import { PortalAuthBoundary } from "@portal/auth/PortalAuthBoundary";
 
+function renderBoundary() {
+  render(
+    <PortalAuthBoundary>
+      <div data-testid="portal">PORTAL</div>
+    </PortalAuthBoundary>,
+  );
+}
+
 describe("PortalAuthBoundary — SaaS", () => {
   beforeEach(() => {
     authState.session = null;
     authState.loading = false;
     authState.isAnonymous = false;
+    authState.portalAccess = false;
+    authState.user = null;
   });
 
-  it("renders the portal when a real (non-guest) Supabase session is present", () => {
+  it("renders the portal for a real session WITH portal access", () => {
     authState.session = { user: { id: "u1" }, access_token: "tok" };
-    render(
-      <PortalAuthBoundary>
-        <div data-testid="portal">PORTAL</div>
-      </PortalAuthBoundary>,
-    );
+    authState.portalAccess = true;
+    authState.user = { portalAccess: true };
+    renderBoundary();
     expect(screen.getByTestId("portal")).toBeInTheDocument();
   });
 
+  it("renders the portal for an admin (collapsed access true before /me resolves)", () => {
+    authState.session = { user: { id: "admin" }, access_token: "tok" };
+    authState.portalAccess = true; // isAdminRole fallback
+    authState.user = {}; // raw portalAccess still undefined
+    renderBoundary();
+    expect(screen.getByTestId("portal")).toBeInTheDocument();
+  });
+
+  it("gates a real session WITHOUT portal access (member) and bounces to the editor", () => {
+    authState.session = { user: { id: "member" }, access_token: "tok" };
+    authState.portalAccess = false;
+    authState.user = { portalAccess: false };
+    allowConsole.error(/not implemented|navigation/i);
+    renderBoundary();
+    expect(screen.queryByTestId("portal")).not.toBeInTheDocument();
+  });
+
+  it("waits (no portal, no redirect) while portal access is still resolving", () => {
+    authState.session = { user: { id: "u1" }, access_token: "tok" };
+    authState.portalAccess = false;
+    authState.user = {}; // /me not back yet -> raw portalAccess undefined
+    // Deliberately do NOT allow a navigation error: if the gate wrongly bounced
+    // this still-resolving user, jsdom's navigation warning would fail the test.
+    renderBoundary();
+    expect(screen.queryByTestId("portal")).not.toBeInTheDocument();
+  });
+
   it("gates (does not render the portal) for an anonymous guest session", () => {
     authState.session = { user: { id: "guest" }, access_token: "tok" };
     authState.isAnonymous = true;
-    // The gate bounces a guest to the editor; jsdom doesn't implement
-    // navigation, so absorb that incidental warning.
     allowConsole.error(/not implemented|navigation/i);
-    render(
-      <PortalAuthBoundary>
-        <div data-testid="portal">PORTAL</div>
-      </PortalAuthBoundary>,
-    );
+    renderBoundary();
     expect(screen.queryByTestId("portal")).not.toBeInTheDocument();
   });
 
   it("gates (does not render the portal) when there is no session", () => {
     authState.session = null;
-    // The gate bounces to /login; jsdom doesn't implement navigation, so absorb
-    // that incidental warning rather than fail the console guard.
     allowConsole.error(/not implemented|navigation/i);
-    render(
-      <PortalAuthBoundary>
-        <div data-testid="portal">PORTAL</div>
-      </PortalAuthBoundary>,
-    );
+    renderBoundary();
     expect(screen.queryByTestId("portal")).not.toBeInTheDocument();
   });
 
   it("gates while the session is still resolving", () => {
     authState.loading = true;
-    render(
-      <PortalAuthBoundary>
-        <div data-testid="portal">PORTAL</div>
-      </PortalAuthBoundary>,
-    );
+    renderBoundary();
     expect(screen.queryByTestId("portal")).not.toBeInTheDocument();
   });
 });
diff --git a/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.tsx b/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.tsx
index 8ab2c58dcd..8824883baa 100644
--- a/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.tsx
+++ b/frontend/editor/src/portal-saas/auth/PortalAuthBoundary.tsx
@@ -22,22 +22,40 @@ function FullScreen({ children }: { children: ReactNode }) {
 }
 
 /**
- * SaaS gate: viewing your own usage is not admin-gated, so any real (signed-in,
- * non-guest) account may enter - deliberately laxer than the self-hosted
- * RequirePortalAccess admin gate. But an anonymous guest session has no account
- * to view or manage, so it is not eligible: bounce it to the editor (where a
- * guest can sign up), mirroring the self-hosted forbidden path. No session at
- * all -> the editor's Supabase login, which returns here signed in.
+ * SaaS portal gate: enter only with backend-granted portal/processor access
+ * (`portalAccess`, from /api/v1/auth/me), mirroring self-hosted RequirePortalAccess.
+ * The old "any signed-in account may enter" behaviour let team members without
+ * access into the Processor.
+ *
+ * portalAccess resolves *after* the session does (/me runs once `loading` is
+ * already false), so treat "real session, access not yet known" (raw
+ * user.portalAccess still undefined, and not admin-by-role) as still-loading
+ * rather than bouncing a legitimate user mid-load. Once settled: no session ->
+ * login; a guest or a real account without access -> the free editor.
  */
 function SaasPortalGate({ children }: { children: ReactNode }) {
-  const { session, loading, isAnonymous } = useAuth();
-  const blocked = !loading && (!session || isAnonymous);
+  const { session, loading, isAnonymous, portalAccess, user } = useAuth();
+
+  const accessPending =
+    !!session &&
+    !isAnonymous &&
+    !portalAccess &&
+    user?.portalAccess === undefined;
+  const settling = loading || accessPending;
+
+  const redirectTo = settling
+    ? null
+    : !session
+      ? withBasePath("/login")
+      : isAnonymous || !portalAccess
+        ? EDITOR_URL
+        : null;
+
   useEffect(() => {
-    if (!blocked) return;
-    // Guest (has a session but anonymous) -> editor; no session -> login.
-    window.location.href = session ? EDITOR_URL : withBasePath("/login");
-  }, [blocked, session]);
-  if (loading || blocked) {
+    if (redirectTo) window.location.href = redirectTo;
+  }, [redirectTo]);
+
+  if (settling || redirectTo) {
     return (
       <FullScreen>
         <Spinner size="lg" />
diff --git a/frontend/editor/src/proprietary/auth/supabase/UseSession.tsx b/frontend/editor/src/proprietary/auth/supabase/UseSession.tsx
index 9d2b3f2682..6bcc6b501e 100644
--- a/frontend/editor/src/proprietary/auth/supabase/UseSession.tsx
+++ b/frontend/editor/src/proprietary/auth/supabase/UseSession.tsx
@@ -141,56 +141,77 @@ export function SupabaseAuthProvider({
     };
   }, []);
 
-  // Enrich with backend truth: grant-based portal access and team leadership
-  // come from /api/v1/auth/me, not Supabase claims. Best-effort; the
-  // isAdminRole fallback below covers failures and anonymous sessions.
+  // Enrich with backend truth: grant-based portal access and team leadership come from
+  // /api/v1/auth/me, not Supabase claims. Portal/Processor access is active-team-dependent on the
+  // backend, and a team switch made elsewhere doesn't change our session object - so besides the
+  // initial load we re-validate whenever the tab regains focus, else a user whose access dropped
+  // would keep seeing the Processor until a full reload. Best-effort; the isAdminRole fallback
+  // below covers failures and anonymous sessions.
   useEffect(() => {
     const token = session?.access_token;
     const sessionUser = session?.user;
-    if (
-      !token ||
-      !sessionUser ||
-      sessionUser.is_anonymous ||
-      sessionUser.portalAccess !== undefined
-    ) {
+    if (!token || !sessionUser || sessionUser.is_anonymous) {
       return;
     }
     let cancelled = false;
-    void fetch("/api/v1/auth/me", {
-      headers: {
-        Authorization: `Bearer ${token}`,
-        Accept: "application/json",
-      },
-    })
-      .then((res) => (res.ok ? res.json() : null))
-      .then(
-        (
-          data: {
-            user?: { portalAccess?: boolean; teamLead?: boolean };
-          } | null,
-        ) => {
-          if (cancelled || !data?.user) return;
+    const loadAccess = () => {
+      void fetch("/api/v1/auth/me", {
+        headers: {
+          Authorization: `Bearer ${token}`,
+          Accept: "application/json",
+        },
+      })
+        .then((res) => (res.ok ? res.json() : null))
+        .then(
+          (
+            data: {
+              user?: { portalAccess?: boolean; teamLead?: boolean };
+            } | null,
+          ) => {
+            if (cancelled || !data?.user) return;
+            setSession((prev) =>
+              prev
+                ? {
+                    ...prev,
+                    user: {
+                      ...prev.user,
+                      portalAccess: data.user?.portalAccess,
+                      teamLead: data.user?.teamLead,
+                    },
+                  }
+                : prev,
+            );
+          },
+        )
+        .catch(() => {
+          // Backend unreachable or /me unsupported: resolve portalAccess to the role-based
+          // fallback so gates awaiting it don't hang on a spinner. This deliberately ignores
+          // grant-based access (a non-admin grant-holder is denied while /me is down) - grants
+          // can't be known without /me, so we fail safe; a later focus refetch recovers it.
+          if (cancelled) return;
           setSession((prev) =>
-            prev
+            prev && prev.user.portalAccess === undefined
               ? {
                   ...prev,
                   user: {
                     ...prev.user,
-                    portalAccess: data.user?.portalAccess,
-                    teamLead: data.user?.teamLead,
+                    portalAccess: isAdminRole(prev.user.role),
                   },
                 }
               : prev,
           );
-        },
-      )
-      .catch(() => {
-        // Backend unreachable or /me unsupported: keep the claim fallback.
-      });
+        });
+    };
+    loadAccess();
+    const onVisible = () => {
+      if (document.visibilityState === "visible") loadAccess();
+    };
+    document.addEventListener("visibilitychange", onVisible);
     return () => {
       cancelled = true;
+      document.removeEventListener("visibilitychange", onVisible);
     };
-  }, [session?.access_token, session?.user?.id, session?.user?.portalAccess]);
+  }, [session?.access_token, session?.user?.id]);
 
   const user = session?.user ?? null;
   const value: AuthContextValue = {

From 621731bda102eed92b83162b4ab541d092b3da2f Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Tue, 21 Jul 2026 18:37:54 +0100
Subject: [PATCH 072/109] Validate RFC 3161 document timestamps and expose
 timestamping (#7095)

# Description of Changes

Fixes timestamp issue and adds timestamp to the signing/security policiy
---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../security/ValidateSignatureController.java |  72 ++++++++++++--
 .../DocumentTimestampValidationTest.java      |  91 ++++++++++++++++++
 .../timestamp/doc-timestamped-tampered.pdf    | Bin 0 -> 21985 bytes
 .../resources/timestamp/doc-timestamped.pdf   | Bin 0 -> 21985 bytes
 .../public/locales/en-US/translation.toml     |   4 +
 .../src/core/types/validateSignature.ts       |   4 +-
 .../components/policies/PolicySetupWizard.tsx |   8 ++
 .../proprietary/policies/operations.test.ts   |   1 +
 .../src/proprietary/policies/operations.ts    |   7 ++
 9 files changed, 179 insertions(+), 8 deletions(-)
 create mode 100644 app/core/src/test/java/stirling/software/SPDF/controller/api/security/DocumentTimestampValidationTest.java
 create mode 100644 app/core/src/test/resources/timestamp/doc-timestamped-tampered.pdf
 create mode 100644 app/core/src/test/resources/timestamp/doc-timestamped.pdf

diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/security/ValidateSignatureController.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/security/ValidateSignatureController.java
index ecfc0ad2db..47fce44876 100644
--- a/app/core/src/main/java/stirling/software/SPDF/controller/api/security/ValidateSignatureController.java
+++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/security/ValidateSignatureController.java
@@ -23,6 +23,9 @@ import org.bouncycastle.cms.CMSSignedData;
 import org.bouncycastle.cms.SignerInformation;
 import org.bouncycastle.cms.SignerInformationStore;
 import org.bouncycastle.cms.jcajce.JcaSimpleSignerInfoVerifierBuilder;
+import org.bouncycastle.operator.jcajce.JcaDigestCalculatorProviderBuilder;
+import org.bouncycastle.tsp.TimeStampToken;
+import org.bouncycastle.tsp.TimeStampTokenInfo;
 import org.bouncycastle.util.Store;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -54,6 +57,9 @@ public class ValidateSignatureController {
     private final CustomPDFDocumentFactory pdfDocumentFactory;
     private final CertificateValidationService certValidationService;
 
+    /** PDF sub-filter identifying an RFC 3161 document timestamp (PAdES-LTV). */
+    private static final String SUBFILTER_RFC3161 = "ETSI.RFC3161";
+
     @InitBinder
     public void initBinder(WebDataBinder binder) {
         binder.registerCustomEditor(
@@ -128,8 +134,35 @@ public class ValidateSignatureController {
                     byte[] signedContent = sig.getSignedContent(file.getInputStream());
                     byte[] signatureBytes = sig.getContents(file.getInputStream());
 
-                    CMSProcessable content = new CMSProcessableByteArray(signedContent);
-                    CMSSignedData signedData = new CMSSignedData(content, signatureBytes);
+                    // An RFC 3161 document timestamp (PAdES-LTV) carries its signed content
+                    // *inside* the CMS - a TSTInfo - rather than being detached over the document.
+                    // Building it as detached digests the ByteRange against an attribute that
+                    // covers the TSTInfo, which can never match.
+                    boolean isDocTimeStamp = SUBFILTER_RFC3161.equals(sig.getSubFilter());
+                    CMSSignedData signedData;
+                    if (isDocTimeStamp) {
+                        signedData = new CMSSignedData(signatureBytes);
+                    } else {
+                        CMSProcessable content = new CMSProcessableByteArray(signedContent);
+                        signedData = new CMSSignedData(content, signatureBytes);
+                    }
+
+                    // What actually binds a timestamp to this document: the TSTInfo's message
+                    // imprint must equal the digest of the signed byte range. Without this check a
+                    // valid timestamp token for some *other* document would verify happily here.
+                    Date timeStampGenTime = null;
+                    if (isDocTimeStamp) {
+                        TimeStampToken token = new TimeStampToken(signedData);
+                        TimeStampTokenInfo info = token.getTimeStampInfo();
+                        timeStampGenTime = info.getGenTime();
+                        if (!timestampCoversContent(info, signedContent)) {
+                            result.setValid(false);
+                            result.setErrorMessage(
+                                    "Timestamp message imprint does not match the document");
+                            results.add(result);
+                            continue;
+                        }
+                    }
 
                     Store<X509CertificateHolder> certStore = signedData.getCertificates();
                     SignerInformationStore signerStore = signedData.getSignerInfos();
@@ -162,7 +195,15 @@ public class ValidateSignatureController {
                         CertificateValidationService.ValidationTime validationTimeResult =
                                 certValidationService.extractValidationTime(signerInfo);
                         Date validationTime;
-                        if (validationTimeResult == null) {
+                        if (timeStampGenTime != null) {
+                            // The TSA's own asserted time is the authoritative one here, and is
+                            // exactly what makes the signature verifiable after the cert expires.
+                            validationTime = timeStampGenTime;
+                            // Distinct from "timestamp", which CertificateValidationService already
+                            // uses for a signature countersigned by a TSA. Both are RFC 3161, but
+                            // one attests a signature and the other attests the whole document.
+                            result.setValidationTimeSource("document-timestamp");
+                        } else if (validationTimeResult == null) {
                             validationTime = new Date();
                             result.setValidationTimeSource("current");
                         } else {
@@ -235,10 +276,13 @@ public class ValidateSignatureController {
 
                         // Set basic signature info
                         result.setSignerName(sig.getName());
+                        // A DocTimeStamp has no /M entry; its date is the TSA's genTime.
                         result.setSignatureDate(
-                                sig.getSignDate() != null
-                                        ? sig.getSignDate().getTime().toString()
-                                        : null);
+                                timeStampGenTime != null
+                                        ? timeStampGenTime.toString()
+                                        : sig.getSignDate() != null
+                                                ? sig.getSignDate().getTime().toString()
+                                                : null);
                         result.setReason(sig.getReason());
                         result.setLocation(sig.getLocation());
 
@@ -301,4 +345,20 @@ public class ValidateSignatureController {
 
         return ResponseEntity.ok(results);
     }
+
+    /**
+     * True when the timestamp token was issued over exactly these bytes.
+     *
+     * <p>The digest algorithm is taken from the token rather than assumed, because a TSA chooses it
+     * - assuming SHA-256 would silently fail against any TSA that uses something else.
+     */
+    private static boolean timestampCoversContent(TimeStampTokenInfo info, byte[] signedContent)
+            throws Exception {
+        org.bouncycastle.operator.DigestCalculator digest =
+                new JcaDigestCalculatorProviderBuilder().build().get(info.getHashAlgorithm());
+        try (java.io.OutputStream out = digest.getOutputStream()) {
+            out.write(signedContent);
+        }
+        return java.util.Arrays.equals(digest.getDigest(), info.getMessageImprintDigest());
+    }
 }
diff --git a/app/core/src/test/java/stirling/software/SPDF/controller/api/security/DocumentTimestampValidationTest.java b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/DocumentTimestampValidationTest.java
new file mode 100644
index 0000000000..6e8f1676a6
--- /dev/null
+++ b/app/core/src/test/java/stirling/software/SPDF/controller/api/security/DocumentTimestampValidationTest.java
@@ -0,0 +1,91 @@
+package stirling.software.SPDF.controller.api.security;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.when;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.List;
+
+import org.apache.pdfbox.Loader;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+import org.springframework.mock.web.MockMultipartFile;
+
+import stirling.software.SPDF.model.api.security.SignatureValidationRequest;
+import stirling.software.SPDF.model.api.security.SignatureValidationResult;
+import stirling.software.SPDF.service.CertificateValidationService;
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.service.CustomPDFDocumentFactory;
+
+/**
+ * Validation of RFC 3161 document timestamps (PAdES-LTV).
+ *
+ * <p>These fixtures are a real PDF stamped by a real public TSA (freetsa.org). Before this was
+ * handled explicitly, every such timestamp was reported invalid: a DocTimeStamp's CMS encapsulates
+ * a TSTInfo rather than being detached over the document, so digesting the byte range compared
+ * against the wrong thing and always mismatched. That made the timestamp feature look broken to
+ * anyone who checked their own output with our validator.
+ */
+class DocumentTimestampValidationTest {
+
+    private ValidateSignatureController controller;
+
+    @BeforeEach
+    void setUp() throws Exception {
+        CertificateValidationService certValidationService =
+                new CertificateValidationService(null, new ApplicationProperties());
+        CustomPDFDocumentFactory factory = org.mockito.Mockito.mock(CustomPDFDocumentFactory.class);
+        // Delegate to the real loader so the signature dictionary is parsed as in production.
+        when(factory.load(any(InputStream.class)))
+                .thenAnswer(
+                        invocation ->
+                                Loader.loadPDF(
+                                        ((InputStream) invocation.getArgument(0)).readAllBytes()));
+        controller = new ValidateSignatureController(factory, certValidationService);
+    }
+
+    @Test
+    void aGenuineDocumentTimestampValidates() throws Exception {
+        SignatureValidationResult result = validate("timestamp/doc-timestamped.pdf");
+
+        assertThat(result.isValid()).isTrue();
+        assertThat(result.getErrorMessage()).isNull();
+        // The TSA's asserted time is what keeps the signature verifiable once the signing
+        // certificate expires, so it must be the time we validate against.
+        // Deliberately not "timestamp" - that value already means "signature countersigned by a
+        // TSA", which is a different assertion about a different thing.
+        assertThat(result.getValidationTimeSource()).isEqualTo("document-timestamp");
+        assertThat(result.getSignatureDate()).isNotNull();
+        assertThat(result.getSubjectDN()).contains("freetsa.org");
+        assertThat(result.isCoversEntireDocument()).isTrue();
+    }
+
+    @Test
+    void aTamperedDocumentFailsTheMessageImprintCheck() throws Exception {
+        // Same file with a single byte flipped inside the signed range. Without the imprint check
+        // the CMS signature over the TSTInfo would still verify happily - the token is untouched -
+        // and a modified document would be reported as validly timestamped.
+        SignatureValidationResult result = validate("timestamp/doc-timestamped-tampered.pdf");
+
+        assertThat(result.isValid()).isFalse();
+        assertThat(result.getErrorMessage())
+                .isEqualTo("Timestamp message imprint does not match the document");
+    }
+
+    private SignatureValidationResult validate(String resource) throws IOException {
+        byte[] bytes;
+        try (InputStream in = new ClassPathResource(resource).getInputStream()) {
+            bytes = in.readAllBytes();
+        }
+        SignatureValidationRequest request = new SignatureValidationRequest();
+        request.setFileInput(
+                new MockMultipartFile("fileInput", "doc.pdf", "application/pdf", bytes));
+
+        List<SignatureValidationResult> results = controller.validateSignature(request).getBody();
+        assertThat(results).hasSize(1);
+        return results.get(0);
+    }
+}
diff --git a/app/core/src/test/resources/timestamp/doc-timestamped-tampered.pdf b/app/core/src/test/resources/timestamp/doc-timestamped-tampered.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..3616a4cb130d5896535cb9007b4072d65cac3144
GIT binary patch
literal 21985
zcmeI4d7Kr+wZ|a>>I97_&n+%jA`usuuI{etDj$MfUDZKRLBQ>yM1&gx!i)}s0gc85
z6So*q!32$oiqR0GiMvTO?t;sUF_^_AK7}XdDKR^0Q1h*x85WtS$;<nE-X9m8nLGD(
z*K+Ed^ZWfy_0+)8t{g0esHTB`S+VAYrmPm#T92F7G<0ZF^QaT*E%~JOsjV%w@d@vb
zsWq2V+eg$|W=)@dOjGmdiBswaO`Ov@tG(7ds-<4EPM<ZSrQ_|HwK!bg)I4s^3H4fY
zF|mE(^wud&!-h50TPBC*^?KbLRBxHm{@I#Vriu2ax7XX~XZpnUx~orWom>xh&1`S0
zPn@wu)9h!yyx@s3&qn>r)kDwTcAsZ@+arcAxOHx?K7-ny`Q*=T^wF0`9yevD;>A^a
z4^#{0uUN2y(r;ckfBAQQ^3sZz&pGtkr7v9b$34y6y*{!-{epvbUHVXZ^hX9?KgNyU
z;U0Nv?HfZTJl}TPlBLU@Z~lXvbHlWF;hNpAS^W8>ug*Gj{x_EXY1HMz?q1RBjUIR2
z^`)JT-g^K0wjSJf{;I)iwpe_}&^;#o;?AC1_R%fZ|L*ud>fP3Cy3dMHw{Q3A6$hR3
zmF*9iKk#c$+<((%uf2NWroE<K|KjYO_PK81BX8c+^0m+Py7H*Kwm)R6V+TzUFTS?=
z-}m2s<ZTc4d}{c-gC05k#CzIi-SYTjeGa|*?8)V!$8UMpp_l&krpc$B@x7kK)qM^=
ztIy)yF8s#e^Nu>CW$~Q5etX?FXU)C3*UDv+#ev^*{T5!f_4OB>_|E@4^4GWT*yYl1
zeeK@;Hv9Ot{hk{7=hLsf?~ThZ*QZT*{*t9PfA-~XZ_@W?=A6T?8nfw<6Arv<hf9Wi
zVZVcSI$`8p5AEDz^wY!6Sk`mFmV<YjzSFKx9CP=e`?ox8&!2yL)4os7Ip^@3m-l>Z
z<h!lEdvay-`A^NiW$3DTr|!Jy(nVLaj@f3rXI2%x7xlX4wI`=f^YeFm^tv_8FT6J4
z7c0&k-@nHvKicw%`|tR{$+NGN=N{I7z*n0F_s{Pc{==L1TzJQWgAbf%&%ScUeXbqx
z_-~Kj?V-;fw$qMB4_~&R-_%~Wt$HpQGHUxbemriQFZO)Q?(DA^f5)`NhfUjj(q>oo
z9@(#0bn^G^>_6a@b6<Moo%5&P`O*3>_v-VxtNK52>?;GlyL<mlwjDH9ti18$3D?~;
zxc^UE9@wns)PdK`+4HEco;m0X&#gY{c)Qo5ySJQq{G*qAd&K#hKXm%9ZV)ehe(4Lp
z-TR2)i{j|OY`gsies}lu*LS_L{E;!IF1m2;r!Rkgmve7?`!|cHFMey)r1`tAIl1rf
z6+fSQ<96>17<=MX7k&Mfe&_Xk_XmG|=+-aYvhsqt7xy~nzp?=bFP!$5OZCJ3Ca&1@
zoKN5QpDQQ6wseM^xy5PGjPIWDtv?()@3GM<o_p)ITc3aAq#c`jpZ@L+`<%b|=MFpS
zjVTKk-(OpG&jq!;p1<s~6As*E!dDJ`r|%b^z4(--&5k~E_*>`RaLGl7Z`0Ic#sg2f
zxhLLp+JJZN9KC3l(TA+OYUS^iZL;w7p?`XF=DgWU)_nB8hd)s3U4L>8^Xq;3%OC&P
zelNas+tOE`8ocD`*;g#Qcf{Avz4F$Xv&%o;H+T5ZPrdomzi#vPrYB##z1|`OX-C9$
zg{z1*j@Kkgi0|1UzDFH5ZEX9DrshLxvilGwuG?m|*Wzr0V7}toc|Se={%EU*-<|*Z
zj0>+i;Aba&r<i-#9+&KP-j?d3{g(aZqP~}1p#E+33$Jgz^RT76^f}|P=TBYz!>_n}
zz{AH}(CfhZh<=~iyrtjjv3>g-H+lT>t@5F-F1~Ny&-{Mt*SAU*x6gZalb>Haa_aC^
zzn{Lq-F?IB&o;mC>0aL-bo;Vn_0Tgf_{8!ZC-=PX?uBEopLF}8hi{*?blQSLj@<FM
z2d}iJT>Z<-ek?}rGj05hOC}E9cKPNvU47PBUp?&)H?Habsq6Hg5C8Scmw#-p{Vw{_
z+iQOH?9%_3koG_6ygi;-we&YPzw+`)N902nK6Usr(|4P2+nngj!?rto)x*6ndc^;D
z+39zUczf3q#*KaPR=NECe)}#zW#D0Z9d_x`5eLqHZp562R_^<wQBN-zcg-zrKlruy
z(W|>oYd&Soei!%dIk|cDl-u8$wCTs+>N#!P)!THpETWrb(M`<<w0x$urud8uJf^j^
zy%w@MuMcpw@k3o|GMQ^<q$$!QwW$(CmL|qUh0}Rd466-IA|*=|iOkB<h$wM+?h08%
zqL88xMKO%*-;vpm98>>HQ}fuVC)aBt4joUf&#sM+Y61YrYPgNy(j#i)!|&nc2j%xG
zCLMe18$WsQ-iLZTc)|XU_j>U0{U5)7$-O_hcgg67?_F~Bqdj`;_5Gf!yRpQ~_K9un
zv)dSqNR@6HIM9zOo3>~QHt0gL0tg9M=0KL(Ah&NE#WIS8jzkp2>E2Pa2mkL0ezmnu
zo;3*&8Z@?jYTNXwEmH;qk+qZJAtD_Tb3xTm>qehPLsBs$;`4)BCx1X6>u^x4zk=ns
z8m64mW!t=^rL`U7&N{BWLeV3pPM%Wdjj|>ZY(0(vPMy*+v3*usUC`~}tU$*ykFHf{
z&Dz%|wX+&Sh~9NytU^ATCaP=K8%emi%T^tW>slv`n>wRDwteD^6V@$V4uIE(j2=Dm
zpsDTkYIt3X>c@>eV91!VNQ4rYq0`7J%7hjs!NvBDM5mF9)|U2qOZ&{=YdRLOz~v$n
z=USy&t1^om%aTQLUVR#+9alxH6z?aAh{`158tze1xF-@yMoE<Nc@oKpZ<;H$=L-9t
zR&i+BNJGnbxQo*2r|GyO!zK7sa9>L2p+$xkhu&<rz0pz}Ns-#jS!t4tfU=qLHp_D7
zqAW|8NU1VirUEZhnaavMl4YFp(`zOhDIzbXA0<U@V~0bQNlbE$6UFx|5s9w85-gY`
zgl-sLS#pogQu@nFo0>eyxVB?XBFU>c1sjFAMK%$FSwtl>NTj4M!aUN9CRS2O#-GY0
z6<D?4s(kHLmaCGk&oV}nG0M&s$QH^;VojMWi6fOLnZ;SEj8c3hO7NPNRd^@k8nTQk
zRFRoD%983mU)`6gQZXsz7>N(_;U1y9!m3qkydUnU?sqsu6vmth?vUZ#>Uzf=Rc{&Z
z(Y9w|;ci`xpmUbtS|wtSbH(9v`t^(`TwV20jlW~;w1UNSf>W)XZ-On#tolbA-L{#C
z7(b0^dLvIZksv0diaSSG&|8j;5)2wfZx~6;$aL5E=pP@zQ@iY)(Z7*dHSd^vLrctq
zHM6XlS$mxd?wY17=(-r`SaVGan3Y~ln5*)Yw_vNvOB5XiZ%I=yfS18<$dI%g6|py(
zK}Igu-V~1hs>pj!TnXOoh&*BF{k<N?xVrH;f;oyply;2Ka#bd=1h&8ffG522y(_^r
zAG{J+FAmmwZ%*l0iKN?=$hy{oRY(|v+jte|yZcq>%152H=DH1R{XXjy2`|WZo$($M
z>sT)d`7-6bSmxEIcvh7YLSES5(?*OFaNWjZBgT~{oXFc%9?3f5weUbvh;9|h*lO?#
zPz5y=;Q}hgLVA%4fJhZqgWOiQSbG7ok_B99BjHjR%fxsGTBy<{Mdq|kOqrwwO*qoH
z%i~;->A9C=<Bhj6b+IuSC`)X?K&90siOAWQUTl(-xl&HM!umo>>57c(T$H>Q`z*5z
z&1ISd1ORYLOloqu%OmTvA_L%U3fy`rbDJjt@d)1v`8-*mD>n*9Ofn1JA(BMMV8kjv
zeUy^hQjrQ6u5~0v%M6_cilsA2tjO!7hmzP>LzX2r6`e?mX=t+}KS4p#G6!9qE|OG%
z<^*t2W<Ik?o~gpfykw9nhki4Lz$QBSFBw%@Wn2Z^uEiYMmaI}h`gAQW>p0ve$g>i5
z#3We(vO1Gp|NX#U(vZ)?Sd+l4Hu#+0V@(27fj^`)lgDNJ0U0%BEh>}(8+i?qb|F3s
z1a%=-Mlmlo>Pdhc_8;jf$;oiC;yy4MTCA*u#j6Y$Go!f3A%=Xx6l3*|v>iqc@)gXs
z6JwA$9ju^wAA^blM%K|MUYGKFFtf1CkM9*X!qzfap5IyijqMwvOZ*e|WlVw9R6He&
zD}(nCEvyo_M63mBw4r@Fd-_LhutBz5*AvFZZ*l02){%a~Os&Wh)5RJ)cwyjK@V<(R
zG5Ymb+d9tH#mHDxyol>FI0$oPIxwK{9R}LLA3OOM-D%zllqreH8Slq8q7d;RpG69u
zD^pu4Q5pw_X3Y|9jB%c%B_p2~Ndm`)z#s~;EF?V|E=hf&h^5bUY?N@4^kSqoMNyXI
zE)AK5+UL@c-QY~N6u1b@Tba0o>=zXXk33IZZZnf>5lg~PmrjaOnzBqwog~icM7!AL
z-uXQ9q$0x@lfss1ny5S%l6>gn*rzTn%K{!OJo6xOW#OYJW8fug0|!i!qQn)YEORYc
z57Ib8%ga17uzF*?)4o(#FQoZ0GmO$O5+O4sb22;P!eym%(kfVnGKc}eETh~?YlsY(
zdRd0Jib`cl&kA^h;E<LH=ORgR0nved%A(YT$qEgD6$~hqbb%42O_^oFha%0GSZ00V
z@m)G0I|ovyw5Qp!kfn|Sz{Jv8t8gna3IS)lQASHe-qr@RffreiN5&d*oSIn2tP<i$
z24+Xzw%(9lEi01wNEW$b^Z~eHRH!d9pA^c2560z&@yRstWLOa}j1owk6uHi9p_7be
zREj!dngy#FF?nFhxePRlyd-6yzCb8tako+yC>h3>cpFAXK-t1(H0EqZ`u9FhA@t0X
z)rq+}E{uX#i!#G!QvR2jCX<yBbrnxwE0lxRWDN)}L4ohbxnU|$c0i>Bi;6hS;oc@L
zG&rIFOq5gN5uMOw92|^5I-0yF@{-~W?v|B4Bx^bZ>&mE1HJUfaO{B%O(~{rFCgjyL
zh8hIV%`E;dQ*EM3WM(jP+=m7uCo-*ls*2R46oJaJ#B$iTbOq)Hps~NvIG;$RPUu?a
zj-M>2G*$^h$N1RcE|3Tq3F5F2))0-RP(j-#q%cf`xwDc{*eEuPQAt)c(~)!@$1BP-
z)0sosSm$FS3dgNBlSHg@4(rhl>4>3)pVFg-3Gk2^x^xV_yiUhxK77Bt67qXP$NUpI
zMpW31f~Hy#Rca<EmSnAtp~>nKSkU^PHtbCd2Pgi}x-sBh9QbVaYCNz+A|PBvq6sV}
zyb81_`~)wp;<b+gM~p!=fq*wEEy$Fq4K*oJlrU7myrH6$12cp!p8^pkF)(;Xwjsfi
zF&)_wx&j75mqd<Eh(*p@AfVtrXuHZXs$?oNMw7aE0oVaLsfukZ$cRQ{5Z<CJij*o^
zN!csVWs~Nh1}eOS<x-u>G)>bZS()oZ<b9^f)H(n)HM&4i07VJpJeQ6!k)jJ~PQYR)
zw@Af^NX&5gpc}lhDi_)%o~}S~?@4PxYLjRZ>S^>s=FGu=qzkG;fw!^o5;_Yh2&p^Q
zBs%~jrjAGDPUWCHi0^foJ8u9N%g{aW7-vaQ7#nJRsSz6NM&^VvAUc71o6RXoge>W4
z30g(A_c<#INRl62=1PQ`cR^WDe*yyxIhULBq(piZ3D5{H)y%9EvCTxnC1f`UyEjrM
zp-Dwn)WAs`tfa`iAgniW3>QmLURbVh4q_9R&<CfXX4sgK*jOr+QkC&efdmdrgdR}Z
zfshswn$Fx}17j`tk2<eJkHvtAv@Aem%SuKjXh^!uQUh238q7IXF47Pai+i$u8O*w{
z1xT9YsIO3bi7b|~=+Qz0R`7!orpYRn2vbH2Bm(BZQWgjeR+kiOQU?Y`c(5ySTYyvv
z*r8lmloWb>=B<XKz|5fkh_$p7S|cK5iN$eM&4^WOxG;eecn4m=BA6<~5L@DZsVsde
zK${G5f=3pH3v-Hi#7n5u>I@f0wrLMqVgga(J=$hv%-xi@ZIKo>Mc|gq3GzefRuL=^
zL{_y#i)*E!G5DWg1}dX5expAYt_U&1@Sq|Q!o9GG%p96J&r5c3;Jnhp&!Ma?^#V=-
zDzmMVcu_)8@DizTX~iID0_lzh3fKrSBS%2%LrzG^1l3Q%A=C;xl~+*Bl6S(jbik|5
zdL7ys!*(jv4h1U;NL+W?`ok+@6jx^jx<g&_J3~cl;l3YUVH4THSnA-yR7$OZ<R2bc
z@PSbE-H0t!N_VXqhhU?^`GVJy`*0sr1MD7s_n~VF@1w%kRaiPyc&JhfJUx65wX3|d
z;=%rm7A2W1cw*%zL8)$3^9YF7(B%J0O<vVzHmECw6<{|ENgOo$zrGsucX&><>#$xG
zAm}61bA@rSFVn)486{%V$4Dt~3%qCN1l&^W>xFG_QW)$24uHIf3>m{{?!vD_&P2+X
z0?y<i6r!+#0zych)a*rslubQ)ohm3O2<S`jBB(jQDX7huQk4=0YLn(jm9W19ij(R2
z-Fr5aEE2<5cCSdofUY(8HhW)TGYI*Z<}P)CA5a>AH-Tt;OT96k-Fx^8RR+{2)kDAq
zt&8M_RRN@^O^5P>+hs}E-->LCe7A4{8l*%isc{7sB$*sKDN~g&WE&AIf!Sd)hiEM=
zn8+k0fKAY0DqtW9>I^&)lvF69q+G0FBZd-b*m<KyfR?8^OVJkIf_eoeX}utu6qG`c
zs1hN_7_b7uJI+Jpndwq3PAQF+RBIgNfD-7$iI{W}hV2T3vWX}UW38~HF+79KNO0Fs
z7esT%RH_5J6as7va}Yoz#-eG7#%7zC#Fb+#pQMzJBhQlzP(rHFC}35hio>ELa9nE(
z8eyzC<Wf*$jvN*X#$nrqg`~_4i)JcRf~cE9&m3$y17bbZD%5HUQORMF(x-u}aJOYs
zSVCL4#yWTkxhyX!mg&f$j1jt&ic1z1f*>UGfE-b2gdtd0q{w)fI3AK=cyOCdVvY6K
z81g|K!!!)MB85Vg6a_$h8K{{N9@eEO3Q!!0xId_MR-%BeQc+;q+DXb#o>6KttfMwW
zu|g+7q8AF1lv3Mbu`JOP>OO(bz)LAb@)I)(irj2qQ%m#Ia7sfIFdGAHgi%vpf*;}e
z6gjB=c(^8&4X8RcFAUjQK>nc;Gz$Y_n;@(yB}QV9&2uXI;qerV0xgjqNkHN^a7x3J
z@I<y3l87kCa%*G?$)UUgMM5wjT}&dtFUn_NLHHTAj60EmV8)RfOyI*a0c`g^`@f`x
zZl1hgS6Lv0AeEr>#=EcK*^QuA|ISkx+!vVV#`jhG+3W3-cJo{Wm=ktEx@$S6a*DhO
zqv9)!uG;Z|9^&Z<N+xxQW+MmM%hm{GDIWbGE5PE3tg0p+_{heiN)a7l&ph%71~9-N
zE!pTHb)f{1fxtnaQI0Y+Q4<m)c@rHJQNFcQD-pnDk!Mm<7bQVb2Fw+innE7WOq4Mx
z)H*~q35d!wk!+DW6bjL}5($W>(|(W@F!$=Y4ZYqTUtr{<$S`_U?RyEwV;DN2M5uW%
z#R`N^LN<mblQbfv8wEx3n<3e;%bf#qQla(007F^=4GN?a6<_31gn}U+3tu7z(0}Y9
zCKT<kD`}aC4B*N_Qc7gwi?RXL0tB&Q{|ggvE%G(u>9Z_U*rQygB4-bQVmA<q9W|UX
zlWdbwUPUlbY=+%YuIE$KO5<O{0u2i^EYPq(!vYNpG%V1tK*ItJ3p6ayut38C4GT0Z
z(6B(m0u2i^EYPq(!vYNpG%V1tK*ItJ3p6ayut38C4GT0Z(6B(m0u2i^EYPsP{|gHY
zYihQ0+UsK`woIvqlfz=3oaGyjG;<<kdQ5Gjf9sth8P2fkI<ji*iBjQcNzOVOJ+X}g
zrn=6d98;g!I;(9`odc&h*s|pGsg4(-mUdiT#x+^J;zX=)1lXjpb&k$z4kv##kE_q-
zh|2?JaNecu{8@DVJb=@*j^y~eaL^Vlb91=A<M^y_J|<^vg;Ts{aspa7>1)g}>y5rT
zf~#xzhtx#JNY*=%E4<P5dFLUSQCH)govwF0SlQaf5q#FRh6C8v9rqQE{;GQIIzzLY
z)6@P>5B+S;C$+VP!F5=CYJK|T^~@0tJmav>DKl$Hr}a8d2o+&D-ZT4f?AibJY&*^K
z`I@IMb;9HP{BdB)U)S*$>pZLP_>+GgndC1V3mz|a{J|MdQ1VA?p5uo2GccZFF8FJ_
zaQ5Bkw)#n|7YEICa}1u^;26AwqwrKX{0>j!&d#IoSdkBP6yC9YpLt-(NtcPaXV1I)
j!g*(%CGI>=%-*&~Y<qpPn`K;g2wu!_Xq@O;or3o_RoyG^

literal 0
HcmV?d00001

diff --git a/app/core/src/test/resources/timestamp/doc-timestamped.pdf b/app/core/src/test/resources/timestamp/doc-timestamped.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..020a1b9dc4b656755af00ed3607ce5e85456e561
GIT binary patch
literal 21985
zcmeI4d7Kr+wZ|a>>I97_&n+%jA`usuuI{etDj$MfUDZKRLBQ>yM1&gx!i)}s0gc85
z6So*q!32$oiqR0GiMvTO?t;sUF_^_AK7}XdDKR^0Q1h*x85WtS$;<nE-X9m8nLGD(
z*K+Ed^ZWfy_0+)8t{g0esHTB`S+VAYrmPm#T92F7G<0ZF^QaT*E%~JOsjV%w@d@vb
zsWq2V+eg$|W=)@dOjGmdiBswaO`Ov@tG(7ds-<4EPM<ZSrQ_|HwK!bg)I4s^3H4fY
zF|mE(^wud&!-h50TPBC*^?KbLRBxHm{@I#Vriu2ax7XX~XZpnUx~orWom>xh&1`S0
zPn@wu)9h!yyx@s3&qn>r)kDwTcAsZ@+arcAxOHx?K7-ny`Q*=T^wF0`9yevD;>A^a
z4^#{0uUN2y(r;ckfBAQQ^3sZz&pGtkr7v9b$34y6y*{!-{epvbUHVXZ^hX9?KgNyU
z;U0Nv?HfZTJl}TPlBLU@Z~lXvbHlWF;hNpAS^W8>ug*Gj{x_EXY1HMz?q1RBjUIR2
z^`)JT-g^K0wjSJf{;I)iwpe_}&^;#o;?AC1_R%fZ|L*ud>fP3Cy3dMHw{Q3A6$hR3
zmF*9iKk#c$+<((%uf2NWroE<K|KjYO_PK81BX8c+^0m+Py7H*Kwm)R6V+TzUFTS?=
z-}m2s<ZTc4d}{c-gC05k#CzIi-SYTjeGa|*?8)V!$8UMpp_l&krpc$B@x7kK)qM^=
ztIy)yF8s#e^Nu>CW$~Q5etX?FXU)C3*UDv+#ev^*{T5!f_4OB>_|E@4^4GWT*yYl1
zeeK@;Hv9Ot{hk{7=hLsf?~ThZ*QZT*{*t9PfA-~XZ_@W?=A6T?8nfw<6Arv<hf9Wi
zVZVcSI$`8p5AEDz^wY!6Sk`mFmV<YjzSFKx9CP=e`?ox8&!2yL)4os7Ip^@3m-l>Z
z<h!lEdvay-`A^NiW$3DTr|!Jy(nVLaj@f3rXI2%x7xlX4wI`=f^YeFm^tv_8FT6J4
z7c0&k-@nHvKicw%`|tR{$+NGN=N{I7z*n0F_s{Pc{==L1TzJQWgAbf%&%ScUeXbqx
z_-~Kj?V-;fw$qMB4_~&R-_%~Wt$HpQGHUxbemriQFZO)Q?(DA^f5)`NhfUjj(q>oo
z9@(#0bn^G^>_6a@b6<Moo%5&P`O*3>_v-VxtNK52>?;GlyL<mlwjDH9ti18$3D?~;
zxc^UE9@wns)PdK`+4HEco;m0X&#gY{c)Qo5ySJQq{G*qAd&K#hKXm%9ZV)ehe(4Lp
z-TR2)i{j|OY`gsies}lu*LS_L{E;!IF1m2;r!Rkgmve7?`!|cHFMey)r1`tAIl1rf
z6+fSQ<96>17<=MX7k&Mfe&_Xk_XmG|=+-aYvhsqt7xy~nzp?=bFP!$5OZCJ3Ca&1@
zoKN5QpDQQ6wseM^xy5PGjPIWDtv?()@3GM<o_p)ITc3aAq#c`jpZ@L+`<%b|=MFpS
zjVTKk-(OpG&jq!;p1<s~6As*E!dDJ`r|%b^z4(--&5k~E_*>`RaLGl7Z`0Ic#sg2f
zxhLLp+JJZN9KC3l(TA+OYUS^iZL;w7p?`XF=DgWU)_nB8hd)s3U4L>8^Xq;3%OC&P
zelNas+tOE`8ocD`*;g#Qcf{Avz4F$Xv&%o;H+T5ZPrdomzi#vPrYB##z1|`OX-C9$
zg{z1*j@Kkgy5f7(anr`O&uD5sq$ax$VdA=NW_vBpHVEb`uATSO<L{5QdidS>ug|#f
zssny@(szovhwX96Zs%>OF4}L|UoPr<*#+v~R=@E2);kYdx=Wuk9((@O)j#}-%LhDs
z%muv;tdHpTsm)vZtsdLA&vBE-FW)L3`s(8Q_WjK7w|;%AWO4hvXE*uz#UrN<U-kRx
z3*6l|y#8$S3!m=w{Xw@cJ5~=p^MX$--*Ix!`|e&i_WDV;FM9a)SxcuaIOND3k9+V+
zd&<?nyzIwf<UZ5J-?(Jr;BA+0e$&-wo%Pkz{&3@({-3%||M~D=zkK<}_S)~FFTK6y
zSI;i}j|pl2lg``YnN>@FbMq@NpL9e%bm3EnKQn!|3AfFOzC3KZ!&g1r`=UqukC&Z(
z*NC@wJz?C~7jKoz@9($o@>2#Lw%1{oE*){;{O3l@d1&RnKN|J)f^pZ}()NR2iyytZ
z>$K)m*6eq2@1B#JS5LY9tx21H{H>nT#$CNlcgrHWSr*;Yd_c=*T5F2W$iQP-Tia_P
ztMmE*R~tXnr6!ZPc1D^aO;VdGQDkXiTvRxnN5!z(&?Hi_RFTN6ERBc~m*=jKMI;I-
z3Q-ip$o?If{m3!(&oniUoqBS;CgRZX<ofK|_^2iTfUJhw2rfOMHa`3wUVc!1zhcs{
z$G-8C2k(8T$AcH_|9GzlAK(A+`<LANlY5tpe)!%cS3laL$6nv>xw;!m%xs_7);_z9
z!H87prhx<fsIqB`reK3EG%J9RfMpJ3sSR@b#!)PzSm;PZQJn4_MSJl7p5Rwo>*QIJ
z0HHx++o!fopV~5IFc4WgDIOxyAu$(J4Yh9cc{C&yLn1yuxOMUe^sx>H#ri8)j;mqH
zDP6YBTUuJ%G48D6+A9=2V(R26b>1jzBEi<<7~s??Efd>kwbcdP9?lAMEc57Eh1RTn
zeNsECF@)${_r)sYqiLeLcD<2=o4ah)vAC{v(zvNJ>SNm{&NyM+(&YeneaPt1BM+L|
zUayANwWxmF*aL=)DT_oXff+iDtfEY4VG>+y??`kSxoB-^ueY?%48Epg5er-{GI6d|
zs<kS!$gwP06zA2aQQC1;#7gmgl8C5GBCg>c6@_~up=6XqDW4~ijQFOxQhTnj?`ai>
zrj0bTjEB1@t$v!0J2G5?PX+g-bRJq{XmRMxcH0{*#gP=L&774c$p|Q$DQ~kZcP`4Z
zgo%_Y(`72~GL@;U%p+OGIX}H-vXLV4V){{1<TiFVWSPVy*Emsp&k~X7>MOy5NkZs`
z@s%a_=q#nbytJvwlZ<OS<|LB5np3b*m|J8MA(%x}GJ`})`XbCD&1hmJm1O*>Oj3bW
z3$Du7US+u|>G~{VG#R7pY=LZ{oFvwi$&xryiIQ2IrOGJ9SE2;3X<3DLGOi)Zs6rK)
ziK8s3-t*OcsVWtdQjU@MFdyy_$}6l|wZ{A5j_Q7gLquWBncxl?-mR{8+)?$G@g8k^
zCKm42)d)Ig8Lm|#_BdA@KBr&Lh{DxX57qcP#!f3(OeZ+i+W98fqRgs)w9##wiHPyj
zn5H-KWD^NuLaMlPgay6j*eJoEVf2QP#EeXLjgS8E0X((K-WmNHnN{<Sxi_@LJXkZ!
znwhoNso<_@%7U(ok&ZRjw18RZ)r7e!UwI3*s=P$eQSg>D1p{~){Durk%TW<~qZwr6
za_vpw=&y>r_r#Up-Hyl;hTh-nag3`Qk0Y3)C`4(;7%f+25=&qUJOFsYE8n{kT=T&z
zf%W2Gz4zvnj+IEdU5Tt~Em(zwF}RIafxf$6g|2+mX=|?Az}D}xPLc3}eAgN8F|m&I
zl8`S`-iu{keTrvQIU(eQ4L)teI04sfJT_undBTajUFDIiBVG#+B!%c!k&LYdzW`NG
zQxPtpVl1Q=xd4b%VKvBYg^RTpAS+qGr8W{Sm9b2Wcc6tTZBk@T+r*SfTF`_ejk`R~
z1(}|ENjBbiD^nL6lYz3t77SEcU6P2Ljp@ZENtr9<v@5JHw3M#M$j(K{d$G?l%g|h=
zNk9Mqx5T6-m%BW&J}WW+-lo8<mom3`5)hB@t&q=?1-f#haKt3D;2k1KgbYTk^3z8t
zxh)l`fZ<w4VzkWAX`om-lf;U=UV12rjWuLhVpGwHq?m>_JMt40BrS8$)#)Nh6=+TX
z7iH!%o8*})jLb_0sdDHyV+d@bqyLgorB%jN!0lShp>4@31*A{c;<ApzeS$nIVMk1o
z6(FlK+4bKK{3Q+fJd8C7%xZ(r={?pYKo$5yN;7#}#vhPTW7eWVDX@{(AZZukvp`T6
za%B|rVxyh}$YKAHo|2plCoAp)qoKvhN?5$gfH5<QiyUIe7fdl$|47?m<RD+cY&$Uq
znbW}vs`oLdC}3nAed2W~zXvl5%l!CWaU*OkgXQ_1<=@!8A-cprVPD1+SWU%K!niVc
z57ELZflI_%phg?ox3i~z)CL=5%XK|rZ2T67-e?`^C(P7}JTYCYv4a-|o(1o#xEP~f
zkF~AiY+a0uMa7G_K7)fWSEd643g2O%9sIGAf6<-hoj{qAn4Ix`d?N}GAM#nG;JGrj
zr4praaA?*n(Z(3(Nm?@Ud66V=YzPdZAj?A1qv4X&CyH45T*pQUCrK|xYEu+tN$%2+
zS*U$34cQIOWJ`gI(7ct2OUQmvf$+%l)a5oaxfZb`{B-H0D5WXOwA4xBtWLCxZSI}V
zGfyfqj4>%}nWl-#b0NuxK8}6r(y}bz!NM~SB3BkZiZTXXvNmwQBq>T<QOYvclJy{s
zGqk+SGXtwP);sM>h4n(3FEhg^4I>dUQ!*#BBQ9K4Iw!4yWhjFf5X>^lt+a;7fT@>d
zh^wenru3|UHwX@CnQ$(WBo`1J*rzN?U6`!U5Lm&0Qb`vWQQDMQCVVK;jEQB|Cm!FW
z6S8w4bxM1hEel!dC;&_>t+fibBBKy+#v5g{ROD@KKpS|G^>}2gA;+nSb<8Ruo@8Kl
z<ZbH>>D96#nU7?VD@GrHD@KL-BJ)Y1JosQ-ZWy0T6HkT}0mCSP#7U9s%oaMyXhx-|
zGp1Rvnh}!+rku+_qsU8A2I>ohQWkeBWr31mjET2lbOe+wY(`_wW~6`b^AtkQJXxKX
ztK-5bc(o`qd?w|8nQ1av8Btg91hzsscum%T@DddGew-Vo0%ZqOO0cMi(;V(?;zENX
z3cy4;B_7cUUB<z|2&ALQiy|*6-r#Oo=|i%nL$I!l%2cCybKFE)TstlKjch_*O=GA*
z@Z8Me?=saUszhc6Gsk^sFmfW(+NY{WO-d1{EK4kheM?thZU7ql8;$dcRO*DTb?*4d
za!O;BAasn69qs~&fRP{$3t<h>XbKgyeL@PuM3_4(8HJ5v!x)uhRWlt)=W)EEOf#K1
zq>XhxHllFcYBNd1I_Iz+?U0TbTKFkFYM1~InW0O^;LGcDjON4l%PS$jH+0NDp<_ga
z-6&|P6;Y*Tf?`S5>KK}=K7j?T|7pYC#Bgxp53L&m?!|%6cCW?*OC$oqRV13gV#2FH
zo5D}<(kfp2C~(9WR1*kzqtb#*nc7g3B1H*970eqdN;xn?=<+ELVG;v_cVrt9EE&_0
zEukx5AaqIO=!970yafUZ?t`|gETc-MGGjEUn-_o`pp&ZD#)6D!L<Zq4%A!cAqLq}r
z0$ny~4r-vnOIR+|sZ7%}J(88VPDI{ks!Xi|P*bA|6a`R}K+bdN7!xVFpymWDhH{Hk
zjEKYxmk+wZE30y$UE=8q6!)IA7Nj<bCZV22FJ#Uf{71T=Iuv*t8!w@=kb;o9b4{`X
zFk<R>RPIy`%7ge`m$~x>aIp;C1CMc*6os*&)|VQg!ER(uC<CGssJGdiqD07&o|d3h
zWP6{pvVbJ{(PgegsCgHZ1@$K|z>ssfIZsNYSCIgX@KVjpN)g*kBwRvvgRpxeWfGcH
zWJL{}#KB66%nQPL6UT6|6y=5G3g;j;aS45J8fu1(8HtUhQYlp#?-WSjz(nW)r5y-q
zA))EaEjBRLg8!)VO7vI^m`KY4M7FGCWP*mI%Pcj31)#y4W91?ZF|oKO>zBc-3tNDs
zNsjso#h1upDT^L0G++fkC}EncVu>(iv_K+Y4lHGX&|q~*u_kq3V1x&|BDV!dm4F?}
zl|@OR*Js{pI10=R`j1#kOQAI)QkGa8SJjMI#fA$LIDvQI6)b|OLJYAb{+G(qrvkLe
zASZZaVYo1-h)2AHO0CXtab%nJpd}^{CElZLR>s^-iQ5)wVN(Qd$($fRlx`Kl0zqU|
zOSHIF8XAND31*-&8sj(mW8sPrGYk(Z5+U3Ro5;+esq?&K7YEKOE&LqH>QXP@6reKO
zI*Au06a_Dl3YS(4f+mpeXrO?N5HoTFv_9m7luS_lBpgDmuv2*j)hu}@TuTSM>a5qH
zoiS{uLhVqnqJYG8r>#G{GDdNAR-il7HNP`dv=;9B;T1NKEsUiOE=;A=8c6=(kp&+J
zRo{)+Ql)g)s&NQ5Dx5EPEx8Z(K{dec(RUxZrtm&0d|id5LxqPbwZPNE_fWgaJ1ZXS
z&uCGS$$}?VeiD@GMm3LscnwYduhisKZDxbIQdj|Y!;r*5v;XU>L4SwmRJ#uARRMxN
zLOoX)7yB|TJeg4<Hhqkg0=K|>c22-8#lBwH1}BBV4&VUDi^z~MjOH%<I^;~Gj49wu
z9zr1sD<~j@<Vnq5L`d1xqt~f|f`Wj)1TTV`1Dt}|j44$qVW2i?j#LTzJD@n3p5MJ^
zL&+jBjAi$VGz{okgKx9<6*hyAk7@2w7x)3C0eBOL#<$cP<JrB3zffgBeNsIHT+q5m
zZdesSirRE2Ke%0%g#E3^rpR{-C!j$}l#&`(U_p|}p_4LI2}8CK!4jAqCUc0^(t?Rh
zQUcfn9i{>XlAzAO6G2IZB1+1|8a84mk%pZ&Y6NI`s<RYr;Vr0FV3O7gvPnTH1c@pU
zf{XzxAiU!|RGyhG)#8-WXi2rkQ4T19PMnBICt=vGKq#At@-Ws4OB%y7*o*{s4Rt{@
zcTA-^uuCDp#xMr~L}DzOmS}9YiAh{J#_~x@`8e`C$p9s!8jS*0C8{_qN&?5VwxAKl
znnNxHHRi}+v0xmwU06uU+^}e-LM4d0DfG<2mNOvMQ>{X+rVy1JCMkUy$O?B`Hiad$
zg=?&Xr;y9?l46;T9LgA>OR2bIQ6UIIG7rcRl|~qXbw!Gdhl%4M8HNY9*(BCjkBuQ8
z)G<uMz$;QHR7p_)#Fv4Z8R21FilP9;k%;?)T4yB+=qeQjrmdZ%4CNW6Cc`>vLli4?
z5+r(|AW12;Ef&iXO`+}+_zb+1QY1eyqoBym1~#=cPYtIuL;<rg&_)<F^(FWbo==g3
z>W_zOQrUp2WAnn0tp(&CDnYX_Ahrp@no?pU2H8BPvL7B#!6?uY>5&8^egmg8ObJh9
zdm)L4f-JX2rjQ)UD^Mf^1JcDL0{o(U1{Q>$VavD^83<+^xxoZJJQKin@3a3)TIlA<
z3wD(SLI_d`N^iXT8lK$<diC!-mBD?1d2W1PwV%D-K4~}4MSwYB7o@wEV=AY}n=mTA
z!sx0UALt>To}gq>muNO}puKF3P?qA+53&L*p2(_d;(?EBJgOAY5%$a@k6-`;4APQ~
z9#R)d02v4z1RCWiLlZS2F_JgYK@sI!OSKXKTo!pIHFZ%EBxS%{k*O)<@ytXSlR~XS
zWRrlXJQK+lxkI54jVqCWcslI|Spjpep4-st?ePUhPKpepSJl3ka6E>g6H0`d2UDy-
z_#|XwXfjD7Lb_2<B)=Jw9lP8)ASV@C4-7D*CD5QiI#KaOE=4F9;<4~0VgUWe9%4e#
z4!e?;iO2x1EF`5wHohnuP%S_ZEB3!I0oNj5Bc49XLWMobWh!#^5GZy7q1aKwDKp77
z8Rb<36UAoO9p!pHMXfacH7wAuK*ItJ3p6ayut38C4GT0Z(6B(m0u2i^EYPq(!vYNp
zG%V1tK*ItJ3p6ayut38C4GT0Z(6B(m0u2i^EYPq(!vYNpG%V1tK*ItJ3;e&Zz_6xf
zJEy%qW@5{fdN?^O=E+&U@klc#LZ-*mHu|^TDU#s~tF9xf)}AO8j+W%Cv(XdVIAE&l
z9Lh2EnXR+hCe=A`ii0gnPM_*{A!=#I<z-xx)hkZK3P*rV8e8Y+tmbg?SM#{~Y>v1*
zU<T)1+RmRv=g$K;P3uUGzY7O#(K0uO`#X-$3g=^T)>b&hYbGb4g_FL<9JAi&t0TC&
zhJQ#+bc|%Z6S=}0U7vRzk{NY1-r4DT$AguvZ5+X8ZEHAyZQXHS;pnfb*RC@(yE#4W
z|Mbw$=6q6HYZzRI#i!P%PhQU);lMKv`<ybfmULRL^Mp_lmg7CM567PUZ_l>VJfE+5
z`cfx6&d(nQru=msf3eQ9`i?*O=aEVN!m;4-V#gnx@dPD*#O66}h(814DdvK|#tUcP
zjc%)-#CmbiTsOzysSS?7OE?Nog~RXgH16y?3Xc`}P)Fe%+xM9VmYj5%n0xlTyDyw~
h)>-1t^Th0Jd&IWaH@jKJb%)@^9EZk<uGJ}ce*>p~EARjS

literal 0
HcmV?d00001

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 49dfb66bc4..4bacc1b22a 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7475,6 +7475,10 @@ label = "Redact sensitive information"
 desc = "Removes hidden JavaScript so nothing can run automatically when the document is opened."
 label = "Strip active content"
 
+[portal.policies.wizard.capability.timestampPdf]
+desc = "Proves the document existed in this exact form at a point in time, using an independent timestamp authority. Only a hash is sent - the document never leaves your server."
+label = "Add a trusted timestamp"
+
 [portal.policies.wizard.capability.watermark]
 desc = "Stamps a visible mark (e.g. “Confidential”) across every page."
 label = "Apply a watermark"
diff --git a/frontend/editor/src/core/types/validateSignature.ts b/frontend/editor/src/core/types/validateSignature.ts
index 7bd48347c1..4e18eaec7a 100644
--- a/frontend/editor/src/core/types/validateSignature.ts
+++ b/frontend/editor/src/core/types/validateSignature.ts
@@ -8,7 +8,7 @@ export interface SignatureValidationBackendResult {
   coversEntireDocument?: boolean | null; // false = content appended after signing
   revocationChecked?: boolean | null;
   revocationStatus?: string | null; // "not-checked" | "good" | "revoked" | "soft-fail" | "unknown"
-  validationTimeSource?: string | null; // "current" | "signing-time" | "timestamp"
+  validationTimeSource?: string | null; // "current" | "signing-time" | "timestamp" | "document-timestamp"
   signerName?: string | null;
   signatureDate?: string | null;
   reason?: string | null;
@@ -37,7 +37,7 @@ export interface SignatureValidationSignature {
   coversEntireDocument?: boolean | null; // false = content appended after signing
   revocationChecked?: boolean | null;
   revocationStatus?: string | null; // "not-checked" | "good" | "revoked" | "soft-fail" | "unknown"
-  validationTimeSource?: string | null; // "current" | "signing-time" | "timestamp"
+  validationTimeSource?: string | null; // "current" | "signing-time" | "timestamp" | "document-timestamp"
   signerName: string;
   signatureDate: string;
   reason: string;
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
index 582332518c..6c5d73786c 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
@@ -114,6 +114,14 @@ const CAPABILITY_META: Record<
     descEn:
       "Removes hidden JavaScript so nothing can run automatically when the document is opened.",
   },
+
+  timestampPdf: {
+    labelKey: "portal.policies.wizard.capability.timestampPdf.label",
+    labelEn: "Add a trusted timestamp",
+    descKey: "portal.policies.wizard.capability.timestampPdf.desc",
+    descEn:
+      "Proves the document existed in this exact form at a point in time, using an independent timestamp authority. Only a hash is sent - the document never leaves your server.",
+  },
   watermark: {
     labelKey: "portal.policies.wizard.capability.watermark.label",
     labelEn: "Apply a watermark",
diff --git a/frontend/editor/src/proprietary/policies/operations.test.ts b/frontend/editor/src/proprietary/policies/operations.test.ts
index 253e9ae6bd..30326722e6 100644
--- a/frontend/editor/src/proprietary/policies/operations.test.ts
+++ b/frontend/editor/src/proprietary/policies/operations.test.ts
@@ -21,6 +21,7 @@ describe("POLICY_OPERATIONS", () => {
       "ocr",
       "redact",
       "sanitize",
+      "timestampPdf",
       "watermark",
     ]);
     for (const id of ALL_TOOL_IDS) {
diff --git a/frontend/editor/src/proprietary/policies/operations.ts b/frontend/editor/src/proprietary/policies/operations.ts
index 5d07df1717..315f1a463a 100644
--- a/frontend/editor/src/proprietary/policies/operations.ts
+++ b/frontend/editor/src/proprietary/policies/operations.ts
@@ -7,6 +7,7 @@
 import { describeToolOperation } from "@app/hooks/tools/shared/toolOperationDescriptor";
 import { redactOperationConfig } from "@app/hooks/tools/redact/useRedactOperation";
 import { sanitizeOperationConfig } from "@app/hooks/tools/sanitize/useSanitizeOperation";
+import { timestampPdfOperationConfig } from "@app/hooks/tools/timestampPdf/useTimestampPdfOperation";
 import { addWatermarkOperationConfig } from "@app/hooks/tools/addWatermark/useAddWatermarkOperation";
 import { ocrOperationConfig } from "@app/hooks/tools/ocr/useOCROperation";
 import { flattenOperationConfig } from "@app/hooks/tools/flatten/useFlattenOperation";
@@ -53,6 +54,12 @@ export const POLICY_OPERATIONS = {
     "/api/v1/security/sanitize-pdf",
     sanitizeOperationConfig,
   ),
+  // RFC 3161 timestamp. Already a SISO tool; surfacing it here is what makes a signature durable
+  // in a pipeline (PAdES-LTV), and only a SHA-256 hash reaches the TSA - never the document.
+  timestampPdf: describeToolOperation(
+    "/api/v1/security/timestamp-pdf",
+    timestampPdfOperationConfig,
+  ),
   watermark: describeToolOperation(
     "/api/v1/security/add-watermark",
     addWatermarkOperationConfig,

From a4ffdc7831f8392fbdda507bf8a26b4e3c5e9457 Mon Sep 17 00:00:00 2001
From: brios <127139797+balazs-szucs@users.noreply.github.com>
Date: Tue, 21 Jul 2026 19:40:16 +0200
Subject: [PATCH 073/109] fix(viewer): dynamic page number input width based on
 total page count (#6607)

# Description of Changes


### Before:

<img width="3092" height="468" alt="image"
src="https://github.com/user-attachments/assets/8ed16ac3-9547-4f07-937e-4177c4ed16fd"
/>


### After:

<img width="1868" height="490" alt="image"
src="https://github.com/user-attachments/assets/8ddf2227-bac4-49f6-973a-90c9f4667dfe"
/>


### Mobile (after):

<img width="842" height="444" alt="image"
src="https://github.com/user-attachments/assets/e601fa94-45a6-46ae-b432-550bb27a98a6"
/>



<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [X] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [X] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [X] I have performed a self-review of my own code
- [X] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [X] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [X] I have run `task check` to verify linters, typechecks, and tests
pass
- [X] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../components/viewer/PdfViewerToolbar.tsx    | 20 ++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx b/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx
index 893cd35d44..011b1baf17 100644
--- a/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx
+++ b/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx
@@ -18,6 +18,12 @@ import ZoomInIcon from "@mui/icons-material/ZoomIn";
 import ZoomOutIcon from "@mui/icons-material/ZoomOut";
 import MoreVertIcon from "@mui/icons-material/MoreVert";
 
+// Sizing constants for the page number input
+const MIN_PAGE_DIGITS = 2;
+const MIN_INPUT_WIDTH_PX = 48;
+const BASE_INPUT_WIDTH_PX = 32;
+const PX_PER_DIGIT = 8;
+
 interface PdfViewerToolbarProps {
   // Page navigation props (placeholders for now)
   currentPage?: number;
@@ -131,6 +137,15 @@ export function PdfViewerToolbar({
     scrollActions.scrollToLastPage();
   };
 
+  const totalPagesDigits = Math.max(
+    MIN_PAGE_DIGITS,
+    (scrollState.totalPages || 1).toString().length,
+  );
+  const inputWidth = Math.max(
+    MIN_INPUT_WIDTH_PX,
+    BASE_INPUT_WIDTH_PX + totalPagesDigits * PX_PER_DIGIT,
+  );
+
   return (
     <Paper
       radius="xl xl 0 0"
@@ -195,10 +210,13 @@ export function PdfViewerToolbar({
         hideControls
         styles={{
           input: {
-            width: 48,
+            width: inputWidth,
             textAlign: "center",
             fontWeight: 500,
             fontSize: 16,
+            paddingLeft: 4,
+            paddingRight: 4,
+            boxSizing: "border-box",
           },
         }}
       />

From e2ea720fc8c46ade541507f9b2c7ff3532d95777 Mon Sep 17 00:00:00 2001
From: brios <127139797+balazs-szucs@users.noreply.github.com>
Date: Tue, 21 Jul 2026 19:41:44 +0200
Subject: [PATCH 074/109] refactor(api): replace regex literals with compiled
 patterns for improved performance and readability (#6511)

# Description of Changes


This pull request refactors several utility classes and controllers to
replace inline regular expression usage with precompiled `Pattern`
constants. This change improves performance, consistency, and
maintainability by ensuring that regex patterns are compiled only once
and reused throughout the codebase. Additionally, it enhances code
clarity and security in filename and SQL content sanitization.

<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [X] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [X] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [X] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [X] I have performed a self-review of my own code
- [X] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [X] I have run `task check` to verify linters, typechecks, and tests
pass
- [X] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.

---------

Co-authored-by: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
---
 .../software/common/util/PdfTextLocator.java  |  5 +++-
 .../software/common/util/RequestUriUtils.java |  6 ++++-
 .../api/MathAuditorAgentController.java       |  7 ++++--
 .../api/PdfCommentAgentController.java        |  7 ++++--
 .../security/service/DatabaseService.java     | 23 +++++++++++--------
 .../service/PdfCommentAgentOrchestrator.java  |  5 +++-
 .../provider/LocalStorageProvider.java        |  8 ++++++-
 .../storage/provider/S3StorageProvider.java   | 11 ++++++---
 8 files changed, 52 insertions(+), 20 deletions(-)

diff --git a/app/common/src/main/java/stirling/software/common/util/PdfTextLocator.java b/app/common/src/main/java/stirling/software/common/util/PdfTextLocator.java
index 60aa65f74b..ec2a5da708 100644
--- a/app/common/src/main/java/stirling/software/common/util/PdfTextLocator.java
+++ b/app/common/src/main/java/stirling/software/common/util/PdfTextLocator.java
@@ -5,6 +5,7 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Locale;
 import java.util.Optional;
+import java.util.regex.Pattern;
 
 import org.apache.pdfbox.pdmodel.PDDocument;
 import org.apache.pdfbox.pdmodel.common.PDRectangle;
@@ -28,6 +29,8 @@ import lombok.extern.slf4j.Slf4j;
 @Component
 public class PdfTextLocator {
 
+    private static final Pattern NON_ALPHANUMERIC_PATTERN = Pattern.compile("[^A-Za-z0-9]");
+
     /** One found line of text with its user-space bounding box. */
     public record MatchedBox(float x, float y, float width, float height) {}
 
@@ -82,7 +85,7 @@ public class PdfTextLocator {
 
     /** Strip everything non-alphanumeric and lowercase for tolerant matching. */
     private static String normalize(String s) {
-        return s.replaceAll("[^A-Za-z0-9]", "").toLowerCase(Locale.ROOT);
+        return NON_ALPHANUMERIC_PATTERN.matcher(s).replaceAll("").toLowerCase(Locale.ROOT);
     }
 
     private static final class CapturedLine {
diff --git a/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java b/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java
index 4db9f118ec..ea14dcc5b3 100644
--- a/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java
+++ b/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java
@@ -1,7 +1,11 @@
 package stirling.software.common.util;
 
+import java.util.regex.Pattern;
+
 public class RequestUriUtils {
 
+    private static final Pattern SHARE_LINK_PATTERN = Pattern.compile("^/share/[^/]+/?$");
+
     public static boolean isStaticResource(String requestURI) {
         return isStaticResource("", requestURI);
     }
@@ -202,7 +206,7 @@ public class RequestUriUtils {
                 // Workflow participant endpoints - access controlled by share tokens, not login
                 || trimmedUri.startsWith("/api/v1/workflow/participant/")
                 // Share-link SPA bootstrap; data APIs remain protected
-                || trimmedUri.matches("^/share/[^/]+/?$");
+                || SHARE_LINK_PATTERN.matcher(trimmedUri).matches();
     }
 
     private static String stripContextPath(String contextPath, String requestURI) {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/MathAuditorAgentController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/MathAuditorAgentController.java
index 20ca5c109f..3199901d4c 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/MathAuditorAgentController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/MathAuditorAgentController.java
@@ -2,6 +2,7 @@ package stirling.software.proprietary.controller.api;
 
 import java.io.IOException;
 import java.math.BigDecimal;
+import java.util.regex.Pattern;
 
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
@@ -46,6 +47,7 @@ import stirling.software.proprietary.service.MathAuditorOrchestrator;
 @Tag(name = "AI Tools", description = "Dispatchable AI-backed tools.")
 public class MathAuditorAgentController {
 
+    private static final Pattern NEWLINE_PATTERN = Pattern.compile("[\\r\\n]");
     private final MathAuditorOrchestrator orchestrator;
 
     @PostMapping(value = "/math-auditor-agent", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
@@ -83,9 +85,10 @@ public class MathAuditorAgentController {
             return ResponseEntity.badRequest().build();
         }
 
+        String originalFilename = fileInput.getOriginalFilename();
         String safeName =
-                fileInput.getOriginalFilename() != null
-                        ? fileInput.getOriginalFilename().replaceAll("[\\r\\n]", "_")
+                originalFilename != null
+                        ? NEWLINE_PATTERN.matcher(originalFilename).replaceAll("_")
                         : "<unnamed>";
         log.info("[math-auditor-agent] request file={} tolerance={}", safeName, tolerance);
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PdfCommentAgentController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PdfCommentAgentController.java
index ef0ceaba25..c02a804ce9 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PdfCommentAgentController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PdfCommentAgentController.java
@@ -1,6 +1,7 @@
 package stirling.software.proprietary.controller.api;
 
 import java.io.IOException;
+import java.util.regex.Pattern;
 
 import org.springframework.core.io.ByteArrayResource;
 import org.springframework.core.io.Resource;
@@ -45,6 +46,7 @@ import tools.jackson.databind.node.ObjectNode;
 @Tag(name = "AI Tools", description = "Dispatchable AI-backed tools.")
 public class PdfCommentAgentController {
 
+    private static final Pattern NEWLINE_PATTERN = Pattern.compile("[\\r\\n]");
     private final PdfCommentAgentOrchestrator orchestrator;
     private final ObjectMapper objectMapper;
 
@@ -78,9 +80,10 @@ public class PdfCommentAgentController {
                     String prompt)
             throws IOException {
 
+        String originalFilename = fileInput.getOriginalFilename();
         String safeName =
-                fileInput.getOriginalFilename() != null
-                        ? fileInput.getOriginalFilename().replaceAll("[\\r\\n]", "_")
+                originalFilename != null
+                        ? NEWLINE_PATTERN.matcher(originalFilename).replaceAll("_")
                         : "<unnamed>";
         log.info(
                 "[pdf-comment-agent] request file={} promptLen={}",
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseService.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseService.java
index ffd9b5cb17..f18f6bd160 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/DatabaseService.java
@@ -46,6 +46,9 @@ public class DatabaseService implements DatabaseServiceInterface {
 
     public static final String BACKUP_PREFIX = "backup_";
     public static final String SQL_SUFFIX = ".sql";
+    private static final Pattern WHITESPACE_PATTERN = Pattern.compile("\\s+");
+    private static final Pattern LINE_COMMENT_PATTERN = Pattern.compile("--[^\r\n]*");
+    private static final Pattern BLOCK_COMMENT_PATTERN = Pattern.compile("/\\*[\\s\\S]*?\\*/");
     private final Path BACKUP_DIR;
 
     // Whitelist of allowed SQL patterns for H2 database backups (generated by SCRIPT command)
@@ -520,7 +523,7 @@ public class DatabaseService implements DatabaseServiceInterface {
     private void validateSqlContent(Path scriptPath) {
         try {
             String content = Files.readString(scriptPath);
-            String normalizedContent = normalizeSqlContent(content);
+            String normalizedContent = sanitizeSql(content);
 
             String codeOnly = stripStringLiterals(normalizedContent);
             for (Pattern deniedPattern : DENIED_PATTERNS) {
@@ -568,19 +571,21 @@ public class DatabaseService implements DatabaseServiceInterface {
     }
 
     /**
-     * Normalizes SQL content by removing comments to prevent bypass attacks.
+     * Sanitize SQL content by removing comments to prevent bypass attacks.
      *
-     * @param sql the SQL content to normalize
-     * @return normalized SQL without comments
+     * @param sql the SQL content to sanitize
+     * @return sanitize SQL without comments
      */
-    private String normalizeSqlContent(String sql) {
+    private String sanitizeSql(String sql) {
         // Remove block comments (/* ... */)
-        sql = sql.replaceAll("/\\*[\\s\\S]*?\\*/", " ");
+        // TODO: I feel like this should re-evaluated.
+        // Passing around SQL like this, smells a bit when we have Hibernate/Critaria API.
+        String intermediateSql = BLOCK_COMMENT_PATTERN.matcher(sql).replaceAll(" ");
         // Remove line comments (--....)
-        sql = sql.replaceAll("--[^\r\n]*", " ");
+        intermediateSql = LINE_COMMENT_PATTERN.matcher(intermediateSql).replaceAll(" ");
         // Collapse multiple whitespaces
-        sql = sql.replaceAll("\\s+", " ");
-        return sql.trim();
+        intermediateSql = WHITESPACE_PATTERN.matcher(intermediateSql).replaceAll(" ");
+        return intermediateSql.trim();
     }
 
     private String stripStringLiterals(String sql) {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/PdfCommentAgentOrchestrator.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/PdfCommentAgentOrchestrator.java
index 9fbcda00f8..57b5699e62 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/service/PdfCommentAgentOrchestrator.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/PdfCommentAgentOrchestrator.java
@@ -7,6 +7,7 @@ import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.UUID;
+import java.util.regex.Pattern;
 
 import org.apache.commons.io.FilenameUtils;
 import org.apache.pdfbox.pdmodel.PDDocument;
@@ -62,6 +63,8 @@ public class PdfCommentAgentOrchestrator {
     /** Filename used when the uploaded PDF has no usable original filename. */
     private static final String FALLBACK_OUTPUT_NAME = "document-commented.pdf";
 
+    private static final Pattern NEWLINE_PATTERN = Pattern.compile("[\\r\\n]");
+
     /**
      * Small value record returned to the controller: the annotated PDF bytes, the suggested
      * download filename (used in the {@code Content-Disposition} header), and metadata the
@@ -263,7 +266,7 @@ public class PdfCommentAgentOrchestrator {
 
     private static String safeName(String originalFilename) {
         return originalFilename != null
-                ? originalFilename.replaceAll("[\\r\\n]", "_")
+                ? NEWLINE_PATTERN.matcher(originalFilename).replaceAll("_")
                 : "<unnamed>";
     }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/storage/provider/LocalStorageProvider.java b/app/proprietary/src/main/java/stirling/software/proprietary/storage/provider/LocalStorageProvider.java
index b67b66f540..91e8ef2945 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/storage/provider/LocalStorageProvider.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/storage/provider/LocalStorageProvider.java
@@ -4,9 +4,11 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.nio.file.StandardCopyOption;
 import java.util.Optional;
 import java.util.UUID;
+import java.util.regex.Pattern;
 
 import org.springframework.core.io.FileSystemResource;
 import org.springframework.core.io.Resource;
@@ -19,6 +21,7 @@ import stirling.software.proprietary.security.model.User;
 @RequiredArgsConstructor
 public class LocalStorageProvider implements StorageProvider {
 
+    private static final Pattern CONTROL_CHARACTER_PATTERN = Pattern.compile("\\p{Cntrl}");
     private final Path basePath;
 
     @Override
@@ -79,7 +82,10 @@ public class LocalStorageProvider implements StorageProvider {
         if (filename == null || filename.isBlank()) {
             return "file";
         }
-        String stripped = Path.of(filename).getFileName().toString().replaceAll("\\p{Cntrl}", "");
+        String stripped =
+                CONTROL_CHARACTER_PATTERN
+                        .matcher(Paths.get(filename).getFileName().toString())
+                        .replaceAll("");
         return stripped.isBlank() ? "file" : stripped;
     }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/storage/provider/S3StorageProvider.java b/app/proprietary/src/main/java/stirling/software/proprietary/storage/provider/S3StorageProvider.java
index 2b88d64844..80e0cbcfd3 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/storage/provider/S3StorageProvider.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/storage/provider/S3StorageProvider.java
@@ -4,10 +4,11 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.net.URI;
 import java.net.URISyntaxException;
-import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.time.Duration;
 import java.util.Optional;
 import java.util.UUID;
+import java.util.regex.Pattern;
 
 import org.springframework.core.io.InputStreamResource;
 import org.springframework.core.io.Resource;
@@ -34,6 +35,7 @@ import software.amazon.awssdk.services.s3.presigner.model.PresignedGetObjectRequ
 @Slf4j
 public class S3StorageProvider implements StorageProvider, AutoCloseable {
 
+    private static final Pattern CONTROL_CHARACTER_PATTERN = Pattern.compile("\\p{Cntrl}");
     private final S3Client s3Client;
     private final S3Presigner s3Presigner;
     private final String bucket;
@@ -152,7 +154,7 @@ public class S3StorageProvider implements StorageProvider, AutoCloseable {
         }
         // Strip CR/LF and other control chars before path parsing (Path.of throws on them on
         // Windows, and they defeat header parsers).
-        String stripped = originalFilename.replaceAll("\\p{Cntrl}", "");
+        String stripped = CONTROL_CHARACTER_PATTERN.matcher(originalFilename).replaceAll("");
         // Use only the basename to avoid leaking directory structure into the header.
         int lastSeparator = Math.max(stripped.lastIndexOf('/'), stripped.lastIndexOf('\\'));
         if (lastSeparator >= 0) {
@@ -184,7 +186,10 @@ public class S3StorageProvider implements StorageProvider, AutoCloseable {
         if (filename == null || filename.isBlank()) {
             return "file";
         }
-        String stripped = Path.of(filename).getFileName().toString().replaceAll("\\p{Cntrl}", "");
+        String stripped =
+                CONTROL_CHARACTER_PATTERN
+                        .matcher(Paths.get(filename).getFileName().toString())
+                        .replaceAll("");
         return stripped.isBlank() ? "file" : stripped;
     }
 }

From e24a30828b5adb09cee83b36ba9d814fd75a82b5 Mon Sep 17 00:00:00 2001
From: brios <127139797+balazs-szucs@users.noreply.github.com>
Date: Tue, 21 Jul 2026 20:49:59 +0200
Subject: [PATCH 075/109] refactor(api): replace deprecated APIs with their
 modern equivalents (#6434)

# Description of Changes


This PR resolves deprecation warnings and addresses compiler errors
resulting from the transition to Spring Security 7.x., as well Jackson 3
and general Java.

* Replaced all usages of `asText()`/`isTextual()` with
`asString()`/`isString()` in JSON parsing logic across
`FormPayloadParser.java`, `ApiEndpoint.java`, and
`KeygenLicenseVerifier.java` to ensure consistent and type-safe string
* Updated `CustomSaml2AuthenticatedPrincipal` to implement
`Saml2ResponseAssertionAccessor`, added a `responseValue` field, and
provided additional getter methods and type-safe attribute accessors.
* Switched from constructing `URL` objects directly from strings to
using `URI.create(...).toURL()` in `UIDataTessdataController.java` for
improved URL safety and parsing.

<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [x] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [x] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../api/form/FormPayloadParser.java           | 16 +++----
 .../software/SPDF/model/ApiEndpoint.java      |  4 +-
 .../ee/KeygenLicenseVerifier.java             | 42 +++++++++----------
 .../api/UIDataTessdataController.java         |  5 ++-
 .../CustomSaml2AuthenticatedPrincipal.java    | 37 ++++++++++++++--
 ...mSaml2ResponseAuthenticationConverter.java |  6 ++-
 .../service/AiToolInputValidator.java         |  2 +-
 .../service/AiWorkflowService.java            |  4 +-
 .../storage/service/FileStorageService.java   |  6 +--
 .../service/SigningFinalizationService.java   |  4 +-
 .../ProprietaryUIDataControllerMoreTest.java  |  2 +-
 .../service/AiToolInputValidatorTest.java     |  2 +-
 12 files changed, 83 insertions(+), 47 deletions(-)

diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/form/FormPayloadParser.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/form/FormPayloadParser.java
index 6c0c40ef0a..6f82c7546e 100644
--- a/app/core/src/main/java/stirling/software/SPDF/controller/api/form/FormPayloadParser.java
+++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/form/FormPayloadParser.java
@@ -117,8 +117,8 @@ final class FormPayloadParser {
                     names.add(single);
                 }
             }
-        } else if (root.isTextual()) {
-            final String single = trimToNull(root.asText(""));
+        } else if (root.isString()) {
+            final String single = trimToNull(root.asString(""));
             if (single != null) {
                 names.add(single);
             }
@@ -197,8 +197,8 @@ final class FormPayloadParser {
         if (node == null || node.isNull()) {
             return null;
         }
-        if (node.isTextual()) {
-            return trimToEmpty(node.asText(""));
+        if (node.isString()) {
+            return trimToEmpty(node.asString(""));
         }
         if (node.isNumber()) {
             return node.numberValue().toString();
@@ -207,7 +207,7 @@ final class FormPayloadParser {
             return Boolean.toString(node.booleanValue());
         }
         // Fallback for other scalar-like nodes
-        return trimToEmpty(node.asText(""));
+        return trimToEmpty(node.asString(""));
     }
 
     private static void collectNames(JsonNode arrayNode, Set<String> sink) {
@@ -227,8 +227,8 @@ final class FormPayloadParser {
             return null;
         }
 
-        if (node.isTextual()) {
-            return trimToNull(node.asText(""));
+        if (node.isString()) {
+            return trimToNull(node.asString(""));
         }
 
         if (node.isObject()) {
@@ -269,7 +269,7 @@ final class FormPayloadParser {
                             final JsonNode v = objectNode.get(key);
                             if (v == null || v.isNull()) {
                                 result.put(key, null);
-                            } else if (v.isTextual() || v.isNumber() || v.isBoolean()) {
+                            } else if (v.isString() || v.isNumber() || v.isBoolean()) {
                                 result.put(key, coerceScalarToString(v));
                             } else {
                                 result.put(key, v.toString());
diff --git a/app/core/src/main/java/stirling/software/SPDF/model/ApiEndpoint.java b/app/core/src/main/java/stirling/software/SPDF/model/ApiEndpoint.java
index 04d2bb1fa1..e25b0dde8e 100644
--- a/app/core/src/main/java/stirling/software/SPDF/model/ApiEndpoint.java
+++ b/app/core/src/main/java/stirling/software/SPDF/model/ApiEndpoint.java
@@ -18,10 +18,10 @@ public class ApiEndpoint {
         postNode.path("parameters")
                 .forEach(
                         paramNode -> {
-                            String paramName = paramNode.path("name").asText("");
+                            String paramName = paramNode.path("name").asString("");
                             parameters.put(paramName, paramNode);
                         });
-        this.description = postNode.path("description").asText("");
+        this.description = postNode.path("description").asString("");
     }
 
     public boolean areParametersValid(Map<String, Object> providedParams) {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/ee/KeygenLicenseVerifier.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/ee/KeygenLicenseVerifier.java
index 1680aa9285..bc68a64f6e 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/ee/KeygenLicenseVerifier.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/ee/KeygenLicenseVerifier.java
@@ -134,9 +134,9 @@ public class KeygenLicenseVerifier {
 
             try {
                 JsonNode attrs = objectMapper.readTree(payload);
-                encryptedData = attrs.path("enc").asText("");
-                encodedSignature = attrs.path("sig").asText("");
-                algorithm = attrs.path("alg").asText("");
+                encryptedData = attrs.path("enc").asString("");
+                encodedSignature = attrs.path("sig").asString("");
+                algorithm = attrs.path("alg").asString("");
             } catch (Exception e) {
                 log.error("Failed to parse license file: {}", e.getMessage());
                 return false;
@@ -219,11 +219,11 @@ public class KeygenLicenseVerifier {
                 String issuedStr =
                         metaObj.path("issued").isNull()
                                 ? null
-                                : metaObj.path("issued").asText(null);
+                                : metaObj.path("issued").asString(null);
                 String expiryStr =
                         metaObj.path("expiry").isNull()
                                 ? null
-                                : metaObj.path("expiry").asText(null);
+                                : metaObj.path("expiry").asString(null);
 
                 if (issuedStr != null && expiryStr != null) {
                     java.time.Instant issued = java.time.Instant.parse(issuedStr);
@@ -287,7 +287,7 @@ public class KeygenLicenseVerifier {
                 }
 
                 // Check license status if available
-                String status = attributesObj.path("status").asText(null);
+                String status = attributesObj.path("status").asString(null);
                 if (status != null
                         && !"ACTIVE".equals(status)
                         && !"EXPIRING".equals(status)) { // Accept "EXPIRING" status as valid
@@ -381,7 +381,7 @@ public class KeygenLicenseVerifier {
 
             JsonNode licenseObj = licenseData.path("license");
             if (licenseObj.isMissingNode() || !licenseObj.isObject()) {
-                String id = licenseData.path("id").asText(null);
+                String id = licenseData.path("id").asString(null);
                 if (id != null) {
                     log.info("Found license ID: {}", id);
                     licenseObj = licenseData; // Use the root object as the license object
@@ -391,7 +391,7 @@ public class KeygenLicenseVerifier {
                 }
             }
 
-            String licenseId = licenseObj.path("id").asText("unknown");
+            String licenseId = licenseObj.path("id").asString("unknown");
             log.info("Processing license with ID: {}", licenseId);
 
             // Check for floating license in license object
@@ -402,7 +402,7 @@ public class KeygenLicenseVerifier {
             }
 
             // Check expiry date
-            String expiryStr = licenseObj.path("expiry").asText(null);
+            String expiryStr = licenseObj.path("expiry").asString(null);
             if (expiryStr != null && !"null".equals(expiryStr)) {
                 java.time.Instant expiry = java.time.Instant.parse(expiryStr);
                 java.time.Instant now = java.time.Instant.now();
@@ -420,7 +420,7 @@ public class KeygenLicenseVerifier {
             // Extract account, product, policy info
             JsonNode accountObj = licenseData.path("account");
             if (!accountObj.isMissingNode() && accountObj.isObject()) {
-                String accountId = accountObj.path("id").asText("unknown");
+                String accountId = accountObj.path("id").asString("unknown");
                 log.info("License belongs to account: {}", accountId);
 
                 // Verify this matches your expected account ID
@@ -433,7 +433,7 @@ public class KeygenLicenseVerifier {
             // Extract policy information if available
             JsonNode policyObj = licenseData.path("policy");
             if (!policyObj.isMissingNode() && policyObj.isObject()) {
-                String policyId = policyObj.path("id").asText("unknown");
+                String policyId = policyObj.path("id").asString("unknown");
                 log.info("License uses policy: {}", policyId);
 
                 // Check for floating license in policy
@@ -503,9 +503,9 @@ public class KeygenLicenseVerifier {
                         validateLicense(licenseKey, machineFingerprint, context);
                 if (validationResponse != null) {
                     boolean isValid = validationResponse.path("meta").path("valid").asBoolean();
-                    String licenseId = validationResponse.path("data").path("id").asText("");
+                    String licenseId = validationResponse.path("data").path("id").asString("");
                     if (!isValid) {
-                        String code = validationResponse.path("meta").path("code").asText("");
+                        String code = validationResponse.path("meta").path("code").asString("");
                         log.info(code);
                         if ("NO_MACHINE".equals(code)
                                 || "NO_MACHINES".equals(code)
@@ -589,8 +589,8 @@ public class KeygenLicenseVerifier {
             JsonNode metaNode = jsonResponse.path("meta");
             boolean isValid = metaNode.path("valid").asBoolean();
 
-            String detail = metaNode.path("detail").asText("");
-            String code = metaNode.path("code").asText("");
+            String detail = metaNode.path("detail").asString("");
+            String code = metaNode.path("code").asString("");
 
             log.info("License validity: {}", isValid);
             log.info("Validation detail: {}", detail);
@@ -614,7 +614,7 @@ public class KeygenLicenseVerifier {
 
             if (includedNode.isArray()) {
                 for (JsonNode node : includedNode) {
-                    if ("policies".equals(node.path("type").asText(""))) {
+                    if ("policies".equals(node.path("type").asString(""))) {
                         policyNode = node;
                         break;
                     }
@@ -700,9 +700,9 @@ public class KeygenLicenseVerifier {
 
                 for (JsonNode machine : machines) {
                     if (machineFingerprint.equals(
-                            machine.path("attributes").path("fingerprint").asText(""))) {
+                            machine.path("attributes").path("fingerprint").asString(""))) {
                         isCurrentMachineActivated = true;
-                        currentMachineId = machine.path("id").asText("");
+                        currentMachineId = machine.path("id").asString("");
                         log.info(
                                 "Current machine is already activated with ID: {}",
                                 currentMachineId);
@@ -729,14 +729,14 @@ public class KeygenLicenseVerifier {
 
                         for (JsonNode machine : machines) {
                             String createdStr =
-                                    machine.path("attributes").path("created").asText(null);
+                                    machine.path("attributes").path("created").asString(null);
                             if (createdStr != null && !createdStr.isEmpty()) {
                                 try {
                                     java.time.Instant createdTime =
                                             java.time.Instant.parse(createdStr);
                                     if (oldestTime == null || createdTime.isBefore(oldestTime)) {
                                         oldestTime = createdTime;
-                                        oldestMachineId = machine.path("id").asText("");
+                                        oldestMachineId = machine.path("id").asString("");
                                     }
                                 } catch (Exception e) {
                                     log.warn(
@@ -750,7 +750,7 @@ public class KeygenLicenseVerifier {
                         if (oldestMachineId == null) {
                             log.warn(
                                     "Could not determine oldest machine by timestamp, using first machine in list");
-                            oldestMachineId = machines.path(0).path("id").asText("");
+                            oldestMachineId = machines.path(0).path("id").asString("");
                         }
 
                         log.info("Deregistering machine with ID: {}", oldestMachineId);
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/UIDataTessdataController.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/UIDataTessdataController.java
index 8212dcfb29..3aba9d0eb9 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/UIDataTessdataController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/UIDataTessdataController.java
@@ -3,6 +3,7 @@ package stirling.software.proprietary.security.controller.api;
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.HttpURLConnection;
+import java.net.URI;
 import java.net.URL;
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -150,7 +151,7 @@ public class UIDataTessdataController {
     protected boolean downloadLanguageFile(String safeLang, Path targetFile, String downloadUrl) {
         HttpURLConnection connection = null;
         try {
-            URL url = new URL(downloadUrl);
+            URL url = URI.create(downloadUrl).toURL();
             connection = (HttpURLConnection) url.openConnection();
             connection.setRequestMethod("GET");
             connection.setRequestProperty("User-Agent", "Stirling-PDF-App");
@@ -199,7 +200,7 @@ public class UIDataTessdataController {
         String apiUrl = "https://api.github.com/repos/tesseract-ocr/tessdata/contents";
         HttpURLConnection connection = null;
         try {
-            URL url = new URL(apiUrl);
+            URL url = URI.create(apiUrl).toURL();
             connection = (HttpURLConnection) url.openConnection();
             connection.setRequestMethod("GET");
             connection.setRequestProperty("User-Agent", "Stirling-PDF-App");
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2AuthenticatedPrincipal.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2AuthenticatedPrincipal.java
index a39a390927..c58d2dcc73 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2AuthenticatedPrincipal.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2AuthenticatedPrincipal.java
@@ -5,15 +5,17 @@ import java.util.List;
 import java.util.Map;
 
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
-import org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticatedPrincipal;
+import org.springframework.security.core.AuthenticatedPrincipal;
+import org.springframework.security.saml2.provider.service.authentication.Saml2ResponseAssertionAccessor;
 
 @ConditionalOnProperty(name = "security.saml2.enabled", havingValue = "true")
 public record CustomSaml2AuthenticatedPrincipal(
         String name,
         Map<String, List<Object>> attributes,
         String nameId,
-        List<String> sessionIndexes)
-        implements Saml2AuthenticatedPrincipal, Serializable {
+        List<String> sessionIndexes,
+        String responseValue)
+        implements Saml2ResponseAssertionAccessor, AuthenticatedPrincipal, Serializable {
 
     @Override
     public String getName() {
@@ -24,4 +26,33 @@ public record CustomSaml2AuthenticatedPrincipal(
     public Map<String, List<Object>> getAttributes() {
         return this.attributes;
     }
+
+    @Override
+    public String getNameId() {
+        return this.nameId;
+    }
+
+    @Override
+    public List<String> getSessionIndexes() {
+        return this.sessionIndexes;
+    }
+
+    @Override
+    public String getResponseValue() {
+        return this.responseValue;
+    }
+
+    @Override
+    @SuppressWarnings("unchecked")
+    public <A> List<A> getAttribute(String name) {
+        List<Object> values = this.attributes.get(name);
+        return values != null ? (List<A>) values : null;
+    }
+
+    @Override
+    @SuppressWarnings("unchecked")
+    public <A> A getFirstAttribute(String name) {
+        List<Object> values = this.attributes.get(name);
+        return values != null && !values.isEmpty() ? (A) values.get(0) : null;
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2ResponseAuthenticationConverter.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2ResponseAuthenticationConverter.java
index f95e2cbc25..0acc98ee55 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2ResponseAuthenticationConverter.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/saml2/CustomSaml2ResponseAuthenticationConverter.java
@@ -99,7 +99,11 @@ public class CustomSaml2ResponseAuthenticationConverter
 
         CustomSaml2AuthenticatedPrincipal principal =
                 new CustomSaml2AuthenticatedPrincipal(
-                        userIdentifier, attributes, userIdentifier, sessionIndexes);
+                        userIdentifier,
+                        attributes,
+                        userIdentifier,
+                        sessionIndexes,
+                        responseToken.getToken().getSaml2Response());
 
         return new Saml2Authentication(
                 principal,
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/AiToolInputValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiToolInputValidator.java
index 260d69fb22..b2d389be3e 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/service/AiToolInputValidator.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiToolInputValidator.java
@@ -39,7 +39,7 @@ public final class AiToolInputValidator {
         }
         if (file.getSize() > MAX_INPUT_FILE_BYTES) {
             throw new ResponseStatusException(
-                    HttpStatus.PAYLOAD_TOO_LARGE,
+                    HttpStatus.CONTENT_TOO_LARGE,
                     "PDF exceeds maximum size of "
                             + (MAX_INPUT_FILE_BYTES / (1024 * 1024))
                             + " MB for AI tools");
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/AiWorkflowService.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiWorkflowService.java
index 74e68d4602..b9e3488324 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/service/AiWorkflowService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiWorkflowService.java
@@ -774,7 +774,7 @@ public class AiWorkflowService {
             String[] errorHolder) {
         try {
             JsonNode node = objectMapper.readTree(line);
-            String event = node.path("event").asText();
+            String event = node.path("event").asString();
             switch (event) {
                 case "progress" -> {
                     AiEngineProgressDetail detail =
@@ -785,7 +785,7 @@ public class AiWorkflowService {
                     JsonNode response = node.path("response");
                     resultHolder[0] = objectMapper.treeToValue(response, AiWorkflowResponse.class);
                 }
-                case "error" -> errorHolder[0] = node.path("message").asText("unknown error");
+                case "error" -> errorHolder[0] = node.path("message").asString("unknown error");
                 case "heartbeat" -> listener.onHeartbeat();
                 default -> log.warn("Ignoring unknown engine stream event: {}", event);
             }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/storage/service/FileStorageService.java b/app/proprietary/src/main/java/stirling/software/proprietary/storage/service/FileStorageService.java
index 37d1e5fa43..32371222f6 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/storage/service/FileStorageService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/storage/service/FileStorageService.java
@@ -943,7 +943,7 @@ public class FileStorageService {
         long maxFileBytes = toBytes(quotas.getMaxFileMb());
         if (maxFileBytes > 0 && newBytes > maxFileBytes) {
             throw new ResponseStatusException(
-                    HttpStatus.PAYLOAD_TOO_LARGE, "Stored file exceeds the maximum size");
+                    HttpStatus.CONTENT_TOO_LARGE, "Stored file exceeds the maximum size");
         }
 
         long delta = newBytes - existingBytes;
@@ -956,7 +956,7 @@ public class FileStorageService {
             long currentBytes = storedFileRepository.sumStorageBytesByOwner(owner);
             if (currentBytes + delta > maxUserBytes) {
                 throw new ResponseStatusException(
-                        HttpStatus.PAYLOAD_TOO_LARGE, "User storage quota exceeded");
+                        HttpStatus.CONTENT_TOO_LARGE, "User storage quota exceeded");
             }
         }
 
@@ -965,7 +965,7 @@ public class FileStorageService {
             long totalBytes = storedFileRepository.sumStorageBytesTotal();
             if (totalBytes + delta > maxTotalBytes) {
                 throw new ResponseStatusException(
-                        HttpStatus.PAYLOAD_TOO_LARGE, "System storage quota exceeded");
+                        HttpStatus.CONTENT_TOO_LARGE, "System storage quota exceeded");
             }
         }
     }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/workflow/service/SigningFinalizationService.java b/app/proprietary/src/main/java/stirling/software/proprietary/workflow/service/SigningFinalizationService.java
index 30673ab5bd..e5e122df45 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/workflow/service/SigningFinalizationService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/workflow/service/SigningFinalizationService.java
@@ -1045,12 +1045,12 @@ public class SigningFinalizationService {
                 if (certNode.has("p12Keystore")) {
                     submission.setP12Keystore(
                             metadataEncryptionService.decryptBytes(
-                                    certNode.get("p12Keystore").asText()));
+                                    certNode.get("p12Keystore").asString()));
                 }
                 if (certNode.has("jksKeystore")) {
                     submission.setJksKeystore(
                             metadataEncryptionService.decryptBytes(
-                                    certNode.get("jksKeystore").asText()));
+                                    certNode.get("jksKeystore").asString()));
                 }
                 return submission;
             }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerMoreTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerMoreTest.java
index 58b8972a45..6b469f7ba2 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerMoreTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ProprietaryUIDataControllerMoreTest.java
@@ -235,7 +235,7 @@ class ProprietaryUIDataControllerMoreTest {
 
             CustomSaml2AuthenticatedPrincipal principal =
                     new CustomSaml2AuthenticatedPrincipal(
-                            "samluser", Map.of(), "nameId", List.of());
+                            "samluser", Map.of(), "nameId", List.of(), "response");
             Authentication auth =
                     new UsernamePasswordAuthenticationToken(principal, null, List.of());
 
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/service/AiToolInputValidatorTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiToolInputValidatorTest.java
index 5f8c906fce..2c4a1fe815 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/service/AiToolInputValidatorTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiToolInputValidatorTest.java
@@ -75,6 +75,6 @@ class AiToolInputValidatorTest {
                 assertThrows(
                         ResponseStatusException.class,
                         () -> AiToolInputValidator.validatePdfUpload(file));
-        assertEquals(HttpStatus.PAYLOAD_TOO_LARGE, ex.getStatusCode());
+        assertEquals(HttpStatus.CONTENT_TOO_LARGE, ex.getStatusCode());
     }
 }

From a4ac034a181c6ce5e78fe4bf35b4d7271f240bfd Mon Sep 17 00:00:00 2001
From: Ludy <Ludy87@users.noreply.github.com>
Date: Wed, 22 Jul 2026 09:10:19 +0200
Subject: [PATCH 076/109] feat(build): centralize Java toolchain language
 version configuration (#6894)

# Description of Changes

This change centralizes the Java toolchain language version into a
single `buildJavaLanguageVersion` variable and reuses it across all Java
compilation tasks to ensure consistent toolchain selection.

### What was changed

- Introduced a shared `buildJavaLanguageVersion` variable derived from
the optional `javaVersion` project property, defaulting to Java 25.
- Updated the root project's Java toolchain configuration to use the
shared variable.
- Updated all subproject Java toolchain configurations to reference the
same shared variable instead of a hardcoded language version.
- Explicitly configured the `compileRestartHelper` task to use a
`javaCompiler` resolved from the same shared toolchain version.

### Why the change was made

- Eliminate duplicated Java language version definitions.
- Ensure all compilation tasks use the same Java toolchain
configuration.
- Allow the `javaVersion` project property to consistently affect the
root project, subprojects, and the restart helper compilation task.
- Simplify future Java version upgrades by requiring changes in only one
location.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 build.gradle | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/build.gradle b/build.gradle
index e4d6a16f8f..8070d9db82 100644
--- a/build.gradle
+++ b/build.gradle
@@ -49,11 +49,15 @@ ext {
     modernJavaVersion = 25
 }
 
+def buildJavaMajorVersion = (project.findProperty('javaVersion') ?: ext.modernJavaVersion).toString().toInteger()
+def buildJavaLanguageVersion = JavaLanguageVersion.of(buildJavaMajorVersion)
+def buildJavaVersion = JavaVersion.toVersion(buildJavaMajorVersion.toString())
+
 java {
-    sourceCompatibility = JavaVersion.VERSION_25
-    targetCompatibility = JavaVersion.VERSION_25
+    sourceCompatibility = buildJavaVersion
+    targetCompatibility = buildJavaVersion
     toolchain {
-        languageVersion = JavaLanguageVersion.of(project.findProperty('javaVersion')?.toString() ?: '25')
+        languageVersion = buildJavaLanguageVersion
     }
 }
 
@@ -174,10 +178,10 @@ subprojects {
     apply from: rootProject.file('gradle/spotless.gradle')
 
     java {
-        sourceCompatibility = JavaVersion.VERSION_25
-        targetCompatibility = JavaVersion.VERSION_25
+        sourceCompatibility = buildJavaVersion
+        targetCompatibility = buildJavaVersion
         toolchain {
-            languageVersion = JavaLanguageVersion.of(25)
+            languageVersion = buildJavaLanguageVersion
         }
     }
 
@@ -272,7 +276,7 @@ subprojects {
 
     tasks.withType(JavaCompile).configureEach {
         options.encoding = "UTF-8"
-        options.release = rootProject.ext.modernJavaVersion
+        options.release = buildJavaMajorVersion
         if (!project.hasProperty("noSpotless")) {
             dependsOn "spotlessApply"
         }
@@ -667,10 +671,14 @@ tasks.register('compileRestartHelper', JavaCompile) {
     source = fileTree(dir: 'scripts', include: 'RestartHelper.java')
     classpath = files()
     destinationDirectory = layout.buildDirectory.dir("restart-helper-classes")
-    def restartMajorVersion = project.ext.modernJavaVersion
+    def restartMajorVersion = buildJavaMajorVersion
+    def restartLanguageVersion = JavaLanguageVersion.of(restartMajorVersion)
     def restartCompatibility = JavaVersion.toVersion(restartMajorVersion.toString())
     sourceCompatibility = restartCompatibility
     targetCompatibility = restartCompatibility
+    javaCompiler = javaToolchains.compilerFor {
+        languageVersion = restartLanguageVersion
+    }
     options.release.set(restartMajorVersion)
 }
 

From b5b9cc443f601b70cb71ccd4890079a27eaa8f08 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 07:50:24 +0000
Subject: [PATCH 077/109] build(deps): bump com.github.junrar:junrar from
 7.5.10 to 7.6.0 in /app/common (#7090)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [com.github.junrar:junrar](https://github.com/junrar/junrar) from
7.5.10 to 7.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/junrar/junrar/releases">com.github.junrar:junrar's
releases</a>.</em></p>
<blockquote>
<h2>Release v7.6.0</h2>
<h2>Changelog</h2>
<h2>🚀 Features</h2>
<ul>
<li>support random access for files in solid RAR4 archives (<a
href="https://github.com/junrar/junrar/commits/e0874d2">e0874d2</a>)</li>
</ul>
<h2>🏎 Perf</h2>
<ul>
<li>replace RarCRC.checkCrc with java.util.zip.CRC32 (<a
href="https://github.com/junrar/junrar/commits/5270d23">5270d23</a>)</li>
</ul>
<h2>🛠  Build</h2>
<p><strong>deps</strong></p>
<ul>
<li>bump gradle-wrapper to 9.5.1 (<a
href="https://github.com/junrar/junrar/commits/cb4b7fd">cb4b7fd</a>)</li>
<li>bump com.fasterxml.jackson.core:jackson-databind (<a
href="https://github.com/junrar/junrar/commits/0bb56b3">0bb56b3</a>)</li>
<li>bump com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (<a
href="https://github.com/junrar/junrar/commits/ca621b2">ca621b2</a>)</li>
<li>bump org.jreleaser from 1.23.0 to 1.24.0 (<a
href="https://github.com/junrar/junrar/commits/90f0548">90f0548</a>)</li>
<li>bump commons-io:commons-io from 2.21.0 to 2.22.0 (<a
href="https://github.com/junrar/junrar/commits/83a5d08">83a5d08</a>)</li>
<li>bump com.github.ben-manes.versions from 0.53.0 to 0.54.0 (<a
href="https://github.com/junrar/junrar/commits/d5abcdb">d5abcdb</a>)</li>
</ul>
<p><strong>unscoped</strong></p>
<ul>
<li>replace deprecated action (<a
href="https://github.com/junrar/junrar/commits/338efcb">338efcb</a>)</li>
</ul>
<h2>Contributors</h2>
<p>We'd like to thank the following people for their contributions:
Gauthier, Gauthier Roebroeck, Robin Schimpf</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/junrar/junrar/blob/master/CHANGELOG.md">com.github.junrar:junrar's
changelog</a>.</em></p>
<blockquote>
<h1><a
href="https://github.com/junrar/junrar/compare/v7.5.10...v7.6.0">7.6.0</a>
(2026-05-13)</h1>
<h2>🚀 Features</h2>
<ul>
<li>support random access for files in solid RAR4 archives (<a
href="https://github.com/junrar/junrar/commits/e0874d2">e0874d2</a>)</li>
</ul>
<h2>🏎 Perf</h2>
<ul>
<li>replace RarCRC.checkCrc with java.util.zip.CRC32 (<a
href="https://github.com/junrar/junrar/commits/5270d23">5270d23</a>)</li>
</ul>
<h2>🛠  Build</h2>
<p><strong>deps</strong></p>
<ul>
<li>bump gradle-wrapper to 9.5.1 (<a
href="https://github.com/junrar/junrar/commits/cb4b7fd">cb4b7fd</a>)</li>
<li>bump com.fasterxml.jackson.core:jackson-databind (<a
href="https://github.com/junrar/junrar/commits/0bb56b3">0bb56b3</a>)</li>
<li>bump com.fasterxml.jackson.datatype:jackson-datatype-jsr310 (<a
href="https://github.com/junrar/junrar/commits/ca621b2">ca621b2</a>)</li>
<li>bump org.jreleaser from 1.23.0 to 1.24.0 (<a
href="https://github.com/junrar/junrar/commits/90f0548">90f0548</a>)</li>
<li>bump commons-io:commons-io from 2.21.0 to 2.22.0 (<a
href="https://github.com/junrar/junrar/commits/83a5d08">83a5d08</a>)</li>
<li>bump com.github.ben-manes.versions from 0.53.0 to 0.54.0 (<a
href="https://github.com/junrar/junrar/commits/d5abcdb">d5abcdb</a>)</li>
</ul>
<p><strong>unscoped</strong></p>
<ul>
<li>replace deprecated action (<a
href="https://github.com/junrar/junrar/commits/338efcb">338efcb</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/junrar/junrar/commit/cb4b7fdb84269e95741fa22120e08ceb15a06152"><code>cb4b7fd</code></a>
build(deps): bump gradle-wrapper to 9.5.1</li>
<li><a
href="https://github.com/junrar/junrar/commit/0bb56b3df4e3b6d14f73de92746a2eb47dd2d7a3"><code>0bb56b3</code></a>
build(deps): bump com.fasterxml.jackson.core:jackson-databind</li>
<li><a
href="https://github.com/junrar/junrar/commit/ca621b22421f9e846df23112b32113230610c8d9"><code>ca621b2</code></a>
build(deps): bump
com.fasterxml.jackson.datatype:jackson-datatype-jsr310</li>
<li><a
href="https://github.com/junrar/junrar/commit/e0874d213832bbeaa8eb265c79479b01b5fa7392"><code>e0874d2</code></a>
feat: support random access for files in solid RAR4 archives</li>
<li><a
href="https://github.com/junrar/junrar/commit/90f0548c728b0bf2e94f6e26f9e6396d9d0a7262"><code>90f0548</code></a>
build(deps): bump org.jreleaser from 1.23.0 to 1.24.0</li>
<li><a
href="https://github.com/junrar/junrar/commit/83a5d085dc84991226229fef1515cc902d129241"><code>83a5d08</code></a>
build(deps): bump commons-io:commons-io from 2.21.0 to 2.22.0</li>
<li><a
href="https://github.com/junrar/junrar/commit/338efcb5472be051989fbafd7179d561c71722eb"><code>338efcb</code></a>
ci: replace deprecated action</li>
<li><a
href="https://github.com/junrar/junrar/commit/5270d235ade54d96dfc9958ab06f495fbbd169e7"><code>5270d23</code></a>
perf: replace RarCRC.checkCrc with java.util.zip.CRC32</li>
<li><a
href="https://github.com/junrar/junrar/commit/d5abcdb9af988ddfa76e98d80787e15525488332"><code>d5abcdb</code></a>
build(deps): bump com.github.ben-manes.versions from 0.53.0 to
0.54.0</li>
<li><a
href="https://github.com/junrar/junrar/commit/edadb28896962fdcf754029bafd0994aaff24530"><code>edadb28</code></a>
chore(release): 7.5.10 [skip ci]</li>
<li>See full diff in <a
href="https://github.com/junrar/junrar/compare/v7.5.10...v7.6.0">compare
view</a></li>
</ul>
</details>
<br />

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Ludy <Ludy87@users.noreply.github.com>
---
 app/common/build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/common/build.gradle b/app/common/build.gradle
index 3ab0369e34..71ccbf236f 100644
--- a/app/common/build.gradle
+++ b/app/common/build.gradle
@@ -16,7 +16,7 @@ dependencies {
     api "org.apache.pdfbox:pdfbox-io:$pdfboxVersion"
     api "org.apache.pdfbox:xmpbox:$pdfboxVersion"
     api "org.apache.pdfbox:preflight:$pdfboxVersion"
-    api 'com.github.junrar:junrar:7.5.10' // RAR archive support for CBR files
+    api 'com.github.junrar:junrar:7.6.0' // RAR archive support for CBR files
     api 'jakarta.servlet:jakarta.servlet-api:6.1.0'
     api 'org.snakeyaml:snakeyaml-engine:3.0.1'
     api "org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.3"

From fab00f3fe2deb04dfd8c29b1f61522cdaa8484ae Mon Sep 17 00:00:00 2001
From: brios <127139797+balazs-szucs@users.noreply.github.com>
Date: Wed, 22 Jul 2026 11:22:58 +0200
Subject: [PATCH 078/109] style(sidebar): fix file sidebar button visibility
 spacing (#7124)

# Description of Changes

<img width="522" height="258" alt="image"
src="https://github.com/user-attachments/assets/f7310ae9-3bdb-460a-a761-d593d6daafe0"
/>


<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../components/shared/FileSidebarFileItem.css   | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/frontend/editor/src/core/components/shared/FileSidebarFileItem.css b/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
index 51278c1673..09c0c5e8eb 100644
--- a/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
+++ b/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
@@ -50,17 +50,16 @@
 }
 
 .file-sidebar-file-item:hover .file-sidebar-file-actions,
-.file-sidebar-file-item.viewed .file-sidebar-file-actions {
+.file-sidebar-file-item:focus-within .file-sidebar-file-actions,
+.file-sidebar-file-item.viewed .file-sidebar-file-actions,
+.file-sidebar-file-item.selected .file-sidebar-file-actions {
   pointer-events: auto;
 }
 
-/* Only shrink the name to clear the buttons while they're visible. */
+/* Always reserve space for action buttons so file name truncation dots (...)
+   never bleed under action buttons or overlap their outline/focus box. */
 .file-sidebar-file-info {
-  transition: padding-right 0.12s ease;
-}
-.file-sidebar-file-item:hover .file-sidebar-file-info,
-.file-sidebar-file-item.viewed .file-sidebar-file-info {
-  padding-right: 3.5rem;
+  padding-right: 3.75rem;
 }
 
 .file-sidebar-file-item:hover:not(.selected) {
@@ -368,8 +367,10 @@
     color 0.12s ease;
 }
 
-/* Reveal on row hover, and keep it shown while its menu is open. */
+/* Reveal on row hover/focus/selected, and keep it shown while its menu is open. */
 .file-sidebar-file-item:hover .file-sidebar-kebab-btn,
+.file-sidebar-file-item:focus-within .file-sidebar-kebab-btn,
+.file-sidebar-file-item.selected .file-sidebar-kebab-btn,
 .file-sidebar-kebab-btn[aria-expanded="true"] {
   opacity: 1;
 }

From 50c0f2bcb512d05891e9001fb22392e1dbe283d6 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Wed, 22 Jul 2026 10:23:15 +0100
Subject: [PATCH 079/109] Fix Calendly scheduler: blank on first open + slow
 load (#7075)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What was wrong

Opening the procurement **Schedule a call** modal had two problems:

1. **Blank the first time, works the second time.** The first open
showed nothing; closing and reopening eventually loaded Calendly.
2. **Slow to load** even when it did work.

## Why

1. Our script loader treated a script as "ready" the moment its
`<script>` tag was added to the page — not when it had actually finished
downloading. On the first open, two loads overlap (React re-runs the
effect in dev), and the second one returned "ready" too early, before
Calendly's code existed, so nothing rendered. Reopening worked because
by then the script had finished.
2. Nothing was loaded until you clicked, so the first open waited on a
cold download of Calendly's script and then its booking page.

## The fix

- Make the script loader wait for the script to **actually finish
loading**, and have overlapping loads share the same wait. This fixes
the blank-first-open (and helps every other lazy-loaded script too).
- **Warm up Calendly early**: open the connection and start fetching its
script as soon as the "Schedule a call" button appears, so the modal
opens quickly instead of downloading everything on click.
- If Calendly still can't load (e.g. blocked by an extension), show the
existing "open in a new tab" link instead of an empty modal.

## Testing

Added a unit test proving the loader only reports "ready" after the
script truly loads. Type-check, lint, and formatting all pass.

Note: I couldn't click through the live modal here (needs a linked
procurement deal running locally) — happy to do a manual open/close/open
pass before merge if you'd like.

---------

Co-authored-by: James Brunton <jbrunton96@gmail.com>
---
 .../public/locales/en-US/translation.toml     |  1 +
 .../src/core/utils/scriptLoader.test.ts       | 86 +++++++++++++++++++
 .../editor/src/core/utils/scriptLoader.ts     | 85 ++++++++++++------
 .../components/procurement/CalendlyInline.tsx | 63 ++++++++++++--
 .../components/procurement/DealStatusHero.tsx |  9 ++
 .../editor/src/portal/views/Procurement.css   | 16 ++++
 6 files changed, 228 insertions(+), 32 deletions(-)
 create mode 100644 frontend/editor/src/core/utils/scriptLoader.test.ts

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 4bacc1b22a..d1fc247e2f 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7837,6 +7837,7 @@ viewInvoice = "View & pay invoice"
 [portal.procurement.schedule]
 fallback = "Couldn't load the scheduler."
 fallbackLink = "Open scheduling in a new tab"
+loading = "Loading scheduler..."
 subtitle = "Your solutions engineer will walk your team through the rollout. Pick a time that suits you."
 title = "Schedule a call"
 
diff --git a/frontend/editor/src/core/utils/scriptLoader.test.ts b/frontend/editor/src/core/utils/scriptLoader.test.ts
new file mode 100644
index 0000000000..9fce749d56
--- /dev/null
+++ b/frontend/editor/src/core/utils/scriptLoader.test.ts
@@ -0,0 +1,86 @@
+import { describe, it, expect } from "vitest";
+import { loadScript, isScriptLoaded } from "@app/utils/scriptLoader";
+
+/** jsdom doesn't fetch external scripts, so we drive the load/error events ourselves. */
+function scriptEl(id: string): HTMLScriptElement {
+  const el = document.getElementById(id) as HTMLScriptElement | null;
+  if (!el) throw new Error(`no script tag #${id}`);
+  return el;
+}
+
+describe("loadScript", () => {
+  it("overlapping loads share one tag and resolve only after the script actually loads", async () => {
+    const id = "test-script-overlap";
+    const src = "https://example.test/overlap.js";
+
+    let firstResolved = false;
+    let secondResolved = false;
+    const p1 = loadScript({ src, id }).then(() => {
+      firstResolved = true;
+    });
+    // Second, overlapping call (e.g. a StrictMode double-effect or a remount before the
+    // first load settled). It must reuse the in-flight load, not resolve on tag existence.
+    const p2 = loadScript({ src, id }).then(() => {
+      secondResolved = true;
+    });
+
+    // Only one tag despite two calls.
+    expect(document.querySelectorAll(`#${id}`)).toHaveLength(1);
+
+    // Regression guard: before the script executes, neither promise resolves — previously
+    // the second call resolved immediately because the tag existed, so callers ran before
+    // the script's globals were defined (the "blank until you reopen" bug).
+    await Promise.resolve();
+    expect(firstResolved).toBe(false);
+    expect(secondResolved).toBe(false);
+    expect(isScriptLoaded(id)).toBe(false);
+
+    scriptEl(id).dispatchEvent(new Event("load"));
+    await Promise.all([p1, p2]);
+    expect(firstResolved).toBe(true);
+    expect(secondResolved).toBe(true);
+    expect(isScriptLoaded(id)).toBe(true);
+  });
+
+  it("resolves immediately once the script has already loaded", async () => {
+    const id = "test-script-cached";
+    const src = "https://example.test/cached.js";
+
+    const first = loadScript({ src, id });
+    scriptEl(id).dispatchEvent(new Event("load"));
+    await first;
+
+    // A later call must resolve from cache without waiting for a fresh load event (which
+    // would never come) and without adding a second tag.
+    await loadScript({ src, id });
+    expect(document.querySelectorAll(`#${id}`)).toHaveLength(1);
+  });
+
+  it("rejects when the script fails to load", async () => {
+    const id = "test-script-error";
+    const src = "https://example.test/error.js";
+
+    const p = loadScript({ src, id });
+    scriptEl(id).dispatchEvent(new Event("error"));
+    await expect(p).rejects.toThrow(/Failed to load script/);
+  });
+
+  it("drops the failed tag so a retry re-attempts instead of hanging", async () => {
+    const id = "test-script-retry";
+    const src = "https://example.test/retry.js";
+
+    // First attempt (e.g. a warm-up) fails.
+    const first = loadScript({ src, id });
+    scriptEl(id).dispatchEvent(new Event("error"));
+    await expect(first).rejects.toThrow(/Failed to load script/);
+    // The poisoned tag must be gone — otherwise a retry would attach to a dead tag.
+    expect(document.querySelectorAll(`#${id}`)).toHaveLength(0);
+
+    // Retry (e.g. the modal opening) creates a fresh tag and can now succeed.
+    const second = loadScript({ src, id });
+    expect(document.querySelectorAll(`#${id}`)).toHaveLength(1);
+    scriptEl(id).dispatchEvent(new Event("load"));
+    await expect(second).resolves.toBeUndefined();
+    expect(isScriptLoaded(id)).toBe(true);
+  });
+});
diff --git a/frontend/editor/src/core/utils/scriptLoader.ts b/frontend/editor/src/core/utils/scriptLoader.ts
index 60c9c02ec8..58179c4b91 100644
--- a/frontend/editor/src/core/utils/scriptLoader.ts
+++ b/frontend/editor/src/core/utils/scriptLoader.ts
@@ -11,6 +11,11 @@ interface ScriptLoadOptions {
 }
 
 const loadedScripts = new Set<string>();
+// Loads that have started but not yet finished, keyed by script id/src. Overlapping
+// callers (e.g. a React StrictMode double-effect, or a component that remounts before
+// the previous load settled) reuse the same promise so they all resolve only when the
+// script has actually executed — never on tag existence alone.
+const pendingScripts = new Map<string, Promise<void>>();
 
 export function loadScript({
   src,
@@ -19,43 +24,75 @@ export function loadScript({
   defer = false,
   onLoad,
 }: ScriptLoadOptions): Promise<void> {
-  return new Promise((resolve, reject) => {
-    // Check if already loaded
-    const scriptId = id || src;
-    if (loadedScripts.has(scriptId)) {
-      resolve();
-      return;
-    }
+  const scriptId = id || src;
 
-    // Check if script already exists in DOM
-    const existingScript = id
-      ? document.getElementById(id)
-      : document.querySelector(`script[src="${src}"]`);
-    if (existingScript) {
+  // Already fully loaded and executed.
+  if (loadedScripts.has(scriptId)) {
+    onLoad?.();
+    return Promise.resolve();
+  }
+
+  // A load for the same script is already in flight — wait for it rather than kicking
+  // off a second one (and, critically, don't resolve just because the tag is present).
+  const inFlight = pendingScripts.get(scriptId);
+  if (inFlight) {
+    return onLoad ? inFlight.then(() => onLoad()) : inFlight;
+  }
+
+  const promise = new Promise<void>((resolve, reject) => {
+    const settleLoaded = (script: HTMLScriptElement) => {
+      script.dataset.loaded = "true";
       loadedScripts.add(scriptId);
+      pendingScripts.delete(scriptId);
+      onLoad?.();
       resolve();
+    };
+    const settleError = (el: HTMLScriptElement) => {
+      pendingScripts.delete(scriptId);
+      // Drop the failed tag so a later retry (e.g. the modal after a warm-up that was
+      // blocked by an extension) creates a fresh one and re-attempts, rather than
+      // attaching to a dead tag whose error event won't fire again and hanging forever.
+      el.remove();
+      reject(new Error(`Failed to load script: ${src}`));
+    };
+
+    // A matching tag may already be in the DOM (added by an earlier load whose Set/Map
+    // state was lost, or injected elsewhere). If our own loader finished it, the
+    // data-loaded flag is set and we can resolve immediately; otherwise attach to its
+    // load lifecycle instead of assuming it is ready.
+    const existing = (
+      id
+        ? document.getElementById(id)
+        : document.querySelector(`script[src="${src}"]`)
+    ) as HTMLScriptElement | null;
+    if (existing) {
+      if (existing.dataset.loaded === "true") {
+        loadedScripts.add(scriptId);
+        onLoad?.();
+        resolve();
+        return;
+      }
+      existing.addEventListener("load", () => settleLoaded(existing), {
+        once: true,
+      });
+      existing.addEventListener("error", () => settleError(existing), {
+        once: true,
+      });
       return;
     }
 
-    // Create and append script
     const script = document.createElement("script");
     script.src = src;
     if (id) script.id = id;
     script.async = async;
     script.defer = defer;
-
-    script.onload = () => {
-      loadedScripts.add(scriptId);
-      if (onLoad) onLoad();
-      resolve();
-    };
-
-    script.onerror = () => {
-      reject(new Error(`Failed to load script: ${src}`));
-    };
-
+    script.addEventListener("load", () => settleLoaded(script), { once: true });
+    script.addEventListener("error", () => settleError(script), { once: true });
     document.head.appendChild(script);
   });
+
+  pendingScripts.set(scriptId, promise);
+  return promise;
 }
 
 export function isScriptLoaded(idOrSrc: string): boolean {
diff --git a/frontend/editor/src/portal/components/procurement/CalendlyInline.tsx b/frontend/editor/src/portal/components/procurement/CalendlyInline.tsx
index 3cac3750fb..794cadac9a 100644
--- a/frontend/editor/src/portal/components/procurement/CalendlyInline.tsx
+++ b/frontend/editor/src/portal/components/procurement/CalendlyInline.tsx
@@ -1,11 +1,15 @@
 import { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
+import { Spinner } from "@app/ui";
 import { loadScript } from "@app/utils/scriptLoader";
 
 /**
  * Inline Calendly scheduler. Lazily loads Calendly's widget.js (only once the embed mounts, i.e. when
- * the modal opens) and initialises an inline widget. Falls back to a plain "open in a new tab" link if
- * the script can't load (offline, blocked, etc.).
+ * the modal opens) and initialises an inline widget. Shows a spinner while the (external, sometimes
+ * slow) script loads, and falls back to a plain "open in a new tab" link if the script can't load
+ * (offline, blocked, etc.). A real load failure fires the script's error event, so the fallback is
+ * shown immediately rather than after a fixed timeout — a slow-but-working connection is never
+ * abandoned, it just spins until the widget arrives.
  */
 
 const CALENDLY_SCRIPT = "https://assets.calendly.com/assets/external/widget.js";
@@ -40,6 +44,36 @@ function buildUrl(base: string): string {
   return `${base}${sep}hide_event_type_details=1&background_color=${WIDGET_COLORS.background}&text_color=${WIDGET_COLORS.text}&primary_color=${WIDGET_COLORS.primary}`;
 }
 
+// Origins the embed fetches from: the widget script, then the scheduler iframe.
+const CALENDLY_ORIGINS = [
+  "https://assets.calendly.com",
+  "https://calendly.com",
+];
+
+function preconnect(origin: string): void {
+  if (typeof document === "undefined") return;
+  if (document.querySelector(`link[rel="preconnect"][href="${origin}"]`))
+    return;
+  const link = document.createElement("link");
+  link.rel = "preconnect";
+  link.href = origin;
+  link.crossOrigin = "anonymous";
+  document.head.appendChild(link);
+}
+
+/**
+ * Warm the Calendly embed ahead of use: open connections to its origins and start fetching
+ * widget.js, so opening the scheduler initialises near-instantly instead of paying a cold
+ * script + iframe fetch on click. Idempotent and safe to call repeatedly; failures are left
+ * for the modal's own load to surface as the fallback link.
+ */
+export function warmCalendly(): void {
+  CALENDLY_ORIGINS.forEach(preconnect);
+  void loadScript({ src: CALENDLY_SCRIPT, id: "calendly-widget-script" }).catch(
+    () => {},
+  );
+}
+
 export function CalendlyInline({
   url = CALENDLY_URL,
   height = 760,
@@ -53,17 +87,25 @@ export function CalendlyInline({
   const { t } = useTranslation();
   const containerRef = useRef<HTMLDivElement>(null);
   const [failed, setFailed] = useState(false);
+  const [loading, setLoading] = useState(true);
 
   const fullUrl = buildUrl(url);
 
   useEffect(() => {
     let cancelled = false;
     setFailed(false);
+    setLoading(true);
     loadScript({ src: CALENDLY_SCRIPT, id: "calendly-widget-script" })
       .then(() => {
         const el = containerRef.current;
         const calendly = (window as CalendlyWindow).Calendly;
-        if (cancelled || !el || !calendly) return;
+        if (cancelled || !el) return;
+        // Script resolved but the global never materialised (blocked/altered by an
+        // extension, etc.) — show the fallback link rather than an empty modal.
+        if (!calendly) {
+          setFailed(true);
+          return;
+        }
         // Re-init explicitly (rather than relying on widget.js auto-scan) so the widget rebuilds on
         // reopen and whenever the URL or prefill changes.
         el.innerHTML = "";
@@ -72,6 +114,7 @@ export function CalendlyInline({
           parentElement: el,
           prefill: email ? { email } : undefined,
         });
+        setLoading(false);
       })
       .catch(() => !cancelled && setFailed(true));
     return () => {
@@ -91,10 +134,14 @@ export function CalendlyInline({
   }
 
   return (
-    <div
-      ref={containerRef}
-      className="portal-calendly"
-      style={{ minWidth: 320, height }}
-    />
+    <div className="portal-calendly" style={{ minWidth: 320, height }}>
+      {loading && (
+        <div className="portal-calendly__loading">
+          <Spinner size="lg" label={t("portal.procurement.schedule.loading")} />
+        </div>
+      )}
+      {/* Calendly injects its iframe here; the spinner overlays until the widget is initialised. */}
+      <div ref={containerRef} className="portal-calendly__embed" />
+    </div>
   );
 }
diff --git a/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx b/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
index e2a3e19687..092e259bb3 100644
--- a/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
+++ b/frontend/editor/src/portal/components/procurement/DealStatusHero.tsx
@@ -1,3 +1,4 @@
+import { useEffect } from "react";
 import { useTranslation } from "react-i18next";
 import { Button } from "@app/ui";
 import type { ViewId } from "@portal/contexts/ViewContext";
@@ -6,6 +7,7 @@ import {
   type ProcurementSnapshot,
 } from "@portal/api/procurement";
 import { StageStepper } from "@portal/components/procurement/StageStepper";
+import { warmCalendly } from "@portal/components/procurement/CalendlyInline";
 import "@portal/views/Procurement.css";
 
 /**
@@ -38,6 +40,13 @@ export function DealStatusHero({
   onNavigate: (view: ViewId) => void;
 }) {
   const { t } = useTranslation();
+
+  // Warm Calendly's connections + widget script as soon as the "Schedule a call" action is
+  // available, so opening the scheduler initialises quickly instead of paying a cold fetch.
+  useEffect(() => {
+    if (canSchedule) warmCalendly();
+  }, [canSchedule]);
+
   const stage = snapshot.stage ?? "trial";
   const inTrial = stage === "trial";
   const cta =
diff --git a/frontend/editor/src/portal/views/Procurement.css b/frontend/editor/src/portal/views/Procurement.css
index adc21fd79a..f733b2c5a3 100644
--- a/frontend/editor/src/portal/views/Procurement.css
+++ b/frontend/editor/src/portal/views/Procurement.css
@@ -1396,11 +1396,27 @@
 /* Calendly scheduler embed (Schedule a call). The widget is always light (Calendly renders inputs on
    white), so give it a white surface — it reads as a clean card even inside the dark-mode modal. */
 .portal-calendly {
+  position: relative;
   border-radius: 10px;
   overflow: hidden;
   background: #ffffff;
 }
 
+/* Fills the surface; Calendly injects its iframe in here. */
+.portal-calendly__embed {
+  height: 100%;
+}
+
+/* Centred spinner shown over the white surface until the widget initialises. */
+.portal-calendly__loading {
+  position: absolute;
+  inset: 0;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  pointer-events: none;
+}
+
 /* ── Agreement (security) step ────────────────────────────────────────────── */
 .portal-agreement__doc {
   margin: 1rem 0;

From ce7f74a3c11d2f82fbd360002926c5b6e8c7ac01 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 22 Jul 2026 10:46:51 +0100
Subject: [PATCH 080/109] Add SaaS OG link-preview cards for app, processor and
 editor (#7027)

# Description of Changes

<!--
Please provide a summary of the changes, including:

- What was changed
- Why the change was made
- Any challenges encountered

Closes #(issue_number)
-->

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 frontend/.prettierignore                      |   1 +
 frontend/editor/public/og-metadata.saas.json  | 679 ++++++++++++++++++
 .../public/og_images/saas/app-editor.png      | Bin 0 -> 122101 bytes
 .../public/og_images/saas/app-processor.png   | Bin 0 -> 128154 bytes
 frontend/editor/public/og_images/saas/app.png | Bin 0 -> 121329 bytes
 .../editor/scripts/generate-og-metadata.mjs   |  64 +-
 frontend/editor/scripts/og-prerender.d.mts    |   2 +
 frontend/editor/scripts/og-prerender.mjs      |   7 +-
 .../editor/src/core/data/ogMetadata.test.ts   |  22 +
 frontend/editor/src/saas/routes/Login.tsx     |   2 +-
 frontend/editor/src/saas/routes/Signup.tsx    |   2 +-
 frontend/editor/vite.config.ts                |  16 +-
 12 files changed, 782 insertions(+), 13 deletions(-)
 create mode 100644 frontend/editor/public/og-metadata.saas.json
 create mode 100644 frontend/editor/public/og_images/saas/app-editor.png
 create mode 100644 frontend/editor/public/og_images/saas/app-processor.png
 create mode 100644 frontend/editor/public/og_images/saas/app.png

diff --git a/frontend/.prettierignore b/frontend/.prettierignore
index ccbc95322f..fa8ab6c502 100644
--- a/frontend/.prettierignore
+++ b/frontend/.prettierignore
@@ -11,6 +11,7 @@ editor/public/vendor/
 editor/public/mockServiceWorker.js
 # Auto-generated OG/social-preview metadata (scripts/generate-og-metadata.mjs); regenerated verbatim.
 editor/public/og-metadata.json
+editor/public/og-metadata.saas.json
 editor/src/core/data/ogImageMap.json
 # Auto-generated portal docs manifest (scripts/sync-portal-docs.mts); regenerated verbatim.
 editor/src/portal/generated/docsManifest.json
diff --git a/frontend/editor/public/og-metadata.saas.json b/frontend/editor/public/og-metadata.saas.json
new file mode 100644
index 0000000000..2bf49f7d9f
--- /dev/null
+++ b/frontend/editor/public/og-metadata.saas.json
@@ -0,0 +1,679 @@
+{
+  "default": {
+    "image": "/og_images/saas/app.png",
+    "title": "Stirling - Edit any PDF. Govern every PDF.",
+    "ogTitle": "Edit any PDF. Govern every PDF.",
+    "description": "The free, open-source PDF Editor, plus a Processor that governs every PDF your organization touches. 1¢ per PDF."
+  },
+  "byTool": {
+    "certSign": {
+      "image": "/og_images/certSign.png",
+      "title": "Certificate Sign - Stirling PDF",
+      "description": "Sign PDF documents using digital certificates"
+    },
+    "sign": {
+      "image": "/og_images/sign.png",
+      "title": "Sign - Stirling PDF",
+      "description": "Adds signature to PDF by drawing, text or image"
+    },
+    "sharedSign": {
+      "image": "/og_images/home.png",
+      "title": "Shared Signing - Stirling PDF",
+      "description": "Request signatures from others and track signing sessions"
+    },
+    "addText": {
+      "image": "/og_images/add-text.png",
+      "title": "Add Text - Stirling PDF",
+      "description": "Add custom text anywhere in your PDF"
+    },
+    "addPassword": {
+      "image": "/og_images/add-password.png",
+      "title": "Add Password - Stirling PDF",
+      "description": "Add password protection and restrictions to PDF files"
+    },
+    "removePassword": {
+      "image": "/og_images/remove-password.png",
+      "title": "Remove Password - Stirling PDF",
+      "description": "Remove password protection from PDF documents"
+    },
+    "removePages": {
+      "image": "/og_images/remove.png",
+      "title": "Remove Pages - Stirling PDF",
+      "description": "Remove specific pages from a PDF document"
+    },
+    "removeBlanks": {
+      "image": "/og_images/remove-blank-pages.png",
+      "title": "Remove Blank Pages - Stirling PDF",
+      "description": "Remove blank pages from PDF documents"
+    },
+    "removeAnnotations": {
+      "image": "/og_images/remove-annotations.png",
+      "title": "Remove Annotations - Stirling PDF",
+      "description": "Remove annotations and comments from PDF documents"
+    },
+    "removeImage": {
+      "image": "/og_images/remove-image.png",
+      "title": "Remove Images - Stirling PDF",
+      "description": "Remove all images from a PDF document"
+    },
+    "changePermissions": {
+      "image": "/og_images/change-permissions.png",
+      "title": "Change Permissions - Stirling PDF",
+      "description": "Change document restrictions and permissions"
+    },
+    "watermark": {
+      "image": "/og_images/add-watermark.png",
+      "title": "Add Watermark - Stirling PDF",
+      "description": "Add a custom watermark to your PDF document."
+    },
+    "sanitize": {
+      "image": "/og_images/sanitize.png",
+      "title": "Sanitize - Stirling PDF",
+      "description": "Remove potentially harmful elements from PDF files"
+    },
+    "split": {
+      "image": "/og_images/split.png",
+      "title": "Split - Stirling PDF",
+      "description": "Split PDFs into multiple documents"
+    },
+    "merge": {
+      "image": "/og_images/mergePdfs.png",
+      "title": "Merge - Stirling PDF",
+      "description": "Merge multiple PDFs into a single document"
+    },
+    "convert": {
+      "image": "/og_images/convert.png",
+      "title": "Convert - Stirling PDF",
+      "description": "Convert files to and from PDF format"
+    },
+    "ocr": {
+      "image": "/og_images/ocr.png",
+      "title": "OCR - Stirling PDF",
+      "description": "Extract text from scanned PDFs using Optical Character Recognition"
+    },
+    "addImage": {
+      "image": "/og_images/add-image.png",
+      "title": "Add Image - Stirling PDF",
+      "description": "Add images anywhere in your PDF"
+    },
+    "rotate": {
+      "image": "/og_images/rotate.png",
+      "title": "Rotate - Stirling PDF",
+      "description": "Easily rotate your PDFs."
+    },
+    "annotate": {
+      "image": "/og_images/annotate.png",
+      "title": "Annotate - Stirling PDF",
+      "description": "Highlight, draw, add notes, and shapes directly in the viewer"
+    },
+    "scannerImageSplit": {
+      "image": "/og_images/detect-split-scanned-photos.png",
+      "title": "Detect & Split Scanned Photos - Stirling PDF",
+      "description": "Detect and split scanned photos into separate pages"
+    },
+    "editTableOfContents": {
+      "image": "/og_images/edit-table-of-contents.png",
+      "title": "Edit Table of Contents - Stirling PDF",
+      "description": "Add or edit bookmarks and table of contents in PDF documents"
+    },
+    "scannerEffect": {
+      "image": "/og_images/scanner-effect.png",
+      "title": "Scanner Effect - Stirling PDF",
+      "description": "Create a PDF that looks like it was scanned"
+    },
+    "autoRename": {
+      "image": "/og_images/auto-rename-pdf-file.png",
+      "title": "Auto Rename PDF File - Stirling PDF",
+      "description": "Automatically rename PDF files based on their content"
+    },
+    "pageLayout": {
+      "image": "/og_images/multi-page-layout.png",
+      "title": "Multi-Page Layout - Stirling PDF",
+      "description": "Merge multiple pages of a PDF document into a single page"
+    },
+    "scalePages": {
+      "image": "/og_images/adjust-page-size-scale.png",
+      "title": "Adjust page size/scale - Stirling PDF",
+      "description": "Change the size/scale of a page and/or its contents."
+    },
+    "adjustContrast": {
+      "image": "/og_images/adjust-colors-contrast.png",
+      "title": "Adjust Colors/Contrast - Stirling PDF",
+      "description": "Adjust colors and contrast of PDF documents"
+    },
+    "crop": {
+      "image": "/og_images/cropPdf.png",
+      "title": "Crop PDF - Stirling PDF",
+      "description": "Crop a PDF to reduce its size (maintains text!)"
+    },
+    "pdfToSinglePage": {
+      "image": "/og_images/single-large-page.png",
+      "title": "PDF to Single Large Page - Stirling PDF",
+      "description": "Merges all PDF pages into one large single page"
+    },
+    "repair": {
+      "image": "/og_images/repair.png",
+      "title": "Repair - Stirling PDF",
+      "description": "Repair corrupted or damaged PDF files"
+    },
+    "compare": {
+      "image": "/og_images/compare.png",
+      "title": "Compare - Stirling PDF",
+      "description": "Compare two PDF documents and highlight differences"
+    },
+    "addPageNumbers": {
+      "image": "/og_images/add-page-numbers.png",
+      "title": "Add Page Numbers - Stirling PDF",
+      "description": "Add Page numbers throughout a document in a set location"
+    },
+    "redact": {
+      "image": "/og_images/redact.png",
+      "title": "Redact - Stirling PDF",
+      "description": "Permanently remove sensitive information from PDF documents"
+    },
+    "flatten": {
+      "image": "/og_images/flatten.png",
+      "title": "Flatten - Stirling PDF",
+      "description": "Remove all interactive elements and forms from a PDF"
+    },
+    "removeCertSign": {
+      "image": "/og_images/remove-certificate-sign.png",
+      "title": "Remove Certificate Sign - Stirling PDF",
+      "description": "Remove digital signature from PDF documents"
+    },
+    "unlockPDFForms": {
+      "image": "/og_images/unlock-pdf-forms.png",
+      "title": "Unlock PDF Forms - Stirling PDF",
+      "description": "Remove read-only property of form fields in a PDF document."
+    },
+    "compress": {
+      "image": "/og_images/compress.png",
+      "title": "Compress - Stirling PDF",
+      "description": "Compress PDFs to reduce their file size."
+    },
+    "extractPages": {
+      "image": "/og_images/extract-pages.png",
+      "title": "Extract Pages - Stirling PDF",
+      "description": "Extract specific pages from a PDF document"
+    },
+    "reorganizePages": {
+      "image": "/og_images/reorganize-pages.png",
+      "title": "Reorganize Pages - Stirling PDF",
+      "description": "Rearrange, duplicate, or delete PDF pages with visual drag-and-drop control."
+    },
+    "extractImages": {
+      "image": "/og_images/extract-images.png",
+      "title": "Extract Images - Stirling PDF",
+      "description": "Extract images from PDF documents"
+    },
+    "addStamp": {
+      "image": "/og_images/add-stamp.png",
+      "title": "Add Stamp to PDF - Stirling PDF",
+      "description": "Add text or add image stamps at set locations"
+    },
+    "addAttachments": {
+      "image": "/og_images/add-attachments.png",
+      "title": "Add Attachments - Stirling PDF",
+      "description": "Add or remove embedded files (attachments) to/from a PDF"
+    },
+    "changeMetadata": {
+      "image": "/og_images/change-metadata.png",
+      "title": "Change Metadata - Stirling PDF",
+      "description": "Change/Remove/Add metadata from a PDF document"
+    },
+    "overlayPdfs": {
+      "image": "/og_images/overlay-pdfs.png",
+      "title": "Overlay Pdfs - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "getPdfInfo": {
+      "image": "/og_images/get-all-info-on-pdf.png",
+      "title": "Get ALL Info on PDF - Stirling PDF",
+      "description": "Grabs any and all information possible on PDFs"
+    },
+    "validateSignature": {
+      "image": "/og_images/validate-pdf-signature.png",
+      "title": "Validate PDF Signature - Stirling PDF",
+      "description": "Verify digital signatures and certificates in PDF documents"
+    },
+    "timestampPdf": {
+      "image": "/og_images/timestamp-pdf.png",
+      "title": "Timestamp PDF - Stirling PDF",
+      "description": "Add an RFC 3161 document timestamp to prove when your PDF existed"
+    },
+    "replaceColor": {
+      "image": "/og_images/replace-and-invert-color.png",
+      "title": "Replace & Invert Color - Stirling PDF",
+      "description": "Replace or invert colors in PDF documents"
+    },
+    "showJS": {
+      "image": "/og_images/show-javascript.png",
+      "title": "Show JavaScript - Stirling PDF",
+      "description": "Extract and display JavaScript code from PDF documents"
+    },
+    "bookletImposition": {
+      "image": "/og_images/booklet-imposition.png",
+      "title": "Booklet Imposition - Stirling PDF",
+      "description": "Create booklets with proper page ordering and multi-page layout for printing and binding"
+    },
+    "pdfTextEditor": {
+      "image": "/og_images/pdf-text-editor.png",
+      "title": "PDF Text Editor - Stirling PDF",
+      "description": "Review and edit text and images in PDFs with grouped text editing and PDF regeneration"
+    },
+    "formFill": {
+      "image": "/og_images/form-fill.png",
+      "title": "Fill Form - Stirling PDF",
+      "description": "Fill PDF form fields interactively with a visual editor"
+    },
+    "multiTool": {
+      "image": "/og_images/multi-tool.png",
+      "title": "Multi-Tool - Stirling PDF",
+      "description": "Use multiple tools on a single PDF document"
+    },
+    "read": {
+      "image": "/og_images/read.png",
+      "title": "Read - Stirling PDF",
+      "description": "View and annotate PDFs. Highlight text, draw, or insert comments for review and collaboration."
+    },
+    "automate": {
+      "image": "/og_images/automate.png",
+      "title": "Automate - Stirling PDF",
+      "description": "Build multi-step workflows by chaining together PDF actions. Ideal for recurring tasks."
+    },
+    "devApi": {
+      "image": "/og_images/dev-api.png",
+      "title": "API - Stirling PDF",
+      "description": "Link to API documentation"
+    },
+    "devFolderScanning": {
+      "image": "/og_images/dev-folder-scanning.png",
+      "title": "Automated Folder Scanning - Stirling PDF",
+      "description": "Link to automated folder scanning guide"
+    },
+    "devSsoGuide": {
+      "image": "/og_images/dev-sso-guide.png",
+      "title": "SSO Guide - Stirling PDF",
+      "description": "Link to SSO guide"
+    },
+    "devAirgapped": {
+      "image": "/og_images/dev-airgapped.png",
+      "title": "Air-gapped Setup - Stirling PDF",
+      "description": "Link to air-gapped setup guide"
+    },
+    "/login": {
+      "image": "/og_images/home.png",
+      "title": "Sign In - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/signup": {
+      "image": "/og_images/home.png",
+      "title": "Sign Up - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/mobile-scanner": {
+      "image": "/og_images/home.png",
+      "title": "Mobile Scanner - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/files": {
+      "image": "/og_images/home.png",
+      "title": "Files - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings": {
+      "image": "/og_images/home.png",
+      "title": "Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/preferences": {
+      "image": "/og_images/home.png",
+      "title": "Preferences Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/notifications": {
+      "image": "/og_images/home.png",
+      "title": "Notifications Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/connections": {
+      "image": "/og_images/home.png",
+      "title": "Connections Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/account": {
+      "image": "/og_images/home.png",
+      "title": "Account Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/general": {
+      "image": "/og_images/home.png",
+      "title": "General Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/people": {
+      "image": "/og_images/home.png",
+      "title": "People Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/teams": {
+      "image": "/og_images/home.png",
+      "title": "Teams Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/security": {
+      "image": "/og_images/home.png",
+      "title": "Security Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/identity": {
+      "image": "/og_images/home.png",
+      "title": "Identity Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/plan": {
+      "image": "/og_images/home.png",
+      "title": "Plan Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/payments": {
+      "image": "/og_images/home.png",
+      "title": "Payments Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/requests": {
+      "image": "/og_images/home.png",
+      "title": "Requests Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/developer": {
+      "image": "/og_images/home.png",
+      "title": "Developer Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/api-keys": {
+      "image": "/og_images/home.png",
+      "title": "Api Keys Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/hotkeys": {
+      "image": "/og_images/home.png",
+      "title": "Hotkeys Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminGeneral": {
+      "image": "/og_images/home.png",
+      "title": "Admin General Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminSecurity": {
+      "image": "/og_images/home.png",
+      "title": "Admin Security Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminConnections": {
+      "image": "/og_images/home.png",
+      "title": "Admin Connections Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminPrivacy": {
+      "image": "/og_images/home.png",
+      "title": "Admin Privacy Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminDatabase": {
+      "image": "/og_images/home.png",
+      "title": "Admin Database Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminAdvanced": {
+      "image": "/og_images/home.png",
+      "title": "Admin Advanced Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminLegal": {
+      "image": "/og_images/home.png",
+      "title": "Admin Legal Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminPremium": {
+      "image": "/og_images/home.png",
+      "title": "Admin Premium Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminFeatures": {
+      "image": "/og_images/home.png",
+      "title": "Admin Features Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminPlan": {
+      "image": "/og_images/home.png",
+      "title": "Admin Plan Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminAudit": {
+      "image": "/og_images/home.png",
+      "title": "Admin Audit Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminUsage": {
+      "image": "/og_images/home.png",
+      "title": "Admin Usage Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminEndpoints": {
+      "image": "/og_images/home.png",
+      "title": "Admin Endpoints Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminStorageSharing": {
+      "image": "/og_images/home.png",
+      "title": "Admin Storage Sharing Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminMcp": {
+      "image": "/og_images/home.png",
+      "title": "Admin Mcp Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/help": {
+      "image": "/og_images/home.png",
+      "title": "Help Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/legal": {
+      "image": "/og_images/home.png",
+      "title": "Legal Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/backendThirdPartyLicenses": {
+      "image": "/og_images/home.png",
+      "title": "Backend Third Party Licenses Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/frontendThirdPartyLicenses": {
+      "image": "/og_images/home.png",
+      "title": "Frontend Third Party Licenses Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/payg": {
+      "image": "/og_images/home.png",
+      "title": "Payg Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/account-link": {
+      "image": "/og_images/home.png",
+      "title": "Account Link Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/processor": {
+      "image": "/og_images/saas/app-processor.png",
+      "title": "Stirling Processor - Govern every PDF your organization touches",
+      "ogTitle": "Govern every PDF your organization touches",
+      "description": "Redaction, retention, and encryption policies enforced everywhere PDFs enter your org. Distribute the free Editor anywhere. 1¢ per PDF."
+    },
+    "/editor": {
+      "image": "/og_images/saas/app-editor.png",
+      "title": "Stirling - The world's most secure PDF editor",
+      "ogTitle": "The world's most secure PDF editor",
+      "description": "Edit, sign, redact, and convert PDFs in your browser. Free forever, open source, and self-hostable."
+    }
+  },
+  "byPath": {
+    "/cert-sign": "certSign",
+    "/sign": "sign",
+    "/shared-sign": "sharedSign",
+    "/add-text": "addText",
+    "/add-password": "addPassword",
+    "/remove-password": "removePassword",
+    "/remove-pages": "removePages",
+    "/remove-blanks": "removeBlanks",
+    "/remove-annotations": "removeAnnotations",
+    "/remove-image": "removeImage",
+    "/change-permissions": "changePermissions",
+    "/watermark": "watermark",
+    "/sanitize": "sanitize",
+    "/split": "split",
+    "/merge": "merge",
+    "/convert": "convert",
+    "/ocr": "ocr",
+    "/add-image": "addImage",
+    "/rotate": "rotate",
+    "/annotate": "annotate",
+    "/scanner-image-split": "scannerImageSplit",
+    "/edit-table-of-contents": "editTableOfContents",
+    "/scanner-effect": "scannerEffect",
+    "/auto-rename": "autoRename",
+    "/page-layout": "pageLayout",
+    "/scale-pages": "scalePages",
+    "/adjust-contrast": "adjustContrast",
+    "/crop": "crop",
+    "/pdf-to-single-page": "pdfToSinglePage",
+    "/repair": "repair",
+    "/compare": "compare",
+    "/add-page-numbers": "addPageNumbers",
+    "/redact": "redact",
+    "/flatten": "flatten",
+    "/remove-cert-sign": "removeCertSign",
+    "/unlock-p-d-f-forms": "unlockPDFForms",
+    "/compress": "compress",
+    "/extract-pages": "extractPages",
+    "/reorganize-pages": "reorganizePages",
+    "/extract-images": "extractImages",
+    "/add-stamp": "addStamp",
+    "/add-attachments": "addAttachments",
+    "/change-metadata": "changeMetadata",
+    "/overlay-pdfs": "overlayPdfs",
+    "/get-pdf-info": "getPdfInfo",
+    "/validate-signature": "validateSignature",
+    "/timestamp-pdf": "timestampPdf",
+    "/replace-color": "replaceColor",
+    "/show-j-s": "showJS",
+    "/booklet-imposition": "bookletImposition",
+    "/pdf-text-editor": "pdfTextEditor",
+    "/form-fill": "formFill",
+    "/multi-tool": "multiTool",
+    "/read": "read",
+    "/automate": "automate",
+    "/dev-api": "devApi",
+    "/dev-folder-scanning": "devFolderScanning",
+    "/dev-sso-guide": "devSsoGuide",
+    "/dev-airgapped": "devAirgapped",
+    "/split-pdfs": "split",
+    "/merge-pdfs": "merge",
+    "/compress-pdf": "compress",
+    "/rotate-pdf": "rotate",
+    "/convert-pdf": "convert",
+    "/file-to-pdf": "convert",
+    "/eml-to-pdf": "convert",
+    "/html-to-pdf": "convert",
+    "/markdown-to-pdf": "convert",
+    "/pdf-to-csv": "convert",
+    "/pdf-to-xlsx": "convert",
+    "/pdf-to-img": "convert",
+    "/pdf-to-markdown": "convert",
+    "/pdf-to-pdfa": "convert",
+    "/pdf-to-word": "convert",
+    "/pdf-to-xml": "convert",
+    "/cbr-to-pdf": "convert",
+    "/pdf-to-cbr": "convert",
+    "/cbz-to-pdf": "convert",
+    "/pdf-to-cbz": "convert",
+    "/manage-signatures": "certSign",
+    "/remove-certificate-sign": "removeCertSign",
+    "/unlock-pdf-forms": "unlockPDFForms",
+    "/sanitize-pdf": "sanitize",
+    "/ocr-pdf": "ocr",
+    "/add-watermark": "watermark",
+    "/single-large-page": "pdfToSinglePage",
+    "/auto-split-pdf": "split",
+    "/auto-size-split-pdf": "split",
+    "/annotations": "annotate",
+    "/fake-scan": "scannerEffect",
+    "/replace-color-pdf": "replaceColor",
+    "/show-js": "showJS",
+    "/pdf-organizer": "reorganizePages",
+    "/multi-page-layout": "pageLayout",
+    "/extract-page": "extractPages",
+    "/img-to-pdf": "convert",
+    "/pdf-to-presentation": "convert",
+    "/pdf-to-text": "convert",
+    "/pdf-to-html": "convert",
+    "/auto-redact": "redact",
+    "/stamp": "addStamp",
+    "/view-pdf": "read",
+    "/get-info-on-pdf": "getPdfInfo",
+    "/remove-image-pdf": "removeImage",
+    "/replace-and-invert-color-pdf": "replaceColor",
+    "/pipeline": "automate",
+    "/extract-image-scans": "scannerImageSplit",
+    "/show-javascript": "showJS",
+    "/split-by-size-or-count": "split",
+    "/overlay-pdf": "overlayPdfs",
+    "/split-pdf-by-sections": "split",
+    "/split-pdf-by-chapters": "split",
+    "/login": "/login",
+    "/signup": "/signup",
+    "/mobile-scanner": "/mobile-scanner",
+    "/files": "/files",
+    "/settings": "/settings",
+    "/settings/preferences": "/settings/preferences",
+    "/settings/notifications": "/settings/notifications",
+    "/settings/connections": "/settings/connections",
+    "/settings/account": "/settings/account",
+    "/settings/general": "/settings/general",
+    "/settings/people": "/settings/people",
+    "/settings/teams": "/settings/teams",
+    "/settings/security": "/settings/security",
+    "/settings/identity": "/settings/identity",
+    "/settings/plan": "/settings/plan",
+    "/settings/payments": "/settings/payments",
+    "/settings/requests": "/settings/requests",
+    "/settings/developer": "/settings/developer",
+    "/settings/api-keys": "/settings/api-keys",
+    "/settings/hotkeys": "/settings/hotkeys",
+    "/settings/adminGeneral": "/settings/adminGeneral",
+    "/settings/adminSecurity": "/settings/adminSecurity",
+    "/settings/adminConnections": "/settings/adminConnections",
+    "/settings/adminPrivacy": "/settings/adminPrivacy",
+    "/settings/adminDatabase": "/settings/adminDatabase",
+    "/settings/adminAdvanced": "/settings/adminAdvanced",
+    "/settings/adminLegal": "/settings/adminLegal",
+    "/settings/adminPremium": "/settings/adminPremium",
+    "/settings/adminFeatures": "/settings/adminFeatures",
+    "/settings/adminPlan": "/settings/adminPlan",
+    "/settings/adminAudit": "/settings/adminAudit",
+    "/settings/adminUsage": "/settings/adminUsage",
+    "/settings/adminEndpoints": "/settings/adminEndpoints",
+    "/settings/adminStorageSharing": "/settings/adminStorageSharing",
+    "/settings/adminMcp": "/settings/adminMcp",
+    "/settings/help": "/settings/help",
+    "/settings/legal": "/settings/legal",
+    "/settings/backendThirdPartyLicenses": "/settings/backendThirdPartyLicenses",
+    "/settings/frontendThirdPartyLicenses": "/settings/frontendThirdPartyLicenses",
+    "/settings/payg": "/settings/payg",
+    "/settings/account-link": "/settings/account-link",
+    "/processor": "/processor",
+    "/editor": "/editor"
+  }
+}
diff --git a/frontend/editor/public/og_images/saas/app-editor.png b/frontend/editor/public/og_images/saas/app-editor.png
new file mode 100644
index 0000000000000000000000000000000000000000..e89c1d060a3283e264a129a6f9655f89b979abea
GIT binary patch
literal 122101
zcmYg%Wk8f|w>44@4H8N-)X?36z|b|MG)Olh(hQ)$DBTSMNOyNCNOyO4cjw3ZJnuQ@
z`#Znp-nG_VdtE^)5E(3V5_ALv1S~mONi_rn<Z=WAL{|Xf%P)VZ4=@m3At1;}ifg#T
z54_zL45ccb?cT^zWxURQE1u1uB*myn@QP5<Q}q>w{HgBoBih%t(qBfen3?1Wa{z&3
z*+J+`YOxfa=YB9EFjepE<LSYGm!<2q@V1A-8LI0CulU~cv?@#2zE<vgk@IHby-H@j
z*gV0i?SZuSmPZQ~M+>>u46t^WIHr$<8U<=OZ49`)K-kTFjd<(ztFxAVa!Qg`=2Q^u
z4<!!}=B^G`yBSfz2Xrm9q-}e|CXDuv2>A&ga$jupp0wmt(Mk&CMkjPH+5frz09wiV
z;_XgNjo5lUZuRMDL6(Gdb8wessfzy9v2gaHQ!vF?q22{@Ekv$v@d8uxa|N%tFvn8L
zr07f_$r>~$)K)ijBU7Rz`tnLcH?h?%VW;F;eIl-<Xh*9VXJw)Q<#9VHFJyy`IX2Te
zn}>2*`$YQQBfaNvg*A10Dc7UbE%0vmAjyAUlv0Ta0`Xz&mVAcztRFgU51|c`WzHHO
z4LDX=hGtnR{0?j9>Mz~-V4rMpbs#t_D%zyMp!rWI<l}xSeI1%Z7!Fbk!nry#Y$d#f
zSk}4rjmVaOeMMzjSs?5Z!Og>aYr<^5UvVm>PT*Q5an5gb^8VSrj5~oWT@)Va+ShlH
zD*lZR#@X?--B@fxh`rg3wI7#oK_}`a?ZciqC)&vA3p=0L1Bi6Y3Ndqe9ZjWu(lU-}
z3Ao)<>vjFXAj>3|5A>Fb#bb?qWb*KtGRp60H|P{N)aeim8RtNcvstpXLm0HAgopV}
zG*ynnnyD3Rt;fCiIK=q21zVouvV0^jhbiKsG6tddGhmA4tcKwT=#%LBmT(e;5BqtP
zXYhP@*kfx}XL!=4TrEfbr3^?!&?P5M-obD<&FL%A6ain1n}yR}tB)g7uc>eJ>;oby
zt<}DBTWs~7`zEJpM6aO_C$$JZ6IElmQv_v`*wyn<iHPS>D2t?V_EIP-QQ1_RgfglN
zn}etYGxC0Vrc0*X;IBfp$#@B3L@1yim5dCF+E6963}wcmloSk?4Q)14J!DzZRQd7r
z1oJx?bw&484nRU%tdJ--3Pj=g=`)m&dGJrx@LEmEz*?G`C@O`~@B<uL!d#N!d<sgU
zj|kef^g{Xs9WJMybh&FDuYJEUNt-?3noA#Z`IvY7ut63Pj{`*eD}|wKehuy3AuRNu
zRC*^4Ifsp%>5k2H?@{`)VtpMI4$r*RrqLNZU!tDT?bQo3KWacKGceU}*PxyYC@Mld
zl$K+?%QH)--51RKwk_EEIk!nO>#WFMZ+KLs8<2be42<75FkS#Vy*2c?%AVW~O<B_)
zrGmYbm*texFpk&F$CqCFC)$bnHIetmS77p6N(u4O6V>3zU$nC}xgX(I{HUyaiEFT<
zY_esefgpoBVbHpm?x1!3qqTvvF!lMyM>KWUR38oxwHnU!3XPcHpyO8-%QyBBhyh>C
zG*zF3o#d=rg0}aYLUiI19=NZaTk@aB54-(KM9!DWqJ$^CjQK2kGJ4^oUX;*H?=G5Z
z>1Y4`5eL>=@?XwcpNCmmt>G15pW51%{PYJy95jgR#DIO5==GnQE#g~Ay!LI&;k3&I
zry7#t|BMa!xGgkCeu$*5EX3nnz<AwVWWb>lmGG7`pyvtxK2R9gM-Q5f?L@n^Bb8nj
zm2j<|F$%^PI>=GQgegx24fG1ZuaF?`PQ}KY-1<!Y?`%wwbhMEA)!~r?Xd>s?UdOwh
zTSE~+cdqobH3AiJlXq}DCQ51?2ae!7OvGQ~_*s5EG9fgO9tuC2Bu=YA8gKmpepg!Q
zq~cD_Do~r(OcUU+GoHE{g-RoAC+V0d=k+9?jHV{2A@C&axDfBe>{9zg`AQCbY9Ag^
zQB485Fnl%jmKnc`OBc6z%PvC`Kvgv^Oc%ArLs?u`G;;P-&X_Bowrlp8r0BN(wP%u}
zs3Y`;l-0+tYdySx68G>Yq>Z|}x*7VQ;gdCB@|R(l!RUeSuHjqn+_G(+u$muzpDKT}
zB^`zv+u?x|-#g|A8V5s0B>>w4sqdXEN>G{qox~o}N4PUS`fH1uVH<7w7A{bx^HOFO
z2v0QycqPcGX@S^dU22QOpIO9kL-qm}OgHsSF5md6ZH1(EgCbIX@l;dq)=XnoT-@A4
zNJn^Gux%;i5f=Fx8l}L;x?}b(P<<%(iOo>!#PejvLUS{zCV$`zp(TIusP_Zz+_AjY
zDAb)nKp|uciubxxHPdflygyBtN_zTt07usC0-Lcz7wKIe2km2b0sf<tGqRzUAAWA;
z?Qqr7JYLnM>%dH=bu!xU()(}=RUDvQvc**KU9QzX^<K!s9@K^*&V6@@8~q!Ox(}RC
zx1k=|<$mOlI0Pc69S}E2Y1LOd&Y%!}0n0<i=_X&bPDu2as<)#BdF)OC|DgT=g~ann
zqJkzC6mpMFll^=rh^p734)XV=Vth97LtdBHU*n#Mz)+c;9%0$3)(qa*q_lss>PZOF
z4ol-Q_JN^Ke_SU@Icl(@<{%s~`Sv~cqX@X_jC132y<46De0ZO`!&t903u~XE=9VJp
z-F>Khcp(m7SEr82fEpBs^cq>7*NUfXG#g;gF^czFJ&!X@c>`B>vU%r|682J}C;1Z0
zuw&>m&u}H){TmJcT*|TvRpmf@)c8*y)5pL0hj6Dhauq&FR4VuR<j>GELIhMqL2EFj
z*aef?e5tA;v7LC1c`@Umj!h^f%sk%U^mf})^!mZ>zktLv_+B2{Zk)0a<8j8vM-*A^
zj!MeA%hwZdp0z8Nm3Uqd-gn1Tnji7=o|W;*bc1KX1?6a}$4z}xwm-%b@tgw06Q1Ox
zW@`=-7pKS%|JokEfs^z@es&@^CR)qVH(o7*`K`p$&*-6mX4iA1+HegT9ZTz7V+H!7
z+=?gL<6Pe-fPJOu1=|&Oqq$|;q`j2EW#oPJfnbSh<UrD5lu(}oN+0TDz0Na*=yj0e
z;6lUyO$R~8JoSyB;XK9&d_G3@M_>c@f&0wjn8eIF65I(iLnTFQCz=r|u><5;Cbp6}
z=m*0iqkNaflK4&MBz8Q%8Xd6CyAhwBk!Yt~;aXI*Esf*Zt7xhaaG@ClV^#iS9o|$V
z0u5Z@W@>fp`U@kU5bsS$yo)>@m&i{;>OnQ~pM~)4X772ARgup#&++JL+PC#dEShK~
z+I$+JczXIcrTpp;?Hx)p`tjsW3zHL7WvbDNuL==2cv6KTW36%S0I9G8ZZ2+7jcuZ?
zt&X?%NdYOcxeh%HBhYW+{Cs)7z<YFwn=sZ5z#5?g)2vYXZTdxNGN!?j*C50sC2)hL
z)_RIsQ)PIxMaxn5gltBXbdg(b)8QPhNC4{~3g&>qIV>>@-_DP+D7fLsds`2I`v>g7
z+Fk{lY0y$4*uUIt%qyck$vJ2^)XRaNpdTU_EdpZ+zhL(WMeN+zW4mRv41n9ezJWKM
z3&zDI#FD#=wei^XiWE~>KkJ1x-ku9vO$xO@f?s&Y969dMB*`BgVRo*K>s|Gnp@G0p
zlI<8*m)Es(JXNK|4@eidYul%<wi;Ns7(EI+X!X?s)u;bj@GSFJz9IIT)>gGRcMRED
zml2FW*I{qJ9@8@$@_<Z<>rS=vTg4KJ<YfnR5Lw7yQD5^(el}q7SJk5=zB_U!P7O`D
z9I0=p+9ske`4=;o!svUgJ%zs<jY|a5SibZ6u$U8|@)d72VE&~pZdvp_s4Mf<XP&cU
zCPPU$eW)$BkwH5Io3v6$0xi}&ld8qhcWbZ~d^c(?fbj_p5F*P6VaPiWl5Sa>(O!~I
zO%CW-^Kg0HX2{@=-_?r<fp?<HjiAYYX|JUK$NN^aHFu(Y0TX=Uf>O6Bl1$0^U2%Z5
z_sk^TDPU1WOuWv55FA$6DrO?sOlQZ0EoMl7-uZ67hspFS#gRQ^h%5KF1jh@Bj#Kbu
zdA!w8`-sZyLGpHJ9>0w5!+~&20wE?Cke2HZ<p1{82G<i1gf}<g)Z>XwWyjLcCLFf?
zhrZ~(9D*(Y?9jSMpYnk$%h)gfq^kI_IJgGsG_?EzZXdm=i~xXrE8k0Ve^%3Wt}x#k
zs-e*NFKI}Y(GVE7Z|H#IJ0-8&uJ+*4`NFCHZg=cXNd#u4gPtgdhfa~n3yRD5h#%?5
zc^9~bIe3IQT+~gnYXdOp<!15WIl7%1#_!#fiH-F}(hiu)^W_utbY0l1l<$D26Evp%
zY8&yz<5w4<2^J%&ZV3(W+wXOm)%nlZ$_@z`-p3@ESqhxWli$|3IW~W#!tJ@LJ;G=4
zQAZ?fMJ?wW@3gbSP%HZ3#OukrSpTKc=l<2pT^FU<kFew!?GKvYw-yXeVM}J@o`8z1
z0T(qXLGt6SS5QC&n2M~zf#VQFd+1ncxq^k4GedQi9p~7dhK^vvbb+hZhkuLj3G;gQ
zG4O6EkwZ7B#)f664)ssdR}ok!5eZo_D20l&C5RZP$QmvJ+hI+G0*phK^vc}}0&ss#
zDdGTsQ8%m26K;6}gIFdaAU4ze$()ao(cS)9?<43CpUsjwaZpmgl>HYX(#Ich@b;bL
zV*loH_yGAP)%Z|>eaHsLy_`0*(j3&nU{Y1*h7fYmQ|&Kamt8kFra!6!h>ILglk~5x
zzo+^Jr@{r{xUPipWYiNL*ay|k`avwy!$GE%ltgxIDUk;j^|n!$Iq^%7%bf5>m{KAx
zJzHaJbF|+7B)D#4$nh3|_}dO!b;5Q<+u3NjckMoKLor_g2Y42pifiVOb1W#yxtd2+
zZ;>=&zzy?h_v@3E{A*Bfj3l&FC}>3r280Zsn0uhsy7xLYUgFleD$^x$Osnc^$4<r3
zSlYJmfAhB0GIaY?)5?zkMtPev<<Pk^M>mY77EFJ$&>OjAWL7H*P(gMZ5nD5uwdTsN
ztnuTnjLTs77XJnZbIPgD(`sLme1_=20Lk;~EZb07AmZr4?79uF_P?JnNQp@1kLZ{j
zY2@E?-(NNJYoE6-%#mwaf?+mPB+t^A?y<btXBnwkC*dzz1|n@GAy{G}F928Qhd_=s
zRm<+?H!QrQ&-nzTu|sg}HIG&xq6a1<Q6w&*yGhkK^p4MTh&EQA&BOi`D702OL@$6^
z5|CAgaLh79!X`Vc*+l_<C>{MQ0&APsvO(x1EiphiTqUJ`LtR5%xFjslm&MdA%elwy
zGECHHOrERMOtcNf2AL%(i58wmzGFfz`of9L$4eAD)8XDxf|A7&L?1}Nm`f7PKy}zh
z13uR-Lrrp2?uVN8Hg$xUk%Zu85@y>_zZqVoc%fNR%wi*z&ti69DW;T!Mbj)ou39TK
zJ)XkoP*x7=%m?6NP0tGK?;(hcAE=nz%=0hRdtuKwE`r@kJ`E{&(YelPugnpuK{Q}W
zN8R!^M954n%hNYBQZiyJH<Ey|)p!|f9`O)x4C8z*Wh3nrzHs3}X0zFW|5fbtk<Sd<
z?+MzY_A!G-qG#<74Lt?T8|fzmd9fe3EQzA@p!2$l-*mgo<x}B@QDZt5%^nD$8pnMu
zUoC_|HDE3sVuj&Sw|dW>xy-k`zVgRPk|E9^fp&>l)DbPTDiZ5+rTPCew@EG`ZFCBe
z+`G6K^sUmvdFqCaNYr8&a`Xycz+b&&hiai`Be+n&OWwDfP(iUjNDeX+NP$;=pq)_0
zBu*3mo`gHJ^|kXygA>Tx^FXXFg{BK!>S5C<*bZ8|6CR%5Dyv#YGeZ=$vXBTne_-WH
zdyAyC(0#!5pl}j_ncW?I$?mwr25Ed-k?nD*ygUFv#!CVsc`7wT(JQrK=p%fGX8pbJ
zYrU)Cw1K?<8`K@Ms%2hz1_56!o^pWSN7}^*EAjDLG}qnbUO|;*-Mzy-!^U@FfUtzj
z+C|+SUGWy#LdRo4CQ&`$zF@FD>M5B)nzUnN6#^#kZT)wAKk86czbX_#0+Ca?iXWY5
zAuXvoP4(n*!?uAU+@1sxYg&ZB|JjP()8+j(a2Fxnnh+Zb>JMla2z&JULjjhx0&Z^c
z*U%RE%Too%ufYsYZpaEm7`EhImG-jm=r~(Y45{4P@J^PWNYL}U)b(=<$Cm3XWTp6x
ztljt@VJ8l$AEoupCNJmq2k8U{0*#bhDc<rv?bX(-ypV`*(p!=|`wpI}O`urbkz-G2
z!{OdUJvSi3;KwB!d?Kk_>IJ|dNSpip1_ciuXJKWUKC7$eCfOG?U`-tRCUIL)P%*~U
zpQp3Bna<*z=3pK>vHD=#|C!`*XERiPaKECRM89L0!b2wQcp_S6?o{uSKy*aaJOE<0
z7h#6={RLgah+i^KD?ik^dXVmg16(cmHYULkXQ*gRGWhqv4O5<icz8O8^z|3;9$gZb
zMXN23NKiMPBbcGypWGm$m%cZYPYGpGLKJB7X=<%c56;2Ch4e0}v#&g0<O=@``g3&c
z=d}PZiJ~17{O%AV)u0%!D`2+O29LUed>xi)e;yIvvnKFWyOCPsdt|?^7jHgSzi#Nj
zLY$?!rX5JA=&H}6na*Fy_cE+XyLzzO`b3jT8^g;1B&j0dhkv(&P(4^L>RErs;m)or
z&Q@{frdbXRER`x0zYi-TW)9p?3zBON*`O$?dCHo6d(_MMPRJ!Q86bZpy)EU_{nvnP
zI<7F>!8PyIJ(|w{7rF>^%R1JC8&zglA{Az+$!6Z?ZZs!9t1fsb1r3*gaiveMFO|%-
z#+26mUL&&@8)fTHJqqp-WF0ypjafeLbQH_7A@9$28!F`MX;UBd@R&du_zl_5uJ`d5
z>bhmu4;_COV-NSRdnFIK-hQC`iTZP*E<W9g0g$1osl%yvocTSXCeCB3yp!C2lQI*t
zA>!V~e^dEtc&Wwv9_ZxS+x6qdY1x48o01gZzbojiY_ddu#kXTg(cCEU@HTb3^6q&G
za3^l`xNQU$Iu5xxHZX%>7(oPf8+8D1@e8K_P00Hz56TVw&LW{!J`{mj(2_x!${!8P
z+)EJ%<rrKK64gC!61N?7(tjw>npRJ3>-r&(UWmXbKm$sYe_s1l)NcoQ@h5LZoZi1l
znzrFEQz0L3i67iO2YeiMwPUYfR5XSHKGuz(<vv%5!18@Me<(_3r{OTfoLXMa|3paP
z@?kLC_6ilSXe-jOn8hy!m7}si0s+QiMFlP8_oE%DhkE$T$l4)Y7-(QC;blE>5gi!S
za__D%{)5t&_U}-<BT`n)5t|XJ0U?Vo;P_9^zK^gKHUqm?3LxfhbIOT-1xsWq40>jB
za?)`#soKycrR_e2#m-6m7xcnjRp$M<sSwphT}nk?*Kzp|Pft2bBLRy7C%y(NRA1q*
zfjrTVAbqd*fgK*&hEH-{NyX*ak&uqJygd0oSqV2Xu+PmV$emez)#zLkDQqIdSq;y~
z4sX6Le%f&FJ;tE6{IH#ZPdZyOLpg)qY_&YrSb2t%anH<bVOc$>^ZQpaoR@p5cMWDh
zcg*Ck7koLh*3ux8qZv3}tqs&vvM~7ICvO-_SI>jrVed)?7B%K?Iw4v7Y(ccpN>p|8
z|Ft**sifg31;gFNSMrxQm;R=Uz?YX+IRFk^<1>L}lc!LlZB$xURaC{F7d_1i+g^}%
zR^4f+f@H9z++ie>r{g9%tqkMN*Yc1F$H>23Js2Nd{+H<lXL#6V+gdC)PEhB^#Z3xu
z^#^UT)DS=Nwl$@pwPJhr79U&cpb|8ev=ii1BMK0$8vOM^PwfzuMz-k$U#5MeOOr|k
z;Nyh<&Y;DrS0?aG4=1l9rsdn2E*Tr^OzdIz_*Zq2*Z<+>fzzbS?`=thnGSae&FdNP
z7jshUXvM{hcq;`+P13s1hfEnO5Q*U`B`Zy8ory!}VY;sh#s5rcZxgdqkGbJ{A^5Y-
zP&b3l!7(k<$d1;}cKaa3gXl|!MbklSzF433pG@HY&3GS~rlrpe-<jx7KmAS0DRRcX
zAnpzdFjT0t!Qj}@oZLlsw8zTbN)3}%`MxCTIJYk<KJNgnG+kwK%I0yyll`OSj4_Sy
zQf^Mu!=_sIR^xBfUBmJ2cr)1#*U@jyyZVz}i)@$ta;w!b79)OxMc`GlS?bLG)e_y?
zHR7OIe?2Vpt;;1H{KxcI0VNk9{<L;v-lDXR)c*kxI|_*=PR0uAY}Fo{2#hu#VD1PW
zN6NDPdE)gMYh48jINYs224a5QQkuA@Jrn-`l!pQa-7Zweh^6dBV9mleeC_%PkOwht
zk?&qNoOZUh;PU!<f8F#d5vCQGw<iEkJQ&@tl-p(>h`bQ0|2lRR={$_Q_X1bixB@@4
zTD@9TpCOaXguS|~ZE6iGP=&GG^rB#|{BE@dwEVT8f~trrp15VsqwI9D14Pb52uRS_
zyR5wb9&&A#VI_`VHO1z^Y-MIHBv|qUq^3m&Yz%9+c@|fJ;f;1EZD`y8C*`l?y+;(U
z+|cH=Fl(*;^eT#Guwh_D_TaR3)Rw#U9_Qrv$l7p?j?O9XO!-A+^7Y+oI}H6_rKj4Z
zj?6?Tcx{a&KKlw}h}3pj7bD*(A^qKBz(`)aqX4hz%M7)@DnKyyH#7BiY=0B+byZkm
zjN@7CHUn7Utu%A0Irv^=VLYo8y|15pf&#p{{&$Q5tZJE+%kd5nm{jpTP{+`rnL%dg
z$kXBJuJ(w%bvjeX+v}rwkGmF=M4Ln<$qt*KuB2%>feszBbC91V^Tu`Qjp|Sncqt3~
z>GpBkvr2REHsr3XU&>rG)ww)m88kmV_RUhAa$n;AlFWRG9Yf>S7Q~$<;Z%wDecDW#
zgR%n^Yk2!eAg3FXce`rF$PLbctL5M8M#{IvLOI+HETR#3o7XCkq3Owq^0j#lp(Ae>
zoA^(ROK=c;6N?W3Itm*3dRH1@X%i^fo!n1HpB*Y^G+^xC<Msmap;%oNz1R3xhrn!1
zK7cS3GA3b#PAuhK2_T#o2~aV<P8E08P~-8hx7L8E3huGu<E`8}k{s2se4EZcG{n~k
zp13AyBI0U|y~Z^~wRCiZ)B0qP$+Bcl{yN+^utf<1)F7g!)%jhUNmh+=6PBQq`7c?-
zQR200_*9<#4fj1;|7_F}*v*sJ`!nWfSl8IKT47K19d9}RT&l{H$#mlKEIa})ygs}B
z`~M|6g=3lRx!isLDD^iw8%GUh`mpdzjAle4P{g`LhBj~Azr?E8x_%#h;olyOd`+oG
z@H&cY{!&9N!{eGgO3Y?x!T+$3+m^9}rfC7&t)bh7H@Z;N-{UTC!+hub;xkFlvbmXU
zjBrs%^oF;&RZu+{MB9+vU5gLEWsoWYW|ybn#k@Ur%8U8nmXtnMQ+<t3G~J%Qoi?vi
z`+xs3_2;ZazD(a16yQR;2_=3-vGA9eZ`H#Kk5pp=m`jYDcbQ~UJ|U5KHLwC$R`JVQ
z4>n?O=o0q?K$%WNteb@+@GEy-cIsCLqv7OSXuAJOV+HO+po3|N!11CIb$EGA0B%Vc
zbMGZ?;Wh^<qKNy@9bZZwAMEvu(CvHof+FrPAqI0#K-R7CA)k<^ThR9Vq|u_u07CPc
zMcWnM6$dJhX3Z9WaK{mvm3KAQJOM7aCf51Q*1fxZnXW0_@I_&bw)kVSDsw*Tn+Uqd
z^yv_acN-cEol^&&k?!U8q*|aZ25<UV&rBsTwy$i~Rk4EDPg|zgj8ZWnGh@oKoprSE
zFdnsFZRbYykFft<q>_&}hWrk@>6Q%GI*A><XATPnaIyka-UtraecukI4pE?uOj%vs
zfR0eKZ_s)n^A31SHg}-)?@hho3u&xo%sKYE&kyj}7IaLjUdOnFgJKW#Dia(Dno3#d
z&XH}^f4fF_Y;92fS`Tr6n7#Acc;v+u?bAUoj&Xz!X{sF7^hbu(S9Z@`(x2^*4W|7C
z$w=&h?7}W;0f*bFn|k*b_(GSMMl?&TRcV?_ZU2i5gKj3x4A864UbI<^%dbpVxO=if
z@@YV?+JN$z>&yZwP3Kz*uuX6v`o>hpNAY7A1*D^9JoI6=en0=!hfXwdd5Q1tkt-CO
zIyIpEj)v4-pd?%ch(;{uKKcTq<W5_s2~ZaaQDan)S(zBl?kN$eT_+lb2rN17Ma9lp
zIuU^}eE6eKim%A?22a)>|EgHb?4s;X^t<6CUllyYLZmqc=dxRe24uV7k$_nTr>6pU
zg1Z#=gwCwy+fIIG%8_zTO};5)42zQWVua;ro8px$)T}H^-iWGQL6oWYjgC}eNtcSJ
zVq8SM?gY-6LhLqNhS`5ObdfidPpbV4z(Z`<pblAr{d$q9gB+8Dg%7jg`0Y^K3}w-b
z{b#$t|BX@@VfzE<cE(^$CdH~Q)y6HhZ6GpuL>az%jcXInjSHD^kV=|#ndDgQ_57Tc
zVdb8GzCk$m3PhGBY_9ypog~}?R3ngb+=SGMi-)a0RGeS!7wtWNseX1++!y1p)iGOH
znr>iiEoDGA?327tt5_UaYL(ArX8$UE`*LK>m(|KX<pCw6M{>6N>N3YQ74u73Q10hP
zSc&hFYOVYK$Ags@B;NI0U=V(3r{6Ty-DoXS=0qlj{(i;_R9m8!dRamq+``%g;1pmo
zdysL~q|vIgzQ^9UgmwoSlnKFzW*4|&!{JW>fV3mCNW2j#5dJz=Rd42xNmu@JR+a!c
zlll+pOIv!pai)e?=i<0J&rqFZfA~&h8F6TyGw@y*OU8zw=0m1^=t(&?-Lm<-&OMmd
z3MwF1jh^am9UJ6B>xW>^9fkM;rY98PX#+QW(|?1MD+l=ATf#>?q7o@ZBuzv&Xx%Cl
zE7QMEj^z(%1I>!RFY_k1p{d_a&d>TaBFye%>XPRD^a0NlOpLEJ3iYPf0m4o2BAiUL
zY_LH*xL!k92Oku1-8w~TJ71<Bnn-#j{?FnTT$Gw7Vj21W-4{5)z19u`kt+d5;BNv0
zl)$ehsswO)Z@%*%M+K5F%ws5km~n4fLR;W)>tV^rUt$Nul5a=Avk><0eLMr^VxyF2
zmqJmfzC+bXDx@R2EYUNS07jKZD#rXT_a&UGA$Y6rTtDX7zi0~>AWee$=v_&$l*Qz|
zcRXi4J4T5;8Z615DVjPnNWDU((bXb8=ys*Z3K;Ng(lz^@n%yL`dE8Sr8n{d`S^_N&
z`Q`P+Z3azeILPMK`v3A>A$Hm<+~dK$t$ikO)-0Gt?~jEll7wnFoQNi)WQ6Dlq2y8T
zb%{k$a$!k-IY;0Hy(o+QQ#k=6t1!vP4cxTYzt_xL<!$<TSWzb}L6T`?5ZN>kF1Rb-
zl#KK}Ju{#og|<$8l7CNd&Ko&D%7vjEiU+bIAU*J=p1K~3*;qC?eOZ`YV{D{T)?ku*
zq{UGidep3i++x=xf-M;k0()i|Ne5Pj-`%sa-r6=eXUnLJSyX%v>u-kQG2FX;ArRL(
zlGA}=$ym)jCx4Mh!UliUI7;F2X4;L%<fghy`v6cEC5=eccu21}nY1OFgq(;R&!8d5
z<$!y&A{k!;)O`@`mylmHbNM;S?}MmjxDT=Amc}znFTJr4W0$nU++F|+o%fNQbHeac
z>)*qae{>Q4LHDe}nJL%bNZMD`c}jhnqw<UL#2OsuLA{8)>H8w3)$LPpbvEwbD>#P#
z@PN;&^J`=b@+cM4Chi7s<|F`1(fgrmAhREbA^7oAi3XqN4U(RC3M@i=<}({sX4d2t
zn9pnmm-ddi;``RFMu~JlOgolh#L>{#mA{^<4-8m|cDc8|Y%sp;J&P$bvdquzA9Qrf
zpz@l0nQtk<GqKMp5$gYnZExRSLi|kQk+uhc@$z0uS#k>P%zfen2T9IXUde%E4tILL
zm_r$MT}CzF=KjhA3CtI`Tb`zG;3GaohNS_Kc%e%mRsV{RpCr_K<I1vfZdl^q5?a-}
zy^KB>%Fj}?-}qWMqq15DYFrP&Xy^D0@puO={m+1BM2vfkoSxXd7X#|JalV}eB>}ii
z%1ZnsIxqLu7Uh?8f5W>9DKwN!1x`QG)f(k7x_q<#Or$YSqJy<wn)zy6q6e>S(Y9-t
zJD+4@=b&gOJs3CIuuvewL<OsfP!{_X5FK*a5*K608wal+WB7G3l1?v>5kwVE{)QO_
zC!8402vBMF4W?jzwJX9=5qKa>WRDucGer%w#4A^L9np8?K@G9Gw)_o>DW)^c@)8AV
z`4f$@&S11mcpA8N)1b3IP_$R5q{R&({c9AWqjf8s-zjsxH4aK35PLK5=bS1XY8XCz
zh3mTi0<fAxwRBL03cw95VZ3c9>dn%&#1W9d;}#?_QGOCMVo*S(oB+=#{+u=C-1p{F
zyyXhETF-shwiUkyb)~q=32l2&l9xjExP+sDp!^|4vC`sZPN{Cdl9@?jWvk8G<Ifl+
zX&lH{9TCBthFxgmjHl;t%$7$Gv(J9x+?R%8B6*@H@Yp&`^U2WMO7uF4_q*^=7&_&3
z#L<)wxcu!=dY2&<Aq~T<6cF7oA7K3V*`?l0@`*H;<KIi$n+9%+59n;Guz|lbOA<Sd
z;Iy&R9~9v0N1wU<%z|*Us}ADOeTElpQydgXz)rm^!61BjU#e<iSRuZ%NDWmx@&urq
zu2h{bU52q$Mp0H@;_|5i+CM$%*hPj;yz(IK4KMsG6%eb;Lh)zq6+Lz+goDJ?<7~>(
z9=hu^Lv;e10{ua2)5D!~e9W}!rq4g@kREyL<d@VatZ0-vi^{o_pjXqE+-dx}gB64~
zb6x&AdL~QK;(%787y9A&Od8Yu3TyE-4=l8^v$FNI!1y5=)u&ofB?9>0<O%eVpzdH9
zxQadSDU@inREz7(tqyQ3D!36JsFn8-|A3-E1{h7x*ZD5M6Kj#dG^=Y)Rz^)>w^2Y%
zO_}=<hRw?2qVIobbdBM94P6Doel*%HC75=qe}C#m`X_X|QgT1Ix8fDfXr4_OdOkiG
zAIhp~BKNjj%$t|L&V><eZQFH+>t0Njwqhp?Fk|7sDc*6L5emU}1K1)i(Ib`!L}<B(
zQjU08^2VeRrb^$=)@U!YxjR@A&t0ZJOf2g)GT$>^*jvE!TWs9`To-!NBaRKlZoSvK
zn{I@`amKD!t!J3s(%$RLRNL2vBK|$=jknlK&9GAtJ1wmI)ch0D^Clbl?DJgOD4XTK
zb_7X+^N8wzNL*4oTGgmeJA$zij$mr}p=omE_+xV|&XhbBK3UbY>h#ESQz@VwZ=&m)
z7wm;JIl>-Lm0JmA)Rsc6aWW29+AH$>s+)4_vdJJj72=XEEbPV3AESDE)$Ag9?L62h
zD+P>e161-HzIfKSC{skx10hx|D8(;4d>tl-ld*eKnIGGRMkrx%k6i@Ca?VelW^lsO
z(0?zDTuOIpzx@}UT4lACv=U&)xNguDk_jrRZv-XIyk<Txbd-9<YIQH%Z;)zs5lG%(
zhk?&H8`$IK0_JD&EW-#CXEiBmtHoBnRIY{8rmJ95FXh<wUg6VwuM9~Cd-;V04m2{%
zI;`Jg$1W;N?vuRl`|B9?Mrrj240j8?^#f(7kU9GEXUhK$PX6AqpY%>$p<b>BkME+2
zJ~PCp`p`lFuRt3fcdM|16@7;<*xd^D=yyz~EDlE?B&)=b6^)S$6`irMP5Z)am=L?u
zvrNY2Y37<~h?i}`+Y{h=Io*By0WU+eX|!|I_u3{igV~yDXV=@Bi=!{z`X0wj@@bFt
zST&yymHi2KnHnYaO`<qxZ%^}()?oIFg)BQ_<Y}r8s2g(ZO#Lw(ut$Lvq`9@0Pofzo
zw+7X#@9b&}ir;)f02r@7Pu_fU$wy5AK2BSAMcWat{v&XXg}_(zi9MvC98r-9UudO*
z5u>(UXvyu<G!B3)S9Ml*Aj@;w$zN?~K@4uSsVgwav&XQ3I+vafxb)XtX(z^AU}$qE
zs=}g5ATFxtn>ASM8q9AD&@aRmMpbh%BrJ?t_8AOU`63vAUkS<{A{?t2b(rJn2|Wav
zWe6P8mIT875wO7l@`6qLlC(FdbdT;fG$wjqLSrMzlp3jweyP8;LC|ly_fhyw#Q9_Y
zfGbdGuL#-k6-Cd7m`jFBA|6^Fc*lo|INnlq40`f3NuwWpaE|54q@LwAYMX=(C><4C
z>cv&Ds3&`snWlBU3!?2rdu7Ta06cwKnWnZ?wBNXLQu*YEzjd_%e(exSvS5l|wq8?r
z6z_+x2Ee#l1}e(8J>c}!g%WM{KaRM{&7+C`(=?u(s{6eaf(%`le=SHmPzE_7i!y*x
zf{rhqo?Os^Pv~=93+HTWG0|d8uYfSt_SSCxdh3~UvW3x)@Ic{wru&9EjbmM(x2ozU
ze@UYhdZeMwuyz~;jIIR{%jGizM#xNE42KRzPh^b-Wv>E>mF{I^ka^&E@p|It>Q*QE
zWHQO8r@0-|ge7ICjFGzZa>ZFIn^7@wrf2bQ$_i5-=b(B^4YDkO!}vbnB4pE~vq>tS
z#)EeJskG*v<Pf&X2{3+cC?&snd$Zobc$KB7h~?46w&n8az`(r4fY(LCEVZ7o=(~1@
zsQ=jW3NQR<+pwy&vak0=BncGUWz#Voj#wv5BS~-F!nj-#!taO}hGTA}gAbhMH+MOZ
zu5q_+53Un#+%#D~QN(;z{@{SR4kemw*Z;siY0w4t8^aZ3wiL<6NKXRwCN}NPYB-OS
z@C2rX@e>_Fq*0H3HAcQQ4Jil>c$IPyWc|9F$WnS*Gw9m)%mc2eTA#e7?H+!w!$G4w
zh5vPq<IJr#urx=?N9VIOKZA!sf8$T1)Tz|AS%$D3?6jZzE+86|GTT{))8xt}?LHI&
zpxxYT&Rde_w9UNIh8^m2wOpd)tAPP-N}r30?d^-F-3UVT=YJ1;?D9-h+?{_{7dG9m
zLIsTL)@3|m&~K0ltqDPA6=|vz_h<&>?@(AyPYHelBgnBb(#wBU8lr3Js%c^2yozJ}
z@N2&$%FP8a_WnO+*CJsgw@4C-W(H(e7^*uFv3m)_8MUPsRZBy8SG!;8;^orAB`zNE
z<va-&^Y7rTmI^F?rXD|*V6_Rc-`YnyAey0HM2-U5qPK(HQ!yd7y+bo&t4U=)4s^fT
z4#-U5e!U@jq<t@Ux)dL-@6fb_i0;bse%o(GB9ZYGsl{80w@Z93y~@R{V>1P)K~{rO
zZ*M#HnC)u@-rytR$&x;+{(G%vJY97n3z8Rs^`!KhqQ>llvK4=$hdWkwU6IS7COsa#
zSGr{>+uq#r(p6<73zAj$+=9kQSdlPY<AUGfKC8tY1PG+t2KG3MtjgYm`N@4t=DEl9
z6{ejbrvXw|p9w{Wt9A?Uxgt~kf_umom+cXe{jA4eo@+Goz92$(ouFu^INB~5o|E1U
zx-2FFS$b2Ke@OCa$6OPa#B&L)osw5<C5^Es7>(=NNiU)Q>1@G)6VHHu>Az&=j5ivB
zc<CB4`K3oX-4|WQYZ7WY{_dM;@2y5>TuB$K9ApKUb+_y%v6UatRY3bprp1{rMP+Cw
zDSH{MEh)SJ<wAvBj_rgMMnxWK{upO4CEo!JXoE_n%HP}4)M^kcmyFU~m+KU@5Wopz
zK!%`rY)Na{WTeOrSCUJV_iJp8V$?9D)#vJ-`je%&cs)~=IKS}EK6go<L@#={ow9m7
z0g>zf@Wru^X#F2XqDSotX`{~*4gD8LCX$R>G!5*OI+l3t4DR1x<%e*+DV;S{LpUfG
zE-_ku@+0pObp74u-1(z-;Yj#@<W&|J$1bg8l!3`YQTG@`6}RfUOmB9l%O*ojQwY_2
z)k?N1qAdyWM+?@V@BYSdCCu_CV`nXz9vLf=Ns#tvsW+Q7+O%b8P4OFVieli?gu+S?
zvOhu`-VfjAOVwh#OBjB?GjK?mzRciieD7TS#a99lGP$BaWVmBmRK^ouBu=gC)|dIZ
zq;(7(gMH#YkAiBW{@)Rine7TIM~nQr^MenGnHnavr^+k$+3ZFPZh%4!<vJ|KQ!<Ul
zx0MQ03+;)>CMK1`p2PKkMIOw$el5l6B|HztMdXwHZk-Lt_$$P)G{55~MG@lr2Qjb$
z5sxm~NYjj4HgawitxMyp2N94Ut&tiA48cWD*G{iVm8GQZzW^9-oC7j6{11k|Z!_cq
z=NQ*jvukBJ$sPjUP{Bx0+59wcV7yGfpF`7z_X#o4A7@Rt*5swXcI0Q>$B%$6h%Rw2
zk$0E56C`_kJHGmHMTN*$1E^s-At!}|AjuF}$v>|Urg+!ptx|Vdb}AZEbQ}mCrb<u>
z#ZAfEz6xdzmQwRk&vrY1!yQn^TckhbVUTll;3qAetqYp|I8%fXmFP*eU*en3p78^N
z2s|U8`6L1y3DDFro|K{=f+qbGyB0n_h&X~;v60dLdFJ|`0rY_@pevQ_lqP#-f)I3Y
z_T4p`0VI3%9!J-)z5R}KFyKvSk3KhS(nU)wb34P<UCd+7A?$$)ojgtWW+qcW4#y^>
zh~9MdE?Q&hT!ERXgdS?V%l0T-7q3{B9QV6;6ccq)=d76Gtgcp<k2D1hl6WJ-l@}3v
zR`_~K&iL?j9K7uWI_A1p6wklv*(=X{YTP5uUqW&+ah<jP>lcXoCaMfIXh%tbz2cXK
zzhw1XX3SFMK=j#g*F)JquI`o@#y>h-=aLJg;|gzBC=$;Cabg|Y4f$TlOuAz$jW|lW
zA1%$v0ZdO*?u;}DI@6|_V(k8-0nwW^|LDmeii(&CStW-s(5%j=izAhBBPK?*p+PZv
zs02@u24&+mT`G=J(K_E@L4T|Vi2wuegD;WL_yFVl0wNKD@JL+B^ECgd={Oh*gn>NU
zOh(>|Dqy1r(9l{#GKXUC>-kys{?v}?C{xi{3Rm3X@Eu-#d@Telt`fE!Y&plqYf@(t
zf!I6yz4*>O>If(79JyLxUTa;*vQ0n1AsF9JDv&jrx(*ej=r|+|#t_!W1A~=a+cMC(
zrqI;-3#L_dvErMHMs0BIV5WZfYeRo9x`vcb8fnM4?;Ea#LN#3t167)E{?3@^VPTMg
zX9%8@6%^k+@A7IUb9@$O`fNFzdLPzA;cnu3){-Sy`fo6AdQx%EGuWO+46N9PX|xtq
zSl)YI6?+37VJiK*LA)m&9!?PLQcjW;Xgbb|0q(rK`5`8p<Y!+b#s?COzwzj2&b`Qe
zd-Q`<PCN2J!#y!e`nB#+4*Lh-C7O2+MEZ~oKcC<pZ6DU&mM;w-SiX5Tr1YnG-{i&L
zovsvymX}1QAWnOt2!DT&Vk;g0NDG<hrVcA+yUx#~*JB;q>)nLjyOV2uN=nTukKd?x
zq%JZypmP{F;5c-kbgs^tlrR}bDF_7Hd|&iw$l2E6tv}i5b-3vO{S+OBIj+}!`fRNu
zGw$Q^FRvQKOQSR$mdgzoq2%XAkKF}c2mo(KEf`LgV)v<?1TxYTNz<HUdO{apzB>C7
zfw=V(PR7|pT>x(DbQBBUOj$rVu<aMZsTe#`4Xy&Yb~)Is;dd!?h}Ctsr1)k#QEnFY
z=fzuif?N4QTlE~l^PRDJXzPCm>Mn7q%Xoo|bJE!qh<stLT19yCh@9|z53x)RJqyP+
zb6}sRXODE4bbzGqBcvY_(xc5UiF;9~17qzQZtZ>+gR8uKd7*Ic|1+kdwdTNRSzwQq
z8jt@Ef4I#xxn4JF5bL5}Ec;Hc*)(`3-6*wqx;M5pJ#s<~OSf>_I)fZUYsroXZD9RX
z?YQ3k9Y0<qvhu!aHXw_VM1;2K$nPv*m-IpOXS*7PlD0!d@40kfr<S&Hw`oM``NR35
zLlTFh$ve@fTgx=LZ`DgCF$ua>?aoi@Fi!W&#6RgA8vh7XZ}F4BFvXwZl9DG98;1<H
zIYoYEw4!&-p-!I%uF6|YJZL{jeh{1L(b1Zd2sHJ>b4<gcvE<t-;qW`Yl~u^w2$OmC
z29~0);o<WY7Z_E$ygf(e{Ygl-$4i^cR})O$zZJB%g{jA^7T<jqoiMM<4_ThU6AmC#
zb{#0`n8v)p;%qmaOt|~5+l<G|e2`~}Z^T>f5UCqp-NoH_DWu`T5FBlTr1WaEts-dh
z$MMQo-92r@+uwtpxu+uQ2J#FZrVlV%LQ`)`TX0G+N%17y0C1QIAl;RFC5>NT;5U=A
znykKt==~bpnO^b>)c<u<dMCyz_2-{u0hQt$GuAFOGokp!;GWW+`F;=bVhozx--qrX
z2VLP2-SPZEDQY?>J1@r8GEmayg(B}XdyEyPd~V$C1+lkuk-WsW{${Og)@?aRJvWw3
z8+w*m+iYNDb=pY;?N3>*Z%6O{y+Wz`9~N~UWC9j?xqz<O3DCcNA`_7UF!n19=?Vp0
zz0fL&@Q-_-?1exhgrvT<)CFdC*&pHtio|hOxXGn?ilB_+tza)Gj`0a$@(C@a%7mjt
zG$Z{Dp>}$60aXlrvFMBGt4D%dVTIMimRraU*Tc_Kks_R2-^?R_wIVHHVBUpaYRNUs
zCP7Qm=ufx_uXp)y-YlBfFs-1r%8y1L1=iG;W0smHb9<o5t<yV!8`g}n!URA5!q;2P
z%%0duE5ipkM&6F%4x1f*MCyG~IVPRK_{lxsCIoOkLt_M>bKIn*@W@=*uyTp?IpaP>
z7xc@;Ge$fvWgpZb(!B;-vu<W9n2IL<>u&JydJfXe)`nK{+JvBg&pi$NiGe1wD|evD
z!0i<yfb`*;spuz%zGeo%r-pIJdkVJ&Y6Z60$N1iUwx(U5dnH4Qq<GsYL+3Ymy~zj9
znEbg`%ic@SZF2s{s|D`k=EqOn-q(p}_**DL!k;Mqjd~o(;MImc+;5mq&5-NOAgf=m
zf$SN#ALBTB@B^v($syj!Q_99pGCN{~<=F16GZ8DTUnmxr;0vsE{nEx@WEaTDwTz~*
zv2Ym0{IGs446-XWE-BEa@Lwt)NwY-Mq^Ij$(pSoFXq5wVPQ&`Rsg9XGezcNM8;nl<
zP!Pad_1a9J4XpyqUE_OpV!=M2jNnbJhKcSj<?v_ffYj)Hz*1tLj6Gf|RmhB3Yq$d<
zjlBQ6f-nLnu<>TX<(s?O7lT#t=@|XxpNa9A5ND}elMa!#W2B+AHofsqJ2m{dk6$i)
zAFvxxLZ~45HMSP4*#?0gWkZK9Ye{V$SyFjO5Nly9);OxhdN!ivnW9%vaiz~K*!BU&
z16i}N-p+Zh6C}K)u`+d{{K860tr(KxGt$fueJhP^ob@hymmZ*l$i>LZ&~f{1yURP}
zKKS8Y5x%f(Fhxku%CQ{EbkW6ccf08D&4~-C>i+P)m7VOg!Fb4H6lME^^E1!&a%De+
zd@|razPK@MkUy6E6Ra1|oUy_A%Fm8PjE~66Vk?(Nj9?Z{SkZPQ0Nf6_OVj2cP83&V
z=$%X)zQ9FQw@#dk+n<L845W=>5|bAEfCcc7-Ym8Mb1;a{dzcxoAU05vwSjQ`bTmCF
z<mWByZCBraT@5X#q57+>ij<o@)h(}}N?$rza*6gn8381Dx;gQEfHbcquih;&wPghv
zMlL(7enV-6N(y0w>@2ZKUrMwT+NwSW^o`tCoob82Z`ev^tF<`<fMxBT*ekHLqTUZi
zEK6o31)M2iDxs1lW`@*5Yt|o<F(C{!!3GL%m{ukSK+sg(ZV!ueAFxQennF%ssg718
zVL=PRG@T)@ok&g{>O{(m+(r4m(M`nfE_+(SlpoD>86}U(?(8{@C;1bI+d7EORrshL
z%XP`)S5y4APG-I((+D&S_J!-dA1f+mMyp%+_P-zBchAqc2aqob4hX*eWLH6l-+n$Z
z>i*9wqA-`S0i1I2Z$1Yy_a3HS%YIpIyI$bO{GxPU3camM6M@2UWvKtittbj5F3~Oz
znw(p&rVIo&)N7XHWCocK#St5HvDfgJ%b-VwwE=dpjMSx6Gn1UMN-#<5OH}ksN_X)H
z$!iq1J$t7cy&b`Q7r1wj_Fp<arnf87?G)fYXvUHkKRL;$d)!Q0f`h8de6v_Dx*d_Z
zwGT5&X{!RNkgAq`eql{w<GpZ|J0OPuqSxQSDKqmNZH}GGq~jvQeHLHSj&XLOnapa3
zHM<bh4X?l{lod+wja=GTI&bg_!u|*eCASQDuz2QblpMy(3lD0eAI23kG_fskB7-Ij
z+66vUN;A!Ko_2-uKDH{=FVTX#pP+6^r<9VCJf6$!jT3uC$L<Fe3dQwnVs0g^okX@R
zyGrEjkRqKc;?rldy1vmjA?!~-`RytezV@@WT&O9qHf)%VQ~tg`f*$>T_SO5`a(LQJ
z>G0dF9fmglxrx{3tnRnL{fGpPn?Cp-szRb<vvH6_vSEsf)ZC5~uY9b;H6eX&H>iVE
zCJ?IW{PX2;@bHRoYWD%AD@9xJoV%VD8sabE;>;A`ie!_}AGcJKTFjK(T0<x(1yn<y
z?a8eM8MTR{s(e=5dI<`8beq%P-g=-;RMkAGTr8|1HP}|B6>MYBJ*pdt6tVi{CYl>;
zQs?_)cDgh`!>%exviQoz&A)FG&|cq53(xxM%9=J*2Nz3`l<b8}9ov%o?R-%+;!AkY
z{n9d|5OQ|0SP&i9a}aO~9c&zN9YW$<SLVNn=iR#awKVy03uQ}BdYiYTaX0t)p^IO)
z6^A|tx4rS$y*rrn^UP!Xs#X>BsAB)a@iKILy4iEB<6%Be>v4B@`Dw^;JMFq@471F=
z(=#vK^QEAUy@!SF;bWJ1&wHWX%g;+vL`k&i@RRcx)VE$7$?Q1)yn^8r(?<f>h$kCs
zFa1G6mKi{{>>a?6mh8iCi|zTVr}ku^gecs0nrw>42r;>({hjcD`9_qhd5tL^)C)}n
zCD6oZ_z!Sb!UTXhA}~%yI=R{$66e4$aR)>|$;W^b$<TL_6qE>C6NHi>>JufuUMp#E
zuG1EK4(sjzy=Ye;-i{>dw!H+axIp*uf8pL(l!?PlYL&j@M{5x5NZmmSs>)<CNkV31
zyI6Kz5kwRW!@v7al1l1KM1=jKzLOl9FG&x{Sq;-aP^Jknu&kipHXv*3a;h{m78XAW
z)r72(X!%Zwhw$*->38Jhzt@&o4!9P`(Cq{42@B`v6km7ciz|3INa7G!T5n8r9m!VC
zZ!}|1_t$)m1as6F?D;l=4QW2_?1ka(cD5Kih*3{_SlcY4tSgwS+1!2N!kn|ZUR-us
za76m(zy4O&>hGc}X+DXfRk;*v&4gNBy6c#-&%@)iLxWTS32i1T-}1r5IHd7zIN`U~
zVS+jP%ol$x?2Cn>vZsB$rP{+!rL9}DmX?d2^N067D>O3R>v~9o9LWEdCbe)Y)%FG|
zJmWND_Lsf73V*9Nd_y{o!bww#o9Y`~NniHY_2MB-=QgwRL>c)~#Ypoz&oNDmrxx}e
z7oOuNvYtup6E>YlbQ$;Hbe?vna9Mhhbuu2dL?`vtm_kLFv5Gv?LAN$IgNvA<bY)iI
z(sX7nTb~Ohu>){$QBL@^yQO!5;frs;3NN9&Sv$R@=VU6R+9bB{4YTs}EZtS`WrW#n
zu?O@Ebr-HuyT9O?KF{oo<ESw;wRo67Ybc2HIE=9D&N4O~Wt(3&WumNk+la$bM4SxW
zRG$TdNRb7F$hbp}W>iX_FZseyJA{QH2vI+~Q8p{S59*+gQIL?C1Mb>)H%KB6GPgYy
zYTGY9oblsAvZGTn)v`RWnwAZF)L!(v9a~DPVc$3N6$hjiMUaH0a2W5?gloGs9ilec
zW=OqVG#eIq3++{qmPGv^{-??h)BCbN{oD5Y+FgNd)H1Kmpx-yWTY9bLR|m64GW%t9
zN59?}x-DWkEZNM9ACu4zCj1Mw51<}W0VtKg{jtG1n`0I=lHbX@SfmwXZW|&Zrzz)&
zbBn=vj^#Mj;UPLV#igFFG~#VJItk?d;mN0wn?VDB*^D;Sl<cR9tg^Zcu9t!==?2(f
zGRseVMo<b7bnJK#u%x((5g@_?cB*};uK5gat)OuazkapG2_lf%$G<^1ZwuGHG(JUi
zkF5}(QngX9CYj;S<UuzO&qcY7pUxIf*A~sk=lL-KW}`0NhA!6z{y(DLGODev3m3($
zr8pEQF2O18P#lW8ySr1|DekVp-MwgWcXxMp2zJx=JLlYA8Do$9N!DI-&Gp!9?oY4q
zrR)Sep@WiUJJ6;*gPU7o?kZr{Gm>QnxS2o|E?&kKb1;<(yU3BbTmk{2-1yr*C2WA0
z4JmvA88+IJZWoGo?DJrw?o;P^xZNa>(krTi5b>0sR%t2@`|=$<L>sWTY?ew_AFW3r
zS5k_ub~MJ9*PN|oNKwkBb<>AT1=+O#yaB8)J6ws5lGQp5-^jY&_wR097Tli^5dY^z
z7t1C-On8kc3Bq94AY_6h2(!KjD6Kn0<}NUju<xN_*;{e6oG?2~H?l~!W|0~mW^Od8
zA-fwO=0<zY{v5|)G_(`MoE~0M3>7nT1@>tcc!$uJPI<_2w6AapicSR?M*i;TxsI2F
z@6{3sbyqO2VA#1k(PnC+*zdl`1`IvzZ}aZ7wLx0CRP5~z&Bt9s;#T%=pX)&+W7a}`
zs?+&yX9_T%i`B=e+z_=hM;d--3b2nN<l@K%3TM*EA`qU|SRMMmqV%QA<tt7OyTPjK
z(N!@K7W=mh42ep)pT>IBQ1O@%gyAhX1z<Qj@8v;A?e&#MJ>InbmGV4fYl*2{CU`G>
zPri^4X}SHezHhy_;}6TzgO~ADj#A{@qfmK#E64#)8DGpHw25#R)?oIzcYCIe(f2tU
z0OUR50Y+5U^c20EHxHppMgEqMPP@NoJha^%h$4IOEM)Yy?|Llu?X){jsbu@Mjg6^k
z94Coy)6l(Ow|bIPt?v7?O8|Z*-vQi`)^yWuKK-UoQTMu@#{LgW`f0pLM;fTP^@lU=
zCbO&$J>SAwmsH32flgyqrx$+61uBzPnDOUI3h9o7BRY%3!RkNy(q4#DBZNa%5)E;-
zKWIr`N`OR}?YJ#2o&tV66%BAkk3w_n!%3phQ=WBOA~BH3=gqClV27?-rgZg<VR;$D
z*#nLQ&y9|h9^1trD*^|WtfO+Q(QuGM09H<_ZLZI~5Zf{JyZ@62h{39XAR~aqs1}w7
z@^o!Qg4TU5BNa*(i8Y|ks;@EU&=Ygc(=i+a?n=61?>dvJDqxHz(!xnMci}KE8No2q
zT02AK=)_Aoz~u%lWIAX;(m^QtOEb1vX>22A)h9mo(<l&ob#1ywmhyc&S=b_MJwv^2
z1h!%y_;$5(LE;+3cC(UYW@__O-d)I!M5ECFvz`z;R!vMiO&2u4Vf&a=P1i6)3ccPq
zmTqO+ayzjrcEeb}VOgcR;y5}!i&88Hd@r5+cJuOyLDM8D35EZPj5?@gO6ZeK-LTlA
z_HDCd0%hk#V@BsgW3~G{WkyBa$jC(<*%yJk1R??T_va@Jxpph~w_bb!zV{bKt<l9;
zo_4e5K|;?8=kDyw^~cVa3qYQVs>XBR%lU1Ynoaw}=%TL2aiJXF`5iRMyGY9YgSYvp
z)1ucgUI^jMCQqklh~$+TQFY5rnVs)p%dPJ(!3PJsO;BYB0qA2v&zJAder^b1Cn&wk
z=UPgy?f5_|nhP|fW>?3g`*F%L`Tp=L`m`?gf0+`7^9CDlfonqbz(fvnt(DQe4TDkX
z>St|?+qohax-ldBY*$Ip&-rs*fQki{Vv0v!T?B8M6*<TF4d>5wDG{b_>H92#Penqf
zyK>V`iarQdbf@m9St!%+Ba1^y%mVZqCMfvwC-Jm6rdDBS_2Ca}$%bXlY7@}s195KP
zD1%nXna=Qu^kM#56_))_^IB!wgUFO*UMEh~)4bZI;wQHBO$6a(NJm#D?owD18<0PW
zwZmUXO!TPcnUQLb`O(eyhwocDWI_>i%ogJ*RdGH(M+QKF`-a&tbI{!}(aOhP`sO9;
z`*}5|MeFwM-~SdX@XPBFj)1Sag-;0X`=P)`w{KO~y9a*z4c0|+Fph4?en1q*#ua!?
z1fFtY2(P<B7+OnI*Gt_fPF|+Y*fOl!r{ksQt~2Uo^$ddd*E{Uo-mtZ--&<n{pY#CP
z&SfvtOyWe(aVWljz5l~JJVSnU?9<z=ysx*Nbu3<dF={`s^Sx~OKY#yM0l_D@iQmt7
zzZkM{@5fTbg}lgEJo=C(=3p5E-oJ63CC9x2qHtH4N3~sO)Pth^B(@NW!QzWp4v>W0
zW&&77h&CRoFD$|yk0$>mVgtsHH$c=eFI0AO|8t9e*?{yGDs-i6E$Mia?G7bJ08ZKk
z-6^8`BxK?+F-z`oF0JiYrd6zIEhKjvruWHQId&gCgkXG3<QJxkul`~Ai-A>%5L}Z_
zT~A!4b{M3Yd$p982@{XZ-sWNATqtPYN+lm5>ydP_Vhr&sQIjkQqWGiQ#B4-F@zd-j
zck|X2qd-nZ9gB|`0rN}vrG>z$d1e0&&A}g*g6ag(6DZT^aDXwDz{2~wF|YDg9q8I>
zPySrll3dfsF6Oei$ev6LN|}}Sqx@#htG|Nf-Ti9X4p}x$$C}9O(4!kZy=CPU@tzV+
zpz4Xgatv*+BX@N!3t1=xfv1&i6C}X5u{gaKbk#sIxv=a-oyUEFw_%hS%Np_B!I+PU
z=FVe?nQ`66l?FUaO|RO1pSRHj?oNmQP!cln>l9u!9FYSZGHAO*_i@5A&v<4bIAIOl
z8|6)3A<#x*=^Db#`fqY*+ipI*41YmB)Ra?8xUu$a>(01HRWYqXn4wQ>#d21rLzMU`
z@Y#J@gtrP~^9|-!Tg_NCknT!ro=yR!p_Otwi2le6^_+30z^Hw;PhjLSoACBtUwp`;
zG0&8dd0D`p)A}(R$6@@(RJV!v$P<Jibya-?U&48bYf3tN*-i;>xv!dF7=K}txQ^s?
zkjGz%xO&7p-)N|7dx`ZhTBPfZEmePh>hhz?3HS6WNDhP@kKPMJ!AD3d?^2uB)jv_1
zvGI*=rv=kEhJA5SjL|tQN)82Ir6i+H^8F$U1MV#YTxtm;2jK|&0r^#bp%b!35_Qh}
zqkbYZ^~PD%4=kfiI=ej*PeFqUS1_@UeHcSi4ChA6<`*2aQIUF*Z_K}%?Cg~){dzf;
zTlAXE_-%iwUme!87!_D;+mEFtA>g$W1~46SgA;In+V(9@p>Nznx9N%eV)HTa%j+Wc
z1NVNA++)KjW?i@T-Gly@bUN$x7PLSB(CcD~-%&P;+r@n5pVDOJN@Buq`!yqAl3Y=@
z4jD??kC-tRlPDAeb<Y=*Q)^$l7z}$Gl8JaM$QGEL4{2G;(};;8rY@#KmdTHG<!($N
zsnV_vad=dr@E$zMf523RN+>Y~q=#Fx|JJZb9K4eL%RaOV{Wmk{V2@1!+I03CHv;24
zb?KpcCTbC;uA}qVO6>yp2z3*f@(3vT$qUa5=^*rANreOfz+_}5uu?QbC;2(+w@v}=
zdjB2!XH(!OXRG@nv=otquyi=9zz3@Dhm;EOQ*}s}QKgHLY@_JgMf#8M>N=L*m7Qla
zQ|YDikuD813?f9CY%o@(Uj^l7eil51PJO>JV_N2$@}RTWPxhenAg)l`WZVysvVrG8
zKb2|LwHs_%O<lpV`Kgi7<KZxCcl9f%-fqBX_t5J(;x1_#i+yP;OPqksWZC4fnOHb?
zH~~jS;Pdcii?224ZsxNY(0ih?d0kB8#rFtWt7Bj0qFC>3h2!1f?fz!+(3FqESi!U5
zdI0~6)9>8r(FM(f(D#RCtLm=p0W4K@p9p$(sV>5U`RWakCqxX&_G@IVqFZg>H)H{x
z?Sen!YvUZA=T&WItPBeO@fcCu8bQUwSDC_2w$o3wg)tPXv!rRjEBbY2`gK9!Sc9co
z;}`dw0ma08NeZF><^P>Ks{QdtCdStI^|v*=l^gNfJXN&$hmjMbjwt=`nb!M2ZpM2v
z<kF};KT#T2yLiVtEOLv4T;OX|wuzhf!yk@AiyFVRBKbS)>e}49{v=jtcD%mM0mc5%
z9OEccJL`n@80*SYnqlBFK96P02)oOB+B!1a60WiK)TbU(gvW~d^Cm4KhrXv^>=WPP
zcH*{U=N#}!&iiH`){mp-x?CE=dsE`Y{PKJ##j?h9KEYG8E-Av(ewuYGXZL#8HNp4z
z>MwF4;dC(eXR9ZIvHdC@p2){s`zwdTPT%|E=a}fX4HSXf&5*k%j*jd5u9x%W3n=SU
zZE)K$7(;Z);P!ewxY>Ho1I%U$4E6DPoqWIiAbeixhL6na`zJz4q~N+8VA1y_{A{+J
z7B@LzLOv4ZVJf}%^jo|SxyFg^D2*E!y6TWa*t3O!Pmr+|8Y)7J?p!#iWNIDHLHInz
zzbJe(_4!+dGixZaVW26Dzxw8I>Nr$=5&91aROk?gQXzbKt9&v!#L%D2|KRnVX{qXV
z((hlQj-Q*(0iTCxdnmsqK9rICOvsZn*Xu__^R|TH86h`i05$NVol(SaqTLmwQK3HT
zu;E`*KzW6AaMU9`NM3UbRkM7uFaMFiis;&B+m9{BjaUggJH)0?%5Jy`YfP9=7gZEc
z*zPNcz;^r-|K8?uey4*oUo6Uv3{v)pucnqT)asY3wWF&DUkTgp&uNxiyrBD)8b(bn
zBdZtuZP8FvTlcH(f84|~eSghS7$AGdr}M?O&FgXLa?;44b@u$1^y-T@QOovk{KI|W
z>rnwl@QD&a^!|7=n$h+356tUutV#l-HbtJ*JLplDZ7Kid!dD-&??3A{gR+pDVNrnD
zwwv*1FC1rtiP7uOKd}DSypu*(L4x+hukP;d*_g#6S4~ynGo*UzaeTSr^bTzE_GQUD
z(~LJv0=sKjha~ZI$vG#kNd^r$;&7S$^&2z6lVb_QG?m=N6@Z45_AV6XZgq0T$qBt5
zI#aGyl!=bXif;&dLYZ}OGivYHGMbk*8o}L(C0ktH?V@UNDdH8&K6SI`Vf1Kf;gkr`
zx^oiFSG*!+JDs{&dW>wcll?A919=;nfV;H8i|<jliZzU}CnW2*k%QcCboPv0Y{H#R
z+rtUX0-z%%J>&<ytp=V;uZLxg<3o6YnvW6MYVwcQca#`C;}PbIF7Jm`U-IB{X%<u7
z`o)cxiCxRsP}9lmsE=2a*R*g#nbhwF!xSlJ*HZM2%G`l3@$>&W&vakR$ug``;_+BI
zxe@q5+Ap!aFsS>n)C5G+G4FgqBUV`Ap|SGe30q-22aoBnP>g`<?i+IVueW<QhVdgo
z?qKU&cS=DofNEh*szI3m8A2+(S;13)1aT)9@D{s*+dvb0!z>n&kd7<}b)a&ey~w-j
z3B|@uaVujAWBuJ+T(y@|aRCEQ9?JtQpUEGLk?e3?I1`%=r1O<O8J~wX_4)`Q*$YEt
z(LzB>YUGC|L~%m3_lwBmQGZ1%Jv?k*xzEiV)SR4C;gp*->7x-cT)Dv7BI!_JZAWTw
zi(peKmlVhi`x(|(WK8Xte6k?-b<T3)w%c-{+`U7_kS!`ly$cs5@xJWdWii|^oFG55
zMa)e6TDlav!_2fjv4y!|E=TrGE#QrS1a$mNuTa0`HG1^j;u=eJX&0yK>x$Y?B%23#
zIX+r0TJLUE)O7aqHi0kGZvv?{%$Z%z2O3>}u7Mxvn~GDJTuw76`!UF-Uo=AxCI~>d
zBL6_yC@P1nzoLkHz9J&A99I<INB(dcll(me+l~+|o_^Rz+d8Vcg(N&Tgp-Z?z2R~h
z4|m%3dBjU^SZs`ZDw>&!)V}2%&P{JYBCRlEEf18g_1C1jiM6G!27vl5v4!}NK22Fh
z-H@H~lp3ESL9L<Q<X4MA;!a6p8bcqF_8OT`%-0bMoFVS9Y#CEj7#!g5<6nQ<3v;i4
z!`+`cnO;_#CX6o=JI5kN`Td%z-LY41qqHh@S4&+ty+<mVPj>pOXyK=ZFBi=K$A<4w
z)WSCRv12h2G1pKh;1^PmtxxwQIf?<O8LQlFm<4y@YgYQz3RViOTG<M}%HCOLud*nc
zQ8vM&CHqCay!&fM!&VgLDaU#v!g;6}=`(?(E6Os83o!0J&l~Z4w7vRseUmB>zD@kJ
ziwda+e01thCdlb}M6n$-6O)OVWjeS%+|H}%ogdlxyj59n_}=2{;VW&1xGyXpj@hC8
z(=%Cg17wh)%%J;96L>Bk^Rtmz#9-!S!!d+x_n%XXi}KG&KF2q}2ox<5w<{ExhY8B&
zY~@iZxw9+k{5Vt@>-7UL=c_WtqQUVLHOd!le5v8BsH-9DMRVvG8v@CSY2mWl3+Fc7
zng7@eyoRYTrPex)A6_(}dqCYWFASmSpGV|G2L%qo!IEGai*1S)ln|)p!%2trFN9-=
ziDKIeg?5T5W86~~)u<~4V8mCAiuzXwm6=@G#{rpdiox$9mPsb+XS$c)-4XHY#DN$i
z9rB+HFe3tH5oG9K7ao%xr;U54?inLP2crGwR+Xw<IY}Z<$|nMh=~ElYtcX4GYb_F*
zOIP{gojRH}gj`e!vfx@;`ZjS`o6vfSJ}3x|uy`(7UJwCvJ=L&ZfEVqrH*x7@Ebc0=
zXNQ0dJzG;P>ybog{+nE__xl*4kE<4Bjy3&6lT(rAb=Q|y?A(8%4{SH2SiJ9Y>;m>~
z`Xj<gdCSJw%it<vH$_5l@BQ6Njiz!RQ{_7w$(E4o-kE@smPe+%rwb_(Wbu8bx1uI%
zFbtrNdr(bKQ7vN*j|Qd`o0WQkn4PeLL?8Ob)%gJCw7zNI@x#^<x{+$M$StM)@+Wi0
zl?Qo_io*$FIEE&pV|GsV*sVS=$?*3UN+Kw*8xgh;M(gxt%v!0`Mj4^fcaEVz1$d2#
z<GmAVh!nwAsIa?XldL|pEw#0+80h~9ccr2eTmWhbe~N*UEg|iB*LM&yl4;=7R8{Dd
z#_ZK}OeT%)G=FPR4CBO+8Bk=foReX5TDYk_JC~=X*oYupHSBif8Oe{75zd)o!M~Rd
z#IEz6mXc)838>8Vk?_SGx{NN$t@-gv(37k9mBY4N_>23hK}ghGkW;qr`>zl}Q1PX&
z@ALi2dutZp`<TRZ{p18_>K&f{QG1mrD3#ZJy5n)>ZPNF(7q^Ssq%$R$CELB|L-aod
ze`(U)oA4N1z!f_gYa`NOcT{#T^q1JJpwxT_B4V{q;aK`9%B4mlH<`<vnX$~Axymtn
z%-?6YA?sL`vVL~tx^rDQZhf)q-d>H-$oy`u6C~L<%q&wBoJO^1l$gf>V;$I@j^WN;
z>>+fA+9ByAK2B!iQifHbNmPVGc%v{pM@`-iCe^h!_xlu4Sd$<5W3Lo3|4RCUAXe~R
z1?7;?J%>d!St8!2mE?i(zQTRA>-G0$Q<@WbNA?@JwGbP&9eC|Hs9e{IN?CdEj+n;0
zG=Vr^zq{B=RR44xoxpNqpXL|)p2)%>QKE;H>+mVXrv+O)wyy-J=ofSYnd_k;;0#IZ
zM5fci<817{XtzB7ViKF|;f#<@;kYFZw--u6D_1O)nEEz1N9S1_M?p@P%0~7j_rtjK
z^J8(s=lKwR=fT1h+qy+v+O887g3H#&bgOKiy|}n|$m1K@_m&TFf#f$=+yc}d*VWFq
zGFk@yEixiJWTyW~B-`^-Ik%2|zH>nW2!eO@hpR9N!k@*l!S*{SWqBr!{$Id`Xc}kf
z{)*5Bi0yV%OCd|auXpx(Wl*K~My5tiY!MjfHzF2MNjpKNd)6(I?irdHAZ;4>5DdIA
zc_|9q<t2-I%YrXMT1v+yWs~<9lnY?d!zC9?n#ZpDMA9+_=jf#5WS+?j;ygThcIqTC
z%bq3rgQC#g@X{w)VF^o;+JNT}ydo?>!y$s=c1sD9)phL;5Z9-qdt;;tDN&#3FIPWK
zEe5`rn?7^epQBweXA_s7&d5<&6}U=uFZ;)E^5srFvb*TGYETwUTN?5>5Zt?dq5K7B
ztRQbB_@L-zrGt6A>Ca)FyQ0jC;rXdwKqDl~+nwCVii;1;h1e8f_2-RLKom%b0YN<W
z{W4igcG;>LK;&`MNc6fjQ(nEXpZv$^aKm}Sy;;Y3`bhGAbk?`yzUi{{?1uJmB5T!W
z|LJ<S>p800TfgfuCi{O*AB#C^YJOJl*vHS?Aw#Rv`?yQOODl3EM!or`<m3a$SKhK?
zLB`IPs>>V_N?=MEYK&x6_$#r|X;ylMkB}0uZ@TL`)ifkjlM@D7yaEF~GnS6sTnv?J
zzBv_p5YCo19jTmPdmX<r5x=sn|2ShUwcSkXh~$oTm{ba^e`*P-F%rn_M>OgWz)oac
zx+|{LnIqXb`n+52A(qBkCj$5;PH8z~t3}&YMSAV@V7yy9A<&HyMr(P^4KWu#-t+wV
z620I>cn3OvS#D`j*Dnb-^LtpLHk~<UXx^~0_C~_2cg)#xf^=HF=|WKu*`=~=$1#G{
zqi6KPm%p~V%~<NlZp=~VU{{yWEJNE_%F8*2`^lWl<EkCnQ@soQ-P%~1ufTO5e07&k
zgUQS4X4U!w!R3a2zD(Cg@9y>FzRB@b?-vcnJrC;tc`06VQcpiOhQzjHhq?ctWk)F9
zMc`*E_(Po|40co8apszyr(KYJ8;-^Xkax>beN>WL2pEhVBDg0s(#j&R)kkL{bCiAY
z>5@IA+CnQtloyTV>jw-b)IEurTgtLw)i%*H;<A)yLjdM9hvsXw6=L~+o>#@}mwlzJ
z;(rU`HKahzQEgV~D1E*@=lQ#kvvEbBZEaPdR=Mup`fUeO{X-qCMkSmxH+ec3A>IjT
z$3sPR`#Z(ety>S&eCW0Am0XKItlb*T-`TnRGs3)ZSrB4>w7El*3x8g&;!Ns%GomAB
z?wpbFZgf5(8jBHI7+zRn39U2#zxc=L01CN-^+}CcPt$~@xt!qEU&~n|p45_T*%dk*
zj!bs8&DX9RRcjH^ny5{Rv)V3e4u@Vh3FUU3&u~2FtUf(K3><uKLu6`1zONXMn*u8{
zh%#-rRdPNjz6(0O35>q`Lm`A7EzZkewaL2Eqs~E^@_&We!ntIcTX5nJb?oS8u<}PV
z-k4=kc<IMGi3Xk!LZq6+h2jx_oPids#28bso=ChT3al#Ql`T;*4@U+^+c5KXE-rFP
zhe4G3)w?e=?O#{wgn$!$?!Pk0E+xRbDXO*x+TR@{;^R$@?w5JQVC3N-Y6?XkwkPCl
zOpVRoV+_!-EXq-pS)vm<8djV{2@Hk#T_H2Vo{H7-Eb3b-**!|zSf5zVW)-SJI`@kJ
z!|0-^aRl8o{qeS_h)eV55Vp1_5+LI+^!8T<Jjg!CR^^ubLJ{L5J%iVb=ylHkbLsN*
zRLRU}cmzcDLPl)53gJn)^V)MqX|Qz7k_(|5Rl#l(<?iPbMg%ALQ$?KVgbIIsD!nln
zZN8a)&CwlSNw<?Y%bp9;zFr8Zk(iv!e9n;bxmih&+c2)~P~EhykN)+xY1906Zzhm&
zzn73tqm@kPeK*bMy?=UI(RKYnc-^1I0vy+^-%rk%G%EdHc}7U+hNB>Y`XR^wN$4cv
zb~$bGRdJrx=jS&zyM#66>0I)zFlN?*8;Hw|GDT&7M{xQqV*Ai<yG=o?Z6~(v`@3~z
zYRDVSu>)lGA+uW;z#YuJVlNika9fJDGBw=%S8xC}(@6^}JGeh#Dyn0QE<MR*0FzF*
zatPm<l>7hq2;F28Yw!;t^D4u3Ur!JXDgV5P{Ck&3^QE`RHA~ZwM?~kdEP_d<zrK1U
z1A3OvS{l?!%p&X)U;t|0Ug&gtXZWat5CC&VRh1|CCUYL^5lz^!=OAQv&AL&Koe0HJ
z`7vD_s7a6EfLlKN9;=aZgZgQUd*>Wxqw3xm^d)!|dO7{5keiS6uQ~<y3pZo`h|(JB
zVl)qW=DpuKb#0q)yNX5@aWxLfzgOAJ_snRL_hHFO;Hf*hIt+bU$M<!&VfrH<6W{h}
z1Wbu6f1^O>0}c7UzowLj9sN1X<~hONYz2!?d>wjXW<3`*t;YWk{Y4YSAb9P+oE=@n
zPXbNZUwe&<rC@u9p+uY^b2l-u`&Ifdbr8|!fvnv-VWi7U^iSN_5f5T%Bv`*tlc=ng
zx+rvj<CtF=Dop|5f@zwj_)B3#%JwIBUi5gXYM|jtd#N?3xQt^6g-Y2<lchB*V@>^p
zqya(EROM<TM>skBEhrIx9>l8|L?5j_Zg@`{im}p@sye=V;yxWefRk3SE*@1CN6U9J
zACMit_qqnMpD@~1mbfOpYn_`lhU`PnYpw|~=IeHey7}DB5P8JvI0}9%STHM0Z3esN
zu-O=}=K`X3f@*B`d3mj5G^qV$G*C#)G~D&4kWf#gxm3c+ZP!*h9&b7eTmemO9*()q
zHP}I19#^2#$(J!RYz@m&aJjDDwaRlcn|xp7I(&UO$Pm|JCj}k76M0;2cuEK^88LM2
z#H?C32WsDz>j9rPfzN%k3y;2pM#qK8>G0_P%XCwq^lp>Bg5e(pj1G!WZO?ipNEc4i
zA;(kf6@F>RZ~u_wjk&Rv=C)Z8i!B@Fg-I*fzIWCuJTZ}^aZlJDy^$asK2FZ#3%uq#
zb)1oX9ngsxgg;8<sK14Af0TP_zi)G!J34C5`G9;Sp_N-Udix`6iBm)75JfYuj3HcG
z(X4H3l1~Ycv@NVbnyv|J9P1FZljfD-E%V0ud$`x#Y`~*YW6ee*Zjv#-hF1yuC;7ru
z@H5>z@9w<!{#o1ZpEvgMNoPHqjD%kWu0-<HRn?Imt<SHwzW2E(^dI4B)(xjs1m)dk
zKp#-Gz{hiYDO}qumYQyoPfK6C)R?CvHs;BTN#(zi%4$kw_^A&;nD_a@Ti?y;4w&gX
z$YRI&g5rnp{H0{;`8Vt6q8Dv;+^sO(WRjl%4~oag#%L@!nlRIaX^4a(eh_Xuk<T2P
zitAf{yS5<lL9Ns9bvUtxwfsDq#7yr1DNDSEmFz;o;FY1y53bKUkSGwd@uC8(i*i$h
z1JwxfX!|O;W95LYyE76Q(*hVkQ2Vl{&|XGR$S(xs6ZAKK2mlPBm*lxDF+UpV_kn0M
zi#VF0eA+W92Lf#=KU)nubZ?~7M4l<_OI$-4$}XI5VQOe#y7f_$aojy0TX>*tiIQv5
zz>dii_BebFWNuQMqouZH#%U^ff??F?rEFUH+bVIW2f^@@qTZ()?BfUNQ2s0X$lf{6
zWmj(ROY44*(iJsVKrI+^9<Q1&aE;+fnyVd1a1gK4)%he;XgZN81;$A87=0W9!7ZLq
z1U>i0{hlz2j??S49G~_pO$u7^8Ik*-9yuSV>*J;Cu1=Iv1`jJu7xhkBwl<p5nTPB@
z>zM*2wRi)n|K=kESzO0dWYvTu&!Bc!tTdyABJmI2A(v<a+1@lFNnI-%ZocV|&xmyt
zxNOy=%<T)Y*@GuN&Ic{6NKeFEL^tsmPH@&w1-d&GDP95wnqf@UWXE6cql}E6jbSa>
zf0dW<tEI%dL76T=uG8-`iKmR<(pV0e6WFQsEFs)(p{!(Kz4_l{X>LhX#WbLuKgrTt
zwGlsaD^KVv=bKHHA(6yUwFV5uqvaK$k|7@C2cx*PEhH~^DluXK_k6!rD~)(6KwtrA
zh2(}b(#i?c)$SNH(17q7<?bJ@s#ey028k{WIT2`Kp})N_hxTjCK=<+W))Pi9mnw`Z
zFNXV{o0_ab2<TMfF{duFJU;CQiLxryuS(Qs`+(Zzd_mI|v$`+-D0C~&9V5P*UbkHn
zTxJ(%%lR}J`5&)`0>>d3IJ!&TH)AX;PLKTTG|U~uN2SHtvI5@(Hom3P@wlY9Q^@|q
ziyF~i84f?kY-xA>ifZeN@;E`^5($wNl8NOMfDS^n{61qXR<8~QntRS~$pcY~F7^7M
z27jsJMuxJmoVPQt|4d^V-}1%|l@Ps3ijS7zrjeD9k3pNmk|myN#tkIcZptj3qbE0_
zERnzhr^($|Yn`Ttu%<EfBeLXUAm8XDPZ86D+wBE8@Q8!(N<keO6<SPwOX^0t_a#f7
zd72aC{K$q!x^6_a0O`o3(C-LbPh7cb#T%bGk@$yI$~}nXTOCSVB&<HK(W1){H?)<A
zTV|iNC0gvAgr`n!2f42vTLe%A)0>~C#ze<zCNPRyaihrn5_Q}dg$&U>;Y|jUV3iOq
z=jOkP{hjCV_?NTjOgWR$dZs?WiwYq0x|)0JxJ)~q<v7<yW|wgS-|9Bp4$^K5@L0>9
zCiBw*>~9i>FA_>ejen+y6M8pX_6|hhkLogoJ3sP077$f6t$@D<CY;R)C6)eZ<0~<9
zV7AwyB{pE=cLKW6`agp;P0UCT9Tuwo8kCf3BTlyG<<(R%{YX!&d<90|-FZ710d4_@
zg=L?U2OqC%#AM38kg}vV8|QjVkI6Z9w>-g=hK@=-{cShR44r{U?*<P@=ovA}Q?8<f
zIZgPA$m?&{4`LDZp+j-0XvM#!Btmu_+YJ)g65YaT1vi0Ix`M7_&%)o(0DG1&la#C(
zDIQ{D=+ju0zE62#QAq5H-gz6=eF|K4d7`|s=A=C&dw$?x^$e&%;?+J{Lpx_eiJjkP
z7Idxaa>~cUx+I=ZnnabKy$h&sh^+V6DTU^{mTC1n(7hEyoH|CN>ageLuUBeS$x9MO
z!J8sqGr7XV^E&v2<Z`l-P|7uE*8ixZCWDJ_tE!MY?j-AVXym+>ab}L_IJ>->-=w;u
zXw&<Vd)1o7AUC*mjrrxzVHMBYUE9Z9@pLl1RLp^VCz~Ef@o{+WTk?GgJ!QR)6Qd^T
z*>=ds+g2dT9~2JHb*slUqeVh61!;YIz|molJ^G*A3Aau|XJpjQW9wR7yH42g@Xd=s
zcKIY!|K~OZkHb<<FCz7}j;gUd8aS?IsidYa4f{$n3u%(=_l@Q<yZj?*j7pR!AP=<(
zh)QF#2hEuDty%~=y_*-!Y%gvQ9!8PSQCmHV@^^gQgPQ{1%|(>z6-=dR7+;VzL-evc
zD*uxvUPX)-G_54<12`H6oCEch?G|n>_<p%W=6O$uMyruvDVTt?<h@(WkIw&#PM>6O
z+JnkY+4_k(bRCkm&dGL^2ecq-Sjq{_6m%mtl$=q<5us36b1K#_UnoXiQf_On%eF_i
zrKb2k8Ed})zLB7g(L%sNIx;+A)pT_V&T(a_f(4z{o$+Bu>r0#mU8mKFrA1BKdR)c2
z0lbsl^TVs43;JUfj;EkoZ?&)Yf<HX}OCJW<3i8~C;rn(h_u({1kPlGd(YY@cn3UBY
z2J2cIW<58eKGr}sS|%4ACzDT;gG9c(9j2$1o7`R`IP$GGF==)?&%-fYAH}pE_WLF{
zS&lP^V7e^rQSrZU0e@?f9s3?Qhn`e<@)UgQ?+JWI65NJ93p~vam&|d8T&rZ%R6&C*
zj*7}bbrMiq8~Z9x8(GR|Jx1pvfAD}6R<49<B0=|&3s~~ctbPit;7*sHL4D6*9!D87
z)O2q^`LUA{MlN>L$!I9u-%5F+j87<@6HhQ$`oepKvb2OGLPixGV=lE@YhyPEM&i@W
ziPQ-SoD1a31M?G{b=gC>D^3Iz0yz%FZ%AXrAXFVm>?)>y$P-l>TJ+tZ_Cp>Noa*2C
ze$oOYwZ7r-@z;O*W`|$}h=<2+!z<MG=q418Tc-l_*-Ac`G?|3*VQ;4w3$UHzuwL<^
z*!sa5{zPv1{G8hC&5Lb~%l<74Em~&jt&Sa*NDM^-j))if)4m5N)*Pm(NvK6(1kbfA
z^NUO_-=~#DTi)GB{|k@T_m^scH?V`<bOmgU656CC^m*FE(RCi?X<8ldey_~$>O7k>
znczQcZ(Pv6{RI420~0-a3~peeLEwFO@+tuy{YPYI)4J&?hOf^nERHTOn6sQ$({ce%
zLjr#6sKIIX2mAyRy?yJh>s)VMyHOlxOaS1`Xvf3a_#5VC%YVnV`%lVpGTd=@_5uZd
z#K<&3u$5;<^2muw&FW7anA4dVgA*VAq=S;%i>NdvFIK@jTSYzqhj<bN&Y5XHFT(Yz
zG1C0>ocE(nOi2m0@-N%&-ajZj^+Z=X!U&oJ(^5)AsHVVnEOfpivg*RdG5@qiDBG=J
zh6C)*)j=#`mjEFO5Bdm2G}H_RuoY%Y(!&<hIF_<RTB7evi=@rbb1BQzd2zAjtkJMy
zM>b2{VZDq%;M`<e@Q--lU3}l-YWI{kQVYud{zJgv`>D${e!j}xhOJ;AMjk=8c_~Vf
z!fw7Wje*_rjK{cfX;Oc}{6b=5iyPyG%S1v4O3=Ww-y?i}8V<D(=k4|2B=>)^7BFh^
zehJ9tOrO_R<37+DERvs}D^-dC>$Tc0T8{HRO{|}}RLfj)zZU~|U$45Z6Pzab1hmG^
z+GnE$-nShFeGZT0d{1_XKwJD|fG73h(dwsN4Ktt;=y+0=^ZJIiN?O2|`_YE=zqVD5
ziWCr!1nZQ{$fXC4gVR;YP_?e<R;C#oeEmHXo!N%E$7IZm-;ZplE0Ow=%oF`tGa!Eu
zan`n+_!(CXArV_97aTtn&4+d6>734J$kxxhHx=t(>K2cZR~grw&qD78Wrg1^bo=fD
z4)0g#y{mN&6fbOKdh!ED_5Q;35S>zCk_}bigOo+E`&x&?mH9pT&jnp}nhniD--()~
zQ4KYZ_^g}n^!Ery?vDOKP!$VQ$1t8Ki!IjIPh00<A*=Nn+Bj(*lsr}&r~36*x_v+8
z?1i*bIyWU49>R!c5{_K2Gosey>xi)rzB-_rSQwjBN_qr`MfcU=!M3O1@j(#T+l{#~
zKd*2ecC_qXZ%9en8T27e6G4FjudiS`h(EtEN*>j=U2ucXl8cUm^owTjn4QPuPYf-`
z?YHT1A4)F58a+VpO_VH#+cZb({r%C`>ml~Tg=oWlQOE4#V2uRf3aSXqhJL^cfQHA?
zCU-(u%=ll%^SiwN3KC6j+}uUt-U`+IV?Re?vpJkp#o@BPduf*2^UXq(<sZI<B7p1r
z9`v4Zu#eD=BIz+n->k#THw3qdPvFZS%yPYIZe|Jx19ZOn2dkz+;~j>fty&+Vk*m3z
zWWhDE?wKt!CyCm9k2qA5pze5>S3Yg%LUD;1Q^rAGI??LMoLXgi567O{uBcBC2=@i?
zI%=(t7EdQ>0pjT*Q~4$8@<%=IU#{?G^)|8*ax4U8wkr049R!{!iTeuMtV=);Mo?<^
zqclmaaO|>hWXsX_Y~cOXk^j+fJNDJg9R4^WR0RUxh#T6%SdHD1OWZQXo&;n?rsk|V
z@*)DZ^;AFrxz(L0*vXDJolaS&uSH&ouYt^<m}&CKvvk2IAg;-iZDqyacTqEH0J=Bv
z;rtQG*0u~ZkJc=meRbrQl#4&0lUx3`<3qUNEuiniGQQ7!`SIfhkB1_%f9KPFHGR`k
zV$9h`cQCgX+JxN%*ChrJ1Z=pC4duU2o2+Ubp#e(;2l9z`p(H2y9@hZ;;M*<FS*VQO
z?Fn^+3<;@adilHay-^I-hvA?wipfU%e|8IZQ46FoHWkK?zzT|erzhd#D4CH+#~GBv
z*)#<YBi;+9*v|xoC$80TQ^o<N%EKYlTCduUBc1I^OgIFJ!pVgb8C+ewr}Vf!<ZOC(
zv2io*83!zjs3z^olLW6ij@dgldy&crN$l=-?`LH%;B<~&oy&2z9K{`-69tM%$?S}j
zGGG+wNpU#f?Vj?G0Md{ILxa-wCPS^lba$WNSB5JJ(ZKte^Na<NF7f-9Ttf9dA6A5a
zI91z8%PySIb9Ng48&PpKw-e~DJ9{omGkMC+<>T#x|JR5`u`ej$<G!icrt!%zq7aAo
z{%%%H=l+n0=%fChmee913?n{)`%aH)zF(_Wlk0k2`v(_xvb@)Q7>6GhJ^YUCs1^f}
zW(*x?;di&9l=SgFZnNXfk)0y{ii|Sp#5+E$?H!%K7FrkIBzyjj(3PrjZV0M)e=#1R
zH^ATvfE*Ibuh~wlalbloG;MFLy_Sp^F!VU}n~puy2->cVjatauz6UiHz{4InKpay7
ztN%}k;*tI($AyVL8hI_51uGIQAC-kQM}8Lz`8ZV8jBsXeKoP}2N+36f%8&SYg7(|+
z9R|p`W4bk<1tjF$PfAm<g$bB*ob;F9kjRr$P6%VWx!&Iysz{95T?jaZjYP15cra)q
zy;C_%3&2RXoLUh_M$z5l1)O3%`w0E4$Xrn{(x5MiJB{^<{7K}kFB8VelqI5yCqt>*
z?wyOL{DMczGbv|t&bxLIHE=Nj9Db@#u8JbCvCGx5om(v!mYQ8Eg!|ZRK?w^znqpH+
zV<ypCU}$?-@dUbR#sI<QWE?_=KKiZ~ozdPV-lr|e2*zk2uj``DBG6$VQ==X(r5%Hh
z&+{Rrc->53_h|kDmq7}HQrc}6U$5(=tXw*)bxcu;;h)Ty7j)!%(ec<x`{6cUKlz3D
zH6HvtUCoZ!B2H37M8@eb>({2&Xyvki%ynL2e)Q{zApBVjP#VbZ-LJBcu6Og#1C7p<
zH!}*emC0|49x4l7!~J@*SMSMOrOtin)_pIJocb#RVA1W1W+mW}cXBH=X)k!}-wemb
z9n0OYP%EPY3WXFa>-TgH7SDhixbYgV4GeU`>5MU6cfQAY-z_AP^4qFZ1F@ziT7tYC
zIijBr<I7Oa*~Aig9P`C7joIYtZP-_tHyV;<+nK5?U<%`hPN|!wh3GS1UuF6FPXCc@
z*iJm`EyyCOr87>Y&RP{fk7jT>@lLp5Vn^rZ!?ZIuhz%1|lVm!P##6XSYRdoqWXJ!0
z9b(&Jkdt-^t|P0Aoo+|*E;)e1Na;#8&xf-J#y`$ax4iF9yEr<pA={I;LWLCAdS1l@
zzwC*0-S=Ogof7}O*W~2$#3nU@d(@LoOlF??64NA5+7iXme~WX9r^%C4gy$duL2{hc
zP=uZcVcNe%x+yIDP!+KOkuC~|fJBTtF=qAySYL>OU`#=pI}CP6%DSbTqSg2evFza+
z%iGv~L}X<_$DB1c!l}=bgRfuRRBVNjglj^mkVO8{k{Y{J!hF7L4}f3;r$q5o-@N}=
z2@dum(_j{CLY5-=kv12NrbHS-XQ7~Poqm*=`GpOgZA7}_+C6AMVRmT=vRxuCkQFRS
zY}lw8Fp!hwTktH}@Ye-Y<<pYheXDPs6GpoHq8@QrLG2oeR*6lw9fal-k($~_xoF1@
z0*R<D)FnnFK7@v5%lTnr^JQidiU_ExsS6*x`QKA^#_9k51WFm1@_s|D`DoiuR(e>m
z%CWQucb*@w<91?gU_Vs|y#FQ5xSr<WzSYP3>t;nw&&|ax5X|x4ie~>i3>Cwx-}{7M
z9C=79uR}Q_kpGTeH>+|&S`zNLkaKu{+s-6(3s_4W+M~+kzn1VrCq}_VnJm)ar`%9C
z5MoGbw~?TH+$kelsMS6l8RkPnG?hs0cFG<!|M5zGqnUHhEE*R=%OGlM3^}sOr0URT
z=)Y}XeRedqD?`zUjQ4l3utNS6YYP#QQjA}9qWda6OtB}BQ>>xH{Xj=Y9FZ|e7)~Yd
zgvm0At&j>sQpNN{x28^AWI|in(ufeX=XaDyT2!@eq1mp)tDY+007)MAXOcu`JZ5!r
z<5kCiQCNl9$xVZ_TD4S%)C0!4utW#NbvX9vVMW^9v%P7-d}1S|i1~K~>V<~s;-pHi
z*hV^9p@j(5WNr-70G0iT_@CK&b#0H9^H^>!6GSzB;~+5%^NJ6Go*!F&%P7Tsw`Y`6
z#w&+Aa*S<fufku_-p=X^KPh_H9*mvJ3A}~9ToOsokW4q2W$KgsQhDh8nJ;R$eljlZ
zdwVL!`wrv7Y0wj-*6H|my*t<z@o{(9rR_FNaVy{YUx%Wg==Jxx1M=Rh4q&$AU~PR7
zu>?-qXU$(wmiYo7%P|-vcZ>Byz<#WY57uluo#NBxp4d=>gyrXWq~w`&n42bY;Aph5
z2Lj^Bxv?_q011m`om3XwfhzyFl8(%hDb3e;h)!-SOesrE7VIK%<pRGiamQsy{YeGx
zUB-Wldf+#&hT?k>OQ)@QYATs{)RdzJ!KB52BwI`^^*(H3sv__R0bIdD$vj%#f^6wq
zNoTN1&B}If6qTxb^U@~i^mPhOf3}nEB9`_WoKHjtxhiMY2wIuu&1=kxlI{lKjvkzy
z8V-uf)D40{udG58%9XBdpvL4yTvJJ&0((EZ+c~F_xD9<}M0lBPz-8H|nx4M%yx=-a
z0Dd!XDkgH@BPz~fKOF{$OSH0ErXNI`9ee;;EB2^@uId^W&K&p2Vt89O;RU!?{;Q~p
z9O0$ne~N?Y<RX=cfgR0L`9iTNZv3<PhVI#bSt8K@2xmgUGKSj%0=AaC<cp&2mt}HB
z%-0}+f01D9s=D%++cpI1to3_wJ-_OFXn|>ir(Gqt*l#R5OrPI=-NK)CJU`#-T9MUI
zFWPCUu`+Q=dC*$uPEb2K%uy)*OrLaj88Fh~m7ky#vYkBMQ3$hsW{YlOdl91$u|+p=
z%$w^TNo#zWWKodcaQ~f?Fmrz$RE0=FM_e7*T923m04r6WkIm{h#tE-R^$Gu+H(B|B
zX5E#L(Wl4d1a9}NKL+<DlQkT=Yh{`@na&9=J-|IyWTk+ZA{frX;pm@r=1Mos7Wm%I
zwKK?K&AEs&)GH~FX=$ZN+YTP-_*x1GG`1eX&z#Eif*-YlGg3g?7qlmhL1unW7(@)q
zdkz1>6tfh!i{=XfgQ$!lp~xHf7lJ$Y*&G~=sCj3s)af6S0Re``(bHAYBL;4F5Dg*r
z@?p~+b>lphp{L?RgAy;@6`<dONITp_p)E0Dgt9v#-bl9p@DJx&Zb8FHIW!eD0OgrI
z|3KbPvIQ<6ipT=ltsNZ(O@{{*xD>&PwGO`Bd9D~4-UOULaK(i7l-*JA5g2wC_3^dm
zfyibKMf+_yUZlWx<S|^uAx4#yM<=gGyIPVPyOi#Zk5;0QHru|r;aBBIXnTj9X~){G
zRp+xLhaDR*l~9_@;N=WjE27p}$+GR(3i$J<YmNhtwb=svxb>|f+0Q88qV4h>d^+8M
zKhsn=<y+oC_+LI=Q`k3m#yQ?^^={Rh{_RxDe29MdD|!E+Fivg4wf$N=f9dHCUs$!9
zp;_7<VQpMfP_SV(O}nzQLYZ!%xF34#uqocY$(&c{(3PgJ2cZ+4k7qcu3)Yq3=1q7z
zF7-|9Ia77xuj(T7<@mMf{lwV!1R1RSP6ul`V8xH|1;=tc=o7`E_$)PZ{wxo)H16fA
zy^es&SRKR&cBHqU6X+^Zn@a#WLB8lx^oEsn&`LeTLaK7AWW^s&q#3p32+Wz#P}#X+
z;8Ya?pDGRayLbX9_m-8dt3+^7w6wX8jq(NB11hIla!#r?t<luT2tu}0x`8seFmy%I
zgd&37U=3RXkFB)7qwG8Boip``zqH8KvC7GIX|q$7ofov5kU%ceyBR<ti=njlI!`AV
zxH2Qj33q%l2;_a){HO&6uYG)0v*?@xyV^T1T2JY~7l(f`UxL}9@l38CQkMVF?s2W2
z*FRUnzjBGrN!p*Ur^uO%wzAWzb|ffFH!^MvnGK1#3@zAilkwsXM);V1*G%kj39A!Y
z`5dj-#+j8k;XT)f6ZYH*r_ieaZZF1#PlvdQ*^@}t=E=5J^QjxcH#@8P<i_^tfAvR<
z3`lMwj(NOK6<F#iTon7*SuiyMNz5EdKd)9=@c9Fdk8|lYZ$0%txwyV1FX7%~R=!v+
z-+sC*ihd4=MPkdPM!><v;cq_)AC=Q~(+y`c20d0B`nX*NvK+EM?0(%AVfgkRBdu6i
zHCGuU8uQ1gT{kBGgSWDicXNi!_$3&0z>w8ysL5@qO*z*A99Jn=KAHRVgwT0te7e5&
zok8T!DbKZtNNPp;i4H1O0wdBF3u!_V4Dyi8>(d?4QgPf%X7z7lTqt*&lX99J<!U@(
zynhlx>&~}sv(F3*7EV?M^r;u(IZs;h@(y&yGygQVDDGM)Up4Tb-sq~$d8K&g7|R?g
zRC+47XS>oKl2(~t`*_&95?ycf<N@hgU~^5vu<->ha^}@^y#hW6hib)Q!18&N3-2rH
z4;%#H3*X=6|C=(_s^G{>sD~E#Z`!G#NBnd=wIGN;<M}DNkgt~^+iXzo35#W$34SCW
zCisLE>zh2(wkPoL--r&Y`yt`BrdbpC_wFlJyHfL&s%Ehb+`z-(9U~pALrgSAOYs;d
zFE12SxBDngvq`zFKFAb`X9q#!i6?@xgZqRdK}Jha&$^O0{*AqWH$$4?_t{XY3MzN&
zoer_41*|01bJk@3rAfsbm>Rdq5r!@2j!LVsbBN<!>!63YKR{ErbJ-()$n+1$aEoe&
zv)ZsjtE35@NvIX!)ZF5Ov9|@CN0|(!qORuK1>8xm$87lc|2KM@1c?bid6Ly86;CBV
zKFM-Hl48Xnb=j9bbPKaMYCfA`h+?oJ_m%Y+NgnAqjZZDmUv02>oi~1$4L<(ysANe_
zqN%s65LlC9)XniD)H*Ik0tyy9c>rott7(X=ofy3i;(%H}Y<+iWiAf`h1wTw}FAA-a
zC=`ss`G@$~eT_kyo1(hI5DP+byGPyyyn&@)5q}pnd5)XCzlRfg``x43jN`D$l=)gw
zlfhWh)eNvM;IS!#<=I;T79!3^fX^D2CMk*i<z{sQ?Te+)9n0i&QO#e?=<YG%Yg@+t
zS_M@`PuKG&Q$&Ka8w{1h*;&!?qXZi`_r)S98$7jP1?TMj@=){(QjeyXwmQ?#S)55l
z=<lCkp-9N*O#?q_tY34MEl(8fvRdbO<1D|oUd0VEyiM-@5$=qA0dD`FEitio0{P+q
zo{}2u4wo#(6!qYAfh}m5o#HMqV$zE{RcMb2JT9~3sj$<~)1$}2VQ)>hoA3THYpk*+
zI1N3-epTk^WhGz$WSW&rO=v0ro>82a2LiEOQoC>rM=bxU{igqo*WuH%VAU?ESu~A1
z(-E+^Y64Gnk3qUg;Rql9Cqu2dPr>0GvLpj2U%y2bR0<w+MVRF?*Wfvbsmy6JFqU7m
zzN-6wr(%+cFjfA@{GKg*%jE#aV*Rap%8#$y^$=vQ8s&$P{m2oH5#I~9??L)3BL9gn
z@ZdD<0;i5lLm5Uq2E%echm(X9v7iMtnxq>M5lv_$610-n3r9edx+ukBF8%tWp2s8%
zGP-0j(!#R^vKEV6>a%|26L#TM#lknaaL1$kyv#@#QacBspPd?L&!p%(Pk+6P#D%Qo
zy~(tYnTvw>e}p5}d*`EUEx`hevxb=S0+vX@7av~8Y*RyI2cgh>XHl?j5;pAcR&%bm
zeq%KIcednK+JGwD6;d5F>qP#PR)cXZq2Yo#Z*B{;{@m$j_SXD6LHdZe^64^85;>h7
z2{c^WJw#UnX45;rX&41)uM?CF4(kGSf$dFL3rspH1d>u3{MQhZakKHcU>r?w@|2Z~
zu5oEFr8KU9?MM(}J_Fh8|I2R$0@-($S50|uhnyx;<cNg+|0)6p;Dki+|88Klz5eV>
z77TSgDt6<JgNUS~3!YCl<b))W`2k5})zl51M|inAaFb=<gT7hR={jyER!W4Fe)%&?
znrDl3;47EtFBR1r2;W=q2BF+JOi{e?j|3XuCFt3?M*RU|vuTVFuYwTMINpNJX@3%C
zfHSL?!^>s)eh&EDVs?-=)+rU&T5oRjbgCXO*UtJZk$hIn)v~qu@f%$Ir_lh+AnhNY
zgr2&<KlaaL#O;@0ZoA3#vTi7~f8=2j4YF7;&hFXc$})N14Yry2hfi1Mr4?I$?X0!8
z$=7LjW=GRc&7GS!98=97jb7yjVRoh6;rm6Ee2NKeQgxf5OCff*;S8!&9-|V+zCTcg
zK{aW)Pl?$%ag%D|&s)dUw19cy4HJI5X(yr%6J89<g1%X1{)5NDGo>3x*I8eIQSL6w
z<rMUeMvZS${mDn8N4e`n-)VS6Vm&Q^5*mI;LXM6432zDq(c8*iy~Q`D%NEya<=y|f
zm@-zwIai-GIN~Jcr07&dUw7uiw?G6o37vFmr<){8-v(nUtFye{0S7XcT+-vek}GFf
z*D=@gt77n4t+~iW+O0U>f|d(0$?p^rbbh{^Y!!=|+;uGqYBZ5rhJ|*%1qmlt_O4_Z
zfX1c*!jfnPl5b0~L(U2Nb$DInQ5aQX=s`q6Fct-LseD0#a4!lEBd7;T-dI$hEC27%
z`rmQ^Qg?2omOG47KWg=0f1+3_>P}u3rct6^OCS>YChb3^x*vTV`-P||T@d$+%ok|(
z9+croW)>7=v{l=!P$qc6O!J8GTYV4;<?X*=cPHlQzm>DnmDp?M#C#%oM~&Q{bHpLt
zdAL~u)sFUeu+lA<h)6Hnd#*&Pppo2>wgBDHU|e`sc&QNh9n^l6^@51O8YUt30Qvth
zb=GlFwcFcQLAr-V8X1rV>5`#41QC#y2I+=D>24|M4(aah?vU>89O~Vk=bY#F{tNSg
zz2~mA)_tw(dq^PeMPbeF#94;@CyG;1O5`ZByue?DDN5qab!d*KfkrY`W@oqel?P$}
zJ;xyJdfWcGa8geR^BLcX*%$P4p)3pd(SBE{7o|4%EG4z&hQxdGCCZ^&@9kuj6RTUs
ze}=XE7N&{%sSG|IH77g(kC^lwccKzPqzZYSpBG!too^bA>!wuTJ2;pAF*#K=bBRqR
zLcEoq8?o=nLQYTiyW!^>^<19mosg#MZ_Z|ie@`)D9QEUto~+_t+$PSrtep}d;}qDN
z?`I#WUUckiABr(yl9&?rbNcOU;{N=luyRfJ6TP{^NSu@uf7^_4w7wKicgj*|HYe7D
zVuK?HD@V#~RzM&xzdzb|0fy|FlcASSL2tM6)DT|rvw)MzI|W=SD6BXFLcx!}(Y`O8
zEpG0u)fA|_s&a=4%V>kr{@@tZS;zZ*I3wWkWyO7Bc{ZQ6ra+;5n!Q<nDTcyll}0}-
zYVluOtwhvncH%4Sbxi*NR4c0SM%vT?#1BYt*i?AmLFbpOb~W$7lfmfh3JC^2L_*gF
zz+H#wi>=6)R8kW>gVyVbg7jQ-FCg9mgA$QiY^8I0NZzDT-3S~jGp4RoKKRBq9TKkI
zvh?CK=~z1j?oGzN%T;GJFSr99@?9uM;IKn?F_Dw7Jt@+KH_Jo-<Fpkwvdk9!M|kya
zLB}DVGz#N<Xa||M?D&FoWA_~SIgh?l6&9n^j1CbE(`O%%o>KD(_Hbd0smLIaxZ$37
zs>~)8Te=TIpv55xUl$?wM$uN1Q~f$RpP%#@OLGS<&*OY!#n{bKO@2j_q3WkHA^0X=
z=SpX_=EeCAx+JT7H5I|EI0bQ`1#m9j7eBhlac1A&J0XNQL%p+>iefzV0b5*TZUOyY
zaTYyTeh<PZ<o`v0bkgR(lxa0se0#^{{3Iyg3YaPLTw~j$1I(Mb?`%)PM=UZ0M`Nw>
zL2x?ZNkGmeDRtqQO{_PdFc3C%-PV5T-=Yj_8dIFxp6XW#PBH$p9rxO=<LwbFAPrw_
z;#nsvY=|T~L$3;;CBIHCd*0XFy4l|2*Z37shiAl?+MK)VwM5N#lYoKBtR345{T_Hg
zt^pW~N*SYzJg3cB%Bg*lAbZ9fc+UFIeyT>yWvg&#1A$nMUFUpt8MdAfB2O8*EK&-O
znCIQx6${3XUd4$rLFVL*Re;D8wF6b?nl#oq?80^lqd_M%>C`2xs1tDLg_4xyyDQK&
zK7zc&5ug<`@CodBaR5WE%zdjNuax>bz{V)kBe3Zr_(QNJh2rTPk8NbY4qsQK2_{>g
zKNW;g6X=m~z_|u!*WJO1>hM9DFy#IP=IrZzZxF)3H3(rkAwq;ex80Op9UY@GjrIG@
z_NVw&-+|m+hwl-?sWC25Itt68fPkRF@cUIrqlke;W<|GbvtI_b6{}_+oh_FpYO~*=
z^8VuC+A7I>AT^2Yk7>qczn3l`4OA+~To&zpDQ$Dv)`oJP+z)lS*B1o;9Z71DMA3~~
z+mG8z%66T|Jj#+)0}2|uhu)QU%n<RG>a;QH7xFqbCFI0|5t_mon<n#qMiMPjcTpY4
zp!o(G%9$5QtB50<1=*M35d(u<W!6=$q@#%r@mE?h{fO*oV94fWI>FB={edi@v)vN_
zt@yQNN^#D_k&vFKl&d1AGH&+sVtm6PFKN?T(<`;*w~O4ECbK$YimpWiV&9(WOlL`S
zQXS{<GcJ^CD5!h|QRcn;n$96-;4H{pZ(_v%0My&)FS!DnQW*@-Y2y){dFPi?zv!Z*
zt{m*~E6XW=!OZwtgwF)v?2t#ju264ltO-;<be|_4)BjPV^E8Oc10rINSvm(TU=`P2
z1QW6a=6k<cjM4KExQ2dj0+_9Un9MQ4(9rc1#g3M78PJKgnZS_ewc13-vgqc@%LSqg
zY6Md)h4sIwdBTu`+7ywLsMn`71$1pWRuuc3xR;FJrLeVPx|}R+t1*a|2^m4Y_~4;y
z5S7B*vSPlnsC0JMG|-4Ke^CkOMT;tzNetgrN~o(Pg>||S^G4X+hhE|DP(pj9oRRYp
zj+`UCyS1kRLa$QDa5=uB$GW3(=&aokj->_-gbr%TRkO8|Qjbe$Ou}oPwivz7$-QXh
zQ=It8r)K*o)2fN`j{<a@b|?{5*nt2x-sEKLCGf^|2(5tP(bsNHF96yRH_tP8^4RK&
zgJvI=C<|j^e=_{~enq3^cv7t8S0-YdRiK^b^hh2QBJAjdeN@zWo}V4<G~8EM38}sT
z$%tX$<;0q2Yj*%<F|$=i!f-<|f7G(s-voDqT0$P?1IgY~H7KJRf7TiD25hb0QW8D1
z^5wIl?X@a!#C;t^()}j_3PbtnhJ?zaA9K#8Ez{Z>9*7g_oi}>HChEr~W6;Vp=4r3T
zmpiAo0)<3xb<iz+jJ*coL>+;%m%&l-w4_w8fL<kFffBuhyw*!^4j9X1_T~-D`7tZT
za}5e6O-`I94|M$I$}A0G^%(m063loFsvro$+%+UB-QAkeh9S#iu9*T?v&~{Hy+ik+
z^?>Rp5um4@c+H<AZ+;Jr=9jN{8Nx=VIel_I-FH5%hXCFT0L0bTP89$?c6z;k#IWD>
z_sl+EtEO$eu6=iPy`)CvuQ*j9yU8b2+)Zgr$TBR^pw}VP@HUek)Ey?qaFAy^8mhl>
zkH-0~+k{WdATa9o)dwWMq!x0A+y1eF;+nyS-*Mi511wcDvKX3Z!SxHnhm6Ltw6_<M
zE($A7#wTgR52x-((ssGoX^}jggO1X8@BuN<%|>UC(M<5gXDdvNiw-a<A&L?C%*i>L
zb!e1`9UlWT1IhK%8hXkD&4yz~FYhE2qOf#SQO8Hz5A7Jr@vK^7BTp&T=1_>KM_LbN
z5cX`PQ{sF}wbNWXDpMI!zTJ=dqt<CoZQ`3s-Zt$_q|YJ3l0b%_N^sI1e)0Cq*BxoJ
zhre$DF$Rj-5le~^`>i!5Rf8J;9bvBiL^kOQbQAUHGG4NXL;2^R1FTLRTq0@7Ur>jA
zO0m?OXd0!F^B{YT!I*V2F|tRc?;>_0fF{Nx7-XK42fps(kXeNx<B1dfPK%TQ?$#41
zqlkWnP5nxmC@;_A&<a5Y;5z5^WDpe=NJMl1Jim9qhX6uAeE5)^DGm*M^i@G8_S!JF
zxqb8v#W+*kQaPn&B7Fhw3J$C$2xNO7Bs7y?O54+N1di=nM`BkNZQu(Fgy633pWl8q
z6r6Yat<tbpM%UArfOt}YK_YdN*rk=}IUKI<5PiUuE$3|8K%zIrulT|$zXV~I2|k(i
z04!a#Pj@c>i#Xx%prrJb8V>xz{=)IynK|h{Y+1k^pSTVBWu3!NKlMk>kJ|1kp+g#}
zhs75NTPMWbQ8c3rj3ZO|XO%d_tZkb7<}IUh=NpuhtlRxA7&A<iS-WJ8YP)&|;<f_@
zFzeN!!un~iZFgb)koy{~vC%ZG>ZYKSh;R((t6AJIu7u>boDQOW_k)&}noi5nSNE=v
zo$Bla{X9o>O1noYT`43=mDOjyFYHv$=pPgQ6WFVoO$A-(@%TjSbTw}dUnF_FD(!u`
zcHdv*^<05=d~S`pmk<k9$$9i;Gg_yKED{p>X?<6sEDr_DqX*HQ;1^YFAwcAOp0BOe
zadQBEKbIa`16wBk2}7pe+Hm#CNE>r}i(McOtW4i7Sgk-FOlcZW=fFuRl!OFrDt92d
zSYm_aT&QLhrFJ<))aUZjB4JmchGTZ1k%Y$!NXLUo@yJIg8}#Hibl*fubmq)eok^uD
zYVb=CQ5)wH%iSY0*)4~>)=3F@b!xve?V&txsDZf}_L3|7`igespb4qzZ6I}#`sahj
zmI1DVA|>+)n*AWT!x)JMgS=fz1>qh=v4D(eljLW;Dj1Sy29@vIzlMabR4rQn$$E^X
zq0(nB>pT`a2K#Ew&HZ=gm%<B=E=vN+w1oA?7U}jVry6Q8xdOd`P&wDA!5=`b`MTn$
zg*R>UXQD`Xl5_PHM{)c2(>M66pJSrFhZm+lCj*Dt=aL$=xhMafp;p9n1zCsUe2P!Y
zVsIK6K(|RsW@ivfMRj_Ywm?lfMPC1Vs`Dbu;#4^8Tr(3hWAI*9K!y75RRLCdkw}(%
z8y$k%-={{|dfwjnr=O@`LV&Uj0gsl!bC&KrtPu~Z;{}g?<fPj`L{c$4`*iwskmE7s
z;h7nx{_2pB;2wDuFhuBp)!j)G`8mrr9*Hj*q@qu{70|j+yI~n|0MrmDga>V>U>w80
zwrI};Vv_Jhn6lb6&{4ug3Ih!PwdWpLE4!+2mqctIjI0nSB-%1KG6Uz0i{6^X`r--H
zjLjl1hs2|g)5^@%A9`0Oo5cu>ZGx07X$>va=NZf1-zC_rY&+$tV<bjVJyqK&uUnli
z>1Jz_T@<F^j%j*8ZLkVMnnqvoPz_k5i}>KLS8q-LA&SeZG)jk<5l{b2O;TMXuYms&
zMhgKc#b|^NEm|Ubdua3{=9ydrg<3KgFFQghy1>Gi#gI7<vpB?ONXS9-1%igQf+3t~
zDuKYeB=Y@aiKlP-$I7#k=(Jjm&#c06_sCll&?3eLI|A+3o6%~{``}9#bsf0Q_{y}a
z6j#3CPY*;FTgx3IsgbAJGZPgnv@uSaW@#ikmPq=4Q+<FqLj^vj3>E0FcP9f|RtQ|C
zVHxm<-GSVw2F{xoSd2IM5YCYh#0%uSv$HNixzl>BPzXoO4Ji76QfxW2C5?4^m?#x5
zYTdWl@2!VkOO&iVsbpJ>#|PybbX%u{Oq6z4so2OXYgYs7{x#o)3|x4U!ve<hY_goE
z^avy0vK`7CvJL<mbVl^3kgk6NGRT1^Gid1RA_sQVE+^H#0=$c$=g3+jJUXD%5f=6_
zRDL`<r2PZ)z?b*D$x4#vJd~0F+GZGd0c>YqcgjnGd(n{uJ_5EjDZe!Z<OK^CgHX0y
z)0QC{$X^91m)>Rq$Sdv_&3hOW3FdlNb=<G)qR2cYRObpt%fO=lVkHSE-<tGX>otXO
z@4z}h*wx9y8}F~}J#HAc%{{iT?vZ^qb<jr*Z6Uay*lP}{PQ|>W1bvA}rQ~r+QS@Ds
zc03w<@CG)?K7AI6*FycfsIu12gFgtjlQi(NUufSWU(vi8h)LyayaH|W^#c8J5^x&c
zjyx<Au3xItQgWsgO{t59zZXCHQq!2U%l@H$%c8`dSJ^V@bD*LSx9%J*;v713^*HnM
zxH-jpTAl__sQ!0SxkV{|ue|;MT$jFN??kogm}wMBtwa1k895uZc<J$b<rmsY{~J4D
zeTo8v;hS(Alk07Vv~1$3@N}JH2A~U}8ww%LPs19+kwB)R{i{v1o@b0W-yHV=0Hwx%
z?`?WWSVW?W^(Cs(%9Je;`P<Xeu*Oq8gfn^(qD~eR1Gh*Do*hoWX!x%UP#2((7eh$Q
z@^ZW0F>piXIOFaFzYI?7V(a@dX}kloau@YOQq#_yv`ZNqFG;gsv-mxtm|MPcOCl<k
z+;T^qWHvfQx&AyS-Ef1S832Dk>9<7D3Kw}rKK9EwStU*Xi1I&{DKbBGLSqHN-<oNJ
z7iRbT8Db1L>D1hmmL=PUw6a7Gz@g8*h1FAR(^uc2UGJ@n$DBtp`naZewFJJ><dR<+
zUnZV2UKFIUKCuRXj5m*J2QvK|cV$ZHOZjewoB6Ey6?SL-tRpWiWy-=k&S#yIsa+;h
zoW$H*p`3-4gh%iz>I{Wj91?5%_?Io)Oc!LY8vtUrNl(x>90<b&9~x2Kwf?{dk6g1*
zt_+HxD@b*dLH-;WN^~K}QqPa49{(CoyUcs^-Bf&}R(xRA5XCLW?n1W0)Hj}*1(9;?
z0(yHL&0R)Fw%>Q77gP&0@zn$OW|j&Dk3O~VT<>19N|&TX!k4o({SwOL_9vGRrYvQJ
zf2G55g?$393d91meK=Z?SCctuN`v0%H4LT+#S{(Z2VgWp+j?`>$8DWgaB)hPG*rY_
z_9sWS^KX-}nz*lqUXX7rpt|F_s4r*P)Uu^cI-D?NPceKoKA=<<t{GKwn8W1git2-@
zG>`=HZ5%6Ocl>iY?}^LWeYeDnnY1_ETv~I4qyJocv9}m|O3-#LsO{++>@oHQQQ-`m
z1W3PzPTe$FJWejK_rP+hL=f<>s8JuiPCJTdMrLB;a?)BxmD+ChDw9>jFoV%*%g0Uv
z50*U<PT7~s)R2c<qi^)e+X5qt$UA!meqABnSCJK*A>%vLMe=ea^h`aB{XyIgXKft~
zDwt?aBV2hiJ8^<20^lQ_VOMcjoJi5e&AhA15B8el8nF7m%SJgmwSWT!HxNL%yN)x$
z*Rie^d$i~rVliBTqR*qZaPNUYPS1bm%VO#}b;bCMVjsX%R&oKN33IpYJ6!O4YR7$W
zsOgLFW^xK^<yRqSUnQJg6Kanq{+1BTvnk?41Ikjk3<pdjji*1>&Dy|^zIO_&)S5K`
ztnJ7#WU8;kkRH$_jzsW;u_<IMisfnv%U?5%bP^`b4L*p<)A6a7_W^E+A1h2LSAB^+
zbF)+igAL&OW!O}{I0OnGxE0rSy0v%q>-n$NEgKd$wh85SC$=N|On<+r`V<jd$9Bxs
zBZ|v3rTu!Dla<W7L8e)pVYK}o?W695;7e!!e@Wmhn(vZ--!zX!B%R%J>}3payiaBY
zFHis#>wC5*U3TMrr->EY=5BtN>GD2#@tAh-OEQ5eGpaN-w>3&_a-Ia=qo>XXx@%A-
z3!d1JSwY?Yb#)D0!3J95?x5tSynK2gafXKIhDObL_xIHnbqC1>J2cjBt9V)t6u+Uq
zTIK&;Zq*!=$^iK%5`EVkDD8#>2VjnYTXj&)n-#)`m!qqH3FXp(h=~T*$a&|21qf}(
zhN;1Zd1R1d{|=C+_-lF~Qhrk#3X(|mc0y!Z2?zC*=izqCt>(x|Ao<M-ShqnTo}*!b
zKm2c9Y1txlM9dWow7%EEvzfo3cH9ML_r<soD85-O55>CnFkXd1)_gXnJX@U|;O~(E
z3sYB&IqhQPtZL1T-*7Wsudt?o!pL|z3NhT0ah77{ka(Pc*qulAceWV1@25V?9Z(%B
z0Szu%9d{_Xs5N{k^=9`Zjy4{jD#=wMGwC21$B=8t#T%-_57$qVm>ieToCN*<JA8Pn
zlVxg?x$`8i@ktK-LF<<fK?i%mljzHebSDYz|541*xvW(QL5<7*DS1v70XZ^<%-#nd
z&32W+PCGlNG}?2eg*d#W0G7cZAs=psbD~ZYwtZlJ=dXAuB->R!eIz&S96m2eG^cp>
zS>$Bu8CuZ_6sw(hqmZzwSMIcB&QXNUIE#XjaB<4DkE5Y|dAKdtOm)DUNnXUga|_)e
z(oEC0m6Y-0fPK9w{{P|##9q46Id5TIMG2M7Jm-OLE~L_u{Q*PZr1`ny6p?#mL;qlp
zl^Ay_DU2)JwERGjig0pdg1RMEi#Xt9kZ^=yE_^j>BwI@T`h&8KekfP|=WkzsVa@f1
z_YWlVx}v@AjJ-#0SBz!hrM)M4-3ctD_cp?mK%h!<N)AcJ8bFzN&;Lg;-!W?QQE*gQ
zOOioLAm9Z<_;rVu-atf6Uv~w>^amlsh3x`PP?NciSum*Kgkson&Daf9P{Gt4RRdfQ
zFu04{JXMF0w30DHg!w+}s*3UoKYCK}eU_W7MVfv?kqswOWA6)3|E7R{Pu)T>WShu)
zAQz5!h{%<`UF$PcSiewrz_U?>A(uacbGXVf828%Z?>|1TnYL{B1n|m#+UxY_)8huK
zsXE0eAA%2~R5Of}?KFukr%xx>w;r!Pb#+~a&C^r_V^75ou;;mte5kB`V4c2>+<8Cy
zw%O0eRe_Advf7RR>9BV2-v#{hm6<T5a_&uTAm|l2!-os!(coJjImLQKgQp|Kb@vM8
zSh1FP7F5Y@6s%sLP(i~p2o~t>RsLA&4_wFUCrg%NlOp$~s-zdmtOyRS`Zgte!K6GD
zl#XS&1{uqf3Bn&jED6}m0UHTrdNE_SU<IY$sYCD)nb=3*O}y*VH`}}fqZ_`DFl4`-
zrq)Hu9<qrE#e6RL`xZ9>{aO<XVM?vx4c|=ZaE<ANuz@ea`VU`bQ^n#0lv23AQolx%
z6~aeT2ux)m$7|N~oMWClwzfld%XQJ4l3sVTYW8c}aYIGCNWLtFpJBp=N5Q@%I{$^V
zs@_2|RF<LSj`SZt2%yd?)(zU(WUN236R4E*EhN`egZ3%4SiC<!mmyX6X)}CE>P7h2
zPBd@IC~W@dOX=`=Q%aLkGKGu_xNc)jS_Qbo%pMve`d8^NjE2Qzvw+Wo6~rZxA#Ou1
z3KH&C1aHq|{VbB5_mW-lz)Aff##9)Y1@~?-MviBZ%ofgWbRLKJ8<E#FdzCt~75rvz
zSBgi+jsyg45%xJ4mu0WCB>sKMZ1C=PkR3b3S2|w!W56I>)MLr`2h}cQ4$P?E@32hP
zG?L4{tC~U>Opdzh;}7=DL^*g$uRL-|-T}#H$6!Izws+X}<d`BMkb|MGif@ah39KlI
z#UR;0N)XD^SObWn!#7=q%Ctv@Yw?r__zU&Z1F-IZs}XjY&fQNys_fBAP{O(*3be8F
zMkw-irN>fqCtf`I{=ogimTG7NsbL8+dd&tx%{@)zcvtX&0$+ScDKyCT-CX>I4~{~9
z&d2&R)-YNE`miXSG38Js5madb-B}$-NAbs8vOlX-97s<4Va8QD>W55KFzkqT*F@%=
z345Jy>PE-z5?nz*4)~uUQi00bj1CQVx3MLYO)s?9Kh0wbA1|BJlv054@*%1TJA2NV
zgi-#s{jEuPzlxoh`)fk-<A`cCFVyAHm(Te42-{6nIINnn#B-WeS^1B4Ri5xLPj1U&
zf(PQ>7<In(_AzlET~+7X8R7en&~2xa{Z{@c)ga9iqkC0Q>$|fb`33*mv{Zxg<Kbmm
zP;KM_k&$%a`oI2AZ=&i(2>NQU`*A-kY{R|Yc&JtSlqgu`&icAjbw0Ev0E^!>ILn)^
zzi;QV+4A@Jml?;~$ka&=@=Z{10w#3U6sQTlP{~MRrDKe}Umka|96R4f?c1Qk!~R;C
zn}&r>v^oQ<KUK`}UUtabMdFWp<noOWM)Cx59bw8Dso2ip^ldp9GAZ%zW7B(N>EE5V
zgyCJ*WOkwa=y_+dp%K^=hC=URq=r8E)P&$<0wxzPvk=bg13(LON`iqEXbPqRi`F`;
z{fW&O&8lc|$7bo|S07HfOBpV!u9y0crMiVgXNs5n7)w)z7EM048dd#sKT)`etPlye
zvpD5cr_B?)9f6fm5wOi8|IJ{w7cXyjCMWBTJi7(<gqIlO@_{uv=Jr;#HSqTRY6zWV
zkYtDJ1L@JHzHmOX5g>+Bpe45<HlaxchkSQbGu2VJByY-CDzNux2gfL|UURpK_3e?&
zsv&vw9ZZ_Bl)iKpMSVTZHA2210M0|t(+B6OmThMKZn{3)X(KS=BG`hCm4scI@kXFq
zxofhU2tVRFv!3P4)!Lubk7TWfPucj*yGj=RJDA9QdOpc>IBj3;q_^LYDh&8gp#czL
zg&BRBHUyGQ-e2V@yz|Vt5_({&n6kv1OS>h0vUa5JdNy2`fQm4iYCuGFmr|9?7P1R=
zm;>_M4u5!(sVFpsIT{|y@I)x&O*gSA5eF@Uy~Gw9Zm4f6my57|go$sNs4yk^qGDjv
z0Ta#TTL@5U3#cKk64cA=1x(L_j9xNueCi~@u|KD(&z3T1dJEOi43r6{1qI!bX3Oin
zpA#pF+V`Ch;tr+I;8abx=9eO={Br3r;MxMd)Nx?hxkVV37^RuPTr?MC-Ea&`T!u$<
zQ_cO8s0l;cTDmnz%h;PnQ~ke9Fcq*9oU}{lk>L{<<Mo`CbOP>;(!e}xtEBun${dF8
z(gvuj_cO(dm+%jnt<!DDnHA=!b|Ulo3tQCovgpBuHJ5jNmmuO%N|~@3dYs~t;P`88
z+jZ^408B1L4U&568~K@VPus`TxpA$AIt4^PYjz<ul!oBE={UQ;s;%?ZYRMn(f9csf
zUKv2TTQ1U$CC46j>K3kGr=kNZQO;zyR+#Un#8K8%Ne*xo!CUQG0*($oC!ka(i-{aD
zr#B1jz^aNtw1p7QLm@yv(pw(=+_cEe070O<jUJ`hpZKQ9&r09bfCa_BHa}!b8k^8l
zHC7`}-52XF@+|G;J+fmp^^9U5*|hhX>2QHl#BxX0=eRruXWzn7GtZ1}sSJ}keKGY*
zGaJ@!WL`}T@FDW=uqxt97lKvaPaMqNp=6d0gvnzP@GFsL56hT8N8LHUNjsIw3gBOU
zJe~07u5qZ^$3S?Rsj$$WKDtbFBH@xx|G#tiJT_UM0J8+7gTlU!rZzHyD3X8JHUBLK
z*n(xCzfUxjOJpUBL{=xoUqn*_SrDKDvA@_Xi%G~Lz)vPh!K-3FwEj+2E#T5ONk|<P
zTVsS&fT<g2ulG!U4wMdLo32WtYsLD<v(6XndDJ9G9_g-1Lboq2Xp-oI`#p~Nr7ohT
z3kbep-65XObxbZ?H!p87)!1C*rOpo@L<@<ki4uPZYDG5w{J*@dKn3!0qz?{z9l<|f
zb6^QKP+6qnk;^D~>`fO)z*nwT<rxYIKsPt=U)fYX2KxdY8(^CL9IEXPfI$o~Ad~di
zNIR#VRGhnic@89y093@}$FkuZJF>MpsPDp#H>fs0>J=gKE%5RvapI&vCY7RnhbNI1
zq=vHY+W~^%yo@#kQm85WVEkmP`-7?VuDEWt26}bfeJY~KcR@AM89B-R7iYi37)p~K
z3fW+Gq)k*U;!Cbav`J!cg@`1iVa$NZFpDv0R5A8dYG^PkD!wwX2VOT%=$Hs{{4wcM
z`!YpYPx|}Nv7S_}NTdzz-xNb_0B9G#ta{TI$_t1LbKa%p)}jDJ8y>f)kc15KCGLA$
z$KDQyF6xHgwMWs+HM{&fV{hLqC%aD9(tEm0V0f5>JI^_md@M53fT9(6wAH#p;y)i$
zIMwBL$0H<weLT<JZ|yROX=KLK>|9?YiwI_j(j=kUhY+pOcatnMmwP!^P22w)^UG+w
ziuK2=@*(>cv+i5dC3TzNmMzHD?^?gk@qpF)2P0YTuMRJ;_l8{tFqc5b$VgKvZ~p@H
zDG35WUj*DGNX7Uo16C8b2Z{1L5ZxFn8lsN(3JhE!hihE;)b4Jr@(R2JWFvk2)@%aE
z69!F#?#iQzbACbC9aCO>m!Mar)t*3A?@fV)Fu--KX${%@ok7`A0<lZ|;EffBt!EHY
z8AfbD8f_$d7&F~OsF6`i^Vb_DXG5L3{Ea8frWm0zpPw)}E7!tWpC09lSXaK~nawmF
zGECm}1dnNtj8OHFNoOHv6ibk`@>kBX)DLsa|JEK=0f%Leg;ce8%={P*JLbOZuh@rF
z&Pd@P9^Qcjx#VxAkG_oQCq1?wWP?HLJ7wv&??a5yfTgX{nVcL^k=#~mN=8oc^Tiec
zEAIZ~>dQPfiSq-i#FnFSSKe{2Q~zU(5y0MW^DbtD89DG1ZUZUUVR;MRym~e_jOHQV
zChX#UO69YFpTb~QAHBqa@#(F`0XGZ+pA)4L8t#;WdpT)lUA3*~_s!jM#<0=Vc!EA`
z{n8W?FwOkp5>V)WF<FWqwWdc~azA;T)%Eguuz$Ro@!U(YxNNrA=HOsy*_;@UE&Atx
z-Iq&>O=P3PZ`bgn33I{~plp9xVQ3LIlxUP!KAKFrwMVDl+8AsH3&k1OiHc^m52KLM
zAd}pyrRlI#L)ogqo73!=!Aq1yYuFM%@159rTn=aWlhb8l^;N~K%~x_#r~l{C^78CD
zd>oTTv1*xd>a=lGTmq>aoS%gzl?B#gmV!#N(MXw#J)@iZ`c6SfgR5O{itoulGN;2t
zCn`MUgV*y#K_@2vSE#K1E&({T;#m?i&Wr5oiiO-^RT8%B2$&)O?X3P;^y>c<jo)M8
zop*;5z*PC-4bipPyY(9k`Qbk4dRk0TdFuluX?vNwm!AX(sg!HPPsl&dhWU!a`gl*@
zcb}I;y!59t(an}s(}H=dLObxQ#-^Z5=Z-<WZ^q*4t4cc-I9D7~uTLnLrXWmC=Do<M
zGJBiiK75}74*ocG{~+Ue6LEF*_1_BMyK2A?h4RJ9eR9IdV;N<0B+hbj9ippt|K$XY
zwqNWPoQQ%bP}r1l;dT<isnF(@cK#^3u!ZLe#L`)FigTAPIH^>nu6bM4ujE|z=lxt&
zQh{Rz1@PueB>#KH2n1M%nP#7kXrZlK(Cs)X8+)pbYBA~_gT+#(vK-XrwEBvS-h{gT
z;WUu|&ZaQ8tTSdU?D|$>0w3wn7@&OQ;$6*ifWpXtZz%=a4HYK7h~;D<4qq@#l_c+$
z7N!&~M4!b$H@&p&%2D=ri@fq>ZuWyW|Gqm$_o1a$X?v(AFG=oN`c?DKW=%nj+wXjb
zJLNjHGltDxfX&!{1Gg!ONW5;e&;!I^WOcbj@6mj@PsH{!E-YrR=GwqXor!V^iXHUE
zytky6n)D*!bgmrdnyptecs#=XO(38T?KKlkFKQL72K2innmL><hZK{D@6JQy4abR{
z(8%jM^tJ?ggnTbn`f0|Ps%R5SESEl|$%RnlIRsZu-mPJBK^nJMV!}bJVzsJo<v$Bc
z^>XUK*K}9p2aW@x+F?xww*H6?Bljws85qh!`MUkwXyq(XXAIX9Xh?-*IraQnKLim4
zec@#<XH1UF9&=N_&xm=ceoTDVcL-;Lpd4tc{!649At`8q8gEkKZ2{SPnB}k`wSu_<
zURYLt$_Ej6+muh?xKAQNR1ZCpJr^6nr#MT|O#$|vrp-yhl$QW-Cxk!aYA#o#1^<6(
zM@~!jYst-DJ==0(E>FWvMAD<(lq42IV7_RQmoTd00!D=dQ8L^BO6d|`YlCkl4G!>t
zmyE=)2D0nO-rIZdM`S{HxFU`I{Vz<frvs@-UdQ@if#ujliSRmo2V`!uVFMA_hNHxq
zdq3`e)-s@Ox-x#qe)>v%N32$9ACX@s`Q!O>fFGiaIC|41P-a5#3}RB#q%^Y{ZNV*f
z*qn~1J7Zw)%eY|fLiQQn9@m=7Dzn2n0AZ_sQu;Bs-u(nO{2RVd4oj2kcaSM)39Fkv
z$^5bndw`Q<-4`%=sP@60#WBi6pF-9chEJIklexQ>DlSZp06gcdOjhskIWBdUDnvCE
zM_fv;Heaat!%V>c)iBFwBcY%Qp5A;GIgwEhsKZtk2|x#Iecy0)vV+&RCeL2nQSs_v
z!S!*<rU1H;_fi<Eym#2xWCe!(=VHdbwXGh^gm%<GQ+`uX|1XECE4+&{gn=*$(@~7i
z8$oxn)Sn`Fv!XZW6YSkLyUt=sCWEDVXgSs!>z1<udsRP^RWFQEvwj|bEy%LUMq%A7
zdmwR>tBVZA^|Ij<bwhzO;T~s1_$<c3AW{HtYBj~t+oJmE`k{lcX&l>lvJx*;DG#wr
zou0twcNon&j#V}r-j~DG#Q3IX<R}OhK{_ot_T6LU>fLYAOD8fArn8QfgVyy|I>TSN
z|2HK{RQD+vSAFG!2vo5Y+8wif1K7Jx$HXTQ!BZYlbi>p{YkLdQa|LNw62tQL)`U3c
z#zQxtg$BQSWcR}IIXyVuhRuW9Tq7Xmi||$IKm`O@T0@wr)bSt}jF*}n<mg3dN~CcT
zztdQGQay22UXJMdvqlsB`T;{GVyH~@IZ^nv(58y<SzGG$tGKYMgu0N=U(knUf@Z6(
z@g*YO-Qe3D6`sj{-ET-HV|~{jhUIM5g)OP^0m{?tr%m;i{PpM54xN4P-043eX*_RT
zTpGa#pHcr?lrK<`v`fSiVG?26>Kf`_LxATD+SU<(vmK^REIN;-nD@C#=XnuzD#rBa
z3vj%pq7XOB10sR4g4kwMuz%5O2@Z<Ju=&bN{6yFfRcYKx!A-W>%0MODOnc#sqD`MI
zO3=@R&@FhKIY64yj+Y6<89yv=QrfcKMv)r`Q&PW+T(Ov*Y6UKd@UGr&0lP*zhS?ri
z>?HWfM<A6ya@Fv>r{Lzz3Eq(X9(FpJJ*Pw!Pa;fgU-0S20wLo;ar*stvdFS+t8ByO
z!f9d&<|ZNrw>G3{?q)U|{%d>`<NT}aa~A{75Af2>0Z|5v3zEL`vXiowxcL~5BZ-IQ
zyK6zU;6@{+f2%{J{o8`k#z~8Tb~}sPcKubF?nr{hbA4#+?C%Wjk^8?wiISDfc{kx^
zt-nL6u072NV#pR7lUrnkDYx4@?5{{%U1m|2TYQ!wAGqkckz*S2)nh7?l{ApkRCS%i
zXnbRT`o@+Oz7`6Iq*L4@Y-*oybJV#6Q8h%L^syHmEh`2ti_=GNQU(yGew0cHs?PUx
zCO&wXA9th`X!+5Hh}fB}yCGqbPW9#`y1F~pc&k>OU@(aTe39rx{#1Yk8|P<heVdc2
zyr`Uaw%9aycFZcVn$#WEuE%zs9_6E~n+|`Zt_B-{;s3w)O_AmxQ#Y3id)d3vcR#+R
z75zi`TlNFeH13^10`7E>DV%<;>4o@k;qY8uOc~HqG5f*~2m#B3*RhvR%=bLctK~~j
zCTu@H`UZlcD{6W;sPn4O&&vi5<)alFZTlX56U+NUb8hTXbk7KzR+X%?Ie&RxfJTt$
zX0@d1l^=t983B8)k1rJhpFqVd(|+xM3)h*vMp-5HAsX$nty}{N2ev$IrhJveO4}sS
zGZ+2V`uH9^^@tfQxh_`)JGK~?IWdS{rl*@zqT;>~J&VdXfoM=jarX%D;Q8mqsbC@<
z*Io~hx9!X$TSs(I#s|-1wlqsHgMAp$FStgvED@Dnzgl*9OL+(wTp1=A;Y)^qlB~N=
z=kykq#8jBXu7KNXKtu^x7qd{2z}IIn4EO^f_B3%nru!zKi+u5>2X9K^%zPB&uFTqW
zLDc!@@QcgUTLU2;p%4(QfIIFj&H8A=HgGqpy8n)5z(xH{cO!295U`D0Mh4OtqEnbA
z%%#|}7QdgH{%thbL8=JfHv=(vO>qC+wtzO}6I_Iy8w4IkDdQO3iRMUC{BCj?GD9*Y
z70Zil6J=D$K4XH05J~}Q{+UTjLb_YA<yno3t;vVzN_djb<C!n`?{U^%uqLN$j=-Mq
zeQlDDW?Ls=?24Urb4``Rg0h(DdqjPbm#%`{I#Br+C6T&-+z9DRC?<5GA$Nh<t?Pg_
zkDCH$S2UAZ&*e8<KIYWjkcoO5f3J9@MI*vBN975WrWCU3oX*fUrypXS{dSpfi}hT!
zT)8kP_x>mbLj81lU0b(Mc`{DRA>WrF8q;I<$T1}lgVY2t&$}QsDwfzHNsm9g=2)!d
z60DuOc$TM^=$$+TCt%C5irrs&Um>#d!F@+?@OAhFN0!-n)5KzIvn~=~!g_Ba90}8`
zLAz!@6?-l$&qD68pUK#BbUvn#=6Ta~sZj~^26wIOugv32Lz2Gx8dTmBfu_VsA6SrJ
z3$v|v)umqcV~tNv!{oEN)=Mq%!^wAt6N4r1Y3l!b+!4HUo$Cls?nW3mXU(-XHeQ(?
z5`qsN_$<lkDN%4N&@mRw<v<$1rl@S(g+W&tM>#MfsnAbf=`l~JLi@SkKHQbSmVlTh
zd#?xcBPJ0Ex-ko`S09w~eg9hCJl*bgxk>`OiQmw>L=<mt#|Be(rO}hjwGOwCIMSro
zh#`!;R^?N~^i1Quqoj0v|6U!d5#s>7T54oVb)M~!rR<&gnxaTTw(mj1QsLGvz-d#n
z;meAVm4+3wHst<YkS5?lVbgv0C6v7X#iMVAz=SEFY(ny`Fp4h!0^(xz<1PzD33pKy
zi^S@S{^f6%l}QyO$ysk(2JNW%i5mP`U_-n8JeEi+_$+t467T5US8Mn*{bbgocQhNy
zUpTrVu^3UU>C}8?R0#LO=E<j=c&+mIe0OUas60irGN<>&B+rxdA779o6^Z~X1Nm>h
zfg6=&3Q=2`{U6&SD(;J$$0Q|rRa`tWD12GoX<p=50Im8cF|_hce__7~PCEinSPzMH
z-Gi*o`P4^6!15V130M(7-IFKuzCx1$sGP7tmS-F)xBY^=G>`LsaGIMrv|m6%wH7d`
zV60uN_!zIT4OqCk1E8T^vR}}X=9^&x=^h>c*fprG<C=4S-1r=)WlgfJYS?vok=iv6
zSVi9TQAY?}p0)xAKA~1W_Nwy%1}5My4JxF-x<HD{PWPk{g4c5b_<D@@67egXXHAK9
zh5Z{Z$Zn<Ya8fsfcYYJQ@VrqM3PGeIw>P~&T`vFwPqv3h=A!qaiOvVvL0sGBFIz{a
z0>B$HR$f+)3f+4F?v$sU&o^_1lNSe$QhsZw2i1Y_1JdOZ=J0p)l!TrxR0h0>@wo9j
z;DPiv$e3hCp~3N`jmLxPnznxT<SwgmTHj8>eZLCY|NN;A?U&7EZoZrt6&AiP@68qF
z@`N?tEU)+zU#&^MD=E1)khQ8>V~F$Ww^J0nx&$c-aeBfwFa>VM`dpKIqBO_sA}W6t
zV=i~#C7pXTM3q~nJyO=fxuE-O|H*80#|6XsHF;CWi#2*)*gh#J8(;2a6<EL*eDlNn
zg03=yUrq6ab$5xs$>QGGs<s`WRBpxAbM*&e-jeGqkxBAn)`l0~`sk9=ui};Kn&MBo
zR?|N}Y1-!Csed+3G@7s|X*~8vWog))HA!~d5Ps%d2gdl1^>a9P%i7gn%pr?w|KIOy
zXcM?nVQB=0l?5=6CD66oD}{P)(@C>CsooruE>{D_$bTui#ns!g>bjoQhn(C?9)p0b
zs^gwfe471;HDbzhI-GFDA7*~X`t!$o=<P`3@xI;GU*ct%=(BD-L&QVR_+MUfMvw#W
z7><CIk~29JV1&(^<vEvLoL6tf01nK}ciUPRf`@^F%&iq6Qii?2{DJZPiBS~fJPPLr
zUU=t<`{AOt^>Jyqc9E|N(eeG+MP-`TpjNG{@XEJ8wI?lqMo#9w{Shb7h8Ip_+eidl
z0Z#xc;)cIgPw(Y8Fg>!ej9Xw=*2&L}s1u`zkJ_NoROHboqD1;N-#!bsm|g^A7r`g4
zrtQTxNg5Gl0`pgX&dv6X+%5Wp0Q)&69+>{@ALCP-OxFmyns2nB-Q+Cwn-!B@p7_#&
zv~%H`e!yMmCUT|9g*>4=QdK9$2|yM6Ror~7X;FMP0eGx&{#@(NOHJZBDlwZpZdmK_
zdb)l<{noHm!>FRKgt`kpEWSyPfSS%~J2Bq9m=L-rwb@y6hV#bWlC$loZN3@~AU)q>
zwkNwAK1sg$gW7iuB6Da9a9X-sGGJ?@6;FJ+8~ufGJ7<FRXiCg?S(&zA*6Un+aUS3A
zz>(&8z5UDjaq$^?SHVz1RTGs-z8l8)jPb|1c5Ay-%l(LRR?|N0_jb_kw$``C^#NgR
zw>$Dt-jf@k0=!FUnGZCX)*5#qB(7{9X<0Q-{{rUOPhg(ucjLwB8Ykv_WGiWWN+Zzm
zm@gd_xJi3%ptq4L$is6(tzPH_y=?CaR7oz&sb!r(>j1q@p@Z35{~SW3Lh;5oZ-Z0#
zxyKzRD5CVcj--y1Lc)2K(3*8Znrdm!w<3X3WRvfaLV?ah^piRl4wEsVMHxItRg|Ac
znZRo#l28g#RFb0OPI|HsH`)ktf9V(wom;95*LhKwso7SKu^;4n?(?2EORd)pB<o;n
z_XDl)2Ut9tAk+Be-lQV`W2m*~{oERy5Q~<@@J+MxsJ0Vy)ZFigUG}d70#JlG53`0^
zBq)-<@`QaPUvc_X+iV^a23APs84Ig49{vj&h!EQ5SO4NV9Vqp8od9l=Yai1dO8>Gd
zDN+Ok4SVW$p02ZF6z@B8;+>mvvaCVlMchm0y4*{PTLXelD_42FUaf;a5#L;%rKQ-c
zkBPwsr)Qg7i>$WN{xm&WNqTKqSo|(`yIvQ(Sq6}0qh^U#hY8T-$+6_Hz~lOzWsXtU
z@c0Vf^|&NC>26OrEfn}++-JAf51YkW&3F0KtrO0YDI6vvCs40(^;YOq^{fteq@G4n
ze9O2p2jcT=UifoA@@;<^bhhn>K&qgj^rmo`<R3UHyJIooEqQ{mJfS<br`P4DAAma5
zK|Qc2&l9Z4-S6<!(Zy@NI$FDJ#HGPD+qJ&6%%?{$0`zl}RL2pvm8WIuh^O8eMJsJJ
zNzbDYMAFj?=8IOhO77<a-P)?pB89&N0fHA;81^lm7xQ*5PmyO0ml=H>O%i$)$V~OP
zwcpxoba2!yzWh{E`^IxBeunOi>G4$yW}4&3odzcE)3Ej2`o}aLn~-5$?#OKbp|;U<
z!OXK4tNVA#-p@5_39l_!G&=z3<0Yd!(ob5BTgL{A(B2eqst1g_^{V+eb*5K1We3+C
z^<Ga`B@{4TE;?mW)vQs)2EW1Co+lNt8aH1l8F$bSb(0Yp<)Jc0+N??;xd>lBQgKJ>
zeNTECg_+{mW2Oxi1&yo7GF<_{rrX{@7HH=|E#Wz+cG2KMmKk=0KC6APr|9XCzUUXI
zQv<j%Jv`{&tl0nA!MIDKL}kSaBjG-#CVy(P;?{lc9wo22GcF~0PxLl32n25NJgC(<
zZM0{u->p6I=;i9fHa^V%mKDZTx0$(;>b0!#7wG4+|8-!q-~F)Vz<N~hqQT<%yu|t2
zpJ#spl%v{{`;mvMf*kX*l%DXt9YL$AaRdTgm*v0H=98Ayw4%qu>aS<Vqxe>rThqYW
z(+=9Z`)*`mp&Rbj<BF_sa^a_xleukxR>FI>(~Bwjo$Y`Gm8A;n$-b`D0zQmw#Rt)_
zO%{#IR9Mj#5<vvpqaWlJ!|m~l@VJGmU3NGk5Pq)zO9)KoB*d0at~>oxyS#tXDtHi$
zI_lXAbl$v4k6f$X+9k2BY8P)6zJIXy0``*?9(ZYBsD3Iw%>LkBav6?qwIO5+r!~a{
z6ykV(2a?G>H>|-9?|Jl{AzwwuvwwWUxNos8<xqSESnr#AOzV^h_LG)>-}Cu+XeISx
zu(s(A-NzgXd_|2X*Qpm!`~B+KFR&5krllLu`dn$+-`V4Sb~4&@Y#r|f10iCl0!}D{
zGj4kX7|&ie%eG59Pb*+juFr&^_i}7(;^Rg%yGe#$LVioWog;W*j!n`vzTS*vQIK=W
zFGVydYXb=&igWrd(YtJk0S2tA-fvuHWt}i}MX};^@1eM%zH}%mp8>Di0H9Qz`ucIJ
z3JF`&culNuZNA;_kAER0VdTQl^u{=Cr+r?N=l#F)0xPxdMCj!4sNTe~W&Xh5rgV&b
zkkNjZ^4ar3xO7PmK-rt5wp7igHflQ`>HY-+t9>G}v>u+={?&Y}-YRehY%N|Lz8OuD
zf=;Tnz{eifGFQ+)0%6_V0t^3RRg8k*oi7mBta)`G*Zi@3OtJRND*JPtQEmuxRTMP&
zV{kF-&pR61A0vDh6rt@pFV0X>2YD_+%m5;Ul3vE9(+-n|{n)=dW;(}T7fW?*+kO-V
zMq%H)2&0wHgoQWQFzwDImRsh;%@8(v4j^8^;o+w89340n>h%_2+`3sXtUY*o$}?=a
ztHy@CK3mXzJSPyoJG;TxG^K=24jIKT&vrE>UoYFw$}$T$hYSZaGASks+yN-&(_mSz
z+Kym`Iby<hSjCDI)F-l`I3J3ctu=AxxmgkMNM!nc99u!st(IG+ox|_UpNDzfl4#Eb
z)8;KAw3+W7HGWyw?4`5w1K)&23UokG;jTO4laB4{{1oEBn1Z2<Pb)i~?#a&A1;1L4
zIXk2D6OH18HlID$a}P@0wisp^Ts6J<HFUc{=pqRlA-?MzUzhu7oSQ)D%e0=T%D)#Q
zKe=gUoQZo-VNu*ZwnVKk+|p20!Xc5n;J#-W>9@AH>D)?&ruS^{y)o}VC{&tJV|A;v
zuIK(e{iQp^?^guRN8XST<=U@zFLs#s{AI5lBpB|1nWDU~&twhTS8rjhatDqem!WaV
z<I7ZM=T@VM?4aJ~UH29KYpvrCo_$rY{UU9<ack#gvtH~(rvKQ(oe9I10m!HQ*Ssae
z8|_iylcBfqUn=gI3?&^=0e0n0_~Xpqk5Glk5o1dS{*5&c6xE;ffgOji0J)c<8GvG^
z-d?1kC81A#W`AtT8@H)ZZ*_|iem<L6Yg!$Htnk75j%qyb$Bvi2#)OsBU3LIg*k!=q
zU*X2r;i2-SzHOxCJ;6-ojBZB`Qb}DsO?pA{RfoM0Xerq6{ju9u>UDQZPRftcO5yZ$
z#M`QAUXYW{KyRA6YXix|>VTj!T|OE{Je^^-@<&IV7lu81bo*J)+1ZQh6Mt~8A|^tk
zJTw!cz>EwKVM3tE-$rQQZgQGbPjl(O<g*&_W>k)~&+w!5IN_IkyhU6g?$-_cW9>Y>
zwPRhk#()I0@H;>Ho_Tfv@bAZ6#NNLjlj%Z_`5WJaczN|G@VA6WDNqH%00B==_sJWC
z<K7K7>2c#fEGBxb>13HFt`z|v9*tqhB>9h03h-qzVnuh&5NH3MBeePkh8g1@JMXo-
zzHDSb165^*4Dp6Jbp#Nwld<kxsM^K@+%B|R!ZL5ZvWb@bP_tUPM=S3MU+~)i<#)>d
zVmX<vrg#%lwJkf#^LHCYFT{Zz*S3}eNti>u-L#r|{pI?~2>_k%bp0apkycR%_>dP6
zr;yK^1?~RbKmbob;q}Su-7Bqcwr74jOf7Q;+RSA9h3<RA7GItMP_LJEnyDF(v6&hV
zr&gY?57$J)4dYr|r_^P2g{C0?iM=I8=YcF}{$hl8gCp(fR!V-ZsQ3EMjb~@9)7DRQ
zzWY$!>z42e7ACBg@>2-vWZ-kjkE*DPgvibJVzkaxEE0S0x1`4j!Z{}fu9h~>n4YWY
za6$sfc-3PEwTlm#E6>INY!%$`n=Jr@Q(O+)kAGf!@LX=44Gbv<^0-v@YZl?hf{6A+
zuc32Ng*iuw8%Uz@rpP|JI8y_NLdu6AdYHTA$!~(-*(G{2B@p7Ww_l{=bXI@g<TWZn
zJ|F*gH$54-1HxN(^d{~3xu|T&XCP>OwrSUJKWe$?8(=j$-_(7$tW)$_e{se);TF-i
zq38WgJmPIzI}#QvRS#ND1&&w<@d2d=A2s#MW%1Ys>{o$74C!NHn)lM$xYp~WZRY&#
zXc;gx&C097%Zd^tYQX)JGLJzBnaU+1Hk%4>XiPGne~rq8VR<c}kSkPZ75P*Yh-yE5
z5C7s>GEn?_O(2ujI$_8N;GXZP=cP4GsmP*V1ObH2sZr>;PfNT!Kulg-d2qX=NFODK
z?uMT%L*c=TrdjBJH+<}5)|{(Zt(#vfx0)-1J>mPb@<}esyjgVpII@hk+og&`nqEsD
z8OLii%MAyX0OQ_gMA%7A_{6L##VW%OAJ%~#KzchagzPB^8cpJ~INua+wdvaNXPL7b
zWV&xQY@NQTc-_qn?8g~V&)P9xf4D8DK}*v;W#4hXB3><Px8ol7C$X{_8h>;?SsQ~L
z6kmi<xBgzyR^A0C^VqJt?j*O2`)3i+2awyfNebon$sQMXmrN#_H|aWmbPf)x3FK+p
zZUW4kEGJ0g0+L-Oy8K23@2A4J-W1QC#D6w8<AAz$>=%`05()e$Wmn)ao5)^CcAeM_
zvhC7;emp*^^^s95Y{@2eFx97?R-WLL6zg}6JP$O@NFHyK4r?hm_%2S!q|gUH9r6ch
zh<`}Qew&lUzJG2vzd9z>c5XlX%j<*_EH2`YLuDe(l*WM;BiHyi8iJKIjbfR})o0=e
z5yP#fDU%>&aikqmM@vN%N{@$D3{B^h_=rAH?v+Eww1=+Vh0?q8c%jzo!5QMHUL&)`
zI$Pm~c4tX*aj~hhQf#!C>t%}@=Vpcrt1BsBtJS?bCy;2=)G`QqtMJsV2$m<l)e`OD
z@mz(wM_ViT&%t}qHXpcq+KFl9wNknf&IcHCvv{5b9_l(1zOrf@p1JqRS9HJjUI)Ul
zrm@|J60;$916p0mU>ChyNxH}E=77jPW7TBur<06}^}$5ozt=jq7?KPZ+CTaN$LpGB
z3nCE4oIXE#Srk{(>Kg~}tbIVDG#iokMkgjysuRgK#NOTYxjz<cn+`q28dq;|nKQM3
z2ED}>-t#3_Na7ja@EudU-5MotxE_?a%`wWh-ROBdt+W1JIigvA1JNc;I7p%X&_;7e
z++LjyQd=4Al96kEHP%76l(-C`>aKXBKo~h2_F;vk4JK)>kO`l`bcFV0*t}XI*7KQz
zH9T)&km6Z7P5*n2)==4x;8?cKe9_REA#S{=**rm($^6Zr=u}Y|Hqk%!flic}3!*%w
z`S<>HD?%qE?K?HCHJ7>EEl^WkVGb-NE~5b!MSk1#o+cct>xNm3dTdiAzK1eVO(-9b
zrp0l$o@L#8*;Kuy%mmJ<(*xc62?3X}(*nclvM1O<v-61{LW;+K60Kj$x3EXysukeZ
z1|M@Db_06D`&6kdezSP)oyJj_Gu}${u5h9<HJ#=^mWWu6t^1y#({0Mjn~uGZY4Cpm
zrdc&g8s_@r@W-l#tX;f%Y%Rd^)44cRKdE8OBakdUb&@YSlLeN~#nKDIo@$X+;5wll
zKd?F|h@2QPaHq-xyV4=+{)?{mIwn9eL%K@D_VU~EdG4&&X6FUug2eiApww&2MvMB)
z-RH;ht^e@N^Vq$lmOuT+++?STGg-!Rco71IL}&-&|KsV~<C%Wn{}rK}lO(6SJ0LkF
zIa{by&V=NY<Q#LJ)3!p0(7_?+L`hCLpEsf=ht2ssb3Si#-fXu0UOwN)<F`NjHQT-W
zzV7RKUeD|Kx-Qqxv(e@nPT>4md#)W*M}T*JUURVQ1fH|Voyndxry!n#P2$q8q#C;N
z%r$emUf4`}t-);l%QWk1s_@36pU+1HJOWW}id7dw8cl=J=`l{>c@mF*m1Ew2!SLcr
zVt-uGg6Q@B0-k}WTQNP7LTK4?{0_Y<s?rWjehPho9IjkSZ1^K+yUB*5q8t2}$!$uQ
z-WC8y0&H8%F<Us{<`#t9b^$n&3=^6)X~Q6p%%~IaNOJAV3<5^5M$8#FVi^T&NH~rM
ze$d~6Bt?mX4#u5D!H)3OAjjQIYZv&f;KwSVJ6}QM8Auc6wjrerL3DiOAc8kYkgppD
zj*c^|=Yk@DT!1m@v;m$ZQFnYt{#a}9P!tbkwI$RFl6f<9rxK^7PAyQJ7Z!z&wX7vp
zh;QSRw^}s_r|$Y6o{<L6ywlBoFUiEh<oBCJiSur(_yI7}8<V*|4fJWJ{*i}58Obn!
z*wfybz=&?s#Kk~e@^L}8p?xL2^?|;*T0pE3hY_cC70ew1wq8^9V6yByTrs@2Baal$
zzi#>OY}BP_p~A2HTrFyB|9w4PCfyGwGFv`30Hbd11Kd&6Md|;*2_`n1R1_@WSJ|`W
z-f%)IqiF-&LZq{?PM>k0WSEHD>HqWS6~8&FQtw>!#Efnf|Czk`=vCQqlM64G?tf6h
z>BMWx6tui}E6lRwDYkq21kxj8LTE8iPoZPFIfo1_{HZv&nzRe3z4<^XKh2STk7P{B
z9tcRXbSYV-=1@5WlD+R>;-_5|^rFP)RZFdQ9&xbX8&N(J$g+rWr#w6vQt670I2ax>
z25lEwF#PwG$%j+*unmWB!svF^G>(C21=zh^`|_9h$CO%<buPfe9WYi=gUDc7u?Yi-
z5#0gBitXU+uZ0pF!jJYV;3gn(jh`Cxa30Y;gAusjymURl7Sl+eU%i6{Wk8d6VebZ=
zVuF#!5qVo&gZ#=QqUzIu!~0wRi*u%K;p=NfCYo!*;e<xgYc?^vi0waCc7AXE$LE37
z+S231fX+;A*`WtfJleM!e%)&VtP+e^8ig~c3}CYAp@7vBSXu381duZcyT<@YEw;q5
z^&gHNTt<y(-$?|bFQki<<_<L2W}raj$&9wKtZ5-oQU>YEbQ$-FU%2jPs1q=qBl>R|
zh*GI94mJGP?Qm-UpNaTRqn>uasvBs?<>T>a)(SXHBZ6_a_aYByvpVX2_e06NU|_I}
z7I{`L0q|x3nHvJI3n8?$EJ)rQoQImHgjQc^XA_@~NOxyvmvGTYziDrXJr$LW*f9IU
zTP*RP`cVL*wfhxH1gUzM4$Rp_(Reg#_RI~+>j^z7)3X8<q5FSDiJ~CbQ9B!Kl|Sz=
zyW=zub-GA{{;fR&qa8jekI~#taXcntPW>7k1&8lCG!t6@zP{-VuAbzRr*Tv=c-akj
zqBo2K3wi(C+9{s@Kb{f652E-`u5*?;_7=Xnzynh!jK_uT|IA+($!W9JhoRov|6Yhz
z{Z0Dtu~&XX)aq5Qn|iF!V70phB5R#duI2u5tD)4kK7T%T$-QrMFhkf=N40K^Bxn~n
zDG!J40+g@s0!U@zMZq!Xv8<SE0P`mlh|cUMnZW<%WhDu#_*7`Aw<d2dTA1LgHXHz6
z&XQ8VA=g5V<d8>feKkP9r|YRO6D*KN?^Z_fkkJt2nAv8^s4XNX$(nvBZ%wQ**xvYq
z*h{Sdk^A*fP||0_Zi^cV4?5U3Y34zttOrj8y{eF>0xc;0`r*)>rVSt8JRpl;1s%=Q
zt85-Dv4s;VH~91;*4|3yZPKStCHORK=aH}w#<6*Mjo$e0D=)xtjEuD&DBt>fjKnUv
zHSbl)aI2F)L1uykVL%Ujk;9o*lIo6^<2w2JCcw!PTE__bVk4l(&HaGa)Lgd3Y3&H3
zy2K?n2VRTQw(?_-NOy2$JNZ1D8)tr>!m8X~fpCpIJ*tyb?%EZ$(U~z@Bu(FJ$&={&
zJ8D}&m5=iZo^+9q;(2gSAD~#mhJl3z+MQs#ABJhh?N=tlucf-x+q01a($gJ+m)aTo
zYaWmp@0G*lnQ%hz;uzxB;zxtPj2Am!69}~{a{AB(jiYO}9V34(u}d^=rm+Y}=;U48
z{b>V#UdWE{da(*H{op1df=w)9HQ&vxZ$0#nXG!_aq|yGJfO`AjP3<WhplNf?BX5Gr
zo7+Q|V=C+zY$#|z2baTu%SV7DT-%b5paG+-&QBflBS4K~-JfV-qSe|XMzudgfvU4m
z7H@f1e<#Sbu6{L;Zz5L_p`<Qu+x9^=adJBmMkL$Wg?KId{eEBO+n{|VQsK>``vrgd
z<j?DGXqfOOM`9iV;=ETp6D1m(k~xrf#v6}<R`*74x(0nsbt`QXHL=P&XLlD8Ql8|G
zxb`8zEPL|X`Do`9vCzeVR$RUKHLfv-a4bNnLgpV9(Kn+%!S<qvK3m<!%>sO7Ejy27
zN`D>c@o2phC;XymXk5D!PN+4x4dGK?TO3Mr2wSUw?<YWuCLwtwZb|4GY&i`0lsd<)
zp*-6BNX29)l%G~=Q%z{uARI@?@@67p7u^g-(voa_T4h@yn?DFz8iZe)RTj+;bnn7x
z8@PJtO0!#U$Tix){upj+v<w#tBz-}}rv)8fR(jV%sUFB9OVo<ooxt9D1htyqxP_MF
zF_8xhf*t-J@?=(<`j&2ANo$5=XoUw;3iwUb_YbCuasakbl%YCqtU*xt@6_BoA<X8l
zg>q}!8fGmyiAqnV`>rhs+WY#Dh`FJtV8o};_WeXNx_#96mp`W$ri`9)Ws<r@T)R-q
zVe7bATg$tzt!%!@+zJGK>m;Q90{=5$9!mD!x;40pNbO6{>;<A}4g?E`9eJjqBrTvs
zLOqxwG%Sry4ayaqxV+RYI#W&E#b8G3hsj6uLJQ+&=w!_<<}hgNK`7}!AGV+od4>J=
zkl9Dg$uFadK#PQxn(<kMpY6^F8jT<3w}XdFpK|}mepl-aas^8inH8MJ(JQeB&3&I0
zqaJvDbhrqkB{IUMZfn@@QI(p8qZ5FM6u{u-{hA@nS$Qnoe(FZ;@JIU><GWDt7|-|Q
zKEs&KIAiU7YXkXK;Bp)xf%62YBiKrVxSqUS9?+WRX&mnM;~N~f$RwiWdcILS|8uZ}
zp6MVXrlkdQT2*4l7k0%-ez;Ahi0j53Qra^`J*4yd3B?z3SeS^hJ0#|QNKySY><PoZ
zj18sX2gw_!X4XDE&WnM3&POOFnDwe#k6cr)Cp*cqqyD3<fEW|&-czY(hc+sZbG2Em
z+ex-yJCAPy8paKq!^P#7roG3EC7&DzyQ}bqQlbm)kU%;JWz0a4zkG7iD`<ntqrP8s
zAnRoPwmA2l#edL>LyDPx1%l!UnO4LDrQ=pwl7>(7{(&vHxwU5zNNAb~gZm;Bpsn!)
z3}s(E@+>(wSJ63-cECX4l-B$o9Z&0!{}s7)pz*yGoX7KhTzU{_sI7h+nv0vOvHlz0
zQ?1qbY`VO)V?aMjd;60(Pz-q~{Bo<C%i%Cy*yqR%Rg~_IX(j!$iqdL2OtXbxX;7pV
zsW%B%(A;~o=QyP$U#Fj37cQVT-{+a@`<%OxUfEt=v?J3}xFH`0;NU{AcjI<fL6Qx$
z*0RW`c>}mdjn0!bw&2!<x+yS5_K!jB2AW8a`YT&MLr=m(d@}IsC5&Lexl<%T>wEY|
zz-r>T92)6dDs%&L1Ug8VPx|?LJ+-sKK{*x*_dh?s(*$e^4v9N4W)Ej>v0X*!i-kt(
zj=QXgs-r`J2#yF}X?5%U{2|17(M?my8OI|Qh*wSz%D`I!@Vy5xtEr&CS3oc)@uWN0
z9JDpm5yeOgBqSs`Xl!lwDKK}{(W@`LJa@Jix?Mu2XE*lDc}Ul}E)%aXBVS~&FXE)}
zX0BdRMA@8LC*R4zrkE(9?~rfGFQ|yS_bsEGW6DM=;IY1jgF52W$7?Dz{eno%w!EkQ
zE0)Kw*tR~*AYGV2+A7CgKLp0xV3(@u!L634(-vVs9ZAEX5kn;rrZ7;T5x5TtEqWXU
z#i6|rG|;>^X=HZX%pL-8g(Z%RzYEEr8CV~%g`<Ktcrz5l<NUd>%}UfvZ3h}Zaw+lZ
z5GMR-MCG5lQ0kPr!x5e+GDga@FxH~gO%YdB=Vrq3Guz!~b3z7-fhkrGsmgH5t|RPV
zm%ka)xIZ;4#ZeA^cR;+T9SxrTG5%#%f?KjiGdYfH{=vE5r7O+!$PfngKt#nS8&(3l
z$$AEY3%~^vCl6<n;me=FqT%R9Wb=OAl+e}#eXVN8m)$9Z4?8(Tn2C~^RzKKRbHB!s
zi&r|F5Z}1_tTz1;=R0F2<5l6LCX4<l)`+o`xHvID=5U}v@Wbx6_NkSzKK%Qq=*Gcl
z+03xtWQFKq+1ik}<j(k)Fzcad|0z+R!W5Q1aeMq3G<d~z`;TDwh81|ze{9Z?-1H@~
z@xu#Eifzu!$&e{q9Lp1{s0J(78&*;AVU^<7;Fa&$eSeFI56JF|oW=Zevhia{jud{^
zu>@6{P^}72m{9RGgz!|UgOA+zA8tXeNnzREardNNaGAHS$!zBwAPV;<3@J1|LGO!1
zE<2S1XTCXr^l3WW#AQ#Bs(`6piv-7ewR?jG3!vlSctCoA4<F-FnI5NY9v<QBSJeZm
z_9$aKTd8N0fbjMq$+{dl(^QnbS6yt;jL;ec%1G-6<E@{r+zsq0tEbI(S~S^(4*v5#
zH3w8z;oDc!#loj~U|St|ff?R9`6dzT3~T_V6)G>R@jZ`Jvm(}PoIQS8J$$P@)>!?p
zM$S4IKIRvT$4zW^-#8Wr@i~(H0fB(#`l?%Q#)RJ_mr6fUrS%o%uO``E?`|ukO&d<m
zSFwZi0X4NgX95x)D8v{P#vP2--znD{zLl&!kJK%_yHQb3kd~ysm?*Yb;Cz94AF*+X
z@8Q8U$vqe+*FbJK0bo;p+rJ1oUWDdhpw?Qtq2h9SW;1+cTs+urjC%^%fneNb&$y8h
zcPaK--_M1}W`4K9UY`4TN4+aR`k-BW=AtA2+3l&A<ATz^gkZ{>kd3l>#(bfp`3*C!
zszvfA6Yp@oWdv2cfy|RGPNglt$p!pZ^l{GhIZbhX9f^!4AcTLbs=BO3KjM%h_+O+`
zWN%;ofqP~0le_GR)Epo2E0e&rQO&#W_zyTsR-_AY6_-&u>Z}3ZnF(ky-KPV5AxXt!
z4Oik@&fkil+*yV`C=dQTc2f~y{je_c_w|H0nM!VrD2<7K&M~Gklt<=Y9YVD7BI}>z
z_>|?o-7l^CHBwQLsKdyI759!80Q1L?3#lpqr2d|TXzED?8mV8PS1;HL+KsOmih5A?
z*5JqkaiEq|i%)NLy0F$0G=>|e&5PE-SB@)8RXr6A2jXLl1@W<C6-4ZjU14QG(-@-e
z*hbn<2?n+7#LHBK9c`n+9m(6Bz#wkel&A{Mf5Qm)vyjL*0_Mv@bzmQQ0T~U1Qh{Fe
zUm8Eo&y&0)zv8l~Q!h83Ju1qk^ngXN4C>i9cYyD<@vgOOK8Lqy+N<i(fSIgy@Gz(V
z^n;POiR=E`o+ayo@p4}fiog?~dp|rf(_3CNrk5#ygckyRgg>1U-dsv&G$44ok~@)?
z%3BVaHY%tnu5^39tBVdPTam2ea`K@GA3wY{a>VWnXTbvqhrq1DznmXAE6BaYMLF~`
zFs#<1u(WDty`<b92uU6!Gsw;HOGrOAU)|8+@&J3(h;!S$;P2r?U{a-H-c|mGBa6Pj
zbM3cETqc1OhOYCy66>DEGZ!zz*ds5P>><Wh0AW=V{=fs+k0~Iv2?plu(e@|dnum)P
z*SYU$dJc`f9K099A=i{LOS{v_+Bj$l1N2r57(NKter0^Xu_VP~={+!9qu(~}vqZ7A
z*S>DQt(2R%si0b~!sydws#4>1XP`sR7VqFwv=voMC`sV*J-^WCfY^rMx@#v~*)4h3
zoZeX(r5thT6?fKL4;Z<)F+}8i$q_4LK3xku-AIFciV<-guNGa+uv`u2-rg*&{48-d
z3@;%PzE_duLkL*{bUYR)$3X(^-%`3GqQ@S%4`?$-Vqn!wfwU;y^SEMJ4N%%fdD^Yi
z8r@`V$|~S<8cvAx)(;&Iw|7|~?IAj#=xj9z7K$kYGJ7D&JKA+rafD#^MR9yV0INg#
zh~`ql<DSi}{^~%IkHuoX9f^8Fn3MX)GYONdlSF~&vfdE<A7wYM0$36-uMKzy$N+wI
zWZ=3?h2~=9R<d=_`aAqU9z7xm73ph9etLLnSY^4Lm^pA6Exo@-10~Z}Vub09IxB*c
z=|IguPJ`IcgVs39h-|<EC;>no0KQIx+d*jF_1J+)q11biGYN?Vcq1h<DF9e}NqAvt
zOZOwvbh!9`?)K6RspoOQ!e9CqIiLJ2Rd`?&vLk)6|Ba#LGt{w7CJj0GjpT)G+|&Fe
zy%j6Eom!L|MxhAPL#OaV)5<oq8^{Pr#ZgD%5}=0g{jWLhrfl7l^s;AbSJR))Z=>=q
zv=o%WAvP;wEqtr8S7evwGfsvZ|D%jzInw^5E3?_=z#VYP-1?tnmEts^lspctSXv$+
zM_1Gb{4^XT0~T2qls(q)*~^8af~PpW>A_E(4%0c+YH3Rq=uHRS|Be%_GG)i6(M<W&
zds={mrB4M5@Hp_+brbm7&dlRvAQY(6=~;lPL|m@5lzRDCLK4+e%QTe77_5CIbnNkm
z{qO-RX#7s1wC)%X?nQ^D367p02Z8suQ2(Sm!dy@?+cFOYO>v*ukY4wbFQU&0NWMc}
ziW!`{fxJ{VbsGlX98z+fj@T`;cBGAgXou_7umFdAFLqQ6>)RAyl*aUn!OYVC#6P@7
z((#k!r+{1aQP(QU6nHdTA4>IkWphG!vHO=2@PEj7-^PI#Ydw&mqinSRK*9IuKj*G%
znAq<gF#q5GJj^kOmHVD?4ueMT@O5jG?&`d<jE_s-P2eIpydm)X#VO%VzLrU(Mf`>I
zdmOUH>;>&r=VY%WAES8Zn7b+MoJu2?Z1VO1IDYvI@PzW#c^693RYRhJp2qi(QqQyG
zBxp>qn*#XT&zQ<7UJ7S;(6eO0?Ed^Whm{AsNorw~;vx-)!@I=9H|-vWXg7}n9gCu1
znhz-jMlM(oUz?U1GzJQLus$z`AVABcw!g^#9YmR3E6Q!49S~Q;TY$>`nAt}v5&k8d
zfk}A(okT4c{l5af=otN2aS4#5*rJ?K;)Y@LG3`Yd`mYZdg-FqvxzYk?&(Jv<^$ULn
zzqR~dq*aP%3B6+0>v5kf*jb{Yw%SHBQClk-5^p5#S(uDFQSrZ3jV+>HIA>N4T>5Ym
zN(sanr7X`YCUZgzo2v`PWl9?~*P6YVKdedgzEcE?{pw%rK659p{Mg-X3Fn*XhFJT?
zvCjcKR2TeNT31W4R0|X(P;zc*J5e7h{!v{py5Me)v3(4mZ1E`2I4;S~nM`3({C4th
zYM=n?LeN30S8-<KW7G2MN~&Tlhtm6M#ge|*tG}LgfL?uQ8!D_<c)unac%D=9_1<~b
z;uLa#SY>zoh;=>p;*Y7|!jw()tAY}R#-Aos&JUQ!zeEf_BnN?I*&PFK`Aj$1;TSCi
zF6p9_BsJ&1O0i<Won8OV0`;c1#IUhoq~?;K3YJVVf$kt5r6-Dx1f{?DtMmt?Z1y%T
zSDGQsUHHHJ89PQ_w1`UO!j^0cs3YI5to~~kcFYTF^2(@LJex3-Fr~6AseEOGL(y1u
zAtNJJ?BI|OK3w>aAGeRj8*3a!XZajWNrL<oR$d_Te2>U}KuY;I{d8W$dhvf3+wSpi
z^#LGzz--u|@J_ll<R-2^iWaTY{Eqc5yEF6+_Br$8Vx`>Bm;s4gx&Q9nG+9I?3ggUn
zF})$IJ#1wvXMq+7tim-d=YBfbt*$cx`z))WY$0&VR93aulzLjJ^-WiY+MABk4`*16
z!#G6K1h!Ymjd~mp#hEm%HWLxIJi|HWyv>2RN?Kgkdl9W~u1H>LDfuk=_gTzS3l|y1
zO(hoSPy4Uhrxo;;53y{aZpui5l;eG#jWyftMOBwQ<wdNz1KLsL{_vyA#yy<!q3QrV
z4B7?7CZ#AO9V?RLp>uF>(>C!~e7t6YN?LC+xVf+<R3JTY(nNGb^?xZNbuusF`LA^u
z*lsx6`pl(8V2AU|2n`eS1~-i5eQ=+X&*5%e{&&$?3_zwu&}F!`$|D|o?-5JH-kT13
z(1N4mVfTL5^C*dapjvmy{EYjn#rYWcX62gb)d)ZV`{5pI(^<r2H{ah(;32=6=^*3z
zqb##8IzNYB30^jKuVTbVmC~xxgNKg**Yx@KiCN)fu8T8HQDTythclC26>9MM$Zu&5
z9|c*6T-S|1KZ`Ny2s*WsvhyU?-Q@>3`%&%bk)-U@PW8J#3s{t1td6yuNCNwxdD_MI
zA@UtL>Zp-<Hu~wZt3rqB3F38F?7!q0c|G&wN^R+pYK_w$9Uj$jJbu>|uH{uLO=ONj
z2Yk+7@X{fFEx6ZAD~qhW(N>9~%|fXW?#sPy`ge0vMxQwEC&*LqwlhcfNr(T-)Lb!Z
zd#TB(lO8}_>jsF@xI$%QuoPw}HPaJg|9z6=xmDdCki)p0(_dZPgm~V1T+TnX*~@-s
zr34ZHohh|d90A7hB+tvojaWC6BLnKgc7<Px-4|tW^YQ^1;qEK0Yoc~H{fl=tOUu17
zZn{)ion&^3W);4X2y}1Kltdc5CE5lTy<Zw?LD~cklv6u4Cj$KW*(0M>og#(iH4@KD
zZYCzkRdq3y2%pMqS^fI%soSx-?EL-6M<yZNiL$M4)?0!1Y*(6_FJ@>yy`aC99ru{|
zSE`Vaz3b^xPUm=`o5rix&C9I)YCh*D8TlAeIjeL2*;6>@Y~7@=iWim6?r<yJIwngT
z0|OZ}o?bBD{a3L44JF)8oi~Hbm}n-nU5^JtZ%drg)zu}o#$UR0UOn;_-#N2Qdw6hX
z`FLKdvwWO=<@0=w$XA1fF*D&Dr>{!9se!^b(ddkciPiwH&-ImX#4h!7GXxSGeBg?p
zE%!d{c_YAlc78z;Mp{x^Vdv0F&-p%8tq)O-^Bnmp;ALdYmy%=PxYJL3dHVEe9lQ<v
zyGz$wr_oaM7gMACd6ui@=G+~{Sd~ZoM}9~H@aJU=h%pInJEbG5Abbw^SS0meHvmI8
zgJ$P^22p^-durnE`sIq<G5<)&`RK1Iu<`mC`gCZNYMyDY?2F6bKKqj-*2>dgPu~ix
z_lkq+_FO*6q_AhJUHSB6mN)zCl}tsq`?Ee61yk)ght{#Fb29H)`CYkXH1*uP4H?tA
zO!qJ~1u}wYm3m&}(5Y$dd}r#ml=g;BJxjOjIZeH6+c?lH>E!w=_j2i`%t*JmJ;~kE
zIw6mK*UDTXkfYJ~vk|!xUEUk1-cr=qCzg>HDouWD@jT?s^?&eC%}&uu$fovsXxkU3
zF+0fa{8fVlXU6I6?L0VzPfl9H2txM#xx7pC)JYmR{pkPi*>;n8x30PQ*X1-eZV^sT
z4EKCg=~;J>o+2<Kv)ta-lax5fl6ix5^`F+lFVFqV6Hzht0W{f!!{@1UcXcC<-1xO$
zn2@;mFDZZ4xYsMOhdCEncm=x>HkvaJTuL<w&9tQjd%x5NR%%%LNY&rL*A~}a_kCYb
z?$nkT3v%`R8Qf!SpwRfS^P|q-g|8|<mM^Iq#C-7ou?Ihs{fRgALPN@{A7^y?Bw0E|
z<vAkJvVqG_{_DWBX-f>+M?PX>Dx4_Xf6(aWzM<%=T{Cq?`u;wExS|iEgVnln^LKlq
zH1%!^pFfQL=_Rowq;BWwW|=E7Z+A6}{_*pViF1dsdy{W1_@t$!6NOdIG)&a2Db<5<
zd<O*;c8%BHg;QMy!AL_&nRnLcm_vX|MXnZF-GGFzQFk9LU5ny*7fMU?Gk!SX(Ug*s
za?R*sIN0m5!xTa4#N+t*!RedoPa!>L^(GqkuJZJu(|8L-i{#mP#5B(h=ZbcAc3!!5
zO>D@a^&0Tqk1Eo|K(J|><h{oP;mjw^KD1ttn+(XmgvD-t*~;+YLmd->mYXGQrw0tk
zt7g6jm3UROR#_(#oaoF0HUF4N$*_eoNOq-v_gsh3tuS5P+7Mz9eLg~gpOg9H*-y7h
zUSOp|T7JC!@k46pA9Sb8Hqfw!U~EZ`fu-K{TZkV$@#KSR4+>@dCo)FZ^XF<QUc$zi
zaNDojf?M2Y`iE1Sr(vFA_|!p;1IjX|_`Fs5(}Ky@nC2bb1P7%D(3Tq`kZ(<I=rg*u
zf7H7B1E)3RV)ibMEp+x<x}Fi*=f$oD*iWyB&2s(t<Bxy9n;ZYY$Y@9i(VMYLqKd=J
zPwq>r-}af@ydei^f3IV&4q5jNqYh2hdrf=|<s(J>`_oZ*=>}l9tM6wnXlWx{5|$|?
zX@WADDqcSixnG6t2jZd~o=a(@BNp=~CVpPMa?4}z34?3L`)U2?v_IoDEz`DXV80h#
z&B!ci^h-y(x%*_qj2^0{Qe&>ogfj|AGmHoOZx49K!%b1&{T^2LkcTLVS@oLqMTSjt
z<Fl<cIeYaWRa(uEF-MPhoKpqzFlqNLqd)(gsExU-M801^Of!Ti0M(V=DWZB$)(n?o
z=*(=}oOfva9y6u?)<?Wp^4?<-_@DC{(ABkh;whFVZ^c^hl`;SNF|h;OOW7=ysU~l>
z%+Kr&ADZv0USC%9H~N?vc2}R5t_-2GiNlwhAFiGpcyID&$tdHjN+El8)PG^u&usFa
z$<2rRNW>!mb?gAa%+Bt=y#C;ht#nK8AD$1F1l*MD|Ja<KRto&%yC@XtkSl>mGSBK!
zHx0r^%jj~?NxzMXtr4r&08d<Z{Cpd_3|PIagRI0{b^v;P@S8>K&{W>Uw`%kkE8P{e
z+i<CklJbbL)Ai#+FpXbMTge&IcjQIWyu!@Q2kX42>b<8B9=mB=!ndzVR;Yat%Ki4p
zwr*GyHd1b%DIaX{b<>XWF&5_53~VM3i2gWWAy=!(!>2LaWHmI5nQd=OFq%f)ADO->
ztK2tN<d2iO$&zKVW7}D@(=EAomNcErUu2Z02K}2i8hd*C^h);BNZ6|o*L1W|CX3a%
zv+5A-0;{r%u{=djHyYXeia3S#=1_T_+5<fE#uLqBzOJ-?=o0a#b?#`_%tH+US8tj%
zeqzBj{92aQ)-YQp-^x2=Mz;&~#ZiBLM`k#Fs(xkEd#bEkQG6uxO&s;}2>cnk7gr*A
z)n^J3uyG)ob=w<T<I%IeSSwjo)k68{%J##uI%a%ZOH=%IiGo7?Wz}7ULpvR&Ko_0e
z>t5kT4t7&LRV_FFG|o0Xq^7s%sOY!8A>E;FDnhPV-2C^4<to)?n|$xgtPq8E=JXi%
z#K<H0v1FO4!UuGT)4whFMxU~u7$~+t&6hv)TL=lG<W<ut0i%wiAdGhNMi-x;J#=JA
z*^_1a`ifF>p#L?ER3I$EO;zBn))>M9h-MeCfX+e3y?yI3)FdD`-3-Ci;WdC0LxlE>
z8fD$Cc$)LBXlrS4wfxmssfR_MEcIaRTcgX{{Noctz1C}zj$mfp8#@<`H}NWBymDPh
z$^mYZAN`QFrxIKtyZL7LmK?ju5`vF=i;cMXuw}itrR@~Bf4MEzI=)nFK&hq<l>33c
zQmO_=XF888Y*sfVi6|bem&jF^U5--;4P2Y{Sk8mn2&jG0st;{@wX02eaT4O(`9V&&
zHp;2Zqo{Ud8*yWEvQn7*Qy>QR$ad(vkqFygAZm0=)`<MpZVmS&eDV;}=Zcx<z1Rh`
zvMBl|{W<0Y8}~Z>{{H#^e(1ELl6PA$*N<dBFfZU&F7WeXn`&nPb!|NyaAv@BPU9^u
zQ-6(YttxCFTWu008e;0DBn#jBY!f(E3%+(=zj7K2dgRjl!9ym}2bS_)w}o7ZgVTQU
zr;?|2do6SGzo?a!{DbO7?W;@Fn;vi)4anAn3#xuS6B=U$uH<<(nJe)Oz1Xm|+uj^m
ztL6We3(d7>;1bZTRI~0{(Gjhsw`R?LrC^fO^bBJ<C!YC3hz0ZBPj7jrBJp8DcXs@f
znvl0>S15H)PTt_-aEUdfYxcD>p|#m-OinvX*1l=;11k6Bc;UXFBdh=!aCE0;^A`5&
zy(WV-&SqbC`__lrkm+CpL&JB?ElwS*&@fWV+TRTa*fs-3TcWO6z&rBRS0MHZFWwth
zziU~X5B8pNCscQu2FpSJInU{q1+cx+Va9;rPc?F6iNXQN%i3e*w&I&IM8(Nk?|{P}
z20?WqzA&T`x_{*5zkgn$u<N8mh1ZF_oEgF|15eFn3b@99fTt#2<FfrXTw?2Xy!QLJ
z(9sP0&PKQ2HB}6{?Ln8biL&S9azX`Sq#`WmX>B$i{_DL-NcSsxQLUG=n!xHBVu5LE
z8z^DUd~3u6ZQK?yG0|TLQHm2^X=g6AjLfh&@oG%erC{7ZPH42ej9>`9l_j|87qG>h
zzrcU8%YqQX0_<VNvO_GFs9n8}_h`nQO_tw*zo)>>iuY3$CVuJAv|F2SA+!;BEyi#K
z2&#oAiNCT({Yj{`Qdl2q*4K?_`ARxdeKjYeDNcia_Ekc&aw_!tHFa5Fnl?&x)Z-d4
z!%#=9^<4kO!v9cbOqclmE!U(>3SY3CDuIFX+edDW0y@iN{u6z3EKD=0FZupvJFQ9Z
zZ^^xBmlwF{aA+aP3oACP3=l#GEg~P}4ut-22|%cybA-fFf0WYNH=e3mo)2oU;GY}&
zdr2qc`g}<RQX^N4EC7sUP#m*^zM=cXay8E;P5G>0OZ0ywaIq#F6x9j`O>{~A)!rEq
zTwr9VP}^nz|6H22x7(TS5OR=DMXhemB{dW55fR^(=c=m6Q-j^cL$sS~Dt)zNXJ;Vk
zBfox?bx&VExsl|PBU=8X@(ja*ksp$yUh5b_7h-r{y!~?Pz_!AZ@au}%v8m`GtMA>t
zI}OLJzRFVe9QGY{Np}~c#frlRrUyBaH6xH{SCe<pyYM^^z0)fQu#sOU9<uF?PviOH
z5%JgSz&JvcfxhN8`LZL7{tvY4ipN#EP}6EZ!RUl<g1OMG*8@Iz{i4JMuXl9uxZcf|
zD;_k=Cm7({g#waMhMHo+DxRwAgM69FhxDR{F9Y3^mw8r=Tv=bK2YDjN)1PKlZyVp8
zdDg+YKLcBE=@UKqAU-GY^Zp#?%X@jId?#Rs`^lH+m$XCV{iC;*Ru;&st3MP;)8*A2
z0y5Sby8=kc0cvlr&7|VFvvYYP<)$Uh;xL-kPBpL}UymIxS!o0!xF*O5rosN>>(jd>
zP+g1pk0x=KcQ-hDb(YWMnJx*P%u-r=5>|z%O;s@O8XOY22gK}E>9bOrdTqJ+3)RoR
zxbaJ!0cq{X3kYU?zfM^eYSPprc2#_^VAHYZpy$62b$2|~>CwF^9S@>^4#O*3vrccm
zMTs9mcOK^mdSAVE4Mv_(b-TVi(@L#-iLDFTsO!tBFSSKFE&Y5!dqYoI9co@#4JW)D
z_!|1@Z=$oafLz*}xsKS|;L(@VB+(O)hUZH^l`xy70jv8PDzosk58rz*7{*$<Be8{M
zm1EJcP4W5;4BhlP5Xtk-jX2`Vd85emY|VVmW^)Frvk1XP4DGXVi$%=ct6eOyZyv2c
zMu-nb&wRWq1c2V;qobodNm?+<yMFa$#Nm$*j__S9ZudO-<?ePY(Nk_YBP&Z|u3Em<
zb1e~YKkpc18lX}@*$56NjyXWLH>;aH2|!(?Px!Xa@2f>GaqKdCO2LbpIohpZGa3~1
za$nXdGPB}K_ucPC!JE@>{ua-ZQ?>FP8$D~6#p3`pqON^kN5>S>eH9l$qD><O$uIUJ
z_S&Z=A&+L<^5A{g3mpnZ0l1k<R?bapf4z7_H201SDyH;o6gNt($}*AkJ#W)b9+f9L
zrm<f{by0n$ZgG`dySuya+&z?NJ+`oVLAboxbA8X|7+Q9nul~lYsd%81v*ZM95M0LB
zk>=dJ=T&}DV9VA-lhP*s$!!zcjN4AR0!mC39{G7SVhdej+(QInQO_uTst!M16S_g+
z%Casu)`s1{YJj->a&4vTYy{=!!wSV9R=+}h(j;Bgs~-l9&IPLB{V^ZH_;xkb>KU)q
zAeLO;nNOV4lH95|uR8X4l2yOa4v}P>^{W3`(?$x#UeKT2#LV!BuAkF)mY*L)TZ{s-
zk5{%y3^G(R2|WI*Jro*_3+qX&Xr;{8NF$$Ko5@q6H&D@2x+T7zo|C8aSZh77-7Cqh
zZz>QMDt7O*1{5g;CS|3kOC}xx-UC{!RUv)t+VX}xNUO}=wu0-vga0;=8x2fPEfx=L
zfgptGZ-@6d05`Ch7h286bMcZgdRB+|yK!zH0Q4g#Z6E#*A);3D-~jk|@nSJOFBw?X
z>oL~kWGJ}>(W*?k9k9Gvpr7pNvl-=8j+l>q>!{*2I!rUePu5<0$58ljKUXav?XmxH
z2>Sh4)6ZH93JHxV_VCbS<rzL==5tie#oTh%aBi+?bp7q-;4lO1GkN+pzcxcxMO@<M
z&7FkP;>w=mOnn9X_v@X-p<6A8rio!CMmBVD)oht-QagYDry*36J|4w5(sJ%^qd$B*
z(l&6KDT;M3>wub!pYrNsUGcr&md%Fe?Y426<?Q0}(<AR}yv@`|di$16+2xt4_3DYx
z9Y!%RJzM<KA=YBzh2Uf|%((rj&)`<O!Zlcha)E?m<s>=z@6~IT%rE1!rX^o2Et7$c
zkLoQ>QIwVawa^};F~q@6wFNw{0lv~yCJgk0IM~gp$Fb=8ND$|GcjwnnzR2rGDc!Qm
zCYcMmb?a|&Hkz=<X;4`Df&!OIZ|0fK2?4*vQ_K7|&-84r#21@P!z?w8py5jkrB`{`
zW?(;JzpR~Ut3W96k67hye(kOn&c5%Ytw7?$hpCT!5FOp-G1@cuw#BK1Q#!rc^o+r4
zFL*Y(NNSm`1<#rhuB7Y{8UqJf0Ovw^spNDNE66RniOdVzUq4u%xGbYF1y_<k_Di&w
zM0MNTP}dc4IQhGkEb<hM&`9NGywqdMs(+dK2(Tw0iLj}A`Nr6Y>C4kv&w!QQkfm=c
zh060lZU<an4P1n>P5|f=j0R=EoV2o1QaUoZ=4X4AG#Hc~(&(4qc3k!OBP}m%rVEn3
z1GNF_8EMCmrf)Kc@@ds`tXvsR$h$1x_~d$pLo0=xj1#A>>QPWM*Le~}n7Z&gKWePP
zhJF~GT;6=}6Yxp^vAr7KBOgx8QBf(i4;@K;oww?IM4`SYUIcRWxtRZ?c@t+0wW%Ch
zrH=JJ9Wj^acOooHT)F(TuWYqnXw!mVXZ8)TAYOFoZLce>uK1=UnaBo<<-QEqT35nA
z*SLaF_5H*`6YU7M&4SlO6b<rnv-kiR6MWX(+&qfzM;Kfi%R^$3;X`#sCCiu`#52NP
zZHXX*vRkiHqH||=2{78BSXK9+NB!h16AJUI#l@hW8hF7^OM}lE8>Do{kfvaKrs|SR
z{?nsaV(a$4V7GOll)_rQG?gUYIT=Jag4cWFig&R95|Te$!6d|Rolkw&zbzTDchE1v
zOe0xT_~bZfq5IJ26WO*G9%)M~C*9udl3i4bKH<+{<XZHw(R-R>soF$zNxILUg^BQX
zdqqC!{Kw@9|HQtkGiv&~w{>PeO1Z5ki3&lKO|{1E3>EnKNGu--_IBoQo95<syiWa5
z&1IAl;7$@+6pEkrOP&a77qOSmycxDWkA;9liqcC*ewcNLBdDGXI`hzXj9t|patUZJ
z@!f_2gB~NGuTFxV<u)Hb`jeHs^V$<Ll-v$O>@EO^ce+Y3bSK3F2P1Xt2*~((w!hk?
z+QYFUg#4d^-;HzT<N#iQG^~U%%GxPGi!oi2(1z`4L6Q(F=-Q3Zil?a}K*9iUEu&?&
zY!Tm+w%4NNr{91WM<uSAY0-dThqd}|wY`pV+47EdSsAqb@wj;K{hf|e931Cw+?c=8
zA(=-9(a=^E4p=ZEbE^$nK-!#WX3Vyee_C#gmJO}F<JRe8bJ)Tl;YW(fh23HEfSEPV
z@ASl1#md^&%i4T>qW-mXKhd9ak>7upn;K0%p*7|Ew|4>`Nn=*rj$M+m64lOL-wXi~
zr*h=M`iFG8LYtxDA=gJjcB~gnv}s2*|C-)b?5~f|C<!J6B&l30oFuC1`|CQ=BJy)~
z<80oWPeq2+`ZMl1r}=yH;D@viv42;IXRJ$qfY3?dQBYl|uh8p)1%Chf{<kI|>fkV_
zrX}nb{n88#IRIgRu}xeu))k3w-}($SxolX;Mp2?v=c+4Ce4gq^S#K79Cr+Yps5^p(
zf3<glwXyKo**&4^^cw*1Tw3Q6R>@)la(=Pff&E(?vBPC0`>fwnQid^zqq?rcXsi8H
z?fgxlw61WDKb(3@X1MO${MGZ3=K8O%ckqVCs9ubjHvXD)UP80z{ns%=wsxh*cgy_~
z(gNJov+d>EK`b&KFKGsCZ<9|8+9|ltzM^MNja4`j)3U$~OUuH#+Vd*7b@Zy~d`B{<
zbtz4Fp~PxrLKTQ#gC8!-iK?AsGPkfG5kc=$QXZFBm3@J2B#UYsEZYLL>>lHxK3X_E
z3*1^z{f_PL8s3DXFToZdTM4*b>=LkpLGF?L95Pm=kJKU>IM4j93Rsh^@xZR5-a4{P
z|9jip`@OIBZ?`skesvHb;=UW+y4656cyqk3enw~#k|00=eQ^l?ethCdUz7s0DT_n4
zK8-q5p1XVBF3TeV7ymH5&&;fYGhP=KcD|?IY1u%}98!s=z)9gGK+O=C-v#NGWi;FR
z+h>yx1#!{W*js-+Us_M;D1Hh;zg)iFJsElFZvI*-Z7IV<6*2<?CsAkVitRL?8Zb`o
z9E1Pa$hvaC3WNEQ+Z*UjdP05_8>cF=Vi~qRRuaCOI5r)zpe!-m9*O7SP>XgD5fS~<
zqS2c%zm1XQyo%}1=~(`RS<bUvHDs`muq)dLZ6q!HK#JcqS7I_o8qg%^1zYO=Q(D}8
zI?-!>51lWA>6e5IUtTdCvAX55m+}|bgGR6;@57aQ?F4MNL-+#z>!uSXw^bgo_mtfc
zQ1H5<l0+{mdtMk84`(8iKVe$V^BiB^#UTt3E~H<3W^0D-)M*UsW!pCgW3m_~7n1h@
z0|;#lb((g%0Awm!Ot-)ThHjwU6~?EG49h)A$`d!{R~keF82FZ}0XLu#j1Cj+ibi=0
zXhAl!%ff7gZf?e9kPEI=V-duwtRAeXl>*{j0GXIzc$a_KU?$rm*4G5L5+242KoViT
zm>H<Ml^BHmL@ze{pf`&FzQ9BJN5<^>2h`pU61k9aaIUk)EX{tI9IbvBZK6eezLOc$
zo^2YZ8hVpdr$Jod=3&>K>#I+kkzBSqCmu|kpi&x015E|J94DFdWqrB3`dmX@vU>pL
z`g@m_KS$%jxl8rD0p;7jY=3mgzSzBznw$StOHZHipf0aLOnQr1*x2$*TxbmE(aPz4
zUbkyMx4f1Yg)Tl%o~KJ(!t~SS#xDvudQn5lv-R%e=8q{~1<DJTm6i9u+xo~$Nl6iy
zmzI|u0%(2r9M6NNr-)^MD@?k0>hJafD)r#Yo2sF}H*emI;mAn-jEq0_pBUlvrA6gj
zz3f<V==|bCZ2BeY<*Q3u5Po>Cd>2p8%<m-NCY<<U<W&ZV?DLh4JbUp`X*E=38|4V6
zcDOO8Vfij#v`NoZJz1FEr==aV={ZAhOC6tsUZzafqv;9N8=-8R7f1)xtA}j!fV^eF
zMqPI_&CK+PZ--HRdS}iK&Eyj-hcn^{$8CM3b}=F9-oH;_XXSW-q7R%zlRrER)0+M_
zc~YB0j$Jh%hHEdd?aqRSQ?@ticjRwjA4E0FQ+lJIqiuC?tHPW9ho6}r7-;zKmXT7r
zOmt>~RAxdqSN%r9IZlWWyXJBm--Lz6_-p6O)W4Vh_Nws>(}NS;+G50x=RWz@G4D$h
zm*4s=74#|virrGgFYd_%-q26oX0v#fAj=Q636c7<lCEyXl6feiiZM+M=(-IlSI(lI
zX)|EbELf<xUaqVbU8K1zPlf<{E<iF9gYQfLJc(GEJyvP?b$0d^JCFDaS68g>kT<=e
zLr%k}-fw7GUkv*7Ny&C!J&xMt%=Ez6VRxqle2#YK)TvXXccGU+zzg~AjINYHI>NH&
z{0Y*h^mI~|7hlSIvy(aAW93*9mf_oQaDWoG7%SyUc2+oe>y{*<Hjgx#SQB0n>ylt`
zVqw*uPz65g*A@Dm7cN-eT|7!@@Pvp8t3H#$?U$2BT?HlrUdqAvnE)Iud0X+8nC0a>
z-=LjLYlraa)mRxRsS8lt<-^0!CJ<V)h~qGta;J`Ohjl_z>z;N#UdU&<W(gp&POlF~
z{!ziv_LduXn68|@BsFr#xN(tGPME(XvGBIY@k!ImH*N@_Rb+{&JjS$gJ|P{*v#lW9
zY#BX@#UJI5n3$%2J-n;)_?eG{qn?1rQ)x^;%pr=BU*YDiUs(HIj6XtG#7yI@x<T~D
z;TxIjZuc8t?4qsL@6i|UDXsA8`?H^BGSS?J%eRm{9ULlq`+;SLY;G6f!a*-V2|a0L
z7Zi7PYHDhH@%@PlsAQhzRdZ2`Zvf#2B$CR@h}i1tfcS!IxCkn(tR5@iTb=G0s@FJv
z-!z2&$GSA=u7A&ZiW!H?;vlsJ+ulCNNb^8c+3^3FocQ=@jI+@<no<4vnIG|UY`oOj
zGaMX_A=@Jr2)eP`!p%XI>nzz5Hb>j4Vu_8=-!47Y?=FPi^JBce02^>oa_tSa0vb2<
z?G6;#*JBW5&t6*cxv8A0;I4jyo5nAGEMwKQUun@{YpL~Val~Y<6Y?#46ym3%*G`Me
zYln%EkDRKpd-w7exW3+yzhz}bjXuvf>H(uP73v!3mtdqJ2H}G9mjFePj(gcXlwl?L
z)~%ha(9l0SzSUp8Jlp()L6X{w3_YB|{bo96*_bv3=h)@s!lH7gdn7wQXyw0OiBvaH
zG)(7yyhJ~(&L1s>30&H(AFzAmrd>AlEXmFNvt4&15EwMJGqMdk^H(gseq|n3x(YlB
zdCI*`3H=}izWqehE>{Ah6v+KtwK3s3hL?B6dg2z>moZ~rCZ^d#K}VsRfp>q&r*Omp
zXOawT%y?cpLkrv<N{el9Wam3y`29O~)9n1cgmiZw$KXuD!ZtsJ>q3>wM%~uvVh#k<
zZx(f4u6h0<?R$Xp&Z37r^7+&|mkEg))AMrBDAs*uA0_AI&Ht<)#f(hU5y$!dLeHN+
z58E0bJ3!e8<CRLYe^tGtX44YR%L6@x`USPR(dfptG>u&Nwg9an<qg8jY<7QmS}AXf
zc*ud?fa_G!UOy1N71;Uvk3kvGdZnsvQF+^lNkLnTVZ(SW=rguDNRhg6<7jKaBz#}E
zC1A{_UWNVS$^y~M+5zdlJ@}qSJ+yl--2vKjQDfa$NWh<c;=1UgmAj{%SYCelpeU?Z
z{ps=I`IA6HH$fVkeT~b;!55PeL1GK(A8?M$2mO=JBt2<7?3wLML$@45))F~lk|!Iz
zAR#4wM<J9rv$4eRmCNNdmHM5nI=xE~x|{p}r~YEPtSZHBjUQm8a!oE=s_*CRw)Bzc
zmR-!`XJTpXu4A#q&+b1k^T}`j?lyTfxPp1{{LUj)tv>a%RiQ_8i3?{}@bScxpFra6
z>xwDadcnN+;6Um*mHg!so_;6t{j&w!n*{XQ=*o&CjH_qH-{07nyxAk?w*Of<-1teb
zlvB^BH#R(%1jiuH{grGNk~D5%%t^ZCVgvTqXRAzsWDy8W(<P)sphhcuLm4Q1H|i7V
z$(jd+bZc&LV?2a@$`Q8j%^qvp;J*DsrXq-*QPSw6Q~Y&U9!jI^pY&0JQhL9R7$jPj
zd~7DI3YMb*JXR@F(Kz>-O<eZ-1|4v#$xZW_yf+gD2M6Uuw08hzllvgy+l<O}-onPn
z(rB)wY3;c*@2MuzCTV(CK9<VUNiJX6d)n%mxcee!i8pd<R9-R9cj@N{@H-eig}4s$
zL}yfzeGtBn1X8^%uacbn@q-Gx4|j~m@3{^S8Y|}zJY3`N?|TOK?Sl#m_yfV_60z^q
zWOdY|rz<OO)mdxjf3|i11FSbZ2huM8>8R?%ekD+n&xOi|>}|V6H%4m4Tb$x^Y;a#|
z)MBNJeD_>j%s$#o05|7Ofe$uA%Uf>p2Cxg{N}we>weul9`Rj`>!2S6D9k3p7zyQ8}
zmFv@x?K`2w0-ThuAKSYUoRhmR=6&%El&|uHp+S*kPivBl(~;qsPEiRAua~#<&)E+F
zae>lfu%orps-TQE)pZ_KhUpfMbnN?A?{h!+;rHwJ)>Kx3a!m9Q<Q517pC^HWwVF}b
z0wT^ayX2*dt844t&IVp15Q^XTbMSiY`JdM11uRKhv(<TwO+4(z)g@o|aH-2i5KS#w
z=7x`$;!gb68`MVN9yjabaAhl@0Ome3w^5H%qs%Ds;Lj{)tddPYM9`fOONc`Tgk3ge
z{#%7@y>Z*U1AvUG^`XV|dkXMcxe3FzT^L8rzoaxmNv%8@5WLudHTR>>nl52Tx*k1q
zw|@CxO-P8?LT$HMIdEuj_jA|3p#kDp5(|+_Q+UC=D0D{K$<=B!K^{4SSg>)TFmDg6
z0i6VAJDhpGiLk0MqdNJLHALB#fx=zw7*0K+a|!r1sXfoaA|!Q2-yTh%QN@SG!)U5!
zwDY?fEBvYUKz)bt!5%P0aT2gy2jYQzdG_ByP(3k7l~>W}u?K?sfC0R>UG3c4+w%gq
zKs#N=(6+o3^Ag)SAK)`%n@M6V&zG(j6Z2QqhE<G|fPHKd1~iWJU#IinpVH1>;+fz$
zJUrxwe-5;&r$drMU*PCb<=4Ba1D2##_@8tC{Glze$rV{-A{8Ffj;uFrWG&W@$$y^v
zv%p?d^xB3)VLaDg>~lxE^n2^Clh}Op3H<YMu7Vt8Qa@h`*kM#3BcsWO>>Ir3vX~=1
zT(+J<dm)MU?28-rO)u95T}ac^wxt5O*7+R+fCc<=_y+(t+9cv3=!m>a;Sx@$jk$mt
z8p;b>ZiL_%TR=9vF;!$u@>v0d5}q)~;ZABo+Kn6#ynRu6sKY!1K%q*m=uE``t7HN;
zhNt<9TQb4EDRA)6%GGrgNcTbHtxq_{XY<Z8fJb!8i=a%r(PP5}F6`^Eh9lIVfM)@;
zx0K*{9zyMj-2}-~C7(^Nrz1Mn@XS8DE1SqjtoJX#3!zIV0>T1`!2?_QT1}9l&6mZ+
z#R=zSb5!8%z#;?pRtKJ!7bGfsjoGV4EN;!|fg1>!Vp>gCJ5e$!1_lN|U3mqJ+=cPI
ziGEYHTWyMVs<L^a4&JUp>7kN~K(x(WB7!j>U~M;A52+wv(cJ4io%2^2eObt7-NQnL
zufA-5>mATQOb;j+4rObF6OLDNuzLIGH%C|?$eL>W(6%OIt>usbBhdi4pQy7Eq2;TR
zRdB_K6L|L@S^h7avIMX=V8mKedlZ_aPDm@8az!6)G!x-Z8^aQn5s<$VlZTb@^&_V?
zcr#yG^7tOK*<G~fR@lWLU3;^!)u_gf7;eJE!n9miMMQ6J_fy345dh`Wsf)!2vy*q2
zz0o$fh3SdTe|MNW6w>JR&)2F_0jRjRV|KZ`Ve_L7Gu5N66W(Km&Z(b8<-q{{?~^qc
zWi2FbpOj?sqo<J{-Kz1-t4Z}R{ER~<={)O5iH;X&C#U3)TW_TST^TYJM!IABR<V5j
zUt3LOd_Y+o_#%ozI=ae95IjpVzkIvAiO}~@)pDS+V-4u>;yL`w35eUmw_ln9tV>*6
z9KYmErQ=uipwdkMY8hszU!J9eUyVXQ!}jq*&8~eH{roKF=YRhFV+jmX_cuoW12CSR
zbnMXJAP_#VK)oEvkUK;CE$}Gi!}pT3_x(slD7Gmlz%||2EcI*Y@6yf9y}ft9U35kz
zgJ)`7)~Z}&tjp!TpLv4sZ!jyM>~8?2H0C>DVSmLfzMs<2s29m+k)vTDSo)-lJQ=KX
zG~e?m<fBt<bTo`cIoJfmZ$(MQZUMeqrrm&Yi*X2X;u{kW!>0-o5F5ccvdy{Jp`Od4
zK-raB)EGQcbuZz3pSi`*ZSYJJpuY&(P&r3xKHt-Y(LIbteF}2wT|`k2@FRd_W!8HB
zwJd(lfc`MQDk&)`i|@)$NvWy1ya`y_9{)Oscc!_1C0~Njd#UzSV^GoF+C+ivim_<H
z*Tte;HlA-c9FA~E4ncWWNc>!H8Vk<s=EeO<{r!0+)(fKQ*`tM(y9*+xnAX;WJ{6&#
zw1#oTm6i74t#qc}*Wcvq+xQm$@-mtW^XajKgv8tt4BC_vZUyLYRAuv0b8<ew<^k`x
zy|9*b8%zUF#HW^gv={Kt^V_=9yxE@*{q&bhSlP4xi$iM+*Tz_ht>k|<|J%L0{I<8W
zx3~1&JN|!OqedC@l@B$S2VFQKsUkBA>$46&q0XlkFG6D5t=#?}Pv0E~_5a6j?{Px*
zN|}+Fy;muY%s3;eGm1NBQ}&3gBHJaAh!o|{-YX7S;p~~cXZXE*zQ5n^pZ<{Keec)n
z^?W`b>%|~{MI(N*N4yTUQ7DU8H0IE_%`x!w*=>1Drb$U(!`uP&N)=`!`F#NU7=8UO
zq6y^i;&lp25~5t?Ywv{=1Lc1>$9jWV_l9}?6)j5=zFe4Ql4(oc>MM->QlSHdVT9<;
zqm-}EW$){O2W*}bF^|wW`-cp!k37RYSJyTfPwXT(vI26_6^oS8dl$b4Fn;Vcv9f?|
zu2ctTB3lvJUrl#|eO!gkOokl$wP@DZW^Krw9G4FJ@(sO$_!jK$b@5$?P=tHD3f|00
zlRn&}`b<XoN#_3Tv{{BMfOSDjJf4edTdM^(elL1PS46QwVJOpD*dbWap8e(LyKMXH
zcYJyyV<#&~-;}E6>6Z#bq(+Qq?SobH$&!eDbq4m`h)t62E?ezuzrJt#&FMtX-s`Ho
zM5-=>alXcEfrx*?FM|ptv#7)me__ws3_On+mh!w=$ju&;r@B*6WLYoo1#WVS>Ry<5
z-j_OEtHG}OD&hHweu=f<^>)&Vmb)Zm!gIPY?m2v$-*|O<m9@hDieGIs4l{&Tct65;
z7v+;>>sDgfgvOqWqloXnCE*KE=S_ynJcFo1471H|uEt)W$fpf>*3x#y8($dwmm~@W
zu6!JgrafAwRcBuciFIVYj<i-9J)JL37~7X&=Hzr+mE)%6>&obJC3)S}P7v7gOzt(G
z?jsmoyqv>W*SmzdZA-Kbr4oB&>^*mR$d4#4(iaZ0A3Ajl4Ihigw9vL?BTE8mL<?^j
zrzr4PNl3Ko_iB@Sd+`qP{gGV=^ZX3`Zo@8a<07AmU&J>fkzc~GPk)Lwxl>r%5YIYb
z^BT5`M6QrGjM*CLPtV?TD9N8Do7)*69~zTb?u__58%pGf>ThK9EU0|2(CZq!|L7ag
zcYfpj?B;VzwsrZzdDo;<S1qn}Jx(GuAiD?aFN0SLYI@6bC7gsP#7MRO%R@#qba!W`
zzyNLRkirMizxtaI3<t}98AasFjM;aIH4Z2nTd}I@#O?v^-tU+eVNXJ0i8+2d;@U9;
zcm5Khlzp*t=sP)l18+M-P^aOr)UiCR=}F!L%39syc=)4?EA3WIrb=Spp-%MXgva62
zG!6zKN>VH}@(;{EkTEK38mAS@a6bqxr3-IceKu046)Z8V#~ysB`?Avpwlaek)FyAw
za(0$j;HE2tJ(w$OcQ|wGDB|9KkgmkizPF%{PMi?Nl~a1x#Y2}xd~%Qo@nrs#j!oWD
z!St&?6gGwgzHfh=6y1A#>P#2(b9N=a;j}2k&6zmszwwZoErwg@Q1|0DtQNO;pG|+o
z_<)A+zCZncD@JRu#QKwN9J?yV%`^9hPoJ8<8j4aELUuqg>qzA}-?I5_1kBTvhB$5p
zVxbo(#IznZef$pZrBU7wSsHsC5Ei`0fv^!g3U5%bcohomh<Z;DU7j(QUW~KkJYu!s
z{;E_;u_&(6Ab&tf8v&)DLic&1z96piwXMFcc-w4qqW}6&y0P}D{_L`O<1AZ%Z=}bP
zeNuJk+8d798+sxmWnQEk>mPor!&ZhcRFOWOpFIouvbbZtRC6pkZQRT_LQb4R^BT*z
z-+E@es9WwN6}Rw>)WlN8ERt-nU5og;=Y6ZUufLO5Z3?+T0lpGsy-~X{`nQ3ff|FW~
z#m75_DI0F_u3DD-f`LS08Qebu77JbfcOB{rT2Q=gq-4QLp$$~NPTLslCwmZ#TW2i#
z@R|KvgdiG{z_0U3M-B~9Uk6j30%aC7I!{-XF99|c+Cf;8{MH|rJI_d#361_y>#fT7
zj`U{L(sO;?*ft7l(?|gf2EIg4dS`;&>~&0fR48;gCP&1I9}UrYl=HDggSmD*T3B>i
zS>25<emcpTA_m{&&?9ZS`Y6{T%p!-cihn*!ON*`XZ_$@4f7DuxJ<C#zmxnnWp!^zl
zcp(%E^yj-e1_S@rE7kPBNRep%ZR9=-mqYilYez|<A*bPioX+o)ZY)hBOe7Ms7)sKh
z(OHa}6yh6&23qr_+m&$D-02Sl7WLk=>pMofl%(iHQSVcN573UxyIGFHz`1i}g7xj8
zh#@UYYVy~4T8|CMReBn19>vNaLi{#wuaPJ^5oyc7%)%6#Ij&-ED$kCMC=jVMS{tfa
z|EHn_egkC>>PFE@2)=d#{E50y*3uXyONU1X{Mcja)LY+;((;Y}78Mj7fHBAAj$2&+
zzt3dAE_ZP32^dK0%ICMfbwMcdsoo|G8gxGlX$V1SwT3`%mh1YyzDM`^mmrCHlm|xs
z>ldNp@T_r1yEdESaH`(KzcP<gB;C4TNl>Aaa9eCdJbbxJP$ubV1KY#tzl<3NMX!Sc
zH77A$ftuClYmaM`wGtJg^=Z})kp8K$_xPQA<68&$7Y~M*l;S*E++*-^m3@iwoB1N~
zGCwm>&*xgfk6mK>p0hddR^x$r*An$ITlnYsQe~}>^11Kh7W4Wkg@f<DEM?+eyMZV6
zp@;iW`R@>E?sZCQ!?tLSL%zX<P{((}`8*IyJa2d}OV&;l*pnxLCrfA<yJUoZBim!P
zrr>+Slmxy^3(wpzbuPRqp>1$qeB=jZoMRM`s$#|d1BM++NjZ&fz822GoZK(hC*~Xp
zdIL4JSW~N2wAAMUPW_`{*-(l}RlZ+kMDvV9EHEOubo0Y*LC<ROoE$zDal?wz>lU65
zWNcu{0gY;&*D#neX<{1>dRb8*+1W&6Qm>ueJV1P|R2o7GqtfrG@@;fNqKn6=F~bfj
z50k8;v7)_3JsPbql(o+1ZzL;gmHO`Q&}fVnx2CTc+Ua;9a+nI`H!Gv_l$u7Pr<4zL
z|JNt{%hic}s*1+_+x>c_m@>pjAh;z&h&}jJ`ZuJ*=tbvaaf5FQjGD%~l+W#SqCHgk
z;@`*2%Cr7iQ|$$Bu!Y}uGf-3Mq*r=xkFs@nSXx<Rmr}BwDh8Pd;L3hV%aK0y5fg?9
zmqeW}*B5YnK1_l|`$gl@^OL;b=h(_c72YQ)`S7|FuW122hz9{P;6NWtooDRgq)9JV
zO+Zn{^7k73W%IzD+`gj%3p9G~J9%9=uvy8WHxY}!Pan2o|HXoXAX)3bod@a3^rLEO
zjxu2pw}QO^Ri=w<Ey=)lm+~8wf;Vocq4gWp8%#-dIP%e*<8UGW1;$ySI9D^eSDGkx
z2O3GVQL<VcHewR6ce}4tb2~{{SnM<wuTrI3h|oSAdWZ6sGVftH911VwAzBflaJaP)
zW4b8Np_=Plgh>@yJYlm4KZM$9&>M&sv&Z2z=V`xtK)SH;Z}!ZBm9>nP*g}O-!{b_=
z(k+tqIl1rP9ThSwGg7IhRq`eiyTSzZUS_rIFizIWO``vmOdN!Z3lKqKU!hCgXVqn8
zW!G1=c$3-W^8(@BBnS3gS3Pr7b3;*F4y#uaUuYtbABi7}M)&YED^~<+iW{EoQckGm
zzS6D4UjeXjHC}cuKB0*#UT<lZB4>%w<2gxzRAr(wr3_0y6I>)TMCMh<AT`T*eB=_j
z`ia^gUUL;D55L0mN7e7^TnYr+cyfI@p43T?pb+jKH@z)nH(lyi1``X8-Q|uIZQ3LI
z{YTtDTn{KpiA4h&&lY{CT={!|yi{dTEK`5uEqocT;Q}DhCzg_-n$}WcF>p5&*Q%2Z
zT3IWK7#$>f6eY0IVd%!U^hb?kkLFjMYZjd3UwWvG+_oX#|4tv;604uluV3$-c&=2W
z-+0JIl>1tPeU+H;hPXQfrRV&<!#k3RdT}M1ZefR}`5jcqRpIuP*1QKlE+K&6_PWrq
zdDMD?bY-84?vi+vHOHtjLX}Unk~vxm-M7xBXxt@8A~4{02Gp?k?6x~T545tDRcUeE
zGYwmL*I*OAexD6M*FK~_G8Rx2ehE4*3Tb%F($0zg6zdNE(1Ew0*#Ju>#DiLr9@t*|
z5a7HuDm|dls55DL17AjX%SpyFWB7a{<0Dfs0q>LoauzTVMS|4k3Y3~eA?iYKr;TiN
z-)qvSu|2l`9<4hh?l(+J@PJRgG`6F)qbsGnyy-1esQZSAf207r-nAdX?_!U`I|L~m
zfqSIz!6lfsoDJ=ud1b##X@-rU0`*p!aEB7P$Q<NN@Ig*U+weIeo;h2pDkXQ|n-L4)
zCYOXxqyBt<O|0mNh$y+)UO#I{pk@SoIfvsf8l0k6*;Ut<3t94K-(Z!S8S&VN8%gkv
z@3f5@I%}M@p5H~6j5aQInn{?<pq~T%>rgywWQqUVeRQgz$5*>RgR$n#7aDMmJW8l;
z0tJ|hmB4w8R6L$3sXN`f>7nKKI-=6XhSE<;Xo$RAOW|ASGEU6Y$<R2vYM1hb2X%>P
z2<H{==M8FTh$z()x7=ykowg_Grm%J1_(09lq$6Sivqk1v^XH@+Mv~}6S7mxxCknB~
z0D<Z*srHz`MZ7ePmKz^JtYkWr4vDH3B;M$hBH#Lb0crt$+)pXyIK0$DtM%cn{cdTd
zykCM9)vpmg;fe5$a$3UA=6eIPc&^B4p6^Qcq9ajqkK%`__X-=;x$xOR(K!OF_APB@
z<lv?8Lb~Y3(8IWPf!4Ic!_d9guV+i?bH6lw^SIxVBtzLjyIm~sCgErO$3L~UJ!{xU
z(c_Lz=A_;GMQgqwzXd**m5^|}Y`&)+Ov{ixurqtmF|Lglkz=r^tfM=WzgJLj|9}?v
z<17DzR|mQ|BTU;LuGvQ@kMUx-s8gp}jaNHUv4yGnoA=jmv3!nlMIL5HU{}SZIaLz;
z-Y;rrspT0@8IT3&H~m|JY%=|gFE{((q4siXS^B@j9{ld6Mn|f@<&I2HBW0uQgne<`
zr%8HU9X(qyu>NDTQJL&uX*n(@`=(U$5-gA;<D=ERs`Gf%hj~KrkEA%2-ru*1s(F9A
zzqDI8Pf(@*aYJj}-AYCKYh`%-Quy#dOyJ0JMg8K}@KYB4wCb?`Mj}v4sc7;|a>ul>
z*zt!_*$;z0d}3PkubOymU-U{ew!KFq?ueL2hxOG-^;JH<N2=|IlgiO#9s!ZF`?QTe
zsLyI*_IY)xx^HWKE?6X`82?KK^r=GHf$gMKnKiW<XG*cBQG_yOq*M2d2Y=>sUhXN-
zgfX)|%Yw)4&;}#s8OM%|aaqNEyOd(MgNNaPnievDqD}sq2KzkTAa`YDqD@*|VjL@e
zvbEZXfzS$9_Dy~Y<#-=0;BGX4OCS=oikqD!n}gA2EV~L+*EQfs*ND2aaZl~tvdKhz
zN^3mU;{65Qmo}GTIzsj>n_Fo!%gdWpKgC$rvYTd2a5Zca4ZG8t8Z?`^No>5ej#dbU
z=kRS^8Kx`D($VUWuE;Sj#H2wjYy2Y99D5<3HB6G8FUL3Bibs*N6%rSX6gV(U@Jo?L
zz5Q>8ftkKZE7^zLJT&rK<9Wyn&CRGC-$UDlM}VxtZ-KRZc*{T1`?KrsYvOvJTzP1b
zoq{wfl@K)TWW6s}7`7mddZd3TBeI{|8=cBD%H|xPl%r&h02lbp5H1x|73Y~4U||z`
zn5emI|77y1T@~!p9KN|yB~m%QMZ>6_XNwIzU%M142CJ*{J^iMYlK=l_&Hb~n(S|{N
zF?FH4>{0SKM@v%5FTjgBvo<Is92p745W6cMzCk7`><Ve)YBgBovid(J_Ou3Ss^eb~
zbV!pty19zs3?Al6!LBjJ<nUn>c)pHrkP}RM>2aYM@7p>kPVz3kpZ(eL7Bh6;@XSn=
zuLJh_kD#gcDOG^Zf+LwlKu31l-uMk(ccV2bJVy)uZ>@Q~mtSP5t=LI;8u1P#Epdvx
z57i=`QR_zOq}vqrRdSQYd?gB`S}$aRfofxi#>R(=7Y#uT6vG0?J|O6hv!Ag4GhoGK
zN6W8ziCjSTxp7>eQ`Xxa^AS?GoKV05Gi10k=e}u>ocYUGlJAS}%3p6&B2#JgeJx9a
z>-LTm#t6O^Wi7Tzi)+gVln8^c=rx{#zq763yuCsd6QY<Mhf`Y*YFlLt73pg}ZUXcN
z3+!R`wSY)PzsQ3Fadh9(r)wWs_t=#;uA2T70RN??j;^+L%h_Sv`SaiOnZsZ8?~PVJ
z?yrHW9bY2G`8KyM3kh@CHs|--G*1x(Wv_*C>me!R7Ec}%?wHL3ztyj`8CZ82l`t9t
zk>iSLkw*6kRzgV7M$wV6K=Ccv3wdT23fKB}#XDjRVCY1^%+VpZ*DY4TJ~&T|>f}hq
zG|F29yYwawO|3I3mZL_auF|k9SxlNRu#vgbhgHTkDq!TxCS57;;5#vY0!RU3A%s8_
z70d<~Kf41vp!7mfOOi8_+lFpXd@^A535ZNXu~=<g0o`e%bgz+@+-GbQ5fdgERhSy&
zbOBR<b*ojli2y=7JSHZd%aG?{JAg~cJF$zJiV84|qu^4dx7pbyBFy~YY<Un7MLg%u
za};PcBm8hdBS3#P_xh)%N$2eaMys*=KUQi(tD*huu0(0q=&e<A+t0JhJ%jjfj>u$<
z$U!QK%m!`7vQ+AgPz86GQ`M4xU46EYg&OIQra2eyn|;(NO_PW!Y(87F-e8LXN_JGC
zS9=oJil+BvfcShEZGv}!5M1Nu2SW4VuXSlgJ3p?0-$;r;@VIljAaX98z(Xeyg22oc
zlXbn8O3UO!a%*rAnuWwEJ^$1M${WfY`jqIdvbt(+Lj<QLI#4q<V2M$RocPZlnT|ls
z7OY$cCS;dJV}>!q&Fz<BdM1I8+!epDv{=>LO8Bz;Q{~W>(HTO$f!5mbW`gv4N^gCH
zkHZUqtqum(d^=wS{}JNvMgz0yad-~r!lfwRO!X04_vIrAc_5IR%R=gsOMpHW0yE=9
znWjSc`q)qB(ITDx!?yuaK0sE%A@^MTq?DKQM^`6K!TaA)Kfm5UJg18Po|C1^4L+Cw
z%S{1jj`<F`*e%xEYed;SKc7$3y=>O~e0d%2?qc`a@BFtH;9{q}S3Xmx5)~^96eOAo
zQ8J4Mlb{eN#t>IJeEu}9K-qL=WTr3}sF~_K&#->sHT;WkRNA!qs?Ia?mW|2w36Vu)
zNCGn%iJ!NQT5=C@h6%fwsEe%Zt^2HoBgObk*F`q6u5HwyjXJl-yic+F`6Hbx;UGMG
z9*DOo=jaaC$Lrmv&R?7!0<GWK(%t$?rPaO_VC$aaG0s58>pD_m2eg<s?wwQra%-OS
z%vc^=z#C*%CjUeJQXQ*s`{B~+kS*3;dp7BqpeDvlSB>aMm<nRtss@fpXOz_^NRi%U
zwITZVx9+V<{%onUr^`kq4}HlKMec~GVNF$T?&i*NmC-^RL6T@*5Zxp77t6)WUIz(J
zf4ssg`n22_5<w(*Z^g%d63mXhH!Eoog_^0>KoQt4wPN-#>hj9t51tVxxV6{te#WaR
zwdC8fW7;EIMv+6XLgEcE2P~Anf6+3GQl;zEaC^;}z1Hw6dE{I?wXa~;^I|^>bCFTI
zNsmY}+7&q`qp4YX75S&T?@CNQ8D5;X+i99aKGJ}}Qh;+Ja4|i*B&Z-i|Lk;gRt<i!
z52zDvDD+l|6+;(0PPMog_Y^pbT?Pwha#R9ht5q*S8qnO;uQOoF$D&j+D&<ch7=?M7
zK^>f+M|uOflfa)UB4j{&aB_l8C`R@rDRJU%1BNobw+-_Gk+eJdBsz2Y^&6e|#Y{p1
z?v(FH!8=*594*IdCbE@gF%|w%>-!Y=?cgk=!csxUXrQLwPd;>nlPF`^{;THavQ4G8
z5VFe%llcQIFAi$ENOR3+U+Z+sdzEm7y0BQd>ixvM5Fg=y1gT1&r(-sRsDX`Is*MaD
z*E>GsbMd8QJR7D1o`y}fr{t;SFL4;YDN;>^k(UQAq9z|UZQN{mvB6Zp{Q@iOq1CwX
zFyr9X>p*x&U@BJLq(7P?XCYodh7kFYd0o_%B55K;pf*Z^wZd&^r%v+l=EI}I->tj9
zIuzr8g@{!(a5-SJ2J75hBxf6h^(%jxZ^N&d9xUZ$^a|ChP;Kd|30BP$4yXH@uYYB0
zyaR-2o{*9DLdXu~`tvp74BVsa=pPV|+XPw1&IE+Jl#Qk3olMc)>F^u!((!6n{Z(_N
zJ$^99#>CDoLUt($!8Bt|io?pEgeVwWVIw?RGNRD2%|m09i4Zu$swCgo$f#(Q?028>
zj_l68@oy#e%r@F39@#nF{?Q-bA?e9|+*#bEWS7{vKjJm-&M2)WS=BPkD{Fb`ku0v5
zlO0p)7=iYrdgEr|rW6agoSe$9At)R{f+d+qiPQ*{VDgl&J*yCYo5Ol~$Jru04+!3U
zCSR^r$^KG3-<oitq|CSB(iEQCnlW7$qi1n7pa5;mmoSxjy=w$n9WON3DhiXsEOA`S
zjU37Rg?ai?2#XeGFt0}|xtJ_4j@3m$h`Vi3dXKJ)c$hHL%CPGux!OP!f>Up6&b=hn
zQ{}^$ksMM^<m5hB7Y)?>hF9-px=tq#OaiAZHKka%r>NE^YO?<PU{_PglYmGEAQ;eB
zQ!=h`RX(j})7Dnajn$IquTDvac5G-s0yQPsbMT4RF#52C_tB9oKEmpVln!IxVXaUJ
zZEYPL71e{8`lklZhrc*GkLWabjoAKh7;S0{BTM$yp~!z_R&2id>>V0i|M;^a?f$E8
z36Ift297s@`=i;)=dwck{c%*gl%zOnz-Acz5sk)#4OTiamNS_9Tp=ina6PRp%Ekr8
z?~T|swhtYFx77@U5_oL@9LOd`cq7iqX3pMklB*Eo74gi?KE#n#T)c<-F;(L><+l$A
z09k02kJi5#lY;>`YXW+;Z1@3k@Iqd$1|ycXR`>ovm^aJ34VBSX0`GktI)IoE$=$#W
zei<w#Ej7o9<2LB989$}k@em9vp>W^^tpjc&f`HTaRZDAiWM!Rv^Qf6yp?sJ0o}bjU
z<gja1ftn$X`Q-1#Ef5kk{_EQPeYN9Q>4NijX=#>Y%nU~LFKg|Bj?c4^UsEqXmq>TP
zbBxbsU2vws(Z75C%$J}yL9lGmRlQw%)J33X_Y>wBA;?c2`;$h1z&1QtDQg5sKW2yW
z`GQF}UNhi+Cnn390_YX(-1rD`Y8NwR3OWRtUTA*BYqm?zJM?f5#KPDQrJwWqMS|`x
zi&8X1DfE|ihTRTX3a7A;wSqm)kY?>F>Liz?-E3xp4h2Fxnhi>?H@2>G*~fKZ>!Cu3
zM!~(sn#$@T${6ryqO}@a;!A8XoLNg0Qa)3%x8+`7M^JIWU=M(5qn|aDem1|1lrXpw
zuA@8G7FTz)Hut+Uf~a!RW3KyeP_pbdeId5XD*5hW;-RJGa(Pc=TqgI6wazQWSHP1e
z``vj<`ta4OKur*+@|<8cb)FTbntM(0_wO0-i0d&RKV!c1eQ0L)s=YsS{tdLSTa2kK
z^_t%5<3bem4Yb4`fIZ|R-E#BVbZ|1S=h(o@I1nO039?^<$HcB)i>j`8TM3WmCW!8@
zT7<Rcx_w%7821IB{^3qcO;j;>ynCv-EaYCjEbj93;(n2~(jml4Y*flO!PCW_=MJf{
zv7r4~RbkS-64C#(+zsg-r2+l<@e>hrpT?%GO2PT|y=TwvgKcg^l_qzA2HF)gayEQt
zfLYYs#%rHeK|$~y#{9BA6oinS#;eR|tD*aDDHb(vlNqF%C(%V*!^r=>a}x~V1l^;E
z)9^QP9YY0g_aEyKqiO+MNQg=}cJGj8+NC`6pw{5C-Fjx79jFNuKCHBf3g$;rhaG~Z
zh<1)->?e`((%ZuxF-{oySgKy5(OM$yAMsuRk$C#O+4nI;9ENqrX$~wHsOf3AINkDO
zh`RCD#yyp0b%m&-hp%+c`7jvP7rP*DB$7Nqb*G_$@a$goRVvTFzny0*?R2&KB2<~T
zfiw^8W%yOt1pX2J*zyKoP?dZ(PU@HJR)%~U+6*%9Rr>$mI=Jv}2f*}wIZKg?j8#~b
zHHYJH%eROLqJO+VC~e9Ad6%;G#btLV`rVj6_#Ul4z~2lCy9HZ}abo{_Qe%>&>Rn2%
zjS{Nl7$UasKcPauMB@TANqw9}KDQK=H*l?_L!Ee9H&}9PAePW+v33PkDe~cFTBzH#
zC!+fZXnaaJIl1S^dzT&6-ePx5*A0M*0dTEbV>$*-J1b40g>QQWc%N7f5%H67tK+EY
zS%<wIH6Uw=Bu`38LPL)V2hu0@EPQTC(s0X6zfG8|UI_Aece!_i0Rm~~eLO_aSM(&d
zEsjI%;m#B=0sJmyx?IZ0w7{(AY6;{la8e?2S@=%$le>KG5ai?eW$=h`^BG>0cOE|E
z{39_wBK;UgZxI}=)d1Ss^#KpR$oF8lkQH0x#zq9|4rPI--<HowI5qe}s|@Fmk|g~j
zJwKe#a4b!fjn~u=rgY2o(j{7YaRv2pK|5|~oYZeq$EIg8uX{Z^LK;kF?b6ydB!68H
z6AVC+`C;W(POc4)-gv<LRd#m2$hG58Q{0B?!bFQT5CQrlc`l4(6Rf0{Bs%_SNyRrs
zt_&611x?82+fd7v)~)Ptl-|no;!malPSk^utopmOS13qAx%>WPk3+Jm12r4)iCx)j
zkw2@{C*K3&gF8uU_RhT!CHA{rVkBGLZ)T|sfO2!RkO4^nc%5sAh`$t%Zbv??VhHr0
zW)@+I%Os2|S$7pcda35}^^TeKNPE_3gg8D4#ZU(0NS*m`tsVub+DpLYrmxxi>R|sc
zrXV(;@-4pe{>21G(}tO9ZeLuYTw#}Viw~jsNU4%$-#k%!f1<M1k1;vf9hz-a_!ijA
z2CRL8B&}~5v}Q}Qnt6BWp~g{Lxa#)6^VX4#9dMDxFlYhqzHI~M6)q`X^*DCf(6M#q
zR67toIHy@U^g6x#r`v=8vu?Zg$XAPcx9l;mmBCU_+d3#idM~C-fM7|{cgv__sC;_J
z^S@!(RA>u{y-pOYB<94L(8J2v>S0XjyU6H2e>L>YIQuIdFm<K|FF(W7XeeB+{U|=r
zW{d>hHp2N4%l!6ANL#0vW`ACOxg+|w;-}NC3*!L^1ashBXimNoG&>zF_VKGaQs4XW
zh@H|UhAFENUso*`aiubpId7s@(&z7^9%Zd9qdCp}C%r~;WT|i=yn(}>>kBW1fHuPD
zU5|ls*nCH)&v6v{anz!)2(Xkmw&TD!DQ;CW55ikwqN7<+n-d8tC-y@a`JS(pY9%(6
zsNRPazIUDUE*y6TgRNFU3BOgf+|)=+4w6~q3$sTGjpv3^(e)dV)>_3Jmv{ihCy_tT
z?%po2K;9mBg9>0>p2hPe9pwGCxE~fGT}WoP;p;CXN}m|RC_k>Y)K&N;(@=Zg0x@+K
zCXBvEK-Zl=vwOI<-0i=B&oc;ByQQ}-J@pzZo`pKgn?Fa#=t*XeevD^^Cv2K=THNDO
zsroD}$7)H>fcX%mRMb18>Z5Orsiw2qr*wr<m&g@i9Amri6OLhPosEZxE8#gnkPGq?
zeF~uH<3oHpuzP1rRb9G>u7)e7ogV(f2KAB$PuBX^Y@hu4RH<fgQJrez-}#BLF0Fog
z%AwfiSp70UrNl&#f35|%Cla`o3U=%25V_v#Ry~=r#pYr&z+tQ3HS<Q<(@z@|MBq;}
z1Af4@wKYJ*07vqr!0dNv@})gm=Gh;6;8m%(O&@{~Y0!Shvr8uV-`TO$M&n^f5D>|W
z`bk^~b?U%-E2n|!7o@*bVCQJb_Gr?_?d{#}aQa31&V!RN5tHX~bkk&majc63l@O?T
z`<(0^J>b~jG(DhoZyuK>$>b16Lu9KOOK<HGOUmiEp;LLQk><Gzv<`F!!r&V8v=pa(
z(p&Mxt<}7X4nCfkiMQ)Ho3jPYT)lmsNJg4lZW#F;GD#oPZ(dC`8Md&h@<eDfc8p_i
zh8qA&9?BN!KQI>Oe1(|LJt{l&wTo88|FmM?^3ntYTbRn$bl#lWOFPsl_e8JQ@QM88
z=V<!^7X&m=K*i?&k7FjG{}At2MA^g_Mo!1tSMLlYLhOU?M)f%!>{~@<ok6&hRiGxe
zDfhPdBic8!cK|{Ng8ugsD)m#kK$LKL`anTX+R+&l>_)0hjm^5%gI~8eK9?`-%bmLe
zQ#>3!u^(q)*R%lk?y&Ok>et%jl=KDhdc;x3+~2<$O5YIMI?etEYnL%h@5D0Xo{s^=
zw7+iK&k~S?GgYVPw?6oJK<*iyY4BXk={7Fo$LdB+z-!Z^mOpyB@iiC_C1rTm+Zz{2
z%fS=0lU~0hMv*H8+WLR$&(WVbX`sXf9p{<tFF`EWJmjQ3_>?}(niX-;xYoYjE%YJv
zR)L3w{%Or#pyuHXA02{%&#Z??iZjRQjn$Eskd0(sU-?o^*3+_=^n<V5E+o=ei+JwP
zJrX)v9Nz@FfK_fwIeF#CGHHd_(5$StK#!?zZa%ym;AsKjQg%|$94@*2eDc8;W>IRV
zq3^ArMfV!bPhEy38D=YbuMBR_L~V?J_Zqjb3$jSoHhK+$k>XzL<$@MoTUS>^u8^HY
zZsmJYo;U~Ad*Y<MO;z^vEB29sIDw2az7S-VC|aABa#9lvUAZDt=`&a1{XAtMDaA9$
z7PmTn8gjb14kTyy?*}uDh94c_vU`{D$FJ|{#rtlI3i_;%sr((8n&LdPb#Z|dpSs*O
ze5s*&z63nvlYwUo;851jG%MvC&%gKS<Hze~RG0iS)jXqOLD)2-!;-d?y)yp+85jjP
zHMpK!^gRaWWJ4C!BAZB!hL22yP(ax4WjvQnXedhBC^=BGU;6P<sC=-6OmmWT;T8?3
zQU=+}V6xl=5l@^dhP_qiY2?w9G0oc52dmy)P9k||c=X`cmWSc$NoGB<VU^HA<`+9O
z6F%<{seXD0<OJ&<K^a->qu(NV8JA1$grm}VqUgwFwhcfcwVr>adgAy21O}F%LkaYA
z9sneRdNML<TrRW4D9zE8E~B$pI2vE=y36RuBkUkscjEA`e)odiztR4dY%~)1=LIg#
zcj4%lmMvlLlss1kkq2m#0)yipLG^WnL+?3&D6-DITZLn|#CHb!DK^ia&J8SsyJ}F+
zVhy4Y#0p`;;QGV(cTDP>eJ~Am6h*DP36Z@#=PIK*KHr6a%Y62JbFkEy*X>JzmFsOU
zZMs)YD1uFj+vL+>K@sONEl!~ow<DEr;n*1GzDZFS_w_o##8I35^?8u{>DF;>slT8k
zG%PF`zdh@M6_k`78YtiuSwfTs8#s%V7)4c{j8yQi3^kl8lyT1@@ayx{!Cd+|r!GVz
zRUPzu3zljDh-pPwV}#TD0ja=Wv@>o^49T1@PGtpOeE+f`(@*3zX(t<e-y+#u0U;Ts
zrdans)X(!aF)Nu{br~3AOH1E<FS-2ud}p_y&ghv|EA;QyI60V-*UqhpYG&tIH&DE}
zc}}+?e~2o2uR)qdR)>nKm(f^ofZr{%1G(GA_5b#4JUu-r$i)&cCq=)Ox-%y80xGX<
zd~$)|0iJBTb@&A+JR|ZQu0+ysAK@?~`+`pyDZ*oDku`MUI4Tl47hDgk9+~hZSf39k
z;L`uC{L>+6momMH(#|cH519p}@Nmm@^pxyPL|+STxa>T^`P`k}^(~Vvt{x~qECV<S
zIfV%?XUcG95N20mDUmvV3n!AS;7*q=9i4S((w+2<Q8wqh>xYiPJmDh!;pWECxQX@q
z=}Ogd*~BNu;kH?T#7!;_^m*^%j|ABO{m$tx7uF^p-I(c=Ch^J14Z-XfwpeuR%@*8d
z2?Xe$)t}mcgmY?q#%B+740FKY1_=GHmX#|7R(XY`EVD2B!ptpgZGk79<UBQU;;_&n
z=K%q*V*USiFlf9eK673_PnWAU`4peawHL}4HW{$g(^qF557_v##(+81vw33ICKt=T
zAFio77v1Y1wFcwuG=oRs&QE?(D&D>oqAs8EK1+bYNrwJ@pnWgI-~_c7R>pDHOXA7w
z4vo%NEoG+o1C6a3{f(yx@L^f|+|3e|V}Y}|Mf3MU2#|tAyuFE?Jl6@!c0g;`tuowJ
zW@8}d6ZeVBZ5oOFEm$G@sc@*Vl{qK3Q2pa40;f`b3PAH?&=0Qgo5Nz94oR5|V6(%x
z$>)*#A2WBu(pDzQojPo~v<_oba|iMg<)Sy4CI!ewX3_#CFdIt!3Y1!}3vR)oT3_bA
z!>I@g@e4d3lq7k{?Mhudnu}puly@O34of(j4C{A~*>l7GN}mtfL7r?i5Vl&SztIE5
zei4_0+&4>&@~JeNo2@$sdO;r6JnV}SE7?zmIi}j^l`+@Se^X*|%unc_aDsLrQx3ie
zRxrnb%1Eh=YZp(w^4@fs#0D_u+Q!5dUuomI0@y+#Wns_)#~6R(E9~MD<2w%j4lh)W
zzP8g}^@<;4SAn5v0k6p!f-+$^GcO}BtH=+DAqPs7q*Yr042g~{#2g3c02L>L>r1Be
zHyZ41X4g)`rx%0ybKZWA#@w>(N2E~nm(XO3$9k_X2FiJ`B!93P1zB{z)R^*$veZf?
zhWbtNV-Ms1&Svz>PW=Id_W`Bk;j8!ak-cW7Dnb&Lr{ndM$y$X8q5u9ha1aux=NA?_
zl)Pej+MAPyT}X#}iw|ccOMti?aIT>`3SjEWr+ah!;EV9n^Xj=hmZd$VS?Pp!P)dB2
z2oNtH{GtTkTky~LHH)Z-$jU{I-%hF0`BHh@)7bO^Kdb7Wz!5+N?E&aHX}HHnx0JBC
z#P<yKO&q33afli0fw1Kef#R1pU<64qbHW5_maT5$K+L2;`*Xwxv;c`@=s1{}rvf$W
zp60oTbIuaLm}4ECT46At*4Sd*jvZ@o@svdOCFc<FCM~2tx>WRVYJ-J2&3RpX{;Gp`
zp;A7(j8P_^ig35a0w;}}p42;})^tHj`Y@;_?xn+jh{%^rO=0rPTC<UY7DwUJsqkn(
z200<=(Gm!S1Dc1sZ+QoGvK75#D)E)>LEna3s7(rRefaO7@o2Srd!>!KSIznhoQZ*9
zds}bwr|WoIP`R}`7WpSatH}doytG99cwV}bGJY^iePKa#uUz?TZw{zIgic<%)g4EE
z*bE1Rwtez_RlYf1<h=9I0^>DXk>hYW@+@m1|1kgK@W3|S4s1kd!4I==#Y&?+n&)mA
z;^GTe*~P{E!a|`=)IxxLF%rKkHn7h5{S%FCmR#JmN{FjiA|?^Ysdyu^N?&31Qhx-<
zuhxC>df3~Zb<e{1hhoOVMF5DrRRUT-6A5zh$Uv;8pog135?$CKy*FER9OdgKU9H)O
znC#91Pp_%19bUIv4)2|GD0$6tRop7@sBC!l6r9~(B+92x4*q(bUbu;G<h59ooHQTW
z2?_}KKkxf#u$pRnR4>83{f2=h0_pyQ1f-}{tq;FRqvf#su_DM*zqJ3kAlz;0yu$S>
zRw^(BFi*_PfgQJy8-^5|$02E=-g!XH5fE8W&hyf;T~eZ9SO<I@X-bMc+gCvjoFK^t
zZP5;8x<m2{O(TS}Zt-70t6KuRO?mO4Q*b^ns9#WKf)fUd`Tb9~;0I=`5pT_fOo`wx
z<iCT5<Y_87@~w`(w6s>_>Yw~3%+qpe<N`hrQ6PeW`#?x$ZRIND^m>UxyA`zY!0Rfc
z$2pN3qHqMJ5i88mhes!>-K7)Nu|K3#EwgKM;pM>Q0J8tYH@cDuK$0y8HqVZZ=B+}S
zn;(?gR9lqjPnN^o4RLqRZv6z!L@xQp{>ff;rQKHv_UbeUi^T#!ET~r;m`Rs%PzT_u
zFymyE>n$J&w1mC%1T<1HG^#sS$&NahkpYozd9Ag?h$RERc}5pt^JAzIZc{%Ff2TOB
z-`xusWi2ZoQ-DG0HNet=nlu?&m<bsB*jAvvL3|XY`FL0PS|&#)W}1--8*z!>sH!yN
zS>bBK^P*f1VgwXl<4G4bmKldcMyAx}C*OA?b8_98HZ`^uyg~ehzwQrcVGrR%IYcOw
z{u9f9>rDK(d;gU0uXoQ|Ef|A16+E<2zW~Alf`IkOpsL4di&s=fM->?BFSb|R1;lN?
zGo{kA`<@S3*pwc}M6Z6WKG_yTd!?e0y6v_qVYYaW)t~E`a_$O<Y5RQr6flDgomY70
z`x<+1PVP>g^31#e4QXE>Ukg+Xs^}@yY9qei2G8-YG0uxTG3x?%^n(9nW9&!3RNWaR
z<@WyS$m&2f+-UvZ-do3@^u6)(GxELqOU{C?`5@a;_pNgk)+`u%CTl0YMy_X}AhBd%
zYEA$%>cDSr8wqgpG7BPp2H{?O2oiYIu#6N})FU)ey>$!sbPBmHBFq6F7G2_ApX1^(
zm=*E)qN+DcIDQ57h+b!wpaI9kGqF<tOjo>&9)Z=|S1960Emvsvus9Hct7M_zjLn@@
zG=QVQAds!uvHYd<8|e;!Ij81^-ro!GND5G;Y-+$<)b*<bc#h!ZRrs~+QX;rMJ6A=O
zzDtCR@qyGo>1TgPb6<>HCNx-lH58vUymswcX`M$h?j3N+rN&kHpN9rb@bvsc9f0)O
z3x(CM^ix6A5Aq2rwZL}OokA@sZNB79nL=7ada1vh)SQf2yT=7omX-AhzmAW8IS<0=
z@Buz4B2~XS!x?}b#BVvN9oY%`-hQTVbkO!bzJ7@uzqVtXx-tR>i5r`BOXurK-qTGi
zwt@SgQU>lXEWKFVaA;{Y!!E9f+P+v9JDVfZ-pTk8aIiK}f6)Nqxd{nq^6t*HEt$6*
zV!-OQe>8UCcufs}U>ti}l#;2huhP3iAbKw&0MX#)7@0c05uRo36cCmR=y3dF#}{ji
z9&~{uul2g$K%L}cbpEo1N>%om^QHl`%mLk}j^C!?lI@T`paB6l-V_GN+wV)RH4GB~
z(R(z%y<6^3Ad#G9c@dnKLmZc>yGR3gdh4OT^=V-+@pPZax%c`xxt~|+{)s1^X?g1*
zz!7^*E;(z0MKMeCF@ogVtEyxKe01R-u4zba!Q`<I<E*Aa%+E^UfH2#f-0rw*^E^P+
zc_zgQBoBnhp_DvZ-wo%p^@}qf<83nm-aR`g+DJ@W!?$<BhY2abO%S-h?^8K}gfjSe
z^lwqWee=fiXU)nAN3u&_qukU>yITK!3tNBj=~B0v8LLWO8W*v2fL_pJ5iMOQ#rZpU
zJbua6*AIvHtG_sLY|VV(-x(bXlDI!(x4~PYuRr=8I8;?<7bJ}YTXdk{U(qp9Ge}pV
zO63i7#aCax%y%U&7j_qG6eLZ;1QD<7qvwoE8I>o<KGz7TW}cS4DWCJ8nCS17zNv~f
znuEo7F!k<wDcF67vsOS^C(C!exy}IM4RWuezwj%m^4*qfX56nTsK6G%{NSWpXaD{w
zmUskOkkwFcdF=uF_c=FzJoiGf*77S5ka+qx%3bg>G|c_Qzs_)nq6E4J^sdxRM@J4N
zcPXcVan0-YW$JTK&#}_<(@XCspdg6chCxkP?8%sU1EyZHueLUy1PBn|ayQY^s>u>E
zu7A~tep<PSB5b8cxN)kpK^JLoT;^>%#0*6~dqtUV=Wl@Zf5KMAb18YQA*vSJZ2x=*
zTJW5uxEHf*w`3^@GFBBBD8fxh1*A@|qm5)XIf=FYGR80{gmdTQiguAR1!{5|TqOqL
zlG*qt`FoVl)gS=$FDMvX>EN<y3el4`(gw=nOAL@f<AIC{AS(FLM$C<^4_n-FISqVB
zdOa4wKmGIc3Bzf448;|n`}e;(VSL{gj>u*^`M=9cFlLb%!Xu{iLb^0!mg!`f4uyS@
zjM;^muDU_D`k5zuD%KdsvPg1+0epa36_cymUo7q{ekX2y(hDq=<oo*oxB<J~TXM*N
zJj%pNFMoRh1`%j!M^DwGaqpliXElqeQ@*>;vwO&B*Agxi5b8l+#U_s2W)p&Xt*7gI
zl0Qq=Wgg|7tNv0273|U)irpUHtl>dqZVH@Z{C=7DaM_~vnKP_Kkn<f$k63J~T+EE&
z@?g|5p+ESO8V8c8Mtyc@)Dg&ym}tB)Q6QvCe)#%>7JV|`SE0K@bbb{-7{Asx8z6R8
zgP+ftyBa=T!EKLnJ{NG++=}l`M>-o5m-sbf7{7gI#$Q3~Nz9QgHK;v-KT72QW})((
z`=l1H|30knip~2Mu|yPH5k)S?+TP2{TKVgF?Z?>$1q@b;);-><LZ48iN_I0N*q^1$
zcD^TMLO4<o5QQ=lJ7*PGtEg)EYOTgpVpXsIdOcMGb*Ri%cJVL5T@zEt%dJVw8l&^Z
z#bS5P0hlA*FQ$5OYg^XJd+TTd%)*FpcX#z(i5*zp$E<W2EAEQCeG4vXbW%;bebx(h
zVsPgE%8f6s9=h#x8K=ECoZt4si04m$SX-<y{h$gdF6CrqWXvmH0ClMD_#hx#Y=Y6J
z76Ep>Y^CXJ9Xa>JkK(~$S^;3b;GD&90tqXS){$mUvsLW{cQhuc{+zVW`b-o7jh3ak
zgP+D{L!*b7fM98+)ZL8_<;>~Tj^RVjv(1irb_kNZQX)$eMs3iBiu|XLT8yuIl=Vx-
z+9npZLqlu2F~jIF)TsN9>^J2<$<T=}L~_?RjzTWm#u#Gx3@UuqA>0mk%Jd+ttCU9H
z%>%bVLBPzy{H2BVh6Rw}z^b&c(B+<En}Wvt>NM0q?5TEwa<e_=QRu@uGmZ475MuJF
z)9Jb2C0achvNDz3-Q72bGnnLXs?|V(A${@hUJzO@f!n6e;YmY}e{5(Ol7Av!W9eMQ
zeRJ}KqBY2KFo9>d`h_gE5(Q5QLif{e#%xct@W@m?!();bA5^%lP1Y^}3oGS%H305G
z+z35GpeCGY<A73Q@i$$fVHq>2ISYZ*62oB9XZiWfX;}+Qal;GEZXiU0I}=rYVFhc!
zGu6zxB?%sFdhLKRsY#o&p@&PhcyW3e3K_g5u{1C{J^OwZDA=|&N7JkiD7i?l9fuPw
zIp|LdMDH>mkMfy?`KdF9&sPH=tK>Ws3o&3he6AK%eWvv!bwB1`SxBHJRD2>A08X5w
z8wd2G6D*1Me7=!I*(*1{$2t>~NU;lmEP$Go3=TlpX;3r)`y?15W_2g3yu5BJtylc~
zTDuc^?pEwl<5LRk8+Y&C1)tZC^U;s5N_mqfeP<Ga&TTwFMEl8j>Jum1n*^2>POlc<
zfj$ew|5khc{a6mN&}p?$$8~2LQII+v(C`o){ju7i)R=YyGm)2PvKGKTB$rOwUpasj
zx#5SFG11vcA%<f{dcu_w6+lG|?V#l-Fbo4)%vudSdL_+f5yH*?m<<Z13C9;Hn$!KB
zNZ=#{$uGM!gebE;`RB!-?74ZXnBR-U2xR!A(z0SR%zD%I59zVwLa1zIt*PabT@?j?
z#Rjx+xG1|o+I5QNuzp8w3Kxvs{leVZs=H6k&A$zQ#25psKz2{0Ed+M8P+(=KWR9YV
zUDi|Q2pFrEc^p8M)37N1qPgq9eDx~XLaeyWPnZehwv&-vP$g^Z)m17}pik%vme%?`
zoz=tf7=KU)sf=o$gkgDf+_)#}rA6PY3XzUjzL42s|ClD4_kesw+f#f+Wp#b3_T&Q#
z%P?<imd+_&lD^sh;~F+Nu)yAx#$+B=%ap!5M}=SMAtKj(_=12F{=0~C-1eC?KE=4j
zhibAdFKa?J>z+>(oyC+!YukiR)heCY8T+(t-0G%{_!&`QfT{r-EwMo0!NSPY{hRAn
z1O&^seEg=>k6(iOKNWx6+g^@mv@U-Nxy51m%^~Hyt=K|v6(0T$>16u_P!D1LQA@Ws
zWz}vBezk*w$J9&UqF#>$3;%uitG2psj>mMD;HvmhxX6a3I}pq#{r!*$rRWe$Mo~Ae
zGm@dLJ2*L1pPB_k5=1LGJ|Xx4r2zL>EPdZeFNA2i<u0>bbF1W#cS%G7u|}ZgxU|d-
zbRPmhHt9c+evv=PqXBO*JKFIbTDV7}v3T&P0nC|s1U6ZR$nJ+a*&bj@u9lA}7#G~T
zS$X=V<A%G@eB>MQ9U2wvG-!g18vRB{%yFCgGjwLD)H!^-8xP|@ynuZokr&jkygt9U
zSO>Bu^4gVw+~QkOa&jRyA18XX>n7-B_wwD5@6E-=ck~BeW;>dj|9pze3<Kuw=^`_M
z+@Np3LmoO-UT0NoQE6xt;GLNAurAK?Qq9Fjvx5BjM%sZG@r*f1$xeqM1t2Q(K#@@i
zK`?*xxXbc);i}@;YiBa|4f#8~@~rX10!vpNZcsiu5Jp8o;PCLL72lD{qN(yGH7@bY
z-<#88ypaX9#vtZgS|%-0Px@tJt48a$+v@noR-sFbJCWWv)7;0FZ;^C`!q|)^1|x++
z{#8Bh{*uqN<G;5=EOdLD*}Iy@{4M)szZteAaLylBb_C5Gvaf`0R9|uR3XCGUvoJji
zA*sya|FaNTjE|RjBIEgNv}zrM+#PM!FXY=W#DmoMzR@or<p-qvwc4c5YJq^iZPe#C
zQPQ$<8rG1fB%i$rcvV#RB_$>QxTnZ2+kM%aYowe88LiH44+Txtu%6XyA?k%?>R~<`
z<g?2MWRfg-mbh%HMcP@4qG&og)vRMmZdJbbW@dZ4l*ZW4(S(b!Rs6ity02FNS~_M1
zkQAVNMYhZm=~d$w7^ygcwaA#eS`<x9(bdS@SPmPM{s51rn?4GcClaxcC0yNT)UK3b
zs>XbPd6E0^wCvsV5w-0XWa`RJPZ!Y<(=}6g?~!<|;|4Fn=z>ltqfuNB3Sq*>U#HO0
zc=Tvy$u97$kKYl5IO$i5bAp_QVhgD2e!NP+!Agyt#;fP!KAb8ZG8LPOf4-sM#&xzj
za}kWKRG)}W+&3w58&M)HnSy(_%-w7e2FcmkCD<o07|bXD6x8t9s6^WQ>?e=u!(Lzm
z)Yuh#8%)`jaHg`|DGFXs_|ScGHG_KFs_$N^=2}#T_{P6;`8H07nz~ATem~vGLmp*5
zlvSL34dn?dhEsF0dS%(BD_NN?b`>Hy-YdmUFxbM7a0Pv6=a7&2D}+yW*h0>d6RUct
zggiLrvu?j=1KCt&WK&cU4lRftF$=-3l*dBuHOB|wX}NYrnu&T+<&p{Lxb*w+->n>e
z*!$#IiY<Rl)>s=Yw?O?0C$Xs>3O%m?ajqs|W73z31%msJ{{agm7?uVB7`uT9O#>KC
zN7nlN`M~S(m~}y>AaJaMjtLM~Y>HK}99AMYINAf<XU+uqBlwugXtA-T5&~zglBNM%
zeCN|MJ~YIJyQLL)ow$09aDscYHJy*?K0qnlaHrKQl^pk`BY#Podixl8m^7}d3ZNdJ
z0$*9jHz>G-=INx!CBrC3ghc$)qIjib@I)Uk1JKq+nI52}Iolez1tLGSj8<)vuajMN
zlM8t4ZtM?%);JIr3sg3ajz1>7Y`^@ebXR+MWihM>iA)hOqY{ZTQsb|<3AA>DYin6u
zDUQT$=@1^C!JPf^C6Mx|v7Qd7YJEC<@a}8zRCNg*<qvFcmKMLsRl*CgCxvL@MY{`o
zSMJ|_%nL#}OREdd?@H1XCy@CS5aJXAb8@R!F&{{A`(rl?mp5<td#<YY+b4(<$T@W$
zh3hQShn%(na{X*c<>}I69t95>5YUjsulHae{$qZAiEZsuU>&{ju-RS`@N0l@9Kauq
zOkD^K1H=b}#InoL{Ud5{9)P<|)$y<C*<n3WbU=t$0=G($qZ!C%2M%eysqy>ZB7m3}
zDs1EvDsbP7;@8L#Xh+5S|92hDW#YlSeKljpnM6PTi(h710@>pnG)&**0QI#1f(69g
zuo0Rv$;Nw>Y!<#@M3s0=KK8WJgy4z(8xQ2=h;`-}9o&w?*J>c-eKD#JBUDv$ZGqlw
zX~n53Z;i)89NfjD6s?-u{cz8TC=tVUe{dlDgK!%?Poedx?m(--wC#tEvs&$sA7tgX
zlq?!wT%+KGsY$#>e+VtR*&RT`zcTXmaG2wkt6L37?g6h5P&rrBU0gEad9$RKHV@VQ
zeYA9a<E?!ULZseK_i2^7sl3WtSTn!tDjnDFE8&1}%#d;ZazS={yTsbn4SUf5?pVHj
z;63|<Ct6(sJ90Wi7}`<~dW**Ag_beDvh7%M0-MUJBQo4x<;bxHJMs+m+!((*s$Z11
z>i25RFC?&_p(31{9u0Tech7Zeh>?V!0~2M+AsboE+!v)gQK?y}g+0f9{jP!{M3ZcX
zRWDVC-0Ka*!Rw--<Nm!980rtTcancopcHXbvwO0<=?x-E`OH4u)KnYT32h|a_W>7M
z$@Pf&Yzm9s{RB$xG<87Ds&bWFzhht<7rL)mx+RO_di;LD79}Bao)%=I&Vako>1i8M
ztXba$YPO|Uf7k<m^W}_lp+P3c5hfWIULi!0r4-J48vZ`j+DS@Iq#=NM{mNUg6#>R<
zoRh2a9X|Pfnr%$6Wr1xBN-iN6h?yhzM@~L|nH6#z<?Wj1F?hk?ladJ-4z}6Sgb$y$
zC~Ldc&jnB>ogqk*M%o+n^K2`KH8!GIU0%8kkC&gqD6doek^{Laf%~mTxhyopcvWfX
zRS@WOb66yWM#caK2<59j2EQv%`lqD)6y&DhdV}diH!Ae`L!cnZj$d_p^xst@Kt81D
ztd)_{elPeh<KhQ<+-(iKq*|ZbbuqpgW&=~+2PB@BOy7#W$<hzpJKq#cR<LlQ5_eTN
zFjQMq{S1>rz<3v_M9glW0`Rc3372Beq)eS4_uLTKIKJ9%eT%SW=^w&H{^~dGr)Rq1
z&<qr?cryR^hTgFm2W-w827Ys+U`)yPKL)&d)nEN|Zk33A*0vM(aoYsU*mO1YOU6up
zEA6*f^1eT~i7tQ4?ooJZW|0RXH7@|qt6`bb4@6(2yHD-B|K2#UJ3fy>$6G{?WZ$x?
z(T10U_!$dokM%D5q^ufq)UScDAGMELbQG;^Rabt4MarD};0ZM~i;K-o0#=!=e*m)>
z7`@a<J8huWtM(h~c5*IHBE~@c7uGWVPfZJe?J?UBBIy)NR?)H`@k)-`5Qq%{!e{Wd
zC`zw{Ia6*xsvLulKWtERXeVJlzlOE5lO@=@`i`*wAI9D~Dy!{#<9!JMC8awRkXE_{
zM3e?eX%H!;yBkC)rMp48yF<DgUYeH%>5jY5bI$j7$NlFX|2ShfWV83$Ypp%koX`9`
z8A#RC_^6&weKvdOKrWjU{Wl8GK*t>A?1M^CFS=4lvi=)VOJKM{86qg=H(`BN0RhDy
z1aSv~0Lt1%9GOAuNKr11o;hvm5Z#>KU{9DQ&BIpfFZVzOP@3|<zaB6A9G}v7e#-xw
z;9aC7p^n>4Vn}IlaPWPG?%07JBoyyWN`N@>ShfE8B3kF<>~09bz?REpXBhe9Onr;Z
zSI6psd+c%i+E)q?q3tzU*f#eA4lK{si@9}50FL^)7Nz$J^!McSz81Rkkh{5Fsd{&N
z4hx>tX}qn?19>gUMq04e1;lt;D|=e37>3?xEulMGx{#XiBf&?PBUkef=eStkW2_oP
zfD*Wp{D**;HcKp{KlP=FC>9N<3AM0)2sV8~8Yb6O_EaX{@w0Lt9+Rcfx3|pkN7%nW
zBV~8E5lWgy7Y%({FMByl<d1b)Aqh5DUeL|HKFIV0BaM5brGWip6@#<BI%nBi!3U`p
z9;xX?D^zKqWeAowQBgx>IhqZXw`!qVZ9>~SY}OpQ$lgeM0ecK8er6*X!!_$kf{u%x
zWrKUft>nKzGX-EcwQ84)v{HCTH=M>XBAB1HuY_I;Ipq$RvV8gSg`$!B{`fW_d<J}O
z03xjbKnLdQ4d*TauK6hizkT0L0U!l^f|l2OCMkFz%V)R6vsa+n2|X*GM0))AakBfN
zyLvIQ3>$(4A_M{?Fb4|&B6<hfKjy4vnfYAmT*tbA3D(|kCsfzUi}N-I&S>5K{{F=M
z>1aL;|HpF!g6p8XAlz_cBKsEbx#1S4vy&YcQ#-*+)Oa`<0OAN8Tsa{swl6ddd0`|U
zDz_GAfizIw#>WO=DUKFFuM@$wm<fIkV=~q{)_sx1KZ4g3srV$fSv+}Yq!u1?xxuf#
zeJN|RH}b+)+6(B`LHXQ<)(>$YUSrX}{VB6vl_&CgKf$Y{RPQ5~)~^Q4be3bGW14m@
z`*nR~(7hk?P@%xCeh74w#P-5h1mG8T_hh|`(UyP)rD4;5JEOI$tE<*-8yN0X1@bSH
z7_0-OhE{uG#It(`1u~JCn3(fTItopz@e@hjfakX>XJjCO2izu%{~9UqKLr+g(Av+l
z;Ptru_6a>8Fd9h6e1-zISgBzVQbc?Q;KkJoena`{qpCXYORcH3M5!G?$F_4OQJ_c_
zcYYIkJL`ITp&IAS28;=M2RqL;<`$&dgoRG^TotaL|7(OmimwS$Vt}D<{>oSX5Yz}O
znl4ORr;QRXfU8c_hsgVWA>?G(Q}KmJgqjN~s}>5>#ayTU1|{WyUTLFt=0YCg9T!x$
zkf)tk1EN>;t#<hkqumufqAn5ffe(%YeAmp2IUy-LA^DoanX6sqkAGEYwG5@57QpPJ
z5OK&TF!vJ+4^XilWj{+dL;)em_DsdsV;vx~!qq~DZ;rVV)cR>11jKO*S!W?Fz^I8u
zi^Jl4KUHW}n($8V<<om8y0)Op2SXz%Sko;zw6#E0i`TSmCh~XF)kLJ~H`9>}t68ps
zqMFN~hbzLGO&^_z6nyUCz*#jgAWJ$qt)2uJw7tGE!6J*_z^15kHebEY91!B-`164a
z36SN5)UWFQtOt;GpeFO!Nyjt+O_7bU=MA^N#P3V*^Nu%$nZ&l1XIfRr74=vkyoG?S
z@6~zT6bC$SXJlQz0iPd+h%r74-h8!!VvuA9JpDnegnUt{yJB{07a#Ir(0^SY5z6nJ
zN7<~9s6ja6f~xS)vzPtD@G6wa*<6p!$$txwncEd$6vXhz+{mO2hiG_@pO_=z%q8ii
z7<+$3c9Sxe7+rGoXAap?uNFBE()9Wv<|w&XVD<YJR8B?;#m^7+>L@~7wv`i^0Rjsw
zG@acA58avLSSi3+bG_&RNmsa+|0Cc}6p-l7r~85MDB0~cQmOhww+Ap(_&k@J>D~{F
zeePvH@#YceOQk+E5+Pd_*G(Gcmq1&v^u7CC*5I`b7mL&3=3P7&OtqhEB2V=!zKB-9
za$y4;f%b$Q*&0p9!IH4$OGl`*M9^;$zPml>RJz&y8Zsz!!=`&`0yba?iu%!$ouu+H
zbg!2vNT2*a=vv74(%D-1&H9}EUZRb4Jxz~()>>1^O}OlW+P3lC$qM-5bUw(Cngd=y
z%PKJYa6L0E&NGvSW}{#?Ue}2oUT-M;gqMuQ39rB_3pNz<xrd^2o_GcW^_&otQ#XI(
zOieP2A<KwJ72Y~Aub-Nm1F%^hor=BoG)v~>FhsqM&eiVGUqT1cCX;Du`+s5ZZ|)-9
zKzXhX2sq7aF8sqn&-<%zB4KACPL?wfI*B@Yk350z4<0Tq5VZN9o^X9$<>&&F*aHYa
zZ70524b>bGCGsafe*XX@^6kN2`k&4X4Q0Gt0V!1N;3;5I(Bgx9d;acOzP%Xea%YYC
z9nc^$e4ow21ji<^ZU7ni*fI^Y&tx=+Mb6am)c%_0SH4T#%u440m2$1WCZ_0CLHar^
z%EqR%RR2ASi9*)k<8}9xul$c%A~iOwF{U4bUY&HvxaRx#v6nD7H_@!Oz+F&BboY#C
zhQj5_H|A(<6ov+{I&CcNpc1u36A_=I`C<)C*Nm+DHno%a1A~BAk+uC5U!+)7z%vV)
z`w|mJkD!}qh0&XLuNis39zCl(Ij=TTLH`=+x}6B<ajdZhyCCsd!9B0yetcH{0Mt}}
ze#ljL0jx&B>WT|%n$I`+AsM;4E(06~G_9>SuFxJi%)2dsW;dxdHGE>uPdQCiV0Zdj
zbpIJn6N{TdZlx!UQL=vBN86>zNit-GSM6R5L=Tn&G{QWPLT@FOpOoXo8G4QuRHIrU
zv%j=xJBh@C6j}`Zx_3#15`G1ZDa31QzV{i^^5!gSd#dGK!!sCVB{3K;?c|Lm(jpTe
zMmg{xyjkWn!?UR>OouR=lQd*J@EHS+9LwwcK!}xwObLm2NWSo)@iMj__SxdR>aTqU
zWZ}YkzxuSF^bVTuOi0>RR9c)#=mU!NSHN=Awwdb($jnTwaQ#=Nrdu*qP;Gg6c_?yE
ze}BW;WxSh8)_tM!<Y*6md17`CFn}LU&WpAI_&Lf&oq~dbQPQ+J0}~Td{q3*2#I8Q3
z_YLqXbzg*UFJ~z_+;AVheLH^4&9XOXaIf9L;6RH8Q5eF7FORiq%S!{>y+7#^bW95K
z+H}U`p^&tDQ38**CN&I4e;_hO8vq`N;xug}H4~M)?DF;YQKX|UKN9Bp-#F%2<Qfds
z_?h1g@jDC16emBfrgn^)Wo}O9OnLZIyqg_2%d{pw^hBb93zfPylB&s1phrO&s_BOM
z;IX*h4$GP1nEewGwdV@*@<3>fsX7*$hW-Bmlkb(afK%!{rM#Hb3`C|2t{Q21sr1j6
zj#x2Cc?b_D`4i^nwW|Mtl%qsG`UW~87F3C)=s`@P;9<~z5(fI&T1ZaSegwzBC8%3s
z5P()zBOuAdURQq|Vu`z8lkyGJSI{tH*<l9O$yiSs5SuyircNaC%q3wxUASbR*E&`P
zdHyjF%X$aw&x>le4oI~WY<~uJ9@ROu=mZi;RPGjf^1s;-cL0Nc*ZU{7h(9ZVfY=@!
zao~{=DYhy-5gzhD3&8%M>l7+l-NwngnH|iwC8yWqV__3il=P!}fY<<DAJ#K|gN$*r
z@dNbZg@13uk-J$y1tP=fXjM{v0L=eO3cpMD)NsETuNrLFx7O3sQ^1IhjC7kNJHs`^
zToMIn$@|Rnh3!m*Ssv5f&QZ}X=$Ym7i)4^I_t)e}Q<^ZFZZzmTIJWH%R?Sya&j$b=
zlx(B~tKwChxPfayA#DPloEm|~bv`(&XUXzFV%p;y8ljZ{TAC47qT;^uz5&S*t)x`5
zHM$jlP-8%WC#V-O1PK`c2YLr8h6Si<=+q}>E;`f>N`XN(3Lm#E!{e!qoXKtEl83bG
z{H(H;$W*bkWPMJk*K0hzNv;nUi3ZY)HaeWjkh<90`H-QcO3-5%!_69$OB;GL;q3`s
zO_-~Jv{*{u8SE+cQiJ4bYOz~q$n!HnXoKo~Q!wLhZ3G8^VMkJlN$fyt80+f<-LKCB
z!&Nu<!+@{D3|L7DxD_^M8&}|g@jyoEE9e)hKirB>b*s{v<<h2b6L1%8f)l$(Z<{vY
z-lMS>(+?UhF`y*|MuZL|xQ#cmX5V*5GJEe;%g{dqhJ8*sx0cm5M`HnbiG;M0bOiZ~
z?#bcfRgSm@I==D7^<)VYc@)j5JXOr8l1sX)HL`gVelk^>X7;cndiAo)8YW}GTTTNa
zgm7D!)&2l;J1H(Hz(<`S!PR)j0A|zxGg^#MmtQCyH|QO7LTq8@c#Q1De@k_4RcQHP
z05GQ*z1x9~Q{r9xRjx!KZv)S{6)*VMgG3`Ey!7bx`huUTj?23%3@u@Dk4Hp4*tc5M
z8wuua?zgbX;vHtX^;O@&#vN;wQ1!BP#FGvR_v?$+B^t3VI_beKLc0!5IGsc7)^pHD
z<qRTAv2%T(KX(<<0@Q1lQ1^QTcDw19dq<JTN$7sFPw3j(n!jN{>e6O*GQZ<~*d13*
zP0hXLyL$|T;R&KIeaxSG<A6eX)5f<eK$Mui7eV+jq|jq_$ly1C*4Sp6WI%nMrn40v
zWoP&pcDau4ZG=cVUgKA|5w6#T_aes{RqzOHx9jF59wzl57Cf-;38lGCV!hvLNZ`R*
z2F02+oSp=6ODk2xFQ7FraYMz;OCQ4ecudpH?572L(Hrk#QW|FF&xaA4m_o;Db)$7?
zgdCqnikhPBgC!||s$^2zLn_(bM<{V$yi2Nnb$wm#`nI#s=&ai1_y!mlq3B_v5-{(9
z0jv7ekSFY5b*f`CxXtYdu17^$SbZ?mW>8dr=?~yOfC;;Jr`QMt{P(ul`(IhFz`LND
z+y(H_y5DY7HD+hn?ywYWz>B3IyNbAbGHYeglwAMu^B3hWV5}r{X$+dvKje`jf|AE+
zhM4%sk3KMB(cCD3=?MCJdb*YaN&zZDsdvN~z}bNaoeCTt_d`+^A2Bnm<JYE1_ygNe
zJW@8~!n~&@i(pnkX$IMvXEO9(Ra)>Ip*=?i_4PVbu_UUs#Wf5(fS4<S>cZ3tj(%`N
znhse;PBjq!l+2K7SSxjoKwv;N<ZTEjc3lJ+LLwr%7qSUFt~_>azhpoG2Ur$Kw@I@8
z|H3VcFkz*=0-Yx%aso#^c^30FXJl0i_GObK<D={^@L4pkJE9lBSVvHkm#Bei{11;S
zx5J7_O<;f(?XWrWY;k)MI9ZpQ+F1w3al%V3g9+OgCzvg9W=?=kF#}}MKqs*|M#sr%
zH=LGv1U?;mSIHqDCFz9!)Dui=r?Wjl0Diax9y&jSfTjxO6+n&}{Y(-R4b6*7@?G-L
z{t-|IKa!ZB2PFa0SbRXIq{sdG&fE-573^!C$KT^;@o;%3KL*Y|5{Z-x>;*NXNR2=q
z2*bJzJQ(D$F1A;aQ>S%fHGVw;Vl3^SWcE7XKq<k=-x!_h9jHfF7#T~EG$&DkS^$1M
zkH`DeK3)#_n)oAH3^18(EN#G-1H&E0@Ocd?yL0hC#qE$eU_9OOYRS5}D$}B7Zk?=<
ziCcdq7r{$@`2RnDcm=$+4rQ+pGJrrTl-X7RU&4Ha^k1jImKWGJf<&+GdV17j4zr1J
zv4GQisKiXh+wBSF^z<~DQGtZGTC=mH)m2X5Vnbr>uKWMu1_K~*h8!ljq<Z~_P2oEh
zrWN&4aGbwavj>dInax(pfF$>X#Z)!;9m2G7jPGV5f%?;Oiha*lnRHlMV6U0bIA=2n
zVN;pBOZh0yWph512Kfm~VcSn4A3pQ&flQQjjbj?;N(fJ_EKKZYn%DJPZcGm|-;oy~
z+=QYv@hgNm(DWsyoZb%VELF~;*Bg%)3bkSLRUCgvUEsa?K6(gaQ*p6Df1XNs!uL_V
zBoXxp6Lw@RK=8EldGjWpP^u#9gH-m0@<MlZ_Vv!poBVf{y*S**g>KDJm_r}EnzmRl
z#XcajiI_W|5d`HK;UgbkSvPO^rzHT^$)8?2EQTjB-ugJ_&53fxHZR$aeV58vt2(Fm
zprVkM?3kGVT1)dT$#bn^dgs;VXLS4WL2<wl!EzAq^lK9U*fx3V#o*807XDO<KGsQ8
z{H!1{DCjk`p+brVLdH1uJ{m_D{xbHqwLd#BqL8>vD&toLO}`dY?FnN0>lmEgFqP3V
zYl$*Ft@YGPcxd53@T#Ra@4w6&6g=|p29&jkxBkB62&_2X{9I`yG?vVDJ#~-l&8e0{
zB+D^99kH?vZG1vE#m#wE+@p<*8Cd{?KkMLCNPK%$_>QxaWj832Y;BWatBxU8B<C@z
zWiuaPvAi`F9Qx`~H?3WtpQ1+GyR?c0(x&&E9VN$Nt70mk#z1mbrQ#y@HU6#m-T@c{
zz$04>hDoSAAc$U2-pCPY6bhOr&L{<tKY9+jibtSV%SmlsV}qrnW;@uAWl!5oqPyja
z%pb54?|lGNvFhDK5kS-d!fZEDIdeWCs^w*Vu!VWWGhn!rB7)CAgwNMH>T}CB{x~Wt
zLnY16|GggB$B4&|L`x~o&7a8qVwki>MYjseSJ1|v6TPZ-HcxHx2qb>HG~i@OvCf95
zD&Jzozr^PlQPzo+Wh$2%s}1^Y6fKUIz~Nfm7UQ|7h5Y}yZcc$<fI$`3tj)EQF-pM<
zy3Mr!nP{d4%7|V|8x?L(Z-xd+OSPY<klqFu>nW-TtylD=8pgbKELB)fs<7$;!T*ov
zMA6sfLli4h=Y%Ay<e4UIP{r5TfRMRYBxvC10W8~|;%u2GuDTs9_Ftfsm*pc-lYC=~
zoRz_@k!;5~yveO}djLteGkKsfAj`2>htH9g?j8wU;d@@OR<AX5yP&8QIo1@+=^Qs;
z4!<Wf)%Zx0C`fSP#IJM@XX~Z8@&BGkgeNbQI8Xz&7-I!x#|`Kt)^u#su*?h9$0+6A
zSVn^IY+HJlBmJZTnsLzUzex<u&G5&%nQub&qNYy}<8~-`^{9)4=`c5A!my+UPQG0E
z?enVbmBh~|NuU%3jWW1C3@8_Uwnk3mkF@-0a!IWK*G3*}dGZJQ1^T91_w=B@D@s;5
zM}TfqjEubbm%ffAB0k&j%9_^}aUg*W@bCk?$3=QYjY`M*<heGIV~ZzVHWou)qbtBK
zbFd>wu<3HjiDuAUjf`^siAiwNrpu}}jqu-k$Y#nI6a1r-cJhqj*Wt{V<EimOGG4<!
z1V<d&T&5R6=gs7UVPiea<#^$4Az8cBmuvX?d+{1wV=2~872Dxn?Ii+f@ig5rEVF^(
zComM7Wk)-El<BTeBKnMSPnqQ^pk<w6D__3{L}eC;6ng_w<-bY(doYwmy~G@@gJrlh
z2L8M!2{_shRg+RDOdeR(4hYCe5FK*95$j<-24K#wK(7!ZXME}GZ@PflR_B3eCk|h3
zXeq&%CP%1=%ThM=LkoIT--Fe4&+7g&Xb@GI0a9L2-Mx3!XoJ-FRaSH!K6EmtIz@uB
z%9KNK2TJl;0OAs&VksHybwO8bI(eftTnvoHaB|0V*=qc5o%}^XYgJFel^58%8U)1H
zoLJ#B2hz-wQa6`{oc!l`19HSbJuSfqB(2$ExpO+u@wgxCZ4%WUVv6+Ap*0t%h$p3L
z-=>yA2iTtkgx$B;f;(GmZp(aVz(p`?xX6_MvH~ru9<8xzh$e3cM!oF+JX|j4ow-d`
zuy|pth8owr(MH8&+B)fS4pV1<cu@GmQcvit@bS*YMsvsSwEq^sOUq_gGOFaTX+_E>
zM;AakrdVTSo+^9q-nYC38K6^g@dpslODBIJ@XREDQQN1LM0IYxHvFK69k(}Db#otB
zXgvj6-GyUI(_mPgH`O|+b+Y_omRwB>GvD}32JP}ZjFw@tR~T^#-UUX4#DJ`XQD{xx
z{oi2IFLB9pBs_veU+Yt@XH*Xqpw(9mv9=9y&thG81zFG0pZkJePpA!$7e&URM+xv`
z>I-yeHn@Uf>>1Z>%k?z>dvEkht2o37{PQW^E1E63)~JArYrTK=P~=R@FNQt2nCZ`j
z<zqi@0P7T(^wUSfmR3NPo@|8DXT~r9hylBoxSZ=lFrxQ!qQC%bEUvw#c63b<P~cKw
z6k7%Fh|&Isq5~;16in`{4Rwu2J`%7X6wO}ukvv%w@H)8Lh9;EUlc?A-*Zc8;33#fo
zj=p;Yq!LW-DCSxa2oAC>>e*2j#cdF6SvOpZvF^Fe{sl<h&pZ?qx(7o+`R%srIQRz*
zekvHL7UrpN^GQ^pS@B<ej*1(r<X6c21qS6UANXPSR}p}b1}Q0CddFs{sGkSQL<z?v
z?E~(0{hnx>!J(Hzdi1~9+o4L<envSxyki5x5$RMC&jB%Di2iIJTO``0$Vw99o=0*&
zxkPZ_b}`4-;F@wn^qn=E4e;7{@vmG^@#wV5p`vbg^4v3bdC^9MQ`>DQ+ZAZj#i->{
zWZK^p`gq$(t6!jb=M|#;w=p2fOx>dQ(s5u_^>|rDQFPS^lA=>r4OznQ;SV3ek<Ow<
zdVZZ<S$GMBWO=k6&x4LlTmNHgB|}0akcXuo#0pbEbU*{7X~bm}iqaadYAoQ>qF)$p
zL`b<l#80g;y-V~6CT-8_-Rlz&;jz&XJAxYG)B1mw2^RdAxzBzo2IfYXnvQ%m^@N^P
zl#*vH(mQSJ-^{kr)xzj$0%6?7le1OOwL`lKv#k~>=0U7B<-#1gkmcH+`3g`MYw`!4
zgD|u&D`54EAJox!!w$(_{Wn%rh&)IM&#c<mT5NlGxg((EydgRDLy#XZbbMlnF8&L^
zc_x!VkRIhAGnaS?qm1-<=vRr{<wUiT)rbDBLk5^uZ%fZXm7*Y!!%M752Fx%GWBBzq
z&tKHNS(J}DLgVcO$5h^SC;!|tq8FI>0*7c$H88k1T3m0vxR0q{uhvOT*C~2niUUA~
zg_P_;A9Vy3?X~;gHX(ma{~b6Qyopd(?0A184?+QtS~z0Jm6vFZ3)jyGqZ~59`d3A3
zRf`M+0#z@a{Fj`PQ&nqNMK`?n(w!)XT)ynJAz3Yb<qvWQHc@$0`?MD)qKfXHX+pKb
z=4sf-TjRkn0A=8;>dbG1dfeSgc9)l(xGIJ9Ic1Tq%i0#ft#l@S6GFfoaN~>*J!O=9
zRgjuTo(L5WeqW=(gkoNSX8yFK18O>LuE$Eg8p)uD*iI9(^L>^yI<NXLHK4%*eL(P~
zjJ6)B=!pB@uNaCUoY0;m<&R%q8ST5d6dnC1xX7Pbd2NveB7>qi<)Hj_plBhb#^YE0
zWHJM`5uv9?@~uI?7}uTr8#NV-Li3ikiI%U$1`_88x3ut)F$tB&StogYX)i<n*;(cB
zo2Aj)`dcdPZ0D5&YxJW(kty`zA<mL~fMFvKz_}4bD2tJ53RIurJJ*A}f|1%@=f&`6
z*4}u2GcWHiHO~MLXO!)!IR)x*jY$lxrwN<+rS%W1eHd1t&sQ<ZkgbQ<+;gPzNl%s)
z%|SAY*VY;%^AHIBovnZbZjFaE{NQi{>-#kT`rSV+{mOm`oh0CiELA57rPjR~U0YIk
zZu4Ssr*pZV{W$RS4k_M<F#oser+psww)Of3)9l<&&o8{3OGsf@{<#Qmh5rd3BRHh-
z(NUgPg<;m5RD-i^o<KEGBnt~eLdqf94Lh0?T~%>C(EV~D&aT_8Q|MPP<rv>3h+*0l
zw9y<Nq0vBVTzR~AcP?NQNDPzx!c12fsYOXNCHKTPaF_BEsY?mI{djshi%|Y5w(IpA
zr^Y2qRzZ!oZ}@P<+4*a;4%U^e+zPc!8t_qFJyWp8=Cxq<H{o|*deAjN^T*8*rj&QI
zVZe~a?&ju8#d~Gq{kt%P$i7dSdEYuu#<h9fAOboB)IMM`m&g7%l<rzgtD}7{r1#U&
zU;IlJEB81IilB5r-7d<>%|q~URW!AmBPs9fvVRPH@G`T*v7sklY(vo|>#p;kOZ%2$
z!n&X?Vyxs!<?>9lKQPDetQ)H2&7O`7^;CQm_7}f0nF=NzzSX%C5Gx_2eC5IV(kX|{
z_io8=;^M+~h}u>i`mnyojbD<;7Ud>FM?psH?=1s`L#w?Plj<)vv{5FeHPBc%*Yp~R
z%pvo5L2n~mZUctC)znZ7Ms%*mPsF6_J9vk+-W?}NV#SWB-4mW2vx~Le3(U5qkG`_L
z&t7k|H|(e4Ku`#U|M%*=J^_r1$I=Xb!>wG)V62OcE5p^u&RkG=F?V<UL@XWnQv1<=
z+_Ys%tC4Y3BnL25o~5;Ml9qgjy`DOIsEgv{pU+LLGbZXQtBMcO-!_9GiuR<U6?lPC
z2Ko%0Dj}gkA;E$9xJ2sDsM9o?UWLme$?w>R|CxzEqyU*WARaxw&Us~(`>htJl2B2P
zP!Ere4rSL?KddG7J#XPa(@ml}+8)~ukMfn<2r+D@LQ6qfS;o$zo#1HZiH!#?^EzsO
z{`-FN&jhE$dX>OH9e{-k1Oe1E)M;ty;Eyz$Tn0sVkF-(GFD$;`TI36$tNMbEd+MN$
z<@<<p<4r5*Tj`*i_!bxlT#R~pds#Pg0aNksAen|yK0$n`q?B3Bpe$WRdE;m*D;pJQ
zgaRJ^dyr;(;NrYTpur-ZPfvo_MmkceHO$v{%T9JJp^w+8)Hm;5==|qG=iZ1^BB&)L
zKodFK8Jd~UH&9N>XVy)G<BF|{XO>fHZFrknry1zjpwi9GG{+$z%t@$GV=8*W7aOad
zf%H$njbeyNTVVTUNCYH|`}%g;+xbc&^N8)6N}^gTR1Zpcr%2JvZm8O{dvTkW?Q51I
z;*(&7ISj~Oqthsl-}xvgJpVGjZS?Wu+WIJm!aq|0thSKw<YW(O_PqD{iINJ#U6bt0
z=|h&)Fz7V9lnf^~XHNm=r)!>2LxWUV1$6kBx13u>hDNY;f(Vu1f5!+Bo=UT8aB#3^
zKr&Z5x_^ermg!?B9U{V&FQv1895hVeHKsXVeK}(4&y0ztmF4f!Y}PhMlI5@e8Dd1y
zp_DJ_h+05?8=Li*AR2P$@~nlUhT9nE17DFIS8w*CbF&tZigpOLeSSwnEmWeSVlVq;
zBJiIL_9Y4#?K3fNjM7q@T-q@<O79Eb0ZBH`!-qB8Ii2VP+#guhpIQ$VOG^`VRLQ~^
z4*asz<zM~~|94CgMg2rYM7&HyKf!qD42r`F&Yy`_V(0w4R{ECpwJyy;TfZAs^n`yS
z(c@KT`|yW<2Tt??@xs>^($(AhHRKDYOfLxsIwWBBu2WDf9^nvMD?z+XIW5{lt<{@t
zfA_Kav)mL<75u0FOoj-ZAv8sAIxyF1()H1NV28XG{tyHR+Nk9`wsC_^YcY(RfuQ<_
z7=68-JpX!e#)DK8Ju8JP4@Tu62BwU7kf8m$Pr|)yd++_NRh0e3ixCbP1kemg>}`Z{
z361<pZ;8?+rHExZhZ+7j5-hE+bqxOv_Lt^YcaKrz)zk=y9-BD%`0t{7ch|sWt-ujC
zPte%$punK)h?sX+(4<sCsX;2-9T5zgR{Vc=I&c;F7TvgyuU=(<N5&OOeKE*pSz`o_
z6ZH{@srlz`;QskSU@-`EF+7=S=Jkb=*jAfBT!ejhZ#S)<-C?~1TwqwF<W|Jb1>~0n
z?>RwRPojrP0dbYxYzQEnE9T$R-0mMR)p7A#aPUa}1E9u>`^1u?7n8;Kq6#aLfcUlV
z@;kS^$5PT*TT4ojK+nUU`>yk}IzuXZ^v9$*>DB62ko=U&yXU3dU&>eC|83m<nC~tY
zu{4h4Q|Vr>;@}>sh?*)7`t_$X^&E()<%KziW%3Hlt<@zTT|;x9e`b{U+&6G_*51uJ
zB1_7MQY<N>5A%+9N!S>t&em$EM@LS>{}g=lNpC!TI{bFw#WJ;l|9J3T7}j*TWXnK)
z{pxYTPvm}_2Q3pdrka}BA-fAVi)El8k=O6;Y^)8`_4aC4vVb^IS^_6&zEK9$K&w7Y
zH@XZ8xoeMO4+tE6105<IQYz=JXMHSWz@m)He1`Z_zmKT2wCy1IIw`;Nr;8rW5s5G3
z*hy|%spuqCt{k_FniM|;KD4U_^Iz?-K*H)j-T==?@#*oOp6=@>U|+Mo>{C|Nw$}b_
z9)L+fbTuZGsqy^J_%P6SF*Ch>(ysb>D8<~}{WhwAKa%8ld$vKn>=%yEo%Z@yPBRs`
z{3y%gse|(Jbn*Nc6K_32ruXEOug-aWv-Dp1ZlGTtet+zH`-1gT<zln%)Fd&ja^45j
znzGzq3Cf&n{&7~JJN#Tnj+K*DNL7Q*M<X;}B6m#_=9tcQKGtxbbU9ioo@|=sIlASI
z)Vx*xZHlixZr&U?x|}ZiHI(Q*|B+9k(^sEu3WZ?>2)GF=&6xP;tI>?^2ImC!%RP;G
zr{ANVar--EwF0hpyYI64o%V-~5?iHSqq&{m&Uz$YXNOYeE6{Atvd#k+u`M$TVlt%)
zA8}F9>#LO{ol1d=IFjGtLb)o;?u!=<@mwb7!{<eoZkD_dsBK$hh1t04MTLWp;PJkm
zPqOPL4#>A;wu9g*;YYoj5i-8eSA@SCFQApXb^f9CaFENh?UONsvm}AoDwo0eeWma}
zGufN2iy4hQj@!(2GcfhwK$*R)RL6Z+5XP0AJkLV6o&gMt(SnQKbF%Ya!BiIzJc&8K
z7d9S#f6tk#L9!$4xB*~V(MbCuUKd{9Y=p7a@n^uf(GTfWPL+b?+;tnaj#AbXtshrN
zh-;pLodi1Hn|$1hk8K&W!=`mbZ%^tSBr<tTheQ<djuLxE;wHM@xihB8+FlzMB9XoN
zC810<$CPF+{l<v0ne7`O78T4E|5P7+UDSB|p?R0?hL2OYDaGQqO<G!7LhG%Y3#7R`
z)+R_hS-+!j?y9h6X>a&Ucu7ZS$NR{l`g8>ARCwchetMej-Mdf>@~P|`JLXxGnlJT3
zm3C4PM_50mzm~Nap@Y<)<=ui%z9l_1R4P8YUD(JZ+(gOBx?mO`$C)>opX8gp>Ew3M
ziaJoFoPPODc)juR7qZRmZMORypAT}fYQ)ww2(ckNLR2yM4ijX|*b-(@&J9OHOg_B6
z;>~V$*vr)8ms~6_^rd%wuTB}h)gdF3h8~4kSUtD&xH}#ep0M;#y68cA962sSpirX-
z>m~Wn*q~K4j{?wbwU%8M8kKwJiz}>AMbhRI8CE{dCm{bmT{T(r_U#wY_H=ZySF*Ax
zb*llWM3cb9P&Sqi6#`Ih<D1`3fj!__zfOc2^U@DYZLKD~ZT7(?3<wZGxoy@+5U{FW
ztnpK<B&x+TYnNIdcrd<3qxc>X!S?xA!rLYp8?I{04bQ!GTafpkxIEElygu!03mDBW
z%GYcVg6%IgHq^T9cdG(RVJWZ}cgLd>hfB2VPrHE`c2bk>L25+XfGhwet&~0%ll$;d
zE>_6w*1KcEio$81CEK}LNcQ4tMca6!nhJ7#zAMor7aJL&R^TvL*4e<Vx0H4Vp=>mT
zcK&XPv*!8S=Og!)`CXlTKY#~lRyfZ!-URsTINru;@v-QHe{vhEl<5tp@vk%;=HTb2
zbK3nS2Wkqetb^H_)9@{Oou(yzU!yH%N<X(3x73~PTp3@ho@`Atp5{uKjpvr=!)DHe
zFQHCHL8?BCMd4$w7G$r*YfJMcKdDta#*Upsu!x9ww@R1XoD*zz951tz<!l>IZmS7o
z`3pE9nhvn8RG&*Nx3)PU!N0jHQ8hhuq%JnlU2XcLV77WQwA*8z`_e;uw*1rZ7~8i3
z4Tqd2N7g(2#2HR@*@Sb4;TMn?ehY=OJ)`lTT4nU(2Ifh-I6<;0KQD3DNgu%ut9%<S
z)+mVmAAWp@(u(ceI$UC1KA8PkKRp6w#3AqEi9a*mtsJFlsxZE;5gyEV<+|mA$2bXU
z*z2p^KOk(MFLhM(6czPB8<lONklPxRe6ALQTo<)9l^}tFi0HY|o+u<RC}e9YRm;54
zt<*}H!C_};ueqgdggn1LS0%XacBU6-`#ExSvW?ElMnXt|o9JVRz`<0ESs|&_@~e-g
zTf=+nNz=dU_tFb%=Po7nD|`WHh@8)s=lOFgfH_G&)84aveO0l|HJ(d!0v*L<(X7AD
zx|_2gOVgg4v1mLz_VNiJ=E~u|ZaqqN*-QiwS!!ju+|W8w2$#j2`x)6JCIw$JwyzIT
z(q!h*Cg^@CbLm|o!1(s<n_4BcQ|G{38>@iF)B^-&5j9ShJuuB>0z;Dp*OMzh$0biz
zx$M5@Om<sBFS0Jehj^x(8YC(O6OR|k)$V}aiTQ?spGgr@Cw(F6>eJ|3le_MFvHT9d
zOA1rud|b3>Sk)FJ14El^+vR^Az%8CcClkNOu>h=!)QGXr1(#{I4GYY_Cpp9jZ9+a3
zx+0xY+sr#Iz_IG<7Ob&}4kJ##UOpwO<1e?EEf#5LxWXtmo`1r{N9)w@pQbd(!7O9k
zKoT}cYzU2=eF(Ba?SSH#&c`}TKm9B{>$^W(B)T#F3Y~d;yV48I-*rW#%2V}O$&{bo
zvoBaqa?nzjy5|p8QEzv|P|cM^8W_B<{4~+%HVYJnWw&NiDM`1JbaFRf3;z&mZq(8K
z3L%;GQnh$IM?ui!yleXklbqAN^%aDt$N>|Qqb+DP)`c2fq&8YGDDD%WbF-ZHo6};#
zam=u-pa_UdjoNeKuP|#|FTe3B=ludEmXq%W8>}`X@9H*2NVv^sCT^hYD|x?CnJsD;
z(}30QiO{I8hDEJnnTkWOlk4PO1B7jBYqlxzyf=UPXk;YhWYexNQyb}c`vIisR;d3*
zd^;VW<*r@kTfMzoZ`V(X8%HwU`pi_AGHI7yw@4(D*>|HCg<hRE;pMsZG`y#rx>3tf
z<hAeGH$&2P9B=LD4Zzqu>zEWqCvxvc2o*wxxH;RSPA&GBJ>d+mdq&J{zG!}}!W@rI
zG<Me95+Sr6O8VkDZm{w4Id!Y$jO$^<G-Ut4*P@I3Z&qBsad806Hr>kS(&dbN=wg|*
zNmirDr1x``<`I~_bC$a~%H7+va<R%_+us`KA+3l^I`L`)%Gyd~V{g5fZ!{J|K%dU3
zy8blE6(bchDCKdP%#_uLjWrwO(?B=7R-=TycKfMPg^jV^Xe#~ajlkLmy_Q?jWDC5V
z0WML#=qwqMs!#K{ca!<*1~)~?0<nPIC?3h!smWID0hTd;;;{Sgc?79D)P2qN;DTBE
zy_p6~$lAaaG6Wk32a@7aRhE{X4uWh7LYu2}%(>AtbsWgX$foT!<MxEbOl$rr=zMeI
zw;DNEA;Ju)S*gjUsHA;P`}FDi<idsGX=kJ|S6CeIrJXEzmnZv~`R<*!N!;kifwz*m
z6Lpg{2g)l0ymeBCap-`0@q^23tk@m&vFy$|Si-g{IzzHqH5zMG3bt+rwoMX0zMm-(
zYN%^C=oyU;skc1UIbv3w$b;rR@SY3x1JNgiKm<Gl86yMIyftnHr#oAj2$AP3v~EUH
z)lT=6=W@?xmqqrBEnCw-C6I}|G}5DjG5<YiOz5WFp)85CA=%+zFFOQ2^ws8R(g_`%
zDd&r^cD(3WZ8MSJOPVhPACs@vwtI-w7!c3uqi2D$)jU1oh!lkby!kx5zT2fX8jgLa
z4?OLrP3bImy>g-|1S3~xZnjKvF8IqBIFAzu;+ooQ#NT-^X&xtY!eO_CEAqu~*$jk<
zxDE1^;Xr`!vM=c<)SCT{*Gm>&!`<Dh%t};L05Vpj+F42gM+sKB*t4IGQmD)t99IXk
zp}9(5<{Awgz|aAqs>NJx?9nrAmXr1`(vZNfd89LS_;fd1yEAz#L_<XmAOhDnNY9p5
zbxdtzCH+7+lp-=0+<lbLii&h{Wj5gbgU;r6t;3ECx8^kX%8LaYBY3hl-d?~a=T8{U
zOucl^XgEtzv^N&O8o<Ts`4t)xg5(K$s8ucwj?t3a&HkQ43?Uq$90JC3xxA21(4B@;
zWV21$V3Om#>Cc0W2*89I9YW|2T!*+ZHWrMIq7o-)Zn2taKh+uq1wD4<eP6(_ss{Cz
zzd>tT>3$tf?pPoF-O61Q#*k}gSo-Ku(;NQO>xo$#Y^2Km!nF6QwA)Xl&s7r{V{TS%
zHwwQzE(wa1LbZ8hokfn8Hjgrq_M-a3OdoG=RMEsj+fLIOg`o3w-#}&P@l`~uy<eF%
zB!wZqYP!^r9X9D!?C{$i62oq>gv#244gol__Z6Qi-B&(JRq3J;4*_uI6!*gI@sEc(
z2+dVGD2&&Y=F<YSw3n;h(3qHwiGsLw7>t4^W?4xZdBWBRGF5EVTYC}@-l&11zNoqR
zJjD;AT5fVjcMHh*Qg-)r-(?es6fTeX0IrEoxM}f&`JPl!qs^kOWL{MNyvz0lNnyir
zx?E!)PxwzJF!Vr?pK^+Gigac|{jld(m3zlbm6_pZ;KCg8{JDE2@81L93j{@fanbbG
z=p&=-ic<&<6iPo8i69}_*&25oGDqhJ$1|K}?HzvAwkWy*Y@#E++N2UX=$iy{HGxkr
z^e<D&_4cP+U)*)ybj}+q&D{+DxC;Gz5+h%`DSvF>q2zH@O0ySAewBV1)n*z{Y$<p8
z<)99G&t&g*qy1dV&*g?T;<EX@5>hm&pgmKLU`*D<B-DeoVb$Ao9GlBxx<qdUzfL7K
zHoj`dcs8pek5$NNb)y7)<B2}a;a``1=${FW*0R>?SsDXNScgmBctL0`$#Jd133atX
z8uT4QQuKUkLEvgSo;D34v_-i*rJvWk1ixi24Sogc`TY2v3z{BRcXmi+L}HSX;2@Kl
zoG*BtZnikL;dH?iz?^e%0jKb_0S((7$J%nYqmMGco}<xXp(Q)ng$$2tYwjok73oZF
zkmumGdVMl~?tGJAp;I+DPg`(vs^qvYf2Yx{ma(_t{o+Q+ipVbA^Y>Ebo7~lMI1MK=
zW$Q_E7X!lvXM4gB2yoMe1`8YQ34`c*!$CXLs_1SZ&W@yz*v?8sBvlsuZ$c)5Xy|)}
z2n`=!uAYzco-fT)pzuo!w^}aeDnP>IvzROtWY*v^1CKgv(3v@I?CmX;ZH2*<Jj909
z@^JOS*B>BiF<BLuxI1n<O`<X=ncT0fIn3--_EzljDsoB3*=k4Tq1VjQPOPK?dznbg
z*X07{<9j*T0pw;{bVYiKOY`ZE<1xhr`8kKB(BF5(|8TZF`oh4?Q8-4=Rcil9L{j!P
zDIuTLJ|G3@$odFE$;YrI-=lX{_cR~3PGDRzUQ#+%=xRiY<&CuT`RUby<;9P|`pY%5
zK~1*vdJrbo-`x71bqZ1_J(U@)Kl93-cVD^Nqqq^yGw4q`8U!D{0`+$)i=!W}?dFte
zB($8Da->)_6YJe?y`MI?B(AvD>W{}shKI`u+OtBK)N2nTx#uT~+USzqCTo?CIw@+_
z&$`Q)M9ya^*uhns7?c_Ao}b8_oknZg!a=T2&O|lO*LN-&T$0!wUoOn<xv#Fj9c8I;
z?3yhSHi#>>pZis{aL2^T`n!l1H39}n`2;u0;WHPCaZCcu{<55_6cP+Wr34V?l9ZH}
zrmmwL6y#T}R~Ah?j=IS$2v>lHL%^*iELrybZ`!2?8${*s;OO%u_{(&oTlT;&I=MCX
z+mleRdkUZBvj`6CzL%G;cG^CDHhRlIPmgkKh#9DzENjc}OLgTd%Avn<{VQ7B-&som
z(-i)t4{dfPnL<4q&|S9xeDF_2b*E*{TslKT!zQ7<w(mue*dYG5+p(NU61=K1pIxeu
z`S9VxnYkAGh+Mv;b~g0>GYw4CtBii%QmfFucws%=x=BPQd(7*RA)%rT;V@NevfIW7
zmf;!}xM*q^<jh#D?i{J3i*O2gD!~stWZwVH6C9Xcvn0w2$Hv#0->ij&-jlmPqH4#h
zJ(bu8IdSqPfnCSts4WG*Ebz-0bNQx$c{k+9-{PYZ!CP;y&OVjfpor{ZIe*0N2}yIn
zoi|xhz{sRRkr_mn)e=$5l!VC|C6H4Ty-}Bz8wC6|7DmQ)KT`&_Ur-yfUVNFs-;+lm
z??5EHG&@o#8;gYRo2f<c_rvlO^Sj@Rfi36PuH)6b%Sxr#V!>NquIw#1zM-7@zr-RF
zM#wlrX1IQt=|T9YNdDdHUe?mm(mCLx?TUqiBe;J(4@_vU-465Rgs%$A^WIH_N5@Ck
ze{7rh{63EX=TDY5$1>%K7||Uws{YciWjJ>oSHwvZN_sKDJ!=dqLfQYymtK}ZUhR4&
zX($+}8aVizQJDmze}Dcy3-=w;u+~_vxA`1Wcvj7A48L3r6+>qb6q{4a_YQL={3q+@
zB_AcyQyj7A=;OGTb5!fRZ-p{v_5<i-9|Ozt458P5MjZUx2(7ReOeU1VSkL$%qa1M2
z2&`2Cf>tgFk&JHQnk<fARGc<tiIkh%z5mIUf}g;CLllJ-MiFRByiY2sjlly>0J}0u
zg~xbSHH%N*0|wN+*XiHM3uWuLL(xMzyJ1ot@+lJ#%SPO<DlW=d^dDiz)qjgBx+VEf
zZV|LnA$GU2`7~LPdtSJUJ`8RC=mPI-;M=RJRG_}q^#0lZYS-{oC}B)!Br%f&fh4-#
zKa5c51F)RFz(*fp-~6?#{QKLnaE%#E2vd%c@Sx=j#NG2kzdQUiU%6@j%ovRS?^%>c
zb!FcCuET`)M&1B6&AR=>%8{tUXw2XL&oi{bkDgGppwgb*C;|J^@sw2xZ;47htl@z-
zO#I$qwW$9N_)8vfUCM<)EP<E3CLJ&c<wXF)AREen4Ms1hef&EhD0pZe2%TGAxu<Lb
zKXLgeAHA3XF0Ug@w?k~A?0*gGz?jItu;idJBq0vr2A~ciZ<D6aqNkWLtBjyquSI!T
zM;rfvo~Y~iNa5d!`)3ew$+Sl%IXoLkuxwoLh;S0Bx_t<pc#EsX1NvG#Upzw@WtWYx
z$3p}ON@g=<Kx6zn@(iRw9bD3Zp;CigOd)~+--yR?T814@Iplw}#L<`*lZt9IJ)Ct}
zqd@9yLG1ZY5(3JA@YzbasVi4+NtyQQf@3^TdNf~=$=<&uh-X9B-`unBJDdrU+J}Y@
z_e#_|>Rv}}mFXic+uPz&R;R%|&T18ou*R_CDR?2t^Hi@^eune!J;}$Vl!!RJ?9eC}
z<A~Wpz_Eh(G#C!G&+-fp?W6hJOYdYK4zcq89d)<GaD<BhLu^N5Rc+R=GFh|~JHuiO
z+{z_h-^%n2hJYauFoT{C=YhX9(Ny}Bl2@@3PIedydlZD4$b7uM{%Yn(%UHy80b%lb
zB29CD2c`9anWl)jUTgrzHRI@HFK${lwT{AT^$=?e!#k`egYrcQq@tn^5CyycmdoTx
zQ=Y$e5+kZam(iV1iL0wz(x&d^EmsLtfDt*vC~|w=Vqr57Zy3e>nRlWk-bf@cEJKU;
zKfPRE`V=q*@i<1r>%wbbB3ZS;fanAp-137<F95f=p9t_NR1!}9o0mnlrh0+HxHS)4
z8WaNJwV|s}epZF<XW+iA<X4kFUK-Nf|NA8+u?^mjStg2-dg3A`AIOQJXYXEXvUf|N
zHRCybaSy-0Z;>~q#b^Sg{|-0(h_0t=>!ToSB8u80gc75isjTYzVGHu4^a$Ck`ny=X
zu?HwcCTXaXi__Al`ovlm*gpiwmjoxs5f<LxuXU*Im~M_@*pnxJ-V2N%_1lunjm39b
zfk-SNH*mb1N|g9!&r9gvfbJ4nulEvb7+BXS$$E!b22qA(u;YFEJ2K*)mlkzYH$`XM
zZ+9NoFYal~G;}lrBW8Qv1tiVeR9VD1YcK~REH<Wn=4WFdSr2IqvHuiGEOWhXHmhF4
zyNh`?w;@Q<K4GhlW;-F&n_2GT5TL$O3OCy5ZKwnbto7%kB@BTkkKc3@WTWLK>FuTu
zGnJ|SIalC=gWzwFfvSn_?7uY=V&LkgdxDEz$kI-0J~N;4)u%r^I*`}VMqHbk1@sUB
zog0jhSZ?L~zNJ?#xZ!U7x6r2TYZpbIzmq89O@7o6IOPa?oOQ2+e)|&GECz$5W4w6y
z(2J7TpO(<SMN5PLIUd3D-QGI=<!fP`k~CglaH(LD@gl7{6<~dqE)hb;6Jt#evoui+
zl7Elo9$n|azwPzBDpE!H@A8eHA@o03bgQ~4Gv2JfKvj5t;hT-cpqy*_epbb9YvT0%
z^Dd5lA7sqWQ`MZp!om><gu3w7510Y?>qd-CQ{%NGP&kN#-wfRKKszqE)o>U%_;P=e
zXXWC`vWv$D-(m;t1#(bt&D7!)J%7AoQ+>5pQxRkO&j)*%ike#gIFb9o3Eqo`jM(ov
zEJkW<0=l~16rnRH2kng17#w{J78CGf?n?M3g5cz7tS1kF)cNwdbP3yv?^;{-FouY!
zW!o2k?C;)unZ?%eG(d+GwAR|0o^7~KJn*@?JMH||+S)o&K$ZGIPx5Zd(Ya1B_u-#8
z=4<^WB)iHc*82l?5<`ww-CE(C%Ux2{kWu{6<!R2l?1?qzSutMEFfn?|C^6$S>vzB(
zsz(?twceZOev}1W5*l0v8*4o7wsS-vJdX5+;I}_7d9KChK;N<TSdz4q7?I6vvQVAR
z4s;3KFGL}Lu#$nC!DoCxNWun0Sd<Mq0ITx9eI%)I{Jcqa5$Oo6g$->F>vE0MzmG9c
zY^qw}CRceSOE!7;mL9a79K!Mjw`QEC567SCJQtmY+*tnorlSz8K1vG80k}_}T01~m
zhD!mSCRyr^^iP#%vf4I3pY2RjEW=fAh(T>hMSDrgYj!se2&p1GkALPuVb4qJ+k=*|
zROBS3W%#`tM85eTzXL;`;rEmg+jV_I>Xh;)fY9HsE^!}$gnd#id15`kR|Rq7X5&iz
zoa`-uD05VZT+9)mH=MlX6q7lU-kOCP-N%TWq31z}&11$OF+v=Y?Mx&%O8)gH5T!y=
zmmNpvhblqxNH3eZ|Jf|zOCQQTC*`p;zPt4~B49%D{6Qxdmt|swmM3s*KpB7)Cblu*
zn?-=U`m~2PfUh1NhD9#uobRldHkl1dco0g?UE^-$KzSA2M|Ys7^M0(c(4?O}#cG9{
z#RL>!Vt{K~#7JfE{?2%WO{O~JbeFnIq=F^l2#$9kG@s1V(6}%GhgwkIJ3Ks;tXA<I
z@th3hyb1hgc;Pt8DRD8;IB?VlsBmvy%DWPqa?F)@qqIgujJaK5+VfYLWlA1CnZoan
zx8EGogXLCaDn18_k%-&qzi|SUam=IFl(<AH<dnr{a7Y7GN~=WveyUg^C=k$f(bLz{
z=y<-EB}4qHLmAE!Y$%C*l}*M|DZb~qnOgj!KbvhI|9u0#VInk-L<#jk)D%!gl;QdD
z2RsU_7CJ=F4e5JytbbWwUmxo+@Oiv+n#d?&kBPqat~qtE=`!_Wa0YPd$W?k~J-YTe
zQ{(MF-+WOggaSGnhP2{hHfri(CzS|sL$oEb;{oDSUCN4&DauBx*5NCJN=_Y*eeprz
zrNnSMBqt}w*EiSX6J9LHrHPA+C%O#8K6v1#QMF4yM~p3r!l4uKcO#Bz#-lQ6dx!Mw
z*-t?CCgn+Ch1eP|OmMU~(^0+dj~kCBSW;fkVm^U1gvcKsH&1ROv~05@M3HPA2GOE0
zufkxNU(AB;({fRZfNxye_;;pAqGez(zNq}XfQLh-m2LjHjSVB4+{!{XZY_>;8~A$Q
zZ9SgiNAPNbYt{W7VpR5e*YI^sw6XuM8-ZUz&rl-Os@!c%RK2js5ufe6efqaRPEYMU
z<eqhMX(7rh;qLB!ID=knFIGa<g8w0_4ZZCYO@>1`;>ulo$(`JwLtP03@p_lnU;n;V
z5!6F0Z+~20%NF$woN7IzE@-ioS~-PG43Y~)135Cm`gZj9{}Z_RV*AVKQ`|+kxP1~)
z{JLU|4*UmzK<Z!RFSw>8VI?ugkQp+%ONT<(wb&{S{3+Vk<{Bf%M=%hyi1@mx1jPP$
z7Za|x1}l+Z%oadv3k(Vh4CU6`HvglOkq>`~+JzMaM+=F8p0i7b`iWTa4ziCe`Il;T
z{Si+N`GKDgi~6{>_MLc@O@^Jjijuj%ulw0<?w?fyLUXg2ppE*>p%6;Y?fiTF5HHdC
zojR~`20qs*!2m`$QYbq8fD_|y>?C@w7gvb#{cFxX9zw*5;C+x<4sI>d9<PTb$LjC*
z1xxbLBi7*o%=Vf<QSjA6-eCkoqVx)P^qXwlvn>Qu()+oXK%LU$==<U!7e2dJQw0eC
z&ILJr`Pa?+{?33abZq*Y|DA5YkHoQUR^T9tK2M?KJlUX2UM<u~PL3lE55pSGk{Q=)
zV@P)6f{;3`Cw^OSFXLhdiQzcTujbP)HlsACbCt^;VM48?_D*-LZZ5}Nm%sdo=ccH?
zv4>GDON8XRPim<jty8$K5kYe9##I&2Nst6;{czYnW;9$fKwdq0!V$;ukow$*D$hBb
z(~Rr-pwqG{=o`+vtc<(;w(kD;ekgPUpILv9ho;hOGFQxBEqN_pt>kwPV`kB-iNZPC
z7Wnn#k17+xazfqL+eO!60ew3=8&S-R$u_bT+l6^bO+xcx{Uru@S{{OsnAq6aI$JnT
zU&g|mlbx~&+0z9_gVR>OQ}Xn*G-A$N*8$$QRSVib&9&BFPH;W`@})nD3C<ItYA)*J
zY@z2zF0{er<{{3hw)1AU-S)ShNRq)Az1_~fJ}9T7rHG{Dhl2OP*>a(Qp=YL1-eLjv
zr<(>cSC*y&a=hGUQ@#&l%Z%2|r?C|(OqGt-N{kW|?DiL9Fvt>$C@%KfcErCPp8XEZ
zS7xj=?2WPC#kQ!XqJGvrqdU8q?ZdcKcJPfzp+8Rj`h)f1@WF~4Egb<Vui{U=wwO`5
zP+&-L5T%h2e8UPI#uOHKVNMG1)Z>WduTpGqR=H^5|J`@J&ALgARNpf&{<e0za4TH`
z;pNi73jcr*3B*+3@XfLeH(c{6i&kHsw4s3t1v~9#2!DOt-|!e70=k)~pk1I^y0|g?
zQ3W6JiqjO)&rcndAkN82?YoGQlJsol1v18}`AkHe$qzXB8!u#NT~LnZH2FsST6cvR
z9A&QiO&~ER6ZYY-oOH5zc<b?T{sYw9<4v3-c1)z$vX5k<*{;_8aX-u^a7lTWH-bFr
z-@KjXH&wdzLU5(qo=nzk63P|->f6hLTJqk>$!WG~{qsUng|5htrrSqWbdMj~&AZy1
z`4PlTPd~#H*1XFrf-LSI4H9HzKwc)QY9HKlG;VuYWwBpgX1x7QDeVG_Tv>26H~{Hy
z)R7VE+bh;w1)92KT>QNzSQNBBz5xC3Y`1rziq&ks{`@PeJz}cxAtvdR!_A4x9ULT&
zv(#+T9#IdAV1Ogk?Nq(LlLFbZey)yvy>IxZCqW4KtBSnBpnUZ*dj7wm%HnG$JYR*#
z6~+#g;BP^}Ik-K~aM#ueR$;5_30=Ke6^9S?#P#%MP+4Qt)&HNy-U2GB?hPLuML>~M
zN-04~8l)r@22i?@mJpEc8cHRG7LhIikp}55Q949o=<XQ0Vdie|``x?NUF)v<KWkXb
zoY}L_K0BWMzR&xdy`#W(us)|tpvyzP?wssSvg__>Mh)i;d!O4t1P_`qp0R2zBd78w
zwbe7FN6eNxqw9ijZ}^?aafUaY%x6%F+8rZ7HA0>{cgNP~R+-5sX|jCS`8AXaAso(-
zN<kQez8l11(de409nOotRV8OO_eYXI+w#Zy52Ij&A<a~V6f%Np>@Jx!w;T&IR6T#h
zdhPFrp`q4((YR+O(x~YM4`DZHKAXJB>gjeGU3#aZ&5v$Vm=G5OSmFB4TpyN-Lefa}
zc4N7gVXr|cJ=h;O^C5pvJntRIJ?Zeg$;=>Mg}+P+H~r#|wv>u=<LVqtkZs`uHWNZ=
zsqx$xkUV@Uoy%!hW+LzVpFazH(R_4|3zha=k>x{g!eyvmk#p05AptZ$@jMI}vLtKF
z4l8Mf$Ct-bGX06dh@P$wIXP!E-oz7Gp(<IjFDxzF7CY;2j+5cj(f##B)wIQPOY2SU
zayCK+{o%Kn+0;`j5E`y;%*<&X2o#O%_t%MAHW~*=sTz9ip2Qj6d_IVIm(B`tG)D0c
zp0SrWgZ{vC)U!M<yI#3uvS{Hc;N5%<&5~7#$=6iO)6Meqew<OCXDsmmiY(Hv5q5<<
zugEX1JRpaFY9yVg$cLFcWo1RrzJS1O$4Y-i_!y7#LUPoLQ~9Pi%*RSWCI6rlWsVOB
zfPf+;)zm2G-h)7^tRILQ`!6HzKIJJT<HYidkD%J9M|sKz;Y-J`aBod8O?z4`rHV=x
zX_)pVM#V;J=Bj>6%~}rlm1G;THTeLdYUp$NXS4*Ooa=L$7%94pE=*qP23yD7@YCrR
z)6IQ>@dH;9DD5E3f}TV0ked)VJm+t|))I26kU)X43J0HtKO^%-bB-#5(NInY*pnmQ
zh7+p!`nCN*4$*xK2*7K`Y4^u7k7fhPrW5WG3cT@4h>1ZBDg`hpenVe8g-W-jxTTu$
z(W~bf(qv?SMtJ77G4ki=-+bS4cS(s*GuNO>)mpFmNb?DQk*w-e^90dt&kl0~L+6bV
zu_Tgj-;wJGJ214DX#|yBW}E4GXE~-b$w+lb)%4J)n0_JF3`-5J-mqM?R>y;{pWLTh
zq^+${sLS)BYGd6beqq?5ENqD+i&w#W_qUDB_-izk=PGUfA0jM`kVj}P9Hrz@w_%NQ
zjwTWB`Co9$VN21&FVVvf=x{UpHi{_*2FzStThb*V$}1HJ+&DER+RK$R0A}w70cx|c
z3YzShZssved$K}IIrXYH>h~)v-j%Inghu$DW+fz9c|V*g&00F9KHn_c(yz6)LfE3i
z1<d*qm&BBpH^&t7k?RwPCy_Kl<*KcLV9ANq7VN4N*YP986nxPGWiTwRx-Q2W*z<aJ
z6pT#tk?#It=ZR4(9ayPG$YDvtl~6lVdj1gc@tsah@qd;-+>!BiCJPf(S_^+$?6C=p
zjE3UvZLvGqY%F}1rbOLm`%rat=Q`Kepy<mPU(B^N2B#|^#u*&E@yK@eIXo<EV~PU8
zldZ&gT6Me4b!&XFxal*p5%98@PoA`kom=<Ai4>0##lztCXjc;AMK;6KGD{K&l#wA|
z^R1D(<>-$y?_+I|xe(Sb9Nd8(d*5QF6Sy4dA@pGnF(Cmmk;YPS?t=>9K4?*+A!gPj
z4!4E2Au>Y|UbC>W7Y#~cxyJ)CU_{%ggQd3v00vRlpCcCxz0$Q;;J<z`J~bOUYeI*L
zZm{L3clPv&?Y7gvq{HkP1F#zH3pk~!Y;;dI%l5%D)_cf0h+kaRof}{(r;hsciO<de
zKk3o>>!^Q~6!O85>2`i><`ggip#rv)Qw0wolu2B)ZWH|ZKLFw;zwO>JyFy$T`Z7@b
zLOIuU>jSXPeNK!zDMd}jc|$jwkhS`kXWHl<rB|H>wY+R3w{gHo&}>>sm5yc-(Essh
zt*8$2^%29;;@RO}Grsl+o050YhlT)r%WyI$%1d67>Nu-Ui|=RRL{L|}6nk1aX%&41
zwZ@lcXZIP&OG*I7Qde&j(WOvG%GbHx+ieNXRqNffhP;F=go9qZX<U=?w_sqk(#A^k
zSZ~l5ZF6wGt#NjU;n#Dzzl){OCtQp?-xe^eENJ-^Jn|tw!D&UdJwzDom93HVlJ&c^
z6oa0R$49%yca6@uDdw+V$Me~x?$;~_VE9=IOhO=^;<RdD$E%u!UVZu=G2C?X3;8qN
z0+4Twdm;Mj^Ge*;mT1l=X7dkRbS&Q~w_@#C=;$)q79uG$@)l_X?Po`Hj}3h<Tk5u_
zoz}8O)Sr7ySPmBi@RpLY*&pccQi-B>=91AU48NSVa1$ZtAE+`$ZlR3`9cDqFi`j-_
zA@tJL1X*Bh@JsKxfJ_=+>s)xpL%v7iGb~klgMMI}qy^5}+YrSfZKu`u*x(-qSf~aY
z-?TR+sr8o)m=vY0*&xaBLKQnF4iNj1l`xf%=#GvqQJ7}au>nLdAvyVUB~42B_t&W1
zjpDAog42Cq0<iha#_Im{y%^B>QLg$C%S;g;LLS4SJt(_hX(P;QCcj*uZDz&@0`*`g
z@8zW%ekt}jYC(oRuK=n5yA6~L9vTV{ujoqIxHl9Kx`F8L@|VYL|F&w0&{G4*TTdk%
z(#ZPHO~mgS^JF24`mH)=JkCBh1a;nD#%nzJ>2rTJU2?hQV@$u;ges@4Iu-BgiNMTN
zbsl^qSg+reE}@>%QEY>U7oPVC6WuxDT|3xr5<lx?0%jPgnduIKc5!LW<uUs(k-;L3
zkn=@;aYX$oBS)C!^yJpJti}`L^-xYBv~_B-HM^^-)8=Tw@6fyWR6^WuyMmvnCF5C&
zqP+?ZBf>j6z6m1*_eOL*>fE-U+fBi32N`XfA;lpYb?bRx&ps=&w^XOIAFJPEggSq2
z`8xZDwmZ9UclM)Z#v=&vw{M%9!*}JME+7mGpTsdC3cGcF%>Fo;%99Mz;fw|W>0bwH
zpX;$9$CjetIlcXUPa0pnEIUI8b5G|p)Kc7tP6~clJbCt$1I}yvbpSTukI*0`e4xFM
z9)w?_UHu=(-MlAp3vgfBWoE#vkD<|^5gqqzstkw2v1WWi1#*tpvXOQVxVgLDyTnX4
zOf4D6DAl9RpolKi9WA{md$1MSFe^X(w7W@GtxH)PTjx~u06aK%=<ACmr@mKbGwA0N
z-5`jROg2bHEp7k|>^uxC^%vVNFKf3dbFlCtybm>|Q$@id>RDKLc?atnmqm4c4cRSt
zkNGRdHMFSC4+bakC`!?%+00h4SOE(&zIH?x5=|ZB6()+}my6>SYvL%2J3kYZ#1i;?
zeU5z5OWRW*L@y;^M~!G|T4<6QF1A}+1jB>1rvqM~{S-I@CvqIQLe4p6eDh}qPwH1v
zHyPwgwTk>de2_idXfL-*b8p4#qYw=7nG5-lN2X_gun@URCvaU?Ur6ueGk~>lVG~FC
zz--RakE3gWhwtkh6?Sk<4INB2FXJU9$GR@&AgJ%J=a(t#I1A=aB{UebPOzS^pTpMs
z@K`_QS)HNS4QLpCX({vz5)Dn?{*5#E)a~~1(<3z7w`@-XV}(Vs)}GFgTUL&bt_>xU
zJ9qeW-#5Tx%Hm^gcxkg9-qgZk_tJ<}ru=vc#8WQYt|Oh3lNa?DooZ+i4<3P>Vnj}A
zxgD8Y6Pagdp52{>Cl~tpbb|gGd72cit(P)t_@>`!ZurR#a7z}|tZZn}h&Wule5V!u
z&xin*{34$0<Qiwz`>_2h{i#Viz(W%(NV)BB{X~sEqHw0%Y%4G-PHz+la={vqaRv&Z
zAt8@$Z}8jTK@1xmo75b43nTSi5o!-)0<=t)OwDcdPPa#f<z#Dp{BbZ^zXsrmzKE3g
z7sOX5rq`4MVuq!ryXfxcBgQX`Za~Uy2KSQ7>I(F$98N<P!3|0Qws-Tj`!tQF4zqcF
z7z+{6leFIjG-5)IFH@(qG8J3z7E`FzurxS+BBVQrvlPL65&n;5OaJ+ZoBIZ&(ssgu
zdFjW#q2+p%tBr07xHmql5l+LXNe~N1PW9>3A<+|c+b8_%bp*493f&JY>yP1Ezb3R5
zjm-roUcCgtzK36L$Ueym;2GcB`Gd`jDce0rDr-TTg(<6+`uCF{hQ!hI?#ueBB~ki`
z&u`^o3mp1s;;I!zGU#3VK8tUYNeW$hoh4_yMx7viv_^(R=7+P}MYTpH1>M{IUldPW
zb`olpdZGx>I3Zz$Pr4d0a+?o#NJ3C!=s6*DLOL-70%<1s{kyFvl}}W>>BRBH?qd9_
zwRgFjJ`zPvQyf~%{sM1zkWdKrF8#gtk&z8`NhPoCH&;nSsFmpFS&8fO$qFz)9`>Ta
zchpqP6}vkd^z>A@cXCvUoWeic(Yk%Z7F&sq=<6v+1Cgg!W0cA2OOAER{aXEvj@GBE
zVCWqtCPUm_XmuZ-(2qLYt5lFTuN@qsSy`-bLc2cSGcnIn?5<O{f6~-}K)|NPWAtPw
zFq!?Y6G9~Khe{d9Dv70~rN#<5wGB<yU;NDAq5ItZO;$-OzUW?1*v;#NxV?z>B)D<L
zW0)r{Ss7<ctcGKX#g}x#|Gq6$m_lu#9_!e|4O=b=b;sKWNLW-&*ct!WV#K<-IY=|q
ztZa<;p;qHgJS*`}GmU3N-Ya8<V{EZRfp?(Bbe6g7O_C+oS8BfV0Hy%__NluThT9sx
zd$7ZGbTr+fZ1S4~$H*=cwb9f>A@214m%b1P)*4i;l)1rR2X1WS*S{5{s;Je^-_Y^h
zUXKa_&o<2@h?sPd;Ls9jkeO+bnK`BWE3RHkYB7Pk$CKZ51NIos`ub*0Gbv%b(t6+i
zyPYt)Ld|v;f8mzSB1wy?@XkpwlX9@P0yzA3d&Y3me{VwbF|R+9_a_$+9zCc{wy3!N
z3|UBsCXvV=d&7q(e7sRua`3QVS;c_q`n%?n6|d;71J`$pwyM;T0xVW0n@7_ehdBi}
zj1dK*=LD2uF>!_kBjrvhAn&4`<NXwFK8N3>m>Y<qMIcP~8?<kf=on?2V%MN^3s9yb
zgVTG>6<U9ovaHaS*Hnwls)7yO|8UpJ+V*lAG5ySi6d`y6Lhd${cyt-0v?=aIXVw3H
zrg2x*!u}B=7y?Q5+b5BT&8ni%$4Az$7+h%dWl0pNfrfgin9}QmY?>b3?I)<gzX_SW
zmApwQ0l~NF9uMWe4Vfi&+{3ASyR{^Q3GuuCoc5Oe5aK+-p6Uh!LK$E;4uM2mol}3M
z&43^Rxv89d$Aiq?CYFH6RJd8xM1Y!z_$gomfyjLQud?Np|JN7q6XVeStEpQ761T74
zalQCo7rRatv3IyTF9aG<5ND?R288mx#O>J}|LRUX8IW3LE{PxF_gJrzkY$l4K(EaO
z$NtI8WuNH(^W`K@x-vNhMXyVUFto$PPlb^fCo>Z~TS#|t=@tC4@Lh3HQK8DPZlPvT
z=KDe261K-C)0@%e9FA0AkzCt1r=L$*W8d0?K9sDn`6b8P_u{hc`$)3fsijMu^x(kw
zcjQKyeTtQQwIc1o@o{)$66FITX=sHDo=jv4V@5~EkAw0d?cBi)iih1@`MinvMJ6Ad
z&X>CT3u}){#6qongaHQNspg(16<>VWAcoBTV#!yJ(O}6{&r|LQW`4pQ0e99vtK?UJ
z!LoG<2i%VBQyhlCwe%{CgLMXdj`S+?D${*^-$<J5pWgL|rfbc}e7vnwbFdG@^mupr
zI2c(nc+js$Qo$N`X<gl%npWdAir~JqPR>vJ;uEWl$37fdX*q(vm#k};mX)FNwraw=
zz5xeE_GnA|;p{fq?DodWw(vXE>euuv?D_Ta-oYF3nXN8haK(K2f*2Oiuli$LqOLx2
zaClgP9d&cE5o9-?jd#_IWZyNbSYuL|lv281f3htb12<-4iFf{|=fM-B^p?ps3MmfZ
z+<(Z`T&R-IcLUYva;N~3CyCqjb&<%Cntclj3LuQqnL@6u0fwo%Pf$qtHt2ESC>r=~
z%aj4}HPo<?^p;#$kCF58t|#M6WQwY;aC5#FRU9dRcp!uQzn;a1i<MbYCBW6320u7U
z#RyWO6!i&&FFI=56?aY|s!Vsi?CcoYpU8aNNR}M6;(0~?d5${fC4B?qU`o$5kU{$L
zv!u3Gw&kFC<7b`GnIlD=L+iEU6T+A`Us%hRKW}EDrV?~7C{t^9`8zQ$1iS4b)DRcv
zSS`~~|3$|JK^68d7e)EPkz1H&`==L2M}6pXtr4W?`LUO`U;hev^EBJbyP@gA(#<^E
zR%+R}M!xMjs{rM!ywH?;qKj!kdW=at&t$Xmn)Y+AE1~&8Ma4U~#ZkdKhZ1fvF@su;
zhL`l7y8$#o0a)mF-Pubd!w)OkY^$88_FZfGXftCp^8Ecr!@|lx1}PpG27QA2OU(TY
zSkuwh(x?b&b-&JY7Fv5S#g|w6Dw^&W9Z?-UBa7<V+G$Hrnz{zUjKgqot8mhH)*`Z{
z*`{w|Q7GUOJc33%I-$lwYB}Svj8cNU8QtfXld<f*_HJ>TGrnIood4x2ub9&K97>H-
z6B&t^JkT~SS#52)XvnLLO;K5%O<(Bqxk+2|ns)QA+xCpFv()lDY`Z4^#}EJh1tun@
zc=_*_=aH_*f^H7j*SRUK*1-;@M5QxdF%t*+V+96co}Zsmi+I&HG(>M$WHx7k-sy5o
z?uwiiU}rE|4$FnAD=U9Cd_8|N=;+^65HvoNh=Co+sbA^`$ESLhKHzMhV&Pn^LrYJW
z)Ef)S{ZXG0NZa;?%aQ8e74=?NC7o^9;S)wR)&*^_Wwv47rR^S5LV}TWH9NG$<UQ(k
z;Sm1UHz5L;0fg5Dee*$r_Bsh9{;S>*rGy{%&v<$MhSUO0WAdUhkfgc7UF04PCN;H4
zu>S@#r0)g{%=;hoi>q9mKmGmya2LWw&5f(gRvCd`XVC9L3|a95*vH&vUFqibZ(6hM
znV#y6@72qO*xv+*8X-XeE@)48GK*z@3y0P(lRPwF;|f$~nZ4{W1aAfqHXFGLBko*X
z+vqA0<bOlt{|kJtZ{+_UqwhzkWW!iRFAEP2E*fA#6i&d!ot9NX+qVYl`o<P<9BJb;
zULM72@w^@@G1;_qVQ0^*){zOjNYp!CWr`F%()2u=uA2ESeE7l8e35B5e|R(VcMyK~
z$kT|Op^BOsL)51Ec9G5@NY-TFZnQC|)D)A78kXan+DvTc<p+23i+)iE0>Mq6ov`co
zLV3t|H~i`C73SsTWq8}y7A`h7*BWle!Xi}WVkKi!*jT85Tp<H{S2sDoo8McC5YbYC
zozrYLCc%;33wYQ~w`>R73B(JEauYmeyz_lfPDN#tMcz$lZ@?O(R8*9Fc7NNO;5Qr_
z=(<$!Ff+f|Gi_R3js5#qIN_?{rMceYqz6gZRy`HP!a%%uBk`ukY^$9ni9_#4W!2rw
z3;K8O43tD#oSd9?x;Hotk=7QslSRhND)RF4hlhu=WFkaP`+Zq1F0cs1>RdKJsAID!
z-^O}~pC2R$vT{?++KX{ok;eZqA3&yAzw_bayZ6#wzXd&7s6761^PJ@JRa8KEy{BqD
zBE`C1(S!1k_d%cd8_4!+<j2OwX)P_2*r#CX85+KOcW&ov_0HnWwoYOqo3LwqX_+@_
z#dnfX$<-8Zzv;MvMEo-MB^_->a&hB08d=xi>8+-sGCBVn5nj;bbvi0TLlng$=spmw
zq?jl=VOvqDp~+87T8e=>TFopZAyGpVM0vpCsGrdh22-D|X1Zw=(q+^cdPrp`AJEiP
z?N=aN8;=s*ELJ0%&eoe@+i&eA+NK%l>Uv|F-0T1YpK^F8ozf@3<2YqijQP8LLr3T6
zavPoJ=(wqwKiS^SL`P@T`T4;HV&A=<sIo{m^K^C^w#7f;ZP!HA<jzf0@g>%0?_>db
z0D@%5)Kpz+uTOAl_mz|<4<10vJ+^cjq@z(gt#WA|%e5LY)WVeuWKEAUhB=$`%6)z1
zJZkJr7bg{x=0QXb`%9W&RGCSTbXI9%@B5OHH3D(Ulvrt~bV`Ib5l@<LWBS*x90CHa
zyYs`G4dpAn0<4N@{A-8CxkCbU#(y`*-Vul{BImewUdcsJKD%7Y*0-@~2@bY0^a!w7
zLo^s;9Eu~RitF#yy=mFjDtHsOf*g&iGr=YjEi-8k@I{{|l1*Cnjx{!{{z;Fh6%t5b
z<9+sQ0b6`09R4W7paFH#PE!STy2{Tl^!D~qQE}q8O?Ew=dMvUwG@L(H)z#uQvt@0K
z8y1=*o)dq#ewZzGUcfJ`i<sP;+op+$jom$2xJMBAK8fF|HSojbx$ye>PgT`ekxS?2
z@;ywE;(bV@8e*tECbds&YSCl=ENxtzCFC-iA;Uzsl5(On3;n?4DGz`BeqRR#taTK0
zHTxt+DDA<4GMi!J9}6ynTD@N`r16AdWE=-oEk3blo`Yj$_@okVm6cnUx|zf;hs-MY
zNr?%g)N^rVUy_TI&L6xBG=f_k%5f?riYDpj?CghvC(LGle3lF<@b<n@Qc~I2_`W-f
zntE<98(~-rh2G%iR^{ZZsXCrDe^&0{bW~{rU1W>~-K9!Hy&N$N-ndm&RK&)~fOuS$
z4j)*v(!&G1el7IsHTn1#s-2ulWoK!mK2!5NVAj1I8c9hDq-H;U<f=_rS&bQa%_(?&
z6xu=78ML&hW|h`_Gd<oY4%(W0vcJb7=4`QIRZJA+_7X0iThQB?+uJ#I5+si6<q+Y0
zKor@pg@s+_)*V4Z5D~euds-VCyZra>@?TYbr~L-I`T=o+V$E%@Lk;w*MOn+&TKC;<
zGJ_M;3>xXK-l#12ZlvJ*{JdD^z*DY2!fau1f8*W5r2T1FjkdN3H77HNV)4Ki5EgaX
zod^4|O3baeS$D_QrwEH;V6=W$WT5l5veLIj&Puqa6pf7dqAym=KE7ZkJzjU7F!b@5
z%>;GGnd<SqqEwZc6uYerfC?w-e5N-mE7ErC@66WW!`}DD({~jVmv>KxSNf0F4<mi|
zUcIp{P|4r2v>}npq74p)(jV_Ws5XmI7kW3srs2v@bm|`jyLF3D#md8@*kHS(ErOB)
z_@nZLO)DG$64Sl{BE0_ab&903IA@nNx2>`M7o{poX90h@<q~SV(tq{#>eB@$602ww
z&I=J$i!GFxNOCsWw+zndQ%X0aUUDbGCq+e&9+xitets>jLhI{rI47}mPx7;$<JSBW
znYxw!-@lQ&)V}X-{jQ*kZll<I=I=z~VcL-?U!kC2O%ay-Y#%jqA)TS@Y{hGq83n&!
zQbKk1rQo)fBSwxMga?V8e61)bSpFFhb(fZiq42ee$FltITs3d$%#Nvs#n~5hiM3|E
z9fo`#JR(I(XLs8v?%qYC7NbeaYAWhQgxI%!8KNYhPe+QIHhz-@uTG#ZXFzKx`RsKz
zORUaqH?3txE{chXQc*z<<TYcVj2qULJkHL<n-g*9UI7gR^`*tuhVJ>e)suWpebjQ2
zozLY)<@);POqpn&r&K*pVr6Nj>k~wSxXh;OY5Qr1`1zK=cCQ1q2t%c=9#it=;w1iD
z(1u>8OQmTS(3ufwXlK4AyXW33SFb8*r`8qGG8f>Q&fX1(^gYY<b>=-+JrLJ%-g#s7
zHtRXP=Xy71%!?PE6`uRGF5#G%G1*E=+COHy0+V`^P!}uk2Tw;Oza+`YvM~;>#~B#+
z)2d@(iPd{N6?UA3^$5_-&-Esar34L*6ug=#4~AEYT{`O<q&}t)cC-eD5qFky$Nqk(
zuFml0)Iqs=pi!S;$J=cz%rm8w#18#hm4*3$KNGs33#e$tiEVULm8oX;CJD>s54t#8
z)bwE%g>fgag@;RundTNU)TNx@_aZ5hqISj2`*=x7m(AXiP>ED;93s+AE}RH}o-S~g
zQg`Cp(9oYR#B`roVh}DrDgJ_JqrkHGQ9LyL5nVu9+6OrNEUfM0c7vAdg<xIW=imIX
zQNPVhf4u5aOjgFiTIYL69T`_|Io!;Rf$)&rY{^P}|9(?n(mcB+JG(457`|6p3SMV2
zm740Kg(IlCC;3`s!WE!#UGoonK#+F2tX*W*)Wk_CvLs(_eXVoa<#^|%LCt5ls%D|k
z$u!Jc+QiDEW+C7Y(Iw|eks-<v!Rb5JR9{&78J@AylPd%}IxtU5L2W**iBx)NJTHq4
zB(?cDk1}56=As4$pu7vyFl>I-a9JrRf9R4Dg8#HKBm^bFynhrC&;1cDQiL-8`E{7(
z;|E)B;V~d_GLeY@o*37NP(>~OVT@tDrHfFY(b={vJ%VO-;hSC!;n|7%TMk2d(%_zD
zv8=z3+1RQx)h33AdtEr}9Ylhm#1Dl|KB>^%ladx1#VRfc=_g1M8s=olTb+H8sp$5u
zKQ%x}#9@lODJLf+nrTbZO5b4mn|4{CZp=>vVt1usdf1r%q~p4}JvTuU#8((eF7_m>
zG@fLvZ)zv~c5KzanVP&8%iay<x6M)R$~VyLY{LYeZ1hEIet$PIoH8LvT^4%TF2I93
zXcz;gnwusj*!Yzb)|XY-)bsI4F)nk4Xu6Cqbx7H+o`T+P;qype!YJ=%(mPPPBkhx$
zH(=jZ6-W?CJR9$^&qA4rI_n#PnO$13+_F?-QVOkXZP__F#XVGu2fWaON_Iau0*#)Q
z9pBQj!(C*I%N9MEZDwe}h)^{%G<vv0H<)94@`+;O<#oR<b(=8)&yh@KD)idGj;R`>
zJ=)+K#1fpGOMsXIo)~m!dOBBixIdAvuuRSE)N$Z5!+xv8$Kk}IRvATY?9B%d^2dLF
zht{EXBWYu^v!3lOc}p*>^^2z+cRaS`d0<j?Z0Hy+uAU&TU9mpjgnG-Jbc{Nx3QhB5
z;o%#eYR#;veqE^A`??A#z7UwUB<1dcR159oU4%5PS{zBwy~o(Jl?I(QH@lrlBw6$g
zpV3%pfcVLcRxW^a%~5!!48^ab%DiERr~8{<*f(tj=sv?dN(7vHd!g!aapsL#o$r6E
z=DJx}n43H{eDvDh#o&IRk&diffUT`}LxWZup8MPJjg8<AyT9KmiW_C2!(<$|1~y7E
zGIAas%GTB<M(MALfpgy8cb5w8-CNjNKa0{bwBP>pNt-~VdAc%Qe)I0%!Rgd537yF3
zg5KWCm8bpXUt-sX*IQtb#oFfb@@ftaY7Qke+3gA(+u{!smdHq?pv$SLo%<`;iU~hC
zHo-I`Xm3k@ZuOzjsB$S#dU`a<1UT4XxxlL?qOQ;>d`w_Z%AtDu^1=(LQ&V1{;DqwR
zk8DrlVep)u)GoA11g$V`UHLI6g6WsiGZ;rZ|C=gE^Qem0h5hzenYV@p23bgErYInR
zc_{0KJ&$P6)#X-NU<$0w>-su;FX~sTNyq&Qub-`C;)g>m$1?~%fwKEKKk6kVi=X(n
zMl%yr`}lZ<FOSBu10P1JC!QN!(vF3{gL5YVjDRC8LxA7FJgx0qQjn6$2izve3B$x>
zn2+ymd&H}luD-y)zFHxf)F_hAUx*2*rZn}Z1_$OC<J!$k^*R^kS~$daJDEtbmCAzf
zrxT^bFN{X=i({#UkAU1;ZgFqAsAvSBLMJ=6N!=&utZ{UZ_-$xLH|z+P`Y~~6Rl`Y!
zohd!6AhV~N)#uMpvB2Ve>S;Y4ooe4EgF@Hio!96QT?`rxEbQ!QU*Eo?tss6o4q=~U
zPGU>-ywszkrGBvuG7^`AeqY-stZFCcgTrOm-amgz+kS-dI$fU0)wxl))cRhm%FuRp
z#x<clXER@Q$C=wrjOeKB_M4~P2?;eJ|6cR$TffBxDm$&quH0^niS7d&^u09EUH{iC
z`um}VKgt$_EEdD5o&moOGTE3U=xHO8lq8m4lDpL0Vv;u=_)udCg(0&+k@(A)XaXWE
zRGzJ9_?*IDScV?wVix1K_i?a<gu8JGv*2ro8SnSLXZM4l5ndI4df9CU=<>%3y80@$
z3*S39<Q~tUJA!CRpQ_^X!xq}MFAs~=cz8f#1Q?env!#BHD%n{NdmQolWHDNzWc1Hi
zZdV_&TBvj7d3PGj_OP2X==---9Ub+tG3pyPHZ^X<ilaq@o0d*F8+UN<6kgX3?J_ZB
ze9I?$^HQfoLU5KY+{(a%!LpAszjJ8p57%~-j7VVZS;k|4f3TCw<ILqAZfED5(z0G@
zll9Bv{;_I@>fJ$PBW!@cca`ei=Q8iQqTF}81ipgqVL?skJ@YgTEsX@2C!LxajTibd
zX<fWvj6%Tk<aEr2A6R6<p_?u|X)t6_oB>Wqq?VReerXwrkIz00%zEzwCX|@liP4Z*
z{jE7T4NP5(jLdDHr5Fk^li4p%HfFq@+V7dVxVT9Aph~ScXK4vTX;8Bt54L>}Pal2F
z&B>t^7w3KEaaz`oe;iA}?6CIt(>HoLOBN2zx8?*@X&$#8TW@xh05W9uXqUc}_Io@H
zL(gnd&ku~EN&MiKtE=@juMF$Iq*`qolvo`%a$NfM5fBGM32f?*YXhp<Bxw<D$CJyl
zZ;0`HyGELi$A*22Q8F_=8^VdNN4|fjAOIAOpMxa%J;x-got+eUtv>cu@peBM^s|XK
zt512P8>u-bjWQ2gFMftO2O24+3i+Pr@9iF0=CRf|t|Yp3D{mKCO)F%gM;rr0{gKFf
zbnD!DPq+Mk8*@K|WvRMFNc>}Q!rY3KZ@cJw((N7BEn9ZTDiP!kfgr;?^Ht;r@D1)O
zI01hwHf^je6Q07P(WvLSL*4^FYYy=g7^4#=z$^id*&!&MieFP&oa$PZI@ZZ~Fl7?S
zPwnasw#=2jm4Y6<dfP48n7q{f6&a|1qQde%nIo`zu7BCb{)CpFfr0kQZvG-0d2un{
zjrm(I=pi3KweYs-DMOl<vhc&BUAm0<jMDkPIP$DG*T1V;Q}r3hx}Ymk3nL+W;tw?~
z8{4}pXDfn#{VfFE!Poa6Bju+HsHE$&*KE6BSY#6?_}GU*GYP?Op1BW^+10ZOF#@L$
zfdsbK#JylhvGO(L4><q-`_#&EU?eF>mEEkx>~3p&O+*zrjotAR_S>FoiIcUNnhG0}
zul~buRcDV0cP1xq;b7j`RpaoJ+|k0EWxNw`lasSZ^138pHz|4k-N*kc0&xB9|33-!
zU$P>}+xAZJVjp{RjI6zXjn?#Ck$#BzU5}e3&)3`UcUMQ;oTUUzvh9c7uO-K>SKK}X
z64)~OAip!uZdT6wma2HsAVly6C=B4*jG@<*8jh<8wh1>#+k6MaFa*2I{+)ivZ^8sZ
z9?5>)q!KmqjM1-Z6mM_@lq6PP#XLaJ16u&ZCV=uDm<E9Nrfqo-9U7WUOw#%~yk3ou
z$??9#A>}F|C8*<SJc)EJT3g5GUwtpW#E%C`M|V!5KTX;8*Qo>SS>TwmaLg6;$Ejg6
zc`-iDm%yK70~-;TC~GVk1EMQaj(Bky+ID#m%K^vir_~(z+F&$br!6c#1xbkQ&<5yL
z(m9nB7Yk^ONylw$(k90UvD5m<YQ>=d|H@uy={i@kVE*Cb&E=ld64dnYZ-%93HK&t-
z|1q5XGc#31jk_noWq_s6R!l3-w_EoGAy_v3(nn6G8InOt7QBk$?f#*gv^{!__Jfkg
zRk?g%^`LFLj|I!Il__<{@5Y52tJZ|OW6kVi{;{LUn33&e6UBPY<8ryUJI5R7p#Bva
zF-O(RwbzZ->1k;MRnP3wK!)Y73*Iip+(7x{Z|k_CBy44ZD$%qwG{wN9ps_2SFU3jf
z?J|0Kec$#RQ&Xa9*^G)QiK9)6f3tpm$oLD&R-jWu&%xg|=60|4C2je{mK4Jhh@O_2
z_rG>R?CpiDPuAb0jx_6w7kcZcE|>3#Kza{;XW+(dby2;}m3-S>gnELi)YV&fl035{
zu6<z&L?(Yq;n2z<vcLjg?(VNU!qz&)eb%{4)odhNqcXD}Ch1g1U|s*33t6pBYdS2z
z3tpmoQ+WJ!-p8qzdhP#U#=HWRT1SlN<B^5x>!0Ztsq*UmAS_*9r*QCNhHP}8FY|U5
z<8ZcTx0}38ov|aaGs#Csr%rc6_u&>}-vy$Vr^Fwwfy*@4JR#l#DDi$@6S!9dB3XaN
zYF^TslDA<-%wWDrz}46FiRE|qm`tu<Z949Axto;FX>&d$2`%4wAD7MP;jdr4@sY_Y
zR4JHYj|R;RD;SIr2&!t-aW<=q^Zk`+SKYC_1+L<!tCLcsP`K8#fkd_$#j6OQaOT*D
zYa=51-l;`L-!lmf=?<d&^o5*)n)I_<?rdf04Z*OIL}8_i5-peU@j;d^*s__V?r%lf
z?@y0Z5eOV_5NO%|`5WX@bC7O0-KQ35o>}dp8gRU?D=YI>16*%*^UO^!{Kv`~shezg
zwy5?(G2!&*`Oi2B^8DU9dyDZo05OXvvXc1Czw2?Z7Uytq<j!)@%Tq4L-t4U^)+w*p
z)DJCcWZe#(9(VGwnkGGOpV{eV;OT!~@olx|s8!dHVO~N1V5e~DftT{qQYO0R*-3Cs
zm9U7IsC8HJ!i0|kRNQ^#ThCxIIzNwtMy$%*Ned?VW^pLsxM`70%z3Z$E=;y>%hIlh
zcYOj=!ogi{d{4&rv4;D76)EKVZka0AO3jG^Z=ZCBT-LNOS%a6*w5Ceg{33<E(GJpQ
zb;EmcWGhLq!*_0IdYi+@Eq<%%sQzvapG-AGFhgl`#}|)d)DRPMBAmq$Q0I2yk2Cnh
zC%qid?NkaRax^H7P?jd&jmpNFqRiY6@bdLqaWN7lXm{gzTR;Pii<Rzo4o{2SHm%@}
zar5!LeP^q*cP-v%KBv=TEZc6Eps+;T+Cgn!i$c~->%tOUcG)I)LP8`Hr~4cK!s+wf
z{TL5yFG-W8^DYj$E^(A^d!tu0+~=a5vINTi(@Fx@$@TagkA!SIiG|H96T1BD?Xtcc
zwdd9d>etn@&p)>1Du!-DSZ_CJrtdpO-5tC?@Ox9P&UJfZXg!uwx7uP(Pe4E*7+UH+
zP`}ho>gsIiwl(d>eSQz|z$jz2@Y&Q1*7>2!2zj33<UuVtqd9s8&dlPG?)GNL;#+3O
zq<4GOWvvXNYvpcY{=VYY#pNtFR>N`<d%r8Mmd?3+I0+g4#R8dRk?hP^J-Q5C#3{To
zcmLkK=yjS@WnIV0s=8=+7sux5QE|V3)=J1Pq~qJ?PA=1_;^G=9zF*+;e-T6~Qb$!`
zQ_@gADW;wVPdbCY_2=-_4zl93zB6x_NzGsJN!v0Y;=kOhA~;wb!bo$QVG>7F3B3G9
zjaa&KTj`6($-O9LwmZSE@Pc2(c%Egm0rpw8e;ZUZR9($}Xxw~$7jxHXB;rCMWfE1F
z@pJ-qNcAF0P10C(i(k%rZ7ixP@%PG|K)t!!#jn;*MahoQQiHFTX<`ZQMY9~^<kdRc
zFJ8s#xLk+Uk7j3^dzM1)EoAqkrNsg+1uee6lFiVj)T!6VOi%x^&~`;=ZObuA)V}~p
z-5MOdQeXcC5H0M<X>D9RyJ{<q)3BHM!wyt<jIpVu7?K>@8YxGK=R*pGd348qifS^@
zvhA~hj>k&Y=e@x;O%A3h=57s2P}!y(Y(rE?JDJz%#I|##rlCNaZN;}j53}Xcc17fg
z{#>qal|Zcaxx7TlVy%&AN+C3?L!t7hou(9q*()uY#z~*?v<~$W8tk;Ki|WvYI`8bG
zpFE3mL2eLaWOKZdZ#te#CFp55tNmOS_3AE5X%j=nk80i;p6A&`oMLq!;hG{xNhjql
zzqr!Sjxn10aZa;#p^f`#st>8-e2ybgzZQ1o+mNIhKIpw3nHe)cTQOtsUwE<BaWV5O
zT?qKDKRr}mM204nRq|{@h@^h?$9SHET}T{S=)#%BE>lmBQJY=&Qal$6smE>?2OCVt
zLs3S-#|=9V3?FU!a$G?Z)I}jB=`|(c>dfe92EvWN>t*q_t%bD_`S%|`zSVw@$oJ3u
z4FZvJ`NLEq&h>dZQc%7=G}EoVjy$`Ejx||oE@k;$VmsVKm@@si$zL4nN`NN4xGKmd
z-k}Up{Yn(h?0~w=t~3<a3Rm6~TPdR1J-PUr^DZD8r2xh9mWeD{%Ac`Yr`bQCaRTG?
zEwv9A01IR*yC)J^b{1V3LEkyYOp#m2kxD|9-7zZb784g<t#KR88lFcY9EFVs)*gM+
zf1Z@(-;KDZA~7yRXK7dK_;BZa6Z#nZxuMDOHsr9{<n&K(O(ae(by3)s*8OBPYYW*6
zH6%;v3`t1MWf6J>-F>%VdlEnte0ROOZ;A3mx9@$^E7R2XQBS)08>FDEHZEu~9^PNX
z?T?!nqwhWK+ZvnHOQ}0uGff|z66Ug;3yfQmMN?c^7=9&hDs=9K$mZr8{FzG<|Jj{e
z{f5>w9p`3{KQ-+~f(HzAQODnsbd+p%-zi8wA<8N`LE&K&q`r0TFuK$aU;>-j-;&%K
zcZ`GWo_NvC?-x^Ec5q2j(s9OiP+$Dkii@<>5cuNi#`|u#f~m5Beg7a*KDi$sF0V&O
z=+j%@<C+xCNyzwpM%U1@a{X`m&Zu+JZ#Kth#nckV*&mBx;i?Ix=pyIl&TuIGes#@v
zUYj||C9)>lf@=5EQSm}=#;7Fcy@MVKpW&Xjk*`RmD}HAmQiUhB?Tyc?35%b!eAjX#
zs2Wx?E2?(<d@?LHYR+>|9Nu2%2uFP?4)%r4x5c6K9euRS<y>T(vT7Rzt@e*;U?xpJ
zS$DoyUilic->a=@Z_R!Zu?;wyG{oX`i`21K+vt3@qeZue9}+C9Eh5wjpPVE~Z8Xx~
z!o$m2SuXGlfvZbJpr%>r84qh;39>V0zNSlSLal60*)*NoI=R@|3<N)Us>NLYu}(PY
z)a%7r?MhLYS^UWO&GgZ5ct$omncSlH_f$3QrpFnhLv^D|jp+`Xud@u@(P5mV(JC_z
zTZ)J|^MiXK^w1%5BvmyRvuC26g*D9NbgWq5{=k=n{1dJ7o!g$Zyr7GWdIuk7nU_tY
zePq<6+{{Cv>(3@N%YxF6R&};C?;1WTU>6!|;=i6(j5m?E@Rz2?7`o>@G$`lTUSnHk
z;j~Xa{di7SCi)}~v4r2iO2UzU`k8y$Sz_o{_+>V;xvyO{=YxX6${!{3bVR*fUdGM~
zS!|xGLq~28Svh=mM?9$`5!|b{B-+=6lbTKr&-~!fBi!2MbrCw8h=do={cR7UnQYDx
zV(OW*Wuf3Y8N0~JvI-#{hZa%s(|8bjsRC6+nlfg)iF}mdU$Zer!gBfZ^RgYY(B*J$
z!Hm{272$0t6}txGN84#p@%=jqn=k2$n_odqS5<w%#Y>=-^RTAFojbG{U&6v=(A!#@
z^*nc+wjE40KxZs0;*4d*2+ol~NJFWoTX43&Ml9#eRSF4udZKnYJz?c&FBkwz3%mMd
zQLdj>stI-I9;EnLz^{8MX=87ybl~nUR0b(Kuj2Xk-N2=hrcru??_-gFw0Pc@sD{uB
zQhwy>#X#1035Sc+e_U9e6s_GgV;eK&caBM($a=>X{xUu-wRZiWPkiU(rdti7x2Q{h
zj*2MFz|g0~jQc*3;Un3Xx^cY6Vss%X4Q&eR2~M-cDK>c#-*IYqxZa@xN44|MoA`~8
zXJ85o?&ub$0|iI#F%UE^lReaOHiOAH#r(G3xs&jjce^qEK{sU>vA_xvq~*iQN^Dc5
zE7hCQAQy*i<x(|O#p7)beT^t!5%IBwnP{tN;KRV)FrP((?EMQ<d7Lz0Y94E+#llJX
ztqX(M?9<Mtqa!Gih@HfffHn_oX+Djm()J`-)2^D0)O{Sdvwi-Rd2NfQM7K{}7W4F@
z9ZxHMwWBaSPkN@LuvwICK#)YyHgZk~^8&jSm)ivUyu%M|czL|;d$1K#by^>LR63#8
zDrm(0z}@SH@Y|f;@v3trC9q`c{+-nNwF)3EqtG>MEGyB7Nvm8=DCbkUR_`HiMcGZ-
z6t%Rv@f;c^Uv%+I`{joac;mFP8x&BswFzDrO}Dq_=N_&5dm!p{13m5Z_iZ0uR*@bN
z-jo;AahcNcb^j&KmI|+}VBcKxcyQeG%cY3Bd^?)#Fa^xUUet!o2HMo%wjj3y2;bcN
z?0Iq)(8jN^L>O7Dj3qDI6<>C?Hc(se`{Y{@>rmdt<fLe<_?gvM#r@c;!6R=9<RSMX
z^w!YLp@#M;^AVm0;g{DUIS6^=iQYe*3#hXHbAg^<7}KoKRW%FZUU3Fj0zhIV=D91O
z9#HCmQ`efnFVEL|U9P-Hd+@FmykokSu%y0hb8DBm3$Xt_@VGtbo*<q8C;HO{U?8B6
z_7~(twi>98#4yGRuN@^ntK9&vlCW)L>wS35|Gam6rAMS4AMIm->;nR+hQzT0-#82o
z^rL#%|9q=#`g_6k4PPY1hH{6s*<yt$%;mwnqVDPW?Hj#(2(CH#_sSv=yoVyPR)qes
zI)Vx1&z@#5O5vU=yC_VpJtafhr<TmBUIi+j*;pF8zkaC{Ik#D3O_!MXx!QKCtM;tz
z;=;JFD0IW`st}M_-V-k$8~rOQt4Ozz>#_bL`>3^N`rio8&ODWp63OpT4h?6CyPQdc
z=SAonXlI2a5=VWeY&t@cge$Pe?S~2pl}}3lr!i&HODDv_Iw|hZ10+sgN`G!nK@D=?
zp@x2V9tQ`%ndW-=pHE-yj%fxggaoev0GNYC)e^MU+p9fw>Yw7t1)P@EbL(J64hg+x
z8@}qy#EcBT80p(|3P$GVdCFg07nocd>i$w)eKG7^CloB;?>d#)8SDW4wX&a|Zw2^O
z!43gWPz;^Ik)MEO`W$jn9S;;_Pf7-)q~2z|jRC=E4t~aG&!%mw3>)>-H4T7zum&GA
zDmWGrq4Sj%b0Q6mx`WfNc%dKP#IcHslCme)*_=~HcY3WzMvwxLG!pswm;dPe=RJ`7
z-_pG5(RlFj+c!b#Nb@q_wuAyX^QNn?a6wLWPcFLoDq|2<#ymN{H_$hAE=}FGuuFZ4
z#PSt4%$|O=iWBgueZd0;n{wM;&$HApQqg|(PU@ZZ+s!W)bS%X=X5`Y0(Tq&L6(WKy
zZ3cHvIe4i4F%e;y)RFDe_KQOPUSiu3m=t#b^#@os5Ffw>vC6d6df=ny<yqauk?ZQp
zhri^AW?*V>hsprAg@ESS*x$TmA-3z131aI7{dsqC;$Bgnr+Y*de48MFpZ&BEriB>c
zBUCYkzK&}=U(9s^D#uMOJ=d#o0>nbiT)42-s13sLtsW{ofpJjXXQ!u=6^^-@2n}_0
zoy<JIwS+{3B#W^J!xhtNIt-$@ELGiARqNya?kCw1q~E{Jr`djdXbW0yx%An;`boF~
zSbXIcCYJv#>@HJPI!iSxq;sRn5>9|}=Gti8_Ri3kUzq!Ys-N%U;K=1$S%TM?j7bI)
z14Emqr{|CWZ;EJK_?7q!9FMsYdYBYbQ+Rt?GQd{wgerE$YbU`^fp(heE<Y(K>^&72
zYy~hLz^fSi&e)eG0JD^paCr5M2;|neR2tZ}d_TL-szRv9<hq=G_j3xZ3JR?#k$Eoc
zh3m1JhqIEeQldhMC1N%6g<UVg;{HAbyr(F8j8QxoU778Q8?^^|GXLb0OeR$mnT%3U
zTO5iDLYQ&lUHe>#j=$@*ipe5zOq_4X*SX27BQS~rjmXuCTmG6?>agpX11Rvbx*b3l
zHL5VrvC(7=Y2K>#s>#X7FzX1y#af`ke=2>&xYWXwF^zzTH34@@|MI>P_*HYYafMES
zW@s+rk(ztR?|VfHeuEoG?rN{XW{vS1l%T779$0(?RkT3W$|ZWnQ8(4*LiiuLWu_;k
zs9Z6bZK7=!tII+d|1{IYiVp!2+SBpp#{f~DA_S=MUW82rK2`!LlLPVohoXd$oP_o%
zR~SagKwP`I84Sq;h~KOtkq-Y)%XdSp`Ud4Sj=JS0|9399?#ur&1-o1*f8SXIT5Vu7
z#mmn<A)NiB;z!XsbKfs%c6phDI3!GTia+W1l{EAU_={Rr_AzfpsTVz`xMfd>%7aW&
zzJH#xb1;9M1EiU`nKlz71IPa{2m5~}EBpcg-{kGuXG~lZanDU$#Ea%(E?kp!zSn0x
zn)v}6SEFj-i!$@Q;3;|}4;Z5^q<#ZLd`~_YZRU+*6@3ijL9qGnIz-2@CCfk+6bgah
z6-*b10fae^v)dJa2ZpzwL$77U>q1hs;uqg{h(j4b0&+|vqZZuOuY^MH<5ypmnJX0M
z<uYUd<ll0Iy^RUkP@cuvbk&V)483gwGH9m7Z9Q16`!Y=@X4vdP3L#I-Cy@{rPxEjx
zCn1UHB5@2f3TvCLSt|ok_6U4-#6a`f1H7s0o*@v-{jhckhXKJ2d1FzedAnk~$QwH%
zZ+PqO)4##YOae`f=|H)Ww4pbPWB>ONxD@*j?Lsgo`x(`Yvt?@LYZThjR6`4GtL7&N
z!)~_OmN{JYissYNof|lP*5H|rXcI;}J)UP~e`_mPYr3AU>zNYFH9zwmooHouYZ!b!
zr#QEZdDB?})It*INgV{qT-<#8yuAu(41{{m2>8J?(zp3QN-Ase`$H*?z2m_N-3Jed
zMkfE7@gJ8|T?Ic9xka@#bc^$BfS&hY2H>0^Yr67K&{gEXKKhmf5um<p^^sW;^SgjI
zHY%Gq6-gw1V4$uCG_;>K^fKF|aE#u*RZv&|6?l$Bt`61K)F{Zk3Jb$!po__Cv8*^d
zKR-KjPm*8m>Uvld{o%e-T-SLI<JAKR5WxrkI<$bz>_9+`2c~P%CF;-$ZZUBrdK$p+
zv0ac8#5eTMkW|{R$3G>#y&K;0td&HYuN)|vZ}tQv%i*??<F@VX<&D=$*G=`gsM;G}
z4+>sqH-{@>fAhNz;?$e(Lob@|+?Rd*nv3W#u0ifp$_FKetKv&RDbn_;rf)_msaG>I
zFJEQ2#H~=1wUrBK(^vROs>uZe+|rdzH`gl1*iJ41tTo%8cr`wM^tp?~;^Qn2KDAJb
zi$6DDUjy409H=mw-`xhg)MS$Z3kMu;aQ~5GTBi0W(OY4k`decvuZB7Vf|4w>P2+yd
z0QhvGwv#i@mF4A`T&RgZ6FqerIaz@}9$xQ1dkq9z)b-U?7)h~joe{Y4GPH691TYNq
zxwr|AuFmhj>{zHVrTK=6zVk0z+mK;Pc4ig^vfAm{Pwrk~hRoHw>Hi+Ofy^4;@}f@b
zZ~ww`T>{AcyOA#+&F*`Mq$>NT`2TnAwl2mglzw)<B>LZM`R2nc(H+d2#&>BW+wTWs
zhROA@|AS`;1{dz*dv`}CwD3tuc213>KGprB<sn?l<bgzBCofbC<4M{*X5ziz_JhN*
zz`7wU2q94`*LQ=DS^d@(I@MQ^n)`|W8}Ju9SP*<;a%nbF{QAGY_+Xd;H*YBQY?O^6
z-MJtuf38RQ+=(R+xDo)I9=7B@d}xZJRPy?#3nfrP+Zw0Oj&I-_h&SatZ;pcp(A`Me
zxzE{LaW%B5uLgD-S)h^UfxfG-PdWjl)#N4ptQ=Owi&|R(+R*luJ03UFKiQRy*@R8m
zG6m8G(o%*&?k5lYQ8-Zm&Q_RA*uWolE#{ht8;}J|-5Gb0`F&8eO3btOcP(-xj?u;J
VR<86Ej@K>lN=gx0B=P3M{{_gkmNozY

literal 0
HcmV?d00001

diff --git a/frontend/editor/public/og_images/saas/app-processor.png b/frontend/editor/public/og_images/saas/app-processor.png
new file mode 100644
index 0000000000000000000000000000000000000000..fd1ebfc620a23d3663c79611ea07dd439920afef
GIT binary patch
literal 128154
zcmYg%bx<7b_B0S=v9P$yVv9QovOsVPEbb883GNzLf(BWf;1b;3LU0YPNpJ}6ZsFs7
zbMNndRrANx*3{JOJm=}t-KQr)MOhXbgA4-!0RdZHPD%{{0l69h0m%b^^!&>=+5=1k
zL<9tRDRB+2j01nqUl!8w9+y}faT_^saVbPx^hi8p`m%6StqH=ObXOhXp6$w3yRmXz
zRe}h-USvyY6gqKS<fQUV3aj6KfxnJQi%QGJckh3bwgx<;r{8By7qv=sYCdMPI_lIP
z-AT<%np@|2LXS$OdDZh}K9TX;&J?TubAqj&itnm)HAYx$pv11*Zhkt&pqS$Ed>G1_
zuxS7Kd(l!DGcwtu<*XS1^rv5mTAe0^+EACf`ywA5hC}K8B42oXf#+gW{i_T8i!*16
zk`J=lKOz))?qsp6W`~*6lE*0h_djDARyo~7ST`5zYxmGOfB7*ijd|zE@R%?wR=g~w
zHEth3P@J7Sr+G4jC}RDD=qyr|6PyJ8b0PZux_r`hIjLpE?7XNh_VSo_t3kk5BO6tw
zmf<^bN1@i!`}T`NOA)f22)3v5_#3)I@3zPW=_WV%on#>UOU2`irkg8oH|;-d)^6%L
zR!f(MIIZtb*BP#t+nT%H|9ugY^{UC4&0+`SN|q3BdDAb!*)PL+eVVfuX9z_L_c&}&
z-8JU4JMUOHnAshjvP$4ZdvijXF(CQVkH79Ba5B$`s^Ax~!h_~LbW@8JtoBUdx^S`a
z*!!w&cZ=9h-YsPZ@VqtVubfFo!;B<>hek<LRksJbSr{zYSplhbUrz|)N#C;%W+;(j
z;Jxj=^S|RXI^J73fXM)@q}_RD<SRw5JR%CO$J(y%ycORMrSRiCO}a02TywN+RJI-4
z%o_h)Pri;s<?^2JqTX1%pcs5|2okDjmeIMK)Qr2h3|>GYfA4M@PNK`HKtC4SaDtbq
z5#G!<Zyf2-F2Qj|5w%TkXP%FI67G}kQoAkj)a)W>wpjTYJoI0u>DC0)#OK`!oaZOR
zk7m2hS|@Q@W8e@v5!rwXx3!Q&C4$x%xr<DeVxZLCH&z;lM-9d38+sgCvk35B>!^M!
zpZ{tYz35`=J|9#{pp=K+L;-aALw`ojS%YZ)M!ufs2cK5z4>jv3jvuU~!n;HV@I(PM
z#2v6Sc9oD}Ro)v2HN-%L?665{Cp(Qgc)rU7{RVzUolI)_uFtF9<*b9G&b}*1Yq}B0
zYHUvWeLC*<3+t@J--}DS&QfVswRLsBO=Q*5IR`V^QTV7WwA#ccYO464uOb(Xw4NB#
z55BV86~X^7|9oMRLZ_oTm48K1dPNbA)Rv$!71*das$YE(fMd|U{v~R=!Zt$%1bZ%;
z%_HBV%o&i`e>YL&&3uLEBX(TrX1gF;KktE1h6<Efmoj4-XB8HoGNWge!To}+))9e)
z+nM<^vo-N2;wyn@e9QLu*PW$CWt1m0cU~HPZw@QsV@Vy@oZmQ`DdWsC>rgoEcz)}B
zp`5A@DZ!57cd)zHaPVaRy0h{pr@h~=rFB7VpFb5Wrq%g+r>vzqInU6?{Hnd4_=&T>
zM5mWl<7@p*%W3NaDnmv5;^kD{EKjUUQCiUNwOtRBm^ZYF0CNJeyYg3{M^C;JRM-_F
zL!dZ@r?hHLJ;!79dz;r!S*+Who+n$uz~wft)1~WQ)1_U1A;VfGe2rXiE9u<ktubDe
z4BiY=Tn3t~kqlgQ`{j)#V?G))cuv3s{$UzVv=3Z~N}9PdRpR{-A1{RqmHchdYBW9`
z?#2rOR!LL7AlE9@Kl8Y_o@#x5Q5O+yu6Lpe$p}bq2PHRU#f-D~^n&SzNZg~%iU#aa
z`XRkUo-<15_hh&7G5zK*lOCjGx=@9?P-U~Dy)J;O_;>L);U0HH^Pz9?@EzDw$;D+!
zx%=f3?dj(eg5KJ<k0SV-q8{R616;DqvTQnnzLA^j4~>TEUkFvwceN$H%WVt#f(Y)l
z1+J6X+nT-tUD0^o8T64^8%YDLjq-Y|vpSY8ZMO=6n?9Xt=_z+;e4GFfx^nokgx>kE
ze)C7!G<PYxv_1@)x~a}(GtKJcEBX8<<^6YYP&G2FexifbVOK9{c^A=<lUF{A+%nfL
z4b&1ktxi1*CYov1Fd&C+>&2L`KL5gBsQpfo)?Rui;r>3eHbedaLl%b2(ACboE#ln2
z3mSFqPNf`1_gTJ#&6M$L_YYfmkx|u8=EM}4Q@u;#vN*ih7*fB2$zK93@yy{1yQ2(`
zXJOr;BJ%@L7iML5T@OXVQEWp7ai!tFyYnFX%DP0Kh1x}Xf<!*8J3rGamky>U4vIRn
z=7h`D1cpc7?4SO|tCjX*ZXxayt`Fax2Z=h)e1&D2>h;%-Mt)B&@ks#MD%<XluD)3R
z2Z9oMMPT`^2J7dBBc5=2Yf-I`j)hexoLm}uXL`Z&FH9lRCep!V-m|MJI3_XpXXve~
z+Ku}W;cSe&caUQceN}>rNywS48QQHD+6eg$D4JT%9|pcY<yKwkhtU&3^-!XU^dxS8
z-d-W9W+AFneF;neA3#Y}7_cLBfF`YM8Y&P$B{38$tZ;>QAIy$?PWqU$FI6@n$&`z-
z)FNbi;NxAm`c#YI@}LVLdce1^#2NJ;y}=8&>j<tGCjy)4M(szsKTt`;EnZcpz1Jsl
z1$^G??f90^lC{g@co1%Z3e&paH0qrt*vY<#iNC5W@TNcn%`8}=0dkK-35h4~iVB_(
z?A8<~Fcz1suinhNdRZk<V&N(yHEcBoWeyBN(;i4Ig<Fk>y3u03pzoKr{dq?5uiMLg
z|LMj2>4H21op&2}jvNEic2am4VdIO5>Wh*9ztYEFye<Uz)tKuFv96Eu7r=E0vm~Wr
z&n_AR_B`DC4Tt+yg~C!63oC&}a?$WQf0kKmQ2~uwl8N{zd?Y3cXz8I%{G+Yby<~t<
zltAOCoM8zICobyl(C7!6g0rDc=+B<HLfeW5_9_x*9vj@kQFAToYh$+~Hj#9wdwDlH
znnwis;6&Ne<jd7%vO8M9*k>%|)Dio6{zhVKnYcQ$(YE_{=PApOD*e`a&5-{z)oA>S
zpQ|;lduCnpi7pvjMlXxzTeG<`yEeQV(*yVxHLie2P$KQ2YH<b9(r#3djJUjv&1>M7
zo+FN}7y>LD@KNFhtl(A+2ehhD0Nv3|l;e0Mr?3|Ui7k*-^$dEeY!-qNrH=#pDQR89
zQ!k267Cq&=Ky#8<D!wGb01WL$m;Hg+n-isxicyqT5V%D6CE5xLfxA!@H~+&Q<yYf9
z@?5V^XX)$UJ$L#pq)li^O7E``9sFx}-tm-5F4$6h4yAgvJEOTk(8)a}=SYORbIay+
zG+Q31l|A^DjhD85xUGCU=(lTz$}wI$Z}oT%A&G+-TPwakI^ng+hrM?Hq%!dk{L;s`
zGe-({&sPf#1^7u0CPJ#bqm9*N2xAAgQ*e}hwnGUW|BCw+S12oh{4XQZ1&y}W#eQe-
zxES*XGxQ*+@o_0j<AAOTR7cgnqu+V4l1-dUz}LmTDEBn5ay7{;Yi=Qb$!>=HVBIw2
zFS;Lbozh9W$+Uk!zU~sac`L8x*;1%EvTYQ%B?3F;h$>yPPY^FoRAIoWSGTj;-8HH6
zbkT&2O{2}Lg--1GvMB>ZH-y^i6yK_SG#Y2F;`_}0lhDq=Wcy$-1$9fC+V>t67x#PH
z_MW#QF(>=m`M-$8pDu%O<}0%Q4?J;fceuVIW!{*MuUR*H1^v|{DHTd3AsRBjvFQug
znt?FcPk8*Gsp?<&(Bs#hf)q2;RXbuRR9lT`?{p#67v;c9fT9FolqZ|>Q$R7ym^cJU
zRdEq%13;ITz~DaqY_0VT*z^5p9sGANcr)!O<M*B@7P<9YFIHnH`}RovLH-!lv2!>%
zA{3ObFs4}KMxvK7{bO4bzV9M$(4ly!{FDR)<Xt1G()J20Xy{H1d=bL=jFCtyq?}gG
zOiRd2fwH@+JHU2RXD#|(Ur<8vz_;)HES3pTHi#du#L$$USFfv`l1598zn}rBP1xt9
z%{XYlRp^u=Jl#)w^jgFLlR@l2k5<fWRzaJ0F`P>{`UdZq3W)nmzNe~9b-WwglQ}N=
zrvCfZJch@71pCM~zuP!dMiv&O4O4Z~zr5yLbUnSXiNRlos(UDt`HEA{p0uPZuna1%
zoXZbPJEaZ7lQ}qxh5e1b<=lNqk)K@mlFWP&ylqZ&Esa_a4zwLQ;=)a7FLZCAMr%Ou
z*0Jf>Qf@?icR5ds!!@}_Ub0!Z7jMpqp*xD?@)O*Wi6_Q6JV94?ms+6}&bYE4yf4k6
zywI8K=F0fHny}Vg7xSe-)hy$RIsR0OCQ<W?#zCpd#dx1XQwr0e!}C@x>{owfM4iM3
z*I!uQzn$B(t5~7-QAv=Vrly+T33So>0%Re6D<OODY6U<hC~~O$v^*j(bXi*8;G-*i
zmlfm9OXfBSfJ0ykSx7Wr5I#nG9&~49V<%7fv>#%Fh2oATx}gnt+Y%NBu?J3|4?A^#
zrIL`zt`6g>6IfK{%A5w5GXqUK3zZvZdSr^9%qgh^UqIKpLqNeYcJuMwX-$`Y`)k3v
z($H4|ukOvMyUi$GDxj%Zz8DhMtLM?5zN)s_)G|{S8vX^~nM8c_8k)pCoXNtvi`|=E
z;g7se@}iuR-jUwn6;vLqAvhSzfuQAOQLx@vSHOVBP3wYE)}fOkbgcB_@gfQLWrb*P
za~!@#mCR!6s8w&(<)3M6@SlZs9+SsODmoxG18;WGQk(xE{dcyKkd;!!1E!Ywi8SXz
ztX+ujuK<bdib)r+3F>=inN%M8X{dF{wtc6z#Rj{)o%^6#LVS^J`m^jPcDy^KAJR<n
zvMZT{_?t#n<L`iANkVqaLq{C-ZYf@0(W@wOrvmihEt}d5HX@v%>Ak)hTq$5GAAZW$
z%<kLC=BZp%{2%`$5wGd3@^$r~gC7j@AF~ny_Kus(c5?F)sw>Mpu%Jf?0~j@Kr|tjW
z8kbBns|Za}Xa0`iN=}V@gSvX^HK*T?F6)g*wZ5_V$|F(m5k@fH9{Sp>B#dj{v=)NW
zJ!u-!njJ^`(m4LpWQ~^+PHqT(jK+j`<9t^)kG)DhM&=+dZ79BnRGwoM8=yAW`m|up
zoIW_F9HyMpM>wt?W8SlCQyk{hYv;&K1f?3e#Gz9afFJ%DX5&~0-vv>i@4MAXfA0Ps
zj_+X#narhuDdU*%wa64pkoBE|ZeIfkZ`k9{#&i5@@u49B5}$aZwn?hEPB{?qopNh2
zrmv$s5Lppe2sQY2k7NtIRi);dh_b)j&wcaNwX8>iWt_FrtS~06+53bcvc?I;#`(+p
zzSQYDr-(2`7h6bpd`y0Azo3W+rf2AEqGr+G34g;m>`?*3hcCtVrVQ3879HaCa-3@c
zSSxE^{a0>VhK=677i#FEPRBg#3b+G|SNO(6*I9v=1I*0jk;8D{@q<kt%^wvr9-~rE
z)Paynx$HY=PIh%pZOP=xX8c0Udu*5>>vnC(LXLl8=V}f6`!?t_L{kK2@Zn;C05(^t
zWt1Y@QXyF9$;nBpaaSP8=;}Wku2rkbA=xGA=B<}(VE7Vl73{WKo?Gti?DthLHkc|6
zjURY?X@0c384Z@Iq<c#Oz6ecLEV~Huy!z3N{2pzejFlFN%%=Os0c*rNRQNxQN@n`)
z>CCH4Nqht=BOFkcX3+@Z{u_I)0#{E6S>yI1-0BU-`Xx{;@k4^nch_vJ&F{}wX@_9N
z(I82_5P|6ysd%Kvh`?H7F`<h}R=Dv&GLT3Jm9kti7%~-xtip$V_ezaC!7D#whgDP;
zVoo&w5(US^5ph`uVnf2v*#69gh32et!s3E!90$nI4Ong4ij`k=$<IhDT%H(HD&g@L
z$l#+8<xVxfwt4$gw)l<Z1&73g;BD+Fko$8fs<=yaiCh*Rbkp4nsnJGAP%v2Pe4>dl
zef)lI)gH-?dYNYeV^UGxm&P~qwDMOJg1n**^@jbdmhpJRndh);j++dt8<~FH{b3IK
zL{uJ?vDnP9)L@L2M<br{&JXFerqCssFbm25_Vh(Mb+CqkscZ=l^>;~J0TuWHnR~%F
zH%w)$&o?FM&x+^XyABRnUQNX*pDYY)ZCyWOr2GktjA{iqi+BBx=%xkH;=F1MLT*}O
z`uJS~ZpE{r(dBohHXVq9I?^?0Y`3LpxKz8v-Z#5<W{<16Z90ueT4FU{8}RUEkHr{R
zFP4%vV5@?U!XL}BTnfB?kk9q3`tWip1V>NG3w$*ExY2Zct@wY>s#}l<eUXU2O7VIC
zmDlJR2oDR`e3N(r`gAikr6U4U!A4cb_Mx;uZlPRDt<G0{4_m;@N|()=vGxT-oV3Zf
zTM?`=3xAqn^w#XB%fjb$_W^8$;G%3!@1z6SviL?{7gBZi7DcyDNLqh=##$;J-K}Rl
zx0k_@68$7z>kx%)IzVPj7l4y1A>I4Mz{E!cmNA__rVdUj=+Ai_Q;sYiJUmpX9h49^
z_tMTJ&9%4f#4vwo1u0KxUArKNB?vt!yc#E`kGm582P#RG&amm_O9@PJbekb`24V=y
z(W@bh$)Ag55i1Ntun9eJB+hUu7w8LCopBI<Iwc(mYxt%y3Ne_%Kj@6EJNoQA026nB
zD87k(A&O0T#|Jk*s+I%&7pN_+QSmDs;bSD3#D66l%6i>TWi<pIv=P#(v5)fbmwUo&
z{Wcfd3A-SA`TAh<u-|Nu$m9)JCN5+w^Ja2;;}Vz`Eij&F(=6L3&4WXdUi5CMJEZ<L
z(E=s6?-WgwNZYT=H9A#P!JxJTPoqkNIPF*L!FG(2qTTg;H@|%1^r?OuQG6OT4RMnB
zs}xHzCP;thFTZ=cR?lKbC4Y{D$SYLy2}RPGH?e4zRD?PK^QV|p46oa8xxcV~yyPOm
zE&Q_=8PHuY{x)=%S~T)=1xhgp_8-z-4i^ejE+j<s>rX*|KA?MsqI^T$*tYCtes1V2
zJ^&@{B*Al3sk}N$i`MOdT`=1PkO$fz0y|TRK)%7+eMvDbY3<zY<p_>4_r`-p<Iq!0
z;;}VP&#10s{*F)r^bf|FRJ^as=Bo2Th}yUS<;n-iF=^;t0+a92%{Zv=9G$v1*>%N0
zG(Be>@sq4-49N#14w;M683K}C6U1D#&z|3WiX6AyHh+2p6Q?GRENS_uLQK0AzYwci
zATyFKy>-K7->_dq4NdPC9q?Wno5YB!jB)78ypQ>k(jWE)c#V|Shg=ML$$^*pplc2b
zl(=^uaC$KvMBwjl0FZ14#(L1xHw08pq}wE73)~bB)sB?XX_!kO|2hoxa|@}Qp@O>y
z{XC%Co|v{FFMf*r|0>|sWfruIch!$?RdIaLsSs;<@s+u}g?R1p^3E=Ouj{G(W5!SH
zj6|rpA-^K$P8uq7rARL8gZ{pTAjJO=+uHv)VDw#|Yhrcfs?)KxL|hIHPO|V<sjYGU
z&#l@oN<U^fJ}fGv<=Qg2Q8((sb>G=0F4RpuOq*gQ-_3ozI3Agxw%EvPtEC+eyrFcT
zkM%Woa^PkPvBT`(omu+qoye*YC}vU!d7&q53o!YQRBt2r2R_FOwunVejAThqBlxd?
zK9uU48MX;~po>mBK62kuaet!9I9dvJWhUMDRan7f^q_hmPVVmSVCMp)pDTr4q4;ni
z|6`^hUfLy1>2xc9a{NedCL5CSY!=cyZXbZf9fuP24XAaWZH>1yY{D%+_cElMehoGu
z0?2v+Km`~bm@B?Ya*U3?ihT7c8AV?z)JCKz(71Fo-r{mYI<i#N_p2R&N@jPHK`=E2
z$9GwbgYq=u57~oRtGd(_VGP8WsHtTnA%$NX(v_93h1sVKD+!}hB43{gBI$s9(rbge
zY!Jb)OnTk8aL8>RktyycuKj@SUqqS9VJL=Jt1&FY5_*&eX<rR{^Y8A_>z3Gh(9ut~
zA!@amMgQ9l_(jUgEshbdWxr)u12yw>d=#4S%PX^i%M|LmUorx(ukhEw%$Udl7q?y_
zFaaq1^&<?Q)l+^fm4obEPddh#N*~0+9V}RZ$NEgx2O66<1nHcc@s5JVrBE}9Xll>B
z16&)ECz_1SJiUVqvMWZC#0WIT2;=v|N-CY&M~Iu+BN4F)*a6#=sIf>kpEmzUmDD%<
zE@=pMjR^FwBAn8%+PJ_cve+>;M45bCGFynrGCauAt&Q4OWpasyl<<_F)O-Z~m!vB=
zU1elS(kaUgmN~nTQEn#co$|n=GbUxePDrL+<1>=3X6W<ydc}?yhrAcdRd{bx9R_rk
zC?UBm|LiJzKrWRL2P|X00($hyg^M~{Ww~U;;o^|y$2cGGWmkMl4O>{xJ95DR=~1)A
zj7f{fQl1-b>q2aPDr5`s;;*EQF(K_I?1AfNbM`>bcY;?$0dVrDgLz8286q%o`h!OD
zP)h;(x0KKqOLj=y!7F4>d?XDLE==dN7Zd}mF6Ja``aAlPiZzbNU9ai}yRBX5P<&?r
z6%(`ipvyOKxR?)RbLY<_j3Q+!<y01?4e5f8aFst;`s)3_sBmKUW|hEBB|<|BG0;Nc
ze14vJV>VFB+}?cI`ozEde~YbtJj6$@eTU`s>wL9_UiEB~7Au0ci%R0yt=$zm3~tH$
zs(8o$i+5aONS$9Plch*6s}@|G1=Y}>yrXRnIVk`q&K)hQ=%M%>u{9l6Qq0ENHtsYr
zeE)QL@%BYO`Q(u#neigu``EiCN;^#+0*j+}s=sSCc0gk4J2ld|WeH%ikthtYOqg<W
zE8Pl*^uET=Vh?F-ko{lHV43-hzwYvR-aBSPW2F(`XMc?Tr|R5K$#B1N1m_HEoLm|9
z>M#`{Te-23jS|7a`7c7W!@htTuo4j5i+bDMnHLr}8sVElm2opUowhX~Rr1ydjR=|&
za;Z)T@(XX5iIh<waEzb|2H@eIeC@+66nFeUB{9a@62^6UlI654NfOGRX&ej-myyc!
z#xbeo6i`CUrQI>dcej2Fzco3`A)S?1)H`#zPCtWQ$bV8mF(UCIsL}thc>q#yX%y`j
z(BU=Ls%!Sw!*p}8?d%08oaW`xMIqH{8CRhmOUEA8ARVY8YMFNca3yAEBbJLhm?{+4
zV5Tgc*<6P#wYNgPwQu@suhn7=*T>{H4-;yW{{%>!a7?jcl=v<#HY_Zy`}_}%g?81d
zrm0iBTn~PV`veQ*dS)ETBV-yU>@s1(mwr%nC!UVnzRm~_sm_?@eRpY??~_YQJjM&c
zE}~B4Gf)g+EYDyBZk8}Gygae+W}KA_&n(u($=$4tle`W{vHy5tt<73BlK<<-^xd&b
zXIb*fbkuA!bvVO2_v&8(&_Pj8hNhH@D_|`Tf>l{~Er^t2XeoB_q0;I~x|d7uvx(iG
z)@b6}y<=T%Z!qaqF_Uzl*cy$p_3X#xt>&b~E{gwQ^nNek<F2ae_Jq?Q$1^r<Au2E8
zg0cKevDMcBi>N13@DhCN4cG^@N_!u(17^{zKuIlGCt79cj5r@(z`45XG&EJncGO0w
z4{!V=KePsd0hY>@UxSSaOx0{UrlAjUM+iSNtPUb=DxP(G34jPJ9RKAtP$JaW7jW7p
zQ%5CHiJBlr_p0v^W-t53E71^P4J747646i!eIFUmKv=T#NtO^d*qa5XX~_=v)7r1h
z=DSbJgGmKlPC`Z`NU!s3zUAi>d>LJ5Oy<RGC6d>oF+(Xa;tH-OlnRJJLKi!nJrFVt
z2z7|GvJ}X@<V((039xdMzihv~nve61??=z4G~w0}-LrlE_Zqb$Z^UwS&^)BO(3h5Q
zJQ`PTbtaAInE%JYUJ0VjjN#nN;4r5r(!Y>Xogj^PguFq0c283S^Ulu_9b{Sd%VZ)t
z#L6endrP$8>H2gl`NK8;dS`b;P;xglw6&q~chxCI?#|L%<C%&Ib~uAwEN+4JziUt&
zT-f7FELAMGH{h?IZPe7#zMQ)Ybwb=ik?-dVS(n{(;E7qmMrqWo>>R^`j@v(^^8!kb
zFpI_iJ)V%}1<)goPpDlYGW^DmOu6LV2O#S=+9c-=-CD@mGvgM>)d*>{8ro;t=<CB0
zK3zc3*a0DD&5*SD$ISykh!S$aIMEj+HR8HDXf28Jk^sml8l6HW<R53;luF^*Fk>-!
zvvm2~gZ#-ts0Q{xn^1wLml0_8KwrSLC&Y5@8c0Qz+db+dy7lS1b({G?fz_)5Ra&Vu
z%}$v@AzivOrs`Q^#{pu7Cv!+7az5jh4K450#)qbG9Yg|*)0bD8BHvo`jQ6oFOBpzO
z0X$lRbhPJwTWj`l!2>Qgf-AG~w(r(Oiu$8A%}a-A!(C~Wt=rV>4yWd!#V7h#P0sh|
zheuYPucX`*g?0W<YY0j#+EjT4m2>ot2oGxPsj!Jy<l>iq$$wk8qKmUu9N;?M&a0w+
z%8dDT)>tkZ+MMn5h2P*yFyt{s7?N1cF+5q8DDHhXyK(9-0vq(rQmM5WG7>3{Y10_p
zIQPAuH#)jOf{s~?Nnyss4iz$-Us!*WR<J01@d%6IK`o~d|HgwQE46l>H*hzP<5uh=
zkjvTWlNgipkVkcUD#%FxaZc@muPr6nKJhp*>FUhF?*FJ08k3U@l7LB=00@+AsQi!H
zH56@gr%|Vxljtr;X@L#`DQ~78r(XL2e8<{B3Hcg?Zm0HHIoT5zz~R@_AKhFWm4`!&
zLkeodkC6>exm%Rz0@bOR>1DHP_i;yA{3gtbWXB=5TY8rh(4AG-<k7IC(;Z8Oif4Yy
zI#+G{8ccUUZ`~agde)ICwN7q+e=1ai$)Hbzir4UohLZ#ViSa2}vB~#Soo$sbHY5Z2
zHd@qR$CEH^Nbcyu6VV1IUIbCqG}_tXd-<_;AESJgo(dd%!7QCDrKA#1i)-uDZT)Ox
z-f*4v$NQFu127FUGrQ3HqJqz8d5j1aQs7hs%5uPaoA_s2=X+k0aYtIr(cvzbemFmx
z;#lpK#PP7FblrW+mCHlL|Mk@j+W$}gCV|Ef1T%YlgI9&!TYs`pqdhC&cOlryQazfA
z=`7gSyWS7z{i-_}BOBhKGoWwR7_79!opv)RvW)Jb>_gd$ncKVi?nEdzU-G6qlKsVO
zIYROeOh^yVUXVEjAmCl;=B}by94aAz3N+MjarQef+47{BbfsAQ&gM14Giw=Ly?s2R
zbA9WeX2{sr_*Xy6WM7>={Es3*OWK$%5&VoryBXFw-EP>APQ$T><)ro!eG(~YkVCiU
z!U=}FA?RxK?LnGcdsGs_@YiZNepo(<wiA6uap2CdI8^8Ec#NFSa?A4y5YrIc2$p9+
zt)Qpg7kyoszFAm_oJf!T+;O#JH{Dp7vq<=naCWCIK2XyFK<;yQ7}?KcW9hQsCb2X5
z4qXY2*;M$b$-sl|Cxfr_XPFVkHhSMe21b!6Vsq7G+UMpt`9(+#X{c2$aK8A;b)#ok
zyAS0X&PE|w=rdU?N!Z(<_#m0Wfa4vV&(B-7s4Ovnv7VWk^lKlg$bjh^VAY<PgBF`P
zl+!?hjC5b>9%}y%ue@r7w!o>|*dsc|AAL?b%W%q&zD%y4i>i<=ap6+UZC@n$;Op=+
zP>7kluktgTGb-?Gj4AdXDOP#y7m=q{vGUj3R*D`)cN7BlKf7F)Tky=)w0hC(m!a>x
ze0-Y1s%!t*2WPK^P6Ry>+21Y}0kT{eD^aKa5yk5e-kdcd7SWumxj{)6t3-k23zf{^
zzSEC+eTrFhhDJ$`Fow@UqO0W{%^cTe4xazo+f))K+i(BSeqrZfl6C5!P3U{_(s^N&
zfm#^NF&nvYRfJN}VPAqWX>iQGtZx^u@d?MH@Qz46lEjf+x~<?T$unY|%1-3_5<BZ*
z5-ropDUzyZ_CDxf`04w)#=n|)M--ZmZ~BI7iZhUQwABsu3n!XA7s4E<ox%h^22O&k
zAlNZ2xpP6c<+uFYYUZsG43K2T9EI|_sJdyD<>H?&E>3Wf5^T@np!JX8IAgL03V(eF
zkbrZOrbd6|EeU=78`St!RU~J4%Gumm!h<PQU<dcv-dx>Dz=fLn4+`x20G0wI^s%3-
zt+B*!p2<yyL4W6nbHba4o;-+Bn~Gu!SHyV6sX$I@^GyFjxb=nc=OBeb7dqrPv7W^#
zF@kRU;CF{FK;F_9B9u!QyO--4PGD2mcX2!BC`JVmI-6VhxxPk~E*gfHzMS@m1#Iw<
zcV@VFZS+wpwSW)Oc*@0)$ccO)_-#J6y#w(tbMM{7tkG9IcHF-9LJYfyU1NuZp3)1~
z!AqyT9wQ<W0>s00Q@Rp=MJCLA5BagiH$sf)H>p0ExUUmcQ~EA`MNxvvSPP{NX8+BT
zXgh=Iar$=h$EdStkx!V7-H8kVE@zvzitUH*&-yM@*CUVk0}p@0|7bc<nsOYpvC0m1
z^%x$rf7d$shDeH$T?f4a&4v;Z3j1b`@p)arEJ*ZH&a1iE)xb|cmwlg^YKX=6RR4Up
zs&jQh-M#>cn9Qtz?rwFY$+IY+$8Kk&;+M@%d5r15Wm~v%5KxrBAvxSm@i2Vr6TtIn
zHDT+8`1`Ii<j6C(pjW;0Xg8_U8w=C&a=MHP!8KUdKt^P<3-ox1NI=##&=i^;i|vuo
zak_6GffEr+#@H0b6+ok#QT>ow>}b|)ewxUO%oTeGdMiftOx?4xZojdFP)Y3VgL;pq
zpP6<Sy2;zD>1j!lg(IWu^xI0+=ZT3$u?D!GZpSF$&D4^eX@E{!OiYd{^M%LOc<G3u
zJcsD6Zw_5c2)@T0s~TzIWhv=Mt!G!{uPmcbd^{ccaP~w(uaO#SL7%VXm=FV?L{V9t
zF)oX4f%YF-m(Q2@XDsEiLu$VF=t+p??Ba706zcNgEO$sUq(?O(k1z^h3UQw>ENkI`
z>tr!lwTkC=KS8b1rx7vhzj9=CUP=i0cdW0MJCYJyN`<8b1IqGNFztE#j+6^!-Uq!U
z?L;Ibptg%vK7U-|VfdO;J7g=M`B7S<K&lTd+Ph4xsb~TNC26aq_E{4TMqQ#w$7sq*
zU#H}Ut+yHs|3?4u#V7Bg_$|2qXIGhP+M%A)q6|~?iujQ9i^|tpI{0IveD7DxLRIM{
zaHVp3PHTpZL@sp9dvUJtuaIGN{pf@02Kke*=|yf;R-A2BtydC5wjOfvCf*VNVf`!j
zlWfo3nLqQ_(E)=0v9ocR?YTfC3>k5pDK)OGxp67+#tJ<+SHN^fgT#xE&>d#YkY&%U
zt|5_CJSjEuxI+-~*V-_Z39MiavZ<R<6`Zx5yO#qOA!=eE<_uuKTH6B6nGcFReY<>_
zJ`0AXVd_h@YOkOOx@@4t6~*t0%b{ZsY!uH25MOl+O0-pR53HfYe#KvlRKpHOkv`v}
zHpMCgct`JbGe{MZJV}jCpL+~HEZ*6kK|`cYBNIJwg9~yT*#-5pqc0Wb2<-9K`Fs=y
z@IO~7NAMi%jpn1yG2og&s2#eHY@$>;rCqAbj;FlHwkWe~!r~iLy3x7!F2~+fx7N=@
zT;Z!Vf=8AW$DWVYUZXn^%m)2r54oS13L}^jJA{5OsNV_;h6XOl{)NJ?N*z|?-nXmK
zyVUsNl@DQ;bkdURiN1h)<!0ydTgHx4Exvg^NJ-*1?VabT^s0lO)jD?ffx9bdd<{>=
z@KM7bP2_EfdPnb9j_gA{n9D!GA$2nm3NfNw1!$E(wWTAW`00dx!dk0%I2Pf)ONXZp
zc|NPcQmNSmzVepdNzoA%Pf)%PcX6J*ldPt2QKx<_Wy%X!b=}k6K_^RT*L#U4&F?z!
z@3>$8O*SsgGh13p1!3cvhD2M+b?0~sD4`Y84$5`M^1MLKdma)E;}Nh(s8W66T?pvb
zL0n&$mMjLMuRhD3A^Vd};WJn}**TR&QwXL84U;;Vtm2-rH~#{STOe+A2|n|p-e;9j
zN%@|1=&l7Ia(-b|jxw#uO`u~zkE(2fezl<qcxF@o2n)hSD*Yle3oW)|Y4WWgU&O6o
z^q4Fr*vr61UuP85OuQ8URZ`Lg&%>*gE}W*a${&*7Y|#e{8e2R0&ejuuXxfB>p>Lw>
z?9w?@qSm(K!$oZ5i%RL{b)>!w`kcU}2WtRH?Zgt?=l%8X(nM@2Vv#bq>XcXX*57tK
z!iEMCKQUEI9*y_1!UH6#^?sNQ9hK?wG5<udYBE=(7v`7-m}p_#i7~D47;dKA=N`kS
z(8d1+?$)Y!U%1`NFy3Vf2G{jBB@3lqEN^Xuy4I!e_d!@0-UZQ4K=3Hav6{?#<%`3-
zu$$Up#xEu%Sd^J_YT{XcMkuKibVBOGM<v^JR)(jmsA4^ZRX>F#`sJ9f1P3t2Dx8L%
zRjUbUAN49;lO=xHY`RfD-W4%YJz36S@MP1E%V6c8{LG~kDjog0e<xKh3d_gxw@nG&
zK6ZH5F(svBmVM#ZoS2Rb->^A5`xNuCi#NZundG>xhpJFdr`?a6x+S%AZO)Ul_3XMZ
z%Eq#r_Aq#x7Jd?Oesvg{B0o0tJEinAa=Xu*U#d&BV7<{>Iu80b+*a?0pCaXh<)W2Y
z_*i&-#Kxf=;D}HC`RwLH&9*~fX%UWsrl-HE#1L#44mF_aM>V99eFz}n3}K7?YLj${
zNwt0=>3FDYG;VMXEzFvQe&U~nX12*7F+8?ic9yZS>^RW!6pw#eMxERDPF!Zh=yMYV
zLq-}_b%=1=u8&a}qMRDCecLu>f1DeR&%}!&cDnGZyH_>Id>+5nE#;K(y;}R>UwfTy
zpKTz6+g+J$==+@J5_OvV&058mz;ijl;Q8zJd!UhLPluw+(@fFJzCgZzNAvgenj6x6
z!NKFdg<V_{eFPbU3B1=YwCO_4ha^?cu$YP4JR3y#7dH7Jh$6Af<KOtqnB4qIBImJ}
z9GxW?>{U+!D4L0NU8FcFkVHL`^`jolXB)}_iawVyc^}z`z=f%=^XCe6EEQXnH5_nR
z1LZ#kED@<3wfa&*@jLfUk4bmIZemB%vnLO_hx2uaH*%M?3z9pDL58NsuQ?CetiR7Y
zws!q0L5;9}UNE1>FXRUuV`Qwzv~jQg<o~;g`SBFM-$5$NlHm}FDm&3R7CKm$hvX;5
z9iM;nvy`vg*UR_x<j?7rh}UNBIG~usSd$B74XJFQV)V9{aMLH~Cd0sCI1}>sfl{6`
zTl%VO6&L>Riu_CvPkeV;Xnk=tqPO20OJ#0ChJR=|Ht)LnkEm2NgiusfCf`Bp+HW}W
zezgL6ojuFE4_{<=Wfa$etK=n>QCa1}=(2OM!F6DSD<pqU8kY>-A0p9gpARsVr%$nm
z0w*}(qd<#1>MVl!%6vLxiSZ_DEH8nZYByKu+b&++-+X#dbt)7ve?Mz9IIabj$gla3
zSI83;XBAK1*$|E_#Z2oLwfbt)tIEqJrBw9SfCSm(G-MxG!hPf}<usLe0QV)<QD|2*
z6|7LbDkNyF?BLp2H1ZY$wcK;%9<t%>_!z&Jo$RR%2YQ4)O)H#tpTBB;vUDvW;B)J8
z@XT<!Z17~W;02#G|6BQP+4Sn5omj>8mi7?07d63IboLA%c0rq1<#}O1?=b*+?Sll4
z2|;ylk$vm|`Ze+$Iwnh0(i;=`2C^e@ONGDjRh$f2BtDhufRzi&)6<VN74P<>u*D-v
zyvLSA^y~OY;bs@BRW<di&pP<946G14Oe;~rKrmA^2S+D?^r<iAX9!9q8f8>BWvfIa
zXiYleHV8404Ik_D&clqNs>;t=+aEDv-eD;hZyoEKsZyOLi!RRioG)3v(f;#eg#69U
zMg9W0xS#F@PZ*G>tPAazW0&2lC1Vcl5UKjvQr1q}Y3#YSmEcJ+U9S|oe+kUByaI_T
z1#^s{M`gLXmb;*72qLii8+c+f*10wY`b$_aZEj^F#UzAu+@IgcM`@YVL&$lX{?+O3
z=5h}@^H7O$n@z7`)=c3+214Cgb(h-}G-y_Z?Rtvo%u4{I`y7eo-Xj@Mj$M7RnHIKi
zm-oI4HMB@{pLH9<=YS77cPIaoNkpD7kxkjyzn>3&i5|x^Tq-_3XV8NH&$lNKqIHN$
zq#ltT#=?`3r}~7Cr1m525*3LaV-w90+_eZ7nA655L5D}7F<#eDg&OsC#ZsB7no@3%
z%-bvB*BMjpH32N*QO@i#xCZ75q<UIEYJ==dj<<pks(w!%Xb<nJIe7`>HpX<JFUl0y
zBiqTd9^T}QUGnK;uP<{Xm9E0Zj3^ysEvY%Yji<;L;%99-oEM*oQ_oqaHsAvOY3`?2
zVJI)>H1f`r@X_6`Ep1LE_m)4|=dpjQX@zdIel3K|NDWe=!;-!2FUly9Y9?xsblPV0
z9t_Gbi7gHSrq>;w0wofOx8-$zte&}GOG+GyI;4)i=ufkHb7|q%3>E(q4E_XU*=OZW
zz~Hr47$bnhXO3@t?{jZ4=ecCNN%TMGFKwU~C77Wu8l$Ei8H2I-rnC+Q*w?R>x7O1-
zFw1fi64mfv9Z83dM-`V$1__(t1dwm-N@I5Lf7JM{HvXBIU)5mwr|c8?gk~jyCoj`a
z)u_%<5KPLvOq}+I>mh$~l5Jf0D_!rtjyc_gr^S+|zY&gmhy@_mm^d;F6STXYV2K8*
zr^^;OPkfNiNu(sg?f%v-IuYx)XD>gSa{>1TfVP<=0ifMF2Z0gr8LotQGN4*K#0Col
z%l8%L(2}D1v_{h$;syAV2UVB#_e=-Zh}zJtDbd5D>oY;HjvJ?-2+7*!SfJ$`^oK_w
zG;a%#TPrG<2}31<XBEdYN@|q)q0v2O&HxUHe8;P*Y1|s+^4>xc@A9d1!dhu-adRQ>
z+}EW8wMYnj*)Vs!Xe^dPGrdY<l&IiWh$qOy8<aKgs=wHkyktk3oM*n}P7jWx5hpfb
zuRRz&{}i_GKkj3{ykQGb@lMwXD-++X9chnRXj|6{Hl8&6ZBv^U+#y$>zE<>lWwY$h
zS4w~A@+yrLRHhzyxN}rL`DFwsu|W6-YFEznr1aULy1U(?q}j0DZ8z*sz}EMux?{@A
z|A5a5-Qbl%C+;YN2W-9ob?h^%MYx%m+9o<Yuqyi6!HX24F4QvKX~EZKX~|c93BkpV
zWrjXg#8b=WPSZh;2v-Fs1AR0AW@|pIxwwn^ZLP(D9Y;NPM=Vvv7n#Ynjc+^kP_?_^
zn_~m`U0Xgr{_a?<<74dWi-j(Pr(q1x%2ViIg(3BbQ#ZU2QgSEafVFrq(9=ksRaA{5
zyl0Rc$wbf8)E08oc@?c0a;<NXwDj)jZfLx&yWJaYDbT@4c0SPkFK6PM-04l3y5-1b
zh*fT5&O{{lqS?6pjOyzo5zOrRHDua)DNT~zYKmZM_o1eUY_!u(BXh23avcVbmB5KU
zvWsjd%T0*OaHL?MkYzzg{3s+>&ZeA7wCY!6`tT-T{Ke<5*<5=+Q-PxieC4+q0?h&-
zeK8*-)<lA-y#5^7YGGO~j8C}xBMNHou_0bD&+>8D|BcmNf$&$r!v_cA!_O1sjVM1j
z3=8htbh7ivDp)^6m>d?Iq!Hi_pGyZE&Z_>|X+rk=kP^9X1(#iMa+c^23ug+#PbWbe
zL9PGtb6*j3-><r0U;mJp7onX?D-CL5#!!Qt)p~_WLq9$$>B@T3tp!-j1^dP?dPf%`
z9k7&cCy21WOR?h|ygip|@)iEUQK>o;;z2(jQ|Q02Xp@p8_I73MsmAXgmZo3TI6Mld
zx%1hld?<mkw_GpZ>1*jUbB$&P9#eX5iv93u(45n&?*6nJi|;Yi%8ZJNL-_9(Op|Bw
z`K=5c&WShQ+Q*zVEAsY<g7rdaLO^3Sax%23S>6HQ1Us%_uR(zD_aZFxS`J9zm~uJc
zc-V%4Aabz;H*su3+zbc?dHT53v{BvN)ihQ>8%bKU&aJ38Le~>Dffz}D6iipS6;2-l
zruZZ{O`uvfc)peAv-;h0*~yfIS1&`<C{?qs(ek4n*-Cex&o`~#YBir789+!-l3T%o
zN8}daubv9<#gIdRkVq}9ODCGqYUynqev%H8#E3U|{Awdzt@O0t&J!MT0vH1ILQmDY
zGRrsn+v>N&H$9{+scCdk6!T0;&4|kB_z7pOxbJ>3<zI}k&+xjq#OoJqP$`aHR=D^2
zP73`{^v98chVUy~>etU$v)g{!qqJ|-HZe4oTR`B7p4@kHv%}#_$$t&66LWoA;;$q9
zE~ir861Q7w>6t8hTV~atDhrET@4tKJTlam>QMdVSFIMQFI<%}(uXPnvR$e~x)8eC+
zzC*)+$otq!s+(_He{%m(gnWvL@UFO<mrmW4;rQJ<m%zC-Smw!dLbo$p#a0j=$zgH+
z>N=PO7h3M1`9|Xal!%dFIyTUvT53ax;~&zP9XF835L@fr?GxdBKpu@bH><7CYfeu(
zbRr&`N%hHF=*gwRr#O@%gUcI9hnf=m+)JO`cMh69-s{}ytO1lL-2rc^zo5MWHgaaD
z%b|R>|6taNxL3HE2J5{wO>{Q*RyE6$oI}Z~a+0XbNWdAfQPktVGe-+xnhieXxXAmZ
z{|#T`Af&>Aa0mmhGtFI&4bT3<Ta|HAYFLPV)<rK=6iwAm97j8gf)l+m<@fT!^EAV`
z`{fsKb^Nl4*K1&v`u@5)j!~veQP=*2ZS^e~P65Ov2`<yd=Y3ySV{@jn!*0Nc(f#si
zWp}*E$o=^=OzhAGjoP_a!LCv_aD-*QvTYjkUGuQe{)NGLT#`0Dtx>`sYTej0-izQs
z;frJ9r(NNdyWcAuf2MJ>A9fyY&r{~Z{+Z@a+T)qyIniXS!I&L)GHRx88B9ZZ1VHjv
z_`HrJ5jQ`H=?9W%0X(b9pOl|Dae)kyLH9aL_Y-Kbf<1l8df99AT#iazx<JvTq@J6#
zVS%P|>vQA_It<d~nTq8d@}cNFpL?RRlg&?-J~&`EV5;8?YZr?li%=APKQ~R4Kf?IS
zf-(AH>6+la$dob~T5f5cqEh0F@agzaAGv>Cxiagw^R1bl^X=3wD}WURigPe8&4yvt
zb9RHtPu>r~-XTxF&#^ZB(*y-rDp2}XxH>8#vtCFos;Oqxx49oZ$z7=W<?@fhXK?h8
zCRJX@Ey7;FoFi0%9iKjrL3}e84}}|oat@hTD}I(4evW*V=bsW0Tpc_2uGv^`8|VD@
zq5sX=efy!qd4I{9xn=u0*^X5dOl?xH6!#9olr%>fiy!{iOQM$%vE}gOtL~nxr<JG6
z82K^pyX&v+vs)>tPjiNzll7wY{|J!Z5EFNCp{5`T?pYQpPEwf|7vOFNY8}OzSrQ>H
z)lg&}B=}|F+Z2H7J2mh23RGcEaEK2L2loyxYh>zmqLYN-*3~tT=y@g}lq2!Yk8c2#
zpNuBWn%-Dl;x&AjmfqN(i;%$~1T5#U>K4OHwXZWYIeih=R>q>J|Bl6$O8to3yD4m9
z0DX;Jipb#p4Mo@_d9iVV;Z!MZMC3Mep4CKdgaE#h<zW!Mf`ME|7?_gG#H>o0s#t`m
z#;y_>K2LhgLxr+TOVxe<<^uL>y}uT(Q%WOTJp}*DtaMad3>#7xbEecFqS}y<VeLzM
zd5sHmub`#rZ{)hXi+UGF1#C%keQipEhe<4I%@xg+%2)I{W*2DA!dBS>{4PtW-Ww-I
zl%8ft8BUAL0O6+<R^{#aq4MT_vVUs45gK@><0<0w*`YCT%vGy-<q@^YfW`{h!`n4E
z>!AQl=61x4Mkz2PsQu2rp<zyM`XP*xc=~kW9}<~<-n;mM2GYB|{t>*k<s~AleT2Lv
zH{YAVC_qRsr0+0D><ci=;L4QWXbV)fC{_t)GPc5%7;MR{{N_WaSxq_96w$Qk2lnR5
zIMUDBN36s?saV2$4wpg+PP98`yqH7g`EyH+3Ve|F%|zJ+iz}52gTGG@ZlQ+@lFWow
z#5TBD`XfcLQn6gUgn$<_5y+*eG?++UhEr77ICs<N@*tYhU8(t?QvP@@`92|Bk?4SM
zyIv*)$CNv+*^V=#>{Fe}ss&!dsvg^9N(}7}_b<Fc%}zD^Lp3sqHi)&?Hekl_lX|B9
zePdKJdID+``vn0KFL5ufekF)tDJ>~vq4o0usx_i1-Aj{b2|TeJI2TM5j8YmcbvBC0
zV!KfQW``e)WgBEH)K6tfw0Xzr&D7Vn|D+7N^#uZPColXvcl18L_c<vNZRo$-k9D8_
z(sp#WDso-kE>LB8OH6XCI(j*=S60<{Z|2$d^f+&5b=WX(VE3KevH6rb#mJ|RQ2WnT
zchvjV-QRzFx5u-eU<1do*$-Duot<~tPvr)Gz5R5K^^AxzX3R`;YNtzhKC6E|FAkVD
zwdIb^3`HZgNa3TAysf32X4uJ>R<chGa4dx_gQ29<5%PvF?~Y@l{qu#Pa4<1n3h%w&
zna@={yAij%LrPVIyT;L{E2Bzky!8~(*ZqSRA62y`iog*f8%&x0=6aMTYPu=RDb6EI
zp{LdK{plfhoR1oAdwQK>!QU|EgbD)od|ejJ!rb*Y5{{^Jc59Y>>JGm}xz%m|Wa5x@
z8~^HHk#&!<b}-Q|eCW0sCOUKO&m|ZNZ1h>jpAYP%+jC6w<G=s44LL^{7jrAhq-t@>
zeY)D^9DA4@5OeOeS^4wc=3|)SdG$t&pu%_W9TRY-pY875MvT~LH8I4oFiC428uKtb
z-%soZNl*F<(`@Px^11Ctfo@fv*u`ybvz<}hTC&4lbiZ|O6F?jkAX6}wH7ggyi`+$;
zlLs8_Dr@7itI33E^rJK9a%@KL61<BQkB#O>`DDMkutmq<Jta*bQOakI{6S^Fc9ge|
z&*wKtO4*5Tj(CvHjVCW3u{%db$`ETjE2r=nA>UXEY57vq@hPTUY(i2lSW5oGw_?Zc
z#08^*!|uWa>AY_wc^ypTGU`(HgT3*@bcWHG?48eJ#G!t(Br8TS<du*>nurJbFIytH
ziupAGdc?U(x}?gTX$>(8eHoZu+zgYwH6ih|{dGxjB1{Oy+|(A;=Uc0@{@Oz0B85N6
zGC!f#Qd*6Q?s_~LDY3U6Dvf4ugyA~8yInWta+6@Q!FG-E_Jekw(&Eo^i%q^)b=f|>
zxMrFm=frGYy>(gqTKuV#UQv2>75uTnzl%8o{!GXEA5<1Ti!zU&?%Nx&k3V!f?{+1r
zYD0ay8h?uVm2YRcUpZd?*hcTXyIk~Ka-R<+Hga2tGP>)+3A8UKWqeb2_7_`T^v<Hl
zzwGLh9z~ro@#!DA<$gK~D@WlW8MS8{U&P7gj)I($4JFeD(yrZBv}klni;nlu%oCgn
zqG0&I$oMsBR6YUaMH6co`aXNo2*$qEbs6R4#z{E9XD#bhd>KZlw=Vyju-bYZ=<{}_
zgBz?PW<w4U-+NmwhAWGa(>v;#XMe&pMd~-a%iVc=2u_4}(nrkf1?8HEtcbf8_#vng
zcgOHY3ay_5DpeW0wLH-6F`a{7{y}UdoV7NLVD(a^vqH>6iz54wT_=X0dtGXp-Jxpn
z)IVJ>Tk{ky_&qDmJ6OlSGn2u=O&+|+BJe7~Q0)SxF-D50oI|XJCtkunvpF&*!JH{4
z(g+);I$13X{n5QP59|8|;acm|SWoS)LUad5_#r$h3BpxJ7eVR$bbamD)&%~HSF9xa
zzA=oG4v<^y>|?Wx!Fq6A>FIC@14p~h2PbJSueFRD9wOqT;*qx2w=A3^DLvgUKM9>g
z#8zdv{(Rm!4OIco+lJIl=0kYr`C$$nv(0#aPBUDue-vF!s!RWOdEBS?QM&|d*5q%D
zy#zV6t%fK!Ic$RY3fEfZ$o4=4My1V@EE2<!0@Jj?<s<9hZv4$T^BVD~g`6(*h;Y}V
zRCb$X4Stm;<l=Dpk?4_xchf}V=2Uy!O_p>Di#nTYo}G?k$}BR~qTBI?rFzV|zfSD^
zON?u56;Nz8v8N<-i_&JM!bv0}#8q0{)0-BI`|%5!iL9otP^fouSUEG@=zVk9d(jON
zQTOoiox}UxbY~FYjFX_VsBQc^@05z*H*b2=zrApUn#HpCy!0-6v!9<dnJ({QWEg|5
zwkT9kF`es9pbSt=&@aL)Csb`c^=Kn<U^db|N+SXzEB-&C-YO{0wuu&n;4Tx~b#MZN
zV1v5{cZcA?U4sO7_u#I9;1Ha_3GTsN2iHCM{(bhjm?~<jhKqjQx1a8{R<9n=o%oyQ
zy<cy*z{g89=V|;!8pZ82#=5ghaa<^`ghRz{UTJhHZA3x18hXi2-aqdTRU<-i?&=)F
z``+>jL}u#+19F!Gs!5{b)PI=@tLv@vVPDVwW{MHF;y*Z55f0YSWHLhIYd*WW89&Kh
zbGpn`U3$hLhvKA;_782H2VRpc13Sn5A#e6eL^7tozzU|o4n-!^z4|{gOI~9>3NZ)|
zY+r6sNfh=U8EJOBWi_VBVh@qL=%k9Ku!gN@WVaCa-W%46C`h`$SDtFJQnm07WButL
z7?A+HCH>nP=4kGB4X^CIrJ!4Z5QXstM7Q3vBr^xJn^BL5AnV}|`6c77F2zkxr7rOu
z(98Gkhccrol>d6@fkeDyAMe9dQnK0qJwfc`;7h)(X+%BcYe0SF{mrxph#pwVq_0Vt
z8)F)5#<ajmHdUmSq;RT_(PmNMm`zRA8>vDQ{JG<H)l~zPl{K7_pz2#(9#x%s#uS~%
z&<Q-QGaMHyWo0%4J10lORTSu*_dP`q7zf@Q8ye5VDIQmA1N>G!gtUwtI{!sFWnSBi
zUqWuD>Mnj?$Y;I7tH0ae=wN`|Tl97RiM(MT7)Z0)AjVwNvgIDP=)U21yZj}qT8rq>
zg^~u9%I@jH9{OGLoR*P&+rWQVB(>}#Hj7OUIJmPvItWL!iR+SFj8rfi+gXB$14{`n
zG#F!#H(!eC1o@nzM9tlxXRjF0fdgDh1e1Y@?2FfSX^NwD=FB8Ak-mj{RXdatD>QrU
zanPt2K?O#nd<2uW2IK;kEVtOpN@6;)hCmp@WGOkQU@D0`zgyle=945^kY6$RUS@_J
zPL)E?Qma&+NF}Z)z3NV5P-*$8LKI(Hf>Fcs7~Hn7s++khyVP!+sQ>STssZ4Xa#_J2
z-BOpTr1`R~VF|gm<i?mrZEJ(v;zcd4?0A|`tq{$huY0<zMQ#?nCQEPvb(Bu5HbM>X
z>t)g(o9tRL{KUT)k%~)?{%($*fEToi6U@C3e)|d2^|R>v{E{z38uW4q(M%U3`|_mn
z?O)P=?j!lya;fO>FnR9x79I0x^<u8pTL+VhO}ox`i0qf}6Hm86i{qvl`Og_MckkI)
zfv?@uQY4w9>o*g9MsICem%<KR4|_nt2cqZ6e;10LU43ioE~B#FJO<CIcH7^0ajf>|
zNahHuLJS_y=_tdCVY23c196JBiDg^A?euM<hogmsDvyhN!AZZV;7>j)0bRT0NED4*
zk<3?d{<lAkd`|$<zIQ&Q?Qts(8=V`Mx6NN6b=424l{H<DRX_b9XLnuaL1=8x2VooC
z+p#O#H$Z>LPF%p&n+^VdQ=!|cf!RX8+XH?BX<3T_<PLSb0$7#~su4PdM{IK_^Sd3{
zwUv>vlgnY!L7*yA#K9_-xWwZlrnC-_bC<<VzP6ey0&o8)h-TY8@s&eJO72e(AAlH;
z7=|nte<il(0~)%d4jt$Lb$U;@D%rh+)I^s<#*he8n84z(mK8oOddRBdc(G-|QhC#O
zDXw~q!OeqLk&gu>3vklp0}i@k(}=0#)p<%BQw>ZtPg>L6_zRD(op7mgrNaE5<qQq#
z7cho3Z&eGK0~}5^?hsFr1*E#*7HN_a{m>FHubPA6-My!y-2DcapCdaINX}Ze#qTzR
zqrDcAry`;6%EKPkh;YD)!1_&$SuC)C#G&Jmj@@tWYx`NlVM$iH?XQ)uD?bAuD_Y%G
z7U!?$9;tggM#3)8Ykpg}dFjisJw;bc>#jfA*@8>Y?TUlP1D;mbqXv7xf&iA0*KW!K
zM3HByg*G_9C#-GZq^|GQwyJfI5lGhj>V2Hy;{kmi4LsH!c56LPRgB)gKTJytKfk7R
zUJvZ`-7M&x|1BkLyfcgwIABy3zK*x7t>|_<;OTxa*cJPSLRsk_!E{~TU&AuW1j3v~
zEFms&nK`Rqh5%ZKqe0z77ImToz_AZ~FbCL{@}GF*h;UKjH0a8C+OJXk;uR8HghnA?
zTO^16OGbZKU^EeME2KZeO5#(v@}pWLfrwT4$Mm>{h@6CTZeYaCfH(|Yoo_??#rz|$
z-#c=C&nl^ykT`#Ymk@mgS#HdV$ncPkr4<f#A(3#5<q0-ibS4Y1v5`c<pH5?=iS#9u
zcZ7+@7&V9y3^Q4OA|igkltuYh@<Dvn+!&PUFLzvPy~Vl1DZUtnt>dYveXQ7~>H@mr
zo-?J+F-_SRhS(gtTII0CmHa4RtR853Z!PauQygSj{t@?Y!8}(AQpruMD?+LKfg9B+
zEk01)R{599g<-&*j4*bVSlOsIovXo9;xBecRfp9v-|NUf#Ta<8u{V;L{5m1-<Z(nR
zRu7}5>-ABO+)>1ydohO9=M4k;5G35iL!XrHh`i^WQsGJV6`N6=1Hx7BN>;3Z<1FEe
zt~+CH-rZRX?{%BeF#iX%yz$B&obf#2Hvq-kloZL=K#H^H^qec3c<Y-vErHj?+FJgJ
zg~|UQ6!rKdeo@Sx6vW&#%ZyZWDtZAb!Nh27(S#oq@ptjNYVPvci9OT5cES+@u%Cgu
zhKXT4I$b+9@y#ZZn|Ijm<#OL1HNBBhY)J%5?8-;IWPS=1&?;ATJ|JmF9ICub;C?!&
zpDE-}jw_eA`Nf8C4FiI$ss%|`nEso7^8e$$$45h6kz?$630ua1ET?rr%_|-5-&>(*
zNPLP}?#z#oFeYSesI_K?K2HlGyzXl%?pFeq1j?x3B$!E1cb|SQR+o=b-eOApdl;j6
zYJH&6!N`E4)0zQH*Dy~-=)lxWkS-(fyO?MNDB7^b7H5Yu=!|$a@g0A=8?*?DX9+D;
zs`KE`WiaGPOiDyTv=>+nU3B;SR637r8+RnrE|DD*a$Pd{6xdW-l_OJ-8;<<!?t0wt
z8T&R_I*9?GrPFwzWAylE&*zNqo6nGsVq^DL(g3&P+H-YYo;6npnaAq4yp{lc|8eex
z6Tlbm16gJ7-j$78ikX+>4xxZEm)zFzPkMK&4baTlb(F$Bq`dBbAD9h=!>mlV{_!l+
zMaT{C3eKCu=`0S?YNy5y5r<qHVdsviRSg;^;LYYzhB<51S9l@~HVywUx%^NR$!Tpl
zvB+UpTxz8<DUCdA(_nK>Nv=dLQ+t>t;DB9X6k#Y}tIXdL<=A>{r)OTK26`%}bRrTm
zyBna)2myyNfrhK;JBs0aHy+(}*@HW5+(KpWJW8d>2b2jG*UfCE5OiR4;Z=e{()&aq
zzRZgvN^t{TRdtD?CZ96it&pn;R-f{o`k3=_p^poNj(34`mlJ<YrJec-rP1D@R#chI
z2W8$kifu?a+r(=oONZDp-nw7d=$GFZ=2B|pLwVa`H*orc;onRm$6jr?cK62hgL7Kz
zV%TUVRg$+c54a|{&#@>!2hIy?qidQ^e<Ar_1XtFypV^^t;^+?aE$vwZY`+eYI53Sn
z{$bo`yC~?!otA%l3H3R@;f2h+d2JxQ-4D4u<U#Y?U5F&vH0Fu}515EvO3&`nnEG+t
zA;9CTb-%WG9nNFTVxN0ndrcoQEPeL-845VwEpFF8fC51KtLzkBvww=^J(eCgCcXD&
zoHcm<9n^JF_7J4C>kLISck+9}owxN>^8)VzRarlE-VOM@&leep^N3*$+*2_pSF$C^
zfxSFU-ZfetP3pujpXL^zh7P2q-wDDgUN$y2lA^`U+obBUj=2#Zc_WRwyNV@H6q{Ur
zOq%iPL5c>cpZU6+&AG#_WO&1Uop6=>l&Ol4UgEm2NP%E(2~fQCq|w1D!t4lVxFg+V
zeLebfO;>%ZS23jL{jt#2U)biFxU?#-&hS@HliK+@Z(Xo;mb+w@sp83shw<rmqj|L6
zukY^c9`1+Ep*_vGQJwKfaRzn|l{DF!=XT6Pm~B=4W7{!X+wJo4eUi_4XY<ECy0quh
zMEO@K2_&-X{^!#DytjRaoZFmwiHagR`BdMxYl?p#eZL#w{qd}3$IX}T=NY7aN8ytl
z55nu8w*Ccn<LMT>_wG4yF6Ptnhd2CrXuh+~d%^5@xm}4kKr;eeW!l#Go!T05#Nhr5
zc7pO{e`Zo>e`%q~0J97wth}#M^m*>?B4u_a5;zv6fix&O&!r(er07Tm8g-?>c*?xp
zk$ygWQC+23o%O#V^-`Q2#=)MtwGX(T(v>bn$$q<V6Yg%RV|t=ee%yD-Jpa4R#xNE+
zE^DQvMBe`>+ZTi$zmuGa#J)wEj6NAJz8{_JVU7^5ttY&@N`&R`;2vHoNkIt}H*u6<
zp5{)K?iA0;O0f~DW1AzMy!(}u96b#bHBMar&;aUZY_aWcGS5{$IITl%xK}NGRy*SH
zz}qsgQTyE~<`dc*y9nWr@WWf6PgOMNua{M#{em;ZUEPoz^TRi0ZT1FG0wp8Az)Zf!
z+EJsj7r=#*yO}F0o|a+xiHetF?;^u|XU;F~LhHGUxoD>0-0nIZh}KT$YW-(T!p48S
zPb$dz+O_oZyfo=O2o%0KB*HJreSKVr!t#5Knh-pH&hR~eB0TUA;g`e7+Sh&I1)slg
zmqFYM`oUh!d=Q@Qm$fot(rG*`Lp}`C|E>;fQGQT}?!B?<`I7sj4zDS~68P?e(m`x6
zrvfs~(NJwe^MWe9R-9T4FmCV%i^J@Q^b2u5G4YyL;}KE<?2+EWJ-^3b#*7yMa~XL^
zDeuoeSsV&fv?HAHDH1zGsS+=Z?|}X7$)!5O`8#~`dR4T7snz<Sx>2Qhy7C;~H5-y|
z-g<>}uGamR1{;ifkOqAmdJVa{{G!@JmS9s`(>B^rHoUquH2Dr_C^8^(e=pv#x9*%n
z5fQD|hf2fCKNvjPd2bIHll~^f8Vek6WVZ!rO2u_^u1}}U!gpR_<Br@i5>W)~Jpt>E
zFEM*Tc$(VZY<rs)beZ#de8D#V$j)(0>*4Rxeu&vMAvT{Wh=$OA07xk*z!V6T#5v_d
zIF4dhj$*&v&1VHelJ`X(%4R?-vN9Ig@e06vVu7=VZ!_K^#)GF+WAPYeFhun#G{_<R
znr5x^*JFT`+(By8B2PJ*a+L>>{TQM@ThUS<rHo-LMyAq3h^ZV@SCu$@>bb4WOB&=A
zNrPZa0Da*?qTDFf5j4f=stICD(3Bkb+z`35-wB;4QoiU5VceYyx@Fkqn-_1qnPZX}
zXm2w9!Wc1Leh!3RMQ5>ip%BzR4_gkau65_MnN(22)Q$ghv=~das8XAJEvL4|oSH&D
zP5gupns0%z8!>1;@f|&&wZ6HT_nFY@=C7}f&#-m9Tl08(#oFJ=bLhB~vh;mx{8u>6
zJX+)e3LSD?M;`XyynYq`fVwK~P}H=1c&+bgnYPkhX3a6o_>aR(<;9}Rp)h7E!yM-_
zoCxMK3ycooB)0|bnSFtq(@F+jCSRT*TSAWXv#-;g*>Un_($!h}b>DNHR~->r$Kb}b
z`UD<HHi*}_E8vB+CeNz;4uk4+Sgv$J2caWE@7-2$7HG-v@2n-1DYsD$HK8a}#<gda
zS&!aUe|mY=vNorIhC%QR)LJLB$@>cSlA$KtR8llU*lH(aC;3}J>{P6kK#l)2+mE+c
zH_SFVLzsn!GG-^V2+DHCHJQsPDzOcvN@L~JWfm{Sr_#$ob+{iMm(*nkd<S^*kMHeK
zH8nYM3(~KK>B{h0`QOQh`pYN$dM_0p5nD!~E?C8U=U5(AeHV!k++<uaZX7chWHqF;
z!eJ%Q>o2wp+-8^~uHtES_?7elsT-y)w@4q$B;!7HT6V^J<?GYGp8RzDQ<lAGNwm`Q
z9{6lO>uVeMU)>&{f3=Sla1lVjs%!Zr^yuFq9N9%p{nL1lf=ukEoS1N;1a`ptYAOSM
zG~}P4^XlpLU>vRm-4aBa-x%oZ8Emo!rA}h|28{iPGd_NavH<g9s%@9-_;6&U13oR9
zVFWnY31V6`^v?(g!->JOll<HLnN)KQvQ|i3MJ;T<xO$3UJ#AmCbUCn!!asW<?kE;R
zCBO`*RB;)VgBpnwZmes^C<#1<68J!cCX5BV;ZcUA*7~N?zjAVJQ-tNkN#e-w05=K+
z`tvCgq?U_qB&-8b1dP}Sk00UR*9z)S2#ql{@(|Z@aVI+C;O&qnvfwNGqu^_$D&mh-
z4K^jkey&RfI9-CM@!8!CRQu8oWL`oFyvY!jZD=i;J(~`JjXq>Pj5Rn5Urz`@0we8(
z+L;L_VXB3(RmKZhUjv(tb3*v)xYcKC*7jXR7cq=fMOR3DFMh^>oQun!T+jlZ4wXx7
zDr_1m?ynN04g4kRGwhq@G<^m}-(J`Q9{cu%pUS17Acu8obtK#4@xV{k{|E!tCwRip
zJc=TC2{!ei{(9nX{6ihA)>6Y-;aF+g<*oi$OhXv(`&3X8Uvgn4xX4KioE!0e@*Lov
zIte|W6{iU+FA)P=n;tWyMM<PN9C|I)stAx|_GdG-3BntUl&Wf!pLpR3vxJ~ImzYeb
zkwk$A8>ahYy=YHBIA``}Y+C(@IE*j6RGK(MwbP{sk`i02vI3%o9N|LNAHS>Z#)1To
z2~Q*#iLJrZ!!hpx2+NR&(&R{H5sL!BPj?Et-#(-Ke)pTc1C;}dS<CC)Q(#qiHF_$m
zo}6@<L6oGceX_~NOF6zE^?N*Ov8s}b$=_V@o(|JNC&hzY^6u~~A2)IqOa5kjTZj_C
zsv_w87^8n^f)MVX^=3M?E>Fg~fozh_<8a=GwQ)ywo?d~Hw(4{4v2pv$$p3K$YqjmX
zc15QlpBLd@qUqi#uI<>*_3^IJu}IOt6x`wK=7$Uc$pfyd(n38}{f90j|5Iw0<<XLb
z7iN0_cfOs_G3ls!eV|faXOITdMyQRfG^lJNI>uu1u|?~j_mEhil8iZtse-!n7|vbs
zpaa8g&Qe)uh=NCv$Y?Hv8j1*oVs_XhEGWs>IWZ-iAuFg&#Yya$y2D+EBZcKY0uCRc
zSdtoX({(wy@lq9*Ij@O>Fw}_WvtEPyk&_s&pvo0fk~v5EM|N)XqY(3A&dg?Umu!6>
zPkjVWZut^lJVC(Ga}hv4uqon^@(x>{p-QZ(inWp@U1vn1%xb9*B_fKz%~|CPILq;;
zooy9ZKH8b-i&nvnd*W~i`B4pS$39aJDZEs0VCOW9)J*jd9sd;KU->I|EUd65bw9{)
zI+&v4bS6(o<L8?DY12^m4jlos78W3N9{w(HrtP(0VVUQ*(zKwIf-WQcw8U=sc%{|8
z!4~{p%(Hj<P8hN;?E5fk$Vq1UKQ%28&GTAb1zJ!xr9o0+!Mi+cD%9UuEbtA05ie1Y
zd82{qs!{(E)|a-==O(O{b)sYR5wzX3LQX>}S6@QKctPbj8<%MM-~*eXSuqrXKR52f
zo;3|Ss#R0iov=c`hZu?C+IaThkD0NEE>&GHZvb)=7&CD@{n9F$B*9qPx#5oe{H!B=
zATxS4CFJu^`Zt^n>=5h|B}yTTt&n6YrORvt7b|?8BYkO#EQBk&2zuU>-!jwnKVB$6
z*;QIY?Z3?oCM9ZTauL6pbcT0Ig5W{lPQO-FZIQ92>qJHutE)p@ICRR(3%GF1tMOUc
zR`BuWErKIh)1Nh2kj=Ul=sHDjp#B80@NsmraI-5%Wukd&MJ`D5->U>yOop2TzO9*D
zj`E1{hPsX$y*gi0g{?Z@%*FX%MlGzn&SdJPvKc(?&nUGYM01rWSD3{KICaBeK7y6~
zf4Lt1CdeCuHtjSN-WzCGKCjm(|C`7u$>NuZ4QVD*ER<LLr|n5Bd{UYC)-f(aDUH&5
z+?;E-$G^qLKKY2E_9>~;5^8g!E$A#LvZSZCm=E<1)Y->X*DB1$^3vF3fTz!y3Fd$2
z<Q&@ctp_n9tSb4qF#*);aZ&FLldh>5e`S0fkHb!vaQBO;fDRE@w1c;&Qc|+TqRC`=
z0z_95rm8F*g_f<F3oFVD>FD#il&`~?U>@{D`ZJm0iI1jcGGdB}0Z1`pfYRreHLG%Z
zS5wiB&cAchjLAcLxw3<BO92H+iw4OAyXyrY*kk;<mPn^2{7Kc>ayL<RcYNT<*h6wm
zRl(dl+hJXd!obOQRbizSxUA_uwSy=Fu@U<tA2xaxxq=PZmzzgVvudJaGgg)lzHzpX
ze#-a#+XZ1QOv;z{ze+MQy6@G%XI(xFW!JZk;kNnOx<4Th;4!PBmE$tuI(oaZ@$!0!
zME-nn>i&3bDHO0`-+W{A{I>4I`?}QmpLnwoJu&+*an`NK<=r{5_8_JWNs@g$xvW$W
zsfFt=)^k4-WtGDd&=)aUJcAL0e0o{}AZ?$E2IVl^lD}B6SUMX^nN)!iN+m%I2DRa)
zn|;FUN?|4{6Z3>X#$*L&)v71yp*E8s_^o<&j6`iouTxij3b#k$hiXGCA{L7Gd%L=0
zkg`l>GqY@~^OnFk;1O=AhV>HOEt67%&UVOsE21;JzXT-3OuItV=h%8EL4j08pvYuH
zh-MM|`Ru_OPg@-ExKrPYc#`&3%1N<5%A8}l(T@D)48|MbDbUQK9ltSiu@dS*DRaGa
zzcn(Wt(fA$#Q)pfz>;;*8ch`(L>N}=FP2U2D7M<ug3Wc@)EPP`Z|jXV?IXLg_LbuR
zuA1_sxJCdHPNU@4NAhXSBF#SUw()_v>a)v?{eq#-JVBQu1W!w$*;OInX=P*MqNMq2
z(>Uh&OCFZK+s$0@=vly<TOQ=Zaw7eIqlH$w$ebVrqH7}IY%hUAFzetE73n2o^RJu`
z+K1*@>(AX_tMyW-iRbs!oph?W93HU=Rt@HxTR`tqOd<lJ;9gU_mO~#kt6cC6VZxs1
zkAzsbL(&QJHhzJo5>6V;+-yb8!BCq0)wX#Jti$a3MRDF)<#gY`DZoj3m4m<xR9;wt
zY+Af!jew#wjJhYsTcjIXH2Bk7^D+5{ssmc#7r8Yn{T@^O-%QEPw%JpjwU-*&p`J9~
zkeL2dioD6*AnI(uP}B(o>dJo^A2Y<x*B!+NvMe&|C`!gh5Oc^*yZ7Or{0`!ER*2x9
zGqeN&Hc<D-6pl<9YpdFhqf<;8e|>imxxxIf-RB-9N@0ayl5o}unNVB5_`VVFa{Mnt
zmk6Bedo6Gi7+hzu2RxkVea+BZ(r-I!JKlf@pKmxHpKd(7t^4igct9cDU$&?Jfw5)N
z`o)yp+o$LLK{ow8C;;}1&#_;yp%O(d&tbL>v9O{N)a+2T!K{RC52{*3Zl&<0qH0#P
z9AihZIj`dO6j}kGMr8<bc0B)QQT|dMx0WbC$twRLQN5^yLm<X5!B|E~xCZtWIt=`P
z^wJM0Ji~_51C)z+m{xArWQ$x%-uzqYIcup*tp3~|Pbh#yMDA|U?5%Ka+GYM@G&+rq
z$e2Vf3mN&TCXqit>4FH}>9|TH9>Z&<DF_tBsRY*qsooT5PSf?^040=@G=3aR7~%-R
z-y!`Hsu}2Sw-o)h+t{fPG6H@#n8UO+GTnc!;?g9gQ#4$`g|<apNNw&wd%e%AEaoTM
z37|S2cmG7qt@_Kh*jpfEY@X^=-Poeu?c#dMT5xf#gr<OL_*h7$*}&%%T<bMX#<O~H
zK+xTC#jQg9_{8q-1ipS#iTqc_L6M0mQiwjZd;CYMOSqnQ-uYkjQ9KP5r}^Iuv+vw}
ztse+3)$8~#dwd+9Ek|d+aPU)lhzD-oJa}|yUCGR_zppF|Y(>6+b>@DWpJ5=N5@Mh9
zMh@liN<1VQZLi?W{^0+$PE^P#jhN<Ab(}uer6Iiuj$brT1%BLxZ!c$xMk(FHg)ZMd
zClz@S^C6M%VYd6HZz>IHZKYbdv4OIT4zK7sID`MoslPClmU<i1mu^X~i!sXWS@Z_L
zZx#KkNirMz8;;MV#10j!s(@toIQ4WKr|2ZqZ!v;EC$t|Sf1kinj3e9-!MprQ<oe^b
zN=Lz}i*xPYITgNJ6V`Ges5JvY^;cTcYuVi|3l`NStYrl>)y!9QX-C{!Lb7(_1$U^_
zsK=67gO3;!y@_dZtTDDgTU*}h;~fe1@HO$T9@}74F46~aW@NIqqih!?A4t~!$Jvf7
zNTjhDK9{N~zbqgSC^XwiTwkSi-g|`!rEPolKVO#$3;&H!-n5Ms-YjbFIK)`7GkXIK
z{u4#O;r`Fn$C_T$jX%e{IQ#b&(D&6IC#7pTBP<CcWg0U&)T_drFxe*CCq_M+qWDp>
zu3QO{loVFUo;H+loRN^A_E<sZHe{$)j5AGsnVnq=36T@LJ0O+J3IwV@1=rVV&v!@J
z1{+_O6tNv9(M-$%vx?;s?P3s=$=f^{QHS7SJn&wIYG&o;%#KI!%H2{5ogKfoNX2&$
zvQHd!bT$t4+3xhKRof`L3(hae0}06<<W`sqQ`zn(JYoaD^5iY!pH>7R87Xsr4Vu?(
zvub@UzEt#hKQ2uMBm}hV5m!!j(2k;F`0LpIhd2;LGFlRBk_d9<CKck_C=jZ^z>CMY
zZ}Flw#Bahm2eHvms6u3*H9_e!%Sbf6$#DlqZqN!3mNan7iS#hx=hO3P7irE18A;<s
zN@-S3c(|(%UfVo#c-F}_@sbjLl`8u!;w6!C$`x9}aTPLPlC?tthY+3@sEx|09HFF&
z?-UIkbkqYY=ROenA4-U+qVeNyO-T}x<$cRNW9Cca05&<s3K@%s7pw<LnpC{1OnT6+
z11&t=y($U@_2^v-qbISpxIOl=3nBCI)r;sUoYnDaCOD|Iv+Sn^zIBxy3=myZQ_)J`
z*w)MSpeeY`N04;?)EqtlCT^TH>Xut`55O~z5?8mv5Y<Ombz}0=go5%VcwQWNmR09!
z8_V}^v`4qkiY3VGr-4Ux$8l<9t<V!xSbCH9maVxI|Ml*5xcw1NOhRHofBX5RFGW+=
zTGw2cZCIl!A5Sw~7%uT&bvupiBq{pn0V+n7@Lx;wnjkS1QXl?6`9|4S+J@YKp9<V_
z`Nl;8_8c}B&c<8HoZ3-NzRdPS5)_MB-fZ`ZZyw<Il1C%-rEO6>ywlP~fzK3p6u2y4
zW#~MP>HM{PM0K6Cn%OrnPVI%_)OZY~q+kanvUG>a6tN%m9m7XR0cNSP8MGX3YB7~H
z47vGLQ~BeInGo%|`VF|y`<bdvxa{ZmBD6+E%Lmn$pqL*LxG(!RETZ-f*MkUvj&Ir0
z@!6W#;V_<<Rqr}-D%mg1FAQrSg;{}r55A4e^w;(m{&wM4CGV{OSLY1~>CXJ5l;Y45
zHEj~{qHVD8>UY5)9u2aVr>15{HIA`TG!4KX{a!TGs5&2fTrBxSpF4bJY<C&IWB}5s
za*)1+m8*z&oiZefalNx|&bck&G4KG>#raQ1Y1a7HUKtVSUqIhygEr60#*r@vkH-$f
z!W|pEp?gUJ9p@>nXOG9Fk|n!AU)xXTpZgvl>If}X(*+s0rT^p^k1`8*MN=pPmPGkt
zA5<L_hLELViEtIH@6*%Xdm}?~3lerR_miBZaNqqELqwzAL}{=D3-N6yAHA;=jRDA!
zB~~y8`M$p=%?af4{46a)th7XHnPFWX8Ro4(aYF44M^QRrG*<@(MaH$wf%J^j^Dgyq
zP}HXrHr4QBy;{x7L?QJxn1~$sP9M%K$tyfUStJ7}q3%Z@I8e}U+V)Zf13S4xcvvP<
z4U)Jsx0|@O-G)91>K``x;Lm~bj>UxRxCFS+af0c-o}}tK=S$e!3?E}%gDz2#-FUCq
zE7U6GD?b<(XlvIEEMM5wQ&jTW0a06_{qe-#sZiG8va(G~t|ntpzm+W;<5Jc<*0|kW
z!`k5HwoPl}hZr`t-|mD1P$z++CvYPadz@l~-`O*$+a4+^yDp#iH=MR(1T?gQ4HgWZ
zw<+@O#vLYPxXaWx@!cwG8X_OebKK@9*xS#RH-jA4J2GaTvkL;Aw;P`O6hAEyzP0wb
z$E7nm{RhUSQR4ma%H6#5%Rj-OzH!e;lO2}%P`n9CvU8V-p4T9_^-)#BRdo04lQ=aI
zT^jX>moE^b68SgcW%8OP{TQ4QVdSDQe=v|Y7+99ZPhDpCW6M;ias(=APpXF;ao1K;
zPa;Abng$yE(llsj!OXt_?}TU%R2IfsfsO;Fnp-BpnFIlpA_mv0*i^J`BQO;jLO+=F
zB($8fu`#N~;PNGz9&sy5Cf}=m%vi*Euf8Ql9mI<o-TV_+Y7?@s<!P-Ob?i1mKR;&2
zbfW|dEqa5^oa!31;|ullVxs3-MuOCUQGb#eD2dSA8zhE;tWTL#Ro`C>?)&)vQsy_b
zU&!i6yEAclO`%$$7OPulc0YgD4)kugPz{K6wS6{WBM9M=NXvDbpAI8+-WGnX--Si0
zsxuaaW~lSl{kS2ryEtgy*Jj~z=v_;>>I)ek10H*8&$}%cguR_~)U-aaAm2_xOS_TE
z8cvF{21sGvQ}+E3N#1=39Qj>~;1~Uxe?`O<1GCTv%Q+dzx5dNN`hvW8^o?Sb?GTB?
z9@_GEJ3JpuyDD91h+u*0W$$9474a{@3Laz|ENaXCW>UHpt_;75pm$d~ojEb89>tu3
zGW8QQ$p3(gd|q9(3>B?+V5A~`yxa~Ph?1%opXMltKPSXcm}>r$D%N5J`4fuTob)=w
zyfO`(F1VrSH2fESc6=pekSdIe|EC1n1^!2gK3QPsV!}`Ka5SlS{?15JWk82aZKyfx
zU)SecKF^%`h-Lcz!}nK*o|0W8f!#KvU+^0fR=~2b#mk&=(jU==GP7Nv{s5;k%d!5^
zfrw)hhn_w?m90{t8h}HMr(Y8+O1!40WXPbQa`h&q2FyOb80-o79G_kkVCPke$C|Ip
z3#-SvFT|niy7-vA%k#15sFZ8+`DP0}Ro}WeCHHm~2ocuOcN&1|+XcGs2)du~ULk`d
zIics>8$xPSdz`YuZ>?%O0hf?GAt<!*yriu3Hn<R{-(U_Nlb`zskRou-A&BNmzZXT5
zVxmR(1DfUYyk)1Emx=$3LIF`}aIlv0`VklYGovGwru^~Zl#xhrk2dUnDZL_8J4!4j
zQ;SR`&bq$}(^0I<p7$*(YGIMmjFCegQHa(sQ7*>V{2wBHvxY+uMFt8SIzXZQQds15
zfeJON%ftR@xmh2ZvWinmKp}(h?Tku+A@cN>Twc13e#09&NuyZ>X|!;^N*(=y0u6Sa
z>VRp*l6hef>~9pcVrgRm#ZS1B4yp>~-XH3NIjDIpzmwI^`DJ5wq#gU#9P|$e+#^+m
z7psw{oRf@*{{}EUq4=T6y|>iXsqj&xWlHYi!oPMDBN4@AB;?lqz~@t5)oiS@IqFkb
zm1Ap$1Z-^A@A^rnj0x)pGlc%4G!t`gQ4{tdJcnLdK8@vJ`f1%`Jpvf(wx9@&{Djlc
zn%@1-b2U+ui^zc2W24f%%RZpcCJf{O3Qd2LjKa@x9<j!P^0%+Y2Iq@beHdd1|Fo*m
z&XLyNd2S9Lo2FohqHaSg?z#7{^zE-d+Icfn{=#C|ao@f1(!I@Uno-Oiuv=y+e0=z@
zFJRZb7XGk2Jw*DrYMGVS*8Sg9loh=U74ERhUg^XyGDBy^Gc;VoT|gnyNb*?L-G^2W
zWUq;VpZ;RMk-}*y-jO?-293#v(5Zr`fnHj;SMd*Gm|-AI?!|%R5G5kVz&3^=pA0PP
za&u3K4<GZ8wW}^wcWZ6Ms<eN2!z;&+aB0+m(KD6Fiz{^G$ltZnd*YOjFnJ+tg~;wR
zmTEn;Og!~a*a=gq<mbg}jJ9M~2o|g*`9We?VrnFwMlj^|%T-mavr5IMl(oc?t`?_>
z1Djt-8v%l=hrltx)Y(YVT0qv{R&k^fRb~yt1m7S222f)XvMxTms?>RC$1Zohi&I(v
zj-iYuR-ISSE9F0SVy)~DoDnYpG(8cGeLi|<SQAucGya}4h;D+^UP~R~0Y#!@YkhZH
z=KgBzXG7WxV>2gg>QaRs>y`ID&p`>^$3<zOi#z#O-@!ZO6^ni8eGk9QDCt*-(Oa*w
z(#yQZs_7n)vhY15Phcxt+5dXn!FNp_sxp2rCp2_uDf~3Rqs(7?J@bz$pY%U^=7`gC
zXt(DNg;rN8g`BX|-#W4_OXV-@^kVvTYW;tP%f!*ri00w|2YuC#7@`2qyQ!R9!AID#
zr%1l;HspV2LB`A9&r7xhJo&Mbo)wg4>@CFLbqvP5?S)O!@&O^-iRGP=xh&mdm7G^Y
zWe%i@Qd!l5>8vq5+~O7TY6kWyKgOnIIyowblFRk7Ka85r$;mVX)WFv<F}Rt#-9`sa
z;wVs9k0h%3nNH!A`)t}n^?U=r%PeuouE7c6ZSU-j%`+BNE)%K6G-+S+G<UW`I>|>T
zwy5R?+h;kG%e9ersgiH;+kt@tbbl^cVboT(bpnOhWpE;2LY(n`<E!Hg+3uu|B;2y>
zG|J;qzhgZ<&HIvf?bzEt>d%0aZ1R0M3GD5hFF$|hcx1J7PKDl=X71Xz@#YUj4)xt{
zmu{L_4BD>QH{M?Jlm*7^+p<U%%~86a=XB2B{z?zF?KXEmz35>Dls;UX2fPi*0`vG`
zVN=b#d(ey?q1@)ClELkU*M1Jg<M5EtWyL~k^Q!;KDHoN_ziwhTq?PfxLhB%ee_>KO
ziQTkR%>rxFiZmxmz-(PyCVu=kQ2Wr0DT^R`Dmrl&xk4n~Ama|5PMmHWz*h)9y2@s+
z3_{gt9-%aOpB?{EP7Pb;Q13rz9HfS`|MJCkompI+miJXWhX*l$<r=W8Kx#`;j$}uW
z%2naJOwIaL8Xue$6O=0%B`tp$fwCF5J=_4C=JLzbE@T<`5Tr^9)<Kkl@0aXK6*<_P
zhSNXC*s4@*BE}k9l|1LFTNfE|NuKG6Y`kf*Kyeha7X?O6FF=s#>dY9oaFxPso1NgP
zENKQ}kU@AOg)mJ^)>u6InkT$gPTSyQ9iv8AnyrwL=JttuM3n_rm)dBhR5roms+slc
z5}&UWG{N0>HSH6EulFSEE?q&+_=kc}rKL?}%_FocH5VNq*v$4FX<ok=Y;JpTaPWp~
zLIn%cG#;xa#OC_+hwDD)elH|%+xF-8wK?wIJJ8?BNf<1=TxoT8ZGI<_Z-#0i#$ND7
z{@wB;;TsG|Kh5R%^7eLHj37trT?xD|h0$1vUgDNfvu=@-E*`}GZN##iMVVfzXDOGA
z`@dT0@n|VhV`#0T0g~_{o)e5u59zigq&XZMoLKQV3Zv)SI5(a_$9&u!Tyb*&D*I6T
z#0O@W4>hktkQo1fDRRB*u|xy-H92?L6kln%x7hXTeJ@g#t|L`f<5TrW(YN)Ww4;=f
z#AuH>PaMzC`mR5><}8aO)w&LyDto$W)dUC?ap9g@;$~odv%6lU^e2(&zL?iE=)NH#
zUgv<1m@j*yMnX_%a8T^wtmSf0*ms-6V_lmCkzQU<o=|r!;CWx5%W3S=!MD%$ZpGsq
zD*t8e{yVSdAP7n8eqG(~zFs@eG0faK3V3z76TB0+Zk-g`X`S>wG4sgbQT{ggPgdp8
zefI*(mnz-19V-Aud-HblYFqw9K7<8y{biqF|4-kY!m#^tSj0y@9Vhe|gp!Awl-$+p
z^(*_jRLxP&OwI#Cc;qmGt2+b*{RTk&8zx+|$~>Nj2sba5W)dbayF5uuiB_3f$b!Ne
z+Y467u35D=!8zo^m((foa2Q;zV8n8f+;=P@6=*Sw$XPV%8P<h2j7J$z#3nu-)zmi_
z=5$&H`J0y2B$bF{e4G%>^Kg_YJyUL=uXF>Gs0y}X!)yHIXARw=fkiUk!X#9=x@5|G
zl*RCm4ewu2dl{Lujsesv#>6K)Gsua-mB-<~+rmSS&VlOw%-qqs36~=7?>E}-&9uv}
z;+3kI<D0RPS(!}>5ZvAiOcT@8&+uyF`_*taSx^O;_Z|JLia}0f5Q+YHck$yUFn7$I
zBInTYwA9vYsPaj0^&T-4Ps{05cP%>~I+~e*6%l@5pXJbagzB%;ekM-te84djeGlCa
z==0dVev@|Y-@I?q-uXDkT+_wx@BA-8O+*0MTA$7?>1qq0wle<bbZN(v1p!IV%1&%h
z>0!X6p!<gBHpYTMqt$rRe8)pcR&D25+bCQ6)_ylH<jg6=$Yq?HymdR4xw?@W$Ialb
zx%=$}DhrPG-v|#67rKAF`=^QPQ~uhrIf(Je|H2OZ9~&ZZbj?pP-r59p?%lsSyvg9%
zA}Ox7{Dra=0>~_7*la1i-`-TWC@Mhe`P-NlUZ9<PyiPV+5+twR-?s@2+S%dvP^tPu
zJUH_J|G9+t&Gl?940~Bd)^$5M*d-{RJ`%9SjmJwh@gb2&Fy6K_NSd*m$rDXx4&bEW
zeiC8o@J2KQX!)xcT6Y{b4-IoliVCn(ATHHcuApj!BKkEAC8RFxOuxZ(E?;uhYeuoO
z<IGJf&*w~=%gB3PC*Y+Ai=IsfVXeX3h95VLMdzxI;>Gg{vg$fBE_}ZkM=v~iC0AM7
zwXC-3;1hiS4U>yz$iG!7G*m)LX$d>4%feecJao|vzrEaHpyqqA-)J)G<;|d=i~`I=
z_vWJDu=Wwv7?&A4cS`+?*;q4Y2$dWH2q%`zEI8;Bx+`v?G5ZHjev^3A;clV~u%nn8
zC%V;l@=lgtc1+~3mmdzo7@DKzf{13W10&4~MP<-+aaXyK*@tCe6@y+Y5Ab##q<XbY
z$p~RoOw7Tjt?zt7J$tE#aSKH%%+Gn5s6OeK5juUE@8DIv<Sc|Lamk51rk~I~Rj!UO
z7v#Y_C$BK`&6@7EB#l4xFiLpo09mGGW0{V7L8ES_OmSq>QfWGT2zdl(UHcwoNFyK+
z0^L#1oU9j+mb9>$>q|>jKsmaB{{nPv=>KKaqBSts3>tQx)s!;Mpwm#Ve6+rWt>RdI
z2jX3KIcoDp(2Vjx(0!evlkgv=kp2#;UPz^sfX72-BrF`0Z_DIl`a@%`wR6RYbV}Lx
z>zrNEtL+-Ih_uC}B(`*Ug0Tf0rkZPRD<5P7TY>B=jkX~ZohV^wVF&BXtH-s%WYt)t
zZkELl(o~BW0wqG^Yer-|w<x5tX!4{M8o>Z+toXPZK7<=;)F1QxS(%^q=4tpgRX*eG
z=Nfwjp_6w|Up)wPQeC$F+OP81!IH>uuxjjAPru9#I@Y*=wdjH2##&}r!g2OiX{>mt
zj<Bm*N*^%|GwY|69E4a%mf((d5PXeKg8KOxBy3yD=`V>F><5O0!zDKOiyRLv0*@kG
zd4UCu?jQj|NhE9Aqa?J5F7q_8e(TZ98~O|#5~U&$i67Mwe(Oy>fjM0BonWM7^5Gd2
zKAKA<t4_hrP2mNcUdl7I`-?<@vt<*EQa`rWYoPGM#AX<K*Ky6G^t#J_&OWKf>bRCZ
zM{W_IK>qAQ5W+drU7ys9BvfqK66b&K$Ft_k<=@ha%KUHAV{bCgflUaS;)S-6Fx2d!
zC>x8KoH73(V5cfGX#CdMFwb(xN7lKdf7?r#w$YkXt|jD%fO;4t)%s;@JzPDu7wL@S
zT(+YJMYa&>(4Hp<J)#IPP=Q}W64fpAA~6(b=&X2DCytVUU*^RNLHkUwL=01TEt(x4
zLII|?+b<*<Y3whF$qif&YIR6s(w3X&0d0r$&#_o^Tv3;cQ?t9t{BB#m1~6f5+QdAl
zHsd`?y~p<=(%{J)L|NkDADk~rL>Y0{=So`Sco9F*_(n-rZF3@HimHWiSx^}4oIO>A
z+^Ks6U#1*HX`NwNfOPAr+Y^<%f5B2Gyo1kURp&(m!xGM$-&7JgKP4L?MoZ7PIa@f?
zP%oBrgDds9)U*ArmoI4949$JAbL~FxBt8Nu2PRIyT<apHtdh?V8*_%Pc?0~-{$Nm^
zUGN6Ofe<<bP}6yfHAL!i$J(rr;OaN)wl?4~_L}$6&YU5nZUA3H@Y{mE%W0J1bHnEG
zf7<*nGKKu<F|reBCiK3m4jf?|-s+y-Tc9e39pX4tNHi7LoZtQ;MxeP8m{TH<s0@Y5
zdD=m-OmmxCDL=hNis<ci?f2G42V9)VhZ3c44uyAHgwBrwsQJ(9#U4s)s*nGr(UzdZ
zs0Gi%AL`pxu4B2K(~+c;q+U74W+SyHh9B$L)+RNJGronh9aayP5a!d3ZY}3%V4Zey
zw}0N9;Hnn{xXKv(u-HAv9+Ax`&Prox{rgK`H48uP!Q#V$q3iS#RA)V=9xU<CxM{Uv
z@j(Dv^rd#1w7C2AW(!DuJuA=N?tA~|Urm)sWcpsrQA`lALt+H}USi@#fN!DpfEGSJ
z5E+|l*a03*H63PKtQQCmCk4y`OJkumnDuY*bJ4#K{Znf+e6X1_$aemDM4IV3AE!X!
zTUte(=njf>IU))d{CAM!EMKJvS6BI1b)Yk^l`=6xWTcvVtFY@t`W-gnDanHzu9z6A
zDC(D@W&d8KIHHP@1iE_4d?+QCuP}81_-&FyF8-(5SekL3A2<R7OkU*RD5xk@PbZw@
zAz!B&$r-ehgk2>7O*v(b)jCfe8W21MuP#Rc3b-{`)G81eqgI0y4Mv^&8ApjX#tOkd
zo7(SGzk1Az3}4fz1g_^k=kKhnPk<jqg{h9p^rTS5<STUfU)o60V%0hM+Af|pjG$ob
z&VG4*v4O{<8_&_CE($O3;EK8C9y%I&9T%Xl`xrDYoa=J-=Ck1AzHVO&nS6twkIw%C
zL^}Ju^hzOo)YRo7*Crl=qpd=gpW^vM@k7ChyJ}~2mh0455Jm!757}5Teh;v6i{iRC
z(PWdw6wPdz@0Q`gFVu86(>3a)tcm@gLmgZ<S6K)n7h*2_w`t!o7Jzau;O)b5XJ5r+
zrskNG>}00$(Aj4~lux)`r+C^kxSmSB>VZQg%e)ZOvKraTKPun5V4L_&8Ow1gH`VY$
z<`OP3B-9m7MMKW{g1ML6wMoQ9lSzvKa8bGWzof|;@{9Bt1{V$tqse052V>$q2Iwa2
zZ_fKXX@#s0*T;KhuDeXROo@wdj4(&evr7oh4_coVRiS9$FBp8Z({V0jXEnIf-ZI@m
z<%JLGT#&$6UW-9iEzCBop9BURTsj_;@Q#3cN#A|~Xm!snC^G512jK{ATyZBv`HxHV
zlwKEZ9)JFQQFe;?5~>Lu@UL!OcAnGFdfM-P^|~AgXt&Kyo&E2j)d~8jRt&tb<=P+L
zt;dajgcmyZsTdks<=6P`MEy4fc>+B<&&iPCT#<@Aozob99+lh@!LUv=(#t&XI7iab
zSJaP6L1tyl5-lAW50w8pKa3<B;wP!az?_wQ)L|MP_u#iR1FHXX+kfX*V(zi;Vp*`|
zZJ-+ZgA->kCznmH>8=$rVLlgG1td97iL&V^Yus12VY!R+jd@M3ThC-TTO$cJbTER^
zkRa0XYaNL4cJ!YjLAdlTZXSaqA@A9r(oSTvBbR>$R0KH|du?v;7`}Z&JLgF<RZM?%
zyA#aoJgE>!bAQ|xsV4s49*3l&lOMcANe)L1JN*<xM`D+i4Q#u|olqP8pD|Rjljv@c
z_X6aKk&826u2j3P&8iYWeIaEZ8n<+QZLiY<W`@yVvPq|V@KHCE&WC$EzeJt%nNvo}
zEpW9$|Ad`2cQppZTcC^T0H1OiO8Lm=fcYEByymsA%1OHQT4BLBaz*IJx?aDx#C@**
zo)s-{lHxQ8Y&Pg&+oW1GJwObb4!>8{8h0Z(*GyyFtv+Rp*0jyNBJ}=ukpBVXDr9rn
zdUt79{0kZUjTNr9!j$Sp>uOqiyk^e<C?wgxkLWAxV=!Br`r)l{A=i|kUHJ5}SCwt>
zd{q1o53ePcdR1<>p!Q_{tXpa6$$fpUWI+=V3U{{BHfC@Cw=o1}5-_tl1YfX>1G@7g
z$_KAdmuA^jBG;m`>HUQC_uJn`495|LD3d4)X_s?XUgMlA;s;aJ@~QqO=V?aHPuZ{Q
z6KD?I+evAL8UJq$>Fj4@#ypY(U~>QDHVrY%#wQN`<Z+*D??)84;;N`8!@9f=mxpZM
z0Vl}7-HD}7ha47s$#GP%g}(JkHjdYtHuHWGZ7Y!<jgEk{meFGU&T%f|nD~5&VK{_c
zjq;hLv@79(Sf91SY5*~EWaL3rj2Dj#+Cq4Yc7ela4LztB1^SVo2!aT#VYA??$eQlF
z_?@H#tnfVe8XH1koO4y0a{t~I<h>+e*Qsy#Lsqu_%uO}N(HMAS#lZm=E7h{1vWl8X
zV99K4vvx#ICv)mhX#m33!z@nh!JM_^R(%BfE#Td5?ibL=it=x9P_0aHl6Lm#v2<sX
zbpyRT{=V$7<mli{fuF3-QdJHO+juHI96nFNz_fZeB{p6BTuL*vmCZV@x1MZn6B~<9
z#R!Qn>N<tK%`p_NKJ2=-d6Kr{;p*GdhYRZ$+s6)9n1n%h!UO+vLX(;^pGdhO`YB}R
zF;ObOKy<0!feD<QA!zFugxVV`b-vp-Pi}Zf-=(F6k6S|vg5&)0ImpQeSw%G)Nbh0L
zCVp?d&_NHW>qWKs+B6u*tt+X;G@;dhFBsBVTAa;$Na49H&jgGWf^iW0vPE#cM=dkq
z{gOq7l|ZCVz;SnX18~0C6<7{z#v0jUpEGishWLEktMdE36>Byx;ju}){h<Hty@mUN
zVHZPONv@vlOa70%*L5*!YTbF9UIiMe=ZiKHVNbAy3o28`&aJ?|KVSaeCUr@3W8%$S
z1zjNF(k?0qx<qPPg82?8`XSk@n5Tuo0?5||3tVD64DvOY!ul&qLv;v9e4nFg$jd)q
zdHwrJmMM}m>B*pQ7zp~{W}*VjbB*TvKp_w6i%T78@ZzP~JqUr(21)sCFIo%feX|8!
zquQg3eww{AC&q%U{Y;)xCo1ucQvw+jf-QKqszEmn6e{>}LPDe*;em}?gGiH^Tt{yT
z;(L&4u)Bi&g}F*{S{a=~6b&^dG6QhWf2-lQFJmcDhnMX(iUrtAPIlxhSO^l~=Xa<~
zSaAx&E6-&09&kubP8*7jFi$;Z44h)Zq&6MzdSYjPkaSv3;J3HH%XgAAz5IwNNh+n8
z_5?!$j{31m!SV$;A(3XE9u=OIG~#C!We6?R?56O?N}*%?HHRLkiPS?+WmV%mbXp)s
z*kKOJD!UT_)_!?j+RLY|d!Bcut@<xWHg7nc3f}eVMCbqi`DFTj)+5ypGih%6Cx3U^
zqd60;3QewFT1`}*3vBO04K$3rw=8JRJs$$e6`YG-P|K#C`-{rFFG5Po)vk+ZtJ;RP
zPn*AE@An&s`nD&Fegxym*cP@7=F+8n)F}j{2z>dT`OUwV9L493q6}+v=6bx=)XSKM
z!B;IIv(t2vbdt?16kgv5PX~~<;U#TG#EQK6mZ_2Fl}E6jgRF7x={9Hl?SFoeF@v-d
z!JFgt&>I%wut$Yb5BiJ#+T42GSx*G{u-|@leYXw16Q2!eHx5<*+8q6a;Sbj#ivT#<
zQZH?4i215Cj0g$BxV@49Vd2o($DQN~v8QEqfn&5}2y}X)1~1sE1JsIVkBtJD_av_K
zRth$FIF-*{zAH~ky|~NP>&_OvtR{>sh%nkT5Q8JeO{(z)=RM8NtS543n%y^;qqE^O
z$)ml0*>ww%IUL5wSvYM{ZC!jQWNUaVX!yFo<j-@+sg9jkjv#O+JwcXKeowC~7{;!1
zx$u7%yMMG$=M`q_W1iUc#E<1QSxaz@T{qvKIT~AUjoQ%I&X&Cld?OrY+TMnoP^%7>
zIOaz{*F^~#aO3uN_AmH8ipoL&`32Ut4lx~^-zRQ-O3!_gYnv~hP!yXhu3~sgFD6uZ
z7w(>WSc*d^t+hvtd}=3RnupOt<^I_Ge(KQQ-D5uDT261s2-P@|<o1!bKK;^3+0e~3
zE7AOugqIUbZ#Au3W}f?}-pfm?`|F?F4!c`yMDlCtvlOZ^RX;oig{uF1x5m&bPZf%_
zNn2dozW>9ea5TFM+ot*Mx&~g=Pw}Dbr|{fN;vE3-=oG553lf82CzIgBg?uK8jjW1=
z3{1Jfzl4;GmX+jvc&eEW1bG=~(+H({W@1^Bf@wg7*iNt#!%-q2skQCJLk_(dj;v_Y
zXqZ8mTqoRZyk+rZI7Gor=su#zVKoC`s{6s@Ye0jrYZYU2Ui>K`PL|RV^O6=3iNb(4
zzDhxeDQUFmyy_4!GPaSmn~rdPG&Y&F+rh)%(+)NrGEdHg8`YPX7Ll{P0tG@5N(Tq9
zAbbZkRdJo6g+)C(LS4fNo(_nC83}Kiur+p|FqQHX6ozZ=iWS-#a773ZdD-cLee6ka
zWH|?q5{t<ca6Sc`8@;ZHFZ>^-&N?c}u6^5r)F2@Ys5Aq}kkVb!DI?t=ol3`$0z-ER
zA~19+tuzSIAYFoVcXxd^&-?zK_xr=8Yq@lB&pmtZ>pJ&&orlt=;JGeJ1GTRIZr=&C
z{V0_HY5I=gkDud@u<qr4wU_Gi*LEcIv8`G`j>T6X=4x)b@SOY2$s7LBTBbdX6PMmk
z*GfxOd^p4D-))8V(b^1Xd+C5D16JI~9nYy(+fdV$eECS*H9}R-EmzBcRqywf=Q)jS
zJSD`&4gdI6{dR6gX&XV7axv|+WS^HkgTacC5wSTqEZ-atf)jLq+~TQ487dKak83C#
zEGM2%k)kS6jr{NWqnDhj;uhp7c<nSNtg!1+xp)XdrwLS9kmHQ+!z4A=O25DLZ|{~#
z6jrPt#G{_&RCa&58TW{bP6R_lV)dgHC>t|O%e31;qV1oE#VxrPsE7Qz+MOZoeR%+P
zv@M3t_!A)$@k?$-vm-P^+!WT(!;x!O3^D{I(?S>l<w5p<GLjt`hnQe~`p3aT)iic1
z=(?2<zX0Ro7wLHi0=loM4E$KCmUeHZdwUG!$==bzoi%p4Pb1XT7%eE?nBdsF4|Nt-
zIwUn6v#O4D(SHikEp=?GeRb#t%2NJ-2SWc|qL#t<CE|>`s&hjnV|_}5?h<3?g^ACP
zh7J(=b7|&Z!ClV=X{KxV+0wmk^wZckQ6!p7cQKaSGlo0zj)x?d#|>HIl6J=#1G>ZV
zhX)#2e2Q??lB)~`d7MK7?qk}z{xcUaoEvsbek+bUh)$B%PoE3FXrkZxV%Vp$aTMTu
zg_0GpqCukkLYjjgg54+3bSEt8Zwm?^r#`N%C8Zpnobll%PA$t@dK}LDB149R)+Yn<
z;__rwHY;QScXSfgZKJ8^-^(7RKM70O?xHqu+tslvrow=c>=65$pPhr9aQCI8ikXV2
zD0nJQz3g74Gq(&==5dyoWcZ&3oU$qx4lVQ+?niB8zE>yvwk)&6Pml~+SFQt6S<RZD
zw_-C9>+0rtD;4+D_f-G)FraI<r(|f|EHBwnJovqoMVL?k`%J;HMH=TX9D(_xE07|^
z+jwo0=)FaR)X!r%v`dkL-1@L`WNf9c#K<jzHa&iA*0-(knql2^B*g=hjA+Gw3>6SI
zNOaDvFnKIWI4l%R4<h44pWl+9Jr<^W6Df>N-axVsl|ln0qc<Dh`17ouf|-QeBA<(Q
zQM{y!;$-edeN7atGeJoshEZbq9_Iu+;vkmQ0UFjaGuY^Hbj|2GvJ!sVfVw07(b3<*
zQ%j|=av$<5z4Hdcf0NYJ>xn@`4kiDmJn;BN7J}qVI{PSU1ww&HXvKl_j&O^J(t7Fv
zDYFEwdoA@hZ5c5I>1n8CZ?UhQKa7V0-Kv_nkL54r&kK=P<MoWOQt8{vg9?pM^}7kH
zx&(G1r4Ww0mMWg&s*!rG8~rT+exY@2+N;U)dn!Cb^H1-c=`|>%qpP>P3|YPby+X-L
zbg+t&elxKlo0s-kGHMo<B7$$mK>Ge|TkA&Qp|?=XI!K=cPjKfoCgWCD?>xBUJ9kzg
zc_e?=tF3Hv0tmUvTEgai2DaoObX4MQc}({IIv_474)BuNI)O4FxGr{JO-PQD!f=jz
z)bh;3Y5$A|VkA5XEeIL%j-Zad^$Ut@1k4`*d`&$N@M-9@Qy&p|Va3((8<T>%fJnV3
z5rW+mtPe4%S-3yJeouEx--brZ*_rg?7{<Aj3e(LBy51rnmpI3vxH9<SXp->f5M(F7
zjhoeyQFi~MeT&#^upz;uAJOFfA?d>4`d3~C?^*j&cA@;wp-2n%iOxOfN@*La@{9N~
zZTvxD9nCFI>jmuJhp*47)p6InqR+DX^~UxH&coGlCw6c|C~_O`rEX&@niul&nfYV%
zM;ec?XU)T#TfN`eGhXyOvPijswodf1NOX^B+?RO9>lPO;1uL{@V*kg=xtZT4?)cH@
zqriR|hvZ0?<(#DK4W(EXrNoLr7ftsxG3wimc&0<f5c;S~r9$M8+-{Mz0{48*6%DSa
z9qQ<70cJVrR!If#B)idJn4JEHT4AkVVnxP3d?&?qZK?X<IvqHA<$sMrWXN`)CpoYC
zK0$stNk+M!exMN_9IaU&bD_1Ia8CoKp<iyF3w{qdJ4c^SA+VX{6UnrCzL;!)h-IAe
zL%%K~C05>ODJD^@6lnYJmu^&I$T{9aK(Vu(^Ux-;M&h}`BNv)jnJ0kBfYVzVA0jQ!
z4;mA8$6WkkkAcE&pqf(!m;X$tEMev#0km&tV1?94dAwAIzEHB*P7JRrP#EFIWW2qw
zl`mwB5F7#J4Og2A?KpkAr|>3HUdp*#*&Qg6-O$-n)MD^Y=0w>jk0@LwV7Qt17D35d
z2p@&XQSL7wq*gLz?9TlkFgrR0-~=*ce8)$IT$71*THB%@NcM5zfB=g)li1^G!4q#C
z3fFQ~9nGVae#M}n;0#PRj*AFN>D~zJTg2sF7VCf&B&(yu>j?@J=gQz?KUm$~xRp8E
zN$3%Y>pL>BMQOLXLFz}k?Kr<G&)u=S3dwFVm!RN+=IMb;9cJ`@=pw^72}LMOuPSoP
z?)8yM>B6Q9Vi{Jh=?MMw;1P-Cd)rw53e9z^W*cMO`_Y_Bl(G#Z{ZVQ5lhH|0o2AO6
z+paS()8xd5j3|Iy))be=qo!|tpIX^B%zR}Li>ycay-r)YDZ_Q*s<=cUy{%O`+|c>F
z-m-Ghk`eY|ii6Xh(Z>6)$PWuv(*dLUW++qg6W~qq%YX*D)}U&qM)O=(tN#T|=6~Lq
zuTqfR&Pg~L-hZjY^2EEq0VG_t?s%eDT84B;Ou|4-i>+;m$X37QHx^6^am-AJrGdrn
z63{~U6?h8E#qpuJC%T$ak3zA4DYCxqT`1ZVQGL16c^pgaM=&Wu9IwfL{1)M3fl(%R
zg^3U9iA7H<pOQ?;0f!aDrp3Xdz{<{I5Z_5Fg<<FvOztBQK~8g`T{3sz8R_kda_Vww
zvj|=b9%Z?&CC$EVALGzFu-u5T@q&lrWTj4w54{f@0>R<XV_9i7bNgya2IcUKU_-jA
zu?)#20hGoLkAN1_?u?Ia$s8ZT?fRYUvo0hb{jN1MrqPvtWfJV_6I{N2E@iGw>4{~q
zmA?|tQCQq=>-z4&EWnd0y+m#ybrmV_(_W_g=MMiB2aUR`RZ_;Bn;Qx*Kk&VKrJPd9
zr*)vt<&ugl_H9!-hMchWbEwzLT@<x}J`ZZW6?g-*)tIrrAL`=n;AVe5^-Gzu$-L=b
zZi&WCE373ek30SJA;M@H27<Y%f1Lx)!jGCd7}S_qPr;o?pw-QOy+^ve!h#T&PXKNk
z21gqbE=B{D)9fLXlVJAD<zHj?-m4bdCcYOKwZy$Hhj||W%uSrcRoPNJ<E4Fk+ka-)
zWJZ-i=-8i<xlGf`gS_d){ZZpq&FM%4l1)TcRSoftMU-EJ=Auf?b%EqLg?r(f5VW}^
zL_X3XS4~xT0nthg4IqBEPW%$6iLDdwWL|5<*6>53Lx27Rd3fT?h#xKxuY4XN%L*B4
z1<Cqqj04M%m*E1(8VyINz4sPT)DRQT3iz(T7Fc)rKpJYW<cRZ;e>6~JDjEdof69U#
zn!F`a<<M&bU0;DNXEZgE^!A{1K|oAto<_lVR!s>HeU~~v<nFas(d@?&PQjtz!|J~c
z+GI!c5^Jmj%Gn~~kAy2kO@d85B_gjfvkl!SQTJ(v#iXjI=|hQ>L$9AQsCTe5xP~-K
z^=aW7<GTJzRzmqcUG~qN`EQ-J_TmFc=PZg*G5(sA1vXJ3S25lfE)%9==PkC?_?1o`
zLY?>L*)(JKaGj*Nmm<l@++sZZi)K41uuZ0>gTm&nXT-zKuJ`MyK%O7@3(PCfwcuW`
zW1F}hTE{f}$`V+muRbv$DLHIu0!pGOA8VGnShbK271U+%zgc4S)Sr`2n`_gD)+VTb
z?Qm|@P4!@5E5kAllelcrN&8Q18=&on>);_9VwBruTN<t$B^FF6vRl?;(}1-}AWr|2
zdFRrHiWkcO1`x!GFs=my$kT=vNg(9rUZTnjR*$5)U(<ylwNAnDq$m=*)NEso>K}p4
zgjSx2O_W{2Yl^D+^B=i5{I-HI?kzF12NtZoOz(K8CSkWI@4>Go-~<W->ZKDBokheo
zXqkq73Klvq4Emw$Huj;wt8?YA>5XsO#%ps{<930#mnD5UGLfHhRvBs9k40FBngj&|
z&)WRE0yJ8sPkdiW2xVYIe?3pj1p})!MEj(+xF$9dignOKY+-K?`Iz4;X;U9``DSw9
zDh51UuPPtsW%MsE@|vGmIWCY62haZ1ex_MF*G~Phorp+t$g`?(N^$ZGqwk7IkjbXl
z(UJj%73bDPDdgqwI(QGVBMypxohSW_XVCk{$FR4D#@}mX3`ugZ2G&N;MS2-J>au!a
zoMoep7fRNQbCotXSw!Ypg}8Ox5o)gTYXZ$R9yOn624vKbDT0E%o#csJckg07&r32V
zg?3bK8*n{B53&8AVa}TSgaf6V)urAo>FQ(Dvy)HT9`+8Ku?<n>A;|#Q4FTTJ#yawf
z)<;;7BhFN3Pv691jKCF30cD2yNAhV29LOW54JdcP^$#wEqdJ$13@6c9Ne1E5Oqw*f
zj$wIgJ4{gwvMLww6D%CR7)U835`c`gl<=}06SFM21z10NKP3~nFhtx^p}h`mi@p;0
zWMhr<utGQ{l+GlE^X}~|u%Tv2lQE`fe~HCSVdsbd2jI<mAZlsHVOD}rR#BOor*8GC
zQU|2wz_#?KCP7ev!F|o92j3X%FQOnp+Ss=vf&KnWqzialv?-BVQY9f7KYPea$}9HY
z*Qgy7)B{FmpVfOJL=yr8Ju0V(YWod7w3z>sp#1P5NakY<Q8grA<hXwjK|hKdhHZc}
z?n;MI%`{SePn0nB#f-VXHfk6NV^g)A`{G<|_GOAY&OOP{Lw(-VYm7r>m_>ot0600E
z>Qfm@>y5bfR(W)fXkSI-H_P?pm?{Z$B}~+HO3C7Vh~^=?VL5!aO6kY0r77Um5|Zft
zaheBD`Tu(xGALV^EmUFZVJd5@PldW@08dZ2uf%IC>we$1l&YnvV}qP{DLC|&fSBk+
z(y3t>)U-v^dkq@pml4Z~z;Q_{MtMs_(AKWV6FUD_dl-hbzaKRT<5v)hgKhd?g~yy0
z2ZEy$zd&?*^u|m@(#l(qPs_zok#WS+faMaS00{A?c_*1}8bGKP43-ener+3m`)GGk
z_l+jy1~k{C-O=nb|56CnzDx*zs)y)x<Do;9VV9SAtNyQL`uJ}KUKC}zKA4Oud(z@?
z<vrGEW+u-kj**6~l-bv;*TQJS5_7nMJoG#QDT^D7ar^o$|DuFlkT3bat>MJ)wAQYs
z2Y!&-yZEY01z+aY4alHutM_fAhQ~BgkX~}f%-|+1A}$12Xhc~La|XM%p;AT01MDKH
zNZslmdrl!*!Hz?bHXU{Nl47l7R~j3K-vP59;UZf}Csk!EJLxgcTT_CIBAw#?&G|3Z
zufM%I+)8_?yeX^TM`iHmI4SLPo7JAX)2{AyH06@CWK$42zT=!IyFE#*Ac<s1-RsO?
zNB2jc3;zX&`ot6Qrf@=4Zv{}rHt29a<T;5!GP+7OM=S2EDxL6+=U^#xiz}FlI2WZV
zYmBS!;e2Dc*Pt-?7EpTFy^ZZx7Tr|fhmeRu9;@);L+SeZ<Tzz!lRK4TI_;uC;C<u3
zZZAs00xilQ{6hzcR^x0WH7c(U;NZX|oi|Nmzaq9yW54_e+@Dm^R`8Gzn3Pz108=Pq
z{#%PT2uB4QB~=dHLK<aY^=w5G5Ty@zGna)&6A}1iusxS=Nt0=GYz_L2HTkMTC#z<t
zw(5vsS9)WiiL&jES_qUAblMbj!1_I4!p5K|9mW0e&$NU&L7vL%!mxjl!Lyb{=QyHl
zxM{<ZzVxqf8}TtJS233!qYBzbO`L+CIbaTqGr_L9v@4FQ6@J??6PY6)z482!-P)@_
zrSeSzST@wkI{lvkG;67J-;*QmW&P>0&y*cFGu5Fni+YvxsXLD~auZj{aau_6zs`46
z*MiflHUu<;lpLXqDNQtlnC`(@r@V;re~w6=`a#tRNx2WOXpv}4Lx`A^_f<v=+Nk9X
z1FUV1eG{7NB$g#~rXDDHi?FHY&jOC_QI4QS((7wb`aXquWM~Ss6(ts6A|}Vr1O)*m
za3E?P`7#OHVkt?b+?z>~dWJFw8T&Jb!S8DbSo0j5Js8@u$`4sT8J&Wqyyc{kNot+w
zN$o**1rX3s9k49ZIhgcKXNbIAs>jI{XnDPubZi(+B|$dauxu}PcWC{44RhIm2+7sb
zySP81ozan$-5D0183{3`9z=;+uZnke*=tM8QjDkNrL=j4tPLvY(Yfe`GIj_*l3?sA
z)^a^P{ujEwSEbJHHG#SCX<sM=Bdr{dtKE78Iyw$}Vf*;`pYDr`F>RpeE8E9%@~}tW
zERK8nIHI3NOo!QOi{lbepc2f;==qT<mTT_qDpY!IH{ZFwL*bz->+5Cb&fze6yjP67
z={e_I9j|3JeITu-@=5mXkC6b3gVxXMLSP{NbrE!l+V6$?IO7=`=@u*b8zlTm3e6^y
z4<;<gSJ=n1Vd#ZWuz}bA&PNtUOl3LCt*O8<^zNRqAU78;EFSE|^Ii5x@%o6cl2*_O
z7-Pxi?K#+Ok5N?I39yKIVKt5V^upzPRL@|Er(hd9he%%usYjgL@8WL}2A$jEwZYY+
z9#feIpF_}qF;_4xj8d7w`zWDk2TF&EgpBK0*6*+=%eBvq6I=)Y_wOfRB+SWIprWeM
zOq@-$;;_|14L06yyL|+f*^y3Z>@k@vf*yH|hEx#f?&5R;YmxL;6o!ZzWIP(PSj8)O
zTgBR*ApHe?MFZ|WB$H~D6}-izF32quJpHnK(7{FPe^1K)xv^!5(C=g*qX6ilB^_Rl
z@uwq5dgG#0%LJh(@+qR_#@gSAlgG5P48u9h$bgXeT*17U!ZQ^$+Jdt@k}aqbY)|LY
z1k7<)l9{>Q^%N&3wa!Y3LMLcSUS;%HIMxzdxX~B3J?XrgR`*<fRcz-19i|AzgAXIl
z4_+Jmf5(aPA-9jyEh2I%@e0JaY`R9XydmtHC<NFb7?MPip3g;w;^MgxYMz3(29P}`
zU{v1FS@HUW*ltNhRlMXw$e~lwBoErdSOn`(7>}UGqZsj4rAAKdPcTLivnfM-$Wc23
zZmk*A5EApI@ZBC1=r+(qX-jZb^QKD6H@ASG0#MJ=u;fVhgwoY8KcvC{sI}=d)eid_
z`86MD4OM_R0D^Qrsf&X|ksF;&<*9<pYa${Mv112LLsr{@zozCeH7~6r8Qz#b4O82l
z+pH(^3a@v2@J2U>cbGaO0#36zu5h?~g3nlU{-e05&}J`fR*9bcX!M#RF96yb$KI2$
z&1Hr0?%F2fn`jbox6-TDogNYFfw~6oj3d(pStRTYa3M|N{HGT^Vofc6Bl|m8{KM~G
z*vy4>#5lC(RyxCv8}Hedp<BUBNEPo^{3<*S&6Zo?aYg;Q&vOz7g?GN}_~NeILy|>;
zTgT)PyI#}XG%DY8nY1@qt1(!<YJr}-R3s4L)f=QHF6|K+{eUS_6TNA@nhy1`Lp6D=
z)#M$OAzk|~;Q1Vm3J3|UV0M({zC$d^f$8NQ!J|7lPLa%@wARFH5Mvhxm*J5;P>J2X
zJ6p-XB5X@ch#Gn!+A%4NdkQ8LpG)-sPIRGwkscAoYJ}Xtg@1Cw-Qg9eCwdr_-z{}e
z6Z}^N{)9BY85#SP%O)d$vK5xO{3I?-9#B7dtc2R1a^-#{O>9=%oQ}6C|BK(LInW%U
zrh{wH%2Dtl@Oza1y74u67UPL4UGbg*V>;c^3sySuC!@tY^`$g<icb_MKD<CLKU<mZ
z`4urQZgW$&P*GW6UdZE-v%WSx8th)soE`$?Sqb+zcW!Vc;%Us6nT4n{DEzx@WXz}o
zIbK!MLc{RZ*g1+GrN4M;_WEaqAc)HWwe!Mn_LvrWD3^30opguEz5geBB!9VwcUT}P
zZfi^=n@~(ZKqW0Zg>f*yf1<AMJUSY=LOE{h^DQqM!;|65Jlw9u+()1Z_fhkBkyVW0
zO>e2sP&tpNz=y=~jlX~O(?%A%=7RD|2Fw5NbXTFJ*@WQa0&|T(;iXRGA!;-@Fl|n^
zsP+LBA2M3;cmu6R-us=M|BF0`GKFOEBS-QLy4*-A*3it5*dxleN5TZsUnSH3KEC1@
z`F;T8Hu!vk(Yj*iXH|&*deHO%xex@qkqm#f@sso5WB-cDfJedMC+;`ze#M4#N@YCa
zQbO&J<)B)qkWOP?Zgq}-8@keM0}NIi{bJmP;$V!6$0%gP>b0~W+3OQ$U|3L29b|bM
zDCgT_IESL{uN(tZ+BjOg67e7~=T^$w^TsEWGU0c4sxMw*k4;NPgH7xqEvMmgdUNxf
zgJ|j6_(Zp68K2yk4hxA0=3a5<`2;UvKK2Rz_n0B&FozDL`5oi`4sug^?iw40w}|Kf
zyUcVE7kmK<M=!$p%K&E4aS%x_$KnSnt#7Uo<Ub^Olb}%(sK~PXD^2#u#H?l%rbKPu
zsa)^;LHwLdxR~)nY{(T(rsbc2a4Tm~1938*XFW@TPj2ID%u)|UwMemugTIB6#tHmN
zNa{C4OCnaenPRbcy?*&SYkK=<!x5f_y*ujMY*6P6y#C+y6GhXJ;MDqb<zxLAtUI}H
zszdEKcAzif7SV2+I&~1gx<M(iFuvJ9SCLA!0Ueu<o^pKE_eXmP09Xe)U4&w;`~8%h
z&)kLfJG8x8Hw{bf%<LM*kKGR~S;B$3bgn#Qe^^5FGP`x-zd%8QjW0jeSal&VJ^8b!
znR+ZOa*=P3@st_H-&J5Lolb_$GU|Z4Hd3*ffB9t!1W}j1T#+i#xjACc?ady^JgLxx
z=v&K8(dQTnrdAdji@}cR-oNN)7jPvZmc0;iezV+^?uZ^?v7S*R6Qq3ZDjHGnc~%}C
zH<!+B!9Qhb#UUA~_XjR<{b~3=ZCoM2+YSH;J+up;Zxf{Rc1*V%DYXhyd=z-afKUx&
z?+hTVuOWO<w<*foep<ywWeGrOW~A2DF}78Fczt$r@@15Fwbs7y_T3^fuBtk4PbM|A
zTf~}eCZ0^<bUMunn`4eu@IHMbG8ib-3*OwuwEi1<%>JwAx6w&;(Kgo(DF1)2AcgM9
zqU1g`=E7JE7?rA|mE4kgLAEY5GQF?s=1Z+RpwC^k&n_YUq||>&12&n5pYHq&950f@
zm#)$c{HdNF!XRB9#~uBw2rmDkYX_QmJ|QDfl_co#@${KVRmYdWRkh8<CB*Uxm>wT=
zFok#;?QPNTD}j0+H~vo-1C({wo=-ZQWqfI9Rkq4#H!o;LM1N}T$@&bd%6m1kbI7YR
zSk1Io@_&xf5tI0{t~j3A*#O{->BFdBsJS?>kt6b=u<|g!QB}@myf<6u88FoPiK8>f
zgr#raFFe$Rqu4Ntc8wDUH5|e!e2-=Pj|gWoCa30x5kr;iv3?-ngIM2?wA@+^dEuR}
zzz|Y%i%2Vr8HF)eVH~LeJ%N$Ndvqx-hH=oi=8Np?9$R}?59O7jcOS7|ep+q!m1s1!
zyC>O$DmA0I61*CokZbZ(GF)UGQ!=RSu2NS~eCC`W5VFoFQ%I<m-qF6v6{#rusRW!8
zGPgR>gWSyh%A}tn^`|`ZgG<b)rIqk+K<*kGM_JiY+g1MGawakPOKmPpCp(1bNfHqX
z2|SG*=y<P{(t!i_r11_-gRAw1qz#a_VpP4#Pt4_zkc*8$g*|KNE*F2$-K2a0Jp50L
zCSQqEB{7J!Xm8OFoxYL;NQ#9^#&*Ffe8A4Uv(Q><P@MJ+5Vf@nQD^w=AO?w=0kU1J
z3z6*ilmjaUv{mivoC?oal&7Ta>VU5Rq`tS%gpiV$X}g2dUpg_ak03Stiu^OxWkx5?
zad$6GsE^@ECT)PJKbCMyWNe_|&%4fq-;@l}+F3R1`&>KKmht1no|)6F7=l_VA=8oG
zcX_9uPs#sn4{TOc7r8~m+9_ZBmQ6_Rl7x5$If?FH0v*2c#(`VpJ)3c$TvPpq%0^0Z
z4zYu=nxtv(AF($p29JsI%Y4Q>oU-|)If(5WevGLKpIVw$EGvrnIXF@_uj@}s>XRsQ
ze)6In)9eVuaL-uXEFg=YSNT)UYm*IQ>(@~lzj=JLV)*=2SQD9bRKx$jpU8~y_1g1=
zP$4v7S}l;afAaDbj-EqHPE4r2=vp%8L%5bF`NeT)H?H@j6$;el0yxC2Pe7XrJlW*o
zF~@Xv<;BQYG}N#N;I2slr>T@{Mc#u3=sT`7G(RSx8}j)-m#)^lFav<Hu`jGugb#BF
zVJMV(?I5m<P&;?>tN5=Iz>;glsX)fsT!XS+aT)|My2D8OuRu99Z!OG$u5_Nfg~FZN
zwvr{<x`?q-`1f;@KQ?T+!x2MfjuCNd1kjk5k@UpkC=>5!f_O5sY2lR%2uK$wY2C~4
zn}|+$Ey{k<$Ja4Dg|5`&dMVzFpXIz3q^@y@Us3p!{qKNH?hkW?GQPMkZ?~*b*g{~9
z51}-<(+qg0ne6yV_!hj<2>!!(?Q#OPF;_pdK;ML_y+dEC>QF+2<CipzFJ@Jr;=avl
z_YdhHqaTmaorM*CLia|2?i`Y@A1i%Tu(Jtuf*p(WA`NVdsOe=)xSe1|=5Nee!8WT@
znwmc<cdjU5l=kz^O)f0<EFRQoqjDHHU;np@=_{-+<*3<+n!Q>?2-XGY75#<DNms`z
zK3Y?IR@m?Xu;=0Ord&h=x}$Ti;XKR=V5PI2K8+rQbyJwM7iLa!NOLS!d&`1|QPAWM
z)jM%|sB(B5c1}{h^}pb0(I5i>|9)i2Gy0I*J2M1q(T#KREZ`o?zCG=o807R63;-3j
z_DuqTiZ9_?Si2<9!YqN>^HO+OXC$QPi1)J>A31)@(dPanUD5{1lTuAd+AUF1wt4Eo
zm&z~m7C-kpiV6+^f$67ly1e4-5e&<k;%X|?eC(N!BSRieWvj;Oh0ivYWJj;ZEvG8r
zvYJ-^ZeoQYl~o5fA!`zTi7b9;#}}0FG3|NSMwmtOcH8gCRqokG>_Nau0?6*D+ZtR^
zEejVhJtl#HPRcH+-RCI~FS*^v%qIe+DdEV!^AD$Jn*_5NFDcoO%)M?^-|m~F<96F{
zJX@NILFLo9ypmeu<;m+`?Pr~&4MZztwXMfWg@jKGMw!R3oQyJO-RE~zg!am30Z0Wf
ztUsY|8Z{0e{)V$%LpSn)z}(yDnf=<^XuS_jr;W#VCke>A9ie%VTVP}@{XP7jdo2~#
z_jRk1H690R3CQ)mhW+M~%09NngX}u$k#zSt*W=%O^A5{Ve19E&Me)sX!{hWxdq^@L
z<6d02y*!9@89%&(N)@D^%}U^6H2I~#XY`@wBmUfF!zt4ozqt;6<LdrE$rzCr>kbxh
zv^H4fNb=BBR*=J@wO>BSw=-MuU%=Ep-(sSe>qa+)4u%Q4H*?qve+%a0t#sC$d0E!p
zxbJC9WJ`EPdXU}tig51qhBSgK2PBcfLM9Wu8lSB-W5yFXxe}+BsH5{<&J@(NU!hC+
zh8M8gYQ#xM$=}mqZ_SKdxoRx-*mRMBv{oyC-%OJmV6+H)&mjv;u}gU`0EL+D?t7xZ
z{7v0&na$620vPMg8T8(JGI}ml`;Tn$hWPf}uW9*VN|;F5qa#Vn0KTfBWe8vG0J5Xo
z!7$PD#$!vZ+!_0p+kh5*k5+U)fqR&r==Rt7G=ODPV6(=kW$;qOq${1Re#7M0IQmz6
zu_+K+<ZCd{N0Al3*@1zgtJavwr@?QG+nz@N@#&Jw90~A>ecB58yq}yM;z=nykoFy;
z50^b(;`H&5-$8IT0I1Jg>qwS4eq6Tw`eQVAVxBEw1AkY8_pbc#vQ55>Imy5$pMGhL
zGWywW9-4w0K3Q*#_Na?R21P-~)h@EmU#r+)crt(T^XC)SENjcS%kFA@(e6~zSm%G8
z&ubbFUA^||0MUW>M|Iyo%p5R4-LiOECc3$zCU#jgnC5<m%-8>qF3xRf{R?+u-XZWb
zj8b089zMDaJY!jb&$?F^rB@po(=Wy>4NaZZIH5g&!r}hn_PBn#R1BD-5xkA0%5Yec
zulZZ4)I37iZ4xXv)BCi|o80@}*)FZzav*CPlbyky9N(7IzKIl4(G7|YWg)id%NQ9Y
zdm_`JTlle>zfn4m-gG-Vs<UD;5k3~%FQSrZLFSP?;&ynDIZtEPnl(=H`TB%CYh$}Y
zH=Xy2_GK5&Y4mDcC6A3JrY77YNDHTQ7UNU;y6AZx=fl*G(ajF#yvT0u0~|9<BT%WN
zw0`Rt&u8yX%iW)zd11HX-&EWh|IKSMkDxq?Wt}^y*Fv6_ATw^ak-I;(2dY@{Saquh
z67U5N9>&Vs#E{2}_;>pjU)~GO5JtVBAV7c76G`!sJ5v!06b<ni^zBE;uxl?Fuk2UI
z?duTFt8$t4mM%@fO=IKYXil5>IhJ`%ZyFQ!V?(`@o0Gbz7<~pYRiMP*DH|R|z>rdZ
z(9%D0SSXZczALd~nM9!HxNU(sw4seFy+qqjd5SkFnvXlFX-P7UI8MI)*v1lOI&6)U
zTF^qvG3r`trVAzcvrj5N*D)bGD9<B9n)PUf?CUN&^&dHqT6p8%v5KazABGpwBiX-%
zX%c^t(h+`^jemxAY544@I!;y%mfLRM8YYGnSz?P0FYO<g%)(AYLZi%uuYUZ&2Zr@`
z5GI0T+7qVxlIV-Q%w;z{F@6_`3DL8TA-e@`Yq#e!>wLhcDl~UDf&S!~(r*7hvV;{$
z_5<!{Kh14q2LC?h&ojCaAUXXoJo)|_Ie0y5DRvw7fZO@eK@ylr6W~2?#4$)eV%pt2
z?%>k&n-;E=lo6vFOR1K>r=CLJ7vg+{$E;Cmp{6V&70=uiDdtO=N#C>mj3<Am9E_fK
zqspncAi1PAKzf<ND+nkz!wTJ9E<C!7A}lMy^1<mlZ89BKT;*{zY~5i+*2J**QD8{R
zQA5C4<aK&iLUHFZX?wEScNCjz#OzDTq4FIv>TyuO(W`ccT0!i5nee%`adl6Hlb1!$
z;*-X$w%-4+sMf0Fk48-3I2=6EeD_}Q8_@L*n-%N6bkeByBq&}U){K1WF4)Unsjgx{
zgH@svMk-vuo>YF5Nkmb)zWi)$gLPu-b4VcGF85N8Jn|(>Qz&bWcvJM)5(*%4X#MWL
za2efXKL^q`{RG#HfDjQpfU9wT(O~rcJoJ5m>D@owPqore0Q!?Tw+lUAhpQT36glC~
zC+UsLL7|oNmfO|4>s_vyfHA@`2{?ThT(jSk0IGgjae!u>w5F!aVo!+;!yZ)GK*%uB
zRMUSJF{=?jR)x}0Zs`>wc;>C=IxxUTkFimk1I<Jw#ROlAjhL_?A9CJO(g;_YBcq=F
zB(IpG?#vWqFCT+qlSzqM8RD=Xk$4at$Ih21$mcM(neI~DvVT*!R$Xa`<V$Ml!0_*a
zEvY72I{7fnnG0hoizJ4;o_)y=86!3^Cxn#~3r)6}FlnGy5XTo3*(5yLS0zYi(kT3M
zQYUYOsHAkETiT3?ZsvyaON=D7;v8cIkh$c(J$f(E|5h3;CY!Gv$6)Zh(O{c>^BFzY
z)k)Lz#)RjQPd2siyL%s)&?y2)6!NI2I?2R*?>1co-8(6iRXz{=XL4d#Ki|L|-hbZW
z+zWg;Ic5T|-k0B9LH&-WVBR~DRjhKvo5%Lf<#;+2Ao@&Bv0nw=agX5C8hs#al$(t?
z93W`(i!kN9UjpA!BewsA2%nP;;{xDGk+x&cB1hB4+$2(uO6dZU?5MaN0J_thmC<dz
zkt&Q08f5(?S^_bHwizcF?*>Xd8B0nM?y2iheLEUkbeB?%nD`=aQDcw?)~FuzIYCPX
zMS`5)8N9Gsm<zWI%Y`aBP{4|A2qtM1v+0!{b(XX--@3I{LAR6aDe9YSu(RN@G>v9F
z#^>Z-FikXp`b1b5^$-j@?!~a6pn5J{6G?#f(4O|x^a?xm&u2OCZ}L2D6Tbk!Nu%c_
z8`i@YkKAu(5~w<Y4U=>%)4#X4_JX{24yQiD_5WkN_)>k?Nk(y*HweV|e=<B;`n9H;
zw-v9T@LSG8sjh4n3F(Q+llbL599getje3i~D0-VS1Ct8`R8lJp+!OGcYqS<Y&qkB|
z<`M$nV=Z<cWcb*bW2q%ZVVmMR5yrwyi(Og619C#Z(SKl5HPek2Tp|e0c&<t|0oo<g
z9ch&Uol<*;wiQJb*;2mT_Nvt&)1zvW!ceK<vlD-2X6H}-o%?3(Ov=(9MskNGrR^bO
z5`s&)ZcI|o-UY*VrV1efhBP5R)ySL73s^gkB?n5}KQ_&(dU@=Bs7rf}2oYY_LEc=1
zXlWbEv?u`yp;|(FWU?Y2Om}M<|2)2~oAv$e*=M0!gc49)%~%&?0C=mmKhJVwSb{&Y
z$FG_OhZHQVoILfsMSLXuNoE!MK4u&iDyOU=2B8(k-c?zCaf>ia9}TO_<g#hIMI;`Y
zaIBb0kmm957*_{<RrSCQPrh<4L_URgkI8dhoD@Eaadm8)d&RODFxvQ05O4^XDP#Tx
zqb(c6b?Fk6C>)Y&GvF>F=w3Y6ByBc7?ww4-k}E<hz#;m%1Dce;UDth6k+zHoJs=ZN
zKY6BF9D5u3OA-Xu!LwixtX7dU9D90XMvG2lMjN20I9x!~5WQYS-!bF(oF~Ix#2fw!
z%N;;`!F-NrtBy8+-FlbINXRMrz8;vF1!}3$H}<zNe0vRphE=RVc@*wbcPTk70a3=z
zQ6?6js6)_%SN`br9;;3W0kYo_V}X)zbAl#tMRDXPkqXR1y+q655?*siKfw51xCd>=
zX$J7roa$dk+fBL)NMTIQ2H@g-Hvg?S!H$TyE5Wab=Z_<AF!L>&1G~-^5F1)Sz7pel
z-Nn0{bLw}HV~%YD1b^0nfo@@2S7^JIaTcvuk1!nxltf@0zqnKG)9z5Ejs}}X6yj}h
zs6=IAVSWN;;1BT<+S^2)&O<pg&)09T@l`(4aBNCRo7B||WgaqBRtKKTzOBdN)uUis
zSW3k&DyEw|!dCfdDY9{?e}DXH3oZ(3`TGn(W?#KH416j8p*4*a<p)5$0_Kfxt4>e;
z*`&FjTixAU8r>~fP6GI1yC)`_A8*fZ|5}Ri%%~DEt{Qu^{g!`DnVDeL1R^d1#-W}!
z5Y5N!L8SU)>5hXV({kezg~^;I>U|~p13^sK*=b#Tdv;=3W-~mu2pY2EG0+mkK8L_K
zxOfPkKrzOSL~rqvmPKT0XJ$Tdce*IxzAl{c1glNh@NfkHSk-=rwgL?FcQ#?$-e=4^
ztVArjaIIqFcCE#e)+N)o^7QtJ(%_7kLfvE$f4RnviK(}_4tdF!IVt2068?QX6{w8w
z6G*?&JDX{2V)8IHO1;z^Ze*F&3w3RH?(;Y<FYuR4?2KM0!5Elv`pxf8>jrrISxXg_
z8bVCbeecCDHfcpgw_85qd$k^C+<q+>EXDaxmEdL#<iOq4tW$8#sPemPI3sWE0n+P_
zyaRcM$2&Z|vOP0`<QkMaCt!u!VDDIOU7*{i-Hh{pMt=CdMipT6MANT?DVSzRuI~#v
z1%YGvh*gqfQd+sLa(m;r1#c1j+2&&@TEW&QkqT&VUdBM3wAc!9o=OfEk*^n&Y3yVL
z)kyYjrra>V&euYt!!16Z>V<V3So%yokM%>cgM_Ipd!5ncg3jZ-Y#@6~KZJZTzc<_E
zN5F7+&ZOSdW+B~*=}8u?`(uIvTE)L4CJLs(>`eVbREq~P$nJ|$i}|}ZgTHAdq{T@s
ztLr{=Zs-hpPaAse3RHOcU6xe6YPksqCWUv7`pRm7JSpB;vjkjTZNE`~iuR%5J=MiW
z%t)b`huX<BTEy7opFBvF9FqLxmZR^ozN@yE|G*VI@x6c2f3a&kH}s+`zxR!J_Kj<z
zdeC=*OB6tO!IW|zsC>X!vdQscThNn9Bfln0;e|VVkDrhCTK2L*EqKQn_rB}rEq<M1
z_oroHv(YEvT1|U>vXndu4FM|~n|74%0@DWf6!>Gtbko(`RR;R_ush@Cd)2&C)jTl0
zNSs-^by8Wgz)g*%pI_WQZ7%OT>W0I6jlfJV8`U+x3llhwC?>L(bT9uRx>~G5%`r^0
zOKfDwB~ONTSq6J>LBoGeu|-+ap71Sg*%t5ci0`Xr$SCOEZ+@&IX2qk7XR3b3`lZd<
z>{^uhZBMEp(TU6nnoGblzN<smRUPLY2C_)%HGzQO?EJP8<{Z;Y7OeaArhA?})`w&k
zzG#8HP?+Byzys2(Uz;~NYSU_3$^-C93s=^B^Ecvy-koYOLU&)5d;b$`zJ_<ZOqG21
z@M~+*lFE4p1VK!;oN3%&PVjxJ-zrY35!*4=+Xc{NzNgz&(1Q&%Ws%?CRN~HnE~|jt
zWdY@SUucg?TesRO{k&yg<lb#ck)Apw3-LJD*{U5a6oHRNwI9GzK<ga;-mz`?8;Skg
zPbIm4dC9_SkkAV4K&(frvkC7efYnhNrXd`gd{9>as|VUj0Rq+0^-Vo;D3b*HPi81C
zO-x~2gwxY<ildA20OoF{oOOnn@Mr#d9q)c({*FK)WNS_o`83S5A`~z;*8at}O`A28
z4I*|#)gd(NSX@$G0|@r|_m4Q~Gb|eA*g1AtBW1A9h(-LV*eji!gxWz_CIlspJXo3$
z<2iFwiEECS8xEME&p%Zsy99OnQP$}zmSF9g>EsoXZx#^w5ZbQDlKhR$23->AY|@0%
zQ;0L!xS+W{<@vgkD%aySyLyl`%-6K|eH#E-Y1fdSe$Sz*Kc$@mLbw5Af)tRa<7Yjy
zOLe<;?=b^N9|mHV03oZx6f_EZ*j67xjDVx|4-lO9V|pvg_S^S0BIV|tk+T_*C14w!
zeLtE0Kp6zkIetGnAT-lXeIa{Q=Y|id8~LY<50XH`ZvF8bpb0!Qd*AR=2~z_tQl(SB
zOs9~v7)%sx*T;D8B*e@*x9EMS`+isYylDe{l%C*r1uEt>OEy=z`s>I1{UK($-yO26
z{`~Wx$JSoVtSdI+g?R|a6KMKl#!v=+T6InoXO^Bf#&mL}A2Gdy(KM)?Jh9YjREz(T
zH`DeM<C;9J>dACEOrZ@&t^7-I<aJ$2y;7TUO{h*JmC6TD8jj_bPr<z@*!k~{JQC)+
zPSlEdD0>b*QbU#&OCx_)OSvUlx4-*gxLQnaLj9QygcN2MW#6di^B9GNiemV#e*2Uw
zv263^23r)u1ZakH?@SVJm=-14MXiCCTeD%EPr0Z1665%_bgKolwv|VW%m}k_nkv3k
zQRq>OX32};{F>Mt{$G!Kq?k|iOw^xwJrP<hd+Otx=s!m{5lV~4EcmvBR3*j`jq&A{
zihYDNm4&;!_sFGF=+ovM^JU_9R2M_C_wx;NYJRr`(HH&j_4~~ga7>Z6v}JNSRnzvX
z7y&>Ypj2eaFA%<ze|Q@JxU(aWZ{8c&<a*d@S3l{oHLt`gzPh}wThDNxc5gmUZqe5k
zIL05m7zjYuz&lus@m@+)gON#YNIg(|f}ZSaIj?@1^S=1ga`}F>8gr**-}id23D`dE
z%3H61uUW?R-UQX1$H1oL%>e=oBjw|x$<}H*GJja@m~2A#H)1VI8f9Em&9?{l9@A>b
z#??>wtFXPs;{h?FgXEf~<rV<&fsEm~zi-}`oWGp|68&KCql65X1u$jB?k}pd@^Aey
zrL{-JEe1z5;AZ&IddtCT>t(^0{2ryg!g=MI(Gi!cU7U@ZQCV-{bIasr?-dmz(W63;
zuu1PGn_t~Ql)dNnx|qAv>S@Dn<#BZ{S2ptYrhoQqYF(1*0{Oh@VE$>-X2E3R6|va$
z<>v$+UM&LaMCa|LVcwWDG2*wVJn>=*7DQEoJ-e|~J<lA!FnA0|Hc!pN<UGd&1Q(~^
z%YYqpwwb<n>zUeO?(oElfoS{^IMv_vIgmy##p!Lxm6H0_@;XDMN(JXr78S}R_nIr4
zFw@cO(1U9_)CI`X9>jXrt`Kwim6Y2GVq&7ur`k$LBDNSH;ibMH7`2W4!@mA^1ufb9
zm_VrQVaCS-;<_KsK5m>$O%-Y%KSU`zxX>oX;=jGbTwMzshPrBTEamdLy{Zg%5iY5%
zxFS&hi32RW)o;|^hY^5<^2#*rd&?$k2-Tq<lH#24f%au|T+ipX$A$dbcn2^(xj%^4
zu4go~Y~q&vc|U1@aqrf#RZ{lj*V)W&`K{Za$5rbCc+}8y(;NzLon*z%dH`Z!^L=N-
zUZZnz`uSIawN03i2dexW&=FV7lxl#6PABINz5w9(gGx*>4<K=Kzi!a`O3ijIY}&U$
z76@;oy#vI-i)|yeyDb&jnDM5nLm4vBtvDe(Ltu24@MazOkB*1&Tl}hi^YSErs~%AR
z^xE5LApU#rX1mPZf6wP^ZaZ+_58q-pnD_6y+lTE5fW&xB3eCIiI6}R5mXY;4N6Z*h
z+~2upEp&g}xOJv|${)42Z`l2Ddp6r36CAeb4G6w?@V%;MEZXcI=98`=O&jLR17bcW
z-*aLFcFNcHfuL5~SCr@G1E5i0-@M(LY(6}j+4lgjbSm&Z;2^q=4Y6|^mi9~UcV2xX
zF`g4Yw?JqZ{i8uSFAm-jR3+Y#<cgcO_3BUuYWzklOK%viI_}Dlw02UuzYmehkd+Ze
zAUgmD!03!XSm9q-_aEL;mMpza>G<cMGH;pV&d0VMmde%1r@uI^#D=?sXQC$M`Qb2T
z+3+Z=ty479!xMqLX_gm#oF71%rR5U&a4^B>u-=Bj{3uVVo*Vy?XEtnGVAOJ{sykcQ
zhRA3x!4!?vzARGoTwt)c<pN;rIiZd(ghpRY4_l@iL|BQ~Z5Jo(6Fi6?gBN$!52{|%
zx#wTByZA+*^0^6~Y`O|K_Pft;zi+u?juBeS?G-qmvmIRVGaXvSpDH`*O;8r)p;RZb
z0(i1_t()_r`!SX+mr-S8d_~hH5tuF4E%We8u~(@RV)#B&Pcqy`!n#&;PR%xa&()~M
z`;5-w6I$R(FrLurvuWF=8*{eHOPC)!kA1-SaDR%m&f!emezp2;O&6us^>1zP=;dg}
zRbna-0yQ9bU31HJHYognDc)l9?UwwJA}Wt_yFN3gbFXLv^aW+Ut7go*r3q*S%g384
z64@TEX;JdDjqiyMU!xjEHxjdffBN$;vjca&p8OEUGe)b&nS9oHv2QR+gXmh?ar9i_
z)<iUD;t<t6Tlhd(UbftZ6ijT9;ke3Mfi&#f&+&JO38UkXv{+8V8&tTrHuWMraxR`c
z01`iN^pQnJG%KLn)@Vdn82dIB0d4*IvrGoLa*KG|WJ_hr<6iC*^vvQGq5Aj*EJwl~
zk`_;`+&w2<z7aRbU@z|zJk1<WFVFPJ%<<$|(bi|#l8Qf(c?`Q`HZTXzC#Ea~6tATP
zZO7kzqtDhLdTdXlwf&YRkxt@!sk%C<#guhFyEM5J672Z1ART4fMy%3<#jY~jG8(8J
z`ZUCA_v#}673=`zGW0{;>cqY8;JxyiBh{@ot3>Vigr24$yxTeBG>6K&fG~3-OGC@x
zG^)(+_n@znCroIyqAT5@i^6@Z|Hp)`?OxO5a%YlpS=X)#d{rw(uztOO?V?7q<@TFB
z5dCJ_N&LtfSZ5Ck+AIG1^BGa^FFpOsBM++w5I8+h;SOSpdJ$#b9g1Q{S?3QSa$iXv
zU?DJ(%Zuc@>xg_!_GF8Gr9Q;`fKNf5<IUOBvT`Gksc5^FmNJ0vy@ZmaHIbapB~yUB
z3%rWp^Bb}lg@$F7ZsYmP83&eyvs2t82GU>4X|O((7wr<G>)TGw4W;4yDNwj{OF$Vw
zn~90|Gb42cT2(iMU_=(c0S_4?_dCw`2Im2VRbPqp{d~I@>UkdBUu1dc%tk0Cxw_Ss
zUb^l80oQ!0<}VqB0L8&^Q-z7!om@vo<4Hb!zox~TZ4V;S{)v+Mc=49(?m#wlZ#jl2
z#y)82&u>OAORNpc^jW0yOWqzg7pMSN%*TTKEpNx^CkijG$9Ew5tbwyxsj576fTaa&
z?hE;@6*|<5Ev~QT6Zj-%0*N|iUthzn@z#MxGN}6vvQU9ACn>U29kHaN!9ghQwG^rQ
z{)OYJ=&!a`7f9upX339%)naPl3r5Uw%YLf6?yj<?v-%$4J>aOn2Ixa)|Lo5#Ks=u}
zK&#zAzHbdczdtXE@mV~+uNhHbej~$_D=XsEWt4H5Lnz|{^w#NTyZai-r|r-kv5B0A
z>ORS+%X2a4dD2{i9-z+v2X1>o%tdW$FTK(Ok`AaZ&PI`EiHx7$OU1xXa+=S^*`oD|
z$A@m8wQKBupUl|5M&4&k(LH(o>gFMRwz@zRzO~{+$&p}@y6oGa#LpVFS)=%gMc`C#
zzBCQ4pI+8{WdqbViocWG=iuv;F`{l?dn`Y`0?_3%9~!<LEfx8My^DP)8<HDOl9Ha6
zRSitX%x%Uccv7ysihtT8aI!%f!`J<2Egc~Y&+#EL=ZF09P7dvge)_95j{3Qa%=()u
zZ|=~jPI5ZQ@fUbYi0`+E0A(}NA=6?T)T0zX$tW~a3076}JVyy~0>HInb>ZEAtmTF^
z|Fiz@(?C~I`z?|pNFK(-9KWv^Bzh&v^Ly-XOMb`^TpH7m@2}p*A_B#8J(OXaNht;L
zX;EKMQJSI&%R$1jzn{&lFY~nt#og;Rr~Ww!wKpoo8`zEpksA^#qy~p%xtb_RKEY-(
zg;9C=ZwNwYO@bBb?zE@98&<dXpH8%FyZ*xE^IednN)LcidK|1kA=v<6;$&Oa$NGAg
zlH+9+L}cOaTx@p?Jb#;U?gKDP`usfmE4n7VpP&=$R-G?*dhT&$XqJ2i!vs5Sy_chS
zh1bZ8(w)-30{xh*&uYY%50yQLd-{|te4hh9Edam9__=qeFxvwl!3%A5vwbaZ%au3<
zQ(Yg}`yMxJZa~wBxqj=k7-*(_>O7xe^W9_yHiY7qccP^ONY8@==9bLuF?*l&3B9fh
z%|Vi!hdlcCKmOFO^}gZF$l{gAe`uzU2ku9I)xfoXcU<qc*x%~q3v9Y~dU_&awR*(7
zRZ}7RXRQM?J&yj!*MR*R&y7mM?IrH-y8d%8DoiS^oiI;<{^)|;PwF{=C_L`KTVC$;
z@p1G0$x){wi8$$`q3bPz=Nb9nsD2q)eX^YVUf;U|?#Zjt=N*2bT4*M=*`U5>n^j*6
zcIUqHr~g{s`Y~|DHEIbM-nRvIUvOLzs_x4CaSD1m;hohM>g%}1R-h4IVFh&l^P;Ei
zn}ry%)$dvZ?(fRn8<$q^GwwGU=7nyJCiT_0dH^CD+`N-3yJ<VVt#rHjYP@V6$);a>
zpjVK_?jv|v=HAq_e#=1R>;7u{p%;57c@o3&tb@>*zt%2=L&>jCzfT(4#;bj6I@2|}
zT0)yK_p<uY&&_x1=9c~`|Bt=jb;G=o$D%ZkR&>cRl;Q%>%iMByYPwaBF0b2Y=D3=a
zWHcf8-K7)XR~^3k(D-rUD^N15A3DvIIY?k~wLjiQdva*(D=h{gP_pxodB?5HFM$JC
zayp;J!a{#DP)Vz|o;}q?ptSP|o8pOk3`9bKF%Sde?#DF7mx<)z(zT>SxdHKMKl@B1
zP`*F<AxTMPVE_>j@2o0-4Bm~JdrP3l;V*oiE?ZCm$j&KQyU@rB;uEl&b&#Q$aq)4_
zk=ih<8%nF%@iLNm9JHYF(T8zRe#-Pp7)5<bPtKo8{_Wb#Tw5-voH}Jl8}}T${OdHy
zRC763tajI^WhK_Of^<!kOOZc_mehr3$dbV-D}1PQv{A|`Tq;x{XV44>$}}1sXM#-|
zS0Ww|3ch6%Ltnhw{#G*}XsczYfB(b@W5aL$+KB6ba=2j*e(~_K?k>Zi8Tx=v5b5%6
zHOaQLPG+@4_92Nm+0YI6%lpQ4gVC$qC&z2QuXhT>R4&n3MNXEUH@{<QKiu>^Z<yaU
zx-S0qBlT-6?X+uhSL32<Sw?(Oip8*!^N@WqaY0_#)h=i>^EgS%u&&bjnCiav1XC<c
z@|t(#F{Q&ja0%FWRBWBpp7-!#le9#0_k1={u-|ISMTf$1*7!D$yy<#4P1g{Ok!GDI
zPk(*kYsfD_zBP|!YFY87xKt7CtrIP3^aBhpa3Kzd(ytz+p;nE)5+rJ^bd9C8E(HlI
zhrmQtE3p!fRf*K#)Yu=r@2z%C*xiI$b<<r+za{aIHgrWLxPx*kd!{`Bmp1Y?T&1Js
z7RzdnWpr?10{G}`k;M@_n)Jmq=4@@00!99<lA-MpcDqqQlpYax{<Wwx(b`tvkxc}R
zZhM;Jh0w19yjUhPRD+_8PtHh|Y&8yz(51O<^EYSG4E`Th>%K}vDlGKH6*9e+>?4r4
z=$4(JeD7wUHIL6VTirz&lm2=CMjPO5ik^Rlts<!|lgcy($_GWgGz>3uA0xFd)BT}o
z9;$bXlwQJT=4=%EG4jeEf$Np;%gu)xH8tR9_G_yzA@6S+C6QeIve&IC!?({^_<<@P
z_U?|5;^?m>Y|*aDHotDIrfRR6`_}h*Jg2$YWpgBzdE3?ZAOWd<*}PHFh13>U$5F#t
z^vCyj4OkhB{vTIg9Trv8y-P`{v?48_fP#c{O9%)^BMl;54&5+FHwZ|>kkZ}VUD6>8
z4MR6W&CKukefRl2_g?>Xd^~6Gv-f(}yWX{4u4yoKaHuapGnO~)ETyvYFIn~go9R(K
zp`Jo_Ryc7ltChOc6Y0O}9EzPMB)b{7C>MM(1%s2$Z3d3RS`89ogg9a-jCZ4i?&)$N
zL_%HZ4~@&pp}A$FE#9yCWCb->KIVB4B|L%5WB+EFF@aQhjIyc?6}*A7790odWefm_
z^^Tb$vvu+r_1lnEU2cKw?W!pgu@da3x}nUJ#q9jg*zO|V3|)CVZEOr6-LPC{sL5C%
zV=y1Q$Ikrr;p5wTDJz^#{HG<2l6h1H>r{E#pq8rAePx=aasq`(%KjLYNsn-qxh4oJ
zn=J17oZhT&{4S98D{X@Y_I?BJdFuqZooV&pHVw+4tC=n_x^lc&2iS?C^NO$HKrUC>
za-5UO%8D{w1k$Gr@W)>3lCtYX)P1kE5HJH+n7!??TKwTGeT2PZ1F&>2?r?~BNBi)b
zzr7skDfMqAF7R`{A5^TQz*Oi3pWLVX$(;|cmpl*N73>G~>+nyfpa0dF@7Lxr?q~y2
zy?=zlyuMDw1ty`l_n4VN5<6llsa?%!dvv->S&&5|m}fFS$&jzCI{~(QF<#PS3vKm?
zS$4QDa(~%M_1j5;j#<&9vbEpor4+-|EvagM{Ei8q%yq^n%ddXyd;4zZ96}SMtBwQN
zDI?V*y+0@Qj|!ARHEp(L3!&LT_^&E7mzS9EUlj>RL}7W$iR>I0zGe~ubLRMYD?&GS
zm3TvGf4vRg`WU{O$Il{0@qPf$#pkie54vuXzFg__trTtHF1?mOO`*9XB~9gGz7Z~|
zOG6RfH6dx^0GP|DNg3{mh{87Btf~mB@x;0{zRl(q9=ZrHe5;i38O^2^7Htlm^@~cf
zWBOJTX@yT$mUZuhrHZY}#D<Qse?v_Sj3Z6@V6x6&vdv`K?{wxY&9l3fB-!#4X9KTC
z?R)=SgV<CvNYT5Fhx}qvb8MKwiO4?`P}+e6Bu|JAfZY{GUL1vpp@IMd2AkCjC>-^$
zYY~0bi-Jd^Mo~n4zzBL>r;~@<3&{Bv^Q?XoK$FkuU$>n=egc~=yo#I~7GH7&-0FPy
zMvQ!xp*W>ZsHl4Hh3l5X`gy4a&tBaKKKJvk36bL)(A?+;Y1DPA)Z2=556^|3{+o+m
zznll125zJ>M0v<ZdE6dc*)2`XVac1tUz_DKIJ7Ijt_rc8?TU*#3AK}0$y>6S-c*nq
zz4wW`{Kr9Pdu;bp+3~zq?oDrx7-EE+;S}-9<s-Cldoi-PbpUsUKSPD4-{coF1D*i$
z*SKetLn)X|bCR=D<vYushh{nEEFglORckP*|51jyvfm11cRkr$T9l0)2zj(tM*e0u
z^!cR7y;{;)v-Qy)b3%AhT*r`!iT`I6L4|xCK-Pz!gw65H%#GsYx|`S}084=W**#v0
zvL>XzU9K%)I0Ab@F*E+|$t@Y92c_1`Ia+!DqLZInu}@7%Z1Ia(T828JHxVzDl56d}
z9uG|yK%XkkL_i(AdFOiiLivO)e}b7Eg$r$kofv*IG%)F24E~Ccc{m3wF|RD30Qm<r
z$Ehh#c<uoDBIH>N_-=T<bsg{v!129-q7a=I1Rmq}tMJUaIo%rbxPOA9KT?@??Z#IJ
zvUE;2;P$4S$1wOR2r>a)A3@9?0$}}D_ZEdc?t0TiQL*;FoY6w$AQs|rb^4D3yyW(E
z@23!dxJ3DQpN<Fu{?og>6~4F3Vz+y#A#;D4b~C`Y+gkcAv$Ko~%z>3dOjP2Y1+t%g
zcm82Lpzwm603%0$o5L#PsKIMtPVcC3^Ln!#<o!niryby}l-1${zx@{6XmFCIiqDhp
z5Iw#j6$hq;m$%=Yn(O6WFw<T34ugb5?~*rd*wZ{bdkzc{3oFG)b8O-j$C0vM;BklH
zy}JV&6y^H9O{v&=fo<J(;x(&34`skD|5n5~`lIH<sgViM6A>R{q>{PSOx^SC*4t}w
zQOA!3H;SfoTrX_WdqqCpx*!rNY&^HNhKCW<1D8$D5=NrC35Rn*FPySZeh9{x>|KN{
zMBn2Xv`_dqhT`c}%AOBvR;qdBGRe|}?2Mud_|s+Sg@VYQ$BMU2_`6!X(4RN`R=-i6
z8Jao1!W6T-UG!4F?tGXE)Le8vOjEylY(j_V#CkO445V0Xfc<f|awdSEfjx9#1)=_J
zX<mVd$xz(u+nDIPJAS0+S>LMQQQoll*PEFFu|={#0HoZeSRkzdVvMTQEoQ|{ukveG
z8yx!AX^eCqc{2c<k61>Lf5hwC4%G|6koL~cr77*Mms~a#HFNhUxM+Yn%{6EuEpGXa
zk?wvgDMn;}0|P_l7CS@X->l&a<k81Q=qhSGrUTVO7Xv)PKN=PSAfbJf{jChu_ev-x
zo%@wIO3>KYay;28`sRpwvOmy@t)mTK4*^dRs}S1v%l_KH{?Xj@QsRMtk7{$r6m#7P
zaxn^T-!-_Jhun@BeNJP;bVgk9YZx~5?~?-BiHrTDj-A<hR%87;fIIBC+^*m{k#KR}
z2N9u(Wixl$hXO+9Zx~iHK%2j*AIrcKhgY3=8Iwc(=aUJX8T=S=ez}s*c)GLtfpR4F
z)*}yGf007spE!vr^d!`nYk}j*r3q2nsee*M+)159FosQun1%64wj+0btaMu5<MBH3
zE@*~oC(@oBZG02Y-haoY89=+=R~MhK5XqVAmW`@xuvAv4)1l0UO*fzq<}XWL($57x
z^*>_p`dD4Pz%cMcrzeA7*N17qn7CQ2%{XsbB`=1v2k)BVIfGElH;R?P{CgHjZB$a}
z7bBCaJ8`o~Wx?pP$O1Zj4`7&?<2q^P3|wp8*Jlo7c$LcUeRiRVx4~HNa|0wx3%~)w
z6Bj}D##@sd{G)8}VpdT=u7A*E4zM#ijQwv4GM~GdW(|w8yLE>#qhPY)6s?D(kcZ31
znW)w-(B3jo+xcF<_#4}kCIWdk9|1x6Cjs%<$*a8Sdg*|P?-nq$>VW$yvuz*jrh7qi
z-JqKl<e3e|SFF?jDxyRF_Q%Oq>^Dctll_f6Tpfrz{^*i7xHvAfk_+GtAL}iV+XVFi
z>zZ`*e?c5|fNDc@GJoOy@ZM*q#weM|1AA}jz#0yjeY>`5#f*mOSJCY%f|Z5A{N&Ar
zQ)O3CA0F|A^Dc!X33cYh)f2OD8;SNx=(${+`#@N8vif@vXD5DUs2W1#y+^u}sV~l(
z^Gb;kW^v+74!j~Id!jsRTEw4})unPeDz+S{rBrp}E-ukZk?XHEeAaiTEMoz(Va)bp
z6U>i$zsStOb;GUM4BN_SX_U|nwRY+E%HzamqVhuxeSvD>2V79Ahwkg5Y(O)7bmkI@
zMeK7(isE-4n_Lw*&WS+k3L0ll(0DC}xh*@$j<qSfdqWn|KuBQO<Lxi`(<|bOY*{>a
zTc8F`6vRG_$AlhQOuyL;z=)^Hp6Ao|HTy$<N{sIN)p!RlkKwHqzTI_9aIL4i2`T0)
zpxp$%{v5pfBW2(7nqkRWqg`d8Q#_lQwv3zE-01Qq+h(iXfkPkxX<N&s^F=j*1rFRS
zAcEg{0evlbrf)xC!KZo&z(sanONRL}NJ?GN9vY)UgwB`jjxox)9w^55f;qQy(N!9g
zX;wM8l4-ml7BHBm;KIete%)U40L+Y{WLCtLn)?Ne3#43^(2$^i0z@>tZUE!F<K>8`
z@@7~QzDcGFHc|0*#9hn%$TQKYhU1%GCDF%ft8(#BxEA&YPtvSPB7*drIQ`DuhSgw<
zi2NA>&@RoB5at2&r)PEKtHPwK+AT8a{@lujKO4G}dN;<Cthn}XFR==*-z-LRNpY5G
zbC&Uc3xKgvm>0UnG!hCVXBX^hKxznXQ}fz-E$Vn6lv}DNa0<y8n-z27jGJ<)jF=7f
zm}50*0O%Meb$x!VYxe6Cxa>M_uW7<#2dLNElmls2N&EE`Xh#3`OqpOliqUg8{>TWg
z<!Vk3FdpHyK3=h@7`PhqR+(L;1MH2FzB?RXJ2CHLr%at`73cA$-C0b=)mtbWFoVnN
z8rg60bM)*<L-rul!__6hchirUA?IaXBki6u^9S?^E_3AwrwsP7H{4^*tK)C%B0t8T
z{T=Q=o2<BC7A@L8nKZKR3c5AqD!T;K9KO4D^SdYn3}+RwH6Z>_oz(6gfrqGS=kUE{
zRcE&r)kL-tF{D<3+K%b5LNK=2&yJXeK#EW)&%n}zkxx5zzn_J^%yp^ZDPLu&*ha%c
zr&T(p|6AXbJ2XP?mPDP<+A6+XnsD*k*WZ)T-Yl-#nD(`aOeP73rYE`TBWm@ZrmU<L
zcis47G`YX*d1k-Y50?^Ek;1I-uinmAZD?u3nZTHIHOL{tUHx>8*^IaN-^g&=qA$Ea
zV@0$94MFiSR+&CAxFWH6{oJixrCT#n84h2!<HM`B3^LLSUV#FaUU&yDNW~cy>1O!6
z^!RyYX8#in#cdv%J<d#KnL+FuDjeM4rH$xeC$2WgX{G91Br+2@L@Nc{!~b%ZO6Jwn
z>rDKbTyd!tp$`NOn+3pcJQbgo7ZxqvKQSVmEGqE*YezG>2Ln+zxSwqR*%{P5_cLF;
z(QCH{Jm%TumUZj{_`?}cN;+0RPl*=px|Qsc&+tZF(#`1e<p2ghdw|hW&zf0_xa&=w
zR1!O&A-UrSNk_}@)IFjb71>?BV68}BfKY!;wJ}dM=*X~HD$M(Ica#M11F0Cfvb*$w
znAd+Bc60{3y!zhDY8m)k5u@OXI%HonT&!b$05+KQR=@Is$@pNAOe0;i-TS_hg}J!z
zb%$(Zb@o`uH7q|^X?Os_kR7`!Z;j9&t7duC-lOtOzX30%BI3LD^x-D%XAxUt0^hzw
z@sdR5xtCU`{mT|vEr-v$<gK6dO{OkW{*6>AV&FI-HTO2eOrnbr$fg8l{=uv~*($^b
z@a*c$?Io$-0Dd?S&4Bm#N()7XU&xuM&*-B!#Pv%(Zhp;x>`7h;WLF6{%Hg06Mqltp
zM1Rh4C8WMe!OdUkv2KsAGNEPVFNJkJmkB|Be_5yRfFsv@rBv}jSagYrf9jcU<HIEp
z)c5}AmzEL<eF};0$&Whl;Eh&?SjqWt3*cs*?lkcikT=_~LoIWkJ{7YcE-LtU5%PNU
z{J;@gFRcNmf!oiASx=e|#seDM4BWPU%5Fon_P31nKvzHDPr(P+>SHavK<udj3K3BE
z&CgfU(J&iXI_~3lCX*19x5V}@;P^qj@M-frF1k-Yn*F~!WtL<Fuy<esOw~l^_7gF$
ze?s)NqX=>iWOaiUo8CXho5m4lT*KPa9AVutvp*-OLUbM`rWKqDZ}z*1`g|eCH7D`N
zmmN-;H~@^++ww4Vmb}4(lfH-iVP4NqE#5I!`qw!1+h%5%B;1TThy<gj^^9&csrZ(s
z<8;_n09?`5374NcJfLIMc4F8xZT*?>;6rS>dw7L^&3@Ag!;7@=*LtFDXUSYuAA0WW
zM?r8!p=55s30M0?-Xsi6phh)~C`)LAf$&Vtf(zin`+5C(fU}_c;!XT$`X3oP?9Yj+
zi87e?xyVxoG^FdjW~)Beo&&-tphQ1}BkBM!{s9drK#0?FQmnbZ6{akZwNve|_XChS
zVL2WcA@&cgVn4#p_dD8Lk3H&e*I!wcr&zfnT+6L;<Cso>YMh(oX9?{ok8Pvi2f$I_
z0Wi6=v0dMJ(Y8|uy1UZpNHL(;2Oq3BcxkF1Uy?vzj2tRNm`(&ra-H`JUt`(g1P0`B
z(Y^*?Gv`H;2NJo<VEeE8n4-CNM+$;lK&8NvJ`#mJfy7eFxU+pzIc83XTgnk4KKdzQ
zctM6`sv%%pj6L0Ui0?=CdWPktE1BxcUc5KD(icydTqsV~1B;%2W{F=5JZ0G;#r{YW
z8eb_PY3TWQ-Dl+Ifa@RQ!GjsY0{d>-QBKoV_pkj0sfz<oS~RM1EhsB6*;p?Mdr1Z4
zTHnu^bdy4eUrlf&8<)awaK4&x)o91-+u-ZIC{upUed!tpj5t{4s$R)85nH7=WdGs9
zi#~A|)BF*-$Iat8C&Y1t#_4L%@X-3+6DYBKF$8dwjZ(o&%}YNVjqRWF`d&xc;D-GT
zKs)7OhTPo?gB4b2^0Iyh>{Ixb>;oPy5Z7gQi4mk79@Y0A`AWaT_Lcwq{9cSCWg^YJ
zo4x}CHD<c6jsK&!>BtCJD$E|bKXMoVUyKWftWI(4d7}^|&d4Z}XezyGK^dcmDXr*Y
z8w|)7U9XHfAiv(yB2vba82S)*^E%5i;d$`aVsZp6WlAItG>>6W9{mTs;1%;=xtv)u
z5Tc8Ui7zqTUwn#5kC1w<q{cc`3$zh_%&=B4Fqw8o1d_#C1mcJ#Q5!rjW#zGm{L($C
z(X#lqY)Dx62W<fFtNE%Qc}(Ozk^6tQKx-z$;%Dm;F|l<ugu8}GhlL((NI!1_5Phj!
zhJdNaT%a1m5LLn95B>Gz;%Cq<0u@Y!jPzCvYx*;;>!%`AQ{M~leeB8U7v*2pwnDpM
z0{I4g(T8GPtD+d!_WLwauJyJSp|sDmOPW1<YYM#iD@D_TGNtOc<=9Arh!P?Gr*R#K
zw)5c-+p4}=`HiU+w~+?vK%%$8Lf_l+uQ^O3VZW^#*MRT;D{>v=d*AYyqt)^hO4Qwj
zLze(<pWnQG(FzCpy<Df^o*9aypAS#4puVz45yK-mW1qRl5?9AR+s*vhLR|l|H`|_B
z$JWx?1ytSI@DIa(c!BNS;8#w`@^<n&27m&}V-?2;vBW=K|594orb1JX$Pftp({DdL
zT}<G}@4R#J$^o_b&EPH)nt6}L+A?QvY3Evp6asVfUy9F}?3HnnM*)UT!q|fX#)>*`
zqOqmc_x%eK_I3~-i{kJG(}oL1WHp5!4OM3UDWGO{mZ^=SlyazLYUt-<)F|e3EW^mn
zQXDUQ{JhT%`r^>iC#F@kf=<DTj#*kP`6n84>G3-rW=dGdWZn>o%0M%%=J|)S#4Q&!
zEU(%2;-9=tiO)tkSB-^0qi!#j`Oj6I6^b3Xg|WYQ9&1Bc@9v)DQ;zP>+FGcD>qirH
z--$O@0$O&vCbL<sQDypdsxm^4!RM#0(sU~#OovWDi`*AO9Z5bVmQJ_e>%VTGi=po=
z$KI&>3Ssw6xH9U;z1zzJm-nA}s>s7Ew02So1Z{o;dH}(aD2Y^(st(^;#0VGrwh;I{
zz8Fc12wN3tI=`>od5O5HAU~;D{c++uaX+P}SflvYuE7rA1%YxR&}o+W-8fhdvP^iY
z_7Z<;<7<F_dFNjH`t}$rML+~8$pwu?XY$hmQaDdDjW81`H*$BG3&yp5CbAEole5ND
zvqX#D_gQ+v{c6-t{b~GqAY)%X{5X#tgBBPz^81xA+?^!zCWH|`6<#dy2tF7daC+7z
zEYI@!z4%3u%;)!Btw!+vfwy9Q0{V}BYRJMs8S7z{-v{Jr-?D#Ojqpb9*uT7#dVyyz
z>8&7`T0X$NnXHw3$AdMYk~bGroP54P(-zdGz$rzN6viLGT)DfJOqSr>E#t^0@PkIi
zHHJ8*z9$3gttlaQV6igiLbu_hv1XVH(@^yK;S;qW>&$`ef{;`H$4E8s*$-ubH4ZR^
z7*5;6Ijh)h(T|R6-%jNHocH6~cYar8)s9E2ZGbGui?xD!GGi9(^>tPgaWX8vUzke>
zw94RI^clGNjsop5$8B1@e=CkFa(=aQR~j-;OFON{{2cX3tuar1){#*I2m$Ya;NT2&
z0oo<IFj6g<?GCU3RWINi?I@p<Oy+ZV?+p%x^6S+CvFo3KXd2Yf9bx33^8H`YWadM)
zv@<{+eRYmhNYX!VxRd%MFsWtn07ScdM@NXSrH9xg^Ei11&^T^w-U{K|u1KFnhrH)=
zx&}OEOv4j8CYcvS@Gw;NnP&uyac)a?Ua$5Yb42aGTE-^Zg_C{@E(7{&Lz+j*##r`$
zAYN_ud6qkIuDWc1Xas(!2Nf?#X;pfF=(U=9XF06eF&%^oy&D<2@u|hC5P@M96;kbt
zlaDeV$z7kcnJoX%Vg`-gG)j-9y;UXZCaw_uGf*LuiP<_ch2H&Uut&{h%*@Nt=n`wK
zZ^OM1&4Q@EdWiM#JLa>Z^x))a(q-egU)gi1`jG6EPnEkWC$ydeFptfQDIGuGRhQd0
zxEviD!$6taZdS7dDT3I%UPeeg10!zZ6p+`64ef2HR9VsepS++fsB0QP{TQj<f2Ox7
zHM|N*OPMP|MgUb$uZ;WK{3HWpi4mj?=utfG@X7!6#dCv{pi}&3!@zNmkv|xqSrQDn
zTQ-JSaX=uR10IVp9#&sri#je7XFyfedUjQ@*I^F)t0kwHfpa?O0+7f5lK}*910>My
z!|jAg`q|hcpkJ}29g%SY-W#kyTBd_A($Ix&-i)VBu_FL7f%zhf&}VD&pSD^vsoz`4
zm?NVH5TIo&QyJ1ft7B~U=-W1x<gRWgI~**;eYTUHrJ*jQr|MgTcjQ^1t^1l=OWovb
zNiH3F@a#!+`}C#$@!dL_IC_SLPUUc_XyUed@X!Le)>irV<<NsDHWwcUrSc6mGnhxT
z$yX>ieCN#d)uyz1Gjwn1Q~%|MeT;XqqJh$vE#cx&-kbpu^8&nv)fc*8(E<vN0@m`z
z@LQXTw(_0(7onDQvjg|>4nPIad>d$H^>Nvg&FAppss&IZR|fz-=e%3?idOGj_ik>1
z7N-nhoc$<yo}@9J3t!=+Ixg<ZZN`}WwbMFjuai3F3uVE={ritGqQ`-F3cNjllNSgK
zzi(*0I!Y5aO_PG4x|_Z{C7DFO*Fp@*GTfah`|_2=;r3m)OSqsl><O0P+{i|SKHZRm
z!Zri*pqc;LJX*(o$&8~O4xh>nG6kKq5-Z*POi~A@Ci+TJGXfLdM;0Ebg!JPDYz(ah
z3i$sS`qq|PjxLnkO$ntyml)>kc?HIi+5g7-P38y!JB-A-j=7mD{~9n@Gg#k1B%-sa
z6i#Rm*^<s|k)X>^!6gLRa#Qb$?>a!^ej?r9vXCp^7Nk~?|EUG7;iqIwjWy>YKh<O5
zxD}6Hx=w4IknEZgSXDsV$4ib4G>|JvnFW}cs|6<-sw62rLMkaI4HU;CMX%j$$A0}Q
zcLK!%NIVD*2BZalft<jmoCo}D4Ome?wI79ZLP<_virVo5BWrHVfSDUdRH%zgw|DxD
zmEhnNx)#=p`;&$VpbCLQ=XuG0mkKZ<J4-<SwWWRBi8uT{Nduf>Es8)A?ke7<kGvk!
z;T{WL9oMlNePZA^wEB-x18y@VMA8v9IP2R<8y&yE(LdE6z^r7J+LPuZ;j|~s7v%?_
zMnHY^y%iZuRo;OFw6HC}m!Ii{ysd${Y2{gnZ5Hvy9)=Q$Kz!BY6xKDMqS<b@=*!r<
zksig}*jHig5u;nocM0bPeags4Fo~sNG+WUX#)OGnO5v#}t_)sPSd-(1EJPSKCLl5@
zc%H1yr=~bX3MrptWfhRW#F3vhr+Ae5#9UyjhkpB#;#i~hD;_u7W}v$9;+qS#gCCWN
z$iX<Ff_}Y0PlMvd_k^Epof+K7_p8hyA!KvkU0+Z_jhULLA}uPm3qxW<l|;_AP#zQD
zGw7u9Kg|~Egd38!#b4ZZ`I@8HdwKD$f*W;VG_Ub2(5AF~sGq6{TsM&)B2s((Sfir3
zIFtzLc~JHrmv2C6fTW;(SR3O9q?oMbt>K~93qFkmD1a(KMsR~?ox1Ag4YcC*P^Yru
zw?I7!P=(3>QDRQ92B7r6P;tu)(116-O5B{<(bjK-vqAx$v81$mIM>Z{Yc2hsJec(U
z9-vZ8THyk_R*0*)`@s;Xk;fSX=`4XT0;Q7dV=Hef074s#N9e&){#(wkPJ2Ul(;U<7
z6ZA;8ta}$-WdWZ93Xl?9ofZ%H8FEkTG+{H)pjV1VNzVW2?^OCTJVq(Q&S$_N5hAJz
z2<HR%dR%zidc$UuxrL35P2q%wYAUao<>lv(Mc2V?_cd^+&rzG329~r0aVaiC7DhOJ
zXyMB?c(t?kInseUh5KE~a=n||1blP%hBGZ~^fOb7)A`n`_V@ta5$i_R$;-cRY)y#D
z0foPK2b>4<lQ<RDF#&q?)Q9!e1uCsIj^n2o<Yk>#1hh_p3lblfh<U~3_TAN+JNuL0
zd%iosqtD8W1zYg#W4#mA!HVh+w0Z23t1)QTOB~wz#w?HPs3l>U`BH{hyzT?FV7LWK
zBoP<$WsL;tv_`bEwg)ULI0a(Xf~O6LS9`xY-F%G-4x@Rqt!;l4I>4~j5WWI>fok?+
z)NebF4to50KXKA*MC;*Zb0YC^(i`=iB4#8<*Sk#DrB8ejV-OVN(sP@44x}e`)(gEx
z>@5jCXijqZueyKtyo~5|I9w+RaXTbxK4s1odu;f1EVYi0s!TPvdF-2X_~2Gg0@5LE
z$cs_*2@M~^CHBpGvtehkJC@L|L(lK$3C(di+D~f{X{u8;gm;w+cZOIA%xGCD&(U;=
zCLRJ~JZq#9s&3$Ew-<7;Urw0G2ZhnZShp$tj3#jsVm_tjqe-$4nD@AwvrQ~~h(xAS
zjn)6y4Y!SkP0&b)cUZW=-sld|CGSx1j=bxmrXqW)sDLLH?K_9XmgcCR_lqNPciR_>
zwvEv|Tx};phB6D2u8~q!EY|N_Q)?!R29yOf3YFe5J`ZGu%PqmN7jdOMgtLC`*^I%-
z%W+Sa6<huN{<f)(r5ox56azccD4QCk_(uIoHp?AUFaFJ=KC+(#jqV4FxLeTA9vq&^
z^e>}$zv%la-me+)!y?v==$dmW{w8vgpxJ;3*H%Afq3kx%Ixy3ZEL7m);|JZoJ!@>L
z@t+b)1BuX}_b<DDtr&`WiQHdqI)Dz!_>HQ(o&PqTFv-0`ce9n(7W+wvrdum8)9(^l
zWqB6o2Z=^LL_DS93od`P^F*WMOP$9>?7Vwpxv={wPS=RGVfy#^`l$bJf5^zlysxer
z|MU@@EYKd(uGf6q9<DO-{uP+{>-$@c!c*j0!`-!Dm*efx--eEx^O845am24(>?f(C
zWet93+YCToMk7Vk47r+hV{%8nX^R4Vgr}O`)aYXYeS#@_<Lns+IYOL2t^!5Qb(pZ`
zNOM?5bv|DOHZMtjuHTf6QihGC-6lMj-Fb>n?4lw1Eft2VTDx@<{)F|9S)MNB54y;{
zH-DH#hcDScG5_^)EXzFUx2MgPQ1U_aY4_j<Aq+}LvGVpQ7l*Y~X^y_?)f12CeY)&d
zGtY&Vxyi73Dn*6`_)g_cYmZ@@QiZ6f!19<uEyX7t5rM0G-<*By)+ye0SfKUh61gf{
zeNw;$x((j0IRK8$1|Ex*gg7B{G)4LzefhhYPKn#yCJDD=6Y2#zzV-04fqF}a!m&7h
zsD0VC(C%nTi4R5A1hmbo<L14$(sOQY&#S}CU(eph{{D>Oz3iWd6etm{FrYb~%+;y&
zS{xC5dKFKoem7vpbP`p|^^j{X#c@sBnj5oE*1R?NGne#4?agjh0KtR9)D5?icps9H
zF6u?tYE*)2>revYZQvn^(C}*>XjYC+H2v1QDG`z}wzE9dIe!IAbgkpA1Lm~(w_^0?
z7Bek--QJQJn2h4LQYix?@a#|Hkp)38f$+p*Z*^|FMdrvOf%Qxwv9mAUlGlCuJZ1eU
z$ua?}L_Mmt;8&Q~_>?Ax3t^NC3r<*L1aHSpXq?@pCsf9NsFLfq9?&FEvnU^TE&j|y
z|6`DpgAD~5{ZUl6sYY+sw1}Lwo-gPWZMoalD&)>Yz~17u6EK)&vtd-);+S>&IhnkP
z*vZBH_y&Z-6MkyBuJas?)<9sRgwU@-=S6h&Wg0$>`Z|AH-1J@AM(TDabP^9a*262@
z=8aNmek}Tunau&u82B^uH%dv&s*~JAhQ`6&-7I2)l|vN1%v~Qu0Y)KCwuZ#zqZnnQ
z>Mx&HS66?>_o@^|<FQpijZQ1q9mb83KG?c$W{2>V=+wv*FiO1*?L5Ydl@g<_HyfGz
z)92{qG(qF+3i~F8xW8&T4_Al*u0HXO-tocdPr-D*fl<OwR;l*ZM=ILGW=*mGG;5Af
z@)kE(&oVgMowSoXvZ51z=)t}MwcQ3on3Qo{I$mdj&wi1)3{fUc>==~l1Y}86AWAWB
zUTGxrVw_ul7zTfsB1jEmD$3++T*8U92sL-K{DR|mLZp7YJUv4iE|$GEsy$1ZGt6H4
z8WbzYZ8;D|xw~&$FvuIIeZld@20N}iCqJc)N9BfJW|5Iacjz@1h{#5EPGn>oXY^5K
zqVbrn{wFGL$x;WOR1J&4YHBN<@Og|_*N<gTuTk0GIc*gz*1qpBZB`2;bG0Z_$~#QZ
zwp0hK2~^vAeI(1bN7F6Nk%jRxkEvW(Y|Jt71?~>W7G5X%st*m!=mi^zb`7ZBMfJWn
zM7vCrb&K3um4j*fwW1_0^g<6vu2fQ9aJ1eGKiYj7e)%PgJtHQS=j^Z5G}vc111?5=
z{nM%{mDeWSqu*-Y$jt@TlFT*Hc3Qopt*tGvKRpSY!jv(}aiPsxdO89KkClAqdr<4O
znvzoV*wXdk;>GwHT#7tRWV;~fF*%L>hv~JxX4k#t-($vIBZttozx`5Zeq1IU0w>E(
zlH@JB<$nhvZyB5k@X<7jHGHqOcM<sI|AHSsssr_$?ZFND(6NIQb=oN%OKVtgj_fo&
zH<m{=j%~I5<P$?&UL2ISz5V(FlfcrmwD000I8(?6+Il;5pjDJ*HO&-7#V@o!$mj_d
z8{bJ0eG9zAIT-a$&T}9qx9Mn9g4;H4v2}XVm*r-hWe=%1JAJx4+%BVx!Sity;n&F<
zVpI^bw95kFy@u=tIwo{zb>Ba~TAavYusVB5PZ(me*)S=K_=>;u#(0yv3lZPTn6{rw
zjhbw@v+Z0YKcQGRVz5uh4P$RezD|T#AAql3_y$<v=;m#*UiIAZt0iozVUTuT9q=!s
z))*_=AG~J>U4_n1m1Jp=%Qeam!XRY2AQ*9R()wB<QL{`pUw5`xv-r#2LVL!x@H@`O
z&)KNYvyr!ZC++YbW|GMn83^PWe~a^xS?Xt~&#s-Qr*qBW6#uHP#VuBcD#XY4V2mG&
zW4g-Zo-d>h-_U&7jg;^EvT049F`dsh?uK&Ry5YZ|cF(!2$C4KPptdu7-%MHHuu$<8
z#=vKXHA|j9G@M>k8MUA9Q}Kzudbvrco;qL`d=hoZX$q@c17hNM!-4``)Xl3;qHk4~
z9jC9zjhx$OfX6Z@P_i2lx<-5cPS<;W1<u?Um$z<Yqvazx%Y9kVZo>e#-eNs#S02<V
zm5#0b7pIJE%Xfrd-Mx?%&EBWD<2KhK54uOZJoA+F=EzwiVk*m2nHj9=f@Tq^%1TU?
zv!`0zvg>Au;MS_{k_l=@m`pq}Fg1Bb_H<btKT_U~J|-&y-AL{%OaBuiM5V}Lx;Kk#
zX!fIq9xTRwk+~O;r4!}CC_E>Pf9{&wVy0?Zo__$lH^IQ=d^tuk(eS??;Cdt5#NKu{
zpI_7Q^0S?rY@v28!H=uZS*;rKR^C&ZoO(&I*?4KZ{ZhJ+?bGsjTpV77^0HhA2{7{5
zYYL%jKG~tFh+w3`@(ZE$7`@CDblMreIdU7hnkm<`nIha&5;e=3F)Y)aZGgJpmJ5UG
zPNx1COK@ODHg9zzeOSMgzGxjCfJ9a=ZxD(r)_WW1HGDTHP|gs^0<Zd+L46NqeSMUl
z7%I0lyR^6-wVDhNjL?$Ao`t*_+vMwk%XlVpTO3z#`#v^gy3Em(km!<S3?I9PO%MIR
zp|y7(AeaIl{jK{f0zBOTDDrfdakh8I`<oaVk%cIIhvdn`M0jhaN?0@}Ricxm6?AlG
z`eEeO<2MhZ8;#X*Ci+#Nd+`$%4#_3sRF2^qwsfCcp*bmui^;$`F{(@Kr<5k0I9QdN
zEY@E){}9(c7IFL4Z>T~r$_HDUgk?nw?7XO|CyG*3t-;*RD#28ev!kEN3Y!X@wV9lj
zstXdxQN>r>Bo3{9Sw8!7XLr}u6kkw;Qqb_YSNt%C?rW6Hqh_`r>|Uq2gx$pR57-y|
zAO3*eexO9S;+F_sGK6+yICm7uFL>c{B^fweCD65(d?~XgzBb+}oTLMjTv9)Hoq%r+
zIK*o7^?;QVe^^^d`<~upyLhfy@<nU3Lc2lfh%bcZ`Cizy`tJuG^TVXX$Ef?0RwIjt
z=MR?1KVBDnwhK46FaEy6=#1d#xbAjRUSwM=G!7u{5!bGA+@3dzNfSfNQ*@xtCd5$~
zA0{$aa4rwHzkXP4cG+JjwHRBf3s|N4wkn13{+=@*ylj3Bm7{`0K8)`0(xQ9c&Ng%r
zwlKtv*GzO=uH2kNG?P=io@E%#KIgR|;(_rhq%q8r3L$N$P6+v*wNfx=#xSV>Xe|ak
zS&G3rLm5{alSM51z>K$DIn>;DYSd8p9;Y)ily#nT!<(@%lW6-Lw3OU*f=C6)xFbi9
zD!QptmuwSOW3LMA94{Sp76prUBsv|DHz)oQs<6Z|(FK=M_@f+SLwL*w<(5LxQDz<h
z!#Q5l3cT+-z>q7cv$jnDP>pmc_l#F?|B_^x1uTmH_YYxc>d*dVNz`S$EE(Ogh(%2y
zckevo&E8W>4L{dca+pNGez|&o?&x{|Jj<6FyFqVX??>m}=#@y%5%p^~+E03r8{RDr
zuA7Y{zKbI$)or_Lrut4`xD!IhB!00R!LKL6-Cy9-QV)E;Q56ble0J?y)v<q@U&;6g
z33YvfE^xFjwYXIv&Oz;0-&e($7dmWnecL>f3?0|=lk{IG@1mit^<?)Kt9DEOU%;U!
zyNAyA6e^Ip5IGm?U{q|%4Q##J>ct0DxMT=~FmzI-BEN}ytmBS0TVA$-)?sRVC2ULc
zM7oHvx)3A0GP99&j3nw#?4BY)?X2&wW>hZZBU;uc;k2N%c6F6nN}{{7qWaCk`ZO6w
z$7ow(y0fiJ;+vNX>0$K;<gzbO3C;=mbg&$ATP#_ZCza?gPTKoAq~C#UegGO9il{RL
zTzuJigyv)QUYXwGaj{*DG_^Lb6EDlTLvi(0Ml`>YiZ+ME^JhQB-f#7+-(MdonC2$N
z#CPdCE^6{kK;`fOVXoI*%I<Vc8Ho%N-S5kozlu<*J>%)$W2@0rbnpRk4#W5B_hFw7
z35iDsRdXi<;W;_SLFlUr#Ec!)<t5C$s<sw}QFQ3e#FxZ*Fe5j@66VO;XZitTT~4|x
z&fXobXP9Sxzb$9?91mvgOIH4OeN)poVSP3&dLA(tbtXz3Wicr3$FmmdBe^!!5Uw~W
zQqw?5q$`X2(drP7qVxn`s2iJCXcYK=Xi^r`)pAHHjsCzTfh1<s=6s;+kfPe5WOC`}
zVYn(~gS9;S3h4pvPa1EszR80q9$$RHXc75Y%}V0@tslrr_5NUzNe(vIi@%XpT6DL>
zgr$O8m~(YuuLbF`{M?{EsB7Vqv+*hCDx3N88f*hjL=pwx<Cb!-u8&EezxD5C+bD&+
zdo6MYq!BayQEC0kq2R=N`}Le5b>Hy2A|PJtJMR4o3JP)n&Buv)U8j2?UsK$S_J5Q3
z-&M6Txsg2+CovZgRbq+~xqndDHL(9g8Ek`L>Ex#^%=wfhiHLoXHPt8#zH1u%1ZRx$
zOhaXkZTC}FCQ+j+7C)1kD1D}~mv9ep-FqYcIZ}L0JxMb2l*t3U$!Mp=Gm_o*=p35g
zw>ja@xvR7Z9~~*+*np}JX*3P^U|DQoyYXv-sT7jYxt58!@+QiE9GMR7ROWnT?Spei
z8fJgKu|dnOC)(BUd(X<p^aIRTl@Ybz$4YQ$dnHqpH9N@~ZF;zam#Z}@*H$`9S7J>N
zd0{Fp>$pgCDw_%^@sgFEv&Cc=daBQ3YH*2JikR#Uj;LsxIRE)_hT_{h1mEVT%z$e7
z-(ww%r@S;*4HSNuua89o-*U8HE&(#s8jFd{OWW_jC&!%OIoBH&e<*%_(sA*<WixZe
z1rIHeO~-TdbHf09QCSB2mjpKV)W%hSE|c=@r~BsUEk}48VXzop0Pf5GP0=n-Z<9IL
zj4Iw%fl)~K`_fm{d1~6)?meFy%wQQg3>$}ZWMh<AW#*LaJ39E&Y^#560+&h-k-u-)
zxIbM5LiJOuWM}+Dq_#*g<~s}OI?dPRZ1(X!LR97)>#;16W3{Z-IAdZ6w!W)}=e3*C
zW6W3n*G@NN0OF52lL*Lt9DW_0T8I$oy3*Rr!HlfUwWPmN^_G;KCr&CrlW&i5q>nvk
z&{qzvMIl^L4ahkyosazPfy{uo#PVyBnWFA6NxnBpjP{2Xd^8LhCOujMt}|IS${+IA
z1Z+4L)84L>KwNA$&z(V`QN6p_z@im`H3RckZa^Zp{8a6k{?%XB`O_fN8zp?`9gD4y
z#0LO_0myw4&j))Pf-)-RueH4m&m6eI^EJ*&>^gbcgzVRIJ6=u+Hylev?Be+-hu>R0
z1%i(4!JNC;LGy7eVaPy(Dq17FJp_3&$;>!Qx1<g%=I#o-?P2(!NZX@`!Guu#XXM|=
z6{@{1mlaiq?WuUC&pOSv9@Q;UgAd4oQNw{NkIgZ+@MgyA8-CDGs*wb_xm9<Yp}c8R
zctACIsRx!%uVCD6ygd%~O55)%ye57OB-@w4?FB{h3C~+w?K8Y>MYU9A1-J6%@I-IP
z<3a(;=)xVvOc}9k#?`8w2^E@k0{*BSik2*c#FBu3I{F&PPxaJ41{R2Wbd&281hdbh
zFtM>%O4fA(+1;L9=sovf8kJ$9jJk_QBZK_W<bltjy^4}yn!iI}O#Q;xA$|XD$Ew`|
zb|*$Zmo=Sb$#pKQRHsvzP<J<=+-kTPW8cNx%c#=SLB60pyLIcGRn()^_%$nxVXERS
zIgRb_0EAS%03~KOi0=p_c*}2CB!`Rsb-&h#z{YLs0Mwe%{P_tA7Jn@2Igm;50_R^K
znlQNs>TfJz21^}a6mVZJ*8Oz=R4-v(uf5>MG#4KO2LkUDQD!p!9Kya^lgvtoUTO>(
z^VJ>~iSbH;2e;&gpN_2+-lcdXhg&b3?*Nzq!2S}{5K1Lbnj9C<%-IZVv9Q~bna)V8
z#Gn&fA9JtM`!Rnt=WRhq?9dJIrE2D46I<{sDF)|}^8U=f8@j1p#Yj2S<o!OLM5>O^
zPN6x6@nQ?fGsqup<w1sh=fhCrvM_7&!JHMp)7+itFJk+Zi43qDf#4u^n71UoJdo%H
zu&2T!VjZeRhv&=lW)BEj>s3gDN|lGOUpM^G9N?VLGC)~Brh=pjNr^G#^B9fw2epdU
zTgO`zhMjAZ1T!*kH3v7qc{&h09jng7l@^6jYl)eGoc&S!tI(E-PC2;K(kT%6s8{lL
z`;rWs9A}HA=eV8b4s)9?UkF+|t9jO0P4Cp;7`R`QxiKAUd0(oEOxNACVuV3_GhKUC
zSHvi8bv8;c{0v%L+b)jpX$Ve4d?m3(t=h0+Q$mUg`|Zq+ffUAKd^x4YT=s4dxbI1t
zI+AcZT~^+RBSm1X5qh+9XJZY}cl*b^pXCqmFv~MGM{z!1n2zlv;mwe~<<hwd6p*hu
zRV-re<<|Y6Lo`J&ZL9j(E<4$$&y&T{i1Gl>K{J_dk;c#a1DbGj&NVld>|}I7P^6@s
zo4uxS7WvjjbR{f{pxRrHCZ!siXdmyFC%0LzKbS>?21c<_)7eGIquS0f!&%%0(;A|*
zerz@oYY=hPUo0*!QO<qIZI|ig)zlm}aql69yF_PIE|R1F?_O37lqIKCgVAbiHyCva
zobganb%R7Sld6F`f=L-!rHoRK-d{EW;4qLi$eU^c_{sO+sEZ~Vw(Qnf1RhQQm2hmg
zqH7O*lyphwewRQ8j`n)3S8wZcmOsDbCbES570{)4<NIx9ApRI2*A`As;Q@bDR8;Jd
zK}oI$llMn%P`wUcDR0)r2GDBdI-Q$9&Is@PO2SvDlI2imk4E4oA0}L8=>-KBDJ}Q)
z2p0GmDapY+=*4}X7XPZJ#YN&#w0JhE0ODgfBPvg}GV8GN%TXf0@E-Z(Wd-)lXp9vP
zqp6b+&)GG9pGEwqV&==8t}0O33~8}gHtT4d4o0^cVYx(Mx4gM1{rGGDeY_^~TaVHp
zWrwy5221e}WjoRA)$tg<w1HgEM2##TwDI}^U29SRd|IR9TluRLlWa_u@fepXpM5`z
zeL~_kCigBdyDn%y^s2VRa$C$4eEDC%>wH7tbe6&pZG9GPBVIG>9vm(34WUnY!+{MB
zy!Rkq;`F4AoaEjTY}L1b*{t1DMX`wF@ucKA(@3j3!B9-nCYTmA-5_!0qy;z;_P>w%
zg1s?ME&pK}X!W0o$8kMcYEq>5Yfxo=v~)(w<a;&SVB~|a3*X_|WcC*K?S^N>9P?y>
zJH|7FT`X6}chnE&${<2^cX>nN1SptE8o#0R#<a3{2eKKp$N~Jm7a&7kS7CNM2yFsY
z>W9l#G_*_2Ptp<^7W!U@F^f!xeI1KTU&)irLvew#kRe7f+FSUl19VJbA>Jya$a28$
z_fgd4>9H4`h&^iMx<hr<)5~7|UcGv;(s;Ap?k_%meVJav@d+52A$Ty6!fk;N+^xtt
z)_NOjhatjka$&_6<9r#B>soeU-Yl-(ptGp3;UeGv!Wfb0qtGQ3g-B}W2uH4zA>E$b
zwNG9<*<$XW`_ksms+DiU2wp&9(>hYbiUUR!9w|mVzRl$Mex^JtYGO@DnW8$N3~St$
zUH$$l?=2J32f@w%lbgqs)qSRjQHT3IX2|c%)78Ml4*H->;U<q+HI$dgbdg&A`A=DD
zD3GwvmFdk@7)^jyTijN60D{SOvDs?+x7kP%3clLifx30;@(;2)Hq4j5ZS%Z_P2Cm(
zZ@RTLI9<wXGpCexJrX01(0>S*BFS|rNd(r{dZAJRad$;IQ(;u`oram!1_0uJ>+Mzn
z+GVcnQH}Y;?RiN>d|DETYIaZHo7Y~O6^q;i0$D|~abU#C*&ut-F`=q|Wu~Cc=ac*`
zMi)_2f+xD&wa#*I#?iRXO(m7{Gq+sUIGQFHyJf@{&BXEVzxQVCxl%@(3@VE5?*}Ei
z6VmtB2b_V0>o)n0Zkq9g7y}2Fxp5YC`{QRBC@U-rTi(t!gzD&g*kw3c+KT2mx_W#T
z^83*n`d7IAFXILe#edUzpGxp4h@GyXM9*ew{yk5eN(O0<rhTpji#5XYiAU1GY6z3!
zL*+%5i@_x=r5^KqSWD0XDzZ@t^(H|=*E#&b>-IsBS5PebWUp`O5rlJr>dACfE!WN{
z8k$~*q0R0b<xv!!y&sKw-Xs40EehSp{WW6RHPkEj-Xm|xlh8D0|J-iJzz`p!^_Bsz
zom9~t7RFew;8bFQauJL(O+s-kvg($F9}N#ri{=xENU$V`hD@R2H2_gX*Syf~b5HQy
zbzz^^X6n!D98+TZG9$NV`gba!^JIEvrWK!-6Se}~S)X3x@un(YEQk<V@hHzu#LZSP
zSRRMt5`@7>gS~>Emp?|D4_7^Q<-`yljy8B7lN+kZOk$XCpZsyGp25IZh5vi*QM-X8
z<DC4!I6>*JBO!vnPqlH5i@$o!K5~7AW<*>`*`_GFlrdF@d0<jtWYwKZ;HGp$g_h7A
zGE4+KZxJwQbDwYVC0gYDcMP)tY5mHB?dVb((A*<G5-cMs2Cr`ELr+1!e{hLx*9Hbv
zShYjb5q@bir_52e?xc_N@C0DM>d>}){piqdMzv?ETFym`6lQ{V{VNL`&{84$Jm6!?
z(hxt0#9Qgp+5?-fO9}_3M@=k-s4n<6*4W%oJLf!_Vt|;ZEQzev<PPY>uQX##vtL9s
zvuoekHt^<4DUbZ*;0%PQ>gs02p|?=vY5<OnARghRtkOS#6VnZ4e#w;Bms_HnK(o|f
zrF5qJlRUp2$VO#q5y)!E_x9oSq};Vk1*GdvStiO#?E5zHfyei5T-n^84QP~qZEqT(
z``<Q~KbFj8It6D(lFA@Q2=d4MT!|XjR3znq^?4N|OWQo*I7ArYn=qA0^qRsr6F}oz
zHpX|aluNc?=Yr|{@t6i!J_#14w(X%1hYB$En=EGb>XZ`dzTG`wT=YXx<Wz>OwZ<|@
zBA7C#hcPR~)0S`I_!*W-0z~+&r8qpXhM23k>FGH17p}jn3U=RnRy0+rc0bQoysBeQ
zbet#mM*}cFrssz1wiam2WJNTSc2BdI5IepwNPtL$^TKjG=+<YbjMV>_e%t4kdlZ%9
z*6wbi=Z;<Uz4kG&0qgp0p7_$)VwY@n9OmN`Zpwy@k7#3cufV-R@>`75H!2^s8uOlF
zMSc)T(D??7Der{&9jN{1#icjbLyrIP;a-=pFGXtYtJ)RcR~lA5ulz42>U4U<Q4jZv
zFs?TTFI6eO^70Lj;#qwV#7uRus^zzHj?Fet{+lgGmsONn+SinuZsdX3QhGdnzN`^y
z%U4>_jp1bK^zHNbUMTUbN|Qi<=FVl637X>O<$wbj%^|5LSN**-<j*!9Ipj_#oZu4g
z%7fhgDUz^D*i)`WV49ooB_Gpd`#L4H&SO${L7QJPxmll6I4Os+Ea`;`1K3JbWlKxZ
z6+PPR-=XEHj&&3Ulrt4((u)aWO%TbZk9^X-!mG>7PSA8D*9gxtt-p!<O1wLz=K9WT
z6Um}kE}E@ADI$Nnx0RD!VF}1lJ*;7Jsh{{fi-Kcc;`)d7FKI?xT(oJ}Zx?F<d?*`4
zuN`2cuWcH4n$w^jaKy}IG>hh1$>vMzYbmOuf^TceXb77l_No5a5}$8EK%S?KGe_!q
zz&}rV$8B(-by>eNu>??MIfuc8lwhh>UyiUa*H%TU2v_P{(jqC>lF8DA4h5Cj^$<?~
zIdE?BMlLy6z@RS3k?zpu@on9+q7~H%j1YspuPK5b7+iwg-?XgQ?(1)%=i9#Q4jKB-
zJ<4D|)rs`w!$rH=pA&6036Wb|3;)Hs>V@hdbB<yOvIKEqRRVDF2uTyhHPLHaF85(J
zvBQ(PFHAqsQ&M(nnM%W1PL%#-SsAl)tohN+xMp2F(Wsd52fJ(yWti0#k*AZxPW~%x
zWn8Ev!AZv&DZY`my-DNKE!o&wcUcy(?(QubA1|X3DQR()Z?ftlTjhroj%Cq`TecUf
z)>;<0ql6l@tgG84k%oNOqq-d(eo^?@nMAR!uV~8ZW6c7}YlU4b&|BzuKe+@$adFmo
zL(my17FeE%N>z;$#b}FtefF-D>^9Kdl#=mvAaI*WW8I~@d;8loZjO6Be*8Foio(D1
zjlTe3PJyl*HPhGUx}C|6_V2jv>exoV&{ZBhHZ`Hl!_~JrwpRcI6)T$sLkgG&cxMJ+
zLo6cm2h{^Sm%5<e)cq2R1mQ1hL){E8qPq=JH_D<cEghmxP%|>T+?P0svmekCUHr&&
zzM~<Nv5qoA9_*X%EMd44+IcV*UEyGQfmBE01hecHUo1iy3+sX;Gw25yAr^ktGf<l&
zBfB#vE$6w)Giu;(9j&JO(0#_TbEDP>wde5if_@3560=4r8~;)N@1e{BipsCg&n6);
zG(f@;cPB~2_24NPG7)%M8ak2Qnl?lR6!k!H$*Na@FUMqqJgnaz;HkP&T8L)HVqyWL
zD|3>i&ErRq*b|k6A>d1_<`}(TSrwG<2+cBSdsfRqQ`+|3Lsl>8sgR}e>7rm(icspb
z(-Cf}4`ccwlZGB{qk426P5HA4&hjP6LsEav?#1?q?Onx-k|)hVQr;Q<5Q&XvPXR_p
z7Hv!?Ylu)aC_A@;vzL+XNVn4>Bvz1d;t$o|mu8!4iRGTb?yquLA63gRCT5JtU7Quo
zQL8<rmmtD2Rw!U3gb1vsHHx<bSd&qRrpEQC`IRf+opdwI?@ns0^^pC^Cg<d|(YBkw
zKYEJ!cm6O7DE}vGwRR3Z8&xmmJSjtk)Frk=?rg=N`Br&hlQJ$^PQRD9{z3a|y<y~n
zaoH2}%wMlhlEbxK7zA0bYwd45981M(&!|Zb2n07^?*P%kGR}dJRQz1V8{oD6{-pE7
zPH_XDI=GE8E?(c9KaG|87a10&I>4)q;w`{KA~BV6ZDZvqhV6pb&+*3G^e7lEK2W2g
zIaDuj?_d*5qVL)|x&ZQp_n=_J`;`dZlQL$2pY~&lmkSVwn?e1{Gl^Dfa408YCwzP^
zKFtJsO5W0b)VjjcoFFni!hiuZ&^y6*{uYBrw02l)X{NH;|BaLR>p4bT;t$Q9k~obP
zgR*a?ElVBWL0AeIqXqXxrO4->GeG|6D_d&m;o52dTvFAJ7=6~y3d=uMDzz_eDY8qr
zu}V`c2E~G+eb_L!0MgUd)8Z-o$)rG%Y@<6)%NAXKJ-ej}Zx;G^?dtLWdFS(y+MzPN
zy2#A{o4In)s*_JZ867m$B2B~)_wHNOSCtuqFlAlBAj^~TKo^}dW{s1GX+e4k;*}cm
z9mj=K(&zWRH+zG^A4Ps=A1H_Z4_SX173KH-fx-hKAuR~fAR;KGgh-BnfTA*_bV+x2
z3J6GxG{R5<(wzb#(lJBBkdi|T-FY_O-~V}Dob%4bl3Cn)_PzIYed-FGWBVHEE^?L`
zNj{#bEb_I$j@Fy%DfekmuDL|L3%h4fW$<}OicLHIbU(pn?TZfoOp2Ez|Lu`CfDByh
z#g+4usChfC7e{>8qP3Jg!UAbApPtG25I^i_MNLKz)>ZX9w;-L&;@neel>MNJY#AkG
zmqyz!PH`h@P+a+BFUMA+LRowg^b;I_@mf8<7jDT+F#WnsuX&5EJSwB9kLon&gg^vz
zTmG_j1)tFwwtOLq4Bh0GgboMIyk}Wlo)VdFMBjx=WNMg&KDfU@B<Ut=ewTAuQ?QGl
z67G?GNOZ~nN77Z-JdI_{e*jwo)x?kQqVN-XAYxb|?2MH`bW?u?-Ofw%bR3E1(yh73
zO|`q;D?I5XA$ag)A>u#0kl3@|@y~=<goVT{BijDH3&LaX2N=6B#7>Y`$3<Q}KJ5f0
z1Biwc5F0n9VIG?$il4jvL_ClZf_z6kNu;M2CWz22Pe>OH+y1gF{B)@AyS?t4MI9-3
zt?a}p|18add%emhG7vj60u%xxIdt*1CxyjQqNl7wI6d%r5y_)C@dEDIXZNaGu+;}I
zcq9V>VBl+Rluc<fmUHRdCNp!ePa#*xAY6D{;Uni88)F!>UmDKOQQSe3c*JOWx&OM=
zUKZl{{P7q%i>!Amr|`+ybZi>AhF532_`eRi{aH69+2+zuqWfa(cvpno(7=oDOeaZh
zig~w-BY=67Ab=U4(-$th(Pqd5<eePOVCNA^(21KOJ*b7OW`ipvvpC39aJu=8ukIe-
zN_Ne0UHM*C)F!#lEhlvRr&55@fd|JtxKr?@xj2ivkI_m@jx<1)O1S?f=WJV?IDOm-
zdihd3bCW{0i2YSPR&Rq(?eH>p$u_ZUG53gjAkUDbaQyx9?5r=d<Q+==0qu6%`P?XT
zjpU@(0KOJ#e!a`k+b#z^TH>D|%j*@cm-Oi-f_wQ?s6qTy)Pai)kko+ep?_S80{JOF
zhB94(HG0QQ#JG*iloP@c_=zT63xce<4yIf8#iiG{6ibXV2N{P||2tP+WlLUq$}xJl
z2jU)XjFhO<+NPnZEwO(Wj9PsF#JJ_?IuJ7WT=v&xZLv!F^HJC8DKfQp8_0X2+vh!{
z9)H7MZ(bo8Dnm*2rnRn=LOA#-*NII2L`eo+8tJISl~fw1m<4Akh-5Oz_sCw1yh?3;
zCEWM;BKND1zg*)_-I2}u431uGlejR<KlY~4l2N%r5os0Cp*JE1J$E?%t0?fZj2AN2
zX#-7<10DKJU(*)rN3)DO`oN@<f_k;Ob1xdjZ-cVF+HlrlQ_cRB&lngj@4G^bYiYm}
z!?*9Mv3zel_|hPXE4~c{+f5?;D|n2%IApF3`5k3p{rA-N?(q5u9WmFw;w{&|UyrDF
zt=g(Y463Hk{`^w2AO2+jv8~Eyg|2s%)5+|nKXynH%tc?C?g(m=jwiG{b8Zp;<!gB+
zOK@{YNRqMLUrzC|_WbN;J|qk49xqpW0PEiR*tBjMDl*MZG<Y==ol?)2YV)>ILwd{d
zBy4s}6&}MK=;FU<IFxeO=|^8artx&>nVQd^C1Lk75;h~wl}w2BLyqJ;&#pyb)iH)U
zsFzaNGxCLIG-E?Ft7!~jAh;!vq{39!K>dz4!xXE-cR})jzmWX@N=N3<yAjGH%buv+
zTvG@K`A#*9Y$5x|D?eGZRed@Vp1NL8tbtK1g8OPcv0Bk5h>F}M0tbIG?>{SvP8pE|
z*q*1@48PcKH?JgIRpMnU3H{?~QV2v<I<%UMrNmPzR~KUEyZyAEY9XZ<dbE6qV7=Y)
z*^ii14k_h)FY@S9DML(kwl+=lS?0V~YSxiBOu{o6_wqFrjJYW)jasb0CD_r1W$bKl
zK#)VL7M5I?JB*INFA&CgX%>>j@(#~5kOzT#O7mAX#U8hOUukfb7OB}bKzY!ooO&ir
ziACRF5(mm-=Fr&aB?S$x`;_fp(mO6+=Y&W_AcO~9gb#S?AVO^)6T7y8)>YBEQ8>rZ
z4(~s7Dv9U5yM-WPJr*FC<MiMhLo43uMW($X&0KDMeKan(4uK;n+wh`_SY>=WG_4bT
z$gLQv5dSM{@w5K671U4M^GU<qq6zzwp5?I|Zztx^87MPP_irHB;0Qm(D^N@XwHg(W
zW#WV{vr>6mjpx(-<W79^nmd-xfA2eq>6EC!k;DGgWDIhHLv(}>YmrI}(Gw(x-cpGh
z6I=GD0uxU7$*#BiD<so|%#r2kto`3e?G-CoWgT3%=307!N$8r)U4}xJQM>A!<020*
zPr0M?Bm=jJ@6aN<)WN5Y_^beP2l*ts@uJQc#D9SGw~}xw_5eN%Pa>7lYLnvZSiP5A
zU{FoaeBe>j5o=>&sz)%%JU$Bl;^jYn!X(#M{R7O31CN+PZaNR<&>^Yc)rTBZfp%E_
z(0?B{TGL}a4lUtHHTkw->ogUj&{hP|r{ypnZL{1lijO-r6SX5gD2E4(aw_an(RKk>
zEL%Y)wOK_P*`G5r%tN-tPh;f7tR;0xpby=v7Vk~MGj`XR5sFTaw8m-9TAnVsQXXP1
z6w6j~8@TqPO@f=FR>^kx6X~VEnH<0@Ptb9fV=L_B3uGv2WPm>Q^<hxS<_`$O^4J+D
zW@5}Z&VzohCiW5R!u9eCW5YCH=<^^RoDqti>dyvBur9$P0tcH+G;#14750fO%NUQp
z&Q1G}-}82d;C+f5&!uFiJr4J(uQK5j9xg(WQI<;trG~wSJ6J|GC0PC0{b8V30cM@3
zl{{NZ8xUGWgA@38t^8bJBGT%4pDSetGc3nPwgQgIx(39Ki6rxdDc4C`i!LkG4oD{_
zmmuQ*w^fHei|o5T;Np<8(4wvxz&ZQU)H-h)><oPjnzY`*^A@eo_coFulPT-)ZjpTP
zaQMbkv6z};mx#=zyv2#$k=xV~(^VL7>%<ebY|KyQ4dLTZl&xN3qQ(3AhMh&W$jewC
zY4@1I;`#;?dX-`^xPZJx`hwZHoI%u80f5!C;I;9ah<E8MOdql+Md4Z4t>>68dJ@%B
z?W3{x3S(%}dl_y?Rvs=2)pWbaW5ow$k{?3XQ+!t0U!RjiXZNN45Y_EJZ!NhlXNXi5
zTiLP4oG=>bh}8Hx%Q3ZJ4ZD5wp2)*iF8R%ZpWb=9B;!(sz9mdK@76%T$p9rrbFmSr
zWg{$wT^)0ccJ2zTxUXBo%Dv0axw9T&!Stw1_rJ?GG-9Q@ld1kFrBI4m8xU)iD>g$&
zrmUQdrVl(<$ed~_$cd0q`C-Px-$P4^GXzR+B@FL^QWaBXJ^7SVroM26vqyh?sse0I
zlZ8_5zZ-IM%EGx(M&&Ah)U)aJzbih`mk`!);Y=<(u6p|FZ=Xt&GdaSr67759219eb
zeqCtBHr7M4J`+Np;nFxQ6(V=K9-G(1IA3`0fA=KWtDk>0j+We2*dYR^)Kx7nqK^Rk
zfgOFd**|`zLI%{sQZ_7q)nOc#)WW2(D~GSIrd0=jG4cXV$Orc^g0V@nCM$4*V01Og
z(>6&17FwM+){VOTa_%<$m997D{L@w9suq(ZwNi6Ww3z5s#q(`CJYx*{LwB}s=!ryL
zzR&fyXv<tl=%4!MX~yM;=V>l~^T%l94};S4^31`h`C;R@s3`3<xcK=yhtA(GG`3>V
z{t@6n@$6Od{kn>|`+si|oB3IEcDU&}Pl|7&xmL+}KHS3HZTO4k9duR<Wmn4TYu_bA
zICTZ<nAsc!WS(EDh~fG5;$W**Q}(;aFv8YqI;ug6i_yvF8_@f#@VV@1$m)dU6|)KT
zM^&eL-~ZvsK2!Nfn*_`Mf-3#XC*<812{5J0f1w`==w#(b%!)Z$ZVQi_%&Cr$QMqW=
zQtQg#y^32U+<qG)5G2#s6j7>@k0M6yRg=oqk!0E6y>~9dmC;@eI<bs;Cc;zqKfDu1
z$+C6dUB4663NLj+#4HniN?9g|t!#b3T%3z*it!&~Uz*KWrwB`DDZ7Z2dw!0iSkXG~
z@i5hDq5g43a$!b2tjnq?V0F6O=+-+z;mU0DC5n`a+cvrX_R@OyJRa}6QDVTY)}G?S
zE8Ma`TSpa~SxSE(&En%c`0RkSQ0xFNtXEc0>!(0${Yr8{k#3BS)cB~ycNRK<9eO&q
zZ!&l;`bR{c%(kbw%}}Ejkl{mYZ$ZhrW@by*Tn>~{m7`3c{u&u4o!}KqRK^$EvW{fE
zvZHLHu_b`zDizfM_{+_9%3xprc&n4r#f%_;gE6$yLs8&A>64K4iHW!Kc2;67WQd~{
z>y2o|QRO2!Bo72p@sW1oK>L8G+|;Raf^i-(I)5DdMj~^GX2JU|a(vIMB%_5e3X$X!
zX*RUbH+4*;n|`Z(<v1&0<&wlwPPjg>g0MtWg0#X6Z6c^~zQ&s*(3A0ti_q%X`JWwJ
z>PtoYV)~p*S3Bbh!&R#>9#UR)q_+mT3cit2HBYgi#9ec)+m^CCi$)ft8*<gE{*u%b
zEr50HKO;j8st6rwiK~cVo}iq$+wAqL3P&&cu$O2oQM;EDn?kW;P|B$v{JP)7J5c`v
z;qkNLSaY#sVdw%{q^kZRMaAgr$<UIT7&+@D2r4c|Y0DVUT}}`E?rxz4wxOvG4~Tci
zD8eveAvi`hnIa)ntCRjK3$uf<RSOhnbL|L<AkRN9tO$)75!=w7aPQ(J1%R{;wB}Gf
zCvr(yZ4oKnBn>p<Amx2pI)u;~b=Ef@AE8<xkE%2ui;``;3Zh``nIf+KJTHp4(Ah`e
zFVlW<cf}c}2_B{I&^HUMR@T0+=Z9b58i~oEmz{)0RR0e%0p|qXY0!%Yax%L_?fF*6
zP7y&H1of_(aq9#Qgk4b~g@YU^;0L0a#oRbXI7?Jn_#K{qGEh=aAM$cp0>ad}k6eI!
z^@!sR4N2HX*M}Cr$<KqN2s26_TB%br7*PhZqF{S5cfOqXs*5@6#2xe=_lJT1AunJ$
zvrs=T`vt4|bC#dEnpx<j^vtZ;I2XiXmPfWTpL>JIL3AG9vOiNXJpX%Yu&exk{Z0Tg
zL|GZuMSrim^{MPUEu{+h)BOwb>=oK8S@G)WE5>AX#aZ$vGwRb7liUiFjtJWS`&;Kx
zPIfQ9@oSG$-BIe|{3x2ZET-&vuRL9GhoCj*^CqFYQxRvFYtooWU<ym9Ebq?0+tv?5
zX(#aAB2s*;e2(aT4v<~gu2&&V<c6X$WDtt_+M$B}E@>=B1g-YZce5Xi(LBLKDQJ(;
zEVv?d3>}tTGgrvu6cHc(e+2=4^uajAos?pYKAV#wCJWw>FD>bcdqfONTKK@Y)VnMo
z!BWCax%n*DW}QF{{<IY(B{vu=#Bma&$H!(4?H&S{=-h1+Iju;34oN}}YIm<brs%K)
zN3rz7+eDHHZyK(4K4$9<eRO?dfu|$jY;8qYek3lv<79z9GDP#YI=q^a*d_SSJuK-o
zmgeImjHXIjX3Ywcc!WwY<V-}m=pJ|=v-_D>PjmloR|o9u+EK(+^WZ@s#(f6drMM=n
zBzpiKA<yZ0&b9`snF+P|WIFV|P(omRNj{cGu*h|*j&_%`y?7>TUm!qbkYd`%-vTMa
z*^@0gu&zq{L3U@g{$WnZMhLnwL+5qj`+5rbp7wX|D2zJ4n>m<ItW{Uoc}F_F6&PXW
z*c;u?H0pBvDs*4f4Brst`~bU<duh_kJT23m`z6@N0%!ztiR7T6oXi2Kkx{(G?wwGI
zjQ{T=yv%qEjhdz#8Kp=O2=|T3+$UJZKf{l8)dc%BDfJWovq^T<EY4Sjo>ERWEc51d
zwZx-Tdz!p(wp%@34iZI=ct0KEbm+qHIoSUxX#;2qaqW?d!x4xb7q?G!%IWdUwa<Zv
z`tB&0u#{pxy0>#D(h|3DpU4NQILIZXAz-%X@96R!5z@IdPNTK`Jdr8h0P(bFMRDZc
zVF*V+R+Cf0|6OqSUq;3$p3E{c_fvcdJq(gRIO94Gnm>dK+gYxxbb_S@Xd7SxI8X?!
zrpfxB0Id<L#btSvm#%n7psTyWq@f+^#Nuo6X;szHv|Z4i*xO+{iIux58@*m3Y4<P?
z>aX)0<-<+HJH3@Lx?x3#bsBW$DOL1dQvgxhWSde&#&A%*RK!@P;G33dAAG0!b6uKD
zB+Ps$N}<qAC1ji_3qK6E;D23h05Wg|ZBf9ElS5oj44=s+C`)YXIt=34f1`JUb%%;e
zLv(FeAbUio>Nvc-?IK&AQkgZ#DQLzB#e%RnfE7qGIcE*=qt?MZ$N93wUOt+ldvHat
z?YUKXTVlUU&!f(By{)l_q#B`{8nX-0iAk>Q|Ik*6R)+57uKMTMTHRVEaK&As@)Zw0
z(aInZX#+EyAd6Q1zh=pgYLBxs2awO)gQL6!vC;%LiA>HF+)V#vXEi1mBEc>PtFE9Z
zD&o`&`T9)2aw6jc&~O*3Pt{wEH@IwkDAlV3x|FOf)fGo{W<Q{VTdYrk^B^tps@UwL
zRo-}2^{4V_Odx3qV4{KMWUNTD5~#IQ56Vtr|AjPn?H(i2o4kZ<rmGwlJAU*gP`l*4
zz@tZ2>CK2N_bl`1RT$sU(zBk8H8z&xCDk@lHT^)HF<a$v8WwM{1%Xsqj%F!fL?C50
z+N}uy!l|L6d?OS_aV4e~5%r>U`84nsb1&19Yw;8nt>A{)u#rS|by()c(z7UE*-gKZ
z;`=R$3!$fj2!qRQp6!q&KWgapSBb)!!a`*A`A-VE@4ipC%oin)axO`<!CZ`%4Ws4=
z{D1G11f!Iuz6oaq$fdlI3ss7ik0Vb-zjkHld`v*_FKD~Dr@Q>@0YdD2Vb!QP)QF<A
zX-}#*q2DHf{$e%;=+nw|FmG<1yRCVvR+{25InRH3pCa&qdZM9vz6H!(<<b!FI)dwa
zANB(pj4pFH!m6ZsFJc&0uDKTw&ZA#tUfv(u$uI@xA#Igu?sey-pD*;5E^Z8c7k0XK
z>nB!T6nC5PU4MLwRJ<yAuEJ?`px*D=2`CB`QUuy_-|l`*54<f?<wPQ0HCYTsNdNuE
zus-rrxBR2bMK(|l`H0$Hbi%#Q*396AO!Oj4Gr`1kK}W7V(a<>`#I4NmH}nqfoq2Fi
z%G!|<-Ko7wgxKlC5yRBzk?$>qnTBd+Wg$KcQkoW~MkjSl3h7HbM=U*tDqI-uC6()U
zlz+hywlKK9x;(2AE~-AW@&?}_AvG8M=^DCrmht-mCLMWRw-~)Kn)7Dy>~LeWP`eh;
z$LoARr6ai2NWd!R^Bl;Ra@-&g+=J~YOcD=+Xicd~qwC@N=-%F5RXDe1h4awT<3;v&
z7sg9wKhd(g9gV*bj}{9++;KJ!ey-~Z@khAg5m7vc9ocD6IeGyIbm=i01g%c@h@L&v
zSI(ZN2t$p^wCUPEgU8I6gbDcH)eVGkfTD3dYn!4VoyERCyMvu_Dj60!BV~9GsLojv
z89g!US(~ce(keSd#lb0*^?0F1Wo8_*n-mSN1IM!>V__U#!45K`P$D1;7hw)&x>uj(
z;qNbC=N5^{azzSro(H{12nw<X(uq!{@m|yJVFhvFsGu_N;DH0e{Os)P&TqzDcpH{_
zknIg_(3OPLl8vELwBvHmZC=fv%D(5WHdD1$US}5U&<mswh#p}$oLohSUk{xf(ph_v
zB7s!DP1Lnav%>pSr`KgHUuniM4J907l6ZvS{CmCWb5V{E-+win`#z_=Cy{p!=tL~l
z3Q-5_Pb?%fVvf>=SIWj}XFL~wV_jBMR#p=(t*nsHBkkt>eSrwi^W>WG+Whb9i{Un{
zS`l={EorYt&%+d?iRu%z0%PGmRp1L%ozlyV!0<Ljh#$mss0c#NFK<D(wdhe<?V0L&
z4r@ST(h+gF4nWxV-(Nf)T3J|}&=ZGyE|7bFd6fmAO5*i#(Ul|~(rLHj&}cb{>p#6;
z&Xe&Noaawh)0{di@&s(BIh_B2HK?+hS~=3TOMzaukOmWZolR2To%W2-wrv2FUDWnO
zW?KIsmVZYiU7Fu)#y*1XV2rNx;;BVXC8FttM-S}H+M6$}yQZdG(7_js>DwVbQiQiU
zW@RLsAJlLkqW;ju32H;fyIpk4cxfFjTX`a7jauT0HSKjDh&)~CQhrj@R25b4twA>f
z9fk?gLNuNaRKeLQxYu2<B@DSXj`&1!1hd7Td%hR(uF|%uChg!SkLH<%=R`H2S%-5z
zlhcWLvPN0%oAVL~1_3P+O*0wLE3Hq?K>ap_597XBS4cvVu6iTpy<$)`!kdkDEhlH;
z2w?9tJawZTu5-vvwXHka7H)y=?OZBBwWsURfA%Hl4!@@C<V1aRE?bxtE^RscQw8^X
zvApyt*P6`fH`aT+mi-PP{iqVv$Ix^=DyFc(Oy0ZT!>upsco(Oj_c%X@t#0x+)1I&O
z&E+0#czq1>yuVn$$xC;+CWkf2oU2t`aN|#nd$V}sOWfjiUGp9}anQd4Q^K_Enp+>y
z{iO%u8d9k9Tt)l-R{h3No#_0FfqRMid)srBjK1jR0XerYqk{xa^%B52`ko&q?JhQN
zPOS#jc`5JNpI-X_qH&Db9BI`ZAvw!D%xqyigfmL<AT7mHYE$e*RE~pqX2xwh#YKvM
zjC$#=>ckKu8zpVDSMZfLtr%2sB-RX_1WGu8J%Xl9DdhA5dDS+}f~V9LRoDQ_6hnn+
zXiD_(ONM!cwUAsiO$B*W^@de97|@6Jv3Q^0z19JdOg{pjklQ`j-#I4HJfDBWLOLyT
zXyB->WQEMCdFmlXYoqHhgpHMjzS?2&Q7Rj-+zb_(Mdxp9kB=Wkf3&w0L2vT6FkP!9
z4#>%1{9m<)-Lq@nZRmzZ6sp(S1{6Nw`3?@cL_POMQN|LsVS}w<cB{ZC?efP>U)TPs
zUP)-YSbN;A`Rtcgb=*mL^2=u;2QpID*Ul0RDghf7W1BHBS??E{ZLQ$tcq`xeu;gm)
z9zx=>u0NjSU9py6XT;S~STFAvqi||H`>jMH=zDtv81s6$)o6R}HLx90ZF}#qGH^h`
zX>5Bq-S4Pdmdec`1RN;}tWd_Y0qs(mnUEil=gV@nMC&VOka<y=EGmgRvtXXdu)!q$
z*crZgC9ud~{rVNUtdx#>Bi4b!j822|>$TZlJZattsAiHJ>eE!NwwJTA9(ZEW_G>KF
zDf_fM<C8_Yx+qCQDPni^SR?$Hj4$zv31vYC4gL_1`zg_DH<=2V`sZfyXZUCL=?KNb
zzhxDgn?O%#SHBh1=rkqH1xSpm3A)Ki4x)9CR*F@g3)sCFBkrjCy4n~o|INNX<J1Rc
z^mK)$#9<_})ma_tvh>bo)u;0EZ(idAsvfhUe0H?PV6hzkWEtGMRsFG|Zd>#s)<H*d
z!otG9k$5p>*QC|#efnCPbbcp_!S`zI{1uNWHMIzX$4Lm&uWvPP-t3BK>|(x~_LH0f
zPjq&)2w!t#4LEe#j_1B?S0=yP6**XAzjwa6^bPkyVEMephUD$o9ixNI$;(|irm*eG
z<(_!2t4Vg4xQRhd^smDe&YP-WvchC>D*x5DN0IE_$ID;@vGMiSy!4Zn8!60uAgR1O
zp7((8c|>W;Ns)YfPq(g3Io|snP{=LPU}v;TUgb0CvPkdjlL5-HC7n!agFv$9Z-BSd
zd!l-M)yRN1E7)V8UX>}F&4AxJuUyg~4E>6z9Gsqs^AZL6XL8^Ykb4j8ZvnrnZ+*1M
zY*WW-;P4aY?U2P9n3Kv%p*fSL0+n7uA>Qxg;#Pju3+XN59>9Q_KMu%fjrnn_=by&_
z(=*&rng#qYlF$q^hul|>;NLF(W*W-$Qji-pJ$Is5je7KJD+zG!)YpGl7BTAZRa4CH
z(2xQ5&7=1hM_Gi3@G4z8%khH4_9Ug+S#Rl~@$X7vmm@~Gcq|XoKDw1HOb7#`+Udu>
zd>p%G%wRT{P^SN_i<U3)qZ@ko-TDy>Z1|QdN9XB8c2%G*T#GrLt>L8_-CNj4Xq;I`
z(mqdm@o&QkA<X%;|EFq^hC|o+_KjonIibG8DciUXgI+Tu6DWHauQ7?Ir)(FpyXe>a
zE|BXIF~6*mvmo0tDjo7o8tm7acQ|O-usyl!Xv8W+CtvOmNDfxOLbDdzGrp7k#i#9e
zgOsJMh7QJ8uM@8egk_jhefDy=haf}j38rUK8;PR!2|Uu7M0-dY9{3B|K06J%a>3Jm
ze$#QpnhI-gda*=i7djIXs|butm=9J5vRWCKeKHy;$zjN4gFl_-R}~PgWL6{`l+=HF
zL@L>HJ<8AdIxwp>UvQl3uN6&HT?EtV79}sWxtO$MVoZ>Ihh2-dgx)o9?^}-+e7;OM
zKi)8^UkZ_iD%17Ga~>}zDPd4G<#Qh&IyyQsdhX0#>$-S^jlmxvd9&x+r-3vSXl!}f
zfkrbXFn&F4A1vj=<ws48+YQ{0-EvK^X&lk~398%hCu&ck&y4HV2!0s&DEn`$tgJ-Q
zKNHy1PAOC?Jlhhr3*z}uqElZEkA63k?y>X93s~h}?(o@6(H~t@!gBL(J=3bOzS<m)
z{^3l~ez%qGZ;Bv3?SU4b0TJluFr^xY1Wn1J&#m1X6Kfw<r$5bYdKYbR<W0Cj9H0Y3
z@4bul3QU*Prxt@EWdNjZWl7lY_V-IV%aHX^5rB2-8^c$RI~wscv2S;=FJUajSri%{
zf;(l7U3IGvr>I?r@L~U+8YH2&+|}>J9zB8_MJzpLB27iC@2Z8b)u+maF|URbXqyl6
zQwl;=xT@x9u!lCq7O0;nYnkD9u^XFJ0Z^m%mgTsmkOo+CGKg#xtxY}fv0ic|7Aa;*
zAsA<@6LfyLcb^c<6=I?<=K?L<NqTM_&zS7zbS`xLpw>^SvANe6c&~Fn*bX`QbxWF%
znU{CFojU!oK8uALDHTim7BVkcVDn~`Ng4J^)>t^q&+djUPP<<U_NQu#%RGt$S7^gp
zuvK89$H7-T65*x!9BYNQA3lJ>rs@8L4t?)<*u$>+z=4_;F|Cvx%&pGxF1jWD*AQ^a
zaeK$jsNqkr<7jTMzD_+<fmCURR;H8vl4xvRWwxM>^OQ<I{{$2z{IZjDI63XEzNL@v
zTM=q@6pkC@v;Wlsx2o7QK|VW997|n6M>6gZ&+B8M05HtmL=6_|N`t7d$C)L$qNd0e
zk(H|Qxb6-l)gA?z8ik48Qp<b(DWu`)nQmJg=`5mwC+SL4@!vE?UWmk+nd_Q$73fV0
zbGioypGiAE3bw)@`6pMq^e~8th^E2s+BcOgTD&H2Sp>#7F}LSCNDhxsrfYQBpq*<Y
z$clx-uU9sB^9-fC|2TS%7np?a4~UDl`|Ngo4~%a}8?LhWmIs$#F}a%UWCF@u`E>kP
z1-@0J*(2Z`Z(Q%`9V*K_!k{EhPgqe*lOjP7YF%gFArYLX96Pc|+nEME5Ww+f`g_8~
z#YJ?8pFzQbXu&YKk3z(U`%FT|b6)D6&sF<gQg{QG^|L;9%51pO!}9c}RJv4c8w6Mu
z(5aELAU)TRY*ukMN-LzyQ`wicnLB-SD&mHUHZ1o|+qj+_ud)3|CnHLRMnfFm8i;3Z
zlnzASbQe3WF)dGaOlMw`XQg1RXU&iuWOG(=&=gVLzE<45+kVr&NLsWC*FW>3ZjRZc
z(UNP^?UXzW@gI1v_Ldym1xX&+9{Y`qN4I8ruW2d7&04?GlsJ{`{IJsV$=TKA`J7tV
zeNGUs0#?q<<c9?*)96~LRcZYb@hN#aa8c&v+5dRKSoFemppaKwePQlCdHjMqdic%f
zJNNYb4%@42wqnD1k+Ux>J>qke+Hi^KMqnTPK*?VP%&I7+<<-@e-SzOVvI9{JqQLKV
z*4d}|Hj#U-+A8r9k5u9$Lz_r2|7&d3Orx9M+2ksz_{GGsy55a5amM4=r?mNK1+<>r
z(Af%;{kl0qt)bl&bs$|jtj`WJL#I^fOQV@>dekn67m9G5Q<iVSUHk={CVr3qW}mQB
zg^Pv>CV?1=Z{Y<9=6f3iftG}ytPnC-E*;+^Jf+fLU8Il#Zk)Iu1{gEmO=U?wD?*<&
zoOOu$n+TE~UixNUh7uOV@cP0JjsCwRi*CaeM_!bYAUBJGUJ{>hip07`Xf0CQG1IR~
zk#2<&4fojH3iP{g#Y@1OdwhysR1)Xf+UXk@kN}-7=xXVIX(%WRIJoL9#65=o+~)J0
zZ*F{`rg4vwlIYa_B=*N!^&*XAI9$I)ugSL4d5w1YUl7<)tNBXV>Lpqx*W?dmEna8<
zQPk$_Wl}!;Y`f+5{>n87`dHuG+(cDdF`zbMoSW}Bu2q=uHeJx#T8x(zFB7szTrCX)
z*?vA|h|^NOEfW@$e~t%{xX*Vm=eNqMU!Db&9^5HRsNDA(tR&m!r<35rHcBt&B857y
zA2jDU4NRH=liR!M%VvNvcn{A5-$jVuK{xQty-&U3w1r;P>4D~S<3CWM8w6`Ktj^+%
z9)TAH<xLN1K0BM@ENO7PJR?><2Yw<Cgl_Ge&$!KVPT}q8O24$-)Mcu-G*=hedj!cU
zSQG350C-XegyVYD;|+6ZKOLpQc6=UlRKd(!>g0`3?9P2T_&c}rQ}yS*rrjn<rNYCY
zEEvAdt$8}!@|vIQsy<TP{5X)ZB6jCNv8ncb$7~q7!i$it|1L*P(*;h<iaIg2C1LqW
zqwG(9%6-nAqa3L1Ef@d7hn5aqXQ)wgyYHb|eOhb`o5Zw&J>LO1o!yG~&7%0$jBUK+
z4c=eM5hmIyzp4P|FY@@%E8`Ir*abWiZ|MBQNSfl$r(0)Q5-koBa`5~};3-MzH#2(o
z{l(h)hAkK!{>=8Gr88X&9PTi&tJfgU!umsOVxrqtMrFG9neaJ=O3w6J*le<58MHuQ
zx*y%>^Bfjs<rp2@A8c?v!{anqebuyKw=ovL4);8oT-E=Rc(1au@}`T>wr!RWAHe+b
z*tct3WSn*ctE>GeC~%HxuZ{GZG&Se55DA%AC@8=0`6X(@HeJ}NW@HvL@ue+CS<8)V
zpqlJEXYw}Q_|Q+0n!VQ#z8QgqZ}m>sr%nU<z+rAPndK2eg2|d?6f<}U#%X`kebMOv
ze(7Cmv>k9soh1j}m{czZLH-kv^#5_2d+&}JrIvz!(aM%R1o<TE?TJAftVg4<P*|Gp
z`r2xe?^#zitVpANZ!{53s*C7mC$8HH*5(q@()w2kdo1E@d#4$bH`;Ljf(Z7QcC4-9
zMTy5@hRnhCMUcO5$IL2F@vWa-%5$^Ni>6%gzMPvGMaOx|^~d@KQ@mO1LJ{l76C37U
zPV<@11$FMQ*w*u5CgX6@A_kL&Dw*vc%H97bS^kPG2w1;p`H#Y#@IF(2a1qUY3*JcJ
z<+_!yHdk8OFI#KNeWLN0SqxOEKmb*B`T_#J#-G=3@~Ek(3ZS%n&L<bwSLf^D2rm5#
zm!8MB!h2uwlcf7x{QywjDR?1KaIIO~B4s|359k4pwa;do<2As?C~>K9WwgTev#G3X
zr#lZ0GGaOr(DNLeX&)^<5})<ZDnH*-myRz!u-S5>kh5&f%4@Ns6W_&7AH#1H9}42;
zR{zd|$R(QM(g(o1ExH}>)}Hq0oQdD>8feWj+wfY1mimSCYWy%>K&`kj_OsIR&~n-x
zsIe1B`NYqs39BbF5Fu?61s|H$DWccH*`HDC+NZ~nJ-0Tnnk6~4*Vw@ZxeSgs!5CID
zuG_Os_Wu@u6^K`>%KcxK%>K&darDgaueYLI?5`d%0QQ12YoEa7s|V|qcvyvyxh^c!
zrH`933kb7+f5#bR2Q;8?LkikV<!rKsHvaD?D<Lj<iA>O1Z+{l>e~deqnzu_JZAIu1
zp2+cKP%V3t$r0!<XWdrEo`g^EkGzTz*q~3!TBljhGA~IEF*RRekG|rWG`J=+X$S1!
z9TDaVp46&G!KXnV1}i`Z{&KaVK(KsigskJf$c0gAI|wAXuM@icLScI`x>|D-jp)oD
zWzK`UR`i=;&BOh!FvHiB7%u*fs<jq9r<wN&R#r|Lz(A&@#iJ9E1n{D4k>k4abi8*2
zq>v)*T8ZX(>f=C@N~arVQ<JA)?>*rAJ1>%?2E-Twd;|z$Z2u~n;z4;V4Y%ApMl7_y
z#ZC7Peohxr?sI-b$lLtK(T1Se!W0~TO;Ouc@@=O5SNmPr4cz+WL%yE{Emae>xVHD{
zg)I+`=dQ^bCc=4}j=;Zyd0YW}o<mo&G4j)Bm>80;QT`Fl2NOH(1LpBrPp_SsV=?;<
z&DCm)xu5cfo)}W7=X|%>wEeKnjpH1I-+=i8cYC=LJSQTihvyN+UvZtyG7Q?11Yu;!
z9l~EI9Uk2>uhhaU%YYJY#6nSk&(YmE2rYV__V`vGxfn+DyV$-nB}R_ge-$p)>(aD2
zZdi}g>nKhvCY|7Dv4N7x98eVM1v!%j9-n)^J*wioRoy0Vet&FtgzDpsD?ecdOS=Uc
z<t$BQ5^)mo+v8D#klOu}x*18$!W9V({YH-MLr0?=neh?Hw$~${>V<Y9bhG2TP)aM&
z!Ev5HAUO#jtxM13wdAECh(Pl@F|2TwPW&Rl&d9Vg4B%qb5}j^SaVDa#rN2Nz3fx@^
z+4Bt1a$<?*YYX-hvzztqy@$G=(|!{>cf{nL;>o0?%&~>n>$s}%p{?Wo^NU5~D!-4=
z)wv>qrS0)nh{Wj9>gp6}svMJ_=l%+JYwyMRwpj188>};7YSa;PD1@g&|7CZFHF~PF
ztiT)>wViy<=sw{{0U-T={*OZ@JxyN68YS0%_7Uy(UTGz8>5k=HKOUd4?*%y~0!QJc
zn|S=0pZkk-pTlLNa9()N@|p`W#Z<x1f<`GE$FbG!JeFXwJT6%L-5X~=w&WE^1v;2Y
zE}j~pSD4qd9>I{5)vwrq3c^AL&BX%&<2_=%;0*H`-}Jes{lfxwvs{)IwwMgpVi<>e
z@QY7(If+h7UaiF!_&||4E*|9Lv$aQf#rdZi9jKVzH*JZ2SWwSwh7%;^RC{K(EVXFr
ziLAh6k)Nx38xN9Qz+w|PZ`H(le;wXx!O1dj<u}IgSh_8{Qcj*};>?WV__j-qDPRMz
zi<<?fjgDE>^JtU&<|`@ItGn61R|oq7KX<=ZBAzzAfBUh$C!UFf!M1XVkoPk}&gi=U
z@`yXU{d1~qy-)X$$zv@K2dGAZ=<3rAnj=tAF!}VYvyI=>eOoh)-0G>H{(GYaBsQFT
zAFTUbosRPjpWCD5u%NmP)~BG4YB|`mDs4H9Qloac0Ar=Hp-glQ6L`|WDClaXr(mlt
z6d;z?M}0+;ep-5IIR2&0r>=<foy`)f#Oz%tppKfjvrKwd+9c?Uw9;PnIGo@x_5V5T
zL+HO6^G(l4;+Yi>`mIaC%T6xPtGttIk28Jy&D&$OJ!?FRc~o!XuPgp<xU1I9rotLU
zwXcEIU`jm}(3^z^DvZzeje#0ai@1ybm6Q2Vq_>^oV8(D5tcyWuR{{EO77CSqNnQ)-
z;auW44dTjMm}Rz2<Y)TTTL$bJ19bv}biBFfC#YZ7MCqA)8Z#Nh0o%j@0yqpaWN|1p
z1d{1ftY0XC53<HZfq0=Q9g4feBvO%R9(q<tRD#+Xr@}sK`j^&T#Gr%s{caK&3FF15
zenJAeky5uM@-wqJ;V7p+yPcEP8{fXd3nGuAN9g!hdi_(8Pr+;R%Wh60m5ol&a-vR2
zx|hUQ0;Hy#pHTEGC{VSZ8BA_}fAqeHF$5n%;g@9XAvCjhkFyh&WL}RV%F$pt6EL{W
z$hB)`u&ZAJ{EiK(N;ntzNzXPS=7Iq-IncPhAv!;TI!qC;n$5lbJq#+9bQttpEQ+M_
z{(gI6!rOrq@lMA#Yvl3?tgBNFHI26+&uvg*i?vWGYSCOP>I;NsCF``11GvswF2Tg2
zz`2HhXNA$ixo=PKLUa5d?Ug*O#v3FUOyabZV6Jg8lP&^n>2zG#B&6S)pgx_f7V^6K
zGuJ-O4*QT4&W@9?lTGIC8%96|3v^SvfOyC#vF+QsAYqd&_p?rjj1BlflyF$3H=Y%n
z)9-O?_t+oB{1HAXaosx?cyg~Z29R-Fmf0yZVbU~ZnN%Xif=Yb`qkSJDTJ^H-yI}lL
zlGKue3vWsX(NFwk*{LL(o@chS)xQ!~ebg~z((8BTk>bpz_O`{>C-<69+6KBck^Wp=
z`4}@Lbkf9P=`|x#ZF5EdQOSE>tK&FcqFZTtZK0_(TxJ+JqG@Td(q<@`Ahkfb5oprl
zL@QMB9zRc^`Z5Kwvj~G8W1Ipm_h@9wB@Qey6fjx|Zxzz_vM(*So31l~JsB)9yNuhz
zfwc45Wnj4#9Cv=N_<*yw^}32)m|I)GZ*O-;uKi?bH6-zLG+(L7a`cI>a+B|6FepT-
zTH0zp6sMSd_mwY#RFsw34`#Jr52Qkmf#dniYKw{AY*;+&aa)V@(7%-ak!0MEW%qYp
zD$6g6OW04=LQDMAA0o0NPzzr^U(KYan8kc7jx>a+RGspi2~HJ5_l9Xdon~F|=$MXp
zC=d<>UsAAD<PccRahlo|=<UCI#8YfLez^VUkXr~cHyAItm7mdSsZmIqCTYE7R4i;o
z@9J0mVFQs8XHgB$G;5kR6DxR+*^RazcljQB7^eg$XNs<RgC8wgv)Xhlo>K!CC~N8e
z&;d)T(>l(o)T%Ceq<nt74L8{Rg$395yX<$&(rob+KOZ%Hp^|qMJ9J3>-%4-V-8*L~
z@+9Lo{6o6qcNA_0UI}F0CscLuQ2L)gf412bD)cd;+s#aN(M1}$zwVCx-GtgOND=gY
z{g!3L=CVF=L?Hz^IayTNjn^?XGh=c_egd3T#vI~?zP>z%uMPWMdaOIAPT3N8=@?(s
zchMSvl-Kg-p21m1rDx}~#)ufvyC=yU%ocKE>21ujN{>B*pV=XEYZUiLlld1B`sE#m
zK><|1BqL$?0V{6b1Ip9MtjNTqBmICo<>=nYB=dMle%ezYB@zG43<SH8pp6A^<V0<P
zm~`%`ZLFXH#zzfA0-LgRbVR+Wj0zaB2sb3w!lW_GPUe^!WAR}us}?t&!jbuxeKa^2
z9CP0zP4nx*##mQw)IB?7&LOxEb`q4pBYuN{pcR@1;Cs>*v{ux&*`AqNKh0``4nYU2
zYG&dOt2f5pY<H2Y0Aiavu}HnP<kFJ=dw;4>p7SL*Wi+?wdsi1b@!jk4d*Du274_nx
z{Ex>%B#1S(;LE-0#;T7kT5D_)-h$3ju=%~lRx+hhW$=z~+W4He83yI@M$-vUE7320
zEmn`~2zsNvQpZZ~Kf4ITx;$U_!u*wJ;$lLQ!n>b{5fW4Ur;4Q_;*X?eNX92CM#(Vi
z%GeJZ1Pn171l2&yo)CDd)jwHR`AM*ZowDkNz|b8u_m(RZ$`dkA*j*QdtFdyM2)`CZ
zmuUH_GnQ@6=oq52gqvjdapaLD@Y8IxN$f@H6U|7T{b$hBI2k0cC$h@EXN;`!&==7N
zELzUD{xEl2f}TN>ZqHaa5m$1*(W$=Uw0`B?h}AB2V7x1mM6vq$`UdG+Qz;EaMG*C~
zBY(HkK|#X9e`KOqTRrs)3RS%!>vL8QW^f~pc|%WDmiy5K_D_!x4-nop+Y{*x|JAJZ
zP6Z#T-{aTXOqptOtyXrQrJ7Q<Un28p&o3)|8h6zw*zTT-e|wNaU9vS%zL@UC^zQ5f
z2pYvZ*cSbGg6D@gy#xt<Z_m!&3Yy>HRlr~gq-PprC1u0;PiC3NGQu;WnJv_*s}F;4
z;bbPM72x`7Yy%>(ALlZo_)<7UGi4m3AQ*R(L>tPK0LuObd7Dffv;0GX{(HfC1Et2d
zPa6F1woXJj(Y>((z!kAR-9sCB`sy1W^2kX@W}A?}I=`Owb&QvPg{vT@L1*T^OUr#J
zfd=J_LGq8???B=Vx{UmJID?-K?@tp0zry3e=riXk*LCkM7Cdb|<(a#?X9pc%l4Bwl
zig2Qv?Z<dt_<3u^ruVY^2VO-i|Ki(&u}qK&Q=2a1|No-cc$L#b9E@7blwVa_I*N!G
zqj$9JT0~`1t)}Y+SxM)h$A~!qm3+;5A1D7yxFqn=3CW%a$k%Cv5zWw;4_TWs^>UWM
z@Vyx$Dkv2NlByF4J!lBs2(gxx^sY_dWE$zgv4rYTeXwufd0Xiv4~a%~M*fvBpTJCB
z`7)0ct<n-}5Gr*QGRVAzU7HPpaK>k@5MWN0c|$Sgi@nUDwL|n(DBnHU6sQrdiSlQz
z4T<oqo>ph0v!ZZG9Gr6@P<{VM0sX~)8(qB+E4K(#yg+Z{<nOSo!_)eB+;mI`@GP4j
zccmM?^!oB1zY}&cyJGl7j%oCb=fSU(2bLb^GsjgJk9$uh0BQrmOs(pTBhto5-;`<$
zt{d*YdMvCVEL`*B&-sy-I17c*_2yMXRvi6VUHKgJ{79xUE?o4;>ya8m*Rb<E0PdjI
zf8N^MVOz)sQKS?dKBL)kwUoszstbD_WkT1uGL^U>)WnIR9p(enddxOm+9yRieK!8%
zWFOPq#aYJnTsx~+J%X8mnydQr>+I5AM}<;db#3(Wss`OU0mBlpNB|6-B@na*q?0dU
zMS~uJ0l0F91gDu5CH!$EFJ62Cr0wl%q;y~Q$wUY3JIvM2vT!<U6<u(hn{3&?Ex)kp
zaA{5J)xx++O==tYQN#31C99@aFEM+Xk895L2W1J<S*~mhtno6N{yqwVJY87)n%Nu2
ztKaNZTXF@}u6l9s`xYtw<p{X>`qR#%kK}q2rX+@b&(?lXnrXOeJtH!es1ole-`$F;
zAAT+aGB@N$;?;lBp0Xytd@OtbHke<5YRUJZbYt3H^&*aS9`q^Dr-(;m_?J83DpgnV
z@q19(v*u+dO#)G5U#fn|s@5(6mX(|(wZxr1I#q9}c7D|dJN*l2n}^N7ZO9)7a^=1m
zCb)S>u#AHx!v(aPGTjz&1!Wt8jwQbaXj?Qom0%oAKLRaYx)rYfYJCA9u!Q}fiKwF%
z!5)n|s;U0TsQV74KfaJ<43?3MulQ^l5Lb+mnCLna>Dm)XQ>}KN#0FmJ>44X_7>ZNk
zK!QM>N~ll8>odC21|7wICnNE-!>_4%e<M;DXD2T6Y&L&cP;Wcq+1p!n8o$>@Ej0lf
z1Nh}Vi~b)8%8q55OqEJNtK#bFniH>H$)niEA>W-DO?Q5&^3$;@sJ`yTgd5?~ZZ?qO
zb3t$k)GG@=hk*`Y1uP5@D#$(=)A2N{$4mLM-_<0!X>Cq5Qgc2TutWja$h(qEr(9F*
zKogsBOoT-VO!zU{IY6WL4afo7cTiF>Pl(EaNfp+G()Ed}bm-*4_6#N)hU7C;DRn(l
zq?}?Hi7NdNT2Bm#ngD(&d}QuJWx5+#;#r1yVJ4T%_(Vx>5Q9qN;vQD9@d%K6s))WO
zkE5b&x59cMm0?<L-0b?G1B|E1dw+eHuONrRJ9fJ%BTK!MF|%+6^oXE4xy@Au9<C#@
zP5+!~)T0dUQL0z$K@&_YY~pC0*!P%j?h#+)f>+t*7u6N@S`Z&gJ$&mWKnoomtvlc4
zDix9X&?>0)UaCBXYW>l{)@XFq&6XvWraoWau%p(1I*z5!T_@f9^*bL1Wjb72?N4EF
zoUJ!=!#Ez0hp-P1TcN7DxrKDE4=Q;dI;8zzv|CuqsLzlLY;zRLZL+Y>AkoW<Q~8vC
zsXg?LcJ%yn3!KcVrdYM95V_zbGecFkcRY%oh;qB+`f4?If>pz9aQ@UedQ!$!_hq5D
z&}fE-Y3w@&y2$|CN199rw7N_7eI5pJ!_2vtUeTW-Uj~kqbRZ6@L@v1AhJWyTJ7EsV
zd&M3E+1X{!mZJCr;1@s`ZlS6<d3g~lzDcDmG}ITy?W0y>TJHro)h(y<GcQwrl3KWy
zEyr@IcdUuggK*`W(p0lTZ>G=Z<;RC%+pQI5GYyAcN1Kne$DTYxBQu+Pq$bw7V!m;H
z`>%+|D_FkzsrvXDyt}VuR=$-NX}8QiV)?#vNeb8nQ`)oaWq^jC!kEN&gBC@r?8Xb!
z!V>^04vIB`lGCMcc#2X<cgkR0za$6QBmUzipDWY}bqTzt6~+yN;d?Uly8dpJU^$um
zx<DaY%56*%;ZB_o%^UX&eo-nd!SY(`X+zQq3Cj@4xUVd^mUh06T_&73VD(N`#Gu`7
z+Dk}Lq(o-8j}$L-(5f0}sflDTK30J%ja*V`nR%z~q$Acvh8R+ZqPF1XoF@J*(M9a4
z4*tJx9gdMcQrXX^Jqib-6tXKvb0kMEB5IHjw#HyG2yl&&doHRZ^O=Y+`A|X*B(5}4
z&zFOV$6I`nW|3Pqhgu3^<)9saAglKW{}E!nj8o@-OK+?MrO5{M{;th~VUA`z&b#4M
z+%-Bwdztdj&W<-IV0L_gAAQin_64YIIO9xoxjyE2u_gU<YD5W6<h4*P$J30yxY0xK
z@;Wh<WSiU!VF(8;h4`p=IY@`=5Z^;nn58*MZq&$)l#Cnyev=11L1t%5TzYrM{%|NN
z25eFC{-`|t)qCHHmC7UFEuEVrQ>XX<>vF;cN_2`#f#KnwzUrB)^Pjehzt9R>aJ+SP
zf3)VGlgycA3AMUOsshShE3&FYmcT45tIR*h!RB%@E2vZ)c>SyCf1HzQZvEw_D8lg3
zKU=Vtr;r3H^v`HqON@l98AV2BM73)uA&Sg{nqDSkxsMjJE&$bjPYWM}^w2Prv_75`
z41$2Tubt8HMbMl6GV+3;UEd`l+0=`4gaOhMkXYVA(dWB21N3aq)i;c|w0_}SJ0%`k
zWrLuxkM+jKw&c0~$?tL*iYUvGA}pIz$2jMsM;HpjfA3gtk^0D{6#(&2jZTGC;=oa%
z&0NX*O4E=7;qqgbalONyw}|&ATZM;K2?OV5M?kIRyZmFdq-D#mDH>X%fI&I92*1~8
z#&6c0dj50k4ZZb@*3QhyHk038vJ(KukO`QEL-ggJ@X`|f7M3A-RIOEN$}G7-N|}@0
z(@ova8Tyi3(qx745I{-Z6s(2eAH`W9ConY!pMGztZn}|9@J%dUW?AAGm%K(1hbzr#
z<A)_=DXZm|K7FOxBoQ#`1$dP~;wWZw-C67cTzb|qnudTVve7<8F}8;)eV(D(uRzim
z1(i!#BH92mVNQirUFhNa5~udBD7a!TvdN@LA*dR0B1n`(feJd7RW6D|cV+eGFxS~_
z2of+X;MyHA?WVJ<8*@x^TIu5^n|ovi-4);cyU3|2Cbc-Cg8STVw$Cw*M&V|44L!VA
zARuXaV_?b-C}q<d?Rdvz9dH@XB1F{k6aWOZ<bUPErBcUPTBqvS4~qyUUU%CVJ6s4K
z@Vgick@FK-*x-eRBL}PY_f-qUhnqmvZ4~!lee9<bhzYZ;yIPN8K;dy6^_KE))osiM
zzbEn7z9hw{>otB@X_l&dm62w6V^ZSW@R1VI@Y;X9^2DB)d6_X|yujgs6)!cmu>Rhe
z-7%4}tK1KxFs{a1_<guCa3tak2M*r+Nd*_mexE-NTWXPS#oyUsJ^R&!{I3{%s)~5(
zn*YmHSjmwRgTBFA_e53y@IBD)Z2p<yvt~e?>q@D6a2p#&;GBTPv{1z0jG50z4O$wY
zo>{67ahaJWvc<S&n=4kOAn07WVfZZ<>#4|;d~o>Q2tilc8*fq-(R?>U3VsEBkB@g5
zjvW8YGX{da_+ijd)6W@R*aeqdm0+($OY9l!@BzUY&@kn3sVAKpqgv(3DQ+6!lNBII
z^>*%R|7zrQ_-pc`9VJVht>oMPEj{KKW^22Jshy#0xZy#8ddH~p&)ij#MWu$)v!yme
zpyejk<q{G)o|ZJ5Dy{Krk+@NXKGPLlmGe`8g;Ry3JDfc}o_0A07*Gn|T4Q`K$jRR>
zMacRbOk9gQ_x6uZ75ytHEQRk*Z6~Bol{?ApU`H)}2fuV9KJ1DP@qK2x#19j9z48bw
zphBpRP!gEWeh>4M`p#m$L2%hf3}PGP1QqDXrhe4&y>?T_?#WQaxG0W@!K6{W905R4
zRl*&&_eL^%29nN%uHN^)yIc~Lwdie^IUZ1OM~yf?T``~k6%gl-QF(gYMx06(bN@}x
zOr$gDFMXjgMzg1zJ3^6y61N71(vdAvxAb0Nsm6bC_LGl4!APY=MH$#ImV!?~x1D`c
zlg59jaGrdNGr|KuoNr)*f(Tz2^is_I|DE`s8Get7Dhl*ICUZA~32f0ap<1)<7`9$B
z;jPKa)wI^_w~@Vxa_$aeY}ESp$7!|6zFLJJ`Vq2`9B*zvOm;0({tH06$#;fEOUuiV
z7w#GxAGqHW())~jWeskDr>3Un%*sIY<%n_>Fk}?}cS?Z}U?9IXt>2NMPIt2|1tX}Z
zy$}q~5g)Pq^?j2K>u0h)_D%3wQ#Arp8-O3pDvjfx#OwQ<p01{QEKHSl7U@>IgXppr
zpePMTKz$CcOVEJO2I7`NCSjoO&6c2fzF+$j^zSE_MEESz#n_D7jBCeQp7SP>F;DLn
z-a+NB)|2S6)x@(46L(^}h-?vt-QJPzZBpM2porcE%26<)=3={`cg`KtK4*5}z5e(X
zw~*vh0ilb3$s+cV5oASyTXe5HJ}d2uNus!paCMtL07HkA72)M{#4@fagE9=?(I#^n
zFBnX_z=*+vD1X%|_UV>^Y*xE1+kF0mX3^dw2OC3>gLI({+E?nejELJoy5Cboqy@*H
zTkPw(y~D`IO-T->pzk-V+z);+0LNP6I1HJF9w6|$-yR^&l)sXZ(9j+vgx+6;dnus#
zzyN{2j^WQ`KSluZ{TQ!>=BY*9`M{Lt0ot^_#;*BN!3TSNf$c39l=1&z?mhge?%zLf
zl^aDyBr{QHna2nr4ylk)*<>V}WQ9=nj+B|b_dI0Fh!T!@I6`HQWAFL9PWR`o@9*~)
z{Capi?jF_sKIeVCUaxDsuIKf9j)OBxguM^gm1`Z+E-W4kQAQG|6_ucK^bSR;t%E#B
z^T&K3D3JhAH<JVxg{refcOyRIL5%?Z%m*}5iI{1N+Ps)$wcn&on6sZm@BRKQNjme&
zCza19eQS;!8*tf~3H-|gaW+Ld!{;8qw5oif!nbfSxBef%-Z}4esH0{-G;7<`c$RK~
z+uWMz#+AtPxa@wBt3QP1LHjxGXi1ar7$ZCm^^kuaQ@CVjxCA)KleGeCpImK*K86<e
z1SoGVj_d(Ne5||6qKHWd%T~JMLVvdIUK7Qr8#rLAa_ML2bsd=9Cc`%xT}ceBSZ7jd
zq&%dp2e^ZPCEEH}m^rDSJ4hi^=LXoqp<=sGfleu>Ogn{?`|8K~qt?fqbbAYZd|9)a
z1(_g~<9hxI#;{ra^n?X5>xQ>swFoDb&;{t1JXMQNMi-E|k%*rb=oTy|Hfb{?+dRXZ
z=Htj}J}fUQeFG*89s~J(jl#^6f~2G$sZ`~{+Z{0o%;9DnFl8w28hmh>Ed%^B2uG~y
zI*poFo+qFKASw1Er1@DCJ^(d8m{F2ze##o*K_|T9XY0|Cz_;5=#m>X%O(v$1J)Rz=
z7gY9APjB?7pz39}XC)%zXd6(sr=5@DC7<r^Z+#f!samdKTOl&C9Ms=i55j}hfpy<u
z_T@WCXhj~-&93mqIL;t&591G}KcL4xNWjt`8Z=hCk=!kMsHv5$dN^NLxBQcMNvpu5
zFEg=F=l!Zv@ufDrsKQOvkt&CH35QjPg(o7N_wv>EHpKZ}hy!~U4vSg~W!~5804xAZ
zr}gc?$vcdA<J*^~c~L(GP(gD5i?tkpkn54b0!@P-F_|n~Ur)uV>$rBj-;BCX;wvmH
z*hg*HMM;BGv^cG$9za+{b}7N7G5YBc$<_(+j^_!cc#KXUtlb=xqXSRUq)<LL$KTJB
z4OO5`?d_#ZR}29U)t=RlZ#GgYIQV)hwG~pm@H@>eXAbNUo+kb!RI;QfAD}yF5X{0x
zg@(|Uer))l?2)saOkw$M4*RLNzoARHfcYBkUhHJg0>AI5WLcK%^`A?u>-c&*(gUY}
zR~!gWII@M<?Qzgz5=n~5)!u?FSUdYU2I%)6qs$#z_5&T}`>gE-4Z;_<WBDgDLBFN%
za3(?}am04GV>7pr89>|xn{wCG^Z5_52E$c|ugQKpwCjYnbAmvTM;}GG<xmYYnzCn9
znJfp3y4`=a^HguIwsU{xGJ=*Rh><*#&tTqF5PP)b`hyBz0;?WwU=Egc=MRNp?*TdQ
zdoJw)%~G#8=I77Su94W(@9EuSRuto@+sBf2X}&iVG9T1$UZzmX)7ja;jAtkvIecF7
zXl5!;5U-|~!I(6>s&kmvsJ-_5U+D!;?K=9c_{s55nAH+JN*n?RuAu#(T>TNB9TZQ8
zZ$feXYo2Sw@s4wMh31dF;;G}`tyro#aG9~Q2h}1x&MQ>T{%+S=**(fbCV>9w9@R-$
zKL?~{Y#dA5BZ7(Z1aXsgIHi2sr)-RuLi1|BBi+?m+qKUW0AmtQwUJf<7om<)7DPpc
zOE{&X_gLvj#-i{2D)yj)5jW~J!Q>)ZRE~b1s5qCjshp^s#q}hLVcWoN&~&BnA5($)
zT}owbe-yX6ilBcbWmatBIU$DW=i5Om4~|=`W&g4`XQo>%EYX4OdQq&#Z*W&ki+PG(
zYrf|#rTY#0ZCKV^w}$u)28qD3ec1i(Q<di~ioZyOdc#(-(-o-MqjVhK&t@*w3SX+z
z%m^5BKQaQ7uye3}%kp|JT2TEn66CNR=CPc{L)Rbx3N4ZL_bgEE<gfgD{z8n72yW%7
zas4X2d=xD*4|)x)E1%ZarnHwf@vWI_cjqv<PP6Ri^jy9GgTBfE<NEHrjjrPtpGb=2
zE9wQ`XEWnp!rab@23Q)nEO`Xr6D>gtnR^&vEA0M)9gn$3-$#`u5G*RuyqoHK`u@$I
zAKyss^to3P5)gd--k8Ga7J=;XrF&U#+~5|C<xc7>`4+bKG`ZVDnoPq|zHR2$9&N_b
z*{YGt^Xmu5d|Ja-erKzq-c}R;8k%;`ph8<0b~MQcEXZ`v-csjXp~JoF{cv6-rHR|`
z#optQQ`QxI>A&ELf3VDKtz!Ih>%mG(P}FZCWTg?;G34f(J*6<b4nxdN0F8VkcN|C~
zoe|#p9Jd512xq{x>(BY8_0vNg<_E@}MXc~$vR%f`+Zg1sp3c*)ww}rxvh}Eei$Zh$
z7!^N>6H5JMxJ1AKKDJHAxr*_>mgla%x=uCl#c;OASV?lNrtc$649c;*nU*R6P@5^B
zH*TM1l&L+~3#k|#s(Q4vAZR(*;4Y3r>^+Kz37Y1-u;dwMf5Z2M*HjzRiN({uNUBWd
zJX4M-KVpTpAlwtNek`Z7;G80kO-U4!&E@Lb_D&%$<f55BY1~EmQ5c4k`KoRLEqkg_
zXbwzrO;C&8zonoR4@1TR{q!ZKgHn`9BbQY+D4J3}BZ6PLXvkqO+t%7l8%`5MyMgKK
zkhcAFd~*!#F|cdPPY1JGA7@sf@6%GNEALCrvI4x8kUTlIidW}9c4ht+i?Z-L%~EVL
zR+pB?g>1v`JYb>vTt_1m{pNOX&1|ID^)ZDo8Q;?s9;I0UA3l75I^=H1zZ+0-_|SRg
zXY1jIHT9f|w=x5TW6!>%tJBibX1E~XT0~@PUmpB*%Ha&~sqYv~<vnz|@Oi33JHc&{
zy;mvsVYXp?&e!)>*^`m!3_`A(0^1QzX~#yor#pVQ^)}{J8vV!&__Zd#T|+&2>6QDb
zEK)6;vBWELQmM|Unx&Kh>gTv^271n$qSE#%*0gd~tYdsh-6v}*cxjo1EHIDg_;D9P
zQZqWyhqXSeD4*h{DHo9wnC)F@ODAG;KeJ81@6fX`51;VdOxIE}HFwew>-@SCWs4fR
zAWAJIe(hNN87XM3`t*Jdk2*H6c)`m29O{}G@x1CgN_UB=plyyqXybV(<$W)jhD)3g
zFz1Tfz*~@y8hz1=OAhJ)hdi!yGh%z{6e($8^<gA*?cDZMB~IT%#Ml+7ewB^V;oA%%
zQDW*Z0fxQmCFcwDBLUx_qnFr*l+&8k%MAZ_UjhJ|!jIfz)7hvbyjUS&wbzcP=EGe6
zcef?4V@g|<i@VxDUHyJe!g8z*Ds3K$%lms4i({J>+C{wBrU;U=LR$_)H3Ny-Uc%KI
z(1T;uDJ=s6uqO$u!foqAB>d7${Uip?@x|rne}Gzohvh_eIprP%$@X7{u6O&MTN$ix
z(efin&D8U`?5!+Fy{?fRd*$lO-E;ZkvGj6EkZGGcd2D*KV1i!Mr3)?ZOyKJKF@DL#
z-k8<c!B^jWt0)`co#d$7>H9g#%YOMvbJx8>=HtV)w(}M*u^(6Y8?d@*in#rCG>TNh
z;L1G`T@1<tNB6WR?F!&@-?&!e0b&Os6^q|15sQL^ycU~@oa^FWN<@!VI1^)p4lslj
z+igeURIZmkC)DC)Jn4R$mfj?O%dpum)DSGsQ@b#i;zBb401x~k9PDkiZmrOEY*74c
z%R(l;&NRQb)#Zoud+g}bFE)<|1C5uNqw{Xh0geVD3<d^2<DJH~R<9KjUq_5rj46q3
z<ZaAbu{1Ce#|hiaN-mfEC<&4cq8+YZSg#l};YijdB&aKX)A9D$3vOc5@{V(@*l_Hm
z>p$rqUQeFYn7_DqT<E4U$GEZBbyEJiM9K=U8S0epWD_?}n?)M8xP%I<k`0w#N~FAm
z%cl;b9d?%ZQlbWmkPPB)-nn{d0A@W3;gurQKgenSQHi9D^$AY8oPwbX{Rk+n0<y#%
z_4jLE@82qDaU4SsYI+sTH!VgIx_Q5Hl=J7d?tb!%$V!4gG@IG8Y?FrHT+u$wdexB_
z6~*C4nNs6OhPe4tdtvnD{76FUrsl_IDxUM77RKt2`Z1#mSlmbOyMrEc!KIzhGG6~E
zEDAzBZzN}(&-t*=N2(-#6VbRb2`Vp@o4ax2A7h>Ygy5XsOFUjCGetcT@*UyB8^QP1
zkReN7+yAw><<Yl9o0s#qUe+xC%54#53|;|*=7+(pw6w$#Fs#VzyV3-YpYPG^oQknM
z<Ac=G9dU`@$(uDQtPenN<9__6{LEXVpQgBr)h-W0wXeU&|D{K~06X#GojdnEt<M))
zY$1+);e02KWcQT#`oK1-W!XiViFv*M5v~nqfb#jAnG<bJ>Od8yZK|T(W~XcClT6yM
zRCKn)^k8DlLfwLtItM|M>QqZ$Vb3fTP~7z6ayN|M=Q5Uj?tW<EzZ3zt^rq)pGg8Ym
zWCam4N?eL!bAdS<nPEWNX<^wKV`ugpI)$AdDpeBi6x%|2berR+fhqKDBy!~6gs0x-
zth@R<rVV*<*X#_4rRqiMRam<fj_=kSee$!lT+d9*jCbDLIh5R5xclYoioyjXxmu3%
zUi{Ym8N_lB&&3+Tmz#-pyQgmmYPxbzop+yD(I0MZmLg`MS?>KNvL54{)A>QLTE4<4
z0_AZSEs|@8(R2FlV52&qR<^&sR(3ITZu3i9*V~eEm^%8OOoOGz<Rs|-G4-cUBPk>!
zWpaz4?s%_0HuK`ix%SLcBU=p@bJYsT^`3Smh{Mw!@Vm&}d9fx>tk}am!FA!Z>Ft6Q
zB8ON`e^IVUx+GIlBc!$xkY5nQVx`^US=&3F9HBQ#uV<Glvp@?nRgm5cvTTiqP_qmy
z8h0iT^^xyqE{M6{ARE^xCHt-c5w8Ui%q$I>Wfqbvcddb5@`8&O5%VzPZJd0o)_lpw
zA0Lzh2NBIXnNniAj?WeZ?<KP9R-KV1prc=**n~N6j@+9@fLz8?`~&tUbAQ|J`!yJJ
zn+K%hK;3wEKuycy*CSnzk<%5|HB0&qFWS_KZx4?9I9)T*a*5Ev=MC@hk`|!gbRL_6
z14JbQ@0;(ChJaMl9>vWAz*2%1VwwFW?<;85?kz~2yIpICGVt2{^k%l}zb*d3{%cIY
z&C?Et`$q+Jo1asw*Y^+J#C)08qI&TE(ryS6yEgp)5^kVzuv~)Xcrj;!wX=pFXQF%O
z;i4j!b_H$Cc8^6qmdU-{%4rBQ3i0}&vwD%VE`G1_oF2E{8}h4aS$4*^*36cl7A$n$
zPLnFEeErELDA<@(!7D9XJbT-l$f)V37I1-L{|N(HM(4C7(|nH^W0K<Qp=OokloKw}
z;L<I^1Q2C?SZT>pV+n(2KCCY)a|_DR8YUzP?I@oDV1!UM0Th{GJS*lpiqAZu@f0>(
zpz8UjTB(Ss>V7pu$^a9Qx$faqqO_0}YHH|8W`9A(2;*>hZ045>vpuWlr4yaT_I|wH
zTjGB3c{8YfWAn!ZI4<ucXbsn`b;rY0J*LtwlN>iZ^wJzsVE`p13hcE0WO0LJZK}C?
zWnkC~FNFXqV>-`Q{^3k`R%2GYvv#yMHN50|`bfh;ZEKM$rXtvoe?mV!mR&w-#1>PF
z-~Ho|uL+y!6k5l_Z`5*h%z8g7&JWmV)Vx@Mn<(~=0r6rFR?$It;^Bjx!8M|IH<&;u
zvl-)FPalM>pCCBjHP@f(6S-#GncVg5!N#!dcs;W){wqU+VmQ5BC34RM<Ok{xHd}KG
z>o-6u>FsDb+0Q5_<X7i|@u<OXi2LI6pu9Tc_Thk-^N`oMx%DD|y2oThiySOI9Z=j{
zg*cPwFf}_;?I51h8x9vA#rq4vWA2GUxTw1k9>MnG1W%h=QzN-`H(?+yizh{=_Gt%K
z#i+<!Z`Zgs!a#0WG35GixZn*_(H!$`YEs93g)P0gswRHnf^Ivt6xpMbeEP+@tf@gu
zjG7*;%@u7ok+UKKhRv=#4H2hCjJ}L81}xH#F_M{9U~bG|xvq;lzU9Le-K1r6_4*Px
zkZC<LJ3TS==vv^IrtFu;r6$l0dyvb1v|BwMuB(cTfkvt8#zJ@cnhIo^U%rI*_Cccj
zKhcJpAo_I$cN;GG7=^825V*-@V=l7e3my^ik5Q}p`|_>Qv!t+M#x!<E`}vTSCkNFY
zbh={n62EQbTbT8vt>D2ul4Y7OrHY^1DKWOw!RXezH$l2((vg60{`v+QMxizxF?KVE
zwTJo8af2EDH*@wfuq68jrFN~I@JZU`)*~g(?e#Fd0#%TitCaL@DzPU3*v*2`7cV^9
zL;m;^W2><`x8ZV}n4{%b6-s|#LFBRf#s;v4sP?@E43Hye7e5VQI17@{8hkv3(mtza
zuP%(DEDn4_03$yF;v86q`AD9}E4^L4Z#UYm!Q{e?gLi8AT0-#ceO4!@4-dK)B##*O
zTB2Hh9oIbBcq62r=d#=7%Yg{_v9V`l^Gcl+yoz0dBNg4B3;(GbH~AX%E80@-j;LXT
zT^E%hOcxS3w)VfQp&na{O-<S{_10w(yq9{vJM!Qg$(ip`d~cVT<&C6o?7f*KCLW;L
zx%pRFLW<@A&?i(_YsJ4m>ps1M=&F6uRZEePERW~!BlBX(a`94=NWR~`cv`Q%CsZf(
z$IFv3v_H9HVk@1MFoY_Ztz2dHpP7meDXo}2di4`|pLD@|yA4l_eS_ZVu@g^~cp^)_
zxN?*mM2$%?<c+TrT{I;iP~N*<=8CN+Xxu&7u&Vk%tQ}Xo(I$6$EL2H^)CMg!ZaF+;
zLvYzxi9RG;yRN3g5LV0e$SXN}kxYu_v8bb|NyO>nx2A6Dy}tlNT|YXGz7Oh9<3+|!
zyWoa-U!h2^CqA?w)lKU*S&6uRt0(mP;^*>T004^r0DPgfB78+RJ20VX5r?DFn-4Gs
zW1$wUD%ca|q$|T>HSd~NYkg886YxcU^ybC(!I;f@y=U>s<7Sd5J`C+w+-R#kRz+Z}
zvOM;u88Og;Oij}dQ1&gRI7)0D@XRLh<Vl`Y#Ldt+v^)^VW8U9XjiQ8pMlFN@A^A|4
zN&!s_)e#oYHbPOBk=fYXLQAL^?<AUcr&Lb9t$&v>YzpMR{6x0LLj@8ZoxseLi{&}w
z8sy43duB>?HweDDAggY6Y{LF^)X$j&sjCui`u53G-^CelO<P`XHw+E?(YMoiw&$j2
zS`59Hfb}`|91kPbfgZ#iMF#ZRi<exJ)EZ)eLU4Qh;{28Et`-AzVng*~4^NABP}56Q
z?>a8OlqLY1=$|{YUAKx_+B;TcK|8}cgQ9D~O0lpejZmcoX$!=-$}qq1Mq#P2@*_y&
z^UgC8?d+0F<{S6eJuf>x%-5RqZxVyqa}aN#?Vzw4C`pgPgdDzHfSjgG=dQc^VZXYr
zLFoiuhUMr3^<#B-U4QQ%cA5rN9n-xxV2<KOiQ@$IFOnOc++P_nG7?4(w#^c(p{uT>
zF`K1|`AS)3r8W0MShs?5R5}mBlrC5MbGw|m5_+?A1EJc2pc$45yy4mqj;hWYnN;cc
ziA<0)57c*0O#b=S=ZukGt4d1c$gt!-mQd+nC_W}I3b<Fw{Bc#xbE!7x<jNp#Yx$wT
zbI*R|@-u+DZ7(CYaHFWb%<NwGJ=|8lcJ0+27l(O?b#yII6!bnleYC%}1OkO=C2t7B
z)nGldotDP6D$IxW(N95yria@OFv3f92fHAdWmekwX{lz><n3?4Cht%@Ip&p5aXaaG
z<>-(1hpWUS?bd7%ee=KzrBP}nn}twN0fd@jre$}H1F(395RKXPn~enq<(Bgnn?&wn
z&XHle$bzammC;#=#dhDac62lDkUIEsgw)^EHqoKKK&PZjkoiR7;Zs~r%VF+kJbyAk
z;8!ar`!n^4pLIA0<MX@hS!OAkV|cQRQYA@%#@o~%+4gog?XTvpaCE`lj?4Pd`I|LH
z#O;a{H+O<<#}tcnqJahV4tvi6FOhutGMkVV^^mlVSjOzL@3kgaS9Jgs6p?Y3^QB#U
z$rZABpc;8G0NYiDTodQ37hIrA-Fzvj-uHVqvMf!Q)+9djun%{OeFJg{%mc6E&Y(p3
zQK<sYnmL4AV3tj+n2^Jp^YnrwU?&6e3;@615nI7^{knqc8<LcnFI`=ad6&9=IF%TI
zhP(qX>v-(*Spa=c=r{~yRBEBFzQ3k!Jv>$Ps^Vw10@MXvMoPiC?Rb}Vili!B#Xr#G
za`Y(!J}F5q-Z#GxLxiK+bS~;9_r6QdFU4&;22F~QdByiXS<IaP$iy6WqY1<IX5+rr
z(xFBHHE_>q9Jisz*%^8d<wS}t)<gjzx3>y3;#;D|KDZ6cMz%Zst00~5<2Hb)oeoY{
zT>5wh2xQq}id03G=luy!f2*+7DR35QlVmuf`)rU}?xSNgk>(nS>bljX(N2>RKAW$F
zSDRy}Z<aW|e#Gd~Ybl01zP%HW#GK4LjX1{eBEjpeJpo_9GCv!^(ootRc_lW7X!%*Q
zWjmn)ss6fB&PyDDQ*g1dbj|cU^YRu^Z`OzbF6m|fjfFk~&1nNsM`AP6CoCkGJe!4v
zXaUI=1mr!}JyYJ39K${mkmS6cLY*W3<H2oL77raZ78b~Q@U=-c4`H~}&Gj}TPzbv-
zJf(xF#f7@!uXnKJcu@cuDMYd(QzSug4BvLIRwSFgU84${xl{MP#KPUQT@qEN{ea@=
zV$)LQwTL^mzT?IZMz_ug&Iq;>hMj8_Y*S(pG^25wZ|jnbVNEM*UDc4xbT}K5a3jzm
zT>L#vh3n4M8<YpxX&PQB?}Hev7XrP~YER5A2|tb-)*Kr=MuIUUvmovxzgK;R^;Xc8
zj3DiAF?ESKkwx0K#egHD`Q%vh!HS>-=6v^TG|B?QUMx=-F2dww*#)iIck%J@zE&d+
zTL+*@{+vNb2Hxco!M$-pS82`Ww2LyE6fe8tmI~4qTz{TI?la@+)!Hx{Yr>L<zA+X0
zR`D<@C*Hk!7pKeCZ`_#k_%dwu&$A@Uu|7GHWqfV!>WzFq=-;Apa4YBbbJ5FY<OWBF
zZsUgwaIdyUaU%qF4dEId72&p!Enqq0bMA4vB`_YR-1tFHx$iD=#5`1DLJ~;(vXQp~
z#~4r4&)8=QH!-rV60B_!tkx@aQ9B_%hX^4})mLR_h7J<lg=S1kKk+7pWiqBbt^Q8Q
z%=h^wx4Q?&>WO%QM9OI4$r4wooi+j`qa$U1kR_cs{S{_RSv@(bp35(Ux#GAnA4imW
z_ZK>~0C2cPz??Rev!TZ}?AHyeL}-CFYt@Sq@LP^Di_oqxr*9?3<mtK^jzt_oo|@(q
zaDhKW$|P~;d#Tc(q&~-0n6z;pI*Um&ox~rwuVFe2-Nh$``V_QE@5QIG&9te#t0cYR
zekQwVdMw3pf2Zmfy-Uoan_b;}I9}&zXE%WvHrK1!**2#2M8UVpFS0S6uMRg0+~sLd
zOT#?f8oqswnf)uP<zSNg%b_38+Hjo327xW#@!D_u8@a6CZ+Z2&&T#Umpz?Kz6hxO_
zcN@IKqPfyn$XM@KsL`t_&2U`=RLL#f2#02D<ApBtL#4}R#9_b$_>~~t5<Nlt3oC6D
z&)S=e@?kilBse~g=l;Vt3GB6iq|kztdGQqg5zza@nv=5zPDvyuO=k5mt-44rOE9T<
zT;B8Ro~KY`5P%E9M^?<olDyfy|H>ScA&BC|XBsE3sb!?V9*o&v>#CPKKZ1*$w~j@a
zSgWex5!TxgU1erY6F;_mFB$vb?MI~_eZ4eWpvd*x&BD*J)E@R@@wbD*$GoOx8yN61
zz{dd}6Dm|P9V)6v-X!?7nkHWcL&uyD01RtMu0+{+;U;Y;Mt0Fx336XACOIa^dSyv<
zV`r{1Ol~GU-CJF|)5LZe%cK}}gXv0DAT66lSu6QT%&Sq!WOHS~%M7~i`r)V(=ISVi
z;4g3O+f70Eyo=d>pgTVF=8snyp8)=@#S41H0Mj^JFYW5>74~e?*xeNQ2`oP%yIB|4
zR##Kp9pU2VLFRpYy=KrPcU`-V?d-@!VAJj)vvbw(Z7`|Q!c}VAv9m!-w+~T4lG(|G
zXzdy(BLCRSzg+urE<*naPRv0oKjc{D<39g7)NNwRkpj-Sgp=K06NpC=q<}XmLPL9T
zXM2mW`aJ8Bux|B|nd@GMv>gSnk-(9jClLXO8IQ`zWF<)DLvOAw69H5tTQ}1h##=1<
z312<R#pLNge<P<KXv21Q<7{O|<UHGMgx*XsYK05!3X9>qp-<p83RG&ftgQ>mzCrE+
z04l9|gC-V_Z@bp}ThO=Cyrj#He<M%cT$2!u)VP0;4h`mpU%YLulnmu$`E(F%-S{Xz
ziND5h6_biPcjc__=s^0*uCSF~@lVXvozAZv=#-LYAp}?&o|x7gJsTs#9sWZ!qUG#b
z<3}m?pqitEqPg%y=W(ykgYj3Q-^Kt*Z#a$lKwfu}`vHK!X=!Nk^hzCnHp<G5T*Swj
z+GxegUl7f+K~*<4i5zfu?Yr!q)K5h?c4*UE8Y#2%jMIKD-k8{s8sW@vMDKVD$w`e^
z8%h|cZW$C2U)%OeQJ?)hVqIt(jJ^LqMFB#pKu2pEJ#-p!<m{wS-HYpQNXG6g>S&E=
zXI1%}oVrTH(_PkXlr_Wv!EuXzb@EY20M<HWGOT3D%=4m9xWAug7H}1G-#8_aJhJuZ
zvI@m}RxlU*s3P+g+v48yGg}a67)c74EmFq{Zk-oD(Y=w#aeN9dXwvvPR#N<*x0|EV
zJ40!)bZhSjS}q)&T41xgcWlxxht_a`{81~$aS8EcOg;0p#VuTe#~icy_s*2mx-LqK
zAScFCRL4<tx|*%N{+Pw*rx`j*#Vl~VI0nJ?^>ys_Au_^OU-7rL3MeN~o%Fg$^|)Wn
z|5K`+G@<&Xgi*$-h($o*Wb@LXqFhS}FD-Lx-lD(IGe?dvUp$SSVar7bY;+XW3nBw8
zBn-!yYlTFmpRj~JmMfIB|CdV~UeW)~w$O)hi`I&il$u;LU2XqGKeQBx-2$D|jLAKQ
z_~tFz&pHnlPnio`{c(JPI*?(<`+~D?pa;p@siCJyfbzg-5!W?QTHudkqy3LPvSO2&
z<}GVvo?wE(#1@kwmz-R;`}!tg^+eOKESHO~W9<Lf>Pgth%g7Z5e_`KXMLDrKIqy=I
zlwV31tn*myJUn})DOk_Ml#$up<GRHf!sO03gaW<o!rn}-@GP7EF_S=*h~J_d5DuGP
zPmkR=bhD5aPfq!#3tfGZANa-f6DcwDo&%hOb++pX_EKJ&VwCO9I@t+fm5!`%Jrr+n
ztFNEdSJDXaQxwT68aOq2!PPNqjylJ|H(Ai{mBT_NQHS9jxWDto%MHB<VC56if$4(s
zLrPcQ;uALc@w^=fao0Z!6HXJh74gC$^2y+{ttL$IX42amap$WIa8wqg7q|VSgOru%
z9%|EVk2WTWB5NWvB%Tg0n&H<c#Vs*8qig%d5BFdGdsp5}OoTp*7$74@#Z~!N2k_rr
z$?G=#S8fGgh4A%JAMa`7?CYZ!y<?P!etf!+LZF}e6vM4?CQlmO^naR9I!<7vQJrY1
zSlrbob49f3xj@SQF@f^d>PfFTvSW?&WDdBM0eawZED#}t3$eaVgz&QXEk;1a0x@su
z3eiyAKfu<O9Y6o1kEQAu&io)bYGkMN&OCk9om?EAdHc6|$6Xl<Z4Dl4Mu$n;@bb8{
zrL39?$_i5X+{c)*6VgENp&gwfiex%rL2mT%rU}tPePztH1TwhRAX9L>(ZyRmySx=g
z%)#^azva6`6-jk6fpy0I<%YMOXQM<A2xIxMz7p|FfvMcv09qJCOz`D(qPxzQo%IC}
z#1yvCdyY&h^`ME(#Wzp30701DsXR^nc|!u3JQa4-$4CxTvc&Tr$E^GvZpA|zh$#m*
zTJ(ON;?wDY6yfMFj(=qvpiYoT4!sx6XVfFw{!QE8LU%~Va7-qXI-e`J=EScYMDXN&
zsU_ZrwNh~|jqfn@89O7stOvqOF|Vksa}WxS9myf&!GCSyx5IajRbPP^LmgYjdJpCE
z9kKr5R^A5HdUuz9ndncfv@R-nl#}p>2;&P)7Q&h)*qx_D`w-sCqR9BricU%lEyvFh
zUrJed;H9t5`Mlv*o{(JE$-5Yf4BACTkO%(xq-<FWh3Invvm`33CqeHkf2?nY8vAng
zh0`r_b5gHbnPJl%2_#TvZf)^S*+$B+vCxlbQr2ePWxV|75m#CZ8SO88EC&*5>TJY1
ze}jE(1#gBAR{A`1gbB%oZEwmf=Nt?FyB>bY1?9^52pV|s99e387rGoM1Za+-PFNG`
znD`sr>0li=Su;)P>DCfP$M`JAgpScOwn|3bia0y|&k?txV|v@1n<J1xs@>KLC!<HW
zeU!Lj9$+k+;!Pwr*MpM)*swq!h%;D1G@ri^INI~t!8gNE3Bv7d;I*dx=}OKQyJToe
zv3#;67Wu&StvS{Ighn8o`IaYy4Jo{`%mBPCjC`nN=W}_(m`mMD<#^Ub4w4P;JJopn
zOOF^`jZI*DQyT<0s6wIX_xs}rYduIlG8+fKDwR{LZgRLcN7k_<G7+QkipUj?gietE
zJXvbZ5vBATg(B``Kg+7)pR>p&wR$%t+CDtBfQ-AxF~WOyR2r2->7f$g*nFK`Rcw>Y
z$3Ic=E27C8$ixLu*Y48?dIFDXWqhGrfAkYntLz7)NJ8oDk?WrSnJMLt{)TsP&E=%>
zuozq0erlHhlD+E%oHA#98xC&WVsMb@zOd*0I(EnV9&mr3U|q)f5Y&{TWn)q8DrOj<
zk)wl4aUns!!=GowkppLzC6G)I&R!-OcrJ+$;=2?n9{#Bw5ge;0t;$k+^^PtAH_JsC
z|AOz*|AiKn3Bnh$zu1IC`?!MLURmfme<&c`gyS&j(&%r)A6#@ox=hu?w5NO2B+KQM
z(1tgy*!dlA4(4Uco|J4vaE_6y?m_5BW;6LN<-Xlr<RAL+l(rRlf=Z>!1N8iHU#4n(
zdcICv?x%g;g|<6tv><)d6(+ZimQ&fYPI&H-+8;;eC64T-AnPt(3VkUZL3^`F`H1p(
zSw<(XOnX8yW0r2bZ<uIPSZvdeU8H|XrAb!J8YN8^TEl~G1W}ePnYQ(xhl-JXHJ+@E
zhVlrAq04hs<zHaN*G@9?A@~Y(s}cJP>@)divz-$S^y8CRMfdM(*~KSk9n*+xv-dpI
z6TOQ?bN=Td+5|wvkJ#+hySfU>ep;>i3QE+gPYCZ@%+&}=@%Qh{_(YTO!6dmn0Zqfa
z6p%z!^65z*JtXMKoxE97%I*~qMYrf7sC19of%Zz(E>gCX&g6h~0OruqDsyLE|F`~Z
zc6=`oHOH?88vCLy7OM7%CZf|$xGrH)+V!>Q;g>ygWI)@AE&${}m$K!wgRh>)Lc)VN
zE@llAQ}ZnW3Df7*TUOW0j5`dvF)W7f96OxKEdRcQM%jk<H|gU#Wl`I%q(emc=A@G*
z5m%|46amVKlEvo^mF4L2PTr&h<ze^;UktGJB^ZQxkWfMdHYc6{C3y8-jO<zh-tc#H
zj1raC4x1Wwn_m4r5QeXx;9_d1gD8e>gULg)^AUZ+v2$@`XODQFaAhzXnV)m?%@F_L
z=4&2rpd;u9QOtCn4rzAorSyY?<aMSC===xl{kXe-?2)1o*11Is9?ghe|C<P51CCW9
zIioYIV~HIYrFQWSV-@z4v_2f}f=`ltGCJD+M(91Ve$gg0Y!6YSZbvd@zbLXrUSZ6Y
zToH<$*GKQ1Te3!i4!IzND#(aw{7D~Z#E#dn*oJ3`Hf!}bdkL{ych|?=Z`IX~)`0N;
zaY`9|*Eum6SADwH#`u8=o&B>Ko2SX+FS-n#_OlTEjn0OCkB_&xNf&p94c&%Lt;RUX
zZogbMm;Ec4nC&hRo{6>pj`BGP!54QAdkmB`1PTx|_E{bzSkb2F;iu{*muH&i$vOo6
zuH;EJGrUdq*<$+>AZaX)E7TTI{F8U#GNAti9emAh9SOb@ZKAW?^$v|zF&%Dl)VO73
zpfyJ}o+Bc|7rMnnv={hgWsBGLjmRI5Wf-ynSCpqSU-+ublZk8J%i?-CM^-FMa_8D;
z5{!LlXp{U}O)w!TG4a=~seN)pj?B~bGNGe$aPVavN^*-&2KrWMK_{L3c?#U99Y`kV
z9wcWC>4iKvF;JXHRB<g<RxRqzA75g~`{L>$QshFQpsz!g3Edt6W=a%^@_IeidfMWg
z0~Poy7wHGCjZ27!Sn7O)0Lqo&P4XoS3&>)G_p|(Y?{{?geS7}+laoIE|E4_3CUkcH
ze41nS)gx`=s@W^((HvqF=%eRYCU1IJ3-Cn*;Kv8gA4(w8b+t{Ri<d+MoC8({SU4U=
zk<|SO`<KH_aWyk6r!+J_!iXM10kO-SQ4hyem?05eH^uwYbeS%d`I!gBR~*15EvSl>
z=q3;Ry7!U6<$r=&icI4ik<pG)8dh58TGrZ0uCl0Ob8}><QT;F_y4rHkq0Z}64xKH8
z_iLIXv$7zEg5DHuzF4O<z~qT8*dlxHsQx&L1iQ(5q@2l`_xHKY)ITQugD$0<P%Cut
z74orAsndQ|U4ZW<%dd-umtmzDx%%k83i>_8P3~Oxsc`N}&KI6>vx^gL%F<dP%Xc_4
z=5u-bZ?3?8UeO995NGyY+d_g4{zvf&h^C%Gw)RL)bQg4@x9A}L_qq7m)<P+w=P{E7
zPqundk(_*}%p#=?#_n2}BMT9|vf;<Tqtdsz;dlFS_<tTN<ss{kvty*rD;7E~^W0O#
z+-KHD6s_Zv@5+rjH!R*jL5|epO8!8{!<6bGh6M}I0=#S><gq<I^RiR?J6yh45PxiT
z@TF8iw4bc@xpQKsRw|u&J%P13IYQ5bPRH)@uD5%}Ihq5}riR$2Wz(PZ*ghs0^p;8u
zQ7Mq5K?!MLSmqLq&0q4ciQpAx@mCR7<QyBwMD>Q-`?xJ-rm17?2ZaL)#X+JrJ6og-
zw#Q-eU_$T~6T?@@75;!SKhwq29I8=31^DbwN^wsd0MnQZQKa=&(!=}cL%9>!%17A`
z>5dbcxdl61h4%4<_z$AU`RR9tiM$W1wesPNhv2@v=wb~d=;4Qq`3FmiBQGk50mHI;
zn0&3AQzM9k{KlWu%lpkh8?~FXgKb186Fc=OS16;Rt=Hq#=ExrLsFc!1eC9K+E+Q4g
zePvFQT}^1(o}(Dgkq=HTGwKTa&+wj<%a&qO)Ij?<b0PJ#vu_e+%0;?KNqp_j)@CE5
zlldmmo1#dYHwHG8dGlntX_{hR*J+NFscqv~L(S{X>3NuHn$W3vfNa8p>N%EQrg`#Y
zIkJSwy7TmZP9Ej$GCk7XVj4mox<}eEVhct(oLVMy`&Lc%L>PKQD_uL&f$ODb=P8&8
z)?CR?xV7j@@@hhin?Li%j3itM+HK$X<<PM%jrv`bMQRr}$-0SR>ZdQ|cLD?NRR`a^
z@tpfg@ySQGrEK1$7fhk^P<m`6qCIQ!tU6v0VlSD>b^o!NjKJ}Qnj(rA`w5NxIWk2)
zhb2UCrto3GM%n&1)#NEC%XqU<{!|CILk493+h-(=XJ8C&k#n6(h<M2A4kLi?mQP$X
z=iySeAVqAt`R;DYjG36`NYa2}@d)LKQ9BZdxpjxUi&`?e9R@EB3~nyTUivQ&xbW-N
zJSZh4hoqm~?|s!KoV7+oor`E53BYpCy%I(Cb1K+Cuow{Z8$^^@C@mlOWjMB64b5kF
z(fzYG38{!-$1hNW1q09elJ^WUHmjIUGX|>yNLRwM&ldgi<PfI-fDroW4NprkxcVk-
z`-PSTgVxKyZY<J&H38;lw}29Jev2hzzt;b+Z9EAzUO2J{&bFzjKjYZ;3ygvd^|<Gk
zn{T6DNEbyjpC)dQQJ}mPLUvi--=IQya=c`Qpb$aGJ3#CEkS@nP3AM?52ONFYiI<HK
zK#w$2J(Wx|D^1$U7+ob3cEtUDEIkS_p-VqR%W7e`_xxVts<xP7v9`gPVEiRn8o~b#
zAz`@vr9|b-aYSWW|2f@wgJod~>vImv)u)Ri#hbnrNWyL_>mHO}FBB}APMWh1D>PlF
z`?GKS(=MJJ7I}Ny9fA@#EROtK1P$Am{^~rLY`**1Ax5%1M6ekIW7g*#1`H60P|(-S
z8*`@9@|ZF4a_>s5JJ&tK_jey(VQ;P})qQ=pl^#*qNlAU^!!<|oV1}B5RkWc-;x2I=
zDW8^ri|=1s-dmYJ8SczkMj+!6VQ}2R_t0e><#X31k+lG!;NHR7mXO?&umG=Jre$Ty
zj9QWu=wrtYu-q<?|GQIqf>9>XL??o5)TTkO6cKFgeA`M%D&D}wg1q=MR5qIpS~3eP
zSXBG}-CjMx)0DBN4nIQl=tPHOLE1WL%#weOj5$9QZfsc{e9gsv7<*cfr~a-Q<(oJB
za$2Kr9VFL{oGg&FzgPidiBqY6Ut9M6E9Y}dr;e*xY7eOC%#rc!^02Ik`+1ts)i^rK
z&ze_=zKV6Mr2XT|Jug4k7`c$^LH)9kGQ=Dj(+(2Js7<#!y<%id^JGZS+3ctH{CK_#
z(F}?vOCsx9hI?vRl7#YI=&okfy+h=KccUIzWixKle-0m8DS8*mgQr?UGw3$qc8PB&
z<BsIwJ(W)*!l)q8^d*t&kPAnYyYR4K{#yU`PnT|GZPOftfT?19@)t>g+jW{#OCoRu
zEbi2qB~`dVb=>f2?KJPoF0%WCf+sor-vi_X{|X@E-G7Wymh(Ad!Q|ZFOpT6`PF_Ac
z-btCg)qA>z!2-^{H*Q<C{(a-NXE(bj>%X8^mPUiMO#B@_Eb%sDOK}UMCYL4SXu{O6
zQY(<WQohX!SrX~15S!bhIEF&P`lM|L`e{_xIhNs4JT8}y|H*lzXvE4S3_e4G7eDAq
zj%yfs1FoU0pM_SF>#qw?SwKT|U=k4v_ZRcj<^o$$K&&j69B&i3<NBR5ICToWoPa#<
zwcpeXTYK0GcFg^vL-dbpo~Wo9Nb@Yn|DKaGw|>7XN4z(LN%I5NMLUkVX|(qtDRJEq
zy3bn2^;vc8=VFEDb?z!*@87?V(=M<C9GT&hs4rhRnj)Z!lU7{+?5M8MjStu>N-Z#p
z05Appm|*l6hv$XB4}*J?4TW~dr88u`#Y7QP?)r_`5=jPTx>|{L?Ak%m?e`A0vw#bR
zUofhFmUeNt)}(7u*A;N92RYJ*1(J9DZcpZ~-0ina^sm|$@g5q|JbP^_iYGBHKE4({
zOuX8ux}bV&WT^`KAqKL7%bPbsBPO4Sggz+Osr>%^xzFAyr$uZf0CE}|6~2(o+E7bT
z(gzH1Dj3HnJC^>`)n~b%)`{Lnr5Mh(9NQa)mg>;+%1R%AVSI<)Rk_vP;8?~-DBH1n
zhF7xXuirjt;OMC4?w%fab`4M1Xfa*j=Cc=AC5O)$sFXRX6|8r@gDePqUTu=TMR$hJ
zdPTqmf5TVyCK=p@Je}zCp!U<<R}hqZUcV&8*n{nb@6eF(*QhQo?eg!NxM2{^S>XBp
z=8S=bAFl(ItFNK!${mse$qE3H57oK3a*SQax9!sW^78U(YHCW1+pUMo-GD}M_Ne!k
zM;yGqFHIuwBRv1teJ6=T^J?B#(`$j3umbd)#*x{bPI6S1eBTS-meitT)%35<&Syc$
zM^#zBUK<Zkc>4_)iAhhLf<Jp3rJf9LGP^`@V8up~LU*S9A62*x$aCnr5Rz3Z=ffW|
zW)j`J#iVt!l%~(|7OrG;X>m+VxyZOTGSJx>n$qOD=kv#o5v+G2^WK~8>B)R2Z>W`8
zivDb$A?B^AsVQjD_pIatyf=-*V|+G8mJXk`=<YPKyD@wB+YEl8*!`8ec;CZCsxI2e
z&+Ufhh98|+5S7zdU+9t0&~+R0H>yGYs0I4ixig3nR**FM?CvCa(1LGI93KSRxI1}t
zFbMXPitG-{P|BQaTq6SV7v}He`f#1G>`MMAjX7I)M!L<FJm&r<S90cb+0YAay6A;7
z&j{f4e^u=Pb#KAr^UDRQ*ke57DVsM&gG_rUd+BkM0A@nzRF<rti-H}8H{(56pOG@N
z2lpzZf3L!<cdWgNno-Z)&`^(xoDEm<{@tc`VF~q$qU*%B@)6&3{E7@)YE~!hW_h?F
z-!%9#kgwey)s+u`Du=kFdPPF1cgLGuq}BX5D#Q##C&6oXu=e6FY*{>Yf=H6KPAKBE
zpq=OO(V;!^)TG@twQmtO8~QBVbW?KsSe}|nN56mn2zBp$zIHjSgB;$tzhpiQc;fY7
zGN*Kxe{V_Ee_X?JNC^((7LN^TFO5VKg*d+Ka5wFvR1`B{*ba&2t`F!{fh!(@1!hJ*
z0R9VX4?hxk;R29S{9}wwoFzA~Rw$!xYqa$O_k;LNbMld32NK}Xt#R#2Xgu(d9if6O
zJ>^Dm;j^&>ao4Mp>i1f{{yu)`jEX4M(sUVSH50lS76$N5!lo)9?sv`n!0w*7I#>8E
z5_$dl_X?A(#d|yNgY{C9*;Ky!ln~Ewq*eOG1e`R8;UB_pTdQHUK4yG#C6EQsqh0N}
zVfGPWheA|@QZI^JuT+Yg1pkmzFO=$515{0hqn&-r3<*_=c~QV{#ZnvmV_lAGX!WvC
zD)G<y@$k^}d+(iaSR8*;EWWl_7^?R;Dj0Evcm43azX$KiNd7q|M@;XyEs|a?==W{^
zYRWFM18xMgwxB+}hXbFt7#icf`u0<TLCO;3B{9*IAgtoJRiG<7LW;M<#}Zde0eGY@
zx}5j}<w^2c_O{+TQRMf<z1Om;9&I*gd)>zta}>o&Sr)`r2S4G0$*z6+6mEgk*|q6m
zP*$$|yPL??AIGp|COXm@8458lvHIKhT*UhxTjR$+>)=oLjlW*9`0aE^*iK#F<Av4`
zq=|Zl8V9WAFf&B{&rujESJ1E9oQjlm%h<$ta$;g8_cU{Qi_kA!_C3GYU1YlW_?gC2
zXTQRgQFWFpz8a#j0avG+EWPt2KjgQ4n@<!95$b&QJ3tmQml@mbI_`nbsiw{z>6ev5
z1BFXJ`{HP6CTJa{A1ZI22`4tC?q{aW=jMY4fA~<cx7p3E0Ty9ng=y5NhzCNN7OD6x
zPx<A7+CS5QaBY3!5@d;xe!ksBW`rw|K*(e^SxTrCF>b%Q;a3vXhMhDu2ZoPLQF!3O
zLf(PTx{S@g4?IW9u_Bd<-{2%{S3b@h8OA5iQO7!XZ!vKw+xa`ZIAGltHY9?+<I!Q`
zLSEjDISQ{~S?0>$Ukyx$zLtPLErhW89>9|WT8#MPd_mRgu@%X#VO`iRQjaX^1Eg*C
z?{<-C>02y~hm8luU*83!9`Xhf)e5zyo&C-kw2-&(I|lOLpY==eC;p?-*uDS#R;U*N
z$vRe9kn?jT<s)PmXyU_IOdojAQIaO}wtwNruo3mMXj!CltDs|}ZOM}(CTSeb;h*#N
zmfET{efn=h&9=yQ*HlSCVcW-&Vr+>@o>G3`5gizdY`Yp^Tp+t%tEhNj@M@s;9F?>0
ztKmr!`sn}eGYO?$EzPdPHbr-~;ge750rDKqEB)}9?12)=<>G1F;s1&H!Lg!ppG=1I
zX@=dmpCx5epQl^Hj&A)BX(cw7Q5<iP%?*76*3c@M|70!k(PudpnY_v?0+~)9i`KT^
zjaY0dhCO!vtgc;I?*B<`{m;A(O3j!;Tln>1Sgz_BUY$R4S}R8$WMq|t{w6|{>=cR}
z$;JoCdU83E3Q}Bb1J65>Q3L(#s?vBM4*o~x<n3qVE$XK{)626Z6>!y*iVgwTUF3s4
zH`)L5wFK#|Qg}h#sJP)r6klXwx_JP%5lA-n{}ub-ZM9^MC^1Z;P<7AHb5tDirg8H<
z67>6@{4M^InxB0tl$_|g?laNPQkAqq7L-LxMbP#?SwZj^ygyEfLL!lI$g8ExX8vZa
z)}I4cfA0TSlZ5o9y5eIWy3IqRj>qL)zo{x2ns6u^<q0ip!p#47r2z~5_O-H)srym#
zsJz0DTK})53b^^R-PNbA{Qamq<ZvOp#Vyk!AFLX5*_?C5>5}OG^pf#L2{#8hL81XR
zZ0))3096mV^}1&M+0nD<UOA6)9VM!I!Ed_nI%9!)JE%$wZ^D4|JBPo}i6XGcyh-w8
z%UpTbtY6=82zbklJ86J2f5cP0{tMl5c;GY&5R~H$#kDT>GwAamwy|pos(=}jfO&TR
z@tT;RVNu*Q<9>WX&EZp~NHK3PihnbepVLBjDx<Znt`lgh0kj})Z%fi{`Vd!<`I9H~
zDA)a4G|%DT^w_#3h|8y}vktHw|CmMF?V$UN=~+xD)_NdaoK=AeD6u60gW<ZhsEaap
zP}yP^nV5WZ14Ow9^fzKr<DWx#<`!X%-ib1`0$dJ$NiH{>0DL0A!n+}p^J3c#da!!<
z4I;x62JT%+7aqe~x@<2BKfKXM)xc6W!VpMD^h(@O*Xm?D5U3u9@IS=wap>W`7mJ!_
z%Xh@CKc4P5vY7_DT&Kl*YU)9eaKd3+^ms#^8^pPDU^vz0uaNN+==?)q{B;7f7AsX!
zeIdsINx{XT)M4OhzeRP>a>dzW3RXCf^`34D>5qO|BH0D%w@4B(#|1nc(xK!$Cik2?
ziLlM6=dj`v6BA6Xx)b0s7=<j~xq~hvM{g$JAXFgx22{=G?w<heu=)Pcwly^VBLz%&
zYL-5=x^-60=hP%vxfb$I_%q@{$sdeEVLw{&7iIy#<*2Z4P;%6TjAQ11rtd*u+MTlF
zz2tHE`gQMy`Wt+6{rT14W;f=A39ml@WcSnjSfIrjMYUgTB^}M`Nc76mz64+26OCc_
zt>-B&<Ma-AW?G5_Dg;aGomGM&K(yP`GuOLx#16jcdrnG_1u|RHopSw!j|+7wpA!_p
zv<Chw#H{vyeUz&Zw~Sc>idy{NT1<C3pIy_z9ISPTJoZ3v3kz4McP;ucJ%0v;2Ixjb
z0o)%r@~uXy&K4$H$BT|sv-ARjeozuP7KI$<)`5L1dqgH=u75>%7lt4}+>#WuL!Rm7
zV^N0f!j^+SHixZ=UQH)>n8EDMzdQ5JsiS?d!uii3!19G(w-APYOrB=$VatlP#Nm^N
zAg)ox+{-R0$%5YttAJ!b+_wuY>)hR#b69d$@FLnc*5EMWV1YT<9bU4V+CPg9c@;vm
zFL?J!5dK6pnp)7zqNrDT0JH-6^yfqDv0L$?4xOTFWwC-5(UFCEwOD$S4=xSI6pe;1
z5WKtcAOpA}yoln@=C)G+|8@TT8Ml{uEjJ0CF-;eNs-KnJ;E+keXwIW{$ZC(@g2)8Y
zO`($IoQHj^AYD12nYjm#0cE9?kK-;IBE=O|0URNW?PD{+z2<#c=dl%ZDo!Ne8mL(6
z5~q%&__`Oukh{P+5DD0FP{dNY`Ez?Pgx562tLx@knT9nHLFjm2j&80^BK3U{XZ@EW
zqz4vn*SYXbd)o$c8u^0<x5qP#S~u6GIv#&CwRLxIA;)1KwdE>v3s-1kxGzdF=j+xX
z_Z*AszayUR3)u}Uz`+r+?we_*cAcJ>U;=>?^t4^Mb^j{nu}Pk8MV)P`FVq3gm@<d?
zbU)<fnf1C471<i~a)fA?nUWI_GrhR={^}zbq9r51b0lC2mG0jUov-T6I9P3EL4ZQ#
zFz_70`Kz!V0d-Q{F{KaQ!rirdd_BTnxgOW;@#)IBi@G#6vp_P}SJ8EnpvW3mbw%=!
zkf4V-=YNJFHg1p1*Bg;95VFBC)jW$6%E#nuA1&25S3BVV292BpK8+jqyB0@47?iI4
zDx6eI;p0Te7%ai9Vapy*bsZH-dF|q*BVgB&!+=H;xrLx>xh1FXnPto++21GU%<D6a
zH#AFLe8CHn&iatj#ygFQfR`w4Eilc7Bckwa$HF=<=@$_Eaz#Xx+ANKprET#>m>h_h
zt<n%gBc=->eFO?yWjJn<K>DpDsTd*%N#-JOtAX(x^J9y>i(p+qOpSootmoZq{r)Ke
zpbV}Dp^_jT(Rv+gs1~j8&L2iW4-~KKl?|?kz$}egfUf>1%5`i1i1tz)5}#~jfe_wC
zGqp=AH&20Ht&4?})bc7+nMe9<=)tBtCi|OvF(w}dKp^y#^I0tcNdYx6bg|JMn1i5U
zkf%<o%ATI!8!+s`ao2GiYJmjFY$!#RX;!o0aRiN3I7Eg!g!f3spBx@fpvl)O%}7d0
zg4(Zg(oV76#vt9z?f%RG4ErA)ROk<H;>=n70vzUdn)C+>bUn~g#K#(l)?d5=@78K9
z&J{I3BGs2=fFu}%`7uCs|Kur0CFy@^l;zSA==$=-tmk7l47;=*gj_nae*;cHa=P;x
z5<DsaL1kqnj2DFn!l3pq&W`Bqy+jYgA^l*<qYu4lcZ~>4;i=d0(92^4me{f@k#Q}9
zTFOPBmCB*W09%7Il$`iT<W37MzG#+7^5(t2xj>tcd1ja27npduf1#gFKDV>zFX*q{
zvaNMxsW52zoGu^LnIPUe_2t^);X&+e%p*p(s}qk1UU_;RzsX4ODkQFEx)Df3PFBbr
z+&**C{R3DDea3a`g7px*+PQCfq))xJHM&vrHR_iqCnsBEc1}$mO9C)oai-7RiHV7a
zS<2@nF<9RplEm4AZ1_BY<Q-*30I>YlOFkJ4mt)dPy^R6{9VGk@f&I{B!yJc2fm7Or
z*)LiLV*Gn3G<#4O1mlJ)j)2+ypW$-$x~HwShKArY8HHxX?u5s`kKgtUeD>SLU51Ch
zQH&FETf^M|H-*<t@e{Hb$WXK(xbe$B6o%F)UIgjCTo|moSZJu{?(PnBctv+LLPl&a
z)h0nS@@%^WUH024E+KQgN0LX0DD#2f0Ql$=ujZ@7oEE<2MpuAnE{KTA*W@OrdHnmC
z>(~H+ZeUsi4j!OCI#2MUY7vAVfMWhToc?1M#KfwBK>P04uO8!ef+U3)eo$CjVZ1gq
z*>dmn7HoObl{0&&or=t-#v*rd9C#C5)e^8-jC)Riu5!qY)~I!HP-s3>#lz}_T!$=!
zLC{nHW|r7j)cVuH4uAW<Pe4b=fi1V{Eyo!!i<WI2ofkIm<K3KDhRZAKQ?B+enD#e^
zSzs!j_!YNqs5Q3iBmpdpd&4XD;?~{+Fl&#+q}P?fa;~QcyaqF52{1o#&&3aK{s~o3
zZvi<Q!K}v=1fjE7_Dz`>s3Z0$f*|)=;*lMrR>}gM-Mp3UaTjKf{o)fu>+`+S-f2!(
z4*m_y$=bJjn?W1{1_+4>c0UYiyYTE6)*nW$@5vt1hp_@sgBeI)>jqaRKED27<;_68
zuJDTA-3*FYjglv`uZhnqL$E9D5<Nkn=e7}&MpKN>u&)>{ey;~VJeoJe`f&x+2K;Le
zNC+YeHFkQt;M>gVl&W=*a^E<|Q*P3g@FgPR@mRwDG1XM(LAB-m`@re~J5{sXQj=g1
z3hP~mdEn}>00xRH*ctF*BXw4;pm$@@w>)ZC16dvjR}25#V__Te;;Y+vsxwx{`I(#d
z#4T8#742(y|D-Suqq;z~htBS$D)s<S=(p&VJ)Zi`hW7pawKCX7PNtZGr(A`N&!$7;
zfg@&j5<?IFd5eiA>#3K;mx=_O!i8EYTT)4|1oMM-#qw7j%rV>#I9w-l`u7}oBJTWi
z_UgMr-Rez9m*H}TrOy7s?*y;1=j;32v<giy%@YO~?<;c__B!1%Z`1o<TKqY92k*f1
zRZ?C0@j+|o%syul49NlR_Uh%!%Lh#lBYxY5M&$1P@Vo16tk;iQ>fMaiaa<UzH0}PC
zmS+ye0z$UCUvuzpDo_M$@Eh|ROD`H028-=%-}!~G-`}mk*FRZkq%r)He}C>>`9H<V
zJJp#;75v{^R=KWQb$xSnFeFas?7!D+3V#1qc$Zba#T|{+>>QnS__t0yHo|`ozu@>E
zm3ztF0MP&U;VJK=|HH;YZga)wZ-wZudg^ZtMVU_Xx8%C;|M@<b|CTS8)0O{}Z~uS)
zpm+STBd-l_`#}`K6d3;==7PX$cXbzCVjT22gyHsX8`M$tj7M&&<$AEfh^`wO=%*by
z>V<0gu-=byALeSI9C2DuH(<-0d#4oRguy4kKs>Am-Wvd$TR9xZG)rM|CeRS8b5pX!
zrrCm$b`D%I)`GYG{hR-XukQ?pv-`d#l1L&US_DCe5<StoNCY7vqD7A&dhZ64=%PhL
z@15u^$}plw@4c7NjWQU9G5_QFy`SH?e3;7^_qp$L&OUpuz4ux!z|kt_t#)YbxJN6@
zqg`)(ak>Y^8Glhl3$yqwfy3Y2^<Q(yF{jVvxn1+sjE;?8IsBRaKT;5@v3(p`H!CU`
zi5_$IbUA*nR~fQL!^)u2JA_ZUW}6^sFe?%YB=44T%-iJI2FurTgx}=CX-af!O7bBY
zjDQj_DhLVN_eE7y6j_gnI$et8b{@Rhlgqid*i>WFWzCTSOVz^jeW>goU4WpesfZRB
zE|5oTIhz32om={<m>hJGpNwfOc%7V0g2RYy_}i!|FtC87P~?x+08m>4y{+X~!Z=>T
z=b(obsD?j6&z;hVyXKYzv3?MEXba!O!1fxr%S+k^Mg}Bs8!IZ{_Cm<y`Vs{}ToC(9
z!*u6AbnbTE%c-L8b;`=OoxNup&rhg!9Nm!YTM^8%WH=#~P%;tC4>DjL4Isw>e#8=G
z`Qq0iB`#i!UVkhDX6pn<$tHVt{}qt}#CtP^W@rORm^A8W1=PEH40x097{Zx0CBtYt
z9e7|znY5)%LU8@*bQ!EuzZ43{u7I}q5hdQHlWr?JaLNd8rrdpu_4{_UeS*W<+2f)$
za(vZTVfo@eIg*q4rp7qxAw+1qsU@WHc6Oo3D?xuokqD>t-5M{^laaUoZo-_UJO@S1
za-Bj6FlektciU-&jEjb}a;iPH8t0T8R%@Igk2dzXbXZ=AluCA2zG5soM>cM+voEB1
z4S&r(>I*y~x#{~@k%PB!zqiAM^E1vHi`d9SDi4dC7x7>0Rofm9XCjHCwBMe4{FIiU
z_gYK^ACmq1{eclC=X1ONrgw7k&JN9)wgv}<i@YN7ulqM0Kz#3o-leLUcg(`R`&saW
zjcvWoELA~QNCW0tjGp&KHM%W;^GvQ{T$^1Qv~(jc9S;4K<>^z4Tsk`Yg!QGjqL;dg
ze~E**eBNWbnko&-8nP`AwbuON%HGJX{Y02d6#a^c(;dYsaB6$hO$i=m)KbcQVf}TV
zrtYF5luh|G7f?n4P&pE41aDrE2@m|?K&(RrPbz`XK<;M*Xu%Zva`X>OT;6Adki>Bt
zE~i8e2?#A4QR7wx%45T#53lSQQ^y7L@<_j0iMK94ANC3l??u86pCG5Wsgf~eyc$p5
z+rIAicis-EtI^1-JO%yGkh2^!7~M#9zIclT2$um}oP^|z<D+#y^a9w)Z?=R~0TSyr
z@8b;^b^B5!*<5s09UhtOi`!*C9Xb|0%f|Qc@SxIjo&pO)t^CrN7)%WCeLi}gY>Wf3
z>iBs;Ql_RNtyP6(C#xu2l}Y$uz5lDLyF@R;{*{a>I?G+{JK>LSYRdE?7R$9^-8b<U
z1J+Z!``(SD;HgNQ>_69sWqWeQ9HN4}Pp|s7KQuD-4l?fLiqVESTsSmJVNKk>Yo_-9
z?<rIFECsnW0G-Xx;CS8G0dr3JL!-`Dt)vPju57EUY5JS(ZSb&E;4^U0`D}&Y#CJ!d
zL+hXL#ThuNf}Jy5SscnMA#Ef4ZM0C=ZR1Dtoac%1z#32eVgtD+8}9XE)(Ek!e=~Nl
zvk<muy$|tMSCwU70*q5|z={%DPt|31D$hUyc5o*0MpTBgSiP>Q8>3NoOxJG(s$hJ)
z3XV18LN%f59_LmBh1NgDqYXgf_lp7E^VhoUOCOEff`^so9}Pg3NXSqtEIIRi2>5JA
zJE+;&*(5u-)IHi3J(u<zpzNixd}ri;bM5=jq=Ivu(uGREWTHS%V5aY1qpIHHpusFa
z4StVily}R(+<hwqaL6f-6u2y%`5hiIL6D&7@5&JbX*^(lHM$2PF$aLH)_FC5Ak&9~
zW5U2mqp{xQiTCORbrS%M&MQESQ>>#8m^}d=;|3Ur^kG6LHCCFx)i?XaZ5z*G#WT@b
zDq@5L{~fH<p=$7=X!7+|b;lV29yfDIyszHpHDQUVZ3Y_DqjiTNyKcN6E4MBqM=p+3
z*w|*+(^in#apWBYEdJDeA#9J*QWI+cbEWV<pC#yeAH(5N8Bki8Ei=kmm;~T}(}3u9
z5&spZ)K7%xRXb1C`Ewu~^r*O06)0I^##B>V4tHz!Y=I6CICKi7e}jyfF%CV*&Nc&&
zKWLCKYr;$?5k26lTBr{ZxH2Jp_<5ggV@4vlCNhoc2&@SHB5zo^4(R{!Sao)rDY-sz
zfjupq`6K$)ChfAPl<h?F&3P1<ob~C#((jx9@2t3@wDd&{NbZ!4>(*FbktG6oQR6Lj
zBgZqK$W1@f16k{wSO}waPSyLlKh4RT?9pL?p9Hp6*YSjb_r46Fki~SZWef*kHv>-S
zkczYl1TiLDmEr~HDtViBK34-}zp^hWa?_EYIMkm)SB@tDu23P<dXrGVrowD*{@%85
zFV3zxI8r|1(yM5@eoH=4z{0C<OpD%eUk1Q)1=?Ad@06TWyxN$F**d`V>IJk;GIXof
zfs^emutR`L>(i~CskTDLXz5LZgTaqP>>2EB!fPTbKy%R>DNQeGgDD-3t3T`5)~&G}
z%YKt}^LX11oCsaZIe=vW4VHg@5-!bE7sQ*uPRhevZ2+aRGe9My*>I<`DBgqzCl+({
zV?cCxVdsaR)o77Hwc;2EXKZF`ExLwtz<tw7U!F%wQ&V0Xq)OJOIA99GX#_2YvsD4$
zHDNb-1!jaqvy%AO{rkysA^3Bz@jUmW)CfRS!X>)jbODJFB8c9j7iR``jwbg6PSj^J
zW&#Oaj9Ns}%@lS57|L}K9|Uq1fO)vuerP#>h$<Z8d<5o1jVfZrBt(&kHzD8CGq2)Z
zL)^1H4CD-1$LSk4@gdh0(SYQ}`*gkvJt>~1u<EtZWWehdDv8pdsMFRoIC}{Kd|$E_
zb1uVjKAQoVuAajERdQThstx|%zxddlG%n22V5Ds$mgkr~5g=$To%(3_asMKE-XjY%
z)W=%EP7-lB0*n&KNrRKyTk=n&&K3lP<9+IF=P*jVxCH=amjb3!AuCR`+}<|?=hCPh
zqF7zwsQ%{tUcj?IZ}b*~x0mtH$A-02MA!qKe0%(ziZVhZzoQuIWVvr>X!={DSN!7d
z1$=ixTF|wVm$4G1?lhG{C3z4p98~fvZ2=tbAj||@43Q0BS6uR~uzBsV`ODL1co6KW
zrbHYaqsiIcNJ|16ndY<g+-vVm<tt)a;D@mRzIU*8^c@h@pxy4x_yqn}<9b&QAUY4&
z`F3hn*VZ(<2kgN5KIlBIKUyX_Cl+~)`A40Xh5?T!2;vSfK@yR43!q&M!aK-W%*2J*
zN)7YLeYHl<V_`!`!Ryd9AEhhd#2Q;cH>9)(<IW&_E~&IB3<n1^nl%P<_40HstL%Aq
z8&>)uV|+aT^a^`;*}Oz2-gbF)HUkcp?HP0%5l@3ax^$=W?&0RYC2j4O+#i63yVcll
z4<JUFm*P0wPL%=$Bs+Zxs5s0Nu(9&=a9k!)e=D!eZxHpRfO7I0TbE-Et-E4-nV?_(
z)*Kr<leqXfIQi?hzV}pA);*c{(`N*9#$5q5fL#-6z7Z{5<!1Mu{<Bks?3135b8WsU
zm%_G+<`#WOrIQnftCT>$f0-tN11o;*Z|Yeg*5AHWd_il&c|Y}r)%Ugnr|y_<MO>3j
z(%2*(<okOW+*izVZu{r*&Rg{$@I10UxP<KeHstjtS!&p5L2<=B67p(u5uSatuN-iL
z=t1hB+v02;RJWuI2+^rwmf@Ij(F-WigX<=KQs{ZyAb^gH>iRv8Gv|K)X6f@|tkZ+;
zj>S$bW_PKPHGEdQ&k}eT#PAUvA|pb3)K#EbfF$?hc;xUN13{=2dsY+fHOX57wPE;X
z;I{o{b6%P^5+D)3HDVlF0`JiZSdI?j*7H^5SJJK|tnJ{J6$NA&fNP$-0~*r?+fbpI
zgpRVc+6z5Zt^3|k45Ve3j<pO0j>`b1Vi-mp(-st~bh-M9WHz)?X7}@4#3trAF6*5Z
z1jVW81-R&K;cs}#7%uv^L0dF{?e}u1()!qwjJFKhzk7TTdg{=&L}%!ZWZ#X1KRVw8
zX2ve@Hb^c|+0?bc?3#S~a3yV1=_)|691*84;rws$You-}SCqYDPX}5CFW=pnAMYvG
zWS#f09^TW1gBSmlb;Qctx-i^Na*@eV{<K-ktzCk|s!Vu}w~9Z4UgUSe3qn3EZB;f0
zfT)(Ie*dD%h8QnGq#>*CGf=jJt<@*Jq?&<ycWV3b#2>c02{p9=L0zyh8q9}2ClR-O
z^X524E|RoRUBmmTW#GLsS7TUnr8OZI3!KHv<{z>k17ZZ_JdDmcr2KF_V_Cho*aPyf
zcvH}Jw`pg2V$L_^z-D>=oZ)w`ZAvXTcf1$|ety(A`NaSQGWQ;(sgjlxC$`cctFg72
zmwGr)$k1_F2jXjxK-iR~t%IPAb8#(wg+AUYN5>$J;?}GEhcg3#hAj*shf4#9*gKHC
zn0DEouC@RG{PsuVIWZR`95p_Jyq`PG;3Z;x_=~|9^X~}>+HQu3mAACz70G;%*#+pf
zO+-!1g5d3sxz7gR@rmQ*H5>yb{NUb%{tC`%Y-?-}`pkLBHvr^3uDHFg6i@N~b#<LJ
z1?}w(?|w{@@@GOQNkZI7x@G|w2vmo`3rLivL`VBkor6E(RqIIF1O{(=u9=}XS+o#f
zw&36`bJ^A`KLO#2EAU<}AbdbxBPe<j&;Tt!ajhVk1v%NURr}rqe1SdIw|ZrtmN3V(
z<E4fRwW?XfbkiV@0Q?z1aI#jVrcA^B<q`+mIs}l|DQ*_#wl|=b$E{sa1cF=;)QNBW
zCCGUPxVZ{1=kl<aRQK_Oyv`$#A+u{Z6Kcp-FD(aK)M;S7hFtn`qg99`a$~F#g7fjd
zfR=o$bKI&jJlUC_1IW}RBJ3(IwD^PrBvfN1&4(r-{%S&(TIK6>F1PS@l3`w*dqkYa
zw$UkCB`<>rs@xu_i!7%%&~x_)l`Q@0o2s!K=@(TZf~QtPw~6ucQ5#bTnz3MR&Fx$t
zys`uAn;Q##B@VCB8X^cE*v`W*65TkDx8ENZW#NC?jW%}eH&`zH(@mYiK_c=9PjgQC
z^MG&l{2wtoy>j`Uif}8jDQ(Dv&76>fa<dz>V~J8kbSjY+7V_*V<6X1WyezxM-4cM?
zWIJUINTU2tbbht9F|eXHeBLf66{^Ah<OK1X<nL}D17f7-Uv{+CQ>=~+(m^2l*yXkn
zu)N%H7v^mWJuLE2sT07~Uf~g}3~G$HCM=k)jM1#u$}xbWYP1i7-k6Y(`O9D4wsHI&
zbm0k15qlHbNLRkYWBlT1MBNamvPzV$dZ3Ek_G-5c@bdLx<6)c9X9k@zgtz%mZ<DiP
zZX2y<i7zn#ChMwFw(scBd8Y|F06T|l0{V_*CuD$65Fm{AkS45Myl`4z;M*x}TEj3T
zi=*vumlP1)&2e4Zw&TZp#6CEXyhGbv>+R~Q+xK-MJlPA9cEmNhoi)uq;5BfZy^X#2
zjsg7U7~mpWjThnL0YJX#=x6A>58FSP?@4c>^RAW)KqTp5W^4dv$fYfrtL}lx*|#I&
zP9H3TilHk#Unp+N%C13hE83_WYX}NZ&XIMfpFIt|XVCoBd6&7u(z>OdQaJusfY5oL
zkFDdY1pqFqd7xas*NDsTBp8}=n_oNs!InBn%jOTTh$}A*tU0~vt>K=MmYRk?=0g|r
zFuP8xb3jW6KN-=%n*=znmLb$?%V1}F@dgrxF8LZ@EE0hl^h2NFF6^3p@d;ES=kl+*
z=%1%~?`U<-LihAR&a&Sb^$XGUIg;GG<K}x%m@De?8|1_5dfaf8753=)9Y;|Q{ltRX
zM&VYT>n>t#I5XD~9Yo@I_qP4tZt<X38Do+OGkLwmj-G66;)NGcgiHQqUO@!-pZ2!;
ze1sk<J;C1S7W}P>^hF|O1PsoPsG^)&R_ju7?o3<B0D9|#;U1jZ8KqX9C~X5`jkXH?
zP2o!H`+|t~P4|P{v@$X4$y?`R#0*B~*Yd%E6v#`#ds;4x4-y*|09raJ)Q8V*rJlb_
zVk%N&!TK?V0J`xNy=~ze(#LnF{H`xW%{0i6Q7PR3PAdc%5ce5mc&qt+R$?5%BkfQE
zOt3_TZsrSckioi?KA_7UR)+%&$V+m0Ma3TDxjqMsAzU)o$<a}neo{J$muw{)--`us
zLBbJ#VD@h&0e}YR?Do@90cK-IqESt<Xh8ed0X4s()<!}ue4=r7d+?Q{-}BO6rKc>0
z8__1eKAg-~P|5~gQ@(E>SxP&xxBcSvi}#NVDZ%eVq8i<%ATj#&N^XflZ=zX+&#(?w
ziMckO(YZF$KJ&bnwQu?*(b?B+(~_N1&6d5ZO<s7|V@B&QPft(nsZk-(dGzro|1JrF
zdS!w&3sagFD+R5fg<fh8q!V14uoiVms-+XWfEOCo3PI8vr)oVCN#`(^{^cAWeluia
zIH#vj6K4sL=<)ezU?uCki*Z4fj|qK0SV5M1HQB+Bp_<eV0Q|xXK8X}YkZ~(D0vv#1
zVd%oXxrJrTrtnU{GM1$9a8UO3YvPTCnsMb?oN>8dmQkeFCke=VAD-}s#_eO)Og~-2
z*SeTv`%JJil|$(mXGLU#bfw{0j`PH8Cb9sGXV|8qY~5Z_k8W+0O)~B*_DH^oXU2PI
zODC+N;X?5NX_sebqS>y$k<{`tL#7XOMHlq)Qp~C0H$ycUdc7Q8uQ^FmmcC<R(ndc-
z8|hW5#vk0jFLs^Z-vv<g{w2bBu<-IWg_O>~^^*}C6trvbvl5+Rhwj&+NGDj#Pe(T4
zI7m%rWZLQ^UoeU}m4M6cwNSpgC9GbfP_()U9Jcy%I+n2{e&mgpTRo5R2+_OJ!J9I8
z{1(@0zW&gy?D&xsXXgRs;?azc^!6@n=hrILZ}Juw6cP#yo}JBZ4ZJs1ZAC(Qygk!7
zTaljrY;&I!#V#c!6)WRAcIQ>jhdQ^t%Mi3i|HNxqfuo?uQ3@@;RY=CCdk+hjln>}$
zXZ|i$l%OBrlVWBHskIE%a*sdODp6I9TJWi?Dme&y=o0xdBY#_?(onP5^kIh_K@T>8
zCcMMaKi0|nLxBJX2Ol?gO6Q7p>;TrRm9<CB2fK^b;jc~fsD(*Op~??d_K5e<=)<d5
zQC&m3CAoZ9dv2dDJNw${$elO_1>>?=H60zzFUJH^HMqr;+1Ve9-QkQws;aVY1jUyw
zBio5z%D2#ylfuv+q4LcXg~1BmYkzdn=I|f941)&M=!&|W^I%z~VXCJ@@YxQ2Qc`wJ
zI*QZo04Zek+H`T~+P;f+oWeIfj%}KDWwLsb4Fy@&ELHD(zQ;!oN5X@<dCl@&H3NT{
z&J6Tm{zU&Fi9*|zO1bAmz_%9%Rc_wDKb~1tWIZpRHtwQiZf)pO9^bP!s9Up}FE~<e
z?CU4$EpK|(^iclw>-HVZJ2Ss>a!yWq=f(;rY6Xby-CH_vpT*^^JbZ1~wB-I`l8fP{
z+3j2V(A6bEQK3s`ncak&c+;$@@gs8y#+4oKb-b6t5DoA9MjxM_Fnl6-$y9G;Zu-JK
zuAK~xCH!4XwL6)i15YlZdHt0O+Gu-vEjog3Mz@2T{edp^wp5NEqIItc+by@UzyAzo
z%kzk3rgxS#uBZ3g9a72j-sk}-RCf5u?(*l6;o+=ICT=K&g#~r24UfK}P{Lc693N_a
z&(%n2uk9tIEo5>>QHLKz=oeg3;b@&UbHs%@pjf3Ey-@1y=@G^yXKnpcFqx2kQ1VDj
zby`$!;|Uv6UqUxY-P-BBkzON-j2BY*#u_i4E-H!p-&Z}W6G&|r=h3V0o9Fx;xv-xi
z`inO@UMsx*ID#efaFt6=yWc?R5#0+}3H${s%-7%O&UNyrr^BV=w#}RO@9T&=9FA5F
zH2sQ=HGq!D?Qc9GIVm;n`j*2NvsGM!+iu%N&bciPQU8IT7z62<sTuw_^B=*EPALgu
zv)y&5@t%j4Ecb6=j*u>gqZT~jSy@>kYrpH<4*+|#<%k}bj)Zdz=hcSWnH!L_;(Vc-
z4vXPj{UNLF))T=(+izOMR(>9l0!xcm)BZN7XV&5<ouTpi+mEd-CFE$W%txL*k|O#~
zB7e7}QQ~e}xPnBKuRY`aTfTn2J35A~0hyEIw!y*n=d8+8)uER@V?H<@uHUXB!U=Cp
zIW&rs){Q@BHk~iT9n1O2nkYNAR)mp&!k%3kC-Slj=a|@-G3!sFc8~Nr^IA%vTzb#t
z$fi@Y0{eIsWo;#mndvxJK0Yy~xOHQgIO7_WB)2Rq_|(8wBI9dt*l#gZmlH!C=Ex>8
zBgLfAIMipB^Ugj+&^c)o#vUPj?8PfA#1ZRyr?l>-!D91f&8<RCA?IEjvTH3II>jfI
zEJ{ruF)mK`{&se*V{!1F97G<GR8POd8kGe*dris*iMj9L7jv49$XN%>Sf8SzqU+w2
zu;*y7r*40$pr7%J(^2x{&H-6xME4kqN+cjlGx4Bxk-{h=gG5p!#dswkG*)2i6Q0ha
zxnjLKD?)$QDd^&l4+SP_4a}^p?hr^^TpW69D%xA4a11%AZ4>S{M!Y*X_@j3#+CP?P
z_mGH&=5@B2iH_7=5~4!1($bFg`Q-$qKnt9;vH8==*sqy_yRG(b6grks9<nAH6GH<v
z(^~Zs^ra;~_6pd(=$0Hx{&GG|yO(4;+u*W0eJ|kU!QxSY3wKoY-6jH>M>FCnh&a;u
zYQ)pSgA&h)x_5P5!Oy48IU7O-oX&+ELPbV{{&`ma_Okcd3{;af;VSM`YKv3KZ&oKP
zb-%mI{6lH3URFWOpDao>YvfT=7u-@^)1c5ATH$0_$fv-!b?dr+3^?k<TxZ*q;<nOy
zNki#Mv7cvr&rr3!c`2e0<hiM|;PAs_tBoHrdWja*)1g$nf?Epn5a@hahTk?8mc-|=
zJZ%WAneF~ih@7i;WY77;mtc@~{)aBBYH(QkZfV0IQ|D&$9OT5v^ZsAO&9xB&a?hzt
z*JO51-nrgQqM|Qmd<iEzlJ>Y?A+pT(Z*_#xYiFt_5{W)i6w4e^=S+1#SXQ_Hh>9ZB
z#LqD0h^VTnx=FkTvb&U&lxwuIZ{LnCJ(0Ib`&=z5@yFW?=J+!w&+PQ3eIH`&VWR<b
zUAaWmcoq=RU(D=5$03@Untz%<JyTiMw%Lme2`RA($wJUfXJ!HkO@`{;ZsRPPeVfqh
zD}uthLgGCa>-g0y;<s)U-T7>{U|YWoVa*zv7tE@le}1jb|H?{ld?;)$q0fTd&SpZ(
z&`o{)aaT@XE`xd4a2T#L$5ncMevq?#s07Hs#>UBJG#w=64L`CTqJOZ;DNYC7k6Ke#
z9Fw3|^WcW-Wj3mh6+inMts0xeu~TAeS5a5~V9PfpE(YYKJ6LF#GvzqmN`F2rD<FBh
z<aius;F0zG=HNqQ8efP~C6<s_8!NQvJYhGx`oZ}9QwpB*ODm_qBORCB#9B*)ie6?)
z(}Z1FcWj5M67HFQK%ms&{fW)y*AEhqcwgIBIZ#wK6?3f6=9{cFZ}>k6xAp78`Z{0T
zBx&f$9M<o<{?oF$!|}J}PQ0bdg$bW9s$PvrQK@FdZKU4BMDrcl`0+xiDQRd@%?HpS
zr~ky6bdy>`nz|<~-sbGajkOiVS2uOx&gjV@mlR5R1Iojk+#GFST1FdnC+d~ozIpSU
zp|ibxUeH>hxNobw;Wu|F1|jnaN7n5*SF0^(hTw_QjoIFrD>N%>cOw_J%XzQ%Tw^kk
zp@dS`=SMI_6P?DTPw!#m$!9Urke6PvLotO0f}OVaqnL&Mt)wDZr6Pl~Lr4vxG4Ast
zbH(zAKPtu^h`rWKpupOs$)?Z3WZ{+nv^y=hn^>>la!Ziu=W#>~v%1fd$KP+?#q9kG
zMyQ<k=3`NxLh11{p4`7*e?3I@@N79iPlxB+;fylr{GWbjEu@2(y4NCb(6apf6OVP=
z{Q6IRA(5x%=zeac2fV?dq1B%3Vq%uf7m>s}b6q)#@(GH^OATklVU?6#4-FtdhOGBc
zXlJ^baKsO<diW9Cb-k||)1pIWyGf+9*HEYFG<x8#@y>4Mgl_HDZ)g*I?bP2W{vNH>
zZEsLSXDj97wPx&hQ^PdrW5b4;6YJYX1DxCOqwI*O+VbB*9g8vqRJ@6H39{<UWRlp?
zWJ4{jLY7(!lqTwcaIaC<s$vAVS~&DE)fzVX9S9(C&l#jI2CJTD$&Xu;-(SRGtazdD
z?5$km1p13_=WHYo-=7Inl9OXEoKz-UxO-yKE`5Ar$wTz(nWux9YiwsMw98kvOQmY2
zCDMKjZlYZZi<zER?j--lvf^J}DjPZ{CVL?c5hkcsAinhX5xyq`!fS9;aF#M(>#^<s
z$`D_?BfHwp(U<K(?eTX;CU5wMG|f-P9JH6DQRhFpGbwUr1~&Je2LD4xF_JDwQr90H
zq}Q+>xJ$fJO>k60wD^B7V#<<}mz5eJlq>caGImZeYT6pqVEWm1gNT_4OZU3H&l2XZ
zSd%uAth91)CS&*RPO31sNpouk!#gUBXM8tj_sMihK=Y$qU;Q$ZQI?AZaXX#dpb{lH
zxwQ)wT{%8EJG;Fz2I#*W1aJt)tZE;??9%1UdJT?yRANIWw)m{pj4QuLxt`3P6&39?
zG+cbe!|m^v%{O{FHvD**5sz)FjIi0Y+GGeU8ypO}ET*<e8Zy7I?i!Y(Cw@VcE9$}N
zH10M}aum%htFY`FtPuAz5B5|0aN>5fqVC?NP#BHqtmExQ#GSV)Dk_DT>ku?ue&MW;
z8_m13A!9bVy9{!&4i4pOp0~{gQc4B&r+i;4<-Se**H2W}gJ>$zPWa`_+?1X!50*{6
z%X4Af0~ANkJx~pGe7EZ31Qml}bwv3W(_moRO|dXaK;7SzD&_sVP6)fB&A&$@bmVv#
zlexUCd~l#oCf<Xn;2a~@1VwzE#&VHICnv0#>FIyT<w;6#W?3J!ss9pQzscO@W>Wai
zps~B)C~5>-VY%B%@@{VgMn!u2y6=LIezoy>$>?bJZj@u4gcST00Q|0B`({e|&s3T#
zjn9J#va`mjU-Jb4#}fAR^aPPGJkWC+Y5+E-*AQP`ULK2GufIV=wV?ctPQrXK^G4d_
zWOx4ir&5NPF*XM8zfyOJ?#<O+MrL(J<mH)xRmS3~{AuKe&dr+Gii+RkWJCci2x%X)
zx^N~I#K|#j3}g(n=y9PQl1B9wTjr>^e~d?Tf(V5{QLL99`fM+{=`x?|?_`EIY!3G4
zk+@IA%RE{M^K?X?=e#^BB~@Ykf!|Oz|30%GG#n_I4p7|=QE;k=wRqb%r7l-UrSQ4}
zzWZH^VVN|l*?qlnp)rrdkzrKzaa{aF;)Bbw&ivDwwOGxx^Mi$X5@JWCu*HM3%t<kR
z?&mjhrng0hBQj*O#Xe&PzR9bXITsGJ`XT&QSjuH&+su!rQ5N3~Nh+(K*Ya=PHEE-N
zDgXGfwGWtGkHg!_h752(9C)vZQy4!=;b=QCMlX|wNe6=v4ws~_<To1#e<Wx-H*LrT
zO)JYViv$e;&NXO`nhzi7z1-Jqh(mg;EN?Ib3L8KJR*n|Ir_UvCeM)+hqfsRB5h^b3
zjczL4n$DSJhp!}RaQ>Ezo@`}j@c{m6=S_cElZg8#yQSDUa5_W(m=v6az9w;VE3}UY
zc0?T(af~;dY(YCB3cUHg53K7pmaZFmna<fk%R0d_ZtzI+!p%*1`5?LrCMO^Ee7_|K
z3MdB*%iM>2yN6dl6dW1#D<P74lkBhyYvIry1mDThoN?zUq`P3mEFw*0tjUn!BqJ{`
zukNq6fdM?Jw|JZ@i_^zI&}IvZbQC?`FEM(>MFrKd9V*%cPR%>Wq7TYjo0;q$ZMRFt
zVnXFQKObLTligi<0sH;*Z);j{K4*Omk<zA-E1!*vr0`-{RqE{yv(I};>}DIrpq~(C
zE(@1_Nj26<_In~HMjy>L2n7GM?o2mM@a5am$W?1TE|4zfR7!CU*H6$E?}$HcL+@mG
z*iNXIXcbAkZ`eu~8P!^RGGRvXOmTZo5)+o``#R}#o-g(N-!D(O_3FXkRXiB5HdbC?
zs^ysX2Z^sT-!r5ts7Iv^I6W=m|4r+LQ{@a~$?DrH<bB}uMjbV=fE#sLaTZ*Fp2wUS
ze4Z)(1>kf{-KA@PbW)rf`ZOdQ&4323l6+*!;zt1mZd~jA2Q*^d(^x$n5IU>qIR=vB
z(R8i#%~&dD0K_S0yhHW~TalLPxfY<~ge6xUUV38OF|RvONPG%7<j?b@lC`teGPDbZ
zJ<pITJy4(hC2ApMMy5cc@7Ci%=IZObdXEIZ=rzKoP=|##F8Jxw)G9yy)GYM&M$TZw
zetH2E>R6h$QFGhG&d6vev)ypAw!X`R2D-2sQ#d{<*!o3)W}8E^Xkr^^Fg)?=^Dn$7
zd>&#3$E@k*{;_6}%R1-;1xunmn&F*tpE*jO310e$rVeEfa10xC=TqNHq*fBJ7ML8g
zO8EDqcrZ`&;l0G8u!316v%ue$yGHzwr8={E=Ql+)+N!DtNj%zCCAp<ddY{h(lkVMZ
z6;M*9NKr;_giW>X(O^z{JAp^q<sjB06liq9AX4SoSDI8assCrJ2pr+_$>%hkY3u#^
z5H8^_K;JAbCEDq-rJa5bmXKBlP?qDwV#F^f7CQizmx1TO8Hjc>jWfL(8b^lthlhtF
z9!Xv{*~N)^`xBC|+@lveM8p|v%!)EHF-Zuq>M%w9iUkOn^Vx(8^y0vbTkR3dbx+dO
zdQ}Mr#OxWRB)GWv_*zCrqObNA&@C=EUPm6|thvnXjlu$JeOA_LA#9S*&Bj3<mx-z6
zNlWV#Xg1B^L%42TVhJa3l|x&08D(YW%fBpe-snD1`O@yT^RejtBT3JlB)d3$cyhxL
zO04PMOql};?oF8LeNu3V#V|W>QQTiF{ZI({U&QuSR0!`qdOxAf6`p$m6nJLg-s_`;
zxw5kU^75~5+_;hWHg|Nis_~o{WS58e>Oy1QCDjmv+w7|=bwMUC?jjH?D>ikw5%!0H
zXN#>W#0*kmHq!*<&xgQ|*SE!!-O-sEH89fh&GnmoVL6uH(#)Ln=f<8Xx?sc8i6sh>
z)#mnD$*HMT-+yYH8OvGylINJvTIVI|v9a$t{ss8D^pX{6N{kb6hTg_wTZUHN1+|Z1
z<Llh)G2QX5w~vLaY9pn*20C(`IMbj9W1T2bQxyvd#^z@JFA|5q%SocD7x^?r(gW4I
ztZc3HEz;aK3XX^nb2xe&Ctf~e-e9#lck5P0`Hkz>P1JdxuRoh;62^Z)+lG!6&(Zm$
zWTtKruK3O=(wCEMJ}LPIzki>_ff=gqIvzmXia7D?+4ryuGqYLE<ZLS5hntylbdfgK
zzI_5=R+fDDBQcX7daPCoTHyT;1s2e@4641;O_>~FRlX#xK(ey!05S!X9~fzXyq)=D
z<B&u)3i|<`5sn0oyWCG{oZs1C2u2%N-zC4Fn0HeGA#{$Gft~Mxz~BV{RMs}xM1(Xs
zVg@A8X{>#nrZOBcQrOiUQKv5f6Z#wzJl4o>on{g`>go-Labvi1Bq5B0Lap%hnXJ6L
zLqUpytX!4@qb12TJUkHsH9gi_`>TR4sXHDtn|z9A%G+hJt^A>$>*4O{?uF@+;Nfn%
zz|7=wxopL!#qqAt-y<7R8)*1}4ExYR?EbmGNNHWA5jPL(|9+GE?CcDFvZX}TpW<$X
zw3;2Tq`NwSAPL|E8n+RDCV2}FZ}E{Fx!QZn;p%oT4%U=Z_NT84LIPjCn3RyZ-0(|J
z7bE%;uixm3Me)KdeGf!>J3GzRPu`L5!QzY|z%xGG$pf&!M1I!qp5*~4{i?;4`k%$(
zp+T_oSz!bH8rK|k4#Y4VZ0gLcEc#j~UtDbde-||Y7ybA}T{vIDBGg!YJHCZa)=&A{
z*D`8wQtU?sZI^1cJ?rf$ZOE8_A+@9cNC|VZ{t`Ox*!-*)#oN$eff|>i(<qjhox@#t
z@9uP(2~1ITMo>4ppgd_!y|jy0TKCszOC6KxXB$jua|!YB@RB3Aaf8>ZpC+cf8F&_8
z+Ci30=|Z!^Xl=<9wGqlf<RM|u$URYn-5uTJfA@^J^9VWS)c2dx`oxkaOm2nNY2ggm
z=Z;6}DX~5WQ~yZard+zqjoBjTq@$AJ4Bx+BTwkYpL@`-uM&hJl%H!$0cY^wEiVjOt
z*YX=bxLV(dzyphmz1#XxBg!@yMD%|`LyNaH^k2XB@TmKs?YXkXo%6xMjwEa-f6UTF
zOkX=;t9z`_(nS(BW<!#jJ7PAFlau3QM*=i8c%zjERyjRvKf{B5u~`N*ttK7a%u=)(
zRu@3O&`Huf)pl@jGK8{3wDLxHc%1D)_f^TmI-dilQtx1dFQGU5oE=CO&39{9(by>n
z&5B>rN92%dH{lK@*ickoOxH)fKo=nz<lucU1)`5&TN5<{YAXGgOP!R}@M$rryLL@y
zV(3j7+Uo2b#L^Neh2Fq*F4E)O8F6uOGjMe02yW3h?PP!=vx0(6v;NfL>a_}e{e-UB
zozofuJiNat1r5IJrH}E`*eFpfFUf8NtF*17PLHAZyC2@lkyD48Fn@lS)&FT&^S-e)
zQl?t@)~zJ<moM2O0;uPG(2c`<RG@4L!~{fCUR)H8*!^dBQRCu!+=k^9&p{WHuS%Vq
znpg@FC^4LG??JaL->a)%oWS;W=W1|y3{9w`{l(#RT;usT(08e<DB`^SCxYY^sP3y(
zA>sL0TU*|#R#;XxXrZ>ZP;P8iEaTI7{hAESwR~tOs#7Jo!G7uINDv{|FkWFp+2ed4
zHE%!qL}C<;ISd`BWu}>`vqA@kCnbH7AU@q_MaOa({FS5`-E?+J_4-4d1<E24$!W-1
za#&iQ4M^dBhMNys56ojD2RuLIjW}$M>+?V{T{>SVben^|1sg!Il;6Ip{oV$KUChCA
z(10w&ee@qGS;)#5B;e%|h(J5T=r`L`!K%g+5bwP&l+qQA+#ahWjElYYZ9h6v%6>VA
zh3riqG4S)HQ=5K3*qEZs$GREne)aHksuj>DJzsx6Y=q1cnKO=*Xe&p6r%@MVKuFAr
zZEzIq{7g%toQ7#`P<fbZndS!2jWV$+J7JII>pa}lf!ej^A&pq4ys<5=Cg&eLrk9tO
zGT**|9?~d<wiuQAo^$jzWdA)`96i{Xl9G~szSmY(#4)GtNok+~Qolb%Z^px+s2*53
zJbP0xwGnA)44tuAa>NXRj<w{x+%bx2-fM3P*<ut~&=0S0$r?lGQtJC(!Qa1s&r^o3
zUIc{BsyNik_}ye?c3z%5J!kN#C`6e`^FR+nwDs0HFD|_DR3M8JE={@;Bfipizc?+p
z#{gRw7_OV>==r{QJb#RObCbG8O>HlYuS+6>j*1HMbhE5W9r}HXFXs2#obLWEfX;dC
z8AyVBpG`lOKOMRd7S@|6PImRMb(pxQ12FAvvU{`ep%U|FoScvg|E@k-V1WOT>b+vm
z`QWiLc^f9CqB2nHgT2|=0T7=mpuaYe;Vm9<%tjq}W__?8E}5zWAZ!*kLqTb0r|7_-
zpsAUzO@1>H22o3&rw>BUkC2<m2O4Y?cZ`jVZ<5fs56l^Zpi{)PcLSdQ!@}(B7}rC)
z;s}O==TH4IUki+Nq8Qs=@)-$24OSJ8XX2ev*XjEy=^u2Lo4WSX5n=|qyVpbrsL9B7
zUf@c0fScfuOn+h4n)_u|GCna8q>rgkuSjeQz82{<xYv2ZY8Mx~o7&>zA4=hV3~f~D
znO*yqu99W|6ta@2YITOUkMmU0Bq7L#N*=Ho@ID1nzbrGosD%j^;ab5n5k2dcTw$ww
zDWD+RoXm;;OY~Pq<=b{ah}Nx|HX-iUV7DQYo~0@&H5y1ScvKV8rGL;m7k8|kZ}kYh
z$RrC95n|1iX{~rn7Q(8MJP4|Ub+TmsG=Ig%V$gfrMVwbFC!X=KzgS=5*<?4R^rVLM
zKCsxJa-N-o!?r<nDgdI{_2ZNLm;Dxzffw}-3Qwnf8?fWFvw4I`HP>Kco=V}lsbnaZ
zH}BpR=I8(R@4><XJze(3$0`Cdl(nK_V!Y1|V|sgw4jqfn&OpT>A))AQ=GCL-0y96|
zhdX^0!7k88%t8k|^8}sZKbN`h5GT9p5xNXdm|9lEU28i$R34LpvS*i?kD=zemO3=(
zRDHeApVx1rBUXk#fb^+(?`o!ATbrz|l(PtR*pRt81!r$m(pw&@#lOANHFjoF{e69N
zwHAfVpFS}hx;KFDg$Ca;iv(3Ce~j08%=D?iV7}hJ|MDFO-PREcGa3fI!9q6kV(VRI
z+?<@X*O0ms?h^AW{0xxo6rAIp*Lbgd9R-=moHhKNv$8NS?5AGJp+uJkO&K0}gjg(A
z%&la4wO~YJbqygtn>78|b*N)lE#v(&^FcgXEHj%SH#_@t>7%2f>2dd6%sVGAt*p`P
zoBKnc@caQKB^AYkH3ULb=xRBBt$+O3-_py=>k?yZ6N#ML5wikOs041AGh84$u-5Zf
z4Bau3t9)iUmRL9;l0pUoCA0n&*Ra(@I;Y4IuIJ?_0Q@;x6ijSWabIQvV@#FtezHK#
zs|oJiE65hS(GhOB6x+yU)?`y8_ux(dkV&f^QjwF(HGPpkvek<UH_Bk_>eAw(<)rv-
zGvg*E^yz9$o?x+X?9Q|o>!X}twIZ;7F}KSW;QEN%ye*V0<_)?p%f6+2taIMvLwC&2
z&u@=k@)->iBqV76(Z!sfV=rg6%HEgI-U@ko)*XYPt-fy8=N%3VN*c7-u3}TBK>f<2
zow3dOP@tSFG4`V{xJ~1Y;gP5JtNMyxhVSolM}Ce3^ekX6gKS)-6Y^<{qM82H8cyc{
zKJEul1*D0qXesf}ECRtzv37Ol5`jAi`9MTs<1QUr;p9k6uSg^0e5>;WAob_yo%r){
z*fwtJqgImYlOSlFbGiN-bK7}EQHM;KjNnj(w>w_wkIGgd$DY{bfhOyn1N%J90zm9i
zII>AI9D?9et)6aP6%b4jb>iXR7}h(LVr5O7L+5K2pbk-$PL8&qAU{F>CK%q|ko(|N
z0oes9vDU8khd>(*1tjOjXWr&$f?Cs1O%<JY4h=_X>vX|4lLB8neklHhA}&@wg1#nE
z>#PaA#zHsQht+|@rKGX@yM?6}Kp8IueA?6BU+2Ne!pbTp!Bqr21oXRyb`Zf&#Xxsd
zKf250EG!iIaO)5#(K`YAv@+0?<c3ZM9l}$fOHd_EbmB*QCYQ9dG|B;NFa5qMow-9w
z&N{aw5QjhA{0HRZ+m|g(*;bK<AJOrXlkqYHgxNVc45FU1OJO45mhfC;UQ9X<kMM(^
z<e9v<II6fWVa<b?HH<Fi3lTlc*^0#xDrNK7cz~w{F=$B~uUf-O;s@EKGSn`tO5r9G
z+SSvw7Cqnm-e{`)X(M?B_Vn{C(Ex;4iftE_p{V`sAnNcA--~OgSL6wbN<DXoLLHq@
z$kjD51lf{N#s`Zrc=Lr<XY|OZ^O>Wgj-}3e|83ya;^SXxmL8s6fB^>w@4rj>v&K|<
z7YtT}^4d#t{2~s*QN+KfESh)RC?S-zzJSlgoU6^5Q|xd>1r9D<x>-8&aNhg;UO$Ww
zXR*B5{QVBra9dbli)DF5JTVfig5qB@{kw)anrR{)TWwuxj&)ohyk%w<dG>5@U|`~c
zpDIN5Rp4C=s`R+Okq2D1$^k6P8ylZg^ZNqzVU`QNA9XZ^91g3Fp(UYVVfI_KTdI0R
z@h6K}U{>CF49N`_nvq1rC^(DFwXBs$Za9NG1&yJ?(!Jf?Aa6ZdpFftkEo^Jh<PaSU
z9D>d;YU+!<z_Gu7@!ab4ax{g9bHJ&ZesB56Tlxj+JMf5W!VO9n8eDYsOXuM!Vm>Xu
z06dv2#-j^zkO|KYE-Tmjg{LTK$7oBPxH%8c8K7qCA|4PE)EyEMTK+FpqMM;zCiTvu
zQz2LYN5;o*H2d8=*_-Ix0$Jp44!Wq)LffMoz$QGn!|y+M%|9SuY-a6fvoavywGfTT
z`f6C(vonCN?-o~Ve66ZF3Q@})(}ic|fO5Ug_@O6tRlu1`6ExhF$s;1Zqo@!JG&=nd
zI#Wt<KT}SHlLpy+Cd(MDaX0;zrjL_iS?+{9efsp@p^<h%w|3msmU?{Me~`&PFmQC{
z3py2}q)GAMK{(9qa73lw138s<jesEexqy{o&S4&cv*~gT24=Wpqe;6#6fGFRJ%PP6
zBTAvC0I=WN1ogA8olZ{C^>uY2vP^|vZrlivkEC;3cG+8919GLnKLl2kULxM)lDflf
zXRuI<#K{<h7L+_!W=G)u)v|i|a*G#J<1|6fqrd4~UkX}?&jvURy)LKnQj>RgcjpG1
zu}a0`MLLbH2kV9$6nD&yH}7~J?>x6$wddh>5u5wT!lMou<nfY{ek$_MH3|4fpyiDJ
z?n>J>2gP^rJYcTxOc;REr;;d;F&-<I^?Y+*wGhKHSpOzx7$ir;oy`|`c*X~sDz>`%
zQy{L$-%Y=WVaJ$`KHc!=W#u4Jp%d>m;qxv(vLgKR26vS);PDyP+8Cn=*C~d3i@WT>
z31Sf%U!<j;lq;E?e9RkTS5&09^BN#t8QHC%Ktpq`-+gBZDMa<P$N;-thoah{;|4HN
z(AWEV`tRST2f<*wLcj|I#Wm~mc{;_~W#(NK3|bBQvm+}Vb8|yXhQR~?Mgm=nsIiF!
zvBH*bN*?FM!Xkh4U`X@>G0Bgm7Z<*T6D5YOTjMg7t@06f0(|}bm4&7s-VG!mBo=K{
zzg=4k>70|aAH?hIZ-jO;e|xcia1qc?M@D)(pyeCEIjQQ_u0S4hA6dxj`Omy|cBLTd
z0Ox6m!TAhml(!O!R$ysvmH|JqqctjfSVEHBx$RY6AgDOadfk6<OKj%ibwah<f)Amm
z=2Hp=?~27Nl?QF@?aHan3;9v4fRYB(Ce$Wd3DEEw)Hi^dAgGWn+!67cK+BHwY92qI
zKKpMTsSLg5CRZ%@5QyoDii+Xkisj{HT46hY<8;7cyG*8`i-WtPRsVTGgxX^#pB}QZ
ztt$^NWffbmQR|dQd3$=eyWb!B_G+9`lUDgD8Avu~|N8Yy$LdzXo9v&k&WKn=<|H9I
z7tBL2aGLA>u0+J47Dz^QZS)Mow$FJhyT0VnzZK=p&P_4<c(_y1aJ{x-_ij6A`Y@;v
zc>EW-`1KMWAK%9ZK5qbe=;7dWrl&`8#OSDg_@Jj=^pu^QhlhuYOU&mYyReT??4b3N
z>)MX!!dDDGMj$l1RsJV2gT*|3@}!2Rr<|u}pe)mEBBJBNqhAUvmesjcRRZGTc?XJm
zUqg+<I(Bv*oeY3&qnQ13jh>Wr2w;05Pr>I)PHXD}h99djTEL@^kIx5lRF0d0xVs;1
z3}OF88OL%fQLx~wXLk^r)RdGK^B-rL3>Ux>7@IBA*U`aDEYMmS@H}}^`HkQvo_Wmu
z`@V&tw@7N{0ONx_?%ONnI!zgwrH*&H$-|Ui34jgVohj&(ykk#^vz|1Of<w6SUZ#6{
zqPGCiqJlzjO$`;P_x>e}npzw1;?!8FHr@kU2^cZ5DDq0q7*ID;YtN1t-}OMv8>ijA
zbGOP;O;xqI<cXx$syWyhljT{#3R|pn&zDO;DYmYl(8j&+s=u^&=^8Iz+$xE{B3c9e
zf`0z6Ai$dz`S#+O>0uiPHngQSH#ZaF<6p2wS6*v@A!!t4O-)Vnlv5lOgT8Q7>*S4<
zSEhs65z?U-aW`+<H)1LeuH|L~Mt$b$W($QM&z4tS`a|&Wif1-dpY#nqHhxxS7@hF8
z?WVFaDLwr-*v(909*0#UT6~aNSkgpW?Br}U@K$VdvH>EhBI{UJ^o1ZpAwGU`YOCw#
zPqMu1zxa6O-v2$xi0>5#zrk@)?xYoc?<U^g8z3k5D(LR#$dQp@s6ibDR1!b9bv=z+
zdpZj;@t2148J*Ka86&8FOP^q)liK=4+y^pLx$jaw`^2Xieu6cMBEldxqWK_dH5*7Y
zI%b9$mK(KR$1_g>S5pG4kVlnIwKPUHN6c*4vIy|ZkI7)pvGs34{-sagE_!I3QYllE
z-7ebL^Yj3CTxk_2%OnOt`kEH}4cwS-)a~p3#u2mS<vn&ykmerb@5+IMq-2U9J>J(p
zA%;-$uWRJAx+=;Oz~K_=Q^3R1(==DO1^MBHuzd1b9>kCo-vK;0RL&>;i24X4eW?e4
z;$0C!$Ul5Mnw$Loi^JBXRDua_lm1v+RW#$_)dHus`*j8|gyBO?>cIJ}5hm4d^lVH|
zAFNB+<~*_tmn+s>fTz^k;beGBrA;fki~Vjk!oN&~EN3o9uJbx0ALHZcJO`F$nCZzA
z>jscvz9EXi$8(pUhrCx+9eRi*p_xqMmV>Sa^ShCVHI%BbIvIm8lCeb);-%ZP{8Y8K
zSQ1hTLr%>EbH;(F`TO$c8<52%Ri&RXfwY5745X%J>v}Mstml}T(DzTn!tyUl%GQn^
z<Kayb;WO4&O+M6x+;ZESn=pBTk7uvl{=NHa89*46_ZsBUws0S~EMVX=%5y`0jd~K;
zGl$qY0331e!HC7UsBgqQpi^6?Z}IhQS?N>}LVUu*OZ;%|>OfZTOL7gx+4T4L`1m>1
zR8Md3XSZ4X278O%d{VD(j{!A7Dy-9bK~*EHb6}tbgusETG;{*?c%+n6lxbqStDlc%
zL)w>l^vN0}BtcOf<an!Dsz9@VgoVzc1T6O|np?M;T|#6t|9<^iZy@RZw99`L@M?Iz
zOLR6=P$(OV_Qo7-jpR{58eDhn04Vk(bGD%YBn&GDBIzaho|jkZ@vI-X^Ge~Y)ty&k
zRtt#<{g;-Eo|g~FI`5p`4q8xX^*DDQ@Vt0l$QDT_J){6(#mAeb025R{-QIrZx^KO~
zT)C5*8Zp=fF*Y-Be&FFrNQ4FV8Zp!M2)5;uwt7gU{?UW1ZXDcnMaYU3BmXvMOHK*`
zDC_RkzyY8!ar{%Ucphve{nBfARf50|0V>wsi<ey>iAnxlc5VHhr?-x0y|MSr>!)n4
zn{Q=7Ps501bw71}ma|SuX0~j`d*IN}DT>W1+z<lh{&A{0a%R>zpOudf<gwH1<neiy
z67tgGaR))w@G7SXBxuWPum~c+<9_?%#S0L`snuJ`pjpd5CQphQb+3j<(C<wikb{d1
z)H!vQm(a)aSuCdG1B`qrlSP?V`WD`xkm$kuDpx$?^@(GUP=gzus5wPm!%Jr=$j=vn
zATK7LXI;P699uj?hm_}t0R*ys!90eFasuF+-x(hRd>_vW_}*+PDXf`ld5PS0Pl0oU
zf88Ja{u4JpKPNwbAs90rUN|v6BWRPhLT$FR_eox*1*lK^B*9-@z0B!v-2#6DUeizi
z`zm;6Lviipf4}-Fbm!`;;Prww;OqVW-lc~FWBcE`LAn180{oM#`}eP0GvIuy{(t|S
z;^ZuWc>r_D6B7dQvd+XTVdt)d*wRDqRr)6|1+l<8UWh<F)3bKx<8LO>{fqmES<iL_
zNJm9y{p#DkAzICQ?qnIAlgMFPRS8Bzh-jtrxd*6$sAO<>`_)TbYnZ>i>Cs}sBYNd5
z@*0v@k{tzEO6q_uY*(LTa;!WV0|)JJNHB*jVwv!2{DU2gkDXb`qxO1@q#}uzZr|A9
z4|{1!eIL_Lk33#{3|IK%)8V8?(mIkw1fR@&Q@{3?@{G@65r!u6Ufp?xSQ`-}XeqP%
zqBI>))`@&YF2Q!v6@PGV;G^Uk`91;e{3|nS8IWJnintk~F#Wt2eE<Wcz(+bO?fk<?
zRf(t{!Bug??{qp_kJmJ|VLz%!4!qr;k;d#chW+=L)5BlA_{b(xMipIHmDSiJKS-!H
zCni5S_80ZdM=J83Y2>?`a!`53h<!Guj7W*oR*O0uR^Ms0zR~XpvSjNd@R4&WJ>sV;
zqg;x?!M0Jf<{rOOyh!hav9s1#KT&L-SK33yklS1;{pv+;mZ!vn$DeLA7VMA+8FvU{
zdNbGPBm8taVOP`nwZl)+zuIY=oNE8j9j1I+A0tA0FP6=0!*;&hGlrM^yq~_GKCVbQ
zO2|QVEevPcdnyN!ObT|FNL?7o+M&zNw#r_Yl(epiI^KIByJak_s7d$X(&242Z$j`a
zrcL`#lxxU-s?=cq*!lpDaOm;XC11>d42r81e^585aCW}4;&aE4gYUUqdt&wu6;$Y{
zpk`@zAnUDJW?6L~#>S0pI=Oc@NH_UID-16ZhBkr~9xd^P?N=HHU-KE94UskZ9LBP(
zQZ|tAcDzUO#ylSr-*1<lS6OmOve$SM>hM*V?s`G^B0D)TMm3D`MxA&&opB*KA*9y~
zb=4B@F)b3kYGBcS^157xxy0-Q_WY*ta@4aHm7n)*U0mRidWjDi_tE+5&QdBAOKh7o
zUEb;vZUt3J*B3_mnn}e=$*=ClJfzH|>Vd8I@~oIVS=2zUQJo#O`+!R>qdNs1hx{y8
z9BmEiJtai_g4H3s8W5R*4Su2<bgjV(8{GW%1{3SzPVrBB<AQ(Ds%(zj>D4N?{4%@|
z9L!5zNpfaO#>9uEWgv^%b264?luE3uQNoF~9}Ls4K(51m7)U{(7=Nyh(Xr(QZmpKZ
zpImk5(3{2TXK?V|<{H0QZG#;|wM=-X<9!i_v=a<0Rn~!s*L8n_uU`&C9MsmZ8LFQ}
z2~menb85d{*d5pJs<8gJ_o)S*@?@97)|R1e>ju*Y23YEOznviOwrGad-$FE5)bd2D
zDTFtu7pg$9`dU`57%aY}pJPGSeULH?%KW^{;|r=3UX587@yAjss(L>bl9y~HKc9V2
zHSO`rvD`x}BhG`Lk2}`6$g9J6F-?5)#Y)WQA6~mU4AqGDi7SZ0i5%XhyRa?njX!cV
z5$C*mzE!gEj70$hz1=B3uJ6dcG@Vw0hpJy1Ya<<pY8epaz0j*a3qzn-nN-V2AbQQB
zG!%j7o{}Ozf{$LCwo4<+hdwxAgh;zEZof#Be%uRjW0+3}?p9g&V(79>zV2<vAXnUn
zb0+9iB9F2hV9EWzUamSU%HUgLk)p65ARw{80*iEsga|7xEZs{=2!gPbvZQn@A+fXw
zBBF$Vph!0;T}r5QE3hC)N!?lXckgrmzRz>#zwi5I<~uWU&cu7(GiF){Xn>Z(?!E5R
zvya$@G_4S}V$9v|pYlMn5KKG0PU{E1)6R%MA-`*UV+hP;vuL-7JA~0<DxhcPa;^8>
zEs4;hoWhi#sMu-|deiFZRa2><J9`#l#P@y$9WFbrl?ran>>8EhhH%QC6vwWGz=9U4
zhX{i+Q#}b6m+uj$6Z++at$}9)rFIG0ijo`h<4O!S>@Lg$)n8<hbE&CPCf^m^nxBpD
zXR9F0hZJ~f!~mZaiDGnk;6R4APdw2$fgZAINjPj@FzfTzXY@Q}@9iF5*5;GrV19Zk
zql5IuIn?{HzMz7y{yP4v;Y}L!hs~eky+55J==P@5FQkYg+B{N8d+OsNDI3RH=u_O-
z->TXVur`>;9Mj^4C;P@qR<GtQs>AhO!=Q1#zU9>(X}TKCso(ToUG011ocw!?8Vc#)
zex&ty5s;F+Ca3y~?{m{$jxxYb9vtn2hJ6=r(80){h#dR%bkW5WGg7_1?Z=tb_tOFd
zJmv%5i`o-1o?jw!ifi`wdajczu;+(5PSm)BP7bP{qQatN!vv%=dyb|rwtwYTE{lrX
zgXT=F(i+%Dg#~%6+bG{OSFsw5@&^Q(;&H!l>gowdi$B{H-7WXc=AV8SD~HyW+?S5>
z%mRk;?Z>3=_nEXUn0NSm*pR;~b)C3O1{z*OsT8NbB15lo=MWq{ZOl-KG;A9`&O*g5
zr#*M^beHSiYM6BDC{(L4@%U+_QN4aLbI?Zau;dCYtV%Hb)yn2+UU1Sqhd9nER5sH0
zT`Q5-t~sjvxLktZW@okB*k{;MGT6<bSPgPqlG#yYy=3g&mGU-^MH7->n2_Ns%C+&d
zbAfS)75Ul(4>bL!Fj<>uP@b&Nn;SGCYNmU`Qo9M}XE8wAE1UYC^6R>>o<G1k4~aXW
z*7DRf_hr26WWfQ#t>Sk_Y=@*Ur7cADMZovItuRXrFLb-P=&QgN&TKg(Vm6Ir%bU<D
z8?EFQ*`ckUa@0bphnAr&*fAfm=p*;>6{Gc*AJ8h3!X00^h*}ox_O`!rU^je#-^S7(
z_s8)-D+73)s_Up4jP>vH4q*nj8!d^pdhZeqjiHT<e1|nJMfE!Oye5R5xqR9x=t*QG
zWeR54ynDu-Vajyz;1?g%TB0VnztXiPF^m5gQ#tHW9&|<iwx?B6#$mtIH)#wMI+TSP
zUgE!X(?W^8`n8MMekVN?66%GL4TsR?juc)nBq-ZN2`sTqL|}z(q!!9N=@QTAXqxXo
z=nh&LQAq1f|Jt2ys6}}=j<bqHAlh~d&Xcpah+G<d+w=CdN|*^&5;Y?5I8uTalm2bF
z#DHK&?`6od?Z(dB&&GG6(5w=2b+{yYGVXi=;y2a2E;`#YBX<~TzqT!#GIcJ0$K2XR
zCa5-vmp0=;CMEC47o2)eD(*|&ZDJn`)NpdV{@~~nKg@&=P1LmFM6uayJ!U8#vwXkJ
z`jPI)l9@MNH8OwiRsDEsn#qiB&AB=^cG?BuueQ1lI3&}|lB`YIyZhXh&>@(8(xJDK
zuR^aUZ=pHkSVb72mF`R6fQ|lWSLzNAKF1wX_~4^=sl%DG7>G`!*0Oz^Xhu}j6YRUr
z^dDTK#Y6QH@lE~83i-LF+1G;NV!ZquB4{QXYu9@UJegfYK5RP9;5#>5U`)|TA{9b#
zhFgYx4378DD`I(2kndWE*($}Nz<7S4;$v-RF=lT+1=<8-#Q13?Q@{cV{kw&sZenYJ
zO9D&rT;rZsB93*H81vN$?*`j#&JwQGD=ThB_Rt}V{+TTLcQ2c;Fsk~yfXG{BMLP9K
z@Nne|TW-z9L>}x67dsPs`Ld3VQ~a8ynsl~Rky!`X$0vJoQ1=sQf7BOnhpC-<iP+Nq
z!a`@VxYz0Qv0~FCK!<ESk>*|fCeuRW5-}B)-qg?as~bHSP|v*4<+a=V6Z4b{7`_G!
zU)FM+<bH7TShv~f&@$vvm)LRb8SUjci-6lB=WeskCTS7}?b$-pd8=d-&=k!~?j-Ke
z2)`XZ+3r^g?(zXMDujyZ-u+u=Ey@R6?9#Ity^KiDZw6gyFAECKOg!8_`8<sKSTDbD
z^mWApMcFvntT3nWvZx95flu=C+Xl(PcQaEr_;J*m83Xu<LqkU8n*}@8;ii>*LACmm
zyd}^gV+f-<;u88+P0=u{7OqR>Zeh&1M#}|=qD=EVl)K3YGDyNZJ+BS2Pvu$1L0cD}
zd7dhLY=iF-S*VFxk@=A;4IiR>XY`iqkyjM^tj%y$8JUf6uA0DxD_8Uohn*jm-?u60
z`n5|$xSr$=%jp)i#FB&x&5Pxk6?p9oCfd3US}A7zD~$;Ulk0M|i?*T3;x*6jxOBHr
z7?d7(lOM@F5OXlULLOXqn8l)u*r$?CJ2qeFcxl4ln1<2M2YlDVm)ufF`tO$Ou3es%
zt}6_;5STNvk>vu>UsIin{P&A?%nEnR;J&Mp6^$nzHaO%ECxU6(fse0vn_kFEHwT1G
z(q7&U??F$Y8KmY_5f7gZBSYK*IZHz|;BzT77=!l+2zwXX^2rgn^ckdUj43gOo8De;
z)<`{vxnCzsh(f()at#KjYa4&YJPZ%<t8TNgc0o6KrU=3@OR2o}pAT~z^)8DrMRj%I
z#lhKNWY~E?R_`n(F>#ys-O{ICtxbeq`Phz~*qa41NB#i&TNO(Xy%H{HWr+^hx{P^r
zduCNS%^m#82cv)6B}0I6SNsOL=18t~JSiXERlF@Y8qHgrX)K=NAeej8?ch#M>9!h*
z5F#p??91Ve8KJ}W<$VnZli%=rcB8)@o`_}t7W=fuw(DVGh!N{bUFRf#`oShgJB^bY
zn)rYczwK;at8s>xg6C&Wb2J-m6%N;7d*|2pa}6FU#ubC+$kEK#>S~vdTR#CxC=_n-
zQ2XcBsh!T2{>qWB)w{|ehgr<G5I=H9R~(fQ7J3J@4`W|<T)k>ySe#PNsilfYtm2@{
z{wSWoeMK495pSfs{zUBi`Ha?4c@->BG|G^=NTkQ2l<A`Z^=Td(fwyG6PhJ{(KRfJk
z275VB`<Q#!?{SDfhN6^EX(nug3+Epum%FQEiJh`n;eRA!3ong-5Nms1%6LYBN%_6f
z{JJXQ_@uhlc0woD#K<M(%Eu(kjU{mRG0>R#CEA_+nAv194WE!}@TR3Hldz~{vVvf}
zMBwaSH79n8B2`#md}N3Hq6k~*aj_ru7gfGB=61UTPH2|)w79=^uM{O`HZ{419E8-j
zOv@cz(;3FsHHGaXr?crf@TxZm%u$G6-5S$&dl4{Z6vu+<1~v+Ic{g6ohAsw&uGR{C
z^KLG@IT+^)?qdP#Ah&2xGrQ(nKiuH*CL_j{u~%wdP+&Csm;a#<bTeI{<1l2Hk?-O6
zbBXyR-6^bO%80wQeMTkWYpmaQ+-$ww?fR$$R+%pu`M`D?8zcNBQOir54(u%qa0!8L
z4{z>&6pc8*)L{P{#0BY6V%#&>Y(W6S`ftOO>*xCQD-z#0jkbql@6GB=f79E8Bv@<c
zw#UjEmKwfbnD0G_;1|HIu=2AH3>xPMo4hymIE1BUeF2RS1#2O`1T857|BUVzHp0jh
z^&6Qel*-@}x97#SLJgEB%V$$VZguZ0dlX82HL#_hOs^fuhgUjwx``n4->=nKZ*$Hy
zhE24KZqJ)JlPf=l9wb}#RBH)DnB)lWuXs(qVqqTg&}*O~4#+*6mu|I-M_f)uM@M9E
zaPZ4I>y6-uFEXM+>ZCA_9V|FmssQgn`koxR)c7UB-0f{2bx>dXmMi{41VrbS<0-u{
zKAeFUL07ewBMX_|4;LHfFY~FGaY<hn#J{7mOJWw1A7fMJNl+XTO5+!lwq=x+;;xO9
z4NWW3)_*Z?BG~ZI>=O`Wl$M4D1cjjkWG`eKPXf53IFW8$qi<;BjFRfBH*ZdQXUZ);
zzjj(*IE*{N)B)rxP>+KHWHXuzK4oQUDc0q-`;2GT>M4Tu(KeCp1(K_?vwVSiD~jqL
z$f51*AN~&w>HR;TA^#U}C6$UiHm0mP0!UXJMCZa+B~5Hd)iibc!fB-s9UJ>X(r_>)
z=siCL8{5ob7J>%Ye7N@2OUp!ePfRj}&up1t^ueq04R612Hw(o`UvOTPNb>+aHS1m}
z9WFX+Y7EMAG$=M*b3tGD-^G9Zrp!Tp9?u2);S>#S$oK6_eLtvoVIcptCBSGUiV*wK
z44y2p3m~ayck#$JW{v8%KCSf>BqYpz)w?izx9Y%wJ0eW6DyJ+5#?JuJQ`DLm!DC4C
z^y>?5F5vbUQup8WooF*54sNJ(wc(G&k-xuF`>|+9SS`KtCr|jj7+<_zm9-*p@xqdk
zZ~WOwNLT?d{Q{!ufKK<QZ72Sabp*K!d*#~B!qO@NPgaBBC3h8xYq}d2YgC}Gl8gUT
zHA7UB3-@3Atqh6i8q&oX2Tw4AHIea@B?m)va$a8SpbW7SrUO;#r6n_?Nkd`y0^^*G
zUz>mw3uYtK?Dqw<nVFMVI&-ea_!B@sI2G&T;&_dbnjDAB9lZCMSxaji7<eEZh|-BQ
z`ILXTp4bGET8ZZRf*><#4({iWydhh$&ILlRJkTxIhXevaCASPw;IvBhM?O}`FZBhS
zX4gT^mKJE4ap=1BDUv2qVPW9}q`tB7XNlB5{rh9MZ5I~t^M(7=BAfCNV6uRqd$qhF
zN%1WprN_+HzJ-MaApKMs54NR#Aoh>raLg`@>|G3)O~)q|fQQPYSTk3rcJ;A37*8=d
zHZ2$)l?MrXjwm*i?q+f&3XLjpbtyNBrT|UjqxbRg>9`BHM(>qgePa35D-Q+5NTE4M
zXfiTSx55NCk?cg6GTcOn8cI?<R^KTk$j@O*arU&9)<tY}=EtR#2iNN-o0!g@ZxvB_
zSsei!&9O>NjN~BjN1G2q!2`hof>FU|;IuhE2S3@G17kHXQgvL9%S~aV$-uQ+r>nzg
zqxX}&<Qj^WfIET2H$4V;8f+yl$HwRw<$Su=B>;zK_-a3F0j+%|cn`e``)1<$55pv(
z4k{J=GwuGr;Gh3v@$De6x>ug)R0rvv4@@C@blm3eQ=nbb9Nontm49NfD#Y!{_5254
zm6ub<7N)=R-_s8*uwRA6|3J7*Yzc}@OIu!YIpp}zzqL7&vyg7$kb(NZT8YV-G!Dr}
zL&HL|=_Qw792opBTX9yWEd+ON)osCA=Tx>Z1H}^;<lh1V%jz(^F*nVI09SM2M2Hfn
zCHJgN*1ze`KrCI|x(vjYreznTXsYnhAluS-fiZyua9-;igNd6f8(JLGC~vuN(I3<*
sN`;sId<;zKLqIt#Ii|N9U(g)|#J+p3c)M@Tn)primL{S^=}z!}0pwfSGynhq

literal 0
HcmV?d00001

diff --git a/frontend/editor/public/og_images/saas/app.png b/frontend/editor/public/og_images/saas/app.png
new file mode 100644
index 0000000000000000000000000000000000000000..9c6b300e6ebbb9a8a52ace46113c76b02ad86a91
GIT binary patch
literal 121329
zcmYg%WmFq&*EPi&C?32>krJE&#jQ9LcPQ@e9vp%@v^YUp+@U~mcXxMp4@LWN%lq8l
zTKO@#CM#=Z&biLnd!Iewit>`^sKlsnaB%3-Qew(*aEO&~aPV#b_?MM-%Hub1ui)UM
z#e`KoGLC)Rmu=M?VWrx%lj*px@}yV-k?`K&S4Ot@S7rCwMfG-T;#|Ea=78ZCtA46_
zCys3cpojVQhM~U+!$r!Q^9mT!T_ZOi8)mODJ82nPI&E3z5b}-m9BUdAv>xHFIUNSW
zGPrCTX57TST5_^YxsRQy?Cr_RrG2!V{2`r4^Vb0zqh;-{Ih(Zx$l=WN34@(})g|m3
z!`0w79`n!64V!=eX3~U-;Le;Q-ES25*p=}+d8g2RhrIVm#nwKHZSAAd=A05{{?tLZ
z6TZL>zo&*g-NjL+V8f)`6eF$5=am+ArOh4F!R$U5y$hHA^T;-pwM;}=T6k`e0%!)4
z@L^UyD~0diOG4(@{L+#4_}1@`;y%8g*-+YR?sP1yNl(yThVn?kd84*hbNL{pjQ$YB
zC{lGCs%-W<|7&~X${*|B-AEeWXG#NE=mky#`&t>&cs#lTdb9{ZYF}2hY|N4>mT^yU
zPK6xOWoIwH@ubHR+k5`hG5O>4y7KH$G-lL~{=uB@&ofUys4p>FmZ#!Jvk`V#_O~JY
zvR{_iOe||ccR$5VIZ~WkPwMcv)|$QV%IeEBtDJTQWd+P^{(X$H4B=sHvC`MmrgvhT
z;h%S;EEAZNM#C)<YKqILyuZpNCYb%y8N&7ykaPNKCzzn_n3g70+(A9Fz73x7q^6W|
zYzmgA@BQkWA1)8fY(#a=Rgo9dV(4W)8A$VbKg%wsci?iUH;@ZF(#`GJ`cW)hYE718
zcvyTS#anGXu(UMx<p#G!`s$0Z9VN_3IX3Zi{0xYDf)&Q?+9(RxKh`hN;Ez$k&nyv!
z*@p&<y8n3oyorsYUpY6uSoBfASJNCmI-8dFBkJd$&L@M;$lX>Pg(<4j@tbnvrVgh0
zZ&aq|`>e3cFnm9feVzYFHelgNpF1Fq{srn#*L%sk2Y<hM87M1}8DrrIWj|%FYzx?V
z^Al?<l__iblGohYGnA+%5B#8F=@)UF)$z=0zUebYSuj5m^@Pn+&9FHdq*vKmxv}VD
z@;MT}B9Wj>L8ktfPYbC=Y17q7Bqxk8quD;PtZpjHS+B}yr;New`{v|7Ir(ECBZ99x
z#`l2vdMo8>i}h;U8JwY@IdUy8$?n^So)*t7`gzBv@sIgPz4C~J>(V#pjKSjg;0Gbw
zsAzL<a`wIPuMR_1^;vd;c?+6cf+96)&H4?koWK@c?vcgE4OeIBKj2q)cB54TNF}E+
z69sP>(Y+h>y>9N;?fNHUYrJ>tM&q{xGyRAtYR+`;!BMG$dI4x<ZQ5%jo6@hR4z9lR
zJoD~#zA@X~crcI3IPi|wSgrnDSAxIdD+)ix-0A+3M3+h0+8p!$>_kR?7m_!5;qs*_
zLJIw0j}Tp_puxxU6LAHTOZr{!#)biD&R~9uEZZ)NV&QG%nt}7earB^$RO?xG4?!&u
z8|df~75f}Q$|co_Kl@9VM`dpBNK>KIxkb)NBrAMRbmh$#aw7cqz@nDSHyvBudg^D+
z5>g=`StRR^toot&PW2$OM8z}y7=8*WL`gQ|$+Xa$?nWm*GZ(Tx##G3ap$qnXq=5MT
z8yG1cpSiW#2g+9oWdkxHsFWh{<Re5H)Xw;&G(FT?OcblAj1*=jyJ4sVTb$*YuYn#T
z)z|C6WJ4<0bfcF8xw=eQGnc&h{bC>C2{LPHz3cH`{?4zKf4Zgj(!kFFuX?Z_C{nrT
z!~L?lqU+h<`jBq*Vez*6&ES-JeBwhKf>NBseeTs(uK3YPt4n&b2SSjrA;4a{YBNdO
zuFI(E|Eik35k|n%5XXw{=nOn|veuU1H`h75*%b>j0Z2A*&uxOp6Q;6D9K;~d&uzXU
z3ivjEo-p3|7<s^C)8q4r=P2HuV>d>Yr}NXzUDTzAe}>6g<P#+B^#k3U_m{{(qDld8
z%XJmM@2&Ej!)IOVk>^FuZc}26H^U1pihdgQx8GCyhnd#!)F>k0llSc<J<2}e4r?K}
zBMU&VZk}@&GoF@v=i3_bi#7pq2wu8pqntrJXwQ5&7Z4tn)}70qyO4ocQc;hG!Eg1;
z)wyax{}k*2k?`yCAM4)4QyS@mojV_OF>|2Gz=dWLc`!g2<RyV&{-{HaBV8vqSTDv;
zabVe~8U?P#V0<ku0106&gki~-k8yt{<M+Yb*q#OIs(eVP&6D?_=95^?J`C;ydMr~x
zyfJfL4i^@EVZ#VD7y^*a#1vl<Sd)6lJWH`hb}mEddE|~PuXQ^4^eZft_e<=qptscm
zPBjLjI&h6-BGt}rzgd|j>xIz`jC9(SyBXPGgh9thWysMxa)>!QHC6lpPYajICn?pU
z4l+^^1J$3WEuV~)x(zh!fD@a0878~R;fB+R=Qe?<m5GV{km&k9-PW9%z#I3h1o0RN
z;f5O4+(#ffo9X`E_C&A6#+x>+A?67tN2M<=54_qHKU|yKZK`J6c=k+(?3qfZ{%vrn
zLUf}pL;8(xo-D|R(t}dbK8Pc1sR}?YEE->f$aOQa73y<ey}@KEdN4d?<aa|lEz1-f
z{pu``g@aP+WygeQ#=4W{7kT$<NzGitPXK1wCTCUXMsxP8UuAH8ut98XeWq8}N(N3=
zCD4iPPOA9b`twmU5~(8ew@a3Cvo*D-bqm&Nsad`6aF=~oX5D?c1FG8gaAB6SS!-Bn
z0Ksaj_W%<?fmmdiMNh=if5o8Gp+Kb|kwmbM-;nu+c_q>-x-oHmgG|H;4P~s)H<SVf
z9OMon6Y2VSUbviXCgTyfdH`u88X^;!OGMb}MjX%k9-D$9+TW-iB>WQYDb^rmHC}H3
zkoVeS54rBcenu>g+=OUYA=V$t0@X{1fB*#LCV)&t9OH_5bt`Q_r6W#pd|>wO>pX#l
zpQDHoU(Ez-Fh0E)?*i|G>O2&p)LwF4C~-|0EB8&F^U|ld`A1j|4rKplX`jqkXT}6y
zznmclMp7S6ml!&>lL{76ptsnsl$o5lQ7xu5t@dLX6gP^lar`F_yS4Sf&wEjN{-zqg
z<ieJJI1;;L-3!c~<Qe&ya$5p;=1E7$m5=t&JUWdCCY_0@f+WOj`%+4cF76o!>}AC)
zubAo@Jnzb;{|&X4Vz_+h&Q2Ox)Z?lnV^YhG4h+l6Eb&e->3h4SldHyKk~8CI9k5w`
z>!#o2=6&9!g!jZXe%+>EDcjUWJ+brE(KnSptxHF86E7gd7p~K*cF>h9wxG1N{O+Si
zi??%CQfJ$5@Qh&X4SuFgrX6p`{a#dsJGp^ieV+i*XP>Ahncf>L;-S!Zyk@;j(Xot?
zA@)jdcgxE9cISgxv>Dx8-cTsdZCU0}HMSe=F1fNx2q<bUFJ7>W1?<+`NyDJQsOP(p
zi^rg$ZnyZq?46Jx;&F><5UwUj!<JuGnw!WpA36cib-di0*-UspH0Fv&fMglLy8AJF
zLoZPN?KBAgYlddSXX0%X=acJ}bOeW>T$KUfAYD^Trmo|#`kq$g>9XkNMf>t&<Cpo&
zdk{p;eJk!QwP8fzI!eJQ1tY(FJ8<(l_=*B&lsbrfp>1%#`pNOQ)YgL0)&C97kfN(w
zoK(QE&iCvP2j#jcBfJkq!#tbO9f27&>#ud}&a>Y$_5QlBS-vB3b1L2u4M{5L@K5gy
z`}C8ba5wh#6`r#^#}7jgh_X+}{S!48&14#CJbSp0Fh(EWFn<>&l2i9{SjMQez*7dq
zD}U{6#~a)W2zBeb)eeuAFv=mI`aQ~qJo2V%+mH9210j}O(RDT)hW`NB>WFTV$C$<+
zU^@YqtV6W*aH?MjCJO;%a^^aihTeM2o;-W`N<tK$&v;9mual#GI*j>9EPB+rr!1Sb
zd++x8kh87G9!fbti)E)2JY7KPsmEyZWUU`zmM6N;PFKf90rSLy3s^Z-4}vY#u(<R~
zYr0*|q;%9XbwbJvj}d6N^(9@ix};LsS-Ia{6lI?MXwP!KsQmgHs1&9GA@W5WOMa?!
zmK=@K5=W%^p-uX~5c~~j(LSh!L0Bk<Mnm0wZ<c#-1Plg%!0zgDCVePe^CMFSb{W;7
zSXcZ4ETE-iyjx&r;hj27Zo=D-E8J>O2P63GG<pGu>fuV?lCQ|kiOCn6v-aT3<b~qi
ztw;4!kZk5?$lDpwlmtRR<7i<;DAoj9V<=WHMhle}U<ThveonM-Rhnp>tsgeuFY*Al
zWIQ{RgaQUI)sY&Z3!09`<Wv)0Ih!pfoWdRYFdyWSaYku{$t4t$bjTeHvszJ0e4ymE
zn!b#%-PfM7eWN(ouJLgZswPfwX%n)fI!x>2(zm}WoA-pobBsg@?3o4j17TF5h&-E-
zs=tkJ6{I?Wxo4F6fCvYIK@&HMDFvxK{pC~E@IdjS{2Q+MW;MvaosT|YP})JxJ$cKL
z)d?Wb*SA}vi%Bs@Zwv-J-MLF-X0=9+_Bf`UYp47&OC2Zu806bIZbHR0+*YXNQHs{+
zu&w<*_5BBn;DDlon>*Q)i!ZkazsNd2->R;=r<e(KGQhqTr!0r|%#9U>I<W2W!txCY
zt!Se)Nu9ICgQNv;WPjkx<?WR9<X7^0SNc`de+no+=X_PNT%Sa@w~qh8Aawn{pTHG2
z`U>g$P%tH<lgIPUM^mT7rDflt+;58HT>p|Se0l%AeR*eKmb565k&8QzQxJ+rEOkK}
zZtTj44rY!CdtGQ8h~Xe~=H`KHeV{Q61VN4KR|lk8WQSt$26N{P#I2f))=Lq}9Bv`A
zyS|6cv7>N>@uDn!f~o2Wu0|Uf|EwpXN{(x4t|`W)e6KKnM=W56#Ws=Jw?7Wwc*U*#
zE5)ZBJy0HztRRO>#KdbpwpO0=9Nw+km9{gru|EOxbhpcn21wWY_!4vgNZct@ugfyg
zX%53{5Xe@dem?AmXGi`ib}K^^ladRGOi8|V@=1!21BZ^8Qff}bW(@1zN)XK>P+s1o
zKu%Y+a^#Wu8Xg;t;#5#BkZACO-zSVm|8c{|b!aJGkvIn1FrL225Rg8id%&>Zr?3*e
zJ5voG9gQ*Lg4~)|p9x-M(vKU?`HcS~swEOSnFjh8EEiPUdNWg}RnBnG4=J7PF5q7s
zs0#D-jL&{+^#FPErT)(E66PC3^9}AaD$DtO*(xg@yX;j`=cP`u7ZHyBCq)%2at(fX
zMb*oTO)gB&#&_G4Y@X;@9L>=w&X47bHytao6$Wsr?fMrh-neKZ3(fq-6<T5&mLlT=
zJYgB<2%&o)+*|!gt7CG(V&~Q>?;39F1-UJicAoypQ|ZLJZv%85$xrR6E{CWztrBAe
zGNfP;+D!raH4aqpWX%cn%p4;aAZn+0rPKu+6hU`q9f<zwRR!7~rc13lq7Z9Y6y?_P
zUS2~Qn?vD3S~h4unFa$Qr|u_%tKo$M_cNaJOk9T0DXkIf&vwn8n785O)<kJ5r0|k8
zL(hmgR@}9)Hyb6;73TY3STzEPn4@sSO9M0*qHnFvH6LgPjELy#q7Fi%c8?uOG-qlN
zFa%Z!HMq^Y!x8x}hEdE`Uyb%vfPpP$U_OS-3>&|437hG2dfs*Ikl7sFV@#=hoV*B$
z6zAoERK|$Pv_UJs>p)?Qjz`v2<82GvtJ9nb;^VGSf+*gaWM2LGJFgHdew<6lq=IJU
z$R$70Z*daidlb2>f`@u4C1b$9^-qm?pwKgenS;WyOj)2l#@=2(>!sL{)lEKzT#*$y
zRpF#ay>uh{8!?^hfupG#tWEC=!4?^jlF{W(SI2rXch785l(*I7EfN7sqOAae=+_3G
zS&jk_eh%L><}{}fePmiQj#{-O`uk~pUBiA`Ic3?L<i6A5ai_E$5_-Ue1&L-+rsuRM
zcl-FIbvz2a(s<;dU<|X4v;w9cK{)#%2yJcLSi$<&=FXy5$wR@?TSH6|sNWa{=iQp@
zZ|xR^|L%jHl?(8C-3etsqY!Q`o<vkL#zW>VPWp6dNi;=lj>jZZVe(O#eb*mET?!}1
zK?uW&kXORYQ3dOMPUOH$l<!2D>+qyzmtT$!0w*h85PHuQno2!}@l)U~55$y@n<OKC
zXVPrH9#?odW3hLH$R%^UV>CRNKm;9!0T<~Mxk8z{%$DwBIHpAR2}RCpT|O0wr;wZd
zDV7Y2dTQc*m1!<ZE}k^sT~16$KNiOaVejfv+21v|7}!A=)w;-c=3I^um1>uJpW1+g
z;gC*Tvrf9t7W~T@Eysgm^ScY4I0&TuPNa5;5jXV*yW|6(-Bga$?(j_Z4vNfnHbH`i
za6DCfOn=dDcrLl4H}y^M5#0oC&xCZ9uO;}%j%}WF$KBiyk3b(+1JXG2da*eFDTpPC
zI+-6fafGabKe)*AJ7IW-tPBAqfF0(!%ljzET|oS!<Yi{9Q=~k*iszYVE`J?CeSESe
z_!c>f?g+XEJE0Zt@dude7F8dR*8|`9T=zSSy^C%PNi?`hMOVXwF4W}7_GD_~21_I8
zEP@G(dAcpK1(__|OfRzaut0&s{L!|30=+eo!!Lh)PFiz;)ynxii=(nUb%gwOY(u^i
zT0oJTD$AO6X#ZC9Uy5ETGC`6yX4f=z!5j_oyJ2WNp+NKOl*V6g=m;ORL0Mo$_nxDT
zG7XjGNg!oXn2&~nrauQMj7X2R@v*z`_6R@_`E#NmFYvssEi!5pFB^vS<t2PrR<q{v
z`y2VeFTC8w&<!X0h~k>x(9z3?Oxk5mG>kX?Ok#?$dMlF_+fclq<-6Fr<64XQ_H~bY
zbi#oNP$67D<EdvfQ!NK5`{y;x5!+<0<fnT3Ib7$ffrus9`L29!#A%)=B2~iec4+q0
zCWtH%yx@VqrJ*j2q;a-63M;Epx*L!M(zO@l!QVN83fLeaBlsq~ZfV0Q)A0D><%w9}
zckC3z9dFj(7y{6XY&=A!tP30r^-W+%!&yFtw=;Us4<guje9$V(VIY3k;mH-G*5Joa
zvd({%!*3CMwL7B5k9kewv5yFBpe;>CuZPM|2jnM+;t(B+(m`qfZ@`>_^Q36l?Z(}u
zy~Gzy`)&f$wAoJeV)75LvP_Ixh%(x07?mAnZQoC_3JOUtfY$?x>mWxKa>WwYgT88#
z)#vtiR>w^duEAGX)el1(=)Mz2P!rXR&pjW%4Lx{)&3h%IQ))c5u-;NSe`aw|QxDH0
zV}ZjNj0Eql?L``$-JBgCfY5?|HSNhhv3<x|oE<0pzpKYXB~Jm(vY$g527#S~H&`M3
zIYM2tQQ3>4`wxcK<7@jF3tdw>F>e{Y%t-XbKF*64{uSqTbeavsFh;I@a3drLeid#P
zp)_p&g=c-P=$~I8?6Z+P7Zg9;U=3&(BJ0FJ=zUmsL?n367ue^#?O0bQIaEm2S(&8>
zXXgbtTH`1-L5sha?;TwXu~m8fOHnBVwSlfnQMwL2(+0a!nx_O%f}e<NkA{CN$B`Z2
zPrz>?CbDg+8+`L+c`6c{;8MwOkEt)%yx;VG^!alGywS`EP&F1N60)Spg4OZJkl8!=
zM9T+9p)lW3a*mWM<!v~(bE_A|v7+Jm+-TmoD!=d+4{z!Q=ms<ti#`O&u7Ce;`|5pI
zEB{k%PvXqUKO>uO5RrQ@T=@bmPyhI=t#R)}3^z$KQB|K0o3V0dUD%&oJLYE`-A%`@
z-=oafw5+m}-`1dl(&-b+M%vDsZY@V>UO@Kr3&{S`#(>=;NSxvfnV%-#8qghWG(I+d
zQ1~(SMrG9SCla_)<5(O)ZycNu_&_5_3J`L0py>(rp^Z4R4Dtwhg0x%_HQ-+@{dbk>
zI3vZOSkMsS5p?`}>e~}1mdRo0Z=0oCtlZJP*$<;XLq8C;_S|C8@LbWPHBTNq2|!F5
z8vqKk;bK{gqD3?(+EnW(?D57@Y<?e(5)}yW7;SO5){*&QYl1r-q*sZrAff`0Lw!yx
zmrNynOvAhy1}}js=!w+J>Q{f12{i7+3xcXxso|_?eG@`@Q;&A21;CnoNbUekfog)+
z?F<vJ@z-2>>T#}niS;{5%@?U-UCcb@f?1%eM`R+1#!RLc8uesr;&`*eYd`axMDdzM
z@c>E89-{mq;zA^ll+M7q=sa*a0X2lk9mPZ9lalIzn7E^Ct2p*3x%Y;fDzxo1i~S4)
z*>~X2acaAee-AZ%EqglkzYPBtnK6AST-Ch%y-8G0`eWGeU5fxs@6tRG^&MyM!Yx)H
z#==`i`uFA=ilBCrCa<8?H6<Xk>R#AwYJ70sZ~ty@8rkFQH<GP0DN89%l*Z`WyHmO!
zr^rMm?gYg#b5f>MLs&)Cs-hT}pBlj@2an}v(G_P$&-C#+9mSbyQV286nARx%DxwC5
zSJ_u#sXT8H(1R-Y5HTc$D+s`_azfqk&+DQ-g8YA+FznI@SA3MTZ1NF&r)3I`KqO5M
zYMk!jVXw$tvu6Lhp9sSb+>X7@77d6l17yFy>JnmJ@*8eCyEo_Up>gb0E*qRjM^Z~?
z?x!kTQwWt@V>LpFNTn6}K;}!?vBwn0F1Js)h)<Aq%=H0Y*YLy{bgmTP+r*?P_f*uT
zx~3JeIh}F`3MA$L)=gx!vm1}Vw;(g7l+-F-$5GyCQK?s40A8wseG0VVj{PQyJmj!e
z>yPR2{?6<N4UsIg(tOa$EBTJXrZB8+ZS?}N>Mr`NM3Lixj4pZASge)TfGEua?Kcm;
za{Sej{i7L1EO1lS%?4gGaCcz@k%reIp~_-rVZ8gcX1E8o{)Rz!Kvu!myh^68-(8FE
zr38Yyqf??|X5M*?8yAhS_|w)&`xjb1ph#0u9)hAiNSvJgukrr7bE8rcwMI<*>F8_h
zhu}wqF)3g_<OFlMNwe(4OVWe;%G+CNr}|Qzn0HmCH78uon<Q)%3`QVHplkNHH1_-T
zFjF?`qB2&U(=hjezBDV&kAD6$j?Q7pU+O=7qhMS!HL@y9{E+79=(RQKkS4%DkHvRg
zZoqPAr*cA_p|dm>#KjRo-{#7BkO;4|TgD+qME=eCA|3~Mb=>X0`uk1B57RJ-`tx&i
zeIrfrxV|b>O;m#rM`?wKbK$fIO4i9}86vQ^JM3$NnRE2#LI5I85N-TH%9D^J6bx|8
zNPz<b=tS{%JVl`QVPqojync#?%ciM21=$#uIAdd9LJ$NXMD`V}%$}XAWFptC<<y51
zs@s4XL~p5<EUY%xg!#5QnFtbv`7+$&F|=4=L`ReNs9*r!ZP#K4TQ#L{YdU+m)Gni@
zod1{!Ho)FL)qM^=_`7wL7raLnpgC%lI;G)q8`dQ8ExbB215x7SKy6A}lLas;4Sla3
zf|V6?F5K>wENbvOBhVCpEi@k<VPiWCgyr^MS~fG+Yc%<2nvI^39)lnP>?Y8nc@*?P
z6+a=v`bMzOMmI?`#lO=h_1a&ex(`l&(c`;oZv3HDr&TbZ>5-fF4>K*-cjxHO2nAaR
z;FZ4#aeECc^&Aq!Ome4gY{z6M+WUQsw(IJE3-btrXT@ibOk_IX?Y0%<L`$||mjwa0
zsa!GQf%-_ruXd0B<PpKHIK!E>7B{8&x1q=GcP0atWUIcObwbY8J}`oFr3}#v3w(UT
zvfs#yD_8Gz9*w-ajz3<X$eljD##iwK`DK}!H@)}&?bOH&UXT|oik~7!Pe*=+OoUWg
zasWvj(+l9UHWUR01le<!-eMirZ!6go$hjz=DvX4C3mJ9*%{DR{KjOK}afLPRp#&%g
z@Rv??^y<~uxShVVnNs>%+Wl7w{e_<(vM)>tb_sFBq!2QfN{9p%^a()x@wbs}K`CDl
zc{?)nU!XDH<GT1LIwXYFLqwC~95UXb?mLvXmEUN==B!@2$io05G=A*bZ{;`_4DZ`X
zh<MGxsf$J_s(BF@OB@w1i&*;Ah^$4C1Uarc63=Atk#rJKsrt{m2q`eUwQlAx@Jnp_
zqvs#G+@)^en8(~O%8rE7783odHHDPH%n=u1U`%HEf8f%}5iiiEA-`$pMsq&iZbo~N
zNYw*s+2%aS4*4c8QY5v)(2?ry$t+l1QkhP$8p^KZD>*Qah`+0^%EX_*M6%O~U0*b5
z+u?n0M?Pk5<?E3`VR9xT5i_MhJ?%~0yxP*xSgweQ_7Y65??%xd%rpPsqEWQk<+EGu
zZu|r@V)a(s#=IU?WuN1brF;=84;%AM_R!eS{|q0cCDde2E14l&65NamU7Oh^7q)RN
z3N1+TX9Y4v&Ek}~Z!Z)74<b9gg7#(bz76>hz-(Ej7o!tu_~znkn!Q$aFqGn}P4%oa
z04?Y6y{P5^waZNQD3cMu2V|I+jO?<Guyfq}m^86HHc=+1MVK{Ga!S;>-h_Wb%PHZN
zuEd(1ENMK91&)0qiOmK{tQy3Ucy!?RGFrl5g>>Sjqe7lWR|<x|$i{twQbe^fBv9JX
zOJa;;IW6O|K|1AJYeT~U8SIqHBU+9!?N~VLao!aKECZFws3i3uLTWKqGB7(VMoiyz
zS4S5SEeHI{gA)etvia>r;~sqE0RU!aHWc}leM8IGARiNI<YuXG+S-`|^{-!}?e?=E
zD=BAMQ4b#S>I5t3y^CBb3+`5F6czaqw}c`pLEx!-k!<+pzbMlv^T;p{g&xlP(FnXy
z9zpbFkv}ehb2~ic)n1jIsK^y5K*usP5c!<5osgO9?uv?L$_dG;dHF8;b6KVy*OB*V
z!L{H~KBx?0&WgO|gu-5U$FS)(EMBV>I#gEnML$-AX`g!7AYc%eGCP!kw9;QT&+HYu
zv#***Cl+_j5j9DM=iL%q71b)<XxkW7&*KP_H5n04);NtZZ2R}khB<@mS03^ly{vRy
zjsM6kOFz22e23axjrkLSz~oA*%Ys0m4dzR)1LvZ0Ne!|q?r2LiV07Ei9Ft8Sk7Vp5
z^XF84#Dm5uT!#<$k7)%6mM2#73D3!vj{}dumOD)kal6umOA`%P&117kLroxhar3EU
z{*CT1Qm5&MZg7IeSBeaeHdyrccHm*kN1*B7fNFA1b!2@<oB5{c<wGgmCW-Bnvy4#$
z?B0Du$nRzz6j2ZTp!|-~KX03)<(N9E4VaM7W3E0;*GQ6!SRaNJ!vTlkK_Y9=Jir>c
zN^yp53V6+nBAqLduM-Ksje<SXh?XLREFAFZcdybGHrJoe_64WZ+<q64XVkc2YJB{!
zECj;nZ?_%Vc5d-kps<Aqr_gC#USFf!#-aCa$>k-i|0h*iQTFh-1WtdS?wYdL{3tj2
z<4AJpW@#)xRPoAb4O0c`+{LhB^3>hrwPktxbB&vLB)Q_V<=5bwd}VJ%{(~yzC;uw@
z6Bk;;Osyepn2)MWR#D5@1InFX{+7(7nLd$v{(`QyEDsXgB}1{WP_RScU6oa6t9<i7
zhG^**zf=XxJ(AqKsHY<Hm|lbRX*05BK_`qBJ-BNy``rz`R84)nt0RY?notgh*a(XN
z_M&m3kwSS}{W<n=7C(6(5JovtTK_RuXPQtXo`1*hU-fla+TA51@XBm3g*G3NAT6FJ
zzzUP1I`~IDR|C>WV`!Ytix!JebC;wvG2m-%FfTq;_8u6&hb&%@n-!-pUL>>Xft%#-
z{}wm%YeCvRZ$iwmffLNFM!s-pf0fuVD8#bJJ&xv=qmf<ZTU{Xv&$F6ZM_6Vu5|6MD
zMb0gXR%R~oi)7Xln{gIV5Oxx4Y;Frnt}5deerHWtqRqEBlH#|{M`3!ruK46D6DhIr
z9pG7KqPRT{&rk7ndSf^-iwB8aBNhvsvyC$G2BjH}b<<O%L#X$CTJ5I_VY*{8Za?u%
z$*<)y#T}OSC<xFG=Wo734@oJ3UoPWGa(oqN_NdZqg$$$T@TO<ndGxjxd$E{hDKz-t
zEdH^6fK9r2T(mx?C^?truph)b@AvxV)24+TQIuYHeYG+4R+viUytDYJw4&#1XDD3~
zddjYGb>L@R5Q?1Habhk=9*H{k;jPD)LVO^(folY2j3#MK(jsx!4y>ibBriJ+9ewSo
z?bp^i3D`#GarVw<Ul*Ty3RW<)yAI1*eC$d-`gNk^dfU_}Nv~V<tMT4DUqsb3T7d6r
z-D^mJbV*@;45;qo9%>G#c{;;*%=tT>CUOMaEPKY=e+iYmmsKAOtqfgwLfu*z%Gp2L
z9k}?iEU?~OLK4oguEd33KvihflMrHR2Gn~Cu%?*HPq6^JkOz%ovtvgeQy>C=%fHpr
z3lWbwqJZ2>>Ek~~d@$VJyY41hd7CiN;QKBuH&hWj;SMG(h^X1o`Cy1?=)_w=y^F#i
z0MP{>-=j>-^&bMtdE0<jZ~qo6hky}R8R+i^#|1y9wZA|t8dP{Ypa<tMC_^=9*p{B=
zRX_w+hG#(G4-QV`vK!w6(<oD5jTmk>)iD2|f(jJN==Jxms#>W6X-uf72kW0#vE0*m
z!!;h=u6dijMycAuxD`ED5M(9OA4fPRttTEL^QjYPZf85UX;6jY)2x8DV~hdzZ2-N`
zT-kNZAXW@**KVEikq}GDZtmY|Ms-~TUq@|01IqJ`Q|Ky~rwy`qz2zbDx1OORNyM+J
zb`J5*qJU!2tgdJuq8~bCF4B3(xnD6=qz!iF9*K#T%$jz4OSH_Sr0cW%PTKf))L7hy
zu>Jets{o`>hD_*A%vX7I42~6Ro<h&qwxh=f=YFoOWKqr9N(B01GC-L%BG4CI{FNH&
z9+^bYW3PPn1BV+yuibxtSMgLx;OcgEe`PA7Npl*{tlvo<``og7M(J0Qtkdo!dluAz
zSY(d-;rg_M!%zIE^I(gk*?608vp#C~*Yr@2-_=DG!fjS8rrqC}?M`S|&Ely$mToJe
ztV0IF3Y2$fiQ;T3f?=ui6_u`<!YCA^#CCY<caWQ!CEM6vihv=rLPws_@$<LLZRbSq
z<Qr)Wv81=hC*{J>xJnsRPm$_UK+F$gb7PX4nMgeD+w&C4mx-&DVIL6RKR4wqVoVGw
z)Zs<*aJ-+L(|SPRm~&szUng~H-9JYlAmXwB2%E4vTHMjDqi|5V=(ZB8dZUJnWS|>&
z$$mXoV$)iR4ONR3jdTs#T4*0KWt17F*~<JSB$rBiE=9mGAQlZCzkp=24BjQC`-RV^
zN&aMJ@(?*9xB;A7Dsl*i7EscALMssnj^T*L^V*&Eaa0Ds0AS`E2ruwa$grUzq77Ao
zcb=l`Y+c&-Vv97Kg3+oBe8E9(s#P{w@xo~@|49#gnX`o&o{u4vl>DKmd|hPhm>!?Y
zxa)fzEqGt#fcFafeW!osK`PqXXK7tL5<@AYo$Pg2BrE1W=s=UV6f;P-I;1V9{4*<|
zS#M?@`G~Eb%Z9sG${TajR;-@O%B`Ka5P+e!e~LJI^FL*KY73Dax)th?FOP_+z-46v
zS)f5Rdc$flni_cZL9_cO=cUK=rfVzh-V)^^6?DujWvcp0+bs1J7-tzR7o|cgtc0D%
z?mq_K@cbSjQJ{Pdb7bN8TbHfXYi!nvi2;GubSG1OH!mbntA{#UI4!?pg9to9620dt
zDOInr-00AuhDRyG-1DNEmyj2xZ!%-(4#ZAPd_Kj?tqzULl^5wkFXq{9U?kqBI39hl
zz5V*kfJyI%_R#2JxaVlZ^8NO%jP5|@MFeLPcX+U~qbnK+0RxmkJ#b@kY(p_k*>-|y
z=1snxI@iFYne3BiBW>BG7Mhl{O{!Y5fedtp9m;-*=vaW5Z-8z4ht%TvjVUU{c(d^y
zTKHRS2-+A)b2yn8d5)ybncb)r8As*Gp(?b-7?4_4<^d^{M4U+i9nT`=?9a_aQ#fm%
zL)dUqGsWg|Uk&be&TM=!vCi(4+$8K035x9(V;Bg={mp=f4f3+7%^E+>2$yn`DWiUa
zxcZ8)GxxIO`Qtr}ao!(;Y^RCwv40Be3I3fsh4rOWg0HHJdv?ZqwI8d_7FR_ML!UwO
zFT6$=G-?13t<135wHZ5nB4y(c_%#;AINYY#^5;hz&41j??0f#)9{b>y+KO{fBIfB4
zXuH_BGPE+~`CTG#v2IO$U<GLwZ&V1$gRHwuH2d!QK4S>a^J|E*R(ysdt{&m-%C{Eh
zlu;^!M7`K~z7Q$rSJ>wnKC2f>>gi(!+pu|ahg(AIa6_S-*Ei>O4HE2-1ze|d6<C`y
z!M8snX7C8^R~7d%X6ylfr?yic4!4H-VCk%=1rW#An)0NDf+zIUg>)eLQ<SCM^pfa)
zgD~Yl2q-nrcPd0+EXGrWvJ8_?x5-G6{6)iVybLI0FQAS}+&~#PN`<@?TX9lJ?LUWf
za936B8Z#Gc%ghLDOWw4aC1%(30T259MI1Up0a<8`msP+smE{)^Tsy^e3?09brVGvO
zm{e^w$OrYwV=IM(+H>aBU<D<sZtT1MVjtZ7M}cC25K(BQ*t>Yi<adKP;<^A130CJV
zQxW^XxoQv8Uo>5_MjCtFF@$n#egt$|0!B|SZ9$?`H#v90&Ep<pW|Srdq<W^<!<VRr
zxS!iE>F~i{rrOZVv-4E9s!i(g{Y>^A3byOEhX@Bn^di#~@uNGy`8Tk&afVmMZOPzC
z_w?tpnM|_HFOP{3nIy*fZ9AQ+&E6#qJ?Eu}D|<cIQhJiE=Mn0i8tTvAd;io7byPF!
z8+}+b_6=vrU*;sysZ<}#oLPh*{teY5)KUQ}>Dkc@pIs}#E&F$_A|u&ABCm&oU6tIx
zo9wF^L`&A4FSlPz1r@Qylc&{RRlFWL@zNl|Rt`{&TaKK;x?gGWI$kjj^<AX{*Ak}(
zu-x-+8krQ|ZP`CG^EfC3eQHbcu;0+li@7P9P)l`QlV__ezf^;M@o{H@jg7}zTL`B-
z%#0*6`%ZFdpE?!X5ID&TICYE+3HsfA(^zwR*zV&k)|UHcJd#3j;6XM~WK5>Y_1=GG
z#cK%6Xl;ipWNpIN;Z$_x(`o;sUv)a5wrZ~hCfKQUbD+dz<)Rr(8hms$_H6oMA?BK!
zbEQl?rVBDO`{G#Om!!ZVJ?W}0EF*_`9CfP&$9D@BYBUR!NDY$A_OmziGi?WqVXu$O
z3Mx(iDg|3$n7P_L3)>!#E2r{Yomf0Pr)tL%tY!><5Uh>An-dVpOP2Hy`<@-7I~qhr
z7eB_)FbtAd$;d8=SUt4+B$i)D9{CgCinrZQrk81GdLoRwC-&mqBK+!qImsJ28N{`=
zEu3!KY%+0p^YJ+18^c)ReWSg;&k8EE1m7=y_HVP!ta_0mk1J~apuTH8Q4cVw6k~rS
z+H6)7Km=MV*rVp_1BR-2_tneJDTH11JkU}pY3tc+43jJV`Dy4#&gqinm>-MAJNfCt
zJO2z+nk^OIzWO>%?CN>5NrEXc5h%}V@+Ht!T={-QJg$j^Zx;MwgfVk_=H>WZmVpFG
zJlTk$XP}RvH1K?GL7Kyr*ufR>0IReSMBhqra!UK0MJv8Gr*#;L1O2p4-G4Kqu&-DC
z9Rq!FNg)h`#36+2lT)HG^Dz^5X8k^L()rA3FVwE;;7}bMXCgs7lB{*dOwz`EkB>?D
zNJZEBZ**W?V)A*~RHU@vl-!w8mS3|^>C*B<Mp##JQppKv!hA`Tdm{4c!H%i(c_IFz
zG1Y)BTl^UXZl=wif`ZTnwcln;HVVsx=}9Wi%TQrhEb$JG{ZoEc-1=m=JWp5Kaq(qY
z&#J`jDvQqh<dOqm3iPJ)0i`*%KI<Hh`uh=x@r5=rn`Kd#;I|^VY`tVwo!B-YonkFM
zr4~FF!*W9k21T;)Vw(M|dj~IOBd*oeE*=*}jGf{9U|+X=g9_z)_x0ENfCQt-cZ%j1
z`_;4&SP2Ot`0B5qJM^Q00JCx>6g9*LqtCI5+t?{>%tf>-v?cDiRqxqI;d}U~ZTKrq
zf~*~zB5(`X_d$$t5=fIj7i9x^oeJ4oj}}6|xue50S9FJ3$1^NOyiBGw0*sE!=CtmY
zPwH1)4mvqdM`g<!Y<nD&pYN)*?b9C%_u&4QKSYkJ$IKVWqI!AvHoG5O1a;F#aTU;D
z%z#Ty_s-}^XTi0m#tY>0q4eP3f{d}kdU@mVg^|}S`d%&DQzAfQDcTegLWUZrlJatk
zeOCfW1Q^PkvS(dgg!b?L4@nQp_#^xZw&<`lRa}a&{F|`Mfw=c2ZKNH*MU4QE*hdVH
zzLO6(pAKG{ga3?=t=l(8cmFJemP5(5)tMOSBfPeg{xKOG0n2nIjXzd#VVv5H+vjEV
zn%&N^Zj%n~w*O>Bq?9}Q#qCFBN~4%O8S3?{>rbGa*NO@zV^9zeQk+6|I=iJ)DIgxI
z;O@NJtsuFLY)$2W?U7(BF$T2i?FB81c}yxeHLhhIy<NF@>B%wEsfy(0!)c$8_$gj-
zsW}B@gFG6v36@ry6dy+mKb<*qN`GzNN0GJk6k(-x1-sW!lfy5|Z1@-$WAW_!=%U;T
zR$-JPIS^mU<sc#3%*vZc^xu@t%@Z_R!H^bt5-V-lRxk!oY~GZ|)e`Vih#{8e?H|CS
z5&RN2fyW>{EQ~aYq<s~i+XE(wR|J!65pQV}3m;+Y248mVTAmk6{sbVz#zn(()bF-S
zXTFkh>&Vf`xR6gMZrUFIe1^L}sVBB9?cl;sK^g6iP>-<hgr_I2ns7my9rJ2v!peIO
zw$bg&c(=NE+PHgzW%ekPB!{_Xlo)E;u+XVs(R&%qP{DIme6-zX@@)R|-&PU9hp>yF
z_tz*@kBnX8pGm5*Rqqqz+!kLqzmwN721hQ*ItuN6`{n=)xDe!jdEG+lji_lM(ZE;y
zI_1={6q9T_JKvVh^66^>!JYIYGR(N3#_6};=#p(Db`QB=#v>RzU+KID{>&PF5@Ph#
zco}E~8&Z{L24W201Rz@mT~%m`3cYJ>B|h^hIj_I2NbV=uMd?buQ!NSE4yc`9LY&gt
zd4f!gCf+NWpD7=Kt}U+N>UVX5UZCbPOZ7lP59X?OA`*0jai=5Q{;%)PGyAkTe|xq|
zT@$1*qs7PCflg^kPC?#0?EI~f!>nZ6lId5e(2QSMidr2a3JD|WXTR9@W(TtLjyAaW
zSc3#0<0$O&qA6daDTdJHCq(<Vwh8|7JEF3Gr{YV=Xi;NPUtj+IJ&o^_;^XmPlox>S
zj7mZCfC6zFQ2?TB{F_W<);3>$a1V=4B#aL)Z%f8UOf2X)+8OzS5|*hE`Hrs7w1rE`
z9m1lFSqLi{_K#-_Y>PM=s)$rOuES^ls@SUv5BAHiw*al!6xuDRkJyMUnNaaQwQT)}
zN%WS)GWW+XR;xr)3WQ~*HbN8?{r8ccB1g3z_FOXtEm@U;pSJqoq7f~qFBqwu(dhxv
z{<>FNXU%tkK9R$`Z*9)A+n$yd*31WT#bev9cB^C5|NITnf!}hmHZ;PvQ$>HjKji<M
zzX^?|=1U;wpc-<6*vGctqoQVsut57GUbvJCiP9Y;$LCqm8neuxsIVU3MAKiMKuSl*
z`p}(*DzSN&0*<PjtOSa@O=lH1o)O5*@w~>P8|yn%9{CbxsTM``E;K`)KjenNTO-uh
z{<Uvx@V@2^-s;$)V<8g?n?aE(g^c={6qBUR+r%n*p0^^U4cwR55LQZsfG^uep07*g
zvre~Cw`|bZ8a}hcsaHx&JbLE1k+&D_xnkerwjc`@dv#N)S>Z%cY0mxN<tQLD6}tw5
zZoqxUIP|;%GN?Y?)`pcPI&YjB?8F<H&yzjtva%#-j%wjti3*rYzLOZT+;QOhezf>;
zxLU$@lBWFkK2k_$(ygA8c*{6U&AIBfWbS*J$VcWf{=1%0%Y7x!y;0?NNekzq0lNj5
z@pG3t^<Qq3fkj4LGqx@=5$E2hZ?QvW%bw0fGT%7rLa}ZbXTH>CDYCKCy9l%}&!en~
z7J4d}^UYR8(R%@^Mp2F^&8UCGzzbBBFIbJg0M&sv(+k{*ChhI|2mKsT?rMQQiH=@u
zg;=hI%z$yqR#<7Is?IlGku9I49<g%uzQ*!>P!y{{lf*(BzfY-B$J`+m64v4}8|Mm(
z&0P79Ngaho0A-<@tQg#7u+JnO62Bo*UXpt!-h~mI5^3>FX2)~(jRZV^c#P&cf7&b0
zJxcPY+vX#Gk>rQ8ZmRa;s=H`+lEnpqmBZ>Q44yMABb>QTYm!44+C7Tp?h}OihAda!
z=e7LhgLiZ2)JI>&2avUwy}b1_)%Tq370$4sGM;48Gv_QS!KZ@}_eIM`?b#KNEia)n
z&m+5Eh9`k5oWG`szx=jso{+%w=?|)3aZBfW4E_6o7AM+NqdtY81a5;S-v?3i8;4{>
z#WBQbCpFM5fbt<I((0fQfOC;MPn;)g%-q<d<|E}uF$&w;{zF;Uh}zc^)QLg&Nv;M-
zACrT1goMQr!5WfP!KB7heZbsNBTejIbmtnpX0(pu0-DosTw&mLbV{7_q*6&W)@j{=
zxyjLo+&5noU)w2WAxdQavgvr9#9&%&8~9yb(ig?U<AqOCJXB`{#VU4xYf2M15B_q}
z55Buo;Al&2>!~v$G>@Sj;Rs>>q#A04?i(6cu6_`~b0auyBhHx4ZK|-*s6&k-%f5-y
zLDddioI-EIzrjeGISWv}3VJX+zz9IrZSL(?p`P)@vm~0GIbxXv$CjS8OT*|?j`+0r
z@LsZY`k`|4=zW{s*4kGmJ$BU2s6S({n-)%;ut0}3kkDN?`Th8Px*hK`(_5R`8J`$l
zt01Pj{RXpozA{O%Mw!$<M7FgFdjhu=zJAXYt=@}!et(+uefJU0w5m-gT9;kFd0YJD
zh%WuiYTlb5M0b{x?2lo-_xm_?q&MssQ2$X3_hr;;Dfp38p?`tj4EF5Fw5|Xdb^woy
z5?(-bPX=#nbBxWhmal%sX_<{Qz8i77sWY+XfGWC1^o2*u`D|K=;J6>|Oju-fPi<#j
z+207dO2O%WkMV3)9kMYmE9@G5uY>Z!*Vd8QuLvbTvncrryClL_UY`?g22+DCurvJ6
z-~LQmC-=@(tNds~&dm{5IB|2?*gw*?uk7r>S-_-||0=nhd)jHHa=aNelH_f>xAofx
z6qcf!93&`wtN}HpUKhq#90+%8P}yN}opePfLO^jMGVEKem^E6Qx<@g&rPXv=n}==$
zZ_#X{t0}6Fxj@RvV$u0`VdKDg2;fA1Y8V{t=PVyS`@0m}<eEHs^fZ+#j_I><1oIkH
z$p_Ev@}2x#Q-M~SWV+t7EV;F~nzPobQDORyBM6?ix-;o5`%sN4jd{Ub=X7uHxmrCr
zZ~3>br(g?SEVrA!uSr~b@H9r({@DhH%+JGwJe1B7G2eXz9?+s_iJzjIl#Up<U18pV
zdnk_7BSAMLx>;Q8r0V@Z<sasJn~4Vbp;#p)255(dLqH>Oh%|9jx7OFU-$2`JnOS?K
zvKB^L20y<UhH$A`4f#UjBynnxYwfr&&LJjXz|j-L6t7^6$jXmc3G#}4b|Kwv8*M(r
z!T_C-qvn~I<bYECcy}|*8}R@f|0gPrMfO)(TYAHJx!G>mfQe(_SoBds^T|xnWp&>t
z>@A8TZSaU^w>YJ+0MP|xmBmQ}arNSNeaX9dyoH)(9pPh_Cy1+pbm)(Aq`ppl#Al}_
z$!?(X0bk8tlS2aQ>ez^$?X7JLTjx!#pUR+T^Z|v5GoDZdSC&4gW|bzL|3Z{Jt&Vuv
zEXxPu#iRSWM40l+;U57_gzbx1zfxQ?AkX7@-{>Xut^Lo5{NQy2&Z~>R<?HIjH|hk4
z4ezjpp@zk{1z!1K{iYw{rVP}J8@HKH=|=1XliqHtc#eQ6=H}QfPZcl6tfljFP5ft3
zx|>m}8MLfac_z3D9?ZJ=1@WFBX4{VmOg2X+s{1;osl<9JAIy-qgGbx`noR*;NCq;s
z#mK@K(1?_e6*58bdWPS3^C`+T+3XRSCm$iY6skGqW`cVM!qJt}G_^m^fG>u>exu%R
zbT!&}NI;ABMti}+30o{eA{r3tE%3U^{Qdbf?R9~cteF|$uFDhe9-$Pzz#2PO>Qn5{
z``H?ra_c9^%UqM6!cng0TX-+7B<fPlA*nyryR0n{1w*VBk7|UJ?%Jpu+$cnbTK*hg
zM(p1VivnT8qwC(GRcA2omA#v|QnBx=;<x8wl^Tf)C60chba^vb6vH#*VPO`}t@<uC
zO)Dqi<d5q#OSW7yO{Z?>9Zh6T{r!<cR-82~p7zRRlAH@3TdxK7*ZJ1&M$_$E7tGS_
zz&9Lo&l{Koy5IwHzo+yyJ+G76r!(DZlY#GKu7s_ZTjYPXtB07$8z6tfR5ttEy`~Il
z#bmI{z^CekkP_{Fw@=c(I!-~Fbi(S%{boY_=)BN4RNX5tN`aR#h%=)*y}m<`4!i$p
ziAo`t>g^1krJZCPOUUxOtm`12YkhMS5VxJ8OMhpcS^BW#OjKhdma9rj9L?)P{{Dj6
z%Z)E0u4g{Ke5x&!R_4Aq3gryX-(clpa0Ja_4&uCsM*!MMtM0owb|u+fha|M9XtQ~K
zK2w`_ZP#v8)i73U#M+D<e$$gMhxP957U;q(FJc@@lu8xqr{qlLV@!NJWR$?V(hEDI
zh3-;tpU01F6xPkpv!u<UIquw?a=4IH>3DanDl842%dZRH9ZGM3`1};P%*jo!qt7!X
z1Z=W>$C7JhYKbI1{{A|T!L#I(PV!mfPoTq0f6Q&enDNU)hMon{z0do(XG~VJ^866%
zH*{RGKn1<~xhJ@%b=z>;GONqwdw=~P^n2rB^-s=J>-EecDQv;K0x0N}(Xdwoy$x28
zFVpqw3<n9F@%Ys~-yaPy^!aY8OeuKtYP~1_`$eLX0FPYAkLpblCHnR-jaP1Y_K+j#
zNwmZoSoDTZK2-Fqw0Aj&S9C<tIoUIrJ?qY!dW>v3Q;Vmkw&qRW{K#o17DYg-qFZm#
zNbjgX4GueZ7OZ86j8oGbH>sO8-3jAz>6s%$ozyp3n81I4YB0Nps(Xz3`k;ML6f&>*
zR;TF}qk=UoFfDdmg`*pG24{S(e>IoF$2~6I1i3OWjh>}8bZHurJXx|HrTQ*$dH%j8
z&WnGGNa21wG`|>`fJL|Q&s3J68i!`TOXQ+W&4@hrvkLj2{ZR7X{z29=@32X||2$+m
zJQj>TZ`8Z5ot$nUJ)G5_sb+b>7KFh2IkERyHDg+>k4bBfF!wR9=g2=>nP-`Y80>Ls
zm;clhVt@v`R;=GiDl0bj&ZY=yQxwI~0uLLcAJ|F6ap=@b5~W&6DF%i`eTQbwu`_Ww
zZA!LF{l<oxv&%-B>JDr2U+m8lny~ZN1Q^R#^3SHai@<_t5Cft<Q2eYSvgOR!u#NZP
z{a$lW5~UdWnyZs3)sjxa16sGwB}zu47yjWxCX@y(g%qW6da&yHSAJh7&5b(_jSqsp
ziHx(obQIgJNht?BXZ|+In{CNLw=ncL%gR0-6)p5HOX+l<KMg_+o=&Mq*Sg7Eu!--3
zUqR`<Al(5z<8Yuk?~a$o8vRV41i@7Evf_~MQ9N4`@0TAUeMoa-5M2WWRs`nVtpM8S
zm$K*>GH>=j4;-H~%u};9sJUB%$msSsc4SPe(XJRGlNfo9N9<RxCSsw7x-w@j1qiX+
zM&HZop@}^GW;+PWgKcd)`eY9&k}=JDz7MC)%OD}&Kd<>+dLr;nHN4Jh_kOZJ9w_+1
z;z9+i7Trgb)d&6siAk^OUK645t0TAY3zb(&P!}QLfyWv=iek+@?s;-29`S_YHTMxc
z(=)!R;3J!nD9|>{%_lym30@RVgsb(zR9ASUF?h#{^-R$u-t}bzPNHr}>T1kG$49dj
zLIZr;v`y5p3Gb1-`?Q=AoT%&6OhgIjSj(-fV>gFNb3=N4eZvd=k!~t-ud9s#5B!><
zVecrG8Sbh2y(FhL#c+^Rz=M|%H3jt3FC5zFUL@`bZ~?#ArLfzt7$2n&j-si8t-O8{
z4`Pi*mevo@C_L>;7L*~+t=ZH(kho6ks0C5&yn4NMrX?w8TwH(LG`4!?@t{38cRO!<
z%af-1_d9E;UIPvy8BIa@f-929K~k=gj2m~3_+~+8qGE9^sm2yXXifi*sjmu(v+2T2
zkl^mFVQ>v@!7aGEOMn0Y28Y4jA-KB}Ah-<f5*&iNyZa8`zgxAJ6c-fTZ=XK>*ip4S
z0Q4GQ7jJ2|^1CV~S^6&57?Fnh2Kn~J_!6nLmq*0U29^3UlM4d-PHDE;O12SN%|`3K
zI83n+6dxuUO{G-p>c7}($C0|aG}QC4ezNuWn~-PaPdp?)bRa5WcCU5x0#gwog1R5y
zrzjB3_eA1MDFFo$#>qlam?m_AeLoJJ$utp)(jY#YXcJoO!J`n0r&^kpnCg?OwA|b}
zm&z0t+x#j2&`Vf_FuAV;(12t6{kuGNmf+0QfCdZl@Y@sFqcb^!nY7Fsz4*SOQ?kbI
zK?gSwTRi9<-n7dSM`xuLGw95C=pfadIdCWAA~d$3xS;)2L5mWGP`JDQui)f|u2lDl
zYKrOmWX()tdln_x@~6f~-218y9^FOjyOo&x>*8YXU8k)djqMZ4QkCE#nk%-?Nk;8b
z0#^qSxJ;CvuBF|(lqcxkyw>bo*MM9Jx~gU`H}kCng17v~e?v|n8$)FGyDO!UQRj~p
z_~q97Jb?7~P(RVc-SvO&Bl?spnfQ?~YBic1xfRiPkb^=}&Z}~!D!jj|yii-Kc`}<A
zYHw=eWW5iAv)~)o-q9|MJ_qYm268zRrFR3X?urIsMq%90XF8__+3wDif5A>B`K}L1
zrOE6V+r3IZ!=iuTn^pCGuY5hqJTz^{cT(&h39|oL6w;#RhF?jGk5C|eK1ea>yi!*W
zv-o=&xLSbYuZH9cGad#DE$#~wj!$GVr(7;yVm#wIr|Ll3_3))jq5wCksVA0o(d#=z
z5o5;0g(&TSS~8~&?_usAh5>K&r6j%AUk={bpal^aW;EqyIEOR9+0RlDJ;OgEVX{vm
zD^y#c*H;o(rcU`e5~>yV8k<*9*-xwa<MH=MzV<>9l9>>wkPPUx@4(7sl8gc6Tbslc
z<QFXuEUr5~cEBh3eM8Z=yo*uNj$i?HzKPna0J7)(#tz`Y<B{S`6_d-N`CGAo`J~=!
zkh9;uufY1pI~K#X-8376tAF#LlWPu_1>+~pw&T9fK~2sFQ_yH_1H60BZtXX7?Pnr)
zy!$zxYge7nt_#MVu8Zk!4=B|>vkcn<Hr1`CKSPelR(T#x$vU2@Ab<N=MiKmYSZ;$y
ze4#nfx*abUW)(ux0D^oA?R$b~kW;wAwdQp-K?>>~F}P?no#VgH70hlO8Ru``xB<QO
z0*E_EpJxZoyzZXPJl{e(E@!8EVmy0|(LmEg290;Co<q9Kt;d&j6AzQ%*QF&N;A-{S
z)v4?9Q782IV}cN9`2D(OL;8<WEroT2{g!h*m@;}%!!OJA5VHN*Y$9eO$ztZ2VJq~3
zJG-?9tC$tjOrZ;3IKun^i(n{g%+*wL4_p76zJY=SFvy)^-#qE8Rz{Ofga#$QvQ-Pf
z1P}2CE*pJ;aHCCJE|^qZbJ^$5TDhuUT9)>#7$Jt~Z+3!Og-?h2)&hu<A%5{S2SOtk
z?L)ZZn^fb!`d+nQ(kY>t4k)W4i&#|>c?TZ5#>te%c+`@XD7d~-UCD)isrz|f+2zZy
z8TWTY0zly@@4dH$oi|n2M6-!V_5gqA1rw*z8x(}+Cd-9%o7nTCF#B&7oAC$U>b{OT
zcxo+uW&wB}GdKVTC83;sw=9*JwM6CXnA+)8U)3t2Xv@S^Ht1Z=P*y1Rli8E!s?(j6
zKps3eDE4OF&^|d6(hq`q(qDJ#2C~0G^wv&eNQT$7aKv6<NcUQGng)Hl_Lkw~^L&}y
zzHRunBVYf-KYm_TUe!$o*_G;-+m(TK^GsmUt)4^Y$0tL_p~7mn2f5W}Mf;}d%s+?B
z#hM9SXeiaZ=f0k{EkiVh&)o=1cCAsKX91*c=UsQ;GdY7>?g8(^x>L<F_d9-r=lKa&
z7Q5CHE=8W_pJ?9u6fvM~)okE42l0U0c+8vYw&;7EFw>FAFjT3}j*WTRxaXP5U&S<x
zF&0%n{FRleEEwo8CnOMWVPtyBS{tIYfNacbU0xCsZ-hhzPz;hU#)_lq6kpz$ejpb5
zD&+vEW7Gek>c)HPR=v8I0o<_t9+>HAJAN!{b=BPa0d{caDrgGNWY^B+5RcBX)S^fB
zOOR8^-IpYe>m)`DqMVxGDs*0GPyd^ah&#3mT|>E9em`?W#i5ozQ(2kC8JS{c(TlCi
zSqOLBt7LWMfj)l*VH8*vQ2aqi!Fi;+ZE3>nW$_^_sX9p&jjLO0FQ);9x3%BPyP_JG
z>|&&Z*rU8Ovph~;>=%B9kmR8a0W#d!I~?a4!MX+w16k!crViDDcWy7j9k(R*Puvxs
z_6!jD&zkp6r9jW%VQUA<2s{>_H_x>l_^GFryPR4=>_xZyD22!6Vo9N&|Fx=4l-h6E
zj;@^}$T3+cBcFqqfk-$RUpvtTnZ)$pV@&{NqKPE&S2vp#nbNgh`C?pj#b+{yp9_}-
zxCe_b3*1RRx{B-5lzCy)G84Foj<75O#^SRcT~l#&@l&Gg>{LcRr~H}M{yJ8&1*fGU
z?kJ9lDk7+m8T5<IXj)evB~4}!wbtVkW_PV*nQN1*xo|EeML;PrQNCV+SvyHMbv25+
zsCUc6gNJWnoUIl-zF9WU8<$K<BN4$<iq&Dp`dms1UcIuB%?e^Xbnhofr4@4yBJx`z
zd!~=P>)RSn*G@4wPm^T!9FWS3sm(ZXilj-Swl<1#WR~Q(!j{-ai7PFpsF^o%9k%8=
z8i?eN5hB=lNs$$9xgpH%rpb*C1mSr+ms2DXJd&7T?aX$B#D;o|<ZCB}5!p8HOvea$
zB#WV@c6k<ie)|Kq%kTj%{b>C0unB=FT&Lx^w-}NQU-vF+$GBDs?AfoVVnD~HtM`wf
zl)D(ZW3OJ0?2d_5&zm+=NTv1e8!?EiZo5E%zFKx1VY1|EeSg`d{-S0QZ)zb=7mHPq
zb!?8#$p7YO5+B(sI4K@0gb_D=;m$P;%Hy*P6i;J{!zIt4GU2M`q&O&X$5$?egCtCp
zA;kll;OWc0DxN1&?R{g7KX_*2j4xV@M@cvXFfy>s0jWv&J-7C)MOBJ1Tf=KX2^Lez
zOvAi+5>Rer^ad4z{(RbP)qHH2Iq{Q`+Vn6LI|U7AtY3@L<+Nn+Wm0LU9>t%_Epe5g
ze;f9uTZ2lgCdctzp$x-#eoA1A(5M8m)GFshCa7tf*$fu!|9Uv0{}3ha%NM~MLJ6#F
ztMG)P!-UZ|{<)_uRLy39CDaVvdKE36C-fuhTVk`-;i|41eI$G@*dzP{Zd(;*d#Kh?
zJ(S-eC%sD<BGec&_9Mnz32y9F{X#KnwvtMEeSUJQ?%nZ&%>h;Z(rM$G>D!ht*RplF
zx?o)DU?x|S>VpaWYyZpayq;=n4_$G_WBS@_QmDao_nz=^Zb;MG>(kQe186UcL3q_;
zq>>}+P#l%V=uLao*uwEn-<2Yd?Cl<~_j<essa#`SaBJ1i9x0wHM_(tC8MQCh;RJKq
zCYm9?PB9g(XRmI1dqMU1r<&bX!U}wEJ4ai;wiN8Gl~AD=)iMy&jfEu)DL7M;3>{=x
znrc|`4ft;O2_W>__IDJI%NoEB5J$y=Y-V+m<XA-w;0aV}srKUNj1PB?PE4q?&<uM4
zFBX9aHSH0T8o>msyZW<HDN>K&YFbdGrejt%`l_lTL5x(qnQnjT&K%84P>8v;jsVDU
zv9ntp#d2+n(_=X79R1_Wr{s?dvc%?ASkdHobRLc$mC5z6swOW2lNN99k2NUPH`U2o
zGRS7SE^B9~2T2er+<<i_fPzqfb4_sE=bwSf0a>-LjtsT0wNJ*(b3vhFd^%qoKk%+~
zm3{Qno?keV5;5J7FOfKrR1K}hM`BrG!Y@;DeXZ}u3si0vp!O6vR1Rr>7>h_|Ch2gd
zC|K|g-u`D(#bCH>wiVU*&w7NRs!7E_`{&Y+dj1Sh*VzPk{Z8EZev4H1^>z<@zw^D=
z+q{e}Dsjmk{Bm8L{cuwa+EPq5Y@lV*aa{q1ta0!^tb=^E>p^diVLpQaWcRZy*_+Ir
z!9yf23qBW{eW(65)$O+%A%eI4>2{QPF+RsB;OCui&5q5&E1s?QlNTm2Q5oh0zr^j|
zq5_rkbcl2Y{h*h0jDkrobi*wuu>jceuoyhFBi=7TxU6*Bwkg{Gks#(IbfDS(Pmy*u
zF&zyERBLEy?x=Dlpch7?iG=yijHKS^1mIxJU?{)C5(dz;h>hU4`)4S-NCwh=XX_sq
z!|y~aYwFLPS<CkDhN)f}Mn4v)^rj6>%z8)$-y|W&9dw##`0d97CCcIB$ZOX4v;C|x
z=h!E8{;Cqvt*UyRciuRVm7N^f+4T$(*W3!V;$SF)6<1Kz-#)#4P(wdD{#}F@s5$~|
za1s7aCzN~O*2P0sfy?WKKoN8ZCv?9NlsSTZ*?Ps|HdmMZR+s(aMInq0e!i-(2i;wc
zytR#S?XpPPL4nxK1~!p2!}c@CUd{>#GX_5=zy2gGT6|Yz1Wa8ZJANAF0~<MuA>ea~
zxqsM(i6!_DEH%-_-*1!#@w#wIQTty3XS}&0M-j}VB^x8d4|Q5=6`1WQOFwB_Dj@J@
z(mZ2Ys=*ZBQzK|`wai#-J7+qp^alVbEua_X9j39H>#mx<2JreVr{do*$9!qI>6raR
zWulM&%b#<~%hjK_r={eMUq3d$LxqcmEj*HWuxnV!`g=)q%Yo&2wQ+W*p^h*Te7r$H
z!x*}PHhzkoU7@#0)^DTnx-h5+ml(78kRn>nW}hZRal8uuV^WhQs;^K7^oT-Z6?xY=
z3YC$vn_3(;L(TK5*dDShu!EQ3*e7OfG<pPHDQ--nbn_v&evWBWiofc}WadL#6Ecpa
zIi*|rhhCK&!7T>MGLO$AHUlL2;uROb;_9Dh;2i?6Qzi<R+jHw$`#;Tq9;CMQJFp=H
zH@Un?2471o*@N&NE_%ow79NT0HeNkXm08k8hN6?w?OGlNEd}lU-XYu?6WCWboafZ=
zFh&R)0l9TD_tSqgXuHGReJ+0&$JHJNa^Ta-@@SG%j#Avm8-0_&6?LH|;q*3H*)G+Q
zDjnA*m$BO}Z>l{^7;UP+2?JIDhSZRDOWVxoQT&&yrkguXoZT$GIr3Klcx{e(xKEvj
z<Gn28#Z~9bl=i4v41Ft?{gsbT7_?<@y3`%rzdY(-r+f^7xm>Sp(HJyq9pMAT?RLNr
zfNC%sSdXfz@<jm~3Uapyhv<8T=6QTXZ2Y~i@fr9kRtNta$9>UFh(vn{(ieCf<4p3X
zB&;k0iKwAHa0-1#|Iwp=KZM)UG0!stkvAghWnS6tix|i`+HCx)EnXjTifUr7ouR#L
z>*)`=!1H8+PHaUOno?bBaSJX`q|yB{e1N0*^H7TZCFMD~U=QBE|8H@#?)PH3&t#AD
zjH}1^)^Je#CArgt*G&0!iBXL!x2f6B+oK(#7Qlp^5&H*l_Uj)n?*S55o-Lc=_H7B4
z1#)Y4z52@s7O#u<f>f3TyW;b7vJ-JR@M)t$!hB~qHCyC8Z)PY1G2`Ca;;Ul{87ayV
zh7)SBT-7&+5z#ZpY3yioGzytV<NkOe=S=AxTDo#`Qfj&BHk2ljD#WkZ3(AsXuoUTv
zE{rz0wNt^vdQK*lt$!GIG2FY2#62TaC+lIV5Lx!vhKsw-hBKUJB;(>nQUWmCMA=ES
ztN4-Tl;%ElVrch=wWA48L^}ABw_E#JHcOtUnCL=tR1exiSn-nW!frUteRsbsy00^4
zQG{3|w=ggdh4H#a{pf|*KV_lDQUEY;BOMe#cqiH1yG%=HG|^EDyh_J^n3CCQGdjH@
zW)CG{?xJ-{H-tC_9K`}VEq`6tU2k$k*71d1ta^*lYI_O>iZ2*5Uf5)Rafs8IjB9^A
z@wKG1Ar<4nT66)wL_?qi?zQj5kUN?;Awf~-v)7BAYwJ<#+RZHz3(uMUnb(r_jdzM6
z&(4gxV9<MA)}DsF5|~7|gr@XwV@>u*hVNW-2m(<1>+-Gq7UL`ON657kT8vRf!(>Hv
z*<NNSVG>j<Y3CcP!apsU9!o*YLO&wbg_Zx-*^I3Li+vs#ubT{b)T)eocBDiAl4kM)
zVPgqQe{9uSx_p2LVCHHPnh8k4i7Lb8sLhhsMnb64#WfTwEV(g%v!%)k;Abgm$zE`7
z->Foacpp8h`~x#q4@qW!i2G5Fqk}CHcBImcBO#Exnu0#W$}S6=jT#kLZ*v#z57<`U
z@1UTtCNR|tx^nEo>d%_8Qpc^DP(4)>%?rzfF-Wj1=C$}aMTnU@56`UGqkZj2!kmJQ
zW^rva7DMp7P|3EA@Dr~VnJan@>_27pQqDusg}|)!+V0>Y{f7@P(EUChqjmx-`##b%
zMn9VjDWm=Qb!jcDTsI2WKHOC3=W^kVMMD(V@_8YP&qg)q0YvsP7;?J?0=s7|(LS8m
zgBr_<|Gt-Vo3@4G;Lr&V<&em(8T#I^giHKRXlwxri-{apP8=t^kK9(yQ?=a=!TOSY
zd=3E+4<IM?Wgv-h&M356u2!aOdoBUf{z|y?mD;E)8+eaidW3D}b5}pWEn+-7Wk-5b
zPl@C3<uov(sjjX~=4w|wO)=f_yue@mtmi}`#7oWER5s}J5rJ0|sBbA5a=79UK#+wf
znfXUe<d)9T?UQ=BQcu58kj7k(9*^$}2A!26p7-FN-W$sr13e_+Go4F0fdu~xi(VbC
zmgm*VyvA%+QFz_{Q|OP`MdeqdGvVWo=7L%NfY>K@QLtpZHA)_|sA$~85qlT)lIj91
z-?~V*pu87-Ytn@&8hd>(^#GQNpURn`5SdxV;J-y0Be-L#AP|ejp1(swJT8;R!jU0p
zKYjI!CU@IQ!&1j%F!%F%580|kbqCmP4;D3ZS2l?Syc5LYu~^x7`yvvG0wMD2qP_aj
zz;|N_iqE6;EJ*e(54#%?{|n#&cYbdyY80tLKM%~%7s(7*hNxhNVzfkn&84+seH_ZY
zyh@sTZh{FG=Q>y_qgd8ZiY2P`A?Vox)N4WJ){G@u=gm^{rJvn@Z+jK+7E)^pwCLz3
zn3(bA#W^1zN0~NIi9C`u%Sv&2&nRlS34i<~;5Z1e=by%r6Z{rK-5-X_LtU{l0L+n)
zKDN&MA&k?R7h;R}#i3nHnEVyl<?3TmUnY4|y_`gdjq-ECMskw?0-x!}b_~Uo2zC6K
zE_P%`XS6sdROJnq0P);pF*Hd5;}zAa?7vm;ZOAwkjLZ+f+%xP43(?6{X^Th<U6Czn
z$ymTlIEL3@Y*;In#(FoF3iDi5c|&pF<UfXeb$+Fy*>sAGO55h6swcr6IwxQwQFYU1
zFJ8y_v%U9GCsoYyYt|j{Lsi5C?_NJcRZ2N;j@J|an&+gP0fA2|vaIaEWQ<4e9oT7C
z4gx+rq)7gU1#9#8fu4Twc7v%0Z4xHk6PG7v1<a%_^C#-qW0C;WQ;{K-eW~cXL1`F{
zyNP)iO(MiYj;MMv@u1z`#{g<X$<a4iJJxlCW<LKi8L0{^#H`<~p?MfZ>i=~0BB*w|
z)HO>F7#NkN_~s%}p?L`*@mbNmrrw{;f8-EjTo<H{|M3tuHcTeesEfU@*%2$K`dtN^
zjPEHakQ-GY+jidKa59Lifw4-FYMci|TE}u2RA<ORP0ICQ^$eAWn4`u;AbeWi=?pO6
zzICTp{X+?a&DIE=AM_X-fG<6Jen6r$Y?#8FHD~>)ZZV!~q$oF+-lB3&x4~0dMG`=g
zn}}V$uHtn%?+{GdDCm+S?rIzCfV#s1e!a1b7Px#IVdme5Wm$N(b0xY;`o*C6dMIc3
zctT(~x>h0N+AR|zc=*%O`>B;dv+5Y^2<fNKJoc8dKr>Fe_U!L1$CQ~!!PA|Oq+np4
zjUW8lj*>Av-ApTeglJam6{-KX&~F;zG*pr0BFXw97Bbyj>!FKWGbO?LsrwDivXC%{
z_lz}E9}}e`T8Mcu&6C2k2k>YH%vv_n(7NG0!)gkz`~e(FnMHv($+eVus2$`b%F6GM
zG6!AFx<V%|ie7z0t0<8_>A@whQ<O)gcyAKUs@EOk`Eal*G;pAJ6&M`sAjmN0*zAR?
zP0+DYb_;#!<i(&Qki5KiwsJ0^^2_>K;8eUKMy*6Zfr=o$Is&VR?~X!+cSw1Qok2T9
z7a&e7iMtjpTMcv_{-8Q%Oq2)z;Cnb2@cS0#DNCcd>aouWrB(<haZ^Epv~bf<!2AOh
z;$4Z*$uW7WymttNB#&thPGFB?m$s$%X-PiUg5$_LdGUB|dE~J@XFl?J*R=KOeA;{^
z*!ce9jPZcD(_06;g`VSLHnK;McCy#5ALaL|l577b;iDYtR4^NSrbfxp+WR8zX%UF?
zr6m_dMM(tX%1_1SI}LYU2>K;Z^P|S&0QDJQw1u1~U=-QOu7s`0e=K&X=5zs}JDSFb
zem#)%8??tK*`c2Sd18Wd=1G|;%q-rEnUA{f>&>^Mqu*9tbO+&CLz`>ADR46)=D{CY
zPPWp2J_KCP67DOto2uKN`_>z35?rd#KIxRNDq0cXA8I9=dEw2hqWkp+qkEg10c|D-
zIklk0YrcL~9Fz`?tsrg{$(PEhg7VcMAI>i<7vtN8<fVCdWkK>vY!LBo2zMaLDNaQ1
z?kv6tukhFy(%u&Axl@dC&Ne7SZ|f|th9h-;Y+B$e6UNesw9*{PJ&6lG0ReO+`SGs|
z@LMig=HsE}+R5wP+S!nzL7Ul73ipazAC4sigqepB>s}KI+x}~Y_lNV(Jz1V)_eqT%
zTM$mYTEAgdLzna-vY2_H;=fuv)D~(CxX;kN!f%3c7C;T&BVAFIQJFOZjrf!OZY~u{
z=gtC9(>IAE@ct5@h}+d==Pto56AYw!MDPRrS<xOuG0{XzEk5{jIQQ_iPeK9}aWSQq
zSj&T&-=Z9kAv6PK^$tQkd@+)PqNZ*VoFP>fHui&Q@T!UTCHm9S1Dz^6l!?IuHjN&q
zJz@2&kGh{x8(A$q#Q*rki`8<&ij2qbLzYq<Xar=!sML!^-))YgR9JwSDvs;NE{ozT
zjdX{;J`AzGT=VpME<nojpoF4~8tM&Jd=*l=1|upJtSEzjw1!5101qZcbPYE_p$ll*
zDaxe1$p)5o?05~nrip6DcA5XQ6sGqp1AMvTQmwh6*G)O-@<5TyZ9C4jb?rs6<A??P
zauO5GyPI@Woju<i<hb)o^L0sgtz%#n?s+=>4Y*jlv%!hx*7<_xrt!Z55#9GJrx;K3
z)x%0fTi)shXNVe--6I7u6{Om$2!f<5vNxXga4a5cG-Gf)7E2CAJMxfT1+t1J72SNA
zCtZ;aypefG%%6bIMeGiTXZTT3YV@V}#vu97-#KG}2VWH!nIRre*7`Utz;xgoF6sJ2
z995MaJ6tpPH@5*H_4At=Ys{uMM@to?J2@0cA7oc3I)#|i=umTlf0f!CqPX<jQ<7<0
zwAV^*$|@=d62BIbDsdr<n;7A2YbsOzT}R=<){5AK%To9=F&B)F57GALY2~ZGd}fn2
zN6r)bYvUNbj;kptkBvl#kqcMqZ@mm%`nAF&US(T5Kv9rC0AoULFnaQ|fYj9oFtz7r
zymt{VrEFl6yA1g{i`y=LaT|Kyh_JYI4GxHh?RTGfpZPz$<zqjcfzMF+ZL@6!4Bh+G
zg`czQ!uIEM?O$SCJMPdxP4@`{K7YK<s#;Ik*QWpH7`S42bWS}-=;igBP5p50@vusX
z^=nz;lBgOmssv1Q`nma3aw@6$@ivCFob7I7wDqq{ZB<3_Jxq&k-?>-8Dz2o$Le{}`
zm@6+35I=u3OWu^E9m*{HDF!fpCK1yv97yX8<>11#hvoNocX}h24BBjWEAC*;<^{^9
z0J$Tlb62ESA`V9~O88@GW~8_V6VvwrdP0(^GKNDD*kkCLpyG=(DY>TXUM@(8XBfGD
zK8%v^r5M_{S5|)P@iBts4;L1aCQG0cyR=3-PN3iO!Lk$h`rmvNc+ujH_pl@`CaenL
z^hqwxdfdAjPd{tMfL!+1-C&P7j?XE8;YRRPyOhwQL-THLg3#Mt^~;j??JbDZ^lFSt
z*O%abacJ(i<4=B;vB;f=1udTwS{M=I`OP_6Y_=Ko?85kj+94JsgtIO(6X3XEYEWmL
zlh0>1yg-6qzdy^=wil#k*P@ikxez%s#GOsCwFm)%N#s2+W0uKNXlm+7I81?=f9CsI
zI~|>ip8`#LQ83B<`1nWC9WCuFgyB=jW@mFM7%;UahVy8pU?y&qyRfV|wa9a)VI{J(
zMdyM(palw0{ASb1Mmp=|8tvry2n`*H7<Yq2;1X03L;mLrCVwl&zhNm{R=J_Rh?!MP
zSl?ScF`&j5T2~m_S#@$Kpaga${2lt&&@~2WP3l$d3sU!lO6<yr$a(m7$=|Ek?qd=f
z1R|Jp_}>Wf0tBT?&vW!mkLAT3$BGl`aP|yKP6SP`;>0Re>fN$S?=w4R`=ZU1S4atN
z99K0v95;~+o5qBmmbbnu5^19_gD?8Yyf?9sR8gXn-<i9eh;#_Y(>-A(AJ@fV^Pfp!
zR<eM2QZ(?b9l-AH+m3#iB=ZUbjP}&QtlEyVueL?&BH-O-Hmf~X2%%R1dQMdnV0O{*
zZ$GBJU=irsNLL?Wd1N#Kc{9}LN=Byj^yiTHG?jGl%w^b{C7}edH1!Z}N-#|!Hkg_^
z?&vBS7=c))baxx5X(?doc48hhrhp@S?bR``q(t6AQOUE1P@3UmDdO*{5xpx{w|(?q
zIGWKvH)T~Eov&H44e>!glUQ(|vWgeTX4shj@U^BU_*2%JoeVM#g|jk$+0xwRS3`=w
zfGHNIi<8Q^{#EL$81AbmV~oNOkF@xt=FxUuw2pY>t}>$8MiWPSG&PNQ(G)?mC4wkO
z>qC8$b6lwAmXN{Cp*5B}pQC2KMgjAJ#AgeQW4J_8Azppg+VkNcTD)H)ib8Fuam{D0
zb@k?o#mg96ECd|MbR~VLI$~)(F3x^ht`u84=MBMpjdK;y&KNX&y-dEWy_wgwH`sL!
ziA|^K;nQY6jm&v(5O(#+8>#NOvvMlPL19FN-8GzOGQlDjCEDuA)rt8#2v}ykcB2-F
zmQ@1W5KpO@vpIZo{Fh}TuAAVDS~yc}9Npl*^TJgsj;72~JyYb|R+1^W|CS;f*hkMB
z2Gx7rU3$YmTtQom@wK#YOXY8UQU>r#GIWItnkD@ix1=UlETM83*RgbgoIxa2p7NN2
zUAALcZoYvM!Q8KG7dyuRc0+_B!~T-xtb_ATxZC(Z93Gld=~Dl%*wEM^c@-iIKs<wP
zn;F56UO(Eu=chlnd~wX2*Q36DQlOMuR+mI!=1ZRx7m49sEVd9vo|G$^x_a%~Q_dHR
z3jI6Z6rlcMmu>YyfB`cQ@Ga~g1ZiA$+=|KuEspqj_7lJfzCCP}cL`^^uEq#I3<Xtu
z3fnJZsHQj6bIk-UGeD+JFuI+oYfg-0oT5ASpl~O#FdNvKn3Xd%YLy)P7bKkhRRZE4
z?gC#V*nEKvzuvBclZ|g^y0Y&uFBJ<u$+kS&h1T=iu1&d%-905>7ac$`>92OjVMi|6
zx^h#=*V*+0a-<cTeXeG*v5=RRgD9ivW(tS92|FtOO5Y3>M_8A49Iqg(?u~pz(6Kam
zN$srA0I=B&B{}nH^!bx{bvLXdAjE#)GkX&gFh*?>=?&gMz&g-|e$v1A@F1uGRzY*f
zMe!Xx7t`Q3r4C=|)vzWDWeg+7W0|C9MMVBb^7I4kV<3xv%~x{Ds1MGtc`Z0N@NxC)
z;U+Nv)id5|*f^Vfb=K@e230hVwL*_C2QQrgd>VN<;vMA6rwN~iYRNF2f>CQ42%U>f
z!xx4Ibh4Bf9CX`SIfPiNE>}O6X&#Y^*1WWh06~w_cm}VReR9dGdk+(away1AjoTS4
zJVzD6&+Bkkg4~o-3CNU`Er(?}<jY1qD9a4Gb{L7wntJX#>mf`!f09VCo;UI$hVjlk
z=1DFFpi!F!pvH>cKW&e`IUKe9TSITvatG~=tKeuN>c12}$cx2V7*fNxK9ML&2N`4}
zCuF6mLPEj<ZNn@k%(9xwopt-_;V^1HrG?036|2iPOh_uwC|?HZlLWOS{w_*@tDX35
zLA4p#HhlrDvi+|DC;z8zELnORfi}hl2pN;n5x$I$Uvw_(&yw|}2MR*$o#nXe7)PK4
z9HB!%iDy4ukJDhL{s*F98%&p=Z$B9OFt%iUq^&I*C?xZ;;7hzavoJ+e9*o+W>d=n4
zotEPynv!ZF%{D@}sk~WIyOF*Y6NRiOeqc&u5;X&TrN%ZuZRb7atjCeE8k)LuW0fF1
zuCQ!uVCT!=X1au?X$v;n_Jggl#d0U)GHR$($aXl%A{$?PBvC@)SMT&uWNb((dZoq7
z^uB$6)1?VN8$;M+M>Ec*%{g6=M>hhJI*La#yUBwKoz@r=74wno2y?K$lMNGs%fk-n
zbvm2biDmVy1CHckv{?RnKxj7(jdxoFNvQfAhARzY5+_z1lo207>E5|Fi}TzJJ(lJ(
zf#u}w`4s%ytv~DwQZk3*xX?yH2Kmtqi4;2~j%}C<i&+_Lc8H7*4dAHch{E|)Lp<;%
z(&Bsk8XgJ1qe6APY9|VPx=0_C?GA2a;Yp?q0>q3cWjZ4UFWp&@Mn1tT65`&hrkw%T
z8cxXm&*U>3x7K;!`5)a<=q>6!c$JXY6x<0GaxmT+L6VI7ukn&yxZiasOe2gzklag?
zulmIdnCnJh0&<YJu<<3Wd5(5gtY#p-6GOazz$DbuC;#!gf4ngvtJrJbvGeEk0%^{T
zm>xyZWX%@0*swSerBpetwoS5Fli_1-CC>~;AV(U?qBVNem*ZRL$Hky<eI#3Uw*G$x
z=&#2G2_5IP$xPtWmJ54rmldEe-{XGyxG?C|VwPp?tqV=FLTkf75A<@A^;`g0j|m}p
z{Jq}3_D1pQc2Yl|G*9fZ&|@h)#HrTt)V`kXCiFUq_O{--_I#>s>9wmmunNJMk%Y_t
z+l5dI3-MSeYM*g*6`|q2om9n_m#bLps958B71;6a&l6nFALhO*fe);jME2Rc<MNd2
z$a*rQ=geE;QviRcG&BXer|r_ZTA!;cf_Q@F*xYVwkDa^U0cOS@Ebf(stk)>N{;4pi
z%)B_cDvia@G*+FGtRo;ns70IgaQ)qUX;$@icBb~1z*BeA{c)2CkEF1IG7&P2`NB<D
zv1;GU`h_XCFUpca!{1<x!P;F|!}Q3PzW~@ma}`hn+vnfiM9JYkez{l`J;%=bJ?thE
z26Nt2d2O+($a5@mB!#8zX0n+lY2Y#$=hp7lEY`7yfHM(p&4a_P*c=jCZ)+UiylaJg
z94khRFF;E_*W}NNV#uzb0a>0@d-oCU)yFx3F;_VQ&x67}ujegp3A7*MamXy^5GL#S
zhNDBd<8{>){L%+{dH&I`_y~~=zKs-nLzebzlUWNwz{L1G<9qGIz*0zx$9QZT4|s2y
zPVik4Ob8$HzCE(oKkjk2`=mWoFFKCa3<On^Ids0>waoj;B{K`YIstxx$6l=}--{Hk
zWD9Z^BvDPfW4bl4`_N&PWp5c0;^fWlmXcLdtKuSUQ%228jMGAtFcjz|zwb!HtL<7}
zST0<{Amc7Ng;+3BL(?)equPa)<|CSbp)lIjT+8qmF^g5khd|x@HXBC?>rlXg11c!)
z%Tb?4|4fD$<WuL3ox`lKK@}YF5goe+a2V^ClMFD5?5u704Vv_1l8_%!#$f^T<F4ZF
zVZA9*+qJZgD-3+=KGgh*V!xpjkBY#6mBWAycQN1kIAr$s$c;jx$d^-G-;cJAQUobS
zR5Gt+;Fmp_f#xVy{BrK5NZ0`DFm+n|T~Qd}3ST*f$Z8!mgE|XR89|S&qNL-tjbjrh
zzJiJ(=0j%GKr~11$|(8rx^WZ({GMczzUK*^!EJ4Jw%4WF+2b^XK0o_8u+qSIUz-G*
zbk}hv_F27tCrP(sZ{@7%{Mj(`=i~Rg)-#cvRw0+`8i=yO(rf3>bO$Cbhobu>mhfX7
zn)mt3*=y^3+hGuk+v&2r7cki#wCDNG9{jV9;k|8w{M5R0#4Wid`QNA#BubCf3d;qL
zq_gW<jSUYPXxF&ZF4jmTMd4g;N4ir0wL)Gvsp!;Uv~&vkHZm_ia#NQAV6cRIx*NH*
z+`XbI)uy<o&a0wT_LGxGrGE?K;(mOm$u9$Ehl_&Tr1fu!Ex@p9Wlh&SJ4d~ERSQOg
zFMv7gf!(nV>)AXetV5+2Yf02u$HHv%?7@1Rw6Q1N0j5WUu;3?z8V$8M*dpPJqI=CU
z?eVRVe>~@~<e`5X%&BpeX;S$t&UfjQLNV}2K0SmwR3b0(Vz5xtGEHjbp>m;u^FA=y
zL9ULRfxh&D3KpuUe4=(5WMR4vcYO$3hN#;qo}J;*`LAY<6T_^1aZ7teSUdUVFl#Zu
zdhv+9<Cd{;E2MCok*$+UMAv*KRpfIXCpZLhu2cqR@eJ-$sbbphGo1Rt5PItuSm@>2
z(EC76buw(rj7IMM70u^9`ps=Z&HiES?F9_-dJ%5M1A#VzioGuW5PVxlWt<Q^lz6*Y
zBQtEU<?U#)UA%N{fAVJWekkv5TyFYp$g%WJInaBMSMw5VyNknkkso?pPuK_X!PUYf
z=m$~Btn%{0R$pWBtp;!?c=C+{(}sN3A8KM{q?wZ`FCp_7)Ue|d7WJY+frEw@GOTa5
zOy`&cKzYVrzHIK)tQ^5zzJ2?U;awvLKkS`V=2f=oNoG;D9uf4j<o!;M%)UaY&Ge~)
z`eao=!W0-TIj|(!F2u8n(*5bZLbWSa1$JHkmYU#bx{@sE2gC_P5`nnzPh)xe<Y7>f
zuc1DoJ3%mo)Psz_;UW%bMEb%-|M2{!!$gd^N{zlKa%j^RZ`})IbA(2tiRxv4Y^s{J
z#%(*Gg!iVOMiJDFf~tKDN+>F;mZRRH!+&fyYAeV8-Ab%>Ec07l{CoXt(xiJ_#JJFt
z9O%wf^(8lSDT(E6F$`efbkTRkT~06v?%4T3^yAM)gyFS+Ayo(bUPQ6afxY1sn)x0D
zM*D94ThkUQ|MFE9+-MK+yma%;obKE0Ea<JDyZu4vu46u!=!dj;;?*6<;dWM2^UY+y
zJQ-GT^*=+QXsC>rw4`U!gyv;XiA_Vn!$;OYJ{1A$+nF6oE~?Utz_cqryX?qI#VD08
z|BkcIkC!h3`#3^$x{`J<1vWHxK0#;265tPF0DA$avKBNp{RdJh#E|F1P-M!MWYuBh
zxM?O)Z=8)z@{e@1p)Rcx3gT0Mn*Py8uQUb8(#LRXB?a^k(D4Mih5=-KXF51XM3_nZ
zMe#Uz#z8T0w3cuZiQnf|E91N-m{=tUF<^HKp#T-bFhea#@TtCHTF4cB%>rLhXYgU^
zy&yJVq-Wh;-~qori3e*!gjC7jbMgG$F`l$dH##m7OVTb-nAb9s`<IfUmbHBSI8o$v
zS~prI)3P~EKZ<W0kLuLIe7h+uZO7)S>H*w_PGh`MWP&lX>x>$Ach#O-0i=!#L)pSR
z5Rx9ArD>y|2<-Ampy+dmF~PIRo2>8R?lxwgtpA!5LVP>V;`8thO<c-JLFBV7)m}G8
z&{s`V!}8oK&y{r@PXE3e@}B&u&bTeCmgQ`E^*Bn#dpm41WH~;5hazEu7{V0*uW;G#
zeMk%M768;OAA~9qeyG1|e2I2dF%O>=n?iCqn==x=TmpBeL*$nAS1<<eDzNDP!_{T~
zFRm{AX`)!(!ap*q>|WgJK*s?`cj+)51(45AjZZ=k=daWFR02ab@@p0brxS}(x0_GH
zyc;DiOUpG9F**Z<NFWqdkz@qR!;LHV6*yaw^()pg=^GqjSPZKZG<28t2jj#z$)w9b
zLaDZ@ai|vNQ25HyLCUtT_3kvp<*Fh@<A_ShTAcf}Pv87-MQzVp{yqf_Y!!dN#Oc67
z(<z!4r}aQDuTSHi^;3yjqOUoxsKOJB=nC=tj`BcEwIP(cEG5xOsg2B9rX9m8Ry8pe
zojkW><fP;MdF!ptGcGiA_4f!W5p$UPc%{qIiS_`Q@T5KXq@f!8Fa~}-)btcO{#fnS
z=Rss2S*_>25ww@(b$Qab%>FVeH5A35(YE6+cWe^|0~~5wpn^oo@NRdZE&m)KX;^lQ
zfGGK{{~cAeUJjQtcihLH`J6qCBrCE#K=$u?^^VV>{brtua`@p6{MO?RewDv3rkm4w
zh;ePZ*<ta<=x`k4oVRW4sVcV?dPhOKO%&@9RMJE;IYh_of<6z<g8bv3?z9Zg*wN-%
ziTn&QMeo7|asj_6hVB%b0Hw!fH-lMCNrPt2JD+3}|GtQN0!`Up<YlQCBe^#t3K)}M
zNA<eVh*|{x)^uY8XecR9Z=uCr`RCH9-7ud4`g^tmL|BT@9-Kq`DqbApKsH<m^8DSq
zpSh?vD+U-CP%`pyM2|B*25M>sK7Gx;)+&V`dGtK`@D1lfOX%%UnN$leY{XrQQI@H|
z$h_JKL3R5x^_*BBzuFb)Qi$IajrW4q78!xQ%hNDQ2yV^sKO69UnWp}2UA8=M@4bAv
zT4wQHrAEab*=MKg*g$M5mOfj$b>NBmc>~Y>)U}Kk2pduhF#$l#xFM~0;HMS!t3BHH
zkrm>7JH}o<dTj;<@I&9u6D@u?qkYS*DxS2s29gNhsgGJ-6Au@U6t%@%H%Lt6iX3W<
zdIdWnRi!@X73FJFEFtYKaQA;=U#+Gno*7sK4eoYn8TL4HWskqQxu8=ttU*RIBJLVQ
z$v1$!$L)l=!XM{}bUa(`G!9#Q#BazgxttRCugU2zw{pDwr4v<Z2I`L2hUZj$OblTj
zo^D6M0vJSOurHIzScRM$agzqkW}zRSMyf$Ckh?OYj8M=0=>&YgiMQ8ENS!xQoO_m5
zp|c2)!FSyL`cL0{dJ{u-6{gOf{oc(h`-SAun2w86$9%g;8Ad`dICJFTz?7g`PRYn}
zuYefr#ud4D>@dQPv6R^R7mZUB^Rn{eCRPeVSi79U#CcrY4Ie6!g`jDu7D>CSHuD6U
zd&DPpqy@;D;hi^?)oWbY<~Zij5p110{P@Tt<j9M&w}&V3SB0cZ9ZPa#(Q*yd$6=(6
z1Q+8%(Q%9m)8s8in|YoH`4Bu?D&sxeFC!8&USLIxZB3|?ZV@)&v)ucoha}WL+=uvx
zRwO^`&~}9j$RhlNk6^R92z8`2*$!M_#rFlKPP%g(X+iuns4bMDHgP3Ddlk5F%cIvZ
zUVMG$PA<&@Cg+q1J{O<)7riLiIYQ&i)NoWWOR^{1H|ue9$}mE(8zlM&ZP_gU-_tv0
zP~G-=!;r*Mt*<m(Ig*s=37O#mVRD=~GUN0d>e98ss}K!s*$pqxLj<>1&ODxg^9CU-
z%n()7n)jVSn_ErmJsbo#KereC?|So>OZHG3KWL3CGYk1j)`Pm?UWbhe^QgAGzI++D
z<(}(L1mP6e%V&0q$}~09vSVhJvfS6hZ7PH=YKry~=9Q}*0t{TGrS(4EatNqW(ErTR
zVHI_<dOP?%83V_DbwPV`RxbpVO=xM_qEl~dSfT!q$2O^~wW?chJwz`{0@byHiz7G~
z*Ph44UFA~J(9ecJvRG-?<8kdiA$t-y8JKVyg<Yo4G5w%euiN6CPK7Px%E<yBvg4ng
zM4_Tw)x4jlYWQ+kdg`);qxrmcF|g+Na^v)+RcMGe8+29nmJlqTQIL4ral~v|)wUVV
z5aZD$x9j;|-C@_cW=v&2eD<H@^oC_eSfH44cFXIL5&q4mg5uKha0|5#4M9&7xCM-%
zn62W4OBEzE0HwewHN9!a9V|6XJ4mjdxIR~rUN~fI62(`zqCSTJYr>p3$9UL;{ZSNp
zRbwEol2dLuS#RdP4zHmGHEnrM1`dDD-_M%3Q-1gqJ5uI3y^K@^k1!I;iY2q;d6WT*
z=*p3BJBoY)*nE4Nz6_PKQEMNGw9Bz47>A<x$auMA!nkT!mxxcojPsY{BI;qh;*3T5
z2wQLmZ#WSd{|S~cZK3Q(#SMX#X1Zuh?r<ZB>q0)D1(&cs1>Cr;%WDDACy(V@CC_P=
zq}s!jwXbYlC)m@ZX-?XY^Jtb$M?#IB&YzLCoxJhSk`g!wy8;9a&#kxz4aG<a<k{Vt
zPj8ndS}%6b<r#{e*;5#No|c@Vg*=SQL@4>r`qQfoH{O~AhS-T%nmk6%#=+}sF`iQr
zc$EgA$p0iX^$rwy+NDD$*O)V73+<eX-zEi_5HuBpH0-O9(GGaI<1RnIxLb3FAX9y3
z8XzFuJxzIPvDI>-qRdxxv>GauW<ac9<_Rc(u%v=Rbp|DJrwsMzhiPAB!=+=laGOol
zejP~jx!m@%>9%Y6Ii-WjS&DL*e|f0aSxUm^bmxasBkc`qUqj)<cS$iA|DmorQPzYk
zat$dfy|_Q|MQf#Eix)|o<R;5l+alGml&RBCYz2QF`msg72+q(_N*CLLeY!9WSmZpy
z?hCVl{N#<`!R;q(lgYxT$Ta@0z~j@d68Kv<Hm!B}oBRl?GkG3E-$S`_nrqwB3&yS~
zwp!_S+dP?kNkL}LVo50s44y|?C7<{>LkS)_QeS}c?N3XGM2#zZg3tB9ezM4x8$LNh
z_r_MnaOv(@4UOIBSK;T2iN@7W)rI>YNt@aawF9TEF9ZCmEl14!_7Hmr<RZ3n?|PSA
zUqSTT*>4YPCuft8*<WTiSfiBmU}wC?N$PQLS0a8a4w_R!LVl9cUVlJNxN_OFT5Gzy
zY}CE2fd<cxb<e}Nk-JKa#9gY6hmggm#sju%WIN%jhs0g8cDGA(z-nD+MTQJ4^e^{A
z`5w7PO*k-0B-?Gf^57;%$j3{$KTrIcg8co4?VhL^?AKKzUb1~7f=0-#h%2Ly-iPZ`
zb^906r;R6}&FW{mi*iqYnKM)S#7{rKQeX%I)0sT^5H!VjpZ*;wK3u8a)@z_w6}?}B
z5C;e8dsn}c{PysS#H`g|8=f@tp8(G2;KWpf1QVzF$nz&84rn&{&^ShE22IuC95#VN
zKjfPiTrykCnPnYL>0~*HQ1@B$!?)Gt%>8n^s_G;0w*Ii}AcB-<Q6b;z8er3J!Tudo
z91>NS7BOXcw7=#}JTVyt=@Xr=b=|=v`axl|JFYj6w10$iUncFSDp1%sC4_Tzf%q{!
z${G@M7(d%w;R}p_FN4Z9ntK*cq;LvB)~kWubdn1Axu$uF*2g)G4$d=bZ0HhFCPl8_
zu)j4XSG~egs9TGwqE~@wUv8q8e$<`vA@NocjAYw4-%#PbeP0~5H9U>>l79QY2~1OF
z()1w{K#$K&#JnE`=Fj-Is=d|jkVy&Nl{X_;b~9{n{%zA(Xy!m2h2`4ME7O(YW;d}c
zWi=>{iXGPMVS~gtBUdbCNo1+0k&Y*cjX%eK+Z;E0zvQFiKn70U@=Uebsk=@fa5+4>
zZTiX?XUsg4u2cV3Y+LndDDEfZrJm6sQKVi+fZkTT=KDwDv4Ka$Q&To_LKuP8fHym@
zwes<A`YoNWRTPyVkuBRshUdH;GZ~ghj|*wdz^7KLKa7Gw+F~B?&}>{f4eVszL*~YE
ztA{k2YaUAjEX|A+pWYiBNSRoaas9iJX#hCvmr;ov3YHfb-APcjJ{&Kruaf|VOQrXv
zbR@s}bQgqC(ijcf$6B-$05++q;tu2C6dlRO;~^paxknVeXWhB7kf^t{sWWkkR3dX(
zwKKr6tU$41(%6-9yVlo6$;@yfxuqwSe61)aA_RI9OXpQZap;#of6C|BKvP_23@U3|
zVdMC+qLHVBX&j<JeM?eJcJER)7+#%?m@|MGS(ubBWP;sPCr5(APbr#H{}lEb=xC^M
zDJoGK{JhKv>`?Xq1In0h{^_6KulF%`<>w^AahDal+o59rHbUdu)8MVx_H@?KII@ZI
zcPL10YR#!LkZIlP46_is=gmDy%sAs_<*#-Vlask`p#p4J#jMmRDRn@~e2%S^u8T%5
zL8)`d+uYnMUeDRDwac0T)UdfP*^~ciG-MKfs_>e+3@o}k5DS%)a;L{)uul`D%$#%h
z^=UOPiL-C3m^O9!-Js}vPpsctz0BX`I^@a?lfw6Kabmzw>9D(5_38FIfO`pa$=bMP
z3c%L;(hrr(_Q=E$4T#h?J628A8LKm0Ubbgzp5Pftv^jPzMHZXTh-LL@*iC*hAoXs%
z99G8o^26%jX6p%g9zK|L<4yH}Z>09ugK4s!%kHmv#?e1Tzp4#?-qa-Pt(JAYALZ}t
zAa-7yBwHEO?AAI<AwUvLepRtwoweXRAniFKC~!Iu!~ZzJ`FJ;g5nTq6F!E)EWxE-Y
zoIbYiE;@$yi&rE%G*E)gl-^AgvjKhKlc<6Wsjl;K&NL+Pz0^@jpz+j8j}(f^TQq)~
zioca_o*k2i<J)=z%(%3Sp{&uIG{D$%J-@}BogvgC1ko(e7w{#t+ddyQ!|F3tyLyEs
zze*82(O?2CSGc{&aU0_+tUw7kQN)CdPKo_FXVK072Iz&SqbLHM^z%Y}3t^;6wD!nx
zZ~#X;5Q)g*FA+t80O3a<uD*}`<V$Z};aAvGoKZ7JPW;mkSpaNC?Foq0NQlIUiu=M*
zjs-$c5zvo1i0Y3`5{bZYu|1t{<N2Hgh5pUtx;Y=>LYyKzFJ#9Wx_={nl{FkpXVJeb
z_|c%_UDAzYr*r!-Qr+~}fHQd@s{B^(|N9+uO&j$a6sGh-Wn#J8XTQ|FF|7J&xqX}T
zi@Exhw0n~}9XNDCo_=;jgGe)eBlgMr^3ho^uut3Dsv}jKKfr*|r~=t%0oe|E$JTZ~
zuAeYV7raQhLQ(m&UYqS;MaPK@Qw?`pYJiRC<z*DfmPF9=c72WIQg7!Cbg}c8#21eW
z3r*`gzr@Ha93S~@kkXa1e;TECGqR2HGJ5_6qu7O+r^hjG<z>rItw=a;!U2U2zSIB<
z7uNVrXVo#Yu=R&Su|BsJsIE|sORvqU=d;|dcQhk+mDbO#6Nc*MlLpBD{JNBG*ReUb
zL_GRc<yx2!Hs`;OX^I+qWIOUcn!g&&hhb$Oz!h;u7zJjjxjU#<=19$dQp@^swRPV3
zEPr<b>gJ4^^E@2FFxA6smJ{8Ec^u?KT@d&UTETO&c*`OPH@03oCumFdrml)DMyc#s
zw*PUCJOLWkRtNF#+(q9~;r`Vkuk6%<mCzcPi(|FU5}Ut1R-PtrzIMCw;Cu{6<bX17
z)|_yjKU}m2M%h@4z`r$?xifjRd#t4n?&tl`<J9_p$M&G`&dWn>!^kO-Hzmv~JxI8`
z|L7A9Pc3C7P2M0rx!BY|QY8N#i>2UZeA*5`cy#Vkkc{^Qh0i<jCqKb!$>MlrGD50|
zurX*}+dR1AwtValh@>wB=0-gRCB8AZno`si;nH(gbB>iGMYpQDrULLZr`0hGF@Af|
zf1>+W;7T`r8nso!q<(GWFiM&ClGSE$jjll5{00YhtS<c0|MffWTU440Vaca_JPYs>
zq_==n>w3NWL_T?E6K@qeGZ}$%+O<OujS~-_YYWM<*PB|8WGAC&g(`4Ri?(@w>*V`<
zIyEw0<D;bX<CGyUBI6mw!Qzn;)x$%rzbkjq!_qtoqj63&G<)pZ$plGhJM)<e%6st|
z(>XLV?#L_1B}VDcqVdb*VMKf@d6aP{z9yN=Qp$zdN-cd#cxpz;YKp?fCha|K`w-+`
zi&J?L$fb?`<lW-aJ;f4ESYl!(gI-LS{{8YJ_H~TJMV}3IWpubS1;G#{nMRsXlK*x^
zK4p?fWI42%C}iG7v5~m=N5@WST#8Q!1dwfo`|x(@@v(p;JTiF}0ke7d#~jrcoYgZS
zz({fG{&ZzCrndPP^WI>c{&jImTH_g|8nkK=WQx@Lq0_xhz+3vG{hpjPko;}#JKgJ#
z_hShucvNv9*}S?3Ha<(A6|}AKZq*&bW$R?T-)ztc@yl|T!rrLiJRo*PkvoDuKmLV6
z&oRdUNaUw;9dq?z4XZj0cjnF!yNO-C9TjKTobX(e)pZ<Mp_7<e)0gkmMjJvHQ!1C!
zmK^ExVGJQ^JzvlH7Np|u?(@<puD5>5w6ked@OiAvwy)EE(8q^GjjV5u($?QWxe4or
z+uHH=9`qur>@c!)ASbC=O_P7T9WolvKUQjArYx%s8oP&#R<uDElivBKa`u0idh4jD
zqPB6HQX0XL?vO!{MrlU6gaIU#ZUO0#Mj28Xkq~Am=|;Lsy1To(V~FqYKF{xczdvTV
z)+}AloH=Ljd*5+gcKvp06!K&PAJr~(fP7%w;(xk{n0blQOk%b?7Q!~qlGmH*E12l*
z(NeCcYK3AJ;Bxx(10q*HDVmVVP5UKvYTGQ?))BTs7765ZoiLVM@*|k~I`-#aFw@Gd
z0Emd&ZhAe!v_`y_*VL49F2Oky6;3F-hMh*Z8M%EMRY;J-B|ud5#N_+?hBfSt`yM9n
zJL%SE@~(a97G{EYtKZ)9`0y4Mv2I{XTV$FIlhdmNMrnrh<SD&QZeNR%#NF-scc7gy
zaEK#DZ^N83N;_n9b<7;)VM2I2bLt)Qi=Am{h>zj#iRxcm%|AVkawKPE*l0z4R|=KH
zIvKS?j0&omUER%0v**9+V6)_gm~s_4L0eDX3W&eRrVD-P=sq68qm9x~Jf1SGh=R?0
zfRSX5yKA;oPQ8DxTXIkhF4n<YmU3Kw=y;N0%X_dQCeIVrP<@-$B=KLhk~s_GK-dph
ze?$wqs}m36<FmBhgd1Q%KtwT-7O?+C`Y!Twl%2sFE)z!dd3GGTus(CJL-I}A`XGFK
zbB$Tg`o0*#1p;=)aNd4q`fKzmzXTC=NR^&G$Wyj6q^g?vqSQ~7Yke+DSMNODWJt^g
z)9bq-E9YR>Dp6*jS<lykx-VPz=!i0NZkT2a5^#~URDq4(+P!_~H+u75C1qdY`zykg
zQ%6CY&B<#D!Rp9!T^<Rki@lmUZf7rdxP45T>$Kn#QCOdi+(&6Rc#riR73K|gHy8aA
z=oS)N(Y9pt^9fGNT<s*Fj%O7H{1^7d6pPUTLRx<12jCYFfyunt;C)VFDYeaEJR~-;
zM^102jL7nqkHk`JY>|B`BI>)tj*kSld*P@}4uT7Mn+^&7GJUd>(Qf#s?-waD0nUBQ
zeX*t10#c&_Ji+f@5W4?GhZ8pp?*L`PAD1XNuAFKkm2(y%j#LuQ>DpbQ{s~KNnQfKA
zLTiI<&jh&sWO(4}!FD!b4FUDoq25d@7?g1fiV+1k=Jv(<ryf|+Cs7~WjpF40yx6<@
z4@Q(Pv7)-%NKEga!Nl20p~r^k!R_qAh>NQWtsnRdJysz}5x{=wf?<2I5ny1$t-Q%O
zq}U&4+t{u0;yRHY{nW^zF&W`)olR-cCkVClc=%_Skr$+A0R*NWc~QjJ6tVT6*{Idz
z3{t)Ph{q~|siEUyhY>f-{T9biLL)L#{4<Z0OG5|K&SmZ)O+cr=p7HxJ%!|Yy*YPq1
zKO!3!X4O?Kd`bg(U=yghUc|mtIQa#JXx(=_H%k9ql4Ke5SPCqbuoDXvqG(X0>Ft!p
z9A1pfg3fcgf{w6E$%sW^F&XjH;>|Yp5-$aX9Nt*EgifQ3^hGM@d19#+pA*({Fb?(l
zwE9to)t2Na?zz8rO}>?IW=+IoD(vH~-T`E?TNtn?r!-INcKq}MBsMA~iQf@D5fm#7
zU(lw6)c&Qu#Rb4x2R&bcvEIS@=(^vV&p@|s%@X-~CU9AR^;?d@-|$O>Sa5|8oG?9*
zPt8jz!AIhUSCG99sg!14WXnmjooo1x^1PFr>e@x3EhLSQJ_Xv(VI)E@oA#Beo=V1h
z?h~1`b469umvlK4_|P(H#&gE#A6H~x-fdo8N%Gc^wHYXZ+jv!9eET0gyYtEa4Nq4F
z{rwGUaqqUsA|1ff-n`h#xw1;_?|XbFb0A30&PGowW+j(E(=0aXFJU7m?c1&t4udsG
zvpKWx?Y43^-*)^~ye(-&xr2!+9^2@fHAw#F;QWuG@nGL!Cix6Ra8u-{v<HX(?znsv
zJ#<})ququV-<vdoT)r1%84bkOg^+niM^2~&+B0;&#`00PcRNTwX_|g-xMX{;;oEJ)
z{6Aw#N=aeSKxFqF-1o;;hi+ulj6tyGaGO4P>sH^<grCi`7O?pk{S}3Ir$`XLZ4NWL
z9Gmiy*r^sD1L$ur!ftXHhNNeLWST+d8Ct>>DnS<AS-arOH5X;%2cBB#fN}XmoJTfa
zODB({HiKyif-4QqG@Md~;A+L5P|Uc&PVpU%>;i?3PRZ{0RPgRv30TYjNsp<Y?4)bg
zY6hX<hN^xD#~OLVI)ge3G)}2W6-ee5sam<rz23X`-%=Z$yd?1_{DIT#H_PU{UvpGF
zje0e05_UF%Y{hYW;mPEugriPpVJWPP=`cd-oihJ^==8;;X`l)d^r5w0QDrUMGxvXD
zUcN-@Z)Z3U+ww=xOmpjcc{4wM9S}X}n_cj^5QSyFvK+b1%?8-2jw`wl(;;v%6kwv4
z2YNcH{ko>k8?0L|1Y%x3z=E`yFfzo5PdbS2`EZ1Pw-kO>f+)e%`uJy19FoSoaga`=
z&oUfCNSqFBunJG*QIjbsia5gYKt{bakEHOwB@{e(>n;4xbRdGapg^?5UsmqTQr@hJ
zw_Y15knVJm6z-$wCk)LrWQ)+3Yq8t-`utcn?0-K$?YC1Ck&m1;;=k(?dqJ=G6H*^A
zTzIO$OV}^($mS)<cqvmU;ZaU?F~?im;JvTBMo$ZrRl#xU9*$kM&W6e?2bDY?S}X3N
zpq4oXc$7jVsyti&!x(x1?R(=cJIZy5tZ}R<%5hwErshD|pI*U7da1ExeCkJlZX|8<
zsp>N%c5V|Q3MT*C43Ho-P4#-;nXJ64Wc^nVB1<s|-O^;YJ-dV5(2EI$vg9x%U-P}=
z4C|oK)A)SBG9B-SD?R^ioB@2mPBq0Xw<B5QI{InL)vvmW3mcj<tam{Y=pAUBdC+gj
z9|Wq*#CAqs#DX*q9!0bermyAd!)0@Sc@`4<X9LWa(#3!Du7`B?0Gv2{5%w&>Ilfrn
zj7K&<>VS$QqW&3Ms0ylA{v+1$akJxux6*g8^S$qHWyH)7Z^~xQ_ShlMZ=crG;(~+^
zW`PG2=)2T6U(Q!oFI)3Glg&-Ql|D_gJG^7=5xOQXUZus#3}E^YoT&=`yGltTEfrN^
zvlEJody283A#nBh;WDTAa<A;f#9Wu|Pmfz3BRF89wd8%mH;!k4yjKUw0>^KnxYV8h
zl+Im_O^@Cz`?LavA)s63q>t?mmb->+#3ZcN?Q^u{-dg6#N+d0mSlWc(x>``}q_O;r
zn+b%mTzdl&DFFZRK{K+<+q*ja8pEGzSaA87d#lwmqwD^lf)C##%>wP!JllaZMNy+I
zH(E;hbpkj!3qg3(vyp>{BJ*6qJ*Oj)lJ~~YB+h<Su3${N1wLC8W+lPRYw-hS%7Qac
zWTb@YM0RuJ-frzLgzFU#L31qs?rMOEMbgC8hrD;(h*!V_9<F$EFL8be9I!K0p#MR`
zHYShQx|+2lrvE3Ff+LJ_)hb<-D~RXw9jjrL8>S2Z^G-PmvHtsuMK*`HD%>2Jri;x}
z%P8_l^Q})`to;h%CF|F`Mz;X|J3+qNic-OCu(M5b9}-(<Ge4_R<U!(GU9VX?x9>|b
zt|xV@bNIsJb4O`xl}t9D5wXV9YWy@l9ZZA@6&UrAz*K138QTruvlslA<-3`{p%9W(
z&=A0=Nm}R}cuJ*hXFs@nXE9f_;)%;hr-=X7CTK>P=kG6`TF>u1VJi-3!vNhGD}@QU
zNPQ*w-;5JI_gw15uXYjo9r8tmahg`9?DH3q^ZjKd?;3-+4#3Xfo21v`vQh9eCoxiQ
ze+KvsTMJ!W=I-NHNbqTm0?cC5{<^DxTcnk#&l6%)nl$8oUq}Sq(h0_qz)L^MfcZXc
z065FS?R{gdk4y7wF3C6_;Lo22#RRH;sQ*GXvDq0-t5Y5BU|U4JAV4Eb4CmScw_~YQ
z4izeAWCWw>WE71t=pNZb*%09>o_E1S6|BMfoN-$`j0~7V&yQdv#6Fk7LgCqm>|q%T
zQnfP9)1R=;^3<Kx4YR1`pQa8gY!jTYXE-sqUp;3m9Qm(9A>D95_rYw@QYT_zb@%gz
z$wBNA?S@(;^Ao7&KoNrQUk%`&hZwcLywl&RnSC*G%00T6HQGt;!C(Ths;xO+4LVnV
z7{yTn4sv+nxvb8Pp2~y5a@Ba`VO31g%)Dxb{67U}6|Ma<uaUh?ojI`Abame5uQnE*
zQi!+RGL|2-4n0g~(%Jg;I>8`eL_FXB`reXQq@U5#^IHl8g)aP&u0#x_^pkF$z1Y#y
z#4+K|_kg4+W$QgNQo&cAhXyZlOwB^&a(<WY(eqJj2C^lPwU)EgcS%4CcK?V!GrIh4
zij-^S;^t0Fv-lIk0Ba7g@f{NEMQrJX<A@jmxFl7nP>v3NpVz#w*qOFV(DU#E@awa7
z4*(}+?|(W2otkbxfn_!lR()F!7*7Kr@CB3KPzqq0;kB+Wvve_P<mlB%=1*Wt?@lZ)
zMbZkY-r0p{OJ^C5>?;Nfy(3N27gv>7laroo@?46D-Y46CKET{qRpN`ua=pegGOkHB
zoTbGZYWd3Y|NNC2YJw2uBqqEqwJ7<4q${y=#?STP-g<+RAx>`^9f3RJYwhBEC;ZH<
zctyU+SJZ(-n)iVIbr{iHx#F6I@pa<YG!A;!fAf~j-13uK_@X2BrSyd0t3Zc$MQ0#Q
z;oYb1t<z_qr_0&}{4YK{*PtS6sw$B=6VhUYiKMyFP0|qK9w}V&d!O#{!VK(O4jl(M
z+d*a3!3GtsTef_2iMq#MVWHx6=X)rz{A)?Rh3&i2pYe?T6FZh^hFpYqeJ(x01BSNH
zQqBs!df<Nad-`sSE&E1)$5SstGyrWnv&`X6RTP*hRQV=^?lVS8a8u1+lZ7r<oPhZc
zA1*;Nw&}-rut3Vb)L470`Bpqn!Z6V6Z|>Pr?QoahVPQCj2~Q5dnZS+7m*OG~F`|WT
z3H1=7hk*t`A2&KZ`j22~xJoa61ax?WB=DaeTkevGiAJ-;7U>=2@`@P!5+YAWA9QA7
z_*(RI*|woxt@mpiCzWyk)64`6esrj|_(#7SG(qzq^2Nlt(NC5(YP;+hFqBVnwdj6@
zSV+8RUa8f@LYUl_Pjq?zt6TiY5?6i!S6ty1ibPx|FL`eMi1m!8zEtA+YV~&kS3Qd4
zB6D%AE&^8~ceZq~fRTfIHK4_Fz|@wv!Qz?3#>&NLBRRK;!6p1<?ps+u(G_e@^9kWW
z_Z4h>iKp!9Ap!+HK}hUfFVclNJ2<1LF!T3+_9fnKY;L~^=tnO}(v^0w5?cni${QvZ
zbN+uHNr#70&>HFmQ`R#!7YLHO+&q?Yd~R?CQg)<bO7sIWbs<bOLuz%puWPrMUi~Hi
z0$F|sHY#Kc-ji=K`v!OdUZHbw%V&RxX_901C`3d7?+~4WV}DCX4(XnQm^DJMg9pH>
zF>od}b6Ck8DtkzZ0=6!X3nXn$Uw|XSO+Xw@NKWJbR{=u*t?1eV3ZX9<JspB}VWDD8
z++df|zTbVZgx%7rnp``@$4w@k+^$~9{nC1DL82Fg1O62nObDMlP7mEd>n1eYnWf;t
zM|&khO{a88EB(S<nB`-aH|Dl_LqLksQ$jRh$zT#AO(n1u+4(v_Gc(=|-fUIae-jYa
z#a%UJqOlPK|1{iWr{-(!rD$C=spm(|oq>7jali?+CWDb!D>z*2EIEEwq~D(k)kla!
zmQ!EJexhNORKCo*kkHGsr9n<8Lz7_4EMFx5nTP3n`Sm#gds4#)G$+NRMXmjo2r8fi
zNvqOE!C|W~NO(T<S_8t<=wcMU<zn*fBgE)Xp_e6Rz^TteR(F+TXub(7lqID;(!<)~
zj{hQ48R2@ll+>?hfQb6Gapa-#e~UmI+8o_Z&%zYO^Bk;8&Ao9{Jy}P_MSYj<uO6OQ
zZ3MJqHM`hnE3;^N{9|iWdZ&6DlEETSxr<E59(e2w&v}ay2+p2B6BJVtK=yqos2L1G
z<K*a}odeGVYSTf45(6m*g*$j#^iraRHe`Z+B#|6I$6yZ9M*{5@#hh-IW)`Y_Mwm{c
z?$5gmHpP5ePmau4#U{oHz}2%i4>NN})h-@c+)a-JdUE3=Oyh{!Pxlz4HA9Do3xyKT
zV~VsK26pkI3cfdnN9B5w+GqMi#_;P%1+av=QNB}z+8Ifx!@L7+FLN%*e+m1~l+RcM
zGcJYJ^79A&Ctb~_^XbXyS`X)Zz;O<_Z+vE7RNBaIG_4PiG+N%4=oHv`NF#0CL$6a|
zyQm2$ch<r1PewhLrLW2Lt4*FA|IM|xX~P!Rs-q3=Sc(LmmAoZA_?qsmJ$*N#w)-FS
zI)_;ENoY*i8nO<Ww~%lBbLc6q>P^R{Oh@|#eFUe9pPF4cnf<wthb^dDAEMAV)b;ea
z;#EN~?Y{i)DmS4}7*x^<+E9Vo9~22iC%2dkssV6YHV#h-M3=pPn~0GX>WaXSyxeez
zSn{qgT%|_*9@mBlDu;buf*9h40VnxpLf5yEUt4XQ&Cpr<noXHg-9E&VCuKe-ln4b$
zV>P+hBC*}yAC>kIDs%Dv@M)DmEENJH#MLdTi^6#%>Zg)bWFeg{tmJ;$t4{BIQ`9S-
z;}L;+Ni?~}SBV&+89DNvW*pA)ne?Um^S(0elBW;bt;k{iv4#<he_0x4iFd&wMcs*>
zu4vPtTPm%3%p_6TW=O1LN~E^O)I-i}m#=e9j)vQx58wJ<!S{sYE9IOI={COG9A`mO
zQSIF|$ZFoN^`cEYc6Ts(XxFuefI}{*;GovSd=aXx|K@L36ee8}t=c*~!}MowcD>Tb
zn%=O6isJe{QtT~!vw(~Dsi*C$U%WqOOx{E2@84D?tYV|%!qE5~OA9WsMRyNY5=Xkw
zn9FKsF^Twwfyw%DFJ8FQlTwY->X4@%$AL5X9RqC^IIdNRbBhNe%SAl(o~d7sS?BP+
zpEH=&@&C0W|BntxX~LXHOdL8PXc9$}$wX?^8W=BZTOzC^t0yba81L0ppRN<VZ%F~@
zu(3|m$4r2Ed@Vsfe!xSZ?c=lr^s!zQ4Ff^-MjnDIU)es_2;KRktto==sxzXaCt2A2
z{Q|dM$WU6kWV}V`<5T3%xAC;DbOcIvky_?<i*r89SQE-CWEjbq4xFSIfW+3dR1c^X
z<PSK8%iC$*2M&r`puNB$&0D5Jf-N*k_2)D!8Kc>A^MB1EyLL1wqzG%ynOn-GU`PVB
zQf#7B3Rwm!VQl_adSr(thP07F)@;(GxrH}G8fPRcw*H?A><fLgxElgqT1@TJkU&gs
z@Ny?CrpQ|VQw=d?kMBwJI1j5~0r7RNWV&GR3;1Z>iA3gW-R|Dk$*_5gd3>bZ_Sw5P
z5FVDzZCJ4D$>l_Fa>8guR%bDu>0D5H=x>H3lor>Cz4LDyT8lFSv{`2&MmDAJC*eAF
zJft_dVfB)cPi)MlFh>^7S1QnR$eu+LX<ei`BzbC9^|jELKa`?(<!<pV%KzUgx88cq
zk(`@d#Kf?pfalg&Bzu(V<|4<*KQ$`ZwRx=TkO=44F*mCb-?C*G1SN@#tNWWFpktE3
zH}4>6kPbw>1XtC8%My0(9u{yUm7Cud)0sblW$H-+x#A&t{RFuRM2Wp1BaC-JViS$&
zWk$J<#Uj+w<zL_H8*FUn{tnL@?8H^H7sTU+fM3NPZINEy^lo6m6nS<5a`pM<BjND!
zvo25qr7ppNtGs@C+!d{@oocugvWHb_lJS(WL-t!it(2I{-$^ocbPwEi&1mdON31hB
z#=HY%zZ`f9CU-_9YcwEd?IeG`YGLjj2&@|aNlko~P#5$*5Il>BNaOt()}?|^GxVFX
zPK={SEBk<ctiEIm{8Pkd0EvwWJyvWmR(SOilQeng#Dx>DmOe^6esJmSKki$PfJE|)
z$xT7;XUkYr%(=;`LCNqg(`)&By8W^rq#sN3*!c5Ff_;q+KTza`Ep8Pq@R(Z-^CeDF
z1k*uQjdecs*I*_RpIu0guKf~yU)ShPHG-o0($NF1$yJ%8gE0F0p=Is=ey8(v%%!YL
z=8dPSZiPbFQ%~2h!QcZX#+qmd?769kI4LMvG(;=wyMT+jDDNrg45a2|4oymo9tId6
zI~6poueUV=>$yNr?qI0=TSB=<&WQSjlrx|WLBwdx{pIL$7E^|^z{!29=k9tOn?y+L
zxNueP71_bQ7hSKSW!mmw;+>N!5PEK9pscU%KlBL*_koJ<UYSWB+w<GY2oE@yKY!fv
zc3&jK5FgFBppbS@Q;D$Y?Z+=lD~#M0qz)xk;jd$!oe{022jVvWG~9oSQ^r9WMaw{?
zvj6tAc)`5K)$=>QR_1EA^=4+8&%qo`xa4bRB87$?xVzqgp?+n9gw>WtZY`DnyBa2`
zoMTY?lIxR2Hn{!n_NsO8f*A4T-nfMmAco>ICh}Xhk#hz7wWdi=+#qMAROQK=VRoRT
z#>uS@gI_}V<Fmrg{^!*6I^L|dm07K?nCH_2>hj9J0@9*fiqByktkGM$%i^68AxSsM
z7LA){vx1JBIi3W4X`wl}ZkdVa<o`}>{@-Ra0+aK=s@sFDk%??zJ4F_CUYXfF-wrP=
z|8a&c?=x$*Af!ABozn0Vs8t60zJ)e`&y+iDb4r1m`q1bMAcOEQmXJFQL*?>f0pwF9
zLgiocdKh81V@q^*y@o;3tdE4+JkV*W%vXyj0pKHmHmD6Bh~T>20=Ol<Is{|vx~UDK
zeVUratpAL}ZVA}w&3wx4E@3UtlksDS=lOI4oSMCc^G-YO7`CKc86qWhks(`m1alD%
zPGQgNn#p{}JcY6NQ8v}E?@%2zJ<yG*3Rh{`B1fF|jQs8Y3kE(js3r4&mHXG?--rsN
zZp0sX&C_VEen|%&n4$xc3?bJwZlUfEA^B1RzdZqa>!H{<=XYMa@$3U|yUwb2!Fo`=
zN`==vE^l<pGkD9F<k+vM^yqIVQjbNl|3PU9GCVIXKr7GRG#yGRcI15>Rd^qMsvP|H
zxpWJr6fl?VQf^hLcCjdKH91Qvejl6f<U0AR2kTQDE@g?Y*Mmdduf>$sNPJh;=03dI
zBudHumPGi7jLPVUj4Vi7TEybXu$|>!pErx5N+$R@$vO5ARAJbv@DP7x{@}b)Z)N&y
zS!%P9c>q96ov4?PE8r1sTAcf|#(>8Zpurd!=t%KK1Q)I>-xxF@#L%|+SL%Vg1XVOI
z3@rtcbr$9%7%c=}q=?8}$t0jBaB-T2lC1=Zu4_G(hnxrQ?qIdLtsKJJm>~7DOHj<s
z<RvH+6aRJf>krvhLno|ESmC_f=JHoXA7RE!=5<yFYj}<RKN)+a35%&2u^3+lW3k46
zx+75IlQKJvA-dp~vN?p4q?Tg3Fw=dX@1|2okeo`1DW%sy;wkDUDaGa7QU7<Z$qb1n
z+FVCBagGqfJmp>;yMx6<TQ|NbLX@;J${oOW`ebO`xm+90r3p9^{!;wCdHtu8mA6{Q
z@`i{YVcAAjPp=7gf<3gYg^uOdn;|F*@n>(==(s#<T8l)Q7vqQi6V28P*7oh^g09Z8
zw%y5?qsb&fj77<<_q>TA4YmtNJSP*Z|E6`AHEa7MBkE!yobfc2zV!qi6_;6L*GCO`
zvjfShcd)3EZ59zD9ee_p!-U~eSS2DVG5lS2H(QFBG=yHqR^>e88_(;hosXykz|p3E
z?c2wlq1HyOu4T$T14!EV2S3Cs<l{zC0&FC`3lc3cno_Z5=Vu_}m+wMR#T7T-n?>d>
zVS`yx=CD0?nuT}7!`<w@m{IIbNW!_Ie<+Z8qe59!|3zz9%)Dx$VAx1*=dr?+@u{dH
zB(#0YQ;{HD7Sn{PKpdOS%L5$v(h3zYTwQ<9inX28$vY{JdHnBp)Mo`x$6N$?a9MrN
zDj4I#i@S?bIGlLA>ZB6)eEfH?i0OpdSn!_WnO0l@)=tOz$3nBDL{bI^THPX`y^mWt
zl!|L2_}u;16*-Darq&I1#VXs@J&%x9Wh|b)Rb@L(hzfVL0D5O=*pYIa(+`!kLmJoH
z3mIc_9mWa$5DIQ<0bj2+vY*Ozm@<P>cvtCRsSa4l4hZ^{{sZ;@TQdcsBPc{)X)V0-
z2(LXoS#hKWTxWYqG10e{PTXx0eU(54v!$#)KN~@Kk|(dw2R>dyVpErMHzJ0B1?b>w
z>+~f^ts5l6xIN{L-f44gY&H-*9DE1EPBzsc9c<<bMG?dn<KpI@3I`S`!`h7k1fd6A
z?*XU3WX@A!!68sWGj>+C@@)hS_}m6q@2H_Ub}YKRKVYw7Lfkg6g%tyjXLVlhT)C(w
zc1s~-beON-p?;<kpEfL-ac7%|`eP#HOdG4%NBKaSGthFOekZ0Tl}r94JpD3#c+Z>>
zi5I}zPW^f&*U?rK_Mfz{d~A~XK$j;+Naxm`SCK^=T?*T|rP|ToO&}v|r2FR%=C4nu
z9R6V)UY;_mJIDLhyBOX4&8+Gn`H00NH0Q_e;W-7jg+=~O(!YXPjyG3F(U;o`npJ_}
zb;Hqbu0oD)dxObvGq^9FkqSQlQ!c(yE!HOF3j})=$|UR`&vu%;*IywX=IngVNAvF;
zx2GYu7oGP=2(A6moz{8%fAZE=Oh8ZFij$?_oU+G|(l5y&(|<d0<xbSykuP>)lSht3
zUYrri0D>aE#WzCWI~dmmkQ>`EPj-jUhj6UJ*D}a|QD1^4nnE0OAx3+SIyyll0YB-$
z*j*dNh^Ti}z;P0k7$HEV#KSqr{~fN40Lltw{S6KJu*J4%Bflx6kn5tD0ymU}=4=aO
zP-43}-%<UsBG`<!hA^8d?%axtR5h?6Kpa3=5vhm#qywr9bhJ+_L3a~W(k?Z$fk+y`
zPwwr%gg^PoOj>LWO)XkzGpOXX93)=<BP`M@TWmynoiWnR*);)9Er1<?loj(hqg*`O
zFzfwQ924>%&G@(mlSbIUytT)myH_`8!p>%sd&RD$KL<hhRiZIc)a+27U3uczMO&e2
zg#4UvhS;f5c<80Z=!a`mFV$>P+=P(oXGI0(wX^R|igwvqGEXvY@F*y;j{WVn_`hTZ
zQ9G-~YpIYDK@<gZ<*StmNcj9Xt`gKG%1dO5BV}}auEgRj!x@IXF>@cZNr}?DafInY
zJ)%aZneGD`vZOo@Uz$Hlp7T*}Pn*w@H8*f$JAuWnzYVl!k4bTx*$ylA%>@t*mH=yv
z)B6|~;=b2O>hoWe&^hrEj`2b>GwfAMK!>~g5LAFXb}N$~=(9?flt1Y$d(>FI+q4m0
z!G0xT2L6sg={(Z(s?!4qfd%o0-URi2lt$qvy8vxaK;`rYrOJ1~d^RC@x7;h_8R#Fe
zsJiX&J6{NXUcp6c5`c3xN20!V^6#_kxP$r8Ce<PcT_!(SmPmDhH1ot|BDQ*BP$jA<
zFlb&&ix|1W<971f{3Q_%TwlNSTe(Y=aB+QndAbNHR4ID;S`@Wddd0PJFnB?t0!0Sj
zKAVEkMj#liGb0^lS(Q;|`d#vsZ>JdB@IJk|eIRh5J?lOVSH@!1N^-+I4@!|mZi{Bi
zkju(XcF37+i`RV?q6ZF<G)~h`HXrV_Ht#45fT4%(swVfFZ<q@i58=KKwfsIy{<QF8
zz_3C7%89tJYQb?=npE$0ck$NsqAI;6Vf@6bx47Y;*1D*1BQL+W2GB!nm}>qh$ZI$N
zhHT4@XlG2{5IVKbySdWn2WPJ)ue*gz6=>&nV@6!<T6AE0@Kv1T4wGMil%*UmD;g2@
zuFrq_z|hSFHdVDQo5X-cS^MP$yYqXIi_V#ZiZ-woJ7gioDzVw)UT{P_$nAlaQYRyd
zmp#+GlK<kgs{E>8#VX$<E{8;)XQOTMh2Tme6bTIWS^?j=cDHDDgF~3J8FRmJb{=}Q
z=U`Igb%+$ZinO}|CW2KXMVw23X`4rWZXumb84Azl@J%P=emm0lc9izvEc<lu;Z7cy
z*0X>huUQe}kCS)11`iv+Rl6Z=x*eb1yxrO>_vO=a)7S8v7bU1awDUpM1w70#=YPCH
zJ`*lt9{Ukgj^@22=B<-DIdAZZM6+ePJ$nfo#MRmTUhrb$VEz0g<(EEKY@U<H$4E}S
z_*^K^skg7vsHSuAeOJM-w)c0G48`a9i>}&Zc;7hi$Vv@hg3&ZxL~^^bsp1*uKh9Oh
zIRlhQAm!((_=+bzLv_J@c&pG!<X8h<PO9#47WVJj^$hI`%foO@UJD9~(pvt00<I<M
zh@Y*@=tOC%LqWGFiM;PB_I&(V*xj1AE%XKdI0vy}{XXmRKJYH)j^BSA2;D2Wdl|1Q
zw0H`1%iFGVxJ@4bFWdB{i$neM*~OHHbxz;&E08i=$4mfR*7DS?77%z;1FwYJuj3k8
z-Vex!({tV?hY@*$>VunIt#JUAmiW!oyPEYFq#29%IsKF~#8_{OrAKYVY($s0jm=T9
z(ILlTdvawiSgy(GJB*vf+5Mv6lh(*)CtW;FnbU~Z7|nq{eALu-KK5fKw8vpVCNue&
zi%!{AvcKY=7NKQclWDQb1gS%-CX9ayOx;$>A*997Tju-^-#g?EK5d2m81qJn7`Uq~
zBVeaaZ|_gJD}=vFgBL_}sSX4YJ-I?1BX3y!nOszX7^e0S5+xP#!o<tKa%N~IjxPSP
z6jzWTX0{W>xb^%m3+q((?cK{)<PE1hubzJeU>bSZd^R~p-~TnXS7^`5@I|}lePDk&
zp|b1nBtSLf+@9RQl#xTyG}l{u@VSyo`RB1Ssn8kBjCY-mtGu4fvw4B`;x3Sw>6oVt
zJiml#()l)%7Cf*fNw7a*O4a~+mBh(JfYFRnHaqWjH>=gKvPYZjGVtJK@#gyZJbUHT
z3gG7J1K<P)i^-RxZVjhjgb)9Y=D}5CnKR5{-Z-|PZZ2X7f{2K+e!gn?ovJAxmBuVa
z6l5hU^PN(ddMCd+h>*uzz6j79j@Zm{;|1pWz1MTn1ZGQ4W+E`lZ<5bJWy-ifHAyID
zG!|(1|5Wf^_funBCx-IL8`gLNP0Tf>#}!X~;NvqtjsnGym$@wI#616i{*<YPm1<7o
zTdwRi-mj&(CwA27e;uQ&!lT<RzgfX*weVDM;;qSgrMlaFpkci^By0@v`399?Ug|Ao
z(KAZ>ON>SQWqe7jL>T5J(Z>14<PA)B@6pApQeHX#wGI06C)A3U;!KT$i1M5~eZbZB
z$?^<?mafD47F%(`|6H!9vO_UX-*rWV@9OS@kp@)CELQ2Q`}Plmt6s#z6(j9^Gc%=K
zeO~rxW;fO=99*A(P=L#`pjY%>f+r)_X%354LV1(d@iqcKJ083)IF!ik$Ng2Ikm}39
zf|=HI1h%ZB2)+27p}Pdl8-#y>(70@Ohtjldr*1@#j{vh&nXho6vO4E3W_NSOu<#o)
z?#-ey7MW~Isi^1b!*KwBxz%be?0npqI{o}Ngvc+tPg~Q!(wHxsIBMEtVNm1SSi^UW
zO}E_XOteYGy5SlT0md%zz1>`lWF5J%{Ejl}lsGO4r6*IJQ*~RhIJB(Swr6oxM6z)?
z%M{hY1e{NMjM=6Hsr{T=nk#0!9SO(P>82x(RPRl4xnb7Pw`bX#5j8fC<CTaH`_3MZ
zmuEU$EByM9K1js!U}GV(yTEjN<d5CgyG7sCFizlRn%6wn4HH2YM_hGB`W|)3Qq|^x
zfhs@Q_6c+#D0t1CS3aC)XCs)(*@*<c#6nZX$Lid-DYfb3a5~Sf=H|k?w}}m0zu`%k
znLbBG%uBH*PAilg^&dSg>Mu-X`Z7O+?vQlX2#;#Rqe7Sln8jsn3G-eL==$f`@PJIE
z)jPlv$T{d9sdu?}^aKLi@c?5Z!ufXv?g*7nwHm|FALe3ib{Wjq(QO*pK_Y1oYL)>4
zs`S^jwM0Z6anIpy@9USW(Z$g`4Crx1j7CPOj>U8iC9hX6QBB<cmblN<*jI<I@HoDd
z;MK@b%LlZcbSsAKU9EY<?h*w<0#<UY%REB5nM@k=3@F#;*5%(ue%QB|hS<ySxM)kO
zYekEcy0Za~>h+lgwEAoWLZE+fY$7&%|H3F%ICJj7=kjhQ9y;wjs-$%;6=qX4Uuht4
zeRbJ%nUe3p0Q4jgiS}xlKfOlHh}}uvb$%%sh==D+v+|l<HBGS$7PP0P6MhIDD<C@K
zh~*vJ09xc;l!AajVg=+^0RT)v>TVSnL~D^4?vOR75Ci@}QGinfw7uk68wkhgsnwTo
z1Edf7zIp^<%14pTtsRowkKGI^IxntR#sc8cw>0@#%RUkt+B*%oS$WUgCB{T?m6}26
zG-<eb3JieXjq)k+{2Mu>Jo~bHYr&h4ZFZmoj7o7r*c@tK%K1jaLL=tGv+%7}<M9Ov
zFSRkm3`Vr}1<7;bh5$mHi=Q|M?!X-JPvT=_pNynf+KnFm5~cllIaL_wRre`I@Gf!A
zPf>Eh1jhRoqq~q!_tRREb&-3EL6b8;jS!tozT91`KcHRwYxu!x#PpllBUAliE3#lm
z2jirbROIli7+zaT43O)kR#-82V)}KHoshhC0^J8?YN8KCXM`RDQIK{-@T?8z4(jR$
z`<Ok!IFERPba?3@n=x2U%{q~O;}YmqDkL<Ygm%rVsP6|d6a?sc(_Dal5tC--2NH9q
z8b;?umgK$3FMScyDA-|gLcn{@I=KLsUcRL{S|yUxR(y5=VyOELrI!$m^zelkk&0Ks
zUnzqmNM?>;MOB2uXmP}hJq+K5(KIl3S3Z1NFcQomm^}I?nzmN=z8*AbGObe<Y+Q6u
za7z6tcvHYCT;S$=aP0cb=2Wlc332hn#mDU@j8d{xM6T^$2AX^A1GQV!LR@(#hzM+q
zfZL7X`T`(2o@fCGX-YdhUt}!e_AHnYQRj8djw=FSe@N759H!c|@_i(tF-4D-I1wHv
z9=nBg|MSpB2`Hls)`&t3T_CmK3MR@7%l0<sYzrDa2z_*z7Y@hvudqxHf`5r;AQCA0
z1>o-?=ZZ++J<%3vA-fQZW7J&bN}9ozY5V#$#a=2YO1+a}aQwN5aYw>(zaY)3$gG<-
zsuM$nt-&Vo=OWsOicLqL%SSu1I~f;F=z@G*n)(Ap%fZg59W+xU@lNsk@HqA_5PBt{
zJJ$uX$57}^hp1ga7Weqi8S?Z`?1}rq#3?`KTCfVG(sKitiNL-1&<wi9WN$9l*A{Zj
zR&+w&x#y^Qab5CR;g;;tgII$u$)v&-!1dt}+?ZND@E$^MI$JN+^KHYA)zU1|y$*ut
zo;}>}FVcSPN^?4&Z1~Nmld|seaFo<W;60TGm!`v{`5HOsa|8N8Qt_px+lu|@b)q^h
z#x<dViSsf}vMmq2(@Y`bnpHxU2ep$y8yDeLD>h8Th{V<cs09<(t`#&QqI9*4rsv1D
zG4KNOzv04%E(o7y*i#gMOv6*b6WrNu9`SJ}ymqE8qug<&JEsR)+0U=KQgM5r6Qv~Q
zHX-AsjnbLdjxGSnXAD)fR$?9Dvfgsq9O6>Aj-_qswNvf%LsE<115Rkoq;IU#F9a*;
zoVE=koFI24UqXY5<V|vw>^1~^4DL*66D2B){xLqU0=uDj&M+)vVAn40MSPw>;><M6
z2V6R}mHyJ;2t!VdV09#(=!rCRM@Z%?QW$2PqU$`|0rkF#mU0G^Hq!vp02s`d<zH|H
zA__o{hzkZ>QDPgb4=$0O3wF0!ha3qaCqzN_m%iRdPkir207^fzQeNwH*b$1om=ZQm
zrn;#jMu=Iwr%{Y>ceBdmEnXswNuFpYW>yDigC3691Fwlxe<kR@1ezezgx(`8f8D`m
zwlj%|&A#fFdL<2u691C2sFethOUvn0Xk5Z}=LVR$N}Vspz7E`_gT~0(cb~2i>T+EF
z&DBVtRG&|ee#QGQ4mnlCAt8ED$$Enw?Yluy1>{d$E|asDLb2*JfPPLtwL#Fz=s?Pw
zC+vFv25Z%uK1N>eBxNqVvt!QBpB&PNmOT<-@L&Hkfp(#>%Wc6;*+E`l1z-G!_2l41
z#t4G&&$r;-w>^Aiwd^Q@;|hGy`@AqY)Zn1#^c)WN$&XSwU+yAi{BK=fG+gvN4*OCr
zisWnfD@{mDd!6<pPWLPdcXZkv*NC9L2Tq!!HE%wrqlx%s<)cF7hNs^)YVfLdRrOd@
zb%o#3$4tp-lDc+{)x`)v{0pMJ0{40CIwed~-*)dv0+#2j?`+``obIhKAr0YFIcvuZ
z3x<SjBSC-;BrogeQD#!<QOaW|Va0d>k~wD;r_Qh7Sj8zZZNa4-@Jbzy3t+RCj<(ej
z24+nx)tyxf5risvar9mg{AlBt{atv*LDbVY6i+Hy<37Lm@*w3cAD6hVQf+U-yiF`9
z&qay$)2C!P;H%Z4syi2@4FU4T3SZ1J@NE8YOF!4Skt7sfd#@ex0(aCA$s1@m`+Pg1
z$KxeK@Pt|*AQbQ&=kBDb%Ci^-=46a=rFWHu=fC_etZLlVbMu;#eC9sJ_-x+z2YXiS
zJ}><Kr(5H01224hQW>&(d&+6gSp<xO&VH$zfBR|CeYfzi9w0IISJNLY-Y-JD0Z$=E
z)9oNH94<Gzo75Noj=M#Wp~byYc;kRWDn+(CCo_mpwoJr`+v?xXeKNobj3@c!FSSCH
z(<Bo6CAp;Nj<NB*60aUmOF0oYAX)zKLp(dy<eTB^d^&1RB(^G8sbT-GwmPTvQxtJQ
z8D$rfBRm>9@W?BQjF|+yPsW|;2o>2-8DWP4{+^`pUD!&EF~u+x%Z5Ic&6-%jY+S(w
zK4koE2S;F(+eO%euwz_=@W|Mg7WqQfn{d)pK(g?lr|XZxU#oBnnViHwRZ)xsA9KS5
zN;KHZuKu<LEOzC*dQC1HO3`{6L^WJ_!cSECi{vq}rZc+Uiu+){9N>Gk{E+N@yQ!@E
z*K#=jeq;UNs<vs?-XCA4(fhFBqJGi)*$wbFM9ZO&^S_+WNIpKo`hsZhr(|hdxAYEc
zSJn9!f$P3-T<Pn1;bb6C4&0k%Dh%~fYANLm`LRdnY07<|+S=YG<>b>`j!1FU_|uv>
zWmcgK^t$II96W(8hF_Sv#Ix(4iT8irfF}3vj)vHj80(#@I*Rl28$WH^*|<@?!N5<I
zOr)EfB34gD3FaX%7a`mV4IlRKdw)i>0J-S3xzo6^O~#Z>&5z&%tgwzNNbN{Poyk?5
z)QT>c<~*ZnCiIPOm}U8|;|r=~opKXA8C|X8GO-tCKU?6jmT1Dev45<-%y}MT<uzUs
zNXfEcX*JAU4}99MA65QsQ+7<Or4N{rbh$T*pS&f1^>|LYn6;|{?92vE`xROSF6YDm
zRdW7(vUo>6cdzVJ84!8x13M=Y*g2f<pEMbakLvh8lC2JX29ZrS<D-K&6Wfn2^e(rC
zrR%{I2XO(JMwbb<$5-%{_%o5KM?Hy{=i!_C2B>#WtQZg+Hl5BN4$cCso<#KFFjHVw
z!&q;WatX7n3<IN<CV*0}oauY4j~es0pWr=bBVzM8sNCCfsSSF0X3~?#0if=!Kya8q
zo9-Ei)q2>hs1MD-6(AhOKA{BE7dh6imRv~2qK~(<iCTxn#kD5rg9`i;q2;wE5;5cK
z6fb4L*|_sD-||cctfV0Hj{dqhX&hPo0R-oPsklh&=zirj=fddPOSF;dqLMAvX!IPF
z7piLNmi<p@w6K`{2)<pbw==%*2zu??@rz$|kVHB9-0@;KWtn0Fn>$n~B{!N)gkEYZ
z^PsFD{$F4-xp}x4tplNsA%7Up{S);`jFzADMK3<o%)RG5XtVOEaALQ5t~vlje{UX7
zY7cFTO*ejkMACfs%Yk$D`LWjHo}<-xQUSO?SAeJAgaC59&gpqPinv+h))L!v_q{{n
zax$eO=Qi~ZJvy6Kiz^py1{fg+DG$eo{EN;`*MM{MVeOi&o1hU;t%+SVUIGaUw}oq4
zVBr85t#f7d8#C5`7tx~W>Uz-EVIcDU65v2X{GsHZyM29;!c8aRqrH;|dq64nP%V2{
zwb%$ale3ZI0CGPY*T;9c8;m$vq!q4x*jN-fWmAlQP0c&&)`;{r5II*gDRMqpe%4@T
zit5w{ju5^{fDSA%Zs-mm&+YV2-HMT0vSNHEH~xpdi|#3rUBJJ(dz5QE9A8w4J>+aA
zB<BM6X=r@q_mb`;y1<g=^39dGnXr3HPb&^(C*2HEs4u=#AnLB#=BIyyU*5Xme$BQ|
z4mG2IgL%k)9ly)!+TB7ieEXB{yTO<i$SF`XK1dFCVzyIEX}4HaWLaRbA49KPJjqG@
znd8j?BXP=RT^{_;j8uy-YW#Q=4*$bf_E8yw^&6VOft`EP{b^dAl9uy8DSSfPA9##8
z#4ud;$1rKK>7XLgt33?}2M9Q)fJFv=F$RY0=R)s0fV5C#@k2Im({Z8T^<3RSbz1|_
zk&wVPY2e!s@(3=7^iq7~xnCoDb+hu)=~<2EA`))r(Y8wiWa7;>M9a3bev4g+Kl=(O
zf8R;b-Yj`GUI7{1jdH~AApu6S%$I=k^3!Ec+B4rR;f4EOqOOaD7r*M}%<3LrkKr!=
z!|84$WO)t11NxI1c*%cV$LF6DIC%yZIe!IB78kDufPpmb?W2HLu1L^n;L$yv)$nlJ
zoh{~lt2*d;ad+T3l<*_lJI3j484ytyU;Un(1GesBuZ}4@Lhm(3f_d+%x`&ObCSZv0
z&1W9W=Ll$<WkkuFQ#SoWGBUBMe>AN?lOM4VD&j-fFR*jLck&Q&6zV@QXYMo+(r8&8
z5i)?ACo=+I2cpq8{c~`=gLPop1d=EA4=IXU2%(QD`>m%&fiux?dU)ueWMMsyODtXA
zRCRI<&r|}qF&U3w0m|zMtfR6dKcaul$pJRZZT3C+`#7+au2Ow0s$idYoDDs>l#ASu
zBjgnZHM;J~-y>E2R{iBm*q$4D%sh%oJynOTnN)eoYB@Mqvut=~S|MF+_jXFNLT;^g
zGD7D|aBWRjyOyt9@Rxl{Jgpz87wj3htO${djKzlmewx!Q*@-;ypWYV>yMH<1&H(nc
z9tHGC(kyb`P57P{A+SqnAbhs`jQRt<(6nV6{-cw%@#GJu*Msn)0PudwY)zp_er|l@
zRlws}7;Z&qR^I>Cv-^ksQG*@gIu(<KO8=+^q)Z_g9wd4eMSiPSmo2h=#0?nbQ=A4O
zwW@;jAfC4&tDFnKuQ0gyUg5fv|Mv7zM!eSX=rO(S)fXv#Oj$-?uwi^p4h*I{EPbIW
z&+4pYb^l^RTf|tIWGks*JK--SW|`=7YF?n4?~3m(6ObN#>d4SPCd^yiN5eM0LN4(=
zDUDYx+wHn^c>aTHjJ#}xQoNJ(y^;!G|InViEgPy!E*k}xtBJPs>Y{U*qp>g*rlpS1
zMY1$1@l@m(A#kX7KMk$_vl+sec2ZSDPp?;&qCtdmQ^mSJO)x->=taCx;S$Px5@)1i
zw6pz`QGuw7xL6XG;hVM1=5ZMOiTb;WEXDQnq=weLXX$M3>NdGLDvt^LqB)2PNp|<}
z_L3uw9T|@kiHM;&F(E@%>a`$_0++O#m%#!R*;3@>o)N)iTuFp0(tKtLV>qo(V!l+(
zZv-tOCq5ufGCwa~^;wAQuYn-t146rfodpw??(>lPjfeZopdiS7Y59ZX!s9dk0V;SL
zHVU0}&raDewUzoiP<w+P%jvuQW8r+DDqQf%yJ@R@cBtrjJL$vuX|F+w{mSNJQGlEO
zG2uabF(jFFqs!pYXF~Jlr04k0_V?~>1BlaYM;)-U-u7qy1f(%E*LxX70N6Qt60#i<
ziI}_w=6_|?Ca_Hh?!%S;DBDLVO`ECeZl(^{y}?|Rx04BBYGdx-#LDATBk0`y*hKXC
zPp3zjkPaMm`l(Nu^62Lgn>R)qq32c%IfUAi1^m_>ikh9eHUB_7AH<ura+WtT5L|7&
z5lW${hC4VhJPiKj^rHW~D9D}_d@4zDslb=-_(7}a05NI?g+{o14T27|2i;)zvzY<s
zd!4K*F4Xe=<0rNG&(kXVT0uDJDBnWU3FzPJ$V2FNLag8NxTG9AG8B!DEyMK7k%5bB
zXM_QwBTeWp-WFVts1Xi(toTR&#?Q7&kK>c@Odm-xeVJp|yXDW1Iow(IEuoCWjEu(U
zXK4zrj3yfvsl>&C_28j5vd?qQq$#oC?$J&3nBuKT8KGbYfOFS}4>wDYrtNbl&so61
z{9p&aj`Js|y-c3_lHwv1xNr1KbZv3*=E2-G77)!|iXQrO#v;xzE^k7K*&4s@#LF(M
z4M+N{sngaz^3;}=kdZZxfPn*X-?y1ndyUrBL2AHrUu=EgTva!)YpPHKq_!H5q&aEb
zk2ikXiD~)SjF`eZL<yv$Mg^#`=vfz~5_rksTpM`QigdIRM?d4Yq;Aeg#WlgTt50<X
zGZXpD$M3QEx?0~HGO@ax+WhWCw$*FuU>WEI>z}~PncCC|kBFH9>c@E}mw&1htLuJz
z=LU+2PKNI#6zUh?S<7wOP>&nMd5j;!g4vp5TIhWY+d+8?%Q()>aXT$mHE&~u@U7nt
zf+X}hgYnP&z%T{1JSDAo^CG=vypAJS7$$=>klSEfs}5zP#l#}L-AnP~{dxMs9@Eb|
z6}%G%?n5CAwhS?59q>b$QC+LWsu*T{oj=2_!ANA&B^2~0q>O8&1kG73gr}Fb^1J<l
zS$<*V?a5~Zr*KbJ%%e@>;pT~K|M<@d=WF2IhkOfBC$WS2^9i^6kz6nYsJg-L3MX`G
z35fQAkn#}|tY|(dc>V3N!3oH0*>n2bCP2fykZrUVQMqCV@=zhKHQFKJeMN)D`#?(I
z*J$mcy|*9kVk0dJS6Rz9K;8`c9`{C*LQYB~H(dakQeWab@)jLj`DmlT`)}dcGTl+;
z)6fKWszoTvOG&{Qa1Q{tlx9pM;yrKiktihWDkqfok!_Y6nmY%%#;I|WJWhO+P<C$%
zQhadfvll+JA%8;|s6ecf_4x+7{4R$A8hm~c?9=*nU0e0%_{V0@irgG@YV;GC*m$2v
zLg|~O&Px)7FI2~R@6uoTF>0L*WYal_#-`%1USiboM(yF5jm=UwPpP1MC;GDQziPOq
z#xQDuHB2#6NRk#u#su<~5=W$ki*XX48Fc_v57KvHXWuR(9vlZ~uH*Tei~w39ZDT~R
zsboE4PmtIV{G-Kua#tXwjs09HZ5^_xuJ1$)AS&wtq-<r8<x#+DIsMwMV%q#S_3810
zBj^29Cxrakg|Y6S?6eWNCwjk1BYfjN4CFVij;r+KYP>r_qqR85Cs_qI9XApesod8^
z58a#V2Y{2QAh8xb;Tne&>>B?FCc>Oy&7;kO&Qujv7oxK1WlaJU|AD42>qLIjP4z7R
zZ@sny&{6iBkr?x2@DfU}`N<vzXX8+G?mM{3&O<uu@4lX`^b0r9Gy;~GULsYdaXB8L
zLH8Y>RwlU&APY;Ce+TpijOm4`d9ey?;Gx=?*%`sb?b1Y7>Cn)l1V!b8`Cbp6%PSg-
zh2!D_<N6p_+;P~R;l6&NObcv13lauqal-GQV|B3<rOzU?xmisyD%zrPO~?zMSXd75
zbnR4#wQ=2eFbq$5t?X(N4iwiPJsAX6md>onyT@?r{%*0sYORC0`QV-7RvYb2{pS6+
zmv0YHMnyi{uPc?;cMI*l_8woX_Zk#+MZ~_E2NK)f=ZlRa4PSxk9@+H;P(0;kES@v;
z7ZyFE4+^U}0c<l{VZ$2zXuW`cM)afya(@gx6^c#r+U_-=bYHi1TXfO407?i{it#Cg
zrmUs|$Z%V$)-WN|s*Gv1>B}dgAD;j%dP-iQv=06e;7p0h_t9SZk26ipAc=qSG6<jr
z<_HF$dDD!$FLXMK^cj}0#~G)$)CLCf5QNxaCA;0Ntz*wKbzTclD&isc(uInL@S$>V
zbjhjm^p~+wO@Qk2No@z~8HvQYpGOxc9dHO@df<w727oC(u5gE*$!p0FB!d5<(szLr
z;yCzQ6&B7&LizE(rD-Tlf7;4pJVN_AG+tzHyE35JY%4bMGTmX!LQF~Ov^I3~4@2ng
zaA@3@K+ACtZBoz$c{%}6Po1o~C*^Ob`2tR>`%fTb-CtbfY1=4OfuFUvZ64WLC)-qv
z|DwG<!X(L>@NQj>6h3P9gf&rgH*)A%q-4O6dxFU$(Xt}*4JX}DZ*$-TYO>(D)%MRP
zXa_{#JJ+=-4Ha-;_U&*$H62cuUKPAn<fw7h2Y-mAy*=_Rs$S{g);cI@y8s@W>}xnQ
zmf49p;jIvSXpN)2CPP2i24xZDD+&OQF#bj<Y>whIn5py87m_w+quU@=k-Us8?^5_2
zT~j<?A%9Q@lIG}N;nT_oOdOhntKa@ELU8?<3E2sBEF1s+1ml~(YUfI;I^%--DiXWf
ze{$!eYOE*8q}eIzzbSv$0JTW`6W9}r1f(bK4=a^Ooulm!1tJ|NYlAA)Wo206aFu+`
zobHa*c}fQOP?kpZE6ZhKhd@{zEVm%FQNmjB3$v=7n;*}}w-0|<YD32I3MSL1G_$i@
z_pN3yhACuOrZgp@s5NC+#9i2<vEBxi=qf%CEc^N#H9TCmTn^leHC^u?9yl1D+kI+!
z@IJIjoTKV_^Z@~(k@@X8V4*N0y}iFA)pPFN2M&9?MZ$+b*5E_Ko#3F@2^ezy`TC|S
z^ehS!Vh<4DdG1%AngNGLfhE7Yhr@?~IITz4>my41F{$Ez*f7~Z0EoreJJsnTJ@<0%
zyMbUQ!p>ON&>i@3DSfT%hdW3IcTN94mcBA9s{ZR5ZbFdmZV9DCx+Mo`ly0OO=^>Tw
z?id6_y1S)22I=k`I){9Z|L6S(7jPZU{9>)O*WSx(dl|@3R`lM>lZiY5uOl9FPV?)S
z{!-w3qw&^L60A9Cgx~hnS!pye%=4G$6`V<3Gixhh!~^WW*LcYQmv?j(r?c3T%>fVy
ziiY}WV#Lm6w1oZEmv4Hdw>JcziwR;Zv@};{J^#aahajQ)>vK-+R>bss1)$mDPR-n2
ze*^tn)+g~?P4i!+ES{3nzT$K<_vj01?rdPm{Zv-GU{UAY$36(uI2wz;n;$`C|J_$a
zneDC)F*6Zpn0xqFnsun?@mu4!^eZ}}Afe(F8$6|<`8XA){}fR3g-IBw2c%j0@P-GN
zzh2kZ(dr{C_`f_+-+eFETLDDTTObYWl%o}P!Kje(KY^xw4zkl2&X%U{bIwTf7-wxD
z47^z!fVua#{iEeCd*UwzK2L|Gm5_6ve*d`<07_n7JKpUXW#8J~-Xj4V-{1G{sTJ1t
zH!V|S=ab4^rdGRq%i91L@Q1nm9F<~3Hp#Sc@u7Rl0@jKWO`hkQ%+$|!FVFMPr_^!)
z2IJ5SF#6qki#OeED)j3&pIs!7bQ(YQ0Yhd{F8LGv$Y?N1od~R^%q$XU_bT=uT~o}W
zyEDO}O;TJ5yEe#VRdczwIG#A=`%&Y!>QvysMaBDpu<C<mW|zR~@d^5jQC(8Z8CF|L
zeiakyvWn$(?d-57KMR8?wdUVt1pj?JOKdU7wsvb4`Gz8Z8lA7IyXwE&Ayww}E19~?
z(?w`H7>&}aGBU#x`&^VAzvbO{epqQu_rvBm<f#{2IFVV!{ij9t1VQ&<jAd#hn>lLJ
z4>O8_)%~}PdH`_Xz!Os2tRl*i!YVp9LOdP^yjL$*an_~2AC=XPi?`j(RNiN%t{o_w
zb}Cz7@9=j%t=PV7VBHN<7`@;yV04?th@R+K`dVT$*8&bQSnaK$X~iS(avL<^fTc#<
z6X*~*%Xakj&9o2k9_3r}xqP5@&3O@g$U0!sjjzo1>p#yCK4`o2djbN(H~%1=R^J)|
z4*+@9wjbQJMhc7Xp}9@#^gb5fWM$6sy!glHqxl!D&e}t%ZmPNh&dy`KN9B|sY6o)O
z@74sTYP}q@f}Y1P>01D7WZ@#orO<p)QccqipxBAKFE`7kw+sHZCjff&I%yWq+)>IX
z(?~#acrUbNNoDxfI@b))#!0DXgL}FhZD|XcKVw_Y0^>BMT$9lc-wx6i8{>bMG&Q&j
z`qeTm4tVUdKnm2wE&c&eXKb^ySKH{HK400n_K3)t6vB7RAhLk1W;0lafie+_h)d-h
zwF(9~#0iIT1x^d%T${PM$uboTz0N)r?7}}BR*L^w>Rr&7Q}t07)ihN|Bsfh*YnrHq
zP*b%4A;B$ZRZ^DxGKh+tDlaYcjf}$QIxA6BIaRB?fgjxJj`F-{t1!)XGO;TvW+rAH
zQBxQMR$-zFOCc&)a=#v^jHQ1CV%cVy$c|TqZDy4lI)!{jYZ-Loi)Ba+a|SXL6n@`x
zqytkhPt;<4^BDZY{uc;0*VuNPxpsd;(&^N#`+RlqZ#MP6G36^K?sM55EldB@;22>T
zF8Q_;&GYGV&0c~6$I~4&$Ft|?#cwq9r0sIW!U)&!TVL{o*NxiU;F^lx#a|!|yKunw
zuy%m*q4?#w5(n0JD#qYg|8(QA;J#!JY<6d`IlwW1G`1Z}DtJ`at=L@`j=p8Kn?w8c
zEX0;tyu!H&_*9hz&H;gsqlyv;m1*BGdI3LPuf06u>^Xi2{O~;S*RgGA6r)?K?UAw4
z6Ru$KcoXh((KOMv&sdrE@8kCUT+kE2?KjZgG-5f{3GOI1MjQEd2EiC2xVcoOQ<<Oe
z8=Vk&&<XQP#Z^0>nj{VUy{AO?AFJJzcBZ1~1mg6yqEA0{)^P3LGXsfVO{@bhI_~d?
zoN(1}DC>zcI5PT=F<myF7QIXH3@$=lIxf@D>`^w_1_28l5F5u2&?7)tyoh3ee9;V~
z|Ci&E<2{X`^0-{MXXS4DOaJTvL;S1@XN%RN{V2v8*0EFp99Wke!fVGB!YBVMSAbSF
zAm%>0UfywY%`HnDBz)}Jm_DYtT~b=%HJ=;%yaGRW3EzV})CQj1u3!3JUjEa(;`x_t
zM%b%q-{ejB+_;#&?#AMuUk5yHFks4mv3nPAwE$kO4bxqx;kSkCdJR6K$rwz4l)0Dr
z0*{XM9c3u=ngcyQY+dr?a5?V~<zsZ?VLBx;mF5rXbWF1PY;q7%Q$A6=8;lv<8<hKl
zdnk9l-&{DFfAr>!g*7Gj<k)*S)Tc2>EP9u_%DHX_eIqTOYa9LTHaa+Kz^@xwgf3>3
z?@hjkBdzfL0jl8#Q*~yuCYhCm_azL;-vVqVP1(NiT!736ux4ckR8c&)sx3EBQj@bG
zhYXjVKyTo$VRyEc*UifiWArpjX}t4&FN_}}0Thf<oFN^k(6Md@%FQ(6wRI?*KA3L;
zn&v#7yz=J+;ru`Y@0w!@-ED;It7~WjR{u6=2d7j`L`M<W5Hi@pS0-DW&!d(q0!K@0
z$DKgn@AIOin0GhcgwG;u*DW+5lB4A=FOoyd_nzO-<Jb*AwiZ`LoJB(;M(_+>UY3hW
zNAQyW)7}GU)d|q9+$w#J%1-q?H)#5&D`Neo8N6P14~X5UG0-SIZhy-mb6M~i`KKw0
zJ;44=G8cp8hK{bE%0d8_L)P;(_nzrjhMfpjknac!o;{$|FxggNR&fm;CMDtQZ^5$y
zI3lixi+zUrM}eUu60-sU{uDEznl*}|D^~g1OvN$FBE_YVH8W$^`B&&4qLj-np2GW`
z0;#AUkHW~lj^gf%T2ThiUp(&%$4;nqM2e7}1ra$a&ry*d`VskhIN_;BXGo}{saOGC
znY8`SG&KXv2+*oxZ}~QwvZAx3vdB4sKXodt6zcBZok8SLSG@(4(eP#6UmnRW^2evR
z<FT;LwGM_#{RTU@-r5Zfa5XeGc08r%Ii&af%5c3X0*QXzPL3oVd-u@~UV5nv-?R=)
z_1#R&G3@Xuvy|EeZySC01ZsW<@Z&8S;X_BFe=o)7<rT*LubqFuZN#Ci<nc7q(r@SK
z)ORoP<sQym1f;O-=ZkageaV)WeICNi;Kc^&`1J`JlaOYKX?A`&z%$SceG2k2m7<b>
zfIfXVjcH5=pv^^40+g8ThdCy2#IJlnm8JQsqJ1h|auy_*=_mP42PL6S1jY>8MQ`Eg
zKVs9=YWrD1`x5~-g8sh&kD@OF9@l|Yvg#Y?YN;(KlszpzN&5@mLVlGIqPLVm*lrLE
z3`tD)B!M~Sb9!l{?F%>EjLt$%A!KUoZWt0zNRhHh^esZ$w1+`~@@I%quW!UU=@8pK
zf+n1K2OV~wkVT7f9okg7$z+8;Ssr5w%Z`oP^#pL6J&*_oPA_d>ufud!5JfDl@`U$P
zNo+x)p>N_>FQUNlR34-c<=@wYj+Rml?+3WF41pEcaXwaSAy&vFE$!ONopZD6@6~hW
z=0aDPeUluo^$fEVrvdNuQ@k>RLI?bu72Uq2w%U12O59@m*IPmJKw@8~FY}lobs5j_
zuHtPV>Goya-_LAj++>8kkrccG+!8#M+<>(D+(%6O^MN^4Kv<FE3v9KQ%rbS&xFY`+
zYWLQ5cRKpdAKdo{zY0&cuRrlI@lqTt|4cy&LDa@JHt>8?s1RegzpKMLYs-ru?ky|v
zgnTU<U`a@z&V>Gs*g~DwdsmnI$ew-J6_PigL2QD$7R}d5f>kO!<}HEqj!8BHxY&l4
zWvR&KDyX#%Ndv1%r;!Eui6(Z4RZuN_f0N*{c(wT@5FkRDp~5K|q$0A;H(tl;l6M>e
zbL+1`tTY~)33UNeUh{OJDozMQ3)6eO^ZToR(B6U&BUe5Mz)ZAEl=a#Pj^FqZW)^-O
zFs8_}|CY+)f$DFu?SW)Fv537+-%fqKOQ@(krtg|5=NKC`9=Uv7VT#dR+)=yjz4o$^
z531Eu;#;-KN5Y=>2Z%xq5T@ejyI1Z$Z}QN(<~tW}q#?w70f?pi7sE!67h1Q?6Yc%_
zWC=1rrD6!k#}PN}Fu42{3!YxEd@1sInhX_pjbslwN+e>{q;vs%%)8A(BNsc3l;>r8
zfR8{?4R_V4CmLYZfayo_m-6JBc(n1w4e7Pmn`@Yhe4f=W&*`kUi9@Bk4LMaeb=ra%
zQOk#dq~S-SK!pM&IdGO#+xz25CQPoYh_{&x{Sd6T<Z+p#Ai+!-&-_LsIH@eU;zN)d
zXq@SWYMLVZ@?JoSsy<{?X!av}y{fNtTY;`t?jHKnec)>)xFK0FjG3oBSe?d&=Wr;1
zo|ub|q&@f!bsMvM0EKNsCooG1_w;>D;<go=5GIkdAo)y#It;&w8&`%e$^-R6v-}w0
z`O_BcYtHNED$?v&U7U@_!L(&B`nBir+y1qie`qD@cdh2&N$ZMlWjlcMVprT(%u}=7
zTaLzskLv)n&9MGU%l4E4$Pj*+^YS$%=NhOYP=CRtzCR1?IL~=Dg5Ph%`oq#x1TQJp
zS{^UNRYaR-6b<1ebE7jx1nJRsT=(9E4lVFqa5m7Aib1bGgn*RDi+&h^0%nxp)!yHs
zx)*j|mujQF`8LxU5<o3EQ4~duUeojTR1oNlitSb|5-Y{#sfbDQhF1I%DOlav|4jC}
zwR@RxEA&XQw&t~J&<g!wm&QQccj~PYEu0faU&|-$ORY1#uMj6l+d`~tnMQ;LDNoBF
z`Cku`WoAhfu<JL*-$HYex<Y?R9Yf@bPT%a1_Zjuv<UDbxwRuE{NwwO7ANMWm1DsCG
zfelLOfBp}Jos;BvpG*LDrv>r|=@TFkG3NnhN#(xZ<G$wGICD1PyeyD0-+XdUVFA}+
z&T;|}_f5+6oKfXVjqmM>Whhlc=Qh4ku^3?LiGe5mtG#0GH7*Vg#6I_a%ejY@Kv2{Q
zsCbe_I9l!gC*TC2K^BhEg_v|6BlbgpG-}9Bt@7|55HpS6b(}oJHPNgDRVfld`1HHT
z?&G^Fath;g#GjMeB!0BTKv=U(D&EE0&*DWV5G^(xDr3huW_1P&TE`#?*e=_F$bOQs
zi2=%dxt1V}D)%8WjV5AfMN<#H+bSNeCs5-YeNAp)L*(ok7%P*VmN9Ior3r)%OmFD8
z>FnM8^H2RiQ3<p9CGSYL{~7CpN^pG~y=t0pEXORFOw`9N#Q@wIG_}DGD!^c4_cJk5
z84<bhTC=wBRm-dH#Hj+K@7#*KnM+jpj;UwDA;sd+hA`A1uWIi7zk^j2gju=JIo<zr
zvOJ2y8xHox$=xr<Ml{Q`xn{;HJD=}?gVOa-aAm^`sEK(GEUo<$)d0(EP0Qdl|FYAe
zwUO8TU&xfdj{HHmis$2l_*u@~CLNC7dc%?f_Z{9p8}nZ0S)b0BbMi3Ig>hfu(fP8r
zdVd3$tCWX1qsoVX+?X*RWk94vNqmQ=Dc)RpZlOlZdy_;JsalQ%iVnQZ%0MJ-+iSXw
z*+vgt$kds4A-vqWrXFyTuq?_u=s$z_VSW<`7UTCU@~RrhWV94OavYCN#SpV!L?drv
zb_#Kq)R^n;nox9ySi`t&+Al}Rl%p9Z82Ku!Ps|^U;yX4%iov-@mP(8(h}%Zb@aUJ@
zPI0@LpNT5|yDp|2tS?N%TLYq;UQ>H2={JvGujALU{kwW-&gWll9bd$rTSfQuu$u;+
zO*vYhZkGJvBh_O?0CGQ}_rXwQ9^ONyRDKzxjERzl%AFULDKwbYFmNe+5xl-N_1LVK
zu<g?^5L~<n`koj*02E2%n78q~+MRPLLME$)-ZK>({V#`h7d;W$%CE}P{fqe-(Vd0-
zNJC;9_7!vC%>bMAe-3V&)yVZxU@PP{##kZY*||y)qBCV#%V+ub=vj2P1bM6e#69`6
z@3|^>08=cUmKkV-?46z*u!ugwGDT4lgvg!?4f!gjvR{=*Y+$xR!6nNY0ir=32~i9h
z?l`TcSK02#t<rVexQD-QxF6|G@SA;$M@0tjKthfH&#`vw@Hu`SA^7JS*^3cB`KKpo
zsF=AWagRUl{<9Wzb$;`Id06oPezs5CmFr@{!tZfwVBEs1R36yWU?5Ad{f5S{6Uau>
z5G6?lECiigWo&o`&O-&<^DNRFcTd4{`o3dPYhv*jFK3}TtGS;D;y8}w`5I%Ck9rcl
z{UgK!8qrm*6xwgi+Rcmu#<O%F_pufh_rhT%BDtf2Zi4$sqxcuz0+xq|d80u}PERbp
z0XX>tr9S@j17z~QBWH|5U*VAVCm&)f^fVpLAT8&eiaZ28XLQ$&XNLVD^KzFR1hk6S
z8VPsZQyq|kR=LhJ7yida5jw&o!Fm5fYRW|u`ObAO(8(L_D*K#Re68fa$E4-7S>FFn
z?GG2jN_;D3i<yo<q@iOo!%(`V4|vV@#&D)q+jqx>IqP2=pZN>#QDx^Uuwf?u`9dzX
zRsl1?$ha`pD!fqqY2l7j$w0{rexcWKF;hw9JIbup(>Zt1%Pi)%oxB(GocJcU?P%q+
z70HLoE>SpZzqpx6V#m52ie(vAcxTXohVIF<ZqKrgzN7ZRTz8#kWuF0Xex+t5$X)Wy
zgtIKbl$4*4P`^i26g~$79hd=#@9jQ9B>-etyMZpKz$cQMGL4SewQS69xsF;ts8IF3
z7y-k8D^RE_l=19)6qO$un($$psoS4~xpW+!mT6`)*J6#qgKjd5G;D6=!Pn%-U)M4;
zuYb)LWBq8Jl!8>PV`7+nURFWljRgh@vQ%u>S9~#59U`b1&w4|Pi(9~(CWHO9MIeUY
zC;gRJ6J?uXuH_0g12wY$hC}{y!UQqrQPIsn_M1)2nFa^u_{G>d>i(7dB{E9?!JD_P
zE1wn_@?ALnAGdOZvap7Ls!EmFkSj0zt|MO<;<N61n&Hdq3Fs)^55lYMy74kDECZC@
z%cQUkqayLgGqs6GYX9y}fH&_yg>kt5%k9havzz0xd82R4V`;u-k4>Dce<Ti`?~&fx
z|242gNWVii_EvoQC@uM4aZLUhyKawb%j}zmaXO_#IWg5k#u~RI@9v1UaX9g(*`p(V
zk=(gNZxd#LMus9%nN)qs>rW>vV3B=^3iN9PiR?+8&QhG_itl^)iL-CeZHT_cVAPms
zU4Dmz|E&0KBY%~*S(C46wZTFyb(&tSUF`wBajf^Mi3!T!!@E-}CF!M5A4IS(C0N%y
zqQ9MX_#t#tJabHse|Sd7^)P)XD9toSWEiW$DhFo?I4t;UFf*L|KBw7g1)r{DYv;qy
zf*xvG<kzCcAz1jBuIkGT0eVuzvLvEKiQKJNxvS+Z2)ggwNgLRIWPj7*a&MqC4z1gE
z$NA5I#H2(CI;K2D+TENA2*QRgW4xvvl1_kRzhqZ?Jt(fIBAw~b0`y)eSn{{>YET0u
zbi=d9y>VDOkUy<5@eGZ9+4CR&AAY$%EDhf;;Cwo2&RVu%*fTnNsGWdAeQ{b;Ud-=a
zy`z4v3dIC&c0C6;Kta=ww=Ld1;fQkRb-(}#wfPX}-s`wOWUXwu2b2Y&+vS{>N0Ltc
zK{91l74O5ufvOq;csGek_S_KAcQo9aHI^9VB^e8b6!V~c5zFBmmLrTNjLqOCX1>qr
zoGQCVhYMEUg;zTBq<a*GK1uqD(0#i3Br%k@RlSa0{q@{bt)M4uq*?^!%#9?LN`)oS
zoxy7~%G{jgBbieh#g;s;WX1=DE^WB>HhLiRJP7f>W2?E?0v-rP+H0k&ZP|C;7)m*G
zGoUhx+Ucw)!>dp!gK(bW-*(X}(a!e_Gp)uwP9Z4xufr!8jPvot4;}snd-Ov+*%$32
z+Jiy$f<!mWMtw4SAYE2X2vfnL)lD2w0E^UjyDkcd3%gnJ$T>&ZXg_sZXJe|j7>Rto
zN7>@+0KlO?;3fS>rp5)fDCU6j;^UYNZxVsB0Jw^F*)pen7Vt6weY1{DU8uLsx9zB>
z@cO?KO}iO3pZM0CUwQ9;Ydvo8ooHR<yVx{(K5XlJ+=&2Z1BI7T`5@M~TKH-Obz9Z6
z?dkDB-4ESJ`S$(C@Ye5lkohs9sM-Uxj9rKekZ{|8q_n4)A?LxrGk2NfmFho2@ar?*
z=k}cU)TWcT-0$*67{f39px$Q-u}io;o-gTMF7vgL-^P+tL3ytG?P8n#x5OC_xAdWS
z0hKP-$s)Si#|Q<HWP1y_*_O)pnBN-He~f|dDnvgBaXMdXXvMZ&(BXj3?v`R6FJgru
zc5P5u(=fLG>8$@OYfIL1?S>aMoq`A3oMrZa8OQgYJBPxD)_o{}5ilnBNxROQ;25=e
zo}Y<|3m-lxWJbmRYjfFp`ETQGVHRIyB0w97<Y!-)Eii_%h7&bOb|o*Fa{afr{dS*%
zelG1TZ2CzGHaD*5FC3!Jr+w<Ma!tJ+hPR8Zym}q&wqv3W%+>OdSF&pO_7ueBo&Ts<
zkW*#q*`#Tiul|6JrIMDg9Po?$jmeL&Q-(XPs5rm(2*JSYuWXO9lO_p^p!wpT%%ytE
z&Tmsb6>|v(mkG6Pg7&S<SAf>GiW%b{{mK);hT#7B^Po1NQWsxaSDDrw^!gG@9(+=Z
z04`ZaS%b7s8|cNRXd6B1IX{DQ%Vctn*^v!^0p>qH{wVJf@=A|qK*JlKJe6Dt54?*s
zZcNvPJSkW-p8I_oJ+B!n6;@nx$akyH!uW&z7pVWmmsU{g;flFt1e{IQ*VFo3Bmx6Z
zndg`<v?lzX{h#MRuQ>Huwy__!j{&rJHdC1`=D7ek=xFgo0lk#8?Lx)B1qSrnet5;L
zcVr%jb#gUiDt?~^5_jId25{%)KPMqL`!lfC3~8ZXR_1V|k>B7RS-@6b&tPmvrhzgZ
zKPwPT{;;MqeqU6W8R=q_pg1?@_{WZvs)mPb=)injDT_q@M42fz2k2eCBD^KAiBZtU
z`*fXm9jh+z)3Ra+s8tW2xkkR3&XvRfh2Z7hMj4jj+sb|Of8s;WI<(d5D^Ydkg@Mx^
zwCYxW|NM^xS+ZQrz>)6oEsR;(AYNym@F1pkDiQBXdfG4ntA;OA!<61&a#|KFjew>f
zU0qtg*-b|KW)c>hlvFOgYQK}x<p)DZ{^JpbEV%-cMEC>5ug`;B8^e!Pl2>FwW%%Gm
z>wgmLgx^hMyw*wm9<_?s<_6I33qb6e2M3RwzF)J(K<&wQK>w!iOXn33?9Ao4aI>^#
z4j`=T>tC8iaM(FBrlHH9=LZ7l)2YW=7psa89K+>(VZGtMY_zqfoAiI?-Tuy<yNT>3
z;?K)UvqEp>UkON_?x1gRN&Qaqo!tjTfRv86w^uz};ErbKDko1(s=%y?F<@}S)@upb
za{i)0^PYIyG~N2dpBw>rwuP@%<TMLCrDM~%GzKsm!zfSti-a^>WrSo*)wwgdHqooG
zUqRvse-yP=JEYdUyPU}oH~Jpml!JSnM?S3v?#^peog|&DW1K=ZH8<~bYl`uV=v}6b
zp{7769@iEmk9>;Im~{~;;jdnrM0}4EJ<h4V0Cs*aWHet*6m&`dWoNR|cdWEu|0cHb
zp_OdhLIX`~m&+S)>qYnLy8}s!lr9U@t*3mg2W2OKbI<=6=!^dH!utSgodYhE=808r
ztkvUvQ!zo%rLKZGKpFjy*V+%g*Pi+z-Y~HlinZHkoUy-2yPE&zF4Pr@!T*`_vt7Fj
zJ6#WlPQCV)AeS%(e&EW}5UpggjdL9$6k)ZhX-s1t<u$k?8^aFo{sKP>>X>dN@H!MM
zFLZF&A^4_q<)FyK&5^VFfno2jdKHJoc3WGia;}YxL)9>WdrL9BJS6UO60`))rjkY{
zt|?{q9{H#nD@DXaJ3Rg{ku2i=WkL8<pftQbR(t^)L*cZY<y}OWoW@)FpDZ^a?d^y4
zCY^^GmDh{jS}+tm)fSe#fV}y*Rd1u=ZVp%t?<viY8RYFy`rn%@1IX#X!*WiopkShz
za~5-_NO;=8f@cCpG}p&h5Gqa`?!sU!6h@GFsC3~>+gxT9(rgohPuscs1Vt}7SgGcQ
zo+U#D!vOD(*6V5E=<{S0y8l{8)Tbp;S<FLh9Nt>|Lhu||j~}HUPLvod$d1OVc$NEC
zic-)gYzyyezW7gQFetcBZ?XV;Ol{ZyibtG_ElK5&TW_NU^GuPnca2`*fwh-cc;-wr
zZ?hVgK~$ZIgUztUb>V_2BpftXVPNR9aS-3Qa@_b)UVgaMu`>np<|mf>elP;UPeAkF
zdRzrUWSJt57i#Cssv|i>#9L0(5&QjlH+C}}(6oR0wz@N!r*}T{dB7u*tB>ZoBp=+5
z7wfENO0{Bh1659-3|FS!>V`fCGs&fz18t^2zf&cIv-66rqh`HrdV3@E*=4}sHiqKG
zEl)^Ro%b%;(W%lOX&Coo6F!d3Z#o-DP7@q+P>hZxV-L$p@}y$yC(!9+Z5UaxT-#iH
zvdaE_{|J30oql#>n!xK)&S@{dp#w7M7S|Tlcc3qFgf7ayYw>4xE1DiMhn{SDL28PG
zvV&wdb8=o2H2P&yU;vj}Td+2Hfcjq7r|XXb@!dX=?1zc|>XajN9kI$%=56NaBwuj8
zZXuG0)YhV87Gq6(tcx7qhh_@~)nON4p3_M^P8YW;h~$jR;`|GCFJ510lL+}vDXKs$
zajmppwq(mhI+Yw;3&Xr{-CE(PU~>R^Q88Y1#Ab(ILCJaW>=fr8Z|7QuV!yTJ9LE$C
zN;7+K^;ac&W-$VXu+-z7a?W#hGlAPmz1CcX#>4Zg=T`eA_XCyV#d_cSp#c>N3tbOF
zt&2+x%v9LgDRLqO36`MKpZ)qDOxUC8mRVw(d51Z;evd<YUFdWO`tAo|aYtmLEyHbo
zRSC^oH+q#Vn;(j~czNrs|1ynb@J2iD*v?h7-ad!s>3?E$8tNnIxbA0t`!+-P-=vnu
zAyB>-r3Xy(R!kL6#ZUqSAXdBm{WLwko1Jn?XFt7~ctGMiyX6<Y_nN%-d%es&f1qDR
z+27KSwZFu?(Zk3Kjw7_h+wJ6+Vi;_14|qOK&RXRQrTuxW9o=;|ZAIz3m@k%*!C>p2
zBzih7JRDDXE)b;+SHu+9QoPL-n3~ie@@bZV2MP@$_@vxEq5L%;6k~XE*7T5*n|rG=
z`Atxcpc~+abla{AS<A~*_KP%3ynehUQ{|1zRvig=B-#EqI+i{+a1!yCi=!+f|I+y6
znRf3+#HR;Fjhh<VIgTDi&Q{mnADc)<esI9Ff^muQ8o~JE3jz0s55N6|83InRz(~J(
z`WQGoVc~`U5esxU=6I}DkT-6~40X#yzC2!@p8Pm{OE&q^yPix4TjIZu<TPEZJd_H(
zIsS8J5U}y#!hP)lB_VXSTu<~Cmbhp)x%Hc(GUxd?DqZ|h-MXE=gzqszxKW{v#qgU)
z3JAl7-o>tLewJWZEO&oY8)8E18R$%Sgzjr;XG6$b5zyeKc7_f<CcZ>RgwrN4Zwhkb
zCVEL$*z<lJ=s&96J6sR*l~n2lDTX}@=0<Cp<P%wI1^P--qL9c9z6$zg<xQMcs+QCb
zp`stY4$=<fxIZP?<wTsyQwghQlz|bvCJHf`CJxBDY{K(Ql4TeM-xVR@=I@ieZYHBB
z$g?a8_gnZWgsM&G-=%#O^C7}>n?<dhZ<-n;EU;-Blz*=v!y9z|^<-IGvrM087F1L7
zp|a(o=62QBbYT;G`Fww!-Ds##Vuy?1{?JLIzw=VjeAs%B*x+cORp+P$?J)Sl?C%DE
zPwAWX5OkBJ2K$aXSiX>;;9*V%zvIoY!h|os@8@zDZ17%nhm_mhC&@NV=$e8#o%vlN
ziJ?#5_JSPxUc1NIU@=u*6F(#4&e)t0b~C92?Q(cR@Dy6)#00_)PWO&C&6vdxV>%$w
z?%PRNVX)WnuG$?$QB11-V;LRrqItRIvEnR7?Xa<|G|O$kvL_Z8KB%0lj;Q*=!V@#y
zu)nYKA-F3j1I`qgr_y{lyE?dY>*n&F*z9Aqj9B`Cx1d)F(=B$BR4hKY2*NRnfg(4{
zxwP8_#6m^$Gt<^wuiP0ZW}HDEi<x`XN|<}eKX%M%QEtc=ls3vhcD1m~>=p13qP4F}
zf_S`m({nxAdoGzJ!X#%8sdQFfdA!l{yz*ifIg*774)=bXvLal#7_5fUc%l=Lv)hFs
z+@thp@&C%l$+LLXLm{&oKl5mlK1+FF^p28U>1jja5LXksF{aJsaJ!OCOsqu2f8wFA
zt!;UG%uQFwEusq3dF!`Qhypf^Sea4h)<AU5`>h9>;o%YT>B_Ylz>u`kibW>EQd3#c
z;&XAZ52Ep-<>tQFEA|7vAiW8FZ!-0(`1Wb9GyFux3b+N1+lD{9Dc7y16mmUF;~eN~
zRgmTlFd9O=_2R3tLnOq~*Av1TY((VYL>@}-g5yk35SC99ye1?0t}4YcOCS%S%M82_
zMn@^X4>H7l>m5jIHAE3Kc^w23<8iW#^YMFY<10#+SzE)__t{sH=dbxd<XBYojm3oa
zB~~JDSTkAELl=ci#4hNwu<B%6PC5CcC&2}BlKB4RYp%>>Q7P9ylW6Kfo6&|@8&<xO
zWd%Y!`j-3loejXe@j8|AjBTt7U0#pgcjWU0q-6zcYQuEF-c)^R5fyD`@dvxg^W1eZ
zIg?b@`;p1eooE)ZE9eZONJJJU8O?h!{j@98=mIMq{JTmrp;-Z2BEPOGf3)Fh_ZX&;
zAe~v8+SiJ3frw7yB;5XZ8vl$Z_&#Ui*iK{!aCTkpal&THZOv#L=NgoBb#--gbed?g
zo-QlBFE8t7bL6vy+$w<WR9caA)QZh_adFY{bn_5qYd%-5Ck}j6UzZr^)4pwWc5Id$
z;jdsY=+@g=cL1gP=&d<|ybStGw9nESLUw-EDE=%{CCq0`riNm84x%Pk$?7H=mSmdr
z8Wy4^A9Hv|Jjv9xb%o^YB2LEckQx;!u8~;Rr54YNq4CrUXP`(Z3)VdC_B)VY?^bp6
z6k@o9eXaxY#Sc^OifqOhmNjS}+9MUlUMl<46WdDwJO;VNoTp>iZQ^Oy&4aG_riCIh
zB8s{aUtH|rF)~a%69VyrRS!s?b%}c4_}uGkua(yLdOKjwrPTQl_qq7W`b)$n7ONY2
zo+m4Cv<d}`Frw!gwhQfIP#6x=p&_0M3B|6<oDa9uw$(J@HY*Sqiqf%=$5G@<D|}J0
z0;fJ8!h={Mu7lS3ku>wuLYkNok7*clCNnu(VnX>7`)YLw8OoV^;|sLd7Hy`%At^s4
zF3`V8XS>G$g#=fqICCBJ&^7R5_#*<V7~O=i8uH6vhbr|Q<b?n?c~P=pN+Sx9BIuD3
zw3J}+oG{K^XExSvuU#KpVu|KicNuTJb&ftIfXo$9A6(IZJb}yXb+V4H^(KlV#|}64
z^;(!;3ENJp(iJAJn)mW~W%?tA#e<AI+SUlL(N6u>H`2;%pqq?CP8e%Nx8ln!ZhE~m
z;)jFd@xEs>bE|A`--h3LbLllYv|gS(D5kjj|1D)BU{+eFHnl_sYV}2)FFmoQt2B}d
zU@+Xiam|47gz#Fs%`+X|T{>45ZKM)r6D>^lRS@AL+aWqMJNhIGa|}-c%F?%<Q4T7e
zP-AuZGxE1dHU&R6<^55zi{!Ty*jQ$}?MsFTK~QtkXO+P^fm095(C_uQ!8*Th!kJdf
z)KjaQvXRvEtWJ)0WfUV92s4>3qedP$d1sYznl1jCAo%fiiIyM+qDJ$7L<*n+sd=X(
zseIWMA#VOSl`EP4o?_+?FNHVpA=<dhuQK7$MM<6y&HYeGt=DHn$nfC+&%Pf9fw&d&
zgMyGG#1b*;rB8Rd=)(%oeU#@U!abHtXxIlDG4cYR%+@AFg=SH5wFdr(HUN`xQn+1M
zN#~=ON9|9c(GYzf2o&OLlXw^X>J~ORM_IEqKK`mQ`=v%rlGH=&asMxf#=j;nk3J)r
zkeJxOqi3x8@G}pkfU3{PpfLSvRu4`p&4A6|V*Szc<vK&WujXcdrXwpSC%?{T0mo8W
zA|fJF1~0s2m0G{mDihPPRw=7Ae#hrefuZg2n<8nCHzKoT2Ce+!Yfc-TFA$Qsaoid5
z%!$T2tw|IteFeVQ=w+g9tN<86Kpyy+N#ESVMWh-MHzpx9NAPuQw-;d)9ZyuMXw*xx
ziy2s}4f=Xvmst8^eIIC4c`~8S_L1OLA&Q1cHl5MRpf-iOO1>$!<X3SnA|{hosJJ84
z=f=*l8AWO-thSt)GP;Vss@RxzW}EuKv4$pZkY>ML6|+lU2PwBsu<TF-adVt6BF?33
zl6@TmRp$LLNRfc#`pC*b=qQFN`r#$zmzV|dZ+E5)UlZ4i$3?U7UBP7nzY9s#;gYkn
zC`=p8O+Iff4AT;UGE%!Pu%viHzx$mdJPqd>@yVmH1~Nb2j%v&;<BqLB_*a}C*8E=x
zTB&9Fw%@LaTwh(r`_67_{P1hLIHaiTge&*bczAB~Y5n%Sv`=C!mTY@@2I2Wctn#U$
zm+7>+Z`*s^3Yx4hH~YV7;fy!-B)L89d};RS8}{@FDVnva_?cgv<!njP8G!Ax%WO50
zd5Nw|b6$og!*2xGuE&|pfCyE+YiGVPFh}S+|F#IG6SBN?F1f`_*xQVW5s9>X+r9IP
zOJ))F9rS&Olxu1R<4R+{Wsx@0-@$_T{C?)T_*qLG+R>`uUpQ}~YlV5fH_e*K+VQ*&
z{1cf{Meg_gy1CRRmVUx-VQ^b-LpUKA6BN-<)?T9KVOA4gx$HQ!Vz=Ul$oXmup5|%Z
zmB2&O9)YUyV6bAWB{eVCaJG*UZDGkc;ta2+$P(1c6_KKd=J2az60W!7>5r2w%&CiG
z@+zjM5PW>UWh7DoCnD%ln0_1<q%ggU1fiQSp7*6y7h;Js2Y7Wq1_WGkw!I1A1jnMs
zirjQ+8TqpY;80IhOYy9E4`jbUc)+^7G%v7AE{&u9wtbx@tMf-VM)$p(q2X$(T4znb
zSx>`pj(@t#d4ZOjSjmIlsXCV_?&YLZtiw`+sAqaYLPDlvd%p9%l)B}w(%nHywTg^L
z-ArqQj6HO6SG+4cb0xM5W}fe#>-$bEP05&MS^DcBlQX%8=-<rX>@fnY#%g*hVfl=*
zDW%%ltYGX|@*Gt=%Q>`<SE#{ZLRbkFMwotT!<f*+UWs*?Z;KO|S00TKaMas?UNp}t
z+q!WI%ndS|(+d=Xt2It5JswDI#rPzCg#=4|uw*vf9q4-1+6^-jlFKxAO_pw@ipHQr
z>ManuXG%Kx^NUumY{pvHW_T`-vrnGuDGx<7FqrBB^IEM$@E3WvyxDkVr<-uaDF$c9
z*Jp=DvbC4@#_N+-pMTzcn_Iaxa6Kp5m?dbiTc96KO^9yVjsVDXyTi(Tl~}#Y-Z*Pz
z$Md1BW7uwKDT`6egHYKHvtm}lnI(yaIKY#6tuN|?Pg`!!7+SMMwy(~Ol;m7v^UT+t
zpI$mnyVhF=jC>C2Q7}j}bW_6)U$<Z=6f@UVs}y;LG?c6y;I{-gsH%h&f@>^X<WI0J
z{93rxMlzEF^6I(Dyd<N61gRg_LBvz*=FQ92=NE>!dHO17v}^JEV*)xBUq==f!tI_9
zcO<p-grfI)e=MZ_m6EuO53VOIK<s@Ll-GWKV9hC2ML6cH#RXOKm6SlDZjT_oAk(N_
z7Ta8uEMrd^6Ikl5J2sF|J;Llmv$4<BwPZ2-UP3G)#kEJs{h2=y<u`oL5^rzxGw~QG
z|2SF*(jG}hLh+wmEp*35tjzxERT<cZMZd2qZrk+pi$YPc;1!RsXMq3y45jYXVz@jb
zzsG>@3;gtpin#x!62HFx$_y4c&m>2Rk?MQPaYq`TyP=@)MAqg|lk@AKPev+ft_O@H
z(M|gS4l6AoqgM^~OV1OJC|KltVY_a7=H}*(?c9gu9<l}^n*m+SIXpl8J7uHEQQ11b
zZT)Us^L@$oSmovfmsqsjK7(F-&pPUO{w6+UtDO$ii_bt-T0KYzVXX6wjsr2-3aRWl
z;{ILYFKk6AU?_=czr%dh`A#ZCwB{0TDyPA5qJ68vdq76LTOJqRZZ@Ve?5H9JgZxax
zMeUL;*n0g^#JD+{pTUe3Ni4T}F<Sy)V3PePxT-2F;1D~%1M}~BDL#@u{>3n?fS)~;
z%)KfET&2v@8urBwibY<M?y#!`yd&``9|o*L^mF8;{tO)QvS38yh?{=qS$T&)E~t9b
zEUgGC`OrZZW8-}FnT9!~=-qU|*+B|*o(`I{V+?zgvU01-Mae%5I?z8H(4Y$LZMAY>
zj?;+g`3xC2X;Vl_?+m@#A|H=R!W{X(;lFVfTk<Z!3PO$AU&BHOsnr^ao@}rSjO4!Y
zcrCC!FxJ)793jQiwzvwGT;hd#2wlZV;T+HZlnCUtovqNX_uA-|SsP1B->;C7Y<0Jf
z6)L&h2z9er`aPB#>OLwrQDyHvFrIzHZ>L{nyiump2^{Er)N4znma+LUhs(d+N;S)M
z8?2y@e|~Hl0KdNmY4seM0$=WGjf8tPu^HZ30%}uKihfO<ckI^I3Qe9+d_scrYO^Jc
z+csV()oiiFScXChhhCEtwD;4O%Zm&A72Z6r4doObKEz17lfjA@1>G(7Ad+*fT%F=f
z&IJ?cV<FSYo}#$}aERu|7qBvmqc{CMY)4&}o%%ha5K`n$iWmkQl=E%BQ@|trOmm(1
zy0Th)*o5Z%dwy)*-kc0Cen2Dty?rXS`XD!taZV`jhk_r!m%jfodG~_fBD8+1N&qEI
z^rw4E_a^LcBEa8|zijpKlpz-M*h?Eg8zxWZ)bPuo*Ydy8^l0#|uHAjV4}xYY%9N`z
zv}2{$#Ua1!52uGl{=*BzG7PwAQlD-;=O3iC6QMC@YZ4i5veSRV9%uqN(ZOh@^YL-4
z5jIDUpr)fdhU09imaH$N@Ca<v?FWn6!`V&lZdY;S$C98%+byms#R-9ue-ES*UB;H!
zH#|K24+H_XCoLNNR~`>N9fVZ_ZDPF;CF*ZAKdm-mI9>Vkv4HQH`1A$1?`h^)93cu`
zv`*hq+5WWRDcFu*p(+_dg+4huAj{<2#jP<}ghNpe(rLbm=A!&;6~_%?S=OV_SJ~Io
z+lNVmy!pGp!ZJ|ezdmX^VnVnll`dW^R$?_(?tFpuM<0AfHuW6A-rW>A5L7-UcA3kt
zC&g^k$u-eP*&3b?_D-kWGP+H+S`p5obhETpJYSpp@z$*E-U6bA-U&qg5L2RvnXpc%
zyAL|vF3i`>F4m9@jbtF7`NJcQp^Yr2S=}&iwTBev-KN+Iiinl1fTGp4$A^F_g;(wB
zaOJoDj8p_mPvAfIQP5vh7O>koqoL<z{H-$Si3U=c*#zAduUy6{@J^p`ktKTna~)c#
zx#JmHgPb+%PGnT^TkR5T&O{y~Du+Fw$U^88l)FYyyGHQA7WB(X0|t1oI4i!92_n4q
zu1PVIpYRQb=*}bj?)tMCVlj6pHOM~-Rkg14R(xAlvvLvdFZKmzKZE9=H#Dq|^@F%-
zZrw!sS1?>~wq>OUyQ9m2;3U>u&s?CJ*YcI@>ewMy{UgX?@;qVyP5MZ>F*-p?4tFMN
zfEqmMG^8R%MKuTc_rRzdHjO(5$2S!N-jRcg{WNYXL@=xtKOlH0tV8}BvzZ_uM>xV)
za)#UNsV?4aTZvq)k7UlS0tROuM5-3S37SYYAImxZp^tY$5b$$>K!9+}GBrU~`KK_+
z95|2;B4HD_*N#Rm!jH;EVSO@Mh1D-c7c*Y~l|Gf*%zwx1l-KaF5c;~;3j8XQ${B;o
zd4}0_pk$M*1}{?fw@7#UdGR%Rm$!W3<jIb*UGLW%RWL{7>9aGaGV{xUh?K&Vk2)*4
zx;+NqVHu=y-X_p(!HW@<x_Rp!)vRY#49T5)H5sEl$6W`ts@qX}U1V^Ec^-jWxG2k@
zx<wNqMaCR8HIa9Wg%?RF8Bl~Rax)nC3Y%~Oe%;vloUtdWQV+hgh!uNW4~rb<*XgO*
zVT}=N@DO>B!$roE`o+4_B7SeJB+boUK1XP8)cjy_QfJi~u8(&>M%}VdHLLwuk%@5S
zMJuOn!<9|mk=}Tu+fd|AfV@I{^$EwLkGx#8NFsESF+s|l2bE!!Eq_d-pW1W5dY@Yo
zO2>dOf#0)~ZE`{|R>3PAvvGVd2x4e=51=hUdb#!gCjyT^0k*f)23F9FX1g{=Ky16Y
z*E>HTm%x=4IjgvG(du$h?`1wPIaW?5Eccr|Eso7SoseE!*U2AOocmAB)>H&CN&5VS
zCD?v$>{oKDUh*;4ie*Z|QO@MPkfgqg<D_=}weVKB?L_i_Ikw1~#1EKkJYox^Te`YG
zv>bO2CiA&eUq$&$Xxs?icYs7xF$6OO5_~~2>I`qPpw!SolACZ>ciYC5%9s07EbpYl
ziT~VD20k)4;?93xPk$#EgsiqBcp3Fq{N*apYPQOJWL6pE%FfCfsTPYCK>Los^>{U1
z5InX)?ldl0;jU@DO@InaKHZH8{lsr@yh7f;JDGR$0XK*2eFn57lhNwL&q_q94pTa}
zpj<um!}41{P36HY(t<+E>F^>gHcDr;T1P0&;(MG=>Ut#4a(q*$8civE?w`Vhq{PdG
zh3nixOrmW}L85osmk)vf4>om5p(_fBqb(6BgnW22%)9Jzij;(fkF3V{&34DP#Rvgm
zq3n~igu3zf2kr{g-|@wPyqr1b^rgRQwEL2@x^}F5dyNYA0d)#jM>My{?K-I9<}m-R
z?hAC>XR*fqBXA~xG*tFI*$_U9(tRfi^pae1Q&@fuOr>+df*fty9CORHpU6W+69g6`
zZq~do%<K;|-&V{^hUyn)LpRBsHd*RF7VZ$BxDDXv1Jpa8`zuO0&5-`lEr~EgTElX6
zSDlJIos}&{HEK4hOk{ix%A%0er1k9=nCH<EW;VC(<b8b9IGSTwo><dJ7<t?IL<s5B
zVR7CALc}&MzI3u>&*DxrId9b676FrThg0tk7YqkjRXcg(BfcD&wj@dUuECJ8JWQW%
ztNVk~lr&cz?>T+r?TWCqi~{m*r{&neTiK)mWs#Wf>d1|6QC@oVj|oNCg$i%7UpKp{
z*;}6tS_-YV2Oo--wh-ugI8#UmULV~AxS-02Q3plifR`Br2%Xmkfm^6VsS+ZZH-zfq
z;<5bUVjK_^Y0>hg@D9z`%>1=SkrDYN&feAExynJ?=p(%u232c4k!4(%rJ*PKn&A%O
z<~g{_V%#J#-XVO>>aGhv_pyfKn;E||rJTf6_gd)%@ROeTNtQ{3X}X>=OAE(?82~-E
zd-t#I9GzK)<@X3wC{U4WLOqTBBh*#D^{IvdCY&~ZC+!_<+rS~Fs-LPjol@Et|JFv8
zXOMgnEmfAy1r5=9VnNeKlF#cJLWf2U56ZKEe)f@+&{K>Q%hf7m22D!qL05Htjv=7f
zNACS+#o!6b#-jI`MZ*J!$RUwm{uvOgif5A*OIT2oRc_)*_+bqYxVmpVjKF58C-b{6
z#`EU`knn+JR%T`^L&y^yT0oJHo!Ej2x0}Z}@=5Qo(tZ_cg(wnw)8EZq=6wf_kBfTg
zMQ{xdo-TJw@9uW9DN&1YHl@kcM|@kcRJR6lbB|45hm*EheBNQ^bd8Wv)SVb%F^pG!
zovfMhf&5?gbjRcVc)O#`H5BP^<XTX{DrETEops~fYpL8RgW1qT?B8ZQ1i==66!s}%
zE<bHWf7osh6NJ1^<3WlvkM)e(fR1S84=L=Bbx!zJIX56g>@pC01np4s9scBSlxS{Y
z+~yNWY}~e^i8j>nel><YJw=sy=N057UR#KGmz`6B>JEOj<9CrB%q{yihY&&*IR4+q
zR^n`l7-Ep{6s-197jt+Djz)5V>|Tjt%pPq+VT6L@Doe|5SpG8z*t>jzs8~_3z~*LQ
zWit2OfZ)ilOEdtm3ZnB2TrCST0=+T``Bm-G3nslmm-zoT9RQ@`EnHOBf0O(bNi|KU
z{w^Yg)d`8K4+ZFGt^SGU;H95R>2;7m<m6qDrs5HL@FCk37e9Lsgs#!MZJ+X!&WO(Y
zsb_CVVQE+Bh2Z18kd$MRu21i#oz4))bo{B?Fh0Y?lzsj9q&G1J#n5-3?lT(<sfQq;
z3DrpilUcIG?uuj)sRP*LESZfhHq?#MeYUntz;!J5#fqfjGkltIlNIIrVgW0*kKGq6
zItg_X-FlnmuLqB4Vge?c+rp<Ej(>lTah>7=n^m&QMIq<k<#eS;pa<nTV6BYm_T@YM
zy)+)p!(%BU79!G$6(%O!)0H`rmo;nqO2hOqHo|=bGsZMXZFxOzjflv^L92<?y?#&8
z=1cl}>~h)Axm>G8LdO)N)*^O46*uGT+$9H{N5yj*!hO3B;<oe6#Bc}q)ILkiH^LlN
zJwC$H*#DkzTy(F@NxTMNR+k)2ciniYU-;y3rQLc<nO%82Q(gfU62jy0M8ac>?`0vl
zw%d(ooDv$J=kMa{QCMmNSPs#DsK9%@B<UzHHB^d(=p>UwrNkyQPmlgi6SOSWv=JjT
zH%w-~vgPRrRJ%Z5LF#6{<I8x(3T!>QK(Kx8b926&a63^QGkckV)PU$>3k)Gz#U!aF
zABIH|i9;TDYGocOKF>_Z>$&<<pu2wYnAYXLYGQ`(6%Dwy2=xuPId6y2ZX2=>K2G2^
zk0k(+dk8`#kB6A&WQZ-bQUp-23E3=}*P^6*_9{2>5Vx5nfe^#ppvMH0SkcVA)E@}l
z?7!ob=(m3-0Y~#)-fFvdo#Pyb=MW&jq;vZ}I>WTKIx|!SeHqXK<aqW!G^NITj9XbZ
zb*>6-dxQD$4E-rO&e&3F8dAGaL3n^`;9hS`sAG5&ppVzbj?5=B?U2$Ie$q(C4iCx|
z?fFRM^nU)c8Wrf#e2U9F(dxJ#6wuW$$R1xYKNF#{U*LQ9-WD627CPJ{wOEertsYvA
zHO@9Nvhh^s;BjxYve4_JkZFFQY_Wgvegcj26>4oQo71ZU{_ptzP*I)TLY`&pmTrR`
zw9GmY;8A=I%cKYZt!@DB?Q*@wa-CL(!@7g;69!=AF@AN*Ock*wuHQtOH|dY#KS2=@
zHHtD>hLcH%OI57FY7L3fiK^H?r~I_bZ)@jT+_Pd8aeU8K-n^x(?B3=x<w$3MDT<6#
z`Gpo|659yW%-j<blE30nx2~imt5C-<;FHtq_#$WBdd?|D+KJz>ri@M}0f1QCnFNHy
zLF2A<ou<RLeNBy$r8(F$3*Vb-J`Gb|=>75n&@1NL%j;EO<P7NwHa?%g*Ex<w`|uV1
z5<}Hrp|gw$6=c*Q+IC+_A-Q`5uXTsS`}C(<7c@&5qWZy=@&2UO9rXxy05t;830j`l
z<}7yer8r1WS@`|&oBtXtM~yFK3k~Mb!~+Qt{@fHZyVeVX{#s*XHB(izMHE4B`_{cA
zH9zf8q!Vl&lTx#D$zKN{)(5ZGH7$1QmM|m7tr;5I*43gG{wF^@KJK=pvv{JkEi=Y^
zz^9v}rCt4uv3OAaQ`Fkz*r8<UM0~HY?J+o7@uO5I)i*UHiuRPB_O}!BOVietZ=~W-
zD{c8suxT3GGE+#eCulWzzU%7kM?0-zOSbwDS3QkT^8I4}y>MIOf@n)90fj}K{axn9
zJXngPrdmhqfIba<n;>*$LCE<gSw~+c{w6ez7Wjw5Y;al{9IBhyNFNkn`FR#EU;mHL
zaFsBd4Hf6Hb9$?ZNIe-idDgb27rDE{f1zt4t}bEk)qC4Y|0ob5^qY?U0b#C%3Xek4
zecX~p`kAq#r~7u2Jnf5#`<Koc&!8<Ll$@mMNioZ;ot;Z2-p~w#kxHoCG0SGxh`Tt&
z2H%7ogOF{v009@DsCm-=JyFa$R!uks?Ii}|e*q2WAjUC$>=Uv8e`%uv&yZC%tTpc;
zp1}+-;kwd+sJ%jl;2UL}cv(npD%NW;I)scq`mx1qL9SbLbM}XzJj=novOkJUpIF6m
z_rPA%VMnJw@<b=%T5056eIz|@!A~SUk{IwH?a280K(Q7ODM%0cS^WkWhHeK={#xe~
z5?lZs-q(1PnvIdIStCPC@t+1D$1N(#1a7oXIjYRjO(l%rYxFo8jBK$&>Ifc`;a(vz
z!$wh8u)?WtA3wq7imEdYoE})VYIUusuCoG`G_$J)HMG`#9pCNa0m23>?p_H52<!bL
zROLaIrw>VNDMrSq*>+>AC}`gz>|~$<GTD_GD66VsW%J>a_h2OnQ)FmNi+Jx8GiGUI
zwO)HEWB$7fsS4<Z8_VKxUnY@5YthbL{ZH=kO3{60i6+QqA{lx1H@?mz-lpBjE;GlP
zWo_*gfDiq9(<P#YqPh89wR~)m26i3<h<)63Pjy;SVI{Q)@OO_2-KETRJ6@8z#-wuu
z|4lXQ#r;37&H^aPsD1mONJuJ(QX(LN%1U=hi+~G?bcoX39ZIJlC`j$n-Q7q@vmm{6
z_YzCjeuww}eledj&N!noaGrh6x$o=#UDtV28Bm(T;{Rroptkz2b6)<pnNzddU%_U)
zMjqM}RPA6T#<`YDh9)Ql>Y%L`4U9N22jWQM`ph>Y)6{#}tDK4F^9)1l_nLynd%bE@
zbyZRIE2f8csYPs*2j`uLEs7H<sn_zH<phoi9uTLDQJ#-beTI|ybNlXSn&ih<8Ch{g
zpwdb5xZ8J9LN=*zzH0gMo*Xk{1~XR4GALuAWu>19^caPu8sC7^>1JW^9*B(vHhX=V
zk1g?O5qp0+Am6tMB(IPcC6;7cQAhq=xnvcH)w;QG-C&JT^7BG{y`C~6=TOZ4ivC~9
zMdZQEX&2{a=sUSOcXh%x$wMMPQn#l;km&)p3x>QO^i^sIv4Y0y^>bq|P0pUoB*>f@
z=XR|0h%FUvV@Q*_IU@h_O%Pk(Bek{g(|km2LuR3hVe%P?&M*0mTjYl0^^=Zt$z8HQ
z6W&NMD*0T|@W@|;cfKgVBtUZAT~demfvzY+9z(m<K7rLTxp_t6ST_>)^^~utB!Ex{
z=eXO)h@b*E5#MVIu1<nBsmz0ZcpquOmA9x4euP&Vt2*rXd?sLtXO_(bCtl_NnHkT)
zkyf+GFWoe+$IqXLlUX!E@z;so^Z5VkV)=<s>kwQvNh;@W*b<)Jarv9tA)9V@#V|_7
zb)M|%d4lSEJY1;&AeXI??(Xi~nG}iJSQGUwyVq9%7led_2ZWStI)_Wp@@%C<n7(q<
z`t^OV{8_Z#8rk229D}_@nLC)b#%(mJJY~2XH(n2Y6ZJS*-5Hpw6lMp%&R>~@j202b
z$;V{<bvWAWo4TvTF)t-@pjo-i)R9?jFhU-<>6!uhDm<AJOxqD|`m{L1cQXOuHzhVa
zo&0Hfowi|Vm>24u+fki)Qg$<>oBRR)zzhpYB${GK=hwA6##byZl0)7~vNM(Jwz~K2
z_W2QNv|KiV4NZD|J~h2-+~<idRN23<;Q$Zp-pj{cr{9EkA5pbEu%2x&La#y+t1UGv
z&HE?z_1QH_I7)Sq&CRwT%iu<DtZ?m~p2PeWK8e&Q6kM$zh$@<Khv=7bd2gK*6?mv0
zCU;Z(L;do|m?8Mt9BYBz6Jn}i8Sc(<EEh_w$MH4ZT0@#Nv5u2b%fheGPN7@sCYcNs
z<vVW_H1kuuj{STLbCafh5Vt9KPj07=V*RNKGuyELHu#__qlVNoknVAJPI81^QGm(|
zbF*c+bY2tU#}5|ceWyCOnYVwCCt=p@85qbv$f^Hk>bJxRbTAGOS@K1oN)U$?r&q{l
z+_%r+uH(toN4qY*%&;GUhhR+rvR6Il+^epy<at!d|By|G0{!^rNy;k#8@G0aDQdkQ
zMO*uMCGYu%tcb_luYCJBo*9~qiyTjYq>$rBYx*ub$fI8NW-sBTi_$O6$V50i>J_sf
zYQ_t7Nz*_jIBe~gQ!BWv1i3@ZS29@=k=4fcwceOehZwfXty+C2!+A=x{F2s<hJtwe
zF-Jj%N1Kk7Uz|%w0wOQ@XfHlzWrf4jI@JChmiE}CrhvvvmleDIq`L*8cx{R4+{Eit
zPx-tbhwSPGvoYP`SI2gyPcQ#~V^x}bM+@{aHVp+-X|bJ5TX!!gd0q`Fqj~1|`TiBm
zh>oQlt9=1ChMCb+*1HuHuhza|O^CFersF%X8d0K&@Zo#yRxdp8(Q1K(AeDtk^I$k|
zQ1gj}cmEwTVdW|J9T#>Un`*<tBuy-lVeX+z^LyfK?<-V<oB1DzqW`uc>$7YJN6AQp
z%>J;KH^GI@^0BX=;cPUAIlq#<z#OCh>L|Oo(`Tqu>O$k_<~YvLqIG}MIVC$Q;xZ7~
zjN#ilZSuN5LuWde(z3VErss8bwxWP>Lrt<wRa?ZZKW2V8&^ML5RZj3QA@!DPRYXo>
z_$?W%ad0<Da6b=%(^agEi|nU$O0WY%CrkK8QHJs9=KD!hh?g-Igm%veio((o6YGQw
zMN>uKxN1;SRqbFCOl&km$+n~?DyPsqsq~3eIV}uq{tClq&Tc}ik@uPE?=M*4hFJ>a
z)t0=&L(#Z#Yy|y$2yqKOHLU9DTw0>aeBO#LC&)L@cqbyg1AY7zDLExv-f*d(%PqaL
z9zIV^L1!MR{XUstY@LWJS5S3;jRWlGZgeTmNk<D(*$yPwZh>{@ZGNl_eFH^jHxQWU
zbr_iR{B`b^!X-Vws-7ghUYiXM51%NCzgaFxS|`J`+?Y<xT9e29nR{_UPMeoo=N1py
zFVThkdbu$%G3%(O^e75s@`LBy-#+)f(F&jbW}p{JhJ7=t%rGrCHA`P7XI#U69r~xT
zFoXeR{vn-T>SJYLSSwq+oJk<DX;r@t-CmgKY_V$~5<g)*E`Oc~Plf?4F?sKV0NcaQ
z)O{fBlgzx*`^eg7TCziyZ`@Si^><;Zi}a!QF8tpfBI*K2fGNA1<#0G9EX7o?I(BN3
zm+*B$^;C4#pdhpUMTx%!BP+iYvUgCU{t<+|7|kV$u9ufVD2L-INKT~7oiux6Rub}y
z-zX_Xbe>y`bk&{AxeQ!byaPz@VyX8{#rif1fHfE|7az>bPcUqJR>z*y`-*P=1nv+>
zA}BaSCoj84=T7;S(3J!$#nk2QM!E`Y-t6^t2(4WpQ=-tD@@d?5Q!_8gy^6$a1M*-w
zg<uK6R31M=w1ToOep0|&Zmp!2G%a=~7^JTQ+f}X4-b_Nlg(y_eZ<&0N_0-=}E}dxZ
zJ<kDw+pBhVqLj<Gdjz~E=8VdInWo*9_tTB>4;Yxg+h(Yw^;9sM^65}OzMD&Iahp^N
zdsExSLFBc4DMh7{Fk8H=<Al;XOH{tLxTTG|+t^uFn%aux?lLnoL#IOc;trFQ_g6R5
zx!*PBr2(7Qxxcp%>thOnh38UuP?$iGQsUVDb=vU`QYl`bNG=k!f6WM1hB1C)xPF}f
zLsJn@Q`3Z7&1M@W)t6+OFBi*0P;dUVtj_VleWo<ZaV7lp9AW~q!AURK&8>>2jjG@_
zxx?RCJ~;EM^oHB3rJc@=0<7@=z-gYCJbkNF=VKy8wCBWVl@8Q2y|$?crhG(TweVPm
z(1_{M7pr%tRIQxO#W<38&Q(d2VW5dDr$x>2Ya%nLu#5+j&WMQ00|(VakP#cazUwz?
z+5#F?`UNp9A&Z)-(%3X;a;mM&pX`CbyDBEEFy6&V0{Wc~Can6qgEQ;^$Y97><!C*Z
za;`Dlu{1k^;uklr_Hd?)7wP7!t$6BQogc9%J(_BsBlv}O0=u`g{l7Y=e9~EumqU$F
zwZ{oBv!RK<RpZUe{v?yb7_ksrSp65+SXA7KghRT-J+f>+Ge7k+tuv*(s&Tv5)XDYi
z$bVovYURs7c#OsBr#C2^H%On^=hGc|W0axjFM>+}ppt66)cXL<IropfSp_1AF+Nu}
zk}y;itJ{xPE{kq)1vk)yRmhN91*Yj9vB2Cyrhel9&EaS?z_tX-JJ6eZTSSG*VyVTT
zxEmRz#2u%_-SLVl((zX}39g)FAsQk3j$7zVV$Tc3XMb$h(#tNE7^{{``k_Bp_abbF
zp8g*vHoG+=C}^XD82s><p`xjsAuNZ<Ty{EYYQ|~8(S|j{#vt000Q>7-ZVE+e-9!8E
zoGpUdD$Vc=7#UUtvL9u;jDT|#v9#YS85<|xWI{Mej9@i!?p?p0%WJhYCv+Pbp<K*4
z^*6U-$kCd38dX8}A}^jHj8DsHaPQw=WjD6o{2x`X>2?y>v_h|`1X3=O*3jN6Ua%-=
zGD9TUi-aAoRjOO#*iM1oS_cGotls+s!zj~7$x`wiBwan{#EP3PB_*4LvYmGjVpm_U
z9TdoL?4r=S9;ip22l64P0L5x+T_C2n{rtHpf){+t<vYtbIhUNwE;+IVne5zA1dCb`
zG#Df20u9d%0GDFycMZxVbi}d!yIPp?_a-oUwqn>T(CCSeupkT&lG1hlMx+@#ie|f`
z{LHVSgGYO$x=Q%~S0!xNN5bQM4x~LE7EzZ*Bq5gZHR7(Wutpg!7^=yXTgGNy+#91@
zEWdrLk_<9(r3^Dr+#)*C5-C4b8FCHuMt;^32`e=*Rr6sTp`tePUR9gIJgTss*+fI<
zpr7748?G_Ie2#Oay@Wxb^@AuQE2~L-vmcD-pVcvONd+Zc9w!z*t9vLP*1t9h>s>I%
zKPI^1b%FdgKD#|Wt4jZo=eZbzxjOIxSjrVZaF(fX&-}ru`vo-FhA5m9+{XCKtSYkC
z`vfb(lWafh?{a@4GwxngOc*CWpvAuhPCSyYn?#KbcPRSrzl;)<;?HkM&}ZT(f=Dxc
ztE>r5h?FmI5`5f)wUSCOYg_R{R+E`#RHy#sQe}WZWaVXreKFe!Q6o40I8|Lbol_^2
z5XSI?j>5~F5aK5!g`Yma;hP{;;AKuSdXY2g+|AwY6qssp@0%{HEU#SZ^sfawujTJ~
z43@rIN9IF4TfNU0uR(M0H1_;xOW%8v89d{_FgYFDj+O3-(&g6)o#m8nv!qy{W02eS
z_s?OGj>mn=sf;s%D$>YfahxFq6BF0KGAO=?&lkbpI?yhAJ`~wvxXLjuw%OSCwRCgQ
z)D>Y;HBqV84i+cB<v|0{XtjTUoeJY<MM|2SxJ?B#NEDsv{v3F>F!^JgQ93EaEY0K6
zuHwpR-a8sE9#X6k9*Y<p8mC-zm$XV|pgwy7zhmqa_~}f}%PQ4M*#uDM<w9-Byg`)K
z>YkFj;W0&l8i885+(f!ztUAfLBa3x!mweF(I)M~@L-^HEbuA6QwN|tD(qE;-gM;G=
ztEnuRuvM$63bCxMAz(Tnak0YGVqio1o>ZF98%g5rsy=^&C&n*w^cb9Hd{+N5!2Zrc
zyzSF77(>HjN;YQB-Y^fWm>!&Eue`Xg>ObbIDMV1kQ}rkE+8{IR00m3KYfiDh!x1TZ
zFwZ~S4B&DPL;B9sow^s{{E=}nSo7})6aL=TBa<mj7H09~XO$b2Q|5Vc!c+nyi#jfQ
zTL@h@b`i)s@-Kt3%Irm)yGzcW<>^3k+ym!V{>;bRF3kZT>Ci!B9W4{<8fgxT;aQ}H
zc2}_gR@n#5_7ih+MzQOrA+AsfDJAkFD$5cRR@rTG<QsH@P_&R#o2iZo*h#MMQ4|UT
z0nR4f8HTYa^71bdTt<QoznISU%HT*5A9Hfrw%~2JJKG44xIQ=<pVO*zkC@{c*Y!Ax
z;MaRNHvCzr!p7y=Z7uxFUZ>_}TmUw|N{jJA-Fnpc-0Ju1#onJkfBvYRb=+;<E%=pe
zb-F(wM>|`uj?ni>q-jxyCh;&Ertzj=LQInEkb^BOK^MN6xWv>VSIb}GbnUEg=!6Aq
z*DNU$de2Q)LrOOqn~!xPQIilhdUTlpp`%s-@B8$)4uXV2xP{foasSh_YdoWnI>fCW
zK|kL5;mBGZQ|+XsHMie77u)2Rt}=JGdJU2<<$cPd(*z^tnC1f;$Ii5rZ}JHAzT+oc
zQw~MZHOdM6p$OY?rK2HileaZmJAO7kd%^douF}um5T<tAThEpX@8giOJY||>S8Ma%
z8xWS|vl!zki1Y-;7nd2Yx!KFhd5|J(GNQd3Ubpdgi{4|orB89Vw{%?J#fgZ#6^NO<
z*3&r#ez-C+GQ!T=({)xJdU|>VYI;tBtH09|`OMxcm)L*>ck?*5L{<n6iTbvYZjF=~
zg+<WtL$sS1z32X=desAk6i`N>pb(qal8uh?4|@LX>Dp{glAZQwE+BEQ1L8mve7!_E
z>|j35cR9kVu76Kc(zKOSeBgYcQxnT}k-!V?aoo)$OmA>Ki5?KWm{FncOSn=<I#)X?
zWrjz&`Snd=*`QF6qJ1Kn{^Yw^KeTT}zx0Lwx)ohjqqa%FE0#J>#Wl`YQWaGzIy<d0
z5`9Ay&4$Nn>kC2V8Uq_7z%E3%KjQ+d9a^EW4H7LZj^%{g<Oj}`Fy%d>Z&q>3RExTw
z<f*5X4!B;+p!ai4BZODDX(jS!RESZJ_5zb5)cQnTtKePuduttnZvk<Oe#dDpRzxaQ
z^ojW<Q7Jg1rIAy;K*>wvH_iBUky%^CqqRnVZqZw{WBwat63y@$Krnsf>|&>La{X~W
zH=QIz>vFV)oycZrV<z8ZPOQ-<9&Mq~cpw0V#F64n&}@(bHj(NDUel2~2ZVRkinYq!
z`xDLxDV5^6tTxJ40xe*IU(DUL>bj#5Vwit`2WwmB`SQ0qhMPP5_#d6i+{MMN4|UP;
zPvAroJIkoD(yBHcYLG!2BR#6G&rDhX_$BT<txot5LXzHzg=IS&F|KbrE6DIr8_<u<
z*3{2=uR;GXAh_1oCPcScN%4SAqt0>iiuCfN6K)(-d5sZ0+8!|*9zEtp2zZ@tWIJ!z
ztFAGT#9ddop<_oa#=g^>98K*uJ+!~tfA%gYH}w0IE2&oST1}z9*EQJssa835eNOj1
zc6}&X)Z3FXdt>M9)|$Z;M!an+7sne9#;*myC!m+$3Re_8LJqE?5rm21I`sBq()>B1
zo_M^>fUc9L?@xPrwqgYhwsVL7=?u%l3>Ap`Lvtb+szsZo7T0iaF&~eJGNni;=`$1)
zXP)Opv|OhiHcI4&WI`Wps01Ia^V;VreLn5{JI(zxXm9~(QDiyW5Px=X^XB9i2VE`B
z1Al_omX*tm87#0D?liV%OWq2))dt`oi`<<O&Ug_2q5hb&lh&(`Qx5Jipb5x{Kj%j@
zHx|LOhx#+M4kmkeVWA|4j|Yb{xYv?B)No=NQl;LZrn0NMqi?h#G@@DRmGhfUk~m$V
z#RdliUoA@>uw((=tM;O3O07uiYN!()@Ud|i;9vlY56~$nXduFD4KlEZW42>}8SWQl
zz6w*mc6HIw<|v`d6$p-S8~l?Ecc(=lnYAiRXVYZR<k0ntxgZpcsPS|ddt;qJ+utaC
z3hhO&-+5y-g%uKn`?S?}?pzS*Cy`Bx*-Vry0H@a*C~2|-vdU{^bUdK``gFfLJN?GT
zG}{=CYgohYAlvutb_f5QyPSc+0)!vayT=47mFbN^sn}u-s`2k1t)isXC&~1P4hZ}h
zUEciW4`y0tJl7iK#@VBlq?Cb^S!A!h%WAKZJR(r3;2lbg+%(xVr!d+4nqC-2IVJ=r
za};Cv)Svbq$~sP|b$yR#=!oE(#bYbp9vFj*v?x#v5iDRXM#e*(*2O~f;HsQ7!Y7B$
znSt>HtCZxJROR^Png2Hxm-pt5tnfkpz>g-uPOo|9e$2{XC065j1XiWSdbMsI{~Q9=
zIGd)u`gF12Cp3<y>r03}I>=}@K?+!Z?xtiBrvr6xyxMqw$&*XuE3~0;L;vgW5x-uS
zYEkeObZ%G>f>KY2`;LDkrgJY_hz64_4HcDpC4ct4E<8ccc?Wapy++5>maIzmue2?l
zRJ_FODzv8Q@p;}$b{g?x2PZW;VyeZ<Q~h!Mi_w}P?8zrtdX4V<IxhVP@qU4Q|0d4u
z_Z+_*e&_YnC|yes{#`l_<NQLb{%BH6{A8P3u}lK%^y)-BW@l_2As4hiQSvV6@%?7l
zn`sY>)GFr3TP3ANu-z{q;pX3j`OB4G%+IE-nVA%keqFu#iegaZb&+fcf%vpCgni|K
z;#lHmLiSMAIP8%J6;mcz5<@WIZ|Tg^2!<h7l6m@gxx8)>h>FMeyY<ydO>*yq#nn~^
z^(xq8(85>&noVQ@A}y00RWYMq<EA{G|H_8^)XSyLWQ(nLdh>Gfr<(8-qbXENV`+Qf
zuO=Kbh{Gp&dc8!=rg@v@EVj6cx!+!QgN@8FCtORQ*Rnd%TPv6n$tF03S9GRHo+B~z
zDFZusNDBh{b;+u=e)kQ&)kcNqiBsiUd{E1{>YRKbemKC+>bhKtkwH5lnoT#!9^0K7
z1S;qO&^3NeiJOP@){UriVO8CCy<d;jd<fQ%kT6VfOsyK+nT&f(T1|Qz@3;4II#i7C
zbnBP8j*!v68nMRox~V(~KU|<GocxpVaRD0}&(@HA&tMCC^J#&Rr%NmY)w=y3B}^Tv
z)&#Doq(p2%4DgYp)1$a?%-m?{&hOZ_!ipb1Pd~$?1la!F0p>57u@`bxh#+F&4qJKj
zNX5V3*E>Y$0AWW{dhpCtRaJF7CqLFZ?{Mi{Z<hz&V7GS?5!uO?IFn>xmbnC62=<bt
zFfxz8KQs5E4yd9kn5#YFqvfp_o*)JjC7Jrm1h8N;oL2JGZh=_#$qb3(?l6WqX<G-?
zg0?)C!$hibE9~7S;UX)QCClmLlPO>5x-&8xc!_D4HO-S5%HFQrl^OzK43P@DG?cez
zrGYlm#LHVMCepl`ZsM^KQ<8;?Q5C;qNmYebpSNG-I#nogD<K5TGhS=Opgo2_g?5lD
zSh1W>G(Tmn>hP%fT&gJlqonI`yvc9GZ@9;GCY`Y4v?^5}IHP<n&5q$d*K`MPVj4bB
zeek<lQBhG9H=i#8_qATStQt>atK;tM&N$p>4;>sDN}?Dq)NlJS8z#h4P>h;LZCqH=
zh%44O>!kNF!~Fd9>kKso0>(DOz!x#_s;37N+OzBW=W8$rHN~;jL4eXmiqk%@&NG&j
z4cv-P;wiykV6IQgei<4YH|<>xuO)dI_tj-8cLzQ1?zH;#sDf;@1~6HP9Co1#32ifL
zPWJZScc(fHyVKHc!@ZAXG+q|t@L5jO*kHWd0;V=L|15Q8DJ6m{;GeYxY>gMsm9N>^
z?LeI*>XeknLZSE?+VAUKf>P_Lm&vqPxm&0Q5A+V-D`ctEA6`C4zNwrG;C)>!f{EFh
zB&&yHX3JE!o<NMF)1Y1N@3Y(Bj6)1(Q&M<O8ou#&-ub97NeX5X6+fv&T&G&Oal+jE
zCRkKOrI^#4*TT+bTCGXCs|Q#=+-DkS=lKyq$SZd|bbX=t*t5#}h)t_?lNql3`2G9(
zO{%)JutoYZ?toqL{l4f5)YDbLW@@X#s!`|SszFic9Sj-VZh}R6hrwx`iN#`}C)mEj
ze`n47qm-$4u{tnA3?mxIuJ~bG+kNZmx3G4mDlZO~PU@U@?#EObQ1e^!xGmNI1JOae
ziM}dE=sc_x9C=mU?zqW3PYQNLPjrUQwodoSD|WyL{d}=J@^cf^+{nb|asgPot3pnb
zKix-&qML!`o>TLew5&TWmZRw$YKe4CNg-@g)oUfw1apcmb{!#qw#>o2Q&afDkFu4%
zI(-&1xJSIYfI^oe#M<_-bz`1EyV+UsEmnTD)j4eu!-GGV8TmgRZaQ;bNb8WJo18RU
z03{I&%qLu3a)svKg&%$JMiGBrla6CpM>aMvZn{f$u;9SmC5Li33RoPGP9FoldP)M#
z;F#bJv4Hs&fn5cb^6GOytZPT%?)3)w?rw1xK-ysptY?Au0~B$0)RK0(Dg(CdZ;c6r
zIt9L!zCF&C7oW;+DDnMUesusP4PbkxK4Fx@CxEoFOi9MGUVg~BNu+XEzoj9zWGn1X
z?)N>mDcLRXj}Ni3aM)-M!?s=0##Nd)hIWBld`Uu0ZFM>1%hC^Gp^WTo@q;-$>xKo)
zh`3TRpD4deQ1@FQXHy%2Ok0j53S`yQLMJ?LM^iIC<{5}96uBI{GD+U>@S$j;6UUmW
ziWImkxzUjev>7)xHh9eqy#!Z3T)s}|%26+#y-1%8moMfB5mM|Hv?doeWf)jGMu=nh
zJQv^8TwL-jUC4-^IaZvRzl=F3D;p%l#(JHgnQLen&-o>5A-eOihoX+hd%6~Gr%V`G
z33PoHp5^MN)lV)B3hoere2K~60vWv9XZ|U<EF++$P9lz~`Y|;x>m{06Ri%7L;03%e
zKPQo%VUlB%w_xOiXAX{)0aZyf0>Zilki+*cbfCf7QP8e(x@&`<5@uUO-z=0XSs*fa
z%e|i~lxGe0Ma}Jqzfn(68JwB(HTZf-s%)XnWy-nlRcKAHQ9?$n<#+5=2e`fvf6{XZ
zMmV-`ALfhWK+)+hXEk>!)ZzXm0D?W*8t2zJt>0C`+}0!z**|3}^?DQ%8}ztN--CS`
z%)Mxe3{LmJS#!gKblS}*#a@D*9t`x9r|5mQ7eMiDdg^p9DmwaLEV1}z=*K$la5Spk
zo+j+h#r02a*8Rg_vg0~XVt1-%?#Fy|d%DNLyzrmTG$UR0mrie^nv63s#6XdmMnx?!
z)a-_nC%(-BnG}HvU;@WnBs#?9*25pD@Ye}TUH!8zv@7}UAF<R3Fb16r?eN4E#MP;<
z4b>E7@Wy@43gk8HnLE^JFy%pC{+lkHdajpR7YwMW4h;K~O~SMi!j}4Uw#bnaERNh{
z5*{HBidYOGdb5ncc30T@qvGsAPC}%n3|@^=8f8#!wpG!jsSAQcK1?$|<Bko-AfU|W
z$<HmkvrbJ7%1caw5j{`XZzMz7yXusxaOGU?!=YIf&RlVv<f@OlUiT$q)(V9us^}&Y
z%N8Xt-YhyUJ0E}T$y8d5x?dEkj~<hXU$)y41D6UQwimMD=BItHcPPpMQuJa$kQMx^
z^UsH!NaVY=&NfGsXM1Lx4(K0fgakLJsMK}sG;y|0mKN_lY`3)v5moHwvnCfaWw>5C
zzB%B%sY`;+#Kb{+MZEiv4xPC%Z1gf7=mF1^sA*m`0AQ=eS+*DCBXG0*wi(ScO0xc1
zjB>5M-9z1f@B?o>du24GpiOcTe@w)eVsiY2kgvO>?L~JVjSTt{A}yMl(ug1JJWh~D
zi83Yrs15e^6m!hB+z|mpUO~)2pfW%M-Bmr%>s&(8^WD{$*#dUg_1@E+Oliw-95am9
zs!c^HzQhlokF0Rz!D#4u_Rv|{c#0`-F!451rpS8rr=rY#--C&ITMoCX1&P!+y&Bwq
z@KPRzxh(&)=Uwg^ldOy0;n$Ctf4=i$2%LH#4?@CRrvxOabtou`0T8PiD2fSeW~V)6
zi;JI+?%fltv}is%?={$oX>CnA+5$JmA$&ngPbZ*kdEFu<<Xp4$UAsRnt}7RGB86J_
zJO^zTXMuPQ;?jdZU3t@jDyx&$!BJ7|*IwIC)g`_K4<<Io$JI1^mX~H@h-V53yXax4
z@Tg&FXlSU)u8(P%;flj5Rd%Adf$J4+Kk>a^e=hG3Dp4xP%L`UbaqgoOkEG*~y<!Z`
zZ=R;h46(V_`VX-D1bRCw^@<EzAec6g-0tCX8p?nv7eanA;{QjHeu3;{p|Bui;1HE?
zaD0A3l3hh6$6FkgPDlFyuDnl#tqPfC3&w?v!@SJykM<4HG(EAnvL&LDGOEq<>AHF?
zPMpe!PwiReV&LZ}ma0-gQFufo1A(WuPHxgm44rFu-EXDrPo#NOYk781bKIVU5p(s)
zSA+D&u}@U*9`VoBuFc}Ts@>l7nc+DoWq~DJq1g?*mZV6hvzvk!^NU#$Jo$Kej|#ZM
zVG7o#(`OsQCOMJ8uJhkKh~f3hs*dxGC*st$|DF?5SBn&&IU6JCZPyp%#w{i;fl9#P
z^KoV+PS>)=aD{wq>m_lmYkL5vCX|adYniILyM+G*UR$-;BNQ6U{3ML^7PsMR?Mpx2
za4rOH6?5vluJnxVZ^>hU_L5Jh%xO!_Zb!aSHjia_*oRQ?>023c|9>J9s*Mt_spC0A
zP4Kn)4;XcZC{#pK@B3{Lj3Oo3ebY3nLMlP`Wid$uHs>__P-D&>q@?2`Y53rn-W{x;
zF;A>G`zepmL|0s_(Ek+pcPj(f>d{DMb$Qw>YiSeg6oxL@d&8}^?K_k`T24-ZY~z)s
z&UkW}BUD@vX+o=_2NSPgb`#v;fKsv88?C7V5}zeu%DIRU4@-8{LbS*6YG)<Os*de-
z?J7v^Tq;PkZu06!R@UtAv%s1Tqr+g{2c=QPm9||2MQ$Lh<t<d>>ad(0b#bEmj5LK_
z<TL}Q8|<#}pv33j?t7^JJx1&O`}eP!);(hos}CuXT&_FHjV%rqHs%IEB_3|md~qEy
zu6Os$b^xe-)As0QJ?|B#7<OKRmR1=c(;~}^EbQz!vA!Brn$6UyvprtD?myg>_2G2h
z_-8~&`Dznn769o(9E|*n>iHU`D1ag|k?b-<V+4%`rAl{=Qgq`z=D;QAzPKfr_vU^Q
zGS$aY>G*7KIEZRC<@9Ww^I6zOF+drFEeLaCJ!ww)Bf=R55q639wn<J(3T|H6YZFTL
zuKTe<^CyrvaTTFYw(|DA%*qXb)Kw2udzZjh9)SQS-2!<)jo}LV&~>w~Z?*_@#Rp}<
z$Rp^ZHmisqg@sG=xA)q?Yl~G`Rm$8;E<%uV|I0t0)&~2bCCB!^Qjn5RaA`v~M=s>B
zd&M)5EtJipLPafPDu4msQo58o*e9fD0L()kzz5YY+ym2AO`^UXi%9*Ps*i7m*1Hf(
z9uWbdAEHzbT-n9SrbvdAncgKxy%4j1Ww?zmGN!uIwj0zMO^27<_nhAtf&`{<Jr^cx
z!HWWJqTRe(U+KM*crW|VJ&uU7i_;i{dXbJOXut#6IYib9xHJ51ug-~^`_B4zodSM)
zU%l(<>SBHVoIqps=ZC=Gj$cktGr$D-lo!T%$<xMS{=Me(?oK;$DF!MxUaXJF#fVbd
ze^l4AGgDk0V{bU^xuExKu>UoS%^^Pa0*Ias%Vqg{$Jd~p1~>8`I^mwz*Ld)TtJRmf
z--Z6!egu1-=~%(WSm6{Sis)&-!P{uN#HSuipIfP`Wn}Q4y-Tw1?nw1Aj`0$kW^?Oe
zXML2eBk~qk7F>|L6e(udbjjZQbbDiLwKyA*OYSD=3jCZo9|;x?fUa}nuU9F0nz~1o
zO#!hJ>p|lf*|9^(roeScL^UiQ#_3KJqTrNV?$F?S6?3by!zO;$Xw$04#f%F1yefV6
zwyNWiC-Mc=BWG`&+}PU)Ox1b67tEM^z+QeflDd~BRNxgTfO8l`XR*uSFI4XD{Bh}#
zb^T;lxMM*=<Z_p64b<aE9>1SX63wqU+TG3Rqo%}>7io9xCd>Z*_E)1`^(1$sCN|+E
z-^od$b*<Hiu+8s+LWQ{WI$Eb?0GHb?P1xzjD;8K7nZUUmZTFbma7orp{zVkCD5}vb
z+qImn{q}U8J}qvBpMB}-058<h%U8`$mp@REZaJC)=i<{XUN)d_c}+eTzeGa^KU%c~
z3FT~qWPywr=uu)Z0^Xcrvg@56%WgT;dKkMQOH3mhPxcI9@HWscQ3Onj8ELBFUe^Kg
zl8@}+*%=u`k43sN;QBtIxjE}!yQ6=}f)^6AD}@oXniwn*I~toxUmSr)ZBH8{kx@@H
zOXEjDgPBfnWzg?*r;C$snkk?tG56?$+5J}?!k_fM_hsP9$3%8Gwai&Z{_hv(YXeyA
zZ3d$^3H&@IX&e3D(AUy~Lmml!e|N$AOlZn<OkhVb1!3nxL>1pM`*UwDCO5=2TtH=s
zd~qF4ez%R<ODQMyxy&}zL2BTY6zvSUqm!HB=0D+N-jNvsQ8+Vf+J^+`A>J;}@x+@c
zZXsthyv*_Y>0?Sv5HMHg_TVIBWe|zrr0qhSo;PHf3+^Rm+|lzf@TKaSgT5zcRY^(L
za(Ol`^>aGm3Vu(vYZG|y$=8*UA}bB$!+EL5cs5)tgeWGu`?C}-ji{3JO~wXPd}(@K
z(}`!=v6l{{8g-^eikmgHx*u)I4#P8q6bb07<tzDH85iv?+9J!xigZoN4EMyucPc&*
z?Y_GNa+xA!7=NS3Q3IHs>$_fW0LANiZC5-fk@%HvmFIai_u@!()b@m#yF?xzvwvwz
zeJ=^3OQoJ4V)7lYO7B*s@O}lG!qEGoTcLk7Bh>1>AAWr_Gfm)HbjKRg0SrP4{FZ`%
z@C;^R)rtu_P#j&I@-@fzGbjAE@__A*1DLe}O3+}8BmpUzXkjv54-rA1G)U}?>-}Xs
z^<Jm;&)}t^7%0;ro~5T_6NebP)LANX{~WSat?1x2<#}rsU**X=C4TN<Dl<MJDfPC$
z+KV@({JntG*<?`cKHs?HTKa=Q6nT1qpz73&e#mAFSsEv`?{-3nPr)&8#v%H6+$YXs
zA=<?HotEB&lT>Zc7%d>uXZc(tcboXpH`x6J#ZG}CII^1ie(b`i?S{^t-H`!AAP>K6
z*1HS7(=6T~aw45);@0&`b4c~)fBicYV)OXN@;pz6vR9#bJU+VFvH#CANU*aw#SNbK
z61(I{cX<HTSLdoQ_$81{K7-7tO>u4$MX$3ClVVJBekHpjaks~=*CTXM!k5z~GOV16
zY&~_4iKKR82h$D~#~6VEiDG7l01rPHE{yc+@+Vd?hV{xj(*d8vQsa2Bd$L4`qoG|~
zoRcg#^OJPLv1vd$I3Utg3kiRfyejy#M;9V<aq3TbfLm%T7{P5rSqU+Bx+a!@G1N)@
z%WhS^=`M7Q=4YRb)#<z$eX^>GdOZJS61sID^z-}?k&*nANE=SXs#(GBmbb`TG{h2<
zG(1BfRcmP8Xz5cyW4}zi_yqROY2G)3egoE>C33A;V&|i?4R*E{JUU!G1a^w+Lv8C<
z<5(bTiNb0lrN;#BV^CwbHC8wh#7O<_;70Hs#@u`E_m28gSu}g|<y$MBX_n#Ut64+N
zpoWHq=4;qPd(N0Cl1j^o63(JgC2&myua5n<$uBDmNs0NDPp1stZr3PPH5$D6xpdq}
zD#j(xaqHL(WCIQ|$ex5Hh<ozJPu4k2<rg>q`a{BFIq}D~`|9EZ)GBz)vqnC>!*!D)
zSWl$xSS+L$5q?977-|Nk0OeYOzL95m^dGmnYhe0#nMv>gPl4O@-@I`gU}Xq3VKw>n
z)lx;iS1dK{2Y+zomUEs~k9~<OVolk2LPY#zbuQXu-H6Se<PSNkMDGuq+%@9QRtb0Z
zE$@N>El>hwl^#a`goNmr^ek@T;9<{@q<(KuikWr636W8uVDBL{Md9@$oOLY3;0b~3
zH!T|MJWb+-Ca)|ERsP(QeFB5wEG6Q&%cJqyKm|%L<0<*10>BC-O6$?G%w<x=BpxGh
zxIUXa*l2qfFML8;DJooV42D&b-qTe(C*qeHR{YZ}a<rh9gNj<0W%zXu2U7ExDi`ZD
zHZ+K!M}=~BRl*@*acp3fL6%QoxBO3%*JX5B?cb*ir)UDD1+DolCj{2U=M-T@8`TKt
zW1bQTzrp8kH8m$M=uN#}=1~H3YGloFPy2C;2m>4I#KUnIZ3Zj3+p=p8EOkJ6NE&6_
zo&}4tNR+|2OJeQivf%7JL-@)LjY)^Cnf(}{yftS3G4;OY^>Z`WZ9g+n21FEgf1%yu
z$MfXK9yWN#yyZ7JB`b#SKxI`oSwHg^IJe|`gJicGk>%w+3>07$YUel#sY+W3A0H84
zo=qvx#F0?|L+W1i#~oSiAr;x9$Hv}zKrk4*tTXmIKUzeRlLHyduuMZnCZOAoRm2;E
zW^eOX_QI8yk?E+}CogJzcG$kMEO8qH;&aR|_J*MfP$=oy{@m(yQKNdlEu2W0x8Wb1
zR06Nn{g&x-ur9+#T@y8CF$>Xz9oaY?k%q#GA#~N<Rs2LD-qYTk#!2#$>(z+S`mxHs
z)9WB0qXo^>K3$6a;c|0qw;!i|+xOzUAXM6|WN7slCIv<~vl5N(ofX2OBqP(6Q3tFI
z-ajRtCm7jXj>$-D!DQEstQla!p}dJ3gqk|GqNxU|)e1CHg)FB85w7~*oa@=9>JwGd
zy^epqa@P#{htj(fRYjrkj?vseRK?6>`-Ru1oj*^f=&-N~#NP?`oQv>ln4VBA&NjAx
z7N$A-Q>L~-wAkxPUpWz<Hi~UxBvRp?b#Z-bekkmM*1LYFTs|KGNuP3XdGyNcH2k#Y
zUxoaam=5Rd392!Ve6=9=^WdO!cXzDQ(_w^?n8%2UT$TCgdn<m=o{kzjeTymL6Zs^L
zX5a7KVd&eT$5i@-bBQ+R+taM_t!+R5*d_XVwE3@h?)>IlQiNTCj~X$3?h!~HYeQ*9
zb8a@0ieI;zdj5TYmJ9)M&R_68^A_>vpb3(3#lf_yF}1aU#Cepy1ZwIbcH7~_pCcm3
zsAK7COTgXyfUdjyRSmFEh)Q*f8x9a9cDN&>c@jEqJ=s~2!Rq3c7G%NK0%h}#(Gvy>
zLQ%vZaKazmzT!!7msB-bm(^}4M)c$T>1X_HTpO`SU#E^!a$GP0it$1p{4!$>4B1a-
zv6@m7){68co7C@tw2M`<z&UYOzfsuJ%8lyNPL-@SjAVuU+zcjoyEjPJh79iYSy=pn
zsA7!@Y05t#u`@r8f;Cek$VRDvWMF%=$s4Hf7|^se$I=RR1U{>BZ{LP4_`v$-q82`h
zAuPr!LXf9GTfgD8mrWqO;5PIH^NT;&S5n?pH8mQ-qFi$<c4;b1O!;zYwwM+tUQt2P
z4{3j`>`}zzY4p`+ckYn0+-dyVCQ*;LI1x_OEFY{!q9#fmF4f5yxApHUzkh$w%mQyT
zT22l@;lCC@Q0moLx`_x&x(>UE<#uwr&Lh!2(va2LlnGkpo6p$e@QWZg8y1bvMK^DO
zhtUu`PI*2~UMEPJ($Krp+<$<lJMj15)v6c)N#NSoZl^$dweB582DG6Ti1(^gg$DED
zBa;mj;)%z4xZgljO@bLMuv7Dt$5Ms`OkN|6<C_5`R5^iyp9SADQF~%)@O6uax+k>~
z<6ZgWjYUw|D|c%a>IA*|ReN7Clj8w4KCYQzS(oDl9Xfaj*15B%b5QEcOTyXWZzDw!
zm+sP_m{zB5c1#5wcVOi2NQN4Yr9mm7MFlqO<=uYLEp0&gJbE?R-Z{BfzWWpx&X)M1
z^JM4C0qV%6`ARQwC1E#4z`$GK!Lw4YBG2e!4rasYXFId_@``m<8o@az^n&q8*mpWi
z<-&)u=qQjUOG<5zWQx2(T<*i{R(==BC9<jM={32Qn$2+CWAF?tJoOg{1X*s&-|>n~
zCGWj{xWaBI8>Yq`gdLUt6~!b2!Fq4S&?|!75K>Bp-JmnjTs3&&t-^bY%j~JuR$73)
zIxO|f6`(zT=VOLT{)6`1eXw#?N4r0YEr>M7nR9kgXe8}*yB9XWf+LZ>P&n=^pwds&
z$nd@C{pfjWL5O#Jp%^*I@%@fRd2|{0ZwW)qVa2_eJ2&<tl6(13;)UqU-oA&A`L-!y
zwo*Wk?GBI#zc?zcWy6^4sD~+&hDv^GBf>v_26~^1WaV_NCtG4gB_|hJVb)_1sH>A?
zhP5y+_miHku0N!m{0+O-;Rx>A{a_1t<BFGuLolb{P4}j&MhV%dBIwEgWp%Y*d&Jx@
zM6A&Ra4L)AX*ti+VpYK4H_Ia=EiG;Fid3v=3wEJsom)tIe!OAzx%<|izY&RwdTxuI
zo4gii=QWv2yP(RgF`3%HJSoEma;U=zxgd?~SJ|K49)68`f@5BK&I%+FC891YsnwwQ
z;>@E9pEw|?_*gLve44iE)S47uP<@2l7JENvmFv>@^{l&3b0xuqt#o9-l#+*IqqbhF
zpWPV$Sq(LDpxD3dg8kuy^6sNA#EyR^scj06#S8Qa+?Ew~Mp+o9YwU)bt}ZOjmIdzv
zx5DYR1ACy3<>)4_%Z!819#^N6IA!>KNfep&wCQ<96m9uKevjXCf2zI&U5j=Ab^6o_
zwF_!?qHEU(YE9tv$7yCPo(o~|zx)SsegOX@a{)*lzMxBiAGZJJGnm8E^oaZTc*>eU
zFH1I};QH#_rE%RwUDpje1>m13i|aM`oz=(*rTZkbtT3US#FJSJYXQr*kGD*cGiyI+
z^?EK<kDI!o&f@Y~J{Y_t_eMPSR%a-FdvJs0h)Nl!x#A}2i>79a2DKcV;Lbc?+BqjE
z&4v8Dlv@4cdPX`{^FPA%(ANX#IB9#rXqBdAJq6u6D~4mDM$0G*?GZ{GwMXV&k}i)U
zy(Cj-6w*D-35{$9q39Wk463x%FCxn2rGY{{LA+zvZMykZD0*L6CPIMZ)`EHF8acHY
zOhy5gD(jbbHff$xS>GAkAf4NIKFxI(%jb$0VcV@I>hXJ;#n^Y@m%50{bm^Dug^r~p
z<U%9YK!Y+UJ*~WbxEd}{;7lJn8RK@V+wc$haQRAnZ574gQz`U=HTsO><8_VFD)=Ne
zU|Kp+KImI5HaX%;MClhYa*<RtcEvBKrm8UK7PB*$YiN*EWW(vd{AdUb&XU|I)*n*w
zzEBG&KAq=#1p7ukwMf4S`fCA2RzR1!nI7nk-u&<?%ouffP*)q#R5kdyHj3Y_(lKGp
zX4>n1gD_%caFkr@iP>t@sX2RfJ5tT@6F_x^o|LQ1YImh0KbM~gjeUPek>d96sp(Yx
z-FcZ<;r;MC7Uh<5;R5CVq@yb0%CH8~i7PN-RVBEZz4v?>F<QODv4|+%F1X6~eqFUe
zbI+<<tR@zw#G!#vb>{;9SbIPh1LmlP?r0E!<hmz*GV8fTr{etuxTGo&gC8_Y-nhPe
zZEan2ZtnUkNoYaPf0e-CPusNk^)kAX{=&xC*m#fnopil>*Sth-ZZ1RfVL74`=aQG7
zzZ&eS4C-7Ub_RUmKpi%n)&2{X)vbcqr#l93|NEjBXf+z6c6|;vCz)J1FMUHLScvg!
zk&BCqkz&_u$N`zRdtQ+;c%ja_z+`0ss@i%N6tWS-KA)i<zS60v;qrJyxdwOn9>Tn}
zH|if^w?mYQr!>)l|6h#d>2H2k!zXq4=lIc8niUi~`p~Yjw^%l}*rZ2L`p`#-E)RUy
zh^eJr_=-=6(micb#Q?eD2;{ey+}@9QdHn@^Q#xp63%PL&o6A_os9xNA3R$&eNK3%p
zO#AzUP_RHs7Pb=D<IjxY7*x2aG_92C6A*aP$`vT;Z#iI^E?|8*4i!0`i*k}CQP=VA
zrm<-vS6fN#al*J%E{tDYU%*fGt8Mt-;%_Z4SC|cJU5trAl1W5IY`Y=a)u&g_n^Wee
zc8y`)$mcB<>wqikjfK#z4L>E-F9(2ib02}mr?mmyXAWDysO`BEQ7!dKwml?6RFQzH
zTE3qDMFi)UzX6K)ks=4d)VyV2EI-mSfU?s$iQ2j}K6m-isL%OKHT&XmA_ysNb%0X8
zY5+-9I!o33_e%fPOZ{6+5F{{AyDP7y8=1wWWQ`a5%dX$*zRJbOct8#WXLacgP%?W_
zeJ=?rYZ*^1HniJq!V3VMKvq4}tvY@6_2AK!-rYtgJxT**lXbUVR4gN;fW<lCq=jz9
z7x$T_57uw)kSShGc+<=p&mWUmphl*)cAK?OR-CA;DRK^-bH7T}x;lz-s;o0|1h{R>
zbG&B|$j(Og<H!RVgy<TGeF8cZM9_Y!dX3t<BUcJ9@nr3^sgXEtx`Z?5azg<w*Zjtn
zG)Mqd^F`{Fi1YS%3!&wd^&#$NAn_N6V)lDf-JZW+_)I@T&*spIU2TU&@&C!r%sko|
zroqBZ)GUL0TOVG&XMB1CkGL6}jq5}2Hj>@rw=}#AIobZkuV4%|p>wm?Ke?3weca0g
zR3|{VRW5>57{UjKz%ty3y0ul4v~(B#I=4@V?2cK_{A1(3?K%Gp^R22H?5BObOKi@g
zE$)&f*-%YZ{b`MCl>9Sdus<!HzH9Yxe&AXZ4kTU*#NZKD>2ZUEr%Bm1xw)uR6z`jz
zKS*8a{!X#6C)F0f@N4yYZxHY5g2+yox(5}{YSv9dQJHB)+R1V_8mspOL56u7Y*IRb
zvT~0qQUjUlo_h-{tAucXRG<-}5B6OeFOIhY@A%JopEQn?In~<`z}vfxq06_wf@8vZ
zQAnsjyZ+UDF$h=z(<qm&UjhTKfhR+%=`ToD1Q#E(x>B`;4TE75r)GFC`Tw(^H>!#k
zx9IX`@Vegq>U|}tU8Y@SnapEmPUP-vdo%Y+C!M8o-c)W|IoW0RTp8tGL^8MH^E>_F
zwi!zsK(?SgYpODwU5xa2e{_@+60Xo_+}6??X%N<v7JF247U>4kvqYqZO{e;qaR8s1
zwhX+dEBI`c`}Xg`GVklnu5SV>hej`S61xp4Io---s|skkXHu^<8}lTx-O`?#(ll)Q
zS~z1hh^F+u|EY-UuN#642<B#0!T~Ox<3JD7!kM|t%g@w?g>;MFLt_=%Vp3FVh|~A}
z(C>xQ#bKV}{9iho@7HltuN@a8(-Y=4)-n5kX`-dytD*QsQ&hi-hKhIf+*NVOxS9uC
z9*2%=^g(c|pu;M)w=>uzlOqMD4ZDFg&a!4eCM*u8`JgEy!|>m-8N>L}BQ}7q!K3eg
ze$sz+6&c0fbbX#UB(^cP+b(1v=J_j_;s35Oj~G3jD$TZS-;mtx*YMd!$yb5^4dq-P
zZs}*B6Yje<`|Gv_v%3BPX!Kfs@rLo)`*tnK33atWTmg6}%M>#{J{jAQN)IaEzbvZe
zgc3t<m&?s)<W{cyt=q*ISYZs`pH#oOF<*!%xisfcO9X$dglv6vm!x$QBhn)NChtF$
zcIxlDDrV4yFS`rDacq1YGCzfa=i}=?aSarx6HC>Py%S9-(q@~MKoy#e!_|eeBi>H@
zB}Y*syhSf9pknY<yYkKx8D*{Q%{8*vU%$L4S9fGhV0P!rAxrLu__~ve`^cB<zqP|a
zd?5zRC*LpC?CW1No=Pw>Gczyy&0wc|%#U4zo1DWj?0>@vYs0&(MGA&f0n@cT`cnGN
zz2BnP2S6O<j{jk3WTa=mAHeVsEpT=C!KMb40N_d*6q7cX^Lqb&;Wqv33~U0=pl8Nt
z<GBRGAf`y6G=sK4IcG7(W#p`fczYp^G#1DNZ`d06A&$5f%ea8-|LZO8$W`EE0deh@
z=mEFwA9$VL&m0fh?GU0D%U}wq1H=^Rlb5SC4r+u-vyf%oC&Z?>#qR&1DYD#}S}Gpe
z6{S65ao;gE#rj-<0|G|iQA%n?2;~sA`rF%7=K0%)VhlY50c$_ZdED>kZjv9E%Y)o9
zwcFzZ61Kd1h0eUdoGwcxoWgS303tmo%|ACkekVz4WwbdYBs$Zyg<D!PG!5H`-4}!_
z0UtlC;#Orf=NpT1iT>x<AYc6NKZ`-rpU0aOEBRLP<w^0nv4a;uIiH7LZ=pTq)$@aT
z1R72cw&L`i?KEVBy)F)~%~lU<9WbsZKwbj?$=qkK%nkFG4sx^hU%Fg439sBXK30|%
z6j*Mb7J~(*j^PDkKtTW%O-73MlW4303!^*~%CD&{FW;SWB1Tj@Q80NEomk~n@7xlW
zZ0k8!BuD?CLD9}`-z2@6XJe{8<io4R<+P}<tF>#7XNn1*4=8H@7}T`C83sZ%ZLgg`
zhRjR#LcL1!qtFL0AF^u-?ZWSP9B*@OJo+ZT+NOH8#20@eo5^{dPryItDD~$Sz@E6>
zn%0Y(`*oW>8*QIEDGxU3*7I3u0R;EU`g}}VUD?L|qCzo<fD~G#3&R8Tw&z)<3Ao#2
zE%O<v_#s>vRp$aGBjlr{r}O>Ujc$A?XZ$tXpZG)Cs1Flp7`oiBmY-t1p^j&k*nQEC
z?024Scr|<Tr)bC1UC80HSq(I8^jc97H}1kXRaz32(Th)CtX^vAYX?^>6Ne%}0+VA-
zt4B~O$QjIb5)99i==<?{^il_Z<o&ClGGX}(_<b!aiwa>9qy7)NgJ#SZM_dk?K?g)_
zW4=DYqEhneZT_}v1IeVKm!}rR4P+=hk7JP{6U34p(D)zps)JI=6-@6yFOj3)43Jgu
zLl-)1m(CE)nSIl2G%lP&4}(NwrZ#^LF#c{kncMJKl=m+0zSynzc#R<^uIKSOCu(Ck
zji47_0Cojjb_bmkYu!5k-x@v_Gm0@iudq%%4<E(UI?dEM&3RoM5z6U2wl}^U&@Of(
zx4<%;ERzA1%U%-_sIYmX`7G~}4mP)J;t!*~W{4~P60wf)v{5Ai9~L)TNqj88R5LES
z%SIM)71I|eqH3<j@{4K|%>l7#g{%lMp!2{2)!%<F{aE?mmwq6H8x#NkD?h?mHi^GW
zs=^q%`XjL*r(dYmA%=$=B)yBj)nEeDw2f>eL``9x_~-Pi&N65SHbQ@82!S|AD~tQw
zJo;lBn|&DHlz;qM>TSsO@+V|3H}SC%4rjv$1u^2*%NGm|!^s=_|3-IWRf0g{)KyX?
zm#OCL3`AJ==Iup{==GinyaBV>ix5BGyA5W<3OJKbutW~l!L+5qc4!f#_L<bc{zlOB
zpD#=~42XR&FV=6q7Pe`0o@?Ia+Wp4@ztBp#5BH`#N7XO11&#I$kmwor#ii~lJDmdW
zMSj2D_}Fgyk`Lx68~pVhHtx-2{&zH#i}82CwJ4$sr%eGeGJ&E`pKOqRV2+%6I!E)X
z?Z20P%o|DSRlESXu!j$2tMAiV0$8ue<HY)(_zf9y2)@bihAY&%`g?*Kw;KRuiHa_6
zm}ESXb#*h{yr&IYSFmgY2l}>N+(sG2iW=%&Z%N&csoRvBz*GA0DMH!3DpW%r|A_^S
zVZT+hMqNOP9U&d!uF{fG^&lE|COAoInJf<|mtPNrvTC9DpUcus^`NGNF6cZcJ#jCj
zLga(eNXl>#URSz>#oHZ9^R@Ws0Ow5jYJK8=bn`Xh1i4X}Lj}>s0_f-yiy1RAHJ3fz
zO4pjHEF{-h?1-Kyxg=K2F~(YPKCyuIZv;lj_1)PYsmR~Og_`AAa8Dldf$eyG&*LFN
zg!mPJP=Vprx}{+b<Q}y~A^z_D1~>>gOAoYW{|k6o7+BmGcKfFqJx-)o;)Spq4nj9#
zP$0_+%xvfj^-9-&#lh;A7YQ2^Zioe+{ebN8A}y}PG_=xKOk%xXPi!l5Jn4s($SK2F
znqPk(mAiQ3a5!!9w~*E|ejWhH%xPjc!h&wQGyIaVBUu?44FK%<n0CO&IC$mi+G?$E
za)6D+rSKb6L2k2=_5|vF1xNQz#}`=<xl1R9|BJG(j%%`u`yQf%v`7nxh*+p}cd1Az
z-5?DEk&+zJN=u2-AxP&?QbMJh0UO=5(F_>z9`Jsi=kHg+j{<Jjb*>Y?_=b96N?qik
z%2Rg7Zrw%$Q=+>C^8``R9-jKE7V%xZF%L*%5+0D2CA_s%j?5f<u9*>(CXugo?MOWS
zx{S@rEPg}eFD#^HDcVr_3GDv&G+Oq?l9x<uQaFw{<hni+eiT8EjAoHI$BUYl%mt6|
zX|(D1qqJ)Yn7C+UOv1)`QE+v*NTE^1J~#szB=^tpEP*a2C^#B$3#>MIB#(vG4(W^p
zJS@Zi{ztM<MC1UU1Op#*WAjlPK;en@hDCk;5c@45F7ET=GlXcCinwc=$y_3o&v9}c
zFvNc>u0FW6asvVZjvY%>u>Ew7_Wzs6oN1B1yEBA5ye+<FyhgI5IN3n+|Ml<)q5_+Q
zn~?>>Cm_R1&MY!|43E1X>~3hBnvdVQwvq)JH((-ptU6TCw+|{xKT&$)aHlFv_116h
zR`FO{m)tQCuG%1ftGn`VtR|bq)7m&MC(JSA5+ie?X04OtiKw<T@rCa@u!)k^xZT65
zReI;N)VjRizTrCZj_Q)j)7RvR{A(mMP&F6&T)DQpmd)@1OrmgD|25<S>G*67QUv7M
zCta)?Kh`D#y<L5!n}X<!9n91vHv6(bm$5ML5#FyxhZ-nIcT9ce=Ts#g1EtADC1sXp
zkDd0a&aNKzHS3fCB8XM0*Y~##1z%#iLcVYRh4O4fbg(^syn%9L$9@68#tT!8QPvAn
z4Hl=BctFX#2Q-QKjDI|f{R1#Y*QR?E%T(Joro#4DvZgsgX=_VJZSG+q@>w5hN)X~c
z8oR`JHvOD&Rb2G9?>aj(^Ii{lE7PZ#(DO7k<4YJ&1la$cZN!l=%OKKk#_P%rb0a5l
zu<HNV8~YTf2*6$HA;yYt+?>(@(tIB8zMk*fPZBNt)>ae;wyJu*j8;w#tm96M_n9iy
z_U~Hv*(#MZ>EKId{e*{Ca#dB__-Z)0>EfzFgf|VyWaoO8??N>$fo_s9-|RMsKc49R
z0ENHp2WO5zaC{3hY?T&uxVrXX#@7~92Ku`O5QT=KcKeUPzrk6kZRqUd;o;FbW%m?B
z9UO_qDS^HAh1YKHnC2fleeLqf8aQ}(Tp-Dk)tLUbU4!KuW5SVW$h;sQ+mU@?)}cM;
z?#nYI%y;(-KM~`uo`Bf9#b10+8OLG)O579bR3zpTx4<<c<}-BsEE^D2bMZhLqQ69~
zxBf@Oo1FzA7CY}zxaRpD^DO(O_-leH2qg4E<6Xe#+C3Afo)ysxe8jKE(m!e^wY^q&
ztgCXCqp^bbzs!^z9?s^TycO{EJXlf7jn0Nfxc$vfa%(ggawCG;RH1VVJisyexN-aF
z%n<fU$DK=|B~{$3M`Xz#I5U}_#sCn=_|C>zYl#x1)b}J9b<5}NuSE4Y0)P}`E2rrB
zauT-h%3QW^O2`7RE{(G%T*IHuC0@i!I>dT_V;Hz`aC_J1%YoJxj@9?Z&MD>ng@uLc
z314^3pRa~qZ_Qc&7ZZv3?;q!M-zI3`y4qq`L#r(LfhxWSdAeut^WA|LswBNy#G3lc
z7NX53NuG|B^U2Ek0NrGj0>JNLveS(3;KU-Ji3)EdI8FZg>#8h30N)+wto$KJ)JD?^
zaIY=-yz|eZOW<Rg_y$%){#MrP5n{4WhRt?sYhO}J56n)a$_$y$N{DQ>S@ZWuf}JYp
zGL+KQkUUSa@bo;#1<pPhxv9Fu8@j;IXXlr6E<xiHwN5}<<J*SU0%BKdmNr;!VhfcO
zw|w<l03b$jUl#?JJe51^AfrCF$cU2Ma<Q?oX|*Ftud6$r#Ic^&x#!BZ13vy=aU}$R
zB+IDki7>gkl7N53jhJ9FU+n%08<;kAY!JWS&rJN4-);oc-3#!@8;wi9t9aWlfm7Xf
ze#bGwDvwuyufLPb?7Z92;id!ddY5{f14Vf)08RS5Fx6HsU6uNz6ksENokxh7ISSGF
zSGnAk-Y>jkTO-v4=^A?>Zy=>>@G1w9Pq<<V+vi~hJtXtILUiTls35B07mt%eE7UZ<
zrpQpW`h_2*KLra4aB1CEknF{0Y&TARC!P?H>w+$hIV)@}MIB#N!UCWk0C@>K^)<%^
zXPL7m5M+hD1DO^F=(a~p2Q;3YTE#s(c&#et+EH2ob{W?0=NkK%2`_{&otA%+b98ia
z$UXHr0bvkyZ~4mgO5{{4x1NtcWE~nK!AZ(jXz^6$g%Kw{1iaGHHqC>%iKN@IICJt`
zW-)E)3;zGtrmSSVBr}Oag7oCuee=`EOF8+J^6vV_Y0`}4seK>J#M$!3(i>IpDoUNQ
zbrSQBeK!DqPr!CerYnGz<ZN@#LJg?N?gRGr48un%-THVVE259Vl*lpsHs0Ouysdgg
zKyZr@zej=Tn`DZbORw5=?$uItW);zNw;7l6c?(FDUDa1f)`!FyEx>z5e0PY~_rOWZ
zUR!i0B<(2q$!13ZaFnvJ<6AofrE{Mn@*8yh9B%RFC!0$<jr;iF#<F8#gnbQdlJ?Cl
zfJye+#|VOiyuais1eDlW_9jCnBG+&e;Yr-OY%~8iTnhm3I}56rfqO9k>|l-A;J8!@
z#Vr{x8hEd0rbMltB1AQN>08Bi`?3J7l)?za3iFHl8+pm6w`sNtIWKcl_YKirO=UZK
z*rQ+`+wuujf6RFVT9K;D7!H@ETs_shaP~AxK9HhA<{A85((?cCUN*9_&Pb-6;C_G$
z{A5K`4j_T4p+7x-q!DPS0>J}hp5ZnrSH0EpH!(kP+3}uNI&ridH9eF|k`AKFm3mg8
zs6!nEVV04jS0wUmUX@O@Z#u5PYhR-V4_wL@{*59Rs{vSv$9!u`uT(_~uv_>b7CQox
z_|{rg02$>z>C*`0??Y02_v<`%UJumQA08$exb1E7_Tml`h5HNV<F%)RzIn0kXp<B0
z0*@#GDDnnE@ncw+Bu;Fb^MwhhFFmS1{^E-tQYX3^018m@@K5FC<-LkgE0b9p%GKj6
z7LzL0|Jy_cJN?`75mPQn)7dzo2`*S4FwiT07MnZaF;XAGI)<KS%Z)m-mC5wFj=ztd
zI@`dp04pLQoyFgYM*5|1)N@?#wMVZ;9<<)*h5vkirR~=*J$KdgT2BDXaVD0=9}zRd
z$9I>up(ubqY2(!h%g#<#F5;{VbepI4H?Rt=cn(lG*<%TrqK4{MQgqI3!a9HwgB8N|
z9$mj3aLzGK$>0FSI8j#C1pxLT_fx!CM3%{hsLyPu3g4E{=Q83!(Y{JXpNP3e<mZJE
za%tozWc=WZJ~1s6mXctnSCZr$&<yP6mQvjJ$E;GEnzwug241+!J76Nuoj)vA1qU0F
zSaLnO+<7g11z(>7L3-&W3LVoXLAJ(!IMkCO3Om`urdf8M+V3XbajYW>1GXMN78ajO
znhJrzciWg`ZXrJg#p?5=+g&|*4ihwb*Yp$6N9_-qBu@|4LRhVQxGmQ|<(P^k_=Sf5
zFW%w)d2+PeNHJ-38g|r^hXvHe)oxJ3C%L*$vyK9ci5@^92B5*|G#IVMNcJ*d`T=Ok
z!M0K_%h(~&iYh4XPCAX$m(?_W%b!&tS+EgGvznvt0Nz(sU`{J0OG1`!2|T$3_E5it
z5G1mB8cRD%^gQhMTgYKM_f4;02`ZQVZZTIqV@;yBVQT@P*(@eYPz2hza@51f=DbzX
z-^)gdzZeaT`~DKGkvh$z(`|qCztkHYrc|n~_;K=w_pW9LRe-ab;n3uV)f5$oCsYZY
zp(^ZN0X!sHq*cNAdF_b-27NIAotDe*EE;*)=-L=frXC+3Pk49%{n1L0Y3C><mgv=g
z`&6sV$!RtH>+~<{)Y9i-!-2tpoJI#!Dh@S11v|A+8RjAfa4kS}`lbvJ>j1vmUuV%t
z3-USTXV1o}9nVeyW@+Pb*W<eY?K1;xhgt<5b2JB$Q!m~eV+x}?9cwTY&EiOWh@PA~
zc!v$iQ^^MN&>b_T$n4Q-8seI-Td@e5x3rH8_?!lYJ{uDh&6ckFk7-IEi-Kf<^h)r+
zk!x^AmQL}4g~KE?xLjcavr|b|pWA$3yKiVf*cvS^7-h{Q3wxdCsEw5(Lf^Or9~KJP
zyrE<=b=Nwep3!%=nEk-IH_=k1(8$^Gi32h>4FdVJk9oK^K6f)haG+Lyw2g~&NrSX6
zm7NP-QDHO`M|m#DR%YHL*~mIj7SR6b%x8WpH`P~S@`Nok;F?Xs%CBpW>q0*u<lvMe
zw5dEKA{vinZK~mvHY7TWbKVRCruGR1;!$x6Pj#~DLM;sNezJBrZaEM+xa%AI?cMM1
z;ekgbAgCh{yLjjdKPsA)<$+=&tY)T`V)~dhA5+p6Cr0#Xu8;7tEfFzL>iF@J{XwUB
z8Q4WAB#-zeQ@}OQtb7yy2Gy`=<!jWZP|g)cdo{8OHQcI6>jSx`PphGnUh+~Vs64lP
z=Q2ml-XY0f6r^7T?m%Rqh;vSY{>A@JH?7+B;m$nv%hip6=m$W9V8iZ80$DH!a1Q0t
z5sfXN?0=~ZOMo(Y|E(w5jwoj$P8so*w4jI54#5hqJy|6^seI%wA>&88v3fm|IR>FH
zmj!*F_6-O}6ZwZS05+!mSb0$UCs4olX<Jgbc9}{TW3DRMZ#nqJPi^D=ZWNrp3e=$V
zKBh-)$Dx4EH(z5^oSjveR7aKC9op+q<y~)?DbMC#NSSuYc@SyjwfbRcg9~{t6Lrbx
zglj@g+eBmw<CSQAN0{S?8qf*pK~}Lx!#Dgh`*SV{ue#-h7=?Lg2XYGyl5irYbAd+)
z5brSi^Eyh*`o}!T(;`6=)Zc_?Pl@(RxPGd5?iTTc{%xm~*v3Vh%w@8-uSgeYfB{F-
z{;=2%-WX>qa)S2ED%z9ArKxOtN}njz>TY9wH156c7igkN*7A)<+9dr~-#M}&9x`cH
z{gHIZa=xjV)+b!K{^imL5af0S`v3qq60B3-7nyZusv#4Qto24o=W-RY<xQBOg~F=i
z-MIChhxL(vvTP*XRbx1p)q24Kv^DSvKQ0{~p^RbOsIO@od;%Z|?GItSaSs2q14@s-
zx&Q7*TCo!Q_ucBDnh?H=XbU9zzIB;K=gWffQdS=4t{t7L#RzRVpB#{elgPl;XUc}U
z2cVSNg)dJrTUOlA85(E0EQn9~{Wm_%_dhsdELjzaPgwWUoxv|uq3k#*Yvw0r{dAur
z<`1ZG%<j<*z&!yx+|OsY#sa&M{DozJZGr;!Sb;*q5sx3l$m^u&z$M})5lrote;U=t
ztZmYlabh3)bH%?bIj>^Mh8EQy;*+xHPucB~zNFkBiO>v32@*&~X;5oEZVxj>w~t~N
zTI%O(OT;9f_@AT8^9@<PnR%J8Jg{?8cWbokqYArq?!R$aI<N^?@}3^%vdUEigZ;=&
zB-0L9JBEA8QOf<W&dvD~#`NMbf5qrQ?E}Dx<UapwUG#MK+V=k76&$nZYxXBB%eZ!y
zdX|2j)$BO3e(bZ_etpv^iTElhw1}QVdif1O_~`WI;*YmB$p0x8H%||}3YPmB?1l01
zE0^|vdiUY0t3aeRbd6X#AE=6j?gdIz1@(lZ^58)2^yWhU0D{*4rD`b3Cv#3wm?6D(
zG1|eX4Jotu!J~F8Or|QsK%dAc$W$$b?J1*_z7^4N3C6S){g7ao0r`=<1Q^|WWcQdx
zg1Ba_b@+xESrelRlBd6CMjD-fjC4<~wFBDzU^;h=mAZLkDUh+B9snlv;~P#MpyEI&
zmrehJwJ9>fjsHk<)mtV<qo?$*2(y;BsR5X{50%WPXtq_JsvS!;rp#Bg*l&u-7Loyd
zslO785m*KcldX2}Q;s2q)qfA)^JJBxfE0*upDT@?_rbr|KLG;zT<ja+rZ6xQE-hkj
z0z4arEZ9?<ZJ#)3xp?5xM#|-40{MVOt2TC?2svg%?bSKlq>L(lCxNVZ)b-ol&MK_k
z6Ec8h5&<LXIb!z+VFUQ70Z~%vP2!lZt0Es8Br<?<QXzk8M&8c}&;!6w-$Ki~H?m3g
zsd}ZdeYV})qmUjX&odl;9teRR+NM3dkgqoF0NBTfgNk#pdH_QQ-k%qq3)~Rp1Sgjb
z!PmNkUs-u!q+H}jG(^~gu}K5)7#twy-S>|Qx@2Jq0#}7!STt6v<#X+ZeT3b$nRBQ2
z-@YT8%H>RUy76S!CygzPs;&hn+ESSvNdOHh_5)k@Mg|*fr&Ry)z@@N4X0_V<cp^OH
z{;)(0P#n5R)EoyG{|fs};7W2yMV$fhrwk2DAh<8}nw@}_7Lc1=Cu6i0?5DCN2@-ps
zYxYr<9^pkY_9bGK_=NA>7Yj4I{`vYK0P&N~iV@7~RN|6X)UqN%B4rBSFQKMITx}hw
zdPQV6w}?|@F~%V7tzV;~8oqHA_}@g<Edr)NONnGFGS)UFqfdoD5Inv>D$ph}D0A_>
z%$oefX*<Pzs@i67@w5Afo1sF}3|9pP>=W#Ppzc0i@kv3&B`=#0+mT^fGxXv|`$KvJ
zt!F#W@+xUgcz-AUnAgqgX_OoEb>THF_J;>QeRlhS=Gu`H<%0+;E0{nO-f5=h?1QQy
z;YShbif<3t#g1cGDgMpaa3O4RMe|7;z(V!ZPS1i`yvo>3X$|J=ubU8{QtzOiu~MAw
z>W(o@i!Ndj2B>i2GK6Au4L%^MUnxS+nlb0Y`(zl$p)Q<<`Ec=W%$Xbz2rD`WIWT%v
z<h=Yt0Z`qyRdqv(xrPoxe(h`KA)A5dU5skz#>j7X68(HwD8|XcH(kdn^hEYIFKO*!
zALrY&=n)2g+>F{@h*|9ttN(Y}*V&-;H&1;P{cqYU>~6R>bI=(N)w)Lk>BB3JlYnQM
z^J0{7<cTdnA>Pk*1pYsaMe>>Yt*RkZ9CY$d8fJ}#ksn9ANMzRulF8mytGQi~m0Rb?
z7wMaoQQw?>)7n|UNbOKN(@#8Dw__ZEWcicvQInK@rh_mr#_{cCGYGJ&0D^+={(nT{
z%bI2#?JImLy#VQgpqFX4pKXNoxW|1#rSoQln1~^5Ykloav?kU=#GLdnoM9&vu9wAr
z<ff%c9|NMITwR5t_V+$jGpSK066W{l5y-giy|-k1So~Op0@Pi*=jTz#xnvlmQX=-?
z@0%*iczZT&QM9_I&Y?S-&7?lPhUs$b#-Vv#ljw`Sai-nD<6^yN@s^GP-rY4$<lpxW
zcY*Mh$N<$^E*aO0ZX&@Usv*{3^n;hcg5g}f`7)IsaBQ>P{CEg9#2T6&RXeTrNxo@q
zRckH%ycNc~A|4lSL1fKfq}p~vSd~{h!LDzm&6ec1h-{WSeZFfj<@2>Et57=<U=}ll
zBYl19(DDli#Th!P4ajt}4X(FjtWwA`OP^$<5lAZkCmDU&G!$|A#AuvPOGVstIZ^=#
zvRhX&4b|Qaz_{{78r@kp)?cRPI&FyPOErDhVEp34Xeo(RylIhyK>ypvCPI2bB;l??
zihlozd=oWOCfs8S=#}|%W8jy#tkW0UbY14_I!^--OmV1`q>@zz89%rIj0d>3G)b`i
zKovApQ$}lL?(R2F+pF#Ds;9MK_^$w#5F?kob6TI5e*GU_KF<)-<4K^+SY(}IMU)TA
z`_SX3CN66g`U5R6Vp4z>%i={OsG$5UlZ@Vp+(?W5pDVfbkkla5Bv-zcQL?)A(C-hI
zQv;$+vekHP#OQE?>$?7sr%ZxiIbZYUPo8&wOTD`)Cx%s0yUMGwK?wp!gB{EjH);J-
zu}G=dxKGK>>aHu!E|YrC7pa^3zavLQiv<4Y0F9{DMVFaMDL?dRnD%XNpX;S=TM{RC
zDWIf>jKtIjl_PLKI?$O~-~Jg&rgjMr*+!vJ1w{!!Mrc1*^Ro83(mlB3dSzr9hytSo
zG;~Z*l!Z`vlnB|!{bTW5iXN5%N+j3NBRTynpeF&XmDwiE^6bqRFGjG|Fr?^M5n)1P
zhgm<O1#Cw=KVU2%z)$SoBt4+cQN62U@;*}0TLij2DYF;bw5S%!45ZG3eQ`2!uE9bC
zh#MlKVyd*q)!80t8LSGj%GJMXhBsmTRUzWdb5y#V2MmFzLx%qm7YC865LJa(t@3cb
zV5n;-Qf6dv5NwS_TLk=!08^vLtNIC)9|+pAI1U2S4+1e7<GDT2RrDj^{peT^6#J|j
z?9>I8jjf1)BJZFWQ>D6!b*)6|m2_awo9;FZa}9wwSgF4{7ZvKxC<e^cQ#F0((0XaL
zdb!O6yzDWx_%(|9p{`EEtpSOuP!o+roqA>&^d95I-4fkmIXHM0qiG&gns+;~#fG95
zu7<8xAsnKuF{bU_dCCv7SSiXJ7Lh%jl)<7->`3@0)1Qf(lCF}bEKnav$SS988DVWk
zNJWcfM{d|Q-d7MYA9Ac)X5cY|-jLD9f&=S(eX83$UGOWE2L{lalQJn*)?1H>HP06(
zk?n|7{})eixNnNy)&vJ7*Sw~Gp?vWZIpn2zpx6%rj+;O_DV6Q%7pv6wdi%uq{M*E@
zH^KSI7Ppw1F;z<zL*0htYQ)}<k=qci)a5dJ(`{-3mT5xP%doo$R^W|U)<c=^Nye7r
zeSRI%l<m*_pc(o=xm=n%9bUR!-Lvn(^1Wn?I)FL7V0`d55#okV+$wR(i-!WeK%ekb
zvBml^0d}Yn=PR52l3Y{Mg$TO;-#x`7Z+b`$sE86FYY7JiyQ+BmdbYc`D!Ehx$V^ZP
z*W%sODxaB8aVY2`RHmeI$B=JG2HzT{QMzuBk}@|*`j-i;L=6aH2+excig-zNor!cr
zVSD`#gY$S>k<$~w0-k1^$g8Fd5s9H$XmQ+7SWln!iEPHiBBOm(iZQFSNO(=_{dr1-
zFL*B(FZ>BE$2=u9h%*VfJ#X80W8}oIAjP7&m`lT_PR%e3!~u&;Mg7mAY$!a?p$E{m
z+buNcCw1Y^Y76jWh8fIKO0f(_QA!OXPH8?!aXNL3q@Rv65v_h#HZ3<okHNcrgA%!(
z_DhoBSoY$1O5eVghLkBzTDWb^jUDW<Sg@yj_cQ+4vt)_4#6p*B6RQ&O%)0B?5$eUv
zkBOulw!GPZcJIz(bH^lEJ^LkB2R}YfLFRN?7U(zztv6zB;nP=HYvEkz*)1^KW3=5c
zGH7q?gdV}zx<?V(nNrS($f}9S8d%Y5z?S#NRz84=lE47qKi;VdW#eb1ctMEZK)&_j
z5e+<TPuBgS*nackNy`nSe{=aXma9Lm8WIYuK6L)N+68s>g{^v#v{X7bTmMZpo%SM$
zm@-|S;|P|xSu@A1Tbs{aW=-K}qT@dVEu*R9yd}bZjAUoL`)rN!{#Uy!SSxG?2Mn;z
z7tT{g1Ia%!4jDn-GM&J7D$Xj}tSHIy0n(MxkjxiJfP%{?5GmpRh<Bu+h4|5Pm1Z<w
zVyd$qgDap?;W3s#>;ows>J|j6q$!Gk7vR}cO$hpD<3Xwd`pENspD_pP1T=tvke5$Q
zblOcoWP(Wmidko{W=g+gkMh5oXQEfgRjGTDaeA0TbK1*KlLhUI9CuYdVY4M1N)05>
zfF3(q!p_Ae!N;dC$OdQJ+)S>lj=BiIAcs_tWw=N|O#>Ytlgd5-TDOcqD>X^S4+i8y
zS<w#h9|%I#Q%v6uvmzn1**YC?zZ`Khz3L}Jf~|R{PsYHSj)vciZ;WC7H|f-Aq-g?f
z4pHBdRP)i!n5E{4VBZI>z;pYP&FSTed-Xvt1@gSSGUnC~ZQ#QWpO^}vMDIYn{t$n+
zfn(Dr_@<2-pWjb{US7WbR6=VK#!HoG4^K-*vEDvo!n!3&yAj@bnqZ7E)M#hrL^JQn
zF6@jA!JQ}h;!%j2<CR%NR~Mr$ziqCSc~17XoNwQ9vTy4PC~5FF*OLFYBmyt1Slf#(
zmpCn@f3?>HvQ`>#@rm*A2`oZy(o3^{gr59%CFpN7t@9qdT3M%@831kAiM`E68bfAj
zHBzKmopD9W>De<I8(pA934U4ZNBw*FH|5A{>_eWgfer#c2ZuO2_&q`3WqgWhJ~@os
zxN3Bmy4ro!9c_#Hy*$F=`yx0{Etbslo@oT5tL+H%^QTWWjisfPm4)TC3jbCUrRQC?
z+cH2OJi)Ny8#Iw_eL`2Gk`-d_cinM5o$9uTXR0dL%xYkt*6weK7uC4!F$EsA1Wvg!
zM3c#Y7k#@bc<<glRE1y~$SnW6!hFh{91EaYK$jRdT#OQ`P=LqAYL<49Y0`MQeo%pC
zXmeZdpSDn<*;Xm2*C+`r0>D5Hf1k2HJ8drKd4A=;qi{aZTjmxYXctwL+bwRibKOT0
zo=Rkd&h%aNjkaF?EEV$PF4GIu-a`GxLr}uI$8_P%11=%+`713gxFgI|W#W#_3PVq<
zNeW>mNc27vTIa=B(PyKhMP{nQFZm^tT^ikE<O6KVhYud8YMdJn{`)YK2kE$}x@rB9
z@)+v*`qjUeE1?@?@jap{pNplCT9wdmV>pfI1SEAlB~owY*vrjLoT>2Br-A2as(&Yr
zbYMjHDO)HdkW)dzHF-q|$JcunH+U<hu{|w**jsuZ5e+2jbF9zN#LtNMIm59!>YdNO
z8&<2E_P_tX*O0ri5GZGTH4K1@Z6MLjS1&_1R?-~q5IO*xae4jzaVAnF&fi>F2kYO}
zE8K#hiHU>Vng5QN%hDPTIyyU{OtwR9aOj3^)=lfveIi9?y8Z~-HZIc<)~hw!)H2-_
z=9`V?=9d5a-{fdoY0ub*$Z~RW7?N~*>Qjn4mu#>_yQ$Qn{OJ}_BgF^?#+BzPM6zl0
z-)&YF7Iw|m|BYB?zN|1?Mn+-bLw@nW;H&d^$b=>8@}&ky30ongiFe30REKjnL49T>
z6LSWjz}gyp?f>oM8u)GZZ=2u0zdkf{y%P=*XCnBa+J=%R`=u{sLuaOgj!&XwOd<V#
z&xVGEW(#xmztPp8jibJn4BCW4aePhqE<QYq)JOo0G|@NlVpQv9(<AUlx;A8vqzZ+o
zl@bbTeY8Ni^!zv1hl#&TU3&zF0*btz$(Wky`zt2;v>HMi1m+uoPX-~7BR#oiI0T1Y
zys>OsbT1K*ZN9k0&{Z;V$KdHvIQ0EopzhOv^d>d%X%KKFTFd6Efv&NJrp-{Ev<ezI
z*@(!GueaSpp5RERM>+nD&n*cd=hqKfU&`(ME`NxE8<zBzL+nkE-B<%4NimrYooBUO
zr3hHP_JE6xZ_Y%S>2c%kaj~JuT!MpPltHQWm=A@RdZ{BU(^LN6U9?g^C!sLX5g>{j
zvC^d#;xbCG4m-?%>T6vc&?<DfbxmgFXC|^y{&~vvwT|E_9HK+4P~oUNbHI3?23Be}
zmAXx-`u)3p*70fsPG$Mc^rmHwQuVi9qxikaWIYf0?@ejt<*#^E9ltnfsMw;uEUaBs
zqMK*^T;4sY&Ek*-1P<KM1BdY=Q~DKd^&<yu0q!FO+Dm_!iapU0*cWe`*+t!L2eP+1
z;_U?N$GfTvRC>z(ved)QP64Zvd2{S_t?SsiJIc1^%)Zz|9$sD`Dd(&@ncBF>6?dvp
zt<uv%F<Ip@)*(1`NQ70ijrxqND)-u5CV&8Ck+HJZ+I$5f^z=g02hGhgj$PqDme=t(
z_b1C<V|^%2AD1x$FEwCSbrsfSe#=W;x&6Cgfqd9EKym_z#=%EVN?~bkXuT*;SY<mQ
zlR%+ywTjAQYJIKSg8UeF=cRevdos91&YK97to6<p+4|z-z$Zf8VM$y<LY!+!345#A
zKR=8+Rq;d>#CyoMta}M;BsEmGZM>2drIUbRFg5(+4!hRc16hXcnm#0$8^$nX<`>_z
z=WCiJhzRscyPu*@7DACLibFj&5bw^`)}F&i9KExxvhk(BHT)>cuAJ}Oid9)g?Ie6H
z_Bb4Nmt71Lk6d%ZqDNFyMRs~%lI#4bK8R8v4CvdO?TCM^nSgB7=cwrc>{$40pumB+
z05$U|_7$#*jup34awXBgqhdD~6j~@)T+C1cTvOgl?BlHC<PabWr9P)Xmgc<}|E3WD
zA!J#9U}+)mtcI3)>vt_*2yhC2ct>Yy<Z;>$RBI_Dm##vDY^I5UH2~0jSqYB#YBnf;
zF{{1H?s0~50q~~;w$K!)N+XSRcISCZY!ijI+gd1Y+(meAu7j@+BaJn7=LbtJNd*w>
z0m+$l1+rC968kZ@&n_KxHnF$PDBOL-`eQ_WQ##QfrH{TQCSEy`8h0E7gWx?+eKItC
z9s?(ouL(!qot{vhT{q*eM>!?Qjh&qY;;X}z#uAR&D1scMY7Sp}o)1Ycf%r?i+>x3b
z!{>utp>U~R<%N;VNG_wAIzyC}>e<Ho=uXg$1Z--LGitAIxw&2uoO>H2kXO0A;SG{b
z7AL{oi3U!CT-9fsKLDJW(9mh+CsiS=EuA{-<41Q)7n8^j<4PZ8hg*~KzBk;g6(R3d
z4@XobaUbc66E02;*5&WK+*z+f;E9IbM&Mm+Y?7vU$e0k0I*lw1%Do!_xhW!f>H$Yn
z-nf>*-g=3hziD3up*$|je%3XA4J7_D?S7awmTtVgP5k@5T+9CL0=95})R%el+|?b_
z`cPa<gtG%Gn;U}>^KgW#9wnp@SEt3nIzJPvrr8<{-O35}9myGbTHqudcJjE08!b4S
z{hl+~ts_0Y0MT%YAcS@6_Z2IzfyP&nK~?b?asBFW!PmrU&glwpQum&`Hkz882qDEt
zdUUu$`m&v}iWS{^Cd$@wbsG^yu{--~s*iPRRvV+lNg&L~>XWIgvr{OhZpqk}q@-1M
zz53^lFK%w5A~@}3iBZpxqh;ioXMXiBn-&$!V1?J<w}^y?x`#8luK|B~!P|WDnB%9Y
z+pc5=cFhsC3qHX+IIsL(VxCyo1TZ9BpsQ!M?+Cch?;bGpHEwuVk)f&^t+y*TKqs~P
zaMBA?*T2Ssi5fXYhDBA|Ok9Kf@jhA%Y@Zq~&<D~_UUdhndBTmSAfmOiXxu{%g7=E3
z+mW{E<#QO{9Ca`}O=^6%lYnkfWpc5vegr$I|8+QMnj(_wj3|{AspPsZQfks)?ml%^
zSXs%JZdgm$Y#3GXcky_CWIMi~SHx%eDB>$vPFa@9OvWO!<3LL6SlqGS&aq*m-s87p
zh+R}nWthZ?ce0E5(qjXWrE1BX6bcC7Z!M(>))`Nwg3$&7OG}fvMqXQ6?2$s(A&+X8
zlTBp_jJ$s<<FTJNpl*hKmRShuA4r$3|J|9On!JmKRv)KL@c=QCs)u&N`Bg_0lO2+y
z*-kC~J~-dQJypoTOs+9*SGf4uTyVcjFFYl=&%^4b4(&c^65@xq$top*S3tbJtj;rS
zp_-vKq653!LKi5mpKF&Ty=6xEc_rG0+4hR}{VLZ8zea*hY+Vo_@;!X?h`{grV1qm3
z+He7?@)>(<l<L=0+4EVFx_&3HMTI%;%NL%V5MfAkYRu$9UW?N6@rdqX-K<Xa5XT9)
ztX@EcPLbYNqOs>>k72DopW|Eav^h6)56%Wr0@+OSQZ#zouZsh)fS<f2swJ-h5Z3uL
zbS))ns3>-@&SMabavv)C8k?GWx>%s<CSJ3X`MZ;e{{?I}Lv#r|3e7Y3+8r8TMd^F`
zJp}H6nk<*En8_vc+=V@c9UTgN_j(B%a)aoU*>)=n8c2ALwyVepnQ!_z{JnA5^!N2J
zM@X805I_GyZzElyVYTUjO@NA|YiTScqNB$bx0efq*;Bc9mRdxrSo<1P!FI{&do0}O
z)+i2vm=^sV%L7}lvC&2yv#49@JDJ|2y;V0!xRR-<df1{eZdb%@A~>Rliga|w_ir1;
z(kmb?m*$0dVzY$*t3p-cT}Sk3P>?*B+zorHu?g~L=<{4D^!EFK=C-6pllJkcr7Mqt
z3PmUW@84?(k{oU%MX_$}OkPh&m3_bc;9?P2eeE4>K+VpEZ{oEsD*`@>X;AeC0Kp|f
zTQOPCnUKc~-O|EvWx=)n_%YH}c9K4KK$(Bj?Z9E|vb8H6>EkHjP#w$f;@vNvK~rfq
zzYkd^xyj{1BMQ4BnNhA7@6qTc{A8FO+}iSV>)ERYuKV{fDBO>(F4Adim@lh?AmdPp
z;Bj)NDx>GAXqE(_A2@)o_yL!SR9KG<SWKnvjl99+jRzlcjiFP;dxuM8?h*rqy0H~K
zjYrw99(~^L?$WC&=Tya=HYuiwVl&S~=f)o-av4wLj+B7~o5fKgvKOvYQnxRF3bre$
zX)DzhjI4v51S><{oc<mG5BJB0<#DCmNUAUA?%VRjSi)2Y#8~-rzHi?lP>Sz9+{zVR
zSfJq~TVC@9o)EOa=ivZ~F?K)2%?$Q7%#P7b9nEdPE+J3$rGBhA<>|7o#myv=N<dqa
zr%oB&I(|_|oNj}!jBjly;-yb*)yrbupt(P}#ne2|t9Ho19LtKpMJ=A56`|hZ$V8UF
zPu5}kKgV6~L@mYM>4o@JEBMIlU(^6@lh;J?T^s6<ibrsLaYWV)&j-vke5o-%>{u)Q
zIo}_GshJ(vInynDH!#1Exstj>dFd??KjWKPY_ZJJST@9DrII;8r7vuyN{+iN%w9)-
z-OKq2q)<rB_CbT9x=qKI6wjqT)5Coi{rcOl4AdJIq<-ag2wvBvf-0flMWS%Wurr&H
z;;O^HVPQ(X$$NGYj7hoV;@@pz{{WMQI-5bn)ESYJp`69=s_UAdJpoW0J7R#WBD(SX
zB<iC&+n$!><^6a)zjxNKwn&afLZqsT6-8Ke>&y?ITUISCpbvL<w!E;k<HFm)imWxL
zpC8JM>T7z86CWDR7z7;JO*V5VY4bq`@}9kBKYP^-M}Hr*LVz%_mD+Q-IDVo+vHA*0
z;v?fSJ-tHB&P4$7Fxy##?kqk=RtTQ;HZBU<YQU!b=2E)HtL#)8sl6nzL$W}{7#Y4{
zC0tx+Tsy@=<StHbhj18$i_<~i4&7J$0MHBX*Xr;ZBwfobB3jhID_kaX;?OWk;u_=|
zOt91AO+SEkXleAp9M41gTf!NYPZBEa`+>sVzFwJMUz9XHj-`Jk8v0Z8^h>qL-{J|w
zNU>vZn8@v*i>X65m|eG}vbl6o<&pA*68wQ-Vb4Vl#_6s?!oqe{rZbCHn3-^vpTgkF
zj<Q_(+Mf{v*oMCHss>d)GRvM4n2?~9S)E2lAQ*&Hp6oNHziwCjhKAx8cwvY~wBD-e
z+P}24z=}<deZ>U%B4{@|8U+DRlmYZl(XCJ9VAE&XSpkSYOW?B$B=~Ze1fjya(QcE*
zTXQe5XcPrxY>fYw*U0QaNv@H|>^fKwquI~03Jb&A2l<SaHwS}tXe+JzUB>*=>i)b6
zAwBk8T%Vo&#N=4Nk^kV)s;A46X)ftyKMDyJ9Ejfzs&MG{Z${YB=2VmPbuCqY@7_kH
zq{YPGL4YWJ@_zl{6}+I4i!}2#-tL!=qi>ek(0C?eSI?|qrQ#FcTz9CWHtL;r5Y<yB
zmmv>3YgUZ4Q@vj{(mWUuPCQ`u8@c>#wCe=F^U`#czcm9%bGR8-W?>NhMxYvutYxV~
zL4!`rsGEyE?p4+|%uk-61sc|MWbVn360b7>tCq$qtU*$<8U0>ZgI1|^S3)?(^;J2a
z>Z2kdHD8ks_>-fEH!Sx9^uMX39WEK~bdNll!|8f>ctwf-*^9aJA{FEIV-o@yGQ&ba
z6rzILf&lQ_B?vF<%g#aUV?3#%^>whe^~>#pVyjJplgAq^y9<|$J+WwYR{USNtVF5@
z;+3y)U0vZ|@W7w46gI|sdT>|$;t_6Yu@di<^7ydCLLtoPqrKHdkoc=4^BEex+f1j%
zn+|)-NyEK%Hb7+sL_n-8Efqj)==7}pEY;Uz4L%Ou)N3#3Z}E@aalxt6Qj;lPD45^C
z%Z<!VoO@~pulA`-?M{kuSx*S->_cY|up}i(!-X$W;b-_3!Rr0_nqkMs{swMM;(lNF
z?JoVAJoa8PhN32G1sk1O2*$>!Bt$OHGXe|S_X&OEz!6B|l<nXh@JIV-W@yGC5@@;*
zJX4YRWBomsSE`++@yQ^*{(j;1&kUEt{ctZ%1Z<^lVl@quq61qXub0&+E3=*wU2}GD
zC^@wOe|aEqWkQY7Z%2(`{8P1+s*W8%SORpjFn0YF@B!5=dy5{hcramvo@z8(K(>gu
zzB~Fr=(dDj8C)BEgA>3l{RD;^q8sajZ{61oD%@H?q_;Lzf`y&px>PF`tdi#Gu0y0c
zX_ZwO-!-!_Bbia?yT>EoCcTfE3g$R{oe?XtAUN6iofr#9*z|V-4-c<E-n550(>~PU
zfz4cld=~LpG^{q90#P^E-&}hqy=@Lb8`MRl@?^0a#p1cEJ2biq7I~`3ZuYUiPf7j3
zXtR9h<cWz3T5k+U9-}HaVK7tmGhd%dw6E7q$KJ_O#4Ev;yAwR;4`w;YiUl(~_Zc?v
zcIq3KKHg2y+HW;GR;Qag9h!C^p1}c8?}r9;F0F@F35nXDcmIWU+3$H;O559>I*w%~
z>AlGY_+T=yv?7;X+WOe=5hYWjWv^>N7}|-d(Dr0h)_FrgIm&cXM(kdkq}LyhA1~y3
zGX5wPN`L~^uOD^Ihd~@z!6N6U5xWTtHea82Xwk+?G(by?1(r7#jK|LGpTew1Q)R!#
z!3(v^?mf2ny}uihJG9qH!2H|_)1_ZlvPe@jsArKQ&~v|6Tn)Y@HABdBtBpWO={ep_
zc5xps4Ef%~HI)yB-!ad=>fKTO>Vz4~MHGGASpii|9R8Wl(V^9;*J>XgtXKbFz%C0!
zv}L6tHmLm~cd>&3=csYt&NE@{o0eV29^=}t7zN^ZH@{DL!^T3LdnB=yfG7<;_2;Ot
z>=oY%Or10aKxk7v+tmQ<<W-0>EDby4T#|&H0d#25-ROPnl=DvDvngTXnGx#7pC<`t
z1-cb~TJKHecc%IL`3~40QO<AXs(CGe6>V<@C$<su&FfEOn&*B}Zr$!W49Y~yWwbwF
zw-KL^;4A42hciPey?(*bZ$@7GACgmy%8&8enOkfT-sIA&E3B(CKpw)OQ$AC3CH1?l
zeN899<QQzn8mocp;bCyfMVawddwTAtFTm{QYhhOx&|pY<XkcKlefsxxaLU`4C37`<
z=wTrFW%fItKQ`Cb*vN?Gs6`^(UFltMI#W}EzRbL<Nnf!o@FCS5liumf>zC9XQba=f
zGP|j2-Rz9$b?SdQ&y#_d?Q?hsbhNILgr)jyMRb6x2Z5)n@M>rTQ#FuxKsY814Gl@u
z*V4^z;H;X=(3gBXS*xAq79+mG<;KpxC%N?E!Dw~KRJyZw{<chCzQv9#1sWVJ*Onsu
z*-%YZ6mq33vM=1;J!Ry#eS*Vn!A`5DKRs~VM;%Vou;?1REPvPjF|;x0A|;s*_#`VX
z8$!A~xHD>%3S%z}(FMK%Kw{2(a1n~cW+n}$`_^|eC1eO*_FulNce7qnZI0S@jkIOh
zL^s+muy5aRdRm#t4pG>@x6E!gf{1&#xJ1`wT>7K*Ni*TF#%qO1Z|GlgC?T2H>CePT
zU#p?q4;Yn~0o2WM*nb!BJov2)8BlboaVuI+nk_Pq500hu*XC&3V7#&)EX57Ozn3V>
zAA)or56LPR=E~AcY;L}_cbF*$NlIb}AWRwk=GsXd+u((*@4YsWVxC)>?E((d0xc$S
z&2yj7o1v>$H0f;*=6av7jMEd^Lr~=}U0BkuMcgN45BmqE0LNZy6A?$qhivJSny-S7
z2$z_*Xgf&zzp`E0V2oHdyngig#p7?B=kW#j$mA(q;l~pH>D-0Xx>4R|n%{^B)eN_j
zdCDGs@qN%8Vdx;G4o;jih2o8_FI;n|jpg31qk=3&AGyuk<M%~J7C#J${zLy?)${h_
zI0h|&V~pByocgpXgDXlJ2$`2!<vA)ce1p|yQG0dfo$gWpPX+ikQ3vS*;$DjDnOEAF
zE~DUF`r8!sg2=gbl{E%N`TvaU!Bxuq{x<)l`0hri;>I`Z<kOk@M45MImwmH*Dpfg(
z)&rvzsQ;(v%72$DTpW&WAf~h#VQTF!|3#2JvB19<GGn{M)P8~JI=}1Y%iE-{KP-_2
z_rY<WC^rnLreDG6i`~Q&Jh{dHdnL*le`gub0@K@X9Q$S+0Nu&|ib=qxw(^3hdCUc5
z^kM)*8OzDoe=Rn!jyfPh>ZD6`SeE6LyEC3uUgsKOeJS&=#{z&RFVegEZglRP$U$qd
zp&}A&Kv3+jBx%MWuTl`B{PDxV`Da8n<NsBE<@Wq|TB3ibhM8^<yZFeMq_S;#%8Wax
zIo};-4Yti?{AYO%-hMVPj{0R)M#usXGsD4&+j%eR&#{(Yl~Q_TwX6-J&lmUjAG`u^
zNEh5qeo65c+X5=NWi`?ercy!BE6*@KF%7Meb3FMW&cNIZ)Jm^ST=_RI&a?aUJ$Wvs
z&m&fB=tW;z6Guvjw;j21<udh0bo*z@MY?q*7rM)DZAYHNA5r~#pmO{if2!jbhkAM*
zkFug%6`lngx#HQAyc`!(3!S#<JC2vfc5eqGeQLs;9rLqS68@{qpF6$<%m=^hBw$jD
z{HyoNk|i~^Gs8k^lcs*1yV5c>qo}`qnev(($DEjJ;>98epzh4%Ou5ZAd}_nTc0=Zu
zk@5Vb$=zPchtG*V1du;JyLdLg@|^LXQ^itj&}*j2vU>!4ax;FO_h|0Ox8FLWC)$C5
zgZ!$!TqaKDeAwm6WqCtxe>)P(zCL`_mah$+s!G&vdu;G3U0>nDD)~v|#gwHY>oM>b
zYnhi#nbRzL9r%DildMjDpBV3@_bSE7>a{%<cHuxd{*dC;i}9d(U~QyMQ~DeBiHWJs
zoz#}!OHh1=7+~#Ymr=!)d8usRhpU2oOD-Bop@j3aTK7JA$yl?oQr16aaoPA*{ZmU!
zDnr}=I%X0p`&2{l?!VsAt>QlOtgD~A7c;m(I-S=v=!b$9Hw{Wxg}z6^e`N+n=V|p(
z@LkN}c!;uazR<I1R=shG%YD|Hd<PF(vY2fu?MuPfXC6`Rsq&tbpWj()lft|p3<+1p
zMrzS*-YzYV{7#nOo|^~Nr-d;E{w|krN}{*jSmA+N^m`F~Se20*yJ_Kf{>+`CsfSU$
z_c#k9H4r2eS0wvht`Wyu%!{<#MF!Q#)mX&kkq0J`-5EsBUCfZ%RHmxemM8mH!-{a6
z2?f=VU*Cx}Dxp~xeS?Zn1CKleD*=MzDmw2`%ng~$4(c8Xr|ewrlcDoVlpE%_mit%W
z?Dk<GA+>L8^CqDmfG|cVbebfpM)<<^wn*!to3}UuTcu_4;(8EwFQ#!m{?Qp+f8Y!U
z`}9ft*6o=oul1ol;o*QU%Z%Q6@IL5L+SPssJ$(RgRIlQ$AUsJd!#{g|F(0aa)1FOj
zr?sHimayj6uH7OC3Z)$d7Ru5}L#eU=1x53iTdwxKs&$O)(;L@`4ky!NRlKLC*a1aH
z6V&T7MdU7CWuV;3@wCR3iPdNOH^Wq~Om~K}jDH`MxzfSA00)<ck}Dt5Gj6#tYZgTT
zKyv2Q*CrI(SAgg_OWnqPSz7(X-f~YI**Pxsaz>6rN;0T*vf##0*ePBfjw`D1vRxv}
zD?D=Vbb6d6k{;Z(hIC#kxe~bli$3#_I#a<{S<potsL|X3G;<59kuFrd6$s-&vUY9a
z-Ys>a#!hewyZ>!lyEaVoZ>T5}EG9fqu99a*IMs^9bjxjGidzE%1Cc`O(RY-Ya1*5V
zsC_sTmH0?sQ%j4soi3D|4U7MqmXlY5S;o~P&20oAp{pMj=m`fZf8~={3x9Q#GMZ}<
zW(kZ;LflrLxU~7<o!~4jEbi3U$*mJ(MaH3m#!SG_==}E7PXI^r=Yp|z&>j^JaRD``
z9-UhmzI^rSg!ZYD658!W;yzkW@!*OKSq9FJ&Ont2;-Es*B`MdL*SUuLsd~2(f13hr
zJ5MQKGj82Beaa-@kjex70}RhpUJu@h!0iiThB7#P#J9eJeq8H*be@6z%2dq_k9WWj
z;^INYXLrVgJot7qDUgr^5G4&7P0y<|#5$HzXAQvEQ?Kl;@@?arBL}~;gP(lTQNGa(
za;G`m{%EPw4v?XowFrQeLcK6?HoQC)JhjZu8kcGnHALPD5Sa)%j6dP_xd0ku+7A41
zl7;BsW4X<=nSK*=#<SBjfc@CvpoQU1)bRG0fTJ`vOa#um0|9VK_5&M(lstHC*%zTe
zVE9;~`M|5Al3_IsaLG>BN)ADUu?R{K+P;57=ly(t{M$q5-(I0m0Ex#yrcEs9b3&|<
z*=0~|``(FrT+SLxEdmb6Ycq5|N-pg>ki=JZv-|0>(myctxzP+tgP8FuCa-|cP}JMO
zftM>ypN2pD^4jI_ivF)%o++EEa?tZAFT7N5AkXwffou=^MfYBeXdnRRX`>8wmJfy=
zO78Y+rNfVbE9!77TUS@db|(Q|`mz)^WGFAD%F5A~!|mhKOUr`)!kEue0yENofIfS*
z{n&XK9inDnV2^@lajSR*8mI3N05Z;T1}|Pe?Ov0%?B~SlT;KW{Us#cL2{~kaJYL&_
z`PQc^`UjF1Q#bTYY1OBjnSVQvqTxX5zFly*G58}KR(ab{`C2m|;@E;{uF&Q++L&Tx
z)E9K`!K{9cp@|_n_AOjdOujf!h|<4bp<)%IptRfbRo_1%M)OeF=no9vX6x#n`03FJ
zpRBLR&1n~Ga<iU->yKnDo>bgrV`jhhf$K!_VyBfG9c7fKEc;c!wp-cF|Bf-xO;?`)
ztw&Z|eCHn#Zsa6L-in+RY_XldD+!_oHi?l(DZq2!sR~-}1BN+<(*D1`sT^td-B2Af
zUGEpVdXkjmbVGA)oqu^rZAUzUBYACfhZm}-A!>ShA}1(T@|97{a#qwX%iS7_wSBDQ
zQKo5trw{H%VnRZV_wUtKw@?3KxIEjw9dmMp`}gm^d@1wQDn?S{&(7}np3oT`a;?HA
zp?`#x@!UbD&vYTb3iKeARaJZ2zgLBc%inqIsOstIS(5q}q=q1t7bp|IeV@3-IPPN5
z=$m+DI>>;grL()+8p2|;{RD3sRDj0>gf?!s^4aU0m4q6*V(KX<>#C)H^b*Cha$S}2
zN+<WN&M?xh4(!XQtaM2{c+n4Pa6fQic|Cnw9OvhD=0N&-sR;1RJn9M$2Rn~`Le=Xf
z2Uk2494Nk(gD*dAZ1Q5g`Gdo!cw@;T;Ame8J;zP3x|&333krYonYB`_!B42YI<Ea&
z6Q7>Em0X%|a6*%*69extE}hEjv|JG=!SoR#f1H-o-kv|L=hr$5-L5I>1Vxc+y`@KD
z8o@W^*8O1TU0NdlCo-ureR2MwG%}{F*rQhKPDXDe*RI&hLRnnkKMvEy$)>^6#Uxkq
zxpZ6+)<IPjkmHCQT%HJ!_;P_$|2IpY|8XUP{*qwxh1}H(wkxedC*;@(=1Yo&+Jc}Z
z`t#JVDXWm0x|&I1!qr}4iO*#ZABc<RxIvXXFtq1$OoMY7k4LUhTF^nnAr%@Be`}a>
zdxYpCf8g8mFfKz{R5<Xm=|`Vwsl#GJw`ar_0XI-^rRN>)=yHl1PhGSxZsunGLkCam
zwag{lnEf*)n~^%VKH7xKfFwYx25`ckU#Y7_FF(5dxYGIGPtOKK+$vzZj2+7^hra<d
zS<Qf~dmx5>wLUN)=g#Jlk@629p-x;XI-Cs1?}$-ejn!*adm&(8hGT>#`k%RfB#;t4
z$AbwyO+TBZYLDcS8zHVd=DUDjUkn`Oa9sMT90c_(H~iY=82WwX)a0|@biW^HjdE}>
zFpHQo`?zRfF;yzUzYo{mH=a#;_sb6`z69c<qF!)piJPhEB+7B)>=ajyMxiq^!y}pP
zcGq>6$~y<X2>!LRemCXg`l#^+Wc>s;;<82n5vDU5U7iU^iMRi`-H|EmJkAd~tkt%f
zSysKCBgScn%I{eD9-e!yYw)k4pk!<0Za5PqX)BnokS5Ws7=d)b{QMn8r_XO&dAi7C
zB@X;2)<Vd+db^dOLwS3ZHutLRaOi|>G-_mTZRuFSOMK}o$WE<>@=kay;|dLuUKVJ1
z;`VhFSq<%$`?|6sw<Q{I5rQ9mPpa%Y6NVHbctqT~#Ev&>v<+fjmZVnvT4j&Ayl^^+
znDUODEKbP^qkGuqwUjb@g`~rML&a{4XQz#wSJXA%tDAqaxry-6MuebS<H4<S%ag;I
zkV?z$<bCMb(a7mWV<Nd(Th=;ril^YD&RK#!B;9OdvP#?&A{F3;`R+BW2`T-iFX(mV
zi|#3ud~06M<gkevzIZy2K08jLTjX&Y<4M?k6o*nm9C|$IQ*7+m_g6)OswMqdgphUL
z!v+76MmO3D;E{!@>RcWzo8%wK9{N7V=TN`+1&B(P6O!8>q@7(a(J4b8tyLMT<C2|M
zr{2AuDby7`#Ti4aPx}>Dxb%aM-9mh(yermLa`A3*aOMslY(+P3Tz^xOh%7bj<bG{d
zuYGwRhMm|K#cZBdy_;#C4I=4u-`L;&7#+8?=pb@-TwbJq_&nj^J)`p5^?;qa(-T&z
z4{$<uh`3_iS3+KHUpE?~-f-Nzr<@A&ZL!H6lb8SLJ~eTi6$LT*`#LIqY4MU&Y;Nk+
zHUhkxuyLV{Q`GU+Tu$JdkyondlX+^zL^`^}4W#RIl;nVZ)m!T3j~}^43|^I+1yx9m
zEp}Uc6{I`eeTC-j-M!Wf3cU^!-iHfrrWrdWJ(G8B$48ZjT7=%f>zC@WjFT`)NSwoH
zDQxjYEcrnh_|j@PeGIruz6TePf=m$DHbS{M>=5>~3$#|xQzr9iG&HXFB)v{dn2jSH
z804i8Ewo=ld|K#KN_boiS<QL|S9~79h>@FuhtY9e^4nePeg$N*<XWd19FcsA8uLqZ
zJ*kEj#*L%)9zyG1d9FYPfRE*N7jIIEh_s$wd%osx61se){6|SG`?Z+2<xP6IX-3%X
zPF@k0yFjJOx+mGi@>vkT>WH9y&+5IGdYGdmYR<kob_hW48&*H6hw7u7yC*$6sc=?Z
zqi%B%kiPjOD_b&F3|I6d92$UfK<(`g$~!MDMzN$!mRmF(Y(b)(PY?Nz_Q^2MfK@Fd
zdhDn3*6eSN&V=}f`Uy^>rjy24pB*yD5TiihX;JmJY8!kSnxMvGvz%`tFfPODo^}GJ
zac9*YU8|g-0xLRN+83$GFDt(7a*YKL@cW?o_fRCTgQiCh19x{99UGE{i@s`BSRVGI
zT#3E2MNZEu^z>Oft0=swEk?_2f09B1f(nkio|o6>P&K8#UmEriEF-h5zbvoLhQQ)s
zF5CIQx$k?x2B}OD7p-!d^Q*eZ?`G6Bshf8hs|L$$bG}*SWXqQm(^yz6<Pdg{uRq|*
zv|6C%&dD?znTtXN1%3a2jlBg_l+o8OJYax;5+WUffJh_KB`|`5bhk)KcXu};-BQxc
z&?y4al0!Gr-3)OL_<!H~-fw;DyWcEy&CK)6eopMY&)L8IJLiC1%iIsTLZ6V{+1|Gp
z`hB@PyNx$)>(r2O_fArjzkT!*l^^QMkCcj%+d<~zaZWNa1UA554G!cKJ>1SF=HMDW
z1>Q|UsfaF~hn?b4x~41=#9lU1Qx5sd7by?mI^JA5z7rA}v}i_pYY@jI31~Q9dbg&z
zD{NMcoMV7;<u7FcV@Omrb{}cn$iJF%bNDpdkRmMr?D-z#OJ5Ra!|Ck2H0jx9NqHDC
z()YnOOpE&CvGTs8!_F|9j~sEqXb{?go{FJiB#4}xajK>FsaR6B`U<bT3Lzon(`aD=
z=+VD3_T(~3va+dhhWZA`Z;jjh?MfQtE`q<`GpyY;>lZj*z8cP1^*Gnxwi)On=f#tg
zuRxs6kw@+(jx{(<gp;1@c8=9923LxPQL5a#n_0OlGzN65y!yhv$yp*>^2Iq!EfUPO
zzkZ92)yh-~bCxt2voOzA7%hx{FDyP*!mL`42ieeYEsKgkdJEK5b*8=m9kjpxR27n^
z6D96d^==Z+GssXPyUj+)lgo2MpcAa;C#AVA6Z#;#H4)30#N1$Mmm{?)#iax6{)<aF
z=zJxIjpfUVtK$0Pj&F(uB(jHROS(g8!EOkS2!gV6Z}bDf8@_C*6j4lpwV7YU6tSbr
z6NW{h81=cit_XX`t)0a#j(k{-AVr6)n@t&z*+oa4<9|%_)r8f-wa_8&Z2lIKvwQ+i
zB_80?-3=h0q^9oIX5+E99YXN$Hdg;ouO1B`Z(8Z5KlM0Gxp)VRZ0}^_;`*xbWU|da
z8)o`wWo2r&!R8oStZ;qO4x#A)jHrY6lk5D3rW-qC>-=n~G0oi=A0IAobu@Bue8r*R
z63s71{3h4seC5+re^LLPumANmKMrfGaPAEwJ+G39L{E3IYRQ+i71W=hum2wFlQ<i-
zd|u&oC?@B!1imxIY(~vwZ{GR0SI};?vI5sBi9wpJT-Z{$M4lqLY5k|}=y+Eb6+OG%
z*}sV0%^BOM;n9QX>D$`u7gjWEz&;g5tK8Vf#E}DayLWSW50ZDhp^r&`bwxL<R#oUR
zWftCFyC=N;4k=VqV{5uE$)=whGSB7m%*lx>vjB`(MKm9ObKkh;Bo^yUl&47ZmANgy
zx9~EsXr9^X<E%h=Ty8w(8ypNq_^KJ(VPN4bTQ=e|b!JWHKL%e!=#e^*WMu>QkD!s7
zb{tckl}t~^B%$~0<=QGG;&+Y)n@AyIlpzqoSQ_LFO%FG5DX9f%LDEm0fzC=)cUn0p
z(~bjdpF59`{d0Z)NH5VkyY=UKsm1TqMT+!dTw`g>>+6I8<U7+N%152#E9d7ihueM?
zhRVyU_uih&w|-4bbXyF9lzL27`Zl~{f$6keaL!EwLSj_~I2LDL6c}0`qgFXot#HBZ
z)J~;o`aGu#9N8X5n8L%IfyHmDpe1;i*?o9GBHIzla6Ccv%5K9}r9A6AR~9JodYzrR
zMFVTTnXVq0dkq!xIH!KFrow$leX5K3t!7UYHJmSXEVRFV!dp0)8Buk$5~uW(W`u+b
z3vx1$=!c)n{psy6T+8HUHH}f=X4+|f<C@(4YZJZ8pXU}ORgtOjiK(eJtq&N%0rgkA
z&GmNvz%vV8Enm&-wIIDsp)ZC&Xc>zJbEG>c0`8mEpU~>c8N-V`h9x1Thj}^EG|tD=
zw@vuVn+|AOzHkBc6XDlt)%`~BCy<j+BE@oN*sw~O!>*U$&99K`vAp3e7+lSL|DD=W
z#|qfa$)Z7)drphRF8@W9hW*5a*S!=E#-2XLi>uRk+m_^%2*K3TF?A`t$jR?W(J|cH
zQr}2$=;;ei2n```_ka3L?bc*EE(p`o(@)jG_5#SCl$w38813%vM)q`*|DmuogASQJ
z<Yt3)eK0l-TZ$<0*ers`G<<5kwrCDBf7<qAzM!NM^rJz{?j%^44cCYgGzdLx8LGr%
z+`5MXX%UyOF{fwLY;;Eajzlyg`e&QT0fa%!Q7IvT)WXR1X1%S(iZ{(MV-2pIUfA2+
zFV)p;J=wT~Gv?Jp#>G<f4jqz9jE>pRPaT)VZlP6YZ+28bc{>yTnHd~2key|yls<}s
z^5WI2$2-j)Q;gNoW;1oilP1IJFu=>McRW8J>Le?eWsR51kxJ=do;&Vk11c9+sI{$l
z)xJK}W530<*GUffI$H-*ey$AKSyQFPVzQEm-^ID$)m**9R8h6_&E)(}{jhpvV3h@>
z{#5nu)mrAvfM5ji@Km*OO69Gc0e9HoVb=V~>##J+|8z$AY|3H<+?d4YG`HL}iyTJg
z!qDTCWo&E=W|8ApKheR+Rrn55wQp_Y6=FH+ibu)tSKv%Z!)JWF9rvr_tyZ7R$={Z=
zb4@cJdWff;a^z`IAuF}D!2Keb)`R9wR%Z&qXJ$&~cL_L~P;2w&-hEPL<}z3LWmaB~
z-#E=Kc4Tn`3lw{+sM`2s7ZdUf<;m97p2(_d3Yn6@k81i}Op@FAFssXy@0={&dr31(
zxaQP^X3am3=S%k&>qk}xwNKcvaga|`=*hOa>z>fbccJyZq&TxVtp;oTFf#BMw<`Mu
zH4%R<i=BR#t7Aux`a>>4pjPWW%$#5ZUrnov(?Ev!+5A<&{r++%HkM~M&gR<6G<RI?
zw3~iY!@c%U_yIi|TcaByIfThrz!;anMO6x>4qE6p*OAQ2W=WHY@|_svG3c&cuEUHS
z7`izsB;ul-kCQF(Y|d901+EFkU5FG43k!K(h(g|W4Q0Or2Mdpi`nSyvW|Deouf<K)
zSpAI@Lw+mZ!l>7VLYC_`ruv0Z9oaJ`CB<n(_E;?3^r+=tzxFWL>>Gqc>?lucwd~@-
zoFGiAkx1~$wn(Q9qdsz`MEfeqq8Lo-vvNel#npOZCq(?;+|1wGeM~Y)USpJNw~=>7
zO>)<C(1@6rZNzwWZkgg21k?Nmo>}-fjCa5yjJwY#UnYaXqer}15FBL|qg~1@H75b}
z+*arH?Ic8yqo4D-VU|&V*|J!z|AwSmp(gY;Jbur`{TLJJltO8?t&m|p0yZQ#-<^S?
zP5sm=u@?@wc9mb20Mi!$8~%uihsT>{S_9p?euEjr>OYNwum0rI^s5A9hVx#IKP@+|
ziLkvn?0mHu+b>}n_b-q|_0EkY87k9Eo9%oS7fmv8UV2LzV`BPX8$p@FL*>hEGRl1w
zJauSYy)!WP81jWMAxFdduv2=j)?#-D>HxM|_!q+Giw%&?Ou|f3f>IN!0JQ5HGzV!(
z52)OoDL^bz_uw<BIrmTG*lqo>-~aY3X!A>@LV$1SmnjjX`L-PMQ?>qvli5Ra*V5<G
zj>-pK89((8-BsB=%=J$rayeA+_}6Fg>p1;ypB1<vJj25sV7GDBlPrk#r}4+ivlWP?
zN=`Vxi>*4?%2nHgnJY`T{;0B&-{te+btzP~os2G%np$x-c(=*X=G4A+x<Du@Hb;}A
zT$Isy<vBLR-+>)L)c*wRP*}S83<*R9=Dd9}O*$*c>#!qmSt{auvQ}le@U8h;>y|Eq
zI1(@)T+~mhzTf1=v!3_lNxJdJt$~3g7V$&lrN{xd*+R1%_K@pbUoGs>i0DaJBfJ$G
zr(c)x-?Er|dQkZBr5asu@a5%zcYA=XDZF0Uq4VWO+vbdH(BeAjlR;p4a7;|h<aeQW
zLSC9`;-}$tDzP!CsdDvI?X#bx{sRoJx&BI@iP*ka)xKfSDo37UPh4|v_w-?+pb9i9
zEiadQb@*=;7gszNNWkCTdD`&cmgBOxClawaYuD;c4H#SEw#}dKP3YgL?ycY^68muq
zdZl938l#EG6kbwz<L2BUUT;!!E*OdpF~}3wirXRowI&;M$dR627Q8?m?Dw4QP_ol$
z&wEkQ40yAZ7!YH9c%ga@4`1;&kWu<CZTmA^D&z(MTlQ}^xgk7mbY}s-<mpT%fymuH
z3U@OI-&BCb=eQrbY0b`pU1y-D)J(U^l953f>ethz68~Q+=aX=7a6rnNe;Cr4FCtu{
zzikbvnU4+Vk&w8DCm{*Ad_|kF%5v5J_2gV{Ts%^UCs>YvezJWESVmG(I<m6V_H<ge
z(v7sQvoKQy@62QbL&enNIyGolP`i@3d5Gt~7Ft1LUT``X0=B<l8asny8DOj_OL;7c
z+ks8wJ{|uQRARn-G1&N@(xGPXuviTpfnAOavT_iNrG~q+fOpirC6}BFaL>DXg2sko
zboER{tuZM)RNUhCeYRrdR3)9PByrcl;GW1{1(<JXWer-<KY}_iHOhp%&yRGvt{WAN
zVE^4`T_2xGp!Nix#*yy1otWrF<83q3hwt<JQ#ernZ)y3bG6@-tyvF)tl??PWCKdE_
z!6$z^^b~)!ww(pdeN1CT?4F0%IBb2i)xK@7xQ;L)d)~UkuR<@A`CX0fQh~Dixy~TA
z(o!q6Q*;iS{Gtkz8?KNWqMYyzE-ybAx~GqF5`*{bS3>}l-C#J@?8bdBZ^CAc6r87n
z^+9YWJY}x;Y(0rkFf5Jhs!MF=%S6MM3>T0Kl6`P1R^*E;(uy^7#b#3z^M>0(C&T5o
ziSDzy^pjW5Uj43-){?dr10~CcC>HvEeU9@xeqa7B>z9jjd4B56x|BmzhYy~lc&nN}
zqdyEcN!#Mz)<k|yEa^6@efKqWj}lECI=IdE)lsG-)_omhfVSy$_iH)@?I42(>Y!a2
zfs9)G+yC7|zl6~K2O@{^>VE*6Bv~^5oyG>~KH>l8k95S_9v=To8~?<;7^DG+sTV*m
zz$%iqCm;Tg()k)EVT~2XXx1y)gNiHAGu6)bLLIz-DzW&vS3UxJ-c(jrN~Q3CI>tcN
zGI+6c0Z`9VX))a7mIQhV`7LPP0_760phpC(e9Nd8RdDjh;MxDx#BXqQ;F7_6o5}H=
zU-s(6B((i}+q6){?BVoni*xvB5{CuCX7+M=It3gZJ6XkFot5=w@G2M`oXul8U9+$d
zKsr<<Ne@w}c3<ixcYo+vWu|_-GkR6C(`gD0as#V?z|X{OIfL^1L{4X&yH%B=qm>5I
z?%g_SA+SXk+10>y(9Q$UG4Ws-1K2{m%AhY1tTsXRe8Efp5CXXL7IRIytNk-z=ad8V
z6Y9DM*31hk-y96W_<G&dWbGT3dh^Ux6tG{|N_DMAwaHYzNI(_f!LGMObW&ACK^1d!
z5ghcZH!SXpoWq8_*DlwK)1<slXI_A=|Cw!-=|2+=&Mo}&$Pg1at|p*uFtFHBv&`8H
ztjGk+oLipRc2a^Q5hut%>11|121lu+M5Z=@^-FU%@o{VB9sc03Oyrht)ID&EaR&C-
z*w|u~TCmaJuiBvK=NYS83nE{t{u#4uSXbYSYPETaYJ~^jL(PJ{K|#V`Cbhope7J0;
zuF`mduWTlSV)P{a^?%!KWMoo(CZPNS0&gli0uIt<Bs_Yb0AIG+d=wc1k_TgXQBjGB
ziE9EK5C4bDy<fGubKeuJFfZ1uwrcB;Z1aC&I{y9I^V+SV{53cQ<}u_k@rbl7x$eFH
zp}NS3Qve1%V>cTjfE*m2f~EJvz2qK9o`A~@cK*bTi^d?abiKN;dpg~tA_LB94S7QH
zySw`UVFKc&L9cr;6Xc*t@BZ?c)T{q;7*AtC#)_vbe^YGVG&dr`EixN!AlIXng*rVh
z5#v$~DJkQG{r2|AUVG?&O2xhKCWY0zBk*VizgJd9zcr%B4i$cnPC;DWHM{@5L9C&g
zdg`0LL~Nl|vmg_;6ki6FJ<~VAUHtp&JA*T;Os|LFr+foNDzWK<_LWst==Z(H<BhyL
zrTHd3=HI*2$8Kg-|FSE_GKTRmGq1cgX>5ollI%1Ky$88{Nqx+gLwRs<cz!uHc5-v+
zFx9V#uy?CZ8(6)$n8<N;YizzSFm$Q6*Xbas{n%kQq`t`WKu1wgaw~q#{YGH<^+f!j
ztfC^UTJYJOIIhfCJa%l!1U@Dvj*iYwiK+CbLC^ug(~8nR^UW4#U}dgwk=&FiN3rfK
z9en+@b6x`-1qBB`|8YyJ?g;`5CsKwsnVnuTbDOp#caeqcpUlW7nuhv{eYvvOpCbb`
zah^WQJ34Z`@saMP&u7EyJvmX@newQSC|TuLWwcK5{u&rg#vc>O>Y~%JB@!S_5Jp4!
z?fvxM0SO0(xUDIN_)Xh8sq-JDlKI4-WN5V!5%9{&uFqv_J|5Tg4H=0kvVU7zGy4TR
zziJdd-}+;>Gv(l@(~(@itM)BT``7AzRMgW@(WNH00N(oKdP|f$X;N!E^|mRR4}D~5
zas7QC`ujgXAkN9ou8mAgc;SQoo)XV|p(7L7b4@n8HPOC7PdjjAwX|f--6PR$w;$X|
zcmm5EL12=ka5~Unlk(YqEHYo>8T?}j1NA9XGCA?P94Z(0Cup2)u>%`igO}xlKE`~D
z<|%1tT|ZNC1qLBL1FCAjK+V&;t2=Ls70}8xR;&JfgjkBmU?JaK36-HmMY?+@N*hNi
zg39udAagK(II>+Bqs<NvT&N+65ED*sY4dp*X-WE^g?k>2qUCYvy6spM$Ll27$3V(-
z5P^TMfr)yOWX=)~ny1ZMA=G)=4!v?ad+U_jhZGNtO?1V7)X0HYB7=vK_!(nCAT2@j
zKEy59x1ZbN`!vLEiy*e}UtbwiSf$*4L*kEV4ng_;{Qm6+2toS)Td8q<?=C`K;GzlN
zz4OFIdq8pbt_9W48$1iVKKTj@p|UIzR8DdZ4b8rn=$UDB`OblW7rDG(-1ZqQuyAK4
zCEe0GIN7RQ4?9w{UPi4~HIpC4G9SbCNsBTWb3gd~!Xhhs+x<|oPV?m@k<YF|j$D}u
zIwl!OKL3;Q&5f<C68Ec32RvqXAg~z#uKVjbbMGY(fBo>yZF|~?h(Q_jaI8roE$pl`
zQGYWdLRb4$)ztmm-M@_}lys7>*4A>L9W?N}NV#1*shbu3>FeWt^X3h;{zf9Zz{0{k
zm<25@7tBgm-40fq{cdL!AB&V!&_Zj``$70tK>_S|W~C=+Z3nJpvqx<iBH+9yq^Q60
z%VkIPGHK2-WkqS*4Y9pdq<)o|kvd-a<vRxoyvQUkSLWe^2ccx!_@pxm8m_!gL1(o*
z7nKoOOaD4$`Y}#xzz)mOjlaFU$m6=Awm96)*xZQ4V#c_)_vrj;cSbbAUJo6H&s+r`
zeGpD&22)XZ_AEa*cu^!E6>Pofm!>_}k;7@uciD<^l9PDhEa}#mpYi$ohE%>nlkMN$
zc_ci6)9IgJodXqJ=|gVa<YY@Rd!COMJ8GJmlF%jP;^gbSwqz(MlBZW_wD%v0^;*aM
zhM}Q@tz^F93eQcpWM0FPhugg{SjTV<DFdn@-^JQb?JIGrNG#bg&bcj+;4)7sPXGSg
zyg%7QZA`1dak&jM=sh6`A0p_bsAR(D3Kcab&HSDLLt@v<y|zAmecd?5C?^+uavmzI
zAhL_SHqe(e87s_<RI;>N{HImT2i+&iTKi8PUrhk<+SN=phXyCC*b{|g(=+up4!h<h
zMeIhfrpQQoZ6|740j;T#%2Q^KyzcIDRR(Kv^0dG}-&&iOg=+0f`wzM6q+l0U^}AK7
zMW+qt2A9d)&=CcV%P!pr?7=o-jv5zd^O_rX%DUa6>W-|Or-K*I=xvSdCVepbUH&GR
za45Pi{~nvW3J;8JI{Vz(<R+P&4W2tZRvebZpJXQEyrnWWR<w~%7t)1GK%8_k?=zT}
z2i5yyJQ4MEf2+dI$%%bpqRi$mgWH0iW=XS_{Xv#&&Qpo(CT#4?A0I!s%_BKrM$Gau
z^4P8|=cL(JR^ER}Q|!1-T_xW9H}u$G4t@})6`aBikVy22l?nA~1B)4P=z!^r^Uh{T
z3C{wa#8@oj0~E}v(UF=iz4WfGb;0u>3+R1pyG>g$!He9y-1myII_vBEA;F1t27NUv
zJt!0F<Jl4u)!kkWvtLR|FhfI<26I?8$JV7>PgLy;epHnWw#^CBv9n*5byAU$HDa0_
zY>YY~PGF-WzS&v5ZWrsG@$u4RE}@OnIr)XIFBrpSX4ck+x9d+Lf<NCF1g-t{e=Npf
zTDr^1!S8mgZt>W?6dv{%c!g>sD6VfRS?~jN1HvPJbbR!he&iS43%?_;<I;Fn*T*^4
z^krmb+Cw@8uSSf^Mpjp_BNg&6#NV$?m2WM7@Ye}6T1RINO?>UAnY(uwlE6{qP?6z-
z!pP5$R8}^YnmXH)O-8n`)Ct$Bc?(5iWtC%QuB~>MYb4QV7695qX&u$&y||>_-K}O~
z4Bqgnt0hWEyy%FiR%O`e?oLcjPE00Q+@~p4WB)z)>hdx}UY<FHN740+MI8%|j0Xx8
z(9zM+?W|H#uIM}aNqj~=a_um?kM<;%E+*{VJ6>%!c2k6XLY(qKtIw3SlV4zih_Ifx
zzMYbiozhrh^HtGl7x%$J0H1(1AxW<QBe(M#E`ij}Rg<JdqL2{ckPui{m_zePVq>FJ
z_T=?J&-LISO=Hu><#|b}%TDLbb@h_$x$r`6R}?WCx(mj`ftI(sr7V;<!R>Ie{yMvf
zsj7X)hVM08DQcRwYceb6htlSgS$l`P<vJq$C)=rBUZCVSk;S#OG`#f|LXKhKfB%+v
z91=%qG2@2R!zLM-o5o#=U^#}vYy)q!>!@%;?&<0(K6|#>d|g*obGGo9cnj7jRW#dd
zu4!cbI%1%N%cV*^$7L%@8d+EOF_EO0O@#{G;}0LHC~G66cNs&nhGe5&D(f5IL`pl>
zh`ohiv&Y5SZ`y{FY|WQ};m?0Gzdn{0*BUXr_XmqIzsRDLd428A_BbrUM^B{t7+si|
zS--<u6^E14A&AOY0qXSb89b<^omDimwy9}O@$ZIl`9$FEA3dpuDdAT{lF%J8GKa>C
ze8abI=M2o)*`dGi(O%F<k?5Hy6&!=I3(L!4sG04q=qz;<Id8MuV=Pn#kZn}Q<^4$a
zDth?hrBuVIw8uAE+!SM2*Qe){H-niTO>VqxEJdTE{14k&Pv<O{UghyQnD2qvz&AXm
z2HOpViJ+(a4}E^mG_JKEQ4-agPRy4O{W=ODOFSRfJw89babJ8?(KVu>MwF81yp?uC
zmGKB{5A1a9L^*jF*Su^x=YAO_?TqhBc71Ikcqy~9G(0*c3XFP+CbDainCQsN%*o~S
zuluRy`Di0KP;h!JCu;ru#gI9-(;4!caXDF8+cQf!QGXxqcDZ$*O?ZVas_qZzT?dTx
zAL$e>Qyi3P=Nknd2njLTE={)86yLSimNX^a9HwomsRhzH?JrJ9^R-s(DioB|&&d;W
zCLTFA$()Vnq+N)KRpk6^s+w={`YRE4pK?%M+btUdZ75G+Q@OZspr_vUU^za4jhVcr
ztMY{WCNQ4GYdd3FML~~)D6VM_nb%*2kl<|o;@Grjc9(T7Fc1Y^V#rJuu3p7pwyj1v
zd3H3+&dvSbN)RJV0rDlL#!6+<!*VZKF>FpWI1q1W|9EVTLwANA6XG+YHa5l(q8m8a
zu2qpvvN;XatPj(eR8CfLJcie{#Ozby$Ql{VF=axjf<tXfiKsHhkB;Wjcofsp(m-yz
z)$1OwmfP_@nE&pbHrqRdn^}%zeMo=x3QDC&SCaRrL_$-wOCWy#_X`|9??7C4cQi`M
z4OW6Dh3d-IN3<?6-`bTJd_p9p4Wpt-cz<AEjO2~-kuihDn>BN`IIJ7*&jx0-CGX}^
zpI1=OnC=y5U1ioYQPnqFUR&5}P&S_SgF&-fYvdc^Y@8uhKF!133eF^7(%SK(m`Ow|
zU}QMTZDVI4vcU)&JDWkv^%GbW;geolIkFF!rYBFEmM}fW_X7mS<El04pwL12oY*u0
zw}XlSDfg3v>CTr_tX7ft*oG^kW3UHvKSW(-W(FDkoN+iUE*w!*gzB*;-MHIP&&eqn
zFr(_v&SF2M!HVpR(f+u`PNXmMr;q$){iYD6{oXim%56oOnP#$@*X;$O1^NUX*9w%i
zRX!0>)+^qBIy>ogTTRQ}>%BgvjUm&~X*JtU3=fwow(;7G>Q5NnZ^yr4kd|yr-`+dB
zEG^T$%E&-_Lc(GM!?)i~JU&~3SAsEzj@NzKploD$IW&>a>AU1BS2qhIxN@yr{PFgL
zBdGM^3o$CR_T|w6V1|4ZU*yl%hm|VM>ymKmYN>nE(qQ@$U6C(Ly|7ba?VY+w5NB=l
z2>lY#C;gIi)RZnaqW(Ht+194c&Yw(8cRM%=Mz3oe@H@B6ruwf=o1xL=dLQIOMeU^e
z*O{B1Q>vG|zzKwIX`LY>P01hmqrr(^pEn`4{AjVe8XAL)hBiib#Pt<#$G@`L%F3fN
zs}!}XC27IN{wf0hzFvW+8cu(bk~C7CZ>}2S?w@XC_onJ>*nRu*9<yQ2$Bv2v%;s1o
z8c$t{lsNxP`gg?6xHLDXIQa){;`(Z7b$3N|oS!*j%bJ+DC@O9*cP&j$fyo?RZwl`V
zhBqqN=2zE$9!ZqY--EP4&*yz+a->hA<4(0`!^2M+E~ZZ2I%D`prFjTkr3Xywz3wom
zn6nO>n`>{0ZVwr_Ic+wG`f{3f!?&83L-|tD`gG5Tfk6R8i7K@R0rvL>4k#O}*)S>w
z$1UzPuNj>PU0+{q>5BrrEi34G$(Oucn#kgDU6^+1s}t|D+r0Z5sr(y0Q}1MX_TrYR
zeK+1oIWcxuW5YPgWQQnaepeUk%*b-f=e!Z#H<gV|smxft4X;ZcwXsOHw+nMtr|#_Z
zY&)kUj7_Rh9uTt|xA!nVm2I!JapRmC9UD_nBf=$CPfN2HSr4RbDGTy;)*YzT_k6nJ
zvEu6z;QO&@SKy><!bng0y|RgkoajRr$#NcEM2}(W7dob~JO#HBGHqC2e7yh9pZ-6E
z<(1=-G|YFydJjT^DJkWZ;cJ9!$ep1&`1Wr&(Mbr1yRH+z8+z*27PtPFrsu<8ZeL+|
zA^Lj{`+vSe6BZOqqYnAYUY$FT+PAoWrrQCPPUEPpeRp-0z63@N5QaY5*Of}^DnF@X
zfUtx@Gg?mP;I5Zt`&+6ZYK%w6F<IG8{MTGT(C~&ygR<o7#SnB}`}-Xo`Q1IoM31pQ
z@bO)c&aXZt6966aq~SERsw^_)t=|eMk+Y%@7fX=v!oq5fd_jcixQyf8r(eF0*vOo+
z9PX8T{n}NaYzRUhK->ncYHsZ$BGkG#cRlu!kB@~zNl{hRdO1)b&$Oh#q$JNuFQV{k
zR+i`5T5ND|aTNz=EguK}l{FbAru})Dw7@G~r*GRljy48@=gU=b+Dro0%Tb+VQNLGa
zNJ+sY{G^K!@!5pJPI0uU`AYIRj^;G1z=AkkrQ!U1)$PTLiKg(^%q3?6^37Ut(vFV0
zR#w*_tq{{a)22I0Y;mMjfbk^NcDGSgy$Z~+nwHmOn`Cl}^EZsmH1|TZ&)&Twz3voD
z6c@+6zP8mr`Yx?9K0o>#TT%nI@v}eWVbMuQ+VvYM?(@a!xf89V%1=Vz>~K&fZGpp&
zG8!apEMQgzhTjOmD+TvPlO6$VY-pC5>E+gbCm8d}!F)W06fWdL{%=MxKgP|Iy#9of
z(ahRSWcd1?SbqK{U4ik*wxEVO{5f98I9h3uq|M?ow}Ou)@BZ|3Lz+8}<5I_-8^XK!
zatN`WL)uK=_@|H2{KPb*OCcuV3rq!hX_02eWmkmUwWa_41U#DEgzO653<3m%ZvcAx
z=X4c58h*F27(y`;)=hA%_vf;v#zs1}itTQyv_{6W73Me)Ef|RhSLNl=u?@d??%7D+
z;%%6wzgo>#|0PP<$mnN-Q}}Ll;J4ywPl_)K!a5~~6<gVH89$_81Yz5DcEjY(zcZWb
znRzI6t}jvMT$qhF6x`I+fq&}y6b~9*9$rY8dj+QRhJxo=4)5QCC}7gxpIcgBqB<;~
z`NmuOQdm*Td}AXx`OW(E>1=)aMF6{g9}%XYVA7~sOhQ*brAt_-_O*2vI`jSZ&H_5R
z{MT&H+}(i=>K*kaKyg{ED79$|yL-W(X;JZ$z;LbWAqn`5?tDCJftClq<&lx%yLX!A
zJC_9(^AuPi<gPbYmE>2y*`9w-|Nfnclk*L?Q!BGO>mT*v>R(QW!r#6H=BAgH(y`fm
z-|Y1vSpI|(aTgMVzl=O)Yrn+Oxe(BMXli+G^&Tp$jtG;ySj;}sD05v1PjTV36%571
z4T548)*=%9I6Fls;CA*ii=v-UAM@!IoFcZmo0YHsz-BM~XkxR|7cRoUs5T!?f$^xe
zozd|u{6~*2`j#$+<58QD&$XByhP$9vO`rcp&t>7!8-JbfG%lCTq=Wqv<J?zum&^GM
z5+1un1+$VOH)Ga*^u9YgIFuVh+U(oD6Q&#lb=h(b;lls$o9T6p^yee?Yk|M#cJu2g
z0P8nP&LOPICsPJI9=sfQlxa~P`|n)%|HzZ4881N*&)%splq@JRVIh*7Hu#7C<<Q^+
zAzxlKM2j<Lziye6ULJqr1zeK>A-@fWiEKx53_YHr;^@KoWniF8)SxYxAi-<zq_@;k
zQ~&yrMdcgdj}<Am9+{->$XfDsQ%0l%_%)w&m(^-S6wc>Hw}!yn((hTNH5kLex7ZM*
zg|Y6dx+O)m=O%7jJGhmyT&<|~{2kolACLxtE)(hg2cVj#`9FXluF!}yd>~=f>lP!L
zU%lTV%Lh;VOaNrU{u@YYSEj8AzkN>lPZUni7XUxv3SRx|A90Ip<+Lc%I+~l`;Znsm
zQ;$5SJa-pb<HU<nQbN0+HG|YZQi|yF`P$k?xM(<w>P(&@dzr|VKEA?Uarp3m2$Mgg
zF7&P*kpBs!{r`ugZi@zC5nd4Rg>d?>52`;l?wAw_4clY@Ut6-1rM<*L&vNH03*DrJ
z^dmjEMcy_>t9Cew<-zq92m!G!tD3EyYhJ|LjZQlv$V*SAOi1|W-iHc4;JQ?+fst;n
zGq{%v36v<joJi&tuH$-Kke;%M3Xy8jM;EUBNE7v;Rtky9uZ*Dfe>9YaB}RH&oHbY)
z_;vm*rLmD|e}C7oQKd!za$Ji_trU<BdD4c$IgOky6OYBo^ZbvX`^S%VnvH`-<t614
zrrh`kU^+3KO)So2=O;rEmp$-Nvy7q57-l|kG81byr&=`jtmm~se|-K|-5;-Rr9mv;
z+baAz+wVg5dj96kZxM>!MsbQb#@_g)&CNc=s`M2eWz?6_L~&SxKQcue=H~~07(A=r
z`#mV%Dug7T^HIg_bm(WsP~nz_xyV1gN*S1&tNu}Sy;e4iblvn)Dzzxjth59N_5R`C
z{$3Rp#QbUJh;dGu?$39{SOyI7uoEvAb%hPm`jd$QAthb;o|6=p(IT^m;;Xdt!=YMn
z)Vo6Vdv`8Pn8sP~Y-cMxJVQ*}EF7NCk@FNQRWrs5_6!UJOeI(M1A&QsvEPOykgnY&
z;(7&LnCgopb+uQPmSSRgx;m!{O0#;6VU`3qcOsJ|3=QGqWkI@~G?Q@}HDA+|WnA|V
zx*_;|VIg5wCn3H}a#)k5Ro)px4GkHu<Y^ex%fD9^Qu4lx=*$GbaX2CA=t$vY832;4
zK47$2rr_R5-Ld5(izp(k+8$?<A@)g6>Rg)XkO8N6q6x=V-8J7{>DNa~Q648FFZ41u
z>goV8KEnCNiuBe6-a4x#xd#*lRmJI5#S7`=MOBlgybjw-JWuYfaup~#Fv@E1_t0Y7
z*{<2wh^H@jgS&rJk&!}?R06IKJ<dCu<s4CN&iX_|rp}~Te7zp0Y?Jc~rUd>iapV7T
z(I^smD=9hYF5cSWx6qgQ?y*bZ*T2(Gk7|*RU)*P~bXX#&OD7JkF(U}cyBe>bQGCg$
z*(dDu{f+St<qKvfVNNkElMx5gGdttC6)SmV2Ir$96Fd$jjqyu3N}$o08*_LX0;}G#
z6CtgDpNb{1Ea<{{I2PV^?%KS+;w`V<aQTAFz3-j-otsH6jldkSx2?<_Ia%4+F?XAq
zp8sLNIPtaa5bbBu&}=awCkOW{)~fHNm2(e21eGo5Pyqclw_zbj_$cYL!Oxt;KDs4e
zQC0QAP~PE~uvy<C_-e_*xx#!0Zm(?lrvc@f1<=r@kKA`HMI3GA{7x%~g9G$#Ef|>S
zJG7raGhQcr<Z#zGSc}iCSS>H9%}V02%g|t=XDpy)pj%?03MH9|dAU9MT~pd6yXi9i
z#e;O{--&vLS6r|aL>Tka{f>V3y}t)X+X_zmdvU5L0<3lp{+&5~VF}K*hvY$PFD*#p
zoGvD`72Wp{Z1rOfm17S?!&B^b(cKrWUNUo67p(P$k99~q)GT;Q`y@g_b8jy#3(bO(
zu4mR`f3M@@FIqu%C-WQgp^TRq-wd$_S4$Yia`U5x;iZ1beV?ya57|D>)QzkNN^4%Q
zC5?WwSv&l8IQK=7{c{il%WM6MndXB>!894=h5Rl8*X-DgF4kA)Zsaib=suUdo5XzU
zZL#Y8;~2BY`p_)d(FTM9A9ml(pvkJe$9UcsB3^_Sw}}=Fr9^~Po5c_Ve@DXUrTwC}
zm<xFiyQXNE^LCe+he>glg++0tYOi>6U=U#h^+1Eg*UZ_g!HPKR6NG=q^;$M5G}`4z
zP^`&0CD8rEJXVF0csUuXEqV4_OLL-j%>Q*o*YilH@Prz@oqHwI({o&)W2PxlT%J$v
zDy}tXEO#71Z3Pa0f`NaEee%JfVP7hHUtgajWn^yxzgz32DhNVJc~4UZ8d~f`30~ES
zpPbe=)Nd?5wg}NFKXLmAmF=o%xR+_pN>ISyvOC!4u{FeTc<$X1ocwfZZf8ogMBbx%
z0pBbv4pi@=+y>EnrrDe{1moO6Y<ZYS^gEvU`u_TOfGM5J#4|H9AqAygwckF6SA;#A
zpe(D`ApD~eS+Pkjt+-4^lTlL{167Ev4JcC$$}OLd&r=usC6VZkiA_3rw9#c|Q9Tw%
zchzR5B%wdMP;%|69j7$v((EF59##yKqCBplk$&r#(c2am===G@``)at@gL-*Z=zLC
zpUUn}XmW%k1kxQoQFjjIYkKa!5!@<0vd`$j$OX$*hvVULb5I$4>oYE96yQITtvKTo
zY9=OGPR31}v2&jj96hGK)_Fw18nvt?w1WQxgA5Ziuz!U3C=m%seAy@a&zJFpY;quV
zS9QatD{2frhCZke5%yNdS1OL0rNgfk{=Km^M9%Bp(IdePFc(!eIYNJK=f&RYdQ9Ut
zYQ>qYzdsMMAJtD!YuRNc0kthrgkudxQwx$dtd#Y6@Kl{khnpTAg`Wn#U&nX937OkF
z^Deo*6x{B62Cpnr?ak{+P2jqTTvESD^jO>+yTFl%kfn{)7%nVmObEoT?NYkjx_6TQ
zz3cnZp&!)NxU(J_&9$BS0JBjDiXw31Hke>$*yJYYyfyu+vVLI8d2Xbr;1v&P!kY>P
z8%%7!_U!H$BsE2|h4mt6<zA#<drmQx|M?|m2z!2F;T8G7bsBl_&|XdDir^J*L?;^&
zPZF?+9yT)fC{huSpeelW6Sdco(d(Yry`I(G0<|ONv}?~!zJlUn3rcP*u$={M486gY
zb)D2?+qphop;jB67vrxH>JO3{eh<CY2|DFFCDeXi3ATO&L%*!7>Jkke%KZyCoO9ha
zrBNCDXLl@#(FRs_C@PFu##rXoC<y%?GO9#*LdIB<OPL|QdP9tCNOgp|KBXTW2%XI|
zx0O#o2vTOuuLXH!%9-;MU?1B$lsz+;j@CDq!=w~Xw%QG1g!e1Hz^#|oJdh_#BgbWD
zy7>i%X2D^0Uy_=fT#6d|hIb9l{X4q(E{}MQ#RjBT_x;4@{zOk;hNjhzjm%8seWA?w
zIjlZ`95FiP*ku6w9fP!Bl?Q9jk*Kf_2v3lUbcheckyFNzHECPXX+hjvHQ)X_!Ou4i
zaqdj2T(hb&wvMAOarwQ2RucaRU1GpP-O^aS_bfEudkKo0R(DXx9Qr<4Ro$A#<fc;<
zAsG9c@7@b}FgW=HKIAb*pc8HwUgx(Cbmjg!0uGZ?Nw36%N0rw8^hszU?BZSR&`li$
zm~(&PQelW~@cv9kD{ywj3UaQ@w>ekZ2VNovHGYX~H(T}7{KkJDo8{E)Wz`kO2huQJ
z?%NTcrs!AB8Jwv3y~HiUynm%RX&vXXf96WLc*uO}t{3lK_dA5T9N}@=*WN~~XxE-%
z_LxZVxUA2joA2tyQ^V57lur#G`f9T?SM(XLp!)`Wae(8cF*RGV@Nx7Ra|BIiWxizC
zm|@^{3sd+}DHwA?H2og>I)b<$x}(qe`_X0fvHmJE+4<0rE^h4yv50}1odTME4`}{g
zF%w^&Nr5svP6<DC{Q6pYtf|4~dnOs1)xwHuTk(hwzi6YI3E%7r)5TTl)0@Cw?98s3
zw)SE!^6%7_sDXA@9SgcI!`#qHT8Me%fU0>CFP4KWYyh7;Ib4}!TUL{OwP@TU)Ve$K
zUSpQFD&poHbXJH}_LYr4T~bp0&tcBOOjvR8S?@@@G`6gwS7!4mT2O**A62qJrVvBq
zfXXrP$@<^s>)bNR`nvh?_#pIWv#lxHVXjTj%~qJ1s}17+Zt$g#hXrPIGJ?^bzoYo+
z)U`OYEGo9N$4z8u9OSMn5uwaL7~I~DdD<(-5ighuI-<L=)5t>WoNQraYT~xOZUKKf
z7#|dJuDr1zWNVkZB(Gc!$1w?!ws6_)1S3?+wj@s8>RYisdy(xSjwuF%rnf4ZmeWn_
zWl)aa+^n`$C{U_$xECY;4@`IV31g1Ym}JTK^_z9vw*i_t5t^`Pdgs$XAM){B?(5X_
zgI|iL6u5z;AWLlL?l$2>nV7tP_NPN4;i@Hw(PA_%W$vhhjw}K`W(Y}NvfU0#x~`#n
zP8mrm1Xqa^fwr<f4K(V|9N4}(I`6*BB-Yk`Wp%o?GgQf`45jIB*jy#Yj+EKrFj&k0
zvmJ~SGiWr6*|U0~Y;BdH(9s7ko4L!jw<Wj{50GWm<!fb2QrzJsZo;CxI9>FXxY+Bw
z3Q4mn)Um(u1TG9Q)37MTKWN*W3Ep(}(?_vvGl_B7nI0zPPYTz*{u)?U$p~FuAT8W`
zVr;@dzLx8g*||zKGcuEXe$c1r+VmZEov)3CVJ*d^zsn0d)NKB$0zmC`GdwnIW?JLq
z7yr9$bXuR*ISqic)b!l!5nliH`PV?c2A`!LOyqSMQ0UXY#q8_6!Tnn@aC|YU-uFqB
zXUiwe`)9}wweT?WZp{T!>@+2H=YC@jY;5i4;_o#R-fWXm2B(zwN^T^;ZnU=<6+sVL
z>wf~(FN=zs)J|eCQ*6xxWnUr3CgGoLa^1NqIrHmymOME$ree;q?k3zpCE5Ja;HN9f
zi*`v(ElcB&x?&Yg?T^sE^l@lQIfYzh$7U5D2BaQu{QmKCDF-$d_a@q~OuF&%#RRLb
z56Ll5Bz0o(kOB9pSru%uG!FCr$q+G)Nlvcc-23QZhfhL{X$K4tN#c6lU+6v7pJA=f
z%ihM|(<G_Tzx<}ehX0K}=n1PQ8H`iTU|{-bz$e=6(9V$Bj@Wcj>VLpJN-kYiFf})`
z)u&5pVas^cmH{lp$9zqmDX&M2*C)<TbBrbW&+bQPA-b80Gar|f%&HA*#3a>iC5-4x
z+oS-hi8)H7#WbUNYn#IxaDv+>^5T|E@`p@Eg1%mydw(9*T<x?l9|{O)Jswr2>8;<G
z8Jct1%y$_6(+sop!}|1VFxR;0d`je6XCFF}_vLfIYW5rg8D8r@I4hkBhjG49UO6~J
zKIuOI^@6+wTo2Lbc>yKbMy4W8c>8B)`YpLxM|l!yWcgES(+LXf=R}HON%fuH0XMYu
z&Oh(GNF)XbdIMi5U(B6e(iF>2D`7TQMS$QHyc{S6;Qx>h;B5XkiRJ$md$;KDA;BMk
z-?!+T%|En+0MdxqzAsMk3-Fa^=3eXLdDPor8RvcDf8t@B_ig|}n7@CA9lZRuKeImw
zBFy>wXL8!9@4M~LATOUU^FTb=uzz2k;Yh1HBo&ECbD+bmfV_EQR|;*0rFz8P{m;dj
z5H1uTnbRM{^vgm7*>}Md(`^v$ry&YW(R41p4cb8=<Z*(avs&Hm$}p2kgNpN$4njO8
z6)ZY_emOZD(RcoA81kC(adFC7+kdP`(e8ed{BdLCk!&XAg{Gpcs?EVj?NqWM7Z}Lb
zR<cPrIav7^vI-<TE<Vy=he>|WsQoM}Y362bo-R7oYWMc;_m)Ji0?l<lcE<PF;0$Ro
zsWezMzmJkZ;CXT396_8!fI~7en9gf;prNn$xc*YkNpU1MFnamySr7gg=NrvlMkAA9
zOX7cwulXknXb*HgdEWdCodA$^??hp_L=3#Js4zdTFh3|HEP?NfhSB>!scr!y8yr&B
z|FDy3SpZ#`nwbpLevOMK;Ivv)$*Xs9*9jUmhLt=+^ZW3q>`_peK}dFK>HX2?cO}MP
zqU58ZqqF{5qep3NV^eQnX8oB2d;k10ICx{S?%|Vz$D{!5V#Jeh7y6(htLm!pQCN5@
zetgZ_``h9-36M5p;-KN?o;9e@Y*3MrQ!}rasCjZbLjr2`Cg_*hN#Qz=W=<U}B{vPt
zTeJA+D4ySB@-Jh3sOa!ECbt48t*t{G70oX^ycqBY)&g|4cYu#H)b0C@d<E@^N$M*0
zc|!&jWqoL963G|L7<Z!m6+N4ovCZac9rg_P$aX<seR6tew-Mr7EQ596$Y)_u;<BTq
zrX?GrEhDF(p`>B`%KqaU?3h?Z7K|5BAEKfbMLVG&IdJZZpYY@#9^rp4qEnZg%bHwR
zAkAUQ`!UKti0>Xs#KQ*{5#(tN8^zQs&qkfj-%)3;K&j%ozC|tRX1ti1WCy6l>`37v
z&n?gdCWa`}0e`-nojJ0z7bKpL1*2jTax$H#*2gKqN3dn}peg~yhi5@-?6AkCY}5At
zI_+UA3kISk5&_VOUbDxXBcM@^4i8n!jZ#IYWMyPDR29|br?5z$al32aV5jier8d6Q
z8Ohzt%5r4RUUhJJl0kFF>hkoe%vB3A+RvzcWTm@7OoZS-MZ-XS^d!0~3p$b^H@D*|
z()|og7*=O?I=kEXgQ`C{GVxpT*EnqrSyfG0)xP4eAhMWfg3a}HS#`K2Q1X1CyDAa*
z4jS>;UmoQm@r2-DV~ap%W;!xEr4l~!S2K=VTKa+1xtjVECaJ)}osn2|9KF(&$3Y7b
z52Ag=D#a8xI?74LYo(MqXifT$G?)C=PSOn={qokK$i!F)G}MJXwVfz1lJYl1+mV?$
z4biEuUOoDf7e(Nomscd{x|~%d(rNeRt}vFbIg%IwZ(w<{w5ed+>kCs$Hb7!Tr>wTl
z5=flL+GK9YRwS0}7;Oag$A8J9+CTs0xm8DvceJ=czszwQ60WL{Ak~YD?cU|(z%#5L
z`%jS=#MgWh0-=%cD^!t^oX*_ctx{>eTlSy>Zb-XnS$x=xbHYz~hFD8dlw>W#xY?B+
zwCQZp7FmuYm_)!W2X9`gljUPvahpMfHR=79M*v;5j24>f>ZiRE!q@SAcbVs&=hHhr
z9|jTVElWzJ5WidK5b}V+(}y7G8NW1mT(bW&@@dGE+uNR#X+NLmxgEy1#A$6OCY~bs
zW8FH~M}Cz5aj^IQ+v(Oyto(=e_hC94y!%HEq{c$kN0a`CZytByrXnK&fK`LsT?%6E
z2_}j%w6AUL)QSv}`a152k2Pp%1Nf*=xmx7W=bk>d@T~5A<n*7zA)EhjFcFBR=)XZi
zl=lBNGJsP5hbVaWjzu{A`TrO1kOGe6-_uabM%ZD0_WM<_k7t1nLC1Iz=V?3x9vfU0
z$k>q)PJd5jA63)i$VUdg@fRJ*MfERJRD@fR>IK#s2oaETI`0&&Lr4Dn(NI%r1sXug
z&oAm`h|<QQfdYzMlc~yJ0Qz!ktOqysbD8fZ7ewSa14FzH0j{sqa~kK7=&q$6`hp-@
zyA5bkpM73K@TSZ>nkk1#T(J-8t*7)9A@E-xvZHN$=i1~6K;=Jz%JisLm##mglQd*x
z7?gh#`m+*%Eomgp;YL%FZ#2a2<rw~P$hht68lh03xmU`xwc$vRD;t=%Oy>G{{Y|O(
zC=We<SYUa%jmahv4-Zdm|AS(P&qGjHbMMj53p~gWjNhXMgfJBbIz^LRYC6S&2RFpt
z6fNV0O2urTO}NPE1>UwM6ls(h+4knnN{Dubs?~nRR(A4F4$+|4;$Ou?IDTI#=ET4?
z#|O&vRuVWm%S>Nk{PUlWUdX#?wgGM~a_fp!sZ|*(z<p_HY5#JJVp&I~Nn2Rx14pGR
zAJR3_CNKu_AVxpWmh(3z^EY@L9D=S`;X19VkNh&o?$m(u{c~I^Ql$C6`r5x=l38p-
zKT=8x8_1N6TzKF|J%N8v+t042k@dX6Ht#hZ-REQe9^f*~&CQqOa9+F+3ChjS@BdtO
zhCp0gI1-2bkcgwJl|qy1)uh{HB?MqPuq-{Q9XX)!)1|YG=oK~xrb<(d1+mzJU<k23
z47sSX(gJ?NevPNve2NsCY-4kiG3rAEi6B4Bg-=(vUtjYRfoKV5bZo3LeB_oL9p(M>
zDXQ;lznrEDpH0xM5Gj!#d$_0?%jhpdX#ouas>gi7w2XIlj$nbF7?)ZQzg*!FOj9a=
zmFNE`&-ZsTE>j`!=XPIYsLpF?uc@s?_oEb1&KWiC*u71lJp8$O_y9Rlq4+I3D$^2R
zUTcUE;0gQd+$t?Au<p0d6&#(d?x?&F|HwOR)<f*!YO`<)>N(%^7r<-<uXz+Y#ZBKw
zuK+s+bEpFj=jG)+wWlVc;iK3;`&IMlgNiczx7|N;vJ`(7!*2fB>h1TNw~em|{ksO3
z^K%Pp`&#|+(!_+x2B<fM$}#^94v-oOyb$V=@9`RI?mkzG`{%Cd^B0=B|17$t9rcV)
zAT8pR{#^+mqIhJHZ(CLm9r@Bx@gM!WM-;0HWBF;M=RoH>;k&y$vAxBpa8UypQJwfw
z-!pvDur??B_wzMB9fC-e7J;T|RfU$-kaxm6l>d27sV;#i0}kq09DOT!@Z0pS(tJO1
zI(hySaX>r+3H({@H~aW$LfU(8>Cyy)zQU33w`i>57J7&wT!A_SWh&zcsi(@C&v4Q1
z^Rbq6nl^5?LXt(KBV^|$ysk%qcE2oD>BS3~7%z%@#n=A%5tuo)JgN!u^Dfxsb=<zp
zKt|H0#0$Rf`jb=3vtYt>jEVGigsZ7w!5GfoES=axcY_cRh)^PF59I*H(G5yHP4D_W
Tr$n{eT77sY1uYi-<o&+@|3+rB

literal 0
HcmV?d00001

diff --git a/frontend/editor/scripts/generate-og-metadata.mjs b/frontend/editor/scripts/generate-og-metadata.mjs
index 3fd4beaf3a..dfd39ec609 100644
--- a/frontend/editor/scripts/generate-og-metadata.mjs
+++ b/frontend/editor/scripts/generate-og-metadata.mjs
@@ -4,7 +4,8 @@
 //
 // Outputs:
 //   src/core/data/ogImageMap.json  - { toolId: imageBasename }  (imported by the client)
-//   public/og-metadata.json        - { default, byTool, byPath } (read by the backend at startup)
+//   public/og-metadata.json        - { default, byTool, byPath } (prerender input, all flavors)
+//   public/og-metadata.saas.json   - same shape, SaaS marketing copy/art (prerender input, --mode saas)
 //
 // Run: `node scripts/generate-og-metadata.mjs`        (writes files)
 //      `node scripts/generate-og-metadata.mjs --check` (CI drift guard: fails if stale)
@@ -26,6 +27,35 @@ const SITE_TITLE = "Stirling PDF";
 const SITE_DESC = "The Free Adobe Acrobat alternative (10M+ Downloads)";
 const DEFAULT_IMAGE_BASENAME = "home";
 
+// SaaS (stirling.com) link-preview cards. Only the SaaS build (`--mode saas`)
+// uses og-metadata.saas.json; every other flavour keeps the tool-registry copy
+// above. `ogTitle` is the punchy social headline; `title` is the SEO <title>.
+// `home` overrides the site default (served at `/app`); the rest are extra
+// marketing landing routes prerendered so their links unfurl with bespoke art.
+const SAAS_DEFAULT = {
+  image: "/og_images/saas/app.png",
+  title: "Stirling - Edit any PDF. Govern every PDF.",
+  ogTitle: "Edit any PDF. Govern every PDF.",
+  description:
+    "The free, open-source PDF Editor, plus a Processor that governs every PDF your organization touches. 1¢ per PDF.",
+};
+const SAAS_ROUTE_OVERRIDES = {
+  "/processor": {
+    image: "/og_images/saas/app-processor.png",
+    title: "Stirling Processor - Govern every PDF your organization touches",
+    ogTitle: "Govern every PDF your organization touches",
+    description:
+      "Redaction, retention, and encryption policies enforced everywhere PDFs enter your org. Distribute the free Editor anywhere. 1¢ per PDF.",
+  },
+  "/editor": {
+    image: "/og_images/saas/app-editor.png",
+    title: "Stirling - The world's most secure PDF editor",
+    ogTitle: "The world's most secure PDF editor",
+    description:
+      "Edit, sign, redact, and convert PDFs in your browser. Free forever, open source, and self-hostable.",
+  },
+};
+
 // Tools whose art exists under a legacy v1 filename that does not match the
 // tool id or any current URL slug. Verified against public/og_images contents.
 const LEGACY_IMAGE_OVERRIDES = {
@@ -178,10 +208,33 @@ const manifest = {
   byPath,
 };
 
+// SaaS manifest: same tool pages as above, but the home default and two extra
+// marketing routes carry the stirling.com cards. Keeps all per-tool OG intact.
+const saasManifest = {
+  default: SAAS_DEFAULT,
+  byTool: { ...byTool },
+  byPath: { ...byPath },
+};
+for (const [routePath, entry] of Object.entries(SAAS_ROUTE_OVERRIDES)) {
+  saasManifest.byTool[routePath] = entry;
+  saasManifest.byPath[routePath] = routePath;
+}
+// SaaS card art lives in the saas/ subdir (outside the root images scan), so
+// check the files on disk directly.
+const missingSaasImages = [SAAS_DEFAULT, ...Object.values(SAAS_ROUTE_OVERRIDES)]
+  .map((e) => e.image)
+  .filter((img) => !fs.existsSync(path.join(ROOT, "public" + img)));
+if (missingSaasImages.length)
+  console.warn(
+    `\nWARNING: SaaS OG cards reference missing images: ${missingSaasImages.join(", ")}`,
+  );
+
 const mapJson = JSON.stringify(ogImageMap, null, 2) + "\n";
 const manifestJson = JSON.stringify(manifest, null, 2) + "\n";
+const saasManifestJson = JSON.stringify(saasManifest, null, 2) + "\n";
 const mapPath = "src/core/data/ogImageMap.json";
 const manifestPath = "public/og-metadata.json";
+const saasManifestPath = "public/og-metadata.saas.json";
 
 const check = process.argv.includes("--check");
 if (check) {
@@ -193,6 +246,11 @@ if (check) {
     read(manifestPath) !== manifestJson
   )
     stale.push(manifestPath);
+  if (
+    !fs.existsSync(path.join(ROOT, saasManifestPath)) ||
+    read(saasManifestPath) !== saasManifestJson
+  )
+    stale.push(saasManifestPath);
   if (stale.length) {
     console.error(
       "OG metadata is stale. Run `node scripts/generate-og-metadata.mjs`:\n  " +
@@ -204,9 +262,13 @@ if (check) {
 } else {
   fs.writeFileSync(path.join(ROOT, mapPath), mapJson);
   fs.writeFileSync(path.join(ROOT, manifestPath), manifestJson);
+  fs.writeFileSync(path.join(ROOT, saasManifestPath), saasManifestJson);
   console.log(
     `Wrote ${mapPath} (${Object.keys(ogImageMap).length} tools with art)`,
   );
+  console.log(
+    `Wrote ${saasManifestPath} (${Object.keys(saasManifest.byPath).length} paths, SaaS)`,
+  );
   console.log(`Wrote ${manifestPath} (${Object.keys(byPath).length} paths)`);
 }
 
diff --git a/frontend/editor/scripts/og-prerender.d.mts b/frontend/editor/scripts/og-prerender.d.mts
index 9f2c58ec6d..27944e0347 100644
--- a/frontend/editor/scripts/og-prerender.d.mts
+++ b/frontend/editor/scripts/og-prerender.d.mts
@@ -4,6 +4,8 @@ export interface OgEntry {
   image: string;
   title: string;
   description: string;
+  /** Punchier social-card title; falls back to `title` for the <title> tag. */
+  ogTitle?: string;
 }
 
 export interface OgInjectOptions {
diff --git a/frontend/editor/scripts/og-prerender.mjs b/frontend/editor/scripts/og-prerender.mjs
index ee189fa7a2..8fa7d274ac 100644
--- a/frontend/editor/scripts/og-prerender.mjs
+++ b/frontend/editor/scripts/og-prerender.mjs
@@ -15,12 +15,13 @@ export const escapeHtml = (value) =>
 const absolute = (urlPath, ogBase) => (ogBase ? ogBase + urlPath : urlPath);
 
 /**
- * Build the OG/Twitter <meta> block for one route.
- * @param {{image:string,title:string,description:string}} entry
+ * Build the OG/Twitter <meta> block for one route. `ogTitle` lets the social
+ * card show a punchier headline than the (SEO) <title>; falls back to `title`.
+ * @param {{image:string,title:string,description:string,ogTitle?:string}} entry
  * @param {{ogBase?:string, pageUrlPath?:string|null}} opts
  */
 export function buildOgTags(entry, { ogBase = "", pageUrlPath = null } = {}) {
-  const title = escapeHtml(entry.title);
+  const title = escapeHtml(entry.ogTitle ?? entry.title);
   const description = escapeHtml(entry.description);
   const imageUrl = absolute(entry.image, ogBase);
   const image = escapeHtml(imageUrl);
diff --git a/frontend/editor/src/core/data/ogMetadata.test.ts b/frontend/editor/src/core/data/ogMetadata.test.ts
index fe64fb90f6..e43ef11b9e 100644
--- a/frontend/editor/src/core/data/ogMetadata.test.ts
+++ b/frontend/editor/src/core/data/ogMetadata.test.ts
@@ -102,6 +102,28 @@ describe("injectOg (build-time prerender)", () => {
     );
     expect(tags).toContain("A &quot;B&quot; &amp; &lt;C&gt;");
   });
+
+  it("uses ogTitle for the social card but title for the <title> tag", () => {
+    const out = injectOg(
+      TEMPLATE,
+      {
+        image: "/og_images/saas/app.png",
+        title: "Stirling - Edit any PDF. Govern every PDF.",
+        ogTitle: "Edit any PDF. Govern every PDF.",
+        description: "d",
+      },
+      {},
+    );
+    expect(out).toContain(
+      "<title>Stirling - Edit any PDF. Govern every PDF.</title>",
+    );
+    expect(out).toContain(
+      '<meta property="og:title" content="Edit any PDF. Govern every PDF." />',
+    );
+    expect(out).toContain(
+      '<meta name="twitter:title" content="Edit any PDF. Govern every PDF." />',
+    );
+  });
 });
 
 describe("prerenderOg (flat + nested route files)", () => {
diff --git a/frontend/editor/src/saas/routes/Login.tsx b/frontend/editor/src/saas/routes/Login.tsx
index 25bad2570d..3a18322d06 100644
--- a/frontend/editor/src/saas/routes/Login.tsx
+++ b/frontend/editor/src/saas/routes/Login.tsx
@@ -83,7 +83,7 @@ export default function Login() {
       "app.description",
       "The Free Adobe Acrobat alternative (10M+ Downloads)",
     ),
-    ogImage: `${baseUrl}/og_images/home.png`,
+    ogImage: `${baseUrl}/og_images/saas/app.png`,
     ogUrl: `${window.location.origin}${window.location.pathname}`,
   });
 
diff --git a/frontend/editor/src/saas/routes/Signup.tsx b/frontend/editor/src/saas/routes/Signup.tsx
index ec59c8cc71..3c34626168 100644
--- a/frontend/editor/src/saas/routes/Signup.tsx
+++ b/frontend/editor/src/saas/routes/Signup.tsx
@@ -108,7 +108,7 @@ export default function Signup() {
       "app.description",
       "The Free Adobe Acrobat alternative (10M+ Downloads)",
     ),
-    ogImage: `${baseUrl}/og_images/home.png`,
+    ogImage: `${baseUrl}/og_images/saas/app.png`,
     ogUrl: `${window.location.origin}${window.location.pathname}`,
   });
 
diff --git a/frontend/editor/vite.config.ts b/frontend/editor/vite.config.ts
index b5733bfe02..0d367d2465 100644
--- a/frontend/editor/vite.config.ts
+++ b/frontend/editor/vite.config.ts
@@ -88,7 +88,12 @@ function compressStaticCopyPlugin(): PluginOption {
 // Pages). Otherwise URLs stay root-relative, which still resolves against whatever
 // origin serves the page (correct for self-hosted Docker). Logic lives in
 // scripts/og-prerender.mjs so it can be unit-tested without a full build.
-function prerenderOgPlugin(): PluginOption {
+function prerenderOgPlugin(isSaas: boolean): PluginOption {
+  // SaaS (stirling.com) prerenders the marketing cards from a dedicated
+  // manifest; every other flavour uses the tool-registry manifest.
+  const manifestFile = isSaas
+    ? "public/og-metadata.saas.json"
+    : "public/og-metadata.json";
   return {
     name: "prerender-og",
     apply: "build" as const,
@@ -105,14 +110,11 @@ function prerenderOgPlugin(): PluginOption {
       let manifest;
       try {
         manifest = JSON.parse(
-          await fs.readFile(
-            path.resolve(__dirname, "public/og-metadata.json"),
-            "utf8",
-          ),
+          await fs.readFile(path.resolve(__dirname, manifestFile), "utf8"),
         );
       } catch {
         console.warn(
-          "[prerender-og] public/og-metadata.json missing; skipping OG prerender. " +
+          `[prerender-og] ${manifestFile} missing; skipping OG prerender. ` +
             "Run `node scripts/generate-og-metadata.mjs`.",
         );
         return;
@@ -330,7 +332,7 @@ export default defineConfig(async ({ mode, command }) => {
         ],
       }),
       compressStaticCopyPlugin(),
-      prerenderOgPlugin(),
+      prerenderOgPlugin(effectiveMode === "saas"),
     ],
     server: {
       host: true,

From 7e76097ac184a10ece1629dfcf54ed4b32990c61 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 22 Jul 2026 12:10:53 +0100
Subject: [PATCH 081/109] Make processor UI mobile friendly BASIC BASIC impl
 (#7126)

# Description of Changes

Very basic mobile impl, just makes side bar collapsable and minor other
changes "better than nothing"

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../public/locales/en-US/translation.toml     |  5 ++
 frontend/editor/src/core/ui/MetricStrip.css   |  6 ++
 frontend/editor/src/core/ui/Modal.css         | 12 +++
 .../editor/src/portal/components/AppShell.css | 41 ++++++++++
 .../portal/components/AppShell.stories.tsx    | 34 ++++++++
 .../editor/src/portal/components/AppShell.tsx | 79 ++++++++++++++++++-
 .../src/portal/components/AssistantPanel.css  |  5 +-
 .../components/NotificationsDropdown.css      |  3 +-
 .../editor/src/portal/components/Sidebar.css  | 38 +++++++++
 .../editor/src/portal/components/Sidebar.tsx  | 31 +++++++-
 .../editor/src/portal/components/icons.tsx    | 10 +++
 .../editor/src/portal/contexts/UIContext.tsx  | 22 +++++-
 .../editor/src/portal/views/EditorAdmin.css   |  6 ++
 .../src/portal/views/Infrastructure.css       | 12 +++
 .../src/portal/views/PipelineBuilder.css      |  7 ++
 .../editor/src/portal/views/Pipelines.css     |  1 +
 frontend/editor/src/portal/views/Policies.css |  6 ++
 frontend/editor/src/portal/views/Sources.css  | 15 ++++
 frontend/editor/src/portal/views/Users.css    |  6 ++
 19 files changed, 328 insertions(+), 11 deletions(-)
 create mode 100644 frontend/editor/src/portal/components/AppShell.stories.tsx

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index d1fc247e2f..d27e881f2e 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7910,6 +7910,11 @@ linkAccount = "Link Stirling account"
 primaryNav = "Primary navigation"
 switchApp = "Switch app"
 
+[portal.shell.topbar]
+closeNav = "Close navigation"
+openNav = "Open navigation"
+search = "Search"
+
 [portal.sources]
 subtitle = "Reusable input connections that feed documents into Stirling. Configure a source once, then reference it from any number of pipelines."
 title = "Sources"
diff --git a/frontend/editor/src/core/ui/MetricStrip.css b/frontend/editor/src/core/ui/MetricStrip.css
index c222e61583..472fce713e 100644
--- a/frontend/editor/src/core/ui/MetricStrip.css
+++ b/frontend/editor/src/core/ui/MetricStrip.css
@@ -9,3 +9,9 @@
     grid-template-columns: repeat(2, 1fr);
   }
 }
+
+@media (max-width: 30rem) {
+  .sui-metric-strip {
+    grid-template-columns: 1fr;
+  }
+}
diff --git a/frontend/editor/src/core/ui/Modal.css b/frontend/editor/src/core/ui/Modal.css
index 7d9ef68746..a3d081b42d 100644
--- a/frontend/editor/src/core/ui/Modal.css
+++ b/frontend/editor/src/core/ui/Modal.css
@@ -25,10 +25,22 @@
   flex-direction: column;
   width: 100%;
   max-height: calc(100vh - 6.5rem);
+  max-height: calc(100dvh - 6.5rem); /* mobile browser chrome shrinks 100vh */
   overflow: hidden;
   animation: scaleIn 0.2s cubic-bezier(0.4, 0, 0.2, 1) both;
 }
 
+/* Phones: drop the tall top inset so the modal gets the vertical space */
+@media (max-width: 30rem) {
+  .sui-modal__backdrop {
+    padding: 1rem 0.75rem;
+    align-items: center;
+  }
+  .sui-modal {
+    max-height: calc(100dvh - 2rem);
+  }
+}
+
 .sui-modal--sm {
   max-width: 24rem;
 }
diff --git a/frontend/editor/src/portal/components/AppShell.css b/frontend/editor/src/portal/components/AppShell.css
index 03702966e4..a01026480a 100644
--- a/frontend/editor/src/portal/components/AppShell.css
+++ b/frontend/editor/src/portal/components/AppShell.css
@@ -8,6 +8,7 @@
 .portal-shell {
   display: flex;
   height: 100vh;
+  height: 100dvh; /* mobile browser chrome shrinks the viewport; dvh tracks it */
   overflow: hidden;
   background: var(--color-bg);
   color: var(--color-text-2);
@@ -27,3 +28,43 @@
   overflow-y: auto;
   animation: fadeInUp var(--motion-enter) both;
 }
+
+/* Mobile topbar — hidden on desktop, where the sidebar is always visible.
+   Height matches the sidebar's logo row so the brand sits at the same level. */
+.portal-shell__topbar {
+  display: none;
+  height: 3.1875rem;
+  flex-shrink: 0;
+  align-items: center;
+  gap: 0.375rem;
+  padding: 0 0.625rem;
+  background: var(--color-sidebar-bg);
+  border-bottom: 1px solid var(--color-sidebar-border);
+}
+
+.portal-shell__topbar-wordmark {
+  height: 1.375rem;
+  width: auto;
+  display: block;
+  margin-right: auto;
+}
+
+/* Scrim behind the mobile nav drawer (below SUI modals at z-index 100). */
+.portal-shell__scrim {
+  display: none;
+  position: fixed;
+  inset: 0;
+  z-index: 75;
+  background: rgba(15, 23, 42, 0.55);
+}
+
+@media (max-width: 48rem) {
+  .portal-shell__topbar {
+    display: flex;
+  }
+  .portal-shell__scrim {
+    display: block;
+    /* fadeIn keyframes come from core tokens.css */
+    animation: fadeIn var(--motion-fast) both;
+  }
+}
diff --git a/frontend/editor/src/portal/components/AppShell.stories.tsx b/frontend/editor/src/portal/components/AppShell.stories.tsx
new file mode 100644
index 0000000000..1df98c3197
--- /dev/null
+++ b/frontend/editor/src/portal/components/AppShell.stories.tsx
@@ -0,0 +1,34 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { AppShell } from "@portal/components/AppShell";
+import { Home } from "@portal/views/Home";
+
+/**
+ * The full shell (sidebar + mobile topbar/drawer + scrolling view column) with
+ * the Home view inside. Resize the viewport below 48rem to exercise the mobile
+ * chrome: the sidebar becomes an off-canvas drawer behind a scrim, opened from
+ * the topbar hamburger.
+ */
+const meta: Meta<typeof AppShell> = {
+  title: "Portal/Shell/AppShell",
+  component: AppShell,
+  parameters: { layout: "fullscreen" },
+};
+export default meta;
+type Story = StoryObj<typeof AppShell>;
+
+export const WithHomeView: Story = {
+  render: () => (
+    <AppShell>
+      <Home />
+    </AppShell>
+  ),
+};
+
+export const Mobile: Story = {
+  render: () => (
+    <AppShell>
+      <Home />
+    </AppShell>
+  ),
+  globals: { viewport: { value: "mobile2", isRotated: false } },
+};
diff --git a/frontend/editor/src/portal/components/AppShell.tsx b/frontend/editor/src/portal/components/AppShell.tsx
index b3744d36bf..c50b4000e9 100644
--- a/frontend/editor/src/portal/components/AppShell.tsx
+++ b/frontend/editor/src/portal/components/AppShell.tsx
@@ -1,17 +1,90 @@
-import type { ReactNode } from "react";
+import { useEffect, type ReactNode } from "react";
+import { useTranslation } from "react-i18next";
+import { useLocation } from "react-router-dom";
+import { ActionIcon } from "@app/ui";
 import { Sidebar } from "@portal/components/Sidebar";
+import { useTheme } from "@portal/contexts/ThemeContext";
+import { useUI } from "@portal/contexts/UIContext";
+import { MenuIcon, SearchIcon } from "@portal/components/icons";
+import wordmarkLight from "@app/assets/brand/modern-logo/StirlingProcessorLogoBlackText.svg";
+import wordmarkDark from "@app/assets/brand/modern-logo/StirlingProcessorLogoWhiteText.svg";
 import "@portal/components/AppShell.css";
 
+/**
+ * Compact header shown only under the mobile breakpoint (CSS-hidden on
+ * desktop): hamburger opens the sidebar drawer, search opens the palette
+ * (there's no ⌘K on a phone).
+ */
+function MobileTopbar() {
+  const { t } = useTranslation();
+  const { theme } = useTheme();
+  const { mobileNavOpen, toggleMobileNav, openSearch } = useUI();
+  return (
+    <header className="portal-shell__topbar">
+      <ActionIcon
+        variant="tertiary"
+        size="lg"
+        aria-label={t("portal.shell.topbar.openNav")}
+        aria-expanded={mobileNavOpen}
+        onClick={toggleMobileNav}
+      >
+        <MenuIcon size={20} />
+      </ActionIcon>
+      <img
+        className="portal-shell__topbar-wordmark"
+        src={theme === "dark" ? wordmarkDark : wordmarkLight}
+        alt={t("portal.shell.sidebar.brandSuffix")}
+      />
+      <ActionIcon
+        variant="tertiary"
+        size="lg"
+        aria-label={t("portal.shell.topbar.search")}
+        onClick={openSearch}
+      >
+        <SearchIcon size={19} />
+      </ActionIcon>
+    </header>
+  );
+}
+
 /**
  * Two-column layout: fixed-width sidebar on the left, a scrolling main column on
- * the right. The Sidebar reads its state from context, so this shell stays
- * prop-free.
+ * the right. Under the mobile breakpoint the sidebar becomes an off-canvas
+ * drawer behind a scrim, opened from the topbar hamburger. The Sidebar reads
+ * its state from context, so this shell stays prop-free.
  */
 export function AppShell({ children }: { children: ReactNode }) {
+  const { mobileNavOpen, closeMobileNav } = useUI();
+  const { pathname } = useLocation();
+
+  // Navigating (tap on a nav row, back button, deep link) always dismisses the
+  // drawer. Depends on pathname only: the close fn's identity changes with any
+  // UI state, and re-running on that would instantly close a just-opened drawer.
+  useEffect(() => {
+    closeMobileNav();
+  }, [pathname]);
+
+  useEffect(() => {
+    if (!mobileNavOpen) return;
+    function onKey(e: KeyboardEvent) {
+      if (e.key === "Escape") closeMobileNav();
+    }
+    document.addEventListener("keydown", onKey);
+    return () => document.removeEventListener("keydown", onKey);
+  }, [mobileNavOpen, closeMobileNav]);
+
   return (
     <div className="portal-shell">
       <Sidebar />
+      {mobileNavOpen && (
+        <div
+          className="portal-shell__scrim"
+          onClick={closeMobileNav}
+          aria-hidden
+        />
+      )}
       <div className="portal-shell__main">
+        <MobileTopbar />
         <main className="portal-shell__view">{children}</main>
       </div>
     </div>
diff --git a/frontend/editor/src/portal/components/AssistantPanel.css b/frontend/editor/src/portal/components/AssistantPanel.css
index e16f84f6c0..90a66f169d 100644
--- a/frontend/editor/src/portal/components/AssistantPanel.css
+++ b/frontend/editor/src/portal/components/AssistantPanel.css
@@ -2,9 +2,10 @@
   position: fixed;
   bottom: 5.5rem;
   right: 1.5rem;
-  width: 23.75rem;
+  /* Clamp to the viewport so small phones don't clip the panel off-screen */
+  width: min(23.75rem, calc(100vw - 2rem));
   height: 32.5rem;
-  max-height: calc(100vh - 7rem);
+  max-height: calc(100dvh - 7rem);
   background: var(--color-surface);
   border: 1px solid var(--color-border);
   border-radius: var(--radius-xl);
diff --git a/frontend/editor/src/portal/components/NotificationsDropdown.css b/frontend/editor/src/portal/components/NotificationsDropdown.css
index 325f8f4fb8..09bd19326d 100644
--- a/frontend/editor/src/portal/components/NotificationsDropdown.css
+++ b/frontend/editor/src/portal/components/NotificationsDropdown.css
@@ -6,7 +6,8 @@
   position: absolute;
   top: calc(100% + 0.25rem);
   right: 0;
-  width: 22.5rem;
+  /* Clamp to the viewport so a right-anchored panel fits small phones */
+  width: min(22.5rem, calc(100vw - 1rem));
   background: var(--color-notif-bg, var(--color-surface));
   border: 1px solid var(--color-border);
   border-radius: var(--radius-md);
diff --git a/frontend/editor/src/portal/components/Sidebar.css b/frontend/editor/src/portal/components/Sidebar.css
index 935a55e722..1e0096fc4e 100644
--- a/frontend/editor/src/portal/components/Sidebar.css
+++ b/frontend/editor/src/portal/components/Sidebar.css
@@ -1,6 +1,7 @@
 .portal-sidebar {
   width: 15rem;
   height: 100vh;
+  height: 100dvh; /* track mobile browser chrome */
   background: var(--color-sidebar-bg);
   border-right: 1px solid var(--color-sidebar-border);
   display: flex;
@@ -10,6 +11,43 @@
   top: 0;
 }
 
+/* Mobile close button (shared ActionIcon) — only shown inside the drawer. */
+.portal-sidebar__close {
+  display: none;
+  flex-shrink: 0;
+}
+
+/* Off-canvas drawer under the shell breakpoint (keep in sync with
+   AppShell.css and Sidebar.tsx). Slides from the inline-start edge so RTL
+   locales get the mirrored behavior for free. */
+@media (max-width: 48rem) {
+  .portal-sidebar {
+    position: fixed;
+    inset-block: 0;
+    inset-inline-start: 0;
+    z-index: 80; /* above the scrim (75), below SUI modals (100) */
+    width: min(17rem, 85vw);
+    border-right: none;
+    border-inline-end: 1px solid var(--color-sidebar-border);
+    transform: translateX(calc(var(--sui-dir, 1) * -100%));
+    visibility: hidden;
+    transition:
+      transform var(--motion-fast),
+      visibility var(--motion-fast);
+  }
+  [dir="rtl"] .portal-sidebar {
+    --sui-dir: -1;
+  }
+  .portal-sidebar--open {
+    transform: translateX(0);
+    visibility: visible;
+    box-shadow: 0 0.5rem 2rem rgba(15, 23, 42, 0.35);
+  }
+  .portal-sidebar__close {
+    display: inline-flex;
+  }
+}
+
 /* Logo block */
 .portal-sidebar__logo {
   height: 3.1875rem; /* 51px */
diff --git a/frontend/editor/src/portal/components/Sidebar.tsx b/frontend/editor/src/portal/components/Sidebar.tsx
index 5b512a7184..4eec4dcc06 100644
--- a/frontend/editor/src/portal/components/Sidebar.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.tsx
@@ -1,4 +1,5 @@
-import { NavItem } from "@app/ui";
+import { useMediaQuery } from "@mantine/hooks";
+import { ActionIcon, NavItem } from "@app/ui";
 import { AppSwitch } from "@app/components/shared/AppSwitch";
 import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
@@ -9,7 +10,7 @@ import { LinkAccountFooterItem } from "@portal/components/LinkAccountFooterItem"
 import { EDITOR_URL, EDITOR_IS_SAME_APP } from "@portal/auth/editorUrl";
 import wordmarkLight from "@app/assets/brand/modern-logo/StirlingProcessorLogoBlackText.svg";
 import wordmarkDark from "@app/assets/brand/modern-logo/StirlingProcessorLogoWhiteText.svg";
-import { SettingsIcon } from "@portal/components/icons";
+import { CloseIcon, SettingsIcon } from "@portal/components/icons";
 import {
   GROUP_PROCESSOR,
   GROUP_PLATFORM,
@@ -23,12 +24,18 @@ const NAV_SECTIONS: NavGroup[] = [
   { labelKey: "portal.nav.section.platform", entries: GROUP_PLATFORM },
 ];
 
+/** Must match the shell breakpoint in AppShell.css / Sidebar.css. */
+const MOBILE_QUERY = "(max-width: 48rem)";
+
 export function Sidebar() {
   const { activeView, setActiveView } = useView();
   const { theme } = useTheme();
-  const { openSettings } = useUI();
+  const { openSettings, mobileNavOpen, closeMobileNav } = useUI();
   const { t } = useTranslation();
   const navigate = useNavigate();
+  const isMobile = useMediaQuery(MOBILE_QUERY, false, {
+    getInitialValueInEffect: false,
+  });
 
   // Editor and portal are one SPA when the editor serves this origin's root, so
   // the switch stays client-side; an absolute EDITOR_URL (dev cross-app setup)
@@ -50,6 +57,9 @@ export function Sidebar() {
         icon={entry.icon}
         isActive={activeView === entry.id}
         onClick={(id) => {
+          // Route changes also close the drawer (AppShell), but re-selecting the
+          // active view or opening an external tab changes no route — close here.
+          closeMobileNav();
           if (entry.externalUrl) {
             window.open(entry.externalUrl, "_blank", "noopener,noreferrer");
           } else {
@@ -62,8 +72,12 @@ export function Sidebar() {
 
   return (
     <aside
-      className="portal-sidebar"
+      className={
+        mobileNavOpen ? "portal-sidebar portal-sidebar--open" : "portal-sidebar"
+      }
       aria-label={t("portal.shell.sidebar.primaryNav")}
+      // Off-canvas on mobile: remove from the tab order and accessibility tree.
+      inert={isMobile && !mobileNavOpen}
     >
       <div className="portal-sidebar__logo">
         <img
@@ -78,6 +92,15 @@ export function Sidebar() {
           theme={theme}
           onSwitch={goToEditor}
         />
+
+        <ActionIcon
+          variant="tertiary"
+          className="portal-sidebar__close"
+          aria-label={t("portal.shell.topbar.closeNav")}
+          onClick={closeMobileNav}
+        >
+          <CloseIcon size={18} />
+        </ActionIcon>
       </div>
 
       <nav className="portal-sidebar__nav">
diff --git a/frontend/editor/src/portal/components/icons.tsx b/frontend/editor/src/portal/components/icons.tsx
index d60f86646e..ac0eb49142 100644
--- a/frontend/editor/src/portal/components/icons.tsx
+++ b/frontend/editor/src/portal/components/icons.tsx
@@ -132,6 +132,16 @@ export function SearchIcon(props: IconProps) {
   );
 }
 
+export function MenuIcon(props: IconProps) {
+  return (
+    <Svg {...props}>
+      <line x1="4" y1="7" x2="20" y2="7" />
+      <line x1="4" y1="12" x2="20" y2="12" />
+      <line x1="4" y1="17" x2="20" y2="17" />
+    </Svg>
+  );
+}
+
 export function SunIcon(props: IconProps) {
   return (
     <Svg {...props}>
diff --git a/frontend/editor/src/portal/contexts/UIContext.tsx b/frontend/editor/src/portal/contexts/UIContext.tsx
index ba2ccbd344..f55c2f5ee9 100644
--- a/frontend/editor/src/portal/contexts/UIContext.tsx
+++ b/frontend/editor/src/portal/contexts/UIContext.tsx
@@ -12,6 +12,12 @@ interface UIContextValue {
   closeSearch: () => void;
   toggleSearch: () => void;
 
+  /** Off-canvas sidebar drawer on small screens (no-op chrome on desktop). */
+  mobileNavOpen: boolean;
+  openMobileNav: () => void;
+  closeMobileNav: () => void;
+  toggleMobileNav: () => void;
+
   assistantOpen: boolean;
   openAssistant: () => void;
   closeAssistant: () => void;
@@ -48,6 +54,7 @@ const UIContext = createContext<UIContextValue | null>(null);
 
 export function UIProvider({ children }: { children: ReactNode }) {
   const [searchOpen, setSearchOpen] = useState(false);
+  const [mobileNavOpen, setMobileNavOpen] = useState(false);
   const [assistantOpen, setAssistantOpen] = useState(false);
   const [settingsOpen, setSettingsOpen] = useState(false);
   const [settingsInitialSection, setSettingsInitialSection] = useState<
@@ -63,11 +70,21 @@ export function UIProvider({ children }: { children: ReactNode }) {
 
   const value = useMemo<UIContextValue>(
     () => ({
+      // Opening any overlay (search, settings, link modal) dismisses the mobile
+      // nav drawer so overlays never stack on top of it.
       searchOpen,
-      openSearch: () => setSearchOpen(true),
+      openSearch: () => {
+        setMobileNavOpen(false);
+        setSearchOpen(true);
+      },
       closeSearch: () => setSearchOpen(false),
       toggleSearch: () => setSearchOpen((o) => !o),
 
+      mobileNavOpen,
+      openMobileNav: () => setMobileNavOpen(true),
+      closeMobileNav: () => setMobileNavOpen(false),
+      toggleMobileNav: () => setMobileNavOpen((o) => !o),
+
       assistantOpen,
       openAssistant: () => setAssistantOpen(true),
       closeAssistant: () => setAssistantOpen(false),
@@ -76,6 +93,7 @@ export function UIProvider({ children }: { children: ReactNode }) {
       settingsOpen,
       settingsInitialSection,
       openSettings: (section?: string) => {
+        setMobileNavOpen(false);
         setSettingsInitialSection(section ?? null);
         setSettingsOpen(true);
       },
@@ -87,6 +105,7 @@ export function UIProvider({ children }: { children: ReactNode }) {
       linkModalOpen,
       linkModalMode,
       openLinkModal: (mode: "link" | "reauth" = "link") => {
+        setMobileNavOpen(false);
         setLinkModalMode(mode);
         // Never stack on Settings: close it first, and remember to reopen it on
         // the account-link section once the login modal closes.
@@ -109,6 +128,7 @@ export function UIProvider({ children }: { children: ReactNode }) {
     }),
     [
       searchOpen,
+      mobileNavOpen,
       assistantOpen,
       settingsOpen,
       settingsInitialSection,
diff --git a/frontend/editor/src/portal/views/EditorAdmin.css b/frontend/editor/src/portal/views/EditorAdmin.css
index 2fda00cda5..61ef2834dd 100644
--- a/frontend/editor/src/portal/views/EditorAdmin.css
+++ b/frontend/editor/src/portal/views/EditorAdmin.css
@@ -340,6 +340,12 @@
   gap: 0.875rem;
 }
 
+@media (max-width: 30rem) {
+  .portal-editor__token-row {
+    grid-template-columns: 1fr;
+  }
+}
+
 .portal-editor__panel-actions {
   display: flex;
   gap: 0.5rem;
diff --git a/frontend/editor/src/portal/views/Infrastructure.css b/frontend/editor/src/portal/views/Infrastructure.css
index bca7406359..1d98dee925 100644
--- a/frontend/editor/src/portal/views/Infrastructure.css
+++ b/frontend/editor/src/portal/views/Infrastructure.css
@@ -104,6 +104,12 @@
   gap: 0.5rem 1rem;
 }
 
+@media (max-width: 30rem) {
+  .portal-infra__export-fields {
+    grid-template-columns: 1fr;
+  }
+}
+
 .portal-infra__export-error {
   margin: 0;
   font-size: 0.8125rem;
@@ -192,6 +198,12 @@
   }
 }
 
+@media (max-width: 30rem) {
+  .portal-infra__metrics {
+    grid-template-columns: 1fr;
+  }
+}
+
 /* ── API keys ───────────────────────────────────────────────────────────── */
 .portal-infra__keys {
   display: flex;
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.css b/frontend/editor/src/portal/views/PipelineBuilder.css
index cef65d6e75..c7e273eec1 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.css
+++ b/frontend/editor/src/portal/views/PipelineBuilder.css
@@ -251,6 +251,13 @@
   gap: 0.625rem;
 }
 
+/* Once the grid stacks (60rem), a sticky inspector would ride over content */
+@media (max-width: 60rem) {
+  .portal-builder__inspector-col {
+    position: static;
+  }
+}
+
 .portal-builder__inspector {
   background: var(--color-surface);
   border: 1px solid var(--color-border);
diff --git a/frontend/editor/src/portal/views/Pipelines.css b/frontend/editor/src/portal/views/Pipelines.css
index 7cd241074d..5c99f6a224 100644
--- a/frontend/editor/src/portal/views/Pipelines.css
+++ b/frontend/editor/src/portal/views/Pipelines.css
@@ -12,6 +12,7 @@
   display: flex;
   align-items: flex-start;
   justify-content: space-between;
+  flex-wrap: wrap; /* actions drop below the title on narrow screens */
   gap: 1rem;
 }
 
diff --git a/frontend/editor/src/portal/views/Policies.css b/frontend/editor/src/portal/views/Policies.css
index c6095dabc1..e58d5522a8 100644
--- a/frontend/editor/src/portal/views/Policies.css
+++ b/frontend/editor/src/portal/views/Policies.css
@@ -183,6 +183,12 @@
   border-top: 1px solid var(--color-border-light);
 }
 
+@media (max-width: 30rem) {
+  .portal-policies__card-stats {
+    grid-template-columns: 1fr;
+  }
+}
+
 /* Wizard + detail shared chrome */
 .portal-policies__wizard-title {
   display: inline-flex;
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index c0e7a56bd9..c092905fe2 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -12,6 +12,7 @@
   display: flex;
   align-items: flex-start;
   justify-content: space-between;
+  flex-wrap: wrap; /* actions drop below the title on narrow screens */
   gap: 1rem;
 }
 
@@ -196,6 +197,12 @@
   }
 }
 
+@media (max-width: 30rem) {
+  .portal-sources__stat-grid {
+    grid-template-columns: 1fr;
+  }
+}
+
 /* Stat tiles now use the shared <StatTile>. */
 
 .portal-sources__url {
@@ -317,6 +324,14 @@
   padding: 0;
 }
 
+/* Phones: labelled step pills don't fit side by side — stack them */
+@media (max-width: 30rem) {
+  .portal-sources__steps {
+    flex-direction: column;
+    gap: 0.375rem;
+  }
+}
+
 .portal-sources__step {
   display: flex;
   align-items: center;
diff --git a/frontend/editor/src/portal/views/Users.css b/frontend/editor/src/portal/views/Users.css
index dfaa9284a6..62c72549bf 100644
--- a/frontend/editor/src/portal/views/Users.css
+++ b/frontend/editor/src/portal/views/Users.css
@@ -226,6 +226,12 @@
   margin: 0.75rem 0 0.875rem;
 }
 
+@media (max-width: 30rem) {
+  .portal-users__access-stats {
+    grid-template-columns: 1fr;
+  }
+}
+
 .portal-users__toggle-rows {
   display: flex;
   flex-direction: column;

From 3bf0019d7c74b2bead1be09351102b6bf3759b57 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Wed, 22 Jul 2026 13:33:53 +0100
Subject: [PATCH 082/109] Webhook policy source (#7051)

# Description of Changes
Create custom webhooks as a source, allows file pushes toa custom made
endpoint with custom auth ID

- Adds webhook as a policy source: external systems push documents to a
receiver endpoint, which stages the files locally and triggers the
policy run
- Requests are authenticated with HMAC signatures; receiver hardened
with bounded body reads and server-minted IDs
- Uses the same team-scoped IntegrationConfig connection model as the S3
source, with matching portal UI (source type, icon, wizard)
- Includes a policies-gated Cucumber feature covering the receiver
end-to-end

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../common/model/ApplicationProperties.java   |   2 +
 .../software/common/util/RequestUriUtils.java |   1 +
 .../common/util/RequestUriUtilsTest.java      |   7 +
 .../proprietary/policy/input/InputSource.java |   6 +
 .../policy/input/WebhookInputSource.java      | 145 +++++++++++++
 .../policy/source/SourceController.java       |  33 ++-
 .../policy/source/SourceOverviewService.java  |  14 +-
 .../proprietary/policy/source/SourceView.java |   3 +-
 .../policy/trigger/WebhookTrigger.java        | 130 ++++++++++++
 .../policy/webhook/WebhookConfig.java         |  37 ++++
 .../policy/webhook/WebhookIds.java            |  33 +++
 .../webhook/WebhookReceiverController.java    | 150 ++++++++++++++
 .../policy/webhook/WebhookSignatures.java     |  49 +++++
 .../policy/webhook/WebhookSpool.java          |  87 ++++++++
 .../proprietary/util/SecretMasker.java        |   2 +-
 .../policy/input/WebhookInputSourceTest.java  | 165 +++++++++++++++
 .../policy/source/SourceControllerTest.java   |  52 +++++
 .../policy/trigger/WebhookTriggerTest.java    | 115 +++++++++++
 .../webhook/WebhookLocalDeliveryE2eTest.java  | 137 +++++++++++++
 .../WebhookReceiverControllerTest.java        | 193 ++++++++++++++++++
 .../policy/webhook/WebhookSignaturesTest.java |  48 +++++
 .../proprietary/util/SecretMaskerTest.java    |  11 +
 .../public/locales/en-US/translation.toml     |  19 ++
 frontend/editor/src/portal/api/sources.ts     |   1 +
 .../components/sources/SourceTypeIcon.tsx     |   1 +
 .../portal/components/sources/sourceTypes.ts  |  14 ++
 .../src/portal/mocks/handlers/sources.ts      |  35 +++-
 .../editor/src/portal/views/SourceBuilder.css |  29 +++
 .../src/portal/views/SourceBuilder.test.tsx   |  33 +++
 .../editor/src/portal/views/SourceBuilder.tsx | 132 +++++++++++-
 frontend/editor/src/portal/views/Sources.css  |   5 +
 testing/cucumber/features/environment.py      |  48 +++++
 .../steps/webhook_step_definitions.py         |  84 ++++++++
 .../cucumber/features/webhook_source.feature  |  25 +++
 34 files changed, 1835 insertions(+), 11 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/input/WebhookInputSource.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/WebhookTrigger.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookConfig.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookIds.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookReceiverController.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookSignatures.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookSpool.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/input/WebhookInputSourceTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/trigger/WebhookTriggerTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookLocalDeliveryE2eTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookReceiverControllerTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookSignaturesTest.java
 create mode 100644 testing/cucumber/features/steps/webhook_step_definitions.py
 create mode 100644 testing/cucumber/features/webhook_source.feature

diff --git a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
index 9714f7a1dd..b55fc381bb 100644
--- a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
+++ b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
@@ -249,6 +249,8 @@ public class ApplicationProperties {
          * in-network object store.
          */
         private boolean allowPrivateS3Endpoints = false;
+
+        private long webhookMaxBytes = 104857600L;
     }
 
     @Data
diff --git a/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java b/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java
index ea14dcc5b3..a653ae6c0b 100644
--- a/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java
+++ b/app/common/src/main/java/stirling/software/common/util/RequestUriUtils.java
@@ -202,6 +202,7 @@ public class RequestUriUtils {
                 || trimmedUri.startsWith("/readiness")
                 || trimmedUri.startsWith(
                         "/api/v1/mobile-scanner/") // Mobile scanner endpoints (no auth)
+                || trimmedUri.startsWith("/api/v1/webhooks/")
                 || trimmedUri.startsWith("/v1/api-docs")
                 // Workflow participant endpoints - access controlled by share tokens, not login
                 || trimmedUri.startsWith("/api/v1/workflow/participant/")
diff --git a/app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java b/app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java
index a6fefd1091..1912f3808b 100644
--- a/app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java
+++ b/app/common/src/test/java/stirling/software/common/util/RequestUriUtilsTest.java
@@ -176,6 +176,13 @@ class RequestUriUtilsTest {
         assertFalse(RequestUriUtils.isPublicAuthEndpoint("/api/v1/convert", ""));
     }
 
+    @Test
+    void testIsPublicAuthEndpoint_webhookReceiver() {
+        // The webhook source receiver authenticates each delivery by HMAC signature, not a session.
+        assertTrue(RequestUriUtils.isPublicAuthEndpoint("/api/v1/webhooks/whk_abc123", ""));
+        assertTrue(RequestUriUtils.isPublicAuthEndpoint("/app/api/v1/webhooks/whk_abc123", "/app"));
+    }
+
     @Test
     void testIsPublicAuthEndpoint_withContextPath() {
         assertTrue(RequestUriUtils.isPublicAuthEndpoint("/app/login", "/app"));
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/InputSource.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/InputSource.java
index d32c2fc546..15fb0d84f2 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/InputSource.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/InputSource.java
@@ -3,6 +3,7 @@ package stirling.software.proprietary.policy.input;
 import java.io.IOException;
 import java.nio.file.Path;
 import java.util.List;
+import java.util.Map;
 
 import stirling.software.proprietary.policy.model.InputSpec;
 
@@ -22,6 +23,11 @@ public interface InputSource {
     /** Throws {@link IllegalArgumentException} on bad config. Called on save to fail fast. */
     default void validate(InputSpec spec) {}
 
+    default Map<String, Object> prepareOptionsForSave(
+            Map<String, Object> options, boolean isCreate) {
+        return options;
+    }
+
     /**
      * Resolve the spec into zero or more units of work, each carrying one run's files and a
      * completion hook. Empty list means nothing to run right now. Discovery is read-only - files
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/WebhookInputSource.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/WebhookInputSource.java
new file mode 100644
index 0000000000..49cb3c70c4
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/input/WebhookInputSource.java
@@ -0,0 +1,145 @@
+package stirling.software.proprietary.policy.input;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Stream;
+
+import org.springframework.core.io.FileSystemResource;
+import org.springframework.core.io.Resource;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.util.FileReadinessChecker;
+import stirling.software.proprietary.policy.ledger.FolderIdentities;
+import stirling.software.proprietary.policy.model.InputSpec;
+import stirling.software.proprietary.policy.model.PolicyInputs;
+import stirling.software.proprietary.policy.webhook.WebhookConfig;
+import stirling.software.proprietary.policy.webhook.WebhookIds;
+import stirling.software.proprietary.policy.webhook.WebhookSpool;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class WebhookInputSource implements InputSource {
+
+    static final String TYPE = "webhook";
+
+    private final WebhookSpool spool;
+    private final FileReadinessChecker readinessChecker;
+
+    @Override
+    public String type() {
+        return TYPE;
+    }
+
+    @Override
+    public boolean supports(InputSpec spec) {
+        return spec != null && TYPE.equals(spec.type());
+    }
+
+    @Override
+    public void validate(InputSpec spec) {
+        WebhookConfig.from(spec.options());
+    }
+
+    @Override
+    public Map<String, Object> prepareOptionsForSave(
+            Map<String, Object> options, boolean isCreate) {
+        boolean hasId =
+                options.get(WebhookConfig.WEBHOOK_ID_OPTION) != null
+                        && !options.get(WebhookConfig.WEBHOOK_ID_OPTION).toString().isBlank();
+        if (!isCreate && hasId) {
+            return options;
+        }
+        Map<String, Object> prepared = new LinkedHashMap<>(options);
+        prepared.put(WebhookConfig.WEBHOOK_ID_OPTION, WebhookIds.newWebhookId());
+        prepared.put(WebhookConfig.SIGNING_SECRET_OPTION, WebhookIds.newSigningSecret());
+        return prepared;
+    }
+
+    @Override
+    public List<ResolvedInput> resolve(InputSpec spec, ResolveContext ctx) throws IOException {
+        WebhookConfig config = WebhookConfig.from(spec.options());
+        Path dir = spool.dirFor(config.webhookId());
+        if (!Files.isDirectory(dir)) {
+            ctx.reportPresent(List.of());
+            return List.of();
+        }
+        Path canonicalDir = FolderIdentities.canonicalDir(dir);
+        List<Path> present = listFiles(dir);
+
+        ctx.reportPresent(
+                present.stream()
+                        .map(file -> FolderIdentities.identity(canonicalDir, dir, file))
+                        .toList());
+
+        List<ResolvedInput> work = new ArrayList<>();
+        for (Path file : present) {
+            if (!readinessChecker.isReady(file)) {
+                continue;
+            }
+            String identity = FolderIdentities.identity(canonicalDir, dir, file);
+            String gate;
+            boolean claimed;
+            try {
+                gate = FolderIdentities.statGate(file);
+                claimed = ctx.claim(identity, gate, null);
+            } catch (IOException | UncheckedIOException e) {
+                log.debug("Could not read {} for its version: {}", file, e.getMessage());
+                continue;
+            }
+            if (!claimed) {
+                continue;
+            }
+            work.add(
+                    new ResolvedInput(
+                            PolicyInputs.of(List.of(fileResource(file))),
+                            success -> completeConsumed(ctx, identity, file, gate, success)));
+        }
+        return work;
+    }
+
+    private static void completeConsumed(
+            ResolveContext ctx, String identity, Path file, String claimGate, boolean success) {
+        ctx.settle(identity, claimGate, null, success);
+        if (!success) {
+            return;
+        }
+        try {
+            if (FolderIdentities.statGate(file).equals(claimGate) && ctx.allSettledDone(identity)) {
+                Files.deleteIfExists(file);
+            }
+        } catch (java.nio.file.NoSuchFileException alreadyGone) {
+        } catch (IOException e) {
+            log.warn("Could not remove consumed webhook delivery {}: {}", file, e.getMessage());
+        }
+    }
+
+    private static List<Path> listFiles(Path dir) throws IOException {
+        List<Path> files = new ArrayList<>();
+        try (Stream<Path> entries = Files.list(dir)) {
+            entries.filter(Files::isRegularFile)
+                    .filter(file -> !file.getFileName().toString().startsWith("."))
+                    .forEach(files::add);
+        }
+        return files;
+    }
+
+    private static Resource fileResource(Path path) {
+        String name = WebhookSpool.displayName(path.getFileName().toString());
+        return new FileSystemResource(path.toFile()) {
+            @Override
+            public String getFilename() {
+                return name;
+            }
+        };
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
index b9a19e9d2f..4ad611f42e 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
@@ -2,6 +2,7 @@ package stirling.software.proprietary.policy.source;
 
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
@@ -44,6 +45,8 @@ import stirling.software.proprietary.util.SecretMasker;
 @Tag(name = "Sources", description = "Reusable policy input connections")
 public class SourceController {
 
+    private static final String WEBHOOK_TYPE = "webhook";
+
     private final SourceStore sourceStore;
     private final SourceAccessGuard sourceAccessGuard;
     private final SourceOverviewService overviewService;
@@ -107,7 +110,8 @@ public class SourceController {
     public ResponseEntity<Source> save(@RequestBody Source source) {
         requireSourceEditingAllowed();
         requireNotEditor(source.id(), source.type());
-        Source owned = withStoredSecrets(resolveOwnership(source));
+        boolean isCreate = source.id() == null || source.id().isBlank();
+        Source owned = withPreparedOptions(withStoredSecrets(resolveOwnership(source)), isCreate);
         try {
             validateConfig(owned);
         } catch (IllegalArgumentException e) {
@@ -117,7 +121,7 @@ public class SourceController {
         // An edited folder source can change which directory needs watching, so re-sync trigger
         // registrations now instead of waiting for the next reconcile.
         policyTriggerManager.notifyPoliciesChanged();
-        return ResponseEntity.ok(withMaskedSecrets(saved));
+        return ResponseEntity.ok(revealOnCreate(saved, isCreate));
     }
 
     @DeleteMapping("/{sourceId}")
@@ -219,14 +223,33 @@ public class SourceController {
     /** Validate the config against the bean that handles the source's type, as the engine will. */
     private void validateConfig(Source source) {
         InputSpec spec = source.toInputSpec();
-        inputSources.stream()
-                .filter(inputSource -> inputSource.supports(spec))
-                .findFirst()
+        inputSourceFor(spec)
                 .orElseThrow(
                         () -> new IllegalArgumentException("unknown source type: " + source.type()))
                 .validate(spec);
     }
 
+    private Source withPreparedOptions(Source source, boolean isCreate) {
+        InputSpec spec = source.toInputSpec();
+        InputSource input = inputSourceFor(spec).orElse(null);
+        if (input == null) {
+            return source;
+        }
+        Map<String, Object> prepared = input.prepareOptionsForSave(source.options(), isCreate);
+        return prepared == null ? source : withOptions(source, prepared);
+    }
+
+    private static Source revealOnCreate(Source saved, boolean isCreate) {
+        if (isCreate && WEBHOOK_TYPE.equals(saved.type())) {
+            return saved;
+        }
+        return withMaskedSecrets(saved);
+    }
+
+    private Optional<InputSource> inputSourceFor(InputSpec spec) {
+        return inputSources.stream().filter(input -> input.supports(spec)).findFirst();
+    }
+
     /**
      * Editing sources requires the editor role for the caller's team (a team leader on SaaS), the
      * same rule as policies. Single-user deployments (login disabled) trust the local operator.
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java
index 1f5eb18174..2c02b9f152 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java
@@ -100,7 +100,8 @@ public class SourceOverviewService {
                 List.of(),
                 docs.total(),
                 docs.last24h(),
-                docs.last30d());
+                docs.last30d(),
+                null);
     }
 
     /**
@@ -141,7 +142,16 @@ public class SourceOverviewService {
                 configRows(source),
                 docs.total(),
                 docs.last24h(),
-                docs.last30d());
+                docs.last30d(),
+                webhookPath(source));
+    }
+
+    private static String webhookPath(Source source) {
+        if (!"webhook".equals(source.type())) {
+            return null;
+        }
+        Object webhookId = source.options().get("webhookId");
+        return webhookId == null ? null : "/api/v1/webhooks/" + webhookId;
     }
 
     /** A disabled (paused) source reads as "disabled"; an unreferenced one reads as "unused". */
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceView.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceView.java
index 6c6a9c4c6d..077edf62d8 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceView.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceView.java
@@ -17,7 +17,8 @@ public record SourceView(
         List<DetailRow> config,
         long docsTotal,
         long docs24h,
-        long docs30d) {
+        long docs30d,
+        String webhookPath) {
 
     /** A policy that references this source. */
     public record PolicyRef(String id, String name) {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/WebhookTrigger.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/WebhookTrigger.java
new file mode 100644
index 0000000000..816f510bba
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/trigger/WebhookTrigger.java
@@ -0,0 +1,130 @@
+package stirling.software.proprietary.policy.trigger;
+
+import java.util.Set;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.policy.engine.PolicyRunner;
+import stirling.software.proprietary.policy.engine.SweepKind;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.store.PolicyStore;
+import stirling.software.proprietary.policy.webhook.WebhookConfig;
+
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class WebhookTrigger implements PolicyTrigger {
+
+    static final String TYPE = "webhook";
+    private static final String WEBHOOK_SOURCE_TYPE = "webhook";
+
+    private final PolicyStore policyStore;
+    private final PolicyRunner policyRunner;
+    private final SourceStore sourceStore;
+    private final ApplicationProperties applicationProperties;
+
+    private volatile ScheduledExecutorService reconciler;
+
+    @Override
+    public String type() {
+        return TYPE;
+    }
+
+    @Override
+    public boolean requiresSource() {
+        return true;
+    }
+
+    @Override
+    public Set<String> supportedSourceTypes() {
+        return Set.of(WEBHOOK_SOURCE_TYPE);
+    }
+
+    @Override
+    public void validate(Policy policy) {
+        boolean hasWebhookSource =
+                policy.sourceIds().stream()
+                        .map(sourceStore::get)
+                        .flatMap(java.util.Optional::stream)
+                        .anyMatch(source -> WEBHOOK_SOURCE_TYPE.equals(source.type()));
+        if (!hasWebhookSource) {
+            throw new IllegalArgumentException(
+                    "webhook trigger requires at least one webhook input source");
+        }
+    }
+
+    @Override
+    public synchronized void start() {
+        if (reconciler != null) {
+            return;
+        }
+        long reconcileSeconds = applicationProperties.getPolicies().getWatchReconcileSeconds();
+        reconciler =
+                Executors.newSingleThreadScheduledExecutor(
+                        Thread.ofVirtual().name("policy-webhook-reconcile-", 0).factory());
+        reconciler.scheduleAtFixedRate(this::safeReconcile, 0, reconcileSeconds, TimeUnit.SECONDS);
+        log.info("Webhook trigger started (reconcile every {}s)", reconcileSeconds);
+    }
+
+    @Override
+    public synchronized void stop() {
+        if (reconciler != null) {
+            reconciler.shutdownNow();
+            reconciler = null;
+        }
+    }
+
+    public void fireForWebhook(String webhookId) {
+        for (Policy policy : policyStore.findByTriggerType(TYPE)) {
+            if (!referencesWebhook(policy, webhookId)) {
+                continue;
+            }
+            try {
+                log.debug("Webhook policy {} ({}) saw a delivery", policy.id(), policy.name());
+                policyRunner.run(policy, SweepKind.LIGHT);
+            } catch (RuntimeException e) {
+                log.warn("Webhook run failed for policy {}: {}", policy.id(), e.getMessage());
+            }
+        }
+    }
+
+    private void safeReconcile() {
+        try {
+            for (Policy policy : policyStore.findByTriggerType(TYPE)) {
+                try {
+                    policyRunner.run(policy);
+                } catch (RuntimeException e) {
+                    log.warn(
+                            "Webhook reconcile run failed for policy {}: {}",
+                            policy.id(),
+                            e.getMessage());
+                }
+            }
+        } catch (RuntimeException e) {
+            log.error("Webhook reconcile failed: {}", e.getMessage(), e);
+        }
+    }
+
+    private boolean referencesWebhook(Policy policy, String webhookId) {
+        for (String sourceId : policy.sourceIds()) {
+            Source source = sourceStore.get(sourceId).orElse(null);
+            if (source == null || !WEBHOOK_SOURCE_TYPE.equals(source.type())) {
+                continue;
+            }
+            Object configured = source.options().get(WebhookConfig.WEBHOOK_ID_OPTION);
+            if (configured != null && configured.toString().equals(webhookId)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookConfig.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookConfig.java
new file mode 100644
index 0000000000..4757513314
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookConfig.java
@@ -0,0 +1,37 @@
+package stirling.software.proprietary.policy.webhook;
+
+import java.util.Map;
+
+public record WebhookConfig(String webhookId, String signingSecret) {
+
+    public static final String WEBHOOK_ID_OPTION = "webhookId";
+    public static final String SIGNING_SECRET_OPTION = "signingSecret";
+
+    public static WebhookConfig from(Map<String, Object> options) {
+        String webhookId = trimmed(options.get(WEBHOOK_ID_OPTION));
+        if (webhookId == null) {
+            throw new IllegalArgumentException("webhook config requires a 'webhookId' option");
+        }
+        if (!WebhookIds.isValidId(webhookId)) {
+            throw new IllegalArgumentException("webhook config 'webhookId' has an invalid format");
+        }
+        String signingSecret = trimmed(options.get(SIGNING_SECRET_OPTION));
+        if (signingSecret == null) {
+            throw new IllegalArgumentException("webhook config requires a 'signingSecret' option");
+        }
+        return new WebhookConfig(webhookId, signingSecret);
+    }
+
+    private static String trimmed(Object value) {
+        if (value == null) {
+            return null;
+        }
+        String text = value.toString().trim();
+        return text.isEmpty() ? null : text;
+    }
+
+    @Override
+    public String toString() {
+        return "WebhookConfig[webhookId=" + webhookId + "]";
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookIds.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookIds.java
new file mode 100644
index 0000000000..098e7d2972
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookIds.java
@@ -0,0 +1,33 @@
+package stirling.software.proprietary.policy.webhook;
+
+import java.security.SecureRandom;
+import java.util.Base64;
+import java.util.regex.Pattern;
+
+public final class WebhookIds {
+
+    private static final Pattern VALID_ID = Pattern.compile("^[A-Za-z0-9_-]{16,128}$");
+
+    private static final SecureRandom RANDOM = new SecureRandom();
+    private static final Base64.Encoder ENCODER = Base64.getUrlEncoder().withoutPadding();
+
+    private WebhookIds() {}
+
+    public static String newWebhookId() {
+        return randomToken(18);
+    }
+
+    public static String newSigningSecret() {
+        return randomToken(32);
+    }
+
+    public static boolean isValidId(String id) {
+        return id != null && VALID_ID.matcher(id).matches();
+    }
+
+    private static String randomToken(int bytes) {
+        byte[] buffer = new byte[bytes];
+        RANDOM.nextBytes(buffer);
+        return ENCODER.encodeToString(buffer);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookReceiverController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookReceiverController.java
new file mode 100644
index 0000000000..509c6c7fd3
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookReceiverController.java
@@ -0,0 +1,150 @@
+package stirling.software.proprietary.policy.webhook;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Arrays;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+
+import io.swagger.v3.oas.annotations.Hidden;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.trigger.WebhookTrigger;
+
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/webhooks")
+@Hidden
+@RequiredArgsConstructor
+@Tag(name = "Webhooks", description = "Inbound webhook source receiver")
+public class WebhookReceiverController {
+
+    static final String SIGNATURE_HEADER = "X-Stirling-Signature";
+    static final String FILENAME_HEADER = "X-Stirling-Filename";
+    private static final String WEBHOOK_TYPE = "webhook";
+
+    private final SourceStore sourceStore;
+    private final WebhookSpool spool;
+    private final WebhookTrigger webhookTrigger;
+    private final ApplicationProperties applicationProperties;
+
+    @PostMapping("/{webhookId}")
+    @Operation(
+            summary = "Deliver a document to a webhook source",
+            description =
+                    "The body is the raw document; sign it with the source's secret and present"
+                            + " 'sha256=<hex>' in the X-Stirling-Signature header. Returns 202 once"
+                            + " the document is spooled for the referencing policies.")
+    public ResponseEntity<WebhookDeliveryResponse> receive(
+            @PathVariable String webhookId,
+            @RequestHeader(value = SIGNATURE_HEADER, required = false) String signature,
+            @RequestHeader(value = FILENAME_HEADER, required = false) String filename,
+            HttpServletRequest request) {
+        if (!WebhookIds.isValidId(webhookId)) {
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "No such webhook");
+        }
+        Source source = findWebhookSource(webhookId);
+        if (source == null) {
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "No such webhook");
+        }
+
+        WebhookConfig config = WebhookConfig.from(source.options());
+        byte[] body = readBoundedBody(request);
+        if (!WebhookSignatures.verify(config.signingSecret(), body, signature)) {
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Invalid signature");
+        }
+        if (!source.enabled()) {
+            throw new ResponseStatusException(
+                    HttpStatus.FORBIDDEN, "Webhook source is paused; deliveries are not accepted");
+        }
+        if (body.length == 0) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Empty request body");
+        }
+
+        String storedName = stageToSpool(webhookId, filename, body);
+
+        webhookTrigger.fireForWebhook(webhookId);
+        log.info(
+                "Accepted webhook delivery '{}' ({} bytes) for {}",
+                storedName,
+                body.length,
+                webhookId);
+        return ResponseEntity.accepted()
+                .contentType(MediaType.APPLICATION_JSON)
+                .body(new WebhookDeliveryResponse(true, storedName, body.length));
+    }
+
+    private Source findWebhookSource(String webhookId) {
+        for (Source source : sourceStore.all()) {
+            if (!WEBHOOK_TYPE.equals(source.type())) {
+                continue;
+            }
+            Object configured = source.options().get(WebhookConfig.WEBHOOK_ID_OPTION);
+            if (configured != null && configured.toString().equals(webhookId)) {
+                return source;
+            }
+        }
+        return null;
+    }
+
+    private String stageToSpool(String webhookId, String filename, byte[] body) {
+        try {
+            return WebhookSpool.displayName(
+                    spool.store(webhookId, filename, body).getFileName().toString());
+        } catch (IOException e) {
+            log.error("Could not spool webhook delivery for {}: {}", webhookId, e.getMessage());
+            throw new ResponseStatusException(
+                    HttpStatus.INTERNAL_SERVER_ERROR, "Could not store delivery");
+        }
+    }
+
+    private byte[] readBoundedBody(HttpServletRequest request) {
+        long maxBytes = applicationProperties.getPolicies().getWebhookMaxBytes();
+        long declared = request.getContentLengthLong();
+        if (declared < 0) {
+            throw new ResponseStatusException(
+                    HttpStatus.LENGTH_REQUIRED, "A Content-Length header is required");
+        }
+        if (declared > maxBytes) {
+            throw new ResponseStatusException(
+                    HttpStatus.PAYLOAD_TOO_LARGE,
+                    "Delivery exceeds the " + maxBytes + "-byte limit");
+        }
+        byte[] body = new byte[(int) declared];
+        int total = 0;
+        try (InputStream in = request.getInputStream()) {
+            int read;
+            while (total < body.length
+                    && (read = in.read(body, total, body.length - total)) != -1) {
+                total += read;
+            }
+            if (total == body.length && in.read() != -1) {
+                throw new ResponseStatusException(
+                        HttpStatus.BAD_REQUEST, "Body exceeds the declared Content-Length");
+            }
+        } catch (IOException e) {
+            throw new ResponseStatusException(
+                    HttpStatus.BAD_REQUEST, "Could not read request body");
+        }
+        return total == body.length ? body : Arrays.copyOf(body, total);
+    }
+
+    public record WebhookDeliveryResponse(boolean accepted, String filename, int bytes) {}
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookSignatures.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookSignatures.java
new file mode 100644
index 0000000000..3373bc7503
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookSignatures.java
@@ -0,0 +1,49 @@
+package stirling.software.proprietary.policy.webhook;
+
+import java.nio.charset.StandardCharsets;
+import java.security.InvalidKeyException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.HexFormat;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+
+public final class WebhookSignatures {
+
+    private static final String ALGORITHM = "HmacSHA256";
+    private static final String PREFIX = "sha256=";
+
+    private WebhookSignatures() {}
+
+    public static String sign(String signingSecret, byte[] body) {
+        return PREFIX + HexFormat.of().formatHex(hmac(signingSecret, body));
+    }
+
+    public static boolean verify(String signingSecret, byte[] body, String presented) {
+        if (signingSecret == null || presented == null || body == null) {
+            return false;
+        }
+        String hex = presented.trim();
+        if (hex.regionMatches(true, 0, PREFIX, 0, PREFIX.length())) {
+            hex = hex.substring(PREFIX.length());
+        }
+        byte[] presentedBytes;
+        try {
+            presentedBytes = HexFormat.of().parseHex(hex);
+        } catch (IllegalArgumentException notHex) {
+            return false;
+        }
+        return MessageDigest.isEqual(hmac(signingSecret, body), presentedBytes);
+    }
+
+    private static byte[] hmac(String signingSecret, byte[] body) {
+        try {
+            Mac mac = Mac.getInstance(ALGORITHM);
+            mac.init(new SecretKeySpec(signingSecret.getBytes(StandardCharsets.UTF_8), ALGORITHM));
+            return mac.doFinal(body);
+        } catch (NoSuchAlgorithmException | InvalidKeyException e) {
+            throw new IllegalStateException("HMAC-SHA256 unavailable", e);
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookSpool.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookSpool.java
new file mode 100644
index 0000000000..6a8377c67a
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/webhook/WebhookSpool.java
@@ -0,0 +1,87 @@
+package stirling.software.proprietary.policy.webhook;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.util.UUID;
+
+import org.springframework.stereotype.Component;
+
+import stirling.software.common.configuration.InstallationPathConfig;
+
+@Component
+public class WebhookSpool {
+
+    private static final String SPOOL_DIR = "policy-webhook-spool";
+    private static final String TEMP_SUFFIX = ".part";
+    private static final String DEFAULT_NAME = "document.pdf";
+    private static final int UNIQUE_LEN = 32;
+
+    private final Path spoolRoot;
+
+    public WebhookSpool() {
+        this(Path.of(InstallationPathConfig.getPath(), SPOOL_DIR));
+    }
+
+    public WebhookSpool(Path spoolRoot) {
+        this.spoolRoot = spoolRoot.toAbsolutePath().normalize();
+    }
+
+    public Path dirFor(String webhookId) {
+        if (!WebhookIds.isValidId(webhookId)) {
+            throw new IllegalArgumentException("invalid webhookId");
+        }
+        Path dir = spoolRoot.resolve(webhookId).normalize();
+        if (!dir.getParent().equals(spoolRoot)) {
+            throw new IllegalArgumentException("invalid webhookId");
+        }
+        return dir;
+    }
+
+    public Path store(String webhookId, String filename, byte[] content) throws IOException {
+        Path dir = dirFor(webhookId);
+        Files.createDirectories(dir);
+        String finalName = spoolName(filename);
+        Path target = dir.resolve(finalName).normalize();
+        Path temp = dir.resolve("." + finalName + TEMP_SUFFIX).normalize();
+        if (!target.startsWith(dir) || !temp.startsWith(dir)) {
+            throw new IllegalArgumentException("invalid delivery name");
+        }
+        Files.write(temp, content);
+        try {
+            Files.move(temp, target, StandardCopyOption.ATOMIC_MOVE);
+        } catch (IOException atomicUnsupported) {
+            Files.move(temp, target, StandardCopyOption.REPLACE_EXISTING);
+        }
+        return target;
+    }
+
+    static String spoolName(String filename) {
+        return UUID.randomUUID().toString().replace("-", "") + "-" + sanitize(filename);
+    }
+
+    public static String displayName(String spoolFileName) {
+        int dash = spoolFileName.indexOf('-');
+        if (dash == UNIQUE_LEN && dash + 1 < spoolFileName.length()) {
+            return spoolFileName.substring(dash + 1);
+        }
+        return spoolFileName;
+    }
+
+    private static String sanitize(String filename) {
+        if (filename == null) {
+            return DEFAULT_NAME;
+        }
+        String base = filename.replace('\\', '/');
+        int slash = base.lastIndexOf('/');
+        if (slash >= 0) {
+            base = base.substring(slash + 1);
+        }
+        base = base.replaceAll("[^A-Za-z0-9._-]", "_").trim();
+        while (base.startsWith(".")) {
+            base = base.substring(1);
+        }
+        return base.isEmpty() ? DEFAULT_NAME : base;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/util/SecretMasker.java b/app/proprietary/src/main/java/stirling/software/proprietary/util/SecretMasker.java
index 5a9619c2dd..f7ce2569f2 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/util/SecretMasker.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/util/SecretMasker.java
@@ -22,7 +22,7 @@ public final class SecretMasker {
                     .getPattern(
                             // secret[_-]?access[_-]?key precedes plain secret so camelCase keys
                             // like secretAccessKey (no word boundary after "secret") still match.
-                            "(?i)\\b(password|token|secret[_-]?access[_-]?key|secret|api[_-]?key|authorization|auth|jwt|cred|cert)\\b");
+                            "(?i)\\b(password|token|secret[_-]?access[_-]?key|signing[_-]?secret|secret|api[_-]?key|authorization|auth|jwt|cred|cert)\\b");
 
     private SecretMasker() {}
 
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/WebhookInputSourceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/WebhookInputSourceTest.java
new file mode 100644
index 0000000000..9255e82d19
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/WebhookInputSourceTest.java
@@ -0,0 +1,165 @@
+package stirling.software.proprietary.policy.input;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.lenient;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Supplier;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.junit.jupiter.api.io.TempDir;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import stirling.software.common.util.FileReadinessChecker;
+import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
+import stirling.software.proprietary.policy.model.InputSpec;
+import stirling.software.proprietary.policy.webhook.WebhookConfig;
+import stirling.software.proprietary.policy.webhook.WebhookSpool;
+
+@ExtendWith(MockitoExtension.class)
+class WebhookInputSourceTest {
+
+    private static final String POLICY = "p1";
+    private static final String WEBHOOK_ID = "testwebhookid1234";
+
+    @Mock private FileReadinessChecker readinessChecker;
+
+    @TempDir Path tempDir;
+
+    private WebhookSpool spool;
+    private WebhookInputSource source;
+    private InProcessProcessedLedger ledger;
+    private RecordingContext ctx;
+
+    @BeforeEach
+    void setUp() {
+        spool = new WebhookSpool(tempDir.resolve("spool"));
+        source = new WebhookInputSource(spool, readinessChecker);
+        ledger = new InProcessProcessedLedger();
+        ctx = new RecordingContext();
+        lenient().when(readinessChecker.isReady(any())).thenReturn(true);
+    }
+
+    private static InputSpec spec(String mode) {
+        return new InputSpec(
+                "webhook",
+                Map.of("webhookId", WEBHOOK_ID, "signingSecret", "secret", "mode", mode));
+    }
+
+    @Test
+    void consumeRemovesTheDeliveryOnceProcessed() throws IOException {
+        Path delivered = spool.store(WEBHOOK_ID, "doc.pdf", "data".getBytes());
+
+        List<ResolvedInput> work = source.resolve(spec("consume"), ctx);
+
+        assertEquals(1, work.size());
+        assertEquals("doc.pdf", work.get(0).inputs().primary().get(0).getFilename());
+        assertTrue(Files.exists(delivered));
+        assertTrue(source.resolve(spec("consume"), ctx).isEmpty());
+
+        work.get(0).onComplete().accept(true);
+        assertTrue(Files.notExists(delivered));
+        assertTrue(source.resolve(spec("consume"), ctx).isEmpty());
+    }
+
+    @Test
+    void aFailedRunLeavesTheDeliveryInPlace() throws IOException {
+        Path delivered = spool.store(WEBHOOK_ID, "doc.pdf", "data".getBytes());
+
+        List<ResolvedInput> work = source.resolve(spec("consume"), ctx);
+        work.get(0).onComplete().accept(false);
+
+        assertTrue(Files.exists(delivered));
+    }
+
+    @Test
+    void nothingDeliveredIsAnEmptySourceNotAnError() throws IOException {
+        List<ResolvedInput> work = source.resolve(spec("consume"), ctx);
+        assertTrue(work.isEmpty());
+        assertTrue(ctx.present.isEmpty());
+    }
+
+    @Test
+    void validateRejectsMissingIdOrSecret() {
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> source.validate(new InputSpec("webhook", Map.of("signingSecret", "s"))));
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> source.validate(new InputSpec("webhook", Map.of("webhookId", WEBHOOK_ID))));
+    }
+
+    @Test
+    void prepareMintsIdAndSecretOnCreate() {
+        Map<String, Object> prepared =
+                source.prepareOptionsForSave(Map.of("mode", "consume"), true);
+
+        String id = prepared.get(WebhookConfig.WEBHOOK_ID_OPTION).toString();
+        String secret = prepared.get(WebhookConfig.SIGNING_SECRET_OPTION).toString();
+        assertFalse(id.isBlank());
+        assertFalse(secret.isBlank());
+        assertEquals("consume", prepared.get("mode"));
+        Map<String, Object> other = source.prepareOptionsForSave(Map.of(), true);
+        assertNotEquals(id, other.get(WebhookConfig.WEBHOOK_ID_OPTION).toString());
+    }
+
+    @Test
+    void prepareLeavesAnExistingWebhookUntouchedOnEdit() {
+        Map<String, Object> existing = Map.of("webhookId", WEBHOOK_ID, "signingSecret", "keepme");
+
+        Map<String, Object> prepared = source.prepareOptionsForSave(existing, false);
+
+        assertEquals(WEBHOOK_ID, prepared.get("webhookId"));
+        assertEquals("keepme", prepared.get("signingSecret"));
+    }
+
+    @Test
+    void prepareIgnoresClientSuppliedIdAndSecretOnCreate() {
+        Map<String, Object> prepared =
+                source.prepareOptionsForSave(
+                        Map.of("webhookId", "client-chosen-id", "signingSecret", "weak"), true);
+
+        assertNotEquals("client-chosen-id", prepared.get(WebhookConfig.WEBHOOK_ID_OPTION));
+        assertNotEquals("weak", prepared.get(WebhookConfig.SIGNING_SECRET_OPTION));
+    }
+
+    private class RecordingContext implements ResolveContext {
+
+        private final List<String> present = new ArrayList<>();
+
+        @Override
+        public boolean claim(String identity, String gate, Supplier<String> contentHash) {
+            return ledger.claim(POLICY, identity, gate, contentHash);
+        }
+
+        @Override
+        public void settle(
+                String identity, String finalGate, String finalContentHash, boolean success) {
+            ledger.settle(POLICY, identity, finalGate, finalContentHash, success);
+        }
+
+        @Override
+        public boolean allSettledDone(String identity) {
+            return ledger.allSettledDone(identity);
+        }
+
+        @Override
+        public void reportPresent(Collection<String> identities) {
+            present.addAll(identities);
+        }
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/source/SourceControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/source/SourceControllerTest.java
index 295b4785b8..545ea8e50f 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/source/SourceControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/source/SourceControllerTest.java
@@ -1,33 +1,41 @@
 package stirling.software.proprietary.policy.source;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
+import java.nio.file.Path;
 import java.util.List;
 import java.util.Map;
 
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.server.ResponseStatusException;
 
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.service.UserServiceInterface;
+import stirling.software.common.util.FileReadinessChecker;
 import stirling.software.proprietary.policy.config.PolicyAccessGuard;
 import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
 import stirling.software.proprietary.policy.input.InputSource;
+import stirling.software.proprietary.policy.input.WebhookInputSource;
 import stirling.software.proprietary.policy.model.OutputSpec;
 import stirling.software.proprietary.policy.model.PipelineStep;
 import stirling.software.proprietary.policy.model.Policy;
 import stirling.software.proprietary.policy.store.InProcessPolicyStore;
 import stirling.software.proprietary.policy.store.PolicyStore;
 import stirling.software.proprietary.policy.trigger.PolicyTriggerManager;
+import stirling.software.proprietary.policy.webhook.WebhookSpool;
 import stirling.software.proprietary.util.SecretMasker;
 
 /**
@@ -41,6 +49,9 @@ class SourceControllerTest {
     private final PolicyStore policyStore = new InProcessPolicyStore();
     private PolicyTriggerManager triggerManager;
     private SourceController controller;
+    private SourceController webhookController;
+
+    @TempDir Path tempDir;
 
     @BeforeEach
     void setUp() {
@@ -61,6 +72,8 @@ class SourceControllerTest {
         // A permissive input source so config validation passes and save can be exercised.
         InputSource folderInput = mock(InputSource.class);
         when(folderInput.supports(any())).thenReturn(true);
+        when(folderInput.prepareOptionsForSave(any(), anyBoolean()))
+                .thenAnswer(invocation -> invocation.getArgument(0));
         controller =
                 new SourceController(
                         sourceStore,
@@ -72,6 +85,45 @@ class SourceControllerTest {
                         triggerManager,
                         properties,
                         List.of(folderInput));
+        WebhookInputSource webhookInput =
+                new WebhookInputSource(new WebhookSpool(tempDir), mock(FileReadinessChecker.class));
+        webhookController =
+                new SourceController(
+                        sourceStore,
+                        sourceGuard,
+                        overviewService,
+                        policyStore,
+                        policyGuard,
+                        authority,
+                        triggerManager,
+                        properties,
+                        List.of(webhookInput));
+    }
+
+    @Test
+    void creatingAWebhookRevealsItsSecretOnceThenMasks() {
+        Source created =
+                webhookController
+                        .save(
+                                new Source(
+                                        null,
+                                        "Partner uploads",
+                                        "webhook",
+                                        Map.of("mode", "consume"),
+                                        true,
+                                        null,
+                                        null))
+                        .getBody();
+
+        String secret = String.valueOf(created.options().get("signingSecret"));
+        String webhookId = String.valueOf(created.options().get("webhookId"));
+        assertNotEquals(SecretMasker.REDACTED, secret);
+        assertFalse(secret.isBlank());
+        assertFalse(webhookId.isBlank());
+
+        Source read = webhookController.get(created.id()).getBody();
+        assertEquals(SecretMasker.REDACTED, read.options().get("signingSecret"));
+        assertEquals(webhookId, read.options().get("webhookId"));
     }
 
     @Test
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/trigger/WebhookTriggerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/trigger/WebhookTriggerTest.java
new file mode 100644
index 0000000000..63b721dd6d
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/trigger/WebhookTriggerTest.java
@@ -0,0 +1,115 @@
+package stirling.software.proprietary.policy.trigger;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.policy.engine.PolicyRunner;
+import stirling.software.proprietary.policy.engine.SweepKind;
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.PipelineStep;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.model.TriggerConfig;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.store.PolicyStore;
+
+@ExtendWith(MockitoExtension.class)
+class WebhookTriggerTest {
+
+    private static final String TYPE = "webhook";
+
+    @Mock private PolicyStore policyStore;
+    @Mock private PolicyRunner policyRunner;
+
+    private final SourceStore sourceStore = new InProcessSourceStore();
+    private WebhookTrigger trigger;
+
+    @BeforeEach
+    void setUp() {
+        trigger =
+                new WebhookTrigger(
+                        policyStore, policyRunner, sourceStore, new ApplicationProperties());
+    }
+
+    @Test
+    void firesOnlyPoliciesReferencingTheDeliveredWebhook() {
+        Policy matching = webhookPolicy("a", "whkA");
+        Policy other = webhookPolicy("b", "whkB");
+        when(policyStore.findByTriggerType(TYPE)).thenReturn(List.of(matching, other));
+
+        trigger.fireForWebhook("whkA");
+
+        verify(policyRunner).run(matching, SweepKind.LIGHT);
+        verify(policyRunner, never()).run(other, SweepKind.LIGHT);
+    }
+
+    @Test
+    void ignoresADeliveryForAnUnknownWebhookId() {
+        Policy policy = webhookPolicy("a", "whkA");
+        when(policyStore.findByTriggerType(TYPE)).thenReturn(List.of(policy));
+
+        trigger.fireForWebhook("whkZ");
+
+        verify(policyRunner, never()).run(any(), any(SweepKind.class));
+    }
+
+    @Test
+    void validateRequiresAWebhookSource() {
+        assertThrows(
+                IllegalArgumentException.class,
+                () -> trigger.validate(policy("p", webhookTriggerConfig(), List.of())));
+        trigger.validate(webhookPolicy("p", "whkA"));
+    }
+
+    private static TriggerConfig webhookTriggerConfig() {
+        return new TriggerConfig(TYPE, Map.of());
+    }
+
+    private Policy webhookPolicy(String id, String webhookId) {
+        String sourceId =
+                sourceStore
+                        .save(
+                                new Source(
+                                        null,
+                                        "hook",
+                                        "webhook",
+                                        Map.of(
+                                                "webhookId",
+                                                webhookId,
+                                                "signingSecret",
+                                                "s",
+                                                "mode",
+                                                "consume"),
+                                        true,
+                                        "owner",
+                                        null))
+                        .id();
+        return policy(id, webhookTriggerConfig(), List.of(sourceId));
+    }
+
+    private static Policy policy(String id, TriggerConfig trigger, List<String> sourceIds) {
+        return new Policy(
+                id,
+                "hook",
+                "owner",
+                true,
+                trigger,
+                sourceIds,
+                List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
+                OutputSpec.inline());
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookLocalDeliveryE2eTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookLocalDeliveryE2eTest.java
new file mode 100644
index 0000000000..774dc8e8bc
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookLocalDeliveryE2eTest.java
@@ -0,0 +1,137 @@
+package stirling.software.proprietary.policy.webhook;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Supplier;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.springframework.mock.web.MockHttpServletRequest;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.util.FileReadinessChecker;
+import stirling.software.proprietary.policy.input.ResolveContext;
+import stirling.software.proprietary.policy.input.ResolvedInput;
+import stirling.software.proprietary.policy.input.WebhookInputSource;
+import stirling.software.proprietary.policy.ledger.InProcessProcessedLedger;
+import stirling.software.proprietary.policy.model.InputSpec;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.trigger.WebhookTrigger;
+
+class WebhookLocalDeliveryE2eTest {
+
+    private static final String POLICY = "p1";
+    private static final String WEBHOOK_ID = "localwebhookid12";
+    private static final String SECRET = "topsecret";
+
+    @TempDir Path tempDir;
+
+    private WebhookReceiverController receiver;
+    private WebhookInputSource inputSource;
+    private WebhookTrigger trigger;
+    private InProcessProcessedLedger ledger;
+    private RecordingContext ctx;
+
+    @BeforeEach
+    void setUp() {
+        WebhookSpool spool = new WebhookSpool(tempDir.resolve("spool"));
+        SourceStore sourceStore = new InProcessSourceStore();
+        sourceStore.save(
+                new Source(
+                        "s1",
+                        "Partner uploads",
+                        "webhook",
+                        Map.of("webhookId", WEBHOOK_ID, "signingSecret", SECRET, "mode", "consume"),
+                        true,
+                        "owner",
+                        null));
+        trigger = mock(WebhookTrigger.class);
+        FileReadinessChecker readiness = mock(FileReadinessChecker.class);
+        when(readiness.isReady(any())).thenReturn(true);
+        receiver =
+                new WebhookReceiverController(
+                        sourceStore, spool, trigger, new ApplicationProperties());
+        inputSource = new WebhookInputSource(spool, readiness);
+        ledger = new InProcessProcessedLedger();
+        ctx = new RecordingContext();
+    }
+
+    @Test
+    void aDeliveryIsSpooledFiresTheTriggerThenIsReadAndConsumed() throws IOException {
+        byte[] body = "a pdf".getBytes(StandardCharsets.UTF_8);
+        String signature = WebhookSignatures.sign(SECRET, body);
+
+        var response = receiver.receive(WEBHOOK_ID, signature, "invoice.pdf", request(body));
+        assertThat(response.getStatusCode().value()).isEqualTo(202);
+        verify(trigger).fireForWebhook(WEBHOOK_ID);
+
+        List<ResolvedInput> work = inputSource.resolve(spec(), ctx);
+        assertThat(work).hasSize(1);
+        assertThat(work.get(0).inputs().primary().get(0).getFilename()).isEqualTo("invoice.pdf");
+        assertThat(read(work.get(0))).isEqualTo("a pdf");
+        assertThat(inputSource.resolve(spec(), ctx)).isEmpty();
+
+        work.get(0).onComplete().accept(true);
+        assertThat(inputSource.resolve(spec(), ctx)).isEmpty();
+    }
+
+    private static InputSpec spec() {
+        return new InputSpec(
+                "webhook",
+                Map.of("webhookId", WEBHOOK_ID, "signingSecret", SECRET, "mode", "consume"));
+    }
+
+    private static MockHttpServletRequest request(byte[] body) {
+        MockHttpServletRequest req =
+                new MockHttpServletRequest("POST", "/api/v1/webhooks/" + WEBHOOK_ID);
+        req.setContent(body);
+        return req;
+    }
+
+    private static String read(ResolvedInput unit) throws IOException {
+        try (InputStream stream = unit.inputs().primary().get(0).getInputStream()) {
+            return new String(stream.readAllBytes(), StandardCharsets.UTF_8);
+        }
+    }
+
+    private class RecordingContext implements ResolveContext {
+
+        private final List<String> present = new ArrayList<>();
+
+        @Override
+        public boolean claim(String identity, String gate, Supplier<String> contentHash) {
+            return ledger.claim(POLICY, identity, gate, contentHash);
+        }
+
+        @Override
+        public void settle(
+                String identity, String finalGate, String finalContentHash, boolean success) {
+            ledger.settle(POLICY, identity, finalGate, finalContentHash, success);
+        }
+
+        @Override
+        public boolean allSettledDone(String identity) {
+            return ledger.allSettledDone(identity);
+        }
+
+        @Override
+        public void reportPresent(Collection<String> identities) {
+            present.addAll(identities);
+        }
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookReceiverControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookReceiverControllerTest.java
new file mode 100644
index 0000000000..4a9a94b5ce
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookReceiverControllerTest.java
@@ -0,0 +1,193 @@
+package stirling.software.proprietary.policy.webhook;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Stream;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.springframework.http.ResponseEntity;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.web.server.ResponseStatusException;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.trigger.WebhookTrigger;
+import stirling.software.proprietary.policy.webhook.WebhookReceiverController.WebhookDeliveryResponse;
+
+class WebhookReceiverControllerTest {
+
+    private static final String WEBHOOK_ID = "receivertestid12";
+    private static final String SECRET = "topsecret";
+    private static final byte[] BODY = "a pdf".getBytes(StandardCharsets.UTF_8);
+
+    @TempDir Path tempDir;
+
+    private SourceStore sourceStore;
+    private WebhookSpool spool;
+    private WebhookTrigger trigger;
+    private ApplicationProperties properties;
+    private WebhookReceiverController controller;
+
+    @BeforeEach
+    void setUp() {
+        sourceStore = new InProcessSourceStore();
+        sourceStore.save(webhookSource(true));
+        spool = new WebhookSpool(tempDir.resolve("spool"));
+        trigger = mock(WebhookTrigger.class);
+        properties = new ApplicationProperties();
+        controller = new WebhookReceiverController(sourceStore, spool, trigger, properties);
+    }
+
+    private static Source webhookSource(boolean enabled) {
+        return new Source(
+                "s1",
+                "Partner uploads",
+                "webhook",
+                Map.of("webhookId", WEBHOOK_ID, "signingSecret", SECRET, "mode", "consume"),
+                enabled,
+                "owner",
+                null);
+    }
+
+    private static MockHttpServletRequest request(byte[] body) {
+        MockHttpServletRequest req =
+                new MockHttpServletRequest("POST", "/api/v1/webhooks/" + WEBHOOK_ID);
+        req.setContent(body);
+        return req;
+    }
+
+    @Test
+    void aValidDeliveryIsSpooledAndFiresTheTrigger() throws IOException {
+        String signature = WebhookSignatures.sign(SECRET, BODY);
+
+        ResponseEntity<WebhookDeliveryResponse> response =
+                controller.receive(WEBHOOK_ID, signature, "invoice.pdf", request(BODY));
+
+        assertEquals(202, response.getStatusCode().value());
+        assertTrue(response.getBody().accepted());
+        assertEquals("invoice.pdf", response.getBody().filename());
+        assertEquals(1, spooledFiles().size());
+        verify(trigger).fireForWebhook(WEBHOOK_ID);
+    }
+
+    @Test
+    void aWrongSignatureIsRejectedAndStoresNothing() {
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () ->
+                                controller.receive(
+                                        WEBHOOK_ID, "sha256=deadbeef", "x.pdf", request(BODY)));
+
+        assertEquals(401, ex.getStatusCode().value());
+        assertTrue(spooledFiles().isEmpty());
+        verify(trigger, never()).fireForWebhook(WEBHOOK_ID);
+    }
+
+    @Test
+    void anUnknownWebhookIsNotFound() {
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () ->
+                                controller.receive(
+                                        "unknownwebhookid",
+                                        WebhookSignatures.sign(SECRET, BODY),
+                                        "x.pdf",
+                                        request(BODY)));
+
+        assertEquals(404, ex.getStatusCode().value());
+    }
+
+    @Test
+    void aPausedSourceRejectsDeliveries() {
+        sourceStore.save(webhookSource(false));
+        String signature = WebhookSignatures.sign(SECRET, BODY);
+
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () -> controller.receive(WEBHOOK_ID, signature, "x.pdf", request(BODY)));
+
+        assertEquals(403, ex.getStatusCode().value());
+        assertTrue(spooledFiles().isEmpty());
+    }
+
+    @Test
+    void anEmptyBodyIsRejected() {
+        byte[] empty = new byte[0];
+        String signature = WebhookSignatures.sign(SECRET, empty);
+
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () -> controller.receive(WEBHOOK_ID, signature, null, request(empty)));
+
+        assertEquals(400, ex.getStatusCode().value());
+    }
+
+    @Test
+    void anOversizeDeliveryIsRejectedBeforeStoring() {
+        properties.getPolicies().setWebhookMaxBytes(2);
+
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () ->
+                                controller.receive(
+                                        WEBHOOK_ID,
+                                        WebhookSignatures.sign(SECRET, BODY),
+                                        "x.pdf",
+                                        request(BODY)));
+
+        assertEquals(413, ex.getStatusCode().value());
+        assertTrue(spooledFiles().isEmpty());
+    }
+
+    @Test
+    void aDeliveryWithoutAContentLengthIsRejected() {
+        MockHttpServletRequest req =
+                new MockHttpServletRequest("POST", "/api/v1/webhooks/" + WEBHOOK_ID);
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class,
+                        () ->
+                                controller.receive(
+                                        WEBHOOK_ID,
+                                        WebhookSignatures.sign(SECRET, BODY),
+                                        "x.pdf",
+                                        req));
+
+        assertEquals(411, ex.getStatusCode().value());
+        assertTrue(spooledFiles().isEmpty());
+    }
+
+    private List<Path> spooledFiles() {
+        Path dir = spool.dirFor(WEBHOOK_ID);
+        if (!Files.isDirectory(dir)) {
+            return List.of();
+        }
+        try (Stream<Path> entries = Files.list(dir)) {
+            return entries.filter(Files::isRegularFile)
+                    .filter(p -> !p.getFileName().toString().startsWith("."))
+                    .toList();
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookSignaturesTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookSignaturesTest.java
new file mode 100644
index 0000000000..6b2e45094d
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/webhook/WebhookSignaturesTest.java
@@ -0,0 +1,48 @@
+package stirling.software.proprietary.policy.webhook;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.nio.charset.StandardCharsets;
+
+import org.junit.jupiter.api.Test;
+
+class WebhookSignaturesTest {
+
+    private static final String SECRET = "whsec_test_secret";
+    private static final byte[] BODY = "the document bytes".getBytes(StandardCharsets.UTF_8);
+
+    @Test
+    void aFreshlySignedBodyVerifies() {
+        String header = WebhookSignatures.sign(SECRET, BODY);
+        assertTrue(header.startsWith("sha256="));
+        assertTrue(WebhookSignatures.verify(SECRET, BODY, header));
+    }
+
+    @Test
+    void abarehexSignatureVerifiesToo() {
+        String header = WebhookSignatures.sign(SECRET, BODY);
+        String bareHex = header.substring("sha256=".length());
+        assertTrue(WebhookSignatures.verify(SECRET, BODY, bareHex));
+    }
+
+    @Test
+    void aWrongSecretDoesNotVerify() {
+        String header = WebhookSignatures.sign(SECRET, BODY);
+        assertFalse(WebhookSignatures.verify("other-secret", BODY, header));
+    }
+
+    @Test
+    void atamperedBodyDoesNotVerify() {
+        String header = WebhookSignatures.sign(SECRET, BODY);
+        byte[] tampered = "the document byteS".getBytes(StandardCharsets.UTF_8);
+        assertFalse(WebhookSignatures.verify(SECRET, tampered, header));
+    }
+
+    @Test
+    void aMissingOrMalformedHeaderIsFalseNotAnError() {
+        assertFalse(WebhookSignatures.verify(SECRET, BODY, null));
+        assertFalse(WebhookSignatures.verify(SECRET, BODY, "sha256=not-hex"));
+        assertFalse(WebhookSignatures.verify(SECRET, BODY, ""));
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/util/SecretMaskerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/util/SecretMaskerTest.java
index 415117a446..86d30cebe9 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/util/SecretMaskerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/util/SecretMaskerTest.java
@@ -103,6 +103,17 @@ class SecretMaskerTest {
             assertEquals("AKIAEXAMPLE", result.get("accessKeyId"));
         }
 
+        @Test
+        @DisplayName("should mask camelCase signingSecret despite no word boundary")
+        void shouldMaskCamelCaseSigningSecret() {
+            Map<String, Object> input = Map.of("signingSecret", "shh", "webhookId", "whk_abc");
+
+            Map<String, Object> result = SecretMasker.mask(input);
+
+            assertEquals(SecretMasker.REDACTED, result.get("signingSecret"));
+            assertEquals("whk_abc", result.get("webhookId"));
+        }
+
         @Test
         @DisplayName("should mask nested map sensitive keys")
         void shouldMaskNestedMapSensitiveKeys() {
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index d27e881f2e..b9e1f6b969 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -8041,6 +8041,25 @@ label = "Secret access key"
 [portal.sources.types.unknown]
 label = "Source"
 
+[portal.sources.types.webhook]
+createNote = "A delivery URL and signing secret are generated when you create this webhook. Senders POST documents to that URL and the referencing policies run on arrival."
+description = "Receive documents by signed HTTP POST from any external system."
+label = "Webhook"
+
+[portal.sources.types.webhook.detail]
+deliveryUrl = "Delivery URL"
+secretNote = "The signing secret is shown once, when the webhook is created. Recreate the source to roll it."
+
+[portal.sources.types.webhook.reveal]
+copy = "Copy"
+done = "Done"
+secret = "Signing secret"
+secretHelp = "Sign each delivery's raw body with this key (HMAC-SHA256) and send it as the X-Stirling-Signature header."
+secretWarning = "Copy the signing secret now. For your security it is shown only once and cannot be retrieved later."
+title = "Webhook created"
+url = "Delivery URL"
+usage = "POST each document as the raw request body to the delivery URL with a binary content type (application/pdf or application/octet-stream). Referencing policies run automatically on arrival."
+
 [portal.sources.wizard]
 name = "Name"
 namePlaceholder = "e.g. Claims intake"
diff --git a/frontend/editor/src/portal/api/sources.ts b/frontend/editor/src/portal/api/sources.ts
index 9a66aeef2d..47e456d094 100644
--- a/frontend/editor/src/portal/api/sources.ts
+++ b/frontend/editor/src/portal/api/sources.ts
@@ -32,6 +32,7 @@ export interface SourceView {
   docsTotal: number;
   docs24h: number;
   docs30d: number;
+  webhookPath?: string | null;
 }
 
 export interface SourceKpi {
diff --git a/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx b/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx
index 606fe45b1e..5ccd70b860 100644
--- a/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx
+++ b/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx
@@ -8,6 +8,7 @@
 const PATHS: Record<string, string> = {
   folder: "M3 7h6l2 2h10v9a1 1 0 01-1 1H4a1 1 0 01-1-1V7z",
   s3: "M7 18a4 4 0 010-8 5 5 0 019.6-1.3A3.5 3.5 0 0117 18H7z",
+  webhook: "M13 2L3 14h9l-1 8 10-12h-9l1-8z",
   editor: "M4 20h16M14 4l6 6-9 9H5v-6l9-9z",
   _default:
     "M14 3H7a1 1 0 00-1 1v16a1 1 0 001 1h10a1 1 0 001-1V7l-4-4zM14 3v4h4",
diff --git a/frontend/editor/src/portal/components/sources/sourceTypes.ts b/frontend/editor/src/portal/components/sources/sourceTypes.ts
index c1f6049188..89d12c945b 100644
--- a/frontend/editor/src/portal/components/sources/sourceTypes.ts
+++ b/frontend/editor/src/portal/components/sources/sourceTypes.ts
@@ -22,6 +22,9 @@ export interface SourceTypeMeta {
  */
 export const EDITOR_SOURCE_TYPE = "editor";
 
+/** The webhook source type. Its delivery URL + signing secret are minted server-side on create. */
+export const WEBHOOK_SOURCE_TYPE = "webhook";
+
 const SOURCE_TYPE_META: Record<string, SourceTypeMeta> = {
   folder: {
     labelKey: "portal.sources.types.folder.label",
@@ -38,6 +41,11 @@ const SOURCE_TYPE_META: Record<string, SourceTypeMeta> = {
     icon: "☁",
     accent: "brand",
   },
+  webhook: {
+    labelKey: "portal.sources.types.webhook.label",
+    icon: "↯",
+    accent: "warning",
+  },
 };
 
 const UNKNOWN_TYPE_META: SourceTypeMeta = {
@@ -180,6 +188,12 @@ export const CREATABLE_SOURCE_TYPES: CreatableSourceType[] = [
       },
     ],
   },
+  {
+    type: WEBHOOK_SOURCE_TYPE,
+    labelKey: "portal.sources.types.webhook.label",
+    descriptionKey: "portal.sources.types.webhook.description",
+    fields: [],
+  },
 ];
 
 /** Default option values for a type's create form. */
diff --git a/frontend/editor/src/portal/mocks/handlers/sources.ts b/frontend/editor/src/portal/mocks/handlers/sources.ts
index 4f4dd0e807..3c378a24f2 100644
--- a/frontend/editor/src/portal/mocks/handlers/sources.ts
+++ b/frontend/editor/src/portal/mocks/handlers/sources.ts
@@ -55,6 +55,17 @@ function seedSources(): StoredSource[] {
       enabled: false,
       owner: "data-eng@acme.com",
     },
+    {
+      id: "src-webhook",
+      name: "Partner uploads",
+      type: "webhook",
+      options: {
+        webhookId: "whk_demo_5f3a9c21b7",
+        signingSecret: "whsec_demo_2b8e1d47a9f60c35",
+      },
+      enabled: true,
+      owner: "you@acme.com",
+    },
   ];
 }
 
@@ -76,6 +87,7 @@ const docCounts: Record<
   "src-contracts": { total: 12840, last24h: 96, last30d: 2310 },
   "src-archive": { total: 1180, last24h: 0, last30d: 0 },
   "src-legacy": { total: 48600, last24h: 0, last30d: 0 },
+  "src-webhook": { total: 3120, last24h: 24, last30d: 640 },
 };
 
 function docsFor(id: string): {
@@ -96,14 +108,21 @@ function nextId(): string {
   return `src_${Date.now().toString(36)}_${idCounter}`;
 }
 
+function randomToken(): string {
+  const bytes = new Uint8Array(16);
+  crypto.getRandomValues(bytes);
+  return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+
 function refsFor(id: string): SourcePolicyRef[] {
   return references[id] ?? [];
 }
 
 function configRows(options: Record<string, unknown>) {
+  const secret = /secret|password|token/i;
   return Object.entries(options).map(([key, value]) => ({
     label: key.charAt(0).toUpperCase() + key.slice(1),
-    value: String(value),
+    value: secret.test(key) ? "********" : String(value),
   }));
 }
 
@@ -120,6 +139,7 @@ function toSourceView(
   refs: SourcePolicyRef[],
 ): SourceView {
   const docs = docsFor(source.id);
+  const webhookId = source.options.webhookId;
   return {
     id: source.id,
     name: source.name,
@@ -131,6 +151,10 @@ function toSourceView(
     docsTotal: docs.total,
     docs24h: docs.last24h,
     docs30d: docs.last30d,
+    webhookPath:
+      source.type === "webhook" && typeof webhookId === "string"
+        ? `/api/v1/webhooks/${webhookId}`
+        : null,
   };
 }
 
@@ -207,8 +231,17 @@ export const sourcesHandlers = [
       ? store.find((s) => s.id === incoming.id)
       : undefined;
     const id = existing?.id ?? nextId();
+    let options = incoming.options ?? {};
+    if (incoming.type === "webhook" && !existing && !options.webhookId) {
+      options = {
+        ...options,
+        webhookId: `whk_${randomToken()}`,
+        signingSecret: `whsec_${randomToken()}`,
+      };
+    }
     const saved: StoredSource = {
       ...incoming,
+      options,
       id,
       owner: existing?.owner ?? "you@acme.com",
     };
diff --git a/frontend/editor/src/portal/views/SourceBuilder.css b/frontend/editor/src/portal/views/SourceBuilder.css
index 985332046d..7a964a2c86 100644
--- a/frontend/editor/src/portal/views/SourceBuilder.css
+++ b/frontend/editor/src/portal/views/SourceBuilder.css
@@ -85,3 +85,32 @@
   justify-content: flex-end;
   gap: 0.5rem;
 }
+
+.portal-source-builder__copy-row {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.portal-source-builder__copy-row > :first-child {
+  flex: 1 1 auto;
+  min-width: 0;
+}
+
+.portal-source-builder__reveal {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+
+.portal-source-builder__muted {
+  margin: 0;
+  font-size: 0.8125rem;
+  color: var(--color-text-4);
+}
+
+.portal-source-builder__type-description {
+  margin: 0;
+  font-size: 0.875rem;
+  color: var(--color-text-3);
+}
diff --git a/frontend/editor/src/portal/views/SourceBuilder.test.tsx b/frontend/editor/src/portal/views/SourceBuilder.test.tsx
index 1f9b3341f8..517b28f515 100644
--- a/frontend/editor/src/portal/views/SourceBuilder.test.tsx
+++ b/frontend/editor/src/portal/views/SourceBuilder.test.tsx
@@ -102,6 +102,39 @@ describe("SourceBuilder", () => {
     ).toBeDisabled();
   });
 
+  it("reveals the delivery URL and signing secret once after creating a webhook", async () => {
+    createSource.mockResolvedValue({
+      id: "wh-1",
+      options: { webhookId: "whk_abc123", signingSecret: "whsec_topsecret" },
+    });
+    renderBuilder("/processor/sources/new");
+
+    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+      target: { value: "Partner uploads" },
+    });
+    // Webhook's connection is optional (self-hosted local-disk), so a name is enough to create.
+    fireEvent.click(screen.getByText("portal.sources.types.webhook.label"));
+    fireEvent.click(screen.getByText("portal.sources.builder.create"));
+
+    await waitFor(() => expect(createSource).toHaveBeenCalledTimes(1));
+    expect(createSource).toHaveBeenCalledWith(
+      expect.objectContaining({ type: "webhook", name: "Partner uploads" }),
+    );
+
+    expect(
+      await screen.findByDisplayValue("whsec_topsecret"),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByDisplayValue(/\/api\/v1\/webhooks\/whk_abc123$/),
+    ).toBeInTheDocument();
+    expect(screen.queryByText("sources list")).not.toBeInTheDocument();
+
+    fireEvent.click(
+      screen.getByText("portal.sources.types.webhook.reveal.done"),
+    );
+    expect(await screen.findByText("sources list")).toBeInTheDocument();
+  });
+
   it("blocks create until required fields are filled", async () => {
     renderBuilder("/processor/sources/new");
     // Name given but directory (required) still blank -> Create disabled.
diff --git a/frontend/editor/src/portal/views/SourceBuilder.tsx b/frontend/editor/src/portal/views/SourceBuilder.tsx
index 31b8550354..4da5a96460 100644
--- a/frontend/editor/src/portal/views/SourceBuilder.tsx
+++ b/frontend/editor/src/portal/views/SourceBuilder.tsx
@@ -27,11 +27,16 @@ import {
   CREATABLE_SOURCE_TYPES,
   defaultOptions,
   sourceTypeMeta,
+  WEBHOOK_SOURCE_TYPE,
   type CreatableSourceType,
 } from "@portal/components/sources/sourceTypes";
 import { S3ConnectionPicker } from "@portal/components/sources/S3ConnectionPicker";
 import "@portal/views/SourceBuilder.css";
 
+function webhookUrl(webhookId: string): string {
+  return `${window.location.origin}/api/v1/webhooks/${webhookId}`;
+}
+
 const OFFERED_TYPES = creatableSourceTypes();
 
 /** A source's stored type resolved to its create-form metadata (edit falls back to any type). */
@@ -84,6 +89,10 @@ export function SourceBuilder() {
   const [error, setError] = useState<string | null>(null);
   const [pendingDelete, setPendingDelete] = useState(false);
   const [deleting, setDeleting] = useState(false);
+  const [reveal, setReveal] = useState<{
+    webhookId: string;
+    secret: string;
+  } | null>(null);
 
   // Seed once: immediately for a new source, or after the record loads for edit.
   useEffect(() => {
@@ -112,18 +121,38 @@ export function SourceBuilder() {
   );
   const canSave = name.trim() !== "" && requiredComplete && !submitting;
 
+  const editingWebhookId =
+    isEdit && sourceState.data?.type === WEBHOOK_SOURCE_TYPE
+      ? String(sourceState.data.options?.webhookId ?? "")
+      : "";
+  const revealUrl = reveal ? webhookUrl(reveal.webhookId) : "";
+  const revealSecret = reveal ? reveal.secret : "";
+
+  function dismissReveal() {
+    setReveal(null);
+    navigate(listPath);
+  }
+
   async function save() {
     if (!canSave) return;
     setSubmitting(true);
     setError(null);
     try {
-      await createSource({
+      const saved = await createSource({
         id: isEdit ? id : undefined,
         name: name.trim(),
         type: type.type,
         options,
         enabled,
       });
+      if (!isEdit && type.type === WEBHOOK_SOURCE_TYPE) {
+        const webhookId = String(saved.options?.webhookId ?? "");
+        const secret = String(saved.options?.signingSecret ?? "");
+        if (webhookId && secret) {
+          setReveal({ webhookId, secret });
+          return;
+        }
+      }
       navigate(listPath);
     } catch (e) {
       setError(errorMessage(e));
@@ -131,6 +160,10 @@ export function SourceBuilder() {
     }
   }
 
+  function copy(text: string) {
+    void navigator.clipboard?.writeText(text);
+  }
+
   async function confirmDelete() {
     if (!id || deleting) return;
     setDeleting(true);
@@ -254,6 +287,18 @@ export function SourceBuilder() {
           </FormField>
         )}
 
+        {!isEdit && (
+          <p className="portal-source-builder__type-description">
+            {t(type.descriptionKey)}
+          </p>
+        )}
+
+        {!isEdit && type.type === WEBHOOK_SOURCE_TYPE && (
+          <p className="portal-source-builder__muted">
+            {t("portal.sources.types.webhook.createNote")}
+          </p>
+        )}
+
         {type.fields.map((field) => (
           <FormField
             key={field.key}
@@ -290,6 +335,28 @@ export function SourceBuilder() {
           </FormField>
         ))}
 
+        {editingWebhookId && (
+          <FormField
+            label={t("portal.sources.types.webhook.detail.deliveryUrl")}
+            helperText={t("portal.sources.types.webhook.detail.secretNote")}
+          >
+            <div className="portal-source-builder__copy-row">
+              <Input
+                value={webhookUrl(editingWebhookId)}
+                readOnly
+                onFocus={(e) => e.currentTarget.select()}
+              />
+              <Button
+                variant="tertiary"
+                size="sm"
+                onClick={() => copy(webhookUrl(editingWebhookId))}
+              >
+                {t("portal.sources.types.webhook.reveal.copy")}
+              </Button>
+            </div>
+          </FormField>
+        )}
+
         {error && <Banner tone="danger" description={error} />}
       </div>
 
@@ -321,6 +388,69 @@ export function SourceBuilder() {
       >
         <p>{t("portal.sources.delete.body", { name })}</p>
       </Modal>
+
+      <Modal
+        open={reveal !== null}
+        onClose={dismissReveal}
+        width="md"
+        title={t("portal.sources.types.webhook.reveal.title")}
+        footer={
+          <div className="portal-source-builder__delete-actions">
+            <Button size="sm" onClick={dismissReveal}>
+              {t("portal.sources.types.webhook.reveal.done")}
+            </Button>
+          </div>
+        }
+      >
+        {reveal && (
+          <div className="portal-source-builder__reveal">
+            <Banner
+              tone="warning"
+              description={t(
+                "portal.sources.types.webhook.reveal.secretWarning",
+              )}
+            />
+            <FormField label={t("portal.sources.types.webhook.reveal.url")}>
+              <div className="portal-source-builder__copy-row">
+                <Input
+                  value={revealUrl}
+                  readOnly
+                  onFocus={(e) => e.currentTarget.select()}
+                />
+                <Button
+                  variant="tertiary"
+                  size="sm"
+                  onClick={() => copy(revealUrl)}
+                >
+                  {t("portal.sources.types.webhook.reveal.copy")}
+                </Button>
+              </div>
+            </FormField>
+            <FormField
+              label={t("portal.sources.types.webhook.reveal.secret")}
+              helperText={t("portal.sources.types.webhook.reveal.secretHelp")}
+            >
+              <div className="portal-source-builder__copy-row">
+                <Input
+                  value={revealSecret}
+                  readOnly
+                  onFocus={(e) => e.currentTarget.select()}
+                />
+                <Button
+                  variant="tertiary"
+                  size="sm"
+                  onClick={() => copy(revealSecret)}
+                >
+                  {t("portal.sources.types.webhook.reveal.copy")}
+                </Button>
+              </div>
+            </FormField>
+            <p className="portal-source-builder__muted">
+              {t("portal.sources.types.webhook.reveal.usage")}
+            </p>
+          </div>
+        )}
+      </Modal>
     </div>
   );
 }
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index c092905fe2..f0dea22e1c 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -95,6 +95,11 @@
 .portal-sources__type-dot--warning {
   --dot-c: var(--color-amber-dark);
 }
+/* Dark: subtle tint + bright icon; amber-light/amber-dark are too close to read. */
+[data-theme="dark"] .portal-sources__type-dot--warning {
+  background: color-mix(in srgb, var(--color-amber) 20%, transparent);
+  color: var(--color-amber);
+}
 .portal-sources__type-dot--danger {
   --dot-c: var(--color-red-dark);
 }
diff --git a/testing/cucumber/features/environment.py b/testing/cucumber/features/environment.py
index b8fcad1486..208e45b23b 100644
--- a/testing/cucumber/features/environment.py
+++ b/testing/cucumber/features/environment.py
@@ -19,6 +19,9 @@ _JWT_DEPENDENT_TAGS = frozenset({
     "jwt", "user_mgmt", "admin_settings", "audit", "signature", "team",
 })
 
+# Tags for scenarios that require the policies feature (policies.enabled=true).
+_POLICIES_DEPENDENT_TAGS = frozenset({"policies", "webhook"})
+
 
 def _check_jwt_available():
     """Probe the server to determine whether JWT Bearer auth is functional.
@@ -85,6 +88,38 @@ def _capture_docker_logs_window(start_line, scenario_name):
         pass
 
 
+def _check_policies_available():
+    """Probe whether webhook sources can be created (proprietary policy feature).
+
+    Creates a throwaway webhook source: a 200 with a minted webhookId means the
+    webhook beans are present (a proprietary build). The probe source is
+    best-effort deleted afterwards.
+    """
+    try:
+        resp = requests.post(
+            f"{_BASE_URL}/api/v1/sources",
+            headers={"X-API-KEY": "123456789", "Content-Type": "application/json"},
+            json={"name": "policies-probe", "type": "webhook", "options": {}, "enabled": True},
+            timeout=10,
+        )
+        if resp.status_code != 200:
+            return False
+        source_id = resp.json().get("id")
+        has_webhook = bool(resp.json().get("options", {}).get("webhookId"))
+        if source_id:
+            try:
+                requests.delete(
+                    f"{_BASE_URL}/api/v1/sources/{source_id}",
+                    headers={"X-API-KEY": "123456789"},
+                    timeout=10,
+                )
+            except Exception:
+                pass
+        return has_webhook
+    except Exception:
+        return False
+
+
 def before_all(context):
     context.endpoint = None
     context.request_data = None
@@ -97,6 +132,12 @@ def before_all(context):
             "(server likely running with V2=false). "
             "Scenarios tagged with JWT-dependent tags will be skipped."
         )
+    context.policies_available = _check_policies_available()
+    if not context.policies_available:
+        print(
+            "\n[POLICIES] Webhook sources are not available in this environment "
+            "(e.g. a core-only build). Scenarios tagged @policies/@webhook will be skipped."
+        )
 
 
 def before_scenario(context, scenario):
@@ -110,6 +151,13 @@ def before_scenario(context, scenario):
         )
         return
 
+    if _POLICIES_DEPENDENT_TAGS & scenario_tags and not context.policies_available:
+        scenario.skip(
+            "Webhook sources not available in this environment (e.g. a core-only build). "
+            "Run against a proprietary build to execute these scenarios."
+        )
+        return
+
     context.files = {}
     context.multi_files = []
     context.json_parts = {}
diff --git a/testing/cucumber/features/steps/webhook_step_definitions.py b/testing/cucumber/features/steps/webhook_step_definitions.py
new file mode 100644
index 0000000000..bcf88bd715
--- /dev/null
+++ b/testing/cucumber/features/steps/webhook_step_definitions.py
@@ -0,0 +1,84 @@
+import hashlib
+import hmac
+
+import requests
+from behave import given, when, then
+
+BASE_URL = "http://localhost:8080"
+API_HEADERS = {"X-API-KEY": "123456789"}
+
+
+def _sign(secret, body):
+    digest = hmac.new(secret.encode(), body.encode(), hashlib.sha256).hexdigest()
+    return "sha256=" + digest
+
+
+@given('I create a webhook source named "{name}"')
+def step_create_webhook_source(context, name):
+    resp = requests.post(
+        f"{BASE_URL}/api/v1/sources",
+        headers={**API_HEADERS, "Content-Type": "application/json"},
+        json={"name": name, "type": "webhook", "options": {}, "enabled": True},
+        timeout=15,
+    )
+    assert resp.status_code == 200, f"create source failed: {resp.status_code} {resp.text}"
+    context.webhook_create_response = resp
+    body = resp.json()
+    context.webhook_source_id = body["id"]
+    context.webhook_id = body["options"]["webhookId"]
+    context.webhook_secret = body["options"]["signingSecret"]
+
+
+@when('I deliver "{payload}" to the webhook with a valid signature')
+def step_deliver_signed(context, payload):
+    signature = _sign(context.webhook_secret, payload)
+    context.webhook_response = requests.post(
+        f"{BASE_URL}/api/v1/webhooks/{context.webhook_id}",
+        headers={"Content-Type": "application/pdf", "X-Stirling-Signature": signature},
+        data=payload.encode(),
+        timeout=15,
+    )
+
+
+@when('I deliver "{payload}" to the webhook with signature "{signature}"')
+def step_deliver_with_signature(context, payload, signature):
+    context.webhook_response = requests.post(
+        f"{BASE_URL}/api/v1/webhooks/{context.webhook_id}",
+        headers={"Content-Type": "application/pdf", "X-Stirling-Signature": signature},
+        data=payload.encode(),
+        timeout=15,
+    )
+
+
+@when('I deliver "{payload}" to webhook id "{webhook_id}"')
+def step_deliver_to_id(context, payload, webhook_id):
+    context.webhook_response = requests.post(
+        f"{BASE_URL}/api/v1/webhooks/{webhook_id}",
+        headers={"Content-Type": "application/pdf", "X-Stirling-Signature": "sha256=00"},
+        data=payload.encode(),
+        timeout=15,
+    )
+
+
+@then("the webhook response status should be {status:d}")
+def step_check_status(context, status):
+    actual = context.webhook_response.status_code
+    assert actual == status, f"expected {status}, got {actual}: {context.webhook_response.text}"
+
+
+@then("the webhook create response includes a signing secret")
+def step_secret_present(context):
+    secret = context.webhook_create_response.json()["options"].get("signingSecret", "")
+    assert secret and secret != "********", f"expected a revealed secret, got '{secret}'"
+
+
+@then("reading the webhook source back masks the signing secret")
+def step_secret_masked(context):
+    resp = requests.get(
+        f"{BASE_URL}/api/v1/sources/{context.webhook_source_id}",
+        headers=API_HEADERS,
+        timeout=15,
+    )
+    assert resp.status_code == 200, f"get source failed: {resp.status_code} {resp.text}"
+    secret = resp.json()["options"].get("signingSecret", "")
+    assert secret != context.webhook_secret, "secret was returned in clear text on read"
diff --git a/testing/cucumber/features/webhook_source.feature b/testing/cucumber/features/webhook_source.feature
new file mode 100644
index 0000000000..cd4ce0e38f
--- /dev/null
+++ b/testing/cucumber/features/webhook_source.feature
@@ -0,0 +1,25 @@
+@policies @webhook
+Feature: Webhook input source
+  # Requires the proprietary policy feature (webhook sources). Scenarios are
+  # skipped automatically when webhook sources are unavailable (see environment.py).
+  # A webhook source mints a delivery URL + signing secret; senders POST signed
+  # documents which are spooled for the referencing policies.
+
+  Scenario: A validly signed delivery is accepted
+    Given I create a webhook source named "Cucumber webhook"
+    When I deliver "hello from cucumber" to the webhook with a valid signature
+    Then the webhook response status should be 202
+
+  Scenario: A wrongly signed delivery is rejected
+    Given I create a webhook source named "Cucumber webhook reject"
+    When I deliver "tampered body" to the webhook with signature "sha256=deadbeef"
+    Then the webhook response status should be 401
+
+  Scenario: Delivering to an unknown webhook id is not found
+    When I deliver "orphan" to webhook id "doesnotexistwebhook0"
+    Then the webhook response status should be 404
+
+  Scenario: The signing secret is revealed once on create then masked on read
+    Given I create a webhook source named "Cucumber webhook secret"
+    Then the webhook create response includes a signing secret
+    And reading the webhook source back masks the signing secret

From 718277a934f8d44e632dd5b883c06b34e33c99e5 Mon Sep 17 00:00:00 2001
From: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Date: Wed, 22 Jul 2026 20:08:45 +0000
Subject: [PATCH 083/109] Portal home: trim to onboarding + processor flow,
 secondary Set up buttons (#7111)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Simplifies the processor home page:

- Removes everything below the processor flow (processing status strip,
recent activity, quick actions, policy summary), leaving just the
onboarding hero and processor flow.
- Changes the policy "Set up" buttons (Security/Classification) from
primary to secondary variant.

<img width="2056" height="1047" alt="Screenshot 2026-07-20 at 7 27
56 PM"
src="https://github.com/user-attachments/assets/8625b274-b52a-47be-9052-80ac3d32dd93"
/>
---
 .../public/locales/en-US/translation.toml     |  50 -----
 .../src/portal/components/PolicySummary.css   |  76 --------
 .../components/PolicySummary.stories.tsx      |  48 -----
 .../src/portal/components/PolicySummary.tsx   | 183 ------------------
 .../components/ProcessingStatusStrip.css      |  43 ----
 .../ProcessingStatusStrip.stories.tsx         |  36 ----
 .../components/ProcessingStatusStrip.tsx      |  52 -----
 .../src/portal/components/RecentActivity.css  | 138 -------------
 .../components/RecentActivity.stories.tsx     |  41 ----
 .../src/portal/components/RecentActivity.tsx  | 127 ------------
 .../processor-flow/FlowPolicies.tsx           |   4 +-
 frontend/editor/src/portal/views/Home.tsx     | 133 -------------
 12 files changed, 3 insertions(+), 928 deletions(-)
 delete mode 100644 frontend/editor/src/portal/components/PolicySummary.css
 delete mode 100644 frontend/editor/src/portal/components/PolicySummary.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/PolicySummary.tsx
 delete mode 100644 frontend/editor/src/portal/components/ProcessingStatusStrip.css
 delete mode 100644 frontend/editor/src/portal/components/ProcessingStatusStrip.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/ProcessingStatusStrip.tsx
 delete mode 100644 frontend/editor/src/portal/components/RecentActivity.css
 delete mode 100644 frontend/editor/src/portal/components/RecentActivity.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/RecentActivity.tsx

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index b9e1f6b969..a17b6583f9 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6744,22 +6744,6 @@ title = "Invite teammates"
 blurb = "{{active}} active · {{recommended}} recommended"
 title = "Confirm your policies"
 
-[portal.home.quickActions]
-subtitle = "Top tasks for today"
-title = "Quick actions"
-
-[portal.home.quickActions.buildPipeline]
-blurb = "3-step composer over the typed op library"
-title = "Build a pipeline"
-
-[portal.home.quickActions.connectSource]
-blurb = "S3, agents, webhooks, watched folders"
-title = "Connect a source"
-
-[portal.home.quickActions.issueApiKey]
-blurb = "Scoped key with rate limits and IP allowlist"
-title = "Issue an API key"
-
 [portal.infrastructure]
 manageEditorDeployment = "Manage Editor deployment"
 sectionsAriaLabel = "Infrastructure sections"
@@ -7531,35 +7515,9 @@ setUp = "Set up {{category}} policy"
 [portal.policies.wizard.workflow]
 description = "Choose what this policy does to every document it processes."
 
-[portal.policySummary]
-activeSummary = "{{active}} / {{total}} active"
-noRule = "No rule enforced yet"
-subtitle = "Standing automations every document passes through, regardless of which pipeline handles it."
-title = "What runs on your PDFs"
-
 [portal.policySummary.action]
-comingSoon = "Upgrade to Enterprise"
-configure = "Configure"
 setUp = "Set up"
 
-[portal.policySummary.column]
-activeRule = "Active rule"
-policy = "Policy"
-status = "Status"
-
-[portal.policySummary.empty]
-description = "Once policies are configured, the categories appear here."
-title = "No policies yet"
-
-[portal.policySummary.state]
-active = "Active"
-off = "Off"
-soon = "Soon"
-
-[portal.processingStatus]
-managePlan = "Manage plan"
-volumeSuffix = "PDFs processed · last 30 days"
-
 [portal.processorFlow]
 footnote = "Counts are over the last 24 hours. Flow speed is illustrative."
 liveBadge = "Live"
@@ -7878,14 +7836,6 @@ homeBody = "Committed volume pricing, org-wide SSO + SCIM + RBAC, 90-day immutab
 homeCta = "Start Trial →"
 homeHeadline = "Process millions of PDFs."
 
-[portal.recentActivity]
-title = "Recent activity"
-viewAll = "View all"
-
-[portal.recentActivity.empty]
-description = "Pipeline runs, deploys and agent events will appear here."
-title = "Nothing here yet"
-
 [portal.search]
 ariaLabel = "Search"
 placeholder = "Search Stirling — endpoints, pipelines, docs…"
diff --git a/frontend/editor/src/portal/components/PolicySummary.css b/frontend/editor/src/portal/components/PolicySummary.css
deleted file mode 100644
index 9b4e475895..0000000000
--- a/frontend/editor/src/portal/components/PolicySummary.css
+++ /dev/null
@@ -1,76 +0,0 @@
-.portal-policysum__head {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 0.75rem;
-  padding: 1rem 1.125rem 0.875rem;
-  border-bottom: 1px solid var(--color-border-light);
-}
-
-.portal-policysum__title {
-  margin: 0;
-  font-size: 0.9375rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-policysum__sub {
-  margin: 0.125rem 0 0;
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-  max-width: 34rem;
-}
-
-.portal-policysum__cat {
-  display: flex;
-  align-items: center;
-  gap: 0.625rem;
-}
-
-.portal-policysum__icon {
-  display: inline-flex;
-  align-items: center;
-  justify-content: center;
-  width: 1.75rem;
-  height: 1.75rem;
-  flex: none;
-  border-radius: var(--radius-md);
-  background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
-  font-size: 0.9375rem;
-}
-
-.portal-policysum__cat-text {
-  display: flex;
-  flex-direction: column;
-  min-width: 0;
-}
-
-.portal-policysum__cat-text strong {
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-policysum__cat-text span {
-  font-size: 0.6875rem;
-  color: var(--color-text-4);
-}
-
-.portal-policysum__rule {
-  font-size: 0.75rem;
-  color: var(--color-text-3);
-}
-
-.portal-policysum__loading {
-  display: flex;
-  flex-direction: column;
-  gap: 0.75rem;
-  padding: 1rem 1.125rem;
-}
-
-.portal-policysum__loading-row {
-  display: flex;
-  flex-direction: column;
-  gap: 0.375rem;
-}
diff --git a/frontend/editor/src/portal/components/PolicySummary.stories.tsx b/frontend/editor/src/portal/components/PolicySummary.stories.tsx
deleted file mode 100644
index 6de9f437ac..0000000000
--- a/frontend/editor/src/portal/components/PolicySummary.stories.tsx
+++ /dev/null
@@ -1,48 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { http, HttpResponse, delay } from "msw";
-import { PolicySummary } from "@portal/components/PolicySummary";
-
-const meta: Meta<typeof PolicySummary> = {
-  title: "Portal/Home/PolicySummary",
-  component: PolicySummary,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "60rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof PolicySummary>;
-
-export const Default: Story = {};
-
-export const Loading: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/api/v1/policies", async () => {
-          await delay("infinite");
-          return HttpResponse.json({});
-        }),
-      ],
-    },
-  },
-};
-
-export const Empty: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/api/v1/policies", () =>
-          HttpResponse.json({
-            summary: { active: 0, paused: 0, categories: 0, docsEnforced: 0 },
-            catalogue: [],
-          }),
-        ),
-      ],
-    },
-  },
-};
diff --git a/frontend/editor/src/portal/components/PolicySummary.tsx b/frontend/editor/src/portal/components/PolicySummary.tsx
deleted file mode 100644
index 9979783536..0000000000
--- a/frontend/editor/src/portal/components/PolicySummary.tsx
+++ /dev/null
@@ -1,183 +0,0 @@
-import { useTranslation } from "react-i18next";
-import {
-  Button,
-  Card,
-  EmptyState,
-  Skeleton,
-  StatusBadge,
-  Table,
-  type TableColumn,
-} from "@app/ui";
-import { useView } from "@portal/contexts/ViewContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import {
-  fetchPolicies,
-  type CatalogueEntry,
-  type PoliciesResponse,
-} from "@portal/api/policies";
-import { PolicyCategoryBadge } from "@portal/components/policies/PolicyCategoryIcon";
-import "@portal/components/PolicySummary.css";
-
-/**
- * Each row's display state collapses a category's facts into one of three
- * mutually-exclusive shapes:
- *
- *   - `locked`  — a coming-soon category; show a "Soon" affordance
- *   - `active`  — a configured policy that's enabled; offer "Configure"
- *   - `off`     — available but not set up (or paused); offer "Set up"
- */
-type RowState = "locked" | "active" | "off";
-
-interface PolicyRow {
-  entry: CatalogueEntry;
-  state: RowState;
-}
-
-const STATE_BADGE: Record<
-  RowState,
-  { tone: "success" | "neutral" | "info"; labelKey: string }
-> = {
-  active: { tone: "success", labelKey: "portal.policySummary.state.active" },
-  off: { tone: "neutral", labelKey: "portal.policySummary.state.off" },
-  locked: { tone: "info", labelKey: "portal.policySummary.state.soon" },
-};
-
-function toRow(entry: CatalogueEntry): PolicyRow {
-  if (entry.category.comingSoon) return { entry, state: "locked" };
-  const active = entry.policy?.state.status === "active";
-  return { entry, state: active ? "active" : "off" };
-}
-
-export function PolicySummary() {
-  const { t } = useTranslation();
-  const { setActiveView } = useView();
-  const state = useAsync<PoliciesResponse>(() => fetchPolicies(), []);
-  const { data } = state;
-  const { isLoading, isEmpty } = useSectionFlags(state);
-
-  const goToPolicies = () => setActiveView("policies");
-
-  const columns: TableColumn<PolicyRow>[] = [
-    {
-      key: "category",
-      header: t("portal.policySummary.column.policy"),
-      render: ({ entry }) => (
-        <div className="portal-policysum__cat">
-          <PolicyCategoryBadge category={entry.category} />
-          <div className="portal-policysum__cat-text">
-            <strong>{t(entry.category.label)}</strong>
-            <span>{t(entry.category.desc)}</span>
-          </div>
-        </div>
-      ),
-    },
-    {
-      key: "status",
-      header: t("portal.policySummary.column.status"),
-      width: "7rem",
-      render: ({ state }) => {
-        const badge = STATE_BADGE[state];
-        return (
-          <StatusBadge tone={badge.tone} size="sm">
-            {t(badge.labelKey)}
-          </StatusBadge>
-        );
-      },
-    },
-    {
-      key: "rule",
-      header: t("portal.policySummary.column.activeRule"),
-      render: ({ entry, state }) => (
-        <span className="portal-policysum__rule">
-          {state === "active"
-            ? t(entry.config.summary)
-            : t("portal.policySummary.noRule")}
-        </span>
-      ),
-    },
-    {
-      key: "action",
-      header: "",
-      align: "right",
-      width: "9rem",
-      render: ({ state }) => {
-        if (state === "locked") {
-          return (
-            <Button size="sm" variant="tertiary" onClick={goToPolicies}>
-              {t("portal.policySummary.action.comingSoon")}
-            </Button>
-          );
-        }
-        return (
-          <Button
-            size="sm"
-            variant={state === "active" ? "tertiary" : "secondary"}
-            onClick={goToPolicies}
-          >
-            {state === "active"
-              ? t("portal.policySummary.action.configure")
-              : t("portal.policySummary.action.setUp")}
-          </Button>
-        );
-      },
-    },
-  ];
-
-  const rows: PolicyRow[] = data?.catalogue?.map(toRow) ?? [];
-
-  return (
-    <section
-      className="portal-policysum"
-      aria-label={t("portal.policySummary.title")}
-    >
-      <Card padding="none">
-        <header className="portal-policysum__head">
-          <div>
-            <h2 className="portal-policysum__title">
-              {t("portal.policySummary.title")}
-            </h2>
-            <p className="portal-policysum__sub">
-              {t("portal.policySummary.subtitle")}
-            </p>
-          </div>
-          {data?.summary && (
-            <StatusBadge tone="info" size="sm">
-              {t("portal.policySummary.activeSummary", {
-                active: data.summary.active,
-                total: data.summary.categories,
-              })}
-            </StatusBadge>
-          )}
-        </header>
-
-        {isLoading && (
-          <div className="portal-policysum__loading" aria-hidden>
-            {Array.from({ length: 5 }).map((_, i) => (
-              <div key={i} className="portal-policysum__loading-row">
-                <Skeleton width="9rem" />
-                <Skeleton width="60%" height="0.625rem" />
-              </div>
-            ))}
-          </div>
-        )}
-
-        {isEmpty && (
-          <EmptyState
-            size="compact"
-            title={t("portal.policySummary.empty.title")}
-            description={t("portal.policySummary.empty.description")}
-          />
-        )}
-
-        {data && rows.length > 0 && (
-          <Table
-            columns={columns}
-            rows={rows}
-            rowKey={(r) => r.entry.category.id}
-            onRowClick={goToPolicies}
-          />
-        )}
-      </Card>
-    </section>
-  );
-}
diff --git a/frontend/editor/src/portal/components/ProcessingStatusStrip.css b/frontend/editor/src/portal/components/ProcessingStatusStrip.css
deleted file mode 100644
index 63341798f6..0000000000
--- a/frontend/editor/src/portal/components/ProcessingStatusStrip.css
+++ /dev/null
@@ -1,43 +0,0 @@
-/* Single inline row: plan + real processed-PDF volume + manage-plan shortcut. */
-.portal-statusstrip--paid {
-  display: flex;
-  align-items: center;
-  gap: 0.625rem;
-  padding: 0.625rem 0.875rem;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  border-radius: var(--radius-md);
-}
-
-.portal-statusstrip__plan {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.4375rem;
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-statusstrip__dot {
-  width: 0.5rem;
-  height: 0.5rem;
-  border-radius: 50%;
-}
-
-.portal-statusstrip__sep {
-  color: var(--color-text-5);
-}
-
-.portal-statusstrip__volume {
-  font-size: 0.8125rem;
-  color: var(--color-text-3);
-}
-
-.portal-statusstrip__volume strong {
-  color: var(--color-text-1);
-  font-weight: 600;
-}
-
-.portal-statusstrip__manage {
-  margin-left: auto;
-}
diff --git a/frontend/editor/src/portal/components/ProcessingStatusStrip.stories.tsx b/frontend/editor/src/portal/components/ProcessingStatusStrip.stories.tsx
deleted file mode 100644
index c5df1139d5..0000000000
--- a/frontend/editor/src/portal/components/ProcessingStatusStrip.stories.tsx
+++ /dev/null
@@ -1,36 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { http, HttpResponse, delay } from "msw";
-import { ProcessingStatusStrip } from "@portal/components/ProcessingStatusStrip";
-
-const meta: Meta<typeof ProcessingStatusStrip> = {
-  title: "Portal/Home/ProcessingStatusStrip",
-  component: ProcessingStatusStrip,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "60rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof ProcessingStatusStrip>;
-
-/** Switch the Tier toolbar to compare the free meter vs the paid plan row. */
-export const Default: Story = {};
-
-/** Free tier pushed near its cap so the meter and upgrade nudge turn amber. */
-export const FreeNearCap: Story = {
-  globals: { tier: "free" },
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/home/kpis", async () => {
-          await delay(80);
-          return HttpResponse.json([{ value: "472 / 500" }]);
-        }),
-      ],
-    },
-  },
-};
diff --git a/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx b/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx
deleted file mode 100644
index 2f4602b11d..0000000000
--- a/frontend/editor/src/portal/components/ProcessingStatusStrip.tsx
+++ /dev/null
@@ -1,52 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { Button, Skeleton } from "@app/ui";
-import { TIER_INFO, useTier } from "@portal/contexts/TierContext";
-import { useView } from "@portal/contexts/ViewContext";
-import { useAsync } from "@portal/hooks/useAsync";
-import { fetchFleetStats, type FleetStats } from "@portal/api/fleetStats";
-import "@portal/components/ProcessingStatusStrip.css";
-
-/**
- * A thin one-line header above the home content: current plan + the real 30-day
- * processed-PDF volume (from the fleet-usage endpoint), with a shortcut to the
- * Usage page. Renders "—" while loading or when the backend can't compute the
- * figure (e.g. EE auditing disabled) — never a fabricated number.
- */
-export function ProcessingStatusStrip() {
-  const { t } = useTranslation();
-  const { tier } = useTier();
-  const { setActiveView } = useView();
-  const { data, loading } = useAsync<FleetStats>(() => fetchFleetStats(), []);
-
-  return (
-    <div className="portal-statusstrip portal-statusstrip--paid">
-      <span className="portal-statusstrip__plan">
-        <span
-          className="portal-statusstrip__dot"
-          style={{ background: TIER_INFO[tier].dotColor }}
-          aria-hidden
-        />
-        {t(TIER_INFO[tier].labelKey)}
-      </span>
-      <span className="portal-statusstrip__sep" aria-hidden>
-        ·
-      </span>
-      <span className="portal-statusstrip__volume">
-        {loading ? (
-          <Skeleton width="3rem" height="0.875rem" />
-        ) : (
-          <strong>{data?.pdfsProcessed?.toLocaleString() ?? "—"}</strong>
-        )}{" "}
-        {t("portal.processingStatus.volumeSuffix")}
-      </span>
-      <Button
-        size="sm"
-        variant="tertiary"
-        className="portal-statusstrip__manage"
-        onClick={() => setActiveView("usage")}
-      >
-        {t("portal.processingStatus.managePlan")}
-      </Button>
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/RecentActivity.css b/frontend/editor/src/portal/components/RecentActivity.css
deleted file mode 100644
index 9fceadfe84..0000000000
--- a/frontend/editor/src/portal/components/RecentActivity.css
+++ /dev/null
@@ -1,138 +0,0 @@
-.portal-activity {
-  display: flex;
-  flex-direction: column;
-}
-
-.portal-activity__head {
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  padding: 0.875rem 1rem;
-  border-bottom: 1px solid var(--color-border-light);
-}
-
-.portal-activity__title {
-  margin: 0;
-  font-size: 0.9375rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-activity__more {
-  font-size: 0.75rem;
-  font-weight: 500;
-  color: var(--color-blue);
-  padding: 0.25rem 0.5rem;
-  border-radius: var(--radius-sm);
-  transition: background var(--motion-fast);
-}
-
-.portal-activity__more:hover {
-  background: var(--color-bg-hover);
-}
-
-.portal-activity__list {
-  list-style: none;
-  margin: 0;
-  padding: 0;
-}
-
-.portal-activity__item {
-  display: flex;
-  gap: 0.75rem;
-  padding: 0.75rem 1rem;
-  border-bottom: 1px solid var(--color-border-light);
-  transition: background var(--motion-fast);
-}
-
-.portal-activity__item:last-child {
-  border-bottom: none;
-}
-
-.portal-activity__item:hover {
-  background: var(--color-bg-hover);
-}
-
-.portal-activity__rail {
-  width: 0.1875rem;
-  border-radius: var(--radius-pill);
-  flex-shrink: 0;
-}
-
-.portal-activity__body {
-  flex: 1 1 auto;
-  min-width: 0;
-}
-
-.portal-activity__row {
-  display: flex;
-  align-items: baseline;
-  justify-content: space-between;
-  gap: 0.5rem;
-}
-
-.portal-activity__action {
-  font-size: 0.8125rem;
-  font-weight: 600;
-  color: var(--color-text-1);
-}
-
-.portal-activity__time {
-  font-size: 0.6875rem;
-  color: var(--color-text-5);
-}
-
-.portal-activity__subject {
-  font-size: 0.75rem;
-  color: var(--color-text-3);
-  margin-top: 0.0625rem;
-}
-
-.portal-activity__detail-row {
-  margin-top: 0.375rem;
-  display: flex;
-  align-items: center;
-  justify-content: space-between;
-  gap: 0.5rem;
-}
-
-.portal-activity__detail {
-  font-size: 0.75rem;
-  color: var(--color-text-4);
-  font-family: var(--font-mono);
-  overflow: hidden;
-  text-overflow: ellipsis;
-  white-space: nowrap;
-  min-width: 0;
-}
-
-.portal-activity__item--skeleton {
-  cursor: default;
-}
-
-.portal-activity__item--skeleton .portal-activity__rail {
-  background: var(--color-border-light);
-}
-
-.portal-activity__skel {
-  height: 0.75rem;
-  border-radius: var(--radius-pill);
-  background: linear-gradient(
-    90deg,
-    var(--color-bg-muted) 0%,
-    var(--color-bg-hover) 50%,
-    var(--color-bg-muted) 100%
-  );
-  background-size: 200% 100%;
-  animation: shimmer 1.4s linear infinite;
-  margin-bottom: 0.375rem;
-}
-
-.portal-activity__skel--md {
-  width: 70%;
-}
-
-.portal-activity__skel--sm {
-  width: 50%;
-  height: 0.625rem;
-}
diff --git a/frontend/editor/src/portal/components/RecentActivity.stories.tsx b/frontend/editor/src/portal/components/RecentActivity.stories.tsx
deleted file mode 100644
index 5b33617ea4..0000000000
--- a/frontend/editor/src/portal/components/RecentActivity.stories.tsx
+++ /dev/null
@@ -1,41 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { http, HttpResponse, delay } from "msw";
-import { RecentActivity } from "@portal/components/RecentActivity";
-
-const meta: Meta<typeof RecentActivity> = {
-  title: "Portal/Home/RecentActivity",
-  component: RecentActivity,
-  parameters: { layout: "padded" },
-  decorators: [
-    (S) => (
-      <div style={{ maxWidth: "40rem" }}>
-        <S />
-      </div>
-    ),
-  ],
-};
-export default meta;
-type Story = StoryObj<typeof RecentActivity>;
-
-export const Default: Story = {};
-
-export const Loading: Story = {
-  parameters: {
-    msw: {
-      handlers: [
-        http.get("/v1/activity", async () => {
-          await delay("infinite");
-          return HttpResponse.json([]);
-        }),
-      ],
-    },
-  },
-};
-
-export const Empty: Story = {
-  parameters: {
-    msw: {
-      handlers: [http.get("/v1/activity", () => HttpResponse.json([]))],
-    },
-  },
-};
diff --git a/frontend/editor/src/portal/components/RecentActivity.tsx b/frontend/editor/src/portal/components/RecentActivity.tsx
deleted file mode 100644
index 3ebd940151..0000000000
--- a/frontend/editor/src/portal/components/RecentActivity.tsx
+++ /dev/null
@@ -1,127 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { Button, Card, EmptyState, Skeleton, StatusBadge } from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useView } from "@portal/contexts/ViewContext";
-import { useAsync } from "@portal/hooks/useAsync";
-import {
-  fetchAuditLog,
-  type AuditLogResponse,
-  type AuditStatus,
-} from "@portal/api/infrastructure";
-import {
-  AUDIT_CAT_LABEL,
-  AUDIT_STATUS_LABEL,
-  AUDIT_TONE,
-} from "@portal/components/infrastructure/infraFormat";
-import "@portal/components/RecentActivity.css";
-
-/** Rail colour by outcome — mirrors the audit status tones. */
-const STATUS_COLOUR: Record<AuditStatus, string> = {
-  success: "var(--color-green)",
-  warning: "var(--color-amber)",
-  danger: "var(--color-red)",
-  info: "var(--color-blue)",
-};
-
-/** How many of the most recent audit events the home card shows. */
-const MAX_EVENTS = 6;
-
-/**
- * The home "Recent activity" card, backed by the real audit log (the same
- * endpoint the Infrastructure → Audit tab reads). Shows the latest few events;
- * "View all" jumps to the full audit view. Failures and an empty log both fall
- * through to the empty state — never an error banner on the dashboard.
- */
-export function RecentActivity() {
-  const { t } = useTranslation();
-  const { tier } = useTier();
-  const { setActiveView } = useView();
-  const { data, loading } = useAsync<AuditLogResponse>(
-    () => fetchAuditLog(tier),
-    [tier],
-  );
-
-  const events = data?.events.slice(0, MAX_EVENTS) ?? [];
-  const isLoading = loading && data === null;
-  const isEmpty = !isLoading && events.length === 0;
-
-  return (
-    <Card
-      padding="none"
-      className="portal-activity"
-      aria-label={t("portal.recentActivity.title")}
-    >
-      <header className="portal-activity__head">
-        <h2 className="portal-activity__title">
-          {t("portal.recentActivity.title")}
-        </h2>
-        <Button
-          variant="quiet"
-          type="button"
-          className="portal-activity__more"
-          onClick={() => setActiveView("infrastructure")}
-        >
-          {t("portal.recentActivity.viewAll")} →
-        </Button>
-      </header>
-
-      {isLoading && (
-        <ul className="portal-activity__list" aria-hidden>
-          {Array.from({ length: 5 }).map((_, i) => (
-            <li
-              key={i}
-              className="portal-activity__item portal-activity__item--skeleton"
-            >
-              <span className="portal-activity__rail" />
-              <div className="portal-activity__body">
-                <Skeleton width="70%" />
-                <Skeleton width="50%" height="0.625rem" />
-              </div>
-            </li>
-          ))}
-        </ul>
-      )}
-
-      {isEmpty && (
-        <EmptyState
-          size="compact"
-          title={t("portal.recentActivity.empty.title")}
-          description={t("portal.recentActivity.empty.description")}
-        />
-      )}
-
-      {events.length > 0 && (
-        <ol className="portal-activity__list">
-          {events.map((event) => (
-            <li key={event.id} className="portal-activity__item">
-              <span
-                className="portal-activity__rail"
-                style={{ background: STATUS_COLOUR[event.status] }}
-                aria-hidden
-              />
-              <div className="portal-activity__body">
-                <div className="portal-activity__row">
-                  <span className="portal-activity__action">
-                    {event.action}
-                  </span>
-                  <span className="portal-activity__time">
-                    {event.timestamp}
-                  </span>
-                </div>
-                <div className="portal-activity__subject">{event.target}</div>
-                <div className="portal-activity__detail-row">
-                  <span className="portal-activity__detail">
-                    {t(AUDIT_CAT_LABEL[event.category])} · {event.actor}
-                  </span>
-                  <StatusBadge tone={AUDIT_TONE[event.status]} size="sm">
-                    {t(AUDIT_STATUS_LABEL[event.status])}
-                  </StatusBadge>
-                </div>
-              </div>
-            </li>
-          ))}
-        </ol>
-      )}
-    </Card>
-  );
-}
diff --git a/frontend/editor/src/portal/components/processor-flow/FlowPolicies.tsx b/frontend/editor/src/portal/components/processor-flow/FlowPolicies.tsx
index f01d51c44d..50b439368f 100644
--- a/frontend/editor/src/portal/components/processor-flow/FlowPolicies.tsx
+++ b/frontend/editor/src/portal/components/processor-flow/FlowPolicies.tsx
@@ -59,8 +59,10 @@ export function FlowPolicies({
             ) : policy.state === "off" ? (
               <Button
                 size="sm"
+                px="sm"
                 py="xs"
-                variant="primary"
+                fontSize="xs"
+                variant="secondary"
                 className="portal-pf__setup"
                 onClick={() => onSetup(policy.key)}
               >
diff --git a/frontend/editor/src/portal/views/Home.tsx b/frontend/editor/src/portal/views/Home.tsx
index e127fe41ad..94a5668c60 100644
--- a/frontend/editor/src/portal/views/Home.tsx
+++ b/frontend/editor/src/portal/views/Home.tsx
@@ -1,133 +1,9 @@
-import { useTranslation } from "react-i18next";
-import { Button, Card } from "@app/ui";
 import { useTier } from "@portal/contexts/TierContext";
-import { useView, type ViewId } from "@portal/contexts/ViewContext";
 import { HomeHero } from "@portal/components/HomeHero";
 import { HomeGreeting } from "@portal/components/HomeGreeting";
 import { ProcessorFlow } from "@portal/components/ProcessorFlow";
-import { RecentActivity } from "@portal/components/RecentActivity";
-import { ProcessingStatusStrip } from "@portal/components/ProcessingStatusStrip";
-import { PolicySummary } from "@portal/components/PolicySummary";
 import "@portal/views/Home.css";
 
-/* ──────────────────────────────────────────────────────────────────────── */
-/*  Quick actions card                                                       */
-/* ──────────────────────────────────────────────────────────────────────── */
-
-/** A stroke icon used inside the quick-action badge (replaces the old text
-    glyphs ⌃ ⇢ ⚙, which rendered off-style vs the portal's icon set). */
-function QuickIcon({ d }: { d: string }) {
-  return (
-    <svg
-      viewBox="0 0 24 24"
-      fill="none"
-      stroke="currentColor"
-      strokeWidth="1.7"
-      strokeLinecap="round"
-      strokeLinejoin="round"
-      aria-hidden
-    >
-      <path d={d} />
-    </svg>
-  );
-}
-
-/** Rows for the Quick Actions list. Each `view` navigates the portal. */
-const QUICK_ACTIONS: Array<{
-  key: string;
-  iconD: string;
-  bg: string;
-  fg: string;
-  view: ViewId;
-}> = [
-  {
-    key: "buildPipeline",
-    iconD:
-      "M6 4a2 2 0 100 4 2 2 0 000-4zM18 16a2 2 0 100 4 2 2 0 000-4zM6 8v6a4 4 0 004 4h4",
-    bg: "var(--color-purple-light)",
-    fg: "var(--color-purple)",
-    view: "pipelines",
-  },
-  {
-    key: "connectSource",
-    iconD:
-      "M10 13a5 5 0 007 0l3-3a5 5 0 00-7-7l-1 1M14 11a5 5 0 00-7 0l-3 3a5 5 0 007 7l1-1",
-    bg: "var(--color-green-light)",
-    fg: "var(--color-green-dark)",
-    view: "sources",
-  },
-  {
-    key: "issueApiKey",
-    iconD:
-      "M2.6 17.4A2 2 0 002 18.8V21a1 1 0 001 1h3a1 1 0 001-1v-1a1 1 0 011-1h1a1 1 0 001-1v-1a1 1 0 011-1h.2a2 2 0 001.4-.6l.8-.8a6.5 6.5 0 10-4-4z M16.5 7.5 h.01",
-    bg: "var(--color-amber-light)",
-    fg: "var(--color-amber-dark)",
-    view: "infrastructure",
-  },
-];
-
-function QuickActions() {
-  const { t } = useTranslation();
-  const { setActiveView } = useView();
-  return (
-    <Card padding="loose" className="portal-home__quick">
-      <div className="portal-home__quick-head">
-        <h2 className="portal-home__quick-title">
-          {t("portal.home.quickActions.title")}
-        </h2>
-        <span className="portal-home__quick-sub">
-          {t("portal.home.quickActions.subtitle")}
-        </span>
-      </div>
-      <div className="portal-home__quick-list">
-        {QUICK_ACTIONS.map((action) => (
-          <Button
-            key={action.key}
-            variant="quiet"
-            justify="start"
-            fullWidth
-            px="sm"
-            py="sm"
-            type="button"
-            className="portal-home__quick-row"
-            onClick={() => setActiveView(action.view)}
-            leftSection={
-              <span
-                className="portal-home__quick-icon"
-                style={{ background: action.bg, color: action.fg }}
-                aria-hidden
-              >
-                <QuickIcon d={action.iconD} />
-              </span>
-            }
-            rightSection={
-              <span className="portal-home__quick-arrow" aria-hidden>
-                <svg
-                  viewBox="0 0 24 24"
-                  fill="none"
-                  stroke="currentColor"
-                  strokeWidth="2"
-                  strokeLinecap="round"
-                  strokeLinejoin="round"
-                >
-                  <path d="M9 6l6 6-6 6" />
-                </svg>
-              </span>
-            }
-          >
-            <span className="portal-home__quick-text">
-              <strong>
-                {t(`portal.home.quickActions.${action.key}.title`)}
-              </strong>
-              <span>{t(`portal.home.quickActions.${action.key}.blurb`)}</span>
-            </span>
-          </Button>
-        ))}
-      </div>
-    </Card>
-  );
-}
-
 /* ──────────────────────────────────────────────────────────────────────── */
 /*  Home view                                                                */
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -144,15 +20,6 @@ export function Home() {
           deal is underway (a bolt-on to any tier), otherwise the setup checklist. */}
       <HomeHero tier={tier} />
       <ProcessorFlow />
-
-      {/* One unified layout across tiers: real processed-PDF volume, real audit
-          activity, quick actions, and the standing-policy summary. */}
-      <ProcessingStatusStrip />
-      <div className="portal-home__row">
-        <RecentActivity />
-        <QuickActions />
-      </div>
-      <PolicySummary />
     </div>
   );
 }

From 357eb77f94546358f0b96592bf6e265fe54a6baa Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Thu, 23 Jul 2026 07:52:57 +0000
Subject: [PATCH 084/109] Portal: multiple named personal API keys with per-key
 usage tracking (#6961)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Description of Changes

Multiple named **personal** API keys per user, replacing the single
opaque per-user key.

- Create (name + one-time secret), list, and revoke named keys from the
portal Infrastructure → API Keys tab. Works self-hosted and SaaS
(`X-API-KEY`).
- Per-key usage stats (today / trailing 30 days / lifetime);
API-processed documents are attributed to the specific key in the
processor's Documents feed.
- The legacy single per-user key keeps working and is lazily represented
as a named key. Rotating it revokes its migrated shadow row so the old
secret stops authenticating.
- Per-user (not per-key) rate limiting plus a per-user active-key cap,
so minting keys can't multiply the daily quota. Name-length cap;
race-safe migration and usage recording.

Keys are strictly personal: one owner, full access, no sharing.
Team-shared / scoped keys and per-key access levels were intentionally
left out of this PR to keep it small and easy to review; they can follow
as a separate, focused change.

> Note: the screenshots from the original revision showed an earlier
team-scoped design and need refreshing.

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [x] I have performed a self-review of my own code
- [x] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [x] I have run `task check` to verify linters, typechecks, and tests
pass
- [x] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.

---------

Co-authored-by: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
---
 .../config/CustomAuditEventRepository.java    |  15 +-
 .../api/PortalApiKeysController.java          |  54 ++++
 .../mcp/security/McpApiKeyAuthFilter.java     |   4 +-
 .../model/api/apikey/CreateApiKeyRequest.java |   4 +
 .../model/api/apikey/CreatedApiKeyDto.java    |   7 +
 .../model/api/apikey/PortalApiKeyDto.java     |  21 ++
 .../api/apikey/PortalApiKeysResponse.java     |   9 +
 .../configuration/SecurityConfiguration.java  |   7 +-
 .../filter/JwtAuthenticationFilter.java       |  24 +-
 .../filter/UserAuthenticationFilter.java      |  32 ++-
 .../filter/UserBasedRateLimitingFilter.java   |  29 +-
 .../proprietary/security/model/ApiKey.java    |  72 +++++
 .../model/ApiKeyAuthenticationToken.java      |   1 +
 .../security/model/ApiKeyDailyUsage.java      |  45 +++
 .../security/model/ApiKeyDailyUsageId.java    |  36 +++
 .../ApiKeyDailyUsageRepository.java           |  55 ++++
 .../security/repository/ApiKeyRepository.java |  19 ++
 .../security/repository/ApiKeyUsageSum.java   |   8 +
 .../service/ApiKeyAuthenticationService.java  | 107 +++++++
 .../security/service/ApiKeyHasher.java        |  50 ++++
 .../service/ApiKeyLegacyMigrator.java         |  31 ++
 .../service/ApiKeyManagementService.java      | 235 ++++++++++++++++
 .../security/service/ApiKeyUsageRecorder.java |  60 ++++
 .../security/service/ApiKeyUsageWriter.java   |  59 ++++
 .../security/service/UserService.java         |  26 +-
 .../service/PortalDocumentsService.java       |  13 +-
 .../SecurityConfigurationTest.java            |   5 +-
 .../filter/UserAuthenticationFilterTest.java  |  17 +-
 .../UserBasedRateLimitingFilterTest.java      |  95 +++++++
 .../ApiKeyAuthenticationServiceTest.java      | 148 ++++++++++
 .../security/service/ApiKeyHasherTest.java    |  38 +++
 .../service/ApiKeyManagementServiceTest.java  | 198 +++++++++++++
 .../service/ApiKeyUsageRecorderTest.java      |  88 ++++++
 .../security/service/UserServiceMoreTest.java |   7 +-
 .../security/service/UserServiceTest.java     |  22 ++
 .../service/PortalDocumentsServiceTest.java   |  14 +
 .../SupabaseAuthenticationFilter.java         |  25 +-
 .../saas/security/SupabaseSecurityConfig.java |   5 +-
 .../db/migration/saas/V33__api_keys.sql       |  24 ++
 .../SupabaseAuthenticationFilterMoreTest.java |  18 +-
 .../SupabaseAuthenticationFilterTest.java     |  20 +-
 .../SupabaseSecurityConfigMoreTest.java       |  11 +-
 .../security/TeamSecurityExpressionsTest.java |  22 ++
 .../public/locales/en-GB/translation.toml     |  28 +-
 .../public/locales/en-US/translation.toml     |  34 +--
 .../core/tests/stubbed/api-keys-ui.spec.ts    | 265 ++++++++++++++++++
 .../editor/src/portal/api/infrastructure.ts   |  53 +++-
 .../infrastructure/ApiKeyCard.stories.tsx     |  36 +--
 .../components/infrastructure/ApiKeyCard.tsx  |  62 ++--
 .../infrastructure/ApiKeysTab.stories.tsx     |  17 +-
 .../infrastructure/ApiKeysTab.test.tsx        | 124 ++++++++
 .../components/infrastructure/ApiKeysTab.tsx  |  95 ++++++-
 .../infrastructure/CreateKeyModal.stories.tsx |   6 +-
 .../infrastructure/CreateKeyModal.test.tsx    |  63 +++++
 .../infrastructure/CreateKeyModal.tsx         |  94 ++-----
 .../components/infrastructure/infraFormat.ts  |   2 -
 .../portal/mocks/handlers/infrastructure.ts   |  46 ++-
 .../editor/src/portal/mocks/infrastructure.ts |  59 ++--
 .../features/enterprise/api_keys.feature      |  86 ++++++
 59 files changed, 2559 insertions(+), 291 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalApiKeysController.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/CreateApiKeyRequest.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/CreatedApiKeyDto.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/PortalApiKeyDto.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/PortalApiKeysResponse.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKey.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyDailyUsage.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyDailyUsageId.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyDailyUsageRepository.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyRepository.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyUsageSum.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyAuthenticationService.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyHasher.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyLegacyMigrator.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyManagementService.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyUsageRecorder.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyUsageWriter.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilterTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyAuthenticationServiceTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyHasherTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyManagementServiceTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyUsageRecorderTest.java
 create mode 100644 app/saas/src/main/resources/db/migration/saas/V33__api_keys.sql
 create mode 100644 frontend/editor/src/core/tests/stubbed/api-keys-ui.spec.ts
 create mode 100644 frontend/editor/src/portal/components/infrastructure/ApiKeysTab.test.tsx
 create mode 100644 frontend/editor/src/portal/components/infrastructure/CreateKeyModal.test.tsx
 create mode 100644 testing/cucumber/features/enterprise/api_keys.feature

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/config/CustomAuditEventRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/config/CustomAuditEventRepository.java
index f83bf0afdc..53596ebdb4 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/config/CustomAuditEventRepository.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/config/CustomAuditEventRepository.java
@@ -54,10 +54,21 @@ public class CustomAuditEventRepository implements AuditEventRepository {
                 return;
             }
             String rid = MDC.get("requestId");
+            String apiKeyLabel =
+                    MDC.get(
+                            stirling.software.proprietary.security.service
+                                    .ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY);
 
-            if (rid != null) {
+            if (rid != null || apiKeyLabel != null) {
                 clean = new java.util.HashMap<>(clean);
-                clean.put("requestId", rid);
+                if (rid != null) {
+                    clean.put("requestId", rid);
+                }
+                // Named key that made the request; surfaces as the doc source in the processor
+                // feed.
+                if (apiKeyLabel != null) {
+                    clean.put("__apiKeyLabel", apiKeyLabel);
+                }
             }
 
             String source = MDC.get("auditSource");
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalApiKeysController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalApiKeysController.java
new file mode 100644
index 0000000000..af0f4d055a
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PortalApiKeysController.java
@@ -0,0 +1,54 @@
+package stirling.software.proprietary.controller.api;
+
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestParam;
+
+import io.swagger.v3.oas.annotations.Operation;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.common.annotations.api.ProprietaryUiDataApi;
+import stirling.software.proprietary.model.api.apikey.CreateApiKeyRequest;
+import stirling.software.proprietary.model.api.apikey.CreatedApiKeyDto;
+import stirling.software.proprietary.model.api.apikey.PortalApiKeysResponse;
+import stirling.software.proprietary.security.service.ApiKeyManagementService;
+
+/**
+ * Real backing for the portal Infrastructure → API Keys tab: list/create/revoke named, personal API
+ * keys. Replaces the former portal-only mock endpoint. Not gated behind an Enterprise license - API
+ * keys are a core auth feature available on every self-hosted instance.
+ */
+@ProprietaryUiDataApi
+@RequiredArgsConstructor
+public class PortalApiKeysController {
+
+    private final ApiKeyManagementService apiKeyManagementService;
+
+    // tier accepted for endpoint symmetry with the other infra tabs; ignored here.
+    @GetMapping("/infrastructure/api-keys")
+    @Operation(summary = "List API keys", description = "The caller's personal API keys.")
+    public ResponseEntity<PortalApiKeysResponse> list(
+            @RequestParam(value = "tier", required = false) String tier) {
+        return ResponseEntity.ok(apiKeyManagementService.listVisibleKeys());
+    }
+
+    @PostMapping("/infrastructure/api-keys")
+    @Operation(
+            summary = "Create an API key",
+            description = "Mints a personal key and returns its one-time secret.")
+    public ResponseEntity<CreatedApiKeyDto> create(@RequestBody CreateApiKeyRequest request) {
+        return ResponseEntity.ok(apiKeyManagementService.createKey(request));
+    }
+
+    @DeleteMapping("/infrastructure/api-keys/{id}")
+    @Operation(summary = "Revoke an API key", description = "Disables a key the caller owns.")
+    public ResponseEntity<Void> revoke(@PathVariable("id") Long id) {
+        apiKeyManagementService.revokeKey(id);
+        return ResponseEntity.noContent().build();
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/mcp/security/McpApiKeyAuthFilter.java b/app/proprietary/src/main/java/stirling/software/proprietary/mcp/security/McpApiKeyAuthFilter.java
index e45dadb0c0..9c76978ccb 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/mcp/security/McpApiKeyAuthFilter.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/mcp/security/McpApiKeyAuthFilter.java
@@ -24,8 +24,8 @@ import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.service.UserService;
 
 /**
- * API-key auth for the MCP endpoint: validates a Stirling per-user API key and binds the request to
- * that user with the MCP scopes.
+ * API-key auth for the MCP endpoint: validates a Stirling API key and binds the request to that
+ * user with the MCP scopes.
  */
 @Slf4j
 public class McpApiKeyAuthFilter extends OncePerRequestFilter {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/CreateApiKeyRequest.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/CreateApiKeyRequest.java
new file mode 100644
index 0000000000..14aa43093c
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/CreateApiKeyRequest.java
@@ -0,0 +1,4 @@
+package stirling.software.proprietary.model.api.apikey;
+
+/** Create-key request body from the portal: just a display name for the new personal key. */
+public record CreateApiKeyRequest(String name) {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/CreatedApiKeyDto.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/CreatedApiKeyDto.java
new file mode 100644
index 0000000000..aa285344c8
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/CreatedApiKeyDto.java
@@ -0,0 +1,7 @@
+package stirling.software.proprietary.model.api.apikey;
+
+import lombok.Builder;
+
+/** Returned once when a key is created: the row plus the plaintext secret, never persisted. */
+@Builder
+public record CreatedApiKeyDto(PortalApiKeyDto key, String secret) {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/PortalApiKeyDto.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/PortalApiKeyDto.java
new file mode 100644
index 0000000000..062c1e0a9f
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/PortalApiKeyDto.java
@@ -0,0 +1,21 @@
+package stirling.software.proprietary.model.api.apikey;
+
+import lombok.Builder;
+
+/**
+ * One API key as shown in the portal Infrastructure → API Keys tab. Never carries the secret; that
+ * is returned once from {@link CreatedApiKeyDto} at creation time.
+ */
+@Builder
+public record PortalApiKeyDto(
+        String id,
+        String name,
+        String prefix,
+        String created,
+        String lastUsed,
+        /** "active" | "revoked". */
+        String status,
+        long usageToday,
+        long usageMonth,
+        /** Lifetime request count for the key. */
+        long usageTotal) {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/PortalApiKeysResponse.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/PortalApiKeysResponse.java
new file mode 100644
index 0000000000..dd21af7226
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/api/apikey/PortalApiKeysResponse.java
@@ -0,0 +1,9 @@
+package stirling.software.proprietary.model.api.apikey;
+
+import java.util.List;
+
+import lombok.Builder;
+
+/** Payload for the API Keys tab: the personal keys the caller owns. */
+@Builder
+public record PortalApiKeysResponse(List<PortalApiKeyDto> keys) {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java
index 20a9cb2628..eab9fc6fd0 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/SecurityConfiguration.java
@@ -57,6 +57,7 @@ import stirling.software.proprietary.security.oauth2.TauriAuthorizationRequestRe
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationFailureHandler;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticationSuccessHandler;
 import stirling.software.proprietary.security.saml2.CustomSaml2ResponseAuthenticationConverter;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
 import stirling.software.proprietary.security.service.CustomOAuth2UserService;
 import stirling.software.proprietary.security.service.CustomUserDetailsService;
 import stirling.software.proprietary.security.service.JwtServiceInterface;
@@ -484,12 +485,14 @@ public class SecurityConfiguration {
     }
 
     @Bean
-    public JwtAuthenticationFilter jwtAuthenticationFilter() {
+    public JwtAuthenticationFilter jwtAuthenticationFilter(
+            ApiKeyAuthenticationService apiKeyAuthenticationService) {
         return new JwtAuthenticationFilter(
                 jwtService,
                 userService,
                 userDetailsService,
                 jwtAuthenticationEntryPoint,
-                securityProperties);
+                securityProperties,
+                apiKeyAuthenticationService);
     }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/JwtAuthenticationFilter.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/JwtAuthenticationFilter.java
index 92bbcab89c..ed8001df5a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/JwtAuthenticationFilter.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/JwtAuthenticationFilter.java
@@ -11,6 +11,7 @@ import java.sql.SQLException;
 import java.util.Map;
 import java.util.Optional;
 
+import org.slf4j.MDC;
 import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
@@ -33,8 +34,9 @@ import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.exception.UnsupportedProviderException;
 import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.AuthenticationType;
-import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.model.exception.AuthenticationFailureException;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService.ApiKeyAuthentication;
 import stirling.software.proprietary.security.service.CustomUserDetailsService;
 import stirling.software.proprietary.security.service.JwtServiceInterface;
 import stirling.software.proprietary.security.service.UserService;
@@ -48,11 +50,15 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
     private final CustomUserDetailsService userDetailsService;
     private final AuthenticationEntryPoint authenticationEntryPoint;
     private final ApplicationProperties.Security securityProperties;
+    private final ApiKeyAuthenticationService apiKeyAuthenticationService;
 
     @Override
     protected void doFilterInternal(
             HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
             throws ServletException, IOException {
+        // Start clean so a pooled thread can't inherit a prior request's key label. This filter
+        // runs before UserAuthenticationFilter, so in JWT mode it owns the API-key label lifecycle.
+        MDC.remove(ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY);
         if (!jwtService.isJwtEnabled()) {
             filterChain.doFilter(request, response);
             return;
@@ -131,9 +137,14 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
             if (apiKey != null && !apiKey.isBlank()) {
                 try {
-                    Optional<User> user = userService.getUserByApiKey(apiKey);
+                    // Resolve through the shared service so the multi-key table (then the legacy
+                    // per-user key) is consulted and per-key usage is recorded; the key runs as its
+                    // owner. It also yields a per-key label for the processor's document
+                    // attribution.
+                    Optional<ApiKeyAuthentication> resolved =
+                            apiKeyAuthenticationService.authenticate(apiKey);
 
-                    if (user.isEmpty()) {
+                    if (resolved.isEmpty()) {
                         handleAuthenticationFailure(
                                 request,
                                 response,
@@ -143,8 +154,13 @@ public class JwtAuthenticationFilter extends OncePerRequestFilter {
 
                     authentication =
                             new ApiKeyAuthenticationToken(
-                                    user.get(), apiKey, user.get().getAuthorities());
+                                    resolved.get().user(), apiKey, resolved.get().authorities());
                     SecurityContextHolder.getContext().setAuthentication(authentication);
+                    if (resolved.get().auditLabel() != null) {
+                        MDC.put(
+                                ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY,
+                                resolved.get().auditLabel());
+                    }
                     return true;
                 } catch (AuthenticationException e) {
                     handleAuthenticationFailure(
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserAuthenticationFilter.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserAuthenticationFilter.java
index 5777b093e8..8fe351ccde 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserAuthenticationFilter.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserAuthenticationFilter.java
@@ -6,6 +6,7 @@ import java.io.IOException;
 import java.util.List;
 import java.util.Optional;
 
+import org.slf4j.MDC;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.context.annotation.Lazy;
 import org.springframework.context.annotation.Profile;
@@ -33,6 +34,8 @@ import stirling.software.common.util.RequestUriUtils;
 import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.saml2.CustomSaml2AuthenticatedPrincipal;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService.ApiKeyAuthentication;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 
@@ -41,18 +44,24 @@ import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 @Profile("!saas")
 public class UserAuthenticationFilter extends OncePerRequestFilter {
 
+    /** MDC key carrying the resolved key's label into audit events for the processor feed. */
+    public static final String API_KEY_LABEL_MDC = ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY;
+
     private final ApplicationProperties.Security securityProp;
     private final UserService userService;
+    private final ApiKeyAuthenticationService apiKeyAuthenticationService;
     private final SessionPersistentRegistry sessionPersistentRegistry;
     private final boolean loginEnabledValue;
 
     public UserAuthenticationFilter(
             @Lazy ApplicationProperties.Security securityProp,
             @Lazy UserService userService,
+            ApiKeyAuthenticationService apiKeyAuthenticationService,
             SessionPersistentRegistry sessionPersistentRegistry,
             @Qualifier("loginEnabled") boolean loginEnabledValue) {
         this.securityProp = securityProp;
         this.userService = userService;
+        this.apiKeyAuthenticationService = apiKeyAuthenticationService;
         this.sessionPersistentRegistry = sessionPersistentRegistry;
         this.loginEnabledValue = loginEnabledValue;
     }
@@ -62,6 +71,14 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
             HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
             throws ServletException, IOException {
 
+        // Start each request clean so a pooled thread can't inherit a prior request's key label -
+        // but keep a label an upstream filter (JwtAuthenticationFilter) already set for a request
+        // it API-key-authenticated, otherwise per-key attribution is lost on the JWT path.
+        if (!(SecurityContextHolder.getContext().getAuthentication()
+                instanceof ApiKeyAuthenticationToken)) {
+            MDC.remove(API_KEY_LABEL_MDC);
+        }
+
         if (!loginEnabledValue) {
             // If login is not enabled, just pass all requests without authentication
             filterChain.doFilter(request, response);
@@ -89,18 +106,23 @@ public class UserAuthenticationFilter extends OncePerRequestFilter {
             String apiKey = request.getHeader("X-API-KEY");
             if (apiKey != null && !apiKey.trim().isEmpty()) {
                 try {
-                    // Use API key to authenticate. This requires you to have an authentication
-                    // provider for API keys.
-                    Optional<User> user = userService.getUserByApiKey(apiKey);
-                    if (user.isEmpty()) {
+                    // Resolves the multi-key table then the legacy key, records usage, and yields a
+                    // per-key label for the processor's document-source attribution.
+                    Optional<ApiKeyAuthentication> resolved =
+                            apiKeyAuthenticationService.authenticate(apiKey);
+                    if (resolved.isEmpty()) {
                         response.setStatus(HttpStatus.UNAUTHORIZED.value());
                         response.getWriter().write("Invalid API Key.");
                         return;
                     }
+                    User user = resolved.get().user();
                     authentication =
                             new ApiKeyAuthenticationToken(
-                                    user.get(), apiKey, user.get().getAuthorities());
+                                    user, apiKey, resolved.get().authorities());
                     SecurityContextHolder.getContext().setAuthentication(authentication);
+                    if (resolved.get().auditLabel() != null) {
+                        MDC.put(API_KEY_LABEL_MDC, resolved.get().auditLabel());
+                    }
                 } catch (AuthenticationException e) {
                     // If API key authentication fails, deny the request
                     response.setStatus(HttpStatus.UNAUTHORIZED.value());
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilter.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilter.java
index e4a15ae7b4..a07b5c9a97 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilter.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilter.java
@@ -11,7 +11,6 @@ import org.springframework.http.HttpStatus;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
-import org.springframework.security.core.userdetails.UserDetails;
 import org.springframework.stereotype.Component;
 import org.springframework.web.filter.OncePerRequestFilter;
 
@@ -58,22 +57,24 @@ public class UserBasedRateLimitingFilter extends OncePerRequestFilter {
             filterChain.doFilter(request, response);
             return;
         }
+        // Bucket by the resolved user (the auth filter runs first and populates the context, even
+        // for X-API-KEY requests), so all of a user's API keys share ONE per-user quota - minting
+        // extra keys can't multiply the daily limit. Fall back to the raw key / IP only when the
+        // request is unauthenticated.
         String identifier = null;
-        // Check for API key in the request headers
-        String apiKey = request.getHeader("X-API-KEY");
-        if (apiKey != null && !apiKey.trim().isEmpty()) {
-            identifier = // Prefix to distinguish between API keys and usernames
-                    "API_KEY_" + apiKey;
-        } else {
-            Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
-            if (authentication != null && authentication.isAuthenticated()) {
-                UserDetails userDetails = (UserDetails) authentication.getPrincipal();
-                identifier = userDetails.getUsername();
-            }
+        Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+        if (authentication != null
+                && authentication.isAuthenticated()
+                && !"anonymousUser".equals(authentication.getName())) {
+            identifier = authentication.getName();
         }
-        // If neither API key nor an authenticated user is present, use IP address
         if (identifier == null) {
-            identifier = request.getRemoteAddr();
+            String apiKey = request.getHeader("X-API-KEY");
+            if (apiKey != null && !apiKey.trim().isEmpty()) {
+                identifier = "API_KEY_" + apiKey;
+            } else {
+                identifier = request.getRemoteAddr();
+            }
         }
         Role userRole =
                 getRoleFromAuthentication(SecurityContextHolder.getContext().getAuthentication());
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKey.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKey.java
new file mode 100644
index 0000000000..fea66144d2
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKey.java
@@ -0,0 +1,72 @@
+package stirling.software.proprietary.security.model;
+
+import java.io.Serializable;
+import java.time.Instant;
+
+import jakarta.persistence.*;
+
+import lombok.AllArgsConstructor;
+import lombok.Builder;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/**
+ * A named, personal API key belonging to a user. The raw secret is shown once at creation and never
+ * stored; only its SHA-256 hash is persisted, so a leaked database row cannot be replayed. Distinct
+ * from the legacy single {@code users.apiKey} column, which stays a per-user key for backward
+ * compatibility and is lazily represented here.
+ */
+@Entity
+@Table(
+        name = "api_keys",
+        indexes = {
+            @Index(name = "idx_api_key_hash", columnList = "key_hash", unique = true),
+            @Index(name = "idx_api_key_owner", columnList = "owner_user_id")
+        })
+@Getter
+@Setter
+@Builder
+@NoArgsConstructor
+@AllArgsConstructor
+public class ApiKey implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private Long id;
+
+    @Column(name = "name", nullable = false, length = 100)
+    private String name;
+
+    /** SHA-256 hex of the raw key; the raw value is never persisted. */
+    @Column(name = "key_hash", nullable = false, unique = true, length = 64)
+    private String keyHash;
+
+    /** Non-secret leading fragment of the raw key, shown in listings (e.g. {@code sk_a1b2c3d4}). */
+    @Column(name = "prefix", nullable = false, length = 32)
+    private String prefix;
+
+    /** The user who created and owns the key; the key authenticates as this user. */
+    @Column(name = "owner_user_id", nullable = false)
+    private Long ownerUserId;
+
+    @Column(name = "enabled", nullable = false)
+    private boolean enabled;
+
+    @Column(name = "created_at", nullable = false)
+    private Instant createdAt;
+
+    @Column(name = "last_used_at")
+    private Instant lastUsedAt;
+
+    @Column(name = "revoked_at")
+    private Instant revokedAt;
+
+    /** Active = enabled and not revoked; only active keys authenticate. */
+    public boolean isActive() {
+        return enabled && revokedAt == null;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyAuthenticationToken.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyAuthenticationToken.java
index c969704bad..b09ba20aab 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyAuthenticationToken.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyAuthenticationToken.java
@@ -5,6 +5,7 @@ import java.util.Collection;
 import org.springframework.security.authentication.AbstractAuthenticationToken;
 import org.springframework.security.core.GrantedAuthority;
 
+/** Authentication produced from an {@code X-API-KEY} header; runs as the key's owner. */
 public class ApiKeyAuthenticationToken extends AbstractAuthenticationToken {
 
     private final Object principal;
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyDailyUsage.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyDailyUsage.java
new file mode 100644
index 0000000000..48055fc7d6
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyDailyUsage.java
@@ -0,0 +1,45 @@
+package stirling.software.proprietary.security.model;
+
+import java.io.Serializable;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Id;
+import jakarta.persistence.IdClass;
+import jakarta.persistence.Table;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/**
+ * One UTC day's request tally for an API key. Rolling "today"/"this month" usage is summed from
+ * these rows, keeping the table at one row per key per active day rather than one per request.
+ */
+@Entity
+@Table(name = "api_key_daily_usage")
+@IdClass(ApiKeyDailyUsageId.class)
+@Getter
+@Setter
+@NoArgsConstructor
+public class ApiKeyDailyUsage implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @Column(name = "api_key_id")
+    private Long apiKeyId;
+
+    @Id
+    @Column(name = "epoch_day")
+    private long epochDay;
+
+    @Column(name = "count")
+    private long count;
+
+    public ApiKeyDailyUsage(Long apiKeyId, long epochDay, long count) {
+        this.apiKeyId = apiKeyId;
+        this.epochDay = epochDay;
+        this.count = count;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyDailyUsageId.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyDailyUsageId.java
new file mode 100644
index 0000000000..77bbbf43f1
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/model/ApiKeyDailyUsageId.java
@@ -0,0 +1,36 @@
+package stirling.software.proprietary.security.model;
+
+import java.io.Serializable;
+import java.util.Objects;
+
+/** Composite key for {@link ApiKeyDailyUsage}: one row per key per UTC day. */
+public class ApiKeyDailyUsageId implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    private Long apiKeyId;
+    private long epochDay;
+
+    public ApiKeyDailyUsageId() {}
+
+    public ApiKeyDailyUsageId(Long apiKeyId, long epochDay) {
+        this.apiKeyId = apiKeyId;
+        this.epochDay = epochDay;
+    }
+
+    @Override
+    public boolean equals(Object o) {
+        if (this == o) {
+            return true;
+        }
+        if (!(o instanceof ApiKeyDailyUsageId other)) {
+            return false;
+        }
+        return epochDay == other.epochDay && Objects.equals(apiKeyId, other.apiKeyId);
+    }
+
+    @Override
+    public int hashCode() {
+        return Objects.hash(apiKeyId, epochDay);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyDailyUsageRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyDailyUsageRepository.java
new file mode 100644
index 0000000000..4db1dd34b8
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyDailyUsageRepository.java
@@ -0,0 +1,55 @@
+package stirling.software.proprietary.security.repository;
+
+import java.util.Collection;
+import java.util.List;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Modifying;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+
+import stirling.software.proprietary.security.model.ApiKeyDailyUsage;
+import stirling.software.proprietary.security.model.ApiKeyDailyUsageId;
+
+@Repository
+public interface ApiKeyDailyUsageRepository
+        extends JpaRepository<ApiKeyDailyUsage, ApiKeyDailyUsageId> {
+
+    /** Atomically bump today's tally; returns 0 when no row exists yet (caller then inserts). */
+    @Modifying
+    @Query(
+            "UPDATE ApiKeyDailyUsage u SET u.count = u.count + 1 "
+                    + "WHERE u.apiKeyId = :apiKeyId AND u.epochDay = :epochDay")
+    int incrementIfPresent(@Param("apiKeyId") Long apiKeyId, @Param("epochDay") long epochDay);
+
+    @Query(
+            "SELECT COALESCE(SUM(u.count), 0) FROM ApiKeyDailyUsage u "
+                    + "WHERE u.apiKeyId = :apiKeyId AND u.epochDay >= :fromDayInclusive")
+    long sumSince(
+            @Param("apiKeyId") Long apiKeyId, @Param("fromDayInclusive") long fromDayInclusive);
+
+    @Query(
+            "SELECT u.count FROM ApiKeyDailyUsage u "
+                    + "WHERE u.apiKeyId = :apiKeyId AND u.epochDay = :epochDay")
+    Long countForDay(@Param("apiKeyId") Long apiKeyId, @Param("epochDay") long epochDay);
+
+    /** Batched today-count for many keys in one query (avoids N+1 when listing keys). */
+    @Query(
+            "SELECT u.apiKeyId AS apiKeyId, u.count AS total FROM ApiKeyDailyUsage u "
+                    + "WHERE u.apiKeyId IN :ids AND u.epochDay = :epochDay")
+    List<ApiKeyUsageSum> countForDayByIds(
+            @Param("ids") Collection<Long> ids, @Param("epochDay") long epochDay);
+
+    /** Batched trailing-window sum for many keys in one query. */
+    @Query(
+            "SELECT u.apiKeyId AS apiKeyId, SUM(u.count) AS total FROM ApiKeyDailyUsage u "
+                    + "WHERE u.apiKeyId IN :ids AND u.epochDay >= :fromDayInclusive "
+                    + "GROUP BY u.apiKeyId")
+    List<ApiKeyUsageSum> sumSinceByIds(
+            @Param("ids") Collection<Long> ids, @Param("fromDayInclusive") long fromDayInclusive);
+
+    void deleteByApiKeyId(Long apiKeyId);
+
+    List<ApiKeyDailyUsage> findByApiKeyId(Long apiKeyId);
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyRepository.java
new file mode 100644
index 0000000000..62e2cc1408
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyRepository.java
@@ -0,0 +1,19 @@
+package stirling.software.proprietary.security.repository;
+
+import java.util.List;
+import java.util.Optional;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+import stirling.software.proprietary.security.model.ApiKey;
+
+@Repository
+public interface ApiKeyRepository extends JpaRepository<ApiKey, Long> {
+
+    Optional<ApiKey> findByKeyHash(String keyHash);
+
+    boolean existsByKeyHash(String keyHash);
+
+    List<ApiKey> findByOwnerUserIdOrderByCreatedAtDesc(Long ownerUserId);
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyUsageSum.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyUsageSum.java
new file mode 100644
index 0000000000..bff5b9304c
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/repository/ApiKeyUsageSum.java
@@ -0,0 +1,8 @@
+package stirling.software.proprietary.security.repository;
+
+/** Projection: a key id and a usage total, for batching per-key usage into one query. */
+public interface ApiKeyUsageSum {
+    Long getApiKeyId();
+
+    Long getTotal();
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyAuthenticationService.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyAuthenticationService.java
new file mode 100644
index 0000000000..ab223f929b
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyAuthenticationService.java
@@ -0,0 +1,107 @@
+package stirling.software.proprietary.security.service;
+
+import java.time.Instant;
+import java.util.Collection;
+import java.util.Optional;
+
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.ApiKey;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.ApiKeyRepository;
+
+/**
+ * Resolves an incoming {@code X-API-KEY} to its owning user and records per-key usage. Depends only
+ * on repositories (never {@code UserService}) so {@code UserService} can delegate here without a
+ * bean cycle.
+ *
+ * <p>Resolution order: the multi-key {@code api_keys} table first (by hash), then the legacy
+ * per-user {@code users.apiKey} column. Legacy keys therefore keep working unchanged. Every key is
+ * personal and authenticates as its owner with the owner's authorities.
+ */
+@Service
+@RequiredArgsConstructor
+public class ApiKeyAuthenticationService {
+
+    /**
+     * MDC key that carries the resolved key's label into audit events so the processor's Documents
+     * feed can attribute a document to the specific key. Set by the auth filters (both flavors),
+     * read by {@code CustomAuditEventRepository}.
+     */
+    public static final String AUDIT_LABEL_MDC_KEY = "apiKeyLabel";
+
+    private final ApiKeyRepository apiKeyRepository;
+    private final ApiKeyUsageRecorder usageRecorder;
+    private final UserRepository userRepository;
+
+    /** The user a raw key authenticates as, or empty if it matches no active key. */
+    public Optional<User> resolveUser(String rawKey) {
+        return authenticate(rawKey).map(ApiKeyAuthentication::user);
+    }
+
+    /**
+     * Resolve a raw key, recording usage as a side effect. Returns the owning user, a display label
+     * for the resolved key ({@code null} for the legacy per-user key), and the owner's authorities.
+     */
+    public Optional<ApiKeyAuthentication> authenticate(String rawKey) {
+        if (rawKey == null || rawKey.isBlank()) {
+            return Optional.empty();
+        }
+
+        ApiKey key = apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(rawKey)).orElse(null);
+        if (key != null) {
+            if (!key.isActive()) {
+                return Optional.empty();
+            }
+            User owner = userRepository.findById(key.getOwnerUserId()).orElse(null);
+            if (owner == null || !owner.isEnabled()) {
+                return Optional.empty();
+            }
+            usageRecorder.record(key.getId());
+            return Optional.of(
+                    new ApiKeyAuthentication(owner, auditLabel(key), owner.getAuthorities()));
+        }
+
+        // Legacy single per-user key: keep working, always a personal key for its user.
+        return userRepository
+                .findByApiKey(rawKey)
+                .filter(User::isEnabled)
+                .map(user -> new ApiKeyAuthentication(user, null, user.getAuthorities()));
+    }
+
+    /** "Production ingest (sk_a1b2c3d4)" - shown against API-sourced docs in the processor feed. */
+    private static String auditLabel(ApiKey key) {
+        return key.getName() + " (" + key.getPrefix() + ")";
+    }
+
+    /**
+     * Revoke the {@code api_keys} row that mirrors a given raw key, if any. Called when the legacy
+     * per-user key is rotated so the migrated shadow row can't keep authenticating the old secret.
+     */
+    @Transactional
+    public void revokeMigratedKey(String rawKey) {
+        if (rawKey == null || rawKey.isBlank()) {
+            return;
+        }
+        apiKeyRepository
+                .findByKeyHash(ApiKeyHasher.hash(rawKey))
+                .filter(ApiKey::isActive)
+                .ifPresent(
+                        k -> {
+                            k.setEnabled(false);
+                            k.setRevokedAt(Instant.now());
+                            apiKeyRepository.save(k);
+                        });
+    }
+
+    /**
+     * A resolved key: the user, an optional processor-feed label, and the authorities to run as.
+     */
+    public record ApiKeyAuthentication(
+            User user, String auditLabel, Collection<? extends GrantedAuthority> authorities) {}
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyHasher.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyHasher.java
new file mode 100644
index 0000000000..3807781036
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyHasher.java
@@ -0,0 +1,50 @@
+package stirling.software.proprietary.security.service;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.security.SecureRandom;
+import java.util.HexFormat;
+
+/** Generates opaque API-key secrets and hashes them for storage/lookup. */
+public final class ApiKeyHasher {
+
+    /** Human-recognisable prefix so a leaked string is identifiable as a Stirling API key. */
+    public static final String KEY_PREFIX = "sk_";
+
+    /** Chars of the raw key kept for non-secret display (includes the {@code sk_} prefix). */
+    private static final int DISPLAY_PREFIX_LENGTH = 11;
+
+    private static final SecureRandom RANDOM = new SecureRandom();
+
+    private ApiKeyHasher() {}
+
+    /** A fresh opaque secret: {@code sk_} followed by 40 hex chars of cryptographic randomness. */
+    public static String generateRawKey() {
+        byte[] bytes = new byte[20];
+        RANDOM.nextBytes(bytes);
+        return KEY_PREFIX + HexFormat.of().formatHex(bytes);
+    }
+
+    /** SHA-256 hex of a raw key; the value stored and looked up, never the raw key. */
+    public static String hash(String rawKey) {
+        try {
+            byte[] digest =
+                    MessageDigest.getInstance("SHA-256")
+                            .digest(rawKey.getBytes(StandardCharsets.UTF_8));
+            return HexFormat.of().formatHex(digest);
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException("SHA-256 unavailable", e);
+        }
+    }
+
+    /** Leading, non-secret fragment shown in listings (e.g. {@code sk_a1b2c3d4}). */
+    public static String displayPrefix(String rawKey) {
+        if (rawKey == null) {
+            return "";
+        }
+        return rawKey.length() <= DISPLAY_PREFIX_LENGTH
+                ? rawKey
+                : rawKey.substring(0, DISPLAY_PREFIX_LENGTH);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyLegacyMigrator.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyLegacyMigrator.java
new file mode 100644
index 0000000000..413c0c0d72
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyLegacyMigrator.java
@@ -0,0 +1,31 @@
+package stirling.software.proprietary.security.service;
+
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Propagation;
+import org.springframework.transaction.annotation.Transactional;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.security.model.ApiKey;
+import stirling.software.proprietary.security.repository.ApiKeyRepository;
+
+/**
+ * Inserts the shadow {@code api_keys} row that mirrors a user's legacy {@code users.apiKey} in its
+ * OWN ({@code REQUIRES_NEW}) transaction. Kept a separate bean so the write is isolated from the
+ * caller's listing transaction: when two concurrent first-loads race to insert the same hash, the
+ * loser's unique-key clash rolls back only this insert instead of poisoning the caller's
+ * transaction (on Postgres a failed statement aborts the whole transaction). The {@code
+ * DataIntegrityViolationException} is left to propagate so the caller can treat it as "already
+ * migrated".
+ */
+@Component
+@RequiredArgsConstructor
+class ApiKeyLegacyMigrator {
+
+    private final ApiKeyRepository apiKeyRepository;
+
+    @Transactional(propagation = Propagation.REQUIRES_NEW)
+    public void insertMigratedKey(ApiKey key) {
+        apiKeyRepository.saveAndFlush(key);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyManagementService.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyManagementService.java
new file mode 100644
index 0000000000..e30bce7845
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyManagementService.java
@@ -0,0 +1,235 @@
+package stirling.software.proprietary.security.service;
+
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.dao.DataIntegrityViolationException;
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+import org.springframework.web.server.ResponseStatusException;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.model.api.apikey.CreateApiKeyRequest;
+import stirling.software.proprietary.model.api.apikey.CreatedApiKeyDto;
+import stirling.software.proprietary.model.api.apikey.PortalApiKeyDto;
+import stirling.software.proprietary.model.api.apikey.PortalApiKeysResponse;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.ApiKey;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.ApiKeyDailyUsageRepository;
+import stirling.software.proprietary.security.repository.ApiKeyRepository;
+
+/**
+ * Portal-facing CRUD for named, personal API keys: lists, creates, and revokes the caller's own
+ * keys. Every key belongs to exactly one user and authenticates as that user; there is no sharing.
+ *
+ * <p>Every pre-existing single {@code users.apiKey} is lazily represented as a key owned by that
+ * user, so historic keys list uniformly.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class ApiKeyManagementService {
+
+    private static final DateTimeFormatter CREATED_FORMAT =
+            DateTimeFormatter.ofPattern("yyyy-MM-dd").withZone(ZoneOffset.UTC);
+    private static final DateTimeFormatter LAST_USED_FORMAT =
+            DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm").withZone(ZoneOffset.UTC);
+    private static final int MONTH_WINDOW_DAYS = 30;
+
+    /** Bounds a key name so it can't bloat storage or the audit/processor feed. */
+    private static final int MAX_NAME_LENGTH = 100;
+
+    /** Caps active keys per user so key creation can't be used to multiply rate-limit budget. */
+    private static final int MAX_ACTIVE_KEYS_PER_USER = 50;
+
+    private final ApiKeyRepository apiKeyRepository;
+    private final ApiKeyDailyUsageRepository usageRepository;
+    private final UserRepository userRepository;
+    private final UserService userService;
+    private final ApiKeyLegacyMigrator legacyMigrator;
+
+    /** All keys the caller owns. */
+    @Transactional
+    public PortalApiKeysResponse listVisibleKeys() {
+        User caller = requireCaller();
+        migrateLegacyKey(caller);
+
+        List<ApiKey> visible =
+                apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(caller.getId());
+
+        // Batch usage for all keys into three queries rather than two-per-key (avoids N+1).
+        long today = Instant.now().atZone(ZoneOffset.UTC).toLocalDate().toEpochDay();
+        List<Long> ids = visible.stream().map(ApiKey::getId).toList();
+        Map<Long, Long> todayById = new HashMap<>();
+        Map<Long, Long> monthById = new HashMap<>();
+        Map<Long, Long> totalById = new HashMap<>();
+        if (!ids.isEmpty()) {
+            usageRepository
+                    .countForDayByIds(ids, today)
+                    .forEach(r -> todayById.put(r.getApiKeyId(), r.getTotal()));
+            usageRepository
+                    .sumSinceByIds(ids, today - (MONTH_WINDOW_DAYS - 1))
+                    .forEach(r -> monthById.put(r.getApiKeyId(), r.getTotal()));
+            usageRepository
+                    .sumSinceByIds(ids, Long.MIN_VALUE)
+                    .forEach(r -> totalById.put(r.getApiKeyId(), r.getTotal()));
+        }
+
+        List<PortalApiKeyDto> keys =
+                visible.stream()
+                        .map(
+                                k ->
+                                        toDto(
+                                                k,
+                                                zeroIfNull(todayById.get(k.getId())),
+                                                zeroIfNull(monthById.get(k.getId())),
+                                                zeroIfNull(totalById.get(k.getId()))))
+                        .toList();
+        return PortalApiKeysResponse.builder().keys(keys).build();
+    }
+
+    private static long zeroIfNull(Long value) {
+        return value == null ? 0L : value;
+    }
+
+    /** Create a personal key and return its one-time secret. */
+    @Transactional
+    public CreatedApiKeyDto createKey(CreateApiKeyRequest request) {
+        User caller = requireCaller();
+        String name = request == null ? null : request.name();
+        if (name == null || name.isBlank()) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "Key name is required");
+        }
+        if (name.trim().length() > MAX_NAME_LENGTH) {
+            throw new ResponseStatusException(
+                    HttpStatus.BAD_REQUEST,
+                    "Key name must be " + MAX_NAME_LENGTH + " characters or fewer");
+        }
+        long activeOwned =
+                apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(caller.getId()).stream()
+                        .filter(ApiKey::isActive)
+                        .count();
+        if (activeOwned >= MAX_ACTIVE_KEYS_PER_USER) {
+            throw new ResponseStatusException(
+                    HttpStatus.TOO_MANY_REQUESTS,
+                    "You have reached the maximum of "
+                            + MAX_ACTIVE_KEYS_PER_USER
+                            + " active API keys; revoke one before creating another");
+        }
+
+        String rawKey = ApiKeyHasher.generateRawKey();
+        ApiKey saved =
+                apiKeyRepository.save(
+                        ApiKey.builder()
+                                .name(name.trim())
+                                .keyHash(ApiKeyHasher.hash(rawKey))
+                                .prefix(ApiKeyHasher.displayPrefix(rawKey))
+                                .ownerUserId(caller.getId())
+                                .enabled(true)
+                                .createdAt(Instant.now())
+                                .build());
+
+        return CreatedApiKeyDto.builder().key(toDto(saved, 0L, 0L, 0L)).secret(rawKey).build();
+    }
+
+    /** Soft-revoke a key the caller owns; also clears the legacy column if it is that key. */
+    @Transactional
+    public void revokeKey(Long id) {
+        User caller = requireCaller();
+        ApiKey key =
+                apiKeyRepository
+                        .findById(id)
+                        .orElseThrow(
+                                () -> new ResponseStatusException(HttpStatus.NOT_FOUND, "No key"));
+        if (!key.getOwnerUserId().equals(caller.getId())) {
+            // Not-found rather than forbidden so a caller can't probe other users' key ids.
+            throw new ResponseStatusException(HttpStatus.NOT_FOUND, "No key");
+        }
+        key.setEnabled(false);
+        key.setRevokedAt(Instant.now());
+        apiKeyRepository.save(key);
+        clearLegacyColumnIfMatches(key);
+    }
+
+    /** Represent a user's pre-existing single key as a row so it lists uniformly. */
+    private void migrateLegacyKey(User user) {
+        String legacy = user.getApiKey();
+        if (legacy == null || legacy.isBlank()) {
+            return;
+        }
+        String hash = ApiKeyHasher.hash(legacy);
+        if (apiKeyRepository.existsByKeyHash(hash)) {
+            return;
+        }
+        try {
+            // Insert in its own transaction so a concurrent-insert clash can't poison this
+            // listing transaction (see ApiKeyLegacyMigrator).
+            legacyMigrator.insertMigratedKey(
+                    ApiKey.builder()
+                            .name("Default key")
+                            .keyHash(hash)
+                            .prefix(ApiKeyHasher.displayPrefix(legacy))
+                            .ownerUserId(user.getId())
+                            .enabled(true)
+                            .createdAt(Instant.now())
+                            .build());
+        } catch (DataIntegrityViolationException alreadyMigrated) {
+            // A concurrent first-load won the race and inserted the same hash; that's fine.
+            log.debug("Legacy key already migrated concurrently for user {}", user.getId());
+        }
+    }
+
+    /**
+     * If a revoked key is the owner's legacy {@code users.apiKey}, null it so it stops resolving.
+     */
+    private void clearLegacyColumnIfMatches(ApiKey key) {
+        userRepository
+                .findById(key.getOwnerUserId())
+                .ifPresent(
+                        owner -> {
+                            String legacy = owner.getApiKey();
+                            if (legacy != null
+                                    && ApiKeyHasher.hash(legacy).equals(key.getKeyHash())) {
+                                owner.setApiKey(null);
+                                userRepository.save(owner);
+                            }
+                        });
+    }
+
+    private PortalApiKeyDto toDto(ApiKey key, long usageToday, long usageMonth, long usageTotal) {
+        return PortalApiKeyDto.builder()
+                .id(String.valueOf(key.getId()))
+                .name(key.getName())
+                .prefix(key.getPrefix())
+                .created(
+                        key.getCreatedAt() == null ? "" : CREATED_FORMAT.format(key.getCreatedAt()))
+                .lastUsed(
+                        key.getLastUsedAt() == null
+                                ? "Never"
+                                : LAST_USED_FORMAT.format(key.getLastUsedAt()))
+                .status(key.isActive() ? "active" : "revoked")
+                .usageToday(usageToday)
+                .usageMonth(usageMonth)
+                .usageTotal(usageTotal)
+                .build();
+    }
+
+    private User requireCaller() {
+        String username = userService.getCurrentUsername();
+        if (username == null || username.isBlank() || "anonymousUser".equalsIgnoreCase(username)) {
+            throw new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Not authenticated");
+        }
+        return userService
+                .findByUsernameIgnoreCase(username)
+                .orElseThrow(
+                        () -> new ResponseStatusException(HttpStatus.UNAUTHORIZED, "Unknown user"));
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyUsageRecorder.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyUsageRecorder.java
new file mode 100644
index 0000000000..5f36678e22
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyUsageRecorder.java
@@ -0,0 +1,60 @@
+package stirling.software.proprietary.security.service;
+
+import java.time.Instant;
+import java.time.ZoneOffset;
+
+import org.springframework.scheduling.annotation.Async;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Records per-key usage off the request thread. Kept a separate bean so the {@code @Async} proxy is
+ * honoured (a self-invocation from the resolver would run inline). Best-effort: never fails a
+ * request. The actual writes go through {@link ApiKeyUsageWriter} so each step commits in its own
+ * transaction and a first-write race can't drop a count.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class ApiKeyUsageRecorder {
+
+    private final ApiKeyUsageWriter writer;
+
+    /** Bump today's tally for the key and stamp last-used. */
+    @Async("auditExecutor")
+    public void record(Long apiKeyId) {
+        if (apiKeyId == null) {
+            return;
+        }
+        try {
+            long epochDay = Instant.now().atZone(ZoneOffset.UTC).toLocalDate().toEpochDay();
+            // First writer of the day inserts the row; everyone else (and the loser of an insert
+            // race) increments. Separate transactions mean a unique-key clash never rolls back an
+            // already-counted request.
+            if (writer.increment(apiKeyId, epochDay) == 0
+                    && !firstUseInserted(apiKeyId, epochDay)) {
+                writer.increment(apiKeyId, epochDay);
+            }
+            writer.stampLastUsed(apiKeyId);
+        } catch (Exception e) {
+            log.debug("Failed to record API key usage for id={}", apiKeyId, e);
+        }
+    }
+
+    /**
+     * Whether we inserted the day's first row. A lost insert race can surface either as a {@code
+     * false} return or - when the failed flush marked the REQUIRES_NEW transaction rollback-only,
+     * so its commit throws - as an exception; both mean "someone else inserted", so we treat any
+     * failure as not-inserted and let the caller fall back to an increment rather than dropping the
+     * count.
+     */
+    private boolean firstUseInserted(Long apiKeyId, long epochDay) {
+        try {
+            return writer.tryInsertFirstUse(apiKeyId, epochDay);
+        } catch (RuntimeException raced) {
+            return false;
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyUsageWriter.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyUsageWriter.java
new file mode 100644
index 0000000000..94bec676d7
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/ApiKeyUsageWriter.java
@@ -0,0 +1,59 @@
+package stirling.software.proprietary.security.service;
+
+import java.time.Instant;
+
+import org.springframework.dao.DataIntegrityViolationException;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.annotation.Propagation;
+import org.springframework.transaction.annotation.Transactional;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.security.model.ApiKeyDailyUsage;
+import stirling.software.proprietary.security.repository.ApiKeyDailyUsageRepository;
+import stirling.software.proprietary.security.repository.ApiKeyRepository;
+
+/**
+ * Per-step transactional writes for {@link ApiKeyUsageRecorder}. Each method runs in its own
+ * ({@code REQUIRES_NEW}) transaction so a unique-key clash when two requests race to insert the
+ * day's first row rolls back only that failed insert - never an already-counted request or the
+ * last-used stamp.
+ */
+@Component
+@RequiredArgsConstructor
+class ApiKeyUsageWriter {
+
+    private final ApiKeyRepository apiKeyRepository;
+    private final ApiKeyDailyUsageRepository usageRepository;
+
+    /** Bump today's tally if the row already exists; returns rows updated (0 if none yet). */
+    @Transactional(propagation = Propagation.REQUIRES_NEW)
+    public int increment(Long apiKeyId, long epochDay) {
+        return usageRepository.incrementIfPresent(apiKeyId, epochDay);
+    }
+
+    /**
+     * Insert today's row with a count of 1. Flushes so a concurrent first-write's unique-key clash
+     * surfaces here (returning false) instead of at commit; the caller then increments instead.
+     */
+    @Transactional(propagation = Propagation.REQUIRES_NEW)
+    public boolean tryInsertFirstUse(Long apiKeyId, long epochDay) {
+        try {
+            usageRepository.saveAndFlush(new ApiKeyDailyUsage(apiKeyId, epochDay, 1));
+            return true;
+        } catch (DataIntegrityViolationException raced) {
+            return false;
+        }
+    }
+
+    @Transactional(propagation = Propagation.REQUIRES_NEW)
+    public void stampLastUsed(Long apiKeyId) {
+        apiKeyRepository
+                .findById(apiKeyId)
+                .ifPresent(
+                        key -> {
+                            key.setLastUsedAt(Instant.now());
+                            apiKeyRepository.save(key);
+                        });
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/UserService.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/UserService.java
index 45532978f3..0cb4653ef1 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/service/UserService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/service/UserService.java
@@ -95,6 +95,7 @@ public class UserService implements UserServiceInterface {
     private final ResourceGrantRepository resourceGrantRepository;
     private final IntegrationConfigRepository integrationConfigRepository;
     private final TeamMembershipService teamMembershipService;
+    private final ApiKeyAuthenticationService apiKeyAuthenticationService;
 
     @Transactional
     public void processSSOPostLogin(
@@ -147,15 +148,16 @@ public class UserService implements UserServiceInterface {
     }
 
     public Authentication getAuthentication(String apiKey) {
-        Optional<User> user = getUserByApiKey(apiKey);
-        if (user.isEmpty()) {
-            throw new UsernameNotFoundException("API key is not valid");
-        }
-        // Convert the user into an Authentication object
-        return new UsernamePasswordAuthenticationToken( // principal (typically the user)
-                user, // credentials (we don't expose the password or API key here)
-                null, // user's authorities (roles/permissions)
-                getAuthorities(user.get()));
+        // Resolve through the shared service (multi-key table, then the legacy per-user column).
+        // The key runs as its owner with the owner's authorities.
+        var resolved =
+                apiKeyAuthenticationService
+                        .authenticate(apiKey)
+                        .orElseThrow(() -> new UsernameNotFoundException("API key is not valid"));
+        return new UsernamePasswordAuthenticationToken(
+                resolved.user(), // principal
+                null, // credentials (we don't expose the password or API key here)
+                resolved.authorities()); // the owner's authorities
     }
 
     private Collection<? extends GrantedAuthority> getAuthorities(User user) {
@@ -173,6 +175,9 @@ public class UserService implements UserServiceInterface {
 
     public User addApiKeyToUser(String username) {
         Optional<User> userOpt = findByUsernameIgnoreCase(username);
+        // Rotating/regenerating the legacy key must also revoke its migrated api_keys shadow row,
+        // otherwise the old secret keeps authenticating (it resolves from api_keys first).
+        userOpt.map(User::getApiKey).ifPresent(apiKeyAuthenticationService::revokeMigratedKey);
         User user = saveUser(userOpt, generateApiKey());
         try {
             databaseService.exportDatabase();
@@ -220,7 +225,8 @@ public class UserService implements UserServiceInterface {
     }
 
     public Optional<User> getUserByApiKey(String apiKey) {
-        return userRepository.findByApiKey(apiKey);
+        // Resolves the multi-key api_keys table first, then the legacy per-user column.
+        return apiKeyAuthenticationService.resolveUser(apiKey);
     }
 
     public Optional<User> loadUserByApiKey(String apiKey) {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalDocumentsService.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalDocumentsService.java
index fcae36f61b..3e519da5ed 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalDocumentsService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/PortalDocumentsService.java
@@ -65,12 +65,13 @@ public class PortalDocumentsService {
             // "API". The automation marker distinguishes a policy-run step from real API traffic.
             boolean automation = isAutomation(data);
             String policyName = asString(data.get("policyName"));
+            String origin = asString(data.get("__origin"));
             String source =
                     automation
                             ? (policyName != null && !policyName.isBlank()
                                     ? "Policy: " + policyName
                                     : "Policy automation")
-                            : sourceLabel(asString(data.get("__origin")));
+                            : sourceLabel(origin, asString(data.get("__apiKeyLabel")));
             String product = automation ? "Automation" : productLabel(source);
             String action = prettyTool(path);
             boolean failed = isFailure(data);
@@ -173,9 +174,12 @@ public class PortalDocumentsService {
         return code instanceof Number n && n.intValue() >= 400;
     }
 
-    private static String sourceLabel(String origin) {
+    private static String sourceLabel(String origin, String apiKeyLabel) {
         if ("API".equals(origin)) {
-            return "API integration";
+            // Attribute to the specific named key when known, else the generic API channel.
+            return apiKeyLabel != null && !apiKeyLabel.isBlank()
+                    ? "API key · " + apiKeyLabel
+                    : "API integration";
         }
         if ("SYSTEM".equals(origin)) {
             return "System";
@@ -184,7 +188,8 @@ public class PortalDocumentsService {
     }
 
     private static String productLabel(String source) {
-        return "API integration".equals(source) ? "API" : "Editor";
+        // Covers both the generic "API integration" and per-key "API key · <label>" sources.
+        return source != null && source.startsWith("API") ? "API" : "Editor";
     }
 
     private static boolean isAutomation(Map<String, Object> data) {
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/configuration/SecurityConfigurationTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/configuration/SecurityConfigurationTest.java
index 50d522c056..fe2bf8e948 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/security/configuration/SecurityConfigurationTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/configuration/SecurityConfigurationTest.java
@@ -29,6 +29,7 @@ import stirling.software.proprietary.security.database.repository.PersistentLogi
 import stirling.software.proprietary.security.filter.IPRateLimitingFilter;
 import stirling.software.proprietary.security.filter.JwtAuthenticationFilter;
 import stirling.software.proprietary.security.filter.UserAuthenticationFilter;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
 import stirling.software.proprietary.security.service.CustomUserDetailsService;
 import stirling.software.proprietary.security.service.JwtServiceInterface;
 import stirling.software.proprietary.security.service.LoginAttemptService;
@@ -160,7 +161,9 @@ class SecurityConfigurationTest {
         @Test
         @DisplayName("jwtAuthenticationFilter is created")
         void jwtAuthenticationFilter() {
-            JwtAuthenticationFilter filter = newConfig(true).jwtAuthenticationFilter();
+            JwtAuthenticationFilter filter =
+                    newConfig(true)
+                            .jwtAuthenticationFilter(mock(ApiKeyAuthenticationService.class));
             assertThat(filter).isNotNull();
         }
 
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/filter/UserAuthenticationFilterTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/filter/UserAuthenticationFilterTest.java
index c1900ce908..df87c30e1b 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/security/filter/UserAuthenticationFilterTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/filter/UserAuthenticationFilterTest.java
@@ -29,6 +29,8 @@ import org.springframework.security.core.session.SessionInformation;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService.ApiKeyAuthentication;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 
@@ -37,6 +39,7 @@ import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 class UserAuthenticationFilterTest {
 
     @Mock private UserService userService;
+    @Mock private ApiKeyAuthenticationService apiKeyAuthenticationService;
     @Mock private SessionPersistentRegistry sessionPersistentRegistry;
 
     private ApplicationProperties.Security securityProp;
@@ -60,7 +63,11 @@ class UserAuthenticationFilterTest {
 
     private UserAuthenticationFilter filter(boolean loginEnabled) {
         return new UserAuthenticationFilter(
-                securityProp, userService, sessionPersistentRegistry, loginEnabled);
+                securityProp,
+                userService,
+                apiKeyAuthenticationService,
+                sessionPersistentRegistry,
+                loginEnabled);
     }
 
     private static User enabledUser(String username) {
@@ -99,7 +106,11 @@ class UserAuthenticationFilterTest {
             User user = enabledUser("api-user");
             user.addAuthority(
                     new stirling.software.proprietary.security.model.Authority("ROLE_USER", user));
-            when(userService.getUserByApiKey("good-key")).thenReturn(Optional.of(user));
+            when(apiKeyAuthenticationService.authenticate("good-key"))
+                    .thenReturn(
+                            Optional.of(
+                                    new ApiKeyAuthentication(
+                                            user, "Prod (sk_demo0000)", user.getAuthorities())));
             when(userService.usernameExistsIgnoreCase("api-user")).thenReturn(true);
             when(userService.isUserDisabled("api-user")).thenReturn(false);
             when(sessionPersistentRegistry.getAllSessions(any(), anyBoolean()))
@@ -117,7 +128,7 @@ class UserAuthenticationFilterTest {
         void invalidApiKeyRejected() throws Exception {
             request.setRequestURI("/api/v1/some/protected");
             request.addHeader("X-API-KEY", "bad-key");
-            when(userService.getUserByApiKey("bad-key")).thenReturn(Optional.empty());
+            when(apiKeyAuthenticationService.authenticate("bad-key")).thenReturn(Optional.empty());
 
             filter(true).doFilter(request, response, filterChain);
 
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilterTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilterTest.java
new file mode 100644
index 0000000000..69bc910701
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/filter/UserBasedRateLimitingFilterTest.java
@@ -0,0 +1,95 @@
+package stirling.software.proprietary.security.filter;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.util.List;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.mock.web.MockFilterChain;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
+import stirling.software.proprietary.security.model.User;
+
+@ExtendWith(MockitoExtension.class)
+@DisplayName("UserBasedRateLimitingFilter")
+class UserBasedRateLimitingFilterTest {
+
+    @AfterEach
+    void clear() {
+        SecurityContextHolder.clearContext();
+    }
+
+    private void authenticateAs(String username) {
+        User u = new User();
+        u.setUsername(username);
+        u.setEnabled(true);
+        SecurityContextHolder.getContext()
+                .setAuthentication(
+                        new ApiKeyAuthenticationToken(
+                                u,
+                                "irrelevant",
+                                List.of(new SimpleGrantedAuthority(Role.USER.getRoleId()))));
+    }
+
+    private long remainingAfterApiPost(UserBasedRateLimitingFilter filter, String apiKey)
+            throws Exception {
+        MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/v1/general/x");
+        req.addHeader("X-API-KEY", apiKey);
+        MockHttpServletResponse res = new MockHttpServletResponse();
+        filter.doFilter(req, res, new MockFilterChain());
+        return Long.parseLong(res.getHeader("X-Rate-Limit-Remaining"));
+    }
+
+    @Test
+    @DisplayName("all of a user's keys share ONE bucket - minting keys can't multiply the quota")
+    void keysShareOnePerUserBucket() throws Exception {
+        UserBasedRateLimitingFilter filter = new UserBasedRateLimitingFilter(true);
+        authenticateAs("alice");
+
+        long afterKeyA = remainingAfterApiPost(filter, "key-A");
+        long afterKeyB = remainingAfterApiPost(filter, "key-B"); // different key, same user
+
+        // The second (different) key drew from the SAME per-user bucket, so remaining fell by one.
+        // If it were keyed per-API-key, both would report the same remaining.
+        assertThat(afterKeyB).isEqualTo(afterKeyA - 1);
+    }
+
+    @Test
+    @DisplayName("non-POST requests are not rate limited")
+    void nonPostPassesThrough() throws Exception {
+        UserBasedRateLimitingFilter filter = new UserBasedRateLimitingFilter(true);
+        authenticateAs("alice");
+        MockHttpServletRequest req = new MockHttpServletRequest("GET", "/api/v1/general/x");
+        req.addHeader("X-API-KEY", "key-A");
+        MockHttpServletResponse res = new MockHttpServletResponse();
+        MockFilterChain chain = new MockFilterChain();
+
+        filter.doFilter(req, res, chain);
+
+        assertThat(res.getHeader("X-Rate-Limit-Remaining")).isNull();
+        assertThat(chain.getRequest()).isNotNull(); // passed down the chain
+    }
+
+    @Test
+    @DisplayName("rate limiting disabled: passes through untouched")
+    void disabledPassesThrough() throws Exception {
+        UserBasedRateLimitingFilter filter = new UserBasedRateLimitingFilter(false);
+        authenticateAs("alice");
+        MockHttpServletRequest req = new MockHttpServletRequest("POST", "/api/v1/general/x");
+        req.addHeader("X-API-KEY", "key-A");
+        MockHttpServletResponse res = new MockHttpServletResponse();
+
+        filter.doFilter(req, res, new MockFilterChain());
+
+        assertThat(res.getHeader("X-Rate-Limit-Remaining")).isNull();
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyAuthenticationServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyAuthenticationServiceTest.java
new file mode 100644
index 0000000000..5a7a5d910b
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyAuthenticationServiceTest.java
@@ -0,0 +1,148 @@
+package stirling.software.proprietary.security.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.security.core.GrantedAuthority;
+
+import stirling.software.common.model.enumeration.Role;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.ApiKey;
+import stirling.software.proprietary.security.model.Authority;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.ApiKeyRepository;
+
+@ExtendWith(MockitoExtension.class)
+@DisplayName("ApiKeyAuthenticationService")
+class ApiKeyAuthenticationServiceTest {
+
+    @Mock private ApiKeyRepository apiKeyRepository;
+    @Mock private ApiKeyUsageRecorder usageRecorder;
+    @Mock private UserRepository userRepository;
+    @InjectMocks private ApiKeyAuthenticationService service;
+
+    private User user(long id, boolean enabled) {
+        User u = new User();
+        u.setId(id);
+        u.setUsername("user" + id);
+        u.setEnabled(enabled);
+        return u;
+    }
+
+    private ApiKey key(long id, long ownerId, boolean enabled, Instant revoked) {
+        return ApiKey.builder()
+                .id(id)
+                .name("Production ingest")
+                .keyHash(ApiKeyHasher.hash("raw-" + id))
+                .prefix("sk_demo0000")
+                .ownerUserId(ownerId)
+                .enabled(enabled)
+                .revokedAt(revoked)
+                .createdAt(Instant.now())
+                .build();
+    }
+
+    @Test
+    @DisplayName("resolves an active multi-key to its owner and records usage")
+    void resolvesActiveKey() {
+        String raw = "raw-1";
+        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw)))
+                .thenReturn(Optional.of(key(1, 7, true, null)));
+        when(userRepository.findById(7L)).thenReturn(Optional.of(user(7, true)));
+
+        var result = service.authenticate(raw);
+
+        assertThat(result).isPresent();
+        assertThat(result.get().user().getId()).isEqualTo(7L);
+        assertThat(result.get().auditLabel()).isEqualTo("Production ingest (sk_demo0000)");
+        verify(usageRecorder).record(1L);
+    }
+
+    @Test
+    @DisplayName("rejects a revoked key without recording usage")
+    void rejectsRevokedKey() {
+        String raw = "raw-2";
+        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw)))
+                .thenReturn(Optional.of(key(2, 7, true, Instant.now())));
+
+        assertThat(service.authenticate(raw)).isEmpty();
+        verifyNoInteractions(usageRecorder);
+    }
+
+    @Test
+    @DisplayName("rejects a key whose owner is disabled")
+    void rejectsDisabledOwner() {
+        String raw = "raw-3";
+        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw)))
+                .thenReturn(Optional.of(key(3, 8, true, null)));
+        when(userRepository.findById(8L)).thenReturn(Optional.of(user(8, false)));
+
+        assertThat(service.authenticate(raw)).isEmpty();
+    }
+
+    @Test
+    @DisplayName("falls back to the legacy per-user column, with no per-key label")
+    void legacyFallback() {
+        String raw = "legacy-key";
+        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw))).thenReturn(Optional.empty());
+        when(userRepository.findByApiKey(raw)).thenReturn(Optional.of(user(9, true)));
+
+        var result = service.authenticate(raw);
+
+        assertThat(result).isPresent();
+        assertThat(result.get().user().getId()).isEqualTo(9L);
+        assertThat(result.get().auditLabel()).isNull();
+        verifyNoInteractions(usageRecorder);
+    }
+
+    @Test
+    @DisplayName("blank keys resolve to nothing")
+    void blankKey() {
+        assertThat(service.authenticate("  ")).isEmpty();
+        assertThat(service.resolveUser(null)).isEmpty();
+    }
+
+    @Test
+    @DisplayName("a key authenticates with its owner's authorities (owner acts as self)")
+    void keyKeepsOwnerAuthorities() {
+        String raw = "raw-6";
+        User owner = user(8, true);
+        owner.addAuthority(new Authority(Role.ADMIN.getRoleId(), owner));
+        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw)))
+                .thenReturn(Optional.of(key(6, 8, true, null)));
+        when(userRepository.findById(8L)).thenReturn(Optional.of(owner));
+
+        var result = service.authenticate(raw);
+
+        List<String> auths =
+                result.get().authorities().stream().map(GrantedAuthority::getAuthority).toList();
+        assertThat(auths).contains(Role.ADMIN.getRoleId());
+    }
+
+    @Test
+    @DisplayName("revokeMigratedKey disables the shadow row so a rotated legacy key stops working")
+    void revokeMigratedKeyRevokesRow() {
+        String raw = "raw-9";
+        ApiKey shadow = key(9, 1, true, null);
+        when(apiKeyRepository.findByKeyHash(ApiKeyHasher.hash(raw)))
+                .thenReturn(Optional.of(shadow));
+
+        service.revokeMigratedKey(raw);
+
+        assertThat(shadow.isEnabled()).isFalse();
+        assertThat(shadow.getRevokedAt()).isNotNull();
+        verify(apiKeyRepository).save(shadow);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyHasherTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyHasherTest.java
new file mode 100644
index 0000000000..ec7836a8af
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyHasherTest.java
@@ -0,0 +1,38 @@
+package stirling.software.proprietary.security.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+@DisplayName("ApiKeyHasher")
+class ApiKeyHasherTest {
+
+    @Test
+    @DisplayName("generated keys are unique, prefixed, and hash deterministically")
+    void generateAndHash() {
+        String a = ApiKeyHasher.generateRawKey();
+        String b = ApiKeyHasher.generateRawKey();
+
+        assertThat(a).startsWith("sk_").isNotEqualTo(b);
+        // Same input hashes the same; SHA-256 hex is 64 chars.
+        assertThat(ApiKeyHasher.hash(a)).isEqualTo(ApiKeyHasher.hash(a)).hasSize(64);
+        assertThat(ApiKeyHasher.hash(a)).isNotEqualTo(ApiKeyHasher.hash(b));
+    }
+
+    @Test
+    @DisplayName("hash never returns the raw key")
+    void hashHidesRaw() {
+        String raw = ApiKeyHasher.generateRawKey();
+        assertThat(ApiKeyHasher.hash(raw)).isNotEqualTo(raw);
+    }
+
+    @Test
+    @DisplayName("display prefix is a short non-secret leading fragment")
+    void displayPrefix() {
+        String raw = ApiKeyHasher.generateRawKey();
+        String prefix = ApiKeyHasher.displayPrefix(raw);
+        assertThat(prefix).hasSize(11).startsWith("sk_");
+        assertThat(raw).startsWith(prefix);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyManagementServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyManagementServiceTest.java
new file mode 100644
index 0000000000..e74452b114
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyManagementServiceTest.java
@@ -0,0 +1,198 @@
+package stirling.software.proprietary.security.service;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.Mockito.lenient;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.web.server.ResponseStatusException;
+
+import stirling.software.proprietary.model.api.apikey.CreateApiKeyRequest;
+import stirling.software.proprietary.model.api.apikey.CreatedApiKeyDto;
+import stirling.software.proprietary.model.api.apikey.PortalApiKeysResponse;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.ApiKey;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.repository.ApiKeyDailyUsageRepository;
+import stirling.software.proprietary.security.repository.ApiKeyRepository;
+
+@ExtendWith(MockitoExtension.class)
+@DisplayName("ApiKeyManagementService")
+class ApiKeyManagementServiceTest {
+
+    @Mock private ApiKeyRepository apiKeyRepository;
+    @Mock private ApiKeyDailyUsageRepository usageRepository;
+    @Mock private UserRepository userRepository;
+    @Mock private UserService userService;
+    @Mock private ApiKeyLegacyMigrator legacyMigrator;
+    @InjectMocks private ApiKeyManagementService service;
+
+    private User caller;
+
+    @BeforeEach
+    void setUp() {
+        caller = new User();
+        caller.setId(1L);
+        caller.setUsername("alice");
+        lenient().when(userService.getCurrentUsername()).thenReturn("alice");
+        lenient()
+                .when(userService.findByUsernameIgnoreCase("alice"))
+                .thenReturn(Optional.of(caller));
+        lenient().when(apiKeyRepository.save(any())).thenAnswer(inv -> inv.getArgument(0));
+        lenient().when(usageRepository.countForDayByIds(any(), anyLong())).thenReturn(List.of());
+        lenient().when(usageRepository.sumSinceByIds(any(), anyLong())).thenReturn(List.of());
+    }
+
+    private ApiKey personalKey(long id, long ownerId) {
+        return ApiKey.builder()
+                .id(id)
+                .name("Key " + id)
+                .keyHash("hash" + id)
+                .prefix("sk_demo0000")
+                .ownerUserId(ownerId)
+                .enabled(true)
+                .createdAt(Instant.now())
+                .build();
+    }
+
+    // ---- migration safety ---------------------------------------------------
+
+    @Test
+    @DisplayName("an existing legacy key migrates to an owner-only row")
+    void legacyKeyMigratesAsPersonal() {
+        caller.setApiKey("legacy-raw-key");
+        when(apiKeyRepository.existsByKeyHash(ApiKeyHasher.hash("legacy-raw-key")))
+                .thenReturn(false);
+        when(apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(1L)).thenReturn(List.of());
+
+        service.listVisibleKeys();
+
+        // Migration insert is isolated in its own transaction (ApiKeyLegacyMigrator).
+        ArgumentCaptor<ApiKey> saved = ArgumentCaptor.forClass(ApiKey.class);
+        verify(legacyMigrator).insertMigratedKey(saved.capture());
+        ApiKey migrated = saved.getValue();
+        assertThat(migrated.getOwnerUserId()).isEqualTo(1L);
+    }
+
+    @Test
+    @DisplayName("migration is idempotent - an already-migrated legacy key is not re-saved")
+    void legacyKeyMigrationIdempotent() {
+        caller.setApiKey("legacy-raw-key");
+        when(apiKeyRepository.existsByKeyHash(ApiKeyHasher.hash("legacy-raw-key")))
+                .thenReturn(true);
+        when(apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(1L)).thenReturn(List.of());
+
+        service.listVisibleKeys();
+
+        verify(legacyMigrator, never()).insertMigratedKey(any());
+    }
+
+    // ---- personal isolation -------------------------------------------------
+
+    @Test
+    @DisplayName("listing scopes keys to the caller by owner id")
+    void personalKeysScopedToOwner() {
+        when(apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(1L))
+                .thenReturn(List.of(personalKey(10, 1L)));
+
+        PortalApiKeysResponse res = service.listVisibleKeys();
+
+        assertThat(res.keys()).singleElement().satisfies(k -> assertThat(k.id()).isEqualTo("10"));
+        // Isolation: the query is keyed by the caller's id, never a broad scan.
+        verify(apiKeyRepository).findByOwnerUserIdOrderByCreatedAtDesc(1L);
+    }
+
+    // ---- creation -----------------------------------------------------------
+
+    @Test
+    @DisplayName("a user creates a personal key and gets a one-time secret")
+    void createPersonalKey() {
+        CreatedApiKeyDto created = service.createKey(new CreateApiKeyRequest("My key"));
+
+        assertThat(created.secret()).startsWith("sk_");
+        ArgumentCaptor<ApiKey> saved = ArgumentCaptor.forClass(ApiKey.class);
+        verify(apiKeyRepository).save(saved.capture());
+        assertThat(saved.getValue().getOwnerUserId()).isEqualTo(1L);
+        assertThat(saved.getValue().getName()).isEqualTo("My key");
+    }
+
+    @Test
+    @DisplayName("rejects an over-long key name")
+    void rejectsLongName() {
+        String longName = "a".repeat(101);
+        assertThatThrownBy(() -> service.createKey(new CreateApiKeyRequest(longName)))
+                .isInstanceOf(ResponseStatusException.class)
+                .hasMessageContaining("characters or fewer");
+        verify(apiKeyRepository, never()).save(any());
+    }
+
+    @Test
+    @DisplayName("rejects a blank key name")
+    void rejectsBlankName() {
+        assertThatThrownBy(() -> service.createKey(new CreateApiKeyRequest("  ")))
+                .isInstanceOf(ResponseStatusException.class)
+                .hasMessageContaining("required");
+        verify(apiKeyRepository, never()).save(any());
+    }
+
+    @Test
+    @DisplayName("rejects creating a key past the per-user active-key cap")
+    void rejectsPastActiveKeyCap() {
+        when(apiKeyRepository.findByOwnerUserIdOrderByCreatedAtDesc(1L))
+                .thenReturn(java.util.Collections.nCopies(50, personalKey(100, 1L)));
+
+        assertThatThrownBy(() -> service.createKey(new CreateApiKeyRequest("One too many")))
+                .isInstanceOf(ResponseStatusException.class);
+        verify(apiKeyRepository, never()).save(any());
+    }
+
+    // ---- revocation ---------------------------------------------------------
+
+    @Test
+    @DisplayName("owner revokes their key and the legacy column is cleared")
+    void revokePersonalClearsLegacy() {
+        caller.setApiKey("legacy-raw-key");
+        ApiKey legacyRow = personalKey(30, 1L);
+        legacyRow.setKeyHash(ApiKeyHasher.hash("legacy-raw-key"));
+        when(apiKeyRepository.findById(30L)).thenReturn(Optional.of(legacyRow));
+        when(userRepository.findById(1L)).thenReturn(Optional.of(caller));
+
+        service.revokeKey(30L);
+
+        assertThat(legacyRow.isEnabled()).isFalse();
+        assertThat(legacyRow.getRevokedAt()).isNotNull();
+        assertThat(caller.getApiKey()).isNull();
+        verify(userRepository).save(caller);
+    }
+
+    @Test
+    @DisplayName(
+            "a non-owner cannot revoke someone else's key (404, not 403, so ids can't be probed)")
+    void revokeForeignKeyForbidden() {
+        when(apiKeyRepository.findById(31L)).thenReturn(Optional.of(personalKey(31, 999L)));
+
+        assertThatThrownBy(() -> service.revokeKey(31L))
+                .isInstanceOf(ResponseStatusException.class)
+                .satisfies(
+                        e ->
+                                assertThat(((ResponseStatusException) e).getStatusCode().value())
+                                        .isEqualTo(404));
+        verify(apiKeyRepository, never()).save(any());
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyUsageRecorderTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyUsageRecorderTest.java
new file mode 100644
index 0000000000..6a03414585
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/ApiKeyUsageRecorderTest.java
@@ -0,0 +1,88 @@
+package stirling.software.proprietary.security.service;
+
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+/**
+ * Unit tests for the increment/insert/increment race protocol. {@code @Async} has no proxy in a
+ * plain Mockito test, so {@code record()} runs inline and is directly testable.
+ */
+@ExtendWith(MockitoExtension.class)
+@DisplayName("ApiKeyUsageRecorder")
+class ApiKeyUsageRecorderTest {
+
+    private static final long KEY = 7L;
+
+    @Mock private ApiKeyUsageWriter writer;
+    @InjectMocks private ApiKeyUsageRecorder recorder;
+
+    @Test
+    @DisplayName("a null key id is a no-op")
+    void nullIdIsNoOp() {
+        recorder.record(null);
+        verifyNoInteractions(writer);
+    }
+
+    @Test
+    @DisplayName("row already exists: one increment, never inserts")
+    void rowExistsFastPath() {
+        when(writer.increment(eq(KEY), anyLong())).thenReturn(1);
+
+        recorder.record(KEY);
+
+        verify(writer, times(1)).increment(eq(KEY), anyLong());
+        verify(writer, never()).tryInsertFirstUse(anyLong(), anyLong());
+        verify(writer).stampLastUsed(KEY);
+    }
+
+    @Test
+    @DisplayName("first writer of the day: increment misses, insert wins, no second increment")
+    void firstWriterInserts() {
+        when(writer.increment(eq(KEY), anyLong())).thenReturn(0);
+        when(writer.tryInsertFirstUse(eq(KEY), anyLong())).thenReturn(true);
+
+        recorder.record(KEY);
+
+        verify(writer, times(1)).increment(eq(KEY), anyLong());
+        verify(writer).tryInsertFirstUse(eq(KEY), anyLong());
+        verify(writer).stampLastUsed(KEY);
+    }
+
+    @Test
+    @DisplayName(
+            "lost the insert race: falls back to a second increment so the count is not dropped")
+    void lostInsertRaceReincrements() {
+        when(writer.increment(eq(KEY), anyLong())).thenReturn(0);
+        when(writer.tryInsertFirstUse(eq(KEY), anyLong())).thenReturn(false);
+
+        recorder.record(KEY);
+
+        verify(writer, times(2)).increment(eq(KEY), anyLong());
+        verify(writer).stampLastUsed(KEY);
+    }
+
+    @Test
+    @DisplayName("insert throws (rollback-only commit): still re-increments, count not dropped")
+    void insertThrowsStillReincrements() {
+        when(writer.increment(eq(KEY), anyLong())).thenReturn(0);
+        when(writer.tryInsertFirstUse(eq(KEY), anyLong()))
+                .thenThrow(new RuntimeException("UnexpectedRollbackException"));
+
+        recorder.record(KEY);
+
+        verify(writer, times(2)).increment(eq(KEY), anyLong());
+        verify(writer).stampLastUsed(KEY);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/UserServiceMoreTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/UserServiceMoreTest.java
index bc516172a6..6e2b942b80 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/UserServiceMoreTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/UserServiceMoreTest.java
@@ -41,6 +41,7 @@ import stirling.software.proprietary.security.model.AuthenticationType;
 import stirling.software.proprietary.security.model.Authority;
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.repository.TeamRepository;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService.ApiKeyAuthentication;
 import stirling.software.proprietary.security.session.SessionPersistentRegistry;
 import stirling.software.proprietary.storage.repository.FileShareAccessRepository;
 import stirling.software.proprietary.storage.repository.FileShareRepository;
@@ -76,6 +77,7 @@ class UserServiceMoreTest {
             integrationConfigRepository;
 
     @Mock private TeamMembershipService teamMembershipService;
+    @Mock private ApiKeyAuthenticationService apiKeyAuthenticationService;
 
     @InjectMocks private UserService userService;
 
@@ -99,7 +101,8 @@ class UserServiceMoreTest {
         void getAuthenticationValid() {
             User u = user("api");
             u.addAuthority(new Authority("ROLE_USER", u));
-            when(userRepository.findByApiKey("k")).thenReturn(Optional.of(u));
+            when(apiKeyAuthenticationService.authenticate("k"))
+                    .thenReturn(Optional.of(new ApiKeyAuthentication(u, null, u.getAuthorities())));
 
             assertThat(userService.getAuthentication("k")).isNotNull();
         }
@@ -107,7 +110,7 @@ class UserServiceMoreTest {
         @Test
         @DisplayName("getAuthentication throws when key is unknown")
         void getAuthenticationInvalid() {
-            when(userRepository.findByApiKey("bad")).thenReturn(Optional.empty());
+            when(apiKeyAuthenticationService.authenticate("bad")).thenReturn(Optional.empty());
 
             assertThatThrownBy(() -> userService.getAuthentication("bad"))
                     .isInstanceOf(UsernameNotFoundException.class);
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/UserServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/UserServiceTest.java
index 95ec72d962..4b49b4c4d2 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/security/service/UserServiceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/service/UserServiceTest.java
@@ -71,6 +71,7 @@ class UserServiceTest {
             integrationConfigRepository;
 
     @Mock private TeamMembershipService teamMembershipService;
+    @Mock private ApiKeyAuthenticationService apiKeyAuthenticationService;
 
     @Spy @InjectMocks private UserService userService;
 
@@ -196,6 +197,27 @@ class UserServiceTest {
         verify(userRepository).save(user);
     }
 
+    @Test
+    void addApiKeyToUserRevokesOldMigratedShadowRow() {
+        User user = new User();
+        user.setUsername("user");
+        user.setApiKey("old-secret");
+        when(userRepository.findByUsernameIgnoreCase("user")).thenReturn(Optional.of(user));
+        when(userRepository.findByApiKey(any())).thenReturn(Optional.empty());
+        when(userRepository.save(any(User.class)))
+                .thenAnswer(invocation -> invocation.getArgument(0));
+
+        User updated = userService.addApiKeyToUser("user");
+
+        // Rotating a legacy key must revoke its migrated api_keys shadow row with the OLD secret,
+        // and do so before the new key is generated - otherwise the old secret keeps
+        // authenticating.
+        org.mockito.InOrder inOrder = inOrder(apiKeyAuthenticationService, userRepository);
+        inOrder.verify(apiKeyAuthenticationService).revokeMigratedKey("old-secret");
+        inOrder.verify(userRepository).save(user);
+        assertNotEquals("old-secret", updated.getApiKey());
+    }
+
     @Test
     void getApiKeyForUserCreatesWhenMissing() {
         User user = new User();
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/service/PortalDocumentsServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/service/PortalDocumentsServiceTest.java
index 1afc0af4a4..f02d919ba3 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/service/PortalDocumentsServiceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/service/PortalDocumentsServiceTest.java
@@ -70,4 +70,18 @@ class PortalDocumentsServiceTest {
         assertThat(doc.getProduct()).isEqualTo("API");
         assertThat(doc.getSource()).isEqualTo("API integration");
     }
+
+    @Test
+    void apiDocumentIsAttributedToItsNamedKey() {
+        PortalReviewDocumentDto doc =
+                onlyDoc(
+                        "{\"path\":\"/api/v1/misc/compress-pdf\",\"__origin\":\"API\","
+                                + "\"__apiKeyLabel\":\"Production ingest (sk_demo0000)\","
+                                + "\"files\":[{\"name\":\"a.pdf\",\"type\":\"application/pdf\"}],"
+                                + "\"statusCode\":200}");
+
+        // The specific key label surfaces as the source; product stays "API".
+        assertThat(doc.getProduct()).isEqualTo("API");
+        assertThat(doc.getSource()).isEqualTo("API key · Production ingest (sk_demo0000)");
+    }
 }
diff --git a/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java b/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
index 34bcccfeb7..890bc081a2 100644
--- a/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
+++ b/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
@@ -18,6 +18,7 @@ import java.util.Map;
 import java.util.Optional;
 import java.util.UUID;
 
+import org.slf4j.MDC;
 import org.springframework.dao.DataIntegrityViolationException;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.AuthenticationException;
@@ -43,6 +44,8 @@ import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.AuthenticationType;
 import stirling.software.proprietary.security.model.Authority;
 import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService.ApiKeyAuthentication;
 import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.saas.model.AmrMethod;
@@ -65,6 +68,7 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
     private final SupabaseUserService supabaseUserService;
     private final SaasTeamService saasTeamService;
     private final JwtDecoder jwtDecoder;
+    private final ApiKeyAuthenticationService apiKeyAuthenticationService;
     private final AuthenticationEntryPoint authenticationEntryPoint =
             new BearerTokenAuthenticationEntryPoint();
 
@@ -73,12 +77,14 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
             UserService userService,
             SupabaseUserService supabaseUserService,
             SaasTeamService saasTeamService,
-            JwtDecoder jwtDecoder) {
+            JwtDecoder jwtDecoder,
+            ApiKeyAuthenticationService apiKeyAuthenticationService) {
         this.teamService = teamService;
         this.userService = userService;
         this.supabaseUserService = supabaseUserService;
         this.saasTeamService = saasTeamService;
         this.jwtDecoder = jwtDecoder;
+        this.apiKeyAuthenticationService = apiKeyAuthenticationService;
     }
 
     @Override
@@ -86,6 +92,9 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
             HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
             throws ServletException, IOException {
 
+        // Start clean so a pooled thread can't inherit a prior request's API-key label.
+        MDC.remove(ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY);
+
         if (isStaticResource(request.getContextPath(), request.getRequestURI())) {
             filterChain.doFilter(request, response);
             return;
@@ -408,16 +417,22 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
             return false;
         }
 
-        Optional<User> user = userService.getUserByApiKey(apiKey);
-        if (user.isEmpty()) {
+        // Resolves the multi-key table then the legacy key, records per-key usage, and yields a
+        // label for the processor's document-source attribution.
+        Optional<ApiKeyAuthentication> resolved = apiKeyAuthenticationService.authenticate(apiKey);
+        if (resolved.isEmpty()) {
             throw new InvalidBearerTokenException("Invalid API Key.");
         }
+        User user = resolved.get().user();
 
-        userService.trackApiKeyFirstUse(user.get());
+        userService.trackApiKeyFirstUse(user);
 
         ApiKeyAuthenticationToken authToken =
-                new ApiKeyAuthenticationToken(user.get(), apiKey, user.get().getAuthorities());
+                new ApiKeyAuthenticationToken(user, apiKey, resolved.get().authorities());
         SecurityContextHolder.getContext().setAuthentication(authToken);
+        if (resolved.get().auditLabel() != null) {
+            MDC.put(ApiKeyAuthenticationService.AUDIT_LABEL_MDC_KEY, resolved.get().auditLabel());
+        }
         return true;
     }
 
diff --git a/app/saas/src/main/java/stirling/software/saas/security/SupabaseSecurityConfig.java b/app/saas/src/main/java/stirling/software/saas/security/SupabaseSecurityConfig.java
index 5fe27a11e8..ce0c937d6e 100644
--- a/app/saas/src/main/java/stirling/software/saas/security/SupabaseSecurityConfig.java
+++ b/app/saas/src/main/java/stirling/software/saas/security/SupabaseSecurityConfig.java
@@ -48,6 +48,7 @@ import lombok.extern.slf4j.Slf4j;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.util.RequestUriUtils;
 import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.service.ApiKeyAuthenticationService;
 import stirling.software.proprietary.security.service.TeamService;
 import stirling.software.proprietary.security.service.UserService;
 import stirling.software.saas.accountlink.DeviceCredentialAuthenticationFilter;
@@ -69,6 +70,7 @@ public class SupabaseSecurityConfig {
     private final SupabaseUserService supabaseUserService;
     private final SaasTeamService saasTeamService;
     private final ApplicationProperties applicationProperties;
+    private final ApiKeyAuthenticationService apiKeyAuthenticationService;
 
     @Value("${app.supabase.issuer:}")
     private String issuer;
@@ -125,7 +127,8 @@ public class SupabaseSecurityConfig {
                                 userService,
                                 supabaseUserService,
                                 saasTeamService,
-                                jwtDecoder),
+                                jwtDecoder,
+                                apiKeyAuthenticationService),
                         BearerTokenAuthenticationFilter.class)
                 .exceptionHandling(
                         ex ->
diff --git a/app/saas/src/main/resources/db/migration/saas/V33__api_keys.sql b/app/saas/src/main/resources/db/migration/saas/V33__api_keys.sql
new file mode 100644
index 0000000000..abced067e6
--- /dev/null
+++ b/app/saas/src/main/resources/db/migration/saas/V33__api_keys.sql
@@ -0,0 +1,24 @@
+-- Named, multi-key personal API keys, plus per-key daily usage.
+-- Idempotent: Hibernate ddl-auto=update may already have created these on some deployments.
+
+CREATE TABLE IF NOT EXISTS api_keys (
+    id            BIGSERIAL    PRIMARY KEY,
+    name          VARCHAR(100) NOT NULL,
+    key_hash      VARCHAR(64)  NOT NULL,
+    prefix        VARCHAR(32)  NOT NULL,
+    owner_user_id BIGINT       NOT NULL,
+    enabled       BOOLEAN     NOT NULL DEFAULT TRUE,
+    created_at    TIMESTAMPTZ NOT NULL,
+    last_used_at  TIMESTAMPTZ,
+    revoked_at    TIMESTAMPTZ
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_api_key_hash ON api_keys (key_hash);
+CREATE INDEX IF NOT EXISTS idx_api_key_owner ON api_keys (owner_user_id);
+
+CREATE TABLE IF NOT EXISTS api_key_daily_usage (
+    api_key_id BIGINT NOT NULL,
+    epoch_day  BIGINT NOT NULL,
+    count      BIGINT NOT NULL DEFAULT 0,
+    PRIMARY KEY (api_key_id, epoch_day)
+);
diff --git a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
index d312b74c75..87e100375f 100644
--- a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
@@ -58,6 +58,10 @@ class SupabaseAuthenticationFilterMoreTest {
     @Mock private SaasTeamService saasTeamService;
     @Mock private JwtDecoder jwtDecoder;
 
+    @Mock
+    private stirling.software.proprietary.security.service.ApiKeyAuthenticationService
+            apiKeyAuthenticationService;
+
     private SupabaseAuthenticationFilter filter;
     private MockHttpServletRequest request;
     private MockHttpServletResponse response;
@@ -68,7 +72,12 @@ class SupabaseAuthenticationFilterMoreTest {
         SecurityContextHolder.clearContext();
         filter =
                 new SupabaseAuthenticationFilter(
-                        teamService, userService, supabaseUserService, saasTeamService, jwtDecoder);
+                        teamService,
+                        userService,
+                        supabaseUserService,
+                        saasTeamService,
+                        jwtDecoder,
+                        apiKeyAuthenticationService);
         request = new MockHttpServletRequest();
         response = new MockHttpServletResponse();
         chain = new MockFilterChain();
@@ -234,7 +243,12 @@ class SupabaseAuthenticationFilterMoreTest {
         @DisplayName("returns true and skips lookup when an api key sets an authenticated context")
         void apiKeyValidStillAuthenticates() throws Exception {
             User user = newUser("alice");
-            when(userService.getUserByApiKey("k1")).thenReturn(Optional.of(user));
+            when(apiKeyAuthenticationService.authenticate("k1"))
+                    .thenReturn(
+                            Optional.of(
+                                    new stirling.software.proprietary.security.service
+                                            .ApiKeyAuthenticationService.ApiKeyAuthentication(
+                                            user, null, user.getAuthorities())));
 
             request.setRequestURI("/api/v1/something");
             request.setMethod("POST");
diff --git a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterTest.java b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterTest.java
index e906655edc..58cf2d72a0 100644
--- a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterTest.java
@@ -48,6 +48,10 @@ class SupabaseAuthenticationFilterTest {
     @Mock private stirling.software.saas.service.SaasTeamService saasTeamService;
     @Mock private JwtDecoder jwtDecoder;
 
+    @Mock
+    private stirling.software.proprietary.security.service.ApiKeyAuthenticationService
+            apiKeyAuthenticationService;
+
     private SupabaseAuthenticationFilter filter;
     private MockHttpServletRequest request;
     private MockHttpServletResponse response;
@@ -58,7 +62,12 @@ class SupabaseAuthenticationFilterTest {
         SecurityContextHolder.clearContext();
         filter =
                 new SupabaseAuthenticationFilter(
-                        teamService, userService, supabaseUserService, saasTeamService, jwtDecoder);
+                        teamService,
+                        userService,
+                        supabaseUserService,
+                        saasTeamService,
+                        jwtDecoder,
+                        apiKeyAuthenticationService);
         request = new MockHttpServletRequest();
         response = new MockHttpServletResponse();
         chain = new MockFilterChain();
@@ -85,7 +94,12 @@ class SupabaseAuthenticationFilterTest {
     void apiKeyHeaderPopulatesSecurityContext() throws Exception {
         User user = newUser("alice");
         user.setApiKey("api-key-123");
-        when(userService.getUserByApiKey("api-key-123")).thenReturn(Optional.of(user));
+        when(apiKeyAuthenticationService.authenticate("api-key-123"))
+                .thenReturn(
+                        Optional.of(
+                                new stirling.software.proprietary.security.service
+                                        .ApiKeyAuthenticationService.ApiKeyAuthentication(
+                                        user, null, user.getAuthorities())));
 
         request.setRequestURI("/api/v1/something");
         request.setMethod("POST");
@@ -103,7 +117,7 @@ class SupabaseAuthenticationFilterTest {
 
     @Test
     void invalidApiKeyTriggers401() throws Exception {
-        when(userService.getUserByApiKey("nope")).thenReturn(Optional.empty());
+        when(apiKeyAuthenticationService.authenticate("nope")).thenReturn(Optional.empty());
 
         request.setRequestURI("/api/v1/something");
         request.setMethod("POST");
diff --git a/app/saas/src/test/java/stirling/software/saas/security/SupabaseSecurityConfigMoreTest.java b/app/saas/src/test/java/stirling/software/saas/security/SupabaseSecurityConfigMoreTest.java
index 54b6e56391..da719e7ba5 100644
--- a/app/saas/src/test/java/stirling/software/saas/security/SupabaseSecurityConfigMoreTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/security/SupabaseSecurityConfigMoreTest.java
@@ -43,9 +43,18 @@ class SupabaseSecurityConfigMoreTest {
     @Mock private SupabaseUserService supabaseUserService;
     @Mock private SaasTeamService saasTeamService;
 
+    @Mock
+    private stirling.software.proprietary.security.service.ApiKeyAuthenticationService
+            apiKeyAuthenticationService;
+
     private SupabaseSecurityConfig config(ApplicationProperties props) {
         return new SupabaseSecurityConfig(
-                userService, teamService, supabaseUserService, saasTeamService, props);
+                userService,
+                teamService,
+                supabaseUserService,
+                saasTeamService,
+                props,
+                apiKeyAuthenticationService);
     }
 
     @Nested
diff --git a/app/saas/src/test/java/stirling/software/saas/security/TeamSecurityExpressionsTest.java b/app/saas/src/test/java/stirling/software/saas/security/TeamSecurityExpressionsTest.java
index c698daccca..ee74f66a29 100644
--- a/app/saas/src/test/java/stirling/software/saas/security/TeamSecurityExpressionsTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/security/TeamSecurityExpressionsTest.java
@@ -21,6 +21,7 @@ import org.springframework.security.core.context.SecurityContextHolder;
 import stirling.software.common.model.enumeration.TeamRole;
 import stirling.software.proprietary.model.Team;
 import stirling.software.proprietary.model.TeamMembership;
+import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
 import stirling.software.proprietary.security.model.User;
 import stirling.software.proprietary.security.repository.TeamMembershipRepository;
 import stirling.software.proprietary.security.service.UserService;
@@ -107,6 +108,27 @@ class TeamSecurityExpressionsTest {
         assertNull(expressions().currentUserTeamId());
     }
 
+    private User leaderUser() {
+        User leader = new User();
+        leader.setId(USER_ID);
+        Team team = new Team();
+        team.setId(TEAM_ID);
+        leader.setTeam(team);
+        return leader;
+    }
+
+    @Test
+    void apiKeyOfALeaderStillLeads() {
+        // A key acts as the owner; if they lead the team, the key leads.
+        SecurityContextHolder.getContext()
+                .setAuthentication(
+                        new ApiKeyAuthenticationToken(leaderUser(), "sk_personal", List.of()));
+        when(membershipRepository.findByTeamIdAndUserId(TEAM_ID, USER_ID))
+                .thenReturn(Optional.of(membershipWithRole(TeamRole.LEADER)));
+
+        assertTrue(expressions().isCurrentUserTeamLeader());
+    }
+
     @Test
     void unauthenticatedIsNotLeader() {
         // No authentication set on the context.
diff --git a/frontend/editor/public/locales/en-GB/translation.toml b/frontend/editor/public/locales/en-GB/translation.toml
index 431fa7af66..fba28f6872 100644
--- a/frontend/editor/public/locales/en-GB/translation.toml
+++ b/frontend/editor/public/locales/en-GB/translation.toml
@@ -6887,23 +6887,28 @@ title = "Infrastructure"
 [portal.infrastructure.apiKeys]
 createKey = "Create key"
 heading = "API keys"
-subheading = "Scoped credentials with per-key rate limits, permissions, and IP allowlists."
+subheading = "Personal credentials, each with its own usage tracking."
 
 [portal.infrastructure.apiKeys.card]
-allowedIps = "Allowed IPs"
-anyIp = "Any IP (no allowlist)"
 created = "Created"
 lastUsed = "Last used"
-permissions = "Permissions"
-rateLimit = "Rate limit"
-rateLimitValue = "{{value}} req/min"
+revoke = "Revoke key"
 usageMonth = "Usage this month"
 usageToday = "Usage today"
 
 [portal.infrastructure.apiKeys.empty]
-description = "Create a scoped key to start calling the Stirling API."
+description = "Create a key to start calling the Stirling API."
 title = "No API keys yet"
 
+[portal.infrastructure.apiKeys.error]
+load = "Couldn't load your API keys. Please try again."
+
+[portal.infrastructure.apiKeys.revoke]
+body = "Revoke \"{{name}}\"? Any integration still using this key will immediately start receiving 401 errors. This can't be undone."
+cancel = "Cancel"
+confirm = "Revoke key"
+title = "Revoke API key"
+
 [portal.infrastructure.audit]
 filterAriaLabel = "Filter audit events by category"
 heading = "Audit logs"
@@ -6964,14 +6969,11 @@ totalEvents = "Total events · 24h"
 cancel = "Cancel"
 createKey = "Create key"
 done = "Done"
-ipAllowlistHelper = "Comma-separated CIDR ranges. Leave blank to allow any IP."
-ipAllowlistLabel = "IP allowlist"
 keyNameLabel = "Key name"
-keyNamePlaceholder = "e.g. Production · ingest"
-permissionsLabel = "Permissions"
+keyNamePlaceholder = "e.g. Production ingest"
 secretKeyCaption = "Secret key"
-secretWarning = "Store this in a secrets manager. Stirling only ever stores a hash — there is no way to recover it later."
-subtitle = "Scope the key to the minimum it needs. You can rotate or revoke at any time."
+secretWarning = "Store this in a secrets manager. Stirling only ever stores a hash, so there is no way to recover it later."
+subtitle = "Give the key a name so you can recognise it later. You can revoke it at any time."
 subtitleCreated = "Copy this secret now — it won't be shown again."
 title = "Create API key"
 titleCreated = "Key created"
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index a17b6583f9..8c2a8333b6 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6751,31 +6751,31 @@ subtitle = "Deployments, credentials, security posture, storage, and the audit t
 title = "Infrastructure"
 
 # Fixed-enum label maps rendered via t(MAP[value]) in the infrastructure tabs.
-[portal.infrastructure.apiKeyPermission]
-admin = "Admin"
-read = "Read"
-write = "Write"
-
 [portal.infrastructure.apiKeys]
 createKey = "Create key"
 heading = "API keys"
-subheading = "Scoped credentials with per-key rate limits, permissions, and IP allowlists."
+subheading = "Personal credentials, each with its own usage tracking."
 
 [portal.infrastructure.apiKeys.card]
-allowedIps = "Allowed IPs"
-anyIp = "Any IP (no allowlist)"
 created = "Created"
 lastUsed = "Last used"
-permissions = "Permissions"
-rateLimit = "Rate limit"
-rateLimitValue = "{{value}} req/min"
+revoke = "Revoke key"
 usageMonth = "Usage this month"
 usageToday = "Usage today"
 
 [portal.infrastructure.apiKeys.empty]
-description = "Create a scoped key to start calling the Stirling API."
+description = "Create a key to start calling the Stirling API."
 title = "No API keys yet"
 
+[portal.infrastructure.apiKeys.error]
+load = "Couldn't load your API keys. Please try again."
+
+[portal.infrastructure.apiKeys.revoke]
+body = "Revoke \"{{name}}\"? Any integration still using this key will immediately start receiving 401 errors. This can't be undone."
+cancel = "Cancel"
+confirm = "Revoke key"
+title = "Revoke API key"
+
 [portal.infrastructure.attestationLabel]
 attested = "Attested"
 inScope = "In scope"
@@ -6861,14 +6861,11 @@ notStarted = "Not started"
 cancel = "Cancel"
 createKey = "Create key"
 done = "Done"
-ipAllowlistHelper = "Comma-separated CIDR ranges. Leave blank to allow any IP."
-ipAllowlistLabel = "IP allowlist"
 keyNameLabel = "Key name"
-keyNamePlaceholder = "e.g. Production · ingest"
-permissionsLabel = "Permissions"
+keyNamePlaceholder = "e.g. Production ingest"
 secretKeyCaption = "Secret key"
-secretWarning = "Store this in a secrets manager. Stirling only ever stores a hash — there is no way to recover it later."
-subtitle = "Scope the key to the minimum it needs. You can rotate or revoke at any time."
+secretWarning = "Store this in a secrets manager. Stirling only ever stores a hash, so there is no way to recover it later."
+subtitle = "Give the key a name so you can recognise it later. You can revoke it at any time."
 subtitleCreated = "Copy this secret now — it won't be shown again."
 title = "Create API key"
 titleCreated = "Key created"
@@ -6917,7 +6914,6 @@ title = "No regions deployed"
 [portal.infrastructure.keyLabel]
 active = "Active"
 revoked = "Revoked"
-rotateSoon = "Rotate soon"
 
 [portal.infrastructure.modelLabel]
 active = "Active"
diff --git a/frontend/editor/src/core/tests/stubbed/api-keys-ui.spec.ts b/frontend/editor/src/core/tests/stubbed/api-keys-ui.spec.ts
new file mode 100644
index 0000000000..003a56fe31
--- /dev/null
+++ b/frontend/editor/src/core/tests/stubbed/api-keys-ui.spec.ts
@@ -0,0 +1,265 @@
+import {
+  test,
+  expect,
+  type APIRequestContext,
+  type Page,
+  type Route,
+} from "@playwright/test";
+import { seedCookieConsent } from "@app/tests/helpers/api-stubs";
+
+/**
+ * E2E coverage for the portal Infrastructure → API Keys tab (PR #6961:
+ * multiple named personal API keys with per-key usage tracking). Drives the
+ * list / create-and-reveal / revoke / empty / error flows through the real
+ * portal shell.
+ *
+ * Auth is real (a genuine admin login against the backend) because the portal's
+ * Spring AuthProvider doesn't settle under a fully-faked session; only the
+ * `api-keys` CRUD responses are stubbed via `page.route`, so the assertions stay
+ * deterministic and no real keys are created.
+ *
+ * Requirements to run for real: a backend on :8080 (reachable through the vite
+ * proxy) AND a portal-enabled frontend (`import.meta.env.DEV`, or a build with
+ * `VITE_INCLUDE_PORTAL=true`). The CI `vite preview` bundle ships with the
+ * portal off, so each test skips cleanly there - the same defensive pattern as
+ * audit-log-ui.spec.ts. Companion unit coverage that always runs in CI lives in
+ * ApiKeysTab.test.tsx.
+ */
+
+const API_KEYS = "**/api/v1/proprietary/ui-data/infrastructure/api-keys";
+
+type StubKey = {
+  id: string;
+  name: string;
+  prefix: string;
+  created: string;
+  lastUsed: string;
+  status: "active" | "revoked";
+  usageToday: number;
+  usageMonth: number;
+  usageTotal: number;
+};
+
+function key(overrides: Partial<StubKey> = {}): StubKey {
+  return {
+    id: "1",
+    name: "Production ingest",
+    prefix: "sk_a1b2c3d4",
+    created: "2026-07-10",
+    lastUsed: "2026-07-15 09:30",
+    status: "active",
+    usageToday: 12,
+    usageMonth: 340,
+    usageTotal: 9001,
+    ...overrides,
+  };
+}
+
+/** Log in as the default admin; returns the JWT, or null when no backend answers. */
+async function adminJwt(request: APIRequestContext): Promise<string | null> {
+  for (const password of ["adminadmin", "stirling"]) {
+    const res = await request
+      .post("/api/v1/auth/login", { data: { username: "admin", password } })
+      .catch(() => null);
+    if (res?.ok()) {
+      const body = await res.json().catch(() => null);
+      const token = body?.session?.access_token;
+      if (token) return token as string;
+    }
+  }
+  return null;
+}
+
+/**
+ * Real admin session + stubbed API-keys CRUD. `keys` seeds the list; create
+ * prepends an active key and reveals a one-time secret; delete flips the target
+ * to `revoked`; `loadStatus` forces the list GET to fail. Returns false (and the
+ * caller skips) when there's no backend to authenticate against.
+ */
+async function setUpApiKeys(
+  page: Page,
+  request: APIRequestContext,
+  opts: { keys?: StubKey[]; loadStatus?: number } = {},
+): Promise<boolean> {
+  const token = await adminJwt(request);
+  if (!token) {
+    test.skip(true, "No backend on :8080 to authenticate the portal");
+    return false;
+  }
+
+  const list = [...(opts.keys ?? [])];
+
+  await seedCookieConsent(page);
+  await page.addInitScript((jwt) => {
+    localStorage.setItem("stirling_jwt", jwt);
+  }, token);
+
+  // Revoke: flip the addressed key to revoked, 204 like the real endpoint.
+  await page.route(`${API_KEYS}/*`, (route: Route) => {
+    const id = route.request().url().split("/").pop() ?? "";
+    const target = list.find((k) => k.id === id);
+    if (target) target.status = "revoked";
+    return route.fulfill({ status: 204, body: "" });
+  });
+
+  // List (GET) and create (POST).
+  await page.route(API_KEYS, async (route: Route) => {
+    if (route.request().method() === "POST") {
+      const body = route.request().postDataJSON() as { name: string };
+      const created = key({
+        id: String(list.length + 100),
+        name: body.name,
+        prefix: "sk_new00000",
+        created: "2026-07-15",
+        lastUsed: "Never",
+        usageToday: 0,
+        usageMonth: 0,
+        usageTotal: 0,
+      });
+      list.unshift(created);
+      return route.fulfill({
+        json: {
+          key: created,
+          secret: "sk_test_demo_secret_shown_once",
+        },
+      });
+    }
+    if (opts.loadStatus && opts.loadStatus >= 400) {
+      return route.fulfill({
+        status: opts.loadStatus,
+        json: { error: "boom" },
+      });
+    }
+    return route.fulfill({ json: { keys: list } });
+  });
+
+  await page.goto("/processor/infrastructure");
+  return true;
+}
+
+/**
+ * Open the API Keys tab, or skip when the portal isn't in this build (the tab
+ * never renders - e.g. the CI `vite preview` bundle). Returns false when skipped.
+ */
+async function openApiKeysTab(page: Page): Promise<boolean> {
+  const tab = page.getByRole("button", { name: "API Keys" });
+  if (!(await tab.isVisible({ timeout: 20_000 }).catch(() => false))) {
+    test.skip(
+      true,
+      "Portal (/processor) not available/bootstrapped in this build",
+    );
+    return false;
+  }
+  await tab.click();
+  return true;
+}
+
+test.describe("Portal API Keys tab", () => {
+  test("shows the empty state when the caller has no keys", async ({
+    page,
+    request,
+  }) => {
+    if (!(await setUpApiKeys(page, request, { keys: [] }))) return;
+    if (!(await openApiKeysTab(page))) return;
+
+    await expect(page.getByText("No API keys yet")).toBeVisible({
+      timeout: 10_000,
+    });
+  });
+
+  test("lists existing keys with prefix, status and usage", async ({
+    page,
+    request,
+  }) => {
+    if (
+      !(await setUpApiKeys(page, request, {
+        keys: [
+          key({ id: "1", name: "Production ingest", prefix: "sk_a1b2c3d4" }),
+          key({
+            id: "2",
+            name: "Old key",
+            prefix: "sk_z9y8x7w6",
+            status: "revoked",
+          }),
+        ],
+      }))
+    )
+      return;
+    if (!(await openApiKeysTab(page))) return;
+
+    await expect(page.getByText("Production ingest")).toBeVisible({
+      timeout: 10_000,
+    });
+    await expect(page.getByText("sk_a1b2c3d4")).toBeVisible();
+    // The revoked key still lists, tagged as such.
+    await expect(page.getByText("Old key")).toBeVisible();
+  });
+
+  test("creates a key and reveals the one-time secret once", async ({
+    page,
+    request,
+  }) => {
+    if (!(await setUpApiKeys(page, request, { keys: [] }))) return;
+    if (!(await openApiKeysTab(page))) return;
+
+    await page.getByRole("button", { name: "Create key" }).click();
+
+    const dialog = page.getByRole("dialog");
+    await expect(dialog).toBeVisible();
+    await dialog.getByRole("textbox").fill("CI smoke key");
+    await dialog.getByRole("button", { name: "Create key" }).click();
+
+    // The plaintext secret is shown exactly once, with a store-it-now warning.
+    await expect(
+      dialog.getByText("sk_test_demo_secret_shown_once"),
+    ).toBeVisible({ timeout: 10_000 });
+    await expect(dialog.getByText(/won't be shown again/i)).toBeVisible();
+
+    await dialog.getByRole("button", { name: "Done" }).click();
+    // Back on the list, the new key is present.
+    await expect(page.getByText("CI smoke key")).toBeVisible({
+      timeout: 10_000,
+    });
+  });
+
+  test("revokes a key after confirmation", async ({ page, request }) => {
+    if (
+      !(await setUpApiKeys(page, request, {
+        keys: [key({ id: "1", name: "Doomed key", status: "active" })],
+      }))
+    )
+      return;
+    if (!(await openApiKeysTab(page))) return;
+
+    // Expand the card, then ask to revoke.
+    await page.getByRole("button", { name: /Doomed key/ }).click();
+    await page.getByRole("button", { name: "Revoke key" }).first().click();
+
+    // Confirm in the dialog.
+    const dialog = page.getByRole("dialog");
+    await expect(dialog).toBeVisible();
+    await expect(dialog.getByText(/can't be undone/i)).toBeVisible();
+    await dialog.getByRole("button", { name: "Revoke key" }).click();
+
+    // The dialog closes and the reloaded list shows the key as revoked.
+    await expect(dialog).toBeHidden({ timeout: 10_000 });
+    await expect(page.getByText("Revoked").first()).toBeVisible({
+      timeout: 10_000,
+    });
+  });
+
+  test("surfaces a load error instead of a false empty state", async ({
+    page,
+    request,
+  }) => {
+    if (!(await setUpApiKeys(page, request, { keys: [], loadStatus: 500 })))
+      return;
+    if (!(await openApiKeysTab(page))) return;
+
+    await expect(
+      page.getByText("Couldn't load your API keys. Please try again."),
+    ).toBeVisible({ timeout: 10_000 });
+    // A failed load must not masquerade as "no keys yet".
+    await expect(page.getByText("No API keys yet")).toHaveCount(0);
+  });
+});
diff --git a/frontend/editor/src/portal/api/infrastructure.ts b/frontend/editor/src/portal/api/infrastructure.ts
index d624f67e03..52a54179a5 100644
--- a/frontend/editor/src/portal/api/infrastructure.ts
+++ b/frontend/editor/src/portal/api/infrastructure.ts
@@ -43,23 +43,33 @@ export interface RecentDeployment {
 /*  API Keys                                                                 */
 /* ──────────────────────────────────────────────────────────────────────── */
 
-export type ApiKeyStatus = "active" | "revoked" | "rotate-soon";
-export type ApiKeyPermission = "Read" | "Write" | "Admin";
+export type ApiKeyStatus = "active" | "revoked";
 
 export interface ApiKey {
   id: string;
   name: string;
-  /** Masked prefix shown in the list, e.g. "sk_live_a3f8…". */
+  /** Non-secret leading fragment, e.g. "sk_a3f81b2c". */
   prefix: string;
   created: string;
+  /** Formatted last-use time, or "Never". */
   lastUsed: string;
   status: ApiKeyStatus;
-  /** Requests/min ceiling. */
-  rateLimit: number;
-  permissions: ApiKeyPermission[];
-  allowedIps: string[];
+  /** Requests made today (UTC). */
   usageToday: number;
+  /** Requests in the trailing 30 days. */
   usageMonth: number;
+  /** Lifetime request count. */
+  usageTotal: number;
+}
+
+export interface ApiKeysResponse {
+  keys: ApiKey[];
+}
+
+/** Returned once on creation: the listed row plus the plaintext secret, shown once. */
+export interface CreatedApiKey {
+  key: ApiKey;
+  secret: string;
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -278,11 +288,30 @@ export async function fetchDeployments(
   );
 }
 
-/** GET /v1/infrastructure/api-keys?tier=… */
-export async function fetchApiKeys(tier: Tier): Promise<ApiKey[]> {
-  return apiClient.local.json<ApiKey[]>(
-    `/v1/infrastructure/api-keys${q(tier)}`,
-  );
+const API_KEYS_PATH = "/api/v1/proprietary/ui-data/infrastructure/api-keys";
+
+// Always this instance's own backend: a key authenticates the instance that issued it, so a
+// self-hosted instance manages its own keys even when SaaS-linked (.local is the SaaS backend on SaaS).
+
+/** GET the caller's personal API keys; scoped server-side per user. */
+export async function fetchApiKeys(): Promise<ApiKeysResponse> {
+  return apiClient.local.json<ApiKeysResponse>(API_KEYS_PATH);
+}
+
+/** POST a new key; the response carries the one-time secret. */
+export async function createApiKey(body: {
+  name: string;
+}): Promise<CreatedApiKey> {
+  return apiClient.local.json<CreatedApiKey>(API_KEYS_PATH, {
+    method: "POST",
+    body,
+  });
+}
+
+/** DELETE (revoke) a key the caller owns. */
+export async function revokeApiKey(id: string): Promise<void> {
+  const path = `${API_KEYS_PATH}/${encodeURIComponent(id)}`;
+  await apiClient.local.json<void>(path, { method: "DELETE" });
 }
 
 /** GET /v1/infrastructure/security?tier=… */
diff --git a/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.stories.tsx b/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.stories.tsx
index 23c06bae3a..e95194e0d2 100644
--- a/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.stories.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.stories.tsx
@@ -6,21 +6,20 @@ import "@portal/views/Infrastructure.css";
 const BASE: ApiKey = {
   id: "key-1",
   name: "Production · ingest",
-  prefix: "sk_live_a3f8…",
-  created: "Mar 2, 2026",
-  lastUsed: "2m ago",
+  prefix: "sk_a3f81b2c",
+  created: "2026-03-02",
+  lastUsed: "2026-07-10 09:14",
   status: "active",
-  rateLimit: 1200,
-  permissions: ["Read", "Write"],
-  allowedIps: ["52.14.0.0/16", "18.221.0.0/16"],
   usageToday: 84210,
   usageMonth: 2410933,
+  usageTotal: 9820145,
 };
 
 const meta: Meta<typeof ApiKeyCard> = {
   title: "Portal/Infrastructure/ApiKeyCard",
   component: ApiKeyCard,
   parameters: { layout: "padded" },
+  args: { onRevoke: (key: ApiKey) => console.log("revoke", key.id) },
   decorators: [
     (S) => (
       <div style={{ maxWidth: "44rem" }}>
@@ -32,37 +31,18 @@ const meta: Meta<typeof ApiKeyCard> = {
 export default meta;
 type Story = StoryObj<typeof ApiKeyCard>;
 
-export const Active: Story = { args: { apiKey: BASE } };
-
-export const RotateSoon: Story = {
-  args: {
-    apiKey: {
-      ...BASE,
-      name: "Ops · admin (legacy)",
-      status: "rotate-soon",
-      permissions: ["Read", "Write", "Admin"],
-      allowedIps: ["203.0.113.7/32"],
-      usageToday: 0,
-    },
-  },
-};
+export const Personal: Story = { args: { apiKey: BASE } };
 
 export const Revoked: Story = {
   args: {
     apiKey: {
       ...BASE,
       name: "Sandbox · webhook tester",
-      prefix: "sk_test_2c4a…",
+      prefix: "sk_2c4a91de",
       status: "revoked",
-      lastUsed: "never",
-      permissions: ["Read"],
-      allowedIps: [],
+      lastUsed: "Never",
       usageToday: 0,
       usageMonth: 0,
     },
   },
 };
-
-export const NoIpAllowlist: Story = {
-  args: { apiKey: { ...BASE, allowedIps: [] } },
-};
diff --git a/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx b/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx
index 69e23cb406..fb5fd5d104 100644
--- a/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/ApiKeyCard.tsx
@@ -1,5 +1,5 @@
 import { useState } from "react";
-import { Button, Card, Chip, StatusBadge } from "@app/ui";
+import { Button, Card, StatusBadge } from "@app/ui";
 import { useTranslation } from "react-i18next";
 import type { ApiKey } from "@portal/api/infrastructure";
 import {
@@ -8,9 +8,17 @@ import {
 } from "@portal/components/infrastructure/infraFormat";
 
 /** Collapsible row for a single API key: header summary + expandable detail grid. */
-export function ApiKeyCard({ apiKey }: { apiKey: ApiKey }) {
+export function ApiKeyCard({
+  apiKey,
+  onRevoke,
+}: {
+  apiKey: ApiKey;
+  /** Ask to revoke this key; the parent confirms before the destructive call. */
+  onRevoke: (key: ApiKey) => void;
+}) {
   const { t } = useTranslation();
   const [open, setOpen] = useState(false);
+  const revocable = apiKey.status === "active";
   return (
     <Card padding="default" className="portal-infra__key">
       <Button
@@ -51,14 +59,6 @@ export function ApiKeyCard({ apiKey }: { apiKey: ApiKey }) {
               <dt>{t("portal.infrastructure.apiKeys.card.lastUsed")}</dt>
               <dd>{apiKey.lastUsed}</dd>
             </div>
-            <div>
-              <dt>{t("portal.infrastructure.apiKeys.card.rateLimit")}</dt>
-              <dd className="portal-infra__mono">
-                {t("portal.infrastructure.apiKeys.card.rateLimitValue", {
-                  value: apiKey.rateLimit.toLocaleString(),
-                })}
-              </dd>
-            </div>
             <div>
               <dt>{t("portal.infrastructure.apiKeys.card.usageToday")}</dt>
               <dd className="portal-infra__mono">
@@ -71,36 +71,20 @@ export function ApiKeyCard({ apiKey }: { apiKey: ApiKey }) {
                 {apiKey.usageMonth.toLocaleString()}
               </dd>
             </div>
-            <div>
-              <dt>{t("portal.infrastructure.apiKeys.card.permissions")}</dt>
-              <dd className="portal-infra__chips">
-                {apiKey.permissions.map((p) => (
-                  <Chip key={p} size="sm">
-                    {t(
-                      `portal.infrastructure.apiKeyPermission.${p.toLowerCase()}`,
-                      p,
-                    )}
-                  </Chip>
-                ))}
-              </dd>
-            </div>
-            <div className="portal-infra__kv-wide">
-              <dt>{t("portal.infrastructure.apiKeys.card.allowedIps")}</dt>
-              <dd className="portal-infra__chips">
-                {apiKey.allowedIps.length === 0 ? (
-                  <span className="portal-infra__muted">
-                    {t("portal.infrastructure.apiKeys.card.anyIp")}
-                  </span>
-                ) : (
-                  apiKey.allowedIps.map((ip) => (
-                    <Chip key={ip} size="sm">
-                      <span className="portal-infra__mono">{ip}</span>
-                    </Chip>
-                  ))
-                )}
-              </dd>
-            </div>
           </dl>
+
+          {revocable && (
+            <div className="portal-infra__modal-actions">
+              <Button
+                variant="secondary"
+                accent="danger"
+                size="sm"
+                onClick={() => onRevoke(apiKey)}
+              >
+                {t("portal.infrastructure.apiKeys.card.revoke")}
+              </Button>
+            </div>
+          )}
         </div>
       )}
     </Card>
diff --git a/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.stories.tsx b/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.stories.tsx
index 7743dd4fdf..7b271f135d 100644
--- a/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.stories.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.stories.tsx
@@ -20,14 +20,19 @@ type Story = StoryObj<typeof ApiKeysTab>;
 
 export const Default: Story = {};
 
+const EMPTY = { keys: [] };
+
 export const Loading: Story = {
   parameters: {
     msw: {
       handlers: [
-        http.get("/v1/infrastructure/api-keys", async () => {
-          await delay("infinite");
-          return HttpResponse.json([]);
-        }),
+        http.get(
+          "*/api/v1/proprietary/ui-data/infrastructure/api-keys",
+          async () => {
+            await delay("infinite");
+            return HttpResponse.json(EMPTY);
+          },
+        ),
       ],
     },
   },
@@ -37,7 +42,9 @@ export const Empty: Story = {
   parameters: {
     msw: {
       handlers: [
-        http.get("/v1/infrastructure/api-keys", () => HttpResponse.json([])),
+        http.get("*/api/v1/proprietary/ui-data/infrastructure/api-keys", () =>
+          HttpResponse.json(EMPTY),
+        ),
       ],
     },
   },
diff --git a/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.test.tsx b/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.test.tsx
new file mode 100644
index 0000000000..955124dea7
--- /dev/null
+++ b/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.test.tsx
@@ -0,0 +1,124 @@
+import { describe, expect, it, vi } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import type { ApiKey } from "@portal/api/infrastructure";
+
+// Deterministic i18n: keys returned verbatim, so assertions are stable.
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+// Stub the API layer so no real request is made. vi.hoisted keeps the mock fns
+// defined before the hoisted vi.mock factory runs; createApiKey is present
+// because the CreateKeyModal child imports it from the same module.
+const { fetchApiKeys, revokeApiKey, createApiKey } = vi.hoisted(() => ({
+  fetchApiKeys: vi.fn(),
+  revokeApiKey: vi.fn(),
+  createApiKey: vi.fn(),
+}));
+vi.mock("@portal/api/infrastructure", () => ({
+  fetchApiKeys,
+  revokeApiKey,
+  createApiKey,
+}));
+
+import { ApiKeysTab } from "@portal/components/infrastructure/ApiKeysTab";
+
+const K = "portal.infrastructure.apiKeys";
+
+function apiKey(overrides: Partial<ApiKey> = {}): ApiKey {
+  return {
+    id: "1",
+    name: "Production ingest",
+    prefix: "sk_a1b2c3d4",
+    created: "2026-07-10",
+    lastUsed: "2026-07-15 09:30",
+    status: "active",
+    usageToday: 12,
+    usageMonth: 340,
+    usageTotal: 9001,
+    ...overrides,
+  };
+}
+
+function renderTab() {
+  return render(
+    <MantineProvider>
+      <ApiKeysTab />
+    </MantineProvider>,
+  );
+}
+
+describe("ApiKeysTab", () => {
+  it("renders the empty state when the caller has no keys", async () => {
+    fetchApiKeys.mockResolvedValueOnce({ keys: [] });
+    renderTab();
+
+    expect(await screen.findByText(`${K}.empty.title`)).toBeInTheDocument();
+  });
+
+  it("lists keys with their prefix, and keeps revoked keys visible", async () => {
+    fetchApiKeys.mockResolvedValueOnce({
+      keys: [
+        apiKey({ id: "1", name: "Production ingest", prefix: "sk_a1b2c3d4" }),
+        apiKey({
+          id: "2",
+          name: "Old key",
+          prefix: "sk_z9y8x7w6",
+          status: "revoked",
+        }),
+      ],
+    });
+    renderTab();
+
+    expect(await screen.findByText("Production ingest")).toBeInTheDocument();
+    expect(screen.getByText("sk_a1b2c3d4")).toBeInTheDocument();
+    expect(screen.getByText("Old key")).toBeInTheDocument();
+  });
+
+  it("surfaces a load error instead of a misleading empty state", async () => {
+    fetchApiKeys.mockRejectedValueOnce(new Error("boom"));
+    renderTab();
+
+    expect(await screen.findByText(`${K}.error.load`)).toBeInTheDocument();
+    // A failed load must not render as "no keys yet".
+    expect(screen.queryByText(`${K}.empty.title`)).not.toBeInTheDocument();
+  });
+
+  it("revokes a key after confirmation and reloads the list", async () => {
+    fetchApiKeys
+      .mockResolvedValueOnce({
+        keys: [apiKey({ id: "7", name: "Doomed key" })],
+      })
+      .mockResolvedValueOnce({
+        keys: [apiKey({ id: "7", name: "Doomed key", status: "revoked" })],
+      });
+    revokeApiKey.mockResolvedValueOnce(undefined);
+    renderTab();
+
+    // Expand the card so the revoke action is reachable.
+    fireEvent.click(await screen.findByText("Doomed key"));
+    fireEvent.click(
+      await screen.findByRole("button", { name: `${K}.card.revoke` }),
+    );
+
+    // Confirm in the dialog (a distinct i18n key from the card action).
+    const confirm = await screen.findByRole("button", {
+      name: `${K}.revoke.confirm`,
+    });
+    fireEvent.click(confirm);
+
+    // The revoke targets the right key, then the confirm dialog closes and the
+    // list re-fetches to reflect the new state.
+    await waitFor(() => expect(revokeApiKey).toHaveBeenCalledWith("7"));
+    await waitFor(() =>
+      expect(
+        screen.queryByRole("button", { name: `${K}.revoke.confirm` }),
+      ).not.toBeInTheDocument(),
+    );
+    expect(fetchApiKeys.mock.calls.length).toBeGreaterThanOrEqual(2);
+  });
+});
diff --git a/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx b/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx
index a93b2c0c56..6a2817d12d 100644
--- a/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/ApiKeysTab.tsx
@@ -1,20 +1,48 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
-import { Button, EmptyState, Skeleton } from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import { fetchApiKeys, type ApiKey } from "@portal/api/infrastructure";
+import { Banner, Button, EmptyState, Modal, Skeleton } from "@app/ui";
+import { useAsync } from "@portal/hooks/useAsync";
+import {
+  fetchApiKeys,
+  revokeApiKey,
+  type ApiKey,
+  type ApiKeysResponse,
+} from "@portal/api/infrastructure";
+import { errorMessage } from "@portal/api/http";
 import { ApiKeyCard } from "@portal/components/infrastructure/ApiKeyCard";
 import { CreateKeyModal } from "@portal/components/infrastructure/CreateKeyModal";
 import { SectionHeader } from "@portal/components/infrastructure/SectionHeader";
 
 export function ApiKeysTab() {
   const { t } = useTranslation();
-  const { tier } = useTier();
   const [modalOpen, setModalOpen] = useState(false);
-  const state = useAsync<ApiKey[]>(() => fetchApiKeys(tier), [tier]);
-  const { data: keys } = state;
-  const { isLoading, isEmpty } = useSectionFlags(state);
+  const [reloadKey, setReloadKey] = useState(0);
+  const [error, setError] = useState<string | null>(null);
+  const [pendingRevoke, setPendingRevoke] = useState<ApiKey | null>(null);
+  const [revoking, setRevoking] = useState(false);
+  const state = useAsync<ApiKeysResponse>(() => fetchApiKeys(), [reloadKey]);
+  const { data, loading, error: loadError } = state;
+
+  const reload = () => setReloadKey((n) => n + 1);
+  const keys = data?.keys ?? [];
+  const isLoading = loading && data === null;
+  // A failed load must not masquerade as a genuinely empty list.
+  const isEmpty = !loading && !loadError && keys.length === 0;
+
+  async function confirmRevoke() {
+    if (!pendingRevoke) return;
+    setError(null);
+    setRevoking(true);
+    try {
+      await revokeApiKey(pendingRevoke.id);
+      setPendingRevoke(null);
+      reload();
+    } catch (e) {
+      setError(errorMessage(e));
+    } finally {
+      setRevoking(false);
+    }
+  }
 
   return (
     <div className="portal-infra__stack">
@@ -32,6 +60,14 @@ export function ApiKeysTab() {
         </Button>
       </div>
 
+      {error && <Banner tone="danger" description={error} />}
+      {!loading && loadError && (
+        <Banner
+          tone="danger"
+          description={t("portal.infrastructure.apiKeys.error.load")}
+        />
+      )}
+
       {isLoading && (
         <div className="portal-infra__stack" aria-hidden>
           {Array.from({ length: 3 }).map((_, i) => (
@@ -48,15 +84,52 @@ export function ApiKeysTab() {
         />
       )}
 
-      {keys && keys.length > 0 && (
+      {keys.length > 0 && (
         <div className="portal-infra__keys">
           {keys.map((k) => (
-            <ApiKeyCard key={k.id} apiKey={k} />
+            <ApiKeyCard key={k.id} apiKey={k} onRevoke={setPendingRevoke} />
           ))}
         </div>
       )}
 
-      <CreateKeyModal open={modalOpen} onClose={() => setModalOpen(false)} />
+      <CreateKeyModal
+        open={modalOpen}
+        onClose={() => setModalOpen(false)}
+        onCreated={reload}
+      />
+
+      <Modal
+        open={pendingRevoke !== null}
+        onClose={() => !revoking && setPendingRevoke(null)}
+        width="sm"
+        title={t("portal.infrastructure.apiKeys.revoke.title")}
+        footer={
+          <div className="portal-infra__modal-actions">
+            <Button
+              variant="tertiary"
+              size="sm"
+              disabled={revoking}
+              onClick={() => setPendingRevoke(null)}
+            >
+              {t("portal.infrastructure.apiKeys.revoke.cancel")}
+            </Button>
+            <Button
+              size="sm"
+              accent="danger"
+              loading={revoking}
+              onClick={confirmRevoke}
+            >
+              {t("portal.infrastructure.apiKeys.revoke.confirm")}
+            </Button>
+          </div>
+        }
+      >
+        <p>
+          {t("portal.infrastructure.apiKeys.revoke.body", {
+            name: pendingRevoke?.name ?? "",
+          })}
+        </p>
+      </Modal>
     </div>
   );
 }
diff --git a/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.stories.tsx b/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.stories.tsx
index f5e21035a6..ba5e3bc6a5 100644
--- a/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.stories.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.stories.tsx
@@ -6,7 +6,11 @@ const meta: Meta<typeof CreateKeyModal> = {
   title: "Portal/Infrastructure/CreateKeyModal",
   component: CreateKeyModal,
   parameters: { layout: "fullscreen" },
-  args: { open: true, onClose: () => console.log("close") },
+  args: {
+    open: true,
+    onClose: () => console.log("close"),
+    onCreated: () => console.log("created"),
+  },
 };
 export default meta;
 type Story = StoryObj<typeof CreateKeyModal>;
diff --git a/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.test.tsx b/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.test.tsx
new file mode 100644
index 0000000000..435307823a
--- /dev/null
+++ b/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.test.tsx
@@ -0,0 +1,63 @@
+import type { ComponentProps } from "react";
+import { describe, expect, it, vi } from "vitest";
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+
+// Deterministic i18n: keys returned verbatim, so assertions are stable.
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+// Stub the API layer so no real request is made; capture the create payload.
+// vi.hoisted keeps the mock fn defined before the hoisted vi.mock factory runs.
+const { createApiKey } = vi.hoisted(() => ({ createApiKey: vi.fn() }));
+vi.mock("@portal/api/infrastructure", () => ({ createApiKey }));
+
+import { CreateKeyModal } from "@portal/components/infrastructure/CreateKeyModal";
+
+const K = "portal.infrastructure.createKey";
+
+function renderModal(props: Partial<ComponentProps<typeof CreateKeyModal>>) {
+  return render(
+    <MantineProvider>
+      <CreateKeyModal open onClose={() => {}} onCreated={() => {}} {...props} />
+    </MantineProvider>,
+  );
+}
+
+describe("CreateKeyModal", () => {
+  it("gates the create button on a non-empty name", () => {
+    renderModal({});
+    const cta = screen.getByRole("button", { name: `${K}.createKey` });
+    expect(cta).toBeDisabled();
+
+    fireEvent.change(screen.getByPlaceholderText(`${K}.keyNamePlaceholder`), {
+      target: { value: "Production ingest" },
+    });
+    expect(cta).toBeEnabled();
+  });
+
+  it("creates a key and reveals the returned secret", async () => {
+    createApiKey.mockResolvedValueOnce({
+      key: { id: "1", name: "Production ingest" },
+      secret: "sk_live_demo_key_rotate_in_prod",
+    });
+    const onCreated = vi.fn();
+    renderModal({ onCreated });
+
+    fireEvent.change(screen.getByPlaceholderText(`${K}.keyNamePlaceholder`), {
+      target: { value: "Production ingest" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: `${K}.createKey` }));
+
+    expect(await screen.findByText(`${K}.secretWarning`)).toBeInTheDocument();
+    expect(
+      screen.getByText("sk_live_demo_key_rotate_in_prod"),
+    ).toBeInTheDocument();
+    await waitFor(() => expect(onCreated).toHaveBeenCalled());
+    expect(createApiKey).toHaveBeenCalledWith({ name: "Production ingest" });
+  });
+});
diff --git a/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.tsx b/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.tsx
index 8461b9dd43..9a51fb176b 100644
--- a/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/CreateKeyModal.tsx
@@ -1,40 +1,30 @@
 import { useState } from "react";
 import { useTranslation } from "react-i18next";
-import {
-  Banner,
-  Button,
-  Checkbox,
-  CodeBlock,
-  FormField,
-  Input,
-  Modal,
-} from "@app/ui";
-import type { ApiKeyPermission } from "@portal/api/infrastructure";
-
-const PERMISSION_OPTS: ApiKeyPermission[] = ["Read", "Write", "Admin"];
-
-// Shown once after a key is created. TODO(backend): use the one-time secret
-// returned by POST /v1/infrastructure/api-keys — it is never persisted server-side.
-const DEMO_NEW_KEY_SECRET = "sk_live_demo_key_rotate_in_prod";
+import { Banner, Button, CodeBlock, FormField, Input, Modal } from "@app/ui";
+import { createApiKey, type CreatedApiKey } from "@portal/api/infrastructure";
+import { errorMessage } from "@portal/api/http";
 
 export function CreateKeyModal({
   open,
   onClose,
+  onCreated,
 }: {
   open: boolean;
   onClose: () => void;
+  /** Called after a successful create so the tab can refresh its list. */
+  onCreated: () => void;
 }) {
   const { t } = useTranslation();
   const [name, setName] = useState("");
-  const [perms, setPerms] = useState<ApiKeyPermission[]>(["Read"]);
-  const [ips, setIps] = useState("");
-  const [created, setCreated] = useState(false);
+  const [created, setCreated] = useState<CreatedApiKey | null>(null);
+  const [submitting, setSubmitting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
 
   function reset() {
     setName("");
-    setPerms(["Read"]);
-    setIps("");
-    setCreated(false);
+    setCreated(null);
+    setSubmitting(false);
+    setError(null);
   }
 
   function close() {
@@ -43,16 +33,18 @@ export function CreateKeyModal({
     setTimeout(reset, 200);
   }
 
-  function togglePerm(p: ApiKeyPermission) {
-    setPerms((prev) =>
-      prev.includes(p) ? prev.filter((x) => x !== p) : [...prev, p],
-    );
-  }
-
-  function createKey() {
-    // TODO(backend): POST /v1/infrastructure/api-keys { name, perms, ips }
-    // and render the one-time secret from the response instead of the fixture.
-    setCreated(true);
+  async function createKey() {
+    setSubmitting(true);
+    setError(null);
+    try {
+      const result = await createApiKey({ name: name.trim() });
+      setCreated(result);
+      onCreated();
+    } catch (e) {
+      setError(errorMessage(e));
+    } finally {
+      setSubmitting(false);
+    }
   }
 
   return (
@@ -72,7 +64,7 @@ export function CreateKeyModal({
       }
       footer={
         created ? (
-          <Button variant="primary" accent="premium" onClick={close}>
+          <Button variant="primary" onClick={close}>
             {t("portal.infrastructure.createKey.done")}
           </Button>
         ) : (
@@ -82,8 +74,7 @@ export function CreateKeyModal({
             </Button>
             <Button
               variant="primary"
-              accent="premium"
-              disabled={name.trim() === "" || perms.length === 0}
+              disabled={name.trim() === "" || submitting}
               onClick={createKey}
             >
               {t("portal.infrastructure.createKey.createKey")}
@@ -95,7 +86,7 @@ export function CreateKeyModal({
       {created ? (
         <div className="portal-infra__stack">
           <CodeBlock
-            code={DEMO_NEW_KEY_SECRET}
+            code={created.secret}
             lang="bash"
             caption={t("portal.infrastructure.createKey.secretKeyCaption")}
           />
@@ -106,6 +97,8 @@ export function CreateKeyModal({
         </div>
       ) : (
         <div className="portal-infra__form">
+          {error && <Banner tone="danger" description={error} />}
+
           <FormField
             label={t("portal.infrastructure.createKey.keyNameLabel")}
             required
@@ -118,35 +111,6 @@ export function CreateKeyModal({
               )}
             />
           </FormField>
-
-          <FormField
-            label={t("portal.infrastructure.createKey.permissionsLabel")}
-          >
-            <div className="portal-infra__perm-row">
-              {PERMISSION_OPTS.map((p) => (
-                <Checkbox
-                  key={p}
-                  label={t(
-                    `portal.infrastructure.apiKeyPermission.${p.toLowerCase()}`,
-                    p,
-                  )}
-                  checked={perms.includes(p)}
-                  onChange={() => togglePerm(p)}
-                />
-              ))}
-            </div>
-          </FormField>
-
-          <FormField
-            label={t("portal.infrastructure.createKey.ipAllowlistLabel")}
-            helperText={t("portal.infrastructure.createKey.ipAllowlistHelper")}
-          >
-            <Input
-              value={ips}
-              onChange={(e) => setIps(e.target.value)}
-              placeholder="52.14.0.0/16, 203.0.113.7/32"
-            />
-          </FormField>
         </div>
       )}
     </Modal>
diff --git a/frontend/editor/src/portal/components/infrastructure/infraFormat.ts b/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
index 8771712ecb..6e4cf31a77 100644
--- a/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
+++ b/frontend/editor/src/portal/components/infrastructure/infraFormat.ts
@@ -55,13 +55,11 @@ export const DEPLOY_LABEL: Record<DeploymentStatus, string> = {
 export const KEY_TONE: Record<ApiKeyStatus, StatusTone> = {
   active: "success",
   revoked: "danger",
-  "rotate-soon": "warning",
 };
 
 export const KEY_LABEL: Record<ApiKeyStatus, string> = {
   active: "portal.infrastructure.keyLabel.active",
   revoked: "portal.infrastructure.keyLabel.revoked",
-  "rotate-soon": "portal.infrastructure.keyLabel.rotateSoon",
 };
 
 export const CERT_TONE: Record<CertStatus, StatusTone> = {
diff --git a/frontend/editor/src/portal/mocks/handlers/infrastructure.ts b/frontend/editor/src/portal/mocks/handlers/infrastructure.ts
index f885a39a1f..715175978a 100644
--- a/frontend/editor/src/portal/mocks/handlers/infrastructure.ts
+++ b/frontend/editor/src/portal/mocks/handlers/infrastructure.ts
@@ -25,10 +25,48 @@ export const infrastructureHandlers = [
     });
   }),
 
-  http.get("/v1/infrastructure/api-keys", async ({ request }) => {
-    await delay(120);
-    return HttpResponse.json(apiKeysFor(tierFrom(request)));
-  }),
+  // Real backend route; wildcard prefix intercepts both local (same-origin) and
+  // SaaS (absolute) callers.
+  http.get(
+    "*/api/v1/proprietary/ui-data/infrastructure/api-keys",
+    async ({ request }) => {
+      await delay(120);
+      return HttpResponse.json(apiKeysFor(tierFrom(request)));
+    },
+  ),
+
+  // Create returns a one-time secret; the mock is non-persistent (dev/Storybook only).
+  http.post(
+    "*/api/v1/proprietary/ui-data/infrastructure/api-keys",
+    async ({ request }) => {
+      await delay(120);
+      const body = (await request.json().catch(() => ({}))) as {
+        name?: string;
+      };
+      return HttpResponse.json({
+        key: {
+          id: `key-${Date.now()}`,
+          name: body.name ?? "New key",
+          prefix: "sk_demo0000",
+          created: "2026-07-10",
+          lastUsed: "Never",
+          status: "active",
+          usageToday: 0,
+          usageMonth: 0,
+          usageTotal: 0,
+        },
+        secret: "sk_live_demo_key_rotate_in_prod",
+      });
+    },
+  ),
+
+  http.delete(
+    "*/api/v1/proprietary/ui-data/infrastructure/api-keys/:id",
+    async () => {
+      await delay(120);
+      return new HttpResponse(null, { status: 204 });
+    },
+  ),
 
   http.get("/v1/infrastructure/security", async ({ request }) => {
     await delay(120);
diff --git a/frontend/editor/src/portal/mocks/infrastructure.ts b/frontend/editor/src/portal/mocks/infrastructure.ts
index 412e6133bf..560a3e2c31 100644
--- a/frontend/editor/src/portal/mocks/infrastructure.ts
+++ b/frontend/editor/src/portal/mocks/infrastructure.ts
@@ -15,6 +15,7 @@
 import type { Tier } from "@portal/contexts/TierContext";
 import type {
   ApiKey,
+  ApiKeysResponse,
   AuditEvent,
   AuditLogResponse,
   AuditSummary,
@@ -166,61 +167,57 @@ const API_KEYS_ALL: ApiKey[] = [
   {
     id: "key-1",
     name: "Production · ingest",
-    prefix: "sk_live_a3f8…",
-    created: "Mar 2, 2026",
-    lastUsed: "2m ago",
+    prefix: "sk_a3f81b2c",
+    created: "2026-03-02",
+    lastUsed: "2026-07-10 09:14",
     status: "active",
-    rateLimit: 1200,
-    permissions: ["Read", "Write"],
-    allowedIps: ["52.14.0.0/16", "18.221.0.0/16"],
     usageToday: 84210,
     usageMonth: 2410933,
+    usageTotal: 2410933,
   },
   {
     id: "key-2",
-    name: "Analytics · read-only",
-    prefix: "sk_live_77be…",
-    created: "Jan 18, 2026",
-    lastUsed: "41m ago",
+    name: "Nightly batch",
+    prefix: "sk_77be0f42",
+    created: "2026-01-18",
+    lastUsed: "2026-07-10 08:33",
     status: "active",
-    rateLimit: 300,
-    permissions: ["Read"],
-    allowedIps: [],
     usageToday: 6120,
     usageMonth: 188400,
+    usageTotal: 188400,
   },
   {
     id: "key-3",
-    name: "Ops · admin (legacy)",
-    prefix: "sk_live_d901…",
-    created: "Aug 9, 2025",
-    lastUsed: "6d ago",
-    status: "rotate-soon",
-    rateLimit: 600,
-    permissions: ["Read", "Write", "Admin"],
-    allowedIps: ["203.0.113.7/32"],
+    name: "CI pipeline",
+    prefix: "sk_d9013ab7",
+    created: "2025-08-09",
+    lastUsed: "2026-07-04 17:02",
+    status: "active",
     usageToday: 0,
     usageMonth: 14200,
+    usageTotal: 14200,
   },
   {
     id: "key-4",
     name: "Sandbox · webhook tester",
-    prefix: "sk_test_2c4a…",
-    created: "May 30, 2026",
-    lastUsed: "never",
+    prefix: "sk_2c4a91de",
+    created: "2026-05-30",
+    lastUsed: "Never",
     status: "revoked",
-    rateLimit: 60,
-    permissions: ["Read"],
-    allowedIps: [],
     usageToday: 0,
     usageMonth: 0,
+    usageTotal: 0,
   },
 ];
 
-export function apiKeysFor(tier: Tier): ApiKey[] {
-  if (tier === "free") return API_KEYS_ALL.slice(0, 1);
-  if (tier === "pro") return API_KEYS_ALL.slice(0, 3);
-  return API_KEYS_ALL;
+export function apiKeysFor(tier: Tier): ApiKeysResponse {
+  const keys =
+    tier === "free"
+      ? API_KEYS_ALL.slice(0, 1)
+      : tier === "pro"
+        ? API_KEYS_ALL.slice(0, 3)
+        : API_KEYS_ALL;
+  return { keys };
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
diff --git a/testing/cucumber/features/enterprise/api_keys.feature b/testing/cucumber/features/enterprise/api_keys.feature
new file mode 100644
index 0000000000..a45b221be4
--- /dev/null
+++ b/testing/cucumber/features/enterprise/api_keys.feature
@@ -0,0 +1,86 @@
+@jwt @auth @apikey
+Feature: API Keys management API
+
+    Tests for the portal API-keys REST API, which lets a user mint, list, and
+    revoke named personal API keys.
+
+    Endpoints (all @EnterpriseEndpoint, JWT/ROLE required):
+    - GET    /api/v1/proprietary/ui-data/infrastructure/api-keys        (list)
+    - POST   /api/v1/proprietary/ui-data/infrastructure/api-keys        (create)
+    - DELETE /api/v1/proprietary/ui-data/infrastructure/api-keys/{id}   (revoke)
+
+    Because these are @EnterpriseEndpoint, authenticated responses may be 200
+    (enterprise enabled) or 403 (feature not in this build). Unauthenticated
+    requests must always be rejected with 401.
+
+    The legacy single per-user key (the global API key) must keep working so no
+    key created before multi-key support is ever lost.
+
+    Admin credentials: username=admin, password=stirling
+    Global API key: 123456789
+
+    # =========================================================================
+    # LIST
+    # =========================================================================
+
+    @positive
+    Scenario: Admin can list API keys
+        Given I am logged in as admin
+        When I send a GET request to "/api/v1/proprietary/ui-data/infrastructure/api-keys" with JWT authentication
+        Then the response status code should be one of "200, 403"
+
+    @negative
+    Scenario: Unauthenticated list request returns 401
+        When I send a GET request to "/api/v1/proprietary/ui-data/infrastructure/api-keys" with no authentication
+        Then the response status code should be 401
+
+    # =========================================================================
+    # CREATE
+    # =========================================================================
+
+    @positive
+    Scenario: Admin can create a personal API key
+        Given I am logged in as admin
+        When I send a JSON POST request to "/api/v1/proprietary/ui-data/infrastructure/api-keys" with JWT authentication and body '{"name": "bdd_personal_key"}'
+        Then the response status code should be one of "200, 403"
+
+    @negative
+    Scenario: Creating a key without a name is rejected
+        Given I am logged in as admin
+        When I send a JSON POST request to "/api/v1/proprietary/ui-data/infrastructure/api-keys" with JWT authentication and body '{"name": ""}'
+        Then the response status code should be one of "400, 403"
+
+    @negative
+    Scenario: Unauthenticated create request returns 401
+        When I send a POST request to "/api/v1/proprietary/ui-data/infrastructure/api-keys" with no authentication
+        Then the response status code should be 401
+
+    # =========================================================================
+    # REVOKE
+    # =========================================================================
+
+    @negative
+    Scenario: Unauthenticated revoke request returns 401
+        When I send a DELETE request to "/api/v1/proprietary/ui-data/infrastructure/api-keys/1" with no authentication
+        Then the response status code should be 401
+
+    @positive
+    Scenario: Admin revoking a non-existent key is handled, not a bypass
+        Given I am logged in as admin
+        When I send a DELETE request to "/api/v1/proprietary/ui-data/infrastructure/api-keys/999999" with JWT authentication
+        Then the response status code should be one of "204, 403, 404"
+
+    # =========================================================================
+    # LEGACY KEY BACKWARD COMPATIBILITY
+    # =========================================================================
+
+    @positive
+    Scenario: The legacy global API key still authenticates
+        When I send a GET request to "/api/v1/auth/me" with API key "123456789"
+        Then the response status code should be 200
+        And the response JSON should have field "username"
+
+    @negative
+    Scenario: An unknown API key is rejected
+        When I send a GET request to "/api/v1/auth/me" with API key "not-a-real-api-key-000"
+        Then the response status code should be 401

From b3875d3149c9bf428b22c155efdd57b33474576f Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Thu, 23 Jul 2026 08:28:26 +0000
Subject: [PATCH 085/109] Add heuristic classification (#7050)

# Description of Changes

- Adds a non-AI heuristic classification engine that classifies
documents client-side in the browser when AI is disabled
- Classification is billed as a policy run via a fast, non-blocking
meter endpoint; a default Classification policy is seeded per team
- Enables the policy engine by default

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .github/workflows/push-docker.yml             |     1 -
 .../ClassificationRunBiller.java              |     8 +
 .../software/proprietary/model/Team.java      |     1 +
 .../proprietary/model/TeamCreatedEvent.java   |     4 +
 .../proprietary/model/TeamEntityListener.java |    26 +
 .../ClassificationMeterController.java        |    81 +
 .../DefaultClassificationPolicySeeder.java    |    95 +
 .../model/TeamEntityListenerTest.java         |    46 +
 ...DefaultClassificationPolicySeederTest.java |   118 +
 .../charge/SaasClassificationRunBiller.java   |    49 +
 .../core/hooks/useClassificationEnabled.ts    |     9 +-
 .../stubbed/classification-grouping.spec.ts   |    47 +
 .../classification-heuristic-upload.spec.ts   |    81 +
 .../classification/classified_invoice.pdf     |    36 +
 .../classification/classified_nda.pdf         |    36 +
 .../classification/classified_resume.pdf      |    36 +
 .../unlabelled/bank_statement.pdf             |   Bin 0 -> 1535 bytes
 .../unlabelled/cover_letter.pdf               |   Bin 0 -> 1635 bytes
 .../unlabelled/generic_notes.pdf              |   Bin 0 -> 1451 bytes
 .../unlabelled/invoice_acme.pdf               |   Bin 0 -> 1630 bytes
 .../classification/unlabelled/nda_mutual.pdf  |   Bin 0 -> 1698 bytes
 .../unlabelled/offer_letter.pdf               |   Bin 0 -> 1618 bytes
 .../unlabelled/purchase_order.pdf             |   Bin 0 -> 1591 bytes
 .../unlabelled/resume_jane_doe.pdf            |    90 +
 .../unlabelled/service_agreement.pdf          |   Bin 0 -> 1659 bytes
 .../unlabelled/spanish_contrato.pdf           |   Bin 0 -> 1505 bytes
 frontend/editor/src/portal/api/policies.ts    |     1 -
 .../policies/PolicyAutoRunController.tsx      |     3 +
 .../useClientSideClassification.test.tsx      |   255 +
 .../policies/useClientSideClassification.ts   |   207 +
 .../policies/usePolicyAutoRun.batch.test.tsx  |     5 +
 .../policies/usePolicyAutoRun.chain.test.tsx  |    26 +
 .../components/policies/usePolicyAutoRun.ts   |    11 +-
 .../shared/FileSidebarGroupControls.css       |     0
 .../shared/FileSidebarGroupControls.tsx       |     0
 .../shared/fileSidebarGrouping.test.ts        |     0
 .../components/shared/fileSidebarGrouping.tsx |    28 +-
 .../shared/fileSidebarGroupingLogic.ts        |     0
 .../proprietary/data/policyDefinitions.tsx    |     2 -
 .../hooks/useClassificationEnabled.ts         |     6 +
 .../services/classificationMeter.ts           |    27 +
 .../heuristic/heuristicClassification.ts      |    18 +
 .../heuristic/heuristicEngine.corpus.test.ts  |  2423 ++
 .../heuristic/heuristicEngine.docs.test.ts    |   118 +
 .../heuristic/heuristicEngine.test.ts         |   125 +
 .../services/heuristic/heuristicEngine.ts     |   976 +
 .../services/heuristic/heuristicExtractor.ts  |   199 +
 .../services/heuristic/heuristicRules.json    | 22352 ++++++++++++++++
 .../heuristic/heuristicRules.lint.test.ts     |   173 +
 .../proprietary/services/heuristic/types.ts   |    42 +
 .../src/proprietary/utils/scheduleIdle.ts     |    11 +
 .../saas/hooks/useClassificationEnabled.ts    |    11 -
 52 files changed, 27740 insertions(+), 43 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationRunBiller.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/TeamCreatedEvent.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/model/TeamEntityListener.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/ClassificationMeterController.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeeder.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/model/TeamEntityListenerTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeederTest.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/payg/charge/SaasClassificationRunBiller.java
 create mode 100644 frontend/editor/src/core/tests/stubbed/classification-grouping.spec.ts
 create mode 100644 frontend/editor/src/core/tests/stubbed/classification-heuristic-upload.spec.ts
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/classified_invoice.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/classified_nda.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/classified_resume.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/bank_statement.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/cover_letter.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/generic_notes.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/invoice_acme.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/nda_mutual.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/offer_letter.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/purchase_order.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/resume_jane_doe.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/service_agreement.pdf
 create mode 100644 frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/spanish_contrato.pdf
 create mode 100644 frontend/editor/src/proprietary/components/policies/useClientSideClassification.test.tsx
 create mode 100644 frontend/editor/src/proprietary/components/policies/useClientSideClassification.ts
 rename frontend/editor/src/{saas => proprietary}/components/shared/FileSidebarGroupControls.css (100%)
 rename frontend/editor/src/{saas => proprietary}/components/shared/FileSidebarGroupControls.tsx (100%)
 rename frontend/editor/src/{saas => proprietary}/components/shared/fileSidebarGrouping.test.ts (100%)
 rename frontend/editor/src/{saas => proprietary}/components/shared/fileSidebarGrouping.tsx (71%)
 rename frontend/editor/src/{saas => proprietary}/components/shared/fileSidebarGroupingLogic.ts (100%)
 create mode 100644 frontend/editor/src/proprietary/hooks/useClassificationEnabled.ts
 create mode 100644 frontend/editor/src/proprietary/services/classificationMeter.ts
 create mode 100644 frontend/editor/src/proprietary/services/heuristic/heuristicClassification.ts
 create mode 100644 frontend/editor/src/proprietary/services/heuristic/heuristicEngine.corpus.test.ts
 create mode 100644 frontend/editor/src/proprietary/services/heuristic/heuristicEngine.docs.test.ts
 create mode 100644 frontend/editor/src/proprietary/services/heuristic/heuristicEngine.test.ts
 create mode 100644 frontend/editor/src/proprietary/services/heuristic/heuristicEngine.ts
 create mode 100644 frontend/editor/src/proprietary/services/heuristic/heuristicExtractor.ts
 create mode 100644 frontend/editor/src/proprietary/services/heuristic/heuristicRules.json
 create mode 100644 frontend/editor/src/proprietary/services/heuristic/heuristicRules.lint.test.ts
 create mode 100644 frontend/editor/src/proprietary/services/heuristic/types.ts
 create mode 100644 frontend/editor/src/proprietary/utils/scheduleIdle.ts
 delete mode 100644 frontend/editor/src/saas/hooks/useClassificationEnabled.ts

diff --git a/.github/workflows/push-docker.yml b/.github/workflows/push-docker.yml
index a613cfdebc..a87f6d68b5 100644
--- a/.github/workflows/push-docker.yml
+++ b/.github/workflows/push-docker.yml
@@ -139,7 +139,6 @@ jobs:
           tags: |
             type=raw,value=${{ steps.versionNumber.outputs.versionNumber }},enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/master' || github.ref == 'refs/heads/V2-master' }}
-            type=raw,value=alpha,enable=${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/testMain' }}
 
       - name: Build and push Unified Dockerfile (latest variant)
         id: build-push-latest
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationRunBiller.java b/app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationRunBiller.java
new file mode 100644
index 0000000000..dd0467c9ca
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/classification/ClassificationRunBiller.java
@@ -0,0 +1,8 @@
+package stirling.software.proprietary.classification;
+
+/** Meters a client-side classification run; SaaS charges PAYG, other flavors have no bean. */
+public interface ClassificationRunBiller {
+
+    /** Charge one classification policy run covering {@code documentCount} documents. */
+    void recordClassificationRun(int documentCount);
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java
index 119c909557..0009ee386e 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java
@@ -14,6 +14,7 @@ import stirling.software.proprietary.security.model.User;
 
 @Entity
 @Table(name = "teams")
+@EntityListeners(TeamEntityListener.class)
 @NoArgsConstructor
 @Getter
 @Setter
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamCreatedEvent.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamCreatedEvent.java
new file mode 100644
index 0000000000..3f632fe1d8
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamCreatedEvent.java
@@ -0,0 +1,4 @@
+package stirling.software.proprietary.model;
+
+/** Published once a new {@link Team} row is inserted, so listeners can seed per-team defaults. */
+public record TeamCreatedEvent(Long teamId, String teamName) {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamEntityListener.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamEntityListener.java
new file mode 100644
index 0000000000..6a4725a142
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/TeamEntityListener.java
@@ -0,0 +1,26 @@
+package stirling.software.proprietary.model;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.ApplicationEventPublisher;
+import org.springframework.stereotype.Component;
+
+import jakarta.persistence.PostPersist;
+
+/** Publishes {@link TeamCreatedEvent} on insert; Spring bridges the publisher via a static. */
+@Component
+public class TeamEntityListener {
+
+    private static ApplicationEventPublisher publisher;
+
+    @Autowired
+    void setPublisher(ApplicationEventPublisher applicationEventPublisher) {
+        TeamEntityListener.publisher = applicationEventPublisher;
+    }
+
+    @PostPersist
+    public void onCreate(Team team) {
+        if (publisher != null) {
+            publisher.publishEvent(new TeamCreatedEvent(team.getId(), team.getName()));
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/ClassificationMeterController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/ClassificationMeterController.java
new file mode 100644
index 0000000000..dc978648b6
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/ClassificationMeterController.java
@@ -0,0 +1,81 @@
+package stirling.software.proprietary.policy.controller;
+
+import java.util.List;
+
+import org.springframework.beans.factory.ObjectProvider;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import io.swagger.v3.oas.annotations.Hidden;
+import io.swagger.v3.oas.annotations.Operation;
+
+import jakarta.servlet.http.HttpServletRequest;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.audit.AuditContext;
+import stirling.software.proprietary.classification.ClassificationRunBiller;
+
+/**
+ * Meters + audits a client-side (non-AI) classification run so both classify paths bill
+ * identically. Side-effect only; does no classification itself.
+ */
+@Slf4j
+@Hidden
+@RestController
+@RequestMapping("/api/v1/policies")
+public class ClassificationMeterController {
+
+    /** Audit step label mirrors the AI classify tool so both paths read alike in the trail. */
+    private static final String CLASSIFY_STEP = "/api/v1/ai/tools/classify-and-label";
+
+    /** Client-supplied count cap: the frontend meters one document per call. */
+    private static final int MAX_DOCUMENTS = 10_000;
+
+    private final ObjectProvider<ClassificationRunBiller> biller;
+
+    public ClassificationMeterController(ObjectProvider<ClassificationRunBiller> biller) {
+        this.biller = biller;
+    }
+
+    @PostMapping("/classify/meter")
+    @Operation(
+            summary = "Meter a client-side classification run",
+            description =
+                    "Records billing + audit for a non-AI classification performed in the browser."
+                            + " Does no classification itself. Dispatched by the frontend, not for"
+                            + " direct use.")
+    public ResponseEntity<Void> meterClassification(
+            @RequestBody(required = false) ClassifyMeterRequest body, HttpServletRequest request) {
+        int documents = body != null && body.documentCount() != null ? body.documentCount() : 1;
+        if (documents < 1) documents = 1;
+        if (documents > MAX_DOCUMENTS) documents = MAX_DOCUMENTS;
+        String policyName =
+                body != null && body.policyName() != null && !body.policyName().isBlank()
+                        ? body.policyName()
+                        : "Classification";
+
+        // Stamp the run so ControllerAuditAspect records it as a policy run, like the AI path.
+        request.setAttribute(AuditContext.REQ_ATTR_POLICY_NAME, policyName);
+        request.setAttribute(AuditContext.REQ_ATTR_POLICY_STEPS, List.of(CLASSIFY_STEP));
+
+        ClassificationRunBiller runBiller = biller.getIfAvailable();
+        if (runBiller != null) {
+            try {
+                runBiller.recordClassificationRun(documents);
+            } catch (RuntimeException e) {
+                log.warn(
+                        "[classify meter] billing failed; classification proceeds unbilled: {}",
+                        e.getMessage());
+            }
+        }
+        return ResponseEntity.accepted().build();
+    }
+
+    /** Frontend payload: documents classified, plus the policy name for the audit label. */
+    public record ClassifyMeterRequest(
+            String policyName, Integer documentCount, List<String> labels) {}
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeeder.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeeder.java
new file mode 100644
index 0000000000..aca6ae0e84
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeeder.java
@@ -0,0 +1,95 @@
+package stirling.software.proprietary.policy.seed;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.event.EventListener;
+import org.springframework.stereotype.Component;
+import org.springframework.transaction.event.TransactionPhase;
+import org.springframework.transaction.event.TransactionalEventListener;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.model.TeamCreatedEvent;
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.PipelineStep;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.store.PolicyStore;
+import stirling.software.proprietary.security.repository.TeamRepository;
+import stirling.software.proprietary.security.service.TeamService;
+
+/**
+ * Seeds an enabled Classification policy per team so classification is on by default. Idempotent;
+ * skips the internal team.
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class DefaultClassificationPolicySeeder {
+
+    static final String CATEGORY = "classification";
+    private static final String CLASSIFY_ENDPOINT = "/api/v1/ai/tools/classify-and-label";
+    private static final String POLICY_NAME = "Classification Policy";
+
+    private final PolicyStore policyStore;
+    private final TeamRepository teamRepository;
+
+    // The default team is created during startup, before the entity event listener is guaranteed
+    // wired, so ensure it once the context is fully ready (self-hosted first boot).
+    @EventListener(ApplicationReadyEvent.class)
+    public void seedDefaultTeamOnStartup() {
+        teamRepository
+                .findByName(TeamService.DEFAULT_TEAM_NAME)
+                .ifPresent(team -> seedIfMissing(team.getId(), team.getName()));
+    }
+
+    // Any team created at runtime (admin-created, SaaS sign-ups); after the team's commit so a
+    // rolled-back team never leaves a policy behind.
+    @TransactionalEventListener(phase = TransactionPhase.AFTER_COMMIT)
+    public void onTeamCreated(TeamCreatedEvent event) {
+        seedIfMissing(event.teamId(), event.teamName());
+    }
+
+    private void seedIfMissing(Long teamId, String teamName) {
+        if (teamId == null || TeamService.INTERNAL_TEAM_NAME.equals(teamName)) {
+            return;
+        }
+        boolean alreadySeeded =
+                policyStore.findByTeam(teamId).stream()
+                        .anyMatch(DefaultClassificationPolicySeeder::isClassification);
+        if (alreadySeeded) {
+            return;
+        }
+        policyStore.save(defaultPolicy(teamId));
+        log.info("Seeded default Classification policy for team {}", teamId);
+    }
+
+    private static boolean isClassification(Policy policy) {
+        return policy.output() != null
+                && CATEGORY.equals(policy.output().options().get("categoryId"));
+    }
+
+    /** The default Classification policy: classify each upload, versioning the file in place. */
+    static Policy defaultPolicy(Long teamId) {
+        Map<String, Object> options = new HashMap<>();
+        options.put("categoryId", CATEGORY);
+        options.put("runOn", "upload");
+        options.put("mode", "new_version");
+        options.put("sources", List.of("editor"));
+        options.put("scopeTypes", List.of());
+        options.put("reviewerEmail", "");
+        return new Policy(
+                null,
+                POLICY_NAME,
+                "system",
+                true,
+                null,
+                List.of(),
+                List.of(new PipelineStep(CLASSIFY_ENDPOINT, Map.of())),
+                new OutputSpec("inline", options),
+                teamId);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/model/TeamEntityListenerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/model/TeamEntityListenerTest.java
new file mode 100644
index 0000000000..6807aa8687
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/model/TeamEntityListenerTest.java
@@ -0,0 +1,46 @@
+package stirling.software.proprietary.model;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatCode;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.springframework.context.ApplicationEventPublisher;
+
+@ExtendWith(MockitoExtension.class)
+class TeamEntityListenerTest {
+
+    @Mock private ApplicationEventPublisher publisher;
+
+    private static Team team(Long id, String name) {
+        Team team = new Team();
+        team.setId(id);
+        team.setName(name);
+        return team;
+    }
+
+    @Test
+    void publishesTeamCreatedEventOnPersist() {
+        TeamEntityListener listener = new TeamEntityListener();
+        listener.setPublisher(publisher);
+
+        listener.onCreate(team(5L, "Acme"));
+
+        ArgumentCaptor<TeamCreatedEvent> event = ArgumentCaptor.forClass(TeamCreatedEvent.class);
+        org.mockito.Mockito.verify(publisher).publishEvent(event.capture());
+        assertThat(event.getValue().teamId()).isEqualTo(5L);
+        assertThat(event.getValue().teamName()).isEqualTo("Acme");
+    }
+
+    @Test
+    void doesNotThrowWhenNoPublisherIsSet() {
+        // JPA can build the listener before Spring wires the publisher; must be a safe no-op.
+        TeamEntityListener listener = new TeamEntityListener();
+        listener.setPublisher(null);
+
+        assertThatCode(() -> listener.onCreate(team(1L, "X"))).doesNotThrowAnyException();
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeederTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeederTest.java
new file mode 100644
index 0000000000..2f270afddb
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeederTest.java
@@ -0,0 +1,118 @@
+package stirling.software.proprietary.policy.seed;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.model.TeamCreatedEvent;
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.store.PolicyStore;
+import stirling.software.proprietary.security.repository.TeamRepository;
+import stirling.software.proprietary.security.service.TeamService;
+
+@ExtendWith(MockitoExtension.class)
+class DefaultClassificationPolicySeederTest {
+
+    @Mock private PolicyStore policyStore;
+    @Mock private TeamRepository teamRepository;
+
+    private DefaultClassificationPolicySeeder seeder() {
+        return new DefaultClassificationPolicySeeder(policyStore, teamRepository);
+    }
+
+    private static Policy classificationPolicy(Long teamId) {
+        return new Policy(
+                "p1",
+                "Classification Policy",
+                "system",
+                true,
+                null,
+                List.of(),
+                List.of(),
+                new OutputSpec("inline", Map.of("categoryId", "classification")),
+                teamId);
+    }
+
+    @Test
+    void seedsAnEnabledClassificationPolicyWhenTheTeamHasNone() {
+        when(policyStore.findByTeam(7L)).thenReturn(List.of());
+
+        seeder().onTeamCreated(new TeamCreatedEvent(7L, "Acme"));
+
+        ArgumentCaptor<Policy> saved = ArgumentCaptor.forClass(Policy.class);
+        verify(policyStore).save(saved.capture());
+        Policy policy = saved.getValue();
+        assertThat(policy.enabled()).isTrue();
+        assertThat(policy.teamId()).isEqualTo(7L);
+        assertThat(policy.output().type()).isEqualTo("inline");
+        assertThat(policy.output().options().get("categoryId")).isEqualTo("classification");
+        assertThat(policy.output().options().get("runOn")).isEqualTo("upload");
+        assertThat(policy.output().options().get("mode")).isEqualTo("new_version");
+        assertThat(policy.output().options().get("sources")).isEqualTo(List.of("editor"));
+        assertThat(policy.steps()).hasSize(1);
+        assertThat(policy.steps().get(0).operation())
+                .isEqualTo("/api/v1/ai/tools/classify-and-label");
+    }
+
+    @Test
+    void doesNotSeedWhenAClassificationPolicyAlreadyExists() {
+        when(policyStore.findByTeam(7L)).thenReturn(List.of(classificationPolicy(7L)));
+
+        seeder().onTeamCreated(new TeamCreatedEvent(7L, "Acme"));
+
+        verify(policyStore, never()).save(any());
+    }
+
+    @Test
+    void doesNotSeedForTheInternalTeam() {
+        seeder().onTeamCreated(new TeamCreatedEvent(2L, "Internal"));
+
+        verify(policyStore, never()).findByTeam(anyLong());
+        verify(policyStore, never()).save(any());
+    }
+
+    @Test
+    void doesNotSeedWhenTeamIdIsNull() {
+        seeder().onTeamCreated(new TeamCreatedEvent(null, "Acme"));
+
+        verify(policyStore, never()).save(any());
+    }
+
+    @Test
+    void seedsTheDefaultTeamOnStartupWhenItExistsAndHasNoPolicy() {
+        Team defaultTeam = new Team();
+        defaultTeam.setId(1L);
+        defaultTeam.setName(TeamService.DEFAULT_TEAM_NAME);
+        when(teamRepository.findByName(TeamService.DEFAULT_TEAM_NAME))
+                .thenReturn(Optional.of(defaultTeam));
+        when(policyStore.findByTeam(1L)).thenReturn(List.of());
+
+        seeder().seedDefaultTeamOnStartup();
+
+        verify(policyStore).save(any());
+    }
+
+    @Test
+    void doesNotSeedOnStartupWhenThereIsNoDefaultTeam() {
+        when(teamRepository.findByName(TeamService.DEFAULT_TEAM_NAME)).thenReturn(Optional.empty());
+
+        seeder().seedDefaultTeamOnStartup();
+
+        verify(policyStore, never()).save(any());
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/charge/SaasClassificationRunBiller.java b/app/saas/src/main/java/stirling/software/saas/payg/charge/SaasClassificationRunBiller.java
new file mode 100644
index 0000000000..79533fb102
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/payg/charge/SaasClassificationRunBiller.java
@@ -0,0 +1,49 @@
+package stirling.software.saas.payg.charge;
+
+import org.springframework.context.annotation.Profile;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.classification.ClassificationRunBiller;
+import stirling.software.proprietary.security.database.repository.UserRepository;
+import stirling.software.proprietary.security.model.ApiKeyAuthenticationToken;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.saas.payg.model.BillingCategory;
+import stirling.software.saas.payg.model.JobSource;
+import stirling.software.saas.payg.model.ProcessType;
+import stirling.software.saas.util.AuthenticationUtils;
+
+/**
+ * Charges one PAYG unit per document as an AUTOMATION job, matching what a server-side
+ * classify policy step bills.
+ */
+@Component
+@Profile("saas")
+@RequiredArgsConstructor
+public class SaasClassificationRunBiller implements ClassificationRunBiller {
+
+    private final UserRepository userRepository;
+    private final JobChargeService jobChargeService;
+
+    @Override
+    public void recordClassificationRun(int documentCount) {
+        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+        User user = AuthenticationUtils.getCurrentUser(auth, userRepository);
+        if (user == null || user.getTeam() == null) {
+            return;
+        }
+        JobSource source =
+                auth instanceof ApiKeyAuthenticationToken ? JobSource.API : JobSource.WEB;
+        ChargeContext ctx =
+                new ChargeContext(
+                        user.getId(),
+                        user.getTeam().getId(),
+                        source,
+                        ProcessType.AUTOMATION,
+                        BillingCategory.AUTOMATION);
+        jobChargeService.chargeStandalone(ctx, Math.max(1, documentCount));
+    }
+}
diff --git a/frontend/editor/src/core/hooks/useClassificationEnabled.ts b/frontend/editor/src/core/hooks/useClassificationEnabled.ts
index e5a2b48ff6..441b81cb45 100644
--- a/frontend/editor/src/core/hooks/useClassificationEnabled.ts
+++ b/frontend/editor/src/core/hooks/useClassificationEnabled.ts
@@ -1,10 +1,5 @@
-// Whether document classification (and everything it drives in the UI: the
-// Files-sidebar category grouping, per-file label chips, and the file-details
-// Classification section) is active in this build. Classification is a
-// SaaS-only feature gated on the AI engine, so core — and every build that
-// doesn't override this seam (proprietary, desktop, cloud) — returns false, and
-// none of that UI ever renders. The saas layer overrides it to track the AI
-// engine's enabled flag, so the feature shows up only on SaaS when AI is on.
+// Whether classification (sidebar grouping, label chips, file-details section)
+// is active in this build. Core has no classifier; proprietary overrides to true.
 
 export function useClassificationEnabled(): boolean {
   return false;
diff --git a/frontend/editor/src/core/tests/stubbed/classification-grouping.spec.ts b/frontend/editor/src/core/tests/stubbed/classification-grouping.spec.ts
new file mode 100644
index 0000000000..682d591804
--- /dev/null
+++ b/frontend/editor/src/core/tests/stubbed/classification-grouping.spec.ts
@@ -0,0 +1,47 @@
+import path from "path";
+import { test, expect } from "@app/tests/helpers/stub-test-base";
+import { uploadFiles } from "@app/tests/helpers/ui-helpers";
+
+// The sidebar groups files by the category in their `StirlingPDFClassification`
+// metadata; these specs exercise that seam with pre-labelled fixtures.
+
+const FIXTURES = path.join(
+  import.meta.dirname,
+  "../test-fixtures/classification",
+);
+
+const categoryHeaders = (page: import("@playwright/test").Page) =>
+  page.locator(".file-sidebar-group .file-sidebar-group-header");
+
+test("classified files group by category family in the sidebar", async ({
+  page,
+}) => {
+  await uploadFiles(page, [
+    path.join(FIXTURES, "classified_invoice.pdf"), // -> Financial
+    path.join(FIXTURES, "classified_nda.pdf"), // -> Legal
+    path.join(FIXTURES, "classified_resume.pdf"), // -> HR
+  ]);
+
+  // The backfill reads each file's classification metadata on idle and regroups;
+  // the category headers appear once it resolves (Playwright auto-retries).
+  const headers = categoryHeaders(page);
+  await expect(headers.filter({ hasText: "Financial" })).toBeVisible({
+    timeout: 15_000,
+  });
+  await expect(headers.filter({ hasText: "Legal" })).toBeVisible();
+  await expect(headers.filter({ hasText: "HR" })).toBeVisible();
+});
+
+test("an unclassified file is not placed in a category group", async ({
+  page,
+}) => {
+  // sample.pdf carries no StirlingPDFClassification metadata, so it must not
+  // create or join any category family group - it falls into the catch-all.
+  await uploadFiles(page, path.join(FIXTURES, "../sample.pdf"));
+
+  // Give the idle backfill a chance to run and (find nothing to) regroup.
+  await expect(page.locator(".file-sidebar-file-item")).toHaveCount(1);
+  await expect(
+    categoryHeaders(page).filter({ hasText: "Financial" }),
+  ).toHaveCount(0);
+});
diff --git a/frontend/editor/src/core/tests/stubbed/classification-heuristic-upload.spec.ts b/frontend/editor/src/core/tests/stubbed/classification-heuristic-upload.spec.ts
new file mode 100644
index 0000000000..223a2eae51
--- /dev/null
+++ b/frontend/editor/src/core/tests/stubbed/classification-heuristic-upload.spec.ts
@@ -0,0 +1,81 @@
+import path from "path";
+import { test, expect } from "@app/tests/helpers/stub-test-base";
+import { uploadFiles } from "@app/tests/helpers/ui-helpers";
+
+// A bulk upload must classify every file in the browser and group it - no file
+// may be stranded in "Other" by races between the upload wave and delivery.
+
+test.use({ autoGoto: false });
+
+const FIXTURES = path.join(
+  import.meta.dirname,
+  "../test-fixtures/classification/unlabelled",
+);
+
+/** The stored policy DefaultClassificationPolicySeeder writes for a new team. */
+const SEEDED_POLICY = {
+  id: "seeded-classification",
+  name: "Classification Policy",
+  owner: "system",
+  enabled: true,
+  trigger: null,
+  sourceIds: [],
+  steps: [{ operation: "/api/v1/ai/tools/classify-and-label", parameters: {} }],
+  output: {
+    type: "inline",
+    options: {
+      categoryId: "classification",
+      runOn: "upload",
+      mode: "new_version",
+      sources: ["editor"],
+      scopeTypes: [],
+      reviewerEmail: "",
+    },
+  },
+  teamId: 1,
+};
+
+test("a 10-file upload wave classifies every file into its group", async ({
+  page,
+}) => {
+  test.setTimeout(180_000);
+
+  await page.route("**/api/v1/policies", (route) =>
+    route.fulfill({ json: [SEEDED_POLICY] }),
+  );
+  await page.route("**/api/v1/policies/classify/meter", (route) =>
+    route.fulfill({ status: 202, body: "" }),
+  );
+  await page.goto("/", { waitUntil: "domcontentloaded", timeout: 120_000 });
+
+  await uploadFiles(
+    page,
+    [
+      "invoice_acme.pdf",
+      "bank_statement.pdf",
+      "purchase_order.pdf",
+      "nda_mutual.pdf",
+      "service_agreement.pdf",
+      "resume_jane_doe.pdf",
+      "cover_letter.pdf",
+      "offer_letter.pdf",
+      "generic_notes.pdf",
+      "spanish_contrato.pdf",
+    ].map((f) => path.join(FIXTURES, f)),
+  );
+
+  // Each group header is a collapsible button whose name carries the member count.
+  // Classification runs a few files per idle pass; wait for the full drain.
+  const header = (name: string, count: number) =>
+    page.getByRole("button", { name: `${name} ${count}`, exact: true });
+  await expect(header("Financial", 3)).toBeVisible({ timeout: 90_000 });
+  await expect(header("HR", 3)).toBeVisible({ timeout: 30_000 });
+  await expect(header("Legal", 2)).toBeVisible({ timeout: 30_000 });
+
+  // The regression: nothing classifiable may be stranded in Other - only the
+  // genuinely unlabellable pair (generic prose + non-English) belongs there.
+  await expect(header("Other", 2)).toBeVisible({ timeout: 30_000 });
+  // The filename can render in several places (Recent, group, viewer); any hit proves presence.
+  await expect(page.getByText("generic_notes.pdf").first()).toBeVisible();
+  await expect(page.getByText("spanish_contrato.pdf").first()).toBeVisible();
+});
diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/classified_invoice.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/classified_invoice.pdf
new file mode 100644
index 0000000000..185fb4cc81
--- /dev/null
+++ b/frontend/editor/src/core/tests/test-fixtures/classification/classified_invoice.pdf
@@ -0,0 +1,36 @@
+%PDF-1.4
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R >>
+endobj
+2 0 obj
+<< /Type /Pages /Kids [3 0 R] /Count 1 >>
+endobj
+3 0 obj
+<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Resources << /Font << /F1 5 0 R >> >> /Contents 4 0 R >>
+endobj
+4 0 obj
+<< /Length 38 >>
+stream
+BT /F1 24 Tf 72 720 Td (INVOICE) Tj ET
+endstream
+endobj
+5 0 obj
+<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>
+endobj
+6 0 obj
+<< /Title (Invoice) /StirlingPDFClassification ({"labels":["invoice"]}) >>
+endobj
+xref
+0 7
+0000000000 65535 f 
+0000000009 00000 n 
+0000000058 00000 n 
+0000000115 00000 n 
+0000000241 00000 n 
+0000000329 00000 n 
+0000000426 00000 n 
+trailer
+<< /Size 7 /Root 1 0 R /Info 6 0 R >>
+startxref
+516
+%%EOF
\ No newline at end of file
diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/classified_nda.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/classified_nda.pdf
new file mode 100644
index 0000000000..ec1eddb1ee
--- /dev/null
+++ b/frontend/editor/src/core/tests/test-fixtures/classification/classified_nda.pdf
@@ -0,0 +1,36 @@
+%PDF-1.4
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R >>
+endobj
+2 0 obj
+<< /Type /Pages /Kids [3 0 R] /Count 1 >>
+endobj
+3 0 obj
+<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Resources << /Font << /F1 5 0 R >> >> /Contents 4 0 R >>
+endobj
+4 0 obj
+<< /Length 55 >>
+stream
+BT /F1 24 Tf 72 720 Td (NON-DISCLOSURE AGREEMENT) Tj ET
+endstream
+endobj
+5 0 obj
+<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>
+endobj
+6 0 obj
+<< /Title (Non-Disclosure Agreement) /StirlingPDFClassification ({"labels":["nda"]}) >>
+endobj
+xref
+0 7
+0000000000 65535 f 
+0000000009 00000 n 
+0000000058 00000 n 
+0000000115 00000 n 
+0000000241 00000 n 
+0000000346 00000 n 
+0000000443 00000 n 
+trailer
+<< /Size 7 /Root 1 0 R /Info 6 0 R >>
+startxref
+546
+%%EOF
\ No newline at end of file
diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/classified_resume.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/classified_resume.pdf
new file mode 100644
index 0000000000..79a17e901b
--- /dev/null
+++ b/frontend/editor/src/core/tests/test-fixtures/classification/classified_resume.pdf
@@ -0,0 +1,36 @@
+%PDF-1.4
+1 0 obj
+<< /Type /Catalog /Pages 2 0 R >>
+endobj
+2 0 obj
+<< /Type /Pages /Kids [3 0 R] /Count 1 >>
+endobj
+3 0 obj
+<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Resources << /Font << /F1 5 0 R >> >> /Contents 4 0 R >>
+endobj
+4 0 obj
+<< /Length 47 >>
+stream
+BT /F1 24 Tf 72 720 Td (CURRICULUM VITAE) Tj ET
+endstream
+endobj
+5 0 obj
+<< /Type /Font /Subtype /Type1 /BaseFont /Helvetica /Encoding /WinAnsiEncoding >>
+endobj
+6 0 obj
+<< /Title (Curriculum Vitae) /StirlingPDFClassification ({"labels":["resume"]}) >>
+endobj
+xref
+0 7
+0000000000 65535 f 
+0000000009 00000 n 
+0000000058 00000 n 
+0000000115 00000 n 
+0000000241 00000 n 
+0000000338 00000 n 
+0000000435 00000 n 
+trailer
+<< /Size 7 /Root 1 0 R /Info 6 0 R >>
+startxref
+533
+%%EOF
\ No newline at end of file
diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/bank_statement.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/bank_statement.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..ad4ef7ab7b0d8579827dad75aaac5d67b44a63ef
GIT binary patch
literal 1535
zcmY!laB<T$)HCK%efj$1el9}=1BLvgEG`=xE`8_x(!3G{LoR*q%#>n<Xk(yMP%M|e
zZ)!?rqEmi_LbL%;#MIJM&&Wc-!o*O|!V)MOQdy9ypdXN!o?6UhXUCPAmjW`*2+3Ig
zg48_6<dV$%JgAup`fiye9twG-IXOTBKw5ngEAvZB6!iV`Ql0a2N^|od!o><8=LNwm
zaZW5r%*jtjvIgWtgzNK4Qu9iR6-*#{0uqaWT$l+#sm1xFMaikf3g*a0f-FZe52O`l
zo?B*4Noo<$tvQJ$sV=F>`6;Pf`aY?7=_MHoCYEL(UBx9usfoE<6?1ZfPv+e=5ZL=%
z``Lr$Xo((=uBe*gnB@+Q7M^Ptq`NK3+Gg}JD1_&K?eVBAQKNjB54xYzPCU3B>)^t(
ze0Mv~J9*6w6Id8iRC6|YcLqBNcTAr0L0}Wpv(;aJ{mh+xP%k=l_VTl4zgcds|M&5)
zGP76yLsyrITaU`)s!9Wn9qul=CFZ^0gG%f^cCiftdt6WKXh@&>e4FEeZI*kqx3`?H
za1l{gej3+SEOa^S+0PX{X7&#q!!A9^;@n(tP-C0cvK8H__ZID2v3Tv)^^UWc*4)=-
z-x<srHcdEUib_kjSX)L(&Bk5MmgQ}WZMN$^n)$JngXv6)mjI`bsxISF=7Z&-W-DT?
zsu`B=xiU5D^=1u~H*D@FZts}*xc%GjLnkM%IrfeFYu#;IZjSW1)rF$&=ab);2zJfB
z=PEUMMZTTvgZ#MgTk{uQ@O!#%^1BQnk;lQ4EL1Y@uukAniJyD+s_G%OaEEKF-Z?Gl
zQTaH<(csXoy;0#7JO8ukiE-}R#rKClrcg&UaJPoVFAm)~3G?2XvRz*v^*7&pV@1g~
zXK}9ONwRZt9~T(yEOqsLur%m};CuO~xej5XH-ro-KKRXwdKMRbxmS7nvB$Erq)Ki^
zH(d|ZzLA)osdu(=fg`(LGFvNavTew<e{O2mpLNHxo}I98@Ba0s>?)u{4vl(fayLav
zH%^Jgsc!kel&9~Jnp2iql9`;S>y)39!lmz;2TVkndFcxJ;hA}kdBvG90WSUE(xeh_
zMgnCgU=D=jDv&WqsnZO<EtFdT${O(G5AuSIjlP?q0?2p3Oz38$0CGVPFyZS56y+xe
zr<N#0>jR4u1^tlJ3ZQ>IbAh?Z2}(OdY0p?BA6Ot+;0(+=phCd~n7tG<T&#=?jLZzo
z4b2QJjf_oAqcoAURTQPBaTzFBav8vZf|;qQv8h6u0$j`x=u8k$$b*X+8UV{7G%+Is
zOm#*Um|_;Dz`_Mhucax5Izt0f3_A=BO)L?5ONtURb5e`IC2VkJRVvUM`a${mB?_Q2
z5*VzWd1?6ypnw6fT@<2ioQ>R!O%2V=&7EA0-JH#woJ}koEiFyV9nB1!44o|<?Fg#?
Yhk0>HVo?b==nRbvOt@54UH#p-03%lg<NyEw

literal 0
HcmV?d00001

diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/cover_letter.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/cover_letter.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..4b8d0f462ac47991cc80152ebf9bf73dfef2a63c
GIT binary patch
literal 1635
zcmbtUeNYr-7;nU{+2SJu6V!Sgy%6Qt-P_ycPA~F4^F)OXNj}nCj~7^7ckOP^4o%I_
z%)}ruVE|1!EJCy($ENWEP$A@+0r95H@dNOaQS*XvNHA>|0k4>;KYIUp_x-)^^Lsw_
z`8~3DgGr7@5s0kw_U|<a4luwkUx8>e2&(5DoB(hHjb+m8Ae9iWEK3k{0Ze0P9q$CG
zn23;SGD@KWDkUDJQj52XvQ|TY#?u+lj>N<ukV}*36h5?Zt0AYg3JlK;a01lC2y+4F
zU|EqsGM!In@eTo?aU9h1tYa1T1hxYyJj<XHJuT2IpW)+13h`<5oB%n&4wO%9;%S?B
z9AvOSJMXYrp&dl~QcBK!_$1RoJ`=+V&?d&p(gHL<E1w1tbUx%VgiNsrlw@TWY>-}s
zI7=M)+T3C+Xv@96nKugOeH}e#Z2Nic=!zM4OJ`JgT-FcU8qRwt`a#d+i5Ko{TAEi&
zG~ZiClzH#dKX#31*qR%ni3!j9?N@G0qTlBSyb-ZUw#^+$)ofs*e{taYZ_3)1hWYQP
z@}9gKa@_NxQ_=9V#m?WEUA{p+BDXnW+L@yC4a<^4$=9ZQ?=@c7*L9Mt*>~yDXMgzj
zd=hCjj+?cHUA(hxZ1D@;0MksDAOC*-@rbZ)xsET%S-9XkF4(zVe|!I_uyR(BJ*rOr
zg`*`uaCD;kJ~?UR+4|u3)@6S>DXD7vgp--!D|04X3O*QVt_msAo6TR9;#Tv9W9Qlq
z<n4X<(4}^@WuL0w)4BFgc;*j&0pt7Xu56tW+3NP+wyENpF=5A{t7nau8-GD+OQ(;2
zd16?0(dFicE%nEALDMR3wfEM(yL(<Q6Egh@8mpU_xSPleFn?5+;(4j^jj`d?3j>a-
zZibaSzw_GcO4%4Ky>by3Tj<UyAIW<(`G?DU)kWLMshj6~d)0FA9XQHe-MGK3d-dLZ
z#CQgEKIe{WafQ?sluj<}*^<z1z$?3C>((@8oUo=u`swAnO51~OoXeHx91NDLrq!f-
z+h?9=C3iLjmF<;#Zk_3-#_d_A%&wpfMpu32)YEgW8<JzgN8fzY+f|)(kxiM`Vc0e*
z^n#YZp5?82mCJeka#i%kYprkJNlrffsPE(MXA9h~{JF89GYbAh?%Hv&fj%6ZT+UW@
ze$dk7$ZBeRz&|#BIZ63e?~%}5MMu1Qj-2SoSM*$b{7gq6XOx6A&|U+QB7J&ON86!^
z7rPss3)wYLV63$GN7*z4HF9F3GF%2g7c-oevonJLf+jeY3;kl1BrB@?iE<?x9|chV
z?&beGkmNTcF)0O&1~uV8%1#uzNdcq?ETXv3cpGm`fC5NG#gPTjMbIhcYhEQPRyVNg
z2X^xkpA1w!4)mfvrNLtmB@Ct;W+^ZQg+=2OrdALnnG)e+=Cr|d1OsXW8(M%ONrD9F
zU<kv-Fr@{!Aq>aFS@#c2fenABPz}e_q&UF-Zi{2&uy;644)cL4l<KFpf{kWaXzQQi
z3Cvn3rh!^`UI5Y@7Rzep(s>{iM*22@R86#+QYk4VMX4w)rZwpdlu>IS2(8ITU^=bQ
b6!YIN`fF|%Xq(VqI-J0ih)iaTGa-KgSUE%G

literal 0
HcmV?d00001

diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/generic_notes.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/generic_notes.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..15dce23df49c255573ee2888e16f71373f345e1c
GIT binary patch
literal 1451
zcmbtUTTC2P7#2dnjF(y@#5CHTP*Kq=GqXEa-E3tqlijpjT%eU*t4?>%Zinv9l$}|+
ztF2aQV=<K2YK5AX7$MLgZI!BxU9F@IiVtd2<pI&)g=z`L7DcfEs%K!qu_XH7c{wxR
zIsf-x&iDU?6;8oK7F)2wvGIuyFcJ_z*;I>Jtr+f5;<5%v3|}h+Rp7UvBkx8GFNHx#
zv?~eVClEsObg`KO97Ps$JUXpPZiN7^5W`T#Y&HzaL7mQQpe^4D<&uCVDRP<<;DV&N
zfgF!S5P@#GPE0Cs4dCT6bSRN{RGx=bpoiyOaN-a(F`|SGZuAiUj$YQFtf_#Sx2X_g
z=y!p^3sof^3qTdHMoQhefloJG;1i^X24g7Jh^Rp)3@AZ};p?Cr);0r*H0xHX7K36G
zOB{;sBb8y|mfce`&$Fi<>~r_79@?@qc=24po}HimcsWRRdY<bj7#*2%zgwD(XZEL_
z+&+@ZUZdO_9}!O{FV;;}wGSQXwy*i-&CfQB`v(2m@L`{FZcEQqV%3l|^GoCR%O;hU
z4^v&)@mYGh`S{rM`lH*DzP8#2CN1k{2U-uFAIPw{-t%={cj>ZS!d|g0f1h%Hva)7Z
z&$b*l+i>ND<+(ZJm0xRWcP&f&cDC=v7FVq0<cjIXC!fLdCua7BOw_RbMEKwjuGXeo
zOEC|1q4m;c_w9$K%4S#3HdmkQem%eESj`(x-OxAMyJMoQiFxh7?wj+dls~JppAc8>
zy^vXOQ`z;~Gh9^HiM+S!io=2P59itb=xhA_<@OoxsfNLy>$^?l@lgJe)~2^_%lzn}
z(^s?Bl8w0S(RL|SR$bb5Z1ApC&kFU{6(1jtzU0o~hInEB7k7*gfA@7qukFlqkUMZ+
zUHQI8ayyD%9C$S=_gh$ZXEU~+F7lX?jiW!Et!{hATfL*^^RCAl&g9+QyQizC>Z|@g
zsi!lJy1pFK1(|-Pv@~hM8{0({3JOvQ?uL<is7V3QWLF|V40p-s!6i8i@C}k&BCFB@
zfZ>(#P1>C3b?KvSnePCd#-JqT-@W{Q2fB<GrK+c3wc-K^^z2Z>2xg#1;6)<ED`HBZ
z5^BJYqt*v_6-=OfJyE25dwO@Ich5#c2Asix1L<6EU?*w?aF6qTGht>3mShOtY@umi
zk-;nxgCUFnJVq=oz|gdX1|hJBktj@k0eKN42{bdV!OX<cduDDa#xnd8TaHDu;~GAm
zK}r1+BMHX9r^Q4m0%LR2uu^&gqBL-?qG&*$XQ-?mIivu+F#5L>_^l3_Vh9IM2^>N5
ptU$3Pf`cJ>ils|fj<686|GqI-b5#>#+Fa>K(oA55g|2b|`wLP@<!k@|

literal 0
HcmV?d00001

diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/invoice_acme.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/invoice_acme.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..e45470639f252af78f0d3fd17bbcfdf77a9d94b6
GIT binary patch
literal 1630
zcmbtUX-pJn7&gHujAFr1DuU^UW#tm)*c+FnyR)q9Rt^`nAfY<!ey$6<GrBtq3z1+W
zUMRuXl(xxML5fXLS|wW1YAsqXC|1EVUZtQ-JQ@+S4W*&SH(cFf(*Ef8XJ(%H-se5?
zK949%r%xag#hB>PPlIPM5)gnZD8y7M45v9a%L5X_->_L+AWw{bnes6_9a?ORmh*r-
z0wGeRG?7vOg@jC0DAC^)r5hl?vluIMVQMu7S&KkN`Os!=fUL&M+c<Wd6X1Fqp9WaB
z-Hr%^&}B?1=jH*P$wHd5yB+Kp>;gi0rimmp!!vfy>XSw&@$c$c9<sa(NXBBa7$^Fi
zU@$=!=XRQ*3&?#bh2%bbLg)ma-e%{a6V+;Gc&LMB&H^!f8Dy>edNc%5h;s2x$T%>M
z*YQpVdxr>09U896J+|5J^6b>d@TvEeJqy!s=lGwxysh@(`&)HMA)>a5AL`?l%&}|2
zjpFS?bMUZ{*1D*S`m?Q9`yQ*OhXxxX*PPGqPZ``(8TQew-2?v5<}Mn(_mWC=MxAo^
zZoc-9lEq(~vIcE?kaWLt;MTR_x+M)*K&Io&-s1k)Y<;ezQ8Fw0E9;t#@m?=IuPu|=
z75M9chBJENK~&((f#XeampdcgS`qDNFb14_xv}f%z{B=w3unj=e%hG&b60L`{<IoX
zZJ;WV-oZXk9`RET_5==jjOSvuoZf!rGh>zh-0DYjSG7>dt<{yLr23{A-<0Ki8NOxh
z+oI}Y3r^YU-a8WfVP&&)K~;QP*v$_@J68G~zs}O&(kkigl8ZYFZ%jX%k`OIch0Ag-
zUTk^yTD)a_Z;0{elC+yHW5jEc@b03Z_-=!f`Z_8wpl0U1W;=H1^Ng_MOB){@Z1(Q&
zZM$$M>cA1Q+0m2uJCjh@T`1qq8D5XQ(2&x&G|bSI{ae@JeEe`F);53Z>Q5lvgx?_6
z4wlC4x?(RjmVei+FFpUHxajbfjJ{{HsP?OVvC$(HduyK*&QphetZ6Sl8GSm@dF<PV
zLnk^kxe=oK`^yWSA1w+!B2nJ{F=jd0zi)QQj^KUQBbVbX`s%!+hZ>7L{jQvl<Er@;
zo6l=;`3!MqOi#!rzr}H<MgCzm_o6!ecV8b_ADGb_<7YL6M0=y?mgut9opjYE@I+%U
z2QBnwvXMmcN{GF>C?s!Q5$tRFJ~I8!X(uqnFM@`~H)~u?QlGWdGA^j+&|>3h&|VCA
zo0&<_a&`-br?O~AZLAgGZ`xQ5>#|J%7@qAe;74^Ts1*r(Otb=x&+^OuJ<I=3ASiEA
zT|x^g6|N_N&>hmao&rJzCZsDo%gLFuArJC!<W>M*0X?W+g9C|GJN~4{pN4#&4ir8K
zXe3R+b96|(AV!x&5tNLOlQKd{iKWuju|8oQCtQaSK#38P2gsySu@tNWlNgE06b@h~
zF_J(wHwB}J7w=Ju7cr#-75mRvl8_>Uoq~}PG_@%hB|$zlf$>hpW{1vE1JAaVLDU9r
z;y4}%7L3MfVApX#7>w|)19>VPsZAwmxrQW_Vp1WdWMa97P|y-uu29P4lwAGaH%4df
U;u$ADIy#b4Dlw5LHB*oM1?IpeUH||9

literal 0
HcmV?d00001

diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/nda_mutual.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/nda_mutual.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..ceece9ecdf87dbbb8c06760a1feaa6108aa41930
GIT binary patch
literal 1698
zcmbtVYfu$s7*0`#HlPs+2PpZxpd!ki-91-^taJ5-oWo_zAkpRU9a!A6i+lFaf$)}s
zjzwO=%M^;D3??#)kq%|3+;l8SKvEIKOUQ6JXlQsTr*;wOq%-xS{qyZU-}gSx`@Zu%
z?*^H4hFMrBfdqAS|9T3+fCR9KsYrM@f@)bi!vhRK7f?wy5KjnO(Mu3?Axxr34eJ2$
z5&@B^WTChcD5Y4aQYGxhW~4!Yn#g2mLuSuLAd@80;V!hsG{~sUJjF7DoB%aY{9M4;
zX<8r<LnFux*3JXe$UrSi+pWxV*apP(qK8DZBu~<8vWtwE;@{abJY;wqkUozwk(}^3
z#1IW_terDM8&J4XisCMOV(1W`fuecH3AxfF4|UMYCP4&^fJ`!<0^~B47-i!*NLmp`
zzCG^(*CO%Bew4B4y8}e-?Sf_1_`-bo?on}RQ<sxVkA@kzAir%V?rqntvE+MtY*U4`
zRm_RJ*`cqgQ}v*g+tciUTJA!j`+1p9QT%+fuMrePyr1a_J@*%P^gX#d*7D$L`}OL+
z{uPy32|j5LRz~?4YY+c1vb~^s>5<-X8}EGHvQ*ibOYDf;olrA1YGnHa1Dx#9I-|l@
zHb2A>(i6~1OK<O3<z{UhpL$q5w`5s%`sV3p<nA9<#g^h4=H~dz4;7)yPnDfUYJ1Bo
z7qyfIMpWG+s`A{Y?K#?QFZTF2&aKyR&DK3i$)6u%KHAkeQ#wX^yu9Q9r8|40;V0Fd
zPurtz{`i2Xx3V93Z=0X+^O>w8V;^r#-=BW4Xsy9HBBS};j%Q!yoS3yZw>7h}Yi8)C
z?EA-Wyl!nASLL<F(iHqd*2BrpCbir0(&Gunh7DfHp0|=R>RZd-jPx#=FwJ7}n&OP|
zxVYE9`P;2)%i?1DQz|BXkoY9;bgpSew~yDW6L(dn=4?5(QC~LaDe9)5#MT7yE6=eg
zz5nT!CB>t^A&+Dim4yY?jW%inQ!g#^r|KIoy%iASA5&oPZZwrFqBTT*;&1z!$8>^Y
z6I=Hl^o(71#&`XSrrV#@{j#!Q^cBSK@uke^pG-;oDzM?)+p7~yZL1Dp-VP^Sy1OfY
zv*z5dYs!b_;=E%@FGuh?KYLAWU+=TY*XBG5X^Zw>WmN18xRMfDon3gfys&Q}FvrpU
z?>KM$uG*uU`5L>|7&5M9LG#XDkmZzKZ|L_?I19J*^t@reIH807BEz}C?__x1*NGMD
zcLvrL?rK}@3HN!sciF0g@vPcICl+sbCGvFZ$;-ueeK$A9ktO|SWBwdbsQKPY^x@#`
z9CW12<!Wn48#J(jIncR~PKP{YCTD3_ItfAbjBw8>CK;gbQH+|gQ9}TN#@G}20k4aW
z7ly=h<BK#d29p1~%KsM--8<}1v4rq&)PMo8I$=&2a3E$7EqD_(ajZE8@*o}+CLTaz
zp+l&5o>efsW^mOGuJe|-RG@Sb&<gez=ax>G0ARW<442??i2{>LR5&4%#Ra>BIXGxR
zBtV5oh96-{$Osv*fME<1(i9)S3}cu?7?m$zxa8$?xbh_olVC!z|BS^jOeo+541ZY{
zBQO_To+Bw5asxks7%CGAWuVb4%L8$Y3vHdpSXdx7Mts+S_;6fnkP^67qr@Z{g;b@N
o>a|Llnoub<a)n&3R?q(L69YZB@g&C&v<@TW3M42<Z!{o(0j70dn*aa+

literal 0
HcmV?d00001

diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/offer_letter.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/offer_letter.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..9adce90b433a89dbc59aab3405a1ab35f07fe571
GIT binary patch
literal 1618
zcmbtUeNYr-7;j`~Y%?nZO+k1O5$KftxLfYdIhpQ*<8A=&JP5&)a5)xOxZ8!>y#l1h
zuSl~faK;a?lt2VC1(fmw(IUktZNL~x9ZZy&9HAQsFVB%^m#;3IsXu!Ed3S&B`}}^-
z^Um{oLW~;i3N%6th1|P8bRI$h0+{q1NTGmWHRGT;fI@IAmB9kDm_IV5LU25pK@lpZ
z0GJUT!R2@aCId1F8X=SOr-_AmB!G=X7Rf?UQ4mRI2y~bSts#%3l@^X-=t)ihYbj0#
zXouCx69}PkL?Pqg0BoR1HDh(y=n0qwLVBht5jDXPRwm0sMo97R>}igqITlDJVvK~H
z|D9qmku2k|TSyj2Jt+lo4?ZDuicd>fInvJOY9%;QLt2;&5`yDMI*ZE&xKu7gv7DVG
zY*4{|TSDxImB`C2&f|O4&)54jDrPNj|Gc8^h^u>k{q<_EWv6nH=J@cj)&q;Xw7$}Y
z_B;FBm(ZwN+mscSGj3y_>xH0RZ(@7XSFK#E-beH1W#@a~=c=QPg;D;lw4ve)e-8EE
zc0b4;OKgpCTQ=VcNY`{OQdfBEZ!e6p*XF}+=V1RYhR1Co`j2AfF6jCI?Rcir=^w|=
zDHpfpCVO{F)?1Q-t+9R`vqg!9?;c*-SS5M=<dOD{zOn}c8e`^A%}HBmXHP+cV^fpw
z)8*#avn6IPd|mq&*<bGw4X&Agx2mTX?c7?*T}rLhp3_wY_C9C2ve;>B=o5*;dL9ml
zMDv{YyFZrhrgm1Ol<IXmf@8EzS>F&XUcskNY;9}}+_#M=zvqUBQ_JW!<YxMYPql}O
zZgebMT1Lf(S3bqP8*}`pj^X06lR>X^tvIS^_dC2a+ckex{%17@z4MZq_wFd@CeD~w
zs&?&kwx|P#<w1|?bO(Mla4%&im!uGjl2W2eB%yPhBD$qtDO$j=u45PLn^*VLjQGW`
z-u#+x;LTGJBR38$&W+rq(9L76ZBKBz@h_`u4ds&We+$^yU2^CBx(lNR-x*OS<9>r%
zmOE+^U5c~E!cSW@gK^h)=SX3%SKE7MZ%T_R9SB=>H7DQyE%w{}xlR2?f1edPxBf@J
zMTbIbM~%xOMBQuN76n{el6KenxLS7N#o`U4{_D^E;Qfhn%aT9xdX!$lVMSN^TP}uP
z&DnGL*|k3RT<5dcsz+YUW6|+~Zzj8G(m}XKE2;>V)G~ZC!#dLX2FXztVugyaW<YQ>
z&G#imX90LEMJs8RngSp=!I935dsA>IZ|Vu73N#)KANlVp|6f3G+q9#E5)=wpivpoK
z-q%_T2pO1oFTqATV@V)6V21e#1>i)ofUj3?;|;2s+|`r2KGmZFnTLRyx1%s;G`wR$
zm}Vu0V3CLvjYQ;_7{}LzdxRC($xH|VatN7TAQH#LILHLk7|N$9EI?0VD8i4n85o8<
zc@L94iOI!$vHy%k5iwuD3=HM7n2BLx4_(eqP*&1DKC~04B9boyHZcqbgt5y%tDeqe
zfbcNFw+5IMm=aSeQ3O?Kl@g6yB~@dQxD>@D5~UcAR^e#Wf8Q8?bCx6Q-1yU>m`n<V
JghU&(&|fGAIoALH

literal 0
HcmV?d00001

diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/purchase_order.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/purchase_order.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..816ef625ab50e0871b5789155362a8aede241fdf
GIT binary patch
literal 1591
zcmbtUdr(wW7`J4EZX}tTEEaT97+?tQz59S&*uhwK7cpsZQBaZSvK*FmmV06EU3sWk
zjRZ9^@~W($i6XGsC}wz<fJ8vxKnfY-WI1AEBCm`HW@WH*d9~t9{n7d7obx;9`+bl3
zexFygO5;xkh%v9xu{-S;2?)R>9mW(23=d~4GzUlwf5Di{f_O1{(j{Pc6ihZ!N+t`$
z69|#Yr2!%tkV(h@nH;_D%}$2^kERTe#X>_dNGJ1jB0E}bI;6w&oROiIIRUOQaytQS
zF_{nnZ@QbxW-J`QwKNQ8OqMiy31$Hwo^HiSIK@#W#$e}$5AmPqX%5mH3nWW6(Ucio
zR~U4VWh`brWI>QUCGXshk2hW6(-=)0G^1Ee6bDsM&m=<(-wkO4mkOj(5pTtEW=N%B
zS!HQ4QS1kV;M{L<;}wpXReK&6u5W8;7^*LM(>-r~-Id}3U17fGi0xX$>&LRXDH)NY
z{d#I5fLwS<<=LO!Ja=H^_WRpBN_><pogX_#JmMvZc*oV#?UP@HH6Fw5bc)NP&kav^
z*+TlNn+B|7!qQhP^76t;VL)a|Jn2^}IV8Ml>DQd`jlFO|Qm`4j_jwoVUBl_Dr)@bI
zCk_ZC*o>S_dP`XM<9Ay#1gEbVvbw!tap9>AyLOHEL}Z^o`$Nq97c*~M-amQ7?DzY{
zhBW`&u9_PT)`KT|O)|wd`yLKS7`B1S9!G0ha)&OKcf97dXLMjzG(1ZV6x42M9CVxs
zd~8zd@X_XCb?dsPu5aoP^u$`rB~dP5p($z1!O^wh*ruCKlTF{=blQH%AdnYjzgi~v
zrK&maTxL($iyf^2t(p^Msa5;Ww8nl_6n~3K#9Jj53uh}k`{wF=+b${os45pHmwJxM
z*GKJeqfcIqn=HOlJrLaZS#IL_g%G{4CsBNg74;6d4VJjmuG0_Ir9>UwP*&;P?ERN^
zq*QQxWZM%%rrP%6Eer5)VYuz-ThB)l*0G?xi9)B1jRxJ7m%nTuY^!dZin#IaO!xSF
zeV=u!v&6e%-|^J;{0`5)$fDW1w#M{{PWsc<pPzlQE#29z<hJ^*`}YM}_MUjA*P}l;
z&bYninN0T29YvRZ8pzl9<h7)}mvMdCak4(+Z7n&aU)VT@xqRq1&WmHYWtL?kwd*$}
z#X=2(Iu_pvO-CSS)KmUS#*~cVY8o}4kv0H4&Pa#RtZ@av@EA)Hw<thfhDf<fYUF9`
zx;pURz5IU%yrfoT!>6E7;2IL}*&*?2M1YS#hXjL1n;Cr!<Ul-*#t^{w!Yq_;WExVT
za(NG5-Xjz2GLYFh2uGUZhlvWw68NZsMT97j2qFUsxkxOP9`v;{%QC|hi~w?sSY04c
zDiupX3RuNR6ehm_y^4_pnqO-$5%J(Zk?cWCPRQ5Vk_3t7*!_GYNuZ?GVE6gp%#_gt
z&5M&c#+U<98n}*OIKa<VRMtp3g#mnF__GScE7YPurHqs)!w6Iiv64VXRS=<3$<=CU
dkXR}Y{qG-(HD@`>%q^CVM3u$7ywq9^_BRf>E~o$i

literal 0
HcmV?d00001

diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/resume_jane_doe.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/resume_jane_doe.pdf
new file mode 100644
index 0000000000..be462dcc6c
--- /dev/null
+++ b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/resume_jane_doe.pdf
@@ -0,0 +1,90 @@
+%PDF-1.3
+%���
+1 0 obj
+<<
+/Count 1
+/Kids [3 0 R]
+/MediaBox [0 0 595.28 841.89]
+/Type /Pages
+>>
+endobj
+2 0 obj
+<<
+/OpenAction [3 0 R /FitH null]
+/PageLayout /OneColumn
+/Pages 1 0 R
+/Type /Catalog
+>>
+endobj
+3 0 obj
+<<
+/Contents 4 0 R
+/Parent 1 0 R
+/Resources 7 0 R
+/Type /Page
+>>
+endobj
+4 0 obj
+<<
+/Filter /FlateDecode
+/Length 685
+>>
+stream
+x�m�Os�0���{$�T���1�&��$%�LO�{	J,ɑd��}W��t
+3��}��V	�~��(�ݧ�.�cHREP�aV��a��1��
S(kL���7��|yn����O�w/���S壌
�P~��7�@�'zf�Ư��e� �������Q'C4ת���J8��P���o�_�}�p��؏JY�
������k�Vh�XtRr�O�R
��h��ZZ�v;nP=
+�h`'���#��
+*�z
퇖��p��<
+��3`Չ�&�`�|� �p�mQqG�,pUC�<�e%o˥e'H���J���%�8�N	���\=a��'Pjp�A+�`Q	m��A��26H�7P��Ӄ��>��� ��:#V�w��֡BOpgy~�4���Ҏz'Z��N��:��Q��f�d6;z89e�d����8���=��0�~h�6;A��]
�$�p��Dr�=�1���&ţ	q�������^�
wkmdHIHځ-�t!NY6
+��E#\�2ڒs�q�ˢي
+Of<*bV���mQ�ᦚ���T{�ԣyD�uEk�fɅr�%Ъ�NK4_ּ�lk�#/������m����[���"wȬ5�a�-�j���h�E����~�'p��@��^U�9\tjd�od�W�i�̉�I��p����E�zry�E�Xג8�/���'��l
+endstream
+endobj
+5 0 obj
+<<
+/BaseFont /Helvetica-Bold
+/Encoding /WinAnsiEncoding
+/Subtype /Type1
+/Type /Font
+>>
+endobj
+6 0 obj
+<<
+/BaseFont /Helvetica
+/Encoding /WinAnsiEncoding
+/Subtype /Type1
+/Type /Font
+>>
+endobj
+7 0 obj
+<<
+/Font <</F1 5 0 R
+/F2 6 0 R>>
+/ProcSet [/PDF /Text /ImageB /ImageC /ImageI]
+>>
+endobj
+8 0 obj
+<<
+/CreationDate (D:20260716092355Z)
+>>
+endobj
+xref
+0 9
+0000000000 65535 f 
+0000000015 00000 n 
+0000000102 00000 n 
+0000000205 00000 n 
+0000000285 00000 n 
+0000001042 00000 n 
+0000001144 00000 n 
+0000001241 00000 n 
+0000001338 00000 n 
+trailer
+<<
+/Size 9
+/Root 2 0 R
+/Info 8 0 R
+/ID [<7F4FFDD51531EF25A5301EAFCA4542A0><7F4FFDD51531EF25A5301EAFCA4542A0>]
+>>
+startxref
+1393
+%%EOF
diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/service_agreement.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/service_agreement.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..68c7db83529142c89892efce2743eeb231ec4607
GIT binary patch
literal 1659
zcmbtUdr%a094|1N*^mM=GadSYAoyY*cY6;7&bz(4kVhPMh&)Dd;g)0Z*u~pD1Q{j`
zLqKJUcsTNk6cl`<QKT3&WI!M_W#QnIgO5^B2@J;)U+p5$r8D(MzkhzapWpZU`99|R
z`T7{N`sJv<1o9cWaq9~R1qfghQ=xzW2qsuN!vhq8LuoSy;w8e9aUBGQQ)Zgfu$dqp
z5fEI7`(p~AkfQzyrSKY+l}-WJKw2mc3JQWK#w^ld4zv;J6r)b!X_lGf1hAgwg8^f=
zS_J~pHH^$+?L2@Z7>Z!6_B7@(%mFby<5UoW<Vh=QaR?)(_;>aUPcb|Pq>p_Jq)qsp
zVlYx1Yqup)9FRLwioqTDMAs=kJ#FPFn~<xO<S8wc#F{Ax4x<<gp8{kUB6@MWjUv;a
z%*wQqaIOM*DR1QNoNOM3UYG4j+Ur@Bv8YOxytm0|<Gz`pQN`g8MoulwSJhXpiW}}4
zyZ+9MwhOw%($ndGoP7J<fme&`^1Ti=8=^li?etntwE1gWwl{9;7&~3RBw>T8?f&?9
z40G|)nb6pv@_|DUh6mNfzty<sUkR;Jr8j)iqm4_i3;v3R`kvX@xW=`*ZY+h&y>l>?
zA3fHTpZ%kU--+^BU(O$YHZqrW^H|y8*-&w;^5cs;@HhGl^IR3TU3=Si%#O+)sdu|{
zZBA^6`NpbbsmqbZpY9gsUSBcTHK(+?{`S?>1-CrgakjD`;PQCG*O&c9JDoyW-#@k0
z_k)(v4gDEovkf1444>=I$*-}beAgG<N;-!)_q0^C_ZDi*>N_2sp(<!&^JwbLmBD2#
zC%^x!{M^#U)=%?V8Ukk;w|t8xXZe4)edieFx~pKTuXZzWEw1~u9#hKkI%FX7gcsgi
znlsQ4*Jj`TXkbt7?`etyhgIr@5k*9atgAxjRp`tT_CLW=BBv-%TTvIxwda{F{`<TP
z`=zRRzWoIWC1va9eG~OdNLKS;aP<7)(jc&4@ceUUHaUf6JMAADa*yqw{cd07_&qfm
z^K0OB<t}e`+K^GZ+aeFklawcN%MN+XJzqHH?nYf%+x+rq%I&hl+8?^#j9gT5xLa{H
zf3&Dy(segxFr%qf8jlPjLvIDnI^whLK+U$;BMaZ#t#aFmH!i&JNd3HJ;Naq;54}xS
zm(10@f+ci&m)$>K%X=^D_T2cQ)UC4D^JkN#cO~m`wrJDC)Cyv_!PCX;UAK9|@fT(s
zUGw1NfXcY7_@*eZ$+4T18tyQ&8j_>*tT6R(FlEi4cshw(u3@ca2-Y#e0Mm>Gz-wtn
z&2aP-0Kq1EB0nKwQObh)A1hj<aZrZr-=qBh0HQ3Xr6-mU5CH2@AXX<V06hl842**4
zV1tcKGEqE;hlN!J;3z6nsCRXmpk&SDO-$aa*Ev+6a0oyMx)m3aR**LE)2_e}Ooqr&
z8KT4_I3Bmy!7bB9B|`{MLdf(1G8~uSAQ?<!sF0?305grDh_C~nz%b-#J52F3rj!fa
z_@^(5$dylFs9b2u6Ly$fSc+2^ZzE|dWt-UUCVC4clmQ!AmIvZ~7TUU+NoIlA81Y*R
z;sX?jT#ic#nM^BHOC?fNqm#%a2rAX6b%aKvCxZUlVxs39Pulp2)}azi0r~joBJ|K-
Df4)rg

literal 0
HcmV?d00001

diff --git a/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/spanish_contrato.pdf b/frontend/editor/src/core/tests/test-fixtures/classification/unlabelled/spanish_contrato.pdf
new file mode 100644
index 0000000000000000000000000000000000000000..dc9a73c2d8254245e6cb734bdeb97fe6332ebd97
GIT binary patch
literal 1505
zcmY!laB<T$)HCK%efj$1el9}=1BLvgEG`=xE`8_x(!3G{LoR*q%#>n<Xk(yMP%M|e
zZ)!?rqEmi_LbL%;#MIJM&&Wc-!o*O|!V)MOQdy9ypdXN!o?6UhXUCPAmjW`*2+3Ig
zg48_6<dV$%JgAup`fiye9twG-IXOTBKw5ngEAvZB6!iV`Ql0a2N^|od!o><8=LNwm
zaZW5r%*jtjvIgWtgzNK4Qu9iR6-*#{0uqaWT$l+#sm1xFMaikf3g*a0f-FZe52O`l
zo?B*4Noo<$tvQJ$sV=F>`6;Pf`aY?7=_MHoCT3<JUBx9usfoE<6?1YYoz1&#Akgx@
zvdeatxZ4(?lXkm$nYK9OUb(;>@aR^8LzkJRWybt{&XHwvt~Kz9)Tce4eb@4D#fc-u
zp6~hNv#V;Rn$!zLx_#|iWtICh=mhK3?xiQ@uefINdt2o7+o5|GPVWl4ox8Oz^6#Ix
zwXe^Lue!g?y?=f2q)*PzJ><R4x1N~p$(cGmV$bC@n@TujcD|k&b^oj5*LfzBxf-q4
z&N<k*yu*3h9TwLg{60DQ=3Dr`{C>7S{9uLEiW1S;-z+3fD|$wm-dqxIUSjz|O!@A~
zIX*!PGJZL}4B^W6n0+8OyT*Ol<z>F?ey%~iRi7U*)p=`j2c~%jD#cVT{F9>pv7(&g
zp5YGBH}66{jutF$w<|9U5L?D*eJruo#qU_*fkmdV-LcH#7FO1eD%jUW=(!rQ*>&%c
z7xMGbWM;OJd1+Db>CndT-lt**UUq+2Qfs|q%3s?fi*#Jg?9GFwb=M07yC2hg8!XIF
z$}9HhY{9yQ=<-|B9zC19U7auZ&%`;M?>4`!UgD}|WI0J```njPOzQ<Sxnv|x{rbO9
z$lTew^U2Z^p952#N?kc3^3@|Vy(u_Y@495Gwa?odOSbI%d{A=3a?`JIk4t49+*+l`
zcVI`@Z*H5lB9}nP7#g|I1Z|3xGMo~NQ{D1`X-nTDHK#1KBr`ct*C{_Ig-hQx5133c
z^U@Xc!!z?7^NKTJ0$lpRrAZ~=tOCj~z&r-YHy~q>(w`ZATPU{xl=$HZ9OMNX8+|uJ
z1(5H6+04yI0px-pVA9qPD9TR`PAyT0)&~|C3i=_b6+r)b<^uDJ6O?v_(w?zMKCnQt
zz!{i3K-t~}n1K{DT&#=?jLZzo4b2QJjf_oAqcoAURTQPBaTzFBav8vZf|;qQv8h6u
z0$j`x=u8k$$b*X+8URZgG%+IsOm#*Um|_-2z~Tc<ucZ-&I-nI8b{HBOS|aq86eVWn
zq!xk8(BRCfRG>HXgYxrB6hNgQFjzhF(()BR0Rv*YC`8*hIXjyh85p>kSsJ()n46gx
sxw<(zyE&PdxjC5|n3+1;5mo^X^Wu`kq7rb>85)|KaH*=g`nz!f00k5J!vFvP

literal 0
HcmV?d00001

diff --git a/frontend/editor/src/portal/api/policies.ts b/frontend/editor/src/portal/api/policies.ts
index 1e2087537c..a26556f5a2 100644
--- a/frontend/editor/src/portal/api/policies.ts
+++ b/frontend/editor/src/portal/api/policies.ts
@@ -194,7 +194,6 @@ export const POLICY_CATEGORIES: PolicyCategory[] = [
     tone: "blue",
     desc: "portal.policies.categories.classification.desc",
     providesClassification: true,
-    requiresAiEngine: true,
   },
   {
     id: "compliance",
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyAutoRunController.tsx b/frontend/editor/src/proprietary/components/policies/PolicyAutoRunController.tsx
index 7c4e921943..7dee491d71 100644
--- a/frontend/editor/src/proprietary/components/policies/PolicyAutoRunController.tsx
+++ b/frontend/editor/src/proprietary/components/policies/PolicyAutoRunController.tsx
@@ -1,4 +1,5 @@
 import { usePolicyAutoRun } from "@app/components/policies/usePolicyAutoRun";
+import { useClientSideClassification } from "@app/components/policies/useClientSideClassification";
 
 /**
  * Headless controller that drives policy auto-run (enforce every enabled policy
@@ -7,5 +8,7 @@ import { usePolicyAutoRun } from "@app/components/policies/usePolicyAutoRun";
  */
 export function PolicyAutoRunController() {
   usePolicyAutoRun();
+  // Non-AI systems classify uploads in the browser; inert when the AI engine is on.
+  useClientSideClassification();
   return null;
 }
diff --git a/frontend/editor/src/proprietary/components/policies/useClientSideClassification.test.tsx b/frontend/editor/src/proprietary/components/policies/useClientSideClassification.test.tsx
new file mode 100644
index 0000000000..d399b09553
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/policies/useClientSideClassification.test.tsx
@@ -0,0 +1,255 @@
+// Delivery guarantees of the client-side classification hook, driving the real
+// policyRunStore and mocking only IO (storage, the heuristic engine, the meter).
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { renderHook, waitFor } from "@testing-library/react";
+import {
+  markDispatched,
+  resetPolicyRuns,
+} from "@app/components/policies/policyRunStore";
+
+interface TestStub {
+  id: string;
+  name: string;
+  lastModified: number;
+  derivedFromTool?: boolean;
+  classificationLabels?: string[];
+}
+
+const mocks = vi.hoisted(() => ({
+  workspace: [] as Array<{
+    id: string;
+    name: string;
+    lastModified: number;
+    derivedFromTool?: boolean;
+    classificationLabels?: string[];
+  }>,
+  configLoading: false,
+  updateStirlingFileStub: vi.fn(),
+  bumpRevision: vi.fn(),
+  getStirlingFile: vi.fn(),
+  updateFileMetadata: vi.fn(async (_id: string, _updates: unknown) => true),
+  classify: vi.fn(),
+  meter: vi.fn(),
+}));
+
+vi.mock("@app/contexts/AppConfigContext", () => ({
+  useAppConfig: () => ({ config: {}, loading: mocks.configLoading }),
+}));
+vi.mock("@app/hooks/useClassificationEnabled", () => ({
+  useClassificationEnabled: () => true,
+}));
+vi.mock("@app/hooks/useAiEngineEnabled", () => ({
+  useAiEngineEnabled: () => false,
+}));
+vi.mock("@app/hooks/usePolicies", () => ({
+  usePolicies: () => ({
+    policies: {
+      classification: {
+        configured: true,
+        status: "active",
+        backendId: "backend-classification",
+        sources: ["editor"],
+      },
+    },
+  }),
+}));
+vi.mock("@app/contexts/FileContext", () => ({
+  useAllFiles: () => ({ fileStubs: mocks.workspace }),
+  useFileManagement: () => ({
+    updateStirlingFileStub: mocks.updateStirlingFileStub,
+  }),
+}));
+vi.mock("@app/contexts/IndexedDBContext", () => ({
+  useIndexedDB: () => ({ bumpRevision: mocks.bumpRevision }),
+}));
+vi.mock("@app/services/fileStorage", () => ({
+  fileStorage: {
+    getStirlingFile: (id: string) => mocks.getStirlingFile(id),
+    updateFileMetadata: (id: string, updates: unknown) =>
+      mocks.updateFileMetadata(id, updates),
+  },
+}));
+vi.mock("@app/services/heuristic/heuristicClassification", () => ({
+  classifyFileHeuristically: (file: File) => mocks.classify(file),
+}));
+vi.mock("@app/services/classificationMeter", () => ({
+  meterClassificationRun: (payload: unknown) => mocks.meter(payload),
+}));
+
+import { useClientSideClassification } from "@app/components/policies/useClientSideClassification";
+
+// Run idle callbacks immediately so batches start without timer waits.
+vi.stubGlobal("requestIdleCallback", (cb: () => void) => {
+  cb();
+  return 1;
+});
+vi.stubGlobal("cancelIdleCallback", () => {});
+
+const stub = (id: string, extra: Partial<TestStub> = {}): TestStub => ({
+  id,
+  name: `${id}.pdf`,
+  lastModified: 1,
+  ...extra,
+});
+
+const fakeFile = (id: string) => new File([id], `${id}.pdf`);
+
+describe("useClientSideClassification delivery", () => {
+  beforeEach(() => {
+    localStorage.clear();
+    resetPolicyRuns();
+    mocks.workspace = [];
+    mocks.configLoading = false;
+    mocks.updateStirlingFileStub.mockClear();
+    mocks.bumpRevision.mockClear();
+    mocks.updateFileMetadata.mockClear();
+    mocks.meter.mockClear();
+    mocks.getStirlingFile.mockReset();
+    mocks.getStirlingFile.mockImplementation(async (id: string) =>
+      fakeFile(id),
+    );
+    mocks.classify.mockReset();
+  });
+
+  it("classifies pending uploads, writes labels, and meters once per file", async () => {
+    mocks.workspace = [stub("a"), stub("b")];
+    mocks.classify.mockImplementation(async (file: File) => ({
+      labels: [file.name.startsWith("a") ? "invoice" : "resume"],
+    }));
+
+    renderHook(() => useClientSideClassification());
+
+    await waitFor(() =>
+      expect(mocks.updateStirlingFileStub).toHaveBeenCalledTimes(2),
+    );
+    expect(mocks.updateStirlingFileStub).toHaveBeenCalledWith("a", {
+      classificationLabels: ["invoice"],
+    });
+    expect(mocks.updateStirlingFileStub).toHaveBeenCalledWith("b", {
+      classificationLabels: ["resume"],
+    });
+    expect(mocks.meter).toHaveBeenCalledTimes(2);
+    expect(mocks.bumpRevision).toHaveBeenCalled();
+  });
+
+  it("delivers a result computed while the effect re-fired mid-batch (upload-wave race)", async () => {
+    let resolveA!: (v: { labels: string[] }) => void;
+    const gateA = new Promise<{ labels: string[] }>((r) => (resolveA = r));
+    mocks.classify.mockImplementation((file: File) =>
+      file.name.startsWith("a") ? gateA : Promise.resolve({ labels: ["nda"] }),
+    );
+    mocks.workspace = [stub("a")];
+
+    const { rerender } = renderHook(() => useClientSideClassification());
+    await waitFor(() => expect(mocks.classify).toHaveBeenCalledTimes(1));
+
+    // A new upload mid-classify re-fires the effect and cancels the in-flight
+    // batch; a's already-computed result must still be delivered.
+    mocks.workspace = [stub("a"), stub("b")];
+    rerender();
+
+    resolveA({ labels: ["purchase-order"] });
+    await waitFor(() =>
+      expect(mocks.updateStirlingFileStub).toHaveBeenCalledWith("a", {
+        classificationLabels: ["purchase-order"],
+      }),
+    );
+    // The newly-arrived file classifies too, and neither is double-classified.
+    await waitFor(() =>
+      expect(mocks.updateStirlingFileStub).toHaveBeenCalledWith("b", {
+        classificationLabels: ["nda"],
+      }),
+    );
+    expect(mocks.classify).toHaveBeenCalledTimes(2);
+    expect(mocks.meter).toHaveBeenCalledTimes(2);
+  });
+
+  it("persists a definitive [] verdict for an unlabelled file and does not retry it", async () => {
+    mocks.workspace = [stub("plain")];
+    mocks.classify.mockResolvedValue({ labels: [] });
+
+    renderHook(() => useClientSideClassification());
+
+    await waitFor(() =>
+      expect(mocks.updateStirlingFileStub).toHaveBeenCalledWith("plain", {
+        classificationLabels: [],
+      }),
+    );
+    expect(mocks.classify).toHaveBeenCalledTimes(1);
+    expect(mocks.meter).toHaveBeenCalledTimes(1);
+  });
+
+  it("heals a previously-dispatched file whose result was lost, without re-metering", async () => {
+    // A past session classified + metered this file but the delivery was lost.
+    markDispatched("classification", "lost");
+    mocks.workspace = [stub("lost")];
+    mocks.classify.mockResolvedValue({ labels: ["bank-statement"] });
+
+    renderHook(() => useClientSideClassification());
+
+    await waitFor(() =>
+      expect(mocks.updateStirlingFileStub).toHaveBeenCalledWith("lost", {
+        classificationLabels: ["bank-statement"],
+      }),
+    );
+    expect(mocks.meter).not.toHaveBeenCalled();
+  });
+
+  it("leaves an unreadable file undelivered (no verdict, no meter) so it can retry", async () => {
+    // An extraction failure may be environmental, so it must never poison the
+    // file with a persisted verdict. The read path deliberately warns.
+    const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+    mocks.workspace = [stub("corrupt")];
+    mocks.classify.mockRejectedValue(new Error("bad pdf"));
+
+    renderHook(() => useClientSideClassification());
+
+    await waitFor(() =>
+      expect(warn).toHaveBeenCalledWith(
+        expect.stringContaining("corrupt.pdf: could not be read"),
+        expect.any(Error),
+      ),
+    );
+    expect(mocks.classify).toHaveBeenCalledTimes(1); // claimed: once per session
+    expect(mocks.updateStirlingFileStub).not.toHaveBeenCalled();
+    expect(mocks.updateFileMetadata).not.toHaveBeenCalled();
+    expect(mocks.meter).not.toHaveBeenCalled();
+    warn.mockRestore();
+  });
+
+  it("waits for app-config before classifying (AI flag unknown = possible double-run)", async () => {
+    // While the config loads, aiEnabled reads false even on an AI-on tenant; classifying
+    // then would race the server-side classify policy and double-bill the same files.
+    mocks.configLoading = true;
+    mocks.workspace = [stub("early")];
+    mocks.classify.mockResolvedValue({ labels: ["invoice"] });
+
+    const { rerender } = renderHook(() => useClientSideClassification());
+    await new Promise((r) => setTimeout(r, 50));
+    expect(mocks.classify).not.toHaveBeenCalled();
+
+    // Config resolves (AI stays off): the pending file classifies normally.
+    mocks.configLoading = false;
+    rerender();
+    await waitFor(() =>
+      expect(mocks.updateStirlingFileStub).toHaveBeenCalledWith("early", {
+        classificationLabels: ["invoice"],
+      }),
+    );
+  });
+
+  it("skips tool outputs and already-labelled files", async () => {
+    mocks.workspace = [
+      stub("derived", { derivedFromTool: true }),
+      stub("done", { classificationLabels: ["invoice"] }),
+      stub("verdict", { classificationLabels: [] }),
+    ];
+
+    renderHook(() => useClientSideClassification());
+
+    // Nothing to classify; give the (immediate) idle path a beat to prove it.
+    await new Promise((r) => setTimeout(r, 50));
+    expect(mocks.classify).not.toHaveBeenCalled();
+  });
+});
diff --git a/frontend/editor/src/proprietary/components/policies/useClientSideClassification.ts b/frontend/editor/src/proprietary/components/policies/useClientSideClassification.ts
new file mode 100644
index 0000000000..aac4b7e3da
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/policies/useClientSideClassification.ts
@@ -0,0 +1,207 @@
+// With the AI engine off, the Classification policy runs here in the browser:
+// each upload is labelled by the heuristic engine and metered for billing parity.
+
+import { useEffect, useRef, useState } from "react";
+import { useAllFiles, useFileManagement } from "@app/contexts/FileContext";
+import { useAppConfig } from "@app/contexts/AppConfigContext";
+import { useIndexedDB } from "@app/contexts/IndexedDBContext";
+import { fileStorage } from "@app/services/fileStorage";
+import { useClassificationEnabled } from "@app/hooks/useClassificationEnabled";
+import { useAiEngineEnabled } from "@app/hooks/useAiEngineEnabled";
+import { scheduleIdle } from "@app/utils/scheduleIdle";
+import { usePolicies } from "@app/hooks/usePolicies";
+import { classifyFileHeuristically } from "@app/services/heuristic/heuristicClassification";
+import { meterClassificationRun } from "@app/services/classificationMeter";
+import {
+  isDispatched,
+  markDispatched,
+} from "@app/components/policies/policyRunStore";
+import type { FileId } from "@app/types/file";
+import type { StirlingFile, StirlingFileStub } from "@app/types/fileContext";
+
+/** The category id of the Classification policy (see policyDefinitions). */
+const CLASSIFICATION_CATEGORY = "classification";
+/** Files classified per idle pass, so a large library drains over several ticks. */
+const CLASSIFY_BATCH = 3;
+/** How long to wait for an upload's bytes to land in IndexedDB (20 × 250ms ≈ 5s).
+ *  The stub can surface in the file list a beat before its bytes are committed. */
+const FILE_WAIT_TRIES = 20;
+const FILE_WAIT_MS = 250;
+
+/** localStorage flag: set to "true" for a full per-file scoring breakdown in the console. */
+const DEBUG_FLAG = "stirling-classification-debug";
+
+function isClassificationDebug(): boolean {
+  try {
+    return localStorage.getItem(DEBUG_FLAG) === "true";
+  } catch {
+    return false;
+  }
+}
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export function useClientSideClassification(): void {
+  const { fileStubs } = useAllFiles();
+  const { updateStirlingFileStub } = useFileManagement();
+  const { bumpRevision } = useIndexedDB();
+  const { policies } = usePolicies();
+  const classificationEnabled = useClassificationEnabled();
+  const aiEnabled = useAiEngineEnabled();
+  // While app-config loads, aiEnabled reads false even on AI-on tenants; classifying
+  // in that window would double-run (and double-bill) files the server also labels.
+  const { loading: configLoading } = useAppConfig();
+  // Files claimed this session, keyed id+lastModified so a new version is retried once. A claim is
+  // taken synchronously right before classifying, so overlapping batches never double-classify.
+  const claimed = useRef<Set<string>>(new Set());
+  // Bumped after each batch to drain the next one.
+  const [tick, setTick] = useState(0);
+
+  const policy = policies[CLASSIFICATION_CATEGORY];
+  // Only when the admin has an active Classification policy - the same gate the AI path uses.
+  const active = Boolean(
+    policy?.configured &&
+    policy.status === "active" &&
+    policy.backendId &&
+    (!policy.sources ||
+      policy.sources.length === 0 ||
+      policy.sources.includes("editor")),
+  );
+
+  useEffect(() => {
+    if (configLoading || !classificationEnabled || aiEnabled || !active) {
+      return;
+    }
+    const claimKey = (s: StirlingFileStub) =>
+      `${s.id as string}:${s.lastModified ?? 0}`;
+    // null labels = never delivered, retried here; [] = definitive no-label verdict.
+    const pending = fileStubs
+      .filter(
+        (s) =>
+          !s.derivedFromTool &&
+          s.classificationLabels == null &&
+          !claimed.current.has(claimKey(s)),
+      )
+      .slice(0, CLASSIFY_BATCH);
+    if (pending.length === 0) return;
+    let cancelled = false;
+    const cancelIdle = scheduleIdle(() => {
+      // Superseded before starting: the newer effect instance owns the queue.
+      if (cancelled) return;
+      void (async () => {
+        let wrote = false;
+        for (const stub of pending) {
+          const key = claimKey(stub);
+          // Re-validate at execution time - another batch may have claimed it since.
+          if (claimed.current.has(key)) continue;
+          claimed.current.add(key);
+          const labels = await classifyStub(stub.id as FileId, stub.name);
+          // Bytes never landed (file removed mid-wait): leave undelivered so a
+          // reload (or new version) retries; the claim stops churn this session.
+          if (labels == null) continue;
+          // Deliver unconditionally - a re-render must never discard a computed
+          // (and already metered) result. Writes are idempotent.
+          updateStirlingFileStub(stub.id as FileId, {
+            classificationLabels: labels,
+          });
+          const ok = await fileStorage.updateFileMetadata(stub.id as FileId, {
+            classificationLabels: labels,
+          });
+          if (ok) wrote = true;
+        }
+        if (wrote) bumpRevision();
+        // Drain the next batch; the terminal pass finds nothing pending and stops.
+        setTick((n) => n + 1);
+      })();
+    });
+    return () => {
+      cancelled = true;
+      cancelIdle();
+    };
+  }, [
+    fileStubs,
+    active,
+    classificationEnabled,
+    aiEnabled,
+    configLoading,
+    updateStirlingFileStub,
+    bumpRevision,
+    tick,
+  ]);
+}
+
+/** Classify one file, metering exactly once; null = no verdict, retried later. */
+async function classifyStub(
+  fileId: FileId,
+  fileName: string,
+): Promise<string[] | null> {
+  let file: StirlingFile | null = null;
+  for (let i = 0; i < FILE_WAIT_TRIES; i++) {
+    file = await fileStorage.getStirlingFile(fileId).catch(() => null);
+    if (file) break;
+    await delay(FILE_WAIT_MS);
+  }
+  if (!file) {
+    console.warn(
+      `[Classify] ${fileName}: bytes never arrived in storage; will retry on next load`,
+    );
+    return null;
+  }
+  const debug = isClassificationDebug();
+  const startedAt = performance.now();
+  try {
+    const result = await classifyFileHeuristically(file, { explain: debug });
+    const { labels } = result;
+    const alreadyMetered = isDispatched(CLASSIFICATION_CATEGORY, fileId);
+    const ms = Math.round(performance.now() - startedAt);
+    const verdict =
+      labels.length > 0
+        ? labels.join(", ")
+        : result.isEnglish
+          ? "no label"
+          : "no label (not English)";
+    console.debug(
+      `[Classify] ${fileName} -> ${verdict} (${result.confidence}, score ${result.score}, ${ms}ms)` +
+        (alreadyMetered ? " [heal: not re-metered]" : ""),
+    );
+    if (debug && result.explain) logExplanation(fileName, result);
+    // Meter on the first classification only; a healing re-run of an undelivered
+    // result (already dispatched) is not a new billable run.
+    if (!alreadyMetered) {
+      meterClassificationRun({
+        policyName: "Classification",
+        documentCount: 1,
+        labels,
+      });
+    }
+    markDispatched(CLASSIFICATION_CATEGORY, fileId);
+    return labels;
+  } catch (err) {
+    // Never persist a verdict for an unreadable file - the failure may be
+    // environmental, so it must stay eligible to retry (and meter) later.
+    console.warn(`[Classify] ${fileName}: could not be read, will retry`, err);
+    return null;
+  }
+}
+
+/** Full scoring breakdown, one collapsed console group per file (debug flag only). */
+function logExplanation(
+  fileName: string,
+  result: Awaited<ReturnType<typeof classifyFileHeuristically>>,
+): void {
+  const ex = result.explain;
+  if (!ex) return;
+  console.groupCollapsed(
+    `[Classify] ${fileName} scoring (english=${ex.isEnglish}, lowText=${ex.lowText})`,
+  );
+  if (ex.candidates.length === 0) {
+    console.log("no label scored above zero");
+  }
+  for (const c of ex.candidates) {
+    console.log(
+      `${c.id}${c.emit ? "" : " (suppressed)"}: score ${c.score}, ${c.distinct} distinct signals`,
+    );
+    for (const s of c.signals) console.log(`  ${s}`);
+  }
+  console.groupEnd();
+}
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.batch.test.tsx b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.batch.test.tsx
index e936d97d00..5837bfb285 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.batch.test.tsx
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.batch.test.tsx
@@ -47,6 +47,11 @@ const mocks = vi.hoisted(() => ({
   consumeFiles: vi.fn(),
 }));
 
+// Classification chains server-side only when the AI engine is on (else it runs
+// client-side); this batch exercises the server chain, so force the engine on.
+vi.mock("@app/hooks/useAiEngineEnabled", () => ({
+  useAiEngineEnabled: () => true,
+}));
 vi.mock("@app/contexts/FileContext", () => ({
   useAllFiles: () => ({ fileStubs: mocks.workspace }),
   useFileManagement: () => ({
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.chain.test.tsx b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.chain.test.tsx
index b2c2d6f5dc..b87cbda445 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.chain.test.tsx
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.chain.test.tsx
@@ -4,6 +4,12 @@ import { renderHook, act } from "@testing-library/react";
 // Two active upload policies, so the auto-run should CHAIN them: fire the first on
 // the upload, then the second on the first's output. Stub the contexts + network so
 // we can drive the dispatch against the REAL run store.
+// Controllable AI-engine flag: on by default so classification chains server-side; one
+// test flips it off to assert classification is kept OUT of the server chain.
+const aiEnabled = vi.hoisted(() => ({ value: true }));
+vi.mock("@app/hooks/useAiEngineEnabled", () => ({
+  useAiEngineEnabled: () => aiEnabled.value,
+}));
 const fileStubs: { id: string; name: string; derivedFromTool?: boolean }[] = [];
 vi.mock("@app/contexts/FileContext", () => ({
   useAllFiles: () => ({ fileStubs }),
@@ -66,6 +72,7 @@ beforeEach(() => {
   localStorage.clear();
   resetPolicyRuns();
   setFileStubs([]);
+  aiEnabled.value = true;
   runStored.mockReset();
   getFile.mockReset();
   getFile.mockResolvedValue({ size: 100 } as never);
@@ -116,4 +123,23 @@ describe("auto-run ordered chaining", () => {
     // The next policy (order 1) fires on the first policy's output, not the original.
     expect(runStored).toHaveBeenCalledWith("backend-cls", [{ size: 100 }]);
   });
+
+  it("keeps classification out of the server chain when the AI engine is off", async () => {
+    // AI off: classification runs client-side (useClientSideClassification), so the
+    // server chain must skip it - only the normal (security) policy dispatches.
+    aiEnabled.value = false;
+    setFileStubs([{ id: "file-1", name: "doc.pdf" }]);
+    runStored.mockResolvedValue("run-sec");
+
+    renderHook(() => usePolicyAutoRun());
+    await act(async () => {
+      await vi.advanceTimersByTimeAsync(1);
+    });
+
+    expect(runStored).toHaveBeenCalledWith("backend-sec", [{ size: 100 }]);
+    expect(runStored).not.toHaveBeenCalledWith(
+      "backend-cls",
+      expect.anything(),
+    );
+  });
 });
diff --git a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
index a876a785ff..ca096b6792 100644
--- a/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
+++ b/frontend/editor/src/proprietary/components/policies/usePolicyAutoRun.ts
@@ -42,6 +42,7 @@ import { readClassificationLabelsFromFile } from "@app/services/fileClassificati
 import type { StirlingFile, StirlingFileStub } from "@app/types/fileContext";
 import type { PoliciesByCategory } from "@app/types/policies";
 import { usePolicies } from "@app/hooks/usePolicies";
+import { useAiEngineEnabled } from "@app/hooks/useAiEngineEnabled";
 import {
   addReconciledRun,
   dispatchKey,
@@ -128,6 +129,7 @@ export function usePolicyAutoRun(): void {
   const { consumeFiles } = useFileContext();
   const { bumpRevision } = useIndexedDB();
   const { policies } = usePolicies();
+  const aiEnabled = useAiEngineEnabled();
   const runs = usePolicyRuns();
   // Live view of the workspace files, read inside the import effect WITHOUT making
   // it a dependency. The silent consume that delivers an output mutates fileStubs,
@@ -161,18 +163,21 @@ export function usePolicyAutoRun(): void {
     () =>
       Object.entries(policies)
         .filter(
-          ([, s]) =>
+          ([id, s]) =>
             s.configured &&
             s.status === "active" &&
             s.backendId &&
             (!s.sources ||
               s.sources.length === 0 ||
               s.sources.includes("editor")) &&
-            (s.runOn ?? "upload") === "upload",
+            (s.runOn ?? "upload") === "upload" &&
+            // Non-AI systems classify in the browser (useClientSideClassification), so keep the
+            // Classification policy out of the server chain when the AI engine is off.
+            !(id === "classification" && !aiEnabled),
         )
         .sort(([, a], [, b]) => (a.order ?? 0) - (b.order ?? 0))
         .map(([id]) => id),
-    [policies],
+    [policies, aiEnabled],
   );
 
   // Runs whose chain-continuation we've already handled this session, so the next
diff --git a/frontend/editor/src/saas/components/shared/FileSidebarGroupControls.css b/frontend/editor/src/proprietary/components/shared/FileSidebarGroupControls.css
similarity index 100%
rename from frontend/editor/src/saas/components/shared/FileSidebarGroupControls.css
rename to frontend/editor/src/proprietary/components/shared/FileSidebarGroupControls.css
diff --git a/frontend/editor/src/saas/components/shared/FileSidebarGroupControls.tsx b/frontend/editor/src/proprietary/components/shared/FileSidebarGroupControls.tsx
similarity index 100%
rename from frontend/editor/src/saas/components/shared/FileSidebarGroupControls.tsx
rename to frontend/editor/src/proprietary/components/shared/FileSidebarGroupControls.tsx
diff --git a/frontend/editor/src/saas/components/shared/fileSidebarGrouping.test.ts b/frontend/editor/src/proprietary/components/shared/fileSidebarGrouping.test.ts
similarity index 100%
rename from frontend/editor/src/saas/components/shared/fileSidebarGrouping.test.ts
rename to frontend/editor/src/proprietary/components/shared/fileSidebarGrouping.test.ts
diff --git a/frontend/editor/src/saas/components/shared/fileSidebarGrouping.tsx b/frontend/editor/src/proprietary/components/shared/fileSidebarGrouping.tsx
similarity index 71%
rename from frontend/editor/src/saas/components/shared/fileSidebarGrouping.tsx
rename to frontend/editor/src/proprietary/components/shared/fileSidebarGrouping.tsx
index 659efbdf31..baf3d812cb 100644
--- a/frontend/editor/src/saas/components/shared/fileSidebarGrouping.tsx
+++ b/frontend/editor/src/proprietary/components/shared/fileSidebarGrouping.tsx
@@ -1,4 +1,5 @@
-// Classification override of the Files-sidebar grouping seam: Recent, one group per VISIBLE category (the fixed, shared label families; each can be hidden device-local), then Other for files in none of those. Labels are cached on the stub via a lazy metadata backfill so grouping stays cheap.
+// Classification override of the Files-sidebar grouping seam: Recent, one group
+// per visible category, then Other. Labels cache onto stubs via a lazy backfill.
 
 import {
   useEffect,
@@ -18,6 +19,7 @@ import {
   subscribeSidebarCategories,
 } from "@app/services/fileSidebarCategories";
 import { buildLabelGroups } from "@app/components/shared/fileSidebarGroupingLogic";
+import { scheduleIdle } from "@app/utils/scheduleIdle";
 import type { FileId } from "@app/types/file";
 import type { StirlingFileStub } from "@app/types/fileContext";
 import type { FileSidebarGroup } from "@core/components/shared/fileSidebarGrouping";
@@ -36,33 +38,22 @@ const BACKFILL_BATCH = 3;
 /** Recheck delay when the backfill yields to an active policy wave. */
 const BACKFILL_BUSY_RETRY_MS = 4000;
 
-/** Schedule work for the browser's idle time (or soon after, as a fallback). */
-function scheduleIdle(task: () => void): () => void {
-  if (typeof requestIdleCallback === "function") {
-    const handle = requestIdleCallback(task, { timeout: 2000 });
-    return () => cancelIdleCallback(handle);
-  }
-  const timer = window.setTimeout(task, 200);
-  return () => window.clearTimeout(timer);
-}
-
 export function useFileSidebarGroups(
   stubs: StirlingFileStub[],
 ): FileSidebarGroup[] | null {
   const { t } = useTranslation();
-  // Classification off (AI disabled) → no grouping at all: return the flat list
-  // like core, and don't fetch team labels or backfill from metadata. Gates the
-  // whole feature so an AI-off SaaS tenant sees no Recent/Other/category chrome.
+  // Classification off (core): flat list, no category fetch or backfill.
   const enabled = useClassificationEnabled();
   const { bumpRevision } = useIndexedDB();
-  // Attempted reads keyed by id+lastModified: a re-classified file (new version bumps lastModified) is re-read and leaves "Other" on its own, while a truly-unlabelled file keeps a stable key and is read once.
+  // Reads keyed by id+lastModified, so a new file version is re-read exactly once.
   const attempted = useRef<Set<string>>(new Set());
   const attemptKey = (s: StirlingFileStub) =>
     `${s.id as string}:${s.lastModified ?? 0}`;
   // Bumped to re-attempt a backfill pass that yielded to an active policy wave.
   const [retryTick, setRetryTick] = useState(0);
 
-  // Fallback for files that arrive with labels already in metadata but no policy delivery (imports/shares): read+cache a few per idle pass, yielding while a policy wave is in flight since those stubs get stamped on delivery anyway.
+  // Backfill labels from file metadata onto stubs, a few per idle pass; yields
+  // while a policy wave is in flight. The heuristic path stamps stubs directly.
   useEffect(() => {
     if (!enabled) return;
     const pending = stubs
@@ -75,7 +66,8 @@ export function useFileSidebarGroups(
     let retryTimer: number | undefined;
     const cancelIdle = scheduleIdle(() => {
       if (cancelled) return;
-      // Deliveries stamp labels during a wave, so reading now is wasted parsing; recheck after it (a timer self-heals when a wave ends without a stubs change).
+      // Reading during a wave is wasted parsing; recheck after it. The timer
+      // self-heals when a wave ends without a stubs change.
       if (hasInFlightPolicyRuns()) {
         retryTimer = window.setTimeout(() => {
           if (!cancelled) setRetryTick((n) => n + 1);
@@ -85,9 +77,9 @@ export function useFileSidebarGroups(
       void (async () => {
         let wrote = false;
         for (const stub of pending) {
-          attempted.current.add(attemptKey(stub));
           const labels = await readStubClassificationLabels(stub);
           if (cancelled) return;
+          attempted.current.add(attemptKey(stub));
           if (labels) {
             const ok = await fileStorage.updateFileMetadata(stub.id as FileId, {
               classificationLabels: labels,
diff --git a/frontend/editor/src/saas/components/shared/fileSidebarGroupingLogic.ts b/frontend/editor/src/proprietary/components/shared/fileSidebarGroupingLogic.ts
similarity index 100%
rename from frontend/editor/src/saas/components/shared/fileSidebarGroupingLogic.ts
rename to frontend/editor/src/proprietary/components/shared/fileSidebarGroupingLogic.ts
diff --git a/frontend/editor/src/proprietary/data/policyDefinitions.tsx b/frontend/editor/src/proprietary/data/policyDefinitions.tsx
index f3377c028e..e725dff68b 100644
--- a/frontend/editor/src/proprietary/data/policyDefinitions.tsx
+++ b/frontend/editor/src/proprietary/data/policyDefinitions.tsx
@@ -43,8 +43,6 @@ export const POLICY_CATEGORIES: PolicyCategory[] = [
     label: "Classification",
     icon: policyCategoryIcon("classification", ICON_SX),
     desc: "Identify each document's type on upload and tag its metadata for filing and search.",
-    // Needs the AI engine to classify; hidden from the policy list when it's off.
-    requiresAiEngine: true,
   },
   {
     id: "compliance",
diff --git a/frontend/editor/src/proprietary/hooks/useClassificationEnabled.ts b/frontend/editor/src/proprietary/hooks/useClassificationEnabled.ts
new file mode 100644
index 0000000000..bf37cf40da
--- /dev/null
+++ b/frontend/editor/src/proprietary/hooks/useClassificationEnabled.ts
@@ -0,0 +1,6 @@
+// Classification is available on every proprietary-based build: the classify
+// policy labels server-side with AI on, the in-browser heuristic labels with AI off.
+
+export function useClassificationEnabled(): boolean {
+  return true;
+}
diff --git a/frontend/editor/src/proprietary/services/classificationMeter.ts b/frontend/editor/src/proprietary/services/classificationMeter.ts
new file mode 100644
index 0000000000..036b7ef242
--- /dev/null
+++ b/frontend/editor/src/proprietary/services/classificationMeter.ts
@@ -0,0 +1,27 @@
+// Meters an in-browser (non-AI) classification run for billing/audit parity with
+// the server-side classify path. Fire-and-forget; failures never block the user.
+
+import apiClient from "@app/services/apiClient";
+import { getPolicyOutputBaseUrl } from "@app/services/policyOutputBaseUrl";
+import { resolvePolicyRunTarget } from "@app/services/policyApi";
+
+interface ClassifyMeterPayload {
+  /** Policy name for the audit-trail label; defaults to "Classification" server-side. */
+  policyName?: string;
+  /** Documents covered by this meter call (defaults to 1 server-side). */
+  documentCount?: number;
+  /** Resolved labels, carried for the audit record. */
+  labels?: string[];
+}
+
+/** Meter a completed client-side classification. Does not throw and is not awaited by callers. */
+export function meterClassificationRun(payload: ClassifyMeterPayload): void {
+  const base = getPolicyOutputBaseUrl(resolvePolicyRunTarget());
+  void apiClient
+    .post(`${base}/api/v1/policies/classify/meter`, payload, {
+      suppressErrorToast: true,
+    })
+    .catch(() => {
+      // Best-effort billing; the classification already succeeded in the browser.
+    });
+}
diff --git a/frontend/editor/src/proprietary/services/heuristic/heuristicClassification.ts b/frontend/editor/src/proprietary/services/heuristic/heuristicClassification.ts
new file mode 100644
index 0000000000..180d7ea409
--- /dev/null
+++ b/frontend/editor/src/proprietary/services/heuristic/heuristicClassification.ts
@@ -0,0 +1,18 @@
+// Client-side classification entry point: load rules, extract the PDF, classify.
+
+import {
+  ensureRulesLoaded,
+  classifyHeuristic,
+} from "@app/services/heuristic/heuristicEngine";
+import { extractHeuristicDoc } from "@app/services/heuristic/heuristicExtractor";
+import type { HeuristicResult } from "@app/services/heuristic/types";
+
+/** Classify a file in the browser. Throws if extraction fails (unreadable / non-PDF). */
+export async function classifyFileHeuristically(
+  file: File,
+  opts?: { explain?: boolean },
+): Promise<HeuristicResult> {
+  await ensureRulesLoaded();
+  const doc = await extractHeuristicDoc(file, file.name);
+  return classifyHeuristic(doc, opts);
+}
diff --git a/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.corpus.test.ts b/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.corpus.test.ts
new file mode 100644
index 0000000000..db63823212
--- /dev/null
+++ b/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.corpus.test.ts
@@ -0,0 +1,2423 @@
+// Broad-corpus accuracy gate: one realistic, natural-prose specimen per document
+// type, asserted on the real engine + rules pack.
+
+import { beforeAll, describe, expect, it } from "vitest";
+import {
+  classifyHeuristic,
+  ensureRulesLoaded,
+} from "@app/services/heuristic/heuristicEngine";
+import type { HeuristicDoc } from "@app/services/heuristic/types";
+
+beforeAll(async () => {
+  await ensureRulesLoaded();
+});
+
+interface Case {
+  /** Expected top label; "" asserts the document stays unlabelled. */
+  expect: string;
+  file: string;
+  pages?: number;
+  /** Replace every space with U+00A0, as some pdf.js text layers do. */
+  nbsp?: boolean;
+  /** Info-dict metadata (lowercase keys), e.g. a generator's producer string. */
+  meta?: Record<string, string>;
+  title: string;
+  body: string[];
+}
+
+const run = (c: Case) => {
+  let body = c.body.join("\n");
+  let title = c.title;
+  if (c.nbsp) {
+    body = body.replace(/ /g, "\u00A0");
+    title = title.replace(/ /g, "\u00A0");
+  }
+  const doc: HeuristicDoc = {
+    fileName: c.file,
+    pageCount: c.pages ?? 1,
+    meta: c.meta ?? {},
+    titleZone: title,
+    firstZone: body,
+    allZone: body,
+  };
+  return classifyHeuristic(doc);
+};
+
+const CASES: Case[] = [
+  {
+    expect: "invoice",
+    file: "2024-014.pdf",
+    title: "Invoice",
+    body: [
+      "Invoice",
+      "Jane Mills Design, 14 Fern Road, Bristol BS1 5TR",
+      "Invoice #: 2024-014    Date: 3 May 2024",
+      "Bill To: Harbour Cafe Ltd",
+      "Logo refresh and brand guidelines ... $950.00",
+      "Menu redesign (2 rounds) ... $250.00",
+      "Total: $1,200.00",
+      "Payment terms: Net 30. Bank transfer to sort code 20-00-00, account 55667788.",
+    ],
+  },
+  {
+    expect: "receipt",
+    file: "20240506_183212.pdf",
+    title: "Greenway Grocers",
+    body: [
+      "Greenway Grocers",
+      "112 Station Road    06/05/2024 18:32",
+      "Oat milk 1L            2.20",
+      "Sourdough loaf         3.80",
+      "Free range eggs x12    4.10",
+      "TOTAL                 10.10",
+      "VISA ****4421   Contactless",
+      "Approval code: 08841",
+      "Thank you for shopping with us",
+    ],
+  },
+  {
+    expect: "bank-statement",
+    file: "statement_march.pdf",
+    pages: 3,
+    title: "Your account statement",
+    body: [
+      "Your account statement",
+      "Statement period: 1 March 2024 - 31 March 2024",
+      "Sort code: 40-12-31    Account number: 71002233",
+      "Opening balance                          2,140.55",
+      "2 Mar   Faster payment - RENT            -950.00",
+      "5 Mar   Salary ACME LTD                 +2,850.00",
+      "12 Mar  Direct debit - CITY POWER         -84.20",
+      "19 Mar  Card purchase - GREENWAY          -10.10",
+      "Closing balance                          3,946.25",
+      "Money in: 2,850.00    Money out: 1,044.30",
+    ],
+  },
+  {
+    expect: "statement-of-account",
+    file: "april_card.pdf",
+    pages: 2,
+    title: "Monthly statement",
+    body: [
+      "Monthly statement",
+      "Account ending in 8891",
+      "Previous balance: $412.90    New balance: $388.15",
+      "Minimum payment due: $25.00    Payment due date: 28 April 2024",
+      "Credit limit: $4,500    Available credit: $4,111.85",
+      "Annual percentage rate (APR): 22.9% variable",
+      "Late payment warning: if we do not receive your minimum payment by the date listed above,",
+      "you may have to pay a late fee of up to $39.",
+      "Interest charge calculation: your APR is applied to the daily balance.",
+    ],
+  },
+  {
+    expect: "purchase-order",
+    file: "PO-88412.pdf",
+    title: "Purchase Order",
+    body: [
+      "Purchase Order",
+      "P.O. Number: PO-88412    Date: 11 June 2024",
+      "Vendor: Brightline Packaging Ltd",
+      "Ship To: Unit 4, Riverside Industrial Estate, Leeds LS10 1AB",
+      "Qty Ordered   Description                Unit Price",
+      "500           Corrugated boxes 40x30cm   0.85",
+      "200           Kraft void fill rolls      3.20",
+      "Delivery date: on or before 25 June 2024.",
+      "All invoices must quote the PO number. No PO, no pay.",
+    ],
+  },
+  {
+    expect: "quote",
+    file: "landscaping_quote.pdf",
+    title: "Quotation",
+    body: [
+      "Quotation",
+      "Quotation number: Q-2231    Date: 8 April 2024",
+      "Prepared for: Mr and Mrs Aldridge",
+      "We are pleased to quote for the following garden works:",
+      "Re-turf rear lawn (85 sqm) ... 1,540.00",
+      "Patio pressure wash and re-point ... 380.00",
+      "Total (inc VAT): 1,920.00",
+      "This quote is valid for 30 days from the date above.",
+    ],
+  },
+  {
+    expect: "expense-report",
+    file: "march_expenses.pdf",
+    title: "Expense report",
+    body: [
+      "Expense report",
+      "Employee: D. Okafor    Department: Field Sales",
+      "Period: 1-31 March 2024",
+      "04 Mar  Client lunch, Manchester        38.50",
+      "11 Mar  Rail ticket, London return      86.00",
+      "18 Mar  Hotel, 1 night (conference)    129.00",
+      "Per diem (2 days)                       90.00",
+      "Total reimbursable: 343.50",
+      "Receipts attached. Approved by: S. Hughes",
+    ],
+  },
+  {
+    expect: "payslip",
+    file: "payslip_2024_05.pdf",
+    title: "Payslip",
+    body: [
+      "Payslip",
+      "Employee: R. Patel    Employee no: 00482    Pay date: 31 May 2024",
+      "Payments                       Deductions",
+      "Basic pay      2,916.67        PAYE tax        382.40",
+      "                               National Insurance 231.15",
+      "                               Pension (5%)    145.83",
+      "Gross pay: 2,916.67            Net pay: 2,157.29",
+      "Tax code: 1257L    NI category: A",
+      "Year to date: gross 14,583.35, tax 1,912.00",
+    ],
+  },
+  {
+    expect: "tax-form",
+    file: "W2_2023.pdf",
+    title: "Wage and Tax Statement",
+    body: [
+      "Form W-2 Wage and Tax Statement 2023",
+      "Employer: Lakeshore Analytics Inc, EIN 84-2210043",
+      "Employee: M. Torres    SSN XXX-XX-4821",
+      "1 Wages, tips, other compensation   72,450.00",
+      "2 Federal income tax withheld        9,812.00",
+      "3 Social security wages             72,450.00",
+      "4 Social security tax withheld       4,491.90",
+      "5 Medicare wages and tips           72,450.00",
+      "Copy B - to be filed with employee's federal tax return.",
+    ],
+  },
+  {
+    expect: "nda",
+    file: "acme_nda_signed.pdf",
+    pages: 4,
+    title: "Non-Disclosure Agreement",
+    body: [
+      "Non-Disclosure Agreement",
+      "This Agreement is made between Acme Ltd (the Disclosing Party) and the undersigned",
+      "recipient (the Receiving Party).",
+      "1. The Receiving Party shall hold all Confidential Information in strict confidence.",
+      "2. Confidential Information excludes information that is or becomes publicly available.",
+      "3. This Agreement shall remain in force for five years from the date of signature.",
+      "Signed for and on behalf of the parties:",
+    ],
+  },
+  {
+    expect: "contract",
+    file: "signed_agreement_final_v3.pdf",
+    pages: 9,
+    title: "Agreement",
+    body: [
+      "Agreement",
+      "This Agreement is entered into as of 1 July 2024 between Corven Holdings Ltd and",
+      "Meridian Supplies Ltd.",
+      "WITNESSETH: in consideration of the mutual covenants contained herein, the parties",
+      "agree as follows:",
+      "1. Definitions. Capitalised terms have the meanings set out in Schedule 1.",
+      "5. Limitation of liability. Neither party shall be liable for indirect losses.",
+      "9. Entire agreement. This Agreement constitutes the entire agreement between the parties.",
+      "IN WITNESS WHEREOF the parties have executed this Agreement.",
+    ],
+  },
+  {
+    expect: "employment-contract",
+    file: "contract_r_patel.pdf",
+    pages: 7,
+    title: "Contract of Employment",
+    body: [
+      "Contract of Employment",
+      "This contract of employment is made between Northgate Logistics Ltd (the Employer)",
+      "and R. Patel (the Employee).",
+      "1. Commencement. Your employment begins on 2 September 2024.",
+      "2. Probationary period. The first six months are a probationary period.",
+      "3. Hours. The Employee shall work 37.5 hours per week.",
+      "4. Holiday. 25 days per annum plus public holidays.",
+      "5. Notice. Either party may terminate on eight weeks written notice.",
+    ],
+  },
+  {
+    expect: "lease-agreement",
+    file: "flat2_tenancy.pdf",
+    pages: 12,
+    title: "Assured Shorthold Tenancy Agreement",
+    body: [
+      "Assured Shorthold Tenancy Agreement",
+      "Property: Flat 2, 18 Camden Row, London NW1 8QP",
+      "Landlord: H. Berger    Tenant: L. Novak",
+      "Term: 12 months commencing 1 August 2024",
+      "Rent: 1,650 per calendar month, payable in advance",
+      "Security deposit: 1,903.85, protected with the Deposit Protection Service",
+      "The tenant shall not sublet the property without written consent.",
+    ],
+  },
+  {
+    expect: "terms-and-conditions",
+    file: "tos.pdf",
+    pages: 14,
+    title: "Terms of Service",
+    body: [
+      "Terms of Service",
+      "Last updated: 12 February 2024",
+      "By accessing or using the Kestrel platform you agree to be bound by these terms.",
+      "1. Your account. You are responsible for safeguarding your credentials.",
+      "2. Acceptable use. You must not misuse the services or interfere with their operation.",
+      "3. Termination. We may suspend or terminate access for breach of these terms.",
+      "4. Disclaimers. The services are provided on an as-is basis.",
+    ],
+  },
+  {
+    expect: "privacy-policy",
+    file: "privacy.pdf",
+    pages: 8,
+    title: "Privacy Notice",
+    body: [
+      "Privacy Notice",
+      "This notice explains how Kestrel Ltd, as data controller, handles your information.",
+      "Personal data we collect: account details, usage data, and support correspondence.",
+      "How we use your information: to provide the service, for billing, and for security.",
+      "Your rights include access, rectification, and the right to erasure.",
+      "We retain personal data only as long as necessary for the purposes described.",
+      "Contact our data protection officer at privacy@kestrel.example.",
+    ],
+  },
+  {
+    expect: "will",
+    file: "last_will.pdf",
+    pages: 5,
+    title: "Last Will and Testament",
+    body: [
+      "Last Will and Testament",
+      "I, Margaret Ellen Shaw, being of sound mind, declare this to be my last will and",
+      "testament, revoking all former wills.",
+      "1. I appoint my daughter, C. Shaw, as executor of this will.",
+      "2. I give, devise and bequeath my residuary estate to my children in equal shares,",
+      "per stirpes.",
+      "Signed by the testator in our presence, who in her presence signed as witnesses.",
+    ],
+  },
+  {
+    expect: "power-of-attorney",
+    file: "lpa_finance.pdf",
+    pages: 10,
+    title: "Lasting Power of Attorney",
+    body: [
+      "Lasting Power of Attorney",
+      "Property and financial affairs",
+      "Donor: A. Whitfield    Attorney: J. Whitfield",
+      "I appoint my attorney to make decisions about my property and financial affairs.",
+      "This lasting power of attorney is registered with the Office of the Public Guardian.",
+      "Certificate provider statement: the donor understands the purpose of this LPA.",
+    ],
+  },
+  {
+    expect: "resume",
+    file: "john_smith.pdf",
+    pages: 2,
+    title: "JOHN SMITH",
+    body: [
+      "JOHN SMITH",
+      "Software Engineer | San Francisco, CA | john.smith@example.com | linkedin.com/in/jsmith",
+      "EXPERIENCE",
+      "Senior Software Engineer, Meridian Labs    2021 - Present",
+      "- Led a team of four building a real-time analytics pipeline handling 2B events/day",
+      "- Cut infrastructure spend 30% by consolidating streaming services",
+      "Software Engineer, Halcyon Systems    2017 - 2021",
+      "- Shipped the customer-facing dashboard used by 40k monthly users",
+      "EDUCATION",
+      "B.S. Computer Science, University of Washington, 2017",
+      "SKILLS",
+      "Go, TypeScript, Kubernetes, PostgreSQL, Kafka",
+    ],
+  },
+  {
+    expect: "cover-letter",
+    file: "application_kestrel.pdf",
+    title: "Application for Product Designer",
+    body: [
+      "Dear Hiring Manager,",
+      "I am writing to apply for the Product Designer role advertised on your careers page.",
+      "In my current position at Fieldnote I redesigned the onboarding flow, lifting",
+      "activation by 22%, and I run our fortnightly usability testing programme.",
+      "Kestrel's focus on accessible tools is why I am excited to apply; my portfolio",
+      "includes two WCAG AA redesigns shipped end to end.",
+      "Thank you for considering my application. I look forward to the opportunity to",
+      "discuss how I can contribute.",
+      "Yours sincerely, Amara Diallo",
+    ],
+  },
+  {
+    expect: "offer-letter",
+    file: "kestrel_offer.pdf",
+    title: "Offer of Employment",
+    body: [
+      "Offer of Employment",
+      "Dear Amara,",
+      "We are pleased to offer you the position of Product Designer at Kestrel Ltd.",
+      "Your start date will be 7 October 2024, and your annual base salary will be 68,000.",
+      "This offer is contingent on satisfactory references and right-to-work checks.",
+      "To accept this offer, please sign and return a copy of this letter by 20 September.",
+      "We look forward to welcoming you to the team.",
+    ],
+  },
+  {
+    expect: "reference-letter",
+    file: "reference_adiallo.pdf",
+    title: "Letter of Recommendation",
+    body: [
+      "Letter of Recommendation",
+      "To whom it may concern,",
+      "It is my pleasure to recommend Amara Diallo, who reported to me for three years",
+      "at Fieldnote as a product designer.",
+      "Amara combines rigorous research habits with fast, pragmatic delivery; her",
+      "onboarding redesign became the template for the rest of the product.",
+      "I highly recommend her without reservation. Please contact me with any questions.",
+      "Daniel Reyes, Head of Design, Fieldnote",
+    ],
+  },
+  {
+    expect: "job-description",
+    file: "jd_platform_eng.pdf",
+    title: "Senior Platform Engineer",
+    body: [
+      "Senior Platform Engineer",
+      "About the role",
+      "We are seeking a senior engineer to own our deployment platform and developer",
+      "tooling, reporting to the Head of Infrastructure.",
+      "Responsibilities",
+      "- Operate and evolve the Kubernetes-based delivery pipeline",
+      "Required qualifications",
+      "- 5+ years running production cloud infrastructure",
+      "Preferred qualifications",
+      "- Experience with progressive delivery and service meshes",
+    ],
+  },
+  {
+    expect: "performance-review",
+    file: "h2_review_jsmith.pdf",
+    title: "Performance Review",
+    body: [
+      "Performance Review - H2 2024",
+      "Employee: J. Smith    Reviewer: T. Nguyen    Role: Senior Engineer",
+      "Overall rating: exceeds expectations",
+      "Strengths: consistently unblocks the team; the analytics migration landed a",
+      "quarter early with zero data loss.",
+      "Areas for improvement: delegate more of the operational load; invest in",
+      "documenting decisions for newer engineers.",
+      "Goals for next period: lead the multi-region rollout; mentor two engineers.",
+    ],
+  },
+  {
+    expect: "timesheet",
+    file: "week_22_hours.pdf",
+    title: "Timesheet",
+    body: [
+      "Timesheet",
+      "Employee: K. Osei    Week ending: 31 May 2024",
+      "Mon 7.50    Tue 7.50    Wed 8.00    Thu 7.50    Fri 6.00",
+      "Regular hours: 36.50",
+      "Overtime hours: 0.00",
+      "Total hours: 36.50",
+      "Employee signature: ____________    Approved by: L. Grant",
+    ],
+  },
+  {
+    expect: "meeting-minutes",
+    file: "board_minutes_may.pdf",
+    pages: 3,
+    title: "Minutes of the Meeting",
+    body: [
+      "Minutes of the Meeting of the Facilities Committee",
+      "Held 14 May 2024, Committee Room B. Present: R. Holt (chair), five members.",
+      "Apologies for absence: D. Cole.",
+      "The meeting was called to order at 18:05. A quorum was present.",
+      "Matters arising: the roofing tender shortlist was approved. Motion carried.",
+      "Any other business: none.",
+      "Date of next meeting: 11 June 2024. The meeting adjourned at 19:20.",
+    ],
+  },
+  {
+    expect: "meeting-agenda",
+    file: "agenda_11june.pdf",
+    title: "Meeting Agenda",
+    body: [
+      "Meeting Agenda",
+      "Facilities Committee - 11 June 2024, 18:00, Committee Room B",
+      "1. Call to order and apologies for absence",
+      "2. Adoption of the agenda",
+      "3. Approval of minutes of the previous meeting",
+      "4. Agenda item: roofing contract award",
+      "5. Agenda item: car park resurfacing budget",
+      "6. Any other business",
+      "7. Date of next meeting",
+    ],
+  },
+  {
+    expect: "memo",
+    file: "memo_hybrid_policy.pdf",
+    title: "Memorandum",
+    body: [
+      "Memorandum",
+      "To: All staff    From: Operations    Date: 3 June 2024",
+      "Re: Updated hybrid working arrangements",
+      "Effective 1 July, core in-office days move to Tuesday through Thursday.",
+      "Team leads may approve exceptions for caregiving or medical needs.",
+      "Desk booking opens each Thursday for the following week.",
+      "Questions to operations@corven.example.",
+    ],
+  },
+  {
+    expect: "press-release",
+    file: "kestrel_series_b.pdf",
+    title: "FOR IMMEDIATE RELEASE",
+    body: [
+      "FOR IMMEDIATE RELEASE",
+      "Kestrel raises $40M Series B to expand accessible design tooling",
+      "LONDON, 4 June 2024 - Kestrel Ltd today announced a $40 million Series B round",
+      "led by Meridian Growth, with participation from existing investors.",
+      "The funding will accelerate hiring and the launch of Kestrel's audit platform.",
+      '"Accessibility is still an afterthought in most tooling," said CEO N. Okafor.',
+      "Media contact: press@kestrel.example    Notes to editors: photography available.",
+    ],
+  },
+  {
+    expect: "newsletter",
+    file: "parish_news_june.pdf",
+    pages: 4,
+    title: "The Elmswell Bulletin",
+    body: [
+      "The Elmswell Bulletin - June edition",
+      "In this issue: the summer fete returns, allotment news, and a new cafe on the green.",
+      "From the editor: thank you to everyone who volunteered at the spring clean-up.",
+      "Dates for your diary: 15 June - summer fete; 22 June - open gardens.",
+      "Allotment corner: plots 12 and 14 are available; contact the parish office.",
+      "Next month we profile the new head teacher at Elmswell Primary.",
+    ],
+  },
+  {
+    expect: "white-paper",
+    file: "zero_trust_wp.pdf",
+    pages: 16,
+    title: "Zero Trust in Practice",
+    body: [
+      "Zero Trust in Practice",
+      "A white paper on migrating enterprise networks beyond the perimeter model.",
+      "Executive summary",
+      "This white paper examines the operational realities of zero-trust rollouts across",
+      "three sectors, drawing on 40 practitioner interviews.",
+      "Key findings: phased device-trust rollouts outperform big-bang migrations; identity",
+      "debt is the leading cause of stalled programmes.",
+      "Conclusions and recommendations follow in section 6.",
+    ],
+  },
+  {
+    expect: "case-study",
+    file: "meridian_case_study.pdf",
+    pages: 3,
+    title: "Customer Case Study",
+    body: [
+      "Customer Case Study",
+      "How Meridian Logistics cut fleet downtime by 34% with Kestrel Audit",
+      "About the client: Meridian operates 1,200 vehicles across the UK and Ireland.",
+      "The challenge: paper-based inspections meant defects surfaced days late.",
+      "The solution: digital inspections with automated triage and parts ordering.",
+      "The results: downtime fell 34% in six months; audit prep time fell from three",
+      "weeks to two days.",
+      '"It paid for itself in a quarter," said the fleet director.',
+    ],
+  },
+  {
+    expect: "financial-statement",
+    file: "annual_accounts_2023.pdf",
+    pages: 42,
+    title: "Consolidated Financial Statements",
+    body: [
+      "Consolidated Financial Statements",
+      "For the year ended 31 December 2023",
+      "Independent auditor's report to the members of Corven Holdings plc",
+      "Consolidated statement of financial position",
+      "Consolidated statement of cash flows",
+      "Notes to the financial statements",
+      "1. Basis of preparation. These statements are prepared under IFRS.",
+      "Revenue for the year was 84.2m (2022: 71.9m).",
+    ],
+  },
+  {
+    expect: "budget",
+    file: "fy25_operating_budget.pdf",
+    pages: 6,
+    title: "FY25 Operating Budget",
+    body: [
+      "FY25 Operating Budget",
+      "Department: Product Engineering",
+      "Budget vs actual, FY24, and proposed FY25 allocations",
+      "Headcount            FY24 actual 3.2m    FY25 budget 3.6m",
+      "Cloud infrastructure FY24 actual 1.1m    FY25 budget 1.0m",
+      "Tooling and licences FY24 actual 0.3m    FY25 budget 0.4m",
+      "The rolling forecast is updated quarterly; variances above 10% require sign-off.",
+    ],
+  },
+  {
+    expect: "insurance-policy",
+    file: "home_policy_renewal.pdf",
+    pages: 18,
+    title: "Your Home Insurance Policy",
+    body: [
+      "Your Home Insurance Policy",
+      "Policy number: HP-2214-8871    Period of insurance: 1 Aug 2024 - 31 Jul 2025",
+      "Your policy is due for renewal. Renewal premium: 341.20 including insurance",
+      "premium tax.",
+      "This policy wording, together with your schedule, forms your contract of insurance.",
+      "Section 1 - Buildings. We insure the buildings against loss or damage.",
+      "Insuring agreement: we will indemnify you subject to the terms and exclusions.",
+    ],
+  },
+  {
+    expect: "insurance-claim",
+    file: "claim_ref_44821.pdf",
+    title: "Claim acknowledgement",
+    body: [
+      "Claim acknowledgement",
+      "Claim reference: 44821    Policy number: HP-2214-8871",
+      "We have received your claim for water damage reported on 12 May 2024.",
+      "Date of loss: 10 May 2024",
+      "A claims adjuster will contact you within two working days to arrange an",
+      "inspection and to explain the proof of loss requirements.",
+      "Please retain damaged items until the adjuster has visited.",
+    ],
+  },
+  {
+    expect: "lab-report",
+    file: "bloods_2024_05.pdf",
+    title: "Laboratory Report",
+    body: [
+      "Laboratory Report",
+      "Patient: R. Patel    DOB: 14/02/1988    Collected: 21 May 2024",
+      "Full blood count",
+      "Haemoglobin      142 g/L      Reference range 130-170",
+      "White cell count 6.1 x10^9/L  Reference range 4.0-11.0",
+      "Platelets        260 x10^9/L  Reference range 150-400",
+      "Comprehensive metabolic panel: sodium 139 mmol/L (135-145), potassium 4.2 (3.5-5.3)",
+      "Reported by: City Pathology Services",
+    ],
+  },
+  {
+    expect: "prescription",
+    file: "rx_amoxicillin.pdf",
+    title: "Prescription",
+    body: [
+      "Prescription",
+      "Patient: L. Novak    DOB: 02/11/1979",
+      "Amoxicillin 500mg capsules",
+      "Take one capsule three times daily for 7 days. Qty dispensed: 21",
+      "Refills remaining: 0    Days supply: 7",
+      "Prescriber: Dr H. Adeyemi, Riverside Practice",
+      "Pharmacy stamp: Elmswell Pharmacy, 4 High Street",
+    ],
+  },
+  {
+    expect: "utility-bill",
+    file: "city_power_june.pdf",
+    pages: 3,
+    title: "Your energy statement",
+    body: [
+      "Your energy statement",
+      "Supply address: Flat 2, 18 Camden Row, London NW1 8QP",
+      "Billing period: 1 May - 31 May 2024",
+      "Electricity used: 212 kWh at 27.4p per kWh ... 58.09",
+      "Standing charge: 31 days at 53.8p ... 16.68",
+      "Meter number: E19D 44210    Previous reading: 30412 (estimated reading)",
+      "Present reading: 30624",
+      "Total charges this period: 74.77",
+    ],
+  },
+  {
+    expect: "booking-confirmation",
+    file: "hotel_confirmation.pdf",
+    title: "Booking Confirmation",
+    body: [
+      "Booking Confirmation",
+      "Confirmation number: HTL-99281",
+      "Your booking is confirmed at the Harbourview Hotel, Edinburgh.",
+      "Check-in date: 12 July 2024 from 15:00",
+      "Check-out date: 14 July 2024 by 11:00",
+      "Room: Double, city view, breakfast included. 2 nights, 2 guests.",
+      "Total: 286.00, payable at the property. Free cancellation until 10 July.",
+    ],
+  },
+  {
+    expect: "itinerary",
+    file: "trip_edinburgh.pdf",
+    title: "Travel Itinerary",
+    body: [
+      "Travel Itinerary",
+      "Traveller: A. Diallo    Booking reference: XK9PLQ",
+      "Outbound - 12 July 2024",
+      "LHR London Heathrow 09:15 -> EDI Edinburgh 10:40, BA 1442, seat 14C",
+      "Return - 14 July 2024",
+      "EDI Edinburgh 18:05 -> LHR London Heathrow 19:35, BA 1447, seat 9A",
+      "Hotel: Harbourview Hotel, 2 nights. Trip summary and e-tickets attached.",
+    ],
+  },
+  {
+    expect: "order-confirmation",
+    file: "order_10422.pdf",
+    title: "Order Confirmation",
+    body: [
+      "Order Confirmation",
+      "Thank you for your order, Amara.",
+      "Order number: 10422    Placed: 2 June 2024",
+      "1x Ergonomic split keyboard ... 129.00",
+      "1x Palm rest, walnut ... 39.00",
+      "Estimated delivery: 6-8 June to 14 Fern Road, Bristol.",
+      "We will email you when your order ships.",
+    ],
+  },
+  {
+    expect: "packing-slip",
+    file: "packing_slip_10422.pdf",
+    title: "Packing Slip",
+    body: [
+      "Packing Slip",
+      "Order number: 10422    Shipped: 5 June 2024",
+      "Ship to: A. Diallo, 14 Fern Road, Bristol BS1 5TR",
+      "Qty shipped   Item",
+      "1             Ergonomic split keyboard",
+      "1             Palm rest, walnut",
+      "Items in this shipment: 2 of 2. This is not an invoice.",
+    ],
+  },
+  {
+    expect: "delivery-note",
+    file: "delivery_note_8871.pdf",
+    title: "Delivery Note",
+    body: [
+      "Delivery Note",
+      "Delivery note no: DN-8871    Date: 25 June 2024",
+      "Deliver to: Unit 4, Riverside Industrial Estate, Leeds LS10 1AB",
+      "Against order: PO-88412",
+      "500 x Corrugated boxes 40x30cm",
+      "200 x Kraft void fill rolls",
+      "Received in good condition. Signed for by: ____________  Time: ______",
+    ],
+  },
+  {
+    expect: "user-guide",
+    file: "kettle_manual.pdf",
+    pages: 24,
+    title: "Instruction Manual",
+    body: [
+      "Instruction Manual",
+      "Rapid-boil kettle, model KB-170",
+      "Important safety instructions - read before first use.",
+      "This appliance can be used by children aged from 8 years and above if they have",
+      "been given supervision or instruction concerning use of the appliance.",
+      "Operating instructions: fill between MIN and MAX, close the lid, press the switch.",
+      "Cleaning and descaling: unplug and allow to cool before cleaning.",
+      "Troubleshooting and warranty information on page 20.",
+    ],
+  },
+  {
+    expect: "safety-data-sheet",
+    file: "sds_isopropanol.pdf",
+    pages: 11,
+    title: "Safety Data Sheet",
+    body: [
+      "Safety Data Sheet",
+      "Section 1: Identification. Product: Isopropyl alcohol 99.9%",
+      "Section 2: Hazards identification. Highly flammable liquid and vapour.",
+      "Section 4: First aid measures. IF IN EYES: rinse cautiously with water.",
+      "Section 6: Accidental release measures. Eliminate all ignition sources.",
+      "Section 11: Toxicological information. May cause drowsiness or dizziness.",
+      "According to Regulation (EC) No 1907/2006 (REACH).",
+    ],
+  },
+  {
+    expect: "certificate",
+    file: "first_aid_cert.pdf",
+    title: "Certificate of Completion",
+    body: [
+      "Certificate of Completion",
+      "This is to certify that",
+      "K. Osei",
+      "has successfully completed the Emergency First Aid at Work course",
+      "held on 20 May 2024 at the Elmswell Training Centre.",
+      "Valid for three years from the date of issue.",
+      "Instructor: P. Marsh    Certificate no: EFAW-20240520-081",
+    ],
+  },
+  {
+    expect: "transcript",
+    file: "uw_transcript.pdf",
+    pages: 2,
+    title: "Official Transcript",
+    body: [
+      "Official Transcript",
+      "Office of the Registrar, University of Washington",
+      "Student: John Smith    Student ID: 1735522",
+      "Program: B.S. Computer Science",
+      "CSE 142 Programming I      4.0 credits   grade 3.8",
+      "CSE 143 Programming II     4.0 credits   grade 3.9",
+      "MATH 126 Calculus III      5.0 credits   grade 3.6",
+      "Cumulative GPA: 3.72    Degree conferred: 10 June 2017",
+    ],
+  },
+  {
+    expect: "research-paper",
+    file: "streaming_paper.pdf",
+    pages: 12,
+    title: "Adaptive Backpressure in Distributed Stream Processors",
+    body: [
+      "Adaptive Backpressure in Distributed Stream Processors",
+      "J. Smith, L. Chen - Meridian Labs",
+      "Abstract - We present an adaptive backpressure protocol that reduces tail",
+      "latency by 41% under skewed load. In this paper we formalise the problem,",
+      "prove stability bounds, and evaluate on three production traces.",
+      "1. Introduction. Stream processors must balance throughput against latency.",
+      "Corresponding author: j.smith@meridianlabs.example",
+      "References [1] Chen et al. (2021) [2] Okafor and Reyes (2019)",
+    ],
+  },
+  {
+    expect: "statement-of-work",
+    file: "sow_kestrel_phase2.pdf",
+    pages: 6,
+    title: "Statement of Work",
+    body: [
+      "Statement of Work",
+      "This Statement of Work is entered into under the Master Services Agreement",
+      "dated 1 March 2024 between Kestrel Ltd and Corven Holdings.",
+      "Scope of work: phase 2 accessibility audit of the claims portal.",
+      "Deliverables: audit report, remediation backlog, retest of priority issues.",
+      "Period of performance: 1 July - 30 September 2024.",
+      "Acceptance criteria: all priority-1 issues verified fixed on retest.",
+      "Fees: time and materials, capped at 48,000.",
+    ],
+  },
+  {
+    expect: "proposal",
+    file: "proposal_fleet_audit.pdf",
+    pages: 8,
+    title: "Proposal",
+    body: [
+      "Proposal for Meridian Logistics",
+      "Fleet inspection digitisation - our proposed approach",
+      "Scope of work: replace paper inspection sheets across 14 depots with digital",
+      "checklists, defect triage, and parts integration.",
+      "Timeline: 12 weeks from kick-off, phased by region.",
+      "Investment: 86,000 fixed fee, including training.",
+      "Acceptance of this proposal: sign below to authorise the work.",
+      "This proposal is valid for 60 days.",
+    ],
+  },
+  {
+    expect: "form",
+    file: "trip_permission.pdf",
+    title: "School Trip Permission Slip",
+    body: [
+      "School Trip Permission Slip",
+      "Elmswell Primary School - Year 4 visit to the Natural History Museum",
+      "Date of trip: 9 July 2024. Cost: 12.50, payable via the school office.",
+      "Please print clearly and return by 28 June.",
+      "Child's name: ______________________  Class: ________",
+      "I give permission for my child to attend the trip.",
+      "Parent/guardian signature: ______________________",
+      "Emergency contact number: ______________________",
+      "For office use only: payment received [ ]  consent received [ ]",
+    ],
+  },
+  {
+    expect: "invitation",
+    file: "wedding_invite.pdf",
+    title: "You are cordially invited",
+    body: [
+      "You are cordially invited",
+      "to celebrate the marriage of",
+      "Amara Diallo and Daniel Reyes",
+      "Saturday the fourteenth of September, two thousand twenty-four",
+      "at three o'clock in the afternoon",
+      "The Orangery, Holland Park, London",
+      "Reception to follow. Kindly respond by the first of August.",
+    ],
+  },
+  {
+    expect: "email-thread",
+    file: "re_re_roofing_tender.pdf",
+    pages: 3,
+    title: "RE: RE: Roofing tender",
+    body: [
+      "From: R. Holt <rholt@example.org>",
+      "Sent: Tuesday 14 May 2024 09:12",
+      "To: D. Cole <dcole@example.org>",
+      "Subject: RE: RE: Roofing tender",
+      "Agreed - let's shortlist the two lowest compliant bids.",
+      "-----Original Message-----",
+      "From: D. Cole    Sent: Monday 13 May 2024 16:40",
+      "On Mon, 13 May 2024, R. Holt wrote:",
+      "> The committee meets Tuesday; can you circulate the tender summary?",
+      "Sent from my iPhone",
+    ],
+  },
+  {
+    expect: "warranty-document",
+    file: "kb170_warranty.pdf",
+    title: "Warranty Certificate",
+    body: [
+      "Warranty Certificate",
+      "Rapid-boil kettle, model KB-170",
+      "This limited warranty covers defects in materials and workmanship for a",
+      "warranty period of two years from the date of purchase.",
+      "This warranty does not cover damage from misuse, descaling neglect, or",
+      "commercial use.",
+      "To make a claim, contact support with your receipt and serial number.",
+    ],
+  },
+  // --- scanned documents: no text layer, the filename is the only signal ---
+  {
+    expect: "invoice",
+    file: "invoice_4412_scan.pdf",
+    title: "",
+    body: [],
+  },
+  {
+    expect: "bank-statement",
+    file: "hsbc_bank_statement_jan.pdf",
+    title: "",
+    body: [],
+  },
+  // --- pdf.js extraction artifacts: NBSP separators, curly quotes, fi/fl ligatures ---
+  {
+    expect: "invoice",
+    file: "doc.pdf",
+    nbsp: true,
+    title: "Tax Invoice",
+    body: [
+      "Tax Invoice",
+      "Invoice Number: INV-2024-3319    Invoice Date: 12 June 2024",
+      "Bill To: Harbour Cafe Ltd",
+      "Consulting services — May ... 1,400.00",
+      "Invoice Total: 1,400.00. Remit payment to the account below.",
+    ],
+  },
+  {
+    expect: "nda",
+    file: "doc.pdf",
+    pages: 3,
+    title: "Confidentiality Agreement",
+    body: [
+      "Confidentiality Agreement",
+      "This confidentiality agreement is made between the Disclosing Party and the",
+      "Receiving Party. Each party’s confidential information shall be held in",
+      "strict confidence and used only to evaluate the proposed relationship.",
+      "The obligations survive for five years from the date of disclosure.",
+    ],
+  },
+  // --- additional common types ---
+  {
+    expect: "tax-return",
+    file: "1040_2023.pdf",
+    pages: 4,
+    title: "U.S. Individual Income Tax Return",
+    body: [
+      "Form 1040 - U.S. Individual Income Tax Return 2023",
+      "Filing status: married filing jointly",
+      "1a Total amount from Form(s) W-2, box 1 ... 72,450",
+      "11 Adjusted gross income ... 71,200",
+      "16 Tax ... 8,102",
+      "25 Federal income tax withheld ... 9,812",
+      "34 Refund: amount you overpaid ... 1,710",
+    ],
+  },
+  {
+    expect: "subscription-confirmation",
+    file: "apple_receipt.pdf",
+    title: "Your receipt from Apple",
+    body: [
+      "Your receipt from Apple",
+      "Subscription: CloudSync Pro, monthly",
+      "Renewal price: 2.99. Next billing date: 12 July 2024.",
+      "Your subscription will automatically renew each month until cancelled.",
+      "Manage your subscription in Settings.",
+    ],
+  },
+  {
+    expect: "donation-receipt",
+    file: "gift_aid_receipt.pdf",
+    title: "Donation Receipt",
+    body: [
+      "Donation Receipt",
+      "Riverside Foodbank, registered charity 1122334",
+      "Thank you for your donation of 50.00 received on 3 June 2024.",
+      "No goods or services were provided in exchange for this contribution.",
+      "Gift Aid: as a UK taxpayer, your donation is worth 25% more at no cost to you.",
+    ],
+  },
+  {
+    expect: "waybill",
+    file: "shipping_label_1Z999.pdf",
+    title: "Shipping label",
+    body: [
+      "Shipping label",
+      "UPS Ground    Tracking: 1Z 999 AA1 01 2345 6784",
+      "Ship from: Brightline Packaging, Leeds LS10 1AB",
+      "Ship to: A. Diallo, 14 Fern Road, Bristol BS1 5TR",
+      "Weight: 2.4 kg    Billing: P/P",
+      "Package 1 of 1",
+    ],
+  },
+  {
+    expect: "customs-declaration",
+    file: "cn22.pdf",
+    title: "Customs Declaration CN22",
+    body: [
+      "Customs Declaration CN22",
+      "May be opened officially",
+      "Description of contents: cotton t-shirts (2)",
+      "HS tariff number: 610910    Country of origin: Portugal",
+      "Declared value: 38.00    Reason for export: sale of goods",
+      "I certify that the particulars given are correct.",
+    ],
+  },
+  {
+    expect: "medical-report",
+    file: "clinic_letter_rp.pdf",
+    pages: 2,
+    title: "Clinical Assessment",
+    body: [
+      "Clinical Assessment",
+      "Patient: R. Patel    NHS no: 943 476 5919    Seen: 21 May 2024",
+      "Presenting complaint: six weeks of intermittent chest tightness on exertion.",
+      "History of present illness: symptoms began after a respiratory infection;",
+      "no orthopnoea; exercise tolerance reduced to one flight of stairs.",
+      "Past medical history: hypertension, well controlled.",
+      "On examination: chest clear, heart sounds normal, BP 132/84.",
+      "Impression and plan: likely post-viral; arrange ECG and review in 4 weeks.",
+    ],
+  },
+  {
+    expect: "referral-letter",
+    file: "referral_cardiology.pdf",
+    title: "Referral Letter",
+    body: [
+      "Referral Letter",
+      "Dear colleague,",
+      "Re: R. Patel, DOB 14/02/1988",
+      "Reason for referral: exertional chest tightness with an abnormal baseline ECG.",
+      "I am referring this patient to the rapid access chest pain clinic.",
+      "Please see this patient within two weeks given the symptom pattern.",
+      "Referring GP: Dr H. Adeyemi, Riverside Practice",
+    ],
+  },
+  {
+    expect: "consent-form",
+    file: "consent_gastroscopy.pdf",
+    title: "Consent Form",
+    body: [
+      "Consent Form",
+      "Procedure: diagnostic gastroscopy",
+      "I confirm the procedure, its benefits, and its risks have been explained to me.",
+      "I have had the opportunity to ask questions and all my questions have been",
+      "answered to my satisfaction.",
+      "I consent to the procedure described above.",
+      "Patient signature: ____________    Person taking consent: ____________",
+    ],
+  },
+  {
+    expect: "benefits-summary",
+    file: "pension_statement_2024.pdf",
+    pages: 3,
+    title: "Annual Benefit Statement",
+    body: [
+      "Annual Benefit Statement",
+      "Scheme: Northgate Group Personal Pension",
+      "Statement date: 5 April 2024",
+      "Your pension pot on 5 April 2024: 48,210",
+      "Contributions received this year: 4,860 (you 2,430, employer 2,430)",
+      "Projected pot at age 67: 214,000 in today's money.",
+      "This statement is provided annually; it is not a guarantee.",
+    ],
+  },
+  {
+    expect: "grade-report",
+    file: "y4_summer_report.pdf",
+    title: "End of Year Report",
+    body: [
+      "End of Year Report - Year 4",
+      "Pupil: T. Diallo    Class: 4B    Attendance: 96.8%",
+      "Reading: working at greater depth. Thoughtful, fluent, and adventurous choices.",
+      "Writing: working towards the expected standard; handwriting is improving.",
+      "Mathematics: expected standard. Confident with fractions and perimeter.",
+      "Effort grade: excellent across all subjects.",
+      "Teacher: Ms P. Whitlow    Headteacher: Mr J. Okafor",
+    ],
+  },
+  {
+    expect: "course-syllabus",
+    file: "cse143_syllabus.pdf",
+    pages: 5,
+    title: "Course Syllabus",
+    body: [
+      "Course Syllabus",
+      "CSE 143: Computer Programming II, Autumn 2024",
+      "Learning objectives: implement and analyse core data structures; write",
+      "well-tested object-oriented programs.",
+      "Required textbook: Building Java Programs, 5th edition.",
+      "Grading: homework 40%, midterm 25%, final 35%.",
+      "Week 1: recursion. Week 2: linked lists. Week 3: stacks and queues.",
+      "Office hours: Tuesdays 2-4pm, Allen Center 303.",
+    ],
+  },
+  {
+    expect: "datasheet",
+    file: "lm317_datasheet.pdf",
+    pages: 22,
+    title: "LM317 Adjustable Regulator",
+    body: [
+      "LM317 3-Terminal Adjustable Regulator",
+      "1 Features: output voltage range adjustable from 1.25V to 37V.",
+      "6 Specifications",
+      "6.1 Absolute maximum ratings over operating temperature range",
+      "6.3 Recommended operating conditions",
+      "6.5 Electrical characteristics",
+      "7.2 Typical application circuit: adjustable voltage regulator with protection diodes.",
+      "8 Pin configuration and functions: ADJ, OUT, IN.",
+    ],
+  },
+  {
+    expect: "incident-report",
+    file: "ir_2024_007.pdf",
+    pages: 6,
+    title: "Security Incident Report",
+    body: [
+      "Security Incident Report IR-2024-007",
+      "Severity: SEV-2    Status: closed",
+      "Summary: credential stuffing against the customer login endpoint.",
+      "Timeline: detected 02:14 UTC by rate-limit alerting; contained 03:05 UTC.",
+      "Containment and eradication: blocked source ASNs, forced resets for 112 accounts.",
+      "Indicators of compromise: IP list attached; no data exfiltration observed.",
+      "Follow-ups: roll out WebAuthn, tighten per-IP limits.",
+    ],
+  },
+  {
+    expect: "audit-report",
+    file: "soc2_type2_2024.pdf",
+    pages: 48,
+    title: "SOC 2 Type II Report",
+    body: [
+      "SOC 2 Type II Report",
+      "System and Organization Controls report on Kestrel Ltd's audit platform.",
+      "Independent service auditor's report for the period 1 April 2023 to 31 March 2024.",
+      "Applicable trust services criteria: security, availability, confidentiality.",
+      "Section 3: description of the system. Section 4: tests of controls and results.",
+      "In our opinion, controls were suitably designed and operated effectively.",
+    ],
+  },
+  // A US-style resume with bare section headings, no CV title, and no LinkedIn URL.
+  {
+    expect: "resume",
+    file: "jordan_avery_2024.pdf",
+    title: "JORDAN AVERY",
+    body: [
+      "JORDAN AVERY",
+      "Portland, OR | (503) 555-0142 | j.avery@example.com",
+      "EXPERIENCE",
+      "Operations Manager, Cascade Outfitters    2019 - Present",
+      "- Run daily operations for a 40-person retail and rental business",
+      "- Cut inventory shrinkage 18% by introducing weekly cycle counts",
+      "Assistant Manager, Trailhead Sports    2015 - 2019",
+      "EDUCATION",
+      "B.A. Business Administration, University of Oregon, 2015",
+      "SKILLS",
+      "Scheduling, budgeting, vendor negotiation, POS systems",
+    ],
+  },
+  // --- negative controls: must stay unlabelled ---
+  {
+    expect: "",
+    file: "weekend_notes.pdf",
+    title: "Weekend Notes",
+    body: [
+      "The weather was clear on Saturday so we walked along the river and stopped",
+      "for coffee near the old bridge before the rain started in the afternoon.",
+      "On Sunday we tidied the garden, read for a while and then cooked a simple",
+      "dinner with the vegetables that were still fresh from last week.",
+      "Nothing else of note happened, and it was a quiet couple of days overall.",
+    ],
+  },
+  {
+    expect: "",
+    file: "contrato.pdf",
+    title: "CONTRATO DE ARRENDAMIENTO",
+    body: [
+      "El presente contrato de arrendamiento se celebra entre el arrendador y el",
+      "arrendatario para el alquiler de la vivienda situada en la direccion indicada.",
+      "El arrendatario se compromete a pagar la renta mensual dentro de los primeros",
+      "cinco dias de cada mes segun las condiciones que se establecen en este documento.",
+      "Ambas partes firman este contrato en senal de conformidad con sus clausulas.",
+    ],
+  },
+  // --- extended coverage: every remaining emitted label + new-rule checks ---
+  {
+    expect: "remittance-advice",
+    file: "remit_20240418.pdf",
+    title: "Remittance Advice",
+    body: [
+      "Remittance Advice",
+      "From: Harlow Manufacturing Ltd    To: Brightline Packaging Ltd",
+      "Payment date: 18 April 2024    Payment reference: HM-2024-0418",
+      "BACS payment to sort code 20-00-00, account ending 4471.",
+      "The following invoices are covered by this payment:",
+      "INV-2201    12 March 2024    1,480.00",
+      "INV-2214    28 March 2024      960.00",
+      "Amount remitted: 2,440.00",
+      "Your account has been credited accordingly. No action is required.",
+    ],
+  },
+  {
+    expect: "credit-note",
+    file: "CN-0092.pdf",
+    title: "Credit Note",
+    body: [
+      "Credit Note",
+      "Credit note number: CN-0092    Credit note date: 6 June 2024",
+      "Customer: Harbour Cafe Ltd    Original invoice: INV-2024-014",
+      "Reason for credit: goods returned - two chairs received damaged.",
+      "Item: Bistro chair (oak)    Qty: 2    Unit price: 85.00",
+      "Total credit: 170.00",
+      "Your account has been credited with the amount shown above.",
+    ],
+  },
+  {
+    expect: "loan-agreement",
+    file: "loan_agreement_final.pdf",
+    pages: 9,
+    title: "Loan Agreement",
+    body: [
+      "Loan Agreement",
+      "This Loan Agreement is made between Fairview Capital LLC (the Lender)",
+      "and Meadowbrook Joinery Ltd (the Borrower).",
+      "1. Principal amount. The Lender agrees to advance the principal amount of",
+      "$150,000 to the Borrower on the terms set out below.",
+      "2. Interest. Interest shall accrue on the outstanding balance at a rate of",
+      "7.5% per annum, calculated daily.",
+      "3. Repayment. The Borrower shall repay the loan in accordance with the",
+      "repayment schedule in Schedule 1, over sixty equal monthly instalments.",
+      "4. Default. Each of the following is an event of default: failure to pay any",
+      "sum within fourteen days of its due date, or breach of any obligation herein.",
+      "Signed for and on behalf of the Borrower and the Lender.",
+    ],
+  },
+  {
+    expect: "letter",
+    file: "important_account_information.pdf",
+    title: "Important information about your account",
+    body: [
+      "Important information about your account",
+      "Dear account holder,",
+      "We are writing to inform you about changes to your account that take effect",
+      "from 1 September 2024. This letter confirms that your everyday banking",
+      "will continue as normal and there is nothing you need to do.",
+      "The changes to your interest rate are set out in the enclosed leaflet, and",
+      "your account with us will keep the same sort code and account number.",
+      "Thank you for banking with us.",
+      "Yours faithfully,",
+      "Customer Services Team",
+    ],
+  },
+  {
+    expect: "board-report",
+    file: "board_pack_q2.pdf",
+    pages: 18,
+    title: "Board Pack",
+    body: [
+      "Board Pack",
+      "Quarterly board meeting of Northwind Trading Ltd, 20 June 2024.",
+      "These confidential board materials have been prepared for the board and",
+      "distributed to the directors one week ahead of the meeting.",
+      "Contents: CEO overview, KPI review, finance update, people update, and",
+      "items for board discussion including the proposed warehouse lease.",
+      "Strategic priorities remain unchanged from the March meeting.",
+      "Appendix B sets out the management accounts for the quarter.",
+    ],
+  },
+  {
+    expect: "pitch-deck",
+    file: "acme_seed_deck.pdf",
+    pages: 14,
+    title: "Acme Robotics",
+    body: [
+      "Acme Robotics",
+      "The problem we solve: warehouse picking is slow, error-prone and expensive.",
+      "Our solution: a modular picking robot that installs in a weekend.",
+      "Total addressable market: $8.4B across e-commerce fulfilment.",
+      "Traction to date: 11 paying customers, 240% net revenue retention.",
+      "Why now: labour shortages and cheap depth sensors change the economics.",
+      "Meet the team: ex-Amazon robotics and two-time founders.",
+      "The ask: we are raising a seed round of $2.5M.",
+      "Use of funds: 60% engineering, 25% go-to-market, 15% operations.",
+    ],
+  },
+  {
+    expect: "investment-summary",
+    file: "investor_update_march.pdf",
+    title: "Investor Update",
+    body: [
+      "Investor Update - March 2024",
+      "Dear investors,",
+      "Highlights and lowlights: we shipped the v2 dashboard and closed our two",
+      "largest deals to date; hiring for the platform team slipped a month.",
+      "Key metrics this month: monthly recurring revenue of $86k, up 9% on",
+      "February; net new MRR of $7.1k; burn rate steady at $110k.",
+      "That leaves fourteen months of runway at the current plan.",
+      "How you can help: intros to heads of operations at mid-market 3PLs.",
+      "Thank you, as ever, for your support.",
+    ],
+  },
+  {
+    expect: "letter-of-intent",
+    file: "loi_project_falcon.pdf",
+    pages: 4,
+    title: "Letter of Intent",
+    body: [
+      "Letter of Intent",
+      "Project Falcon - strictly private and confidential",
+      "This letter of intent sets out the indicative terms on which Redwood",
+      "Industrial Group would be willing to pursue the acquisition of the",
+      "business and assets of Meadowbrook Joinery Ltd.",
+      "This letter is non-binding and does not create any obligation on either",
+      "party, and any transaction remains subject to definitive agreement.",
+      "During the exclusivity period of sixty days the Sellers shall not solicit",
+      "offers from any other person, and both parties shall proceed in good",
+      "faith negotiations toward completion.",
+    ],
+  },
+  {
+    expect: "quarterly-report",
+    file: "q3_earnings_release.pdf",
+    pages: 8,
+    title: "Quarterly Earnings Release",
+    body: [
+      "Quarterly Earnings Release",
+      "Northwind Group reports third quarter results and raises full-year guidance.",
+      "Revenue of $412M, up 14% year-over-year; operating margin of 18.2%.",
+      "Diluted earnings per share of $0.94, ahead of consensus estimates.",
+      "The company beat analyst estimates on both revenue and earnings.",
+      "Management will host a conference call to discuss these results at 5:00pm",
+      "Eastern Time today; a replay of the earnings call will be available.",
+      "Guidance for the full year: revenue of $1.63B to $1.66B.",
+    ],
+  },
+  {
+    expect: "report",
+    file: "report_to_cabinet_leisure.pdf",
+    pages: 12,
+    title: "Report to Cabinet",
+    body: [
+      "Report to Cabinet",
+      "Report of the Director of Communities: future of the Riverside Leisure Centre.",
+      "Portfolio holder: Councillor J. Ellis    Wards affected: Castle, Riverside.",
+      "Key decision: yes.",
+      "The committee is recommended to approve option two, refurbishment in",
+      "phases, and it is recommended that officers procure a design partner.",
+      "Financial implications: capital cost of 4.2m over two years.",
+      "Legal implications: none beyond standard procurement obligations.",
+      "Reason for the decision: the centre no longer meets accessibility standards.",
+    ],
+  },
+  {
+    expect: "regulatory-filing",
+    file: "uksi_2024_0871.pdf",
+    pages: 16,
+    title: "The Data Protection (Amendment) Regulations 2024",
+    body: [
+      "Statutory Instruments",
+      "2024 No. 871",
+      "The Data Protection (Amendment) Regulations 2024",
+      "Made 4 June 2024. Laid before Parliament 6 June 2024.",
+      "The Secretary of State makes these Regulations in exercise of the powers",
+      "conferred by sections 16 and 211 of the Data Protection Act 2018.",
+      "1. These Regulations may be cited as the Data Protection (Amendment)",
+      "Regulations 2024 and come into force on 1 August 2024.",
+      "2. Regulation 4 of the principal Regulations is amended as follows.",
+      "Explanatory note: this note is not part of the Regulations.",
+    ],
+  },
+  {
+    expect: "appraisal-report",
+    file: "409a_valuation_2024.pdf",
+    pages: 34,
+    title: "409A Valuation Report",
+    body: [
+      "409A Valuation Report",
+      "Prepared for the board of Acme Robotics, Inc.",
+      "Valuation date: 31 March 2024.",
+      "Purpose: to estimate the fair market value of the company's common stock.",
+      "We considered the market approach and the income approach. Under the",
+      "income approach we applied a discounted cash flow analysis using a",
+      "weighted average cost of capital of 24%.",
+      "Under the market approach we performed a comparable company analysis",
+      "using the guideline public company method across eight peers.",
+      "Concluded fair market value: $2.84 per common share.",
+    ],
+  },
+  {
+    expect: "tax-statement",
+    file: "cp14_notice.pdf",
+    title: "Notice of Assessment",
+    body: [
+      "Notice of Assessment",
+      "Notice date: 12 May 2024    Taxpayer ID ending: 4417",
+      "You have unpaid taxes for the 2023 tax year.",
+      "Proposed amount due: $1,240.00, which includes a late payment penalty",
+      "of $62.00 and interest calculated to the date of this notice.",
+      "Amount due immediately: $1,240.00.",
+      "If you do not pay by 5 June 2024, additional penalties will apply.",
+      "Payment options are listed on the back of this notice.",
+    ],
+  },
+  {
+    expect: "court-filing",
+    file: "motion_to_dismiss.pdf",
+    pages: 11,
+    title: "Motion to Dismiss",
+    body: [
+      "United States District Court for the Northern District of Ohio",
+      "Civil Action No. 5:24-cv-00311",
+      "Meridian Supply Co., Plaintiff, v. Lakeshore Logistics LLC, Defendant.",
+      "Defendant's Motion to Dismiss",
+      "Comes now Defendant Lakeshore Logistics LLC, by and through undersigned",
+      "counsel, and moves this Court to dismiss the complaint for failure to",
+      "state a cause of action, as set out in the memorandum in support filed",
+      "herewith. The complaint's prayer for relief seeks damages unavailable",
+      "as a matter of law.",
+      "Respectfully submitted, /s/ Dana Whitfield, Counsel for Defendant.",
+      "Certificate of service: a copy was served on all counsel of record.",
+    ],
+  },
+  {
+    expect: "affidavit",
+    file: "affidavit_of_residence.pdf",
+    title: "Affidavit of Residence",
+    body: [
+      "Affidavit of Residence",
+      "State of Texas, County of Travis.",
+      "I, Morgan Reyes, being duly sworn, deposes and says:",
+      "1. I am over eighteen years of age and competent to make this affidavit.",
+      "2. I have resided at 118 Fern Road, Austin, Texas since March 2019.",
+      "3. The facts stated here are true and correct to the best of my knowledge.",
+      "Affiant: Morgan Reyes",
+      "Subscribed and sworn to before me this 9th day of May 2024.",
+      "Notary Public, State of Texas. My commission expires 01/31/2026.",
+    ],
+  },
+  {
+    expect: "legal-notice",
+    file: "letter_before_action.pdf",
+    title: "Letter Before Action",
+    body: [
+      "Letter Before Action",
+      "Dear Mr Hale,",
+      "We act for Brightline Packaging Ltd. This is a letter before claim under",
+      "the pre-action protocol for debt claims.",
+      "Our client is owed 4,860.00 under invoices that remain unpaid despite",
+      "repeated reminders. This is our client's final demand for payment.",
+      "Unless payment is received within fourteen days we are instructed to",
+      "issue proceedings without further notice, and further legal action may",
+      "include a claim for interest and costs.",
+      "Govern yourself accordingly.",
+    ],
+  },
+  {
+    expect: "purchase-agreement",
+    file: "asset_purchase_agreement.pdf",
+    pages: 64,
+    title: "Asset Purchase Agreement",
+    body: [
+      "Asset Purchase Agreement",
+      "by and among Redwood Industrial Group, Inc., as Buyer, and Meadowbrook",
+      "Joinery Ltd, as Seller, dated as of 12 July 2024.",
+      "Article III sets out the representations and warranties of the Seller,",
+      "qualified by the disclosure schedule delivered at signing.",
+      "Article II provides for a purchase price adjustment based on closing",
+      "working capital, with an escrow amount of $1,500,000 to be held by the",
+      "escrow agent for eighteen months.",
+      "Article VII sets out the closing conditions, including the absence of any",
+      "material adverse effect on the business of the target company.",
+    ],
+  },
+  {
+    expect: "shareholder-agreement",
+    file: "shareholders_agreement_2024.pdf",
+    pages: 28,
+    title: "Shareholders' Agreement",
+    body: [
+      "Shareholders' Agreement",
+      "relating to Acme Robotics Ltd, entered into by the persons listed in",
+      "Schedule 1 as holders of shares in the company.",
+      "5. Transfer of shares. No shareholder may transfer shares except as",
+      "permitted by this clause, subject to the pre-emption rights in clause 6.",
+      "7. Drag-along rights. If holders of 75% of the shares accept an offer,",
+      "they may require every other shareholder to sell on the same terms.",
+      "8. Tag-along rights. No transfer may complete unless each minority",
+      "shareholder is offered the same price per share.",
+      "10. Reserved matters. The consent of investor directors is required for",
+      "the matters in Schedule 3, including changes to board composition.",
+    ],
+  },
+  {
+    expect: "legal-opinion",
+    file: "approved_judgment_hale.pdf",
+    pages: 22,
+    title: "Approved Judgment",
+    body: [
+      "Approved Judgment",
+      "In the matter of Meridian Supply Co v Lakeshore Logistics.",
+      "Before the Honourable Mrs Justice Carey, handed down 14 June 2024.",
+      "This is the judgment of the court on the defendant's application.",
+      "For the reasons given below, the appeal is dismissed.",
+      "The claimant's construction of clause 9 is to be preferred; the",
+      "commercial context points firmly in the same direction.",
+      "Costs follow the event. Permission to appeal is refused.",
+    ],
+  },
+  {
+    expect: "subpoena",
+    file: "subpoena_duces_tecum.pdf",
+    title: "Subpoena to Produce Documents",
+    body: [
+      "Subpoena to Produce Documents, Information, or Objects",
+      "To: Custodian of Records, Lakeshore Logistics LLC.",
+      "You are commanded to produce at the time, date and place set forth below",
+      "the documents described in Attachment A.",
+      "This subpoena duces tecum is issued in the matter of Meridian Supply Co",
+      "v Lakeshore Logistics, pending in the district court.",
+      "Place of compliance: 400 Main Street, Suite 210, Cleveland, Ohio.",
+      "Return date: 2 August 2024 at 10:00 a.m.",
+      "Issued by the clerk of court on application of counsel for the plaintiff.",
+    ],
+  },
+  {
+    expect: "settlement-agreement",
+    file: "settlement_agreement_reyes.pdf",
+    pages: 7,
+    title: "Settlement Agreement",
+    body: [
+      "Settlement Agreement",
+      "between Morgan Reyes (the Claimant) and Northwind Trading Ltd",
+      "(the Respondent), each a party and together the parties.",
+      "The parties desire to resolve all matters between them arising out of",
+      "the Claimant's employment, without any admission of liability.",
+      "1. The Respondent shall pay the Claimant a settlement sum of 24,000",
+      "within 21 days, in full and final settlement of all claims.",
+      "2. The Claimant agrees to withdraw the claim before the employment",
+      "tribunal and enters into the release of claims in Schedule 1.",
+      "3. This agreement was reached following discussions through a",
+      "conciliation officer.",
+    ],
+  },
+  {
+    expect: "employee-handbook",
+    file: "staff_handbook_2024.pdf",
+    pages: 48,
+    title: "Employee Handbook",
+    body: [
+      "Employee Handbook",
+      "Welcome to the company. This handbook explains what you can expect from",
+      "us and what we expect from you.",
+      "Code of conduct: we treat colleagues and customers with respect.",
+      "Dress code: smart casual, with site rules taking precedence in the yard.",
+      "Annual leave: 25 days plus public holidays; sick leave is set out in",
+      "section 6 together with reporting requirements.",
+      "Your first three months are a probationary period.",
+      "The disciplinary procedure and grievance procedure are in section 9,",
+      "and our equal opportunity commitments are in section 10.",
+      "Working hours are 9:00 to 17:30, Monday to Friday.",
+    ],
+  },
+  {
+    expect: "risk-assessment",
+    file: "enterprise_risk_register.pdf",
+    pages: 12,
+    title: "Risk Assessment Report",
+    body: [
+      "Risk Assessment Report",
+      "Enterprise risk register for Northwind Trading Ltd, reviewed quarterly.",
+      "Methodology: each risk is scored for likelihood and impact on a five",
+      "point scale, before and after controls, and assigned a risk owner.",
+      "The risk heat map on page 3 summarises the top twelve risks.",
+      "R-04 Supply concentration: inherent risk high; mitigation plan agreed",
+      "with procurement; residual risk medium, within our risk appetite.",
+      "R-07 Warehouse fire: risk rating severe; sprinkler upgrade underway.",
+      "Control effectiveness is tested by internal audit on rotation.",
+    ],
+  },
+  {
+    expect: "compliance-document",
+    file: "information_security_policy.pdf",
+    pages: 18,
+    title: "Information Security Policy",
+    body: [
+      "Information Security Policy",
+      "Policy owner: Head of IT Security.    Effective date: 1 May 2024.",
+      "Scope: this policy applies to all staff, contractors and systems and",
+      "forms part of our information security management system.",
+      "Access is granted on the principle of least privilege and reviewed",
+      "quarterly, as set out in the access control policy.",
+      "Information is handled according to the data classification policy;",
+      "the acceptable use policy governs personal use of company systems.",
+      "The password policy requires a unique passphrase per system.",
+      "This document follows a twelve month policy review cycle.",
+    ],
+  },
+  {
+    expect: "questionnaire",
+    file: "vendor_security_questionnaire.pdf",
+    pages: 9,
+    title: "Vendor Security Questionnaire",
+    body: [
+      "Vendor Security Questionnaire",
+      "To be completed by the supplier as part of our vendor risk management",
+      "and due diligence questionnaire process.",
+      "Please answer yes or no in the response column, adding detail where",
+      "relevant to your data handling practices.",
+      "Section 3: do you maintain a list of subprocessors, and are they bound",
+      "by equivalent contractual obligations?",
+      "Section 5: describe any compensating control where a requirement is",
+      "not met in full.",
+      "This questionnaire is based on the standardized information gathering",
+      "format and should take about an hour to complete.",
+    ],
+  },
+  {
+    expect: "immunization-record",
+    file: "immunization_record_reyes.pdf",
+    title: "Immunization Record",
+    body: [
+      "Immunization Record",
+      "Patient name: Alex Reyes    Date of birth: 04/12/2016",
+      "Vaccine    Date administered    Administered by    Lot number",
+      "DTaP (dose 5)    03/22/2021    Dr. N. Okafor    AC41B",
+      "MMR (dose 2)    03/22/2021    Dr. N. Okafor    KL98D",
+      "Varicella (dose 2)    03/22/2021    Dr. N. Okafor    MM31A",
+      "Hepatitis B (dose 3)    11/02/2017    Dr. N. Okafor    KT77C",
+      "Tdap booster due: 2028.",
+      "This record was printed from the state immunisation history registry.",
+    ],
+  },
+  {
+    expect: "medical-invoice",
+    file: "eob_march_2024.pdf",
+    title: "Explanation of Benefits",
+    body: [
+      "Explanation of Benefits",
+      "This is not a bill. Keep this statement for your records.",
+      "Member: Morgan Reyes    Claim number: 88-4412-07",
+      "Provider: Lakeside Family Medicine    Date of service: 03/14/2024",
+      "Amount billed: $240.00    Allowed amount: $132.00",
+      "Plan paid: $105.60    Coinsurance: $26.40    Copay: $0.00",
+      "Patient responsibility: $26.40",
+      "Applied to deductible: $0.00    Out-of-pocket maximum met: no.",
+      "Your provider may bill you for the patient responsibility shown above.",
+    ],
+  },
+  {
+    expect: "discharge-summary",
+    file: "discharge_summary_hale.pdf",
+    pages: 3,
+    title: "Discharge Summary",
+    body: [
+      "Discharge Summary",
+      "Patient: Thomas Hale    NHS number: 943 476 5919",
+      "Date of admission: 2 June 2024    Date of discharge: 6 June 2024",
+      "Discharge diagnosis: community acquired pneumonia.",
+      "Hospital course: the patient responded well to intravenous antibiotics",
+      "and was stepped down to oral therapy on day two.",
+      "Medications on discharge: amoxicillin 500mg three times daily for five",
+      "days; continue regular inhalers.",
+      "Condition at discharge: stable, mobilising independently; discharged home.",
+      "Follow-up arrangements: chest x-ray in six weeks. Copy to GP.",
+    ],
+  },
+  {
+    expect: "insurance-certificate",
+    file: "acord_25_certificate.pdf",
+    title: "Certificate of Liability Insurance",
+    body: [
+      "Certificate of Liability Insurance",
+      "This certificate is issued as a matter of information only and confers",
+      "no rights upon the certificate holder.",
+      "Insured: Lakeshore Logistics LLC, 400 Main Street, Cleveland, OH.",
+      "Commercial general liability: each occurrence $1,000,000; general",
+      "aggregate $2,000,000. Policy number GL-8841-22, ACORD 25 form.",
+      "Certificate holder: Meridian Supply Co is named as additional insured",
+      "with respect to work performed under contract 2024-118.",
+      "Should any of the above described policies be cancelled before the",
+      "expiration date thereof, notice will be delivered in accordance with",
+      "the policy provisions.",
+    ],
+  },
+  {
+    expect: "thesis",
+    file: "reyes_phd_thesis.pdf",
+    pages: 186,
+    title: "Consensus Protocols for Unreliable Networks",
+    body: [
+      "Consensus Protocols for Unreliable Networks",
+      "A thesis submitted in partial fulfilment of the requirements for the",
+      "degree of Doctor of Philosophy.",
+      "School of Computing, University of Leeds, September 2024.",
+      "Thesis supervisor: Professor A. Whitmore.",
+      "I hereby declare that this thesis is my own work and has not been",
+      "submitted for any other degree; see the declaration of authorship.",
+      "Acknowledgements: I thank my supervisor and the systems group.",
+      "Abstract: we study agreement under message loss and partition.",
+    ],
+  },
+  {
+    expect: "assignment-brief",
+    file: "problem_set_4.pdf",
+    title: "Problem Set 4",
+    body: [
+      "Problem Set 4",
+      "MATH 2210 Linear Algebra    Due date: Friday 24 May at 5pm",
+      "Answer all questions. Show your work for full credit; unsupported",
+      "answers receive no marks.",
+      "Total marks: 40.",
+      "Question 1 (8 marks): find the eigenvalues of the matrix A below.",
+      "Question 2 (12 marks): prove that similar matrices share a determinant.",
+      "Submit your solutions as a single PDF through the course portal.",
+      "Late submissions will lose 10% per day up to three days.",
+    ],
+  },
+  {
+    expect: "registration-form",
+    file: "student_enrollment_form.pdf",
+    title: "Student Enrollment Form",
+    body: [
+      "Student Enrollment Form",
+      "Section A - pupil details: full name, date of birth, year group applied",
+      "for, and current or previous school attended.",
+      "Section B - parent/guardian details and emergency contacts, including",
+      "at least two adults we may call during the school day.",
+      "Section C - home language survey: which language is spoken most at home?",
+      "Section D - proof of residency: please attach a recent council tax bill",
+      "or tenancy agreement showing your home address.",
+      "Return the completed admission form to the school office by 15 June.",
+    ],
+  },
+  {
+    expect: "lesson-plan",
+    file: "lesson_plan_fractions.pdf",
+    title: "Lesson Plan",
+    body: [
+      "Lesson Plan - Year 5 Mathematics - Comparing Fractions",
+      "Lesson objective: pupils can compare fractions with unlike denominators.",
+      "Success criteria: I can find a common denominator; I can order three",
+      "fractions; I can explain my reasoning to a partner.",
+      "Key vocabulary: numerator, denominator, equivalent, common multiple.",
+      "Starter activity (5 min): match equivalent fraction cards in pairs.",
+      "Main activity (30 min): guided practice, then independent questions.",
+      "Differentiation: number lines for support; extension into improper",
+      "fractions for rapid graspers. Assessment for learning: exit ticket",
+      "with three ordering problems collected as the plenary.",
+    ],
+  },
+  {
+    expect: "mortgage-document",
+    file: "closing_disclosure.pdf",
+    pages: 5,
+    title: "Closing Disclosure",
+    body: [
+      "Closing Disclosure",
+      "This form is a statement of final loan terms and closing costs.",
+      "Borrower: Morgan Reyes    Property: 118 Fern Road, Austin, TX",
+      "Loan amount: $312,000    Loan term: 30 years    Fixed rate: 6.25%",
+      "Loan-to-value: 80%. Your loan has no prepayment penalty.",
+      "Projected payments include amounts held in your escrow account for",
+      "property taxes and homeowner's insurance.",
+      "The amortization schedule in the appendix shows principal and interest",
+      "over the life of the loan; this note is secured by a deed of trust.",
+      "Signed at closing alongside the promissory note.",
+    ],
+  },
+  {
+    expect: "deed",
+    file: "warranty_deed_recorded.pdf",
+    title: "Warranty Deed",
+    body: [
+      "Warranty Deed",
+      "Recorded at the request of Travis County Title Co.",
+      "The grantor, Evelyn Marsh, a single person, for good and valuable",
+      "consideration, grants and conveys to the grantee, Morgan Reyes, the",
+      "following described real property in fee simple:",
+      "Legal description: Lot 14, Block C, Fernwood Addition, according to the",
+      "plat recorded in Volume 88, Page 12, plat records of Travis County.",
+      "Filed for record with the county recorder on 21 June 2024.",
+    ],
+  },
+  {
+    expect: "property-listing",
+    file: "14_fern_road_brochure.pdf",
+    title: "14 Fern Road, Bristol",
+    body: [
+      "14 Fern Road, Bristol",
+      "Guide price 425,000. Offers in excess of the guide will be considered.",
+      "A well presented three bedroom semi with a south facing garden, fitted",
+      "kitchen, and off-street parking for two cars.",
+      "Approximately 1,180 sq ft of accommodation over two floors.",
+      "Council tax band D. EPC rating C.",
+      "Viewing strictly by appointment through the vendor's estate agent.",
+      "Open house Saturday 10:00 to 12:00.",
+    ],
+  },
+  {
+    expect: "inspection-report",
+    file: "home_inspection_fern_rd.pdf",
+    pages: 32,
+    title: "Home Inspection Report",
+    body: [
+      "Home Inspection Report",
+      "Property: 118 Fern Road, Austin, TX    Inspected: 14 June 2024",
+      "Each system is given a condition rating: satisfactory, marginal, or",
+      "defective, with photographs in the appendix.",
+      "Roof covering: architectural shingle, marginal; several lifted tabs.",
+      "Electrical: two bathroom receptacles lack GFCI protection; recommend",
+      "evaluation by a licensed electrician.",
+      "Crawl space: minor moisture staining at the north wall; downspouts",
+      "discharge against the foundation and should be extended.",
+      "A summary of deficiencies appears on the final page.",
+    ],
+  },
+  {
+    expect: "hoa-document",
+    file: "hoa_annual_assessment.pdf",
+    title: "Fernwood Homeowners Association",
+    body: [
+      "Fernwood Homeowners Association",
+      "Annual assessment notice for 2024-2025.",
+      "Dear owner, the board has approved the budget and the annual assessment",
+      "of $640, payable in two instalments; HOA dues fund insurance, common",
+      "areas maintenance and the reserve fund.",
+      "A special assessment of $150 was approved for pool resurfacing.",
+      "Reminder: exterior changes require architectural review before work",
+      "begins, per the CC&Rs.",
+      "Questions may be directed to the managing agent, Brookside Community",
+      "Management.",
+    ],
+  },
+  {
+    expect: "application-form",
+    file: "planning_application_2024.pdf",
+    title: "Planning Application",
+    body: [
+      "Planning Application",
+      "Application for planning permission under the Town and Country Planning",
+      "Act 1990.",
+      "Proposal: erection of a single storey rear extension and detached",
+      "garden studio at 14 Fern Road.",
+      "The proposed development falls within the Fernwood conservation area;",
+      "a heritage statement accompanies this application.",
+      "Please include a site plan at 1:1250 showing the boundary in red.",
+      "Case officer use only: application reference and date received.",
+      "The planning officer will contact you if further information is needed.",
+    ],
+  },
+  {
+    expect: "government-notice",
+    file: "foi_response_2024_0441.pdf",
+    title: "Freedom of Information Request",
+    body: [
+      "Freedom of Information Request - Response",
+      "Our reference: FOI 2024/0441",
+      "Thank you for your request for information about road maintenance",
+      "spending. Your request has been handled under the Freedom of",
+      "Information Act 2000.",
+      "We have located records responsive to your request; extracts are",
+      "enclosed. Some material is withheld under section 43, and this",
+      "exemption is subject to a public interest test, which we concluded",
+      "favours withholding.",
+      "You have the right to an internal review, and thereafter may complain",
+      "to the Information Commissioner's Office.",
+    ],
+  },
+  {
+    expect: "visa-document",
+    file: "i797_approval_notice.pdf",
+    title: "U.S. Citizenship and Immigration Services",
+    body: [
+      "U.S. Citizenship and Immigration Services",
+      "I-797A, Notice of Action",
+      "Case type: I-129, petition for a nonimmigrant worker.",
+      "Receipt number: WAC-24-118-50441    Beneficiary: Reyes, Morgan",
+      "The petition has been approved. The beneficiary's alien registration",
+      "number and the attached I-94 record the new period of admission.",
+      "Immigration status: H-1B, valid to 30 September 2027.",
+      "Please contact USCIS if any information on this notice is incorrect.",
+    ],
+  },
+  {
+    expect: "license",
+    file: "premises_licence_ph0441.pdf",
+    title: "Premises Licence",
+    body: [
+      "Premises Licence",
+      "Granted under the Licensing Act 2003 by Bristol City Council as the",
+      "licensing authority.",
+      "Licence number: PL-0441    Premises: The Harbour Cafe, 112 Station Road.",
+      "The permit holder is hereby licensed to sell alcohol for consumption on",
+      "the premises between 11:00 and 23:00 daily.",
+      "The licence is granted subject to the following conditions: CCTV shall",
+      "be maintained, and a refusals log kept.",
+      "This permit must be displayed prominently at the premises.",
+    ],
+  },
+  {
+    expect: "public-notice",
+    file: "notice_public_hearing_zoning.pdf",
+    title: "Notice of Public Hearing",
+    body: [
+      "Notice of Public Hearing",
+      "Notice is hereby given that the Fernwood Town Council will hold a",
+      "public hearing on Tuesday 16 July 2024 at 7:00 pm in the council",
+      "chamber, 1 Civic Square.",
+      "The purpose of the hearing is to receive comment on the proposed",
+      "amendment to the zoning bylaw for the Station Road corridor.",
+      "All interested persons may appear and be heard, and written comments",
+      "may be filed with the clerk before the hearing.",
+      "Published by authority of the town clerk.",
+    ],
+  },
+  {
+    expect: "analytics-report",
+    file: "labour_market_bulletin.pdf",
+    pages: 18,
+    title: "Statistical Bulletin",
+    body: [
+      "Statistical Bulletin",
+      "Labour market overview, UK: July 2024.",
+      "Source: Office for National Statistics.",
+      "The employment rate was 74.6%, up 0.2 percentage points quarter on",
+      "quarter and broadly flat year on year, seasonally adjusted.",
+      "Estimates are subject to sampling error; confidence intervals are",
+      "shown in the accompanying data tables.",
+      "Next publication date: 13 August 2024.",
+      "These figures are designated national statistics.",
+    ],
+  },
+  {
+    expect: "grant-agreement",
+    file: "notice_of_award_r01.pdf",
+    title: "Notice of Award",
+    body: [
+      "Notice of Award",
+      "Federal award identification number: R01-HL-158812.",
+      "Recipient: University of Leeds    Award amount: $412,000.",
+      "Assistance listing number: 93.837.",
+      "Period of performance: 1 September 2024 to 31 August 2027.",
+      "This award is subject to the terms and conditions of the grant,",
+      "including the reporting requirements in Section IV.",
+      "Grant number and document number must be quoted on all drawdown",
+      "requests. Authorized organizational representative: Dr P. Shah.",
+    ],
+  },
+  {
+    expect: "tender-document",
+    file: "itt_fleet_services.pdf",
+    pages: 42,
+    title: "Invitation to Tender",
+    body: [
+      "Invitation to Tender",
+      "Provision of fleet maintenance services, reference ITT-2024-081.",
+      "Section 2, instructions to tenderers: tenders must be submitted through",
+      "the e-procurement portal; the submission deadline is 12:00 noon on",
+      "30 August 2024. Clarification questions close ten days earlier.",
+      "Section 3 sets out the scope of requirements, including response times",
+      "and workshop standards.",
+      "Award will be to the most economically advantageous tender against the",
+      "evaluation criteria: 60% quality, 40% price.",
+      "A pre-qualification questionnaire must accompany each submission.",
+    ],
+  },
+  {
+    expect: "sales-proposal",
+    file: "tender_response_fleet.pdf",
+    pages: 36,
+    title: "Tender Response",
+    body: [
+      "Tender Response",
+      "Provision of fleet maintenance services, reference ITT-2024-081.",
+      "We are pleased to submit our tender in response to your invitation.",
+      "Our technical response demonstrates full coverage of the scope, and the",
+      "compliance matrix at Appendix A confirms we are fully compliant with",
+      "every mandatory requirement.",
+      "The pricing schedule at Appendix B sets out fixed rates for the first",
+      "two years.",
+      "Our proposed approach pairs a dedicated account manager with a mobile",
+      "technician team based within eight miles of your depot.",
+    ],
+  },
+  {
+    expect: "supply-order",
+    file: "purchase_requisition_2214.pdf",
+    title: "Purchase Requisition",
+    body: [
+      "Purchase Requisition",
+      "Requisition number: REQ-2214    Requisition date: 3 July 2024",
+      "Requested by: Facilities    Budget holder: J. Okafor",
+      "Cost centre: FAC-110    Budget code: 5400-EQ",
+      "Justification for purchase: replacement of the workshop compressor,",
+      "which failed its service inspection.",
+      "Preferred supplier: Brightline Industrial Supplies.",
+      "Item: 90L belt-drive compressor    Qty: 1    Estimated cost: 1,140.00",
+      "Approval routing: budget holder, then procurement.",
+    ],
+  },
+  {
+    expect: "grant-application",
+    file: "community_fund_application.pdf",
+    pages: 9,
+    title: "Grant Application",
+    body: [
+      "Grant Application",
+      "Funding opportunity: Community Facilities Fund 2024.",
+      "Applicant organisation: Fernwood Sports Association, registered",
+      "charity 1148812.",
+      "Project summary: refurbish the pavilion kitchen and accessible toilet.",
+      "Amount requested: 24,500. We are applying for 70% of project costs,",
+      "with match funding of 10,500 secured from club reserves.",
+      "Outcomes and milestones: works complete by March 2025; open kitchen",
+      "sessions for four community groups per week from April.",
+      "Declaration signed by two trustees.",
+    ],
+  },
+  {
+    expect: "technical-drawing",
+    file: "GA-1104_rev_C.pdf",
+    title: "General Arrangement",
+    body: [
+      "General Arrangement - Conveyor Frame Assembly",
+      "Drawing number GA-1104    Revision C    Scale 1:10    Sheet 1 of 2",
+      "Third angle projection. Do not scale. Work to figured dimensions only.",
+      "All dimensions in millimetres unless noted otherwise.",
+      "Break all sharp edges 0.5 x 45 degrees.",
+      "Material: S275 structural steel, hot dip galvanised after fabrication.",
+      "Drawn by: MR    Checked by: TH    Approved: 21/06/2024",
+      "Issued for construction.",
+    ],
+  },
+  {
+    expect: "bill-of-materials",
+    file: "bom_ctrl_board_a3.pdf",
+    title: "Bill of Material",
+    body: [
+      "Bill of Material - Controller Board, Assembly CTRL-0301 Rev A3",
+      "Top level assembly: CTRL-0301    Qty per assembly shown per unit.",
+      "Ref designator    Manufacturer part number    Description    Qty",
+      "C1-C8    GRM188R71C104KA01    100nF 0402 X7R    8",
+      "R12    ERJ-3EKF1002V    10k 0603 1%    1",
+      "U4    STM32G071KBU6    MCU, 64k flash    1",
+      "J2    Do not populate - programming header, test builds only.",
+      "Reference designator order follows the assembly drawing.",
+    ],
+  },
+  {
+    expect: "safety-procedure",
+    file: "sop_014_lockout.pdf",
+    title: "Standard Operating Procedure",
+    body: [
+      "Standard Operating Procedure SOP-014: Conveyor Lockout and Cleaning",
+      "Purpose: safe isolation of the packing conveyor for scheduled cleaning.",
+      "A permit to work is required before starting; the shift supervisor",
+      "delivers a toolbox talk covering this procedure at the start of shift.",
+      "Personal protective equipment: cut-resistant gloves and safety glasses.",
+      "Sequence of work: isolate at the local breaker, apply personal lock and",
+      "tag, verify zero energy, then clean per the schedule.",
+      "Control measures: an exclusion zone is marked while guards are off.",
+      "First aid arrangements are posted at the workshop entrance.",
+    ],
+  },
+  {
+    expect: "test-report",
+    file: "mill_cert_heat_88412.pdf",
+    title: "Mill Test Certificate",
+    body: [
+      "Mill Test Certificate",
+      "Certificate number: MTC-2024-1180    Standard: EN 10204 3.1",
+      "Product: S355J2 structural plate, 12mm.    Heat number: 88412.",
+      "Cast number: 88412-2.",
+      "Chemical composition (%): C 0.16, Si 0.35, Mn 1.42, P 0.012, S 0.008.",
+      "Mechanical properties: yield strength 372 MPa, tensile strength",
+      "528 MPa, elongation 24%.",
+      "Charpy impact at -20C: 41J average, batch tested.",
+      "We certify the material supplied conforms to the order requirements.",
+    ],
+  },
+  {
+    expect: "quality-report",
+    file: "fai_report_ctrl0301.pdf",
+    title: "First Article Inspection Report",
+    body: [
+      "First Article Inspection Report",
+      "Part: mounting bracket BRK-2210 Rev B    Inspection lot: 24-0611",
+      "Purpose: dimensional inspection of the first production article against",
+      "the drawing, using the sampling plan in QP-07.",
+      "Characteristic 4: hole spacing 42.00 +/- 0.10, measured 42.06, pass.",
+      "Characteristic 9: flatness 0.20 max, measured 0.31, out of tolerance.",
+      "Disposition: non-conformance NC-118 raised; use-as-is rejected; rework",
+      "and re-present for final inspection.",
+      "Inspected by: T. Hale    Acceptance criteria: drawing plus QP-07.",
+    ],
+  },
+  {
+    expect: "return-authorization",
+    file: "rma_return_label.pdf",
+    title: "Return Merchandise Authorization",
+    body: [
+      "Return Merchandise Authorization",
+      "RMA number: RMA-88412    Order: 2024-1180",
+      "Return reason: wrong size.",
+      "Return instructions: pack the item in its original packaging, include",
+      "this sheet, and affix this label to the outside of the box.",
+      "The enclosed prepaid return label covers shipping; drop the parcel at",
+      "any service point within 30 days.",
+      "Refunds are processed by the returns department within five working",
+      "days of receipt.",
+    ],
+  },
+  {
+    expect: "presentation",
+    file: "qbr_slides_q2.pdf",
+    pages: 22,
+    meta: { producer: "Microsoft PowerPoint for Microsoft 365" },
+    title: "Quarterly Business Review",
+    body: [
+      "Quarterly Business Review",
+      "Agenda: performance recap, customer health, roadmap, open actions.",
+      "In this presentation we cover Q2 results and the outlook for Q3.",
+      "Key takeaways: renewals held at 96%, onboarding time halved, and the",
+      "new reporting module is the most requested add-on.",
+      "Customer health: two accounts at risk, recovery plans in flight.",
+      "Q&A",
+      "Thank you for your attention.",
+    ],
+  },
+  {
+    expect: "brochure",
+    file: "spring_offers_flyer.pdf",
+    title: "Fernwood Garden Services",
+    body: [
+      "Fernwood Garden Services",
+      "Why choose us? Fully insured, local, and rated 4.9 across 300 reviews.",
+      "Spring tidy-ups, hedge cutting, lawn treatment plans and patio cleaning.",
+      "Features and benefits: fixed prices, no contract, satisfaction",
+      "guaranteed on every visit.",
+      "Limited time offer: 20% off your first lawn treatment.",
+      "Book your free consultation today - call us today on 0117 946 0000 or",
+      "visit our website for a free quote.",
+      "Bring this flyer to receive the discount. No obligation.",
+    ],
+  },
+  {
+    expect: "business-plan",
+    file: "business_plan_2024.pdf",
+    pages: 26,
+    title: "Business Plan",
+    body: [
+      "Business Plan",
+      "Harbour Roastery Ltd, 2024 to 2027.",
+      "Executive summary: a speciality coffee roastery supplying cafes across",
+      "the south west, expanding into direct subscriptions.",
+      "Company description: founded 2021; roastery and training room in Bristol.",
+      "Market analysis: the regional speciality segment is growing 11% a year;",
+      "our target market is independent cafes within 90 minutes.",
+      "SWOT analysis and competitive landscape are set out in section 4.",
+      "Financial projections: revenue of 640k in year one rising to 1.1m in",
+      "year three, with break-even analysis at month 14.",
+      "Funding requirements: 180k for a second roaster and packing line.",
+      "Revenue model: wholesale contracts plus consumer subscriptions.",
+    ],
+  },
+  {
+    expect: "organization-chart",
+    file: "org_chart_july.pdf",
+    title: "Organisation Chart",
+    body: [
+      "Organisation Chart - Northwind Trading Ltd, July 2024",
+      "This chart shows reporting lines and department structure after the",
+      "June reorganisation; headcount is shown in brackets for each team.",
+      "Chief Executive",
+      "Operations Director - direct reports: warehouse manager, fleet",
+      "manager, facilities lead. The warehouse manager reports to the",
+      "Operations Director with a team of 24.",
+      "Finance Director - direct reports: financial controller, payroll lead.",
+      "The reporting structure for the interim data team is under review.",
+    ],
+  },
+  {
+    expect: "technical-specification",
+    file: "srs_dispatch_v2.pdf",
+    pages: 34,
+    title: "Software Requirements Specification",
+    body: [
+      "Software Requirements Specification",
+      "Dispatch Planning System, version 2.0. This document specifies the",
+      "functional requirements and non-functional requirements for the",
+      "dispatch planner used by the operations team.",
+      "Intended audience: developers, testers and the product owner.",
+      "Normative references: RFC 2119 key words; see terms and definitions.",
+      "FR-12: the system shall comply with the routing rules in Appendix C.",
+      "NFR-3: page loads shall complete within two seconds at the 95th",
+      "percentile.",
+      "Revision history and acceptance criteria appear at the end of this",
+      "document.",
+    ],
+  },
+  {
+    expect: "patent",
+    file: "US10884412.pdf",
+    pages: 24,
+    title: "United States Patent",
+    body: [
+      "United States Patent",
+      "Patent number: US 10,884,412 B2    Date of patent: Jan 5, 2021",
+      "Field of the invention: the present invention relates to modular",
+      "conveyor systems for warehouse automation.",
+      "Background of the invention: existing pickers require fixed rails.",
+      "Summary of the invention: a drive unit with a detachable guide.",
+      "Brief description of the drawings: FIG. 1 shows the drive unit;",
+      "FIG. 2 shows the guide in a released position.",
+      "In one embodiment, the preferred embodiment uses a magnetic coupling",
+      "distinguishing over the prior art. References cited appear on the",
+      "cover page.",
+      "What is claimed is: 1. A conveyor drive unit comprising a housing...",
+    ],
+  },
+  {
+    expect: "api-documentation",
+    file: "dispatch_api_reference.pdf",
+    pages: 58,
+    title: "API Reference",
+    body: [
+      "API Reference",
+      "Dispatch Planning API, version 2.3. See the changelog and release",
+      "notes for differences from 2.2, including known issues.",
+      "Authentication: pass your API key in the Authorization header. The",
+      "sandbox base URL is http://localhost:8080 when using the emulator.",
+      "POST /routes - create a route. Query parameters: dryRun (boolean).",
+      "The request body accepts a JSON route plan; the response body returns",
+      "the planned stops with ETAs.",
+      "Configuration: set the DISPATCH_ENV environment variable, or use the",
+      "configuration file described in the developer guide. A command line",
+      "client is available for scripting.",
+    ],
+  },
+  {
+    expect: "license-agreement",
+    file: "license_certificate_pro.pdf",
+    title: "License Certificate",
+    body: [
+      "License Certificate",
+      "Product: FlowChart Studio Professional    License type: perpetual",
+      "license with twelve months of updates.",
+      "Licensed to: Northwind Trading Ltd    Number of seats: 25",
+      "License key: XXXXX-XXXXX-XXXXX-88412    Serial number: 118812",
+      "Maintenance expires: 31 July 2025.",
+      "How to activate: open Help, choose Enter activation code, and paste",
+      "the license key above. Activation instructions for offline machines",
+      "are on the reverse.",
+      "Keep this certificate for your records.",
+    ],
+  },
+  {
+    expect: "gift-certificate",
+    file: "gift_voucher_50.pdf",
+    title: "Gift Voucher",
+    body: [
+      "Gift Voucher",
+      "The Harbour Cafe",
+      "This voucher entitles the bearer to fifty pounds toward food and drink.",
+      "Voucher code: HC-4412-GIFT    Value: 50.00",
+      "To redeem, present this voucher at the till; redeemable at our Station",
+      "Road cafe only.",
+      "Valid until 30 June 2025. Not redeemable for cash; no cash value if",
+      "lost or expired.",
+      "From: Aunt Priya    To: Sam - happy graduation!",
+    ],
+  },
+  {
+    expect: "confirmation-letter",
+    file: "appointment_confirmation_dental.pdf",
+    title: "Appointment Confirmation",
+    body: [
+      "Appointment Confirmation",
+      "Dear Morgan Reyes,",
+      "Your appointment has been confirmed with Dr Okafor at Fernwood Dental.",
+      "Appointment date: Tuesday 23 July 2024    Appointment time: 09:40",
+      "Please arrive ten minutes early with a list of current medications.",
+      "If you are unable to attend, you can cancel or reschedule up to 24",
+      "hours in advance without charge; to reschedule call 0117 946 0001.",
+      "Failure to attend without notice may incur a fee.",
+      "We look forward to seeing you.",
+    ],
+  },
+  {
+    expect: "waybill",
+    file: "bill_of_lading_88412.pdf",
+    title: "Bill of Lading",
+    body: [
+      "Straight Bill of Lading",
+      "Carrier: Lakeshore Logistics LLC    Pro number: 8841-2214",
+      "Shipper: Brightline Packaging Ltd, Unit 4, Riverside Estate, Leeds.",
+      "Consignee: Northwind Trading Ltd, 12 Dock Street, Hull.",
+      "6 pallets, corrugated cartons, 1,420 kg, freight charges collect.",
+      "Received in apparent good order for carriage subject to the conditions",
+      "on the reverse.",
+      "Shipper signature: J. Mills    Driver: T. Hale    Trailer: 4471",
+    ],
+  },
+  {
+    expect: "incident-report",
+    file: "accident_report_yard.pdf",
+    title: "Accident Report",
+    body: [
+      "Accident Report",
+      "Reference: AR-2024-0611    Location: Northwind Trading, dispatch yard.",
+      "Date and time: 11 June 2024, 14:20.",
+      "Description: a reversing forklift struck a pallet stack; a case fell",
+      "and bruised an operative's shoulder. First aid was given on site and",
+      "the operative attended hospital as a precaution.",
+      "Reporting officer: S. Whitfield, shift supervisor.",
+      "A copy of the police report was requested for the insurer, and the",
+      "root cause analysis is scheduled for Friday's safety meeting.",
+      "Witnesses: two, statements attached. Severity level: minor.",
+    ],
+  },
+  {
+    expect: "certificate",
+    file: "birth_certificate_reyes.pdf",
+    title: "Certificate of Live Birth",
+    body: [
+      "Certificate of Live Birth",
+      "Registration district: Travis County, Texas.",
+      "This is to certify that the following particulars are recorded in the",
+      "register of births.",
+      "Child: Alex Jordan Reyes    Date of birth: 4 December 2016",
+      "Place of birth: Austin, Texas.",
+      "Parents: Morgan Reyes and Casey Reyes.",
+      "Registered: 18 December 2016    Registrar: E. Marsh",
+      "Certified to be a true copy of an entry in the register.",
+    ],
+  },
+  {
+    expect: "regulatory-filing",
+    file: "articles_of_incorporation_acme.pdf",
+    pages: 4,
+    title: "Articles of Incorporation",
+    body: [
+      "Articles of Incorporation",
+      "of Acme Robotics, Inc., filed with the Secretary of State of Delaware.",
+      "First: the name of the corporation is Acme Robotics, Inc.",
+      "Second: the registered office is 1209 Orange Street, Wilmington.",
+      "Third: the corporation is authorized to issue 10,000,000 shares of",
+      "common stock with a par value of $0.0001 per share.",
+      "Fourth: the name and mailing address of the incorporator are stated",
+      "below. Upon filing, the certificate of incorporation becomes effective.",
+      "In witness whereof, the incorporator has executed these articles on",
+      "12 July 2024.",
+    ],
+  },
+  {
+    expect: "invoice",
+    file: "qb_invoice_1181.pdf",
+    meta: { producer: "Intuit QuickBooks Online" },
+    title: "Invoice",
+    body: [
+      "Invoice",
+      "Harbour Roastery Ltd",
+      "Invoice number: 1181    Invoice date: 2 August 2024",
+      "Bill to: The Harbour Cafe, 112 Station Road.",
+      "House espresso 6kg ... 96.00",
+      "Filter subscription (August) ... 48.00",
+      "Total: 144.00. Payment terms: net 30.",
+    ],
+  },
+  {
+    expect: "payslip",
+    file: "adp_earnings_statement.pdf",
+    meta: { producer: "ADP, LLC" },
+    title: "Earnings Statement",
+    body: [
+      "Earnings Statement",
+      "Northwind Trading Ltd    Pay period: 01/07/2024 to 31/07/2024",
+      "Pay date: 31 July 2024    Employee: T. Hale",
+      "Gross pay: 2,860.00",
+      "Total deductions: 642.10, including income tax and pension.",
+      "Net pay: 2,217.90",
+      "Year to date gross: 20,020.00    Tax code: 1257L",
+    ],
+  },
+  {
+    expect: "tax-return",
+    file: "turbotax_2023_return.pdf",
+    pages: 14,
+    meta: { producer: "Intuit TurboTax 2023" },
+    title: "U.S. Individual Income Tax Return",
+    body: [
+      "Form 1040: U.S. Individual Income Tax Return, tax year 2023.",
+      "Filing status: married filing jointly.",
+      "Wages from W-2 box 1: 96,400. Interest income: 412.",
+      "Adjusted gross income: 96,812.",
+      "Standard deduction: 27,700. Taxable income: 69,112.",
+      "Total tax: 7,864. Federal income tax withheld: 8,120.",
+      "Refund: 256. Routing and account numbers as provided.",
+    ],
+  },
+  {
+    expect: "expense-report",
+    file: "concur_expense_july.pdf",
+    meta: { producer: "SAP Concur" },
+    title: "Expense Report",
+    body: [
+      "Expense Report",
+      "Employee: S. Whitfield    Report: July client visits",
+      "Business purpose: quarterly reviews with three northern accounts.",
+      "12 July - rail, Leeds to Hull, 34.50, receipts attached.",
+      "12 July - lunch with client, 28.20.",
+      "18 July - mileage claimed: 96 miles at 0.45 per mile, 43.20.",
+      "Per diem (two days): 50.00.",
+      "Total reimbursable: 155.90.",
+      "Approved by cost center FAC-110 manager.",
+    ],
+  },
+  {
+    expect: "",
+    file: "angebot_gartenpflege.pdf",
+    title: "Angebot Gartenpflege",
+    body: [
+      "Angebot fur die Gartenpflege",
+      "Sehr geehrte Frau Weber, vielen Dank fur Ihre Anfrage.",
+      "Gerne unterbreiten wir Ihnen das folgende Angebot fur die regelmassige",
+      "Pflege Ihres Gartens mit einem monatlichen Besuch unseres Teams.",
+      "Der Preis betragt 120 Euro pro Monat und die Rechnung wird jeweils am",
+      "Anfang des Monats gestellt. Das Angebot ist bis Ende August gultig und",
+      "wir freuen uns sehr auf Ihre Ruckmeldung.",
+      "Mit freundlichen Grussen, Fernwood Gartenservice GmbH",
+    ],
+  },
+];
+
+describe("heuristic engine broad corpus", () => {
+  it.each(CASES.map((c) => [c.expect || `nothing (${c.file})`, c] as const))(
+    "labels a %s correctly",
+    (_label, c) => {
+      const r = run(c);
+      const detail = `expected ${c.expect || "no label"}, got [${r.labels.join(", ")}] (confidence ${r.confidence}, score ${r.score})`;
+      if (c.expect === "") {
+        expect(r.labels, detail).toEqual([]);
+      } else {
+        expect(r.labels[0], detail).toBe(c.expect);
+      }
+    },
+  );
+});
diff --git a/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.docs.test.ts b/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.docs.test.ts
new file mode 100644
index 0000000000..25d226035d
--- /dev/null
+++ b/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.docs.test.ts
@@ -0,0 +1,118 @@
+// Regression cases: each feeds the real engine a typical specimen's actual text.
+
+import { beforeAll, describe, expect, it } from "vitest";
+import {
+  classifyHeuristic,
+  ensureRulesLoaded,
+} from "@app/services/heuristic/heuristicEngine";
+import type { HeuristicDoc } from "@app/services/heuristic/types";
+
+beforeAll(async () => {
+  await ensureRulesLoaded();
+});
+
+function classify(
+  title: string,
+  body: string,
+  fileName = "doc.pdf",
+  pageCount = 1,
+) {
+  const doc: HeuristicDoc = {
+    fileName,
+    pageCount,
+    meta: {},
+    titleZone: title,
+    firstZone: body,
+    allZone: body,
+  };
+  return classifyHeuristic(doc);
+}
+
+describe("scoring explanations", () => {
+  const doc: HeuristicDoc = {
+    fileName: "invoice_acme.pdf",
+    pageCount: 1,
+    meta: {},
+    titleZone: "TAX INVOICE",
+    firstZone: "Invoice Number: INV-9 Invoice Total: 950.00",
+    allZone: "Invoice Number: INV-9 Invoice Total: 950.00",
+  };
+
+  it("returns candidates with per-rule signals when requested", () => {
+    const r = classifyHeuristic(doc, { explain: true });
+    expect(r.labels[0]).toBe("invoice");
+    const top = r.explain?.candidates[0];
+    expect(top?.id).toBe("invoice");
+    expect(top?.score).toBeGreaterThan(0);
+    expect(top?.signals.some((s) => s.includes('phrase "tax invoice"'))).toBe(
+      true,
+    );
+    expect(top?.signals.some((s) => s.includes("filename"))).toBe(true);
+  });
+
+  it("omits the explanation by default", () => {
+    expect(classifyHeuristic(doc).explain).toBeUndefined();
+  });
+});
+
+describe("documents observed lost on upload (engine must label them)", () => {
+  it("labels a resume", () => {
+    const body = [
+      "CURRICULUM VITAE",
+      "Jane Doe    jane.doe@example.com    +44 7700 900123    London, United Kingdom",
+      "Professional Summary: An experienced software engineer with more than ten years of",
+      "professional experience building reliable web applications and leading small teams.",
+      "Career Objective: To take on a senior engineering role where I can apply my skills in",
+      "distributed systems and mentor other engineers on the team.",
+      "Professional Experience:",
+      "Senior Engineer, Northwind Ltd (2019 to present). Led the migration of the billing platform",
+      "and improved reliability across all of the core services.",
+      "Software Engineer, Contoso plc (2014 to 2019). Built and maintained customer-facing features",
+      "used by more than a million people every day.",
+      "Education: BSc Computer Science, University of Manchester.",
+      "References available upon request.",
+    ].join("\n");
+    const r = classify("CURRICULUM VITAE", body, "resume_jane_doe.pdf");
+    expect(r.labels[0]).toBe("resume");
+  });
+
+  it("labels a purchase order", () => {
+    const body = [
+      "PURCHASE ORDER",
+      "Purchase Order Number: PO-55231    Requisition Number: REQ-9910    Date: 2 April 2024",
+      "To: Global Office Supplies Ltd. Please supply the following goods to our warehouse at the",
+      "address shown below and confirm the expected delivery date by return.",
+      "Qty Ordered: 20    Item: Ergonomic office chair    Unit Price: $180.00",
+      "Qty Ordered: 15    Item: Height-adjustable desk    Unit Price: $420.00",
+      "Qty Ordered: 50    Item: LED desk lamp    Unit Price: $35.00",
+      "This is an official order. All goods supplied against this purchase order must reference the",
+      "requisition number on the delivery note and on your invoice.",
+      "Authorised by: Procurement Department, Northwind Ltd.",
+    ].join("\n");
+    const r = classify("PURCHASE ORDER", body, "purchase_order.pdf");
+    expect(r.labels[0]).toBe("purchase-order");
+  });
+
+  it("labels a master services agreement", () => {
+    const body = [
+      "MASTER SERVICES AGREEMENT",
+      "This Master Services Agreement is made between the Client and the Service Provider and sets",
+      "out the terms on which the Service Provider will provide services to the Client.",
+      "1. Engagement. The Client engages the Service Provider to perform the services described in",
+      "each Statement of Work agreed between the parties from time to time.",
+      "2. Fees. The Client shall pay the fees set out in the applicable Statement of Work within",
+      "thirty days of the date of each invoice.",
+      "3. Term and Termination. This agreement shall continue until terminated by either party on",
+      "sixty days written notice to the other party.",
+      "4. Confidentiality. Each party shall keep confidential the confidential information of the",
+      "other party that it receives under this agreement.",
+      "We are pleased to act for you and look forward to a productive working relationship.",
+    ].join("\n");
+    const r = classify(
+      "MASTER SERVICES AGREEMENT",
+      body,
+      "service_agreement.pdf",
+    );
+    expect(r.labels[0]).toBe("service-agreement");
+  });
+});
diff --git a/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.test.ts b/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.test.ts
new file mode 100644
index 0000000000..dbbe78c441
--- /dev/null
+++ b/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.test.ts
@@ -0,0 +1,125 @@
+// Core fidelity cases for the heuristic engine against the real rules pack.
+
+import { beforeAll, describe, expect, it } from "vitest";
+import {
+  classifyHeuristic,
+  detectEnglish,
+  ensureRulesLoaded,
+} from "@app/services/heuristic/heuristicEngine";
+import type { HeuristicDoc } from "@app/services/heuristic/types";
+
+beforeAll(async () => {
+  await ensureRulesLoaded();
+});
+
+function classify(title: string, body: string) {
+  const doc: HeuristicDoc = {
+    fileName: "doc.pdf",
+    pageCount: 1,
+    meta: {},
+    titleZone: title,
+    firstZone: body,
+    allZone: body,
+  };
+  return classifyHeuristic(doc);
+}
+
+describe("heuristic engine port fidelity", () => {
+  it("classifies an invoice as invoice", () => {
+    const body = [
+      "INVOICE",
+      "Acme Web Services Ltd",
+      "123 High Street, London, EC1A 4JQ",
+      "Invoice Number: INV-2024-0117",
+      "Invoice Date: 14 March 2024",
+      "Due Date: 13 April 2024",
+      "Bill To: Northwind Trading Company",
+      "Description            Qty    Unit Price    Amount",
+      "Website hosting (annual)   1      480.00       480.00",
+      "Subtotal: 930.00",
+      "VAT (20%): 186.00",
+      "Total Due: 1,116.00",
+      "Payment Terms: Net 30. Please quote the invoice number with payment.",
+    ].join("\n");
+    const r = classify("INVOICE", body);
+    expect(r.labels.length).toBeGreaterThan(0);
+    expect(r.labels[0]).toBe("invoice");
+  });
+
+  it("classifies a curriculum vitae as resume", () => {
+    const body = [
+      "CURRICULUM VITAE",
+      "Jordan Ellis",
+      "Bristol, UK | jordan.ellis@example.com | 07700 900123",
+      "Professional Summary",
+      "Experienced software engineer with 8 years building web platforms.",
+      "Work Experience",
+      "Senior Engineer, Northwind Ltd (2020-present)",
+      "Education",
+      "BSc Computer Science, University of Bristol, 2016",
+      "Skills",
+      "TypeScript, Java, React, cloud architecture, mentoring",
+      "References available on request.",
+    ].join("\n");
+    const r = classify("CURRICULUM VITAE", body);
+    expect(r.labels.length).toBeGreaterThan(0);
+    expect(r.labels[0]).toBe("resume");
+  });
+
+  it("classifies a boarding pass as ticket", () => {
+    const body = [
+      "BOARDING PASS",
+      "British Airways",
+      "Passenger: SMITH/JANE MS",
+      "Flight: BA 117    Date: 22 APR 2024",
+      "From: LONDON HEATHROW (LHR)  Terminal 5",
+      "To: NEW YORK JFK (JFK)",
+      "Departure: 11:20   Boarding Time: 10:35   Gate: B44",
+      "Seat: 34K   Group: 3   Class: Economy",
+      "Booking Reference: XK9PLQ",
+      "Please be at the gate 45 minutes before departure.",
+    ].join("\n");
+    const r = classify("BOARDING PASS", body);
+    expect(r.labels.length).toBeGreaterThan(0);
+    expect(r.labels[0]).toBe("ticket");
+  });
+
+  it("classifies an NDA as nda", () => {
+    const body = [
+      "NON-DISCLOSURE AGREEMENT",
+      "This Mutual Non-Disclosure Agreement (the Agreement) is entered into",
+      "by and between Stirling Systems Ltd and the Receiving Party.",
+      "1. Confidential Information means any proprietary data disclosed by a party.",
+      "2. Obligations: The Receiving Party shall hold all Confidential Information",
+      "in strict confidence and not disclose it to any third party.",
+      "3. Term: The obligations survive for a period of five (5) years.",
+      "4. Governing Law: This Agreement is governed by the laws of England and Wales.",
+      "Accepted and agreed by the authorised representatives of the parties.",
+    ].join("\n");
+    const r = classify("NON-DISCLOSURE AGREEMENT", body);
+    expect(r.labels.length).toBeGreaterThan(0);
+    expect(r.labels[0]).toBe("nda");
+  });
+
+  it("does not classify a non-English (Spanish) document", () => {
+    const body = [
+      "CONTRATO DE ARRENDAMIENTO DE VIVIENDA",
+      "Este contrato de arrendamiento se celebra entre el arrendador y el",
+      "arrendatario para la vivienda situada en la ciudad.",
+      "El arrendatario pagara una renta mensual de 1150 euros segun las",
+      "condiciones que las partes acuerdan por el plazo de doce meses.",
+      "Ambas partes firman este documento segun la ley aplicable.",
+    ].join("\n");
+    const r = classify("CONTRATO DE ARRENDAMIENTO", body);
+    expect(r.isEnglish).toBe(false);
+    expect(r.labels).toHaveLength(0);
+  });
+
+  it("detects English prose", () => {
+    const english =
+      "This agreement is made between the parties and shall be governed by the laws" +
+      " of England. The tenant agrees to pay the rent that is due under this" +
+      " contract for the property.";
+    expect(detectEnglish(english).isEnglish).toBe(true);
+  });
+});
diff --git a/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.ts b/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.ts
new file mode 100644
index 0000000000..e030a9e93a
--- /dev/null
+++ b/frontend/editor/src/proprietary/services/heuristic/heuristicEngine.ts
@@ -0,0 +1,976 @@
+// Heuristic (non-AI) document classifier: string/regex/structural scoring over
+// extracted text, filename and metadata. Rules lazy-load as a separate chunk.
+
+import type {
+  HeuristicConfidence,
+  HeuristicDoc,
+  HeuristicExplanation,
+  HeuristicResult,
+} from "@app/services/heuristic/types";
+
+export type {
+  HeuristicConfidence,
+  HeuristicDoc,
+  HeuristicExplanation,
+  HeuristicResult,
+};
+
+// --- scoring constants ---
+const ZONE_MULT: Record<string, number> = { title: 2.0, first: 1.35, any: 1.0 };
+const FLOOR = 18;
+const HIGH_SCORE = 45;
+const HIGH_MARGIN = 15;
+const HIGH_SIGNALS = 3;
+const MED_SCORE = 28;
+const MED_MARGIN = 8;
+const SEC_FLOOR = 28;
+const SEC_FRAC = 0.5;
+const SEC_SIGNALS = 2;
+const SEC_MAX = 4;
+
+const STOPWORDS = new Set<string>([
+  "the",
+  "and",
+  "of",
+  "to",
+  "in",
+  "is",
+  "that",
+  "for",
+  "on",
+  "with",
+  "as",
+  "are",
+  "this",
+  "be",
+  "by",
+  "at",
+  "from",
+  "or",
+  "an",
+  "not",
+  "your",
+  "you",
+  "we",
+  "has",
+  "have",
+  "will",
+  "was",
+  "were",
+  "been",
+  "their",
+  "they",
+  "which",
+  "any",
+  "all",
+  "may",
+  "shall",
+  "if",
+  "can",
+  "our",
+  "its",
+  "it",
+  "no",
+  "but",
+  "other",
+  "than",
+  "these",
+  "such",
+  "must",
+  "each",
+  "per",
+  "under",
+  "more",
+  "when",
+  "also",
+  "into",
+  "only",
+  "should",
+  "would",
+]);
+
+// Non-Latin scripts end English classification outright when they dominate.
+const SCRIPT_RANGES: RegExp[] = [
+  /[一-鿿぀-ヿ]/g, // CJK + Kana
+  /[가-힯ᄀ-ᇿ]/g, // Hangul
+  /[Ѐ-ӿ]/g, // Cyrillic
+  /[؀-ۿݐ-ݿ]/g, // Arabic
+  /[Ͱ-Ϳ]/g, // Greek
+  /[ऀ-ॿ]/g, // Devanagari
+  /[֐-׿]/g, // Hebrew
+  /[฀-๿]/g, // Thai
+];
+
+interface LatinProfile {
+  words: Set<string>;
+  dia: RegExp | null;
+}
+
+// Function-word and diacritic profiles for common Latin-script languages.
+const LATIN_PROFILES: LatinProfile[] = [
+  {
+    words: new Set([
+      "el",
+      "los",
+      "las",
+      "que",
+      "para",
+      "una",
+      "por",
+      "según",
+      "más",
+    ]),
+    dia: /[áéíóúñ¿¡]/g,
+  },
+  {
+    words: new Set([
+      "le",
+      "les",
+      "des",
+      "une",
+      "est",
+      "pour",
+      "avec",
+      "dans",
+      "vous",
+      "votre",
+      "être",
+      "nous",
+      "cette",
+      "sont",
+      "été",
+    ]),
+    dia: /[àâçèéêëîïôùûœ]/g,
+  },
+  {
+    words: new Set([
+      "der",
+      "die",
+      "das",
+      "und",
+      "ist",
+      "für",
+      "mit",
+      "von",
+      "nicht",
+      "ein",
+      "eine",
+      "werden",
+      "wird",
+      "bei",
+      "sind",
+      "dem",
+    ]),
+    dia: /[äöüß]/g,
+  },
+  {
+    words: new Set([
+      "il",
+      "di",
+      "che",
+      "per",
+      "con",
+      "una",
+      "del",
+      "della",
+      "sono",
+      "questo",
+      "essere",
+      "più",
+      "nel",
+      "anche",
+      "gli",
+    ]),
+    dia: /[àèéìòù]/g,
+  },
+  {
+    words: new Set([
+      "os",
+      "as",
+      "que",
+      "para",
+      "com",
+      "uma",
+      "por",
+      "são",
+      "não",
+      "você",
+      "está",
+      "mais",
+    ]),
+    dia: /[ãõçáéíóúâêô]/g,
+  },
+  {
+    words: new Set([
+      "het",
+      "een",
+      "van",
+      "voor",
+      "met",
+      "aan",
+      "niet",
+      "zijn",
+      "wordt",
+      "deze",
+      "als",
+      "bij",
+      "ook",
+      "naar",
+    ]),
+    dia: null,
+  },
+  {
+    words: new Set([
+      "och",
+      "att",
+      "det",
+      "som",
+      "på",
+      "är",
+      "av",
+      "för",
+      "med",
+      "den",
+      "till",
+      "inte",
+      "har",
+      "ett",
+      "du",
+    ]),
+    dia: /[åäö]/g,
+  },
+  {
+    words: new Set([
+      "nie",
+      "jest",
+      "się",
+      "że",
+      "oraz",
+      "dla",
+      "przez",
+      "lub",
+      "być",
+      "może",
+      "przy",
+      "jak",
+    ]),
+    dia: /[ąćęłńśźż]/g,
+  },
+  {
+    words: new Set([
+      "ve",
+      "bir",
+      "bu",
+      "için",
+      "ile",
+      "olarak",
+      "olan",
+      "gibi",
+      "daha",
+      "çok",
+      "her",
+      "kadar",
+      "sonra",
+    ]),
+    dia: /[çğışöü]/g,
+  },
+];
+
+// detectEnglish helper patterns (global for counting; \p{L} needs the u flag).
+const LETTERS = /\p{L}/gu;
+const LATIN_LETTER = /[a-z]/gi;
+const WORD = /[\p{L}']+/gu;
+
+// ASCII whitespace plus the no-break spaces pdf.js extraction commonly emits.
+// eslint-disable-next-line no-control-regex -- vertical tab is intentional ASCII whitespace
+const WHITESPACE = /[\t\n\x0B\f\r \u00A0\u2007\u202F]+/g;
+
+// Structural signal patterns. Boolean-presence ones stay non-global (safe .test()),
+// counting ones are global (used via countAll). Currency symbols are \u-escaped.
+const CURRENCY = new RegExp(
+  "[$£€]\\s?\\d[\\d,.]*|\\d[\\d,.]*\\s?(usd|gbp|eur)\\b",
+  "gi",
+);
+const NUMERIC_TOKEN = new RegExp("^[\\d$£€.,%-]+$");
+const DIGIT = /\d/;
+const FORM_LABEL = /^[A-Za-z][A-Za-z /()&']{2,30}:\s*$/;
+const UNDERSCORE4 = /_{4,}/;
+const CHECKBOX = /[☐☑□■]\s/;
+const DOT_LEADER = /\.{5,}\s*\d+\s*$/;
+const BULLET = /^[•▪◦*-]\s+\S/;
+const URL = /https?:\/\/|www\./gi;
+const TOC = /table of contents/i;
+const SIG1 = /\b(signature|signed by|authorized signature|\/s\/)\b/i;
+const SIG2 = /_{6,}\s*\n\s*(date|name|sign)/i;
+const REF1 = /\b(references|bibliography)\b/i;
+const REF2 = /\[\d{1,3}\]|\(\d{4}\)/;
+const EMAIL_FROM = /\bfrom:\s.+\n(.*\n){0,3}?\s*(to|sent|date):\s/i;
+const EMAIL_SUBJ = /subject:\s/i;
+const ADDRESS = /\b\d{5}(-\d{4})?\b|\b[A-Z]{1,2}\d{1,2}[A-Z]?\s?\d[A-Z]{2}\b/g;
+
+// --- prepared rule model ---
+interface Phrase {
+  text: string;
+  weight: number;
+  where: string;
+}
+interface Rx {
+  re: RegExp;
+  weight: number;
+  where: string;
+}
+interface FileRx {
+  re: RegExp;
+  weight: number;
+}
+interface MetaRx {
+  field: string;
+  re: RegExp;
+  weight: number;
+}
+interface Negative {
+  text: string | null;
+  re: RegExp | null;
+  weight: number;
+}
+interface Structural {
+  signal: string;
+  weight: number;
+}
+interface PreparedLabel {
+  id: string;
+  emit: boolean;
+  phrases: Phrase[];
+  regexes: Rx[];
+  filenames: FileRx[];
+  metadata: MetaRx[];
+  negatives: Negative[];
+  structural: Structural[];
+}
+interface Prior {
+  min: number;
+  max: number | null;
+}
+
+// Raw JSON shapes (loose - the pack is authored by hand).
+interface RawRule {
+  text?: unknown;
+  pattern?: unknown;
+  weight?: unknown;
+  where?: unknown;
+  flags?: unknown;
+  field?: unknown;
+  signal?: unknown;
+}
+interface RawLabel {
+  id?: unknown;
+  emit?: unknown;
+  phrases?: RawRule[];
+  regexes?: RawRule[];
+  filenames?: RawRule[];
+  metadata?: RawRule[];
+  negatives?: RawRule[];
+  structural?: RawRule[];
+}
+interface RulesFile {
+  labels?: RawLabel[];
+  priors?: Record<string, unknown>;
+}
+
+let PREPARED: PreparedLabel[] | null = null;
+let PRIORS: Map<string, Prior> | null = null;
+let loadPromise: Promise<void> | null = null;
+
+/** Load and prepare the rules pack once. Must resolve before classifyHeuristic. */
+export async function ensureRulesLoaded(): Promise<void> {
+  if (PREPARED && PRIORS) return;
+  if (!loadPromise) {
+    loadPromise = import("@app/services/heuristic/heuristicRules.json").then(
+      (mod) => {
+        const root = ((mod as { default?: RulesFile }).default ??
+          (mod as RulesFile)) as RulesFile;
+        PREPARED = prepare(root.labels ?? []);
+        PRIORS = loadPriors(root.priors ?? {});
+      },
+      (err) => {
+        // A failed chunk load (flaky network) must not poison later attempts.
+        loadPromise = null;
+        throw err;
+      },
+    );
+  }
+  await loadPromise;
+}
+
+// --- Preparation ---
+
+function prepare(labels: RawLabel[]): PreparedLabel[] {
+  const out: PreparedLabel[] = [];
+  for (const label of labels) {
+    const id = typeof label.id === "string" ? label.id : "";
+    const emit = typeof label.emit !== "boolean" ? true : label.emit;
+
+    const phrases: Phrase[] = [];
+    for (const p of label.phrases ?? []) {
+      const text = typeof p.text === "string" ? p.text : "";
+      const w = num(p.weight);
+      if (text.length === 0 || w <= 0) continue;
+      phrases.push({
+        text: normalize(text),
+        weight: Math.min(w, 40),
+        where: where(p),
+      });
+    }
+
+    const regexes: Rx[] = [];
+    for (const r of label.regexes ?? []) {
+      const re = compileRegex(str(r.pattern), flags(r));
+      if (re == null) continue;
+      regexes.push({
+        re,
+        weight: Math.min(num(r.weight), 30),
+        where: where(r),
+      });
+    }
+
+    const filenames: FileRx[] = [];
+    for (const r of label.filenames ?? []) {
+      const re = compileRegex(str(r.pattern), flags(r));
+      if (re == null) continue;
+      filenames.push({ re, weight: Math.min(num(r.weight), 30) });
+    }
+
+    const metadata: MetaRx[] = [];
+    for (const r of label.metadata ?? []) {
+      const re = compileRegex(str(r.pattern), flags(r));
+      if (re == null) continue;
+      const field = typeof r.field === "string" && r.field ? r.field : "any";
+      metadata.push({ field, re, weight: Math.min(num(r.weight), 20) });
+    }
+
+    const negatives: Negative[] = [];
+    for (const n of label.negatives ?? []) {
+      const text = n.text != null ? normalize(String(n.text)) : null;
+      const re =
+        n.pattern != null ? compileRegex(String(n.pattern), flags(n)) : null;
+      if (text == null && re == null) continue;
+      negatives.push({
+        text,
+        re,
+        weight: Math.min(Math.abs(num(n.weight)), 30),
+      });
+    }
+
+    const structural: Structural[] = [];
+    for (const s of label.structural ?? []) {
+      const signal = typeof s.signal === "string" ? s.signal : "";
+      const w = num(s.weight);
+      if (signal.length === 0 || w <= 0) continue;
+      structural.push({ signal, weight: Math.min(w, 12) });
+    }
+
+    out.push({
+      id,
+      emit,
+      phrases,
+      regexes,
+      filenames,
+      metadata,
+      negatives,
+      structural,
+    });
+  }
+  return out;
+}
+
+function loadPriors(priorsNode: Record<string, unknown>): Map<string, Prior> {
+  const out = new Map<string, Prior>();
+  for (const [key, val] of Object.entries(priorsNode)) {
+    if (!Array.isArray(val) || val.length === 0) continue;
+    const min = Math.trunc(num(val[0]));
+    const max =
+      val.length > 1 && val[1] != null ? Math.trunc(num(val[1])) : null;
+    out.set(key, { min, max });
+  }
+  return out;
+}
+
+function where(node: RawRule): string {
+  const w = typeof node.where === "string" ? node.where : "";
+  return w.length === 0 ? "any" : w;
+}
+
+function flags(node: RawRule): string {
+  return typeof node.flags === "string" ? node.flags : "";
+}
+
+/** Compile a rule regex to a RegExp, or null when it won't compile. */
+export function compileRegex(
+  pattern: string | null,
+  flagStr: string,
+): RegExp | null {
+  if (pattern == null) return null;
+  try {
+    const fl = flagStr.length === 0 ? "gi" : flagStr;
+    let f = "g"; // always global for iterative counting
+    if (fl.indexOf("i") >= 0) f += "i";
+    if (fl.indexOf("m") >= 0) f += "m";
+    if (fl.indexOf("s") >= 0) f += "s";
+    return new RegExp(pattern, f);
+  } catch {
+    return null;
+  }
+}
+
+// --- Public API ---
+
+interface ScoredLabel {
+  label: PreparedLabel;
+  score: number;
+  distinct: number;
+  /** Rule-hit descriptions, collected only when explain is requested. */
+  signals: string[] | null;
+}
+
+/** Max candidates and per-candidate signals included in an explanation. */
+const EXPLAIN_CANDIDATES = 6;
+const EXPLAIN_SIGNALS = 12;
+
+const fmt = (n: number) => Math.round(n * 10) / 10;
+
+function toExplanation(
+  en: { isEnglish: boolean; lowText: boolean },
+  scored: ScoredLabel[],
+): HeuristicExplanation {
+  return {
+    isEnglish: en.isEnglish,
+    lowText: en.lowText,
+    candidates: scored.slice(0, EXPLAIN_CANDIDATES).map((s) => ({
+      id: s.label.id,
+      emit: s.label.emit,
+      score: fmt(s.score),
+      distinct: s.distinct,
+      signals: (s.signals ?? []).slice(0, EXPLAIN_SIGNALS),
+    })),
+  };
+}
+
+/** Classify a document; returns emitted label ids (primary + secondaries, capped at 5). */
+export function classifyHeuristic(
+  doc: HeuristicDoc,
+  opts?: { explain?: boolean },
+): HeuristicResult {
+  if (!PREPARED || !PRIORS) {
+    throw new Error(
+      "Heuristic rules not loaded; await ensureRulesLoaded() before classifyHeuristic().",
+    );
+  }
+  const explain = opts?.explain === true;
+
+  const en = detectEnglish(doc.allZone);
+  // Non-English with real text: honestly out of scope for the English heuristics.
+  if (!en.isEnglish && !en.lowText) {
+    return {
+      labels: [],
+      confidence: "none",
+      score: 0,
+      isEnglish: false,
+      ...(explain ? { explain: toExplanation(en, []) } : {}),
+    };
+  }
+
+  const titleRaw = nz(doc.titleZone);
+  const firstRaw = nz(doc.firstZone);
+  const anyRaw = nz(doc.allZone);
+  const titleNorm = normalize(titleRaw);
+  const firstNorm = normalize(firstRaw);
+  const anyNorm = normalize(anyRaw);
+  const fileNameLower = nz(doc.fileName).toLowerCase();
+  const meta = doc.meta ?? {};
+  const metaAll = Object.values(meta).join(" \n ");
+  const struct = computeStructural(doc);
+
+  const scored: ScoredLabel[] = [];
+  for (const label of PREPARED) {
+    let score = 0;
+    let distinct = 0;
+    const sig: string[] | null = explain ? [] : null;
+
+    for (const phrase of label.phrases) {
+      let best = 0;
+      let bestZone = "";
+      for (const zone of ["title", "first", "any"] as const) {
+        const hay =
+          zone === "title" ? titleNorm : zone === "first" ? firstNorm : anyNorm;
+        const count = countOccurrences(hay, phrase.text);
+        if (count === 0) continue;
+        const zf = phrase.where === "any" || phrase.where === zone ? 1 : 0.75;
+        const value = phrase.weight * ZONE_MULT[zone] * zf * damp(count);
+        if (value > best) {
+          best = value;
+          bestZone = zone;
+        }
+      }
+      if (best > 0) {
+        score += best;
+        distinct++;
+        sig?.push(`phrase "${phrase.text}" +${fmt(best)} (${bestZone})`);
+      }
+    }
+
+    for (const rx of label.regexes) {
+      let best = 0;
+      let bestZone = "";
+      for (const zone of ["title", "first", "any"] as const) {
+        const hay =
+          zone === "title" ? titleRaw : zone === "first" ? firstRaw : anyRaw;
+        const count = countRegex(rx.re, hay);
+        if (count === 0) continue;
+        const zf = rx.where === "any" || rx.where === zone ? 1 : 0.75;
+        const value = rx.weight * ZONE_MULT[zone] * zf * damp(count);
+        if (value > best) {
+          best = value;
+          bestZone = zone;
+        }
+      }
+      if (best > 0) {
+        score += best;
+        distinct++;
+        sig?.push(`regex ${rx.re.source} +${fmt(best)} (${bestZone})`);
+      }
+    }
+
+    for (const fn of label.filenames) {
+      if (countRegex(fn.re, fileNameLower) > 0) {
+        score += fn.weight;
+        distinct++;
+        sig?.push(`filename ${fn.re.source} +${fn.weight}`);
+      }
+    }
+
+    for (const md of label.metadata) {
+      const value = md.field === "any" ? metaAll : (meta[md.field] ?? "");
+      if (countRegex(md.re, value) > 0) {
+        score += md.weight;
+        distinct++;
+        sig?.push(`metadata(${md.field}) ${md.re.source} +${md.weight}`);
+      }
+    }
+
+    for (const st of label.structural) {
+      const value = struct[st.signal] ?? 0;
+      if (value > 0) {
+        score += st.weight * value;
+        sig?.push(`structural ${st.signal} +${fmt(st.weight * value)}`);
+      }
+    }
+
+    for (const neg of label.negatives) {
+      const count =
+        neg.text != null
+          ? countOccurrences(anyNorm, neg.text)
+          : countRegex(neg.re, anyRaw);
+      if (count > 0) {
+        const value = neg.weight * damp(Math.min(count, 3));
+        score -= value;
+        sig?.push(
+          `negative ${neg.text != null ? `"${neg.text}"` : (neg.re?.source ?? "")} -${fmt(value)}`,
+        );
+      }
+    }
+
+    if (score > 0) {
+      const prior = pagePriorMultiplier(label.id, doc.pageCount);
+      if (prior !== 1) sig?.push(`page-prior x${fmt(prior)}`);
+      score *= prior;
+      scored.push({ label, score, distinct, signals: sig });
+    }
+  }
+
+  // Stable sort by score descending.
+  scored.sort((a, b) => b.score - a.score);
+
+  const top = scored.length === 0 ? null : scored[0];
+  const s1 = top != null ? top.score : 0;
+  const s2 = scored.length > 1 ? scored[1].score : 0;
+  const margin = s1 - s2;
+
+  let confidence: HeuristicConfidence = "none";
+  if (top != null && s1 >= FLOOR) {
+    if (
+      s1 >= HIGH_SCORE &&
+      margin >= HIGH_MARGIN &&
+      top.distinct >= HIGH_SIGNALS &&
+      s2 <= s1 * 0.65
+    ) {
+      confidence = "high";
+    } else if (s1 >= MED_SCORE && margin >= MED_MARGIN) {
+      confidence = "medium";
+    } else {
+      confidence = "low";
+    }
+  }
+
+  const roundedScore = Math.round(s1);
+  const explanation = explain ? { explain: toExplanation(en, scored) } : {};
+  if (top == null || confidence === "none") {
+    return {
+      labels: [],
+      confidence: "none",
+      score: roundedScore,
+      isEnglish: en.isEnglish,
+      ...explanation,
+    };
+  }
+  // Internal-only winner (book, menu...): suppress output rather than mislabel.
+  if (!top.label.emit) {
+    return {
+      labels: [],
+      confidence,
+      score: roundedScore,
+      isEnglish: en.isEnglish,
+      ...explanation,
+    };
+  }
+
+  const labels: string[] = [top.label.id];
+  for (let i = 1; i < scored.length && labels.length < 5; i++) {
+    const s = scored[i];
+    if (labels.length - 1 >= SEC_MAX) break;
+    if (
+      s.label.emit &&
+      s.score >= SEC_FLOOR &&
+      s.score >= s1 * SEC_FRAC &&
+      s.distinct >= SEC_SIGNALS
+    ) {
+      labels.push(s.label.id);
+    }
+  }
+  return {
+    labels,
+    confidence,
+    score: roundedScore,
+    isEnglish: en.isEnglish,
+    ...explanation,
+  };
+}
+
+/** True when the top match cleared the high-confidence bar. */
+export function isHighConfidence(r: HeuristicResult): boolean {
+  return r.confidence === "high";
+}
+
+/** High confidence AND an emitted label - trustworthy enough to skip the AI engine. */
+export function isDefinitive(r: HeuristicResult): boolean {
+  return isHighConfidence(r) && r.labels.length > 0;
+}
+
+// --- English detection ---
+
+interface EnglishResult {
+  isEnglish: boolean;
+  lowText: boolean;
+}
+
+export function detectEnglish(text: string): EnglishResult {
+  const raw = nz(text);
+  const letters = countAll(LETTERS, raw);
+  if (letters < 25) return { isEnglish: false, lowText: true };
+
+  for (const re of SCRIPT_RANGES) {
+    const hits = countAll(re, raw);
+    if (hits / letters > 0.25) return { isEnglish: false, lowText: false };
+  }
+
+  const latinRatio = countAll(LATIN_LETTER, raw) / letters;
+  const words = allMatches(WORD, normalize(raw));
+  const totalWords = Math.max(words.length, 1);
+  let enHits = 0;
+  for (const w of words) if (STOPWORDS.has(w)) enHits++;
+  const stopRatio = enHits / totalWords;
+
+  let bestScore = 0;
+  let bestRatio = 0;
+  let bestDistinct = 0;
+  let bestDia = 0;
+  for (const profile of LATIN_PROFILES) {
+    let hits = 0;
+    const distinct = new Set<string>();
+    for (const w of words) {
+      if (profile.words.has(w)) {
+        hits++;
+        distinct.add(w);
+      }
+    }
+    const diaCount = profile.dia == null ? 0 : countAll(profile.dia, raw);
+    const ratio = hits / totalWords;
+    const score = ratio + Math.min(diaCount / totalWords, 0.15) * 6;
+    if (score > bestScore) {
+      bestScore = score;
+      bestRatio = ratio;
+      bestDistinct = distinct.size;
+      bestDia = diaCount;
+    }
+  }
+
+  const lowText = totalWords < 30;
+  const nonEnglish =
+    latinRatio >= 0.7 &&
+    totalWords >= 12 &&
+    (bestDistinct >= 3 || bestDia >= 6) &&
+    (bestDia >= 3 || bestRatio >= 0.1) &&
+    bestScore > stopRatio * 1.2 &&
+    (stopRatio < 0.04 || bestRatio > stopRatio * 1.5);
+  if (nonEnglish) return { isEnglish: false, lowText };
+
+  const bar = lowText ? 0.03 : 0.045;
+  // Data-dense docs (tickets, itineraries, prescriptions) are mostly names and numbers with few
+  // function words in ANY language; reject stop-poor text only on affirmative foreign evidence.
+  const foreignEvidence = bestDistinct >= 3 || bestDia >= 6;
+  return {
+    isEnglish: latinRatio >= 0.75 && (stopRatio >= bar || !foreignEvidence),
+    lowText,
+  };
+}
+
+// --- Structural signals ---
+
+function computeStructural(doc: HeuristicDoc): Record<string, number> {
+  const all = nz(doc.allZone);
+  const lines: string[] = [];
+  for (const l of all.split("\n")) {
+    const t = l.trim();
+    if (t.length > 0) lines.push(t);
+  }
+  const tokens: string[] = [];
+  for (const t of all.split(WHITESPACE)) {
+    if (t.length > 0) tokens.push(t);
+  }
+  const totalTokens = Math.max(tokens.length, 1);
+
+  const currency = countAll(CURRENCY, all);
+  let numericTokens = 0;
+  for (const t of tokens) {
+    if (NUMERIC_TOKEN.test(t) && DIGIT.test(t)) numericTokens++;
+  }
+  let formLines = 0;
+  for (const l of lines) {
+    if (FORM_LABEL.test(l) || UNDERSCORE4.test(l) || CHECKBOX.test(l))
+      formLines++;
+  }
+  let dotLeaders = 0;
+  for (const l of lines) if (DOT_LEADER.test(l)) dotLeaders++;
+  let bullets = 0;
+  for (const l of lines) if (BULLET.test(l)) bullets++;
+  const urls = countAll(URL, all);
+  const tail = all.length > 2500 ? all.slice(all.length - 2500) : all;
+  const last4000 = all.length > 4000 ? all.slice(all.length - 4000) : all;
+
+  const s: Record<string, number> = {};
+  s["currency_heavy"] = currency >= 8 ? 1.0 : Math.min(currency / 8.0, 1.0);
+  s["number_table"] = numericTokens / totalTokens >= 0.22 ? 1.0 : 0.0;
+  s["form_like"] = formLines >= 6 ? 1.0 : formLines >= 3 ? 0.5 : 0.0;
+  s["toc"] = TOC.test(all) || dotLeaders >= 5 ? 1.0 : 0.0;
+  s["signature_block"] = SIG1.test(tail) || SIG2.test(tail) ? 1.0 : 0.0;
+  s["references_section"] =
+    REF1.test(last4000) && REF2.test(last4000) ? 1.0 : 0.0;
+  s["short_doc"] = doc.pageCount > 0 && doc.pageCount <= 2 ? 1.0 : 0.0;
+  s["long_doc"] = doc.pageCount >= 40 ? 1.0 : 0.0;
+  s["bullet_heavy"] = bullets >= 12 ? 1.0 : bullets >= 6 ? 0.5 : 0.0;
+  s["email_headers"] = EMAIL_FROM.test(all) && EMAIL_SUBJ.test(all) ? 1.0 : 0.0;
+  s["url_heavy"] = urls >= 6 ? 1.0 : 0.0;
+  s["address_block"] = countAll(ADDRESS, all) >= 2 ? 1.0 : 0.0;
+  return s;
+}
+
+function pagePriorMultiplier(labelId: string, pageCount: number): number {
+  const prior = PRIORS!.get(labelId);
+  if (prior == null || pageCount < 1) return 1;
+  if (prior.max != null && pageCount > prior.max) {
+    return Math.max(0.3, prior.max / pageCount);
+  }
+  if (pageCount < prior.min) return Math.max(0.3, pageCount / prior.min);
+  return 1;
+}
+
+// --- Helpers ---
+
+function nz(s: string | null | undefined): string {
+  return s == null ? "" : s;
+}
+
+function num(v: unknown): number {
+  return typeof v === "number" && Number.isFinite(v) ? v : 0;
+}
+
+function str(v: unknown): string | null {
+  return typeof v === "string" ? v : null;
+}
+
+// Curly apostrophes and fi/fl ligatures survive pdf.js extraction in many PDFs;
+// fold them to ASCII so rule phrases authored with ' / fi / fl still match.
+const CURLY_APOSTROPHE = /[\u2018\u2019]/g;
+const LIGATURE_FI = /\uFB01/g;
+const LIGATURE_FL = /\uFB02/g;
+
+function normalize(text: string | null | undefined): string {
+  return nz(text)
+    .toLowerCase()
+    .replace(CURLY_APOSTROPHE, "'")
+    .replace(LIGATURE_FI, "fi")
+    .replace(LIGATURE_FL, "fl")
+    .replace(WHITESPACE, " ");
+}
+
+function damp(count: number): number {
+  if (count <= 0) return 0;
+  return 1 + 0.35 * (Math.log(Math.min(count, 12)) / Math.log(2));
+}
+
+function countOccurrences(haystack: string, needle: string | null): number {
+  if (needle == null || needle.length === 0) return 0;
+  let count = 0;
+  let idx = haystack.indexOf(needle);
+  while (idx !== -1 && count < 12) {
+    count++;
+    idx = haystack.indexOf(needle, idx + needle.length);
+  }
+  return count;
+}
+
+// Non-overlapping matches capped at 12.
+function countRegex(re: RegExp | null, text: string | null): number {
+  if (re == null || text == null || text.length === 0) return 0;
+  re.lastIndex = 0;
+  let count = 0;
+  let m: RegExpExecArray | null;
+  while (count < 12 && (m = re.exec(text)) !== null) {
+    count++;
+    if (m.index === re.lastIndex) re.lastIndex++; // advance past zero-width match
+  }
+  return count;
+}
+
+function countAll(re: RegExp, text: string | null): number {
+  if (text == null || text.length === 0) return 0;
+  re.lastIndex = 0;
+  let count = 0;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(text)) !== null) {
+    count++;
+    if (m.index === re.lastIndex) re.lastIndex++;
+  }
+  return count;
+}
+
+function allMatches(re: RegExp, text: string | null): string[] {
+  const out: string[] = [];
+  if (text == null || text.length === 0) return out;
+  re.lastIndex = 0;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(text)) !== null) {
+    out.push(m[0]);
+    if (m.index === re.lastIndex) re.lastIndex++;
+  }
+  return out;
+}
diff --git a/frontend/editor/src/proprietary/services/heuristic/heuristicExtractor.ts b/frontend/editor/src/proprietary/services/heuristic/heuristicExtractor.ts
new file mode 100644
index 0000000000..426c1133e1
--- /dev/null
+++ b/frontend/editor/src/proprietary/services/heuristic/heuristicExtractor.ts
@@ -0,0 +1,199 @@
+// pdf.js extraction feeding the engine: page-1 text, a first-5 + last-2 page
+// window, Info-dict metadata, and a large-font page-1 "title" zone.
+
+import { pdfWorkerManager } from "@app/services/pdfWorkerManager";
+import type {
+  PDFDocumentProxy,
+  TextItem,
+} from "pdfjs-dist/types/src/display/api";
+import type { HeuristicDoc } from "@app/services/heuristic/types";
+
+const WINDOW_FIRST = 5;
+const WINDOW_LAST = 2;
+const PAGE_CHAR_CAP = 8000;
+const TITLE_CAP = 400;
+
+/** One rebuilt text line: baseline y (bottom-origin), its largest font size, and the text. */
+interface Line {
+  text: string;
+  size: number;
+  y: number;
+}
+
+/** Build the engine's input document from a PDF blob. Throws if the PDF can't be read. */
+export async function extractHeuristicDoc(
+  file: Blob,
+  fileName: string,
+): Promise<HeuristicDoc> {
+  const arrayBuffer = await file.arrayBuffer();
+  let pdfDoc: PDFDocumentProxy | null = null;
+  try {
+    pdfDoc = await pdfWorkerManager.createDocument(arrayBuffer, {
+      disableAutoFetch: true,
+      disableStream: true,
+    });
+    const pageCount = pdfDoc.numPages;
+    let firstZone = "";
+    let titleZone = "";
+    if (pageCount >= 1) {
+      // Page 1 feeds three zones (first, title, window); pump its items once.
+      const page1 = await pdfDoc.getPage(1);
+      const items = await pageTextItems(page1);
+      firstZone = textFromItems(items);
+      titleZone = titleFromLines(
+        buildLines(items),
+        page1.getViewport({ scale: 1 }).height,
+      );
+    }
+    const parts: string[] = [];
+    for (const pageNo of windowPages(pageCount)) {
+      const text = pageNo === 1 ? firstZone : await pageText(pdfDoc, pageNo);
+      if (text.length > 0) parts.push(text);
+    }
+    const meta = await metadata(pdfDoc);
+    return {
+      fileName,
+      pageCount,
+      meta,
+      titleZone,
+      firstZone,
+      allZone: parts.join("\n"),
+    };
+  } finally {
+    if (pdfDoc) {
+      try {
+        pdfWorkerManager.destroyDocument(pdfDoc);
+      } catch {
+        // Best-effort cleanup.
+      }
+    }
+  }
+}
+
+/** First WINDOW_FIRST + last WINDOW_LAST page numbers, deduped, in order. */
+function windowPages(pageCount: number): number[] {
+  const pages = new Set<number>();
+  for (let p = 1; p <= Math.min(WINDOW_FIRST, pageCount); p++) pages.add(p);
+  for (let p = Math.max(1, pageCount - WINDOW_LAST + 1); p <= pageCount; p++) {
+    pages.add(p);
+  }
+  return [...pages].sort((a, b) => a - b);
+}
+
+function isTextItem(item: unknown): item is TextItem {
+  return typeof (item as TextItem).str === "string";
+}
+
+/**
+ * Pump text items with a plain reader loop: Safari/WebKit cannot async-iterate
+ * the ReadableStream behind pdf.js getTextContent.
+ */
+async function pageTextItems(
+  page: Awaited<ReturnType<PDFDocumentProxy["getPage"]>>,
+): Promise<unknown[]> {
+  const reader = page.streamTextContent().getReader();
+  const items: unknown[] = [];
+  for (;;) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    if (Array.isArray(value?.items)) items.push(...value.items);
+  }
+  return items;
+}
+
+/** A page's text (items joined, newline on hasEOL), trimmed and capped. */
+async function pageText(
+  pdfDoc: PDFDocumentProxy,
+  pageNo: number,
+): Promise<string> {
+  if (pageNo < 1 || pageNo > pdfDoc.numPages) return "";
+  const page = await pdfDoc.getPage(pageNo);
+  return textFromItems(await pageTextItems(page));
+}
+
+function textFromItems(items: readonly unknown[]): string {
+  let text = "";
+  for (const item of items) {
+    if (!isTextItem(item)) continue;
+    text += item.str;
+    text += item.hasEOL ? "\n" : " ";
+  }
+  const trimmed = text.trim();
+  return trimmed.length > PAGE_CHAR_CAP
+    ? trimmed.slice(0, PAGE_CHAR_CAP)
+    : trimmed;
+}
+
+/** Group items into lines (break on hasEOL), tracking each line's max font size + baseline y. */
+function buildLines(items: readonly unknown[]): Line[] {
+  const lines: Line[] = [];
+  let current = "";
+  let size = 0;
+  let y = -1;
+  const flush = () => {
+    const text = current.trim();
+    if (text.length > 0) lines.push({ text, size, y });
+    current = "";
+    size = 0;
+    y = -1;
+  };
+  for (const item of items) {
+    if (!isTextItem(item)) continue;
+    const itemSize = Math.hypot(item.transform[0], item.transform[1]);
+    if (itemSize > size) size = itemSize;
+    if (y < 0) y = item.transform[5];
+    current += item.str;
+    if (item.hasEOL) flush();
+  }
+  flush();
+  return lines;
+}
+
+/** Large-font lines near the top of page 1 approximate the title. */
+function titleFromLines(lines: Line[], pageHeight: number): string {
+  if (lines.length === 0) return "";
+  // pdf.js y is bottom-origin: the top 45% of the page is y > 0.55 * height.
+  const top = lines.filter((l) => l.y > pageHeight * 0.55);
+  const pool = top.length > 0 ? top : lines.slice(0, Math.min(8, lines.length));
+  let maxSize = 0;
+  for (const l of pool) maxSize = Math.max(maxSize, l.size);
+
+  const parts: string[] = [];
+  if (maxSize === 0) {
+    for (let i = 0; i < Math.min(3, pool.length); i++) parts.push(pool[i].text);
+    return parts.join("\n");
+  }
+  let taken = 0;
+  for (const l of pool) {
+    if (taken >= 6) break;
+    if (l.size >= maxSize * 0.72) {
+      parts.push(l.text);
+      taken++;
+    }
+  }
+  const result = parts.join("\n");
+  return result.length > TITLE_CAP ? result.slice(0, TITLE_CAP) : result;
+}
+
+/** Info-dict fields keyed lowercase to match the engine's metadata rules. */
+async function metadata(
+  pdfDoc: PDFDocumentProxy,
+): Promise<Record<string, string>> {
+  let info: Record<string, unknown> = {};
+  try {
+    const md = await pdfDoc.getMetadata();
+    info = (md.info ?? {}) as Record<string, unknown>;
+  } catch {
+    return {};
+  }
+  const get = (k: string) =>
+    typeof info[k] === "string" ? (info[k] as string) : "";
+  return {
+    title: get("Title"),
+    author: get("Author"),
+    subject: get("Subject"),
+    keywords: get("Keywords"),
+    creator: get("Creator"),
+    producer: get("Producer"),
+  };
+}
diff --git a/frontend/editor/src/proprietary/services/heuristic/heuristicRules.json b/frontend/editor/src/proprietary/services/heuristic/heuristicRules.json
new file mode 100644
index 0000000000..b34a7bf446
--- /dev/null
+++ b/frontend/editor/src/proprietary/services/heuristic/heuristicRules.json
@@ -0,0 +1,22352 @@
+{
+  "version": 1,
+  "source": "poc/downloads-classifier (heuristic classifier POC)",
+  "labels": [
+    {
+      "id": "invoice",
+      "name": "Invoice",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "tax invoice",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "invoice",
+          "weight": 14,
+          "where": "title"
+        },
+        {
+          "text": "invoice number",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "invoice date",
+          "weight": 16,
+          "where": "first"
+        },
+        {
+          "text": "bill to",
+          "weight": 12,
+          "where": "first"
+        },
+        {
+          "text": "vat invoice",
+          "weight": 24
+        },
+        {
+          "text": "amount due",
+          "weight": 8
+        },
+        {
+          "text": "balance due",
+          "weight": 14
+        },
+        {
+          "text": "invoice total",
+          "weight": 16
+        },
+        {
+          "text": "payment terms",
+          "weight": 8
+        },
+        {
+          "text": "remit payment to",
+          "weight": 16
+        },
+        {
+          "text": "due upon receipt",
+          "weight": 16
+        },
+        {
+          "text": "net 30",
+          "weight": 12
+        },
+        {
+          "text": "total payable",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\binv[-#]?\\d{3,8}\\b",
+          "weight": 14,
+          "name": "INV-#### reference"
+        },
+        {
+          "pattern": "invoice\\s*(?:no\\.?|number|#)\\s*:?\\s*[a-z0-9][a-z0-9-]{2,14}",
+          "weight": 16,
+          "name": "Invoice number field"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "invoice",
+          "weight": 26,
+          "name": "invoice in filename"
+        },
+        {
+          "pattern": "\\binv[_-]?\\d{3,8}",
+          "weight": 20,
+          "name": "INV number in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "invoice",
+          "weight": 16,
+          "name": "Invoice in PDF title"
+        },
+        {
+          "field": "any",
+          "pattern": "quickbooks|freshbooks|invoice2go|zoho invoice|\\bxero\\b",
+          "weight": 12,
+          "name": "Invoicing software producer"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "remittance advice",
+          "weight": 18,
+          "name": "remittance heading"
+        },
+        {
+          "pattern": "packing\\s+slip|delivery\\s+note",
+          "weight": 14,
+          "name": "shipping doc wording"
+        },
+        {
+          "text": "statement period",
+          "weight": 12,
+          "name": "statement period"
+        },
+        {
+          "text": "minimum payment due",
+          "weight": 14,
+          "name": "card statement term"
+        },
+        {
+          "text": "your subscription",
+          "weight": 16,
+          "name": "subscription context"
+        },
+        {
+          "text": "next billing date",
+          "weight": 18,
+          "name": "subscription renewal date"
+        },
+        {
+          "text": "billing period",
+          "weight": 12,
+          "name": "recurring billing period"
+        },
+        {
+          "text": "plan renewal",
+          "weight": 14,
+          "name": "subscription plan renewal"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 8
+        },
+        {
+          "signal": "number_table",
+          "weight": 5
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "receipt",
+      "name": "Receipt",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "sales receipt",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "change due",
+          "weight": 26
+        },
+        {
+          "text": "amount tendered",
+          "weight": 24
+        },
+        {
+          "text": "cash tendered",
+          "weight": 22
+        },
+        {
+          "text": "thank you for your purchase",
+          "weight": 20
+        },
+        {
+          "text": "thank you for shopping",
+          "weight": 20
+        },
+        {
+          "text": "receipt number",
+          "weight": 16
+        },
+        {
+          "text": "your receipt",
+          "weight": 14
+        },
+        {
+          "text": "card ending in",
+          "weight": 14
+        },
+        {
+          "text": "payment received",
+          "weight": 12
+        },
+        {
+          "text": "merchant id",
+          "weight": 12
+        },
+        {
+          "text": "approval code",
+          "weight": 12
+        },
+        {
+          "text": "transaction id",
+          "weight": 8
+        },
+        {
+          "text": "total charged",
+          "weight": 12
+        },
+        {
+          "text": "payment confirmation",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "your payment was successful",
+          "weight": 28
+        },
+        {
+          "text": "we have received your payment",
+          "weight": 26
+        },
+        {
+          "text": "your payment has been processed",
+          "weight": 26
+        },
+        {
+          "text": "confirmation of payment",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "payment successful",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "thank you for your payment",
+          "weight": 22
+        },
+        {
+          "text": "proof of payment",
+          "weight": 16
+        },
+        {
+          "text": "payment reference",
+          "weight": 16
+        },
+        {
+          "text": "amount paid",
+          "weight": 12
+        },
+        {
+          "text": "payment date",
+          "weight": 8
+        },
+        {
+          "text": "payment method",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "[x*\\u2022]{4}\\s?-?\\d{4}",
+          "weight": 12,
+          "name": "masked card number"
+        },
+        {
+          "pattern": "auth(?:orization)?\\s*(?:code|#)\\s*:?\\s*[a-z0-9]{4,10}",
+          "weight": 12,
+          "name": "authorization code"
+        },
+        {
+          "pattern": "payment\\s*(?:id|reference|ref\\.?|confirmation)\\s*(?:number|no\\.?|#)?\\s*:?\\s*[a-z0-9][a-z0-9-]{3,24}",
+          "weight": 14,
+          "name": "payment reference field"
+        },
+        {
+          "pattern": "your payment of\\s*(?:usd|eur|gbp|\\$|£|€)",
+          "weight": 18,
+          "name": "your payment of <amount>"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "receipt",
+          "weight": 26,
+          "name": "receipt in filename"
+        },
+        {
+          "pattern": "payment[_-]?confirmation",
+          "weight": 16,
+          "name": "payment confirmation filename"
+        },
+        {
+          "pattern": "payment[-_ ]?confirmation",
+          "weight": 28,
+          "name": "payment confirmation filename"
+        },
+        {
+          "pattern": "proof[-_ ]?of[-_ ]?payment",
+          "weight": 26,
+          "name": "proof of payment filename"
+        },
+        {
+          "pattern": "payment[-_ ]?receipt",
+          "weight": 18,
+          "name": "payment receipt filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "receipt",
+          "weight": 14,
+          "name": "Receipt in PDF title"
+        },
+        {
+          "field": "title",
+          "pattern": "payment (confirmation|receipt)",
+          "weight": 14,
+          "name": "payment confirmation in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "minimum payment due",
+          "weight": 18,
+          "name": "card statement term"
+        },
+        {
+          "text": "statement period",
+          "weight": 16,
+          "name": "statement period"
+        },
+        {
+          "text": "balance due",
+          "weight": 12,
+          "name": "unpaid balance"
+        },
+        {
+          "text": "your subscription",
+          "weight": 12,
+          "name": "subscription context"
+        },
+        {
+          "text": "next billing date",
+          "weight": 14,
+          "name": "subscription renewal date"
+        },
+        {
+          "text": "renews automatically",
+          "weight": 14,
+          "name": "subscription wording"
+        },
+        {
+          "text": "estimated delivery",
+          "weight": 12,
+          "name": "order confirmation field"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 8
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "bank-statement",
+      "name": "Bank statement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "account statement",
+          "weight": 18,
+          "where": "title"
+        },
+        {
+          "text": "statement of account",
+          "weight": 14,
+          "where": "title"
+        },
+        {
+          "text": "opening balance",
+          "weight": 20
+        },
+        {
+          "text": "closing balance",
+          "weight": 20
+        },
+        {
+          "text": "beginning balance",
+          "weight": 20
+        },
+        {
+          "text": "ending balance",
+          "weight": 18
+        },
+        {
+          "text": "deposits and other credits",
+          "weight": 24
+        },
+        {
+          "text": "withdrawals and other debits",
+          "weight": 24
+        },
+        {
+          "text": "statement period",
+          "weight": 14
+        },
+        {
+          "text": "sort code",
+          "weight": 12
+        },
+        {
+          "text": "money in",
+          "weight": 12
+        },
+        {
+          "text": "money out",
+          "weight": 12
+        },
+        {
+          "text": "available balance",
+          "weight": 12
+        },
+        {
+          "text": "overdraft",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "sort\\s*code\\s*:?\\s*\\d{2}[- ]\\d{2}[- ]\\d{2}",
+          "weight": 18,
+          "name": "UK sort code"
+        },
+        {
+          "pattern": "routing\\s*(?:number|no\\.?|#)\\s*:?\\s*\\d{9}",
+          "weight": 18,
+          "name": "US routing number"
+        },
+        {
+          "pattern": "(?:faster payment|direct debit|standing order)\\b",
+          "weight": 12,
+          "name": "UK transaction types"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "e?[-_]?statement",
+          "weight": 16,
+          "name": "statement in filename"
+        },
+        {
+          "pattern": "bank[_ -]?statement",
+          "weight": 24,
+          "name": "bank statement filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "minimum payment due",
+          "weight": 22,
+          "name": "card statement term"
+        },
+        {
+          "text": "credit limit",
+          "weight": 18,
+          "name": "card statement term"
+        },
+        {
+          "text": "annual percentage rate",
+          "weight": 14,
+          "name": "APR wording"
+        },
+        {
+          "text": "invoice number",
+          "weight": 10,
+          "name": "invoice field"
+        },
+        {
+          "text": "kwh",
+          "weight": 12,
+          "name": "utility usage unit"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 10
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "statement-of-account",
+      "name": "Statement of account",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "minimum payment due",
+          "weight": 28
+        },
+        {
+          "text": "late payment warning",
+          "weight": 26
+        },
+        {
+          "text": "minimum payment warning",
+          "weight": 26
+        },
+        {
+          "text": "interest charge calculation",
+          "weight": 24
+        },
+        {
+          "text": "credit limit",
+          "weight": 20
+        },
+        {
+          "text": "available credit",
+          "weight": 20
+        },
+        {
+          "text": "annual percentage rate",
+          "weight": 20
+        },
+        {
+          "text": "purchases and adjustments",
+          "weight": 18
+        },
+        {
+          "text": "statement balance",
+          "weight": 16
+        },
+        {
+          "text": "previous balance",
+          "weight": 14
+        },
+        {
+          "text": "new balance",
+          "weight": 14
+        },
+        {
+          "text": "cash advance",
+          "weight": 14
+        },
+        {
+          "text": "payment due date",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bAPR\\b",
+          "flags": "g",
+          "weight": 12,
+          "name": "APR (uppercase)"
+        },
+        {
+          "pattern": "account\\s+ending\\s+(?:in\\s+)?\\d{4}",
+          "weight": 14,
+          "name": "account ending ####"
+        },
+        {
+          "pattern": "\\d{1,2}\\.\\d{2}%\\s+(?:variable\\s+)?apr",
+          "weight": 14,
+          "name": "percentage APR rate"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(credit[-_ ]?card|visa|mastercard|amex|barclaycard).{0,12}stat",
+          "weight": 24,
+          "name": "card statement filename"
+        },
+        {
+          "pattern": "card[_-]?statement",
+          "weight": 22,
+          "name": "card statement"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "sort code",
+          "weight": 16,
+          "name": "bank account detail"
+        },
+        {
+          "text": "routing number",
+          "weight": 16,
+          "name": "bank account detail"
+        },
+        {
+          "text": "deposits and other credits",
+          "weight": 14,
+          "name": "checking statement term"
+        },
+        {
+          "text": "invoice number",
+          "weight": 12,
+          "name": "invoice field"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 8
+        },
+        {
+          "signal": "number_table",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "purchase-order",
+      "name": "Purchase order",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "purchase order",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "please supply the following",
+          "weight": 24
+        },
+        {
+          "text": "official order",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "requisition number",
+          "weight": 18
+        },
+        {
+          "text": "qty ordered",
+          "weight": 16
+        },
+        {
+          "text": "quantity ordered",
+          "weight": 16
+        },
+        {
+          "text": "purchase order number",
+          "weight": 14
+        },
+        {
+          "text": "vendor no",
+          "weight": 12
+        },
+        {
+          "text": "po number",
+          "weight": 10
+        },
+        {
+          "text": "delivery date",
+          "weight": 8
+        },
+        {
+          "text": "ship to",
+          "weight": 8,
+          "where": "first"
+        },
+        {
+          "text": "authorized by",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bp\\.?o\\.?\\s*(?:#|no\\.?|number)\\s*:?\\s*[a-z0-9][a-z0-9/-]{2,14}",
+          "weight": 16,
+          "name": "PO number field"
+        },
+        {
+          "pattern": "\\bpo[-/ ]?\\d{4,8}\\b",
+          "weight": 12,
+          "name": "PO-#### reference"
+        },
+        {
+          "pattern": "no\\s+po,?\\s+no\\s+pay",
+          "weight": 18,
+          "name": "no PO no pay policy"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "purchase[_-]?order",
+          "weight": 28,
+          "name": "purchase order filename"
+        },
+        {
+          "pattern": "\\bpo[_-]?\\d{3,8}",
+          "weight": 22,
+          "name": "PO number filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "invoice number",
+          "weight": 16,
+          "name": "invoice field"
+        },
+        {
+          "text": "remittance advice",
+          "weight": 14,
+          "name": "remittance heading"
+        },
+        {
+          "text": "packing slip",
+          "weight": 12,
+          "name": "packing slip"
+        },
+        {
+          "text": "amount due",
+          "weight": 10,
+          "name": "billing term"
+        },
+        {
+          "text": "quotation",
+          "weight": 10,
+          "name": "quote wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "quote",
+      "name": "Quote",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "quotation",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "estimate",
+          "weight": 12,
+          "where": "title"
+        },
+        {
+          "text": "we are pleased to quote",
+          "weight": 26
+        },
+        {
+          "text": "this quote is valid",
+          "weight": 24
+        },
+        {
+          "text": "quotation is valid",
+          "weight": 22
+        },
+        {
+          "text": "quotation number",
+          "weight": 20
+        },
+        {
+          "text": "quote number",
+          "weight": 18
+        },
+        {
+          "text": "estimate number",
+          "weight": 18
+        },
+        {
+          "text": "valid until",
+          "weight": 12
+        },
+        {
+          "text": "prices quoted",
+          "weight": 16
+        },
+        {
+          "text": "acceptance signature",
+          "weight": 16
+        },
+        {
+          "text": "to accept this",
+          "weight": 14
+        },
+        {
+          "text": "estimated cost",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "quote\\s*(?:#|no\\.?|number)\\s*:?\\s*[a-z0-9][a-z0-9-]{1,14}",
+          "weight": 14,
+          "name": "quote number field"
+        },
+        {
+          "pattern": "valid\\s+for\\s+\\d{1,3}\\s+days",
+          "weight": 16,
+          "name": "valid for N days"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "quot(e|ation)",
+          "weight": 24,
+          "name": "quote filename"
+        },
+        {
+          "pattern": "estimate",
+          "weight": 22,
+          "name": "estimate filename"
+        },
+        {
+          "pattern": "\\bqt[_-]?\\d{3,8}",
+          "weight": 16,
+          "name": "QT number filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "invoice number",
+          "weight": 14,
+          "name": "invoice field"
+        },
+        {
+          "text": "amount paid",
+          "weight": 12,
+          "name": "completed payment"
+        },
+        {
+          "text": "remittance",
+          "weight": 12,
+          "name": "remittance wording"
+        },
+        {
+          "text": "statement period",
+          "weight": 12,
+          "name": "statement period"
+        },
+        {
+          "text": "executive summary",
+          "weight": 10,
+          "name": "proposal wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        },
+        {
+          "signal": "number_table",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "remittance-advice",
+      "name": "Remittance advice",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "remittance advice",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "payment advice",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "amount remitted",
+          "weight": 24
+        },
+        {
+          "text": "invoices paid",
+          "weight": 20
+        },
+        {
+          "text": "bacs payment",
+          "weight": 20
+        },
+        {
+          "text": "in settlement of",
+          "weight": 18
+        },
+        {
+          "text": "the following invoices",
+          "weight": 16
+        },
+        {
+          "text": "payment reference",
+          "weight": 12
+        },
+        {
+          "text": "has been credited",
+          "weight": 12
+        },
+        {
+          "text": "payment date",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "payment\\s+ref(?:erence)?\\s*(?:no\\.?|number|#)?\\s*:?\\s*[a-z0-9][a-z0-9/-]{3,20}",
+          "weight": 12,
+          "name": "payment reference field"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "remit",
+          "weight": 26,
+          "name": "remittance filename"
+        },
+        {
+          "pattern": "payment[_-]?advice",
+          "weight": 24,
+          "name": "payment advice filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "amount due",
+          "weight": 14,
+          "name": "unpaid billing term"
+        },
+        {
+          "text": "minimum payment due",
+          "weight": 14,
+          "name": "card statement term"
+        },
+        {
+          "text": "quotation",
+          "weight": 12,
+          "name": "quote wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        },
+        {
+          "signal": "short_doc",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "expense-report",
+      "name": "Expense report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "expense report",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "expense claim",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "total reimbursable",
+          "weight": 24
+        },
+        {
+          "text": "receipts attached",
+          "weight": 22
+        },
+        {
+          "text": "per diem",
+          "weight": 20
+        },
+        {
+          "text": "employee expense",
+          "weight": 20
+        },
+        {
+          "text": "mileage claimed",
+          "weight": 20
+        },
+        {
+          "text": "business purpose",
+          "weight": 16
+        },
+        {
+          "text": "expenses incurred",
+          "weight": 14
+        },
+        {
+          "text": "subsistence",
+          "weight": 12
+        },
+        {
+          "text": "reimbursement",
+          "weight": 12
+        },
+        {
+          "text": "total claimed",
+          "weight": 10
+        },
+        {
+          "text": "cost center",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\d{1,4}\\s*miles?\\s*(?:@|at)\\s*[$\\u00a3\\u20ac]?\\s?\\d+(?:\\.\\d+)?",
+          "weight": 14,
+          "name": "mileage rate line"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "expense",
+          "weight": 24,
+          "name": "expense filename"
+        },
+        {
+          "pattern": "reimburs",
+          "weight": 20,
+          "name": "reimbursement filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "any",
+          "pattern": "\\bconcur\\b|expensify|zoho expense",
+          "weight": 14,
+          "name": "Expense software producer"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "net pay",
+          "weight": 16,
+          "name": "payslip term"
+        },
+        {
+          "text": "gross pay",
+          "weight": 14,
+          "name": "payslip term"
+        },
+        {
+          "text": "policy number",
+          "weight": 12,
+          "name": "insurance claim term"
+        },
+        {
+          "text": "invoice number",
+          "weight": 10,
+          "name": "invoice field"
+        },
+        {
+          "text": "total hours",
+          "weight": 10,
+          "name": "timesheet term"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 6
+        },
+        {
+          "signal": "form_like",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "financial-statement",
+      "name": "Financial statement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "consolidated financial statements",
+          "weight": 30
+        },
+        {
+          "text": "independent auditor",
+          "weight": 26
+        },
+        {
+          "text": "statement of financial position",
+          "weight": 26
+        },
+        {
+          "text": "notes to the financial statements",
+          "weight": 24
+        },
+        {
+          "text": "of cash flows",
+          "weight": 22
+        },
+        {
+          "text": "balance sheet",
+          "weight": 20
+        },
+        {
+          "text": "income statement",
+          "weight": 20
+        },
+        {
+          "text": "annual report",
+          "weight": 18,
+          "where": "title"
+        },
+        {
+          "text": "retained earnings",
+          "weight": 18
+        },
+        {
+          "text": "cash and cash equivalents",
+          "weight": 18
+        },
+        {
+          "text": "fiscal year ended",
+          "weight": 16
+        },
+        {
+          "text": "earnings per share",
+          "weight": 16
+        },
+        {
+          "text": "profit and loss",
+          "weight": 14
+        },
+        {
+          "text": "quarterly report",
+          "weight": 14,
+          "where": "title"
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "form\\s+10-[kq]\\b",
+          "weight": 22,
+          "name": "SEC form 10-K/10-Q"
+        },
+        {
+          "pattern": "for\\s+the\\s+(?:year|quarter|quarterly\\s+period|three\\s+months|nine\\s+months)\\s+ended",
+          "weight": 14,
+          "name": "period ended wording"
+        },
+        {
+          "pattern": "\\(in\\s+(?:thousands|millions)[^)]{0,40}\\)",
+          "weight": 16,
+          "name": "(in thousands/millions)"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "annual[_-]?report",
+          "weight": 26,
+          "name": "annual report filename"
+        },
+        {
+          "pattern": "financial[_-]?statements?",
+          "weight": 22,
+          "name": "financial statements filename"
+        },
+        {
+          "pattern": "10-?[kq]\\b",
+          "weight": 18,
+          "name": "10-K/10-Q filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "annual report|financial statements",
+          "weight": 14,
+          "name": "report title metadata"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "minimum payment due",
+          "weight": 14,
+          "name": "card statement term"
+        },
+        {
+          "text": "sort code",
+          "weight": 12,
+          "name": "bank account detail"
+        },
+        {
+          "text": "invoice number",
+          "weight": 10,
+          "name": "invoice field"
+        },
+        {
+          "text": "business plan",
+          "weight": 14,
+          "name": "business plan wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "long_doc",
+          "weight": 8
+        },
+        {
+          "signal": "toc",
+          "weight": 6
+        },
+        {
+          "signal": "number_table",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "budget",
+      "name": "Budget",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "annual budget",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "budget forecast",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "operating budget",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "rolling forecast",
+          "weight": 24
+        },
+        {
+          "text": "budget vs actual",
+          "weight": 26
+        },
+        {
+          "text": "actual vs budget",
+          "weight": 26
+        },
+        {
+          "text": "variance analysis",
+          "weight": 22
+        },
+        {
+          "text": "budget variance",
+          "weight": 20
+        },
+        {
+          "text": "forecast assumptions",
+          "weight": 18
+        },
+        {
+          "text": "profit and loss projection",
+          "weight": 18
+        },
+        {
+          "text": "capex",
+          "weight": 12
+        },
+        {
+          "text": "opex",
+          "weight": 12
+        },
+        {
+          "text": "cost center",
+          "weight": 10
+        },
+        {
+          "text": "fiscal year budget",
+          "weight": 16
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "budget\\s+(?:vs\\.?|versus)\\s+actual",
+          "weight": 18,
+          "name": "budget vs actual variant"
+        },
+        {
+          "pattern": "variance\\s+(?:of|is)\\s*[+-]?\\$?[\\d,.]{1,12}",
+          "weight": 14,
+          "name": "variance figure"
+        },
+        {
+          "pattern": "\\bfy\\s?2\\d\\s+budget\\b",
+          "weight": 14,
+          "name": "FY budget"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "budget",
+          "weight": 18,
+          "name": "budget in filename"
+        },
+        {
+          "pattern": "forecast",
+          "weight": 18,
+          "name": "forecast in filename"
+        },
+        {
+          "pattern": "opex[-_ ]?capex",
+          "weight": 16,
+          "name": "opex/capex filename"
+        },
+        {
+          "pattern": "fy20\\d{2}[-_ ]?budget",
+          "weight": 22,
+          "name": "FY budget filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "budget|forecast",
+          "weight": 12,
+          "name": "budget/forecast in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "independent auditor",
+          "weight": 18,
+          "name": "audited financial report term"
+        },
+        {
+          "text": "consolidated financial statements",
+          "weight": 16,
+          "name": "financial report heading"
+        },
+        {
+          "text": "notes to the financial statements",
+          "weight": 14,
+          "name": "financial report term"
+        },
+        {
+          "text": "reimbursement",
+          "weight": 12,
+          "name": "expense report term"
+        },
+        {
+          "text": "mileage",
+          "weight": 10,
+          "name": "expense report term"
+        },
+        {
+          "text": "employee expense report",
+          "weight": 14,
+          "name": "expense report heading"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "credit-note",
+      "name": "Credit note",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "credit note",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "credit memo",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "credit note number",
+          "weight": 28
+        },
+        {
+          "text": "reason for credit",
+          "weight": 26
+        },
+        {
+          "text": "credit memo number",
+          "weight": 24
+        },
+        {
+          "text": "amount credited",
+          "weight": 22
+        },
+        {
+          "text": "your account has been credited",
+          "weight": 22
+        },
+        {
+          "text": "total credit",
+          "weight": 18
+        },
+        {
+          "text": "credit note date",
+          "weight": 18
+        },
+        {
+          "text": "original invoice",
+          "weight": 16
+        },
+        {
+          "text": "goods returned",
+          "weight": 14
+        },
+        {
+          "text": "restocking fee",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "(?:relates|applies|refers) to invoice",
+          "weight": 20,
+          "name": "relates-to-invoice clause"
+        },
+        {
+          "pattern": "credit (?:note|memo)\\s*(?:no\\.?|number|#)\\s*:?\\s*[a-z0-9][a-z0-9/-]{2,16}",
+          "weight": 18,
+          "name": "credit note number field"
+        },
+        {
+          "pattern": "\\bcn[-#]\\d{3,8}\\b",
+          "weight": 14,
+          "name": "CN-#### reference"
+        },
+        {
+          "pattern": "(?:-|\\()\\s?(?:[$£€]|usd|gbp|eur)\\s?\\d[\\d,]*(?:\\.\\d{2})?\\)?",
+          "weight": 12,
+          "name": "negative currency amount"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "credit[-_ ]?note",
+          "weight": 28,
+          "name": "credit note filename"
+        },
+        {
+          "pattern": "credit[-_ ]?memo",
+          "weight": 26,
+          "name": "credit memo filename"
+        },
+        {
+          "pattern": "(^|[^a-z])cn[-_]?\\d{3,}",
+          "weight": 16,
+          "name": "CN number in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "credit (note|memo)",
+          "weight": 16,
+          "name": "credit note in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "remittance advice",
+          "weight": 20,
+          "name": "remittance heading"
+        },
+        {
+          "text": "amount remitted",
+          "weight": 16,
+          "name": "remittance language"
+        },
+        {
+          "text": "change due",
+          "weight": 16,
+          "name": "POS receipt term"
+        },
+        {
+          "text": "amount tendered",
+          "weight": 14,
+          "name": "POS receipt term"
+        },
+        {
+          "text": "balance due",
+          "weight": 14,
+          "name": "invoice language"
+        },
+        {
+          "text": "amount due",
+          "weight": 12,
+          "name": "invoice language"
+        },
+        {
+          "text": "due upon receipt",
+          "weight": 12,
+          "name": "invoice language"
+        },
+        {
+          "text": "estimated delivery",
+          "weight": 10,
+          "name": "order confirmation field"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "number_table",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "loan-agreement",
+      "name": "Loan agreement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "loan agreement",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "credit agreement",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "promissory note",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "the borrower",
+          "weight": 18
+        },
+        {
+          "text": "the lender",
+          "weight": 18
+        },
+        {
+          "text": "principal amount",
+          "weight": 18
+        },
+        {
+          "text": "repayment schedule",
+          "weight": 20
+        },
+        {
+          "text": "event of default",
+          "weight": 16
+        },
+        {
+          "text": "interest shall accrue",
+          "weight": 18
+        },
+        {
+          "text": "early repayment",
+          "weight": 10
+        },
+        {
+          "text": "outstanding balance",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "interest rate of \\d{1,2}(\\.\\d{1,2})? ?%|\\d{1,2}(\\.\\d{1,2})? ?% per annum",
+          "flags": "gi",
+          "weight": 16,
+          "name": "Interest rate clause"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "loan[-_ ]?(agreement|contract|note)|promissory",
+          "weight": 26,
+          "name": "Loan filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "mortgage",
+          "weight": 20,
+          "name": "Mortgage, not a general loan"
+        },
+        {
+          "text": "deed of trust",
+          "weight": 16,
+          "name": "Mortgage vocabulary"
+        },
+        {
+          "text": "lease agreement",
+          "weight": 14,
+          "name": "Lease"
+        },
+        {
+          "text": "credit card",
+          "weight": 14,
+          "name": "Card statement vocabulary"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 6
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "order-confirmation",
+      "name": "Order confirmation",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "order confirmation",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "your order has been placed",
+          "weight": 28,
+          "where": "first"
+        },
+        {
+          "text": "your order is confirmed",
+          "weight": 28
+        },
+        {
+          "text": "thank you for your order",
+          "weight": 26
+        },
+        {
+          "text": "when your order ships",
+          "weight": 22
+        },
+        {
+          "text": "estimated delivery",
+          "weight": 18
+        },
+        {
+          "text": "order placed",
+          "weight": 16,
+          "where": "first"
+        },
+        {
+          "text": "items ordered",
+          "weight": 16
+        },
+        {
+          "text": "order number",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "order summary",
+          "weight": 14
+        },
+        {
+          "text": "shipping method",
+          "weight": 12
+        },
+        {
+          "text": "order total",
+          "weight": 12
+        },
+        {
+          "text": "shipping address",
+          "weight": 6,
+          "where": "first"
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "order\\s*(?:no\\.?|number|#)\\s*:?\\s*[a-z0-9][a-z0-9-]{3,20}",
+          "weight": 14,
+          "name": "Order number field"
+        },
+        {
+          "pattern": "\\b\\d{3}-\\d{7}-\\d{7}\\b",
+          "flags": "g",
+          "weight": 20,
+          "name": "Amazon-style order id"
+        },
+        {
+          "pattern": "arriv(?:es|ing)\\s*:?\\s+(?:mon|tue|wed|thu|fri|sat|sun|by|between)",
+          "weight": 12,
+          "name": "arrival estimate line"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "order[-_ ]?confirmation",
+          "weight": 30,
+          "name": "order confirmation filename"
+        },
+        {
+          "pattern": "order[-_ #]?\\d{4,}",
+          "weight": 16,
+          "name": "order number in filename"
+        },
+        {
+          "pattern": "your[-_ ]?order",
+          "weight": 18,
+          "name": "your order filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "order confirmation",
+          "weight": 16,
+          "name": "order confirmation in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "invoice number",
+          "weight": 16,
+          "name": "invoice field"
+        },
+        {
+          "text": "packing slip",
+          "weight": 16,
+          "name": "shipping doc heading"
+        },
+        {
+          "text": "your booking is confirmed",
+          "weight": 16,
+          "name": "travel booking wording"
+        },
+        {
+          "text": "check-out date",
+          "weight": 14,
+          "name": "hotel confirmation field"
+        },
+        {
+          "text": "next billing date",
+          "weight": 14,
+          "name": "subscription renewal"
+        },
+        {
+          "text": "minimum payment due",
+          "weight": 12,
+          "name": "card statement term"
+        },
+        {
+          "text": "change due",
+          "weight": 12,
+          "name": "POS receipt term"
+        },
+        {
+          "text": "boarding pass",
+          "weight": 12,
+          "name": "boarding pass heading"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 5
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        },
+        {
+          "signal": "address_block",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "donation-receipt",
+      "name": "Donation receipt",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "donation receipt",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "no goods or services were provided",
+          "weight": 32
+        },
+        {
+          "text": "thank you for your donation",
+          "weight": 28
+        },
+        {
+          "text": "501(c)(3)",
+          "weight": 26
+        },
+        {
+          "text": "charitable contribution",
+          "weight": 24
+        },
+        {
+          "text": "gift aid",
+          "weight": 24
+        },
+        {
+          "text": "tax-deductible",
+          "weight": 22
+        },
+        {
+          "text": "registered charity",
+          "weight": 22
+        },
+        {
+          "text": "thank you for your generous",
+          "weight": 22
+        },
+        {
+          "text": "donation amount",
+          "weight": 18
+        },
+        {
+          "text": "your gift",
+          "weight": 8
+        },
+        {
+          "text": "donor",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "ein\\s*:?\\s*\\d{2}-\\d{7}",
+          "weight": 14,
+          "name": "EIN tax id"
+        },
+        {
+          "pattern": "registered charity (?:no\\.?|number)\\s*:?\\s*\\d{6,8}",
+          "weight": 18,
+          "name": "UK charity number"
+        },
+        {
+          "pattern": "tax[- ]deductible to the (?:full(?:est)? )?extent",
+          "weight": 18,
+          "name": "deductible-to-extent clause"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "donation",
+          "weight": 26,
+          "name": "donation in filename"
+        },
+        {
+          "pattern": "gift[-_ ]?aid",
+          "weight": 22,
+          "name": "gift aid filename"
+        },
+        {
+          "pattern": "justgiving|gofundme|donorbox",
+          "weight": 20,
+          "name": "donation platform filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "donation",
+          "weight": 14,
+          "name": "donation in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "invoice number",
+          "weight": 12,
+          "name": "invoice field"
+        },
+        {
+          "text": "amount due",
+          "weight": 12,
+          "name": "billing term"
+        },
+        {
+          "text": "minimum payment due",
+          "weight": 10,
+          "name": "card statement term"
+        },
+        {
+          "text": "order confirmation",
+          "weight": 10,
+          "name": "retail order heading"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "address_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "letter",
+      "name": "Letter",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "important information about your account",
+          "weight": 26
+        },
+        {
+          "text": "changes to your interest rate",
+          "weight": 26
+        },
+        {
+          "text": "financial services compensation scheme",
+          "weight": 24
+        },
+        {
+          "text": "dear account holder",
+          "weight": 22
+        },
+        {
+          "text": "changes to your account",
+          "weight": 22
+        },
+        {
+          "text": "this letter confirms that",
+          "weight": 20
+        },
+        {
+          "text": "we are writing to inform you",
+          "weight": 18
+        },
+        {
+          "text": "thank you for banking with us",
+          "weight": 18
+        },
+        {
+          "text": "your account with us",
+          "weight": 16
+        },
+        {
+          "text": "dear sir or madam",
+          "weight": 20,
+          "where": "first"
+        },
+        {
+          "text": "to whom it may concern",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "yours faithfully",
+          "weight": 22
+        },
+        {
+          "text": "yours sincerely",
+          "weight": 16
+        },
+        {
+          "text": "yours truly",
+          "weight": 12
+        },
+        {
+          "text": "i am writing to inform you",
+          "weight": 18
+        },
+        {
+          "text": "i am writing to complain",
+          "weight": 22
+        },
+        {
+          "text": "with reference to your letter",
+          "weight": 18
+        },
+        {
+          "text": "thank you for your letter",
+          "weight": 22
+        },
+        {
+          "text": "i look forward to hearing from you",
+          "weight": 12
+        },
+        {
+          "text": "please find enclosed",
+          "weight": 10
+        },
+        {
+          "text": "warm regards",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "(?:holds?|maintains?)\\s+an?\\s+account\\s+with",
+          "weight": 20,
+          "name": "account verification wording"
+        },
+        {
+          "pattern": "account\\s+(?:opening|closure)\\s+confirmation",
+          "weight": 20,
+          "name": "account opening/closure confirmation"
+        },
+        {
+          "pattern": "interest\\s+rate\\s+(?:change|is\\s+changing|will\\s+change)",
+          "weight": 16,
+          "name": "interest rate change notice"
+        },
+        {
+          "pattern": "\\bdear (mr|mrs|ms|miss|dr|prof)\\.? [a-z]+",
+          "flags": "gi",
+          "weight": 12,
+          "name": "Personal salutation",
+          "where": "first"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "bank[-_ ]?(confirmation[-_ ]?)?letter",
+          "weight": 22,
+          "name": "bank letter filename"
+        },
+        {
+          "pattern": "account[-_ ]?(verification|confirmation)",
+          "weight": 20,
+          "name": "account verification filename"
+        },
+        {
+          "pattern": "proof[-_ ]?of[-_ ]?(account|funds)",
+          "weight": 24,
+          "name": "proof of account/funds filename"
+        },
+        {
+          "pattern": "^letter[_\\- ]",
+          "weight": 18,
+          "name": "Starts with letter_"
+        },
+        {
+          "pattern": "letter[_\\- ]?(to|from)[_\\- ]",
+          "weight": 20,
+          "name": "Letter to/from in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "\\bletter\\b",
+          "weight": 10,
+          "name": "Letter in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "statement period",
+          "weight": 22,
+          "name": "bank statement term"
+        },
+        {
+          "text": "opening balance",
+          "weight": 18,
+          "name": "bank statement term"
+        },
+        {
+          "text": "closing balance",
+          "weight": 18,
+          "name": "bank statement term"
+        },
+        {
+          "text": "minimum payment due",
+          "weight": 16,
+          "name": "card statement term"
+        },
+        {
+          "text": "deposits and other credits",
+          "weight": 16,
+          "name": "checking statement term"
+        },
+        {
+          "text": "transaction detail",
+          "weight": 14,
+          "name": "statement transaction table"
+        },
+        {
+          "text": "dear hiring manager",
+          "weight": 22,
+          "name": "Cover letter salutation"
+        },
+        {
+          "pattern": "(my|attached|enclosed) (resume|cv|curriculum vitae)",
+          "flags": "gi",
+          "weight": 18,
+          "name": "Resume mention (cover letter)"
+        },
+        {
+          "pattern": "(pleasure|pleased) to recommend|letter of recommendation",
+          "flags": "gi",
+          "weight": 20,
+          "name": "Reference letter wording"
+        },
+        {
+          "text": "pleased to offer you the position",
+          "weight": 22,
+          "name": "Offer letter wording"
+        },
+        {
+          "text": "notice is hereby given",
+          "weight": 18,
+          "name": "Legal notice wording"
+        },
+        {
+          "pattern": "patient:? (name|number|id)|re: patient",
+          "flags": "gi",
+          "weight": 15,
+          "name": "Medical letter patient field"
+        },
+        {
+          "pattern": "internal revenue service|\\bhmrc\\b|department for work and pensions|social security administration",
+          "flags": "gi",
+          "weight": 12,
+          "name": "Government agency letterhead"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "address_block",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 5
+        },
+        {
+          "signal": "signature_block",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "board-report",
+      "name": "Board report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "board deck",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "board pack",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "board of directors meeting",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "quarterly board meeting",
+          "weight": 24
+        },
+        {
+          "text": "board meeting materials",
+          "weight": 22
+        },
+        {
+          "text": "prepared for the board",
+          "weight": 20
+        },
+        {
+          "text": "distributed to the directors",
+          "weight": 20
+        },
+        {
+          "text": "confidential board materials",
+          "weight": 24
+        },
+        {
+          "text": "for board discussion",
+          "weight": 18
+        },
+        {
+          "text": "kpi review",
+          "weight": 12
+        },
+        {
+          "text": "quarter in review",
+          "weight": 12
+        },
+        {
+          "text": "board resolution to approve",
+          "weight": 14
+        },
+        {
+          "text": "strategic priorities",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bq[1-4]\\s+20\\d{2}\\s+board\\s+(?:deck|pack|meeting)\\b",
+          "weight": 20,
+          "name": "Q# 20xx board pack reference"
+        },
+        {
+          "pattern": "agenda\\s+item\\s+\\d{1,2}\\b",
+          "weight": 14,
+          "name": "Agenda item number"
+        },
+        {
+          "pattern": "\\d{1,2}\\s+in\\s+favou?r,?\\s+\\d{1,2}\\s+against",
+          "weight": 16,
+          "name": "Board approval vote tally"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "board[_ -]?(?:deck|pack)",
+          "weight": 28,
+          "name": "board deck/pack filename"
+        },
+        {
+          "pattern": "board[_-]?materials",
+          "weight": 22,
+          "name": "board materials filename"
+        },
+        {
+          "pattern": "q[1-4][_-]?20\\d{2}[_-]?board",
+          "weight": 20,
+          "name": "Q# board filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "board deck|board pack|board meeting",
+          "weight": 14,
+          "name": "Board deck/pack title metadata"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "meeting was called to order",
+          "weight": 18,
+          "name": "minutes procedural phrase"
+        },
+        {
+          "text": "minutes of the previous meeting",
+          "weight": 18,
+          "name": "minutes heading"
+        },
+        {
+          "text": "motion carried",
+          "weight": 14,
+          "name": "formal motion vote wording"
+        },
+        {
+          "text": "the problem we solve",
+          "weight": 14,
+          "name": "pitch deck problem framing"
+        },
+        {
+          "text": "total addressable market",
+          "weight": 14,
+          "name": "pitch deck TAM wording"
+        },
+        {
+          "text": "use of funds",
+          "weight": 12,
+          "name": "pitch deck use of funds"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "bullet_heavy",
+          "weight": 8
+        },
+        {
+          "signal": "number_table",
+          "weight": 6
+        },
+        {
+          "signal": "toc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "pitch-deck",
+      "name": "Pitch deck",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "pitch deck",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "the problem we solve",
+          "weight": 24
+        },
+        {
+          "text": "our solution",
+          "weight": 16
+        },
+        {
+          "text": "total addressable market",
+          "weight": 26
+        },
+        {
+          "text": "market size",
+          "weight": 14
+        },
+        {
+          "text": "the ask",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "use of funds",
+          "weight": 22
+        },
+        {
+          "text": "traction to date",
+          "weight": 20
+        },
+        {
+          "text": "go-to-market strategy",
+          "weight": 12
+        },
+        {
+          "text": "meet the team",
+          "weight": 12
+        },
+        {
+          "text": "why now",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "raising a seed round",
+          "weight": 22
+        },
+        {
+          "text": "series a round",
+          "weight": 16
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\btam\\b",
+          "weight": 14,
+          "name": "TAM acronym"
+        },
+        {
+          "pattern": "\\b(?:pre-)?seed\\s+round\\b|\\bseries\\s+[a-e]\\s+round\\b",
+          "weight": 18,
+          "name": "Funding round stage mention"
+        },
+        {
+          "pattern": "raising\\s+\\$\\s?\\d[\\d,.]*\\s*(?:m|k|million|thousand)?\\b",
+          "weight": 18,
+          "name": "Raising $X amount"
+        },
+        {
+          "pattern": "\\bsam\\b\\s*(?:/|and|&)\\s*\\bsom\\b",
+          "weight": 12,
+          "name": "SAM/SOM market sizing"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "pitch[_-]?deck",
+          "weight": 30,
+          "name": "pitch deck filename"
+        },
+        {
+          "pattern": "seed[_-]?(?:deck|round)",
+          "weight": 22,
+          "name": "seed deck/round filename"
+        },
+        {
+          "pattern": "investor[_-]?deck",
+          "weight": 20,
+          "name": "investor deck filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "pitch deck|investor deck",
+          "weight": 15,
+          "name": "Pitch deck title metadata"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "board of directors meeting",
+          "weight": 14,
+          "name": "board deck wording"
+        },
+        {
+          "text": "board pack",
+          "weight": 14,
+          "name": "board deck wording"
+        },
+        {
+          "text": "quarter in review",
+          "weight": 12,
+          "name": "board KPI review wording"
+        },
+        {
+          "text": "guidance for the full year",
+          "weight": 12,
+          "name": "earnings guidance wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "bullet_heavy",
+          "weight": 8
+        },
+        {
+          "signal": "short_doc",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "investment-summary",
+      "name": "Investment summary",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "capitalization table",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "cap table",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "fully diluted shares outstanding",
+          "weight": 26
+        },
+        {
+          "text": "fully diluted ownership",
+          "weight": 24
+        },
+        {
+          "text": "option pool",
+          "weight": 18
+        },
+        {
+          "text": "preferred stock",
+          "weight": 12
+        },
+        {
+          "text": "common stock",
+          "weight": 8
+        },
+        {
+          "text": "series a preferred",
+          "weight": 18
+        },
+        {
+          "text": "shares outstanding",
+          "weight": 12
+        },
+        {
+          "text": "ownership percentage",
+          "weight": 14
+        },
+        {
+          "text": "as-converted basis",
+          "weight": 18
+        },
+        {
+          "text": "authorized shares",
+          "weight": 10
+        },
+        {
+          "text": "fully diluted basis",
+          "weight": 16
+        },
+        {
+          "text": "investor update",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "dear investors",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "highlights and lowlights",
+          "weight": 26
+        },
+        {
+          "text": "burn rate",
+          "weight": 16
+        },
+        {
+          "text": "monthly recurring revenue",
+          "weight": 18
+        },
+        {
+          "text": "annual recurring revenue",
+          "weight": 18
+        },
+        {
+          "text": "the ask",
+          "weight": 12
+        },
+        {
+          "text": "key metrics this month",
+          "weight": 20
+        },
+        {
+          "text": "how you can help",
+          "weight": 18
+        },
+        {
+          "text": "months of runway",
+          "weight": 20
+        },
+        {
+          "text": "net new mrr",
+          "weight": 16
+        },
+        {
+          "text": "runway",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\d{1,3}(?:\\.\\d{1,2})?\\s?%\\s+(?:fully\\s+diluted|ownership|of\\s+the\\s+company)",
+          "weight": 16,
+          "name": "% ownership figure"
+        },
+        {
+          "pattern": "class\\s+[a-c]\\s+(?:common|preferred)\\s+stock",
+          "weight": 14,
+          "name": "Share class label"
+        },
+        {
+          "pattern": "\\bfd\\s+shares\\b",
+          "weight": 12,
+          "name": "FD shares abbreviation"
+        },
+        {
+          "pattern": "\\bmrr\\b",
+          "weight": 12,
+          "name": "MRR acronym"
+        },
+        {
+          "pattern": "\\barr\\b",
+          "weight": 10,
+          "name": "ARR acronym"
+        },
+        {
+          "pattern": "\\bq[1-4]\\s+20\\d{2}\\s+investor\\s+update\\b",
+          "weight": 20,
+          "name": "Q# investor update heading"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "cap[_-]?table",
+          "weight": 30,
+          "name": "cap table filename"
+        },
+        {
+          "pattern": "captable",
+          "weight": 26,
+          "name": "captable filename"
+        },
+        {
+          "pattern": "\\bcap[_-]?tbl\\b",
+          "weight": 16,
+          "name": "cap tbl abbreviation filename"
+        },
+        {
+          "pattern": "investor[_-]?update",
+          "weight": 30,
+          "name": "investor update filename"
+        },
+        {
+          "pattern": "monthly[_-]?update",
+          "weight": 14,
+          "name": "monthly update filename"
+        },
+        {
+          "pattern": "investor[_-]?letter",
+          "weight": 18,
+          "name": "investor letter filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "cap table|capitalization table|capitalisation table",
+          "weight": 16,
+          "name": "Cap table title metadata"
+        },
+        {
+          "field": "title",
+          "pattern": "investor update",
+          "weight": 16,
+          "name": "Investor update title metadata"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "opening balance",
+          "weight": 16,
+          "name": "bank statement wording"
+        },
+        {
+          "text": "closing balance",
+          "weight": 14,
+          "name": "bank statement wording"
+        },
+        {
+          "text": "sort code",
+          "weight": 14,
+          "name": "UK bank account detail"
+        },
+        {
+          "text": "routing number",
+          "weight": 14,
+          "name": "US bank account detail"
+        },
+        {
+          "text": "balance sheet",
+          "weight": 10,
+          "name": "financial report wording"
+        },
+        {
+          "text": "earnings call",
+          "weight": 14,
+          "name": "public earnings wording"
+        },
+        {
+          "text": "guidance for the full year",
+          "weight": 12,
+          "name": "public earnings guidance wording"
+        },
+        {
+          "text": "diluted earnings per share",
+          "weight": 12,
+          "name": "EPS wording"
+        },
+        {
+          "text": "board pack",
+          "weight": 10,
+          "name": "board deck wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 10
+        },
+        {
+          "signal": "form_like",
+          "weight": 4
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "letter-of-intent",
+      "name": "Letter of intent",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "term sheet",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "pre-money valuation",
+          "weight": 28
+        },
+        {
+          "text": "post-money valuation",
+          "weight": 24
+        },
+        {
+          "text": "liquidation preference",
+          "weight": 26
+        },
+        {
+          "text": "pro rata rights",
+          "weight": 20
+        },
+        {
+          "text": "anti-dilution protection",
+          "weight": 18
+        },
+        {
+          "text": "drag-along rights",
+          "weight": 16
+        },
+        {
+          "text": "tag-along rights",
+          "weight": 14
+        },
+        {
+          "text": "board seats",
+          "weight": 10
+        },
+        {
+          "text": "this term sheet is non-binding",
+          "weight": 26
+        },
+        {
+          "text": "vesting schedule",
+          "weight": 8
+        },
+        {
+          "text": "right of first refusal",
+          "weight": 12
+        },
+        {
+          "text": "letter of intent",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "memorandum of understanding",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "this letter of intent",
+          "weight": 24
+        },
+        {
+          "text": "non-binding",
+          "weight": 20
+        },
+        {
+          "text": "indicative terms",
+          "weight": 22
+        },
+        {
+          "text": "exclusivity period",
+          "weight": 20
+        },
+        {
+          "text": "intent to acquire",
+          "weight": 22
+        },
+        {
+          "text": "intent to purchase",
+          "weight": 20
+        },
+        {
+          "text": "subject to definitive agreement",
+          "weight": 24
+        },
+        {
+          "text": "good faith negotiations",
+          "weight": 14
+        },
+        {
+          "text": "no binding obligation",
+          "weight": 18
+        },
+        {
+          "text": "definitive agreement",
+          "weight": 10
+        },
+        {
+          "text": "expression of interest",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "series\\s+[a-e]\\s+preferred\\s+stock",
+          "weight": 16,
+          "name": "Series X preferred stock"
+        },
+        {
+          "pattern": "1x\\s+non-?participating",
+          "weight": 16,
+          "name": "1x liquidation preference"
+        },
+        {
+          "pattern": "\\$\\s?\\d[\\d,.]*\\s*(?:m|million)?\\s+pre-money",
+          "weight": 16,
+          "name": "$X pre-money figure"
+        },
+        {
+          "pattern": "\\bloi\\b",
+          "weight": 12,
+          "name": "LOI abbreviation"
+        },
+        {
+          "pattern": "\\bmou\\b",
+          "weight": 12,
+          "name": "MOU abbreviation"
+        },
+        {
+          "pattern": "subject to (?:the negotiation and execution of )?a definitive (?:purchase |merger )?agreement",
+          "weight": 20,
+          "name": "subject to definitive agreement clause"
+        },
+        {
+          "pattern": "shall not be binding on either party",
+          "weight": 16,
+          "name": "non-binding clause"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "term[_-]?sheet",
+          "weight": 30,
+          "name": "term sheet filename"
+        },
+        {
+          "pattern": "ts[_-]?series[_-]?[a-e]",
+          "weight": 18,
+          "name": "TS series letter filename"
+        },
+        {
+          "pattern": "letter[-_ ]?of[-_ ]?intent",
+          "weight": 30,
+          "name": "letter of intent filename"
+        },
+        {
+          "pattern": "(^|[^a-z])loi([^a-z]|$)",
+          "weight": 22,
+          "name": "LOI in filename"
+        },
+        {
+          "pattern": "(^|[^a-z])mou([^a-z]|$)",
+          "weight": 20,
+          "name": "MOU in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "term sheet",
+          "weight": 16,
+          "name": "Term sheet title metadata"
+        },
+        {
+          "field": "title",
+          "pattern": "letter of intent|memorandum of understanding",
+          "weight": 16,
+          "name": "LOI/MOU in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "entire agreement",
+          "weight": 12,
+          "name": "formal contract wording"
+        },
+        {
+          "text": "governing law",
+          "weight": 10,
+          "name": "formal contract wording"
+        },
+        {
+          "text": "fully diluted shares outstanding",
+          "weight": 10,
+          "name": "cap table wording"
+        },
+        {
+          "text": "in witness whereof",
+          "weight": 16,
+          "name": "binding contract execution clause"
+        },
+        {
+          "text": "this agreement is entered into",
+          "weight": 16,
+          "name": "definitive agreement wording"
+        },
+        {
+          "text": "representations and warranties",
+          "weight": 18,
+          "name": "M&A definitive agreement term"
+        },
+        {
+          "text": "purchase price adjustment",
+          "weight": 14,
+          "name": "M&A definitive agreement term"
+        },
+        {
+          "text": "closing conditions",
+          "weight": 14,
+          "name": "M&A closing term"
+        },
+        {
+          "text": "non-disclosure agreement",
+          "weight": 10,
+          "name": "NDA heading"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 5
+        },
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "signature_block",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "quarterly-report",
+      "name": "Quarterly report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "quarterly earnings release",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "earnings call",
+          "weight": 24
+        },
+        {
+          "text": "conference call to discuss",
+          "weight": 20
+        },
+        {
+          "text": "non-gaap",
+          "weight": 14
+        },
+        {
+          "text": "guidance for the full year",
+          "weight": 20
+        },
+        {
+          "text": "raises full-year guidance",
+          "weight": 18
+        },
+        {
+          "text": "year-over-year",
+          "weight": 10
+        },
+        {
+          "text": "operating margin",
+          "weight": 12
+        },
+        {
+          "text": "diluted earnings per share",
+          "weight": 18
+        },
+        {
+          "text": "beat analyst estimates",
+          "weight": 20
+        },
+        {
+          "text": "consensus estimates",
+          "weight": 16
+        },
+        {
+          "text": "interim results",
+          "weight": 14,
+          "where": "title"
+        },
+        {
+          "text": "half-year results",
+          "weight": 14,
+          "where": "title"
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "reports\\s+(?:first|second|third|fourth|q[1-4])\\s+quarter\\s+(?:and\\s+half-year\\s+)?(?:20\\d{2}\\s+)?(?:financial\\s+)?results",
+          "weight": 22,
+          "name": "reports Q# results headline"
+        },
+        {
+          "pattern": "eps\\s+of\\s+(?:\\$|\\u00a3|\\u20ac)?\\d",
+          "weight": 16,
+          "name": "EPS of $X"
+        },
+        {
+          "pattern": "rais(?:e[sd]?|ing)\\s+(?:its\\s+)?(?:full[- ]year\\s+)?guidance",
+          "weight": 16,
+          "name": "raises guidance"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "earnings[_-]?(?:release|report)",
+          "weight": 28,
+          "name": "earnings release/report filename"
+        },
+        {
+          "pattern": "q[1-4][_-]?20\\d{2}[_-]?earnings",
+          "weight": 22,
+          "name": "Q# earnings filename"
+        },
+        {
+          "pattern": "interim[_-]?results",
+          "weight": 18,
+          "name": "interim results filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "earnings release|earnings report|interim results",
+          "weight": 12,
+          "name": "Earnings title metadata"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "consolidated financial statements",
+          "weight": 14,
+          "name": "10-K/10-Q financial report wording"
+        },
+        {
+          "text": "notes to the financial statements",
+          "weight": 14,
+          "name": "annual report wording"
+        },
+        {
+          "text": "form 10-k",
+          "weight": 12,
+          "name": "SEC annual filing"
+        },
+        {
+          "text": "form 10-q",
+          "weight": 10,
+          "name": "SEC quarterly filing"
+        },
+        {
+          "text": "months of runway",
+          "weight": 10,
+          "name": "investor update wording"
+        },
+        {
+          "text": "burn rate",
+          "weight": 10,
+          "name": "investor update wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 6
+        },
+        {
+          "signal": "number_table",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "report",
+      "name": "Report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "due diligence report",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "due diligence findings",
+          "weight": 26
+        },
+        {
+          "text": "red flags",
+          "weight": 18
+        },
+        {
+          "text": "data room",
+          "weight": 16
+        },
+        {
+          "text": "target company",
+          "weight": 14
+        },
+        {
+          "text": "confirmatory due diligence",
+          "weight": 22
+        },
+        {
+          "text": "diligence memo",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "legal due diligence",
+          "weight": 20
+        },
+        {
+          "text": "financial due diligence",
+          "weight": 20
+        },
+        {
+          "text": "key risks identified",
+          "weight": 14
+        },
+        {
+          "text": "management interviews",
+          "weight": 12
+        },
+        {
+          "text": "quality of earnings",
+          "weight": 18
+        },
+        {
+          "text": "report to cabinet",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "portfolio holder",
+          "weight": 30
+        },
+        {
+          "text": "wards affected",
+          "weight": 28
+        },
+        {
+          "text": "the committee is recommended to",
+          "weight": 28
+        },
+        {
+          "text": "report to the committee",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "it is recommended that",
+          "weight": 20
+        },
+        {
+          "text": "key decision",
+          "weight": 20,
+          "where": "first"
+        },
+        {
+          "text": "scrutiny committee",
+          "weight": 18
+        },
+        {
+          "text": "report of the director",
+          "weight": 22
+        },
+        {
+          "text": "reason for the decision",
+          "weight": 16
+        },
+        {
+          "text": "financial implications",
+          "weight": 12
+        },
+        {
+          "text": "legal implications",
+          "weight": 12
+        },
+        {
+          "text": "exempt from publication",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "due\\s+diligence\\s+(?:report|memo|findings|summary)",
+          "weight": 20,
+          "name": "Due diligence heading"
+        },
+        {
+          "pattern": "\\bqo?e\\s+report\\b",
+          "weight": 12,
+          "name": "QoE report abbreviation"
+        },
+        {
+          "pattern": "agenda\\s+item\\s+(no\\.?\\s*)?\\d{1,2}",
+          "weight": 14,
+          "name": "Agenda item number"
+        },
+        {
+          "pattern": "wards?\\s+affected\\s*:",
+          "weight": 22,
+          "name": "Wards affected field"
+        },
+        {
+          "pattern": "report\\s+(of|by)\\s+the\\s+(director|head|chief|executive|county\\s+administrator|city\\s+manager)",
+          "weight": 18,
+          "name": "Officer report line"
+        },
+        {
+          "pattern": "cabinet\\s+member\\s+for\\s+[a-z]",
+          "weight": 20,
+          "name": "Cabinet member portfolio"
+        },
+        {
+          "pattern": "recommendations?\\s*:?\\s*that\\s+(the\\s+)?(cabinet|committee|council|board)",
+          "weight": 24,
+          "name": "Recommendation to body"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "due[_-]?diligence",
+          "weight": 30,
+          "name": "due diligence filename"
+        },
+        {
+          "pattern": "\\bdd[_-]?report\\b",
+          "weight": 18,
+          "name": "DD report filename"
+        },
+        {
+          "pattern": "diligence[_-]?memo",
+          "weight": 22,
+          "name": "diligence memo filename"
+        },
+        {
+          "pattern": "(cabinet|committee|council)[-_ ]?report",
+          "weight": 24,
+          "name": "Committee report filename"
+        },
+        {
+          "pattern": "staff[-_ ]?report",
+          "weight": 20,
+          "name": "Staff report filename"
+        },
+        {
+          "pattern": "agenda[-_ ]?item",
+          "weight": 14,
+          "name": "Agenda item filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "due diligence",
+          "weight": 16,
+          "name": "Due diligence title metadata"
+        },
+        {
+          "field": "title",
+          "pattern": "report to (cabinet|council|committee)",
+          "weight": 14,
+          "name": "Report-to title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "entire agreement",
+          "weight": 10,
+          "name": "formal contract wording"
+        },
+        {
+          "text": "case study",
+          "weight": 10,
+          "name": "case study wording"
+        },
+        {
+          "text": "consolidated financial statements",
+          "weight": 8,
+          "name": "financial report wording"
+        },
+        {
+          "text": "minutes of the meeting",
+          "weight": 26,
+          "name": "Meeting minutes"
+        },
+        {
+          "text": "apologies for absence",
+          "weight": 24,
+          "name": "Minutes boilerplate"
+        },
+        {
+          "text": "the meeting was called to order",
+          "weight": 22,
+          "name": "US minutes boilerplate"
+        },
+        {
+          "text": "matters arising",
+          "weight": 14,
+          "name": "Minutes section"
+        },
+        {
+          "text": "notice of meeting",
+          "weight": 16,
+          "name": "Meeting agenda cover"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "long_doc",
+          "weight": 6
+        },
+        {
+          "signal": "toc",
+          "weight": 4
+        },
+        {
+          "signal": "references_section",
+          "weight": 3
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "regulatory-filing",
+      "name": "Regulatory filing",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "offering memorandum",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "prospectus",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "private placement memorandum",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "risk factors",
+          "weight": 12
+        },
+        {
+          "text": "initial public offering",
+          "weight": 22
+        },
+        {
+          "text": "offering price",
+          "weight": 18
+        },
+        {
+          "text": "these securities have not been registered",
+          "weight": 28
+        },
+        {
+          "text": "underwriters",
+          "weight": 10
+        },
+        {
+          "text": "use of proceeds",
+          "weight": 18
+        },
+        {
+          "text": "prospective investors",
+          "weight": 14
+        },
+        {
+          "text": "subscription agreement",
+          "weight": 14
+        },
+        {
+          "text": "be it enacted",
+          "weight": 36
+        },
+        {
+          "text": "this act may be cited as",
+          "weight": 32
+        },
+        {
+          "text": "a bill to",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "an act to",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "short title and commencement",
+          "weight": 26
+        },
+        {
+          "text": "in the senate of the united states",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "in the house of representatives",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "is amended as follows",
+          "weight": 20
+        },
+        {
+          "text": "ordered to be printed",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "royal assent",
+          "weight": 18
+        },
+        {
+          "text": "this act extends to",
+          "weight": 18
+        },
+        {
+          "text": "by the authority of parliament",
+          "weight": 20
+        },
+        {
+          "text": "subsection (1)",
+          "weight": 8
+        },
+        {
+          "text": "insert after",
+          "weight": 6
+        },
+        {
+          "text": "these regulations may be cited as",
+          "weight": 34
+        },
+        {
+          "text": "notice of proposed rulemaking",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "statutory instruments",
+          "weight": 30,
+          "where": "first"
+        },
+        {
+          "text": "in exercise of the powers conferred",
+          "weight": 30
+        },
+        {
+          "text": "this note is not part of the regulations",
+          "weight": 30
+        },
+        {
+          "text": "federal register",
+          "weight": 24
+        },
+        {
+          "text": "code of federal regulations",
+          "weight": 22
+        },
+        {
+          "text": "final rule",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "the secretary hereby",
+          "weight": 22
+        },
+        {
+          "text": "regulatory impact analysis",
+          "weight": 16
+        },
+        {
+          "text": "compliance date",
+          "weight": 14
+        },
+        {
+          "text": "laid before parliament",
+          "weight": 20
+        },
+        {
+          "text": "comments must be received",
+          "weight": 12
+        },
+        {
+          "text": "articles of incorporation",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "certificate of incorporation",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "articles of association",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "memorandum of association",
+          "weight": 24
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "securities\\s+act\\s+of\\s+1933",
+          "weight": 18,
+          "name": "Securities Act of 1933 reference"
+        },
+        {
+          "pattern": "registration\\s+statement\\s+(?:on\\s+form\\s+[a-z]-?\\d)?",
+          "weight": 12,
+          "name": "SEC registration statement"
+        },
+        {
+          "pattern": "offering\\s+price\\s+of\\s+\\$\\d",
+          "weight": 14,
+          "name": "Offering price of $X"
+        },
+        {
+          "pattern": "\\bh\\.\\s?r\\.\\s?\\d{1,5}\\b",
+          "weight": 20,
+          "name": "House bill number"
+        },
+        {
+          "pattern": "\\b1\\d{2}(st|nd|rd|th)\\s+congress\\b",
+          "weight": 22,
+          "name": "Congress session"
+        },
+        {
+          "pattern": "sec(tion)?\\.?\\s*\\d{1,3}\\.\\s+(short title|definitions|purposes)",
+          "weight": 20,
+          "name": "Bill section heading"
+        },
+        {
+          "pattern": "\\b20\\d{2}\\s+chapter\\s+\\d{1,3}\\b",
+          "weight": 18,
+          "name": "UK act chapter number"
+        },
+        {
+          "pattern": "amendments?\\s+(of|to)\\s+the\\s+[a-z ]{3,40}\\s+act\\s+(19|20)\\d{2}",
+          "weight": 18,
+          "name": "Amendment of act"
+        },
+        {
+          "pattern": "\\b\\d{1,2}\\s+cfr\\s+parts?\\s+\\d+",
+          "weight": 24,
+          "name": "CFR part citation"
+        },
+        {
+          "pattern": "\\brin\\s+\\d{4}-[a-z]{2}\\d{2}\\b",
+          "weight": 22,
+          "name": "Regulation identifier number"
+        },
+        {
+          "pattern": "\\bfr\\s+doc\\.?\\s+\\d{4}-\\d{4,6}\\b",
+          "weight": 20,
+          "name": "Federal Register doc number"
+        },
+        {
+          "pattern": "\\b20\\d{2}\\s+no\\.\\s?\\d{1,4}\\b",
+          "weight": 16,
+          "name": "SI year and number"
+        },
+        {
+          "pattern": "docket\\s+(no\\.?|number)\\s*:?\\s*[a-z]{2,6}-",
+          "weight": 14,
+          "name": "Rulemaking docket"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "prospectus",
+          "weight": 28,
+          "name": "prospectus filename"
+        },
+        {
+          "pattern": "offering[_-]?memorandum",
+          "weight": 26,
+          "name": "offering memorandum filename"
+        },
+        {
+          "pattern": "\\bppm\\b",
+          "weight": 14,
+          "name": "PPM abbreviation filename"
+        },
+        {
+          "pattern": "\\b(hr|s)[-_ ]?\\d{3,5}\\b",
+          "weight": 16,
+          "name": "Bill number filename"
+        },
+        {
+          "pattern": "bill",
+          "weight": 15,
+          "name": "Bill filename"
+        },
+        {
+          "pattern": "(ukpga|act[-_ ]?20\\d{2})",
+          "weight": 20,
+          "name": "Act filename"
+        },
+        {
+          "pattern": "federal[-_ ]?register|final[-_ ]?rule",
+          "weight": 22,
+          "name": "Federal Register rule filename"
+        },
+        {
+          "pattern": "statutory[-_ ]?instrument|uksi",
+          "weight": 24,
+          "name": "Statutory instrument filename"
+        },
+        {
+          "pattern": "\\bcfr\\b|rulemaking",
+          "weight": 18,
+          "name": "CFR/rulemaking filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "prospectus|offering memorandum",
+          "weight": 16,
+          "name": "Prospectus title metadata"
+        },
+        {
+          "field": "title",
+          "pattern": "a bill|an act|public law",
+          "weight": 12,
+          "name": "Bill/act in PDF title"
+        },
+        {
+          "field": "any",
+          "pattern": "legislation\\.gov\\.uk",
+          "weight": 14,
+          "name": "legislation.gov.uk metadata"
+        },
+        {
+          "field": "title",
+          "pattern": "federal register|final rule|regulations 20\\d{2}",
+          "weight": 12,
+          "name": "Rule in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "annual report",
+          "weight": 10,
+          "name": "financial report wording"
+        },
+        {
+          "text": "entire agreement",
+          "weight": 10,
+          "name": "formal contract wording"
+        },
+        {
+          "text": "this term sheet is non-binding",
+          "weight": 12,
+          "name": "term sheet wording"
+        },
+        {
+          "text": "terms and conditions",
+          "weight": 26,
+          "name": "T&C legalese confusable"
+        },
+        {
+          "text": "this agreement",
+          "weight": 20,
+          "name": "Contract wording"
+        },
+        {
+          "text": "privacy policy",
+          "weight": 16,
+          "name": "Policy document"
+        },
+        {
+          "text": "licensee",
+          "weight": 14,
+          "name": "License agreement party"
+        },
+        {
+          "text": "statutory instrument",
+          "weight": 18,
+          "name": "Regulation, not primary legislation"
+        },
+        {
+          "text": "we welcome your views",
+          "weight": 16,
+          "name": "Consultation paper wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "long_doc",
+          "weight": 6
+        },
+        {
+          "signal": "toc",
+          "weight": 5
+        },
+        {
+          "signal": "references_section",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "appraisal-report",
+      "name": "Appraisal report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "409a valuation",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "valuation report",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "fair market value",
+          "weight": 18
+        },
+        {
+          "text": "discounted cash flow",
+          "weight": 22
+        },
+        {
+          "text": "comparable company analysis",
+          "weight": 22
+        },
+        {
+          "text": "enterprise value",
+          "weight": 14
+        },
+        {
+          "text": "guideline public company method",
+          "weight": 20
+        },
+        {
+          "text": "weighted average cost of capital",
+          "weight": 18
+        },
+        {
+          "text": "market approach",
+          "weight": 8
+        },
+        {
+          "text": "income approach",
+          "weight": 8
+        },
+        {
+          "text": "asset approach",
+          "weight": 8
+        },
+        {
+          "text": "valuation date",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b409a\\b",
+          "weight": 20,
+          "name": "409A reference"
+        },
+        {
+          "pattern": "\\bwacc\\b",
+          "weight": 14,
+          "name": "WACC acronym"
+        },
+        {
+          "pattern": "discount\\s+rate\\s+of\\s+\\d{1,2}(?:\\.\\d+)?%",
+          "weight": 14,
+          "name": "Discount rate percentage"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "409a",
+          "weight": 28,
+          "name": "409A filename"
+        },
+        {
+          "pattern": "valuation[_-]?report",
+          "weight": 26,
+          "name": "valuation report filename"
+        },
+        {
+          "pattern": "business[_-]?valuation",
+          "weight": 22,
+          "name": "business valuation filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "409a|valuation report",
+          "weight": 16,
+          "name": "Valuation report title metadata"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "balance sheet",
+          "weight": 8,
+          "name": "financial report wording"
+        },
+        {
+          "text": "consolidated financial statements",
+          "weight": 10,
+          "name": "financial report wording"
+        },
+        {
+          "text": "fully diluted shares outstanding",
+          "weight": 8,
+          "name": "cap table wording"
+        },
+        {
+          "text": "due diligence",
+          "weight": 8,
+          "name": "due diligence wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "long_doc",
+          "weight": 5
+        },
+        {
+          "signal": "number_table",
+          "weight": 6
+        },
+        {
+          "signal": "toc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "tax-form",
+      "name": "Tax form",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "wage and tax statement",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "statement of remuneration paid",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "withholding certificate",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "request for taxpayer identification number",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "p60 end of year certificate",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "details of employee leaving work",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "pay and income tax details",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "nonemployee compensation",
+          "weight": 24
+        },
+        {
+          "text": "social security wages",
+          "weight": 26
+        },
+        {
+          "text": "medicare wages and tips",
+          "weight": 26
+        },
+        {
+          "text": "federal income tax withheld",
+          "weight": 16
+        },
+        {
+          "text": "income tax deducted",
+          "weight": 14
+        },
+        {
+          "text": "employer identification number",
+          "weight": 8,
+          "where": "first"
+        },
+        {
+          "text": "national insurance contributions in this employment",
+          "weight": 22
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bform\\s+w-?2\\b",
+          "weight": 20,
+          "name": "Form W-2"
+        },
+        {
+          "pattern": "\\b1099-(?:misc|nec|int|div|r|g|k|b|s)\\b",
+          "weight": 22,
+          "name": "Form 1099 variant"
+        },
+        {
+          "pattern": "\\bform\\s+w-?9\\b",
+          "weight": 20,
+          "name": "Form W-9"
+        },
+        {
+          "pattern": "\\bform\\s+w-?4\\b",
+          "weight": 18,
+          "name": "Form W-4"
+        },
+        {
+          "pattern": "\\b1095-[abc]\\b",
+          "weight": 18,
+          "name": "Form 1095 health coverage"
+        },
+        {
+          "pattern": "omb no\\.?\\s*1545-\\d{4}",
+          "weight": 12,
+          "name": "IRS OMB number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(?:^|[^a-z0-9])w[-_ ]?2(?:[^0-9]|$)",
+          "weight": 22,
+          "name": "W-2 in filename"
+        },
+        {
+          "pattern": "(?:^|[^0-9])1099(?:[^0-9]|$)",
+          "weight": 22,
+          "name": "1099 in filename"
+        },
+        {
+          "pattern": "(?:^|[^a-z0-9])w[-_ ]?[49](?:[^0-9]|$)",
+          "weight": 20,
+          "name": "W-9/W-4 in filename"
+        },
+        {
+          "pattern": "(?:^|[^a-z0-9])(?:p45|p60|t4)(?:[^0-9a-z]|$)",
+          "weight": 20,
+          "name": "P45/P60/T4 in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "w-?[249]\\b|1099|p45|p60|\\bt4\\b",
+          "weight": 12,
+          "name": "Tax form id in title"
+        },
+        {
+          "field": "any",
+          "pattern": "internal revenue service|hm revenue|canada revenue agency",
+          "weight": 8,
+          "name": "Revenue agency in metadata"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "form 1040",
+          "weight": 15,
+          "name": "Filed 1040 return"
+        },
+        {
+          "text": "self assessment",
+          "weight": 12,
+          "name": "UK self assessment return"
+        },
+        {
+          "text": "adjusted gross income",
+          "weight": 12,
+          "name": "Return computation line"
+        },
+        {
+          "text": "net pay",
+          "weight": 10,
+          "name": "Payslip vocabulary"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 8
+        },
+        {
+          "signal": "short_doc",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "tax-return",
+      "name": "Tax return",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "u.s. individual income tax return",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "self assessment tax return",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "income tax and benefit return",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "resident income tax return",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "your tax calculation",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "adjusted gross income",
+          "weight": 22
+        },
+        {
+          "text": "total income on which tax is due",
+          "weight": 26
+        },
+        {
+          "text": "amount you owe",
+          "weight": 16
+        },
+        {
+          "text": "filing status",
+          "weight": 10,
+          "where": "first"
+        },
+        {
+          "text": "itemized deductions",
+          "weight": 16
+        },
+        {
+          "text": "unique taxpayer reference",
+          "weight": 16,
+          "where": "first"
+        },
+        {
+          "text": "payment on account",
+          "weight": 12
+        },
+        {
+          "text": "standard deduction",
+          "weight": 14
+        },
+        {
+          "text": "taxable income",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bform\\s+1040\\b",
+          "weight": 22,
+          "name": "Form 1040"
+        },
+        {
+          "pattern": "\\b1040-(?:sr|nr|x|es)\\b",
+          "weight": 18,
+          "name": "1040 variant"
+        },
+        {
+          "pattern": "schedule\\s+(?:[a-e]|se)\\s+\\(form\\s+1040\\)",
+          "weight": 16,
+          "name": "1040 schedule"
+        },
+        {
+          "pattern": "\\bsa(?:100|302)\\b",
+          "weight": 20,
+          "name": "HMRC SA form number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(?:^|[^0-9])1040(?:[^0-9]|$)",
+          "weight": 20,
+          "name": "1040 in filename"
+        },
+        {
+          "pattern": "tax[-_ ]?return",
+          "weight": 24,
+          "name": "Tax return in filename"
+        },
+        {
+          "pattern": "self[-_ ]?assessment|sa100|sa302",
+          "weight": 22,
+          "name": "Self assessment in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "1040|tax return|self assessment",
+          "weight": 12,
+          "name": "Return in title"
+        },
+        {
+          "field": "any",
+          "pattern": "turbotax|taxact|h&r block|taxslayer|freetaxusa|taxcalc",
+          "weight": 14,
+          "name": "Tax software producer"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "wage and tax statement",
+          "weight": 18,
+          "name": "W-2 heading"
+        },
+        {
+          "text": "notice of assessment",
+          "weight": 12,
+          "name": "Agency notice"
+        },
+        {
+          "text": "notice date",
+          "weight": 12,
+          "name": "Agency notice field"
+        },
+        {
+          "text": "proposed amount due",
+          "weight": 14,
+          "name": "IRS CP2000 notice vocabulary"
+        },
+        {
+          "text": "net pay",
+          "weight": 10,
+          "name": "Payslip vocabulary"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 6
+        },
+        {
+          "signal": "number_table",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "tax-statement",
+      "name": "Tax statement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "notice of deficiency",
+          "weight": 32
+        },
+        {
+          "text": "notice of assessment",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "notice of penalty assessment",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "notice of intent to levy",
+          "weight": 30
+        },
+        {
+          "text": "amount due immediately",
+          "weight": 26
+        },
+        {
+          "text": "you have unpaid taxes",
+          "weight": 26
+        },
+        {
+          "text": "proposed amount due",
+          "weight": 24
+        },
+        {
+          "text": "late payment penalty",
+          "weight": 18
+        },
+        {
+          "text": "late filing penalty",
+          "weight": 18
+        },
+        {
+          "text": "notice date",
+          "weight": 12,
+          "where": "first"
+        },
+        {
+          "text": "if you do not pay",
+          "weight": 8
+        },
+        {
+          "text": "hm revenue and customs",
+          "weight": 8,
+          "where": "first"
+        },
+        {
+          "text": "hm revenue & customs",
+          "weight": 8,
+          "where": "first"
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "notice\\s+(?:cp|ltr)[- ]?\\d{2,4}",
+          "weight": 24,
+          "name": "IRS notice number"
+        },
+        {
+          "pattern": "failure[ -]to[ -](?:pay|file) penalty",
+          "weight": 22,
+          "name": "Failure-to-pay/file penalty"
+        },
+        {
+          "pattern": "penalt(?:y|ies) and interest",
+          "weight": 12,
+          "name": "Penalty and interest"
+        },
+        {
+          "pattern": "proposed changes to your (?:\\d{4} )?(?:form 1040|tax return)",
+          "weight": 22,
+          "name": "CP2000 proposed changes"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "irs[-_ ]?(?:notice|letter)|hmrc",
+          "weight": 18,
+          "name": "IRS/HMRC in filename"
+        },
+        {
+          "pattern": "cp[-_ ]?(?:14|49|90|501|503|504|2000)",
+          "weight": 24,
+          "name": "IRS CP code in filename"
+        },
+        {
+          "pattern": "tax[-_ ]?notice|penalty[-_ ]?notice",
+          "weight": 22,
+          "name": "Tax notice in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "any",
+          "pattern": "internal revenue service|hm revenue",
+          "weight": 10,
+          "name": "Revenue agency in metadata"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "u.s. individual income tax return",
+          "weight": 18,
+          "name": "1040 title"
+        },
+        {
+          "text": "wage and tax statement",
+          "weight": 15,
+          "name": "W-2 heading"
+        },
+        {
+          "text": "invoice number",
+          "weight": 15,
+          "name": "Invoice vocabulary"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "address_block",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "payslip",
+      "name": "Payslip",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "earnings statement",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "statement of earnings",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "pay advice",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "payslip",
+          "weight": 20
+        },
+        {
+          "text": "net pay",
+          "weight": 20
+        },
+        {
+          "text": "gross pay",
+          "weight": 18
+        },
+        {
+          "text": "take home pay",
+          "weight": 18
+        },
+        {
+          "text": "pay period",
+          "weight": 12
+        },
+        {
+          "text": "pay date",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "basic pay",
+          "weight": 14
+        },
+        {
+          "text": "total deductions",
+          "weight": 12
+        },
+        {
+          "text": "tax code",
+          "weight": 10,
+          "where": "first"
+        },
+        {
+          "text": "year to date",
+          "weight": 8
+        },
+        {
+          "text": "national insurance",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bytd\\b",
+          "weight": 12,
+          "name": "YTD column"
+        },
+        {
+          "pattern": "\\bfica\\b",
+          "weight": 14,
+          "name": "FICA deduction"
+        },
+        {
+          "pattern": "\\bpaye\\b",
+          "weight": 12,
+          "name": "PAYE deduction"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "pay[-_ ]?slip",
+          "weight": 28,
+          "name": "Payslip in filename"
+        },
+        {
+          "pattern": "pay[-_ ]?stub",
+          "weight": 28,
+          "name": "Paystub in filename"
+        },
+        {
+          "pattern": "(?:wage|salary)[-_ ]?slip",
+          "weight": 24,
+          "name": "Wage/salary slip in filename"
+        },
+        {
+          "pattern": "payroll|pay[-_ ]?check|earnings[-_ ]?statement",
+          "weight": 18,
+          "name": "Payroll in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "payslip|pay slip|pay stub|pay advice|salary slip|earnings statement",
+          "weight": 14,
+          "name": "Payslip in title"
+        },
+        {
+          "field": "any",
+          "pattern": "\\badp\\b|gusto|paychex|paylocity|moorepay|sage payroll",
+          "weight": 14,
+          "name": "Payroll software producer"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "wage and tax statement",
+          "weight": 16,
+          "name": "W-2 heading"
+        },
+        {
+          "pattern": "\\bp60\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "P60 certificate"
+        },
+        {
+          "text": "timesheet",
+          "weight": 12,
+          "name": "Timesheet vocabulary"
+        },
+        {
+          "text": "invoice number",
+          "weight": 12,
+          "name": "Invoice vocabulary"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "form_like",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "benefits-summary",
+      "name": "Benefits summary",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "pension statement",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "annual benefit statement",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "pension pot",
+          "weight": 26
+        },
+        {
+          "text": "vested balance",
+          "weight": 26
+        },
+        {
+          "text": "superannuation",
+          "weight": 24
+        },
+        {
+          "text": "fund value",
+          "weight": 18
+        },
+        {
+          "text": "lifetime allowance",
+          "weight": 20
+        },
+        {
+          "text": "pension savings",
+          "weight": 16
+        },
+        {
+          "text": "retirement savings",
+          "weight": 16
+        },
+        {
+          "text": "defined contribution",
+          "weight": 16
+        },
+        {
+          "text": "transfer value",
+          "weight": 16
+        },
+        {
+          "text": "defined benefit",
+          "weight": 14
+        },
+        {
+          "text": "employer contributions",
+          "weight": 14
+        },
+        {
+          "text": "retirement age",
+          "weight": 10
+        },
+        {
+          "text": "universal credit",
+          "weight": 28,
+          "where": "first"
+        },
+        {
+          "text": "department for work and pensions",
+          "weight": 26
+        },
+        {
+          "text": "personal independence payment",
+          "weight": 30
+        },
+        {
+          "text": "housing benefit",
+          "weight": 24
+        },
+        {
+          "text": "jobseeker's allowance",
+          "weight": 26
+        },
+        {
+          "text": "employment and support allowance",
+          "weight": 26
+        },
+        {
+          "text": "award notice",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "benefit entitlement",
+          "weight": 22
+        },
+        {
+          "text": "social security administration",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "supplemental security income",
+          "weight": 28
+        },
+        {
+          "text": "monthly benefit amount",
+          "weight": 20
+        },
+        {
+          "text": "your social security benefits",
+          "weight": 24
+        },
+        {
+          "text": "child benefit",
+          "weight": 22
+        },
+        {
+          "text": "cost of living adjustment",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b401\\(?k\\)?",
+          "weight": 16,
+          "name": "401(k) plan"
+        },
+        {
+          "pattern": "\\b(?:sipp|rrsp)\\b",
+          "weight": 14,
+          "name": "Pension account acronym"
+        },
+        {
+          "pattern": "\\b(?:traditional|roth|sep)[- ]ira\\b",
+          "weight": 14,
+          "name": "IRA account type"
+        },
+        {
+          "pattern": "\\b[a-ceghj-pr-tw-z]{2}\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[a-d]\\b",
+          "weight": 12,
+          "name": "National Insurance number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "pension",
+          "weight": 24,
+          "name": "Pension in filename"
+        },
+        {
+          "pattern": "401[-_ ]?k",
+          "weight": 24,
+          "name": "401k in filename"
+        },
+        {
+          "pattern": "retirement|superannuation",
+          "weight": 18,
+          "name": "Retirement in filename"
+        },
+        {
+          "pattern": "universal[-_ ]?credit",
+          "weight": 25,
+          "name": "Universal Credit filename"
+        },
+        {
+          "pattern": "benefit",
+          "weight": 16,
+          "name": "Benefit filename"
+        },
+        {
+          "pattern": "award[-_ ]?notice",
+          "weight": 20,
+          "name": "Award notice filename"
+        },
+        {
+          "pattern": "\\bdwp\\b",
+          "weight": 18,
+          "name": "DWP filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "pension|retirement|401\\(?k\\)?",
+          "weight": 12,
+          "name": "Pension in title"
+        },
+        {
+          "field": "title",
+          "pattern": "universal credit|benefit|award notice",
+          "weight": 12,
+          "name": "Benefits title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "net pay",
+          "weight": 12,
+          "name": "Payslip vocabulary"
+        },
+        {
+          "text": "sum insured",
+          "weight": 12,
+          "name": "Insurance policy vocabulary"
+        },
+        {
+          "text": "available balance",
+          "weight": 10,
+          "name": "Bank statement vocabulary"
+        },
+        {
+          "text": "gross pay",
+          "weight": 14,
+          "name": "Payslip"
+        },
+        {
+          "text": "p60",
+          "weight": 14,
+          "name": "UK tax certificate"
+        },
+        {
+          "text": "1099",
+          "weight": 14,
+          "name": "US tax form (incl. SSA-1099)"
+        },
+        {
+          "text": "payslip",
+          "weight": 16,
+          "name": "Payslip"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 4
+        },
+        {
+          "signal": "number_table",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "contract",
+      "name": "Contract",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "in witness whereof",
+          "weight": 16
+        },
+        {
+          "text": "this agreement is entered into",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "hereinafter referred to as",
+          "weight": 12
+        },
+        {
+          "text": "in consideration of the mutual covenants",
+          "weight": 28
+        },
+        {
+          "text": "term and termination",
+          "weight": 16
+        },
+        {
+          "text": "the parties hereto",
+          "weight": 14
+        },
+        {
+          "text": "governing law",
+          "weight": 8
+        },
+        {
+          "text": "entire agreement",
+          "weight": 8
+        },
+        {
+          "text": "indemnify and hold harmless",
+          "weight": 12
+        },
+        {
+          "text": "witnesseth",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "by and between",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "shall be governed by and construed",
+          "weight": 12
+        },
+        {
+          "text": "agreed terms",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "statement of work",
+          "weight": 8
+        },
+        {
+          "text": "data processing agreement",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "data processing addendum",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "article 28",
+          "weight": 26
+        },
+        {
+          "text": "standard contractual clauses",
+          "weight": 28
+        },
+        {
+          "text": "data controller",
+          "weight": 18
+        },
+        {
+          "text": "data processor",
+          "weight": 18
+        },
+        {
+          "text": "sub-processors",
+          "weight": 20
+        },
+        {
+          "text": "processing of personal data",
+          "weight": 20
+        },
+        {
+          "text": "technical and organisational measures",
+          "weight": 24
+        },
+        {
+          "text": "data subject rights",
+          "weight": 16
+        },
+        {
+          "text": "international data transfer",
+          "weight": 14
+        },
+        {
+          "text": "personal data",
+          "weight": 8
+        },
+        {
+          "text": "gdpr",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "this\\s+agreement\\s+is\\s+made\\s+(on|as\\s+of|by\\s+and\\s+between)",
+          "flags": "gi",
+          "weight": 20,
+          "name": "agreement made on/between",
+          "where": "first"
+        },
+        {
+          "pattern": "is\\s+made\\s+and\\s+entered\\s+into",
+          "flags": "gi",
+          "weight": 18,
+          "name": "made and entered into",
+          "where": "first"
+        },
+        {
+          "pattern": "article\\s*28(\\(\\d\\))?\\s*(of\\s+the\\s+)?(gdpr|regulation)",
+          "flags": "gi",
+          "weight": 20,
+          "name": "GDPR Article 28 reference"
+        },
+        {
+          "pattern": "annex\\s+(i{1,3}|1|2|3)\\s*[:\\-]?\\s*(list of parties|description of processing)",
+          "flags": "gi",
+          "weight": 16,
+          "name": "SCC annex heading"
+        },
+        {
+          "pattern": "processing\\s+instructions",
+          "flags": "gi",
+          "weight": 12,
+          "name": "processing instructions clause"
+        },
+        {
+          "pattern": "\\bccpa\\b|\\bcpra\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "CCPA/CPRA reference"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(contract|agreement)",
+          "weight": 16,
+          "name": "contract/agreement in filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])(msa|sow|mou|dpa)([^a-z0-9]|$)",
+          "weight": 18,
+          "name": "MSA/SOW/MOU/DPA abbreviation"
+        },
+        {
+          "pattern": "data[\\s_-]?processing[\\s_-]?agreement",
+          "weight": 30,
+          "name": "DPA filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])dpa([^a-z0-9]|$)",
+          "weight": 24,
+          "name": "DPA abbreviation filename"
+        },
+        {
+          "pattern": "standard[\\s_-]?contractual[\\s_-]?clauses|(^|[^a-z0-9])scc([^a-z0-9]|$)",
+          "weight": 20,
+          "name": "SCC filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "agreement|contract",
+          "flags": "gi",
+          "weight": 10,
+          "name": "Info title mentions agreement"
+        },
+        {
+          "field": "title",
+          "pattern": "data processing agreement|data processing addendum",
+          "weight": 16,
+          "name": "Info title DPA"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "non-disclosure agreement",
+          "weight": 24,
+          "name": "NDA-specific heading"
+        },
+        {
+          "text": "disclosing party",
+          "weight": 16,
+          "name": "NDA party vocab"
+        },
+        {
+          "text": "last will and testament",
+          "weight": 22,
+          "name": "will vocab"
+        },
+        {
+          "text": "terms of service",
+          "weight": 16,
+          "name": "ToS vocab"
+        },
+        {
+          "text": "power of attorney",
+          "weight": 16,
+          "name": "POA vocab"
+        },
+        {
+          "pattern": "(employment agreement|contract of employment|offer of employment)",
+          "flags": "gi",
+          "weight": 26,
+          "name": "employment contract heading"
+        },
+        {
+          "pattern": "(probationary period|annual salary|holiday entitlement|paid time off|hours of work)",
+          "flags": "gi",
+          "weight": 16,
+          "name": "employment terms vocab"
+        },
+        {
+          "pattern": "\\b(landlord|tenant|tenancy|assured shorthold|security deposit|monthly rent)\\b",
+          "flags": "gi",
+          "weight": 24,
+          "name": "landlord/tenant vocab"
+        },
+        {
+          "text": "receiving party",
+          "weight": 14,
+          "name": "NDA vocab"
+        },
+        {
+          "text": "by accessing or using",
+          "weight": 14,
+          "name": "ToS acceptance clause"
+        },
+        {
+          "text": "master services agreement",
+          "weight": 12,
+          "name": "MSA vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 8
+        },
+        {
+          "signal": "long_doc",
+          "weight": 4
+        },
+        {
+          "signal": "toc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "nda",
+      "name": "NDA",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "non-disclosure agreement",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "nondisclosure agreement",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "confidentiality agreement",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "mutual non-disclosure",
+          "weight": 30,
+          "where": "first"
+        },
+        {
+          "text": "disclosing party",
+          "weight": 14
+        },
+        {
+          "text": "receiving party",
+          "weight": 14
+        },
+        {
+          "text": "confidential information",
+          "weight": 8
+        },
+        {
+          "text": "shall not disclose",
+          "weight": 14
+        },
+        {
+          "text": "return or destroy",
+          "weight": 14
+        },
+        {
+          "text": "permitted purpose",
+          "weight": 12
+        },
+        {
+          "text": "in strict confidence",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bnda\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "NDA abbreviation"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(^|[^a-z0-9])nda([^a-z0-9]|$)",
+          "weight": 26,
+          "name": "nda in filename"
+        },
+        {
+          "pattern": "(non.?disclosure|confidentiality)",
+          "weight": 24,
+          "name": "non-disclosure in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "non.?disclosure|confidentiality|\\bnda\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "Info title NDA"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "master services agreement",
+          "weight": 30,
+          "name": "MSA, not an NDA"
+        },
+        {
+          "text": "master service agreement",
+          "weight": 30,
+          "name": "MSA, not an NDA"
+        },
+        {
+          "text": "statement of work",
+          "weight": 20,
+          "name": "MSA/SOW context"
+        },
+        {
+          "text": "services agreement",
+          "weight": 18,
+          "name": "Services contract"
+        },
+        {
+          "text": "service levels",
+          "weight": 14,
+          "name": "Services contract"
+        },
+        {
+          "text": "employment agreement",
+          "weight": 16,
+          "name": "Employment contract"
+        },
+        {
+          "text": "purchase agreement",
+          "weight": 16,
+          "name": "Purchase agreement"
+        },
+        {
+          "text": "share purchase",
+          "weight": 16,
+          "name": "M&A context"
+        },
+        {
+          "text": "loan agreement",
+          "weight": 16,
+          "name": "Loan agreement"
+        },
+        {
+          "text": "lease agreement",
+          "weight": 14,
+          "name": "Lease"
+        },
+        {
+          "pattern": "fees (and|&) (payment|charges)|payment terms",
+          "flags": "gi",
+          "weight": 12,
+          "name": "Commercial payment terms (full contract)"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 7
+        },
+        {
+          "signal": "short_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "terms-and-conditions",
+      "name": "Terms and conditions",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "terms of service",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "terms of use",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "terms and conditions",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "acceptable use policy",
+          "weight": 24
+        },
+        {
+          "text": "privacy policy",
+          "weight": 10
+        },
+        {
+          "text": "limitation of liability",
+          "weight": 12
+        },
+        {
+          "text": "by accessing or using",
+          "weight": 28,
+          "where": "first"
+        },
+        {
+          "text": "we reserve the right",
+          "weight": 12
+        },
+        {
+          "text": "user agreement",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "these terms",
+          "weight": 8
+        },
+        {
+          "text": "you agree to be bound",
+          "weight": 22
+        },
+        {
+          "text": "end user license agreement",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "end user licence agreement",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "consumer contracts regulations",
+          "weight": 14
+        }
+      ],
+      "regexes": [],
+      "filenames": [
+        {
+          "pattern": "terms.{0,3}(of.{0,3}(service|use)|and.{0,3}conditions)",
+          "weight": 24,
+          "name": "terms of service/use in filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])(tos|eula|tnc|t&c)([^a-z0-9]|$)",
+          "weight": 20,
+          "name": "ToS/EULA abbreviation"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "terms\\s+(of\\s+(service|use)|and\\s+conditions|&\\s*conditions)",
+          "flags": "gi",
+          "weight": 14,
+          "name": "Info title terms"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "policy number",
+          "weight": 14,
+          "name": "insurance policy vocab"
+        },
+        {
+          "text": "sum insured",
+          "weight": 14,
+          "name": "insurance policy vocab"
+        },
+        {
+          "text": "booking reference",
+          "weight": 14,
+          "name": "booking confirmation vocab"
+        },
+        {
+          "text": "invoice number",
+          "weight": 12,
+          "name": "invoice vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "url_heavy",
+          "weight": 5
+        },
+        {
+          "signal": "long_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "court-filing",
+      "name": "Court filing",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "united states district court",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "in the circuit court",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "in the superior court",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "in the high court of justice",
+          "weight": 28,
+          "where": "first"
+        },
+        {
+          "text": "comes now",
+          "weight": 28
+        },
+        {
+          "text": "motion to dismiss",
+          "weight": 22
+        },
+        {
+          "text": "memorandum in support",
+          "weight": 18
+        },
+        {
+          "text": "certificate of service",
+          "weight": 16
+        },
+        {
+          "text": "respectfully submitted",
+          "weight": 20
+        },
+        {
+          "text": "cause of action",
+          "weight": 14
+        },
+        {
+          "text": "prayer for relief",
+          "weight": 24
+        },
+        {
+          "text": "civil action no",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "particulars of claim",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "statement of truth",
+          "weight": 20
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bcase\\s+(no|number)\\.?\\s*:?\\s*[a-z0-9]",
+          "flags": "gi",
+          "weight": 16,
+          "name": "case number",
+          "where": "first"
+        },
+        {
+          "pattern": "\\bdocket\\s+(no|number)\\.?",
+          "flags": "gi",
+          "weight": 16,
+          "name": "docket number"
+        },
+        {
+          "pattern": "plaintiffs?\\s*,?\\s*v(s)?\\.",
+          "flags": "gi",
+          "weight": 18,
+          "name": "Plaintiff v. caption",
+          "where": "first"
+        },
+        {
+          "pattern": "claim\\s+no\\.?\\s*[a-z]{2}-\\d{4}-\\d{4,6}",
+          "flags": "gi",
+          "weight": 20,
+          "name": "UK court claim number"
+        },
+        {
+          "pattern": "\\d{1,2}:\\d{2}-cv-\\d{4,6}",
+          "flags": "gi",
+          "weight": 22,
+          "name": "federal civil docket (cv)"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(motion|complaint|petition|docket|subpoena|pleading|summons)",
+          "weight": 16,
+          "name": "filing type in filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])court([^a-z0-9]|$)",
+          "weight": 14,
+          "name": "court in filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "subscribed and sworn to before me",
+          "weight": 14,
+          "name": "affidavit jurat"
+        },
+        {
+          "text": "last will and testament",
+          "weight": 14,
+          "name": "will vocab"
+        },
+        {
+          "text": "memorandum opinion",
+          "weight": 26,
+          "name": "Court-issued opinion"
+        },
+        {
+          "text": "approved judgment",
+          "weight": 26,
+          "name": "Court-issued judgment"
+        },
+        {
+          "text": "opinion of the court",
+          "weight": 18,
+          "name": "Court-issued opinion"
+        },
+        {
+          "text": "it is so ordered",
+          "weight": 18,
+          "name": "Court disposition"
+        },
+        {
+          "text": "per curiam",
+          "weight": 18,
+          "name": "Appellate opinion"
+        },
+        {
+          "text": "for the reasons that follow",
+          "weight": 14,
+          "name": "Judicial reasoning"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "affidavit",
+      "name": "Affidavit",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "affidavit",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "being duly sworn",
+          "weight": 32
+        },
+        {
+          "text": "deposes and says",
+          "weight": 32
+        },
+        {
+          "text": "subscribed and sworn to before me",
+          "weight": 34
+        },
+        {
+          "text": "notary public",
+          "weight": 8
+        },
+        {
+          "text": "my commission expires",
+          "weight": 10
+        },
+        {
+          "text": "under penalty of perjury",
+          "weight": 12
+        },
+        {
+          "text": "statutory declaration",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "sworn statement",
+          "weight": 20
+        },
+        {
+          "text": "affiant",
+          "weight": 26
+        },
+        {
+          "text": "deponent",
+          "weight": 22
+        },
+        {
+          "text": "make oath and say",
+          "weight": 30
+        },
+        {
+          "text": "solemnly and sincerely declare",
+          "weight": 30
+        },
+        {
+          "text": "commissioner for oaths",
+          "weight": 24
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "state\\s+of\\s+[a-z]+.{0,30}county\\s+of",
+          "flags": "gi",
+          "weight": 16,
+          "name": "notary venue block"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(affidavit|sworn)",
+          "weight": 26,
+          "name": "affidavit in filename"
+        },
+        {
+          "pattern": "statutory.?declaration",
+          "weight": 24,
+          "name": "statutory declaration in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "affidavit|statutory declaration",
+          "flags": "gi",
+          "weight": 14,
+          "name": "Info title affidavit"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "attorney-in-fact",
+          "weight": 16,
+          "name": "POA vocab"
+        },
+        {
+          "text": "last will and testament",
+          "weight": 16,
+          "name": "will vocab"
+        },
+        {
+          "text": "deed of trust",
+          "weight": 12,
+          "name": "mortgage vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 7
+        },
+        {
+          "signal": "signature_block",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "power-of-attorney",
+      "name": "Power of attorney",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "power of attorney",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "attorney-in-fact",
+          "weight": 30
+        },
+        {
+          "text": "durable power of attorney",
+          "weight": 34
+        },
+        {
+          "text": "lasting power of attorney",
+          "weight": 32
+        },
+        {
+          "text": "enduring power of attorney",
+          "weight": 30
+        },
+        {
+          "text": "hereby appoint",
+          "weight": 20
+        },
+        {
+          "text": "grant of authority",
+          "weight": 18
+        },
+        {
+          "text": "office of the public guardian",
+          "weight": 24
+        },
+        {
+          "text": "certificate provider",
+          "weight": 20
+        },
+        {
+          "text": "my agent",
+          "weight": 8
+        },
+        {
+          "text": "on my behalf",
+          "weight": 4
+        },
+        {
+          "text": "disability or incapacity",
+          "weight": 18
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\blp1[fh]\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "UK LPA form code"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "power.?of.?attorney",
+          "weight": 28,
+          "name": "power of attorney in filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])(poa|lpa)([^a-z0-9]|$)",
+          "weight": 20,
+          "name": "POA/LPA abbreviation"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "power of attorney|\\blpa\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "Info title POA"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "last will and testament",
+          "weight": 18,
+          "name": "will vocab"
+        },
+        {
+          "text": "deed of trust",
+          "weight": 14,
+          "name": "mortgage vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 8
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        },
+        {
+          "signal": "form_like",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "will",
+      "name": "Will",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "last will and testament",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "being of sound mind",
+          "weight": 26
+        },
+        {
+          "text": "testator",
+          "weight": 24
+        },
+        {
+          "text": "give, devise and bequeath",
+          "weight": 32
+        },
+        {
+          "text": "bequeath",
+          "weight": 22
+        },
+        {
+          "text": "revocable living trust",
+          "weight": 30
+        },
+        {
+          "text": "residuary estate",
+          "weight": 28
+        },
+        {
+          "text": "per stirpes",
+          "weight": 28
+        },
+        {
+          "text": "codicil",
+          "weight": 22
+        },
+        {
+          "text": "settlor",
+          "weight": 22
+        },
+        {
+          "text": "executor",
+          "weight": 12
+        },
+        {
+          "text": "trustee",
+          "weight": 6
+        },
+        {
+          "text": "declaration of trust",
+          "weight": 18,
+          "where": "first"
+        },
+        {
+          "text": "beneficiaries",
+          "weight": 4
+        }
+      ],
+      "regexes": [],
+      "filenames": [
+        {
+          "pattern": "(last.?will|testament|codicil)",
+          "weight": 26,
+          "name": "will in filename"
+        },
+        {
+          "pattern": "(living|revocable|family).?trust",
+          "weight": 24,
+          "name": "trust in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "last will|testament|living trust|declaration of trust",
+          "flags": "gi",
+          "weight": 12,
+          "name": "Info title will/trust"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "deed of trust",
+          "weight": 24,
+          "name": "mortgage instrument"
+        },
+        {
+          "text": "pension scheme",
+          "weight": 12,
+          "name": "pension trustee vocab"
+        },
+        {
+          "text": "unit trust",
+          "weight": 12,
+          "name": "investment fund vocab"
+        },
+        {
+          "text": "attorney-in-fact",
+          "weight": 10,
+          "name": "POA vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "legal-notice",
+      "name": "Legal notice",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "cease and desist",
+          "weight": 34
+        },
+        {
+          "text": "demand letter",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "notice of default",
+          "weight": 24
+        },
+        {
+          "text": "notice of breach",
+          "weight": 24
+        },
+        {
+          "text": "without prejudice",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "govern yourself accordingly",
+          "weight": 32
+        },
+        {
+          "text": "letter before action",
+          "weight": 30
+        },
+        {
+          "text": "letter before claim",
+          "weight": 30
+        },
+        {
+          "text": "notice of intent to sue",
+          "weight": 28
+        },
+        {
+          "text": "notice to quit",
+          "weight": 18
+        },
+        {
+          "text": "final demand for payment",
+          "weight": 18
+        },
+        {
+          "text": "failure to comply",
+          "weight": 8
+        },
+        {
+          "text": "further legal action",
+          "weight": 16
+        },
+        {
+          "text": "pre-action protocol",
+          "weight": 28
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "re\\s*:\\s*(cease|demand|notice|outstanding)",
+          "flags": "gi",
+          "weight": 12,
+          "name": "Re: demand/notice subject",
+          "where": "first"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(cease.?and.?desist|demand.?letter|legal.?notice)",
+          "weight": 26,
+          "name": "demand/notice in filename"
+        },
+        {
+          "pattern": "notice.?of.?(default|breach|termination|claim)",
+          "weight": 18,
+          "name": "notice-of in filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "homeowners association",
+          "weight": 16,
+          "name": "HOA notice"
+        },
+        {
+          "text": "internal revenue service",
+          "weight": 14,
+          "name": "tax notice"
+        },
+        {
+          "text": "hmrc",
+          "weight": 12,
+          "name": "UK tax notice"
+        },
+        {
+          "text": "kwh",
+          "weight": 10,
+          "name": "utility disconnection notice"
+        },
+        {
+          "pattern": "\\bcase\\s+no\\b",
+          "flags": "gi",
+          "weight": 10,
+          "name": "court case number present"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 7
+        },
+        {
+          "signal": "address_block",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "purchase-agreement",
+      "name": "Purchase agreement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "agreement and plan of merger",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "share purchase agreement",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "asset purchase agreement",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "merger agreement",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "purchase price adjustment",
+          "weight": 22
+        },
+        {
+          "text": "representations and warranties",
+          "weight": 20
+        },
+        {
+          "text": "closing conditions",
+          "weight": 20
+        },
+        {
+          "text": "escrow amount",
+          "weight": 22
+        },
+        {
+          "text": "escrow agent",
+          "weight": 18
+        },
+        {
+          "text": "surviving corporation",
+          "weight": 20
+        },
+        {
+          "text": "material adverse effect",
+          "weight": 18
+        },
+        {
+          "text": "disclosure schedule",
+          "weight": 16
+        },
+        {
+          "text": "target company",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "closing\\s+(?:date|conditions)",
+          "weight": 12,
+          "name": "closing date/conditions"
+        },
+        {
+          "pattern": "escrow\\s+(?:amount|account|agent|fund)",
+          "weight": 16,
+          "name": "escrow terms"
+        },
+        {
+          "pattern": "purchase price\\s+(?:of|shall be|is)\\s*\\$",
+          "weight": 16,
+          "name": "purchase price figure"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "share[-_ ]?purchase[-_ ]?agreement",
+          "weight": 28,
+          "name": "SPA filename"
+        },
+        {
+          "pattern": "merger[-_ ]?agreement",
+          "weight": 26,
+          "name": "merger agreement filename"
+        },
+        {
+          "pattern": "asset[-_ ]?purchase[-_ ]?agreement",
+          "weight": 26,
+          "name": "APA filename"
+        },
+        {
+          "pattern": "(^|[^a-z])(m&a|spa|apa)([^a-z]|$)",
+          "weight": 18,
+          "name": "M&A abbreviation in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "merger agreement|share purchase agreement|plan of merger",
+          "weight": 16,
+          "name": "M&A agreement in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "letter of intent",
+          "weight": 16,
+          "name": "LOI heading"
+        },
+        {
+          "text": "non-binding",
+          "weight": 14,
+          "name": "LOI non-binding wording"
+        },
+        {
+          "text": "employment agreement",
+          "weight": 10,
+          "name": "employment contract heading"
+        },
+        {
+          "text": "master services agreement",
+          "weight": 10,
+          "name": "MSA heading"
+        },
+        {
+          "text": "statement of work",
+          "weight": 8,
+          "name": "SOW heading"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 6
+        },
+        {
+          "signal": "long_doc",
+          "weight": 5
+        },
+        {
+          "signal": "number_table",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "shareholder-agreement",
+      "name": "Shareholder agreement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "shareholders agreement",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "shareholders' agreement",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "drag-along rights",
+          "weight": 28
+        },
+        {
+          "text": "tag-along rights",
+          "weight": 28
+        },
+        {
+          "text": "pre-emption rights",
+          "weight": 24
+        },
+        {
+          "text": "reserved matters",
+          "weight": 24
+        },
+        {
+          "text": "right of first refusal",
+          "weight": 18
+        },
+        {
+          "text": "transfer of shares",
+          "weight": 16
+        },
+        {
+          "text": "minority shareholder",
+          "weight": 14
+        },
+        {
+          "text": "majority shareholder",
+          "weight": 12
+        },
+        {
+          "text": "anti-dilution",
+          "weight": 16
+        },
+        {
+          "text": "cap table",
+          "weight": 10
+        },
+        {
+          "text": "board composition",
+          "weight": 12
+        },
+        {
+          "text": "voting rights",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "drag[- ]along",
+          "weight": 18,
+          "name": "drag-along variant"
+        },
+        {
+          "pattern": "tag[- ]along",
+          "weight": 18,
+          "name": "tag-along variant"
+        },
+        {
+          "pattern": "pre[- ]emption\\s+rights?",
+          "weight": 16,
+          "name": "pre-emption rights variant"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "shareholders?[-_ ]?agreement",
+          "weight": 30,
+          "name": "shareholders agreement filename"
+        },
+        {
+          "pattern": "cap[-_ ]?table",
+          "weight": 18,
+          "name": "cap table filename"
+        },
+        {
+          "pattern": "(^|[^a-z])sha([^a-z]|$)",
+          "weight": 16,
+          "name": "SHA abbreviation in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "shareholders?.?\\s?agreement",
+          "weight": 16,
+          "name": "shareholders agreement in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "employment agreement",
+          "weight": 10,
+          "name": "employment contract heading"
+        },
+        {
+          "text": "master services agreement",
+          "weight": 8,
+          "name": "MSA heading"
+        },
+        {
+          "text": "agreement and plan of merger",
+          "weight": 14,
+          "name": "merger agreement heading"
+        },
+        {
+          "text": "purchase price adjustment",
+          "weight": 12,
+          "name": "M&A definitive agreement term"
+        },
+        {
+          "text": "escrow amount",
+          "weight": 10,
+          "name": "M&A escrow term"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 6
+        },
+        {
+          "signal": "long_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "legal-opinion",
+      "name": "Legal opinion",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "approved judgment",
+          "weight": 34,
+          "where": "first"
+        },
+        {
+          "text": "appeal from the united states district court",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "per curiam",
+          "weight": 24
+        },
+        {
+          "text": "the appeal is dismissed",
+          "weight": 24
+        },
+        {
+          "text": "the appeal is allowed",
+          "weight": 22
+        },
+        {
+          "text": "judgment of the court",
+          "weight": 22
+        },
+        {
+          "text": "opinion of the court",
+          "weight": 22
+        },
+        {
+          "text": "it is so ordered",
+          "weight": 22
+        },
+        {
+          "text": "before the honourable",
+          "weight": 20,
+          "where": "first"
+        },
+        {
+          "text": "united states court of appeals",
+          "weight": 18,
+          "where": "first"
+        },
+        {
+          "text": "for the reasons given",
+          "weight": 14
+        },
+        {
+          "text": "handed down",
+          "weight": 12
+        },
+        {
+          "text": "affirmed",
+          "weight": 6
+        },
+        {
+          "text": "remanded",
+          "weight": 6
+        },
+        {
+          "text": "memorandum opinion",
+          "weight": 32,
+          "where": "first"
+        },
+        {
+          "text": "memorandum and order",
+          "weight": 28,
+          "where": "first"
+        },
+        {
+          "text": "findings of fact and conclusions of law",
+          "weight": 26
+        },
+        {
+          "text": "pending before the court",
+          "weight": 18
+        },
+        {
+          "text": "granted in part and denied in part",
+          "weight": 22
+        },
+        {
+          "text": "for the reasons that follow",
+          "weight": 18
+        },
+        {
+          "text": "the motion is granted",
+          "weight": 14
+        },
+        {
+          "text": "the motion is denied",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\[\\d{4}\\]\\s+(ewhc|ewca|uksc|ukpc|ukut|ewfc)\\s+((civ|crim|admin)\\s+)?\\d{1,5}",
+          "weight": 25,
+          "name": "UK neutral citation"
+        },
+        {
+          "pattern": "judgment of the (district|trial) court is (affirmed|reversed|vacated|modified)",
+          "weight": 22,
+          "name": "appellate disposition"
+        },
+        {
+          "pattern": "\\b(mr|mrs|lord|lady)\\s+justice\\s+[a-z]{2,24}",
+          "weight": 14,
+          "name": "Mr/Mrs Justice name"
+        },
+        {
+          "pattern": "\\b\\d{1,3}\\s+f\\.\\s?(2d|3d|4th)\\s+\\d{1,4}\\b",
+          "weight": 12,
+          "name": "federal reporter citation"
+        },
+        {
+          "pattern": "\\bcircuit judges\\b",
+          "weight": 12,
+          "name": "circuit judges panel"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "judg(e)?ment",
+          "weight": 26,
+          "name": "judgment in filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])(ewhc|ewca|uksc)([^a-z0-9]|$)",
+          "weight": 28,
+          "name": "UK court code in filename"
+        },
+        {
+          "pattern": "opinion",
+          "weight": 16,
+          "name": "opinion in filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])ruling([^a-z0-9]|$)",
+          "weight": 15,
+          "name": "ruling in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "judg(e)?ment|opinion of the court",
+          "flags": "gi",
+          "weight": 12,
+          "name": "Info title judgment/opinion"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "respectfully submitted",
+          "weight": 20,
+          "name": "party filing sign-off"
+        },
+        {
+          "text": "comes now",
+          "weight": 20,
+          "name": "party pleading opener"
+        },
+        {
+          "text": "prayer for relief",
+          "weight": 16,
+          "name": "complaint vocab"
+        },
+        {
+          "text": "particulars of claim",
+          "weight": 16,
+          "name": "UK pleading heading"
+        },
+        {
+          "text": "certificate of service",
+          "weight": 14,
+          "name": "filing service certificate"
+        },
+        {
+          "text": "statement of truth",
+          "weight": 12,
+          "name": "UK pleading verification"
+        },
+        {
+          "pattern": "\\bdoi\\s*:\\s*10\\.\\d{4,5}",
+          "flags": "gi",
+          "weight": 14,
+          "name": "DOI identifier (academic paper)"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "long_doc",
+          "weight": 5
+        },
+        {
+          "signal": "toc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "subpoena",
+      "name": "Subpoena",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "subpoena duces tecum",
+          "weight": 34
+        },
+        {
+          "text": "witness summons",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "you are commanded to",
+          "weight": 30
+        },
+        {
+          "text": "summons in a civil action",
+          "weight": 28,
+          "where": "first"
+        },
+        {
+          "text": "subpoena to testify",
+          "weight": 26
+        },
+        {
+          "text": "subpoena to produce documents",
+          "weight": 26
+        },
+        {
+          "text": "you are hereby summoned",
+          "weight": 26
+        },
+        {
+          "text": "if you do not comply with this summons",
+          "weight": 24
+        },
+        {
+          "text": "place of compliance",
+          "weight": 18
+        },
+        {
+          "text": "return date",
+          "weight": 14
+        },
+        {
+          "text": "to give evidence",
+          "weight": 12
+        },
+        {
+          "text": "failure to comply",
+          "weight": 8
+        },
+        {
+          "text": "clerk of court",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "you are (hereby )?(commanded|summoned|required) to (appear|attend|produce|testify)",
+          "weight": 24,
+          "name": "command to appear/produce"
+        },
+        {
+          "pattern": "\\bao\\s?88[ab]?\\b",
+          "weight": 16,
+          "name": "AO 88 subpoena form code"
+        },
+        {
+          "pattern": "\\bn20\\b",
+          "weight": 14,
+          "name": "UK N20 witness summons form"
+        },
+        {
+          "pattern": "\\brule 45\\b",
+          "weight": 12,
+          "name": "FRCP Rule 45 reference"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "subpoena",
+          "weight": 30,
+          "name": "subpoena in filename"
+        },
+        {
+          "pattern": "witness[-_ ]?summons",
+          "weight": 28,
+          "name": "witness summons in filename"
+        },
+        {
+          "pattern": "duces[-_ ]?tecum",
+          "weight": 26,
+          "name": "duces tecum in filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])summons([^a-z0-9]|$)",
+          "weight": 22,
+          "name": "summons in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "subpoena|summons",
+          "flags": "gi",
+          "weight": 14,
+          "name": "Info title subpoena/summons"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "motion to quash",
+          "weight": 22,
+          "name": "filing about a subpoena"
+        },
+        {
+          "text": "respectfully submitted",
+          "weight": 16,
+          "name": "party filing sign-off"
+        },
+        {
+          "text": "memorandum in support",
+          "weight": 14,
+          "name": "motion brief vocab"
+        },
+        {
+          "text": "particulars of claim",
+          "weight": 14,
+          "name": "UK pleading heading"
+        },
+        {
+          "text": "prayer for relief",
+          "weight": 14,
+          "name": "complaint vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 7
+        },
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "address_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "settlement-agreement",
+      "name": "Settlement agreement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "settlement agreement",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "full and final settlement",
+          "weight": 28
+        },
+        {
+          "text": "settlement and release",
+          "weight": 26
+        },
+        {
+          "text": "admission of liability",
+          "weight": 24
+        },
+        {
+          "text": "conciliation officer",
+          "weight": 24
+        },
+        {
+          "text": "release of claims",
+          "weight": 22
+        },
+        {
+          "text": "settlement sum",
+          "weight": 22
+        },
+        {
+          "text": "general release",
+          "weight": 20
+        },
+        {
+          "text": "settlement payment",
+          "weight": 16
+        },
+        {
+          "text": "withdraw the claim",
+          "weight": 14
+        },
+        {
+          "text": "desire to resolve",
+          "weight": 8
+        },
+        {
+          "text": "employment tribunal",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bcot[- ]?3\\b",
+          "weight": 22,
+          "name": "ACAS COT3 form"
+        },
+        {
+          "pattern": "releases? and forever discharges?",
+          "weight": 22,
+          "name": "release and discharge clause"
+        },
+        {
+          "pattern": "in full and final (settlement|satisfaction) of",
+          "weight": 20,
+          "name": "full and final clause"
+        },
+        {
+          "pattern": "\\bacas\\b",
+          "weight": 14,
+          "name": "ACAS conciliation"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "settlement",
+          "weight": 28,
+          "name": "settlement in filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])cot3([^a-z0-9]|$)",
+          "weight": 26,
+          "name": "COT3 in filename"
+        },
+        {
+          "pattern": "release[-_ ]?agreement",
+          "weight": 18,
+          "name": "release agreement in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "settlement",
+          "flags": "gi",
+          "weight": 14,
+          "name": "Info title settlement"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "policy number",
+          "weight": 16,
+          "name": "insurance policy vocab"
+        },
+        {
+          "text": "master services agreement",
+          "weight": 16,
+          "name": "MSA heading"
+        },
+        {
+          "text": "date of loss",
+          "weight": 14,
+          "name": "insurance claim vocab"
+        },
+        {
+          "text": "statement of work",
+          "weight": 14,
+          "name": "commercial contract vocab"
+        },
+        {
+          "text": "non-disclosure agreement",
+          "weight": 14,
+          "name": "NDA heading"
+        },
+        {
+          "text": "purchase price",
+          "weight": 12,
+          "name": "purchase/M&A vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 8
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "service-agreement",
+      "name": "Service agreement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "letter of engagement",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "engagement letter",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "client care letter",
+          "weight": 30
+        },
+        {
+          "text": "we are pleased to act",
+          "weight": 28
+        },
+        {
+          "text": "we are pleased to confirm our understanding",
+          "weight": 28
+        },
+        {
+          "text": "scope of engagement",
+          "weight": 26
+        },
+        {
+          "text": "thank you for instructing us",
+          "weight": 26
+        },
+        {
+          "text": "terms of engagement",
+          "weight": 24
+        },
+        {
+          "text": "solicitors regulation authority",
+          "weight": 20
+        },
+        {
+          "text": "legal ombudsman",
+          "weight": 16
+        },
+        {
+          "text": "terms of business",
+          "weight": 14
+        },
+        {
+          "text": "our fees",
+          "weight": 12
+        },
+        {
+          "text": "hourly rates",
+          "weight": 12
+        },
+        {
+          "text": "disbursements",
+          "weight": 8
+        },
+        {
+          "text": "master services agreement",
+          "weight": 38,
+          "where": "title"
+        },
+        {
+          "text": "master service agreement",
+          "weight": 38,
+          "where": "title"
+        },
+        {
+          "text": "master agreement",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "framework agreement",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "statement of work",
+          "weight": 22
+        },
+        {
+          "text": "statements of work",
+          "weight": 22
+        },
+        {
+          "text": "services to be performed",
+          "weight": 14
+        },
+        {
+          "text": "service levels",
+          "weight": 14
+        },
+        {
+          "text": "fees and payment",
+          "weight": 12
+        },
+        {
+          "text": "term and termination",
+          "weight": 10
+        },
+        {
+          "text": "independent contractor",
+          "weight": 8
+        },
+        {
+          "text": "governing law",
+          "weight": 6
+        },
+        {
+          "text": "in witness whereof",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "(will|shall) be (charged|billed) at",
+          "weight": 12,
+          "name": "billed/charged at clause"
+        },
+        {
+          "pattern": "sign and return (the )?(enclosed|attached|a) copy",
+          "weight": 12,
+          "name": "sign-and-return instruction"
+        },
+        {
+          "pattern": "\\bmsa\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "MSA abbreviation"
+        },
+        {
+          "pattern": "\\bsow[s]?\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "SOW reference"
+        },
+        {
+          "pattern": "exhibit [a-e]\\b",
+          "flags": "gi",
+          "weight": 10,
+          "name": "Contract exhibits"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "engagement[-_ ]?letter|letter[-_ ]?of[-_ ]?engagement",
+          "weight": 28,
+          "name": "engagement letter in filename"
+        },
+        {
+          "pattern": "client[-_ ]?care",
+          "weight": 26,
+          "name": "client care in filename"
+        },
+        {
+          "pattern": "retainer",
+          "weight": 20,
+          "name": "retainer in filename"
+        },
+        {
+          "pattern": "terms[-_ ]?of[-_ ]?business",
+          "weight": 18,
+          "name": "terms of business in filename"
+        },
+        {
+          "pattern": "\\bmsa\\b|master[-_ ]?servic",
+          "weight": 26,
+          "name": "MSA in filename"
+        },
+        {
+          "pattern": "framework[-_ ]?agreement",
+          "weight": 22,
+          "name": "Framework agreement filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "engagement letter|letter of engagement|client care",
+          "flags": "gi",
+          "weight": 14,
+          "name": "Info title engagement"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "pleased to offer you",
+          "weight": 24,
+          "name": "job offer wording"
+        },
+        {
+          "text": "annual salary",
+          "weight": 20,
+          "name": "offer/employment vocab"
+        },
+        {
+          "text": "dear hiring manager",
+          "weight": 18,
+          "name": "cover letter salutation"
+        },
+        {
+          "text": "i am writing to apply",
+          "weight": 16,
+          "name": "cover letter opener"
+        },
+        {
+          "pattern": "my (resume|cv|curriculum vitae)",
+          "flags": "gi",
+          "weight": 14,
+          "name": "applicant materials"
+        },
+        {
+          "text": "this proposal",
+          "weight": 12,
+          "name": "business proposal vocab"
+        },
+        {
+          "text": "non-disclosure agreement",
+          "weight": 24,
+          "name": "Standalone NDA"
+        },
+        {
+          "text": "last will and testament",
+          "weight": 20
+        },
+        {
+          "text": "lease agreement",
+          "weight": 16,
+          "name": "Lease"
+        },
+        {
+          "text": "employment agreement",
+          "weight": 16,
+          "name": "Employment contract"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "address_block",
+          "weight": 5
+        },
+        {
+          "signal": "signature_block",
+          "weight": 3
+        },
+        {
+          "signal": "toc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "privacy-policy",
+      "name": "Privacy policy",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "privacy policy",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "privacy notice",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "personal data we collect",
+          "weight": 28
+        },
+        {
+          "text": "how we use your information",
+          "weight": 26
+        },
+        {
+          "text": "data controller",
+          "weight": 18
+        },
+        {
+          "text": "your rights under",
+          "weight": 14
+        },
+        {
+          "text": "right to erasure",
+          "weight": 18
+        },
+        {
+          "text": "we collect",
+          "weight": 8
+        },
+        {
+          "text": "cookies",
+          "weight": 8
+        },
+        {
+          "text": "third parties",
+          "weight": 5
+        },
+        {
+          "text": "opt out",
+          "weight": 6
+        },
+        {
+          "text": "data protection officer",
+          "weight": 16
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bgdpr\\b|\\bccpa\\b|\\buk gdpr\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "Privacy regulation"
+        },
+        {
+          "pattern": "article \\d{1,2} of the gdpr",
+          "flags": "gi",
+          "weight": 16,
+          "name": "GDPR article reference"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "privacy[-_ ]?(policy|notice)",
+          "weight": 26,
+          "name": "Privacy policy filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "terms of service",
+          "weight": 18,
+          "name": "ToS, not privacy policy"
+        },
+        {
+          "text": "terms and conditions",
+          "weight": 16,
+          "name": "T&C, not privacy policy"
+        },
+        {
+          "text": "data processing agreement",
+          "weight": 22,
+          "name": "DPA (contract), not a policy"
+        },
+        {
+          "text": "standard contractual clauses",
+          "weight": 14,
+          "name": "DPA vocabulary"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "url_heavy",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "resume",
+      "name": "Resume",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "curriculum vitae",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "professional experience",
+          "weight": 18
+        },
+        {
+          "text": "work experience",
+          "weight": 10
+        },
+        {
+          "text": "employment history",
+          "weight": 16
+        },
+        {
+          "text": "career history",
+          "weight": 14
+        },
+        {
+          "text": "references available upon request",
+          "weight": 28
+        },
+        {
+          "text": "references available on request",
+          "weight": 28
+        },
+        {
+          "text": "professional summary",
+          "weight": 20,
+          "where": "first"
+        },
+        {
+          "text": "career objective",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "personal profile",
+          "weight": 16,
+          "where": "first"
+        },
+        {
+          "text": "core competencies",
+          "weight": 14
+        },
+        {
+          "text": "professional memberships",
+          "weight": 10
+        },
+        {
+          "text": "key skills",
+          "weight": 10
+        },
+        {
+          "text": "technical skills",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "linkedin\\.com/in/[a-z0-9-]{3,40}",
+          "weight": 10,
+          "name": "LinkedIn profile URL"
+        },
+        {
+          "pattern": "(19|20)\\d{2}\\s*[-–]\\s*(present|current)\\b",
+          "weight": 14,
+          "name": "Date range ending in Present"
+        },
+        {
+          "pattern": "^\\s*(work\\s+)?experience\\s*$",
+          "flags": "im",
+          "weight": 12,
+          "name": "Experience section heading"
+        },
+        {
+          "pattern": "^\\s*education\\s*$",
+          "flags": "im",
+          "weight": 10,
+          "name": "Education section heading"
+        },
+        {
+          "pattern": "^\\s*(key\\s+|technical\\s+)?skills\\s*$",
+          "flags": "im",
+          "weight": 8,
+          "name": "Skills section heading"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "resume",
+          "weight": 26,
+          "name": "resume in filename"
+        },
+        {
+          "pattern": "(^|[^a-z])cv([^a-z]|$)",
+          "weight": 22,
+          "name": "cv in filename"
+        },
+        {
+          "pattern": "curriculum",
+          "weight": 24,
+          "name": "curriculum in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "resume|curriculum vitae",
+          "weight": 14,
+          "name": "Resume/CV in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "dear hiring manager",
+          "weight": 20,
+          "name": "cover letter salutation"
+        },
+        {
+          "text": "we are seeking",
+          "weight": 18,
+          "name": "job description language"
+        },
+        {
+          "text": "pleased to offer you",
+          "weight": 18,
+          "name": "offer letter language"
+        },
+        {
+          "text": "letter of recommendation",
+          "weight": 15,
+          "name": "reference letter heading"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 5
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "cover-letter",
+      "name": "Cover letter",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "dear hiring manager",
+          "weight": 30,
+          "where": "first"
+        },
+        {
+          "text": "i am writing to apply",
+          "weight": 30
+        },
+        {
+          "text": "i am excited to apply",
+          "weight": 26
+        },
+        {
+          "text": "i am writing to express my interest",
+          "weight": 26
+        },
+        {
+          "text": "i wish to apply for",
+          "weight": 22
+        },
+        {
+          "text": "applying for the position of",
+          "weight": 24
+        },
+        {
+          "text": "apply for the above position",
+          "weight": 22
+        },
+        {
+          "text": "thank you for considering my application",
+          "weight": 28
+        },
+        {
+          "text": "my enclosed resume",
+          "weight": 24
+        },
+        {
+          "text": "i enclose my cv",
+          "weight": 26
+        },
+        {
+          "text": "as advertised on",
+          "weight": 16
+        },
+        {
+          "text": "i look forward to the opportunity to discuss",
+          "weight": 20
+        },
+        {
+          "text": "your job posting",
+          "weight": 16
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bre:?\\s+application for\\b",
+          "weight": 16,
+          "name": "Re: application for subject line"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "cover[_ -]?letter",
+          "weight": 28,
+          "name": "cover letter in filename"
+        },
+        {
+          "pattern": "covering[_ -]?letter",
+          "weight": 26,
+          "name": "covering letter in filename"
+        },
+        {
+          "pattern": "application[_ -]?letter",
+          "weight": 20,
+          "name": "application letter in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "cover(ing)? letter",
+          "weight": 14,
+          "name": "Cover letter in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "curriculum vitae",
+          "weight": 15,
+          "name": "CV heading"
+        },
+        {
+          "text": "we are seeking",
+          "weight": 18,
+          "name": "job description language"
+        },
+        {
+          "text": "pleased to offer you",
+          "weight": 20,
+          "name": "offer letter language"
+        },
+        {
+          "text": "references available upon request",
+          "weight": 12,
+          "name": "resume closing line"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "address_block",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "job-description",
+      "name": "Job description",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "job description",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "role profile",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "about the role",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "position summary",
+          "weight": 18
+        },
+        {
+          "text": "we are seeking",
+          "weight": 24
+        },
+        {
+          "text": "key responsibilities",
+          "weight": 22
+        },
+        {
+          "text": "essential duties",
+          "weight": 18
+        },
+        {
+          "text": "required qualifications",
+          "weight": 24
+        },
+        {
+          "text": "preferred qualifications",
+          "weight": 26
+        },
+        {
+          "text": "the ideal candidate",
+          "weight": 22
+        },
+        {
+          "text": "person specification",
+          "weight": 28
+        },
+        {
+          "text": "job purpose",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "main duties and responsibilities",
+          "weight": 18
+        },
+        {
+          "text": "salary range",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "[$£€]\\s?\\d{2,3},\\d{3}\\s*(-|–|to)\\s*[$£€]?\\s?\\d{2,3},\\d{3}",
+          "weight": 14,
+          "name": "Salary range figures"
+        },
+        {
+          "pattern": "what you['’]ll (do|bring|need)",
+          "weight": 24,
+          "name": "What you'll do/bring heading (both apostrophes)"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "job[_ -]?description",
+          "weight": 28,
+          "name": "job description in filename"
+        },
+        {
+          "pattern": "(^|[^a-z])jd([^a-z]|$)",
+          "weight": 18,
+          "name": "jd in filename"
+        },
+        {
+          "pattern": "role[_ -]?profile",
+          "weight": 24,
+          "name": "role profile in filename"
+        },
+        {
+          "pattern": "(posting|vacancy|advert)",
+          "weight": 16,
+          "name": "vacancy/posting in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "job description|role profile",
+          "weight": 14,
+          "name": "Job description in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "pleased to offer you",
+          "weight": 22,
+          "name": "offer letter language"
+        },
+        {
+          "text": "i am writing to apply",
+          "weight": 18,
+          "name": "cover letter language"
+        },
+        {
+          "text": "curriculum vitae",
+          "weight": 15,
+          "name": "CV heading"
+        },
+        {
+          "text": "this agreement",
+          "weight": 12,
+          "name": "contract language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "bullet_heavy",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "offer-letter",
+      "name": "Offer letter",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "pleased to offer you",
+          "weight": 30
+        },
+        {
+          "text": "offer of employment",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "offer you the position of",
+          "weight": 26
+        },
+        {
+          "text": "conditional offer of employment",
+          "weight": 28
+        },
+        {
+          "text": "your start date will be",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "annual base salary",
+          "weight": 22
+        },
+        {
+          "text": "accept this offer",
+          "weight": 28
+        },
+        {
+          "text": "this offer is contingent",
+          "weight": 26
+        },
+        {
+          "text": "this offer is conditional",
+          "weight": 26
+        },
+        {
+          "text": "contingent upon",
+          "weight": 10
+        },
+        {
+          "text": "sign and return",
+          "weight": 14
+        },
+        {
+          "text": "we look forward to welcoming you",
+          "weight": 18
+        },
+        {
+          "text": "at-will",
+          "weight": 8
+        },
+        {
+          "text": "offer will remain open",
+          "weight": 18
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "salary of\\s+[$£€]?\\s?\\d{2,3},\\d{3}",
+          "weight": 16,
+          "name": "salary of $X figure"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "offer[_ -]?letter",
+          "weight": 28,
+          "name": "offer letter in filename"
+        },
+        {
+          "pattern": "offer[_ -]?of[_ -]?employment",
+          "weight": 28,
+          "name": "offer of employment in filename"
+        },
+        {
+          "pattern": "job[_ -]?offer",
+          "weight": 24,
+          "name": "job offer in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "offer (letter|of employment)",
+          "weight": 14,
+          "name": "Offer letter in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "we are seeking",
+          "weight": 20,
+          "name": "job description language"
+        },
+        {
+          "text": "person specification",
+          "weight": 15,
+          "name": "UK job description section"
+        },
+        {
+          "text": "i am writing to apply",
+          "weight": 18,
+          "name": "cover letter language"
+        },
+        {
+          "text": "curriculum vitae",
+          "weight": 15,
+          "name": "CV heading"
+        },
+        {
+          "text": "the employee shall",
+          "weight": 15,
+          "name": "employment contract language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 4
+        },
+        {
+          "signal": "signature_block",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "reference-letter",
+      "name": "Reference letter",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "letter of recommendation",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "letter of reference",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "character reference",
+          "weight": 30
+        },
+        {
+          "text": "it is my pleasure to recommend",
+          "weight": 32
+        },
+        {
+          "text": "i am writing to recommend",
+          "weight": 32
+        },
+        {
+          "text": "i highly recommend",
+          "weight": 24
+        },
+        {
+          "text": "i strongly recommend",
+          "weight": 20
+        },
+        {
+          "text": "i have known",
+          "weight": 16,
+          "where": "first"
+        },
+        {
+          "text": "without reservation",
+          "weight": 20
+        },
+        {
+          "text": "worked under my supervision",
+          "weight": 24
+        },
+        {
+          "text": "in my capacity as",
+          "weight": 12
+        },
+        {
+          "text": "to whom it may concern",
+          "weight": 10,
+          "where": "first"
+        },
+        {
+          "text": "an asset to your",
+          "weight": 18
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\brecommend (him|her|them)\\b",
+          "weight": 16,
+          "name": "recommend him/her/them"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(reference|recommendation)[_ -]?letter",
+          "weight": 28,
+          "name": "reference/recommendation letter in filename"
+        },
+        {
+          "pattern": "letter[_ -]?of[_ -]?(reference|recommendation)",
+          "weight": 28,
+          "name": "letter of reference in filename"
+        },
+        {
+          "pattern": "char(acter)?[_ -]?ref",
+          "weight": 22,
+          "name": "character reference in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "letter of recommendation|reference letter|character reference",
+          "weight": 14,
+          "name": "Reference letter in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "reference range",
+          "weight": 24,
+          "name": "lab report term"
+        },
+        {
+          "text": "referral",
+          "weight": 12,
+          "name": "medical referral term"
+        },
+        {
+          "text": "i am writing to apply",
+          "weight": 16,
+          "name": "cover letter language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "signature_block",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "employment-contract",
+      "name": "Employment contract",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "contract of employment",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "employment agreement",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "terms and conditions of employment",
+          "weight": 28
+        },
+        {
+          "text": "probationary period",
+          "weight": 22
+        },
+        {
+          "text": "notice period",
+          "weight": 14
+        },
+        {
+          "text": "remuneration",
+          "weight": 16
+        },
+        {
+          "text": "the employee shall",
+          "weight": 22
+        },
+        {
+          "text": "the employer shall",
+          "weight": 22
+        },
+        {
+          "text": "termination of employment",
+          "weight": 18
+        },
+        {
+          "text": "hours of work",
+          "weight": 14
+        },
+        {
+          "text": "restrictive covenant",
+          "weight": 14
+        },
+        {
+          "text": "gross misconduct",
+          "weight": 20
+        },
+        {
+          "text": "garden leave",
+          "weight": 24
+        },
+        {
+          "text": "continuous employment",
+          "weight": 18
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\((the\\s+)?[\"“]?(employer|employee)[\"”]?\\)",
+          "weight": 20,
+          "name": "Employer/Employee defined term"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "employment[_ -]?(contract|agreement)",
+          "weight": 28,
+          "name": "employment contract in filename"
+        },
+        {
+          "pattern": "contract[_ -]?of[_ -]?employment",
+          "weight": 28,
+          "name": "contract of employment in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "employment (agreement|contract)|contract of employment",
+          "weight": 14,
+          "name": "Employment contract in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "landlord",
+          "weight": 24,
+          "name": "lease agreement term"
+        },
+        {
+          "text": "tenant",
+          "weight": 20,
+          "name": "lease agreement term"
+        },
+        {
+          "text": "non-disclosure agreement",
+          "weight": 18,
+          "name": "NDA heading"
+        },
+        {
+          "text": "pleased to offer you",
+          "weight": 16,
+          "name": "offer letter language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 6
+        },
+        {
+          "signal": "long_doc",
+          "weight": 4
+        },
+        {
+          "signal": "toc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "timesheet",
+      "name": "Timesheet",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "timesheet",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "time sheet",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "time and attendance",
+          "weight": 16
+        },
+        {
+          "text": "week ending",
+          "weight": 24
+        },
+        {
+          "text": "hours worked",
+          "weight": 18
+        },
+        {
+          "text": "total hours",
+          "weight": 14
+        },
+        {
+          "text": "regular hours",
+          "weight": 18
+        },
+        {
+          "text": "overtime hours",
+          "weight": 20
+        },
+        {
+          "text": "clock in",
+          "weight": 20
+        },
+        {
+          "text": "clock out",
+          "weight": 20
+        },
+        {
+          "text": "billable hours",
+          "weight": 12
+        },
+        {
+          "text": "employee signature",
+          "weight": 8
+        },
+        {
+          "text": "approved by",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bmon(day)?\\s+tue(sday)?\\s+wed(nesday)?\\b",
+          "weight": 16,
+          "name": "Weekday column headers"
+        },
+        {
+          "pattern": "\\b\\d{1,2}\\.\\d{2}\\s?(hrs|hours)\\b",
+          "weight": 12,
+          "name": "Decimal hours (e.g. 7.50 hrs)"
+        },
+        {
+          "pattern": "(hours|hrs):\\s?\\d{1,3}\\.\\d{2}\\b",
+          "weight": 12,
+          "name": "Hours total (e.g. Hours: 40.00)"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "time[_ -]?sheet",
+          "weight": 30,
+          "name": "timesheet in filename"
+        },
+        {
+          "pattern": "(^|[^a-z])hours([^a-z]|$)",
+          "weight": 12,
+          "name": "hours in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "time ?sheet",
+          "weight": 14,
+          "name": "Timesheet in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "invoice number",
+          "weight": 20,
+          "name": "invoice field"
+        },
+        {
+          "text": "net pay",
+          "weight": 20,
+          "name": "payslip field"
+        },
+        {
+          "text": "remittance",
+          "weight": 15,
+          "name": "remittance advice term"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        },
+        {
+          "signal": "form_like",
+          "weight": 5
+        },
+        {
+          "signal": "short_doc",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "performance-review",
+      "name": "Performance review",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "performance review",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "performance appraisal",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "appraisal record",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "appraisal meeting",
+          "weight": 22
+        },
+        {
+          "text": "review period",
+          "weight": 22
+        },
+        {
+          "text": "areas for improvement",
+          "weight": 26
+        },
+        {
+          "text": "exceeds expectations",
+          "weight": 26
+        },
+        {
+          "text": "meets expectations",
+          "weight": 24
+        },
+        {
+          "text": "self-assessment",
+          "weight": 12
+        },
+        {
+          "text": "overall rating",
+          "weight": 22
+        },
+        {
+          "text": "development plan",
+          "weight": 14
+        },
+        {
+          "text": "mid-year review",
+          "weight": 20
+        },
+        {
+          "text": "manager comments",
+          "weight": 18
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b5\\s*[-=–]\\s*(exceptional|outstanding|exceeds)",
+          "weight": 16,
+          "name": "Rating scale legend (5 = Exceptional)"
+        },
+        {
+          "pattern": "overall rating\\s*[:=]?\\s*[1-5]\\b",
+          "weight": 14,
+          "name": "Overall rating score"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "performance[_ -]?review",
+          "weight": 28,
+          "name": "performance review in filename"
+        },
+        {
+          "pattern": "appraisal",
+          "weight": 18,
+          "name": "appraisal in filename"
+        },
+        {
+          "pattern": "perf[_ -]?review",
+          "weight": 22,
+          "name": "perf review in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "performance (review|appraisal)|appraisal",
+          "weight": 12,
+          "name": "Performance review in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "tax return",
+          "weight": 20,
+          "name": "self assessment tax confusable"
+        },
+        {
+          "text": "hmrc",
+          "weight": 18,
+          "name": "UK tax authority"
+        },
+        {
+          "text": "inspection",
+          "weight": 15,
+          "name": "inspection report term"
+        },
+        {
+          "text": "appraised value",
+          "weight": 20,
+          "name": "property appraisal term"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 5
+        },
+        {
+          "signal": "number_table",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "employee-handbook",
+      "name": "Employee handbook",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "employee handbook",
+          "weight": 38,
+          "where": "title"
+        },
+        {
+          "text": "staff handbook",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "code of conduct",
+          "weight": 16
+        },
+        {
+          "text": "dress code",
+          "weight": 16
+        },
+        {
+          "text": "annual leave",
+          "weight": 12
+        },
+        {
+          "text": "sick leave",
+          "weight": 12
+        },
+        {
+          "text": "disciplinary procedure",
+          "weight": 16
+        },
+        {
+          "text": "grievance procedure",
+          "weight": 16
+        },
+        {
+          "text": "equal opportunity",
+          "weight": 10
+        },
+        {
+          "text": "probationary period",
+          "weight": 8
+        },
+        {
+          "text": "working hours",
+          "weight": 8
+        },
+        {
+          "text": "welcome to the company",
+          "weight": 14
+        }
+      ],
+      "regexes": [],
+      "filenames": [
+        {
+          "pattern": "(employee|staff)[-_ ]?handbook",
+          "weight": 28,
+          "name": "Handbook filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "employment agreement",
+          "weight": 18,
+          "name": "Individual contract, not handbook"
+        },
+        {
+          "text": "offer of employment",
+          "weight": 16,
+          "name": "Offer letter"
+        },
+        {
+          "text": "curriculum vitae",
+          "weight": 16,
+          "name": "CV"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "toc",
+          "weight": 8
+        },
+        {
+          "signal": "long_doc",
+          "weight": 4
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "risk-assessment",
+      "name": "Risk assessment",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "penetration test report",
+          "weight": 38,
+          "where": "title"
+        },
+        {
+          "text": "penetration testing report",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "penetration test",
+          "weight": 14,
+          "where": "title"
+        },
+        {
+          "text": "vulnerability assessment and penetration test",
+          "weight": 30
+        },
+        {
+          "text": "rules of engagement",
+          "weight": 22
+        },
+        {
+          "text": "attack narrative",
+          "weight": 20
+        },
+        {
+          "text": "exploitability",
+          "weight": 18
+        },
+        {
+          "text": "owasp top 10",
+          "weight": 16
+        },
+        {
+          "text": "remediation recommendations",
+          "weight": 12
+        },
+        {
+          "text": "scope of engagement",
+          "weight": 12
+        },
+        {
+          "text": "critical severity finding",
+          "weight": 10
+        },
+        {
+          "text": "retest results",
+          "weight": 8
+        },
+        {
+          "text": "risk assessment report",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "risk register",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "likelihood and impact",
+          "weight": 24
+        },
+        {
+          "text": "residual risk",
+          "weight": 24
+        },
+        {
+          "text": "risk heat map",
+          "weight": 24
+        },
+        {
+          "text": "risk owner",
+          "weight": 20
+        },
+        {
+          "text": "inherent risk",
+          "weight": 18
+        },
+        {
+          "text": "mitigation plan",
+          "weight": 14
+        },
+        {
+          "text": "risk appetite",
+          "weight": 16
+        },
+        {
+          "text": "risk rating",
+          "weight": 12
+        },
+        {
+          "text": "threat and vulnerability",
+          "weight": 16
+        },
+        {
+          "text": "control effectiveness",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "cvss\\s*(v?3(\\.\\d)?)?\\s*(score|base score)?\\s*[:=]?\\s*\\d(\\.\\d)?",
+          "flags": "gi",
+          "weight": 22,
+          "name": "CVSS score"
+        },
+        {
+          "pattern": "\\b(critical|high|medium|low)\\s*[-–]?\\s*(risk|severity)\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "severity rating"
+        },
+        {
+          "pattern": "\\bfinding\\s*#?\\d{1,3}\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "finding number"
+        },
+        {
+          "pattern": "\\ba0[1-9]:20\\d{2}\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "OWASP category code"
+        },
+        {
+          "pattern": "engagement\\s+(dates?|window)",
+          "flags": "gi",
+          "weight": 12,
+          "name": "engagement dates"
+        },
+        {
+          "pattern": "risk\\s*(score|rating)\\s*[:=]?\\s*(low|medium|high|critical|\\d{1,2})",
+          "flags": "gi",
+          "weight": 16,
+          "name": "risk score/rating"
+        },
+        {
+          "pattern": "likelihood\\s*[:=]?\\s*(low|medium|high)",
+          "flags": "gi",
+          "weight": 12,
+          "name": "likelihood field"
+        },
+        {
+          "pattern": "\\d{1,2}\\s*x\\s*\\d{1,2}\\s*risk\\s*matrix",
+          "flags": "gi",
+          "weight": 14,
+          "name": "risk matrix dimensions"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "pen[\\s_-]?test|penetration[\\s_-]?test",
+          "weight": 28,
+          "name": "pentest in filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])vapt([^a-z0-9]|$)",
+          "weight": 22,
+          "name": "VAPT abbreviation"
+        },
+        {
+          "pattern": "security[\\s_-]?assessment",
+          "weight": 16,
+          "name": "security assessment filename"
+        },
+        {
+          "pattern": "risk[\\s_-]?assessment",
+          "weight": 28,
+          "name": "risk assessment filename"
+        },
+        {
+          "pattern": "risk[\\s_-]?register",
+          "weight": 26,
+          "name": "risk register filename"
+        },
+        {
+          "pattern": "risk[\\s_-]?matrix",
+          "weight": 18,
+          "name": "risk matrix filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "penetration test|pentest|vapt",
+          "weight": 16,
+          "name": "Info title pentest"
+        },
+        {
+          "field": "title",
+          "pattern": "risk assessment|risk register",
+          "weight": 14,
+          "name": "Info title risk assessment"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "functional requirements",
+          "weight": 14,
+          "name": "tech spec vocab"
+        },
+        {
+          "text": "api reference",
+          "weight": 12,
+          "name": "software doc vocab"
+        },
+        {
+          "text": "trust services criteria",
+          "weight": 20,
+          "name": "SOC 2 report vocab"
+        },
+        {
+          "text": "auditor's opinion",
+          "weight": 16,
+          "name": "SOC 2 opinion vocab"
+        },
+        {
+          "text": "cvss",
+          "weight": 14,
+          "name": "pentest report vocab"
+        },
+        {
+          "text": "indicators of compromise",
+          "weight": 12,
+          "name": "incident report vocab"
+        },
+        {
+          "text": "containment and eradication",
+          "weight": 12,
+          "name": "incident report vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        },
+        {
+          "signal": "toc",
+          "weight": 4
+        },
+        {
+          "signal": "long_doc",
+          "weight": 3
+        },
+        {
+          "signal": "form_like",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "audit-report",
+      "name": "Audit report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "soc 2 type ii",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "soc 2 type 2",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "type ii report",
+          "weight": 20
+        },
+        {
+          "text": "system and organization controls",
+          "weight": 30
+        },
+        {
+          "text": "trust services criteria",
+          "weight": 28
+        },
+        {
+          "text": "independent service auditor's report",
+          "weight": 26
+        },
+        {
+          "text": "control objectives",
+          "weight": 20
+        },
+        {
+          "text": "management's assertion",
+          "weight": 22
+        },
+        {
+          "text": "iso/iec 27001",
+          "weight": 24
+        },
+        {
+          "text": "aicpa",
+          "weight": 16
+        },
+        {
+          "text": "exceptions noted",
+          "weight": 12
+        },
+        {
+          "text": "unqualified opinion",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "soc\\s*2\\s*type\\s*(i{1,2}|1|2)",
+          "flags": "gi",
+          "weight": 24,
+          "name": "SOC 2 Type I/II"
+        },
+        {
+          "pattern": "iso\\s*/?\\s*iec\\s*27001(:\\d{4})?",
+          "flags": "gi",
+          "weight": 20,
+          "name": "ISO 27001 reference"
+        },
+        {
+          "pattern": "\\d{1,2}[/.-]\\d{1,2}[/.-]\\d{2,4}\\s*(to|through|-)\\s*\\d{1,2}[/.-]\\d{1,2}[/.-]\\d{2,4}",
+          "flags": "gi",
+          "weight": 14,
+          "name": "audit period date range"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "soc[\\s_-]?2",
+          "weight": 28,
+          "name": "SOC 2 in filename"
+        },
+        {
+          "pattern": "type[\\s_-]?ii",
+          "weight": 16,
+          "name": "Type II in filename"
+        },
+        {
+          "pattern": "iso[\\s_-]?27001",
+          "weight": 20,
+          "name": "ISO 27001 filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "soc\\s*2|type\\s*ii|iso\\s*27001",
+          "weight": 14,
+          "name": "Info title SOC 2"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "certificate of liability insurance",
+          "weight": 22,
+          "name": "COI heading"
+        },
+        {
+          "text": "certificate holder",
+          "weight": 16,
+          "name": "COI field"
+        },
+        {
+          "text": "consolidated financial statements",
+          "weight": 18,
+          "name": "financial report vocab"
+        },
+        {
+          "text": "balance sheet",
+          "weight": 14,
+          "name": "financial statement vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "long_doc",
+          "weight": 5
+        },
+        {
+          "signal": "toc",
+          "weight": 4
+        },
+        {
+          "signal": "signature_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "compliance-document",
+      "name": "Compliance document",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "information security policy",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "security policy",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "acceptable use policy",
+          "weight": 20
+        },
+        {
+          "text": "data classification policy",
+          "weight": 26
+        },
+        {
+          "text": "access control policy",
+          "weight": 24
+        },
+        {
+          "text": "policy owner",
+          "weight": 22
+        },
+        {
+          "text": "password policy",
+          "weight": 18
+        },
+        {
+          "text": "least privilege",
+          "weight": 16
+        },
+        {
+          "text": "confidentiality, integrity and availability",
+          "weight": 24
+        },
+        {
+          "text": "policy review cycle",
+          "weight": 14
+        },
+        {
+          "text": "information security management system",
+          "weight": 22
+        },
+        {
+          "text": "effective date",
+          "weight": 6
+        },
+        {
+          "text": "business continuity plan",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "disaster recovery plan",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "recovery time objective",
+          "weight": 28
+        },
+        {
+          "text": "recovery point objective",
+          "weight": 28
+        },
+        {
+          "text": "business impact analysis",
+          "weight": 26
+        },
+        {
+          "text": "failover procedures",
+          "weight": 20
+        },
+        {
+          "text": "crisis management team",
+          "weight": 20
+        },
+        {
+          "text": "continuity of operations",
+          "weight": 18
+        },
+        {
+          "text": "backup and recovery",
+          "weight": 12
+        },
+        {
+          "text": "emergency response plan",
+          "weight": 16
+        },
+        {
+          "text": "alternate site",
+          "weight": 12
+        },
+        {
+          "text": "activation criteria",
+          "weight": 10
+        },
+        {
+          "text": "regulatory compliance report",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "compliance report",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "compliance assessment",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "controls tested",
+          "weight": 24
+        },
+        {
+          "text": "non-compliance",
+          "weight": 20
+        },
+        {
+          "text": "remediation plan",
+          "weight": 18
+        },
+        {
+          "text": "compliance framework",
+          "weight": 18
+        },
+        {
+          "text": "attestation of compliance",
+          "weight": 28
+        },
+        {
+          "text": "gap analysis",
+          "weight": 14
+        },
+        {
+          "text": "corrective action plan",
+          "weight": 18
+        },
+        {
+          "text": "regulatory requirements",
+          "weight": 10
+        },
+        {
+          "text": "audit findings",
+          "weight": 12
+        },
+        {
+          "text": "declaration of conformity",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "certificate of conformity",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "declare under our sole responsibility",
+          "weight": 36,
+          "where": "first"
+        },
+        {
+          "text": "object of the declaration",
+          "weight": 30
+        },
+        {
+          "text": "notified body",
+          "weight": 26
+        },
+        {
+          "text": "harmonised standards",
+          "weight": 24
+        },
+        {
+          "text": "harmonized standards",
+          "weight": 24
+        },
+        {
+          "text": "ukca",
+          "weight": 20
+        },
+        {
+          "text": "conformity assessment",
+          "weight": 16
+        },
+        {
+          "text": "ce marking",
+          "weight": 14
+        },
+        {
+          "text": "essential requirements",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "policy\\s+(owner|approved by|effective date)\\s*[:]",
+          "flags": "gi",
+          "weight": 14,
+          "name": "policy metadata field"
+        },
+        {
+          "pattern": "review(ed)?\\s+(annually|every\\s+\\d{1,2}\\s+(months|years))",
+          "flags": "gi",
+          "weight": 12,
+          "name": "policy review cadence"
+        },
+        {
+          "pattern": "\\biso\\s?27001\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "ISO 27001 reference"
+        },
+        {
+          "pattern": "\\brto\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "RTO abbreviation"
+        },
+        {
+          "pattern": "\\brpo\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "RPO abbreviation"
+        },
+        {
+          "pattern": "recovery\\s+time\\s+objective\\s*[:=]?\\s*\\d{1,3}\\s*(hours?|minutes?|days?)",
+          "flags": "gi",
+          "weight": 18,
+          "name": "RTO with value"
+        },
+        {
+          "pattern": "tier\\s*[1-4]\\s*(system|application)",
+          "flags": "gi",
+          "weight": 12,
+          "name": "recovery tier classification"
+        },
+        {
+          "pattern": "pci\\s*dss",
+          "flags": "gi",
+          "weight": 18,
+          "name": "PCI DSS reference"
+        },
+        {
+          "pattern": "hipaa\\s*(security|privacy)?\\s*rule",
+          "flags": "gi",
+          "weight": 16,
+          "name": "HIPAA rule reference"
+        },
+        {
+          "pattern": "\\bfedramp\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "FedRAMP reference"
+        },
+        {
+          "pattern": "compliance\\s+(status|rate)\\s*[:=]?\\s*\\d{1,3}\\s*%",
+          "flags": "gi",
+          "weight": 14,
+          "name": "compliance percentage"
+        },
+        {
+          "pattern": "\\b\\d{4}/\\d{1,3}/(eu|ec|eec)\\b",
+          "flags": "gi",
+          "weight": 22,
+          "name": "eu directive number"
+        },
+        {
+          "pattern": "regulation\\s?\\(eu\\)\\s?\\d{4}/\\d{3,4}",
+          "flags": "gi",
+          "weight": 18,
+          "name": "eu regulation number"
+        },
+        {
+          "pattern": "\\b(bs\\s?)?en\\s?(iso\\s?|iec\\s?)?\\d{3,5}([-:]\\d{1,4}){0,3}",
+          "flags": "gi",
+          "weight": 12,
+          "name": "en standard reference"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "information[\\s_-]?security[\\s_-]?polic",
+          "weight": 28,
+          "name": "information security policy filename"
+        },
+        {
+          "pattern": "security[\\s_-]?polic(y|ies)",
+          "weight": 24,
+          "name": "security policy filename"
+        },
+        {
+          "pattern": "infosec[\\s_-]?polic",
+          "weight": 22,
+          "name": "infosec policy filename"
+        },
+        {
+          "pattern": "acceptable[\\s_-]?use[\\s_-]?polic",
+          "weight": 18,
+          "name": "AUP filename"
+        },
+        {
+          "pattern": "business[\\s_-]?continuity",
+          "weight": 28,
+          "name": "BCP filename"
+        },
+        {
+          "pattern": "disaster[\\s_-]?recovery",
+          "weight": 26,
+          "name": "DR plan filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])(bcp|drp)([^a-z0-9]|$)",
+          "weight": 20,
+          "name": "BCP/DRP abbreviation"
+        },
+        {
+          "pattern": "compliance[\\s_-]?report",
+          "weight": 28,
+          "name": "compliance report filename"
+        },
+        {
+          "pattern": "compliance[\\s_-]?assessment",
+          "weight": 22,
+          "name": "compliance assessment filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])(aoc|pci[\\s_-]?dss)([^a-z0-9]|$)",
+          "weight": 20,
+          "name": "AOC/PCI DSS abbreviation"
+        },
+        {
+          "pattern": "declaration[\\s_-]*of[\\s_-]*conformity",
+          "weight": 26,
+          "name": "doc filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])(coc|cofc|dofc)([^a-z0-9]|$)",
+          "weight": 18,
+          "name": "coc abbreviation"
+        },
+        {
+          "pattern": "conformity",
+          "weight": 16,
+          "name": "conformity keyword"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "information security policy|security policy",
+          "weight": 14,
+          "name": "Info title security policy"
+        },
+        {
+          "field": "title",
+          "pattern": "business continuity|disaster recovery",
+          "weight": 14,
+          "name": "Info title BCP/DR"
+        },
+        {
+          "field": "title",
+          "pattern": "compliance report|compliance assessment|attestation of compliance",
+          "weight": 14,
+          "name": "Info title compliance report"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "by accessing or using",
+          "weight": 20,
+          "name": "ToS acceptance clause"
+        },
+        {
+          "text": "you agree to be bound",
+          "weight": 18,
+          "name": "ToS clause"
+        },
+        {
+          "text": "these terms",
+          "weight": 12,
+          "name": "ToS vocab"
+        },
+        {
+          "text": "end user license agreement",
+          "weight": 16,
+          "name": "EULA vocab"
+        },
+        {
+          "text": "this document specifies",
+          "weight": 12,
+          "name": "tech spec vocab"
+        },
+        {
+          "text": "functional requirements",
+          "weight": 12,
+          "name": "tech spec vocab"
+        },
+        {
+          "text": "root cause analysis",
+          "weight": 12,
+          "name": "incident report vocab"
+        },
+        {
+          "text": "indicators of compromise",
+          "weight": 12,
+          "name": "incident report vocab"
+        },
+        {
+          "text": "risk register",
+          "weight": 10,
+          "name": "risk assessment vocab"
+        },
+        {
+          "text": "certificate of liability insurance",
+          "weight": 20,
+          "name": "COI heading"
+        },
+        {
+          "text": "certificate holder",
+          "weight": 16,
+          "name": "COI field"
+        },
+        {
+          "text": "consolidated financial statements",
+          "weight": 16,
+          "name": "financial report vocab"
+        },
+        {
+          "text": "trust services criteria",
+          "weight": 14,
+          "name": "SOC 2 report vocab"
+        },
+        {
+          "text": "has successfully completed",
+          "weight": 24,
+          "name": "diploma wording"
+        },
+        {
+          "text": "certificate of insurance",
+          "weight": 22,
+          "name": "insurance cert"
+        },
+        {
+          "text": "proof of purchase",
+          "weight": 18,
+          "name": "warranty card"
+        },
+        {
+          "text": "warranty period",
+          "weight": 16,
+          "name": "warranty card"
+        },
+        {
+          "text": "heat number",
+          "weight": 18,
+          "name": "mill cert field"
+        },
+        {
+          "text": "chemical composition",
+          "weight": 16,
+          "name": "mill cert table"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "toc",
+          "weight": 4
+        },
+        {
+          "signal": "long_doc",
+          "weight": 3
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 4
+        },
+        {
+          "signal": "number_table",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 8
+        },
+        {
+          "signal": "signature_block",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "incident-report",
+      "name": "Incident report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "security incident report",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "incident response report",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "post-incident report",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "post-mortem",
+          "weight": 14
+        },
+        {
+          "text": "root cause analysis",
+          "weight": 22
+        },
+        {
+          "text": "timeline of events",
+          "weight": 20
+        },
+        {
+          "text": "affected systems",
+          "weight": 18
+        },
+        {
+          "text": "containment and eradication",
+          "weight": 26
+        },
+        {
+          "text": "indicators of compromise",
+          "weight": 26
+        },
+        {
+          "text": "data breach notification",
+          "weight": 24
+        },
+        {
+          "text": "unauthorized access",
+          "weight": 14
+        },
+        {
+          "text": "lessons learned",
+          "weight": 8
+        },
+        {
+          "text": "severity level",
+          "weight": 6
+        },
+        {
+          "text": "police report",
+          "weight": 24
+        },
+        {
+          "text": "accident report",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "reporting officer",
+          "weight": 20
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "incident\\s*(id|number|ref(erence)?)\\s*[:#]?\\s*[a-z0-9-]{3,15}",
+          "flags": "gi",
+          "weight": 16,
+          "name": "incident ID"
+        },
+        {
+          "pattern": "\\bioc(s)?\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "IOC abbreviation"
+        },
+        {
+          "pattern": "detected\\s+(on|at)\\s+\\d{1,2}[/.-]\\d{1,2}[/.-]\\d{2,4}",
+          "flags": "gi",
+          "weight": 14,
+          "name": "detection date"
+        },
+        {
+          "pattern": "mean\\s+time\\s+to\\s+(detect|contain|respond)",
+          "flags": "gi",
+          "weight": 16,
+          "name": "MTTD/MTTC/MTTR"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "security[\\s_-]?incident",
+          "weight": 26,
+          "name": "security incident filename"
+        },
+        {
+          "pattern": "incident[\\s_-]?report",
+          "weight": 24,
+          "name": "incident report filename"
+        },
+        {
+          "pattern": "breach[\\s_-]?report",
+          "weight": 22,
+          "name": "breach report filename"
+        },
+        {
+          "pattern": "post[\\s_-]?mortem",
+          "weight": 18,
+          "name": "postmortem filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "incident report|breach notification|post-incident",
+          "weight": 14,
+          "name": "Info title incident report"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "call to order",
+          "weight": 14,
+          "name": "meeting minutes vocab"
+        },
+        {
+          "text": "attendees present",
+          "weight": 12,
+          "name": "meeting minutes vocab"
+        },
+        {
+          "text": "risk register",
+          "weight": 12,
+          "name": "risk assessment vocab"
+        },
+        {
+          "text": "likelihood and impact",
+          "weight": 10,
+          "name": "risk assessment vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 6
+        },
+        {
+          "signal": "toc",
+          "weight": 3
+        },
+        {
+          "signal": "signature_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "questionnaire",
+      "name": "Questionnaire",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "vendor security questionnaire",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "third-party risk questionnaire",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "standardized information gathering",
+          "weight": 28
+        },
+        {
+          "text": "consensus assessments initiative questionnaire",
+          "weight": 32
+        },
+        {
+          "text": "security questionnaire",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "subprocessors",
+          "weight": 16
+        },
+        {
+          "text": "data handling practices",
+          "weight": 16
+        },
+        {
+          "text": "please answer yes or no",
+          "weight": 18
+        },
+        {
+          "text": "vendor risk management",
+          "weight": 16
+        },
+        {
+          "text": "due diligence questionnaire",
+          "weight": 20
+        },
+        {
+          "text": "compensating control",
+          "weight": 10
+        },
+        {
+          "text": "response column",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bsig\\s?(lite|core)\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "SIG questionnaire abbreviation"
+        },
+        {
+          "pattern": "\\bcaiq\\b",
+          "flags": "gi",
+          "weight": 18,
+          "name": "CAIQ abbreviation"
+        },
+        {
+          "pattern": "yes\\s*/\\s*no\\s*/\\s*n\\s*/\\s*a",
+          "flags": "gi",
+          "weight": 12,
+          "name": "yes/no/na answer format"
+        },
+        {
+          "pattern": "question\\s*#?\\d{1,3}",
+          "flags": "gi",
+          "weight": 12,
+          "name": "numbered question"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "security[\\s_-]?questionnaire",
+          "weight": 28,
+          "name": "security questionnaire filename"
+        },
+        {
+          "pattern": "vendor[\\s_-]?risk",
+          "weight": 20,
+          "name": "vendor risk filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])(sig|caiq)([^a-z0-9]|$)",
+          "weight": 22,
+          "name": "SIG/CAIQ abbreviation filename"
+        },
+        {
+          "pattern": "due[\\s_-]?diligence",
+          "weight": 16,
+          "name": "due diligence filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "security questionnaire|vendor risk|caiq",
+          "weight": 14,
+          "name": "Info title vendor questionnaire"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "cvss",
+          "weight": 12,
+          "name": "pentest report vocab"
+        },
+        {
+          "text": "trust services criteria",
+          "weight": 14,
+          "name": "SOC 2 report vocab"
+        },
+        {
+          "text": "auditor's opinion",
+          "weight": 12,
+          "name": "SOC 2 opinion vocab"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 10
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 4
+        },
+        {
+          "signal": "number_table",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "lab-report",
+      "name": "Lab report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "laboratory report",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "reference range",
+          "weight": 26
+        },
+        {
+          "text": "reference interval",
+          "weight": 24
+        },
+        {
+          "text": "full blood count",
+          "weight": 24
+        },
+        {
+          "text": "comprehensive metabolic panel",
+          "weight": 24
+        },
+        {
+          "text": "complete blood count",
+          "weight": 22
+        },
+        {
+          "text": "specimen type",
+          "weight": 22
+        },
+        {
+          "text": "specimen id",
+          "weight": 20
+        },
+        {
+          "text": "basic metabolic panel",
+          "weight": 20
+        },
+        {
+          "text": "urea and electrolytes",
+          "weight": 16
+        },
+        {
+          "text": "lipid panel",
+          "weight": 16
+        },
+        {
+          "text": "sample type",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "date collected",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "out of range",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b\\d{1,4}(?:\\.\\d{1,3})?\\s?(?:mg\\/dl|mmol\\/l|g\\/dl|g\\/l|iu\\/l|u\\/l|ng\\/ml|mcg\\/dl|pg\\/ml|miu\\/l|umol\\/l|10\\^(?:9|12)\\/l|x10e(?:3|6)\\/ul)\\b",
+          "weight": 16,
+          "name": "Result value with lab units"
+        },
+        {
+          "pattern": "(?:mg\\/dl|mmol\\/l|g\\/dl|g\\/l|iu\\/l|u\\/l|ng\\/ml|umol\\/l|ug\\/l|fl|%)\\s?\\(\\s?\\d{1,4}(?:\\.\\d{1,3})?\\s?[-–]\\s?\\d{1,4}(?:\\.\\d{1,3})?\\s?\\)",
+          "weight": 14,
+          "name": "Bracketed reference range"
+        },
+        {
+          "pattern": "\\bclia\\s?(?:no\\.?|number|#)?\\s?:?\\s?\\d{2}d\\d{7}\\b",
+          "weight": 14,
+          "name": "CLIA number"
+        },
+        {
+          "pattern": "\\b(?:h(?:a)?emoglobin|h(?:a)?ematocrit|platelet count|white (?:blood )?cell count|creatinine|bilirubin|alkaline phosphatase|hba1c|tsh|egfr|ferritin)\\b",
+          "weight": 10,
+          "name": "Common lab analytes"
+        },
+        {
+          "pattern": "\\bcollected\\s?:?\\s?\\d{1,2}[\\/\\-]",
+          "weight": 10,
+          "name": "Collected date field"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "lab[-_ .]?(results?|report|work)",
+          "weight": 26,
+          "name": "lab results filename"
+        },
+        {
+          "pattern": "blood[-_ .]?(test|work|results?)",
+          "weight": 22,
+          "name": "blood test filename"
+        },
+        {
+          "pattern": "path(ology)?[-_ .]?(report|results?)",
+          "weight": 18,
+          "name": "pathology filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "lab(oratory)?[ _-]?(results?|report)",
+          "weight": 14,
+          "name": "lab report in title"
+        },
+        {
+          "field": "any",
+          "pattern": "labcorp|quest diagnostics|sonora quest|bioreference",
+          "weight": 14,
+          "name": "reference lab vendor"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "explanation of benefits",
+          "weight": 18,
+          "name": "EOB language"
+        },
+        {
+          "text": "certificate of analysis",
+          "weight": 18,
+          "name": "industrial CoA, not medical"
+        },
+        {
+          "text": "amount billed",
+          "weight": 18,
+          "name": "billing language"
+        },
+        {
+          "text": "patient responsibility",
+          "weight": 18,
+          "name": "billing language"
+        },
+        {
+          "text": "allowed amount",
+          "weight": 16,
+          "name": "billing language"
+        },
+        {
+          "text": "plan paid",
+          "weight": 14,
+          "name": "EOB payment language"
+        },
+        {
+          "text": "amount you owe",
+          "weight": 14,
+          "name": "billing language"
+        },
+        {
+          "text": "dispense as written",
+          "weight": 14,
+          "name": "prescription language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 10
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "prescription",
+      "name": "Prescription",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "dispense as written",
+          "weight": 32
+        },
+        {
+          "text": "repeat prescription",
+          "weight": 26
+        },
+        {
+          "text": "pharmacy stamp",
+          "weight": 24
+        },
+        {
+          "text": "refills remaining",
+          "weight": 20
+        },
+        {
+          "text": "qty dispensed",
+          "weight": 18
+        },
+        {
+          "text": "days supply",
+          "weight": 16
+        },
+        {
+          "text": "take one tablet",
+          "weight": 14
+        },
+        {
+          "text": "take one capsule",
+          "weight": 14
+        },
+        {
+          "text": "sig:",
+          "weight": 14
+        },
+        {
+          "text": "prescriber",
+          "weight": 12
+        },
+        {
+          "text": "controlled substance",
+          "weight": 10
+        },
+        {
+          "text": "pharmacist",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bdea\\s?(?:no\\.?|number|#)?\\s?:?\\s?[a-z]{2}\\d{7}\\b",
+          "weight": 25,
+          "name": "DEA number"
+        },
+        {
+          "pattern": "\\bndc\\s?:?\\s?\\d{4,5}-\\d{3,4}-\\d{1,2}\\b",
+          "weight": 20,
+          "name": "NDC code"
+        },
+        {
+          "pattern": "\\btake (?:one|two|1|2) (?:tablet|capsule|cap)s? by mouth\\b",
+          "weight": 18,
+          "name": "Sig dosing instruction"
+        },
+        {
+          "pattern": "\\brx\\s?(?:no\\.?|number|#)?\\s?:?\\s?\\d{5,10}\\b",
+          "weight": 16,
+          "name": "Rx number"
+        },
+        {
+          "pattern": "\\brefills?(?: remaining| left| authorized)?\\s?:?\\s?\\d{1,2}\\b",
+          "weight": 14,
+          "name": "Refill count"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "prescription",
+          "weight": 26,
+          "name": "prescription filename"
+        },
+        {
+          "pattern": "(^|[^a-z])rx([^a-z]|$)",
+          "weight": 18,
+          "name": "rx token in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "prescription",
+          "weight": 12,
+          "name": "prescription in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "explanation of benefits",
+          "weight": 18,
+          "name": "EOB language"
+        },
+        {
+          "text": "reference range",
+          "weight": 16,
+          "name": "lab report language"
+        },
+        {
+          "text": "allowed amount",
+          "weight": 14,
+          "name": "billing language"
+        },
+        {
+          "text": "patient responsibility",
+          "weight": 12,
+          "name": "billing language"
+        },
+        {
+          "text": "formulary",
+          "weight": 12,
+          "name": "insurance drug-list language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 8
+        },
+        {
+          "signal": "form_like",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "medical-report",
+      "name": "Medical report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "discharge summary",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "presenting complaint",
+          "weight": 24
+        },
+        {
+          "text": "history of present illness",
+          "weight": 24
+        },
+        {
+          "text": "on examination",
+          "weight": 20
+        },
+        {
+          "text": "past medical history",
+          "weight": 20
+        },
+        {
+          "text": "hospital course",
+          "weight": 20
+        },
+        {
+          "text": "thank you for referring",
+          "weight": 18,
+          "where": "first"
+        },
+        {
+          "text": "treatment plan",
+          "weight": 14
+        },
+        {
+          "text": "diagnosis:",
+          "weight": 12
+        },
+        {
+          "text": "dear dr",
+          "weight": 12,
+          "where": "first"
+        },
+        {
+          "text": "physical examination",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bconsultant (?:cardiologist|physician|dermatologist|neurologist|psychiatrist|surgeon|paediatrician|pediatrician|gastroenterologist|rheumatologist|endocrinologist|oncologist|urologist|ophthalmologist)\\b",
+          "weight": 16,
+          "name": "Consultant specialty sign-off"
+        },
+        {
+          "pattern": "\\bmrn\\s?(?:no\\.?|#)?\\s?:?\\s?[a-z0-9]{5,12}\\b",
+          "weight": 14,
+          "name": "Medical record number"
+        },
+        {
+          "pattern": "\\bnhs\\s?(?:no\\.?|number)\\s?:?\\s?\\d{3}\\s?\\d{3}\\s?\\d{4}\\b",
+          "weight": 10,
+          "name": "NHS number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "discharge[-_ .]?summary",
+          "weight": 24,
+          "name": "discharge summary filename"
+        },
+        {
+          "pattern": "(clinic|consult(ant)?|medical|dr)[-_ .]?letter",
+          "weight": 22,
+          "name": "clinic letter filename"
+        },
+        {
+          "pattern": "clinic[-_ .]?note",
+          "weight": 20,
+          "name": "clinic note filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "(clinic|discharge) (letter|summary)",
+          "weight": 12,
+          "name": "clinic letter in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "reason for referral",
+          "weight": 20,
+          "name": "referral letter language"
+        },
+        {
+          "text": "please see this patient",
+          "weight": 20,
+          "name": "referral letter language"
+        },
+        {
+          "text": "i am referring",
+          "weight": 18,
+          "name": "referral letter language"
+        },
+        {
+          "text": "reference range",
+          "weight": 14,
+          "name": "lab report language"
+        },
+        {
+          "text": "explanation of benefits",
+          "weight": 14,
+          "name": "EOB language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "address_block",
+          "weight": 6
+        },
+        {
+          "signal": "signature_block",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "immunization-record",
+      "name": "Immunization record",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "immunization record",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "vaccination record",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "certificate of vaccination",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "immunisation history",
+          "weight": 26
+        },
+        {
+          "text": "date administered",
+          "weight": 18
+        },
+        {
+          "text": "dtap",
+          "weight": 18
+        },
+        {
+          "text": "tdap",
+          "weight": 18
+        },
+        {
+          "text": "booster due",
+          "weight": 16
+        },
+        {
+          "text": "lot number",
+          "weight": 14
+        },
+        {
+          "text": "varicella",
+          "weight": 14
+        },
+        {
+          "text": "mmr",
+          "weight": 12
+        },
+        {
+          "text": "administered by",
+          "weight": 10
+        },
+        {
+          "text": "yellow fever",
+          "weight": 10
+        },
+        {
+          "text": "hepatitis b",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b(?:comirnaty|spikevax|vaxzevria|nuvaxovid|gardasil|shingrix|havrix|engerix|stamaril|typhim|daptacel|varivax|fluzone|menactra|bexsero|pentacel|infanrix)\\b",
+          "weight": 16,
+          "name": "Vaccine brand name"
+        },
+        {
+          "pattern": "\\b(?:lot|batch)\\s?(?:no\\.?|number|#)?\\s?:?\\s?[a-z0-9][a-z0-9-]{3,11}\\b",
+          "weight": 10,
+          "name": "Lot/batch number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "immuni[sz]",
+          "weight": 26,
+          "name": "immunization filename"
+        },
+        {
+          "pattern": "vaccin",
+          "weight": 24,
+          "name": "vaccine filename"
+        },
+        {
+          "pattern": "covid[-_ .]?(pass|cert|vacc|record)",
+          "weight": 20,
+          "name": "covid pass filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "immuni[sz]ation|vaccin",
+          "weight": 12,
+          "name": "vaccination in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "reference range",
+          "weight": 14,
+          "name": "lab report language"
+        },
+        {
+          "text": "explanation of benefits",
+          "weight": 14,
+          "name": "EOB language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 4
+        },
+        {
+          "signal": "form_like",
+          "weight": 4
+        },
+        {
+          "signal": "short_doc",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "medical-invoice",
+      "name": "Medical invoice",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "explanation of benefits",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "this is not a bill",
+          "weight": 30,
+          "where": "first"
+        },
+        {
+          "text": "patient responsibility",
+          "weight": 26
+        },
+        {
+          "text": "allowed amount",
+          "weight": 22
+        },
+        {
+          "text": "amount billed",
+          "weight": 20
+        },
+        {
+          "text": "plan paid",
+          "weight": 20
+        },
+        {
+          "text": "provider may bill you",
+          "weight": 18
+        },
+        {
+          "text": "coinsurance",
+          "weight": 16
+        },
+        {
+          "text": "copay",
+          "weight": 12
+        },
+        {
+          "text": "date of service",
+          "weight": 12
+        },
+        {
+          "text": "amount you owe",
+          "weight": 12
+        },
+        {
+          "text": "out-of-pocket maximum",
+          "weight": 10
+        },
+        {
+          "text": "guarantor",
+          "weight": 8
+        },
+        {
+          "text": "deductible",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bcpt\\s?(?:code)?\\s?:?\\s?\\d{5}\\b",
+          "weight": 18,
+          "name": "CPT code"
+        },
+        {
+          "pattern": "amount billed[\\s\\S]{0,40}allowed amount",
+          "weight": 16,
+          "name": "EOB amount column headers"
+        },
+        {
+          "pattern": "\\bguarantor\\s?(?:no\\.?|number|#|id)\\s?:?",
+          "weight": 16,
+          "name": "Guarantor number"
+        },
+        {
+          "pattern": "\\bclaim\\s?(?:no\\.?|number|#|id)\\s?:?\\s?[a-z0-9][a-z0-9-]{5,17}\\b",
+          "weight": 12,
+          "name": "Claim number"
+        },
+        {
+          "pattern": "\\b\\d{5}\\s?\\$\\d",
+          "weight": 12,
+          "name": "Procedure code before amount"
+        },
+        {
+          "pattern": "\\bmember id\\s?:?\\s?[a-z0-9]{6,14}\\b",
+          "weight": 10,
+          "name": "Member ID"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "explanation[-_ .]?of[-_ .]?benefits",
+          "weight": 28,
+          "name": "explanation of benefits filename"
+        },
+        {
+          "pattern": "(^|[^a-z])eob([^a-z]|$)",
+          "weight": 22,
+          "name": "eob token in filename"
+        },
+        {
+          "pattern": "(medical|hospital)[-_ .]?bill",
+          "weight": 22,
+          "name": "medical bill filename"
+        },
+        {
+          "pattern": "billing[-_ .]?statement",
+          "weight": 18,
+          "name": "billing statement filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "explanation of benefits|eob|billing statement",
+          "weight": 12,
+          "name": "EOB in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "summary of benefits and coverage",
+          "weight": 18,
+          "name": "insurance policy language"
+        },
+        {
+          "text": "reference range",
+          "weight": 16,
+          "name": "lab report language"
+        },
+        {
+          "text": "policy period",
+          "weight": 14,
+          "name": "insurance policy language"
+        },
+        {
+          "text": "kwh",
+          "weight": 14,
+          "name": "utility bill language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 9
+        },
+        {
+          "signal": "number_table",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "referral-letter",
+      "name": "Referral letter",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "referral letter",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "reason for referral",
+          "weight": 28
+        },
+        {
+          "text": "please see this patient",
+          "weight": 28
+        },
+        {
+          "text": "referring physician",
+          "weight": 26
+        },
+        {
+          "text": "i am referring",
+          "weight": 26
+        },
+        {
+          "text": "referring gp",
+          "weight": 24
+        },
+        {
+          "text": "two week wait",
+          "weight": 24
+        },
+        {
+          "text": "grateful if you would see",
+          "weight": 24
+        },
+        {
+          "text": "referring provider",
+          "weight": 22
+        },
+        {
+          "text": "urgent referral",
+          "weight": 22
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bnhs\\s?(?:no\\.?|number)\\s?:?\\s?\\d{3}\\s?\\d{3}\\s?\\d{4}\\b",
+          "weight": 10,
+          "name": "NHS number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "referral",
+          "weight": 26,
+          "name": "referral filename"
+        },
+        {
+          "pattern": "refer(red|ring)",
+          "weight": 16,
+          "name": "referred/referring filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "referral",
+          "weight": 14,
+          "name": "referral in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "letter of recommendation",
+          "weight": 22,
+          "name": "HR reference letter"
+        },
+        {
+          "text": "it is my pleasure to recommend",
+          "weight": 22,
+          "name": "HR reference letter"
+        },
+        {
+          "text": "thank you for referring",
+          "weight": 16,
+          "name": "consultant reply letter"
+        },
+        {
+          "text": "reference range",
+          "weight": 14,
+          "name": "lab report language"
+        },
+        {
+          "text": "explanation of benefits",
+          "weight": 14,
+          "name": "EOB language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "address_block",
+          "weight": 6
+        },
+        {
+          "signal": "signature_block",
+          "weight": 5
+        },
+        {
+          "signal": "short_doc",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "consent-form",
+      "name": "Consent form",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "consent form",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "informed consent",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "i have had the opportunity to ask questions",
+          "weight": 32
+        },
+        {
+          "text": "i consent to",
+          "weight": 24
+        },
+        {
+          "text": "consent to treatment",
+          "weight": 24
+        },
+        {
+          "text": "participant information sheet",
+          "weight": 24
+        },
+        {
+          "text": "person taking consent",
+          "weight": 26
+        },
+        {
+          "text": "withdraw at any time",
+          "weight": 22
+        },
+        {
+          "text": "i give my consent",
+          "weight": 22
+        },
+        {
+          "text": "please initial each box",
+          "weight": 20
+        },
+        {
+          "text": "risks and benefits",
+          "weight": 18
+        },
+        {
+          "text": "patient signature",
+          "weight": 12
+        },
+        {
+          "text": "voluntary",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "i,?\\s+the\\s+undersigned,?\\s+(?:hereby\\s+)?(?:consent|authori[sz]e)",
+          "weight": 20,
+          "name": "undersigned consent clause"
+        },
+        {
+          "pattern": "opportunity to [a-z ,]{0,50}ask questions",
+          "weight": 18,
+          "name": "opportunity to ask questions clause"
+        },
+        {
+          "pattern": "(?:free|right) to withdraw [a-z ]{0,60}at any time",
+          "weight": 18,
+          "name": "free to withdraw clause"
+        },
+        {
+          "pattern": "risks?,? (?:and\\s+)?benefits?,? and alternatives",
+          "weight": 16,
+          "name": "risks benefits alternatives triple"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "consent[-_ ]?form",
+          "weight": 28,
+          "name": "consent form filename"
+        },
+        {
+          "pattern": "informed[-_ ]?consent",
+          "weight": 26,
+          "name": "informed consent filename"
+        },
+        {
+          "pattern": "consent",
+          "weight": 18,
+          "name": "consent in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "consent",
+          "weight": 14,
+          "name": "consent in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "omb no.",
+          "weight": 20,
+          "name": "government form field"
+        },
+        {
+          "text": "paperwork reduction act",
+          "weight": 20,
+          "name": "government form language"
+        },
+        {
+          "text": "explanation of benefits",
+          "weight": 16,
+          "name": "EOB language"
+        },
+        {
+          "text": "reason for referral",
+          "weight": 14,
+          "name": "referral letter language"
+        },
+        {
+          "text": "reference range",
+          "weight": 12,
+          "name": "lab report language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 8
+        },
+        {
+          "signal": "form_like",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "discharge-summary",
+      "name": "Discharge summary",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "discharge summary",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "medications on discharge",
+          "weight": 30
+        },
+        {
+          "text": "discharge medications",
+          "weight": 26
+        },
+        {
+          "text": "discharge diagnosis",
+          "weight": 26
+        },
+        {
+          "text": "date of admission",
+          "weight": 24
+        },
+        {
+          "text": "date of discharge",
+          "weight": 24
+        },
+        {
+          "text": "follow-up arrangements",
+          "weight": 24
+        },
+        {
+          "text": "copy to gp",
+          "weight": 22
+        },
+        {
+          "text": "condition at discharge",
+          "weight": 20
+        },
+        {
+          "text": "admission date",
+          "weight": 18,
+          "where": "first"
+        },
+        {
+          "text": "discharge date",
+          "weight": 18,
+          "where": "first"
+        },
+        {
+          "text": "discharge instructions",
+          "weight": 18
+        },
+        {
+          "text": "hospital course",
+          "weight": 16
+        },
+        {
+          "text": "discharged home",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "date of admission[\\s\\S]{0,60}date of discharge",
+          "weight": 18,
+          "name": "admission/discharge date pair (UK)"
+        },
+        {
+          "pattern": "admi(?:ssion|t) date[\\s\\S]{0,60}discharge date",
+          "weight": 16,
+          "name": "admission/discharge date pair (US)"
+        },
+        {
+          "pattern": "discharged? (?:home|to home|to a (?:nursing|care) home|to rehab)",
+          "weight": 12,
+          "name": "discharge destination"
+        },
+        {
+          "pattern": "\\bnhs\\s?(?:no\\.?|number)\\s?:?\\s?\\d{3}\\s?\\d{3}\\s?\\d{4}\\b",
+          "weight": 8,
+          "name": "NHS number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "discharge[-_ ]?summary",
+          "weight": 28,
+          "name": "discharge summary filename"
+        },
+        {
+          "pattern": "discharge",
+          "weight": 20,
+          "name": "discharge in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "discharge",
+          "weight": 14,
+          "name": "discharge in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "reason for referral",
+          "weight": 22,
+          "name": "referral letter language"
+        },
+        {
+          "text": "please see this patient",
+          "weight": 20,
+          "name": "referral letter language"
+        },
+        {
+          "text": "grateful if you would see",
+          "weight": 18,
+          "name": "referral letter language"
+        },
+        {
+          "text": "thank you for referring",
+          "weight": 16,
+          "name": "clinic letter language"
+        },
+        {
+          "text": "explanation of benefits",
+          "weight": 16,
+          "name": "EOB language"
+        },
+        {
+          "text": "patient responsibility",
+          "weight": 14,
+          "name": "billing language"
+        },
+        {
+          "text": "reference range",
+          "weight": 12,
+          "name": "lab report language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "address_block",
+          "weight": 4
+        },
+        {
+          "signal": "signature_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "insurance-policy",
+      "name": "Insurance policy",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "policy wording",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "insuring agreement",
+          "weight": 30
+        },
+        {
+          "text": "declarations page",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "policy schedule",
+          "weight": 26
+        },
+        {
+          "text": "period of insurance",
+          "weight": 24
+        },
+        {
+          "text": "sum insured",
+          "weight": 22
+        },
+        {
+          "text": "limit of indemnity",
+          "weight": 22
+        },
+        {
+          "text": "contract of insurance",
+          "weight": 20
+        },
+        {
+          "text": "general exclusions",
+          "weight": 18
+        },
+        {
+          "text": "policy period",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "coverages and limits",
+          "weight": 12
+        },
+        {
+          "text": "named insured",
+          "weight": 12,
+          "where": "first"
+        },
+        {
+          "text": "underwritten by",
+          "weight": 12
+        },
+        {
+          "text": "policyholder",
+          "weight": 8
+        },
+        {
+          "text": "your policy is due for renewal",
+          "weight": 36,
+          "where": "first"
+        },
+        {
+          "text": "renewal invitation",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "renewal premium",
+          "weight": 28
+        },
+        {
+          "text": "your new premium",
+          "weight": 26
+        },
+        {
+          "text": "renewal notice",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "renewal offer",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "renewal term",
+          "weight": 18
+        },
+        {
+          "text": "insurance premium tax",
+          "weight": 16
+        },
+        {
+          "text": "no claims discount",
+          "weight": 14
+        },
+        {
+          "text": "no claims bonus",
+          "weight": 14
+        },
+        {
+          "text": "renewal date",
+          "weight": 12,
+          "where": "first"
+        },
+        {
+          "text": "continuous payment authority",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "policy\\s*(?:no|number|num|#)[.:# ]\\s*[a-z0-9][a-z0-9/-]{4,19}",
+          "flags": "gi",
+          "weight": 12,
+          "name": "Policy number"
+        },
+        {
+          "pattern": "(?:last year(?:'|’)?s|previous(?: annual)?) premium",
+          "flags": "gi",
+          "weight": 20,
+          "name": "Premium comparison"
+        },
+        {
+          "pattern": "renewal (?:date|premium)\\s*:",
+          "flags": "gi",
+          "weight": 12,
+          "name": "Renewal field with colon"
+        },
+        {
+          "pattern": "renew(?:s|ed)? automatically|auto(?:matic(?:ally)?)?[ -]?renew",
+          "flags": "gi",
+          "weight": 12,
+          "name": "Auto-renew variants"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "insurance[ _-]?policy",
+          "weight": 26,
+          "name": "insurance policy filename"
+        },
+        {
+          "pattern": "policy[ _-]?(schedule|wording|document|booklet|declarations?)",
+          "weight": 24,
+          "name": "policy document filename"
+        },
+        {
+          "pattern": "(?:^|[\\W_])ipid(?:[\\W_]|$)",
+          "weight": 18,
+          "name": "IPID filename"
+        },
+        {
+          "pattern": "(?:^|[\\W_])policy",
+          "weight": 8,
+          "name": "policy in filename"
+        },
+        {
+          "pattern": "(insurance|policy|motor|home|auto)[ _-]?renewal",
+          "weight": 26,
+          "name": "insurance renewal filename"
+        },
+        {
+          "pattern": "renewal[ _-]?(notice|invitation|offer)",
+          "weight": 26,
+          "name": "renewal notice filename"
+        },
+        {
+          "pattern": "renewal",
+          "weight": 12,
+          "name": "renewal in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "insurance policy|policy (schedule|wording|booklet|document)",
+          "weight": 12,
+          "name": "policy document title"
+        },
+        {
+          "field": "title",
+          "pattern": "renewal (notice|invitation|offer)|policy renewal",
+          "weight": 12,
+          "name": "renewal document title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "certificate of liability insurance",
+          "weight": 25,
+          "name": "COI heading"
+        },
+        {
+          "text": "certificate holder",
+          "weight": 18,
+          "name": "COI field"
+        },
+        {
+          "text": "date of loss",
+          "weight": 15,
+          "name": "claim document"
+        },
+        {
+          "text": "privacy policy",
+          "weight": 16,
+          "name": "web/ToS privacy policy"
+        },
+        {
+          "text": "limited warranty",
+          "weight": 12,
+          "name": "product warranty terms"
+        },
+        {
+          "text": "employee handbook",
+          "weight": 12,
+          "name": "HR policy handbook"
+        },
+        {
+          "text": "your subscription",
+          "weight": 18,
+          "name": "subscription renewal"
+        },
+        {
+          "text": "registration renewal",
+          "weight": 16,
+          "name": "vehicle registration renewal"
+        },
+        {
+          "text": "lease agreement",
+          "weight": 14,
+          "name": "lease renewal"
+        },
+        {
+          "text": "domain name",
+          "weight": 12,
+          "name": "domain renewal notice"
+        },
+        {
+          "text": "membership",
+          "weight": 10,
+          "name": "membership renewal"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "long_doc",
+          "weight": 5
+        },
+        {
+          "signal": "toc",
+          "weight": 3
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "insurance-certificate",
+      "name": "Insurance certificate",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "certificate of liability insurance",
+          "weight": 38,
+          "where": "title"
+        },
+        {
+          "text": "this certificate is issued as a matter of information",
+          "weight": 36,
+          "where": "first"
+        },
+        {
+          "text": "should any of the above described policies be cancelled",
+          "weight": 34
+        },
+        {
+          "text": "certificate of insurance",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "certificate holder",
+          "weight": 30
+        },
+        {
+          "text": "certificate of motor insurance",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "certificate of employers",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "certificate must be displayed",
+          "weight": 26
+        },
+        {
+          "text": "evidence of property insurance",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "commercial general liability",
+          "weight": 18
+        },
+        {
+          "text": "general aggregate",
+          "weight": 18
+        },
+        {
+          "text": "evidence of insurance",
+          "weight": 16
+        },
+        {
+          "text": "acord",
+          "weight": 14
+        },
+        {
+          "text": "additional insured",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "acord\\s*2[0-9]{1,2}",
+          "flags": "gi",
+          "weight": 22,
+          "name": "ACORD form number"
+        },
+        {
+          "pattern": "each occurrence\\s*\\$\\s*[\\d,]{7,15}",
+          "flags": "gi",
+          "weight": 18,
+          "name": "Occurrence limit amount"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "certificate[ _-]?of[ _-]?insurance",
+          "weight": 28,
+          "name": "certificate of insurance filename"
+        },
+        {
+          "pattern": "acord",
+          "weight": 25,
+          "name": "acord filename"
+        },
+        {
+          "pattern": "(?:^|[\\W_])coi(?:[\\W_]|$)",
+          "weight": 22,
+          "name": "coi abbreviation"
+        },
+        {
+          "pattern": "cert.{0,20}(insurance|liab)",
+          "weight": 20,
+          "name": "insurance certificate filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "certificate of .{0,20}insurance|acord",
+          "weight": 16,
+          "name": "certificate title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "policy wording",
+          "weight": 18,
+          "name": "full policy booklet"
+        },
+        {
+          "text": "has successfully completed",
+          "weight": 20,
+          "name": "diploma/certificate of completion"
+        },
+        {
+          "text": "certificate of completion",
+          "weight": 20,
+          "name": "course completion certificate"
+        },
+        {
+          "text": "certificate of origin",
+          "weight": 18,
+          "name": "customs/trade certificate"
+        },
+        {
+          "text": "renewal notice",
+          "weight": 12,
+          "name": "renewal document"
+        },
+        {
+          "text": "date of loss",
+          "weight": 12,
+          "name": "claim document"
+        },
+        {
+          "text": "table of contents",
+          "weight": 8,
+          "name": "long booklet"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 8
+        },
+        {
+          "signal": "form_like",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "insurance-claim",
+      "name": "Insurance claim",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "date of loss",
+          "weight": 28,
+          "where": "first"
+        },
+        {
+          "text": "proof of loss",
+          "weight": 26
+        },
+        {
+          "text": "first notice of loss",
+          "weight": 26
+        },
+        {
+          "text": "claims adjuster",
+          "weight": 24
+        },
+        {
+          "text": "loss adjuster",
+          "weight": 24
+        },
+        {
+          "text": "we have received your claim",
+          "weight": 24
+        },
+        {
+          "text": "notice of claim",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "claim reference",
+          "weight": 20,
+          "where": "first"
+        },
+        {
+          "text": "cause of loss",
+          "weight": 20
+        },
+        {
+          "text": "claim number",
+          "weight": 16,
+          "where": "first"
+        },
+        {
+          "text": "your claim has been",
+          "weight": 16
+        },
+        {
+          "text": "claim form",
+          "weight": 14,
+          "where": "title"
+        },
+        {
+          "text": "amount claimed",
+          "weight": 10
+        },
+        {
+          "text": "claimant",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "claim\\s*(?:no|number|num|ref|reference|#)[.:# ]\\s*[a-z0-9][a-z0-9/-]{3,19}",
+          "flags": "gi",
+          "weight": 15,
+          "name": "Claim number"
+        },
+        {
+          "pattern": "date of loss\\s*[:.]?\\s*\\d{1,2}[/.-]\\d{1,2}[/.-]\\d{2,4}",
+          "flags": "gi",
+          "weight": 18,
+          "name": "Date of loss field"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "insurance[ _-]?claim",
+          "weight": 26,
+          "name": "insurance claim filename"
+        },
+        {
+          "pattern": "claim[ _-]?form",
+          "weight": 22,
+          "name": "claim form filename"
+        },
+        {
+          "pattern": "(?:^|[\\W_])fnol(?:[\\W_]|$)",
+          "weight": 22,
+          "name": "first notice of loss abbreviation"
+        },
+        {
+          "pattern": "(?:^|[\\W_])claim",
+          "weight": 12,
+          "name": "claim in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "claim (form|summary|letter)|insurance claim",
+          "weight": 12,
+          "name": "claim document title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "explanation of benefits",
+          "weight": 20,
+          "name": "health EOB (medical bill)"
+        },
+        {
+          "text": "this is not a bill",
+          "weight": 15,
+          "name": "EOB boilerplate"
+        },
+        {
+          "text": "policy wording",
+          "weight": 15,
+          "name": "full policy booklet"
+        },
+        {
+          "text": "expense report",
+          "weight": 15,
+          "name": "expense claim"
+        },
+        {
+          "text": "small claims",
+          "weight": 16,
+          "name": "small claims court"
+        },
+        {
+          "pattern": "in the (county|high) court",
+          "weight": 18,
+          "name": "UK court heading"
+        },
+        {
+          "pattern": "\\bplaintiff\\b",
+          "weight": 14,
+          "name": "US court party"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "research-paper",
+      "name": "Research paper",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "abstract",
+          "weight": 8,
+          "where": "title"
+        },
+        {
+          "text": "keywords:",
+          "weight": 12,
+          "where": "first"
+        },
+        {
+          "text": "index terms",
+          "weight": 20,
+          "where": "first"
+        },
+        {
+          "text": "in this paper",
+          "weight": 16
+        },
+        {
+          "text": "we propose",
+          "weight": 8
+        },
+        {
+          "text": "et al.",
+          "weight": 8
+        },
+        {
+          "text": "related work",
+          "weight": 14
+        },
+        {
+          "text": "corresponding author",
+          "weight": 20
+        },
+        {
+          "text": "received in revised form",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "manuscript received",
+          "weight": 18,
+          "where": "first"
+        },
+        {
+          "text": "proceedings of the",
+          "weight": 14
+        },
+        {
+          "text": "contents lists available at sciencedirect",
+          "weight": 24,
+          "where": "first"
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b10\\.\\d{4,9}/[a-z0-9.()/:;_-]{4,60}",
+          "weight": 20,
+          "name": "DOI"
+        },
+        {
+          "pattern": "arxiv[:\\s]\\d{4}\\.\\d{4,5}",
+          "weight": 25,
+          "name": "arXiv identifier"
+        },
+        {
+          "pattern": "\\[\\d{1,3}(,\\s?\\d{1,3}){1,6}\\]",
+          "weight": 10,
+          "name": "Numeric citation brackets"
+        },
+        {
+          "pattern": "vol\\.\\s?\\d{1,3},\\s?no\\.\\s?\\d{1,3}",
+          "weight": 14,
+          "name": "Volume/issue line"
+        },
+        {
+          "pattern": "issn[:\\s]*\\d{4}-?\\d{3}[\\dx]",
+          "weight": 10,
+          "name": "ISSN"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "arxiv",
+          "weight": 24,
+          "name": "arxiv in filename"
+        },
+        {
+          "pattern": "\\d{4}\\.\\d{4,5}(v\\d{1,2})?\\.pdf",
+          "weight": 22,
+          "name": "arXiv id filename"
+        },
+        {
+          "pattern": "1-s2\\.0-s\\d",
+          "weight": 25,
+          "name": "Elsevier download filename"
+        },
+        {
+          "pattern": "(preprint|manuscript)",
+          "weight": 16,
+          "name": "preprint/manuscript filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "producer",
+          "pattern": "latex|pdftex|xetex|luatex",
+          "weight": 14,
+          "name": "LaTeX producer"
+        },
+        {
+          "field": "any",
+          "pattern": "elsevier|springer|ieee|arxiv",
+          "weight": 12,
+          "name": "Academic publisher"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "in partial fulfillment",
+          "weight": 22,
+          "name": "Thesis submission clause"
+        },
+        {
+          "text": "in partial fulfilment",
+          "weight": 22,
+          "name": "Thesis submission clause (UK)"
+        },
+        {
+          "text": "white paper",
+          "weight": 16,
+          "name": "Business white paper"
+        },
+        {
+          "text": "what is claimed is",
+          "weight": 20,
+          "name": "Patent claims wording"
+        },
+        {
+          "text": "this is to certify",
+          "weight": 12,
+          "name": "Certificate wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "references_section",
+          "weight": 10
+        }
+      ]
+    },
+    {
+      "id": "thesis",
+      "name": "Thesis",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "in partial fulfillment",
+          "weight": 34,
+          "where": "first"
+        },
+        {
+          "text": "in partial fulfilment",
+          "weight": 34,
+          "where": "first"
+        },
+        {
+          "text": "a thesis submitted",
+          "weight": 32,
+          "where": "first"
+        },
+        {
+          "text": "a dissertation submitted",
+          "weight": 32,
+          "where": "first"
+        },
+        {
+          "text": "submitted in accordance with the requirements",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "submitted to the faculty",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "for the degree of",
+          "weight": 18,
+          "where": "first"
+        },
+        {
+          "text": "doctor of philosophy",
+          "weight": 16,
+          "where": "first"
+        },
+        {
+          "text": "doctoral committee",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "thesis supervisor",
+          "weight": 18
+        },
+        {
+          "text": "i hereby declare that this thesis",
+          "weight": 30
+        },
+        {
+          "text": "declaration of authorship",
+          "weight": 24
+        },
+        {
+          "text": "graduate school",
+          "weight": 8
+        },
+        {
+          "text": "acknowledgements",
+          "weight": 5
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "(doctoral|ph\\.?d\\.?|master'?s|msc|bachelor'?s|undergraduate)\\s(thesis|dissertation)",
+          "weight": 22,
+          "name": "Degree-level thesis mention"
+        },
+        {
+          "pattern": "\\bchapter\\s[1-9]\\b",
+          "weight": 6,
+          "name": "Chapter headings"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(thesis|dissertation)",
+          "weight": 28,
+          "name": "thesis/dissertation filename"
+        },
+        {
+          "pattern": "phd",
+          "weight": 12,
+          "name": "phd in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "thesis|dissertation",
+          "weight": 16,
+          "name": "Thesis in Info title"
+        },
+        {
+          "field": "producer",
+          "pattern": "latex|pdftex|xetex",
+          "weight": 6,
+          "name": "LaTeX producer"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "received in revised form",
+          "weight": 15,
+          "name": "Journal article header"
+        },
+        {
+          "text": "contents lists available at",
+          "weight": 15,
+          "name": "ScienceDirect header"
+        },
+        {
+          "pattern": "isbn[:\\s]",
+          "weight": 10,
+          "name": "ISBN (book)"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "toc",
+          "weight": 9
+        },
+        {
+          "signal": "long_doc",
+          "weight": 10
+        },
+        {
+          "signal": "references_section",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "certificate",
+      "name": "Certificate",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "certificate of completion",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "certificate of achievement",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "certificate of attendance",
+          "weight": 26
+        },
+        {
+          "text": "certificate of participation",
+          "weight": 24
+        },
+        {
+          "text": "this is to certify that",
+          "weight": 32
+        },
+        {
+          "text": "has successfully completed",
+          "weight": 30
+        },
+        {
+          "text": "is hereby awarded",
+          "weight": 26
+        },
+        {
+          "text": "having satisfied the examiners",
+          "weight": 26
+        },
+        {
+          "text": "with all the rights and privileges",
+          "weight": 26
+        },
+        {
+          "text": "awarded the degree of",
+          "weight": 22
+        },
+        {
+          "text": "verify this certificate",
+          "weight": 20
+        },
+        {
+          "text": "continuing education credits",
+          "weight": 16
+        },
+        {
+          "text": "in recognition of",
+          "weight": 12
+        },
+        {
+          "text": "professional certificate",
+          "weight": 14
+        },
+        {
+          "text": "certificate of live birth",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "certificate of birth",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "certificate of marriage",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "certificate of death",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "registration district",
+          "weight": 16
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "certificate\\s(no|number|id)[.:\\s]",
+          "weight": 14,
+          "name": "Certificate number"
+        },
+        {
+          "pattern": "cpd\\s?(hours|credits|points|units)",
+          "weight": 14,
+          "name": "CPD hours"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(certificate|diploma)",
+          "weight": 22,
+          "name": "certificate/diploma filename"
+        },
+        {
+          "pattern": "(^|[^a-z])cert[_-]",
+          "weight": 14,
+          "name": "cert_ prefix"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "certificate|diploma",
+          "weight": 12,
+          "name": "Certificate in Info title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "certificate of insurance",
+          "weight": 30,
+          "name": "Insurance certificate"
+        },
+        {
+          "text": "certificate of liability",
+          "weight": 30,
+          "name": "Liability insurance certificate"
+        },
+        {
+          "text": "issued as a matter of information",
+          "weight": 30,
+          "name": "ACORD COI wording"
+        },
+        {
+          "text": "certificate of origin",
+          "weight": 22,
+          "name": "Customs certificate"
+        },
+        {
+          "text": "certificate of incorporation",
+          "weight": 24,
+          "name": "Company registration certificate"
+        },
+        {
+          "text": "certificate of analysis",
+          "weight": 20,
+          "name": "Lab/QC certificate"
+        },
+        {
+          "text": "cumulative gpa",
+          "weight": 15,
+          "name": "Transcript wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 12
+        },
+        {
+          "signal": "signature_block",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "transcript",
+      "name": "Transcript",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "official transcript",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "academic transcript",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "statement of results",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "statement of marks",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "academic record",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "cumulative gpa",
+          "weight": 26
+        },
+        {
+          "text": "semester gpa",
+          "weight": 22
+        },
+        {
+          "text": "grade point average",
+          "weight": 20
+        },
+        {
+          "text": "credits attempted",
+          "weight": 22
+        },
+        {
+          "text": "credits earned",
+          "weight": 20
+        },
+        {
+          "text": "credits awarded",
+          "weight": 18
+        },
+        {
+          "text": "office of the registrar",
+          "weight": 26
+        },
+        {
+          "text": "dean's list",
+          "weight": 16
+        },
+        {
+          "text": "credit hours",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bgpa[:\\s]+[0-4]\\.\\d{1,2}",
+          "weight": 18,
+          "name": "GPA value"
+        },
+        {
+          "pattern": "\\b[a-f][+-]?\\s\\d{1,2}\\.\\d{2}\\b",
+          "weight": 8,
+          "name": "Letter grade row"
+        },
+        {
+          "pattern": "\\b(10|15|20|30|40|60|120)\\scredits\\b",
+          "weight": 12,
+          "name": "Module credit value (UK)"
+        },
+        {
+          "pattern": "\\b\\d{1,3}(\\.\\d)?\\s?ects\\b",
+          "weight": 16,
+          "name": "ECTS credits (EU)"
+        },
+        {
+          "pattern": "\\b(fall|spring|summer|autumn|winter)\\s(semester|term)\\s20\\d{2}\\b",
+          "weight": 6,
+          "name": "Semester heading"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "transcript",
+          "weight": 22,
+          "name": "transcript filename"
+        },
+        {
+          "pattern": "academic[_ -]?record",
+          "weight": 18,
+          "name": "academic record filename"
+        },
+        {
+          "pattern": "mark[_ -]?sheet",
+          "weight": 20,
+          "name": "marksheet filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "transcript",
+          "weight": 12,
+          "name": "Transcript in Info title"
+        }
+      ],
+      "negatives": [
+        {
+          "pattern": "(court|hearing|deposition|interview)\\s?transcript",
+          "weight": 22,
+          "name": "Non-academic transcript"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "course-syllabus",
+      "name": "Course syllabus",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "course syllabus",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "syllabus",
+          "weight": 18,
+          "where": "title"
+        },
+        {
+          "text": "course outline",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "module handbook",
+          "weight": 24
+        },
+        {
+          "text": "lecture notes",
+          "weight": 24
+        },
+        {
+          "text": "learning objectives",
+          "weight": 22
+        },
+        {
+          "text": "learning outcomes",
+          "weight": 20
+        },
+        {
+          "text": "required textbook",
+          "weight": 24
+        },
+        {
+          "text": "course description",
+          "weight": 20,
+          "where": "first"
+        },
+        {
+          "text": "grading policy",
+          "weight": 20
+        },
+        {
+          "text": "office hours",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "teaching assistant",
+          "weight": 12
+        },
+        {
+          "text": "academic integrity",
+          "weight": 12
+        },
+        {
+          "text": "recommended reading",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\blecture\\s\\d{1,2}\\b",
+          "weight": 12,
+          "name": "Lecture number"
+        },
+        {
+          "pattern": "\\bweek\\s\\d{1,2}[:\\s]",
+          "weight": 8,
+          "name": "Week schedule"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "syllabus",
+          "weight": 28,
+          "name": "syllabus filename"
+        },
+        {
+          "pattern": "lecture",
+          "weight": 18,
+          "name": "lecture filename"
+        },
+        {
+          "pattern": "(week|module|unit)[_ -]?\\d{1,2}",
+          "weight": 14,
+          "name": "week/module filename"
+        },
+        {
+          "pattern": "(^|[^a-z])lec[_-]?\\d",
+          "weight": 14,
+          "name": "lecNN filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "syllabus|lecture",
+          "weight": 12,
+          "name": "Syllabus/lecture in Info title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "show your work",
+          "weight": 14,
+          "name": "Assignment wording"
+        },
+        {
+          "text": "answer all questions",
+          "weight": 14,
+          "name": "Exam/worksheet wording"
+        },
+        {
+          "pattern": "[\\[(]\\d{1,2}\\s?marks?[\\])]",
+          "weight": 12,
+          "name": "Marks brackets (worksheet)"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "bullet_heavy",
+          "weight": 4
+        },
+        {
+          "signal": "toc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "assignment-brief",
+      "name": "Assignment brief",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "show your work",
+          "weight": 28
+        },
+        {
+          "text": "show all your working",
+          "weight": 26
+        },
+        {
+          "text": "answer all questions",
+          "weight": 22
+        },
+        {
+          "text": "problem set",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "question paper",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "total marks",
+          "weight": 20
+        },
+        {
+          "text": "points possible",
+          "weight": 18
+        },
+        {
+          "text": "homework",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "worksheet",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "submit your solutions",
+          "weight": 16
+        },
+        {
+          "text": "late submissions will",
+          "weight": 14
+        },
+        {
+          "text": "total points",
+          "weight": 14
+        },
+        {
+          "text": "this assignment",
+          "weight": 10
+        },
+        {
+          "text": "due date",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "[\\[(]\\d{1,2}\\s?marks?[\\])]",
+          "weight": 20,
+          "name": "Marks brackets"
+        },
+        {
+          "pattern": "\\(\\d{1,3}\\s?(points|pts)\\)",
+          "weight": 16,
+          "name": "Points parenthetical"
+        },
+        {
+          "pattern": "(question|problem)\\s\\d{1,2}\\s?[.:(]",
+          "weight": 10,
+          "name": "Numbered questions"
+        },
+        {
+          "pattern": "candidate\\s(number|no\\.?)[:\\s]",
+          "weight": 14,
+          "name": "Exam candidate header"
+        },
+        {
+          "pattern": "due\\s(date:?\\s)?(by\\s)?(monday|tuesday|wednesday|thursday|friday|saturday|sunday)",
+          "weight": 12,
+          "name": "Due weekday"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(homework|assignment|worksheet|problem[_ -]?set|pset)",
+          "weight": 24,
+          "name": "homework/worksheet filename"
+        },
+        {
+          "pattern": "(^|[^a-z])hw[_ -]?\\d",
+          "weight": 18,
+          "name": "hwN filename"
+        },
+        {
+          "pattern": "(^|[^a-z])(quiz|midterm|exams?)[^a-z]",
+          "weight": 16,
+          "name": "quiz/exam filename"
+        },
+        {
+          "pattern": "exercise",
+          "weight": 10,
+          "name": "exercise filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "homework|assignment|worksheet",
+          "weight": 10,
+          "name": "Assignment in Info title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "invoice",
+          "weight": 18,
+          "name": "Invoice (due date confusable)"
+        },
+        {
+          "text": "amount due",
+          "weight": 16,
+          "name": "Billing wording"
+        },
+        {
+          "text": "internal revenue service",
+          "weight": 18,
+          "name": "IRS tax worksheet"
+        },
+        {
+          "pattern": "assignment\\s(of|and assumption)\\s",
+          "weight": 20,
+          "name": "Legal assignment"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 4
+        },
+        {
+          "signal": "form_like",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "grade-report",
+      "name": "Grade report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "report card",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "working towards the expected standard",
+          "weight": 30
+        },
+        {
+          "text": "working at greater depth",
+          "weight": 28
+        },
+        {
+          "text": "school report",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "end of year report",
+          "weight": 26
+        },
+        {
+          "text": "effort grade",
+          "weight": 24
+        },
+        {
+          "text": "teacher comments",
+          "weight": 20
+        },
+        {
+          "text": "teacher's comments",
+          "weight": 20
+        },
+        {
+          "text": "promoted to grade",
+          "weight": 18
+        },
+        {
+          "text": "attainment",
+          "weight": 16
+        },
+        {
+          "text": "exceeds standards",
+          "weight": 16
+        },
+        {
+          "text": "meets expectations",
+          "weight": 14
+        },
+        {
+          "text": "attendance",
+          "weight": 6
+        },
+        {
+          "text": "pupil",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "attendance\\s*:?\\s*\\d{1,3}(?:\\.\\d)?\\s*%",
+          "weight": 20,
+          "name": "attendance percentage"
+        },
+        {
+          "pattern": "(?:working towards|working at|exceeding) (?:the )?expected standard",
+          "weight": 16,
+          "name": "UK attainment band"
+        },
+        {
+          "pattern": "(?:autumn|spring|summer|fall) (?:term|trimester|semester)\\s+(?:report|20\\d{2})",
+          "weight": 14,
+          "name": "term report header"
+        },
+        {
+          "pattern": "\\b(?:wts|exs|gds)\\b",
+          "weight": 10,
+          "name": "UK attainment codes"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "report[-_ ]?card",
+          "weight": 28,
+          "name": "report card filename"
+        },
+        {
+          "pattern": "school[-_ ]?report",
+          "weight": 24,
+          "name": "school report filename"
+        },
+        {
+          "pattern": "(end[-_ ]?of[-_ ]?(year|term)|summer|autumn)[-_ ]?report",
+          "weight": 20,
+          "name": "end of year/term report filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "report card|school report",
+          "weight": 14,
+          "name": "report card in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "cumulative gpa",
+          "weight": 24,
+          "name": "transcript language"
+        },
+        {
+          "text": "office of the registrar",
+          "weight": 22,
+          "name": "transcript issuer"
+        },
+        {
+          "text": "credits attempted",
+          "weight": 20,
+          "name": "transcript language"
+        },
+        {
+          "text": "official transcript",
+          "weight": 20,
+          "name": "transcript heading"
+        },
+        {
+          "text": "grade point average",
+          "weight": 16,
+          "name": "transcript language"
+        },
+        {
+          "text": "show your work",
+          "weight": 14,
+          "name": "worksheet language"
+        },
+        {
+          "text": "credit hours",
+          "weight": 12,
+          "name": "transcript language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 5
+        },
+        {
+          "signal": "number_table",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "registration-form",
+      "name": "Registration form",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "enrollment form",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "enrolment form",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "new student enrollment",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "admission form",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "pupil details",
+          "weight": 26
+        },
+        {
+          "text": "admission application",
+          "weight": 24
+        },
+        {
+          "text": "student registration",
+          "weight": 22
+        },
+        {
+          "text": "previous school",
+          "weight": 22
+        },
+        {
+          "text": "home language survey",
+          "weight": 22
+        },
+        {
+          "text": "proof of residency",
+          "weight": 18
+        },
+        {
+          "text": "parent/carer",
+          "weight": 16
+        },
+        {
+          "text": "emergency contacts",
+          "weight": 14
+        },
+        {
+          "text": "year group",
+          "weight": 14
+        },
+        {
+          "text": "parent/guardian",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "entering grade\\s*:?\\s*(?:k|pre-k|[1-9]|1[0-2])\\b",
+          "weight": 16,
+          "name": "US entering grade field"
+        },
+        {
+          "pattern": "previous school (?:attended|or nursery)",
+          "weight": 14,
+          "name": "previous school field"
+        },
+        {
+          "pattern": "year of entry\\s*:?\\s*20\\d{2}",
+          "weight": 14,
+          "name": "year of entry field"
+        },
+        {
+          "pattern": "parent\\s*/\\s*(?:guardian|carer)",
+          "weight": 12,
+          "name": "parent/guardian slash field"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "enrol{1,2}ment",
+          "weight": 26,
+          "name": "enrollment filename"
+        },
+        {
+          "pattern": "admission[-_ ]?(form|application|pack)",
+          "weight": 24,
+          "name": "admission form filename"
+        },
+        {
+          "pattern": "registration[-_ ]?(form|packet)",
+          "weight": 18,
+          "name": "registration form filename"
+        },
+        {
+          "pattern": "new[-_ ]?student",
+          "weight": 16,
+          "name": "new student filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "enrol|admission|registration",
+          "weight": 12,
+          "name": "enrollment terms in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "omb no.",
+          "weight": 22,
+          "name": "government form field"
+        },
+        {
+          "text": "paperwork reduction act",
+          "weight": 20,
+          "name": "government form language"
+        },
+        {
+          "text": "position applied for",
+          "weight": 16,
+          "name": "job application language"
+        },
+        {
+          "text": "cumulative gpa",
+          "weight": 14,
+          "name": "transcript language"
+        },
+        {
+          "text": "official transcript",
+          "weight": 14,
+          "name": "transcript heading"
+        },
+        {
+          "text": "course syllabus",
+          "weight": 12,
+          "name": "course material heading"
+        },
+        {
+          "text": "risks and benefits",
+          "weight": 12,
+          "name": "consent form language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 8
+        },
+        {
+          "signal": "address_block",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "lesson-plan",
+      "name": "Lesson plan",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "lesson plan",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "starter activity",
+          "weight": 30
+        },
+        {
+          "text": "plenary",
+          "weight": 26
+        },
+        {
+          "text": "assessment for learning",
+          "weight": 26
+        },
+        {
+          "text": "key vocabulary",
+          "weight": 24
+        },
+        {
+          "text": "success criteria",
+          "weight": 24
+        },
+        {
+          "text": "curriculum links",
+          "weight": 24
+        },
+        {
+          "text": "differentiation",
+          "weight": 22
+        },
+        {
+          "text": "lesson objective",
+          "weight": 22
+        },
+        {
+          "text": "exit ticket",
+          "weight": 20
+        },
+        {
+          "text": "main activity",
+          "weight": 16
+        },
+        {
+          "text": "guided practice",
+          "weight": 16
+        },
+        {
+          "text": "learning objectives",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "lesson\\s+\\d{1,2}\\s+of\\s+\\d{1,2}",
+          "weight": 14,
+          "name": "lesson X of Y"
+        },
+        {
+          "pattern": "\\b(?:ks[1-4]|key stage [1-4])\\b",
+          "weight": 14,
+          "name": "UK key stage"
+        },
+        {
+          "pattern": "\\bngss\\b|common core (?:state )?standards",
+          "weight": 14,
+          "name": "US standards alignment"
+        },
+        {
+          "pattern": "\\(\\s?\\d{1,2}\\s?min(?:s|utes)?\\s?\\)",
+          "weight": 12,
+          "name": "timed activity segments"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "lesson[-_ ]?plan",
+          "weight": 30,
+          "name": "lesson plan filename"
+        },
+        {
+          "pattern": "scheme[-_ ]?of[-_ ]?work",
+          "weight": 20,
+          "name": "scheme of work filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "lesson plan",
+          "weight": 14,
+          "name": "lesson plan in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "course syllabus",
+          "weight": 22,
+          "name": "course material heading"
+        },
+        {
+          "text": "required textbook",
+          "weight": 18,
+          "name": "course material language"
+        },
+        {
+          "text": "any other business",
+          "weight": 16,
+          "name": "meeting agenda language"
+        },
+        {
+          "text": "grading policy",
+          "weight": 16,
+          "name": "course material language"
+        },
+        {
+          "text": "apologies for absence",
+          "weight": 14,
+          "name": "meeting agenda language"
+        },
+        {
+          "text": "office hours",
+          "weight": 14,
+          "name": "course material language"
+        },
+        {
+          "text": "show your work",
+          "weight": 12,
+          "name": "worksheet language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 5
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 4
+        },
+        {
+          "signal": "form_like",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "lease-agreement",
+      "name": "Lease agreement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "residential lease agreement",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "assured shorthold tenancy",
+          "weight": 32
+        },
+        {
+          "text": "tenancy agreement",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "lease agreement",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "security deposit",
+          "weight": 20
+        },
+        {
+          "text": "deposit protection",
+          "weight": 20
+        },
+        {
+          "text": "holding deposit",
+          "weight": 18
+        },
+        {
+          "text": "landlord and tenant",
+          "weight": 16
+        },
+        {
+          "text": "monthly rent",
+          "weight": 16
+        },
+        {
+          "text": "quiet enjoyment",
+          "weight": 14
+        },
+        {
+          "text": "tenant shall",
+          "weight": 12
+        },
+        {
+          "text": "lessee",
+          "weight": 12
+        },
+        {
+          "text": "the premises",
+          "weight": 6
+        },
+        {
+          "text": "sublet",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "term of (?:the |this )?(?:lease|tenancy)",
+          "weight": 18,
+          "name": "term-of-lease clause"
+        },
+        {
+          "pattern": "[$£€]\\s?\\d[\\d,]{2,9}(?:\\.\\d{2})?\\s*(?:per calendar month|per month|pcm|/month|/mo)",
+          "weight": 16,
+          "name": "rent amount per month"
+        },
+        {
+          "pattern": "deposit protection service|tenancy deposit scheme|mydeposits",
+          "weight": 16,
+          "name": "UK deposit scheme"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "rental[-_ ]?agreement",
+          "weight": 28,
+          "name": "rental agreement filename"
+        },
+        {
+          "pattern": "tenancy",
+          "weight": 26,
+          "name": "tenancy filename"
+        },
+        {
+          "pattern": "(?:^|[^a-z])lease",
+          "weight": 24,
+          "name": "lease filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "lease|tenancy",
+          "weight": 12,
+          "name": "lease in doc title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "closing disclosure",
+          "weight": 20,
+          "name": "mortgage closing doc"
+        },
+        {
+          "text": "loan estimate",
+          "weight": 18,
+          "name": "mortgage loan estimate"
+        },
+        {
+          "text": "borrower",
+          "weight": 14,
+          "name": "mortgage borrower term"
+        },
+        {
+          "text": "service charge demand",
+          "weight": 14,
+          "name": "hoa service charge demand"
+        },
+        {
+          "text": "grantor",
+          "weight": 12,
+          "name": "deed grantor term"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "mortgage-document",
+      "name": "Mortgage document",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "closing disclosure",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "loan estimate",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "mortgage offer",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "deed of trust",
+          "weight": 26
+        },
+        {
+          "text": "this security instrument",
+          "weight": 26
+        },
+        {
+          "text": "your home may be repossessed",
+          "weight": 26
+        },
+        {
+          "text": "mortgage deed",
+          "weight": 22
+        },
+        {
+          "text": "early repayment charge",
+          "weight": 20
+        },
+        {
+          "text": "escrow account",
+          "weight": 18
+        },
+        {
+          "text": "standard variable rate",
+          "weight": 18
+        },
+        {
+          "text": "promissory note",
+          "weight": 16
+        },
+        {
+          "text": "loan-to-value",
+          "weight": 16
+        },
+        {
+          "text": "amortization schedule",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "loan (?:number|no\\.?|id|#)\\s*#?\\s*:?\\s*\\d{6,12}",
+          "weight": 14,
+          "name": "loan number"
+        },
+        {
+          "pattern": "interest rate\\s*(?:of|:)?\\s*\\d{1,2}\\.\\d{1,3}\\s?%",
+          "weight": 12,
+          "name": "interest rate figure"
+        },
+        {
+          "pattern": "nmls\\s*(?:id)?\\s*#?\\s*:?\\s*\\d{4,8}",
+          "weight": 15,
+          "name": "NMLS identifier"
+        },
+        {
+          "pattern": "principal (?:and|&) interest",
+          "weight": 18,
+          "name": "principal-and-interest"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "closing[-_ ]?disclosure",
+          "weight": 30,
+          "name": "closing disclosure filename"
+        },
+        {
+          "pattern": "loan[-_ ]?estimate",
+          "weight": 28,
+          "name": "loan estimate filename"
+        },
+        {
+          "pattern": "mortgage",
+          "weight": 26,
+          "name": "mortgage filename"
+        },
+        {
+          "pattern": "deed[-_ ]?of[-_ ]?trust",
+          "weight": 26,
+          "name": "deed of trust filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "closing disclosure|loan estimate|mortgage",
+          "weight": 14,
+          "name": "mortgage doc title"
+        },
+        {
+          "field": "creator",
+          "pattern": "encompass|calyx",
+          "weight": 10,
+          "name": "loan origination software"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "minimum payment due",
+          "weight": 16,
+          "name": "credit card statement"
+        },
+        {
+          "text": "monthly rent",
+          "weight": 14,
+          "name": "lease rent term"
+        },
+        {
+          "text": "security deposit",
+          "weight": 12,
+          "name": "lease deposit term"
+        },
+        {
+          "text": "statement period",
+          "weight": 12,
+          "name": "bank statement"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 4
+        },
+        {
+          "signal": "number_table",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "deed",
+      "name": "Deed",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "warranty deed",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "quitclaim deed",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "quit claim deed",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "grant deed",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "hm land registry",
+          "weight": 28
+        },
+        {
+          "text": "grants and conveys",
+          "weight": 22
+        },
+        {
+          "text": "bargain, sell and convey",
+          "weight": 22
+        },
+        {
+          "text": "register of title",
+          "weight": 22
+        },
+        {
+          "text": "title absolute",
+          "weight": 22
+        },
+        {
+          "text": "in fee simple",
+          "weight": 20
+        },
+        {
+          "text": "grantee",
+          "weight": 18
+        },
+        {
+          "text": "county recorder",
+          "weight": 18
+        },
+        {
+          "text": "grantor",
+          "weight": 16
+        },
+        {
+          "text": "legal description",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "title number\\s*:?\\s*[a-z]{1,3}\\d{4,7}",
+          "weight": 18,
+          "name": "UK title number"
+        },
+        {
+          "pattern": "book\\s+\\d{1,6},?\\s+page\\s+\\d{1,6}",
+          "weight": 16,
+          "name": "recorder book/page"
+        },
+        {
+          "pattern": "(?:apn|parcel (?:id|no\\.?|number))\\s*[:#]?\\s*\\d[\\d-]{4,14}",
+          "weight": 14,
+          "name": "assessor parcel number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "quitclaim|warranty[-_ ]?deed",
+          "weight": 28,
+          "name": "deed type filename"
+        },
+        {
+          "pattern": "title[-_ ]?deed",
+          "weight": 26,
+          "name": "title deed filename"
+        },
+        {
+          "pattern": "land[-_ ]?registry|official[-_ ]?copy",
+          "weight": 22,
+          "name": "land registry filename"
+        },
+        {
+          "pattern": "(?:^|[^a-z])deed",
+          "weight": 20,
+          "name": "deed filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "deed|land registry",
+          "weight": 10,
+          "name": "deed in doc title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "deed of trust",
+          "weight": 20,
+          "name": "mortgage instrument"
+        },
+        {
+          "text": "last will and testament",
+          "weight": 18,
+          "name": "will document"
+        },
+        {
+          "text": "promissory note",
+          "weight": 14,
+          "name": "loan note"
+        },
+        {
+          "text": "loan estimate",
+          "weight": 14,
+          "name": "mortgage doc"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "property-listing",
+      "name": "Property listing",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "offers in excess of",
+          "weight": 26
+        },
+        {
+          "text": "guide price",
+          "weight": 24
+        },
+        {
+          "text": "council tax band",
+          "weight": 24
+        },
+        {
+          "text": "asking price",
+          "weight": 22
+        },
+        {
+          "text": "strictly by appointment",
+          "weight": 20
+        },
+        {
+          "text": "epc rating",
+          "weight": 20
+        },
+        {
+          "text": "schedule a showing",
+          "weight": 20
+        },
+        {
+          "text": "open house",
+          "weight": 16
+        },
+        {
+          "text": "estate agent",
+          "weight": 14
+        },
+        {
+          "text": "fitted kitchen",
+          "weight": 14
+        },
+        {
+          "text": "realtor",
+          "weight": 12
+        },
+        {
+          "text": "off-street parking",
+          "weight": 10
+        },
+        {
+          "text": "equal housing opportunity",
+          "weight": 8
+        },
+        {
+          "text": "sq ft",
+          "weight": 5
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "mls\\s*(?:#|no\\.?|number)?\\s*:?\\s*[a-z]?\\d{6,10}",
+          "weight": 18,
+          "name": "MLS number"
+        },
+        {
+          "pattern": "\\d\\s*(?:bed(?:room)?s?|bd)\\s*[|,•·/]?\\s*\\d(?:\\.\\d)?\\s*(?:bath(?:room)?s?|ba)\\b",
+          "weight": 16,
+          "name": "beds/baths pattern"
+        },
+        {
+          "pattern": "[\\d,]{3,6}\\s*(?:sq\\.?\\s?ft|sqft|square feet)",
+          "weight": 10,
+          "name": "square footage"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "rightmove|zoopla|zillow|redfin",
+          "weight": 26,
+          "name": "listing portal filename"
+        },
+        {
+          "pattern": "listing",
+          "weight": 20,
+          "name": "listing filename"
+        },
+        {
+          "pattern": "property[-_ ]?details|particulars",
+          "weight": 20,
+          "name": "property details filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "any",
+          "pattern": "rightmove|zoopla|zillow|redfin|matterport",
+          "weight": 14,
+          "name": "listing portal metadata"
+        },
+        {
+          "field": "title",
+          "pattern": "for sale|property details",
+          "weight": 10,
+          "name": "for-sale title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "at the time of inspection",
+          "weight": 16,
+          "name": "inspection report"
+        },
+        {
+          "text": "appraisal report",
+          "weight": 14,
+          "name": "appraisal doc"
+        },
+        {
+          "text": "security deposit",
+          "weight": 10,
+          "name": "lease term"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "address_block",
+          "weight": 5
+        },
+        {
+          "signal": "url_heavy",
+          "weight": 4
+        },
+        {
+          "signal": "short_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "inspection-report",
+      "name": "Inspection report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "home inspection report",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "property inspection report",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "homebuyer report",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "building survey",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "chartered surveyor",
+          "weight": 20
+        },
+        {
+          "text": "condition rating",
+          "weight": 18
+        },
+        {
+          "text": "recommend evaluation",
+          "weight": 18
+        },
+        {
+          "text": "gfci",
+          "weight": 16
+        },
+        {
+          "text": "roof covering",
+          "weight": 14
+        },
+        {
+          "text": "crawl space",
+          "weight": 12
+        },
+        {
+          "text": "downspouts",
+          "weight": 10
+        },
+        {
+          "text": "deficiencies",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "at the time of (?:the )?inspection",
+          "weight": 24,
+          "name": "time-of-inspection phrasing"
+        },
+        {
+          "pattern": "condition rating[:\\s]+[123]\\b",
+          "weight": 14,
+          "name": "RICS condition rating"
+        },
+        {
+          "pattern": "internachi|ashi (?:certified|member)",
+          "weight": 14,
+          "name": "inspector association"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "home[-_ ]?inspection",
+          "weight": 28,
+          "name": "home inspection filename"
+        },
+        {
+          "pattern": "homebuyer|building[-_ ]?survey",
+          "weight": 24,
+          "name": "survey report filename"
+        },
+        {
+          "pattern": "inspection",
+          "weight": 22,
+          "name": "inspection filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "creator",
+          "pattern": "spectora|homegauge|home inspector pro",
+          "weight": 12,
+          "name": "inspection software"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "safety data sheet",
+          "weight": 22,
+          "name": "SDS document"
+        },
+        {
+          "text": "reference range",
+          "weight": 14,
+          "name": "lab report"
+        },
+        {
+          "text": "asking price",
+          "weight": 12,
+          "name": "property listing"
+        },
+        {
+          "text": "certificate of insurance",
+          "weight": 12,
+          "name": "insurance cert"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "long_doc",
+          "weight": 5
+        },
+        {
+          "signal": "toc",
+          "weight": 4
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "hoa-document",
+      "name": "HOA document",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "homeowners association",
+          "weight": 26
+        },
+        {
+          "text": "homeowners' association",
+          "weight": 26
+        },
+        {
+          "text": "hoa dues",
+          "weight": 24
+        },
+        {
+          "text": "service charge demand",
+          "weight": 24
+        },
+        {
+          "text": "cc&rs",
+          "weight": 24
+        },
+        {
+          "text": "architectural review",
+          "weight": 22
+        },
+        {
+          "text": "residents association",
+          "weight": 20
+        },
+        {
+          "text": "community association",
+          "weight": 18
+        },
+        {
+          "text": "special assessment",
+          "weight": 18
+        },
+        {
+          "text": "annual assessment",
+          "weight": 16
+        },
+        {
+          "text": "ground rent",
+          "weight": 16
+        },
+        {
+          "text": "managing agent",
+          "weight": 14
+        },
+        {
+          "text": "reserve fund",
+          "weight": 12
+        },
+        {
+          "text": "common areas",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "covenants,? conditions,? (?:and|&) restrictions",
+          "weight": 22,
+          "name": "CC&R spelled out"
+        },
+        {
+          "pattern": "(?:dues|assessment)s?\\s+(?:of|are|in the amount of)\\s+[$£]",
+          "weight": 12,
+          "name": "dues amount"
+        },
+        {
+          "pattern": "\\bhoa\\b",
+          "weight": 12,
+          "name": "HOA acronym"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "hoa[-_. ]|[-_. ]hoa",
+          "weight": 24,
+          "name": "hoa filename"
+        },
+        {
+          "pattern": "homeowners",
+          "weight": 20,
+          "name": "homeowners filename"
+        },
+        {
+          "pattern": "service[-_ ]?charge",
+          "weight": 18,
+          "name": "service charge filename"
+        },
+        {
+          "pattern": "assessment[-_ ]?notice",
+          "weight": 18,
+          "name": "assessment notice filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "tenancy agreement",
+          "weight": 16,
+          "name": "lease agreement"
+        },
+        {
+          "text": "taxable value",
+          "weight": 14,
+          "name": "tax assessment notice"
+        },
+        {
+          "text": "policy number",
+          "weight": 12,
+          "name": "insurance doc"
+        },
+        {
+          "text": "invoice number",
+          "weight": 10,
+          "name": "invoice"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "address_block",
+          "weight": 4
+        },
+        {
+          "signal": "short_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "application-form",
+      "name": "Application form",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "omb no.",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "omb control number",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "paperwork reduction act",
+          "weight": 30
+        },
+        {
+          "text": "for official use only",
+          "weight": 16
+        },
+        {
+          "text": "for office use only",
+          "weight": 20
+        },
+        {
+          "text": "do not write below this line",
+          "weight": 24
+        },
+        {
+          "text": "please complete in black ink",
+          "weight": 22
+        },
+        {
+          "text": "block capitals",
+          "weight": 12
+        },
+        {
+          "text": "print or type",
+          "weight": 14
+        },
+        {
+          "text": "form approved",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "check the appropriate box",
+          "weight": 12
+        },
+        {
+          "text": "continue on a separate sheet",
+          "weight": 12
+        },
+        {
+          "text": "offence to make a false statement",
+          "weight": 18
+        },
+        {
+          "text": "national insurance number",
+          "weight": 8
+        },
+        {
+          "text": "town and country planning act",
+          "weight": 30
+        },
+        {
+          "text": "planning application",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "planning permission",
+          "weight": 26
+        },
+        {
+          "text": "board of zoning appeals",
+          "weight": 26
+        },
+        {
+          "text": "zoning variance",
+          "weight": 26
+        },
+        {
+          "text": "proposed development",
+          "weight": 22
+        },
+        {
+          "text": "building permit application",
+          "weight": 24
+        },
+        {
+          "text": "case officer",
+          "weight": 20
+        },
+        {
+          "text": "planning officer",
+          "weight": 20
+        },
+        {
+          "text": "erection of",
+          "weight": 14
+        },
+        {
+          "text": "site plan",
+          "weight": 12
+        },
+        {
+          "text": "conservation area",
+          "weight": 10
+        },
+        {
+          "text": "setback",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "omb\\s+(no\\.?|control\\s+no\\.?|control\\s+number)\\s*:?\\s*\\d{4}-\\d{4}",
+          "weight": 24,
+          "name": "OMB control number",
+          "where": "first"
+        },
+        {
+          "pattern": "\\bform\\s+[a-z]{1,4}[- ]?\\d{1,4}[a-z]?\\b",
+          "weight": 14,
+          "name": "Agency form number"
+        },
+        {
+          "pattern": "\\b(department|bureau|ministry|office) of (health|state|motor vehicles|public safety|homeland security|veterans affairs|vital statistics|revenue|labor|labour|transportation|transport|human services|social services|home affairs|the interior|consular affairs)\\b",
+          "weight": 14,
+          "name": "Government agency letterhead",
+          "where": "first"
+        },
+        {
+          "pattern": "\\(rev\\.?\\s*\\d{1,2}[\\/. -]\\d{2,4}\\)",
+          "weight": 12,
+          "name": "Form revision marker",
+          "where": "first"
+        },
+        {
+          "pattern": "application\\s+(no\\.?|number|ref(erence)?)\\s*:?\\s*\\d{2}\\/\\d{4,5}\\/[a-z]{2,6}",
+          "weight": 24,
+          "name": "UK planning reference"
+        },
+        {
+          "pattern": "(grant|refuse|approve)\\s+(full\\s+)?planning\\s+permission",
+          "weight": 22,
+          "name": "Planning decision wording"
+        },
+        {
+          "pattern": "parcel\\s+(id|number|no\\.?)",
+          "weight": 14,
+          "name": "Parcel identifier"
+        },
+        {
+          "pattern": "\\bzon(ed|ing)\\s+(district|classification)\\b",
+          "weight": 14,
+          "name": "Zoning district"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(application|registration)[-_ ]?form",
+          "weight": 18,
+          "name": "Application form filename"
+        },
+        {
+          "pattern": "\\bform[-_ ]?[a-z]{0,3}-?\\d{1,4}\\b",
+          "weight": 16,
+          "name": "Form number filename"
+        },
+        {
+          "pattern": "planning[-_ ]?(application|permission|statement|decision)",
+          "weight": 26,
+          "name": "Planning filename"
+        },
+        {
+          "pattern": "zoning|variance",
+          "weight": 20,
+          "name": "Zoning filename"
+        },
+        {
+          "pattern": "site[-_ ]?plan",
+          "weight": 16,
+          "name": "Site plan filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "producer",
+          "pattern": "livecycle",
+          "weight": 10,
+          "name": "LiveCycle form producer"
+        },
+        {
+          "field": "title",
+          "pattern": "\\bform\\b",
+          "weight": 8,
+          "name": "Form in title"
+        },
+        {
+          "field": "title",
+          "pattern": "planning (application|permission)|zoning",
+          "weight": 12,
+          "name": "Planning in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "internal revenue service",
+          "weight": 30,
+          "name": "IRS form is a tax form"
+        },
+        {
+          "text": "form 1040",
+          "weight": 20,
+          "name": "US tax return form"
+        },
+        {
+          "text": "self assessment",
+          "weight": 16,
+          "name": "HMRC tax form"
+        },
+        {
+          "text": "citizenship and immigration services",
+          "weight": 16,
+          "name": "USCIS belongs to visa-immigration"
+        },
+        {
+          "text": "universal credit",
+          "weight": 14,
+          "name": "Benefits paperwork"
+        },
+        {
+          "pattern": "\\bform w-[249]\\b|withholding (allowance|certificate)|employee's withholding",
+          "flags": "gi",
+          "weight": 22,
+          "name": "Withholding / W-form (tax-form)"
+        },
+        {
+          "text": "premises licence",
+          "weight": 20,
+          "name": "Licensing, not planning"
+        },
+        {
+          "text": "this permit must be displayed",
+          "weight": 20,
+          "name": "Issued permit certificate"
+        },
+        {
+          "text": "licensing act 2003",
+          "weight": 18,
+          "name": "Alcohol licensing"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 12
+        },
+        {
+          "signal": "address_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "government-notice",
+      "name": "Government notice",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "quote this reference",
+          "weight": 18
+        },
+        {
+          "text": "an executive agency of",
+          "weight": 26
+        },
+        {
+          "text": "on behalf of the secretary of state",
+          "weight": 28
+        },
+        {
+          "text": "penalty for private use",
+          "weight": 26
+        },
+        {
+          "text": "your national insurance number",
+          "weight": 14
+        },
+        {
+          "text": "our reference",
+          "weight": 10,
+          "where": "first"
+        },
+        {
+          "text": "your reference",
+          "weight": 8,
+          "where": "first"
+        },
+        {
+          "text": "electoral register",
+          "weight": 20
+        },
+        {
+          "text": "gov.uk",
+          "weight": 10
+        },
+        {
+          "text": "crown copyright",
+          "weight": 12
+        },
+        {
+          "text": "borough council",
+          "weight": 12
+        },
+        {
+          "text": "county council",
+          "weight": 12
+        },
+        {
+          "text": "official business",
+          "weight": 8
+        },
+        {
+          "text": "yours faithfully",
+          "weight": 5
+        },
+        {
+          "text": "freedom of information request",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "your request for information",
+          "weight": 30
+        },
+        {
+          "text": "freedom of information act 2000",
+          "weight": 28
+        },
+        {
+          "text": "records responsive to your request",
+          "weight": 28
+        },
+        {
+          "text": "duty to confirm or deny",
+          "weight": 26
+        },
+        {
+          "text": "information commissioner's office",
+          "weight": 24
+        },
+        {
+          "text": "public records request",
+          "weight": 22
+        },
+        {
+          "text": "right to an internal review",
+          "weight": 22
+        },
+        {
+          "text": "this exemption is subject to a public interest test",
+          "weight": 24
+        },
+        {
+          "text": "fee waiver",
+          "weight": 8
+        },
+        {
+          "text": "environmental information regulations",
+          "weight": 20
+        },
+        {
+          "text": "we have decided to withhold",
+          "weight": 18
+        },
+        {
+          "text": "consultation paper",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "we welcome your views",
+          "weight": 30
+        },
+        {
+          "text": "this consultation closes",
+          "weight": 30
+        },
+        {
+          "text": "consultation document",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "call for evidence",
+          "weight": 26
+        },
+        {
+          "text": "responses to this consultation",
+          "weight": 24
+        },
+        {
+          "text": "green paper",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "consultation period",
+          "weight": 20
+        },
+        {
+          "text": "have your say",
+          "weight": 20
+        },
+        {
+          "text": "how to respond",
+          "weight": 16
+        },
+        {
+          "text": "request for public comment",
+          "weight": 18
+        },
+        {
+          "text": "consultation questions",
+          "weight": 18
+        },
+        {
+          "text": "respondents",
+          "weight": 7
+        },
+        {
+          "text": "supersedes circular",
+          "weight": 32
+        },
+        {
+          "text": "this circular provides guidance",
+          "weight": 28
+        },
+        {
+          "text": "dear chief executive",
+          "weight": 28,
+          "where": "first"
+        },
+        {
+          "text": "guidance to local authorities",
+          "weight": 26
+        },
+        {
+          "text": "chief executives of local authorities",
+          "weight": 24
+        },
+        {
+          "text": "cancels and replaces",
+          "weight": 22
+        },
+        {
+          "text": "this circular",
+          "weight": 20
+        },
+        {
+          "text": "heads of executive departments and agencies",
+          "weight": 26
+        },
+        {
+          "text": "all heads of department",
+          "weight": 20
+        },
+        {
+          "text": "this directive",
+          "weight": 18
+        },
+        {
+          "text": "action required by",
+          "weight": 16
+        },
+        {
+          "text": "circular",
+          "weight": 14,
+          "where": "title"
+        },
+        {
+          "text": "with immediate effect",
+          "weight": 10
+        },
+        {
+          "text": "contract award notice",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "notice of award",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "notice of intent to award",
+          "weight": 28
+        },
+        {
+          "text": "standstill period",
+          "weight": 28
+        },
+        {
+          "text": "unsuccessful tenderers",
+          "weight": 24
+        },
+        {
+          "text": "successful tenderer",
+          "weight": 22
+        },
+        {
+          "text": "successful bidder",
+          "weight": 20
+        },
+        {
+          "text": "has been awarded to",
+          "weight": 20
+        },
+        {
+          "text": "award of contract",
+          "weight": 16
+        },
+        {
+          "text": "total value of the contract",
+          "weight": 14
+        },
+        {
+          "text": "debriefing",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "(our|your)\\s+ref(erence)?\\s*[:.]\\s*[a-z0-9][a-z0-9\\/\\-]{3,}",
+          "weight": 12,
+          "name": "Reference number field"
+        },
+        {
+          "pattern": "5\\s*u\\.?s\\.?c\\.?\\s*(§|section)?\\s*552",
+          "weight": 24,
+          "name": "5 USC 552 citation"
+        },
+        {
+          "pattern": "\\bfoia?\\b",
+          "weight": 16,
+          "name": "FOI/FOIA abbreviation"
+        },
+        {
+          "pattern": "section\\s+\\d{1,2}(\\(\\d\\))?(\\([a-z]\\))?\\s+of the freedom of information act",
+          "weight": 24,
+          "name": "FOI exemption citation"
+        },
+        {
+          "pattern": "exemption\\s+(b\\s*)?\\(?[b(]\\s*\\d\\)?",
+          "weight": 14,
+          "name": "FOIA (b) exemption"
+        },
+        {
+          "pattern": "(request|reference)\\s+(number|no\\.?)\\s*:?\\s*(foi|foia|epa|doj)[-\\s]?[a-z0-9-]{2,}",
+          "weight": 20,
+          "name": "FOI request reference"
+        },
+        {
+          "pattern": "consultation\\s+(closes|ends|period\\s+closes)\\s+(at|on)",
+          "weight": 22,
+          "name": "Consultation close date"
+        },
+        {
+          "pattern": "comments\\s+must\\s+be\\s+(received|submitted)\\s+(on\\s+or\\s+before|by|no\\s+later\\s+than)",
+          "weight": 18,
+          "name": "Comment deadline"
+        },
+        {
+          "pattern": "question\\s+\\d{1,2}\\s*[:.]\\s*(do|should|to\\s+what|how|what)",
+          "weight": 16,
+          "name": "Numbered consultation question"
+        },
+        {
+          "pattern": "circular\\s+(no\\.?\\s*)?\\d{1,3}\\/\\d{2,4}",
+          "weight": 26,
+          "name": "Circular number"
+        },
+        {
+          "pattern": "\\bomb\\s+circular\\s+(no\\.?\\s*)?a-\\d{2,3}\\b",
+          "weight": 26,
+          "name": "OMB circular"
+        },
+        {
+          "pattern": "supersedes\\s+(circular|directive|memorandum|guidance)",
+          "weight": 22,
+          "name": "Supersession line"
+        },
+        {
+          "pattern": "\\bm-\\d{2}-\\d{2}\\b",
+          "weight": 16,
+          "name": "OMB memorandum number"
+        },
+        {
+          "pattern": "ocds-[a-z0-9]{6}-[a-z0-9]{1,12}",
+          "weight": 20,
+          "name": "OCDS notice id"
+        },
+        {
+          "pattern": "unsuccessful (?:tenderers|bidders|proposers|offerors)",
+          "weight": 16,
+          "name": "Unsuccessful parties notice"
+        },
+        {
+          "pattern": "number of (?:tenders|bids|proposals) received\\s*:?\\s*\\d{1,4}",
+          "weight": 14,
+          "name": "Tender count line"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(gov|council|federal|ministry|dwp|home[-_ ]?office)[-_ ]?letter",
+          "weight": 18,
+          "name": "Government letter filename"
+        },
+        {
+          "pattern": "electoral",
+          "weight": 15,
+          "name": "Electoral correspondence filename"
+        },
+        {
+          "pattern": "foia?[-_ ]?(request|response|reply)",
+          "weight": 28,
+          "name": "FOI request/response filename"
+        },
+        {
+          "pattern": "public[-_ ]?records[-_ ]?request",
+          "weight": 24,
+          "name": "Public records request filename"
+        },
+        {
+          "pattern": "(^|[^a-z])foia?([^a-z]|$)",
+          "weight": 18,
+          "name": "FOI in filename"
+        },
+        {
+          "pattern": "consultation",
+          "weight": 26,
+          "name": "Consultation filename"
+        },
+        {
+          "pattern": "green[-_ ]?paper",
+          "weight": 22,
+          "name": "Green paper filename"
+        },
+        {
+          "pattern": "call[-_ ]?for[-_ ]?evidence",
+          "weight": 20,
+          "name": "Call for evidence filename"
+        },
+        {
+          "pattern": "circular",
+          "weight": 26,
+          "name": "Circular filename"
+        },
+        {
+          "pattern": "directive",
+          "weight": 18,
+          "name": "Directive filename"
+        },
+        {
+          "pattern": "award[-_ ]?notice|notice[-_ ]?of[-_ ]?award|intent[-_ ]?to[-_ ]?award",
+          "weight": 28,
+          "name": "Award notice filename"
+        },
+        {
+          "pattern": "contract[-_ ]?award",
+          "weight": 26,
+          "name": "Contract award filename"
+        },
+        {
+          "pattern": "\\bnoia\\b",
+          "weight": 15,
+          "name": "NOIA filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "any",
+          "pattern": "gov\\.uk",
+          "weight": 10,
+          "name": "gov.uk in metadata"
+        },
+        {
+          "field": "title",
+          "pattern": "freedom of information|foia",
+          "weight": 14,
+          "name": "FOI in PDF title"
+        },
+        {
+          "field": "title",
+          "pattern": "consultation|green paper",
+          "weight": 14,
+          "name": "Consultation in PDF title"
+        },
+        {
+          "field": "title",
+          "pattern": "circular|directive",
+          "weight": 14,
+          "name": "Circular in PDF title"
+        },
+        {
+          "field": "title",
+          "pattern": "award notice|notice of (?:intent to )?award",
+          "weight": 16,
+          "name": "Award notice in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "hm revenue",
+          "weight": 18,
+          "name": "HMRC letters are tax notices"
+        },
+        {
+          "text": "tax return",
+          "weight": 14,
+          "name": "Tax correspondence"
+        },
+        {
+          "text": "universal credit",
+          "weight": 16,
+          "name": "Benefits statement territory"
+        },
+        {
+          "text": "council tax",
+          "weight": 12,
+          "name": "Council tax bill"
+        },
+        {
+          "text": "leave to remain",
+          "weight": 16,
+          "name": "Immigration decision letter"
+        },
+        {
+          "text": "subject access request",
+          "weight": 20,
+          "name": "GDPR SAR, not FOI"
+        },
+        {
+          "text": "planning permission",
+          "weight": 12,
+          "name": "Planning application territory"
+        },
+        {
+          "text": "final rule",
+          "weight": 18,
+          "name": "Adopted regulation"
+        },
+        {
+          "text": "white paper",
+          "weight": 16,
+          "name": "White paper report"
+        },
+        {
+          "text": "minutes of the meeting",
+          "weight": 14,
+          "name": "Meeting minutes"
+        },
+        {
+          "text": "for immediate release",
+          "weight": 16,
+          "name": "Press release header"
+        },
+        {
+          "text": "apologies for absence",
+          "weight": 12,
+          "name": "Meeting minutes"
+        },
+        {
+          "text": "in witness whereof",
+          "weight": 18,
+          "name": "Contract execution language"
+        },
+        {
+          "text": "grant offer",
+          "weight": 14,
+          "name": "Grant award letter language"
+        },
+        {
+          "text": "we are pleased to submit",
+          "weight": 14,
+          "name": "Bid submission language"
+        },
+        {
+          "text": "budget period",
+          "weight": 16,
+          "name": "Grant NoA budget period"
+        },
+        {
+          "text": "selected for funding",
+          "weight": 14,
+          "name": "Grant funding decision"
+        },
+        {
+          "pattern": "\\bcfda\\b|assistance listing|2 cfr part 200",
+          "weight": 16,
+          "name": "Federal grant award markers"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "address_block",
+          "weight": 6
+        },
+        {
+          "signal": "signature_block",
+          "weight": 4
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 3
+        },
+        {
+          "signal": "url_heavy",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "visa-document",
+      "name": "Visa document",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "u.s. citizenship and immigration services",
+          "weight": 34,
+          "where": "first"
+        },
+        {
+          "text": "uscis",
+          "weight": 26
+        },
+        {
+          "text": "uk visas and immigration",
+          "weight": 28
+        },
+        {
+          "text": "petition for a nonimmigrant worker",
+          "weight": 30
+        },
+        {
+          "text": "biometric residence permit",
+          "weight": 30
+        },
+        {
+          "text": "indefinite leave to remain",
+          "weight": 32
+        },
+        {
+          "text": "leave to remain",
+          "weight": 24
+        },
+        {
+          "text": "immigration status",
+          "weight": 18
+        },
+        {
+          "text": "visa application",
+          "weight": 20
+        },
+        {
+          "text": "home office reference",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "certificate of sponsorship",
+          "weight": 24
+        },
+        {
+          "text": "alien registration number",
+          "weight": 28
+        },
+        {
+          "text": "i-94",
+          "weight": 24
+        },
+        {
+          "text": "schengen visa",
+          "weight": 26
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b(eac|wac|lin|src|msc|ioe|nbc|ysc)[-\\s]?\\d{2}[-\\s]?\\d{3}[-\\s]?\\d{5}\\b",
+          "weight": 25,
+          "name": "USCIS receipt number"
+        },
+        {
+          "pattern": "\\bform\\s+i-\\d{2,3}[a-z]?\\b",
+          "weight": 22,
+          "name": "USCIS I-series form"
+        },
+        {
+          "pattern": "\\bds-(11|82|160|260)\\b",
+          "weight": 20,
+          "name": "State Dept DS form"
+        },
+        {
+          "pattern": "\\b(h-1b|h-2a|l-1|f-1|j-1|o-1|e-2|tn)\\s+(visa|status|classification|petition)\\b",
+          "weight": 18,
+          "name": "Visa classification"
+        },
+        {
+          "pattern": "\\ba#\\s*\\d{2,3}[- ]?\\d{3}[- ]?\\d{3}\\b",
+          "weight": 18,
+          "name": "Alien number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "visa|uscis|immigration",
+          "weight": 24,
+          "name": "Visa/immigration filename"
+        },
+        {
+          "pattern": "\\bi-?(20|94|129|130|485|539|765|797)",
+          "weight": 20,
+          "name": "I-series form filename"
+        },
+        {
+          "pattern": "passport",
+          "weight": 18,
+          "name": "Passport filename"
+        },
+        {
+          "pattern": "home[-_ ]?office",
+          "weight": 16,
+          "name": "Home Office filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "visa|uscis|immigration",
+          "weight": 14,
+          "name": "Immigration title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "boarding pass",
+          "weight": 20,
+          "name": "Travel boarding pass"
+        },
+        {
+          "text": "boarding time",
+          "weight": 16,
+          "name": "Travel boarding pass"
+        },
+        {
+          "text": "itinerary",
+          "weight": 12,
+          "name": "Travel itinerary"
+        },
+        {
+          "text": "e-ticket",
+          "weight": 14,
+          "name": "Travel e-ticket"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "license",
+      "name": "License",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "licence number",
+          "weight": 14
+        },
+        {
+          "text": "license number",
+          "weight": 14
+        },
+        {
+          "text": "permit holder",
+          "weight": 22
+        },
+        {
+          "text": "is hereby licensed",
+          "weight": 26
+        },
+        {
+          "text": "is hereby authorised",
+          "weight": 14
+        },
+        {
+          "text": "is hereby authorized",
+          "weight": 14
+        },
+        {
+          "text": "this permit must be displayed",
+          "weight": 28
+        },
+        {
+          "text": "licensing authority",
+          "weight": 22
+        },
+        {
+          "text": "licensing act 2003",
+          "weight": 28
+        },
+        {
+          "text": "premises licence",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "driving licence",
+          "weight": 22
+        },
+        {
+          "text": "driver's license",
+          "weight": 10
+        },
+        {
+          "text": "subject to the following conditions",
+          "weight": 12
+        },
+        {
+          "text": "is authorized to",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "(licence|license|permit)\\s+(no\\.?|number|#)\\s*:?\\s*[a-z0-9][a-z0-9\\/\\-]{2,}",
+          "weight": 16,
+          "name": "License/permit number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "licen[cs]e|permit",
+          "weight": 20,
+          "name": "License/permit filename"
+        },
+        {
+          "pattern": "dvla",
+          "weight": 20,
+          "name": "DVLA filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "licen[cs]e|permit",
+          "weight": 12,
+          "name": "License/permit title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "end user license agreement",
+          "weight": 28,
+          "name": "Software EULA"
+        },
+        {
+          "text": "license agreement",
+          "weight": 18,
+          "name": "Software/IP contract"
+        },
+        {
+          "text": "licensor",
+          "weight": 16,
+          "name": "Licensing contract party"
+        },
+        {
+          "text": "certificate of liability insurance",
+          "weight": 20,
+          "name": "Insurance certificate"
+        },
+        {
+          "text": "has successfully completed",
+          "weight": 14,
+          "name": "Diploma/certificate wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 5
+        },
+        {
+          "signal": "signature_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "public-notice",
+      "name": "Public notice",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "the london gazette",
+          "weight": 34,
+          "where": "first"
+        },
+        {
+          "text": "official gazette",
+          "weight": 28
+        },
+        {
+          "text": "gazette notice",
+          "weight": 28
+        },
+        {
+          "text": "published by authority",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "notice of public hearing",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "public notice",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "legal advertisement",
+          "weight": 22
+        },
+        {
+          "text": "notice is hereby given",
+          "weight": 16
+        },
+        {
+          "text": "all interested persons",
+          "weight": 14
+        },
+        {
+          "text": "affidavit of publication",
+          "weight": 20
+        },
+        {
+          "text": "will hold a public hearing",
+          "weight": 18
+        },
+        {
+          "text": "notice of intent",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "gazette\\s+(issue|no\\.?|number)\\s*:?\\s*\\d+",
+          "weight": 22,
+          "name": "Gazette issue number"
+        },
+        {
+          "pattern": "notice\\s+(no\\.?|number|id)\\s*:?\\s*\\d{4,}",
+          "weight": 14,
+          "name": "Notice number"
+        },
+        {
+          "pattern": "published\\s+in\\s+the\\s+[a-z ]{3,30}\\s+(gazette|herald|tribune|times|journal)",
+          "weight": 16,
+          "name": "Publication in named paper"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "gazette",
+          "weight": 26,
+          "name": "Gazette filename"
+        },
+        {
+          "pattern": "public[-_ ]?notice",
+          "weight": 24,
+          "name": "Public notice filename"
+        },
+        {
+          "pattern": "notice[-_ ]?of[-_ ]?hearing",
+          "weight": 20,
+          "name": "Notice of hearing filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "gazette|public notice",
+          "weight": 14,
+          "name": "Gazette/notice in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "plaintiff",
+          "weight": 20,
+          "name": "Court filing party"
+        },
+        {
+          "text": "summons",
+          "weight": 18,
+          "name": "Court process document"
+        },
+        {
+          "text": "notice to quit",
+          "weight": 16,
+          "name": "Legal notice to tenant"
+        },
+        {
+          "text": "case no",
+          "weight": 14,
+          "name": "Court case number"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "analytics-report",
+      "name": "Analytics report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "statistical bulletin",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "statistical release",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "office for national statistics",
+          "weight": 30
+        },
+        {
+          "text": "bureau of labor statistics",
+          "weight": 30
+        },
+        {
+          "text": "seasonally adjusted",
+          "weight": 26
+        },
+        {
+          "text": "census bureau",
+          "weight": 24
+        },
+        {
+          "text": "quarter on quarter",
+          "weight": 22
+        },
+        {
+          "text": "national statistics",
+          "weight": 18
+        },
+        {
+          "text": "next publication date",
+          "weight": 18
+        },
+        {
+          "text": "sampling error",
+          "weight": 14
+        },
+        {
+          "text": "year on year",
+          "weight": 12
+        },
+        {
+          "text": "data tables",
+          "weight": 10
+        },
+        {
+          "text": "margin of error",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b(increased|decreased|rose|fell)\\s+(by\\s+)?\\d{1,2}(\\.\\d)?\\s?(per\\s?cent|percent|percentage\\s+points|%)",
+          "weight": 16,
+          "name": "Percent change wording"
+        },
+        {
+          "pattern": "\\bq[1-4]\\s+20\\d{2}\\b",
+          "weight": 12,
+          "name": "Quarter reference"
+        },
+        {
+          "pattern": "(three\\s+months|quarter)\\s+(to|ending)\\s+[a-z]+\\s+20\\d{2}",
+          "weight": 16,
+          "name": "Reference period"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "statistical[-_ ]?(release|bulletin)",
+          "weight": 28,
+          "name": "Statistical release filename"
+        },
+        {
+          "pattern": "(^|[^a-z])(ons|bls|cpi|gdp)([^a-z]|$)",
+          "weight": 18,
+          "name": "Stats agency/series filename"
+        },
+        {
+          "pattern": "labou?r[-_ ]?market|unemployment",
+          "weight": 16,
+          "name": "Labour market filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "any",
+          "pattern": "office for national statistics|census bureau|bureau of labor statistics",
+          "weight": 14,
+          "name": "Stats agency metadata"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "consolidated financial statements",
+          "weight": 24,
+          "name": "Company financial report"
+        },
+        {
+          "text": "earnings per share",
+          "weight": 22,
+          "name": "Company results"
+        },
+        {
+          "text": "balance sheet",
+          "weight": 18,
+          "name": "Financial statements"
+        },
+        {
+          "text": "for immediate release",
+          "weight": 16,
+          "name": "Press release header"
+        },
+        {
+          "text": "fiscal year ended",
+          "weight": 14,
+          "name": "Company reporting period"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "grant-agreement",
+      "name": "Grant agreement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "notice of award",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "federal award identification number",
+          "weight": 32
+        },
+        {
+          "text": "grant offer letter",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "period of performance",
+          "weight": 28
+        },
+        {
+          "text": "your application for funding has been successful",
+          "weight": 28
+        },
+        {
+          "text": "assistance listing number",
+          "weight": 26
+        },
+        {
+          "text": "terms and conditions of the grant",
+          "weight": 24
+        },
+        {
+          "text": "grant number",
+          "weight": 22
+        },
+        {
+          "text": "authorized organizational representative",
+          "weight": 22
+        },
+        {
+          "text": "award amount",
+          "weight": 20
+        },
+        {
+          "text": "grant agreement",
+          "weight": 14
+        },
+        {
+          "text": "match funding",
+          "weight": 12
+        },
+        {
+          "text": "drawdown",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bcfda\\s+(no\\.?|number)?\\s*:?\\s*\\d{2}\\.\\d{3}\\b",
+          "weight": 24,
+          "name": "CFDA number"
+        },
+        {
+          "pattern": "\\bfain\\b",
+          "weight": 18,
+          "name": "FAIN abbreviation"
+        },
+        {
+          "pattern": "period\\s+of\\s+performance\\s*:?\\s*\\d{1,2}\\/\\d{1,2}\\/\\d{2,4}",
+          "weight": 20,
+          "name": "Period of performance dates"
+        },
+        {
+          "pattern": "(award|grant)\\s+(no\\.?|number)\\s*:?\\s*[a-z0-9][a-z0-9\\/\\-]{4,}",
+          "weight": 16,
+          "name": "Award/grant number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "notice[-_ ]?of[-_ ]?award",
+          "weight": 28,
+          "name": "Notice of award filename"
+        },
+        {
+          "pattern": "grant[-_ ]?(award|offer|agreement|letter)",
+          "weight": 24,
+          "name": "Grant letter filename"
+        },
+        {
+          "pattern": "(^|[^a-z])noa([^a-z]|$)",
+          "weight": 15,
+          "name": "NoA abbreviation filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "notice of award|grant (offer|award)",
+          "weight": 14,
+          "name": "Award in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "scholarship",
+          "weight": 16,
+          "name": "Education scholarship award"
+        },
+        {
+          "text": "purchase order",
+          "weight": 14,
+          "name": "Procurement document"
+        },
+        {
+          "text": "invoice number",
+          "weight": 14,
+          "name": "Invoice"
+        },
+        {
+          "text": "universal credit",
+          "weight": 14,
+          "name": "Benefits statement"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 5
+        },
+        {
+          "signal": "signature_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "tender-document",
+      "name": "Tender document",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "invitation to tender",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "request for proposal",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "request for quotation",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "instructions to tenderers",
+          "weight": 26
+        },
+        {
+          "text": "instructions to bidders",
+          "weight": 22
+        },
+        {
+          "text": "pre-qualification questionnaire",
+          "weight": 24
+        },
+        {
+          "text": "most economically advantageous tender",
+          "weight": 26
+        },
+        {
+          "text": "evaluation criteria",
+          "weight": 14
+        },
+        {
+          "text": "scope of requirements",
+          "weight": 16
+        },
+        {
+          "text": "submission deadline",
+          "weight": 12
+        },
+        {
+          "text": "clarification questions",
+          "weight": 12
+        },
+        {
+          "text": "tender documents",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b(?:itt|rfp|rfq|rft)\\s*(?:no\\.?|ref(?:erence)?|#)?\\s*[:#-]?\\s*\\d{2,6}\\b",
+          "weight": 16,
+          "name": "ITT/RFP/RFQ reference number"
+        },
+        {
+          "pattern": "deadline for (?:receipt|submission) of (?:tenders|bids|proposals|quotations)",
+          "weight": 20,
+          "name": "Tender deadline line"
+        },
+        {
+          "pattern": "\\bfar\\s+(?:part\\s+\\d{1,2}|\\d{2}\\.\\d{3}(?:-\\d{1,2})?)\\b",
+          "weight": 18,
+          "name": "FAR clause/part reference"
+        },
+        {
+          "pattern": "public contracts regulations 2015|\\bpcr\\s*2015\\b|find a tender|contracts finder",
+          "weight": 18,
+          "name": "UK procurement regime"
+        },
+        {
+          "pattern": "solicitation\\s*(?:no\\.?|number|#)\\s*:?\\s*[a-z0-9][a-z0-9-]{2,18}",
+          "weight": 16,
+          "name": "Solicitation number"
+        },
+        {
+          "pattern": "sealed (?:bids|proposals|tenders)",
+          "weight": 12,
+          "name": "Sealed submissions"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "invitation[-_ ]?to[-_ ]?tender|request[-_ ]?for[-_ ]?(?:proposal|quotation|tender)s?",
+          "weight": 28,
+          "name": "ITT/RFP/RFQ filename"
+        },
+        {
+          "pattern": "\\b(?:itt|rfp|rfq|rft|pqq)\\b(?![-_ ]?(?:response|reply|submission|return))",
+          "weight": 22,
+          "name": "Solicitation acronym filename"
+        },
+        {
+          "pattern": "tender(?![-_ ]?(?:response|return|submission))",
+          "weight": 16,
+          "name": "Tender filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "invitation to tender|request for (?:proposal|quotation|tender)",
+          "weight": 16,
+          "name": "Solicitation in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "we are pleased to submit",
+          "weight": 18,
+          "name": "Bidder submission language"
+        },
+        {
+          "text": "in response to your invitation",
+          "weight": 18,
+          "name": "Bid response opener"
+        },
+        {
+          "text": "has been awarded to",
+          "weight": 14,
+          "name": "Award notice language"
+        },
+        {
+          "text": "our proposed approach",
+          "weight": 14,
+          "name": "Seller proposal language"
+        },
+        {
+          "text": "this quotation is valid",
+          "weight": 12,
+          "name": "Quote validity language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "toc",
+          "weight": 4
+        },
+        {
+          "signal": "long_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "sales-proposal",
+      "name": "Sales proposal",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "in response to your invitation",
+          "weight": 30
+        },
+        {
+          "text": "we are pleased to submit",
+          "weight": 26
+        },
+        {
+          "text": "tender response",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "compliance matrix",
+          "weight": 24
+        },
+        {
+          "text": "pricing schedule",
+          "weight": 18
+        },
+        {
+          "text": "technical response",
+          "weight": 16
+        },
+        {
+          "text": "form of tender",
+          "weight": 16
+        },
+        {
+          "text": "method statement",
+          "weight": 10
+        },
+        {
+          "text": "technical proposal",
+          "weight": 14
+        },
+        {
+          "text": "our bid",
+          "weight": 8
+        },
+        {
+          "text": "fully compliant",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "in response to (?:your |the )?(?:itt|rfp|rfq|rft|invitation to tender|request for (?:proposal|quotation|tender)s?)",
+          "weight": 22,
+          "name": "Response to solicitation"
+        },
+        {
+          "pattern": "(?:technical|cost|price|pricing) (?:proposal|volume|envelope)",
+          "weight": 12,
+          "name": "Bid volume naming"
+        },
+        {
+          "pattern": "comply\\b.{0,40}partially comply",
+          "weight": 16,
+          "name": "Compliance matrix headings"
+        },
+        {
+          "pattern": "(?:tender|bid|offer) (?:remains|is|shall remain) (?:open|valid)",
+          "weight": 12,
+          "name": "Tender validity commitment"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(?:tender|bid|rfp|itt)[-_ ]?(?:response|submission|return)",
+          "weight": 28,
+          "name": "Tender response filename"
+        },
+        {
+          "pattern": "response[-_ ]?to[-_ ]?(?:tender|rfp|itt|rfq)",
+          "weight": 26,
+          "name": "Response-to-solicitation filename"
+        },
+        {
+          "pattern": "compliance[-_ ]?matrix",
+          "weight": 18,
+          "name": "Compliance matrix filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "tender response|bid response|technical proposal",
+          "weight": 14,
+          "name": "Bid response in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "instructions to tenderers",
+          "weight": 18,
+          "name": "Buyer-side ITT language"
+        },
+        {
+          "text": "instructions to bidders",
+          "weight": 16,
+          "name": "Buyer-side solicitation language"
+        },
+        {
+          "text": "notice of award",
+          "weight": 14,
+          "name": "Award notice language"
+        },
+        {
+          "text": "purchase order number",
+          "weight": 12,
+          "name": "Purchase order language"
+        },
+        {
+          "text": "sequence of operations",
+          "weight": 14,
+          "name": "Standalone method statement (RAMS)"
+        },
+        {
+          "pattern": "\\brams\\b|risk assessment and method statement",
+          "weight": 14,
+          "name": "RAMS document markers"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "toc",
+          "weight": 3
+        },
+        {
+          "signal": "signature_block",
+          "weight": 3
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 2
+        }
+      ]
+    },
+    {
+      "id": "supply-order",
+      "name": "Supply order",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "purchase requisition",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "requisition for purchase",
+          "weight": 24
+        },
+        {
+          "text": "requisition number",
+          "weight": 24
+        },
+        {
+          "text": "justification for purchase",
+          "weight": 26
+        },
+        {
+          "text": "budget holder",
+          "weight": 22
+        },
+        {
+          "text": "requisition date",
+          "weight": 16
+        },
+        {
+          "text": "cost centre",
+          "weight": 14
+        },
+        {
+          "text": "cost center",
+          "weight": 14
+        },
+        {
+          "text": "preferred supplier",
+          "weight": 14
+        },
+        {
+          "text": "requested by",
+          "weight": 12,
+          "where": "first"
+        },
+        {
+          "text": "budget code",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\breq(?:uisition)?\\.?\\s*(?:no\\.?|number|#)\\s*:?\\s*[a-z0-9][a-z0-9/-]{1,14}",
+          "weight": 18,
+          "name": "Requisition number field"
+        },
+        {
+          "pattern": "cost cent(?:re|er)\\s*:?\\s*[a-z0-9]",
+          "weight": 12,
+          "name": "Cost centre code"
+        },
+        {
+          "pattern": "justification\\s*(?:for (?:purchase|request))?\\s*:",
+          "weight": 14,
+          "name": "Justification field"
+        },
+        {
+          "pattern": "\\bpr[-#]?\\d{4,8}\\b",
+          "weight": 12,
+          "name": "PR number reference"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "requisition",
+          "weight": 28,
+          "name": "Requisition filename"
+        },
+        {
+          "pattern": "purchase[-_ ]?req",
+          "weight": 22,
+          "name": "Purchase req filename"
+        },
+        {
+          "pattern": "\\bpr[-_]?\\d{4,8}",
+          "weight": 15,
+          "name": "PR number filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "requisition",
+          "weight": 16,
+          "name": "Requisition in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "purchase order number",
+          "weight": 20,
+          "name": "Issued PO language"
+        },
+        {
+          "text": "this purchase order",
+          "weight": 16,
+          "name": "PO document language"
+        },
+        {
+          "text": "ship to",
+          "weight": 12,
+          "name": "PO shipping field"
+        },
+        {
+          "text": "invoice number",
+          "weight": 12,
+          "name": "Invoice language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 8
+        },
+        {
+          "signal": "short_doc",
+          "weight": 5
+        },
+        {
+          "signal": "number_table",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "grant-application",
+      "name": "Grant application",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "grant application",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "application for funding",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "funding application",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "applicant organisation",
+          "weight": 24
+        },
+        {
+          "text": "applicant organization",
+          "weight": 22
+        },
+        {
+          "text": "match funding",
+          "weight": 24
+        },
+        {
+          "text": "amount requested",
+          "weight": 20
+        },
+        {
+          "text": "outcomes and milestones",
+          "weight": 20
+        },
+        {
+          "text": "matching funds",
+          "weight": 16
+        },
+        {
+          "text": "we are applying for",
+          "weight": 16
+        },
+        {
+          "text": "project summary",
+          "weight": 12
+        },
+        {
+          "text": "funding opportunity",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "(?:amount|funding|total) (?:requested|sought)\\s*:?\\s*[$£€]?\\s*[\\d.,]{1,12}",
+          "weight": 16,
+          "name": "Requested amount field"
+        },
+        {
+          "pattern": "\\bsf-?424\\b|grants\\.gov|funding opportunity (?:number|announcement|title)",
+          "weight": 22,
+          "name": "US federal grant application markers"
+        },
+        {
+          "pattern": "charity (?:no\\.?|number)\\s*:?\\s*\\d{6,8}",
+          "weight": 12,
+          "name": "UK charity number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "grant[-_ ]?application|funding[-_ ]?application|application[-_ ]?for[-_ ]?funding",
+          "weight": 28,
+          "name": "Grant application filename"
+        },
+        {
+          "pattern": "\\bsf[-_]?424",
+          "weight": 22,
+          "name": "SF-424 filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "grant application|application for funding",
+          "weight": 14,
+          "name": "Grant application in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "your application has been successful",
+          "weight": 20,
+          "name": "Funder decision language"
+        },
+        {
+          "text": "pleased to inform you",
+          "weight": 18,
+          "name": "Award letter opener"
+        },
+        {
+          "text": "terms and conditions of grant",
+          "weight": 14,
+          "name": "Grant offer conditions"
+        },
+        {
+          "text": "swot analysis",
+          "weight": 12,
+          "name": "Business plan language"
+        },
+        {
+          "text": "market analysis",
+          "weight": 10,
+          "name": "Business plan language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "technical-drawing",
+      "name": "Technical drawing",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "do not scale",
+          "weight": 30
+        },
+        {
+          "text": "angle projection",
+          "weight": 30
+        },
+        {
+          "text": "work to figured dimensions",
+          "weight": 26
+        },
+        {
+          "text": "break all sharp edges",
+          "weight": 22
+        },
+        {
+          "text": "general arrangement",
+          "weight": 18
+        },
+        {
+          "text": "drawn by",
+          "weight": 16
+        },
+        {
+          "text": "checked by",
+          "weight": 12
+        },
+        {
+          "text": "issued for construction",
+          "weight": 12
+        },
+        {
+          "text": "unless noted otherwise",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b(dwg|drg|drawing)\\s?(no\\.?|number|#)\\s?:?\\s?[a-z0-9][a-z0-9/_.-]{2,24}",
+          "flags": "gi",
+          "weight": 20,
+          "name": "drawing number"
+        },
+        {
+          "pattern": "all\\s?dimensions\\s?(are\\s?)?in\\s?(mm|millimet|inches)",
+          "flags": "gi",
+          "weight": 22,
+          "name": "dimensions in mm note"
+        },
+        {
+          "pattern": "\\bscale\\s?:?\\s?\\d{1,2}\\s?:\\s?\\d{1,4}\\b",
+          "flags": "gi",
+          "weight": 18,
+          "name": "scale ratio"
+        },
+        {
+          "pattern": "\\bsheet\\s?\\d{1,3}\\s?of\\s?\\d{1,3}\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "sheet x of y"
+        },
+        {
+          "pattern": "[ø⌀]\\s?\\d{1,3}(\\.\\d{1,2})?",
+          "flags": "gi",
+          "weight": 12,
+          "name": "diameter callout"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(^|[^a-z0-9])(dwg|drg)([^a-z0-9]|$)",
+          "weight": 20,
+          "name": "dwg abbreviation"
+        },
+        {
+          "pattern": "drawing",
+          "weight": 15,
+          "name": "drawing keyword"
+        },
+        {
+          "pattern": "general[\\s_-]?arrangement|(^|[^a-z0-9])ga[\\s_-]?plan",
+          "weight": 16,
+          "name": "ga plan filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "producer",
+          "pattern": "autocad|dwg to pdf|solidworks|revit|microstation|inventor|draftsight|bricscad",
+          "weight": 20,
+          "name": "cad producer"
+        },
+        {
+          "field": "creator",
+          "pattern": "autocad|solidworks|revit|catia|creo|archicad|tekla|vectorworks",
+          "weight": 18,
+          "name": "cad creator"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "absolute maximum ratings",
+          "weight": 22,
+          "name": "datasheet section"
+        },
+        {
+          "text": "electrical characteristics",
+          "weight": 16,
+          "name": "datasheet section"
+        },
+        {
+          "text": "safety data sheet",
+          "weight": 20,
+          "name": "sds heading"
+        },
+        {
+          "text": "inspection report",
+          "weight": 14,
+          "name": "inspection doc referencing drawings"
+        },
+        {
+          "text": "table of contents",
+          "weight": 10,
+          "name": "manual or spec toc"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "bill-of-materials",
+      "name": "Bill of materials",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "bill of quantities",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "bills of quantities",
+          "weight": 32
+        },
+        {
+          "text": "carried to collection",
+          "weight": 30
+        },
+        {
+          "text": "provisional sum",
+          "weight": 26
+        },
+        {
+          "text": "measured works",
+          "weight": 26
+        },
+        {
+          "text": "prime cost sum",
+          "weight": 24
+        },
+        {
+          "text": "preliminaries",
+          "weight": 20
+        },
+        {
+          "text": "form of tender",
+          "weight": 16
+        },
+        {
+          "text": "daywork",
+          "weight": 14
+        },
+        {
+          "text": "main summary",
+          "weight": 12
+        },
+        {
+          "text": "bill of material",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "reference designator",
+          "weight": 30
+        },
+        {
+          "text": "qty per assembly",
+          "weight": 28
+        },
+        {
+          "text": "manufacturer part number",
+          "weight": 26
+        },
+        {
+          "text": "parts list",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "top level assembly",
+          "weight": 18
+        },
+        {
+          "text": "do not populate",
+          "weight": 16
+        },
+        {
+          "text": "assembly drawing",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b(smm7|nrm\\s?[12]|cesmm\\s?\\d?)\\b",
+          "flags": "gi",
+          "weight": 22,
+          "name": "measurement standard"
+        },
+        {
+          "pattern": "description\\s+(unit\\s+)?(qty|quantity)\\s+(unit\\s+)?rate\\s+(£\\s+)?amount",
+          "flags": "gi",
+          "weight": 20,
+          "name": "boq column header"
+        },
+        {
+          "pattern": "\\bmpn\\b|mfr\\.?\\s?p/?n|mfg\\.?\\s?part\\s?(no\\.?|number)",
+          "flags": "gi",
+          "weight": 16,
+          "name": "mpn abbreviation"
+        },
+        {
+          "pattern": "\\b[rcldqu]\\d{1,3}\\s?,\\s?[rcldqu]\\d{1,3}\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "reference designator list"
+        },
+        {
+          "pattern": "\\bdnp\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "dnp marker"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(^|[^a-z0-9])boq([^a-z0-9]|$)",
+          "weight": 24,
+          "name": "boq abbreviation"
+        },
+        {
+          "pattern": "bill[\\s_-]*of[\\s_-]*quantities",
+          "weight": 26,
+          "name": "boq filename"
+        },
+        {
+          "pattern": "pricing[\\s_-]?document|tender[\\s_-]?sum",
+          "weight": 15,
+          "name": "tender pricing filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])bom([^a-z0-9]|$)",
+          "weight": 24,
+          "name": "bom abbreviation"
+        },
+        {
+          "pattern": "bill[\\s_-]*of[\\s_-]*materials?",
+          "weight": 24,
+          "name": "bom filename"
+        },
+        {
+          "pattern": "parts[\\s_-]?list",
+          "weight": 18,
+          "name": "parts list filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "packing slip",
+          "weight": 24,
+          "name": "shipping doc"
+        },
+        {
+          "text": "purchase order",
+          "weight": 14,
+          "name": "procurement doc"
+        },
+        {
+          "text": "ship to",
+          "weight": 14,
+          "name": "shipping address"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 8
+        },
+        {
+          "signal": "number_table",
+          "weight": 6
+        },
+        {
+          "signal": "long_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "safety-procedure",
+      "name": "Safety procedure",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "method statement",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "safe system of work",
+          "weight": 28
+        },
+        {
+          "text": "sequence of work",
+          "weight": 26
+        },
+        {
+          "text": "permit to work",
+          "weight": 24
+        },
+        {
+          "text": "toolbox talk",
+          "weight": 22
+        },
+        {
+          "text": "control measures",
+          "weight": 16
+        },
+        {
+          "text": "banksman",
+          "weight": 16
+        },
+        {
+          "text": "first aid arrangements",
+          "weight": 16
+        },
+        {
+          "text": "personal protective equipment",
+          "weight": 14
+        },
+        {
+          "text": "site induction",
+          "weight": 14
+        },
+        {
+          "text": "exclusion zone",
+          "weight": 12
+        },
+        {
+          "text": "standard operating procedure",
+          "weight": 30
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\brams\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "rams acronym"
+        },
+        {
+          "pattern": "(likelihood|probability)\\s?[x×*]\\s?(severity|consequence)",
+          "flags": "gi",
+          "weight": 18,
+          "name": "risk matrix formula"
+        },
+        {
+          "pattern": "\\bppe\\b",
+          "flags": "gi",
+          "weight": 10,
+          "name": "ppe acronym"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "method[\\s_-]?statement",
+          "weight": 26,
+          "name": "method statement filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])rams([^a-z0-9]|$)",
+          "weight": 20,
+          "name": "rams filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])ms[-_ ]?\\d{2,4}",
+          "weight": 15,
+          "name": "ms number filename"
+        },
+        {
+          "pattern": "standard[-_ ]?operating[-_ ]?procedure|\\bsop\\b",
+          "weight": 16,
+          "name": "SOP filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "information security",
+          "weight": 24,
+          "name": "infosec risk assessment"
+        },
+        {
+          "text": "27001",
+          "weight": 22,
+          "name": "iso 27001"
+        },
+        {
+          "text": "penetration test",
+          "weight": 18,
+          "name": "security testing doc"
+        },
+        {
+          "text": "vulnerability assessment",
+          "weight": 16,
+          "name": "infosec assessment"
+        },
+        {
+          "text": "access control policy",
+          "weight": 14,
+          "name": "security policy"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "bullet_heavy",
+          "weight": 6
+        },
+        {
+          "signal": "toc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "test-report",
+      "name": "Test report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "material test certificate",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "mill test certificate",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "heat number",
+          "weight": 30
+        },
+        {
+          "text": "mill certificate",
+          "weight": 24
+        },
+        {
+          "text": "chemical composition",
+          "weight": 24
+        },
+        {
+          "text": "test certificate",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "cast number",
+          "weight": 22
+        },
+        {
+          "text": "inspection certificate",
+          "weight": 18,
+          "where": "title"
+        },
+        {
+          "text": "tensile strength",
+          "weight": 18
+        },
+        {
+          "text": "charpy",
+          "weight": 18
+        },
+        {
+          "text": "yield strength",
+          "weight": 16
+        },
+        {
+          "text": "batch tested",
+          "weight": 16
+        },
+        {
+          "text": "elongation",
+          "weight": 10
+        },
+        {
+          "text": "calibration certificate",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "certificate of calibration",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "traceable to national standards",
+          "weight": 30
+        },
+        {
+          "text": "calibration due",
+          "weight": 26
+        },
+        {
+          "text": "measurement uncertainty",
+          "weight": 24
+        },
+        {
+          "text": "uncertainty of measurement",
+          "weight": 24
+        },
+        {
+          "text": "calibration laboratory",
+          "weight": 18
+        },
+        {
+          "text": "calibration procedure",
+          "weight": 16
+        },
+        {
+          "text": "unit under test",
+          "weight": 16
+        },
+        {
+          "text": "test equipment used",
+          "weight": 14
+        },
+        {
+          "text": "calibrated by",
+          "weight": 14
+        },
+        {
+          "text": "calibration technician",
+          "weight": 14
+        },
+        {
+          "text": "environmental conditions",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "en\\s?10204",
+          "flags": "gi",
+          "weight": 25,
+          "name": "en 10204 reference"
+        },
+        {
+          "pattern": "\\b3\\.[12]\\s?(certificate|cert)\\b|certificate\\s?(type\\s?)?3\\.[12]",
+          "flags": "gi",
+          "weight": 16,
+          "name": "type 3.1 certificate"
+        },
+        {
+          "pattern": "\\b\\d{3,4}\\s?(n/mm2|n/mm²|mpa)\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "strength units"
+        },
+        {
+          "pattern": "\\bheat\\s?no\\.?\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "heat no abbreviation"
+        },
+        {
+          "pattern": "\\bas[- ](found|left)\\b",
+          "flags": "gi",
+          "weight": 20,
+          "name": "as-found as-left"
+        },
+        {
+          "pattern": "coverage\\s?factor\\s?\\(?k\\)?\\s?=?\\s?2",
+          "flags": "gi",
+          "weight": 22,
+          "name": "coverage factor k=2"
+        },
+        {
+          "pattern": "iso\\s?/?\\s?(iec\\s?)?17025",
+          "flags": "gi",
+          "weight": 22,
+          "name": "iso 17025"
+        },
+        {
+          "pattern": "\\b(ukas|nist|npl|ptb|nabl|dakks)\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "national metrology body"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "mill[\\s_-]?(test[\\s_-]?)?cert",
+          "weight": 24,
+          "name": "mill cert filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])mtc([^a-z0-9]|$)",
+          "weight": 20,
+          "name": "mtc abbreviation"
+        },
+        {
+          "pattern": "test[\\s_-]?cert",
+          "weight": 18,
+          "name": "test cert filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])3\\.1([^a-z0-9]|$)",
+          "weight": 15,
+          "name": "3.1 in filename"
+        },
+        {
+          "pattern": "cal[\\s_-]?cert",
+          "weight": 22,
+          "name": "cal cert filename"
+        },
+        {
+          "pattern": "calibration",
+          "weight": 22,
+          "name": "calibration keyword"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])cal[-_ ]?\\d{3,}",
+          "weight": 15,
+          "name": "cal number filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "producer",
+          "pattern": "met/?cal|procal|indysoft|gagetrak",
+          "weight": 14,
+          "name": "calibration software"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "patient",
+          "weight": 24,
+          "name": "medical lab report"
+        },
+        {
+          "text": "reference range",
+          "weight": 20,
+          "name": "medical lab values"
+        },
+        {
+          "text": "sole responsibility",
+          "weight": 14,
+          "name": "declaration of conformity"
+        },
+        {
+          "text": "calibration",
+          "weight": 14,
+          "name": "calibration cert"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "quality-report",
+      "name": "Quality report",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "first article inspection",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "incoming inspection",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "dimensional inspection",
+          "weight": 26
+        },
+        {
+          "text": "final inspection",
+          "weight": 24
+        },
+        {
+          "text": "non-conformance",
+          "weight": 22
+        },
+        {
+          "text": "inspection lot",
+          "weight": 22
+        },
+        {
+          "text": "inspection report",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "sampling plan",
+          "weight": 20
+        },
+        {
+          "text": "out of tolerance",
+          "weight": 16
+        },
+        {
+          "text": "inspected by",
+          "weight": 14
+        },
+        {
+          "text": "acceptance criteria",
+          "weight": 12
+        },
+        {
+          "text": "disposition",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bncr[- ]?\\d{2,6}\\b",
+          "flags": "gi",
+          "weight": 20,
+          "name": "ncr number"
+        },
+        {
+          "pattern": "\\baql\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "aql"
+        },
+        {
+          "pattern": "nominal\\s+(actual|measured)|nominal\\s+\\d+(\\.\\d+)?\\s+measured",
+          "flags": "gi",
+          "weight": 16,
+          "name": "nominal vs actual columns"
+        },
+        {
+          "pattern": "accept(ed)?\\s?/\\s?reject(ed)?",
+          "flags": "gi",
+          "weight": 14,
+          "name": "accept reject column"
+        },
+        {
+          "pattern": "non[- ]?conform(ance|ing|ity|ities)",
+          "flags": "gi",
+          "weight": 14,
+          "name": "nonconformance variants"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(incoming|final|first[\\s_-]?article)[\\s_-]?inspection",
+          "weight": 24,
+          "name": "inspection stage filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])(fai|ncr)([^a-z0-9]|$)",
+          "weight": 18,
+          "name": "fai or ncr abbreviation"
+        },
+        {
+          "pattern": "inspection[\\s_-]?report",
+          "weight": 15,
+          "name": "inspection report filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "home inspection",
+          "weight": 28,
+          "name": "property inspection"
+        },
+        {
+          "text": "property address",
+          "weight": 18,
+          "name": "property inspection"
+        },
+        {
+          "text": "crawl space",
+          "weight": 16,
+          "name": "property inspection"
+        },
+        {
+          "text": "patient",
+          "weight": 18,
+          "name": "medical report"
+        },
+        {
+          "text": "heat number",
+          "weight": 14,
+          "name": "mill cert field"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        },
+        {
+          "signal": "form_like",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "itinerary",
+      "name": "Itinerary",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "travel itinerary",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "trip itinerary",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "flight itinerary",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "your itinerary",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "itinerary",
+          "weight": 10,
+          "where": "title"
+        },
+        {
+          "text": "trip summary",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "layover",
+          "weight": 18
+        },
+        {
+          "text": "stopover",
+          "weight": 14
+        },
+        {
+          "text": "connecting flight",
+          "weight": 14
+        },
+        {
+          "text": "outbound flight",
+          "weight": 16
+        },
+        {
+          "text": "return flight",
+          "weight": 12
+        },
+        {
+          "text": "total duration",
+          "weight": 10
+        },
+        {
+          "text": "passenger details",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\((?!USD|EUR|GBP|CHF|JPY|CAD|AUD|VAT|LLC|LTD|INC|FAQ|PDF|USA)[A-Z]{3}\\)",
+          "flags": "g",
+          "weight": 10,
+          "name": "IATA airport code in parentheses (currency/legal codes excluded)"
+        },
+        {
+          "pattern": "\\b\\d{1,2}h\\s?\\d{2}m\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "duration like 2h 45m"
+        },
+        {
+          "pattern": "(?:depart|departure)s?\\s*:?\\s*\\d{1,2}:\\d{2}",
+          "flags": "gi",
+          "weight": 14,
+          "name": "departure time field"
+        },
+        {
+          "pattern": "(?:arrive|arrival)s?\\s*:?\\s*\\d{1,2}:\\d{2}",
+          "flags": "gi",
+          "weight": 12,
+          "name": "arrival time field"
+        },
+        {
+          "pattern": "travell?er details",
+          "flags": "gi",
+          "weight": 14,
+          "name": "traveler/traveller details (US+UK)"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "itinerar",
+          "weight": 28,
+          "name": "itinerary in filename"
+        },
+        {
+          "pattern": "trip[-_ ]?(?:plan|details|summary)",
+          "weight": 20,
+          "name": "trip plan/details/summary"
+        },
+        {
+          "pattern": "travel[-_ ]?plan",
+          "weight": 18,
+          "name": "travel plan"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "itinerar",
+          "weight": 14,
+          "name": "itinerary in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "itinerary receipt",
+          "weight": 14,
+          "name": "e-ticket receipt heading"
+        },
+        {
+          "text": "fare calculation",
+          "weight": 16,
+          "name": "e-ticket fare calculation"
+        },
+        {
+          "text": "fare basis",
+          "weight": 12,
+          "name": "e-ticket fare basis"
+        },
+        {
+          "text": "boarding pass",
+          "weight": 18,
+          "name": "boarding pass heading"
+        },
+        {
+          "text": "check-out date",
+          "weight": 10,
+          "name": "hotel confirmation field"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 4
+        },
+        {
+          "signal": "short_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "ticket",
+      "name": "Ticket",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "boarding pass",
+          "weight": 36,
+          "where": "title"
+        },
+        {
+          "text": "mobile boarding pass",
+          "weight": 26
+        },
+        {
+          "text": "boarding time",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "gate closes",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "boarding group",
+          "weight": 20,
+          "where": "first"
+        },
+        {
+          "text": "boarding zone",
+          "weight": 16,
+          "where": "first"
+        },
+        {
+          "text": "boarding begins",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "gate subject to change",
+          "weight": 18
+        },
+        {
+          "text": "priority boarding",
+          "weight": 12
+        },
+        {
+          "text": "have a nice flight",
+          "weight": 14
+        },
+        {
+          "text": "gate",
+          "weight": 5,
+          "where": "first"
+        },
+        {
+          "text": "seat",
+          "weight": 4,
+          "where": "first"
+        },
+        {
+          "text": "electronic ticket receipt",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "e-ticket receipt",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "itinerary receipt",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "electronic ticket",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "e-ticket",
+          "weight": 14
+        },
+        {
+          "text": "fare basis",
+          "weight": 26
+        },
+        {
+          "text": "fare calculation",
+          "weight": 26
+        },
+        {
+          "text": "baggage allowance",
+          "weight": 18
+        },
+        {
+          "text": "not valid before",
+          "weight": 18
+        },
+        {
+          "text": "not valid after",
+          "weight": 16
+        },
+        {
+          "text": "ticket number",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "form of payment",
+          "weight": 12
+        },
+        {
+          "text": "endorsements",
+          "weight": 12
+        },
+        {
+          "text": "booking class",
+          "weight": 10
+        },
+        {
+          "text": "admit one",
+          "weight": 30
+        },
+        {
+          "text": "this ticket admits",
+          "weight": 28
+        },
+        {
+          "text": "doors open",
+          "weight": 24
+        },
+        {
+          "text": "gates open",
+          "weight": 20
+        },
+        {
+          "text": "general admission",
+          "weight": 24
+        },
+        {
+          "text": "no re-entry",
+          "weight": 24
+        },
+        {
+          "text": "valid for one admission",
+          "weight": 26
+        },
+        {
+          "text": "will call",
+          "weight": 8
+        },
+        {
+          "text": "box office",
+          "weight": 12
+        },
+        {
+          "text": "ticket holder",
+          "weight": 16
+        },
+        {
+          "text": "rain or shine",
+          "weight": 18
+        },
+        {
+          "text": "booking reference",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "seat\\s*:?\\s*\\d{1,2}[a-k]\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "seat assignment"
+        },
+        {
+          "pattern": "gate\\s*:?\\s*[a-z]?\\d{1,3}\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "gate number"
+        },
+        {
+          "pattern": "(?:flight|flt)\\s*:?\\s*[a-z]{2}\\s?\\d{1,4}\\b",
+          "flags": "gi",
+          "weight": 8,
+          "name": "flight number"
+        },
+        {
+          "pattern": "(?:pnr|record locator|booking ref(?:erence)?)\\s*:?\\s*[a-z0-9]{5,7}\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "record locator (PNR)"
+        },
+        {
+          "pattern": "(?:ticket|tkt)\\s*(?:number|no\\.?|#|nbr)?\\s*:?\\s*\\d{3}[- ]?\\d{10}",
+          "flags": "gi",
+          "weight": 22,
+          "name": "ticket number field with 13 digits"
+        },
+        {
+          "pattern": "\\b\\d{3}[- ]?\\d{10}\\b",
+          "flags": "g",
+          "weight": 12,
+          "name": "13-digit ticket number"
+        },
+        {
+          "pattern": "\\b(?:etkt|e-tkt)\\b",
+          "flags": "gi",
+          "weight": 18,
+          "name": "ETKT marker"
+        },
+        {
+          "pattern": "\\bnuc\\s?\\d{1,6}(?:\\.\\d{1,2})?\\b",
+          "flags": "gi",
+          "weight": 18,
+          "name": "NUC amount in fare calculation"
+        },
+        {
+          "pattern": "sec(tion)?\\W{0,4}[a-z0-9]{1,6}\\W{1,12}row\\W{0,4}[a-z0-9]{1,4}\\W{1,12}seats?\\W{0,4}[a-z0-9]{1,4}",
+          "flags": "gi",
+          "weight": 22,
+          "name": "Section/Row/Seat block"
+        },
+        {
+          "pattern": "\\brow [a-z0-9]{1,3}\\W{1,10}seats? [a-z0-9]{1,3}\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "Row/Seat pair"
+        },
+        {
+          "pattern": "doors:? ?\\d{1,2}[:.]\\d{2} ?(am|pm)?",
+          "flags": "gi",
+          "weight": 16,
+          "name": "Doors time"
+        },
+        {
+          "pattern": "print[\\- ]at[\\- ]home",
+          "flags": "gi",
+          "weight": 18,
+          "name": "Print-at-home ticket"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "boarding",
+          "weight": 26,
+          "name": "boarding in filename"
+        },
+        {
+          "pattern": "e[-_]?ticket|etkt",
+          "weight": 28,
+          "name": "e-ticket filename"
+        },
+        {
+          "pattern": "ticket[-_ ]?receipt",
+          "weight": 22,
+          "name": "ticket receipt filename"
+        },
+        {
+          "pattern": "ticket",
+          "weight": 18,
+          "name": "Ticket in filename"
+        },
+        {
+          "pattern": "ticketmaster|eventbrite|axs|seetickets|dice[_\\- ]",
+          "weight": 26,
+          "name": "Ticketing platform in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "boarding",
+          "weight": 16,
+          "name": "boarding in PDF title"
+        },
+        {
+          "field": "title",
+          "pattern": "e-?ticket|electronic ticket|itinerary receipt",
+          "weight": 16,
+          "name": "e-ticket in PDF title"
+        },
+        {
+          "field": "any",
+          "pattern": "amadeus|sabre|travelport|galileo",
+          "weight": 8,
+          "name": "GDS software in metadata"
+        },
+        {
+          "field": "any",
+          "pattern": "ticketmaster|eventbrite|axs tickets|see tickets",
+          "weight": 15,
+          "name": "Ticketing platform metadata"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "check-out date",
+          "weight": 12,
+          "name": "hotel confirmation field"
+        },
+        {
+          "text": "invoice",
+          "weight": 10,
+          "name": "invoice wording"
+        },
+        {
+          "text": "room type",
+          "weight": 12,
+          "name": "hotel confirmation field"
+        },
+        {
+          "text": "flight",
+          "weight": 12,
+          "name": "Flight (travel)"
+        },
+        {
+          "text": "itinerary",
+          "weight": 15,
+          "name": "Itinerary (travel)"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 10
+        },
+        {
+          "signal": "form_like",
+          "weight": 3
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "booking-confirmation",
+      "name": "Booking confirmation",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "booking confirmation",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "reservation confirmation",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "your booking is confirmed",
+          "weight": 30,
+          "where": "first"
+        },
+        {
+          "text": "your reservation is confirmed",
+          "weight": 28,
+          "where": "first"
+        },
+        {
+          "text": "confirmation number",
+          "weight": 16,
+          "where": "first"
+        },
+        {
+          "text": "check-in date",
+          "weight": 22
+        },
+        {
+          "text": "check-out date",
+          "weight": 24
+        },
+        {
+          "text": "room type",
+          "weight": 20
+        },
+        {
+          "text": "number of guests",
+          "weight": 18
+        },
+        {
+          "text": "cancellation policy",
+          "weight": 14
+        },
+        {
+          "text": "we look forward to welcoming you",
+          "weight": 22
+        },
+        {
+          "text": "booking reference",
+          "weight": 8,
+          "where": "first"
+        },
+        {
+          "text": "pick-up date",
+          "weight": 10
+        },
+        {
+          "text": "drop-off date",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "check[- ]?in\\s*:?\\s*(?:mon|tue|wed|thu|fri|sat|sun|\\d{1,2}[/.-])",
+          "flags": "gi",
+          "weight": 14,
+          "name": "check-in date field"
+        },
+        {
+          "pattern": "check[- ]?out\\s*:?\\s*(?:mon|tue|wed|thu|fri|sat|sun|\\d{1,2}[/.-])",
+          "flags": "gi",
+          "weight": 14,
+          "name": "check-out date field"
+        },
+        {
+          "pattern": "confirmation\\s*(?:number|no\\.?|code|#)\\s*:?\\s*[a-z0-9.-]{5,20}",
+          "flags": "gi",
+          "weight": 14,
+          "name": "confirmation number field"
+        },
+        {
+          "pattern": "\\b\\d{1,3}\\s+nights?\\b",
+          "flags": "gi",
+          "weight": 8,
+          "name": "nights count"
+        },
+        {
+          "pattern": "\\b\\d{1,2}\\s+(?:adults?|guests?)\\b",
+          "flags": "gi",
+          "weight": 10,
+          "name": "guest count"
+        },
+        {
+          "pattern": "(?:pick[- ]?up|drop[- ]?off)\\s*(?:date|time|location)\\s*:?",
+          "flags": "gi",
+          "weight": 12,
+          "name": "pick-up/drop-off field (car rental)"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "booking[-_ ]?confirmation",
+          "weight": 30,
+          "name": "booking confirmation filename"
+        },
+        {
+          "pattern": "confirmation",
+          "weight": 16,
+          "name": "confirmation in filename"
+        },
+        {
+          "pattern": "hotel|reservation|booking",
+          "weight": 16,
+          "name": "hotel/reservation/booking in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "booking|reservation|confirmation",
+          "weight": 12,
+          "name": "booking in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "boarding pass",
+          "weight": 18,
+          "name": "boarding pass heading"
+        },
+        {
+          "text": "boarding time",
+          "weight": 16,
+          "name": "boarding pass field"
+        },
+        {
+          "text": "fare basis",
+          "weight": 14,
+          "name": "e-ticket fare basis"
+        },
+        {
+          "text": "security deposit",
+          "weight": 14,
+          "name": "lease agreement wording"
+        },
+        {
+          "text": "order confirmation",
+          "weight": 16,
+          "name": "retail order confirmation heading"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "address_block",
+          "weight": 5
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 3
+        },
+        {
+          "signal": "short_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "utility-bill",
+      "name": "Utility bill",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "meter reading",
+          "weight": 24
+        },
+        {
+          "text": "standing charge",
+          "weight": 26
+        },
+        {
+          "text": "kwh",
+          "weight": 12
+        },
+        {
+          "text": "per kwh",
+          "weight": 16
+        },
+        {
+          "text": "billing period",
+          "weight": 6,
+          "where": "first"
+        },
+        {
+          "text": "supply address",
+          "weight": 20,
+          "where": "first"
+        },
+        {
+          "text": "estimated reading",
+          "weight": 20
+        },
+        {
+          "text": "energy statement",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "energy bill",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "gas and electricity",
+          "weight": 20
+        },
+        {
+          "text": "meter number",
+          "weight": 18
+        },
+        {
+          "text": "water and sewer",
+          "weight": 18
+        },
+        {
+          "text": "unit rate",
+          "weight": 16
+        },
+        {
+          "text": "average daily usage",
+          "weight": 14
+        },
+        {
+          "text": "line rental",
+          "weight": 26
+        },
+        {
+          "text": "call charges",
+          "weight": 20
+        },
+        {
+          "text": "data usage",
+          "weight": 16
+        },
+        {
+          "text": "roaming charges",
+          "weight": 22
+        },
+        {
+          "text": "plan charge",
+          "weight": 16
+        },
+        {
+          "text": "unlimited data",
+          "weight": 14
+        },
+        {
+          "text": "itemised calls",
+          "weight": 24
+        },
+        {
+          "text": "itemized calls",
+          "weight": 24
+        },
+        {
+          "text": "minutes used",
+          "weight": 16
+        },
+        {
+          "text": "governmental surcharges",
+          "weight": 20
+        },
+        {
+          "text": "data allowance",
+          "weight": 16
+        },
+        {
+          "text": "broadband",
+          "weight": 10
+        },
+        {
+          "text": "mobile number",
+          "weight": 10,
+          "where": "first"
+        },
+        {
+          "text": "airtime",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b\\d[\\d,]{0,6}(\\.\\d{1,3})?\\s*kwh\\b",
+          "flags": "gi",
+          "weight": 15,
+          "name": "kWh amount"
+        },
+        {
+          "pattern": "(previous|present|current)\\s+reading",
+          "flags": "gi",
+          "weight": 12,
+          "name": "meter reading row"
+        },
+        {
+          "pattern": "\\bmp[ar]n\\b",
+          "flags": "gi",
+          "weight": 20,
+          "name": "UK meter point number (MPAN/MPRN)"
+        },
+        {
+          "pattern": "\\b\\d{1,6}\\s*(ccf|hcf|therms)\\b",
+          "flags": "gi",
+          "weight": 13,
+          "name": "gas/water volume units"
+        },
+        {
+          "pattern": "electric(ity)?\\s+charges",
+          "flags": "gi",
+          "weight": 16,
+          "name": "electric/electricity charges heading"
+        },
+        {
+          "pattern": "\\b\\d{1,4}(\\.\\d{1,2})?\\s*gb\\s+(of\\s+)?data\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "data allowance in GB"
+        },
+        {
+          "pattern": "\\bused\\s+\\d{1,4}(\\.\\d{1,2})?\\s*gb\\b",
+          "flags": "gi",
+          "weight": 13,
+          "name": "GB used"
+        },
+        {
+          "pattern": "\\b\\d{1,4}\\s*(minutes|mins)\\s+(used|included|remaining)\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "minutes usage"
+        },
+        {
+          "pattern": "talk,?\\s*text\\s*(and|&)\\s*data",
+          "flags": "gi",
+          "weight": 12,
+          "name": "talk text and data"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(electric|gas|water|energy|utility|utilities|power)[-_ ]?(bill|statement)",
+          "weight": 25,
+          "name": "utility bill filename"
+        },
+        {
+          "pattern": "(british[-_ ]?gas|octopus[-_ ]?energy|thames[-_ ]?water|scottish[-_ ]?power|national[-_ ]?grid|duke[-_ ]?energy|con[-_ ]?edison)",
+          "weight": 18,
+          "name": "utility provider filename"
+        },
+        {
+          "pattern": "(pg&e|pacific[-_ ]?gas|eon[-_ ]?next|e\\.on|sse[-_ ]?energy|edf[-_ ]?energy|severn[-_ ]?trent|united[-_ ]?utilities|american[-_ ]?water|centerpoint[-_ ]?energy)",
+          "weight": 18,
+          "name": "utility provider filename (extended)"
+        },
+        {
+          "pattern": "(phone|mobile|broadband|wireless|telecom|cell)[-_ ]?(bill|statement|invoice)",
+          "weight": 25,
+          "name": "telecom bill filename"
+        },
+        {
+          "pattern": "(verizon|vodafone|t-?mobile|at&t|xfinity|comcast|spectrum[-_ ]?bill|virgin[-_ ]?media|o2[-_ ]?bill|ee[-_ ]?bill|sky[-_ ]?bill|three[-_ ]?bill|giffgaff|mint[-_ ]?mobile)",
+          "weight": 18,
+          "name": "telecom provider filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "(energy|electricity|gas|water|utility)\\s*(bill|statement)",
+          "weight": 14,
+          "name": "utility bill title"
+        },
+        {
+          "field": "author",
+          "pattern": "(british gas|octopus energy|edf energy|e\\.on|duke energy|con edison|national grid|thames water|pacific gas)",
+          "weight": 12,
+          "name": "utility provider author"
+        },
+        {
+          "field": "title",
+          "pattern": "(phone|mobile|wireless|broadband|telecom)\\s*(bill|statement)",
+          "weight": 14,
+          "name": "telecom bill title"
+        },
+        {
+          "field": "author",
+          "pattern": "(verizon|vodafone|at&t|t-mobile|comcast|xfinity|virgin media|bt group)",
+          "weight": 12,
+          "name": "telecom provider author"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "patient",
+          "weight": 14,
+          "name": "medical bill vocabulary"
+        },
+        {
+          "text": "policy number",
+          "weight": 12,
+          "name": "insurance vocabulary"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 4
+        },
+        {
+          "signal": "number_table",
+          "weight": 5
+        },
+        {
+          "signal": "address_block",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "subscription-confirmation",
+      "name": "Subscription confirmation",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "next billing date",
+          "weight": 28
+        },
+        {
+          "text": "subscription renewal",
+          "weight": 26
+        },
+        {
+          "text": "your subscription",
+          "weight": 22
+        },
+        {
+          "text": "manage your subscription",
+          "weight": 26
+        },
+        {
+          "text": "renews on",
+          "weight": 20
+        },
+        {
+          "text": "will automatically renew",
+          "weight": 26
+        },
+        {
+          "text": "renews automatically",
+          "weight": 22
+        },
+        {
+          "text": "unless you cancel",
+          "weight": 16
+        },
+        {
+          "text": "thank you for subscribing",
+          "weight": 24
+        },
+        {
+          "text": "your receipt from apple",
+          "weight": 32
+        },
+        {
+          "text": "google play",
+          "weight": 10
+        },
+        {
+          "text": "free trial",
+          "weight": 8
+        },
+        {
+          "text": "cancel anytime",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "(monthly|annual|yearly)\\s+(subscription|membership|plan)",
+          "flags": "gi",
+          "weight": 14,
+          "name": "plan cadence"
+        },
+        {
+          "pattern": "next\\s+(billing|payment|renewal)\\s+date",
+          "flags": "gi",
+          "weight": 15,
+          "name": "next billing/payment date field"
+        },
+        {
+          "pattern": "subscription\\s+(fee|charge|period)",
+          "flags": "gi",
+          "weight": 12,
+          "name": "subscription fee/charge/period"
+        },
+        {
+          "pattern": "billed\\s+(monthly|annually|yearly)",
+          "flags": "gi",
+          "weight": 16,
+          "name": "billed monthly/annually"
+        },
+        {
+          "pattern": "auto[- ]?renew(al|s|ing)?",
+          "flags": "gi",
+          "weight": 14,
+          "name": "auto-renew variants"
+        },
+        {
+          "pattern": "(cancel|manage)\\s+your\\s+(subscription|membership|plan)",
+          "flags": "gi",
+          "weight": 15,
+          "name": "cancel/manage your subscription"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "subscription",
+          "weight": 20,
+          "name": "subscription filename"
+        },
+        {
+          "pattern": "(netflix|spotify|patreon|hulu|audible|crunchyroll|disney[-_ ]?plus|disneyplus)",
+          "weight": 18,
+          "name": "subscription service filename"
+        },
+        {
+          "pattern": "(adobe|dropbox|icloud)[-_ ]?(receipt|invoice|renewal|subscription)",
+          "weight": 20,
+          "name": "software subscription receipt filename"
+        },
+        {
+          "pattern": "(apple|itunes|google[-_ ]?play|app[-_ ]?store)[-_ ]?(receipt|invoice|order)",
+          "weight": 20,
+          "name": "app store receipt filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "subscription",
+          "weight": 12,
+          "name": "subscription title"
+        },
+        {
+          "field": "author",
+          "pattern": "(stripe|paddle|recurly|chargebee|fastspring)",
+          "weight": 10,
+          "name": "billing platform author"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "policy number",
+          "weight": 15,
+          "name": "insurance renewal"
+        },
+        {
+          "text": "insured",
+          "weight": 12,
+          "name": "insurance vocabulary"
+        },
+        {
+          "text": "kwh",
+          "weight": 10,
+          "name": "utility usage"
+        },
+        {
+          "text": "minutes used",
+          "weight": 10,
+          "name": "telecom usage"
+        },
+        {
+          "text": "roaming",
+          "weight": 10,
+          "name": "telecom roaming"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "waybill",
+      "name": "Waybill",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "shipping label",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "ship from",
+          "weight": 12,
+          "where": "first"
+        },
+        {
+          "text": "tracking number",
+          "weight": 8
+        },
+        {
+          "text": "tracking #",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "usps priority mail",
+          "weight": 22
+        },
+        {
+          "text": "usps ground advantage",
+          "weight": 26
+        },
+        {
+          "text": "ups ground",
+          "weight": 12
+        },
+        {
+          "text": "fedex ground",
+          "weight": 12
+        },
+        {
+          "text": "billing: p/p",
+          "weight": 22
+        },
+        {
+          "text": "postage paid",
+          "weight": 14
+        },
+        {
+          "text": "royal mail tracked",
+          "weight": 24
+        },
+        {
+          "text": "tracked 48",
+          "weight": 18
+        },
+        {
+          "text": "tracked 24",
+          "weight": 18
+        },
+        {
+          "text": "fold here",
+          "weight": 16
+        },
+        {
+          "text": "bill of lading",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "air waybill",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "waybill",
+          "weight": 22,
+          "where": "title"
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b1z[\\s-]?[0-9a-z]{3}[\\s-]?[0-9a-z]{3}[\\s-]?[0-9a-z]{2}[\\s-]?[0-9a-z]{4}[\\s-]?[0-9a-z]{4}\\b",
+          "weight": 24,
+          "name": "UPS tracking number"
+        },
+        {
+          "pattern": "\\b9[1-5]\\d{2}[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}[\\s-]?\\d{4}(?:[\\s-]?\\d{2})?\\b",
+          "weight": 20,
+          "name": "USPS tracking number"
+        },
+        {
+          "pattern": "\\b[a-z]{2}\\s?\\d{4}\\s?\\d{4}\\s?\\d\\s?gb\\b",
+          "weight": 18,
+          "name": "Royal Mail tracking number"
+        },
+        {
+          "pattern": "\\b(?:wt|wgt|weight)[:\\s]+\\d+(?:\\.\\d+)?\\s?(?:lbs?|kg|oz)\\b",
+          "weight": 6,
+          "name": "Package weight line"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "shipping[-_ ]?label",
+          "weight": 28,
+          "name": "shipping label filename"
+        },
+        {
+          "pattern": "(ups|usps|fedex|dhl|evri|dpd|hermes|royal[-_ ]?mail)[-_ ]?(shipping[-_ ]?)?label",
+          "weight": 26,
+          "name": "carrier label filename"
+        },
+        {
+          "pattern": "(^|[\\\\/])labels?( ?\\(\\d+\\))?\\.pdf$",
+          "weight": 16,
+          "name": "label.pdf filename"
+        },
+        {
+          "pattern": "way[-_ ]?bill|bill[-_ ]?of[-_ ]?lading|\\bawb\\b",
+          "weight": 18,
+          "name": "waybill / bill of lading filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "shipping label",
+          "weight": 14,
+          "name": "shipping label in title"
+        },
+        {
+          "field": "any",
+          "pattern": "shipstation|endicia|stamps\\.com|pirate ?ship|easypost|shippo|click ?& ?drop|sendcloud|packlink",
+          "weight": 15,
+          "name": "label platform producer"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "return label",
+          "weight": 20,
+          "name": "return label doc"
+        },
+        {
+          "text": "return authorization",
+          "weight": 16,
+          "name": "return authorization doc"
+        },
+        {
+          "pattern": "\\brma\\s?(?:number|no\\.?|#)?[-\\s#:]*\\d",
+          "weight": 14,
+          "name": "RMA number present"
+        },
+        {
+          "text": "packing slip",
+          "weight": 14,
+          "name": "packing slip doc"
+        },
+        {
+          "text": "commercial invoice",
+          "weight": 12,
+          "name": "customs invoice doc"
+        },
+        {
+          "text": "proof of delivery",
+          "weight": 16,
+          "name": "POD doc"
+        },
+        {
+          "text": "delivery note",
+          "weight": 12,
+          "name": "delivery note doc"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 10
+        },
+        {
+          "signal": "address_block",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "packing-slip",
+      "name": "Packing slip",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "packing slip",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "packing list",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "qty shipped",
+          "weight": 24
+        },
+        {
+          "text": "qty ordered",
+          "weight": 20
+        },
+        {
+          "text": "quantity shipped",
+          "weight": 22
+        },
+        {
+          "text": "items in this shipment",
+          "weight": 24
+        },
+        {
+          "text": "in this shipment",
+          "weight": 12
+        },
+        {
+          "text": "this is not an invoice",
+          "weight": 22
+        },
+        {
+          "text": "backordered",
+          "weight": 12
+        },
+        {
+          "text": "qty to follow",
+          "weight": 16
+        },
+        {
+          "text": "number of cartons",
+          "weight": 12
+        },
+        {
+          "text": "picked by",
+          "weight": 14
+        },
+        {
+          "text": "order number",
+          "weight": 5,
+          "where": "first"
+        },
+        {
+          "text": "ship date",
+          "weight": 8,
+          "where": "first"
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b\\d{3}-\\d{7}-\\d{7}\\b",
+          "weight": 10,
+          "name": "Amazon order ID"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "packing[-_ ]?slip",
+          "weight": 28,
+          "name": "packing slip filename"
+        },
+        {
+          "pattern": "packing[-_ ]?list",
+          "weight": 24,
+          "name": "packing list filename"
+        },
+        {
+          "pattern": "pack[-_ ]?slip",
+          "weight": 20,
+          "name": "packslip filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "packing (slip|list)",
+          "weight": 14,
+          "name": "packing slip in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "amount due",
+          "weight": 14,
+          "name": "invoice amount due"
+        },
+        {
+          "text": "subtotal",
+          "weight": 10,
+          "name": "priced document"
+        },
+        {
+          "text": "unit price",
+          "weight": 8,
+          "name": "priced line items"
+        },
+        {
+          "text": "commercial invoice",
+          "weight": 14,
+          "name": "customs invoice doc"
+        },
+        {
+          "pattern": "\\binvoice\\s?(number|no\\.?|#)",
+          "weight": 8,
+          "name": "invoice number present"
+        },
+        {
+          "text": "delivery note",
+          "weight": 12,
+          "name": "delivery note doc"
+        },
+        {
+          "text": "proof of delivery",
+          "weight": 12,
+          "name": "POD doc"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "customs-declaration",
+      "name": "Customs declaration",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "customs declaration",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "commercial invoice",
+          "weight": 18,
+          "where": "title"
+        },
+        {
+          "text": "hs code",
+          "weight": 20
+        },
+        {
+          "text": "hs tariff number",
+          "weight": 28
+        },
+        {
+          "text": "tariff code",
+          "weight": 18
+        },
+        {
+          "text": "country of origin",
+          "weight": 14
+        },
+        {
+          "text": "declared value",
+          "weight": 22
+        },
+        {
+          "text": "reason for export",
+          "weight": 26
+        },
+        {
+          "text": "for customs purposes only",
+          "weight": 28
+        },
+        {
+          "text": "may be opened officially",
+          "weight": 26
+        },
+        {
+          "text": "country of manufacture",
+          "weight": 18
+        },
+        {
+          "text": "air waybill",
+          "weight": 10
+        },
+        {
+          "text": "incoterms",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bcn\\s?2[23]\\b",
+          "weight": 25,
+          "name": "CN22/CN23 form code"
+        },
+        {
+          "pattern": "\\beori\\b",
+          "weight": 18,
+          "name": "EORI mention"
+        },
+        {
+          "pattern": "\\beori(?:\\s?(?:number|no\\.?))?[:\\s#]*[a-z]{2}\\s?\\d{9,15}\\b",
+          "weight": 20,
+          "name": "EORI number"
+        },
+        {
+          "pattern": "harmoni[sz]ed\\s+(?:system|tariff|code|commodity)",
+          "weight": 16,
+          "name": "Harmonized system mention"
+        },
+        {
+          "pattern": "\\b\\d{4}\\.\\d{2}(?:\\.\\d{2,4})?\\b",
+          "weight": 6,
+          "name": "HS code format"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "cn[-_ ]?2[23]",
+          "weight": 28,
+          "name": "CN22/CN23 filename"
+        },
+        {
+          "pattern": "customs",
+          "weight": 24,
+          "name": "customs filename"
+        },
+        {
+          "pattern": "commercial[-_ ]?invoice",
+          "weight": 24,
+          "name": "commercial invoice filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "customs|commercial invoice",
+          "weight": 12,
+          "name": "customs in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "amount due",
+          "weight": 10,
+          "name": "payment invoice"
+        },
+        {
+          "text": "remittance advice",
+          "weight": 12,
+          "name": "remittance doc"
+        },
+        {
+          "text": "packing list",
+          "weight": 10,
+          "name": "export packing list doc"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 8
+        },
+        {
+          "signal": "number_table",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "delivery-note",
+      "name": "Delivery note",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "delivery note",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "proof of delivery",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "despatch note",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "dispatch note",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "advice note",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "goods received note",
+          "weight": 22
+        },
+        {
+          "text": "received by",
+          "weight": 16
+        },
+        {
+          "text": "delivered on",
+          "weight": 14
+        },
+        {
+          "text": "received in good condition",
+          "weight": 26
+        },
+        {
+          "text": "goods received",
+          "weight": 18
+        },
+        {
+          "text": "signed for by",
+          "weight": 22
+        },
+        {
+          "text": "signature of recipient",
+          "weight": 20
+        },
+        {
+          "text": "waybill number",
+          "weight": 12
+        },
+        {
+          "text": "consignment",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bpod\\s?(?:no\\.?|number|#)\\b",
+          "weight": 15,
+          "name": "POD number"
+        },
+        {
+          "pattern": "delivered\\s(?:on\\s)?\\d{1,2}[/.-]\\d{1,2}[/.-]\\d{2,4}",
+          "weight": 14,
+          "name": "Delivered date line"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "delivery[-_ ]?note",
+          "weight": 28,
+          "name": "delivery note filename"
+        },
+        {
+          "pattern": "proof[-_ ]?of[-_ ]?delivery",
+          "weight": 26,
+          "name": "proof of delivery filename"
+        },
+        {
+          "pattern": "(^|[\\\\/_-])pod[_-]?\\d+",
+          "weight": 20,
+          "name": "POD number filename"
+        },
+        {
+          "pattern": "de?spatch[-_ ]?note",
+          "weight": 22,
+          "name": "despatch note filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "delivery note|proof of delivery",
+          "weight": 12,
+          "name": "delivery note in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "packing slip",
+          "weight": 14,
+          "name": "packing slip doc"
+        },
+        {
+          "text": "amount due",
+          "weight": 12,
+          "name": "payment invoice"
+        },
+        {
+          "text": "unit price",
+          "weight": 8,
+          "name": "priced line items"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "signature_block",
+          "weight": 10
+        },
+        {
+          "signal": "short_doc",
+          "weight": 5
+        },
+        {
+          "signal": "address_block",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "return-authorization",
+      "name": "Return authorization",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "return label",
+          "weight": 28
+        },
+        {
+          "text": "return mailing label",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "return shipping label",
+          "weight": 30
+        },
+        {
+          "text": "returns label",
+          "weight": 26
+        },
+        {
+          "text": "return authorization",
+          "weight": 26
+        },
+        {
+          "text": "return authorisation",
+          "weight": 26
+        },
+        {
+          "text": "return merchandise authorization",
+          "weight": 32
+        },
+        {
+          "text": "rma number",
+          "weight": 30
+        },
+        {
+          "text": "return instructions",
+          "weight": 22
+        },
+        {
+          "text": "affix this label",
+          "weight": 24
+        },
+        {
+          "text": "prepaid return",
+          "weight": 22
+        },
+        {
+          "text": "returns department",
+          "weight": 18
+        },
+        {
+          "text": "return reason",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\brma\\s?(?:number|no\\.?|#)?[-\\s#:]*\\d{4,12}\\b",
+          "weight": 22,
+          "name": "RMA number"
+        },
+        {
+          "pattern": "\\breturns? ?cent(?:er|re)\\b",
+          "weight": 14,
+          "name": "Returns center/centre"
+        },
+        {
+          "pattern": "\\b(?:1z[0-9a-z]{16}|9[1-5]\\d{20})\\b",
+          "weight": 12,
+          "name": "Carrier tracking number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "returns?[-_ ]?(mailing[-_ ]?)?(shipping[-_ ]?)?label",
+          "weight": 30,
+          "name": "return label filename"
+        },
+        {
+          "pattern": "(^|[\\\\/_-])rma[_-]?\\d+",
+          "weight": 24,
+          "name": "RMA filename"
+        },
+        {
+          "pattern": "returns?[-_ ]?auth",
+          "weight": 24,
+          "name": "return authorization filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "return label|rma",
+          "weight": 12,
+          "name": "return label in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "tax return",
+          "weight": 25,
+          "name": "tax document"
+        },
+        {
+          "text": "return on investment",
+          "weight": 14,
+          "name": "business ROI doc"
+        },
+        {
+          "text": "annual return",
+          "weight": 14,
+          "name": "companies house filing"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "proposal",
+      "name": "Proposal",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "proposal for",
+          "weight": 18,
+          "where": "title"
+        },
+        {
+          "text": "this proposal",
+          "weight": 16
+        },
+        {
+          "text": "scope of work",
+          "weight": 18
+        },
+        {
+          "text": "statement of work",
+          "weight": 18
+        },
+        {
+          "text": "prepared for",
+          "weight": 12,
+          "where": "first"
+        },
+        {
+          "text": "deliverables",
+          "weight": 8
+        },
+        {
+          "text": "investment summary",
+          "weight": 14
+        },
+        {
+          "text": "total investment",
+          "weight": 12
+        },
+        {
+          "text": "proposal is valid",
+          "weight": 24
+        },
+        {
+          "text": "acceptance of this proposal",
+          "weight": 26
+        },
+        {
+          "text": "our proposed approach",
+          "weight": 18
+        },
+        {
+          "text": "request for proposal",
+          "weight": 12
+        },
+        {
+          "text": "project timeline",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "proposal\\s*(?:no\\.?|number|#|ref)\\s*[:#]?\\s*[a-z0-9/-]{2,20}",
+          "weight": 16,
+          "name": "Proposal reference number"
+        },
+        {
+          "pattern": "(?:proposal|offer) (?:is |remains )?valid (?:for|until)",
+          "weight": 10,
+          "name": "Proposal validity period"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "proposal",
+          "weight": 26,
+          "name": "'proposal' in filename"
+        },
+        {
+          "pattern": "\\bsow\\b|statement[-_ ]of[-_ ]work",
+          "weight": 18,
+          "name": "Statement of work filename"
+        },
+        {
+          "pattern": "rfp[-_ ]?(?:response|reply)",
+          "weight": 20,
+          "name": "RFP response filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "proposal",
+          "weight": 14,
+          "name": "Proposal in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "quotation",
+          "weight": 12,
+          "name": "Quote document language"
+        },
+        {
+          "pattern": "invoice\\s*(?:no\\.?|number|#)",
+          "weight": 14,
+          "name": "Invoice number present"
+        },
+        {
+          "text": "in witness whereof",
+          "weight": 16,
+          "name": "Contract execution language"
+        },
+        {
+          "text": "purchase order",
+          "weight": 10,
+          "name": "Purchase order language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 3
+        },
+        {
+          "signal": "signature_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "presentation",
+      "name": "Presentation",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "agenda",
+          "weight": 8,
+          "where": "title"
+        },
+        {
+          "text": "key takeaways",
+          "weight": 14
+        },
+        {
+          "text": "thank you for your attention",
+          "weight": 24
+        },
+        {
+          "text": "questions?",
+          "weight": 6
+        },
+        {
+          "text": "q&a",
+          "weight": 8
+        },
+        {
+          "text": "in this presentation",
+          "weight": 16
+        },
+        {
+          "text": "quarterly business review",
+          "weight": 16
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bslide\\s+\\d{1,3}\\b",
+          "weight": 10,
+          "name": "Slide numbering"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "slides|deck|presentation",
+          "weight": 22,
+          "name": "Slides/deck in filename"
+        },
+        {
+          "pattern": "\\.pptx?|powerpoint|keynote",
+          "weight": 24,
+          "name": "Exported presentation file"
+        },
+        {
+          "pattern": "webinar",
+          "weight": 14,
+          "name": "Webinar filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "any",
+          "pattern": "powerpoint",
+          "weight": 18,
+          "name": "PowerPoint metadata"
+        },
+        {
+          "field": "creator",
+          "pattern": "keynote|impress|google slides",
+          "weight": 15,
+          "name": "Presentation software creator"
+        },
+        {
+          "field": "producer",
+          "pattern": "slides|keynote|impress",
+          "weight": 12,
+          "name": "Presentation software producer"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "minutes of the meeting",
+          "weight": 16,
+          "name": "Meeting minutes language"
+        },
+        {
+          "text": "table of contents",
+          "weight": 8,
+          "name": "Report-style ToC"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "bullet_heavy",
+          "weight": 9
+        }
+      ]
+    },
+    {
+      "id": "press-release",
+      "name": "Press release",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "for immediate release",
+          "weight": 38,
+          "where": "first"
+        },
+        {
+          "text": "press release",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "media contact",
+          "weight": 22
+        },
+        {
+          "text": "press contact",
+          "weight": 20
+        },
+        {
+          "text": "today announced",
+          "weight": 20
+        },
+        {
+          "text": "is pleased to announce",
+          "weight": 16
+        },
+        {
+          "text": "notes to editors",
+          "weight": 26
+        },
+        {
+          "text": "embargoed until",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "headquartered in",
+          "weight": 8
+        },
+        {
+          "text": "###",
+          "weight": 14
+        },
+        {
+          "text": "for further information please contact",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\((?:nasdaq|nyse|lse|tsx|asx|euronext|aim)\\s*:\\s*[a-z.]{1,6}\\)",
+          "weight": 16,
+          "name": "Stock exchange ticker"
+        },
+        {
+          "pattern": "media (?:inquiries|enquiries)",
+          "weight": 14,
+          "name": "Media inquiries line"
+        },
+        {
+          "pattern": "pr newswire|business wire|globe newswire|accesswire",
+          "weight": 16,
+          "name": "Wire service name"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "press[-_ ]?release",
+          "weight": 28,
+          "name": "Press release filename"
+        },
+        {
+          "pattern": "\\bpr[-_]\\d{2,6}",
+          "weight": 12,
+          "name": "Numbered PR filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "press release",
+          "weight": 16,
+          "name": "Press release in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "in this issue",
+          "weight": 16,
+          "name": "Newsletter language"
+        },
+        {
+          "text": "unsubscribe",
+          "weight": 12,
+          "name": "Newsletter footer"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "newsletter",
+      "name": "Newsletter",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "in this issue",
+          "weight": 30
+        },
+        {
+          "text": "in this edition",
+          "weight": 22
+        },
+        {
+          "text": "newsletter",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "unsubscribe",
+          "weight": 14
+        },
+        {
+          "text": "from the editor",
+          "weight": 20
+        },
+        {
+          "text": "upcoming events",
+          "weight": 14
+        },
+        {
+          "text": "dates for your diary",
+          "weight": 22
+        },
+        {
+          "text": "monthly newsletter",
+          "weight": 24
+        },
+        {
+          "text": "quarterly newsletter",
+          "weight": 22
+        },
+        {
+          "text": "message from the president",
+          "weight": 16
+        },
+        {
+          "text": "save the date",
+          "weight": 10
+        },
+        {
+          "text": "in our next issue",
+          "weight": 20
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "vol(?:ume|\\.)?\\s*\\d{1,3}[,.]?\\s*(?:issue|no\\.?|number)\\s*\\d{1,3}",
+          "weight": 12,
+          "name": "Volume/issue numbering"
+        },
+        {
+          "pattern": "issue\\s*(?:#|no\\.?)?\\s*\\d{1,3}\\s*[|,•-]\\s*(?:spring|summer|autumn|fall|winter|january|february|march|april|may|june|july|august|september|october|november|december)",
+          "weight": 18,
+          "name": "Issue with season/month"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "newsletter",
+          "weight": 28,
+          "name": "Newsletter filename"
+        },
+        {
+          "pattern": "bulletin",
+          "weight": 16,
+          "name": "Bulletin filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "newsletter",
+          "weight": 14,
+          "name": "Newsletter in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "for immediate release",
+          "weight": 20,
+          "name": "Press release header"
+        },
+        {
+          "text": "invoice",
+          "weight": 10,
+          "name": "Billing language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "url_heavy",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "brochure",
+      "name": "Brochure",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "contact us today",
+          "weight": 18
+        },
+        {
+          "text": "call us today",
+          "weight": 18
+        },
+        {
+          "text": "call today",
+          "weight": 12
+        },
+        {
+          "text": "why choose us",
+          "weight": 24
+        },
+        {
+          "text": "free consultation",
+          "weight": 16
+        },
+        {
+          "text": "free quote",
+          "weight": 12
+        },
+        {
+          "text": "limited time offer",
+          "weight": 16
+        },
+        {
+          "text": "satisfaction guaranteed",
+          "weight": 16
+        },
+        {
+          "text": "features and benefits",
+          "weight": 16
+        },
+        {
+          "text": "no obligation",
+          "weight": 10
+        },
+        {
+          "text": "book your free",
+          "weight": 18
+        },
+        {
+          "text": "bring this flyer",
+          "weight": 24
+        },
+        {
+          "text": "visit our website",
+          "weight": 6
+        },
+        {
+          "text": "follow us on",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "(?:\\d{1,2}% off|free (?:day pass|trial|estimate|gift|tour)|offer ends|no joining fee|grand opening)",
+          "weight": 12,
+          "name": "Promotional offer"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "brochure|flyer|flier|leaflet|pamphlet",
+          "weight": 26,
+          "name": "Brochure/flyer filename"
+        },
+        {
+          "pattern": "one[-_ ]?pager",
+          "weight": 16,
+          "name": "One-pager filename"
+        }
+      ],
+      "metadata": [],
+      "negatives": [
+        {
+          "text": "for immediate release",
+          "weight": 15,
+          "name": "Press release header"
+        },
+        {
+          "text": "unsubscribe",
+          "weight": 10,
+          "name": "Newsletter footer"
+        },
+        {
+          "pattern": "mls\\s*#|offers over|guide price",
+          "weight": 12,
+          "name": "Property listing language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 8
+        },
+        {
+          "signal": "url_heavy",
+          "weight": 3
+        },
+        {
+          "signal": "address_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "meeting-minutes",
+      "name": "Meeting minutes",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "minutes of the meeting",
+          "weight": 30
+        },
+        {
+          "text": "meeting minutes",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "minutes of the",
+          "weight": 14,
+          "where": "title"
+        },
+        {
+          "text": "apologies for absence",
+          "weight": 28
+        },
+        {
+          "text": "matters arising",
+          "weight": 26
+        },
+        {
+          "text": "the meeting was called to order",
+          "weight": 28
+        },
+        {
+          "text": "motion carried",
+          "weight": 22
+        },
+        {
+          "text": "seconded by",
+          "weight": 16
+        },
+        {
+          "text": "approval of minutes",
+          "weight": 20
+        },
+        {
+          "text": "minutes were approved",
+          "weight": 20
+        },
+        {
+          "text": "date of next meeting",
+          "weight": 18
+        },
+        {
+          "text": "the meeting adjourned",
+          "weight": 22
+        },
+        {
+          "text": "any other business",
+          "weight": 16
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "present:\\s*[a-z]",
+          "weight": 8,
+          "name": "Present list"
+        },
+        {
+          "pattern": "(?:adjourned|closed) at \\d{1,2}[:.]\\d{2}",
+          "weight": 16,
+          "name": "Adjournment time"
+        },
+        {
+          "pattern": "(?:a )?quorum (?:was|being|is) (?:present|established|met)",
+          "weight": 14,
+          "name": "Quorum statement"
+        },
+        {
+          "pattern": "(?:old|new|unfinished) business",
+          "weight": 10,
+          "name": "Old/new business section"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "minutes",
+          "weight": 24,
+          "name": "Minutes filename"
+        },
+        {
+          "pattern": "\\bmom[-_]|minutes[-_ ]of[-_ ]meeting",
+          "weight": 14,
+          "name": "Minutes-of-meeting filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "minutes",
+          "weight": 12,
+          "name": "Minutes in title"
+        }
+      ],
+      "negatives": [
+        {
+          "pattern": "plaintiff|defendant",
+          "weight": 14,
+          "name": "Court filing parties"
+        },
+        {
+          "text": "for immediate release",
+          "weight": 12,
+          "name": "Press release header"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "memo",
+      "name": "Memo",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "memorandum",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "interoffice memorandum",
+          "weight": 32
+        },
+        {
+          "text": "interoffice memo",
+          "weight": 28
+        },
+        {
+          "text": "internal memorandum",
+          "weight": 26
+        },
+        {
+          "text": "this memo",
+          "weight": 16
+        },
+        {
+          "text": "this memorandum",
+          "weight": 16
+        },
+        {
+          "text": "memo",
+          "weight": 8,
+          "where": "title"
+        },
+        {
+          "text": "executive briefing",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "briefing note",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "decision required",
+          "weight": 26
+        },
+        {
+          "text": "bottom line up front",
+          "weight": 22
+        },
+        {
+          "text": "for decision",
+          "weight": 20
+        },
+        {
+          "text": "key recommendation",
+          "weight": 20
+        },
+        {
+          "text": "action requested",
+          "weight": 18
+        },
+        {
+          "text": "prepared for the executive team",
+          "weight": 22
+        },
+        {
+          "text": "prepared for the board",
+          "weight": 18
+        },
+        {
+          "text": "strategic recommendation",
+          "weight": 16
+        },
+        {
+          "text": "summary for leadership",
+          "weight": 16
+        },
+        {
+          "text": "this briefing",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bto:\\s*\\S[\\s\\S]{0,120}?\\bfrom:\\s*\\S[\\s\\S]{0,160}?\\b(?:date|re|subject):",
+          "weight": 18,
+          "name": "To/From/Re header block"
+        },
+        {
+          "pattern": "memo\\s*(?:no\\.?|number|#)\\s*[:#]?\\s*[a-z0-9-]{2,15}",
+          "weight": 14,
+          "name": "Memo number"
+        },
+        {
+          "pattern": "\\bbluf\\b",
+          "weight": 12,
+          "name": "BLUF abbreviation"
+        },
+        {
+          "pattern": "decision\\s+(?:requested|required)\\s+by",
+          "weight": 16,
+          "name": "decision required by"
+        },
+        {
+          "pattern": "recommend(?:ation)?:\\s",
+          "weight": 10,
+          "name": "recommendation label"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "memo(?:randum)?(?:[-_ .0-9]|$)",
+          "weight": 22,
+          "name": "Memo filename"
+        },
+        {
+          "pattern": "executive[-_ ]?briefing",
+          "weight": 28,
+          "name": "executive briefing filename"
+        },
+        {
+          "pattern": "exec[-_ ]?summary",
+          "weight": 24,
+          "name": "exec summary filename"
+        },
+        {
+          "pattern": "board[-_ ]?brief",
+          "weight": 20,
+          "name": "board brief filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "memo(randum)?",
+          "weight": 12,
+          "name": "Memo in title"
+        },
+        {
+          "field": "title",
+          "pattern": "executive briefing|briefing note",
+          "weight": 14,
+          "name": "executive briefing in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "memorandum of understanding",
+          "weight": 24,
+          "name": "MoU contract"
+        },
+        {
+          "text": "memorandum of agreement",
+          "weight": 22,
+          "name": "MoA contract"
+        },
+        {
+          "pattern": "memorandum of law|memorandum in support|memorandum opinion",
+          "weight": 22,
+          "name": "Legal brief memorandum"
+        },
+        {
+          "pattern": "offering memorandum|private placement memorandum",
+          "weight": 24,
+          "name": "Securities offering memorandum"
+        },
+        {
+          "pattern": "\\bsent:\\s",
+          "weight": 14,
+          "name": "Email Sent header"
+        },
+        {
+          "pattern": "\\bdear\\s+(?:mr|ms|mrs|dr|sir|madam)",
+          "weight": 12,
+          "name": "Letter salutation"
+        },
+        {
+          "text": "key findings",
+          "weight": 12,
+          "name": "white paper/report term"
+        },
+        {
+          "text": "methodology",
+          "weight": 10,
+          "name": "white paper/report term"
+        },
+        {
+          "text": "survey respondents",
+          "weight": 10,
+          "name": "white paper/report term"
+        },
+        {
+          "text": "funding requirements",
+          "weight": 10,
+          "name": "business plan funding term"
+        },
+        {
+          "text": "market analysis",
+          "weight": 8,
+          "name": "business plan market term"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "business-plan",
+      "name": "Business plan",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "business plan",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "executive summary",
+          "weight": 8,
+          "where": "first"
+        },
+        {
+          "text": "market analysis",
+          "weight": 18
+        },
+        {
+          "text": "financial projections",
+          "weight": 22
+        },
+        {
+          "text": "competitive landscape",
+          "weight": 14
+        },
+        {
+          "text": "swot analysis",
+          "weight": 20
+        },
+        {
+          "text": "target market",
+          "weight": 12
+        },
+        {
+          "text": "funding requirements",
+          "weight": 20
+        },
+        {
+          "text": "break-even analysis",
+          "weight": 20
+        },
+        {
+          "text": "revenue model",
+          "weight": 14
+        },
+        {
+          "text": "company description",
+          "weight": 14
+        },
+        {
+          "text": "marketing strategy",
+          "weight": 10
+        },
+        {
+          "text": "management team",
+          "weight": 6
+        },
+        {
+          "text": "strategic plan",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "corporate strategy",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "strategic pillars",
+          "weight": 26
+        },
+        {
+          "text": "strategic priorities",
+          "weight": 22
+        },
+        {
+          "text": "strategic objectives",
+          "weight": 20
+        },
+        {
+          "text": "north star",
+          "weight": 20
+        },
+        {
+          "text": "strategic roadmap",
+          "weight": 20
+        },
+        {
+          "text": "key initiatives",
+          "weight": 16
+        },
+        {
+          "text": "vision statement",
+          "weight": 14
+        },
+        {
+          "text": "mission statement",
+          "weight": 12
+        },
+        {
+          "text": "long-term strategy",
+          "weight": 14
+        },
+        {
+          "text": "three-year strategy",
+          "weight": 18
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "year\\s*(?:one|two|three|1|2|3)\\s*(?:revenue|turnover|sales)",
+          "weight": 12,
+          "name": "Year-by-year projection"
+        },
+        {
+          "pattern": "start[- ]?up (?:costs|funding|capital)",
+          "weight": 12,
+          "name": "Startup costs language"
+        },
+        {
+          "pattern": "\\b\\d{1,2}[- ]year strategic plan",
+          "weight": 18,
+          "name": "N-year strategic plan"
+        },
+        {
+          "pattern": "strategy\\s+20\\d{2}\\s*[-–]\\s*20\\d{2}",
+          "weight": 16,
+          "name": "strategy year range"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "business[-_ ]?plan",
+          "weight": 28,
+          "name": "Business plan filename"
+        },
+        {
+          "pattern": "bizplan",
+          "weight": 20,
+          "name": "Bizplan filename"
+        },
+        {
+          "pattern": "strategic[-_ ]?plan",
+          "weight": 28,
+          "name": "strategic plan filename"
+        },
+        {
+          "pattern": "corporate[-_ ]?strategy",
+          "weight": 24,
+          "name": "corporate strategy filename"
+        },
+        {
+          "pattern": "strategy[-_ ]?20\\d{2}",
+          "weight": 18,
+          "name": "strategy year filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "business plan",
+          "weight": 16,
+          "name": "Business plan in title"
+        },
+        {
+          "field": "title",
+          "pattern": "strategic plan|corporate strategy",
+          "weight": 16,
+          "name": "strategic plan in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "consolidated financial statements",
+          "weight": 16,
+          "name": "Financial report language"
+        },
+        {
+          "text": "for the year ended",
+          "weight": 12,
+          "name": "Statutory accounts language"
+        },
+        {
+          "text": "case study",
+          "weight": 12,
+          "name": "Case study language"
+        },
+        {
+          "text": "start-up costs",
+          "weight": 12,
+          "name": "business plan startup term"
+        },
+        {
+          "text": "acceptance of this proposal",
+          "weight": 14,
+          "name": "proposal acceptance clause"
+        },
+        {
+          "text": "total investment",
+          "weight": 10,
+          "name": "proposal investment term"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "toc",
+          "weight": 5
+        },
+        {
+          "signal": "currency_heavy",
+          "weight": 3
+        },
+        {
+          "signal": "long_doc",
+          "weight": 3
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 5
+        }
+      ]
+    },
+    {
+      "id": "white-paper",
+      "name": "White paper",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "white paper",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "whitepaper",
+          "weight": 26
+        },
+        {
+          "text": "this white paper",
+          "weight": 26
+        },
+        {
+          "text": "key findings",
+          "weight": 18
+        },
+        {
+          "text": "executive summary",
+          "weight": 8,
+          "where": "first"
+        },
+        {
+          "text": "methodology",
+          "weight": 10
+        },
+        {
+          "text": "conclusions and recommendations",
+          "weight": 16
+        },
+        {
+          "text": "research report",
+          "weight": 14
+        },
+        {
+          "text": "industry report",
+          "weight": 14
+        },
+        {
+          "text": "about this report",
+          "weight": 16
+        },
+        {
+          "text": "survey respondents",
+          "weight": 12
+        },
+        {
+          "text": "the findings",
+          "weight": 6
+        },
+        {
+          "text": "in partnership with",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b\\d{2,3}% of (?:respondents|organi[sz]ations|companies|businesses|leaders)",
+          "weight": 16,
+          "name": "Survey percentage finding"
+        },
+        {
+          "pattern": "surveyed\\s+[\\d,]{3,6}\\s+",
+          "weight": 12,
+          "name": "Survey sample size"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "white[-_ ]?paper",
+          "weight": 28,
+          "name": "Whitepaper filename"
+        },
+        {
+          "pattern": "state[-_ ]of[-_ ]|industry[-_ ]report|research[-_ ]report",
+          "weight": 16,
+          "name": "Industry report filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "white\\s?paper",
+          "weight": 16,
+          "name": "White paper in title"
+        }
+      ],
+      "negatives": [
+        {
+          "pattern": "doi\\.org|arxiv",
+          "weight": 16,
+          "name": "Academic identifiers"
+        },
+        {
+          "text": "for immediate release",
+          "weight": 14,
+          "name": "Press release header"
+        },
+        {
+          "text": "abstract",
+          "weight": 8,
+          "name": "Academic abstract"
+        },
+        {
+          "pattern": "independent auditor",
+          "weight": 16,
+          "name": "Audited annual report language"
+        },
+        {
+          "text": "for the year ended",
+          "weight": 12,
+          "name": "Statutory accounts language"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "toc",
+          "weight": 5
+        },
+        {
+          "signal": "long_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "case-study",
+      "name": "Case study",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "case study",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "customer case study",
+          "weight": 32
+        },
+        {
+          "text": "success story",
+          "weight": 20
+        },
+        {
+          "text": "customer success story",
+          "weight": 26
+        },
+        {
+          "text": "customer story",
+          "weight": 22
+        },
+        {
+          "text": "the challenge",
+          "weight": 12
+        },
+        {
+          "text": "the solution",
+          "weight": 10
+        },
+        {
+          "text": "the results",
+          "weight": 10
+        },
+        {
+          "text": "about the client",
+          "weight": 18
+        },
+        {
+          "text": "about the customer",
+          "weight": 16
+        },
+        {
+          "text": "products used",
+          "weight": 16
+        },
+        {
+          "text": "key results",
+          "weight": 12
+        },
+        {
+          "text": "at a glance",
+          "weight": 10
+        },
+        {
+          "text": "return on investment",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\d{1,3}%\\s+(?:increase|reduction|decrease|improvement)\\s+in",
+          "weight": 14,
+          "name": "Quantified outcome"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "case[-_ ]?study",
+          "weight": 28,
+          "name": "Case study filename"
+        },
+        {
+          "pattern": "success[-_ ]?story",
+          "weight": 20,
+          "name": "Success story filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "case study",
+          "weight": 16,
+          "name": "Case study in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "the patient",
+          "weight": 12,
+          "name": "Clinical case report"
+        },
+        {
+          "pattern": "plaintiff|court of appeals",
+          "weight": 12,
+          "name": "Legal case"
+        },
+        {
+          "pattern": "doi\\.org",
+          "weight": 10,
+          "name": "Academic DOI"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "organization-chart",
+      "name": "Organization chart",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "organizational chart",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "organisation chart",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "org chart",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "reporting lines",
+          "weight": 24
+        },
+        {
+          "text": "reporting structure",
+          "weight": 22
+        },
+        {
+          "text": "direct reports",
+          "weight": 18
+        },
+        {
+          "text": "reports to",
+          "weight": 14
+        },
+        {
+          "text": "chain of command",
+          "weight": 18
+        },
+        {
+          "text": "headcount",
+          "weight": 14
+        },
+        {
+          "text": "department structure",
+          "weight": 14
+        },
+        {
+          "text": "team structure",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "org(?:ani[sz]ational)?\\s*chart",
+          "weight": 16,
+          "name": "org chart variant"
+        },
+        {
+          "pattern": "reports?\\s+to\\s+(?:the\\s+)?(?:ceo|cfo|coo|cto|vp|director|head of|chief)",
+          "weight": 14,
+          "name": "reports to executive role"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "org(?:anizational|anisational)?[-_ ]?chart",
+          "weight": 30,
+          "name": "org chart filename"
+        },
+        {
+          "pattern": "reporting[-_ ]?structure",
+          "weight": 20,
+          "name": "reporting structure filename"
+        },
+        {
+          "pattern": "leadership[-_ ]?structure",
+          "weight": 16,
+          "name": "leadership structure filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "organi[sz]ational chart|org chart",
+          "weight": 14,
+          "name": "org chart in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "essential duties and responsibilities",
+          "weight": 14,
+          "name": "job description heading"
+        },
+        {
+          "text": "job summary",
+          "weight": 12,
+          "name": "job description term"
+        },
+        {
+          "text": "duties and responsibilities",
+          "weight": 12,
+          "name": "job description term"
+        },
+        {
+          "text": "qualifications",
+          "weight": 8,
+          "name": "job description term"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 6
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "meeting-agenda",
+      "name": "Meeting agenda",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "meeting agenda",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "adoption of the agenda",
+          "weight": 26
+        },
+        {
+          "text": "any other business",
+          "weight": 24
+        },
+        {
+          "text": "apologies for absence",
+          "weight": 24
+        },
+        {
+          "text": "call to order",
+          "weight": 22
+        },
+        {
+          "text": "agenda item",
+          "weight": 18
+        },
+        {
+          "text": "approval of minutes",
+          "weight": 16
+        },
+        {
+          "text": "old business",
+          "weight": 16
+        },
+        {
+          "text": "new business",
+          "weight": 14
+        },
+        {
+          "text": "discussion items",
+          "weight": 14
+        },
+        {
+          "text": "agenda",
+          "weight": 12,
+          "where": "title"
+        },
+        {
+          "text": "next meeting",
+          "weight": 8
+        },
+        {
+          "text": "adjournment",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bitem\\s+\\d{1,2}\\s*[.:)]",
+          "weight": 10,
+          "name": "numbered agenda items"
+        },
+        {
+          "pattern": "agenda\\s+item\\s+requests?",
+          "weight": 14,
+          "name": "agenda item requests"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "meeting[-_ ]?agenda",
+          "weight": 30,
+          "name": "meeting agenda filename"
+        },
+        {
+          "pattern": "agenda",
+          "weight": 26,
+          "name": "agenda in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "agenda",
+          "weight": 14,
+          "name": "agenda in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "motion carried",
+          "weight": 22,
+          "name": "minutes narrative"
+        },
+        {
+          "text": "seconded by",
+          "weight": 18,
+          "name": "minutes narrative"
+        },
+        {
+          "text": "respectfully submitted",
+          "weight": 18,
+          "name": "minutes sign-off"
+        },
+        {
+          "text": "the meeting was adjourned",
+          "weight": 18,
+          "name": "minutes past-tense closing"
+        },
+        {
+          "pattern": "minutes\\s+(?:recorded|prepared|taken)\\s+by",
+          "weight": 16,
+          "name": "minutes recorder credit"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "bullet_heavy",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "statement-of-work",
+      "name": "Statement of work",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "statement of work",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "this statement of work",
+          "weight": 26
+        },
+        {
+          "text": "period of performance",
+          "weight": 24
+        },
+        {
+          "text": "acceptance criteria",
+          "weight": 18
+        },
+        {
+          "text": "scope of work",
+          "weight": 16
+        },
+        {
+          "text": "time and materials",
+          "weight": 16
+        },
+        {
+          "text": "master services agreement",
+          "weight": 14
+        },
+        {
+          "text": "change order",
+          "weight": 14
+        },
+        {
+          "text": "deliverables",
+          "weight": 12
+        },
+        {
+          "text": "work product",
+          "weight": 12
+        },
+        {
+          "text": "milestones",
+          "weight": 8
+        },
+        {
+          "text": "fixed fee",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "statement of work\\s*(?:no\\.?|number|#)\\s*\\d{1,4}",
+          "weight": 20,
+          "name": "SOW number"
+        },
+        {
+          "pattern": "statement of work\\s*\\(\\s*[\"']?sow[\"']?\\s*\\)",
+          "weight": 22,
+          "name": "SOW defined-term clause"
+        },
+        {
+          "pattern": "\\bmsa\\b",
+          "flags": "g",
+          "weight": 8,
+          "name": "MSA abbreviation"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "statement[-_ ]?of[-_ ]?work",
+          "weight": 30,
+          "name": "statement of work filename"
+        },
+        {
+          "pattern": "(^|[^a-z])sow[-_ ]?\\d{0,3}([^a-z0-9]|$)",
+          "weight": 20,
+          "name": "SOW in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "statement of work|\\bsow\\b",
+          "weight": 14,
+          "name": "SOW in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "we are pleased to submit",
+          "weight": 16,
+          "name": "proposal wording"
+        },
+        {
+          "text": "this proposal",
+          "weight": 14,
+          "name": "proposal wording"
+        },
+        {
+          "text": "estimate is valid for",
+          "weight": 14,
+          "name": "quote validity clause"
+        },
+        {
+          "text": "employment agreement",
+          "weight": 14,
+          "name": "employment contract heading"
+        },
+        {
+          "text": "in witness whereof",
+          "weight": 12,
+          "name": "general contract execution clause"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 4
+        },
+        {
+          "signal": "signature_block",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "user-guide",
+      "name": "User guide",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "owner's manual",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "instruction manual",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "user manual",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "instructions for use",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "user guide",
+          "weight": 14,
+          "where": "title"
+        },
+        {
+          "text": "operating instructions",
+          "weight": 24
+        },
+        {
+          "text": "important safety instructions",
+          "weight": 30,
+          "where": "first"
+        },
+        {
+          "text": "keep these instructions",
+          "weight": 22
+        },
+        {
+          "text": "before first use",
+          "weight": 12
+        },
+        {
+          "text": "troubleshooting",
+          "weight": 8
+        },
+        {
+          "text": "quick start guide",
+          "weight": 18,
+          "where": "title"
+        },
+        {
+          "text": "risk of electric shock",
+          "weight": 20
+        },
+        {
+          "text": "can be used by children aged",
+          "weight": 26
+        },
+        {
+          "text": "supply cord is damaged",
+          "weight": 24
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "model\\s?(no\\.?|number|#)?\\s?:?\\s?[a-z]{0,4}-?[0-9][a-z0-9/-]{2,}",
+          "flags": "gi",
+          "weight": 12,
+          "name": "model number"
+        },
+        {
+          "pattern": "(do not|never)\\s(disassemble|immerse|attempt to repair|expose this)",
+          "flags": "gi",
+          "weight": 14,
+          "name": "safety warning"
+        },
+        {
+          "pattern": "owner[’']?s\\s(manual|guide)",
+          "flags": "gi",
+          "weight": 18,
+          "name": "owners manual apostrophe variants"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(user|owner'?s?|instruction|operating)[\\s_-]*(manual|guide|instructions)",
+          "weight": 26,
+          "name": "manual filename"
+        },
+        {
+          "pattern": "manual",
+          "weight": 15,
+          "name": "manual keyword"
+        },
+        {
+          "pattern": "quick[\\s_-]*start",
+          "weight": 16,
+          "name": "quick start filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])ifu([^a-z0-9]|$)|instructions[\\s_-]?for[\\s_-]?use",
+          "weight": 16,
+          "name": "instructions for use filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "manual|user guide",
+          "weight": 12,
+          "name": "manual in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "safety data sheet",
+          "weight": 28,
+          "name": "sds heading"
+        },
+        {
+          "text": "absolute maximum ratings",
+          "weight": 16,
+          "name": "datasheet section"
+        },
+        {
+          "text": "api reference",
+          "weight": 14,
+          "name": "software docs"
+        },
+        {
+          "text": "release notes",
+          "weight": 12,
+          "name": "software release notes"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "toc",
+          "weight": 6
+        }
+      ]
+    },
+    {
+      "id": "datasheet",
+      "name": "Datasheet",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "absolute maximum ratings",
+          "weight": 34
+        },
+        {
+          "text": "electrical characteristics",
+          "weight": 28
+        },
+        {
+          "text": "recommended operating conditions",
+          "weight": 28
+        },
+        {
+          "text": "typical application circuit",
+          "weight": 26
+        },
+        {
+          "text": "typical performance characteristics",
+          "weight": 24
+        },
+        {
+          "text": "pin configuration",
+          "weight": 24
+        },
+        {
+          "text": "pin description",
+          "weight": 20
+        },
+        {
+          "text": "technical data sheet",
+          "weight": 20,
+          "where": "title"
+        },
+        {
+          "text": "datasheet",
+          "weight": 18,
+          "where": "title"
+        },
+        {
+          "text": "ordering information",
+          "weight": 14
+        },
+        {
+          "text": "package outline",
+          "weight": 14
+        },
+        {
+          "text": "operating temperature range",
+          "weight": 14
+        },
+        {
+          "text": "ripple & noise",
+          "weight": 20
+        },
+        {
+          "text": "derating curve",
+          "weight": 18
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b\\d+(\\.\\d+)?\\s?(mv|µa|ua|pf|nf|µf|uf|mhz|khz|ghz|kω|mω|vdc|vac)",
+          "flags": "gi",
+          "weight": 14,
+          "name": "electrical units"
+        },
+        {
+          "pattern": "[-–]\\s?\\d{1,3}\\s?°?\\s?c?\\s?(to|~)\\s?\\+?\\d{1,3}\\s?°\\s?c",
+          "flags": "gi",
+          "weight": 14,
+          "name": "temperature range"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "datasheet",
+          "weight": 24,
+          "name": "datasheet filename"
+        },
+        {
+          "pattern": "spec[\\s_-]?sheet",
+          "weight": 18,
+          "name": "spec sheet filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])tds([^a-z0-9]|$)",
+          "weight": 16,
+          "name": "tds filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])ds\\d{4,}",
+          "weight": 15,
+          "name": "vendor ds-number filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "datasheet|data sheet",
+          "weight": 12,
+          "name": "datasheet title"
+        },
+        {
+          "field": "any",
+          "pattern": "texas instruments|stmicroelectronics|analog devices|nxp semiconductors|infineon|microchip technology|onsemi|renesas|vishay|rohm",
+          "weight": 14,
+          "name": "semiconductor vendor"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "safety data sheet",
+          "weight": 30,
+          "name": "sds heading"
+        },
+        {
+          "text": "first aid measures",
+          "weight": 20,
+          "name": "sds section"
+        },
+        {
+          "text": "hazards identification",
+          "weight": 16,
+          "name": "sds section 2"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "technical-specification",
+      "name": "Technical specification",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "technical specification",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "requirements specification",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "functional requirements",
+          "weight": 22
+        },
+        {
+          "text": "non-functional requirements",
+          "weight": 28
+        },
+        {
+          "text": "external interface requirements",
+          "weight": 20
+        },
+        {
+          "text": "this document specifies",
+          "weight": 24
+        },
+        {
+          "text": "normative references",
+          "weight": 26
+        },
+        {
+          "text": "shall comply with",
+          "weight": 14
+        },
+        {
+          "text": "issued for construction",
+          "weight": 12
+        },
+        {
+          "text": "revision history",
+          "weight": 8
+        },
+        {
+          "text": "acceptance criteria",
+          "weight": 10
+        },
+        {
+          "text": "intended audience",
+          "weight": 8
+        },
+        {
+          "text": "for the purposes of this document",
+          "weight": 16
+        },
+        {
+          "text": "terms and definitions",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "the\\s(system|software|application|device|product|supplier|contractor|equipment|installation)\\sshall\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "shall requirement"
+        },
+        {
+          "pattern": "\\b(req|srs|nfr)[-_]\\d{1,4}\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "requirement id"
+        },
+        {
+          "pattern": "\\b(iso|iec|astm|ansi|bs en)\\s?\\d{2,5}\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "standards reference"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(technical|functional|requirements?|system)[\\s_-]?spec",
+          "weight": 22,
+          "name": "spec filename"
+        },
+        {
+          "pattern": "specification",
+          "weight": 15,
+          "name": "specification keyword"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])srs([^a-z0-9]|$)",
+          "weight": 16,
+          "name": "srs filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "specification|requirements",
+          "weight": 10,
+          "name": "specification title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "in witness whereof",
+          "weight": 22,
+          "name": "contract execution"
+        },
+        {
+          "text": "what is claimed is",
+          "weight": 20,
+          "name": "patent claims"
+        },
+        {
+          "text": "absolute maximum ratings",
+          "weight": 14,
+          "name": "datasheet section"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "toc",
+          "weight": 5
+        },
+        {
+          "signal": "long_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "patent",
+      "name": "Patent",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "united states patent",
+          "weight": 34,
+          "where": "first"
+        },
+        {
+          "text": "patent application publication",
+          "weight": 34,
+          "where": "first"
+        },
+        {
+          "text": "european patent application",
+          "weight": 30,
+          "where": "first"
+        },
+        {
+          "text": "date of patent",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "field of the invention",
+          "weight": 32
+        },
+        {
+          "text": "background of the invention",
+          "weight": 30
+        },
+        {
+          "text": "summary of the invention",
+          "weight": 30
+        },
+        {
+          "text": "brief description of the drawings",
+          "weight": 32
+        },
+        {
+          "text": "what is claimed is",
+          "weight": 36
+        },
+        {
+          "text": "the present invention",
+          "weight": 22
+        },
+        {
+          "text": "preferred embodiment",
+          "weight": 24
+        },
+        {
+          "text": "prior art",
+          "weight": 20
+        },
+        {
+          "text": "in one embodiment",
+          "weight": 18
+        },
+        {
+          "text": "references cited",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bus\\s?\\d{1,2},\\d{3},\\d{3}\\s?[ab]\\d?\\b",
+          "flags": "gi",
+          "weight": 20,
+          "name": "us patent number"
+        },
+        {
+          "pattern": "\\bus\\s?\\d{4}/\\d{7}\\s?a\\d\\b",
+          "flags": "gi",
+          "weight": 18,
+          "name": "us publication number"
+        },
+        {
+          "pattern": "\\bep\\s?\\d[\\s.]?\\d{3}[\\s.]?\\d{3}\\s?[ab]\\d\\b",
+          "flags": "gi",
+          "weight": 18,
+          "name": "ep publication number"
+        },
+        {
+          "pattern": "\\bwo\\s?\\d{4}/\\d{5,6}(\\s?a\\d)?\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "wo publication number"
+        },
+        {
+          "pattern": "(of|according to)\\sclaim\\s\\d{1,3}",
+          "flags": "gi",
+          "weight": 18,
+          "name": "claim reference"
+        },
+        {
+          "pattern": "int\\.?\\s?cl\\.?\\s?:?\\s?[a-h]\\d{2}[a-z]",
+          "flags": "gi",
+          "weight": 18,
+          "name": "ipc classification"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "patent",
+          "weight": 22,
+          "name": "patent keyword"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])us\\d{7,8}[ab]?\\d?",
+          "weight": 20,
+          "name": "us patent number filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])ep\\d{6,7}",
+          "weight": 18,
+          "name": "ep number filename"
+        },
+        {
+          "pattern": "(^|[^a-z0-9])wo\\d{4}",
+          "weight": 16,
+          "name": "wo publication filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "patent",
+          "weight": 12,
+          "name": "patent in title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "in witness whereof",
+          "weight": 18,
+          "name": "patent license contract"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "long_doc",
+          "weight": 3
+        },
+        {
+          "signal": "references_section",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "api-documentation",
+      "name": "API documentation",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "api reference",
+          "weight": 26,
+          "where": "title"
+        },
+        {
+          "text": "release notes",
+          "weight": 24,
+          "where": "title"
+        },
+        {
+          "text": "developer guide",
+          "weight": 22,
+          "where": "title"
+        },
+        {
+          "text": "administration guide",
+          "weight": 18,
+          "where": "title"
+        },
+        {
+          "text": "request body",
+          "weight": 20
+        },
+        {
+          "text": "query parameters",
+          "weight": 20
+        },
+        {
+          "text": "response body",
+          "weight": 18
+        },
+        {
+          "text": "environment variable",
+          "weight": 16
+        },
+        {
+          "text": "api key",
+          "weight": 14
+        },
+        {
+          "text": "changelog",
+          "weight": 18
+        },
+        {
+          "text": "known issues",
+          "weight": 14
+        },
+        {
+          "text": "localhost",
+          "weight": 12
+        },
+        {
+          "text": "configuration file",
+          "weight": 12
+        },
+        {
+          "text": "command line",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b(get|post|put|delete|patch)\\s/[a-z0-9_{}/.:-]{3,}",
+          "flags": "gi",
+          "weight": 18,
+          "name": "http endpoint"
+        },
+        {
+          "pattern": "\\$\\s?(sudo|npm|pip|git|docker|curl|apt|brew|systemctl|make)\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "shell command"
+        },
+        {
+          "pattern": "\"[a-z_]{2,24}\"\\s?:\\s?(\"|\\d|true|false|\\{|\\[)",
+          "flags": "g",
+          "weight": 12,
+          "name": "json snippet"
+        },
+        {
+          "pattern": "\\bv\\d+\\.\\d+\\.\\d+\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "semantic version"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(api|developer|dev|admin)[\\s_-]?(reference|guide|docs|documentation)",
+          "weight": 24,
+          "name": "api guide filename"
+        },
+        {
+          "pattern": "release[\\s_-]?notes|changelog",
+          "weight": 22,
+          "name": "release notes filename"
+        },
+        {
+          "pattern": "readme",
+          "weight": 16,
+          "name": "readme filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "any",
+          "pattern": "sphinx|mkdocs|doxygen|gitbook|asciidoctor|docusaurus",
+          "weight": 14,
+          "name": "docs generator"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "important safety instructions",
+          "weight": 16,
+          "name": "hardware manual"
+        },
+        {
+          "text": "safety data sheet",
+          "weight": 20,
+          "name": "sds heading"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "url_heavy",
+          "weight": 6
+        },
+        {
+          "signal": "toc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "safety-data-sheet",
+      "name": "Safety data sheet",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "safety data sheet",
+          "weight": 38,
+          "where": "title"
+        },
+        {
+          "text": "hazards identification",
+          "weight": 30
+        },
+        {
+          "text": "hazard identification",
+          "weight": 26
+        },
+        {
+          "text": "first aid measures",
+          "weight": 28
+        },
+        {
+          "text": "firefighting measures",
+          "weight": 26
+        },
+        {
+          "text": "accidental release measures",
+          "weight": 32
+        },
+        {
+          "text": "handling and storage",
+          "weight": 20
+        },
+        {
+          "text": "exposure controls",
+          "weight": 24
+        },
+        {
+          "text": "toxicological information",
+          "weight": 28
+        },
+        {
+          "text": "ecological information",
+          "weight": 24
+        },
+        {
+          "text": "disposal considerations",
+          "weight": 26
+        },
+        {
+          "text": "precautionary statements",
+          "weight": 24
+        },
+        {
+          "text": "signal word",
+          "weight": 22
+        },
+        {
+          "text": "flash point",
+          "weight": 14
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b\\d{2,7}-\\d{2}-\\d\\b",
+          "flags": "g",
+          "weight": 14,
+          "name": "cas number"
+        },
+        {
+          "pattern": "\\b[hp][1-5]\\d{2}\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "ghs hazard code"
+        },
+        {
+          "pattern": "regulation\\s\\(ec\\)\\s?no\\.?\\s?1907/2006",
+          "flags": "gi",
+          "weight": 20,
+          "name": "reach regulation"
+        },
+        {
+          "pattern": "\\bun\\s?\\d{4}\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "un number"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "(^|[^a-z0-9])m?sds([^a-z0-9]|$)",
+          "weight": 26,
+          "name": "sds filename"
+        },
+        {
+          "pattern": "safety[\\s_-]?data[\\s_-]?sheet",
+          "weight": 28,
+          "name": "safety data sheet filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "safety data sheet|msds",
+          "weight": 16,
+          "name": "sds title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "absolute maximum ratings",
+          "weight": 16,
+          "name": "datasheet section"
+        },
+        {
+          "text": "electrical characteristics",
+          "weight": 12,
+          "name": "datasheet section"
+        },
+        {
+          "text": "important safety instructions",
+          "weight": 12,
+          "name": "appliance manual heading"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "number_table",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "warranty-document",
+      "name": "Warranty document",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "warranty certificate",
+          "weight": 32,
+          "where": "title"
+        },
+        {
+          "text": "warranty card",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "limited warranty",
+          "weight": 28
+        },
+        {
+          "text": "this warranty covers",
+          "weight": 26
+        },
+        {
+          "text": "this warranty does not cover",
+          "weight": 26
+        },
+        {
+          "text": "warranty period",
+          "weight": 24
+        },
+        {
+          "text": "warranty registration",
+          "weight": 24
+        },
+        {
+          "text": "manufacturer's warranty",
+          "weight": 22
+        },
+        {
+          "text": "from the date of purchase",
+          "weight": 20
+        },
+        {
+          "text": "proof of purchase",
+          "weight": 18
+        },
+        {
+          "text": "implied warranties",
+          "weight": 16
+        },
+        {
+          "text": "normal wear and tear",
+          "weight": 14
+        },
+        {
+          "text": "extended warranty",
+          "weight": 14
+        },
+        {
+          "text": "repair or replace",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b\\d{1,2}[- ]year(?:s)?\\s+(?:limited\\s+)?(?:warranty|guarantee)",
+          "weight": 18,
+          "name": "N-year warranty"
+        },
+        {
+          "pattern": "warrant(?:y|ies)\\s+(?:is|are)\\s+void",
+          "weight": 14,
+          "name": "warranty void clause"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "warranty",
+          "weight": 28,
+          "name": "warranty in filename"
+        },
+        {
+          "pattern": "guarantee",
+          "weight": 18,
+          "name": "guarantee in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "warranty|guarantee",
+          "weight": 12,
+          "name": "warranty in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "policy number",
+          "weight": 16,
+          "name": "insurance policy field"
+        },
+        {
+          "text": "certificate of insurance",
+          "weight": 14,
+          "name": "COI heading"
+        },
+        {
+          "text": "troubleshooting",
+          "weight": 14,
+          "name": "user manual section"
+        },
+        {
+          "text": "premium",
+          "weight": 12,
+          "name": "insurance term"
+        },
+        {
+          "text": "table of contents",
+          "weight": 10,
+          "name": "manual TOC"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 4
+        }
+      ]
+    },
+    {
+      "id": "license-agreement",
+      "name": "License agreement",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "license certificate",
+          "weight": 30,
+          "where": "title"
+        },
+        {
+          "text": "license key",
+          "weight": 28
+        },
+        {
+          "text": "product key",
+          "weight": 26
+        },
+        {
+          "text": "activation code",
+          "weight": 26
+        },
+        {
+          "text": "activation instructions",
+          "weight": 24
+        },
+        {
+          "text": "perpetual license",
+          "weight": 22
+        },
+        {
+          "text": "number of seats",
+          "weight": 20
+        },
+        {
+          "text": "maintenance expires",
+          "weight": 20
+        },
+        {
+          "text": "licensed to",
+          "weight": 18
+        },
+        {
+          "text": "how to activate",
+          "weight": 18
+        },
+        {
+          "text": "your license",
+          "weight": 14
+        },
+        {
+          "text": "license type",
+          "weight": 14
+        },
+        {
+          "text": "serial number",
+          "weight": 6
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b[a-z0-9]{4,5}(?:-[a-z0-9]{4,5}){3,6}\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "hyphenated product key"
+        },
+        {
+          "pattern": "(?:license|licence|product|activation)\\s*(?:key|code)\\s*:?\\s*[a-z0-9][a-z0-9-]{9,39}",
+          "weight": 18,
+          "name": "license key field"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "licen[cs]e[-_ ]?key",
+          "weight": 28,
+          "name": "license key filename"
+        },
+        {
+          "pattern": "licen[cs]e[-_ ]?certificate",
+          "weight": 26,
+          "name": "license certificate filename"
+        },
+        {
+          "pattern": "product[-_ ]?key",
+          "weight": 24,
+          "name": "product key filename"
+        },
+        {
+          "pattern": "activation",
+          "weight": 16,
+          "name": "activation in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "license (certificate|key)",
+          "weight": 14,
+          "name": "license certificate in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "end user license agreement",
+          "weight": 20,
+          "name": "EULA legal text"
+        },
+        {
+          "text": "by installing or using",
+          "weight": 18,
+          "name": "EULA acceptance clause"
+        },
+        {
+          "text": "department of motor vehicles",
+          "weight": 14,
+          "name": "government license context"
+        },
+        {
+          "text": "terms and conditions",
+          "weight": 10,
+          "name": "T&C legal doc"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 8
+        },
+        {
+          "signal": "form_like",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "email-thread",
+      "name": "Email thread",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "original message",
+          "weight": 16
+        },
+        {
+          "text": "forwarded message",
+          "weight": 18
+        },
+        {
+          "text": "begin forwarded message",
+          "weight": 24
+        },
+        {
+          "text": "wrote:",
+          "weight": 6
+        },
+        {
+          "text": "sent from my iphone",
+          "weight": 24
+        },
+        {
+          "text": "reply all",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "from:\\s?[^\\n]{0,60}@[a-z0-9.\\-]+",
+          "flags": "gi",
+          "weight": 14,
+          "name": "From: with email address",
+          "where": "first"
+        },
+        {
+          "pattern": "sent:\\s?(monday|tuesday|wednesday|thursday|friday|saturday|sunday)",
+          "flags": "gi",
+          "weight": 20,
+          "name": "Sent: weekday header"
+        },
+        {
+          "pattern": "subject:\\s?(re|fw|fwd):",
+          "flags": "gi",
+          "weight": 22,
+          "name": "Re:/Fwd: subject header"
+        },
+        {
+          "pattern": "<[a-z0-9._%+\\-]+@[a-z0-9.\\-]+\\.[a-z]{2,}>",
+          "flags": "gi",
+          "weight": 8,
+          "name": "Angle-bracket email address"
+        },
+        {
+          "pattern": "\\bon [a-z]{3}, (\\d{1,2} [a-z]{3}|[a-z]{3} \\d{1,2}),? \\d{4}[^\\n]{0,60}wrote:",
+          "flags": "gi",
+          "weight": 16,
+          "name": "Quoted reply header"
+        },
+        {
+          "pattern": "sent from my (iphone|ipad|galaxy|android|mobile device)|get outlook for (ios|android)",
+          "flags": "gi",
+          "weight": 18,
+          "name": "Mobile signature"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "^gmail - ",
+          "weight": 26,
+          "name": "Gmail print filename"
+        },
+        {
+          "pattern": "(^|[\\\\/])(fw|fwd|re)[_ ]",
+          "weight": 16,
+          "name": "FW/RE filename prefix"
+        },
+        {
+          "pattern": "email",
+          "weight": 14,
+          "name": "Email in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "creator",
+          "pattern": "outlook|thunderbird",
+          "weight": 14,
+          "name": "Mail client creator"
+        },
+        {
+          "field": "title",
+          "pattern": "^(re|fw|fwd):",
+          "weight": 14,
+          "name": "Re:/Fwd: in PDF title"
+        },
+        {
+          "field": "title",
+          "pattern": "^gmail - ",
+          "weight": 16,
+          "name": "Gmail print title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "memorandum",
+          "weight": 18,
+          "name": "Memo heading"
+        },
+        {
+          "text": "for immediate release",
+          "weight": 20,
+          "name": "Press release wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "email_headers",
+          "weight": 12
+        }
+      ]
+    },
+    {
+      "id": "recipe",
+      "name": "Recipe",
+      "phrases": [
+        {
+          "text": "ingredients",
+          "weight": 10,
+          "where": "title"
+        },
+        {
+          "text": "preheat the oven",
+          "weight": 28
+        },
+        {
+          "text": "preheat oven to",
+          "weight": 26
+        },
+        {
+          "text": "prep time",
+          "weight": 22
+        },
+        {
+          "text": "cook time",
+          "weight": 20
+        },
+        {
+          "text": "servings",
+          "weight": 10
+        },
+        {
+          "text": "until golden brown",
+          "weight": 18
+        },
+        {
+          "text": "over medium heat",
+          "weight": 16
+        },
+        {
+          "text": "in a large bowl",
+          "weight": 14
+        },
+        {
+          "text": "season with salt and pepper",
+          "weight": 18
+        },
+        {
+          "text": "method",
+          "weight": 4,
+          "where": "title"
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\b\\d+ ?(cups?|tablespoons?|teaspoons?|tbsp|tsp)\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "Cooking measurement"
+        },
+        {
+          "pattern": "\\d{2,3} ?° ?[cf]\\b|\\b\\d{2,3} ?degrees ?[cf]?\\b",
+          "flags": "gi",
+          "weight": 10,
+          "name": "Oven temperature"
+        },
+        {
+          "pattern": "\\bserves \\d{1,2}\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "Serves N"
+        },
+        {
+          "pattern": "\\bbring to (a|the) (boil|simmer)\\b",
+          "flags": "gi",
+          "weight": 12,
+          "name": "Bring to a boil/simmer"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "recipe",
+          "weight": 25,
+          "name": "Recipe in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "recipe",
+          "weight": 12,
+          "name": "Recipe in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "safety data sheet",
+          "weight": 20,
+          "name": "SDS ingredients section"
+        },
+        {
+          "text": "please inform your server",
+          "weight": 15,
+          "name": "Menu wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 4
+        },
+        {
+          "signal": "bullet_heavy",
+          "weight": 4
+        }
+      ],
+      "emit": false
+    },
+    {
+      "id": "menu",
+      "name": "Menu",
+      "phrases": [
+        {
+          "text": "starters",
+          "weight": 14,
+          "where": "title"
+        },
+        {
+          "text": "appetizers",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "main courses",
+          "weight": 16,
+          "where": "title"
+        },
+        {
+          "text": "mains",
+          "weight": 10,
+          "where": "title"
+        },
+        {
+          "text": "desserts",
+          "weight": 12,
+          "where": "title"
+        },
+        {
+          "text": "wine list",
+          "weight": 18
+        },
+        {
+          "text": "tasting menu",
+          "weight": 16
+        },
+        {
+          "text": "please inform your server",
+          "weight": 26
+        },
+        {
+          "text": "ask your server",
+          "weight": 20
+        },
+        {
+          "text": "market price",
+          "weight": 18
+        },
+        {
+          "text": "food allergy or intolerance",
+          "weight": 22
+        },
+        {
+          "text": "allergen information is available",
+          "weight": 22
+        },
+        {
+          "text": "service charge",
+          "weight": 8
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\((v|vg|ve|gf)\\)",
+          "flags": "g",
+          "weight": 10,
+          "name": "Dietary marker (v)/(vg)"
+        },
+        {
+          "pattern": "\\.{3,} ?(£|\\$|€)?\\d{1,3}(\\.\\d{2})?",
+          "flags": "g",
+          "weight": 12,
+          "name": "Dotted price leader"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "menu",
+          "weight": 24,
+          "name": "Menu in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "menu",
+          "weight": 12,
+          "name": "Menu in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "pattern": "\\b\\d+ ?(cups?|tablespoons?|teaspoons?|tbsp|tsp)\\b",
+          "flags": "gi",
+          "weight": 14,
+          "name": "Cooking measurements (recipe)"
+        },
+        {
+          "text": "invoice number",
+          "weight": 15,
+          "name": "Invoice field"
+        },
+        {
+          "text": "subtotal",
+          "weight": 12,
+          "name": "Receipt field"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "currency_heavy",
+          "weight": 6
+        },
+        {
+          "signal": "short_doc",
+          "weight": 4
+        }
+      ],
+      "emit": false
+    },
+    {
+      "id": "book-ebook",
+      "name": "Book / eBook",
+      "phrases": [
+        {
+          "text": "no part of this publication may be reproduced",
+          "weight": 24,
+          "where": "first"
+        },
+        {
+          "text": "no part of this book",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "first published",
+          "weight": 20,
+          "where": "first"
+        },
+        {
+          "text": "first edition",
+          "weight": 14,
+          "where": "first"
+        },
+        {
+          "text": "printed in the united states of america",
+          "weight": 18,
+          "where": "first"
+        },
+        {
+          "text": "library of congress",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "catalogue record for this book",
+          "weight": 26,
+          "where": "first"
+        },
+        {
+          "text": "this is a work of fiction",
+          "weight": 22,
+          "where": "first"
+        },
+        {
+          "text": "about the author",
+          "weight": 14
+        },
+        {
+          "text": "prologue",
+          "weight": 12
+        },
+        {
+          "text": "epilogue",
+          "weight": 14
+        },
+        {
+          "text": "all rights reserved",
+          "weight": 6,
+          "where": "first"
+        },
+        {
+          "text": "table of contents",
+          "weight": 5
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "isbn(-1[03])?:? ?[0-9][0-9\\- ]{8,16}[0-9x]",
+          "flags": "gi",
+          "weight": 24,
+          "name": "ISBN"
+        },
+        {
+          "pattern": "\\bchapter (one|two|three|\\d{1,2})\\b",
+          "flags": "gi",
+          "weight": 10,
+          "name": "Chapter heading"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "ebook|e-book",
+          "weight": 22,
+          "name": "eBook in filename"
+        },
+        {
+          "pattern": "(^|[^a-z])book([^a-z]|$)",
+          "weight": 10,
+          "name": "Book in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "producer",
+          "pattern": "calibre",
+          "weight": 18,
+          "name": "calibre producer (ebook tool)"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "a thesis submitted",
+          "weight": 25,
+          "name": "Thesis wording"
+        },
+        {
+          "text": "user manual",
+          "weight": 18,
+          "name": "User manual"
+        },
+        {
+          "text": "instruction manual",
+          "weight": 15,
+          "name": "Instruction manual"
+        },
+        {
+          "pattern": "doi:? ?10\\.\\d{4}",
+          "flags": "gi",
+          "weight": 15,
+          "name": "DOI (academic paper)"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "long_doc",
+          "weight": 12
+        },
+        {
+          "signal": "toc",
+          "weight": 5
+        }
+      ],
+      "emit": false
+    },
+    {
+      "id": "magazine-article",
+      "name": "Magazine article",
+      "phrases": [
+        {
+          "text": "continued on page",
+          "weight": 24
+        },
+        {
+          "text": "photography by",
+          "weight": 20
+        },
+        {
+          "text": "words by",
+          "weight": 22
+        },
+        {
+          "text": "illustration by",
+          "weight": 16
+        },
+        {
+          "text": "contributing editor",
+          "weight": 20
+        },
+        {
+          "text": "editor-in-chief",
+          "weight": 14
+        },
+        {
+          "text": "in this issue",
+          "weight": 20
+        },
+        {
+          "text": "cover story",
+          "weight": 18
+        },
+        {
+          "text": "exclusive interview",
+          "weight": 16
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "\\bissue \\d{1,3}\\b",
+          "flags": "gi",
+          "weight": 8,
+          "name": "Issue number"
+        },
+        {
+          "pattern": "vol\\.? ?\\d{1,3},? (no\\.? ?\\d{1,3}|issue \\d{1,3})",
+          "flags": "gi",
+          "weight": 8,
+          "name": "Volume/issue"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "magazine",
+          "weight": 20,
+          "name": "Magazine in filename"
+        },
+        {
+          "pattern": "article|feature",
+          "weight": 10,
+          "name": "Article/feature in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "creator",
+          "pattern": "indesign",
+          "weight": 8,
+          "name": "InDesign creator"
+        }
+      ],
+      "negatives": [
+        {
+          "pattern": "doi:? ?10\\.\\d{4}",
+          "flags": "gi",
+          "weight": 20,
+          "name": "DOI (academic paper)"
+        },
+        {
+          "text": "abstract",
+          "weight": 12,
+          "name": "Abstract (academic)"
+        },
+        {
+          "text": "for immediate release",
+          "weight": 25,
+          "name": "Press release wording"
+        },
+        {
+          "text": "newsletter",
+          "weight": 18,
+          "name": "Newsletter"
+        }
+      ],
+      "structural": [],
+      "emit": false
+    },
+    {
+      "id": "form",
+      "name": "Form",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "please print clearly",
+          "weight": 24
+        },
+        {
+          "text": "check all that apply",
+          "weight": 24
+        },
+        {
+          "text": "please tick",
+          "weight": 18
+        },
+        {
+          "text": "for office use only",
+          "weight": 24
+        },
+        {
+          "text": "please complete all sections",
+          "weight": 22
+        },
+        {
+          "text": "do not write below this line",
+          "weight": 26
+        },
+        {
+          "text": "block capitals",
+          "weight": 20
+        },
+        {
+          "text": "attach additional sheets",
+          "weight": 20
+        },
+        {
+          "text": "permission slip",
+          "weight": 24
+        },
+        {
+          "text": "i give permission for my child",
+          "weight": 26
+        },
+        {
+          "text": "signature of applicant",
+          "weight": 14
+        },
+        {
+          "text": "parent/guardian",
+          "weight": 14
+        },
+        {
+          "text": "emergency contact",
+          "weight": 10
+        },
+        {
+          "text": "date of birth",
+          "weight": 5
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "_{6,}",
+          "flags": "g",
+          "weight": 12,
+          "name": "Fill-in blanks"
+        },
+        {
+          "pattern": "☐|❏|❑|\\[ ?\\]",
+          "flags": "g",
+          "weight": 12,
+          "name": "Checkbox marks"
+        },
+        {
+          "pattern": "_{2,} ?\\/ ?_{2,}",
+          "flags": "g",
+          "weight": 12,
+          "name": "Date fill-in blank"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "permission[_\\- ]slip|consent[_\\- ]form",
+          "weight": 24,
+          "name": "Permission/consent form filename"
+        },
+        {
+          "pattern": "form",
+          "weight": 12,
+          "name": "Form in filename"
+        },
+        {
+          "pattern": "application",
+          "weight": 10,
+          "name": "Application in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "\\bform\\b",
+          "weight": 8,
+          "name": "Form in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "pattern": "omb (approval )?(control )?(no\\.?|number|#):? ?\\d{4}-\\d{4}",
+          "flags": "gi",
+          "weight": 28,
+          "name": "OMB control number (US federal form)"
+        },
+        {
+          "pattern": "internal revenue service|\\birs\\b|form 1040|form w-[249]\\b|\\bhmrc\\b|self assessment|employer identification number|\\bp45\\b|\\bp60\\b",
+          "flags": "gi",
+          "weight": 24,
+          "name": "Tax authority form"
+        },
+        {
+          "pattern": "uscis|department of homeland security|form (i|n|g|ds|ar)-\\d{1,4}\\b|alien registration number|permanent resident",
+          "flags": "gi",
+          "weight": 24,
+          "name": "Immigration/government form"
+        },
+        {
+          "pattern": "\\(rev\\.? ?(\\d{1,2}[-/.]\\d{2,4}|[a-z]{3,9} \\d{4})\\)|cat\\.? no\\.? ?\\d{4,6}[a-z]?",
+          "flags": "gi",
+          "weight": 16,
+          "name": "Official form revision/catalog stamp"
+        },
+        {
+          "pattern": "\\b(department|bureau|ministry|division|office|borough) of (public safety|health|state|motor vehicles|homeland security|veterans affairs|vital statistics|revenue|labor|labour|transportation|transport|human services|social services|home affairs|the interior|consular affairs)\\b|driver license division|driving licence",
+          "flags": "gi",
+          "weight": 22,
+          "name": "Government agency letterhead"
+        },
+        {
+          "pattern": "national insurance number|social security number|\\bssn\\b|\\bnino\\b",
+          "flags": "gi",
+          "weight": 16,
+          "name": "National ID number field"
+        },
+        {
+          "pattern": "penalt(y|ies) of perjury",
+          "flags": "gi",
+          "weight": 18,
+          "name": "Perjury declaration (tax/gov form)"
+        },
+        {
+          "text": "policy number",
+          "weight": 12,
+          "name": "Insurance claim form"
+        },
+        {
+          "pattern": "\\bform\\s+[a-z]{1,4}[- ]?\\d{1,4}[a-z]?\\b",
+          "flags": "gi",
+          "weight": 20,
+          "name": "Official agency form number"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "form_like",
+          "weight": 12
+        },
+        {
+          "signal": "short_doc",
+          "weight": 3
+        }
+      ]
+    },
+    {
+      "id": "invitation",
+      "name": "Invitation",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "you are cordially invited",
+          "weight": 34
+        },
+        {
+          "text": "request the pleasure of your company",
+          "weight": 34
+        },
+        {
+          "text": "cordially invite",
+          "weight": 28
+        },
+        {
+          "text": "celebrate the marriage of",
+          "weight": 28
+        },
+        {
+          "text": "save the date",
+          "weight": 26
+        },
+        {
+          "text": "reception to follow",
+          "weight": 26
+        },
+        {
+          "text": "you are invited",
+          "weight": 22
+        },
+        {
+          "text": "kindly respond by",
+          "weight": 22
+        },
+        {
+          "text": "invites you to",
+          "weight": 20
+        },
+        {
+          "text": "rsvp",
+          "weight": 18
+        },
+        {
+          "text": "guest of honor",
+          "weight": 14
+        },
+        {
+          "text": "invitation",
+          "weight": 10,
+          "where": "title"
+        },
+        {
+          "text": "dress code",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "rsvp\\s+(?:by|to|at|before)",
+          "weight": 16,
+          "name": "RSVP by/to"
+        },
+        {
+          "pattern": "black[- ]tie",
+          "weight": 12,
+          "name": "black tie dress code"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "invitation",
+          "weight": 26,
+          "name": "invitation in filename"
+        },
+        {
+          "pattern": "save[-_ ]?the[-_ ]?date",
+          "weight": 26,
+          "name": "save the date filename"
+        },
+        {
+          "pattern": "invite",
+          "weight": 16,
+          "name": "invite in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "invitation|save the date",
+          "weight": 12,
+          "name": "invitation in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "admit one",
+          "weight": 20,
+          "name": "event ticket wording"
+        },
+        {
+          "text": "general admission",
+          "weight": 18,
+          "name": "event ticket wording"
+        },
+        {
+          "text": "no re-entry",
+          "weight": 16,
+          "name": "event ticket wording"
+        },
+        {
+          "text": "boarding pass",
+          "weight": 14,
+          "name": "boarding pass heading"
+        },
+        {
+          "text": "order confirmation",
+          "weight": 12,
+          "name": "retail order heading"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "gift-certificate",
+      "name": "Gift certificate",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "gift voucher",
+          "weight": 30
+        },
+        {
+          "text": "gift certificate",
+          "weight": 28
+        },
+        {
+          "text": "this voucher entitles",
+          "weight": 28
+        },
+        {
+          "text": "gift card",
+          "weight": 24
+        },
+        {
+          "text": "voucher code",
+          "weight": 24
+        },
+        {
+          "text": "redeem this voucher",
+          "weight": 24
+        },
+        {
+          "text": "not redeemable for cash",
+          "weight": 24
+        },
+        {
+          "text": "gift card number",
+          "weight": 22
+        },
+        {
+          "text": "redeemable at",
+          "weight": 22
+        },
+        {
+          "text": "no cash value",
+          "weight": 20
+        },
+        {
+          "text": "to redeem",
+          "weight": 14
+        },
+        {
+          "text": "promo code",
+          "weight": 10
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "(?:gift\\s*card|voucher|certificate)\\s*(?:number|no\\.?|code|#)\\s*:?\\s*[a-z0-9][a-z0-9 -]{5,24}",
+          "weight": 16,
+          "name": "gift card/voucher code field"
+        },
+        {
+          "pattern": "(?:check|view)\\s+your\\s+balance",
+          "weight": 12,
+          "name": "check your balance"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "gift[-_ ]?card",
+          "weight": 28,
+          "name": "gift card filename"
+        },
+        {
+          "pattern": "gift[-_ ]?certificate",
+          "weight": 26,
+          "name": "gift certificate filename"
+        },
+        {
+          "pattern": "voucher",
+          "weight": 24,
+          "name": "voucher in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "gift (card|certificate|voucher)",
+          "weight": 12,
+          "name": "gift card in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "boarding pass",
+          "weight": 16,
+          "name": "boarding pass heading"
+        },
+        {
+          "text": "admit one",
+          "weight": 14,
+          "name": "event ticket wording"
+        },
+        {
+          "text": "fare basis",
+          "weight": 12,
+          "name": "e-ticket term"
+        },
+        {
+          "text": "invoice number",
+          "weight": 10,
+          "name": "invoice field"
+        },
+        {
+          "text": "your subscription",
+          "weight": 10,
+          "name": "subscription context"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 8
+        }
+      ]
+    },
+    {
+      "id": "confirmation-letter",
+      "name": "Confirmation letter",
+      "emit": true,
+      "phrases": [
+        {
+          "text": "appointment confirmation",
+          "weight": 34,
+          "where": "title"
+        },
+        {
+          "text": "your appointment has been confirmed",
+          "weight": 30
+        },
+        {
+          "text": "your appointment is scheduled",
+          "weight": 28
+        },
+        {
+          "text": "appointment reminder",
+          "weight": 28,
+          "where": "title"
+        },
+        {
+          "text": "your upcoming appointment",
+          "weight": 26
+        },
+        {
+          "text": "if you are unable to attend",
+          "weight": 20
+        },
+        {
+          "text": "cancel or reschedule",
+          "weight": 20
+        },
+        {
+          "text": "please arrive",
+          "weight": 16
+        },
+        {
+          "text": "failure to attend",
+          "weight": 16
+        },
+        {
+          "text": "to reschedule",
+          "weight": 14
+        },
+        {
+          "text": "appointment date",
+          "weight": 12
+        },
+        {
+          "text": "appointment time",
+          "weight": 12
+        }
+      ],
+      "regexes": [
+        {
+          "pattern": "appointment\\s*(?:date|time|ref(?:erence)?)\\s*:?",
+          "weight": 10,
+          "name": "appointment field labels"
+        },
+        {
+          "pattern": "(?:cancel|change|reschedule)\\s+your\\s+appointment",
+          "weight": 16,
+          "name": "cancel/reschedule your appointment"
+        },
+        {
+          "pattern": "please arrive\\s+\\d{1,2}\\s+minutes",
+          "weight": 14,
+          "name": "arrive N minutes early"
+        }
+      ],
+      "filenames": [
+        {
+          "pattern": "appointment",
+          "weight": 28,
+          "name": "appointment in filename"
+        },
+        {
+          "pattern": "appt",
+          "weight": 18,
+          "name": "appt abbreviation in filename"
+        }
+      ],
+      "metadata": [
+        {
+          "field": "title",
+          "pattern": "appointment",
+          "weight": 14,
+          "name": "appointment in PDF title"
+        }
+      ],
+      "negatives": [
+        {
+          "text": "check-out date",
+          "weight": 16,
+          "name": "hotel confirmation field"
+        },
+        {
+          "text": "your booking is confirmed",
+          "weight": 14,
+          "name": "travel booking wording"
+        },
+        {
+          "text": "boarding pass",
+          "weight": 12,
+          "name": "boarding pass heading"
+        },
+        {
+          "text": "prescription",
+          "weight": 12,
+          "name": "prescription wording"
+        },
+        {
+          "text": "referral",
+          "weight": 10,
+          "name": "referral letter wording"
+        }
+      ],
+      "structural": [
+        {
+          "signal": "short_doc",
+          "weight": 8
+        },
+        {
+          "signal": "address_block",
+          "weight": 4
+        }
+      ]
+    }
+  ],
+  "priors": {
+    "resume": [1, 6],
+    "cover-letter": [1, 3],
+    "letter": [1, 5],
+    "memo": [1, 5],
+    "ticket": [1, 4],
+    "invitation": [1, 3],
+    "receipt": [1, 3],
+    "invoice": [1, 6],
+    "quote": [1, 10],
+    "purchase-order": [1, 8],
+    "remittance-advice": [1, 3],
+    "payslip": [1, 3],
+    "tax-form": [1, 10],
+    "tax-statement": [1, 8],
+    "subscription-confirmation": [1, 3],
+    "order-confirmation": [1, 4],
+    "donation-receipt": [1, 2],
+    "confirmation-letter": [1, 2],
+    "gift-certificate": [1, 2],
+    "waybill": [1, 2],
+    "return-authorization": [1, 2],
+    "packing-slip": [1, 3],
+    "delivery-note": [1, 3],
+    "prescription": [1, 2],
+    "referral-letter": [1, 3],
+    "immunization-record": [1, 4],
+    "medical-invoice": [1, 6],
+    "certificate": [1, 2],
+    "insurance-certificate": [1, 4],
+    "license": [1, 5],
+    "utility-bill": [1, 10],
+    "benefits-summary": [1, 8],
+    "government-notice": [1, 6],
+    "hoa-document": [1, 5],
+    "legal-notice": [1, 6],
+    "menu": [1, 8],
+    "recipe": [1, 6],
+    "timesheet": [1, 3],
+    "organization-chart": [1, 5],
+    "meeting-agenda": [1, 5],
+    "job-description": [1, 6],
+    "offer-letter": [1, 5],
+    "reference-letter": [1, 3],
+    "email-thread": [1, 8],
+    "nda": [1, 12],
+    "affidavit": [1, 8],
+    "investment-summary": [1, 12],
+    "letter-of-intent": [1, 15],
+    "credit-note": [1, 3],
+    "public-notice": [1, 4],
+    "subpoena": [1, 6],
+    "service-agreement": [1, 6],
+    "consent-form": [1, 4],
+    "discharge-summary": [1, 6],
+    "grade-report": [1, 4],
+    "registration-form": [1, 6],
+    "supply-order": [1, 3],
+    "grant-agreement": [1, 4],
+    "technical-drawing": [1, 12],
+    "compliance-document": [1, 3],
+    "test-report": [1, 4],
+    "book-ebook": [30, null],
+    "thesis": [20, null],
+    "regulatory-filing": [12, null],
+    "audit-report": [10, null],
+    "business-plan": [8, null],
+    "user-guide": [5, null],
+    "employee-handbook": [8, null]
+  }
+}
diff --git a/frontend/editor/src/proprietary/services/heuristic/heuristicRules.lint.test.ts b/frontend/editor/src/proprietary/services/heuristic/heuristicRules.lint.test.ts
new file mode 100644
index 0000000000..d21d9a79bd
--- /dev/null
+++ b/frontend/editor/src/proprietary/services/heuristic/heuristicRules.lint.test.ts
@@ -0,0 +1,173 @@
+// Structural lint for the rules pack: the engine silently drops or clamps
+// malformed rules, so authoring mistakes must fail here instead.
+
+import { describe, expect, it } from "vitest";
+import { compileRegex } from "@app/services/heuristic/heuristicEngine";
+import rules from "@app/services/heuristic/heuristicRules.json";
+
+interface RawRule {
+  text?: string;
+  pattern?: string;
+  weight?: number;
+  where?: string;
+  flags?: string;
+  field?: string;
+  signal?: string;
+}
+interface RawLabel {
+  id: string;
+  emit?: boolean;
+  phrases?: RawRule[];
+  regexes?: RawRule[];
+  filenames?: RawRule[];
+  metadata?: RawRule[];
+  negatives?: RawRule[];
+  structural?: RawRule[];
+}
+const labels = (rules as { labels: RawLabel[] }).labels;
+const priors = (rules as { priors: Record<string, unknown> }).priors;
+
+// Mirrors computeStructural's emitted keys; extend together with the engine.
+const SIGNALS = new Set([
+  "currency_heavy",
+  "number_table",
+  "form_like",
+  "toc",
+  "signature_block",
+  "references_section",
+  "short_doc",
+  "long_doc",
+  "bullet_heavy",
+  "email_headers",
+  "url_heavy",
+  "address_block",
+]);
+const ZONES = new Set(["title", "first", "any"]);
+const META_FIELDS = new Set([
+  "title",
+  "author",
+  "subject",
+  "keywords",
+  "creator",
+  "producer",
+  "any",
+]);
+// The engine clamps at these; authoring past them is a hidden no-op, so fail instead.
+const WEIGHT_CAPS = {
+  phrases: 40,
+  regexes: 30,
+  filenames: 30,
+  metadata: 20,
+  negatives: 30,
+  structural: 12,
+} as const;
+
+describe("heuristicRules.json pack lint", () => {
+  it("has unique, non-empty label ids", () => {
+    const ids = labels.map((l) => l.id);
+    expect(ids.every((id) => typeof id === "string" && id.length > 0)).toBe(
+      true,
+    );
+    expect(new Set(ids).size).toBe(ids.length);
+  });
+
+  it("keys every page prior to an existing label id", () => {
+    const ids = new Set(labels.map((l) => l.id));
+    const orphans = Object.keys(priors).filter((k) => !ids.has(k));
+    expect(orphans, "priors keyed to no label never apply").toEqual([]);
+  });
+
+  it("compiles every regex/filename/metadata/negative pattern", () => {
+    const broken: string[] = [];
+    for (const label of labels) {
+      for (const kind of ["regexes", "filenames", "metadata"] as const) {
+        for (const r of label[kind] ?? []) {
+          if (compileRegex(r.pattern ?? null, r.flags ?? "") == null) {
+            broken.push(`${label.id} ${kind}: ${r.pattern}`);
+          }
+        }
+      }
+      for (const n of label.negatives ?? []) {
+        if (
+          n.pattern != null &&
+          compileRegex(n.pattern, n.flags ?? "") == null
+        ) {
+          broken.push(`${label.id} negative: ${n.pattern}`);
+        }
+      }
+    }
+    expect(broken, "non-compiling patterns are silently dropped").toEqual([]);
+  });
+
+  it("uses only structural signals the engine computes", () => {
+    const unknown: string[] = [];
+    for (const label of labels) {
+      for (const s of label.structural ?? []) {
+        if (!SIGNALS.has(s.signal ?? "")) {
+          unknown.push(`${label.id}: ${s.signal}`);
+        }
+      }
+    }
+    expect(unknown, "unknown signals always score 0").toEqual([]);
+  });
+
+  it("uses only zones and metadata fields the engine reads", () => {
+    const bad: string[] = [];
+    for (const label of labels) {
+      for (const kind of ["phrases", "regexes"] as const) {
+        for (const r of label[kind] ?? []) {
+          if (r.where != null && !ZONES.has(r.where)) {
+            bad.push(`${label.id} ${kind} where: ${r.where}`);
+          }
+        }
+      }
+      for (const m of label.metadata ?? []) {
+        if (m.field != null && !META_FIELDS.has(m.field)) {
+          bad.push(`${label.id} metadata field: ${m.field}`);
+        }
+      }
+    }
+    expect(bad).toEqual([]);
+  });
+
+  it("keeps every weight positive and within the engine's clamp", () => {
+    const bad: string[] = [];
+    for (const label of labels) {
+      for (const kind of [
+        "phrases",
+        "regexes",
+        "filenames",
+        "metadata",
+        "negatives",
+        "structural",
+      ] as const) {
+        for (const r of label[kind] ?? []) {
+          const w = r.weight;
+          if (typeof w !== "number" || !Number.isFinite(w) || w <= 0) {
+            bad.push(`${label.id} ${kind}: weight ${String(w)}`);
+          } else if (Math.abs(w) > WEIGHT_CAPS[kind]) {
+            bad.push(`${label.id} ${kind}: weight ${w} over cap`);
+          }
+        }
+      }
+    }
+    expect(bad).toEqual([]);
+  });
+
+  it("gives every phrase a non-empty text and every negative a matcher", () => {
+    const bad: string[] = [];
+    for (const label of labels) {
+      for (const p of label.phrases ?? []) {
+        if (typeof p.text !== "string" || p.text.trim().length === 0) {
+          bad.push(`${label.id} phrase with empty text`);
+        }
+      }
+      for (const n of label.negatives ?? []) {
+        if (n.text == null && n.pattern == null) {
+          bad.push(`${label.id} negative with neither text nor pattern`);
+        }
+      }
+    }
+    expect(bad).toEqual([]);
+  });
+});
diff --git a/frontend/editor/src/proprietary/services/heuristic/types.ts b/frontend/editor/src/proprietary/services/heuristic/types.ts
new file mode 100644
index 0000000000..fbd8128ba4
--- /dev/null
+++ b/frontend/editor/src/proprietary/services/heuristic/types.ts
@@ -0,0 +1,42 @@
+// Shared types for the client-side heuristic (non-AI) document classifier.
+
+/** Input document for the heuristic engine. */
+export interface HeuristicDoc {
+  fileName: string;
+  pageCount: number;
+  meta: Record<string, string>;
+  titleZone: string;
+  firstZone: string;
+  allZone: string;
+}
+
+// "none" = no match or non-English; a real runtime value, not just a type state.
+export type HeuristicConfidence = "none" | "low" | "medium" | "high";
+
+/** One scored candidate label with the rule hits that produced its score (debug only). */
+export interface LabelScoreExplanation {
+  id: string;
+  emit: boolean;
+  score: number;
+  distinct: number;
+  /** Human-readable contributions, e.g. `phrase "tax invoice" +60 (title)`. */
+  signals: string[];
+}
+
+/** Why a document scored the way it did; produced only when explain is requested. */
+export interface HeuristicExplanation {
+  isEnglish: boolean;
+  lowText: boolean;
+  /** Top candidates by score, best first. Empty when rejected as non-English. */
+  candidates: LabelScoreExplanation[];
+}
+
+/** Classification outcome: emitted vocabulary label ids (primary first, capped at 5). */
+export interface HeuristicResult {
+  labels: string[];
+  confidence: HeuristicConfidence;
+  score: number;
+  isEnglish: boolean;
+  /** Present only when classify was called with `{ explain: true }`. */
+  explain?: HeuristicExplanation;
+}
diff --git a/frontend/editor/src/proprietary/utils/scheduleIdle.ts b/frontend/editor/src/proprietary/utils/scheduleIdle.ts
new file mode 100644
index 0000000000..8d3e5bec96
--- /dev/null
+++ b/frontend/editor/src/proprietary/utils/scheduleIdle.ts
@@ -0,0 +1,11 @@
+// Idle-time scheduling shared by the classification/backfill passes.
+
+/** Schedule work for the browser's idle time (or soon after, as a fallback). */
+export function scheduleIdle(task: () => void): () => void {
+  if (typeof requestIdleCallback === "function") {
+    const handle = requestIdleCallback(task, { timeout: 2000 });
+    return () => cancelIdleCallback(handle);
+  }
+  const timer = window.setTimeout(task, 200);
+  return () => window.clearTimeout(timer);
+}
diff --git a/frontend/editor/src/saas/hooks/useClassificationEnabled.ts b/frontend/editor/src/saas/hooks/useClassificationEnabled.ts
deleted file mode 100644
index a776f77986..0000000000
--- a/frontend/editor/src/saas/hooks/useClassificationEnabled.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-// SaaS override of the classification-enabled seam: classification is available
-// exactly when the AI engine is on for this tenant. Off → the sidebar grouping,
-// group-picker, per-file label chips and the file-details Classification section
-// all stay hidden, so an AI-disabled SaaS tenant sees the plain flat file list
-// with no hint the feature exists.
-
-import { useAiEngineEnabled } from "@app/hooks/useAiEngineEnabled";
-
-export function useClassificationEnabled(): boolean {
-  return useAiEngineEnabled();
-}

From 8de94ff152b4fea4ba65014401cf04ec1e86a319 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Thu, 23 Jul 2026 08:29:06 +0000
Subject: [PATCH 086/109] Ai customization settings (#7069)

# Description of Changes
AI settings customisation in settings menu, as part of this also tested
and fixed ollama and other 3rd party AI integrations

- Adds an admin AI settings UI for customizing AI behaviour, including
per-provider model and API-key configuration
- Backend pushes AI config changes to the Python engine at runtime via a
config-push bridge, so changes apply without a restart
- Config-push is gated off in SaaS; engine now drains background tasks
on shutdown instead of cancelling them
---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../common/model/ApplicationProperties.java   |  96 ++++
 .../controller/api/misc/ConfigController.java |  14 +-
 .../src/main/resources/settings.yml.template  |  31 ++
 .../controller/api/AiEngineController.java    |  21 +-
 .../api/ClassifyLabelController.java          |   5 +
 .../api/CreatePdfAgentController.java         |   4 +-
 .../api/MathAuditorAgentController.java       |   3 +
 .../api/PdfCommentAgentController.java        |   3 +
 .../api/AdminSettingsController.java          | 106 +++-
 .../service/AiEngineConfigSync.java           | 282 ++++++++++
 .../proprietary/service/AiFeatureGate.java    |  56 ++
 .../api/ClassifyLabelControllerTest.java      |   3 +
 .../api/PdfCommentAgentControllerTest.java    |  27 +-
 .../api/AdminSettingsControllerTest.java      | 102 +++-
 .../service/AiEngineConfigSyncTest.java       | 251 +++++++++
 .../service/AiFeatureGateTest.java            |  77 +++
 .../resources/application-saas.properties     |   5 +
 engine/.env                                   |   4 +
 engine/pyproject.toml                         |   1 +
 .../src/stirling/agents/math_presentation.py  |   4 +
 engine/src/stirling/agents/orchestrator.py    |  79 ++-
 engine/src/stirling/agents/output_mode.py     |  28 +
 engine/src/stirling/agents/pdf_questions.py   |  10 +-
 engine/src/stirling/api/app.py                | 182 +++++--
 engine/src/stirling/api/bootstrap.py          |  72 +++
 engine/src/stirling/api/routes/__init__.py    |   2 +
 engine/src/stirling/api/routes/config.py      | 250 +++++++++
 engine/src/stirling/config/config_cache.py    | 116 ++++
 engine/src/stirling/config/settings.py        |  12 +
 engine/src/stirling/contracts/__init__.py     |  12 +
 engine/src/stirling/contracts/config.py       |  69 +++
 engine/src/stirling/documents/embedder.py     |  29 +-
 engine/src/stirling/documents/service.py      |  18 +
 engine/src/stirling/services/runtime.py       | 144 ++++-
 .../tests/fixtures/processor_config_push.json |  24 +
 engine/tests/test_config_cache.py             | 111 ++++
 engine/tests/test_config_contract.py          |  70 +++
 engine/tests/test_config_routes.py            | 383 +++++++++++++
 engine/uv.lock                                |   2 +
 .../public/locales/en-US/translation.toml     | 167 ++++++
 frontend/editor/public/og-metadata.json       |  24 +
 frontend/editor/public/og-metadata.saas.json  |  24 +
 .../core/components/shared/config/types.ts    |   4 +
 .../shared/config/configNavSections.tsx       |  43 ++
 .../AdminAiDocumentsSection.tsx               | 383 +++++++++++++
 .../configSections/AdminAiGeneralSection.tsx  | 511 ++++++++++++++++++
 .../configSections/AdminAiLimitsSection.tsx   | 198 +++++++
 .../configSections/AdminAiModelsSection.tsx   | 391 ++++++++++++++
 .../configSections/aiEngineSettings.test.ts   |  57 ++
 .../config/configSections/aiEngineSettings.ts | 101 ++++
 .../config/saasConfigNavSections.test.tsx     |  52 ++
 51 files changed, 4568 insertions(+), 95 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/service/AiEngineConfigSync.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/service/AiFeatureGate.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/service/AiEngineConfigSyncTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/service/AiFeatureGateTest.java
 create mode 100644 engine/src/stirling/agents/output_mode.py
 create mode 100644 engine/src/stirling/api/bootstrap.py
 create mode 100644 engine/src/stirling/api/routes/config.py
 create mode 100644 engine/src/stirling/config/config_cache.py
 create mode 100644 engine/src/stirling/contracts/config.py
 create mode 100644 engine/tests/fixtures/processor_config_push.json
 create mode 100644 engine/tests/test_config_cache.py
 create mode 100644 engine/tests/test_config_contract.py
 create mode 100644 engine/tests/test_config_routes.py
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiDocumentsSection.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiGeneralSection.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiLimitsSection.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiModelsSection.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/aiEngineSettings.test.ts
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/aiEngineSettings.ts
 create mode 100644 frontend/editor/src/saas/components/shared/config/saasConfigNavSections.test.tsx

diff --git a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
index b55fc381bb..2aa8413cf6 100644
--- a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
+++ b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
@@ -305,6 +305,102 @@ public class ApplicationProperties {
          * explicitly requests it via {@code AiEngineClient.postWithTimeout}.
          */
         private int longRunningTimeoutSeconds = 600;
+
+        /** Timeout (seconds) for the SSE stream held open by long-running orchestrator runs. */
+        private int streamTimeoutSeconds = 1800;
+
+        /**
+         * Whether the processor pushes settings-derived AI config to the engine on startup/save.
+         * Pin false for env-driven deployments (SaaS) to keep the engine env-controlled.
+         */
+        private boolean pushConfigToEngine = true;
+
+        /** Model + provider selection, forwarded to the engine per-request. */
+        private Models models = new Models();
+
+        /** Retrieval-augmented-generation (RAG) knobs, forwarded to the engine per-request. */
+        private Rag rag = new Rag();
+
+        /** Request size / cost guardrails. */
+        private Limits limits = new Limits();
+
+        /** Per-capability on/off switches so an admin can disable individual AI tools. */
+        private Features features = new Features();
+
+        @Data
+        public static class Models {
+            /** Provider driving the model strings: 'anthropic', 'openai', 'ollama', or 'custom'. */
+            private String provider = "anthropic";
+
+            /** High-quality tier model name (without provider prefix), e.g. 'claude-haiku-4-5'. */
+            private String smartModel = "claude-haiku-4-5";
+
+            /** Cheap/fast tier model name (without provider prefix). */
+            private String fastModel = "claude-haiku-4-5";
+
+            private int smartMaxTokens = 8192;
+            private int fastMaxTokens = 2048;
+
+            /**
+             * API key for the selected provider (secret; masked). Empty means the engine uses its
+             * own env credential (e.g. ANTHROPIC_API_KEY).
+             */
+            private String apiKey = "";
+
+            /**
+             * OpenAI-compatible base URL for 'ollama' / 'custom' providers (e.g.
+             * http://ollama:11434/v1). Ignored for anthropic/openai. SSRF-sensitive - admin only.
+             */
+            private String baseUrl = "";
+        }
+
+        @Data
+        public static class Rag {
+            /**
+             * Embedding provider: 'voyageai', 'openai', 'ollama', or 'custom' (OpenAI-compatible).
+             */
+            private String embeddingProvider = "voyageai";
+
+            /** Embedding model name (without provider prefix), e.g. 'voyage-4'. */
+            private String embeddingModel = "voyage-4";
+
+            /**
+             * Secret API key for the embedding provider; masked + env-overridable like
+             * models.apiKey.
+             */
+            private String embeddingApiKey = "";
+
+            /**
+             * OpenAI-compatible base URL for 'ollama' / 'custom' embedding providers (e.g.
+             * http://ollama:11434/v1). Ignored for voyageai/openai. SSRF-sensitive - admin only.
+             */
+            private String embeddingBaseUrl = "";
+
+            /** How many chunks retrieval returns per search. */
+            private int topK = 20;
+
+            /** Per-run cap on knowledge-search tool calls before the agent must answer. */
+            private int maxSearches = 5;
+        }
+
+        @Data
+        public static class Limits {
+            private int maxPages = 200;
+            private int maxCharacters = 200000;
+
+            /** Process-wide cap on concurrent model API calls (engine restart to apply). */
+            private int modelMaxConcurrency = 32;
+        }
+
+        @Data
+        public static class Features {
+            private boolean chat = true;
+            private boolean documentQuestions = true;
+            private boolean createPdf = true;
+            private boolean mathAuditor = true;
+            private boolean pdfComment = true;
+            private boolean classify = true;
+        }
     }
 
     /**
diff --git a/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java b/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java
index 27477f9c2a..8044050025 100644
--- a/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java
+++ b/app/core/src/main/java/stirling/software/SPDF/controller/api/misc/ConfigController.java
@@ -336,7 +336,19 @@ public class ConfigController {
             configData.put("premiumEnabled", applicationProperties.getPremium().isEnabled());
 
             // AI Engine settings
-            configData.put("aiEngineEnabled", applicationProperties.getAiEngine().isEnabled());
+            ApplicationProperties.AiEngine aiEngineConfig = applicationProperties.getAiEngine();
+            configData.put("aiEngineEnabled", aiEngineConfig.isEnabled());
+            // Per-capability flags let the UI hide individual AI tools an admin has turned off.
+            ApplicationProperties.AiEngine.Features aiFeatures = aiEngineConfig.getFeatures();
+            configData.put(
+                    "aiFeatures",
+                    Map.ofEntries(
+                            Map.entry("chat", aiFeatures.isChat()),
+                            Map.entry("documentQuestions", aiFeatures.isDocumentQuestions()),
+                            Map.entry("createPdf", aiFeatures.isCreatePdf()),
+                            Map.entry("mathAuditor", aiFeatures.isMathAuditor()),
+                            Map.entry("pdfComment", aiFeatures.isPdfComment()),
+                            Map.entry("classify", aiFeatures.isClassify())));
 
             // Timestamp TSA settings — single source of truth for presets + admin URLs
             ApplicationProperties.Security.Timestamp tsConfig =
diff --git a/app/core/src/main/resources/settings.yml.template b/app/core/src/main/resources/settings.yml.template
index 85d97158b3..2d227c34a2 100644
--- a/app/core/src/main/resources/settings.yml.template
+++ b/app/core/src/main/resources/settings.yml.template
@@ -366,6 +366,35 @@ aiEngine:
   enabled: false # Set to 'true' to enable the AI engine integration
   url: http://localhost:5001 # URL of the Python AI engine
   timeoutSeconds: 120 # Timeout in seconds for AI engine requests
+  longRunningTimeoutSeconds: 600 # Timeout (seconds) for heavy operations like RAG ingestion of large documents
+  streamTimeoutSeconds: 1800 # SSE stream timeout (seconds) for long-running orchestrator runs
+  pushConfigToEngine: true # Push admin AI config to the engine on startup + save; false = engine stays fully env-controlled
+  models:
+    provider: anthropic # Model provider: 'anthropic', 'openai', 'ollama', or 'custom' (OpenAI-compatible)
+    smartModel: claude-haiku-4-5 # High-quality tier model name (no provider prefix)
+    fastModel: claude-haiku-4-5 # Cheap/fast tier model name (no provider prefix)
+    smartMaxTokens: 8192 # Max output tokens for the smart tier
+    fastMaxTokens: 2048 # Max output tokens for the fast tier
+    apiKey: "" # API key for the selected provider (secret). Empty = engine uses its native env credentials (e.g. ANTHROPIC_API_KEY)
+    baseUrl: "" # OpenAI-compatible base URL for 'ollama'/'custom' providers (e.g. http://ollama:11434/v1). Ignored for anthropic/openai
+  rag:
+    embeddingProvider: voyageai # Embedding provider: 'voyageai', 'openai', 'ollama', or 'custom' (OpenAI-compatible)
+    embeddingModel: voyage-4 # Embedding model name (no provider prefix)
+    embeddingApiKey: "" # Secret API key for the embedding provider. Empty = engine uses its native env credentials (e.g. VOYAGE_API_KEY)
+    embeddingBaseUrl: "" # OpenAI-compatible base URL for 'ollama'/'custom' embedding providers (e.g. http://ollama:11434/v1). Ignored for voyageai/openai
+    topK: 20 # Number of chunks retrieval returns per search
+    maxSearches: 5 # Per-run cap on knowledge-search tool calls before the agent must answer
+  limits:
+    maxPages: 200 # Upper bound on PDF pages the engine will process per request
+    maxCharacters: 200000 # Upper bound on characters of extracted text per request
+    modelMaxConcurrency: 32 # Process-wide cap on concurrent model API calls (engine restart to apply)
+  features: # Per-capability switches; turn an individual AI tool off without disabling the whole engine
+    chat: true # Assistant chat
+    documentQuestions: true # Ask-questions-about-a-PDF
+    createPdf: true # Generate a PDF from a natural-language spec
+    mathAuditor: true # Numerical/formula contradiction auditing
+    pdfComment: true # AI-authored PDF comments/annotations
+    classify: true # Automatic document classification/labelling
 
 policies:
   # Folder automations can read from and write to the directories you allow here, so treat this as a
@@ -385,6 +414,8 @@ policies:
 mcp:
   enabled: false # Master switch. 'false' (default) means no /mcp endpoint, no metadata, no beans wired.
   scopesEnabled: true # Enforce mcp.tools.read / mcp.tools.write scopes derived from operation category
+  maxRequestBytes: 10485760 # Max size (bytes) of an incoming MCP tool request payload (default 10 MB)
+  maxInlineResponseBytes: 10485760 # Max size (bytes) of an MCP tool response returned inline before it is rejected (default 10 MB)
   allowedOperations: [] # Tool allow-list (operation ids, e.g. ['compress-pdf']). Empty = all. When set, ONLY these are exposed over MCP.
   blockedOperations: [] # Tool deny-list (operation ids). Always removed from MCP even if otherwise allowed.
   auth:
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/AiEngineController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/AiEngineController.java
index a96b3d1240..f50d53e542 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/AiEngineController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/AiEngineController.java
@@ -7,7 +7,6 @@ import java.util.concurrent.Executor;
 
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Qualifier;
-import org.springframework.beans.factory.annotation.Value;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.http.ResponseEntity;
@@ -28,6 +27,7 @@ import jakarta.validation.Valid;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.job.ResultFile;
 import stirling.software.common.service.JobOwnershipService;
 import stirling.software.common.service.TaskManager;
@@ -38,6 +38,7 @@ import stirling.software.proprietary.model.api.ai.AiWorkflowResponse;
 import stirling.software.proprietary.model.api.ai.AiWorkflowResultFile;
 import stirling.software.proprietary.service.AiEngineClient;
 import stirling.software.proprietary.service.AiEngineEndpointResolver;
+import stirling.software.proprietary.service.AiFeatureGate;
 import stirling.software.proprietary.service.AiWorkflowService;
 
 import tools.jackson.core.JacksonException;
@@ -60,15 +61,14 @@ public class AiEngineController {
     private final TaskManager taskManager;
     private final JobOwnershipService jobOwnershipService;
     private final AiEngineEndpointResolver endpointResolver;
+    private final AiFeatureGate aiFeatureGate;
     private final UserServiceInterface userService;
 
     /**
-     * SSE emitter timeout. Long enough to accommodate multi-gigabyte PDF workflows (OCR on a
-     * 1000-page scan, splitting a huge PDF, etc.) without the emitter completing out from under the
-     * executor. Configurable via {@code stirling.ai.streamTimeoutMs}.
+     * SSE emitter timeout (ms), long enough for multi-gigabyte PDF workflows without completing out
+     * from under the executor. Derived from {@code aiEngine.streamTimeoutSeconds}.
      */
-    @Value("${stirling.ai.streamTimeoutMs:1800000}")
-    private long streamTimeoutMs;
+    private final long streamTimeoutMs;
 
     public AiEngineController(
             AiEngineClient aiEngineClient,
@@ -78,6 +78,8 @@ public class AiEngineController {
             TaskManager taskManager,
             JobOwnershipService jobOwnershipService,
             AiEngineEndpointResolver endpointResolver,
+            AiFeatureGate aiFeatureGate,
+            ApplicationProperties applicationProperties,
             @Autowired(required = false) UserServiceInterface userService) {
         this.aiEngineClient = aiEngineClient;
         this.aiWorkflowService = aiWorkflowService;
@@ -86,7 +88,10 @@ public class AiEngineController {
         this.taskManager = taskManager;
         this.jobOwnershipService = jobOwnershipService;
         this.endpointResolver = endpointResolver;
+        this.aiFeatureGate = aiFeatureGate;
         this.userService = userService;
+        this.streamTimeoutMs =
+                applicationProperties.getAiEngine().getStreamTimeoutSeconds() * 1000L;
     }
 
     private String currentUserId() {
@@ -111,6 +116,7 @@ public class AiEngineController {
                             + " system and downloadable via GET /api/v1/general/files/{fileId}.")
     public AiWorkflowResponse orchestrate(@Valid @ModelAttribute AiWorkflowRequest request)
             throws IOException {
+        aiFeatureGate.requireConversationalWorkflow();
         AiWorkflowResponse result = aiWorkflowService.orchestrate(request);
         registerFileResultAsJob(result);
         return result;
@@ -123,6 +129,7 @@ public class AiEngineController {
                     "Accepts a PDF upload and a user message, returns SSE events with progress"
                             + " updates followed by the final AI workflow result")
     public SseEmitter orchestrateStream(@Valid @ModelAttribute AiWorkflowRequest request) {
+        aiFeatureGate.requireConversationalWorkflow();
         SseEmitter emitter = new SseEmitter(streamTimeoutMs);
 
         emitter.onTimeout(
@@ -246,6 +253,8 @@ public class AiEngineController {
                     "Sends a user message to the PDF edit agent which returns a structured plan"
                             + " of tool operations to perform")
     public ResponseEntity<String> pdfEdit(@RequestBody String requestBody) throws IOException {
+        // Same gate as /orchestrate: edit agent is a model call on the same conversational surface.
+        aiFeatureGate.requireConversationalWorkflow();
         JsonNode parsed = parseJson(requestBody);
         if (!parsed.isObject()) {
             throw new ResponseStatusException(
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ClassifyLabelController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ClassifyLabelController.java
index 3b7f36037b..798de71df9 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ClassifyLabelController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/ClassifyLabelController.java
@@ -35,6 +35,7 @@ import stirling.software.proprietary.classification.ClassificationLabelProvider;
 import stirling.software.proprietary.classification.model.ClassificationLabel;
 import stirling.software.proprietary.model.api.ai.AiPageText;
 import stirling.software.proprietary.service.AiEngineClient;
+import stirling.software.proprietary.service.AiFeatureGate;
 import stirling.software.proprietary.service.PdfContentExtractor;
 
 import tools.jackson.databind.JsonNode;
@@ -67,6 +68,7 @@ public class ClassifyLabelController {
     private final PdfContentExtractor pdfContentExtractor;
     private final PdfMetadataService pdfMetadataService;
     private final AiEngineClient aiEngineClient;
+    private final AiFeatureGate aiFeatureGate;
     private final ObjectMapper objectMapper;
     private final UserServiceInterface userService;
 
@@ -81,6 +83,7 @@ public class ClassifyLabelController {
             PdfContentExtractor pdfContentExtractor,
             PdfMetadataService pdfMetadataService,
             AiEngineClient aiEngineClient,
+            AiFeatureGate aiFeatureGate,
             ObjectMapper objectMapper,
             ClassificationLabelProvider labelProvider,
             @Autowired(required = false) UserServiceInterface userService) {
@@ -89,6 +92,7 @@ public class ClassifyLabelController {
         this.pdfContentExtractor = pdfContentExtractor;
         this.pdfMetadataService = pdfMetadataService;
         this.aiEngineClient = aiEngineClient;
+        this.aiFeatureGate = aiFeatureGate;
         this.objectMapper = objectMapper;
         this.labelProvider = labelProvider;
         this.userService = userService;
@@ -104,6 +108,7 @@ public class ClassifyLabelController {
                             + " intended for direct client use.")
     public ResponseEntity<Resource> classifyAndLabel(
             @RequestParam("fileInput") MultipartFile fileInput) throws IOException {
+        aiFeatureGate.requireClassify();
         try (PDDocument document = pdfDocumentFactory.load(fileInput, true)) {
             String fileName = safeFileName(fileInput.getOriginalFilename());
 
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/CreatePdfAgentController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/CreatePdfAgentController.java
index 5e2298937a..0a41c552aa 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/CreatePdfAgentController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/CreatePdfAgentController.java
@@ -34,6 +34,7 @@ import stirling.software.common.util.TempFileManager;
 import stirling.software.common.util.WebResponseUtils;
 import stirling.software.proprietary.model.api.ai.create.AiDocument;
 import stirling.software.proprietary.service.AiDocumentHtmlRenderer;
+import stirling.software.proprietary.service.AiFeatureGate;
 
 import tools.jackson.core.JacksonException;
 import tools.jackson.databind.ObjectMapper;
@@ -59,6 +60,7 @@ public class CreatePdfAgentController {
     private final ApplicationProperties applicationProperties;
     private final ObjectMapper objectMapper;
     private final AiDocumentHtmlRenderer htmlRenderer;
+    private final AiFeatureGate aiFeatureGate;
 
     /**
      * Returns true only when WeasyPrint is definitively unavailable — either the binary could not
@@ -93,10 +95,10 @@ public class CreatePdfAgentController {
     public ResponseEntity<Resource> createPdf(
             @RequestParam("document") String document, @RequestParam("filename") String filename)
             throws Exception {
-
         if (!applicationProperties.getAiEngine().isEnabled()) {
             throw new ResponseStatusException(HttpStatus.NOT_FOUND);
         }
+        aiFeatureGate.requireCreatePdf();
 
         AiDocument model;
         try {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/MathAuditorAgentController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/MathAuditorAgentController.java
index 3199901d4c..8beddd5e94 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/MathAuditorAgentController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/MathAuditorAgentController.java
@@ -21,6 +21,7 @@ import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.proprietary.model.api.ai.Verdict;
+import stirling.software.proprietary.service.AiFeatureGate;
 import stirling.software.proprietary.service.AiToolInputValidator;
 import stirling.software.proprietary.service.MathAuditorOrchestrator;
 
@@ -49,6 +50,7 @@ public class MathAuditorAgentController {
 
     private static final Pattern NEWLINE_PATTERN = Pattern.compile("[\\r\\n]");
     private final MathAuditorOrchestrator orchestrator;
+    private final AiFeatureGate aiFeatureGate;
 
     @PostMapping(value = "/math-auditor-agent", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
     @Operation(
@@ -79,6 +81,7 @@ public class MathAuditorAgentController {
                                             + " ignored (default: 0.01)")
                     @RequestParam(value = "tolerance", defaultValue = "0.01")
                     BigDecimal tolerance) {
+        aiFeatureGate.requireMathAuditor();
 
         AiToolInputValidator.validatePdfUpload(fileInput);
         if (tolerance.compareTo(BigDecimal.ZERO) < 0) {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PdfCommentAgentController.java b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PdfCommentAgentController.java
index c02a804ce9..fadfacf03a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PdfCommentAgentController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/controller/api/PdfCommentAgentController.java
@@ -21,6 +21,7 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.proprietary.service.AiFeatureGate;
 import stirling.software.proprietary.service.AiToolResponseHeaders;
 import stirling.software.proprietary.service.PdfCommentAgentOrchestrator;
 import stirling.software.proprietary.service.PdfCommentAgentOrchestrator.AnnotatedPdf;
@@ -49,6 +50,7 @@ public class PdfCommentAgentController {
     private static final Pattern NEWLINE_PATTERN = Pattern.compile("[\\r\\n]");
     private final PdfCommentAgentOrchestrator orchestrator;
     private final ObjectMapper objectMapper;
+    private final AiFeatureGate aiFeatureGate;
 
     @PostMapping(
             value = "/pdf-comment-agent",
@@ -79,6 +81,7 @@ public class PdfCommentAgentController {
                     @RequestParam("prompt")
                     String prompt)
             throws IOException {
+        aiFeatureGate.requirePdfComment();
 
         String originalFilename = fileInput.getOriginalFilename();
         String safeName =
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java
index 4bbe7f432a..286c0f1d01 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java
@@ -8,6 +8,7 @@ import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -45,6 +46,7 @@ import stirling.software.common.util.RegexPatternUtils;
 import stirling.software.proprietary.security.model.api.admin.SettingValueResponse;
 import stirling.software.proprietary.security.model.api.admin.UpdateSettingValueRequest;
 import stirling.software.proprietary.security.model.api.admin.UpdateSettingsRequest;
+import stirling.software.proprietary.service.AiEngineConfigSync;
 
 import tools.jackson.core.type.TypeReference;
 import tools.jackson.databind.ObjectMapper;
@@ -58,6 +60,7 @@ public class AdminSettingsController {
     private final ApplicationProperties applicationProperties;
     private final ObjectMapper objectMapper;
     private final ApplicationContext applicationContext;
+    private final AiEngineConfigSync aiEngineConfigSync;
 
     // Track settings that have been modified but not yet applied (require restart)
     private static final ConcurrentHashMap<String, Object> pendingChanges =
@@ -172,6 +175,26 @@ public class AdminSettingsController {
                         .body(Map.of("error", "No settings provided to update"));
             }
 
+            // Mutable copy so we can drop masked "********" values: a UI round-trip must not
+            // overwrite a real secret (e.g. an API key) with the placeholder from the GET.
+            settings = new LinkedHashMap<>(settings);
+            settings.entrySet()
+                    .removeIf(
+                            e -> {
+                                if (!"********".equals(e.getValue())) {
+                                    return false;
+                                }
+                                String key = e.getKey();
+                                String leaf =
+                                        key.contains(".")
+                                                ? key.substring(key.lastIndexOf('.') + 1)
+                                                : key;
+                                return isSensitiveFieldWithPath(leaf, key);
+                            });
+            if (settings.isEmpty()) {
+                return ResponseEntity.ok(Map.of("message", "No changed settings to update."));
+            }
+
             // Validate all settings first before applying any changes
             for (Map.Entry<String, Object> entry : settings.entrySet()) {
                 String key = entry.getKey();
@@ -188,6 +211,9 @@ public class AdminSettingsController {
 
                 // Validate pipeline path settings
                 String validationError = validatePipelinePathSetting(key, value);
+                if (validationError == null) {
+                    validationError = validateAiEngineNumericSetting(key, value);
+                }
                 if (validationError != null) {
                     return ResponseEntity.badRequest()
                             .body(Map.of("error", HtmlUtils.htmlEscape(validationError)));
@@ -202,10 +228,13 @@ public class AdminSettingsController {
             for (Map.Entry<String, Object> entry : settings.entrySet()) {
                 String key = entry.getKey();
                 Object value = entry.getValue();
-                log.info("Admin updating setting: {} = {}", key, value);
+                log.info("Admin updating setting: {} = {}", key, logSafeValue(key, value));
                 pendingChanges.put(key, value != null ? value : "");
             }
 
+            // Push changed AI settings live so model/RAG/limit changes skip the restart.
+            maybePushAiEngineLive(settings);
+
             return ResponseEntity.ok(
                     Map.of(
                             "message",
@@ -350,7 +379,10 @@ public class AdminSettingsController {
                                                     + HtmlUtils.htmlEscape(fullKey)));
                 }
 
-                log.info("Admin updating section setting: {} = {}", fullKey, value);
+                log.info(
+                        "Admin updating section setting: {} = {}",
+                        fullKey,
+                        logSafeValue(fullKey, value));
                 GeneralUtils.saveKeyToSettings(fullKey, value);
 
                 // Track this as a pending change
@@ -469,7 +501,7 @@ public class AdminSettingsController {
                 }
             }
 
-            log.info("Admin updating single setting: {} = {}", key, value);
+            log.info("Admin updating single setting: {} = {}", key, logSafeValue(key, value));
             GeneralUtils.saveKeyToSettings(key, value);
 
             // Track this as a pending change
@@ -600,6 +632,27 @@ public class AdminSettingsController {
         }
     }
 
+    /**
+     * Forward pending {@code aiEngine.*} changes to the engine after a save. Sends all accumulated
+     * pending changes, not just this save's: the running bean doesn't reflect unrestarted values.
+     */
+    private void maybePushAiEngineLive(Map<String, Object> changedSettings) {
+        boolean aiChangedNow =
+                changedSettings.keySet().stream().anyMatch(k -> k.startsWith("aiEngine."));
+        if (!aiChangedNow) {
+            return;
+        }
+        Map<String, Object> aiEnginePending = new HashMap<>();
+        for (Map.Entry<String, Object> entry : pendingChanges.entrySet()) {
+            if (entry.getKey().startsWith("aiEngine.")) {
+                aiEnginePending.put(entry.getKey(), entry.getValue());
+            }
+        }
+        if (!aiEnginePending.isEmpty()) {
+            aiEngineConfigSync.pushLiveAfterSave(aiEnginePending);
+        }
+    }
+
     private Object getSectionData(String sectionName) {
         if (sectionName == null || sectionName.trim().isEmpty()) {
             return null;
@@ -684,6 +737,38 @@ public class AdminSettingsController {
         return true;
     }
 
+    /**
+     * Minimum accepted value per bounded {@code aiEngine.*} numeric. A saved out-of-range value
+     * would make the engine reject every later push, including the one that fixes it.
+     */
+    private static final Map<String, Integer> AI_ENGINE_NUMERIC_MINIMUMS =
+            Map.of(
+                    "aiEngine.models.smartMaxTokens", 1,
+                    "aiEngine.models.fastMaxTokens", 1,
+                    "aiEngine.rag.topK", 1,
+                    "aiEngine.rag.maxSearches", 0,
+                    "aiEngine.limits.maxPages", 1,
+                    "aiEngine.limits.maxCharacters", 1,
+                    "aiEngine.limits.modelMaxConcurrency", 1);
+
+    private String validateAiEngineNumericSetting(String key, Object value) {
+        Integer min = AI_ENGINE_NUMERIC_MINIMUMS.get(key);
+        if (min == null || value == null) {
+            return null;
+        }
+        long parsed;
+        if (value instanceof Number number) {
+            parsed = number.longValue();
+        } else {
+            try {
+                parsed = Long.parseLong(value.toString().trim());
+            } catch (NumberFormatException e) {
+                return key + " must be a whole number";
+            }
+        }
+        return parsed < min ? key + " must be at least " + min : null;
+    }
+
     private String validatePipelinePathSetting(String key, Object value) {
         // Validate pipeline path settings
         if (key.startsWith("system.customPaths.pipeline.watchedFoldersDirs")
@@ -828,6 +913,15 @@ public class AdminSettingsController {
         return masked;
     }
 
+    /**
+     * Value to log for a settings key, with secrets redacted: API keys, client secrets and mail
+     * passwords travel this path and must not land in the log in cleartext.
+     */
+    private Object logSafeValue(String key, Object value) {
+        String leaf = key.contains(".") ? key.substring(key.lastIndexOf('.') + 1) : key;
+        return isSensitiveFieldWithPath(leaf, key) ? "<redacted>" : value;
+    }
+
     /** Check if a field name indicates sensitive data with full path context */
     private boolean isSensitiveFieldWithPath(String fieldName, String fullPath) {
         String lowerField = fieldName.toLowerCase();
@@ -843,10 +937,12 @@ public class AdminSettingsController {
             return true;
         }
 
-        // Check for fields containing 'password' or 'secret' or 'bottoken'
+        // Match secret-bearing names (apikey covers provider creds). "token" is a suffix
+        // match only, so it doesn't swallow numeric fields like smartMaxTokens.
         return lowerField.contains("password")
                 || lowerField.contains("secret")
-                || lowerField.contains("bottoken");
+                || lowerField.contains("apikey")
+                || lowerField.endsWith("token");
     }
 
     /** Create a masked representation for sensitive fields */
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/AiEngineConfigSync.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiEngineConfigSync.java
new file mode 100644
index 0000000000..99f5f025ef
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiEngineConfigSync.java
@@ -0,0 +1,282 @@
+package stirling.software.proprietary.service;
+
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.stream.Collectors;
+
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.event.EventListener;
+import org.springframework.stereotype.Service;
+
+import jakarta.annotation.PreDestroy;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.AiEngine;
+
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ObjectNode;
+
+/**
+ * Pushes admin-configured AI settings to the engine on startup and after each save; non-blocking
+ * and best-effort. Disabled via {@code aiEngine.pushConfigToEngine} for env-driven deployments.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class AiEngineConfigSync {
+
+    private static final int MAX_ATTEMPTS = 5;
+    private static final long RETRY_DELAY_MS = 3000L;
+
+    private final ApplicationProperties applicationProperties;
+    private final AiEngineClient aiEngineClient;
+    private final ObjectMapper objectMapper;
+
+    // Single worker keeps pushes strictly ordered; virtual (daemon) thread never blocks shutdown.
+    private final ExecutorService pushExecutor =
+            Executors.newSingleThreadExecutor(
+                    Thread.ofVirtual().name("ai-engine-config-sync").factory());
+
+    @PreDestroy
+    void shutdown() {
+        pushExecutor.shutdownNow();
+    }
+
+    @EventListener(ApplicationReadyEvent.class)
+    public void pushConfigOnStartup() {
+        AiEngine cfg = applicationProperties.getAiEngine();
+        if (!cfg.isEnabled()) {
+            return;
+        }
+        if (!cfg.isPushConfigToEngine()) {
+            log.debug(
+                    "Skipping AI engine config push: aiEngine.pushConfigToEngine is disabled"
+                            + " (the engine is configured from its own environment)");
+            return;
+        }
+        // Engine may still be booting; push off-thread with retries so startup never blocks.
+        submit(() -> pushWithRetries(cfg));
+    }
+
+    /**
+     * Push AI settings to the engine after an admin save so changes apply without a restart. No-op
+     * unless AI is enabled and an engine-relevant {@code aiEngine.*} key changed.
+     */
+    public void pushLiveAfterSave(Map<String, Object> pendingAiEngine) {
+        // Save already persisted; a build/dispatch failure must not fail the save.
+        try {
+            // Gate on the running bean: the client refuses calls while disabled, so a pending
+            // enable would always fail here; the post-restart startup push covers first enablement.
+            AiEngine cfg = applicationProperties.getAiEngine();
+            if (pendingAiEngine == null
+                    || pendingAiEngine.isEmpty()
+                    || !cfg.isPushConfigToEngine()
+                    || !cfg.isEnabled()) {
+                return;
+            }
+            Set<String> engineKeys =
+                    pendingAiEngine.keySet().stream()
+                            .filter(AiEngineConfigSync::isEngineRelevantKey)
+                            .collect(Collectors.toSet());
+            if (engineKeys.isEmpty()) {
+                return;
+            }
+            ObjectNode node = buildConfigNode(cfg);
+            pendingAiEngine.forEach((k, v) -> overlayIfEngineRelevant(node, k, v));
+            keepEnvForUnconfiguredIdentity(node, engineKeys);
+            String body = node.toString();
+            submit(() -> pushOnce(body));
+        } catch (Exception e) {
+            log.warn(
+                    "Could not build the live AI engine config push: {} (settings were saved; the"
+                            + " engine will re-sync on the next restart)",
+                    e.getMessage(),
+                    e);
+        }
+    }
+
+    /**
+     * Run pushes on the single-threaded executor so they stay serialised: each carries the full
+     * config and the engine keeps whatever lands last, so overlapping pushes could leave it stale.
+     */
+    private void submit(Runnable task) {
+        pushExecutor.execute(task);
+    }
+
+    private void pushOnce(String body) {
+        try {
+            aiEngineClient.post("/api/v1/config", body, null);
+            log.info("Pushed AI engine configuration after settings change");
+        } catch (Exception e) {
+            log.error(
+                    "Live AI engine config push failed: {}. The engine keeps running its previous"
+                            + " configuration; if the engine is not on localhost, set"
+                            + " STIRLING_ENGINE_SHARED_SECRET on both the engine and the processor"
+                            + " so it accepts the push.",
+                    e.getMessage());
+        }
+    }
+
+    // Only models/rag/limits reach the engine; the rest is processor-side.
+    private static boolean isEngineRelevantKey(String key) {
+        return key.startsWith("aiEngine.models.")
+                || key.startsWith("aiEngine.rag.")
+                || key.startsWith("aiEngine.limits.");
+    }
+
+    private void overlayIfEngineRelevant(ObjectNode node, String key, Object value) {
+        if (!isEngineRelevantKey(key)) {
+            return;
+        }
+        String[] parts = key.substring("aiEngine.".length()).split("\\.");
+        if (parts.length < 2) {
+            // No leaf here; writing at parts[0] would overwrite the whole section with a scalar.
+            return;
+        }
+        ObjectNode parent = node;
+        for (int i = 0; i < parts.length - 1; i++) {
+            JsonNode child = parent.get(parts[i]);
+            parent = (child instanceof ObjectNode on) ? on : parent.putObject(parts[i]);
+        }
+        parent.set(parts[parts.length - 1], objectMapper.valueToTree(value));
+    }
+
+    private void pushWithRetries(AiEngine cfg) {
+        ObjectNode node = buildConfigNode(cfg);
+        keepEnvForUnconfiguredIdentity(node, Set.of());
+        String body = node.toString();
+        for (int attempt = 1; attempt <= MAX_ATTEMPTS; attempt++) {
+            try {
+                aiEngineClient.post("/api/v1/config", body, null);
+                log.info("Pushed AI engine configuration on startup (attempt {})", attempt);
+                return;
+            } catch (Exception e) {
+                log.warn(
+                        "AI engine config push failed (attempt {}/{}): {}",
+                        attempt,
+                        MAX_ATTEMPTS,
+                        e.getMessage());
+                if (attempt < MAX_ATTEMPTS) {
+                    try {
+                        Thread.sleep(RETRY_DELAY_MS);
+                    } catch (InterruptedException ie) {
+                        Thread.currentThread().interrupt();
+                        return;
+                    }
+                }
+            }
+        }
+        log.warn(
+                "Giving up pushing AI engine configuration after {} attempts; the engine will use"
+                        + " its own environment configuration until the next restart.",
+                MAX_ATTEMPTS);
+    }
+
+    private ObjectNode buildConfigNode(AiEngine cfg) {
+        AiEngine.Models m = cfg.getModels();
+        AiEngine.Rag r = cfg.getRag();
+        AiEngine.Limits l = cfg.getLimits();
+
+        ObjectNode root = objectMapper.createObjectNode();
+
+        ObjectNode models = root.putObject("models");
+        models.put("provider", m.getProvider());
+        models.put("smartModel", m.getSmartModel());
+        models.put("fastModel", m.getFastModel());
+        models.put("smartMaxTokens", m.getSmartMaxTokens());
+        models.put("fastMaxTokens", m.getFastMaxTokens());
+        models.put("apiKey", m.getApiKey());
+        models.put("baseUrl", m.getBaseUrl());
+
+        ObjectNode rag = root.putObject("rag");
+        rag.put("embeddingProvider", r.getEmbeddingProvider());
+        rag.put("embeddingModel", r.getEmbeddingModel());
+        rag.put("embeddingApiKey", r.getEmbeddingApiKey());
+        rag.put("embeddingBaseUrl", r.getEmbeddingBaseUrl());
+        rag.put("topK", r.getTopK());
+        rag.put("maxSearches", r.getMaxSearches());
+
+        ObjectNode limits = root.putObject("limits");
+        limits.put("maxPages", l.getMaxPages());
+        limits.put("maxCharacters", l.getMaxCharacters());
+        limits.put("modelMaxConcurrency", l.getModelMaxConcurrency());
+
+        return root;
+    }
+
+    // Defaults used to detect whether a section was configured or left at built-in values.
+    private static final AiEngine.Models DEFAULT_MODELS = new AiEngine.Models();
+    private static final AiEngine.Rag DEFAULT_RAG = new AiEngine.Rag();
+
+    private static boolean isBlank(String s) {
+        return s == null || s.isBlank();
+    }
+
+    private static String text(JsonNode section, String field) {
+        return section.path(field).asText("");
+    }
+
+    /**
+     * Blank the identity (provider/model/credentials) of unconfigured sections so the push keeps
+     * the engine's env values; edited sections are sent as-is so a cleared key really clears.
+     */
+    private void keepEnvForUnconfiguredIdentity(ObjectNode root, Set<String> touchedKeys) {
+        if (root.get("models") instanceof ObjectNode models) {
+            boolean configured =
+                    touchedIdentity(touchedKeys, MODEL_IDENTITY_KEYS)
+                            || !isBlank(text(models, "apiKey"))
+                            || !isBlank(text(models, "baseUrl"))
+                            || !DEFAULT_MODELS.getProvider().equals(text(models, "provider"))
+                            || !DEFAULT_MODELS.getSmartModel().equals(text(models, "smartModel"))
+                            || !DEFAULT_MODELS.getFastModel().equals(text(models, "fastModel"));
+            if (!configured) {
+                models.put("provider", "");
+                models.put("smartModel", "");
+                models.put("fastModel", "");
+                models.put("apiKey", "");
+                models.put("baseUrl", "");
+            }
+        }
+        if (root.get("rag") instanceof ObjectNode rag) {
+            boolean configured =
+                    touchedIdentity(touchedKeys, RAG_IDENTITY_KEYS)
+                            || !isBlank(text(rag, "embeddingApiKey"))
+                            || !isBlank(text(rag, "embeddingBaseUrl"))
+                            || !DEFAULT_RAG
+                                    .getEmbeddingProvider()
+                                    .equals(text(rag, "embeddingProvider"))
+                            || !DEFAULT_RAG.getEmbeddingModel().equals(text(rag, "embeddingModel"));
+            if (!configured) {
+                rag.put("embeddingProvider", "");
+                rag.put("embeddingModel", "");
+                rag.put("embeddingApiKey", "");
+                rag.put("embeddingBaseUrl", "");
+            }
+        }
+    }
+
+    private static final Set<String> MODEL_IDENTITY_KEYS =
+            Set.of(
+                    "aiEngine.models.provider",
+                    "aiEngine.models.smartModel",
+                    "aiEngine.models.fastModel",
+                    "aiEngine.models.apiKey",
+                    "aiEngine.models.baseUrl");
+
+    private static final Set<String> RAG_IDENTITY_KEYS =
+            Set.of(
+                    "aiEngine.rag.embeddingProvider",
+                    "aiEngine.rag.embeddingModel",
+                    "aiEngine.rag.embeddingApiKey",
+                    "aiEngine.rag.embeddingBaseUrl");
+
+    private static boolean touchedIdentity(Set<String> touchedKeys, Set<String> identityKeys) {
+        return touchedKeys.stream().anyMatch(identityKeys::contains);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/service/AiFeatureGate.java b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiFeatureGate.java
new file mode 100644
index 0000000000..ffce8a1eb3
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/service/AiFeatureGate.java
@@ -0,0 +1,56 @@
+package stirling.software.proprietary.service;
+
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Component;
+import org.springframework.web.server.ResponseStatusException;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.AiEngine.Features;
+
+/**
+ * Central gate for the AI feature switches ({@code aiEngine.features.*}); each {@code require*}
+ * throws 503 when the engine is disabled or the capability is off.
+ */
+@Component
+@RequiredArgsConstructor
+public class AiFeatureGate {
+
+    private final ApplicationProperties applicationProperties;
+
+    private Features features() {
+        return applicationProperties.getAiEngine().getFeatures();
+    }
+
+    private void require(boolean featureEnabled, String feature) {
+        if (!applicationProperties.getAiEngine().isEnabled() || !featureEnabled) {
+            throw new ResponseStatusException(
+                    HttpStatus.SERVICE_UNAVAILABLE, "AI feature '" + feature + "' is disabled");
+        }
+    }
+
+    /**
+     * Shared entry point for chat and document questions; open while either is enabled, since a
+     * request can't be attributed to just one. No per-capability gate exists for the same reason.
+     */
+    public void requireConversationalWorkflow() {
+        require(features().isChat() || features().isDocumentQuestions(), "conversation");
+    }
+
+    public void requireCreatePdf() {
+        require(features().isCreatePdf(), "createPdf");
+    }
+
+    public void requireMathAuditor() {
+        require(features().isMathAuditor(), "mathAuditor");
+    }
+
+    public void requirePdfComment() {
+        require(features().isPdfComment(), "pdfComment");
+    }
+
+    public void requireClassify() {
+        require(features().isClassify(), "classify");
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ClassifyLabelControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ClassifyLabelControllerTest.java
index 2773ed7965..74749289a7 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ClassifyLabelControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/ClassifyLabelControllerTest.java
@@ -29,6 +29,7 @@ import stirling.software.common.util.TempFileManager;
 import stirling.software.proprietary.classification.ClassificationLabelProvider;
 import stirling.software.proprietary.classification.model.ClassificationLabel;
 import stirling.software.proprietary.service.AiEngineClient;
+import stirling.software.proprietary.service.AiFeatureGate;
 import stirling.software.proprietary.service.PdfContentExtractor;
 
 import tools.jackson.databind.JsonNode;
@@ -44,6 +45,7 @@ class ClassifyLabelControllerTest {
     @Mock private PdfContentExtractor pdfContentExtractor;
     @Mock private PdfMetadataService pdfMetadataService;
     @Mock private AiEngineClient aiEngineClient;
+    @Mock private AiFeatureGate aiFeatureGate;
 
     private final ObjectMapper objectMapper = JsonMapper.builder().build();
     private ClassifyLabelController controller;
@@ -56,6 +58,7 @@ class ClassifyLabelControllerTest {
                         pdfContentExtractor,
                         pdfMetadataService,
                         aiEngineClient,
+                        aiFeatureGate,
                         objectMapper,
                         ClassificationLabelProvider.withLabels(labels),
                         null);
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/PdfCommentAgentControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/PdfCommentAgentControllerTest.java
index 42edace946..6be89e99cd 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/PdfCommentAgentControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/controller/api/PdfCommentAgentControllerTest.java
@@ -3,6 +3,7 @@ package stirling.software.proprietary.controller.api;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -26,6 +27,7 @@ import org.springframework.web.server.ResponseStatusException;
 import org.springframework.web.servlet.mvc.annotation.ResponseStatusExceptionResolver;
 import org.springframework.web.servlet.mvc.support.DefaultHandlerExceptionResolver;
 
+import stirling.software.proprietary.service.AiFeatureGate;
 import stirling.software.proprietary.service.PdfCommentAgentOrchestrator;
 import stirling.software.proprietary.service.PdfCommentAgentOrchestrator.AnnotatedPdf;
 
@@ -39,13 +41,15 @@ import tools.jackson.databind.json.JsonMapper;
 class PdfCommentAgentControllerTest {
 
     @Mock private PdfCommentAgentOrchestrator orchestrator;
+    @Mock private AiFeatureGate aiFeatureGate;
 
     private MockMvc mockMvc;
 
     @BeforeEach
     void setUp() {
         PdfCommentAgentController controller =
-                new PdfCommentAgentController(orchestrator, JsonMapper.builder().build());
+                new PdfCommentAgentController(
+                        orchestrator, JsonMapper.builder().build(), aiFeatureGate);
         mockMvc =
                 MockMvcBuilders.standaloneSetup(controller)
                         // standaloneSetup's defaults don't handle ResponseStatusException; wire up
@@ -117,6 +121,27 @@ class PdfCommentAgentControllerTest {
         verify(orchestrator, never()).applyComments(any(), anyString());
     }
 
+    @Test
+    void returnsServiceUnavailableWhenPdfCommentFeatureDisabled() throws Exception {
+        doThrow(new ResponseStatusException(HttpStatus.SERVICE_UNAVAILABLE))
+                .when(aiFeatureGate)
+                .requirePdfComment();
+        MockMultipartFile pdfFile =
+                new MockMultipartFile(
+                        "fileInput",
+                        "input.pdf",
+                        MediaType.APPLICATION_PDF_VALUE,
+                        "%PDF-1.4\n%%EOF".getBytes());
+
+        mockMvc.perform(
+                        multipart("/api/v1/ai/tools/pdf-comment-agent")
+                                .file(pdfFile)
+                                .param("prompt", "flag dates"))
+                .andExpect(status().isServiceUnavailable());
+
+        verify(orchestrator, never()).applyComments(any(), anyString());
+    }
+
     @Test
     void rejectsMissingPromptParameter() throws Exception {
         MockMultipartFile pdfFile =
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/security/controller/api/AdminSettingsControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/security/controller/api/AdminSettingsControllerTest.java
index 5dc0e92963..4a4e297c0b 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/security/controller/api/AdminSettingsControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/security/controller/api/AdminSettingsControllerTest.java
@@ -1,10 +1,13 @@
 package stirling.software.proprietary.security.controller.api;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.argThat;
 import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.verify;
 
 import java.io.IOException;
 import java.lang.reflect.Field;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
@@ -26,6 +29,7 @@ import stirling.software.common.util.GeneralUtils;
 import stirling.software.proprietary.security.model.api.admin.SettingValueResponse;
 import stirling.software.proprietary.security.model.api.admin.UpdateSettingValueRequest;
 import stirling.software.proprietary.security.model.api.admin.UpdateSettingsRequest;
+import stirling.software.proprietary.service.AiEngineConfigSync;
 
 import tools.jackson.databind.ObjectMapper;
 import tools.jackson.databind.json.JsonMapper;
@@ -37,6 +41,7 @@ class AdminSettingsControllerTest {
     private ApplicationProperties applicationProperties;
     private ObjectMapper objectMapper;
     private ApplicationContext applicationContext;
+    private AiEngineConfigSync aiEngineConfigSync;
 
     private AdminSettingsController controller;
 
@@ -45,9 +50,13 @@ class AdminSettingsControllerTest {
         applicationProperties = new ApplicationProperties();
         objectMapper = JsonMapper.builder().build();
         applicationContext = org.mockito.Mockito.mock(ApplicationContext.class);
+        aiEngineConfigSync = org.mockito.Mockito.mock(AiEngineConfigSync.class);
         controller =
                 new AdminSettingsController(
-                        applicationProperties, objectMapper, applicationContext);
+                        applicationProperties,
+                        objectMapper,
+                        applicationContext,
+                        aiEngineConfigSync);
         clearPendingChanges();
     }
 
@@ -189,6 +198,33 @@ class AdminSettingsControllerTest {
             assertThat(response.getBody().get("error").toString()).contains("Invalid setting key");
         }
 
+        @Test
+        @DisplayName("rejects an out-of-range aiEngine numeric with 400")
+        void rejectsOutOfRangeAiEngineNumeric() {
+            // An out-of-range value would make the engine reject every later push, including the
+            // one that fixes it.
+            UpdateSettingsRequest request = new UpdateSettingsRequest();
+            request.setSettings(Map.of("aiEngine.limits.modelMaxConcurrency", 0));
+
+            ResponseEntity<Map<String, Object>> response = controller.updateSettings(request);
+
+            assertThat(response.getStatusCode()).isEqualTo(HttpStatus.BAD_REQUEST);
+            assertThat(response.getBody().get("error").toString()).contains("at least 1");
+        }
+
+        @Test
+        @DisplayName("accepts zero maxSearches, which legitimately means no retrieval")
+        void acceptsZeroMaxSearches() {
+            UpdateSettingsRequest request = new UpdateSettingsRequest();
+            request.setSettings(Map.of("aiEngine.rag.maxSearches", 0));
+
+            try (MockedStatic<GeneralUtils> mocked = mockStatic(GeneralUtils.class)) {
+                ResponseEntity<Map<String, Object>> response = controller.updateSettings(request);
+
+                assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+            }
+        }
+
         @Test
         @DisplayName("rejects unknown section prefix with 400")
         void rejectsUnknownSection() {
@@ -277,6 +313,51 @@ class AdminSettingsControllerTest {
                 assertThat(response.getStatusCode()).isEqualTo(HttpStatus.BAD_REQUEST);
             }
         }
+
+        @Test
+        @DisplayName("drops a masked ******** secret so a UI round-trip can't overwrite a real key")
+        void dropsMaskedSecretValue() {
+            UpdateSettingsRequest request = new UpdateSettingsRequest();
+            Map<String, Object> settings = new HashMap<>();
+            settings.put("aiEngine.models.apiKey", "********");
+            settings.put("ui.appName", "My App");
+            request.setSettings(settings);
+
+            try (MockedStatic<GeneralUtils> mocked = mockStatic(GeneralUtils.class)) {
+                ResponseEntity<Map<String, Object>> response = controller.updateSettings(request);
+
+                assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+                // The masked secret is stripped; only the real change is persisted.
+                mocked.verify(
+                        () ->
+                                GeneralUtils.updateSettingsTransactional(
+                                        argThat(
+                                                (Map<String, Object> m) ->
+                                                        !m.containsKey("aiEngine.models.apiKey")
+                                                                && m.containsKey("ui.appName"))));
+            }
+        }
+
+        @Test
+        @DisplayName("forwards only aiEngine.* pending keys to the engine live-push")
+        void forwardsOnlyAiEngineKeysToLivePush() {
+            UpdateSettingsRequest request = new UpdateSettingsRequest();
+            Map<String, Object> settings = new HashMap<>();
+            settings.put("aiEngine.models.provider", "ollama");
+            settings.put("ui.appName", "My App");
+            request.setSettings(settings);
+
+            try (MockedStatic<GeneralUtils> mocked = mockStatic(GeneralUtils.class)) {
+                controller.updateSettings(request);
+
+                verify(aiEngineConfigSync)
+                        .pushLiveAfterSave(
+                                argThat(
+                                        (Map<String, Object> m) ->
+                                                m.containsKey("aiEngine.models.provider")
+                                                        && !m.containsKey("ui.appName")));
+            }
+        }
     }
 
     @Nested
@@ -430,6 +511,25 @@ class AdminSettingsControllerTest {
             SettingValueResponse body = (SettingValueResponse) response.getBody();
             assertThat(body.getValue()).isEqualTo("********");
         }
+
+        @Test
+        @DisplayName("masks aiEngine apiKey but NOT the maxTokens numeric fields")
+        void masksApiKeyButNotMaxTokens() {
+            applicationProperties.getAiEngine().getModels().setApiKey("sk-real-key");
+            applicationProperties.getAiEngine().getModels().setSmartMaxTokens(8192);
+
+            // "token" as a substring of maxTokens must not trigger masking (would break the UI
+            // and flip the integer to a "********" string).
+            ResponseEntity<?> tokensResp =
+                    controller.getSettingValue("aiEngine.models.smartMaxTokens");
+            SettingValueResponse tokens = (SettingValueResponse) tokensResp.getBody();
+            assertThat(tokens.getValue()).isEqualTo(8192);
+
+            // The real credential is still masked.
+            ResponseEntity<?> keyResp = controller.getSettingValue("aiEngine.models.apiKey");
+            SettingValueResponse key = (SettingValueResponse) keyResp.getBody();
+            assertThat(key.getValue()).isEqualTo("********");
+        }
     }
 
     @Nested
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/service/AiEngineConfigSyncTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiEngineConfigSyncTest.java
new file mode 100644
index 0000000000..41f35c9daf
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiEngineConfigSyncTest.java
@@ -0,0 +1,251 @@
+package stirling.software.proprietary.service;
+
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.timeout;
+import static org.mockito.Mockito.verify;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.ArgumentCaptor;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.ApplicationProperties.AiEngine;
+
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.json.JsonMapper;
+
+/**
+ * Config-push bridge is self-hosted-only. These lock in that the processor stays silent when {@code
+ * aiEngine.pushConfigToEngine} is off (env-driven/SaaS) and pushes when it is on.
+ */
+class AiEngineConfigSyncTest {
+
+    private ApplicationProperties applicationProperties;
+    private AiEngineClient aiEngineClient;
+    private AiEngineConfigSync sync;
+
+    @BeforeEach
+    void setUp() {
+        applicationProperties = new ApplicationProperties();
+        applicationProperties.getAiEngine().setEnabled(true);
+        applicationProperties.getAiEngine().setPushConfigToEngine(true);
+        aiEngineClient = mock(AiEngineClient.class);
+        ObjectMapper objectMapper = JsonMapper.builder().build();
+        sync = new AiEngineConfigSync(applicationProperties, aiEngineClient, objectMapper);
+    }
+
+    @Test
+    void startupPushSkippedWhenPushDisabled() throws Exception {
+        applicationProperties.getAiEngine().setPushConfigToEngine(false);
+
+        sync.pushConfigOnStartup();
+
+        // Returns synchronously before spawning the push thread, so no interaction ever happens.
+        verify(aiEngineClient, never()).post(anyString(), anyString(), isNull());
+    }
+
+    @Test
+    void startupPushSkippedWhenDisabled() throws Exception {
+        applicationProperties.getAiEngine().setEnabled(false);
+
+        sync.pushConfigOnStartup();
+
+        verify(aiEngineClient, never()).post(anyString(), anyString(), isNull());
+    }
+
+    @Test
+    void startupPushSentWhenEnabledAndPushOn() throws Exception {
+        sync.pushConfigOnStartup();
+
+        // Push runs on a virtual thread; wait for the single POST to /api/v1/config.
+        verify(aiEngineClient, timeout(3000)).post(eq("/api/v1/config"), anyString(), isNull());
+    }
+
+    @Test
+    void livePushSkippedWhenPushDisabled() throws Exception {
+        applicationProperties.getAiEngine().setPushConfigToEngine(false);
+
+        sync.pushLiveAfterSave(Map.of("aiEngine.models.provider", "ollama"));
+
+        verify(aiEngineClient, never()).post(anyString(), anyString(), isNull());
+    }
+
+    @Test
+    void livePushSentForEngineRelevantChangeWhenPushOn() throws Exception {
+        sync.pushLiveAfterSave(Map.of("aiEngine.models.provider", "ollama"));
+
+        verify(aiEngineClient, timeout(3000)).post(eq("/api/v1/config"), anyString(), isNull());
+    }
+
+    @Test
+    void startupPushSerialisesTheEngineWireContract() throws Exception {
+        // Distinct values so a dropped/renamed field is detectable. Keep in sync with
+        // engine/tests/fixtures/processor_config_push.json (the engine validates the same shape).
+        AiEngine ai = applicationProperties.getAiEngine();
+        ai.getModels().setProvider("ollama");
+        ai.getModels().setSmartModel("smart-model-x");
+        ai.getModels().setFastModel("fast-model-x");
+        ai.getModels().setSmartMaxTokens(1111);
+        ai.getModels().setFastMaxTokens(2222);
+        ai.getModels().setApiKey("provider-key-abc");
+        ai.getModels().setBaseUrl("http://engine.example/v1");
+        ai.getRag().setEmbeddingProvider("custom");
+        ai.getRag().setEmbeddingModel("embed-model-x");
+        ai.getRag().setEmbeddingApiKey("embed-key-abc");
+        ai.getRag().setEmbeddingBaseUrl("http://embed.example/v1");
+        ai.getRag().setTopK(33);
+        ai.getRag().setMaxSearches(7);
+        ai.getLimits().setMaxPages(111);
+        ai.getLimits().setMaxCharacters(222222);
+        ai.getLimits().setModelMaxConcurrency(9);
+
+        ArgumentCaptor<String> body = ArgumentCaptor.forClass(String.class);
+        sync.pushConfigOnStartup();
+        verify(aiEngineClient, timeout(3000)).post(eq("/api/v1/config"), body.capture(), isNull());
+
+        JsonNode root = JsonMapper.builder().build().readTree(body.getValue());
+
+        JsonNode models = root.get("models");
+        assertEquals("ollama", models.get("provider").asText());
+        assertEquals("smart-model-x", models.get("smartModel").asText());
+        assertEquals("fast-model-x", models.get("fastModel").asText());
+        assertEquals(1111, models.get("smartMaxTokens").asInt());
+        assertEquals(2222, models.get("fastMaxTokens").asInt());
+        assertEquals("provider-key-abc", models.get("apiKey").asText());
+        assertEquals("http://engine.example/v1", models.get("baseUrl").asText());
+
+        JsonNode rag = root.get("rag");
+        assertEquals("custom", rag.get("embeddingProvider").asText());
+        assertEquals("embed-model-x", rag.get("embeddingModel").asText());
+        assertEquals("embed-key-abc", rag.get("embeddingApiKey").asText());
+        assertEquals("http://embed.example/v1", rag.get("embeddingBaseUrl").asText());
+        assertEquals(33, rag.get("topK").asInt());
+        assertEquals(7, rag.get("maxSearches").asInt());
+
+        JsonNode limits = root.get("limits");
+        assertEquals(111, limits.get("maxPages").asInt());
+        assertEquals(222222, limits.get("maxCharacters").asInt());
+        assertEquals(9, limits.get("modelMaxConcurrency").asInt());
+    }
+
+    @Test
+    void livePushSkippedForNonEngineRelevantChange() throws Exception {
+        // features.* is processor-side only; no engine push is warranted.
+        sync.pushLiveAfterSave(Map.of("aiEngine.features.chat", false));
+
+        verify(aiEngineClient, never()).post(anyString(), anyString(), isNull());
+    }
+
+    @Test
+    void startupPushKeepsEnvWhenSectionsUnconfigured() throws Exception {
+        // All defaults, no credentials: the push must NOT override the engine's env-configured
+        // provider/model/embedder, so the identity fields are blanked ("keep env" on the engine).
+        ArgumentCaptor<String> body = ArgumentCaptor.forClass(String.class);
+        sync.pushConfigOnStartup();
+        verify(aiEngineClient, timeout(3000)).post(eq("/api/v1/config"), body.capture(), isNull());
+
+        JsonNode root = JsonMapper.builder().build().readTree(body.getValue());
+        assertEquals("", root.get("models").get("provider").asText());
+        assertEquals("", root.get("models").get("smartModel").asText());
+        assertEquals("", root.get("models").get("fastModel").asText());
+        assertEquals("", root.get("rag").get("embeddingProvider").asText());
+        assertEquals("", root.get("rag").get("embeddingModel").asText());
+    }
+
+    @Test
+    void startupPushSendsProviderWhenChangedFromDefault() throws Exception {
+        // Admin selected a non-default provider (relying on the engine's env key): send it so the
+        // engine actually switches provider, even though no API key was entered in the UI.
+        applicationProperties.getAiEngine().getModels().setProvider("openai");
+
+        ArgumentCaptor<String> body = ArgumentCaptor.forClass(String.class);
+        sync.pushConfigOnStartup();
+        verify(aiEngineClient, timeout(3000)).post(eq("/api/v1/config"), body.capture(), isNull());
+
+        JsonNode models = JsonMapper.builder().build().readTree(body.getValue()).get("models");
+        assertEquals("openai", models.get("provider").asText());
+    }
+
+    @Test
+    void startupPushSendsModelsWhenApiKeyConfigured() throws Exception {
+        // A configured key means the admin is driving models from the UI: send the full section.
+        applicationProperties.getAiEngine().getModels().setApiKey("sk-real-key");
+
+        ArgumentCaptor<String> body = ArgumentCaptor.forClass(String.class);
+        sync.pushConfigOnStartup();
+        verify(aiEngineClient, timeout(3000)).post(eq("/api/v1/config"), body.capture(), isNull());
+
+        JsonNode models = JsonMapper.builder().build().readTree(body.getValue()).get("models");
+        assertEquals("anthropic", models.get("provider").asText());
+        assertEquals("sk-real-key", models.get("apiKey").asText());
+    }
+
+    @Test
+    void livePushSendsAnExplicitlyClearedApiKeyRatherThanKeepEnv() throws Exception {
+        // Clearing a leaked key must reach the engine as a real clear; blanking it as "keep env"
+        // would leave the revoked key live in the engine's cache indefinitely.
+        ArgumentCaptor<String> body = ArgumentCaptor.forClass(String.class);
+        sync.pushLiveAfterSave(mapOf("aiEngine.models.apiKey", ""));
+        verify(aiEngineClient, timeout(3000)).post(eq("/api/v1/config"), body.capture(), isNull());
+
+        JsonNode models = JsonMapper.builder().build().readTree(body.getValue()).get("models");
+        assertEquals("", models.get("apiKey").asText());
+        // Identity was NOT blanked wholesale: the provider still travels so the engine applies
+        // the cleared credential against the right provider.
+        assertEquals("anthropic", models.get("provider").asText());
+    }
+
+    @Test
+    void livePushKeepsEnvWhenOnlyANumericKnobChanged() throws Exception {
+        // The admin touched a limit, not the identity, so the engine's env-configured
+        // provider/model must be preserved.
+        ArgumentCaptor<String> body = ArgumentCaptor.forClass(String.class);
+        sync.pushLiveAfterSave(Map.of("aiEngine.limits.maxPages", 42));
+        verify(aiEngineClient, timeout(3000)).post(eq("/api/v1/config"), body.capture(), isNull());
+
+        JsonNode root = JsonMapper.builder().build().readTree(body.getValue());
+        assertEquals("", root.get("models").get("provider").asText());
+        assertEquals("", root.get("models").get("apiKey").asText());
+        assertEquals(42, root.get("limits").get("maxPages").asInt());
+    }
+
+    @Test
+    void livePushIgnoresAMalformedKeyInsteadOfClobberingTheSection() throws Exception {
+        // "aiEngine.models." has no leaf; writing at the section name would replace the whole
+        // models object with a scalar and produce an unparseable push.
+        ArgumentCaptor<String> body = ArgumentCaptor.forClass(String.class);
+        sync.pushLiveAfterSave(mapOf("aiEngine.models.", "junk"));
+        verify(aiEngineClient, timeout(3000)).post(eq("/api/v1/config"), body.capture(), isNull());
+
+        JsonNode models = JsonMapper.builder().build().readTree(body.getValue()).get("models");
+        assertTrue(models.isObject(), "models must still be an object");
+    }
+
+    @Test
+    void livePushNeverThrowsIntoTheCaller() throws Exception {
+        // The caller has already persisted settings.yml, so a push-building failure must not
+        // surface as a failed save. A null value inside the map is enough to break naive code.
+        Map<String, Object> pending = new HashMap<>();
+        pending.put("aiEngine.models.provider", null);
+
+        assertDoesNotThrow(() -> sync.pushLiveAfterSave(pending));
+    }
+
+    /** {@link Map#of} rejects nulls and we need entries with empty/odd values. */
+    private static Map<String, Object> mapOf(String key, Object value) {
+        Map<String, Object> map = new HashMap<>();
+        map.put(key, value);
+        return map;
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/service/AiFeatureGateTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiFeatureGateTest.java
new file mode 100644
index 0000000000..932a56296e
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/service/AiFeatureGateTest.java
@@ -0,0 +1,77 @@
+package stirling.software.proprietary.service;
+
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.springframework.http.HttpStatus;
+import org.springframework.web.server.ResponseStatusException;
+
+import stirling.software.common.model.ApplicationProperties;
+
+/**
+ * Lock in fail-closed gating: a 503 when the engine is disabled or the feature flag is off, and a
+ * clean pass only when both are on.
+ */
+class AiFeatureGateTest {
+
+    private ApplicationProperties props;
+    private AiFeatureGate gate;
+
+    @BeforeEach
+    void setUp() {
+        props = new ApplicationProperties();
+        props.getAiEngine().setEnabled(true); // features default all-on
+        gate = new AiFeatureGate(props);
+    }
+
+    @Test
+    void passesWhenEngineEnabledAndFeatureOn() {
+        assertDoesNotThrow(() -> gate.requireClassify());
+        assertDoesNotThrow(() -> gate.requireConversationalWorkflow());
+    }
+
+    @Test
+    void throws503WhenFeatureFlagOff() {
+        props.getAiEngine().getFeatures().setClassify(false);
+
+        ResponseStatusException ex =
+                assertThrows(ResponseStatusException.class, () -> gate.requireClassify());
+        assertEquals(HttpStatus.SERVICE_UNAVAILABLE, ex.getStatusCode());
+    }
+
+    @Test
+    void throws503WhenEngineDisabledEvenIfFeatureOn() {
+        props.getAiEngine().setEnabled(false); // feature flag still true
+
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class, () -> gate.requireConversationalWorkflow());
+        assertEquals(HttpStatus.SERVICE_UNAVAILABLE, ex.getStatusCode());
+    }
+
+    @Test
+    void conversationalWorkflowAllowedWhileEitherChatOrDocumentQuestionsOn() {
+        // The orchestrate endpoint serves both, so it stays open while either is enabled.
+        props.getAiEngine().getFeatures().setChat(false);
+        props.getAiEngine().getFeatures().setDocumentQuestions(true);
+        assertDoesNotThrow(() -> gate.requireConversationalWorkflow());
+
+        props.getAiEngine().getFeatures().setChat(true);
+        props.getAiEngine().getFeatures().setDocumentQuestions(false);
+        assertDoesNotThrow(() -> gate.requireConversationalWorkflow());
+    }
+
+    @Test
+    void conversationalWorkflowThrows503WhenBothChatAndDocumentQuestionsOff() {
+        props.getAiEngine().getFeatures().setChat(false);
+        props.getAiEngine().getFeatures().setDocumentQuestions(false);
+
+        ResponseStatusException ex =
+                assertThrows(
+                        ResponseStatusException.class, () -> gate.requireConversationalWorkflow());
+        assertEquals(HttpStatus.SERVICE_UNAVAILABLE, ex.getStatusCode());
+    }
+}
diff --git a/app/saas/src/main/resources/application-saas.properties b/app/saas/src/main/resources/application-saas.properties
index 8275970929..f0630aaac1 100644
--- a/app/saas/src/main/resources/application-saas.properties
+++ b/app/saas/src/main/resources/application-saas.properties
@@ -1,6 +1,11 @@
 # Stirling-PDF SaaS profile. Pure multi-tenant cloud.
 # Activated when the :saas module is on the classpath.
 
+# ---------- AI engine ----------
+# SaaS AI backend is env-driven (reached via AiProxyController); never push settings-derived
+# config to it, so pin the config-push off.
+aiEngine.pushConfigToEngine=false
+
 # ---------- Datasource ----------
 system.datasource.enableCustomDatabase=true
 system.datasource.customDatabaseUrl=${SAAS_DB_URL:}
diff --git a/engine/.env b/engine/.env
index a99abf0ccf..1a90ad8c18 100644
--- a/engine/.env
+++ b/engine/.env
@@ -88,3 +88,7 @@ STIRLING_LOG_FILE=
 # Use when diagnosing worker stalls: a hung call shows a "Request" line with
 # no matching "Response" line. Noisy; leave off in normal use.
 STIRLING_HTTP_DEBUG=false
+
+# Let the Java processor push admin AI settings to POST /api/v1/config at startup.
+# Set false in env-driven deployments so the environment is the single source of truth.
+STIRLING_ALLOW_CONFIG_PUSH=true
diff --git a/engine/pyproject.toml b/engine/pyproject.toml
index 5113ea03ff..8cbb94daf8 100644
--- a/engine/pyproject.toml
+++ b/engine/pyproject.toml
@@ -4,6 +4,7 @@ version = "0.1.0"
 description = "AI Document Engine"
 requires-python = ">=3.13"
 dependencies = [
+    "cryptography>=44.0.0",
     "fastapi>=0.116.0",
     "pgvector>=0.3.6",
     "psycopg[binary,pool]>=3.2",
diff --git a/engine/src/stirling/agents/math_presentation.py b/engine/src/stirling/agents/math_presentation.py
index bfb6fa7ef8..a8652572a6 100644
--- a/engine/src/stirling/agents/math_presentation.py
+++ b/engine/src/stirling/agents/math_presentation.py
@@ -15,6 +15,7 @@ from __future__ import annotations
 from pydantic import Field
 from pydantic_ai import Agent
 
+from stirling.agents.output_mode import output_retries
 from stirling.contracts import (
     MathAuditorToolReportArtifact,
     OrchestratorRequest,
@@ -68,6 +69,9 @@ class MathIntentClassifier:
         self._agent: Agent[None, _MathIntentDecision] = Agent(
             model=runtime.fast_model,
             output_type=_MathIntentDecision,
+            # Local models emit valid structured output only intermittently; extra
+            # retries make this hot-path classifier reliable. No-op for real providers.
+            retries=output_retries(runtime.settings.chat_provider),
             system_prompt=_MATH_INTENT_SYSTEM_PROMPT,
             model_settings=runtime.fast_model_settings,
         )
diff --git a/engine/src/stirling/agents/orchestrator.py b/engine/src/stirling/agents/orchestrator.py
index e07e771e34..bb7f2682df 100644
--- a/engine/src/stirling/agents/orchestrator.py
+++ b/engine/src/stirling/agents/orchestrator.py
@@ -2,12 +2,14 @@ from __future__ import annotations
 
 import logging
 from dataclasses import dataclass
-from typing import assert_never
+from typing import Literal, assert_never
 
+from pydantic import ConfigDict, Field
 from pydantic_ai import Agent
-from pydantic_ai.output import ToolOutput
+from pydantic_ai.output import NativeOutput, ToolOutput
 from pydantic_ai.tools import RunContext
 
+from stirling.agents.output_mode import output_retries, uses_tool_output
 from stirling.agents.pdf_create import PdfCreateAgent
 from stirling.agents.pdf_edit import PdfEditAgent
 from stirling.agents.pdf_questions import PdfQuestionAgent
@@ -27,6 +29,7 @@ from stirling.contracts import (
     format_file_names,
 )
 from stirling.contracts.pdf_create import PdfCreateOrchestrateResponse
+from stirling.models import ApiModel
 from stirling.services import AppRuntime
 
 logger = logging.getLogger(__name__)
@@ -38,6 +41,34 @@ class OrchestratorDeps:
     request: OrchestratorRequest
 
 
+# Enum routing for Ollama/custom local models: they pass the user message as args to the
+# zero-arg tool delegates below, which reject it, so pick a capability by name and dispatch in Python.
+_RouteCapability = Literal["pdf_edit", "pdf_question", "user_spec", "pdf_review", "pdf_create", "unsupported"]
+
+
+class _RouteDecision(ApiModel):
+    # Local models add stray tool args and send null for optional fields; tolerate both.
+    model_config = ConfigDict(extra="ignore")
+    capability: _RouteCapability
+    message: str | None = Field(
+        default=None,
+        description="Only for capability='unsupported': a short, helpful message to show the user.",
+    )
+
+
+_ROUTER_SYSTEM_PROMPT = (
+    "You are the top-level router. Choose exactly one capability that best handles the request:\n"
+    "- pdf_edit: modify or convert one or more attached PDFs.\n"
+    "- pdf_question: answer questions about the contents of the attached PDFs.\n"
+    "- user_spec: create or define an agent spec.\n"
+    "- pdf_review: return the PDF with review comments/annotations attached.\n"
+    "- pdf_create: generate a NEW document from scratch (invoice, report, letter) - no input file.\n"
+    "- unsupported: none of the above fit, or the user asks about the assistant itself; put a "
+    "helpful message in 'message'.\n"
+    "Respond with the capability and (only for unsupported) a message."
+)
+
+
 class OrchestratorAgent:
     def __init__(self, runtime: AppRuntime) -> None:
         self.runtime = runtime
@@ -86,6 +117,8 @@ class OrchestratorAgent:
                     description="Return this when none of the delegate outputs fit the request.",
                 ),
             ],
+            # Local models pick a delegate less reliably; extra retries. No-op for real providers.
+            retries=output_retries(runtime.settings.chat_provider),
             deps_type=OrchestratorDeps,
             system_prompt=(
                 "You are the top-level orchestrator. "
@@ -103,6 +136,21 @@ class OrchestratorAgent:
             ),
             model_settings=runtime.fast_model_settings,
         )
+        # Local models can't drive the zero-arg tool delegates; route by name instead (#6163: unify these paths).
+        self._route_via_enum = uses_tool_output(runtime.settings.chat_provider)
+        # The router has no tools, so NativeOutput works on Ollama here; a lone output tool
+        # would tempt a local model to answer in plain text and never call it.
+        self._router = (
+            Agent(
+                model=runtime.fast_model,
+                output_type=NativeOutput([_RouteDecision]),
+                retries=output_retries(runtime.settings.chat_provider),
+                system_prompt=_ROUTER_SYSTEM_PROMPT,
+                model_settings=runtime.fast_model_settings,
+            )
+            if self._route_via_enum
+            else None
+        )
 
     async def handle(self, request: OrchestratorRequest) -> OrchestratorResponse:
         logger.info(
@@ -114,6 +162,8 @@ class OrchestratorAgent:
         )
         if request.resume_with is not None:
             return await self._resume(request, request.resume_with)
+        if self._router is not None:
+            return await self._route_and_dispatch(request)
         result = await self.agent.run(
             self._build_prompt(request),
             deps=OrchestratorDeps(runtime=self.runtime, request=request),
@@ -121,6 +171,31 @@ class OrchestratorAgent:
         logger.info("[orchestrator] routed -> %s", type(result.output).__name__)
         return result.output
 
+    async def _route_and_dispatch(self, request: OrchestratorRequest) -> OrchestratorResponse:
+        """Local-model routing: pick a capability by name, then dispatch in Python."""
+        assert self._router is not None
+        result = await self._router.run(self._build_prompt(request))
+        decision = result.output
+        logger.info("[orchestrator] enum-routed -> %s", decision.capability)
+        match decision.capability:
+            case "pdf_edit":
+                return await self._run_pdf_edit(request)
+            case "pdf_question":
+                return await self._run_pdf_question(request)
+            case "user_spec":
+                return await self._run_agent_draft(request)
+            case "pdf_review":
+                return await self._run_pdf_review(request)
+            case "pdf_create":
+                return await self._run_pdf_create(request)
+            case "unsupported":
+                return UnsupportedCapabilityResponse(
+                    capability="orchestrate",
+                    message=decision.message or "I can't help with that request.",
+                )
+            case _ as unreachable:
+                assert_never(unreachable)
+
     async def _resume(self, request: OrchestratorRequest, capability: SupportedCapability) -> OrchestratorResponse:
         """Fast-path to get back to the correct endpoint without having to call AI.
 
diff --git a/engine/src/stirling/agents/output_mode.py b/engine/src/stirling/agents/output_mode.py
new file mode 100644
index 0000000000..8751178448
--- /dev/null
+++ b/engine/src/stirling/agents/output_mode.py
@@ -0,0 +1,28 @@
+"""Provider-aware output: Ollama/custom block tools under native json-schema, so use ToolOutput not NativeOutput."""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+from typing import Any
+
+from pydantic_ai.output import NativeOutput, ToolOutput
+
+# Providers whose OpenAI-compatible endpoint needs tool-delivered structured output.
+_TOOL_OUTPUT_PROVIDERS = frozenset({"ollama", "custom"})
+
+
+def uses_tool_output(chat_provider: str) -> bool:
+    return chat_provider in _TOOL_OUTPUT_PROVIDERS
+
+
+def structured_output(output_types: Sequence[Any], *, chat_provider: str) -> Any:
+    """Pick a structured-output spec compatible with the active chat provider."""
+    types = list(output_types)
+    if uses_tool_output(chat_provider):
+        return [ToolOutput(t) for t in types]
+    return NativeOutput(types)
+
+
+def output_retries(chat_provider: str, *, native: int = 1, tool: int = 6) -> int:
+    """Local models delivering via ToolOutput need more output-validation retries."""
+    return tool if uses_tool_output(chat_provider) else native
diff --git a/engine/src/stirling/agents/pdf_questions.py b/engine/src/stirling/agents/pdf_questions.py
index 5b956c468b..f594c2fdd7 100644
--- a/engine/src/stirling/agents/pdf_questions.py
+++ b/engine/src/stirling/agents/pdf_questions.py
@@ -3,10 +3,10 @@ from __future__ import annotations
 import logging
 
 from pydantic_ai import Agent
-from pydantic_ai.output import NativeOutput
 
 from stirling.agents.contradiction import ContradictionCapability, ContradictionDetector
 from stirling.agents.math_presentation import MathIntentClassifier, extract_math_verdict
+from stirling.agents.output_mode import output_retries, structured_output
 from stirling.agents.shared import ChunkedReasoner, WholeDocReaderCapability
 from stirling.contracts import (
     AiFile,
@@ -196,9 +196,15 @@ class PdfQuestionAgent:
             files=request.files,
             principals=principals,
         )
+        # Ollama/custom block tool-calling under native json-schema output, so deliver the
+        # structured result via a tool call or the model answers ungrounded. See agents.output_mode.
+        provider = self.runtime.settings.chat_provider
         agent = Agent(
             model=self.runtime.smart_model,
-            output_type=NativeOutput([PdfQuestionAnswerResponse, PdfQuestionNotFoundResponse]),
+            output_type=structured_output(
+                [PdfQuestionAnswerResponse, PdfQuestionNotFoundResponse], chat_provider=provider
+            ),
+            retries=output_retries(provider),
             system_prompt=PDF_QUESTION_SYSTEM_PROMPT,
             # pydantic-ai accepts a list of (string-or-callable) instruction sources;
             # it resolves each at run time and concatenates them for the model.
diff --git a/engine/src/stirling/api/app.py b/engine/src/stirling/api/app.py
index 34b0da36fd..60de81360f 100644
--- a/engine/src/stirling/api/app.py
+++ b/engine/src/stirling/api/app.py
@@ -3,28 +3,20 @@ from __future__ import annotations
 import asyncio
 import logging
 from contextlib import asynccontextmanager
-from typing import Annotated
 
-from fastapi import Depends, FastAPI
+from fastapi import Depends, FastAPI, Request
 from pydantic_ai import Agent
+from pydantic_ai.models import Model
 from pydantic_ai.models.instrumented import InstrumentationSettings
 
-from stirling.agents import (
-    DocumentClassifierAgent,
-    ExecutionPlanningAgent,
-    OrchestratorAgent,
-    PdfEditAgent,
-    PdfQuestionAgent,
-    UserSpecAgent,
-)
-from stirling.agents.ledger import MathAuditorAgent
-from stirling.agents.pdf_comment import PdfCommentAgent
+from stirling.api.bootstrap import apply_app_state, build_app_state
 from stirling.api.dependencies import enforce_required_user_id
 from stirling.api.engine_auth import EngineSharedSecretMiddleware
 from stirling.api.middleware import UserIdMiddleware
 from stirling.api.routes import (
     agent_capabilities_router,
     agent_draft_router,
+    config_router,
     document_classifier_router,
     document_router,
     execution_router,
@@ -34,38 +26,42 @@ from stirling.api.routes import (
     pdf_edit_router,
     pdf_question_router,
 )
+from stirling.api.routes.config import CONFIG_APPLY_ERRORS, apply_to_app, resolve_and_apply
 from stirling.config import AppSettings, load_settings
+from stirling.config.config_cache import cache_stamp, load_config
 from stirling.contracts import HealthResponse
-from stirling.documents import DocumentService
-from stirling.services import build_runtime, setup_posthog_tracking
+from stirling.documents import DocumentService, EmbeddingService
+from stirling.services import setup_posthog_tracking
 
 logger = logging.getLogger(__name__)
 
 
+# Seconds the lifespan waits for a background task to drain before cancelling it.
+_BACKGROUND_TASK_DRAIN_SECONDS = 10
+
+
+async def _sleep_until(stop: asyncio.Event, seconds: float) -> bool:
+    """Wait up to ``seconds``; True if asked to stop, False if the interval elapsed."""
+    try:
+        await asyncio.wait_for(stop.wait(), timeout=seconds)
+    except TimeoutError:
+        return False
+    return True
+
+
 async def _run_expired_doc_reaper(
     documents: DocumentService,
     interval_seconds: int,
+    stop: asyncio.Event,
 ) -> None:
-    """Periodically delete documents whose ``expires_at`` has passed.
-
-    A reaped collection drops everything rooted at that document. Backstop
-    for the explicit logout purge: catches sessions that ended without a
-    clean logout (tab close, JWT expiry, engine restart). Persistent rows
-    (``expires_at`` null, the shape we use for org-shared docs) are never
-    touched. Runs until cancelled by the lifespan teardown.
-    """
+    """Backstop purge of documents past ``expires_at``; persistent (null expires_at) rows are never touched."""
     await _reap(documents)
-    while True:
-        await asyncio.sleep(interval_seconds)
+    while not await _sleep_until(stop, interval_seconds):
         await _reap(documents)
 
 
 async def _reap(documents: DocumentService) -> None:
-    """One reaper iteration. Logs the deleted count on success and the full
-    exception with traceback on failure; never re-raises non-cancel errors so
-    a bad iteration doesn't kill the loop. ``asyncio.CancelledError`` is
-    re-raised so the lifespan teardown can cancel the task cleanly.
-    """
+    """One reaper iteration; swallows non-cancel errors so a bad iteration doesn't kill the loop."""
     try:
         deleted = await documents.reap_expired()
         if deleted:
@@ -76,6 +72,45 @@ async def _reap(documents: DocumentService) -> None:
         logger.exception("Document reaper iteration failed; will retry on next interval")
 
 
+def _adopt_cached_config_if_changed(fast_api: FastAPI) -> None:
+    """Re-apply the persisted config when the shared cache file changed under us; never raises."""
+    # Read the stamp before the payload: a write landing between the two re-applies next
+    # tick, whereas the reverse order would record the newer stamp and skip forever.
+    stamp = cache_stamp()
+    if stamp is None or stamp == getattr(fast_api.state, "config_cache_stamp", None):
+        return
+    # Claim the stamp up front so a cache we cannot read or apply is not retried every tick.
+    fast_api.state.config_cache_stamp = stamp
+    cached = load_config()
+    if cached is None:
+        return
+    try:
+        effective, _ = apply_to_app(fast_api, cached)
+    except CONFIG_APPLY_ERRORS:
+        logger.warning("Config pushed to another worker could not be applied here", exc_info=True)
+        return
+    logger.info(
+        "Adopted AI config pushed to another worker: smart_model=%s fast_model=%s",
+        effective.smart_model_name,
+        effective.fast_model_name,
+    )
+
+
+async def _run_config_cache_watcher(
+    fast_api: FastAPI,
+    interval_seconds: int,
+    stop: asyncio.Event,
+) -> None:
+    """Poll the shared config cache so every worker converges on the last push."""
+    while not await _sleep_until(stop, interval_seconds):
+        try:
+            _adopt_cached_config_if_changed(fast_api)
+        except asyncio.CancelledError:
+            raise
+        except Exception:
+            logger.exception("Config cache watcher iteration failed; will retry on next interval")
+
+
 def _load_startup_settings(fast_api: FastAPI) -> AppSettings:
     override = fast_api.dependency_overrides.get(load_settings)
     if override is not None:
@@ -83,37 +118,84 @@ def _load_startup_settings(fast_api: FastAPI) -> AppSettings:
     return load_settings()
 
 
+def _restore_cached_config(
+    settings: AppSettings,
+) -> tuple[AppSettings, Model | None, Model | None, EmbeddingService | None]:
+    """Restore the last-applied pushed config from the encrypted cache, or env settings on any failure."""
+    if not settings.allow_config_push:
+        return settings, None, None, None
+    cached = load_config()
+    if cached is None:
+        return settings, None, None, None
+    try:
+        effective, smart_model, fast_model, embedder, notes = resolve_and_apply(settings, cached)
+    except CONFIG_APPLY_ERRORS:
+        logger.warning("Cached AI config could not be applied; falling back to env settings", exc_info=True)
+        return settings, None, None, None
+    logger.info(
+        "Restored cached AI config: smart_model=%s fast_model=%s%s",
+        effective.smart_model_name,
+        effective.fast_model_name,
+        f"; {'; '.join(notes)}" if notes else "",
+    )
+    return effective, smart_model, fast_model, embedder
+
+
 @asynccontextmanager
 async def lifespan(fast_api: FastAPI):
     # Load env vars on startup so we can immediately crash if required env vars aren't set
     settings = _load_startup_settings(fast_api)
-    runtime = build_runtime(settings)
-    fast_api.state.settings = settings
-    fast_api.state.runtime = runtime
-    fast_api.state.orchestrator_agent = OrchestratorAgent(runtime)
-    fast_api.state.pdf_edit_agent = PdfEditAgent(runtime)
-    fast_api.state.pdf_question_agent = PdfQuestionAgent(runtime)
-    fast_api.state.user_spec_agent = UserSpecAgent(runtime)
-    fast_api.state.execution_planning_agent = ExecutionPlanningAgent(runtime)
-    fast_api.state.math_auditor_agent = MathAuditorAgent(runtime)
-    fast_api.state.pdf_comment_agent = PdfCommentAgent(runtime)
-    fast_api.state.document_classifier_agent = DocumentClassifierAgent(runtime)
-    tracer_provider = setup_posthog_tracking(settings)
+    # Precedence: env < persisted cache < live push. Stamp first so a push landing mid-boot
+    # is re-adopted by the watcher rather than mistaken for the config we just restored.
+    fast_api.state.config_cache_stamp = cache_stamp()
+    effective, smart_model, fast_model, embedder = _restore_cached_config(settings)
+    app_state = build_app_state(
+        effective,
+        fast_model=fast_model,
+        smart_model=smart_model,
+        embedder=embedder,
+    )
+    fast_api.state.settings = effective
+    apply_app_state(fast_api.state, app_state)
+    runtime = app_state.runtime
+    tracer_provider = setup_posthog_tracking(effective)
     if tracer_provider:
         Agent.instrument_all(InstrumentationSettings(tracer_provider=tracer_provider))
+    stop_background = asyncio.Event()
     reaper_task = asyncio.create_task(
         _run_expired_doc_reaper(
             runtime.documents,
             interval_seconds=settings.documents_reaper_interval_seconds,
+            stop=stop_background,
         ),
         name="expired-document-reaper",
     )
+    background_tasks = [reaper_task]
+    if effective.allow_config_push:
+        # A push reaches only one uvicorn worker; this watcher is how the rest of the
+        # pool picks it up, otherwise most requests keep running the previous models.
+        background_tasks.append(
+            asyncio.create_task(
+                _run_config_cache_watcher(
+                    fast_api,
+                    interval_seconds=settings.config_cache_poll_interval_seconds,
+                    stop=stop_background,
+                ),
+                name="config-cache-watcher",
+            )
+        )
     yield
-    reaper_task.cancel()
-    try:
-        await reaper_task
-    except asyncio.CancelledError:
-        pass
+    # Drain the loops rather than cancel: cancelling a reaper mid `to_thread` sqlite call lets
+    # close() pull the connection out from under it and segfault sqlite-vec. Cancel is a backstop.
+    stop_background.set()
+    _, pending = await asyncio.wait(background_tasks, timeout=_BACKGROUND_TASK_DRAIN_SECONDS)
+    for task in pending:
+        logger.warning("Background task %s did not stop in time; cancelling", task.get_name())
+        task.cancel()
+        try:
+            await task
+        except asyncio.CancelledError:
+            pass
     await runtime.documents.close()
     if tracer_provider:
         tracer_provider.shutdown()
@@ -135,10 +217,16 @@ app.include_router(ledger_router, dependencies=_user_gate)
 app.include_router(pdf_comments_router, dependencies=_user_gate)
 app.include_router(agent_capabilities_router, dependencies=_user_gate)
 app.include_router(document_classifier_router, dependencies=_user_gate)
+# Config push is a system sync with no X-User-Id, so it is guarded by the shared secret
+# and allow_config_push flag only, deliberately NOT the per-user identity gate.
+app.include_router(config_router)
 
 
 @app.get("/health", response_model=HealthResponse)
-async def healthcheck(settings: Annotated[AppSettings, Depends(load_settings)]) -> HealthResponse:
+async def healthcheck(http_request: Request) -> HealthResponse:
+    # Report the LIVE config on app.state, not the boot-time env cache, so an admin
+    # "Test connection" shows the model actually in use after a push. Falls back to env.
+    settings: AppSettings = getattr(http_request.app.state, "settings", None) or load_settings()
     return HealthResponse(
         status="ok",
         smart_model=settings.smart_model_name,
diff --git a/engine/src/stirling/api/bootstrap.py b/engine/src/stirling/api/bootstrap.py
new file mode 100644
index 0000000000..241578438e
--- /dev/null
+++ b/engine/src/stirling/api/bootstrap.py
@@ -0,0 +1,72 @@
+"""Assemble the runtime + agents into one bundle, swapped onto app.state atomically to change models at runtime."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, fields
+from typing import Any
+
+from pydantic_ai.models import Model
+
+from stirling.agents import (
+    DocumentClassifierAgent,
+    ExecutionPlanningAgent,
+    OrchestratorAgent,
+    PdfEditAgent,
+    PdfQuestionAgent,
+    UserSpecAgent,
+)
+from stirling.agents.ledger import MathAuditorAgent
+from stirling.agents.pdf_comment import PdfCommentAgent
+from stirling.config import AppSettings
+from stirling.documents import DocumentService, EmbeddingService
+from stirling.services import AppRuntime, build_runtime
+
+
+@dataclass(frozen=True)
+class AppState:
+    """Every object the lifespan assigns onto ``fast_api.state``."""
+
+    runtime: AppRuntime
+    orchestrator_agent: OrchestratorAgent
+    pdf_edit_agent: PdfEditAgent
+    pdf_question_agent: PdfQuestionAgent
+    user_spec_agent: UserSpecAgent
+    execution_planning_agent: ExecutionPlanningAgent
+    math_auditor_agent: MathAuditorAgent
+    pdf_comment_agent: PdfCommentAgent
+    document_classifier_agent: DocumentClassifierAgent
+
+
+def build_app_state(
+    settings: AppSettings,
+    *,
+    documents: DocumentService | None = None,
+    fast_model: Model | None = None,
+    smart_model: Model | None = None,
+    embedder: EmbeddingService | None = None,
+) -> AppState:
+    """Build the runtime and every agent from ``settings``."""
+    runtime = build_runtime(
+        settings,
+        documents=documents,
+        fast_model=fast_model,
+        smart_model=smart_model,
+        embedder=embedder,
+    )
+    return AppState(
+        runtime=runtime,
+        orchestrator_agent=OrchestratorAgent(runtime),
+        pdf_edit_agent=PdfEditAgent(runtime),
+        pdf_question_agent=PdfQuestionAgent(runtime),
+        user_spec_agent=UserSpecAgent(runtime),
+        execution_planning_agent=ExecutionPlanningAgent(runtime),
+        math_auditor_agent=MathAuditorAgent(runtime),
+        pdf_comment_agent=PdfCommentAgent(runtime),
+        document_classifier_agent=DocumentClassifierAgent(runtime),
+    )
+
+
+def apply_app_state(state: Any, app_state: AppState) -> None:
+    """Copy every field of ``app_state`` onto a Starlette ``app.state`` object."""
+    for field in fields(app_state):
+        setattr(state, field.name, getattr(app_state, field.name))
diff --git a/engine/src/stirling/api/routes/__init__.py b/engine/src/stirling/api/routes/__init__.py
index f40e9918f8..440ff18f9d 100644
--- a/engine/src/stirling/api/routes/__init__.py
+++ b/engine/src/stirling/api/routes/__init__.py
@@ -1,5 +1,6 @@
 from .agent_capabilities import router as agent_capabilities_router
 from .agent_drafts import router as agent_draft_router
+from .config import router as config_router
 from .document_classifier import router as document_classifier_router
 from .documents import router as document_router
 from .execution import router as execution_router
@@ -12,6 +13,7 @@ from .pdf_questions import router as pdf_question_router
 __all__ = [
     "agent_capabilities_router",
     "agent_draft_router",
+    "config_router",
     "document_classifier_router",
     "document_router",
     "execution_router",
diff --git a/engine/src/stirling/api/routes/config.py b/engine/src/stirling/api/routes/config.py
new file mode 100644
index 0000000000..cc06a8d87e
--- /dev/null
+++ b/engine/src/stirling/api/routes/config.py
@@ -0,0 +1,250 @@
+from __future__ import annotations
+
+import ipaddress
+import logging
+
+from fastapi import APIRouter, FastAPI, HTTPException, Request, status
+from openai import OpenAIError
+from pydantic_ai.exceptions import UserError
+from pydantic_ai.models import Model
+
+from stirling.api.bootstrap import apply_app_state, build_app_state
+from stirling.config import AppSettings
+from stirling.config.config_cache import cache_stamp, save_config
+from stirling.contracts import ConfigApplyResponse, ConfigPushRequest
+from stirling.documents import EmbeddingService
+from stirling.services import AppRuntime
+from stirling.services.runtime import _build_model, validate_structured_output_support
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/api/v1/config", tags=["config"])
+
+# Model/provider construction + validation failures. The HTTP route maps these to a
+# 400 (no swap); boot catches them to fall back to env when a cached config is bad.
+CONFIG_APPLY_ERRORS = (ValueError, UserError, OpenAIError)
+
+_REINDEX_NOTE = (
+    "Embedding model changed; existing indexed documents were embedded with the previous model and "
+    "must be re-indexed. If the embedding dimensionality changed, re-ingest before searching."
+)
+
+
+def _strip_provider_prefix(model_name: str) -> str:
+    """Drop a leading ``provider:`` from an env model string ("anthropic:x" -> "x")."""
+    _, sep, rest = model_name.partition(":")
+    return rest if sep else model_name
+
+
+def _compose_embedding_model(provider: str, model: str) -> str:
+    """Compose the engine's ``provider:model`` embedding string from pushed parts."""
+    provider = provider.strip()
+    return f"{provider}:{model}" if provider else model
+
+
+def _split_embedding_ref(ref: str) -> tuple[str, str]:
+    """Split an env embedding string ("voyageai:voyage-4") into (provider, model)."""
+    provider, sep, model = ref.partition(":")
+    return (provider, model) if sep else ("", ref)
+
+
+def _keep(pushed: int | None, current: int) -> int:
+    """Return the pushed value, or the current one when the push omitted it."""
+    return pushed if pushed is not None else current
+
+
+# Presence of any of these means request.client.host may be proxy-rewritten and cannot be
+# trusted as the transport peer, so a spoofed X-Forwarded-For could otherwise read as loopback.
+_FORWARDING_HEADERS = ("x-forwarded-for", "x-forwarded-host", "x-real-ip", "forwarded")
+
+
+def _is_direct_loopback_client(request: Request) -> bool:
+    """True only for a direct local connection with no proxy; fails closed if any forwarding header is present."""
+    if any(h in request.headers for h in _FORWARDING_HEADERS):
+        return False
+    client = request.client
+    if client is None:
+        return False
+    try:
+        return ipaddress.ip_address(client.host).is_loopback
+    except ValueError:
+        return client.host == "localhost"
+
+
+def resolve_and_apply(
+    current: AppSettings,
+    request: ConfigPushRequest,
+) -> tuple[AppSettings, Model, Model, EmbeddingService | None, list[str]]:
+    """Resolve a pushed config against the running settings; it never swaps live state (the caller does)."""
+    models = request.models
+    rag = request.rag
+    limits = request.limits
+    notes: list[str] = []
+
+    provider = models.provider.strip()
+    api_key = models.api_key
+    base_url = models.base_url
+    use_explicit_provider = bool(provider or api_key or base_url)
+
+    if use_explicit_provider and not current.chat_provider:
+        # First push over an env engine: running names are still "provider:model", strip the prefix.
+        smart_name = models.smart_model or _strip_provider_prefix(current.smart_model_name)
+        fast_name = models.fast_model or _strip_provider_prefix(current.fast_model_name)
+    elif use_explicit_provider:
+        # A provider was already pushed, so the running names are bare and may legitimately
+        # contain a colon ("llama3.1:8b"). Stripping again would truncate them to "8b".
+        smart_name = models.smart_model or current.smart_model_name
+        fast_name = models.fast_model or current.fast_model_name
+    else:
+        # No provider/credentials pushed: keep the fully env-driven model strings.
+        smart_name = models.smart_model or current.smart_model_name
+        fast_name = models.fast_model or current.fast_model_name
+
+    def _build(bare: str) -> Model:
+        if use_explicit_provider:
+            return _build_model(bare, provider=provider or None, api_key=api_key or None, base_url=base_url or None)
+        return _build_model(bare)
+
+    smart_model = _build(smart_name)
+    fast_model = _build(fast_name)
+    validate_structured_output_support(smart_model, smart_name)
+    validate_structured_output_support(fast_model, fast_name)
+
+    # Scalars: None / empty keep the current value.
+    smart_max_tokens = _keep(models.smart_max_tokens, current.smart_model_max_tokens)
+    fast_max_tokens = _keep(models.fast_max_tokens, current.fast_model_max_tokens)
+    top_k = _keep(rag.top_k, current.rag_default_top_k)
+    max_searches = _keep(rag.max_searches, current.rag_max_searches)
+    max_pages = _keep(limits.max_pages, current.max_pages)
+    max_characters = _keep(limits.max_characters, current.max_characters)
+    model_max_concurrency = _keep(limits.model_max_concurrency, current.model_max_concurrency)
+
+    # Embedding: any non-empty embedding field triggers a rebuild; empty fields fall
+    # back to the running provider/model/creds so a partial push never clobbers env.
+    embedding_changed = bool(
+        rag.embedding_provider.strip() or rag.embedding_model.strip() or rag.embedding_api_key or rag.embedding_base_url
+    )
+    rag_embedding_model = current.rag_embedding_model
+    new_embedder: EmbeddingService | None = None
+    if embedding_changed:
+        current_provider, current_model = _split_embedding_ref(current.rag_embedding_model)
+        embed_provider = rag.embedding_provider.strip() or current_provider
+        embed_model = rag.embedding_model.strip() or current_model
+        rag_embedding_model = _compose_embedding_model(embed_provider, embed_model)
+        new_embedder = EmbeddingService(
+            model_name=embed_model,
+            chunk_size=current.rag_chunk_size,
+            chunk_overlap=current.rag_chunk_overlap,
+            provider=embed_provider or None,
+            api_key=rag.embedding_api_key or None,
+            base_url=rag.embedding_base_url or None,
+        )
+        notes.append(_REINDEX_NOTE)
+
+    effective = current.model_copy(
+        update={
+            "chat_provider": provider,
+            "smart_model_name": smart_name,
+            "fast_model_name": fast_name,
+            "smart_model_max_tokens": smart_max_tokens,
+            "fast_model_max_tokens": fast_max_tokens,
+            "rag_embedding_model": rag_embedding_model,
+            "rag_default_top_k": top_k,
+            "rag_max_searches": max_searches,
+            "max_pages": max_pages,
+            "max_characters": max_characters,
+            "model_max_concurrency": model_max_concurrency,
+        }
+    )
+    return effective, smart_model, fast_model, new_embedder, notes
+
+
+def apply_to_app(app: FastAPI, request: ConfigPushRequest) -> tuple[AppSettings, list[str]]:
+    """Resolve ``request`` and swap the bundle onto app.state; no await, so the swap is atomic wrt the event loop."""
+    current: AppSettings = app.state.settings
+    runtime: AppRuntime = app.state.runtime
+    effective, smart_model, fast_model, new_embedder, notes = resolve_and_apply(current, request)
+    new_state = build_app_state(
+        effective,
+        documents=runtime.documents,
+        fast_model=fast_model,
+        smart_model=smart_model,
+    )
+    app.state.settings = effective
+    apply_app_state(app.state, new_state)
+    # Retune retrieval breadth on the reused store without rebuilding it.
+    runtime.documents.default_top_k = effective.rag_default_top_k
+    if new_embedder is not None:
+        # Swap the embedder onto the reused DocumentService, never tearing down the live store.
+        runtime.documents.embedder = new_embedder
+    return effective, notes
+
+
+@router.post("", response_model=ConfigApplyResponse)
+async def apply_config(request: ConfigPushRequest, http_request: Request) -> ConfigApplyResponse:
+    """Apply admin-pushed AI settings by rebuilding the runtime + agents, persisting so it survives a restart."""
+    app = http_request.app
+    current: AppSettings = app.state.settings
+    if not current.allow_config_push:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Config push is disabled on this deployment (STIRLING_ALLOW_CONFIG_PUSH is false).",
+        )
+    # Secure-by-default: with no shared secret set, only trust a direct loopback caller, since a
+    # pushed base_url/model could repoint the engine to exfiltrate document content.
+    if not current.engine_shared_secret and not _is_direct_loopback_client(http_request):
+        client_host = http_request.client.host if http_request.client else "unknown"
+        logger.warning(
+            "Rejected config push from non-local/proxied caller %s with no shared secret set",
+            client_host,
+        )
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail=(
+                "Config push from a non-local or proxied caller requires"
+                " STIRLING_ENGINE_SHARED_SECRET to be set on both the engine and the processor."
+            ),
+        )
+
+    try:
+        effective, notes = apply_to_app(app, request)
+    except CONFIG_APPLY_ERRORS as exc:
+        # Reject without touching the running config.
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(exc)) from exc
+
+    # Persist (encrypted) so the config survives a restart and sibling workers adopt it.
+    # Best-effort: it is already applied live, so a persist failure must never become a 500.
+    try:
+        save_config(request)
+        # Claim the stamp we just wrote so this worker's watcher does not rebuild for it.
+        app.state.config_cache_stamp = cache_stamp()
+    except Exception:  # noqa: BLE001 - best-effort persist, never fail the applied push
+        logger.warning("Applied AI config but failed to persist the encrypted cache", exc_info=True)
+        notes.append(
+            "Config applied on this worker but could not be persisted; it will not survive an"
+            " engine restart and other workers will not pick it up."
+        )
+
+    logger.info(
+        "Applied pushed AI config: provider=%s smart_model=%s fast_model=%s top_k=%s",
+        request.models.provider.strip() or "<env>",
+        effective.smart_model_name,
+        effective.fast_model_name,
+        effective.rag_default_top_k,
+    )
+
+    return ConfigApplyResponse(
+        status="applied",
+        provider=request.models.provider.strip(),
+        smart_model=effective.smart_model_name,
+        fast_model=effective.fast_model_name,
+        smart_max_tokens=effective.smart_model_max_tokens,
+        fast_max_tokens=effective.fast_model_max_tokens,
+        rag_embedding_model=effective.rag_embedding_model,
+        rag_top_k=effective.rag_default_top_k,
+        rag_max_searches=effective.rag_max_searches,
+        max_pages=effective.max_pages,
+        max_characters=effective.max_characters,
+        model_max_concurrency=effective.model_max_concurrency,
+        notes=notes,
+    )
diff --git a/engine/src/stirling/config/config_cache.py b/engine/src/stirling/config/config_cache.py
new file mode 100644
index 0000000000..deb5864f97
--- /dev/null
+++ b/engine/src/stirling/config/config_cache.py
@@ -0,0 +1,116 @@
+"""Persistent, Fernet-encrypted cache of the last-applied config-push. Boot restores it so an
+engine-only restart keeps admin config; sibling uvicorn workers poll it to adopt a push."""
+
+from __future__ import annotations
+
+import base64
+import logging
+import os
+import stat
+from pathlib import Path
+
+from cryptography.fernet import Fernet, InvalidToken
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.kdf.hkdf import HKDF
+
+from stirling.config.settings import ENGINE_ROOT, load_settings
+from stirling.contracts import ConfigPushRequest
+
+logger = logging.getLogger(__name__)
+
+_CACHE_FILENAME = "ai_config_cache.enc"
+_KEY_FILENAME = "ai_config_cache.key"
+# Constant salt/info so the same shared secret always derives the same Fernet key.
+_HKDF_SALT = b"stirling-ai-config-cache/v1/salt"
+_HKDF_INFO = b"stirling-ai-config-cache/v1/fernet-key"
+
+_keyfile_warned = False
+
+
+def _default_data_dir() -> Path:
+    """The engine data dir (where the sqlite store lives by default)."""
+    return ENGINE_ROOT / "data"
+
+
+def _shared_secret() -> str:
+    return load_settings().engine_shared_secret
+
+
+def _derive_key_from_secret(secret: str) -> bytes:
+    hkdf = HKDF(algorithm=hashes.SHA256(), length=32, salt=_HKDF_SALT, info=_HKDF_INFO)
+    return base64.urlsafe_b64encode(hkdf.derive(secret.encode("utf-8")))
+
+
+def _write_private_bytes(path: Path, payload: bytes) -> None:
+    """Write ``payload`` to ``path`` atomically (temp file + rename) and owner-only (0600) from the moment it exists."""
+    tmp_path = path.with_name(f"{path.name}.tmp")
+    fd = os.open(tmp_path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, stat.S_IRUSR | stat.S_IWUSR)
+    try:
+        with os.fdopen(fd, "wb") as handle:
+            handle.write(payload)
+            handle.flush()
+            os.fsync(handle.fileno())
+        os.replace(tmp_path, path)
+    except BaseException:
+        tmp_path.unlink(missing_ok=True)
+        raise
+
+
+def _load_or_create_keyfile(data_dir: Path) -> bytes:
+    global _keyfile_warned
+    key_path = data_dir / _KEY_FILENAME
+    if key_path.exists():
+        return key_path.read_bytes().strip()
+    key = Fernet.generate_key()
+    data_dir.mkdir(parents=True, exist_ok=True)
+    _write_private_bytes(key_path, key)
+    if not _keyfile_warned:
+        logger.warning(
+            "STIRLING_ENGINE_SHARED_SECRET is not set; encrypting the AI config cache with a local"
+            " keyfile at %s (0600, best-effort). This is modest protection only - set a shared secret"
+            " for HKDF key derivation in any deployment where the cache must be strongly protected.",
+            key_path,
+        )
+        _keyfile_warned = True
+    return key
+
+
+def _fernet(data_dir: Path) -> Fernet:
+    secret = _shared_secret()
+    if secret:
+        return Fernet(_derive_key_from_secret(secret))
+    return Fernet(_load_or_create_keyfile(data_dir))
+
+
+def save_config(request: ConfigPushRequest, *, data_dir: Path | None = None) -> None:
+    """Encrypt and persist the last-applied pushed config, overwriting any prior file."""
+    data_dir = data_dir or _default_data_dir()
+    data_dir.mkdir(parents=True, exist_ok=True)
+    payload = request.model_dump_json(by_alias=True).encode("utf-8")
+    token = _fernet(data_dir).encrypt(payload)
+    _write_private_bytes(data_dir / _CACHE_FILENAME, token)
+
+
+def cache_stamp(*, data_dir: Path | None = None) -> tuple[int, int] | None:
+    """Identify the current cache file as (mtime_ns, size), or None when absent; cheap enough to poll."""
+    cache_path = (data_dir or _default_data_dir()) / _CACHE_FILENAME
+    try:
+        info = cache_path.stat()
+    except OSError:
+        return None
+    return (info.st_mtime_ns, info.st_size)
+
+
+def load_config(*, data_dir: Path | None = None) -> ConfigPushRequest | None:
+    """Load + decrypt the persisted config; returns None (never raises) when absent, corrupt, or wrong key."""
+    data_dir = data_dir or _default_data_dir()
+    cache_path = data_dir / _CACHE_FILENAME
+    if not cache_path.exists():
+        return None
+    try:
+        token = cache_path.read_bytes()
+        payload = _fernet(data_dir).decrypt(token)
+        return ConfigPushRequest.model_validate_json(payload)
+    except (InvalidToken, ValueError, OSError) as exc:
+        logger.warning("Ignoring unreadable AI config cache at %s: %s", cache_path, exc)
+        return None
diff --git a/engine/src/stirling/config/settings.py b/engine/src/stirling/config/settings.py
index 1293cc371f..d0cf6eba2f 100644
--- a/engine/src/stirling/config/settings.py
+++ b/engine/src/stirling/config/settings.py
@@ -25,6 +25,9 @@ class AppSettings(BaseSettings):
 
     smart_model_name: str = Field(validation_alias="STIRLING_SMART_MODEL")
     fast_model_name: str = Field(validation_alias="STIRLING_FAST_MODEL")
+    # Provider backing the active chat models; empty for env/native, 'ollama'/'custom' by push.
+    # Agents read it to pick a tool-compatible output strategy since local models block tools under native json-schema.
+    chat_provider: str = Field(default="")
     smart_model_max_tokens: int = Field(validation_alias="STIRLING_SMART_MODEL_MAX_TOKENS")
     fast_model_max_tokens: int = Field(validation_alias="STIRLING_FAST_MODEL_MAX_TOKENS")
     # Process-wide ceiling on concurrent model API calls, shared by both model
@@ -123,6 +126,15 @@ class AppSettings(BaseSettings):
     engine_shared_secret: str = Field(default="", validation_alias="STIRLING_ENGINE_SHARED_SECRET")
     engine_require_auth: bool = Field(default=False, validation_alias="STIRLING_ENGINE_REQUIRE_AUTH")
 
+    # When true, the Java processor may push admin AI settings to POST /api/v1/config at startup.
+    # Turn off in env-driven deployments so the environment is the single source of truth.
+    allow_config_push: bool = Field(default=True, validation_alias="STIRLING_ALLOW_CONFIG_PUSH")
+    # How often each worker polls the shared config cache; bounds how long the pool can disagree on the active model.
+    config_cache_poll_interval_seconds: int = Field(
+        default=15,
+        validation_alias="STIRLING_CONFIG_CACHE_POLL_INTERVAL_SECONDS",
+    )
+
 
 def _configure_logging(level_name: str, log_file: str, http_debug: bool) -> None:
     """Configure the ``stirling`` logger hierarchy."""
diff --git a/engine/src/stirling/contracts/__init__.py b/engine/src/stirling/contracts/__init__.py
index 513906d610..caf41effa0 100644
--- a/engine/src/stirling/contracts/__init__.py
+++ b/engine/src/stirling/contracts/__init__.py
@@ -29,6 +29,13 @@ from .common import (
     format_conversation_history,
     format_file_names,
 )
+from .config import (
+    ConfigApplyResponse,
+    ConfigLimitsSection,
+    ConfigModelsSection,
+    ConfigPushRequest,
+    ConfigRagSection,
+)
 from .contradiction import (
     Claim,
     Contradiction,
@@ -139,6 +146,11 @@ __all__ = [
     "Claim",
     "CommentSpec",
     "CompletedExecutionAction",
+    "ConfigApplyResponse",
+    "ConfigLimitsSection",
+    "ConfigModelsSection",
+    "ConfigPushRequest",
+    "ConfigRagSection",
     "Contradiction",
     "ContradictionReport",
     "ContradictionSeverity",
diff --git a/engine/src/stirling/contracts/config.py b/engine/src/stirling/contracts/config.py
new file mode 100644
index 0000000000..fed75ac320
--- /dev/null
+++ b/engine/src/stirling/contracts/config.py
@@ -0,0 +1,69 @@
+from __future__ import annotations
+
+from pydantic import ConfigDict, Field
+
+from stirling.models import ApiModel
+
+
+class TolerantApiModel(ApiModel):
+    """Push-contract base: unknown fields from a newer processor are ignored rather than
+    rejecting the whole push. Overrides only the extra policy; camelCase aliasing is inherited."""
+
+    model_config = ConfigDict(extra="ignore")
+
+
+class ConfigModelsSection(TolerantApiModel):
+    """Model provider + credentials pushed by the Java processor; empty fields mean "keep the engine's env value"."""
+
+    provider: str = ""
+    smart_model: str = ""
+    fast_model: str = ""
+    smart_max_tokens: int | None = Field(default=None, ge=1)
+    fast_max_tokens: int | None = Field(default=None, ge=1)
+    api_key: str = ""
+    base_url: str = ""
+
+
+class ConfigRagSection(TolerantApiModel):
+    embedding_provider: str = ""
+    embedding_model: str = ""
+    embedding_api_key: str = ""
+    # OpenAI-compatible endpoint URL for ollama/custom embedding providers; empty keeps the env value.
+    embedding_base_url: str = ""
+    top_k: int | None = Field(default=None, ge=1)
+    # 0 is a legitimate "no retrieval searches" setting, so this floors at 0 not 1.
+    max_searches: int | None = Field(default=None, ge=0)
+
+
+class ConfigLimitsSection(TolerantApiModel):
+    max_pages: int | None = Field(default=None, ge=1)
+    max_characters: int | None = Field(default=None, ge=1)
+    # Must be >= 1: it becomes an asyncio.Semaphore bound, and 0 constructs a permanently locked
+    # semaphore that hangs every model call; the push is persisted so a restart won't clear it.
+    model_max_concurrency: int | None = Field(default=None, ge=1)
+
+
+class ConfigPushRequest(TolerantApiModel):
+    """Admin-configured AI settings pushed at processor startup."""
+
+    models: ConfigModelsSection = Field(default_factory=ConfigModelsSection)
+    rag: ConfigRagSection = Field(default_factory=ConfigRagSection)
+    limits: ConfigLimitsSection = Field(default_factory=ConfigLimitsSection)
+
+
+class ConfigApplyResponse(ApiModel):
+    """Summary of the effective config after a push. Never echoes credentials."""
+
+    status: str
+    provider: str
+    smart_model: str
+    fast_model: str
+    smart_max_tokens: int
+    fast_max_tokens: int
+    rag_embedding_model: str
+    rag_top_k: int
+    rag_max_searches: int
+    max_pages: int
+    max_characters: int
+    model_max_concurrency: int
+    notes: list[str] = Field(default_factory=list)
diff --git a/engine/src/stirling/documents/embedder.py b/engine/src/stirling/documents/embedder.py
index 13e9c7018d..c92a448149 100644
--- a/engine/src/stirling/documents/embedder.py
+++ b/engine/src/stirling/documents/embedder.py
@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 from pydantic_ai import Embedder
+from pydantic_ai.embeddings.openai import OpenAIEmbeddingModel
+from pydantic_ai.providers.openai import OpenAIProvider
 
 from stirling.documents.chunker import chunk_text
 from stirling.documents.store import Document
@@ -12,6 +14,27 @@ from stirling.documents.store import Document
 DEFAULT_EMBED_BATCH_SIZE = 256
 
 
+def _build_embedder(
+    model_name: str,
+    *,
+    provider: str | None = None,
+    api_key: str | None = None,
+    base_url: str | None = None,
+) -> Embedder:
+    """Construct an :class:`Embedder`; explicit provider/api_key/base_url is the config-push path, else env form."""
+    if not provider and not api_key and not base_url:
+        return Embedder(model_name)
+
+    provider_name = (provider or "").lower()
+    key = api_key or None
+    if provider_name in ("voyageai", "openai"):
+        return Embedder(f"{provider_name}:{model_name}")
+    if provider_name in ("ollama", "custom"):
+        openai_provider = OpenAIProvider(base_url=base_url or None, api_key=key or "ollama")
+        return Embedder(OpenAIEmbeddingModel(model_name, provider=openai_provider))
+    raise ValueError(f"Unsupported embedding provider {provider!r}.")
+
+
 class EmbeddingService:
     """Wraps Pydantic AI's Embedder to provide document chunking and embedding."""
 
@@ -21,8 +44,12 @@ class EmbeddingService:
         chunk_size: int = 512,
         chunk_overlap: int = 64,
         embed_batch_size: int = DEFAULT_EMBED_BATCH_SIZE,
+        *,
+        provider: str | None = None,
+        api_key: str | None = None,
+        base_url: str | None = None,
     ) -> None:
-        self._embedder = Embedder(model_name)
+        self._embedder = _build_embedder(model_name, provider=provider, api_key=api_key, base_url=base_url)
         self._chunk_size = chunk_size
         self._chunk_overlap = chunk_overlap
         self._embed_batch_size = embed_batch_size
diff --git a/engine/src/stirling/documents/service.py b/engine/src/stirling/documents/service.py
index 262f5f7ff4..0415e9d140 100644
--- a/engine/src/stirling/documents/service.py
+++ b/engine/src/stirling/documents/service.py
@@ -43,6 +43,24 @@ class DocumentService:
         self._store = store
         self._default_top_k = default_top_k
 
+    @property
+    def default_top_k(self) -> int:
+        return self._default_top_k
+
+    @default_top_k.setter
+    def default_top_k(self, value: int) -> None:
+        # Lets a config-push retune retrieval breadth without rebuilding the store.
+        self._default_top_k = value
+
+    @property
+    def embedder(self) -> EmbeddingService:
+        return self._embedder
+
+    @embedder.setter
+    def embedder(self, value: EmbeddingService) -> None:
+        # Lets a config-push swap the embedding model while keeping the live store; existing vectors need re-indexing.
+        self._embedder = value
+
     async def ingest(
         self,
         collection: FileId,
diff --git a/engine/src/stirling/services/runtime.py b/engine/src/stirling/services/runtime.py
index 011eb8aaf2..06b8595afa 100644
--- a/engine/src/stirling/services/runtime.py
+++ b/engine/src/stirling/services/runtime.py
@@ -1,7 +1,9 @@
 from __future__ import annotations
 
 import asyncio
+import json
 import logging
+import os
 from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
 from dataclasses import dataclass
@@ -12,8 +14,10 @@ from pydantic_ai import RunContext
 from pydantic_ai.messages import ModelMessage, ModelResponse
 from pydantic_ai.models import Model, ModelRequestParameters, StreamedResponse, infer_model
 from pydantic_ai.models.anthropic import AnthropicModel
+from pydantic_ai.models.openai import OpenAIChatModel
 from pydantic_ai.models.wrapper import WrapperModel
 from pydantic_ai.providers.anthropic import AnthropicProvider
+from pydantic_ai.providers.openai import OpenAIProvider
 from pydantic_ai.settings import ModelSettings
 
 from stirling.config import ENGINE_ROOT, AppSettings, DocumentsBackend
@@ -49,6 +53,63 @@ def _build_anthropic_http_client() -> httpx.AsyncClient:
     )
 
 
+# Placeholder when no Anthropic key is set, so a deployment using only another provider
+# (Ollama etc.) can still boot. Anthropic calls then fail with a clear 401 instead.
+_UNCONFIGURED_ANTHROPIC_KEY = "unconfigured"
+_warned_missing_anthropic_key = False
+
+
+def _anthropic_provider(explicit_key: str | None = None) -> AnthropicProvider:
+    """Build the Anthropic provider, tolerating a missing key so an Ollama/OpenAI-only deployment can still boot."""
+    http_client = _build_anthropic_http_client()
+    key = explicit_key or os.environ.get("ANTHROPIC_API_KEY")
+    if key:
+        return AnthropicProvider(api_key=key, http_client=http_client)
+    global _warned_missing_anthropic_key
+    if not _warned_missing_anthropic_key:
+        _warned_missing_anthropic_key = True
+        logger.warning(
+            "ANTHROPIC_API_KEY is not set - the engine will start, but Anthropic model "
+            "calls will fail until a key is provided or a different provider is configured "
+            "(admin AI settings / config push)."
+        )
+    return AnthropicProvider(api_key=_UNCONFIGURED_ANTHROPIC_KEY, http_client=http_client)
+
+
+class _NullContentCoercingTransport(httpx.AsyncHTTPTransport):
+    """Coerce assistant ``content: null`` to ``""`` in outgoing OpenAI requests, which Ollama otherwise rejects."""
+
+    async def handle_async_request(self, request: httpx.Request) -> httpx.Response:
+        if request.headers.get("content-type", "").startswith("application/json") and request.content:
+            try:
+                body = json.loads(request.content)
+            except ValueError:
+                return await super().handle_async_request(request)
+            messages = body.get("messages")
+            if isinstance(messages, list):
+                changed = False
+                for message in messages:
+                    if isinstance(message, dict) and message.get("content", "") is None:
+                        message["content"] = ""
+                        changed = True
+                if changed:
+                    new_body = json.dumps(body).encode("utf-8")
+                    headers = [(k, v) for k, v in request.headers.raw if k.lower() != b"content-length"]
+                    request = httpx.Request(
+                        method=request.method,
+                        url=request.url,
+                        headers=headers,
+                        content=new_body,
+                        extensions=request.extensions,
+                    )
+        return await super().handle_async_request(request)
+
+
+def _openai_compat_http_client() -> httpx.AsyncClient:
+    """httpx client for Ollama/custom OpenAI-compatible endpoints (null-content fix)."""
+    return httpx.AsyncClient(transport=_NullContentCoercingTransport())
+
+
 class ConcurrencyLimitedModel(WrapperModel):
     """Caps in-flight model API calls with a semaphore shared across the process."""
 
@@ -131,45 +192,72 @@ def _build_document_store(settings: AppSettings) -> DocumentStore:
     assert_never(settings.documents_backend)
 
 
-def _build_documents(settings: AppSettings) -> DocumentService:
-    """Build the document service used by per-request RAG capabilities."""
-    logger.info("Documents: embedding_model=%s", settings.rag_embedding_model)
-    embedder = EmbeddingService(
-        model_name=settings.rag_embedding_model,
-        chunk_size=settings.rag_chunk_size,
-        chunk_overlap=settings.rag_chunk_overlap,
-    )
+def _build_documents(settings: AppSettings, embedder: EmbeddingService | None = None) -> DocumentService:
+    """Build the document service used for RAG; ``embedder`` lets a cache-restore boot inject a pre-built one."""
+    if embedder is None:
+        logger.info("Documents: embedding_model=%s", settings.rag_embedding_model)
+        embedder = EmbeddingService(
+            model_name=settings.rag_embedding_model,
+            chunk_size=settings.rag_chunk_size,
+            chunk_overlap=settings.rag_chunk_overlap,
+        )
     store = _build_document_store(settings)
     return DocumentService(embedder=embedder, store=store, default_top_k=settings.rag_default_top_k)
 
 
-def build_runtime(settings: AppSettings) -> AppRuntime:
-    fast_model = _build_model(settings.fast_model_name)
-    smart_model = _build_model(settings.smart_model_name)
-    validate_structured_output_support(fast_model, settings.fast_model_name)
-    validate_structured_output_support(smart_model, settings.smart_model_name)
+def build_runtime(
+    settings: AppSettings,
+    *,
+    documents: DocumentService | None = None,
+    fast_model: Model | None = None,
+    smart_model: Model | None = None,
+    embedder: EmbeddingService | None = None,
+) -> AppRuntime:
+    """Assemble the shared runtime; the keyword args let a config-push reuse the live store and inject built models."""
+    fast = fast_model if fast_model is not None else _build_model(settings.fast_model_name)
+    smart = smart_model if smart_model is not None else _build_model(settings.smart_model_name)
+    validate_structured_output_support(fast, settings.fast_model_name)
+    validate_structured_output_support(smart, settings.smart_model_name)
 
     # One semaphore across both tiers: the cap protects the provider account
     # and process resources, which the tiers share.
     model_semaphore = asyncio.Semaphore(settings.model_max_concurrency)
     return AppRuntime(
         settings=settings,
-        fast_model=ConcurrencyLimitedModel(fast_model, model_semaphore),
-        smart_model=ConcurrencyLimitedModel(smart_model, model_semaphore),
-        documents=_build_documents(settings),
+        fast_model=ConcurrencyLimitedModel(fast, model_semaphore),
+        smart_model=ConcurrencyLimitedModel(smart, model_semaphore),
+        documents=documents if documents is not None else _build_documents(settings, embedder),
     )
 
 
-def _build_model(model_name: str) -> Model:
-    """Construct a model, injecting our keepalive-free httpx client for
-    Anthropic models so workers don't pick up stale pooled connections.
+def _build_model(
+    model_name: str,
+    *,
+    provider: str | None = None,
+    api_key: str | None = None,
+    base_url: str | None = None,
+) -> Model:
+    """Construct a model for ``model_name``; explicit provider/api_key/base_url is the config-push path, else env."""
+    if not provider and not api_key and not base_url:
+        if model_name.startswith("anthropic:"):
+            bare_name = model_name.removeprefix("anthropic:")
+            return AnthropicModel(bare_name, provider=_anthropic_provider())
+        return infer_model(model_name)
 
-    Other providers fall back to ``infer_model`` defaults; the stale-pool
-    issue is specific to the Cloudflare-fronted Anthropic API in our
-    observations and the fix doesn't necessarily apply elsewhere.
-    """
-    if model_name.startswith("anthropic:"):
-        bare_name = model_name.removeprefix("anthropic:")
-        provider = AnthropicProvider(http_client=_build_anthropic_http_client())
-        return AnthropicModel(bare_name, provider=provider)
-    return infer_model(model_name)
+    provider_name = (provider or "").lower()
+    key = api_key or None
+    if provider_name == "anthropic":
+        return AnthropicModel(model_name, provider=_anthropic_provider(key))
+    if provider_name == "openai":
+        openai_provider = OpenAIProvider(api_key=key) if key else OpenAIProvider()
+        return OpenAIChatModel(model_name, provider=openai_provider)
+    if provider_name in ("ollama", "custom"):
+        # OpenAI-compatible endpoint. Ollama ignores the key but the SDK needs a non-empty
+        # one, so default to a placeholder; the custom client coerces null assistant content.
+        openai_provider = OpenAIProvider(
+            base_url=base_url or None,
+            api_key=key or "ollama",
+            http_client=_openai_compat_http_client(),
+        )
+        return OpenAIChatModel(model_name, provider=openai_provider)
+    raise ValueError(f"Unsupported model provider {provider!r}.")
diff --git a/engine/tests/fixtures/processor_config_push.json b/engine/tests/fixtures/processor_config_push.json
new file mode 100644
index 0000000000..b0ee37f6d5
--- /dev/null
+++ b/engine/tests/fixtures/processor_config_push.json
@@ -0,0 +1,24 @@
+{
+  "models": {
+    "provider": "ollama",
+    "smartModel": "smart-model-x",
+    "fastModel": "fast-model-x",
+    "smartMaxTokens": 1111,
+    "fastMaxTokens": 2222,
+    "apiKey": "provider-key-abc",
+    "baseUrl": "http://engine.example/v1"
+  },
+  "rag": {
+    "embeddingProvider": "custom",
+    "embeddingModel": "embed-model-x",
+    "embeddingApiKey": "embed-key-abc",
+    "embeddingBaseUrl": "http://embed.example/v1",
+    "topK": 33,
+    "maxSearches": 7
+  },
+  "limits": {
+    "maxPages": 111,
+    "maxCharacters": 222222,
+    "modelMaxConcurrency": 9
+  }
+}
diff --git a/engine/tests/test_config_cache.py b/engine/tests/test_config_cache.py
new file mode 100644
index 0000000000..dfe29d4dd1
--- /dev/null
+++ b/engine/tests/test_config_cache.py
@@ -0,0 +1,111 @@
+"""Tests for the encrypted config cache (stirling.config.config_cache)."""
+
+from __future__ import annotations
+
+import os
+import stat
+from pathlib import Path
+
+import pytest
+
+from stirling.config import config_cache
+from stirling.contracts import ConfigPushRequest
+
+
+def _sample() -> ConfigPushRequest:
+    return ConfigPushRequest.model_validate(
+        {
+            "models": {
+                "provider": "anthropic",
+                "smartModel": "claude-haiku-4-5",
+                "fastModel": "claude-haiku-4-5",
+                "smartMaxTokens": 8192,
+                "fastMaxTokens": 2048,
+                "apiKey": "secret-key-value",
+                "baseUrl": "",
+            },
+            "rag": {
+                "embeddingProvider": "voyageai",
+                "embeddingModel": "voyage-4",
+                "embeddingApiKey": "embed-secret",
+                "embeddingBaseUrl": "",
+                "topK": 20,
+                "maxSearches": 5,
+            },
+            "limits": {"maxPages": 200, "maxCharacters": 200000, "modelMaxConcurrency": 32},
+        }
+    )
+
+
+def test_roundtrip_with_shared_secret(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(config_cache, "_shared_secret", lambda: "the-shared-secret")
+    req = _sample()
+    config_cache.save_config(req, data_dir=tmp_path)
+    # HKDF-from-secret path: no keyfile is written.
+    assert not (tmp_path / "ai_config_cache.key").exists()
+    assert config_cache.load_config(data_dir=tmp_path) == req
+    # Secrets are encrypted at rest.
+    assert b"secret-key-value" not in (tmp_path / "ai_config_cache.enc").read_bytes()
+
+
+def test_roundtrip_with_keyfile_when_no_secret(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(config_cache, "_shared_secret", lambda: "")
+    req = _sample()
+    config_cache.save_config(req, data_dir=tmp_path)
+    # No shared secret: a random keyfile is generated and reused for decrypt.
+    assert (tmp_path / "ai_config_cache.key").exists()
+    assert config_cache.load_config(data_dir=tmp_path) == req
+
+
+def test_load_missing_returns_none(tmp_path: Path) -> None:
+    assert config_cache.load_config(data_dir=tmp_path) is None
+
+
+def test_load_corrupt_returns_none(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(config_cache, "_shared_secret", lambda: "a-secret")
+    (tmp_path / "ai_config_cache.enc").write_bytes(b"not-a-valid-fernet-token")
+    assert config_cache.load_config(data_dir=tmp_path) is None
+
+
+def test_wrong_key_returns_none(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    monkeypatch.setattr(config_cache, "_shared_secret", lambda: "secret-a")
+    config_cache.save_config(_sample(), data_dir=tmp_path)
+    # A different secret derives a different key -> decrypt fails, returns None.
+    monkeypatch.setattr(config_cache, "_shared_secret", lambda: "secret-b")
+    assert config_cache.load_config(data_dir=tmp_path) is None
+
+
+@pytest.mark.skipif(os.name == "nt", reason="POSIX file modes are not enforced on Windows")
+def test_cache_and_keyfile_are_owner_only(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """Both files hold credential material, so neither may land at the umask default."""
+    monkeypatch.setattr(config_cache, "_shared_secret", lambda: "")
+    config_cache.save_config(_sample(), data_dir=tmp_path)
+
+    for name in ("ai_config_cache.enc", "ai_config_cache.key"):
+        mode = stat.S_IMODE((tmp_path / name).stat().st_mode)
+        assert mode == 0o600, f"{name} is {oct(mode)}, expected 0o600"
+
+
+def test_save_leaves_no_temp_file_behind(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """The write goes via a temp file + rename so a reader never sees a partial cache."""
+    monkeypatch.setattr(config_cache, "_shared_secret", lambda: "the-shared-secret")
+    config_cache.save_config(_sample(), data_dir=tmp_path)
+    config_cache.save_config(_sample(), data_dir=tmp_path)
+
+    assert not list(tmp_path.glob("*.tmp"))
+    assert config_cache.load_config(data_dir=tmp_path) == _sample()
+
+
+def test_cache_stamp_tracks_writes(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """cache_stamp is None before any write and changes when the file is rewritten."""
+    monkeypatch.setattr(config_cache, "_shared_secret", lambda: "the-shared-secret")
+    assert config_cache.cache_stamp(data_dir=tmp_path) is None
+
+    config_cache.save_config(_sample(), data_dir=tmp_path)
+    first = config_cache.cache_stamp(data_dir=tmp_path)
+    assert first is not None
+
+    bigger = _sample()
+    bigger.models.smart_model = "claude-haiku-4-5-with-a-much-longer-name-so-the-size-differs"
+    config_cache.save_config(bigger, data_dir=tmp_path)
+    assert config_cache.cache_stamp(data_dir=tmp_path) != first
diff --git a/engine/tests/test_config_contract.py b/engine/tests/test_config_contract.py
new file mode 100644
index 0000000000..797b7bc147
--- /dev/null
+++ b/engine/tests/test_config_contract.py
@@ -0,0 +1,70 @@
+"""Wire-contract test pinning the camelCase processor -> engine config push; keep in sync with the Java test."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from typing import Any
+
+from stirling.contracts import ConfigPushRequest
+
+FIXTURE = Path(__file__).parent / "fixtures" / "processor_config_push.json"
+
+
+def _load() -> dict[str, Any]:
+    return json.loads(FIXTURE.read_text(encoding="utf-8"))
+
+
+def test_processor_contract_round_trips_every_field() -> None:
+    payload = _load()
+    req = ConfigPushRequest.model_validate(payload)
+
+    m = payload["models"]
+    assert req.models.provider == m["provider"]
+    assert req.models.smart_model == m["smartModel"]
+    assert req.models.fast_model == m["fastModel"]
+    assert req.models.smart_max_tokens == m["smartMaxTokens"]
+    assert req.models.fast_max_tokens == m["fastMaxTokens"]
+    assert req.models.api_key == m["apiKey"]
+    assert req.models.base_url == m["baseUrl"]
+
+    r = payload["rag"]
+    assert req.rag.embedding_provider == r["embeddingProvider"]
+    assert req.rag.embedding_model == r["embeddingModel"]
+    assert req.rag.embedding_api_key == r["embeddingApiKey"]
+    assert req.rag.embedding_base_url == r["embeddingBaseUrl"]
+    assert req.rag.top_k == r["topK"]
+    assert req.rag.max_searches == r["maxSearches"]
+
+    limits = payload["limits"]
+    assert req.limits.max_pages == limits["maxPages"]
+    assert req.limits.max_characters == limits["maxCharacters"]
+    assert req.limits.model_max_concurrency == limits["modelMaxConcurrency"]
+
+
+def test_processor_contract_has_no_unmapped_keys() -> None:
+    """Guard the fixture itself: every wire key must map to a model field, none silently absorbed by extra="ignore"."""
+    payload = _load()
+    expected = {
+        "models": {
+            "provider",
+            "smartModel",
+            "fastModel",
+            "smartMaxTokens",
+            "fastMaxTokens",
+            "apiKey",
+            "baseUrl",
+        },
+        "rag": {
+            "embeddingProvider",
+            "embeddingModel",
+            "embeddingApiKey",
+            "embeddingBaseUrl",
+            "topK",
+            "maxSearches",
+        },
+        "limits": {"maxPages", "maxCharacters", "modelMaxConcurrency"},
+    }
+    assert set(payload) == set(expected)
+    for section, keys in expected.items():
+        assert set(payload[section]) == keys
diff --git a/engine/tests/test_config_routes.py b/engine/tests/test_config_routes.py
new file mode 100644
index 0000000000..7d30cd7635
--- /dev/null
+++ b/engine/tests/test_config_routes.py
@@ -0,0 +1,383 @@
+"""Tests for the config-push endpoint (POST /api/v1/config), driving the real lifespan so app.state is populated."""
+
+from __future__ import annotations
+
+import asyncio
+import threading
+from collections.abc import Callable, Iterator
+from contextlib import contextmanager
+from pathlib import Path
+from unittest.mock import patch
+
+import pytest
+from conftest import build_app_settings
+from fastapi.testclient import TestClient
+
+from stirling.api import app
+from stirling.api.app import _adopt_cached_config_if_changed
+from stirling.config import AppSettings, config_cache, load_settings
+from stirling.contracts import ConfigPushRequest
+from stirling.documents import DocumentService
+
+
+@pytest.fixture(autouse=True)
+def _isolate_config_cache(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """Point the encrypted config cache at a per-test tmp dir so persistence never leaks."""
+    monkeypatch.setattr(config_cache, "_default_data_dir", lambda: tmp_path)
+
+
+@contextmanager
+def _client(
+    settings_factory: Callable[[], AppSettings],
+    *,
+    client_addr: tuple[str, int] = ("127.0.0.1", 12345),
+) -> Iterator[TestClient]:
+    """Enter a TestClient whose lifespan builds app.state from ``settings_factory``."""
+    previous = app.dependency_overrides.get(load_settings)
+    app.dependency_overrides[load_settings] = settings_factory
+    try:
+        with TestClient(app, client=client_addr) as client:
+            yield client
+    finally:
+        if previous is None:
+            app.dependency_overrides.pop(load_settings, None)
+        else:
+            app.dependency_overrides[load_settings] = previous
+
+
+def _anthropic_push() -> dict[str, object]:
+    return {
+        "models": {
+            "provider": "anthropic",
+            "smartModel": "claude-haiku-4-5",
+            "fastModel": "claude-haiku-4-5",
+            "smartMaxTokens": 4096,
+            "fastMaxTokens": 1024,
+            "apiKey": "test-key-not-a-real-secret",
+            "baseUrl": "",
+        },
+        "rag": {
+            "embeddingProvider": "",
+            "embeddingModel": "",
+            "embeddingApiKey": "",
+            "embeddingBaseUrl": "",
+            "topK": 7,
+            "maxSearches": 3,
+        },
+        "limits": {"maxPages": 50, "maxCharacters": 12345, "modelMaxConcurrency": 8},
+    }
+
+
+def test_config_push_forbidden_when_disabled() -> None:
+    def factory() -> AppSettings:
+        return build_app_settings().model_copy(update={"allow_config_push": False})
+
+    with _client(factory) as client:
+        response = client.post("/api/v1/config", json=_anthropic_push())
+    assert response.status_code == 403
+
+
+def test_config_push_from_non_local_caller_without_secret_returns_403() -> None:
+    """Secure-by-default: with no shared secret, a remote caller cannot push a config."""
+    with _client(build_app_settings, client_addr=("203.0.113.9", 4444)) as client:
+        response = client.post("/api/v1/config", json=_anthropic_push())
+    assert response.status_code == 403
+    assert "STIRLING_ENGINE_SHARED_SECRET" in response.json()["detail"]
+
+
+def test_config_push_from_loopback_with_forwarded_header_returns_403() -> None:
+    """A forwarding header means the peer address may be proxy-rewritten, so loopback isn't trusted without a secret."""
+    with _client(build_app_settings) as client:  # peer is loopback 127.0.0.1
+        response = client.post(
+            "/api/v1/config",
+            json=_anthropic_push(),
+            headers={"X-Forwarded-For": "127.0.0.1"},
+        )
+    assert response.status_code == 403
+    assert "STIRLING_ENGINE_SHARED_SECRET" in response.json()["detail"]
+
+
+def test_config_push_persist_failure_still_applies_without_500() -> None:
+    """Persistence is best-effort: a persist failure must not turn an already-applied push into a 500."""
+    with _client(build_app_settings) as client:
+        with patch(
+            "stirling.api.routes.config.save_config",
+            side_effect=ValueError("corrupt keyfile"),
+        ):
+            response = client.post("/api/v1/config", json=_anthropic_push())
+        assert response.status_code == 200
+        # The config WAS applied live despite the persist failure.
+        assert app.state.settings.smart_model_name == "claude-haiku-4-5"
+        assert any("could not be persisted" in note for note in response.json()["notes"])
+
+
+def test_config_push_applies_model_and_limits() -> None:
+    with _client(build_app_settings) as client:
+        response = client.post("/api/v1/config", json=_anthropic_push())
+        assert response.status_code == 200
+        body = response.json()
+        # Wire summary is camelCase and never echoes the api key.
+        assert body["smartModel"] == "claude-haiku-4-5"
+        assert body["fastModel"] == "claude-haiku-4-5"
+        assert body["smartMaxTokens"] == 4096
+        assert body["ragTopK"] == 7
+        assert body["maxPages"] == 50
+        assert body["modelMaxConcurrency"] == 8
+        assert "test-key-not-a-real-secret" not in response.text
+        # State was swapped: the running settings now reflect the push.
+        assert app.state.settings.smart_model_name == "claude-haiku-4-5"
+        assert app.state.settings.max_pages == 50
+        assert app.state.runtime.documents.default_top_k == 7
+
+
+def test_config_push_unsupported_provider_returns_400_without_swap() -> None:
+    with _client(build_app_settings) as client:
+        before = app.state.runtime
+        payload = _anthropic_push()
+        payload["models"]["provider"] = "nonsense-provider"  # type: ignore[index]
+        response = client.post("/api/v1/config", json=payload)
+        assert response.status_code == 400
+        # Running runtime is untouched when the push is rejected.
+        assert app.state.runtime is before
+        assert app.state.settings.smart_model_name == "test"
+
+
+def test_config_push_unsupported_model_returns_400() -> None:
+    """A model that fails structured-output validation is rejected with 400."""
+    with _client(build_app_settings) as client:
+        before = app.state.runtime
+        with patch(
+            "stirling.api.routes.config.validate_structured_output_support",
+            side_effect=ValueError("Unsupported model foo. This model does not support structured outputs."),
+        ):
+            response = client.post("/api/v1/config", json=_anthropic_push())
+        assert response.status_code == 400
+        assert "does not support structured outputs" in response.json()["detail"]
+        assert app.state.runtime is before
+
+
+def test_config_push_ollama_embedding_rebuilds_embedder() -> None:
+    """A pushed ollama/custom embedding provider swaps the embedder onto the reused store, with a re-index note."""
+    with _client(build_app_settings) as client:
+        store_before = app.state.runtime.documents
+        embedder_before = app.state.runtime.documents.embedder
+        payload = _anthropic_push()
+        payload["rag"] = {
+            "embeddingProvider": "ollama",
+            "embeddingModel": "nomic-embed-text",
+            "embeddingApiKey": "",
+            "embeddingBaseUrl": "http://localhost:11434/v1",
+            "topK": 9,
+            "maxSearches": 4,
+        }
+        response = client.post("/api/v1/config", json=payload)
+        assert response.status_code == 200
+        body = response.json()
+        assert body["ragEmbeddingModel"] == "ollama:nomic-embed-text"
+        assert any("re-index" in note for note in body["notes"])
+        docs = app.state.runtime.documents
+        # Same store object reused (connection pool intact), embedder swapped.
+        assert docs is store_before
+        assert docs.embedder is not embedder_before
+        assert docs.default_top_k == 9
+
+
+def test_config_push_unsupported_embedding_provider_returns_400() -> None:
+    with _client(build_app_settings) as client:
+        embedder_before = app.state.runtime.documents.embedder
+        payload = _anthropic_push()
+        payload["rag"] = {
+            "embeddingProvider": "totally-bogus",
+            "embeddingModel": "x",
+            "embeddingApiKey": "",
+            "embeddingBaseUrl": "",
+            "topK": None,
+            "maxSearches": None,
+        }
+        response = client.post("/api/v1/config", json=payload)
+        assert response.status_code == 400
+        # Embedder untouched when the push is rejected.
+        assert app.state.runtime.documents.embedder is embedder_before
+
+
+def test_config_push_empty_models_keep_env_value() -> None:
+    """An empty models block keeps the engine's env models but still applies pushed limits."""
+    with _client(build_app_settings) as client:
+        payload = _anthropic_push()
+        payload["models"] = {
+            "provider": "",
+            "smartModel": "",
+            "fastModel": "",
+            "smartMaxTokens": None,
+            "fastMaxTokens": None,
+            "apiKey": "",
+            "baseUrl": "",
+        }
+        response = client.post("/api/v1/config", json=payload)
+        assert response.status_code == 200
+        # Env "test" model preserved for both tiers; limits still applied.
+        assert app.state.settings.smart_model_name == "test"
+        assert app.state.settings.fast_model_name == "test"
+        assert app.state.settings.max_pages == 50
+
+
+def test_config_push_ignores_unknown_fields() -> None:
+    """A newer processor pushing unknown fields must not 422; they are ignored and the rest applies."""
+    with _client(build_app_settings) as client:
+        payload = _anthropic_push()
+        payload["futureTopLevelField"] = {"anything": 1}
+        payload["models"]["experimentalFlag"] = True  # type: ignore[index]
+        response = client.post("/api/v1/config", json=payload)
+        assert response.status_code == 200
+        assert app.state.settings.smart_model_name == "claude-haiku-4-5"
+        assert app.state.settings.max_pages == 50
+
+
+def test_boot_restores_cached_config() -> None:
+    """A persisted config is decrypted and applied on boot, overriding env."""
+    config_cache.save_config(ConfigPushRequest.model_validate(_anthropic_push()))
+    with _client(build_app_settings):
+        # Env model is "test"; the cache pushed claude-haiku-4-5 + limits.
+        assert app.state.settings.smart_model_name == "claude-haiku-4-5"
+        assert app.state.settings.fast_model_name == "claude-haiku-4-5"
+        assert app.state.settings.max_pages == 50
+        assert app.state.settings.smart_model_max_tokens == 4096
+        assert app.state.runtime.documents.default_top_k == 7
+
+
+def test_boot_ignores_cache_when_push_disabled() -> None:
+    """With allow_config_push false, env wins and the cache is ignored."""
+    config_cache.save_config(ConfigPushRequest.model_validate(_anthropic_push()))
+
+    def factory() -> AppSettings:
+        return build_app_settings().model_copy(update={"allow_config_push": False})
+
+    with _client(factory):
+        assert app.state.settings.smart_model_name == "test"
+        assert app.state.settings.max_pages == 200
+
+
+def test_boot_proceeds_on_corrupt_cache(tmp_path: Path) -> None:
+    """A corrupt cache file is ignored and boot falls back to env, never crashing."""
+    (tmp_path / "ai_config_cache.enc").write_bytes(b"not-a-valid-fernet-token")
+    with _client(build_app_settings):
+        assert app.state.settings.smart_model_name == "test"
+        assert app.state.settings.max_pages == 200
+
+
+def test_config_push_from_remote_caller_is_allowed_when_secret_is_set() -> None:
+    """The loopback gate is a fallback for the no-secret case only; a remote caller may push once a secret is set."""
+
+    def factory() -> AppSettings:
+        return build_app_settings().model_copy(update={"engine_shared_secret": "s3cret"})
+
+    with _client(factory, client_addr=("203.0.113.9", 4444)) as client:
+        response = client.post("/api/v1/config", json=_anthropic_push())
+    assert response.status_code == 200
+    assert app.state.settings.smart_model_name == "claude-haiku-4-5"
+
+
+@pytest.mark.parametrize(
+    ("section", "field", "value"),
+    [
+        ("limits", "modelMaxConcurrency", 0),
+        ("limits", "modelMaxConcurrency", -1),
+        ("limits", "maxPages", 0),
+        ("limits", "maxCharacters", 0),
+        ("rag", "topK", 0),
+        ("models", "smartMaxTokens", 0),
+    ],
+)
+def test_config_push_rejects_out_of_range_numbers(section: str, field: str, value: int) -> None:
+    """Out-of-range numbers are rejected by the contract before anything is applied."""
+    with _client(build_app_settings) as client:
+        payload = _anthropic_push()
+        payload[section][field] = value  # type: ignore[index]
+        response = client.post("/api/v1/config", json=payload)
+        assert response.status_code == 422
+        # Nothing was applied: the engine is still on its env config.
+        assert app.state.settings.smart_model_name == "test"
+        assert app.state.settings.max_pages == 200
+
+
+def test_config_push_allows_zero_max_searches() -> None:
+    """0 searches is a legitimate "no retrieval" setting, not an out-of-range value."""
+    with _client(build_app_settings) as client:
+        payload = _anthropic_push()
+        payload["rag"]["maxSearches"] = 0  # type: ignore[index]
+        response = client.post("/api/v1/config", json=payload)
+        assert response.status_code == 200
+        assert app.state.settings.rag_max_searches == 0
+
+
+def test_second_push_keeps_a_colon_bearing_model_name() -> None:
+    """A pushed model name may contain a colon ("llama3.1:8b") and must survive a follow-up push, not be re-stripped."""
+    ollama_push: dict[str, object] = {
+        "models": {
+            "provider": "ollama",
+            "smartModel": "llama3.1:8b",
+            "fastModel": "llama3.1:8b",
+            "baseUrl": "http://localhost:11434/v1",
+        },
+        "rag": {},
+        "limits": {},
+    }
+    with _client(build_app_settings) as client:
+        assert client.post("/api/v1/config", json=ollama_push).status_code == 200
+        assert app.state.settings.smart_model_name == "llama3.1:8b"
+
+        # Second push: same provider/base URL, model left empty ("keep what you have").
+        followup: dict[str, object] = {
+            "models": {
+                "provider": "ollama",
+                "smartModel": "",
+                "fastModel": "",
+                "baseUrl": "http://localhost:11434/v1",
+            },
+            "rag": {},
+            "limits": {"maxPages": 42},
+        }
+        response = client.post("/api/v1/config", json=followup)
+        assert response.status_code == 200
+        assert app.state.settings.smart_model_name == "llama3.1:8b"
+        assert app.state.settings.fast_model_name == "llama3.1:8b"
+        assert app.state.settings.max_pages == 42
+
+
+def test_worker_adopts_a_config_pushed_to_a_sibling_worker() -> None:
+    """A push reaches one uvicorn worker; the rest adopt it from the shared cache file."""
+    with _client(build_app_settings):
+        assert app.state.settings.smart_model_name == "test"
+
+        config_cache.save_config(ConfigPushRequest.model_validate(_anthropic_push()))
+        _adopt_cached_config_if_changed(app)
+
+        assert app.state.settings.smart_model_name == "claude-haiku-4-5"
+        assert app.state.settings.max_pages == 50
+        assert app.state.runtime.documents.default_top_k == 7
+
+
+def test_worker_does_not_rebuild_when_the_cache_is_unchanged() -> None:
+    """The watcher is a poll, so an unchanged cache must be a no-op, not a rebuild every tick."""
+    config_cache.save_config(ConfigPushRequest.model_validate(_anthropic_push()))
+    with _client(build_app_settings):
+        before = app.state.orchestrator_agent
+        _adopt_cached_config_if_changed(app)
+        assert app.state.orchestrator_agent is before
+
+
+def test_shutdown_drains_background_tasks_instead_of_cancelling_them() -> None:
+    """Shutdown must let the reaper iteration finish before the store closes, else close segfaults sqlite-vec."""
+    reap_finished = threading.Event()
+
+    async def slow_reap(*_args: object, **_kwargs: object) -> int:
+        # Long enough to still be running when the (empty) test body hands back to teardown.
+        await asyncio.sleep(0.2)
+        reap_finished.set()
+        return 0
+
+    with patch.object(DocumentService, "reap_expired", slow_reap):
+        with _client(build_app_settings):
+            pass
+
+    assert reap_finished.is_set(), "teardown cancelled the reaper mid-iteration"
diff --git a/engine/uv.lock b/engine/uv.lock
index afa5f389ae..5e9d166af0 100644
--- a/engine/uv.lock
+++ b/engine/uv.lock
@@ -605,6 +605,7 @@ name = "engine"
 version = "0.1.0"
 source = { editable = "." }
 dependencies = [
+    { name = "cryptography" },
     { name = "fastapi" },
     { name = "opentelemetry-sdk" },
     { name = "pgvector" },
@@ -631,6 +632,7 @@ dev = [
 
 [package.metadata]
 requires-dist = [
+    { name = "cryptography", specifier = ">=44.0.0" },
     { name = "fastapi", specifier = ">=0.116.0" },
     { name = "opentelemetry-sdk", specifier = ">=1.39.0" },
     { name = "pgvector", specifier = ">=0.3.6" },
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 8c2a8333b6..6cf87f4252 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -692,6 +692,166 @@ manualLinks = "Manual downloads: click the links and place the files into the te
 noLanguages = "No tessdata languages found in the configured directory."
 permissionNotice = "The tessdata path is not writable. Downloads will be opened in the browser; please save the .traineddata files manually into the tessdata folder."
 
+# AI engine admin settings (AI nav group)
+[admin.settings.ai.documents]
+description = "Configure the embedding model and retrieval settings used to answer questions over documents. Applied to the AI engine when saved."
+title = "Documents & RAG"
+
+[admin.settings.ai.documents.embeddingApiKey]
+description = "Leave blank to use the engine's own environment credential. Applies to self-hosted single-engine deployments."
+generic = "Embedding API key"
+openai = "OpenAI API key"
+setPlaceholder = "Saved - leave blank to keep the current key"
+voyageai = "VoyageAI API key"
+
+[admin.settings.ai.documents.embeddingBaseUrl]
+description = "Base URL of the OpenAI-compatible / Ollama embeddings endpoint, e.g. http://ollama:11434/v1. Must point at a trusted internal endpoint (SSRF-sensitive)."
+label = "Embedding base URL"
+
+[admin.settings.ai.documents.embeddingModel]
+description = "Embedding model name. Free text; suggestions are hints only."
+label = "Embedding model"
+
+[admin.settings.ai.documents.embeddingProvider]
+description = "Provider used to turn document text into vector embeddings."
+label = "Embedding provider"
+
+[admin.settings.ai.documents.maxSearches]
+description = "Maximum number of retrieval searches the agent may run per request."
+label = "Max searches"
+
+[admin.settings.ai.documents.reindexNote]
+body = "Changing the embedding model takes effect immediately, but documents indexed with the previous model must be re-indexed for search to return correct results."
+title = "Re-index required"
+
+[admin.settings.ai.documents.saved]
+reindexNote = "If you changed the embedding model, re-index existing documents so search uses the new model."
+
+[admin.settings.ai.documents.topK]
+description = "Number of most-relevant chunks retrieved per search."
+label = "Top K"
+
+[admin.settings.ai.general]
+description = "Connect Stirling to the Python AI engine and choose which AI capabilities are exposed. Changes apply on restart."
+title = "AI Engine"
+
+[admin.settings.ai.general.capabilities]
+description = "Turn individual AI features on or off. Disabled features are hidden in the app."
+title = "Capabilities"
+
+[admin.settings.ai.general.enabled]
+description = "Master switch. When off, no AI tools, agents, or engine calls are available."
+label = "Enable AI"
+
+[admin.settings.ai.general.features.chat]
+description = "Conversational assistant for working with PDFs."
+label = "Chat assistant"
+
+[admin.settings.ai.general.features.classify]
+description = "Automatically categorise documents by type or content."
+label = "Document classification"
+
+[admin.settings.ai.general.features.createPdf]
+description = "Generate a new PDF (e.g. from HTML) via an AI agent."
+label = "Create PDF from prompt"
+
+[admin.settings.ai.general.features.documentQuestions]
+description = "Ask questions and get answers grounded in an uploaded document."
+label = "Document questions"
+
+[admin.settings.ai.general.features.mathAuditor]
+description = "Review documents for mathematical and numerical errors."
+label = "Math auditor"
+
+[admin.settings.ai.general.features.pdfComment]
+description = "Add AI-authored review comments and annotations to a PDF."
+label = "PDF comment agent"
+
+[admin.settings.ai.general.longRunningTimeoutSeconds]
+description = "Timeout for heavier agent operations such as document generation."
+label = "Long-running timeout (seconds)"
+
+[admin.settings.ai.general.note]
+body = "The AI engine runs as a separate service. Its shared secret"
+body2 = "is set via a container environment variable. Provider API keys can be entered on these pages or supplied as engine environment variables; keys entered here are pushed to the engine when saved."
+title = "About the AI engine"
+
+[admin.settings.ai.general.streamTimeoutSeconds]
+description = "Timeout for streamed (token-by-token) chat responses."
+label = "Stream timeout (seconds)"
+
+[admin.settings.ai.general.test]
+button = "Test connection"
+failBody = "The AI engine did not respond. Check the URL, that the engine container is running, and that AI is enabled (a restart is needed after enabling)."
+failTitle = "AI engine unreachable"
+okBody = "The AI engine responded to a health check."
+okTitle = "AI engine reachable"
+
+[admin.settings.ai.general.timeoutSeconds]
+description = "Timeout for standard AI requests to the engine."
+label = "Request timeout (seconds)"
+
+[admin.settings.ai.general.url]
+description = "Internal URL of the Python AI engine, e.g. http://stirling-pdf-engine:5001."
+label = "AI engine URL"
+
+[admin.settings.ai.limits]
+description = "Guardrails for how much work AI requests may do and how many run concurrently. Applied to the AI engine when saved."
+title = "Limits & Performance"
+
+[admin.settings.ai.limits.maxCharacters]
+description = "Guardrail: reject AI requests whose extracted text exceeds this length."
+label = "Max characters per request"
+
+[admin.settings.ai.limits.maxPages]
+description = "Guardrail: reject AI requests over this many PDF pages."
+label = "Max pages per request"
+
+[admin.settings.ai.limits.modelMaxConcurrency]
+description = "Maximum simultaneous in-flight model calls across the whole engine."
+label = "Model max concurrency"
+
+[admin.settings.ai.models]
+description = "Choose the LLM provider and the smart/fast models the AI engine uses. Applied to the AI engine when saved."
+title = "Models & Providers"
+
+[admin.settings.ai.models.apiKey]
+anthropic = "Anthropic API key"
+description = "Leave blank to use the engine's own environment credential. Applies to self-hosted single-engine deployments."
+generic = "API key"
+openai = "OpenAI API key"
+setPlaceholder = "Saved - leave blank to keep the current key"
+
+[admin.settings.ai.models.baseUrl]
+description = "Base URL of the OpenAI-compatible / Ollama endpoint, e.g. http://ollama:11434/v1."
+label = "Provider base URL"
+warning = "The base URL must point at a trusted internal endpoint. The engine will make server-side requests to it, so an untrusted value is SSRF-sensitive."
+
+[admin.settings.ai.models.fastMaxTokens]
+description = "Maximum output tokens for the fast model."
+label = "Fast model max tokens"
+
+[admin.settings.ai.models.fastModel]
+description = "Cheaper, faster model for lightweight tasks. Free text; suggestions are hints only."
+label = "Fast model"
+
+[admin.settings.ai.models.provider]
+description = "Which LLM provider the engine talks to."
+label = "Provider"
+
+[admin.settings.ai.models.smartMaxTokens]
+description = "Maximum output tokens for the smart model."
+label = "Smart model max tokens"
+
+[admin.settings.ai.models.smartModel]
+description = "High-capability model for complex reasoning. Free text; suggestions are hints only."
+label = "Smart model"
+
+[admin.settings.ai.saved]
+body = "Changes are pushed to the AI engine automatically."
+bodyNoPush = "Settings saved. They will apply the next time the AI engine picks up its configuration."
+title = "AI settings saved"
+
 [admin.settings.badge]
 clickToUpgrade = "Click to view plan details"
 
@@ -8816,6 +8976,13 @@ title = "Signature Order"
 [settings]
 close = "Close"
 
+[settings.ai]
+documents = "Documents & RAG"
+general = "General"
+limits = "Limits & Performance"
+models = "Models & Providers"
+title = "AI"
+
 [settings.configuration]
 advanced = "Advanced"
 database = "Database"
diff --git a/frontend/editor/public/og-metadata.json b/frontend/editor/public/og-metadata.json
index 1fc552cd80..63461920ce 100644
--- a/frontend/editor/public/og-metadata.json
+++ b/frontend/editor/public/og-metadata.json
@@ -475,6 +475,26 @@
       "title": "Admin Mcp Settings - Stirling PDF",
       "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
     },
+    "/settings/adminAiGeneral": {
+      "image": "/og_images/home.png",
+      "title": "Admin Ai General Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminAiModels": {
+      "image": "/og_images/home.png",
+      "title": "Admin Ai Models Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminAiDocuments": {
+      "image": "/og_images/home.png",
+      "title": "Admin Ai Documents Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminAiLimits": {
+      "image": "/og_images/home.png",
+      "title": "Admin Ai Limits Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
     "/settings/help": {
       "image": "/og_images/home.png",
       "title": "Help Settings - Stirling PDF",
@@ -654,6 +674,10 @@
     "/settings/adminEndpoints": "/settings/adminEndpoints",
     "/settings/adminStorageSharing": "/settings/adminStorageSharing",
     "/settings/adminMcp": "/settings/adminMcp",
+    "/settings/adminAiGeneral": "/settings/adminAiGeneral",
+    "/settings/adminAiModels": "/settings/adminAiModels",
+    "/settings/adminAiDocuments": "/settings/adminAiDocuments",
+    "/settings/adminAiLimits": "/settings/adminAiLimits",
     "/settings/help": "/settings/help",
     "/settings/legal": "/settings/legal",
     "/settings/backendThirdPartyLicenses": "/settings/backendThirdPartyLicenses",
diff --git a/frontend/editor/public/og-metadata.saas.json b/frontend/editor/public/og-metadata.saas.json
index 2bf49f7d9f..8f581f2125 100644
--- a/frontend/editor/public/og-metadata.saas.json
+++ b/frontend/editor/public/og-metadata.saas.json
@@ -476,6 +476,26 @@
       "title": "Admin Mcp Settings - Stirling PDF",
       "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
     },
+    "/settings/adminAiGeneral": {
+      "image": "/og_images/home.png",
+      "title": "Admin Ai General Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminAiModels": {
+      "image": "/og_images/home.png",
+      "title": "Admin Ai Models Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminAiDocuments": {
+      "image": "/og_images/home.png",
+      "title": "Admin Ai Documents Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
+    "/settings/adminAiLimits": {
+      "image": "/og_images/home.png",
+      "title": "Admin Ai Limits Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
     "/settings/help": {
       "image": "/og_images/home.png",
       "title": "Help Settings - Stirling PDF",
@@ -667,6 +687,10 @@
     "/settings/adminEndpoints": "/settings/adminEndpoints",
     "/settings/adminStorageSharing": "/settings/adminStorageSharing",
     "/settings/adminMcp": "/settings/adminMcp",
+    "/settings/adminAiGeneral": "/settings/adminAiGeneral",
+    "/settings/adminAiModels": "/settings/adminAiModels",
+    "/settings/adminAiDocuments": "/settings/adminAiDocuments",
+    "/settings/adminAiLimits": "/settings/adminAiLimits",
     "/settings/help": "/settings/help",
     "/settings/legal": "/settings/legal",
     "/settings/backendThirdPartyLicenses": "/settings/backendThirdPartyLicenses",
diff --git a/frontend/editor/src/core/components/shared/config/types.ts b/frontend/editor/src/core/components/shared/config/types.ts
index 5cbdd1b169..1182933d61 100644
--- a/frontend/editor/src/core/components/shared/config/types.ts
+++ b/frontend/editor/src/core/components/shared/config/types.ts
@@ -32,6 +32,10 @@ export const VALID_NAV_KEYS = [
   "adminEndpoints",
   "adminStorageSharing",
   "adminMcp",
+  "adminAiGeneral",
+  "adminAiModels",
+  "adminAiDocuments",
+  "adminAiLimits",
   "help",
   "legal",
   "backendThirdPartyLicenses",
diff --git a/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx b/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx
index 0081c594a3..218d4b2f57 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx
@@ -17,6 +17,10 @@ import AdminPlanSection from "@app/components/shared/config/configSections/Admin
 import AdminFeaturesSection from "@app/components/shared/config/configSections/AdminFeaturesSection";
 import AdminEndpointsSection from "@app/components/shared/config/configSections/AdminEndpointsSection";
 import AdminMcpSection from "@app/components/shared/config/configSections/AdminMcpSection";
+import AdminAiGeneralSection from "@app/components/shared/config/configSections/AdminAiGeneralSection";
+import AdminAiModelsSection from "@app/components/shared/config/configSections/AdminAiModelsSection";
+import AdminAiDocumentsSection from "@app/components/shared/config/configSections/AdminAiDocumentsSection";
+import AdminAiLimitsSection from "@app/components/shared/config/configSections/AdminAiLimitsSection";
 import AdminAuditSection from "@app/components/shared/config/configSections/AdminAuditSection";
 import AdminUsageSection from "@app/components/shared/config/configSections/AdminUsageSection";
 import AdminStorageSharingSection from "@app/components/shared/config/configSections/AdminStorageSharingSection";
@@ -166,6 +170,45 @@ export const useConfigNavSections = (
       ],
     });
 
+    // AI
+    sections.push({
+      title: t("settings.ai.title", "AI"),
+      items: [
+        {
+          key: "adminAiGeneral",
+          label: t("settings.ai.general", "General"),
+          icon: "smart-toy-rounded",
+          component: <AdminAiGeneralSection />,
+          disabled: requiresLogin,
+          disabledTooltip: requiresLogin ? enableLoginTooltip : undefined,
+        },
+        {
+          key: "adminAiModels",
+          label: t("settings.ai.models", "Models & Providers"),
+          icon: "psychology",
+          component: <AdminAiModelsSection />,
+          disabled: requiresLogin,
+          disabledTooltip: requiresLogin ? enableLoginTooltip : undefined,
+        },
+        {
+          key: "adminAiDocuments",
+          label: t("settings.ai.documents", "Documents & RAG"),
+          icon: "description",
+          component: <AdminAiDocumentsSection />,
+          disabled: requiresLogin,
+          disabledTooltip: requiresLogin ? enableLoginTooltip : undefined,
+        },
+        {
+          key: "adminAiLimits",
+          label: t("settings.ai.limits", "Limits & Performance"),
+          icon: "speed",
+          component: <AdminAiLimitsSection />,
+          disabled: requiresLogin,
+          disabledTooltip: requiresLogin ? enableLoginTooltip : undefined,
+        },
+      ],
+    });
+
     // Security & Authentication
     sections.push({
       title: t("settings.securityAuth.title", "Security & Authentication"),
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiDocumentsSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiDocumentsSection.tsx
new file mode 100644
index 0000000000..55c5867288
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiDocumentsSection.tsx
@@ -0,0 +1,383 @@
+import { useCallback, useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+  NumberInput,
+  PasswordInput,
+  Autocomplete,
+  Select,
+  TextInput,
+  Stack,
+  Paper,
+  Text,
+  Loader,
+  Group,
+  Alert,
+} from "@mantine/core";
+import { alert } from "@app/components/toast";
+import LocalIcon from "@app/components/shared/LocalIcon";
+import { useAdminSettings } from "@app/hooks/useAdminSettings";
+import { useSettingsDirty } from "@app/hooks/useSettingsDirty";
+import PendingBadge from "@app/components/shared/config/PendingBadge";
+import { SettingsStickyFooter } from "@app/components/shared/config/SettingsStickyFooter";
+import apiClient from "@app/services/apiClient";
+import { useLoginRequired } from "@app/hooks/useLoginRequired";
+import { Z_INDEX_OVER_CONFIG_MODAL } from "@app/styles/zIndex";
+import {
+  AiEngineSettingsData,
+  AiEngineRag,
+  AiEngineApiResponse,
+  EMBEDDING_MODEL_SUGGESTIONS,
+  MASKED_SECRET,
+  clampMin,
+  savedToastBody,
+} from "@app/components/shared/config/configSections/aiEngineSettings";
+
+export default function AdminAiDocumentsSection() {
+  const { t } = useTranslation();
+  const { loginEnabled } = useLoginRequired();
+
+  // Track edits to the masked secret so we never send "********" back.
+  const [embeddingApiKeyDirty, setEmbeddingApiKeyDirty] = useState(false);
+
+  const {
+    settings,
+    setSettings,
+    loading,
+    saving,
+    fetchSettings,
+    saveSettings,
+    isFieldPending,
+  } = useAdminSettings<AiEngineSettingsData>({
+    sectionName: "aiEngine",
+    fetchTransformer: async (): Promise<
+      AiEngineSettingsData & { _pending?: Partial<AiEngineSettingsData> }
+    > => {
+      const response = await apiClient.get<AiEngineApiResponse>(
+        "/api/v1/admin/settings/section/aiEngine",
+      );
+      return response.data || {};
+    },
+    // Save ONLY this page's keys as dot-notation so sibling AI keys are preserved.
+    saveTransformer: (s: AiEngineSettingsData) => {
+      const prov = s.rag?.embeddingProvider || "voyageai";
+      const usesBaseUrl = prov === "ollama" || prov === "custom";
+      const usesApiKey = prov !== "ollama";
+      const deltaSettings: Record<string, unknown> = {
+        "aiEngine.rag.embeddingProvider": prov,
+        "aiEngine.rag.embeddingModel": s.rag?.embeddingModel ?? "",
+        // Never send a base URL for a provider that doesn't use one.
+        "aiEngine.rag.embeddingBaseUrl": usesBaseUrl
+          ? (s.rag?.embeddingBaseUrl ?? "")
+          : "",
+        "aiEngine.rag.topK": clampMin(s.rag?.topK, 1),
+        "aiEngine.rag.maxSearches": clampMin(s.rag?.maxSearches, 0),
+      };
+      // Send the key when the user typed one, or a provider switch cleared it; the explicit
+      // "" wipes the previous provider's stored key.
+      if (embeddingApiKeyDirty) {
+        deltaSettings["aiEngine.rag.embeddingApiKey"] = usesApiKey
+          ? (s.rag?.embeddingApiKey ?? "")
+          : "";
+      }
+      return { sectionData: {}, deltaSettings };
+    },
+  });
+
+  useEffect(() => {
+    fetchSettings();
+  }, []);
+
+  const { isDirty, resetToSnapshot, markSaved } = useSettingsDirty(
+    settings,
+    loading,
+  );
+
+  const handleSave = async () => {
+    try {
+      await saveSettings();
+      setEmbeddingApiKeyDirty(false);
+      markSaved();
+      // Pushed to the engine live (the embedder is hot-swapped), but documents embedded with the
+      // previous model must be re-indexed, so the toast flags that caveat.
+      alert({
+        alertType: "success",
+        title: t("admin.settings.ai.saved.title", "AI settings saved"),
+        body: `${savedToastBody(settings, t)} ${t(
+          "admin.settings.ai.documents.saved.reindexNote",
+          "If you changed the embedding model, re-index existing documents so search uses the new model.",
+        )}`,
+      });
+    } catch (_error) {
+      alert({
+        alertType: "error",
+        title: t("admin.error", "Error"),
+        body: t("admin.settings.saveError", "Failed to save settings"),
+      });
+    }
+  };
+
+  const handleDiscard = useCallback(() => {
+    setEmbeddingApiKeyDirty(false);
+    setSettings(resetToSnapshot());
+  }, [resetToSnapshot, setSettings]);
+
+  const setRag = (patch: Partial<AiEngineRag>) =>
+    setSettings({ ...settings, rag: { ...(settings.rag || {}), ...patch } });
+
+  if (loading) {
+    return (
+      <Stack align="center" justify="center" h={200}>
+        <Loader size="lg" />
+      </Stack>
+    );
+  }
+
+  const embeddingProvider = settings.rag?.embeddingProvider || "voyageai";
+  const embeddingSuggestions =
+    EMBEDDING_MODEL_SUGGESTIONS[embeddingProvider] || [];
+  const showEmbeddingBaseUrl =
+    embeddingProvider === "ollama" || embeddingProvider === "custom";
+  // Ollama's embeddings endpoint needs no API key, mirroring the Models page.
+  const showEmbeddingApiKey = embeddingProvider !== "ollama";
+  const embeddingApiKeyLabel =
+    embeddingProvider === "voyageai"
+      ? t(
+          "admin.settings.ai.documents.embeddingApiKey.voyageai",
+          "VoyageAI API key",
+        )
+      : embeddingProvider === "openai"
+        ? t(
+            "admin.settings.ai.documents.embeddingApiKey.openai",
+            "OpenAI API key",
+          )
+        : t(
+            "admin.settings.ai.documents.embeddingApiKey.generic",
+            "Embedding API key",
+          );
+  const embeddingApiKeyPlaceholder =
+    embeddingProvider === "voyageai"
+      ? "pa-..."
+      : embeddingProvider === "openai"
+        ? "sk-..."
+        : "";
+
+  return (
+    <div className="settings-section-container">
+      <Stack gap="lg" className="settings-section-content">
+        <div>
+          <Text fw={600} size="lg">
+            {t("admin.settings.ai.documents.title", "Documents & RAG")}
+          </Text>
+          <Text size="sm" c="dimmed">
+            {t(
+              "admin.settings.ai.documents.description",
+              "Configure the embedding model and retrieval settings used to answer questions over documents. Applied to the AI engine when saved.",
+            )}
+          </Text>
+        </div>
+
+        <Paper withBorder p="md" radius="md">
+          <Stack gap="md">
+            <Select
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.documents.embeddingProvider.label",
+                      "Embedding provider",
+                    )}
+                  </span>
+                  <PendingBadge
+                    show={isFieldPending("rag.embeddingProvider")}
+                  />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.documents.embeddingProvider.description",
+                "Provider used to turn document text into vector embeddings.",
+              )}
+              data={[
+                { value: "voyageai", label: "VoyageAI" },
+                { value: "openai", label: "OpenAI" },
+                { value: "ollama", label: "Ollama" },
+                { value: "custom", label: "Custom (OpenAI-compatible)" },
+              ]}
+              value={embeddingProvider}
+              onChange={(v) => {
+                const next = v || "voyageai";
+                const patch: Partial<AiEngineRag> = { embeddingProvider: next };
+                // Clear fields the new provider doesn't use so a stale hidden value can't
+                // leak into the payload.
+                if (next !== "ollama" && next !== "custom")
+                  patch.embeddingBaseUrl = "";
+                if (next !== embeddingProvider) {
+                  // One stored key, issued for one provider: carrying it across a switch
+                  // would 401 while the field still read "Saved". Require a re-entry.
+                  patch.embeddingApiKey = "";
+                  setEmbeddingApiKeyDirty(true);
+                }
+                setRag(patch);
+              }}
+              allowDeselect={false}
+              comboboxProps={{
+                withinPortal: true,
+                zIndex: Z_INDEX_OVER_CONFIG_MODAL,
+              }}
+            />
+
+            <Autocomplete
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.documents.embeddingModel.label",
+                      "Embedding model",
+                    )}
+                  </span>
+                  <PendingBadge show={isFieldPending("rag.embeddingModel")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.documents.embeddingModel.description",
+                "Embedding model name. Free text; suggestions are hints only.",
+              )}
+              data={embeddingSuggestions}
+              value={settings.rag?.embeddingModel || ""}
+              onChange={(value) => setRag({ embeddingModel: value })}
+              comboboxProps={{
+                withinPortal: true,
+                zIndex: Z_INDEX_OVER_CONFIG_MODAL,
+              }}
+            />
+
+            {showEmbeddingApiKey && (
+              <PasswordInput
+                label={
+                  <Group gap="xs">
+                    <span>{embeddingApiKeyLabel}</span>
+                    <PendingBadge
+                      show={isFieldPending("rag.embeddingApiKey")}
+                    />
+                  </Group>
+                }
+                description={t(
+                  "admin.settings.ai.documents.embeddingApiKey.description",
+                  "Leave blank to use the engine's own environment credential. Applies to self-hosted single-engine deployments.",
+                )}
+                // Blank when a key is already stored (returned masked as "********") so
+                // appending to the sentinel can't corrupt the saved key.
+                value={
+                  embeddingApiKeyDirty
+                    ? (settings.rag?.embeddingApiKey ?? "")
+                    : ""
+                }
+                onChange={(e) => {
+                  setEmbeddingApiKeyDirty(true);
+                  setRag({ embeddingApiKey: e.target.value });
+                }}
+                placeholder={
+                  !embeddingApiKeyDirty &&
+                  settings.rag?.embeddingApiKey === MASKED_SECRET
+                    ? t(
+                        "admin.settings.ai.documents.embeddingApiKey.setPlaceholder",
+                        "Saved - leave blank to keep the current key",
+                      )
+                    : embeddingApiKeyPlaceholder
+                }
+              />
+            )}
+
+            {showEmbeddingBaseUrl && (
+              <TextInput
+                label={
+                  <Group gap="xs">
+                    <span>
+                      {t(
+                        "admin.settings.ai.documents.embeddingBaseUrl.label",
+                        "Embedding base URL",
+                      )}
+                    </span>
+                    <PendingBadge
+                      show={isFieldPending("rag.embeddingBaseUrl")}
+                    />
+                  </Group>
+                }
+                description={t(
+                  "admin.settings.ai.documents.embeddingBaseUrl.description",
+                  "Base URL of the OpenAI-compatible / Ollama embeddings endpoint, e.g. http://ollama:11434/v1. Must point at a trusted internal endpoint (SSRF-sensitive).",
+                )}
+                value={settings.rag?.embeddingBaseUrl || ""}
+                onChange={(e) => setRag({ embeddingBaseUrl: e.target.value })}
+                placeholder="http://ollama:11434/v1"
+              />
+            )}
+
+            <NumberInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t("admin.settings.ai.documents.topK.label", "Top K")}
+                  </span>
+                  <PendingBadge show={isFieldPending("rag.topK")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.documents.topK.description",
+                "Number of most-relevant chunks retrieved per search.",
+              )}
+              value={settings.rag?.topK ?? 0}
+              onChange={(value) => setRag({ topK: Number(value) })}
+              min={1}
+            />
+
+            <NumberInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.documents.maxSearches.label",
+                      "Max searches",
+                    )}
+                  </span>
+                  <PendingBadge show={isFieldPending("rag.maxSearches")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.documents.maxSearches.description",
+                "Maximum number of retrieval searches the agent may run per request.",
+              )}
+              value={settings.rag?.maxSearches ?? 0}
+              onChange={(value) => setRag({ maxSearches: Number(value) })}
+              min={0}
+            />
+          </Stack>
+        </Paper>
+
+        <Alert
+          variant="light"
+          color="orange"
+          title={t(
+            "admin.settings.ai.documents.reindexNote.title",
+            "Re-index required",
+          )}
+          icon={<LocalIcon icon="warning-rounded" width="1rem" height="1rem" />}
+        >
+          <Text size="xs">
+            {t(
+              "admin.settings.ai.documents.reindexNote.body",
+              "Changing the embedding model takes effect immediately, but documents indexed with the previous model must be re-indexed for search to return correct results.",
+            )}
+          </Text>
+        </Alert>
+      </Stack>
+
+      <SettingsStickyFooter
+        isDirty={isDirty}
+        saving={saving}
+        loginEnabled={loginEnabled}
+        onSave={handleSave}
+        onDiscard={handleDiscard}
+      />
+    </div>
+  );
+}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiGeneralSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiGeneralSection.tsx
new file mode 100644
index 0000000000..db835740c0
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiGeneralSection.tsx
@@ -0,0 +1,511 @@
+import { useCallback, useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+  TextInput,
+  NumberInput,
+  Switch,
+  Stack,
+  Paper,
+  Text,
+  Loader,
+  Group,
+  Alert,
+  Code,
+} from "@mantine/core";
+import { alert } from "@app/components/toast";
+import LocalIcon from "@app/components/shared/LocalIcon";
+import RestartConfirmationModal from "@app/components/shared/config/RestartConfirmationModal";
+import { useRestartServer } from "@app/components/shared/config/useRestartServer";
+import { useAdminSettings } from "@app/hooks/useAdminSettings";
+import { useSettingsDirty } from "@app/hooks/useSettingsDirty";
+import PendingBadge from "@app/components/shared/config/PendingBadge";
+import { SettingsStickyFooter } from "@app/components/shared/config/SettingsStickyFooter";
+import apiClient from "@app/services/apiClient";
+import { useLoginRequired } from "@app/hooks/useLoginRequired";
+import { Button } from "@app/ui/Button";
+import {
+  AiEngineSettingsData,
+  AiEngineFeatures,
+  AiEngineApiResponse,
+  clampMin,
+} from "@app/components/shared/config/configSections/aiEngineSettings";
+
+export default function AdminAiGeneralSection() {
+  const { t } = useTranslation();
+  const { loginEnabled } = useLoginRequired();
+  const {
+    restartModalOpened,
+    showRestartModal,
+    closeRestartModal,
+    restartServer,
+  } = useRestartServer();
+
+  const {
+    settings,
+    setSettings,
+    loading,
+    saving,
+    fetchSettings,
+    saveSettings,
+    isFieldPending,
+  } = useAdminSettings<AiEngineSettingsData>({
+    sectionName: "aiEngine",
+    fetchTransformer: async (): Promise<
+      AiEngineSettingsData & { _pending?: Partial<AiEngineSettingsData> }
+    > => {
+      const response = await apiClient.get<AiEngineApiResponse>(
+        "/api/v1/admin/settings/section/aiEngine",
+      );
+      return response.data || {};
+    },
+    // Save ONLY this page's keys as dot-notation so sibling AI keys are preserved.
+    saveTransformer: (s: AiEngineSettingsData) => ({
+      sectionData: {},
+      deltaSettings: {
+        "aiEngine.enabled": s.enabled ?? false,
+        "aiEngine.url": s.url ?? "",
+        // Timeouts must be >= 1s; a 0 would make every engine call fail/deadlock.
+        "aiEngine.timeoutSeconds": clampMin(s.timeoutSeconds, 1),
+        "aiEngine.longRunningTimeoutSeconds": clampMin(
+          s.longRunningTimeoutSeconds,
+          1,
+        ),
+        "aiEngine.streamTimeoutSeconds": clampMin(s.streamTimeoutSeconds, 1),
+        "aiEngine.features.chat": s.features?.chat ?? false,
+        "aiEngine.features.documentQuestions":
+          s.features?.documentQuestions ?? false,
+        "aiEngine.features.createPdf": s.features?.createPdf ?? false,
+        "aiEngine.features.mathAuditor": s.features?.mathAuditor ?? false,
+        "aiEngine.features.pdfComment": s.features?.pdfComment ?? false,
+        "aiEngine.features.classify": s.features?.classify ?? false,
+      },
+    }),
+  });
+
+  useEffect(() => {
+    fetchSettings();
+  }, []);
+
+  const { isDirty, resetToSnapshot, markSaved } = useSettingsDirty(
+    settings,
+    loading,
+  );
+
+  const handleSave = async () => {
+    try {
+      await saveSettings();
+      markSaved();
+      showRestartModal();
+    } catch (_error) {
+      alert({
+        alertType: "error",
+        title: t("admin.error", "Error"),
+        body: t("admin.settings.saveError", "Failed to save settings"),
+      });
+    }
+  };
+
+  const handleDiscard = useCallback(() => {
+    setSettings(resetToSnapshot());
+  }, [resetToSnapshot, setSettings]);
+
+  const [testingConnection, setTestingConnection] = useState(false);
+
+  // Probe the RUNNING configuration (the Java bean), not unsaved form values -
+  // after enabling AI or changing the URL, save + restart first, then test.
+  const handleTestConnection = async () => {
+    setTestingConnection(true);
+    try {
+      await apiClient.get("/api/v1/ai/health");
+      alert({
+        alertType: "success",
+        title: t(
+          "admin.settings.ai.general.test.okTitle",
+          "AI engine reachable",
+        ),
+        body: t(
+          "admin.settings.ai.general.test.okBody",
+          "The AI engine responded to a health check.",
+        ),
+      });
+    } catch (error) {
+      const detail =
+        (error as { response?: { data?: { message?: string } } })?.response
+          ?.data?.message ||
+        t(
+          "admin.settings.ai.general.test.failBody",
+          "The AI engine did not respond. Check the URL, that the engine container is running, and that AI is enabled (a restart is needed after enabling).",
+        );
+      alert({
+        alertType: "error",
+        title: t(
+          "admin.settings.ai.general.test.failTitle",
+          "AI engine unreachable",
+        ),
+        body: detail,
+      });
+    } finally {
+      setTestingConnection(false);
+    }
+  };
+
+  const setFeatures = (patch: Partial<AiEngineFeatures>) =>
+    setSettings({
+      ...settings,
+      features: { ...(settings.features || {}), ...patch },
+    });
+
+  if (loading) {
+    return (
+      <Stack align="center" justify="center" h={200}>
+        <Loader size="lg" />
+      </Stack>
+    );
+  }
+
+  const enabled = settings.enabled || false;
+
+  return (
+    <div className="settings-section-container">
+      <Stack gap="lg" className="settings-section-content">
+        <div>
+          <Text fw={600} size="lg">
+            {t("admin.settings.ai.general.title", "AI Engine")}
+          </Text>
+          <Text size="sm" c="dimmed">
+            {t(
+              "admin.settings.ai.general.description",
+              "Connect Stirling to the Python AI engine and choose which AI capabilities are exposed. Changes apply on restart.",
+            )}
+          </Text>
+        </div>
+
+        <Paper withBorder p="md" radius="md">
+          <Stack gap="md">
+            <Group justify="space-between" align="flex-start" wrap="nowrap">
+              <div>
+                <Text fw={500} size="sm">
+                  {t("admin.settings.ai.general.enabled.label", "Enable AI")}
+                </Text>
+                <Text size="xs" c="dimmed" mt={4}>
+                  {t(
+                    "admin.settings.ai.general.enabled.description",
+                    "Master switch. When off, no AI tools, agents, or engine calls are available.",
+                  )}
+                </Text>
+              </div>
+              <Group gap="xs">
+                <Switch
+                  checked={enabled}
+                  onChange={(e) =>
+                    setSettings({ ...settings, enabled: e.target.checked })
+                  }
+                  aria-label={t(
+                    "admin.settings.ai.general.enabled.label",
+                    "Enable AI",
+                  )}
+                />
+                <PendingBadge show={isFieldPending("enabled")} />
+              </Group>
+            </Group>
+
+            <TextInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t("admin.settings.ai.general.url.label", "AI engine URL")}
+                  </span>
+                  <PendingBadge show={isFieldPending("url")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.general.url.description",
+                "Internal URL of the Python AI engine, e.g. http://stirling-pdf-engine:5001.",
+              )}
+              value={settings.url || ""}
+              onChange={(e) =>
+                setSettings({ ...settings, url: e.target.value })
+              }
+              placeholder="http://stirling-pdf-engine:5001"
+              disabled={!enabled}
+            />
+
+            <Group justify="flex-end">
+              <Button
+                variant="secondary"
+                size="sm"
+                loading={testingConnection}
+                onClick={handleTestConnection}
+              >
+                {t("admin.settings.ai.general.test.button", "Test connection")}
+              </Button>
+            </Group>
+
+            <NumberInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.general.timeoutSeconds.label",
+                      "Request timeout (seconds)",
+                    )}
+                  </span>
+                  <PendingBadge show={isFieldPending("timeoutSeconds")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.general.timeoutSeconds.description",
+                "Timeout for standard AI requests to the engine.",
+              )}
+              value={settings.timeoutSeconds ?? 0}
+              onChange={(value) =>
+                setSettings({ ...settings, timeoutSeconds: Number(value) })
+              }
+              min={1}
+              disabled={!enabled}
+            />
+
+            <NumberInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.general.longRunningTimeoutSeconds.label",
+                      "Long-running timeout (seconds)",
+                    )}
+                  </span>
+                  <PendingBadge
+                    show={isFieldPending("longRunningTimeoutSeconds")}
+                  />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.general.longRunningTimeoutSeconds.description",
+                "Timeout for heavier agent operations such as document generation.",
+              )}
+              value={settings.longRunningTimeoutSeconds ?? 0}
+              onChange={(value) =>
+                setSettings({
+                  ...settings,
+                  longRunningTimeoutSeconds: Number(value),
+                })
+              }
+              min={1}
+              disabled={!enabled}
+            />
+
+            <NumberInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.general.streamTimeoutSeconds.label",
+                      "Stream timeout (seconds)",
+                    )}
+                  </span>
+                  <PendingBadge show={isFieldPending("streamTimeoutSeconds")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.general.streamTimeoutSeconds.description",
+                "Timeout for streamed (token-by-token) chat responses.",
+              )}
+              value={settings.streamTimeoutSeconds ?? 0}
+              onChange={(value) =>
+                setSettings({
+                  ...settings,
+                  streamTimeoutSeconds: Number(value),
+                })
+              }
+              min={1}
+              disabled={!enabled}
+            />
+          </Stack>
+        </Paper>
+
+        <Paper withBorder p="md" radius="md">
+          <Stack gap="md">
+            <div>
+              <Text fw={600} size="sm">
+                {t(
+                  "admin.settings.ai.general.capabilities.title",
+                  "Capabilities",
+                )}
+              </Text>
+              <Text size="xs" c="dimmed" mt={4}>
+                {t(
+                  "admin.settings.ai.general.capabilities.description",
+                  "Turn individual AI features on or off. Disabled features are hidden in the app.",
+                )}
+              </Text>
+            </div>
+
+            <FeatureSwitch
+              label={t(
+                "admin.settings.ai.general.features.chat.label",
+                "Chat assistant",
+              )}
+              description={t(
+                "admin.settings.ai.general.features.chat.description",
+                "Conversational assistant for working with PDFs.",
+              )}
+              checked={settings.features?.chat ?? false}
+              onChange={(checked) => setFeatures({ chat: checked })}
+              pending={isFieldPending("features.chat")}
+              disabled={!enabled}
+            />
+            <FeatureSwitch
+              label={t(
+                "admin.settings.ai.general.features.documentQuestions.label",
+                "Document questions",
+              )}
+              description={t(
+                "admin.settings.ai.general.features.documentQuestions.description",
+                "Ask questions and get answers grounded in an uploaded document.",
+              )}
+              checked={settings.features?.documentQuestions ?? false}
+              onChange={(checked) =>
+                setFeatures({ documentQuestions: checked })
+              }
+              pending={isFieldPending("features.documentQuestions")}
+              disabled={!enabled}
+            />
+            <FeatureSwitch
+              label={t(
+                "admin.settings.ai.general.features.createPdf.label",
+                "Create PDF from prompt",
+              )}
+              description={t(
+                "admin.settings.ai.general.features.createPdf.description",
+                "Generate a new PDF (e.g. from HTML) via an AI agent.",
+              )}
+              checked={settings.features?.createPdf ?? false}
+              onChange={(checked) => setFeatures({ createPdf: checked })}
+              pending={isFieldPending("features.createPdf")}
+              disabled={!enabled}
+            />
+            <FeatureSwitch
+              label={t(
+                "admin.settings.ai.general.features.mathAuditor.label",
+                "Math auditor",
+              )}
+              description={t(
+                "admin.settings.ai.general.features.mathAuditor.description",
+                "Review documents for mathematical and numerical errors.",
+              )}
+              checked={settings.features?.mathAuditor ?? false}
+              onChange={(checked) => setFeatures({ mathAuditor: checked })}
+              pending={isFieldPending("features.mathAuditor")}
+              disabled={!enabled}
+            />
+            <FeatureSwitch
+              label={t(
+                "admin.settings.ai.general.features.pdfComment.label",
+                "PDF comment agent",
+              )}
+              description={t(
+                "admin.settings.ai.general.features.pdfComment.description",
+                "Add AI-authored review comments and annotations to a PDF.",
+              )}
+              checked={settings.features?.pdfComment ?? false}
+              onChange={(checked) => setFeatures({ pdfComment: checked })}
+              pending={isFieldPending("features.pdfComment")}
+              disabled={!enabled}
+            />
+            <FeatureSwitch
+              label={t(
+                "admin.settings.ai.general.features.classify.label",
+                "Document classification",
+              )}
+              description={t(
+                "admin.settings.ai.general.features.classify.description",
+                "Automatically categorise documents by type or content.",
+              )}
+              checked={settings.features?.classify ?? false}
+              onChange={(checked) => setFeatures({ classify: checked })}
+              pending={isFieldPending("features.classify")}
+              disabled={!enabled}
+            />
+          </Stack>
+        </Paper>
+
+        <Alert
+          variant="light"
+          color="blue"
+          title={t(
+            "admin.settings.ai.general.note.title",
+            "About the AI engine",
+          )}
+          icon={<LocalIcon icon="info-rounded" width="1rem" height="1rem" />}
+        >
+          <Text size="xs">
+            {t(
+              "admin.settings.ai.general.note.body",
+              "The AI engine runs as a separate service. Its shared secret",
+            )}{" "}
+            <Code>STIRLING_ENGINE_SHARED_SECRET</Code>{" "}
+            {t(
+              "admin.settings.ai.general.note.body2",
+              "is set via a container environment variable. Provider API keys can be entered on these pages or supplied as engine environment variables; keys entered here are pushed to the engine when saved.",
+            )}
+          </Text>
+        </Alert>
+      </Stack>
+
+      <SettingsStickyFooter
+        isDirty={isDirty}
+        saving={saving}
+        loginEnabled={loginEnabled}
+        onSave={handleSave}
+        onDiscard={handleDiscard}
+      />
+
+      <RestartConfirmationModal
+        opened={restartModalOpened}
+        onClose={closeRestartModal}
+        onRestart={restartServer}
+      />
+    </div>
+  );
+}
+
+interface FeatureSwitchProps {
+  label: string;
+  description: string;
+  checked: boolean;
+  onChange: (checked: boolean) => void;
+  pending: boolean;
+  disabled: boolean;
+}
+
+function FeatureSwitch({
+  label,
+  description,
+  checked,
+  onChange,
+  pending,
+  disabled,
+}: FeatureSwitchProps) {
+  return (
+    <Group justify="space-between" align="flex-start" wrap="nowrap">
+      <div>
+        <Text fw={500} size="sm">
+          {label}
+        </Text>
+        <Text size="xs" c="dimmed" mt={4}>
+          {description}
+        </Text>
+      </div>
+      <Group gap="xs">
+        <Switch
+          checked={checked}
+          onChange={(e) => onChange(e.target.checked)}
+          disabled={disabled}
+          // The visible label is a sibling Text, so the control needs its own name.
+          aria-label={label}
+        />
+        <PendingBadge show={pending} />
+      </Group>
+    </Group>
+  );
+}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiLimitsSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiLimitsSection.tsx
new file mode 100644
index 0000000000..bfb1c31f28
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiLimitsSection.tsx
@@ -0,0 +1,198 @@
+import { useCallback, useEffect } from "react";
+import { useTranslation } from "react-i18next";
+import { NumberInput, Stack, Paper, Text, Loader, Group } from "@mantine/core";
+import { alert } from "@app/components/toast";
+import { useAdminSettings } from "@app/hooks/useAdminSettings";
+import { useSettingsDirty } from "@app/hooks/useSettingsDirty";
+import PendingBadge from "@app/components/shared/config/PendingBadge";
+import { SettingsStickyFooter } from "@app/components/shared/config/SettingsStickyFooter";
+import apiClient from "@app/services/apiClient";
+import { useLoginRequired } from "@app/hooks/useLoginRequired";
+import {
+  AiEngineSettingsData,
+  AiEngineLimits,
+  AiEngineApiResponse,
+  clampMin,
+  savedToastBody,
+} from "@app/components/shared/config/configSections/aiEngineSettings";
+
+export default function AdminAiLimitsSection() {
+  const { t } = useTranslation();
+  const { loginEnabled } = useLoginRequired();
+
+  const {
+    settings,
+    setSettings,
+    loading,
+    saving,
+    fetchSettings,
+    saveSettings,
+    isFieldPending,
+  } = useAdminSettings<AiEngineSettingsData>({
+    sectionName: "aiEngine",
+    fetchTransformer: async (): Promise<
+      AiEngineSettingsData & { _pending?: Partial<AiEngineSettingsData> }
+    > => {
+      const response = await apiClient.get<AiEngineApiResponse>(
+        "/api/v1/admin/settings/section/aiEngine",
+      );
+      return response.data || {};
+    },
+    // Save ONLY this page's keys as dot-notation so sibling AI keys are preserved.
+    saveTransformer: (s: AiEngineSettingsData) => ({
+      sectionData: {},
+      deltaSettings: {
+        // All must be >= 1; a 0 page/char cap or 0 concurrency breaks or deadlocks the engine.
+        "aiEngine.limits.maxPages": clampMin(s.limits?.maxPages, 1),
+        "aiEngine.limits.maxCharacters": clampMin(s.limits?.maxCharacters, 1),
+        "aiEngine.limits.modelMaxConcurrency": clampMin(
+          s.limits?.modelMaxConcurrency,
+          1,
+        ),
+      },
+    }),
+  });
+
+  useEffect(() => {
+    fetchSettings();
+  }, []);
+
+  const { isDirty, resetToSnapshot, markSaved } = useSettingsDirty(
+    settings,
+    loading,
+  );
+
+  const handleSave = async () => {
+    try {
+      await saveSettings();
+      markSaved();
+      // Engine-facing values are pushed to the AI engine live on save; no restart needed.
+      alert({
+        alertType: "success",
+        title: t("admin.settings.ai.saved.title", "AI settings saved"),
+        body: savedToastBody(settings, t),
+      });
+    } catch (_error) {
+      alert({
+        alertType: "error",
+        title: t("admin.error", "Error"),
+        body: t("admin.settings.saveError", "Failed to save settings"),
+      });
+    }
+  };
+
+  const handleDiscard = useCallback(() => {
+    setSettings(resetToSnapshot());
+  }, [resetToSnapshot, setSettings]);
+
+  const setLimits = (patch: Partial<AiEngineLimits>) =>
+    setSettings({
+      ...settings,
+      limits: { ...(settings.limits || {}), ...patch },
+    });
+
+  if (loading) {
+    return (
+      <Stack align="center" justify="center" h={200}>
+        <Loader size="lg" />
+      </Stack>
+    );
+  }
+
+  return (
+    <div className="settings-section-container">
+      <Stack gap="lg" className="settings-section-content">
+        <div>
+          <Text fw={600} size="lg">
+            {t("admin.settings.ai.limits.title", "Limits & Performance")}
+          </Text>
+          <Text size="sm" c="dimmed">
+            {t(
+              "admin.settings.ai.limits.description",
+              "Guardrails for how much work AI requests may do and how many run concurrently. Applied to the AI engine when saved.",
+            )}
+          </Text>
+        </div>
+
+        <Paper withBorder p="md" radius="md">
+          <Stack gap="md">
+            <NumberInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.limits.maxPages.label",
+                      "Max pages per request",
+                    )}
+                  </span>
+                  <PendingBadge show={isFieldPending("limits.maxPages")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.limits.maxPages.description",
+                "Guardrail: reject AI requests over this many PDF pages.",
+              )}
+              value={settings.limits?.maxPages ?? 0}
+              onChange={(value) => setLimits({ maxPages: Number(value) })}
+              min={1}
+            />
+
+            <NumberInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.limits.maxCharacters.label",
+                      "Max characters per request",
+                    )}
+                  </span>
+                  <PendingBadge show={isFieldPending("limits.maxCharacters")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.limits.maxCharacters.description",
+                "Guardrail: reject AI requests whose extracted text exceeds this length.",
+              )}
+              value={settings.limits?.maxCharacters ?? 0}
+              onChange={(value) => setLimits({ maxCharacters: Number(value) })}
+              min={1}
+            />
+
+            <NumberInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.limits.modelMaxConcurrency.label",
+                      "Model max concurrency",
+                    )}
+                  </span>
+                  <PendingBadge
+                    show={isFieldPending("limits.modelMaxConcurrency")}
+                  />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.limits.modelMaxConcurrency.description",
+                "Maximum simultaneous in-flight model calls across the whole engine.",
+              )}
+              value={settings.limits?.modelMaxConcurrency ?? 0}
+              onChange={(value) =>
+                setLimits({ modelMaxConcurrency: Number(value) })
+              }
+              min={1}
+            />
+          </Stack>
+        </Paper>
+      </Stack>
+
+      <SettingsStickyFooter
+        isDirty={isDirty}
+        saving={saving}
+        loginEnabled={loginEnabled}
+        onSave={handleSave}
+        onDiscard={handleDiscard}
+      />
+    </div>
+  );
+}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiModelsSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiModelsSection.tsx
new file mode 100644
index 0000000000..c7161f4e6e
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiModelsSection.tsx
@@ -0,0 +1,391 @@
+import { useCallback, useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+  TextInput,
+  NumberInput,
+  PasswordInput,
+  Autocomplete,
+  Select,
+  Stack,
+  Paper,
+  Text,
+  Loader,
+  Group,
+  Alert,
+} from "@mantine/core";
+import { alert } from "@app/components/toast";
+import LocalIcon from "@app/components/shared/LocalIcon";
+import { useAdminSettings } from "@app/hooks/useAdminSettings";
+import { useSettingsDirty } from "@app/hooks/useSettingsDirty";
+import PendingBadge from "@app/components/shared/config/PendingBadge";
+import { SettingsStickyFooter } from "@app/components/shared/config/SettingsStickyFooter";
+import apiClient from "@app/services/apiClient";
+import { useLoginRequired } from "@app/hooks/useLoginRequired";
+import { Z_INDEX_OVER_CONFIG_MODAL } from "@app/styles/zIndex";
+import {
+  AiEngineSettingsData,
+  AiEngineModels,
+  AiEngineApiResponse,
+  MODEL_SUGGESTIONS,
+  MASKED_SECRET,
+  clampMin,
+  savedToastBody,
+} from "@app/components/shared/config/configSections/aiEngineSettings";
+
+export default function AdminAiModelsSection() {
+  const { t } = useTranslation();
+  const { loginEnabled } = useLoginRequired();
+
+  // Track whether the user actually edited the masked secret. If not, we omit
+  // it from the delta entirely so we never send "********" back to the server.
+  const [apiKeyDirty, setApiKeyDirty] = useState(false);
+
+  const {
+    settings,
+    setSettings,
+    loading,
+    saving,
+    fetchSettings,
+    saveSettings,
+    isFieldPending,
+  } = useAdminSettings<AiEngineSettingsData>({
+    sectionName: "aiEngine",
+    fetchTransformer: async (): Promise<
+      AiEngineSettingsData & { _pending?: Partial<AiEngineSettingsData> }
+    > => {
+      const response = await apiClient.get<AiEngineApiResponse>(
+        "/api/v1/admin/settings/section/aiEngine",
+      );
+      return response.data || {};
+    },
+    // Save ONLY this page's keys as dot-notation so sibling AI keys are preserved.
+    saveTransformer: (s: AiEngineSettingsData) => {
+      const prov = s.models?.provider || "anthropic";
+      const usesBaseUrl = prov === "ollama" || prov === "custom";
+      const usesApiKey = prov !== "ollama";
+      const deltaSettings: Record<string, unknown> = {
+        "aiEngine.models.provider": prov,
+        "aiEngine.models.smartModel": s.models?.smartModel ?? "",
+        "aiEngine.models.fastModel": s.models?.fastModel ?? "",
+        "aiEngine.models.smartMaxTokens": clampMin(s.models?.smartMaxTokens, 1),
+        "aiEngine.models.fastMaxTokens": clampMin(s.models?.fastMaxTokens, 1),
+        // Never send a base URL for a provider that doesn't use one (avoids leaking a
+        // stale value left over from a previous Ollama/Custom selection).
+        "aiEngine.models.baseUrl": usesBaseUrl ? (s.models?.baseUrl ?? "") : "",
+      };
+      // Send the key when the user typed one or a provider switch cleared it; the explicit
+      // "" wipes the old provider's stored key (and is forced for providers with no key field).
+      if (apiKeyDirty) {
+        deltaSettings["aiEngine.models.apiKey"] = usesApiKey
+          ? (s.models?.apiKey ?? "")
+          : "";
+      }
+      return { sectionData: {}, deltaSettings };
+    },
+  });
+
+  useEffect(() => {
+    fetchSettings();
+  }, []);
+
+  const { isDirty, resetToSnapshot, markSaved } = useSettingsDirty(
+    settings,
+    loading,
+  );
+
+  const handleSave = async () => {
+    try {
+      await saveSettings();
+      setApiKeyDirty(false);
+      markSaved();
+      // Engine-facing values are pushed to the AI engine live on save; no restart needed.
+      alert({
+        alertType: "success",
+        title: t("admin.settings.ai.saved.title", "AI settings saved"),
+        body: savedToastBody(settings, t),
+      });
+    } catch (_error) {
+      alert({
+        alertType: "error",
+        title: t("admin.error", "Error"),
+        body: t("admin.settings.saveError", "Failed to save settings"),
+      });
+    }
+  };
+
+  const handleDiscard = useCallback(() => {
+    setApiKeyDirty(false);
+    setSettings(resetToSnapshot());
+  }, [resetToSnapshot, setSettings]);
+
+  const setModels = (patch: Partial<AiEngineModels>) =>
+    setSettings({
+      ...settings,
+      models: { ...(settings.models || {}), ...patch },
+    });
+
+  if (loading) {
+    return (
+      <Stack align="center" justify="center" h={200}>
+        <Loader size="lg" />
+      </Stack>
+    );
+  }
+
+  const provider = settings.models?.provider || "anthropic";
+  const showApiKey = provider !== "ollama";
+  const showBaseUrl = provider === "ollama" || provider === "custom";
+  const modelSuggestions = MODEL_SUGGESTIONS[provider] || [];
+
+  const apiKeyLabel =
+    provider === "anthropic"
+      ? t("admin.settings.ai.models.apiKey.anthropic", "Anthropic API key")
+      : provider === "openai"
+        ? t("admin.settings.ai.models.apiKey.openai", "OpenAI API key")
+        : t("admin.settings.ai.models.apiKey.generic", "API key");
+  const apiKeyPlaceholder =
+    provider === "anthropic"
+      ? "sk-ant-..."
+      : provider === "openai"
+        ? "sk-..."
+        : "";
+
+  return (
+    <div className="settings-section-container">
+      <Stack gap="lg" className="settings-section-content">
+        <div>
+          <Text fw={600} size="lg">
+            {t("admin.settings.ai.models.title", "Models & Providers")}
+          </Text>
+          <Text size="sm" c="dimmed">
+            {t(
+              "admin.settings.ai.models.description",
+              "Choose the LLM provider and the smart/fast models the AI engine uses. Applied to the AI engine when saved.",
+            )}
+          </Text>
+        </div>
+
+        <Paper withBorder p="md" radius="md">
+          <Stack gap="md">
+            <Select
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t("admin.settings.ai.models.provider.label", "Provider")}
+                  </span>
+                  <PendingBadge show={isFieldPending("models.provider")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.models.provider.description",
+                "Which LLM provider the engine talks to.",
+              )}
+              data={[
+                { value: "anthropic", label: "Anthropic" },
+                { value: "openai", label: "OpenAI" },
+                { value: "ollama", label: "Ollama" },
+                { value: "custom", label: "Custom (OpenAI-compatible)" },
+              ]}
+              value={provider}
+              onChange={(v) => {
+                const next = v || "anthropic";
+                const patch: Partial<AiEngineModels> = { provider: next };
+                // Clear fields the new provider doesn't use so a stale hidden value can't
+                // leak into the payload (e.g. an Ollama base URL after switching to Anthropic).
+                if (next !== "ollama" && next !== "custom") patch.baseUrl = "";
+                if (next !== provider) {
+                  // Only one key is stored and it belongs to its provider; carrying it across a
+                  // switch would 401 every call while the field still read "Saved", so clear it.
+                  patch.apiKey = "";
+                  setApiKeyDirty(true);
+                }
+                setModels(patch);
+              }}
+              allowDeselect={false}
+              comboboxProps={{
+                withinPortal: true,
+                zIndex: Z_INDEX_OVER_CONFIG_MODAL,
+              }}
+            />
+
+            <Autocomplete
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.models.smartModel.label",
+                      "Smart model",
+                    )}
+                  </span>
+                  <PendingBadge show={isFieldPending("models.smartModel")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.models.smartModel.description",
+                "High-capability model for complex reasoning. Free text; suggestions are hints only.",
+              )}
+              data={modelSuggestions}
+              value={settings.models?.smartModel || ""}
+              onChange={(value) => setModels({ smartModel: value })}
+              comboboxProps={{
+                withinPortal: true,
+                zIndex: Z_INDEX_OVER_CONFIG_MODAL,
+              }}
+            />
+
+            <Autocomplete
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.models.fastModel.label",
+                      "Fast model",
+                    )}
+                  </span>
+                  <PendingBadge show={isFieldPending("models.fastModel")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.models.fastModel.description",
+                "Cheaper, faster model for lightweight tasks. Free text; suggestions are hints only.",
+              )}
+              data={modelSuggestions}
+              value={settings.models?.fastModel || ""}
+              onChange={(value) => setModels({ fastModel: value })}
+              comboboxProps={{
+                withinPortal: true,
+                zIndex: Z_INDEX_OVER_CONFIG_MODAL,
+              }}
+            />
+
+            <NumberInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.models.smartMaxTokens.label",
+                      "Smart model max tokens",
+                    )}
+                  </span>
+                  <PendingBadge
+                    show={isFieldPending("models.smartMaxTokens")}
+                  />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.models.smartMaxTokens.description",
+                "Maximum output tokens for the smart model.",
+              )}
+              value={settings.models?.smartMaxTokens ?? 0}
+              onChange={(value) => setModels({ smartMaxTokens: Number(value) })}
+              min={1}
+            />
+
+            <NumberInput
+              label={
+                <Group gap="xs">
+                  <span>
+                    {t(
+                      "admin.settings.ai.models.fastMaxTokens.label",
+                      "Fast model max tokens",
+                    )}
+                  </span>
+                  <PendingBadge show={isFieldPending("models.fastMaxTokens")} />
+                </Group>
+              }
+              description={t(
+                "admin.settings.ai.models.fastMaxTokens.description",
+                "Maximum output tokens for the fast model.",
+              )}
+              value={settings.models?.fastMaxTokens ?? 0}
+              onChange={(value) => setModels({ fastMaxTokens: Number(value) })}
+              min={1}
+            />
+
+            {showApiKey && (
+              <PasswordInput
+                label={
+                  <Group gap="xs">
+                    <span>{apiKeyLabel}</span>
+                    <PendingBadge show={isFieldPending("models.apiKey")} />
+                  </Group>
+                }
+                description={t(
+                  "admin.settings.ai.models.apiKey.description",
+                  "Leave blank to use the engine's own environment credential. Applies to self-hosted single-engine deployments.",
+                )}
+                // Keep the field blank when a key is already stored (returned masked as "********");
+                // a pre-filled sentinel would corrupt the key on append, so bind the real value only once typed.
+                value={apiKeyDirty ? (settings.models?.apiKey ?? "") : ""}
+                onChange={(e) => {
+                  setApiKeyDirty(true);
+                  setModels({ apiKey: e.target.value });
+                }}
+                placeholder={
+                  !apiKeyDirty && settings.models?.apiKey === MASKED_SECRET
+                    ? t(
+                        "admin.settings.ai.models.apiKey.setPlaceholder",
+                        "Saved - leave blank to keep the current key",
+                      )
+                    : apiKeyPlaceholder
+                }
+              />
+            )}
+
+            {showBaseUrl && (
+              <TextInput
+                label={
+                  <Group gap="xs">
+                    <span>
+                      {t(
+                        "admin.settings.ai.models.baseUrl.label",
+                        "Provider base URL",
+                      )}
+                    </span>
+                    <PendingBadge show={isFieldPending("models.baseUrl")} />
+                  </Group>
+                }
+                description={t(
+                  "admin.settings.ai.models.baseUrl.description",
+                  "Base URL of the OpenAI-compatible / Ollama endpoint, e.g. http://ollama:11434/v1.",
+                )}
+                value={settings.models?.baseUrl || ""}
+                onChange={(e) => setModels({ baseUrl: e.target.value })}
+                placeholder="http://ollama:11434/v1"
+              />
+            )}
+
+            {showBaseUrl && (
+              <Alert
+                variant="light"
+                color="orange"
+                icon={
+                  <LocalIcon
+                    icon="warning-rounded"
+                    width="1rem"
+                    height="1rem"
+                  />
+                }
+              >
+                <Text size="xs">
+                  {t(
+                    "admin.settings.ai.models.baseUrl.warning",
+                    "The base URL must point at a trusted internal endpoint. The engine will make server-side requests to it, so an untrusted value is SSRF-sensitive.",
+                  )}
+                </Text>
+              </Alert>
+            )}
+          </Stack>
+        </Paper>
+      </Stack>
+
+      <SettingsStickyFooter
+        isDirty={isDirty}
+        saving={saving}
+        loginEnabled={loginEnabled}
+        onSave={handleSave}
+        onDiscard={handleDiscard}
+      />
+    </div>
+  );
+}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/aiEngineSettings.test.ts b/frontend/editor/src/proprietary/components/shared/config/configSections/aiEngineSettings.test.ts
new file mode 100644
index 0000000000..5bd0da6b4f
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/aiEngineSettings.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from "vitest";
+import {
+  clampMin,
+  savedToastBody,
+} from "@app/components/shared/config/configSections/aiEngineSettings";
+
+describe("clampMin", () => {
+  it("keeps a valid integer unchanged", () => {
+    expect(clampMin(8192, 1)).toBe(8192);
+    expect(clampMin(200, 1)).toBe(200);
+  });
+
+  it("floors below the minimum for empty / zero / NaN / junk input", () => {
+    // A cleared NumberInput yields "" -> 0; a transient "-" -> NaN; both must clamp to min.
+    expect(clampMin("", 1)).toBe(1);
+    expect(clampMin(0, 1)).toBe(1);
+    expect(clampMin(Number.NaN, 1)).toBe(1);
+    expect(clampMin(undefined, 1)).toBe(1);
+    expect(clampMin("-", 1)).toBe(1);
+  });
+
+  it("floors fractional values to an integer", () => {
+    expect(clampMin(5.7, 1)).toBe(5);
+  });
+
+  it("allows zero when the minimum is zero (e.g. maxSearches)", () => {
+    expect(clampMin(0, 0)).toBe(0);
+    expect(clampMin("", 0)).toBe(0);
+    expect(clampMin(4, 0)).toBe(4);
+  });
+});
+
+describe("savedToastBody", () => {
+  // The helper is passed i18next's t(); echo the key back so assertions read clearly.
+  const t = (key: string) => key;
+
+  it("promises a live push only when AI is on and config push is enabled", () => {
+    expect(savedToastBody({ enabled: true, pushConfigToEngine: true }, t)).toBe(
+      "admin.settings.ai.saved.body",
+    );
+    // pushConfigToEngine defaults to true on the backend, so an absent flag still promises it.
+    expect(savedToastBody({ enabled: true }, t)).toBe(
+      "admin.settings.ai.saved.body",
+    );
+  });
+
+  it("does not promise a push the processor will not make", () => {
+    // AI off: pushLiveAfterSave returns early, so nothing reaches the engine.
+    expect(savedToastBody({ enabled: false }, t)).toBe(
+      "admin.settings.ai.saved.bodyNoPush",
+    );
+    // Env-driven deployment (SaaS pins this false): the engine owns its own config.
+    expect(
+      savedToastBody({ enabled: true, pushConfigToEngine: false }, t),
+    ).toBe("admin.settings.ai.saved.bodyNoPush");
+  });
+});
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/aiEngineSettings.ts b/frontend/editor/src/proprietary/components/shared/config/configSections/aiEngineSettings.ts
new file mode 100644
index 0000000000..197f521d8b
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/aiEngineSettings.ts
@@ -0,0 +1,101 @@
+// Shared types + constants for the aiEngine admin settings section.
+// All four sub-pages share one GET /section/aiEngine payload; each saves only its own keys so siblings survive.
+
+/** Secret fields come back masked as this literal when a value is set. */
+export const MASKED_SECRET = "********";
+
+/** Clamp a numeric setting to a safe integer at submit; a persisted 0 timeout/concurrency would deadlock the engine (Mantine's min only guards on blur). */
+export const clampMin = (value: unknown, min: number): number =>
+  Math.max(min, Math.floor(Number(value) || min));
+
+export interface AiEngineModels {
+  provider?: string;
+  smartModel?: string;
+  fastModel?: string;
+  smartMaxTokens?: number;
+  fastMaxTokens?: number;
+  apiKey?: string;
+  baseUrl?: string;
+}
+
+export interface AiEngineRag {
+  embeddingProvider?: string;
+  embeddingModel?: string;
+  embeddingApiKey?: string;
+  embeddingBaseUrl?: string;
+  topK?: number;
+  maxSearches?: number;
+}
+
+export interface AiEngineLimits {
+  maxPages?: number;
+  maxCharacters?: number;
+  modelMaxConcurrency?: number;
+}
+
+export interface AiEngineFeatures {
+  chat?: boolean;
+  documentQuestions?: boolean;
+  createPdf?: boolean;
+  mathAuditor?: boolean;
+  pdfComment?: boolean;
+  classify?: boolean;
+}
+
+export interface AiEngineSettingsData {
+  enabled?: boolean;
+  url?: string;
+  /**
+   * Whether the processor forwards settings to the engine; SaaS pins it false, so a save
+   * persists but never reaches the engine (the toast must say so, not promise a live push).
+   */
+  pushConfigToEngine?: boolean;
+  timeoutSeconds?: number;
+  longRunningTimeoutSeconds?: number;
+  streamTimeoutSeconds?: number;
+  models?: AiEngineModels;
+  rag?: AiEngineRag;
+  limits?: AiEngineLimits;
+  features?: AiEngineFeatures;
+}
+
+/**
+ * Post-save toast body; the processor pushes only when AI is enabled AND config push is on,
+ * so the message must not promise a live push unconditionally.
+ */
+export const savedToastBody = (
+  settings: AiEngineSettingsData,
+  t: (key: string, fallback: string) => string,
+): string =>
+  settings.enabled && settings.pushConfigToEngine !== false
+    ? t(
+        "admin.settings.ai.saved.body",
+        "Changes are pushed to the AI engine automatically.",
+      )
+    : t(
+        "admin.settings.ai.saved.bodyNoPush",
+        "Settings saved. They will apply the next time the AI engine picks up its configuration.",
+      );
+
+export interface ApiResponseWithPending<T> {
+  _pending?: Partial<T>;
+}
+
+export type AiEngineApiResponse = AiEngineSettingsData &
+  ApiResponseWithPending<AiEngineSettingsData>;
+
+/** Free-text model suggestions per provider (hints only). */
+export const MODEL_SUGGESTIONS: Record<string, string[]> = {
+  anthropic: ["claude-haiku-4-5", "claude-sonnet-5", "claude-opus-4-8"],
+  openai: ["gpt-4o", "gpt-4o-mini", "o3-mini"],
+  ollama: ["llama3.1", "qwen2.5", "mistral"],
+  custom: ["llama3.1", "qwen2.5", "mistral"],
+};
+
+/** Free-text embedding-model suggestions per embedding provider. */
+export const EMBEDDING_MODEL_SUGGESTIONS: Record<string, string[]> = {
+  voyageai: ["voyage-4", "voyage-3.5"],
+  openai: ["text-embedding-3-small", "text-embedding-3-large"],
+  ollama: ["nomic-embed-text", "mxbai-embed-large", "bge-m3"],
+  custom: ["nomic-embed-text", "mxbai-embed-large", "bge-m3"],
+};
diff --git a/frontend/editor/src/saas/components/shared/config/saasConfigNavSections.test.tsx b/frontend/editor/src/saas/components/shared/config/saasConfigNavSections.test.tsx
new file mode 100644
index 0000000000..890cb604b4
--- /dev/null
+++ b/frontend/editor/src/saas/components/shared/config/saasConfigNavSections.test.tsx
@@ -0,0 +1,52 @@
+import { describe, it, expect } from "vitest";
+import { type TFunction } from "i18next";
+import { allowConsole } from "@app/tests/failOnConsole";
+import { createSaasConfigNavSections } from "@app/components/shared/config/saasConfigNavSections";
+
+// Passthrough i18n stub: return the provided fallback (2nd arg) or the key.
+const t = ((key: string, fallback?: string) =>
+  fallback ?? key) as unknown as TFunction<"translation", undefined>;
+
+const Overview = () => null;
+
+type Sections = ReturnType<typeof createSaasConfigNavSections>;
+
+function itemKeys(sections: Sections): string[] {
+  return sections.flatMap((s) => s.items.map((i) => i.key));
+}
+
+// Admin AI settings pages exist only in the self-hosted proprietary flavor; this locks in that
+// the AI group can never leak into the SaaS nav (fails loudly if wired into the SaaS cascade).
+describe("saasConfigNavSections", () => {
+  const AI_ITEM_KEYS = [
+    "adminAiGeneral",
+    "adminAiModels",
+    "adminAiDocuments",
+    "adminAiLimits",
+  ];
+
+  it("never exposes the admin AI settings group or its pages", () => {
+    // The shared core nav helper warns it is deprecated; incidental to this test.
+    allowConsole.warn(/createConfigNavSections is deprecated/);
+    const sections = createSaasConfigNavSections(Overview, () => {}, { t });
+
+    const keys = itemKeys(sections);
+    for (const aiKey of AI_ITEM_KEYS) {
+      expect(keys).not.toContain(aiKey);
+    }
+    expect(sections.map((s) => s.title)).not.toContain("AI");
+  });
+
+  it("also hides the AI pages for anonymous users", () => {
+    allowConsole.warn(/createConfigNavSections is deprecated/);
+    const sections = createSaasConfigNavSections(Overview, () => {}, {
+      t,
+      isAnonymous: true,
+    });
+
+    const keys = itemKeys(sections);
+    for (const aiKey of AI_ITEM_KEYS) {
+      expect(keys).not.toContain(aiKey);
+    }
+  });
+});

From 67e10138b5ac16cee908f4c94104082477a48f30 Mon Sep 17 00:00:00 2001
From: EthanHealy01 <80844253+EthanHealy01@users.noreply.github.com>
Date: Thu, 23 Jul 2026 09:05:56 +0000
Subject: [PATCH 087/109] =?UTF-8?q?Follow-up:=20colour=20token=20migration?=
 =?UTF-8?q?=20(compat=20=E2=86=92=20--c-*,=20hardcoded=20hex)=20(#7011)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to #7009, which built the theme token layer (`primitives` →
`colors` → `compat`). This PR moves the whole app onto it, removes
hardcoded colours, turns on enforcement so they can't come back, and
adds a user-selectable accent.

## What this does
- **Semantic tokens everywhere** — legacy colour aliases and raw hex are
rewritten to `--c-*` tokens (`--c-surface*`, `--c-text*`, `--c-primary`,
…). Straight rename, no visual change. Genuine literals (brand/OAuth,
colour pickers, data-viz) are left as-is.
- **Fixes missing colours** — some tokens the migration referenced were
never defined, so a few surfaces (login button, auth banners, badges,
procurement view) silently lost their colour. All defined now, and they
adapt to light/dark and the accent automatically.
- **Blocking colour lint** — CI now fails on hardcoded colours,
undefined tokens, or unreadable low-contrast status colours.
- **User-selectable accent** — light and dark each get their own accent
from Settings → Appearance, contrast-clamped so text stays legible.
"Default" keeps the standard blue.

## Still to come
Remaining inline-style hex, the legacy token-definition files
(`theme.css`, `tokens.css`), and folding `zIndex.ts` onto the dimension
tokens.

## Testing
`task frontend:check:all` green; light/dark and accent switching
spot-checked.
---
 .taskfiles/frontend.yml                       |   6 +-
 frontend/.storybook/preview.tsx               |   4 +-
 frontend/editor/scripts/lint/theme-lint.mjs   | 737 +++++++++++++++---
 .../slides/SaasOnboardingSlides.module.css    |  10 +-
 .../shared/FreeLimitReachedModal.tsx          |   2 +-
 .../shared/SpendCapReachedModal.tsx           |   2 +-
 .../shared/config/configSections/Payg.css     | 169 ++--
 .../shared/config/configSections/Payg.tsx     |  12 +-
 .../shared/config/configSections/PaygFree.css |  44 +-
 .../config/configSections/SpendCapControl.css |  40 +-
 .../config/configSections/TeamSection.tsx     |  13 +-
 .../config/configSections/UpgradeModal.css    |  37 +-
 .../editor/src/core/assets/Brand.stories.tsx  |   4 +-
 .../src/core/components/FileManager.tsx       |   2 +-
 .../annotation/shared/TextInputWithFont.tsx   |   2 +-
 .../components/fileEditor/AddFileCard.tsx     |  10 +-
 .../fileEditor/FileEditor.module.css          |  90 +--
 .../fileEditor/FileEditorThumbnail.module.css |  20 +-
 .../components/fileManager/DesktopLayout.tsx  |   2 +-
 .../fileManager/EmptyFilesState.tsx           |   8 +-
 .../components/fileManager/FileListItem.tsx   |   2 +-
 .../components/fileManager/MobileLayout.tsx   |   2 +-
 .../components/filesPage/FileDetailsPanel.tsx |   2 +-
 .../core/components/filesPage/FileGrid.tsx    |   2 +-
 .../components/filesPage/FileManagerView.tsx  |  16 +-
 .../components/filesPage/FileOriginBadge.tsx  |  14 +-
 .../core/components/filesPage/FilesPage.css   | 316 ++++----
 .../filesPage/FolderAppearancePicker.tsx      |  10 +-
 .../components/filesPage/FolderThumbnail.tsx  |   4 +-
 .../components/filesPage/FolderTreePanel.css  |  36 +-
 .../filesPage/MoveToFolderDialog.tsx          |   6 +-
 .../src/core/components/layout/Workbench.tsx  |   2 +-
 .../InitialOnboardingModal.module.css         |  84 +-
 .../onboarding/OnboardingSlideShell.tsx       |   4 +-
 .../components/onboarding/OnboardingTour.css  |   6 +-
 .../slides/AnimatedSlideBackground.module.css |   2 +-
 .../onboarding/slides/DesktopInstallTitle.tsx |   4 +-
 .../onboarding/slides/FirstLoginSlide.tsx     |   2 +-
 .../onboarding/slides/SecurityCheckSlide.tsx  |   2 +-
 .../pageEditor/DragDropGrid.module.css        |  10 +-
 .../components/pageEditor/FileThumbnail.tsx   |   4 +-
 .../pageEditor/PageEditor.module.css          |  12 +-
 .../pageEditor/PageEditorControls.tsx         |   4 +-
 .../BulkSelectionPanel.module.css             |  84 +-
 .../bulkSelectionPanel/OperatorsSection.tsx   |   2 +-
 .../bulkSelectionPanel/PageSelectionInput.tsx |   4 +-
 .../bulkSelectionPanel/SelectPages.tsx        |   2 +-
 .../core/components/shared/AppConfigModal.css |  18 +-
 .../core/components/shared/AppConfigModal.tsx |  12 +-
 .../src/core/components/shared/AppSwitch.css  |   6 +-
 .../src/core/components/shared/Badge.tsx      |   4 +-
 .../components/shared/EditableSecretField.tsx |   6 +-
 .../core/components/shared/ErrorBoundary.tsx  |   2 +-
 .../src/core/components/shared/FileCard.tsx   |   4 +-
 .../components/shared/FileDropdownMenu.tsx    |   4 +-
 .../shared/FileSelectorPicker.module.css      |  18 +-
 .../core/components/shared/FileSidebar.css    |  88 +--
 .../core/components/shared/FileSidebar.tsx    |   6 +-
 .../components/shared/FileSidebarFileItem.css |  67 +-
 .../src/core/components/shared/Footer.tsx     |   4 +-
 .../shared/HoverActionMenu.module.css         |   4 +-
 .../components/shared/HoverActionMenu.tsx     |   2 +-
 .../core/components/shared/LandingPage.css    |  22 +-
 .../shared/LanguageSelector.module.css        |  21 +-
 .../components/shared/LanguageSelector.tsx    |   4 +-
 .../ObscuredOverlay.module.css                |   2 +-
 .../shared/PageEditorFileDropdown.tsx         |   6 +-
 .../core/components/shared/PolicyBadges.css   |   2 +-
 .../src/core/components/shared/ToolIcon.tsx   |   2 +-
 .../components/shared/ToolPanelHeader.css     |   4 +-
 .../src/core/components/shared/Tooltip.tsx    |   2 +-
 .../core/components/shared/UpdateModal.tsx    |  16 +-
 .../core/components/shared/WorkbenchBar.css   |  44 +-
 .../shared/filePreview/DocumentThumbnail.tsx  |   2 +-
 .../shared/textInput/TextInput.module.css     |  16 +-
 .../shared/tooltip/Tooltip.module.css         |  64 +-
 .../shared/tooltip/TooltipContent.tsx         |  12 +-
 .../core/components/toast/ToastRenderer.css   |  26 +-
 .../core/components/tools/RightSidebar.tsx    |   2 +-
 .../src/core/components/tools/ToolPanel.css   | 140 ++--
 .../components/tools/ToolPanelModePrompt.css  |  82 +-
 .../src/core/components/tools/ToolPicker.tsx  |   4 +-
 .../PageNumberPreview.module.css              |  10 +-
 .../addPageNumbers/PageNumberPreview.tsx      |   2 +-
 .../tools/addStamp/StampPreview.module.css    |  10 +-
 .../tools/addStamp/StampPreviewUtils.ts       |   2 +-
 .../tools/automate/AutomationEntry.tsx        |   6 +-
 .../tools/automate/AutomationRun.tsx          |   2 +-
 .../components/tools/automate/ToolList.tsx    |   2 +-
 .../certSign/CertificateTypeSettings.tsx      |   2 +-
 .../certSign/panels/SignRequestPanel.tsx      |   6 +-
 .../components/tools/compare/compareView.css  | 168 ++--
 .../tools/convert/GroupedFormatDropdown.tsx   |   2 +-
 .../editTableOfContents/BookmarkEditor.tsx    |   7 +-
 .../EditTableOfContentsWorkbenchView.tsx      |  10 +-
 .../getPdfInfo/sections/PerPageSection.tsx    |   4 +-
 .../getPdfInfo/shared/ScrollableCodeBlock.tsx |   4 +-
 .../getPdfInfo/shared/accordionStyles.ts      |   2 +-
 .../tools/ocr/LanguagePicker.module.css       |  57 +-
 .../components/tools/ocr/LanguagePicker.tsx   |   2 +-
 .../OverlayPdfsSettings.module.css            |   6 +-
 .../tools/pageLayout/PageLayoutSettings.tsx   |   2 +-
 .../tools/redact/RedactSingleStepSettings.tsx |   6 +-
 .../ReorganizePagesSettings.tsx               |   2 +-
 .../core/components/tools/shared/ToolStep.tsx |   6 +-
 .../components/tools/showJS/ShowJSView.css    |  24 +-
 .../tools/toolPicker/ToolPicker.css           |  18 +-
 .../tools/toolPicker/ToolSearch.tsx           |   6 +-
 .../validateSignature/reportView/styles.css   |  24 +-
 .../components/viewer/AttachmentSidebar.css   |  16 +-
 .../components/viewer/BookmarkSidebar.css     |  18 +-
 .../components/viewer/BookmarkSidebar.tsx     |   9 +-
 .../components/viewer/CommentsSidebar.tsx     |  12 +-
 .../core/components/viewer/LayerSidebar.css   |  28 +-
 .../core/components/viewer/LocalEmbedPDF.tsx  |   2 +-
 .../components/viewer/PdfViewerToolbar.tsx    |   2 +-
 .../core/components/viewer/SidebarBase.css    |  17 +-
 .../components/viewer/ThumbnailSidebar.tsx    |  12 +-
 .../core/data/useTranslatedToolRegistry.tsx   |   8 +-
 frontend/editor/src/core/pages/HomePage.css   |  32 +-
 .../src/core/pages/MobileScannerPage.tsx      |  20 +-
 .../editor/src/core/styles/cookieconsent.css  |  23 +-
 frontend/editor/src/core/styles/index.css     |   6 +-
 frontend/editor/src/core/styles/theme.css     | 109 +--
 frontend/editor/src/core/theme/README.md      |  11 +-
 frontend/editor/src/core/theme/colors.css     |  90 +++
 frontend/editor/src/core/theme/compat.css     | 148 ----
 frontend/editor/src/core/theme/index.css      |   3 +-
 .../editor/src/core/theme/mantineTheme.ts     | 109 +--
 frontend/editor/src/core/theme/primitives.css | 124 +++
 .../editor/src/core/tokens/Tokens.stories.tsx |  26 +-
 frontend/editor/src/core/tokens/base.css      |   6 +-
 frontend/editor/src/core/tokens/tokens.css    | 172 ++--
 frontend/editor/src/core/tools/Compare.tsx    |   4 +-
 .../core/tools/formFill/FormFieldSidebar.tsx  |   6 +-
 .../core/tools/formFill/FormFill.module.css   |  35 +-
 frontend/editor/src/core/ui/ActionIcon.tsx    |   2 +-
 frontend/editor/src/core/ui/Avatar.css        |   4 +-
 frontend/editor/src/core/ui/Banner.css        |  22 +-
 frontend/editor/src/core/ui/Button.css        |   4 +-
 .../editor/src/core/ui/Button.stories.tsx     |   2 +-
 frontend/editor/src/core/ui/Button.tsx        |   2 +-
 frontend/editor/src/core/ui/Card.css          |   8 +-
 frontend/editor/src/core/ui/Card.stories.tsx  |  10 +-
 frontend/editor/src/core/ui/CarouselDots.css  |   6 +-
 frontend/editor/src/core/ui/ChatFABButton.css |   6 +-
 frontend/editor/src/core/ui/ChatFABWindow.css |   8 +-
 .../src/core/ui/ChatFABWindow.stories.tsx     |  10 +-
 frontend/editor/src/core/ui/Checkbox.css      |  22 +-
 frontend/editor/src/core/ui/ChipFlow.css      |   2 +-
 frontend/editor/src/core/ui/Collapsible.css   |   8 +-
 frontend/editor/src/core/ui/ColorInput.tsx    |  93 ++-
 frontend/editor/src/core/ui/DataRow.css       |   4 +-
 frontend/editor/src/core/ui/Drawer.css        |  20 +-
 .../editor/src/core/ui/Drawer.stories.tsx     |   6 +-
 frontend/editor/src/core/ui/Dropdown.css      |  18 +-
 frontend/editor/src/core/ui/EmptyState.css    |   8 +-
 frontend/editor/src/core/ui/FormField.css     |   2 +-
 frontend/editor/src/core/ui/IconBadge.css     |   6 +-
 .../editor/src/core/ui/Inline.stories.tsx     |   2 +-
 frontend/editor/src/core/ui/Input.css         |  12 +-
 frontend/editor/src/core/ui/ListRow.css       |  22 +-
 frontend/editor/src/core/ui/MantineForms.css  |  44 +-
 frontend/editor/src/core/ui/MethodBadge.css   |  12 +-
 .../src/core/ui/MethodBadge.stories.tsx       |   2 +-
 frontend/editor/src/core/ui/MetricCard.css    |  20 +-
 frontend/editor/src/core/ui/Modal.css         |  20 +-
 frontend/editor/src/core/ui/MultiSelect.tsx   |   8 +-
 frontend/editor/src/core/ui/NavItem.css       |  18 +-
 .../editor/src/core/ui/NavItem.stories.tsx    |  10 +-
 frontend/editor/src/core/ui/NumberInput.tsx   |   8 +-
 frontend/editor/src/core/ui/PanelHeader.css   |   8 +-
 frontend/editor/src/core/ui/ProgressBar.css   |   2 +-
 .../src/core/ui/ProgressBar.stories.tsx       |   8 +-
 frontend/editor/src/core/ui/ProgressBar.tsx   |   4 +-
 frontend/editor/src/core/ui/Radio.css         |  16 +-
 .../editor/src/core/ui/SectionDivider.css     |   2 +-
 .../src/core/ui/SectionDivider.stories.tsx    |  10 +-
 frontend/editor/src/core/ui/SectionHeader.css |   6 +-
 frontend/editor/src/core/ui/Select.css        |  16 +-
 frontend/editor/src/core/ui/Select.tsx        |   8 +-
 frontend/editor/src/core/ui/SettingsRow.css   |   4 +-
 .../src/core/ui/SettingsRow.stories.tsx       |   2 +-
 frontend/editor/src/core/ui/SettingsShell.css |  26 +-
 .../src/core/ui/SettingsShell.stories.tsx     |   4 +-
 frontend/editor/src/core/ui/Skeleton.css      |   6 +-
 frontend/editor/src/core/ui/Slider.css        |  16 +-
 .../editor/src/core/ui/Spinner.stories.tsx    |   2 +-
 frontend/editor/src/core/ui/Stack.stories.tsx |   6 +-
 frontend/editor/src/core/ui/StatTile.css      |   6 +-
 frontend/editor/src/core/ui/StatusBadge.css   |  14 +-
 frontend/editor/src/core/ui/StepIndicator.css |   8 +-
 frontend/editor/src/core/ui/Table.css         |  18 +-
 frontend/editor/src/core/ui/Tabs.css          |  20 +-
 frontend/editor/src/core/ui/Toast.css         |  10 +-
 frontend/editor/src/core/ui/ToggleSwitch.css  |   8 +-
 frontend/editor/src/core/ui/accents.css       |  86 +-
 .../components/DesktopOnboardingModal.tsx     |   9 +-
 .../components/SetupWizard/desktopOAuth.css   |   2 +-
 .../toolPicker/ToolPickerFooterExtensions.tsx |   4 +-
 .../src/desktop/routes/login/LoginHeader.tsx  |   2 +-
 frontend/editor/src/output.css                | 439 ++++++-----
 .../editor/src/portal/components/AppShell.css |   6 +-
 .../src/portal/components/AssistantButton.css |   8 +-
 .../src/portal/components/AssistantPanel.css  |  36 +-
 .../components/AssistantPanel.stories.tsx     |   2 +-
 .../editor/src/portal/components/AuthGate.tsx |   2 +-
 .../components/ChatFABWidget.stories.tsx      |  16 +-
 .../portal/components/DownloadEditorModal.css |  26 +-
 .../portal/components/EditorStatusCard.css    |  10 +-
 .../portal/components/EditorStatusCard.tsx    |   2 +-
 .../components/NotificationsDropdown.css      |  34 +-
 .../src/portal/components/ProcessorFlow.css   |  56 +-
 .../src/portal/components/SearchModal.css     |  16 +-
 .../portal/components/SearchModal.stories.tsx |   2 +-
 .../src/portal/components/SetupChecklist.css  |  26 +-
 .../components/SetupChecklist.stories.tsx     |   4 +-
 .../editor/src/portal/components/Sidebar.css  |  29 +-
 .../src/portal/components/Sidebar.stories.tsx |   2 +-
 .../editor/src/portal/components/Sidebar.tsx  |  12 +-
 .../src/portal/components/WelcomeBanner.css   |  10 +-
 .../src/portal/components/billing/billing.css | 194 ++---
 .../policies/ClassificationLabelsSection.css  |  10 +-
 .../policies/PolicyCategoryIcon.css           |   4 +-
 .../components/processor-flow/FlowSankey.tsx  |   4 +-
 .../processor-flow/useFlowParticles.ts        |   4 +-
 .../procurement/ProcurementModal.stories.tsx  |   2 +-
 .../src/portal/contexts/TierContext.tsx       |   4 +-
 .../src/portal/data/Endpoints.stories.tsx     |  18 +-
 .../editor/src/portal/data/Ops.stories.tsx    |  38 +-
 frontend/editor/src/portal/data/ops.ts        |   4 +-
 frontend/editor/src/portal/theme/base.css     |   4 +-
 .../editor/src/portal/theme/mantineTheme.ts   |  16 +-
 .../editor/src/portal/views/AccountLink.css   |  18 +-
 .../editor/src/portal/views/DeveloperDocs.css | 144 ++--
 .../editor/src/portal/views/Documents.css     |  30 +-
 .../editor/src/portal/views/EditorAdmin.css   |  46 +-
 frontend/editor/src/portal/views/Home.css     |  23 +-
 .../src/portal/views/Infrastructure.css       |  54 +-
 .../src/portal/views/PipelineBuilder.css      |  86 +-
 .../editor/src/portal/views/Pipelines.css     |  20 +-
 frontend/editor/src/portal/views/Policies.css |  66 +-
 .../editor/src/portal/views/Procurement.css   | 386 ++++-----
 .../editor/src/portal/views/SourceBuilder.css |   4 +-
 frontend/editor/src/portal/views/Sources.css  | 112 +--
 frontend/editor/src/portal/views/Usage.css    |  54 +-
 frontend/editor/src/portal/views/Users.css    |  84 +-
 .../auth/ui/AuthDefaultCredentials.tsx        |  25 +-
 .../src/proprietary/auth/ui/auth-theme.css    |  24 +-
 .../editor/src/proprietary/auth/ui/auth.css   |  78 +-
 .../src/proprietary/billing/MeterBar.tsx      |  13 +-
 .../components/LoginLandingRedirect.tsx       |   2 +-
 .../proprietary/components/chat/ChatPanel.css |  60 +-
 .../components/chat/ChatQuickActions.tsx      |  37 +-
 .../ClassificationCategoryManager.css         |   6 +-
 .../shared/PolicyEnforcingOverlay.tsx         |   2 +-
 .../shared/config/configSections/ApiKeys.tsx  |   8 +-
 .../config/configSections/PeopleSection.tsx   |   5 +-
 .../configSections/apiKeys/ApiKeySection.tsx  |   8 +-
 .../dividerWithText/DividerWithText.css       |   4 +-
 .../watchedFolders/CardExpansionModal.tsx     |  12 +-
 .../components/watchedFolders/StatCard.tsx    |   6 +-
 .../watchedFolders/WatchedFolderCard.tsx      |   3 +-
 .../watchedFolders/WatchedFolderHomePage.tsx  |   8 +-
 .../WatchedFolderManagementModal.tsx          |  12 +-
 .../watchedFolders/WatchedFolderSection.tsx   |   4 +-
 .../WatchedFolderWorkbenchView.tsx            |  29 +-
 .../watchedFolders/WatchedFolders.css         |  76 +-
 .../editor/src/proprietary/routes/Landing.tsx |   8 +-
 .../editor/src/proprietary/routes/Login.tsx   |  16 +-
 .../routes/login/LoggedInState.tsx            |  10 +-
 .../saas/components/auth/GuestUserBanner.css  |   4 +-
 .../saas/components/shared/AppConfigModal.tsx |  12 +-
 .../shared/charts/StackedBarChart.css         |   6 +-
 .../shared/charts/StackedBarChart.tsx         |   4 +-
 .../shared/config/configSections/ApiKeys.tsx  |   8 +-
 frontend/editor/src/saas/routes/Login.tsx     |   6 +-
 frontend/editor/src/saas/routes/Signup.tsx    |   4 +-
 .../src/saas/routes/authShared/saas-auth.css  |  23 +-
 .../editor/src/saas/styles/saas-theme.css     |  20 +-
 280 files changed, 4030 insertions(+), 3474 deletions(-)
 delete mode 100644 frontend/editor/src/core/theme/compat.css

diff --git a/.taskfiles/frontend.yml b/.taskfiles/frontend.yml
index 9a3b1bdd47..7ac5300a15 100644
--- a/.taskfiles/frontend.yml
+++ b/.taskfiles/frontend.yml
@@ -207,10 +207,14 @@ tasks:
       - task: lint:colors
 
   lint:colors:
-    desc: "Enforce theme tokens — colours in core/theme route through the palette"
+    desc: "Enforce theme tokens — no hardcoded colours or raw primitives in components"
+    aliases: [lint:colours]
     deps: [install]
     cmds:
       - node editor/scripts/lint/theme-lint.mjs
+      - node editor/scripts/lint/theme-lint.mjs css-colors
+      - node editor/scripts/lint/theme-lint.mjs code-colors
+      - node editor/scripts/lint/theme-lint.mjs no-primitives
 
   contrast:
     desc: "Report low-contrast theme token pairs (warning only, never blocks)"
diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index b2459cd926..339fe4f842 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -226,8 +226,8 @@ const preview: Preview = {
     backgrounds: {
       default: "app",
       values: [
-        { name: "app", value: "var(--color-bg)" },
-        { name: "surface", value: "var(--color-surface)" },
+        { name: "app", value: "var(--c-bg)" },
+        { name: "surface", value: "var(--c-surface)" },
       ],
     },
     a11y: {
diff --git a/frontend/editor/scripts/lint/theme-lint.mjs b/frontend/editor/scripts/lint/theme-lint.mjs
index b21b18f322..561fd5c1cc 100644
--- a/frontend/editor/scripts/lint/theme-lint.mjs
+++ b/frontend/editor/scripts/lint/theme-lint.mjs
@@ -1,19 +1,24 @@
 #!/usr/bin/env node
-// Theme colour lint — guards the theme SYSTEM (core/theme/). Two modes:
+// Theme colour lint — guards the theme system + app-wide colour hygiene. Modes:
 //
 //   node theme-lint.mjs            enforce: literal colours live ONLY in
-//                                  primitives.css; colors/compat/dimensions must
-//                                  reference tokens; no duplicate primitives.
-//                                  (blocking)
-//   node theme-lint.mjs contrast   warn-only WCAG contrast report (never blocks)
-//
-// Scope is deliberately just core/theme/ — the palette + token layer this PR
-// owns, which is clean, so no baseline file is needed. Enforcing "no hardcoded
-// colours" across the whole app (260+ existing sites) is a separate migration.
+//                                  primitives.css; core/theme references tokens;
+//                                  no duplicate primitives; every referenced
+//                                  --p-*/--c-* token resolves. (blocking)
+//   node theme-lint.mjs css-colors enforce: NO hardcoded colour in any source
+//                                  .css (primitives.css + generated output.css
+//                                  exempt). Scope: all editor/src. (blocking)
+//   node theme-lint.mjs code-colors enforce: no hardcoded colour in TS/TSX DOM
+//                                  code (default-deny with layered exemptions;
+//                                  `// theme-allow-color` opt-out). (blocking)
+//   node theme-lint.mjs contrast   warn-only WCAG report — fixed --c-* pairs +
+//                                  status-tone text/fill pairs. (The tone gate
+//                                  below 1.6:1 is enforced in the default run.)
 //
 // Structural black / white / transparent (shadows, scrims) are always allowed.
 
 import { readFileSync, readdirSync } from "node:fs";
+import { execSync } from "node:child_process";
 import { relative, resolve, join } from "node:path";
 
 const THEME = resolve(process.cwd(), "editor/src/core/theme");
@@ -26,7 +31,6 @@ const PRIMITIVES = "editor/src/core/theme/primitives.css";
 const THEME_FILES = [
   "primitives.css",
   "colors.css",
-  "compat.css",
   "dimensions.css",
   "index.css",
 ];
@@ -34,8 +38,156 @@ const THEME_FILES = [
 // ── colour helpers ─────────────────────────────────────────────────────────
 const HEX_RE = /#[0-9a-fA-F]{3,8}\b/g;
 const FUNC_RE = /\b(?:rgba?|hsla?)\(\s*[^)]*\)/g;
-const NAMED_RE =
-  /\b(?:white|black|red|green|blue|orange|yellow|purple|gray|grey|silver|transparent)\b/g;
+// CSS named colours (structural white/black/transparent handled separately).
+// Kept broad so `color: teal`/`navy`/`crimson`/`cyan` can't slip past the gate.
+const NAMED_COLORS = [
+  "aliceblue",
+  "antiquewhite",
+  "aqua",
+  "aquamarine",
+  "azure",
+  "beige",
+  "bisque",
+  "blanchedalmond",
+  "blue",
+  "blueviolet",
+  "brown",
+  "burlywood",
+  "cadetblue",
+  "chartreuse",
+  "chocolate",
+  "coral",
+  "cornflowerblue",
+  "cornsilk",
+  "crimson",
+  "cyan",
+  "darkblue",
+  "darkcyan",
+  "darkgoldenrod",
+  "darkgray",
+  "darkgreen",
+  "darkgrey",
+  "darkkhaki",
+  "darkmagenta",
+  "darkolivegreen",
+  "darkorange",
+  "darkorchid",
+  "darkred",
+  "darksalmon",
+  "darkseagreen",
+  "darkslateblue",
+  "darkslategray",
+  "darkslategrey",
+  "darkturquoise",
+  "darkviolet",
+  "deeppink",
+  "deepskyblue",
+  "dimgray",
+  "dimgrey",
+  "dodgerblue",
+  "firebrick",
+  "floralwhite",
+  "forestgreen",
+  "fuchsia",
+  "gainsboro",
+  "ghostwhite",
+  "gold",
+  "goldenrod",
+  "gray",
+  "green",
+  "greenyellow",
+  "grey",
+  "honeydew",
+  "hotpink",
+  "indianred",
+  "indigo",
+  "ivory",
+  "khaki",
+  "lavender",
+  "lavenderblush",
+  "lawngreen",
+  "lemonchiffon",
+  "lightblue",
+  "lightcoral",
+  "lightcyan",
+  "lightgoldenrodyellow",
+  "lightgray",
+  "lightgreen",
+  "lightgrey",
+  "lightpink",
+  "lightsalmon",
+  "lightseagreen",
+  "lightskyblue",
+  "lightslategray",
+  "lightslategrey",
+  "lightsteelblue",
+  "lightyellow",
+  "lime",
+  "limegreen",
+  "linen",
+  "magenta",
+  "maroon",
+  "mediumaquamarine",
+  "mediumblue",
+  "mediumorchid",
+  "mediumpurple",
+  "mediumseagreen",
+  "mediumslateblue",
+  "mediumspringgreen",
+  "mediumturquoise",
+  "mediumvioletred",
+  "midnightblue",
+  "mintcream",
+  "mistyrose",
+  "moccasin",
+  "navajowhite",
+  "navy",
+  "oldlace",
+  "olive",
+  "olivedrab",
+  "orange",
+  "orangered",
+  "orchid",
+  "palegoldenrod",
+  "palegreen",
+  "paleturquoise",
+  "palevioletred",
+  "papayawhip",
+  "peachpuff",
+  "peru",
+  "pink",
+  "plum",
+  "powderblue",
+  "purple",
+  "rebeccapurple",
+  "red",
+  "rosybrown",
+  "royalblue",
+  "saddlebrown",
+  "salmon",
+  "sandybrown",
+  "seagreen",
+  "seashell",
+  "sienna",
+  "silver",
+  "skyblue",
+  "slateblue",
+  "slategray",
+  "slategrey",
+  "snow",
+  "springgreen",
+  "steelblue",
+  "tan",
+  "teal",
+  "thistle",
+  "tomato",
+  "turquoise",
+  "violet",
+  "wheat",
+  "yellow",
+  "yellowgreen",
+];
+const NAMED_RE = new RegExp(`\\b(?:${NAMED_COLORS.join("|")})\\b`, "g");
 
 function expandHex(hex) {
   let h = hex.slice(1).toLowerCase();
@@ -66,6 +218,98 @@ function stripComments(text) {
   return text.replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " "));
 }
 
+// ── shared colour math + token resolution (used by contrast report + tone guard)
+function readPrimitives(css) {
+  const primitives = {};
+  for (const m of css.matchAll(
+    /(--p-[a-z0-9-]+)\s*:\s*(#[0-9a-fA-F]{3,8})\s*;/g,
+  ))
+    primitives[m[1]] = m[2];
+  return primitives;
+}
+function hexToRgb(hex) {
+  // expandHex normalises 3/4-digit shorthand to 6/8; parse alpha from 8-digit.
+  const h = expandHex(hex.startsWith("#") ? hex : "#" + hex).slice(1);
+  return {
+    r: parseInt(h.slice(0, 2), 16),
+    g: parseInt(h.slice(2, 4), 16),
+    b: parseInt(h.slice(4, 6), 16),
+    a: h.length >= 8 ? parseInt(h.slice(6, 8), 16) / 255 : 1,
+  };
+}
+const over = (f, b) => ({
+  r: f.r * f.a + b.r * (1 - f.a),
+  g: f.g * f.a + b.g * (1 - f.a),
+  b: f.b * f.a + b.b * (1 - f.a),
+  a: 1,
+});
+const mix = (a, b, p) => ({
+  r: (a.r * p + b.r * (100 - p)) / 100,
+  g: (a.g * p + b.g * (100 - p)) / 100,
+  b: (a.b * p + b.b * (100 - p)) / 100,
+  a: 1,
+});
+// Resolve any token value: hex, rgb(a), var(--x[, fallback]) (--p-* → palette,
+// else the theme map), or color-mix(in srgb, A n%, B|transparent).
+function resolveColorValue(v, t, primitives, seen) {
+  if (v == null) return null;
+  // Collapse internal whitespace so multi-line values (e.g. a color-mix() split
+  // across lines in tokens.css) match the single-line grammars below.
+  v = v.replace(/\s+/g, " ").trim();
+  let m;
+  if (v.startsWith("#")) return hexToRgb(v);
+  if ((m = v.match(/^rgba?\(([^)]+)\)$/))) {
+    const n = m[1]
+      .split(/[,/\s]+/)
+      .map(Number)
+      .filter((x) => !Number.isNaN(x));
+    return { r: n[0], g: n[1], b: n[2], a: n[3] ?? 1 };
+  }
+  if ((m = v.match(/^var\(\s*(--[a-z0-9-]+)\s*(?:,\s*([\s\S]+))?\)$/))) {
+    return resolveColorVar(m[1], m[2], t, primitives, seen);
+  }
+  if (
+    (m = v.match(
+      /^color-mix\(\s*in srgb\s*,\s*(.+?)\s+(\d+)%\s*,\s*(.+?)\s*\)$/,
+    ))
+  ) {
+    const a = resolveColorValue(m[1], t, primitives, seen);
+    if (!a) return null;
+    if (m[3].trim() === "transparent") return { ...a, a: +m[2] / 100 };
+    const b = resolveColorValue(m[3].trim(), t, primitives, seen);
+    return b ? mix(a, b, +m[2]) : null;
+  }
+  return null;
+}
+function resolveColorVar(name, fallback, t, primitives, seen) {
+  if (name.startsWith("--p-")) {
+    return primitives[name]
+      ? hexToRgb(primitives[name])
+      : fallback
+        ? resolveColorValue(fallback, t, primitives, seen)
+        : null;
+  }
+  if (!seen.has(name) && t[name] !== undefined) {
+    const next = new Set(seen).add(name);
+    const r = resolveColorValue(t[name], t, primitives, next);
+    if (r) return r;
+  }
+  return fallback ? resolveColorValue(fallback, t, primitives, seen) : null;
+}
+const relativeLuminance = ({ r, g, b }) => {
+  const f = (v) => {
+    v /= 255;
+    return v <= 0.03928 ? v / 12.92 : ((v + 0.055) / 1.055) ** 2.4;
+  };
+  return 0.2126 * f(r) + 0.7152 * f(g) + 0.0722 * f(b);
+};
+const contrastRatio = (a, b) => {
+  const [hi, lo] = [relativeLuminance(a), relativeLuminance(b)].sort(
+    (x, y) => y - x,
+  );
+  return (hi + 0.05) / (lo + 0.05);
+};
+
 // ── enforce: literals only in primitives.css, no duplicate primitives ────────
 function check() {
   const violations = [];
@@ -149,11 +393,7 @@ function check() {
 function reportContrast() {
   const primitivesCss = readFileSync(join(THEME, "primitives.css"), "utf8");
   const colorsCss = readFileSync(join(THEME, "colors.css"), "utf8");
-  const primitives = {};
-  for (const m of primitivesCss.matchAll(
-    /(--p-[a-z0-9-]+)\s*:\s*(#[0-9a-fA-F]{3,8})\s*;/g,
-  ))
-    primitives[m[1]] = m[2];
+  const primitives = readPrimitives(primitivesCss);
   const blocks = [];
   for (const m of colorsCss.matchAll(/([^{}]+)\{([^}]*)\}/g)) {
     const decls = {};
@@ -189,82 +429,8 @@ function reportContrast() {
   };
   const flatten = (list) =>
     Object.assign({ ...SEED }, ...list.map((b) => b.decls));
-  const hexToRgb = (h) => {
-    h = h.replace("#", "");
-    if (h.length === 3)
-      h = h
-        .split("")
-        .map((c) => c + c)
-        .join("");
-    return {
-      r: parseInt(h.slice(0, 2), 16),
-      g: parseInt(h.slice(2, 4), 16),
-      b: parseInt(h.slice(4, 6), 16),
-      a: 1,
-    };
-  };
-  const over = (f, b) => ({
-    r: f.r * f.a + b.r * (1 - f.a),
-    g: f.g * f.a + b.g * (1 - f.a),
-    b: f.b * f.a + b.b * (1 - f.a),
-    a: 1,
-  });
-  const mix = (a, b, p) => ({
-    r: (a.r * p + b.r * (100 - p)) / 100,
-    g: (a.g * p + b.g * (100 - p)) / 100,
-    b: (a.b * p + b.b * (100 - p)) / 100,
-    a: 1,
-  });
-  // Resolve any token value: hex, rgb(a), var(--x[, fallback]) (--p-* → palette,
-  // else the theme map/seed), or color-mix(in srgb, A n%, B|transparent).
-  function resolveValue(v, t, seen) {
-    if (v == null) return null;
-    v = v.trim();
-    let m;
-    if (v.startsWith("#")) return hexToRgb(v);
-    if ((m = v.match(/^rgba?\(([^)]+)\)$/))) {
-      const n = m[1]
-        .split(/[,/\s]+/)
-        .map(Number)
-        .filter((x) => !Number.isNaN(x));
-      return { r: n[0], g: n[1], b: n[2], a: n[3] ?? 1 };
-    }
-    if ((m = v.match(/^var\(\s*(--[a-z0-9-]+)\s*(?:,\s*([\s\S]+))?\)$/))) {
-      return resolveVar(m[1], m[2], t, seen);
-    }
-    if ((m = v.match(/^color-mix\(in srgb,\s*(.+?)\s+(\d+)%\s*,\s*(.+)\)$/))) {
-      const a = resolveValue(m[1], t, seen);
-      if (!a) return null;
-      if (m[3].trim() === "transparent") return { ...a, a: +m[2] / 100 };
-      const b = resolveValue(m[3].trim(), t, seen);
-      return b ? mix(a, b, +m[2]) : null;
-    }
-    return null;
-  }
-  function resolveVar(name, fallback, t, seen) {
-    if (name.startsWith("--p-")) {
-      return primitives[name]
-        ? hexToRgb(primitives[name])
-        : fallback
-          ? resolveValue(fallback, t, seen)
-          : null;
-    }
-    if (!seen.has(name) && t[name] !== undefined) {
-      const next = new Set(seen).add(name);
-      const r = resolveValue(t[name], t, next);
-      if (r) return r;
-    }
-    return fallback ? resolveValue(fallback, t, seen) : null;
-  }
   const resolve = (token, t) =>
-    resolveValue(t[token] ?? null, t, new Set([token]));
-  const lum = ({ r, g, b }) => {
-    const f = (v) => {
-      v /= 255;
-      return v <= 0.03928 ? v / 12.92 : ((v + 0.055) / 1.055) ** 2.4;
-    };
-    return 0.2126 * f(r) + 0.7152 * f(g) + 0.0722 * f(b);
-  };
+    resolveColorValue(t[token] ?? null, t, primitives, new Set([token]));
   const contrast = (t1, t2, t) => {
     const surface = resolve("--c-surface", t);
     let a = resolve(t1, t);
@@ -272,8 +438,7 @@ function reportContrast() {
     if (!a || !b || !surface) return null;
     if (a.a < 1) a = over(a, surface);
     if (b.a < 1) b = over(b, surface);
-    const [hi, lo] = [lum(a), lum(b)].sort((x, y) => y - x);
-    return (hi + 0.05) / (lo + 0.05);
+    return contrastRatio(a, b);
   };
   const PAIRS = [
     ["--c-text", "--c-surface", 4.5],
@@ -307,23 +472,397 @@ function reportContrast() {
   );
 }
 
+// ── status-tone text on its own fill ─────────────────────────────────────────
+// Checks --color-{hue} text against its --color-{hue}-light fill, per theme.
+// Below TONE_INVISIBLE blocks the build; TONE_FLOOR (WCAG AA) is advisory.
+const TOKENS_CSS = resolve(process.cwd(), "editor/src/core/tokens/tokens.css");
+const TONE_FLOOR = 3.0;
+const TONE_INVISIBLE = 1.6;
+// Compute the contrast of every --color-{hue} text on its own --color-{hue}-light
+// fill, per theme. Returns [{ theme, base, fill, ratio|null }] — no printing, so
+// both the warn-only report and the blocking guard can share it.
+function toneContrastResults() {
+  const primitives = readPrimitives(
+    readFileSync(join(THEME, "primitives.css"), "utf8"),
+  );
+  // Strip comments first: a selector's captured prefix can otherwise include a
+  // preceding comment that mentions data-theme="dark", misclassifying the block.
+  const css = stripComments(readFileSync(TOKENS_CSS, "utf8"));
+  const isDark = (sel) => /data-theme="dark"|color-scheme="dark"/.test(sel);
+  const lightTones = {};
+  const darkTones = {};
+  for (const m of css.matchAll(/([^{}]+)\{([^}]*)\}/g)) {
+    const target = isDark(m[1]) ? darkTones : lightTones;
+    for (const d of m[2].matchAll(/(--color-[a-z0-9-]+)\s*:\s*([^;]+);/g))
+      target[d[1]] = d[2].trim();
+  }
+  // Dark only overrides the tones it redefines; unspecified ones inherit light.
+  const themes = { light: lightTones, dark: { ...lightTones, ...darkTones } };
+  const white = { r: 255, g: 255, b: 255, a: 1 };
+  const results = [];
+  for (const [theme, t] of Object.entries(themes)) {
+    const bases = Object.keys(t)
+      .map((k) => /^(--color-[a-z]+)-light$/.exec(k)?.[1])
+      .filter((base) => base && t[base] !== undefined);
+    for (const base of bases) {
+      const fill = `${base}-light`;
+      const fg = resolveColorValue(t[base], t, primitives, new Set([base]));
+      const bg = resolveColorValue(t[fill], t, primitives, new Set([fill]));
+      const ratio =
+        fg && bg
+          ? contrastRatio(
+              fg.a < 1 ? over(fg, bg) : fg,
+              bg.a < 1 ? over(bg, white) : bg,
+            )
+          : null;
+      results.push({ theme, base, fill, ratio });
+    }
+  }
+  return results;
+}
+
+function reportToneContrast() {
+  const results = toneContrastResults();
+  let warnings = 0;
+  let invisible = 0;
+  console.log("tone-contrast report: text on its own -light fill\n");
+  let theme = "";
+  for (const { theme: th, base, fill, ratio } of results) {
+    if (th !== theme) {
+      theme = th;
+      console.log(`  ${theme}`);
+    }
+    if (ratio == null) {
+      console.log(`    ?      ${base} on ${fill} (unresolved)`);
+      continue;
+    }
+    // ✖ = near-invisible (blocks CI), ⚠ = below the WCAG floor (warn only).
+    const mark =
+      ratio < TONE_INVISIBLE ? "✖ " : ratio < TONE_FLOOR ? "⚠ " : "  ";
+    if (ratio < TONE_INVISIBLE) invisible++;
+    else if (ratio < TONE_FLOOR) warnings++;
+    console.log(
+      `    ${mark}${ratio.toFixed(2).padStart(5)}  (floor ${TONE_FLOOR}, blocks <${TONE_INVISIBLE})  ${base} on ${fill}`,
+    );
+  }
+  const parts = [];
+  if (invisible)
+    parts.push(`✖ ${invisible} near-invisible (<${TONE_INVISIBLE}:1)`);
+  if (warnings) parts.push(`⚠ ${warnings} below the ${TONE_FLOOR} floor`);
+  console.log(
+    parts.length
+      ? `\n${parts.join(", ")}. ✖ blocks the build; ⚠ is advisory.\n`
+      : "\n✓ all tones clear the floor.\n",
+  );
+}
+
+// ── css-colors (blocking): no hardcoded colour in ANY source .css ────────────
+// App-wide guard that source CSS routes every colour through the palette. File
+// list from `git ls-files` (a VCS query, never a directory walk feeding a read).
+// primitives.css (the literal home) and generated output.css are exempt.
+function checkAppCss() {
+  const EXEMPT = /(?:^|\/)(?:primitives\.css|output\.css)$/;
+  const listed = execSync("git ls-files -- editor/src", { encoding: "utf8" })
+    .split("\n")
+    .map((l) => l.trim())
+    .filter((l) => l && l.endsWith(".css") && !EXEMPT.test(l));
+
+  const violations = [];
+  const lineOf = (text, index) => text.slice(0, index).split("\n").length;
+  for (const rel of listed) {
+    const text = stripComments(readFileSync(rel, "utf8"));
+    for (const re of [HEX_RE, FUNC_RE]) {
+      re.lastIndex = 0;
+      let m;
+      while ((m = re.exec(text)) !== null) {
+        if (/var\(/i.test(m[0])) continue; // rgb()/color-mix wrapping a token
+        const norm = normalizeColor(m[0]);
+        if (isStructuralColor(norm)) continue;
+        violations.push({
+          file: rel,
+          line: lineOf(text, m.index),
+          msg: `raw colour ${m[0]} — define it in primitives.css and use var(--p-…)`,
+        });
+      }
+    }
+    text.split("\n").forEach((line, i) => {
+      const colon = line.indexOf(":");
+      if (colon < 0 || /[{}]/.test(line)) return;
+      if (!/^\s*(?:--)?[a-z][a-z0-9-]*\s*$/i.test(line.slice(0, colon))) return;
+      const value = line
+        .slice(colon + 1)
+        .replace(/--[a-z0-9-]+/gi, " ")
+        .replace(/url\([^)]*\)/g, " ")
+        .replace(/["'][^"']*["']/g, " ");
+      for (const nm of value.match(NAMED_RE) || []) {
+        if (isStructuralName(nm)) continue;
+        violations.push({
+          file: rel,
+          line: i + 1,
+          msg: `named colour "${nm}" — define it in primitives.css and use var(--p-…)`,
+        });
+      }
+    });
+  }
+  return violations;
+}
+
+// ── code-colors (blocking): no hardcoded colour in TS/TSX DOM code ───────────
+// Default-deny with layered exemptions: structural black/white/transparent;
+// safe contexts on the line (var() fallback, canvas/pdf-lib rgb, an explicit
+// `// theme-allow-color` opt-out); and exempt PATHS where colour literals are
+// inherent (rendering/vendor/config/tests/stories).
+const CODE_EXEMPT_PATH = [
+  /Thumbnail|Overlay|DrawingCanvas|PageEditor|MobileScannerPage/,
+  // PDF rendering/drawing surfaces that legitimately carry colour literals —
+  // scoped to specific tool paths, not a blanket "pdf" substring (which used to
+  // exempt most of the app in a PDF product).
+  /pdfTextEditor|pixelCompare|\/compare\.ts$|customPrimary|accentColors/,
+  /validateSignature\/outputtedPDFSections|CenteredMessageSection|StatusBadgeSection/,
+  /\/viewer\/|Annotation|useViewerReadAloud|CommentsSidebar|\/constants\/search\.ts$|SignaturePreview/,
+  /ColorPicker|ColorControl|WatchedFolderManagementModal|watchedFolderPresets|fileColors|unifiedBackground|folder\.ts$|policyFolders/,
+  /OAuthButtons|oauthCallbackHtml/,
+  /mantineTheme|\/theme\.ts$|toolsTaxonomy|LayoutPreview|PageNumberPreview|CloudStorageIcons/,
+  /\/onboarding\//,
+  /addStamp|addWatermark|\/tooltips\//,
+  /UpgradeBanner|AdminPlanSection/,
+  /\.test\.[jt]sx?$|\.stories\.[jt]sx?$|\/types\//,
+];
+const CODE_HEX =
+  /#(?:[0-9a-fA-F]{8}|[0-9a-fA-F]{6}|[0-9a-fA-F]{4}|[0-9a-fA-F]{3})(?![0-9a-fA-F])/g;
+const CODE_RGB = /rgba?\(([^)]*)\)/gi;
+const CODE_HSL = /hsla?\(([^)]*)\)/gi;
+// NOTE: bare named colours (e.g. 'blue') are intentionally NOT flagged in
+// TS/TSX — they are dominated by legitimate Mantine palette props (`c="red"`,
+// `color="blue"`, which are theme-routed) and provider names ('azure'), so a
+// string match produces mostly false positives. hsl()/hex/rgb() are unambiguous.
+const codeStructuralHex = (h) =>
+  /^#(?:000|fff|000f|ffff|000000|ffffff|00000000|ffffffff)$/i.test(h);
+// Line-level skips for contexts where a colour literal is inherent (canvas /
+// pdf-lib drawing, computed-style reads) or explicitly opted out. NOTE: a
+// `var(--x, #hex)` literal fallback is deliberately NOT skipped — the hex in the
+// fallback is still a hardcoded colour and must route through a token.
+const CODE_SKIP_LINE =
+  /theme-allow-color|readColor\(|getPropertyValue|\.colors\.[a-z]+\?\.\[|fillStyle|strokeStyle|shadowColor|addColorStop|createLinearGradient|ctx\.|getContext/i;
+function codeStripNonCode(text) {
+  return text
+    .replace(/\/\*[\s\S]*?\*\//g, (m) => m.replace(/[^\n]/g, " "))
+    .replace(
+      /(^|[^:])\/\/[^\n]*/g,
+      (m, p) => p + m.slice(p.length).replace(/[^\n]/g, " "),
+    )
+    .replace(/&#\d+;/g, "     ");
+}
+function codeRgbIsColour(inner) {
+  if (/var\(/.test(inner)) return false;
+  const p = inner
+    .split(/[, /]+/)
+    .map((x) => x.trim())
+    .filter(Boolean);
+  if (!/^\d/.test(p[0] || "")) return false;
+  const nums = p.slice(0, 3).map(Number);
+  if (nums.some((n) => Number.isNaN(n))) return false;
+  if (nums.every((n) => n <= 1)) return false; // pdf-lib rgb(0..1)
+  const k = `${nums[0]},${nums[1]},${nums[2]}`;
+  return k !== "0,0,0" && k !== "255,255,255";
+}
+function checkCodeColors() {
+  const files = execSync("git ls-files -- editor/src", { encoding: "utf8" })
+    .split("\n")
+    .map((l) => l.trim())
+    .filter(
+      (l) =>
+        /\.(ts|tsx)$/.test(l) && !CODE_EXEMPT_PATH.some((re) => re.test(l)),
+    );
+  const violations = [];
+  for (const rel of files) {
+    const raw = readFileSync(rel, "utf8");
+    const rawLines = raw.split("\n");
+    const text = codeStripNonCode(raw);
+    text.split("\n").forEach((line, i) => {
+      if (/theme-allow-color/.test(rawLines[i] || "")) return;
+      if (CODE_SKIP_LINE.test(line)) return;
+      const hits = [];
+      for (const h of line.match(CODE_HEX) || [])
+        if (!codeStructuralHex(h)) hits.push(h);
+      for (const m of line.match(CODE_RGB) || [])
+        if (codeRgbIsColour(m.replace(/rgba?\(|\)/gi, ""))) hits.push(m);
+      for (const m of line.match(CODE_HSL) || [])
+        if (!/var\(/.test(m)) hits.push(m);
+      for (const h of hits)
+        violations.push({
+          file: rel,
+          line: i + 1,
+          msg: `hardcoded colour ${h} — use a var(--c-*/--p-*) token, or add \`// theme-allow-color <reason>\` if it must be a literal`,
+        });
+    });
+  }
+  return violations;
+}
+
+// ── token-resolution (blocking): every referenced --p-*/--c-* must resolve ────
+// A `var(--p-…)`/`var(--c-…)` with no fallback silently computes to the initial
+// value (transparent/inherited) when the token is undefined, so the colour just
+// disappears — invisible to the literal checks above. Assert every such
+// reference has a definition somewhere (any source .css/.ts/.tsx) or a fallback.
+// Runtime-injected families (--user-*, --mantine-*, --accent-*) are out of scope.
+function checkTokenResolution() {
+  const files = execSync("git ls-files -- editor/src", { encoding: "utf8" })
+    .split("\n")
+    .map((l) => l.trim())
+    .filter((l) => /\.(css|ts|tsx)$/.test(l));
+  const DEF_RE = /(--[a-z0-9-]+)\s*:/gi;
+  // Capture the token and the char that follows it (`,` ⇒ has a fallback).
+  const REF_RE = /var\(\s*(--[a-z0-9-]+)\s*(,|\))/gi;
+  const defined = new Set();
+  const refs = [];
+  const lineOf = (text, index) => text.slice(0, index).split("\n").length;
+  for (const rel of files) {
+    const text = stripComments(readFileSync(rel, "utf8"));
+    for (const m of text.matchAll(DEF_RE)) defined.add(m[1]);
+    for (const m of text.matchAll(REF_RE)) {
+      const [token, next] = [m[1], m[2]];
+      if (!/^--[pc]-/.test(token)) continue; // only our theme tokens
+      if (next === ",") continue; // has a fallback → degrades safely
+      refs.push({ file: rel, line: lineOf(text, m.index), token });
+    }
+  }
+  return refs.filter((r) => !defined.has(r.token));
+}
+
+// ── no-primitives (blocking): components must reference --c-* SEMANTIC tokens,
+// not raw --p-* palette primitives — otherwise a colour-scheme change to the
+// semantic layer won't reach them. --p-* is allowed ONLY in the token-definition
+// layer (primitives/colors/dimensions + legacy vocab files + accents).
+const PRIMITIVE_LAYER = [
+  /^editor\/src\/core\/theme\//,
+  /^editor\/src\/core\/styles\/theme\.css$/,
+  /^editor\/src\/core\/tokens\/tokens\.css$/,
+  /^editor\/src\/saas\/styles\/saas-theme\.css$/,
+  /^editor\/src\/proprietary\/auth\/ui\/auth-theme\.css$/,
+  /^editor\/src\/core\/ui\/accents\.css$/,
+];
+function checkNoPrimitives() {
+  const files = execSync("git ls-files -- editor/src", { encoding: "utf8" })
+    .split("\n")
+    .map((l) => l.trim())
+    .filter(
+      (l) =>
+        /\.(css|scss|ts|tsx)$/.test(l) &&
+        !PRIMITIVE_LAYER.some((re) => re.test(l)),
+    );
+  const REF = /var\(\s*(--p-[a-z0-9-]+)/g;
+  const violations = [];
+  const lineOf = (text, index) => text.slice(0, index).split("\n").length;
+  for (const rel of files) {
+    const text = stripComments(readFileSync(rel, "utf8"));
+    for (const m of text.matchAll(REF))
+      violations.push({ file: rel, line: lineOf(text, m.index), token: m[1] });
+  }
+  return violations;
+}
+
 // ── CLI ──────────────────────────────────────────────────────────────────────
+if (process.argv.includes("no-primitives")) {
+  const v = checkNoPrimitives();
+  if (v.length) {
+    console.error(
+      `\n✖ theme-lint no-primitives: ${v.length} raw --p-* primitive ref(s) in components — use a --c-* semantic token so colour-scheme changes propagate:\n`,
+    );
+    for (const x of v) console.error(`  ${x.file}:${x.line}  var(${x.token})`);
+    console.error("");
+    process.exit(1);
+  }
+  console.log(
+    "✓ theme-lint no-primitives: components reference --c-* semantic tokens (no raw --p-*)",
+  );
+  process.exit(0);
+}
+
 if (process.argv.includes("contrast")) {
   reportContrast();
+  reportToneContrast();
   process.exit(0); // never blocks
 }
 
+if (process.argv.includes("css-colors")) {
+  const v = checkAppCss();
+  if (v.length) {
+    console.error(
+      `\n✖ theme-lint css-colors: ${v.length} hardcoded colour(s) in source CSS:\n`,
+    );
+    for (const x of v) console.error(`  ${x.file}:${x.line}  ${x.msg}`);
+    console.error(
+      `\nDefine every colour once in core/theme/primitives.css and reference it with var(--p-…).\n`,
+    );
+    process.exit(1);
+  }
+  console.log(
+    "✓ theme-lint css-colors: source CSS is free of hardcoded colour",
+  );
+  process.exit(0);
+}
+
+if (process.argv.includes("code-colors")) {
+  const v = checkCodeColors();
+  if (v.length) {
+    console.error(
+      `\n✖ theme-lint code-colors: ${v.length} hardcoded colour(s) in TS/TSX:\n`,
+    );
+    for (const x of v) console.error(`  ${x.file}:${x.line}  ${x.msg}`);
+    console.error("");
+    process.exit(1);
+  }
+  console.log(
+    "✓ theme-lint code-colors: no hardcoded colour in TS/TSX DOM code (rendering/vendor/config areas exempt)",
+  );
+  process.exit(0);
+}
+
 const violations = check();
-if (violations.length) {
+// Block near-invisible status tones (< TONE_INVISIBLE) in either theme.
+const toneViolations = toneContrastResults().filter(
+  (r) => r.ratio != null && r.ratio < TONE_INVISIBLE,
+);
+// Block references to --p-*/--c-* tokens that are defined nowhere (no fallback).
+const unresolvedTokens = checkTokenResolution();
+if (unresolvedTokens.length) {
   console.error(
-    `\n✖ theme-lint: ${violations.length} raw/duplicate colour(s) in core/theme/:\n`,
+    `\n✖ theme-lint: ${unresolvedTokens.length} reference(s) to undefined --p-*/--c-* token(s) (colour silently drops to transparent/inherited):\n`,
   );
-  for (const v of violations) console.error(`  ${v.file}:${v.line}  ${v.msg}`);
+  for (const r of unresolvedTokens)
+    console.error(
+      `  ${r.file}:${r.line}  var(${r.token}) — not defined anywhere`,
+    );
   console.error(
-    `\nDefine every colour once in core/theme/primitives.css and reference it with var(--p-…).\n`,
+    `\nDefine the token (primitive in primitives.css, semantic in colors.css) or give the var() a fallback.\n`,
   );
+}
+if (violations.length || toneViolations.length || unresolvedTokens.length) {
+  if (violations.length) {
+    console.error(
+      `\n✖ theme-lint: ${violations.length} raw/duplicate colour(s) in core/theme/:\n`,
+    );
+    for (const v of violations)
+      console.error(`  ${v.file}:${v.line}  ${v.msg}`);
+    console.error(
+      `\nDefine every colour once in core/theme/primitives.css and reference it with var(--p-…).\n`,
+    );
+  }
+  if (toneViolations.length) {
+    console.error(
+      `\n✖ theme-lint: ${toneViolations.length} status tone(s) below the ${TONE_INVISIBLE}:1 legibility floor (text nearly invisible on its own fill):\n`,
+    );
+    for (const v of toneViolations)
+      console.error(
+        `  ${v.base} on ${v.fill} — ${v.ratio.toFixed(2)}:1 in ${v.theme} theme`,
+      );
+    console.error(
+      `\nGive --color-{hue}-light a paler/darker tint in core/tokens/tokens.css so the label is legible.\n`,
+    );
+  }
   process.exit(1);
 }
 console.log(
-  "✓ theme-lint: core/theme colours all route through the primitive palette",
+  "✓ theme-lint: core/theme colours route through the primitive palette; status tones clear the legibility floor",
 );
diff --git a/frontend/editor/src/cloud/components/onboarding/slides/SaasOnboardingSlides.module.css b/frontend/editor/src/cloud/components/onboarding/slides/SaasOnboardingSlides.module.css
index 3fcdb93831..a02d7c4ce9 100644
--- a/frontend/editor/src/cloud/components/onboarding/slides/SaasOnboardingSlides.module.css
+++ b/frontend/editor/src/cloud/components/onboarding/slides/SaasOnboardingSlides.module.css
@@ -8,7 +8,7 @@
 }
 
 .freeHighlight {
-  background: linear-gradient(135deg, #6366f1, #ec4899);
+  background: linear-gradient(135deg, var(--c-hue-indigo), var(--c-hue-pink));
   -webkit-background-clip: text;
   background-clip: text;
   color: transparent;
@@ -36,7 +36,7 @@
   flex-direction: column;
   max-height: 200px;
   overflow-y: auto;
-  border: 1px solid var(--border-default, #d1d5db);
+  border: 1px solid var(--c-border);
   border-radius: 12px;
   margin-bottom: 12px;
 }
@@ -49,7 +49,7 @@
 }
 
 .memberRow + .memberRow {
-  border-top: 1px solid var(--border-subtle, #e5e7eb);
+  border-top: 1px solid var(--c-border-subtle);
 }
 
 .memberIdentity {
@@ -62,7 +62,7 @@
 .memberName {
   font-size: 14px;
   font-weight: 600;
-  color: var(--onboarding-title, #111827);
+  color: var(--c-text);
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
@@ -70,7 +70,7 @@
 
 .memberEmail {
   font-size: 12px;
-  color: var(--onboarding-body, #6b7280);
+  color: var(--c-text-muted);
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
diff --git a/frontend/editor/src/cloud/components/shared/FreeLimitReachedModal.tsx b/frontend/editor/src/cloud/components/shared/FreeLimitReachedModal.tsx
index 177a15b7af..118b0a2d91 100644
--- a/frontend/editor/src/cloud/components/shared/FreeLimitReachedModal.tsx
+++ b/frontend/editor/src/cloud/components/shared/FreeLimitReachedModal.tsx
@@ -87,7 +87,7 @@ export function FreeLimitReachedModal({ onClose }: FreeLimitReachedModalProps) {
         content: {
           overflow: "hidden",
           border: "none",
-          background: "var(--bg-surface)",
+          background: "var(--c-surface)",
           maxHeight: "90vh",
           display: "flex",
           flexDirection: "column",
diff --git a/frontend/editor/src/cloud/components/shared/SpendCapReachedModal.tsx b/frontend/editor/src/cloud/components/shared/SpendCapReachedModal.tsx
index 91f4ec6e95..405bbe2ef2 100644
--- a/frontend/editor/src/cloud/components/shared/SpendCapReachedModal.tsx
+++ b/frontend/editor/src/cloud/components/shared/SpendCapReachedModal.tsx
@@ -87,7 +87,7 @@ export function SpendCapReachedModal({ onClose }: SpendCapReachedModalProps) {
         content: {
           overflow: "hidden",
           border: "none",
-          background: "var(--bg-surface)",
+          background: "var(--c-surface)",
           maxHeight: "90vh",
           display: "flex",
           flexDirection: "column",
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/Payg.css b/frontend/editor/src/cloud/components/shared/config/configSections/Payg.css
index cf9378ac9e..581f3af671 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/Payg.css
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/Payg.css
@@ -2,25 +2,22 @@
    Uses the app's semantic theme tokens (theme.css) so it tracks light/dark. */
 
 .payg {
-  --payg-accent: #0a8bff;
-  --payg-accent-soft: rgba(10, 139, 255, 0.1);
+  --payg-accent: var(--c-primary);
+  --payg-accent-soft: color-mix(in srgb, var(--c-primary) 10%, transparent);
   --payg-radius: 14px;
   --payg-gap: 20px;
   /* Cards sit ON the modal content bg; in light that's white-on-white so we
      lean on border + shadow. Tokens are overridden per scheme below. */
-  --payg-card-bg: var(--bg-surface);
-  --payg-card-border: var(--border-default);
-  --payg-inset-bg: var(--bg-raised);
-  --payg-divider: var(--border-subtle);
+  --payg-card-bg: var(--c-surface);
+  --payg-card-border: var(--c-border);
+  --payg-inset-bg: var(--c-surface-raised);
+  --payg-divider: var(--c-border-subtle);
 }
 
-/* Dark mode: modal content bg is #131729 (--bg-surface), so lift cards above it */
+/* Dark mode: surfaces/borders track the neutral --c-* tokens (set on the base
+   rule); only the brand-azure accent tint is tuned brighter for dark. */
 [data-mantine-color-scheme="dark"] .payg {
-  --payg-card-bg: #1c2340;
-  --payg-card-border: #2d3560;
-  --payg-inset-bg: #0d1020;
-  --payg-accent-soft: rgba(79, 142, 245, 0.16);
-  --payg-divider: #2d3560;
+  --payg-accent-soft: color-mix(in srgb, var(--c-primary) 16%, transparent);
 }
 
 /* ── Header ─────────────────────────────────────────────────────────── */
@@ -29,12 +26,12 @@
   font-size: 1.35rem;
   font-weight: 700;
   letter-spacing: -0.01em;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 .payg-header__subtitle {
   margin-top: 4px;
   font-size: 0.875rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 .payg-role-pill {
   display: inline-flex;
@@ -49,12 +46,12 @@
 .payg-role-pill[data-leader="true"] {
   background: var(--payg-accent-soft);
   color: var(--payg-accent);
-  border: 1px solid rgba(10, 139, 255, 0.25);
+  border: 1px solid color-mix(in srgb, var(--c-primary) 25%, transparent);
 }
 .payg-role-pill[data-leader="false"] {
-  background: var(--bg-muted);
-  color: var(--text-muted);
-  border: 1px solid var(--border-default);
+  background: var(--c-surface-sunken);
+  color: var(--c-text-subtle);
+  border: 1px solid var(--c-border);
 }
 
 /* ── Plan header: free-vs-metered split (shared by free + subscribed) ──── */
@@ -73,7 +70,7 @@
 }
 .payg-planhead__eyebrow {
   font-size: 0.78rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 .payg-planhead__split {
   display: grid;
@@ -98,7 +95,7 @@
   margin-bottom: 8px;
 }
 .payg-planhead__lbl--free {
-  color: #10b981;
+  color: var(--c-success);
 }
 .payg-planhead__lbl--meter {
   color: var(--payg-accent);
@@ -110,14 +107,14 @@
   margin: 0;
   font-size: 1.05rem;
   font-weight: 700;
-  color: var(--text-primary);
+  color: var(--c-text);
   letter-spacing: -0.01em;
   line-height: 1.25;
 }
 .payg-planhead__body {
   margin: 5px 0 0;
   font-size: 0.85rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   line-height: 1.5;
 }
 @media (max-width: 640px) {
@@ -147,11 +144,11 @@
 .payg-card__title {
   font-size: 0.95rem;
   font-weight: 650;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 .payg-card__subtitle {
   font-size: 0.8125rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin-top: 2px;
 }
 
@@ -175,22 +172,22 @@
 .payg-hero[data-state="FULL"]::before {
   background: linear-gradient(
     135deg,
-    rgba(10, 139, 255, 0.12) 0%,
-    rgba(10, 139, 255, 0) 55%
+    color-mix(in srgb, var(--c-primary) 12%, transparent) 0%,
+    color-mix(in srgb, var(--c-primary) 0%, transparent) 55%
   );
 }
 .payg-hero[data-state="WARNED"]::before {
   background: linear-gradient(
     135deg,
-    rgba(234, 179, 8, 0.16) 0%,
-    rgba(234, 179, 8, 0) 55%
+    color-mix(in srgb, var(--c-warning) 16%, transparent) 0%,
+    color-mix(in srgb, var(--c-warning) 0%, transparent) 55%
   );
 }
 .payg-hero[data-state="DEGRADED"]::before {
   background: linear-gradient(
     135deg,
-    rgba(239, 68, 68, 0.16) 0%,
-    rgba(239, 68, 68, 0) 55%
+    color-mix(in srgb, var(--c-danger) 16%, transparent) 0%,
+    color-mix(in srgb, var(--c-danger) 0%, transparent) 55%
   );
 }
 .payg-hero__inner {
@@ -202,7 +199,7 @@
   font-weight: 700;
   letter-spacing: 0.08em;
   text-transform: uppercase;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 .payg-hero__figure {
   display: flex;
@@ -215,12 +212,12 @@
   font-weight: 750;
   line-height: 1;
   letter-spacing: -0.03em;
-  color: var(--text-primary);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 .payg-hero__cap {
   font-size: 1rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-variant-numeric: tabular-nums;
 }
 .payg-hero__meta {
@@ -229,10 +226,10 @@
   flex-wrap: wrap;
   gap: 6px 18px;
   font-size: 0.8125rem;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
 }
 .payg-hero__meta-dot {
-  color: var(--border-strong);
+  color: var(--c-border-strong);
 }
 .payg-hero__credit {
   display: inline-flex;
@@ -242,11 +239,11 @@
   font-size: 0.75rem;
   font-weight: 600;
   color: var(--color-green-700);
-  background: rgba(34, 197, 94, 0.14);
+  background: color-mix(in srgb, var(--c-success) 14%, transparent);
 }
 [data-mantine-color-scheme="dark"] .payg-hero__credit {
-  color: #4ade80;
-  background: rgba(34, 197, 94, 0.18);
+  color: var(--c-success);
+  background: color-mix(in srgb, var(--c-success) 18%, transparent);
 }
 
 /* Make Mantine default-variant buttons read clearly on the lifted cards in
@@ -257,16 +254,24 @@
 
 /* Dark mode: the stock default button is a flat slab that disappears into the
    card. Lift it with a soft top-down gradient + brighter border, and warm the
-   hover so the buttons feel tactile against --payg-card-bg (#1c2340). Driven
-   through Mantine's --button-* vars. The same rule covers disabled buttons
+   hover so the buttons feel tactile against the card surface. Driven through
+   Mantine's --button-* vars. The same rule covers disabled buttons
    (Cancel/Update cap before the form is dirty) so they read identically to the
    always-enabled ones — Mantine only fades them via opacity. */
 [data-mantine-color-scheme="dark"]
   .payg
   .mantine-Button-root[data-variant="default"] {
-  --button-bg: linear-gradient(180deg, #232a50 0%, #1c2340 100%);
-  --button-hover: linear-gradient(180deg, #2d3560 0%, #232a50 100%);
-  --button-bd: 1px solid #2d3560;
+  --button-bg: linear-gradient(
+    180deg,
+    var(--c-surface-raised) 0%,
+    var(--c-surface) 100%
+  );
+  --button-hover: linear-gradient(
+    180deg,
+    var(--c-border) 0%,
+    var(--c-surface-raised) 100%
+  );
+  --button-bd: 1px solid var(--c-border);
   --button-color: var(--mantine-color-white);
   box-shadow:
     0 1px 0 rgba(255, 255, 255, 0.04) inset,
@@ -307,7 +312,7 @@
 }
 .payg-status[data-state="FULL"] .payg-status__dot {
   background: var(--color-green-500);
-  box-shadow: 0 0 0 3px rgba(34, 197, 94, 0.18);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--c-success) 18%, transparent);
 }
 .payg-status[data-state="WARNED"] {
   background: var(--color-yellow-100);
@@ -315,7 +320,7 @@
 }
 .payg-status[data-state="WARNED"] .payg-status__dot {
   background: var(--color-yellow-500);
-  box-shadow: 0 0 0 3px rgba(234, 179, 8, 0.2);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--c-warning) 20%, transparent);
 }
 .payg-status[data-state="DEGRADED"] {
   background: var(--color-red-100);
@@ -323,7 +328,7 @@
 }
 .payg-status[data-state="DEGRADED"] .payg-status__dot {
   background: var(--color-red-500);
-  box-shadow: 0 0 0 3px rgba(239, 68, 68, 0.2);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--c-danger) 20%, transparent);
 }
 
 /* Segmented usage bar */
@@ -331,7 +336,7 @@
   margin-top: 18px;
   height: 10px;
   border-radius: 999px;
-  background: var(--bg-muted);
+  background: var(--c-surface-sunken);
   overflow: hidden;
   position: relative;
 }
@@ -341,13 +346,13 @@
   transition: width 0.5s cubic-bezier(0.16, 1, 0.3, 1);
 }
 .payg-bar__fill[data-state="FULL"] {
-  background: linear-gradient(90deg, #0a8bff, #38bdf8);
+  background: var(--c-primary);
 }
 .payg-bar__fill[data-state="WARNED"] {
-  background: linear-gradient(90deg, #f59e0b, #fbbf24);
+  background: var(--c-warning);
 }
 .payg-bar__fill[data-state="DEGRADED"] {
-  background: linear-gradient(90deg, #dc2626, #f87171);
+  background: var(--c-danger);
 }
 
 /* ── "What counts as a document?" expandable help ───────────────────── */
@@ -365,10 +370,10 @@
   font: inherit;
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
 }
 .payg-help__toggle:hover {
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 .payg-help__chevron {
   transition: transform 0.15s ease;
@@ -381,10 +386,10 @@
   padding: 12px 14px;
   border-radius: 10px;
   border: 1px solid var(--payg-card-border);
-  background: var(--bg-muted);
+  background: var(--c-surface-sunken);
   font-size: 0.8125rem;
   line-height: 1.45;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
 }
 .payg-help__panel ul {
   margin: 0;
@@ -401,7 +406,7 @@
   padding: 13px 16px;
   border-radius: 10px;
   background: var(--payg-accent-soft);
-  border: 1px solid rgba(10, 139, 255, 0.2);
+  border: 1px solid color-mix(in srgb, var(--c-primary) 20%, transparent);
 }
 .payg-preview__icon {
   color: var(--payg-accent);
@@ -409,12 +414,12 @@
 }
 .payg-preview__main {
   font-size: 0.875rem;
-  color: var(--text-primary);
+  color: var(--c-text);
   font-weight: 550;
 }
 .payg-preview__note {
   font-size: 0.75rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin-top: 1px;
 }
 
@@ -453,17 +458,17 @@
   flex-shrink: 0;
 }
 .payg-gate[data-enabled="true"] .payg-gate__chip {
-  background: rgba(34, 197, 94, 0.16);
-  color: #22c55e;
+  background: color-mix(in srgb, var(--c-success) 16%, transparent);
+  color: var(--c-success);
 }
 .payg-gate[data-enabled="false"] .payg-gate__chip {
-  background: rgba(239, 68, 68, 0.16);
-  color: #f87171;
+  background: color-mix(in srgb, var(--c-danger) 16%, transparent);
+  color: var(--c-danger);
 }
 .payg-gate__label {
   font-size: 0.8125rem;
   line-height: 1.35;
-  color: var(--text-primary);
+  color: var(--c-text);
   flex: 1;
 }
 .payg-gate__tag {
@@ -477,16 +482,16 @@
   white-space: nowrap;
 }
 .payg-gate__tag[data-variant="on"] {
-  color: var(--text-muted);
-  background: var(--bg-muted);
+  color: var(--c-text-subtle);
+  background: var(--c-surface-sunken);
 }
 .payg-gate__tag[data-variant="pause"] {
-  color: #dc2626;
-  background: rgba(239, 68, 68, 0.12);
+  color: var(--c-danger);
+  background: color-mix(in srgb, var(--c-danger) 12%, transparent);
 }
 [data-mantine-color-scheme="dark"] .payg-gate__tag[data-variant="pause"] {
-  color: #f87171;
-  background: rgba(239, 68, 68, 0.18);
+  color: var(--c-danger);
+  background: color-mix(in srgb, var(--c-danger) 18%, transparent);
 }
 
 /* ── Member rows ────────────────────────────────────────────────────── */
@@ -509,17 +514,17 @@
   justify-content: center;
   font-size: 0.8125rem;
   font-weight: 650;
-  color: #fff;
+  color: var(--c-text-on-primary);
   flex-shrink: 0;
 }
 .payg-member__name {
   font-size: 0.875rem;
   font-weight: 550;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 .payg-member__email {
   font-size: 0.75rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 .payg-member__usage {
   text-align: right;
@@ -527,7 +532,7 @@
 }
 .payg-member__usage-num {
   font-size: 0.8125rem;
-  color: var(--text-primary);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 .payg-member__minibar {
@@ -570,27 +575,27 @@
 }
 .payg-activity__label {
   font-size: 0.8438rem;
-  color: var(--text-primary);
+  color: var(--c-text);
   flex: 1;
 }
 .payg-activity__ts {
   font-size: 0.75rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 .payg-activity__kind {
   font-size: 0.625rem;
   font-weight: 700;
   letter-spacing: 0.05em;
   text-transform: uppercase;
-  color: var(--text-muted);
-  background: var(--bg-muted);
+  color: var(--c-text-subtle);
+  background: var(--c-surface-sunken);
   padding: 2px 8px;
   border-radius: 999px;
 }
 .payg-activity__units {
   font-size: 0.8125rem;
   font-weight: 650;
-  color: var(--text-primary);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
   min-width: 58px;
   text-align: right;
@@ -604,20 +609,20 @@
   gap: 16px;
   padding: 20px 24px;
   border-radius: var(--payg-radius);
-  border: 1px solid rgba(99, 91, 255, 0.28);
+  border: 1px solid color-mix(in srgb, var(--c-accent-stripe) 28%, transparent);
   background: linear-gradient(
     135deg,
-    rgba(99, 91, 255, 0.1) 0%,
-    rgba(99, 91, 255, 0.02) 100%
+    color-mix(in srgb, var(--c-accent-stripe) 10%, transparent) 0%,
+    color-mix(in srgb, var(--c-accent-stripe) 2%, transparent) 100%
   );
 }
 .payg-stripe__title {
   font-size: 0.9375rem;
   font-weight: 650;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 .payg-stripe__subtitle {
   font-size: 0.8125rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin-top: 2px;
 }
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx
index 8cf61f2385..53f4b98486 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx
@@ -60,12 +60,12 @@ interface PaygProps {
 
 // Stable-ish avatar colour from a string.
 const AVATAR_COLORS = [
-  "#0a8bff",
-  "#8b5cf6",
-  "#ec4899",
-  "#10b981",
-  "#f59e0b",
-  "#06b6d4",
+  "var(--c-avatar-1)",
+  "var(--c-avatar-2)",
+  "var(--c-avatar-3)",
+  "var(--c-avatar-4)",
+  "var(--c-avatar-5)",
+  "var(--c-avatar-6)",
 ];
 function avatarColor(seed: string): string {
   let h = 0;
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.css b/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.css
index 6ade6c7b6d..9e89fa38eb 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.css
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/PaygFree.css
@@ -70,11 +70,11 @@
   gap: 8px;
   font-size: 0.8rem;
   line-height: 1.45;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 .paygf-proc__membernote-icon {
   flex-shrink: 0;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-size: 1.1rem !important;
   margin-top: 1px;
 }
@@ -113,12 +113,12 @@
   font-weight: 750;
   line-height: 1;
   letter-spacing: -0.02em;
-  color: var(--text-primary);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 .paygf-meter__cap {
   font-size: 0.85rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-variant-numeric: tabular-nums;
 }
 .paygf-meter .payg-bar {
@@ -131,7 +131,7 @@
   align-items: center;
   gap: 6px 10px;
   font-size: 0.78rem;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
 }
 
 /* ── Leader CTA card ──────────────────────────────────────────────────── */
@@ -145,8 +145,10 @@
   border: 1.5px solid transparent;
   background:
     linear-gradient(var(--payg-card-bg), var(--payg-card-bg)) padding-box,
-    linear-gradient(135deg, var(--payg-accent) 0%, #6c5ce7 100%) border-box;
-  box-shadow: 0 10px 28px -18px rgba(10, 139, 255, 0.4);
+    linear-gradient(135deg, var(--payg-accent) 0%, var(--c-hue-purple) 100%)
+      border-box;
+  box-shadow: 0 10px 28px -18px
+    color-mix(in srgb, var(--c-primary) 40%, transparent);
   display: flex;
   flex-direction: column;
   gap: 16px;
@@ -161,8 +163,12 @@
   flex-shrink: 0;
   padding: 10px;
   border-radius: 12px;
-  background: linear-gradient(135deg, var(--payg-accent) 0%, #6c5ce7 100%);
-  color: white !important;
+  background: linear-gradient(
+    135deg,
+    var(--payg-accent) 0%,
+    var(--c-hue-purple) 100%
+  );
+  color: var(--c-text-on-primary) !important;
   font-size: 1.7rem !important;
 }
 .paygf-cta__heading-text {
@@ -172,14 +178,14 @@
   margin: 0;
   font-size: 1.2rem;
   font-weight: 700;
-  color: var(--text-primary);
+  color: var(--c-text);
   letter-spacing: -0.01em;
   line-height: 1.25;
 }
 .paygf-cta__subtitle {
   margin: 4px 0 0;
   font-size: 0.9rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   line-height: 1.5;
 }
 
@@ -196,7 +202,7 @@
   align-items: flex-start;
   gap: 8px;
   font-size: 0.85rem;
-  color: var(--text-primary);
+  color: var(--c-text);
   line-height: 1.45;
 }
 .paygf-cta__check {
@@ -220,7 +226,7 @@
 .paygf-cta__reassurance {
   margin: 0;
   font-size: 0.78rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   text-align: right;
 }
 
@@ -237,7 +243,7 @@
 }
 .paygf-member-note__icon {
   flex-shrink: 0;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   padding: 8px;
   background: var(--payg-card-bg);
   border-radius: 10px;
@@ -247,14 +253,14 @@
   margin: 0;
   font-size: 1rem;
   font-weight: 700;
-  color: var(--text-primary);
+  color: var(--c-text);
   letter-spacing: -0.005em;
   line-height: 1.3;
 }
 .paygf-member-note__body {
   margin: 6px 0 0;
   font-size: 0.875rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   line-height: 1.5;
 }
 
@@ -285,14 +291,14 @@
   font-weight: 700;
   letter-spacing: 0.06em;
   text-transform: uppercase;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin-bottom: 10px;
 }
 .paygf-explainer__icon {
   font-size: 1rem !important;
 }
 .paygf-explainer__icon--free {
-  color: #10b981;
+  color: var(--c-success);
 }
 .paygf-explainer__icon--paid {
   color: var(--payg-accent);
@@ -300,6 +306,6 @@
 .paygf-explainer__text {
   margin: 0;
   font-size: 0.85rem;
-  color: var(--text-primary);
+  color: var(--c-text);
   line-height: 1.55;
 }
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.css b/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.css
index bc9ce0cef8..d0ed711434 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.css
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.css
@@ -9,12 +9,12 @@
    Payg.css / UpgradeModal.css treatments the control sits beside. */
 
 .scc {
-  --scc-accent: #0a8bff;
-  --scc-accent-text: #0a8bff;
-  --scc-accent-soft: rgba(10, 139, 255, 0.12);
-  --scc-accent-border: rgba(10, 139, 255, 0.25);
-  --scc-chip-bg: var(--bg-muted);
-  --scc-chip-border: var(--border-default);
+  --scc-accent: var(--c-primary);
+  --scc-accent-text: var(--c-primary);
+  --scc-accent-soft: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  --scc-accent-border: color-mix(in srgb, var(--c-primary) 25%, transparent);
+  --scc-chip-bg: var(--c-surface-sunken);
+  --scc-chip-border: var(--c-border);
   /* Consistent vertical rhythm between the control row, the estimate, and any
      note — without it the blocks sit flush. */
   display: flex;
@@ -22,10 +22,10 @@
   gap: 14px;
 }
 [data-mantine-color-scheme="dark"] .scc {
-  --scc-accent-text: #7ab4ff;
-  --scc-accent-soft: rgba(79, 142, 245, 0.16);
-  --scc-chip-bg: #1c2340;
-  --scc-chip-border: #2d3560;
+  /* Chip surface/border track the neutral --c-* tokens (base rule); only the
+     brand-azure accent is tuned brighter for dark. */
+  --scc-accent-text: var(--c-primary);
+  --scc-accent-soft: color-mix(in srgb, var(--c-primary) 16%, transparent);
 }
 
 /* ── Inline row: presets · custom · no-cap · (save) ──────────────────── */
@@ -47,7 +47,7 @@
   border-radius: 999px;
   border: 1px solid var(--scc-chip-border);
   background: var(--scc-chip-bg);
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   font: inherit;
   font-size: 0.85rem;
   font-weight: 600;
@@ -59,8 +59,8 @@
     background 0.12s ease;
 }
 .scc-chip:hover:not(:disabled) {
-  color: var(--text-primary);
-  border-color: var(--border-strong);
+  color: var(--c-text);
+  border-color: var(--c-border-strong);
 }
 .scc-chip[data-selected="true"] {
   background: var(--scc-accent-soft);
@@ -90,7 +90,7 @@
     background 0.12s ease;
 }
 .scc-custom:hover {
-  border-color: var(--border-strong);
+  border-color: var(--c-border-strong);
 }
 .scc-custom[data-active="true"] {
   border-style: solid;
@@ -98,7 +98,7 @@
   background: var(--scc-accent-soft);
 }
 .scc-custom__symbol {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-size: 0.85rem;
   font-weight: 600;
 }
@@ -111,14 +111,14 @@
   border: none;
   outline: none;
   background: transparent;
-  color: var(--text-primary);
+  color: var(--c-text);
   font: inherit;
   font-size: 0.85rem;
   font-weight: 600;
   font-variant-numeric: tabular-nums;
 }
 .scc-custom__input::placeholder {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-weight: 600;
 }
 .scc-custom:disabled,
@@ -148,17 +148,17 @@
 .scc-estimate__main {
   font-size: 0.875rem;
   font-weight: 550;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 .scc-estimate__sub {
   font-size: 0.75rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin-top: 1px;
 }
 
 /* Quiet helper line (e.g. "Shown in USD — change later in your currency"). */
 .scc-note {
   font-size: 0.8125rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   line-height: 1.45;
 }
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/TeamSection.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/TeamSection.tsx
index 44fc59c738..4eb064d8bf 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/TeamSection.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/TeamSection.tsx
@@ -11,6 +11,7 @@ import {
 } from "@mantine/core";
 import { Button } from "@app/ui/Button";
 import { ActionIcon } from "@app/ui/ActionIcon";
+import { StatusBadge } from "@app/ui/StatusBadge";
 import { useTranslation } from "react-i18next";
 import { useSaaSTeam } from "@app/contexts/SaaSTeamContext";
 import LocalIcon from "@app/components/shared/LocalIcon";
@@ -265,12 +266,14 @@ const TeamSection: React.FC = () => {
                   </ActionIcon>
                 )}
                 {isTeamLeader && (
-                  <Badge color="blue">{t("team.leader", "LEADER")}</Badge>
+                  <StatusBadge tone="info" showDot={false}>
+                    {t("team.leader", "LEADER")}
+                  </StatusBadge>
                 )}
                 {isPersonalTeam && (
-                  <Badge color="gray" variant="light" size="xs">
+                  <StatusBadge tone="neutral" showDot={false}>
                     {t("team.personal", "Personal")}
-                  </Badge>
+                  </StatusBadge>
                 )}
               </Group>
             )}
@@ -430,8 +433,8 @@ const TeamSection: React.FC = () => {
                         style={
                           member.role !== "LEADER"
                             ? {
-                                backgroundColor: "var(--tool-header-badge-bg)",
-                                color: "var(--tool-header-badge-text)",
+                                backgroundColor: "var(--c-surface-raised)",
+                                color: "var(--c-accent-fg)",
                               }
                             : undefined
                         }
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css b/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css
index c6da318f0f..46df9ddee4 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css
@@ -5,22 +5,21 @@
    user feels like they're filling out one form, not navigating pages. */
 
 .upm {
-  --upm-accent: #0a8bff;
-  --upm-accent-2: #6c5ce7;
-  --upm-accent-soft: rgba(10, 139, 255, 0.08);
-  --upm-success: #10b981;
+  --upm-accent: var(--c-primary);
+  --upm-accent-2: var(--c-hue-purple);
+  --upm-accent-soft: color-mix(in srgb, var(--c-primary) 8%, transparent);
+  --upm-success: var(--c-success);
   --upm-radius: 18px;
-  --upm-card-bg: var(--bg-surface);
-  --upm-border: var(--border-default);
-  --upm-divider: var(--border-subtle);
-  --upm-text: var(--text-primary);
-  --upm-muted: var(--text-muted);
+  --upm-card-bg: var(--c-surface);
+  --upm-border: var(--c-border);
+  --upm-divider: var(--c-border-subtle);
+  --upm-text: var(--c-text);
+  --upm-muted: var(--c-text-subtle);
 }
 [data-mantine-color-scheme="dark"] .upm {
-  --upm-card-bg: #1c2340;
-  --upm-border: #2d3560;
-  --upm-divider: #2d3560;
-  --upm-accent-soft: rgba(79, 142, 245, 0.14);
+  /* Card/border/divider track the neutral --c-* tokens (base rule); only the
+     brand-azure accent tint is tuned for dark. */
+  --upm-accent-soft: color-mix(in srgb, var(--c-primary) 14%, transparent);
 }
 
 /* Backdrop locks the page and centres the modal. z-index matches
@@ -150,7 +149,7 @@
 .upm-step[data-state="active"] .upm-step__dot {
   background: linear-gradient(135deg, var(--upm-accent), var(--upm-accent-2));
   border-color: transparent;
-  color: white;
+  color: var(--c-text-on-primary);
 }
 .upm-step[data-state="done"] {
   color: var(--upm-success);
@@ -158,7 +157,7 @@
 .upm-step[data-state="done"] .upm-step__dot {
   background: var(--upm-success);
   border-color: transparent;
-  color: white;
+  color: var(--c-text-on-primary);
 }
 .upm-step__connector {
   flex: 1 1 auto;
@@ -254,7 +253,7 @@
   border-radius: 6px;
 }
 .upm-step__edit:hover {
-  background: rgba(10, 139, 255, 0.12);
+  background: color-mix(in srgb, var(--c-primary) 12%, transparent);
 }
 
 /* Placeholder card for the loading / error / mock states — a dashed, centered
@@ -327,8 +326,10 @@
 }
 .upm-confirm__icon {
   font-size: 64px !important;
-  color: #10b981;
-  filter: drop-shadow(0 6px 18px rgba(16, 185, 129, 0.35));
+  color: var(--upm-success);
+  filter: drop-shadow(
+    0 6px 18px color-mix(in srgb, var(--c-success) 35%, transparent)
+  );
 }
 .upm-confirm__title {
   margin: 6px 0 0;
diff --git a/frontend/editor/src/core/assets/Brand.stories.tsx b/frontend/editor/src/core/assets/Brand.stories.tsx
index 886e7a023d..ac144c88b1 100644
--- a/frontend/editor/src/core/assets/Brand.stories.tsx
+++ b/frontend/editor/src/core/assets/Brand.stories.tsx
@@ -61,7 +61,9 @@ function Swatch({ label, src, onDark, h }: Asset & { h: number }) {
       >
         <img src={src} alt={label} style={{ height: h, maxWidth: 200 }} />
       </div>
-      <figcaption style={{ fontSize: 12, color: "var(--text-muted, #71717a)" }}>
+      <figcaption
+        style={{ fontSize: 12, color: "var(--c-text-subtle, #71717a)" }}
+      >
         {label}
       </figcaption>
     </figure>
diff --git a/frontend/editor/src/core/components/FileManager.tsx b/frontend/editor/src/core/components/FileManager.tsx
index d05d05ea2b..6361d9d4a8 100644
--- a/frontend/editor/src/core/components/FileManager.tsx
+++ b/frontend/editor/src/core/components/FileManager.tsx
@@ -221,7 +221,7 @@ const FileManager: React.FC<FileManagerProps> = ({ selectedTool }) => {
             width: "100%",
             border: "none",
             borderRadius: "var(--radius-md)",
-            backgroundColor: "var(--bg-file-manager)",
+            backgroundColor: "var(--c-bg)",
           }}
           styles={{
             inner: { pointerEvents: "all" },
diff --git a/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.tsx b/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.tsx
index 60905d3065..2760e9281c 100644
--- a/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.tsx
+++ b/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.tsx
@@ -227,7 +227,7 @@ export const TextInputWithFont: React.FC<TextInputWithFontProps> = ({
                     width: 24,
                     height: 24,
                     backgroundColor: textColor,
-                    border: "1px solid #ccc",
+                    border: "1px solid var(--c-border)",
                     borderRadius: 4,
                     cursor: disabled ? "default" : "pointer",
                   }}
diff --git a/frontend/editor/src/core/components/fileEditor/AddFileCard.tsx b/frontend/editor/src/core/components/fileEditor/AddFileCard.tsx
index bf19c16967..5491138e6b 100644
--- a/frontend/editor/src/core/components/fileEditor/AddFileCard.tsx
+++ b/frontend/editor/src/core/components/fileEditor/AddFileCard.tsx
@@ -110,7 +110,7 @@ const AddFileCard = ({
                 variant="tertiary"
                 style={{
                   backgroundColor: "var(--landing-button-bg)",
-                  color: "var(--landing-button-color)",
+                  color: "var(--c-accent-fg)",
                   border: "1px solid var(--landing-button-border)",
                   borderRadius: "2rem",
                   height: "38px",
@@ -129,7 +129,7 @@ const AddFileCard = ({
                   icon="add"
                   width="1.5rem"
                   height="1.5rem"
-                  className="text-[var(--accent-interactive)]"
+                  className="text-[var(--c-primary)]"
                 />
                 <span>{t("landing.addFiles", "Add Files")}</span>
               </Button>
@@ -140,7 +140,7 @@ const AddFileCard = ({
               title={terminology.uploadFromComputer}
               style={{
                 backgroundColor: "var(--landing-button-bg)",
-                color: "var(--landing-button-color)",
+                color: "var(--c-accent-fg)",
                 border: "1px solid var(--landing-button-border)",
                 borderRadius: "1rem",
                 height: "38px",
@@ -161,7 +161,7 @@ const AddFileCard = ({
                 icon={icons.uploadIconName}
                 width="1.25rem"
                 height="1.25rem"
-                style={{ color: "var(--accent-interactive)", flexShrink: 0 }}
+                style={{ color: "var(--c-primary)", flexShrink: 0 }}
               />
               {isUploadHover && (
                 <span
@@ -181,7 +181,7 @@ const AddFileCard = ({
 
           {/* Instruction Text */}
           <span
-            className="text-[var(--accent-interactive)]"
+            className="text-[var(--c-primary)]"
             style={{
               fontSize: ".8rem",
               textAlign: "center",
diff --git a/frontend/editor/src/core/components/fileEditor/FileEditor.module.css b/frontend/editor/src/core/components/fileEditor/FileEditor.module.css
index 037eddf742..aa89d250e1 100644
--- a/frontend/editor/src/core/components/fileEditor/FileEditor.module.css
+++ b/frontend/editor/src/core/components/fileEditor/FileEditor.module.css
@@ -3,7 +3,7 @@
    ========================= */
 
 .card {
-  background: var(--file-card-bg);
+  background: var(--c-surface-raised);
   border-radius: 0.0625rem;
   cursor: pointer;
   transition:
@@ -28,7 +28,7 @@
 /* While dragging */
 .card.dragging,
 .card:global(.dragging) {
-  outline: 1px solid var(--border-strong);
+  outline: 1px solid var(--c-border-strong);
   box-shadow: var(--shadow-md);
   transform: none !important;
 }
@@ -42,15 +42,17 @@
   justify-content: space-between;
   padding: 0 6px;
   user-select: none;
-  background: var(--bg-toolbar);
-  color: var(--text-primary);
-  border-bottom: 1px solid var(--border-default);
+  background: var(--c-bg-raised);
+  color: var(--c-text);
+  border-bottom: 1px solid var(--c-border);
 }
 
 .headerResting {
-  background: #3b4b6e; /* dark blue for unselected in light mode */
-  color: #ffffff;
-  border-bottom: 1px solid var(--border-default);
+  background: var(
+    --c-file-header-resting
+  ); /* branded navy for unselected files */
+  color: var(--c-text-on-primary);
+  border-bottom: 1px solid var(--c-border);
 }
 
 .headerSelected {
@@ -62,20 +64,20 @@
 /* Error highlight (transient) */
 .headerError {
   background: var(--color-red-200);
-  color: var(--text-primary);
+  color: var(--c-text);
   border-bottom: 2px solid var(--color-red-500);
 }
 
 /* Unsupported (but not errored) header appearance */
 .headerUnsupported {
-  background: var(--unsupported-bar-bg); /* neutral gray */
-  color: #ffffff;
-  border-bottom: 1px solid var(--unsupported-bar-border);
+  background: var(--c-bg-raised); /* neutral gray */
+  color: var(--c-text-on-primary);
+  border-bottom: 1px solid var(--c-border);
 }
 
 /* Selected border color in light mode */
 :global([data-mantine-color-scheme="light"]) .card[data-selected="true"] {
-  outline-color: var(--card-selected-border);
+  outline-color: var(--c-primary);
 }
 
 /* Reserve space for checkbox instead of logo */
@@ -106,7 +108,7 @@
 }
 
 .headerIconButton {
-  color: #ffffff !important;
+  color: var(--c-text-on-primary) !important;
 }
 
 /* Menu dropdown */
@@ -117,12 +119,12 @@
 /* -------- Title / Meta -------- */
 .title {
   line-height: 1.2;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 .meta {
   margin-top: 2px;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
 }
 
 /* -------- Preview area -------- */
@@ -131,7 +133,7 @@
   width: 100%;
   height: 100%;
   overflow: hidden;
-  background: var(--file-card-bg);
+  background: var(--c-surface-raised);
 }
 
 .previewPaper {
@@ -142,7 +144,7 @@
   display: grid;
   position: relative;
   overflow: hidden;
-  background: var(--file-card-bg);
+  background: var(--c-surface-raised);
 }
 
 /* Thumbnail fallback */
@@ -152,7 +154,7 @@
   inset: 0;
   display: grid;
   place-items: center;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   font-weight: 600;
   font-size: 12px;
 }
@@ -162,7 +164,7 @@
   position: absolute;
   bottom: 6px;
   right: 6px;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   z-index: 1;
   cursor: grab;
   display: inline-flex;
@@ -173,12 +175,12 @@
   position: absolute;
   left: 0;
   top: 44px; /* just below header */
-  background: var(--bg-toolbar);
-  border-bottom: 1px solid var(--border-default);
+  background: var(--c-bg-raised);
+  border-bottom: 1px solid var(--c-border);
   z-index: 20;
   overflow: hidden;
   animation: slideDown 140ms ease-out;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 @keyframes slideDown {
@@ -200,13 +202,13 @@
   padding: 12px 16px;
   background: transparent;
   border: none;
-  color: var(--text-primary);
+  color: var(--c-text);
   cursor: pointer;
   text-align: left;
 }
 
 .actionRow:hover {
-  background: var(--hover-bg);
+  background: var(--c-hover);
 }
 
 .actionDanger {
@@ -215,7 +217,7 @@
 
 .actionsDivider {
   height: 1px;
-  background: var(--border-default);
+  background: var(--c-border);
   margin: 4px 0;
 }
 
@@ -229,13 +231,13 @@
 }
 
 .pinned {
-  color: #ffc107 !important;
+  color: var(--c-warning) !important;
 }
 
 /* Unsupported file indicator */
 .unsupportedPill {
   margin-left: 1.75rem;
-  background: #6b7280;
+  background: var(--c-neutral-fill);
   color: white;
   padding: 4px 8px;
   border-radius: 12px;
@@ -252,7 +254,7 @@
 .errorPill {
   margin-left: 1.75rem;
   background: var(--color-red-500);
-  color: #ffffff;
+  color: var(--c-text-on-primary);
   padding: 4px 8px;
   border-radius: 12px;
   font-size: 10px;
@@ -291,36 +293,36 @@
    DARK MODE OVERRIDES
    ========================= */
 :global([data-mantine-color-scheme="dark"]) .card {
-  outline-color: #1c2340; /* deselected stroke */
+  outline-color: var(--c-border); /* deselected stroke */
 }
 
 :global([data-mantine-color-scheme="dark"]) .card[data-selected="true"] {
-  outline-color: #2d3560; /* selected stroke (subtle navy) */
+  outline-color: var(--c-primary); /* selected stroke (subtle navy) */
 }
 
 :global([data-mantine-color-scheme="dark"]) .headerResting {
-  background: #0d1020; /* requested default unselected color */
-  color: var(--tool-header-text); /* #D0D6DC */
-  border-bottom-color: var(--tool-header-border); /* #3A4047 */
+  /* Background flips via the themed --c-file-header-resting token. */
+  color: var(--c-accent-fg, var(--c-primary));
+  border-bottom-color: var(--c-border);
 }
 
 :global([data-mantine-color-scheme="dark"]) .headerSelected {
-  background: var(--tool-header-border); /* #3A4047 */
-  color: var(--tool-header-text); /* #D0D6DC */
-  border-bottom-color: var(--tool-header-border);
+  background: var(--c-border);
+  color: var(--c-accent-fg, var(--c-primary));
+  border-bottom-color: var(--c-border);
 }
 
 :global([data-mantine-color-scheme="dark"]) .title {
-  color: #d0d6dc; /* title text */
+  color: var(--c-text); /* title text */
 }
 
 :global([data-mantine-color-scheme="dark"]) .meta {
-  color: #6b7280; /* subtitle text */
+  color: var(--c-text-muted); /* subtitle text */
 }
 
 /* Light mode selected header stroke override */
 :global([data-mantine-color-scheme="light"]) .card[data-selected="true"] {
-  outline-color: #3b4b6e;
+  outline-color: var(--c-primary);
 }
 
 /* =========================
@@ -333,7 +335,7 @@
   height: calc(310px - 0.5rem);
   margin: 0.5rem auto 0;
   background: var(--c-bg);
-  border: 1.5px solid var(--border-default);
+  border: 1.5px solid var(--c-border);
   border-radius: 12px;
   box-shadow: var(--shadow-md);
   cursor: pointer;
@@ -347,11 +349,11 @@
 .addFileCard:hover {
   box-shadow: var(--shadow-lg);
   transform: translateY(-1px);
-  border-color: var(--accent-interactive);
+  border-color: var(--c-primary);
 }
 
 .addFileCard:focus-visible {
-  outline: 2px solid var(--accent-interactive);
+  outline: 2px solid var(--c-primary);
   outline-offset: 2px;
 }
 
@@ -386,7 +388,7 @@
 }
 
 .addFileCard:hover .addFileText {
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 .addFileSubtext {
diff --git a/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.module.css b/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.module.css
index f0e0ce91bc..a148cc9fa8 100644
--- a/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.module.css
+++ b/frontend/editor/src/core/components/fileEditor/FileEditorThumbnail.module.css
@@ -75,7 +75,7 @@
   box-shadow: var(--shadow-md);
   overflow: hidden;
   position: relative;
-  background: var(--bg-surface);
+  background: var(--c-surface);
   transition:
     box-shadow 0.15s ease,
     transform 0.2s ease;
@@ -91,7 +91,7 @@
   height: 100%;
   object-fit: contain;
   border-radius: 12px;
-  background: var(--bg-surface);
+  background: var(--c-surface);
   display: block;
   position: relative;
   z-index: 1;
@@ -115,7 +115,7 @@
 .fileName {
   font-size: 13px;
   font-weight: 600;
-  color: var(--text-primary);
+  color: var(--c-text);
   line-height: var(--file-name-line-height);
   height: calc(var(--file-name-lines) * var(--file-name-line-height));
   margin: 0;
@@ -149,7 +149,7 @@
 
 .fileMeta {
   font-size: 11px;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   line-height: var(--file-meta-line-height);
   height: var(--file-meta-line-height);
   overflow: hidden;
@@ -183,7 +183,7 @@
   display: flex;
   align-items: center;
   justify-content: center;
-  background: rgba(220, 38, 38, 0.12);
+  background: color-mix(in srgb, var(--c-danger) 12%, transparent);
   border-radius: 12px;
   z-index: 2;
   pointer-events: none;
@@ -191,7 +191,7 @@
 
 .errorPill {
   background: var(--mantine-color-red-6);
-  color: white;
+  color: var(--c-text-on-primary);
   border-radius: 12px;
   padding: 4px 12px;
   font-size: 12px;
@@ -233,7 +233,7 @@
 
 .ownershipBadge {
   background: var(--mantine-color-blue-6);
-  color: white;
+  color: var(--c-text-on-primary);
   border-radius: 6px;
   padding: 2px 7px;
   font-size: 10px;
@@ -247,14 +247,14 @@
   padding: 1px 5px;
   font-size: 10px;
   font-weight: 700;
-  color: white;
+  color: var(--c-text-on-primary);
   line-height: 16px;
   white-space: nowrap;
 }
 
 .pinnedBadge {
   background: var(--mantine-color-yellow-6);
-  color: white;
+  color: var(--c-text-on-primary);
   border-radius: 4px;
   padding: 2px 4px;
   display: flex;
@@ -268,7 +268,7 @@
   bottom: 6px;
   right: 6px;
   cursor: grab;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   opacity: 0;
   transition: opacity 0.15s ease;
   pointer-events: none;
diff --git a/frontend/editor/src/core/components/fileManager/DesktopLayout.tsx b/frontend/editor/src/core/components/fileManager/DesktopLayout.tsx
index 46376421fb..dc203ab756 100644
--- a/frontend/editor/src/core/components/fileManager/DesktopLayout.tsx
+++ b/frontend/editor/src/core/components/fileManager/DesktopLayout.tsx
@@ -50,7 +50,7 @@ const DesktopLayout: React.FC = () => {
             flex: 1,
             display: "flex",
             flexDirection: "column",
-            backgroundColor: "var(--bg-file-list)",
+            backgroundColor: "var(--c-surface)",
             border: "1px solid var(--mantine-color-gray-2)",
             boxShadow: "0 2px 8px rgba(0, 0, 0, 0.1)",
             overflow: "hidden",
diff --git a/frontend/editor/src/core/components/fileManager/EmptyFilesState.tsx b/frontend/editor/src/core/components/fileManager/EmptyFilesState.tsx
index 95cbff8b9b..59b42ef954 100644
--- a/frontend/editor/src/core/components/fileManager/EmptyFilesState.tsx
+++ b/frontend/editor/src/core/components/fileManager/EmptyFilesState.tsx
@@ -81,8 +81,8 @@ const EmptyFilesState: React.FC = () => {
             variant="tertiary"
             aria-label={t("emptyFilesState.upload", "Upload")}
             style={{
-              backgroundColor: "var(--bg-file-manager)",
-              color: "var(--landing-button-color)",
+              backgroundColor: "var(--c-bg)",
+              color: "var(--c-accent-fg)",
               border: "1px solid var(--landing-button-border)",
               borderRadius: isUploadHover ? "2rem" : "1rem",
               height: "38px",
@@ -103,7 +103,7 @@ const EmptyFilesState: React.FC = () => {
               icon={icons.uploadIconName}
               width="1.25rem"
               height="1.25rem"
-              style={{ color: "var(--accent-interactive)" }}
+              style={{ color: "var(--c-primary)" }}
             />
             {isUploadHover && (
               <span style={{ marginLeft: ".5rem" }}>
@@ -115,7 +115,7 @@ const EmptyFilesState: React.FC = () => {
 
         {/* Instruction Text */}
         <span
-          className="text-[var(--accent-interactive)]"
+          className="text-[var(--c-primary)]"
           style={{ fontSize: ".8rem", textAlign: "center" }}
         >
           {terminology.dropFilesHere}
diff --git a/frontend/editor/src/core/components/fileManager/FileListItem.tsx b/frontend/editor/src/core/components/fileManager/FileListItem.tsx
index ba1fe52bc9..5a8e721c1b 100644
--- a/frontend/editor/src/core/components/fileManager/FileListItem.tsx
+++ b/frontend/editor/src/core/components/fileManager/FileListItem.tsx
@@ -189,7 +189,7 @@ const FileListItem: React.FC<FileListItemProps> = ({
           backgroundColor:
             isSelected || shouldShowHovered
               ? "var(--mantine-color-gray-1)"
-              : "var(--bg-file-list)",
+              : "var(--c-surface)",
           opacity: 1,
           transition: "background-color 0.15s ease",
           userSelect: "none",
diff --git a/frontend/editor/src/core/components/fileManager/MobileLayout.tsx b/frontend/editor/src/core/components/fileManager/MobileLayout.tsx
index 2545a9d604..9cc8c6ed99 100644
--- a/frontend/editor/src/core/components/fileManager/MobileLayout.tsx
+++ b/frontend/editor/src/core/components/fileManager/MobileLayout.tsx
@@ -47,7 +47,7 @@ const MobileLayout: React.FC = () => {
           flex: 1,
           display: "flex",
           flexDirection: "column",
-          backgroundColor: "var(--bg-file-list)",
+          backgroundColor: "var(--c-surface)",
           borderRadius: "0.5rem",
           border: "1px solid var(--mantine-color-gray-2)",
           overflow: "hidden",
diff --git a/frontend/editor/src/core/components/filesPage/FileDetailsPanel.tsx b/frontend/editor/src/core/components/filesPage/FileDetailsPanel.tsx
index 07c2e771dc..693d8efae7 100644
--- a/frontend/editor/src/core/components/filesPage/FileDetailsPanel.tsx
+++ b/frontend/editor/src/core/components/filesPage/FileDetailsPanel.tsx
@@ -201,7 +201,7 @@ export function FileDetailsPanel({
                 <img src={single.thumbnailUrl} alt="" />
               ) : (
                 <PictureAsPdfIcon
-                  style={{ fontSize: "3rem", color: "var(--text-muted)" }}
+                  style={{ fontSize: "3rem", color: "var(--c-text-subtle)" }}
                 />
               )}
             </div>
diff --git a/frontend/editor/src/core/components/filesPage/FileGrid.tsx b/frontend/editor/src/core/components/filesPage/FileGrid.tsx
index 69c30f98a3..ce9be12ad2 100644
--- a/frontend/editor/src/core/components/filesPage/FileGrid.tsx
+++ b/frontend/editor/src/core/components/filesPage/FileGrid.tsx
@@ -499,7 +499,7 @@ function FolderCard({
       <div
         className="files-page-card-thumb"
         style={{
-          background: `linear-gradient(135deg, color-mix(in srgb, ${folder.color ?? "var(--accent-interactive, #6366f1)"} 18%, var(--bg-surface)), color-mix(in srgb, ${folder.color ?? "var(--accent-interactive, #6366f1)"} 6%, var(--bg-surface)))`,
+          background: `linear-gradient(135deg, color-mix(in srgb, ${folder.color ?? "var(--c-primary)"} 18%, var(--c-surface)), color-mix(in srgb, ${folder.color ?? "var(--c-primary)"} 6%, var(--c-surface)))`,
         }}
       >
         <FolderThumbnail
diff --git a/frontend/editor/src/core/components/filesPage/FileManagerView.tsx b/frontend/editor/src/core/components/filesPage/FileManagerView.tsx
index 002d81ca00..cc6a74d09e 100644
--- a/frontend/editor/src/core/components/filesPage/FileManagerView.tsx
+++ b/frontend/editor/src/core/components/filesPage/FileManagerView.tsx
@@ -845,7 +845,7 @@ export default function FileManagerView() {
               fontSize: "0.95rem",
               fontWeight: 600,
               padding: "0.25rem 0.5rem",
-              color: "var(--text-primary)",
+              color: "var(--c-text)",
             }}
           >
             {currentTab === "local"
@@ -991,9 +991,9 @@ export default function FileManagerView() {
           style={{
             padding: "0.6rem 1.25rem",
             background:
-              "color-mix(in srgb, var(--mantine-color-red-6, #e03131) 12%, transparent)",
-            color: "var(--text-primary)",
-            borderBottom: "1px solid var(--border-subtle)",
+              "color-mix(in srgb, var(--mantine-color-red-6) 12%, transparent)",
+            color: "var(--c-text)",
+            borderBottom: "1px solid var(--c-border-subtle)",
             fontSize: "0.85rem",
             display: "flex",
             justifyContent: "space-between",
@@ -1083,15 +1083,15 @@ export default function FileManagerView() {
                     style={{
                       background:
                         currentTab === tab.id
-                          ? "var(--hover-bg)"
+                          ? "var(--c-hover)"
                           : "transparent",
                       border: "none",
                       borderRadius: "0.3rem",
                       padding: "0.2rem 0.6rem",
                       color:
                         currentTab === tab.id
-                          ? "var(--text-primary)"
-                          : "var(--text-muted)",
+                          ? "var(--c-text)"
+                          : "var(--c-text-subtle)",
                       fontWeight: currentTab === tab.id ? 500 : 400,
                       fontSize: "0.75rem",
                       cursor: "pointer",
@@ -1662,7 +1662,7 @@ const SearchField = React.forwardRef<
   const { t } = useTranslation();
   return (
     <div className="files-page-search">
-      <SearchIcon fontSize="small" style={{ color: "var(--text-muted)" }} />
+      <SearchIcon fontSize="small" style={{ color: "var(--c-text-subtle)" }} />
       <input
         ref={ref}
         type="text"
diff --git a/frontend/editor/src/core/components/filesPage/FileOriginBadge.tsx b/frontend/editor/src/core/components/filesPage/FileOriginBadge.tsx
index 91a2bc0dba..a4e9b6e3f9 100644
--- a/frontend/editor/src/core/components/filesPage/FileOriginBadge.tsx
+++ b/frontend/editor/src/core/components/filesPage/FileOriginBadge.tsx
@@ -27,19 +27,17 @@ const styles = {
     lineHeight: 1.2,
   },
   local: {
-    background:
-      "color-mix(in srgb, var(--text-muted, #6b7280) 16%, transparent)",
-    color: "var(--text-secondary)",
+    background: "color-mix(in srgb, var(--c-text-subtle) 16%, transparent)",
+    color: "var(--c-text-muted)",
   },
   cloud: {
-    background:
-      "color-mix(in srgb, var(--accent-interactive, #6366f1) 16%, transparent)",
-    color: "var(--accent-interactive, #6366f1)",
+    background: "color-mix(in srgb, var(--c-primary) 16%, transparent)",
+    color: "var(--c-primary)",
   },
   shared: {
     background:
-      "color-mix(in srgb, var(--mantine-color-orange-6, #f97316) 16%, transparent)",
-    color: "var(--mantine-color-orange-6, #f97316)",
+      "color-mix(in srgb, var(--mantine-color-orange-6) 16%, transparent)",
+    color: "var(--mantine-color-orange-6)",
   },
 };
 
diff --git a/frontend/editor/src/core/components/filesPage/FilesPage.css b/frontend/editor/src/core/components/filesPage/FilesPage.css
index 86266b99bc..dfdb35dcb7 100644
--- a/frontend/editor/src/core/components/filesPage/FilesPage.css
+++ b/frontend/editor/src/core/components/filesPage/FilesPage.css
@@ -3,8 +3,8 @@
   flex-direction: column;
   width: 100%;
   height: 100%;
-  background: var(--bg-background);
-  color: var(--text-primary);
+  background: var(--c-bg);
+  color: var(--c-text);
   overflow: hidden;
 }
 
@@ -22,8 +22,8 @@
   gap: 1rem;
   min-height: 48px;
   padding: 0 0.75rem;
-  border-bottom: 1px solid var(--border-subtle);
-  background: var(--bg-toolbar);
+  border-bottom: 1px solid var(--c-border-subtle);
+  background: var(--c-bg-raised);
   flex-shrink: 0;
 }
 
@@ -52,7 +52,7 @@
   border: none;
   padding: 0.25rem 0.5rem;
   border-radius: 0.375rem;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   cursor: pointer;
   font-size: inherit;
   font-weight: 500;
@@ -64,19 +64,14 @@
   overflow: hidden;
   text-overflow: ellipsis;
 }
-
-.files-page-breadcrumb:hover {
-  background: var(--hover-bg);
-  color: var(--text-primary);
-}
-
+.files-page-breadcrumb:hover,
 .files-page-breadcrumb.is-current {
-  color: var(--text-primary);
-  background: var(--hover-bg);
+  background: var(--c-hover);
+  color: var(--c-text);
 }
 
 .files-page-breadcrumb-sep {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-size: 1rem !important;
   width: 1rem;
   height: 1rem;
@@ -88,8 +83,8 @@
   display: flex;
   align-items: center;
   gap: 0.35rem;
-  background: var(--bg-surface);
-  border: 1px solid var(--border-subtle);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 999px;
   padding: 0.2rem 0.75rem;
   /* Fills its grid cell; the cell's minmax(...) clamps to a sensible range. */
@@ -102,7 +97,7 @@
   border: none;
   outline: none;
   flex: 1;
-  color: var(--text-primary);
+  color: var(--c-text);
   font-size: 0.9rem;
 }
 
@@ -116,8 +111,8 @@
 .files-page-tree {
   width: 17rem;
   flex-shrink: 0;
-  border-right: 1px solid var(--border-subtle);
-  background: var(--bg-toolbar);
+  border-right: 1px solid var(--c-border-subtle);
+  background: var(--c-bg-raised);
   overflow-y: auto;
   display: flex;
   flex-direction: column;
@@ -135,7 +130,7 @@
   font-size: 0.8rem;
   text-transform: uppercase;
   letter-spacing: 0.04em;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 
 /* Tree node styles moved to FolderTreePanel.css - that's where the
@@ -156,8 +151,8 @@
   align-items: center;
   gap: 0.75rem;
   padding: 0.55rem 1.25rem;
-  border-bottom: 1px solid var(--border-subtle);
-  background: var(--bg-background);
+  border-bottom: 1px solid var(--c-border-subtle);
+  background: var(--c-bg);
   flex-shrink: 0;
   flex-wrap: wrap;
   min-height: 3rem;
@@ -165,7 +160,7 @@
 
 .files-page-toolbar-info {
   font-size: 0.85rem;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   font-weight: 500;
 }
 
@@ -178,7 +173,7 @@
 }
 
 .files-page-toolbar-info span {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 
 .files-page-toolbar-actions {
@@ -226,7 +221,7 @@
 .files-page-toolbar-divider {
   width: 1px;
   height: 1.4rem;
-  background: var(--border-subtle);
+  background: var(--c-border-subtle);
   margin: 0 0.15rem;
 }
 
@@ -264,7 +259,7 @@
   padding: 1.25rem;
   position: relative;
   scrollbar-width: thin;
-  scrollbar-color: var(--border-subtle) transparent;
+  scrollbar-color: var(--c-border-subtle) transparent;
 }
 
 .files-page-content::-webkit-scrollbar {
@@ -273,14 +268,14 @@
 }
 
 .files-page-content::-webkit-scrollbar-thumb {
-  background: var(--border-subtle);
+  background: var(--c-border-subtle);
   border-radius: 999px;
   border: 2px solid transparent;
   background-clip: content-box;
 }
 
 .files-page-content::-webkit-scrollbar-thumb:hover {
-  background: var(--text-muted);
+  background: var(--c-text-subtle);
   background-clip: content-box;
 }
 
@@ -288,7 +283,7 @@
 .folder-tree-panel-inner,
 .files-page-details-body {
   scrollbar-width: thin;
-  scrollbar-color: var(--border-subtle) transparent;
+  scrollbar-color: var(--c-border-subtle) transparent;
 }
 
 .files-page-tree-list::-webkit-scrollbar,
@@ -300,7 +295,7 @@
 .files-page-tree-list::-webkit-scrollbar-thumb,
 .folder-tree-panel-inner::-webkit-scrollbar-thumb,
 .files-page-details-body::-webkit-scrollbar-thumb {
-  background: var(--border-subtle);
+  background: var(--c-border-subtle);
   border-radius: 999px;
 }
 
@@ -313,10 +308,10 @@
 .files-page-list {
   display: flex;
   flex-direction: column;
-  border: 1px solid var(--border-subtle);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.6rem;
   overflow: hidden;
-  background: var(--bg-surface);
+  background: var(--c-surface);
 }
 
 .files-page-list-row {
@@ -325,7 +320,7 @@
   gap: 0.5rem;
   align-items: center;
   padding: 0.5rem 0.75rem;
-  border-bottom: 1px solid var(--border-subtle);
+  border-bottom: 1px solid var(--c-border-subtle);
   cursor: pointer;
   font-size: 0.9rem;
   transition: background-color 0.12s ease;
@@ -336,8 +331,8 @@
 }
 
 .files-page-list-row.is-header {
-  background: var(--bg-toolbar);
-  color: var(--text-muted);
+  background: var(--c-bg-raised);
+  color: var(--c-text-subtle);
   text-transform: uppercase;
   font-size: 0.72rem;
   letter-spacing: 0.05em;
@@ -356,33 +351,25 @@
 }
 
 .files-page-list-row.is-header [data-sortable="true"]:hover {
-  background: var(--hover-bg);
-  color: var(--text-primary);
+  background: var(--c-hover);
+  color: var(--c-text);
 }
-
-.files-page-list-row:not(.is-header):hover {
-  background: var(--hover-bg);
-}
-
+.files-page-list-row:not(.is-header):hover,
 .files-page-list-row.is-selected {
-  background: var(--hover-bg);
+  background: var(--c-hover);
 }
 
 .files-page-list-row.is-drop-target {
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 12%,
-    transparent
-  );
-  box-shadow: inset 0 0 0 1px var(--accent-interactive, #6366f1);
+  background: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  box-shadow: inset 0 0 0 1px var(--c-primary);
 }
 
 .files-page-card {
   position: relative;
   display: flex;
   flex-direction: column;
-  background: var(--bg-surface);
-  border: 1px solid var(--border-subtle);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.85rem;
   overflow: hidden;
   cursor: pointer;
@@ -397,8 +384,8 @@
   transform: translateY(-2px);
   border-color: color-mix(
     in srgb,
-    var(--accent-interactive, #6366f1) 35%,
-    var(--border-subtle)
+    var(--c-primary) 35%,
+    var(--c-border-subtle)
   );
   box-shadow:
     0 4px 6px -1px rgba(0, 0, 0, 0.08),
@@ -406,16 +393,15 @@
 }
 
 .files-page-card:focus-visible {
-  outline: 2px solid var(--accent-interactive, #6366f1);
+  outline: 2px solid var(--c-primary);
   outline-offset: 2px;
 }
 
 .files-page-card.is-selected {
-  border-color: var(--accent-interactive, #6366f1);
+  border-color: var(--c-primary);
   box-shadow:
-    0 0 0 2px var(--accent-interactive, #6366f1),
-    0 6px 18px -6px
-      color-mix(in srgb, var(--accent-interactive, #6366f1) 35%, transparent);
+    0 0 0 2px var(--c-primary),
+    0 6px 18px -6px color-mix(in srgb, var(--c-primary) 35%, transparent);
 }
 
 .files-page-card.is-folder {
@@ -426,8 +412,8 @@
   aspect-ratio: 4 / 3;
   background: linear-gradient(
     180deg,
-    color-mix(in srgb, var(--text-muted) 5%, var(--bg-surface)),
-    var(--bg-surface)
+    color-mix(in srgb, var(--c-text-subtle) 5%, var(--c-surface)),
+    var(--c-surface)
   );
   display: flex;
   align-items: center;
@@ -452,7 +438,7 @@
   flex-direction: column;
   align-items: center;
   gap: 0.4rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-size: 0.72rem;
   font-weight: 600;
   letter-spacing: 0.04em;
@@ -472,13 +458,13 @@
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
-  color: var(--text-primary);
+  color: var(--c-text);
   letter-spacing: -0.005em;
 }
 
 .files-page-card-meta {
   font-size: 0.76rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   display: flex;
   align-items: center;
   gap: 0.4rem;
@@ -488,7 +474,7 @@
    the user can tell which folder each hit lives in without navigating. */
 .files-page-card-path {
   font-size: 0.72rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
@@ -517,8 +503,8 @@
 /* Style the Mantine checkbox so it reads as a soft pill rather than a
    bare form control. */
 .files-page-card-selector :where(.mantine-Checkbox-input) {
-  background: var(--bg-surface);
-  border-color: var(--border-subtle);
+  background: var(--c-surface);
+  border-color: var(--c-border-subtle);
   box-shadow: 0 1px 4px rgba(0, 0, 0, 0.18);
 }
 
@@ -536,26 +522,26 @@
    Use stronger specificity + !important to win over Mantine's
    variant=filled inline styles. */
 .files-page-card .files-page-card-actions button.mantine-ActionIcon-root {
-  background-color: var(--bg-raised, var(--bg-surface)) !important;
-  color: var(--text-primary) !important;
-  border: 1px solid var(--border-default, var(--border-subtle)) !important;
+  background-color: var(--c-surface-raised, var(--c-surface)) !important;
+  color: var(--c-text) !important;
+  border: 1px solid var(--c-border, var(--c-border-subtle)) !important;
   box-shadow: 0 2px 6px rgba(0, 0, 0, 0.25);
   backdrop-filter: blur(6px);
 }
 
 .files-page-card .files-page-card-actions button.mantine-ActionIcon-root:hover {
-  background-color: var(--hover-bg) !important;
+  background-color: var(--c-hover) !important;
 }
 
 /* Row-view kebab: same high-contrast treatment so it's readable
    against selected (tinted) and in-workspace rows. */
 .files-page-list-row .mantine-ActionIcon-root[aria-label$="actions"] {
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
 }
 
 .files-page-list-row .mantine-ActionIcon-root[aria-label$="actions"]:hover {
-  background-color: var(--hover-bg) !important;
-  color: var(--text-primary);
+  background-color: var(--c-hover) !important;
+  color: var(--c-text);
 }
 
 .files-page-card-origin {
@@ -578,8 +564,8 @@
   gap: 0.35rem;
   padding: 0.22rem 0.55rem;
   border-radius: 999px;
-  background: var(--mantine-color-teal-6, #10b981);
-  color: #ffffff;
+  background: var(--mantine-color-teal-6, var(--c-success));
+  color: var(--c-text-on-primary);
   font-size: 0.68rem;
   font-weight: 700;
   letter-spacing: 0.04em;
@@ -594,7 +580,7 @@
   width: 0.45rem;
   height: 0.45rem;
   border-radius: 50%;
-  background: #ffffff;
+  background: var(--c-text-on-primary);
   box-shadow: 0 0 0 2px rgba(255, 255, 255, 0.35);
   animation: files-page-open-pulse 1.8s ease-in-out infinite;
 }
@@ -614,8 +600,8 @@
 .files-page-card.is-in-workspace {
   border-color: color-mix(
     in srgb,
-    var(--mantine-color-teal-6, #10b981) 35%,
-    var(--border-subtle)
+    var(--mantine-color-teal-6, var(--c-success)) 35%,
+    var(--c-border-subtle)
   );
 }
 
@@ -627,7 +613,12 @@
   pointer-events: none;
   background: linear-gradient(
     180deg,
-    color-mix(in srgb, var(--mantine-color-teal-6, #10b981) 6%, transparent) 0%,
+    color-mix(
+        in srgb,
+        var(--mantine-color-teal-6, var(--c-success)) 6%,
+        transparent
+      )
+      0%,
     transparent 40%
   );
   z-index: 0;
@@ -639,8 +630,8 @@
   gap: 0.3rem;
   padding: 0.12rem 0.5rem;
   border-radius: 999px;
-  background: var(--mantine-color-teal-6, #10b981);
-  color: #ffffff;
+  background: var(--mantine-color-teal-6, var(--c-success));
+  color: var(--c-text-on-primary);
   font-size: 0.68rem;
   font-weight: 700;
   letter-spacing: 0.04em;
@@ -653,7 +644,7 @@
 .files-page-list-row.is-in-workspace {
   background: color-mix(
     in srgb,
-    var(--mantine-color-teal-6, #10b981) 4%,
+    var(--mantine-color-teal-6, var(--c-success)) 4%,
     transparent
   );
 }
@@ -685,13 +676,9 @@
 }
 
 .files-page-card.is-drop-target {
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 10%,
-    var(--bg-surface)
-  );
-  box-shadow: 0 0 0 2px var(--accent-interactive, #6366f1);
-  border-color: var(--accent-interactive, #6366f1);
+  background: color-mix(in srgb, var(--c-primary) 10%, var(--c-surface));
+  box-shadow: 0 0 0 2px var(--c-primary);
+  border-color: var(--c-primary);
 }
 
 @keyframes files-page-skeleton-pulse {
@@ -707,9 +694,9 @@
   display: block;
   background: linear-gradient(
     90deg,
-    color-mix(in srgb, var(--text-muted) 12%, transparent) 25%,
-    color-mix(in srgb, var(--text-muted) 22%, transparent) 50%,
-    color-mix(in srgb, var(--text-muted) 12%, transparent) 75%
+    color-mix(in srgb, var(--c-text-subtle) 12%, transparent) 25%,
+    color-mix(in srgb, var(--c-text-subtle) 22%, transparent) 50%,
+    color-mix(in srgb, var(--c-text-subtle) 12%, transparent) 75%
   );
   background-size: 200% 100%;
   animation: files-page-skeleton-pulse 1.4s ease-in-out infinite;
@@ -718,14 +705,14 @@
 
 .files-page-skeleton-card {
   pointer-events: none;
-  border-color: var(--border-subtle);
+  border-color: var(--c-border-subtle);
   box-shadow: none;
 }
 
 .files-page-skeleton-card:hover {
   transform: none;
   box-shadow: none;
-  border-color: var(--border-subtle);
+  border-color: var(--c-border-subtle);
 }
 
 .files-page-skeleton-row {
@@ -743,7 +730,7 @@
   justify-content: center;
   height: 100%;
   gap: 0.75rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   padding: 4rem 1.5rem;
   text-align: center;
 }
@@ -755,25 +742,21 @@
   width: 5rem;
   height: 5rem;
   border-radius: 50%;
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 12%,
-    transparent
-  );
-  color: var(--accent-interactive, #6366f1);
+  background: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  color: var(--c-primary);
   margin-bottom: 0.25rem;
 }
 
 .files-page-empty-title {
   font-size: 1.15rem;
-  color: var(--text-primary);
+  color: var(--c-text);
   font-weight: 600;
   letter-spacing: -0.01em;
 }
 
 .files-page-empty-hint {
   font-size: 0.9rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   max-width: 30rem;
   line-height: 1.5;
 }
@@ -797,8 +780,8 @@
 .files-page-details {
   width: 22rem;
   flex-shrink: 0;
-  border-left: 1px solid var(--border-subtle);
-  background: var(--bg-toolbar);
+  border-left: 1px solid var(--c-border-subtle);
+  background: var(--c-bg-raised);
   display: flex;
   flex-direction: column;
   overflow: hidden;
@@ -817,7 +800,7 @@
   font-size: 0.78rem;
   text-transform: uppercase;
   letter-spacing: 0.06em;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 
 .files-page-details-header strong {
@@ -846,8 +829,8 @@
   flex-direction: column;
   gap: 0.4rem;
   padding: 0.6rem 1.1rem;
-  border-top: 1px solid var(--border-subtle);
-  background: var(--bg-toolbar);
+  border-top: 1px solid var(--c-border-subtle);
+  background: var(--c-bg-raised);
 }
 
 /* Collapsible "File info" header (size/type/dates). */
@@ -857,11 +840,11 @@
   justify-content: space-between;
   width: 100%;
   padding: 0.4rem 0.6rem;
-  background: var(--bg-surface);
-  border: 1px solid var(--border-subtle);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.5rem;
   cursor: pointer;
-  color: var(--text-secondary, var(--text-primary));
+  color: var(--c-text-muted, var(--c-text));
   font-size: 0.78rem;
   text-transform: uppercase;
   letter-spacing: 0.04em;
@@ -878,8 +861,8 @@
   /* Compact fixed height (was a tall 4:3 box that dominated the panel and
      pushed the action buttons off the bottom). */
   height: 6.5rem;
-  background: var(--bg-surface);
-  border: 1px solid var(--border-subtle);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.6rem;
   display: flex;
   align-items: center;
@@ -911,8 +894,8 @@
   gap: 0.55rem;
   font-size: 0.85rem;
   padding: 0.65rem 0.75rem;
-  background: var(--bg-surface);
-  border: 1px solid var(--border-subtle);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.5rem;
 }
 
@@ -923,12 +906,12 @@
 }
 
 .files-page-details-field-label {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-size: 0.78rem;
 }
 
 .files-page-details-field-value {
-  color: var(--text-primary);
+  color: var(--c-text);
   text-align: right;
   word-break: break-word;
   font-weight: 500;
@@ -939,8 +922,8 @@
   flex-direction: column;
   gap: 0.3rem;
   padding: 0.5rem 0.6rem;
-  background: var(--bg-surface);
-  border: 1px solid var(--border-subtle);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.5rem;
 }
 
@@ -948,7 +931,7 @@
   font-size: 0.72rem;
   text-transform: uppercase;
   letter-spacing: 0.05em;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 
 /* Filename chip next to the title - "PDF", "DOCX", etc.
@@ -959,9 +942,9 @@
   align-items: center;
   padding: 0.12rem 0.5rem;
   border-radius: 0.4rem;
-  background: var(--bg-surface);
-  border: 1px solid var(--border-subtle);
-  color: var(--text-secondary, var(--text-primary));
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
+  color: var(--c-text-muted, var(--c-text));
   font-size: 0.65rem;
   font-weight: 700;
   letter-spacing: 0.05em;
@@ -980,8 +963,8 @@
   flex-direction: column;
   gap: 0.4rem;
   padding: 0.55rem 0.7rem 0.7rem;
-  background: var(--bg-surface);
-  border: 1px solid var(--border-subtle);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.5rem;
 }
 .files-page-details-version-timeline-label {
@@ -991,12 +974,12 @@
   font-size: 0.72rem;
   text-transform: uppercase;
   letter-spacing: 0.05em;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 .files-page-details-version-timeline-count {
   margin-left: auto;
   font-weight: 600;
-  color: var(--text-secondary, var(--text-muted));
+  color: var(--c-text-muted, var(--c-text-subtle));
   text-transform: none;
   letter-spacing: 0;
 }
@@ -1026,27 +1009,26 @@
   width: 0.55rem;
   height: 0.55rem;
   border-radius: 50%;
-  background: var(--bg-toolbar);
-  border: 2px solid var(--border-strong, var(--border-subtle));
+  background: var(--c-bg-raised);
+  border: 2px solid var(--c-border-strong, var(--c-border-subtle));
   z-index: 1;
   flex-shrink: 0;
 }
 .files-page-details-version-timeline-rail-dot.is-active {
-  background: var(--accent-interactive, #6366f1);
-  border-color: var(--accent-interactive, #6366f1);
-  box-shadow: 0 0 0 3px
-    color-mix(in srgb, var(--accent-interactive, #6366f1) 25%, transparent);
+  background: var(--c-primary);
+  border-color: var(--c-primary);
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--c-primary) 25%, transparent);
 }
 .files-page-details-version-timeline-rail-dot.is-ellipsis {
   width: 0.35rem;
   height: 0.35rem;
-  background: var(--text-muted);
+  background: var(--c-text-subtle);
   border-color: transparent;
 }
 .files-page-details-version-timeline-rail-line {
   width: 2px;
   flex: 1;
-  background: var(--border-subtle);
+  background: var(--c-border-subtle);
   min-height: 0.6rem;
   margin-top: 2px;
 }
@@ -1062,11 +1044,7 @@
 }
 .files-page-details-version-timeline-row.is-active
   .files-page-details-version-timeline-body {
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 10%,
-    transparent
-  );
+  background: color-mix(in srgb, var(--c-primary) 10%, transparent);
 }
 .files-page-details-version-timeline-summary {
   appearance: none;
@@ -1084,11 +1062,11 @@
 }
 .files-page-details-version-timeline-summary:hover
   .files-page-details-version-timeline-chevron {
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 .files-page-details-version-timeline-delta {
   font-size: 0.82rem;
-  color: var(--text-primary);
+  color: var(--c-text);
   font-weight: 500;
   white-space: nowrap;
   overflow: hidden;
@@ -1099,30 +1077,30 @@
 }
 .files-page-details-version-timeline-delta.is-origin {
   font-weight: 400;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-style: italic;
 }
 .files-page-details-version-timeline-delta-plus {
-  color: var(--accent-interactive, #6366f1);
+  color: var(--c-primary);
   font-weight: 700;
 }
 .files-page-details-version-timeline-spacer {
   flex: 1;
 }
 .files-page-details-version-timeline-chevron {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   transition: transform 0.15s ease;
 }
 .files-page-details-version-timeline-chevron.is-expanded {
   transform: rotate(180deg);
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 .files-page-details-version-timeline-meta-line {
   display: flex;
   align-items: center;
   gap: 0.35rem;
   font-size: 0.7rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 .files-page-details-version-timeline-expanded {
   display: flex;
@@ -1130,7 +1108,7 @@
   gap: 0.4rem;
   margin-top: 0.45rem;
   padding-top: 0.5rem;
-  border-top: 1px dashed var(--border-subtle);
+  border-top: 1px dashed var(--c-border-subtle);
 }
 .files-page-details-version-timeline-toolchain {
   display: flex;
@@ -1139,7 +1117,7 @@
 }
 .files-page-details-version-timeline-toolchain-label {
   font-size: 0.65rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   text-transform: uppercase;
   letter-spacing: 0.05em;
 }
@@ -1147,12 +1125,12 @@
 .files-page-details-version-timeline-collapse-btn {
   appearance: none;
   background: none;
-  border: 1px dashed var(--border-subtle);
+  border: 1px dashed var(--c-border-subtle);
   border-radius: 0.3rem;
   padding: 0.25rem 0.5rem;
   margin: 0.1rem 0;
   font-size: 0.72rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   cursor: pointer;
   text-align: left;
   transition:
@@ -1161,8 +1139,8 @@
 }
 .files-page-details-version-timeline-ellipsis-btn:hover,
 .files-page-details-version-timeline-collapse-btn:hover {
-  color: var(--text-primary);
-  border-color: var(--border-strong, var(--text-muted));
+  color: var(--c-text);
+  border-color: var(--c-border-strong, var(--c-text-subtle));
 }
 .files-page-details-version-timeline-collapse-btn {
   align-self: flex-start;
@@ -1172,12 +1150,8 @@
 .files-page-drop-overlay {
   position: absolute;
   inset: 1rem;
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 14%,
-    var(--bg-background)
-  );
-  border: 2px dashed var(--accent-interactive, #6366f1);
+  background: color-mix(in srgb, var(--c-primary) 14%, var(--c-bg));
+  border: 2px dashed var(--c-primary);
   border-radius: 1rem;
   display: flex;
   flex-direction: column;
@@ -1185,7 +1159,7 @@
   justify-content: center;
   gap: 1rem;
   pointer-events: none;
-  color: var(--accent-interactive, #6366f1);
+  color: var(--c-primary);
   font-weight: 600;
   font-size: 1.1rem;
   z-index: 10;
@@ -1200,40 +1174,28 @@
   width: 4.5rem;
   height: 4.5rem;
   border-radius: 50%;
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 30%,
-    transparent
-  );
+  background: color-mix(in srgb, var(--c-primary) 30%, transparent);
 }
 
 .files-page-drop-overlay-icon svg {
   font-size: 2.5rem !important;
-  color: var(--bg-background);
+  color: var(--c-bg);
 }
 
 .files-page-drop-overlay-sub {
   font-size: 0.85rem;
   font-weight: 500;
-  color: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 80%,
-    var(--text-secondary)
-  );
+  color: color-mix(in srgb, var(--c-primary) 80%, var(--c-text-muted));
 }
 
 @keyframes files-page-drop-overlay-pulse {
   0%,
   100% {
-    border-color: var(--accent-interactive, #6366f1);
+    border-color: var(--c-primary);
     transform: scale(1);
   }
   50% {
-    border-color: color-mix(
-      in srgb,
-      var(--accent-interactive, #6366f1) 60%,
-      transparent
-    );
+    border-color: color-mix(in srgb, var(--c-primary) 60%, transparent);
     transform: scale(1.005);
   }
 }
diff --git a/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.tsx b/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.tsx
index 3944489cb7..0a256b1310 100644
--- a/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.tsx
+++ b/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.tsx
@@ -70,7 +70,7 @@ export function FolderAppearancePicker({
                 borderRadius: "50%",
                 border:
                   folder.color === c
-                    ? "2px solid var(--text-primary)"
+                    ? "2px solid var(--c-text)"
                     : "2px solid transparent",
                 background: c,
                 cursor: disabled ? "not-allowed" : "pointer",
@@ -123,7 +123,7 @@ function Section({
           fontSize: "0.7rem",
           textTransform: "uppercase",
           letterSpacing: "0.05em",
-          color: "var(--text-muted)",
+          color: "var(--c-text-subtle)",
           fontWeight: 600,
         }}
       >
@@ -163,13 +163,13 @@ function IconButton({
           justifyContent: "center",
           fontSize: "1.1rem",
           borderRadius: "0.4rem",
-          background: selected ? "var(--hover-bg)" : "transparent",
+          background: selected ? "var(--c-hover)" : "transparent",
           border: selected
-            ? "1px solid var(--accent-interactive, #6366f1)"
+            ? "1px solid var(--c-primary)"
             : "1px solid transparent",
           cursor: disabled ? "not-allowed" : "pointer",
           padding: 0,
-          color: "var(--text-primary)",
+          color: "var(--c-text)",
         }}
       >
         {icon.glyph || "-"}
diff --git a/frontend/editor/src/core/components/filesPage/FolderThumbnail.tsx b/frontend/editor/src/core/components/filesPage/FolderThumbnail.tsx
index b8e68f9f7f..39554a21ee 100644
--- a/frontend/editor/src/core/components/filesPage/FolderThumbnail.tsx
+++ b/frontend/editor/src/core/components/filesPage/FolderThumbnail.tsx
@@ -30,7 +30,7 @@ export function FolderThumbnail({
   size = "thumb",
   iconGlyph,
 }: FolderThumbnailProps) {
-  const accent = color ?? "var(--accent-interactive, #6366f1)";
+  const accent = color ?? "var(--c-primary, #6366f1)";
   const px = SIZE_PX[size];
   const showBadge = size === "thumb" && (fileCount ?? 0) > 0;
   // Per-instance unique ids - `${color}` previously embedded `#` and CSS
@@ -149,7 +149,7 @@ export function FolderThumbnail({
             minWidth: "1.4rem",
             height: "1.4rem",
             borderRadius: "999px",
-            background: "var(--bg-surface, #fff)",
+            background: "var(--c-surface, #fff)",
             border: `1px solid ${accent}`,
             color: accent,
             fontSize: "0.7rem",
diff --git a/frontend/editor/src/core/components/filesPage/FolderTreePanel.css b/frontend/editor/src/core/components/filesPage/FolderTreePanel.css
index 2b75efe685..4a98babcbc 100644
--- a/frontend/editor/src/core/components/filesPage/FolderTreePanel.css
+++ b/frontend/editor/src/core/components/filesPage/FolderTreePanel.css
@@ -15,8 +15,8 @@
 .folder-tree-panel {
   width: 0;
   flex-shrink: 0;
-  background: var(--bg-toolbar);
-  border-right: 0 solid var(--border-subtle);
+  background: var(--c-bg-raised);
+  border-right: 0 solid var(--c-border-subtle);
   overflow: hidden;
   height: 100%;
   pointer-events: none;
@@ -65,11 +65,7 @@
 
 .folder-tree-panel-resizer:hover,
 .folder-tree-panel-resizer:focus-visible {
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 35%,
-    transparent
-  );
+  background: color-mix(in srgb, var(--c-primary) 35%, transparent);
   outline: none;
 }
 
@@ -87,7 +83,7 @@
   font-size: 13px;
   font-weight: 600;
   letter-spacing: 0.02em;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   text-transform: uppercase;
 }
 
@@ -112,7 +108,7 @@
   margin: 0 8px;
   cursor: pointer;
   user-select: none;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   font-size: 14px;
   position: relative;
   transition: background-color 0.15s ease;
@@ -120,23 +116,19 @@
 }
 
 .files-page-tree-node:hover {
-  background: var(--hover-bg);
+  background: var(--c-hover);
 }
 
 .files-page-tree-node.is-active {
-  background: var(--hover-bg);
-  color: var(--text-primary);
+  background: var(--c-hover);
+  color: var(--c-text);
   font-weight: 500;
 }
 
 .files-page-tree-node.is-drop-target {
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 12%,
-    transparent
-  );
-  box-shadow: inset 0 0 0 1px var(--accent-interactive, #6366f1);
-  color: var(--text-primary);
+  background: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  box-shadow: inset 0 0 0 1px var(--c-primary);
+  color: var(--c-text);
 }
 
 .files-page-tree-toggle {
@@ -145,7 +137,7 @@
   justify-content: center;
   width: 16px;
   height: 16px;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   flex-shrink: 0;
 }
 
@@ -165,7 +157,7 @@
   align-items: center;
   justify-content: center;
   flex-shrink: 0;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin-left: 8px;
   font-size: 18px;
 }
@@ -183,7 +175,7 @@
 }
 
 .files-page-tree-count {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-size: 12px;
   flex-shrink: 0;
   margin-left: 8px;
diff --git a/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.tsx b/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.tsx
index b6e098ea4d..0d978621d9 100644
--- a/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.tsx
+++ b/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.tsx
@@ -127,7 +127,7 @@ export function MoveToFolderDialog({
         </Text>
         <div
           style={{
-            border: "1px solid var(--border-subtle)",
+            border: "1px solid var(--c-border-subtle)",
             borderRadius: "0.5rem",
             maxHeight: "20rem",
             overflowY: "auto",
@@ -343,8 +343,8 @@ function FolderPick({
         opacity: disabled ? 0.45 : 1,
         gap: "0.5rem",
         padding: `0.4rem 0.75rem 0.4rem ${0.75 + depth * 0.85}rem`,
-        background: isActive ? "var(--hover-bg)" : "transparent",
-        borderBottom: "1px solid var(--border-subtle)",
+        background: isActive ? "var(--c-hover)" : "transparent",
+        borderBottom: "1px solid var(--c-border-subtle)",
         boxSizing: "border-box",
         fontWeight: isActive ? 600 : 400,
       }}
diff --git a/frontend/editor/src/core/components/layout/Workbench.tsx b/frontend/editor/src/core/components/layout/Workbench.tsx
index a1b9c84984..fc5dd77226 100644
--- a/frontend/editor/src/core/components/layout/Workbench.tsx
+++ b/frontend/editor/src/core/components/layout/Workbench.tsx
@@ -218,7 +218,7 @@ export default function Workbench() {
     <Box
       className="flex-1 h-full min-w-0 relative flex flex-col"
       data-tour="workbench"
-      style={{ backgroundColor: "var(--bg-background)", minWidth: 0 }}
+      style={{ backgroundColor: "var(--c-bg)", minWidth: 0 }}
     >
       {/* Workbench Bar - animates in/out based on file presence */}
       {currentView !== "myFiles" &&
diff --git a/frontend/editor/src/core/components/onboarding/InitialOnboardingModal/InitialOnboardingModal.module.css b/frontend/editor/src/core/components/onboarding/InitialOnboardingModal/InitialOnboardingModal.module.css
index e1f46bc6e8..f9439dcdd2 100644
--- a/frontend/editor/src/core/components/onboarding/InitialOnboardingModal/InitialOnboardingModal.module.css
+++ b/frontend/editor/src/core/components/onboarding/InitialOnboardingModal/InitialOnboardingModal.module.css
@@ -22,7 +22,7 @@
   display: flex;
   align-items: center;
   justify-content: center;
-  box-shadow: 0 16px 32px rgba(15, 23, 42, 0.18);
+  box-shadow: 0 16px 32px rgba(0, 0, 0, 0.18);
   animation: heroLogoScale 0.25s ease forwards;
 }
 
@@ -49,10 +49,10 @@
 .securityCard {
   width: 100%;
   max-width: 480px;
-  background: var(--bg-surface, #ffffff);
+  background: var(--c-surface);
   border-radius: 16px;
   padding: 20px;
-  box-shadow: 0 12px 32px rgba(15, 23, 42, 0.12);
+  box-shadow: 0 12px 32px rgba(0, 0, 0, 0.12);
   display: flex;
   flex-direction: column;
   gap: 16px;
@@ -65,7 +65,7 @@
   font-weight: 500;
   font-size: 15px;
   line-height: 1.5;
-  color: var(--onboarding-body, #1f2937);
+  color: var(--c-text-muted);
 }
 
 .mfaSlideContent {
@@ -77,10 +77,10 @@
 .mfaCard {
   width: 100%;
   max-width: 560px;
-  background: var(--bg-surface, #ffffff);
+  background: var(--c-surface);
   border-radius: 16px;
   padding: 20px;
-  box-shadow: 0 12px 32px rgba(15, 23, 42, 0.12);
+  box-shadow: 0 12px 32px rgba(0, 0, 0, 0.12);
 }
 
 .mfaSetupGrid {
@@ -94,7 +94,7 @@
   padding: 12px;
   background: #ffffff;
   border-radius: 12px;
-  box-shadow: 0 8px 16px rgba(15, 23, 42, 0.12);
+  box-shadow: 0 8px 16px rgba(0, 0, 0, 0.12);
   display: flex;
   justify-content: center;
 }
@@ -102,7 +102,7 @@
 .mfaSteps {
   margin: 0;
   padding-left: 18px;
-  color: var(--onboarding-body, #1f2937);
+  color: var(--c-text-muted);
   font-size: 14px;
   line-height: 1.5;
 }
@@ -149,11 +149,7 @@
   padding: 4px;
   outline: none;
 }
-
-.iconButton:focus {
-  outline: none;
-}
-
+.iconButton:focus,
 .iconButton:focus-visible {
   outline: none;
 }
@@ -194,14 +190,7 @@
   text-align: center;
   animation: heroLogoEnter 0.25s ease forwards;
 }
-
-.title {
-  text-align: center;
-  opacity: 0;
-  transform: translateX(24px);
-  animation: bodySlideIn 0.25s ease forwards;
-}
-
+.title,
 .bodyCopy {
   text-align: center;
   opacity: 0;
@@ -273,13 +262,13 @@
   opacity: 1;
   border: 1px solid rgba(255, 255, 255, 0.9);
   background: rgba(255, 255, 255, 0.9);
-  color: #1f2933;
+  color: var(--c-text);
   box-shadow: 0 0 8px rgba(255, 255, 255, 0.7);
 }
 
 /* Modal content styles */
 .modalContent {
-  background: var(--bg-surface);
+  background: var(--c-surface);
   position: relative;
 }
 
@@ -299,7 +288,7 @@
     sans-serif;
   font-weight: 600;
   font-size: 22px;
-  color: var(--onboarding-title);
+  color: var(--c-text);
 }
 
 /* Body text styles */
@@ -313,7 +302,7 @@
     Arial,
     sans-serif;
   font-size: 16px;
-  color: var(--onboarding-body);
+  color: var(--c-text-muted);
   line-height: 1.5;
 }
 
@@ -335,8 +324,8 @@
 }
 
 .v2Badge {
-  background: #dbefff;
-  color: #2a4bff;
+  background: var(--c-primary-tint);
+  color: var(--c-accent-fg);
   padding: 3px 9px;
   border-radius: 6px;
   font-size: 12px;
@@ -345,7 +334,7 @@
 
 /* Icon styles */
 .heroIcon {
-  color: var(--onboarding-title, #0f172a);
+  color: var(--c-text);
 }
 
 /* ===================================================================== */
@@ -353,7 +342,7 @@
 /* ===================================================================== */
 
 .card {
-  background: var(--bg-surface);
+  background: var(--c-surface);
   display: flex;
   flex-direction: column;
 }
@@ -383,7 +372,7 @@
   font-size: 17px;
   font-weight: 700;
   letter-spacing: -0.01em;
-  color: var(--onboarding-title, #0f172a);
+  color: var(--c-text);
 }
 
 .headerRight {
@@ -395,8 +384,8 @@
 .stepPill {
   font-size: 12px;
   font-weight: 600;
-  color: var(--onboarding-body, #64748b);
-  background: var(--bg-muted, #f1f5f9);
+  color: var(--c-text-muted);
+  background: var(--c-surface-sunken);
   padding: 5px 11px;
   border-radius: 9999px;
   white-space: nowrap;
@@ -413,17 +402,17 @@
   flex: 1;
   height: 5px;
   border-radius: 9999px;
-  background: var(--onboarding-step-inactive, #e2e8f0);
+  background: var(--onboarding-step-inactive, var(--c-border));
   transition: background 0.2s ease;
 }
 
 .progressSegDone {
-  background: var(--color-blue, #3b82f6);
+  background: var(--c-primary);
 }
 
 .divider {
   height: 1px;
-  background: var(--border-subtle, rgba(15, 23, 42, 0.08));
+  background: var(--c-border-subtle);
 }
 
 /* ---- content ---- */
@@ -445,7 +434,7 @@
   min-height: 128px;
   border-radius: 14px;
   overflow: hidden;
-  background: linear-gradient(155deg, #eef1fb 0%, #f6f4fc 55%, #fbf4f7 100%);
+  background: var(--c-onboarding-hero);
 }
 
 .heroArt {
@@ -459,18 +448,18 @@
   height: 62px;
   border-radius: 15px;
   object-fit: contain;
-  filter: drop-shadow(0 10px 20px rgba(15, 23, 42, 0.16));
+  filter: drop-shadow(0 10px 20px rgba(0, 0, 0, 0.16));
 }
 
 .heroTile {
   width: 62px;
   height: 62px;
   border-radius: 15px;
-  background: #ffffff;
+  background: var(--c-onboarding-hero-tile);
   display: flex;
   align-items: center;
   justify-content: center;
-  box-shadow: 0 10px 22px rgba(15, 23, 42, 0.14);
+  box-shadow: 0 10px 22px rgba(0, 0, 0, 0.14);
 }
 
 /* ---- title + body (left-aligned, clean) ---- */
@@ -479,14 +468,14 @@
   font-weight: 600;
   letter-spacing: -0.01em;
   line-height: 1.3;
-  color: var(--onboarding-title, #0f172a);
+  color: var(--c-text);
   text-align: left;
 }
 
 .bodyNew {
   font-size: 14px;
   line-height: 1.5;
-  color: var(--onboarding-body, #475569);
+  color: var(--c-text-muted);
   text-align: left;
 }
 
@@ -513,16 +502,9 @@
   gap: 12px;
 }
 
-/* ---- dark theme surface tuning ---- */
-:global([data-mantine-color-scheme="dark"]) .heroPanel {
-  background: linear-gradient(155deg, #1a2236 0%, #171e30 55%, #201a28 100%);
-}
-
+/* ---- dark theme surface tuning ----
+   Hero panel + tile colours flip via the themed --c-onboarding-hero* tokens;
+   only the tile's heavier dark shadow needs a per-scheme override. */
 :global([data-mantine-color-scheme="dark"]) .heroTile {
-  background: #0f1626;
   box-shadow: 0 12px 28px rgba(0, 0, 0, 0.4);
 }
-
-:global([data-mantine-color-scheme="dark"]) .divider {
-  background: rgba(255, 255, 255, 0.08);
-}
diff --git a/frontend/editor/src/core/components/onboarding/OnboardingSlideShell.tsx b/frontend/editor/src/core/components/onboarding/OnboardingSlideShell.tsx
index 3a8a2a57e4..49d94662eb 100644
--- a/frontend/editor/src/core/components/onboarding/OnboardingSlideShell.tsx
+++ b/frontend/editor/src/core/components/onboarding/OnboardingSlideShell.tsx
@@ -116,7 +116,7 @@ export default function OnboardingSlideShell({
         content: {
           overflow: "hidden",
           border: "none",
-          background: "var(--bg-surface)",
+          background: "var(--c-surface)",
           maxHeight: "90vh",
         },
       }}
@@ -193,7 +193,7 @@ export default function OnboardingSlideShell({
 
           <div key={`body-${slideKey}`} className={styles.bodyNew}>
             {body}
-            <style>{`.${styles.bodyNew} strong{color: var(--onboarding-title); font-weight: 600;}`}</style>
+            <style>{`.${styles.bodyNew} strong{color: var(--c-text); font-weight: 600;}`}</style>
           </div>
 
           <div className={styles.footer}>
diff --git a/frontend/editor/src/core/components/onboarding/OnboardingTour.css b/frontend/editor/src/core/components/onboarding/OnboardingTour.css
index a1cbd4f3d8..a689b9f3f4 100644
--- a/frontend/editor/src/core/components/onboarding/OnboardingTour.css
+++ b/frontend/editor/src/core/components/onboarding/OnboardingTour.css
@@ -13,7 +13,7 @@
   box-shadow:
     0 0 0 2px var(--mantine-primary-color-filled),
     0 0 15px var(--mantine-primary-color-filled),
-    inset 0 0 15px rgba(59, 130, 246, 0.1);
+    inset 0 0 15px color-mix(in srgb, var(--c-primary) 10%, transparent);
   border-radius: 8px;
 }
 
@@ -23,13 +23,13 @@
     box-shadow:
       0 0 0 3px var(--mantine-primary-color-filled),
       0 0 20px var(--mantine-primary-color-filled),
-      inset 0 0 20px rgba(59, 130, 246, 0.1);
+      inset 0 0 20px color-mix(in srgb, var(--c-primary) 10%, transparent);
   }
   50% {
     box-shadow:
       0 0 0 3px var(--mantine-primary-color-filled),
       0 0 30px var(--mantine-primary-color-filled),
-      inset 0 0 30px rgba(59, 130, 246, 0.2);
+      inset 0 0 30px color-mix(in srgb, var(--c-primary) 20%, transparent);
   }
 }
 
diff --git a/frontend/editor/src/core/components/onboarding/slides/AnimatedSlideBackground.module.css b/frontend/editor/src/core/components/onboarding/slides/AnimatedSlideBackground.module.css
index e278703955..7ca0b4fd93 100644
--- a/frontend/editor/src/core/components/onboarding/slides/AnimatedSlideBackground.module.css
+++ b/frontend/editor/src/core/components/onboarding/slides/AnimatedSlideBackground.module.css
@@ -40,7 +40,7 @@
   position: absolute;
   border-radius: 50%;
   pointer-events: none;
-  box-shadow: 0 18px 36px rgba(15, 23, 42, 0.12);
+  box-shadow: 0 18px 36px rgba(0, 0, 0, 0.12);
   animation-name: circleSway;
   animation-timing-function: ease-in-out;
   animation-iteration-count: infinite;
diff --git a/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.tsx b/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.tsx
index efb95b95bb..b76eff2c30 100644
--- a/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.tsx
+++ b/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.tsx
@@ -129,9 +129,9 @@ export const DesktopInstallTitle: React.FC<DesktopInstallTitleProps> = ({
                 leftSection={iconKey ? <OsIcon os={iconKey} /> : undefined}
                 style={{
                   backgroundColor: isSelected
-                    ? "var(--bg-muted, #f1f5f9)"
+                    ? "var(--c-surface-sunken, #f1f5f9)"
                     : "transparent",
-                  color: "var(--onboarding-title, #0f172a)",
+                  color: "var(--c-text, #0f172a)",
                   fontWeight: isSelected ? 600 : 500,
                 }}
               >
diff --git a/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.tsx b/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.tsx
index 89de08e6e7..d684592a4a 100644
--- a/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.tsx
+++ b/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.tsx
@@ -125,7 +125,7 @@ function FirstLoginForm({
                 icon="info-rounded"
                 width={20}
                 height={20}
-                style={{ color: "#3B82F6", flexShrink: 0 }}
+                style={{ color: "var(--c-primary)", flexShrink: 0 }}
               />
               <span>
                 {t(
diff --git a/frontend/editor/src/core/components/onboarding/slides/SecurityCheckSlide.tsx b/frontend/editor/src/core/components/onboarding/slides/SecurityCheckSlide.tsx
index 02b3e8502c..6101605772 100644
--- a/frontend/editor/src/core/components/onboarding/slides/SecurityCheckSlide.tsx
+++ b/frontend/editor/src/core/components/onboarding/slides/SecurityCheckSlide.tsx
@@ -26,7 +26,7 @@ export default function SecurityCheckSlide({
               icon="error"
               width={20}
               height={20}
-              style={{ color: "#F04438", flexShrink: 0 }}
+              style={{ color: "var(--c-danger)", flexShrink: 0 }}
             />
             <span>
               {i18n.t(
diff --git a/frontend/editor/src/core/components/pageEditor/DragDropGrid.module.css b/frontend/editor/src/core/components/pageEditor/DragDropGrid.module.css
index afad117774..519ec608e0 100644
--- a/frontend/editor/src/core/components/pageEditor/DragDropGrid.module.css
+++ b/frontend/editor/src/core/components/pageEditor/DragDropGrid.module.css
@@ -28,15 +28,15 @@
 
 .selectionBox {
   position: absolute;
-  border: 2px dashed #3b82f6;
-  background-color: rgba(59, 130, 246, 0.1);
+  border: 2px dashed var(--c-primary);
+  background-color: color-mix(in srgb, var(--c-primary) 10%, transparent);
   pointer-events: none;
 }
 
 .dropIndicator {
   position: absolute;
   width: 4px;
-  background-color: rgba(96, 165, 250, 0.8);
+  background-color: color-mix(in srgb, var(--c-primary) 80%, transparent);
   border-radius: 2px;
   pointer-events: none;
 }
@@ -50,8 +50,8 @@
   position: absolute;
   top: -8px;
   right: -8px;
-  background-color: #3b82f6;
-  color: #ffffff;
+  background-color: var(--c-primary);
+  color: var(--c-text-on-primary);
   border-radius: 50%;
   width: 32px;
   height: 32px;
diff --git a/frontend/editor/src/core/components/pageEditor/FileThumbnail.tsx b/frontend/editor/src/core/components/pageEditor/FileThumbnail.tsx
index 472fc141d7..f3730a9399 100644
--- a/frontend/editor/src/core/components/pageEditor/FileThumbnail.tsx
+++ b/frontend/editor/src/core/components/pageEditor/FileThumbnail.tsx
@@ -241,7 +241,7 @@ const FileThumbnail = ({
             <CheckboxIndicator
               checked={isSelected}
               onChange={() => onToggleFile(file.id)}
-              color="var(--checkbox-checked-bg)"
+              color="var(--c-primary)"
             />
           ) : (
             <div className={styles.unsupportedPill}>
@@ -372,7 +372,7 @@ const FileThumbnail = ({
                   objectFit: "contain",
                   borderRadius: 0,
                   background: "#ffffff",
-                  border: "1px solid var(--border-default)",
+                  border: "1px solid var(--c-border)",
                   display: "block",
                   marginLeft: "auto",
                   marginRight: "auto",
diff --git a/frontend/editor/src/core/components/pageEditor/PageEditor.module.css b/frontend/editor/src/core/components/pageEditor/PageEditor.module.css
index 3be018ffa2..fe8660a04a 100644
--- a/frontend/editor/src/core/components/pageEditor/PageEditor.module.css
+++ b/frontend/editor/src/core/components/pageEditor/PageEditor.module.css
@@ -21,13 +21,13 @@
 
 @keyframes pageMovedHighlight {
   0% {
-    background-color: rgba(59, 130, 246, 0.32);
+    background-color: color-mix(in srgb, var(--c-primary) 32%, transparent);
   }
   60% {
-    background-color: rgba(59, 130, 246, 0.12);
+    background-color: color-mix(in srgb, var(--c-primary) 12%, transparent);
   }
   100% {
-    background-color: rgba(59, 130, 246, 0);
+    background-color: color-mix(in srgb, var(--c-primary) 0%, transparent);
   }
 }
 
@@ -63,7 +63,7 @@
 
 /* Action styles */
 .actionRow:hover {
-  background: var(--hover-bg);
+  background: var(--c-hover);
 }
 
 .actionDanger {
@@ -72,7 +72,7 @@
 
 .actionsDivider {
   height: 1px;
-  background: var(--border-default);
+  background: var(--c-border);
   margin: 4px 0;
 }
 
@@ -86,7 +86,7 @@
 
 .unsupportedPill {
   margin-left: 1.75rem;
-  background: #6b7280;
+  background: var(--c-text-subtle);
   color: white;
   padding: 4px 8px;
   border-radius: 12px;
diff --git a/frontend/editor/src/core/components/pageEditor/PageEditorControls.tsx b/frontend/editor/src/core/components/pageEditor/PageEditorControls.tsx
index 96762a9203..fe73984fef 100644
--- a/frontend/editor/src/core/components/pageEditor/PageEditorControls.tsx
+++ b/frontend/editor/src/core/components/pageEditor/PageEditorControls.tsx
@@ -121,8 +121,8 @@ const PageEditorControls = ({
           borderBottomLeftRadius: 0,
           borderBottomRightRadius: 0,
           boxShadow: "0 -2px 8px rgba(0,0,0,0.04)",
-          backgroundColor: "var(--bg-toolbar)",
-          border: "1px solid var(--border-default)",
+          backgroundColor: "var(--c-bg-raised)",
+          border: "1px solid var(--c-border)",
           borderRadius: "16px 16px 0 0",
           pointerEvents: "auto",
           minWidth: 360,
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/BulkSelectionPanel.module.css b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/BulkSelectionPanel.module.css
index f80bebaa26..1ecd05808b 100644
--- a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/BulkSelectionPanel.module.css
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/BulkSelectionPanel.module.css
@@ -31,7 +31,7 @@
 
 .rightCol {
   width: 8rem;
-  border-left: 0.0625rem solid var(--border-default);
+  border-left: 0.0625rem solid var(--c-border);
   padding-left: 0.75rem;
   display: flex;
   flex-direction: column;
@@ -47,15 +47,15 @@
   width: 100%;
   border-radius: 1.25rem;
   border: 0.0625rem solid var(--bulk-card-border);
-  background-color: var(--bulk-card-bg);
-  color: var(--text-primary);
+  background-color: var(--c-surface);
+  color: var(--c-text);
   transition: all 0.2s ease;
   min-height: 2rem;
 }
 
 .operatorChip:hover:not(:disabled) {
   border-color: var(--bulk-card-hover-border);
-  background-color: var(--hover-bg);
+  background-color: var(--c-hover);
   transform: translateY(-0.0625rem);
   box-shadow: var(--shadow-sm);
 }
@@ -70,24 +70,12 @@
   cursor: not-allowed;
 }
 
-:global([data-mantine-color-scheme="dark"]) .operatorChip {
-  background-color: var(--bulk-card-bg);
-  border-color: var(--bulk-card-border);
-  color: var(--text-primary);
-}
-
-:global([data-mantine-color-scheme="dark"]) .operatorChip:hover:not(:disabled) {
-  background-color: var(--hover-bg);
-  border-color: var(--bulk-card-hover-border);
-  color: var(--text-primary);
-}
-
 .dropdownHeader {
   display: flex;
   justify-content: space-between;
   align-items: center;
   padding: 0.75rem;
-  border-bottom: 0.0625rem solid var(--border-default);
+  border-bottom: 0.0625rem solid var(--c-border);
   margin-bottom: 0.5rem;
 }
 
@@ -111,7 +99,7 @@
 }
 
 .chevron {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 
 /* Icon-based chevrons */
@@ -151,13 +139,13 @@
 .selectedList {
   max-height: 8rem;
   overflow: auto;
-  background-color: var(--bg-raised);
-  border: 0.0625rem solid var(--border-default);
+  background-color: var(--c-surface-raised);
+  border: 0.0625rem solid var(--c-border);
   border-radius: 0.75rem;
   padding: 0.5rem 0.75rem;
   margin-top: 0.5rem;
   min-width: 24rem;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 .selectedText {
@@ -175,7 +163,7 @@
   justify-content: space-between;
   align-items: center;
   padding: 0.75rem;
-  border-bottom: 0.0625rem solid var(--border-default);
+  border-bottom: 0.0625rem solid var(--c-border);
   margin-bottom: 0.5rem;
 }
 
@@ -193,26 +181,18 @@
 }
 
 .advancedItem:hover {
-  background-color: var(--hover-bg);
-}
-
-:global([data-mantine-color-scheme="dark"]) .advancedItem:hover {
-  background-color: var(--hover-bg);
+  background-color: var(--c-hover);
 }
 
 .advancedCard {
-  background-color: var(--bulk-card-bg);
+  background-color: var(--c-surface);
   border: none;
   border-radius: 0.75rem;
   padding: 0.25rem;
   margin-bottom: 0.5rem;
   width: 100%;
   box-sizing: border-box;
-  color: var(--text-primary);
-}
-
-:global([data-mantine-color-scheme="dark"]) .advancedCard {
-  background-color: var(--bulk-card-bg);
+  color: var(--c-text);
 }
 
 .inputGroup {
@@ -226,24 +206,17 @@
 .applyButton {
   min-width: 4rem;
   flex-shrink: 0;
-}
-
-/* Style inputs and buttons within advanced cards to match bg-raised */
-.advancedCard :global(.mantine-NumberInput-input) {
-  background-color: var(--bg-raised) !important;
-  border-color: var(--border-default) !important;
-  color: var(--text-primary) !important;
-}
-
+} /* Style inputs and buttons within advanced cards to match bg-raised */
+.advancedCard :global(.mantine-NumberInput-input),
 .advancedCard :global(.mantine-Button-root) {
-  background-color: var(--bg-raised) !important;
-  border-color: var(--border-default) !important;
-  color: var(--text-primary) !important;
+  background-color: var(--c-surface-raised) !important;
+  border-color: var(--c-border) !important;
+  color: var(--c-text) !important;
 }
 
 .advancedCard :global(.mantine-Button-root:hover) {
-  background-color: var(--hover-bg) !important;
-  border-color: var(--border-strong) !important;
+  background-color: var(--c-hover) !important;
+  border-color: var(--c-border-strong) !important;
 }
 
 /* Error helper text above the input */
@@ -254,8 +227,8 @@
 
 /* Compact error container for inline tool settings */
 .errorCompact {
-  background-color: var(--bg-raised);
-  border: 0.0625rem solid var(--border-default);
+  background-color: var(--c-surface-raised);
+  border: 0.0625rem solid var(--c-border);
   border-radius: 0.75rem;
   padding: 0.5rem 0.75rem;
   margin-top: 0.5rem;
@@ -271,11 +244,6 @@
   overflow: hidden;
 }
 
-/* Dark-mode adjustments */
-:global([data-mantine-color-scheme="dark"]) .selectedList {
-  background-color: var(--bg-raised);
-}
-
 /* Small screens: allow the section to shrink instead of enforcing a large min width */
 @media (max-width: 480px) {
   .panelGroup,
@@ -290,16 +258,16 @@
 .panelContainer {
   max-height: 95vh;
   overflow: auto;
-  background-color: var(--bulk-panel-bg);
-  color: var(--text-primary);
+  background-color: var(--c-surface);
+  color: var(--c-text);
   border-radius: 0.5rem;
 }
 
 /* Override Mantine Popover dropdown background */
 :global(.mantine-Popover-dropdown) {
-  background-color: var(--bulk-panel-bg) !important;
+  background-color: var(--c-surface) !important;
   border-color: var(--bulk-card-border) !important;
-  color: var(--text-primary) !important;
+  color: var(--c-text) !important;
 }
 
 /* Override Mantine Switch outline */
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.tsx b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.tsx
index d2ff79ad97..682a134268 100644
--- a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.tsx
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.tsx
@@ -17,7 +17,7 @@ const OperatorsSection = ({
 
   return (
     <div>
-      <Text size="xs" c="var(--text-muted)" fw={500} mb="xs">
+      <Text size="xs" c="var(--c-text-subtle)" fw={500} mb="xs">
         {t("bulkSelection.keywords.title", "Keywords")}:
       </Text>
       <Group gap="sm" wrap="nowrap">
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/PageSelectionInput.tsx b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/PageSelectionInput.tsx
index 2e5513a7c8..f0add9d978 100644
--- a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/PageSelectionInput.tsx
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/PageSelectionInput.tsx
@@ -44,7 +44,7 @@ const PageSelectionInput = ({
               icon="gpp-maybe-outline-rounded"
               width="1rem"
               height="1rem"
-              style={{ color: "var(--text-instruction)" }}
+              style={{ color: "var(--c-accent-fg)" }}
             />
             <Text>
               {t("bulkSelection.pageSelection.title", "Page Selection")}
@@ -53,7 +53,7 @@ const PageSelectionInput = ({
         </Tooltip>
         {typeof advancedOpened === "boolean" && (
           <Flex align="center" gap="xs">
-            <Text size="sm" c="var(--text-secondary)">
+            <Text size="sm" c="var(--c-text-muted)">
               {t("bulkSelection.advanced.title", "Advanced")}
             </Text>
             <Switch
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.tsx b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.tsx
index 5fc7341430..d2daa6499c 100644
--- a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.tsx
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.tsx
@@ -50,7 +50,7 @@ const SelectPages = ({
 
   return (
     <div className={classes.advancedCard}>
-      <Text size="sm" fw={600} c="var(--text-secondary)" mb="xs">
+      <Text size="sm" fw={600} c="var(--c-text-muted)" mb="xs">
         {title}
       </Text>
       {error && (
diff --git a/frontend/editor/src/core/components/shared/AppConfigModal.css b/frontend/editor/src/core/components/shared/AppConfigModal.css
index 3f979258fb..46033eaf97 100644
--- a/frontend/editor/src/core/components/shared/AppConfigModal.css
+++ b/frontend/editor/src/core/components/shared/AppConfigModal.css
@@ -63,7 +63,8 @@
 }
 
 .modal-nav-scroll:hover {
-  scrollbar-color: rgba(128, 128, 128, 0.5) transparent;
+  scrollbar-color: color-mix(in srgb, var(--c-border-strong) 50%, transparent)
+    transparent;
 }
 
 .modal-nav-scroll::-webkit-scrollbar {
@@ -81,11 +82,11 @@
 }
 
 .modal-nav-scroll:hover::-webkit-scrollbar-thumb {
-  background-color: rgba(128, 128, 128, 0.5);
+  background-color: color-mix(in srgb, var(--c-border-strong) 50%, transparent);
 }
 
 .modal-nav-scroll::-webkit-scrollbar-thumb:hover {
-  background-color: rgba(128, 128, 128, 0.7);
+  background-color: color-mix(in srgb, var(--c-border-strong) 70%, transparent);
 }
 
 .modal-nav-section {
@@ -131,7 +132,8 @@
 }
 
 .modal-content-scroll:hover {
-  scrollbar-color: rgba(128, 128, 128, 0.5) transparent;
+  scrollbar-color: color-mix(in srgb, var(--c-border-strong) 50%, transparent)
+    transparent;
 }
 
 .modal-content-scroll::-webkit-scrollbar {
@@ -149,11 +151,11 @@
 }
 
 .modal-content-scroll:hover::-webkit-scrollbar-thumb {
-  background-color: rgba(128, 128, 128, 0.5);
+  background-color: color-mix(in srgb, var(--c-border-strong) 50%, transparent);
 }
 
 .modal-content-scroll::-webkit-scrollbar-thumb:hover {
-  background-color: rgba(128, 128, 128, 0.7);
+  background-color: color-mix(in srgb, var(--c-border-strong) 70%, transparent);
 }
 
 .modal-header {
@@ -212,8 +214,8 @@
   bottom: 0;
   left: 0;
   right: 0;
-  background: var(--modal-content-bg);
-  border-top: 1px solid var(--modal-header-border);
+  background: var(--c-surface);
+  border-top: 1px solid var(--c-border-subtle);
   padding: 1rem 2rem;
   margin: 0 -2rem;
   margin-bottom: -1rem;
diff --git a/frontend/editor/src/core/components/shared/AppConfigModal.tsx b/frontend/editor/src/core/components/shared/AppConfigModal.tsx
index 1a9485cce8..9ad7963b6f 100644
--- a/frontend/editor/src/core/components/shared/AppConfigModal.tsx
+++ b/frontend/editor/src/core/components/shared/AppConfigModal.tsx
@@ -165,13 +165,13 @@ const AppConfigModalInner: React.FC<AppConfigModalProps> = ({
 
   const colors = useMemo(
     () => ({
-      navBg: "var(--modal-nav-bg)",
-      sectionTitle: "var(--modal-nav-section-title)",
+      navBg: "var(--c-bg-raised)",
+      sectionTitle: "var(--c-text-subtle)",
       navItem: "var(--modal-nav-item)",
-      navItemActive: "var(--modal-nav-item-active)",
-      navItemActiveBg: "var(--modal-nav-item-active-bg)",
-      contentBg: "var(--modal-content-bg)",
-      headerBorder: "var(--modal-header-border)",
+      navItemActive: "var(--c-accent-fg)",
+      navItemActiveBg: "var(--c-primary-subtle)",
+      contentBg: "var(--c-surface)",
+      headerBorder: "var(--c-border-subtle)",
     }),
     [],
   );
diff --git a/frontend/editor/src/core/components/shared/AppSwitch.css b/frontend/editor/src/core/components/shared/AppSwitch.css
index c40080b1e9..bccf8fbceb 100644
--- a/frontend/editor/src/core/components/shared/AppSwitch.css
+++ b/frontend/editor/src/core/components/shared/AppSwitch.css
@@ -9,15 +9,15 @@
   background: none;
   cursor: pointer;
   border-radius: var(--radius-sm);
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   transition:
     background var(--motion-fast),
     color var(--motion-fast);
 }
 
 .app-switch-btn:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-2);
+  background: var(--c-hover);
+  color: var(--c-text-muted);
 }
 
 .app-switch-icon {
diff --git a/frontend/editor/src/core/components/shared/Badge.tsx b/frontend/editor/src/core/components/shared/Badge.tsx
index dd15bec465..04ca973a8e 100644
--- a/frontend/editor/src/core/components/shared/Badge.tsx
+++ b/frontend/editor/src/core/components/shared/Badge.tsx
@@ -79,8 +79,8 @@ const Badge: React.FC<BadgeProps> = ({
 
     // Default styling
     return {
-      background: "var(--tool-header-badge-bg)",
-      color: "var(--tool-header-badge-text)",
+      background: "var(--c-surface-raised)",
+      color: "var(--c-accent-fg)",
     };
   };
 
diff --git a/frontend/editor/src/core/components/shared/EditableSecretField.tsx b/frontend/editor/src/core/components/shared/EditableSecretField.tsx
index 24e6d881c3..4168996959 100644
--- a/frontend/editor/src/core/components/shared/EditableSecretField.tsx
+++ b/frontend/editor/src/core/components/shared/EditableSecretField.tsx
@@ -78,7 +78,11 @@ export default function EditableSecretField({
       )}
       {description && (
         <p
-          style={{ margin: "4px 0 12px 0", fontSize: "0.75rem", color: "#666" }}
+          style={{
+            margin: "4px 0 12px 0",
+            fontSize: "0.75rem",
+            color: "var(--c-text-muted)",
+          }}
         >
           {description}
         </p>
diff --git a/frontend/editor/src/core/components/shared/ErrorBoundary.tsx b/frontend/editor/src/core/components/shared/ErrorBoundary.tsx
index a2003a7d61..b5330058c4 100644
--- a/frontend/editor/src/core/components/shared/ErrorBoundary.tsx
+++ b/frontend/editor/src/core/components/shared/ErrorBoundary.tsx
@@ -117,7 +117,7 @@ export default class ErrorBoundary extends React.Component<
                     style={{
                       fontSize: "0.75rem",
                       overflow: "auto",
-                      backgroundColor: "#f5f5f5",
+                      backgroundColor: "var(--c-surface-sunken)",
                       padding: "1rem",
                       borderRadius: "4px",
                       maxHeight: "300px",
diff --git a/frontend/editor/src/core/components/shared/FileCard.tsx b/frontend/editor/src/core/components/shared/FileCard.tsx
index c731092459..e43dbeeb1c 100644
--- a/frontend/editor/src/core/components/shared/FileCard.tsx
+++ b/frontend/editor/src/core/components/shared/FileCard.tsx
@@ -74,7 +74,7 @@ const FileCard = ({
       <Stack gap={6} align="center">
         <Box
           style={{
-            border: "2px solid #e0e0e0",
+            border: "2px solid var(--c-border)",
             borderRadius: 8,
             width: 90,
             height: 120,
@@ -82,7 +82,7 @@ const FileCard = ({
             alignItems: "center",
             justifyContent: "center",
             margin: "0 auto",
-            background: "#fafbfc",
+            background: "var(--c-surface)",
             position: "relative",
           }}
         >
diff --git a/frontend/editor/src/core/components/shared/FileDropdownMenu.tsx b/frontend/editor/src/core/components/shared/FileDropdownMenu.tsx
index 735d633fee..00eb8b7c56 100644
--- a/frontend/editor/src/core/components/shared/FileDropdownMenu.tsx
+++ b/frontend/editor/src/core/components/shared/FileDropdownMenu.tsx
@@ -54,8 +54,8 @@ export const FileDropdownMenu: React.FC<FileDropdownMenuProps> = ({
       </Menu.Target>
       <Menu.Dropdown
         style={{
-          backgroundColor: "var(--bg-file-manager)",
-          border: "1px solid var(--border-subtle)",
+          backgroundColor: "var(--c-bg)",
+          border: "1px solid var(--c-border-subtle)",
           borderRadius: "8px",
           boxShadow: "0 2px 8px rgba(0, 0, 0, 0.15)",
           maxHeight: "50vh",
diff --git a/frontend/editor/src/core/components/shared/FileSelectorPicker.module.css b/frontend/editor/src/core/components/shared/FileSelectorPicker.module.css
index 89c57dd3fa..cb388c28aa 100644
--- a/frontend/editor/src/core/components/shared/FileSelectorPicker.module.css
+++ b/frontend/editor/src/core/components/shared/FileSelectorPicker.module.css
@@ -1,9 +1,9 @@
 /* ── Trigger ─────────────────────────────────────── */
 .trigger {
-  border: 1px solid var(--border-default);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
   padding: 0.5rem 0.75rem;
-  background: var(--bg-surface);
+  background: var(--c-surface);
   cursor: pointer;
   flex: 1;
   min-width: 0;
@@ -47,8 +47,8 @@
   justify-content: space-between;
   padding: 0.3rem 0.45rem;
   gap: 0.4rem;
-  border-bottom: 1px solid var(--border-default);
-  background: var(--bg-surface);
+  border-bottom: 1px solid var(--c-border);
+  background: var(--c-surface);
 }
 
 .tabGroup {
@@ -66,7 +66,7 @@
   min-width: 0;
   min-height: 24px;
   max-height: 26px;
-  border: 1px solid var(--border-default);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-sm);
   background: color-mix(
     in srgb,
@@ -185,8 +185,8 @@
 /* ── Search / filter row ─────────────────────────── */
 .searchRow {
   padding: 0.3rem 0.45rem;
-  border-bottom: 1px solid var(--border-default);
-  background: var(--bg-surface);
+  border-bottom: 1px solid var(--c-border);
+  background: var(--c-surface);
 }
 
 .searchInput {
@@ -195,7 +195,7 @@
   height: 1.625rem;
   padding: 0 0.5rem;
   font-size: 0.7rem;
-  border: 1px solid var(--border-subtle, var(--border-default));
+  border: 1px solid var(--c-border-subtle, var(--c-border));
   border-radius: var(--radius-sm);
   background: var(--mantine-color-default-hover);
   color: var(--mantine-color-text);
@@ -233,7 +233,7 @@
   cursor: pointer;
   background: transparent;
   border: none;
-  border-top: 1px solid var(--border-default);
+  border-top: 1px solid var(--c-border);
   text-align: left;
   transition: background 0.08s ease;
 }
diff --git a/frontend/editor/src/core/components/shared/FileSidebar.css b/frontend/editor/src/core/components/shared/FileSidebar.css
index 3261f60211..5832609680 100644
--- a/frontend/editor/src/core/components/shared/FileSidebar.css
+++ b/frontend/editor/src/core/components/shared/FileSidebar.css
@@ -1,8 +1,8 @@
 /* ========== FILE SIDEBAR ========== */
 
 .file-sidebar {
-  background-color: var(--bg-toolbar);
-  border-right: 1px solid var(--border-subtle);
+  background-color: var(--c-bg-raised);
+  border-right: 1px solid var(--c-border-subtle);
   display: flex;
   flex-direction: column;
   height: 100%;
@@ -24,7 +24,7 @@
 
 /* ---- Native file drag-and-drop ---- */
 .file-sidebar[data-file-drag-over] {
-  outline: 2px dashed var(--mantine-color-blue-6, #3b82f6);
+  outline: 2px dashed var(--mantine-color-blue-6, var(--c-primary));
   outline-offset: -4px;
 }
 
@@ -42,20 +42,20 @@
   pointer-events: none;
   background-color: color-mix(
     in srgb,
-    var(--mantine-color-blue-6, #3b82f6) 12%,
-    var(--bg-toolbar)
+    var(--mantine-color-blue-6, var(--c-primary)) 12%,
+    var(--c-bg-raised)
   );
 }
 
 .file-sidebar-drop-overlay-icon {
-  color: var(--mantine-color-blue-6, #3b82f6) !important;
+  color: var(--mantine-color-blue-6, var(--c-primary)) !important;
   font-size: 28px !important;
 }
 
 .file-sidebar-drop-overlay-text {
   font-size: 13px;
   font-weight: 600;
-  color: var(--mantine-color-blue-6, #3b82f6);
+  color: var(--mantine-color-blue-6, var(--c-primary));
 }
 
 /* ---- Header ---- */
@@ -75,11 +75,11 @@
 /* Icons stay left-aligned during animation; overflow:hidden on inner clips text naturally */
 
 .file-sidebar-header:hover {
-  background-color: var(--hover-bg);
+  background-color: var(--c-hover);
 }
 
 .file-sidebar-menu-icon {
-  color: var(--text-muted) !important;
+  color: var(--c-text-subtle) !important;
   font-size: 18px !important;
   flex-shrink: 0;
 }
@@ -129,11 +129,11 @@
 }
 
 .file-sidebar-search-row:not(.active):hover {
-  background-color: var(--hover-bg);
+  background-color: var(--c-hover);
 }
 
 .file-sidebar-search-icon {
-  color: var(--text-muted) !important;
+  color: var(--c-text-subtle) !important;
   font-size: 18px !important;
   flex-shrink: 0;
 }
@@ -148,19 +148,19 @@
   border: none;
   outline: none;
   font-size: 14px;
-  color: var(--text-primary);
+  color: var(--c-text);
   margin-left: 12px;
   min-width: 0;
 }
 
 .file-sidebar-search-input::placeholder {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 
 .file-sidebar-search-label {
   margin-left: 12px;
   font-size: 14px;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
 }
 
 /* ---- Scrollable content ---- */
@@ -199,7 +199,7 @@
 }
 
 .file-sidebar-action-row:hover {
-  background-color: var(--hover-bg);
+  background-color: var(--c-hover);
 }
 
 .file-sidebar-action-row.disabled {
@@ -212,7 +212,7 @@
 }
 
 .file-sidebar-action-icon {
-  color: var(--text-muted) !important;
+  color: var(--c-text-subtle) !important;
   font-size: 18px !important;
   flex-shrink: 0;
   display: inline-flex;
@@ -234,7 +234,7 @@
 .file-sidebar-action-label {
   margin-left: 12px;
   font-size: 14px;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   white-space: nowrap;
 }
 
@@ -253,7 +253,7 @@
 }
 
 .file-sidebar-cloud-row:not(.disabled):hover {
-  background-color: var(--hover-bg);
+  background-color: var(--c-hover);
 }
 
 .file-sidebar-cloud-row.disabled {
@@ -320,19 +320,19 @@
   border: none;
   background: transparent;
   cursor: pointer;
-  color: var(--text-default, var(--color-text-1));
+  color: var(--text-default, var(--c-text));
   border-radius: 0;
   font-size: 13px;
   font-weight: 600;
   text-align: left;
 }
 .file-sidebar-group-header:hover {
-  background: var(--hover-bg, var(--color-bg-hover));
+  background: var(--c-hover, var(--c-hover));
 }
 
 .file-sidebar-group-icon {
   flex: none;
-  color: var(--text-muted, var(--color-text-3));
+  color: var(--c-text-subtle, var(--c-text-subtle));
 }
 
 .file-sidebar-group-label {
@@ -347,7 +347,7 @@
   flex: none;
   font-size: 11px;
   font-weight: 500;
-  color: var(--text-muted, var(--color-text-3));
+  color: var(--c-text-subtle, var(--c-text-subtle));
 }
 
 /* Full-width, flat rows: no inset, no radius, so the hover/selected highlight
@@ -363,7 +363,7 @@
 }
 /* Hover reads neutral (not the default blue tint); selected stays blue. */
 .file-sidebar-group-items .file-sidebar-file-item:hover:not(.selected) {
-  background-color: var(--color-bg-hover, rgba(120, 120, 120, 0.1));
+  background-color: var(--c-hover);
 }
 /* A plain circle where the selected check sits — on hover, and blue when selected. */
 .file-sidebar-group-items .file-sidebar-file-checkbox-hover,
@@ -413,7 +413,7 @@
   border: none;
   background: transparent;
   cursor: pointer;
-  color: var(--color-blue, #2563eb);
+  color: var(--c-accent-fg, var(--c-primary));
   font-size: 12px;
   font-weight: 500;
   border-radius: 6px;
@@ -424,7 +424,7 @@
   display: none;
 }
 .file-sidebar-view-all:hover {
-  background: var(--color-bg-hover, rgba(120, 120, 120, 0.1));
+  background: var(--c-hover);
 }
 
 .file-sidebar-file-list::-webkit-scrollbar {
@@ -438,11 +438,11 @@
   border-radius: 2px;
 }
 .file-sidebar-file-list::-webkit-scrollbar-thumb:hover {
-  background: var(--text-muted);
+  background: var(--c-text-subtle);
 }
 
 .file-sidebar-section-divider {
-  border-top: 1px solid var(--border-subtle);
+  border-top: 1px solid var(--c-border-subtle);
   margin: 10px 14px 6px 14px;
 }
 
@@ -457,7 +457,7 @@
 
 .file-sidebar-section-header {
   position: relative;
-  border-top: 1px solid var(--border-subtle);
+  border-top: 1px solid var(--c-border-subtle);
   padding-top: 10px;
   margin-top: 4px;
   flex-shrink: 0;
@@ -467,7 +467,7 @@
   font-size: 13px;
   font-weight: 600;
   letter-spacing: 0.02em;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   text-transform: uppercase;
 }
 
@@ -481,7 +481,7 @@
   align-items: center;
   justify-content: space-between;
   font-size: 11px;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin-bottom: 4px;
 }
 .file-sidebar-bulk-add-count {
@@ -490,19 +490,19 @@
 .file-sidebar-bulk-add-track {
   height: 3px;
   border-radius: 999px;
-  background: color-mix(in srgb, var(--color-blue, #3b82f6) 15%, transparent);
+  background: color-mix(in srgb, var(--c-primary) 15%, transparent);
   overflow: hidden;
 }
 .file-sidebar-bulk-add-bar {
   height: 100%;
   border-radius: 999px;
-  background: var(--color-blue, #3b82f6);
+  background: var(--c-primary);
   transition: width 0.15s ease-out;
 }
 
 .file-sidebar-section-count {
   font-size: 11px;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 
 .file-sidebar-section-btn {
@@ -515,7 +515,7 @@
   background: transparent;
   border-radius: 4px;
   cursor: pointer;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   padding: 0;
   outline: none;
   transition:
@@ -525,13 +525,13 @@
 }
 
 .file-sidebar-section-btn:focus-visible {
-  outline: 2px solid #3b82f6;
+  outline: 2px solid var(--c-primary);
   outline-offset: 1px;
 }
 
 .file-sidebar-section-btn:hover {
-  background-color: var(--hover-bg);
-  color: var(--text-primary);
+  background-color: var(--c-hover);
+  color: var(--c-text);
 }
 
 .file-sidebar-section-btn-external {
@@ -576,7 +576,7 @@
   align-items: center;
   gap: 8px;
   padding: 8px 10px;
-  border-top: 1px solid var(--border-subtle);
+  border-top: 1px solid var(--c-border-subtle);
   flex-shrink: 0;
   min-height: 48px;
 }
@@ -587,8 +587,8 @@
   width: 28px;
   height: 28px;
   border-radius: 50%;
-  background-color: var(--mantine-color-blue-6, #3b82f6);
-  color: #fff;
+  background-color: var(--mantine-color-blue-6, var(--c-primary));
+  color: var(--c-text-on-primary);
   font-size: 12px;
   font-weight: 600;
   display: flex;
@@ -615,7 +615,7 @@
   flex: 1;
   font-size: 13px;
   font-weight: 500;
-  color: var(--text-primary);
+  color: var(--c-text);
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
@@ -623,11 +623,11 @@
 }
 
 .file-sidebar-bottom-bar[role="button"]:hover {
-  background-color: var(--hover-bg);
+  background-color: var(--c-hover);
 }
 
 .file-sidebar-bottom-bar[role="button"]:focus-visible {
-  outline: 2px solid #3b82f6;
+  outline: 2px solid var(--c-primary);
   outline-offset: -2px;
 }
 
@@ -638,7 +638,7 @@
   width: 28px;
   height: 28px;
   border-radius: 6px;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   padding: 0;
   flex-shrink: 0;
   margin-left: auto;
diff --git a/frontend/editor/src/core/components/shared/FileSidebar.tsx b/frontend/editor/src/core/components/shared/FileSidebar.tsx
index b5c815f824..501c5385d1 100644
--- a/frontend/editor/src/core/components/shared/FileSidebar.tsx
+++ b/frontend/editor/src/core/components/shared/FileSidebar.tsx
@@ -1114,7 +1114,7 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
                   <div className="file-sidebar-cloud-icon-wrapper">
                     <GoogleDriveIcon
                       className="file-sidebar-cloud-icon-gray"
-                      style={{ color: "var(--text-secondary)" }}
+                      style={{ color: "var(--c-text-muted)" }}
                     />
                     {isGoogleDriveEnabled && (
                       <GoogleDriveIcon
@@ -1145,7 +1145,7 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
                 aria-label={t("watchedFolders.sidebarTitle", "Watched Folders")}
                 style={
                   isWatchedFoldersActive
-                    ? { backgroundColor: "var(--active-bg)" }
+                    ? { backgroundColor: "var(--c-active)" }
                     : undefined
                 }
               >
@@ -1197,7 +1197,7 @@ const FileSidebar = forwardRef<HTMLDivElement, FileSidebarProps>(
 
                 {!stubsLoaded ? (
                   <div className="file-sidebar-loading">
-                    <Loader size="sm" color="var(--text-muted)" />
+                    <Loader size="sm" color="var(--c-text-subtle)" />
                   </div>
                 ) : filteredFileStubs.length > 0 ? (
                   <div className="file-sidebar-file-list">
diff --git a/frontend/editor/src/core/components/shared/FileSidebarFileItem.css b/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
index 09c0c5e8eb..4d742f7be6 100644
--- a/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
+++ b/frontend/editor/src/core/components/shared/FileSidebarFileItem.css
@@ -17,7 +17,7 @@
   background: transparent;
 }
 .file-sidebar-file-list::-webkit-scrollbar-thumb {
-  background: rgb(var(--border));
+  background: var(--c-border);
   border-radius: 2px;
 }
 
@@ -63,15 +63,15 @@
 }
 
 .file-sidebar-file-item:hover:not(.selected) {
-  background-color: rgba(59, 130, 246, 0.06);
+  background-color: color-mix(in srgb, var(--c-primary) 6%, transparent);
 }
 
 .file-sidebar-file-item.selected {
-  background-color: rgba(59, 130, 246, 0.12);
+  background-color: color-mix(in srgb, var(--c-primary) 12%, transparent);
 }
 
 .file-sidebar-file-item.active:not(.selected) {
-  background-color: rgba(59, 130, 246, 0.06);
+  background-color: color-mix(in srgb, var(--c-primary) 6%, transparent);
 }
 
 /* Icon wrapper */
@@ -95,7 +95,7 @@
   width: 20px;
   height: 20px;
   border-radius: 5px;
-  border: 1.5px solid var(--border-hover, var(--border-strong));
+  border: 1.5px solid var(--c-border-strong);
 }
 
 .file-sidebar-file-item:hover .file-sidebar-file-checkbox-hover {
@@ -116,7 +116,7 @@
   width: 20px;
   height: 20px;
   border-radius: 5px;
-  background-color: #3b82f6;
+  background-color: var(--c-primary);
   display: flex;
   align-items: center;
   justify-content: center;
@@ -124,7 +124,7 @@
 }
 
 .file-sidebar-check-svg {
-  color: white;
+  color: var(--c-text-on-primary);
   flex-shrink: 0;
 }
 
@@ -179,14 +179,14 @@
   display: block;
   font-size: 13px;
   font-weight: 500;
-  color: var(--text-primary);
+  color: var(--c-text);
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
 }
 
 .file-sidebar-file-item.selected .file-sidebar-file-name {
-  color: #3b82f6;
+  color: var(--c-accent-fg);
 }
 
 .file-sidebar-file-meta-row {
@@ -199,7 +199,7 @@
 
 .file-sidebar-file-meta {
   font-size: 11px;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
@@ -211,7 +211,7 @@
   align-items: center;
   justify-content: center;
   flex-shrink: 0;
-  color: var(--accent-interactive, #6366f1);
+  color: var(--c-primary);
 }
 
 /* ---- Folder membership tags ---- */
@@ -250,7 +250,7 @@
   font-size: 10px;
   font-weight: 600;
   line-height: 1.2;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
@@ -260,7 +260,7 @@
   font-size: 10px;
   font-weight: 600;
   line-height: 1;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   cursor: default;
   flex-shrink: 0;
 }
@@ -277,7 +277,7 @@
   background: transparent;
   border-radius: 4px;
   cursor: pointer;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   padding: 0;
   opacity: 0;
   transition:
@@ -297,48 +297,45 @@
   bottom: 0;
   z-index: 2;
   /* solid base + green tint overlay so content behind doesn't bleed through */
-  background-color: var(--bg-toolbar);
+  background-color: var(--c-bg-raised);
   background-image: linear-gradient(
-    rgba(34, 197, 94, 0.1),
-    rgba(34, 197, 94, 0.1)
+    color-mix(in srgb, var(--c-success) 10%, transparent),
+    color-mix(in srgb, var(--c-success) 10%, transparent)
   );
 }
 
 .file-sidebar-file-item.viewed .file-sidebar-file-name {
-  color: #22c55e;
+  color: var(--c-success);
 }
 
 .file-sidebar-file-item.viewed .file-sidebar-file-check {
-  background-color: #22c55e;
+  background-color: var(--c-success);
 }
 
 /* viewed takes precedence over selected */
 .file-sidebar-file-item.viewed.selected {
-  background-color: var(--bg-toolbar);
+  background-color: var(--c-bg-raised);
   background-image: linear-gradient(
-    rgba(34, 197, 94, 0.1),
-    rgba(34, 197, 94, 0.1)
+    color-mix(in srgb, var(--c-success) 10%, transparent),
+    color-mix(in srgb, var(--c-success) 10%, transparent)
   );
 }
 
 /* Always show eye for the currently viewed file */
 .file-sidebar-file-item.viewed .file-sidebar-eye-btn {
   opacity: 1;
-  color: #22c55e;
+  color: var(--c-success);
 }
 
 .file-sidebar-eye-btn:hover {
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 /* Eye open: shown by default */
 .file-sidebar-eye-open {
   display: block !important;
 }
-.file-sidebar-eye-closed {
-  display: none !important;
-}
-
+.file-sidebar-eye-closed,
 /* On hover over a viewed item: swap to eye-closed */
 .file-sidebar-file-item.viewed:hover .file-sidebar-eye-open {
   display: none !important;
@@ -359,7 +356,7 @@
   background: transparent;
   border-radius: 4px;
   cursor: pointer;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   padding: 0;
   opacity: 0;
   transition:
@@ -376,14 +373,14 @@
 }
 
 .file-sidebar-kebab-btn:hover {
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 /* ---- Date group headers ---- */
 .file-sidebar-date-group-header {
   font-size: 11px;
   font-weight: 500;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   padding: 0 10px 2px 10px;
   margin-top: 8px;
   user-select: none;
@@ -410,13 +407,13 @@
 
 .file-sidebar-empty-text {
   font-size: 12px;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin: 0 0 2px 0;
 }
 
 .file-sidebar-empty-hint {
   font-size: 11px;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   opacity: 0.7;
   margin: 0;
 }
@@ -426,8 +423,8 @@
   position: fixed;
   z-index: 9999;
   transform: translateY(-50%);
-  background: var(--bg-surface, #fff);
-  border: 1px solid var(--border-subtle);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 8px;
   box-shadow: 0 8px 24px rgba(0, 0, 0, 0.18);
   padding: 4px;
diff --git a/frontend/editor/src/core/components/shared/Footer.tsx b/frontend/editor/src/core/components/shared/Footer.tsx
index 2fb7312fba..8ae0d3d4c1 100644
--- a/frontend/editor/src/core/components/shared/Footer.tsx
+++ b/frontend/editor/src/core/components/shared/Footer.tsx
@@ -54,8 +54,8 @@ export default function Footer({
     <div
       style={{
         height: "var(--footer-height)",
-        backgroundColor: "var(--bg-surface)",
-        borderTop: "1px solid var(--border-subtle)",
+        backgroundColor: "var(--c-surface)",
+        borderTop: "1px solid var(--c-border-subtle)",
         display: "flex",
         flexDirection: "column",
         justifyContent: "center",
diff --git a/frontend/editor/src/core/components/shared/HoverActionMenu.module.css b/frontend/editor/src/core/components/shared/HoverActionMenu.module.css
index 61d17eb404..d7c7b39e9e 100644
--- a/frontend/editor/src/core/components/shared/HoverActionMenu.module.css
+++ b/frontend/editor/src/core/components/shared/HoverActionMenu.module.css
@@ -6,8 +6,8 @@
   display: flex;
   gap: 8px;
   align-items: center;
-  background: var(--bg-toolbar);
-  border: 1px solid var(--border-default);
+  background: var(--c-bg-raised);
+  border: 1px solid var(--c-border);
   padding: 6px 12px;
   border-radius: 20px;
   box-shadow: var(--shadow-md);
diff --git a/frontend/editor/src/core/components/shared/HoverActionMenu.tsx b/frontend/editor/src/core/components/shared/HoverActionMenu.tsx
index d912aace48..68660ede47 100644
--- a/frontend/editor/src/core/components/shared/HoverActionMenu.tsx
+++ b/frontend/editor/src/core/components/shared/HoverActionMenu.tsx
@@ -70,7 +70,7 @@ const HoverActionMenu: React.FC<HoverActionMenuProps> = ({
               disabled={action.disabled}
               onClick={action.onClick}
               aria-label={action.label}
-              style={{ color: action.color || "var(--text-secondary)" }}
+              style={{ color: action.color || "var(--c-text-muted)" }}
               data-tour={action.dataTour}
             >
               {action.icon}
diff --git a/frontend/editor/src/core/components/shared/LandingPage.css b/frontend/editor/src/core/components/shared/LandingPage.css
index 8762c1368d..57729a806a 100644
--- a/frontend/editor/src/core/components/shared/LandingPage.css
+++ b/frontend/editor/src/core/components/shared/LandingPage.css
@@ -10,7 +10,7 @@
   font-size: 2rem;
   font-weight: 700;
   line-height: 1.25;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 .landing-subtitle {
@@ -20,7 +20,7 @@
   font-size: 0.9375rem;
   line-height: 1.5;
   max-width: 28rem;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
 }
 
 /* ── Document stack ──────────────────────────────────────── */
@@ -49,7 +49,7 @@
   width: 128px;
   height: 160px;
   transform-origin: bottom center;
-  border: 1px solid #e5e7eb;
+  border: 1px solid var(--c-illustration-line);
   box-shadow: var(--landing-doc-shadow-back-idle);
 }
 
@@ -103,10 +103,10 @@
 /* Bars — static light colours, never change with theme */
 .landing-bar {
   border-radius: 9999px;
-  background-color: #e5e7eb;
+  background-color: var(--c-illustration-line);
 }
 .landing-bar--strong {
-  background-color: #d1d5db;
+  background-color: var(--c-illustration-line-strong);
 }
 
 /* ── Action buttons ──────────────────────────────────────── */
@@ -121,27 +121,27 @@
 .landing-btn-secondary {
   border-radius: 0.75rem !important;
   font-weight: 600 !important;
-  border-color: var(--landing-button-border, var(--border-default)) !important;
-  background-color: var(--landing-button-bg, var(--bg-surface)) !important;
-  color: var(--landing-button-color, var(--text-primary)) !important;
+  border-color: var(--landing-button-border, var(--c-border)) !important;
+  background-color: var(--landing-button-bg, var(--c-surface)) !important;
+  color: var(--c-accent-fg, var(--c-text)) !important;
 }
 .landing-btn-secondary:hover {
   background-color: var(
     --landing-button-hover-bg,
-    var(--landing-button-bg, var(--bg-surface))
+    var(--landing-button-bg, var(--c-surface))
   ) !important;
 }
 
 /* Icon-only variant: accent colour instead of button text colour */
 .landing-btn-icon {
-  color: var(--accent-interactive) !important;
+  color: var(--c-primary) !important;
 }
 
 /* Dropzone accept/reject outlines. Mantine 8 no longer supports nested
  * `&[data-accept]` selectors inside the `styles` prop object, so these are
  * plain CSS attribute selectors on a class applied to the Dropzone root. */
 .landing-dropzone[data-accept] {
-  outline: 2px dashed var(--accent-interactive);
+  outline: 2px dashed var(--c-primary);
   outline-offset: 4px;
 }
 .landing-dropzone[data-reject] {
diff --git a/frontend/editor/src/core/components/shared/LanguageSelector.module.css b/frontend/editor/src/core/components/shared/LanguageSelector.module.css
index 8f2248687b..68c1d672bf 100644
--- a/frontend/editor/src/core/components/shared/LanguageSelector.module.css
+++ b/frontend/editor/src/core/components/shared/LanguageSelector.module.css
@@ -6,7 +6,7 @@
 }
 
 .languageItem {
-  border-right: 2px solid var(--mantine-color-gray-3);
+  border-right: 2px solid var(--c-border);
 }
 
 .languageItem:nth-child(4n) {
@@ -20,7 +20,7 @@
   }
 
   .languageItem:nth-child(4n) {
-    border-right: 2px solid var(--mantine-color-gray-3);
+    border-right: 2px solid var(--c-border);
   }
 
   .languageItem:nth-child(2n) {
@@ -34,7 +34,7 @@
   }
 
   .languageItem:nth-child(4n) {
-    border-right: 2px solid var(--mantine-color-gray-3);
+    border-right: 2px solid var(--c-border);
   }
 
   .languageItem:nth-child(3n) {
@@ -42,23 +42,12 @@
   }
 }
 
-/* Dark theme support */
-[data-mantine-color-scheme="dark"] .languageItem {
-  border-right-color: var(--mantine-color-dark-3);
-}
-
+/* Dark theme: divider colour comes from the adaptive --c-border token on the
+   base rules; only the layout quirk (no right border on 4n) differs. */
 [data-mantine-color-scheme="dark"] .languageItem:nth-child(4n) {
   border-right: none;
 }
 
-[data-mantine-color-scheme="dark"] .languageItem:nth-child(2n) {
-  border-right-color: var(--mantine-color-dark-3);
-}
-
-[data-mantine-color-scheme="dark"] .languageItem:nth-child(3n) {
-  border-right-color: var(--mantine-color-dark-3);
-}
-
 /* Responsive text visibility */
 .languageText {
   display: none;
diff --git a/frontend/editor/src/core/components/shared/LanguageSelector.tsx b/frontend/editor/src/core/components/shared/LanguageSelector.tsx
index aad6c714d7..257f7cd0f5 100644
--- a/frontend/editor/src/core/components/shared/LanguageSelector.tsx
+++ b/frontend/editor/src/core/components/shared/LanguageSelector.tsx
@@ -91,10 +91,10 @@ const LanguageItem: React.FC<LanguageItemProps> = ({
             ? "light-dark(var(--mantine-color-blue-1), var(--mantine-color-blue-8))"
             : undefined,
           color: disabled
-            ? "var(--text-muted)"
+            ? "var(--c-text-subtle)"
             : isSelected
               ? "light-dark(var(--mantine-color-blue-9), var(--mantine-color-blue-3))"
-              : "var(--text-primary)",
+              : "var(--c-text)",
         }}
       >
         {label}
diff --git a/frontend/editor/src/core/components/shared/ObscuredOverlay/ObscuredOverlay.module.css b/frontend/editor/src/core/components/shared/ObscuredOverlay/ObscuredOverlay.module.css
index 5651993c4c..4f390cf066 100644
--- a/frontend/editor/src/core/components/shared/ObscuredOverlay/ObscuredOverlay.module.css
+++ b/frontend/editor/src/core/components/shared/ObscuredOverlay/ObscuredOverlay.module.css
@@ -12,7 +12,7 @@
   padding: 16px;
   color: #ffffff;
   font-weight: 600;
-  background: rgba(16, 18, 27, 0.55);
+  background: rgba(0, 0, 0, 0.55);
   backdrop-filter: blur(6px);
   -webkit-backdrop-filter: blur(6px);
   border: 1px solid rgba(255, 255, 255, 0.06);
diff --git a/frontend/editor/src/core/components/shared/PageEditorFileDropdown.tsx b/frontend/editor/src/core/components/shared/PageEditorFileDropdown.tsx
index fbe44c35c6..b15374d101 100644
--- a/frontend/editor/src/core/components/shared/PageEditorFileDropdown.tsx
+++ b/frontend/editor/src/core/components/shared/PageEditorFileDropdown.tsx
@@ -197,8 +197,8 @@ export const PageEditorFileDropdown: React.FC<PageEditorFileDropdownProps> = ({
       <Menu.Dropdown
         className="ph-no-capture"
         style={{
-          backgroundColor: "var(--bg-file-manager)",
-          border: "1px solid var(--border-subtle)",
+          backgroundColor: "var(--c-bg)",
+          border: "1px solid var(--c-border-subtle)",
           borderRadius: "8px",
           boxShadow: "0 2px 8px rgba(0, 0, 0, 0.15)",
           maxHeight: "80vh",
@@ -231,7 +231,7 @@ export const PageEditorFileDropdown: React.FC<PageEditorFileDropdownProps> = ({
             marginTop: "0.5rem",
             cursor: "pointer",
             backgroundColor: "transparent",
-            borderTop: "1px solid var(--border-subtle)",
+            borderTop: "1px solid var(--c-border-subtle)",
             transition: "background-color 0.15s ease",
           }}
           onMouseEnter={(e) => {
diff --git a/frontend/editor/src/core/components/shared/PolicyBadges.css b/frontend/editor/src/core/components/shared/PolicyBadges.css
index d193cc752e..3a919e24c9 100644
--- a/frontend/editor/src/core/components/shared/PolicyBadges.css
+++ b/frontend/editor/src/core/components/shared/PolicyBadges.css
@@ -17,7 +17,7 @@
   width: 15px;
   height: 15px;
   border-radius: 4px;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   background: color-mix(in srgb, currentColor 16%, transparent);
   pointer-events: auto;
 }
diff --git a/frontend/editor/src/core/components/shared/ToolIcon.tsx b/frontend/editor/src/core/components/shared/ToolIcon.tsx
index d0a1c82b9b..b1aa129304 100644
--- a/frontend/editor/src/core/components/shared/ToolIcon.tsx
+++ b/frontend/editor/src/core/components/shared/ToolIcon.tsx
@@ -14,7 +14,7 @@ interface ToolIconProps {
 export const ToolIcon: React.FC<ToolIconProps> = ({
   icon,
   opacity = 1,
-  color = "var(--tools-text-and-icon-color)",
+  color = "var(--c-text)",
   marginRight = "0.5rem",
 }) => {
   return (
diff --git a/frontend/editor/src/core/components/shared/ToolPanelHeader.css b/frontend/editor/src/core/components/shared/ToolPanelHeader.css
index f1d99d1913..6080586d07 100644
--- a/frontend/editor/src/core/components/shared/ToolPanelHeader.css
+++ b/frontend/editor/src/core/components/shared/ToolPanelHeader.css
@@ -18,7 +18,7 @@
   flex: 1;
   min-width: 0;
   padding: 0.4rem 0.75rem 0.4rem 0.4rem;
-  border: 1px solid var(--border-subtle, var(--mantine-color-default-border));
+  border: 1px solid var(--c-border-subtle, var(--mantine-color-default-border));
   border-radius: 9999px;
   background: var(--mantine-color-body);
   text-align: left;
@@ -70,7 +70,7 @@
    so it doesn't read as a clashing lighter card on the dark toolbar. */
 [data-mantine-color-scheme="dark"] .sui-panelhdr__bar {
   background: transparent;
-  border-color: var(--border-subtle, var(--mantine-color-default-border));
+  border-color: var(--c-border-subtle, var(--mantine-color-default-border));
 }
 
 [data-mantine-color-scheme="dark"] .sui-panelhdr__icon {
diff --git a/frontend/editor/src/core/components/shared/Tooltip.tsx b/frontend/editor/src/core/components/shared/Tooltip.tsx
index 9c94bc4726..5403940751 100644
--- a/frontend/editor/src/core/components/shared/Tooltip.tsx
+++ b/frontend/editor/src/core/components/shared/Tooltip.tsx
@@ -383,7 +383,7 @@ export const Tooltip: React.FC<TooltipProps> = ({
         zIndex: Z_INDEX_OVER_FULLSCREEN_SURFACE,
         visibility: positionReady ? "visible" : "hidden",
         opacity: positionReady ? 1 : 0,
-        color: "var(--text-primary)",
+        color: "var(--c-text)",
         ...containerStyle,
       }}
       className={`${styles["tooltip-container"]} ${isPinned ? styles.pinned : ""}`}
diff --git a/frontend/editor/src/core/components/shared/UpdateModal.tsx b/frontend/editor/src/core/components/shared/UpdateModal.tsx
index 4a5e5b2404..f2c14f16fb 100644
--- a/frontend/editor/src/core/components/shared/UpdateModal.tsx
+++ b/frontend/editor/src/core/components/shared/UpdateModal.tsx
@@ -291,7 +291,7 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
           <Box
             style={{
               border:
-                "1px solid var(--border-subtle, var(--mantine-color-default-border))",
+                "1px solid var(--c-border-subtle, var(--mantine-color-default-border))",
               borderRadius: 12,
               padding: "24px 28px",
               background:
@@ -493,10 +493,10 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
                       style={{
                         borderTop:
                           idx === 0
-                            ? "1px solid var(--border-subtle, var(--mantine-color-default-border))"
+                            ? "1px solid var(--c-border-subtle, var(--mantine-color-default-border))"
                             : undefined,
                         borderBottom:
-                          "1px solid var(--border-subtle, var(--mantine-color-default-border))",
+                          "1px solid var(--c-border-subtle, var(--mantine-color-default-border))",
                         padding: "10px 12px",
                       }}
                     >
@@ -576,10 +576,10 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
                       style={{
                         borderTop:
                           index === 0
-                            ? "1px solid var(--border-subtle, var(--mantine-color-default-border))"
+                            ? "1px solid var(--c-border-subtle, var(--mantine-color-default-border))"
                             : undefined,
                         borderBottom:
-                          "1px solid var(--border-subtle, var(--mantine-color-default-border))",
+                          "1px solid var(--c-border-subtle, var(--mantine-color-default-border))",
                       }}
                     >
                       <Group
@@ -656,7 +656,7 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
                           pb="sm"
                           style={{
                             borderTop:
-                              "1px solid var(--border-subtle, var(--mantine-color-default-border))",
+                              "1px solid var(--c-border-subtle, var(--mantine-color-default-border))",
                           }}
                         >
                           <Stack gap="sm" mt="sm">
@@ -749,7 +749,7 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
             <Box
               style={{
                 border:
-                  "1px solid var(--border-subtle, var(--mantine-color-default-border))",
+                  "1px solid var(--c-border-subtle, var(--mantine-color-default-border))",
                 borderRadius: 12,
                 padding: "16px 20px",
               }}
@@ -834,7 +834,7 @@ const UpdateModal: React.FC<UpdateModalProps> = ({
       <Box
         style={{
           borderTop:
-            "1px solid var(--border-subtle, var(--mantine-color-default-border))",
+            "1px solid var(--c-border-subtle, var(--mantine-color-default-border))",
           padding: "16px 28px",
           flexShrink: 0,
         }}
diff --git a/frontend/editor/src/core/components/shared/WorkbenchBar.css b/frontend/editor/src/core/components/shared/WorkbenchBar.css
index 2a61e8099c..bbaf784ac6 100644
--- a/frontend/editor/src/core/components/shared/WorkbenchBar.css
+++ b/frontend/editor/src/core/components/shared/WorkbenchBar.css
@@ -8,8 +8,8 @@
   align-content: flex-start;
   min-height: 40px;
   padding: 0 8px;
-  background-color: var(--bg-toolbar);
-  border-bottom: 1px solid var(--border-subtle);
+  background-color: var(--c-bg-raised);
+  border-bottom: 1px solid var(--c-border-subtle);
   flex-shrink: 0;
   z-index: 50;
 }
@@ -33,7 +33,7 @@
   border: none;
   border-radius: 8px;
   background: transparent;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   font-size: 13px;
   font-weight: 500;
   cursor: pointer;
@@ -44,27 +44,23 @@
 }
 
 .workbench-bar-view-btn:hover {
-  background-color: var(--hover-bg);
-  color: var(--text-primary);
+  background-color: var(--c-hover);
+  color: var(--c-text);
 }
 
 .workbench-bar-view-btn.active {
-  background-color: var(--mantine-color-blue-light, rgba(59, 130, 246, 0.12));
-  color: var(--mantine-color-blue-6, #3b82f6);
+  background-color: var(--c-primary-subtle);
+  color: var(--c-accent-fg);
 }
 
 .workbench-bar-view-btn.workbench-bar-back-btn {
-  color: var(--text-primary);
+  color: var(--c-text);
   font-weight: 600;
 }
 
 .workbench-bar-view-btn.workbench-bar-back-btn:hover {
-  background-color: color-mix(
-    in srgb,
-    var(--accent-interactive, #4a90e2) 12%,
-    transparent
-  );
-  color: var(--accent-interactive, #4a90e2);
+  background-color: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  color: var(--c-accent-fg);
 }
 
 .workbench-bar-view-btn svg {
@@ -106,7 +102,7 @@
   flex: 0 0 100%;
   height: auto;
   padding: 4px 0;
-  border-top: 1px solid var(--border-subtle);
+  border-top: 1px solid var(--c-border-subtle);
   justify-content: flex-start;
   overflow-x: auto;
   overflow-y: hidden;
@@ -138,7 +134,7 @@
  * Tight 24px hit-box and no hover background: these are quiet toolbar icons —
  * hover feedback comes from the icon colour darkening, not a bg tint. */
 .workbench-bar-action-icon {
-  color: var(--text-secondary) !important;
+  color: var(--c-text-muted) !important;
   /* min-* too: Mantine's ActionIcon sets min-width/min-height from --ai-size
    * (36px), which floors the width and defeats the 24px clamp. */
   width: 24px !important;
@@ -155,17 +151,17 @@
 }
 
 .workbench-bar-action-icon:hover {
-  color: var(--text-primary) !important;
+  color: var(--c-text) !important;
 }
 
 .workbench-bar-action-icon[data-variant="filled"] {
-  background: var(--mantine-color-blue-6, #3b82f6) !important;
-  color: #fff !important;
+  background: var(--c-primary) !important;
+  color: var(--c-text-on-primary) !important;
 }
 
 .workbench-bar-action-icon[data-variant="filled"]:hover {
-  background: var(--mantine-color-blue-7, #2563eb) !important;
-  color: #fff !important;
+  background: var(--c-primary-hover) !important;
+  color: var(--c-text-on-primary) !important;
 }
 
 .workbench-bar-action-wrapper {
@@ -181,7 +177,7 @@
 .workbench-bar-divider {
   width: 1px;
   height: 16px;
-  background-color: var(--border-subtle);
+  background-color: var(--c-border-subtle);
   margin: 0 4px;
 }
 
@@ -200,7 +196,7 @@
 .viewer-inline-controls__page {
   font-size: 12px;
   font-weight: 500;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   min-width: 3rem;
   text-align: center;
   white-space: nowrap;
@@ -214,7 +210,7 @@
 
 .viewer-inline-controls__zoom-pct {
   font-size: 12px;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   min-width: 2.5rem;
   text-align: right;
   white-space: nowrap;
diff --git a/frontend/editor/src/core/components/shared/filePreview/DocumentThumbnail.tsx b/frontend/editor/src/core/components/shared/filePreview/DocumentThumbnail.tsx
index 9b5ce16eaf..5eb1bad56c 100644
--- a/frontend/editor/src/core/components/shared/filePreview/DocumentThumbnail.tsx
+++ b/frontend/editor/src/core/components/shared/filePreview/DocumentThumbnail.tsx
@@ -153,7 +153,7 @@ const DocumentThumbnail: React.FC<DocumentThumbnailProps> = ({
               fontWeight: 700,
               letterSpacing: "0.1em",
               textTransform: "uppercase",
-              color: "var(--text-secondary)",
+              color: "var(--c-text-muted)",
               background: "rgb(var(--border))",
               padding: "3px 10px",
               borderRadius: "6px",
diff --git a/frontend/editor/src/core/components/shared/textInput/TextInput.module.css b/frontend/editor/src/core/components/shared/textInput/TextInput.module.css
index 72fa8abb7b..b5131b014f 100644
--- a/frontend/editor/src/core/components/shared/textInput/TextInput.module.css
+++ b/frontend/editor/src/core/components/shared/textInput/TextInput.module.css
@@ -15,7 +15,7 @@
   display: flex;
   align-items: center;
   justify-content: center;
-  color: var(--search-text-and-icon-color);
+  color: var(--c-text-subtle);
 }
 
 .input {
@@ -27,12 +27,12 @@
   outline: none;
   box-shadow: none;
   transition: box-shadow 0.2s ease;
-  background-color: var(--input-bg);
-  color: var(--search-text-and-icon-color);
+  background-color: var(--c-input-bg);
+  color: var(--c-text-subtle);
 }
 
 .input::placeholder {
-  color: var(--search-text-and-icon-color);
+  color: var(--c-text-subtle);
   opacity: 1;
 }
 
@@ -65,13 +65,9 @@
   justify-content: center;
   font-size: 16px;
   transition: background-color 0.2s ease;
-  color: var(--search-text-and-icon-color);
+  color: var(--c-text-subtle);
 }
 
 .clearButton:hover {
-  background-color: rgba(0, 0, 0, 0.1);
-}
-
-[data-mantine-color-scheme="dark"] .clearButton:hover {
-  background-color: rgba(255, 255, 255, 0.1);
+  background-color: var(--c-hover);
 }
diff --git a/frontend/editor/src/core/components/shared/tooltip/Tooltip.module.css b/frontend/editor/src/core/components/shared/tooltip/Tooltip.module.css
index e2b5ecca10..fa4023dc56 100644
--- a/frontend/editor/src/core/components/shared/tooltip/Tooltip.module.css
+++ b/frontend/editor/src/core/components/shared/tooltip/Tooltip.module.css
@@ -1,9 +1,9 @@
 /* Tooltip Container */
 .tooltip-container {
   position: fixed;
-  border: 0.0625rem solid var(--border-default);
+  border: 0.0625rem solid var(--c-border);
   border-radius: 0.75rem;
-  background-color: var(--bg-raised);
+  background-color: var(--c-surface-raised);
   box-shadow:
     0 0.625rem 0.9375rem -0.1875rem rgba(0, 0, 0, 0.1),
     0 0.25rem 0.375rem -0.125rem rgba(0, 0, 0, 0.05);
@@ -15,25 +15,25 @@
     transform 100ms ease-out;
   max-width: 50vh;
   max-height: 80vh;
-  color: var(--text-primary);
+  color: var(--c-text);
   display: flex;
   flex-direction: column;
 }
 
 /* Pinned tooltip indicator */
 .tooltip-container.pinned {
-  border-color: var(--primary-color, #3b82f6);
+  border-color: var(--primary-color, var(--c-primary));
   box-shadow:
     0 0.625rem 0.9375rem -0.1875rem rgba(0, 0, 0, 0.1),
     0 0.25rem 0.375rem -0.125rem rgba(0, 0, 0, 0.05),
-    0 0 0 0.125rem rgba(59, 130, 246, 0.1);
+    0 0 0 0.125rem color-mix(in srgb, var(--c-primary) 10%, transparent);
 }
 
 /* Pinned tooltip header */
 .tooltip-container.pinned .tooltip-header {
-  background-color: var(--primary-color, #3b82f6);
+  background-color: var(--primary-color, var(--c-primary));
   color: white;
-  border-color: var(--primary-color, #3b82f6);
+  border-color: var(--primary-color, var(--c-primary));
 }
 
 /* Close button */
@@ -42,10 +42,10 @@
   top: 0.5rem;
   right: 0.5rem;
   font-size: 0.875rem;
-  background: var(--bg-raised);
+  background: var(--c-surface-raised);
   padding: 0.25rem;
   border-radius: 0.25rem;
-  border: 0.0625rem solid var(--border-default);
+  border: 0.0625rem solid var(--c-border);
   cursor: pointer;
   transition:
     background-color 0.2s ease,
@@ -64,15 +64,15 @@
 }
 
 .tooltip-pin-button:hover {
-  background-color: #ef4444 !important;
-  border-color: #ef4444 !important;
+  background-color: var(--c-danger) !important;
+  border-color: var(--c-danger) !important;
 }
 
 .tooltip-pin-button:focus,
 .tooltip-pin-button:focus-visible {
   outline: none;
-  border-color: var(--border-default) !important;
-  background-color: var(--bg-raised) !important;
+  border-color: var(--c-border) !important;
+  background-color: var(--c-surface-raised) !important;
 }
 
 /* Tooltip Header */
@@ -107,7 +107,7 @@
 /* Tooltip Body */
 .tooltip-body {
   padding: 1rem;
-  color: var(--text-primary) !important;
+  color: var(--c-text) !important;
   font-size: 0.875rem !important;
   line-height: 1.6 !important;
   overflow-y: auto;
@@ -116,47 +116,49 @@
 }
 
 .tooltip-body * {
-  color: var(--text-primary) !important;
+  color: var(--c-text) !important;
 }
 
 /* Link styling within tooltips */
 .tooltip-body a {
-  color: var(--link-color, #3b82f6) !important;
+  color: var(--link-color, var(--c-primary)) !important;
   text-decoration: underline;
-  text-decoration-color: var(--link-underline-color, rgba(59, 130, 246, 0.3));
+  text-decoration-color: var(
+    --link-underline-color,
+    color-mix(in srgb, var(--c-primary) 30%, transparent)
+  );
   transition:
     color 0.2s ease,
     text-decoration-color 0.2s ease;
 }
 
 .tooltip-body a:hover {
-  color: var(--link-hover-color, #2563eb) !important;
+  color: var(--link-hover-color, var(--c-primary-hover)) !important;
   text-decoration-color: var(
     --link-hover-underline-color,
-    rgba(37, 99, 235, 0.5)
+    color-mix(in srgb, var(--c-primary-hover) 50%, transparent)
   );
 }
-
-.tooltip-container .tooltip-body {
-  color: var(--text-primary) !important;
-}
-
+.tooltip-container .tooltip-body,
 .tooltip-container .tooltip-body * {
-  color: var(--text-primary) !important;
+  color: var(--c-text) !important;
 }
 
 /* Ensure links maintain their styling */
 .tooltip-container .tooltip-body a {
-  color: var(--link-color, #3b82f6) !important;
+  color: var(--link-color, var(--c-primary)) !important;
   text-decoration: underline;
-  text-decoration-color: var(--link-underline-color, rgba(59, 130, 246, 0.3));
+  text-decoration-color: var(
+    --link-underline-color,
+    color-mix(in srgb, var(--c-primary) 30%, transparent)
+  );
 }
 
 .tooltip-container .tooltip-body a:hover {
-  color: var(--link-hover-color, #2563eb) !important;
+  color: var(--link-hover-color, var(--c-primary-hover)) !important;
   text-decoration-color: var(
     --link-hover-underline-color,
-    rgba(37, 99, 235, 0.5)
+    color-mix(in srgb, var(--c-primary-hover) 50%, transparent)
   );
 }
 
@@ -165,8 +167,8 @@
   position: absolute;
   width: 0.5rem;
   height: 0.5rem;
-  background: var(--bg-raised);
-  border: 0.0625rem solid var(--border-default);
+  background: var(--c-surface-raised);
+  border: 0.0625rem solid var(--c-border);
   transform: rotate(45deg);
 }
 
diff --git a/frontend/editor/src/core/components/shared/tooltip/TooltipContent.tsx b/frontend/editor/src/core/components/shared/tooltip/TooltipContent.tsx
index 08436799f9..28d18c4e4c 100644
--- a/frontend/editor/src/core/components/shared/tooltip/TooltipContent.tsx
+++ b/frontend/editor/src/core/components/shared/tooltip/TooltipContent.tsx
@@ -17,13 +17,13 @@ export const TooltipContent: React.FC<TooltipContentProps> = ({
     <div
       className={`${styles["tooltip-body"]}`}
       style={{
-        color: "var(--text-primary)",
+        color: "var(--c-text)",
         padding: `16px ${16 + extraRightPadding}px 16px 16px`,
         fontSize: "14px",
         lineHeight: "1.6",
       }}
     >
-      <div style={{ color: "var(--text-primary)" }}>
+      <div style={{ color: "var(--c-text)" }}>
         {tips ? (
           <>
             {tips.map((tip, index) => (
@@ -35,8 +35,8 @@ export const TooltipContent: React.FC<TooltipContentProps> = ({
                   <div
                     style={{
                       display: "inline-block",
-                      backgroundColor: "var(--tooltip-title-bg)",
-                      color: "var(--tooltip-title-color)",
+                      backgroundColor: "var(--c-primary-tint)",
+                      color: "var(--c-text)",
                       padding: "6px 12px",
                       borderRadius: "16px",
                       fontSize: "12px",
@@ -51,7 +51,7 @@ export const TooltipContent: React.FC<TooltipContentProps> = ({
                   <p
                     style={{
                       margin: "0 0 12px 0",
-                      color: "var(--text-secondary)",
+                      color: "var(--c-text-muted)",
                       fontSize: "13px",
                     }}
                     dangerouslySetInnerHTML={{ __html: tip.description }}
@@ -62,7 +62,7 @@ export const TooltipContent: React.FC<TooltipContentProps> = ({
                     style={{
                       margin: "0",
                       paddingLeft: "16px",
-                      color: "var(--text-secondary)",
+                      color: "var(--c-text-muted)",
                       fontSize: "13px",
                     }}
                   >
diff --git a/frontend/editor/src/core/components/toast/ToastRenderer.css b/frontend/editor/src/core/components/toast/ToastRenderer.css
index 6ecd9e3dfd..9a9bbbe609 100644
--- a/frontend/editor/src/core/components/toast/ToastRenderer.css
+++ b/frontend/editor/src/core/components/toast/ToastRenderer.css
@@ -75,26 +75,26 @@
 /* Toast Alert Type Colors */
 .toast-item--success {
   background: var(--color-green-100);
-  color: var(--text-primary);
+  color: var(--c-text);
   border: 1px solid var(--color-green-400);
 }
 
 .toast-item--error {
   background: var(--color-red-100);
-  color: var(--text-primary);
+  color: var(--c-text);
   border: 1px solid var(--color-red-400);
 }
 
 .toast-item--warning {
   background: var(--color-yellow-100);
-  color: var(--text-primary);
+  color: var(--c-text);
   border: 1px solid var(--color-yellow-400);
 }
 
 .toast-item--neutral {
-  background: var(--bg-surface);
-  color: var(--text-primary);
-  border: 1px solid var(--border-default);
+  background: var(--c-surface);
+  color: var(--c-text);
+  border: 1px solid var(--c-border);
 }
 
 /* Toast Header Row */
@@ -146,7 +146,7 @@
   border-radius: 999px;
   border: none;
   background: transparent;
-  color: var(--text-secondary);
+  color: var(--c-text-muted);
   cursor: pointer;
   display: flex;
   align-items: center;
@@ -166,7 +166,7 @@
 .toast-progress-container {
   margin-top: 8px;
   height: 6px;
-  background: var(--bg-muted);
+  background: var(--c-surface-sunken);
   border-radius: 999px;
   overflow: hidden;
 }
@@ -217,21 +217,21 @@
 }
 
 .toast-action-button--success {
-  color: var(--text-primary);
+  color: var(--c-text);
   border-color: var(--color-green-400);
 }
 
 .toast-action-button--error {
-  color: var(--text-primary);
+  color: var(--c-text);
   border-color: var(--color-red-400);
 }
 
 .toast-action-button--warning {
-  color: var(--text-primary);
+  color: var(--c-text);
   border-color: var(--color-yellow-400);
 }
 
 .toast-action-button--neutral {
-  color: var(--text-primary);
-  border-color: var(--border-default);
+  color: var(--c-text);
+  border-color: var(--c-border);
 }
diff --git a/frontend/editor/src/core/components/tools/RightSidebar.tsx b/frontend/editor/src/core/components/tools/RightSidebar.tsx
index 41110ac034..73ec5db69f 100644
--- a/frontend/editor/src/core/components/tools/RightSidebar.tsx
+++ b/frontend/editor/src/core/components/tools/RightSidebar.tsx
@@ -168,7 +168,7 @@ export default function RightSidebar() {
       ref={toolPanelRef}
       data-sidebar="tool-panel"
       data-tour={fullscreenExpanded ? undefined : "tool-panel"}
-      className={`tool-panel flex flex-col ${fullscreenExpanded ? "tool-panel--fullscreen-active" : "overflow-hidden"} bg-[var(--bg-toolbar)] border-l border-[var(--border-subtle)] transition-all duration-300 ease-out ${isMobile ? "h-full border-r-0" : "h-screen"} ${fullscreenExpanded ? "tool-panel--fullscreen" : ""}`}
+      className={`tool-panel flex flex-col ${fullscreenExpanded ? "tool-panel--fullscreen-active" : "overflow-hidden"} bg-[var(--c-bg-raised)] border-l border-[var(--c-border-subtle)] transition-all duration-300 ease-out ${isMobile ? "h-full border-r-0" : "h-screen"} ${fullscreenExpanded ? "tool-panel--fullscreen" : ""}`}
       style={{
         width: computedWidth(),
         padding: "0",
diff --git a/frontend/editor/src/core/components/tools/ToolPanel.css b/frontend/editor/src/core/components/tools/ToolPanel.css
index e9cbb9b1b2..8a2d17f3fa 100644
--- a/frontend/editor/src/core/components/tools/ToolPanel.css
+++ b/frontend/editor/src/core/components/tools/ToolPanel.css
@@ -4,8 +4,8 @@
   align-items: center;
   gap: 2px;
   padding: 4px 8px;
-  border-bottom: 1px solid var(--border-subtle);
-  background-color: var(--bg-toolbar);
+  border-bottom: 1px solid var(--c-border-subtle);
+  background-color: var(--c-bg-raised);
   flex-shrink: 0;
 }
 
@@ -13,115 +13,107 @@
 .tool-panel__fullscreen-surface-inner {
   --fullscreen-bg-surface-1: color-mix(
     in srgb,
-    var(--bg-toolbar) 96%,
+    var(--c-bg-raised) 96%,
     transparent
   );
-  --fullscreen-bg-surface-2: color-mix(
-    in srgb,
-    var(--bg-background) 90%,
-    transparent
-  );
-  --fullscreen-bg-header: var(--bg-toolbar);
-  --fullscreen-bg-controls-1: var(--bg-toolbar);
+  --fullscreen-bg-surface-2: color-mix(in srgb, var(--c-bg) 90%, transparent);
+  --fullscreen-bg-header: var(--c-bg-raised);
+  --fullscreen-bg-controls-1: var(--c-bg-raised);
   --fullscreen-bg-controls-2: color-mix(
     in srgb,
-    var(--bg-toolbar) 95%,
-    var(--bg-background)
-  );
-  --fullscreen-bg-body-1: color-mix(
-    in srgb,
-    var(--bg-background) 86%,
-    transparent
+    var(--c-bg-raised) 95%,
+    var(--c-bg)
   );
+  --fullscreen-bg-body-1: color-mix(in srgb, var(--c-bg) 86%, transparent);
   --fullscreen-bg-body-2: color-mix(
     in srgb,
-    var(--bg-toolbar) 78%,
+    var(--c-bg-raised) 78%,
     transparent
   );
-  --fullscreen-bg-group: color-mix(in srgb, var(--bg-toolbar) 82%, transparent);
-  --fullscreen-bg-item: color-mix(in srgb, var(--bg-toolbar) 88%, transparent);
+  --fullscreen-bg-group: color-mix(
+    in srgb,
+    var(--c-bg-raised) 82%,
+    transparent
+  );
+  --fullscreen-bg-item: color-mix(in srgb, var(--c-bg-raised) 88%, transparent);
   --fullscreen-bg-list-item: color-mix(
     in srgb,
-    var(--bg-toolbar) 86%,
+    var(--c-bg-raised) 86%,
     transparent
   );
   --fullscreen-bg-icon-detailed: color-mix(
     in srgb,
-    var(--bg-muted) 75%,
+    var(--c-surface-sunken) 75%,
     transparent
   );
   --fullscreen-bg-icon-compact: color-mix(
     in srgb,
-    var(--bg-muted) 70%,
+    var(--c-surface-sunken) 70%,
     transparent
   );
   --fullscreen-border-subtle-75: color-mix(
     in srgb,
-    var(--border-subtle) 75%,
+    var(--c-border-subtle) 75%,
     transparent
   );
   --fullscreen-border-subtle-70: color-mix(
     in srgb,
-    var(--border-subtle) 70%,
+    var(--c-border-subtle) 70%,
     transparent
   );
   --fullscreen-border-subtle-65: color-mix(
     in srgb,
-    var(--border-subtle) 65%,
+    var(--c-border-subtle) 65%,
     transparent
   );
   --fullscreen-border-favorites: color-mix(
     in srgb,
     var(--special-color-favorites) 25%,
-    var(--border-subtle)
+    var(--c-border-subtle)
   );
   --fullscreen-border-recommended: color-mix(
     in srgb,
     var(--special-color-recommended) 25%,
-    var(--border-subtle)
+    var(--c-border-subtle)
   );
   --fullscreen-shadow-primary: color-mix(
     in srgb,
-    var(--shadow-color, rgba(15, 23, 42, 0.55)) 25%,
+    var(--shadow-color, color-mix(in srgb, black 55%, transparent)) 25%,
     transparent
   );
   --fullscreen-shadow-secondary: color-mix(
     in srgb,
-    var(--shadow-color, rgba(15, 23, 42, 0.35)) 30%,
+    var(--shadow-color, color-mix(in srgb, black 35%, transparent)) 30%,
     transparent
   );
   --fullscreen-shadow-group: color-mix(
     in srgb,
-    var(--shadow-color, rgba(15, 23, 42, 0.45)) 18%,
+    var(--shadow-color, color-mix(in srgb, black 45%, transparent)) 18%,
     transparent
   );
   --fullscreen-accent-hover: color-mix(
     in srgb,
-    var(--text-primary) 20%,
-    var(--border-subtle)
+    var(--c-text) 20%,
+    var(--c-border-subtle)
   );
   --fullscreen-accent-selected: color-mix(
     in srgb,
-    var(--text-primary) 30%,
-    var(--border-subtle)
-  );
-  --fullscreen-accent-ring: color-mix(
-    in srgb,
-    var(--text-primary) 15%,
-    transparent
+    var(--c-text) 30%,
+    var(--c-border-subtle)
   );
+  --fullscreen-accent-ring: color-mix(in srgb, var(--c-text) 15%, transparent);
   --fullscreen-accent-list-bg: color-mix(
     in srgb,
-    var(--text-primary) 8%,
-    var(--bg-toolbar)
+    var(--c-text) 8%,
+    var(--c-bg-raised)
   );
   --fullscreen-accent-list-border: color-mix(
     in srgb,
-    var(--text-primary) 20%,
-    var(--border-subtle)
+    var(--c-text) 20%,
+    var(--c-border-subtle)
   );
-  --fullscreen-text-icon: var(--text-primary);
-  --fullscreen-text-icon-compact: var(--text-primary);
+  --fullscreen-text-icon: var(--c-text);
+  --fullscreen-text-icon-compact: var(--c-text);
 }
 
 .tool-panel {
@@ -153,7 +145,7 @@
 
 .tool-panel__collapsed-divider {
   height: 1px;
-  background: var(--border-subtle);
+  background: var(--c-border-subtle);
   margin: 0 0.5rem 8px;
 }
 
@@ -178,7 +170,7 @@
   border: 1px solid transparent;
   border-radius: 0.5rem;
   background: transparent;
-  color: var(--tools-text-and-icon-color);
+  color: var(--c-text);
   cursor: pointer;
   transition:
     background 120ms ease-out,
@@ -198,8 +190,8 @@
 
 .tool-panel__expand-btn {
   flex-shrink: 0;
-  color: var(--text-secondary) !important;
-  border-color: var(--border-subtle) !important;
+  color: var(--c-text-muted) !important;
+  border-color: var(--c-border-subtle) !important;
 }
 
 /* The collapse/expand toggle keeps a stable identity across the collapsed strip
@@ -210,25 +202,25 @@
 }
 
 .tool-panel__expand-btn svg {
-  color: var(--text-secondary) !important;
+  color: var(--c-text-muted) !important;
 }
 
 .tool-panel__expand-btn:hover {
-  color: var(--text-primary) !important;
+  color: var(--c-text) !important;
   border-color: var(--border) !important;
 }
 
 .tool-panel__collapsed-search-btn {
   flex-shrink: 0;
-  color: var(--text-secondary) !important;
+  color: var(--c-text-muted) !important;
 }
 
 .tool-panel__collapsed-search-btn svg {
-  color: var(--text-secondary) !important;
+  color: var(--c-text-muted) !important;
 }
 
 .tool-panel__collapsed-search-btn:hover {
-  color: var(--text-primary) !important;
+  color: var(--c-text) !important;
 }
 
 .tool-panel__back-btn {
@@ -237,7 +229,7 @@
 
 .tool-panel__back-bar {
   flex-shrink: 0;
-  border-bottom: 1px solid var(--border-subtle) !important;
+  border-bottom: 1px solid var(--c-border-subtle) !important;
 }
 
 .tool-panel--fullscreen-active {
@@ -282,7 +274,7 @@
 /* Search that separates the Policies section from the Tools list below it. */
 .tool-panel__between-search {
   padding: 0.5rem 0.75rem 0.25rem;
-  border-top: 1px solid var(--border-subtle, var(--color-border));
+  border-top: 1px solid var(--c-border-subtle, var(--c-border));
 }
 
 .tool-panel__between-search .search-input-container {
@@ -292,7 +284,7 @@
 
 /* Slightly recessed search field so it reads as distinct from the panel. */
 .tool-panel__between-search input {
-  background-color: var(--bg-muted);
+  background-color: var(--c-surface-sunken);
 }
 
 ::view-transition-old(tool-rail) {
@@ -334,7 +326,7 @@
 }
 
 .tool-panel--fullscreen {
-  background: var(--bg-toolbar);
+  background: var(--c-bg-raised);
 }
 
 .tool-panel__placeholder {
@@ -342,7 +334,7 @@
   display: flex;
   align-items: center;
   justify-content: center;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-size: 0.9rem;
   padding: 1.5rem;
   text-align: center;
@@ -403,8 +395,8 @@
   align-items: center;
   gap: 1rem;
   padding: 0.75rem 1.75rem;
-  border-bottom: 1px solid var(--border-subtle);
-  background: var(--bg-toolbar);
+  border-bottom: 1px solid var(--c-border-subtle);
+  background: var(--c-bg-raised);
 }
 
 .tool-panel__fullscreen-brand {
@@ -428,8 +420,8 @@
   align-items: center;
   gap: 1rem;
   padding: 0.75rem 1.75rem;
-  border-bottom: 1px solid var(--tool-panel-search-border-bottom);
-  background: var(--tool-panel-search-bg);
+  border-bottom: 1px solid var(--c-border);
+  background: var(--c-surface-sunken);
 }
 
 .tool-panel__fullscreen-controls .search-input-container {
@@ -546,7 +538,10 @@
 .tool-panel__fullscreen-item:hover:not([aria-disabled="true"]):not(:disabled) {
   transform: translateY(-2px);
   border-color: var(--fullscreen-accent-hover);
-  box-shadow: var(--shadow-xl, 0 18px 34px rgba(15, 23, 42, 0.14));
+  box-shadow: var(
+    --shadow-xl,
+    0 18px 34px color-mix(in srgb, black 14%, transparent)
+  );
 }
 
 .tool-panel__fullscreen-item--selected {
@@ -619,8 +614,8 @@
   inset: 0;
   background: linear-gradient(
     135deg,
-    color-mix(in srgb, var(--text-primary) 12%, transparent),
-    color-mix(in srgb, var(--text-primary) 4%, transparent)
+    color-mix(in srgb, var(--c-text) 12%, transparent),
+    color-mix(in srgb, var(--c-text) 4%, transparent)
   );
   opacity: 0;
   transition: opacity 0.2s ease;
@@ -630,8 +625,7 @@
 .tool-panel__fullscreen-item:hover:not([aria-disabled="true"])
   .tool-panel__fullscreen-icon {
   transform: scale(1.08);
-  box-shadow: 0 4px 12px
-    color-mix(in srgb, var(--text-primary) 15%, transparent);
+  box-shadow: 0 4px 12px color-mix(in srgb, var(--c-text) 15%, transparent);
 }
 
 .tool-panel__fullscreen-item:hover:not([aria-disabled="true"])
@@ -656,7 +650,7 @@
 }
 
 .tool-panel__fullscreen-name {
-  color: var(--text-primary);
+  color: var(--c-text);
   font-size: 13px !important;
   font-weight: 500 !important;
 }
@@ -753,8 +747,8 @@
   inset: 0;
   background: linear-gradient(
     135deg,
-    color-mix(in srgb, var(--text-primary) 10%, transparent),
-    color-mix(in srgb, var(--text-primary) 3%, transparent)
+    color-mix(in srgb, var(--c-text) 10%, transparent),
+    color-mix(in srgb, var(--c-text) 3%, transparent)
   );
   opacity: 0;
   transition: opacity 0.2s ease;
@@ -764,7 +758,7 @@
 .tool-panel__fullscreen-list-item:hover:not([aria-disabled="true"])
   .tool-panel__fullscreen-list-icon {
   transform: scale(1.06);
-  box-shadow: 0 2px 8px color-mix(in srgb, var(--text-primary) 12%, transparent);
+  box-shadow: 0 2px 8px color-mix(in srgb, var(--c-text) 12%, transparent);
 }
 
 .tool-panel__fullscreen-list-item:hover:not([aria-disabled="true"])
diff --git a/frontend/editor/src/core/components/tools/ToolPanelModePrompt.css b/frontend/editor/src/core/components/tools/ToolPanelModePrompt.css
index 2749abe537..58421faa4c 100644
--- a/frontend/editor/src/core/components/tools/ToolPanelModePrompt.css
+++ b/frontend/editor/src/core/components/tools/ToolPanelModePrompt.css
@@ -1,10 +1,10 @@
 .tool-panel-mode-prompt__modal {
-  background: color-mix(in srgb, var(--bg-toolbar) 94%, transparent);
-  border: 1px solid color-mix(in srgb, var(--border-subtle) 70%, transparent);
+  background: color-mix(in srgb, var(--c-bg-raised) 94%, transparent);
+  border: 1px solid color-mix(in srgb, var(--c-border-subtle) 70%, transparent);
   box-shadow: 0 32px 64px
     color-mix(
       in srgb,
-      var(--shadow-color, rgba(15, 23, 42, 0.55)) 20%,
+      var(--shadow-color, color-mix(in srgb, black 55%, transparent)) 20%,
       transparent
     );
   max-width: min(46rem, 100%);
@@ -22,8 +22,8 @@
   gap: 1rem;
   background: linear-gradient(
     145deg,
-    color-mix(in srgb, var(--bg-surface) 96%, transparent),
-    color-mix(in srgb, var(--bg-muted) 70%, transparent)
+    color-mix(in srgb, var(--c-surface) 96%, transparent),
+    color-mix(in srgb, var(--c-surface-sunken) 70%, transparent)
   );
   width: 100%;
   max-width: 19rem;
@@ -31,28 +31,20 @@
 
 .tool-panel-mode-prompt__card--sidebar {
   border: 1px solid
-    color-mix(
-      in srgb,
-      var(--accent-primary, var(--mantine-color-blue-6, #228be6)) 18%,
-      var(--border-subtle)
-    );
+    color-mix(in srgb, var(--c-primary) 18%, var(--c-border-subtle));
   background: linear-gradient(
     165deg,
-    color-mix(in srgb, var(--bg-surface) 96%, transparent),
-    color-mix(
-      in srgb,
-      var(--accent-primary, var(--mantine-color-blue-6, #228be6)) 8%,
-      transparent
-    )
+    color-mix(in srgb, var(--c-surface) 96%, transparent),
+    color-mix(in srgb, var(--c-primary) 8%, transparent)
   );
 }
 
 .tool-panel-mode-prompt__preview {
   border-radius: 0.9rem;
-  border: 1px solid color-mix(in srgb, var(--border-subtle) 70%, transparent);
+  border: 1px solid color-mix(in srgb, var(--c-border-subtle) 70%, transparent);
   background: linear-gradient(
     135deg,
-    color-mix(in srgb, var(--bg-muted) 82%, transparent),
+    color-mix(in srgb, var(--c-surface-sunken) 82%, transparent),
     transparent 75%
   );
   padding: 0.75rem;
@@ -76,54 +68,49 @@
   gap: 0.45rem;
   background: linear-gradient(
     180deg,
-    color-mix(in srgb, var(--bg-muted) 88%, transparent),
-    color-mix(in srgb, var(--bg-muted) 72%, transparent)
+    color-mix(in srgb, var(--c-surface-sunken) 88%, transparent),
+    color-mix(in srgb, var(--c-surface-sunken) 72%, transparent)
   );
-  border: 1px solid color-mix(in srgb, var(--border-subtle) 65%, transparent);
+  border: 1px solid color-mix(in srgb, var(--c-border-subtle) 65%, transparent);
 }
 
 .tool-panel-mode-prompt__sidebar-search {
   height: 0.5rem;
   border-radius: 0.4rem;
-  background: color-mix(in srgb, var(--bg-background) 90%, transparent);
-  border: 1px solid color-mix(in srgb, var(--border-subtle) 60%, transparent);
+  background: color-mix(in srgb, var(--c-bg) 90%, transparent);
+  border: 1px solid color-mix(in srgb, var(--c-border-subtle) 60%, transparent);
 }
 
 .tool-panel-mode-prompt__sidebar-item {
   height: 0.55rem;
   border-radius: 0.35rem;
-  background: color-mix(
-    in srgb,
-    var(--accent-primary, var(--mantine-color-blue-6, #228be6)) 32%,
-    var(--bg-muted)
-  );
+  background: color-mix(in srgb, var(--c-primary) 32%, var(--c-surface-sunken));
 }
 
 .tool-panel-mode-prompt__sidebar-item--muted {
-  background: color-mix(in srgb, var(--bg-background) 88%, transparent);
+  background: color-mix(in srgb, var(--c-bg) 88%, transparent);
 }
 
 .tool-panel-mode-prompt__workspace {
   flex: 1;
   border-radius: 0.65rem;
-  border: 1px solid color-mix(in srgb, var(--border-subtle) 65%, transparent);
+  border: 1px solid color-mix(in srgb, var(--c-border-subtle) 65%, transparent);
   padding: 0.5rem;
   display: grid;
   gap: 0.35rem;
   grid-template-rows: 1.4fr 0.6fr;
   background: linear-gradient(
     160deg,
-    color-mix(in srgb, var(--bg-background) 94%, transparent),
-    color-mix(in srgb, var(--bg-muted) 68%, transparent)
+    color-mix(in srgb, var(--c-bg) 94%, transparent),
+    color-mix(in srgb, var(--c-surface-sunken) 68%, transparent)
   );
 }
 
 .tool-panel-mode-prompt__workspace-page {
   border-radius: 0.45rem;
-  background: color-mix(in srgb, var(--bg-surface) 96%, transparent);
-  border: 1px solid color-mix(in srgb, var(--border-subtle) 55%, transparent);
-  box-shadow: inset 0 0 0 1px
-    color-mix(in srgb, var(--bg-background) 60%, transparent);
+  background: color-mix(in srgb, var(--c-surface) 96%, transparent);
+  border: 1px solid color-mix(in srgb, var(--c-border-subtle) 55%, transparent);
+  box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--c-bg) 60%, transparent);
 }
 
 .tool-panel-mode-prompt__workspace-page--secondary {
@@ -151,11 +138,11 @@
 
 .tool-panel-mode-prompt__legacy-card {
   border-radius: 0.45rem;
-  border: 1px solid color-mix(in srgb, var(--border-subtle) 55%, transparent);
+  border: 1px solid color-mix(in srgb, var(--c-border-subtle) 55%, transparent);
   background: linear-gradient(
     150deg,
-    color-mix(in srgb, var(--bg-muted) 88%, transparent),
-    color-mix(in srgb, var(--bg-background) 76%, transparent)
+    color-mix(in srgb, var(--c-surface-sunken) 88%, transparent),
+    color-mix(in srgb, var(--c-bg) 76%, transparent)
   );
   height: 1.2rem;
 }
@@ -185,11 +172,11 @@
 
 .tool-panel-mode-prompt__fullscreen-card {
   border-radius: 0.45rem;
-  border: 1px solid color-mix(in srgb, var(--border-subtle) 55%, transparent);
+  border: 1px solid color-mix(in srgb, var(--c-border-subtle) 55%, transparent);
   background: linear-gradient(
     150deg,
-    color-mix(in srgb, var(--bg-muted) 88%, transparent),
-    color-mix(in srgb, var(--bg-background) 76%, transparent)
+    color-mix(in srgb, var(--c-surface-sunken) 88%, transparent),
+    color-mix(in srgb, var(--c-bg) 76%, transparent)
   );
   height: 1.2rem;
 }
@@ -210,20 +197,15 @@
 }
 
 .tool-panel-mode-prompt__action:hover {
-  box-shadow: 0 10px 18px
-    color-mix(
-      in srgb,
-      var(--accent-primary, var(--mantine-color-blue-6, #228be6)) 25%,
-      transparent
-    );
+  box-shadow: 0 10px 18px color-mix(in srgb, var(--c-primary) 25%, transparent);
 }
 
 .tool-panel-mode-prompt__maybe-later {
-  color: color-mix(in srgb, var(--text-secondary) 90%, var(--text-muted));
+  color: color-mix(in srgb, var(--c-text-muted) 90%, var(--c-text-subtle));
 }
 
 .tool-panel-mode-prompt__maybe-later:hover {
-  background: color-mix(in srgb, var(--bg-muted) 78%, transparent);
+  background: color-mix(in srgb, var(--c-surface-sunken) 78%, transparent);
 }
 
 @media (max-width: 600px) {
diff --git a/frontend/editor/src/core/components/tools/ToolPicker.tsx b/frontend/editor/src/core/components/tools/ToolPicker.tsx
index 779e945b8c..6cda34aff2 100644
--- a/frontend/editor/src/core/components/tools/ToolPicker.tsx
+++ b/frontend/editor/src/core/components/tools/ToolPicker.tsx
@@ -37,7 +37,7 @@ const HEADER_TEXT_STYLE: React.CSSProperties = {
   padding: "0.25rem 0 0.35rem 0.5rem",
   textTransform: "uppercase",
   letterSpacing: "0.06em",
-  color: "var(--text-muted)",
+  color: "var(--c-text-subtle)",
 };
 const SCROLLABLE_STYLE: React.CSSProperties = {
   flex: 1,
@@ -50,7 +50,7 @@ const SCROLLABLE_STYLE: React.CSSProperties = {
 const CONTAINER_STYLE: React.CSSProperties = {
   display: "flex",
   flexDirection: "column",
-  background: "var(--bg-toolbar)",
+  background: "var(--c-bg-raised)",
 };
 const toTitleCase = (s: string) =>
   s.replace(
diff --git a/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.module.css b/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.module.css
index 8a20a78340..d2ae85a88b 100644
--- a/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.module.css
+++ b/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.module.css
@@ -16,7 +16,7 @@
 }
 
 .containerBorder {
-  border: 1px solid var(--border-default, #333);
+  border: 1px solid var(--c-border);
 }
 
 /* Page thumbnail styles */
@@ -105,8 +105,8 @@
 
 .gridTileSelected,
 .gridTileHovered {
-  border: 2px solid var(--mantine-primary-color-filled, #3b82f6);
-  background-color: rgba(59, 130, 246, 0.2);
+  border: 2px solid var(--c-primary);
+  background-color: color-mix(in srgb, var(--c-primary) 20%, transparent);
 }
 
 /* Preview header */
@@ -116,14 +116,14 @@
 
 .divider {
   height: 1px;
-  background-color: var(--border-default, #333);
+  background-color: var(--c-border);
   margin-bottom: 8px;
 }
 
 .previewLabel {
   font-size: 14px;
   font-weight: 500;
-  color: var(--text-primary);
+  color: var(--c-text);
   text-align: center;
 }
 
diff --git a/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.tsx b/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.tsx
index fe92d1ff42..6e35b286a9 100644
--- a/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.tsx
+++ b/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.tsx
@@ -220,7 +220,7 @@ export default function PageNumberPreview({
       width: "100%",
       aspectRatio: `${(pageSize?.widthPts ?? 595.28) / (pageSize?.heightPts ?? 841.89)} / 1`,
       backgroundColor: pageThumbnail ? "white" : "rgba(255,255,255,0.03)",
-      border: "1px solid var(--border-default, #333)",
+      border: "1px solid var(--c-border, #333)",
       overflow: "hidden" as const,
     }),
     [pageSize, pageThumbnail],
diff --git a/frontend/editor/src/core/components/tools/addStamp/StampPreview.module.css b/frontend/editor/src/core/components/tools/addStamp/StampPreview.module.css
index 7e740f6f51..dccf897eaa 100644
--- a/frontend/editor/src/core/components/tools/addStamp/StampPreview.module.css
+++ b/frontend/editor/src/core/components/tools/addStamp/StampPreview.module.css
@@ -16,7 +16,7 @@
 }
 
 .containerBorder {
-  border: 1px solid var(--border-default, #333);
+  border: 1px solid var(--c-border);
 }
 
 /* Page thumbnail styles */
@@ -95,7 +95,7 @@
 
 .gridTileSelected,
 .gridTileHovered {
-  border: 2px solid var(--mantine-primary-color-filled, #3b82f6);
+  border: 2px solid var(--c-primary);
 }
 
 /* Preview header */
@@ -105,14 +105,14 @@
 
 .divider {
   height: 1px;
-  background-color: var(--border-default, #333);
+  background-color: var(--c-border);
   margin-bottom: 8px;
 }
 
 .previewLabel {
   font-size: 14px;
   font-weight: 500;
-  color: var(--text-primary);
+  color: var(--c-text);
   text-align: center;
 }
 
@@ -127,7 +127,7 @@
 
 /* Information text container */
 .informationContainer {
-  background-color: var(--information-text-bg);
+  background-color: var(--c-surface);
   padding: 2px;
   padding-left: 8px;
   padding-right: 8px;
diff --git a/frontend/editor/src/core/components/tools/addStamp/StampPreviewUtils.ts b/frontend/editor/src/core/components/tools/addStamp/StampPreviewUtils.ts
index 97120c0fcf..8ac3c73551 100644
--- a/frontend/editor/src/core/components/tools/addStamp/StampPreviewUtils.ts
+++ b/frontend/editor/src/core/components/tools/addStamp/StampPreviewUtils.ts
@@ -280,7 +280,7 @@ export function computeStampPreviewStyle(
       width: "100%",
       aspectRatio: `${(pageSize?.widthPts ?? 595.28) / (pageSize?.heightPts ?? 841.89)} / 1`,
       backgroundColor: hasPageThumbnail ? "white" : "rgba(255,255,255,0.03)",
-      border: "1px solid var(--border-default, #333)",
+      border: "1px solid var(--c-border, #333)",
       overflow: "hidden",
     },
     item: {
diff --git a/frontend/editor/src/core/components/tools/automate/AutomationEntry.tsx b/frontend/editor/src/core/components/tools/automate/AutomationEntry.tsx
index 322d2d87fc..8ffbfeda81 100644
--- a/frontend/editor/src/core/components/tools/automate/AutomationEntry.tsx
+++ b/frontend/editor/src/core/components/tools/automate/AutomationEntry.tsx
@@ -191,11 +191,9 @@ export default function AutomationEntry({
         className="tool-button"
         style={{
           borderRadius: 0,
-          color: "var(--tools-text-and-icon-color)",
+          color: "var(--c-text)",
           overflow: "visible",
-          backgroundColor: shouldShowMenu
-            ? "var(--automation-entry-hover-bg)"
-            : undefined,
+          backgroundColor: shouldShowMenu ? "var(--c-hover)" : undefined,
         }}
       >
         {buttonContent}
diff --git a/frontend/editor/src/core/components/tools/automate/AutomationRun.tsx b/frontend/editor/src/core/components/tools/automate/AutomationRun.tsx
index e59996ab8f..4f63a80d3c 100644
--- a/frontend/editor/src/core/components/tools/automate/AutomationRun.tsx
+++ b/frontend/editor/src/core/components/tools/automate/AutomationRun.tsx
@@ -153,7 +153,7 @@ export default function AutomationRun({
             style={{
               width: 16,
               height: 16,
-              border: "2px solid #ccc",
+              border: "2px solid var(--c-border)",
               borderRadius: "50%",
             }}
           />
diff --git a/frontend/editor/src/core/components/tools/automate/ToolList.tsx b/frontend/editor/src/core/components/tools/automate/ToolList.tsx
index ad67ed4aa9..e2fe54deb0 100644
--- a/frontend/editor/src/core/components/tools/automate/ToolList.tsx
+++ b/frontend/editor/src/core/components/tools/automate/ToolList.tsx
@@ -148,7 +148,7 @@ export default function ToolList({
                   borderTop: "none",
                   borderRadius:
                     "0 0 var(--mantine-radius-lg) var(--mantine-radius-lg)",
-                  backgroundColor: "var(--active-bg)",
+                  backgroundColor: "var(--c-active)",
                   padding: "var(--mantine-spacing-xs)",
                 }}
               >
diff --git a/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.tsx b/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.tsx
index 4311c5f6ca..aaab1cb93e 100644
--- a/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.tsx
@@ -75,7 +75,7 @@ const CertificateTypeSettings = ({
   if (!hasAlternativeSources) {
     return (
       <Stack gap="md">
-        <div style={{ color: "var(--text-muted)", fontSize: "11px" }}>
+        <div style={{ color: "var(--c-text-subtle)", fontSize: "11px" }}>
           {t(
             "certSign.source.noOtherSources",
             "No other certificate sources are available.",
diff --git a/frontend/editor/src/core/components/tools/certSign/panels/SignRequestPanel.tsx b/frontend/editor/src/core/components/tools/certSign/panels/SignRequestPanel.tsx
index 2b128ebd11..0f21335833 100644
--- a/frontend/editor/src/core/components/tools/certSign/panels/SignRequestPanel.tsx
+++ b/frontend/editor/src/core/components/tools/certSign/panels/SignRequestPanel.tsx
@@ -317,9 +317,9 @@ const SignRequestPanel = ({ data }: SignRequestPanelProps) => {
         onClick={handleAddToActiveFiles}
         fullWidth
         style={{
-          backgroundColor: "var(--landing-inner-paper-bg)",
-          color: "var(--btn-open-file)",
-          border: "1px solid var(--landing-inner-paper-border)",
+          backgroundColor: "var(--c-surface-raised)",
+          color: "var(--c-primary)",
+          border: "1px solid var(--c-border)",
         }}
       >
         {t("certSign.collab.signRequest.addToFiles", "Add to Active Files")}
diff --git a/frontend/editor/src/core/components/tools/compare/compareView.css b/frontend/editor/src/core/components/tools/compare/compareView.css
index 7a86c69d4a..aaa703fcc1 100644
--- a/frontend/editor/src/core/components/tools/compare/compareView.css
+++ b/frontend/editor/src/core/components/tools/compare/compareView.css
@@ -5,19 +5,14 @@
 .compare-dropdown-sticky {
   position: sticky;
   z-index: 2;
-  background: var(--compare-page-label-bg);
+  background: var(--c-surface-sunken);
   color: var(--compare-page-label-fg);
   font-size: 0.75rem;
   padding: 0.25rem 0.5rem;
-  border-bottom: 1px solid var(--border-subtle);
+  border-bottom: 1px solid var(--c-border-subtle);
   pointer-events: none;
 }
 
-[data-mantine-color-scheme="dark"] .compare-dropdown-sticky {
-  background: var(--compare-page-label-bg);
-  color: var(--compare-page-label-fg);
-  border-bottom: 1px solid var(--border-default);
-}
 .compare-workbench {
   display: flex;
   flex-direction: column;
@@ -91,9 +86,9 @@
   position: sticky;
   top: 0;
   z-index: 10;
-  background: var(--bg-toolbar);
+  background: var(--c-bg-raised);
   backdrop-filter: blur(8px);
-  border-bottom: 1px solid var(--border-default);
+  border-bottom: 1px solid var(--c-border);
   padding: 0.5rem;
   margin: -0.5rem -0.5rem 0.5rem -0.5rem;
 }
@@ -164,21 +159,13 @@
   margin: 0 !important;
   border-top-left-radius: 8px !important;
   border-top-right-radius: 8px !important;
-}
-
-/* Style the dropdown container */
-.compare-changes-select .mantine-Combobox-dropdown {
-  border: 1px solid var(--border-subtle) !important;
-  border-radius: 8px !important;
-  box-shadow: var(--shadow-md) !important;
-  background-color: var(--bg-surface) !important;
-}
-
+} /* Style the dropdown container */
+.compare-changes-select .mantine-Combobox-dropdown,
 .compare-changes-select--comparison .mantine-Combobox-dropdown {
-  border: 1px solid var(--border-subtle) !important;
+  border: 1px solid var(--c-border-subtle) !important;
   border-radius: 8px !important;
   box-shadow: var(--shadow-md) !important;
-  background-color: var(--bg-surface) !important;
+  background-color: var(--c-surface) !important;
 }
 
 /* Custom scrollbar for ScrollArea */
@@ -187,18 +174,18 @@
 }
 
 .compare-changes-select .mantine-ScrollArea-viewport::-webkit-scrollbar-track {
-  background: var(--bg-muted) !important;
+  background: var(--c-surface-sunken) !important;
   border-radius: 3px !important;
 }
 
 .compare-changes-select .mantine-ScrollArea-viewport::-webkit-scrollbar-thumb {
-  background: var(--border-strong) !important;
+  background: var(--c-border-strong) !important;
   border-radius: 3px !important;
 }
 
 .compare-changes-select
   .mantine-ScrollArea-viewport::-webkit-scrollbar-thumb:hover {
-  background: var(--text-muted) !important;
+  background: var(--c-text-subtle) !important;
 }
 
 .compare-changes-select--comparison
@@ -208,27 +195,21 @@
 
 .compare-changes-select--comparison
   .mantine-ScrollArea-viewport::-webkit-scrollbar-track {
-  background: var(--bg-muted) !important;
+  background: var(--c-surface-sunken) !important;
   border-radius: 3px !important;
 }
 
 .compare-changes-select--comparison
   .mantine-ScrollArea-viewport::-webkit-scrollbar-thumb {
-  background: var(--border-strong) !important;
+  background: var(--c-border-strong) !important;
   border-radius: 3px !important;
 }
 
 .compare-changes-select--comparison
   .mantine-ScrollArea-viewport::-webkit-scrollbar-thumb:hover {
-  background: var(--text-muted) !important;
-}
-
-/* Style the dropdown options */
-.compare-changes-select .mantine-Combobox-option {
-  font-size: 0.875rem !important;
-  padding: 8px 12px !important;
-}
-
+  background: var(--c-text-subtle) !important;
+} /* Style the dropdown options */
+.compare-changes-select .mantine-Combobox-option,
 .compare-changes-select--comparison .mantine-Combobox-option {
   font-size: 0.875rem !important;
   padding: 8px 12px !important;
@@ -240,27 +221,16 @@
 
 .compare-changes-select--comparison .mantine-Combobox-option:hover {
   background-color: var(--spdf-compare-added-badge-bg) !important;
-}
-
-/* Style the search input */
-.compare-changes-select .mantine-Combobox-search {
-  font-size: 0.875rem !important;
-  padding: 8px 12px !important;
-  border-bottom: 1px solid var(--border-subtle) !important;
-}
-
+} /* Style the search input */
+.compare-changes-select .mantine-Combobox-search,
 .compare-changes-select--comparison .mantine-Combobox-search {
   font-size: 0.875rem !important;
   padding: 8px 12px !important;
-  border-bottom: 1px solid var(--border-subtle) !important;
+  border-bottom: 1px solid var(--c-border-subtle) !important;
 }
-
-.compare-changes-select .mantine-Combobox-search::placeholder {
-  color: var(--text-muted) !important;
-}
-
+.compare-changes-select .mantine-Combobox-search::placeholder,
 .compare-changes-select--comparison .mantine-Combobox-search::placeholder {
-  color: var(--text-muted) !important;
+  color: var(--c-text-subtle) !important;
 }
 
 /* Style the chevron - ensure proper coloring */
@@ -273,29 +243,49 @@
 /* Flash/pulse highlight for navigated change */
 @keyframes compare-flash {
   0% {
-    outline: 4px solid rgba(255, 235, 59, 0);
-    box-shadow: 0 0 0 rgba(255, 235, 59, 0);
-    background-color: rgba(255, 235, 59, 0.2) !important;
+    outline: 4px solid color-mix(in srgb, var(--c-highlight) 0%, transparent);
+    box-shadow: 0 0 0 color-mix(in srgb, var(--c-highlight) 0%, transparent);
+    background-color: color-mix(
+      in srgb,
+      var(--c-highlight) 20%,
+      transparent
+    ) !important;
   }
   25% {
-    outline: 4px solid rgba(255, 235, 59, 1);
-    box-shadow: 0 0 20px rgba(255, 235, 59, 0.8);
-    background-color: rgba(255, 235, 59, 0.4) !important;
+    outline: 4px solid color-mix(in srgb, var(--c-highlight) 100%, transparent);
+    box-shadow: 0 0 20px color-mix(in srgb, var(--c-highlight) 80%, transparent);
+    background-color: color-mix(
+      in srgb,
+      var(--c-highlight) 40%,
+      transparent
+    ) !important;
   }
   50% {
-    outline: 4px solid rgba(255, 235, 59, 1);
-    box-shadow: 0 0 30px rgba(255, 235, 59, 0.9);
-    background-color: rgba(255, 235, 59, 0.5) !important;
+    outline: 4px solid color-mix(in srgb, var(--c-highlight) 100%, transparent);
+    box-shadow: 0 0 30px color-mix(in srgb, var(--c-highlight) 90%, transparent);
+    background-color: color-mix(
+      in srgb,
+      var(--c-highlight) 50%,
+      transparent
+    ) !important;
   }
   75% {
-    outline: 4px solid rgba(255, 235, 59, 0.8);
-    box-shadow: 0 0 15px rgba(255, 235, 59, 0.6);
-    background-color: rgba(255, 235, 59, 0.3) !important;
+    outline: 4px solid color-mix(in srgb, var(--c-highlight) 80%, transparent);
+    box-shadow: 0 0 15px color-mix(in srgb, var(--c-highlight) 60%, transparent);
+    background-color: color-mix(
+      in srgb,
+      var(--c-highlight) 30%,
+      transparent
+    ) !important;
   }
   100% {
-    outline: 4px solid rgba(255, 235, 59, 0);
-    box-shadow: 0 0 0 rgba(255, 235, 59, 0);
-    background-color: rgba(255, 235, 59, 0) !important;
+    outline: 4px solid color-mix(in srgb, var(--c-highlight) 0%, transparent);
+    box-shadow: 0 0 0 color-mix(in srgb, var(--c-highlight) 0%, transparent);
+    background-color: color-mix(
+      in srgb,
+      var(--c-highlight) 0%,
+      transparent
+    ) !important;
   }
 }
 
@@ -304,14 +294,18 @@
   z-index: 1000;
   position: relative;
   /* Bonus: temporarily override red/green to yellow during flash for clarity */
-  background-color: rgba(255, 235, 59, 0.5) !important;
+  background-color: color-mix(
+    in srgb,
+    var(--c-highlight) 50%,
+    transparent
+  ) !important;
 }
 
 /* Union overlay for group flash */
 .compare-diff-flash-overlay {
   animation: compare-flash 1.5s ease-in-out 1;
   z-index: 999;
-  background-color: rgba(255, 235, 59, 0.4);
+  background-color: color-mix(in srgb, var(--c-highlight) 40%, transparent);
   pointer-events: none;
   border-radius: 2px;
 }
@@ -328,7 +322,7 @@
   width: 0.75rem;
   height: 0.75rem;
   border-radius: 999px;
-  border: 1px solid rgba(15, 23, 42, 0.15);
+  border: 1px solid var(--c-border);
 }
 
 .compare-summary__stats {
@@ -343,10 +337,10 @@
 }
 
 .compare-summary__segment {
-  border: 1px solid var(--mantine-color-gray-3);
+  border: 1px solid var(--c-border);
   border-radius: 0.5rem;
   padding: 0.75rem;
-  background-color: var(--mantine-color-gray-0);
+  background-color: var(--c-surface);
 }
 
 .compare-diff-page {
@@ -357,10 +351,10 @@
 
 .compare-diff-page__canvas {
   position: relative;
-  border: 1px solid var(--border-strong);
+  border: 1px solid var(--c-border-strong);
   border-radius: 0.75rem;
   overflow: hidden;
-  background-color: var(--bg-surface);
+  background-color: var(--c-surface);
   width: 100%;
 }
 
@@ -381,7 +375,7 @@
   margin-right: auto;
   max-width: 100%;
   background-color: #fff; /* ensure stable white backing during load */
-  border: 1px solid var(--border-subtle);
+  border: 1px solid var(--c-border-subtle);
   will-change: transform;
 }
 
@@ -403,7 +397,7 @@
   display: inline-block;
   padding: 2px 8px;
   border-radius: 8px;
-  background-color: var(--compare-page-label-bg);
+  background-color: var(--c-surface-sunken);
   color: var(--compare-page-label-fg);
 }
 
@@ -432,7 +426,7 @@
 }
 .compare-dropdown-option__page {
   font-size: 0.7rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 .compare-dropdown-option__text {
   display: -webkit-box;
@@ -446,11 +440,11 @@
 /* Non-sticky in-flow group headers; sticky handled by floating header */
 .compare-dropdown-group {
   position: static;
-  background: var(--compare-page-label-bg);
+  background: var(--c-surface-sunken);
   color: var(--compare-page-label-fg);
   font-size: 0.75rem;
   padding: 0.25rem 0.5rem;
-  border-bottom: 1px solid var(--border-subtle);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .compare-dropdown-group.compare-dropdown-group--hidden {
@@ -461,15 +455,9 @@
   overflow: hidden;
 }
 
-[data-mantine-color-scheme="dark"] .compare-dropdown-group {
-  background: var(--compare-page-label-bg);
-  color: var(--compare-page-label-fg);
-  border-bottom: 1px solid var(--border-default);
-}
-
 /* Light grey rendering flag next to page labels in the dropdown */
 .compare-dropdown-rendering-flag {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin-left: 0.25rem;
 }
 
@@ -489,7 +477,7 @@
   position: sticky;
   top: 0;
   z-index: 2;
-  background: var(--bg-background);
+  background: var(--c-bg);
   padding: 0.25rem 0;
 }
 
@@ -550,7 +538,7 @@
   padding-bottom: 32px;
 }
 .compare-pixel-page {
-  border: 1px solid var(--mantine-color-default-border, #dee2e6);
+  border: 1px solid var(--mantine-color-default-border, var(--c-border));
   border-radius: 8px;
   padding: 12px;
   background: var(--mantine-color-body, #fff);
@@ -568,13 +556,13 @@
 }
 .compare-pixel-triptych figure img {
   display: block;
-  border: 1px solid var(--mantine-color-default-border, #dee2e6);
+  border: 1px solid var(--mantine-color-default-border, var(--c-border));
   background: #fff;
 }
 .compare-pixel-triptych figcaption {
   font-size: 11px;
   text-align: center;
-  color: var(--mantine-color-dimmed, #868e96);
+  color: var(--mantine-color-dimmed, var(--c-text-muted));
 }
 .compare-pixel-overlay {
   position: relative;
@@ -583,7 +571,7 @@
 .compare-pixel-overlay-img {
   display: block;
   width: 100%;
-  border: 1px solid var(--mantine-color-default-border, #dee2e6);
+  border: 1px solid var(--mantine-color-default-border, var(--c-border));
 }
 .compare-pixel-overlay-top {
   position: absolute;
diff --git a/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.tsx b/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.tsx
index 7ffd30fa85..8ab2f10662 100644
--- a/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.tsx
+++ b/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.tsx
@@ -104,7 +104,7 @@ const GroupedFormatDropdown = ({
             cursor: disabled ? "not-allowed" : "pointer",
             width: "100%",
             color: disabled
-              ? "var(--dropdown-trigger-text-disabled)"
+              ? "var(--c-text-subtle)"
               : "var(--dropdown-trigger-text)",
           }}
         >
diff --git a/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.tsx b/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.tsx
index 9b6152cf55..c1711a635c 100644
--- a/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.tsx
+++ b/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.tsx
@@ -219,8 +219,9 @@ export default function BookmarkEditor({
         withBorder
         p="md"
         style={{
-          borderColor: "var(--border-default)",
-          background: level === 0 ? "var(--bg-surface)" : "var(--bg-muted)",
+          borderColor: "var(--c-border)",
+          background:
+            level === 0 ? "var(--c-surface)" : "var(--c-surface-sunken)",
         }}
       >
         <Stack gap="sm">
@@ -380,7 +381,7 @@ export default function BookmarkEditor({
             <Stack
               gap="sm"
               pl="lg"
-              style={{ borderLeft: "1px solid var(--border-default)" }}
+              style={{ borderLeft: "1px solid var(--c-border)" }}
             >
               {bookmark.children.map((child) => (
                 <Fragment key={child.id}>
diff --git a/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.tsx b/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.tsx
index 148917dba6..d5f8901673 100644
--- a/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.tsx
+++ b/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.tsx
@@ -100,7 +100,7 @@ const EditTableOfContentsWorkbenchView = ({
         width: "100%",
         height: "100%",
         overflowY: "auto",
-        background: "var(--bg-raised)",
+        background: "var(--c-surface-raised)",
       }}
     >
       <Stack gap="xl" maw={1200} mx="auto">
@@ -121,8 +121,8 @@ const EditTableOfContentsWorkbenchView = ({
           radius="md"
           p="xl"
           style={{
-            backgroundColor: "var(--bg-surface)",
-            borderColor: "var(--border-default)",
+            backgroundColor: "var(--c-surface)",
+            borderColor: "var(--c-border)",
             boxShadow: "var(--shadow-md)",
           }}
         >
@@ -167,8 +167,8 @@ const EditTableOfContentsWorkbenchView = ({
             radius="md"
             p="xl"
             style={{
-              backgroundColor: "var(--bg-surface)",
-              borderColor: "var(--border-default)",
+              backgroundColor: "var(--c-surface)",
+              borderColor: "var(--c-border)",
               boxShadow: "var(--shadow-md)",
             }}
           >
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/sections/PerPageSection.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/sections/PerPageSection.tsx
index 0c11cf592a..80eb184a42 100644
--- a/frontend/editor/src/core/components/tools/getPdfInfo/sections/PerPageSection.tsx
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/sections/PerPageSection.tsx
@@ -125,8 +125,8 @@ const PerPageSection: React.FC<PerPageSectionProps> = ({
                 <Accordion.Panel>
                   <div
                     style={{
-                      backgroundColor: "var(--bg-raised)",
-                      color: "var(--text-primary)",
+                      backgroundColor: "var(--c-surface-raised)",
+                      color: "var(--c-text)",
                       borderRadius: 8,
                       padding: 12,
                     }}
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/shared/ScrollableCodeBlock.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/shared/ScrollableCodeBlock.tsx
index 4d66e247b8..35373c0ef7 100644
--- a/frontend/editor/src/core/components/tools/getPdfInfo/shared/ScrollableCodeBlock.tsx
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/shared/ScrollableCodeBlock.tsx
@@ -32,8 +32,8 @@ const ScrollableCodeBlock: React.FC<ScrollableCodeBlockProps> = ({
       block
       style={{
         whiteSpace: "pre-wrap",
-        backgroundColor: "var(--bg-raised)",
-        color: "var(--text-primary)",
+        backgroundColor: "var(--c-surface-raised)",
+        color: "var(--c-text)",
         maxHeight,
         overflowY: "auto",
       }}
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/shared/accordionStyles.ts b/frontend/editor/src/core/components/tools/getPdfInfo/shared/accordionStyles.ts
index 73e45eee63..b10d60174f 100644
--- a/frontend/editor/src/core/components/tools/getPdfInfo/shared/accordionStyles.ts
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/shared/accordionStyles.ts
@@ -5,7 +5,7 @@ type AccordionStyles = Partial<Record<AccordionStylesNames, CSSProperties>>;
 
 export const pdfInfoAccordionStyles: AccordionStyles = {
   item: {
-    backgroundColor: "var(--accordion-item-bg)",
+    backgroundColor: "var(--c-surface-raised)",
   },
   control: {
     backgroundColor: "transparent",
diff --git a/frontend/editor/src/core/components/tools/ocr/LanguagePicker.module.css b/frontend/editor/src/core/components/tools/ocr/LanguagePicker.module.css
index 6f7ae437b1..02e91270fa 100644
--- a/frontend/editor/src/core/components/tools/ocr/LanguagePicker.module.css
+++ b/frontend/editor/src/core/components/tools/ocr/LanguagePicker.module.css
@@ -5,9 +5,9 @@
   flex-direction: row;
   align-items: center; /* Center align items vertically */
   height: 32px;
-  border: 1px solid var(--border-default);
-  background-color: var(--mantine-color-white); /* Use Mantine color variable */
-  color: var(--text-secondary);
+  border: 1px solid var(--c-border);
+  background-color: var(--c-input-bg);
+  color: var(--c-text-muted);
   border-radius: var(--radius-sm);
   padding: 4px 8px;
   font-size: 13px;
@@ -15,25 +15,9 @@
   transition: all 0.2s ease;
 }
 
-/* Dark mode background */
-[data-mantine-color-scheme="dark"] .languagePicker {
-  background-color: var(
-    --mantine-color-dark-6
-  ); /* Use Mantine dark color instead of hardcoded */
-}
-
 .languagePicker:hover {
-  border-color: var(--border-strong);
-  background-color: var(
-    --mantine-color-gray-0
-  ); /* Light gray on hover for light mode */
-}
-
-/* Dark mode hover */
-[data-mantine-color-scheme="dark"] .languagePicker:hover {
-  background-color: var(
-    --mantine-color-dark-5
-  ); /* Use Mantine color variable */
+  border-color: var(--c-border-strong);
+  background-color: var(--c-hover);
 }
 
 .languagePicker:disabled {
@@ -43,30 +27,25 @@
 
 .languagePickerIcon {
   font-size: 16px;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin-left: auto;
   display: flex;
   align-items: center; /* Center the icon vertically */
 }
 
 .languagePickerDropdown {
-  background-color: var(--mantine-color-white); /* Use Mantine color variable */
-  border: 1px solid var(--border-default);
+  background-color: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-sm);
   padding: 4px;
 }
 
-/* Dark mode dropdown background */
-[data-mantine-color-scheme="dark"] .languagePickerDropdown {
-  background-color: var(--mantine-color-dark-6);
-}
-
 .languagePickerOption {
   padding: 6px 10px;
   cursor: pointer;
   border-radius: var(--radius-xs);
   font-size: 13px;
-  color: var(--text-primary);
+  color: var(--c-text);
   transition: background-color 0.2s ease;
 }
 
@@ -81,14 +60,7 @@
 }
 
 .languagePickerOption:hover {
-  background-color: var(
-    --mantine-color-gray-0
-  ); /* Light gray on hover for light mode */
-}
-
-/* Dark mode option hover */
-[data-mantine-color-scheme="dark"] .languagePickerOption:hover {
-  background-color: var(--mantine-color-dark-5);
+  background-color: var(--c-hover);
 }
 
 /* Additional helper classes for the component */
@@ -110,7 +82,7 @@
 
 .languagePickerScrollArea {
   max-height: 180px;
-  border-bottom: 1px solid var(--border-default);
+  border-bottom: 1px solid var(--c-border);
   padding-bottom: 8px;
 }
 
@@ -121,12 +93,7 @@
 }
 
 .languagePickerLink {
-  color: var(--mantine-color-blue-6);
+  color: var(--c-accent-fg);
   text-decoration: underline;
   cursor: pointer;
 }
-
-/* Dark mode link */
-[data-mantine-color-scheme="dark"] .languagePickerLink {
-  color: var(--mantine-color-blue-4);
-}
diff --git a/frontend/editor/src/core/components/tools/ocr/LanguagePicker.tsx b/frontend/editor/src/core/components/tools/ocr/LanguagePicker.tsx
index 4649df64b4..78d51bcc3b 100644
--- a/frontend/editor/src/core/components/tools/ocr/LanguagePicker.tsx
+++ b/frontend/editor/src/core/components/tools/ocr/LanguagePicker.tsx
@@ -158,7 +158,7 @@ const LanguagePicker: React.FC<LanguagePickerProps> = ({
         <Text
           size="xs"
           style={{
-            color: "#3b82f6",
+            color: "var(--c-primary)",
             cursor: "pointer",
             textDecoration: "underline",
             textAlign: "center",
diff --git a/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.module.css b/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.module.css
index b6efb3bbc0..377d73dfd5 100644
--- a/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.module.css
+++ b/frontend/editor/src/core/components/tools/overlayPdfs/OverlayPdfsSettings.module.css
@@ -29,11 +29,7 @@
   white-space: normal;
   word-break: break-word;
 }
-
-.fileSize {
-  flex-shrink: 0;
-}
-
+.fileSize,
 .removeButton {
   flex-shrink: 0;
 }
diff --git a/frontend/editor/src/core/components/tools/pageLayout/PageLayoutSettings.tsx b/frontend/editor/src/core/components/tools/pageLayout/PageLayoutSettings.tsx
index ff6d0e71c8..d432d63c53 100644
--- a/frontend/editor/src/core/components/tools/pageLayout/PageLayoutSettings.tsx
+++ b/frontend/editor/src/core/components/tools/pageLayout/PageLayoutSettings.tsx
@@ -61,7 +61,7 @@ export default function PageLayoutSettings({
           {selectedPagesPerSheetOption && (
             <div
               style={{
-                backgroundColor: "var(--information-text-bg)",
+                backgroundColor: "var(--c-surface)",
                 color: "var(--information-text-color)",
                 padding: "8px 12px",
                 borderRadius: "8px",
diff --git a/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.tsx b/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.tsx
index cf73302210..c537b327bc 100644
--- a/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.tsx
+++ b/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.tsx
@@ -56,7 +56,11 @@ const RedactSingleStepSettings = ({
           <Divider />
           <Stack gap="md">
             <div
-              style={{ padding: "20px", textAlign: "center", color: "#666" }}
+              style={{
+                padding: "20px",
+                textAlign: "center",
+                color: "var(--c-text-muted)",
+              }}
             >
               Manual redaction interface will be available here when
               implemented.
diff --git a/frontend/editor/src/core/components/tools/reorganizePages/ReorganizePagesSettings.tsx b/frontend/editor/src/core/components/tools/reorganizePages/ReorganizePagesSettings.tsx
index b01b717bb0..a5bbe2fa66 100644
--- a/frontend/editor/src/core/components/tools/reorganizePages/ReorganizePagesSettings.tsx
+++ b/frontend/editor/src/core/components/tools/reorganizePages/ReorganizePagesSettings.tsx
@@ -40,7 +40,7 @@ export default function ReorganizePagesSettings({
       {selectedMode && (
         <div
           style={{
-            backgroundColor: "var(--information-text-bg)",
+            backgroundColor: "var(--c-surface)",
             color: "var(--information-text-color)",
             padding: "8px 12px",
             borderRadius: "8px",
diff --git a/frontend/editor/src/core/components/tools/shared/ToolStep.tsx b/frontend/editor/src/core/components/tools/shared/ToolStep.tsx
index 0325b7566c..5b261d4883 100644
--- a/frontend/editor/src/core/components/tools/shared/ToolStep.tsx
+++ b/frontend/editor/src/core/components/tools/shared/ToolStep.tsx
@@ -168,7 +168,11 @@ const ToolStep = ({
         )}
       </div>
       <Divider
-        style={{ color: "#E2E8F0", marginLeft: "1rem", marginRight: "-0.5rem" }}
+        style={{
+          color: "var(--c-border)",
+          marginLeft: "1rem",
+          marginRight: "-0.5rem",
+        }}
       />
     </div>
   );
diff --git a/frontend/editor/src/core/components/tools/showJS/ShowJSView.css b/frontend/editor/src/core/components/tools/showJS/ShowJSView.css
index 301589a930..7237fe7a3b 100644
--- a/frontend/editor/src/core/components/tools/showJS/ShowJSView.css
+++ b/frontend/editor/src/core/components/tools/showJS/ShowJSView.css
@@ -7,7 +7,7 @@
   white-space: pre;
   tab-size: 2;
   margin: 0;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 .tok-kw {
@@ -35,7 +35,7 @@
   align-items: center;
   gap: 6px;
   min-width: 64px;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   user-select: none;
 }
 .line-number {
@@ -45,7 +45,7 @@
 .fold-toggle {
   border: none;
   background: transparent;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   cursor: pointer;
   padding: 0 2px;
 }
@@ -62,21 +62,29 @@
   flex: 1 1 auto;
 }
 .collapsed-indicator {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-style: italic;
   cursor: pointer;
   padding-left: 8px;
 }
 .collapsed-inline {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   margin-left: 6px;
 }
 .search-hit {
-  background: rgba(255, 235, 59, 0.4); /* yellow highlight */
+  background: color-mix(
+    in srgb,
+    var(--c-highlight) 40%,
+    transparent
+  ); /* yellow highlight */
   border-radius: 2px;
 }
 .search-hit-active {
-  background: rgba(33, 150, 243, 0.4); /* active blue */
+  background: color-mix(
+    in srgb,
+    var(--c-primary) 40%,
+    transparent
+  ); /* active blue */
 }
 
 .showjs-root {
@@ -92,7 +100,7 @@
   border: 1px solid var(--mantine-color-gray-4);
   border-radius: 8px;
   overflow: hidden;
-  background: var(--bg-file-manager);
+  background: var(--c-bg);
 }
 
 .showjs-toolbar {
diff --git a/frontend/editor/src/core/components/tools/toolPicker/ToolPicker.css b/frontend/editor/src/core/components/tools/toolPicker/ToolPicker.css
index b48932d6aa..b3b8fe3a2b 100644
--- a/frontend/editor/src/core/components/tools/toolPicker/ToolPicker.css
+++ b/frontend/editor/src/core/components/tools/toolPicker/ToolPicker.css
@@ -12,12 +12,12 @@
 }
 
 .tool-picker-scrollable::-webkit-scrollbar-thumb {
-  background-color: var(--mantine-color-gray-4);
+  background-color: var(--c-border);
   border-radius: 0.1875rem;
 }
 
 .tool-picker-scrollable::-webkit-scrollbar-thumb:hover {
-  background-color: var(--mantine-color-gray-5);
+  background-color: var(--c-border-strong);
 }
 
 .search-input {
@@ -28,7 +28,7 @@
   text-transform: uppercase;
   padding-bottom: 0.5rem;
   font-size: 0.75rem;
-  color: var(--tool-subcategory-text-color);
+  color: var(--c-text-subtle);
   /* Align the text with tool labels to account for icon gutter */
   padding-left: 1rem;
 }
@@ -44,24 +44,20 @@
   text-transform: uppercase;
   font-weight: 600;
   font-size: 0.75rem;
-  color: var(--tool-subcategory-text-color);
+  color: var(--c-text-subtle);
   white-space: nowrap;
   overflow: visible;
 }
 
 .tool-subcategory-row-rule {
   height: 1px;
-  background-color: var(--tool-subcategory-rule-color);
+  background-color: var(--c-border-subtle);
   flex: 1 1 auto;
 }
 
-/* Selected tool highlight — theme-aware via CSS variable */
+/* Selected tool highlight — theme-aware via the adaptive --c-active token */
 :root {
-  --tool-button-selected-bg: var(--mantine-color-gray-2);
-}
-
-[data-mantine-color-scheme="dark"] {
-  --tool-button-selected-bg: var(--mantine-color-dark-4);
+  --tool-button-selected-bg: var(--c-active);
 }
 
 /* Compact tool buttons (padding via the Button `p`/`py` props).
diff --git a/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.tsx b/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.tsx
index 66463b9005..39eaf2a57b 100644
--- a/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.tsx
+++ b/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.tsx
@@ -148,15 +148,13 @@ const ToolSearch = ({
                   setDropdownOpen(false);
                 }}
                 leftSection={
-                  <div style={{ color: "var(--tools-text-and-icon-color)" }}>
-                    {tool.icon}
-                  </div>
+                  <div style={{ color: "var(--c-text)" }}>{tool.icon}</div>
                 }
                 fullWidth
                 justify="start"
                 style={{
                   borderRadius: "6px",
-                  color: "var(--tools-text-and-icon-color)",
+                  color: "var(--c-text)",
                   padding: "8px 12px",
                 }}
               >
diff --git a/frontend/editor/src/core/components/tools/validateSignature/reportView/styles.css b/frontend/editor/src/core/components/tools/validateSignature/reportView/styles.css
index 096470305e..b4c9e1c815 100644
--- a/frontend/editor/src/core/components/tools/validateSignature/reportView/styles.css
+++ b/frontend/editor/src/core/components/tools/validateSignature/reportView/styles.css
@@ -44,7 +44,7 @@
 .simulated-page {
   width: min(820px, 100%);
   min-height: 1040px;
-  background-color: var(--bg-raised) !important;
+  background-color: var(--c-surface-raised) !important;
   box-shadow: 0 12px 32px var(--shadow-color) !important;
   border-radius: 12px !important;
   padding: 48px 56px !important;
@@ -52,7 +52,7 @@
   overflow: hidden;
   display: flex;
   flex-direction: column;
-  color: var(--text-primary) !important;
+  color: var(--c-text) !important;
 }
 
 /* Container for the interactive report view */
@@ -60,19 +60,19 @@
   width: 100%;
   height: 100%;
   /* Match Active Files/Page Editor background */
-  background: var(--bg-background) !important;
+  background: var(--c-bg) !important;
   padding: 32px 24px 48px;
   overflow-y: auto;
 }
 
 /* Keep field blocks stable colors across themes */
 .field-value {
-  border: 1px solid var(--border-default) !important;
-  background-color: var(--bg-raised) !important;
+  border: 1px solid var(--c-border) !important;
+  background-color: var(--c-surface-raised) !important;
 }
 
 .field-container {
-  color: var(--text-primary) !important;
+  color: var(--c-text) !important;
 }
 
 /* Thumbnail preview styles */
@@ -111,19 +111,19 @@
 /* Flash highlight animation for section navigation */
 @keyframes section-flash {
   0% {
-    background-color: rgba(255, 235, 59, 0);
+    background-color: color-mix(in srgb, var(--c-highlight) 0%, transparent);
     box-shadow: none;
   }
   20% {
-    background-color: rgba(255, 235, 59, 0.35);
-    box-shadow: 0 0 20px rgba(255, 235, 59, 0.5);
+    background-color: color-mix(in srgb, var(--c-highlight) 35%, transparent);
+    box-shadow: 0 0 20px color-mix(in srgb, var(--c-highlight) 50%, transparent);
   }
   50% {
-    background-color: rgba(255, 235, 59, 0.25);
-    box-shadow: 0 0 15px rgba(255, 235, 59, 0.4);
+    background-color: color-mix(in srgb, var(--c-highlight) 25%, transparent);
+    box-shadow: 0 0 15px color-mix(in srgb, var(--c-highlight) 40%, transparent);
   }
   100% {
-    background-color: rgba(255, 235, 59, 0);
+    background-color: color-mix(in srgb, var(--c-highlight) 0%, transparent);
     box-shadow: none;
   }
 }
diff --git a/frontend/editor/src/core/components/viewer/AttachmentSidebar.css b/frontend/editor/src/core/components/viewer/AttachmentSidebar.css
index 6c20964ab3..addaca8979 100644
--- a/frontend/editor/src/core/components/viewer/AttachmentSidebar.css
+++ b/frontend/editor/src/core/components/viewer/AttachmentSidebar.css
@@ -21,7 +21,7 @@
   border-radius: 0.65rem;
   cursor: pointer;
   transition: all 0.2s ease;
-  background: color-mix(in srgb, var(--bg-toolbar) 86%, transparent);
+  background: color-mix(in srgb, var(--c-bg-raised) 86%, transparent);
   border: 1px solid transparent;
   width: 100%;
   box-sizing: border-box;
@@ -31,12 +31,8 @@
 }
 
 .attachment-item:hover {
-  background: color-mix(in srgb, var(--text-primary) 8%, var(--bg-toolbar));
-  border-color: color-mix(
-    in srgb,
-    var(--text-primary) 20%,
-    var(--border-subtle)
-  );
+  background: color-mix(in srgb, var(--c-text) 8%, var(--c-bg-raised));
+  border-color: color-mix(in srgb, var(--c-text) 20%, var(--c-border-subtle));
   transform: translateX(2px);
 }
 
@@ -46,7 +42,7 @@
 
 .attachment-item:focus-visible {
   outline: 2px solid
-    color-mix(in srgb, var(--text-primary) 30%, var(--border-subtle));
+    color-mix(in srgb, var(--c-text) 30%, var(--c-border-subtle));
   outline-offset: 2px;
 }
 
@@ -54,7 +50,7 @@
 .attachment-item__download-icon {
   flex-shrink: 0;
   transition: transform 0.2s ease;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 
 .attachment-item:hover .attachment-item__download-icon {
@@ -75,7 +71,7 @@
   line-height: 1.35;
   overflow-wrap: anywhere;
   word-break: break-word;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 .attachment-item__meta {
diff --git a/frontend/editor/src/core/components/viewer/BookmarkSidebar.css b/frontend/editor/src/core/components/viewer/BookmarkSidebar.css
index 74214fe8b9..5d8beab4e0 100644
--- a/frontend/editor/src/core/components/viewer/BookmarkSidebar.css
+++ b/frontend/editor/src/core/components/viewer/BookmarkSidebar.css
@@ -32,16 +32,12 @@
 
 .bookmark-item--clickable {
   cursor: pointer;
-  background: color-mix(in srgb, var(--bg-toolbar) 86%, transparent);
+  background: color-mix(in srgb, var(--c-bg-raised) 86%, transparent);
 }
 
 .bookmark-item--clickable:hover {
-  background: color-mix(in srgb, var(--text-primary) 8%, var(--bg-toolbar));
-  border-color: color-mix(
-    in srgb,
-    var(--text-primary) 20%,
-    var(--border-subtle)
-  );
+  background: color-mix(in srgb, var(--c-text) 8%, var(--c-bg-raised));
+  border-color: color-mix(in srgb, var(--c-text) 20%, var(--c-border-subtle));
   transform: translateX(2px);
 }
 
@@ -51,7 +47,7 @@
 
 .bookmark-item--clickable:focus-visible {
   outline: 2px solid
-    color-mix(in srgb, var(--text-primary) 30%, var(--border-subtle));
+    color-mix(in srgb, var(--c-text) 30%, var(--c-border-subtle));
   outline-offset: 2px;
 }
 
@@ -75,7 +71,7 @@
   width: 2rem;
   height: 2rem;
   flex-shrink: 0;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-size: 1.25rem;
   opacity: 0.5;
   font-weight: 300;
@@ -94,11 +90,11 @@
   line-height: 1.35;
   overflow-wrap: anywhere;
   word-break: break-word;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 .bookmark-item--clickable:hover .bookmark-item__title {
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 .bookmark-item__page {
diff --git a/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx b/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx
index a9125215bc..2acd3e309d 100644
--- a/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx
+++ b/frontend/editor/src/core/components/viewer/BookmarkSidebar.tsx
@@ -845,9 +845,10 @@ export const BookmarkSidebar = ({
               p="sm"
               data-testid="bookmark-add-form"
               style={{
-                border: "1px solid var(--border-subtle)",
+                border: "1px solid var(--c-border-subtle)",
                 borderRadius: 6,
-                background: "var(--bg-raised, var(--mantine-color-gray-0))",
+                background:
+                  "var(--c-surface-raised, var(--mantine-color-gray-0))",
               }}
             >
               <Stack gap="xs">
@@ -945,8 +946,8 @@ export const BookmarkSidebar = ({
           px="sm"
           py="xs"
           style={{
-            borderTop: "1px solid var(--border-subtle)",
-            backgroundColor: "var(--bg-toolbar)",
+            borderTop: "1px solid var(--c-border-subtle)",
+            backgroundColor: "var(--c-bg-raised)",
             flexShrink: 0,
           }}
         >
diff --git a/frontend/editor/src/core/components/viewer/CommentsSidebar.tsx b/frontend/editor/src/core/components/viewer/CommentsSidebar.tsx
index e25f9671d9..3bbc5c8f53 100644
--- a/frontend/editor/src/core/components/viewer/CommentsSidebar.tsx
+++ b/frontend/editor/src/core/components/viewer/CommentsSidebar.tsx
@@ -679,8 +679,8 @@ export function CommentsSidebar({
         top: 0,
         bottom: 0,
         width: SIDEBAR_WIDTH,
-        backgroundColor: "var(--bg-file-manager)",
-        borderLeft: "1px solid var(--border-subtle)",
+        backgroundColor: "var(--c-bg)",
+        borderLeft: "1px solid var(--c-border-subtle)",
         zIndex: 998,
         display: "flex",
         flexDirection: "column",
@@ -690,7 +690,7 @@ export function CommentsSidebar({
       <div
         style={{
           padding: "0.75rem 1rem",
-          borderBottom: "1px solid var(--border-subtle)",
+          borderBottom: "1px solid var(--c-border-subtle)",
           display: "flex",
           alignItems: "center",
           gap: "0.5rem",
@@ -869,7 +869,7 @@ export function CommentsSidebar({
                     <Box
                       mb="xs"
                       style={{
-                        borderBottom: "1px solid var(--border-subtle)",
+                        borderBottom: "1px solid var(--c-border-subtle)",
                       }}
                     />
                     <Stack gap="sm">
@@ -902,9 +902,9 @@ export function CommentsSidebar({
                             style={{
                               border: selectedAnnotationIds.has(id)
                                 ? "1px solid var(--mantine-color-blue-3)"
-                                : "1px solid var(--border-subtle)",
+                                : "1px solid var(--c-border-subtle)",
                               borderRadius: 8,
-                              backgroundColor: "var(--bg-raised)",
+                              backgroundColor: "var(--c-surface-raised)",
                             }}
                           >
                             <Group
diff --git a/frontend/editor/src/core/components/viewer/LayerSidebar.css b/frontend/editor/src/core/components/viewer/LayerSidebar.css
index 40ff79ae9b..305853ec9f 100644
--- a/frontend/editor/src/core/components/viewer/LayerSidebar.css
+++ b/frontend/editor/src/core/components/viewer/LayerSidebar.css
@@ -38,16 +38,12 @@
 }
 
 .layer-item:hover {
-  background: color-mix(in srgb, var(--text-primary) 6%, var(--bg-toolbar));
-  border-color: color-mix(
-    in srgb,
-    var(--text-primary) 14%,
-    var(--border-subtle)
-  );
+  background: color-mix(in srgb, var(--c-text) 6%, var(--c-bg-raised));
+  border-color: color-mix(in srgb, var(--c-text) 14%, var(--c-border-subtle));
 }
 
 .layer-item:active {
-  background: color-mix(in srgb, var(--text-primary) 10%, var(--bg-toolbar));
+  background: color-mix(in srgb, var(--c-text) 10%, var(--c-bg-raised));
 }
 
 .layer-item__expand-btn {
@@ -58,7 +54,7 @@
   width: 1.25rem;
   height: 1.25rem;
   cursor: pointer;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   opacity: 0.7;
   transition: opacity 0.15s ease;
 }
@@ -78,16 +74,20 @@
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
-  color: var(--text-primary);
+  color: var(--c-text);
   line-height: 1.4;
   cursor: pointer;
   user-select: none;
 }
 
 .layer-item--hidden .layer-item__label {
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   text-decoration: line-through;
-  text-decoration-color: color-mix(in srgb, var(--text-muted) 60%, transparent);
+  text-decoration-color: color-mix(
+    in srgb,
+    var(--c-text-subtle) 60%,
+    transparent
+  );
 }
 
 /* Children Container */
@@ -97,7 +97,7 @@
   gap: 0.125rem;
   margin-top: 0.125rem;
   border-left: 2px solid
-    color-mix(in srgb, var(--border-subtle) 60%, transparent);
+    color-mix(in srgb, var(--c-border-subtle) 60%, transparent);
   margin-left: 0.875rem;
   padding-left: 0.25rem;
 }
@@ -105,8 +105,8 @@
 /* Footer with Apply button */
 .layer-sidebar__footer {
   padding: 0.625rem 0.875rem;
-  background: var(--bg-toolbar);
-  border-top: 1px solid var(--border-subtle);
+  background: var(--c-bg-raised);
+  border-top: 1px solid var(--c-border-subtle);
 }
 
 /* Dirty indicator badge */
diff --git a/frontend/editor/src/core/components/viewer/LocalEmbedPDF.tsx b/frontend/editor/src/core/components/viewer/LocalEmbedPDF.tsx
index f9f8d9794a..547fba12e7 100644
--- a/frontend/editor/src/core/components/viewer/LocalEmbedPDF.tsx
+++ b/frontend/editor/src/core/components/viewer/LocalEmbedPDF.tsx
@@ -997,7 +997,7 @@ export function LocalEmbedPDF({
                     <Viewport
                       documentId={documentId}
                       style={{
-                        backgroundColor: "var(--bg-background)",
+                        backgroundColor: "var(--c-bg)",
                         height: "100%",
                         width: "100%",
                         maxHeight: "100%",
diff --git a/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx b/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx
index 011b1baf17..8d7429eba8 100644
--- a/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx
+++ b/frontend/editor/src/core/components/viewer/PdfViewerToolbar.tsx
@@ -359,7 +359,7 @@ export function PdfViewerToolbar({
               minWidth: "2.5rem",
               textAlign: "center",
               fontSize: 12,
-              color: "var(--text-muted)",
+              color: "var(--c-text-subtle)",
             }}
           >
             {displayZoomPercent}%
diff --git a/frontend/editor/src/core/components/viewer/SidebarBase.css b/frontend/editor/src/core/components/viewer/SidebarBase.css
index 058796038d..8e7771dead 100644
--- a/frontend/editor/src/core/components/viewer/SidebarBase.css
+++ b/frontend/editor/src/core/components/viewer/SidebarBase.css
@@ -6,15 +6,15 @@
   flex-direction: column;
   background: linear-gradient(
     135deg,
-    color-mix(in srgb, var(--bg-toolbar) 96%, transparent),
-    color-mix(in srgb, var(--bg-background) 90%, transparent)
+    color-mix(in srgb, var(--c-bg-raised) 96%, transparent),
+    color-mix(in srgb, var(--c-bg) 90%, transparent)
   );
   border-left: 1px solid
-    color-mix(in srgb, var(--border-subtle) 75%, transparent);
+    color-mix(in srgb, var(--c-border-subtle) 75%, transparent);
   box-shadow: -2px 0 16px
     color-mix(
       in srgb,
-      var(--shadow-color, rgba(15, 23, 42, 0.35)) 20%,
+      var(--shadow-color, color-mix(in srgb, black 35%, transparent)) 20%,
       transparent
     );
   backdrop-filter: blur(12px);
@@ -26,8 +26,8 @@
   align-items: center;
   justify-content: space-between;
   padding: 0.75rem 0.875rem;
-  background: var(--bg-toolbar);
-  border-bottom: 1px solid var(--border-subtle);
+  background: var(--c-bg-raised);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .sidebar-base__header-title {
@@ -46,9 +46,8 @@
 
 /* Search Section (used by bookmark & attachment sidebars) */
 .sidebar-base__search {
-  background: var(--tool-panel-search-bg, var(--bg-toolbar));
-  border-bottom: 1px solid
-    var(--tool-panel-search-border-bottom, var(--border-subtle));
+  background: var(--c-surface-sunken, var(--c-bg-raised));
+  border-bottom: 1px solid var(--c-border, var(--c-border-subtle));
   padding-top: 0.75rem !important;
 }
 
diff --git a/frontend/editor/src/core/components/viewer/ThumbnailSidebar.tsx b/frontend/editor/src/core/components/viewer/ThumbnailSidebar.tsx
index 6b195c4485..c44271258a 100644
--- a/frontend/editor/src/core/components/viewer/ThumbnailSidebar.tsx
+++ b/frontend/editor/src/core/components/viewer/ThumbnailSidebar.tsx
@@ -238,7 +238,7 @@ export function ThumbnailSidebar({
                       onMouseEnter={(e) => {
                         if (scrollState.currentPage !== pageIndex + 1) {
                           e.currentTarget.style.backgroundColor =
-                            "var(--hover-bg)";
+                            "var(--c-hover)";
                         }
                       }}
                       onMouseLeave={(e) => {
@@ -259,7 +259,7 @@ export function ThumbnailSidebar({
                               height: "auto",
                               borderRadius: "4px",
                               boxShadow: "0 2px 4px rgba(0, 0, 0, 0.1)",
-                              border: "1px solid var(--border-subtle)",
+                              border: "1px solid var(--c-border-subtle)",
                             }}
                           />
                         </PrivateContent>
@@ -285,13 +285,13 @@ export function ThumbnailSidebar({
                           style={{
                             width: "11.5rem",
                             height: "15rem",
-                            backgroundColor: "var(--bg-muted)",
-                            border: "1px solid var(--border-subtle)",
+                            backgroundColor: "var(--c-surface-sunken)",
+                            border: "1px solid var(--c-border-subtle)",
                             borderRadius: "4px",
                             display: "flex",
                             alignItems: "center",
                             justifyContent: "center",
-                            color: "var(--text-muted)",
+                            color: "var(--c-text-subtle)",
                             fontSize: "12px",
                           }}
                         >
@@ -307,7 +307,7 @@ export function ThumbnailSidebar({
                           color:
                             scrollState.currentPage === pageIndex + 1
                               ? "var(--color-primary-500)"
-                              : "var(--text-muted)",
+                              : "var(--c-text-subtle)",
                         }}
                       >
                         Page {pageIndex + 1}
diff --git a/frontend/editor/src/core/data/useTranslatedToolRegistry.tsx b/frontend/editor/src/core/data/useTranslatedToolRegistry.tsx
index 58b61c71be..120f955b42 100644
--- a/frontend/editor/src/core/data/useTranslatedToolRegistry.tsx
+++ b/frontend/editor/src/core/data/useTranslatedToolRegistry.tsx
@@ -1199,7 +1199,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
             icon="open-in-new-rounded"
             width="1.5rem"
             height="1.5rem"
-            style={{ color: "#2F7BF6" }}
+            style={{ color: "var(--c-accent-fg, var(--c-primary))" }}
           />
         ),
         name: t("home.devApi.title", "API"),
@@ -1219,7 +1219,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
             icon="open-in-new-rounded"
             width="1.5rem"
             height="1.5rem"
-            style={{ color: "#2F7BF6" }}
+            style={{ color: "var(--c-accent-fg, var(--c-primary))" }}
           />
         ),
         name: t("home.devFolderScanning.title", "Automated Folder Scanning"),
@@ -1242,7 +1242,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
             icon="open-in-new-rounded"
             width="1.5rem"
             height="1.5rem"
-            style={{ color: "#2F7BF6" }}
+            style={{ color: "var(--c-accent-fg, var(--c-primary))" }}
           />
         ),
         name: t("home.devSsoGuide.title", "SSO Guide"),
@@ -1262,7 +1262,7 @@ export function useTranslatedToolCatalog(): TranslatedToolCatalog {
             icon="open-in-new-rounded"
             width="1.5rem"
             height="1.5rem"
-            style={{ color: "#2F7BF6" }}
+            style={{ color: "var(--c-accent-fg, var(--c-primary))" }}
           />
         ),
         name: t("home.devAirgapped.title", "Air-gapped Setup"),
diff --git a/frontend/editor/src/core/pages/HomePage.css b/frontend/editor/src/core/pages/HomePage.css
index cfd3bded5c..7af1e89404 100644
--- a/frontend/editor/src/core/pages/HomePage.css
+++ b/frontend/editor/src/core/pages/HomePage.css
@@ -3,13 +3,13 @@
   flex-direction: column;
   height: 100%;
   width: 100%;
-  background-color: var(--bg-background);
+  background-color: var(--c-bg);
 }
 
 .mobile-toggle {
   padding: 0.5rem 0.75rem;
-  border-bottom: 1px solid var(--border-subtle);
-  background: var(--bg-toolbar);
+  border-bottom: 1px solid var(--c-border-subtle);
+  background: var(--c-bg-raised);
   display: flex;
   flex-direction: column;
   gap: 0.35rem;
@@ -47,8 +47,8 @@
   gap: 0.25rem;
   padding: 0.2rem;
   border-radius: 9999px;
-  background: var(--bg-background);
-  border: 1px solid var(--border-subtle);
+  background: var(--c-bg);
+  border: 1px solid var(--c-border-subtle);
 }
 
 .mobile-toggle-button {
@@ -57,7 +57,7 @@
   padding: 0.4rem 0.9rem;
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   background: transparent;
   transition:
     background 0.2s ease,
@@ -65,18 +65,18 @@
 }
 
 .mobile-toggle-button:focus-visible {
-  outline: 2px solid var(--primary-color, #228be6);
+  outline: 2px solid var(--c-primary);
   outline-offset: 2px;
 }
 
 .mobile-toggle-button.active {
-  background: var(--primary-surface, rgba(34, 139, 230, 0.12));
-  color: var(--text-primary);
+  background: var(--c-primary-subtle);
+  color: var(--c-text);
 }
 
 .mobile-toggle-hint {
   font-size: 0.7rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   text-align: center;
 }
 
@@ -134,8 +134,8 @@
   align-items: center;
   justify-content: space-around;
   padding: 0.5rem;
-  border-top: 1px solid var(--border-subtle);
-  background: var(--bg-toolbar);
+  border-top: 1px solid var(--c-border-subtle);
+  background: var(--c-bg-raised);
   gap: 0.5rem;
   position: relative;
   z-index: 10;
@@ -152,7 +152,7 @@
   padding: 0.5rem;
   border: none;
   background: transparent;
-  color: var(--text-primary);
+  color: var(--c-text);
   cursor: pointer;
   border-radius: 0.5rem;
   transition: background 0.2s ease;
@@ -165,16 +165,16 @@
 
 @media (hover: hover) and (pointer: fine) {
   .mobile-bottom-button:hover {
-    background: var(--bg-hover, rgba(0, 0, 0, 0.05));
+    background: var(--c-hover);
   }
 }
 
 .mobile-bottom-button:active {
-  background: var(--bg-active, rgba(0, 0, 0, 0.1));
+  background: var(--c-active);
 }
 
 .mobile-bottom-button-label {
   font-size: 0.75rem;
   font-weight: 500;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/core/pages/MobileScannerPage.tsx b/frontend/editor/src/core/pages/MobileScannerPage.tsx
index cf4e3e3564..bce84cf371 100644
--- a/frontend/editor/src/core/pages/MobileScannerPage.tsx
+++ b/frontend/editor/src/core/pages/MobileScannerPage.tsx
@@ -995,7 +995,7 @@ export default function MobileScannerPage() {
     <Box
       style={{
         minHeight: "100dvh",
-        background: "var(--bg-background)",
+        background: "var(--c-bg)",
         display: "flex",
         flexDirection: "column",
       }}
@@ -1004,8 +1004,8 @@ export default function MobileScannerPage() {
       <Box
         p="md"
         style={{
-          background: "var(--bg-toolbar)",
-          borderBottom: "1px solid var(--border-subtle)",
+          background: "var(--c-bg-raised)",
+          borderBottom: "1px solid var(--c-border-subtle)",
         }}
       >
         <Group gap="sm" align="center">
@@ -1025,7 +1025,7 @@ export default function MobileScannerPage() {
             background: loadingStatus.includes("✗")
               ? "var(--mantine-color-red-1)"
               : "var(--mantine-color-blue-1)",
-            borderBottom: "1px solid var(--border-subtle)",
+            borderBottom: "1px solid var(--c-border-subtle)",
             fontSize: "0.85rem",
             fontFamily: "monospace",
             textAlign: "center",
@@ -1231,8 +1231,8 @@ export default function MobileScannerPage() {
           {/* Controls bar - fixed at bottom */}
           <Box
             style={{
-              backgroundColor: "var(--bg-toolbar)",
-              borderTop: "1px solid var(--border-subtle)",
+              backgroundColor: "var(--c-bg-raised)",
+              borderTop: "1px solid var(--c-border-subtle)",
               padding: "0.75rem 1rem",
             }}
           >
@@ -1372,8 +1372,8 @@ export default function MobileScannerPage() {
           {/* Controls bar - fixed at bottom */}
           <Box
             style={{
-              backgroundColor: "var(--bg-toolbar)",
-              borderTop: "1px solid var(--border-subtle)",
+              backgroundColor: "var(--c-bg-raised)",
+              borderTop: "1px solid var(--c-border-subtle)",
               padding: "0.75rem 1rem",
             }}
           >
@@ -1401,7 +1401,7 @@ export default function MobileScannerPage() {
       )}
 
       {capturedImages.length > 0 && (
-        <Box p="sm" style={{ borderTop: "1px solid var(--border-subtle)" }}>
+        <Box p="sm" style={{ borderTop: "1px solid var(--c-border-subtle)" }}>
           <Group justify="space-between" mb="sm">
             <Text size="sm" fw={600}>
               {t("mobileScanner.batchImages", "Batch")} ({capturedImages.length}
@@ -1442,7 +1442,7 @@ export default function MobileScannerPage() {
                   height: "80px",
                   borderRadius: "var(--radius-sm)",
                   overflow: "hidden",
-                  border: "2px solid var(--border-subtle)",
+                  border: "2px solid var(--c-border-subtle)",
                 }}
               >
                 <img
diff --git a/frontend/editor/src/core/styles/cookieconsent.css b/frontend/editor/src/core/styles/cookieconsent.css
index 4c226e6d0d..4e6374918e 100644
--- a/frontend/editor/src/core/styles/cookieconsent.css
+++ b/frontend/editor/src/core/styles/cookieconsent.css
@@ -1,10 +1,7 @@
 /* Cookie Consent Modal Styling - Ensure proper z-index */
 
 /* Ensure cookie consent appears above everything */
-#cc-main {
-  z-index: 999999 !important;
-}
-
+#cc-main,
 /* Additional styling if needed */
 .cm-wrapper,
 .pm-wrapper {
@@ -15,26 +12,26 @@
  * matches the rest of the UI (navy-indigo surfaces) instead of a flat grey. */
 .cc--darkmode .cm,
 .cc--darkmode .pm {
-  background: var(--bg-surface) !important;
-  color: var(--text-primary) !important;
-  border: 1px solid var(--border-subtle) !important;
+  background: var(--c-surface) !important;
+  color: var(--c-text) !important;
+  border: 1px solid var(--c-border-subtle) !important;
 }
 
 .cc--darkmode .pm-overlay {
-  background: rgba(0, 0, 0, 0.6) !important;
+  background: var(--c-overlay) !important;
 }
 
 /* Buttons — match the shared neutral surface treatment. */
 .cc--darkmode .cm__btn,
 .cc--darkmode .pm__btn {
-  background: var(--bg-muted) !important;
-  color: var(--text-primary) !important;
-  border: 1px solid var(--border-default) !important;
+  background: var(--c-surface-sunken) !important;
+  color: var(--c-text) !important;
+  border: 1px solid var(--c-border) !important;
 }
 
 .cc--darkmode .cm__btn:hover,
 .cc--darkmode .pm__btn:hover {
-  background: var(--hover-bg) !important;
+  background: var(--c-hover) !important;
 }
 
 /* Ensure ScrollArea doesn't interfere */
@@ -44,5 +41,5 @@
 
 /* Override any potential conflicts */
 [data-mantine-color-scheme="dark"] #cc-main {
-  color: #ffffff !important;
+  color: var(--c-text) !important;
 }
diff --git a/frontend/editor/src/core/styles/index.css b/frontend/editor/src/core/styles/index.css
index 66a98cc8c8..01a5279f31 100644
--- a/frontend/editor/src/core/styles/index.css
+++ b/frontend/editor/src/core/styles/index.css
@@ -79,5 +79,9 @@ code {
 }
 
 .viewer-file-tab[data-active] {
-  background-color: rgba(147, 197, 253, 0.5);
+  background-color: color-mix(
+    in srgb,
+    var(--c-tab-active-tint) 50%,
+    transparent
+  );
 }
diff --git a/frontend/editor/src/core/styles/theme.css b/frontend/editor/src/core/styles/theme.css
index 18955b438f..c8a1663b4c 100644
--- a/frontend/editor/src/core/styles/theme.css
+++ b/frontend/editor/src/core/styles/theme.css
@@ -38,18 +38,16 @@
   );
 
   /* File Manager active file colors */
-  --file-active-badge-bg: rgba(
-    34,
-    197,
-    94,
-    0.15
+  --file-active-badge-bg: color-mix(
+    in srgb,
+    var(--p-green-500) 15%,
+    transparent
   ); /* Transparent green for active badge */
   --file-active-badge-fg: var(--p-green-700); /* Green text for active badge */
-  --file-active-badge-border: rgba(
-    34,
-    197,
-    94,
-    0.3
+  --file-active-badge-border: color-mix(
+    in srgb,
+    var(--p-green-500) 30%,
+    transparent
   ); /* Green border for active badge */
 }
 
@@ -189,7 +187,7 @@
   /* Colors for tooltips */
   --tooltip-header-bg: var(--p-blue-700);
   --tooltip-header-color: white;
-  --tooltip-border: var(--border-default);
+  --tooltip-border: var(--c-border);
 
   /* Inactive icon colors for light mode */
   --icon-inactive-bg: var(--p-gray-400);
@@ -203,7 +201,7 @@
   --pdf-selection-ring: color-mix(in srgb, var(--p-blue-500) 18%, transparent);
 
   /* container */
-  --landing-button-bg: var(--bg-surface);
+  --landing-button-bg: var(--c-surface);
   --landing-button-border: var(--p-blue-400);
   --landing-button-hover-bg: var(--p-gray-50);
 
@@ -270,7 +268,7 @@
   --code-com-color: var(--p-gray-500); /* gray-500 */
 
   /* Compare page label chip (light mode): slightly lighter than surrounding rows */
-  --compare-page-label-fg: var(--text-secondary);
+  --compare-page-label-fg: var(--c-text-muted);
 
   /* Status indicator dot ring shadow */
   --status-dot-ring: 0 0 0 2px rgba(0, 0, 0, 0.08);
@@ -409,9 +407,9 @@
   --icon-inactive-color: var(--p-gray-500);
 
   /* Dark mode tooltip colors */
-  --tooltip-header-bg: var(--bg-raised);
-  --tooltip-header-color: var(--text-primary);
-  --tooltip-border: var(--border-default);
+  --tooltip-header-bg: var(--c-surface-raised);
+  --tooltip-header-color: var(--c-text);
+  --tooltip-border: var(--c-border);
 
   --text-brand-accent: var(--p-red-500);
 
@@ -425,7 +423,7 @@
   --landing-doc-shadow-front-idle:
     0 8px 30px rgba(0, 0, 0, 0.55), 0 4px 12px rgba(0, 0, 0, 0.4),
     0 0 0 1px rgba(255, 255, 255, 0.04);
-  --landing-button-hover-bg: var(--bg-raised);
+  --landing-button-hover-bg: var(--c-surface-raised);
 
   /* selected file header colors for dark */
   --header-selected-bg: var(--p-blue-700);
@@ -448,9 +446,11 @@
 
   /* dark background for cards */
   --bulk-card-border: var(
-    --border-default
+    --c-border
   ); /* default border for cards and buttons */
-  --bulk-card-hover-border: var(--border-strong); /* stronger border on hover */
+  --bulk-card-hover-border: var(
+    --c-border-strong
+  ); /* stronger border on hover */
 
   /* Config Modal colors (dark mode) */
   --modal-nav-item: var(--p-gray-300);
@@ -468,7 +468,7 @@
   --code-com-color: var(--p-gray-500); /* muted gray-blue */
 
   /* Compare page label chip (dark mode): slightly darker than surrounding rows */
-  --compare-page-label-fg: var(--text-secondary);
+  --compare-page-label-fg: var(--c-text-muted);
 
   /* Status indicator dot ring shadow (dark) */
   --status-dot-ring: 0 0 0 2px rgba(255, 255, 255, 0.15);
@@ -497,7 +497,7 @@
 }
 
 [data-mantine-color-scheme="dark"] .plan-card [data-size="sm"] {
-  color: rgb(194, 200, 224) !important;
+  color: var(--p-c-c2c8e0) !important;
 }
 
 /* Current plan badge - use light mode green in dark mode */
@@ -507,24 +507,24 @@
 
 /* Plan section button colors */
 .plan-button:not(:disabled):not([data-disabled]) {
-  background-color: #0a8bff !important;
+  background-color: var(--p-azure-500) !important;
 }
 
 [data-mantine-color-scheme="dark"]
   .plan-button:not(:disabled):not([data-disabled]) {
-  background-color: #2040a0 !important;
+  background-color: var(--p-royal-700) !important;
 }
 
 /* Lighter grey for disabled plan buttons */
 .plan-button:disabled,
 .plan-button[data-disabled] {
-  background-color: #7e7e7e !important;
+  background-color: var(--p-c-7e7e7e) !important;
   color: white;
 }
 
 [data-mantine-color-scheme="dark"] .plan-button:disabled,
 [data-mantine-color-scheme="dark"] .plan-button[data-disabled] {
-  background-color: #6b7280 !important;
+  background-color: var(--p-gray-500) !important;
 }
 
 /* Override the flat multiply blend for a clean, modern semi-transparent overlay */
@@ -541,19 +541,29 @@
 /* Flash highlight for comment card (e.g. "View comment" from annotation menu) */
 @keyframes comment-card-flash {
   0% {
-    background-color: rgba(255, 235, 59, 0);
+    background-color: color-mix(in srgb, var(--p-flash-yellow) 0%, transparent);
     box-shadow: none;
   }
   20% {
-    background-color: rgba(255, 235, 59, 0.35);
-    box-shadow: 0 0 20px rgba(255, 235, 59, 0.5);
+    background-color: color-mix(
+      in srgb,
+      var(--p-flash-yellow) 35%,
+      transparent
+    );
+    box-shadow: 0 0 20px
+      color-mix(in srgb, var(--p-flash-yellow) 50%, transparent);
   }
   50% {
-    background-color: rgba(255, 235, 59, 0.25);
-    box-shadow: 0 0 15px rgba(255, 235, 59, 0.4);
+    background-color: color-mix(
+      in srgb,
+      var(--p-flash-yellow) 25%,
+      transparent
+    );
+    box-shadow: 0 0 15px
+      color-mix(in srgb, var(--p-flash-yellow) 40%, transparent);
   }
   100% {
-    background-color: rgba(255, 235, 59, 0);
+    background-color: color-mix(in srgb, var(--p-flash-yellow) 0%, transparent);
     box-shadow: none;
   }
 }
@@ -576,7 +586,7 @@
   --link-hover-border: color-mix(in srgb, var(--p-blue-500) 32%, transparent);
   --link-hover-shadow:
     inset 0 0 0 1px rgba(255, 255, 255, 0.35),
-    0 1px 4px rgba(10, 139, 255, 0.12);
+    0 1px 4px color-mix(in srgb, var(--p-azure-500) 12%, transparent);
   --link-focus-ring: color-mix(in srgb, var(--p-blue-500) 25%, transparent);
   --link-toolbar-bg: color-mix(in srgb, var(--p-blue-700) 88%, transparent);
   --link-toolbar-border: rgba(255, 255, 255, 0.1);
@@ -589,7 +599,8 @@
   --link-hover-bg: color-mix(in srgb, var(--p-blue-500) 14%, transparent);
   --link-hover-border: color-mix(in srgb, var(--p-blue-500) 38%, transparent);
   --link-hover-shadow:
-    inset 0 0 0 1px rgba(255, 255, 255, 0.1), 0 1px 4px rgba(79, 142, 245, 0.18);
+    inset 0 0 0 1px rgba(255, 255, 255, 0.1),
+    0 1px 4px color-mix(in srgb, var(--p-c-4f8ef5) 18%, transparent);
   --link-focus-ring: color-mix(in srgb, var(--p-blue-500) 30%, transparent);
   --link-toolbar-bg: color-mix(in srgb, var(--p-blue-700) 94%, transparent);
   --link-toolbar-border: rgba(255, 255, 255, 0.07);
@@ -721,7 +732,7 @@
 }
 
 .pdf-link-toolbar-btn:hover .pdf-link-toolbar-label {
-  color: #60a5fa; /* Modern blue accent */
+  color: var(--p-blue-400); /* Modern blue accent */
   text-decoration: underline;
   text-underline-offset: 3px;
 }
@@ -731,8 +742,8 @@
 }
 
 .pdf-link-toolbar-btn--delete:hover {
-  background: rgba(239, 68, 68, 0.15);
-  color: #fca5a5;
+  background: color-mix(in srgb, var(--p-red-500) 15%, transparent);
+  color: var(--p-art-red-light);
 }
 
 .pdf-link-toolbar-sep {
@@ -755,8 +766,8 @@
 }
 
 .pdf-link-toolbar-btn--delete:hover {
-  background: rgba(239, 68, 68, 0.2);
-  color: #f87171;
+  background: color-mix(in srgb, var(--p-red-500) 20%, transparent);
+  color: var(--p-red-400);
 }
 
 .pdf-link-toolbar-btn--go:hover {
@@ -808,19 +819,19 @@
 
 /* Modern logo icon */
 .logo-icon-modern__path1 {
-  fill: #acacac;
+  fill: var(--p-c-acacac);
   fill-opacity: 0.3;
 }
 .logo-icon-modern__path2 {
-  fill: #fc9999;
+  fill: var(--p-art-red-soft);
   fill-opacity: 0.5;
 }
 [data-mantine-color-scheme="dark"] .logo-icon-modern__path1 {
-  fill: #e6e6e6;
+  fill: var(--p-c-e6e6e6);
   fill-opacity: 0.4;
 }
 [data-mantine-color-scheme="dark"] .logo-icon-modern__path2 {
-  fill: #e6e6e6;
+  fill: var(--p-c-e6e6e6);
   fill-opacity: 0.7;
 }
 
@@ -829,13 +840,13 @@
   opacity: 0.2;
 }
 .logo-icon-classic__body {
-  fill: #ff4b4b;
+  fill: var(--p-art-red);
 }
 .logo-icon-classic__flap {
-  fill: #545454;
+  fill: var(--p-c-545454);
 }
 .logo-icon-classic__triangle {
-  fill: #d0dbdc;
+  fill: var(--p-c-d0dbdc);
 }
 .logo-icon-classic__s {
   fill: white;
@@ -847,10 +858,10 @@
   fill: white;
 }
 [data-mantine-color-scheme="dark"] .logo-icon-classic__flap {
-  fill: #d3d3d3;
+  fill: var(--p-c-d3d3d3);
 }
 [data-mantine-color-scheme="dark"] .logo-icon-classic__triangle {
-  fill: #d0dbdc;
+  fill: var(--p-c-d0dbdc);
 }
 [data-mantine-color-scheme="dark"] .logo-icon-classic__s {
   fill: var(--mantine-color-body);
@@ -866,11 +877,11 @@
 }
 /* PDF text: dimmed red in light mode, standard red in dark */
 .wordmark__pdf--muted {
-  fill: #d62626;
+  fill: var(--p-c-d62626);
   fill-opacity: 0.7;
 }
 [data-mantine-color-scheme="dark"] .wordmark__pdf--muted {
-  fill: #c56565;
+  fill: var(--p-art-red-muted);
   fill-opacity: 1;
 }
 
diff --git a/frontend/editor/src/core/theme/README.md b/frontend/editor/src/core/theme/README.md
index 8abc110723..fb8160a2d8 100644
--- a/frontend/editor/src/core/theme/README.md
+++ b/frontend/editor/src/core/theme/README.md
@@ -18,13 +18,12 @@ Read this before touching colours or theming anywhere in the frontend.
 |---|---|
 | `primitives.css` | **The palette.** 41 literal colours (`--p-*`) — one neutral ramp (`--p-gray-*` light, `--p-zinc-*` dark) + status hues (blue/green/amber/red). The ONLY place literals live. |
 | `colors.css` | **Semantic tokens** (`--c-*`), mapped from primitives per theme. This is what you should reference. |
-| `compat.css` | **Legacy-name aliases** → `--c-*`. Lets old files keep their `--bg-surface` / `--color-text-1` / etc. names working. Uses `:root:root` so it out-ranks legacy files. |
 | `dimensions.css` | Non-colour tokens: spacing, radius, z-index, type, motion. |
 | `index.css` | Barrel that `@import`s the above. Imported by `ThemeProvider` (and Storybook). |
 | `mantineTheme.ts` | Mantine theme object wiring. |
 
-Two **legacy** colour files still exist outside this folder and are being phased out — prefer `--c-*` over their tokens, and don't add to them:
-`core/styles/theme.css` (editor `--bg-*`/`--text-*` vocab) and `core/tokens/tokens.css` (SUI `--color-*` vocab, gradients, code palette). `compat.css` already overrides their surface/text/border tokens, so most of what they define is dead weight.
+The old `compat.css` legacy-alias layer has been removed — every component now references `--c-*` directly. Two **legacy** colour files still exist outside this folder and are being phased out — prefer `--c-*` over their tokens, and don't add to them:
+`core/styles/theme.css` (editor `--bg-*`/`--text-*` vocab) and `core/tokens/tokens.css` (SUI `--color-*` vocab, gradients, code palette).
 
 ## Semantic tokens (`--c-*`)
 
@@ -53,7 +52,7 @@ Because the accent is user-chosen, `deriveAccessiblePrimary(pick, base)` clamps
 - `--user-primary-on` → `--c-text-on-primary`. White by default; flips to **black only for genuinely light picks** (relative-luminance cutoff `0.62`, so saturated amber/green/cyan keep white text).
 - `--user-accent-fg` → `--c-accent-fg`. The accent tuned as a **foreground** (text/icon on the app surface): forced light on dark bases (`L ≥ 0.62`), dark on light (`L ≤ 0.45`), so accent text never goes dark-on-dark.
 
-**Rule of thumb:** a filled control's background uses `--c-primary` with its label on `--c-text-on-primary`; an accent used **as text/icon on a surface** (nav selection, links, tool-header text) uses `--c-accent-fg`. Because `compat.css` (`:root:root`) wins on specificity, accent-as-text legacy tokens are routed there as `var(--c-accent-fg, var(--c-primary))` — the fallback keeps non-custom builds on the raw primary.
+**Rule of thumb:** a filled control's background uses `--c-primary` with its label on `--c-text-on-primary`; an accent used **as text/icon on a surface** (nav selection, links, tool-header text) uses `--c-accent-fg`. Reference it as `var(--c-accent-fg, var(--c-primary))` — the fallback keeps non-custom builds (where `--c-accent-fg` is unset) on the raw primary.
 
 The FAB / logo mark is a deliberate exception: it's pinned to white (`--p-white`), not the on-primary flip — a brand mark, not body text.
 
@@ -71,5 +70,5 @@ App-wide "no hardcoded colours in components" is **not** enforced yet (there are
 - **`--mantine-*` vars are consumed by Mantine at runtime**, not via our `var()`. A source scan can't see their use — never delete them as "unused", and set them (not raw colours) when overriding Mantine.
 - **`--accent-*` (categorical hues) are used dynamically** via `` `var(--accent-${hue})` `` in `utils/accentColors.ts`. A literal search won't find them — don't treat them as unused.
 - **Tailwind consumes some vars** (`--gray-*`, `--color-*`, `--background`, `--border`) via `editor/tailwind.config.js` using `rgb(var(--x))`. That file is outside the usual scan roots — check it before removing those.
-- **Specificity:** `compat.css` uses `:root:root` (0,2,0) to beat legacy files. If a token you set in `colors.css` (`html[data-app-theme="custom"]`, 0,1,1) isn't winning, a `:root:root` or a `[data-mantine-color-scheme]`-compound block is probably overriding it — set it in `compat.css` or the more specific block.
-- **Adding a colour:** put the literal in `primitives.css`, map it to a `--c-*` in `colors.css` if it's a new semantic role, and reference the `--c-*` (or an existing `compat` alias) from components. Don't skip straight to a `--p-*` in a component unless there's genuinely no semantic fit.
+- **Specificity:** if a token you set in `colors.css` (`html[data-app-theme="custom"]`, 0,1,1) isn't winning, a `:root:root` or a `[data-mantine-color-scheme]`-compound block in the legacy files is probably overriding it — set it in the more specific block.
+- **Adding a colour:** put the literal in `primitives.css`, map it to a `--c-*` in `colors.css` if it's a new semantic role, and reference the `--c-*` from components. Don't skip straight to a `--p-*` in a component unless there's genuinely no semantic fit.
diff --git a/frontend/editor/src/core/theme/colors.css b/frontend/editor/src/core/theme/colors.css
index 927053f0a1..ba0e5466f5 100644
--- a/frontend/editor/src/core/theme/colors.css
+++ b/frontend/editor/src/core/theme/colors.css
@@ -30,6 +30,74 @@ html[data-app-theme="light"] {
 
   --c-success: var(--p-green-600);
   --c-danger: var(--p-red-600);
+  --c-warning: var(--p-amber-600);
+  /* Highlight/flash (search hits, compare jump-to) — same in both themes. */
+  --c-highlight: var(--p-flash-yellow);
+  /* Stirling brand red (auth CTAs) — a fixed brand colour, same in both themes. */
+  --c-brand: var(--p-brand-red);
+  --c-brand-hover: var(--p-brand-red-600);
+
+  --c-primary-tint: color-mix(in srgb, var(--c-primary) 14%, var(--c-surface));
+  --c-primary-border: color-mix(
+    in srgb,
+    var(--c-primary) 32%,
+    var(--c-surface)
+  );
+  --c-danger-subtle: color-mix(in srgb, var(--c-danger) 10%, var(--c-surface));
+  --c-success-subtle: color-mix(
+    in srgb,
+    var(--c-success) 10%,
+    var(--c-surface)
+  );
+
+  /* ── Decorative / brand / categorical palette ──────────────────────────
+     Fixed hues that intentionally do NOT follow the chosen accent: brand
+     marks, vendor colours, categorical avatar dots, static illustrations,
+     and the multi-hue gradients on feature/upgrade/onboarding surfaces.
+     Named here so components reference a --c-* token, never a raw --p-*. */
+  --c-brand-mark: var(--p-brand-red-650); /* Stirling logo mark fill */
+  --c-accent-stripe: var(--p-periwinkle-500); /* Stripe "connect" CTA */
+
+  /* Feature-accent hues (fixed) used as stops in multi-hue gradients. */
+  --c-hue-blue: var(--p-blue-500);
+  --c-hue-indigo: var(--p-indigo-500);
+  --c-hue-violet: var(--p-violet-600);
+  --c-hue-purple: var(--p-purple-500);
+  --c-hue-pink: var(--p-pink-500);
+
+  /* Categorical avatar palette (per-user dot colour). */
+  --c-avatar-1: var(--p-azure-500);
+  --c-avatar-2: var(--p-violet-500);
+  --c-avatar-3: var(--p-pink-500);
+  --c-avatar-4: var(--p-emerald-500);
+  --c-avatar-5: var(--p-amber-500);
+  --c-avatar-6: var(--p-cyan-500);
+
+  /* Always-dark marketing/product hero strip (portal). Same in both themes. */
+  --c-hero-dark: var(--p-zinc-950);
+  --c-hero-dark-cta-text: var(--p-navy-700);
+
+  /* Neutral solid badge fill (grey pill). */
+  --c-neutral-fill: var(--p-gray-500);
+
+  /* Static document illustration (theme-independent line work). */
+  --c-illustration-line: var(--p-gray-200);
+  --c-illustration-line-strong: var(--p-gray-300);
+
+  /* Viewer active file-tab tint base. */
+  --c-tab-active-tint: var(--p-blue-200);
+
+  /* Themed: file-card resting/unselected header (branded navy). */
+  --c-file-header-resting: var(--p-navy-500);
+
+  /* Themed: onboarding hero panel gradient + inset tile. */
+  --c-onboarding-hero: linear-gradient(
+    155deg,
+    var(--p-tint-blue) 0%,
+    var(--p-tint-violet) 55%,
+    var(--p-tint-pink) 100%
+  );
+  --c-onboarding-hero-tile: var(--p-white);
 }
 
 /* ── MIDNIGHT (original navy) — also the default portal/Storybook dark ────── */
@@ -60,6 +128,17 @@ html[data-app-theme="midnight"] {
 
   --c-success: var(--p-green-500);
   --c-danger: var(--p-red-500);
+  --c-warning: var(--p-amber-500);
+
+  /* Themed decorative dark overrides (see :root for light + rationale). */
+  --c-file-header-resting: var(--p-navy-950);
+  --c-onboarding-hero: linear-gradient(
+    155deg,
+    var(--p-navy-850) 0%,
+    var(--p-navy-880) 55%,
+    var(--p-plum-900) 100%
+  );
+  --c-onboarding-hero-tile: var(--p-navy-900);
 }
 
 /* ── Base accent — fixed default (blue buttons); [data-accent="default"] blocks at the end keep surfaces neutral. LIGHT base here, DARK base next. ── */
@@ -217,6 +296,17 @@ html[data-app-theme="custom"][data-mantine-color-scheme="dark"] {
   /* Dark-tuned status shades (lighter than the light-theme :root values). */
   --c-success: var(--p-green-500);
   --c-danger: var(--p-red-400);
+  --c-warning: var(--p-amber-500);
+
+  /* Themed decorative dark overrides (see :root for light + rationale). */
+  --c-file-header-resting: var(--p-navy-950);
+  --c-onboarding-hero: linear-gradient(
+    155deg,
+    var(--p-navy-850) 0%,
+    var(--p-navy-880) 55%,
+    var(--p-plum-900) 100%
+  );
+  --c-onboarding-hero-tile: var(--p-navy-900);
 
   /* Category icon chips → neutral. */
   --icon-tools-bg: var(--c-surface-raised);
diff --git a/frontend/editor/src/core/theme/compat.css b/frontend/editor/src/core/theme/compat.css
deleted file mode 100644
index a7c6e40759..0000000000
--- a/frontend/editor/src/core/theme/compat.css
+++ /dev/null
@@ -1,148 +0,0 @@
-/* COMPAT — legacy token names (editor --bg-/--text-, SUI/portal --color-) aliased onto the canonical --c- set so existing files keep working. :root:root (0,2,0) out-ranks the legacy blocks; aliases are theme-agnostic. */
-
-:root:root {
-  /* ── Canvas (darkest / centre) ── */
-  --bg-background: var(--c-bg);
-  --bg-file-manager: var(--c-bg);
-  --color-bg: var(--c-bg);
-
-  /* ── Raised chrome — sidebars, toolbars, headers, side nav. ── */
-  --bg-toolbar: var(--c-bg-raised);
-  --color-sidebar-bg: var(--c-bg-raised);
-  --color-header-bg: var(--c-bg-raised);
-  --modal-nav-bg: var(--c-bg-raised);
-  --unsupported-bar-bg: var(--c-bg-raised);
-
-  /* ── Surfaces — cards, modals, dropdowns, popovers ── */
-  --bg-surface: var(--c-surface);
-  --bg-file-list: var(--c-surface);
-  --modal-content-bg: var(--c-surface);
-  --bulk-panel-bg: var(--c-surface);
-  --bulk-card-bg: var(--c-surface);
-  --api-keys-card-bg: var(--c-surface);
-  --color-surface: var(--c-surface);
-  --color-dropdown-bg: var(--c-surface);
-  --information-text-bg: var(--c-surface);
-
-  --bg-raised: var(--c-surface-raised);
-  --file-card-bg: var(--c-surface-raised);
-  --color-surface-alt: var(--c-surface-raised);
-  --landing-inner-paper-bg: var(--c-surface-raised);
-  --accordion-item-bg: var(--c-surface-raised);
-
-  --bg-muted: var(--c-surface-sunken);
-  --color-bg-muted: var(--c-surface-sunken);
-  --tool-panel-search-bg: var(--c-surface-sunken);
-  --compare-page-label-bg: var(--c-surface-sunken);
-
-  /* ── Inputs ── */
-  --input-bg: var(--c-input-bg);
-  --api-keys-input-bg: var(--c-input-bg);
-
-  /* ── Text ── */
-  --text-primary: var(--c-text);
-  --color-text-1: var(--c-text);
-  --color-header-text: var(--c-text);
-  --color-logo-text: var(--c-text);
-  --tools-text-and-icon-color: var(--c-text);
-
-  --text-secondary: var(--c-text-muted);
-  --color-text-2: var(--c-text-muted);
-  --color-nav-hover-text: var(--c-text-muted);
-
-  --text-muted: var(--c-text-subtle);
-  --color-text-3: var(--c-text-subtle);
-  --color-text-4: var(--c-text-subtle);
-  --color-text-5: var(--c-text-subtle);
-  --color-text-6: var(--c-text-subtle);
-  --color-text-muted: var(--c-text-subtle);
-  --color-nav-text: var(--c-text-subtle);
-  --search-text-and-icon-color: var(--c-text-subtle);
-
-  /* ── Borders ── */
-  --border-default: var(--c-border);
-  --color-border: var(--c-border);
-  --color-border-input: var(--c-border);
-
-  --border-subtle: var(--c-border-subtle);
-  --color-border-light: var(--c-border-subtle);
-  --color-divider: var(--c-border-subtle);
-
-  --border-strong: var(--c-border-strong);
-  --border-hover: var(--c-border-strong);
-  --color-border-hover: var(--c-border-strong);
-
-  /* More borders/dividers that were still navy in neutral dark. */
-  --color-header-border: var(--c-border);
-  --color-sidebar-border: var(--c-border);
-  --color-dropdown-border: var(--c-border);
-  --color-search-border: var(--c-border);
-  --tool-header-border: var(--c-border);
-  --tool-panel-search-border-bottom: var(--c-border);
-  --landing-inner-paper-border: var(--c-border);
-  --unsupported-bar-border: var(--c-border);
-  --api-keys-card-border: var(--c-border);
-  --api-keys-input-border: var(--c-border);
-  --color-usage-track: var(--c-border);
-  --color-sidebar-divider: var(--c-border-subtle);
-  --tool-subcategory-rule-color: var(--c-border-subtle);
-  --modal-header-border: var(--c-border-subtle);
-
-  /* ── More surfaces that were still navy in neutral dark ── */
-  --color-bg-alt: var(--c-bg-raised);
-  --color-search-bg: var(--c-surface-sunken);
-  --color-dropdown-hover: var(--c-hover);
-  --tool-header-badge-bg: var(--c-surface-raised);
-  --color-nav-active: var(--c-primary-subtle);
-  --modal-nav-item-active-bg: var(--c-primary-subtle);
-
-  /* ── More text tokens that were still navy in neutral dark ── */
-  --onboarding-title: var(--c-text);
-  --onboarding-body: var(--c-text-muted);
-  --modal-nav-section-title: var(--c-text-subtle);
-  --tool-subcategory-text-color: var(--c-text-subtle);
-  --dropdown-trigger-text-disabled: var(--c-text-subtle);
-  --tool-header-badge-text: var(--c-accent-fg, var(--c-primary));
-  --tooltip-title-bg: color-mix(
-    in srgb,
-    var(--c-primary) 12%,
-    var(--c-surface)
-  );
-  --tooltip-title-color: var(--c-text);
-
-  /* ── Interaction states ── */
-  --hover-bg: var(--c-hover);
-  --color-bg-hover: var(--c-hover);
-  --color-nav-hover: var(--c-hover);
-  --automation-entry-hover-bg: var(--c-hover);
-  --active-bg: var(--c-active);
-
-  /* ── Primary / accent — fills/borders use raw --c-primary; text/icon-on-surface uses --c-accent-fg (falls back to --c-primary outside the custom theme). ── */
-  --color-blue: var(--c-primary);
-  --accent-blue: var(--c-primary);
-  --accent-interactive: var(--c-primary);
-  --btn-open-file: var(--c-primary);
-  --card-selected-border: var(--c-primary);
-  --checkbox-checked-bg: var(--c-primary);
-  --color-blue-dark: var(--c-primary-hover);
-  --modal-nav-item-active: var(--c-accent-fg, var(--c-primary));
-  --color-nav-active-text: var(--c-accent-fg, var(--c-primary));
-  --tool-header-text: var(--c-accent-fg, var(--c-primary));
-  --text-instruction: var(--c-accent-fg, var(--c-primary));
-  --landing-button-color: var(--c-accent-fg, var(--c-primary));
-  /* SUI "blue" accent border/light (secondary buttons, chips) — derived from the primary. */
-  --color-blue-border: color-mix(
-    in srgb,
-    var(--c-primary) 38%,
-    var(--c-surface)
-  );
-  --color-blue-light: color-mix(
-    in srgb,
-    var(--c-primary) 12%,
-    var(--c-surface)
-  );
-
-  /* ── Status ── */
-  --accent-green: var(--c-success);
-  --accent-red: var(--c-danger);
-}
diff --git a/frontend/editor/src/core/theme/index.css b/frontend/editor/src/core/theme/index.css
index dc4523c653..9131c18ccb 100644
--- a/frontend/editor/src/core/theme/index.css
+++ b/frontend/editor/src/core/theme/index.css
@@ -1,5 +1,4 @@
-/* Consolidated theme entry. Order matters: primitives → dimensions → colors → compat (legacy aliases, :root:root wins). */
+/* Consolidated theme entry. Order matters: primitives → dimensions → colors. */
 @import "./primitives.css";
 @import "./dimensions.css";
 @import "./colors.css";
-@import "./compat.css";
diff --git a/frontend/editor/src/core/theme/mantineTheme.ts b/frontend/editor/src/core/theme/mantineTheme.ts
index 21496939af..bd0f7b764f 100644
--- a/frontend/editor/src/core/theme/mantineTheme.ts
+++ b/frontend/editor/src/core/theme/mantineTheme.ts
@@ -118,7 +118,7 @@ export const mantineTheme = createTheme({
       overlayBorder: "var(--color-primary-500)",
       overlayBackground: "rgba(59, 130, 246, 0.1)", // Blue with 10% opacity
       handleColor: "var(--color-primary-500)",
-      handleBorder: "var(--bg-surface)",
+      handleBorder: "var(--c-surface)",
     },
   },
 
@@ -135,11 +135,11 @@ export const mantineTheme = createTheme({
         // Custom button variant for PDF tools
         pdfTool: (_theme: MantineTheme) => ({
           root: {
-            backgroundColor: "var(--bg-surface)",
-            border: "1px solid var(--border-default)",
-            color: "var(--text-primary)",
+            backgroundColor: "var(--c-surface)",
+            border: "1px solid var(--c-border)",
+            color: "var(--c-text)",
             "&:hover": {
-              backgroundColor: "var(--hover-bg)",
+              backgroundColor: "var(--c-hover)",
               borderColor: "var(--color-primary-500)",
             },
           },
@@ -150,8 +150,8 @@ export const mantineTheme = createTheme({
     Paper: {
       styles: {
         root: {
-          backgroundColor: "var(--bg-surface)",
-          border: "1px solid var(--border-subtle)",
+          backgroundColor: "var(--c-surface)",
+          border: "1px solid var(--c-border-subtle)",
         },
       },
     },
@@ -159,8 +159,8 @@ export const mantineTheme = createTheme({
     Card: {
       styles: {
         root: {
-          backgroundColor: "var(--bg-surface)",
-          border: "1px solid var(--border-subtle)",
+          backgroundColor: "var(--c-surface)",
+          border: "1px solid var(--c-border-subtle)",
           boxShadow: "var(--shadow-sm)",
         },
       },
@@ -170,7 +170,7 @@ export const mantineTheme = createTheme({
       styles: {
         root: {
           backgroundColor: "var(--color-gray-100)",
-          color: "var(--text-primary)",
+          color: "var(--c-text)",
         },
       },
     },
@@ -178,16 +178,16 @@ export const mantineTheme = createTheme({
     Textarea: {
       styles: (_theme: MantineTheme) => ({
         input: {
-          backgroundColor: "var(--bg-surface)",
-          borderColor: "var(--border-default)",
-          color: "var(--text-primary)",
+          backgroundColor: "var(--c-surface)",
+          borderColor: "var(--c-border)",
+          color: "var(--c-text)",
           "&:focus": {
             borderColor: "var(--color-primary-500)",
             boxShadow: "0 0 0 1px var(--color-primary-500)",
           },
         },
         label: {
-          color: "var(--text-secondary)",
+          color: "var(--c-text-muted)",
           fontWeight: "var(--font-weight-medium)",
         },
       }),
@@ -196,16 +196,16 @@ export const mantineTheme = createTheme({
     TextInput: {
       styles: (_theme: MantineTheme) => ({
         input: {
-          backgroundColor: "var(--bg-surface)",
-          borderColor: "var(--border-default)",
-          color: "var(--text-primary)",
+          backgroundColor: "var(--c-surface)",
+          borderColor: "var(--c-border)",
+          color: "var(--c-text)",
           "&:focus": {
             borderColor: "var(--color-primary-500)",
             boxShadow: "0 0 0 1px var(--color-primary-500)",
           },
         },
         label: {
-          color: "var(--text-secondary)",
+          color: "var(--c-text-muted)",
           fontWeight: "var(--font-weight-medium)",
         },
       }),
@@ -214,16 +214,16 @@ export const mantineTheme = createTheme({
     PasswordInput: {
       styles: (_theme: MantineTheme) => ({
         input: {
-          backgroundColor: "var(--bg-surface)",
-          borderColor: "var(--border-default)",
-          color: "var(--text-primary)",
+          backgroundColor: "var(--c-surface)",
+          borderColor: "var(--c-border)",
+          color: "var(--c-text)",
           "&:focus": {
             borderColor: "var(--color-primary-500)",
             boxShadow: "0 0 0 1px var(--color-primary-500)",
           },
         },
         label: {
-          color: "var(--text-secondary)",
+          color: "var(--c-text-muted)",
           fontWeight: "var(--font-weight-medium)",
         },
       }),
@@ -232,26 +232,26 @@ export const mantineTheme = createTheme({
     Select: {
       styles: {
         input: {
-          backgroundColor: "var(--bg-surface)",
-          borderColor: "var(--border-default)",
-          color: "var(--text-primary)",
+          backgroundColor: "var(--c-surface)",
+          borderColor: "var(--c-border)",
+          color: "var(--c-text)",
           "&:focus": {
             borderColor: "var(--color-primary-500)",
             boxShadow: "0 0 0 1px var(--color-primary-500)",
           },
         },
         label: {
-          color: "var(--text-secondary)",
+          color: "var(--c-text-muted)",
           fontWeight: "var(--font-weight-medium)",
         },
         dropdown: {
-          backgroundColor: "var(--bg-surface)",
-          borderColor: "var(--border-subtle)",
+          backgroundColor: "var(--c-surface)",
+          borderColor: "var(--c-border-subtle)",
           boxShadow: "var(--shadow-lg)",
         },
         option: {
-          color: "var(--text-primary)",
-          "--combobox-option-hover": "var(--hover-bg)",
+          color: "var(--c-text)",
+          "--combobox-option-hover": "var(--c-hover)",
           "--combobox-option-selected": "var(--color-primary-100)",
         },
       },
@@ -260,26 +260,26 @@ export const mantineTheme = createTheme({
     MultiSelect: {
       styles: {
         input: {
-          backgroundColor: "var(--bg-surface)",
-          borderColor: "var(--border-default)",
-          color: "var(--text-primary)",
+          backgroundColor: "var(--c-surface)",
+          borderColor: "var(--c-border)",
+          color: "var(--c-text)",
           "&:focus": {
             borderColor: "var(--color-primary-500)",
             boxShadow: "0 0 0 1px var(--color-primary-500)",
           },
         },
         label: {
-          color: "var(--text-secondary)",
+          color: "var(--c-text-muted)",
           fontWeight: "var(--font-weight-medium)",
         },
         dropdown: {
-          backgroundColor: "var(--bg-surface)",
-          borderColor: "var(--border-subtle)",
+          backgroundColor: "var(--c-surface)",
+          borderColor: "var(--c-border-subtle)",
           boxShadow: "var(--shadow-lg)",
         },
         option: {
-          color: "var(--text-primary)",
-          "--combobox-option-hover": "var(--hover-bg)",
+          color: "var(--c-text)",
+          "--combobox-option-hover": "var(--c-hover)",
           "--combobox-option-selected": "var(--color-primary-100)",
         },
       },
@@ -287,8 +287,9 @@ export const mantineTheme = createTheme({
     Tooltip: {
       styles: {
         tooltip: {
-          backgroundColor: "var( --tooltip-title-bg)",
-          color: "var( --tooltip-title-color)",
+          backgroundColor:
+            "color-mix( in srgb, var(--c-primary) 12%, var(--c-surface) )",
+          color: "var(--c-text)",
           border: "1px solid var(--tooltip-border)",
           fontSize: "0.75rem",
           fontWeight: "500",
@@ -301,14 +302,14 @@ export const mantineTheme = createTheme({
     Checkbox: {
       styles: {
         input: {
-          borderColor: "var(--border-default)",
+          borderColor: "var(--c-border)",
           "&:checked": {
             backgroundColor: "var(--color-primary-500)",
             borderColor: "var(--color-primary-500)",
           },
         },
         label: {
-          color: "var(--text-primary)",
+          color: "var(--c-text)",
         },
       },
     },
@@ -316,7 +317,7 @@ export const mantineTheme = createTheme({
     Slider: {
       styles: {
         track: {
-          backgroundColor: "var(--bg-muted)",
+          backgroundColor: "var(--c-surface-sunken)",
         },
         bar: {
           backgroundColor: "var(--color-primary-500)",
@@ -326,10 +327,10 @@ export const mantineTheme = createTheme({
           borderColor: "var(--color-primary-500)",
         },
         mark: {
-          borderColor: "var(--border-default)",
+          borderColor: "var(--c-border)",
         },
         markLabel: {
-          color: "var(--text-muted)",
+          color: "var(--c-text-subtle)",
         },
       },
     },
@@ -337,16 +338,16 @@ export const mantineTheme = createTheme({
     Modal: {
       styles: {
         content: {
-          backgroundColor: "var(--bg-surface)",
-          border: "1px solid var(--border-subtle)",
+          backgroundColor: "var(--c-surface)",
+          border: "1px solid var(--c-border-subtle)",
           boxShadow: "var(--shadow-xl)",
         },
         header: {
-          backgroundColor: "var(--bg-surface)",
-          borderBottom: "1px solid var(--border-subtle)",
+          backgroundColor: "var(--c-surface)",
+          borderBottom: "1px solid var(--c-border-subtle)",
         },
         title: {
-          color: "var(--text-primary)",
+          color: "var(--c-text)",
           fontWeight: "var(--font-weight-semibold)",
         },
       },
@@ -355,15 +356,15 @@ export const mantineTheme = createTheme({
     Notification: {
       styles: {
         root: {
-          backgroundColor: "var(--bg-surface)",
-          border: "1px solid var(--border-subtle)",
+          backgroundColor: "var(--c-surface)",
+          border: "1px solid var(--c-border-subtle)",
           boxShadow: "var(--shadow-lg)",
         },
         title: {
-          color: "var(--text-primary)",
+          color: "var(--c-text)",
         },
         description: {
-          color: "var(--text-secondary)",
+          color: "var(--c-text-muted)",
         },
       },
     },
diff --git a/frontend/editor/src/core/theme/primitives.css b/frontend/editor/src/core/theme/primitives.css
index 901a3dd646..22716816a2 100644
--- a/frontend/editor/src/core/theme/primitives.css
+++ b/frontend/editor/src/core/theme/primitives.css
@@ -42,4 +42,128 @@
   --p-red-400: #f87171;
   --p-red-500: #ef4444;
   --p-red-600: #dc2626;
+
+  /* Brand-red + ai-accent scales, consumed by core/ui/accents.css. */
+  --p-brand-red-200: #d9a8a8;
+  --p-brand-red-300: #d98a8a;
+  --p-brand-red-650: #8e3131;
+  --p-brand-red-700: #7a2929;
+  --p-brand-red-900: #5a2424;
+  --p-cyan-400: #22d3ee;
+  --p-indigo-200: #c7d2fe;
+  --p-indigo-300: #a5b4fc;
+  --p-indigo-400: #818cf8;
+  --p-indigo-500: #6366f1;
+  --p-indigo-800: #3730a3;
+
+  /* Extended accent/status/neutral weights referenced by app CSS. */
+  --p-azure-300: #7ab4ff;
+  --p-azure-400: #38bdf8;
+  --p-cyan-500: #06b6d4;
+  --p-green-400: #4ade80;
+  --p-pink-500: #ec4899;
+  --p-purple-500: #6c5ce7;
+  --p-periwinkle-500: #635bff;
+  --p-teal-700: #0f7b6c;
+  --p-gray-450: #868e96;
+  --p-gray-b0: #b0b0b0;
+  --p-gray-mid: #808080;
+
+  /* Brand red (login/auth CTAs) — base + hover, complementing the -200..-900 scale above. */
+  --p-brand-red: #af3434;
+  --p-brand-red-600: #9a2e2e;
+
+  /* Highlight flash (compare / show-JS / signature-report animations). */
+  --p-flash-yellow: #ffeb3b;
+
+  /* Onboarding hero gradient stops (dark decorative navies + light tints). */
+  --p-navy-850: #1a2236;
+  --p-navy-880: #171e30;
+  --p-navy-900: #0f1626;
+  --p-plum-900: #201a28;
+  --p-tint-blue: #eef1fb;
+  --p-tint-violet: #f6f4fc;
+  --p-tint-pink: #fbf4f7;
+
+  /* Notion-style procurement view palette. */
+  --p-notion-blue: #2383e2;
+  --p-notion-blue-strong: #1b6ec2;
+  --p-notion-blue-border: #b8d5f2;
+  --p-notion-ink: #37352f;
+  --p-notion-gray: #9b9a97;
+  --p-notion-gray-strong: #787774;
+  --p-notion-paper: #f5f4f1;
+  --p-notion-paper-2: #f0eee9;
+  --p-notion-border: #e3e1dc;
+  --p-notion-border-2: #eae8e3;
+  --p-notion-border-cool: #d3d1cb;
+
+  /* Vendor status chips (procurement / auth callback). */
+  --p-vendor-red: #ef5350;
+  --p-vendor-red-text: #c62828;
+  --p-vendor-red-soft: #ef9a9a;
+  --p-vendor-red-bg: #ffebee;
+  --p-vendor-red-border: #ffcdd2;
+  --p-vendor-red-bg-dark: #3d2020;
+  --p-vendor-red-border-dark: #5d3030;
+  --p-vendor-green: #66bb6a;
+
+  /* Palette entries migrated from literals in consuming files. */
+  --p-c-0550ae: #0550ae;
+  --p-emerald-600: #059669;
+  --p-code-string: #0a3069;
+  --p-azure-500: #0a8bff;
+  --p-navy-950: #0d1020;
+  --p-c-0f172a: #0f172a;
+  --p-emerald-500: #10b981;
+  --p-navy-700: #16213e;
+  --p-c-1a2332: #1a2332;
+  --p-c-1c2340: #1c2340;
+  --p-c-1e293b: #1e293b;
+  --p-c-1f2328: #1f2328;
+  --p-royal-700: #2040a0;
+  --p-c-2d3560: #2d3560;
+  --p-emerald-400: #34d399;
+  --p-azure-650: #3a7be8;
+  --p-navy-500: #3b4b6e;
+  --p-c-475569: #475569;
+  --p-c-334155: #334155;
+  --p-c-cbd5e1: #cbd5e1;
+  --p-azure-550: #4c8bf5;
+  --p-c-545454: #545454;
+  --p-azure-450: #5b9bf7;
+  --p-c-64748b: #64748b;
+  --p-c-656d76: #656d76;
+  --p-c-6e7781: #6e7781;
+  --p-violet-600: #7c3aed;
+  --p-c-7e7e7e: #7e7e7e;
+  --p-c-8250df: #8250df;
+  --p-violet-500: #8b5cf6;
+  --p-c-8c959f: #8c959f;
+  --p-blue-200: #93c5fd;
+  --p-c-94a3b8: #94a3b8;
+  --p-code-type: #953800;
+  --p-violet-400: #a78bfa;
+  --p-c-acacac: #acacac;
+  --p-c-c084fc: #c084fc;
+  --p-art-red-muted: #c56565;
+  --p-c-cf222e: #cf222e;
+  --p-c-d0d6dc: #d0d6dc;
+  --p-c-d0d7de: #d0d7de;
+  --p-c-d0dbdc: #d0dbdc;
+  --p-c-d3d3d3: #d3d3d3;
+  --p-c-d62626: #d62626;
+  --p-c-e6e6e6: #e6e6e6;
+  --p-c-eaeef2: #eaeef2;
+  --p-c-eef1f4: #eef1f4;
+  --p-c-f1f5f9: #f1f5f9;
+  --p-c-f472b6: #f472b6;
+  --p-c-f6f8fa: #f6f8fa;
+  --p-c-f8fafc: #f8fafc;
+  --p-art-red-soft: #fc9999;
+  --p-art-red-light: #fca5a5;
+  --p-art-red: #ff4b4b;
+  --p-c-ffc107: #ffc107;
+  --p-c-c2c8e0: #c2c8e0;
+  --p-c-4f8ef5: #4f8ef5;
 }
diff --git a/frontend/editor/src/core/tokens/Tokens.stories.tsx b/frontend/editor/src/core/tokens/Tokens.stories.tsx
index 7543d7d4d6..0003c06b17 100644
--- a/frontend/editor/src/core/tokens/Tokens.stories.tsx
+++ b/frontend/editor/src/core/tokens/Tokens.stories.tsx
@@ -42,8 +42,8 @@ function Group({ heading, swatches }: { heading: string; swatches: Swatch[] }) {
               alignItems: "center",
               gap: 10,
               padding: 10,
-              background: "var(--color-surface)",
-              border: "1px solid var(--color-border)",
+              background: "var(--c-surface)",
+              border: "1px solid var(--c-border)",
               borderRadius: "var(--radius-md)",
             }}
           >
@@ -53,7 +53,7 @@ function Group({ heading, swatches }: { heading: string; swatches: Swatch[] }) {
                 height: 36,
                 borderRadius: 6,
                 background: `var(${s.varName})`,
-                border: "1px solid var(--color-border)",
+                border: "1px solid var(--c-border)",
                 flexShrink: 0,
               }}
             />
@@ -62,7 +62,7 @@ function Group({ heading, swatches }: { heading: string; swatches: Swatch[] }) {
                 style={{
                   fontSize: 12,
                   fontWeight: 500,
-                  color: "var(--color-text-2)",
+                  color: "var(--c-text-muted)",
                 }}
               >
                 {s.label}
@@ -71,7 +71,7 @@ function Group({ heading, swatches }: { heading: string; swatches: Swatch[] }) {
                 style={{
                   fontSize: 11,
                   fontFamily: "var(--font-mono)",
-                  color: "var(--color-text-4)",
+                  color: "var(--c-text-subtle)",
                   overflow: "hidden",
                   textOverflow: "ellipsis",
                 }}
@@ -154,14 +154,14 @@ export const Typography: Story = {
         display: "flex",
         flexDirection: "column",
         gap: 18,
-        color: "var(--color-text-1)",
+        color: "var(--c-text)",
       }}
     >
       <div>
         <div
           style={{
             fontSize: 11,
-            color: "var(--color-text-5)",
+            color: "var(--c-text-subtle)",
             marginBottom: 4,
           }}
         >
@@ -181,7 +181,7 @@ export const Typography: Story = {
         <div
           style={{
             fontSize: 11,
-            color: "var(--color-text-5)",
+            color: "var(--c-text-subtle)",
             marginBottom: 4,
           }}
         >
@@ -193,7 +193,7 @@ export const Typography: Story = {
         <div
           style={{
             fontSize: 11,
-            color: "var(--color-text-5)",
+            color: "var(--c-text-subtle)",
             marginBottom: 4,
           }}
         >
@@ -207,7 +207,7 @@ export const Typography: Story = {
         <div
           style={{
             fontSize: 11,
-            color: "var(--color-text-5)",
+            color: "var(--c-text-subtle)",
             marginBottom: 4,
           }}
         >
@@ -221,7 +221,7 @@ export const Typography: Story = {
         <div
           style={{
             fontSize: 11,
-            color: "var(--color-text-5)",
+            color: "var(--c-text-subtle)",
             marginBottom: 4,
           }}
         >
@@ -240,8 +240,8 @@ export const Motion: Story = {
     <div style={{ display: "flex", flexDirection: "column", gap: 18 }}>
       <div
         style={{
-          background: "var(--color-surface)",
-          border: "1px solid var(--color-border)",
+          background: "var(--c-surface)",
+          border: "1px solid var(--c-border)",
           padding: 16,
           borderRadius: 8,
           animation: "fadeInUp 0.25s cubic-bezier(0.4, 0, 0.2, 1) both",
diff --git a/frontend/editor/src/core/tokens/base.css b/frontend/editor/src/core/tokens/base.css
index 581af3f387..562c6bcc25 100644
--- a/frontend/editor/src/core/tokens/base.css
+++ b/frontend/editor/src/core/tokens/base.css
@@ -11,8 +11,8 @@ body,
 #root {
   margin: 0;
   padding: 0;
-  background: var(--color-bg);
-  color: var(--color-text-2);
+  background: var(--c-bg);
+  color: var(--c-text-muted);
   font-family: var(--font-sans);
   -webkit-font-smoothing: antialiased;
   -moz-osx-font-smoothing: grayscale;
@@ -29,7 +29,7 @@ button {
 }
 
 a {
-  color: var(--color-blue);
+  color: var(--c-primary);
   text-decoration: none;
 }
 a:hover {
diff --git a/frontend/editor/src/core/tokens/tokens.css b/frontend/editor/src/core/tokens/tokens.css
index 989fdb7e4b..6f4a5f5204 100644
--- a/frontend/editor/src/core/tokens/tokens.css
+++ b/frontend/editor/src/core/tokens/tokens.css
@@ -26,24 +26,56 @@
 
   /* Brand / status */
   --color-purple: var(--p-blue-400);
-  --color-purple-light: var(--p-blue-400);
-  --color-purple-border: var(--p-blue-400);
+  --color-purple-light: color-mix(
+    in srgb,
+    var(--p-blue-400) 13%,
+    var(--p-white)
+  );
+  --color-purple-border: color-mix(
+    in srgb,
+    var(--p-blue-400) 40%,
+    var(--p-white)
+  );
   --color-purple-dark: var(--p-blue-600);
   --color-green: var(--p-green-500);
-  --color-green-light: var(--p-green-500);
-  --color-green-border: var(--p-green-500);
+  --color-green-light: color-mix(
+    in srgb,
+    var(--p-green-500) 13%,
+    var(--p-white)
+  );
+  --color-green-border: color-mix(
+    in srgb,
+    var(--p-green-500) 40%,
+    var(--p-white)
+  );
   --color-green-dark: var(--p-green-600);
   --color-red: var(--p-red-500);
-  --color-red-light: var(--p-red-400);
-  --color-red-border: var(--p-red-400);
+  --color-red-light: color-mix(in srgb, var(--p-red-500) 13%, var(--p-white));
+  --color-red-border: color-mix(in srgb, var(--p-red-500) 40%, var(--p-white));
   --color-red-dark: var(--p-red-600);
   --color-amber: var(--p-amber-500);
-  --color-amber-light: var(--p-amber-400);
-  --color-amber-border: var(--p-amber-400);
+  --color-amber-light: color-mix(
+    in srgb,
+    var(--p-amber-500) 15%,
+    var(--p-white)
+  );
+  --color-amber-border: color-mix(
+    in srgb,
+    var(--p-amber-500) 42%,
+    var(--p-white)
+  );
   --color-amber-dark: var(--p-amber-600);
   --color-orange: var(--p-amber-600);
-  --color-orange-light: var(--p-amber-400);
-  --color-orange-border: var(--p-amber-400);
+  --color-orange-light: color-mix(
+    in srgb,
+    var(--p-amber-600) 15%,
+    var(--p-white)
+  );
+  --color-orange-border: color-mix(
+    in srgb,
+    var(--p-amber-600) 42%,
+    var(--p-white)
+  );
   --color-orange-dark: var(--p-red-600);
 
   /* Category accents (theme-stable) */
@@ -60,7 +92,7 @@
   --color-cat-extraction: var(--p-blue-500);
 
   /* Surfaces */
-  --color-bg-subtle: var(--p-gray-50);
+  --color-bg-subtle: var(--c-surface-sunken);
   --color-bg-code: var(--p-gray-100);
 
   /* Dropdowns / tooltips */
@@ -93,33 +125,33 @@
   /* Gradients */
   --grad-blue-btn: linear-gradient(
     180deg,
-    #5b9bf7 0%,
-    #4c8bf5 50%,
-    #3a7be8 100%
+    var(--p-azure-450) 0%,
+    var(--p-azure-550) 50%,
+    var(--p-azure-650) 100%
   );
   --grad-purple-btn: linear-gradient(
     180deg,
-    #a78bfa 0%,
-    #8b5cf6 50%,
-    #7c3aed 100%
+    var(--p-violet-400) 0%,
+    var(--p-violet-500) 50%,
+    var(--p-violet-600) 100%
   );
   --grad-green-btn: linear-gradient(
     180deg,
-    #34d399 0%,
-    #10b981 50%,
-    #059669 100%
+    var(--p-emerald-400) 0%,
+    var(--p-emerald-500) 50%,
+    var(--p-emerald-600) 100%
   );
   --grad-amber-btn: linear-gradient(
     180deg,
-    #fbbf24 0%,
-    #f59e0b 50%,
-    #d97706 100%
+    var(--p-amber-400) 0%,
+    var(--p-amber-500) 50%,
+    var(--p-amber-600) 100%
   );
   --grad-red-btn: linear-gradient(
     180deg,
-    #f87171 0%,
-    #ef4444 50%,
-    #dc2626 100%
+    var(--p-red-400) 0%,
+    var(--p-red-500) 50%,
+    var(--p-red-600) 100%
   );
 }
 
@@ -132,7 +164,11 @@
   --color-purple-border: var(--p-zinc-600);
   --color-purple-dark: var(--p-blue-400);
   --color-green: var(--p-green-500);
-  --color-green-light: var(--p-green-700);
+  --color-green-light: color-mix(
+    in srgb,
+    var(--p-green-500) 20%,
+    var(--p-zinc-900)
+  );
   --color-green-border: var(--p-green-700);
   --color-green-dark: var(--p-green-500);
   --color-red: var(--p-red-400);
@@ -140,7 +176,11 @@
   --color-red-border: var(--p-red-600);
   --color-red-dark: var(--p-red-500);
   --color-amber: var(--p-amber-400);
-  --color-amber-light: var(--p-amber-600);
+  --color-amber-light: color-mix(
+    in srgb,
+    var(--p-amber-500) 20%,
+    var(--p-zinc-900)
+  );
   --color-amber-border: var(--p-amber-600);
   /* Deeper than the base so it stays distinct (hover shade + amber text on
      dark surfaces). ~7.4:1 on --color-amber-light, passes WCAG AA. Was
@@ -148,11 +188,15 @@
      no-op in dark mode. */
   --color-amber-dark: var(--p-amber-500);
   --color-orange: var(--p-amber-500);
-  --color-orange-light: var(--p-amber-600);
+  --color-orange-light: color-mix(
+    in srgb,
+    var(--p-amber-600) 30%,
+    var(--p-zinc-900)
+  );
   --color-orange-border: var(--p-red-600);
   --color-orange-dark: var(--p-amber-400);
 
-  --color-bg-subtle: var(--p-gray-900);
+  --color-bg-subtle: var(--c-surface-sunken);
   --color-bg-code: var(--p-zinc-900);
 
   --color-tooltip-bg: var(--p-gray-250);
@@ -176,9 +220,9 @@
 
   --grad-blue-btn: linear-gradient(
     180deg,
-    #3b82f6 0%,
-    #2563eb 50%,
-    #1d4ed8 100%
+    var(--p-blue-500) 0%,
+    var(--p-blue-600) 50%,
+    var(--p-blue-700) 100%
   );
 }
 
@@ -187,39 +231,39 @@
    base colours are load-bearing; the syntax slots are kept for future Shiki. */
 :root,
 [data-theme="light"] {
-  --code-bg: #f6f8fa;
-  --code-bg-alt: #eef1f4;
-  --code-bg-header: #eaeef2;
-  --code-text: #1f2328;
-  --code-dim: #656d76;
-  --code-muted: #8c959f;
-  --code-keyword: #cf222e;
-  --code-string: #0a3069;
-  --code-number: #0550ae;
-  --code-fn: #8250df;
-  --code-type: #953800;
-  --code-property: #0550ae;
-  --code-comment: #6e7781;
-  --code-border: #d0d7de;
+  --code-bg: var(--p-c-f6f8fa);
+  --code-bg-alt: var(--p-c-eef1f4);
+  --code-bg-header: var(--p-c-eaeef2);
+  --code-text: var(--p-c-1f2328);
+  --code-dim: var(--p-c-656d76);
+  --code-muted: var(--p-c-8c959f);
+  --code-keyword: var(--p-c-cf222e);
+  --code-string: var(--p-code-string);
+  --code-number: var(--p-c-0550ae);
+  --code-fn: var(--p-c-8250df);
+  --code-type: var(--p-code-type);
+  --code-property: var(--p-c-0550ae);
+  --code-comment: var(--p-c-6e7781);
+  --code-border: var(--p-c-d0d7de);
   /* Window-chrome traffic-light dots in the code-block header. */
-  --code-dot: #d0d7de;
+  --code-dot: var(--p-c-d0d7de);
 }
 [data-theme="dark"] {
-  --code-bg: #0f172a;
-  --code-bg-alt: #1e293b;
-  --code-bg-header: #1a2332;
-  --code-text: #e2e8f0;
-  --code-dim: #64748b;
-  --code-muted: #94a3b8;
-  --code-keyword: #60a5fa;
-  --code-string: #fbbf24;
-  --code-number: #c084fc;
-  --code-fn: #34d399;
-  --code-type: #f472b6;
-  --code-property: #93c5fd;
-  --code-comment: #475569;
-  --code-border: #1e293b;
-  --code-dot: #475569;
+  --code-bg: var(--p-c-0f172a);
+  --code-bg-alt: var(--p-c-1e293b);
+  --code-bg-header: var(--p-c-1a2332);
+  --code-text: var(--p-gray-250);
+  --code-dim: var(--p-c-64748b);
+  --code-muted: var(--p-c-94a3b8);
+  --code-keyword: var(--p-blue-400);
+  --code-string: var(--p-amber-400);
+  --code-number: var(--p-c-c084fc);
+  --code-fn: var(--p-emerald-400);
+  --code-type: var(--p-c-f472b6);
+  --code-property: var(--p-blue-200);
+  --code-comment: var(--p-c-475569);
+  --code-border: var(--p-c-1e293b);
+  --code-dot: var(--p-c-475569);
 }
 
 /* Radii / typography / motion / spacing / z-index — theme-stable */
@@ -227,7 +271,7 @@
   /* Home hero strip navy. Theme-stable by design — the white hero CTA keeps
      this deep navy text in both light and dark (branded surface). The hero
      background itself is accent-responsive (see EditorStatusCard/WelcomeBanner). */
-  --color-hero-navy: #16213e;
+  --color-hero-navy: var(--p-navy-700);
 
   /* 4-px grid spacing scale (rem so it tracks font-size changes). Use these
      in layout primitives + component CSS instead of bare 0.5rem / 0.75rem. */
diff --git a/frontend/editor/src/core/tools/Compare.tsx b/frontend/editor/src/core/tools/Compare.tsx
index d7d6e0f65b..0b2a8d5171 100644
--- a/frontend/editor/src/core/tools/Compare.tsx
+++ b/frontend/editor/src/core/tools/Compare.tsx
@@ -357,10 +357,10 @@ const Compare = (props: BaseToolProps) => {
             data-slot-state="filled"
             data-slot-filename={stub?.name}
             style={{
-              border: "1px solid var(--border-default)",
+              border: "1px solid var(--c-border)",
               borderRadius: "var(--radius-md)",
               padding: "0.75rem 1rem",
-              background: "var(--bg-surface)",
+              background: "var(--c-surface)",
               width: "100%",
               minHeight: "9rem",
               position: "relative",
diff --git a/frontend/editor/src/core/tools/formFill/FormFieldSidebar.tsx b/frontend/editor/src/core/tools/formFill/FormFieldSidebar.tsx
index 2e49991ceb..d348c5c241 100644
--- a/frontend/editor/src/core/tools/formFill/FormFieldSidebar.tsx
+++ b/frontend/editor/src/core/tools/formFill/FormFieldSidebar.tsx
@@ -82,9 +82,9 @@ export function FormFieldSidebar({ visible, onToggle }: FormFieldSidebarProps) {
         zIndex: 999,
         display: "flex",
         flexDirection: "column",
-        background: "var(--bg-toolbar, var(--mantine-color-body))",
+        background: "var(--c-bg-raised, var(--mantine-color-body))",
         borderLeft:
-          "1px solid var(--border-subtle, var(--mantine-color-default-border))",
+          "1px solid var(--c-border-subtle, var(--mantine-color-default-border))",
         boxShadow: "-4px 0 16px rgba(0,0,0,0.08)",
       }}
     >
@@ -96,7 +96,7 @@ export function FormFieldSidebar({ visible, onToggle }: FormFieldSidebarProps) {
           justifyContent: "space-between",
           padding: "0.625rem 0.75rem",
           borderBottom:
-            "1px solid var(--border-subtle, var(--mantine-color-default-border))",
+            "1px solid var(--c-border-subtle, var(--mantine-color-default-border))",
           flexShrink: 0,
         }}
       >
diff --git a/frontend/editor/src/core/tools/formFill/FormFill.module.css b/frontend/editor/src/core/tools/formFill/FormFill.module.css
index 4cffc284f5..800e610c03 100644
--- a/frontend/editor/src/core/tools/formFill/FormFill.module.css
+++ b/frontend/editor/src/core/tools/formFill/FormFill.module.css
@@ -8,8 +8,7 @@
 
 .modeTabs {
   flex-shrink: 0;
-  border-bottom: 1px solid
-    var(--border-default, var(--mantine-color-default-border));
+  border-bottom: 1px solid var(--c-border, var(--mantine-color-default-border));
   background: transparent;
   padding: 0.25rem;
 }
@@ -44,7 +43,7 @@
   font-weight: 700;
   text-transform: uppercase;
   letter-spacing: 0.02em;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   transition: color 0.15s ease;
   line-height: 1;
 }
@@ -59,8 +58,7 @@
   flex-shrink: 0;
   padding: 0.75rem 1rem;
   background: transparent;
-  border-bottom: 1px solid
-    var(--border-default, var(--mantine-color-default-border));
+  border-bottom: 1px solid var(--c-border, var(--mantine-color-default-border));
   display: flex;
   flex-direction: column;
   gap: 0.625rem;
@@ -76,7 +74,7 @@
 .progressLabel {
   font-size: 0.6875rem;
   font-weight: 600;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   white-space: nowrap;
 }
 
@@ -133,7 +131,7 @@
   content: "";
   flex: 1;
   height: 1px;
-  background: var(--border-default, var(--mantine-color-default-border));
+  background: var(--c-border, var(--mantine-color-default-border));
   opacity: 0.2;
 }
 
@@ -142,22 +140,22 @@
   font-weight: 800;
   text-transform: uppercase;
   letter-spacing: 0.1em;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   opacity: 0.6;
 }
 
 .fieldCard {
   padding: 0.625rem 0.75rem;
   border-radius: var(--radius-md);
-  border: 1px solid var(--border-default, var(--mantine-color-default-border));
-  background: var(--bg-surface, var(--mantine-color-body));
+  border: 1px solid var(--c-border, var(--mantine-color-default-border));
+  background: var(--c-surface, var(--mantine-color-body));
   cursor: pointer;
   transition: all 0.15s ease;
 }
 
 .fieldCard:hover {
   border-color: var(--mantine-color-blue-5);
-  background: var(--bg-surface);
+  background: var(--c-surface);
 }
 
 .fieldCardActive {
@@ -193,7 +191,7 @@
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
-  color: var(--text-primary);
+  color: var(--c-text);
 }
 
 .fieldRequired {
@@ -214,7 +212,7 @@
 .fieldHint {
   margin-top: 0.375rem;
   font-size: 0.6875rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   line-height: 1.4;
   font-style: italic;
   opacity: 0.8;
@@ -235,7 +233,7 @@
   gap: 0.75rem;
   padding: 5rem 1.5rem;
   text-align: center;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   background: transparent;
 }
 
@@ -263,14 +261,13 @@
 .statusBar {
   flex-shrink: 0;
   padding: 0.5rem 1rem;
-  border-top: 1px solid
-    var(--border-default, var(--mantine-color-default-border));
+  border-top: 1px solid var(--c-border, var(--mantine-color-default-border));
   display: flex;
   align-items: center;
   justify-content: space-between;
   font-size: 0.6875rem;
   font-weight: 600;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   background: transparent;
 }
 
@@ -294,7 +291,7 @@
 .comingSoonTitle {
   font-size: 1rem;
   font-weight: 800;
-  color: var(--text-primary);
+  color: var(--c-text);
   text-transform: uppercase;
   letter-spacing: 0.05em;
 }
@@ -302,6 +299,6 @@
 .comingSoonDesc {
   font-size: 0.75rem;
   line-height: 1.6;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   max-width: 200px;
 }
diff --git a/frontend/editor/src/core/ui/ActionIcon.tsx b/frontend/editor/src/core/ui/ActionIcon.tsx
index 44584be569..682e4b41e5 100644
--- a/frontend/editor/src/core/ui/ActionIcon.tsx
+++ b/frontend/editor/src/core/ui/ActionIcon.tsx
@@ -100,7 +100,7 @@ export const ActionIcon = forwardRef<HTMLButtonElement, ActionIconProps>(
               "--ai-bg": "transparent",
               "--ai-hover": "transparent",
               "--ai-color": "var(--_text)",
-              "--ai-hover-color": "var(--color-text-1)",
+              "--ai-hover-color": "var(--c-text)",
               "--ai-bd": "1px solid transparent",
             }
           : {
diff --git a/frontend/editor/src/core/ui/Avatar.css b/frontend/editor/src/core/ui/Avatar.css
index 21089db8f0..e2e8dc63bd 100644
--- a/frontend/editor/src/core/ui/Avatar.css
+++ b/frontend/editor/src/core/ui/Avatar.css
@@ -70,6 +70,6 @@
   background: var(--grad-red-btn);
 }
 .sui-avatar--neutral {
-  background: var(--color-bg-muted);
-  color: var(--color-text-2);
+  background: var(--c-surface-sunken);
+  color: var(--c-text-muted);
 }
diff --git a/frontend/editor/src/core/ui/Banner.css b/frontend/editor/src/core/ui/Banner.css
index 937905a915..6f3a53e930 100644
--- a/frontend/editor/src/core/ui/Banner.css
+++ b/frontend/editor/src/core/ui/Banner.css
@@ -10,29 +10,29 @@
 }
 
 .sui-banner--info {
-  background: var(--color-blue-light);
-  color: var(--color-text-2);
-  border-color: var(--color-blue-border);
+  background: var(--c-primary-tint);
+  color: var(--c-text-muted);
+  border-color: var(--c-primary-border);
 }
 .sui-banner--success {
   background: var(--color-green-light);
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   border-color: var(--color-green-border);
 }
 .sui-banner--warning {
   background: var(--color-amber-light);
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   border-color: var(--color-amber-border);
 }
 .sui-banner--danger {
   background: var(--color-red-light);
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   border-color: var(--color-red-border);
 }
 .sui-banner--neutral {
   background: var(--color-bg-subtle);
-  color: var(--color-text-2);
-  border-color: var(--color-border);
+  color: var(--c-text-muted);
+  border-color: var(--c-border);
 }
 
 .sui-banner__icon {
@@ -45,7 +45,7 @@
 }
 
 .sui-banner--info .sui-banner__icon {
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 .sui-banner--success .sui-banner__icon {
   color: var(--color-green);
@@ -63,10 +63,10 @@
 }
 .sui-banner__title {
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .sui-banner__desc {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   margin-top: 0.125rem;
 }
 
diff --git a/frontend/editor/src/core/ui/Button.css b/frontend/editor/src/core/ui/Button.css
index 6ec23ca9ea..529d97fe16 100644
--- a/frontend/editor/src/core/ui/Button.css
+++ b/frontend/editor/src/core/ui/Button.css
@@ -67,8 +67,8 @@
 [data-theme="dark"] .sui-btn.mantine-Button-root:disabled:not([data-loading]),
 [data-theme="dark"]
   .sui-btn.mantine-Button-root[data-disabled]:not([data-loading]) {
-  background: var(--color-bg-muted);
-  color: var(--color-text-5);
+  background: var(--c-surface-sunken);
+  color: var(--c-text-subtle);
   border-color: transparent;
   opacity: 1;
 }
diff --git a/frontend/editor/src/core/ui/Button.stories.tsx b/frontend/editor/src/core/ui/Button.stories.tsx
index d35a24aed7..374d31c46e 100644
--- a/frontend/editor/src/core/ui/Button.stories.tsx
+++ b/frontend/editor/src/core/ui/Button.stories.tsx
@@ -172,7 +172,7 @@ export const Loading: Story = {
 /** Disabled primary — dark mode keeps a muted accent instead of grey. */
 export const DisabledDark: Story = {
   render: () => (
-    <div style={{ background: "var(--bg-surface)", padding: 24, width: 360 }}>
+    <div style={{ background: "var(--c-surface)", padding: 24, width: 360 }}>
       <div style={{ display: "flex", flexDirection: "column", gap: 12 }}>
         <Button data-d="active" fullWidth text="Merge (8 files)" />
         <Button data-d="disabled" fullWidth disabled text="Merge (8 files)" />
diff --git a/frontend/editor/src/core/ui/Button.tsx b/frontend/editor/src/core/ui/Button.tsx
index 6df2382864..7d2ff6d457 100644
--- a/frontend/editor/src/core/ui/Button.tsx
+++ b/frontend/editor/src/core/ui/Button.tsx
@@ -190,7 +190,7 @@ const ButtonRoot = forwardRef<HTMLButtonElement, ButtonProps>(
               "--button-bg": "transparent",
               "--button-hover": "transparent",
               "--button-color": "var(--_text)",
-              "--button-hover-color": "var(--color-text-1)",
+              "--button-hover-color": "var(--c-text)",
               "--button-bd": "1px solid transparent",
             }
           : {
diff --git a/frontend/editor/src/core/ui/Card.css b/frontend/editor/src/core/ui/Card.css
index bfc49be935..fcbefdab5b 100644
--- a/frontend/editor/src/core/ui/Card.css
+++ b/frontend/editor/src/core/ui/Card.css
@@ -1,7 +1,7 @@
 .sui-card {
   position: relative;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-lg);
   box-shadow: var(--shadow-md);
   transition:
@@ -27,7 +27,7 @@
   cursor: pointer;
 }
 .sui-card--interactive:hover {
-  border-color: var(--color-border-hover);
+  border-color: var(--c-border-strong);
   box-shadow: var(--shadow-lg);
   transform: translateY(-0.0625rem);
 }
@@ -46,7 +46,7 @@
   border-radius: var(--radius-lg) 0 0 var(--radius-lg);
 }
 .sui-card--accent-default::before {
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 .sui-card--accent-premium::before {
   background: var(--color-purple);
diff --git a/frontend/editor/src/core/ui/Card.stories.tsx b/frontend/editor/src/core/ui/Card.stories.tsx
index 8f480e2bf3..b1f1392948 100644
--- a/frontend/editor/src/core/ui/Card.stories.tsx
+++ b/frontend/editor/src/core/ui/Card.stories.tsx
@@ -7,14 +7,14 @@ import { StatusBadge } from "@app/ui/StatusBadge";
 function CardBody({ color }: { color: string }) {
   return (
     <div>
-      <h3 style={{ margin: 0, fontSize: 14, color: "var(--color-text-1)" }}>
+      <h3 style={{ margin: 0, fontSize: 14, color: "var(--c-text)" }}>
         {color} card
       </h3>
       <p
         style={{
           margin: "4px 0 0",
           fontSize: 12,
-          color: "var(--color-text-3)",
+          color: "var(--c-text-subtle)",
         }}
       >
         Surface treatment with the {color} accent strip.
@@ -126,7 +126,7 @@ export const InContext_ProductGrid: Story = {
           style={{
             margin: "6px 0 14px",
             fontSize: 13,
-            color: "var(--color-text-3)",
+            color: "var(--c-text-subtle)",
           }}
         >
           Attach pipelines where PDFs already live.
@@ -153,7 +153,7 @@ export const InContext_ProductGrid: Story = {
           style={{
             margin: "0 0 14px",
             fontSize: 13,
-            color: "var(--color-text-3)",
+            color: "var(--c-text-subtle)",
           }}
         >
           Compose document workflows from typed operations.
@@ -168,7 +168,7 @@ export const InContext_ProductGrid: Story = {
           style={{
             margin: "6px 0 14px",
             fontSize: 13,
-            color: "var(--color-text-3)",
+            color: "var(--c-text-subtle)",
           }}
         >
           Wire your agent via MCP, REST, or tool definitions.
diff --git a/frontend/editor/src/core/ui/CarouselDots.css b/frontend/editor/src/core/ui/CarouselDots.css
index 6608198148..5211ae6d2c 100644
--- a/frontend/editor/src/core/ui/CarouselDots.css
+++ b/frontend/editor/src/core/ui/CarouselDots.css
@@ -11,7 +11,7 @@
   padding: 0;
   border: none;
   border-radius: 50%;
-  background: var(--sui-dot-color, var(--color-text-5));
+  background: var(--sui-dot-color, var(--c-text-subtle));
   opacity: 0.4;
   cursor: pointer;
   transition:
@@ -25,14 +25,14 @@
 }
 
 .sui-carousel-dots__dot:focus-visible {
-  outline: 2px solid var(--sui-dot-active-color, var(--color-blue));
+  outline: 2px solid var(--sui-dot-active-color, var(--c-primary));
   outline-offset: 2px;
 }
 
 .sui-carousel-dots__dot.is-active {
   width: 1rem;
   border-radius: var(--radius-pill);
-  background: var(--sui-dot-active-color, var(--color-blue));
+  background: var(--sui-dot-active-color, var(--c-primary));
   opacity: 1;
 }
 
diff --git a/frontend/editor/src/core/ui/ChatFABButton.css b/frontend/editor/src/core/ui/ChatFABButton.css
index 657f31a25d..171abf8809 100644
--- a/frontend/editor/src/core/ui/ChatFABButton.css
+++ b/frontend/editor/src/core/ui/ChatFABButton.css
@@ -7,7 +7,7 @@
   border-radius: 16px;
   border: none;
   background: var(--c-primary);
-  color: var(--p-white);
+  color: var(--c-text-on-primary);
   cursor: pointer;
   box-shadow: 0 4px 16px color-mix(in srgb, var(--c-primary) 40%, transparent);
   transition:
@@ -85,7 +85,7 @@
   width: 8px;
   height: 8px;
   border-radius: 50%;
-  background: #22c55e;
+  background: var(--c-success);
   animation: chat-fab-pulse 1.5s ease-in-out infinite;
 }
 
@@ -109,7 +109,7 @@
   width: 16px;
   height: 16px;
   border-radius: 50%;
-  background: #22c55e;
+  background: var(--c-success);
   display: flex;
   align-items: center;
   justify-content: center;
diff --git a/frontend/editor/src/core/ui/ChatFABWindow.css b/frontend/editor/src/core/ui/ChatFABWindow.css
index b5dbb4f451..6f281d8252 100644
--- a/frontend/editor/src/core/ui/ChatFABWindow.css
+++ b/frontend/editor/src/core/ui/ChatFABWindow.css
@@ -5,12 +5,12 @@
   width: 100%;
   height: 100%;
   /* Use Mantine variables in the editor; fall back to shared tokens in storybook */
-  background: var(--mantine-color-body, var(--color-surface, #ffffff));
+  background: var(--mantine-color-body, var(--c-surface));
   border-radius: 16px;
-  border: 1px solid var(--border-subtle, var(--color-border, #e3e8ee));
+  border: 1px solid var(--c-border-subtle, var(--c-border));
   box-shadow:
-    0 8px 32px rgba(15, 23, 42, 0.14),
-    0 2px 8px rgba(15, 23, 42, 0.06);
+    0 8px 32px rgba(0, 0, 0, 0.14),
+    0 2px 8px rgba(0, 0, 0, 0.06);
   overflow: hidden;
 
   /* Closed state: collapsed toward bottom-right origin */
diff --git a/frontend/editor/src/core/ui/ChatFABWindow.stories.tsx b/frontend/editor/src/core/ui/ChatFABWindow.stories.tsx
index a90ae63cad..1c3c40ab05 100644
--- a/frontend/editor/src/core/ui/ChatFABWindow.stories.tsx
+++ b/frontend/editor/src/core/ui/ChatFABWindow.stories.tsx
@@ -29,7 +29,7 @@ function MockChat() {
       <div
         style={{
           padding: "14px 16px 10px",
-          borderBottom: "1px solid var(--color-border, #e3e8ee)",
+          borderBottom: "1px solid var(--c-border, #e3e8ee)",
           fontSize: 14,
           fontWeight: 600,
         }}
@@ -55,7 +55,7 @@ function MockChat() {
               background:
                 m.role === "user"
                   ? "#3b82f6"
-                  : "var(--color-bg-muted, #f3f4f6)",
+                  : "var(--c-surface-sunken, #f3f4f6)",
               color: m.role === "user" ? "#fff" : "inherit",
               borderRadius: 10,
               padding: "8px 12px",
@@ -69,16 +69,16 @@ function MockChat() {
       <div
         style={{
           padding: "10px 12px 14px",
-          borderTop: "1px solid var(--color-border, #e3e8ee)",
+          borderTop: "1px solid var(--c-border, #e3e8ee)",
         }}
       >
         <div
           style={{
-            background: "var(--color-bg-muted, #f3f4f6)",
+            background: "var(--c-surface-sunken, #f3f4f6)",
             borderRadius: 10,
             padding: "8px 12px",
             fontSize: 13,
-            color: "var(--color-text-4, #64748b)",
+            color: "var(--c-text-subtle, #64748b)",
           }}
         >
           What do you want to do?
diff --git a/frontend/editor/src/core/ui/Checkbox.css b/frontend/editor/src/core/ui/Checkbox.css
index 5281cdf5ec..f20358f1aa 100644
--- a/frontend/editor/src/core/ui/Checkbox.css
+++ b/frontend/editor/src/core/ui/Checkbox.css
@@ -4,7 +4,7 @@
   gap: var(--space-2);
   cursor: pointer;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .sui-check--disabled {
@@ -25,8 +25,8 @@
   height: 1rem;
   margin-top: 0.0625rem;
   border-radius: var(--radius-xs);
-  border: 1.5px solid var(--color-border-hover);
-  background: var(--color-surface);
+  border: 1.5px solid var(--c-border-strong);
+  background: var(--c-surface);
   display: inline-flex;
   align-items: center;
   justify-content: center;
@@ -37,13 +37,13 @@
 }
 
 .sui-check__input:focus-visible + .sui-check__box {
-  outline: 2px solid var(--color-blue);
+  outline: 2px solid var(--c-primary);
   outline-offset: 2px;
 }
 
 .sui-check__input:checked + .sui-check__box {
-  background: var(--color-blue);
-  border-color: var(--color-blue);
+  background: var(--c-primary);
+  border-color: var(--c-primary);
   color: var(--color-text-on-accent);
 }
 
@@ -55,8 +55,8 @@
 }
 
 .sui-check--mixed .sui-check__box {
-  background: var(--color-blue);
-  border-color: var(--color-blue);
+  background: var(--c-primary);
+  border-color: var(--c-primary);
 }
 .sui-check--mixed .sui-check__tick {
   opacity: 0;
@@ -78,7 +78,7 @@
 .sui-check__icon {
   display: inline-flex;
   align-items: center;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   flex-shrink: 0;
 }
 .sui-check__text {
@@ -86,10 +86,10 @@
   flex-direction: column;
 }
 .sui-check__label {
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-weight: 500;
 }
 .sui-check__desc {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/core/ui/ChipFlow.css b/frontend/editor/src/core/ui/ChipFlow.css
index 13eba56dfb..69b6216b03 100644
--- a/frontend/editor/src/core/ui/ChipFlow.css
+++ b/frontend/editor/src/core/ui/ChipFlow.css
@@ -5,7 +5,7 @@
   gap: 0.375rem;
 }
 .sui-chipflow__sep {
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-size: 0.75rem;
   line-height: 1;
   flex-shrink: 0;
diff --git a/frontend/editor/src/core/ui/Collapsible.css b/frontend/editor/src/core/ui/Collapsible.css
index 95b53886a5..d0c1308f3b 100644
--- a/frontend/editor/src/core/ui/Collapsible.css
+++ b/frontend/editor/src/core/ui/Collapsible.css
@@ -1,5 +1,5 @@
 .sui-collapsible {
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.5625rem;
   overflow: hidden;
 }
@@ -10,7 +10,7 @@
   gap: 0.5rem;
   width: 100%;
   padding: 0.75rem 0.875rem;
-  background: var(--color-surface);
+  background: var(--c-surface);
   border: none;
   cursor: pointer;
   text-align: left;
@@ -18,7 +18,7 @@
 }
 
 .sui-collapsible__head:hover {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 .sui-collapsible__head-main {
@@ -39,7 +39,7 @@
 }
 
 .sui-collapsible__chevron {
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   transition: transform 0.2s ease;
 }
 
diff --git a/frontend/editor/src/core/ui/ColorInput.tsx b/frontend/editor/src/core/ui/ColorInput.tsx
index 6063ecf688..cf33331d7d 100644
--- a/frontend/editor/src/core/ui/ColorInput.tsx
+++ b/frontend/editor/src/core/ui/ColorInput.tsx
@@ -1,4 +1,9 @@
-import type React from "react";
+import {
+  type FocusEventHandler,
+  type CSSProperties,
+  useEffect,
+  useState,
+} from "react";
 import {
   ColorInput as MantineColorInput,
   type ColorInputProps as MantineColorInputProps,
@@ -7,15 +12,15 @@ import { useInputAria } from "@app/ui/ariaForwarding";
 import "@app/ui/MantineForms.css";
 
 const SUI_INPUT_VARS = {
-  "--input-bg": "var(--color-surface)",
-  "--input-bd": "var(--color-border-input)",
-  "--input-bd-focus": "var(--color-blue)",
+  "--input-bg": "var(--c-surface)",
+  "--input-bd": "var(--c-border)",
+  "--input-bd-focus": "var(--c-primary)",
   "--input-radius": "var(--radius-md)",
-  "--input-color": "var(--color-text-1)",
+  "--input-color": "var(--c-text)",
   "--input-placeholder-color": "var(--color-text-placeholder)",
   "--input-height-sm": "1.75rem",
   "--input-height-md": "2.25rem",
-} as React.CSSProperties;
+} as CSSProperties;
 
 export type ColorInputSize = "sm" | "md";
 
@@ -23,6 +28,8 @@ export interface ColorInputProps {
   // Value
   value?: string;
   onChange?: (value: string) => void;
+  /** Fires once when picking finishes (pointer up / blur), not every drag frame — for committing expensive updates. */
+  onChangeEnd?: (value: string) => void;
   defaultValue?: string;
 
   // Behaviour
@@ -30,6 +37,8 @@ export interface ColorInputProps {
   swatches?: string[];
   swatchesPerRow?: number;
   withPicker?: boolean;
+  /** Restrict the gamut live: every change is run through this (handle sticks at the boundary), receiving the previous in-gamut value so a clamp can preserve hue at achromatic extremes. */
+  clampValue?: (value: string, previous: string) => string;
 
   // Popover escape hatch — only for zIndex / offset overrides in modals
   popoverProps?: MantineColorInputProps["popoverProps"];
@@ -44,37 +53,35 @@ export interface ColorInputProps {
   required?: boolean;
   disabled?: boolean;
   readOnly?: boolean;
-  onFocus?: React.FocusEventHandler<HTMLInputElement>;
-  onBlur?: React.FocusEventHandler<HTMLInputElement>;
+  onFocus?: FocusEventHandler<HTMLInputElement>;
+  onBlur?: FocusEventHandler<HTMLInputElement>;
 
   // SUI — invalid applies error styling; FormField renders the message itself.
   inputSize?: ColorInputSize;
   invalid?: boolean;
 }
 
-type PassthroughProps = Omit<
-  Pick<
-    MantineColorInputProps,
-    | "value"
-    | "onChange"
-    | "defaultValue"
-    | "format"
-    | "swatches"
-    | "swatchesPerRow"
-    | "withPicker"
-    | "popoverProps"
-    | "placeholder"
-    | "id"
-    | "name"
-    | "aria-label"
-    | "aria-describedby"
-    | "required"
-    | "disabled"
-    | "readOnly"
-    | "onFocus"
-    | "onBlur"
-  >,
-  never
+type PassthroughProps = Pick<
+  MantineColorInputProps,
+  | "value"
+  | "onChange"
+  | "onChangeEnd"
+  | "defaultValue"
+  | "format"
+  | "swatches"
+  | "swatchesPerRow"
+  | "withPicker"
+  | "popoverProps"
+  | "placeholder"
+  | "id"
+  | "name"
+  | "aria-label"
+  | "aria-describedby"
+  | "required"
+  | "disabled"
+  | "readOnly"
+  | "onFocus"
+  | "onBlur"
 >;
 
 /**
@@ -90,6 +97,8 @@ export function ColorInput({
   format = "hex",
   value,
   onChange,
+  onChangeEnd,
+  clampValue,
   defaultValue,
   swatches,
   swatchesPerRow,
@@ -108,9 +117,27 @@ export function ColorInput({
   onBlur,
 }: ColorInputProps) {
   const inputRef = useInputAria({ describedBy: ariaDescribedBy });
+
+  // With a clamp, this component owns the displayed value so the picker reflects the constraint live (clamped and mirrored back each frame); without one, value/handlers pass straight through.
+  const [clamped, setClamped] = useState(value ?? defaultValue ?? "");
+  useEffect(() => {
+    if (value !== undefined) setClamped(value);
+  }, [value]);
+
+  const constrainedProps = clampValue
+    ? {
+        value: clamped,
+        onChange: (next: string) => {
+          const c = clampValue(next, clamped);
+          setClamped(c);
+          onChange?.(c);
+        },
+        onChangeEnd: (next: string) => onChangeEnd?.(clampValue(next, clamped)),
+      }
+    : { value, onChange, onChangeEnd };
+
   const passthroughProps: PassthroughProps = {
-    value,
-    onChange,
+    ...constrainedProps,
     defaultValue,
     format,
     swatches,
diff --git a/frontend/editor/src/core/ui/DataRow.css b/frontend/editor/src/core/ui/DataRow.css
index ab5fbf69a2..4f5153a315 100644
--- a/frontend/editor/src/core/ui/DataRow.css
+++ b/frontend/editor/src/core/ui/DataRow.css
@@ -12,12 +12,12 @@
   flex-shrink: 0;
   font-size: 0.75rem;
   font-weight: 500;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 .sui-datarow__value {
   flex: 1;
   min-width: 0;
   font-size: 0.75rem;
-  color: var(--color-text-1);
+  color: var(--c-text);
   overflow-wrap: anywhere;
 }
diff --git a/frontend/editor/src/core/ui/Drawer.css b/frontend/editor/src/core/ui/Drawer.css
index 8972bbefc2..013f79fdeb 100644
--- a/frontend/editor/src/core/ui/Drawer.css
+++ b/frontend/editor/src/core/ui/Drawer.css
@@ -1,7 +1,7 @@
 .sui-drawer__backdrop {
   position: fixed;
   inset: 0;
-  background: rgba(15, 23, 42, 0.32);
+  background: rgba(0, 0, 0, 0.32);
   z-index: var(--z-drawer);
   animation: fadeIn 0.18s ease both;
 }
@@ -11,7 +11,7 @@
   top: 0;
   bottom: 0;
   max-width: 100vw;
-  background: var(--color-surface);
+  background: var(--c-surface);
   display: flex;
   flex-direction: column;
   z-index: calc(var(--z-drawer) + 1);
@@ -20,14 +20,14 @@
 
 .sui-drawer--right {
   right: 0;
-  border-left: 1px solid var(--color-border);
-  box-shadow: -4px 0 24px rgba(15, 23, 42, 0.12);
+  border-left: 1px solid var(--c-border);
+  box-shadow: -4px 0 24px rgba(0, 0, 0, 0.12);
 }
 
 .sui-drawer--left {
   left: 0;
-  border-right: 1px solid var(--color-border);
-  box-shadow: 4px 0 24px rgba(15, 23, 42, 0.12);
+  border-right: 1px solid var(--c-border);
+  box-shadow: 4px 0 24px rgba(0, 0, 0, 0.12);
   animation-name: slideInLeft;
 }
 
@@ -55,7 +55,7 @@
   align-items: flex-start;
   gap: var(--space-3);
   padding: var(--space-4) var(--space-4) var(--space-3);
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .sui-drawer__header-text {
@@ -66,13 +66,13 @@
 .sui-drawer__title {
   font-size: 1rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .sui-drawer__sub {
   margin-top: 0.125rem;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Sizing/background/hover are owned by the Button; this just keeps it from
@@ -89,7 +89,7 @@
 
 .sui-drawer__footer {
   padding: var(--space-3) var(--space-4);
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
   background: var(--color-bg-subtle);
   display: flex;
   align-items: center;
diff --git a/frontend/editor/src/core/ui/Drawer.stories.tsx b/frontend/editor/src/core/ui/Drawer.stories.tsx
index c1df90536b..0f9630a712 100644
--- a/frontend/editor/src/core/ui/Drawer.stories.tsx
+++ b/frontend/editor/src/core/ui/Drawer.stories.tsx
@@ -24,7 +24,7 @@ const meta: Meta<typeof Drawer> = {
         style={{
           minHeight: "100vh",
           padding: 24,
-          background: "var(--color-bg)",
+          background: "var(--c-bg)",
         }}
       >
         <S />
@@ -38,7 +38,7 @@ const meta: Meta<typeof Drawer> = {
         <>
           <Button onClick={() => setOpen(true)}>Open drawer</Button>
           <Drawer {...args} open={open} onClose={() => setOpen(false)}>
-            <p style={{ color: "var(--color-text-3)" }}>
+            <p style={{ color: "var(--c-text-subtle)" }}>
               The drawer body scrolls when its content overflows. The header and
               footer (when present) are sticky.
             </p>
@@ -79,7 +79,7 @@ export const WithFooter: Story = {
               </>
             }
           >
-            <p style={{ color: "var(--color-text-3)" }}>
+            <p style={{ color: "var(--c-text-subtle)" }}>
               Sticky footer demo — scroll the body, footer stays anchored.
             </p>
           </Drawer>
diff --git a/frontend/editor/src/core/ui/Dropdown.css b/frontend/editor/src/core/ui/Dropdown.css
index 736371e6ae..38b20ee1d8 100644
--- a/frontend/editor/src/core/ui/Dropdown.css
+++ b/frontend/editor/src/core/ui/Dropdown.css
@@ -8,8 +8,8 @@
   top: calc(100% + var(--space-1));
   min-width: 12rem;
   padding: var(--space-1);
-  background: var(--color-dropdown-bg);
-  border: 1px solid var(--color-dropdown-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
   box-shadow: var(--shadow-lg);
   z-index: var(--z-dropdown);
@@ -34,7 +34,7 @@
   width: 100%;
   text-align: left;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   border-radius: var(--radius-sm);
   /* Explicit button reset: hosts without a global button reset (e.g. the
      editor) would otherwise show the UA's buttonface background and border. */
@@ -48,13 +48,13 @@
 }
 
 .sui-dd__item:hover:not(.is-disabled) {
-  background: var(--color-dropdown-hover);
-  color: var(--color-text-1);
+  background: var(--c-hover);
+  color: var(--c-text);
 }
 
 .sui-dd__item.is-active {
-  background: var(--color-nav-active);
-  color: var(--color-nav-active-text);
+  background: var(--c-primary-subtle);
+  color: var(--c-accent-fg);
   font-weight: 500;
 }
 
@@ -73,11 +73,11 @@
   margin-left: auto;
   font-family: var(--font-mono);
   font-size: 0.6875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .sui-dd__divider {
   height: 1px;
-  background: var(--color-divider);
+  background: var(--c-border-subtle);
   margin: var(--space-1) 0;
 }
diff --git a/frontend/editor/src/core/ui/EmptyState.css b/frontend/editor/src/core/ui/EmptyState.css
index e78db8b664..bf8250bc82 100644
--- a/frontend/editor/src/core/ui/EmptyState.css
+++ b/frontend/editor/src/core/ui/EmptyState.css
@@ -14,7 +14,7 @@
 .sui-empty__icon {
   display: inline-flex;
   margin-bottom: var(--space-2);
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .sui-empty__eyebrow {
@@ -22,14 +22,14 @@
   font-weight: 600;
   text-transform: uppercase;
   letter-spacing: 0.06em;
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 
 .sui-empty__title {
   margin: 0;
   font-size: 1.125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .sui-empty--compact .sui-empty__title {
@@ -41,7 +41,7 @@
   max-width: 32rem;
   font-size: 0.875rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .sui-empty--compact .sui-empty__copy {
diff --git a/frontend/editor/src/core/ui/FormField.css b/frontend/editor/src/core/ui/FormField.css
index 0ae531bc65..f5cbe2d5fc 100644
--- a/frontend/editor/src/core/ui/FormField.css
+++ b/frontend/editor/src/core/ui/FormField.css
@@ -24,7 +24,7 @@
 
 .sui-field__help {
   font-size: 0.6875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   line-height: 1.45;
 }
 
diff --git a/frontend/editor/src/core/ui/IconBadge.css b/frontend/editor/src/core/ui/IconBadge.css
index aaca06f217..9aa3f8f46f 100644
--- a/frontend/editor/src/core/ui/IconBadge.css
+++ b/frontend/editor/src/core/ui/IconBadge.css
@@ -7,7 +7,7 @@
   /* Resolved tint. Each accent class sets --ib-base; --ib-accent defaults to it
      but a consumer can override --ib-accent alone (e.g. to neutralise the badge
      until hover) without losing the per-accent base. */
-  --ib-accent: var(--ib-base, var(--color-blue));
+  --ib-accent: var(--ib-base, var(--c-primary));
   color: var(--ib-accent);
   background: color-mix(in srgb, var(--ib-accent) 14%, transparent);
 }
@@ -20,7 +20,7 @@
   height: 2rem;
 }
 .sui-iconbadge--blue {
-  --ib-base: var(--color-blue);
+  --ib-base: var(--c-primary);
 }
 .sui-iconbadge--purple {
   --ib-base: var(--color-purple);
@@ -38,6 +38,6 @@
   --ib-base: var(--color-orange);
 }
 .sui-iconbadge--neutral {
-  --ib-base: var(--color-text-1);
+  --ib-base: var(--c-text);
   background: none;
 }
diff --git a/frontend/editor/src/core/ui/Inline.stories.tsx b/frontend/editor/src/core/ui/Inline.stories.tsx
index 10233e1371..5149f36018 100644
--- a/frontend/editor/src/core/ui/Inline.stories.tsx
+++ b/frontend/editor/src/core/ui/Inline.stories.tsx
@@ -29,7 +29,7 @@ export const SpaceBetween: Story = {
       style={{
         width: "30rem",
         padding: 12,
-        border: "1px solid var(--color-border)",
+        border: "1px solid var(--c-border)",
         borderRadius: 8,
       }}
     >
diff --git a/frontend/editor/src/core/ui/Input.css b/frontend/editor/src/core/ui/Input.css
index 09a7ca0cda..3c68bdd8c5 100644
--- a/frontend/editor/src/core/ui/Input.css
+++ b/frontend/editor/src/core/ui/Input.css
@@ -3,18 +3,18 @@
   align-items: center;
   gap: var(--space-2);
   padding: 0 var(--space-2);
-  background: var(--color-surface);
-  border: 1px solid var(--color-border-input);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
-  color: var(--color-text-1);
+  color: var(--c-text);
   transition:
     border-color var(--motion-fast),
     box-shadow var(--motion-fast);
 }
 
 .sui-input:focus-within {
-  border-color: var(--color-blue);
-  box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-blue) 16%, transparent);
+  border-color: var(--c-primary);
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--c-primary) 16%, transparent);
 }
 
 .sui-input--sm {
@@ -61,6 +61,6 @@
 .sui-input__icon {
   display: inline-flex;
   align-items: center;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   flex-shrink: 0;
 }
diff --git a/frontend/editor/src/core/ui/ListRow.css b/frontend/editor/src/core/ui/ListRow.css
index 8317b76fc5..836dba4d8f 100644
--- a/frontend/editor/src/core/ui/ListRow.css
+++ b/frontend/editor/src/core/ui/ListRow.css
@@ -6,20 +6,20 @@
   padding: 0.7rem 0.875rem;
   text-align: left;
   background: transparent;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .sui-listrow--divider {
-  border-top: 1px solid var(--color-border);
+  border-top: 1px solid var(--c-border);
 }
 .sui-listrow--interactive {
   cursor: pointer;
   transition: background var(--motion-fast);
 }
 .sui-listrow--interactive:hover {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 .sui-listrow--interactive:focus-visible {
-  outline: 0.125rem solid var(--color-blue);
+  outline: 0.125rem solid var(--c-primary);
   outline-offset: -0.125rem;
 }
 
@@ -32,8 +32,8 @@
   border-radius: var(--radius-md);
   flex-shrink: 0;
   margin-top: 0.05rem;
-  color: var(--color-text-4);
-  background: var(--color-bg-muted);
+  color: var(--c-text-subtle);
+  background: var(--c-surface-sunken);
 }
 .sui-listrow__leading[data-tone="success"] {
   color: var(--color-green);
@@ -48,8 +48,8 @@
   background: color-mix(in srgb, var(--color-red) 14%, transparent);
 }
 .sui-listrow__leading[data-tone="info"] {
-  color: var(--color-blue);
-  background: color-mix(in srgb, var(--color-blue) 14%, transparent);
+  color: var(--c-primary);
+  background: color-mix(in srgb, var(--c-primary) 14%, transparent);
 }
 .sui-listrow__leading[data-tone="purple"] {
   color: var(--color-purple);
@@ -65,19 +65,19 @@
 .sui-listrow__title {
   font-size: 0.8125rem;
   font-weight: 500;
-  color: var(--color-text-1);
+  color: var(--c-text);
   overflow: hidden;
   text-overflow: ellipsis;
   white-space: nowrap;
 }
 .sui-listrow__desc {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   margin-top: 0.125rem;
 }
 .sui-listrow__meta {
   font-size: 0.6875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   margin-top: 0.125rem;
 }
 .sui-listrow__trailing {
diff --git a/frontend/editor/src/core/ui/MantineForms.css b/frontend/editor/src/core/ui/MantineForms.css
index fb95e15c07..ebedf547f7 100644
--- a/frontend/editor/src/core/ui/MantineForms.css
+++ b/frontend/editor/src/core/ui/MantineForms.css
@@ -13,11 +13,11 @@
  * here act as a typed reference and as a fallback for any slot Mantine reads
  * before the inline vars are applied. */
 .sui-mantine-wrapper {
-  --input-bg: var(--color-surface);
-  --input-bd: var(--color-border-input);
-  --input-bd-focus: var(--color-blue);
+  --input-bg: var(--c-surface);
+  --input-bd: var(--c-border);
+  --input-bd-focus: var(--c-primary);
   --input-radius: var(--radius-md);
-  --input-color: var(--color-text-1);
+  --input-color: var(--c-text);
   --input-placeholder-color: var(--color-text-placeholder);
   --input-height-sm: 1.75rem;
   --input-height-md: 2.25rem;
@@ -31,7 +31,7 @@
 /* SUI focus ring — matches .sui-input:focus-within */
 .sui-mantine-wrapper[data-focused],
 .sui-mantine-wrapper:focus-within {
-  box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-blue) 16%, transparent);
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--c-primary) 16%, transparent);
 }
 
 /* Error state */
@@ -54,9 +54,9 @@
 /* ---- MultiSelect pills ---- */
 /* Pills match SUI's Chip component: small rounded tags. */
 .sui-mantine-pill {
-  background: var(--color-blue-light) !important;
-  color: var(--color-blue-dark) !important;
-  border: 1px solid var(--color-blue-border) !important;
+  background: var(--c-primary-tint) !important;
+  color: var(--c-primary-hover) !important;
+  border: 1px solid var(--c-primary-border) !important;
   border-radius: var(--radius-sm) !important;
   font-size: 0.75rem !important;
   font-weight: 500 !important;
@@ -69,26 +69,26 @@
 
 /* ---- NumberInput controls (increment/decrement buttons) ---- */
 .sui-mantine-control {
-  border-color: var(--color-border-input) !important;
-  color: var(--color-text-3) !important;
+  border-color: var(--c-border) !important;
+  color: var(--c-text-subtle) !important;
 }
 
 .sui-mantine-control:hover {
-  background: var(--color-bg-hover) !important;
-  color: var(--color-text-1) !important;
+  background: var(--c-hover) !important;
+  color: var(--c-text) !important;
 }
 
 /* ---- Select: hide Mantine's right-section clear button border ---- */
 .sui-mantine-wrapper .mantine-Select-section {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 /* ---- Slider ---- */
 .sui-mantine-slider {
-  --slider-color: var(--color-blue);
-  --slider-track-bg: var(--color-border);
-  --slider-thumb-color: var(--color-surface);
-  --slider-thumb-bd: var(--color-blue);
+  --slider-color: var(--c-primary);
+  --slider-track-bg: var(--c-border);
+  --slider-thumb-color: var(--c-surface);
+  --slider-thumb-bd: var(--c-primary);
 }
 
 .sui-mantine-slider:focus-within {
@@ -97,13 +97,13 @@
 
 /* Thumb focus ring matches SUI */
 .sui-mantine-slider .mantine-Slider-thumb:focus-visible {
-  box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-blue) 16%, transparent);
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--c-primary) 16%, transparent);
   outline: none;
 }
 
 /* Mark labels use SUI text tokens */
 .sui-mantine-slider .mantine-Slider-markLabel {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   font-size: 0.75rem;
 }
 
@@ -112,7 +112,7 @@
  * SuiProvider syncs forceColorScheme to SUI theme, so
  * [data-mantine-color-scheme="dark"] === [data-theme="dark"] in practice. ---- */
 [data-mantine-color-scheme="dark"] .sui-mantine-wrapper {
-  --input-bg: var(--color-surface);
-  --input-bd: var(--color-border-input);
-  --input-color: var(--color-text-1);
+  --input-bg: var(--c-surface);
+  --input-bd: var(--c-border);
+  --input-color: var(--c-text);
 }
diff --git a/frontend/editor/src/core/ui/MethodBadge.css b/frontend/editor/src/core/ui/MethodBadge.css
index 75703b92d8..9b138ed389 100644
--- a/frontend/editor/src/core/ui/MethodBadge.css
+++ b/frontend/editor/src/core/ui/MethodBadge.css
@@ -10,14 +10,14 @@
   line-height: 1.4;
 }
 .sui-method--get {
-  color: var(--color-green);
+  color: var(--color-green-dark);
   background: var(--color-green-light);
   border-color: var(--color-green-border);
 }
 .sui-method--post {
-  color: var(--color-blue);
-  background: var(--color-blue-light);
-  border-color: var(--color-blue-border);
+  color: var(--c-primary);
+  background: var(--c-primary-tint);
+  border-color: var(--c-primary-border);
 }
 .sui-method--put {
   color: var(--color-amber-dark);
@@ -25,12 +25,12 @@
   border-color: var(--color-amber-border);
 }
 .sui-method--patch {
-  color: var(--color-purple);
+  color: var(--color-purple-dark);
   background: var(--color-purple-light);
   border-color: var(--color-purple-border);
 }
 .sui-method--delete {
-  color: var(--color-red);
+  color: var(--color-red-dark);
   background: var(--color-red-light);
   border-color: var(--color-red-border);
 }
diff --git a/frontend/editor/src/core/ui/MethodBadge.stories.tsx b/frontend/editor/src/core/ui/MethodBadge.stories.tsx
index 9110ef9f06..6dd557ab82 100644
--- a/frontend/editor/src/core/ui/MethodBadge.stories.tsx
+++ b/frontend/editor/src/core/ui/MethodBadge.stories.tsx
@@ -23,7 +23,7 @@ export const InRow: Story = {
     <div style={{ display: "flex", alignItems: "center", gap: 10 }}>
       <MethodBadge method="POST" />
       <span
-        style={{ fontFamily: "var(--font-mono)", color: "var(--color-text-2)" }}
+        style={{ fontFamily: "var(--font-mono)", color: "var(--c-text-muted)" }}
       >
         /v1/coi
       </span>
diff --git a/frontend/editor/src/core/ui/MetricCard.css b/frontend/editor/src/core/ui/MetricCard.css
index 59c2b45000..8c7adfeb00 100644
--- a/frontend/editor/src/core/ui/MetricCard.css
+++ b/frontend/editor/src/core/ui/MetricCard.css
@@ -3,8 +3,8 @@
   flex-direction: column;
   gap: 0.5rem;
   padding: 1.125rem 1.25rem;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-lg);
   box-shadow: var(--shadow-md);
   transition:
@@ -36,12 +36,12 @@
   cursor: pointer;
 }
 .sui-metric--interactive:hover {
-  border-color: var(--color-border-hover);
+  border-color: var(--c-border-strong);
   box-shadow: var(--shadow-lg);
   transform: translateY(-0.0625rem);
 }
 .sui-metric--interactive:focus-visible {
-  outline: 2px solid var(--color-blue);
+  outline: 2px solid var(--c-primary);
   outline-offset: 2px;
 }
 
@@ -53,18 +53,18 @@
 }
 .sui-metric__label {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-weight: 500;
   letter-spacing: 0.01em;
 }
 .sui-metric__icon {
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   display: inline-flex;
 }
 .sui-metric__value {
   font-size: 1.625rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   line-height: 1.1;
 }
 .sui-metric__footer {
@@ -88,9 +88,7 @@
 .sui-metric__delta--down {
   color: var(--color-red);
 }
-.sui-metric__delta--flat {
-  color: var(--color-text-5);
-}
+.sui-metric__delta--flat,
 .sui-metric__desc {
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/core/ui/Modal.css b/frontend/editor/src/core/ui/Modal.css
index a3d081b42d..2773585415 100644
--- a/frontend/editor/src/core/ui/Modal.css
+++ b/frontend/editor/src/core/ui/Modal.css
@@ -1,7 +1,7 @@
 .sui-modal__backdrop {
   position: fixed;
   inset: 0;
-  background: rgba(15, 23, 42, 0.55);
+  background: rgba(0, 0, 0, 0.55);
   display: flex;
   align-items: flex-start;
   justify-content: center;
@@ -15,12 +15,12 @@
   /* Set our own font: the modal portals to <body>, so it can't inherit the
      app's font through the DOM (the portal's .portal-scope isn't an ancestor). */
   font-family: var(--font-sans);
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-xl);
   box-shadow:
-    0 1.25rem 3rem rgba(15, 23, 42, 0.35),
-    0 0 0 1px var(--color-border-light);
+    0 1.25rem 3rem rgba(0, 0, 0, 0.35),
+    0 0 0 1px var(--c-border-subtle);
   display: flex;
   flex-direction: column;
   width: 100%;
@@ -59,7 +59,7 @@
   align-items: flex-start;
   gap: 0.75rem;
   padding: 1rem 1.125rem 0.75rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .sui-modal__header-text {
@@ -70,13 +70,13 @@
 .sui-modal__title {
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .sui-modal__sub {
   margin-top: 0.125rem;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Sizing/background/hover are owned by the Button; this just keeps it from
@@ -89,12 +89,12 @@
   flex: 1 1 auto;
   overflow-y: auto;
   padding: 1rem 1.125rem 1.125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .sui-modal__footer {
   padding: 0.875rem 1.125rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
   display: flex;
   justify-content: flex-end;
   gap: 0.5rem;
diff --git a/frontend/editor/src/core/ui/MultiSelect.tsx b/frontend/editor/src/core/ui/MultiSelect.tsx
index 31ac9544f8..0d2ab92ad8 100644
--- a/frontend/editor/src/core/ui/MultiSelect.tsx
+++ b/frontend/editor/src/core/ui/MultiSelect.tsx
@@ -8,11 +8,11 @@ import { useInputAria } from "@app/ui/ariaForwarding";
 import "@app/ui/MantineForms.css";
 
 const SUI_INPUT_VARS = {
-  "--input-bg": "var(--color-surface)",
-  "--input-bd": "var(--color-border-input)",
-  "--input-bd-focus": "var(--color-blue)",
+  "--input-bg": "var(--c-surface)",
+  "--input-bd": "var(--c-border)",
+  "--input-bd-focus": "var(--c-primary)",
   "--input-radius": "var(--radius-md)",
-  "--input-color": "var(--color-text-1)",
+  "--input-color": "var(--c-text)",
   "--input-placeholder-color": "var(--color-text-placeholder)",
   "--input-height-sm": "1.75rem",
   "--input-height-md": "2.25rem",
diff --git a/frontend/editor/src/core/ui/NavItem.css b/frontend/editor/src/core/ui/NavItem.css
index 982abbc26b..8b9949eab5 100644
--- a/frontend/editor/src/core/ui/NavItem.css
+++ b/frontend/editor/src/core/ui/NavItem.css
@@ -6,7 +6,7 @@
   padding: 0.4375rem 0.75rem;
   margin: 0.0625rem 0.5rem;
   border-radius: var(--radius-lg);
-  color: var(--color-nav-text);
+  color: var(--c-text-subtle);
   font-size: 0.8125rem;
   font-weight: 400;
   transition:
@@ -15,16 +15,16 @@
   text-align: left;
 }
 .sui-navitem:hover {
-  background: var(--color-nav-hover);
-  color: var(--color-nav-hover-text);
+  background: var(--c-hover);
+  color: var(--c-text-muted);
 }
 .sui-navitem.is-active {
-  background: var(--color-nav-active);
-  color: var(--color-nav-active-text);
+  background: var(--c-primary-subtle);
+  color: var(--c-accent-fg);
   font-weight: 500;
 }
 .sui-navitem.is-active:hover {
-  background: var(--color-nav-active);
+  background: var(--c-primary-subtle);
 }
 .sui-navitem__icon {
   width: 1rem;
@@ -43,7 +43,7 @@
   margin-left: auto;
 }
 .sui-navitem:focus-visible {
-  outline: 0.125rem solid var(--color-blue);
+  outline: 0.125rem solid var(--c-primary);
   outline-offset: 0.125rem;
 }
 
@@ -61,7 +61,7 @@
   border-radius: 3px;
 }
 .sui-navitem[data-accent="blue"]::before {
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 .sui-navitem[data-accent="purple"]::before {
   background: var(--color-purple);
@@ -76,7 +76,7 @@
   background: var(--color-red);
 }
 .sui-navitem[data-accent="blue"] .sui-navitem__icon {
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 .sui-navitem[data-accent="purple"] .sui-navitem__icon {
   color: var(--color-purple);
diff --git a/frontend/editor/src/core/ui/NavItem.stories.tsx b/frontend/editor/src/core/ui/NavItem.stories.tsx
index 7ceb981d79..52d74138bc 100644
--- a/frontend/editor/src/core/ui/NavItem.stories.tsx
+++ b/frontend/editor/src/core/ui/NavItem.stories.tsx
@@ -3,7 +3,7 @@ import type { Meta, StoryObj } from "@storybook/react-vite";
 import { NavItem } from "@app/ui/NavItem";
 import { SectionDivider } from "@app/ui/SectionDivider";
 
-function Dot({ color = "var(--color-blue)" }: { color?: string }) {
+function Dot({ color = "var(--c-primary)" }: { color?: string }) {
   return (
     <span
       style={{
@@ -29,9 +29,9 @@ const meta: Meta<typeof NavItem> = {
       <div
         style={{
           width: "15rem",
-          background: "var(--color-sidebar-bg)",
+          background: "var(--c-bg-raised)",
           padding: 10,
-          border: "1px solid var(--color-sidebar-border)",
+          border: "1px solid var(--c-border)",
           borderRadius: 6,
         }}
       >
@@ -55,8 +55,8 @@ export const WithTrailingBadge: Story = {
       <span
         style={{
           fontSize: 11,
-          color: "var(--color-blue)",
-          background: "var(--color-blue-light)",
+          color: "var(--c-primary)",
+          background: "var(--c-primary-tint)",
           padding: "1px 6px",
           borderRadius: 10,
         }}
diff --git a/frontend/editor/src/core/ui/NumberInput.tsx b/frontend/editor/src/core/ui/NumberInput.tsx
index 751c902636..a685279663 100644
--- a/frontend/editor/src/core/ui/NumberInput.tsx
+++ b/frontend/editor/src/core/ui/NumberInput.tsx
@@ -7,11 +7,11 @@ import { useInputAria } from "@app/ui/ariaForwarding";
 import "@app/ui/MantineForms.css";
 
 const SUI_INPUT_VARS = {
-  "--input-bg": "var(--color-surface)",
-  "--input-bd": "var(--color-border-input)",
-  "--input-bd-focus": "var(--color-blue)",
+  "--input-bg": "var(--c-surface)",
+  "--input-bd": "var(--c-border)",
+  "--input-bd-focus": "var(--c-primary)",
   "--input-radius": "var(--radius-md)",
-  "--input-color": "var(--color-text-1)",
+  "--input-color": "var(--c-text)",
   "--input-placeholder-color": "var(--color-text-placeholder)",
   "--input-height-sm": "1.75rem",
   "--input-height-md": "2.25rem",
diff --git a/frontend/editor/src/core/ui/PanelHeader.css b/frontend/editor/src/core/ui/PanelHeader.css
index 9869b56be3..02f32c3707 100644
--- a/frontend/editor/src/core/ui/PanelHeader.css
+++ b/frontend/editor/src/core/ui/PanelHeader.css
@@ -18,7 +18,7 @@
   flex: 1;
   min-width: 0;
   padding: 0.4rem 0.75rem 0.4rem 0.4rem;
-  border: 1px solid var(--border-subtle, var(--mantine-color-default-border));
+  border: 1px solid var(--c-border-subtle, var(--mantine-color-default-border));
   border-radius: 9999px;
   background: var(--mantine-color-body);
   text-align: left;
@@ -125,7 +125,7 @@ button.sui-panelhdr__bar:hover {
   border-color: color-mix(
     in srgb,
     var(--mantine-color-blue-5) 60%,
-    var(--border-subtle, var(--mantine-color-default-border))
+    var(--c-border-subtle, var(--mantine-color-default-border))
   );
 }
 
@@ -133,7 +133,7 @@ button.sui-panelhdr__bar:hover {
    so it doesn't read as a clashing lighter card on the dark toolbar. */
 [data-mantine-color-scheme="dark"] .sui-panelhdr__bar {
   background: transparent;
-  border-color: var(--border-subtle, var(--mantine-color-default-border));
+  border-color: var(--c-border-subtle, var(--mantine-color-default-border));
 }
 
 [data-mantine-color-scheme="dark"] button.sui-panelhdr__bar:hover {
@@ -144,7 +144,7 @@ button.sui-panelhdr__bar:hover {
   border-color: color-mix(
     in srgb,
     var(--mantine-color-blue-4) 55%,
-    var(--border-subtle, var(--mantine-color-default-border))
+    var(--c-border-subtle, var(--mantine-color-default-border))
   );
 }
 
diff --git a/frontend/editor/src/core/ui/ProgressBar.css b/frontend/editor/src/core/ui/ProgressBar.css
index 9bee3de24b..64d77ce1b8 100644
--- a/frontend/editor/src/core/ui/ProgressBar.css
+++ b/frontend/editor/src/core/ui/ProgressBar.css
@@ -1,6 +1,6 @@
 .sui-progress {
   width: 100%;
-  background: var(--color-usage-track);
+  background: var(--c-border);
   border-radius: 62.4375rem;
   overflow: hidden;
 }
diff --git a/frontend/editor/src/core/ui/ProgressBar.stories.tsx b/frontend/editor/src/core/ui/ProgressBar.stories.tsx
index 0f3f4f927b..7c8b386dda 100644
--- a/frontend/editor/src/core/ui/ProgressBar.stories.tsx
+++ b/frontend/editor/src/core/ui/ProgressBar.stories.tsx
@@ -56,9 +56,9 @@ export const InContext_UsageMeter: Story = {
         style={{
           width: "16rem",
           padding: 14,
-          border: "1px solid var(--color-border)",
+          border: "1px solid var(--c-border)",
           borderRadius: 8,
-          background: "var(--color-surface)",
+          background: "var(--c-surface)",
         }}
       >
         <S />
@@ -75,8 +75,8 @@ export const InContext_UsageMeter: Story = {
           marginBottom: 6,
         }}
       >
-        <span style={{ color: "var(--color-text-4)" }}>Docs processed</span>
-        <span style={{ color: "var(--color-text-2)", fontWeight: 500 }}>
+        <span style={{ color: "var(--c-text-subtle)" }}>Docs processed</span>
+        <span style={{ color: "var(--c-text-muted)", fontWeight: 500 }}>
           412 / 500
         </span>
       </div>
diff --git a/frontend/editor/src/core/ui/ProgressBar.tsx b/frontend/editor/src/core/ui/ProgressBar.tsx
index 570fc43099..e6ca30c0e1 100644
--- a/frontend/editor/src/core/ui/ProgressBar.tsx
+++ b/frontend/editor/src/core/ui/ProgressBar.tsx
@@ -45,10 +45,10 @@ export function ProgressBar({
           ? "linear-gradient(90deg, var(--color-red), color-mix(in srgb, var(--color-red) 70%, white))"
           : v >= 0.8
             ? "linear-gradient(90deg, var(--color-amber), color-mix(in srgb, var(--color-amber) 70%, white))"
-            : "linear-gradient(90deg, var(--color-blue), color-mix(in srgb, var(--color-blue) 70%, white))";
+            : "linear-gradient(90deg, var(--c-primary), color-mix(in srgb, var(--c-primary) 70%, white))";
     } else {
       fill =
-        "linear-gradient(90deg, var(--color-blue), color-mix(in srgb, var(--color-blue) 70%, white))";
+        "linear-gradient(90deg, var(--c-primary), color-mix(in srgb, var(--c-primary) 70%, white))";
     }
   }
   return (
diff --git a/frontend/editor/src/core/ui/Radio.css b/frontend/editor/src/core/ui/Radio.css
index 162d0a9d5e..7000c12219 100644
--- a/frontend/editor/src/core/ui/Radio.css
+++ b/frontend/editor/src/core/ui/Radio.css
@@ -17,7 +17,7 @@
   gap: var(--space-2);
   cursor: pointer;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .sui-radio--disabled {
   opacity: 0.5;
@@ -37,8 +37,8 @@
   height: 1rem;
   margin-top: 0.0625rem;
   border-radius: 50%;
-  border: 1.5px solid var(--color-border-hover);
-  background: var(--color-surface);
+  border: 1.5px solid var(--c-border-strong);
+  background: var(--c-surface);
   display: inline-flex;
   align-items: center;
   justify-content: center;
@@ -47,12 +47,12 @@
 }
 
 .sui-radio__input:focus-visible + .sui-radio__dot {
-  outline: 2px solid var(--color-blue);
+  outline: 2px solid var(--c-primary);
   outline-offset: 2px;
 }
 
 .sui-radio__input:checked + .sui-radio__dot {
-  border-color: var(--color-blue);
+  border-color: var(--c-primary);
 }
 
 .sui-radio__input:checked + .sui-radio__dot::after {
@@ -60,7 +60,7 @@
   width: 0.5rem;
   height: 0.5rem;
   border-radius: 50%;
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 
 .sui-radio__text {
@@ -68,10 +68,10 @@
   flex-direction: column;
 }
 .sui-radio__label {
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-weight: 500;
 }
 .sui-radio__desc {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/core/ui/SectionDivider.css b/frontend/editor/src/core/ui/SectionDivider.css
index 8999f6f0a3..ddfa8f0363 100644
--- a/frontend/editor/src/core/ui/SectionDivider.css
+++ b/frontend/editor/src/core/ui/SectionDivider.css
@@ -1,5 +1,5 @@
 .sui-divider {
   height: 0.0625rem;
-  background: var(--color-sidebar-divider);
+  background: var(--c-border-subtle);
   width: 100%;
 }
diff --git a/frontend/editor/src/core/ui/SectionDivider.stories.tsx b/frontend/editor/src/core/ui/SectionDivider.stories.tsx
index 8cd433e83a..dd758dfd39 100644
--- a/frontend/editor/src/core/ui/SectionDivider.stories.tsx
+++ b/frontend/editor/src/core/ui/SectionDivider.stories.tsx
@@ -13,9 +13,9 @@ type Story = StoryObj<typeof SectionDivider>;
 export const Default: Story = {
   render: () => (
     <div style={{ width: "24rem" }}>
-      <p style={{ color: "var(--color-text-3)" }}>Section above</p>
+      <p style={{ color: "var(--c-text-subtle)" }}>Section above</p>
       <SectionDivider />
-      <p style={{ color: "var(--color-text-3)" }}>Section below</p>
+      <p style={{ color: "var(--c-text-subtle)" }}>Section below</p>
     </div>
   ),
 };
@@ -25,11 +25,11 @@ export const InContext_SidebarGroups: Story = {
     <div
       style={{
         width: "15rem",
-        background: "var(--color-sidebar-bg)",
+        background: "var(--c-bg-raised)",
         padding: 10,
-        border: "1px solid var(--color-sidebar-border)",
+        border: "1px solid var(--c-border)",
         borderRadius: 6,
-        color: "var(--color-text-2)",
+        color: "var(--c-text-muted)",
         fontSize: 13,
       }}
     >
diff --git a/frontend/editor/src/core/ui/SectionHeader.css b/frontend/editor/src/core/ui/SectionHeader.css
index 63a354cc23..8a534d09a1 100644
--- a/frontend/editor/src/core/ui/SectionHeader.css
+++ b/frontend/editor/src/core/ui/SectionHeader.css
@@ -17,14 +17,14 @@ button.sui-sectionhdr {
   font-weight: 600;
   text-transform: uppercase;
   letter-spacing: 0.05em;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 .sui-sectionhdr__count {
   font-size: 0.6875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 .sui-sectionhdr__chevron {
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   flex-shrink: 0;
   transition: transform var(--motion-fast);
 }
diff --git a/frontend/editor/src/core/ui/Select.css b/frontend/editor/src/core/ui/Select.css
index b01cf2ecd1..7ced297651 100644
--- a/frontend/editor/src/core/ui/Select.css
+++ b/frontend/editor/src/core/ui/Select.css
@@ -2,18 +2,18 @@
   position: relative;
   display: inline-flex;
   align-items: center;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border-input);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
-  color: var(--color-text-1);
+  color: var(--c-text);
   transition:
     border-color var(--motion-fast),
     box-shadow var(--motion-fast);
 }
 
 .sui-select:focus-within {
-  border-color: var(--color-blue);
-  box-shadow: 0 0 0 2px color-mix(in srgb, var(--color-blue) 16%, transparent);
+  border-color: var(--c-primary);
+  box-shadow: 0 0 0 2px color-mix(in srgb, var(--c-primary) 16%, transparent);
 }
 
 .sui-select--sm {
@@ -53,8 +53,8 @@
  * select's color-scheme to the active SUI theme so the popup is always legible.
  */
 .sui-select__el option {
-  background-color: var(--color-surface);
-  color: var(--color-text-1);
+  background-color: var(--c-surface);
+  color: var(--c-text);
 }
 [data-theme="dark"] .sui-select__el {
   color-scheme: dark;
@@ -75,5 +75,5 @@
   display: inline-flex;
   align-items: center;
   pointer-events: none;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/core/ui/Select.tsx b/frontend/editor/src/core/ui/Select.tsx
index fa2d5346b7..242ddf9740 100644
--- a/frontend/editor/src/core/ui/Select.tsx
+++ b/frontend/editor/src/core/ui/Select.tsx
@@ -7,11 +7,11 @@ import { useInputAria } from "@app/ui/ariaForwarding";
 import "@app/ui/MantineForms.css";
 
 const SUI_INPUT_VARS = {
-  "--input-bg": "var(--color-surface)",
-  "--input-bd": "var(--color-border-input)",
-  "--input-bd-focus": "var(--color-blue)",
+  "--input-bg": "var(--c-surface)",
+  "--input-bd": "var(--c-border)",
+  "--input-bd-focus": "var(--c-primary)",
   "--input-radius": "var(--radius-md)",
-  "--input-color": "var(--color-text-1)",
+  "--input-color": "var(--c-text)",
   "--input-placeholder-color": "var(--color-text-placeholder)",
   "--input-height-sm": "1.75rem",
   "--input-height-md": "2.25rem",
diff --git a/frontend/editor/src/core/ui/SettingsRow.css b/frontend/editor/src/core/ui/SettingsRow.css
index f374a5fdab..18d707c489 100644
--- a/frontend/editor/src/core/ui/SettingsRow.css
+++ b/frontend/editor/src/core/ui/SettingsRow.css
@@ -13,11 +13,11 @@
 .sui-settingsrow__label {
   font-size: 0.8125rem;
   font-weight: 500;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .sui-settingsrow__desc {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   margin-top: 0.125rem;
 }
 .sui-settingsrow__control {
diff --git a/frontend/editor/src/core/ui/SettingsRow.stories.tsx b/frontend/editor/src/core/ui/SettingsRow.stories.tsx
index 4527ef2689..792171942b 100644
--- a/frontend/editor/src/core/ui/SettingsRow.stories.tsx
+++ b/frontend/editor/src/core/ui/SettingsRow.stories.tsx
@@ -48,7 +48,7 @@ export const List: Story = {
           key={r.label}
           style={{
             padding: "0.7rem 0.875rem",
-            borderTop: i > 0 ? "1px solid var(--color-border)" : undefined,
+            borderTop: i > 0 ? "1px solid var(--c-border)" : undefined,
           }}
         >
           <SettingsRow
diff --git a/frontend/editor/src/core/ui/SettingsShell.css b/frontend/editor/src/core/ui/SettingsShell.css
index 5d0e591c8b..7141e497e4 100644
--- a/frontend/editor/src/core/ui/SettingsShell.css
+++ b/frontend/editor/src/core/ui/SettingsShell.css
@@ -14,7 +14,7 @@
   flex-direction: column;
   gap: 1.25rem;
   background: var(--color-bg-subtle);
-  border-right: 1px solid var(--color-border-light);
+  border-right: 1px solid var(--c-border-subtle);
 }
 
 .sui-settings-shell__group {
@@ -30,7 +30,7 @@
   font-weight: 600;
   letter-spacing: 0.04em;
   text-transform: uppercase;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .sui-settings-shell__item {
@@ -45,20 +45,20 @@
   text-align: left;
   font-size: 0.8125rem;
   font-weight: 500;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   cursor: pointer;
   transition:
     background var(--motion-fast),
     color var(--motion-fast);
 }
 .sui-settings-shell__item:hover:not(:disabled) {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
+  background: var(--c-hover);
+  color: var(--c-text);
 }
 .sui-settings-shell__item.is-active {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
-  box-shadow: inset 2px 0 0 var(--color-blue);
+  background: var(--c-hover);
+  color: var(--c-text);
+  box-shadow: inset 2px 0 0 var(--c-primary);
 }
 .sui-settings-shell__item:disabled {
   opacity: 0.5;
@@ -87,7 +87,7 @@
   min-width: 0;
   display: flex;
   flex-direction: column;
-  background: var(--color-surface);
+  background: var(--c-surface);
 }
 
 .sui-settings-shell__header {
@@ -97,12 +97,12 @@
   justify-content: space-between;
   gap: 0.75rem;
   padding: 0.875rem 1.25rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 .sui-settings-shell__title {
   font-size: 1rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .sui-settings-shell__header-actions {
   display: flex;
@@ -128,7 +128,7 @@
   justify-content: flex-end;
   gap: 0.75rem;
   padding: 0.75rem 1.25rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 
 /* On a phone the rail collapses to a horizontal strip above the content. */
@@ -143,7 +143,7 @@
     flex-wrap: wrap;
     gap: 0.25rem;
     border-right: none;
-    border-bottom: 1px solid var(--color-border-light);
+    border-bottom: 1px solid var(--c-border-subtle);
   }
   .sui-settings-shell__group {
     flex-direction: row;
diff --git a/frontend/editor/src/core/ui/SettingsShell.stories.tsx b/frontend/editor/src/core/ui/SettingsShell.stories.tsx
index cd266c95a1..f8cf00fd6b 100644
--- a/frontend/editor/src/core/ui/SettingsShell.stories.tsx
+++ b/frontend/editor/src/core/ui/SettingsShell.stories.tsx
@@ -49,7 +49,7 @@ export const Default: Story = {
   render: () => {
     const [active, setActive] = useState("profile");
     return (
-      <div style={{ height: "36rem", border: "1px solid var(--color-border)" }}>
+      <div style={{ height: "36rem", border: "1px solid var(--c-border)" }}>
         <SettingsShell
           sections={SECTIONS}
           activeKey={active}
@@ -63,7 +63,7 @@ export const Default: Story = {
             </>
           }
         >
-          <p style={{ color: "var(--color-text-3)" }}>
+          <p style={{ color: "var(--c-text-subtle)" }}>
             Content for the “{LABELS[active]}” section renders here.
           </p>
         </SettingsShell>
diff --git a/frontend/editor/src/core/ui/Skeleton.css b/frontend/editor/src/core/ui/Skeleton.css
index 98da3c7dbe..42dccfb5be 100644
--- a/frontend/editor/src/core/ui/Skeleton.css
+++ b/frontend/editor/src/core/ui/Skeleton.css
@@ -2,9 +2,9 @@
   display: inline-block;
   background: linear-gradient(
     90deg,
-    var(--color-bg-muted) 0%,
-    var(--color-bg-hover) 50%,
-    var(--color-bg-muted) 100%
+    var(--c-surface-sunken) 0%,
+    var(--c-hover) 50%,
+    var(--c-surface-sunken) 100%
   );
   background-size: 200% 100%;
   animation: shimmer 1.4s linear infinite;
diff --git a/frontend/editor/src/core/ui/Slider.css b/frontend/editor/src/core/ui/Slider.css
index 005ca0cbba..7be91a36c6 100644
--- a/frontend/editor/src/core/ui/Slider.css
+++ b/frontend/editor/src/core/ui/Slider.css
@@ -17,10 +17,10 @@
   border-radius: var(--radius-pill);
   background: linear-gradient(
     90deg,
-    var(--color-blue) 0%,
-    var(--color-blue) var(--slider-pct),
-    var(--color-bg-muted) var(--slider-pct),
-    var(--color-bg-muted) 100%
+    var(--c-primary) 0%,
+    var(--c-primary) var(--slider-pct),
+    var(--c-surface-sunken) var(--slider-pct),
+    var(--c-surface-sunken) 100%
   );
   outline: none;
 }
@@ -32,7 +32,7 @@
   height: 1rem;
   border-radius: 50%;
   background: #fff;
-  border: 2px solid var(--color-blue);
+  border: 2px solid var(--c-primary);
   box-shadow: 0 1px 2px rgba(0, 0, 0, 0.15);
   cursor: pointer;
   transition: transform var(--motion-fast);
@@ -43,13 +43,13 @@
   height: 1rem;
   border-radius: 50%;
   background: #fff;
-  border: 2px solid var(--color-blue);
+  border: 2px solid var(--c-primary);
   box-shadow: 0 1px 2px rgba(0, 0, 0, 0.15);
   cursor: pointer;
 }
 
 .sui-slider__input:focus-visible::-webkit-slider-thumb {
-  outline: 2px solid var(--color-blue);
+  outline: 2px solid var(--c-primary);
   outline-offset: 2px;
 }
 
@@ -64,5 +64,5 @@
   font-family: var(--font-mono);
   font-size: 0.75rem;
   font-weight: 500;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
diff --git a/frontend/editor/src/core/ui/Spinner.stories.tsx b/frontend/editor/src/core/ui/Spinner.stories.tsx
index 9435ffec3a..f2bc56a9ac 100644
--- a/frontend/editor/src/core/ui/Spinner.stories.tsx
+++ b/frontend/editor/src/core/ui/Spinner.stories.tsx
@@ -31,7 +31,7 @@ export const SizeRow: Story = {
 export const InheritsColor: Story = {
   render: () => (
     <div style={{ display: "flex", gap: 24 }}>
-      <span style={{ color: "var(--color-blue)" }}>
+      <span style={{ color: "var(--c-primary)" }}>
         <Spinner />
       </span>
       <span style={{ color: "var(--color-green)" }}>
diff --git a/frontend/editor/src/core/ui/Stack.stories.tsx b/frontend/editor/src/core/ui/Stack.stories.tsx
index d35a40928c..20f6948632 100644
--- a/frontend/editor/src/core/ui/Stack.stories.tsx
+++ b/frontend/editor/src/core/ui/Stack.stories.tsx
@@ -17,7 +17,7 @@ function Box({ children }: { children: React.ReactNode }) {
     <div
       style={{
         padding: 8,
-        background: "var(--color-bg-muted)",
+        background: "var(--c-surface-sunken)",
         borderRadius: 6,
         fontSize: 12,
       }}
@@ -42,7 +42,7 @@ export const GapSizes: Story = {
     <Inline gap="6" align="start">
       {(["1", "2", "4", "6"] as const).map((gap) => (
         <Stack key={gap} gap={gap}>
-          <div style={{ fontSize: 11, color: "var(--color-text-4)" }}>
+          <div style={{ fontSize: 11, color: "var(--c-text-subtle)" }}>
             gap {gap}
           </div>
           <Box>A</Box>
@@ -59,7 +59,7 @@ export const InCard: Story = {
     <Card padding="loose" style={{ width: "20rem" }}>
       <Stack gap="3">
         <div style={{ fontWeight: 600 }}>Card title</div>
-        <div style={{ color: "var(--color-text-3)", fontSize: 13 }}>
+        <div style={{ color: "var(--c-text-subtle)", fontSize: 13 }}>
           Stack is the default vertical container — it's how you compose every
           card body, list, and form section.
         </div>
diff --git a/frontend/editor/src/core/ui/StatTile.css b/frontend/editor/src/core/ui/StatTile.css
index c29455fc72..0fdc22c8ca 100644
--- a/frontend/editor/src/core/ui/StatTile.css
+++ b/frontend/editor/src/core/ui/StatTile.css
@@ -9,14 +9,14 @@
   font-size: 0.6875rem;
   text-transform: uppercase;
   letter-spacing: 0.04em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   font-weight: 600;
 }
 
 .sui-stat__value {
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 
@@ -34,6 +34,6 @@
 .sui-stat__value code {
   font-family: var(--font-mono);
   font-size: 0.75rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   word-break: break-all;
 }
diff --git a/frontend/editor/src/core/ui/StatusBadge.css b/frontend/editor/src/core/ui/StatusBadge.css
index 62f6fb0f3a..230c99b40d 100644
--- a/frontend/editor/src/core/ui/StatusBadge.css
+++ b/frontend/editor/src/core/ui/StatusBadge.css
@@ -8,15 +8,15 @@
   letter-spacing: 0.01em;
   border: 1px solid transparent;
   line-height: 1;
-  color: var(--sui-status-c, var(--color-text-3));
+  color: var(--sui-status-c, var(--c-text-subtle));
   background: color-mix(
     in srgb,
-    var(--sui-status-c, var(--color-text-3)) 12%,
+    var(--sui-status-c, var(--c-text-subtle)) 12%,
     transparent
   );
   border-color: color-mix(
     in srgb,
-    var(--sui-status-c, var(--color-text-3)) 28%,
+    var(--sui-status-c, var(--c-text-subtle)) 28%,
     transparent
   );
 }
@@ -51,9 +51,9 @@
 
 /* Neutral keeps the plain muted surface rather than an accent tint. */
 .sui-status--neutral {
-  color: var(--color-text-3);
-  background: var(--color-bg-muted);
-  border-color: var(--color-border-light);
+  color: var(--c-text-subtle);
+  background: var(--c-surface-sunken);
+  border-color: var(--c-border-subtle);
 }
 /* Tones only pick the accent; the base rule builds the fill + border. `-dark`
    is theme-adaptive, so text stays legible on the pale fill in both themes. */
@@ -67,7 +67,7 @@
   --sui-status-c: var(--color-red-dark);
 }
 .sui-status--info {
-  --sui-status-c: var(--color-blue-dark);
+  --sui-status-c: var(--c-primary-hover);
 }
 .sui-status--purple {
   --sui-status-c: var(--color-purple-dark);
diff --git a/frontend/editor/src/core/ui/StepIndicator.css b/frontend/editor/src/core/ui/StepIndicator.css
index d5d46e7bd5..8c364d9c56 100644
--- a/frontend/editor/src/core/ui/StepIndicator.css
+++ b/frontend/editor/src/core/ui/StepIndicator.css
@@ -6,7 +6,7 @@
 .sui-steps__bar {
   flex: 1;
   border-radius: 999px;
-  background: var(--color-border);
+  background: var(--c-border);
   transition: background var(--motion-fast);
 }
 .sui-steps--md .sui-steps__bar {
@@ -17,11 +17,11 @@
 }
 /* Completed steps: solid accent. */
 .sui-steps__bar[data-state="done"] {
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 /* Current step: solid accent + a soft ring so it reads as "you are here". */
 .sui-steps__bar[data-state="current"] {
-  background: var(--color-blue);
+  background: var(--c-primary);
   box-shadow: 0 0 0 0.1875rem
-    color-mix(in srgb, var(--color-blue) 22%, transparent);
+    color-mix(in srgb, var(--c-primary) 22%, transparent);
 }
diff --git a/frontend/editor/src/core/ui/Table.css b/frontend/editor/src/core/ui/Table.css
index 3b17a6c44d..696bbc8afb 100644
--- a/frontend/editor/src/core/ui/Table.css
+++ b/frontend/editor/src/core/ui/Table.css
@@ -1,9 +1,9 @@
 .sui-table-wrap {
   width: 100%;
   overflow-x: auto;
-  border: 1px solid var(--color-border);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
-  background: var(--color-surface);
+  background: var(--c-surface);
 }
 
 .sui-table {
@@ -15,12 +15,12 @@
 .sui-table__th {
   text-align: left;
   font-weight: 600;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-size: 0.6875rem;
   text-transform: uppercase;
   letter-spacing: 0.04em;
   padding: 0.625rem 0.875rem;
-  border-bottom: 1px solid var(--color-border);
+  border-bottom: 1px solid var(--c-border);
   white-space: nowrap;
 }
 .sui-table__th--right,
@@ -34,8 +34,8 @@
 
 .sui-table__td {
   padding: 0.625rem 0.875rem;
-  color: var(--color-text-2);
-  border-bottom: 1px solid var(--color-border-light);
+  color: var(--c-text-muted);
+  border-bottom: 1px solid var(--c-border-subtle);
   vertical-align: middle;
 }
 .sui-table tbody tr:last-child .sui-table__td {
@@ -47,15 +47,15 @@
   transition: background var(--motion-fast);
 }
 .sui-table__row--interactive:hover {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 .sui-table__row--interactive:focus-visible {
-  outline: 0.125rem solid var(--color-blue);
+  outline: 0.125rem solid var(--c-primary);
   outline-offset: -0.125rem;
 }
 
 .sui-table__empty {
   padding: 2rem;
   text-align: center;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/core/ui/Tabs.css b/frontend/editor/src/core/ui/Tabs.css
index b9dd365fc7..9fa18ce5b4 100644
--- a/frontend/editor/src/core/ui/Tabs.css
+++ b/frontend/editor/src/core/ui/Tabs.css
@@ -7,7 +7,7 @@
 .sui-tabs--pill {
 }
 .sui-tabs--underline {
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
   padding-bottom: var(--space-1);
   gap: var(--space-3);
 }
@@ -18,7 +18,7 @@
   gap: var(--space-1_5);
   padding: var(--space-1_5) var(--space-3);
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   background: transparent;
   border: 1px solid transparent;
   transition:
@@ -28,8 +28,8 @@
 }
 
 .sui-tabs__tab:hover:not(.is-disabled) {
-  color: var(--color-text-1);
-  background: var(--color-bg-hover);
+  color: var(--c-text);
+  background: var(--c-hover);
 }
 
 .sui-tabs__tab.is-disabled {
@@ -42,9 +42,9 @@
   border-radius: var(--radius-pill);
 }
 .sui-tabs--pill .sui-tabs__tab.is-active {
-  color: var(--sui-tab-accent, var(--color-blue));
-  background: var(--color-blue-light);
-  border-color: var(--sui-tab-accent, var(--color-blue-border));
+  color: var(--sui-tab-accent, var(--c-primary));
+  background: var(--c-primary-tint);
+  border-color: var(--sui-tab-accent, var(--c-primary-border));
   font-weight: 500;
 }
 
@@ -56,8 +56,8 @@
   margin-bottom: -1px;
 }
 .sui-tabs--underline .sui-tabs__tab.is-active {
-  color: var(--sui-tab-accent, var(--color-blue));
-  border-bottom-color: var(--sui-tab-accent, var(--color-blue));
+  color: var(--sui-tab-accent, var(--c-primary));
+  border-bottom-color: var(--sui-tab-accent, var(--c-primary));
   font-weight: 500;
 }
 
@@ -69,7 +69,7 @@
 
 .sui-tabs__count {
   font-size: 0.6875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .sui-tabs__tab.is-active .sui-tabs__count {
diff --git a/frontend/editor/src/core/ui/Toast.css b/frontend/editor/src/core/ui/Toast.css
index a1ca3a67bf..eff290522d 100644
--- a/frontend/editor/src/core/ui/Toast.css
+++ b/frontend/editor/src/core/ui/Toast.css
@@ -16,8 +16,8 @@
   align-items: flex-start;
   gap: var(--space-3);
   padding: var(--space-3) var(--space-4);
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-left-width: 3px;
   border-radius: var(--radius-md);
   box-shadow: var(--shadow-lg);
@@ -25,7 +25,7 @@
 }
 
 .sui-toast--info {
-  border-left-color: var(--color-blue);
+  border-left-color: var(--c-primary);
 }
 .sui-toast--success {
   border-left-color: var(--color-green);
@@ -44,10 +44,10 @@
 }
 .sui-toast__title {
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .sui-toast__desc {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   margin-top: 0.125rem;
   line-height: 1.45;
 }
diff --git a/frontend/editor/src/core/ui/ToggleSwitch.css b/frontend/editor/src/core/ui/ToggleSwitch.css
index f5025ebfbe..1b6aa90528 100644
--- a/frontend/editor/src/core/ui/ToggleSwitch.css
+++ b/frontend/editor/src/core/ui/ToggleSwitch.css
@@ -34,7 +34,7 @@
   transition: transform var(--motion-base);
 }
 .sui-toggle input:checked + .sui-toggle__track {
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 .sui-toggle input:checked + .sui-toggle__track .sui-toggle__thumb {
   transform: translateX(1rem);
@@ -65,14 +65,14 @@
 .sui-toggle__label {
   font-size: 0.8125rem;
   font-weight: 500;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .sui-toggle__desc {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .sui-toggle input:focus-visible + .sui-toggle__track {
-  outline: 2px solid var(--color-blue);
+  outline: 2px solid var(--c-primary);
   outline-offset: 2px;
 }
diff --git a/frontend/editor/src/core/ui/accents.css b/frontend/editor/src/core/ui/accents.css
index 1d47b4ec89..404f98cc52 100644
--- a/frontend/editor/src/core/ui/accents.css
+++ b/frontend/editor/src/core/ui/accents.css
@@ -2,24 +2,26 @@
  * accents derive from --color-* tokens (auto dark), neutral/brand/ai are explicit. */
 
 .sui-acc-default {
-  --_solid: var(--color-blue);
-  --_solid-hover: var(--color-blue-dark);
+  --_solid: var(--c-primary);
+  --_solid-hover: var(--c-primary-hover);
   --_on: #ffffff;
-  --_text: var(--color-blue-dark);
-  --_bd: var(--color-blue-border);
-  --_tint: color-mix(in srgb, var(--color-blue) 12%, transparent);
+  --_text: var(--c-primary-hover);
+  --_bd: color-mix(in srgb, var(--c-primary) 38%, var(--c-surface));
+  --_tint: color-mix(in srgb, var(--c-primary) 12%, transparent);
 }
 
 html[data-app-theme="custom"] .sui-acc-default {
   --_on: var(--c-text-on-primary);
 }
+/* Danger is pinned to a fixed deep red (not the theme-lightened coral), so the
+   fill and the outline/text are the SAME red in both light and dark. */
 .sui-acc-danger {
-  --_solid: var(--color-red);
-  --_solid-hover: var(--color-red-dark);
+  --_solid: var(--p-red-500);
+  --_solid-hover: var(--p-red-600);
   --_on: #ffffff;
-  --_text: var(--color-red-dark);
-  --_bd: var(--color-red-border);
-  --_tint: color-mix(in srgb, var(--color-red) 12%, transparent);
+  --_text: var(--p-red-500);
+  --_bd: color-mix(in srgb, var(--p-red-500) 45%, transparent);
+  --_tint: color-mix(in srgb, var(--p-red-500) 12%, transparent);
 }
 .sui-acc-success {
   --_solid: var(--color-green);
@@ -49,57 +51,57 @@ html[data-app-theme="custom"] .sui-acc-default {
 
 /* neutral: low-emphasis grey — no palette token, so explicit. */
 .sui-acc-neutral {
-  --_solid: #475569;
-  --_solid-hover: #334155;
+  --_solid: var(--p-c-475569);
+  --_solid-hover: var(--p-c-334155);
   --_on: #ffffff;
-  --_text: #475569;
-  --_bd: #cbd5e1;
-  --_tint: rgba(71, 85, 105, 0.1);
+  --_text: var(--p-c-475569);
+  --_bd: var(--p-c-cbd5e1);
+  --_tint: color-mix(in srgb, var(--p-c-475569) 10%, transparent);
 }
 [data-theme="dark"] .sui-acc-neutral {
-  --_solid: #64748b;
-  --_solid-hover: #475569;
-  --_text: #cbd5e1;
-  --_bd: #334155;
-  --_tint: rgba(148, 163, 184, 0.16);
+  --_solid: var(--p-c-64748b);
+  --_solid-hover: var(--p-c-475569);
+  --_text: var(--p-c-cbd5e1);
+  --_bd: var(--p-c-334155);
+  --_tint: color-mix(in srgb, var(--p-c-94a3b8) 16%, transparent);
 }
 /* brand: Stirling red — a bespoke brand colour, not part of the token palette. */
 .sui-acc-brand {
-  --_solid: #8e3131;
-  --_solid-hover: #7a2929;
+  --_solid: var(--p-brand-red-650);
+  --_solid-hover: var(--p-brand-red-700);
   --_on: #ffffff;
-  --_text: #8e3131;
-  --_bd: #d9a8a8;
-  --_tint: rgba(142, 49, 49, 0.09);
+  --_text: var(--p-brand-red-650);
+  --_bd: var(--p-brand-red-200);
+  --_tint: color-mix(in srgb, var(--p-brand-red-650) 9%, transparent);
 }
 [data-theme="dark"] .sui-acc-brand {
-  --_text: #d98a8a;
-  --_bd: #5a2424;
-  --_tint: rgba(217, 138, 138, 0.16);
+  --_text: var(--p-brand-red-300);
+  --_bd: var(--p-brand-red-900);
+  --_tint: color-mix(in srgb, var(--p-brand-red-300) 16%, transparent);
 }
 /* ai: multi-hue gradient for AI features — no single-colour token. */
 .sui-acc-ai {
   --_solid: linear-gradient(
     135deg,
-    #8b5cf6 0%,
-    #6366f1 38%,
-    #3b82f6 72%,
-    #22d3ee 100%
+    var(--p-violet-500) 0%,
+    var(--p-indigo-500) 38%,
+    var(--p-blue-500) 72%,
+    var(--p-cyan-400) 100%
   );
   --_solid-hover: linear-gradient(
     135deg,
-    #8b5cf6 0%,
-    #6366f1 38%,
-    #3b82f6 72%,
-    #22d3ee 100%
+    var(--p-violet-500) 0%,
+    var(--p-indigo-500) 38%,
+    var(--p-blue-500) 72%,
+    var(--p-cyan-400) 100%
   );
   --_on: #ffffff;
-  --_text: #6366f1;
-  --_bd: #c7d2fe;
-  --_tint: rgba(99, 102, 241, 0.1);
+  --_text: var(--p-indigo-500);
+  --_bd: var(--p-indigo-200);
+  --_tint: color-mix(in srgb, var(--p-indigo-500) 10%, transparent);
 }
 [data-theme="dark"] .sui-acc-ai {
-  --_text: #a5b4fc;
-  --_bd: #3730a3;
-  --_tint: rgba(129, 140, 248, 0.18);
+  --_text: var(--p-indigo-300);
+  --_bd: var(--p-indigo-800);
+  --_tint: color-mix(in srgb, var(--p-indigo-400) 18%, transparent);
 }
diff --git a/frontend/editor/src/desktop/components/DesktopOnboardingModal.tsx b/frontend/editor/src/desktop/components/DesktopOnboardingModal.tsx
index 96bddff2af..4f9222c2b0 100644
--- a/frontend/editor/src/desktop/components/DesktopOnboardingModal.tsx
+++ b/frontend/editor/src/desktop/components/DesktopOnboardingModal.tsx
@@ -15,7 +15,10 @@ import { connectionModeService } from "@app/services/connectionModeService";
 
 const ONBOARDING_KEY = "stirling-desktop-onboarding-seen";
 
-const SIGN_IN_GRADIENT: [string, string] = ["#3B82F6", "#7C3AED"];
+const SIGN_IN_GRADIENT: [string, string] = [
+  "var(--c-hue-blue)",
+  "var(--c-hue-violet)",
+];
 
 /**
  * Desktop-specific onboarding modal.
@@ -76,7 +79,7 @@ export function DesktopOnboardingModal() {
         content: {
           overflow: "hidden",
           border: "none",
-          background: "var(--bg-surface)",
+          background: "var(--c-surface)",
           maxHeight: "90vh",
           display: "flex",
           flexDirection: "column",
@@ -158,7 +161,7 @@ export function DesktopOnboardingModal() {
                 <div className={`${styles.bodyCopy} ${styles.bodyCopyInner}`}>
                   {welcomeSlide.body}
                 </div>
-                <style>{`.${styles.bodyCopyInner} strong { color: var(--onboarding-title); font-weight: 600; }`}</style>
+                <style>{`.${styles.bodyCopyInner} strong { color: var(--c-text); font-weight: 600; }`}</style>
               </div>
               <OnboardingStepper totalSteps={totalSteps} activeStep={step} />
               <div className={styles.buttonContainer}>
diff --git a/frontend/editor/src/desktop/components/SetupWizard/desktopOAuth.css b/frontend/editor/src/desktop/components/SetupWizard/desktopOAuth.css
index 55ab193a4c..3483c3563a 100644
--- a/frontend/editor/src/desktop/components/SetupWizard/desktopOAuth.css
+++ b/frontend/editor/src/desktop/components/SetupWizard/desktopOAuth.css
@@ -30,7 +30,7 @@
 }
 
 .oauth-button-vertical-desktop:hover:not(:disabled) {
-  background-color: var(--bg-raised);
+  background-color: var(--c-surface-raised);
 }
 
 .oauth-button-vertical-desktop:disabled {
diff --git a/frontend/editor/src/desktop/components/tools/toolPicker/ToolPickerFooterExtensions.tsx b/frontend/editor/src/desktop/components/tools/toolPicker/ToolPickerFooterExtensions.tsx
index 1dc41e9497..d573f189af 100644
--- a/frontend/editor/src/desktop/components/tools/toolPicker/ToolPickerFooterExtensions.tsx
+++ b/frontend/editor/src/desktop/components/tools/toolPicker/ToolPickerFooterExtensions.tsx
@@ -40,8 +40,8 @@ export function ToolPickerFooterExtensions() {
       px="sm"
       py={10}
       style={{
-        borderTop: "1px solid var(--border-default)",
-        background: "var(--bg-toolbar)",
+        borderTop: "1px solid var(--c-border)",
+        background: "var(--c-bg-raised)",
         flexShrink: 0,
       }}
     >
diff --git a/frontend/editor/src/desktop/routes/login/LoginHeader.tsx b/frontend/editor/src/desktop/routes/login/LoginHeader.tsx
index fc715e6696..1b7900956e 100644
--- a/frontend/editor/src/desktop/routes/login/LoginHeader.tsx
+++ b/frontend/editor/src/desktop/routes/login/LoginHeader.tsx
@@ -63,7 +63,7 @@ export default function LoginHeader({
             aria-label={t("common.close", "Close")}
             style={{
               flexShrink: 0,
-              color: "var(--text-secondary)",
+              color: "var(--c-text-muted)",
               outline: "none",
             }}
           >
diff --git a/frontend/editor/src/output.css b/frontend/editor/src/output.css
index c77b20bc87..09e3931f55 100644
--- a/frontend/editor/src/output.css
+++ b/frontend/editor/src/output.css
@@ -1,362 +1,375 @@
-*, ::before, ::after {
-    --tw-border-spacing-x: 0;
-    --tw-border-spacing-y: 0;
-    --tw-translate-x: 0;
-    --tw-translate-y: 0;
-    --tw-rotate: 0;
-    --tw-skew-x: 0;
-    --tw-skew-y: 0;
-    --tw-scale-x: 1;
-    --tw-scale-y: 1;
-    --tw-pan-x:  ;
-    --tw-pan-y:  ;
-    --tw-pinch-zoom:  ;
-    --tw-scroll-snap-strictness: proximity;
-    --tw-gradient-from-position:  ;
-    --tw-gradient-via-position:  ;
-    --tw-gradient-to-position:  ;
-    --tw-ordinal:  ;
-    --tw-slashed-zero:  ;
-    --tw-numeric-figure:  ;
-    --tw-numeric-spacing:  ;
-    --tw-numeric-fraction:  ;
-    --tw-ring-inset:  ;
-    --tw-ring-offset-width: 0px;
-    --tw-ring-offset-color: #fff;
-    --tw-ring-color: rgb(59 130 246 / 0.5);
-    --tw-ring-offset-shadow: 0 0 #0000;
-    --tw-ring-shadow: 0 0 #0000;
-    --tw-shadow: 0 0 #0000;
-    --tw-shadow-colored: 0 0 #0000;
-    --tw-blur:  ;
-    --tw-brightness:  ;
-    --tw-contrast:  ;
-    --tw-grayscale:  ;
-    --tw-hue-rotate:  ;
-    --tw-invert:  ;
-    --tw-saturate:  ;
-    --tw-sepia:  ;
-    --tw-drop-shadow:  ;
-    --tw-backdrop-blur:  ;
-    --tw-backdrop-brightness:  ;
-    --tw-backdrop-contrast:  ;
-    --tw-backdrop-grayscale:  ;
-    --tw-backdrop-hue-rotate:  ;
-    --tw-backdrop-invert:  ;
-    --tw-backdrop-opacity:  ;
-    --tw-backdrop-saturate:  ;
-    --tw-backdrop-sepia:  ;
-    --tw-contain-size:  ;
-    --tw-contain-layout:  ;
-    --tw-contain-paint:  ;
-    --tw-contain-style:  
+*,
+::before,
+::after {
+  --tw-border-spacing-x: 0;
+  --tw-border-spacing-y: 0;
+  --tw-translate-x: 0;
+  --tw-translate-y: 0;
+  --tw-rotate: 0;
+  --tw-skew-x: 0;
+  --tw-skew-y: 0;
+  --tw-scale-x: 1;
+  --tw-scale-y: 1;
+  --tw-pan-x:  ;
+  --tw-pan-y:  ;
+  --tw-pinch-zoom:  ;
+  --tw-scroll-snap-strictness: proximity;
+  --tw-gradient-from-position:  ;
+  --tw-gradient-via-position:  ;
+  --tw-gradient-to-position:  ;
+  --tw-ordinal:  ;
+  --tw-slashed-zero:  ;
+  --tw-numeric-figure:  ;
+  --tw-numeric-spacing:  ;
+  --tw-numeric-fraction:  ;
+  --tw-ring-inset:  ;
+  --tw-ring-offset-width: 0px;
+  --tw-ring-offset-color: #fff;
+  --tw-ring-color: rgb(59 130 246 / 0.5);
+  --tw-ring-offset-shadow: 0 0 #0000;
+  --tw-ring-shadow: 0 0 #0000;
+  --tw-shadow: 0 0 #0000;
+  --tw-shadow-colored: 0 0 #0000;
+  --tw-blur:  ;
+  --tw-brightness:  ;
+  --tw-contrast:  ;
+  --tw-grayscale:  ;
+  --tw-hue-rotate:  ;
+  --tw-invert:  ;
+  --tw-saturate:  ;
+  --tw-sepia:  ;
+  --tw-drop-shadow:  ;
+  --tw-backdrop-blur:  ;
+  --tw-backdrop-brightness:  ;
+  --tw-backdrop-contrast:  ;
+  --tw-backdrop-grayscale:  ;
+  --tw-backdrop-hue-rotate:  ;
+  --tw-backdrop-invert:  ;
+  --tw-backdrop-opacity:  ;
+  --tw-backdrop-saturate:  ;
+  --tw-backdrop-sepia:  ;
+  --tw-contain-size:  ;
+  --tw-contain-layout:  ;
+  --tw-contain-paint:  ;
+  --tw-contain-style:     
+;
 }
 ::backdrop {
-    --tw-border-spacing-x: 0;
-    --tw-border-spacing-y: 0;
-    --tw-translate-x: 0;
-    --tw-translate-y: 0;
-    --tw-rotate: 0;
-    --tw-skew-x: 0;
-    --tw-skew-y: 0;
-    --tw-scale-x: 1;
-    --tw-scale-y: 1;
-    --tw-pan-x:  ;
-    --tw-pan-y:  ;
-    --tw-pinch-zoom:  ;
-    --tw-scroll-snap-strictness: proximity;
-    --tw-gradient-from-position:  ;
-    --tw-gradient-via-position:  ;
-    --tw-gradient-to-position:  ;
-    --tw-ordinal:  ;
-    --tw-slashed-zero:  ;
-    --tw-numeric-figure:  ;
-    --tw-numeric-spacing:  ;
-    --tw-numeric-fraction:  ;
-    --tw-ring-inset:  ;
-    --tw-ring-offset-width: 0px;
-    --tw-ring-offset-color: #fff;
-    --tw-ring-color: rgb(59 130 246 / 0.5);
-    --tw-ring-offset-shadow: 0 0 #0000;
-    --tw-ring-shadow: 0 0 #0000;
-    --tw-shadow: 0 0 #0000;
-    --tw-shadow-colored: 0 0 #0000;
-    --tw-blur:  ;
-    --tw-brightness:  ;
-    --tw-contrast:  ;
-    --tw-grayscale:  ;
-    --tw-hue-rotate:  ;
-    --tw-invert:  ;
-    --tw-saturate:  ;
-    --tw-sepia:  ;
-    --tw-drop-shadow:  ;
-    --tw-backdrop-blur:  ;
-    --tw-backdrop-brightness:  ;
-    --tw-backdrop-contrast:  ;
-    --tw-backdrop-grayscale:  ;
-    --tw-backdrop-hue-rotate:  ;
-    --tw-backdrop-invert:  ;
-    --tw-backdrop-opacity:  ;
-    --tw-backdrop-saturate:  ;
-    --tw-backdrop-sepia:  ;
-    --tw-contain-size:  ;
-    --tw-contain-layout:  ;
-    --tw-contain-paint:  ;
-    --tw-contain-style:  
+  --tw-border-spacing-x: 0;
+  --tw-border-spacing-y: 0;
+  --tw-translate-x: 0;
+  --tw-translate-y: 0;
+  --tw-rotate: 0;
+  --tw-skew-x: 0;
+  --tw-skew-y: 0;
+  --tw-scale-x: 1;
+  --tw-scale-y: 1;
+  --tw-pan-x:  ;
+  --tw-pan-y:  ;
+  --tw-pinch-zoom:  ;
+  --tw-scroll-snap-strictness: proximity;
+  --tw-gradient-from-position:  ;
+  --tw-gradient-via-position:  ;
+  --tw-gradient-to-position:  ;
+  --tw-ordinal:  ;
+  --tw-slashed-zero:  ;
+  --tw-numeric-figure:  ;
+  --tw-numeric-spacing:  ;
+  --tw-numeric-fraction:  ;
+  --tw-ring-inset:  ;
+  --tw-ring-offset-width: 0px;
+  --tw-ring-offset-color: #fff;
+  --tw-ring-color: rgb(59 130 246 / 0.5);
+  --tw-ring-offset-shadow: 0 0 #0000;
+  --tw-ring-shadow: 0 0 #0000;
+  --tw-shadow: 0 0 #0000;
+  --tw-shadow-colored: 0 0 #0000;
+  --tw-blur:  ;
+  --tw-brightness:  ;
+  --tw-contrast:  ;
+  --tw-grayscale:  ;
+  --tw-hue-rotate:  ;
+  --tw-invert:  ;
+  --tw-saturate:  ;
+  --tw-sepia:  ;
+  --tw-drop-shadow:  ;
+  --tw-backdrop-blur:  ;
+  --tw-backdrop-brightness:  ;
+  --tw-backdrop-contrast:  ;
+  --tw-backdrop-grayscale:  ;
+  --tw-backdrop-hue-rotate:  ;
+  --tw-backdrop-invert:  ;
+  --tw-backdrop-opacity:  ;
+  --tw-backdrop-saturate:  ;
+  --tw-backdrop-sepia:  ;
+  --tw-contain-size:  ;
+  --tw-contain-layout:  ;
+  --tw-contain-paint:  ;
+  --tw-contain-style:     
+;
 }
 .mb-3 {
-    margin-bottom: 0.75rem
+  margin-bottom: 0.75rem;
 }
 .mb-4 {
-    margin-bottom: 1rem
+  margin-bottom: 1rem;
 }
 .mr-2 {
-    margin-right: 0.5rem
+  margin-right: 0.5rem;
 }
 .mt-2 {
-    margin-top: 0.5rem
+  margin-top: 0.5rem;
 }
 .mt-4 {
-    margin-top: 1rem
+  margin-top: 1rem;
 }
 .block {
-    display: block
+  display: block;
 }
 .flex {
-    display: flex
+  display: flex;
 }
 .hidden {
-    display: none
+  display: none;
 }
 .h-6 {
-    height: 1.5rem
+  height: 1.5rem;
 }
 .h-full {
-    height: 100%
+  height: 100%;
 }
 .h-screen {
-    height: 100vh
+  height: 100vh;
 }
 .w-6 {
-    width: 1.5rem
+  width: 1.5rem;
 }
 .w-64 {
-    width: 16rem
+  width: 16rem;
 }
 .w-72 {
-    width: 18rem
+  width: 18rem;
 }
 .w-full {
-    width: 100%
+  width: 100%;
 }
 .max-w-3xl {
-    max-width: 48rem
+  max-width: 48rem;
 }
 .flex-1 {
-    flex: 1 1 0%
+  flex: 1 1 0%;
 }
 .cursor-pointer {
-    cursor: pointer
+  cursor: pointer;
 }
 .list-disc {
-    list-style-type: disc
+  list-style-type: disc;
 }
 .flex-col {
-    flex-direction: column
+  flex-direction: column;
 }
 .items-center {
-    align-items: center
+  align-items: center;
 }
 .justify-center {
-    justify-content: center
+  justify-content: center;
 }
 .justify-between {
-    justify-content: space-between
+  justify-content: space-between;
 }
 .space-x-2 > :not([hidden]) ~ :not([hidden]) {
-    --tw-space-x-reverse: 0;
-    margin-right: calc(0.5rem * var(--tw-space-x-reverse));
-    margin-left: calc(0.5rem * calc(1 - var(--tw-space-x-reverse)))
+  --tw-space-x-reverse: 0;
+  margin-right: calc(0.5rem * var(--tw-space-x-reverse));
+  margin-left: calc(0.5rem * calc(1 - var(--tw-space-x-reverse)));
 }
 .space-x-3 > :not([hidden]) ~ :not([hidden]) {
-    --tw-space-x-reverse: 0;
-    margin-right: calc(0.75rem * var(--tw-space-x-reverse));
-    margin-left: calc(0.75rem * calc(1 - var(--tw-space-x-reverse)))
+  --tw-space-x-reverse: 0;
+  margin-right: calc(0.75rem * var(--tw-space-x-reverse));
+  margin-left: calc(0.75rem * calc(1 - var(--tw-space-x-reverse)));
 }
 .space-y-2 > :not([hidden]) ~ :not([hidden]) {
-    --tw-space-y-reverse: 0;
-    margin-top: calc(0.5rem * calc(1 - var(--tw-space-y-reverse)));
-    margin-bottom: calc(0.5rem * var(--tw-space-y-reverse))
+  --tw-space-y-reverse: 0;
+  margin-top: calc(0.5rem * calc(1 - var(--tw-space-y-reverse)));
+  margin-bottom: calc(0.5rem * var(--tw-space-y-reverse));
 }
 .space-y-3 > :not([hidden]) ~ :not([hidden]) {
-    --tw-space-y-reverse: 0;
-    margin-top: calc(0.75rem * calc(1 - var(--tw-space-y-reverse)));
-    margin-bottom: calc(0.75rem * var(--tw-space-y-reverse))
+  --tw-space-y-reverse: 0;
+  margin-top: calc(0.75rem * calc(1 - var(--tw-space-y-reverse)));
+  margin-bottom: calc(0.75rem * var(--tw-space-y-reverse));
 }
 .space-y-4 > :not([hidden]) ~ :not([hidden]) {
-    --tw-space-y-reverse: 0;
-    margin-top: calc(1rem * calc(1 - var(--tw-space-y-reverse)));
-    margin-bottom: calc(1rem * var(--tw-space-y-reverse))
+  --tw-space-y-reverse: 0;
+  margin-top: calc(1rem * calc(1 - var(--tw-space-y-reverse)));
+  margin-bottom: calc(1rem * var(--tw-space-y-reverse));
 }
 .overflow-hidden {
-    overflow: hidden
+  overflow: hidden;
 }
 .overflow-y-auto {
-    overflow-y: auto
+  overflow-y: auto;
 }
 .rounded {
-    border-radius: 0.25rem
+  border-radius: 0.25rem;
 }
 .rounded-md {
-    border-radius: 0.375rem
+  border-radius: 0.375rem;
 }
 .border {
-    border-width: 1px
+  border-width: 1px;
 }
 .border-b {
-    border-bottom-width: 1px
+  border-bottom-width: 1px;
 }
 .border-l {
-    border-left-width: 1px
+  border-left-width: 1px;
 }
 .border-r {
-    border-right-width: 1px
+  border-right-width: 1px;
 }
 .border-none {
-    border-style: none
+  border-style: none;
 }
 .bg-blue-600 {
-    --tw-bg-opacity: 1;
-    background-color: rgb(37 99 235 / var(--tw-bg-opacity, 1))
+  --tw-bg-opacity: 1;
+  background-color: rgb(37 99 235 / var(--tw-bg-opacity, 1));
 }
 .bg-gray-100 {
-    --tw-bg-opacity: 1;
-    background-color: rgb(243 244 246 / var(--tw-bg-opacity, 1))
+  --tw-bg-opacity: 1;
+  background-color: rgb(243 244 246 / var(--tw-bg-opacity, 1));
 }
 .bg-gray-50 {
-    --tw-bg-opacity: 1;
-    background-color: rgb(249 250 251 / var(--tw-bg-opacity, 1))
+  --tw-bg-opacity: 1;
+  background-color: rgb(249 250 251 / var(--tw-bg-opacity, 1));
 }
 .bg-green-600 {
-    --tw-bg-opacity: 1;
-    background-color: rgb(22 163 74 / var(--tw-bg-opacity, 1))
+  --tw-bg-opacity: 1;
+  background-color: rgb(22 163 74 / var(--tw-bg-opacity, 1));
 }
 .bg-white {
-    --tw-bg-opacity: 1;
-    background-color: rgb(255 255 255 / var(--tw-bg-opacity, 1))
+  --tw-bg-opacity: 1;
+  background-color: rgb(255 255 255 / var(--tw-bg-opacity, 1));
 }
 .p-2 {
-    padding: 0.5rem
+  padding: 0.5rem;
 }
 .p-4 {
-    padding: 1rem
+  padding: 1rem;
 }
 .px-2 {
-    padding-left: 0.5rem;
-    padding-right: 0.5rem
+  padding-left: 0.5rem;
+  padding-right: 0.5rem;
 }
 .px-4 {
-    padding-left: 1rem;
-    padding-right: 1rem
+  padding-left: 1rem;
+  padding-right: 1rem;
 }
 .py-1 {
-    padding-top: 0.25rem;
-    padding-bottom: 0.25rem
+  padding-top: 0.25rem;
+  padding-bottom: 0.25rem;
 }
 .py-2 {
-    padding-top: 0.5rem;
-    padding-bottom: 0.5rem
+  padding-top: 0.5rem;
+  padding-bottom: 0.5rem;
 }
 .pl-5 {
-    padding-left: 1.25rem
+  padding-left: 1.25rem;
 }
 .text-left {
-    text-align: left
+  text-align: left;
 }
 .text-center {
-    text-align: center
+  text-align: center;
 }
 .text-lg {
-    font-size: 1.125rem;
-    line-height: 1.75rem
+  font-size: 1.125rem;
+  line-height: 1.75rem;
 }
 .text-sm {
-    font-size: 0.875rem;
-    line-height: 1.25rem
+  font-size: 0.875rem;
+  line-height: 1.25rem;
 }
 .text-xl {
-    font-size: 1.25rem;
-    line-height: 1.75rem
+  font-size: 1.25rem;
+  line-height: 1.75rem;
 }
 .text-xs {
-    font-size: 0.75rem;
-    line-height: 1rem
+  font-size: 0.75rem;
+  line-height: 1rem;
 }
 .font-medium {
-    font-weight: 500
+  font-weight: 500;
 }
 .font-semibold {
-    font-weight: 600
+  font-weight: 600;
 }
 .leading-none {
-    line-height: 1
+  line-height: 1;
 }
 .text-blue-600 {
-    --tw-text-opacity: 1;
-    color: rgb(37 99 235 / var(--tw-text-opacity, 1))
+  --tw-text-opacity: 1;
+  color: rgb(37 99 235 / var(--tw-text-opacity, 1));
 }
 .text-gray-500 {
-    --tw-text-opacity: 1;
-    color: rgb(107 114 128 / var(--tw-text-opacity, 1))
+  --tw-text-opacity: 1;
+  color: rgb(107 114 128 / var(--tw-text-opacity, 1));
 }
 .text-gray-600 {
-    --tw-text-opacity: 1;
-    color: rgb(75 85 99 / var(--tw-text-opacity, 1))
+  --tw-text-opacity: 1;
+  color: rgb(75 85 99 / var(--tw-text-opacity, 1));
 }
 .text-red-500 {
-    --tw-text-opacity: 1;
-    color: rgb(239 68 68 / var(--tw-text-opacity, 1))
+  --tw-text-opacity: 1;
+  color: rgb(239 68 68 / var(--tw-text-opacity, 1));
 }
 .text-red-600 {
-    --tw-text-opacity: 1;
-    color: rgb(220 38 38 / var(--tw-text-opacity, 1))
+  --tw-text-opacity: 1;
+  color: rgb(220 38 38 / var(--tw-text-opacity, 1));
 }
 .text-white {
-    --tw-text-opacity: 1;
-    color: rgb(255 255 255 / var(--tw-text-opacity, 1))
+  --tw-text-opacity: 1;
+  color: rgb(255 255 255 / var(--tw-text-opacity, 1));
 }
 .underline {
-    text-decoration-line: underline
+  text-decoration-line: underline;
 }
 .shadow {
-    --tw-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
-    --tw-shadow-colored: 0 1px 3px 0 var(--tw-shadow-color), 0 1px 2px -1px var(--tw-shadow-color);
-    box-shadow: var(--tw-ring-offset-shadow, 0 0 #0000), var(--tw-ring-shadow, 0 0 #0000), var(--tw-shadow)
+  --tw-shadow: 0 1px 3px 0 rgb(0 0 0 / 0.1), 0 1px 2px -1px rgb(0 0 0 / 0.1);
+  --tw-shadow-colored:
+    0 1px 3px 0 var(--tw-shadow-color), 0 1px 2px -1px var(--tw-shadow-color);
+  box-shadow:
+    var(--tw-ring-offset-shadow, 0 0 #0000), var(--tw-ring-shadow, 0 0 #0000),
+    var(--tw-shadow);
 }
 .shadow-sm {
-    --tw-shadow: 0 1px 2px 0 rgb(0 0 0 / 0.05);
-    --tw-shadow-colored: 0 1px 2px 0 var(--tw-shadow-color);
-    box-shadow: var(--tw-ring-offset-shadow, 0 0 #0000), var(--tw-ring-shadow, 0 0 #0000), var(--tw-shadow)
+  --tw-shadow: 0 1px 2px 0 rgb(0 0 0 / 0.05);
+  --tw-shadow-colored: 0 1px 2px 0 var(--tw-shadow-color);
+  box-shadow:
+    var(--tw-ring-offset-shadow, 0 0 #0000), var(--tw-ring-shadow, 0 0 #0000),
+    var(--tw-shadow);
 }
 .grayscale {
-    --tw-grayscale: grayscale(100%);
-    filter: var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow)
+  --tw-grayscale: grayscale(100%);
+  filter: var(--tw-blur) var(--tw-brightness) var(--tw-contrast)
+    var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate)
+    var(--tw-sepia) var(--tw-drop-shadow);
 }
 .filter {
-    filter: var(--tw-blur) var(--tw-brightness) var(--tw-contrast) var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate) var(--tw-sepia) var(--tw-drop-shadow)
+  filter: var(--tw-blur) var(--tw-brightness) var(--tw-contrast)
+    var(--tw-grayscale) var(--tw-hue-rotate) var(--tw-invert) var(--tw-saturate)
+    var(--tw-sepia) var(--tw-drop-shadow);
 }
 .hover\:bg-blue-700:hover {
-    --tw-bg-opacity: 1;
-    background-color: rgb(29 78 216 / var(--tw-bg-opacity, 1))
+  --tw-bg-opacity: 1;
+  background-color: rgb(29 78 216 / var(--tw-bg-opacity, 1));
 }
 .hover\:bg-gray-200:hover {
-    --tw-bg-opacity: 1;
-    background-color: rgb(229 231 235 / var(--tw-bg-opacity, 1))
+  --tw-bg-opacity: 1;
+  background-color: rgb(229 231 235 / var(--tw-bg-opacity, 1));
 }
 .hover\:bg-green-700:hover {
-    --tw-bg-opacity: 1;
-    background-color: rgb(21 128 61 / var(--tw-bg-opacity, 1))
+  --tw-bg-opacity: 1;
+  background-color: rgb(21 128 61 / var(--tw-bg-opacity, 1));
 }
 .hover\:underline:hover {
-    text-decoration-line: underline
+  text-decoration-line: underline;
 }
diff --git a/frontend/editor/src/portal/components/AppShell.css b/frontend/editor/src/portal/components/AppShell.css
index a01026480a..6535832399 100644
--- a/frontend/editor/src/portal/components/AppShell.css
+++ b/frontend/editor/src/portal/components/AppShell.css
@@ -10,8 +10,8 @@
   height: 100vh;
   height: 100dvh; /* mobile browser chrome shrinks the viewport; dvh tracks it */
   overflow: hidden;
-  background: var(--color-bg);
-  color: var(--color-text-2);
+  background: var(--c-bg);
+  color: var(--c-text-muted);
 }
 
 .portal-shell__main {
@@ -55,7 +55,7 @@
   position: fixed;
   inset: 0;
   z-index: 75;
-  background: rgba(15, 23, 42, 0.55);
+  background: var(--c-overlay);
 }
 
 @media (max-width: 48rem) {
diff --git a/frontend/editor/src/portal/components/AssistantButton.css b/frontend/editor/src/portal/components/AssistantButton.css
index 107ff7c1ac..6ae6e34e46 100644
--- a/frontend/editor/src/portal/components/AssistantButton.css
+++ b/frontend/editor/src/portal/components/AssistantButton.css
@@ -8,14 +8,14 @@
   display: inline-flex;
   align-items: center;
   justify-content: center;
-  color: #fff;
+  color: var(--c-text-on-primary);
   background: linear-gradient(
     135deg,
-    var(--color-blue) 0%,
+    var(--c-primary) 0%,
     var(--color-purple) 100%
   );
   box-shadow:
-    0 0.5rem 1.25rem rgba(59, 130, 246, 0.35),
+    0 0.5rem 1.25rem color-mix(in srgb, var(--c-primary) 35%, transparent),
     inset 0 0.0625rem 0 rgba(255, 255, 255, 0.2);
   transition:
     transform var(--motion-base),
@@ -26,7 +26,7 @@
 .portal-assistant-btn:hover {
   transform: scale(1.08);
   box-shadow:
-    0 0.75rem 1.75rem rgba(59, 130, 246, 0.45),
+    0 0.75rem 1.75rem color-mix(in srgb, var(--c-primary) 45%, transparent),
     inset 0 0.0625rem 0 rgba(255, 255, 255, 0.25);
 }
 
diff --git a/frontend/editor/src/portal/components/AssistantPanel.css b/frontend/editor/src/portal/components/AssistantPanel.css
index 90a66f169d..2e5edc907f 100644
--- a/frontend/editor/src/portal/components/AssistantPanel.css
+++ b/frontend/editor/src/portal/components/AssistantPanel.css
@@ -6,8 +6,8 @@
   width: min(23.75rem, calc(100vw - 2rem));
   height: 32.5rem;
   max-height: calc(100dvh - 7rem);
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-xl);
   box-shadow: var(--shadow-lg);
   display: flex;
@@ -26,7 +26,7 @@
   color: var(--color-text-on-accent);
   background: linear-gradient(
     135deg,
-    var(--color-blue) 0%,
+    var(--c-primary) 0%,
     var(--color-purple) 100%
   );
 }
@@ -91,17 +91,17 @@
   padding: 0.4375rem 0.625rem;
   font-size: 0.8125rem;
   text-align: left;
-  color: var(--color-text-2);
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  color: var(--c-text-muted);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
   transition:
     border-color var(--motion-fast),
     background var(--motion-fast);
 }
 .portal-assistant__suggestion:hover {
-  background: var(--color-bg-hover);
-  border-color: var(--color-blue-border);
+  background: var(--c-hover);
+  border-color: var(--c-primary-border);
 }
 
 .portal-assistant__bubble {
@@ -116,16 +116,16 @@
 
 .portal-assistant__bubble--user {
   align-self: flex-end;
-  background: var(--color-blue);
+  background: var(--c-primary);
   color: var(--color-text-on-accent);
   border-bottom-right-radius: 0.25rem;
 }
 
 .portal-assistant__bubble--assistant {
   align-self: flex-start;
-  background: var(--color-surface);
-  color: var(--color-text-2);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  color: var(--c-text-muted);
+  border: 1px solid var(--c-border);
   border-bottom-left-radius: 0.25rem;
 }
 
@@ -138,7 +138,7 @@
   width: 0.375rem;
   height: 0.375rem;
   border-radius: 50%;
-  background: var(--color-text-5);
+  background: var(--c-text-subtle);
   animation: pulse 1.2s ease-in-out infinite;
 }
 .portal-assistant__typing span:nth-child(2) {
@@ -153,8 +153,8 @@
   align-items: center;
   gap: 0.5rem;
   padding: 0.625rem 0.75rem;
-  border-top: 1px solid var(--color-border);
-  background: var(--color-surface);
+  border-top: 1px solid var(--c-border);
+  background: var(--c-surface);
 }
 
 .portal-assistant__input {
@@ -162,15 +162,15 @@
   font: inherit;
   font-size: 0.8125rem;
   background: transparent;
-  border: 1px solid var(--color-border-input);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
   padding: 0.4375rem 0.625rem;
-  color: var(--color-text-1);
+  color: var(--c-text);
   outline: none;
   transition: border-color var(--motion-fast);
 }
 .portal-assistant__input:focus {
-  border-color: var(--color-blue);
+  border-color: var(--c-primary);
 }
 
 .portal-assistant__send {
diff --git a/frontend/editor/src/portal/components/AssistantPanel.stories.tsx b/frontend/editor/src/portal/components/AssistantPanel.stories.tsx
index 92fe3e0bdf..911f389566 100644
--- a/frontend/editor/src/portal/components/AssistantPanel.stories.tsx
+++ b/frontend/editor/src/portal/components/AssistantPanel.stories.tsx
@@ -18,7 +18,7 @@ const meta: Meta<typeof AssistantPanel> = {
   parameters: { layout: "fullscreen" },
   decorators: [
     (S) => (
-      <div style={{ minHeight: "100vh", background: "var(--color-bg)" }}>
+      <div style={{ minHeight: "100vh", background: "var(--c-bg)" }}>
         <ForceOpen />
         <S />
       </div>
diff --git a/frontend/editor/src/portal/components/AuthGate.tsx b/frontend/editor/src/portal/components/AuthGate.tsx
index a7f4e58ef5..0af62ee53b 100644
--- a/frontend/editor/src/portal/components/AuthGate.tsx
+++ b/frontend/editor/src/portal/components/AuthGate.tsx
@@ -19,7 +19,7 @@ function FullScreenMessage({ children }: { children: ReactNode }) {
         alignItems: "center",
         justifyContent: "center",
         gap: "0.75rem",
-        color: "var(--color-text-3)",
+        color: "var(--c-text-subtle)",
       }}
     >
       {children}
diff --git a/frontend/editor/src/portal/components/ChatFABWidget.stories.tsx b/frontend/editor/src/portal/components/ChatFABWidget.stories.tsx
index b6124bbd25..af7d67eea7 100644
--- a/frontend/editor/src/portal/components/ChatFABWidget.stories.tsx
+++ b/frontend/editor/src/portal/components/ChatFABWidget.stories.tsx
@@ -55,7 +55,7 @@ function MockChatContent({
           alignItems: "center",
           justifyContent: "space-between",
           padding: "14px 16px 10px",
-          borderBottom: "1px solid var(--color-border, #e3e8ee)",
+          borderBottom: "1px solid var(--c-border, #e3e8ee)",
           flexShrink: 0,
         }}
       >
@@ -65,7 +65,7 @@ function MockChatContent({
           shape="circle"
           onClick={onClose}
           aria-label="Close chat"
-          style={{ color: "var(--color-text-4, #64748b)" }}
+          style={{ color: "var(--c-text-subtle, #64748b)" }}
         >
           ✕
         </Button>
@@ -91,7 +91,7 @@ function MockChatContent({
               background:
                 m.role === "user"
                   ? "#3b82f6"
-                  : "var(--color-bg-muted, #f3f4f6)",
+                  : "var(--c-surface-sunken, #f3f4f6)",
               color: m.role === "user" ? "#fff" : "inherit",
               borderRadius: 10,
               padding: "8px 12px",
@@ -108,17 +108,17 @@ function MockChatContent({
       <div
         style={{
           padding: "10px 12px 14px",
-          borderTop: "1px solid var(--color-border, #e3e8ee)",
+          borderTop: "1px solid var(--c-border, #e3e8ee)",
           flexShrink: 0,
         }}
       >
         <div
           style={{
-            background: "var(--color-bg-muted, #f3f4f6)",
+            background: "var(--c-surface-sunken, #f3f4f6)",
             borderRadius: 10,
             padding: "8px 12px",
             fontSize: 13,
-            color: "var(--color-text-4, #64748b)",
+            color: "var(--c-text-subtle, #64748b)",
           }}
         >
           What do you want to do?
@@ -149,7 +149,7 @@ function ChatFABWidgetDemo({
         width: "100%",
         height: "100%",
         overflow: "hidden",
-        background: "var(--color-bg, #f8f9fb)",
+        background: "var(--c-bg, #f8f9fb)",
       }}
     >
       {/* FAB button */}
@@ -249,7 +249,7 @@ function ChatFABFullFlowDemo() {
               padding: "4px 10px",
               borderRadius: 6,
               background:
-                step === s ? "#3b82f6" : "var(--color-bg-muted, #f3f4f6)",
+                step === s ? "#3b82f6" : "var(--c-surface-sunken, #f3f4f6)",
               color: step === s ? "#fff" : "inherit",
               fontWeight: step === s ? 600 : 400,
             }}
diff --git a/frontend/editor/src/portal/components/DownloadEditorModal.css b/frontend/editor/src/portal/components/DownloadEditorModal.css
index fba739501f..4742833be8 100644
--- a/frontend/editor/src/portal/components/DownloadEditorModal.css
+++ b/frontend/editor/src/portal/components/DownloadEditorModal.css
@@ -14,7 +14,7 @@
   font-weight: 700;
   letter-spacing: 0.06em;
   text-transform: uppercase;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 .portal-install__section:first-child {
   margin-top: 0;
@@ -27,9 +27,9 @@
   gap: 0.875rem;
   width: 100%;
   padding: 0.75rem 0.875rem;
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
-  background: var(--color-surface);
+  background: var(--c-surface);
   text-align: left;
   cursor: pointer;
   transition:
@@ -37,8 +37,8 @@
     background var(--motion-fast);
 }
 .portal-install__option:hover {
-  border-color: var(--color-border-input);
-  background: var(--color-bg-hover);
+  border-color: var(--c-border);
+  background: var(--c-hover);
 }
 
 .portal-install__option-icon {
@@ -48,8 +48,8 @@
   height: 2.25rem;
   flex-shrink: 0;
   border-radius: 0.625rem;
-  color: var(--color-blue);
-  background: var(--color-blue-light);
+  color: var(--c-primary);
+  background: var(--c-primary-tint);
 }
 
 .portal-install__option-text {
@@ -60,14 +60,14 @@
 .portal-install__option-text strong {
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-install__option-text span {
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 .portal-install__option-chevron {
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   flex-shrink: 0;
 }
 
@@ -88,13 +88,13 @@
   font-weight: 700;
   letter-spacing: 0.06em;
   text-transform: uppercase;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 .portal-install__note {
   margin: 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 .portal-install__guide {
   align-self: flex-start;
@@ -106,7 +106,7 @@
   background: none;
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-blue);
+  color: var(--c-primary);
   cursor: pointer;
 }
 .portal-install__guide:hover {
diff --git a/frontend/editor/src/portal/components/EditorStatusCard.css b/frontend/editor/src/portal/components/EditorStatusCard.css
index 10d8a020b4..e71a50bac3 100644
--- a/frontend/editor/src/portal/components/EditorStatusCard.css
+++ b/frontend/editor/src/portal/components/EditorStatusCard.css
@@ -4,8 +4,8 @@
 
 .portal-editor-hero {
   border-radius: var(--radius-xl);
-  border: 1px solid var(--color-border-input);
-  background: var(--color-surface);
+  border: 1px solid var(--c-border);
+  background: var(--c-surface);
   box-shadow: var(--shadow-sm);
   overflow: hidden;
 }
@@ -15,7 +15,7 @@
   align-items: center;
   gap: 1.25rem;
   padding: 1rem 1.25rem;
-  background: color-mix(in srgb, var(--c-primary) 22%, var(--p-zinc-950));
+  background: color-mix(in srgb, var(--c-primary) 22%, var(--c-hero-dark));
 }
 
 .portal-editor-hero__logo {
@@ -123,7 +123,7 @@
 .portal-editor-hero__action .portal-editor-hero__cta.sui-btn {
   background: #ffffff;
   border-color: #ffffff;
-  color: var(--color-hero-navy);
+  color: var(--c-hero-dark-cta-text);
 }
 .portal-editor-hero__action .portal-editor-hero__cta.sui-btn:hover {
   background: rgba(255, 255, 255, 0.88);
@@ -141,5 +141,5 @@
 
 /* Attached footer strip (setup checklist). */
 .portal-editor-hero__footer {
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
diff --git a/frontend/editor/src/portal/components/EditorStatusCard.tsx b/frontend/editor/src/portal/components/EditorStatusCard.tsx
index 8d3b7dcbcf..1734d677c3 100644
--- a/frontend/editor/src/portal/components/EditorStatusCard.tsx
+++ b/frontend/editor/src/portal/components/EditorStatusCard.tsx
@@ -28,7 +28,7 @@ function StirlingMark() {
       fill="none"
       aria-hidden
     >
-      <rect width="256" height="256" rx="58" fill="#8E3131" />
+      <rect width="256" height="256" rx="58" fill="var(--c-brand-mark)" />
       <path
         d="M39.2638 127.834L155.374 32L155.375 121.499L39.2638 217.333L39.2638 127.834Z"
         fill="white"
diff --git a/frontend/editor/src/portal/components/NotificationsDropdown.css b/frontend/editor/src/portal/components/NotificationsDropdown.css
index 09bd19326d..ba14ec9c60 100644
--- a/frontend/editor/src/portal/components/NotificationsDropdown.css
+++ b/frontend/editor/src/portal/components/NotificationsDropdown.css
@@ -8,8 +8,8 @@
   right: 0;
   /* Clamp to the viewport so a right-anchored panel fits small phones */
   width: min(22.5rem, calc(100vw - 1rem));
-  background: var(--color-notif-bg, var(--color-surface));
-  border: 1px solid var(--color-border);
+  background: var(--color-notif-bg, var(--c-surface));
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
   box-shadow: var(--shadow-lg);
   overflow: hidden;
@@ -22,21 +22,21 @@
   align-items: center;
   justify-content: space-between;
   padding: 0.625rem 0.875rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
   font-size: 0.8125rem;
 }
 
 .portal-notif__title {
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-notif__count {
   font-size: 0.6875rem;
   font-weight: 500;
-  color: var(--color-blue);
+  color: var(--c-primary);
   padding: 0.125rem 0.375rem;
-  background: var(--color-blue-light);
+  background: var(--c-primary-tint);
   border-radius: var(--radius-pill);
 }
 
@@ -53,7 +53,7 @@
   align-items: flex-start;
   gap: 0.625rem;
   padding: 0.625rem 0.875rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
   cursor: pointer;
   transition: background var(--motion-fast);
 }
@@ -63,7 +63,7 @@
 }
 
 .portal-notif__item:hover {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 .portal-notif__dot {
@@ -82,20 +82,20 @@
 .portal-notif__item-title {
   font-size: 0.8125rem;
   font-weight: 500;
-  color: var(--color-text-1);
+  color: var(--c-text);
   margin-bottom: 0.125rem;
 }
 
 .portal-notif__desc {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   line-height: 1.4;
   margin-bottom: 0.25rem;
 }
 
 .portal-notif__time {
   font-size: 0.6875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-notif__footer {
@@ -103,21 +103,21 @@
   align-items: center;
   justify-content: space-between;
   padding: 0.5rem 0.625rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
   background: var(--color-bg-subtle);
 }
 
 .portal-notif__action {
   font-size: 0.75rem;
   font-weight: 500;
-  color: var(--color-blue);
+  color: var(--c-primary);
   padding: 0.25rem 0.5rem;
   border-radius: var(--radius-sm);
   transition: background var(--motion-fast);
 }
 
 .portal-notif__action:hover:not(:disabled) {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 .portal-notif__action:disabled {
@@ -126,13 +126,13 @@
 }
 
 .portal-notif__count--quiet {
-  background: var(--color-bg-muted);
-  color: var(--color-text-5);
+  background: var(--c-surface-sunken);
+  color: var(--c-text-subtle);
 }
 
 .portal-notif__empty {
   padding: 1.5rem 1rem;
   text-align: center;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/portal/components/ProcessorFlow.css b/frontend/editor/src/portal/components/ProcessorFlow.css
index 7e020d0253..16acbf91af 100644
--- a/frontend/editor/src/portal/components/ProcessorFlow.css
+++ b/frontend/editor/src/portal/components/ProcessorFlow.css
@@ -33,7 +33,7 @@
   width: 0.5rem;
   height: 0.5rem;
   border-radius: 50%;
-  background: var(--color-border);
+  background: var(--c-border);
 }
 
 .portal-pf__live--on {
@@ -46,12 +46,12 @@
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-pf__connected {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
@@ -83,7 +83,7 @@
 
 .portal-pf__wire-path {
   fill: none;
-  stroke: var(--color-border-light);
+  stroke: var(--c-border-subtle);
   stroke-width: 1.25;
 }
 
@@ -112,7 +112,7 @@
   font-weight: 600;
   letter-spacing: 0.04em;
   text-transform: uppercase;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   margin-bottom: 0.125rem;
 }
 
@@ -121,8 +121,8 @@
   height: auto;
   width: 100%;
   text-align: left;
-  background: var(--color-bg);
-  border: 1px solid var(--color-border-light);
+  background: var(--c-bg);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
   transition:
     background var(--motion-fast),
@@ -136,12 +136,12 @@
 }
 
 .portal-pf__node:hover {
-  background: var(--color-bg-hover);
-  border-color: var(--color-border);
+  background: var(--c-hover);
+  border-color: var(--c-border);
 }
 
 .portal-pf__node:focus-visible {
-  outline: 2px solid var(--color-blue);
+  outline: 2px solid var(--c-primary);
   outline-offset: 2px;
 }
 
@@ -160,12 +160,12 @@
   height: 1.75rem;
   border-radius: var(--radius-md);
   font-size: 0.9375rem;
-  background: var(--color-bg-muted);
-  color: var(--color-text-3);
+  background: var(--c-surface-sunken);
+  color: var(--c-text-subtle);
 }
 
 .portal-pf__node--soon .portal-pf__node-icon {
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   font-weight: 600;
 }
 
@@ -188,7 +188,7 @@
 .portal-pf__node-text strong {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
@@ -196,7 +196,7 @@
 
 .portal-pf__node-text span {
   font-size: 0.6875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* ── Policies card (core) ───────────────────────────────────────────────────── */
@@ -205,8 +205,8 @@
   flex: none;
   width: 18rem;
   padding: 0.75rem;
-  background: var(--color-bg);
-  border: 1px solid var(--color-border-light);
+  background: var(--c-bg);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-lg);
   box-shadow: var(--shadow-sm);
 }
@@ -229,7 +229,7 @@
 }
 
 .portal-pf__policy + .portal-pf__policy {
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 
 .portal-pf__policy-line {
@@ -247,7 +247,7 @@
   height: 1.5rem;
   border-radius: 6px;
   font-size: 0.875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   transition:
     color 0.3s ease,
     background-color 0.3s ease,
@@ -259,7 +259,7 @@
 }
 
 .portal-pf__policy--locked .portal-pf__policy-icon {
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 /* Leading-LED blink: added for 150ms as a particle threads this row's lane,
@@ -275,22 +275,22 @@
   flex: 1 1 auto;
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   min-width: 0;
 }
 
 .portal-pf__policy--active .portal-pf__policy-label {
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-pf__policy--locked .portal-pf__policy-label {
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-weight: 500;
 }
 
 .portal-pf__policy-count {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-variant-numeric: tabular-nums;
   white-space: nowrap;
 }
@@ -299,7 +299,7 @@
   flex: none;
   font-size: 0.6875rem;
   font-weight: 600;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   text-transform: uppercase;
   letter-spacing: 0.04em;
 }
@@ -314,7 +314,7 @@
 .portal-pf__foot {
   margin: 0.875rem 0 0;
   font-size: 0.6875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-pf__loading {
@@ -337,7 +337,7 @@
 .portal-pf__sankey-label {
   font-size: 12px;
   font-weight: 600;
-  fill: var(--color-text-2);
+  fill: var(--c-text-muted);
   font-variant-numeric: tabular-nums;
 }
 
@@ -346,7 +346,7 @@
   font-weight: 600;
   letter-spacing: 0.05em;
   text-transform: uppercase;
-  fill: var(--color-text-5);
+  fill: var(--c-text-subtle);
 }
 
 .portal-pf__sankey-empty {
diff --git a/frontend/editor/src/portal/components/SearchModal.css b/frontend/editor/src/portal/components/SearchModal.css
index 6b139c975d..501cfd140a 100644
--- a/frontend/editor/src/portal/components/SearchModal.css
+++ b/frontend/editor/src/portal/components/SearchModal.css
@@ -3,8 +3,8 @@
   align-items: center;
   gap: 0.625rem;
   padding: 0.25rem 0.25rem 0.75rem;
-  border-bottom: 1px solid var(--color-border-light);
-  color: var(--color-text-4);
+  border-bottom: 1px solid var(--c-border-subtle);
+  color: var(--c-text-subtle);
 }
 
 .portal-search__input {
@@ -14,7 +14,7 @@
   background: transparent;
   border: none;
   outline: none;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-search__input::placeholder {
@@ -26,8 +26,8 @@
   font-size: 0.6875rem;
   padding: 0.0625rem 0.375rem;
   border-radius: var(--radius-xs);
-  background: var(--color-bg-muted);
-  color: var(--color-text-4);
+  background: var(--c-surface-sunken);
+  color: var(--c-text-subtle);
 }
 
 .portal-search__results {
@@ -54,17 +54,17 @@
   justify-content: space-between;
   padding: 0.5rem 0.625rem;
   border-radius: var(--radius-sm);
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   font-size: 0.8125rem;
   text-align: left;
 }
 
 .portal-search__item:hover {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 .portal-search__item-hint {
   font-family: var(--font-mono);
   font-size: 0.6875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/portal/components/SearchModal.stories.tsx b/frontend/editor/src/portal/components/SearchModal.stories.tsx
index 16de3449e6..892c99c3ae 100644
--- a/frontend/editor/src/portal/components/SearchModal.stories.tsx
+++ b/frontend/editor/src/portal/components/SearchModal.stories.tsx
@@ -18,7 +18,7 @@ const meta: Meta<typeof SearchModal> = {
   parameters: { layout: "fullscreen" },
   decorators: [
     (S) => (
-      <div style={{ minHeight: "100vh", background: "var(--color-bg)" }}>
+      <div style={{ minHeight: "100vh", background: "var(--c-bg)" }}>
         <ForceOpen />
         <S />
       </div>
diff --git a/frontend/editor/src/portal/components/SetupChecklist.css b/frontend/editor/src/portal/components/SetupChecklist.css
index a19919e640..0fcb71e678 100644
--- a/frontend/editor/src/portal/components/SetupChecklist.css
+++ b/frontend/editor/src/portal/components/SetupChecklist.css
@@ -21,7 +21,7 @@
   width: 100%;
   padding: 0.6875rem 1.25rem;
   border: none;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
   background: transparent;
   text-align: left;
   cursor: pointer;
@@ -31,7 +31,7 @@
   border-top: none;
 }
 .portal-setup__row:hover {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 /* Numbered step marker */
@@ -42,10 +42,10 @@
   height: 1.5rem;
   flex-shrink: 0;
   border-radius: 50%;
-  border: 1px solid var(--color-border-input);
+  border: 1px solid var(--c-border);
   font-size: 0.75rem;
   font-weight: 600;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 /* Completed step: filled green check. */
 .portal-setup__num.is-done {
@@ -54,7 +54,7 @@
   color: #fff;
 }
 .portal-setup__row.is-done .portal-setup__text strong {
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-setup__text {
@@ -65,12 +65,12 @@
 .portal-setup__text strong {
   font-size: 0.875rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-setup__text span {
   font-size: 0.75rem;
   line-height: 1.4;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* ── Enterprise upsell rung ── */
@@ -81,10 +81,10 @@
   gap: 1rem;
   flex-wrap: wrap;
   padding: 0.75rem 1.25rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
   background: linear-gradient(
     90deg,
-    color-mix(in srgb, var(--color-blue) 5%, transparent) 0%,
+    color-mix(in srgb, var(--c-primary) 5%, transparent) 0%,
     transparent 55%
   );
 }
@@ -105,18 +105,18 @@
   font-weight: 700;
   letter-spacing: 0.06em;
   text-transform: uppercase;
-  color: var(--color-blue-dark);
-  background: var(--color-blue-light);
+  color: var(--c-primary-hover);
+  background: var(--c-primary-tint);
 }
 
 .portal-setup__enterprise-text {
   margin: 0;
   font-size: 0.8125rem;
   line-height: 1.45;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   min-width: 0;
 }
 .portal-setup__enterprise-text strong {
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-weight: 700;
 }
diff --git a/frontend/editor/src/portal/components/SetupChecklist.stories.tsx b/frontend/editor/src/portal/components/SetupChecklist.stories.tsx
index 78af75d188..432be155d7 100644
--- a/frontend/editor/src/portal/components/SetupChecklist.stories.tsx
+++ b/frontend/editor/src/portal/components/SetupChecklist.stories.tsx
@@ -23,10 +23,10 @@ const meta: Meta<typeof SetupChecklist> = {
       <div
         style={{
           maxWidth: "60rem",
-          border: "1px solid var(--color-border)",
+          border: "1px solid var(--c-border)",
           borderRadius: "var(--radius-xl)",
           overflow: "hidden",
-          background: "var(--color-surface)",
+          background: "var(--c-surface)",
         }}
       >
         <S />
diff --git a/frontend/editor/src/portal/components/Sidebar.css b/frontend/editor/src/portal/components/Sidebar.css
index 1e0096fc4e..c9dfa871ee 100644
--- a/frontend/editor/src/portal/components/Sidebar.css
+++ b/frontend/editor/src/portal/components/Sidebar.css
@@ -2,8 +2,8 @@
   width: 15rem;
   height: 100vh;
   height: 100dvh; /* track mobile browser chrome */
-  background: var(--color-sidebar-bg);
-  border-right: 1px solid var(--color-sidebar-border);
+  background: var(--c-bg-raised);
+  border-right: 1px solid var(--c-border);
   display: flex;
   flex-direction: column;
   flex-shrink: 0;
@@ -41,7 +41,7 @@
   .portal-sidebar--open {
     transform: translateX(0);
     visibility: visible;
-    box-shadow: 0 0.5rem 2rem rgba(15, 23, 42, 0.35);
+    box-shadow: 0 0.5rem 2rem rgba(0, 0, 0, 0.35);
   }
   .portal-sidebar__close {
     display: inline-flex;
@@ -55,7 +55,7 @@
   display: flex;
   align-items: center;
   gap: 0.5rem;
-  border-bottom: 1px solid var(--color-sidebar-divider);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 /* Stirling Processor wordmark (theme-switched in Sidebar.tsx); matches the
@@ -67,6 +67,19 @@
   flex-shrink: 0;
 }
 
+/* Show the wordmark that matches the rendered scheme (black text on light,
+   white text on dark). Keyed on data-mantine-color-scheme so it follows the
+   actual theme, not the portal's separate (and sometimes stale) theme state. */
+.portal-sidebar__wordmark--dark {
+  display: none;
+}
+[data-mantine-color-scheme="dark"] .portal-sidebar__wordmark--light {
+  display: none;
+}
+[data-mantine-color-scheme="dark"] .portal-sidebar__wordmark--dark {
+  display: block;
+}
+
 /* App switcher (down-arrow → Portal / Editor); button and menu styling live
    with the shared AppSwitch element. */
 .portal-sidebar__app-switch {
@@ -86,8 +99,8 @@
 
 /* Each section is a labelled card: a small header above its nav items. */
 .portal-sidebar__section {
-  background: var(--color-surface);
-  border: 1px solid var(--color-sidebar-divider);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.625rem;
   padding: 0.5rem 0.375rem 0.375rem;
   display: flex;
@@ -101,7 +114,7 @@
   font-size: 0.6875rem;
   font-weight: 600;
   letter-spacing: 0.02em;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-sidebar__group {
@@ -112,7 +125,7 @@
 
 /* Footer */
 .portal-sidebar__footer {
-  border-top: 1px solid var(--color-sidebar-divider);
+  border-top: 1px solid var(--c-border-subtle);
   padding: 0.5rem 0.625rem 0.75rem;
   display: flex;
   flex-direction: column;
diff --git a/frontend/editor/src/portal/components/Sidebar.stories.tsx b/frontend/editor/src/portal/components/Sidebar.stories.tsx
index df4d6c1cdb..d40d710adb 100644
--- a/frontend/editor/src/portal/components/Sidebar.stories.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.stories.tsx
@@ -11,7 +11,7 @@ const meta: Meta<typeof Sidebar> = {
         style={{
           display: "flex",
           height: "100vh",
-          background: "var(--color-bg)",
+          background: "var(--c-bg)",
         }}
       >
         <S />
diff --git a/frontend/editor/src/portal/components/Sidebar.tsx b/frontend/editor/src/portal/components/Sidebar.tsx
index 4eec4dcc06..b4f5300d16 100644
--- a/frontend/editor/src/portal/components/Sidebar.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.tsx
@@ -80,9 +80,17 @@ export function Sidebar() {
       inert={isMobile && !mobileNavOpen}
     >
       <div className="portal-sidebar__logo">
+        {/* Both wordmarks render; CSS shows the right one per the actual color
+            scheme (data-mantine-color-scheme), so it tracks the rendered theme
+            rather than the portal's separate theme state. */}
         <img
-          className="portal-sidebar__wordmark"
-          src={theme === "dark" ? wordmarkDark : wordmarkLight}
+          className="portal-sidebar__wordmark portal-sidebar__wordmark--light"
+          src={wordmarkLight}
+          alt={t("portal.shell.sidebar.brandSuffix")}
+        />
+        <img
+          className="portal-sidebar__wordmark portal-sidebar__wordmark--dark"
+          src={wordmarkDark}
           alt={t("portal.shell.sidebar.brandSuffix")}
         />
 
diff --git a/frontend/editor/src/portal/components/WelcomeBanner.css b/frontend/editor/src/portal/components/WelcomeBanner.css
index 457291eadb..157ee24ac0 100644
--- a/frontend/editor/src/portal/components/WelcomeBanner.css
+++ b/frontend/editor/src/portal/components/WelcomeBanner.css
@@ -4,10 +4,10 @@
 
 .portal-welcome {
   border-radius: var(--radius-xl);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   overflow: hidden;
   isolation: isolate;
-  background: var(--color-surface);
+  background: var(--c-surface);
 }
 
 /* ── Dark product header strip ── */
@@ -18,7 +18,7 @@
   gap: 1rem;
   flex-wrap: wrap;
   padding: 0.875rem 1.25rem;
-  background: color-mix(in srgb, var(--c-primary) 22%, var(--p-zinc-950));
+  background: color-mix(in srgb, var(--c-primary) 22%, var(--c-hero-dark));
 }
 
 .portal-welcome__brand {
@@ -90,7 +90,7 @@
 .portal-welcome__header .portal-welcome__cta.sui-btn {
   background: #ffffff;
   border-color: #ffffff;
-  color: var(--color-hero-navy);
+  color: var(--c-hero-dark-cta-text);
 }
 .portal-welcome__header .portal-welcome__cta.sui-btn:hover {
   background: rgba(255, 255, 255, 0.88);
@@ -99,5 +99,5 @@
 
 /* ── Steps + enterprise (setup checklist) sit directly under the header ── */
 .portal-welcome__footer {
-  background: var(--color-surface);
+  background: var(--c-surface);
 }
diff --git a/frontend/editor/src/portal/components/billing/billing.css b/frontend/editor/src/portal/components/billing/billing.css
index 423e917c94..3ab25438db 100644
--- a/frontend/editor/src/portal/components/billing/billing.css
+++ b/frontend/editor/src/portal/components/billing/billing.css
@@ -28,7 +28,7 @@
 .portal-billing__spend-foot {
   margin-top: auto;
   padding-top: 1rem;
-  border-top: 1px solid var(--color-border);
+  border-top: 1px solid var(--c-border);
 }
 .portal-billing__spend-foot:not(:first-child) {
   margin-top: 1.25rem;
@@ -42,25 +42,25 @@
   padding: 0.3rem 0.7rem;
   font-size: 0.8125rem;
   font-weight: 500;
-  color: var(--color-blue);
+  color: var(--c-primary);
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border);
+  border: 1px solid var(--c-border);
   border-radius: 999px;
   cursor: pointer;
 }
 .portal-billing__suggested:hover {
-  border-color: var(--color-blue);
+  border-color: var(--c-primary);
 }
 .portal-billing__guardrail {
   margin-top: 0.85rem;
   padding: 0.7rem 0.85rem;
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   background: var(--color-bg-subtle);
   border-radius: 0.6rem;
 }
 .portal-billing__guardrail strong {
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-billing__edit-actions {
   display: flex;
@@ -99,20 +99,20 @@
   font-weight: 600;
   text-transform: uppercase;
   letter-spacing: 0.06em;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   margin-bottom: 0.25rem;
 }
 
 .portal-billing__section-title {
   font-size: 1.05rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   margin: 0 0 0.25rem;
 }
 
 .portal-billing__section-sub {
   font-size: 0.875rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   margin: 0 0 1rem;
 }
 
@@ -153,20 +153,20 @@
 .portal-billing__checkout-status-title {
   font-size: 1.125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   margin: 0.25rem 0 0;
 }
 
 .portal-billing__checkout-status-body {
   font-size: 0.9375rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   margin: 0;
   max-width: 32rem;
 }
 
 .portal-billing__checkout-status-hint {
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   margin: 0;
 }
 
@@ -188,7 +188,7 @@
   font-size: 1.25rem;
   font-weight: 600;
   margin: 0;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-billing__meter-figures {
@@ -206,21 +206,21 @@
 .portal-billing__meter-num {
   font-size: 1.75rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-billing__meter-num--muted {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-billing__meter-label {
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-billing__meter-track {
   height: 0.5rem;
-  background: var(--color-bg-subtle, #e5e7eb);
+  background: var(--color-bg-subtle, var(--c-surface-sunken));
   border-radius: 999px;
   overflow: hidden;
   margin-bottom: 0.75rem;
@@ -228,14 +228,14 @@
 
 .portal-billing__meter-fill {
   height: 100%;
-  background: linear-gradient(90deg, var(--color-blue), var(--color-purple));
+  background: linear-gradient(90deg, var(--c-primary), var(--color-purple));
   border-radius: 999px;
   transition: width 200ms ease;
 }
 
 .portal-billing__meter-foot {
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   margin: 0.75rem 0 0;
 }
 
@@ -265,12 +265,12 @@
   font-weight: 750;
   line-height: 1;
   letter-spacing: -0.02em;
-  color: var(--color-text-1, #0f172a);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 .paygf-meter__cap {
   font-size: 0.85rem;
-  color: var(--color-text-3, #64748b);
+  color: var(--c-text-subtle);
   font-variant-numeric: tabular-nums;
 }
 .paygf-meter .payg-bar {
@@ -283,7 +283,7 @@
   align-items: center;
   gap: 6px 10px;
   font-size: 0.78rem;
-  color: var(--color-text-2, #475569);
+  color: var(--c-text-muted);
 }
 
 /* Status chip (Healthy / Approaching / Cap reached). Solid hex colours
@@ -333,7 +333,7 @@
   margin-top: 18px;
   height: 10px;
   border-radius: 999px;
-  background: var(--color-bg-subtle, #e5e7eb);
+  background: var(--color-bg-subtle, var(--c-surface-sunken));
   overflow: hidden;
   position: relative;
 }
@@ -343,7 +343,7 @@
   transition: width 0.5s cubic-bezier(0.16, 1, 0.3, 1);
 }
 .payg-bar__fill[data-state="FULL"] {
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 .payg-bar__fill[data-state="WARNED"] {
   background: var(--color-amber);
@@ -363,12 +363,12 @@
   font-size: 1.25rem;
   font-weight: 600;
   margin: 0;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-billing__plan-sub {
   font-size: 0.9375rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   margin: 0 0 0.5rem;
 }
 
@@ -383,7 +383,7 @@
 
 .portal-billing__plan-features li {
   font-size: 0.875rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   padding-left: 1.25rem;
   position: relative;
 }
@@ -405,12 +405,12 @@
 
 .portal-billing__plan-reassure {
   font-size: 0.75rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-billing__plan-readonly {
   font-size: 0.875rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   font-style: italic;
   margin: 0;
 }
@@ -432,16 +432,16 @@
   display: flex;
   justify-content: space-between;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-billing__breakdown-value {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-billing__breakdown-track {
   height: 0.5rem;
-  background: var(--color-bg-subtle, #e5e7eb);
+  background: var(--color-bg-subtle, var(--c-surface-sunken));
   border-radius: 999px;
   overflow: hidden;
 }
@@ -453,7 +453,7 @@
 }
 
 .portal-billing__breakdown-fill--blue {
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 
 .portal-billing__breakdown-fill--purple {
@@ -478,13 +478,13 @@
   flex-direction: column;
   gap: 0.25rem;
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-billing__cap-input {
   width: 8rem;
   padding: 0.5rem 0.75rem;
-  border: 1px solid var(--color-border, #d1d5db);
+  border: 1px solid var(--c-border);
   border-radius: 0.375rem;
   font-size: 0.9375rem;
   font-family: inherit;
@@ -495,7 +495,7 @@
   align-items: center;
   gap: 0.375rem;
   font-size: 0.875rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   cursor: pointer;
 }
 
@@ -512,12 +512,12 @@
 
 .portal-billing__member-name {
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-billing__member-email {
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-billing__invoice-num {
@@ -526,7 +526,7 @@
 }
 
 .portal-billing__invoice-desc {
-  color: var(--color-text-1, #0f172a);
+  color: var(--c-text);
   font-size: 0.9375rem;
 }
 
@@ -566,26 +566,26 @@
    Same class names + structure so the visual is identical to the SaaS Plan
    page; when the shared-component move lands, these dedupe to one stylesheet. */
 .scc {
-  --scc-accent: var(--color-blue);
-  --scc-accent-text: var(--color-blue);
-  --scc-accent-soft: color-mix(in srgb, var(--color-blue) 12%, transparent);
-  --scc-accent-border: color-mix(in srgb, var(--color-blue) 25%, transparent);
-  --scc-chip-bg: var(--color-bg-muted, #f8fafc);
-  --scc-chip-border: var(--color-border, #e2e8f0);
-  --scc-text-primary: var(--color-text-1, #0f172a);
-  --scc-text-secondary: var(--color-text-2, #475569);
-  --scc-text-muted: var(--color-text-3, #64748b);
-  --scc-border-strong: var(--color-text-4, #94a3b8);
+  --scc-accent: var(--c-primary);
+  --scc-accent-text: var(--c-primary);
+  --scc-accent-soft: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  --scc-accent-border: color-mix(in srgb, var(--c-primary) 25%, transparent);
+  --scc-chip-bg: var(--c-surface-sunken);
+  --scc-chip-border: var(--c-border);
+  --scc-text-primary: var(--c-text);
+  --scc-text-secondary: var(--c-text-muted);
+  --scc-text-muted: var(--c-text-subtle);
+  --scc-border-strong: var(--c-text-subtle);
   display: flex;
   flex-direction: column;
   gap: 14px;
   margin-top: 0.75rem;
 }
 [data-theme="dark"] .scc {
-  --scc-accent-text: var(--color-blue);
-  --scc-accent-soft: color-mix(in srgb, var(--color-blue) 16%, transparent);
-  --scc-chip-bg: var(--color-bg-muted);
-  --scc-chip-border: var(--color-border);
+  --scc-accent-text: var(--c-primary);
+  --scc-accent-soft: color-mix(in srgb, var(--c-primary) 16%, transparent);
+  --scc-chip-bg: var(--c-surface-sunken);
+  --scc-chip-border: var(--c-border);
 }
 
 .scc-row {
@@ -719,7 +719,7 @@
 }
 .portal-billing__planhead-eyebrow {
   font-size: 0.78rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 .portal-billing__role-pill {
   display: inline-flex;
@@ -732,14 +732,14 @@
   white-space: nowrap;
 }
 .portal-billing__role-pill[data-leader="true"] {
-  background: color-mix(in srgb, var(--color-blue) 12%, transparent);
-  color: var(--color-blue);
-  border: 1px solid color-mix(in srgb, var(--color-blue) 25%, transparent);
+  background: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  color: var(--c-primary);
+  border: 1px solid color-mix(in srgb, var(--c-primary) 25%, transparent);
 }
 .portal-billing__role-pill[data-leader="false"] {
-  background: var(--color-bg-muted);
-  color: var(--color-text-3);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface-sunken);
+  color: var(--c-text-subtle);
+  border: 1px solid var(--c-border);
 }
 .portal-billing__planhead-split {
   display: grid;
@@ -751,7 +751,7 @@
 .portal-billing__planhead-col--meter {
   padding-right: 0;
   padding-left: 22px;
-  border-left: 1px solid var(--color-border);
+  border-left: 1px solid var(--c-border);
 }
 .portal-billing__planhead-lbl {
   display: inline-flex;
@@ -767,27 +767,27 @@
   color: var(--color-green);
 }
 .portal-billing__planhead-lbl--meter {
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 .portal-billing__planhead-title {
   margin: 0;
   font-size: 1.05rem;
   font-weight: 700;
-  color: var(--color-text-1);
+  color: var(--c-text);
   letter-spacing: -0.01em;
   line-height: 1.25;
 }
 .portal-billing__planhead-body {
   margin: 5px 0 0;
   font-size: 0.85rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   line-height: 1.5;
 }
 /* The period meter merged into the plan-head card, divided from the split. */
 .portal-billing__planhead-meter {
   margin-top: 18px;
   padding-top: 18px;
-  border-top: 1px solid var(--color-border);
+  border-top: 1px solid var(--c-border);
 }
 @media (max-width: 640px) {
   .portal-billing__planhead-split {
@@ -801,7 +801,7 @@
     padding-left: 0;
     padding-top: 16px;
     border-left: none;
-    border-top: 1px solid var(--color-border);
+    border-top: 1px solid var(--c-border);
   }
 }
 
@@ -820,7 +820,7 @@
   border-radius: 0.375rem;
   font-size: 0.8125rem;
   font-weight: 500;
-  color: var(--color-text-1, #0f172a);
+  color: var(--c-text);
   text-decoration: none;
   border: 1px solid transparent;
   transition:
@@ -829,14 +829,14 @@
 }
 
 .portal-billing__invoice-link:hover {
-  background: var(--color-bg-muted, #f1f5f9);
-  border-color: var(--color-border, #e2e8f0);
+  background: var(--c-surface-sunken);
+  border-color: var(--c-border);
 }
 
 .portal-billing__invoice-link:focus-visible {
   outline: none;
-  border-color: var(--color-blue);
-  background: var(--color-bg-muted, #f1f5f9);
+  border-color: var(--c-primary);
+  background: var(--c-surface-sunken);
 }
 
 .portal-billing__invoice-footer {
@@ -861,7 +861,7 @@
   margin: 0;
   font-size: 1.5rem;
   font-weight: 700;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 /* ── Free PDF Editors (fleet) card ───────────────────────────────────── */
@@ -880,8 +880,8 @@
   line-height: 0;
   border-radius: 0.65rem;
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border);
-  color: var(--color-blue);
+  border: 1px solid var(--c-border);
+  color: var(--c-primary);
 }
 /* Identity, stats, and the "Invite teammates" action all sit on one line; the
    metric cells render flat (no per-stat box) and are divided by hairlines, so
@@ -902,7 +902,7 @@
   background: transparent;
   border: 0;
   box-shadow: none;
-  border-left: 1px solid var(--color-border);
+  border-left: 1px solid var(--c-border);
   padding: 0 0 0 1.5rem;
   min-width: 0;
   gap: 0.3rem;
@@ -931,7 +931,7 @@
   border-radius: 0;
   font-size: 0.85rem;
   font-weight: 400;
-  color: var(--color-text-3, #64748b);
+  color: var(--c-text-subtle);
 }
 .portal-billing__trial-meter .payg-status__dot,
 .portal-billing__spend-meter .payg-status__dot {
@@ -972,25 +972,25 @@
   font-weight: 750;
   line-height: 1;
   letter-spacing: -0.02em;
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 .portal-billing__bignum-unit {
   font-size: 0.85rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 .portal-billing__segbar {
   display: flex;
   height: 0.55rem;
   border-radius: 999px;
   overflow: hidden;
-  background: var(--color-bg-muted, #f1f5f9);
+  background: var(--c-surface-sunken);
 }
 .portal-billing__segbar-seg {
   height: 100%;
 }
 .portal-billing__segbar-seg--blue {
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 .portal-billing__segbar-seg--purple {
   background: var(--color-purple);
@@ -1018,7 +1018,7 @@
   flex-shrink: 0;
 }
 .portal-billing__dot--blue {
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 .portal-billing__dot--purple {
   background: var(--color-purple);
@@ -1028,24 +1028,24 @@
 }
 .portal-billing__seglegend-label {
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-billing__seglegend-val {
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   font-variant-numeric: tabular-nums;
 }
 .portal-billing__seglegend-desc {
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* ── Spend-limit projection line ─────────────────────────────────────── */
 .portal-billing__projection {
   margin: 0.85rem 0 0;
   font-size: 0.85rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 .portal-billing__projection strong {
-  color: var(--color-amber, #d97706);
+  color: var(--color-amber, var(--c-warning));
 }
 
 /* ── Checkout modal: 2-step (spend limit → payment) ──────────────────── */
@@ -1070,15 +1070,15 @@
   height: 4px;
   flex: 1;
   border-radius: var(--radius-pill);
-  background: var(--color-border);
+  background: var(--c-border);
 }
 .portal-billing__checkout-steps span.is-done {
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 .portal-billing__checkout-stepcount {
   font-size: 0.75rem;
   font-weight: 600;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   white-space: nowrap;
 }
 
@@ -1086,7 +1086,7 @@
   margin: 0;
   font-size: 0.75rem;
   line-height: 1.55;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 .portal-billing__checkout-cap-actions {
   display: flex;
@@ -1101,9 +1101,9 @@
   flex-direction: column;
   gap: 0.5rem;
   padding: 1rem;
-  border: 1px solid var(--color-border-input);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
-  background: var(--color-surface);
+  background: var(--c-surface);
 }
 .portal-billing__card-placeholder-head {
   display: flex;
@@ -1111,14 +1111,14 @@
   justify-content: space-between;
   font-size: 0.75rem;
   font-weight: 600;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .portal-billing__card-placeholder-badge {
   font-size: 0.625rem;
   font-weight: 700;
   text-transform: uppercase;
   letter-spacing: 0.06em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   background: var(--color-bg-code);
   padding: 0.125rem 0.375rem;
   border-radius: var(--radius-sm);
@@ -1129,15 +1129,15 @@
   gap: 0.625rem;
   padding: 0.75rem 0.875rem;
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-sm);
   font-family: var(--font-mono);
   font-size: 0.8125rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 .portal-billing__card-placeholder-note {
   margin: 0;
   font-size: 0.6875rem;
   line-height: 1.5;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.css b/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.css
index 02f7bfdbf5..13c1f4812f 100644
--- a/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.css
+++ b/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.css
@@ -8,11 +8,11 @@
   display: flex;
   gap: var(--space-3);
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .classification-summary-note {
   font-size: 0.75rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 /* Expandable category → labels list. */
@@ -24,10 +24,10 @@
   flex-direction: column;
 }
 .classification-category {
-  border-top: 1px solid var(--border-default);
+  border-top: 1px solid var(--c-border);
 }
 .classification-category:last-child {
-  border-bottom: 1px solid var(--border-default);
+  border-bottom: 1px solid var(--c-border);
 }
 .classification-category-header {
   min-height: 2.5rem;
@@ -43,7 +43,7 @@
 }
 .classification-category-count {
   font-size: 0.75rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 .classification-category-labels {
   display: flex;
diff --git a/frontend/editor/src/portal/components/policies/PolicyCategoryIcon.css b/frontend/editor/src/portal/components/policies/PolicyCategoryIcon.css
index 96113b7aa1..ee0b6dde44 100644
--- a/frontend/editor/src/portal/components/policies/PolicyCategoryIcon.css
+++ b/frontend/editor/src/portal/components/policies/PolicyCategoryIcon.css
@@ -8,8 +8,8 @@
   height: 2rem;
   flex-shrink: 0;
   border-radius: var(--radius-lg);
-  background: var(--color-bg-muted);
-  color: var(--color-text-3);
+  background: var(--c-surface-sunken);
+  color: var(--c-text-subtle);
   /* The shared MUI outline glyph inherits its size from here. */
   font-size: 1.15rem;
 }
diff --git a/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx b/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx
index 43170a21a4..962cef995a 100644
--- a/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx
+++ b/frontend/editor/src/portal/components/processor-flow/FlowSankey.tsx
@@ -67,8 +67,8 @@ export function FlowSankey({ sources, outcomes, policies }: FlowSankeyProps) {
   const y0R = padY + (H - (midH + (outcomes.length - 1) * gap)) / 2;
 
   const outFill = (key: FlowOutcomeKey) => OUTCOME_FILL[key];
-  const srcFill = "var(--color-blue)";
-  const waistFill = "var(--color-text-4)";
+  const srcFill = "var(--c-primary)";
+  const waistFill = "var(--c-text-subtle)";
 
   const ribbon = (
     x0: number,
diff --git a/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts b/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts
index 7efbee40e2..65fc6cc9ad 100644
--- a/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts
+++ b/frontend/editor/src/portal/components/processor-flow/useFlowParticles.ts
@@ -140,7 +140,7 @@ export function useFlowParticles({
             ) as SVGCircleElement;
             c.setAttribute("r", "2.5");
             c.setAttribute("opacity", "0.75");
-            c.style.fill = "var(--color-blue)";
+            c.style.fill = "var(--c-primary)";
             pg.appendChild(c);
             particles.push({
               el: c,
@@ -219,7 +219,7 @@ export function useFlowParticles({
               p.phase = 2;
               p.t = 0;
               p.el.style.fill =
-                OUTCOME_FILL[outcomeKeys[p.out]] ?? "var(--color-blue)";
+                OUTCOME_FILL[outcomeKeys[p.out]] ?? "var(--c-primary)";
               p.el.setAttribute("r", "2.5");
               p.el.setAttribute("opacity", "0.75");
             }
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx b/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx
index 6c57c501c7..7fb8b865f2 100644
--- a/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx
+++ b/frontend/editor/src/portal/components/procurement/ProcurementModal.stories.tsx
@@ -26,7 +26,7 @@ export const Open: Story = {
     children: (
       <Card padding="loose">
         <h3 style={{ margin: 0 }}>Ready for payment</h3>
-        <p style={{ color: "var(--color-text-3)" }}>
+        <p style={{ color: "var(--c-text-subtle)" }}>
           Your quote is accepted. Continue to checkout to pay your committed
           contract and go live.
         </p>
diff --git a/frontend/editor/src/portal/contexts/TierContext.tsx b/frontend/editor/src/portal/contexts/TierContext.tsx
index 152e1f7a0b..411a3f75ba 100644
--- a/frontend/editor/src/portal/contexts/TierContext.tsx
+++ b/frontend/editor/src/portal/contexts/TierContext.tsx
@@ -18,8 +18,8 @@ export interface TierInfo {
 export const TIER_INFO: Record<Tier, TierInfo> = {
   // Matches SaaS branding (editor/cloud Payg + PaygFree): the always-free
   // manual-tools tier is "Editor plan"; the metered tier is "Processor plan".
-  free: { labelKey: "portal.tier.free", dotColor: "var(--color-text-4)" },
-  pro: { labelKey: "portal.tier.pro", dotColor: "var(--color-blue)" },
+  free: { labelKey: "portal.tier.free", dotColor: "var(--c-text-subtle)" },
+  pro: { labelKey: "portal.tier.pro", dotColor: "var(--c-primary)" },
   enterprise: {
     labelKey: "portal.tier.enterprise",
     dotColor: "var(--color-purple)",
diff --git a/frontend/editor/src/portal/data/Endpoints.stories.tsx b/frontend/editor/src/portal/data/Endpoints.stories.tsx
index f702b5dea4..5f3a561766 100644
--- a/frontend/editor/src/portal/data/Endpoints.stories.tsx
+++ b/frontend/editor/src/portal/data/Endpoints.stories.tsx
@@ -21,7 +21,7 @@ type Story = StoryObj;
 export const ByVertical: Story = {
   render: () => (
     <div style={{ display: "flex", flexDirection: "column", gap: 22 }}>
-      <div style={{ fontSize: 12, color: "var(--color-text-4)" }}>
+      <div style={{ fontSize: 12, color: "var(--c-text-subtle)" }}>
         {ALL_ENDPOINTS.length} endpoints across {VERTICALS.length} verticals
       </div>
       {VERTICALS.map((v) => (
@@ -42,12 +42,10 @@ export const ByVertical: Story = {
                 background: v.color,
               }}
             />
-            <h3
-              style={{ margin: 0, fontSize: 14, color: "var(--color-text-1)" }}
-            >
+            <h3 style={{ margin: 0, fontSize: 14, color: "var(--c-text)" }}>
               {v.label}
             </h3>
-            <span style={{ fontSize: 12, color: "var(--color-text-5)" }}>
+            <span style={{ fontSize: 12, color: "var(--c-text-subtle)" }}>
               {v.endpoints.length} endpoints
             </span>
           </div>
@@ -61,8 +59,8 @@ export const ByVertical: Story = {
                   gap: 12,
                   alignItems: "center",
                   padding: "0.625rem 0.875rem",
-                  background: "var(--color-surface)",
-                  border: "1px solid var(--color-border)",
+                  background: "var(--c-surface)",
+                  border: "1px solid var(--c-border)",
                   borderRadius: "var(--radius-md)",
                 }}
               >
@@ -71,7 +69,7 @@ export const ByVertical: Story = {
                   style={{
                     fontFamily: "var(--font-mono)",
                     fontSize: 12,
-                    color: "var(--color-text-2)",
+                    color: "var(--c-text-muted)",
                   }}
                 >
                   {e.endpoint}
@@ -81,7 +79,7 @@ export const ByVertical: Story = {
                     style={{
                       fontSize: 13,
                       fontWeight: 500,
-                      color: "var(--color-text-1)",
+                      color: "var(--c-text)",
                     }}
                   >
                     {e.name}
@@ -89,7 +87,7 @@ export const ByVertical: Story = {
                   <div
                     style={{
                       fontSize: 12,
-                      color: "var(--color-text-4)",
+                      color: "var(--c-text-subtle)",
                       overflow: "hidden",
                       textOverflow: "ellipsis",
                       whiteSpace: "nowrap",
diff --git a/frontend/editor/src/portal/data/Ops.stories.tsx b/frontend/editor/src/portal/data/Ops.stories.tsx
index f86c18f645..bcaa524095 100644
--- a/frontend/editor/src/portal/data/Ops.stories.tsx
+++ b/frontend/editor/src/portal/data/Ops.stories.tsx
@@ -26,7 +26,7 @@ const STAGE_ORDER: OpKind[] = [
 ];
 const STAGE_COLOUR: Record<OpKind, string> = {
   ingest: "var(--color-green)",
-  validate: "var(--color-blue)",
+  validate: "var(--c-primary)",
   modify: "#F97316",
   secure: "var(--color-red)",
   store: "var(--color-purple)",
@@ -60,12 +60,12 @@ export const PipelineOps: Story = {
                 fontSize: 13,
                 textTransform: "uppercase",
                 letterSpacing: 0.6,
-                color: "var(--color-text-3)",
+                color: "var(--c-text-subtle)",
               }}
             >
               {stage}
             </h3>
-            <span style={{ fontSize: 12, color: "var(--color-text-5)" }}>
+            <span style={{ fontSize: 12, color: "var(--c-text-subtle)" }}>
               {PIPELINE_OPS[stage].length} ops
             </span>
           </div>
@@ -109,7 +109,7 @@ export const PipelineOps: Story = {
 export const LibraryByCategory: Story = {
   render: () => (
     <div style={{ display: "flex", flexDirection: "column", gap: 22 }}>
-      <div style={{ fontSize: 12, color: "var(--color-text-4)" }}>
+      <div style={{ fontSize: 12, color: "var(--c-text-subtle)" }}>
         {LIBRARY_OPS.length} library ops across {OP_CATEGORIES.length}{" "}
         categories
       </div>
@@ -137,18 +137,18 @@ export const LibraryByCategory: Story = {
                 style={{
                   margin: 0,
                   fontSize: 13,
-                  color: "var(--color-text-1)",
+                  color: "var(--c-text)",
                 }}
               >
                 {cat.name}
               </h3>
-              <span style={{ fontSize: 12, color: "var(--color-text-5)" }}>
+              <span style={{ fontSize: 12, color: "var(--c-text-subtle)" }}>
                 {cat.blurb}
               </span>
               <span
                 style={{
                   fontSize: 12,
-                  color: "var(--color-text-5)",
+                  color: "var(--c-text-subtle)",
                   marginLeft: "auto",
                 }}
               >
@@ -207,8 +207,8 @@ export const Agents: Story = {
           key={a.id}
           style={{
             padding: 14,
-            background: "var(--color-surface)",
-            border: "1px solid var(--color-border)",
+            background: "var(--c-surface)",
+            border: "1px solid var(--c-border)",
             borderRadius: 8,
           }}
         >
@@ -220,14 +220,14 @@ export const Agents: Story = {
               marginBottom: 4,
             }}
           >
-            <strong style={{ fontSize: 13, color: "var(--color-text-1)" }}>
+            <strong style={{ fontSize: 13, color: "var(--c-text)" }}>
               {a.label}
             </strong>
           </div>
           <div
             style={{
               fontSize: 12,
-              color: "var(--color-text-4)",
+              color: "var(--c-text-subtle)",
               marginBottom: 8,
             }}
           >
@@ -241,8 +241,8 @@ export const Agents: Story = {
                   fontSize: 11,
                   padding: "0.125rem 0.375rem",
                   borderRadius: 4,
-                  background: "var(--color-bg-muted)",
-                  color: "var(--color-text-3)",
+                  background: "var(--c-surface-sunken)",
+                  color: "var(--c-text-subtle)",
                   fontFamily: "var(--font-mono)",
                 }}
               >
@@ -267,13 +267,13 @@ export const SourcesAndDestinations: Story = {
               key={s.id}
               style={{
                 padding: "0.625rem 0.75rem",
-                border: "1px solid var(--color-border)",
+                border: "1px solid var(--c-border)",
                 borderRadius: 6,
-                background: "var(--color-surface)",
+                background: "var(--c-surface)",
               }}
             >
               <div style={{ fontSize: 13, fontWeight: 500 }}>{s.label}</div>
-              <div style={{ fontSize: 12, color: "var(--color-text-4)" }}>
+              <div style={{ fontSize: 12, color: "var(--c-text-subtle)" }}>
                 {s.desc}
               </div>
             </div>
@@ -288,13 +288,13 @@ export const SourcesAndDestinations: Story = {
               key={d.id}
               style={{
                 padding: "0.625rem 0.75rem",
-                border: "1px solid var(--color-border)",
+                border: "1px solid var(--c-border)",
                 borderRadius: 6,
-                background: "var(--color-surface)",
+                background: "var(--c-surface)",
               }}
             >
               <div style={{ fontSize: 13, fontWeight: 500 }}>{d.label}</div>
-              <div style={{ fontSize: 12, color: "var(--color-text-4)" }}>
+              <div style={{ fontSize: 12, color: "var(--c-text-subtle)" }}>
                 {d.desc}
               </div>
             </div>
diff --git a/frontend/editor/src/portal/data/ops.ts b/frontend/editor/src/portal/data/ops.ts
index e5803971ad..f650a13fad 100644
--- a/frontend/editor/src/portal/data/ops.ts
+++ b/frontend/editor/src/portal/data/ops.ts
@@ -425,7 +425,7 @@ export const OP_CATEGORIES: readonly OpCategoryMeta[] = [
   },
   {
     name: "Validation",
-    color: "var(--color-blue)",
+    color: "var(--c-primary)",
     blurb: "Schema checks, trust gates, filters",
   },
   {
@@ -470,7 +470,7 @@ export const OP_CATEGORIES: readonly OpCategoryMeta[] = [
   },
   {
     name: "Developer Tools",
-    color: "var(--color-text-5)",
+    color: "var(--c-text-subtle)",
     blurb: "Repair, compress, metadata",
   },
 ];
diff --git a/frontend/editor/src/portal/theme/base.css b/frontend/editor/src/portal/theme/base.css
index b9fa93d9e6..5326abaffc 100644
--- a/frontend/editor/src/portal/theme/base.css
+++ b/frontend/editor/src/portal/theme/base.css
@@ -9,7 +9,7 @@
    :where, `.portal-scope button` would outweigh `.sui-btn` and strip its fill. */
 
 .portal-scope {
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   font-family: var(--font-sans);
   -webkit-font-smoothing: antialiased;
   -moz-osx-font-smoothing: grayscale;
@@ -31,7 +31,7 @@
 }
 
 :where(.portal-scope) a {
-  color: var(--color-blue);
+  color: var(--c-primary);
   text-decoration: none;
 }
 
diff --git a/frontend/editor/src/portal/theme/mantineTheme.ts b/frontend/editor/src/portal/theme/mantineTheme.ts
index 01953245f9..d78f31ed69 100644
--- a/frontend/editor/src/portal/theme/mantineTheme.ts
+++ b/frontend/editor/src/portal/theme/mantineTheme.ts
@@ -84,25 +84,25 @@ const purple = tuple(
  */
 export const suiCssVariablesResolver: CSSVariablesResolver = () => ({
   variables: {
-    "--mantine-color-text": "var(--color-text-1)",
+    "--mantine-color-text": "var(--c-text)",
     "--mantine-color-placeholder": "var(--color-text-placeholder)",
-    "--mantine-color-body": "var(--color-bg)",
+    "--mantine-color-body": "var(--c-bg)",
   },
   light: {
     // Popover/dropdown background + combobox search input
-    "--mantine-color-white": "var(--color-surface)",
+    "--mantine-color-white": "var(--c-surface)",
     // Option hover background
-    "--mantine-color-gray-0": "var(--color-bg-hover)",
+    "--mantine-color-gray-0": "var(--c-hover)",
     // Dropdown border
-    "--mantine-color-gray-2": "var(--color-border)",
+    "--mantine-color-gray-2": "var(--c-border)",
   },
   dark: {
     // Popover/dropdown background (dark-6 is the floating surface in dark mode)
-    "--mantine-color-dark-6": "var(--color-surface)",
+    "--mantine-color-dark-6": "var(--c-surface)",
     // Deeper background used for option hover + combobox search input
-    "--mantine-color-dark-7": "var(--color-bg)",
+    "--mantine-color-dark-7": "var(--c-bg)",
     // Border in dark mode
-    "--mantine-color-dark-4": "var(--color-border)",
+    "--mantine-color-dark-4": "var(--c-border)",
   },
 });
 
diff --git a/frontend/editor/src/portal/views/AccountLink.css b/frontend/editor/src/portal/views/AccountLink.css
index 07b49a03f1..34afe4d7af 100644
--- a/frontend/editor/src/portal/views/AccountLink.css
+++ b/frontend/editor/src/portal/views/AccountLink.css
@@ -19,13 +19,13 @@
   margin: 0;
   font-size: 1.375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-link__page-sub {
   margin: 0.25rem 0 0;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   max-width: 44rem;
 }
 
@@ -49,14 +49,14 @@
   font-weight: 600;
   text-transform: uppercase;
   letter-spacing: 0.04em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-link__title {
   margin: 0.125rem 0 0;
   font-size: 1.125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-link__form,
@@ -85,13 +85,13 @@
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-link__section-sub {
   margin: 0.25rem 0 0;
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   max-width: 44rem;
 }
 
@@ -110,16 +110,16 @@
 
 .portal-link__cell-strong {
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-link__device-id {
   font-size: 0.6875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   font-variant-numeric: tabular-nums;
 }
 
 .portal-link__muted {
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-size: 0.8125rem;
 }
diff --git a/frontend/editor/src/portal/views/DeveloperDocs.css b/frontend/editor/src/portal/views/DeveloperDocs.css
index 1786940dd5..d986c1448a 100644
--- a/frontend/editor/src/portal/views/DeveloperDocs.css
+++ b/frontend/editor/src/portal/views/DeveloperDocs.css
@@ -35,7 +35,7 @@
   min-height: 0;
   height: 100%;
   overflow-y: auto;
-  border-right: 1px solid var(--color-border-light);
+  border-right: 1px solid var(--c-border-subtle);
   padding: 1.25rem 0;
 }
 
@@ -61,7 +61,7 @@
   top: 50%;
   transform: translateY(-50%);
   font-size: 0.9375rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   pointer-events: none;
 }
 
@@ -69,20 +69,20 @@
   width: 100%;
   padding: 0.4rem 0.6rem 0.4rem 1.9rem;
   font-size: 0.8125rem;
-  color: var(--color-text-1);
+  color: var(--c-text);
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
   outline: none;
 }
 
 .portal-docs__search-input:focus {
-  border-color: var(--color-blue);
+  border-color: var(--c-primary);
 }
 
 .portal-docs__nav-empty {
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   padding: 0.5rem 0.75rem;
   margin: 0;
 }
@@ -96,7 +96,7 @@
 .portal-docs__results-count {
   font-size: 0.6875rem;
   font-weight: 500;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   padding: 0 0.75rem 0.5rem;
 }
 
@@ -110,7 +110,7 @@
 
 /* Hairline divider between results for clear, calm separation. */
 .portal-docs__results-list li + li {
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 
 .portal-docs__result {
@@ -121,7 +121,7 @@
 
 .portal-docs__result:hover,
 .portal-docs__result.is-active {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 .portal-docs__result-body {
@@ -145,7 +145,7 @@
 .portal-docs__result-title {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   line-height: 1.3;
   min-width: 0;
   overflow: hidden;
@@ -156,13 +156,13 @@
 .portal-docs__result-section {
   flex-shrink: 0;
   font-size: 0.6875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-docs__result-snippet {
   font-size: 0.75rem;
   line-height: 1.4;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   display: -webkit-box;
   -webkit-line-clamp: 1;
   -webkit-box-orient: vertical;
@@ -171,7 +171,7 @@
 
 /* Subtle match emphasis — coloured text, not a filled block. */
 .portal-docs__hl {
-  color: var(--color-blue);
+  color: var(--c-primary);
   font-weight: 600;
   background: none;
 }
@@ -190,13 +190,13 @@
   font-weight: 700;
   letter-spacing: 0.06em;
   text-transform: uppercase;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Collapsible section header (Overview stays a static label). */
 .portal-docs__nav-head--button:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-2);
+  background: var(--c-hover);
+  color: var(--c-text-muted);
 }
 
 .portal-docs__nav-head-main {
@@ -214,7 +214,7 @@
 
 .portal-docs__nav-chevron {
   font-size: 0.625rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   transition: transform var(--motion-fast);
 }
 
@@ -225,7 +225,7 @@
 .portal-docs__nav-count {
   font-size: 0.625rem;
   font-weight: 600;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   background: var(--color-bg-subtle);
   border-radius: var(--radius-pill);
   padding: 0.05rem 0.4rem;
@@ -240,7 +240,7 @@
 .portal-docs__nav-children {
   margin: 0.125rem 0 0.25rem 0.85rem;
   padding-left: 0.4rem;
-  border-left: 1px solid var(--color-border-light);
+  border-left: 1px solid var(--c-border-subtle);
   display: flex;
   flex-direction: column;
   gap: 0.0625rem;
@@ -266,7 +266,7 @@
   background: transparent;
   border-radius: 0;
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   cursor: pointer;
   text-align: left;
   transition:
@@ -275,13 +275,13 @@
 }
 
 .portal-docs__nav-link:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
+  background: var(--c-hover);
+  color: var(--c-text);
 }
 
 .portal-docs__nav-link.is-active {
-  background: var(--color-blue-light);
-  color: var(--color-blue);
+  background: color-mix(in srgb, var(--c-primary) 12%, var(--c-surface));
+  color: var(--c-primary);
   font-weight: 600;
 }
 
@@ -317,7 +317,7 @@
   min-height: 0;
   height: 100%;
   overflow-y: auto;
-  border-left: 1px solid var(--color-border-light);
+  border-left: 1px solid var(--c-border-subtle);
   padding: 1.5rem 0.75rem;
 }
 
@@ -331,7 +331,7 @@
   font-weight: 700;
   letter-spacing: 0.06em;
   text-transform: uppercase;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   padding: 0 0.5rem 0.5rem;
 }
 
@@ -350,7 +350,7 @@
   border-left: 2px solid transparent;
   font-size: 0.8125rem;
   line-height: 1.35;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   text-decoration: none;
   transition: color var(--motion-fast);
 }
@@ -361,12 +361,12 @@
 }
 
 .portal-docs__toc-link:hover {
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-docs__toc-link.is-active {
-  color: var(--color-blue);
-  border-left-color: var(--color-blue);
+  color: var(--c-primary);
+  border-left-color: var(--c-primary);
   font-weight: 600;
 }
 
@@ -392,9 +392,9 @@
     padding: 0.5rem 0.75rem;
     font-size: 0.8125rem;
     font-weight: 600;
-    color: var(--color-text-1);
+    color: var(--c-text);
     background: var(--color-bg-subtle);
-    border: 1px solid var(--color-border-light);
+    border: 1px solid var(--c-border-subtle);
     border-radius: var(--radius-md);
     cursor: pointer;
   }
@@ -404,7 +404,7 @@
     height: auto;
     max-height: 60vh;
     border-right: none;
-    border-bottom: 1px solid var(--color-border-light);
+    border-bottom: 1px solid var(--c-border-subtle);
   }
 
   .portal-docs__sidebar.is-open {
@@ -426,7 +426,7 @@
   font-size: 0.6875rem;
   font-weight: 700;
   letter-spacing: 0.08em;
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 
 .portal-docs__section-title {
@@ -434,7 +434,7 @@
   font-size: 1.75rem;
   font-weight: 700;
   line-height: 1.15;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-docs__section-lead {
@@ -442,13 +442,13 @@
   max-width: 46rem;
   font-size: 0.9375rem;
   line-height: 1.6;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-docs__callout {
   font-size: 0.875rem;
   line-height: 1.55;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-docs__callout code {
@@ -483,7 +483,7 @@
   width: 1.75rem;
   height: 1.75rem;
   border-radius: var(--radius-pill);
-  background: var(--color-blue);
+  background: var(--c-primary);
   color: var(--color-text-on-accent);
   font-size: 0.8125rem;
   font-weight: 700;
@@ -500,14 +500,14 @@
   margin: 0;
   font-size: 1rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-docs__step-body p {
   margin: 0;
   font-size: 0.875rem;
   line-height: 1.55;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-docs__snippet {
@@ -529,7 +529,7 @@
   align-items: center;
   gap: 0.75rem;
   font-size: 0.875rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 /* ── Rate limits ───────────────────────────────────────────────────────── */
@@ -548,14 +548,14 @@
 
 .portal-docs__limit-label {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   margin-bottom: 0.25rem;
 }
 
 .portal-docs__limit-value {
   font-size: 1.25rem;
   font-weight: 700;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 /* ── Endpoint reference ────────────────────────────────────────────────── */
@@ -569,7 +569,7 @@
 .portal-docs__endpoint-group {
   display: flex;
   flex-direction: column;
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-lg);
   overflow: hidden;
 }
@@ -581,9 +581,9 @@
   padding: 0.625rem 0.875rem;
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   background: var(--color-bg-subtle);
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .portal-docs__endpoint-dot {
@@ -597,7 +597,7 @@
   align-items: center;
   gap: 0.75rem;
   padding: 0.5rem 0.875rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
   font-size: 0.8125rem;
 }
 
@@ -608,12 +608,12 @@
 .portal-docs__endpoint-path {
   font-family: var(--font-mono, monospace);
   font-size: 0.8125rem;
-  color: var(--color-text-1);
+  color: var(--c-text);
   min-width: 11rem;
 }
 
 .portal-docs__endpoint-name {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   flex: 1;
   min-width: 0;
   overflow: hidden;
@@ -623,7 +623,7 @@
 
 .portal-docs__endpoint-fields {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   white-space: nowrap;
 }
 
@@ -646,7 +646,7 @@
   align-items: center;
   gap: 0.75rem;
   font-size: 0.875rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 /* ── SDK grid ──────────────────────────────────────────────────────────── */
@@ -678,7 +678,7 @@
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   flex: 1;
 }
 
@@ -715,7 +715,7 @@
   margin: 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 /* ── Playbooks ─────────────────────────────────────────────────────────── */
@@ -736,14 +736,14 @@
   margin: 0 0 0.375rem;
   font-size: 1rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-docs__playbook-blurb {
   margin: 0 0 0.875rem;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-docs__playbook-flow {
@@ -761,7 +761,7 @@
 }
 
 .portal-docs__playbook-arrow {
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-size: 0.75rem;
 }
 
@@ -808,20 +808,20 @@
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-docs__skill-blurb {
   margin: 0 0 0.625rem;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-docs__skill-ops {
   font-family: var(--font-mono, monospace);
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* ── Markdown content ──────────────────────────────────────────────────── */
@@ -829,14 +829,14 @@
 .portal-docs__md {
   font-size: 0.9375rem;
   line-height: 1.65;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-docs__md h1,
 .portal-docs__md h2,
 .portal-docs__md h3,
 .portal-docs__md h4 {
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-weight: 650;
   line-height: 1.25;
   margin: 1.75rem 0 0.75rem;
@@ -845,7 +845,7 @@
 .portal-docs__md h2 {
   font-size: 1.3125rem;
   padding-bottom: 0.3rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .portal-docs__md h3 {
@@ -871,7 +871,7 @@
 }
 
 .portal-docs__md a {
-  color: var(--color-blue);
+  color: var(--c-primary);
   text-decoration: none;
 }
 
@@ -890,10 +890,10 @@
 .portal-docs__md blockquote {
   margin: 0 0 0.875rem;
   padding: 0.125rem 0.875rem;
-  border-left: 3px solid var(--color-blue);
+  border-left: 3px solid var(--c-primary);
   background: var(--color-bg-subtle);
   border-radius: 0 var(--radius-md) var(--radius-md) 0;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-docs__md blockquote p {
@@ -904,12 +904,12 @@
   max-width: 100%;
   height: auto;
   border-radius: var(--radius-md);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
 }
 
 .portal-docs__md hr {
   border: none;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
   margin: 1.5rem 0;
 }
 
@@ -922,7 +922,7 @@
   margin: 0;
   padding: 0.875rem 4rem 0.875rem 0.875rem;
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
   overflow-x: auto;
   font-size: 0.8125rem;
@@ -954,7 +954,7 @@
 
 .portal-docs__md-tablewrap th,
 .portal-docs__md-tablewrap td {
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   padding: 0.4rem 0.625rem;
   text-align: left;
 }
@@ -967,16 +967,16 @@
 .portal-docs__source {
   margin-top: 2rem;
   padding-top: 1rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
   font-size: 0.8125rem;
 }
 
 .portal-docs__source a {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   text-decoration: none;
 }
 
 .portal-docs__source a:hover {
-  color: var(--color-blue);
+  color: var(--c-primary);
   text-decoration: underline;
 }
diff --git a/frontend/editor/src/portal/views/Documents.css b/frontend/editor/src/portal/views/Documents.css
index 13cbf33c3c..f363037981 100644
--- a/frontend/editor/src/portal/views/Documents.css
+++ b/frontend/editor/src/portal/views/Documents.css
@@ -25,14 +25,14 @@
   margin: 0;
   font-size: 1.375rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-documents__sub {
   margin: 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   max-width: 46rem;
 }
 
@@ -81,12 +81,12 @@
 
 .portal-documents__name {
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-documents__note {
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-documents__lock {
@@ -97,18 +97,18 @@
 
 .portal-documents__muted {
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-documents__action {
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-documents__editor-action {
   font-size: 0.8125rem;
   font-style: italic;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Drawer body */
@@ -137,7 +137,7 @@
 
 .portal-documents__field {
   font-weight: 500;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 /* Masked / sensitive placeholder */
@@ -149,7 +149,7 @@
   padding: 2rem 1rem;
   text-align: center;
   background: var(--color-bg-subtle);
-  border: 1px dashed var(--color-border);
+  border: 1px dashed var(--c-border);
   border-radius: var(--radius-lg);
 }
 
@@ -160,7 +160,7 @@
 .portal-documents__masked-text {
   margin: 0;
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   max-width: 22rem;
 }
 
@@ -192,7 +192,7 @@
   height: 0.5rem;
   margin-top: 0.375rem;
   border-radius: 50%;
-  background: var(--color-blue);
+  background: var(--c-primary);
 }
 
 /* Connecting line between successive timeline dots. */
@@ -205,7 +205,7 @@
   transform: translateX(-50%);
   width: 1px;
   height: calc(100% + 1rem);
-  background: var(--color-border);
+  background: var(--c-border);
 }
 
 .portal-documents__timeline-body {
@@ -223,18 +223,18 @@
 
 .portal-documents__timeline-time {
   font-size: 0.6875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-documents__timeline-detail {
   margin: 0;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   line-height: 1.45;
 }
 
 .portal-documents__timeline-actor {
   font-family: var(--font-mono);
   font-size: 0.6875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/portal/views/EditorAdmin.css b/frontend/editor/src/portal/views/EditorAdmin.css
index 61ef2834dd..1ccd0d63b1 100644
--- a/frontend/editor/src/portal/views/EditorAdmin.css
+++ b/frontend/editor/src/portal/views/EditorAdmin.css
@@ -19,14 +19,14 @@
   margin: 0;
   font-size: 1.375rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-editor__sub {
   margin: 0.25rem 0 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   max-width: 52rem;
 }
 
@@ -39,14 +39,14 @@
   margin: 0;
   font-size: 1rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-editor__section-sub {
   margin: 0.1875rem 0 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   max-width: 52rem;
 }
 
@@ -92,11 +92,11 @@
 
 .portal-editor__target-icon--neutral {
   background: var(--color-bg-subtle);
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 .portal-editor__target-icon--blue {
-  background: var(--color-blue-light);
-  color: var(--color-blue);
+  background: var(--c-primary-tint);
+  color: var(--c-primary);
 }
 .portal-editor__target-icon--purple {
   background: var(--color-purple-light);
@@ -112,21 +112,21 @@
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-editor__target-tagline {
   margin: 0.1875rem 0 0;
   font-size: 0.75rem;
   line-height: 1.45;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-editor__target-meta {
   margin: 0;
   font-size: 0.75rem;
   font-family: var(--font-mono);
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -140,7 +140,7 @@
   gap: 0.625rem;
   padding: 0.875rem;
   background: var(--color-bg-subtle);
-  border: 1px dashed var(--color-border);
+  border: 1px dashed var(--c-border);
   border-radius: var(--radius-md);
 }
 
@@ -148,7 +148,7 @@
   margin: 0;
   font-size: 0.8125rem;
   line-height: 1.45;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -191,8 +191,8 @@
 }
 
 .portal-editor__pairing-icon--blue {
-  background: var(--color-blue-light);
-  color: var(--color-blue);
+  background: color-mix(in srgb, var(--c-primary) 12%, var(--c-surface));
+  color: var(--c-primary);
 }
 .portal-editor__pairing-icon--purple {
   background: var(--color-purple-light);
@@ -212,27 +212,27 @@
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-editor__pairing-desc {
   margin: 0.1875rem 0 0;
   font-size: 0.75rem;
   line-height: 1.45;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-editor__pairing-value {
   padding: 0.625rem 0.75rem;
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
 }
 
 .portal-editor__pairing-value code {
   font-family: var(--font-mono);
   font-size: 0.8125rem;
-  color: var(--color-text-1);
+  color: var(--c-text);
   word-break: break-all;
 }
 
@@ -258,7 +258,7 @@
 .portal-editor__cell-strong {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-editor__cell-muted {
@@ -268,12 +268,12 @@
 .portal-editor__mono {
   font-family: var(--font-mono);
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-editor__muted {
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -313,14 +313,14 @@
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-editor__panel-sub {
   margin: 0.25rem 0 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-editor__enterprise-tag {
diff --git a/frontend/editor/src/portal/views/Home.css b/frontend/editor/src/portal/views/Home.css
index 3027dfa1bc..732bd617a5 100644
--- a/frontend/editor/src/portal/views/Home.css
+++ b/frontend/editor/src/portal/views/Home.css
@@ -16,12 +16,12 @@
   font-size: 1.5rem;
   font-weight: 700;
   letter-spacing: -0.02em;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .portal-home__greeting-date {
   margin: 0;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Two-column dashboard row (activity + quick actions) */
@@ -47,12 +47,12 @@
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-home__quick-sub {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-home__quick-list {
@@ -65,7 +65,7 @@
    shared Button's leftSection / label / rightSection, not overridden here. */
 .portal-home__quick-row {
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
   text-align: left;
   transition:
@@ -74,8 +74,8 @@
 }
 
 .portal-home__quick-row:hover {
-  background: var(--color-bg-hover);
-  border-color: var(--color-border);
+  background: var(--c-hover);
+  border-color: var(--c-border);
 }
 
 /* Let the label grow so the arrow (rightSection) is pushed to the far right,
@@ -109,18 +109,19 @@
 
 .portal-home__quick-text strong {
   font-size: 0.8125rem;
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-weight: 600;
 }
 
 .portal-home__quick-text span {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-home__quick-arrow {
   display: inline-flex;
-  color: var(--color-text-5);
+  font-size: 0.875rem;
+  color: var(--c-text-subtle);
 }
 .portal-home__quick-arrow svg {
   width: 1rem;
@@ -128,5 +129,5 @@
 }
 
 .portal-home__quick-row:hover .portal-home__quick-arrow {
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
diff --git a/frontend/editor/src/portal/views/Infrastructure.css b/frontend/editor/src/portal/views/Infrastructure.css
index 1d98dee925..2bff218e96 100644
--- a/frontend/editor/src/portal/views/Infrastructure.css
+++ b/frontend/editor/src/portal/views/Infrastructure.css
@@ -24,13 +24,13 @@
   margin: 0;
   font-size: 1.375rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-infra__sub {
   margin: 0;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   max-width: 48rem;
 }
 
@@ -62,13 +62,13 @@
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-infra__section-sub {
   margin: 0.125rem 0 0;
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Audit tab header row: section heading + Export action */
@@ -95,7 +95,7 @@
 .portal-infra__export-label {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-infra__export-fields {
@@ -113,7 +113,7 @@
 .portal-infra__export-error {
   margin: 0;
   font-size: 0.8125rem;
-  color: var(--color-danger, #e5484d);
+  color: var(--c-danger);
 }
 
 .portal-infra__export-actions {
@@ -146,13 +146,13 @@
 .portal-infra__cell-strong {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-infra__cell-code {
   font-family: var(--font-mono);
   font-size: 0.6875rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   background: var(--color-bg-code);
   padding: 0.0625rem 0.3125rem;
   border-radius: var(--radius-sm);
@@ -162,12 +162,12 @@
 .portal-infra__mono {
   font-family: var(--font-mono);
   font-size: 0.75rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-infra__muted {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Region load cell */
@@ -180,7 +180,7 @@
 .portal-infra__load-pct {
   font-family: var(--font-mono);
   font-size: 0.6875rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   min-width: 2.25rem;
   text-align: right;
 }
@@ -226,7 +226,7 @@
 }
 
 .portal-infra__key-head:hover {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 .portal-infra__key-id {
@@ -244,7 +244,7 @@
 
 .portal-infra__chevron {
   font-size: 1.125rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   transition: transform var(--motion-fast);
   line-height: 1;
 }
@@ -255,7 +255,7 @@
 
 .portal-infra__key-body {
   padding: 0 1.125rem 1.125rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 
 .portal-infra__kv {
@@ -279,14 +279,14 @@
   font-size: 0.6875rem;
   text-transform: uppercase;
   letter-spacing: 0.04em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   margin-bottom: 0.25rem;
 }
 
 .portal-infra__kv dd {
   margin: 0;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-infra__chips {
@@ -342,7 +342,7 @@
 .portal-infra__cert-detail {
   margin: 0;
   font-size: 0.6875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   line-height: 1.4;
 }
 
@@ -392,7 +392,7 @@
 .portal-infra__attestation-link {
   font-size: 0.75rem;
   font-weight: 600;
-  color: var(--color-blue);
+  color: var(--c-primary);
   text-decoration: none;
 }
 
@@ -412,7 +412,7 @@
 .portal-infra__usage-value {
   font-size: 1.25rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-infra__usage-value .portal-infra__muted {
@@ -436,7 +436,7 @@
   gap: 0.75rem;
   padding: 0.625rem 0.75rem;
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
 }
 
@@ -447,8 +447,8 @@
   width: 1.75rem;
   height: 1.75rem;
   border-radius: var(--radius-md);
-  background: var(--color-blue-light);
-  color: var(--color-blue);
+  background: var(--c-primary-tint);
+  color: var(--c-primary);
   font-size: 0.875rem;
 }
 
@@ -480,7 +480,7 @@
   gap: 0.25rem;
   padding: 0.625rem 0.75rem;
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
 }
 
@@ -493,7 +493,7 @@
   width: 0.5rem;
   height: 0.5rem;
   border-radius: 50%;
-  background: var(--color-text-5);
+  background: var(--c-text-subtle);
 }
 
 .portal-infra__lifecycle-stage.is-active .portal-infra__lifecycle-dot {
@@ -503,13 +503,13 @@
 .portal-infra__lifecycle-label {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-infra__lifecycle-arrow {
   display: flex;
   align-items: center;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   font-size: 0.875rem;
 }
 
@@ -522,7 +522,7 @@
 
 .portal-infra__event span {
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 /* ── Table skeleton ─────────────────────────────────────────────────────── */
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.css b/frontend/editor/src/portal/views/PipelineBuilder.css
index c7e273eec1..b56b199676 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.css
+++ b/frontend/editor/src/portal/views/PipelineBuilder.css
@@ -20,7 +20,7 @@
   gap: 0.75rem;
   flex-wrap: wrap;
   padding-bottom: 1rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .portal-builder__back {
@@ -31,13 +31,13 @@
   background: none;
   padding: 0;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   cursor: pointer;
   white-space: nowrap;
 }
 
 .portal-builder__back:hover {
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-builder__head-main {
@@ -75,13 +75,13 @@
   font-size: 0.6875rem;
   text-transform: uppercase;
   letter-spacing: 0.04em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   font-weight: 600;
 }
 
 .portal-builder__empty {
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   margin: 0;
   padding: 0.5rem 0;
 }
@@ -100,8 +100,8 @@
   display: flex;
   align-items: center;
   gap: 0.5rem;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border-light);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-lg);
   padding: 0.5rem 0.625rem;
   transition:
@@ -110,8 +110,8 @@
 }
 
 .portal-builder__step--active {
-  border-color: var(--color-blue);
-  background: var(--color-blue-light);
+  border-color: var(--c-primary);
+  background: var(--c-primary-tint);
 }
 
 .portal-builder__step-main {
@@ -138,12 +138,12 @@
   border-radius: 50%;
   font-size: 0.6875rem;
   font-weight: 600;
-  background: var(--color-blue-light);
-  color: var(--color-blue);
+  background: var(--c-primary-tint);
+  color: var(--c-primary);
 }
 
 .portal-builder__step--active .portal-builder__step-index {
-  background: var(--color-blue);
+  background: var(--c-primary);
   color: #fff;
 }
 
@@ -156,12 +156,12 @@
 .portal-builder__step-name {
   font-size: 0.875rem;
   font-weight: 500;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-builder__step-note {
   font-size: 0.6875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-builder__step-actions {
@@ -177,9 +177,9 @@
   height: 1.5rem;
   padding: 0;
   border-radius: var(--radius-md);
-  border: 1px solid var(--color-border);
-  background: var(--color-surface);
-  color: var(--color-text-3);
+  border: 1px solid var(--c-border);
+  background: var(--c-surface);
+  color: var(--c-text-subtle);
   cursor: pointer;
   transition:
     background var(--motion-fast),
@@ -187,8 +187,8 @@
 }
 
 .portal-builder__step-actions button:hover:not(:disabled) {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
+  background: var(--c-hover);
+  color: var(--c-text);
 }
 
 .portal-builder__step-actions button:disabled {
@@ -203,10 +203,10 @@
   gap: 0.375rem;
   width: 100%;
   padding: 0.625rem;
-  border: 1px dashed var(--color-border);
+  border: 1px dashed var(--c-border);
   border-radius: var(--radius-lg);
   background: none;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   font-size: 0.8125rem;
   cursor: pointer;
   transition:
@@ -215,8 +215,8 @@
 }
 
 .portal-builder__add-step:hover {
-  border-color: var(--color-blue);
-  color: var(--color-blue);
+  border-color: var(--c-primary);
+  color: var(--c-primary);
 }
 
 /* Pipeline settings (above the operation list) */
@@ -225,7 +225,7 @@
   flex-direction: column;
   gap: 0.75rem;
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-lg);
   padding: 1.125rem;
 }
@@ -259,8 +259,8 @@
 }
 
 .portal-builder__inspector {
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-lg);
   box-shadow: var(--shadow-sm);
   padding: 1.125rem;
@@ -268,9 +268,9 @@
 
 /* Tool picker */
 .portal-pipelines__picker {
-  border: 1px solid var(--color-border);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-lg);
-  background: var(--color-surface);
+  background: var(--c-surface);
   overflow: hidden;
 }
 
@@ -278,7 +278,7 @@
   display: flex;
   align-items: center;
   padding: 0.5rem 0.75rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .portal-pipelines__picker-search input {
@@ -287,7 +287,7 @@
   background: none;
   padding: 0;
   font-size: 0.875rem;
-  color: var(--color-text-1);
+  color: var(--c-text);
   outline: none;
 }
 
@@ -300,7 +300,7 @@
 .portal-pipelines__picker-group-label {
   padding: 0.5rem 0.75rem 0.25rem;
   font-size: 0.6875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-pipelines__picker-item {
@@ -313,18 +313,18 @@
   padding: 0.4375rem 0.75rem;
   text-align: left;
   cursor: pointer;
-  color: var(--color-text-1);
+  color: var(--c-text);
   transition: background var(--motion-fast);
 }
 
 .portal-pipelines__picker-item:hover {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 .portal-pipelines__picker-icon {
   display: inline-flex;
   align-items: center;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   font-size: 1.125rem;
 }
 
@@ -335,7 +335,7 @@
 .portal-pipelines__picker-empty {
   padding: 1rem 0.75rem;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   margin: 0;
 }
 
@@ -349,11 +349,11 @@
   padding: 0;
   font-weight: 400;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-builder__back.sui-btn:hover {
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-builder__step-main.sui-btn {
@@ -369,16 +369,16 @@
   height: auto;
   min-height: 0;
   padding: 0.625rem;
-  border: 1px dashed var(--color-border);
+  border: 1px dashed var(--c-border);
   background: none;
   font-weight: 400;
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-builder__add-step.sui-btn:hover {
-  border-color: var(--color-blue);
-  color: var(--color-blue);
+  border-color: var(--c-primary);
+  color: var(--c-primary);
 }
 
 .portal-pipelines__picker-item.sui-btn {
@@ -386,11 +386,11 @@
   min-height: 0;
   padding: 0.4375rem 0.75rem;
   font-weight: 400;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-pipelines__picker-item.sui-btn:hover {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 .portal-builder__step-actions .sui-ai {
diff --git a/frontend/editor/src/portal/views/Pipelines.css b/frontend/editor/src/portal/views/Pipelines.css
index 5c99f6a224..989feab4fe 100644
--- a/frontend/editor/src/portal/views/Pipelines.css
+++ b/frontend/editor/src/portal/views/Pipelines.css
@@ -20,14 +20,14 @@
   margin: 0;
   font-size: 1.375rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-pipelines__sub {
   margin: 0.25rem 0 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   max-width: 46rem;
 }
 
@@ -49,7 +49,7 @@
 .portal-pipelines__name-text strong {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-pipelines__pipe-dot {
@@ -61,25 +61,25 @@
   flex-shrink: 0;
   border-radius: var(--radius-md);
   font-size: 0.875rem;
-  background: var(--color-blue-light);
-  color: var(--color-blue);
+  background: var(--c-primary-tint);
+  color: var(--c-primary);
 }
 
 .portal-pipelines__muted {
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   margin: 0;
 }
 
 .portal-pipelines__caret {
   display: inline-block;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   transition: transform var(--motion-fast);
 }
 
 .portal-pipelines__caret.is-open {
   transform: rotate(90deg);
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 
 /* Table skeleton */
@@ -94,7 +94,7 @@
   font-size: 0.6875rem;
   text-transform: uppercase;
   letter-spacing: 0.04em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   font-weight: 600;
 }
 
@@ -113,7 +113,7 @@
   overflow-y: auto;
   padding: 0.625rem;
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
 }
 
diff --git a/frontend/editor/src/portal/views/Policies.css b/frontend/editor/src/portal/views/Policies.css
index e58d5522a8..e1a821ee27 100644
--- a/frontend/editor/src/portal/views/Policies.css
+++ b/frontend/editor/src/portal/views/Policies.css
@@ -18,14 +18,14 @@
   margin: 0;
   font-size: 1.375rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-policies__sub {
   margin: 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   max-width: 46rem;
 }
 
@@ -49,14 +49,14 @@
   flex: 1;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 /* "Set up" underline link inside the active-row button's rightSection */
 .portal-policies__setup-link {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-blue);
+  color: var(--c-primary);
   text-decoration: underline;
   text-underline-offset: 2px;
 }
@@ -83,7 +83,7 @@
 
 .portal-policies__card-enforces {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
@@ -106,13 +106,13 @@
 .portal-policies__card-statval {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   line-height: 1.2;
 }
 
 .portal-policies__card-statlbl {
   font-size: 0.6875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   line-height: 1.2;
 }
 
@@ -124,19 +124,19 @@
   height: 2rem;
   flex-shrink: 0;
   font-size: 1.125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-policies__card-title {
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-policies__card-blurb {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   line-height: 1.4;
 }
 
@@ -144,7 +144,7 @@
   margin: 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-policies__card-foot {
@@ -165,7 +165,7 @@
 .portal-policies__card-cta {
   font-size: 0.75rem;
   font-weight: 600;
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 
 .portal-policies__chevron-right {
@@ -180,7 +180,7 @@
   gap: 0.5rem;
   margin-top: auto;
   padding-top: 0.75rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 
 @media (max-width: 30rem) {
@@ -219,7 +219,7 @@
   margin: 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-policies__wizard-heading {
@@ -227,7 +227,7 @@
   font-size: 0.6875rem;
   text-transform: uppercase;
   letter-spacing: 0.04em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   font-weight: 600;
 }
 
@@ -260,13 +260,13 @@
 }
 
 .portal-policies__capability + .portal-policies__capability {
-  border-top: 1px solid var(--color-border);
+  border-top: 1px solid var(--c-border);
 }
 
 /* An enabled row with config gets a faint tint so the revealed settings read as
  * belonging to it. */
 .portal-policies__capability[data-on] .portal-policies__capability-config {
-  border-top: 1px dashed var(--color-border);
+  border-top: 1px dashed var(--c-border);
   padding-top: 0.75rem;
   margin-top: 0.75rem;
 }
@@ -282,7 +282,7 @@
 }
 
 .portal-policies__source--on {
-  border-color: var(--color-blue);
+  border-color: var(--c-primary);
 }
 
 .portal-policies__source-label {
@@ -297,7 +297,7 @@
   padding: 0;
   font-size: 0.75rem;
   font-weight: 600;
-  color: var(--color-blue);
+  color: var(--c-primary);
   cursor: pointer;
 }
 
@@ -320,17 +320,17 @@
 }
 
 .portal-policies__detail-sep {
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   font-size: 0.75rem;
 }
 
 .portal-policies__detail-meta {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-policies__enforce-arrow {
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   font-size: 0.75rem;
 }
 
@@ -344,7 +344,7 @@
 .portal-policies__detail-inline-label {
   font-size: 0.6875rem;
   font-weight: 600;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   text-transform: uppercase;
   letter-spacing: 0.04em;
   flex-shrink: 0;
@@ -353,7 +353,7 @@
 
 .portal-policies__detail-inline-value {
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   line-height: 1.5;
 }
 
@@ -366,7 +366,7 @@
 }
 
 .portal-policies__activity-row + .portal-policies__activity-row {
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 
 .portal-policies__activity-icon {
@@ -384,7 +384,7 @@
   color: var(--color-amber);
 }
 .portal-policies__activity-icon--info {
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 
 @keyframes portal-policies-spin {
@@ -408,17 +408,17 @@
 .portal-policies__activity-doc {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-policies__activity-action {
   font-size: 0.75rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-policies__activity-time {
   font-size: 0.6875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   white-space: nowrap;
 }
 
@@ -457,7 +457,7 @@
 }
 
 .portal-policies__detail-stats .sui-stat + .sui-stat {
-  border-left: 1px solid var(--color-border-light);
+  border-left: 1px solid var(--c-border-subtle);
 }
 
 /* ── Catalogue table (replaces the stacked category cards) ──────────────── */
@@ -471,7 +471,7 @@
 .portal-policies__cell-name {
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   min-width: 0;
 }
 
@@ -483,13 +483,13 @@
 
 .portal-policies__muted {
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-policies__docs {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 /* The .pcat-badge icon styles live with the PolicyCategoryIcon component
diff --git a/frontend/editor/src/portal/views/Procurement.css b/frontend/editor/src/portal/views/Procurement.css
index f733b2c5a3..e26fd74a31 100644
--- a/frontend/editor/src/portal/views/Procurement.css
+++ b/frontend/editor/src/portal/views/Procurement.css
@@ -19,13 +19,13 @@
   margin: 0;
   font-size: 1.375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-proc__subtitle {
   margin: 0.25rem 0 0;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Eyebrow label shared by the journey header + SE block */
@@ -35,7 +35,7 @@
   font-weight: 600;
   text-transform: uppercase;
   letter-spacing: 0.05em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   margin-bottom: 0.25rem;
 }
 
@@ -47,7 +47,7 @@
   justify-content: space-between;
   gap: 1rem;
   padding: 1.25rem 1.5rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
   flex-wrap: wrap;
 }
 
@@ -55,7 +55,7 @@
   margin: 0;
   font-size: 1.0625rem;
   font-weight: 700;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-proc__journey-sub {
@@ -63,7 +63,7 @@
   max-width: 36rem;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-proc__se {
@@ -80,12 +80,12 @@
 .portal-proc__se-name {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-proc__se-email {
   font-size: 0.75rem;
-  color: var(--color-blue);
+  color: var(--c-primary);
   text-decoration: none;
 }
 
@@ -96,7 +96,7 @@
 /* Stepper band */
 .portal-proc__journey-stepper {
   padding: 1.125rem 1.5rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .portal-proc__steps {
@@ -122,7 +122,7 @@
   width: 0.875rem;
   height: 0.875rem;
   border-radius: 50%;
-  background: var(--color-border-input);
+  background: var(--c-border);
 }
 
 .portal-proc__step--complete .portal-proc__step-dot {
@@ -139,16 +139,16 @@
   font-weight: 500;
   text-align: center;
   white-space: nowrap;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-proc__step--complete .portal-proc__step-label {
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-proc__step--current .portal-proc__step-label {
   font-weight: 700;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 /* Connector aligns with the 0.875rem dots: (14px − 2px) / 2 = 6px down */
@@ -156,7 +156,7 @@
   flex: 1;
   height: 2px;
   margin: 0.375rem 0.375rem 0;
-  background: var(--color-border-light);
+  background: var(--c-border-subtle);
 }
 
 .portal-proc__step-line[data-filled="true"] {
@@ -170,28 +170,28 @@
   gap: 0.625rem;
   flex-wrap: wrap;
   padding: 0.75rem 1.5rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
   background: var(--color-bg-code);
 }
 
 .portal-proc__trial-title {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-proc__trial-dim {
   font-size: 0.78125rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-proc__trial-key {
   font-family:
     ui-monospace, SFMono-Regular, Menlo, Consolas, "Liberation Mono", monospace;
   font-size: 0.6875rem;
-  color: var(--color-text-4);
-  background: var(--color-surface);
-  border: 1px solid var(--color-border-input);
+  color: var(--c-text-subtle);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: 0.375rem;
   padding: 0.1875rem 0.5rem;
 }
@@ -212,7 +212,7 @@
   gap: 0.625rem;
   font-size: 0.84375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-proc__next-dot {
@@ -230,20 +230,20 @@
 /* ── Documents card ───────────────────────────────────────────────────── */
 .portal-proc__docs-head {
   padding: 1.125rem 1.5rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .portal-proc__docs-title {
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 700;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-proc__docs-sub {
   margin: 0.25rem 0 0;
   font-size: 0.78125rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-proc__docs-body {
@@ -273,7 +273,7 @@
 }
 
 .portal-proc__stage-dot[data-state="upcoming"] {
-  background: var(--color-border-input);
+  background: var(--c-border);
 }
 
 .portal-proc__stage-label {
@@ -281,30 +281,30 @@
   font-weight: 700;
   letter-spacing: 0.03em;
   text-transform: uppercase;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-proc__stage-label[data-current] {
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-proc__stage-hint {
   font-size: 0.71875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-proc__stage-count {
   font-size: 0.6875rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 /* Document lists inside the accordion */
 .portal-proc__doc-list {
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 
 .portal-proc__doc-list--boxed {
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.5rem;
   overflow: hidden;
 }
@@ -326,20 +326,20 @@
   font-size: 0.71875rem;
   font-weight: 400;
   line-height: 1.45;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-proc__acc-toggle-label {
   font-size: 0.75rem;
   font-weight: 600;
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 
 .portal-proc__supporting-groups {
   display: flex;
   flex-direction: column;
   gap: 1rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
   padding: 0.875rem;
 }
 
@@ -348,7 +348,7 @@
   font-weight: 700;
   text-transform: uppercase;
   letter-spacing: 0.05em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   margin-bottom: 0.5rem;
 }
 
@@ -359,7 +359,7 @@
   justify-content: space-between;
   gap: 1rem;
   padding: 0.75rem 0.875rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .portal-proc__doc:last-child {
@@ -384,14 +384,14 @@
 .portal-proc__doc-name {
   font-size: 0.84375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-proc__doc-sub {
   margin: 0.0625rem 0 0;
   font-size: 0.71875rem;
   line-height: 1.4;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-proc__doc-actions {
@@ -413,7 +413,7 @@
   margin: 0 0 1rem;
   font-size: 0.875rem;
   line-height: 1.55;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-proc__modal-actions {
@@ -435,7 +435,7 @@
 
 .portal-proc__upload-name {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 @media (max-width: 48rem) {
@@ -466,8 +466,8 @@
   font-weight: 700;
   text-transform: uppercase;
   letter-spacing: 0.06em;
-  color: var(--color-primary, #2383e2);
-  background: var(--color-primary-light, #eaf2fb);
+  color: var(--c-primary);
+  background: var(--c-primary-subtle);
   padding: 0.15rem 0.5rem;
   border-radius: 0.375rem;
   margin-bottom: 0.4rem;
@@ -476,11 +476,11 @@
   margin: 0;
   font-size: 0.8125rem;
   line-height: 1.45;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   max-width: 44rem;
 }
 .portal-proc__upsell-copy strong {
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 /* ── Quote builder ────────────────────────────────────────────────────────── */
@@ -494,11 +494,11 @@
   margin: 0;
   font-size: 1rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-proc__builder-step {
   font-size: 0.75rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 .portal-proc__builder-body {
   display: flex;
@@ -510,23 +510,23 @@
   flex-direction: column;
   gap: 0.3rem;
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 .portal-proc__field input,
 .portal-proc__field select {
   padding: 0.45rem 0.6rem;
-  border: 1px solid var(--color-border, #eae8e3);
+  border: 1px solid var(--c-border);
   border-radius: 0.5rem;
   font-size: 0.875rem;
-  background: var(--color-bg-elevated, #fff);
-  color: var(--color-text-1);
+  background: var(--c-input-bg);
+  color: var(--c-text);
 }
 .portal-proc__builder-addons {
   display: flex;
   flex-direction: column;
   gap: 0.4rem;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .portal-proc__builder-addons label {
   display: flex;
@@ -543,16 +543,16 @@
   display: flex;
   align-items: baseline;
   justify-content: space-between;
-  border-bottom: 1px solid var(--color-border, #eae8e3);
+  border-bottom: 1px solid var(--c-border);
   padding-bottom: 0.5rem;
 }
 .portal-proc__quote-number {
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-proc__quote-valid {
   font-size: 0.75rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 .portal-proc__quote-lines {
   list-style: none;
@@ -564,11 +564,11 @@
   justify-content: space-between;
   padding: 0.4rem 0;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
-  border-bottom: 1px solid var(--color-border-light, #f0eee9);
+  color: var(--c-text-muted);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 .portal-proc__quote-lines li[data-kind="DISCOUNT"] {
-  color: var(--color-success, #0f7b6c);
+  color: var(--c-success);
 }
 .portal-proc__quote-total {
   display: flex;
@@ -579,19 +579,19 @@
 }
 .portal-proc__quote-total strong {
   font-size: 1.25rem;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-proc__quote-tcv {
   font-size: 0.75rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 /* ══ Quote builder — copied from the marketing prototype (tight density) ═════ */
 .portal-qb {
-  background: #ffffff;
-  border: 1px solid #e3e1dc;
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: 14px;
-  box-shadow: inset 0 0 0 1px #eae8e3;
+  box-shadow: inset 0 0 0 1px var(--c-border-subtle);
   overflow: hidden;
 }
 .portal-qb__head {
@@ -599,10 +599,10 @@
   align-items: center;
   justify-content: space-between;
   padding: 18px 24px 14px;
-  border-bottom: 1px solid #f0eee9;
+  border-bottom: 1px solid var(--c-border-subtle);
   background: linear-gradient(
     180deg,
-    rgba(35, 131, 226, 0.055) 0%,
+    color-mix(in srgb, var(--c-primary) 5.5%, transparent) 0%,
     transparent 100%
   );
 }
@@ -610,13 +610,13 @@
   margin: 0;
   font-size: 16px;
   font-weight: 700;
-  color: #37352f;
+  color: var(--c-text);
 }
 .portal-qb__stepchip {
   font-size: 11px;
   font-weight: 700;
-  color: #9b9a97;
-  background: #f5f4f1;
+  color: var(--c-text-subtle);
+  background: var(--c-surface-sunken);
   padding: 3px 10px;
   border-radius: 999px;
 }
@@ -629,11 +629,11 @@
   flex: 1;
   height: 6px;
   border-radius: 999px;
-  background: #f0eee9;
+  background: var(--c-surface-sunken);
   transition: background 0.3s;
 }
 .portal-qb__progress span[data-on] {
-  background: #2383e2;
+  background: var(--c-primary);
 }
 .portal-qb__body {
   padding: 20px 24px;
@@ -650,7 +650,7 @@
   width: 38px;
   height: 38px;
   border-radius: 10px;
-  background: #eaf2fb;
+  background: var(--c-primary-tint);
   display: flex;
   align-items: center;
   justify-content: center;
@@ -660,11 +660,11 @@
 .portal-qb__intro-title {
   font-size: 15px;
   font-weight: 700;
-  color: #37352f;
+  color: var(--c-text);
 }
 .portal-qb__intro-sub {
   font-size: 12.5px;
-  color: #9b9a97;
+  color: var(--c-text-subtle);
   margin-top: 1px;
 }
 .portal-qb__field {
@@ -675,7 +675,7 @@
   display: block;
   font-size: 12px;
   font-weight: 600;
-  color: #787774;
+  color: var(--c-text-muted);
   margin-bottom: 6px;
 }
 .portal-qb__field input,
@@ -685,11 +685,11 @@
   padding: 9px 11px;
   font-size: 13.5px;
   border-radius: 8px;
-  border: 1px solid #e3e1dc;
+  border: 1px solid var(--c-border);
   font-family: inherit;
   outline: none;
-  background: #fff;
-  color: #37352f;
+  background: var(--c-input-bg);
+  color: var(--c-text);
 }
 .portal-qb__row {
   display: flex;
@@ -703,7 +703,7 @@
 .portal-qb__hint {
   margin: 7px 0 0;
   font-size: 11.5px;
-  color: #9b9a97;
+  color: var(--c-text-subtle);
   line-height: 1.4;
 }
 .portal-qb__pills {
@@ -716,20 +716,20 @@
   font-size: 13px;
   font-weight: 600;
   border-radius: 8px;
-  border: 1px solid #e3e1dc;
-  background: #fff;
-  color: #37352f;
+  border: 1px solid var(--c-border);
+  background: var(--c-surface);
+  color: var(--c-text);
   cursor: pointer;
 }
 .portal-qb__pills button[data-on] {
-  background: #2383e2;
-  border-color: #2383e2;
-  color: #fff;
+  background: var(--c-primary);
+  border-color: var(--c-primary);
+  color: var(--c-text-on-primary);
 }
 .portal-qb__discount {
   margin: 6px 0 0;
   font-size: 11.5px;
-  color: #0f7b6c;
+  color: var(--c-success);
 }
 .portal-qb__opts {
   display: flex;
@@ -742,28 +742,28 @@
   min-width: 150px;
   padding: 12px 14px;
   border-radius: 9px;
-  border: 1px solid #e3e1dc;
-  background: #fff;
+  border: 1px solid var(--c-border);
+  background: var(--c-surface);
   cursor: pointer;
   display: flex;
   flex-direction: column;
   gap: 2px;
 }
 .portal-qb__opt[data-on] {
-  border-color: #2383e2;
-  background: #eaf2fb;
+  border-color: var(--c-primary);
+  background: var(--c-primary-tint);
 }
 .portal-qb__opt-title {
   font-size: 13px;
   font-weight: 700;
-  color: #37352f;
+  color: var(--c-text);
 }
 .portal-qb__opt[data-on] .portal-qb__opt-title {
-  color: #1b6ec2;
+  color: var(--c-primary);
 }
 .portal-qb__opt-sub {
   font-size: 11.5px;
-  color: #9b9a97;
+  color: var(--c-text-muted);
   line-height: 1.4;
 }
 .portal-qb__addons {
@@ -777,43 +777,43 @@
   gap: 11px;
   padding: 11px 13px;
   border-radius: 9px;
-  border: 1px solid #e3e1dc;
-  background: #fff;
+  border: 1px solid var(--c-border);
+  background: var(--c-surface);
   cursor: pointer;
   text-align: left;
 }
 .portal-qb__addon[data-on] {
-  border-color: #2383e2;
-  background: #eaf2fb;
+  border-color: var(--c-primary);
+  background: var(--c-primary-tint);
 }
 .portal-qb__addon-box {
   width: 18px;
   height: 18px;
   flex-shrink: 0;
   border-radius: 5px;
-  border: 1px solid #d3d1cb;
+  border: 1px solid var(--c-border);
   display: flex;
   align-items: center;
   justify-content: center;
   font-size: 12px;
   color: transparent;
-  background: #fff;
+  background: var(--c-surface);
 }
 .portal-qb__addon[data-on] .portal-qb__addon-box {
-  background: #2383e2;
-  border-color: #2383e2;
-  color: #fff;
+  background: var(--c-primary);
+  border-color: var(--c-primary);
+  color: var(--c-text-on-primary);
 }
 .portal-qb__addon-title {
   display: block;
   font-size: 13px;
   font-weight: 600;
-  color: #37352f;
+  color: var(--c-text);
 }
 .portal-qb__addon-sub {
   display: block;
   font-size: 11.5px;
-  color: #9b9a97;
+  color: var(--c-text-subtle);
   margin-top: 1px;
 }
 .portal-qb__eula {
@@ -822,10 +822,10 @@
   gap: 10px;
   padding: 12px;
   border-radius: 9px;
-  border: 1px solid #f0eee9;
-  background: #f5f4f1;
+  border: 1px solid var(--c-border-subtle);
+  background: var(--c-surface-sunken);
   font-size: 12.5px;
-  color: #37352f;
+  color: var(--c-text);
   line-height: 1.5;
   cursor: pointer;
 }
@@ -835,12 +835,12 @@
   justify-content: space-between;
   gap: 12px;
   padding: 14px 24px;
-  border-top: 1px solid #f0eee9;
+  border-top: 1px solid var(--c-border-subtle);
   flex-wrap: wrap;
 }
 .portal-qb__running {
   font-size: 11.5px;
-  color: #9b9a97;
+  color: var(--c-text-subtle);
 }
 .portal-qb__foot-btns {
   display: flex;
@@ -848,34 +848,34 @@
 }
 /* Step 4 — the itemised quote paper */
 .portal-qb__papertray {
-  background: #f5f4f1;
+  background: var(--c-surface-sunken);
   padding: 18px;
   max-height: 56vh;
   overflow-y: auto;
   margin: -20px -24px;
 }
 .portal-qb__paper {
-  background: #fff;
-  border: 1px solid #f0eee9;
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 12px;
   overflow: hidden;
-  box-shadow: 0 1px 3px rgba(15, 23, 42, 0.06);
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.06);
 }
 .portal-qb__paper-head {
   display: flex;
   align-items: flex-start;
   justify-content: space-between;
   padding: 20px 24px;
-  border-bottom: 1px solid #f0eee9;
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 .portal-qb__paper-brand {
   font-size: 13.5px;
   font-weight: 800;
-  color: #37352f;
+  color: var(--c-text);
 }
 .portal-qb__paper-eyebrow {
   font-size: 11px;
-  color: #9b9a97;
+  color: var(--c-text-subtle);
 }
 .portal-qb__paper-meta {
   text-align: right;
@@ -883,11 +883,11 @@
 .portal-qb__quote-number {
   font-size: 12.5px;
   font-weight: 700;
-  color: #37352f;
+  color: var(--c-text);
 }
 .portal-qb__paper-meta div:not(.portal-qb__quote-number) {
   font-size: 11px;
-  color: #9b9a97;
+  color: var(--c-text-subtle);
 }
 .portal-qb__paper-for {
   padding: 18px 24px 0;
@@ -895,7 +895,7 @@
 .portal-qb__paper-company {
   font-size: 14px;
   font-weight: 700;
-  color: #37352f;
+  color: var(--c-text);
 }
 .portal-qb__lines {
   list-style: none;
@@ -907,16 +907,16 @@
   justify-content: space-between;
   gap: 14px;
   padding: 10px 0;
-  border-bottom: 1px solid #f0eee9;
+  border-bottom: 1px solid var(--c-border-subtle);
   font-size: 13px;
   font-weight: 600;
-  color: #37352f;
+  color: var(--c-text);
 }
 .portal-qb__lines li[data-kind="DISCOUNT"] {
-  color: #0f7b6c;
+  color: var(--c-success);
 }
 .portal-qb__lines li[data-kind="INCLUDED"] span:last-child {
-  color: #9b9a97;
+  color: var(--c-text-subtle);
   font-weight: 500;
 }
 .portal-qb__total {
@@ -926,17 +926,17 @@
   margin: 16px 24px 24px;
   padding: 16px 18px;
   border-radius: 10px;
-  background: #eaf2fb;
-  border: 1px solid #b8d5f2;
+  background: var(--c-primary-tint);
+  border: 1px solid var(--c-primary-border);
 }
 .portal-qb__total-label {
   font-size: 13px;
   font-weight: 700;
-  color: #37352f;
+  color: var(--c-text);
 }
 .portal-qb__total-tcv {
   font-size: 11.5px;
-  color: #787774;
+  color: var(--c-text-muted);
   margin-top: 2px;
 }
 .portal-qb__total-num {
@@ -946,12 +946,12 @@
   display: block;
   font-size: 23px;
   font-weight: 800;
-  color: #37352f;
+  color: var(--c-text);
   line-height: 1;
 }
 .portal-qb__total-num span {
   font-size: 11px;
-  color: #9b9a97;
+  color: var(--c-text-subtle);
   margin-top: 3px;
 }
 
@@ -962,16 +962,16 @@
 
 /* ── Deal-status hero (Home, active deal) ─────────────────────────────────── */
 .portal-hero {
-  border: 1px solid var(--color-border);
+  border: 1px solid var(--c-border);
   border-radius: 12px;
   padding: 1.1rem 1.25rem;
   background:
     radial-gradient(
       120% 140% at 100% 0%,
-      rgba(124, 58, 237, 0.08),
+      color-mix(in srgb, var(--c-hue-violet) 8%, transparent),
       transparent 55%
     ),
-    var(--color-surface);
+    var(--c-surface);
   display: flex;
   flex-direction: column;
   gap: 1rem;
@@ -989,13 +989,13 @@
   font-weight: 700;
   text-transform: uppercase;
   letter-spacing: 0.06em;
-  color: var(--color-primary, #2383e2);
+  color: var(--c-primary);
 }
 .portal-hero__company {
   display: block;
   font-size: 1.0625rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
   margin-top: 0.2rem;
 }
 .portal-hero__chips {
@@ -1006,8 +1006,8 @@
 .portal-hero__chip {
   font-size: 0.6875rem;
   font-weight: 600;
-  color: var(--color-text-3);
-  background: var(--color-border-light);
+  color: var(--c-text-subtle);
+  background: var(--c-border-subtle);
   border-radius: 999px;
   padding: 0.2rem 0.6rem;
 }
@@ -1021,7 +1021,7 @@
   gap: 0.75rem;
   flex-wrap: wrap;
   padding-top: 0.85rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 .portal-hero__next-label {
   display: inline-flex;
@@ -1029,14 +1029,14 @@
   gap: 0.45rem;
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .portal-hero__next-dot {
   width: 0.5rem;
   height: 0.5rem;
   border-radius: 999px;
-  background: var(--color-primary, #2383e2);
-  box-shadow: 0 0 0 3px rgba(35, 131, 226, 0.18);
+  background: var(--c-primary);
+  box-shadow: 0 0 0 3px var(--c-primary-subtle);
 }
 
 /* ── Full-screen takeover modal (procurement flow) ────────────────────────── */
@@ -1049,7 +1049,7 @@
   justify-content: center;
   padding: clamp(0.5rem, 4vh, 3rem) 1rem;
   overflow-y: auto;
-  background: rgba(15, 23, 42, 0.55);
+  background: var(--c-overlay);
   backdrop-filter: blur(6px) saturate(160%);
   -webkit-backdrop-filter: blur(6px) saturate(160%);
   animation: portal-procmodal-fade 0.15s ease-out;
@@ -1066,10 +1066,10 @@
   position: relative;
   width: 100%;
   max-width: 62rem;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: 14px;
-  box-shadow: 0 24px 64px rgba(15, 23, 42, 0.28);
+  box-shadow: 0 24px 64px rgba(0, 0, 0, 0.28);
   padding: 1.5rem 1.5rem 1.75rem;
 }
 .portal-procmodal__close {
@@ -1077,8 +1077,8 @@
   top: 0.85rem;
   right: 0.85rem;
   border: none;
-  background: var(--color-border-light);
-  color: var(--color-text-3);
+  background: var(--c-border-subtle);
+  color: var(--c-text-subtle);
   width: 1.9rem;
   height: 1.9rem;
   border-radius: 8px;
@@ -1086,8 +1086,8 @@
   cursor: pointer;
 }
 .portal-procmodal__close:hover {
-  background: var(--color-border);
-  color: var(--color-text-1);
+  background: var(--c-border);
+  color: var(--c-text);
 }
 .portal-procmodal__header {
   margin-bottom: 1.25rem;
@@ -1097,12 +1097,12 @@
   margin: 0;
   font-size: 1.35rem;
   font-weight: 700;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-procmodal__sub {
   margin: 0.3rem 0 0;
   font-size: 0.875rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 .portal-procmodal__body {
   display: flex;
@@ -1122,7 +1122,7 @@
 .portal-proc__license {
   margin-top: 1.25rem;
   padding: 1rem;
-  border: 1px solid var(--color-border, rgba(0, 0, 0, 0.1));
+  border: 1px solid var(--c-border);
   border-radius: 0.6rem;
   background: var(--color-surface-2, rgba(0, 0, 0, 0.02));
 }
@@ -1132,7 +1132,7 @@
   font-weight: 600;
   text-transform: uppercase;
   letter-spacing: 0.03em;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .portal-proc__license-key {
   display: block;
@@ -1143,18 +1143,18 @@
   font-family: var(--font-mono, monospace);
   font-size: 0.85rem;
   word-break: break-all;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-proc__license-hint {
   margin: 0.6rem 0 0;
   font-size: 0.75rem;
-  color: var(--color-text-3, var(--color-text-2));
+  color: var(--c-text-subtle, var(--c-text-muted));
 }
 .portal-proc__milestone-for {
   margin: 0.15rem 0 0;
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .portal-proc__milestone-lines {
   margin: 0.85rem 0 0.5rem;
@@ -1169,16 +1169,16 @@
 .portal-proc__milestone-annual {
   font-size: 1.75rem;
   font-weight: 700;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-proc__milestone-annual small {
   font-size: 0.8125rem;
   font-weight: 500;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 .portal-proc__milestone-tcv {
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 /* Hero next-step action row (primary CTA + optional extend-trial). */
@@ -1190,7 +1190,7 @@
 
 /* Hero quick-action chips (clickable pills next to the company name). */
 .portal-hero__chip--action {
-  border: 1px solid var(--color-border);
+  border: 1px solid var(--c-border);
   cursor: pointer;
   transition:
     background 0.12s,
@@ -1198,8 +1198,8 @@
     transform 0.12s;
 }
 .portal-hero__chip--action:hover {
-  background: var(--color-surface);
-  box-shadow: 0 2px 5px rgba(15, 23, 42, 0.1);
+  background: var(--c-surface);
+  box-shadow: 0 2px 5px rgba(0, 0, 0, 0.1);
   transform: translateY(-1px);
 }
 
@@ -1208,10 +1208,10 @@
   list-style: none;
   margin: 0;
   padding: 0;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 .portal-hero__checklist li {
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 .portal-hero__checklist button {
   display: flex;
@@ -1225,13 +1225,13 @@
   text-align: left;
 }
 .portal-hero__checklist button:hover {
-  background: var(--color-bg-hover, var(--color-border-light));
+  background: var(--c-hover, var(--c-border-subtle));
 }
 .portal-hero__check-dot {
   width: 0.5rem;
   height: 0.5rem;
   border-radius: 999px;
-  background: var(--color-border);
+  background: var(--c-border);
   flex-shrink: 0;
 }
 .portal-hero__check-text {
@@ -1242,19 +1242,19 @@
   display: block;
   font-size: 0.85rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-hero__check-sub {
   display: block;
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   margin-top: 0.05rem;
 }
 .portal-hero__check-pill {
   font-size: 0.6875rem;
   font-weight: 600;
-  color: var(--color-text-5);
-  background: var(--color-border-light);
+  color: var(--c-text-subtle);
+  background: var(--c-border-subtle);
   border-radius: 999px;
   padding: 0.15rem 0.55rem;
   flex-shrink: 0;
@@ -1270,7 +1270,7 @@
   justify-content: center;
   padding: 1rem;
   overflow-y: auto;
-  background: rgba(15, 23, 42, 0.55);
+  background: var(--c-overlay);
   backdrop-filter: blur(4px);
   -webkit-backdrop-filter: blur(4px);
   animation: portal-procmodal-fade 0.15s ease-out;
@@ -1281,10 +1281,10 @@
   position: relative;
   width: 100%;
   max-width: 30rem;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: 14px;
-  box-shadow: 0 24px 64px rgba(15, 23, 42, 0.28);
+  box-shadow: 0 24px 64px rgba(0, 0, 0, 0.28);
   padding: 1.35rem 1.4rem 1.4rem;
   max-height: 86vh;
   overflow-y: auto;
@@ -1302,18 +1302,18 @@
   margin: 0;
   font-size: 1.05rem;
   font-weight: 700;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-sidemodal__sub {
   margin: 0.25rem 0 0;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   line-height: 1.5;
 }
 .portal-sidemodal__text {
   margin: 0;
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   line-height: 1.55;
 }
 .portal-sidemodal__footer {
@@ -1323,17 +1323,17 @@
   gap: 0.75rem;
   margin-top: 1.1rem;
   padding-top: 0.9rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 .portal-sidemodal__ghost {
   border: none;
   background: none;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   cursor: pointer;
 }
 .portal-sidemodal__ghost:hover:not(:disabled) {
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 /* Key documents ledger. */
@@ -1345,7 +1345,7 @@
   font-weight: 700;
   text-transform: uppercase;
   letter-spacing: 0.05em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   margin-bottom: 0.4rem;
 }
 .portal-docs__list {
@@ -1358,7 +1358,7 @@
   align-items: center;
   gap: 0.75rem;
   padding: 0.55rem 0;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 .portal-docs__row-text {
   flex: 1;
@@ -1368,12 +1368,12 @@
   display: block;
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-docs__row-sub {
   display: block;
   font-size: 0.72rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   margin-top: 0.05rem;
 }
 .portal-docs__row-action {
@@ -1382,15 +1382,15 @@
   border-radius: 999px;
   padding: 0.2rem 0.6rem;
   flex-shrink: 0;
-  color: var(--color-text-3);
-  background: var(--color-border-light);
+  color: var(--c-text-subtle);
+  background: var(--c-border-subtle);
 }
 .portal-docs__row-action[data-status="action"] {
-  color: var(--color-primary, #2383e2);
-  background: var(--color-primary-light, #eaf2fb);
+  color: var(--c-primary);
+  background: var(--c-primary-subtle);
 }
 .portal-docs__row-action[data-status="request"] {
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 /* Calendly scheduler embed (Schedule a call). The widget is always light (Calendly renders inputs on
@@ -1423,18 +1423,18 @@
   max-height: 22rem;
   overflow-y: auto;
   padding: 1rem 1.1rem;
-  border: 1px solid var(--color-border);
+  border: 1px solid var(--c-border);
   border-radius: 10px;
-  background: var(--color-bg-subtle, var(--color-bg));
+  background: var(--color-bg-subtle, var(--c-bg));
   font-size: 0.8125rem;
   line-height: 1.55;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 .portal-agreement__doc h4 {
   margin: 1rem 0 0.35rem;
   font-size: 0.8125rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-agreement__doc h4:first-child {
   margin-top: 0;
@@ -1443,7 +1443,7 @@
   margin: 0 0 0.5rem;
 }
 .portal-agreement__doc strong {
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-agreement__accept {
   margin-top: 0.25rem;
@@ -1460,12 +1460,12 @@
   border: none;
   background: none;
   font-size: 0.75rem;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   cursor: pointer;
   text-decoration: underline;
 }
 .portal-proc__reset button:hover:not(:disabled) {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 .portal-proc__reset button:disabled {
   opacity: 0.5;
diff --git a/frontend/editor/src/portal/views/SourceBuilder.css b/frontend/editor/src/portal/views/SourceBuilder.css
index 7a964a2c86..ec6b9fe4a4 100644
--- a/frontend/editor/src/portal/views/SourceBuilder.css
+++ b/frontend/editor/src/portal/views/SourceBuilder.css
@@ -31,7 +31,7 @@
 .portal-source-builder__title {
   font-size: 1.375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   margin: 0;
 }
 
@@ -67,7 +67,7 @@
 
 .portal-source-builder__type-card.is-selected {
   border-color: var(--color-accent, var(--color-brand));
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 .portal-source-builder__type-icon {
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index f0dea22e1c..96bd2dc5f3 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -26,14 +26,14 @@
   margin: 0;
   font-size: 1.375rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-sources__sub {
   margin: 0.25rem 0 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   max-width: 46rem;
 }
 
@@ -58,7 +58,7 @@
 .portal-sources__name-text strong {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-sources__type-dot {
@@ -70,21 +70,21 @@
   flex-shrink: 0;
   border-radius: var(--radius-md);
   font-size: 0.875rem;
-  color: var(--dot-c, var(--color-text-3));
+  color: var(--dot-c, var(--c-text-subtle));
   background: color-mix(
     in srgb,
-    var(--dot-c, var(--color-text-3)) 14%,
+    var(--dot-c, var(--c-text-subtle)) 14%,
     transparent
   );
 }
 
 /* Neutral keeps a plain muted surface rather than an accent tint. */
 .portal-sources__type-dot--neutral {
-  background: var(--color-bg-muted);
-  color: var(--color-text-3);
+  background: var(--c-surface-sunken);
+  color: var(--c-text-subtle);
 }
 .portal-sources__type-dot--default {
-  --dot-c: var(--color-blue-dark);
+  --dot-c: var(--c-primary-hover);
 }
 .portal-sources__type-dot--premium {
   --dot-c: var(--color-purple-dark);
@@ -106,24 +106,24 @@
 
 .portal-sources__muted {
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-sources__caret {
   display: inline-block;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   transition: transform var(--motion-fast);
 }
 
 .portal-sources__caret.is-open {
   transform: rotate(90deg);
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 
 /* Expanded detail panel */
 .portal-sources__expanded {
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-lg);
   box-shadow: var(--shadow-sm);
   padding: 1.25rem;
@@ -147,19 +147,19 @@
   gap: 0.75rem;
   padding-bottom: 0.875rem;
   margin-bottom: 1rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .portal-sources__expanded-title {
   margin: 0;
   font-size: 1rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-sources__expanded-sub {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-sources__expanded-close {
@@ -167,9 +167,9 @@
   width: 1.75rem;
   height: 1.75rem;
   border-radius: var(--radius-md);
-  border: 1px solid var(--color-border);
-  background: var(--color-surface);
-  color: var(--color-text-4);
+  border: 1px solid var(--c-border);
+  background: var(--c-surface);
+  color: var(--c-text-subtle);
   font-size: 1.125rem;
   line-height: 1;
   cursor: pointer;
@@ -179,8 +179,8 @@
 }
 
 .portal-sources__expanded-close:hover {
-  background: var(--color-bg-hover);
-  color: var(--color-text-1);
+  background: var(--c-hover);
+  color: var(--c-text);
 }
 
 /* Detail body */
@@ -213,7 +213,7 @@
 .portal-sources__url {
   font-family: var(--font-mono);
   font-size: 0.75rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   word-break: break-all;
 }
 
@@ -229,12 +229,12 @@
   align-items: baseline;
   justify-content: space-between;
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-sources__bar-head strong {
   font-size: 0.8125rem;
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-family: var(--font-mono);
 }
 
@@ -249,7 +249,7 @@
   font-size: 0.6875rem;
   text-transform: uppercase;
   letter-spacing: 0.04em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
   font-weight: 600;
 }
 
@@ -257,7 +257,7 @@
   display: block;
   width: 100%;
   margin-top: 0.5rem;
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 
 .portal-sources__chips {
@@ -280,7 +280,7 @@
   gap: 0.625rem;
   padding: 0.4375rem 0.625rem;
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
   border-radius: var(--radius-md);
 }
 
@@ -291,7 +291,7 @@
 .portal-sources__endpoint-path {
   font-family: var(--font-mono);
   font-size: 0.75rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   min-width: 0;
   overflow: hidden;
   text-overflow: ellipsis;
@@ -299,7 +299,7 @@
 
 .portal-sources__endpoint-calls {
   font-size: 0.6875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   white-space: nowrap;
   font-family: var(--font-mono);
 }
@@ -343,22 +343,22 @@
   gap: 0.4375rem;
   flex: 1;
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   padding: 0.5rem 0.625rem;
   border-radius: var(--radius-md);
   background: var(--color-bg-subtle);
-  border: 1px solid var(--color-border-light);
+  border: 1px solid var(--c-border-subtle);
 }
 
 .portal-sources__step.is-active {
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-weight: 600;
-  border-color: color-mix(in srgb, var(--color-blue) 40%, transparent);
-  background: var(--color-blue-light);
+  border-color: color-mix(in srgb, var(--c-primary) 40%, transparent);
+  background: color-mix(in srgb, var(--c-primary) 12%, var(--c-surface));
 }
 
 .portal-sources__step.is-done {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-sources__step-mark {
@@ -370,14 +370,14 @@
   border-radius: 50%;
   font-size: 0.6875rem;
   font-weight: 600;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
-  color: var(--color-text-4);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
+  color: var(--c-text-subtle);
 }
 
 .portal-sources__step.is-active .portal-sources__step-mark {
-  background: var(--color-blue);
-  border-color: var(--color-blue);
+  background: var(--c-primary);
+  border-color: var(--c-primary);
   color: var(--color-text-on-accent);
 }
 
@@ -415,8 +415,8 @@
   align-items: center;
   gap: 0.5rem;
   padding: 1rem 0.5rem;
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-md);
   cursor: pointer;
   transition:
@@ -425,14 +425,14 @@
 }
 
 .portal-sources__type-card:hover {
-  border-color: var(--color-border-strong, var(--color-border));
-  background: var(--color-bg-hover);
+  border-color: var(--color-border-strong, var(--c-border));
+  background: var(--c-hover);
 }
 
 .portal-sources__type-card.is-selected {
-  border-color: var(--color-blue);
-  background: var(--color-blue-light);
-  box-shadow: 0 0 0 1px var(--color-blue) inset;
+  border-color: var(--c-primary);
+  background: color-mix(in srgb, var(--c-primary) 12%, var(--c-surface));
+  box-shadow: 0 0 0 1px var(--c-primary) inset;
 }
 
 /* Icon inside the type picker: a plain stroke icon above the label (no badge
@@ -441,11 +441,11 @@
   display: inline-flex;
   align-items: center;
   justify-content: center;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-sources__type-card.is-selected .portal-sources__type-icon {
-  color: var(--color-blue);
+  color: var(--c-primary);
 }
 
 .portal-sources__type-icon .portal-sources__type-svg {
@@ -463,7 +463,7 @@
 .portal-sources__type-name {
   font-size: 0.75rem;
   font-weight: 500;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-sources__wizard-body {
@@ -476,13 +476,13 @@
   margin: 0;
   font-size: 0.875rem;
   line-height: 1.55;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-sources__wizard-note {
   margin: 0;
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-sources__wizard-footer {
@@ -533,7 +533,7 @@
 .portal-sources__connections-title {
   font-size: 0.875rem;
   font-weight: 600;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
   margin: 0 0 0.5rem;
 }
 
@@ -556,11 +556,11 @@
 
 .portal-sources__connections-name {
   font-weight: 500;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-sources__connections-bucket {
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-size: 0.8125rem;
 }
 
@@ -579,7 +579,7 @@
 }
 
 .portal-sources__connections-sub {
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-size: 0.875rem;
   margin: 0;
 }
diff --git a/frontend/editor/src/portal/views/Usage.css b/frontend/editor/src/portal/views/Usage.css
index c03e790680..47c035f83e 100644
--- a/frontend/editor/src/portal/views/Usage.css
+++ b/frontend/editor/src/portal/views/Usage.css
@@ -11,8 +11,8 @@
   position: sticky;
   top: 0;
   z-index: 5;
-  background: var(--color-sidebar-bg);
-  border-bottom: 1px solid var(--color-border);
+  background: var(--c-bg-raised);
+  border-bottom: 1px solid var(--c-border);
 }
 .portal-usage__header-inner {
   display: flex;
@@ -35,13 +35,13 @@
   margin: 0;
   font-size: 1.375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-usage__subtitle {
   margin: 0.25rem 0 0;
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Two-column row: current plan + spend cap */
@@ -67,13 +67,13 @@
   margin: 0;
   font-size: 0.9375rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-usage__section-sub {
   margin: 0.25rem 0 0;
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Current plan card */
@@ -96,14 +96,14 @@
   font-weight: 600;
   text-transform: uppercase;
   letter-spacing: 0.04em;
-  color: var(--color-text-5);
+  color: var(--c-text-subtle);
 }
 
 .portal-usage__plan-name {
   margin: 0.125rem 0 0;
   font-size: 1.125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 /* Wallet contract card */
@@ -139,13 +139,13 @@
   font-size: 2.25rem;
   font-weight: 600;
   line-height: 1;
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 
 .portal-usage__wallet-hero-unit {
   font-size: 0.875rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Cap progress (free) */
@@ -160,12 +160,12 @@
   align-items: center;
   justify-content: space-between;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-usage__cap-pct {
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 
@@ -183,7 +183,7 @@
   gap: 0.75rem;
   padding: 0.5rem 0;
   font-size: 0.8125rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
 }
 
 .portal-usage__breakdown-row:last-child {
@@ -191,24 +191,24 @@
 }
 
 .portal-usage__breakdown-label {
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-usage__breakdown-value {
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 
 .portal-usage__breakdown-row--total {
   margin-top: 0.25rem;
   padding-top: 0.625rem;
-  border-top: 1px solid var(--color-border);
+  border-top: 1px solid var(--c-border);
   font-size: 0.875rem;
 }
 
 .portal-usage__breakdown-row--total .portal-usage__breakdown-label {
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-weight: 600;
 }
 
@@ -254,7 +254,7 @@
   margin: 0;
   font-size: 1rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-usage__plan-card-price {
@@ -267,19 +267,19 @@
 .portal-usage__plan-card-amount {
   font-size: 1.5rem;
   font-weight: 700;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-usage__plan-card-cadence {
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-usage__plan-card-blurb {
   margin: 0;
   font-size: 0.8125rem;
   line-height: 1.45;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-usage__plan-card-features {
@@ -297,7 +297,7 @@
   align-items: flex-start;
   gap: 0.5rem;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-usage__plan-card-check {
@@ -338,18 +338,18 @@
   align-items: center;
   gap: 0.625rem;
   font-size: 0.75rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* Billing history */
 .portal-usage__hist-date {
   font-variant-numeric: tabular-nums;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-usage__hist-amount {
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
   font-variant-numeric: tabular-nums;
 }
 
@@ -370,7 +370,7 @@
   margin: 0 0 1rem;
   font-size: 0.875rem;
   line-height: 1.55;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-usage__modal-bullets {
@@ -387,7 +387,7 @@
   align-items: flex-start;
   gap: 0.5rem;
   font-size: 0.8125rem;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-usage__modal-actions {
diff --git a/frontend/editor/src/portal/views/Users.css b/frontend/editor/src/portal/views/Users.css
index 62c72549bf..75591cc8d8 100644
--- a/frontend/editor/src/portal/views/Users.css
+++ b/frontend/editor/src/portal/views/Users.css
@@ -19,14 +19,14 @@
   margin: 0;
   font-size: 1.375rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-users__sub {
   margin: 0.25rem 0 0;
   font-size: 0.8125rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
   max-width: 46rem;
 }
 
@@ -39,18 +39,18 @@
   margin: 0;
   font-size: 1rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-users__section-sub {
   margin: 0.25rem 0 0;
   font-size: 0.8125rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-users__muted {
   font-size: 0.8125rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -74,7 +74,7 @@
 .portal-users__member-text strong {
   font-size: 0.8125rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-users__row-action {
@@ -86,7 +86,7 @@
   border-radius: var(--radius-md);
   border: 1px solid transparent;
   background: transparent;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-size: 1.125rem;
   line-height: 1;
   cursor: pointer;
@@ -97,9 +97,9 @@
 }
 
 .portal-users__row-action:hover {
-  background: var(--color-bg-hover);
-  border-color: var(--color-border);
-  color: var(--color-text-1);
+  background: var(--c-hover);
+  border-color: var(--c-border);
+  color: var(--c-text);
 }
 
 .portal-users__table-skeleton {
@@ -144,7 +144,7 @@
   margin: 0;
   font-size: 0.75rem;
   line-height: 1.45;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 
 .portal-users__role-perms {
@@ -161,7 +161,7 @@
   padding-left: 0.875rem;
   font-size: 0.6875rem;
   line-height: 1.4;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 .portal-users__role-perms li::before {
@@ -172,7 +172,7 @@
   width: 0.25rem;
   height: 0.25rem;
   border-radius: 50%;
-  background: var(--color-text-5);
+  background: var(--c-text-subtle);
 }
 
 /* ──────────────────────────────────────────────────────────────────────── */
@@ -209,14 +209,14 @@
   margin: 0;
   font-size: 0.875rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 
 .portal-users__access-note {
   margin: 0.5rem 0 0;
   font-size: 0.75rem;
   line-height: 1.45;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 
 .portal-users__access-stats {
@@ -264,8 +264,8 @@
   margin: 0.75rem 0 0;
   padding: 0.5rem 0.75rem;
   border-radius: 8px;
-  background: color-mix(in srgb, var(--sui-danger, #dc2626) 12%, transparent);
-  color: var(--sui-danger, #dc2626);
+  background: color-mix(in srgb, var(--c-danger) 12%, transparent);
+  color: var(--c-danger);
   font-size: 0.85rem;
 }
 
@@ -279,7 +279,7 @@
 }
 
 .portal-users__link {
-  color: var(--color-blue);
+  color: var(--c-primary);
   text-decoration: none;
 }
 .portal-users__link:hover {
@@ -293,8 +293,8 @@
 }
 
 .portal-users__group {
-  background: var(--color-surface);
-  border: 1px solid var(--color-border);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: var(--radius-lg);
   overflow: hidden;
 }
@@ -305,7 +305,7 @@
   justify-content: space-between;
   gap: 1rem;
   padding: 0.75rem 1.25rem;
-  border-bottom: 1px solid var(--color-border-light);
+  border-bottom: 1px solid var(--c-border-subtle);
   background: var(--color-bg-subtle);
 }
 
@@ -319,15 +319,15 @@
 .portal-users__group-title > strong {
   font-size: 0.9rem;
   font-weight: 650;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-users__group-desc {
   font-size: 0.8rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 .portal-users__group-count {
   font-size: 0.78rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   white-space: nowrap;
 }
 .portal-users__group-action {
@@ -337,7 +337,7 @@
   background: none;
   border: none;
   cursor: pointer;
-  color: var(--color-blue);
+  color: var(--c-primary);
   font-size: 0.8rem;
   font-weight: 500;
   white-space: nowrap;
@@ -353,7 +353,7 @@
   padding: 0.7rem 1.25rem;
 }
 .portal-users__row + .portal-users__row {
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 .portal-users__row-main {
   display: flex;
@@ -371,15 +371,15 @@
 .portal-users__row-name {
   font-size: 0.875rem;
   font-weight: 600;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .portal-users__row-you {
   font-weight: 400;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 .portal-users__row-email {
   font-size: 0.78rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   overflow: hidden;
   text-overflow: ellipsis;
 }
@@ -398,7 +398,7 @@
 }
 .portal-users__row-active {
   font-size: 0.78rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   white-space: nowrap;
 }
 .portal-users__row-role {
@@ -420,24 +420,24 @@
 .portal-users__invite-hint {
   margin: 0;
   font-size: 0.78rem;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
 }
 .portal-users__invite-access {
   display: flex;
   flex-direction: column;
   gap: 0.6rem;
   padding-top: 0.75rem;
-  border-top: 1px solid var(--color-border-light);
+  border-top: 1px solid var(--c-border-subtle);
 }
 .portal-users__invite-access-label {
   font-size: 0.78rem;
   font-weight: 600;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .portal-users__form-note {
   margin: 0;
   font-size: 0.8rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 
 @media (max-width: 720px) {
@@ -469,7 +469,7 @@
   border-radius: var(--radius-md);
   border: 1px solid transparent;
   background: transparent;
-  color: var(--color-text-4);
+  color: var(--c-text-subtle);
   font-size: 1.125rem;
   line-height: 1;
   cursor: pointer;
@@ -479,9 +479,9 @@
     border-color var(--motion-fast);
 }
 .portal-users__row-kebab:hover {
-  background: var(--color-bg-hover);
-  border-color: var(--color-border);
-  color: var(--color-text-1);
+  background: var(--c-hover);
+  border-color: var(--c-border);
+  color: var(--c-text);
 }
 
 .portal-users__show-more {
@@ -491,14 +491,14 @@
   text-align: center;
   background: none;
   border: none;
-  border-top: 1px solid var(--color-border-light);
-  color: var(--color-blue);
+  border-top: 1px solid var(--c-border-subtle);
+  color: var(--c-primary);
   font-size: 0.8rem;
   font-weight: 500;
   cursor: pointer;
 }
 .portal-users__show-more:hover {
-  background: var(--color-bg-hover);
+  background: var(--c-hover);
 }
 
 .portal-users__row-tag {
@@ -525,5 +525,5 @@
   margin: 0;
   font-size: 0.875rem;
   line-height: 1.5;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
diff --git a/frontend/editor/src/proprietary/auth/ui/AuthDefaultCredentials.tsx b/frontend/editor/src/proprietary/auth/ui/AuthDefaultCredentials.tsx
index 9d7c7858ed..9f1a6dd3f4 100644
--- a/frontend/editor/src/proprietary/auth/ui/AuthDefaultCredentials.tsx
+++ b/frontend/editor/src/proprietary/auth/ui/AuthDefaultCredentials.tsx
@@ -10,30 +10,17 @@ export default function AuthDefaultCredentials() {
   return (
     <Alert color="blue" variant="light" radius="md" mt="xl">
       <Stack gap="xs" align="center">
-        <Text
-          size="sm"
-          fw={600}
-          ta="center"
-          style={{ color: "var(--text-primary)" }}
-        >
+        <Text size="sm" fw={600} ta="center" style={{ color: "var(--c-text)" }}>
           {t("login.defaultCredentials", "Default Login Credentials")}
         </Text>
-        <Text size="sm" ta="center" style={{ color: "var(--text-primary)" }}>
-          <Text
-            component="span"
-            fw={600}
-            style={{ color: "var(--text-primary)" }}
-          >
+        <Text size="sm" ta="center" style={{ color: "var(--c-text)" }}>
+          <Text component="span" fw={600} style={{ color: "var(--c-text)" }}>
             {t("login.username", "Username")}:
           </Text>{" "}
           admin
         </Text>
-        <Text size="sm" ta="center" style={{ color: "var(--text-primary)" }}>
-          <Text
-            component="span"
-            fw={600}
-            style={{ color: "var(--text-primary)" }}
-          >
+        <Text size="sm" ta="center" style={{ color: "var(--c-text)" }}>
+          <Text component="span" fw={600} style={{ color: "var(--c-text)" }}>
             {t("login.password", "Password")}:
           </Text>{" "}
           stirling
@@ -42,7 +29,7 @@ export default function AuthDefaultCredentials() {
           size="xs"
           ta="center"
           mt="xs"
-          style={{ color: "var(--text-muted)" }}
+          style={{ color: "var(--c-text-subtle)" }}
         >
           {t(
             "login.changePasswordWarning",
diff --git a/frontend/editor/src/proprietary/auth/ui/auth-theme.css b/frontend/editor/src/proprietary/auth/ui/auth-theme.css
index c1b843e804..8580d59e0b 100644
--- a/frontend/editor/src/proprietary/auth/ui/auth-theme.css
+++ b/frontend/editor/src/proprietary/auth/ui/auth-theme.css
@@ -33,20 +33,20 @@
 }
 
 [data-mantine-color-scheme="dark"] {
-  --auth-bg-color: var(--bg-muted);
-  --auth-card-bg: var(--bg-surface);
-  --auth-label-text: var(--text-secondary);
-  --auth-input-border: var(--border-default);
-  --auth-input-bg: var(--bg-raised);
-  --auth-input-text: var(--text-primary);
+  --auth-bg-color: var(--c-surface-sunken);
+  --auth-card-bg: var(--c-surface);
+  --auth-label-text: var(--c-text-muted);
+  --auth-input-border: var(--c-border);
+  --auth-input-bg: var(--c-surface-raised);
+  --auth-input-text: var(--c-text);
   --auth-border-focus: var(--p-blue-500);
   --auth-focus-ring: color-mix(in srgb, var(--p-blue-500) 20%, transparent);
   --auth-button-bg: var(--p-red-600);
   --auth-button-text: #ffffff;
-  --auth-magic-button-bg: var(--bg-raised);
-  --auth-magic-button-text: var(--text-primary);
-  --auth-text-primary: var(--text-primary);
-  --auth-text-secondary: var(--text-secondary);
+  --auth-magic-button-bg: var(--c-surface-raised);
+  --auth-magic-button-text: var(--c-text);
+  --auth-text-primary: var(--c-text);
+  --auth-text-secondary: var(--c-text-muted);
   --auth-error-bg: color-mix(in srgb, var(--p-red-500) 12%, transparent);
   --auth-error-border: color-mix(in srgb, var(--p-red-500) 35%, transparent);
   --auth-error-text: var(--p-red-400);
@@ -59,6 +59,6 @@
   --auth-success-text: var(--p-green-500);
   --text-divider-rule-rgb-light: 28, 35, 64;
   --text-divider-label-rgb-light: 91, 98, 128;
-  --tool-subcategory-rule-color-light: var(--border-default);
-  --tool-subcategory-text-color-light: var(--text-secondary);
+  --tool-subcategory-rule-color-light: var(--c-border);
+  --tool-subcategory-text-color-light: var(--c-text-muted);
 }
diff --git a/frontend/editor/src/proprietary/auth/ui/auth.css b/frontend/editor/src/proprietary/auth/ui/auth.css
index 1745e1d6b3..e4337af2d6 100644
--- a/frontend/editor/src/proprietary/auth/ui/auth.css
+++ b/frontend/editor/src/proprietary/auth/ui/auth.css
@@ -139,7 +139,7 @@
 .auth-checkbox {
   width: 1rem; /* 16px */
   height: 1rem; /* 16px */
-  accent-color: #af3434;
+  accent-color: var(--c-brand);
 }
 
 .auth-terms-label {
@@ -267,25 +267,25 @@
 }
 
 .oauth-button-vertical:hover:not(:disabled) {
-  background-color: var(--hover-bg);
+  background-color: var(--c-hover);
   box-shadow: 0 0.25rem 0.75rem rgba(0, 0, 0, 0.12);
   transform: translateY(-1px);
-  border-color: var(--border-default);
+  border-color: var(--c-border);
 }
 
 .oauth-button-vertical-tinted {
   background: linear-gradient(
     90deg,
-    color-mix(in srgb, var(--oauth-accent) 65%, #0f172a) 0 6px,
-    #0f172a 6px 100%
+    color-mix(in srgb, var(--oauth-accent) 65%, var(--c-text)) 0 6px,
+    var(--c-text) 6px 100%
   );
 }
 
 .oauth-button-vertical-tinted:hover:not(:disabled) {
   background: linear-gradient(
     90deg,
-    color-mix(in srgb, var(--oauth-accent) 75%, #111827) 0 6px,
-    #111827 6px 100%
+    color-mix(in srgb, var(--oauth-accent) 75%, var(--c-text)) 0 6px,
+    var(--c-text) 6px 100%
   );
 }
 
@@ -293,7 +293,7 @@
   min-height: 0;
   justify-content: flex-start;
   padding: 0.75rem 1rem; /* 12px 16px */
-  border: 1px solid #d1d5db;
+  border: 1px solid var(--c-border);
   border-radius: 0.75rem; /* 12px */
   background-color: var(--auth-card-bg);
   font-weight: 500;
@@ -302,7 +302,7 @@
 }
 
 .oauth-button-vertical-legacy:hover:not(:disabled) {
-  background-color: #f3f4f6;
+  background-color: var(--c-hover);
   color: var(--auth-text-primary);
   box-shadow: none;
 }
@@ -331,28 +331,28 @@
 
 .oauth-button-vertical-outline {
   background: transparent;
-  border: 2px solid #0f172a;
-  color: #0f172a;
+  border: 2px solid var(--c-text);
+  color: var(--c-text);
   box-shadow: none;
 }
 
 .oauth-button-vertical-outline:hover:not(:disabled) {
-  background: #0f172a;
-  color: #f8fafc;
-  box-shadow: 0 0.35rem 0.9rem rgba(15, 23, 42, 0.2);
+  background: var(--c-text);
+  color: var(--c-surface);
+  box-shadow: 0 0.35rem 0.9rem rgba(0, 0, 0, 0.2);
 }
 
 .oauth-button-vertical-light {
-  background: #f8fafc;
-  color: #0f172a;
-  border: 1px solid rgba(15, 23, 42, 0.12);
-  box-shadow: 0 0.25rem 0.75rem rgba(15, 23, 42, 0.12);
+  background: var(--c-surface);
+  color: var(--c-text);
+  border: 1px solid var(--c-border);
+  box-shadow: 0 0.25rem 0.75rem rgba(0, 0, 0, 0.12);
 }
 
 .oauth-button-vertical-light:hover:not(:disabled) {
-  background: #eef2f7;
-  color: #0f172a;
-  box-shadow: 0 0.35rem 0.9rem rgba(15, 23, 42, 0.16);
+  background: var(--c-hover);
+  color: var(--c-text);
+  box-shadow: 0 0.35rem 0.9rem rgba(0, 0, 0, 0.16);
 }
 
 .oauth-button-vertical:disabled {
@@ -363,7 +363,7 @@
 }
 
 .oauth-button-vertical:focus-visible {
-  outline: 3px solid rgba(59, 130, 246, 0.5);
+  outline: 3px solid color-mix(in srgb, var(--c-primary) 50%, transparent);
   outline-offset: 2px;
 }
 
@@ -441,7 +441,7 @@
   display: flex;
   align-items: center;
   justify-content: center;
-  background: var(--bg-muted);
+  background: var(--c-surface-sunken);
   border: 1px solid var(--auth-input-border);
 }
 
@@ -460,8 +460,8 @@
 
 .oauth-button-vertical-outline .oauth-icon-wrapper,
 .oauth-button-vertical-light .oauth-icon-wrapper {
-  background: rgba(15, 23, 42, 0.06);
-  border-color: rgba(15, 23, 42, 0.14);
+  background: var(--c-surface-sunken);
+  border-color: var(--c-border);
 }
 .oauth-button-right {
   display: flex;
@@ -616,7 +616,7 @@
 
 .auth-input-error:focus {
   border-color: var(--auth-error-text) !important;
-  box-shadow: 0 0 0 3px rgba(220, 38, 38, 0.1) !important;
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--c-danger) 10%, transparent) !important;
 }
 
 /* Shared auth styles extracted from inline */
@@ -680,18 +680,18 @@
 
 /* Email login button - red CTA style matching SaaS version */
 .auth-cta-button {
-  background-color: #af3434 !important;
+  background-color: var(--c-brand) !important;
   color: white !important;
   border: none !important;
   font-weight: 600 !important;
 }
 
 .auth-cta-button:hover:not(:disabled) {
-  background-color: #9a2e2e !important;
+  background-color: var(--c-brand-hover) !important;
 }
 
 .auth-cta-button:disabled {
-  background-color: #af3434 !important;
+  background-color: var(--c-brand) !important;
   opacity: 0.6 !important;
 }
 
@@ -742,8 +742,8 @@
 }
 
 .auth-expandable-trigger--active {
-  border-color: #af3434 !important;
-  box-shadow: 0 0 0 3px rgba(175, 52, 52, 0.12);
+  border-color: var(--c-brand) !important;
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--c-brand) 12%, transparent);
 }
 
 /* ── Animated expand/collapse via grid-template-rows ───────────────── */
@@ -781,12 +781,12 @@
      own padding-block); horizontal stays in the shorthand. */
   --sui-btn-py: 0.625rem; /* 10px */
   padding: 0.625rem 1rem; /* 10px 16px */
-  border: 1px solid #d1d5db;
+  border: 1px solid var(--c-border);
   border-radius: 0.625rem; /* 10px */
-  background-color: #ffffff;
+  background-color: var(--c-surface);
   font-size: 0.9375rem; /* 15px */
   font-weight: 600;
-  color: #000000;
+  color: var(--c-text);
   cursor: pointer;
   gap: 0.5rem;
   box-shadow: 0 0.125rem 0.375rem rgba(0, 0, 0, 0.04);
@@ -802,20 +802,20 @@
 }
 
 .oauth-button-fullwidth:hover:not(:disabled) {
-  background-color: #fafafa;
+  background-color: var(--c-hover);
   box-shadow: 0 2px 8px rgba(0, 0, 0, 0.08);
 }
 
 [data-mantine-color-scheme="dark"] .oauth-button-fullwidth {
-  background-color: var(--bg-surface);
-  color: var(--text-primary);
-  border-color: var(--border-default);
+  background-color: var(--c-surface);
+  color: var(--c-text);
+  border-color: var(--c-border);
   box-shadow: none;
 }
 
 [data-mantine-color-scheme="dark"]
   .oauth-button-fullwidth:hover:not(:disabled) {
-  background-color: var(--bg-raised);
+  background-color: var(--c-surface-raised);
   box-shadow: none;
 }
 
diff --git a/frontend/editor/src/proprietary/billing/MeterBar.tsx b/frontend/editor/src/proprietary/billing/MeterBar.tsx
index bb15fa44aa..ee03d62885 100644
--- a/frontend/editor/src/proprietary/billing/MeterBar.tsx
+++ b/frontend/editor/src/proprietary/billing/MeterBar.tsx
@@ -1,5 +1,13 @@
 import type { ReactNode } from "react";
 import type { MeterState } from "@app/billing/format";
+import { StatusBadge, type StatusTone } from "@app/ui/StatusBadge";
+
+// Meter state → the shared StatusBadge tone (contrast-tuned per theme).
+const STATE_TONE: Record<MeterState, StatusTone> = {
+  FULL: "success",
+  WARNED: "warning",
+  DEGRADED: "danger",
+};
 
 interface MeterBarProps {
   state: MeterState;
@@ -41,10 +49,9 @@ export function MeterBar({
           <span className="paygf-meter__cap">{capSuffix}</span>
         </div>
         {statusLabel != null && (
-          <span className="payg-status" data-state={state}>
-            <span className="payg-status__dot" />
+          <StatusBadge tone={STATE_TONE[state]} size="sm" showDot>
             {statusLabel}
-          </span>
+          </StatusBadge>
         )}
       </div>
       {showBar && (
diff --git a/frontend/editor/src/proprietary/components/LoginLandingRedirect.tsx b/frontend/editor/src/proprietary/components/LoginLandingRedirect.tsx
index 82dd48ed5a..1df1995d02 100644
--- a/frontend/editor/src/proprietary/components/LoginLandingRedirect.tsx
+++ b/frontend/editor/src/proprietary/components/LoginLandingRedirect.tsx
@@ -107,7 +107,7 @@ export function LoginLandingRedirect() {
           position: "fixed",
           inset: 0,
           zIndex: Z_INDEX_SIGN_IN_MODAL,
-          background: "var(--bg-surface)",
+          background: "var(--c-surface)",
         }}
       >
         <LoadingFallback />
diff --git a/frontend/editor/src/proprietary/components/chat/ChatPanel.css b/frontend/editor/src/proprietary/components/chat/ChatPanel.css
index 58c3ea4619..e95078bcdf 100644
--- a/frontend/editor/src/proprietary/components/chat/ChatPanel.css
+++ b/frontend/editor/src/proprietary/components/chat/ChatPanel.css
@@ -8,7 +8,7 @@
   /* Match the right-rail toolbar background so dark-mode doesn't show a
      lighter card behind the chat, and so the agent-card → pill morph
      doesn't flash a different colour mid-transition. */
-  background: var(--bg-toolbar);
+  background: var(--c-bg-raised);
 }
 
 .chat-panel--embedded {
@@ -31,7 +31,7 @@
   flex: 1;
   min-width: 0;
   padding: 0.4rem 0.75rem 0.4rem 0.4rem;
-  border: 1px solid var(--border-subtle);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 9999px;
   background: var(--mantine-color-body);
   cursor: pointer;
@@ -103,7 +103,7 @@
   border-color: color-mix(
     in srgb,
     var(--mantine-color-blue-5) 60%,
-    var(--border-subtle)
+    var(--c-border-subtle)
   );
 }
 
@@ -111,7 +111,7 @@
   border-color: color-mix(
     in srgb,
     var(--mantine-color-blue-4) 55%,
-    var(--border-subtle)
+    var(--c-border-subtle)
   );
 }
 
@@ -119,14 +119,14 @@
    so it doesn't read as a clashing lighter card on the dark toolbar. */
 [data-mantine-color-scheme="dark"] .chat-panel__agent-pill {
   background: transparent;
-  border-color: var(--border-subtle);
+  border-color: var(--c-border-subtle);
 }
 
 /* The default tertiary accent is blue — use the surface text colour instead so
    the pill label and close icon don't look like interactive links. Overrides
    the Mantine button colour var the shared Button sets inline. */
 .chat-panel__header .sui-btn--tertiary {
-  --button-color: var(--text-primary) !important;
+  --button-color: var(--c-text) !important;
 }
 
 [data-mantine-color-scheme="dark"] .chat-panel__agent-pill:hover {
@@ -146,7 +146,7 @@
 [data-mantine-color-scheme="dark"] .chat-panel-input {
   background: transparent;
   box-shadow:
-    0 0 0 1px var(--border-subtle),
+    0 0 0 1px var(--c-border-subtle),
     0 6px 16px rgba(0, 0, 0, 0.25);
 }
 
@@ -162,7 +162,7 @@
 
 [data-mantine-color-scheme="dark"] .chat-quick-action:hover {
   background: rgba(255, 255, 255, 0.04);
-  border-color: var(--border-subtle);
+  border-color: var(--c-border-subtle);
 }
 
 .chat-panel__agent-pill-label {
@@ -271,8 +271,8 @@
 
 .chat-file-pill--more {
   background: transparent;
-  border: 1px dashed var(--border-subtle);
-  color: var(--text-muted);
+  border: 1px dashed var(--c-border-subtle);
+  color: var(--c-text-subtle);
   cursor: pointer;
   padding: 0.2rem 0.55rem;
 }
@@ -285,7 +285,7 @@
   display: block;
   width: 100%;
   padding: 0.6rem 0.75rem;
-  border: 1px solid var(--border-subtle);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.65rem;
   background: var(--mantine-color-body);
   transition:
@@ -310,6 +310,14 @@
   flex-shrink: 0;
 }
 
+/* Let the label fill the row and align left so the badge sits flush left and
+   the chevron (rightSection) is pushed to the far right. */
+.chat-quick-action .mantine-Button-label {
+  flex: 1;
+  min-width: 0;
+  text-align: left;
+}
+
 /* Input area: send button on the left, textarea fills the rest — one compact
    row so the composer stays short when the welcome screen is fully populated. */
 .chat-panel-input {
@@ -325,7 +333,7 @@
   flex-shrink: 0;
   box-shadow:
     0 0 0 1px rgba(0, 0, 0, 0.04),
-    0 4px 14px rgba(15, 23, 42, 0.08);
+    0 4px 14px rgba(0, 0, 0, 0.08);
   transition: box-shadow 160ms ease-out;
 }
 
@@ -365,7 +373,7 @@
   align-items: center;
   gap: 0.45rem;
   flex-shrink: 0;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 
 .chat-panel-disclaimer__icon {
@@ -377,7 +385,7 @@
 .chat-panel-disclaimer--banner {
   margin: 0.35rem 0.75rem 0;
   padding: 0.6rem 0.75rem;
-  border: 1px solid var(--border-subtle);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.65rem;
   background: var(--mantine-color-gray-light);
   font-size: 0.78rem;
@@ -440,7 +448,7 @@
   border: none;
   border-radius: 0.375rem;
   background: transparent;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   cursor: pointer;
   transition:
     background 100ms ease-out,
@@ -458,7 +466,7 @@
 
 .chat-message-timestamp {
   font-size: 0.7rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   padding: 0 0.25rem;
   white-space: nowrap;
 }
@@ -526,11 +534,11 @@
   line-height: 1.35;
   background: linear-gradient(
     90deg,
-    var(--text-muted) 0%,
-    var(--text-muted) 40%,
+    var(--c-text-subtle) 0%,
+    var(--c-text-subtle) 40%,
     var(--mantine-color-text) 50%,
-    var(--text-muted) 60%,
-    var(--text-muted) 100%
+    var(--c-text-subtle) 60%,
+    var(--c-text-subtle) 100%
   );
   background-size: 200% 100%;
   background-clip: text;
@@ -548,7 +556,7 @@
   height: 20px;
   flex-shrink: 0;
   overflow: hidden;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   animation: chat-phase-pulse 1.6s ease-in-out infinite;
 }
 
@@ -603,7 +611,7 @@
   align-items: center;
   padding: 0.1rem 0.25rem 0.1rem 0.1rem;
   border-radius: 0.35rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   transition: background 120ms ease-out;
 }
 
@@ -640,7 +648,7 @@
   min-width: 1.1rem;
   text-align: right;
   font-size: 0.75rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   font-variant-numeric: tabular-nums;
 }
 
@@ -652,7 +660,7 @@
   height: 18px;
   flex-shrink: 0;
   overflow: hidden;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
 }
 
 .chat-completed-log__tool-name {
@@ -676,8 +684,8 @@
   .chat-progress-live__label {
     animation: none;
     background: none;
-    -webkit-text-fill-color: var(--text-muted);
-    color: var(--text-muted);
+    -webkit-text-fill-color: var(--c-text-subtle);
+    color: var(--c-text-subtle);
   }
   .chat-progress-live__phase-icon {
     animation: none;
diff --git a/frontend/editor/src/proprietary/components/chat/ChatQuickActions.tsx b/frontend/editor/src/proprietary/components/chat/ChatQuickActions.tsx
index f650c953fd..408cb757f3 100644
--- a/frontend/editor/src/proprietary/components/chat/ChatQuickActions.tsx
+++ b/frontend/editor/src/proprietary/components/chat/ChatQuickActions.tsx
@@ -1,6 +1,6 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
-import { Box, Group, Stack, Text } from "@mantine/core";
+import { Box, Stack, Text } from "@mantine/core";
 import { Button } from "@app/ui/Button";
 import { ActionIcon } from "@app/ui/ActionIcon";
 import CloseIcon from "@mui/icons-material/Close";
@@ -32,30 +32,37 @@ function QuickActionCard({ action }: { action: QuickAction }) {
       type="button"
       variant="tertiary"
       hover={false}
+      fullWidth
+      py="sm"
+      justify="start"
       className="chat-quick-action"
       onClick={action.onClick}
       aria-label={action.title}
-    >
-      <Group gap="sm" wrap="nowrap" align="center">
-        <Box className="chat-quick-action__icon">{action.icon}</Box>
-        <Box style={{ minWidth: 0, flex: 1 }}>
-          <Text size="sm" fw={500}>
-            {action.title}
-          </Text>
-          {action.subtitle && (
-            <Text size="xs" c="dimmed" truncate>
-              {action.subtitle}
-            </Text>
-          )}
+      leftSection={
+        <Box className="chat-quick-action__icon" style={{ marginRight: "5px" }}>
+          {action.icon}
         </Box>
+      }
+      rightSection={
         <KeyboardArrowDownIcon
           sx={{
             fontSize: 18,
             transform: "rotate(-90deg)",
-            color: "var(--text-muted)",
+            color: "var(--c-text-subtle)",
           }}
         />
-      </Group>
+      }
+    >
+      <Box style={{ minWidth: 0 }}>
+        <Text size="sm" fw={500}>
+          {action.title}
+        </Text>
+        {action.subtitle && (
+          <Text size="xs" c="dimmed" truncate>
+            {action.subtitle}
+          </Text>
+        )}
+      </Box>
     </Button>
   );
 }
diff --git a/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.css b/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.css
index b967707164..3917f482e6 100644
--- a/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.css
+++ b/frontend/editor/src/proprietary/components/policies/ClassificationCategoryManager.css
@@ -17,17 +17,17 @@
   display: inline-flex;
   align-items: center;
   flex: none;
-  color: var(--color-text-2);
+  color: var(--c-text-muted);
 }
 .category-visibility-name {
   flex: 1;
   min-width: 0;
   font-size: 0.875rem;
-  color: var(--color-text-1);
+  color: var(--c-text);
 }
 .category-visibility-count {
   font-size: 0.75rem;
-  color: var(--color-text-3);
+  color: var(--c-text-subtle);
 }
 /* Hidden categories read as dimmed until re-shown. */
 .category-visibility-row--hidden .category-visibility-icon,
diff --git a/frontend/editor/src/proprietary/components/shared/PolicyEnforcingOverlay.tsx b/frontend/editor/src/proprietary/components/shared/PolicyEnforcingOverlay.tsx
index 92cc4a556f..45dea92070 100644
--- a/frontend/editor/src/proprietary/components/shared/PolicyEnforcingOverlay.tsx
+++ b/frontend/editor/src/proprietary/components/shared/PolicyEnforcingOverlay.tsx
@@ -40,7 +40,7 @@ export function PolicyEnforcingOverlay({
   if (!enforcing) return null;
   return (
     <Overlay
-      color="var(--color-bg)"
+      color="var(--c-bg)"
       backgroundOpacity={0.9}
       blur={4}
       zIndex={zIndex}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/ApiKeys.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/ApiKeys.tsx
index 038cb9a69e..e5ccfdd727 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/ApiKeys.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/ApiKeys.tsx
@@ -72,8 +72,8 @@ export default function ApiKeys() {
         p="md"
         radius="md"
         style={{
-          background: "var(--bg-muted)",
-          border: "1px solid var(--border-subtle)",
+          background: "var(--c-surface-sunken)",
+          border: "1px solid var(--c-border-subtle)",
         }}
       >
         <Group gap="xs" wrap="nowrap" align="flex-start">
@@ -159,8 +159,8 @@ export default function ApiKeys() {
           style={{
             padding: 18,
             borderRadius: 12,
-            background: "var(--api-keys-card-bg)",
-            border: "1px solid var(--api-keys-card-border)",
+            background: "var(--c-surface)",
+            border: "1px solid var(--c-border)",
             boxShadow: "0 2px 8px var(--api-keys-card-shadow)",
           }}
         >
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/PeopleSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/PeopleSection.tsx
index 68c2f49536..10e9f39fb0 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/PeopleSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/PeopleSection.tsx
@@ -640,7 +640,10 @@ export default function PeopleSection() {
                 key={user.id}
                 style={
                   isCurrentUser(user)
-                    ? { backgroundColor: "rgba(34, 139, 230, 0.08)" }
+                    ? {
+                        backgroundColor:
+                          "color-mix(in srgb, var(--c-primary) 8%, transparent)",
+                      }
                     : undefined
                 }
               >
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.tsx
index f05817a957..6a57c9a1e0 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.tsx
@@ -27,8 +27,8 @@ export default function ApiKeySection({
         radius="md"
         p={18}
         style={{
-          background: "var(--api-keys-card-bg)",
-          border: "1px solid var(--api-keys-card-border)",
+          background: "var(--c-surface)",
+          border: "1px solid var(--c-border)",
           boxShadow: "0 2px 8px var(--api-keys-card-shadow)",
         }}
       >
@@ -36,8 +36,8 @@ export default function ApiKeySection({
           <Box style={{ flex: 1 }}>
             <Box
               style={{
-                background: "var(--api-keys-input-bg)",
-                border: "1px solid var(--api-keys-input-border)",
+                background: "var(--c-input-bg)",
+                border: "1px solid var(--c-border)",
                 borderRadius: 8,
                 padding: "8px 12px",
                 fontFamily:
diff --git a/frontend/editor/src/proprietary/components/shared/dividerWithText/DividerWithText.css b/frontend/editor/src/proprietary/components/shared/dividerWithText/DividerWithText.css
index fef222ddd1..ba94d4a6f4 100644
--- a/frontend/editor/src/proprietary/components/shared/dividerWithText/DividerWithText.css
+++ b/frontend/editor/src/proprietary/components/shared/dividerWithText/DividerWithText.css
@@ -30,11 +30,11 @@
 }
 
 .text-divider.subcategory .text-divider__rule {
-  background-color: var(--tool-subcategory-rule-color);
+  background-color: var(--c-border-subtle);
 }
 
 .text-divider.subcategory .text-divider__label {
-  color: var(--tool-subcategory-text-color);
+  color: var(--c-text-subtle);
   text-transform: uppercase;
   font-weight: 600;
 }
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/CardExpansionModal.tsx b/frontend/editor/src/proprietary/components/watchedFolders/CardExpansionModal.tsx
index f5fc841689..b3d379438b 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/CardExpansionModal.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/CardExpansionModal.tsx
@@ -130,7 +130,7 @@ export function CardExpansionModal({
           willChange: "top, left, width, height, opacity",
           borderRadius: "var(--mantine-radius-md)",
           overflow: "hidden",
-          backgroundColor: "var(--bg-toolbar)",
+          backgroundColor: "var(--c-bg-raised)",
           display: "flex",
           flexDirection: "column",
           boxShadow: "0 1.5rem 3rem rgba(0,0,0,0.3)",
@@ -142,7 +142,7 @@ export function CardExpansionModal({
             position: "relative",
             height: headerH,
             flexShrink: 0,
-            borderBottom: "0.0625rem solid var(--border-subtle)",
+            borderBottom: "0.0625rem solid var(--c-border-subtle)",
             overflow: "hidden",
           }}
         >
@@ -221,14 +221,14 @@ export function CardExpansionModal({
               display: "flex",
               flexDirection: "column",
               minHeight: 0,
-              backgroundColor: "var(--bg-toolbar)",
+              backgroundColor: "var(--c-bg-raised)",
             }}
           >
             {toolbar && (
               <div
                 style={{
                   flexShrink: 0,
-                  borderBottom: "0.0625rem solid var(--border-subtle)",
+                  borderBottom: "0.0625rem solid var(--c-border-subtle)",
                 }}
               >
                 {toolbar}
@@ -251,7 +251,7 @@ export function CardExpansionModal({
                 <div
                   style={{
                     padding: "0.75rem 1rem",
-                    backgroundColor: "var(--bg-toolbar)",
+                    backgroundColor: "var(--c-bg-raised)",
                   }}
                 >
                   {children}
@@ -262,7 +262,7 @@ export function CardExpansionModal({
               <div
                 style={{
                   padding: "0.75rem 1rem",
-                  borderTop: "0.0625rem solid var(--border-subtle)",
+                  borderTop: "0.0625rem solid var(--c-border-subtle)",
                   flexShrink: 0,
                 }}
               >
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/StatCard.tsx b/frontend/editor/src/proprietary/components/watchedFolders/StatCard.tsx
index a6a983ca3d..a8d7499878 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/StatCard.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/StatCard.tsx
@@ -30,9 +30,9 @@ export function StatCard({
       style={{
         padding: "0.5rem 0.75rem 2rem",
         borderRadius: "var(--mantine-radius-sm)",
-        border: `0.0625rem solid ${isActive && hoverColor ? hoverColor : "var(--border-subtle)"}`,
+        border: `0.0625rem solid ${isActive && hoverColor ? hoverColor : "var(--c-border-subtle)"}`,
         backgroundColor:
-          isActive && hoverColor ? `${hoverColor}10` : "var(--bg-toolbar)",
+          isActive && hoverColor ? `${hoverColor}10` : "var(--c-bg-raised)",
         textAlign: "center",
         cursor: isClickable ? "pointer" : "default",
         transition: "border-color 0.15s ease, background-color 0.15s ease",
@@ -43,7 +43,7 @@ export function StatCard({
       }}
       onMouseLeave={(e) => {
         if (isClickable && !isActive)
-          e.currentTarget.style.borderColor = "var(--border-subtle)";
+          e.currentTarget.style.borderColor = "var(--c-border-subtle)";
       }}
     >
       <div style={{ display: "block", marginBottom: "0.375rem" }}>{icon}</div>
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderCard.tsx b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderCard.tsx
index 44b2b0c657..90e083fb23 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderCard.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderCard.tsx
@@ -78,7 +78,8 @@ export function WatchedFolderCard({
       style={
         isDragOver
           ? {
-              backgroundColor: "rgba(59,130,246,0.10)",
+              backgroundColor:
+                "color-mix(in srgb, var(--c-primary) 10%, transparent)",
               borderRadius: "var(--mantine-radius-sm)",
             }
           : undefined
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderHomePage.tsx b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderHomePage.tsx
index f1110c9a2a..0f0b2b5bd5 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderHomePage.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderHomePage.tsx
@@ -120,7 +120,7 @@ function FolderCard({
       ? "var(--mantine-color-blue-filled)"
       : isDone
         ? "var(--color-green-500)"
-        : "var(--text-muted)";
+        : "var(--c-text-subtle)";
   const statusDotPulse = isActive;
 
   const statusLabel = isPaused
@@ -197,7 +197,7 @@ function FolderCard({
       <div
         className="wf-card-thumb"
         style={{
-          background: `linear-gradient(135deg, color-mix(in srgb, ${folder.accentColor} 18%, var(--bg-surface)), color-mix(in srgb, ${folder.accentColor} 6%, var(--bg-surface)))`,
+          background: `linear-gradient(135deg, color-mix(in srgb, ${folder.accentColor} 18%, var(--c-surface)), color-mix(in srgb, ${folder.accentColor} 6%, var(--c-surface)))`,
         }}
       >
         <FolderThumbnail
@@ -319,8 +319,8 @@ function HowItWorks() {
       style={{
         padding: "1rem 1.25rem",
         borderRadius: "var(--mantine-radius-md)",
-        border: "0.0625rem solid var(--border-subtle)",
-        backgroundColor: "var(--bg-toolbar)",
+        border: "0.0625rem solid var(--c-border-subtle)",
+        backgroundColor: "var(--c-bg-raised)",
       }}
     >
       <Group gap="xs" mb="sm" justify="space-between">
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderManagementModal.tsx b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderManagementModal.tsx
index 362d4cf7b0..9093c84d4b 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderManagementModal.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderManagementModal.tsx
@@ -58,7 +58,7 @@ function SectionLabel({ children }: { children: string }) {
       tt="uppercase"
       style={{
         letterSpacing: "0.06em",
-        color: "var(--tool-subcategory-text-color)",
+        color: "var(--c-text-subtle)",
         marginBottom: "0.5rem",
       }}
     >
@@ -330,7 +330,7 @@ export function WatchedFolderManagementModal({
           style={{
             width: "28rem",
             flexShrink: 0,
-            borderRight: "0.0625rem solid var(--border-subtle)",
+            borderRight: "0.0625rem solid var(--c-border-subtle)",
             display: "flex",
             flexDirection: "column",
             overflow: "hidden",
@@ -439,7 +439,7 @@ export function WatchedFolderManagementModal({
                       style={{
                         marginLeft: "0.75rem",
                         paddingLeft: "0.75rem",
-                        borderLeft: "2px solid var(--border-subtle)",
+                        borderLeft: "2px solid var(--c-border-subtle)",
                       }}
                     >
                       <Box
@@ -532,7 +532,7 @@ export function WatchedFolderManagementModal({
                     style={{
                       padding: "0.5rem 0.75rem",
                       borderRadius: "var(--mantine-radius-sm)",
-                      border: `0.0625rem solid ${outputDirName ? "var(--mantine-color-green-filled)" : "var(--border-subtle)"}`,
+                      border: `0.0625rem solid ${outputDirName ? "var(--mantine-color-green-filled)" : "var(--c-border-subtle)"}`,
                       backgroundColor: outputDirName
                         ? "var(--mantine-color-green-light)"
                         : "transparent",
@@ -628,7 +628,7 @@ export function WatchedFolderManagementModal({
                     gap: "0.35rem",
                     padding: "0.25rem 0",
                     width: "100%",
-                    color: "var(--tool-subcategory-text-color)",
+                    color: "var(--c-text-subtle)",
                     fontSize: "0.7rem",
                     fontWeight: 600,
                     letterSpacing: "0.06em",
@@ -810,7 +810,7 @@ export function WatchedFolderManagementModal({
           <div
             style={{
               padding: "1rem 1.5rem",
-              borderTop: "0.0625rem solid var(--border-subtle)",
+              borderTop: "0.0625rem solid var(--c-border-subtle)",
               flexShrink: 0,
             }}
           >
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderSection.tsx b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderSection.tsx
index 67073a023a..94783a0929 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderSection.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderSection.tsx
@@ -78,8 +78,8 @@ export function WatchedFolderSection() {
   return (
     <Box
       style={{
-        borderTop: "1px solid var(--border-subtle)",
-        backgroundColor: "var(--bg-toolbar)",
+        borderTop: "1px solid var(--c-border-subtle)",
+        backgroundColor: "var(--c-bg-raised)",
         display: "flex",
         flexDirection: "column",
         height: "100%",
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderWorkbenchView.tsx b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderWorkbenchView.tsx
index 4954cebfc3..f77bcf0cb5 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderWorkbenchView.tsx
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolderWorkbenchView.tsx
@@ -852,8 +852,8 @@ export function WatchedFolderWorkbenchView({
         px="xl"
         py="md"
         style={{
-          borderBottom: "0.0625rem solid var(--border-subtle)",
-          backgroundColor: "var(--bg-toolbar)",
+          borderBottom: "0.0625rem solid var(--c-border-subtle)",
+          backgroundColor: "var(--c-bg-raised)",
           flexShrink: 0,
         }}
       >
@@ -893,7 +893,7 @@ export function WatchedFolderWorkbenchView({
                   width: "0.75rem",
                   height: "0.75rem",
                   borderRadius: "50%",
-                  backgroundColor: "var(--bg-toolbar)",
+                  backgroundColor: "var(--c-bg-raised)",
                   textAlign: "center",
                   display: "flex",
                   alignItems: "center",
@@ -1221,7 +1221,7 @@ export function WatchedFolderWorkbenchView({
                     style={{
                       height: "0.1875rem",
                       borderRadius: "999px",
-                      backgroundColor: "var(--border-subtle)",
+                      backgroundColor: "var(--c-border-subtle)",
                       overflow: "hidden",
                     }}
                   >
@@ -1263,7 +1263,7 @@ export function WatchedFolderWorkbenchView({
                 flex: 1,
                 color: isDragOver
                   ? "var(--mantine-color-blue-filled)"
-                  : "var(--tool-subcategory-text-color)",
+                  : "var(--c-text-subtle)",
                 textTransform: "uppercase",
                 letterSpacing: "0.05em",
               }}
@@ -1361,8 +1361,8 @@ export function WatchedFolderWorkbenchView({
                 <Box
                   style={{
                     padding: "0.375rem 0.75rem",
-                    borderTop: "0.0625rem solid var(--border-subtle)",
-                    borderBottom: "0.0625rem solid var(--border-subtle)",
+                    borderTop: "0.0625rem solid var(--c-border-subtle)",
+                    borderBottom: "0.0625rem solid var(--c-border-subtle)",
                     backgroundColor: "var(--mantine-color-blue-light)",
                     display: "flex",
                     alignItems: "center",
@@ -1502,10 +1502,10 @@ export function WatchedFolderWorkbenchView({
                         key={fileId}
                         style={{
                           borderRadius: "var(--mantine-radius-sm)",
-                          border: `0.0625rem solid ${isFocused ? "var(--mantine-color-blue-4)" : isSelected ? "var(--mantine-color-blue-filled)" : status === "error" ? "var(--mantine-color-red-light)" : "var(--border-subtle)"}`,
+                          border: `0.0625rem solid ${isFocused ? "var(--mantine-color-blue-4)" : isSelected ? "var(--mantine-color-blue-filled)" : status === "error" ? "var(--mantine-color-red-light)" : "var(--c-border-subtle)"}`,
                           backgroundColor: isSelected
                             ? "var(--mantine-color-blue-light)"
-                            : "var(--bg-toolbar)",
+                            : "var(--c-bg-raised)",
                           overflow: "hidden",
                           outline: "none",
                         }}
@@ -1722,7 +1722,7 @@ export function WatchedFolderWorkbenchView({
                         {isExpanded && (
                           <Box
                             style={{
-                              borderTop: `0.0625rem solid ${status === "error" ? "var(--mantine-color-red-light)" : "var(--border-subtle)"}`,
+                              borderTop: `0.0625rem solid ${status === "error" ? "var(--mantine-color-red-light)" : "var(--c-border-subtle)"}`,
                               padding: "0.375rem 0.625rem 0.375rem 2rem",
                               backgroundColor: "var(--bg-app)",
                             }}
@@ -2194,7 +2194,7 @@ export function WatchedFolderWorkbenchView({
                     style={{
                       flex: 1,
                       position: "relative",
-                      borderBottom: "0.0625rem solid var(--border-subtle)",
+                      borderBottom: "0.0625rem solid var(--c-border-subtle)",
                     }}
                   >
                     {[0, 25, 50, 75].map((pct) => (
@@ -2205,7 +2205,7 @@ export function WatchedFolderWorkbenchView({
                           top: `${pct}%`,
                           left: 0,
                           right: 0,
-                          borderTop: "0.0625rem dashed var(--border-subtle)",
+                          borderTop: "0.0625rem dashed var(--c-border-subtle)",
                           pointerEvents: "none",
                         }}
                       />
@@ -2245,8 +2245,9 @@ export function WatchedFolderWorkbenchView({
                                   ? `calc(100% - ${chartHover.relX}px + 12px)`
                                   : undefined,
                                 top: Math.max(chartHover.relY - 36, 4),
-                                backgroundColor: "var(--bg-toolbar)",
-                                border: "0.0625rem solid var(--border-subtle)",
+                                backgroundColor: "var(--c-bg-raised)",
+                                border:
+                                  "0.0625rem solid var(--c-border-subtle)",
                                 borderRadius: "var(--mantine-radius-sm)",
                                 padding: "0.3rem 0.5rem",
                                 pointerEvents: "none",
diff --git a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolders.css b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolders.css
index d41693db12..86c20d5b6e 100644
--- a/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolders.css
+++ b/frontend/editor/src/proprietary/components/watchedFolders/WatchedFolders.css
@@ -26,8 +26,8 @@
   position: relative;
   display: flex;
   flex-direction: column;
-  background: var(--bg-surface);
-  border: 1px solid var(--border-subtle);
+  background: var(--c-surface);
+  border: 1px solid var(--c-border-subtle);
   border-radius: 0.85rem;
   overflow: hidden;
   cursor: pointer;
@@ -42,8 +42,8 @@
   transform: translateY(-2px);
   border-color: color-mix(
     in srgb,
-    var(--accent-interactive, #6366f1) 35%,
-    var(--border-subtle)
+    var(--c-primary) 35%,
+    var(--c-border-subtle)
   );
   box-shadow:
     0 4px 6px -1px rgba(0, 0, 0, 0.08),
@@ -51,25 +51,21 @@
 }
 
 .wf-card:focus-visible {
-  outline: 2px solid var(--accent-interactive, #6366f1);
+  outline: 2px solid var(--c-primary);
   outline-offset: 2px;
 }
 
 .wf-card.is-drop-target {
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 10%,
-    var(--bg-surface)
-  );
-  box-shadow: 0 0 0 2px var(--accent-interactive, #6366f1);
-  border-color: var(--accent-interactive, #6366f1);
+  background: color-mix(in srgb, var(--c-primary) 10%, var(--c-surface));
+  box-shadow: 0 0 0 2px var(--c-primary);
+  border-color: var(--c-primary);
 }
 
 /* Dragging a file the folder already contains — signal it's a no-op, not an add. */
 .wf-card.is-already-member {
-  background: color-mix(in srgb, #f59e0b 8%, var(--bg-surface));
-  box-shadow: 0 0 0 2px #f59e0b;
-  border-color: #f59e0b;
+  background: color-mix(in srgb, var(--c-warning) 8%, var(--c-surface));
+  box-shadow: 0 0 0 2px var(--c-warning);
+  border-color: var(--c-warning);
 }
 
 .wf-card-drag-message {
@@ -83,8 +79,8 @@
   padding: 0.5rem;
   font-size: 0.8rem;
   font-weight: 600;
-  color: var(--text-primary);
-  background: color-mix(in srgb, var(--bg-surface) 72%, transparent);
+  color: var(--c-text);
+  background: color-mix(in srgb, var(--c-surface) 72%, transparent);
   backdrop-filter: blur(1px);
   border-radius: inherit;
   /* Let drag/drop events pass through to the card underneath. */
@@ -97,8 +93,8 @@
   justify-content: center;
   background: linear-gradient(
     180deg,
-    color-mix(in srgb, var(--text-muted) 5%, var(--bg-surface)),
-    var(--bg-surface)
+    color-mix(in srgb, var(--c-text-subtle) 5%, var(--c-surface)),
+    var(--c-surface)
   );
   aspect-ratio: 1.6 / 1;
   padding: 0.75rem;
@@ -118,13 +114,13 @@
   white-space: nowrap;
   overflow: hidden;
   text-overflow: ellipsis;
-  color: var(--text-primary);
+  color: var(--c-text);
   letter-spacing: -0.005em;
 }
 
 .wf-card-meta {
   font-size: 0.76rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   display: flex;
   align-items: center;
   gap: 0.4rem;
@@ -166,12 +162,12 @@
   justify-content: center;
   gap: 0.5rem;
   text-align: center;
-  background: var(--bg-surface);
-  border: 1.5px dashed var(--border-subtle);
+  background: var(--c-surface);
+  border: 1.5px dashed var(--c-border-subtle);
   border-radius: 0.85rem;
   padding: 1rem;
   cursor: pointer;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   min-height: 9rem;
   transition:
     border-color 0.14s ease,
@@ -180,13 +176,9 @@
 }
 
 .wf-new-tile:hover {
-  border-color: var(--accent-interactive, #6366f1);
-  color: var(--accent-interactive, #6366f1);
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 6%,
-    var(--bg-surface)
-  );
+  border-color: var(--c-primary);
+  color: var(--c-primary);
+  background: color-mix(in srgb, var(--c-primary) 6%, var(--c-surface));
 }
 
 .wf-new-tile-icon {
@@ -196,12 +188,8 @@
   width: 3rem;
   height: 3rem;
   border-radius: 50%;
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 12%,
-    transparent
-  );
-  color: var(--accent-interactive, #6366f1);
+  background: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  color: var(--c-primary);
 }
 
 .wf-empty {
@@ -211,7 +199,7 @@
   justify-content: center;
   gap: 0.75rem;
   padding: 4rem 1.5rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   text-align: center;
 }
 
@@ -222,25 +210,21 @@
   width: 5rem;
   height: 5rem;
   border-radius: 50%;
-  background: color-mix(
-    in srgb,
-    var(--accent-interactive, #6366f1) 12%,
-    transparent
-  );
-  color: var(--accent-interactive, #6366f1);
+  background: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  color: var(--c-primary);
   margin-bottom: 0.25rem;
 }
 
 .wf-empty-title {
   font-size: 1.15rem;
-  color: var(--text-primary);
+  color: var(--c-text);
   font-weight: 600;
   letter-spacing: -0.01em;
 }
 
 .wf-empty-hint {
   font-size: 0.9rem;
-  color: var(--text-muted);
+  color: var(--c-text-subtle);
   max-width: 30rem;
   line-height: 1.5;
 }
diff --git a/frontend/editor/src/proprietary/routes/Landing.tsx b/frontend/editor/src/proprietary/routes/Landing.tsx
index c377df1794..acb6a6e9c8 100644
--- a/frontend/editor/src/proprietary/routes/Landing.tsx
+++ b/frontend/editor/src/proprietary/routes/Landing.tsx
@@ -142,11 +142,13 @@ export default function Landing() {
             padding: "1.5rem",
             marginTop: "1rem",
             borderRadius: "0.75rem",
-            backgroundColor: "rgba(37, 99, 235, 0.08)",
-            border: "1px solid rgba(37, 99, 235, 0.2)",
+            backgroundColor:
+              "color-mix(in srgb, var(--c-primary) 8%, transparent)",
+            border:
+              "1px solid color-mix(in srgb, var(--c-primary) 20%, transparent)",
           }}
         >
-          <p style={{ margin: "0 0 0.75rem 0", color: "var(--text-primary)" }}>
+          <p style={{ margin: "0 0 0.75rem 0", color: "var(--c-text)" }}>
             {t(
               "backendStartup.unreachable",
               "The application cannot currently connect to the backend. Verify the backend status and network connectivity, then try again.",
diff --git a/frontend/editor/src/proprietary/routes/Login.tsx b/frontend/editor/src/proprietary/routes/Login.tsx
index b21b9e1dd6..3e6764bf60 100644
--- a/frontend/editor/src/proprietary/routes/Login.tsx
+++ b/frontend/editor/src/proprietary/routes/Login.tsx
@@ -440,11 +440,13 @@ export default function Login() {
             padding: "1.5rem",
             marginTop: "1rem",
             borderRadius: "0.75rem",
-            backgroundColor: "rgba(37, 99, 235, 0.08)",
-            border: "1px solid rgba(37, 99, 235, 0.2)",
+            backgroundColor:
+              "color-mix(in srgb, var(--c-primary) 8%, transparent)",
+            border:
+              "1px solid color-mix(in srgb, var(--c-primary) 20%, transparent)",
           }}
         >
-          <p style={{ margin: "0 0 0.75rem 0", color: "var(--text-primary)" }}>
+          <p style={{ margin: "0 0 0.75rem 0", color: "var(--c-text)" }}>
             {t(
               "backendStartup.unreachable",
               "The application cannot currently connect to the backend. Verify the backend status and network connectivity, then try again.",
@@ -480,10 +482,12 @@ export default function Login() {
               style={{
                 padding: "1rem",
                 marginBottom: "1rem",
-                backgroundColor: "rgba(34, 197, 94, 0.1)",
-                border: "1px solid rgba(34, 197, 94, 0.3)",
+                backgroundColor:
+                  "color-mix(in srgb, var(--c-success) 10%, transparent)",
+                border:
+                  "1px solid color-mix(in srgb, var(--c-success) 30%, transparent)",
                 borderRadius: "0.5rem",
-                color: "#16a34a",
+                color: "var(--c-success)",
               }}
             >
               <p
diff --git a/frontend/editor/src/proprietary/routes/login/LoggedInState.tsx b/frontend/editor/src/proprietary/routes/login/LoggedInState.tsx
index a8c2d5c7cd..b990dba4e0 100644
--- a/frontend/editor/src/proprietary/routes/login/LoggedInState.tsx
+++ b/frontend/editor/src/proprietary/routes/login/LoggedInState.tsx
@@ -24,7 +24,7 @@ export default function LoggedInState() {
         display: "flex",
         alignItems: "center",
         justifyContent: "center",
-        backgroundColor: "#f3f4f6",
+        backgroundColor: "var(--c-bg)",
         padding: "16px",
       }}
     >
@@ -32,7 +32,7 @@ export default function LoggedInState() {
         style={{
           maxWidth: "400px",
           width: "100%",
-          backgroundColor: "#ffffff",
+          backgroundColor: "var(--c-surface)",
           borderRadius: "16px",
           boxShadow: "0 10px 25px rgba(0, 0, 0, 0.1)",
           padding: "32px",
@@ -55,19 +55,19 @@ export default function LoggedInState() {
             style={{
               fontSize: "24px",
               fontWeight: "bold",
-              color: "#059669",
+              color: "var(--c-success)",
               marginBottom: "8px",
             }}
           >
             {t("login.youAreLoggedIn")}
           </h1>
-          <p style={{ color: "#6b7280", fontSize: "14px" }}>
+          <p style={{ color: "var(--c-text-subtle)", fontSize: "14px" }}>
             {t("login.email")}: {user?.email}
           </p>
         </div>
 
         <div style={{ textAlign: "center", marginTop: "16px" }}>
-          <p style={{ color: "#6b7280", fontSize: "14px" }}>
+          <p style={{ color: "var(--c-text-subtle)", fontSize: "14px" }}>
             Redirecting to home...
           </p>
         </div>
diff --git a/frontend/editor/src/saas/components/auth/GuestUserBanner.css b/frontend/editor/src/saas/components/auth/GuestUserBanner.css
index 40ef91adc7..2dc1ba528d 100644
--- a/frontend/editor/src/saas/components/auth/GuestUserBanner.css
+++ b/frontend/editor/src/saas/components/auth/GuestUserBanner.css
@@ -3,8 +3,8 @@
   top: 1rem;
   right: 4.5rem;
   z-index: 1000;
-  background: var(--modal-content-bg, #111418);
-  border: 1px solid var(--api-keys-card-border, rgba(255, 255, 255, 0.08));
+  background: var(--c-surface);
+  border: 1px solid var(--c-border);
   border-radius: 12px;
   box-shadow: 0 6px 24px rgba(0, 0, 0, 0.35);
   padding: 12px 16px;
diff --git a/frontend/editor/src/saas/components/shared/AppConfigModal.tsx b/frontend/editor/src/saas/components/shared/AppConfigModal.tsx
index 32def0b196..3f7b4de5ab 100644
--- a/frontend/editor/src/saas/components/shared/AppConfigModal.tsx
+++ b/frontend/editor/src/saas/components/shared/AppConfigModal.tsx
@@ -130,13 +130,13 @@ const AppConfigModal: React.FC<AppConfigModalProps> = ({
 
   const colors = useMemo(
     () => ({
-      navBg: "var(--modal-nav-bg)",
-      sectionTitle: "var(--modal-nav-section-title)",
+      navBg: "var(--c-bg-raised)",
+      sectionTitle: "var(--c-text-subtle)",
       navItem: "var(--modal-nav-item)",
-      navItemActive: "var(--modal-nav-item-active)",
-      navItemActiveBg: "var(--modal-nav-item-active-bg)",
-      contentBg: "var(--modal-content-bg)",
-      headerBorder: "var(--modal-header-border)",
+      navItemActive: "var(--c-accent-fg)",
+      navItemActiveBg: "var(--c-primary-subtle)",
+      contentBg: "var(--c-surface)",
+      headerBorder: "var(--c-border-subtle)",
     }),
     [],
   );
diff --git a/frontend/editor/src/saas/components/shared/charts/StackedBarChart.css b/frontend/editor/src/saas/components/shared/charts/StackedBarChart.css
index afb382969b..04c19f5f02 100644
--- a/frontend/editor/src/saas/components/shared/charts/StackedBarChart.css
+++ b/frontend/editor/src/saas/components/shared/charts/StackedBarChart.css
@@ -1,6 +1,6 @@
 .chart-tooltip {
-  background: var(--bg-surface);
-  color: var(--text-primary);
+  background: var(--c-surface);
+  color: var(--c-text);
   border: 1px solid transparent;
   box-shadow: var(--shadow-md);
   padding: 8px 10px;
@@ -9,6 +9,6 @@
   border-radius: 8px;
 }
 [data-mantine-color-scheme="dark"] .chart-tooltip {
-  border-color: var(--border-subtle);
+  border-color: var(--c-border-subtle);
   box-shadow: none;
 }
diff --git a/frontend/editor/src/saas/components/shared/charts/StackedBarChart.tsx b/frontend/editor/src/saas/components/shared/charts/StackedBarChart.tsx
index b1ba0ed3ac..5f56843dae 100644
--- a/frontend/editor/src/saas/components/shared/charts/StackedBarChart.tsx
+++ b/frontend/editor/src/saas/components/shared/charts/StackedBarChart.tsx
@@ -108,7 +108,7 @@ export default function StackedBarChart({
         .attr("rx", radius)
         .attr("ry", radius)
         .attr("fill", "var(--usage-inactive)")
-        .attr("stroke", "var(--api-keys-card-border)");
+        .attr("stroke", "var(--c-border)");
 
       // Define a clipPath that will reveal the used portion from left to right
       const defs = svg.append("defs");
@@ -308,7 +308,7 @@ export default function StackedBarChart({
                 background: "var(--usage-inactive)",
                 display: "inline-block",
                 borderRadius: 2,
-                outline: "1px solid var(--api-keys-card-border)",
+                outline: "1px solid var(--c-border)",
               }}
             />
             <Text size="sm">{t("common.remaining", "Remaining")}</Text>
diff --git a/frontend/editor/src/saas/components/shared/config/configSections/ApiKeys.tsx b/frontend/editor/src/saas/components/shared/config/configSections/ApiKeys.tsx
index 4d65073f71..19883e5531 100644
--- a/frontend/editor/src/saas/components/shared/config/configSections/ApiKeys.tsx
+++ b/frontend/editor/src/saas/components/shared/config/configSections/ApiKeys.tsx
@@ -74,8 +74,8 @@ export default function ApiKeys() {
           radius="md"
           p={18}
           style={{
-            background: "var(--api-keys-card-bg)",
-            border: "1px solid var(--api-keys-card-border)",
+            background: "var(--c-surface)",
+            border: "1px solid var(--c-border)",
             boxShadow: "0 2px 8px var(--api-keys-card-shadow)",
           }}
         >
@@ -111,8 +111,8 @@ export default function ApiKeys() {
             style={{
               padding: 18,
               borderRadius: 12,
-              background: "var(--api-keys-card-bg)",
-              border: "1px solid var(--api-keys-card-border)",
+              background: "var(--c-surface)",
+              border: "1px solid var(--c-border)",
               boxShadow: "0 2px 8px var(--api-keys-card-shadow)",
             }}
           >
diff --git a/frontend/editor/src/saas/routes/Login.tsx b/frontend/editor/src/saas/routes/Login.tsx
index 3a18322d06..ab75b7bb79 100644
--- a/frontend/editor/src/saas/routes/Login.tsx
+++ b/frontend/editor/src/saas/routes/Login.tsx
@@ -334,7 +334,7 @@ export default function Login() {
                   <p
                     style={{
                       fontSize: "0.875rem",
-                      color: "#059669",
+                      color: "var(--c-success)",
                       margin: 0,
                     }}
                   >
@@ -429,7 +429,7 @@ export default function Login() {
             cursor: "pointer",
             fontSize: "1rem",
             fontWeight: 700,
-            color: "var(--text-primary)",
+            color: "var(--c-text)",
           }}
         >
           {isSigningIn
@@ -454,7 +454,7 @@ export default function Login() {
             border: "none",
             cursor: "pointer",
             fontSize: "0.875rem",
-            color: "#9ca3af",
+            color: "var(--c-text-subtle)",
           }}
         >
           {t("login.createAccount", "Create an account")}
diff --git a/frontend/editor/src/saas/routes/Signup.tsx b/frontend/editor/src/saas/routes/Signup.tsx
index 3c34626168..942cfefb5a 100644
--- a/frontend/editor/src/saas/routes/Signup.tsx
+++ b/frontend/editor/src/saas/routes/Signup.tsx
@@ -260,7 +260,7 @@ export default function Signup() {
             cursor: "pointer",
             fontSize: "1rem",
             fontWeight: 700,
-            color: "var(--text-primary)",
+            color: "var(--c-text)",
           }}
         >
           {isSigningUp
@@ -285,7 +285,7 @@ export default function Signup() {
             border: "none",
             cursor: "pointer",
             fontSize: "0.875rem",
-            color: "#9ca3af",
+            color: "var(--c-text-subtle)",
           }}
         >
           {t("signup.alreadyHaveAccount", "I already have an account")}
diff --git a/frontend/editor/src/saas/routes/authShared/saas-auth.css b/frontend/editor/src/saas/routes/authShared/saas-auth.css
index 96d97f695c..23067d77f9 100644
--- a/frontend/editor/src/saas/routes/authShared/saas-auth.css
+++ b/frontend/editor/src/saas/routes/authShared/saas-auth.css
@@ -14,9 +14,9 @@
   z-index: 40;
   margin-top: 0.5rem;
   min-width: 16rem;
-  background-color: #ffffff;
-  color: #000000;
-  border: 1px solid #e5e7eb;
+  background-color: var(--c-surface);
+  color: var(--c-text);
+  border: 1px solid var(--c-border);
   border-radius: 0.5rem;
   box-shadow:
     0 10px 15px -3px rgba(0, 0, 0, 0.1),
@@ -25,9 +25,6 @@
 }
 
 [data-mantine-color-scheme="dark"] .auth-dropdown {
-  background-color: var(--bg-surface);
-  color: var(--text-primary);
-  border-color: var(--border-default);
   box-shadow: var(--shadow-md);
 }
 
@@ -39,17 +36,13 @@
   border: none;
   padding: 0.5rem 0.75rem;
   border-radius: 0.375rem;
-  color: #000;
+  color: var(--c-text);
   cursor: pointer;
 }
 
-[data-mantine-color-scheme="dark"] .auth-dropdown-item {
-  color: var(--text-primary);
-}
-
 .auth-guest-button {
-  background-color: #ffffff;
-  color: #9c2f30;
+  background-color: var(--c-surface);
+  color: var(--c-brand);
   border: 2px solid currentColor;
 }
 
@@ -93,8 +86,8 @@
 }
 
 .auth-expandable-trigger--active {
-  border-color: #af3434 !important;
-  box-shadow: 0 0 0 3px rgba(175, 52, 52, 0.12);
+  border-color: var(--c-brand) !important;
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--c-brand) 12%, transparent);
 }
 
 /* ── Animated expand/collapse via grid-template-rows ───────────────── */
diff --git a/frontend/editor/src/saas/styles/saas-theme.css b/frontend/editor/src/saas/styles/saas-theme.css
index 44a016eb5d..0d6b0d4940 100644
--- a/frontend/editor/src/saas/styles/saas-theme.css
+++ b/frontend/editor/src/saas/styles/saas-theme.css
@@ -119,20 +119,20 @@
   --color-orange-400: var(--p-red-600);
 
   /* Auth page colors (dark mode) — mirror proprietary so the auth card themes dark */
-  --auth-bg-color: var(--bg-muted);
-  --auth-card-bg: var(--bg-surface);
-  --auth-label-text: var(--text-secondary);
-  --auth-input-border: var(--border-default);
-  --auth-input-bg: var(--bg-raised);
-  --auth-input-text: var(--text-primary);
+  --auth-bg-color: var(--c-surface-sunken);
+  --auth-card-bg: var(--c-surface);
+  --auth-label-text: var(--c-text-muted);
+  --auth-input-border: var(--c-border);
+  --auth-input-bg: var(--c-surface-raised);
+  --auth-input-text: var(--c-text);
   --auth-border-focus: var(--p-blue-500);
   --auth-focus-ring: color-mix(in srgb, var(--p-blue-500) 20%, transparent);
   --auth-button-bg: var(--p-red-600);
   --auth-button-text: #ffffff;
-  --auth-magic-button-bg: var(--bg-raised);
-  --auth-magic-button-text: var(--text-primary);
-  --auth-text-primary: var(--text-primary);
-  --auth-text-secondary: var(--text-secondary);
+  --auth-magic-button-bg: var(--c-surface-raised);
+  --auth-magic-button-text: var(--c-text);
+  --auth-text-primary: var(--c-text);
+  --auth-text-secondary: var(--c-text-muted);
   --auth-error-bg: color-mix(in srgb, var(--p-red-500) 12%, transparent);
   --auth-error-border: color-mix(in srgb, var(--p-red-500) 35%, transparent);
   --auth-error-text: var(--p-red-400);

From 1e2895a79f92a41abce7a5105bfabc9bdc85f373 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Thu, 23 Jul 2026 11:18:39 +0000
Subject: [PATCH 088/109] Add external-API integrations plus pipeline steps
 (#7098)

New Generic API mode with examples and integrations setup around it

- Adds an integration operations catalogue so external-API connections
(e.g. Microsoft Purview) can be used as policy pipeline steps
- New generic external-API step calls a configured connection during a
policy run, with a verdict gate to pass/fail documents on the response
- Purview sensitivity-labelling step applies labels to processed
documents, gated behind the Purview connection being configured (WIP to
be changed later)

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../common/model/ApplicationProperties.java   |  21 +
 .../common/service/InternalApiClient.java     |   7 +-
 .../access/service/SecretMasker.java          |  69 ++
 .../integration/api/ApiAuthType.java          |  25 +
 .../api/ApiConnectionResolver.java            | 130 +++
 .../api/ApiConnectionSettings.java            | 282 ++++++
 .../api/ApiIntegrationValidator.java          | 109 +++
 .../integration/api/ApiTokenCache.java        | 149 ++++
 .../integration/api/ApiTokenLogin.java        | 209 +++++
 .../integration/api/DocumentContext.java      | 180 ++++
 .../api/ExternalApiCallController.java        | 552 ++++++++++++
 .../integration/api/ExternalApiCaller.java    | 299 +++++++
 .../integration/api/ExternalApiHeaders.java   |  72 ++
 .../integration/api/ExternalApiPaths.java     | 120 +++
 .../api/IntegrationStepValidator.java         |  68 ++
 .../integration/api/MultipartBody.java        | 101 +++
 .../integration/api/Placeholders.java         | 153 ++++
 .../integration/api/ResultFiles.java          | 215 +++++
 .../integration/api/ResultUrls.java           | 108 +++
 .../IntegrationConfigController.java          |  19 +
 .../integration/model/IntegrationType.java    |   7 +-
 .../purview/PdfSensitivityLabels.java         | 323 +++++++
 .../purview/PurviewConnectionSettings.java    |  94 ++
 .../purview/PurviewIntegrationValidator.java  |  23 +
 .../purview/PurviewLabelController.java       | 184 ++++
 .../integration/purview/SensitivityLabel.java | 186 ++++
 .../service/IntegrationConfigService.java     |  32 +
 .../policy/controller/PolicyController.java   |  28 +-
 .../policy/engine/PipelineStepValidator.java  |  22 +
 .../policy/engine/PolicyValidator.java        |  28 +-
 .../access/service/SecretMaskerTest.java      |  42 +
 .../api/ApiIntegrationValidatorTest.java      |  76 ++
 .../integration/api/DocumentContextTest.java  | 177 ++++
 .../ExternalApiCallControllerLiveTest.java    | 615 +++++++++++++
 .../api/ExternalApiCallerAuthHeaderTest.java  | 145 +++
 .../api/ExternalApiCallerTokenLoginTest.java  | 296 ++++++
 .../integration/api/ExternalApiPathsTest.java | 135 +++
 .../integration/api/MultipartBodyTest.java    | 111 +++
 .../api/PlaceholdersTemplateTest.java         | 110 +++
 .../integration/api/PlaceholdersTest.java     | 127 +++
 .../integration/api/ResultUrlsTest.java       | 193 ++++
 .../purview/PdfSensitivityLabelsTest.java     | 282 ++++++
 .../service/IntegrationConfigServiceTest.java | 106 ++-
 .../policy/engine/PolicyValidatorTest.java    |   7 +-
 .../public/locales/en-US/translation.toml     | 541 ++++++++++-
 .../editor/src/core/i18n/translationAudit.ts  |   9 +
 frontend/editor/src/core/theme/colors.css     |   7 +
 frontend/editor/src/core/theme/primitives.css |   4 +
 .../editor/src/portal/api/integrations.ts     |  20 +-
 frontend/editor/src/portal/api/policies.ts    |   9 +-
 .../pipelines/PipelineStepSettings.tsx        |  17 +
 .../components/pipelines/ToolPicker.tsx       |  59 +-
 .../pipelines/integrationStep.test.ts         |  81 ++
 .../components/pipelines/integrationStep.ts   |  62 ++
 .../policies/PolicyExternalApiConfig.test.tsx |  81 ++
 .../policies/PolicyExternalApiConfig.tsx      | 416 +++++++++
 .../policies/PolicyPurviewConfig.tsx          |  93 ++
 .../policies/PolicyPurviewReadConfig.tsx      |  45 +
 .../policies/PolicySetupWizard.test.tsx       |  47 +
 .../components/policies/PolicySetupWizard.tsx |  84 +-
 .../policies/stepOperations.test.ts           | 251 ++++++
 .../components/policies/stepOperations.ts     | 672 ++++++++++++++
 .../components/sources/ConnectionForm.tsx     | 105 +++
 .../sources/ConnectionModal.test.tsx          | 309 +++++++
 .../components/sources/ConnectionModal.tsx    | 221 +++++
 .../sources/ConnectionPicker.test.tsx         | 111 +++
 .../components/sources/ConnectionPicker.tsx   | 103 +++
 .../sources/ConnectionTypePicker.tsx          | 142 +++
 .../sources/ConnectionsTab.test.tsx           |   3 +
 .../components/sources/ConnectionsTab.tsx     |  95 +-
 .../components/sources/S3ConnectionForm.tsx   | 116 ---
 .../sources/S3ConnectionModal.test.tsx        | 131 ---
 .../components/sources/S3ConnectionModal.tsx  | 127 ---
 .../sources/S3ConnectionPicker.test.tsx       |  11 +-
 .../components/sources/S3ConnectionPicker.tsx |  65 +-
 .../sources/connectionTypes.test.ts           | 217 +++++
 .../components/sources/connectionTypes.ts     | 844 ++++++++++++++++++
 .../editor/src/portal/mocks/handlers/index.ts |   2 +
 .../src/portal/mocks/handlers/integrations.ts | 128 +++
 .../src/portal/views/PipelineBuilder.test.tsx |  76 +-
 .../src/portal/views/PipelineBuilder.tsx      |  58 +-
 .../src/portal/views/SourceBuilder.test.tsx   |   2 +
 frontend/editor/src/portal/views/Sources.css  | 244 +++++
 .../editor/src/portal/views/Sources.test.tsx  |   3 +
 .../proprietary/policies/operations.test.ts   |   3 +
 .../src/proprietary/policies/operations.ts    |  94 +-
 frontend/eslint.config.mjs                    |  11 +
 87 files changed, 11399 insertions(+), 557 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiAuthType.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiConnectionResolver.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiConnectionSettings.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiIntegrationValidator.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiTokenCache.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiTokenLogin.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/DocumentContext.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiCallController.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiCaller.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiHeaders.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiPaths.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/IntegrationStepValidator.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/MultipartBody.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/Placeholders.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ResultFiles.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ResultUrls.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PdfSensitivityLabels.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewConnectionSettings.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewIntegrationValidator.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewLabelController.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/SensitivityLabel.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PipelineStepValidator.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ApiIntegrationValidatorTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/api/DocumentContextTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallControllerLiveTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallerAuthHeaderTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallerTokenLoginTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiPathsTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/api/MultipartBodyTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/api/PlaceholdersTemplateTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/api/PlaceholdersTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ResultUrlsTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/integration/purview/PdfSensitivityLabelsTest.java
 create mode 100644 frontend/editor/src/portal/components/pipelines/integrationStep.test.ts
 create mode 100644 frontend/editor/src/portal/components/pipelines/integrationStep.ts
 create mode 100644 frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.test.tsx
 create mode 100644 frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx
 create mode 100644 frontend/editor/src/portal/components/policies/PolicyPurviewConfig.tsx
 create mode 100644 frontend/editor/src/portal/components/policies/PolicyPurviewReadConfig.tsx
 create mode 100644 frontend/editor/src/portal/components/policies/stepOperations.test.ts
 create mode 100644 frontend/editor/src/portal/components/policies/stepOperations.ts
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionForm.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionModal.test.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionModal.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionPicker.test.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionPicker.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/S3ConnectionForm.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/S3ConnectionModal.test.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/S3ConnectionModal.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/connectionTypes.test.ts
 create mode 100644 frontend/editor/src/portal/components/sources/connectionTypes.ts
 create mode 100644 frontend/editor/src/portal/mocks/handlers/integrations.ts

diff --git a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
index 2aa8413cf6..b20dc298f7 100644
--- a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
+++ b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
@@ -250,6 +250,27 @@ public class ApplicationProperties {
          */
         private boolean allowPrivateS3Endpoints = false;
 
+        /**
+         * Whether an API/Purview/ConsignO integration's base URL may resolve to a loopback,
+         * link-local, or private address. Off by default: unlike S3 connections, any user may
+         * create one of these, so without this gate a user could point a connection at the cloud
+         * metadata address and have the server fetch it for them. Enable only when integrations
+         * genuinely live inside the network (e.g. an on-prem ConsignO or an internal API gateway).
+         */
+        private boolean allowPrivateApiEndpoints = false;
+
+        /**
+         * Whether administrators may define their own API integrations - a free-form base URL,
+         * path, body and headers - as opposed to only using the built-in vendor presets (Purview,
+         * ConsignO, S3). On by default, and admin-only regardless: a custom integration can point
+         * the server at any host, so it is authoring power, not self-serve.
+         *
+         * <p>Turning this off stops new custom integrations being created or edited. Ones that
+         * already exist keep running, because a policy that silently stopped calling out would be a
+         * worse surprise than one that keeps working; disable the connection itself to stop it.
+         */
+        private boolean allowCustomApiIntegrations = true;
+
         private long webhookMaxBytes = 104857600L;
     }
 
diff --git a/app/common/src/main/java/stirling/software/common/service/InternalApiClient.java b/app/common/src/main/java/stirling/software/common/service/InternalApiClient.java
index 63d577ca85..dd49ab3f51 100644
--- a/app/common/src/main/java/stirling/software/common/service/InternalApiClient.java
+++ b/app/common/src/main/java/stirling/software/common/service/InternalApiClient.java
@@ -46,9 +46,14 @@ public class InternalApiClient {
     // The second alternation carves out `/api/v1/ai/tools/*` specifically — AI tools are
     // dispatchable, but the broader `/api/v1/ai/` surface (orchestrate, health, etc.) is
     // intentionally NOT permitted to avoid plan steps re-entering the orchestrator.
+    //
+    // `/api/v1/integration/*` holds third-party steps (external API call, Purview labelling,
+    // ConsignO). They reach outside the JVM, so the namespace is deliberately kept to tools that
+    // dereference an admin-owned connection rather than a caller-supplied host — see
+    // ApiConnectionResolver.
     private static final Pattern ALLOWED_ENDPOINT_PATH =
             Pattern.compile(
-                    "^/api/v1/(general|misc|security|convert|filter)(/[A-Za-z0-9_-]+)+$"
+                    "^/api/v1/(general|misc|security|convert|filter|integration)(/[A-Za-z0-9_-]+)+$"
                             + "|^/api/v1/ai/tools(/[A-Za-z0-9_-]+)+$");
 
     /**
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/access/service/SecretMasker.java b/app/proprietary/src/main/java/stirling/software/proprietary/access/service/SecretMasker.java
index f160b92759..4be76e174e 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/access/service/SecretMasker.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/access/service/SecretMasker.java
@@ -39,6 +39,11 @@ public class SecretMasker {
                     "bearer",
                     "signature");
 
+    // Keys whose nested map holds secrets under arbitrary, caller-named keys - a free-form HTTP
+    // headers map is the case in point: the secret can sit under any header name (X-API-Key,
+    // Ocp-Apim-Subscription-Key), so the name is no signal. Mask every value in these outright.
+    private static final Set<String> SENSITIVE_VALUE_CONTAINERS = Set.of("headers");
+
     /** Replace sensitive values with the mask (recursively) for safe display. */
     public Map<String, Object> mask(Map<String, Object> config) {
         return mask(config, 0);
@@ -73,6 +78,12 @@ public class SecretMasker {
             if (isSensitive(e.getKey()) && isRedacted(e.getValue(), depth)) {
                 continue;
             }
+            if (isSensitiveContainer(e.getKey())
+                    && e.getValue() instanceof Map<?, ?> m
+                    && depth < MAX_DEPTH) {
+                out.put(e.getKey(), sanitizeAllValues(castMap(m), depth + 1));
+                continue;
+            }
             out.put(
                     e.getKey(),
                     e.getValue() instanceof Map<?, ?> m && depth < MAX_DEPTH
@@ -100,6 +111,14 @@ public class SecretMasker {
                 }
                 continue;
             }
+            if (isSensitiveContainer(key)
+                    && depth < MAX_DEPTH
+                    && stored.get(key) instanceof Map<?, ?> s
+                    && value instanceof Map<?, ?> i) {
+                // Every value here is a secret, so restore a redacted one from stored per-entry.
+                out.put(key, mergeAllValues(castMap(s), castMap(i), depth + 1));
+                continue;
+            }
             if (depth < MAX_DEPTH
                     && stored.get(key) instanceof Map<?, ?> s
                     && value instanceof Map<?, ?> i) {
@@ -119,6 +138,9 @@ public class SecretMasker {
             }
             return MASK;
         }
+        if (isSensitiveContainer(key) && value instanceof Map<?, ?> m && depth < MAX_DEPTH) {
+            return maskAllValues(castMap(m), depth + 1);
+        }
         if (depth >= MAX_DEPTH) {
             // Too deep to descend; mask containers rather than risk leaking an unmasked secret.
             return value instanceof Map<?, ?> || value instanceof List<?> ? MASK : value;
@@ -141,6 +163,53 @@ public class SecretMasker {
         return SENSITIVE_HINTS.stream().anyMatch(lower::contains);
     }
 
+    private boolean isSensitiveContainer(String key) {
+        return SENSITIVE_VALUE_CONTAINERS.contains(key.toLowerCase(Locale.ROOT));
+    }
+
+    /** Mask every value in a container map, whatever its keys are named. */
+    private Map<String, Object> maskAllValues(Map<String, Object> map, int depth) {
+        Map<String, Object> out = new LinkedHashMap<>();
+        for (Map.Entry<String, Object> e : map.entrySet()) {
+            Object v = e.getValue();
+            if (v == null || (v instanceof String s && s.isBlank())) {
+                out.put(e.getKey(), v);
+            } else if (v instanceof Map<?, ?> m && depth < MAX_DEPTH) {
+                out.put(e.getKey(), maskAllValues(castMap(m), depth + 1));
+            } else {
+                out.put(e.getKey(), MASK);
+            }
+        }
+        return out;
+    }
+
+    /** Merge a container map treating every entry as a secret, restoring redacted from stored. */
+    private Map<String, Object> mergeAllValues(
+            Map<String, Object> stored, Map<String, Object> incoming, int depth) {
+        Map<String, Object> out = new LinkedHashMap<>();
+        for (Map.Entry<String, Object> e : incoming.entrySet()) {
+            if (isRedacted(e.getValue(), depth)) {
+                if (stored.containsKey(e.getKey())) {
+                    out.put(e.getKey(), stored.get(e.getKey()));
+                }
+            } else {
+                out.put(e.getKey(), e.getValue());
+            }
+        }
+        return out;
+    }
+
+    /** Drop redacted entries from a container map on create, whatever their keys are named. */
+    private Map<String, Object> sanitizeAllValues(Map<String, Object> map, int depth) {
+        Map<String, Object> out = new LinkedHashMap<>();
+        for (Map.Entry<String, Object> e : map.entrySet()) {
+            if (!isRedacted(e.getValue(), depth)) {
+                out.put(e.getKey(), e.getValue());
+            }
+        }
+        return out;
+    }
+
     /** Blank, the mask placeholder, or any structure that still contains the mask. */
     private boolean isRedacted(Object value, int depth) {
         if (value == null) {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiAuthType.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiAuthType.java
new file mode 100644
index 0000000000..0eef442523
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiAuthType.java
@@ -0,0 +1,25 @@
+package stirling.software.proprietary.integration.api;
+
+/**
+ * How an {@link stirling.software.proprietary.integration.model.IntegrationType#API} connection
+ * authenticates.
+ */
+public enum ApiAuthType {
+    /** No credentials; the endpoint is open or authorises by network position. */
+    NONE,
+    /** {@code Authorization: Bearer <token>}. */
+    BEARER,
+    /** {@code Authorization: Basic base64(username:password)}. */
+    BASIC,
+    /** The token in a caller-named header, e.g. {@code X-API-Key: <token>}. */
+    HEADER,
+    /**
+     * The connection logs in first and reuses the short-lived token it gets back.
+     *
+     * <p>For the large class of enterprise APIs - ConsignO Cloud, OAuth2 client-credentials, and
+     * others - where credentials buy a token rather than authenticating a call directly. Without
+     * this a step could not reach them at all: each call needs a token, and a stateless step has
+     * nowhere to obtain or keep one. See {@link ApiTokenLogin}.
+     */
+    TOKEN_LOGIN
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiConnectionResolver.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiConnectionResolver.java
new file mode 100644
index 0000000000..e29435ff14
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiConnectionResolver.java
@@ -0,0 +1,130 @@
+package stirling.software.proprietary.integration.api;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.access.model.ResourceType;
+import stirling.software.proprietary.access.service.OwnershipService;
+import stirling.software.proprietary.integration.model.IntegrationConfig;
+import stirling.software.proprietary.integration.model.IntegrationType;
+import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
+import stirling.software.proprietary.security.model.User;
+import stirling.software.proprietary.security.service.UserService;
+
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * Dereferences a step's {@code connectionId} to a stored integration config.
+ *
+ * <p>Mirrors {@code S3ConnectionResolver}. When an authenticated caller is present the connection
+ * must be usable by them; a background worker thread carries no {@code SecurityContext} and skips
+ * that check, relying on the step having been access-checked when the policy was saved or when an
+ * ad-hoc run was dispatched - see {@link IntegrationStepValidator}, which is what makes that
+ * assumption true rather than merely hoped for.
+ */
+@Service
+@RequiredArgsConstructor
+@Transactional(readOnly = true)
+public class ApiConnectionResolver {
+
+    private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+
+    private final IntegrationConfigRepository connections;
+    private final OwnershipService ownership;
+    private final UserService userService;
+
+    /** The raw config map for a connection of the given type. */
+    public Map<String, Object> resolveConfig(Long connectionId, IntegrationType type) {
+        IntegrationConfig connection =
+                connections
+                        .findById(connectionId)
+                        .filter(cfg -> cfg.getIntegrationType() == type)
+                        .filter(this::usableByCurrentUser)
+                        // Existence and access collapse into one error so a caller cannot tell
+                        // "no such connection" from "someone else's connection" and enumerate ids.
+                        .orElseThrow(
+                                () ->
+                                        new IllegalArgumentException(
+                                                "unknown or inaccessible "
+                                                        + type.name().toLowerCase()
+                                                        + " connection"));
+        if (!connection.isEnabled()) {
+            throw new IllegalArgumentException(
+                    type.name().toLowerCase() + " connection is disabled");
+        }
+        return configOf(connection);
+    }
+
+    /** The settings for a generic {@code API} connection. */
+    public ApiConnectionSettings resolve(Long connectionId) {
+        return ApiConnectionSettings.from(resolveConfig(connectionId, IntegrationType.API));
+    }
+
+    /** Parse a {@code connectionId} step parameter; null when absent. */
+    public static Long connectionId(Object reference) {
+        if (reference == null || (reference instanceof String s && s.isBlank())) {
+            return null;
+        }
+        if (reference instanceof Number number) {
+            return number.longValue();
+        }
+        try {
+            return Long.valueOf(reference.toString().trim());
+        } catch (NumberFormatException e) {
+            throw new IllegalArgumentException(
+                    "'connectionId' is not a valid connection reference: " + reference);
+        }
+    }
+
+    /**
+     * Whether the current caller may use this connection. A missing principal means a worker
+     * thread, where access was established earlier; it must never be the only thing standing
+     * between a caller and a connection, or the check becomes a confused deputy.
+     */
+    private boolean usableByCurrentUser(IntegrationConfig connection) {
+        User user = currentUser();
+        return user == null || ownership.canUse(ResourceType.INTEGRATION_CONFIG, connection, user);
+    }
+
+    // Mirrors ResourceAccessSecurity's principal resolution; null when unauthenticated.
+    private User currentUser() {
+        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
+        if (auth == null || !auth.isAuthenticated()) {
+            return null;
+        }
+        Object principal = auth.getPrincipal();
+        if (principal instanceof User user) {
+            return user;
+        }
+        if (principal instanceof UserDetails userDetails) {
+            return userService.findByUsername(userDetails.getUsername()).orElse(null);
+        }
+        if (principal instanceof String username && !"anonymousUser".equals(username)) {
+            return userService.findByUsername(username).orElse(null);
+        }
+        return null;
+    }
+
+    private static Map<String, Object> configOf(IntegrationConfig connection) {
+        String json = connection.getConfig();
+        if (json == null || json.isBlank()) {
+            return Map.of();
+        }
+        try {
+            return OBJECT_MAPPER.readValue(
+                    json, new TypeReference<LinkedHashMap<String, Object>>() {});
+        } catch (Exception e) {
+            throw new IllegalArgumentException(
+                    "connection '" + connection.getName() + "' has unreadable config", e);
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiConnectionSettings.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiConnectionSettings.java
new file mode 100644
index 0000000000..a1bb29cf84
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiConnectionSettings.java
@@ -0,0 +1,282 @@
+package stirling.software.proprietary.integration.api;
+
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.LinkedHashMap;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+
+/**
+ * A resolved {@code API} connection: where to call, and how to authenticate.
+ *
+ * <p>{@code baseUrl} is the security anchor of the whole feature. It is set by whoever can manage
+ * the connection (an admin or team owner) and is the only thing that decides which host is
+ * contacted. A pipeline step supplies a <em>relative path</em> only, resolved under this base by
+ * {@link ExternalApiPaths}, so a step author can never pivot the call to a host of their choosing.
+ * Widening that - letting a step pass a full URL - would turn every policy into an SSRF primitive.
+ *
+ * <p>Whether the base URL may resolve to a private address is deliberately <em>not</em> a field
+ * here. Any user may create an API connection (unlike S3, which {@code IntegrationConfigService}
+ * restricts to admins), so a per-connection opt-in would let a user grant themselves a fetch of the
+ * cloud metadata service. It is an operator property instead - {@code
+ * policies.allowPrivateApiEndpoints} - checked by {@link ApiIntegrationValidator}.
+ */
+public record ApiConnectionSettings(
+        String baseUrl,
+        ApiAuthType authType,
+        String headerName,
+        String headerPrefix,
+        String token,
+        String username,
+        String password,
+        Map<String, String> headers,
+        ApiTokenLogin tokenLogin,
+        Set<String> resultUrlHosts,
+        int timeoutSeconds) {
+
+    static final String BASE_URL_OPTION = "baseUrl";
+    static final String AUTH_TYPE_OPTION = "authType";
+    static final String HEADER_NAME_OPTION = "headerName";
+    static final String HEADER_PREFIX_OPTION = "headerPrefix";
+    // "token"/"password" contain SecretMasker hints, so they mask on read and merge on update.
+    static final String TOKEN_OPTION = "token";
+    static final String USERNAME_OPTION = "username";
+    static final String PASSWORD_OPTION = "password";
+    static final String HEADERS_OPTION = "headers";
+    static final String RESULT_URL_HOSTS_OPTION = "resultUrlHosts";
+    static final String TIMEOUT_SECONDS_OPTION = "timeoutSeconds";
+
+    static final int DEFAULT_TIMEOUT_SECONDS = 60;
+    private static final int MAX_TIMEOUT_SECONDS = 600;
+
+    public ApiConnectionSettings {
+        headers = headers == null ? Map.of() : Map.copyOf(headers);
+        resultUrlHosts = resultUrlHosts == null ? Set.of() : Set.copyOf(resultUrlHosts);
+    }
+
+    /**
+     * @throws IllegalArgumentException if the config is unusable; the message is surfaced to the
+     *     operator editing the connection, so it names the offending option.
+     */
+    public static ApiConnectionSettings from(Map<String, Object> options) {
+        String baseUrl = trimmed(options.get(BASE_URL_OPTION));
+        if (baseUrl == null) {
+            throw new IllegalArgumentException("api config requires a 'baseUrl' option");
+        }
+        URI uri = parseHttpUrl(baseUrl);
+        if (uri.getQuery() != null || uri.getFragment() != null) {
+            throw new IllegalArgumentException(
+                    "api config 'baseUrl' must not carry a query string or fragment");
+        }
+
+        ApiAuthType authType = parseAuthType(trimmed(options.get(AUTH_TYPE_OPTION)));
+        String headerName = trimmed(options.get(HEADER_NAME_OPTION));
+        // Many APIs want a scheme before the token ("Authorization: Token abc",
+        // "Authorization: DeepL-Auth-Key abc"). Without this a preset would have to make the
+        // operator paste the scheme into the secret itself, which reads as a typo waiting to
+        // happen.
+        String headerPrefix = trimmed(options.get(HEADER_PREFIX_OPTION));
+        String token = trimmed(options.get(TOKEN_OPTION));
+        String username = trimmed(options.get(USERNAME_OPTION));
+        String password = trimmed(options.get(PASSWORD_OPTION));
+
+        switch (authType) {
+            case BEARER -> require(token, "api config authType 'BEARER' requires a 'token'");
+            case HEADER -> {
+                require(token, "api config authType 'HEADER' requires a 'token'");
+                require(headerName, "api config authType 'HEADER' requires a 'headerName'");
+                if (!ExternalApiHeaders.isValidName(headerName)) {
+                    throw new IllegalArgumentException(
+                            "api config 'headerName' is not a valid HTTP header name: "
+                                    + headerName);
+                }
+            }
+            case BASIC -> {
+                require(username, "api config authType 'BASIC' requires a 'username'");
+                require(password, "api config authType 'BASIC' requires a 'password'");
+            }
+            case TOKEN_LOGIN -> {
+                /* validated by ApiTokenLogin.from below */
+            }
+            case NONE -> {
+                /* nothing to check */
+            }
+        }
+
+        return new ApiConnectionSettings(
+                stripTrailingSlash(baseUrl),
+                authType,
+                headerName,
+                headerPrefix,
+                token,
+                username,
+                password,
+                parseHeaders(options.get(HEADERS_OPTION)),
+                authType == ApiAuthType.TOKEN_LOGIN ? ApiTokenLogin.from(options) : null,
+                parseResultUrlHosts(options.get(RESULT_URL_HOSTS_OPTION)),
+                parseTimeout(options.get(TIMEOUT_SECONDS_OPTION)));
+    }
+
+    /** The configured base as a URI; callers resolve step paths under it. */
+    public URI baseUri() {
+        return URI.create(baseUrl);
+    }
+
+    /**
+     * Identity of this connection's login for token-cache purposes. Includes the credentials, so
+     * editing a password evicts the token cached under the old one rather than reusing it until it
+     * expires.
+     */
+    String tokenCacheKey() {
+        return baseUrl + "|" + Objects.hash(tokenLogin);
+    }
+
+    private static URI parseHttpUrl(String value) {
+        URI uri;
+        try {
+            uri = new URI(value);
+        } catch (URISyntaxException e) {
+            throw new IllegalArgumentException("api config 'baseUrl' is not a valid URL", e);
+        }
+        String scheme = uri.getScheme() == null ? null : uri.getScheme().toLowerCase(Locale.ROOT);
+        if (!"http".equals(scheme) && !"https".equals(scheme)) {
+            throw new IllegalArgumentException(
+                    "api config 'baseUrl' must be an http(s) URL, e.g. https://api.example.com");
+        }
+        if (uri.getHost() == null || uri.getHost().isBlank()) {
+            throw new IllegalArgumentException("api config 'baseUrl' must include a host");
+        }
+        return uri;
+    }
+
+    private static ApiAuthType parseAuthType(String value) {
+        if (value == null) {
+            return ApiAuthType.NONE;
+        }
+        try {
+            return ApiAuthType.valueOf(value.toUpperCase(Locale.ROOT));
+        } catch (IllegalArgumentException e) {
+            throw new IllegalArgumentException(
+                    "api config 'authType' must be one of NONE, BEARER, BASIC, HEADER; got "
+                            + value);
+        }
+    }
+
+    /** Static headers sent on every call. Rejects anything auth-bearing to keep one auth path. */
+    private static Map<String, String> parseHeaders(Object value) {
+        if (value == null) {
+            return Map.of();
+        }
+        if (!(value instanceof Map<?, ?> raw)) {
+            throw new IllegalArgumentException("api config 'headers' must be an object");
+        }
+        Map<String, String> headers = new LinkedHashMap<>();
+        for (Map.Entry<?, ?> entry : raw.entrySet()) {
+            String name = trimmed(entry.getKey());
+            String headerValue = entry.getValue() == null ? null : entry.getValue().toString();
+            if (name == null) {
+                continue;
+            }
+            if (!ExternalApiHeaders.isValidName(name)) {
+                throw new IllegalArgumentException(
+                        "api config 'headers' has an invalid header name: " + name);
+            }
+            if (ExternalApiHeaders.isReserved(name)) {
+                throw new IllegalArgumentException(
+                        "api config 'headers' must not set '"
+                                + name
+                                + "'; use 'authType' and 'token' instead");
+            }
+            if (headerValue == null || !ExternalApiHeaders.isValidValue(headerValue)) {
+                throw new IllegalArgumentException(
+                        "api config 'headers' has an invalid value for '" + name + "'");
+            }
+            headers.put(name, headerValue);
+        }
+        return headers;
+    }
+
+    /**
+     * Hosts a result may be fetched from, beyond the connection's own. Declared by the operator
+     * because the alternative - trusting the host named in the API's response - is an SSRF.
+     */
+    private static Set<String> parseResultUrlHosts(Object value) {
+        if (value == null) {
+            return Set.of();
+        }
+        if (!(value instanceof java.util.List<?> list)) {
+            throw new IllegalArgumentException(
+                    "api config 'resultUrlHosts' must be a list of hostnames");
+        }
+        Set<String> out = new java.util.LinkedHashSet<>();
+        for (Object entry : list) {
+            String host = trimmed(entry);
+            if (host == null) {
+                continue;
+            }
+            if (host.contains("/") || host.contains(":") || host.contains("*")) {
+                // A URL, port or wildcard here would read as broader than it is; subdomains are
+                // already covered by the "endsWith('.' + host)" rule at match time.
+                throw new IllegalArgumentException(
+                        "api config 'resultUrlHosts' takes bare hostnames, e.g."
+                                + " cdn.vendor.com; got "
+                                + host);
+            }
+            out.add(host.toLowerCase(Locale.ROOT));
+        }
+        return out;
+    }
+
+    private static int parseTimeout(Object value) {
+        if (value == null) {
+            return DEFAULT_TIMEOUT_SECONDS;
+        }
+        int seconds;
+        try {
+            seconds = Integer.parseInt(value.toString().trim());
+        } catch (NumberFormatException e) {
+            throw new IllegalArgumentException("api config 'timeoutSeconds' must be a number");
+        }
+        if (seconds < 1 || seconds > MAX_TIMEOUT_SECONDS) {
+            throw new IllegalArgumentException(
+                    "api config 'timeoutSeconds' must be between 1 and " + MAX_TIMEOUT_SECONDS);
+        }
+        return seconds;
+    }
+
+    private static void require(String value, String message) {
+        if (value == null) {
+            throw new IllegalArgumentException(message);
+        }
+    }
+
+    private static String stripTrailingSlash(String value) {
+        String out = value;
+        while (out.endsWith("/")) {
+            out = out.substring(0, out.length() - 1);
+        }
+        return out;
+    }
+
+    private static String trimmed(Object value) {
+        if (value == null) {
+            return null;
+        }
+        String text = value.toString().trim();
+        return text.isEmpty() ? null : text;
+    }
+
+    /** Never prints the credentials, so an accidental log line cannot leak them. */
+    @Override
+    public String toString() {
+        return "ApiConnectionSettings[baseUrl="
+                + baseUrl
+                + ", authType="
+                + authType
+                + ", timeoutSeconds="
+                + timeoutSeconds
+                + "]";
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiIntegrationValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiIntegrationValidator.java
new file mode 100644
index 0000000000..014bacb4a5
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiIntegrationValidator.java
@@ -0,0 +1,109 @@
+package stirling.software.proprietary.integration.api;
+
+import java.util.Map;
+
+import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.cluster.s3.S3Clients;
+import stirling.software.proprietary.integration.model.IntegrationType;
+import stirling.software.proprietary.integration.service.IntegrationConfigValidator;
+
+/**
+ * The {@code API} connection schema, enforced when the config is saved: an http(s) base URL, a
+ * coherent auth block, and a host that must not reach private addresses without the operator
+ * opt-in.
+ *
+ * <p>The host check runs here so a bad connection fails in the form rather than mid-run. It is not
+ * the only check - {@link ExternalApiCaller} re-checks before dispatch, because DNS can be
+ * re-pointed at a private address long after save time (a check-then-use gap this validator alone
+ * cannot close).
+ */
+@Component
+@RequiredArgsConstructor
+public class ApiIntegrationValidator implements IntegrationConfigValidator {
+
+    private final ApplicationProperties applicationProperties;
+
+    @Override
+    public IntegrationType type() {
+        return IntegrationType.API;
+    }
+
+    @Override
+    public void validate(Map<String, Object> config) {
+        ApiConnectionSettings settings = ApiConnectionSettings.from(config);
+        requirePublicHost(settings, applicationProperties, "API connection base URL");
+    }
+
+    /**
+     * Shared by every integration type that dials an operator-supplied host, so they cannot drift
+     * apart on what counts as reachable.
+     */
+    static void requirePublicHost(
+            ApiConnectionSettings settings,
+            ApplicationProperties applicationProperties,
+            String settingName) {
+        // Block the cloud metadata service unconditionally - before the opt-in check. The private-
+        // endpoint opt-in exists for on-prem services (RFC1918, an internal gateway), but the
+        // metadata endpoint is never a real integration and reaching it is the highest-value SSRF:
+        // it hands out the instance's own IAM credentials. So it stays blocked even when the
+        // operator has allowed private endpoints.
+        denyCloudMetadata(settings.baseUri(), settingName);
+        try {
+            S3Clients.validateEndpointHost(
+                    settings.baseUri(),
+                    applicationProperties.getPolicies().isAllowPrivateApiEndpoints(),
+                    settingName,
+                    "set policies.allowPrivateApiEndpoints=true to opt in (e.g. for an on-prem"
+                            + " integration).");
+        } catch (IllegalStateException e) {
+            throw new IllegalArgumentException(e.getMessage(), e);
+        }
+    }
+
+    /** AWS/GCP/Azure, Oracle and IBM metadata addresses; mirrors {@code SsrfProtectionService}. */
+    private static final java.util.Set<String> CLOUD_METADATA_IPS =
+            java.util.Set.of(
+                    "169.254.169.254", "169.254.169.253", "169.254.169.250", "fd00:ec2::254");
+
+    private static void denyCloudMetadata(java.net.URI uri, String settingName) {
+        String host = uri.getHost();
+        if (host == null || host.isBlank()) {
+            return; // a missing host is S3Clients' error to report, with its own message
+        }
+        java.net.InetAddress[] addresses;
+        try {
+            addresses = java.net.InetAddress.getAllByName(host);
+        } catch (java.net.UnknownHostException e) {
+            return; // an unresolvable host is likewise left to S3Clients to reject
+        }
+        for (java.net.InetAddress address : addresses) {
+            String ip = normalise(address.getHostAddress());
+            if (CLOUD_METADATA_IPS.stream().anyMatch(ip::startsWith)) {
+                throw new IllegalArgumentException(
+                        settingName
+                                + " host '"
+                                + host
+                                + "' resolves to the cloud metadata service ("
+                                + ip
+                                + "), which is never a valid integration target.");
+            }
+        }
+    }
+
+    /** Strip an IPv4-mapped-IPv6 prefix and any zone id so the compare sees a bare address. */
+    private static String normalise(String ip) {
+        String out = ip;
+        int zone = out.indexOf('%');
+        if (zone >= 0) {
+            out = out.substring(0, zone);
+        }
+        if (out.startsWith("::ffff:")) {
+            out = out.substring(7);
+        }
+        return out;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiTokenCache.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiTokenCache.java
new file mode 100644
index 0000000000..3610f77ab0
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiTokenCache.java
@@ -0,0 +1,149 @@
+package stirling.software.proprietary.integration.api;
+
+import java.io.IOException;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.time.Duration;
+import java.util.Map;
+import java.util.concurrent.TimeUnit;
+
+import org.springframework.http.MediaType;
+
+import com.github.benmanes.caffeine.cache.Cache;
+import com.github.benmanes.caffeine.cache.Caffeine;
+
+import lombok.extern.slf4j.Slf4j;
+
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * Obtains and caches the short-lived tokens of {@link ApiAuthType#TOKEN_LOGIN} connections.
+ *
+ * <p>The step that uses a token is stateless and runs once per document, so without a cache a
+ * hundred-document policy would perform a hundred logins - which many vendors rate-limit, and some
+ * treat as suspicious. The cache is keyed on the connection's login identity (credentials included)
+ * so that editing a password does not keep reusing the token bought with the old one.
+ *
+ * <p>Entries expire well inside the vendor's stated lifetime, and a 401 additionally evicts and
+ * retries once ({@link ExternalApiCaller}), so a token that expires early - or is revoked - costs
+ * one retry rather than a failed run.
+ */
+@Slf4j
+public class ApiTokenCache {
+
+    /** Bounded so a deployment with many connections cannot grow this without limit. */
+    private static final int MAX_ENTRIES = 500;
+
+    private final Cache<String, String> tokens;
+    private final HttpClient httpClient;
+    private final ObjectMapper objectMapper;
+
+    ApiTokenCache(HttpClient httpClient, ObjectMapper objectMapper) {
+        this.httpClient = httpClient;
+        this.objectMapper = objectMapper;
+        this.tokens =
+                Caffeine.newBuilder()
+                        .maximumSize(MAX_ENTRIES)
+                        // Per-entry, because each connection states its own lifetime.
+                        .expireAfter(
+                                new com.github.benmanes.caffeine.cache.Expiry<String, String>() {
+                                    @Override
+                                    public long expireAfterCreate(
+                                            String key, String value, long currentTime) {
+                                        return ttlNanos(key);
+                                    }
+
+                                    @Override
+                                    public long expireAfterUpdate(
+                                            String key,
+                                            String value,
+                                            long currentTime,
+                                            long currentDuration) {
+                                        return ttlNanos(key);
+                                    }
+
+                                    @Override
+                                    public long expireAfterRead(
+                                            String key,
+                                            String value,
+                                            long currentTime,
+                                            long currentDuration) {
+                                        // Reading must not extend a token's life: the vendor's
+                                        // clock is running regardless of how often we use it.
+                                        return currentDuration;
+                                    }
+                                })
+                        .build();
+    }
+
+    // The TTL travels in the key so the Expiry callbacks can see it without a second lookup.
+    private static long ttlNanos(String key) {
+        int seconds = Integer.parseInt(key.substring(key.lastIndexOf('#') + 1));
+        return TimeUnit.SECONDS.toNanos(seconds);
+    }
+
+    /**
+     * The connection's current token, logging in if there is not a live one.
+     *
+     * @throws IOException if the login call fails or returns no token
+     */
+    String token(ApiConnectionSettings settings) throws IOException {
+        String key = cacheKey(settings);
+        String cached = tokens.getIfPresent(key);
+        if (cached != null) {
+            return cached;
+        }
+        String token = login(settings);
+        tokens.put(key, token);
+        return token;
+    }
+
+    /** Drop the cached token, e.g. after a 401 says it is no longer accepted. */
+    void invalidate(ApiConnectionSettings settings) {
+        tokens.invalidate(cacheKey(settings));
+    }
+
+    private static String cacheKey(ApiConnectionSettings settings) {
+        return settings.tokenCacheKey() + "#" + settings.tokenLogin().tokenTtlSeconds();
+    }
+
+    private String login(ApiConnectionSettings settings) throws IOException {
+        ApiTokenLogin login = settings.tokenLogin();
+        URI target = ExternalApiPaths.resolve(settings.baseUri(), login.loginPath());
+
+        HttpRequest.Builder request =
+                HttpRequest.newBuilder(target)
+                        .timeout(Duration.ofSeconds(settings.timeoutSeconds()))
+                        .header("Content-Type", MediaType.APPLICATION_JSON_VALUE)
+                        .POST(
+                                HttpRequest.BodyPublishers.ofByteArray(
+                                        objectMapper.writeValueAsBytes(login.loginBody())));
+        login.loginHeaders().forEach(request::header);
+
+        ExternalApiCaller.Response response =
+                ExternalApiCaller.send(httpClient, request.build(), target);
+        if (!response.isSuccess()) {
+            // Deliberately does not echo the body: a login failure response can repeat the
+            // credentials back, and this message reaches the run log.
+            throw new IOException(
+                    "Login to "
+                            + target.getHost()
+                            + login.loginPath()
+                            + " returned HTTP "
+                            + response.status());
+        }
+        try {
+            String token = login.extractToken(response, objectMapper);
+            log.debug("[external-api] obtained a token from {}", target.getHost());
+            return token;
+        } catch (IllegalStateException e) {
+            throw new IOException(e.getMessage(), e);
+        }
+    }
+
+    /** The auth header for an authenticated call. */
+    Map.Entry<String, String> authHeader(ApiConnectionSettings settings) throws IOException {
+        return settings.tokenLogin().authHeader(token(settings));
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiTokenLogin.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiTokenLogin.java
new file mode 100644
index 0000000000..a7c02d786f
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ApiTokenLogin.java
@@ -0,0 +1,209 @@
+package stirling.software.proprietary.integration.api;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * How a connection turns credentials into a short-lived token.
+ *
+ * <p>Modelled on what real APIs actually do rather than on one vendor. The two axes that vary are
+ * where the token comes back ({@code tokenResponseHeader} or {@code tokenResponseJsonPath}) and how
+ * it is then presented ({@code tokenHeaderName} + {@code tokenPrefix}). That covers both ends of
+ * the spectrum:
+ *
+ * <ul>
+ *   <li>ConsignO Cloud - {@code POST /auth/login} with {@code X-Client-Id}/{@code X-Client-Secret}
+ *       headers and a {@code {username, password, tenantId}} body, returning the token in the
+ *       {@code X-Auth-Token} <em>response header</em>, which is then sent back as {@code
+ *       X-Auth-Token}.
+ *   <li>OAuth2 client-credentials - a form or JSON post returning {@code {"access_token": ...}} in
+ *       the body, sent back as {@code Authorization: Bearer ...}.
+ * </ul>
+ *
+ * <p>{@code loginBody} and {@code loginHeaders} are stored as nested maps rather than a
+ * pre-rendered JSON string so {@code SecretMasker} can recurse and mask the {@code password} /
+ * {@code X-Client-Secret} entries inside them. A flat string would sail past it and hand the
+ * password back in plaintext on every read of the connection.
+ */
+record ApiTokenLogin(
+        String loginPath,
+        Map<String, Object> loginBody,
+        Map<String, String> loginHeaders,
+        String tokenResponseHeader,
+        String tokenResponseJsonPath,
+        String tokenHeaderName,
+        String tokenPrefix,
+        int tokenTtlSeconds) {
+
+    static final String LOGIN_PATH_OPTION = "loginPath";
+    static final String LOGIN_BODY_OPTION = "loginBody";
+    static final String LOGIN_HEADERS_OPTION = "loginHeaders";
+    static final String TOKEN_RESPONSE_HEADER_OPTION = "tokenResponseHeader";
+    static final String TOKEN_RESPONSE_JSON_PATH_OPTION = "tokenResponseJsonPath";
+    static final String TOKEN_HEADER_NAME_OPTION = "tokenHeaderName";
+    static final String TOKEN_PREFIX_OPTION = "tokenPrefix";
+    static final String TOKEN_TTL_SECONDS_OPTION = "tokenTtlSeconds";
+
+    /**
+     * Conservative default. ConsignO's token lasts 30 minutes; caching for 25 leaves room for a
+     * slow call to finish on a token that was still valid when it started. A cache that expired
+     * exactly on the vendor's boundary would fail intermittently and look like a network fault.
+     */
+    static final int DEFAULT_TOKEN_TTL_SECONDS = 1500;
+
+    private static final int MAX_TOKEN_TTL_SECONDS = 86400;
+
+    ApiTokenLogin {
+        loginBody = loginBody == null ? Map.of() : Map.copyOf(loginBody);
+        loginHeaders = loginHeaders == null ? Map.of() : Map.copyOf(loginHeaders);
+    }
+
+    static ApiTokenLogin from(Map<String, Object> options) {
+        String loginPath = trimmed(options.get(LOGIN_PATH_OPTION));
+        if (loginPath == null) {
+            throw new IllegalArgumentException(
+                    "api config authType 'TOKEN_LOGIN' requires a 'loginPath', e.g. /auth/login");
+        }
+        String responseHeader = trimmed(options.get(TOKEN_RESPONSE_HEADER_OPTION));
+        String responseJsonPath = trimmed(options.get(TOKEN_RESPONSE_JSON_PATH_OPTION));
+        if ((responseHeader == null) == (responseJsonPath == null)) {
+            throw new IllegalArgumentException(
+                    "api config authType 'TOKEN_LOGIN' needs exactly one of"
+                            + " 'tokenResponseHeader' (e.g. X-Auth-Token) or"
+                            + " 'tokenResponseJsonPath' (e.g. access_token) to say where the token"
+                            + " comes back");
+        }
+        String tokenHeaderName = trimmed(options.get(TOKEN_HEADER_NAME_OPTION));
+        if (tokenHeaderName == null) {
+            throw new IllegalArgumentException(
+                    "api config authType 'TOKEN_LOGIN' requires a 'tokenHeaderName' saying which"
+                            + " header carries the token back, e.g. X-Auth-Token or Authorization");
+        }
+        if (!ExternalApiHeaders.isValidName(tokenHeaderName)) {
+            throw new IllegalArgumentException(
+                    "api config 'tokenHeaderName' is not a valid HTTP header name: "
+                            + tokenHeaderName);
+        }
+        if (responseHeader != null && !ExternalApiHeaders.isValidName(responseHeader)) {
+            throw new IllegalArgumentException(
+                    "api config 'tokenResponseHeader' is not a valid HTTP header name: "
+                            + responseHeader);
+        }
+
+        return new ApiTokenLogin(
+                loginPath,
+                nestedObject(options.get(LOGIN_BODY_OPTION), LOGIN_BODY_OPTION),
+                loginHeaders(options.get(LOGIN_HEADERS_OPTION)),
+                responseHeader,
+                responseJsonPath,
+                tokenHeaderName,
+                trimmed(options.get(TOKEN_PREFIX_OPTION)) == null
+                        ? ""
+                        : trimmed(options.get(TOKEN_PREFIX_OPTION)) + " ",
+                ttl(options.get(TOKEN_TTL_SECONDS_OPTION)));
+    }
+
+    /** Pull the token out of a login response. */
+    String extractToken(ExternalApiCaller.Response response, ObjectMapper objectMapper) {
+        if (tokenResponseHeader != null) {
+            String value = response.header(tokenResponseHeader);
+            if (value == null || value.isBlank()) {
+                throw new IllegalStateException(
+                        "Login succeeded but returned no '"
+                                + tokenResponseHeader
+                                + "' response header");
+            }
+            return value;
+        }
+        JsonNode node = response.bodyAsJson(objectMapper);
+        for (String segment : tokenResponseJsonPath.split("\\.")) {
+            if (node == null) {
+                break;
+            }
+            node = node.get(segment);
+        }
+        if (node == null || !node.isValueNode() || node.asString().isBlank()) {
+            throw new IllegalStateException(
+                    "Login succeeded but its body had no token at '" + tokenResponseJsonPath + "'");
+        }
+        return node.asString();
+    }
+
+    /** The header to send on an authenticated call. */
+    Map.Entry<String, String> authHeader(String token) {
+        return Map.entry(tokenHeaderName, tokenPrefix + token);
+    }
+
+    private static Map<String, Object> nestedObject(Object value, String option) {
+        if (value == null) {
+            return Map.of();
+        }
+        if (!(value instanceof Map<?, ?> raw)) {
+            throw new IllegalArgumentException("api config '" + option + "' must be an object");
+        }
+        Map<String, Object> out = new LinkedHashMap<>();
+        raw.forEach((key, entry) -> out.put(String.valueOf(key), entry));
+        return out;
+    }
+
+    private static Map<String, String> loginHeaders(Object value) {
+        Map<String, String> out = new LinkedHashMap<>();
+        nestedObject(value, LOGIN_HEADERS_OPTION)
+                .forEach(
+                        (name, entry) -> {
+                            String headerValue = entry == null ? null : entry.toString();
+                            if (!ExternalApiHeaders.isValidName(name)) {
+                                throw new IllegalArgumentException(
+                                        "api config 'loginHeaders' has an invalid header name: "
+                                                + name);
+                            }
+                            if (headerValue == null
+                                    || !ExternalApiHeaders.isValidValue(headerValue)) {
+                                throw new IllegalArgumentException(
+                                        "api config 'loginHeaders' has an invalid value for '"
+                                                + name
+                                                + "'");
+                            }
+                            out.put(name, headerValue);
+                        });
+        return out;
+    }
+
+    private static int ttl(Object value) {
+        if (value == null) {
+            return DEFAULT_TOKEN_TTL_SECONDS;
+        }
+        int seconds;
+        try {
+            seconds = Integer.parseInt(value.toString().trim());
+        } catch (NumberFormatException e) {
+            throw new IllegalArgumentException("api config 'tokenTtlSeconds' must be a number");
+        }
+        if (seconds < 1 || seconds > MAX_TOKEN_TTL_SECONDS) {
+            throw new IllegalArgumentException(
+                    "api config 'tokenTtlSeconds' must be between 1 and " + MAX_TOKEN_TTL_SECONDS);
+        }
+        return seconds;
+    }
+
+    private static String trimmed(Object value) {
+        if (value == null) {
+            return null;
+        }
+        String text = value.toString().trim();
+        return text.isEmpty() ? null : text;
+    }
+
+    /** Never prints the login body or headers: both carry the credentials. */
+    @Override
+    public String toString() {
+        return "ApiTokenLogin[loginPath="
+                + loginPath
+                + ", tokenTtlSeconds="
+                + tokenTtlSeconds
+                + "]";
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/DocumentContext.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/DocumentContext.java
new file mode 100644
index 0000000000..044d24c0c5
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/DocumentContext.java
@@ -0,0 +1,180 @@
+package stirling.software.proprietary.integration.api;
+
+import java.io.IOException;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.time.Instant;
+import java.util.Base64;
+import java.util.Calendar;
+import java.util.HexFormat;
+import java.util.List;
+import java.util.Locale;
+
+import org.apache.pdfbox.Loader;
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDDocumentInformation;
+import org.springframework.web.multipart.MultipartFile;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.service.PdfMetadataService;
+import stirling.software.proprietary.integration.purview.PdfSensitivityLabels;
+import stirling.software.proprietary.integration.purview.SensitivityLabel;
+
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ObjectNode;
+
+/**
+ * Everything Stirling already knows about the document and the run, as one JSON object.
+ *
+ * <p>An external API almost always wants more than the bytes: what the file is, what it was called,
+ * whether it is already classified or labelled, and which policy sent it. All of that is in hand at
+ * the moment of the call, so it is offered rather than left for the operator to re-derive - most
+ * usefully the Purview label and the classifier's verdict, which turn a call-out into something the
+ * receiving system can make a decision with.
+ *
+ * <p>The shape is also the namespace for placeholders (see {@link Placeholders}), so {@code
+ * {{document.sha256}}} or {@code {{sensitivityLabel.name}}} in a field, path, or header resolves
+ * against exactly what is documented here:
+ *
+ * <pre>
+ * document.filename | .extension | .contentType | .sizeBytes | .sha256 | .base64
+ *         .pageCount | .encrypted | .title | .author | .subject | .keywords
+ *         .creator | .producer | .created | .modified
+ * classification.*         the classifier policy's verdict, when it has run
+ * sensitivityLabel.labelId | .name | .siteId | .method | .protected
+ * run.policyName | .runId | .timestamp
+ * </pre>
+ *
+ * <p>Every field is best-effort: a non-PDF, an unparseable PDF, or an ad-hoc run with no policy
+ * simply omits what it cannot know. Building the context must never be the reason a step fails.
+ */
+@Slf4j
+final class DocumentContext {
+
+    private DocumentContext() {}
+
+    static ObjectNode build(
+            MultipartFile file,
+            byte[] content,
+            String policyName,
+            String runId,
+            ObjectMapper objectMapper) {
+        ObjectNode root = objectMapper.createObjectNode();
+        ObjectNode document = root.putObject("document");
+
+        String filename = file.getOriginalFilename();
+        document.put("filename", filename);
+        document.put("extension", extensionOf(filename));
+        document.put("contentType", file.getContentType());
+        document.put("sizeBytes", content.length);
+        document.put("sha256", sha256(content));
+        // The bytes themselves, for steps that carry the document inside a JSON body
+        // (an attachment field, a signing payload) rather than as multipart.
+        document.put("base64", Base64.getEncoder().encodeToString(content));
+
+        if (looksLikePdf(content)) {
+            addPdfFacts(document, root, content, objectMapper);
+        }
+
+        ObjectNode run = root.putObject("run");
+        run.put("policyName", policyName);
+        run.put("runId", runId);
+        run.put("timestamp", Instant.now().toString());
+        return root;
+    }
+
+    /** PDF-only facts. A document we cannot parse still gets the basics above. */
+    private static void addPdfFacts(
+            ObjectNode document, ObjectNode root, byte[] content, ObjectMapper objectMapper) {
+        try (PDDocument pdf = Loader.loadPDF(content)) {
+            document.put("pageCount", pdf.getNumberOfPages());
+            document.put("encrypted", pdf.isEncrypted());
+
+            PDDocumentInformation info = pdf.getDocumentInformation();
+            document.put("title", info.getTitle());
+            document.put("author", info.getAuthor());
+            document.put("subject", info.getSubject());
+            document.put("keywords", info.getKeywords());
+            document.put("creator", info.getCreator());
+            document.put("producer", info.getProducer());
+            document.put("created", toIso(info.getCreationDate()));
+            document.put("modified", toIso(info.getModificationDate()));
+
+            addClassification(root, info, objectMapper);
+            addSensitivityLabel(root, pdf);
+        } catch (IOException | RuntimeException e) {
+            // An encrypted or malformed PDF is a normal thing to send to an external API; the
+            // extra facts are a convenience, not a precondition.
+            log.debug("Could not read PDF facts for the step context: {}", e.getMessage());
+        }
+    }
+
+    /** The classifier policy's verdict, so a call-out can act on it without re-classifying. */
+    private static void addClassification(
+            ObjectNode root, PDDocumentInformation info, ObjectMapper objectMapper) {
+        String raw = info.getCustomMetadataValue(PdfMetadataService.CLASSIFICATION_KEY);
+        if (raw == null || raw.isBlank()) {
+            return;
+        }
+        try {
+            JsonNode parsed = objectMapper.readTree(raw);
+            root.set("classification", parsed);
+        } catch (RuntimeException e) {
+            // Written by another tool; if it is not JSON, pass it through as text rather than drop
+            // it - the receiving system may still recognise it.
+            root.put("classification", raw);
+        }
+    }
+
+    /** The Purview label already on the document, if any. */
+    private static void addSensitivityLabel(ObjectNode root, PDDocument pdf) {
+        List<SensitivityLabel> labels = PdfSensitivityLabels.readAll(pdf);
+        if (labels.isEmpty()) {
+            return;
+        }
+        SensitivityLabel label = labels.get(0);
+        ObjectNode node = root.putObject("sensitivityLabel");
+        node.put("labelId", label.labelId());
+        node.put("name", label.name());
+        node.put("siteId", label.siteId());
+        node.put("method", label.method() == null ? null : label.method().name());
+        node.put("protected", label.isProtected());
+    }
+
+    /** Cheap check so a non-PDF never pays for a parse attempt. */
+    private static boolean looksLikePdf(byte[] content) {
+        return content.length > 4
+                && content[0] == '%'
+                && content[1] == 'P'
+                && content[2] == 'D'
+                && content[3] == 'F';
+    }
+
+    /**
+     * A content hash is the field external systems most often key on - dedupe, chain-of-custody,
+     * "have I already scanned this" - and they cannot compute it without the bytes we are sending.
+     */
+    private static String sha256(byte[] content) {
+        try {
+            return HexFormat.of().formatHex(MessageDigest.getInstance("SHA-256").digest(content));
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException("SHA-256 is required by the Java platform", e);
+        }
+    }
+
+    private static String toIso(Calendar calendar) {
+        return calendar == null ? null : calendar.toInstant().toString();
+    }
+
+    private static String extensionOf(String filename) {
+        if (filename == null) {
+            return null;
+        }
+        int dot = filename.lastIndexOf('.');
+        return dot < 0 || dot == filename.length() - 1
+                ? null
+                : filename.substring(dot + 1).toLowerCase(Locale.ROOT);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiCallController.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiCallController.java
new file mode 100644
index 0000000000..499ab90fdb
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiCallController.java
@@ -0,0 +1,552 @@
+package stirling.software.proprietary.integration.api;
+
+import java.io.IOException;
+import java.util.Base64;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.multipart.MultipartFile;
+
+import io.github.pixee.security.Filenames;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.service.AutomationRunContext;
+import stirling.software.common.service.InternalApiClient;
+import stirling.software.common.util.TempFileManager;
+import stirling.software.proprietary.service.AiToolResponseHeaders;
+
+import tools.jackson.core.type.TypeReference;
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ObjectNode;
+
+/**
+ * Posts the document flowing through a policy to a third-party HTTP API and folds the answer back
+ * into the run.
+ *
+ * <p>This is the generic integration step: rather than a bespoke connector per vendor, an operator
+ * defines an {@code API} connection (base URL + credentials) once and any policy can call a path
+ * under it. The connection owns the host and the credentials; the step owns only the path and the
+ * form fields, so a policy author can never aim the call somewhere else or read the secret.
+ *
+ * <p>Response handling is explicit rather than inferred, because the two useful behaviours destroy
+ * different things when guessed wrong:
+ *
+ * <ul>
+ *   <li>{@code report} (default) - the document continues untouched and the API's answer rides
+ *       along in {@link AiToolResponseHeaders#TOOL_REPORT}. For call-outs that inspect or notify. A
+ *       {@code requireTrue} field turns the answer into a gate: the named JSON verdict must be true
+ *       or the step fails, so a scanner's "not clean" actually stops the run.
+ *   <li>{@code replace} - the response body <em>becomes</em> the document. For call-outs that
+ *       transform. Fails loudly if the API returns JSON or an empty body, instead of silently
+ *       dropping the document from the pipeline.
+ * </ul>
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/integration")
+@RequiredArgsConstructor
+@Tag(name = "Integrations", description = "Third-party integration steps.")
+public class ExternalApiCallController {
+
+    static final String MODE_REPORT = "report";
+    static final String MODE_REPLACE = "replace";
+
+    /**
+     * The report travels as an HTTP header, and Jetty caps a response header at 8KB by default. A
+     * body larger than this is summarised rather than risking a header the container refuses to
+     * write - which would fail the whole step over a merely verbose API.
+     */
+    static final int MAX_REPORT_BODY_CHARS = 4096;
+
+    static final String BODY_MULTIPART = "multipart";
+    static final String BODY_JSON = "json";
+    static final String BODY_BINARY = "binary";
+
+    /** Field (multipart) and property (json) the auto-populated context is offered under. */
+    static final String CONTEXT_FIELD = "stirlingContext";
+
+    private final ApiConnectionResolver connectionResolver;
+    private final ExternalApiCaller caller;
+    private final ObjectMapper objectMapper;
+    private final TempFileManager tempFileManager;
+    private final ApplicationProperties applicationProperties;
+
+    @PostMapping(value = "/external-api-call", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Send the document to an external API",
+            description =
+                    "Sends the document to a path under a stored API connection's base URL and"
+                            + " either records the response as a step report or replaces the"
+                            + " document with it. Fields, path and headers may reference"
+                            + " {{document.*}}, {{classification.*}}, {{sensitivityLabel.*}} and"
+                            + " {{run.*}}. Type:SISO")
+    public ResponseEntity<Resource> call(
+            @RequestParam("fileInput") MultipartFile fileInput,
+            @RequestParam("connectionId") String connectionId,
+            @RequestParam(value = "path", required = false) String path,
+            @RequestParam(value = "method", defaultValue = "POST") String method,
+            @RequestParam(value = "bodyMode", defaultValue = BODY_MULTIPART) String bodyMode,
+            @RequestParam(value = "fileFieldName", defaultValue = "file") String fileFieldName,
+            @RequestParam(value = "responseMode", defaultValue = MODE_REPORT) String responseMode,
+            @RequestParam(value = "resultUrlPath", required = false) String resultUrlPath,
+            @RequestParam(value = "resultUrlHeader", required = false) String resultUrlHeader,
+            @RequestParam(value = "responseSelect", required = false) String responseSelect,
+            @RequestParam(value = "requireTrue", required = false) String requireTrue,
+            @RequestParam(value = "fields", required = false) String fields,
+            @RequestParam(value = "bodyTemplate", required = false) String bodyTemplate,
+            @RequestParam(value = "headers", required = false) String headers,
+            @RequestParam(value = "includeContext", defaultValue = "false") boolean includeContext,
+            @RequestParam(value = "includeFile", defaultValue = "true") boolean includeFile,
+            @RequestHeader(value = InternalApiClient.POLICY_NAME_HEADER, required = false)
+                    String policyName,
+            @RequestHeader(value = AutomationRunContext.RUN_ID_HEADER, required = false)
+                    String runId)
+            throws IOException {
+
+        String mode = normalise(responseMode, MODE_REPORT, MODE_REPORT, MODE_REPLACE);
+        String body = normalise(bodyMode, BODY_MULTIPART, BODY_MULTIPART, BODY_JSON, BODY_BINARY);
+        String verb = parseMethod(method);
+
+        Long id = ApiConnectionResolver.connectionId(connectionId);
+        if (id == null) {
+            throw new IllegalArgumentException("'connectionId' is required");
+        }
+        ApiConnectionSettings settings = connectionResolver.resolve(id);
+
+        String filename = safeFileName(fileInput.getOriginalFilename());
+        String contentType =
+                fileInput.getContentType() == null
+                        ? MediaType.APPLICATION_OCTET_STREAM_VALUE
+                        : fileInput.getContentType();
+        byte[] content = fileInput.getBytes();
+
+        ObjectNode context =
+                DocumentContext.build(fileInput, content, policyName, runId, objectMapper);
+
+        ExternalApiCaller.Response response =
+                caller.dispatch(
+                        settings,
+                        verb,
+                        Placeholders.resolve(path, context, Placeholders.Escaping.URL_PATH),
+                        buildBody(
+                                body,
+                                bodyTemplate,
+                                includeFile,
+                                includeContext,
+                                context,
+                                fileFieldName,
+                                filename,
+                                contentType,
+                                content,
+                                resolveAll(parseJsonObject(fields, "fields"), context)),
+                        validatedHeaders(resolveAll(parseJsonObject(headers, "headers"), context)));
+
+        if (!response.isSuccess()) {
+            // Fail the step: a policy that silently continued past a rejected call-out would
+            // deliver documents the external system believes it never approved.
+            throw new IOException(
+                    "External API returned HTTP " + response.status() + summarise(response));
+        }
+
+        enforceVerdict(response, requireTrue);
+
+        return MODE_REPLACE.equals(mode)
+                ? replaceDocument(
+                        settings,
+                        response,
+                        filename,
+                        resultUrlPath,
+                        resultUrlHeader,
+                        responseSelect)
+                : reportOnly(fileInput, filename, contentType, response);
+    }
+
+    /**
+     * Assemble the outbound body.
+     *
+     * <ul>
+     *   <li>{@code multipart} - the file plus form fields, what most upload APIs expect.
+     *   <li>{@code json} - a JSON object of the fields, with the context merged in and the file
+     *       base64'd under {@code content}. For APIs that take a document as JSON, and for
+     *       notify-style call-outs (with {@code includeFile=false}) that want the facts only.
+     *   <li>{@code binary} - the raw bytes as the body. For APIs that want the file and nothing
+     *       else; fields would have nowhere to go, so they are refused rather than dropped.
+     * </ul>
+     */
+    private ExternalApiCaller.Body buildBody(
+            String bodyMode,
+            String bodyTemplate,
+            boolean includeFile,
+            boolean includeContext,
+            ObjectNode context,
+            String fileFieldName,
+            String filename,
+            String contentType,
+            byte[] content,
+            Map<String, String> fields)
+            throws IOException {
+
+        if (bodyTemplate != null && !bodyTemplate.isBlank()) {
+            return templatedBody(bodyTemplate, context, filename, contentType, content);
+        }
+        switch (bodyMode) {
+            case BODY_BINARY -> {
+                if (!fields.isEmpty()) {
+                    throw new IllegalArgumentException(
+                            "bodyMode 'binary' sends only the document, so 'fields' cannot be"
+                                    + " sent; use 'headers' instead, or bodyMode 'multipart'.");
+                }
+                if (!includeFile) {
+                    throw new IllegalArgumentException(
+                            "bodyMode 'binary' with includeFile=false would send an empty body");
+                }
+                return ExternalApiCaller.raw(contentType, content);
+            }
+            case BODY_JSON -> {
+                ObjectNode json = objectMapper.createObjectNode();
+                fields.forEach(json::put);
+                if (includeContext) {
+                    json.setAll(context);
+                }
+                if (includeFile) {
+                    json.put("filename", filename);
+                    json.put("contentType", contentType);
+                    json.put("content", Base64.getEncoder().encodeToString(content));
+                }
+                return ExternalApiCaller.raw(
+                        MediaType.APPLICATION_JSON_VALUE, objectMapper.writeValueAsBytes(json));
+            }
+            default -> {
+                Map<String, String> all = new LinkedHashMap<>(fields);
+                if (includeContext) {
+                    all.put(CONTEXT_FIELD, objectMapper.writeValueAsString(context));
+                }
+                if (!includeFile) {
+                    // Fields-only multipart: a notify-style call-out that wants the facts, not
+                    // the document.
+                    MultipartBody body = new MultipartBody();
+                    body.addFields(all);
+                    return new ExternalApiCaller.Body(body.contentType(), body.build());
+                }
+                return ExternalApiCaller.multipart(
+                        fileFieldName, filename, contentType, content, all);
+            }
+        }
+    }
+
+    /**
+     * A caller-shaped JSON body: the template is resolved against the context, so an arbitrary
+     * vendor payload can be expressed as config. {@code {{document.base64}}} carries the file
+     * itself, which is how APIs that take a document nested inside a JSON document are reached.
+     *
+     * <p>The base64 is added to a copy of the context rather than the context proper: it is the
+     * size of the file, and {@code stirlingContext} must not silently grow by a whole document.
+     */
+    private ExternalApiCaller.Body templatedBody(
+            String bodyTemplate,
+            ObjectNode context,
+            String filename,
+            String contentType,
+            byte[] content)
+            throws IOException {
+        JsonNode template;
+        try {
+            template = objectMapper.readTree(bodyTemplate);
+        } catch (Exception e) {
+            throw new IllegalArgumentException("api step 'bodyTemplate' must be valid JSON", e);
+        }
+        ObjectNode withFile = context.deepCopy();
+        ObjectNode document = (ObjectNode) withFile.get("document");
+        if (document != null) {
+            document.put("base64", Base64.getEncoder().encodeToString(content));
+            document.put("safeFilename", filename);
+            document.put("resolvedContentType", contentType);
+        }
+        JsonNode resolved = Placeholders.resolveTree(template, withFile);
+        return ExternalApiCaller.raw(
+                MediaType.APPLICATION_JSON_VALUE, objectMapper.writeValueAsBytes(resolved));
+    }
+
+    /** Resolve every value's placeholders against the context. */
+    private Map<String, String> resolveAll(Map<String, String> values, ObjectNode context) {
+        Map<String, String> out = new LinkedHashMap<>();
+        values.forEach(
+                (key, value) ->
+                        out.put(
+                                key,
+                                Placeholders.resolve(value, context, Placeholders.Escaping.NONE)));
+        return out;
+    }
+
+    /** Per-step headers, held to the same rules as a connection's static headers. */
+    private Map<String, String> validatedHeaders(Map<String, String> headers) {
+        headers.forEach(
+                (name, value) -> {
+                    if (!ExternalApiHeaders.isValidName(name)) {
+                        throw new IllegalArgumentException(
+                                "api step 'headers' has an invalid header name: " + name);
+                    }
+                    if (ExternalApiHeaders.isReserved(name)) {
+                        throw new IllegalArgumentException(
+                                "api step 'headers' must not set '"
+                                        + name
+                                        + "'; it is set by the connection or the client");
+                    }
+                    if (!ExternalApiHeaders.isValidValue(value)) {
+                        // A resolved placeholder could carry a newline out of document metadata.
+                        throw new IllegalArgumentException(
+                                "api step 'headers' has an invalid value for '" + name + "'");
+                    }
+                });
+        return headers;
+    }
+
+    private static String parseMethod(String method) {
+        String verb = method == null ? "POST" : method.trim().toUpperCase(Locale.ROOT);
+        // Only the verbs that carry a body; GET/DELETE would silently drop the document.
+        if (!List.of("POST", "PUT", "PATCH").contains(verb)) {
+            throw new IllegalArgumentException(
+                    "'method' must be POST, PUT or PATCH; got " + method);
+        }
+        return verb;
+    }
+
+    private static String normalise(String value, String fallback, String... allowed) {
+        String out =
+                value == null || value.isBlank() ? fallback : value.trim().toLowerCase(Locale.ROOT);
+        if (!List.of(allowed).contains(out)) {
+            throw new IllegalArgumentException(
+                    "must be one of " + String.join(", ", allowed) + "; got " + value);
+        }
+        return out;
+    }
+
+    /**
+     * Turn the response into the document that continues down the pipeline.
+     *
+     * <p>Three shapes of answer are accepted, because real APIs use all three: the document inline,
+     * a URL to fetch it from, or an archive to pick it out of. Anything else fails the step rather
+     * than putting a non-document into the pipeline for a later step to trip over.
+     */
+    private ResponseEntity<Resource> replaceDocument(
+            ApiConnectionSettings settings,
+            ExternalApiCaller.Response response,
+            String requestFilename,
+            String resultUrlPath,
+            String resultUrlHeader,
+            String responseSelect)
+            throws IOException {
+
+        ExternalApiCaller.Response payload = response;
+        boolean followed = false;
+        String url = resultUrl(response, resultUrlPath, resultUrlHeader);
+        if (url != null) {
+            // The URL came out of the response, so ResultUrls decides whether it may be fetched.
+            payload =
+                    caller.getResult(
+                            settings, ResultUrls.validate(settings, url, applicationProperties));
+            followed = true;
+            if (!payload.isSuccess()) {
+                throw new IOException(
+                        "Fetching the API's result URL returned HTTP " + payload.status());
+            }
+        }
+
+        if (payload.body().length == 0) {
+            throw new IOException(
+                    "External API returned an empty body, so there is no document to replace with;"
+                            + " use responseMode=report to keep the original.");
+        }
+        if (payload.isJson() && !followed) {
+            throw new IOException(
+                    "External API returned JSON, which cannot replace the document. Use"
+                            + " responseMode=report to keep the original and record the answer, or"
+                            + " set resultUrlPath if the JSON points at the document.");
+        }
+
+        String filename = ResultFiles.nameFor(payload, requestFilename);
+        Resource result = ResultFiles.asResource(payload.body(), filename);
+
+        if (ResultFiles.isArchive(result)) {
+            if (responseSelect == null || responseSelect.isBlank()) {
+                // Handing a .zip to a step that expects a PDF fails later and more obscurely.
+                throw new IOException(
+                        "External API returned an archive; set 'responseSelect' (e.g. *.pdf, or an"
+                                + " index) to say which entry becomes the document.");
+            }
+            result = ResultFiles.selectFromArchive(result, responseSelect, tempFileManager);
+            filename = result.getFilename();
+        } else if (responseSelect != null && !responseSelect.isBlank()) {
+            throw new IOException(
+                    "'responseSelect' was set but the API returned a single file, not an archive");
+        }
+
+        MediaType type =
+                payload.contentType() == null || ResultFiles.isArchiveName(filename)
+                        ? MediaType.APPLICATION_OCTET_STREAM
+                        : MediaType.parseMediaType(payload.contentType().split(";")[0].trim());
+        return ResponseEntity.ok()
+                .contentType(type)
+                .header(
+                        HttpHeaders.CONTENT_DISPOSITION,
+                        "attachment; filename=\"" + filename + "\"")
+                .body(result);
+    }
+
+    /** The result URL the API pointed at, from the body or a header; null when neither is set. */
+    private String resultUrl(
+            ExternalApiCaller.Response response, String resultUrlPath, String resultUrlHeader) {
+        if (resultUrlHeader != null && !resultUrlHeader.isBlank()) {
+            String value = response.header(resultUrlHeader.trim());
+            if (value == null || value.isBlank()) {
+                throw new IllegalArgumentException(
+                        "'resultUrlHeader' names '"
+                                + resultUrlHeader
+                                + "' but the response had no such header");
+            }
+            return value;
+        }
+        if (resultUrlPath == null || resultUrlPath.isBlank()) {
+            return null;
+        }
+        JsonNode node = response.bodyAsJson(objectMapper);
+        for (String segment : resultUrlPath.trim().split("\\.")) {
+            if (node == null) {
+                break;
+            }
+            node = node.get(segment);
+        }
+        if (node == null || !node.isValueNode() || node.asString().isBlank()) {
+            throw new IllegalArgumentException(
+                    "'resultUrlPath' found no URL at '" + resultUrlPath + "' in the response");
+        }
+        return node.asString();
+    }
+
+    /**
+     * Gate the run on a boolean verdict in the API's JSON answer (e.g. Cloudmersive's {@code
+     * CleanResult}). When {@code requireTrue} names a field - dotted for a nested one - that field
+     * must be JSON {@code true}, or the step fails so the document is parked rather than delivered.
+     * Fail-closed: a missing field, a non-boolean, a false, or a non-JSON body all stop the run.
+     * This is what makes a scanner's "not clean" actually stop the pipeline.
+     */
+    private void enforceVerdict(ExternalApiCaller.Response response, String requireTrue)
+            throws IOException {
+        if (requireTrue == null || requireTrue.isBlank()) {
+            return;
+        }
+        JsonNode node = response.isJson() ? response.bodyAsJson(objectMapper) : null;
+        for (String segment : requireTrue.trim().split("\\.")) {
+            if (node == null) {
+                break;
+            }
+            node = node.get(segment);
+        }
+        if (node == null || !node.asBoolean(false)) {
+            throw new IOException(
+                    "External API verdict '"
+                            + requireTrue.trim()
+                            + "' was not true"
+                            + summarise(response)
+                            + "; the document was not approved, so the run was stopped.");
+        }
+    }
+
+    /** The document passes through; the API's answer rides in the report header. */
+    private ResponseEntity<Resource> reportOnly(
+            MultipartFile fileInput,
+            String filename,
+            String contentType,
+            ExternalApiCaller.Response response)
+            throws IOException {
+        return ResponseEntity.ok()
+                .contentType(MediaType.parseMediaType(contentType))
+                .header(
+                        HttpHeaders.CONTENT_DISPOSITION,
+                        "attachment; filename=\"" + filename + "\"")
+                .header(AiToolResponseHeaders.TOOL_REPORT, buildReport(response))
+                .body(new ByteArrayResource(fileInput.getBytes()));
+    }
+
+    /** A JSON object describing the call, small enough to survive as a header. */
+    private String buildReport(ExternalApiCaller.Response response) {
+        ObjectNode report = objectMapper.createObjectNode();
+        report.put("status", response.status());
+        report.put("contentType", response.contentType());
+        if (response.isJson()) {
+            try {
+                JsonNode parsed = objectMapper.readTree(response.bodyAsText());
+                String rendered = objectMapper.writeValueAsString(parsed);
+                if (rendered.length() <= MAX_REPORT_BODY_CHARS) {
+                    report.set("body", parsed);
+                } else {
+                    report.put("bodyTruncated", true);
+                    report.put("body", rendered.substring(0, MAX_REPORT_BODY_CHARS));
+                }
+            } catch (Exception e) {
+                // Content-Type said JSON but the body is not; keep the step alive and say so.
+                report.put("bodyParseError", e.getMessage());
+                report.put("body", truncate(response.bodyAsText()));
+            }
+        } else {
+            report.put("bodyBytes", response.body().length);
+        }
+        return objectMapper.writeValueAsString(report);
+    }
+
+    /** A JSON object of string values, e.g. {@code {"policy":"strict"}}. */
+    private Map<String, String> parseJsonObject(String json, String what) {
+        if (json == null || json.isBlank()) {
+            return Map.of();
+        }
+        Map<String, Object> raw;
+        try {
+            raw =
+                    objectMapper.readValue(
+                            json, new TypeReference<LinkedHashMap<String, Object>>() {});
+        } catch (Exception e) {
+            throw new IllegalArgumentException("api step '" + what + "' must be a JSON object", e);
+        }
+        Map<String, String> out = new LinkedHashMap<>();
+        raw.forEach((key, value) -> out.put(key, value == null ? "" : value.toString()));
+        return out;
+    }
+
+    private String summarise(ExternalApiCaller.Response response) {
+        String text = truncate(response.bodyAsText());
+        return text.isBlank() ? "" : ": " + text;
+    }
+
+    private static String truncate(String text) {
+        if (text == null) {
+            return "";
+        }
+        String oneLine = text.replaceAll("\\s+", " ").trim();
+        return oneLine.length() <= MAX_REPORT_BODY_CHARS
+                ? oneLine
+                : oneLine.substring(0, MAX_REPORT_BODY_CHARS) + "…";
+    }
+
+    private static String safeFileName(String originalFilename) {
+        String name = Filenames.toSimpleFileName(originalFilename);
+        return (name == null || name.isBlank()) ? "document" : name;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiCaller.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiCaller.java
new file mode 100644
index 0000000000..67171bb5f5
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiCaller.java
@@ -0,0 +1,299 @@
+package stirling.software.proprietary.integration.api;
+
+import java.io.IOException;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.util.Base64;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Service;
+
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.model.ApplicationProperties;
+
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * Performs the outbound call for an {@code API} connection.
+ *
+ * <p>Follows the established self-hosted outbound pattern (JDK {@link HttpClient}; see {@code
+ * AccountLinkClient}): the client is injectable so tests can drive a real local server without
+ * reaching the network.
+ */
+@Slf4j
+@Service
+public class ExternalApiCaller {
+
+    /**
+     * Cap on a response we will read into memory. An external API returning something enormous is a
+     * misconfiguration, and without a cap it would be a trivial way to OOM the server.
+     */
+    static final int MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
+
+    private static final Duration CONNECT_TIMEOUT = Duration.ofSeconds(10);
+
+    private final HttpClient httpClient;
+    private final ApplicationProperties applicationProperties;
+    private final ApiTokenCache tokenCache;
+
+    @Autowired
+    public ExternalApiCaller(
+            ApplicationProperties applicationProperties, ObjectMapper objectMapper) {
+        this(
+                HttpClient.newBuilder()
+                        .connectTimeout(CONNECT_TIMEOUT)
+                        // Following a redirect would re-target the request at a host the base URL
+                        // never authorised, undoing ExternalApiPaths. Let the caller see the 3xx.
+                        .followRedirects(HttpClient.Redirect.NEVER)
+                        .build(),
+                applicationProperties,
+                objectMapper);
+    }
+
+    ExternalApiCaller(
+            HttpClient httpClient,
+            ApplicationProperties applicationProperties,
+            ObjectMapper objectMapper) {
+        this.httpClient = httpClient;
+        this.applicationProperties = applicationProperties;
+        this.tokenCache = new ApiTokenCache(httpClient, objectMapper);
+    }
+
+    /** What the external API sent back, before the step decides what to do with it. */
+    public record Response(
+            int status, String contentType, byte[] body, Map<String, String> headers) {
+
+        public Response {
+            headers = headers == null ? Map.of() : Map.copyOf(headers);
+        }
+
+        /** A response header by name, case-insensitively; null when absent. */
+        public String header(String name) {
+            for (Map.Entry<String, String> entry : headers.entrySet()) {
+                if (entry.getKey().equalsIgnoreCase(name)) {
+                    return entry.getValue();
+                }
+            }
+            return null;
+        }
+
+        JsonNode bodyAsJson(ObjectMapper objectMapper) {
+            try {
+                return objectMapper.readTree(bodyAsText());
+            } catch (RuntimeException e) {
+                return null;
+            }
+        }
+
+        public boolean isSuccess() {
+            return status >= 200 && status < 300;
+        }
+
+        public boolean isJson() {
+            return contentType != null && contentType.toLowerCase().contains("json");
+        }
+
+        public String bodyAsText() {
+            return new String(body, StandardCharsets.UTF_8);
+        }
+    }
+
+    /**
+     * POST a document to {@code path} under the connection's base URL as multipart/form-data.
+     *
+     * @throws IOException on transport failure or an oversized response
+     */
+    public Response postFile(
+            ApiConnectionSettings settings,
+            String path,
+            String fileFieldName,
+            String filename,
+            String fileContentType,
+            byte[] content,
+            Map<String, String> fields)
+            throws IOException {
+        return dispatch(
+                settings,
+                "POST",
+                path,
+                multipart(fileFieldName, filename, fileContentType, content, fields),
+                Map.of());
+    }
+
+    /** A request body plus the Content-Type that describes it. */
+    record Body(String contentType, HttpRequest.BodyPublisher publisher) {}
+
+    static Body multipart(
+            String fileFieldName,
+            String filename,
+            String fileContentType,
+            byte[] content,
+            Map<String, String> fields)
+            throws IOException {
+        MultipartBody body = new MultipartBody();
+        body.addFields(fields);
+        body.addFile(fileFieldName, filename, fileContentType, content);
+        return new Body(body.contentType(), body.build());
+    }
+
+    /** A body of caller-built bytes, e.g. a JSON document or the raw file. */
+    static Body raw(String contentType, byte[] content) {
+        return new Body(contentType, HttpRequest.BodyPublishers.ofByteArray(content));
+    }
+
+    /**
+     * Send {@code body} to {@code path} under the connection's base URL.
+     *
+     * @param method POST, PUT or PATCH - the verbs that carry a body
+     * @param extraHeaders per-step headers, already validated by the caller
+     */
+    public Response dispatch(
+            ApiConnectionSettings settings,
+            String method,
+            String path,
+            Body body,
+            Map<String, String> extraHeaders)
+            throws IOException {
+
+        URI target = ExternalApiPaths.resolve(settings.baseUri(), path);
+        // Re-check at dispatch: save-time validation cannot see a DNS record re-pointed at a
+        // private address afterwards.
+        ApiIntegrationValidator.requirePublicHost(
+                settings, applicationProperties, "API connection base URL");
+
+        Response response = attempt(settings, method, target, body, extraHeaders);
+        if (response.status() == 401 && settings.authType() == ApiAuthType.TOKEN_LOGIN) {
+            // The cached token was rejected - expired early, or revoked. One fresh login and
+            // one retry; if that also 401s the credentials are wrong and the step says so.
+            log.debug("[external-api] token rejected by {}; re-authenticating", target.getHost());
+            tokenCache.invalidate(settings);
+            response = attempt(settings, method, target, body, extraHeaders);
+        }
+        return response;
+    }
+
+    private Response attempt(
+            ApiConnectionSettings settings,
+            String method,
+            URI target,
+            Body body,
+            Map<String, String> extraHeaders)
+            throws IOException {
+        HttpRequest.Builder request =
+                HttpRequest.newBuilder(target)
+                        .timeout(Duration.ofSeconds(settings.timeoutSeconds()))
+                        .header("Content-Type", body.contentType())
+                        .method(method, body.publisher());
+        applyHeaders(request, settings);
+        // Step headers last so a step can override a connection default, but never the auth
+        // header: ExternalApiHeaders rejects reserved names before we get here.
+        extraHeaders.forEach(request::header);
+        return send(httpClient, request.build(), target);
+    }
+
+    /**
+     * GET an absolute result URL the API pointed us at.
+     *
+     * <p>Takes a {@link URI} rather than a string so it cannot be called with something unchecked:
+     * the only way to obtain one is {@link ResultUrls#validate}, which is where the host allowlist
+     * lives. Credentials are deliberately not sent - the URL is usually a presigned link on another
+     * host, and forwarding the connection's token there would leak it to a third party.
+     */
+    public Response getResult(ApiConnectionSettings settings, URI target) throws IOException {
+        HttpRequest request =
+                HttpRequest.newBuilder(target)
+                        .timeout(Duration.ofSeconds(settings.timeoutSeconds()))
+                        .GET()
+                        .build();
+        return send(httpClient, request, target);
+    }
+
+    /** GET {@code path} under the connection's base URL. */
+    public Response get(ApiConnectionSettings settings, String path) throws IOException {
+        URI target = ExternalApiPaths.resolve(settings.baseUri(), path);
+        ApiIntegrationValidator.requirePublicHost(
+                settings, applicationProperties, "API connection base URL");
+
+        HttpRequest.Builder request =
+                HttpRequest.newBuilder(target)
+                        .timeout(Duration.ofSeconds(settings.timeoutSeconds()))
+                        .GET();
+        applyHeaders(request, settings);
+        return send(httpClient, request.build(), target);
+    }
+
+    static Response send(HttpClient httpClient, HttpRequest request, URI target)
+            throws IOException {
+        HttpResponse<byte[]> response;
+        try {
+            response = httpClient.send(request, HttpResponse.BodyHandlers.ofByteArray());
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IOException("Interrupted calling " + safeTarget(target), e);
+        } catch (IOException e) {
+            // The message can carry the host but never the credentials, which live in headers.
+            throw new IOException(
+                    "Failed to call " + safeTarget(target) + ": " + e.getMessage(), e);
+        }
+        byte[] body = response.body() == null ? new byte[0] : response.body();
+        if (body.length > MAX_RESPONSE_BYTES) {
+            throw new IOException(
+                    "Response from "
+                            + safeTarget(target)
+                            + " exceeds the "
+                            + MAX_RESPONSE_BYTES
+                            + " byte limit");
+        }
+        String contentType = response.headers().firstValue("content-type").orElse(null);
+        Map<String, String> headers = new LinkedHashMap<>();
+        response.headers()
+                .map()
+                .forEach((name, values) -> headers.put(name, String.join(", ", values)));
+        log.debug("[external-api] {} -> HTTP {}", safeTarget(target), response.statusCode());
+        return new Response(response.statusCode(), contentType, body, headers);
+    }
+
+    private void applyHeaders(HttpRequest.Builder request, ApiConnectionSettings settings)
+            throws IOException {
+        settings.headers().forEach(request::header);
+        switch (settings.authType()) {
+            case BEARER -> request.header("Authorization", "Bearer " + settings.token());
+            case HEADER ->
+                    request.header(
+                            settings.headerName(),
+                            settings.headerPrefix() == null
+                                    ? settings.token()
+                                    : settings.headerPrefix() + " " + settings.token());
+            case BASIC ->
+                    request.header(
+                            "Authorization",
+                            "Basic "
+                                    + Base64.getEncoder()
+                                            .encodeToString(
+                                                    (settings.username()
+                                                                    + ":"
+                                                                    + settings.password())
+                                                            .getBytes(StandardCharsets.UTF_8)));
+            case TOKEN_LOGIN -> {
+                Map.Entry<String, String> auth = tokenCache.authHeader(settings);
+                request.header(auth.getKey(), auth.getValue());
+            }
+            case NONE -> {
+                /* no credentials */
+            }
+        }
+    }
+
+    /** Scheme, host and path only: a query string could carry a token an operator put there. */
+    private static String safeTarget(URI target) {
+        return target.getScheme() + "://" + target.getAuthority() + target.getPath();
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiHeaders.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiHeaders.java
new file mode 100644
index 0000000000..055101e381
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiHeaders.java
@@ -0,0 +1,72 @@
+package stirling.software.proprietary.integration.api;
+
+import java.util.Locale;
+import java.util.Set;
+
+/**
+ * Validation for operator-supplied HTTP header names and values.
+ *
+ * <p>Header values reach the wire verbatim, so a value carrying CR/LF could splice extra headers -
+ * or a whole second request - into the stream. Names and values are therefore checked against the
+ * RFC 7230 grammar rather than trusted.
+ */
+public final class ExternalApiHeaders {
+
+    /**
+     * Headers a connection may not set as a static header. Authentication has exactly one path
+     * ({@code authType} + {@code token}) so credentials cannot be smuggled in as a "static" header
+     * that bypasses the auth validation; the rest are framing headers owned by the HTTP client,
+     * where a caller-set value would contradict the body actually sent.
+     */
+    private static final Set<String> RESERVED =
+            Set.of(
+                    "authorization",
+                    "proxy-authorization",
+                    "host",
+                    "content-length",
+                    "transfer-encoding",
+                    "connection",
+                    "upgrade",
+                    "expect");
+
+    private ExternalApiHeaders() {}
+
+    /** RFC 7230 {@code token}: the only characters legal in a header name. */
+    public static boolean isValidName(String name) {
+        if (name == null || name.isEmpty()) {
+            return false;
+        }
+        for (int i = 0; i < name.length(); i++) {
+            if (!isTokenChar(name.charAt(i))) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /** Visible ASCII, space and horizontal tab. Excludes CR/LF and NUL, which would inject. */
+    public static boolean isValidValue(String value) {
+        if (value == null) {
+            return false;
+        }
+        for (int i = 0; i < value.length(); i++) {
+            char c = value.charAt(i);
+            boolean printable = c >= 0x20 && c <= 0x7E;
+            if (!printable && c != '\t') {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    public static boolean isReserved(String name) {
+        return name != null && RESERVED.contains(name.toLowerCase(Locale.ROOT));
+    }
+
+    private static boolean isTokenChar(char c) {
+        return (c >= 'a' && c <= 'z')
+                || (c >= 'A' && c <= 'Z')
+                || (c >= '0' && c <= '9')
+                || "!#$%&'*+-.^_`|~".indexOf(c) >= 0;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiPaths.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiPaths.java
new file mode 100644
index 0000000000..36ca00816c
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ExternalApiPaths.java
@@ -0,0 +1,120 @@
+package stirling.software.proprietary.integration.api;
+
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Locale;
+
+/**
+ * Resolves a step-supplied relative path under a connection's operator-set base URL.
+ *
+ * <p>This is the control that keeps the external-API step from being an SSRF primitive. The base
+ * URL comes from an {@code IntegrationConfig} only someone with manage rights can edit; the path
+ * comes from a pipeline step, which is a far weaker trust boundary. Everything here exists to
+ * guarantee that a path can address a resource <em>under</em> the base and nothing else.
+ *
+ * <p>{@link URI#resolve} is deliberately not used: resolving the protocol-relative {@code
+ * //evil.example} against {@code https://api.example.com/v1} yields {@code https://evil.example},
+ * silently changing host. Instead the path is screened, appended textually, normalised, and then
+ * the result is re-checked against the base - so a miss in the screen is still caught by the check.
+ */
+public final class ExternalApiPaths {
+
+    private ExternalApiPaths() {}
+
+    /**
+     * @param base the connection's base URL, already validated as http(s) with a host
+     * @param path a relative path, optionally with a query string; blank means the base itself
+     * @throws IllegalArgumentException if the path is absolute, escapes the base, or carries
+     *     characters that could split the request line
+     */
+    public static URI resolve(URI base, String path) {
+        if (path == null || path.isBlank()) {
+            return base;
+        }
+        String candidate = path.trim();
+        screen(candidate);
+
+        if (!candidate.startsWith("/")) {
+            candidate = "/" + candidate;
+        }
+
+        URI resolved;
+        try {
+            resolved = new URI(base + candidate).normalize();
+        } catch (URISyntaxException e) {
+            throw new IllegalArgumentException(
+                    "api step 'path' is not a valid URL path: " + path, e);
+        }
+        requireSameOrigin(base, resolved, path);
+        requireUnderBasePath(base, resolved, path);
+        return resolved;
+    }
+
+    /** Reject the shapes that could retarget the request before it is even assembled. */
+    private static void screen(String path) {
+        if (path.contains("://") || path.startsWith("//")) {
+            throw new IllegalArgumentException(
+                    "api step 'path' must be relative to the connection's base URL, not an"
+                            + " absolute or protocol-relative URL: "
+                            + path);
+        }
+        for (int i = 0; i < path.length(); i++) {
+            char c = path.charAt(i);
+            // Control characters and spaces can split the request line; a backslash is normalised
+            // to '/' by some servers and would sidestep the traversal check below.
+            if (c <= 0x20 || c == 0x7F || c == '\\') {
+                throw new IllegalArgumentException(
+                        "api step 'path' contains an illegal character: " + path);
+            }
+        }
+        if (path.indexOf('#') >= 0) {
+            throw new IllegalArgumentException(
+                    "api step 'path' must not contain a fragment: " + path);
+        }
+        // Percent-encoded dots would survive the normalise() below and be decoded by the target, so
+        // a traversal must not be smuggled past us in encoded form.
+        //
+        // Only dots are rejected. An encoded slash or backslash is legitimate: Placeholders encodes
+        // substituted values, so a filename containing '/' arrives here as %2F, where it is data
+        // inside one segment rather than structure. Rejecting those would refuse ordinary filenames
+        // while doing nothing for traversal, which needs the dots.
+        String lower = path.toLowerCase(Locale.ROOT);
+        if (lower.contains("%2e")) {
+            throw new IllegalArgumentException(
+                    "api step 'path' must not percent-encode dots: " + path);
+        }
+    }
+
+    private static void requireSameOrigin(URI base, URI resolved, String original) {
+        boolean sameOrigin =
+                equalsIgnoreCase(base.getScheme(), resolved.getScheme())
+                        && equalsIgnoreCase(base.getHost(), resolved.getHost())
+                        && base.getPort() == resolved.getPort()
+                        && resolved.getUserInfo() == null;
+        if (!sameOrigin) {
+            throw new IllegalArgumentException(
+                    "api step 'path' would change the target host; it must stay under the"
+                            + " connection's base URL: "
+                            + original);
+        }
+    }
+
+    private static void requireUnderBasePath(URI base, URI resolved, String original) {
+        String basePath = base.getPath() == null ? "" : base.getPath();
+        String resolvedPath = resolved.getPath() == null ? "" : resolved.getPath();
+        // The base URL has its trailing slash stripped at parse time, so a base path of "/v1"
+        // must match "/v1" exactly or be followed by a separator - never "/v1betray".
+        boolean under =
+                basePath.isEmpty()
+                        || resolvedPath.equals(basePath)
+                        || resolvedPath.startsWith(basePath + "/");
+        if (!under) {
+            throw new IllegalArgumentException(
+                    "api step 'path' escapes the connection's base path: " + original);
+        }
+    }
+
+    private static boolean equalsIgnoreCase(String a, String b) {
+        return a == null ? b == null : a.equalsIgnoreCase(b);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/IntegrationStepValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/IntegrationStepValidator.java
new file mode 100644
index 0000000000..6118f3b642
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/IntegrationStepValidator.java
@@ -0,0 +1,68 @@
+package stirling.software.proprietary.integration.api;
+
+import java.util.Map;
+
+import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.proprietary.integration.model.IntegrationType;
+import stirling.software.proprietary.policy.engine.PipelineStepValidator;
+import stirling.software.proprietary.policy.model.PipelineStep;
+
+/**
+ * Authorization-checks the {@code connectionId} of any integration step, on the request thread.
+ *
+ * <p>This is what stops an integration step being a confused deputy. A step names a connection by
+ * id, and the worker thread that runs it has no principal - so {@link ApiConnectionResolver} lets
+ * the lookup through unchecked there, exactly as the S3 resolver does. Without this validator a
+ * caller could put any id in a step and have the server dial that tenant's endpoint with that
+ * tenant's stored credentials. Resolving here, while the caller is still on the thread, forces the
+ * ownership check to run.
+ *
+ * <p>Registered as a {@link PipelineStepValidator} so both entry points cover it: save-time
+ * validation of a stored policy, and {@code PolicyController}'s ad-hoc gate.
+ */
+@Component
+@RequiredArgsConstructor
+public class IntegrationStepValidator implements PipelineStepValidator {
+
+    static final String CONNECTION_ID_PARAM = "connectionId";
+    private static final String INTEGRATION_PREFIX = "/api/v1/integration/";
+
+    /**
+     * Which connection type each integration step dereferences. A step under {@link
+     * #INTEGRATION_PREFIX} that is absent here is rejected rather than waved through, so a new
+     * endpoint cannot quietly skip this check by forgetting to register.
+     */
+    private static final Map<String, IntegrationType> STEP_CONNECTION_TYPES =
+            Map.of(
+                    "/api/v1/integration/external-api-call", IntegrationType.API,
+                    "/api/v1/integration/purview-apply-label", IntegrationType.PURVIEW,
+                    "/api/v1/integration/purview-read-label", IntegrationType.PURVIEW,
+                    "/api/v1/integration/consigno-submit", IntegrationType.CONSIGNO,
+                    "/api/v1/integration/consigno-fetch-signed", IntegrationType.CONSIGNO);
+
+    private final ApiConnectionResolver connectionResolver;
+
+    @Override
+    public void validate(PipelineStep step) {
+        String operation = step.operation();
+        if (operation == null || !operation.startsWith(INTEGRATION_PREFIX)) {
+            return;
+        }
+        IntegrationType type = STEP_CONNECTION_TYPES.get(operation);
+        if (type == null) {
+            throw new IllegalArgumentException("unknown integration step: " + operation);
+        }
+        Long connectionId =
+                ApiConnectionResolver.connectionId(step.parameters().get(CONNECTION_ID_PARAM));
+        if (connectionId == null) {
+            throw new IllegalArgumentException(
+                    operation + " requires a '" + CONNECTION_ID_PARAM + "' parameter");
+        }
+        // Throws if the connection is missing, the wrong type, disabled, or not usable by the
+        // caller. The parsed settings are discarded: this call is the check.
+        connectionResolver.resolveConfig(connectionId, type);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/MultipartBody.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/MultipartBody.java
new file mode 100644
index 0000000000..a848f8599c
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/MultipartBody.java
@@ -0,0 +1,101 @@
+package stirling.software.proprietary.integration.api;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.net.http.HttpRequest;
+import java.nio.charset.StandardCharsets;
+import java.security.SecureRandom;
+import java.util.Base64;
+import java.util.Map;
+
+/**
+ * Builds a {@code multipart/form-data} body for the JDK HTTP client, which has no multipart
+ * publisher of its own.
+ *
+ * <p>The body is assembled in memory. Callers bound the document size before getting here; the
+ * external-API step is for API-shaped payloads, not bulk transfer.
+ */
+final class MultipartBody {
+
+    private final String boundary;
+    private final ByteArrayOutputStream out = new ByteArrayOutputStream();
+
+    MultipartBody() {
+        byte[] random = new byte[16];
+        new SecureRandom().nextBytes(random);
+        this.boundary =
+                "StirlingBoundary" + Base64.getUrlEncoder().withoutPadding().encodeToString(random);
+    }
+
+    String contentType() {
+        return "multipart/form-data; boundary=" + boundary;
+    }
+
+    /**
+     * @throws IllegalArgumentException if the <em>name</em> could break out of its part header;
+     *     names come from step parameters, so they are checked rather than trusted
+     */
+    MultipartBody addField(String name, String value) throws IOException {
+        requireSafe(name, "field name");
+        writeAscii("--" + boundary + "\r\n");
+        writeAscii("Content-Disposition: form-data; name=\"" + name + "\"\r\n\r\n");
+        // The value is body, not header: quotes, newlines and backslashes are ordinary data here
+        // and must survive untouched. Checking it like a header rejected every JSON value - which
+        // is most of them, the auto-populated context included.
+        out.write(value.getBytes(StandardCharsets.UTF_8));
+        writeAscii("\r\n");
+        return this;
+    }
+
+    MultipartBody addFile(String name, String filename, String contentType, byte[] content)
+            throws IOException {
+        requireSafe(name, "file field name");
+        requireSafe(filename, "filename");
+        writeAscii("--" + boundary + "\r\n");
+        writeAscii(
+                "Content-Disposition: form-data; name=\""
+                        + name
+                        + "\"; filename=\""
+                        + filename
+                        + "\"\r\n");
+        writeAscii("Content-Type: " + contentType + "\r\n\r\n");
+        out.write(content);
+        writeAscii("\r\n");
+        return this;
+    }
+
+    HttpRequest.BodyPublisher build() throws IOException {
+        writeAscii("--" + boundary + "--\r\n");
+        return HttpRequest.BodyPublishers.ofByteArray(out.toByteArray());
+    }
+
+    MultipartBody addFields(Map<String, String> fields) throws IOException {
+        for (Map.Entry<String, String> entry : fields.entrySet()) {
+            addField(entry.getKey(), entry.getValue());
+        }
+        return this;
+    }
+
+    /**
+     * A quote, CR, LF or backslash in a <em>part header</em> - a field name or filename - would let
+     * it close the quoted string and forge headers of its own. Values are not checked: they are
+     * body, and the boundary that delimits them is 16 random bytes minted per request, so a value
+     * cannot end its own part.
+     */
+    private static void requireSafe(String value, String what) {
+        if (value == null) {
+            throw new IllegalArgumentException("api step " + what + " must not be null");
+        }
+        if (value.indexOf('"') >= 0
+                || value.indexOf('\r') >= 0
+                || value.indexOf('\n') >= 0
+                || value.indexOf('\\') >= 0) {
+            throw new IllegalArgumentException(
+                    "api step " + what + " contains an illegal character: " + value);
+        }
+    }
+
+    private void writeAscii(String text) throws IOException {
+        out.write(text.getBytes(StandardCharsets.UTF_8));
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/Placeholders.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/Placeholders.java
new file mode 100644
index 0000000000..7a8a3fade3
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/Placeholders.java
@@ -0,0 +1,153 @@
+package stirling.software.proprietary.integration.api;
+
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.node.ArrayNode;
+import tools.jackson.databind.node.ObjectNode;
+import tools.jackson.databind.node.StringNode;
+
+/**
+ * Substitutes {@code {{dotted.path}}} references against the {@link DocumentContext}.
+ *
+ * <p>This is what lets one step satisfy APIs that disagree about payload shape. Rather than a
+ * connector per vendor, an operator writes the field names the vendor expects and fills them from
+ * context - {@code {"sha256": "{{document.sha256}}", "class": "{{sensitivityLabel.name}}"}}.
+ *
+ * <p>Deliberately not a template language: dotted lookup and nothing else. No expressions, no
+ * control flow, no method calls - a step definition is lower-trust than server config, and the
+ * whole point of a template engine (evaluating what it is given) is the thing to avoid here.
+ */
+final class Placeholders {
+
+    private static final Pattern PLACEHOLDER = Pattern.compile("\\{\\{\\s*([\\w.]+)\\s*}}");
+
+    /** How a resolved value is escaped for the position it lands in. */
+    enum Escaping {
+        /** Verbatim: form fields and header values, which are validated separately. */
+        NONE,
+        /** Percent-encoded: a path segment, where a stray slash would change the target. */
+        URL_PATH
+    }
+
+    private Placeholders() {}
+
+    /**
+     * @param template text that may contain {@code {{...}}} references; null passes through
+     * @param context the object to resolve against
+     * @throws IllegalArgumentException if a reference names something the context does not hold, so
+     *     a typo surfaces as an error instead of silently sending an empty value
+     */
+    static String resolve(String template, JsonNode context, Escaping escaping) {
+        if (template == null || template.isEmpty()) {
+            return template;
+        }
+        Matcher matcher = PLACEHOLDER.matcher(template);
+        StringBuilder out = new StringBuilder();
+        while (matcher.find()) {
+            String path = matcher.group(1);
+            JsonNode value = lookup(context, path);
+            if (value == null || value.isMissingNode()) {
+                throw new IllegalArgumentException(
+                        "unknown placeholder '{{"
+                                + path
+                                + "}}'; available: document.*, classification.*,"
+                                + " sensitivityLabel.*, run.*");
+            }
+            matcher.appendReplacement(out, Matcher.quoteReplacement(render(value, escaping)));
+        }
+        matcher.appendTail(out);
+        return out.toString();
+    }
+
+    /**
+     * Resolve every string in a JSON tree, in place, leaving structure and non-strings alone.
+     *
+     * <p>This is what lets one step post an arbitrary vendor-shaped body - a nested {@code
+     * documents[0].data} as readily as a flat field - without a connector per vendor.
+     */
+    static JsonNode resolveTree(JsonNode node, JsonNode context) {
+        if (node instanceof ObjectNode object) {
+            for (String name : new java.util.ArrayList<>(object.propertyNames())) {
+                object.set(name, resolveTree(object.get(name), context));
+            }
+            return object;
+        }
+        if (node instanceof ArrayNode array) {
+            for (int i = 0; i < array.size(); i++) {
+                array.set(i, resolveTree(array.get(i), context));
+            }
+            return array;
+        }
+        if (node != null && node.isString()) {
+            return StringNode.valueOf(resolve(node.asString(), context, Escaping.NONE));
+        }
+        return node;
+    }
+
+    /** Whether the text references anything at all, so callers can skip resolving. */
+    static boolean hasPlaceholder(String text) {
+        return text != null && PLACEHOLDER.matcher(text).find();
+    }
+
+    private static JsonNode lookup(JsonNode context, String path) {
+        JsonNode node = context;
+        for (String segment : path.split("\\.")) {
+            if (node == null || !node.isObject()) {
+                return null;
+            }
+            node = node.get(segment);
+        }
+        return node;
+    }
+
+    /**
+     * A null in context renders empty rather than the literal "null": absent metadata is a normal
+     * state, and "null" in a vendor's field would be a value, not an absence.
+     */
+    private static String render(JsonNode value, Escaping escaping) {
+        String text;
+        if (value.isNull()) {
+            text = "";
+        } else if (value.isValueNode()) {
+            text = value.asString();
+        } else {
+            // An object or array (e.g. {{classification}}) renders as its JSON.
+            text = value.toString();
+        }
+        return escaping == Escaping.URL_PATH ? urlEncodePathSegment(text) : text;
+    }
+
+    /**
+     * Encode for a path segment: a filename is the likeliest value to land in a path and may carry
+     * a slash, which would otherwise read as structure rather than data.
+     *
+     * <p>Dots are left alone even though a traversal is made of them. Encoding them would be worse:
+     * {@code %2E%2E} survives {@link java.net.URI#normalize()} and gets decoded by the target, so
+     * the traversal would arrive intact and unexamined. Left raw, {@code ..} normalises here and is
+     * caught by {@code ExternalApiPaths}' under-the-base check - the one place that can actually
+     * see it.
+     */
+    private static String urlEncodePathSegment(String text) {
+        StringBuilder out = new StringBuilder(text.length());
+        for (byte b : text.getBytes(java.nio.charset.StandardCharsets.UTF_8)) {
+            char c = (char) (b & 0xFF);
+            // RFC 3986 unreserved.
+            boolean unreserved =
+                    (c >= 'a' && c <= 'z')
+                            || (c >= 'A' && c <= 'Z')
+                            || (c >= '0' && c <= '9')
+                            || c == '-'
+                            || c == '.'
+                            || c == '_'
+                            || c == '~';
+            if (unreserved) {
+                out.append(c);
+            } else {
+                out.append('%').append(String.format("%02X", b & 0xFF));
+            }
+        }
+        return out.toString();
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ResultFiles.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ResultFiles.java
new file mode 100644
index 0000000000..f2ceb7988f
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ResultFiles.java
@@ -0,0 +1,215 @@
+package stirling.software.proprietary.integration.api;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
+
+import stirling.software.common.util.TempFileManager;
+import stirling.software.common.util.ZipExtractionUtils;
+
+/**
+ * Works out which bytes, and under which name, a response should contribute to the pipeline.
+ *
+ * <p>Three things go wrong if this is left implicit:
+ *
+ * <ul>
+ *   <li><b>The name.</b> A step that replaces the document must name it for what came back, not for
+ *       what went out. Keeping the inbound name means a PDF-to-DOCX call-out yields a DOCX called
+ *       {@code .pdf}, and the next step's type check either waves it through or rejects it for the
+ *       wrong reason. The response's own {@code Content-Disposition} or {@code Content-Type} is the
+ *       only honest source.
+ *   <li><b>Archives.</b> Plenty of APIs answer with a ZIP even when one file was sent - ConsignO
+ *       returns "PDF (single) or ZIP (multiple)". Handing a {@code .zip} to a step expecting a PDF
+ *       is a confusing failure, so a step can select what it wanted out of the archive.
+ *   <li><b>Nothing useful at all.</b> An empty body or an error page is not a document, and saying
+ *       so beats letting it flow onward as one.
+ * </ul>
+ */
+final class ResultFiles {
+
+    /** Extensions we can name from a content type; anything else keeps the server's filename. */
+    private static final Map<String, String> EXTENSION_BY_TYPE =
+            Map.ofEntries(
+                    Map.entry("application/pdf", "pdf"),
+                    Map.entry("application/zip", "zip"),
+                    Map.entry("application/json", "json"),
+                    Map.entry("text/plain", "txt"),
+                    Map.entry("text/html", "html"),
+                    Map.entry("image/png", "png"),
+                    Map.entry("image/jpeg", "jpg"),
+                    Map.entry("image/tiff", "tiff"),
+                    Map.entry("application/msword", "doc"),
+                    Map.entry(
+                            "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+                            "docx"),
+                    Map.entry("application/vnd.ms-excel", "xls"),
+                    Map.entry(
+                            "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+                            "xlsx"));
+
+    private ResultFiles() {}
+
+    /**
+     * The filename to give the returned bytes.
+     *
+     * <p>Prefers what the server said ({@code Content-Disposition}), then the base name of the
+     * request with an extension derived from {@code Content-Type}, and only then the original name
+     * unchanged.
+     */
+    static String nameFor(ExternalApiCaller.Response response, String requestFilename) {
+        String disposition = response.header("content-disposition");
+        String fromServer = filenameFromDisposition(disposition);
+        if (fromServer != null) {
+            return fromServer;
+        }
+        String extension = extensionFor(response.contentType());
+        if (extension == null) {
+            return requestFilename;
+        }
+        return baseName(requestFilename) + "." + extension;
+    }
+
+    /**
+     * Pick the file a step asked for out of an archive.
+     *
+     * @param select a glob such as {@code *.pdf}, or a 0-based index such as {@code 1}
+     * @throws IOException if nothing in the archive matches, naming what was there - a silent pick
+     *     of the wrong file would be worse than a failed step
+     */
+    static Resource selectFromArchive(
+            Resource archive, String select, TempFileManager tempFileManager) throws IOException {
+        List<Resource> entries = ZipExtractionUtils.extractZip(archive, tempFileManager);
+        if (entries.isEmpty()) {
+            throw new IOException("The API returned an empty archive");
+        }
+        Integer index = asIndex(select);
+        if (index != null) {
+            if (index < 0 || index >= entries.size()) {
+                throw new IOException(
+                        "'responseSelect' asked for entry "
+                                + index
+                                + " but the archive has "
+                                + entries.size()
+                                + ": "
+                                + names(entries));
+            }
+            return entries.get(index);
+        }
+        List<Resource> matches = new ArrayList<>();
+        for (Resource entry : entries) {
+            if (matchesGlob(entry.getFilename(), select)) {
+                matches.add(entry);
+            }
+        }
+        if (matches.isEmpty()) {
+            throw new IOException(
+                    "'responseSelect' matched nothing in the archive; it holds " + names(entries));
+        }
+        if (matches.size() > 1) {
+            // Taking the first would be a coin toss the operator did not ask for.
+            throw new IOException(
+                    "'responseSelect' matched "
+                            + matches.size()
+                            + " entries ("
+                            + names(matches)
+                            + "); narrow it, or use an index");
+        }
+        return matches.get(0);
+    }
+
+    /** Whether the chosen name is itself an archive, so its content type is not the entry's. */
+    static boolean isArchiveName(String filename) {
+        return filename != null && filename.toLowerCase(Locale.ROOT).endsWith(".zip");
+    }
+
+    static boolean isArchive(Resource resource) throws IOException {
+        return ZipExtractionUtils.isZip(resource);
+    }
+
+    static Resource asResource(byte[] content, String filename) {
+        return new ByteArrayResource(content) {
+            @Override
+            public String getFilename() {
+                return filename;
+            }
+        };
+    }
+
+    /** Only {@code *} is supported, and only against the entry's own name. */
+    private static boolean matchesGlob(String filename, String glob) {
+        if (filename == null) {
+            return false;
+        }
+        String name = filename.toLowerCase(Locale.ROOT);
+        String pattern = glob.trim().toLowerCase(Locale.ROOT);
+        String regex =
+                java.util.Arrays.stream(pattern.split("\\*", -1))
+                        .map(java.util.regex.Pattern::quote)
+                        .reduce((a, b) -> a + ".*" + b)
+                        .orElse("");
+        return name.matches(regex);
+    }
+
+    private static Integer asIndex(String select) {
+        try {
+            return Integer.valueOf(select.trim());
+        } catch (NumberFormatException e) {
+            return null;
+        }
+    }
+
+    private static String names(List<Resource> entries) {
+        return entries.stream().map(Resource::getFilename).toList().toString();
+    }
+
+    /** {@code attachment; filename="signed.pdf"} or its RFC 5987 {@code filename*} form. */
+    private static String filenameFromDisposition(String disposition) {
+        if (disposition == null) {
+            return null;
+        }
+        for (String part : disposition.split(";")) {
+            String token = part.trim();
+            String value = null;
+            if (token.regionMatches(true, 0, "filename=", 0, 9)) {
+                value = token.substring(9).trim();
+            } else if (token.regionMatches(true, 0, "filename*=", 0, 10)) {
+                value = token.substring(10).trim();
+                int tick = value.lastIndexOf('\'');
+                if (tick >= 0) {
+                    value = value.substring(tick + 1);
+                }
+            }
+            if (value == null) {
+                continue;
+            }
+            if (value.length() >= 2 && value.startsWith("\"") && value.endsWith("\"")) {
+                value = value.substring(1, value.length() - 1);
+            }
+            // The name comes from the remote server, so it is treated as data: strip any path it
+            // tries to bring with it rather than letting it steer where anything is written.
+            String simple = io.github.pixee.security.Filenames.toSimpleFileName(value);
+            if (simple != null && !simple.isBlank()) {
+                return simple;
+            }
+        }
+        return null;
+    }
+
+    private static String extensionFor(String contentType) {
+        if (contentType == null) {
+            return null;
+        }
+        String type = contentType.split(";")[0].trim().toLowerCase(Locale.ROOT);
+        return EXTENSION_BY_TYPE.get(type);
+    }
+
+    private static String baseName(String filename) {
+        int dot = filename.lastIndexOf('.');
+        return dot <= 0 ? filename : filename.substring(0, dot);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ResultUrls.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ResultUrls.java
new file mode 100644
index 0000000000..53d382f3ef
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/api/ResultUrls.java
@@ -0,0 +1,108 @@
+package stirling.software.proprietary.integration.api;
+
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.Locale;
+import java.util.Set;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.cluster.s3.S3Clients;
+
+/**
+ * Validates a result URL an external API asked us to fetch.
+ *
+ * <p>This is the most dangerous input in the whole feature and deserves saying plainly: unlike a
+ * step's {@code path}, which an operator wrote, this URL is <em>chosen by the remote service at run
+ * time</em>. Fetching whatever it names would hand any integration - or anything that has
+ * compromised, spoofed, or MITM'd one - a server-side GET of its choosing, i.e. the cloud metadata
+ * service. {@link ExternalApiPaths} cannot help here: the whole point of a result URL is that it
+ * usually lives on a different host (a CDN or presigned object store), so "must be under the base
+ * URL" would reject the normal case.
+ *
+ * <p>The rule is therefore an <em>operator-declared</em> allowlist: a result may come from the
+ * connection's own host, or from a host named in the connection's {@code resultUrlHosts}. The
+ * decision of which hosts are legitimate stays with whoever configured the connection, and never
+ * with the response.
+ */
+final class ResultUrls {
+
+    private ResultUrls() {}
+
+    /**
+     * @param url exactly as the API returned it
+     * @return the URL to fetch
+     * @throws IllegalArgumentException if the response named a host the operator did not authorise
+     */
+    static URI validate(
+            ApiConnectionSettings settings,
+            String url,
+            ApplicationProperties applicationProperties) {
+        URI uri;
+        try {
+            uri = new URI(url.trim());
+        } catch (URISyntaxException e) {
+            throw new IllegalArgumentException(
+                    "The API returned a result URL that is not a valid URL: " + url, e);
+        }
+        String scheme = uri.getScheme() == null ? "" : uri.getScheme().toLowerCase(Locale.ROOT);
+        if (!"http".equals(scheme) && !"https".equals(scheme)) {
+            // file:, gopher:, jar: and friends are how a URL fetch becomes a local file read.
+            throw new IllegalArgumentException(
+                    "The API returned a result URL that is not http(s): " + url);
+        }
+        String host = uri.getHost();
+        if (host == null || host.isBlank()) {
+            throw new IllegalArgumentException(
+                    "The API returned a result URL with no host: " + url);
+        }
+        if (uri.getUserInfo() != null) {
+            // Credentials in a URL are also the classic way to make a host look like another one.
+            throw new IllegalArgumentException(
+                    "The API returned a result URL carrying credentials, which is not accepted");
+        }
+
+        if (!isAllowedHost(settings, host)) {
+            throw new IllegalArgumentException(
+                    "The API returned a result URL on '"
+                            + host
+                            + "', which this connection does not allow. Add it to the connection's"
+                            + " 'resultUrlHosts' if results are meant to come from there.");
+        }
+        // Even an allowlisted name must not resolve somewhere internal: a hostile or compromised
+        // DNS record for cdn.vendor.example pointing at 169.254.169.254 would otherwise be obeyed.
+        try {
+            S3Clients.validateEndpointHost(
+                    uri,
+                    applicationProperties.getPolicies().isAllowPrivateApiEndpoints(),
+                    "API result URL",
+                    "set policies.allowPrivateApiEndpoints=true to opt in (e.g. for an on-prem"
+                            + " integration).");
+        } catch (IllegalStateException e) {
+            throw new IllegalArgumentException(e.getMessage(), e);
+        }
+        return uri;
+    }
+
+    /**
+     * The connection's own host is implicitly allowed; anything else must be declared.
+     *
+     * <p>Package-private so the matching rule can be tested without a DNS lookup: {@link #validate}
+     * additionally resolves the host, which fails closed and so cannot run against example hosts.
+     */
+    static boolean isAllowedHost(ApiConnectionSettings settings, String host) {
+        String candidate = host.toLowerCase(Locale.ROOT);
+        if (candidate.equalsIgnoreCase(settings.baseUri().getHost())) {
+            return true;
+        }
+        Set<String> allowed = settings.resultUrlHosts();
+        for (String entry : allowed) {
+            String allowedHost = entry.toLowerCase(Locale.ROOT);
+            // An exact host, or a subdomain of it. Not a bare suffix match: "evilvendor.com"
+            // must not be admitted by an entry of "vendor.com".
+            if (candidate.equals(allowedHost) || candidate.endsWith("." + allowedHost)) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/controller/IntegrationConfigController.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/controller/IntegrationConfigController.java
index 4e79fc5e7a..2c92883aee 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/integration/controller/IntegrationConfigController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/controller/IntegrationConfigController.java
@@ -52,6 +52,25 @@ public class IntegrationConfigController {
         return ResponseEntity.ok(service.toResponse(service.create(request, user), user));
     }
 
+    /**
+     * What this caller may set up, so the UI offers the vendor presets and the free-form "custom
+     * API" option only to those who can actually use them. The answer is computed here rather than
+     * inferred client-side: hiding a button is presentation, and the service still refuses the call
+     * regardless of what the client believed.
+     */
+    @GetMapping("/capabilities")
+    public ResponseEntity<IntegrationCapabilitiesResponse> capabilities(
+            @AuthenticationPrincipal User user) {
+        requireUser(user);
+        return ResponseEntity.ok(
+                new IntegrationCapabilitiesResponse(service.canAuthorCustomApi(user)));
+    }
+
+    /**
+     * @param customApi whether the caller may author a free-form API integration
+     */
+    public record IntegrationCapabilitiesResponse(boolean customApi) {}
+
     @GetMapping("/{id}")
     public ResponseEntity<IntegrationConfigResponse> get(
             @PathVariable Long id, @AuthenticationPrincipal User user) {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/model/IntegrationType.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/model/IntegrationType.java
index 1e5bc0c7d4..375b7f4604 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/integration/model/IntegrationType.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/model/IntegrationType.java
@@ -4,5 +4,10 @@ package stirling.software.proprietary.integration.model;
 public enum IntegrationType {
     S3,
     MCP,
-    API
+    /** A generic outbound HTTP endpoint a pipeline step can post a document to. */
+    API,
+    /** Microsoft Purview Information Protection: sensitivity-label taxonomy via Graph. */
+    PURVIEW,
+    /** ConsignO Cloud (Notarius) e-signature and notarization. */
+    CONSIGNO
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PdfSensitivityLabels.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PdfSensitivityLabels.java
new file mode 100644
index 0000000000..28ed8de8f3
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PdfSensitivityLabels.java
@@ -0,0 +1,323 @@
+package stirling.software.proprietary.integration.purview;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.Set;
+import java.util.function.Predicate;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDDocumentCatalog;
+import org.apache.pdfbox.pdmodel.PDDocumentInformation;
+import org.apache.pdfbox.pdmodel.common.PDMetadata;
+
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Reads and writes Microsoft Purview sensitivity labels on a PDF.
+ *
+ * <p>Microsoft documents <em>what</em> a label is - the {@code MSIP_Label_<GUID>_<Attribute>}
+ * key/value set - but not <em>where</em> it lives inside a PDF; that detail sits inside the MIP
+ * SDK, which is C++/.NET only and has no Java binding. This class therefore treats the two places a
+ * PDF can hold such pairs as equally valid:
+ *
+ * <ul>
+ *   <li>the Document Information dictionary, whose custom entries are literally a key/value map;
+ *   <li>the XMP packet, where the same keys appear as properties.
+ * </ul>
+ *
+ * <p>Reading is deliberately tolerant - it scans both and takes whichever yields a label - so a
+ * document labelled by Acrobat, the MIP client, or another vendor is still understood. Writing
+ * populates both, because a downstream reader may only look at one.
+ *
+ * <p>Scope: this applies the label <em>metadata</em>. It does not encrypt, and cannot: protection
+ * is enforced by the Azure Rights Management service through the MIP SDK. A label whose policy
+ * demands encryption will be marked here but not protected, which {@link #apply} refuses to do
+ * silently.
+ */
+@Slf4j
+public final class PdfSensitivityLabels {
+
+    /** Captures the GUID and the attribute name out of {@code MSIP_Label_<guid>_<attr>}. */
+    private static final Pattern LABEL_KEY =
+            Pattern.compile("^MSIP_Label_([0-9a-fA-F-]{36})_(\\w+)$");
+
+    /** Finds the same keys inside a raw XMP packet, whatever schema wraps them. */
+    private static final Pattern XMP_LABEL_ENTRY =
+            Pattern.compile(
+                    "<([\\w-]+:)?(MSIP_Label_[0-9a-fA-F-]{36}_\\w+)>([^<]*)</\\1?\\2>",
+                    Pattern.CASE_INSENSITIVE);
+
+    /**
+     * Adobe's extension schema for carrying arbitrary Document Info entries in XMP. Using it keeps
+     * the XMP copy standards-shaped instead of inventing a namespace.
+     */
+    private static final String PDFX_NAMESPACE = "http://ns.adobe.com/pdfx/1.3/";
+
+    private static final int MAX_XMP_BYTES = 8 * 1024 * 1024;
+
+    private PdfSensitivityLabels() {}
+
+    /**
+     * The label on this document, if any.
+     *
+     * <p>A document carries at most one label per organisation, but may carry labels from several.
+     * When more than one is present the first found is returned - callers that care about a
+     * specific tenant should compare {@link SensitivityLabel#siteId()}.
+     */
+    public static Optional<SensitivityLabel> read(PDDocument document) {
+        List<SensitivityLabel> all = readAll(document);
+        return all.isEmpty() ? Optional.empty() : Optional.of(all.get(0));
+    }
+
+    /** Every label on the document, across both metadata surfaces, de-duplicated by GUID. */
+    public static List<SensitivityLabel> readAll(PDDocument document) {
+        Map<String, Map<String, String>> byLabelId = new LinkedHashMap<>();
+        collect(infoPairs(document), byLabelId);
+        collect(xmpPairs(document), byLabelId);
+
+        List<SensitivityLabel> labels = new ArrayList<>();
+        byLabelId.forEach(
+                (labelId, attributes) -> {
+                    SensitivityLabel label = SensitivityLabel.fromAttributes(labelId, attributes);
+                    if (label != null) {
+                        labels.add(label);
+                    }
+                });
+        return labels;
+    }
+
+    /**
+     * Apply a label, replacing any the same tenant already set.
+     *
+     * @throws IllegalArgumentException if the label claims encryption, which this cannot honour
+     */
+    public static void apply(PDDocument document, SensitivityLabel label) throws IOException {
+        if (label.isProtected()) {
+            // Writing ContentBits=ENCRYPT onto an unencrypted file would tell every downstream
+            // reader the content is protected when it is plaintext. Refuse rather than lie.
+            throw new IllegalArgumentException(
+                    "This label requires encryption, which needs the Microsoft Purview client or"
+                            + " MIP SDK; Stirling can apply the label metadata but cannot protect"
+                            + " the content.");
+        }
+        // "An object can only have one label from the same organization." Replace this tenant's
+        // labels on both surfaces, but leave other tenants' labels untouched on both.
+        Set<String> replaced = labelIdsOfTenant(document, label.siteId());
+        replaced.add(label.labelId());
+        Map<String, String> pairs = label.toMetadata();
+        removeInfoLabels(document, replaced::contains);
+        writeInfo(document, pairs);
+        writeXmp(document, pairs, replaced::contains);
+    }
+
+    /** Strip every label, e.g. before re-labelling or when downgrading a document. */
+    public static void clear(PDDocument document) throws IOException {
+        removeInfoLabels(document, labelId -> true);
+        writeXmp(document, Map.of(), labelId -> true);
+    }
+
+    /** The GUIDs of labels this tenant already set, so both surfaces can drop exactly those. */
+    private static Set<String> labelIdsOfTenant(PDDocument document, String siteId) {
+        Set<String> ids = new LinkedHashSet<>();
+        for (SensitivityLabel existing : readAll(document)) {
+            if (siteId.equalsIgnoreCase(existing.siteId())) {
+                ids.add(existing.labelId());
+            }
+        }
+        return ids;
+    }
+
+    /** Drop info-dictionary label entries whose GUID the predicate selects. */
+    private static void removeInfoLabels(PDDocument document, Predicate<String> removeLabelId) {
+        PDDocumentInformation info = document.getDocumentInformation();
+        for (String key : new ArrayList<>(info.getMetadataKeys())) {
+            Matcher matcher = LABEL_KEY.matcher(key);
+            if (matcher.matches() && removeLabelId.test(matcher.group(1))) {
+                info.setCustomMetadataValue(key, null);
+            }
+        }
+    }
+
+    private static void writeInfo(PDDocument document, Map<String, String> pairs) {
+        PDDocumentInformation info = document.getDocumentInformation();
+        pairs.forEach(info::setCustomMetadataValue);
+    }
+
+    /**
+     * Rewrite the XMP packet's label properties, leaving the rest of the packet untouched.
+     *
+     * <p>The packet is edited textually rather than re-serialised through xmpbox: a document's XMP
+     * may carry schemas xmpbox does not model, and a round-trip through it would silently drop
+     * them.
+     */
+    private static void writeXmp(
+            PDDocument document, Map<String, String> pairs, Predicate<String> removeLabelId)
+            throws IOException {
+        PDDocumentCatalog catalog = document.getDocumentCatalog();
+        String existing = readXmpString(catalog);
+        if (existing == null) {
+            if (pairs.isEmpty()) {
+                return;
+            }
+            existing = emptyPacket();
+        }
+        String stripped = stripLabels(existing, removeLabelId);
+        String updated = insertLabelProperties(stripped, pairs);
+        if (updated == null) {
+            log.debug("XMP packet has no rdf:Description to hold the label; info dictionary only");
+            return;
+        }
+        PDMetadata metadata = new PDMetadata(document);
+        metadata.importXMPMetadata(updated.getBytes(StandardCharsets.UTF_8));
+        catalog.setMetadata(metadata);
+    }
+
+    /** Remove only the XMP label entries whose GUID the predicate selects, keeping the rest. */
+    private static String stripLabels(String packet, Predicate<String> removeLabelId) {
+        Matcher matcher = XMP_LABEL_ENTRY.matcher(packet);
+        StringBuilder out = new StringBuilder();
+        while (matcher.find()) {
+            Matcher key = LABEL_KEY.matcher(matcher.group(2));
+            boolean remove = key.matches() && removeLabelId.test(key.group(1));
+            matcher.appendReplacement(out, Matcher.quoteReplacement(remove ? "" : matcher.group()));
+        }
+        matcher.appendTail(out);
+        return out.toString();
+    }
+
+    /** Splice the properties into the first {@code rdf:Description}; null when there is none. */
+    private static String insertLabelProperties(String packet, Map<String, String> pairs) {
+        if (pairs.isEmpty()) {
+            return packet;
+        }
+        Matcher description = Pattern.compile("<rdf:Description\\b[^>]*>").matcher(packet);
+        if (!description.find()) {
+            return null;
+        }
+        StringBuilder properties = new StringBuilder();
+        pairs.forEach(
+                (key, value) ->
+                        properties
+                                .append("\n         <pdfx:")
+                                .append(key)
+                                .append('>')
+                                .append(escapeXml(value))
+                                .append("</pdfx:")
+                                .append(key)
+                                .append('>'));
+        String opening = description.group();
+        String withNamespace =
+                opening.contains("xmlns:pdfx=")
+                        ? opening
+                        : opening.substring(0, opening.length() - 1)
+                                + " xmlns:pdfx=\""
+                                + PDFX_NAMESPACE
+                                + "\">";
+        return packet.substring(0, description.start())
+                + withNamespace
+                + properties
+                + packet.substring(description.end());
+    }
+
+    private static Map<String, String> infoPairs(PDDocument document) {
+        Map<String, String> pairs = new LinkedHashMap<>();
+        PDDocumentInformation info = document.getDocumentInformation();
+        for (String key : info.getMetadataKeys()) {
+            String value = info.getCustomMetadataValue(key);
+            if (value != null) {
+                pairs.put(key, value);
+            }
+        }
+        return pairs;
+    }
+
+    private static Map<String, String> xmpPairs(PDDocument document) {
+        Map<String, String> pairs = new LinkedHashMap<>();
+        String packet;
+        try {
+            packet = readXmpString(document.getDocumentCatalog());
+        } catch (IOException e) {
+            log.debug(
+                    "Unreadable XMP packet; falling back to the info dictionary: {}",
+                    e.getMessage());
+            return pairs;
+        }
+        if (packet == null) {
+            return pairs;
+        }
+        Matcher matcher = XMP_LABEL_ENTRY.matcher(packet);
+        while (matcher.find()) {
+            pairs.put(matcher.group(2), unescapeXml(matcher.group(3).trim()));
+        }
+        return pairs;
+    }
+
+    /** Group raw pairs by label GUID, keeping the attribute name as the key. */
+    private static void collect(Map<String, String> pairs, Map<String, Map<String, String>> into) {
+        pairs.forEach(
+                (key, value) -> {
+                    Matcher matcher = LABEL_KEY.matcher(key);
+                    if (!matcher.matches()) {
+                        return;
+                    }
+                    into.computeIfAbsent(matcher.group(1), id -> new LinkedHashMap<>())
+                            // Info-dictionary pairs are collected first and win: a stale XMP copy
+                            // must not override the value the labelling client wrote.
+                            .putIfAbsent(matcher.group(2), value);
+                });
+    }
+
+    private static String readXmpString(PDDocumentCatalog catalog) throws IOException {
+        PDMetadata metadata = catalog.getMetadata();
+        if (metadata == null) {
+            return null;
+        }
+        try (InputStream is = metadata.exportXMPMetadata()) {
+            ByteArrayOutputStream buffer = new ByteArrayOutputStream();
+            byte[] chunk = new byte[8192];
+            int read;
+            int total = 0;
+            while ((read = is.read(chunk)) != -1) {
+                total += read;
+                if (total > MAX_XMP_BYTES) {
+                    // A hostile document could otherwise hand us an unbounded packet to hold.
+                    throw new IOException("XMP packet exceeds " + MAX_XMP_BYTES + " bytes");
+                }
+                buffer.write(chunk, 0, read);
+            }
+            return buffer.toString(StandardCharsets.UTF_8);
+        }
+    }
+
+    private static String emptyPacket() {
+        return "<?xpacket begin=\"\" id=\"W5M0MpCehiHzreSzNTczkc9d\"?>"
+                + "<x:xmpmeta xmlns:x=\"adobe:ns:meta/\">"
+                + "<rdf:RDF xmlns:rdf=\"http://www.w3.org/1999/02/22-rdf-syntax-ns#\">"
+                + "<rdf:Description rdf:about=\"\"></rdf:Description>"
+                + "</rdf:RDF></x:xmpmeta><?xpacket end=\"w\"?>";
+    }
+
+    private static String escapeXml(String value) {
+        return value.replace("&", "&amp;")
+                .replace("<", "&lt;")
+                .replace(">", "&gt;")
+                .replace("\"", "&quot;");
+    }
+
+    private static String unescapeXml(String value) {
+        return value.replace("&lt;", "<")
+                .replace("&gt;", ">")
+                .replace("&quot;", "\"")
+                .replace("&amp;", "&");
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewConnectionSettings.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewConnectionSettings.java
new file mode 100644
index 0000000000..cc40872293
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewConnectionSettings.java
@@ -0,0 +1,94 @@
+package stirling.software.proprietary.integration.purview;
+
+import java.util.Locale;
+import java.util.Map;
+import java.util.regex.Pattern;
+
+/**
+ * A Microsoft Purview tenant connection.
+ *
+ * <p>Only {@code tenantId} is required, because labelling a document needs nothing else: a label is
+ * a set of key/value pairs and the tenant id is the {@code SiteId} among them. No call to Microsoft
+ * is involved, so the step works with no network and no app registration.
+ *
+ * <p>The app-registration fields are optional and buy exactly one thing: reading the tenant's label
+ * taxonomy from Graph, so the UI can offer a list of labels instead of asking someone to paste a
+ * GUID. They are not needed to apply or read a label. Graph cannot apply labels for an application
+ * anyway - "application permissions are not supported when updating assignedLabels" - which is why
+ * labelling here goes through the published metadata contract instead.
+ */
+public record PurviewConnectionSettings(
+        String tenantId,
+        String clientId,
+        String clientSecret,
+        String graphBaseUrl,
+        String loginBaseUrl) {
+
+    static final String TENANT_ID_OPTION = "tenantId";
+    static final String CLIENT_ID_OPTION = "clientId";
+    // Contains a SecretMasker hint, so it masks on read and merges on update.
+    static final String CLIENT_SECRET_OPTION = "clientSecret";
+    static final String GRAPH_BASE_URL_OPTION = "graphBaseUrl";
+    static final String LOGIN_BASE_URL_OPTION = "loginBaseUrl";
+
+    public static final String DEFAULT_GRAPH_BASE_URL = "https://graph.microsoft.com";
+    public static final String DEFAULT_LOGIN_BASE_URL = "https://login.microsoftonline.com";
+
+    /** Entra tenant ids are GUIDs; the value ends up in document metadata, so it is checked. */
+    private static final Pattern GUID =
+            Pattern.compile("^[0-9a-fA-F]{8}(-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}$");
+
+    public static PurviewConnectionSettings from(Map<String, Object> options) {
+        String tenantId = trimmed(options.get(TENANT_ID_OPTION));
+        if (tenantId == null) {
+            throw new IllegalArgumentException("purview config requires a 'tenantId'");
+        }
+        if (!GUID.matcher(tenantId).matches()) {
+            throw new IllegalArgumentException(
+                    "purview config 'tenantId' must be a GUID, e.g."
+                            + " cb46c030-1825-4e81-a295-151c039dbf02");
+        }
+        String clientId = trimmed(options.get(CLIENT_ID_OPTION));
+        String clientSecret = trimmed(options.get(CLIENT_SECRET_OPTION));
+        // Half an app registration would fail only when someone opened the label picker, which is
+        // a confusing place to discover it.
+        if ((clientId == null) != (clientSecret == null)) {
+            throw new IllegalArgumentException(
+                    "purview config needs both 'clientId' and 'clientSecret' to read the label"
+                            + " list, or neither");
+        }
+        return new PurviewConnectionSettings(
+                tenantId.toLowerCase(Locale.ROOT),
+                clientId,
+                clientSecret,
+                orDefault(trimmed(options.get(GRAPH_BASE_URL_OPTION)), DEFAULT_GRAPH_BASE_URL),
+                orDefault(trimmed(options.get(LOGIN_BASE_URL_OPTION)), DEFAULT_LOGIN_BASE_URL));
+    }
+
+    /** Whether this connection can read the tenant's label taxonomy from Graph. */
+    public boolean canListLabels() {
+        return clientId != null && clientSecret != null;
+    }
+
+    private static String orDefault(String value, String fallback) {
+        return value == null ? fallback : value;
+    }
+
+    private static String trimmed(Object value) {
+        if (value == null) {
+            return null;
+        }
+        String text = value.toString().trim();
+        return text.isEmpty() ? null : text;
+    }
+
+    /** Never prints the client secret, so an accidental log line cannot leak it. */
+    @Override
+    public String toString() {
+        return "PurviewConnectionSettings[tenantId="
+                + tenantId
+                + ", canListLabels="
+                + canListLabels()
+                + "]";
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewIntegrationValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewIntegrationValidator.java
new file mode 100644
index 0000000000..485345e5cd
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewIntegrationValidator.java
@@ -0,0 +1,23 @@
+package stirling.software.proprietary.integration.purview;
+
+import java.util.Map;
+
+import org.springframework.stereotype.Component;
+
+import stirling.software.proprietary.integration.model.IntegrationType;
+import stirling.software.proprietary.integration.service.IntegrationConfigValidator;
+
+/** The Purview connection schema, enforced when the config is saved. */
+@Component
+public class PurviewIntegrationValidator implements IntegrationConfigValidator {
+
+    @Override
+    public IntegrationType type() {
+        return IntegrationType.PURVIEW;
+    }
+
+    @Override
+    public void validate(Map<String, Object> config) {
+        PurviewConnectionSettings.from(config);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewLabelController.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewLabelController.java
new file mode 100644
index 0000000000..65555077c3
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/PurviewLabelController.java
@@ -0,0 +1,184 @@
+package stirling.software.proprietary.integration.purview;
+
+import java.io.IOException;
+import java.time.Instant;
+import java.util.List;
+import java.util.Optional;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.multipart.MultipartFile;
+
+import io.github.pixee.security.Filenames;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.common.service.CustomPDFDocumentFactory;
+import stirling.software.common.util.TempFileManager;
+import stirling.software.common.util.WebResponseUtils;
+import stirling.software.proprietary.integration.api.ApiConnectionResolver;
+import stirling.software.proprietary.integration.model.IntegrationType;
+import stirling.software.proprietary.integration.purview.SensitivityLabel.AssignmentMethod;
+import stirling.software.proprietary.service.AiToolResponseHeaders;
+
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ArrayNode;
+import tools.jackson.databind.node.ObjectNode;
+
+/**
+ * Purview sensitivity labelling as policy steps.
+ *
+ * <p>Both steps are local: a label is metadata, so applying and reading one involves no call to
+ * Microsoft. The connection supplies the tenant id that becomes the label's {@code SiteId}.
+ *
+ * <p>{@code purview-read-label} exists to make labels <em>actionable</em>: it reports what a
+ * document already carries, so a policy can branch on it - the case Purview itself does not cover,
+ * since it labels documents but does not process them.
+ */
+@Slf4j
+@RestController
+@RequestMapping("/api/v1/integration")
+@RequiredArgsConstructor
+@Tag(name = "Integrations", description = "Third-party integration steps.")
+public class PurviewLabelController {
+
+    private final ApiConnectionResolver connectionResolver;
+    private final CustomPDFDocumentFactory pdfDocumentFactory;
+    private final TempFileManager tempFileManager;
+    private final ObjectMapper objectMapper;
+
+    @PostMapping(value = "/purview-apply-label", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Apply a Microsoft Purview sensitivity label",
+            description =
+                    "Writes the Purview label metadata (MSIP_Label_<GUID>_*) onto the PDF, so"
+                            + " Purview-aware tools recognise the label. Applies the label only;"
+                            + " it cannot encrypt, which requires the Microsoft client."
+                            + " Input:PDF Output:PDF Type:SISO")
+    public ResponseEntity<Resource> applyLabel(
+            @RequestParam("fileInput") MultipartFile fileInput,
+            @RequestParam("connectionId") String connectionId,
+            @RequestParam("labelId") String labelId,
+            @RequestParam(value = "labelName", required = false) String labelName,
+            @RequestParam(value = "method", defaultValue = "STANDARD") String method,
+            @RequestParam(value = "contentBits", required = false) Integer contentBits)
+            throws IOException {
+
+        PurviewConnectionSettings settings = settings(connectionId);
+        AssignmentMethod assignment = parseMethod(method);
+
+        try (PDDocument document = pdfDocumentFactory.load(fileInput, true)) {
+            String fileName = safeFileName(fileInput.getOriginalFilename());
+            SensitivityLabel label =
+                    new SensitivityLabel(
+                            labelId.trim(),
+                            labelName,
+                            settings.tenantId(),
+                            assignment,
+                            Instant.now(),
+                            contentBits);
+            PdfSensitivityLabels.apply(document, label);
+            log.debug("[purview-apply-label] labelled {} as {}", fileName, labelId);
+            return WebResponseUtils.pdfDocToWebResponse(document, fileName, tempFileManager);
+        }
+    }
+
+    @PostMapping(value = "/purview-read-label", consumes = MediaType.MULTIPART_FORM_DATA_VALUE)
+    @Operation(
+            summary = "Read the Microsoft Purview sensitivity label on a PDF",
+            description =
+                    "Reports the Purview labels a PDF already carries so a policy can act on"
+                            + " them. The document passes through unchanged."
+                            + " Input:PDF Output:PDF Type:SISO")
+    public ResponseEntity<Resource> readLabel(
+            @RequestParam("fileInput") MultipartFile fileInput,
+            @RequestParam("connectionId") String connectionId)
+            throws IOException {
+
+        PurviewConnectionSettings settings = settings(connectionId);
+
+        List<SensitivityLabel> labels;
+        try (PDDocument document = pdfDocumentFactory.load(fileInput, true)) {
+            labels = PdfSensitivityLabels.readAll(document);
+        }
+        // The document is returned byte-for-byte rather than re-saved: a read must not perturb the
+        // file it inspected, and a PDFBox round-trip would rewrite its structure.
+        byte[] bytes = fileInput.getBytes();
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_PDF);
+        headers.setContentDispositionFormData(
+                "attachment", safeFileName(fileInput.getOriginalFilename()));
+        headers.setContentLength(bytes.length);
+        headers.set(AiToolResponseHeaders.TOOL_REPORT, buildReport(labels, settings));
+        return ResponseEntity.ok().headers(headers).body(new ByteArrayResource(bytes));
+    }
+
+    /**
+     * The labels found, and which of them is this tenant's - a document can carry labels from
+     * several organisations, and only the matching one reflects this tenant's policy.
+     */
+    private String buildReport(List<SensitivityLabel> labels, PurviewConnectionSettings settings) {
+        Optional<SensitivityLabel> own =
+                labels.stream()
+                        .filter(label -> settings.tenantId().equalsIgnoreCase(label.siteId()))
+                        .findFirst();
+        ObjectNode report = objectMapper.createObjectNode();
+        report.put("labelled", own.isPresent());
+        own.ifPresent(
+                label -> {
+                    report.put("labelId", label.labelId());
+                    report.put("labelName", label.name());
+                    report.put("method", label.method() == null ? null : label.method().name());
+                    report.put(
+                            "setDate", label.setDate() == null ? null : label.setDate().toString());
+                    report.put("contentBits", label.contentBits());
+                    report.put("protected", label.isProtected());
+                });
+        ArrayNode others = report.putArray("otherTenantLabels");
+        labels.stream()
+                .filter(label -> !settings.tenantId().equalsIgnoreCase(label.siteId()))
+                .forEach(
+                        label -> {
+                            ObjectNode node = others.addObject();
+                            node.put("labelId", label.labelId());
+                            node.put("siteId", label.siteId());
+                        });
+        return objectMapper.writeValueAsString(report);
+    }
+
+    private PurviewConnectionSettings settings(String connectionId) {
+        Long id = ApiConnectionResolver.connectionId(connectionId);
+        if (id == null) {
+            throw new IllegalArgumentException("'connectionId' is required");
+        }
+        return PurviewConnectionSettings.from(
+                connectionResolver.resolveConfig(id, IntegrationType.PURVIEW));
+    }
+
+    private static AssignmentMethod parseMethod(String method) {
+        AssignmentMethod parsed = AssignmentMethod.parse(method);
+        if (parsed == null) {
+            throw new IllegalArgumentException(
+                    "'method' must be STANDARD (applied automatically) or PRIVILEGED (chosen by a"
+                            + " person); got "
+                            + method);
+        }
+        return parsed;
+    }
+
+    private static String safeFileName(String originalFilename) {
+        String name = Filenames.toSimpleFileName(originalFilename);
+        return (name == null || name.isBlank()) ? "labelled.pdf" : name;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/SensitivityLabel.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/SensitivityLabel.java
new file mode 100644
index 0000000000..5f6e97452e
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/purview/SensitivityLabel.java
@@ -0,0 +1,186 @@
+package stirling.software.proprietary.integration.purview;
+
+import java.time.Instant;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
+import java.util.LinkedHashMap;
+import java.util.Locale;
+import java.util.Map;
+import java.util.regex.Pattern;
+
+/**
+ * One Microsoft Purview Information Protection label as it is written to a document.
+ *
+ * <p>Microsoft persists a label as a flat set of key/value pairs named {@code
+ * MSIP_Label_<GUID>_<Attribute>}, and documents that contract publicly so third-party software can
+ * read a label and act on it. That published contract - not the MIP SDK, which has no Java binding
+ * - is what this type implements. See <a
+ * href="https://learn.microsoft.com/en-us/information-protection/develop/concept-mip-metadata">Label
+ * metadata in the MIP SDK</a>.
+ *
+ * <p>Only {@code Enabled} and {@code SiteId} are mandatory in that contract; the rest are optional
+ * and may be absent on a label written by an older client, so readers here tolerate their absence.
+ */
+public record SensitivityLabel(
+        String labelId,
+        String name,
+        String siteId,
+        AssignmentMethod method,
+        Instant setDate,
+        Integer contentBits) {
+
+    /** How the label came to be applied. */
+    public enum AssignmentMethod {
+        /** Applied by default or automatically - e.g. by a policy like this one. */
+        STANDARD,
+        /** Chosen deliberately by a person. */
+        PRIVILEGED;
+
+        String wireValue() {
+            return name().charAt(0) + name().substring(1).toLowerCase(Locale.ROOT);
+        }
+
+        static AssignmentMethod parse(String value) {
+            if (value == null) {
+                return null;
+            }
+            try {
+                return valueOf(value.trim().toUpperCase(Locale.ROOT));
+            } catch (IllegalArgumentException e) {
+                return null;
+            }
+        }
+    }
+
+    public static final String KEY_PREFIX = "MSIP_Label_";
+
+    /** Content marks the labelling application applied; a bitmask, per the MIP contract. */
+    public static final int CONTENT_BITS_HEADER = 0x1;
+
+    public static final int CONTENT_BITS_FOOTER = 0x2;
+    public static final int CONTENT_BITS_WATERMARK = 0x4;
+    public static final int CONTENT_BITS_ENCRYPT = 0x8;
+
+    /**
+     * Extended ISO 8601, matching the {@code 2018-11-08T21:13:16-0800} form Microsoft documents.
+     */
+    private static final DateTimeFormatter SET_DATE =
+            DateTimeFormatter.ofPattern("yyyy-MM-dd'T'HH:mm:ssZ", Locale.ROOT)
+                    .withZone(ZoneOffset.UTC);
+
+    /**
+     * Microsoft caps each key and value at 255 characters "to maintain compatibility across common
+     * applications".
+     */
+    static final int MAX_VALUE_LENGTH = 255;
+
+    /** The GUID shape a labelId must take, matching what the read path accepts from a document. */
+    private static final Pattern LABEL_ID = Pattern.compile("^[0-9a-fA-F-]{36}$");
+
+    public SensitivityLabel {
+        if (labelId == null || labelId.isBlank()) {
+            throw new IllegalArgumentException("a sensitivity label needs a labelId");
+        }
+        if (!LABEL_ID.matcher(labelId).matches()) {
+            // labelId is spliced verbatim into XMP/info key names; a non-GUID would let a stray
+            // character (a space, or <, >, &) corrupt or inject the metadata it is written into.
+            throw new IllegalArgumentException("a sensitivity label needs a GUID labelId");
+        }
+        if (siteId == null || siteId.isBlank()) {
+            throw new IllegalArgumentException("a sensitivity label needs a siteId (tenant id)");
+        }
+    }
+
+    /** The {@code MSIP_Label_<GUID>_} prefix this label's keys share. */
+    public String keyPrefix() {
+        return KEY_PREFIX + labelId + "_";
+    }
+
+    /**
+     * This label as the key/value pairs to persist. Optional attributes are omitted when unset
+     * rather than written empty, so a reader cannot mistake "not recorded" for "recorded as blank".
+     */
+    public Map<String, String> toMetadata() {
+        Map<String, String> out = new LinkedHashMap<>();
+        String prefix = keyPrefix();
+        out.put(prefix + "Enabled", "true");
+        out.put(prefix + "SiteId", siteId);
+        if (method != null) {
+            out.put(prefix + "Method", method.wireValue());
+        }
+        if (setDate != null) {
+            out.put(prefix + "SetDate", SET_DATE.format(setDate));
+        }
+        if (name != null && !name.isBlank()) {
+            out.put(prefix + "Name", truncate(name));
+        }
+        if (contentBits != null) {
+            out.put(prefix + "ContentBits", String.valueOf(contentBits));
+        }
+        return out;
+    }
+
+    /**
+     * Rebuild a label from the pairs found on a document.
+     *
+     * @param labelId the GUID between the prefix and the attribute name
+     * @param attributes attribute name (e.g. {@code Name}) to value, for that GUID only
+     * @return null when the pairs do not describe an enabled label
+     */
+    static SensitivityLabel fromAttributes(String labelId, Map<String, String> attributes) {
+        // "DLP products typically validate the existence of this key to identify the
+        // classification label" - an absent or false Enabled means there is no label here.
+        if (!"true".equalsIgnoreCase(attributes.get("Enabled"))) {
+            return null;
+        }
+        String siteId = attributes.get("SiteId");
+        if (siteId == null || siteId.isBlank()) {
+            // SiteId is mandatory in the contract, but a label written by something non-compliant
+            // is still a label; keep it readable rather than throwing on someone else's file.
+            siteId = "unknown";
+        }
+        return new SensitivityLabel(
+                labelId,
+                attributes.get("Name"),
+                siteId,
+                AssignmentMethod.parse(attributes.get("Method")),
+                parseDate(attributes.get("SetDate")),
+                parseInt(attributes.get("ContentBits")));
+    }
+
+    private static Instant parseDate(String value) {
+        if (value == null || value.isBlank()) {
+            return null;
+        }
+        try {
+            return SET_DATE.parse(value.trim(), Instant::from);
+        } catch (RuntimeException e) {
+            try {
+                // Tolerate the plain ISO form some writers use instead.
+                return Instant.parse(value.trim());
+            } catch (RuntimeException ignored) {
+                return null;
+            }
+        }
+    }
+
+    private static Integer parseInt(String value) {
+        if (value == null || value.isBlank()) {
+            return null;
+        }
+        try {
+            return Integer.valueOf(value.trim());
+        } catch (NumberFormatException e) {
+            return null;
+        }
+    }
+
+    private static String truncate(String value) {
+        return value.length() <= MAX_VALUE_LENGTH ? value : value.substring(0, MAX_VALUE_LENGTH);
+    }
+
+    /** Whether the labelling application encrypted the content. */
+    public boolean isProtected() {
+        return contentBits != null && (contentBits & CONTENT_BITS_ENCRYPT) != 0;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigService.java b/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigService.java
index a7ef7d4512..a6650569a8 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/integration/service/IntegrationConfigService.java
@@ -13,6 +13,7 @@ import org.springframework.web.server.ResponseStatusException;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.access.model.DefaultAccessPolicy;
 import stirling.software.proprietary.access.model.OwnerScope;
 import stirling.software.proprietary.access.model.ResourceType;
@@ -43,6 +44,7 @@ public class IntegrationConfigService {
     private final OwnershipService ownership;
     private final SecretMasker secretMasker;
     private final ResourceGrantRepository grantRepository;
+    private final ApplicationProperties applicationProperties;
     // Bean-discovered extension points: features that understand a type contribute its config
     // schema and report what still references a config, without this module depending on them.
     private final List<IntegrationConfigValidator> validators;
@@ -62,6 +64,7 @@ public class IntegrationConfigService {
                 && !ownership.isAdmin(currentUser)) {
             throw forbidden("S3 connections can only be created by administrators or team owners");
         }
+        requireCustomApiAllowed(cfg.getIntegrationType(), currentUser);
         cfg.setName(require(request.name(), "name"));
         cfg.setEnabled(request.enabled() == null || request.enabled());
         cfg.setLocked(request.locked() != null && request.locked());
@@ -113,6 +116,9 @@ public class IntegrationConfigService {
             cfg.setDefaultAccess(request.defaultAccess());
         }
         if (request.config() != null) {
+            // Editing the config of a custom integration is the same authoring power as creating
+            // one - it is where the base URL and body live - so it is gated identically.
+            requireCustomApiAllowed(cfg.getIntegrationType(), currentUser);
             Map<String, Object> merged =
                     secretMasker.merge(readJson(cfg.getConfig()), request.config());
             validateConfig(cfg.getIntegrationType(), merged);
@@ -121,6 +127,32 @@ public class IntegrationConfigService {
         return repository.save(cfg);
     }
 
+    /**
+     * A custom API integration names its own host, path and body, so it can point the server
+     * anywhere. That is authoring power rather than self-serve configuration: admins only, and the
+     * operator can withdraw it entirely. The vendor presets are not gated here - they carry a fixed
+     * shape, so the worst a user can do is misconfigure their own connection.
+     */
+    private void requireCustomApiAllowed(IntegrationType type, User currentUser) {
+        if (type != IntegrationType.API) {
+            return;
+        }
+        if (!applicationProperties.getPolicies().isAllowCustomApiIntegrations()) {
+            throw forbidden(
+                    "Custom API integrations are disabled on this server"
+                            + " (policies.allowCustomApiIntegrations)");
+        }
+        if (!ownership.isAdmin(currentUser)) {
+            throw forbidden("Custom API integrations can only be created by administrators");
+        }
+    }
+
+    /** Whether this caller may author custom API integrations, for the UI to offer or hide it. */
+    public boolean canAuthorCustomApi(User currentUser) {
+        return applicationProperties.getPolicies().isAllowCustomApiIntegrations()
+                && ownership.isAdmin(currentUser);
+    }
+
     @Transactional
     public void delete(Long id, User currentUser) {
         IntegrationConfig cfg = load(id);
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
index e0df6ba2b1..06172b8cbc 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
@@ -123,7 +123,7 @@ public class PolicyController {
             throws IOException {
         stampPolicyAudit(definition);
         requireRunnable(definition);
-        validateAdHocOutput(definition);
+        validateAdHocRun(definition);
         PolicyInputs inputs = toInputs(files);
         PolicyRunHandle handle =
                 policyRunner.runAdHoc(definition, inputs, PolicyProgressListener.NOOP);
@@ -144,7 +144,7 @@ public class PolicyController {
             throws IOException {
         stampPolicyAudit(definition);
         requireRunnable(definition);
-        validateAdHocOutput(definition);
+        validateAdHocRun(definition);
         PolicyInputs inputs = toInputs(files);
 
         SseEmitter emitter =
@@ -560,18 +560,22 @@ public class PolicyController {
     }
 
     /**
-     * Authorization-check an ad-hoc run's output while the caller's principal is present (this
-     * request thread). The worker thread that later delivers carries no security context, so an S3
-     * output's connection-access check would be skipped there; without this gate a caller could
-     * reference another tenant's connection by id and write to it (confused deputy). Stored
-     * policies are covered by save-time {@link PolicyValidator#validate} instead.
+     * Authorization-check an ad-hoc run's steps and output while the caller's principal is present
+     * (this request thread). The worker thread that later runs and delivers carries no security
+     * context, so a connection-access check would be skipped there; without this gate a caller
+     * could reference another tenant's connection by id and write to it, or make the server call it
+     * with its stored credentials (confused deputy). Stored policies are covered by save-time
+     * {@link PolicyValidator#validate} instead.
      */
-    private void validateAdHocOutput(PipelineDefinition definition) {
-        if (definition.output() == null) {
-            return;
-        }
+    private void validateAdHocRun(PipelineDefinition definition) {
         try {
-            policyValidator.validateOutput(definition.output());
+            // Steps get the same treatment as the output, and for the same reason: an integration
+            // step dereferences its connection by id on a principal-less worker thread, so this
+            // request thread is the only place that reference can be checked against the caller.
+            policyValidator.validateSteps(definition.steps());
+            if (definition.output() != null) {
+                policyValidator.validateOutput(definition.output());
+            }
         } catch (IllegalArgumentException e) {
             throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());
         }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PipelineStepValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PipelineStepValidator.java
new file mode 100644
index 0000000000..fc440609a0
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PipelineStepValidator.java
@@ -0,0 +1,22 @@
+package stirling.software.proprietary.policy.engine;
+
+import stirling.software.proprietary.policy.model.PipelineStep;
+
+/**
+ * Validates one step's parameters before a run is admitted. Implementations are beans discovered by
+ * {@link PolicyValidator}, so the feature that understands a step's parameters owns their rules
+ * without the engine depending on it.
+ *
+ * <p>Steps run on a worker thread with no {@code SecurityContext}, so anything a step dereferences
+ * by id - an integration connection, say - cannot be authorization-checked at run time. A validator
+ * that resolves such a reference must therefore be called while the caller's principal is still
+ * present, which is what {@link PolicyValidator#validateSteps} guarantees.
+ */
+public interface PipelineStepValidator {
+
+    /**
+     * @throws IllegalArgumentException if the step is misconfigured or references something the
+     *     current caller may not use
+     */
+    void validate(PipelineStep step);
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java
index cac05765a0..c2d1357889 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyValidator.java
@@ -9,6 +9,7 @@ import lombok.RequiredArgsConstructor;
 import stirling.software.proprietary.policy.input.InputSource;
 import stirling.software.proprietary.policy.model.InputSpec;
 import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.PipelineStep;
 import stirling.software.proprietary.policy.model.Policy;
 import stirling.software.proprietary.policy.model.TriggerConfig;
 import stirling.software.proprietary.policy.output.PolicyOutputSink;
@@ -17,10 +18,10 @@ import stirling.software.proprietary.policy.source.SourceStore;
 import stirling.software.proprietary.policy.trigger.PolicyTrigger;
 
 /**
- * Validates a policy at save time by delegating each facet (trigger, sources, output) to the bean
- * that handles its type, so a misconfiguration fails fast rather than at run time. A null trigger
- * is a manual-only policy and skips trigger validation. Each referenced {@code sourceId} must
- * resolve to a persisted {@link Source} whose config its {@link InputSource} bean accepts.
+ * Validates a policy at save time by delegating each facet (trigger, sources, steps, output) to the
+ * bean that handles its type, so a misconfiguration fails fast rather than at run time. A null
+ * trigger is a manual-only policy and skips trigger validation. Each referenced {@code sourceId}
+ * must resolve to a persisted {@link Source} whose config its {@link InputSource} bean accepts.
  */
 @Service
 @RequiredArgsConstructor
@@ -29,6 +30,7 @@ public class PolicyValidator {
     private final List<PolicyTrigger> triggers;
     private final List<InputSource> inputSources;
     private final List<PolicyOutputSink> outputSinks;
+    private final List<PipelineStepValidator> stepValidators;
     private final SourceStore sourceStore;
 
     /**
@@ -50,9 +52,27 @@ public class PolicyValidator {
             InputSpec spec = source.toInputSpec();
             inputSourceFor(spec).validate(spec);
         }
+        validateSteps(policy.steps());
         validateOutput(policy.output());
     }
 
+    /**
+     * Validate each step against every registered {@link PipelineStepValidator}. Must be called on
+     * a request thread (caller's principal present) for the same reason as {@link
+     * #validateOutput(OutputSpec)}: a step that dereferences an integration connection by id is
+     * access-checked here or nowhere, since the worker thread that later runs it has no principal.
+     *
+     * @throws IllegalArgumentException if any step is invalid or references an inaccessible
+     *     resource
+     */
+    public void validateSteps(List<PipelineStep> steps) {
+        for (PipelineStep step : steps) {
+            for (PipelineStepValidator validator : stepValidators) {
+                validator.validate(step);
+            }
+        }
+    }
+
     /**
      * Validate an output spec against its sink. Must be called on a request thread (caller's
      * principal present) so an S3 output's connection is authorization-checked against the caller -
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/access/service/SecretMaskerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/access/service/SecretMaskerTest.java
index 4f76b06b5c..dbd8c02131 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/access/service/SecretMaskerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/access/service/SecretMaskerTest.java
@@ -77,6 +77,48 @@ class SecretMaskerTest {
         assertThat(clean).containsEntry("bucket", "b").doesNotContainKey("secretKey");
     }
 
+    @Test
+    void maskRedactsEveryHeaderValueRegardlessOfName() {
+        Map<String, Object> headers = new LinkedHashMap<>();
+        headers.put("X-API-Key", "real-secret"); // name carries no secret hint
+        headers.put("Ocp-Apim-Subscription-Key", "abc123");
+        headers.put("Content-Type", "application/json");
+        Map<String, Object> config = new LinkedHashMap<>();
+        config.put("baseUrl", "https://api.example");
+        config.put("headers", headers);
+
+        Map<String, Object> masked = masker.mask(config);
+
+        assertThat(masked.get("baseUrl")).isEqualTo("https://api.example");
+        @SuppressWarnings("unchecked")
+        Map<String, Object> maskedHeaders = (Map<String, Object>) masked.get("headers");
+        assertThat(maskedHeaders.get("X-API-Key")).isEqualTo(SecretMasker.MASK);
+        assertThat(maskedHeaders.get("Ocp-Apim-Subscription-Key")).isEqualTo(SecretMasker.MASK);
+        assertThat(maskedHeaders.get("Content-Type")).isEqualTo(SecretMasker.MASK);
+    }
+
+    @Test
+    void mergeRestoresRedactedHeaderValuesFromStored() {
+        Map<String, Object> storedHeaders = new LinkedHashMap<>();
+        storedHeaders.put("X-API-Key", "REAL");
+        storedHeaders.put("Content-Type", "application/json");
+        Map<String, Object> stored = new LinkedHashMap<>();
+        stored.put("headers", storedHeaders);
+
+        Map<String, Object> incomingHeaders = new LinkedHashMap<>();
+        incomingHeaders.put("X-API-Key", SecretMasker.MASK); // untouched secret comes back masked
+        incomingHeaders.put("Content-Type", "text/plain"); // genuinely edited
+        Map<String, Object> incoming = new LinkedHashMap<>();
+        incoming.put("headers", incomingHeaders);
+
+        Map<String, Object> merged = masker.merge(stored, incoming);
+
+        @SuppressWarnings("unchecked")
+        Map<String, Object> mergedHeaders = (Map<String, Object>) merged.get("headers");
+        assertThat(mergedHeaders.get("X-API-Key")).isEqualTo("REAL"); // restored, not "********"
+        assertThat(mergedHeaders.get("Content-Type")).isEqualTo("text/plain"); // updated
+    }
+
     @Test
     void deeplyNestedInputIsBoundedNotOverflowing() {
         // Build a structure far deeper than the recursion cap.
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ApiIntegrationValidatorTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ApiIntegrationValidatorTest.java
new file mode 100644
index 0000000000..e767aae34d
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ApiIntegrationValidatorTest.java
@@ -0,0 +1,76 @@
+package stirling.software.proprietary.integration.api;
+
+import static org.assertj.core.api.Assertions.assertThatCode;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+
+import stirling.software.common.model.ApplicationProperties;
+
+/**
+ * The private-endpoint opt-in is coarse by design (it lets an on-prem integration reach RFC1918),
+ * but it must never open the cloud metadata service - the one internal address whose only use is
+ * stealing the instance's credentials.
+ */
+class ApiIntegrationValidatorTest {
+
+    private final ApiIntegrationValidator validator =
+            new ApiIntegrationValidator(properties(false));
+
+    private static ApplicationProperties properties(boolean allowPrivate) {
+        ApplicationProperties p = new ApplicationProperties();
+        p.getPolicies().setAllowPrivateApiEndpoints(allowPrivate);
+        return p;
+    }
+
+    private static Map<String, Object> config(String baseUrl) {
+        Map<String, Object> c = new LinkedHashMap<>();
+        c.put("baseUrl", baseUrl);
+        return c;
+    }
+
+    @Test
+    void acceptsAnOrdinaryPublicHost() {
+        // A public IP literal, so the check needs no network DNS (an unresolvable name would fail
+        // closed at the resolve step, which is correct but not what this test is about).
+        assertThatCode(() -> validator.validate(config("https://1.1.1.1/v1")))
+                .doesNotThrowAnyException();
+    }
+
+    @Test
+    void rejectsAPrivateHostByDefault() {
+        assertThatThrownBy(() -> validator.validate(config("http://10.0.0.5/x")))
+                .isInstanceOf(IllegalArgumentException.class);
+    }
+
+    @Test
+    void rejectsTheCloudMetadataAddressEvenWithThePrivateOptInOn() {
+        ApiIntegrationValidator opted = new ApiIntegrationValidator(properties(true));
+
+        // The on-prem opt-in allows RFC1918, but the metadata endpoint stays blocked.
+        assertThatThrownBy(() -> opted.validate(config("http://169.254.169.254/latest/meta-data/")))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("metadata service");
+    }
+
+    @Test
+    void aPrivateOnPremHostIsAllowedWhenOptedIn() {
+        ApiIntegrationValidator opted = new ApiIntegrationValidator(properties(true));
+
+        assertThatCode(() -> opted.validate(config("http://10.10.0.20:8080/api")))
+                .doesNotThrowAnyException();
+    }
+
+    @Test
+    void theMetadataBlockRunsBeforeTheOptInSoItCannotBeBypassed() {
+        // Also covers the Oracle/IBM variants that share the 169.254.169.x range.
+        ApiIntegrationValidator opted = new ApiIntegrationValidator(properties(true));
+
+        assertThatThrownBy(() -> opted.validate(config("http://169.254.169.253/")))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("metadata service");
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/DocumentContextTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/DocumentContextTest.java
new file mode 100644
index 0000000000..4576584b58
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/DocumentContextTest.java
@@ -0,0 +1,177 @@
+package stirling.software.proprietary.integration.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.time.Instant;
+import java.util.Base64;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.junit.jupiter.api.Test;
+import org.springframework.mock.web.MockMultipartFile;
+
+import stirling.software.common.service.PdfMetadataService;
+import stirling.software.proprietary.integration.purview.PdfSensitivityLabels;
+import stirling.software.proprietary.integration.purview.SensitivityLabel;
+import stirling.software.proprietary.integration.purview.SensitivityLabel.AssignmentMethod;
+
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ObjectNode;
+
+/**
+ * The context is what an external API gets told about the document, so it is asserted concretely.
+ */
+class DocumentContextTest {
+
+    private static final String TENANT = "cb46c030-1825-4e81-a295-151c039dbf02";
+    private final ObjectMapper objectMapper = new ObjectMapper();
+
+    private static byte[] pdfBytes(java.util.function.Consumer<PDDocument> customise)
+            throws IOException {
+        try (PDDocument document = new PDDocument()) {
+            document.addPage(new PDPage());
+            document.addPage(new PDPage());
+            customise.accept(document);
+            ByteArrayOutputStream out = new ByteArrayOutputStream();
+            document.save(out);
+            return out.toByteArray();
+        }
+    }
+
+    private ObjectNode contextOf(byte[] content, String filename, String policyName, String runId) {
+        MockMultipartFile file =
+                new MockMultipartFile("fileInput", filename, "application/pdf", content);
+        return DocumentContext.build(file, content, policyName, runId, objectMapper);
+    }
+
+    @Test
+    void describesThePdfAndTheRun() throws IOException {
+        byte[] content =
+                pdfBytes(
+                        document -> {
+                            document.getDocumentInformation().setTitle("Q3 Invoice");
+                            document.getDocumentInformation().setAuthor("Anthony");
+                        });
+
+        ObjectNode context = contextOf(content, "invoice.pdf", "Outbound review", "run-42");
+
+        assertThat(context.at("/document/filename").asString()).isEqualTo("invoice.pdf");
+        assertThat(context.at("/document/extension").asString()).isEqualTo("pdf");
+        assertThat(context.at("/document/contentType").asString()).isEqualTo("application/pdf");
+        assertThat(context.at("/document/sizeBytes").asInt()).isEqualTo(content.length);
+        assertThat(context.at("/document/pageCount").asInt()).isEqualTo(2);
+        assertThat(context.at("/document/encrypted").asBoolean()).isFalse();
+        assertThat(context.at("/document/title").asString()).isEqualTo("Q3 Invoice");
+        assertThat(context.at("/document/author").asString()).isEqualTo("Anthony");
+        assertThat(context.at("/run/policyName").asString()).isEqualTo("Outbound review");
+        assertThat(context.at("/run/runId").asString()).isEqualTo("run-42");
+        assertThat(Instant.parse(context.at("/run/timestamp").asString())).isNotNull();
+    }
+
+    @Test
+    void hashesTheContentTheApiWillReceive() throws IOException {
+        byte[] content = pdfBytes(document -> {});
+
+        String sha = contextOf(content, "a.pdf", null, null).at("/document/sha256").asString();
+
+        assertThat(sha).hasSize(64).matches("[0-9a-f]{64}");
+        // Same bytes, same hash: external systems key on this for dedupe and chain-of-custody.
+        assertThat(contextOf(content, "renamed.pdf", null, null).at("/document/sha256").asString())
+                .isEqualTo(sha);
+    }
+
+    @Test
+    void carriesTheBytesAsBase64ForBodyPayloads() throws IOException {
+        // Presets that attach or sign the document reference {{document.base64}}; without this the
+        // placeholder is unknown and the whole step fails at resolution time.
+        byte[] content = pdfBytes(document -> {});
+
+        String base64 = contextOf(content, "a.pdf", null, null).at("/document/base64").asString();
+
+        assertThat(Base64.getDecoder().decode(base64)).isEqualTo(content);
+    }
+
+    @Test
+    void surfacesAnExistingPurviewLabel() throws IOException {
+        byte[] content =
+                pdfBytes(
+                        document -> {
+                            try {
+                                PdfSensitivityLabels.apply(
+                                        document,
+                                        new SensitivityLabel(
+                                                "2096f6a2-d2f7-48be-b329-b73aaa526e5d",
+                                                "Confidential",
+                                                TENANT,
+                                                AssignmentMethod.PRIVILEGED,
+                                                null,
+                                                null));
+                            } catch (IOException e) {
+                                throw new java.io.UncheckedIOException(e);
+                            }
+                        });
+
+        ObjectNode context = contextOf(content, "secret.pdf", null, null);
+
+        assertThat(context.at("/sensitivityLabel/name").asString()).isEqualTo("Confidential");
+        assertThat(context.at("/sensitivityLabel/siteId").asString()).isEqualTo(TENANT);
+        assertThat(context.at("/sensitivityLabel/method").asString()).isEqualTo("PRIVILEGED");
+        assertThat(context.at("/sensitivityLabel/protected").asBoolean()).isFalse();
+    }
+
+    @Test
+    void surfacesTheClassifierVerdictAsJson() throws IOException {
+        byte[] content =
+                pdfBytes(
+                        document ->
+                                document.getDocumentInformation()
+                                        .setCustomMetadataValue(
+                                                PdfMetadataService.CLASSIFICATION_KEY,
+                                                "{\"label\":\"invoice\",\"confidence\":0.91}"));
+
+        ObjectNode context = contextOf(content, "a.pdf", null, null);
+
+        // Nested, not a JSON string, so {{classification.label}} resolves.
+        assertThat(context.at("/classification/label").asString()).isEqualTo("invoice");
+        assertThat(context.at("/classification/confidence").asDouble()).isEqualTo(0.91);
+    }
+
+    @Test
+    void omitsWhatIsAbsentRatherThanInventingIt() throws IOException {
+        ObjectNode context = contextOf(pdfBytes(document -> {}), "a.pdf", null, null);
+
+        assertThat(context.has("sensitivityLabel")).isFalse();
+        assertThat(context.has("classification")).isFalse();
+        assertThat(context.at("/run/policyName").isNull()).isTrue();
+    }
+
+    @Test
+    void aNonPdfStillGetsTheBasics() {
+        byte[] content = "just text".getBytes();
+        MockMultipartFile file =
+                new MockMultipartFile("fileInput", "notes.txt", "text/plain", content);
+
+        ObjectNode context = DocumentContext.build(file, content, null, null, objectMapper);
+
+        assertThat(context.at("/document/filename").asString()).isEqualTo("notes.txt");
+        assertThat(context.at("/document/extension").asString()).isEqualTo("txt");
+        assertThat(context.at("/document/sizeBytes").asInt()).isEqualTo(content.length);
+        assertThat(context.at("/document/sha256").asString()).hasSize(64);
+        // No PDF facts, and no exception either.
+        assertThat(context.at("/document/pageCount").isMissingNode()).isTrue();
+    }
+
+    @Test
+    void unparseableBytesClaimingToBeAPdfDoNotFailTheStep() {
+        byte[] content = "%PDF-1.7 but truncated".getBytes();
+        MockMultipartFile file =
+                new MockMultipartFile("fileInput", "broken.pdf", "application/pdf", content);
+
+        ObjectNode context = DocumentContext.build(file, content, null, null, objectMapper);
+
+        assertThat(context.at("/document/sha256").asString()).hasSize(64);
+        assertThat(context.at("/document/pageCount").isMissingNode()).isTrue();
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallControllerLiveTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallControllerLiveTest.java
new file mode 100644
index 0000000000..462c1a348f
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallControllerLiveTest.java
@@ -0,0 +1,615 @@
+package stirling.software.proprietary.integration.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.when;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.http.HttpClient;
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.zip.ZipEntry;
+import java.util.zip.ZipOutputStream;
+
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.mockito.junit.jupiter.MockitoSettings;
+import org.mockito.quality.Strictness;
+import org.springframework.core.io.Resource;
+import org.springframework.http.ResponseEntity;
+import org.springframework.mock.web.MockMultipartFile;
+
+import com.sun.net.httpserver.HttpExchange;
+import com.sun.net.httpserver.HttpServer;
+
+import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.service.PdfMetadataService;
+import stirling.software.common.util.TempFileManager;
+import stirling.software.common.util.TempFileRegistry;
+import stirling.software.proprietary.integration.model.IntegrationType;
+import stirling.software.proprietary.integration.purview.PdfSensitivityLabels;
+import stirling.software.proprietary.integration.purview.SensitivityLabel;
+import stirling.software.proprietary.integration.purview.SensitivityLabel.AssignmentMethod;
+import stirling.software.proprietary.service.AiToolResponseHeaders;
+
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * Drives the real {@link ExternalApiCallController} against a real HTTP server on loopback.
+ *
+ * <p>Everything below the connection lookup is genuine: a real PDF, real context extraction, real
+ * placeholder resolution, a real JDK HTTP client, and a real receiver that records exactly what
+ * arrived. Only {@link ApiConnectionResolver} is stubbed - resolving a connection means a database
+ * and an authorization check, which belong to their own tests.
+ *
+ * <p>The receiver is the point. Asserting what a third party actually received is the only way to
+ * know the document and its context left in the shape an integration expects; asserting our own
+ * intentions would pass just as happily with the bytes never leaving.
+ */
+@ExtendWith(MockitoExtension.class)
+@MockitoSettings(strictness = Strictness.LENIENT)
+class ExternalApiCallControllerLiveTest {
+
+    @Mock private ApiConnectionResolver connectionResolver;
+
+    private HttpServer server;
+    private String baseUrl;
+    private ExternalApiCallController controller;
+    private final ObjectMapper objectMapper = new ObjectMapper();
+    private final ApplicationProperties properties = new ApplicationProperties();
+
+    /** What the receiver saw, so assertions are about the wire rather than our intentions. */
+    private volatile String receivedBody;
+
+    private volatile String receivedContentType;
+    private volatile String receivedMethod;
+    private final Map<String, String> receivedHeaders = new LinkedHashMap<>();
+
+    @BeforeEach
+    void startReceiver() throws IOException {
+        // Loopback is exactly what the host guard blocks by default; an operator opts in for an
+        // on-prem integration, which is what a local receiver stands in for.
+        properties.getPolicies().setAllowPrivateApiEndpoints(true);
+
+        server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+
+        // Records, then answers with a verdict - the DLP/scanner shape.
+        server.createContext(
+                "/v1/scan",
+                exchange -> {
+                    capture(exchange);
+                    respond(
+                            exchange,
+                            200,
+                            "application/json",
+                            "{\"verdict\":\"clean\",\"score\":0.02}"
+                                    .getBytes(StandardCharsets.UTF_8));
+                });
+
+        // Answers with a different document - the converter shape.
+        server.createContext(
+                "/v1/convert",
+                exchange -> {
+                    capture(exchange);
+                    exchange.getResponseHeaders()
+                            .add("Content-Disposition", "attachment; filename=\"converted.docx\"");
+                    respond(
+                            exchange,
+                            200,
+                            "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+                            "DOCX-BYTES".getBytes(StandardCharsets.UTF_8));
+                });
+
+        // Answers with a link to the result - the async/large-file shape.
+        server.createContext(
+                "/v1/deferred",
+                exchange -> {
+                    capture(exchange);
+                    respond(
+                            exchange,
+                            200,
+                            "application/json",
+                            ("{\"status\":\"done\",\"data\":{\"downloadUrl\":\""
+                                            + baseUrl
+                                            + "/files/result.pdf\"}}")
+                                    .getBytes(StandardCharsets.UTF_8));
+                });
+
+        // Answers with a link on a host the connection never authorised.
+        server.createContext(
+                "/v1/evil",
+                exchange -> {
+                    capture(exchange);
+                    respond(
+                            exchange,
+                            200,
+                            "application/json",
+                            "{\"data\":{\"downloadUrl\":\"http://169.254.169.254/latest/meta-data/\"}}"
+                                    .getBytes(StandardCharsets.UTF_8));
+                });
+
+        server.createContext(
+                "/files/result.pdf",
+                exchange ->
+                        respond(
+                                exchange,
+                                200,
+                                "application/pdf",
+                                "%PDF-1.7 fetched".getBytes(StandardCharsets.UTF_8)));
+
+        // Answers with an archive - ConsignO's "PDF (single) or ZIP (multiple)" shape.
+        server.createContext(
+                "/v1/bundle",
+                exchange -> {
+                    capture(exchange);
+                    respond(exchange, 200, "application/zip", zip());
+                });
+
+        server.createContext(
+                "/v1/reject",
+                exchange -> {
+                    capture(exchange);
+                    respond(
+                            exchange,
+                            422,
+                            "application/json",
+                            "{\"error\":\"policy violation\"}".getBytes(StandardCharsets.UTF_8));
+                });
+
+        // Cloudmersive's scan shape: HTTP 200 with the verdict in the body, clean or not.
+        server.createContext(
+                "/v1/clean",
+                exchange -> {
+                    capture(exchange);
+                    respond(
+                            exchange,
+                            200,
+                            "application/json",
+                            "{\"CleanResult\":true}".getBytes(StandardCharsets.UTF_8));
+                });
+        server.createContext(
+                "/v1/infected",
+                exchange -> {
+                    capture(exchange);
+                    respond(
+                            exchange,
+                            200,
+                            "application/json",
+                            "{\"CleanResult\":false,\"FoundViruses\":[{\"VirusName\":\"EICAR\"}]}"
+                                    .getBytes(StandardCharsets.UTF_8));
+                });
+
+        server.start();
+        baseUrl = "http://127.0.0.1:" + server.getAddress().getPort();
+
+        ExternalApiCaller caller =
+                new ExternalApiCaller(
+                        HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NEVER).build(),
+                        properties,
+                        objectMapper);
+        controller =
+                new ExternalApiCallController(
+                        connectionResolver,
+                        caller,
+                        objectMapper,
+                        new TempFileManager(new TempFileRegistry(), properties),
+                        properties);
+    }
+
+    @AfterEach
+    void stopReceiver() {
+        server.stop(0);
+    }
+
+    private void capture(HttpExchange exchange) throws IOException {
+        receivedMethod = exchange.getRequestMethod();
+        receivedBody = new String(exchange.getRequestBody().readAllBytes(), StandardCharsets.UTF_8);
+        receivedContentType = exchange.getRequestHeaders().getFirst("Content-Type");
+        exchange.getRequestHeaders()
+                .forEach((name, values) -> receivedHeaders.put(name, values.get(0)));
+    }
+
+    private static void respond(HttpExchange exchange, int status, String contentType, byte[] body)
+            throws IOException {
+        exchange.getResponseHeaders().add("Content-Type", contentType);
+        exchange.sendResponseHeaders(status, body.length);
+        exchange.getResponseBody().write(body);
+        exchange.close();
+    }
+
+    private static byte[] zip() throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        try (ZipOutputStream zip = new ZipOutputStream(out)) {
+            zip.putNextEntry(new ZipEntry("audit-trail.txt"));
+            zip.write("who signed what".getBytes(StandardCharsets.UTF_8));
+            zip.closeEntry();
+            zip.putNextEntry(new ZipEntry("signed.pdf"));
+            zip.write("%PDF-1.7 signed".getBytes(StandardCharsets.UTF_8));
+            zip.closeEntry();
+        }
+        return out.toByteArray();
+    }
+
+    /** A labelled, classified PDF, so the context has something real to carry. */
+    private static MockMultipartFile pdf() throws IOException {
+        try (PDDocument document = new PDDocument()) {
+            document.addPage(new PDPage());
+            document.addPage(new PDPage());
+            document.getDocumentInformation().setTitle("Q3 Claim");
+            document.getDocumentInformation()
+                    .setCustomMetadataValue(
+                            PdfMetadataService.CLASSIFICATION_KEY,
+                            "{\"label\":\"invoice\",\"confidence\":0.91}");
+            PdfSensitivityLabels.apply(
+                    document,
+                    new SensitivityLabel(
+                            "2096f6a2-d2f7-48be-b329-b73aaa526e5d",
+                            "Confidential",
+                            "cb46c030-1825-4e81-a295-151c039dbf02",
+                            AssignmentMethod.PRIVILEGED,
+                            null,
+                            null));
+            ByteArrayOutputStream out = new ByteArrayOutputStream();
+            document.save(out);
+            return new MockMultipartFile(
+                    "fileInput", "claim.pdf", "application/pdf", out.toByteArray());
+        }
+    }
+
+    private void connection(Map<String, Object> extra) {
+        Map<String, Object> config = new LinkedHashMap<>();
+        config.put("baseUrl", baseUrl);
+        config.putAll(extra);
+        when(connectionResolver.resolve(eq(7L))).thenReturn(ApiConnectionSettings.from(config));
+        when(connectionResolver.resolveConfig(eq(7L), any(IntegrationType.class)))
+                .thenReturn(config);
+    }
+
+    /**
+     * The step's parameters, named. The controller takes seventeen positional arguments, which is
+     * unreadable and easy to mis-order at a call site; this lets each test state only what it
+     * varies.
+     */
+    private final class Step {
+        private String path = "/v1/scan";
+        private String method = "POST";
+        private String bodyMode = "multipart";
+        private String fileFieldName = "file";
+        private String responseMode = "report";
+        private String resultUrlPath;
+        private String resultUrlHeader;
+        private String responseSelect;
+        private String requireTrue;
+        private String fields;
+        private String bodyTemplate;
+        private String headers;
+        private boolean includeContext;
+        private boolean includeFile = true;
+        private String policyName;
+        private String runId;
+
+        Step path(String v) {
+            path = v;
+            return this;
+        }
+
+        Step method(String v) {
+            method = v;
+            return this;
+        }
+
+        Step bodyMode(String v) {
+            bodyMode = v;
+            return this;
+        }
+
+        Step responseMode(String v) {
+            responseMode = v;
+            return this;
+        }
+
+        Step resultUrlPath(String v) {
+            resultUrlPath = v;
+            return this;
+        }
+
+        Step responseSelect(String v) {
+            responseSelect = v;
+            return this;
+        }
+
+        Step requireTrue(String v) {
+            requireTrue = v;
+            return this;
+        }
+
+        Step fields(String v) {
+            fields = v;
+            return this;
+        }
+
+        Step bodyTemplate(String v) {
+            bodyTemplate = v;
+            return this;
+        }
+
+        Step headers(String v) {
+            headers = v;
+            return this;
+        }
+
+        Step includeContext(boolean v) {
+            includeContext = v;
+            return this;
+        }
+
+        Step run(String policy, String id) {
+            policyName = policy;
+            runId = id;
+            return this;
+        }
+
+        ResponseEntity<Resource> go() throws IOException {
+            return controller.call(
+                    pdf(),
+                    "7",
+                    path,
+                    method,
+                    bodyMode,
+                    fileFieldName,
+                    responseMode,
+                    resultUrlPath,
+                    resultUrlHeader,
+                    responseSelect,
+                    requireTrue,
+                    fields,
+                    bodyTemplate,
+                    headers,
+                    includeContext,
+                    includeFile,
+                    policyName,
+                    runId);
+        }
+    }
+
+    private Step step() {
+        return new Step();
+    }
+
+    @Test
+    void sendsTheDocumentAndWhatWeKnowAboutItToTheReceiver() throws IOException {
+        connection(Map.of());
+
+        ResponseEntity<Resource> response =
+                step().path("/v1/scan")
+                        .fields(
+                                "{\"sha256\":\"{{document.sha256}}\",\"label\":\"{{sensitivityLabel.name}}\","
+                                        + "\"class\":\"{{classification.label}}\",\"pages\":\"{{document.pageCount}}\"}")
+                        .includeContext(true)
+                        .run("Outbound review", "run-42")
+                        .go();
+
+        assertThat(receivedMethod).isEqualTo("POST");
+        assertThat(receivedContentType).startsWith("multipart/form-data");
+        // Fields the vendor asked for, filled from what Stirling already knew - no extra calls.
+        assertThat(receivedBody).contains("name=\"label\"").contains("Confidential");
+        assertThat(receivedBody).contains("name=\"class\"").contains("invoice");
+        assertThat(receivedBody).contains("name=\"pages\"").contains("2");
+        assertThat(receivedBody).containsPattern("name=\"sha256\"[\\s\\S]{0,24}[0-9a-f]{64}");
+        // The document itself, under the field name the vendor expects.
+        assertThat(receivedBody).contains("name=\"file\"; filename=\"claim.pdf\"").contains("%PDF");
+        // The context, including which policy and run sent it.
+        assertThat(receivedBody)
+                .contains("stirlingContext")
+                .contains("Outbound review")
+                .contains("run-42");
+
+        JsonNode report =
+                objectMapper.readTree(
+                        response.getHeaders().getFirst(AiToolResponseHeaders.TOOL_REPORT));
+        assertThat(report.at("/status").asInt()).isEqualTo(200);
+        assertThat(report.at("/body/verdict").asString()).isEqualTo("clean");
+    }
+
+    @Test
+    void reportModeReturnsTheDocumentUntouched() throws IOException {
+        connection(Map.of());
+
+        ResponseEntity<Resource> response = step().path("/v1/scan").go();
+
+        // Byte-for-byte: an inspecting call-out must not perturb what it inspected.
+        assertThat(response.getBody().getInputStream().readAllBytes())
+                .startsWith("%PDF".getBytes());
+        assertThat(response.getHeaders().getFirst("Content-Disposition")).contains("claim.pdf");
+    }
+
+    @Test
+    void replaceModeAdoptsTheReturnedDocumentAndItsRealName() throws IOException {
+        connection(Map.of());
+
+        ResponseEntity<Resource> response =
+                step().path("/v1/convert").bodyMode("binary").responseMode("replace").go();
+
+        assertThat(receivedContentType).isEqualTo("application/pdf");
+        assertThat(receivedBody).startsWith("%PDF");
+        assertThat(response.getBody().getInputStream().readAllBytes())
+                .isEqualTo("DOCX-BYTES".getBytes(StandardCharsets.UTF_8));
+        // Named for what came back, not what went out: a DOCX must not be called .pdf.
+        assertThat(response.getHeaders().getFirst("Content-Disposition"))
+                .contains("converted.docx");
+    }
+
+    @Test
+    void followsAResultUrlOnTheConnectionsOwnHost() throws IOException {
+        connection(Map.of());
+
+        ResponseEntity<Resource> response =
+                step().path("/v1/deferred")
+                        .responseMode("replace")
+                        .resultUrlPath("data.downloadUrl")
+                        .go();
+
+        assertThat(response.getBody().getInputStream().readAllBytes())
+                .isEqualTo("%PDF-1.7 fetched".getBytes(StandardCharsets.UTF_8));
+    }
+
+    @Test
+    void refusesAResultUrlTheConnectionNeverAuthorised() {
+        connection(Map.of());
+
+        // The URL is chosen by the remote service at run time; obeying it would be an SSRF.
+        assertThatThrownBy(
+                        () ->
+                                step().path("/v1/evil")
+                                        .responseMode("replace")
+                                        .resultUrlPath("data.downloadUrl")
+                                        .go())
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("does not allow");
+    }
+
+    @Test
+    void picksTheWantedFileOutOfAReturnedArchive() throws IOException {
+        connection(Map.of());
+
+        ResponseEntity<Resource> response =
+                step().path("/v1/bundle").responseMode("replace").responseSelect("*.pdf").go();
+
+        assertThat(response.getBody().getInputStream().readAllBytes())
+                .isEqualTo("%PDF-1.7 signed".getBytes(StandardCharsets.UTF_8));
+    }
+
+    @Test
+    void anUnselectedArchiveFailsRatherThanBecomingTheDocument() {
+        connection(Map.of());
+
+        // Handing a .zip to a step that expects a PDF fails later and more obscurely.
+        assertThatThrownBy(() -> step().path("/v1/bundle").responseMode("replace").go())
+                .isInstanceOf(IOException.class)
+                .hasMessageContaining("responseSelect");
+    }
+
+    @Test
+    void aRejectedCallOutFailsTheStep() {
+        connection(Map.of());
+
+        // A policy that continued past a rejection would deliver documents the external system
+        // believes it never approved.
+        assertThatThrownBy(() -> step().path("/v1/reject").go())
+                .isInstanceOf(IOException.class)
+                .hasMessageContaining("HTTP 422")
+                .hasMessageContaining("policy violation");
+    }
+
+    @Test
+    void aCleanVerdictLetsTheDocumentThrough() throws IOException {
+        connection(Map.of());
+
+        // Cloudmersive answers HTTP 200 whether clean or not; the verdict is in the body. A clean
+        // result must pass the document through untouched.
+        ResponseEntity<Resource> response =
+                step().path("/v1/clean").requireTrue("CleanResult").go();
+
+        assertThat(response.getBody().getInputStream().readAllBytes())
+                .startsWith("%PDF".getBytes());
+    }
+
+    @Test
+    void anInfectedVerdictStopsTheRunEvenOnHttp200() {
+        connection(Map.of());
+
+        // The whole security proposition: HTTP 200 with CleanResult=false must NOT sail through.
+        assertThatThrownBy(() -> step().path("/v1/infected").requireTrue("CleanResult").go())
+                .isInstanceOf(IOException.class)
+                .hasMessageContaining("CleanResult")
+                .hasMessageContaining("not true");
+    }
+
+    @Test
+    void aMissingVerdictFieldFailsClosed() {
+        connection(Map.of());
+
+        // /v1/scan answers {"verdict":"clean"} - it has no CleanResult field at all. A gate that
+        // cannot find its verdict must stop the run, not wave the document through.
+        assertThatThrownBy(() -> step().path("/v1/scan").requireTrue("CleanResult").go())
+                .isInstanceOf(IOException.class)
+                .hasMessageContaining("not true");
+    }
+
+    @Test
+    void sendsAVendorShapedJsonBodyWithTheDocumentNestedInside() throws IOException {
+        connection(Map.of());
+
+        // ConsignO's submit shape: the PDF base64'd into documents[0].data.
+        step().path("/v1/scan")
+                .bodyMode("json")
+                .bodyTemplate(
+                        "{\"name\":\"{{document.filename}}\",\"status\":1,"
+                                + "\"documents\":[{\"name\":\"{{document.filename}}\",\"data\":\"{{document.base64}}\"}],"
+                                + "\"actions\":[{\"mode\":\"remote\",\"signer\":{\"type\":\"certifio\"}}]}")
+                .go();
+
+        assertThat(receivedContentType).isEqualTo("application/json");
+        JsonNode sent = objectMapper.readTree(receivedBody);
+        assertThat(sent.at("/name").asString()).isEqualTo("claim.pdf");
+        // Numbers keep their type; only strings are substituted.
+        assertThat(sent.at("/status").isNumber()).isTrue();
+        assertThat(sent.at("/actions/0/signer/type").asString()).isEqualTo("certifio");
+        assertThat(Base64.getDecoder().decode(sent.at("/documents/0/data").asString()))
+                .startsWith("%PDF".getBytes(StandardCharsets.UTF_8));
+    }
+
+    @Test
+    void appliesTheConnectionsCredentialAndTheStepsHeadersAndVerb() throws IOException {
+        connection(Map.of("authType", "BEARER", "token", "s3cr3t-token"));
+
+        step().path("/v1/scan")
+                .method("PUT")
+                .headers("{\"X-Case-Id\":\"{{run.runId}}\"}")
+                .run(null, "run-99")
+                .go();
+
+        assertThat(receivedMethod).isEqualTo("PUT");
+        assertThat(receivedHeaders.get("X-case-id")).isEqualTo("run-99");
+        // The connection's credential, which the step never supplies or sees.
+        assertThat(receivedHeaders.get("Authorization")).isEqualTo("Bearer s3cr3t-token");
+    }
+
+    @Test
+    void aStepCannotAimTheCallAtAnotherHost() {
+        connection(Map.of());
+
+        assertThatThrownBy(() -> step().path("//evil.example/x").go())
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("must be relative");
+    }
+
+    @Test
+    void notifyStyleCallOutSendsTheFactsWithoutTheDocument() throws IOException {
+        connection(Map.of());
+
+        Step notify = step().path("/v1/scan").bodyMode("json").includeContext(true);
+        notify.includeFile = false;
+        notify.run("Outbound review", "run-7").go();
+
+        JsonNode sent = objectMapper.readTree(receivedBody);
+        assertThat(sent.at("/document/filename").asString()).isEqualTo("claim.pdf");
+        assertThat(sent.at("/run/policyName").asString()).isEqualTo("Outbound review");
+        // No document: the point of a notification is the facts, not the bytes.
+        assertThat(sent.has("content")).isFalse();
+        assertThat(receivedBody).doesNotContain("%PDF");
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallerAuthHeaderTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallerAuthHeaderTest.java
new file mode 100644
index 0000000000..47aed03ae2
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallerAuthHeaderTest.java
@@ -0,0 +1,145 @@
+package stirling.software.proprietary.integration.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.http.HttpClient;
+import java.nio.charset.StandardCharsets;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import com.sun.net.httpserver.HttpServer;
+
+import stirling.software.common.model.ApplicationProperties;
+
+import tools.jackson.databind.ObjectMapper;
+
+/**
+ * Asserts the credential header {@link ExternalApiCaller} actually puts on the wire for each auth
+ * shape, against a real local server.
+ *
+ * <p>The interesting case is {@code headerPrefix}. Vendors disagree about the scheme in front of a
+ * token - PandaDoc wants {@code API-Key}, Rossum {@code token}, DeepL {@code DeepL-Auth-Key} - and
+ * without it every one of those presets would have to make the operator paste the scheme into the
+ * secret field, where a missing space silently becomes a 401.
+ */
+class ExternalApiCallerAuthHeaderTest {
+
+    private HttpServer server;
+    private String baseUrl;
+    private final Map<String, String> seen = new ConcurrentHashMap<>();
+    private final ObjectMapper objectMapper = new ObjectMapper();
+
+    @BeforeEach
+    void startServer() throws IOException {
+        server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+        server.createContext(
+                "/ingest",
+                exchange -> {
+                    seen.clear();
+                    exchange.getRequestHeaders()
+                            .forEach(
+                                    (name, values) ->
+                                            seen.put(
+                                                    name.toLowerCase(java.util.Locale.ROOT),
+                                                    String.join(", ", values)));
+                    exchange.getRequestBody().readAllBytes();
+                    byte[] body = "{\"ok\":true}".getBytes(StandardCharsets.UTF_8);
+                    exchange.getResponseHeaders().add("Content-Type", "application/json");
+                    exchange.sendResponseHeaders(200, body.length);
+                    exchange.getResponseBody().write(body);
+                    exchange.close();
+                });
+        server.start();
+        baseUrl = "http://127.0.0.1:" + server.getAddress().getPort();
+    }
+
+    @AfterEach
+    void stopServer() {
+        server.stop(0);
+    }
+
+    @Test
+    void headerAuthWithPrefixSendsSchemeAndToken() throws IOException {
+        post(
+                connection(
+                        Map.of(
+                                "authType",
+                                "HEADER",
+                                "headerName",
+                                "Authorization",
+                                "headerPrefix",
+                                "API-Key",
+                                "token",
+                                "pd-secret")));
+
+        assertThat(seen).containsEntry("authorization", "API-Key pd-secret");
+    }
+
+    @Test
+    void headerAuthWithoutPrefixSendsTheBareToken() throws IOException {
+        post(
+                connection(
+                        Map.of(
+                                "authType",
+                                "HEADER",
+                                "headerName",
+                                "x-api-key",
+                                "token",
+                                "sk-ant-secret")));
+
+        // No scheme invented: a vendor that wants the raw key must receive exactly that.
+        assertThat(seen).containsEntry("x-api-key", "sk-ant-secret");
+        assertThat(seen).doesNotContainKey("authorization");
+    }
+
+    @Test
+    void bearerAuthIsUnaffectedByAPrefix() throws IOException {
+        // headerPrefix belongs to HEADER auth; BEARER must keep its own scheme regardless.
+        post(
+                connection(
+                        Map.of(
+                                "authType",
+                                "BEARER",
+                                "headerPrefix",
+                                "API-Key",
+                                "token",
+                                "sk-secret")));
+
+        assertThat(seen).containsEntry("authorization", "Bearer sk-secret");
+    }
+
+    private void post(ApiConnectionSettings settings) throws IOException {
+        ExternalApiCaller.Response response =
+                caller().dispatch(
+                                settings,
+                                "POST",
+                                "/ingest",
+                                ExternalApiCaller.raw(
+                                        "application/json", "{}".getBytes(StandardCharsets.UTF_8)),
+                                Map.of());
+        assertThat(response.isSuccess()).isTrue();
+    }
+
+    private ApiConnectionSettings connection(Map<String, Object> options) {
+        Map<String, Object> config = new LinkedHashMap<>(options);
+        config.put("baseUrl", baseUrl);
+        return ApiConnectionSettings.from(config);
+    }
+
+    private ExternalApiCaller caller() {
+        ApplicationProperties properties = new ApplicationProperties();
+        // The server is on loopback, which is exactly what the guard blocks by default.
+        properties.getPolicies().setAllowPrivateApiEndpoints(true);
+        return new ExternalApiCaller(
+                HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NEVER).build(),
+                properties,
+                objectMapper);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallerTokenLoginTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallerTokenLoginTest.java
new file mode 100644
index 0000000000..7cfbb8cbe4
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiCallerTokenLoginTest.java
@@ -0,0 +1,296 @@
+package stirling.software.proprietary.integration.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.http.HttpClient;
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Base64;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicInteger;
+
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import com.sun.net.httpserver.HttpExchange;
+import com.sun.net.httpserver.HttpServer;
+
+import stirling.software.common.model.ApplicationProperties;
+
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ObjectNode;
+
+/**
+ * Drives {@link ExternalApiCaller} against a real local HTTP server shaped like ConsignO Cloud's
+ * auth: credentials in headers plus a JSON body, and the token handed back only in the {@code
+ * X-Auth-Token} <em>response header</em>.
+ *
+ * <p>A real server rather than a mock, because what is being tested is the wire behaviour - that
+ * the token is found in a header, reused rather than re-fetched, and re-obtained on a 401.
+ */
+class ExternalApiCallerTokenLoginTest {
+
+    private HttpServer server;
+    private String baseUrl;
+    private final AtomicInteger logins = new AtomicInteger();
+    private final List<Map<String, String>> callHeaders = new ArrayList<>();
+    private final ObjectMapper objectMapper = new ObjectMapper();
+    private volatile String issuedToken = "token-1";
+    private volatile boolean rejectToken;
+    private volatile String workflowBody;
+
+    @BeforeEach
+    void startServer() throws IOException {
+        server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+
+        server.createContext(
+                "/api/v1/auth/login",
+                exchange -> {
+                    logins.incrementAndGet();
+                    String body =
+                            new String(
+                                    exchange.getRequestBody().readAllBytes(),
+                                    StandardCharsets.UTF_8);
+                    // The vendor authenticates the app by header and the user by body.
+                    if (!"client-abc".equals(exchange.getRequestHeaders().getFirst("X-Client-Id"))
+                            || !"client-xyz"
+                                    .equals(
+                                            exchange.getRequestHeaders()
+                                                    .getFirst("X-Client-Secret"))
+                            || !body.contains("\"password\":\"s3cr3t\"")
+                            || !body.contains("\"tenantId\":\"acme\"")) {
+                        respond(exchange, 401, "{}");
+                        return;
+                    }
+                    exchange.getResponseHeaders().add("X-Auth-Token", issuedToken);
+                    respond(exchange, 200, "{\"msg\":\"ok\"}");
+                });
+
+        server.createContext(
+                "/api/v1/documents",
+                exchange -> {
+                    Map<String, String> headers = new LinkedHashMap<>();
+                    exchange.getRequestHeaders()
+                            .forEach((name, values) -> headers.put(name, values.get(0)));
+                    callHeaders.add(headers);
+                    String token = exchange.getRequestHeaders().getFirst("X-Auth-Token");
+                    if (rejectToken || token == null || !token.equals(issuedToken)) {
+                        respond(exchange, 401, "{\"msg\":\"expired\"}");
+                        return;
+                    }
+                    respond(
+                            exchange,
+                            201,
+                            "{\"response\":{\"metadata\":{\"documentId\":\"doc-9\"}}}");
+                });
+
+        server.createContext(
+                "/api/v1/workflows",
+                exchange -> {
+                    if (!issuedToken.equals(
+                            exchange.getRequestHeaders().getFirst("X-Auth-Token"))) {
+                        respond(exchange, 401, "{\"msg\":\"expired\"}");
+                        return;
+                    }
+                    workflowBody =
+                            new String(
+                                    exchange.getRequestBody().readAllBytes(),
+                                    StandardCharsets.UTF_8);
+                    respond(exchange, 201, "{\"response\":{\"id\":\"wf-7\",\"status\":1}}");
+                });
+
+        server.start();
+        baseUrl = "http://127.0.0.1:" + server.getAddress().getPort() + "/api/v1";
+    }
+
+    @AfterEach
+    void stopServer() {
+        server.stop(0);
+    }
+
+    private static void respond(HttpExchange exchange, int status, String body) throws IOException {
+        byte[] bytes = body.getBytes(StandardCharsets.UTF_8);
+        exchange.getResponseHeaders().add("Content-Type", "application/json");
+        exchange.sendResponseHeaders(status, bytes.length);
+        exchange.getResponseBody().write(bytes);
+        exchange.close();
+    }
+
+    private ExternalApiCaller caller() {
+        ApplicationProperties properties = new ApplicationProperties();
+        // The server is on loopback, which is exactly what the guard blocks by default.
+        properties.getPolicies().setAllowPrivateApiEndpoints(true);
+        return new ExternalApiCaller(
+                HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NEVER).build(),
+                properties,
+                objectMapper);
+    }
+
+    /** The ConsignO connection an operator would configure. */
+    private ApiConnectionSettings consignoConnection() {
+        Map<String, Object> config = new LinkedHashMap<>();
+        config.put("baseUrl", baseUrl);
+        config.put("authType", "TOKEN_LOGIN");
+        config.put("loginPath", "/auth/login");
+        config.put(
+                "loginBody",
+                Map.of("username", "api@acme.test", "password", "s3cr3t", "tenantId", "acme"));
+        config.put(
+                "loginHeaders",
+                Map.of("X-Client-Id", "client-abc", "X-Client-Secret", "client-xyz"));
+        config.put("tokenResponseHeader", "X-Auth-Token");
+        config.put("tokenHeaderName", "X-Auth-Token");
+        return ApiConnectionSettings.from(config);
+    }
+
+    private ExternalApiCaller.Response upload(ExternalApiCaller caller) throws IOException {
+        return caller.postFile(
+                consignoConnection(),
+                "/documents",
+                "file",
+                "contract.pdf",
+                "application/pdf",
+                "%PDF-1.7".getBytes(StandardCharsets.UTF_8),
+                Map.of());
+    }
+
+    @Test
+    void logsInAndSendsTheTokenFromTheResponseHeader() throws IOException {
+        ExternalApiCaller.Response response = upload(caller());
+
+        assertThat(response.status()).isEqualTo(201);
+        assertThat(response.bodyAsText()).contains("doc-9");
+        assertThat(logins.get()).isEqualTo(1);
+        // The token was found in a response header and presented on the next call.
+        assertThat(callHeaders)
+                .singleElement()
+                .extracting(h -> h.get("X-auth-token"))
+                .isEqualTo("token-1");
+    }
+
+    @Test
+    void reusesTheTokenAcrossCallsRatherThanLoggingInPerDocument() throws IOException {
+        ExternalApiCaller caller = caller();
+        upload(caller);
+        upload(caller);
+        upload(caller);
+
+        // A 100-document policy must not perform 100 logins.
+        assertThat(logins.get()).isEqualTo(1);
+        assertThat(callHeaders).hasSize(3);
+    }
+
+    @Test
+    void reAuthenticatesOnceWhenTheTokenIsRejected() throws IOException {
+        ExternalApiCaller caller = caller();
+        upload(caller);
+        assertThat(logins.get()).isEqualTo(1);
+
+        // The vendor expires the token early and starts issuing a new one.
+        issuedToken = "token-2";
+        ExternalApiCaller.Response response = upload(caller);
+
+        assertThat(response.status()).isEqualTo(201);
+        assertThat(logins.get()).isEqualTo(2);
+        assertThat(callHeaders).last().extracting(h -> h.get("X-auth-token")).isEqualTo("token-2");
+    }
+
+    @Test
+    void aPersistent401SurfacesRatherThanLoopingForever() throws IOException {
+        rejectToken = true;
+
+        ExternalApiCaller.Response response = upload(caller());
+
+        assertThat(response.status()).isEqualTo(401);
+        // Exactly one retry: the initial login plus one re-auth, then give up.
+        assertThat(logins.get()).isEqualTo(2);
+    }
+
+    /**
+     * The whole ConsignO submit, as an operator would configure it: log in, then post their real
+     * workflow shape with the PDF base64'd into {@code documents[0].data}. Their API takes the
+     * document inline, so {@code POST /documents} is not needed and the submit is a single call -
+     * which is what brings it within reach of the generic step.
+     */
+    @Test
+    void submitsAConsignoSignatureWorkflowEndToEnd() throws IOException {
+        byte[] pdf = "%PDF-1.7 contract".getBytes(StandardCharsets.UTF_8);
+        ObjectNode context = objectMapper.createObjectNode();
+        ObjectNode document = context.putObject("document");
+        document.put("filename", "contract.pdf");
+        document.put("base64", Base64.getEncoder().encodeToString(pdf));
+
+        String template =
+                """
+                {
+                  "name": "{{document.filename}}",
+                  "status": 1,
+                  "documents": [
+                    {"name": "{{document.filename}}", "data": "{{document.base64}}"}
+                  ],
+                  "actions": [
+                    {"mode":"remote","ref":"1",
+                     "signer":{"type":"certifio","email":"notary@example.test","lang":"en"}}
+                  ]
+                }
+                """;
+        JsonNode body = Placeholders.resolveTree(objectMapper.readTree(template), context);
+
+        ExternalApiCaller.Response response =
+                caller().dispatch(
+                                consignoConnection(),
+                                "POST",
+                                "/workflows",
+                                ExternalApiCaller.raw(
+                                        "application/json", objectMapper.writeValueAsBytes(body)),
+                                Map.of());
+
+        assertThat(response.status()).isEqualTo(201);
+        // The workflow id the vendor hands back - the thing a later fetch would need, and which a
+        // step currently has no way to carry to the next step.
+        assertThat(objectMapper.readTree(response.bodyAsText()).at("/response/id").asString())
+                .isEqualTo("wf-7");
+        assertThat(logins.get()).isEqualTo(1);
+
+        // The document really arrived, nested where ConsignO expects it.
+        JsonNode received = objectMapper.readTree(workflowBody);
+        assertThat(received.at("/actions/0/signer/type").asString()).isEqualTo("certifio");
+        assertThat(Base64.getDecoder().decode(received.at("/documents/0/data").asString()))
+                .isEqualTo(pdf);
+    }
+
+    @Test
+    void badCredentialsFailTheStepWithoutEchoingThem() {
+        Map<String, Object> config = new LinkedHashMap<>();
+        config.put("baseUrl", baseUrl);
+        config.put("authType", "TOKEN_LOGIN");
+        config.put("loginPath", "/auth/login");
+        config.put("loginBody", Map.of("username", "api@acme.test", "password", "wrong"));
+        config.put("loginHeaders", Map.of("X-Client-Id", "client-abc", "X-Client-Secret", "nope"));
+        config.put("tokenResponseHeader", "X-Auth-Token");
+        config.put("tokenHeaderName", "X-Auth-Token");
+        ApiConnectionSettings settings = ApiConnectionSettings.from(config);
+
+        assertThatThrownBy(
+                        () ->
+                                caller().postFile(
+                                                settings,
+                                                "/documents",
+                                                "file",
+                                                "c.pdf",
+                                                "application/pdf",
+                                                "%PDF".getBytes(StandardCharsets.UTF_8),
+                                                Map.of()))
+                .isInstanceOf(IOException.class)
+                .hasMessageContaining("returned HTTP 401")
+                // The login body is echoed by some vendors; the message must not carry it onward.
+                .hasMessageNotContaining("wrong");
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiPathsTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiPathsTest.java
new file mode 100644
index 0000000000..e03b330095
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ExternalApiPathsTest.java
@@ -0,0 +1,135 @@
+package stirling.software.proprietary.integration.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.net.URI;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+/**
+ * {@link ExternalApiPaths} is the control that stops the external-API step becoming an SSRF
+ * primitive, so these lean on the ways a step author might try to leave the connection's base URL.
+ */
+class ExternalApiPathsTest {
+
+    private static final URI BASE = URI.create("https://api.example.com/v1");
+
+    @Nested
+    @DisplayName("resolves paths under the base")
+    class Resolves {
+
+        @Test
+        void appendsARelativePath() {
+            assertThat(ExternalApiPaths.resolve(BASE, "/scan"))
+                    .isEqualTo(URI.create("https://api.example.com/v1/scan"));
+        }
+
+        @Test
+        void addsTheLeadingSlashWhenOmitted() {
+            assertThat(ExternalApiPaths.resolve(BASE, "scan"))
+                    .isEqualTo(URI.create("https://api.example.com/v1/scan"));
+        }
+
+        @Test
+        void blankPathIsTheBaseItself() {
+            assertThat(ExternalApiPaths.resolve(BASE, "  ")).isEqualTo(BASE);
+            assertThat(ExternalApiPaths.resolve(BASE, null)).isEqualTo(BASE);
+        }
+
+        @Test
+        void keepsAQueryString() {
+            assertThat(ExternalApiPaths.resolve(BASE, "/scan?mode=strict"))
+                    .isEqualTo(URI.create("https://api.example.com/v1/scan?mode=strict"));
+        }
+
+        @Test
+        void allowsATraversalThatStaysUnderTheBase() {
+            // "/v1/a/../b" normalises to "/v1/b", which is still under the base.
+            assertThat(ExternalApiPaths.resolve(BASE, "/a/../b"))
+                    .isEqualTo(URI.create("https://api.example.com/v1/b"));
+        }
+
+        @Test
+        void baseWithNoPathAcceptsAnyPath() {
+            assertThat(ExternalApiPaths.resolve(URI.create("https://api.example.com"), "/scan"))
+                    .isEqualTo(URI.create("https://api.example.com/scan"));
+        }
+
+        @Test
+        void keepsAnEncodedSlashFromASubstitutedValue() {
+            // Placeholders percent-encodes what it substitutes, so a filename containing '/'
+            // arrives as %2F. That is data inside one segment and must survive.
+            assertThat(ExternalApiPaths.resolve(BASE, "/docs/my%2Ffile.pdf"))
+                    .isEqualTo(URI.create("https://api.example.com/v1/docs/my%2Ffile.pdf"));
+        }
+    }
+
+    @Nested
+    @DisplayName("refuses to leave the base")
+    class Refuses {
+
+        @Test
+        void protocolRelativeUrlCannotChangeHost() {
+            // The reason URI.resolve is not used: it would yield https://evil.example/x here.
+            assertThatThrownBy(() -> ExternalApiPaths.resolve(BASE, "//evil.example/x"))
+                    .isInstanceOf(IllegalArgumentException.class)
+                    .hasMessageContaining("must be relative");
+        }
+
+        @ParameterizedTest
+        @ValueSource(
+                strings = {
+                    "https://evil.example/x",
+                    "http://evil.example/x",
+                    "HTTPS://evil.example/x",
+                    "file:///etc/passwd"
+                })
+        void absoluteUrlIsRejected(String path) {
+            assertThatThrownBy(() -> ExternalApiPaths.resolve(BASE, path))
+                    .isInstanceOf(IllegalArgumentException.class);
+        }
+
+        @Test
+        void traversalAboveTheBasePathIsRejected() {
+            assertThatThrownBy(() -> ExternalApiPaths.resolve(BASE, "/../admin"))
+                    .isInstanceOf(IllegalArgumentException.class)
+                    .hasMessageContaining("escapes");
+        }
+
+        @Test
+        void percentEncodedTraversalIsRejected() {
+            // normalize() would not decode these, so the target server would do the escaping.
+            assertThatThrownBy(() -> ExternalApiPaths.resolve(BASE, "/%2e%2e/admin"))
+                    .isInstanceOf(IllegalArgumentException.class)
+                    .hasMessageContaining("percent-encode");
+        }
+
+        @ParameterizedTest
+        @ValueSource(strings = {"/scan\r\nX-Injected: 1", "/scan\nfoo", "/sc an", "/scan\\..\\x"})
+        void requestSplittingCharactersAreRejected(String path) {
+            assertThatThrownBy(() -> ExternalApiPaths.resolve(BASE, path))
+                    .isInstanceOf(IllegalArgumentException.class)
+                    .hasMessageContaining("illegal character");
+        }
+
+        @Test
+        void siblingPathThatMerelySharesAPrefixIsRejected() {
+            // "/v1betray" starts with "/v1" textually but is a different resource tree.
+            assertThatThrownBy(() -> ExternalApiPaths.resolve(BASE, "/../v1betray/x"))
+                    .isInstanceOf(IllegalArgumentException.class)
+                    .hasMessageContaining("escapes");
+        }
+
+        @Test
+        void fragmentIsRejected() {
+            assertThatThrownBy(() -> ExternalApiPaths.resolve(BASE, "/scan#frag"))
+                    .isInstanceOf(IllegalArgumentException.class)
+                    .hasMessageContaining("fragment");
+        }
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/MultipartBodyTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/MultipartBodyTest.java
new file mode 100644
index 0000000000..c059de14d4
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/MultipartBodyTest.java
@@ -0,0 +1,111 @@
+package stirling.software.proprietary.integration.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+/**
+ * The name/value asymmetry here is easy to get wrong in either direction: too lax on names is
+ * header injection, too strict on values silently rejects ordinary JSON.
+ */
+class MultipartBodyTest {
+
+    private static String render(MultipartBody body) throws IOException {
+        // The publisher is what actually goes on the wire.
+        java.net.http.HttpRequest.BodyPublisher publisher = body.build();
+        StringBuilder out = new StringBuilder();
+        publisher.subscribe(
+                new java.util.concurrent.Flow.Subscriber<>() {
+                    @Override
+                    public void onSubscribe(java.util.concurrent.Flow.Subscription s) {
+                        s.request(Long.MAX_VALUE);
+                    }
+
+                    @Override
+                    public void onNext(java.nio.ByteBuffer item) {
+                        byte[] bytes = new byte[item.remaining()];
+                        item.get(bytes);
+                        out.append(new String(bytes, StandardCharsets.UTF_8));
+                    }
+
+                    @Override
+                    public void onError(Throwable t) {}
+
+                    @Override
+                    public void onComplete() {}
+                });
+        return out.toString();
+    }
+
+    @Test
+    void carriesAJsonValueThroughUntouched() throws IOException {
+        // Regression: values were once checked like headers, which rejected every JSON value —
+        // including the auto-populated context, so includeContext could never be sent.
+        String json = "{\"document\":{\"title\":\"Q3 \\\"final\\\"\"},\"n\":2}";
+        MultipartBody body = new MultipartBody();
+        body.addField("stirlingContext", json);
+
+        assertThat(render(body)).contains(json);
+    }
+
+    @Test
+    void carriesAValueWithNewlinesAndBackslashes() throws IOException {
+        MultipartBody body = new MultipartBody();
+        body.addField("notes", "line one\nline two\\end");
+
+        assertThat(render(body)).contains("line one\nline two\\end");
+    }
+
+    @Test
+    void writesTheDocumentUnderItsFieldNameAndFilename() throws IOException {
+        MultipartBody body = new MultipartBody();
+        body.addFields(Map.of("policy", "strict"));
+        body.addFile(
+                "file",
+                "claim.pdf",
+                "application/pdf",
+                "%PDF-1.7".getBytes(StandardCharsets.UTF_8));
+
+        String rendered = render(body);
+        assertThat(rendered).contains("name=\"policy\"").contains("strict");
+        assertThat(rendered)
+                .contains("name=\"file\"; filename=\"claim.pdf\"")
+                .contains("Content-Type: application/pdf")
+                .contains("%PDF-1.7");
+        assertThat(body.contentType()).startsWith("multipart/form-data; boundary=StirlingBoundary");
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"na\"me", "na\rme", "na\nme", "na\\me"})
+    void refusesAFieldNameThatCouldForgeItsOwnHeaders(String name) {
+        MultipartBody body = new MultipartBody();
+
+        assertThatThrownBy(() -> body.addField(name, "v"))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("illegal character");
+    }
+
+    @ParameterizedTest
+    @ValueSource(strings = {"a\".pdf", "a\r.pdf", "a\n.pdf"})
+    void refusesAFilenameThatCouldForgeItsOwnHeaders(String filename) {
+        MultipartBody body = new MultipartBody();
+
+        assertThatThrownBy(() -> body.addFile("file", filename, "application/pdf", new byte[] {1}))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("illegal character");
+    }
+
+    @Test
+    void eachBodyGetsItsOwnBoundary() {
+        // A value cannot end its own part because it cannot know the boundary in advance.
+        assertThat(new MultipartBody().contentType())
+                .isNotEqualTo(new MultipartBody().contentType());
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/PlaceholdersTemplateTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/PlaceholdersTemplateTest.java
new file mode 100644
index 0000000000..3d91d0230f
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/PlaceholdersTemplateTest.java
@@ -0,0 +1,110 @@
+package stirling.software.proprietary.integration.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.util.Base64;
+
+import org.junit.jupiter.api.Test;
+
+import tools.jackson.databind.JsonNode;
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ObjectNode;
+
+/**
+ * Body templating is what decides whether a vendor with a nested payload needs bespoke code, so the
+ * headline case here is ConsignO Cloud's real {@code POST /workflows} shape.
+ */
+class PlaceholdersTemplateTest {
+
+    private final ObjectMapper objectMapper = new ObjectMapper();
+
+    private ObjectNode context() {
+        ObjectNode root = objectMapper.createObjectNode();
+        ObjectNode document = root.putObject("document");
+        document.put("filename", "contract.pdf");
+        document.put("base64", Base64.getEncoder().encodeToString("%PDF-1.7".getBytes()));
+        document.put("pageCount", 4);
+        root.putObject("run").put("policyName", "Signature run");
+        root.putObject("sensitivityLabel").put("name", "Confidential");
+        return root;
+    }
+
+    private JsonNode resolve(String template) {
+        return Placeholders.resolveTree(objectMapper.readTree(template), context());
+    }
+
+    @Test
+    void buildsConsignOsWorkflowPayload() {
+        // Lifted from the ConsignO Cloud API reference: the document rides base64 in
+        // documents[0].data, and `certifio` is the Notarius professional-certificate signer.
+        String template =
+                """
+                {
+                  "name": "{{document.filename}}",
+                  "status": 1,
+                  "documents": [
+                    {"name": "{{document.filename}}", "data": "{{document.base64}}"}
+                  ],
+                  "actions": [
+                    {
+                      "mode": "remote",
+                      "ref": "1",
+                      "signer": {
+                        "type": "certifio",
+                        "email": "notary@example.test",
+                        "lang": "en"
+                      }
+                    }
+                  ]
+                }
+                """;
+
+        JsonNode body = resolve(template);
+
+        assertThat(body.at("/name").asString()).isEqualTo("contract.pdf");
+        // Numbers and booleans keep their type; only strings are substituted.
+        assertThat(body.at("/status").isNumber()).isTrue();
+        assertThat(body.at("/status").asInt()).isEqualTo(1);
+        assertThat(body.at("/documents/0/name").asString()).isEqualTo("contract.pdf");
+        assertThat(new String(Base64.getDecoder().decode(body.at("/documents/0/data").asString())))
+                .isEqualTo("%PDF-1.7");
+        assertThat(body.at("/actions/0/signer/type").asString()).isEqualTo("certifio");
+        assertThat(body.at("/actions/0/ref").asString()).isEqualTo("1");
+    }
+
+    @Test
+    void resolvesInsideNestedObjectsAndArrays() {
+        JsonNode body =
+                resolve(
+                        "{\"a\":{\"b\":[{\"c\":\"{{document.filename}}\"},"
+                                + "\"{{run.policyName}}\"]}}");
+
+        assertThat(body.at("/a/b/0/c").asString()).isEqualTo("contract.pdf");
+        assertThat(body.at("/a/b/1").asString()).isEqualTo("Signature run");
+    }
+
+    @Test
+    void leavesNonStringsAlone() {
+        JsonNode body = resolve("{\"n\":3,\"b\":true,\"z\":null,\"arr\":[1,2]}");
+
+        assertThat(body.at("/n").asInt()).isEqualTo(3);
+        assertThat(body.at("/b").asBoolean()).isTrue();
+        assertThat(body.at("/z").isNull()).isTrue();
+        assertThat(body.at("/arr/1").asInt()).isEqualTo(2);
+    }
+
+    @Test
+    void substitutesWithinSurroundingText() {
+        JsonNode body = resolve("{\"subject\":\"{{run.policyName}}: {{document.filename}}\"}");
+
+        assertThat(body.at("/subject").asString()).isEqualTo("Signature run: contract.pdf");
+    }
+
+    @Test
+    void aTypoInATemplateIsAnErrorNotASilentlyEmptyPayload() {
+        assertThatThrownBy(() -> resolve("{\"x\":\"{{document.flename}}\"}"))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("unknown placeholder");
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/PlaceholdersTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/PlaceholdersTest.java
new file mode 100644
index 0000000000..cd82e7997f
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/PlaceholdersTest.java
@@ -0,0 +1,127 @@
+package stirling.software.proprietary.integration.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.net.URI;
+
+import org.junit.jupiter.api.Test;
+
+import stirling.software.proprietary.integration.api.Placeholders.Escaping;
+
+import tools.jackson.databind.ObjectMapper;
+import tools.jackson.databind.node.ObjectNode;
+
+class PlaceholdersTest {
+
+    private final ObjectMapper objectMapper = new ObjectMapper();
+
+    private ObjectNode context() {
+        ObjectNode root = objectMapper.createObjectNode();
+        ObjectNode document = root.putObject("document");
+        document.put("filename", "invoice.pdf");
+        document.put("sha256", "abc123");
+        document.put("pageCount", 3);
+        document.putNull("title");
+        ObjectNode label = root.putObject("sensitivityLabel");
+        label.put("name", "Confidential");
+        root.putObject("run").put("policyName", "Outbound review");
+        return root;
+    }
+
+    @Test
+    void substitutesADottedPath() {
+        assertThat(Placeholders.resolve("{{document.filename}}", context(), Escaping.NONE))
+                .isEqualTo("invoice.pdf");
+    }
+
+    @Test
+    void substitutesSeveralWithSurroundingText() {
+        assertThat(
+                        Placeholders.resolve(
+                                "{{document.filename}} ({{document.pageCount}}p) is"
+                                        + " {{sensitivityLabel.name}}",
+                                context(),
+                                Escaping.NONE))
+                .isEqualTo("invoice.pdf (3p) is Confidential");
+    }
+
+    @Test
+    void toleratesWhitespaceInsideBraces() {
+        assertThat(Placeholders.resolve("{{ document.sha256 }}", context(), Escaping.NONE))
+                .isEqualTo("abc123");
+    }
+
+    @Test
+    void aNullValueRendersEmptyNotTheWordNull() {
+        // "null" in a vendor's field would read as a value rather than an absence.
+        assertThat(Placeholders.resolve("[{{document.title}}]", context(), Escaping.NONE))
+                .isEqualTo("[]");
+    }
+
+    @Test
+    void textWithNoPlaceholderIsUntouched() {
+        assertThat(Placeholders.resolve("/scan", context(), Escaping.NONE)).isEqualTo("/scan");
+        assertThat(Placeholders.resolve(null, context(), Escaping.NONE)).isNull();
+    }
+
+    @Test
+    void anUnknownPathIsAnErrorRatherThanAnEmptyValue() {
+        // A typo that silently sent "" could mean an external system files a document wrongly.
+        assertThatThrownBy(
+                        () -> Placeholders.resolve("{{document.nope}}", context(), Escaping.NONE))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("unknown placeholder");
+        assertThatThrownBy(() -> Placeholders.resolve("{{nope.at.all}}", context(), Escaping.NONE))
+                .isInstanceOf(IllegalArgumentException.class);
+    }
+
+    @Test
+    void anObjectRendersAsJson() {
+        assertThat(Placeholders.resolve("{{sensitivityLabel}}", context(), Escaping.NONE))
+                .isEqualTo("{\"name\":\"Confidential\"}");
+    }
+
+    @Test
+    void pathEscapingEncodesSeparatorsButNotDots() {
+        ObjectNode context = context();
+        context.putObject("x").put("weird", "a/b c.pdf");
+
+        // The dot survives (it is unreserved); the slash and space cannot pass as structure.
+        assertThat(Placeholders.resolve("{{x.weird}}", context, Escaping.URL_PATH))
+                .isEqualTo("a%2Fb%20c.pdf");
+    }
+
+    @Test
+    void aTraversalInAValueIsNeutralisedRatherThanObeyed() {
+        ObjectNode context = context();
+        context.putObject("x").put("nasty", "../../admin");
+
+        // Encoding the separators leaves one inert segment, so there is no traversal left to
+        // normalise: the request stays under the base and the value arrives as data.
+        String resolved = Placeholders.resolve("/docs/{{x.nasty}}", context, Escaping.URL_PATH);
+        assertThat(resolved).isEqualTo("/docs/..%2F..%2Fadmin");
+
+        assertThat(ExternalApiPaths.resolve(URI.create("https://api.example.com/v1"), resolved))
+                .isEqualTo(URI.create("https://api.example.com/v1/docs/..%2F..%2Fadmin"));
+    }
+
+    @Test
+    void aTraversalWrittenIntoTheTemplateItselfIsStillRejected() {
+        // The operator's own text is not encoded, so a literal ".." normalises and the base check
+        // sees it. This is why dots are deliberately left unencoded above.
+        assertThatThrownBy(
+                        () ->
+                                ExternalApiPaths.resolve(
+                                        URI.create("https://api.example.com/v1"), "/docs/../../x"))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("escapes");
+    }
+
+    @Test
+    void detectsWhetherTextReferencesAnything() {
+        assertThat(Placeholders.hasPlaceholder("{{a.b}}")).isTrue();
+        assertThat(Placeholders.hasPlaceholder("plain")).isFalse();
+        assertThat(Placeholders.hasPlaceholder(null)).isFalse();
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ResultUrlsTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ResultUrlsTest.java
new file mode 100644
index 0000000000..a46cd115a7
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/api/ResultUrlsTest.java
@@ -0,0 +1,193 @@
+package stirling.software.proprietary.integration.api;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.net.URI;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
+
+import stirling.software.common.model.ApplicationProperties;
+
+/**
+ * A result URL is picked by the remote service at run time, so these lean on the ways a hostile or
+ * compromised integration might use that to aim a server-side fetch somewhere it should not go.
+ */
+class ResultUrlsTest {
+
+    private final ApplicationProperties properties = new ApplicationProperties();
+
+    private ApiConnectionSettings connection(List<String> resultUrlHosts) {
+        Map<String, Object> config = new LinkedHashMap<>();
+        config.put("baseUrl", "https://api.vendor.example/v1");
+        if (resultUrlHosts != null) {
+            config.put("resultUrlHosts", resultUrlHosts);
+        }
+        return ApiConnectionSettings.from(config);
+    }
+
+    // The host-matching rule is asserted directly: validate() also resolves the host, which fails
+    // closed, so it cannot be exercised against reserved .example names without real DNS.
+
+    @Test
+    void allowsTheConnectionsOwnHostWithoutBeingDeclared() {
+        assertThat(ResultUrls.isAllowedHost(connection(null), "api.vendor.example")).isTrue();
+    }
+
+    @Test
+    void allowsADeclaredResultHost() {
+        // The common real case: the API answers on one host, the file lives on a CDN.
+        assertThat(
+                        ResultUrls.isAllowedHost(
+                                connection(List.of("cdn.vendor.example")), "cdn.vendor.example"))
+                .isTrue();
+    }
+
+    @Test
+    void allowsASubdomainOfADeclaredHost() {
+        assertThat(
+                        ResultUrls.isAllowedHost(
+                                connection(List.of("vendor.example")), "files.eu.vendor.example"))
+                .isTrue();
+    }
+
+    @Test
+    void hostMatchingIsCaseInsensitive() {
+        assertThat(
+                        ResultUrls.isAllowedHost(
+                                connection(List.of("CDN.Vendor.Example")), "cdn.vendor.example"))
+                .isTrue();
+    }
+
+    @Test
+    void anUnresolvableHostIsRefusedRatherThanAssumedSafe() {
+        // Fail closed: if we cannot see where a name points, we cannot say it is not internal.
+        assertThatThrownBy(
+                        () ->
+                                ResultUrls.validate(
+                                        connection(null),
+                                        "https://api.vendor.example/files/signed.pdf",
+                                        properties))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("Unable to resolve");
+    }
+
+    @Test
+    void fetchesFromAnAllowedHostThatResolves() {
+        properties.getPolicies().setAllowPrivateApiEndpoints(true);
+        Map<String, Object> config = new LinkedHashMap<>();
+        config.put("baseUrl", "http://127.0.0.1:9000/v1");
+        ApiConnectionSettings settings = ApiConnectionSettings.from(config);
+
+        assertThat(
+                        ResultUrls.validate(
+                                settings, "http://127.0.0.1:9000/files/signed.pdf", properties))
+                .isEqualTo(URI.create("http://127.0.0.1:9000/files/signed.pdf"));
+    }
+
+    @Test
+    void refusesAnUndeclaredHost() {
+        assertThatThrownBy(
+                        () ->
+                                ResultUrls.validate(
+                                        connection(null), "https://evil.example/x.pdf", properties))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("does not allow");
+    }
+
+    @Test
+    void refusesAHostThatMerelyEndsWithADeclaredOne() {
+        // "evilvendor.example" must not be admitted by an entry of "vendor.example".
+        assertThatThrownBy(
+                        () ->
+                                ResultUrls.validate(
+                                        connection(List.of("vendor.example")),
+                                        "https://evilvendor.example/x.pdf",
+                                        properties))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("does not allow");
+    }
+
+    @Test
+    void refusesTheCloudMetadataServiceEvenIfDeclared() {
+        // The headline SSRF: an integration answering with the metadata address.
+        assertThatThrownBy(
+                        () ->
+                                ResultUrls.validate(
+                                        connection(List.of("169.254.169.254")),
+                                        "http://169.254.169.254/latest/meta-data/iam/",
+                                        properties))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("private/link-local");
+    }
+
+    @Test
+    void refusesLoopbackEvenIfDeclared() {
+        assertThatThrownBy(
+                        () ->
+                                ResultUrls.validate(
+                                        connection(List.of("localhost")),
+                                        "http://localhost:8080/admin",
+                                        properties))
+                .isInstanceOf(IllegalArgumentException.class);
+    }
+
+    @Test
+    void anOperatorCanOptInToPrivateResultHostsForOnPrem() {
+        properties.getPolicies().setAllowPrivateApiEndpoints(true);
+
+        assertThat(
+                        ResultUrls.validate(
+                                connection(List.of("localhost")),
+                                "http://localhost:8080/files/signed.pdf",
+                                properties))
+                .hasHost("localhost");
+    }
+
+    @ParameterizedTest
+    @ValueSource(
+            strings = {
+                "file:///etc/passwd",
+                "jar:file:///tmp/x.jar!/y",
+                "gopher://evil.example/x",
+                "ftp://evil.example/x"
+            })
+    void refusesNonHttpSchemes(String url) {
+        // A URL fetch that accepts file: is a local file read.
+        assertThatThrownBy(() -> ResultUrls.validate(connection(null), url, properties))
+                .isInstanceOf(IllegalArgumentException.class);
+    }
+
+    @Test
+    void refusesCredentialsEmbeddedInTheUrl() {
+        assertThatThrownBy(
+                        () ->
+                                ResultUrls.validate(
+                                        connection(List.of("cdn.vendor.example")),
+                                        "https://user:pw@cdn.vendor.example/x.pdf",
+                                        properties))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("credentials");
+    }
+
+    @Test
+    void refusesGarbage() {
+        assertThatThrownBy(() -> ResultUrls.validate(connection(null), "not a url", properties))
+                .isInstanceOf(IllegalArgumentException.class);
+    }
+
+    @Test
+    void resultUrlHostsMustBeBareHostnames() {
+        // A URL or wildcard here reads as broader than it is.
+        assertThatThrownBy(() -> connection(List.of("https://cdn.vendor.example/x")))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("bare hostnames");
+        assertThatThrownBy(() -> connection(List.of("*.vendor.example")))
+                .isInstanceOf(IllegalArgumentException.class);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/purview/PdfSensitivityLabelsTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/purview/PdfSensitivityLabelsTest.java
new file mode 100644
index 0000000000..7e563c371a
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/purview/PdfSensitivityLabelsTest.java
@@ -0,0 +1,282 @@
+package stirling.software.proprietary.integration.purview;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+
+import org.apache.pdfbox.Loader;
+import org.apache.pdfbox.pdmodel.PDDocument;
+import org.apache.pdfbox.pdmodel.PDPage;
+import org.apache.pdfbox.pdmodel.common.PDMetadata;
+import org.junit.jupiter.api.Test;
+
+import stirling.software.proprietary.integration.purview.SensitivityLabel.AssignmentMethod;
+
+/**
+ * Exercises the label round-trip against real PDFBox documents, including a save/reload so the
+ * assertions reflect what actually lands on disk rather than in-memory state.
+ */
+class PdfSensitivityLabelsTest {
+
+    private static final String LABEL_ID = "2096f6a2-d2f7-48be-b329-b73aaa526e5d";
+    private static final String TENANT = "cb46c030-1825-4e81-a295-151c039dbf02";
+
+    private static PDDocument newDocument() {
+        PDDocument document = new PDDocument();
+        document.addPage(new PDPage());
+        return document;
+    }
+
+    private static PDDocument saveAndReload(PDDocument document) throws IOException {
+        ByteArrayOutputStream out = new ByteArrayOutputStream();
+        document.save(out);
+        document.close();
+        return Loader.loadPDF(new ByteArrayInputStream(out.toByteArray()).readAllBytes());
+    }
+
+    private static String xmpString(PDDocument document) throws IOException {
+        PDMetadata metadata = document.getDocumentCatalog().getMetadata();
+        if (metadata == null) {
+            return "";
+        }
+        try (InputStream is = metadata.exportXMPMetadata()) {
+            return new String(is.readAllBytes(), StandardCharsets.UTF_8);
+        }
+    }
+
+    private static SensitivityLabel confidential() {
+        return new SensitivityLabel(
+                LABEL_ID,
+                "Confidential",
+                TENANT,
+                AssignmentMethod.STANDARD,
+                Instant.parse("2026-07-17T10:15:30Z"),
+                SensitivityLabel.CONTENT_BITS_FOOTER);
+    }
+
+    @Test
+    void appliedLabelSurvivesSaveAndReload() throws IOException {
+        PDDocument document = newDocument();
+        PdfSensitivityLabels.apply(document, confidential());
+
+        try (PDDocument reloaded = saveAndReload(document)) {
+            SensitivityLabel read = PdfSensitivityLabels.read(reloaded).orElseThrow();
+            assertThat(read.labelId()).isEqualTo(LABEL_ID);
+            assertThat(read.name()).isEqualTo("Confidential");
+            assertThat(read.siteId()).isEqualTo(TENANT);
+            assertThat(read.method()).isEqualTo(AssignmentMethod.STANDARD);
+            assertThat(read.setDate()).isEqualTo(Instant.parse("2026-07-17T10:15:30Z"));
+            assertThat(read.contentBits()).isEqualTo(SensitivityLabel.CONTENT_BITS_FOOTER);
+        }
+    }
+
+    @Test
+    void writesTheDocumentedKeyNamesIntoTheInfoDictionary() throws IOException {
+        try (PDDocument document = newDocument()) {
+            PdfSensitivityLabels.apply(document, confidential());
+
+            var info = document.getDocumentInformation();
+            String prefix = "MSIP_Label_" + LABEL_ID + "_";
+            assertThat(info.getCustomMetadataValue(prefix + "Enabled")).isEqualTo("true");
+            assertThat(info.getCustomMetadataValue(prefix + "SiteId")).isEqualTo(TENANT);
+            assertThat(info.getCustomMetadataValue(prefix + "Method")).isEqualTo("Standard");
+            assertThat(info.getCustomMetadataValue(prefix + "Name")).isEqualTo("Confidential");
+            assertThat(info.getCustomMetadataValue(prefix + "ContentBits")).isEqualTo("2");
+            // Extended ISO 8601, as the MIP contract specifies.
+            assertThat(info.getCustomMetadataValue(prefix + "SetDate"))
+                    .isEqualTo("2026-07-17T10:15:30+0000");
+        }
+    }
+
+    @Test
+    void readsALabelPresentOnlyInTheInfoDictionary() throws IOException {
+        // What a third-party labeller may leave behind: no XMP copy at all.
+        try (PDDocument document = newDocument()) {
+            var info = document.getDocumentInformation();
+            String prefix = "MSIP_Label_" + LABEL_ID + "_";
+            info.setCustomMetadataValue(prefix + "Enabled", "true");
+            info.setCustomMetadataValue(prefix + "SiteId", TENANT);
+            info.setCustomMetadataValue(prefix + "Name", "Secret");
+
+            SensitivityLabel read = PdfSensitivityLabels.read(document).orElseThrow();
+            assertThat(read.name()).isEqualTo("Secret");
+            assertThat(read.method()).isNull();
+        }
+    }
+
+    @Test
+    void unlabelledDocumentReadsAsEmpty() throws IOException {
+        try (PDDocument document = newDocument()) {
+            assertThat(PdfSensitivityLabels.read(document)).isEmpty();
+        }
+    }
+
+    @Test
+    void enabledFalseIsNotALabel() throws IOException {
+        try (PDDocument document = newDocument()) {
+            var info = document.getDocumentInformation();
+            info.setCustomMetadataValue("MSIP_Label_" + LABEL_ID + "_Enabled", "false");
+            info.setCustomMetadataValue("MSIP_Label_" + LABEL_ID + "_SiteId", TENANT);
+
+            assertThat(PdfSensitivityLabels.read(document)).isEmpty();
+        }
+    }
+
+    @Test
+    void relabellingReplacesTheSameTenantsLabel() throws IOException {
+        // "An object can only have one label from the same organization."
+        String otherLabel = "11111111-2222-3333-4444-555555555555";
+        try (PDDocument document = newDocument()) {
+            PdfSensitivityLabels.apply(document, confidential());
+            PdfSensitivityLabels.apply(
+                    document,
+                    new SensitivityLabel(
+                            otherLabel, "Public", TENANT, AssignmentMethod.PRIVILEGED, null, null));
+
+            assertThat(PdfSensitivityLabels.readAll(document))
+                    .singleElement()
+                    .satisfies(
+                            label -> {
+                                assertThat(label.labelId()).isEqualTo(otherLabel);
+                                assertThat(label.name()).isEqualTo("Public");
+                            });
+        }
+    }
+
+    @Test
+    void aDifferentTenantsLabelIsLeftAlone() throws IOException {
+        String foreignTenant = "99999999-8888-7777-6666-555555555555";
+        try (PDDocument document = newDocument()) {
+            PdfSensitivityLabels.apply(
+                    document,
+                    new SensitivityLabel(
+                            "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+                            "Foreign",
+                            foreignTenant,
+                            null,
+                            null,
+                            null));
+            PdfSensitivityLabels.apply(document, confidential());
+
+            assertThat(PdfSensitivityLabels.readAll(document))
+                    .hasSize(2)
+                    .extracting(SensitivityLabel::siteId)
+                    .containsExactlyInAnyOrder(foreignTenant, TENANT);
+        }
+    }
+
+    @Test
+    void aDifferentTenantsLabelStaysInTheXmpSurfaceToo() throws IOException {
+        String foreignLabel = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
+        PDDocument document = newDocument();
+        PdfSensitivityLabels.apply(
+                document,
+                new SensitivityLabel(
+                        foreignLabel,
+                        "Foreign",
+                        "99999999-8888-7777-6666-555555555555",
+                        null,
+                        null,
+                        null));
+        PdfSensitivityLabels.apply(document, confidential());
+
+        try (PDDocument reloaded = saveAndReload(document)) {
+            // The foreign label must survive on the XMP copy, not only in the info dictionary:
+            // re-labelling replaces this tenant's labels, not everyone else's.
+            String xmp = xmpString(reloaded);
+            assertThat(xmp).contains("MSIP_Label_" + foreignLabel + "_");
+            assertThat(xmp).contains("MSIP_Label_" + LABEL_ID + "_");
+        }
+    }
+
+    @Test
+    void clearRemovesEveryLabel() throws IOException {
+        PDDocument document = newDocument();
+        PdfSensitivityLabels.apply(document, confidential());
+        PdfSensitivityLabels.clear(document);
+
+        try (PDDocument reloaded = saveAndReload(document)) {
+            assertThat(PdfSensitivityLabels.readAll(reloaded)).isEmpty();
+        }
+    }
+
+    @Test
+    void refusesALabelThatClaimsEncryption() throws IOException {
+        try (PDDocument document = newDocument()) {
+            SensitivityLabel encrypting =
+                    new SensitivityLabel(
+                            LABEL_ID,
+                            "Highly Confidential",
+                            TENANT,
+                            AssignmentMethod.STANDARD,
+                            null,
+                            SensitivityLabel.CONTENT_BITS_ENCRYPT);
+
+            // Marking content as protected without protecting it would mislead every reader.
+            assertThatThrownBy(() -> PdfSensitivityLabels.apply(document, encrypting))
+                    .isInstanceOf(IllegalArgumentException.class)
+                    .hasMessageContaining("cannot protect");
+        }
+    }
+
+    @Test
+    void preservesUnrelatedXmpAndInfoMetadata() throws IOException {
+        PDDocument document = newDocument();
+        document.getDocumentInformation().setAuthor("Anthony");
+        document.getDocumentInformation().setCustomMetadataValue("StirlingPDFClassification", "{}");
+        PdfSensitivityLabels.apply(document, confidential());
+
+        try (PDDocument reloaded = saveAndReload(document)) {
+            assertThat(reloaded.getDocumentInformation().getAuthor()).isEqualTo("Anthony");
+            assertThat(
+                            reloaded.getDocumentInformation()
+                                    .getCustomMetadataValue("StirlingPDFClassification"))
+                    .isEqualTo("{}");
+            assertThat(PdfSensitivityLabels.read(reloaded)).isPresent();
+        }
+    }
+
+    @Test
+    void labelValuesAreCappedAtTheDocumentedLength() {
+        SensitivityLabel longName =
+                new SensitivityLabel(LABEL_ID, "x".repeat(400), TENANT, null, null, null);
+        assertThat(longName.toMetadata().get("MSIP_Label_" + LABEL_ID + "_Name"))
+                .hasSize(SensitivityLabel.MAX_VALUE_LENGTH);
+    }
+
+    @Test
+    void labelRequiresIdAndTenant() {
+        assertThatThrownBy(() -> new SensitivityLabel(null, "n", TENANT, null, null, null))
+                .isInstanceOf(IllegalArgumentException.class);
+        assertThatThrownBy(() -> new SensitivityLabel(LABEL_ID, "n", " ", null, null, null))
+                .isInstanceOf(IllegalArgumentException.class);
+    }
+
+    @Test
+    void rejectsALabelIdThatIsNotAGuid() {
+        // labelId is written into XMP/info key names verbatim; a space or markup char must not
+        // pass,
+        // or it would corrupt or inject the metadata packet it lands in.
+        assertThatThrownBy(
+                        () ->
+                                new SensitivityLabel(
+                                        "not a guid", "Public", TENANT, null, null, null))
+                .isInstanceOf(IllegalArgumentException.class);
+        assertThatThrownBy(
+                        () ->
+                                new SensitivityLabel(
+                                        "<inject>-2222-3333-4444-5555555555",
+                                        "Public",
+                                        TENANT,
+                                        null,
+                                        null,
+                                        null))
+                .isInstanceOf(IllegalArgumentException.class);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/integration/service/IntegrationConfigServiceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/integration/service/IntegrationConfigServiceTest.java
index fbfef15721..90842612d1 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/integration/service/IntegrationConfigServiceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/integration/service/IntegrationConfigServiceTest.java
@@ -55,6 +55,9 @@ class IntegrationConfigServiceTest {
     @Mock private IntegrationConfigValidator validator;
     @Mock private IntegrationConfigUsageCheck usageCheck;
 
+    private final stirling.software.common.model.ApplicationProperties applicationProperties =
+            new stirling.software.common.model.ApplicationProperties();
+
     private IntegrationConfigService service;
 
     @BeforeEach
@@ -65,6 +68,7 @@ class IntegrationConfigServiceTest {
                         ownership,
                         secretMasker,
                         grantRepository,
+                        applicationProperties,
                         List.of(validator),
                         List.of(usageCheck));
     }
@@ -72,21 +76,107 @@ class IntegrationConfigServiceTest {
     @Test
     void createRejectsAConfigItsTypeValidatorRefuses() {
         when(secretMasker.sanitize(any())).thenReturn(Map.of());
-        when(validator.type()).thenReturn(IntegrationType.API);
-        org.mockito.Mockito.doThrow(new IllegalArgumentException("api config needs a 'url'"))
+        when(validator.type()).thenReturn(IntegrationType.MCP);
+        org.mockito.Mockito.doThrow(new IllegalArgumentException("mcp config needs a 'url'"))
                 .when(validator)
                 .validate(any());
 
+        assertThatThrownBy(
+                        () ->
+                                service.create(
+                                        request(IntegrationType.MCP, OwnerScope.USER, null),
+                                        user(7)))
+                .isInstanceOf(ResponseStatusException.class)
+                .satisfies(
+                        e ->
+                                assertThat(((ResponseStatusException) e).getStatusCode())
+                                        .isEqualTo(HttpStatus.BAD_REQUEST));
+    }
+
+    @Test
+    void anAdminCanAuthorACustomApiIntegration() {
+        when(secretMasker.sanitize(any())).thenReturn(Map.of());
+        when(repository.save(any())).thenAnswer(inv -> inv.getArgument(0));
+        when(ownership.isAdmin(any())).thenReturn(true);
+
+        IntegrationConfig created =
+                service.create(request(IntegrationType.API, OwnerScope.USER, null), user(7));
+
+        assertThat(created.getIntegrationType()).isEqualTo(IntegrationType.API);
+    }
+
+    @Test
+    void aNonAdminCannotAuthorACustomApiIntegration() {
+        // A custom integration names its own host and body, so it can aim the server anywhere;
+        // that is admin authoring power, not self-serve config like a vendor preset.
+        when(ownership.isAdmin(any())).thenReturn(false);
+
         assertThatThrownBy(
                         () ->
                                 service.create(
                                         request(IntegrationType.API, OwnerScope.USER, null),
                                         user(7)))
                 .isInstanceOf(ResponseStatusException.class)
-                .satisfies(
-                        e ->
-                                assertThat(((ResponseStatusException) e).getStatusCode())
-                                        .isEqualTo(HttpStatus.BAD_REQUEST));
+                .extracting(e -> ((ResponseStatusException) e).getStatusCode())
+                .isEqualTo(HttpStatus.FORBIDDEN);
+    }
+
+    @Test
+    void theOperatorCanWithdrawCustomApiAuthoringEntirely() {
+        applicationProperties.getPolicies().setAllowCustomApiIntegrations(false);
+
+        // Off for everyone, admins included.
+        assertThatThrownBy(
+                        () ->
+                                service.create(
+                                        request(IntegrationType.API, OwnerScope.USER, null),
+                                        user(7)))
+                .isInstanceOf(ResponseStatusException.class)
+                .extracting(e -> ((ResponseStatusException) e).getStatusCode())
+                .isEqualTo(HttpStatus.FORBIDDEN);
+        assertThat(service.canAuthorCustomApi(user(7))).isFalse();
+    }
+
+    @Test
+    void vendorPresetsAreNotGatedByTheCustomApiFlag() {
+        // Purview/ConsignO carry a fixed shape: the worst a user can do is misconfigure their own
+        // connection, so they stay self-serve even with custom authoring switched off.
+        applicationProperties.getPolicies().setAllowCustomApiIntegrations(false);
+        when(secretMasker.sanitize(any())).thenReturn(Map.of());
+        when(repository.save(any())).thenAnswer(inv -> inv.getArgument(0));
+
+        IntegrationConfig created =
+                service.create(request(IntegrationType.PURVIEW, OwnerScope.USER, null), user(7));
+
+        assertThat(created.getIntegrationType()).isEqualTo(IntegrationType.PURVIEW);
+    }
+
+    @Test
+    void editingACustomApisConfigNeedsTheSameRightsAsCreatingIt() {
+        // Otherwise the base URL and body could be rewritten by someone who could never have
+        // authored them.
+        IntegrationConfig cfg = config(5L);
+        cfg.setIntegrationType(IntegrationType.API);
+        when(repository.findById(5L)).thenReturn(Optional.of(cfg));
+        when(ownership.canManage(any(), eq(cfg), any())).thenReturn(true);
+        when(ownership.isAdmin(any())).thenReturn(false);
+
+        assertThatThrownBy(
+                        () ->
+                                service.update(
+                                        5L,
+                                        request(IntegrationType.API, OwnerScope.USER, null),
+                                        user(7)))
+                .isInstanceOf(ResponseStatusException.class)
+                .extracting(e -> ((ResponseStatusException) e).getStatusCode())
+                .isEqualTo(HttpStatus.FORBIDDEN);
+    }
+
+    @Test
+    void customApiAuthoringIsOnByDefaultForAdmins() {
+        when(ownership.isAdmin(any())).thenReturn(true);
+
+        assertThat(service.canAuthorCustomApi(user(7))).isTrue();
     }
 
     @Test
@@ -112,9 +202,9 @@ class IntegrationConfigServiceTest {
         User user = user(7);
 
         IntegrationConfig created =
-                service.create(request(IntegrationType.API, OwnerScope.USER, null), user);
+                service.create(request(IntegrationType.MCP, OwnerScope.USER, null), user);
 
-        assertThat(created.getIntegrationType()).isEqualTo(IntegrationType.API);
+        assertThat(created.getIntegrationType()).isEqualTo(IntegrationType.MCP);
         assertThat(created.getName()).isEqualTo("name");
         verify(ownership)
                 .assignOwnership(eq(created), eq(OwnerScope.USER), isNull(), eq(user), any());
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyValidatorTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyValidatorTest.java
index 21a9f3e42e..2e9613a024 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyValidatorTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyValidatorTest.java
@@ -35,6 +35,7 @@ class PolicyValidatorTest {
     @Mock private PolicyTrigger trigger;
     @Mock private InputSource inputSource;
     @Mock private PolicyOutputSink outputSink;
+    @Mock private PipelineStepValidator stepValidator;
 
     private final SourceStore sourceStore = new InProcessSourceStore();
     private PolicyValidator validator;
@@ -43,7 +44,11 @@ class PolicyValidatorTest {
     void setUp() {
         validator =
                 new PolicyValidator(
-                        List.of(trigger), List.of(inputSource), List.of(outputSink), sourceStore);
+                        List.of(trigger),
+                        List.of(inputSource),
+                        List.of(outputSink),
+                        List.of(stepValidator),
+                        sourceStore);
     }
 
     @Test
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 6cf87f4252..e3c636b49e 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -4775,13 +4775,13 @@ hint = "Upload a PNG, JPG, SVG, or other image file to place on the PDF. SVG fil
 label = "Upload Image"
 placeholder = "Select image file"
 
-[imageToPdf]
-tags = "conversion,img,jpg,picture,photo"
-
 [imageToPDF]
 header = "Image to PDF"
 title = "Image to PDF"
 
+[imageToPdf]
+tags = "conversion,img,jpg,picture,photo"
+
 [infoBanner]
 dismiss = "Dismiss"
 
@@ -6499,33 +6499,297 @@ beta = "Beta"
 ga = "GA"
 
 [portal.connections]
-createTitle = "New S3 connection"
+createTitle = "New connection"
+createTitleFor = "Connect {{name}}"
 delete = "Delete"
 edit = "Edit"
-editTitle = "Edit S3 connection"
-subtitle = "Reusable S3 credentials that sources and pipeline outputs connect to."
+editTitle = "Edit connection"
+subtitle = "Reusable credentials that sources, pipeline outputs and integration steps connect to."
+unsupportedType = "This connection type cannot be edited here."
 
 [portal.connections.actions]
 new = "New connection"
 
+[portal.connections.categories.advanced]
+description = "For a service we do not support yet."
+label = "Advanced"
+
+[portal.connections.categories.audit]
+description = "Record what happened to a document, where your auditors already look."
+label = "Audit & compliance logging"
+
+[portal.connections.categories.notify]
+description = "Tell another system that something happened."
+label = "Notify & workflow"
+
+[portal.connections.categories.security]
+description = "Scan or label a document before it moves on."
+label = "Security & classification"
+
+[portal.connections.categories.signing]
+description = "Send a document out to be signed or notarized."
+label = "E-signature & notarization"
+
+[portal.connections.categories.storage]
+description = "Where processed documents end up - a bucket, a drive, a ticket or a page."
+label = "File & attach"
+
+[portal.connections.commonFields.accessToken]
+helperText = "Stirling stores this encrypted and never shows it again."
+label = "Access token"
+
+[portal.connections.commonFields.apiKey]
+label = "API key"
+
+[portal.connections.commonFields.apiToken]
+label = "API token"
+
+[portal.connections.commonFields.baseUrl]
+helperText = "Steps using this connection can only call paths under this URL, never another host."
+label = "Server URL"
+
+[portal.connections.commonFields.email]
+label = "Email"
+
+[portal.connections.commonFields.password]
+label = "Password"
+
+[portal.connections.commonFields.username]
+label = "Username"
+
+[portal.connections.commonFields.webhookUrl]
+helperText = "Paste the URL the service gave you. Only paths under it can be called."
+label = "Webhook URL"
+
 [portal.connections.empty]
-description = "Add an S3 connection to reuse the same bucket and credentials across sources and pipeline outputs."
+description = "Add a connection to reuse the same credentials across sources, pipeline outputs and integration steps."
 title = "No connections yet"
 
+[portal.connections.fields]
+name = "Connection name"
+namePlaceholder = "e.g. Claims bucket"
+
 [portal.connections.picker]
 cancel = "Cancel"
 createNew = "New connection..."
 placeholder = "Select a connection"
 save = "Save connection"
 
-[portal.connections.s3.fields]
-name = "Connection name"
-namePlaceholder = "e.g. Claims bucket"
+[portal.connections.picker2]
+back = "Change integration"
+heading = "What do you want to connect?"
+noResultsBody = "We do not support it yet - tell us about it and we will look at adding it."
+noResultsTitle = "Nothing matches \"{{query}}\""
+searchPlaceholder = "Search integrations - try \"sign\", \"ocr\" or a product name"
 
 [portal.connections.table]
-bucket = "Bucket"
+detail = "Details"
 name = "Name"
-region = "Region"
+type = "Type"
+
+[portal.connections.types.api]
+description = "Call any HTTP API from a policy. You choose the URL, authentication and payload."
+label = "Custom API"
+
+[portal.connections.types.api.fields.authType]
+label = "Authentication"
+
+[portal.connections.types.api.fields.authType.options.basic]
+label = "Username and password"
+
+[portal.connections.types.api.fields.authType.options.bearer]
+label = "Bearer token"
+
+[portal.connections.types.api.fields.authType.options.header]
+label = "Token in a custom header"
+
+[portal.connections.types.api.fields.authType.options.none]
+label = "None"
+
+[portal.connections.types.api.fields.authType.options.tokenLogin]
+label = "Log in for a token"
+
+[portal.connections.types.api.fields.baseUrl]
+helperText = "Steps using this connection can only call paths under this URL, never another host."
+label = "Base URL"
+placeholder = "https://api.example.com/v1"
+
+[portal.connections.types.api.fields.headerName]
+label = "Header name"
+placeholder = "X-API-Key"
+
+[portal.connections.types.api.fields.loginPath]
+label = "Login path"
+placeholder = "/auth/login"
+
+[portal.connections.types.api.fields.password]
+label = "Password"
+
+[portal.connections.types.api.fields.resultUrlHosts]
+helperText = "If the API replies with a download link, only these hosts may be fetched. Separate with commas. Leave blank to allow only the base URL's own host."
+label = "Allowed result hosts"
+
+[portal.connections.types.api.fields.token]
+label = "Token"
+
+[portal.connections.types.api.fields.tokenHeaderName]
+label = "Send the token as this header"
+
+[portal.connections.types.api.fields.tokenResponseHeader]
+helperText = "The response header the login call returns the token in, e.g. X-Auth-Token."
+label = "Token response header"
+
+[portal.connections.types.api.fields.username]
+label = "Username"
+
+[portal.connections.types.clamav]
+baseUrlPlaceholder = "http://clamav-rest:9000"
+description = "Scan documents for malware on a server you run - nothing leaves your network."
+label = "ClamAV (self-hosted)"
+
+[portal.connections.types.cloudmersive]
+description = "Virus and content scanning for documents in a policy."
+label = "Cloudmersive"
+
+[portal.connections.types.cloudmersiveadvanced]
+description = "Block documents containing macros, executables, scripts or embedded objects - not just known malware."
+label = "Cloudmersive Advanced Scan"
+
+[portal.connections.types.confluence]
+baseUrlPlaceholder = "https://your-site.atlassian.net/wiki/api/v2"
+description = "Attach processed documents to a Confluence page."
+label = "Confluence"
+
+[portal.connections.types.consigno]
+description = "Send documents to ConsignO Cloud (Notarius) for electronic signature and notarization."
+label = "ConsignO Cloud"
+
+[portal.connections.types.consigno.fields.baseUrl]
+helperText = "Your ConsignO Cloud environment, including /api/v1."
+label = "Server URL"
+placeholder = "https://your-org.consignocloud.com/api/v1"
+
+[portal.connections.types.consigno.fields.clientId]
+label = "API key"
+
+[portal.connections.types.consigno.fields.clientSecret]
+label = "API secret"
+
+[portal.connections.types.consigno.fields.password]
+label = "Password"
+
+[portal.connections.types.consigno.fields.tenantId]
+helperText = "Only needed if your organisation uses tenants."
+label = "Tenant"
+
+[portal.connections.types.consigno.fields.username]
+label = "Username"
+
+[portal.connections.types.discord]
+baseUrlPlaceholder = "https://discord.com/api/webhooks/..."
+description = "Post a message to Discord when a policy processes a document."
+label = "Discord"
+
+[portal.connections.types.elastic]
+baseUrlPlaceholder = "https://your-cluster:9200"
+description = "Index an audit event in Elasticsearch each time a policy handles a document."
+label = "Elasticsearch"
+
+[portal.connections.types.googlechat]
+baseUrlPlaceholder = "https://chat.googleapis.com/v1/spaces/..."
+description = "Post a message to a Google Chat space when a policy runs."
+label = "Google Chat"
+
+[portal.connections.types.jira]
+baseUrlPlaceholder = "https://your-site.atlassian.net"
+description = "Attach processed documents to a Jira issue."
+label = "Jira"
+
+[portal.connections.types.mailgun]
+description = "Email a document or a notification when a policy runs."
+label = "Mailgun"
+
+[portal.connections.types.nextcloud]
+baseUrlPlaceholder = "https://your-server/remote.php/dav"
+description = "File processed documents into Nextcloud."
+label = "Nextcloud"
+
+[portal.connections.types.nextcloud.fields.appPassword]
+label = "App password"
+
+[portal.connections.types.presidio]
+baseUrlPlaceholder = "http://presidio-analyzer:3000"
+description = "Detect personal data in document text using a Presidio server you run."
+label = "Presidio (self-hosted)"
+
+[portal.connections.types.purview]
+description = "Read and apply Microsoft Purview sensitivity labels on PDFs."
+label = "Microsoft Purview"
+
+[portal.connections.types.purview.fields.clientId]
+helperText = "Optional. Only needed to pick labels by name; labelling works without it."
+label = "Application (client) ID"
+
+[portal.connections.types.purview.fields.clientSecret]
+label = "Client secret"
+
+[portal.connections.types.purview.fields.tenantId]
+helperText = "Stamped onto every label as its SiteId, so Purview-aware tools know which organisation applied it."
+label = "Directory (tenant) ID"
+placeholder = "cb46c030-1825-4e81-a295-151c039dbf02"
+
+[portal.connections.types.s3]
+description = "An S3 bucket that sources can read from and pipeline outputs can write to."
+label = "S3 storage"
+
+[portal.connections.types.s3.fields.accessKeyId]
+label = "Access key ID"
+
+[portal.connections.types.s3.fields.bucket]
+label = "Bucket"
+
+[portal.connections.types.s3.fields.endpoint]
+helperText = "Leave blank for AWS. Set this for MinIO or another S3-compatible store."
+label = "Endpoint"
+
+[portal.connections.types.s3.fields.region]
+label = "Region"
+
+[portal.connections.types.s3.fields.secretAccessKey]
+label = "Secret access key"
+
+[portal.connections.types.sendgrid]
+description = "Email a document or a notification when a policy runs."
+label = "SendGrid"
+
+[portal.connections.types.slack]
+description = "Post a message to Slack when a policy processes a document."
+label = "Slack"
+
+[portal.connections.types.splunk]
+baseUrlPlaceholder = "https://your-splunk:8088"
+description = "Send an audit event to Splunk each time a policy handles a document."
+label = "Splunk"
+
+[portal.connections.types.sumologic]
+baseUrlPlaceholder = "https://endpoint.collection.sumologic.com/receiver/v1/http/..."
+description = "Send an audit event to a Sumo Logic HTTP collector."
+label = "Sumo Logic"
+
+[portal.connections.types.teams]
+baseUrlPlaceholder = "https://your-org.webhook.office.com/webhookb2/..."
+description = "Post a message to a Teams channel when a policy runs."
+label = "Microsoft Teams"
+
+[portal.connections.types.webhook]
+baseUrlPlaceholder = "https://example.com/hooks/documents"
+description = "Post each document, or just the details, to a URL you choose."
+label = "Webhook"
+
+[portal.connections.types.zapier]
+baseUrlPlaceholder = "https://hooks.zapier.com/hooks/catch/..."
+description = "Trigger a Zap or Make scenario from a policy."
+label = "Zapier & Make"
 
 [portal.docs]
 browse = "Browse docs"
@@ -7300,6 +7564,8 @@ newPipeline = "New pipeline"
 [portal.pipelines.builder]
 addStep = "Add tool"
 back = "Back to pipelines"
+chooseAccount = "Choose an account"
+chooseOperation = "Choose what this step does"
 discard = "Discard changes"
 enabled = "Enabled"
 keepEditing = "Keep editing"
@@ -7309,6 +7575,8 @@ pipelineSettings = "Pipeline settings"
 searchTools = "Search tools"
 selectToolBody = "Add a tool to build your pipeline."
 selectToolTitle = "No tools yet"
+sendToSystem = "Send to another system"
+stepsNeedSetup = "These steps still need an operation and an account chosen before saving: {{tools}}."
 toolSettings = "Tool settings"
 unknownStep = "Unrecognized operation, kept as-is."
 unsavedBody = "You have unsaved changes. Save them before leaving, or discard them?"
@@ -7474,6 +7742,29 @@ minConfidence = "Min confidence"
 2 = "Name"
 3 = "Normalize"
 
+[portal.policies.config.purview]
+label = "Apply a Microsoft Purview sensitivity label"
+
+[portal.policies.config.purview.fields]
+connection = "Purview tenant"
+labelId = "Label ID"
+labelIdHelp = "The label's GUID, from the Purview portal. Applying a label writes its metadata onto the PDF; it cannot encrypt, which needs the Microsoft client."
+labelName = "Label name (optional)"
+labelNameHelp = "Recorded alongside the ID so people and tools can recognise the label."
+
+[portal.policies.config.purview.fields.method]
+help = "Purview distinguishes a label a policy applied from one a person chose."
+label = "How the label is recorded"
+privileged = "As chosen by a person"
+standard = "As applied automatically"
+
+[portal.policies.config.purviewRead]
+label = "Read a Microsoft Purview label"
+
+[portal.policies.config.purviewRead.fields]
+connection = "Purview tenant"
+connectionHelp = "Reads the label the document already carries, so later steps can act on it."
+
 [portal.policies.config.retention]
 summary = "Enforces how long documents are kept, when to archive, and when to delete."
 
@@ -7552,6 +7843,183 @@ description = "Your policies are saved and will appear once the connection is re
 retry = "Retry"
 title = "Backend unavailable"
 
+[portal.policies.operations]
+change = "Change what this step does"
+noResults = "No step matches that. Try a product name, or \"scan\", \"notify\", \"attach\"."
+searchPlaceholder = "Search steps - try \"scan\", \"attach\" or a product name"
+
+[portal.policies.operations.bodyMode]
+binary = "Raw file bytes"
+json = "Inside a JSON payload"
+multipart = "As a file upload (multipart)"
+
+[portal.policies.operations.clamavScan]
+description = "Your own ClamAV server checks the document; nothing leaves your network."
+label = "Scan for viruses (self-hosted)"
+
+[portal.policies.operations.cloudmersiveAdvancedScan]
+description = "Rejects documents carrying macros, executables, scripts or embedded objects."
+label = "Block active content"
+
+[portal.policies.operations.cloudmersiveScan]
+description = "Cloudmersive checks the document and the run stops if it is not clean."
+label = "Scan for viruses"
+
+[portal.policies.operations.confluenceAttach]
+description = "Files the processed document onto a page."
+label = "Attach to a Confluence page"
+
+[portal.policies.operations.consignoSubmit]
+description = "Submits the document to ConsignO Cloud for signing."
+label = "Send for signature (ConsignO)"
+note = "Submits the document. Retrieving the signed copy is not yet supported, because a step cannot pass a result to a later step."
+
+[portal.policies.operations.customApiCall]
+description = "Author the call yourself: path, method, body and response handling."
+label = "Call a custom API"
+
+[portal.policies.operations.discordNotify]
+description = "Tells a channel that the policy handled a document."
+label = "Post a message to Discord"
+
+[portal.policies.operations.elasticIndex]
+description = "Records what the policy did as a searchable document."
+label = "Index an audit event in Elasticsearch"
+
+[portal.policies.operations.fields.bodyMode]
+helperText = "Multipart suits upload APIs; JSON suits APIs that want the file inside a payload; binary sends the raw bytes."
+label = "How to send the document"
+
+[portal.policies.operations.fields.bodyTemplate]
+helperText = "A JSON body sent as-is. {{document.base64}} carries the file; {{document.*}} and {{run.*}} are filled in per document."
+label = "JSON body"
+
+[portal.policies.operations.fields.connection]
+label = "Account"
+
+[portal.policies.operations.fields.domain]
+label = "Mailgun domain"
+placeholder = "mg.acme.com"
+
+[portal.policies.operations.fields.fileFieldName]
+helperText = "The form field the API expects the document under."
+label = "File field name"
+placeholder = "file"
+
+[portal.policies.operations.fields.from]
+label = "From"
+placeholder = "processor@acme.com"
+
+[portal.policies.operations.fields.headers]
+helperText = "A JSON object of header name/value pairs. The connection's credential is added for you."
+label = "Headers"
+
+[portal.policies.operations.fields.index]
+label = "Index"
+placeholder = "stirling-audit"
+
+[portal.policies.operations.fields.issueKey]
+label = "Issue key"
+placeholder = "OPS-42"
+
+[portal.policies.operations.fields.message]
+helperText = "Sent as the message body. {{document.*}} and {{run.*}} are filled in per document."
+label = "Message"
+
+[portal.policies.operations.fields.method]
+label = "Method"
+
+[portal.policies.operations.fields.pageId]
+label = "Page ID"
+placeholder = "66186"
+
+[portal.policies.operations.fields.path]
+helperText = "Appended to the connection's base URL. It can never reach another host."
+label = "Path"
+placeholder = "/v1/scan"
+
+[portal.policies.operations.fields.remotePath]
+helperText = "Where in the drive to write it. {{document.filename}} is filled in per document."
+label = "Destination path"
+placeholder = "Processed/{{document.filename}}"
+
+[portal.policies.operations.fields.responseMode]
+helperText = "Report leaves the document untouched. Replace swaps it for whatever comes back."
+label = "What to do with the reply"
+
+[portal.policies.operations.fields.signerEmail]
+label = "Signer's email"
+placeholder = "signer@acme.com"
+
+[portal.policies.operations.fields.subject]
+label = "Subject"
+placeholder = "Processed: {{document.filename}}"
+
+[portal.policies.operations.fields.text]
+helperText = "Presidio analyses this text. Use {{document.title}} or paste the text you want checked."
+label = "Text to check"
+
+[portal.policies.operations.fields.to]
+label = "To"
+placeholder = "records@acme.com"
+
+[portal.policies.operations.fields.username]
+label = "Nextcloud username"
+placeholder = "svc-stirling"
+
+[portal.policies.operations.googlechatNotify]
+description = "Tells a space that the policy handled a document."
+label = "Post a message to Google Chat"
+
+[portal.policies.operations.jiraAttach]
+description = "Files the processed document onto an issue."
+label = "Attach to a Jira issue"
+
+[portal.policies.operations.mailgunEmail]
+description = "Sends the processed document as an attachment."
+label = "Email the document (Mailgun)"
+
+[portal.policies.operations.nextcloudUpload]
+description = "Writes the processed document into a folder."
+label = "Upload to Nextcloud"
+
+[portal.policies.operations.presidioAnalyze]
+description = "Your own Presidio server reports the personal data it finds."
+label = "Detect personal data"
+note = "Presidio reads text, not files. Give it the text you want checked — the document itself is not uploaded."
+
+[portal.policies.operations.responseMode]
+replace = "Replace the document with the reply"
+report = "Keep the document, record the reply"
+
+[portal.policies.operations.sendgridEmail]
+description = "Sends the processed document as an attachment."
+label = "Email the document (SendGrid)"
+
+[portal.policies.operations.slackNotify]
+description = "Tells a channel that the policy handled a document."
+label = "Post a message to Slack"
+
+[portal.policies.operations.splunkEvent]
+description = "Records what the policy did, where your auditors already look."
+label = "Send an audit event to Splunk"
+
+[portal.policies.operations.sumologicEvent]
+description = "Records what the policy did to an HTTP collector."
+label = "Send an audit event to Sumo Logic"
+
+[portal.policies.operations.teamsNotify]
+description = "Tells a channel that the policy handled a document."
+label = "Post a message to Teams"
+
+[portal.policies.operations.webhookPost]
+description = "Sends the document itself to a URL you choose."
+label = "Post the document to a webhook"
+
+[portal.policies.operations.zapierNotify]
+description = "Hands the run's details to your automation."
+label = "Trigger a Zap or Make scenario"
+
 [portal.policies.stats]
 activeFor = "Active"
 dataProcessed = "Data processed"
@@ -8108,22 +8576,10 @@ top = "Top level only"
 description = "Pull documents from an Amazon S3 or S3-compatible bucket."
 label = "Amazon S3"
 
-[portal.sources.types.s3.fields.accessKeyId]
-label = "Access key ID"
-
-[portal.sources.types.s3.fields.bucket]
-label = "Bucket"
-placeholder = "my-company-inbox"
-
 [portal.sources.types.s3.fields.connection]
 helperText = "The stored connection holding the bucket and credentials. Reused by every source and pipeline output that references it."
 label = "Connection"
 
-[portal.sources.types.s3.fields.endpoint]
-helperText = "Leave blank for Amazon S3. Set to use an S3-compatible service such as MinIO."
-label = "Custom endpoint"
-placeholder = "https://s3.example.com"
-
 [portal.sources.types.s3.fields.mode]
 helperText = "Consume removes each object from the bucket once every policy has processed it."
 label = "Read mode"
@@ -8137,13 +8593,6 @@ helperText = "Only objects whose keys start with this prefix are processed."
 label = "Key prefix"
 placeholder = "incoming/"
 
-[portal.sources.types.s3.fields.region]
-label = "Region"
-placeholder = "us-east-1"
-
-[portal.sources.types.s3.fields.secretAccessKey]
-label = "Secret access key"
-
 [portal.sources.types.unknown]
 label = "Source"
 
@@ -8868,12 +9317,12 @@ label = "Remove XMP Metadata"
 [sanitize.steps]
 settings = "Settings"
 
-[sanitizePdf]
-tags = "clean,secure,safe,remove-threats"
-
 [sanitizePDF]
 title = "Sanitize PDF"
 
+[sanitizePdf]
+tags = "clean,secure,safe,remove-threats"
+
 [scalePages]
 tags = "resize,adjust,scale,page size,resize page,scale page,change size,adjust size,enlarge,shrink page,fit to page,A4,letter size"
 title = "Adjust page-scale"
@@ -8881,18 +9330,6 @@ title = "Adjust page-scale"
 [scannerEffect]
 tags = "scan,simulate,create,fake scan,look scanned,scanner effect,make look scanned,photocopy effect,simulate scanner,realistic scan"
 
-[ScannerImageSplit.selectText]
-1 = "Angle Threshold:"
-10 = "Extra padding (in pixels) around each saved photo so edges aren't cut."
-2 = "Tilt (in degrees) needed before we auto-straighten a photo."
-3 = "Tolerance:"
-4 = "How closely a color must match the page background to count as background. Higher = looser, lower = stricter."
-5 = "Minimum Area:"
-6 = "Smallest photo size (in pixels²) we'll keep to avoid tiny fragments."
-7 = "Minimum Contour Area:"
-8 = "Smallest edge/shape we consider when finding photos (filters dust and specks)."
-9 = "Border Size:"
-
 [scannerImageSplit]
 submit = "Extract Image Scans"
 tags = "separate,auto-detect,scans,multi-photo,organize"
@@ -8924,6 +9361,18 @@ whatThisDoes = "What this does"
 whatThisDoesDesc = "Automatically finds and extracts each photo from a scanned page or composite image-no manual cropping."
 whenToUse = "When to use"
 
+[ScannerImageSplit.selectText]
+1 = "Angle Threshold:"
+10 = "Extra padding (in pixels) around each saved photo so edges aren't cut."
+2 = "Tilt (in degrees) needed before we auto-straighten a photo."
+3 = "Tolerance:"
+4 = "How closely a color must match the page background to count as background. Higher = looser, lower = stricter."
+5 = "Minimum Area:"
+6 = "Smallest photo size (in pixels²) we'll keep to avoid tiny fragments."
+7 = "Minimum Contour Area:"
+8 = "Smallest edge/shape we consider when finding photos (filters dust and specks)."
+9 = "Border Size:"
+
 [search]
 noResults = "No results found"
 placeholder = "Enter search term..."
diff --git a/frontend/editor/src/core/i18n/translationAudit.ts b/frontend/editor/src/core/i18n/translationAudit.ts
index 79fee63a7c..9e4e57a8a5 100644
--- a/frontend/editor/src/core/i18n/translationAudit.ts
+++ b/frontend/editor/src/core/i18n/translationAudit.ts
@@ -89,6 +89,10 @@ export const I18N_PROJECTS: TranslationProject[] = [
       // components/sources/sourceTypes.ts (t(field.labelKey)), invisible to the
       // static scan.
       /^portal\.sources\.types\./,
+      // The connection catalogue (connectionTypes.ts) mirrors source types: every key is
+      // t(`${PREFIX}.${id}.label`) / t(`${COMMON}.${field}.label`) with multi-segment const
+      // prefixes, so the whole family is matched here rather than by the shape heuristic.
+      /^portal\.connections\.(types|commonFields)\./,
       // Portal catalogue copy stored as i18n keys in api/<surface>.ts constants
       // (label maps, role/policy/journey catalogues) and rendered via
       // t(constant), invisible to the static scan.
@@ -99,6 +103,11 @@ export const I18N_PROJECTS: TranslationProject[] = [
       /^portal\.procurement\.journeySteps\./,
       /^portal\.users\.roles\./,
       /^portal\.policies\.(categories|config|endpoints)\./,
+      // The integration operations catalogue (stepOperations.ts) assembles every key as
+      // t(`${PREFIX}.${id}.label`) where PREFIX is the multi-segment const
+      // "portal.policies.operations" - the shape heuristic treats that interpolation as one
+      // segment, so this whole catalogue-driven family is matched here instead.
+      /^portal\.policies\.operations\./,
       // Policy field labels + option display copy are looked up with keys
       // derived from catalogue data (t(`policies.field.${key}`),
       // t(`policyOption.${id}`)) in the PolicyFieldRows and setup wizards —
diff --git a/frontend/editor/src/core/theme/colors.css b/frontend/editor/src/core/theme/colors.css
index ba0e5466f5..ced2c5dcb6 100644
--- a/frontend/editor/src/core/theme/colors.css
+++ b/frontend/editor/src/core/theme/colors.css
@@ -73,6 +73,13 @@ html[data-app-theme="light"] {
   --c-avatar-5: var(--p-amber-500);
   --c-avatar-6: var(--p-cyan-500);
 
+  /* Connection picker: muted categorical marks + brand-red accent. */
+  --c-conn-accent: var(--p-art-red-muted);
+  --c-conn-storage: var(--p-art-blue-muted);
+  --c-conn-signing: var(--p-art-green-muted);
+  --c-conn-notify: var(--p-art-amber-muted);
+  --c-conn-neutral: var(--p-gray-mid);
+
   /* Always-dark marketing/product hero strip (portal). Same in both themes. */
   --c-hero-dark: var(--p-zinc-950);
   --c-hero-dark-cta-text: var(--p-navy-700);
diff --git a/frontend/editor/src/core/theme/primitives.css b/frontend/editor/src/core/theme/primitives.css
index 22716816a2..6ea844e9ed 100644
--- a/frontend/editor/src/core/theme/primitives.css
+++ b/frontend/editor/src/core/theme/primitives.css
@@ -147,6 +147,10 @@
   --p-c-acacac: #acacac;
   --p-c-c084fc: #c084fc;
   --p-art-red-muted: #c56565;
+  /* Muted category hues for connection-picker marks. */
+  --p-art-blue-muted: #4a7ab5;
+  --p-art-green-muted: #5d8348;
+  --p-art-amber-muted: #ac7a2c;
   --p-c-cf222e: #cf222e;
   --p-c-d0d6dc: #d0d6dc;
   --p-c-d0d7de: #d0d7de;
diff --git a/frontend/editor/src/portal/api/integrations.ts b/frontend/editor/src/portal/api/integrations.ts
index 19f88fea29..01eebe96ab 100644
--- a/frontend/editor/src/portal/api/integrations.ts
+++ b/frontend/editor/src/portal/api/integrations.ts
@@ -1,12 +1,12 @@
 /**
- * Integrations service layer: stored connections (S3 today; MCP/API later) that
- * policy sources and pipeline outputs reference by id instead of embedding
+ * Integrations service layer: stored connections (S3, Purview, ConsignO, and free-form API) that
+ * policy sources, pipeline outputs and integration steps reference by id instead of embedding
  * credentials. Secrets are write-only - reads return them masked, and sending
  * the mask back on update keeps the stored value.
  */
 import { apiClient } from "@portal/api/http";
 
-export type IntegrationType = "S3" | "MCP" | "API";
+export type IntegrationType = "S3" | "MCP" | "API" | "PURVIEW" | "CONSIGNO";
 export type OwnerScope = "USER" | "TEAM" | "SERVER";
 
 /** Mirrors the backend IntegrationConfigResponse; `config` values are masked. */
@@ -47,6 +47,20 @@ export async function fetchS3Connections(): Promise<IntegrationConfig[]> {
   );
 }
 
+/**
+ * What this caller may set up. Answered by the server because the custom-API gate is an
+ * authorization decision, not a presentation one - the create call is refused regardless.
+ */
+export interface IntegrationCapabilities {
+  customApi: boolean;
+}
+
+export async function fetchIntegrationCapabilities(): Promise<IntegrationCapabilities> {
+  return apiClient.local.json<IntegrationCapabilities>(
+    "/api/v1/integrations/capabilities",
+  );
+}
+
 export async function createIntegration(
   body: IntegrationConfigRequest,
 ): Promise<IntegrationConfig> {
diff --git a/frontend/editor/src/portal/api/policies.ts b/frontend/editor/src/portal/api/policies.ts
index a26556f5a2..fb3788dc76 100644
--- a/frontend/editor/src/portal/api/policies.ts
+++ b/frontend/editor/src/portal/api/policies.ts
@@ -291,7 +291,14 @@ export const POLICY_CONFIG: Record<string, PolicyConfigDef> = {
       "portal.policies.config.compliance.rules.2",
     ],
     scopeLabel: "portal.policies.config.scopeAll",
-    defaultOperations: [policyStep("sanitize"), policyStep("flatten")],
+    // Apply writes our sensitivity label into the document after it is sanitised and flattened.
+    // Offered only once a Purview tenant is connected (it needs a tenant connection and a label
+    // GUID, which no default can guess), and hidden entirely until then.
+    defaultOperations: [
+      policyStep("sanitize"),
+      policyStep("flatten"),
+      policyStep("purviewApplyLabel"),
+    ],
     fields: [
       {
         label: "portal.policies.config.compliance.fields.frameworks",
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx
index 672383ecd3..213217de5b 100644
--- a/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx
+++ b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.tsx
@@ -7,6 +7,10 @@ import { type ToolRegistry } from "@app/data/toolsTaxonomy";
 import { type ErasedToolParams } from "@app/hooks/tools/shared/toolOperationTypes";
 import { type WorkingToolStep } from "@app/hooks/tools/shared/toolAutomation";
 
+import { PolicyExternalApiConfig } from "@portal/components/policies/PolicyExternalApiConfig";
+import { isIntegrationStep } from "@portal/components/pipelines/integrationStep";
+import type { ExternalApiStepParams } from "@portal/components/policies/stepOperations";
+
 interface PipelineStepSettingsProps {
   step: WorkingToolStep;
   registry: Partial<ToolRegistry>;
@@ -23,8 +27,21 @@ export function PipelineStepSettings({
   registry,
   onChange,
 }: PipelineStepSettingsProps) {
+  // Hooks first: selecting a different step re-renders this same instance, so an early return
+  // above useTranslation would change the hook count between renders and crash.
   const { t } = useTranslation();
 
+  // An integration step is configured by the operations catalogue, not by a tool's settings UI:
+  // it has no registry entry to look one up from.
+  if (isIntegrationStep(step)) {
+    return (
+      <PolicyExternalApiConfig
+        parameters={step.params as unknown as ExternalApiStepParams}
+        onChange={(params) => onChange(params as never)}
+      />
+    );
+  }
+
   if (step.support === "noSettings") {
     return (
       <Banner
diff --git a/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx b/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx
index e031854ec1..0c531a6874 100644
--- a/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx
+++ b/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx
@@ -7,21 +7,46 @@ import {
   type SubcategoryId,
 } from "@app/data/toolsTaxonomy";
 import { type ExecutableTool } from "@app/hooks/tools/shared/toolAutomation";
+import {
+  searchOperations,
+  type StepOperation,
+} from "@portal/components/policies/stepOperations";
 
 interface ToolPickerProps {
   tools: ExecutableTool[];
   onPick: (tool: ExecutableTool) => void;
   onClose: () => void;
+  /**
+   * Catalogue operations that hand the document to an outside system. Kept apart from the tool
+   * groups because they are a different species - a tool transforms the document in place, these
+   * call somebody else - and grouping them under a tool subcategory would bury that.
+   */
+  operations?: StepOperation[];
+  onPickOperation?: (operation: StepOperation) => void;
 }
 
 /**
  * Type-to-filter, category-grouped tool picker for adding a step to a pipeline. Replaces the flat
  * wall of tool pills so the list stays usable as the tool count grows.
  */
-export function ToolPicker({ tools, onPick, onClose }: ToolPickerProps) {
+export function ToolPicker({
+  tools,
+  onPick,
+  onClose,
+  operations = [],
+  onPickOperation,
+}: ToolPickerProps) {
   const { t } = useTranslation();
   const [query, setQuery] = useState("");
 
+  const matchedOperations = useMemo(
+    () =>
+      onPickOperation
+        ? searchOperations(operations, query, (key) => t(key))
+        : [],
+    [operations, onPickOperation, query, t],
+  );
+
   const groups = useMemo(() => {
     const q = query.trim().toLowerCase();
     const matched = q
@@ -58,7 +83,7 @@ export function ToolPicker({ tools, onPick, onClose }: ToolPickerProps) {
         />
       </div>
       <div className="portal-pipelines__picker-list">
-        {groups.length === 0 ? (
+        {groups.length === 0 && matchedOperations.length === 0 ? (
           <p className="portal-pipelines__picker-empty">
             {t("portal.pipelines.builder.noToolMatches")}
           </p>
@@ -93,6 +118,36 @@ export function ToolPicker({ tools, onPick, onClose }: ToolPickerProps) {
             </div>
           ))
         )}
+
+        {matchedOperations.length > 0 && onPickOperation ? (
+          <div className="portal-pipelines__picker-group">
+            <div className="portal-pipelines__picker-group-label">
+              {t("portal.pipelines.builder.sendToSystem")}
+            </div>
+            {matchedOperations.map((op) => (
+              <Button
+                key={op.id}
+                variant="quiet"
+                justify="start"
+                fullWidth
+                className="portal-pipelines__picker-item"
+                onClick={() => onPickOperation(op)}
+                leftSection={
+                  <span
+                    className="portal-pipelines__picker-icon"
+                    aria-hidden="true"
+                  >
+                    {t(op.labelKey).slice(0, 1)}
+                  </span>
+                }
+              >
+                <span className="portal-pipelines__picker-name">
+                  {t(op.labelKey)}
+                </span>
+              </Button>
+            ))}
+          </div>
+        ) : null}
       </div>
     </div>
   );
diff --git a/frontend/editor/src/portal/components/pipelines/integrationStep.test.ts b/frontend/editor/src/portal/components/pipelines/integrationStep.test.ts
new file mode 100644
index 0000000000..e8ea993088
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/integrationStep.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  INTEGRATION_ENDPOINT,
+  integrationStepConfigured,
+  isIntegrationStep,
+  newIntegrationStep,
+  stepOperation,
+} from "@portal/components/pipelines/integrationStep";
+import {
+  buildStepParameters,
+  operationById,
+} from "@portal/components/policies/stepOperations";
+import {
+  serializeToolStep,
+  type WorkingToolStep,
+} from "@app/hooks/tools/shared/toolAutomation";
+
+describe("integration steps in a pipeline", () => {
+  it("creates a step the backend will dispatch generically", () => {
+    const step = newIntegrationStep(operationById("discordNotify")!);
+
+    expect(step.toolId).toBeNull();
+    expect(step.operation).toBe(INTEGRATION_ENDPOINT);
+    expect(isIntegrationStep(step)).toBe(true);
+  });
+
+  it("survives serialisation verbatim, so the saved pipeline keeps its config", () => {
+    // toolId null takes serializeToolStep's unmapped path; if that ever changed, an integration
+    // step would be rewritten on save and silently lose its parameters.
+    const op = operationById("jiraAttach")!;
+    const step = newIntegrationStep(op);
+    // Configure it the way the inspector does: rebuild from the catalogue with real answers.
+    step.params = buildStepParameters(op, "12", {
+      issueKey: "OPS-42",
+    }) as never;
+
+    const wire = serializeToolStep(step, {});
+
+    expect(wire.operation).toBe(INTEGRATION_ENDPOINT);
+    expect(wire.parameters.connectionId).toBe("12");
+    expect(wire.parameters.path).toBe("/rest/api/3/issue/OPS-42/attachments");
+    expect(JSON.parse(wire.parameters.headers as string)).toEqual({
+      "X-Atlassian-Token": "no-check",
+    });
+  });
+
+  it("leaves an unfilled field blank rather than shipping the placeholder", () => {
+    // A freshly added step is deliberately unconfigured. What matters is that {{issueKey}} does
+    // not survive into the wire call, where Jira would receive it as a literal path segment.
+    const step = newIntegrationStep(operationById("jiraAttach")!);
+    expect(step.params.path).not.toContain("{{");
+    expect(integrationStepConfigured(step)).toBe(false);
+  });
+
+  it("remembers which operation it is, so the builder can name and edit it", () => {
+    const step = newIntegrationStep(operationById("splunkEvent")!);
+    expect(stepOperation(step)?.id).toBe("splunkEvent");
+  });
+
+  it("is not configured until an account is chosen", () => {
+    const step = newIntegrationStep(operationById("clamavScan")!);
+    // Created deliberately blank so the operator sees it in the chain and fills it in.
+    expect(integrationStepConfigured(step)).toBe(false);
+
+    (step.params as Record<string, unknown>).connectionId = "4";
+    expect(integrationStepConfigured(step)).toBe(true);
+  });
+
+  it("leaves ordinary tool steps alone", () => {
+    const toolStep = {
+      toolId: "compress",
+      operation: "/api/v1/misc/compress-pdf",
+      params: {},
+      support: "supported",
+    } as unknown as WorkingToolStep;
+    expect(isIntegrationStep(toolStep)).toBe(false);
+    expect(stepOperation(toolStep)).toBeUndefined();
+    expect(integrationStepConfigured(toolStep)).toBe(true);
+  });
+});
diff --git a/frontend/editor/src/portal/components/pipelines/integrationStep.ts b/frontend/editor/src/portal/components/pipelines/integrationStep.ts
new file mode 100644
index 0000000000..93754ccefb
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/integrationStep.ts
@@ -0,0 +1,62 @@
+/**
+ * Integration operations as pipeline steps.
+ *
+ * A pipeline step is an endpoint path plus parameters, and the engine dispatches it generically —
+ * so an integration operation is already a legal step. What it lacked was a way to *pick* one and
+ * *configure* it in the builder, whose picker is fed by the editor's tool registry and does not
+ * know about them.
+ *
+ * These steps deliberately stay `toolId: null`. They are not registry tools, and pretending
+ * otherwise would mean inventing a fake tool id that `serializeToolStep` would then try to resolve
+ * an endpoint from. The unmapped path already round-trips a step verbatim, which is exactly the
+ * behaviour wanted here; the only thing added is that the builder can now recognise and edit them
+ * rather than showing them as an opaque "unknown step".
+ */
+
+import type { ErasedToolParams } from "@app/hooks/tools/shared/toolOperationTypes";
+import type { WorkingToolStep } from "@app/hooks/tools/shared/toolAutomation";
+import {
+  buildStepParameters,
+  emptyOperationValues,
+  operationById,
+  type StepOperation,
+} from "@portal/components/policies/stepOperations";
+
+/** The one endpoint every catalogue operation dispatches through. */
+export const INTEGRATION_ENDPOINT = "/api/v1/integration/external-api-call";
+
+export function isIntegrationStep(step: WorkingToolStep): boolean {
+  return step.toolId === null && step.operation === INTEGRATION_ENDPOINT;
+}
+
+/** A new pipeline step for a chosen operation, seeded with the catalogue's defaults. */
+export function newIntegrationStep(op: StepOperation): WorkingToolStep {
+  const values = emptyOperationValues(op);
+  return {
+    toolId: null,
+    operation: INTEGRATION_ENDPOINT,
+    // Connection is chosen in the inspector; the step is created unconfigured on purpose so the
+    // operator sees it in the chain and fills it in, rather than the picker blocking on a modal.
+    params: buildStepParameters(op, "", values) as unknown as ErasedToolParams,
+    support: "unknown",
+  };
+}
+
+/**
+ * The operation a step was built from, or undefined if it predates the catalogue (a pipeline
+ * authored through the API can name the endpoint without an operationId).
+ */
+export function stepOperation(
+  step: WorkingToolStep,
+): StepOperation | undefined {
+  if (!isIntegrationStep(step)) return undefined;
+  const id = (step.params as Record<string, unknown>).operationId;
+  return typeof id === "string" && id ? operationById(id) : undefined;
+}
+
+/** True once the step can actually run: an operation chosen and an account selected. */
+export function integrationStepConfigured(step: WorkingToolStep): boolean {
+  if (!isIntegrationStep(step)) return true;
+  const params = step.params as Record<string, unknown>;
+  return Boolean(params.operationId) && Boolean(params.connectionId);
+}
diff --git a/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.test.tsx b/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.test.tsx
new file mode 100644
index 0000000000..7f1c232429
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.test.tsx
@@ -0,0 +1,81 @@
+import { useState } from "react";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+
+import { PolicyExternalApiConfig } from "@portal/components/policies/PolicyExternalApiConfig";
+import {
+  buildStepParameters,
+  operationById,
+  type ExternalApiStepParams,
+} from "@portal/components/policies/stepOperations";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: MantineProvider });
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+vi.mock("@portal/api/integrations", () => ({
+  fetchIntegrations: () => Promise.resolve([]),
+  fetchIntegrationCapabilities: () => Promise.resolve({ customApi: false }),
+  createIntegration: vi.fn(),
+  updateIntegration: vi.fn(),
+}));
+
+vi.mock("@portal/api/http", () => ({
+  errorMessage: (e: unknown) => String(e),
+}));
+
+// A stateful host so the controlled component behaves as it does in the builder, and the test can
+// read the parameters after each change.
+let latest: ExternalApiStepParams;
+function Harness({ initial }: { initial: ExternalApiStepParams }) {
+  const [params, setParams] = useState(initial);
+  latest = params;
+  return (
+    <PolicyExternalApiConfig
+      parameters={params}
+      onChange={(p) => {
+        latest = p;
+        setParams(p);
+      }}
+    />
+  );
+}
+
+describe("switching an operation's vendor", () => {
+  beforeEach(() => {
+    latest = undefined as unknown as ExternalApiStepParams;
+  });
+
+  it("drops the account, so a Slack webhook is never carried into a Jira step", async () => {
+    const discord = buildStepParameters(operationById("discordNotify")!, "5", {
+      message: "hi",
+    });
+    render(<Harness initial={discord} />);
+
+    // Start on the Discord form with its account chosen.
+    expect(latest.operationId).toBe("discordNotify");
+    expect(latest.connectionId).toBe("5");
+
+    // Change the operation, then pick a different vendor.
+    fireEvent.click(screen.getByText("portal.policies.operations.change"));
+    fireEvent.click(
+      await screen.findByText("portal.policies.operations.jiraAttach.label"),
+    );
+
+    await waitFor(() => expect(latest.operationId).toBe("jiraAttach"));
+    // The Discord account did not ride across to the Jira step.
+    expect(latest.connectionId).toBe("");
+  });
+});
diff --git a/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx b/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx
new file mode 100644
index 0000000000..9299f26071
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx
@@ -0,0 +1,416 @@
+import { useEffect, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import SearchRoundedIcon from "@mui/icons-material/SearchRounded";
+import ArrowBackRoundedIcon from "@mui/icons-material/ArrowBackRounded";
+import { Banner, Button, FormField, Input, Select } from "@app/ui";
+import { fetchIntegrationCapabilities } from "@portal/api/integrations";
+import { ConnectionPicker } from "@portal/components/sources/ConnectionPicker";
+import {
+  CONNECTION_CATEGORIES,
+  type ConnectionCategory,
+} from "@portal/components/sources/connectionTypes";
+import {
+  STEP_OPERATIONS,
+  buildStepParameters,
+  emptyOperationValues,
+  operationById,
+  operationsByCategory,
+  searchOperations,
+  type ExternalApiStepParams,
+  type StepOperation,
+} from "@portal/components/policies/stepOperations";
+
+/**
+ * Configures a "send the document to another system" step.
+ *
+ * The step's own API takes seventeen parameters — path, body mode, file field name, response mode
+ * and so on. Asking an operator for those is asking them to have read the vendor's API docs, which
+ * is the difference between supporting a vendor and merely being able to reach it. So this screen
+ * asks two questions instead: *what do you want to do*, and *with which account*. The catalogue
+ * fills in the rest.
+ *
+ * The escape hatch stays: choosing Custom API reveals the raw call, because an operator connecting
+ * something we do not ship a template for still needs a way through.
+ */
+/**
+ * Every step parameter is a flat string (the pipeline serialises them as form fields), so the
+ * operator's answers travel JSON-encoded in `operationValues` and are decoded here.
+ */
+export type ExternalApiParams = ExternalApiStepParams;
+
+function decodeValues(raw: string | undefined): Record<string, string> {
+  if (!raw) return {};
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    return parsed && typeof parsed === "object"
+      ? (parsed as Record<string, string>)
+      : {};
+  } catch {
+    // A hand-edited or truncated value should not break the form.
+    return {};
+  }
+}
+
+interface PolicyExternalApiConfigProps {
+  parameters: ExternalApiParams;
+  onChange: (parameters: ExternalApiParams) => void;
+}
+
+export function PolicyExternalApiConfig({
+  parameters,
+  onChange,
+}: PolicyExternalApiConfigProps) {
+  const { t } = useTranslation();
+  const [query, setQuery] = useState("");
+  // Whether to OFFER the escape hatch. The server refuses it regardless of what the client
+  // believes, so this is presentation only - the same contract the connections tab uses.
+  const [allowCustom, setAllowCustom] = useState(true);
+
+  useEffect(() => {
+    fetchIntegrationCapabilities().then(
+      (c) => setAllowCustom(c.customApi !== false),
+      () => undefined,
+    );
+  }, []);
+
+  const selected = parameters.operationId
+    ? operationById(parameters.operationId)
+    : undefined;
+  const values = decodeValues(parameters.operationValues);
+
+  const available = useMemo(
+    () => STEP_OPERATIONS.filter((op) => allowCustom || !op.custom),
+    [allowCustom],
+  );
+  const matches = useMemo(
+    () => searchOperations(available, query, (key) => t(key)),
+    [available, query, t],
+  );
+  const grouped = useMemo(() => operationsByCategory(matches), [matches]);
+  const searching = query.trim() !== "";
+
+  function choose(op: StepOperation) {
+    // Picking from the grid always starts the operation fresh with no account: a Slack webhook is
+    // not a valid Jira account, and reaching the grid means the operator is choosing anew. The
+    // account chosen for a previous operation would otherwise ride along, unlisted by the vendor
+    // filter yet still saved.
+    onChange(buildStepParameters(op, "", emptyOperationValues(op)));
+  }
+
+  function setValue(key: string, value: string) {
+    if (!selected) return;
+    const next = { ...values, [key]: value };
+    onChange(
+      buildStepParameters(selected, parameters.connectionId ?? "", next),
+    );
+  }
+
+  function setConnection(id: string) {
+    if (!selected) {
+      onChange({ ...parameters, connectionId: id });
+      return;
+    }
+    onChange(buildStepParameters(selected, id, values));
+  }
+
+  // ---- step 1: pick what the step should do ---------------------------------------------------
+  if (!selected) {
+    const sections: ConnectionCategory[] = searching
+      ? []
+      : CONNECTION_CATEGORIES.filter((c) => (grouped.get(c)?.length ?? 0) > 0);
+
+    return (
+      <div className="portal-policies__capability-config">
+        <div className="portal-conn-picker__search">
+          <SearchRoundedIcon className="portal-conn-picker__search-icon" />
+          <input
+            type="search"
+            value={query}
+            onChange={(e) => setQuery(e.target.value)}
+            placeholder={t("portal.policies.operations.searchPlaceholder")}
+            aria-label={t("portal.policies.operations.searchPlaceholder")}
+          />
+        </div>
+
+        {matches.length === 0 ? (
+          <p className="portal-conn-picker__empty-body">
+            {t("portal.policies.operations.noResults")}
+          </p>
+        ) : searching ? (
+          <OperationGrid operations={matches} onPick={choose} />
+        ) : (
+          sections.map((category) => (
+            <section key={category} className="portal-conn-picker__section">
+              <h4 className="portal-conn-picker__section-title">
+                {t(`portal.connections.categories.${category}.label`)}
+              </h4>
+              <OperationGrid
+                operations={grouped.get(category) ?? []}
+                onPick={choose}
+              />
+            </section>
+          ))
+        )}
+      </div>
+    );
+  }
+
+  // ---- step 2: the two questions that remain --------------------------------------------------
+  return (
+    <div className="portal-policies__capability-config">
+      <Button
+        variant="quiet"
+        size="sm"
+        className="portal-sources__connection-back"
+        leftSection={<ArrowBackRoundedIcon fontSize="inherit" />}
+        onClick={() =>
+          onChange({
+            ...parameters,
+            operationId: "",
+            operationValues: "",
+            // Forget the account too: it belonged to this operation's vendor, and the next pick
+            // starts clean rather than carrying it to a mismatched one.
+            connectionId: "",
+          })
+        }
+      >
+        {t("portal.policies.operations.change")}
+      </Button>
+
+      <p className="portal-policies__capability-summary">
+        {t(selected.descriptionKey)}
+      </p>
+
+      {selected.noteKey && (
+        <Banner tone="warning" description={t(selected.noteKey)} />
+      )}
+
+      <FormField
+        label={t("portal.policies.operations.fields.connection.label")}
+        required
+      >
+        <ConnectionPicker
+          value={parameters.connectionId ?? ""}
+          onChange={setConnection}
+          integrationType={selected.integrationType}
+          createTypeId={selected.connectionTypeId}
+          presetId={selected.connectionTypeId}
+        />
+      </FormField>
+
+      {(selected.fields ?? []).map((field) => (
+        <FormField
+          key={field.key}
+          label={t(field.labelKey)}
+          required={field.required}
+          helperText={field.helperTextKey ? t(field.helperTextKey) : undefined}
+        >
+          {field.control === "textarea" ? (
+            <textarea
+              className="portal-sources__connection-textarea"
+              rows={3}
+              value={values[field.key] ?? ""}
+              onChange={(e) => setValue(field.key, e.target.value)}
+            />
+          ) : field.control === "select" ? (
+            <Select
+              value={values[field.key] ?? ""}
+              options={(field.options ?? []).map((o) => ({
+                value: o.value,
+                label: t(o.labelKey),
+              }))}
+              onChange={(v) => v && setValue(field.key, v)}
+            />
+          ) : (
+            <Input
+              value={values[field.key] ?? ""}
+              placeholder={
+                field.placeholderKey ? t(field.placeholderKey) : undefined
+              }
+              onChange={(e) => setValue(field.key, e.target.value)}
+            />
+          )}
+        </FormField>
+      ))}
+
+      {selected.custom && (
+        <CustomCallFields parameters={parameters} onChange={onChange} />
+      )}
+    </div>
+  );
+}
+
+function OperationGrid({
+  operations,
+  onPick,
+}: {
+  operations: StepOperation[];
+  onPick: (op: StepOperation) => void;
+}) {
+  const { t } = useTranslation();
+  return (
+    <div className="portal-conn-picker__grid">
+      {operations.map((op) => {
+        const label = t(op.labelKey);
+        return (
+          <button
+            key={op.id}
+            type="button"
+            className={
+              "portal-conn-picker__card" +
+              (op.custom ? " portal-conn-picker__card--advanced" : "")
+            }
+            onClick={() => onPick(op)}
+          >
+            <span
+              className={`portal-conn-picker__mark portal-conn-picker__mark--${op.category}`}
+              aria-hidden
+            >
+              {label.slice(0, 1)}
+            </span>
+            <span className="portal-conn-picker__card-text">
+              <span className="portal-conn-picker__card-name">{label}</span>
+              <span className="portal-conn-picker__card-desc">
+                {t(op.descriptionKey)}
+              </span>
+            </span>
+          </button>
+        );
+      })}
+    </div>
+  );
+}
+
+/**
+ * The raw call, shown only for Custom API. These are the same parameters a preset fills in
+ * silently — exposed here because there is no template to fill them.
+ */
+function CustomCallFields({
+  parameters,
+  onChange,
+}: {
+  parameters: ExternalApiParams;
+  onChange: (p: ExternalApiParams) => void;
+}) {
+  const { t } = useTranslation();
+  const set = (key: keyof ExternalApiParams, value: string) =>
+    onChange({ ...parameters, [key]: value });
+  const str = (key: keyof ExternalApiParams) => parameters[key] ?? "";
+
+  return (
+    <>
+      <FormField
+        label={t("portal.policies.operations.fields.path.label")}
+        helperText={t("portal.policies.operations.fields.path.helperText")}
+        required
+      >
+        <Input
+          value={str("path")}
+          placeholder="/v1/scan"
+          onChange={(e) => set("path", e.target.value)}
+        />
+      </FormField>
+
+      <FormField label={t("portal.policies.operations.fields.method.label")}>
+        <Select
+          value={str("method") || "POST"}
+          options={["POST", "PUT", "PATCH", "GET"].map((m) => ({
+            value: m,
+            label: m,
+          }))}
+          onChange={(v) => v && set("method", v)}
+        />
+      </FormField>
+
+      <FormField
+        label={t("portal.policies.operations.fields.bodyMode.label")}
+        helperText={t("portal.policies.operations.fields.bodyMode.helperText")}
+      >
+        <Select
+          value={str("bodyMode") || "multipart"}
+          options={[
+            {
+              value: "multipart",
+              label: t("portal.policies.operations.bodyMode.multipart"),
+            },
+            {
+              value: "json",
+              label: t("portal.policies.operations.bodyMode.json"),
+            },
+            {
+              value: "binary",
+              label: t("portal.policies.operations.bodyMode.binary"),
+            },
+          ]}
+          onChange={(v) => v && set("bodyMode", v)}
+        />
+      </FormField>
+
+      {(str("bodyMode") || "multipart") === "multipart" && (
+        <FormField
+          label={t("portal.policies.operations.fields.fileFieldName.label")}
+          helperText={t(
+            "portal.policies.operations.fields.fileFieldName.helperText",
+          )}
+        >
+          <Input
+            value={str("fileFieldName") || "file"}
+            onChange={(e) => set("fileFieldName", e.target.value)}
+          />
+        </FormField>
+      )}
+
+      <FormField
+        label={t("portal.policies.operations.fields.responseMode.label")}
+        helperText={t(
+          "portal.policies.operations.fields.responseMode.helperText",
+        )}
+      >
+        <Select
+          value={str("responseMode") || "report"}
+          options={[
+            {
+              value: "report",
+              label: t("portal.policies.operations.responseMode.report"),
+            },
+            {
+              value: "replace",
+              label: t("portal.policies.operations.responseMode.replace"),
+            },
+          ]}
+          onChange={(v) => v && set("responseMode", v)}
+        />
+      </FormField>
+
+      <FormField
+        label={t("portal.policies.operations.fields.headers.label")}
+        helperText={t("portal.policies.operations.fields.headers.helperText")}
+      >
+        <textarea
+          className="portal-sources__connection-textarea"
+          rows={2}
+          value={str("headers")}
+          placeholder='{"X-Api-Version": "2"}'
+          onChange={(e) => set("headers", e.target.value)}
+        />
+      </FormField>
+
+      {(str("bodyMode") || "multipart") === "json" && (
+        <FormField
+          label={t("portal.policies.operations.fields.bodyTemplate.label")}
+          helperText={t(
+            "portal.policies.operations.fields.bodyTemplate.helperText",
+          )}
+        >
+          <textarea
+            className="portal-sources__connection-textarea"
+            rows={4}
+            value={str("bodyTemplate")}
+            placeholder='{"file": "{{document.base64}}"}'
+            onChange={(e) => set("bodyTemplate", e.target.value)}
+          />
+        </FormField>
+      )}
+    </>
+  );
+}
diff --git a/frontend/editor/src/portal/components/policies/PolicyPurviewConfig.tsx b/frontend/editor/src/portal/components/policies/PolicyPurviewConfig.tsx
new file mode 100644
index 0000000000..685fa49ffb
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicyPurviewConfig.tsx
@@ -0,0 +1,93 @@
+import { useTranslation } from "react-i18next";
+import { FormField, Input, Select } from "@app/ui";
+import { ConnectionPicker } from "@portal/components/sources/ConnectionPicker";
+
+/**
+ * Configures the Purview labelling step: which tenant, and which label.
+ *
+ * The label is entered as its GUID. Listing labels by name needs Graph and an app registration,
+ * which a connection may not have — so the GUID is the honest lowest common denominator, and the
+ * name is optional metadata written alongside it (Microsoft stopped writing friendly names, but a
+ * label carrying one is still easier to recognise downstream).
+ */
+export interface PurviewLabelParams {
+  connectionId: string;
+  labelId: string;
+  labelName: string;
+  method: string;
+}
+
+interface PolicyPurviewConfigProps {
+  parameters: PurviewLabelParams;
+  onChange: (parameters: PurviewLabelParams) => void;
+}
+
+export function PolicyPurviewConfig({
+  parameters,
+  onChange,
+}: PolicyPurviewConfigProps) {
+  const { t } = useTranslation();
+  const set = (key: keyof PurviewLabelParams, value: string) =>
+    onChange({ ...parameters, [key]: value });
+
+  return (
+    <div className="portal-policies__capability-config">
+      <FormField
+        label={t("portal.policies.config.purview.fields.connection")}
+        required
+      >
+        <ConnectionPicker
+          value={parameters.connectionId ?? ""}
+          onChange={(id) => set("connectionId", id)}
+          integrationType="PURVIEW"
+          createTypeId="purview"
+        />
+      </FormField>
+
+      <FormField
+        label={t("portal.policies.config.purview.fields.labelId")}
+        helperText={t("portal.policies.config.purview.fields.labelIdHelp")}
+        required
+      >
+        <Input
+          value={parameters.labelId ?? ""}
+          placeholder="2096f6a2-d2f7-48be-b329-b73aaa526e5d"
+          onChange={(e) => set("labelId", e.target.value)}
+        />
+      </FormField>
+
+      <FormField
+        label={t("portal.policies.config.purview.fields.labelName")}
+        helperText={t("portal.policies.config.purview.fields.labelNameHelp")}
+      >
+        <Input
+          value={parameters.labelName ?? ""}
+          placeholder="Confidential"
+          onChange={(e) => set("labelName", e.target.value)}
+        />
+      </FormField>
+
+      <FormField
+        label={t("portal.policies.config.purview.fields.method.label")}
+        helperText={t("portal.policies.config.purview.fields.method.help")}
+      >
+        <Select
+          value={parameters.method || "STANDARD"}
+          options={[
+            {
+              value: "STANDARD",
+              label: t("portal.policies.config.purview.fields.method.standard"),
+            },
+            {
+              value: "PRIVILEGED",
+              label: t(
+                "portal.policies.config.purview.fields.method.privileged",
+              ),
+            },
+          ]}
+          onChange={(value) => set("method", value ?? "STANDARD")}
+        />
+      </FormField>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/policies/PolicyPurviewReadConfig.tsx b/frontend/editor/src/portal/components/policies/PolicyPurviewReadConfig.tsx
new file mode 100644
index 0000000000..1b5c9ec7bc
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicyPurviewReadConfig.tsx
@@ -0,0 +1,45 @@
+import { useTranslation } from "react-i18next";
+import { FormField } from "@app/ui";
+import { ConnectionPicker } from "@portal/components/sources/ConnectionPicker";
+
+/**
+ * Configures the "read a Purview label" step: which tenant to read against.
+ *
+ * This is the join-don't-beat primitive. Purview classifies documents; this reads the label it
+ * applied so the rest of the policy can act on it - redact, watermark, route - which is the
+ * PDF-specific work Purview does not do. Only the tenant matters here; the report the step emits
+ * carries whatever label the document already holds.
+ */
+export interface PurviewReadParams {
+  connectionId: string;
+}
+
+interface PolicyPurviewReadConfigProps {
+  parameters: PurviewReadParams;
+  onChange: (parameters: PurviewReadParams) => void;
+}
+
+export function PolicyPurviewReadConfig({
+  parameters,
+  onChange,
+}: PolicyPurviewReadConfigProps) {
+  const { t } = useTranslation();
+  return (
+    <div className="portal-policies__capability-config">
+      <FormField
+        label={t("portal.policies.config.purviewRead.fields.connection")}
+        helperText={t(
+          "portal.policies.config.purviewRead.fields.connectionHelp",
+        )}
+        required
+      >
+        <ConnectionPicker
+          value={parameters.connectionId ?? ""}
+          onChange={(id) => onChange({ ...parameters, connectionId: id })}
+          integrationType="PURVIEW"
+          createTypeId="purview"
+        />
+      </FormField>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx
index 91765fe0e7..503811eeda 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx
@@ -37,12 +37,21 @@ vi.mock("@portal/api/sources", () => ({
   fetchSources: () => fetchSources(),
 }));
 
+const fetchIntegrations = vi.fn();
+vi.mock("@portal/api/integrations", () => ({
+  fetchIntegrations: () => fetchIntegrations(),
+}));
+
 const CONTINUE = "portal.policies.wizard.actions.continue";
 const SAVE_CHANGES = "portal.policies.wizard.actions.saveChanges";
 const ENABLE = "portal.policies.wizard.actions.enablePolicy";
 
 const security = POLICY_CATEGORIES.find((c) => c.id === "security")!;
 const securityConfig = POLICY_CONFIG.security;
+const compliance = POLICY_CATEGORIES.find((c) => c.id === "compliance")!;
+const complianceConfig = POLICY_CONFIG.compliance;
+
+const PURVIEW_LABEL = "Apply a Microsoft Purview sensitivity label";
 
 function editEntry(steps: PipelineStep[]): CatalogueEntry {
   const policy: DecoratedPolicy = {
@@ -80,6 +89,7 @@ async function submitWizard(saveLabel: string) {
 describe("PolicySetupWizard", () => {
   beforeEach(() => {
     fetchSources.mockResolvedValue({ sources: [] });
+    fetchIntegrations.mockResolvedValue([]);
   });
 
   it("round-trips a saved step's backend params on edit", async () => {
@@ -107,6 +117,43 @@ describe("PolicySetupWizard", () => {
     ]);
   });
 
+  it("hides the Purview step when no Purview tenant is connected", async () => {
+    fetchIntegrations.mockResolvedValue([]);
+    const entry: CatalogueEntry = {
+      category: compliance,
+      config: complianceConfig,
+      policy: null,
+    };
+
+    render(
+      <PolicySetupWizard entry={entry} onClose={vi.fn()} onSubmit={vi.fn()} />,
+    );
+
+    // Sanitize is in the same chain and always shows, so once it renders the chain has loaded.
+    await screen.findByText("Strip active content");
+    // The Purview option can only fail without a connection, so it is not offered at all.
+    expect(screen.queryByText(PURVIEW_LABEL)).toBeNull();
+  });
+
+  it("offers the Purview step once a Purview connection exists", async () => {
+    fetchIntegrations.mockResolvedValue([
+      { id: 1, name: "Corp Purview", integrationType: "PURVIEW", config: {} },
+    ]);
+    const entry: CatalogueEntry = {
+      category: compliance,
+      config: complianceConfig,
+      policy: null,
+    };
+
+    render(
+      <PolicySetupWizard entry={entry} onClose={vi.fn()} onSubmit={vi.fn()} />,
+    );
+
+    await waitFor(() =>
+      expect(screen.getByText(PURVIEW_LABEL)).toBeInTheDocument(),
+    );
+  });
+
   it("seeds the preset chain for a new policy (redact + sanitize on, watermark off)", async () => {
     const onSubmit = vi.fn().mockResolvedValue(undefined);
     const entry: CatalogueEntry = {
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
index 6c5d73786c..e56065ce48 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
@@ -32,11 +32,14 @@ import {
   type PolicyToolStep,
 } from "@app/policies/operations";
 import { fetchSources } from "@portal/api/sources";
+import { fetchIntegrations } from "@portal/api/integrations";
+import { errorMessage } from "@portal/api/http";
 import { useAsync } from "@portal/hooks/useAsync";
 import { PolicyFieldRow } from "@portal/components/policies/PolicyFieldRow";
 import { PolicyCategoryBadge } from "@portal/components/policies/PolicyCategoryIcon";
 import { PolicyRedactConfig } from "@app/components/policies/PolicyRedactConfig";
 import { PolicyWatermarkConfig } from "@app/components/policies/PolicyWatermarkConfig";
+import { PolicyPurviewConfig } from "@portal/components/policies/PolicyPurviewConfig";
 import { ClassificationLabelsSection } from "@portal/components/policies/ClassificationLabelsSection";
 import "@portal/views/Policies.css";
 
@@ -87,7 +90,21 @@ function resolveFieldValues(
  * starts enabled — the user toggles tools off in the workflow.
  */
 // Temporary until the catalogue carries a defaultEnabled flag.
-const DISABLED_BY_DEFAULT = new Set<PolicyToolId>(["watermark"]);
+// Steps that cannot work until someone configures them, so they start off rather than failing
+// every run of a freshly created policy. Purview needs a tenant connection and a label GUID.
+const DISABLED_BY_DEFAULT = new Set<PolicyToolId>([
+  "watermark",
+  "purviewApplyLabel",
+  "purviewReadLabel",
+  "externalApiCall",
+]);
+
+// Steps that cannot work without a Purview tenant connection, so they are hidden entirely until one
+// is configured rather than offered as an option that can only fail.
+const PURVIEW_TOOLS = new Set<PolicyToolId>([
+  "purviewApplyLabel",
+  "purviewReadLabel",
+]);
 
 /**
  * Policy-facing framing for each capability a policy can include. Labels and
@@ -154,6 +171,27 @@ const CAPABILITY_META: Record<
     descEn:
       "Identifies the document's type from your team's labels and tags it, so it files and searches by category.",
   },
+  purviewApplyLabel: {
+    labelKey: "portal.policies.wizard.capability.purviewApplyLabel.label",
+    labelEn: "Apply a Microsoft Purview sensitivity label",
+    descKey: "portal.policies.wizard.capability.purviewApplyLabel.desc",
+    descEn:
+      "Marks the document with one of your organisation's Purview labels, so Purview-aware tools recognise how sensitive it is.",
+  },
+  purviewReadLabel: {
+    labelKey: "portal.policies.wizard.capability.purviewReadLabel.label",
+    labelEn: "Read the document's Purview label",
+    descKey: "portal.policies.wizard.capability.purviewReadLabel.desc",
+    descEn:
+      "Reports the Purview label a document already carries, so the rest of the policy can act on how sensitive it is.",
+  },
+  externalApiCall: {
+    labelKey: "portal.policies.wizard.capability.externalApiCall.label",
+    labelEn: "Send the document to another system",
+    descKey: "portal.policies.wizard.capability.externalApiCall.desc",
+    descEn:
+      "Hands the document to a system you have connected, and records what it answered.",
+  },
 };
 
 function seedTools(entry: CatalogueEntry): ToolState[] {
@@ -278,7 +316,31 @@ function PolicySetupWizardBody({
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
 
-  const enabledTools = useMemo(() => tools.filter((tl) => tl.enabled), [tools]);
+  const integrationsAsync = useAsync(() => fetchIntegrations(), []);
+  const hasPurviewConnection = useMemo(
+    () =>
+      (integrationsAsync.data ?? []).some(
+        (c) => c.integrationType === "PURVIEW",
+      ),
+    [integrationsAsync.data],
+  );
+
+  // Purview steps only appear once a tenant is connected. An already-enabled one (a saved policy,
+  // or a tenant connected earlier) stays visible so editing a policy never silently drops it.
+  const visibleTools = useMemo(
+    () =>
+      tools.filter(
+        (tl) =>
+          !PURVIEW_TOOLS.has(tl.toolId) || hasPurviewConnection || tl.enabled,
+      ),
+    [tools, hasPurviewConnection],
+  );
+
+  // Derive from the visible list: a hidden step is never submitted (hidden implies disabled).
+  const enabledTools = useMemo(
+    () => visibleTools.filter((tl) => tl.enabled),
+    [visibleTools],
+  );
 
   function setToolEnabled(toolId: PolicyToolId, enabled: boolean) {
     setTools((prev) =>
@@ -329,9 +391,13 @@ function PolicySetupWizardBody({
         retryDelayMinutes,
         steps,
       });
-    } catch {
+    } catch (e) {
       setSubmitting(false);
-      setError(t("portal.policies.wizard.errors.saveFailed"));
+      // Surface the backend's actual reason (e.g. a step missing its account) rather than a
+      // generic failure the operator cannot act on.
+      setError(
+        errorMessage(e) || t("portal.policies.wizard.errors.saveFailed"),
+      );
     }
   }
 
@@ -433,7 +499,7 @@ function PolicySetupWizardBody({
           </p>
           <Card padding="none">
             <div className="portal-policies__capabilities">
-              {tools.map((tl) => {
+              {visibleTools.map((tl) => {
                 const meta = CAPABILITY_META[tl.toolId];
                 const label = meta
                   ? t(meta.labelKey, meta.labelEn)
@@ -479,6 +545,14 @@ function PolicySetupWizardBody({
                             }
                           />
                         )}
+                        {tl.toolId === "purviewApplyLabel" && (
+                          <PolicyPurviewConfig
+                            parameters={tl.params}
+                            onChange={(params) =>
+                              setToolParams("purviewApplyLabel", params)
+                            }
+                          />
+                        )}
                       </div>
                     )}
                   </div>
diff --git a/frontend/editor/src/portal/components/policies/stepOperations.test.ts b/frontend/editor/src/portal/components/policies/stepOperations.test.ts
new file mode 100644
index 0000000000..3c2dd1c29c
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/stepOperations.test.ts
@@ -0,0 +1,251 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  STEP_OPERATIONS,
+  buildStepParameters,
+  emptyOperationValues,
+  operationById,
+  operationFormValid,
+  searchOperations,
+} from "@portal/components/policies/stepOperations";
+import { CREATABLE_CONNECTION_TYPES } from "@portal/components/sources/connectionTypes";
+
+const t = (key: string) => key;
+
+describe("STEP_OPERATIONS", () => {
+  it("every operation rides a connection type that exists", () => {
+    // An operation whose credential cannot be created is unusable, and the picker would offer
+    // inline creation of a type that isn't in the catalogue.
+    const ids = new Set(CREATABLE_CONNECTION_TYPES.map((c) => c.id));
+    for (const op of STEP_OPERATIONS) {
+      expect(ids, `${op.id} -> ${op.connectionTypeId}`).toContain(
+        op.connectionTypeId,
+      );
+    }
+  });
+
+  it("has no duplicate ids", () => {
+    const ids = STEP_OPERATIONS.map((o) => o.id);
+    expect(new Set(ids).size).toBe(ids.length);
+  });
+
+  it("every placeholder in a call is backed by a field the operator can fill", () => {
+    // A {{token}} with no matching field would reach the backend unresolved and be sent literally.
+    const contextual = /^(document|run|classification|sensitivityLabel)\./;
+    for (const op of STEP_OPERATIONS) {
+      const blob = [
+        op.call.path,
+        op.call.bodyTemplate ?? "",
+        JSON.stringify(op.call.headers ?? {}),
+        JSON.stringify(op.call.fields ?? {}),
+      ].join(" ");
+      const used = [...blob.matchAll(/\{\{([a-zA-Z0-9_.]+)\}\}/g)].map(
+        (m) => m[1],
+      );
+      const declared = new Set((op.fields ?? []).map((f) => f.key));
+      for (const token of used) {
+        if (contextual.test(token)) continue; // resolved per document by the backend
+        expect(declared, `${op.id} uses {{${token}}}`).toContain(token);
+      }
+    }
+  });
+});
+
+describe("buildStepParameters", () => {
+  it("substitutes the operator's answers into the path", () => {
+    const jira = operationById("jiraAttach")!;
+    const params = buildStepParameters(jira, "7", { issueKey: "OPS-42" });
+
+    expect(params.path).toBe("/rest/api/3/issue/OPS-42/attachments");
+    expect(params.connectionId).toBe("7");
+    expect(params.fileFieldName).toBe("file");
+    // The header Jira rejects the upload without.
+    expect(JSON.parse(params.headers)).toEqual({
+      "X-Atlassian-Token": "no-check",
+    });
+  });
+
+  it("leaves per-document placeholders for the backend to resolve", () => {
+    const splunk = operationById("splunkEvent")!;
+    const params = buildStepParameters(splunk, "1", {});
+
+    // These are resolved per document at run time, not here.
+    expect(params.bodyTemplate).toContain("{{document.sha256}}");
+    expect(params.bodyTemplate).toContain("{{run.policyName}}");
+    expect(params.includeFile).toBe("false");
+  });
+
+  it("emits a complete parameter set even for a minimal operation", () => {
+    const clamav = operationById("clamavScan")!;
+    const params = buildStepParameters(clamav, "3", {});
+
+    for (const key of [
+      "connectionId",
+      "path",
+      "method",
+      "bodyMode",
+      "fileFieldName",
+      "responseMode",
+      "responseSelect",
+      "resultUrlPath",
+      "resultUrlHeader",
+      "headers",
+      "fields",
+      "bodyTemplate",
+      "includeContext",
+      "includeFile",
+      "operationId",
+      "operationValues",
+    ]) {
+      expect(params, key).toHaveProperty(key);
+    }
+    expect(params.operationId).toBe("clamavScan");
+  });
+
+  it("remembers the operation and answers so a saved step reopens configured", () => {
+    const nextcloud = operationById("nextcloudUpload")!;
+    const values = { username: "svc", remotePath: "Processed/x.pdf" };
+    const params = buildStepParameters(nextcloud, "9", values);
+
+    expect(params.operationId).toBe("nextcloudUpload");
+    expect(JSON.parse(params.operationValues)).toEqual(values);
+    expect(params.method).toBe("PUT");
+    expect(params.bodyMode).toBe("binary");
+  });
+});
+
+describe("operation form", () => {
+  it("seeds defaults and enforces required fields", () => {
+    const elastic = operationById("elasticIndex")!;
+    const seeded = emptyOperationValues(elastic);
+
+    expect(seeded.index).toBe("stirling-audit");
+    expect(operationFormValid(elastic, seeded)).toBe(true);
+    expect(operationFormValid(elastic, { index: "  " })).toBe(false);
+  });
+
+  it("an operation with no fields is immediately valid", () => {
+    const cloudmersive = operationById("cloudmersiveScan")!;
+    expect(operationFormValid(cloudmersive, {})).toBe(true);
+  });
+});
+
+describe("searchOperations", () => {
+  it("matches the job word, not just the product name", () => {
+    const hits = searchOperations(STEP_OPERATIONS, "malware", t).map(
+      (o) => o.id,
+    );
+    expect(hits).toContain("cloudmersiveScan");
+    expect(hits).toContain("clamavScan");
+    expect(hits).not.toContain("jiraAttach");
+  });
+
+  it("returns everything for an empty query", () => {
+    expect(searchOperations(STEP_OPERATIONS, "  ", t)).toHaveLength(
+      STEP_OPERATIONS.length,
+    );
+  });
+});
+
+describe("substituting operator answers into a JSON body", () => {
+  it("escapes an answer so a quote does not break the body", () => {
+    // The operator types prose, not JSON. An apostrophe is fine; a double quote or a backslash
+    // used to land raw inside the serialised template and the backend rejected the whole step
+    // with "bodyTemplate must be valid JSON".
+    const op = operationById("discordNotify")!;
+    const params = buildStepParameters(op, "9", {
+      message: 'Tagged the "processed" batch \\ archived',
+    });
+
+    const body: unknown = JSON.parse(params.bodyTemplate);
+    expect(body).toEqual({
+      content: 'Tagged the "processed" batch \\ archived',
+    });
+  });
+
+  it("leaves the backend's own placeholders for the server pass", () => {
+    // {{document.filename}} carries a dot, so the client substituter must not touch it.
+    const op = operationById("discordNotify")!;
+    const params = buildStepParameters(op, "9", {
+      message: "{{run.policyName}} did {{document.filename}}",
+    });
+
+    expect(params.bodyTemplate).toContain("{{document.filename}}");
+    expect(JSON.parse(params.bodyTemplate)).toEqual({
+      content: "{{run.policyName}} did {{document.filename}}",
+    });
+  });
+
+  it("escapes a quoted answer substituted into the fields map", () => {
+    // Mailgun is the entry that actually templates `fields`, and a subject line is exactly the
+    // kind of free text an operator puts quotes in.
+    const op = operationById("mailgunEmail")!;
+    const params = buildStepParameters(op, "3", {
+      domain: "mg.example.test",
+      to: "ops@example.test",
+      from: "bot@example.test",
+      subject: 'Re: the "urgent" batch',
+    });
+
+    expect(JSON.parse(params.fields)).toMatchObject({
+      subject: 'Re: the "urgent" batch',
+      to: "ops@example.test",
+    });
+    // The path is not JSON, so it keeps the plain substitution.
+    expect(params.path).toBe("/v3/mg.example.test/messages");
+  });
+});
+
+describe("the Cloudmersive scan gate", () => {
+  it("sends CleanResult as a verdict gate, not a no-op archive selector", () => {
+    // The old shape put "CleanResult" in responseSelect, which the backend only reads in replace
+    // mode as a ZIP-entry name - so an infected file (HTTP 200, CleanResult:false) sailed through.
+    // It must ride requireTrue, which the backend enforces in report mode.
+    const params = buildStepParameters(
+      operationById("cloudmersiveScan")!,
+      "3",
+      {},
+    );
+
+    expect(params.requireTrue).toBe("CleanResult");
+    expect(params.responseSelect).toBe("");
+    expect(params.responseMode).toBe("report");
+  });
+
+  it("gates the advanced scan too", () => {
+    const params = buildStepParameters(
+      operationById("cloudmersiveAdvancedScan")!,
+      "3",
+      {},
+    );
+    expect(params.requireTrue).toBe("CleanResult");
+  });
+
+  it("leaves requireTrue blank for operations that do not gate", () => {
+    const params = buildStepParameters(operationById("discordNotify")!, "3", {
+      message: "hi",
+    });
+    expect(params.requireTrue).toBe("");
+  });
+});
+
+describe("substituting an answer into the URL path", () => {
+  it("percent-encodes the answer so a slash stays a value, not a new segment", () => {
+    // A Jira key like "OPS/1" (or a space) must not add a path segment or reach another endpoint.
+    const params = buildStepParameters(operationById("jiraAttach")!, "3", {
+      issueKey: "OPS 1/2",
+    });
+
+    expect(params.path).toBe("/rest/api/3/issue/OPS%201%2F2/attachments");
+    expect(params.path).not.toContain(" ");
+  });
+
+  it("leaves the backend's own {{document.*}} placeholders in the path untouched", () => {
+    // Mailgun's path carries {{domain}} (an operator field) but backend placeholders would have
+    // dots; only the operator field is substituted and encoded here.
+    const params = buildStepParameters(operationById("mailgunEmail")!, "3", {
+      domain: "mg.acme.com",
+    });
+    expect(params.path).toBe("/v3/mg.acme.com/messages");
+  });
+});
diff --git a/frontend/editor/src/portal/components/policies/stepOperations.ts b/frontend/editor/src/portal/components/policies/stepOperations.ts
new file mode 100644
index 0000000000..5c6e0958d9
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/stepOperations.ts
@@ -0,0 +1,672 @@
+/**
+ * What a connection can actually *do* — the operations catalogue.
+ *
+ * A connection stores credentials; it does not know how to call anything. This file supplies the
+ * other half: for each vendor, the exact call that makes it useful. Without it, picking
+ * "Cloudmersive" gets an operator a saved API key and a blank form asking for a URL path, a body
+ * mode and a field name they would have to read the vendor's docs to discover.
+ *
+ * Mirrors {@link CREATABLE_CONNECTION_TYPES} deliberately: an operation is added by describing the
+ * call, not by writing a component. Adding a vendor operation is an entry here plus two lines of
+ * copy — the same bar that made the connection catalogue maintainable.
+ *
+ * Every `call` below was exercised against the real vendor or a contract-accurate mock; the shapes
+ * are not guesses. Where a vendor needs something only the operator knows (a Jira issue key, a
+ * Splunk index), that becomes a `field` and is substituted into the path or body via the backend's
+ * `{{placeholder}}` resolution — which also gives the operator `{{document.*}}` and `{{run.*}}`.
+ */
+
+import type { IntegrationType } from "@portal/api/integrations";
+import type { ConnectionCategory } from "@portal/components/sources/connectionTypes";
+
+/**
+ * The complete parameter set of the `external-api-call` step. Every key is present and every
+ * value is a string, because the pipeline serialises steps as form fields.
+ */
+export interface ExternalApiStepParams {
+  connectionId: string;
+  path: string;
+  method: string;
+  bodyMode: string;
+  fileFieldName: string;
+  responseMode: string;
+  resultUrlPath: string;
+  resultUrlHeader: string;
+  responseSelect: string;
+  requireTrue: string;
+  fields: string;
+  headers: string;
+  bodyTemplate: string;
+  includeContext: string;
+  includeFile: string;
+  operationId: string;
+  operationValues: string;
+}
+
+const PREFIX = "portal.policies.operations";
+
+/** One value the operator supplies per step, substituted into the call. */
+export interface OperationFieldDef {
+  key: string;
+  labelKey: string;
+  control: "text" | "textarea" | "select";
+  required?: boolean;
+  placeholderKey?: string;
+  helperTextKey?: string;
+  defaultValue?: string;
+  options?: { value: string; labelKey: string }[];
+}
+
+/**
+ * The wire call, in the vocabulary the `external-api-call` step already accepts. Anything omitted
+ * falls back to the step's own defaults, so an entry states only what is distinctive about it.
+ */
+export interface OperationCall {
+  /** Relative to the connection's base URL. May carry `{{field}}` and `{{document.*}}`. */
+  path: string;
+  method?: "POST" | "PUT" | "PATCH" | "GET";
+  bodyMode?: "multipart" | "json" | "binary";
+  /** Multipart only: the form field the vendor expects the document under. */
+  fileFieldName?: string;
+  /** `report` leaves the document untouched; `replace` swaps it for what came back. */
+  responseMode?: "report" | "replace";
+  /** Archive-entry selector for `replace` mode (e.g. `*.pdf`); not a JSON verdict. */
+  responseSelect?: string;
+  /**
+   * A dotted path into the JSON response that must be `true`, or the step fails and the document is
+   * parked. This is the scan gate: Cloudmersive's `CleanResult` stops the run when a file is not
+   * clean, rather than the verdict being merely reported and ignored.
+   */
+  requireTrue?: string;
+  headers?: Record<string, string>;
+  fields?: Record<string, string>;
+  bodyTemplate?: string;
+  /** False for notify-style calls that send facts rather than the document. */
+  includeFile?: boolean;
+}
+
+export interface StepOperation {
+  id: string;
+  /** The connection preset this rides, so the picker can offer inline creation of the right type. */
+  connectionTypeId: string;
+  integrationType: IntegrationType;
+  category: ConnectionCategory;
+  labelKey: string;
+  descriptionKey: string;
+  searchTerms?: string[];
+  call: OperationCall;
+  fields?: OperationFieldDef[];
+  /**
+   * True for the escape hatch, where the operator authors the call themselves. Admin-gated by the
+   * same server flag as the custom connection; the UI only decides whether to offer it.
+   */
+  custom?: boolean;
+  /** Shown as a caveat in the picker when a vendor has a known limitation. */
+  noteKey?: string;
+}
+
+const f = (
+  key: string,
+  control: OperationFieldDef["control"] = "text",
+  required = true,
+): OperationFieldDef => ({
+  key,
+  labelKey: `${PREFIX}.fields.${key}.label`,
+  control,
+  required,
+  placeholderKey: `${PREFIX}.fields.${key}.placeholder`,
+});
+
+/** A notify call: JSON facts, no document, posted straight at the webhook URL. */
+function notify(
+  id: string,
+  connectionTypeId: string,
+  bodyKey: string,
+  searchTerms: string[],
+): StepOperation {
+  return {
+    id,
+    connectionTypeId,
+    integrationType: "API",
+    category: "notify",
+    labelKey: `${PREFIX}.${id}.label`,
+    descriptionKey: `${PREFIX}.${id}.description`,
+    searchTerms,
+    call: {
+      // The webhook URL is the whole endpoint, so the step adds no path of its own.
+      path: "",
+      bodyMode: "json",
+      includeFile: false,
+      bodyTemplate: JSON.stringify({ [bodyKey]: "{{message}}" }),
+    },
+    fields: [
+      {
+        key: "message",
+        labelKey: `${PREFIX}.fields.message.label`,
+        control: "textarea",
+        required: true,
+        helperTextKey: `${PREFIX}.fields.message.helperText`,
+        defaultValue:
+          "{{run.policyName}} processed {{document.filename}} ({{document.pageCount}} pages)",
+      },
+    ],
+  };
+}
+
+export const STEP_OPERATIONS: StepOperation[] = [
+  // ---- scan & classify: the verdict gates the run ------------------------------------------
+  {
+    id: "cloudmersiveScan",
+    connectionTypeId: "cloudmersive",
+    integrationType: "API",
+    category: "security",
+    labelKey: `${PREFIX}.cloudmersiveScan.label`,
+    descriptionKey: `${PREFIX}.cloudmersiveScan.description`,
+    searchTerms: ["virus", "malware", "scan", "av", "antivirus"],
+    // Verified against the live API: a clean PDF returns {"CleanResult":true}. The verdict gates
+    // the run - CleanResult=false fails the step even though the HTTP status is 200.
+    call: {
+      path: "/virus/scan/file",
+      bodyMode: "multipart",
+      fileFieldName: "inputFile",
+      responseMode: "report",
+      requireTrue: "CleanResult",
+    },
+  },
+  {
+    id: "cloudmersiveAdvancedScan",
+    connectionTypeId: "cloudmersiveadvanced",
+    integrationType: "API",
+    category: "security",
+    labelKey: `${PREFIX}.cloudmersiveAdvancedScan.label`,
+    descriptionKey: `${PREFIX}.cloudmersiveAdvancedScan.description`,
+    searchTerms: [
+      "macro",
+      "executable",
+      "script",
+      "active content",
+      "ole",
+      "scan",
+    ],
+    // The block-list is expressed as headers; each defaults to false, i.e. blocking is ON. The
+    // CleanResult verdict gates the run, so a blocked file stops the pipeline rather than passing.
+    call: {
+      path: "/virus/scan/file/advanced",
+      bodyMode: "multipart",
+      fileFieldName: "inputFile",
+      responseMode: "report",
+      requireTrue: "CleanResult",
+      headers: {
+        allowExecutables: "false",
+        allowMacros: "false",
+        allowScripts: "false",
+        allowUnsafeArchives: "false",
+        allowOleEmbeddedObject: "false",
+      },
+    },
+  },
+  {
+    id: "clamavScan",
+    connectionTypeId: "clamav",
+    integrationType: "API",
+    category: "security",
+    labelKey: `${PREFIX}.clamavScan.label`,
+    descriptionKey: `${PREFIX}.clamavScan.description`,
+    searchTerms: ["virus", "malware", "scan", "self-hosted", "on-prem"],
+    // Verified against a real ClamAV container: an infected file answers non-2xx, failing the step.
+    call: {
+      path: "/scan",
+      bodyMode: "multipart",
+      fileFieldName: "file",
+      responseMode: "report",
+    },
+  },
+  {
+    id: "presidioAnalyze",
+    connectionTypeId: "presidio",
+    integrationType: "API",
+    category: "security",
+    labelKey: `${PREFIX}.presidioAnalyze.label`,
+    descriptionKey: `${PREFIX}.presidioAnalyze.description`,
+    searchTerms: ["pii", "personal data", "dlp", "gdpr", "detect"],
+    noteKey: `${PREFIX}.presidioAnalyze.note`,
+    // Presidio's analyser takes text, not a file - so the document is described, not uploaded.
+    call: {
+      path: "/analyze",
+      bodyMode: "json",
+      includeFile: false,
+      responseMode: "report",
+      bodyTemplate: JSON.stringify({ text: "{{text}}", language: "en" }),
+    },
+    fields: [
+      {
+        key: "text",
+        labelKey: `${PREFIX}.fields.text.label`,
+        control: "textarea",
+        required: true,
+        helperTextKey: `${PREFIX}.fields.text.helperText`,
+      },
+    ],
+  },
+
+  // ---- file & attach ------------------------------------------------------------------------
+  {
+    id: "jiraAttach",
+    connectionTypeId: "jira",
+    integrationType: "API",
+    category: "storage",
+    labelKey: `${PREFIX}.jiraAttach.label`,
+    descriptionKey: `${PREFIX}.jiraAttach.description`,
+    searchTerms: ["jira", "issue", "ticket", "attach", "atlassian"],
+    // Verified against a real Jira Cloud site. The anti-XSRF header is mandatory.
+    call: {
+      path: "/rest/api/3/issue/{{issueKey}}/attachments",
+      bodyMode: "multipart",
+      fileFieldName: "file",
+      responseMode: "report",
+      headers: { "X-Atlassian-Token": "no-check" },
+    },
+    fields: [f("issueKey")],
+  },
+  {
+    id: "confluenceAttach",
+    connectionTypeId: "confluence",
+    integrationType: "API",
+    category: "storage",
+    labelKey: `${PREFIX}.confluenceAttach.label`,
+    descriptionKey: `${PREFIX}.confluenceAttach.description`,
+    searchTerms: ["confluence", "page", "wiki", "attach", "atlassian"],
+    // Verified against a real Confluence site. Note "nocheck" here vs Jira's "no-check", and that
+    // only the v1 API can create an attachment.
+    call: {
+      path: "/wiki/rest/api/content/{{pageId}}/child/attachment",
+      bodyMode: "multipart",
+      fileFieldName: "file",
+      responseMode: "report",
+      headers: { "X-Atlassian-Token": "nocheck" },
+      fields: { minorEdit: "true" },
+    },
+    fields: [f("pageId")],
+  },
+  {
+    id: "nextcloudUpload",
+    connectionTypeId: "nextcloud",
+    integrationType: "API",
+    category: "storage",
+    labelKey: `${PREFIX}.nextcloudUpload.label`,
+    descriptionKey: `${PREFIX}.nextcloudUpload.description`,
+    searchTerms: ["nextcloud", "webdav", "upload", "file", "owncloud"],
+    // Verified byte-identical against a real Nextcloud: WebDAV takes the raw bytes on a PUT.
+    call: {
+      path: "/remote.php/dav/files/{{username}}/{{remotePath}}",
+      method: "PUT",
+      bodyMode: "binary",
+      responseMode: "report",
+    },
+    fields: [
+      f("username"),
+      {
+        key: "remotePath",
+        labelKey: `${PREFIX}.fields.remotePath.label`,
+        control: "text",
+        required: true,
+        helperTextKey: `${PREFIX}.fields.remotePath.helperText`,
+        defaultValue: "Processed/{{document.filename}}",
+      },
+    ],
+  },
+
+  // ---- audit & compliance logging -------------------------------------------------------------
+  {
+    id: "splunkEvent",
+    connectionTypeId: "splunk",
+    integrationType: "API",
+    category: "audit",
+    labelKey: `${PREFIX}.splunkEvent.label`,
+    descriptionKey: `${PREFIX}.splunkEvent.description`,
+    searchTerms: ["splunk", "hec", "siem", "audit", "log", "event"],
+    // Verified against a real Splunk HEC; the event was found by Splunk's own search.
+    call: {
+      path: "/services/collector/event",
+      bodyMode: "json",
+      includeFile: false,
+      responseMode: "report",
+      bodyTemplate: JSON.stringify({
+        sourcetype: "stirling:policy",
+        event: {
+          action: "policy.document.processed",
+          policy: "{{run.policyName}}",
+          runId: "{{run.runId}}",
+          filename: "{{document.filename}}",
+          sha256: "{{document.sha256}}",
+          pages: "{{document.pageCount}}",
+        },
+      }),
+    },
+  },
+  {
+    id: "elasticIndex",
+    connectionTypeId: "elastic",
+    integrationType: "API",
+    category: "audit",
+    labelKey: `${PREFIX}.elasticIndex.label`,
+    descriptionKey: `${PREFIX}.elasticIndex.description`,
+    searchTerms: ["elastic", "elasticsearch", "siem", "audit", "index", "log"],
+    // Verified against a real Elasticsearch: the event was queried back out afterwards.
+    call: {
+      path: "/{{index}}/_doc",
+      bodyMode: "json",
+      includeFile: false,
+      responseMode: "report",
+      bodyTemplate: JSON.stringify({
+        event: "policy.document.processed",
+        policy: "{{run.policyName}}",
+        runId: "{{run.runId}}",
+        filename: "{{document.filename}}",
+        sha256: "{{document.sha256}}",
+      }),
+    },
+    fields: [
+      {
+        key: "index",
+        labelKey: `${PREFIX}.fields.index.label`,
+        control: "text",
+        required: true,
+        defaultValue: "stirling-audit",
+      },
+    ],
+  },
+  {
+    id: "sumologicEvent",
+    connectionTypeId: "sumologic",
+    integrationType: "API",
+    category: "audit",
+    labelKey: `${PREFIX}.sumologicEvent.label`,
+    descriptionKey: `${PREFIX}.sumologicEvent.description`,
+    searchTerms: ["sumo", "sumologic", "siem", "audit", "log"],
+    call: {
+      path: "",
+      bodyMode: "json",
+      includeFile: false,
+      responseMode: "report",
+      bodyTemplate: JSON.stringify({
+        event: "policy.document.processed",
+        policy: "{{run.policyName}}",
+        filename: "{{document.filename}}",
+        sha256: "{{document.sha256}}",
+      }),
+    },
+  },
+
+  // ---- email the document ----------------------------------------------------------------------
+  {
+    id: "sendgridEmail",
+    connectionTypeId: "sendgrid",
+    integrationType: "API",
+    category: "notify",
+    labelKey: `${PREFIX}.sendgridEmail.label`,
+    descriptionKey: `${PREFIX}.sendgridEmail.description`,
+    searchTerms: ["email", "mail", "send", "attachment", "sendgrid"],
+    call: {
+      path: "/v3/mail/send",
+      bodyMode: "json",
+      responseMode: "report",
+      bodyTemplate: JSON.stringify({
+        personalizations: [{ to: [{ email: "{{to}}" }] }],
+        from: { email: "{{from}}" },
+        subject: "{{subject}}",
+        content: [
+          { type: "text/plain", value: "Attached: {{document.filename}}" },
+        ],
+        attachments: [
+          {
+            content: "{{document.base64}}",
+            filename: "{{document.filename}}",
+            type: "application/pdf",
+            disposition: "attachment",
+          },
+        ],
+      }),
+    },
+    fields: [
+      f("to"),
+      f("from"),
+      {
+        key: "subject",
+        labelKey: `${PREFIX}.fields.subject.label`,
+        control: "text",
+        required: true,
+        defaultValue: "Processed: {{document.filename}}",
+      },
+    ],
+  },
+  {
+    id: "mailgunEmail",
+    connectionTypeId: "mailgun",
+    integrationType: "API",
+    category: "notify",
+    labelKey: `${PREFIX}.mailgunEmail.label`,
+    descriptionKey: `${PREFIX}.mailgunEmail.description`,
+    searchTerms: ["email", "mail", "send", "attachment", "mailgun"],
+    call: {
+      path: "/v3/{{domain}}/messages",
+      bodyMode: "multipart",
+      fileFieldName: "attachment",
+      responseMode: "report",
+      responseSelect: "id",
+      fields: {
+        from: "{{from}}",
+        to: "{{to}}",
+        subject: "{{subject}}",
+        text: "Attached: {{document.filename}}",
+      },
+    },
+    fields: [
+      f("domain"),
+      f("to"),
+      f("from"),
+      {
+        key: "subject",
+        labelKey: `${PREFIX}.fields.subject.label`,
+        control: "text",
+        required: true,
+        defaultValue: "Processed: {{document.filename}}",
+      },
+    ],
+  },
+
+  // ---- notify: one shape, several vendors -------------------------------------------------------
+  notify("slackNotify", "slack", "text", [
+    "slack",
+    "chat",
+    "notify",
+    "message",
+  ]),
+  notify("teamsNotify", "teams", "text", [
+    "teams",
+    "microsoft",
+    "chat",
+    "notify",
+  ]),
+  notify("discordNotify", "discord", "content", ["discord", "chat", "notify"]),
+  notify("googlechatNotify", "googlechat", "text", [
+    "google",
+    "chat",
+    "notify",
+  ]),
+  notify("zapierNotify", "zapier", "text", [
+    "zapier",
+    "make",
+    "automation",
+    "trigger",
+  ]),
+
+  {
+    id: "webhookPost",
+    connectionTypeId: "webhook",
+    integrationType: "API",
+    category: "notify",
+    labelKey: `${PREFIX}.webhookPost.label`,
+    descriptionKey: `${PREFIX}.webhookPost.description`,
+    searchTerms: ["webhook", "http", "post", "callback", "custom"],
+    call: {
+      path: "",
+      bodyMode: "multipart",
+      fileFieldName: "file",
+      responseMode: "report",
+    },
+  },
+
+  // ---- sign ---------------------------------------------------------------------------------------
+  {
+    id: "consignoSubmit",
+    connectionTypeId: "consigno",
+    integrationType: "CONSIGNO",
+    category: "signing",
+    labelKey: `${PREFIX}.consignoSubmit.label`,
+    descriptionKey: `${PREFIX}.consignoSubmit.description`,
+    searchTerms: ["consigno", "notarius", "sign", "signature", "esign"],
+    noteKey: `${PREFIX}.consignoSubmit.note`,
+    call: {
+      path: "/workflows",
+      bodyMode: "json",
+      responseMode: "report",
+      bodyTemplate: JSON.stringify({
+        name: "{{document.filename}}",
+        documents: [
+          { name: "{{document.filename}}", data: "{{document.base64}}" },
+        ],
+        signers: [{ email: "{{signerEmail}}", type: "certifio" }],
+      }),
+    },
+    fields: [f("signerEmail")],
+  },
+
+  // ---- the escape hatch ---------------------------------------------------------------------------
+  {
+    id: "customApiCall",
+    connectionTypeId: "api",
+    integrationType: "API",
+    category: "advanced",
+    labelKey: `${PREFIX}.customApiCall.label`,
+    descriptionKey: `${PREFIX}.customApiCall.description`,
+    searchTerms: ["custom", "api", "http", "advanced", "anything"],
+    custom: true,
+    // Nothing baked in: every part of the call is the operator's to author.
+    call: {
+      path: "",
+      bodyMode: "multipart",
+      fileFieldName: "file",
+      responseMode: "report",
+    },
+  },
+];
+
+/** Operations grouped for the picker, in the catalogue's own category order. */
+export function operationsByCategory(
+  operations: StepOperation[],
+): Map<ConnectionCategory, StepOperation[]> {
+  const map = new Map<ConnectionCategory, StepOperation[]>();
+  for (const op of operations) {
+    const list = map.get(op.category) ?? [];
+    list.push(op);
+    map.set(op.category, list);
+  }
+  return map;
+}
+
+/** Matches label, description and the vendor's own aliases, like the connection picker. */
+export function searchOperations(
+  operations: StepOperation[],
+  query: string,
+  t: (key: string) => string,
+): StepOperation[] {
+  const q = query.trim().toLowerCase();
+  if (!q) return operations;
+  return operations.filter((op) => {
+    const haystack = [
+      t(op.labelKey),
+      t(op.descriptionKey),
+      op.id,
+      ...(op.searchTerms ?? []),
+    ]
+      .join(" ")
+      .toLowerCase();
+    return haystack.includes(q);
+  });
+}
+
+/** The operator-supplied defaults for a freshly chosen operation. */
+export function emptyOperationValues(
+  op: StepOperation,
+): Record<string, string> {
+  const values: Record<string, string> = {};
+  for (const field of op.fields ?? []) {
+    values[field.key] = field.defaultValue ?? "";
+  }
+  return values;
+}
+
+export function operationFormValid(
+  op: StepOperation,
+  values: Record<string, string>,
+): boolean {
+  return (op.fields ?? []).every(
+    (field) => !field.required || (values[field.key] ?? "").trim() !== "",
+  );
+}
+
+/**
+ * Turn a chosen operation plus the operator's answers into the parameters the
+ * `external-api-call` step takes.
+ *
+ * Operator values are substituted into the call's own `{{placeholders}}` here, in the client,
+ * because they are step configuration rather than per-document context. The backend's placeholder
+ * pass then resolves the remaining `{{document.*}}` and `{{run.*}}` at run time, per document.
+ */
+export function buildStepParameters(
+  op: StepOperation,
+  connectionId: string,
+  values: Record<string, string>,
+): ExternalApiStepParams {
+  // Substituted into the URL path: the answer is percent-encoded, so a space or slash in a key
+  // (a Jira "OPS 1", a path-shaped id) is a value, not a change to the target. Matches the
+  // backend's URL_PATH escaping for its own {{document.*}} pass.
+  const substitutePath = (text: string): string =>
+    text.replace(/\{\{([a-zA-Z0-9_]+)\}\}/g, (whole, key: string) =>
+      key in values ? encodeURIComponent(values[key]) : whole,
+    );
+  // Substituted into an already-serialised JSON string: a quote or backslash in an answer would
+  // otherwise break the body, and the backend rejects it as invalid JSON.
+  const substituteJson = (text: string): string =>
+    text.replace(/\{\{([a-zA-Z0-9_]+)\}\}/g, (whole, key: string) =>
+      key in values ? JSON.stringify(values[key]).slice(1, -1) : whole,
+    );
+
+  const call = op.call;
+  // Every declared parameter is emitted, blank where the operation does not use it, so the result
+  // is a complete step rather than a partial one the caller has to top up.
+  return {
+    connectionId,
+    path: substitutePath(call.path ?? ""),
+    method: call.method ?? "POST",
+    bodyMode: call.bodyMode ?? "multipart",
+    fileFieldName: call.fileFieldName ?? "file",
+    responseMode: call.responseMode ?? "report",
+    responseSelect: call.responseSelect ?? "",
+    requireTrue: call.requireTrue ?? "",
+    resultUrlPath: "",
+    resultUrlHeader: "",
+    headers: call.headers ? substituteJson(JSON.stringify(call.headers)) : "",
+    fields: call.fields ? substituteJson(JSON.stringify(call.fields)) : "",
+    bodyTemplate: call.bodyTemplate ? substituteJson(call.bodyTemplate) : "",
+    includeContext: "false",
+    includeFile: String(call.includeFile ?? true),
+    operationId: op.id,
+    operationValues: JSON.stringify(values),
+  };
+}
+
+export function operationById(id: string): StepOperation | undefined {
+  return STEP_OPERATIONS.find((op) => op.id === id);
+}
diff --git a/frontend/editor/src/portal/components/sources/ConnectionForm.tsx b/frontend/editor/src/portal/components/sources/ConnectionForm.tsx
new file mode 100644
index 0000000000..a6cd42da89
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionForm.tsx
@@ -0,0 +1,105 @@
+import { useTranslation } from "react-i18next";
+import { FormField, Input, Select } from "@app/ui";
+import {
+  isFieldVisible,
+  type ConnectionFieldDef,
+  type CreatableConnectionType,
+} from "@portal/components/sources/connectionTypes";
+
+/**
+ * Renders whatever fields a connection type declares, rather than knowing any vendor's shape.
+ *
+ * Mirrors how {@code SourceBuilder} renders {@code CREATABLE_SOURCE_TYPES}: adding Purview or
+ * ConsignO is a descriptor, not a component. Secrets are write-only — on edit the backend returns
+ * them masked and keeps the stored value when the mask is sent back untouched.
+ */
+interface ConnectionFormProps {
+  type: CreatableConnectionType;
+  /** Answers keyed by field key, plus `name`. Dotted keys nest at build time. */
+  values: Record<string, string>;
+  onChange: (values: Record<string, string>) => void;
+}
+
+export function ConnectionForm({
+  type,
+  values,
+  onChange,
+}: ConnectionFormProps) {
+  const { t } = useTranslation();
+  const set = (key: string, value: string) =>
+    onChange({ ...values, [key]: value });
+
+  return (
+    <div className="portal-sources__connection-form">
+      <FormField label={t("portal.connections.fields.name")} required>
+        <Input
+          value={values.name ?? ""}
+          placeholder={t("portal.connections.fields.namePlaceholder")}
+          onChange={(e) => set("name", e.target.value)}
+        />
+      </FormField>
+
+      {type.fields
+        // A hidden field keeps its value in state so switching auth type and back does not
+        // silently discard what was typed; buildConnectionConfig sends only what is filled.
+        .filter((field) => isFieldVisible(field, values))
+        .map((field) => (
+          <ConnectionField
+            key={field.key}
+            field={field}
+            value={values[field.key] ?? ""}
+            onChange={(value) => set(field.key, value)}
+          />
+        ))}
+    </div>
+  );
+}
+
+function ConnectionField({
+  field,
+  value,
+  onChange,
+}: {
+  field: ConnectionFieldDef;
+  value: string;
+  onChange: (value: string) => void;
+}) {
+  const { t } = useTranslation();
+  return (
+    <FormField
+      label={t(field.labelKey)}
+      required={field.required}
+      helperText={field.helperTextKey ? t(field.helperTextKey) : undefined}
+    >
+      {field.control === "select" ? (
+        <Select
+          value={value}
+          options={(field.options ?? []).map((option) => ({
+            value: option.value,
+            label: t(option.labelKey),
+          }))}
+          onChange={(next) => onChange(next ?? "")}
+        />
+      ) : field.control === "textarea" || field.control === "hostList" ? (
+        <textarea
+          className="portal-sources__connection-textarea"
+          rows={field.control === "hostList" ? 2 : 5}
+          value={value}
+          placeholder={
+            field.placeholderKey ? t(field.placeholderKey) : undefined
+          }
+          onChange={(e) => onChange(e.target.value)}
+        />
+      ) : (
+        <Input
+          type={field.control === "password" ? "password" : undefined}
+          value={value}
+          placeholder={
+            field.placeholderKey ? t(field.placeholderKey) : undefined
+          }
+          onChange={(e) => onChange(e.target.value)}
+        />
+      )}
+    </FormField>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sources/ConnectionModal.test.tsx b/frontend/editor/src/portal/components/sources/ConnectionModal.test.tsx
new file mode 100644
index 0000000000..c1a152ab8d
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionModal.test.tsx
@@ -0,0 +1,309 @@
+import { MantineProvider } from "@mantine/core";
+import { render, screen, waitFor } from "@testing-library/react";
+import userEvent from "@testing-library/user-event";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+import { ConnectionModal } from "@portal/components/sources/ConnectionModal";
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({ t: (key: string) => key }),
+}));
+
+vi.mock("@portal/api/integrations", () => ({
+  createIntegration: vi.fn(),
+  updateIntegration: vi.fn(),
+}));
+
+vi.mock("@portal/api/http", () => ({
+  errorMessage: (e: unknown) => String(e),
+}));
+
+const { createIntegration, updateIntegration } =
+  await import("@portal/api/integrations");
+
+const wrap = (ui: React.ReactNode) => <MantineProvider>{ui}</MantineProvider>;
+
+const fill = async (label: string, value: string) => {
+  const field = screen.getByLabelText(label, { exact: false });
+  await userEvent.clear(field);
+  await userEvent.type(field, value);
+};
+
+describe("ConnectionModal", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(createIntegration).mockResolvedValue({ id: 7 } as never);
+    vi.mocked(updateIntegration).mockResolvedValue({ id: 7 } as never);
+  });
+
+  it("creates a Purview connection with its tenant id", async () => {
+    const onSaved = vi.fn();
+    render(
+      wrap(
+        <ConnectionModal
+          open
+          fixedTypeId="purview"
+          onClose={vi.fn()}
+          onSaved={onSaved}
+        />,
+      ),
+    );
+
+    await fill("portal.connections.fields.name", "Corp Purview");
+    await fill(
+      "portal.connections.types.purview.fields.tenantId",
+      "cb46c030-1825-4e81-a295-151c039dbf02",
+    );
+    await userEvent.click(screen.getByText("portal.connections.picker.save"));
+
+    await waitFor(() =>
+      expect(createIntegration).toHaveBeenCalledWith({
+        integrationType: "PURVIEW",
+        name: "Corp Purview",
+        scope: "TEAM",
+        config: {
+          presetId: "purview",
+          tenantId: "cb46c030-1825-4e81-a295-151c039dbf02",
+        },
+      }),
+    );
+    expect(onSaved).toHaveBeenCalled();
+  });
+
+  it("bakes the ConsignO preset into the saved config", async () => {
+    render(
+      wrap(
+        <ConnectionModal
+          open
+          fixedTypeId="consigno"
+          onClose={vi.fn()}
+          onSaved={vi.fn()}
+        />,
+      ),
+    );
+
+    await fill("portal.connections.fields.name", "Notarius");
+    await fill(
+      "portal.connections.types.consigno.fields.baseUrl",
+      "https://acme.consignocloud.com/api/v1",
+    );
+    await fill("portal.connections.types.consigno.fields.clientId", "cid");
+    await fill(
+      "portal.connections.types.consigno.fields.clientSecret",
+      "csecret",
+    );
+    await fill(
+      "portal.connections.types.consigno.fields.username",
+      "api@acme.test",
+    );
+    await fill("portal.connections.types.consigno.fields.password", "pw");
+    await userEvent.click(screen.getByText("portal.connections.picker.save"));
+
+    await waitFor(() => expect(createIntegration).toHaveBeenCalled());
+    const body = vi.mocked(createIntegration).mock.calls[0][0];
+    expect(body.integrationType).toBe("CONSIGNO");
+    // The operator supplied credentials; the vendor's auth mechanics came from the preset.
+    expect(body.config).toMatchObject({
+      authType: "TOKEN_LOGIN",
+      loginPath: "/auth/login",
+      tokenResponseHeader: "X-Auth-Token",
+      loginHeaders: { "X-Client-Id": "cid", "X-Client-Secret": "csecret" },
+      loginBody: { username: "api@acme.test", password: "pw" },
+    });
+  });
+
+  it("round-trips a masked secret so the stored value is kept", async () => {
+    render(
+      wrap(
+        <ConnectionModal
+          open
+          connection={
+            {
+              id: 3,
+              integrationType: "S3",
+              name: "Existing",
+              config: {
+                bucket: "b",
+                region: "eu-west-2",
+                accessKeyId: "AK",
+                secretAccessKey: "********",
+              },
+            } as never
+          }
+          onClose={vi.fn()}
+          onSaved={vi.fn()}
+        />,
+      ),
+    );
+
+    await userEvent.click(screen.getByText("portal.connections.picker.save"));
+
+    await waitFor(() => expect(updateIntegration).toHaveBeenCalled());
+    const [id, body] = vi.mocked(updateIntegration).mock.calls[0];
+    expect(id).toBe(3);
+    // Sending the mask back unchanged is what tells the backend to keep the real secret.
+    expect(body.config).toMatchObject({
+      secretAccessKey: "********",
+      bucket: "b",
+    });
+  });
+
+  it("cannot be saved until the required fields are filled", async () => {
+    render(
+      wrap(
+        <ConnectionModal
+          open
+          fixedTypeId="purview"
+          onClose={vi.fn()}
+          onSaved={vi.fn()}
+        />,
+      ),
+    );
+
+    const save = screen.getByText("portal.connections.picker.save");
+    expect(save.closest("button")).toBeDisabled();
+
+    await fill("portal.connections.fields.name", "Corp");
+    // Name alone is not enough: Purview needs a tenant id.
+    expect(save.closest("button")).toBeDisabled();
+  });
+
+  it("offers custom API only to admins, and only under Advanced", async () => {
+    const { rerender } = render(
+      wrap(
+        <ConnectionModal
+          open
+          capabilities={{ customApi: false }}
+          onClose={vi.fn()}
+          onSaved={vi.fn()}
+        />,
+      ),
+    );
+    // Not an admin: the escape hatch is not offered at all.
+    expect(screen.queryByText("portal.connections.types.api.label")).toBeNull();
+    expect(
+      screen.queryByText("portal.connections.categories.advanced.label"),
+    ).toBeNull();
+
+    rerender(
+      wrap(
+        <ConnectionModal
+          open
+          capabilities={{ customApi: true }}
+          onClose={vi.fn()}
+          onSaved={vi.fn()}
+        />,
+      ),
+    );
+    // Admin: reachable, but filed under Advanced rather than sitting among the vendors.
+    await waitFor(() =>
+      expect(
+        screen.getByText("portal.connections.types.api.label"),
+      ).toBeInTheDocument(),
+    );
+    expect(
+      screen.getByText("portal.connections.categories.advanced.label"),
+    ).toBeInTheDocument();
+  });
+
+  it("pins the custom API form even without capabilities, rather than blanking", async () => {
+    // The pipeline's Custom API step opens this modal pinned to "api" and passes no capabilities
+    // (it has none to hand). Filtering the pin through capabilities dropped the gated custom entry
+    // and left the picker with nothing - a blank screen. A pinned slot is already vetted upstream,
+    // so its form must always render.
+    render(
+      wrap(
+        <ConnectionModal
+          open
+          fixedTypeId="api"
+          onClose={vi.fn()}
+          onSaved={vi.fn()}
+        />,
+      ),
+    );
+
+    // Straight to the api form (its base URL field), not an empty grid.
+    await waitFor(() =>
+      expect(
+        screen.getByLabelText(
+          /portal\.connections\.types\.api\.fields\.baseUrl/,
+          {
+            exact: false,
+          },
+        ),
+      ).toBeInTheDocument(),
+    );
+    // The picker's search box is a tell for the empty-grid state; it must not be here.
+    expect(
+      screen.queryByPlaceholderText(
+        "portal.connections.picker2.searchPlaceholder",
+      ),
+    ).toBeNull();
+  });
+
+  it("searches across vendor aliases rather than just the label", async () => {
+    render(wrap(<ConnectionModal open onClose={vi.fn()} onSaved={vi.fn()} />));
+
+    // "siem" is nobody's product name - it is the job. Someone who wants audit logging should
+    // find Splunk without having to guess we filed it under "audit".
+    await userEvent.type(
+      screen.getByPlaceholderText(
+        "portal.connections.picker2.searchPlaceholder",
+      ),
+      "siem",
+    );
+
+    await waitFor(() =>
+      expect(
+        screen.getByText("portal.connections.types.splunk.label"),
+      ).toBeInTheDocument(),
+    );
+    // A flat result list, not every category heading it happens to fall under.
+    expect(screen.queryByText("portal.connections.types.s3.label")).toBeNull();
+  });
+
+  it("picking a vendor opens its form, and the back link returns to the grid", async () => {
+    render(wrap(<ConnectionModal open onClose={vi.fn()} onSaved={vi.fn()} />));
+
+    await userEvent.click(
+      screen.getByText("portal.connections.types.purview.label"),
+    );
+    // The chosen vendor's own fields, not a generic form.
+    await waitFor(() =>
+      expect(
+        screen.getByLabelText(
+          "portal.connections.types.purview.fields.tenantId",
+          {
+            exact: false,
+          },
+        ),
+      ).toBeInTheDocument(),
+    );
+
+    await userEvent.click(screen.getByText("portal.connections.picker2.back"));
+    await waitFor(() =>
+      expect(
+        screen.getByText("portal.connections.types.s3.label"),
+      ).toBeInTheDocument(),
+    );
+  });
+
+  it("says so when a search matches nothing", async () => {
+    render(wrap(<ConnectionModal open onClose={vi.fn()} onSaved={vi.fn()} />));
+
+    await userEvent.type(
+      screen.getByPlaceholderText(
+        "portal.connections.picker2.searchPlaceholder",
+      ),
+      "Fabrikam",
+    );
+
+    await waitFor(() =>
+      expect(
+        screen.getByText("portal.connections.picker2.noResultsTitle"),
+      ).toBeInTheDocument(),
+    );
+    // No cards left over from the unfiltered grid.
+    expect(screen.queryByText("portal.connections.types.s3.label")).toBeNull();
+  });
+});
diff --git a/frontend/editor/src/portal/components/sources/ConnectionModal.tsx b/frontend/editor/src/portal/components/sources/ConnectionModal.tsx
new file mode 100644
index 0000000000..b2845da0ba
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionModal.tsx
@@ -0,0 +1,221 @@
+import ArrowBackRoundedIcon from "@mui/icons-material/ArrowBackRounded";
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Banner, Button, Modal } from "@app/ui";
+import { errorMessage } from "@portal/api/http";
+import {
+  createIntegration,
+  updateIntegration,
+  type IntegrationCapabilities,
+  type IntegrationConfig,
+} from "@portal/api/integrations";
+import { ConnectionTypePicker } from "@portal/components/sources/ConnectionTypePicker";
+import { ConnectionForm } from "@portal/components/sources/ConnectionForm";
+import {
+  CREATABLE_CONNECTION_TYPES,
+  buildConnectionConfig,
+  connectionFormValid,
+  connectionFormValues,
+  connectionTypeOf,
+  creatableConnectionTypes,
+  emptyConnectionValues,
+  type CreatableConnectionType,
+} from "@portal/components/sources/connectionTypes";
+
+/**
+ * The one place connections are created and edited, for every type.
+ *
+ * Launched from the Connections tab, the source builder's picker, and the pipeline builder output,
+ * so setup is always a modal rather than inline splat. What can be created comes from the server's
+ * capabilities (`customApi`), not from anything decided here — hiding the option is presentation;
+ * the backend refuses the call regardless.
+ *
+ * Saving validates backend-side (schema, host, credentials). On edit the type is fixed: an
+ * integration's type is what its stored config means, so changing it would reinterpret the config
+ * rather than convert it.
+ */
+interface ConnectionModalProps {
+  open: boolean;
+  /** When set, edit this connection; otherwise create a new one. */
+  connection?: IntegrationConfig | null;
+  /** Pin the type (e.g. an S3 picker creating inline) instead of offering a choice. */
+  fixedTypeId?: string;
+  capabilities?: IntegrationCapabilities;
+  onClose: () => void;
+  /** The saved connection, so callers can select or refresh it. */
+  onSaved: (connection: IntegrationConfig) => void;
+}
+
+export function ConnectionModal({
+  open,
+  connection,
+  fixedTypeId,
+  capabilities,
+  onClose,
+  onSaved,
+}: ConnectionModalProps) {
+  const { t } = useTranslation();
+  const [type, setType] = useState<CreatableConnectionType | null>(null);
+  const [values, setValues] = useState<Record<string, string>>({ name: "" });
+  const [saving, setSaving] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  // "pick" chooses what to connect to; "form" fills it in.
+  const [mode, setMode] = useState<"pick" | "form">("pick");
+  const isEdit = Boolean(connection);
+
+  // A pinned slot is an explicit choice, already vetted where it was offered (the S3 field, or the
+  // custom-API operation, which is itself capability-gated). Resolve it from the full catalogue so
+  // the modal always has its form - the open picker still respects capabilities. Filtering the pin
+  // through capabilities is what blanked the modal: the custom-API type is gated, so it dropped out
+  // and left the picker with nothing to show.
+  const available = fixedTypeId
+    ? CREATABLE_CONNECTION_TYPES.filter((entry) => entry.id === fixedTypeId)
+    : creatableConnectionTypes(capabilities);
+  // The picker is only worth showing when there is actually a choice - not for a pinned slot
+  // (an S3 field on a source) or an edit, where the type is already decided.
+  const canPick = !isEdit && !fixedTypeId;
+
+  // Seed each time the modal opens (or its target changes).
+  useEffect(() => {
+    if (!open) return;
+    setError(null);
+    if (connection) {
+      setMode("form");
+      const existing = connectionTypeOf(
+        connection.integrationType,
+        connection.config,
+      );
+      setType(existing ?? null);
+      setValues(
+        existing
+          ? connectionFormValues(existing, {
+              name: connection.name,
+              config: connection.config ?? {},
+            })
+          : { name: connection.name },
+      );
+      return;
+    }
+    // A pinned slot (an S3 field on a source) has nothing to choose, so skip straight to the form.
+    // Stay on the form even if the pin resolves to nothing: the form branch shows a clear
+    // "unsupported type" banner, whereas the picker would render an empty grid - a blank screen.
+    const pinned = fixedTypeId ? (available[0] ?? null) : null;
+    setMode(fixedTypeId ? "form" : "pick");
+    setType(pinned);
+    setValues(pinned ? emptyConnectionValues(pinned) : { name: "" });
+    // `available` is derived from props each render; depending on it would reseed on every
+    // keystroke and wipe the form.
+  }, [open, connection, fixedTypeId, capabilities]);
+
+  function pickType(next: CreatableConnectionType) {
+    setType(next);
+    setValues((current) => ({
+      ...emptyConnectionValues(next),
+      name: current.name ?? "",
+    }));
+    setMode("form");
+  }
+
+  async function save() {
+    if (saving || !type || !connectionFormValid(type, values)) return;
+    setSaving(true);
+    setError(null);
+    try {
+      const config = buildConnectionConfig(type, values);
+      const saved = connection
+        ? await updateIntegration(connection.id, {
+            name: values.name.trim(),
+            config,
+          })
+        : // TEAM scope suits the team-based portal (the backend defaults the team to the
+          // caller's own). A teamless single-operator self-hosted deployment would need a
+          // USER/SERVER scope choice here - follow-up if the portal ships there.
+          await createIntegration({
+            integrationType: type.integrationType,
+            name: values.name.trim(),
+            scope: "TEAM",
+            config,
+          });
+      onSaved(saved);
+      onClose();
+    } catch (e) {
+      setError(errorMessage(e));
+    } finally {
+      setSaving(false);
+    }
+  }
+
+  return (
+    <Modal
+      open={open}
+      onClose={onClose}
+      // The grid wants room to breathe; a form is easier to read narrow.
+      width={mode === "pick" ? "lg" : "md"}
+      title={
+        isEdit
+          ? t("portal.connections.editTitle")
+          : mode === "pick"
+            ? t("portal.connections.picker2.heading")
+            : // Once something is chosen the title says what, so the form is self-describing.
+              t("portal.connections.createTitleFor", {
+                name: type ? t(type.labelKey) : "",
+              })
+      }
+      footer={
+        // The picker commits on click, so the modal's footer belongs to the form step alone.
+        mode === "form" ? (
+          <div className="portal-sources__connection-create-actions">
+            <Button
+              variant="tertiary"
+              size="sm"
+              disabled={saving}
+              onClick={onClose}
+            >
+              {t("portal.connections.picker.cancel")}
+            </Button>
+            <Button
+              size="sm"
+              loading={saving}
+              disabled={!type || !connectionFormValid(type, values)}
+              onClick={() => void save()}
+            >
+              {t("portal.connections.picker.save")}
+            </Button>
+          </div>
+        ) : undefined
+      }
+    >
+      {mode === "pick" ? (
+        <ConnectionTypePicker types={available} onPick={pickType} />
+      ) : (
+        <>
+          {canPick && (
+            // The choice is made in the picker now; this just gets them back to it, so the
+            // selection stays visible without a dropdown that duplicates the grid.
+            <Button
+              variant="quiet"
+              size="sm"
+              className="portal-sources__connection-back"
+              leftSection={<ArrowBackRoundedIcon fontSize="inherit" />}
+              onClick={() => setMode("pick")}
+            >
+              {t("portal.connections.picker2.back")}
+            </Button>
+          )}
+
+          {type ? (
+            <ConnectionForm type={type} values={values} onChange={setValues} />
+          ) : (
+            // An unknown stored type (e.g. MCP, which has no form) must not render a blank editor
+            // that would save an empty config over whatever is there.
+            <Banner
+              tone="warning"
+              description={t("portal.connections.unsupportedType")}
+            />
+          )}
+          {error && <Banner tone="danger" description={error} />}
+        </>
+      )}
+    </Modal>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sources/ConnectionPicker.test.tsx b/frontend/editor/src/portal/components/sources/ConnectionPicker.test.tsx
new file mode 100644
index 0000000000..f68c89156a
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionPicker.test.tsx
@@ -0,0 +1,111 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { ConnectionPicker } from "@portal/components/sources/ConnectionPicker";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: MantineProvider });
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+const fetchIntegrations = vi.fn();
+vi.mock("@portal/api/integrations", () => ({
+  fetchIntegrations: () => fetchIntegrations(),
+  fetchIntegrationCapabilities: () => Promise.resolve({ customApi: false }),
+  createIntegration: vi.fn(),
+  updateIntegration: vi.fn(),
+}));
+
+vi.mock("@portal/api/http", () => ({
+  errorMessage: (e: unknown) => String(e),
+}));
+
+// Three API connections sharing integrationType "API": a Slack webhook, a Jira account, and a
+// hand-authored custom API. Only presetId tells them apart.
+const CONNECTIONS = [
+  {
+    id: 1,
+    name: "Team Slack",
+    integrationType: "API",
+    config: { presetId: "slack" },
+  },
+  {
+    id: 2,
+    name: "Ops Jira",
+    integrationType: "API",
+    config: { presetId: "jira" },
+  },
+  {
+    id: 3,
+    name: "House API",
+    integrationType: "API",
+    config: { presetId: "api" },
+  },
+];
+
+describe("ConnectionPicker vendor filtering", () => {
+  beforeEach(() => {
+    fetchIntegrations.mockReset();
+    fetchIntegrations.mockResolvedValue(CONNECTIONS);
+  });
+
+  it("offers only the named vendor's accounts, plus custom API, never another webhook", async () => {
+    render(
+      <ConnectionPicker
+        value=""
+        onChange={vi.fn()}
+        integrationType="API"
+        createTypeId="jira"
+        presetId="jira"
+      />,
+    );
+
+    // Open the Mantine Select so its options render.
+    fireEvent.click(
+      await screen.findByPlaceholderText(
+        "portal.connections.picker.placeholder",
+      ),
+    );
+
+    // Jira (the vendor asked for) and the free-form custom API (which can point anywhere).
+    await waitFor(() =>
+      expect(screen.getByText("Ops Jira")).toBeInTheDocument(),
+    );
+    expect(screen.getByText("House API")).toBeInTheDocument();
+    // A Jira step must not offer a Slack webhook as its account.
+    expect(screen.queryByText("Team Slack")).toBeNull();
+  });
+
+  it("without a presetId falls back to every connection of the backend type", async () => {
+    render(
+      <ConnectionPicker
+        value=""
+        onChange={vi.fn()}
+        integrationType="API"
+        createTypeId="api"
+      />,
+    );
+
+    fireEvent.click(
+      await screen.findByPlaceholderText(
+        "portal.connections.picker.placeholder",
+      ),
+    );
+
+    await waitFor(() =>
+      expect(screen.getByText("Team Slack")).toBeInTheDocument(),
+    );
+    expect(screen.getByText("Ops Jira")).toBeInTheDocument();
+    expect(screen.getByText("House API")).toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx b/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx
new file mode 100644
index 0000000000..be54916726
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx
@@ -0,0 +1,103 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import { Banner, Button, Select } from "@app/ui";
+import { errorMessage } from "@portal/api/http";
+import {
+  fetchIntegrations,
+  type IntegrationConfig,
+  type IntegrationType,
+} from "@portal/api/integrations";
+import { ConnectionModal } from "@portal/components/sources/ConnectionModal";
+import { connectionTypeOf } from "@portal/components/sources/connectionTypes";
+
+/**
+ * Selects a stored connection of one type by id — an S3 bucket for a source, a Purview tenant for a
+ * labelling step. Creating a new one opens the shared modal (saved immediately and validated
+ * backend-side), so the parent only ever sees a real connection id.
+ *
+ * The type is fixed by the slot rather than chosen here: a field that wants a Purview tenant is not
+ * satisfied by an S3 bucket, so offering the choice would only invite an error the backend then has
+ * to reject.
+ */
+interface ConnectionPickerProps {
+  value: string;
+  onChange: (connectionId: string) => void;
+  /** The backend type this slot accepts. */
+  integrationType: IntegrationType;
+  /** The catalogue entry used when creating inline; defaults to the type's own. */
+  createTypeId: string;
+  /**
+   * The specific vendor this slot wants (e.g. "jira"). Seventeen presets share the "API" backend
+   * type, so filtering on `integrationType` alone offers a Jira step your Slack webhook. When set,
+   * only connections that resolve to this preset are shown - plus any free-form custom API
+   * connection, which can point anywhere and so fits any API operation.
+   */
+  presetId?: string;
+}
+
+export function ConnectionPicker({
+  value,
+  onChange,
+  integrationType,
+  createTypeId,
+  presetId,
+}: ConnectionPickerProps) {
+  const { t } = useTranslation();
+  const [connections, setConnections] = useState<IntegrationConfig[] | null>(
+    null,
+  );
+  const [modalOpen, setModalOpen] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  useEffect(() => {
+    let mounted = true;
+    fetchIntegrations()
+      .then((list) => {
+        if (!mounted) return;
+        // A connection fits this slot when the backend type matches and, if a vendor is named,
+        // when it is that vendor - or a free-form custom API connection, which points wherever
+        // its base URL says and so serves any API operation.
+        setConnections(
+          list.filter((c) => {
+            if (c.integrationType !== integrationType) return false;
+            if (!presetId) return true;
+            const resolved = connectionTypeOf(c.integrationType, c.config);
+            return resolved?.id === presetId || resolved?.kind === "custom";
+          }),
+        );
+      })
+      .catch((e) => {
+        if (mounted) setError(errorMessage(e));
+      });
+    return () => {
+      mounted = false;
+    };
+  }, [integrationType, presetId]);
+
+  return (
+    <div className="portal-sources__connection-picker">
+      <Select
+        value={value || null}
+        placeholder={t("portal.connections.picker.placeholder")}
+        options={(connections ?? []).map((connection) => ({
+          value: String(connection.id),
+          label: connection.name,
+        }))}
+        onChange={(selected) => onChange(selected ?? "")}
+      />
+      <Button variant="tertiary" size="sm" onClick={() => setModalOpen(true)}>
+        {t("portal.connections.picker.createNew")}
+      </Button>
+      {error && <Banner tone="danger" description={error} />}
+      <ConnectionModal
+        open={modalOpen}
+        fixedTypeId={createTypeId}
+        onClose={() => setModalOpen(false)}
+        onSaved={(created) => {
+          setConnections((list) => [...(list ?? []), created]);
+          onChange(String(created.id));
+        }}
+      />
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx b/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx
new file mode 100644
index 0000000000..7d1ea67fa9
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx
@@ -0,0 +1,142 @@
+import { useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import SearchRoundedIcon from "@mui/icons-material/SearchRounded";
+import {
+  CONNECTION_CATEGORIES,
+  searchConnectionTypes,
+  type ConnectionCategory,
+  type CreatableConnectionType,
+} from "@portal/components/sources/connectionTypes";
+
+/**
+ * Choose what to connect to.
+ *
+ * A dropdown was right for three vendors and is wrong for thirty: you cannot scan it, and it hides
+ * the answer to "do you support X?" behind a click. This is a searchable, categorised grid instead,
+ * grouped by the job someone is trying to do - because a person who has never heard of ConsignO
+ * still knows they want "signing".
+ *
+ * Search matches the vendor's own aliases and the job words too ("siem", "ocr", "notify"), because
+ * people search for the problem as often as the product.
+ */
+interface ConnectionTypePickerProps {
+  types: CreatableConnectionType[];
+  onPick: (type: CreatableConnectionType) => void;
+}
+
+export function ConnectionTypePicker({
+  types,
+  onPick,
+}: ConnectionTypePickerProps) {
+  const { t } = useTranslation();
+  const [query, setQuery] = useState("");
+
+  const matches = useMemo(
+    () => searchConnectionTypes(types, query, (key) => t(key)),
+    [types, query, t],
+  );
+
+  const grouped = useMemo(() => {
+    const map = new Map<ConnectionCategory, CreatableConnectionType[]>();
+    for (const type of matches) {
+      const list = map.get(type.category) ?? [];
+      list.push(type);
+      map.set(type.category, list);
+    }
+    return map;
+  }, [matches]);
+
+  const searching = query.trim() !== "";
+  // While searching, one flat relevance-ordered list reads better than seven tiny sections.
+  const sections: ConnectionCategory[] = searching
+    ? []
+    : CONNECTION_CATEGORIES.filter((c) => (grouped.get(c)?.length ?? 0) > 0);
+
+  return (
+    <div className="portal-conn-picker">
+      <div className="portal-conn-picker__search">
+        <SearchRoundedIcon className="portal-conn-picker__search-icon" />
+        <input
+          type="search"
+          autoFocus
+          value={query}
+          onChange={(e) => setQuery(e.target.value)}
+          placeholder={t("portal.connections.picker2.searchPlaceholder")}
+          aria-label={t("portal.connections.picker2.searchPlaceholder")}
+        />
+      </div>
+
+      {matches.length === 0 ? (
+        <div className="portal-conn-picker__empty">
+          <p className="portal-conn-picker__empty-title">
+            {t("portal.connections.picker2.noResultsTitle", { query })}
+          </p>
+          <p className="portal-conn-picker__empty-body">
+            {t("portal.connections.picker2.noResultsBody")}
+          </p>
+        </div>
+      ) : searching ? (
+        <Grid types={matches} onPick={onPick} />
+      ) : (
+        sections.map((category) => (
+          <section key={category} className="portal-conn-picker__section">
+            <h4 className="portal-conn-picker__section-title">
+              {t(`portal.connections.categories.${category}.label`)}
+            </h4>
+            <p className="portal-conn-picker__section-desc">
+              {t(`portal.connections.categories.${category}.description`)}
+            </p>
+            <Grid types={grouped.get(category) ?? []} onPick={onPick} />
+          </section>
+        ))
+      )}
+    </div>
+  );
+}
+
+function Grid({
+  types,
+  onPick,
+}: {
+  types: CreatableConnectionType[];
+  onPick: (type: CreatableConnectionType) => void;
+}) {
+  const { t } = useTranslation();
+  return (
+    <div className="portal-conn-picker__grid">
+      {types.map((type) => {
+        const label = t(type.labelKey);
+        return (
+          <button
+            key={type.id}
+            type="button"
+            className={
+              "portal-conn-picker__card" +
+              (type.kind === "custom"
+                ? " portal-conn-picker__card--advanced"
+                : "")
+            }
+            onClick={() => onPick(type)}
+          >
+            {/* A monogram rather than a logo: no third-party assets to ship, licence or keep
+                current, and it still gives each card something to recognise at a glance. Tinted
+                by category so the colour still carries meaning while searching, when the section
+                headings that would otherwise group them are gone. */}
+            <span
+              className={`portal-conn-picker__mark portal-conn-picker__mark--${type.category}`}
+              aria-hidden
+            >
+              {label.slice(0, 1)}
+            </span>
+            <span className="portal-conn-picker__card-text">
+              <span className="portal-conn-picker__card-name">{label}</span>
+              <span className="portal-conn-picker__card-desc">
+                {t(type.descriptionKey)}
+              </span>
+            </span>
+          </button>
+        );
+      })}
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx b/frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx
index 938dfa832b..157a674e5c 100644
--- a/frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx
@@ -23,6 +23,9 @@ vi.mock("react-i18next", () => ({
 const fetchS3Connections = vi.fn();
 const deleteIntegration = vi.fn();
 vi.mock("@portal/api/integrations", () => ({
+  fetchIntegrations: () => fetchS3Connections(),
+  // Custom-API authoring is a server decision; these tests assert the default view.
+  fetchIntegrationCapabilities: () => Promise.resolve({ customApi: false }),
   fetchS3Connections: () => fetchS3Connections(),
   deleteIntegration: (id: number) => deleteIntegration(id),
   createIntegration: vi.fn(),
diff --git a/frontend/editor/src/portal/components/sources/ConnectionsTab.tsx b/frontend/editor/src/portal/components/sources/ConnectionsTab.tsx
index 136f557032..c249afcbae 100644
--- a/frontend/editor/src/portal/components/sources/ConnectionsTab.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectionsTab.tsx
@@ -12,17 +12,20 @@ import {
 import { errorMessage } from "@portal/api/http";
 import {
   deleteIntegration,
-  fetchS3Connections,
+  fetchIntegrationCapabilities,
+  fetchIntegrations,
+  type IntegrationCapabilities,
   type IntegrationConfig,
 } from "@portal/api/integrations";
 import { SourcesIcon } from "@portal/components/icons";
-import { S3ConnectionModal } from "@portal/components/sources/S3ConnectionModal";
+import { ConnectionModal } from "@portal/components/sources/ConnectionModal";
+import { connectionTypeOf } from "@portal/components/sources/connectionTypes";
 
 /**
- * The Connections tab of the Sources page: stored S3 connections that sources
- * and pipeline outputs reference by id. Create/edit go through the shared
- * {@link S3ConnectionModal}; deleting one the backend still references returns a
- * 409, surfaced inline.
+ * The Connections tab of the Sources page: the stored connections that sources, pipeline outputs
+ * and integration steps reference by id — S3, Purview, ConsignO, and admin-authored custom APIs.
+ * Create/edit go through the shared {@link ConnectionModal}; deleting one the backend still
+ * references returns a 409, surfaced inline.
  */
 export function ConnectionsTab() {
   const { t } = useTranslation();
@@ -33,10 +36,13 @@ export function ConnectionsTab() {
   const [editing, setEditing] = useState<IntegrationConfig | null>(null);
   const [busy, setBusy] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  const [capabilities, setCapabilities] = useState<
+    IntegrationCapabilities | undefined
+  >(undefined);
 
   const refresh = useCallback(async () => {
     try {
-      setConnections(await fetchS3Connections());
+      setConnections(await fetchIntegrations());
     } catch (e) {
       setError(errorMessage(e));
     }
@@ -46,6 +52,12 @@ export function ConnectionsTab() {
     void refresh();
   }, [refresh]);
 
+  // What this caller may author. Left undefined on failure, which withholds the custom-API
+  // option rather than offering something the backend would refuse.
+  useEffect(() => {
+    fetchIntegrationCapabilities().then(setCapabilities, () => undefined);
+  }, []);
+
   function openCreate() {
     setEditing(null);
     setModalOpen(true);
@@ -78,18 +90,21 @@ export function ConnectionsTab() {
         render: (c) => <strong>{c.name}</strong>,
       },
       {
-        key: "bucket",
-        header: t("portal.connections.table.bucket"),
-        render: (c) => (
-          <span className="portal-sources__connections-bucket">
-            {String(c.config?.bucket ?? "")}
-          </span>
-        ),
+        key: "type",
+        header: t("portal.connections.table.type"),
+        render: (c) => {
+          const type = connectionTypeOf(c.integrationType, c.config);
+          return type ? t(type.labelKey) : c.integrationType;
+        },
       },
       {
-        key: "region",
-        header: t("portal.connections.table.region"),
-        render: (c) => String(c.config?.region ?? ""),
+        key: "detail",
+        header: t("portal.connections.table.detail"),
+        render: (c) => (
+          <span className="portal-sources__connections-bucket">
+            {connectionDetail(c)}
+          </span>
+        ),
       },
       {
         key: "actions",
@@ -128,17 +143,21 @@ export function ConnectionsTab() {
 
   return (
     <section className="portal-sources__connections">
-      <div className="portal-sources__connections-head">
-        <p className="portal-sources__connections-sub">
-          {t("portal.connections.subtitle")}
-        </p>
-        <Button
-          onClick={openCreate}
-          leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
-        >
-          {t("portal.connections.actions.new")}
-        </Button>
-      </div>
+      {/* The empty state carries its own heading and call to action, so the header row would
+          only double the button and the copy - show it once there are connections to head. */}
+      {!isEmpty && (
+        <div className="portal-sources__connections-head">
+          <p className="portal-sources__connections-sub">
+            {t("portal.connections.subtitle")}
+          </p>
+          <Button
+            onClick={openCreate}
+            leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
+          >
+            {t("portal.connections.actions.new")}
+          </Button>
+        </div>
+      )}
 
       {error && <Banner tone="danger" description={error} />}
 
@@ -175,12 +194,30 @@ export function ConnectionsTab() {
         />
       )}
 
-      <S3ConnectionModal
+      <ConnectionModal
         open={modalOpen}
         connection={editing}
+        capabilities={capabilities}
         onClose={() => setModalOpen(false)}
         onSaved={() => void refresh()}
       />
     </section>
   );
 }
+
+/**
+ * The one line that identifies a connection at a glance. Per type, because "bucket" means nothing
+ * to a Purview tenant and a base URL means nothing to S3. Never a secret: config arrives masked,
+ * but only non-secret keys are shown regardless.
+ */
+function connectionDetail(connection: IntegrationConfig): string {
+  const config = connection.config ?? {};
+  switch (connection.integrationType) {
+    case "S3":
+      return String(config.bucket ?? "");
+    case "PURVIEW":
+      return String(config.tenantId ?? "");
+    default:
+      return String(config.baseUrl ?? "");
+  }
+}
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionForm.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionForm.tsx
deleted file mode 100644
index 0158025d83..0000000000
--- a/frontend/editor/src/portal/components/sources/S3ConnectionForm.tsx
+++ /dev/null
@@ -1,116 +0,0 @@
-import { useTranslation } from "react-i18next";
-import { FormField, Input } from "@app/ui";
-
-/**
- * The connection-level S3 fields (per-use settings like prefix/mode live on the
- * source or output referencing the connection). Secrets are write-only: when
- * editing, the backend returns them masked and keeps the stored value if the
- * mask is sent back unchanged.
- */
-export interface S3ConnectionFormValues {
-  name: string;
-  bucket: string;
-  region: string;
-  endpoint: string;
-  accessKeyId: string;
-  secretAccessKey: string;
-}
-
-export const EMPTY_S3_CONNECTION: S3ConnectionFormValues = {
-  name: "",
-  bucket: "",
-  region: "us-east-1",
-  endpoint: "",
-  accessKeyId: "",
-  secretAccessKey: "",
-};
-
-export function s3ConnectionRequestConfig(
-  values: S3ConnectionFormValues,
-): Record<string, unknown> {
-  return {
-    bucket: values.bucket.trim(),
-    region: values.region.trim(),
-    endpoint: values.endpoint.trim(),
-    accessKeyId: values.accessKeyId.trim(),
-    secretAccessKey: values.secretAccessKey,
-  };
-}
-
-export function s3ConnectionFormValid(values: S3ConnectionFormValues): boolean {
-  return (
-    values.name.trim() !== "" &&
-    values.bucket.trim() !== "" &&
-    values.accessKeyId.trim() !== "" &&
-    values.secretAccessKey.trim() !== ""
-  );
-}
-
-interface S3ConnectionFormProps {
-  values: S3ConnectionFormValues;
-  onChange: (values: S3ConnectionFormValues) => void;
-}
-
-export function S3ConnectionForm({ values, onChange }: S3ConnectionFormProps) {
-  const { t } = useTranslation();
-  const set = (key: keyof S3ConnectionFormValues, value: string) =>
-    onChange({ ...values, [key]: value });
-
-  return (
-    <div className="portal-sources__connection-form">
-      <FormField label={t("portal.connections.s3.fields.name")} required>
-        <Input
-          value={values.name}
-          placeholder={t("portal.connections.s3.fields.namePlaceholder")}
-          onChange={(e) => set("name", e.target.value)}
-        />
-      </FormField>
-      <FormField
-        label={t("portal.sources.types.s3.fields.bucket.label")}
-        required
-      >
-        <Input
-          value={values.bucket}
-          placeholder="my-company-inbox"
-          onChange={(e) => set("bucket", e.target.value)}
-        />
-      </FormField>
-      <FormField label={t("portal.sources.types.s3.fields.region.label")}>
-        <Input
-          value={values.region}
-          placeholder="us-east-1"
-          onChange={(e) => set("region", e.target.value)}
-        />
-      </FormField>
-      <FormField
-        label={t("portal.sources.types.s3.fields.accessKeyId.label")}
-        required
-      >
-        <Input
-          value={values.accessKeyId}
-          onChange={(e) => set("accessKeyId", e.target.value)}
-        />
-      </FormField>
-      <FormField
-        label={t("portal.sources.types.s3.fields.secretAccessKey.label")}
-        required
-      >
-        <Input
-          type="password"
-          value={values.secretAccessKey}
-          onChange={(e) => set("secretAccessKey", e.target.value)}
-        />
-      </FormField>
-      <FormField
-        label={t("portal.sources.types.s3.fields.endpoint.label")}
-        helperText={t("portal.sources.types.s3.fields.endpoint.helperText")}
-      >
-        <Input
-          value={values.endpoint}
-          placeholder="https://s3.example.com"
-          onChange={(e) => set("endpoint", e.target.value)}
-        />
-      </FormField>
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionModal.test.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionModal.test.tsx
deleted file mode 100644
index e052243fe9..0000000000
--- a/frontend/editor/src/portal/components/sources/S3ConnectionModal.test.tsx
+++ /dev/null
@@ -1,131 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import {
-  fireEvent,
-  render as baseRender,
-  screen,
-  waitFor,
-} from "@testing-library/react";
-import { MantineProvider } from "@mantine/core";
-import { S3ConnectionModal } from "@portal/components/sources/S3ConnectionModal";
-import type { IntegrationConfig } from "@portal/api/integrations";
-
-const render = (ui: Parameters<typeof baseRender>[0]) =>
-  baseRender(ui, { wrapper: MantineProvider });
-
-vi.mock("react-i18next", () => ({
-  useTranslation: () => ({
-    t: (key: string) => key,
-    i18n: { changeLanguage: vi.fn() },
-  }),
-}));
-
-const createIntegration = vi.fn();
-const updateIntegration = vi.fn();
-vi.mock("@portal/api/integrations", () => ({
-  createIntegration: (...a: unknown[]) => createIntegration(...a),
-  updateIntegration: (...a: unknown[]) => updateIntegration(...a),
-}));
-
-function setField(labelPattern: RegExp, value: string) {
-  fireEvent.change(screen.getByLabelText(labelPattern), { target: { value } });
-}
-
-describe("S3ConnectionModal", () => {
-  beforeEach(() => {
-    createIntegration.mockReset();
-    updateIntegration.mockReset();
-  });
-
-  it("creates a team-scoped connection from the entered fields", async () => {
-    createIntegration.mockResolvedValue({ id: 5, name: "Claims bucket" });
-    const onSaved = vi.fn();
-    const onClose = vi.fn();
-    render(<S3ConnectionModal open onClose={onClose} onSaved={onSaved} />);
-
-    setField(/portal\.connections\.s3\.fields\.name/, "Claims bucket");
-    setField(/portal\.sources\.types\.s3\.fields\.bucket\.label/, "inbox");
-    setField(/portal\.sources\.types\.s3\.fields\.accessKeyId\.label/, "AKIA");
-    setField(
-      /portal\.sources\.types\.s3\.fields\.secretAccessKey\.label/,
-      "shh",
-    );
-    fireEvent.click(screen.getByText("portal.connections.picker.save"));
-
-    await waitFor(() => expect(createIntegration).toHaveBeenCalledTimes(1));
-    expect(createIntegration).toHaveBeenCalledWith({
-      integrationType: "S3",
-      name: "Claims bucket",
-      scope: "TEAM",
-      config: {
-        bucket: "inbox",
-        region: "us-east-1",
-        endpoint: "",
-        accessKeyId: "AKIA",
-        secretAccessKey: "shh",
-      },
-    });
-    await waitFor(() => expect(onSaved).toHaveBeenCalledTimes(1));
-    expect(onClose).toHaveBeenCalled();
-  });
-
-  it("round-trips a masked secret unchanged on edit (keeps the stored value)", async () => {
-    updateIntegration.mockResolvedValue({ id: 5, name: "Claims bucket" });
-    // The API returns secrets masked; the modal must resend the sentinel verbatim
-    // so the backend keeps the stored secret rather than overwriting it.
-    const connection = {
-      id: 5,
-      integrationType: "S3",
-      name: "Claims bucket",
-      config: {
-        bucket: "inbox",
-        region: "us-east-1",
-        accessKeyId: "AKIA",
-        secretAccessKey: "********",
-      },
-      canManage: true,
-    } as unknown as IntegrationConfig;
-
-    render(
-      <S3ConnectionModal
-        open
-        connection={connection}
-        onClose={vi.fn()}
-        onSaved={vi.fn()}
-      />,
-    );
-
-    const secret = screen.getByLabelText(
-      /portal\.sources\.types\.s3\.fields\.secretAccessKey\.label/,
-    ) as HTMLInputElement;
-    expect(secret.value).toBe("********");
-    // Change only the name; leave the masked secret untouched.
-    setField(/portal\.connections\.s3\.fields\.name/, "Renamed bucket");
-    fireEvent.click(screen.getByText("portal.connections.picker.save"));
-
-    await waitFor(() => expect(updateIntegration).toHaveBeenCalledTimes(1));
-    expect(updateIntegration).toHaveBeenCalledWith(
-      5,
-      expect.objectContaining({
-        name: "Renamed bucket",
-        config: expect.objectContaining({ secretAccessKey: "********" }),
-      }),
-    );
-  });
-
-  it("keeps save disabled until the required fields are present", () => {
-    render(<S3ConnectionModal open onClose={vi.fn()} onSaved={vi.fn()} />);
-    const save = () =>
-      screen.getByText("portal.connections.picker.save").closest("button");
-
-    expect(save()).toBeDisabled();
-    setField(/portal\.connections\.s3\.fields\.name/, "Only a name");
-    expect(save()).toBeDisabled();
-    setField(/portal\.sources\.types\.s3\.fields\.bucket\.label/, "inbox");
-    setField(/portal\.sources\.types\.s3\.fields\.accessKeyId\.label/, "AKIA");
-    setField(
-      /portal\.sources\.types\.s3\.fields\.secretAccessKey\.label/,
-      "shh",
-    );
-    expect(save()).not.toBeDisabled();
-  });
-});
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionModal.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionModal.tsx
deleted file mode 100644
index c4e649df4e..0000000000
--- a/frontend/editor/src/portal/components/sources/S3ConnectionModal.tsx
+++ /dev/null
@@ -1,127 +0,0 @@
-import { useEffect, useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Banner, Button, Modal } from "@app/ui";
-import { errorMessage } from "@portal/api/http";
-import {
-  createIntegration,
-  updateIntegration,
-  type IntegrationConfig,
-} from "@portal/api/integrations";
-import {
-  EMPTY_S3_CONNECTION,
-  S3ConnectionForm,
-  s3ConnectionFormValid,
-  s3ConnectionRequestConfig,
-  type S3ConnectionFormValues,
-} from "@portal/components/sources/S3ConnectionForm";
-
-/**
- * The one place S3 connections are created and edited. Launched from the
- * Connections tab, the source builder's connection picker, and the pipeline
- * builder output - so connection setup is always a modal, never inline splat.
- * Saving validates backend-side (schema, SSRF, credentials); on edit the secret
- * arrives masked and round-trips unchanged to keep the stored value.
- */
-interface S3ConnectionModalProps {
-  open: boolean;
-  /** When set, edit this connection; otherwise create a new one. */
-  connection?: IntegrationConfig | null;
-  onClose: () => void;
-  /** The saved connection, so callers can select or refresh it. */
-  onSaved: (connection: IntegrationConfig) => void;
-}
-
-export function S3ConnectionModal({
-  open,
-  connection,
-  onClose,
-  onSaved,
-}: S3ConnectionModalProps) {
-  const { t } = useTranslation();
-  const [form, setForm] = useState<S3ConnectionFormValues>(EMPTY_S3_CONNECTION);
-  const [saving, setSaving] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const isEdit = Boolean(connection);
-
-  // Seed the form each time the modal opens (or its target changes).
-  useEffect(() => {
-    if (!open) return;
-    if (connection) {
-      const config = connection.config ?? {};
-      setForm({
-        name: connection.name,
-        bucket: String(config.bucket ?? ""),
-        region: String(config.region ?? "us-east-1"),
-        endpoint: String(config.endpoint ?? ""),
-        accessKeyId: String(config.accessKeyId ?? ""),
-        secretAccessKey: String(config.secretAccessKey ?? ""),
-      });
-    } else {
-      setForm(EMPTY_S3_CONNECTION);
-    }
-    setError(null);
-  }, [open, connection]);
-
-  async function save() {
-    if (saving || !s3ConnectionFormValid(form)) return;
-    setSaving(true);
-    setError(null);
-    try {
-      const saved = connection
-        ? await updateIntegration(connection.id, {
-            name: form.name.trim(),
-            config: s3ConnectionRequestConfig(form),
-          })
-        : // TEAM scope suits the team-based portal (the backend defaults the team to the
-          // caller's own). A teamless single-operator self-hosted deployment would need a
-          // USER/SERVER scope choice here - follow-up if the portal ships there.
-          await createIntegration({
-            integrationType: "S3",
-            name: form.name.trim(),
-            scope: "TEAM",
-            config: s3ConnectionRequestConfig(form),
-          });
-      onSaved(saved);
-      onClose();
-    } catch (e) {
-      setError(errorMessage(e));
-    } finally {
-      setSaving(false);
-    }
-  }
-
-  return (
-    <Modal
-      open={open}
-      onClose={onClose}
-      title={t(
-        isEdit
-          ? "portal.connections.editTitle"
-          : "portal.connections.createTitle",
-      )}
-      footer={
-        <div className="portal-sources__connection-create-actions">
-          <Button
-            variant="tertiary"
-            size="sm"
-            disabled={saving}
-            onClick={onClose}
-          >
-            {t("portal.connections.picker.cancel")}
-          </Button>
-          <Button
-            size="sm"
-            loading={saving}
-            disabled={!s3ConnectionFormValid(form)}
-            onClick={() => void save()}
-          >
-            {t("portal.connections.picker.save")}
-          </Button>
-        </div>
-      }
-    >
-      <S3ConnectionForm values={form} onChange={setForm} />
-      {error && <Banner tone="danger" description={error} />}
-    </Modal>
-  );
-}
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx
index 8800fdfd15..1eb7c64db6 100644
--- a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx
+++ b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx
@@ -21,6 +21,9 @@ vi.mock("react-i18next", () => ({
 const fetchS3Connections = vi.fn();
 const createIntegration = vi.fn();
 vi.mock("@portal/api/integrations", () => ({
+  fetchIntegrations: () => fetchS3Connections(),
+  // Custom-API authoring is a server decision; these tests assert the default view.
+  fetchIntegrationCapabilities: () => Promise.resolve({ customApi: false }),
   fetchS3Connections: () => fetchS3Connections(),
   createIntegration: (...a: unknown[]) => createIntegration(...a),
   updateIntegration: vi.fn(),
@@ -42,24 +45,24 @@ describe("S3ConnectionPicker", () => {
       await screen.findByText("portal.connections.picker.createNew"),
     );
     fireEvent.change(
-      screen.getByLabelText(/portal\.connections\.s3\.fields\.name/),
+      screen.getByLabelText(/portal\.connections\.fields\.name/),
       { target: { value: "New bucket" } },
     );
     fireEvent.change(
       screen.getByLabelText(
-        /portal\.sources\.types\.s3\.fields\.bucket\.label/,
+        /portal\.connections\.types\.s3\.fields\.bucket\.label/,
       ),
       { target: { value: "inbox" } },
     );
     fireEvent.change(
       screen.getByLabelText(
-        /portal\.sources\.types\.s3\.fields\.accessKeyId\.label/,
+        /portal\.connections\.types\.s3\.fields\.accessKeyId\.label/,
       ),
       { target: { value: "AKIA" } },
     );
     fireEvent.change(
       screen.getByLabelText(
-        /portal\.sources\.types\.s3\.fields\.secretAccessKey\.label/,
+        /portal\.connections\.types\.s3\.fields\.secretAccessKey\.label/,
       ),
       { target: { value: "shh" } },
     );
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx
index 58b559e23b..cc36aef29e 100644
--- a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx
+++ b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx
@@ -1,17 +1,8 @@
-import { useEffect, useState } from "react";
-import { useTranslation } from "react-i18next";
-import { Banner, Button, Select } from "@app/ui";
-import { errorMessage } from "@portal/api/http";
-import {
-  fetchS3Connections,
-  type IntegrationConfig,
-} from "@portal/api/integrations";
-import { S3ConnectionModal } from "@portal/components/sources/S3ConnectionModal";
+import { ConnectionPicker } from "@portal/components/sources/ConnectionPicker";
 
 /**
- * Selects a stored S3 connection by id. Creating a new one opens the shared
- * connection modal (saved immediately and validated backend-side), so the
- * parent only ever sees a real connection id.
+ * The S3 slot on a source or pipeline output. A thin alias over {@link ConnectionPicker} so the
+ * `control: "s3Connection"` field descriptor keeps its name and call sites stay untouched.
  */
 interface S3ConnectionPickerProps {
   value: string;
@@ -22,50 +13,12 @@ export function S3ConnectionPicker({
   value,
   onChange,
 }: S3ConnectionPickerProps) {
-  const { t } = useTranslation();
-  const [connections, setConnections] = useState<IntegrationConfig[] | null>(
-    null,
-  );
-  const [modalOpen, setModalOpen] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-
-  useEffect(() => {
-    let mounted = true;
-    fetchS3Connections()
-      .then((list) => {
-        if (mounted) setConnections(list);
-      })
-      .catch((e) => {
-        if (mounted) setError(errorMessage(e));
-      });
-    return () => {
-      mounted = false;
-    };
-  }, []);
-
   return (
-    <div className="portal-sources__connection-picker">
-      <Select
-        value={value || null}
-        placeholder={t("portal.connections.picker.placeholder")}
-        options={(connections ?? []).map((connection) => ({
-          value: String(connection.id),
-          label: connection.name,
-        }))}
-        onChange={(selected) => onChange(selected ?? "")}
-      />
-      <Button variant="tertiary" size="sm" onClick={() => setModalOpen(true)}>
-        {t("portal.connections.picker.createNew")}
-      </Button>
-      {error && <Banner tone="danger" description={error} />}
-      <S3ConnectionModal
-        open={modalOpen}
-        onClose={() => setModalOpen(false)}
-        onSaved={(created) => {
-          setConnections((list) => [...(list ?? []), created]);
-          onChange(String(created.id));
-        }}
-      />
-    </div>
+    <ConnectionPicker
+      value={value}
+      onChange={onChange}
+      integrationType="S3"
+      createTypeId="s3"
+    />
   );
 }
diff --git a/frontend/editor/src/portal/components/sources/connectionTypes.test.ts b/frontend/editor/src/portal/components/sources/connectionTypes.test.ts
new file mode 100644
index 0000000000..8de257e88b
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/connectionTypes.test.ts
@@ -0,0 +1,217 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  CREATABLE_CONNECTION_TYPES,
+  PRESET_ID_KEY,
+  buildConnectionConfig,
+  connectionFormValues,
+  connectionTypeOf,
+  creatableConnectionTypes,
+  isFieldVisible,
+} from "@portal/components/sources/connectionTypes";
+
+const byId = (id: string) => {
+  const type = CREATABLE_CONNECTION_TYPES.find((entry) => entry.id === id);
+  if (!type) throw new Error(`no connection type ${id}`);
+  return type;
+};
+
+describe("connection type catalogue", () => {
+  it("offers the vendor presets to everyone", () => {
+    const offered = creatableConnectionTypes({ customApi: false }).map(
+      (t) => t.id,
+    );
+
+    expect(offered).toContain("s3");
+    expect(offered).toContain("purview");
+    expect(offered).toContain("consigno");
+  });
+
+  it("offers custom API only when the server says the caller may author one", () => {
+    expect(
+      creatableConnectionTypes({ customApi: true }).map((t) => t.id),
+    ).toContain("api");
+    expect(
+      creatableConnectionTypes({ customApi: false }).map((t) => t.id),
+    ).not.toContain("api");
+    // Capabilities not loaded yet: withhold rather than offer something that would be refused.
+    expect(creatableConnectionTypes(undefined).map((t) => t.id)).not.toContain(
+      "api",
+    );
+  });
+
+  it("only the custom API entry is gated", () => {
+    const gated = CREATABLE_CONNECTION_TYPES.filter(
+      (t) => t.requiresCustomApi,
+    ).map((t) => t.id);
+    expect(gated).toEqual(["api"]);
+  });
+});
+
+describe("buildConnectionConfig", () => {
+  it("bakes the ConsignO preset in and nests the operator's credentials", () => {
+    const config = buildConnectionConfig(byId("consigno"), {
+      baseUrl: "https://acme.consignocloud.com/api/v1",
+      "loginHeaders.X-Client-Id": "client-abc",
+      "loginHeaders.X-Client-Secret": "client-xyz",
+      "loginBody.username": "api@acme.test",
+      "loginBody.password": "s3cr3t",
+      "loginBody.tenantId": "acme",
+    });
+
+    // The vendor's mechanics come from the preset, not from the operator.
+    expect(config.authType).toBe("TOKEN_LOGIN");
+    expect(config.loginPath).toBe("/auth/login");
+    expect(config.tokenResponseHeader).toBe("X-Auth-Token");
+    expect(config.tokenHeaderName).toBe("X-Auth-Token");
+
+    // Dotted keys nest, so SecretMasker can recurse and mask password/secret by key name.
+    expect(config.loginBody).toEqual({
+      username: "api@acme.test",
+      password: "s3cr3t",
+      tenantId: "acme",
+    });
+    expect(config.loginHeaders).toEqual({
+      "X-Client-Id": "client-abc",
+      "X-Client-Secret": "client-xyz",
+    });
+  });
+
+  it("omits blanks rather than sending empty values", () => {
+    const config = buildConnectionConfig(byId("purview"), {
+      tenantId: "cb46c030-1825-4e81-a295-151c039dbf02",
+      clientId: "",
+      clientSecret: "",
+    });
+
+    // presetId records which preset built this, so a saved connection can be mapped back to the
+    // right form; the blank optional fields are still omitted.
+    expect(config).toEqual({
+      presetId: "purview",
+      tenantId: "cb46c030-1825-4e81-a295-151c039dbf02",
+    });
+  });
+
+  it("splits the result-host allowlist into a list", () => {
+    const config = buildConnectionConfig(byId("api"), {
+      baseUrl: "https://api.vendor.example",
+      authType: "NONE",
+      resultUrlHosts: "cdn.vendor.example, files.vendor.example",
+    });
+
+    expect(config.resultUrlHosts).toEqual([
+      "cdn.vendor.example",
+      "files.vendor.example",
+    ]);
+  });
+
+  it("carries no preset for the free-form type", () => {
+    expect(byId("api").presetConfig).toBeUndefined();
+  });
+});
+
+describe("isFieldVisible", () => {
+  const api = byId("api");
+  const field = (key: string) => {
+    const found = api.fields.find((f) => f.key === key);
+    if (!found) throw new Error(`no field ${key}`);
+    return found;
+  };
+
+  it("shows auth fields only for the auth type that uses them", () => {
+    expect(isFieldVisible(field("token"), { authType: "BEARER" })).toBe(true);
+    expect(isFieldVisible(field("token"), { authType: "BASIC" })).toBe(false);
+    expect(isFieldVisible(field("username"), { authType: "BASIC" })).toBe(true);
+    expect(isFieldVisible(field("username"), { authType: "NONE" })).toBe(false);
+    expect(
+      isFieldVisible(field("loginPath"), { authType: "TOKEN_LOGIN" }),
+    ).toBe(true);
+    expect(isFieldVisible(field("loginPath"), { authType: "BEARER" })).toBe(
+      false,
+    );
+  });
+
+  it("shows unconditional fields always", () => {
+    expect(isFieldVisible(field("baseUrl"), {})).toBe(true);
+  });
+});
+
+describe("resolving a stored connection back to its preset", () => {
+  it("keeps a Discord connection as Discord, not the first API preset", () => {
+    // Seventeen presets share integrationType "API". Matching on that alone returned whichever
+    // came first in the catalogue, so every API connection displayed as Cloudmersive - and the
+    // edit form then rewrote a Discord webhook as a Cloudmersive endpoint on save.
+    const discord = CREATABLE_CONNECTION_TYPES.find((t) => t.id === "discord")!;
+    const config = buildConnectionConfig(discord, {
+      name: "Team Discord",
+      baseUrl: "https://discord.com/api/webhooks/1/abc",
+    });
+
+    expect(connectionTypeOf("API", config)?.id).toBe("discord");
+  });
+
+  it("round-trips an edit without destroying the stored config", () => {
+    const discord = CREATABLE_CONNECTION_TYPES.find((t) => t.id === "discord")!;
+    const url = "https://discord.com/api/webhooks/1/abc";
+    const config = buildConnectionConfig(discord, { name: "d", baseUrl: url });
+
+    const reopened = connectionTypeOf("API", config)!;
+    const values = connectionFormValues(reopened, { name: "d", config });
+
+    expect(buildConnectionConfig(reopened, values).baseUrl).toBe(url);
+  });
+
+  it("recovers a markerless Discord connection from its webhook host", () => {
+    // A connection made before the marker carries no presetId, only its URL. Discord webhooks are
+    // always discord.com, so the host names the vendor - it must not show as "Custom API".
+    const legacy = { baseUrl: "https://discord.com/api/webhooks/1/abc" };
+    expect(connectionTypeOf("API", legacy)?.id).toBe("discord");
+  });
+
+  it("recovers a Teams connection from a webhook subdomain", () => {
+    // Teams posts from a per-tenant subdomain, so the match is on the domain suffix, not the host.
+    const legacy = {
+      baseUrl: "https://acme.webhook.office.com/webhookb2/abc/IncomingWebhook",
+    };
+    expect(connectionTypeOf("API", legacy)?.id).toBe("teams");
+  });
+
+  it("falls back to the free-form entry when the host names no vendor", () => {
+    // Naming a specific vendor would be a guess, and the wrong guess loses data; the custom entry
+    // shows the base URL and auth it really has.
+    const legacy = { baseUrl: "https://api.acme.test/v2", authType: "BEARER" };
+    const resolved = connectionTypeOf("API", legacy)!;
+
+    expect(resolved.kind).toBe("custom");
+    const values = connectionFormValues(resolved, {
+      name: "l",
+      config: legacy,
+    });
+    expect(buildConnectionConfig(resolved, values).baseUrl).toBe(
+      legacy.baseUrl,
+    );
+  });
+
+  it("does not guess between vendors that share a host", () => {
+    // The two Cloudmersive presets both live at api.cloudmersive.com, so a markerless connection
+    // there is genuinely ambiguous - resolve to the safe free-form form, not one of them at random.
+    const legacy = {
+      baseUrl: "https://api.cloudmersive.com",
+      authType: "HEADER",
+    };
+    expect(connectionTypeOf("API", legacy)?.kind).toBe("custom");
+  });
+
+  it("still prefers the marker over the host when both are present", () => {
+    // A webhook preset pointed at a custom relay: the marker is authoritative, not the URL.
+    const config = {
+      [PRESET_ID_KEY]: "slack",
+      baseUrl: "https://discord.com/x",
+    };
+    expect(connectionTypeOf("API", config)?.id).toBe("slack");
+  });
+
+  it("still resolves exactly when only one preset owns the type", () => {
+    expect(connectionTypeOf("PURVIEW", {})?.id).toBe("purview");
+  });
+});
diff --git a/frontend/editor/src/portal/components/sources/connectionTypes.ts b/frontend/editor/src/portal/components/sources/connectionTypes.ts
new file mode 100644
index 0000000000..ad5dfa3f17
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/connectionTypes.ts
@@ -0,0 +1,844 @@
+/**
+ * The connection types an operator can set up, as data rather than components.
+ *
+ * Mirrors {@link CREATABLE_SOURCE_TYPES} deliberately: a vendor is added by describing its fields,
+ * not by writing a form. That is what makes "support a load of things out of the box" true rather
+ * than aspirational — a preset is an entry here plus, at most, a body template.
+ *
+ * Two kinds of entry:
+ *
+ * - **Presets** (S3, Purview, ConsignO) — a fixed shape. The operator supplies credentials and
+ *   whichever endpoint their tenant lives on; they cannot change what the integration *does*.
+ * - **Custom API** — a free-form base URL, path, body and headers. This is authoring power: it can
+ *   aim the server at any host, so the backend restricts it to admins and lets an operator withdraw
+ *   it entirely (`policies.allowCustomApiIntegrations`). `requiresCustomApi` only decides whether to
+ *   *offer* it; `IntegrationConfigService` refuses the call regardless of what the client believed.
+ */
+
+import type { IntegrationType } from "@portal/api/integrations";
+
+/** One configurable field. `control` mirrors the source builder's vocabulary. */
+export interface ConnectionFieldDef {
+  key: string;
+  labelKey: string;
+  control: "text" | "password" | "select" | "textarea" | "hostList";
+  required?: boolean;
+  placeholderKey?: string;
+  helperTextKey?: string;
+  options?: { value: string; labelKey: string }[];
+  defaultValue?: string;
+  /** Shown only when another field has one of these values, e.g. auth fields per authType. */
+  visibleWhen?: { key: string; oneOf: string[] };
+}
+
+export interface CreatableConnectionType {
+  /** Stable id; distinct from `integrationType` so several presets can share a backend type. */
+  id: string;
+  integrationType: IntegrationType;
+  /**
+   * "preset" — a supported vendor, the primary path: pick it and fill in credentials. "custom" —
+   * the free-form escape hatch, deliberately set apart because it needs a developer's grasp of the
+   * target API, and steering everyone here would both confuse non-technical operators and give away
+   * the customisation an enterprise deal is negotiated around. Most people should never need it;
+   * the answer to "my vendor isn't listed" is to request it, not to build it.
+   */
+  kind: "preset" | "custom";
+  /** Groups the picker; also what someone scans by when they don't know the vendor's name. */
+  category: ConnectionCategory;
+  labelKey: string;
+  descriptionKey: string;
+  /**
+   * Extra words search should match: former names (HelloSign), the job someone is trying to do
+   * ("ocr", "notify"), and the stack it belongs to ("microsoft 365"). People search for the problem
+   * as often as the product.
+   */
+  searchTerms?: string[];
+  /** Config baked in rather than asked for — what makes a preset a preset. */
+  presetConfig?: Record<string, unknown>;
+  /**
+   * Hostnames that identify this vendor from a stored connection whose `presetId` is absent (one
+   * made before the marker, or through the API). A Discord webhook is always discord.com, so the
+   * URL recovers the vendor with no marker. Matched against the host and any subdomain of it.
+   */
+  identifyHosts?: string[];
+  /** True for entries that need admin + the server flag; see the module comment. */
+  requiresCustomApi?: boolean;
+  fields: ConnectionFieldDef[];
+}
+
+export type ConnectionCategory =
+  | "storage"
+  | "signing"
+  | "security"
+  | "audit"
+  | "notify"
+  | "advanced";
+
+/** Display order of the category sections in the picker. */
+// Substantial sections first; the two deliberate one-card sections (signing = the ConsignO
+// flagship, advanced = the admin escape hatch) close the list rather than opening it.
+export const CONNECTION_CATEGORIES: ConnectionCategory[] = [
+  "storage",
+  "security",
+  "audit",
+  "notify",
+  "signing",
+  "advanced",
+];
+
+const PREFIX = "portal.connections.types";
+const COMMON = "portal.connections.commonFields";
+
+const S3_FIELDS: ConnectionFieldDef[] = [
+  {
+    key: "bucket",
+    labelKey: `${PREFIX}.s3.fields.bucket.label`,
+    control: "text",
+    required: true,
+  },
+  {
+    key: "region",
+    labelKey: `${PREFIX}.s3.fields.region.label`,
+    control: "text",
+    defaultValue: "us-east-1",
+  },
+  {
+    key: "endpoint",
+    labelKey: `${PREFIX}.s3.fields.endpoint.label`,
+    control: "text",
+    helperTextKey: `${PREFIX}.s3.fields.endpoint.helperText`,
+  },
+  {
+    key: "accessKeyId",
+    labelKey: `${PREFIX}.s3.fields.accessKeyId.label`,
+    control: "text",
+    required: true,
+  },
+  {
+    key: "secretAccessKey",
+    labelKey: `${PREFIX}.s3.fields.secretAccessKey.label`,
+    control: "password",
+    required: true,
+  },
+];
+
+const PURVIEW_FIELDS: ConnectionFieldDef[] = [
+  {
+    key: "tenantId",
+    labelKey: `${PREFIX}.purview.fields.tenantId.label`,
+    control: "text",
+    required: true,
+    placeholderKey: `${PREFIX}.purview.fields.tenantId.placeholder`,
+    helperTextKey: `${PREFIX}.purview.fields.tenantId.helperText`,
+  },
+  // Optional: labelling is local and needs only the tenant id. These buy the label picker.
+  {
+    key: "clientId",
+    labelKey: `${PREFIX}.purview.fields.clientId.label`,
+    control: "text",
+    helperTextKey: `${PREFIX}.purview.fields.clientId.helperText`,
+  },
+  {
+    key: "clientSecret",
+    labelKey: `${PREFIX}.purview.fields.clientSecret.label`,
+    control: "password",
+  },
+];
+
+const CONSIGNO_FIELDS: ConnectionFieldDef[] = [
+  {
+    key: "baseUrl",
+    labelKey: `${PREFIX}.consigno.fields.baseUrl.label`,
+    control: "text",
+    required: true,
+    placeholderKey: `${PREFIX}.consigno.fields.baseUrl.placeholder`,
+    helperTextKey: `${PREFIX}.consigno.fields.baseUrl.helperText`,
+  },
+  {
+    key: "loginHeaders.X-Client-Id",
+    labelKey: `${PREFIX}.consigno.fields.clientId.label`,
+    control: "text",
+    required: true,
+  },
+  {
+    key: "loginHeaders.X-Client-Secret",
+    labelKey: `${PREFIX}.consigno.fields.clientSecret.label`,
+    control: "password",
+    required: true,
+  },
+  {
+    key: "loginBody.username",
+    labelKey: `${PREFIX}.consigno.fields.username.label`,
+    control: "text",
+    required: true,
+  },
+  {
+    key: "loginBody.password",
+    labelKey: `${PREFIX}.consigno.fields.password.label`,
+    control: "password",
+    required: true,
+  },
+  {
+    key: "loginBody.tenantId",
+    labelKey: `${PREFIX}.consigno.fields.tenantId.label`,
+    control: "text",
+    helperTextKey: `${PREFIX}.consigno.fields.tenantId.helperText`,
+  },
+];
+
+const CUSTOM_API_FIELDS: ConnectionFieldDef[] = [
+  {
+    key: "baseUrl",
+    labelKey: `${PREFIX}.api.fields.baseUrl.label`,
+    control: "text",
+    required: true,
+    placeholderKey: `${PREFIX}.api.fields.baseUrl.placeholder`,
+    helperTextKey: `${PREFIX}.api.fields.baseUrl.helperText`,
+  },
+  {
+    key: "authType",
+    labelKey: `${PREFIX}.api.fields.authType.label`,
+    control: "select",
+    defaultValue: "NONE",
+    options: [
+      {
+        value: "NONE",
+        labelKey: `${PREFIX}.api.fields.authType.options.none.label`,
+      },
+      {
+        value: "BEARER",
+        labelKey: `${PREFIX}.api.fields.authType.options.bearer.label`,
+      },
+      {
+        value: "BASIC",
+        labelKey: `${PREFIX}.api.fields.authType.options.basic.label`,
+      },
+      {
+        value: "HEADER",
+        labelKey: `${PREFIX}.api.fields.authType.options.header.label`,
+      },
+      {
+        value: "TOKEN_LOGIN",
+        labelKey: `${PREFIX}.api.fields.authType.options.tokenLogin.label`,
+      },
+    ],
+  },
+  {
+    key: "token",
+    labelKey: `${PREFIX}.api.fields.token.label`,
+    control: "password",
+    required: true,
+    visibleWhen: { key: "authType", oneOf: ["BEARER", "HEADER"] },
+  },
+  {
+    key: "headerName",
+    labelKey: `${PREFIX}.api.fields.headerName.label`,
+    control: "text",
+    required: true,
+    placeholderKey: `${PREFIX}.api.fields.headerName.placeholder`,
+    visibleWhen: { key: "authType", oneOf: ["HEADER"] },
+  },
+  {
+    key: "username",
+    labelKey: `${PREFIX}.api.fields.username.label`,
+    control: "text",
+    required: true,
+    visibleWhen: { key: "authType", oneOf: ["BASIC"] },
+  },
+  {
+    key: "password",
+    labelKey: `${PREFIX}.api.fields.password.label`,
+    control: "password",
+    required: true,
+    visibleWhen: { key: "authType", oneOf: ["BASIC"] },
+  },
+  {
+    key: "loginPath",
+    labelKey: `${PREFIX}.api.fields.loginPath.label`,
+    control: "text",
+    required: true,
+    placeholderKey: `${PREFIX}.api.fields.loginPath.placeholder`,
+    visibleWhen: { key: "authType", oneOf: ["TOKEN_LOGIN"] },
+  },
+  {
+    key: "tokenResponseHeader",
+    labelKey: `${PREFIX}.api.fields.tokenResponseHeader.label`,
+    control: "text",
+    required: true,
+    helperTextKey: `${PREFIX}.api.fields.tokenResponseHeader.helperText`,
+    visibleWhen: { key: "authType", oneOf: ["TOKEN_LOGIN"] },
+  },
+  {
+    key: "tokenHeaderName",
+    labelKey: `${PREFIX}.api.fields.tokenHeaderName.label`,
+    control: "text",
+    required: true,
+    visibleWhen: { key: "authType", oneOf: ["TOKEN_LOGIN"] },
+  },
+  {
+    key: "resultUrlHosts",
+    labelKey: `${PREFIX}.api.fields.resultUrlHosts.label`,
+    control: "hostList",
+    helperTextKey: `${PREFIX}.api.fields.resultUrlHosts.helperText`,
+  },
+];
+
+/**
+ * Fields shared across vendors. "API key" reads the same for VirusTotal and Mindee, so it is
+ * translated once here rather than 25 times under each vendor's namespace; only genuinely
+ * vendor-specific wording (Purview's "Directory (tenant) ID") lives under the vendor.
+ */
+const field = {
+  /** Tenant-specific server URL. `id` names the vendor whose placeholder/help to show. */
+  baseUrl: (id: string): ConnectionFieldDef => ({
+    key: "baseUrl",
+    labelKey: `${COMMON}.baseUrl.label`,
+    control: "text",
+    required: true,
+    placeholderKey: `${PREFIX}.${id}.baseUrlPlaceholder`,
+    helperTextKey: `${COMMON}.baseUrl.helperText`,
+  }),
+  /** The URL a vendor hands you to post to (Teams/Zapier/webhook), which IS the whole endpoint. */
+  webhookUrl: (id: string): ConnectionFieldDef => ({
+    key: "baseUrl",
+    labelKey: `${COMMON}.webhookUrl.label`,
+    control: "text",
+    required: true,
+    placeholderKey: `${PREFIX}.${id}.baseUrlPlaceholder`,
+    helperTextKey: `${COMMON}.webhookUrl.helperText`,
+  }),
+  apiKey: (): ConnectionFieldDef => ({
+    key: "token",
+    labelKey: `${COMMON}.apiKey.label`,
+    control: "password",
+    required: true,
+  }),
+  accessToken: (): ConnectionFieldDef => ({
+    key: "token",
+    labelKey: `${COMMON}.accessToken.label`,
+    control: "password",
+    required: true,
+    helperTextKey: `${COMMON}.accessToken.helperText`,
+  }),
+  username: (labelKey = `${COMMON}.username.label`): ConnectionFieldDef => ({
+    key: "username",
+    labelKey,
+    control: "text",
+    required: true,
+  }),
+  password: (labelKey = `${COMMON}.password.label`): ConnectionFieldDef => ({
+    key: "password",
+    labelKey,
+    control: "password",
+    required: true,
+  }),
+};
+
+/**
+ * A vendor whose integration is "an HTTP API with known mechanics". The auth shape, and the base
+ * URL when the vendor has a single global one, are baked into `preset`; the operator supplies only
+ * credentials. Adding a vendor is this entry plus two lines of copy — no component, no backend.
+ */
+function apiPreset(spec: {
+  id: string;
+  category: ConnectionCategory;
+  preset: Record<string, unknown>;
+  fields: ConnectionFieldDef[];
+  searchTerms?: string[];
+  identifyHosts?: string[];
+}): CreatableConnectionType {
+  return {
+    id: spec.id,
+    integrationType: "API",
+    kind: "preset",
+    category: spec.category,
+    labelKey: `${PREFIX}.${spec.id}.label`,
+    descriptionKey: `${PREFIX}.${spec.id}.description`,
+    searchTerms: spec.searchTerms,
+    presetConfig: spec.preset,
+    identifyHosts: spec.identifyHosts,
+    fields: spec.fields,
+  };
+}
+
+/**
+ * Vendors whose HTTP contract has been verified against their published documentation.
+ *
+ * The bar is deliberately narrow, because the pipeline can make exactly ONE call per step and
+ * carries nothing from one step to the next. A vendor earns a place here only if it is:
+ *
+ * 1. **one call** - no submit-then-poll, no upload-then-attach;
+ * 2. **a static credential** - no OAuth2 refresh, no per-request signature;
+ * 3. **useful in that one call** - the answer comes back, or the call itself is the point.
+ *
+ * That excludes most of the obvious names. Every e-signature vendor is multi-call (create, send,
+ * then retrieve the signed file later). Azure Document Intelligence, ABBYY, VirusTotal, Rossum and
+ * Mindee are all submit-then-poll. SharePoint, Drive, Box, Salesforce and the rest are OAuth. They
+ * are not missing by oversight - they cannot work correctly here yet, and listing them would be a
+ * promise the engine cannot keep.
+ */
+const API_PRESETS: CreatableConnectionType[] = [
+  // ---- malware & active content -------------------------------------------------------------
+  apiPreset({
+    id: "cloudmersive",
+    category: "security",
+    preset: {
+      authType: "HEADER",
+      headerName: "Apikey",
+      baseUrl: "https://api.cloudmersive.com",
+    },
+    fields: [field.apiKey()],
+    searchTerms: ["malware", "antivirus", "virus", "scan", "threat"],
+  }),
+  apiPreset({
+    id: "cloudmersiveadvanced",
+    category: "security",
+    preset: {
+      authType: "HEADER",
+      headerName: "Apikey",
+      baseUrl: "https://api.cloudmersive.com",
+    },
+    fields: [field.apiKey()],
+    searchTerms: [
+      "macro",
+      "executable",
+      "script",
+      "active content",
+      "malware",
+      "ole",
+      "scan",
+    ],
+  }),
+  apiPreset({
+    id: "clamav",
+    category: "security",
+    // Self-hosted: no vendor account, no key, and the document never leaves the estate - which is
+    // the whole argument for on-prem customers who cannot send files to a cloud scanner.
+    preset: { authType: "NONE" },
+    fields: [field.baseUrl("clamav")],
+    searchTerms: [
+      "virus",
+      "malware",
+      "antivirus",
+      "scan",
+      "self-hosted",
+      "on-prem",
+    ],
+  }),
+
+  // ---- audit & SIEM ---------------------------------------------------------------------------
+  apiPreset({
+    id: "splunk",
+    category: "audit",
+    preset: {
+      authType: "HEADER",
+      headerName: "Authorization",
+      headerPrefix: "Splunk",
+    },
+    fields: [field.baseUrl("splunk"), field.apiKey()],
+    searchTerms: ["siem", "hec", "audit", "log", "event", "compliance"],
+  }),
+  apiPreset({
+    id: "elastic",
+    category: "audit",
+    preset: {
+      authType: "HEADER",
+      headerName: "Authorization",
+      headerPrefix: "ApiKey",
+    },
+    fields: [field.baseUrl("elastic"), field.apiKey()],
+    searchTerms: ["siem", "elasticsearch", "kibana", "audit", "log", "index"],
+  }),
+  apiPreset({
+    id: "sumologic",
+    category: "audit",
+    preset: { authType: "NONE" },
+    fields: [field.webhookUrl("sumologic")],
+    searchTerms: ["siem", "audit", "log", "collector"],
+  }),
+
+  // ---- PII detection ---------------------------------------------------------------------------
+  apiPreset({
+    id: "presidio",
+    category: "security",
+    // Self-hosted and unauthenticated by design; takes TEXT, so it needs extracted text rather
+    // than the document itself.
+    preset: { authType: "NONE" },
+    fields: [field.baseUrl("presidio")],
+    searchTerms: ["pii", "dlp", "sensitive", "redact", "gdpr", "self-hosted"],
+  }),
+
+  // ---- email the document ----------------------------------------------------------------------
+  apiPreset({
+    id: "sendgrid",
+    category: "notify",
+    preset: { authType: "BEARER", baseUrl: "https://api.sendgrid.com/v3" },
+    fields: [field.apiKey()],
+    searchTerms: ["email", "mail", "send", "attachment", "twilio"],
+  }),
+  apiPreset({
+    id: "mailgun",
+    category: "notify",
+    // Region matters: EU domains must use api.eu.mailgun.net and are not auto-detected.
+    preset: { authType: "BASIC", username: "api" },
+    fields: [
+      field.baseUrl("mailgun"),
+      field.password(`${COMMON}.apiKey.label`),
+    ],
+    searchTerms: ["email", "mail", "send", "attachment"],
+  }),
+
+  // ---- notify ------------------------------------------------------------------------------------
+  apiPreset({
+    id: "slack",
+    category: "notify",
+    preset: { authType: "NONE" },
+    fields: [field.webhookUrl("slack")],
+    searchTerms: ["chat", "notify", "message", "alert"],
+    identifyHosts: ["slack.com"],
+  }),
+  apiPreset({
+    id: "teams",
+    category: "notify",
+    preset: { authType: "NONE" },
+    fields: [field.webhookUrl("teams")],
+    searchTerms: ["microsoft", "chat", "notify", "message", "alert"],
+    // Classic incoming webhooks post from *.webhook.office.com; Workflows from *.logic.azure.com.
+    identifyHosts: ["webhook.office.com", "logic.azure.com"],
+  }),
+  apiPreset({
+    id: "discord",
+    category: "notify",
+    preset: { authType: "NONE" },
+    fields: [field.webhookUrl("discord")],
+    searchTerms: ["chat", "notify", "message"],
+    identifyHosts: ["discord.com", "discordapp.com"],
+  }),
+  apiPreset({
+    id: "googlechat",
+    category: "notify",
+    preset: { authType: "NONE" },
+    fields: [field.webhookUrl("googlechat")],
+    searchTerms: ["google", "chat", "notify", "workspace", "message"],
+    identifyHosts: ["chat.googleapis.com"],
+  }),
+  apiPreset({
+    id: "zapier",
+    category: "notify",
+    preset: { authType: "NONE" },
+    fields: [field.webhookUrl("zapier")],
+    searchTerms: ["make", "automation", "workflow", "trigger", "no-code"],
+    identifyHosts: ["zapier.com"],
+  }),
+  apiPreset({
+    id: "webhook",
+    category: "notify",
+    preset: { authType: "NONE" },
+    fields: [field.webhookUrl("webhook")],
+    searchTerms: ["http", "post", "callback", "custom", "notify"],
+  }),
+
+  // ---- file & attach: tickets and pages are destinations just like buckets -----------------------
+  apiPreset({
+    id: "jira",
+    category: "storage",
+    preset: { authType: "BASIC" },
+    fields: [
+      field.baseUrl("jira"),
+      field.username(`${COMMON}.email.label`),
+      field.password(`${COMMON}.apiToken.label`),
+    ],
+    searchTerms: ["atlassian", "issue", "ticket", "attach", "project"],
+  }),
+  apiPreset({
+    id: "confluence",
+    category: "storage",
+    preset: { authType: "BASIC" },
+    fields: [
+      field.baseUrl("confluence"),
+      field.username(`${COMMON}.email.label`),
+      field.password(`${COMMON}.apiToken.label`),
+    ],
+    searchTerms: ["atlassian", "wiki", "page", "attach", "space"],
+  }),
+
+  // ---- file to storage ------------------------------------------------------------------------------
+  apiPreset({
+    id: "nextcloud",
+    category: "storage",
+    preset: { authType: "BASIC" },
+    fields: [
+      field.baseUrl("nextcloud"),
+      field.username(),
+      field.password(`${PREFIX}.nextcloud.fields.appPassword`),
+    ],
+    searchTerms: ["owncloud", "webdav", "files", "self-hosted", "upload"],
+  }),
+];
+
+export const CREATABLE_CONNECTION_TYPES: CreatableConnectionType[] = [
+  {
+    id: "s3",
+    integrationType: "S3",
+    kind: "preset",
+    category: "storage",
+    labelKey: `${PREFIX}.s3.label`,
+    descriptionKey: `${PREFIX}.s3.description`,
+    searchTerms: ["aws", "bucket", "minio", "object storage"],
+    fields: S3_FIELDS,
+  },
+  {
+    id: "purview",
+    integrationType: "PURVIEW",
+    kind: "preset",
+    category: "security",
+    labelKey: `${PREFIX}.purview.label`,
+    descriptionKey: `${PREFIX}.purview.description`,
+    searchTerms: ["microsoft", "sensitivity", "label", "classification", "mip"],
+    fields: PURVIEW_FIELDS,
+  },
+  {
+    id: "consigno",
+    integrationType: "CONSIGNO",
+    kind: "preset",
+    category: "signing",
+    labelKey: `${PREFIX}.consigno.label`,
+    descriptionKey: `${PREFIX}.consigno.description`,
+    searchTerms: ["notarius", "notarize", "esign", "sign", "certifio"],
+    // The vendor's auth shape, baked in: the operator supplies credentials, never the mechanics.
+    presetConfig: {
+      authType: "TOKEN_LOGIN",
+      loginPath: "/auth/login",
+      tokenResponseHeader: "X-Auth-Token",
+      tokenHeaderName: "X-Auth-Token",
+    },
+    fields: CONSIGNO_FIELDS,
+  },
+  ...API_PRESETS,
+  {
+    id: "api",
+    integrationType: "API",
+    kind: "custom",
+    category: "advanced",
+    labelKey: `${PREFIX}.api.label`,
+    descriptionKey: `${PREFIX}.api.description`,
+    requiresCustomApi: true,
+    fields: CUSTOM_API_FIELDS,
+  },
+];
+
+/** Free-text match over name, description-agnostic keywords and category. */
+export function searchConnectionTypes(
+  types: CreatableConnectionType[],
+  query: string,
+  label: (key: string) => string,
+): CreatableConnectionType[] {
+  const q = query.trim().toLowerCase();
+  if (!q) return types;
+  return types.filter((type) => {
+    const haystack = [
+      label(type.labelKey),
+      type.id,
+      type.category,
+      ...(type.searchTerms ?? []),
+    ]
+      .join(" ")
+      .toLowerCase();
+    return q.split(/\s+/).every((word) => haystack.includes(word));
+  });
+}
+
+/** The types this caller may create. `customApi` comes from the server, never inferred here. */
+export function creatableConnectionTypes(
+  capabilities: { customApi: boolean } | undefined,
+): CreatableConnectionType[] {
+  return CREATABLE_CONNECTION_TYPES.filter(
+    (type) => !type.requiresCustomApi || capabilities?.customApi === true,
+  );
+}
+
+/** The supported vendors — the primary path an operator picks from. */
+export function presetConnectionTypes(): CreatableConnectionType[] {
+  return CREATABLE_CONNECTION_TYPES.filter((type) => type.kind === "preset");
+}
+
+/**
+ * Build the config payload for a type: its preset, then the operator's answers.
+ *
+ * Dotted keys (`loginBody.password`) nest, so a preset's credentials land where the backend expects
+ * them *and* where `SecretMasker` can see them — it recurses into nested maps and masks by key name,
+ * so a flat `loginBody` string would hand the password back in clear on every read.
+ */
+/**
+ * Reserved config key recording which preset created a connection.
+ *
+ * A stored connection only carries an `integrationType`, and most presets share `"API"` - Discord,
+ * Splunk, Jira and fourteen others are all `API`. Without this, mapping a saved connection back to
+ * its preset is guesswork, and guessing wrong means the edit form renders another vendor's fields
+ * and overwrites the config on save. The backend keeps `config` as a free-form map and ignores keys
+ * it does not model, so this rides along without a schema change.
+ */
+export const PRESET_ID_KEY = "presetId";
+
+export function buildConnectionConfig(
+  type: CreatableConnectionType,
+  values: Record<string, string>,
+): Record<string, unknown> {
+  const config: Record<string, unknown> = {
+    ...(type.presetConfig ?? {}),
+    [PRESET_ID_KEY]: type.id,
+  };
+  for (const field of type.fields) {
+    const raw = values[field.key];
+    if (raw === undefined || raw === "") continue;
+    const value: unknown =
+      field.control === "hostList"
+        ? raw
+            .split(/[\s,]+/)
+            .map((entry) => entry.trim())
+            .filter(Boolean)
+        : raw;
+    setPath(config, field.key, value);
+  }
+  return config;
+}
+
+/** Whether a field should be shown given the answers so far. */
+export function isFieldVisible(
+  field: ConnectionFieldDef,
+  values: Record<string, string>,
+): boolean {
+  if (!field.visibleWhen) return true;
+  const current = values[field.visibleWhen.key] ?? "";
+  return field.visibleWhen.oneOf.includes(current);
+}
+
+/** The hostname of a URL, lowercased, or undefined if it is missing or unparseable. */
+function hostOf(url: unknown): string | undefined {
+  if (typeof url !== "string" || url === "") return undefined;
+  try {
+    return new URL(url).hostname.toLowerCase();
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The vendor a stored connection points at, recovered from its URL when the `presetId` marker is
+ * absent. Only an unambiguous host wins: two presets sharing a host (the Cloudmersive pair) is
+ * treated as unknown rather than guessed, since guessing wrong would show the wrong form.
+ */
+function presetByHost(host: string): CreatableConnectionType | undefined {
+  const matches = new Set<CreatableConnectionType>();
+  for (const type of CREATABLE_CONNECTION_TYPES) {
+    // Webhook vendors: the operator supplies the URL, so match the vendor's domain and subdomains.
+    for (const sig of type.identifyHosts ?? []) {
+      if (host === sig || host.endsWith(`.${sig}`)) matches.add(type);
+    }
+    // Fixed-host presets: the base URL is baked in, so an exact host match identifies them.
+    if (hostOf(type.presetConfig?.baseUrl) === host) matches.add(type);
+  }
+  return matches.size === 1 ? [...matches][0] : undefined;
+}
+
+/** The type an existing connection was made from, so editing reuses its form. */
+export function connectionTypeOf(
+  integrationType: IntegrationType,
+  config?: Record<string, unknown> | null,
+): CreatableConnectionType | undefined {
+  const presetId = config?.[PRESET_ID_KEY];
+  if (typeof presetId === "string") {
+    const exact = CREATABLE_CONNECTION_TYPES.find((t) => t.id === presetId);
+    if (exact) return exact;
+  }
+
+  const candidates = CREATABLE_CONNECTION_TYPES.filter(
+    (type) => type.integrationType === integrationType,
+  );
+  if (candidates.length === 1) return candidates[0];
+
+  // No marker (made before it existed, or through the API): recover the vendor from the URL it
+  // points at, since a Discord webhook is always discord.com and so on. Showing "Custom API" for
+  // something the operator set up as Discord is both confusing and, on save, what rewrote the
+  // webhook as another vendor's endpoint.
+  const host = hostOf(config?.baseUrl);
+  if (host) {
+    const byHost = presetByHost(host);
+    if (byHost && byHost.integrationType === integrationType) return byHost;
+  }
+
+  // Still unknown: fall back to the free-form entry rather than naming a vendor at random. It shows
+  // the base URL and auth the connection actually has, so editing preserves them.
+  return candidates.find((type) => type.kind === "custom") ?? candidates[0];
+}
+
+/** Blank answers for a new connection: the fields' defaults, plus an empty name. */
+export function emptyConnectionValues(
+  type: CreatableConnectionType,
+): Record<string, string> {
+  const values: Record<string, string> = { name: "" };
+  for (const field of type.fields) {
+    values[field.key] = field.defaultValue ?? "";
+  }
+  return values;
+}
+
+/**
+ * Seed the form from a stored connection. Secrets arrive masked and are carried back verbatim,
+ * which is what tells the backend to keep the stored value (`SecretMasker.merge`).
+ */
+export function connectionFormValues(
+  type: CreatableConnectionType,
+  connection: { name: string; config: Record<string, unknown> },
+): Record<string, string> {
+  const values = emptyConnectionValues(type);
+  values.name = connection.name;
+  for (const field of type.fields) {
+    const stored = getPath(connection.config, field.key);
+    if (stored === undefined || stored === null) continue;
+    values[field.key] = Array.isArray(stored)
+      ? stored.join(", ")
+      : String(stored);
+  }
+  return values;
+}
+
+/** Name plus every required field that is actually on screen. */
+export function connectionFormValid(
+  type: CreatableConnectionType,
+  values: Record<string, string>,
+): boolean {
+  if ((values.name ?? "").trim() === "") return false;
+  return type.fields.every(
+    (field) =>
+      !field.required ||
+      !isFieldVisible(field, values) ||
+      (values[field.key] ?? "").trim() !== "",
+  );
+}
+
+function getPath(source: Record<string, unknown>, path: string): unknown {
+  let node: unknown = source;
+  for (const segment of path.split(".")) {
+    if (typeof node !== "object" || node === null) return undefined;
+    node = (node as Record<string, unknown>)[segment];
+  }
+  return node;
+}
+
+function setPath(
+  target: Record<string, unknown>,
+  path: string,
+  value: unknown,
+): void {
+  const segments = path.split(".");
+  let node = target;
+  for (let i = 0; i < segments.length - 1; i++) {
+    const next = node[segments[i]];
+    if (typeof next !== "object" || next === null) {
+      node[segments[i]] = {};
+    }
+    node = node[segments[i]] as Record<string, unknown>;
+  }
+  node[segments[segments.length - 1]] = value;
+}
diff --git a/frontend/editor/src/portal/mocks/handlers/index.ts b/frontend/editor/src/portal/mocks/handlers/index.ts
index 8163c10e4d..0600656524 100644
--- a/frontend/editor/src/portal/mocks/handlers/index.ts
+++ b/frontend/editor/src/portal/mocks/handlers/index.ts
@@ -15,6 +15,7 @@ import { classificationHandlers } from "@portal/mocks/handlers/classification";
 import { documentsHandlers } from "@portal/mocks/handlers/documents";
 import { editorDeployHandlers } from "@portal/mocks/handlers/editorDeploy";
 import { linkHandlers } from "@portal/mocks/handlers/link";
+import { integrationsHandlers } from "@portal/mocks/handlers/integrations";
 
 export const handlers = [
   ...authHandlers,
@@ -34,6 +35,7 @@ export const handlers = [
   ...documentsHandlers,
   ...editorDeployHandlers,
   ...linkHandlers,
+  ...integrationsHandlers,
 ];
 
 export { resetNotificationsStore } from "@portal/mocks/handlers/notifications";
diff --git a/frontend/editor/src/portal/mocks/handlers/integrations.ts b/frontend/editor/src/portal/mocks/handlers/integrations.ts
new file mode 100644
index 0000000000..ed71db265c
--- /dev/null
+++ b/frontend/editor/src/portal/mocks/handlers/integrations.ts
@@ -0,0 +1,128 @@
+import { http, HttpResponse } from "msw";
+
+/**
+ * Stored connections, for stories and the demo tour.
+ *
+ * Secrets are returned masked, exactly as the backend does — a fixture that handed back a real
+ * secret would quietly teach the wrong thing about the contract.
+ */
+const CONNECTIONS = [
+  {
+    id: 1,
+    integrationType: "S3",
+    name: "Claims intake bucket",
+    scope: "TEAM",
+    ownerUserId: null,
+    ownerTeamId: 1,
+    enabled: true,
+    locked: false,
+    defaultAccess: "EXPLICIT_ONLY",
+    config: {
+      bucket: "acme-claims-inbox",
+      region: "eu-west-2",
+      accessKeyId: "AKIAIOSFODNN7EXAMPLE",
+      secretAccessKey: "********",
+    },
+    canManage: true,
+    createdAt: "2026-07-02T09:12:00",
+    updatedAt: "2026-07-02T09:12:00",
+  },
+  {
+    id: 2,
+    integrationType: "PURVIEW",
+    name: "Contoso Purview",
+    scope: "TEAM",
+    ownerUserId: null,
+    ownerTeamId: 1,
+    enabled: true,
+    locked: false,
+    defaultAccess: "EXPLICIT_ONLY",
+    config: {
+      tenantId: "cb46c030-1825-4e81-a295-151c039dbf02",
+      clientId: "8f2a1c44-9b21-4d0e-9c33-2b7e5a10d4f1",
+      clientSecret: "********",
+    },
+    canManage: true,
+    createdAt: "2026-07-11T14:03:00",
+    updatedAt: "2026-07-16T08:40:00",
+  },
+  {
+    id: 3,
+    integrationType: "CONSIGNO",
+    name: "Notarius (production)",
+    scope: "TEAM",
+    ownerUserId: null,
+    ownerTeamId: 1,
+    enabled: true,
+    locked: false,
+    defaultAccess: "EXPLICIT_ONLY",
+    config: {
+      baseUrl: "https://acme.consignocloud.com/api/v1",
+      authType: "TOKEN_LOGIN",
+      loginPath: "/auth/login",
+      tokenResponseHeader: "X-Auth-Token",
+      tokenHeaderName: "X-Auth-Token",
+      loginHeaders: {
+        "X-Client-Id": "acme-prod",
+        "X-Client-Secret": "********",
+      },
+      loginBody: {
+        username: "automation@acme.test",
+        password: "********",
+        tenantId: "acme",
+      },
+    },
+    canManage: true,
+    createdAt: "2026-07-14T11:25:00",
+    updatedAt: "2026-07-14T11:25:00",
+  },
+  {
+    id: 4,
+    integrationType: "API",
+    name: "Acme DLP scanner",
+    scope: "TEAM",
+    ownerUserId: null,
+    ownerTeamId: 1,
+    enabled: true,
+    locked: false,
+    defaultAccess: "EXPLICIT_ONLY",
+    config: {
+      baseUrl: "https://dlp.acme-security.example/v2",
+      authType: "BEARER",
+      token: "********",
+      resultUrlHosts: ["cdn.acme-security.example"],
+    },
+    canManage: true,
+    createdAt: "2026-07-15T16:47:00",
+    updatedAt: "2026-07-15T16:47:00",
+  },
+];
+
+export const integrationsHandlers = [
+  http.get("*/api/v1/integrations", () => HttpResponse.json(CONNECTIONS)),
+  // Stories show the admin's view; the server is the real gate.
+  http.get("*/api/v1/integrations/capabilities", () =>
+    HttpResponse.json({ customApi: true }),
+  ),
+  http.post("*/api/v1/integrations", async ({ request }) => {
+    const body = (await request.json()) as Record<string, unknown>;
+    return HttpResponse.json({
+      ...CONNECTIONS[0],
+      id: 99,
+      ...body,
+      canManage: true,
+    });
+  }),
+  http.put("*/api/v1/integrations/:id", async ({ request, params }) => {
+    const body = (await request.json()) as Record<string, unknown>;
+    return HttpResponse.json({
+      ...CONNECTIONS[0],
+      id: Number(params.id),
+      ...body,
+    });
+  }),
+  http.delete(
+    "*/api/v1/integrations/:id",
+    () => new HttpResponse(null, { status: 204 }),
+  ),
+];
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
index a9a8aab0f7..6f40b82764 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
@@ -53,6 +53,9 @@ vi.mock("@portal/api/policies", () => ({
 const fetchS3Connections = vi.fn();
 const createIntegration = vi.fn();
 vi.mock("@portal/api/integrations", () => ({
+  fetchIntegrations: () => fetchS3Connections(),
+  // Custom-API authoring is a server decision; these tests assert the default view.
+  fetchIntegrationCapabilities: () => Promise.resolve({ customApi: false }),
   fetchS3Connections: () => fetchS3Connections(),
   createIntegration: (...args: unknown[]) => createIntegration(...args),
 }));
@@ -209,24 +212,24 @@ describe("PipelineBuilder", () => {
       await screen.findByText("portal.connections.picker.createNew"),
     );
     fireEvent.change(
-      screen.getByLabelText(/portal\.connections\.s3\.fields\.name/),
+      screen.getByLabelText(/portal\.connections\.fields\.name/),
       { target: { value: "Claims bucket" } },
     );
     fireEvent.change(
       screen.getByLabelText(
-        /portal\.sources\.types\.s3\.fields\.bucket\.label/,
+        /portal\.connections\.types\.s3\.fields\.bucket\.label/,
       ),
       { target: { value: "claims-processed" } },
     );
     fireEvent.change(
       screen.getByLabelText(
-        /portal\.sources\.types\.s3\.fields\.accessKeyId\.label/,
+        /portal\.connections\.types\.s3\.fields\.accessKeyId\.label/,
       ),
       { target: { value: "AKIAEXAMPLE" } },
     );
     fireEvent.change(
       screen.getByLabelText(
-        /portal\.sources\.types\.s3\.fields\.secretAccessKey\.label/,
+        /portal\.connections\.types\.s3\.fields\.secretAccessKey\.label/,
       ),
       { target: { value: "shh-secret" } },
     );
@@ -330,6 +333,28 @@ describe("PipelineBuilder", () => {
     ).toBeDisabled();
   });
 
+  it("blocks saving an integration step with no account chosen", async () => {
+    // A Discord step added but left without an account would fail at run time with a raw backend
+    // rejection; the builder must refuse to save it and say why, where the fix is one click away.
+    renderBuilder("/processor/pipelines/new");
+
+    fireEvent.change(await screen.findByRole("textbox"), {
+      target: { value: "Notify only" },
+    });
+    fireEvent.click(screen.getByRole("button", { name: /addTool/ }));
+    fireEvent.click(
+      await screen.findByText("portal.policies.operations.discordNotify.label"),
+    );
+
+    // Operation chosen, account not: still not saveable.
+    expect(
+      await screen.findByText("portal.pipelines.builder.stepsNeedSetup"),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("portal.pipelines.composer.create").closest("button"),
+    ).toBeDisabled();
+  });
+
   it("deletes an existing pipeline after confirmation", async () => {
     renderBuilder("/processor/pipelines/plc-1");
 
@@ -355,6 +380,49 @@ describe("PipelineBuilder", () => {
     expect(await screen.findByText("pipelines list")).toBeInTheDocument();
   });
 
+  it("keeps the account chosen for an integration step", async () => {
+    // The regression: integration steps are deliberately toolId-less, and the builder's param
+    // update used to skip exactly those, so picking an account looked like it did nothing.
+    fetchS3Connections.mockResolvedValue([
+      {
+        id: 9,
+        name: "Ops alerts",
+        integrationType: "API",
+        config: { presetId: "discord" },
+      },
+    ]);
+    renderBuilder("/processor/pipelines/new");
+
+    fireEvent.change(await screen.findByRole("textbox"), {
+      target: { value: "Notify on processed" },
+    });
+
+    fireEvent.click(screen.getByRole("button", { name: /addTool/ }));
+    fireEvent.click(
+      await screen.findByText("portal.policies.operations.discordNotify.label"),
+    );
+
+    fireEvent.click(
+      await screen.findByPlaceholderText(
+        "portal.connections.picker.placeholder",
+      ),
+    );
+    fireEvent.click(await screen.findByText("Ops alerts"));
+
+    fireEvent.click(screen.getByText("portal.pipelines.composer.create"));
+
+    await waitFor(() => expect(savePipeline).toHaveBeenCalledTimes(1));
+    const saved = savePipeline.mock.calls[0][0] as Policy;
+    const step = saved.steps[0] as unknown as {
+      operation: string;
+      parameters: Record<string, string>;
+    };
+    expect(step.operation).toBe("/api/v1/integration/external-api-call");
+    // The selection survived all the way to the wire, not just to the dropdown.
+    expect(step.parameters.connectionId).toBe("9");
+    expect(step.parameters.operationId).toBe("discordNotify");
+  });
+
   it("leaves immediately when there are no unsaved edits", async () => {
     renderBuilder("/processor/pipelines/new");
 
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.tsx b/frontend/editor/src/portal/views/PipelineBuilder.tsx
index 28e040bcce..66c5748e85 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.tsx
@@ -58,6 +58,13 @@ import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { humanizeOperation } from "@portal/components/pipelines/pipelineOperations";
 import { PipelineStepSettings } from "@portal/components/pipelines/PipelineStepSettings";
 import { ToolPicker } from "@portal/components/pipelines/ToolPicker";
+import { STEP_OPERATIONS } from "@portal/components/policies/stepOperations";
+import {
+  integrationStepConfigured,
+  isIntegrationStep,
+  newIntegrationStep,
+  stepOperation,
+} from "@portal/components/pipelines/integrationStep";
 import "@portal/views/PipelineBuilder.css";
 
 type OutputMode = PipelineOutputMode;
@@ -271,6 +278,15 @@ export function PipelineBuilder() {
     );
   }
 
+  function addOperationStep(op: (typeof STEP_OPERATIONS)[number]) {
+    setSteps((current) => {
+      const next = [...current, newIntegrationStep(op)];
+      setSelectedIndex(next.length - 1);
+      return next;
+    });
+    setPickerOpen(false);
+  }
+
   function addStep(tool: ExecutableTool) {
     setSteps((current) => {
       const next = [...current, newWorkingToolStep(tool, allTools)];
@@ -299,12 +315,22 @@ export function PipelineBuilder() {
   function updateStepParams(index: number, params: ErasedToolParams) {
     setSteps((current) =>
       current.map((step, i) =>
-        i === index && step.toolId !== null ? { ...step, params } : step,
+        // Integration steps are deliberately toolId-less, so they must be editable too; only a
+        // genuinely unrecognised step has no editor to send changes from.
+        i === index && (step.toolId !== null || isIntegrationStep(step))
+          ? { ...step, params }
+          : step,
       ),
     );
   }
 
   function stepLabel(step: WorkingToolStep): string {
+    // An integration step's endpoint is the same for every vendor, so the raw path would read
+    // "External api call" for all of them. Name it by the operation instead.
+    const op = stepOperation(step);
+    if (op) return t(op.labelKey);
+    if (isIntegrationStep(step))
+      return t("portal.pipelines.builder.sendToSystem");
     const entry = step.toolId ? allTools[step.toolId] : undefined;
     return entry?.name ?? humanizeOperation(step.operation);
   }
@@ -314,6 +340,13 @@ export function PipelineBuilder() {
   const uploadStepLabels = steps.filter(stepRequiresUpload).map(stepLabel);
   const hasUploadSteps = uploadStepLabels.length > 0;
 
+  // An integration step with no operation or no account chosen would fail at run time with a raw
+  // backend rejection, so block saving on it here where the fix is one click away.
+  const unconfiguredStepLabels = steps
+    .filter((step) => !integrationStepConfigured(step))
+    .map(stepLabel);
+  const hasUnconfiguredSteps = unconfiguredStepLabels.length > 0;
+
   // Track unsaved edits: snapshot the form and compare against the state captured just after
   // seeding, so leaving the builder can prompt to save or discard.
   const snapshot = JSON.stringify({
@@ -346,6 +379,7 @@ export function PipelineBuilder() {
     scheduleCountValid &&
     outputValid &&
     !hasUploadSteps &&
+    !hasUnconfiguredSteps &&
     !submitting;
 
   const triggerOptions = [
@@ -644,6 +678,14 @@ export function PipelineBuilder() {
           })}
         />
       )}
+      {hasUnconfiguredSteps && (
+        <Banner
+          tone="warning"
+          description={t("portal.pipelines.builder.stepsNeedSetup", {
+            tools: unconfiguredStepLabels.join(", "),
+          })}
+        />
+      )}
 
       {/* Pipeline-level settings, above the operation list. */}
       <section className="portal-builder__settings">
@@ -819,7 +861,17 @@ export function PipelineBuilder() {
                       <span className="portal-builder__step-name">
                         {stepLabel(step)}
                       </span>
-                      {stepRequiresUpload(step) ? (
+                      {isIntegrationStep(step) ? (
+                        !stepOperation(step) ? (
+                          <span className="portal-builder__step-note">
+                            {t("portal.pipelines.builder.chooseOperation")}
+                          </span>
+                        ) : !integrationStepConfigured(step) ? (
+                          <span className="portal-builder__step-note">
+                            {t("portal.pipelines.builder.chooseAccount")}
+                          </span>
+                        ) : null
+                      ) : stepRequiresUpload(step) ? (
                         <span className="portal-builder__step-note">
                           {t("portal.pipelines.builder.needsUpload")}
                         </span>
@@ -874,6 +926,8 @@ export function PipelineBuilder() {
             <ToolPicker
               tools={executableTools}
               onPick={addStep}
+              operations={STEP_OPERATIONS}
+              onPickOperation={addOperationStep}
               onClose={() => setPickerOpen(false)}
             />
           ) : (
diff --git a/frontend/editor/src/portal/views/SourceBuilder.test.tsx b/frontend/editor/src/portal/views/SourceBuilder.test.tsx
index 517b28f515..60a9f13b93 100644
--- a/frontend/editor/src/portal/views/SourceBuilder.test.tsx
+++ b/frontend/editor/src/portal/views/SourceBuilder.test.tsx
@@ -30,6 +30,8 @@ vi.mock("@portal/api/sources", () => ({
 
 const fetchS3Connections = vi.fn();
 vi.mock("@portal/api/integrations", () => ({
+  fetchIntegrations: () => Promise.resolve([]),
+  fetchIntegrationCapabilities: () => Promise.resolve({ customApi: false }),
   fetchS3Connections: () => fetchS3Connections(),
   createIntegration: vi.fn(),
 }));
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index 96bd2dc5f3..0fd4646f17 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -526,6 +526,71 @@
   gap: 0.75rem;
 }
 
+/* Back to the grid from the form. Sits above the fields, where the type dropdown used to be. */
+.portal-sources__connection-back {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.35rem;
+  margin-bottom: 1rem;
+  padding: 0;
+  background: none;
+  border: none;
+  cursor: pointer;
+  font: inherit;
+  font-size: 0.8125rem;
+  color: var(--c-text-muted);
+}
+
+.portal-sources__connection-back:hover {
+  color: var(--text-default, inherit);
+}
+
+/* The "request an integration" / "advanced" affordances, set below the form so presets read as
+   the primary path and these as the way out of it. */
+.portal-sources__connection-secondary {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 1rem;
+  margin-top: 1rem;
+  padding-top: 0.75rem;
+  border-top: 1px solid var(--c-border-subtle);
+}
+
+.portal-sources__connection-link {
+  background: none;
+  border: none;
+  padding: 0;
+  cursor: pointer;
+  font: inherit;
+  font-size: 0.8125rem;
+  color: var(--c-conn-accent);
+  text-decoration: underline;
+  text-underline-offset: 2px;
+}
+
+.portal-sources__connection-link:hover {
+  opacity: 0.8;
+}
+
+/* Free-text fields (result-host list, body template) that outgrow a single-line input. */
+.portal-sources__connection-textarea {
+  width: 100%;
+  padding: 0.5rem 0.75rem;
+  border: 1px solid var(--c-border);
+  border-radius: var(--radius-sm, 0.375rem);
+  background: var(--surface-input, transparent);
+  color: inherit;
+  font-family: var(--font-mono, ui-monospace, monospace);
+  font-size: 0.8125rem;
+  line-height: 1.5;
+  resize: vertical;
+}
+
+.portal-sources__connection-textarea:focus-visible {
+  outline: 2px solid var(--c-conn-accent);
+  outline-offset: -1px;
+}
+
 .portal-sources__connections {
   margin-top: 1.5rem;
 }
@@ -589,3 +654,182 @@
   gap: 0.25rem;
   justify-content: flex-end;
 }
+
+/* ---- Integration picker ---------------------------------------------------------------------
+   A searchable grid of what we can connect to. Sized so a full category is visible without
+   scrolling on a laptop, and so the search box is the first thing focus lands on. */
+.portal-conn-picker {
+  display: flex;
+  flex-direction: column;
+  gap: 1.25rem;
+  /* Bounded rather than free-growing: the modal should not become the page. */
+  max-height: min(60vh, 32rem);
+  overflow-y: auto;
+}
+
+.portal-conn-picker__search {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 0.5rem 0.75rem;
+  border: 1px solid var(--c-border);
+  border-radius: var(--radius-sm, 0.375rem);
+  /* Real theme token with a transparent fallback so it never falls back to opaque white in dark;
+     the border alone is enough to read as an input. */
+  background: var(--color-bg-subtle, transparent);
+}
+
+.portal-conn-picker__search-icon {
+  flex: none;
+  font-size: 1.125rem;
+  color: var(--c-text-muted);
+}
+
+.portal-conn-picker__search input {
+  flex: 1;
+  min-width: 0;
+  border: none;
+  background: none;
+  outline: none;
+  font: inherit;
+  color: inherit;
+}
+
+.portal-conn-picker__section {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+}
+
+.portal-conn-picker__section-title {
+  margin: 0;
+  font-size: 0.8125rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--c-text-muted);
+}
+
+.portal-conn-picker__section-desc {
+  margin: 0 0 0.5rem;
+  font-size: 0.8125rem;
+  color: var(--c-text-muted);
+}
+
+.portal-conn-picker__grid {
+  display: grid;
+  /* auto-fill so the grid reflows to the modal rather than to a fixed column count. */
+  grid-template-columns: repeat(auto-fill, minmax(13.5rem, 1fr));
+  gap: 0.5rem;
+}
+
+.portal-conn-picker__card {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.625rem;
+  padding: 0.625rem 0.75rem;
+  text-align: left;
+  cursor: pointer;
+  border: 1px solid var(--c-border-subtle);
+  border-radius: var(--radius-sm, 0.375rem);
+  background: var(--surface-subtle, transparent);
+  font: inherit;
+  color: inherit;
+}
+
+.portal-conn-picker__card:hover {
+  border-color: var(--c-conn-accent);
+  background: color-mix(in srgb, var(--c-conn-neutral) 6%, transparent);
+}
+
+/* The custom-API card is an escape hatch, not a vendor: dashed, so it reads as "something else". */
+.portal-conn-picker__card--advanced {
+  border-style: dashed;
+}
+
+.portal-conn-picker__mark {
+  flex: none;
+  display: grid;
+  place-items: center;
+  width: 1.75rem;
+  height: 1.75rem;
+  border-radius: var(--radius-sm, 0.375rem);
+  background: color-mix(in srgb, var(--c-conn-accent) 14%, transparent);
+  color: var(--c-conn-accent);
+  font-size: 0.875rem;
+  font-weight: 600;
+}
+
+/* One hue per category. Muted on purpose - these sit 60-odd to a page, and saturated marks would
+   turn the grid into confetti. */
+.portal-conn-picker__mark--storage {
+  background: color-mix(in srgb, var(--c-conn-storage) 16%, transparent);
+  color: var(--c-conn-storage);
+}
+
+.portal-conn-picker__mark--signing {
+  background: color-mix(in srgb, var(--c-conn-signing) 18%, transparent);
+  color: var(--c-conn-signing);
+}
+
+.portal-conn-picker__mark--security {
+  background: color-mix(in srgb, var(--c-conn-accent) 16%, transparent);
+  color: var(--c-conn-accent);
+}
+
+.portal-conn-picker__mark--notify {
+  background: color-mix(in srgb, var(--c-conn-notify) 18%, transparent);
+  color: var(--c-conn-notify);
+}
+
+.portal-conn-picker__mark--advanced {
+  background: color-mix(in srgb, var(--c-conn-neutral) 16%, transparent);
+  color: var(--c-text-muted);
+}
+
+.portal-conn-picker__card-text {
+  display: flex;
+  flex-direction: column;
+  gap: 0.125rem;
+  min-width: 0;
+}
+
+.portal-conn-picker__card-name {
+  font-size: 0.875rem;
+  font-weight: 500;
+}
+
+.portal-conn-picker__card-desc {
+  font-size: 0.75rem;
+  line-height: 1.35;
+  color: var(--c-text-muted);
+  /* Two lines keeps every card the same height without truncating most descriptions. */
+  display: -webkit-box;
+  -webkit-line-clamp: 2;
+  -webkit-box-orient: vertical;
+  overflow: hidden;
+}
+
+.portal-conn-picker__empty {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 2rem 1rem;
+  text-align: center;
+}
+
+.portal-conn-picker__empty-title {
+  margin: 0;
+  font-size: 0.9375rem;
+  font-weight: 600;
+}
+
+.portal-conn-picker__empty-body {
+  margin: 0 0 0.5rem;
+  font-size: 0.8125rem;
+  color: var(--c-text-muted);
+}
diff --git a/frontend/editor/src/portal/views/Sources.test.tsx b/frontend/editor/src/portal/views/Sources.test.tsx
index 2bdda1b64b..e3b42356c0 100644
--- a/frontend/editor/src/portal/views/Sources.test.tsx
+++ b/frontend/editor/src/portal/views/Sources.test.tsx
@@ -27,6 +27,9 @@ vi.mock("@portal/api/sources", () => ({
 
 const fetchS3Connections = vi.fn();
 vi.mock("@portal/api/integrations", () => ({
+  fetchIntegrations: () => fetchS3Connections(),
+  // Custom-API authoring is a server decision; these tests assert the default view.
+  fetchIntegrationCapabilities: () => Promise.resolve({ customApi: false }),
   fetchS3Connections: () => fetchS3Connections(),
   deleteIntegration: vi.fn(),
 }));
diff --git a/frontend/editor/src/proprietary/policies/operations.test.ts b/frontend/editor/src/proprietary/policies/operations.test.ts
index 30326722e6..c0aa97e153 100644
--- a/frontend/editor/src/proprietary/policies/operations.test.ts
+++ b/frontend/editor/src/proprietary/policies/operations.test.ts
@@ -17,8 +17,11 @@ describe("POLICY_OPERATIONS", () => {
     expect(ALL_TOOL_IDS.sort()).toEqual([
       "classify",
       "compress",
+      "externalApiCall",
       "flatten",
       "ocr",
+      "purviewApplyLabel",
+      "purviewReadLabel",
       "redact",
       "sanitize",
       "timestampPdf",
diff --git a/frontend/editor/src/proprietary/policies/operations.ts b/frontend/editor/src/proprietary/policies/operations.ts
index 315f1a463a..092d8b50de 100644
--- a/frontend/editor/src/proprietary/policies/operations.ts
+++ b/frontend/editor/src/proprietary/policies/operations.ts
@@ -22,9 +22,24 @@ import type { WirePipelineStep } from "@app/policies/types";
  */
 export type AiPolicyEndpoint = "/api/v1/ai/tools/classify-and-label";
 
-/** An AI tool usable in a policy — the AI-endpoint analogue of a standard tool descriptor. */
+/**
+ * Endpoints for third-party integration steps. Excluded from the generated {@link ToolEndpoint}
+ * union for the same reason as the AI tools: `/api/v1/integration/` is not one of the tool
+ * namespaces the generator reads.
+ */
+export type IntegrationPolicyEndpoint =
+  | "/api/v1/integration/external-api-call"
+  | "/api/v1/integration/purview-apply-label"
+  | "/api/v1/integration/purview-read-label";
+
+/** An endpoint typed here rather than by the generator. */
+export type UntypedPolicyEndpoint =
+  | AiPolicyEndpoint
+  | IntegrationPolicyEndpoint;
+
+/** A tool usable in a policy whose endpoint isn't in the generated union. */
 export interface AiToolDescriptor<TParams> {
-  readonly endpoint: AiPolicyEndpoint;
+  readonly endpoint: UntypedPolicyEndpoint;
   readonly defaultParameters: TParams;
   toApi(params: TParams): Record<string, unknown>;
   fromApi(api: Record<string, unknown>): TParams;
@@ -45,6 +60,35 @@ export function describeAiToolOperation(
   };
 }
 
+/**
+ * Describe an integration step. Unlike AI tools these carry real parameters, so each supplies its
+ * own defaults; every one of them needs a `connectionId` naming the stored connection that holds
+ * the endpoint and credentials. Values cross the wire as form fields, hence the string round-trip.
+ */
+function describeIntegrationOperation<TParams extends Record<string, string>>(
+  endpoint: IntegrationPolicyEndpoint,
+  defaultParameters: TParams,
+): AiToolDescriptor<TParams> {
+  return {
+    endpoint,
+    defaultParameters,
+    // Drop blanks rather than send empty fields: the backend distinguishes "absent" from
+    // "empty" for optional params like `path` and `labelName`.
+    toApi: (params) =>
+      Object.fromEntries(
+        Object.entries(params).filter(([, value]) => value !== ""),
+      ),
+    fromApi: (api) => {
+      const out = { ...defaultParameters } as Record<string, string>;
+      for (const key of Object.keys(defaultParameters)) {
+        const value = api[key];
+        if (value !== undefined && value !== null) out[key] = String(value);
+      }
+      return out as TParams;
+    },
+  };
+}
+
 export const POLICY_OPERATIONS = {
   redact: describeToolOperation(
     "/api/v1/security/auto-redact",
@@ -74,6 +118,48 @@ export const POLICY_OPERATIONS = {
     compressOperationConfig,
   ),
   classify: describeAiToolOperation("/api/v1/ai/tools/classify-and-label"),
+  purviewApplyLabel: describeIntegrationOperation(
+    "/api/v1/integration/purview-apply-label",
+    { connectionId: "", labelId: "", labelName: "", method: "STANDARD" },
+  ),
+  purviewReadLabel: describeIntegrationOperation(
+    "/api/v1/integration/purview-read-label",
+    { connectionId: "" },
+  ),
+  externalApiCall: describeIntegrationOperation(
+    "/api/v1/integration/external-api-call",
+    {
+      connectionId: "",
+      path: "",
+      method: "POST",
+      // multipart | json | binary — how the document reaches the API.
+      bodyMode: "multipart",
+      fileFieldName: "file",
+      // Default to leaving the document alone; `replace` opts in to the response becoming it.
+      responseMode: "report",
+      // For `replace`, where the document actually is: inline (leave both blank), behind a URL in
+      // the response body / a header, and/or inside a returned archive.
+      resultUrlPath: "",
+      resultUrlHeader: "",
+      responseSelect: "",
+      // A dotted path into the JSON response that must be true, or the step fails: the scan gate.
+      requireTrue: "",
+      // JSON objects whose values may reference {{document.*}}, {{classification.*}},
+      // {{sensitivityLabel.*}} and {{run.*}}.
+      fields: "",
+      headers: "",
+      // A vendor-shaped JSON body; wins over bodyMode/fields when set. {{document.base64}}
+      // carries the file, for APIs that nest it inside a JSON document.
+      bodyTemplate: "",
+      includeContext: "false",
+      includeFile: "true",
+      // Which catalogue entry the operator chose, and their answers to its fields. Persisted so a
+      // saved step reopens on the same operation rather than back at the picker; JSON-encoded to
+      // keep every step parameter a flat string, as `fields` and `headers` already are.
+      operationId: "",
+      operationValues: "",
+    },
+  ),
 } as const;
 
 export type PolicyToolId = keyof typeof POLICY_OPERATIONS;
@@ -97,8 +183,8 @@ const TOOL_ID_BY_ENDPOINT = new Map<string, PolicyToolId>(
   POLICY_TOOL_IDS.map((id) => [POLICY_OPERATIONS[id].endpoint, id]),
 );
 
-/** A policy step's endpoint: a standard {@link ToolEndpoint} or an {@link AiPolicyEndpoint}. */
-export type PolicyEndpoint = ToolEndpoint | AiPolicyEndpoint;
+/** A policy step's endpoint: a generated {@link ToolEndpoint} or one typed here. */
+export type PolicyEndpoint = ToolEndpoint | UntypedPolicyEndpoint;
 
 export function policyEndpoint(toolId: PolicyToolId): PolicyEndpoint {
   return POLICY_OPERATIONS[toolId].endpoint;
diff --git a/frontend/eslint.config.mjs b/frontend/eslint.config.mjs
index 9793c60ac8..76daf03315 100644
--- a/frontend/eslint.config.mjs
+++ b/frontend/eslint.config.mjs
@@ -268,6 +268,17 @@ export default defineConfig(
       "no-restricted-syntax": ["error", ...mantineComponentImportRestrictions],
     },
   },
+  // TEMPORARY (same rationale as procurement above): the connection/operation catalogues render
+  // bespoke preset tiles (tinted monogram + two-line text). Raw-<button> rule only; migrate later.
+  {
+    files: [
+      "editor/src/portal/components/sources/ConnectionTypePicker.tsx",
+      "editor/src/portal/components/policies/PolicyExternalApiConfig.tsx",
+    ],
+    rules: {
+      "no-restricted-syntax": ["error", ...mantineComponentImportRestrictions],
+    },
+  },
   // Stricter rules that not all sub-folders are conformant to yet.
   {
     files: srcGlobs,

From 29002d0b8281d3af7e27b0ae972f2adee113e258 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Thu, 23 Jul 2026 11:19:24 +0000
Subject: [PATCH 089/109] Improve UX around source folders in Processor (#7101)

# Description of Changes
Adds implicitly defined folders to the list of locations that folder
sources can look in, including the legacy watchedFolder folders, and the
server storage location (if enabled). Also adds a settings UI for
defining the list of allowed folders instead of having to manually edit
`settings.yml` (please excuse the styling, that's the standard styling
of the Processor, hoping it gets fixed by one of the styling PRs).

<img width="888" height="786" alt="image"
src="https://github.com/user-attachments/assets/cf6d0705-adcf-463c-8e80-6901a652068b"
/>

<img width="1103" height="713" alt="image"
src="https://github.com/user-attachments/assets/b7244592-249a-4149-994f-3a2b750f25f9"
/>
---
 .../common/model/ApplicationProperties.java   |   7 +-
 .../src/main/resources/settings.yml.template  |   8 +-
 .../config/FolderAccessDeniedException.java   |  14 +
 .../policy/config/FolderAccessGuard.java      |  57 ++-
 .../FolderAccessSettingsController.java       |  42 +++
 .../policy/source/SourceController.java       |  30 ++
 .../api/AdminSettingsController.java          |   4 +-
 .../policy/config/FolderAccessGuardTest.java  |  90 ++++-
 .../policy/input/FolderInputSourceTest.java   |   6 +-
 .../policy/output/FolderOutputSinkTest.java   |  11 +-
 .../public/locales/en-US/translation.toml     |  25 ++
 frontend/editor/public/og-metadata.json       |   6 +
 frontend/editor/public/og-metadata.saas.json  |   6 +
 .../core/components/shared/config/types.ts    |   1 +
 frontend/editor/src/portal/api/sources.ts     |  24 +-
 .../src/portal/views/SourceBuilder.test.tsx   |  63 +++-
 .../editor/src/portal/views/SourceBuilder.tsx |  37 +-
 .../shared/config/configNavSections.tsx       |   9 +
 .../AdminFolderAccessSection.tsx              | 328 ++++++++++++++++++
 .../AdminStorageSharingSection.tsx            |   2 +-
 20 files changed, 746 insertions(+), 24 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessDeniedException.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/FolderAccessSettingsController.java
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminFolderAccessSection.tsx

diff --git a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
index b20dc298f7..43f27eec2d 100644
--- a/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
+++ b/app/common/src/main/java/stirling/software/common/model/ApplicationProperties.java
@@ -208,9 +208,10 @@ public class ApplicationProperties {
     public static class Policies {
         /**
          * Absolute directories that policy folder input sources and output sinks may read from or
-         * write to. Empty (the default) disables folder access entirely, so a policy can never be
-         * pointed at an arbitrary server path. Stirling's own config directory is always
-         * off-limits, and folder access is always disabled in SaaS mode regardless of this list.
+         * write to. Empty (the default) disables folder access except to implicitly defined
+         * folders, such as server storage folders (if enabled) and the pipeline watched folders.
+         * Stirling's own config directory is always off-limits, and folder access is always
+         * disabled in SaaS mode regardless of this list.
          */
         private List<String> allowedFolderRoots = new java.util.ArrayList<>();
 
diff --git a/app/core/src/main/resources/settings.yml.template b/app/core/src/main/resources/settings.yml.template
index 2d227c34a2..fd9cc13c13 100644
--- a/app/core/src/main/resources/settings.yml.template
+++ b/app/core/src/main/resources/settings.yml.template
@@ -398,9 +398,11 @@ aiEngine:
 
 policies:
   # Folder automations can read from and write to the directories you allow here, so treat this as a
-  # security boundary. Leave allowedFolderRoots empty (default) to disable folder sources/outputs
-  # entirely; list absolute directories to permit folder access only within them. Stirling's own
-  # config directory is always off-limits, and folder access is always disabled in SaaS mode.
+  # security boundary. Leave allowedFolderRoots empty (default) to disable folder sources/outputs,
+  # other than from directories that are always permitted like server file-storage and watched folders.
+  # List absolute directories to permit folder access within them.
+  # Stirling's own config directory is always off-limits, and folder access is always
+  # disabled in SaaS mode.
   allowedFolderRoots: [] # e.g. ["/data/inbox", "/data/outbox"]
   scheduleSweepSeconds: 60 # How often (seconds) scheduled policies are checked for being due
   watchReconcileSeconds: 300 # How often (seconds) folder-watch re-syncs watches and re-runs as a safety net for missed events
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessDeniedException.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessDeniedException.java
new file mode 100644
index 0000000000..12b4ab0855
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessDeniedException.java
@@ -0,0 +1,14 @@
+package stirling.software.proprietary.policy.config;
+
+/**
+ * A folder path was rejected only because it falls outside the configured/implied allowed roots - a
+ * condition an admin can resolve by adding the root under the Folder Access settings. Distinct from
+ * the guard's other rejections (SaaS mode, the protected config dir), which editing the allowlist
+ * cannot fix, so callers can offer a "go to settings" affordance for this case alone.
+ */
+public class FolderAccessDeniedException extends IllegalArgumentException {
+
+    public FolderAccessDeniedException(String message) {
+        super(message);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java
index 5c83e0cde3..92ab91e99c 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/config/FolderAccessGuard.java
@@ -10,6 +10,7 @@ import org.springframework.core.env.Environment;
 import org.springframework.stereotype.Component;
 
 import stirling.software.common.configuration.InstallationPathConfig;
+import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.policy.model.Policy;
 import stirling.software.proprietary.policy.source.SourceStore;
@@ -22,6 +23,9 @@ import stirling.software.proprietary.policy.source.SourceStore;
  *   <li>denied entirely under the {@code saas} profile;
  *   <li>Stirling's own config dir always rejected, even if an allowed root were misconfigured to
  *       contain it;
+ *   <li>Stirling-owned "implied" roots are always permitted (even with none configured): the local
+ *       server file-storage directory when that storage provider is enabled, and the pipeline
+ *       watched-folder directories, so automations use them without the admin listing them;
  *   <li>must resolve within {@code policies.allowedFolderRoots}; none configured means all denied.
  * </ol>
  *
@@ -33,18 +37,29 @@ public class FolderAccessGuard {
 
     public static final String FOLDER_TYPE = "folder";
 
+    /** Reason keys for an implied root, surfaced to the admin UI so it can label each one. */
+    public static final String IMPLIED_SERVER_STORAGE = "serverStorage";
+
+    public static final String IMPLIED_WATCHED_FOLDER = "watchedFolder";
+
+    /** A directory implicitly permitted regardless of {@code allowedFolderRoots}, and why. */
+    public record ImpliedRoot(Path path, String reason) {}
+
     private final boolean saasActive;
     private final List<Path> allowedRoots;
+    private final List<ImpliedRoot> impliedRoots;
     private final List<Path> protectedRoots;
     private final SourceStore sourceStore;
 
     public FolderAccessGuard(
             ApplicationProperties applicationProperties,
+            RuntimePathConfig runtimePathConfig,
             Environment environment,
             SourceStore sourceStore) {
         this.saasActive = Arrays.asList(environment.getActiveProfiles()).contains("saas");
         this.allowedRoots =
                 normalizeAll(applicationProperties.getPolicies().getAllowedFolderRoots());
+        this.impliedRoots = impliedRoots(applicationProperties.getStorage(), runtimePathConfig);
         this.protectedRoots = List.of(normalize(Path.of(InstallationPathConfig.getConfigPath())));
         this.sourceStore = sourceStore;
     }
@@ -62,18 +77,28 @@ public class FolderAccessGuard {
                         "folder may not point inside a protected Stirling directory");
             }
         }
+        // Stirling-owned implied roots are always permitted, even with no configured roots, so
+        // automations work against them out of the box.
+        if (impliedRoots.stream().anyMatch(root -> normalized.startsWith(root.path()))) {
+            return normalized;
+        }
         if (allowedRoots.isEmpty()) {
-            throw new IllegalArgumentException(
+            throw new FolderAccessDeniedException(
                     "folder access is disabled; set policies.allowedFolderRoots to permit it");
         }
         boolean within = allowedRoots.stream().anyMatch(normalized::startsWith);
         if (!within) {
-            throw new IllegalArgumentException(
+            throw new FolderAccessDeniedException(
                     "folder '" + normalized + "' is outside the allowed folder roots");
         }
         return normalized;
     }
 
+    /** The Stirling-owned directories always permitted, with a reason key for each (read-only). */
+    public List<ImpliedRoot> impliedRoots() {
+        return impliedRoots;
+    }
+
     /** Whether this policy touches a folder source/sink, and so is subject to these rules. */
     public boolean usesFolderAccess(Policy policy) {
         boolean readsFolder =
@@ -86,6 +111,34 @@ public class FolderAccessGuard {
         return readsFolder || writesFolder;
     }
 
+    /**
+     * Stirling-owned directories always permitted regardless of {@code allowedFolderRoots}, so
+     * folder automations work against them out of the box.
+     */
+    private static List<ImpliedRoot> impliedRoots(
+            ApplicationProperties.Storage storage, RuntimePathConfig runtimePathConfig) {
+        List<ImpliedRoot> roots = new ArrayList<>();
+        for (Path path : serverStorageRoots(storage)) {
+            roots.add(new ImpliedRoot(path, IMPLIED_SERVER_STORAGE));
+        }
+        for (Path path : normalizeAll(runtimePathConfig.getPipelineWatchedFoldersPaths())) {
+            roots.add(new ImpliedRoot(path, IMPLIED_WATCHED_FOLDER));
+        }
+        return List.copyOf(roots);
+    }
+
+    /** The local server file-storage directory, when that storage provider is enabled. */
+    private static List<Path> serverStorageRoots(ApplicationProperties.Storage storage) {
+        if (!storage.isEnabled() || !"local".equalsIgnoreCase(storage.getProvider())) {
+            return List.of();
+        }
+        String basePath = storage.getLocal().getBasePath();
+        if (basePath == null || basePath.isBlank()) {
+            return List.of();
+        }
+        return List.of(normalize(Path.of(basePath)));
+    }
+
     private static List<Path> normalizeAll(List<String> roots) {
         List<Path> result = new ArrayList<>();
         for (String root : roots) {
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/FolderAccessSettingsController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/FolderAccessSettingsController.java
new file mode 100644
index 0000000000..1b39aee106
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/FolderAccessSettingsController.java
@@ -0,0 +1,42 @@
+package stirling.software.proprietary.policy.controller;
+
+import java.util.List;
+
+import org.springframework.security.access.prepost.PreAuthorize;
+import org.springframework.web.bind.annotation.GetMapping;
+
+import io.swagger.v3.oas.annotations.Operation;
+
+import lombok.RequiredArgsConstructor;
+
+import stirling.software.common.annotations.api.AdminApi;
+import stirling.software.proprietary.policy.config.FolderAccessGuard;
+
+/**
+ * Read-only admin view of the folder roots that are always permitted for folder automations,
+ * regardless of {@code policies.allowedFolderRoots} (server storage, pipeline watched folders). The
+ * Folder Access settings section renders these so an admin can see what is implicitly allowed and
+ * why, without them being editable. The editable roots themselves live under the {@code policies}
+ * settings section.
+ */
+@AdminApi
+@PreAuthorize("hasRole('ADMIN')")
+@RequiredArgsConstructor
+public class FolderAccessSettingsController {
+
+    private final FolderAccessGuard folderAccessGuard;
+
+    @GetMapping("/policies/implied-folder-roots")
+    @Operation(
+            summary = "Implied folder roots",
+            description =
+                    "Stirling-managed directories always permitted for folder automations"
+                            + " regardless of policies.allowedFolderRoots. Read-only.")
+    public List<ImpliedFolderRoot> impliedFolderRoots() {
+        return folderAccessGuard.impliedRoots().stream()
+                .map(root -> new ImpliedFolderRoot(root.path().toString(), root.reason()))
+                .toList();
+    }
+
+    public record ImpliedFolderRoot(String path, String reason) {}
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
index 4ad611f42e..6539d9a34d 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
@@ -6,8 +6,10 @@ import java.util.Optional;
 
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
+import org.springframework.http.ProblemDetail;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.DeleteMapping;
+import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -23,6 +25,7 @@ import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.RequiredArgsConstructor;
 
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.proprietary.policy.config.FolderAccessDeniedException;
 import stirling.software.proprietary.policy.config.PolicyAccessGuard;
 import stirling.software.proprietary.policy.config.PolicyManagementAuthority;
 import stirling.software.proprietary.policy.input.InputSource;
@@ -45,6 +48,13 @@ import stirling.software.proprietary.util.SecretMasker;
 @Tag(name = "Sources", description = "Reusable policy input connections")
 public class SourceController {
 
+    /**
+     * Machine-readable marker on the error body when a folder source is rejected for pointing
+     * outside the allowed roots. The admin portal keys off this to offer a link straight to the
+     * Folder Access settings rather than only showing the message.
+     */
+    public static final String FOLDER_ACCESS_DENIED_CODE = "folderAccessDenied";
+
     private static final String WEBHOOK_TYPE = "webhook";
 
     private final SourceStore sourceStore;
@@ -114,6 +124,10 @@ public class SourceController {
         Source owned = withPreparedOptions(withStoredSecrets(resolveOwnership(source)), isCreate);
         try {
             validateConfig(owned);
+        } catch (FolderAccessDeniedException e) {
+            // Surfaced with a machine-readable code by handleFolderAccessDenied so the portal can
+            // link to the Folder Access settings; don't flatten it into a plain 400 here.
+            throw e;
         } catch (IllegalArgumentException e) {
             throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());
         }
@@ -150,6 +164,22 @@ public class SourceController {
         return ResponseEntity.noContent().build();
     }
 
+    /**
+     * A folder source was rejected for pointing outside the allowed roots. Return a 400 carrying
+     * {@link #FOLDER_ACCESS_DENIED_CODE} so the portal can offer a link to the Folder Access
+     * settings, while other guard rejections (SaaS mode, the protected config dir) fall through to
+     * the global handler as plain 400s the admin can't fix by editing the allowlist.
+     */
+    @ExceptionHandler(FolderAccessDeniedException.class)
+    public ResponseEntity<ProblemDetail> handleFolderAccessDenied(FolderAccessDeniedException ex) {
+        ProblemDetail problem =
+                ProblemDetail.forStatusAndDetail(HttpStatus.BAD_REQUEST, ex.getMessage());
+        problem.setProperty("code", FOLDER_ACCESS_DENIED_CODE);
+        return ResponseEntity.badRequest()
+                .contentType(MediaType.APPLICATION_PROBLEM_JSON)
+                .body(problem);
+    }
+
     /**
      * Stamp owner + team server-side. Create stamps the current user and their team; update
      * preserves the existing owner and team after verifying the source belongs to the caller's
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java
index 286c0f1d01..650acd968b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/controller/api/AdminSettingsController.java
@@ -673,6 +673,7 @@ public class AdminSettingsController {
             case "telegram" -> applicationProperties.getTelegram();
             case "aiengine", "aiEngine" -> applicationProperties.getAiEngine();
             case "mcp" -> applicationProperties.getMcp();
+            case "policies" -> applicationProperties.getPolicies();
             default -> null;
         };
     }
@@ -699,7 +700,8 @@ public class AdminSettingsController {
                     "telegram",
                     "aiEngine",
                     "aiengine",
-                    "mcp");
+                    "mcp",
+                    "policies");
 
     // Pattern to validate safe property paths - only alphanumeric, dots, and underscores
     private static final Pattern SAFE_KEY_PATTERN =
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/config/FolderAccessGuardTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/config/FolderAccessGuardTest.java
index 4859954e71..351dcd1d2f 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/config/FolderAccessGuardTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/config/FolderAccessGuardTest.java
@@ -13,6 +13,7 @@ import org.junit.jupiter.api.io.TempDir;
 import org.springframework.core.env.StandardEnvironment;
 
 import stirling.software.common.configuration.InstallationPathConfig;
+import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.proprietary.policy.model.InputSpec;
 import stirling.software.proprietary.policy.model.OutputSpec;
@@ -36,7 +37,37 @@ class FolderAccessGuardTest {
         properties.getPolicies().setAllowedFolderRoots(allowedRoots);
         StandardEnvironment environment = new StandardEnvironment();
         environment.setActiveProfiles(activeProfiles);
-        return new FolderAccessGuard(properties, environment, sourceStore);
+        return new FolderAccessGuard(
+                properties, new RuntimePathConfig(properties), environment, sourceStore);
+    }
+
+    private FolderAccessGuard guardWithStorage(
+            List<String> allowedRoots, boolean storageEnabled, String provider, String basePath) {
+        ApplicationProperties properties = new ApplicationProperties();
+        properties.getPolicies().setAllowedFolderRoots(allowedRoots);
+        ApplicationProperties.Storage storage = properties.getStorage();
+        storage.setEnabled(storageEnabled);
+        storage.setProvider(provider);
+        storage.getLocal().setBasePath(basePath);
+        return new FolderAccessGuard(
+                properties,
+                new RuntimePathConfig(properties),
+                new StandardEnvironment(),
+                sourceStore);
+    }
+
+    private FolderAccessGuard guardWithWatchedFolder(String watchedDir) {
+        ApplicationProperties properties = new ApplicationProperties();
+        properties
+                .getSystem()
+                .getCustomPaths()
+                .getPipeline()
+                .setWatchedFoldersDirs(List.of(watchedDir));
+        return new FolderAccessGuard(
+                properties,
+                new RuntimePathConfig(properties),
+                new StandardEnvironment(),
+                sourceStore);
     }
 
     @Test
@@ -50,8 +81,9 @@ class FolderAccessGuardTest {
     @Test
     void rejectsADirectoryOutsideEveryAllowedRoot() {
         FolderAccessGuard guard = guard(List.of(tempDir.toString()));
+        // FolderAccessDeniedException (not the base type): the admin can fix this in settings.
         assertThrows(
-                IllegalArgumentException.class,
+                FolderAccessDeniedException.class,
                 () -> guard.requirePermitted(tempDir.resolveSibling("elsewhere")));
     }
 
@@ -59,14 +91,50 @@ class FolderAccessGuardTest {
     void rejectsTraversalThatWalksOutOfAnAllowedRoot() {
         FolderAccessGuard guard = guard(List.of(tempDir.toString()));
         assertThrows(
-                IllegalArgumentException.class,
+                FolderAccessDeniedException.class,
                 () -> guard.requirePermitted(tempDir.resolve("..").resolve("escaped")));
     }
 
     @Test
     void rejectsEverythingWhenNoRootsAreConfigured() {
         FolderAccessGuard guard = guard(List.of());
-        assertThrows(IllegalArgumentException.class, () -> guard.requirePermitted(tempDir));
+        assertThrows(FolderAccessDeniedException.class, () -> guard.requirePermitted(tempDir));
+    }
+
+    @Test
+    void permitsTheLocalServerStorageDirectoryEvenWithNoConfiguredRoots() {
+        Path storageBase = tempDir.resolve("storage");
+        FolderAccessGuard guard =
+                guardWithStorage(List.of(), true, "local", storageBase.toString());
+        Path within = storageBase.resolve("inbox");
+
+        assertEquals(within.toAbsolutePath().normalize(), guard.requirePermitted(within));
+    }
+
+    @Test
+    void ignoresServerStorageWhenTheStorageFeatureIsDisabled() {
+        Path storageBase = tempDir.resolve("storage");
+        FolderAccessGuard guard =
+                guardWithStorage(List.of(), false, "local", storageBase.toString());
+
+        assertThrows(IllegalArgumentException.class, () -> guard.requirePermitted(storageBase));
+    }
+
+    @Test
+    void ignoresServerStorageWhenTheProviderIsNotLocal() {
+        Path storageBase = tempDir.resolve("storage");
+        FolderAccessGuard guard = guardWithStorage(List.of(), true, "s3", storageBase.toString());
+
+        assertThrows(IllegalArgumentException.class, () -> guard.requirePermitted(storageBase));
+    }
+
+    @Test
+    void permitsPipelineWatchedFoldersEvenWithNoConfiguredRoots() {
+        Path watched = tempDir.resolve("watched");
+        FolderAccessGuard guard = guardWithWatchedFolder(watched.toString());
+        Path within = watched.resolve("inbox");
+
+        assertEquals(within.toAbsolutePath().normalize(), guard.requirePermitted(within));
     }
 
     @Test
@@ -76,15 +144,21 @@ class FolderAccessGuardTest {
         // Allow the config dir's parent, so only the protected-path rule can reject it.
         FolderAccessGuard guard = guard(List.of(configDir.getParent().toString()));
 
-        assertThrows(
-                IllegalArgumentException.class,
-                () -> guard.requirePermitted(configDir.resolve("settings.yml")));
+        // Not a FolderAccessDeniedException: editing the allowlist can't unprotect the config dir.
+        IllegalArgumentException ex =
+                assertThrows(
+                        IllegalArgumentException.class,
+                        () -> guard.requirePermitted(configDir.resolve("settings.yml")));
+        assertFalse(ex instanceof FolderAccessDeniedException);
     }
 
     @Test
     void refusesAllFolderAccessUnderTheSaasProfile() {
         FolderAccessGuard guard = guard(List.of(tempDir.toString()), "saas");
-        assertThrows(IllegalArgumentException.class, () -> guard.requirePermitted(tempDir));
+        // Not a FolderAccessDeniedException: SaaS has no folder allowlist to point the admin at.
+        IllegalArgumentException ex =
+                assertThrows(IllegalArgumentException.class, () -> guard.requirePermitted(tempDir));
+        assertFalse(ex instanceof FolderAccessDeniedException);
     }
 
     @Test
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/FolderInputSourceTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/FolderInputSourceTest.java
index 64178ce9bb..bcb968ca8d 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/FolderInputSourceTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/input/FolderInputSourceTest.java
@@ -27,6 +27,7 @@ import org.mockito.Mock;
 import org.mockito.junit.jupiter.MockitoExtension;
 import org.springframework.core.env.StandardEnvironment;
 
+import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.util.FileReadinessChecker;
 import stirling.software.proprietary.policy.config.FolderAccessGuard;
@@ -57,7 +58,10 @@ class FolderInputSourceTest {
         properties.getPolicies().setAllowedFolderRoots(List.of(tempDir.toString()));
         FolderAccessGuard guard =
                 new FolderAccessGuard(
-                        properties, new StandardEnvironment(), new InProcessSourceStore());
+                        properties,
+                        new RuntimePathConfig(properties),
+                        new StandardEnvironment(),
+                        new InProcessSourceStore());
         source = new FolderInputSource(readinessChecker, guard);
         ledger = new InProcessProcessedLedger();
         ctx = new RecordingContext();
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/FolderOutputSinkTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/FolderOutputSinkTest.java
index f9e1c92403..7f9acf4fae 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/FolderOutputSinkTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/FolderOutputSinkTest.java
@@ -19,6 +19,7 @@ import org.springframework.core.env.StandardEnvironment;
 import org.springframework.core.io.ByteArrayResource;
 import org.springframework.core.io.Resource;
 
+import stirling.software.common.configuration.RuntimePathConfig;
 import stirling.software.common.model.ApplicationProperties;
 import stirling.software.common.model.job.ResultFile;
 import stirling.software.proprietary.policy.config.FolderAccessGuard;
@@ -49,7 +50,10 @@ class FolderOutputSinkTest {
         sink =
                 new FolderOutputSink(
                         new FolderAccessGuard(
-                                properties, new StandardEnvironment(), new InProcessSourceStore()),
+                                properties,
+                                new RuntimePathConfig(properties),
+                                new StandardEnvironment(),
+                                new InProcessSourceStore()),
                         ledger);
     }
 
@@ -113,7 +117,10 @@ class FolderOutputSinkTest {
         FolderOutputSink orderedSink =
                 new FolderOutputSink(
                         new FolderAccessGuard(
-                                properties, new StandardEnvironment(), new InProcessSourceStore()),
+                                properties,
+                                new RuntimePathConfig(properties),
+                                new StandardEnvironment(),
+                                new InProcessSourceStore()),
                         orderedLedger);
 
         orderedSink.deliver(
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index e3c636b49e..4c99d2a479 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -1099,6 +1099,25 @@ label = "Regenerate on Startup"
 description = "Number of days the certificate will be valid"
 label = "Certificate Validity (days)"
 
+[admin.settings.folderAccess]
+description = "Directories that folder sources and folder outputs are allowed to read from and write to. This is a security boundary: automations can never be pointed at a server path outside this list."
+securityNote = "Leave this empty to disable folder sources and outputs entirely. Stirling's own configuration directory is always off-limits."
+title = "Folder Access"
+
+[admin.settings.folderAccess.implied]
+description = "These Stirling-managed directories are always permitted and can't be changed here."
+serverStorage = "Server file storage"
+title = "Always allowed"
+watchedFolder = "Pipeline watched folder"
+
+[admin.settings.folderAccess.roots]
+add = "Add"
+empty = "No folders allowed. Folder sources and outputs are currently disabled."
+hint = "Enter absolute paths, for example /data/inbox."
+label = "Allowed folder roots"
+placeholder = "/data/inbox"
+remove = "Remove folder root"
+
 [admin.settings.general]
 description = "Configure system-wide application settings including branding and default behavior."
 system = "System"
@@ -8506,6 +8525,11 @@ editTitle = "Edit source"
 enabled = "Enabled"
 save = "Save changes"
 
+[portal.sources.builder.folderAccess]
+description = "Folder automations can only use folders an administrator has allowed. Add it under Folder Access settings, then try again."
+openSettings = "Folder Access settings"
+title = "This folder isn't allowed"
+
 [portal.sources.delete]
 body = "Delete \"{{name}}\"? This can't be undone. Policies that reference it would need to be updated."
 cancel = "Cancel"
@@ -9437,6 +9461,7 @@ advanced = "Advanced"
 database = "Database"
 endpoints = "Endpoints"
 features = "Features"
+folderAccess = "Folder Access"
 mcp = "MCP Server"
 storageSharing = "File Storage & Sharing"
 systemSettings = "System Settings"
diff --git a/frontend/editor/public/og-metadata.json b/frontend/editor/public/og-metadata.json
index 63461920ce..3053b4fd9e 100644
--- a/frontend/editor/public/og-metadata.json
+++ b/frontend/editor/public/og-metadata.json
@@ -470,6 +470,11 @@
       "title": "Admin Storage Sharing Settings - Stirling PDF",
       "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
     },
+    "/settings/adminFolderAccess": {
+      "image": "/og_images/home.png",
+      "title": "Admin Folder Access Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
     "/settings/adminMcp": {
       "image": "/og_images/home.png",
       "title": "Admin Mcp Settings - Stirling PDF",
@@ -673,6 +678,7 @@
     "/settings/adminUsage": "/settings/adminUsage",
     "/settings/adminEndpoints": "/settings/adminEndpoints",
     "/settings/adminStorageSharing": "/settings/adminStorageSharing",
+    "/settings/adminFolderAccess": "/settings/adminFolderAccess",
     "/settings/adminMcp": "/settings/adminMcp",
     "/settings/adminAiGeneral": "/settings/adminAiGeneral",
     "/settings/adminAiModels": "/settings/adminAiModels",
diff --git a/frontend/editor/public/og-metadata.saas.json b/frontend/editor/public/og-metadata.saas.json
index 8f581f2125..39f6bf414e 100644
--- a/frontend/editor/public/og-metadata.saas.json
+++ b/frontend/editor/public/og-metadata.saas.json
@@ -471,6 +471,11 @@
       "title": "Admin Storage Sharing Settings - Stirling PDF",
       "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
     },
+    "/settings/adminFolderAccess": {
+      "image": "/og_images/home.png",
+      "title": "Admin Folder Access Settings - Stirling PDF",
+      "description": "The Free Adobe Acrobat alternative (10M+ Downloads)"
+    },
     "/settings/adminMcp": {
       "image": "/og_images/home.png",
       "title": "Admin Mcp Settings - Stirling PDF",
@@ -686,6 +691,7 @@
     "/settings/adminUsage": "/settings/adminUsage",
     "/settings/adminEndpoints": "/settings/adminEndpoints",
     "/settings/adminStorageSharing": "/settings/adminStorageSharing",
+    "/settings/adminFolderAccess": "/settings/adminFolderAccess",
     "/settings/adminMcp": "/settings/adminMcp",
     "/settings/adminAiGeneral": "/settings/adminAiGeneral",
     "/settings/adminAiModels": "/settings/adminAiModels",
diff --git a/frontend/editor/src/core/components/shared/config/types.ts b/frontend/editor/src/core/components/shared/config/types.ts
index 1182933d61..6b7d62192d 100644
--- a/frontend/editor/src/core/components/shared/config/types.ts
+++ b/frontend/editor/src/core/components/shared/config/types.ts
@@ -31,6 +31,7 @@ export const VALID_NAV_KEYS = [
   "adminUsage",
   "adminEndpoints",
   "adminStorageSharing",
+  "adminFolderAccess",
   "adminMcp",
   "adminAiGeneral",
   "adminAiModels",
diff --git a/frontend/editor/src/portal/api/sources.ts b/frontend/editor/src/portal/api/sources.ts
index 47e456d094..4262a47a97 100644
--- a/frontend/editor/src/portal/api/sources.ts
+++ b/frontend/editor/src/portal/api/sources.ts
@@ -1,9 +1,31 @@
-import { apiClient } from "@portal/api/http";
+import { apiClient, HttpError } from "@portal/api/http";
 
 /**
  * Sources service layer: the backend contract.
  */
 
+/**
+ * Backend marker (on the error body) for a folder source rejected because its
+ * directory falls outside the allowed roots - the one folder-access failure an
+ * admin can fix in the Folder Access settings. Mirrors
+ * SourceController.FOLDER_ACCESS_DENIED_CODE.
+ */
+export const FOLDER_ACCESS_DENIED_CODE = "folderAccessDenied";
+
+/**
+ * True when a source save failed specifically because the folder is outside the
+ * allowed roots (so the caller can point the admin at settings), as opposed to
+ * any other 400 (blank directory, SaaS mode, the protected config dir).
+ */
+export function isFolderAccessDeniedError(error: unknown): boolean {
+  return (
+    error instanceof HttpError &&
+    typeof error.body === "object" &&
+    error.body !== null &&
+    (error.body as { code?: unknown }).code === FOLDER_ACCESS_DENIED_CODE
+  );
+}
+
 /** Overview row status: referenced and enabled, enabled-but-orphaned, or disabled. */
 export type SourceStatus = "active" | "unused" | "disabled";
 
diff --git a/frontend/editor/src/portal/views/SourceBuilder.test.tsx b/frontend/editor/src/portal/views/SourceBuilder.test.tsx
index 60a9f13b93..77186de7d8 100644
--- a/frontend/editor/src/portal/views/SourceBuilder.test.tsx
+++ b/frontend/editor/src/portal/views/SourceBuilder.test.tsx
@@ -7,10 +7,19 @@ import {
 } from "@testing-library/react";
 import { MantineProvider } from "@mantine/core";
 import { MemoryRouter, Route, Routes } from "react-router-dom";
+import type { ReactNode } from "react";
 import { SourceBuilder } from "@portal/views/SourceBuilder";
+import { UIProvider } from "@portal/contexts/UIContext";
+
+// SourceBuilder reads useUI() to open settings, so wrap in its provider.
+const Providers = ({ children }: { children: ReactNode }) => (
+  <MantineProvider>
+    <UIProvider>{children}</UIProvider>
+  </MantineProvider>
+);
 
 const render = (ui: Parameters<typeof baseRender>[0]) =>
-  baseRender(ui, { wrapper: MantineProvider });
+  baseRender(ui, { wrapper: Providers });
 
 vi.mock("react-i18next", () => ({
   useTranslation: () => ({
@@ -22,10 +31,12 @@ vi.mock("react-i18next", () => ({
 const createSource = vi.fn();
 const fetchSource = vi.fn();
 const deleteSource = vi.fn();
+const isFolderAccessDeniedError = vi.fn();
 vi.mock("@portal/api/sources", () => ({
   createSource: (s: unknown) => createSource(s),
   fetchSource: (id: string) => fetchSource(id),
   deleteSource: (id: string) => deleteSource(id),
+  isFolderAccessDeniedError: (e: unknown) => isFolderAccessDeniedError(e),
 }));
 
 const fetchS3Connections = vi.fn();
@@ -55,6 +66,8 @@ describe("SourceBuilder", () => {
     fetchSource.mockReset();
     deleteSource.mockReset();
     deleteSource.mockResolvedValue(undefined);
+    isFolderAccessDeniedError.mockReset();
+    isFolderAccessDeniedError.mockReturnValue(false);
     fetchS3Connections.mockReset();
     fetchS3Connections.mockResolvedValue([]);
   });
@@ -86,6 +99,54 @@ describe("SourceBuilder", () => {
     expect(await screen.findByText("sources list")).toBeInTheDocument();
   });
 
+  it("offers a Folder Access settings link when the folder is outside allowed roots", async () => {
+    createSource.mockRejectedValue(
+      new Error("outside the allowed folder roots"),
+    );
+    isFolderAccessDeniedError.mockReturnValue(true);
+    renderBuilder("/processor/sources/new");
+
+    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+      target: { value: "Claims intake" },
+    });
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.sources\.types\.folder\.fields\.directory\.label/,
+      ),
+      { target: { value: "/etc" } },
+    );
+    fireEvent.click(screen.getByText("portal.sources.builder.create"));
+
+    expect(
+      await screen.findByText("portal.sources.builder.folderAccess.title"),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("portal.sources.builder.folderAccess.openSettings"),
+    ).toBeInTheDocument();
+  });
+
+  it("shows a plain error banner (no settings link) for other save failures", async () => {
+    createSource.mockRejectedValue(new Error("boom"));
+    isFolderAccessDeniedError.mockReturnValue(false);
+    renderBuilder("/processor/sources/new");
+
+    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+      target: { value: "Claims intake" },
+    });
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.sources\.types\.folder\.fields\.directory\.label/,
+      ),
+      { target: { value: "/data/incoming" } },
+    );
+    fireEvent.click(screen.getByText("portal.sources.builder.create"));
+
+    expect(await screen.findByText("boom")).toBeInTheDocument();
+    expect(
+      screen.queryByText("portal.sources.builder.folderAccess.openSettings"),
+    ).not.toBeInTheDocument();
+  });
+
   it("gates the s3 type on a chosen connection", async () => {
     renderBuilder("/processor/sources/new");
     fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
diff --git a/frontend/editor/src/portal/views/SourceBuilder.tsx b/frontend/editor/src/portal/views/SourceBuilder.tsx
index 4da5a96460..4d6ff1af14 100644
--- a/frontend/editor/src/portal/views/SourceBuilder.tsx
+++ b/frontend/editor/src/portal/views/SourceBuilder.tsx
@@ -18,8 +18,10 @@ import {
   createSource,
   deleteSource,
   fetchSource,
+  isFolderAccessDeniedError,
   type Source,
 } from "@portal/api/sources";
+import { useUI } from "@portal/contexts/UIContext";
 import { useAsync } from "@portal/hooks/useAsync";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { creatableSourceTypes } from "@portal/components/sources/creatableSourceTypes";
@@ -69,6 +71,7 @@ function optionsFor(
 export function SourceBuilder() {
   const { t } = useTranslation();
   const navigate = useNavigate();
+  const { openSettings } = useUI();
   const { id } = useParams();
   const isEdit = Boolean(id);
   const listPath = toPortalPath(VIEW_PATHS.sources);
@@ -87,6 +90,9 @@ export function SourceBuilder() {
   const [seeded, setSeeded] = useState(false);
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
+  // A folder-outside-allowed-roots failure: the error banner offers a link to
+  // the Folder Access settings instead of leaving the admin at a dead end.
+  const [folderAccessDenied, setFolderAccessDenied] = useState(false);
   const [pendingDelete, setPendingDelete] = useState(false);
   const [deleting, setDeleting] = useState(false);
   const [reveal, setReveal] = useState<{
@@ -137,6 +143,7 @@ export function SourceBuilder() {
     if (!canSave) return;
     setSubmitting(true);
     setError(null);
+    setFolderAccessDenied(false);
     try {
       const saved = await createSource({
         id: isEdit ? id : undefined,
@@ -156,6 +163,7 @@ export function SourceBuilder() {
       navigate(listPath);
     } catch (e) {
       setError(errorMessage(e));
+      setFolderAccessDenied(isFolderAccessDeniedError(e));
       setSubmitting(false);
     }
   }
@@ -357,7 +365,34 @@ export function SourceBuilder() {
           </FormField>
         )}
 
-        {error && <Banner tone="danger" description={error} />}
+        {error &&
+          (folderAccessDenied ? (
+            <Banner
+              tone="danger"
+              title={t(
+                "portal.sources.builder.folderAccess.title",
+                "This folder isn't allowed",
+              )}
+              description={t(
+                "portal.sources.builder.folderAccess.description",
+                "Folder automations can only use folders an administrator has allowed. Add it under Folder Access settings, then try again.",
+              )}
+              action={
+                <Button
+                  variant="secondary"
+                  size="sm"
+                  onClick={() => openSettings("adminFolderAccess")}
+                >
+                  {t(
+                    "portal.sources.builder.folderAccess.openSettings",
+                    "Folder Access settings",
+                  )}
+                </Button>
+              }
+            />
+          ) : (
+            <Banner tone="danger" description={error} />
+          ))}
       </div>
 
       <Modal
diff --git a/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx b/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx
index 218d4b2f57..34effc2df9 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configNavSections.tsx
@@ -24,6 +24,7 @@ import AdminAiLimitsSection from "@app/components/shared/config/configSections/A
 import AdminAuditSection from "@app/components/shared/config/configSections/AdminAuditSection";
 import AdminUsageSection from "@app/components/shared/config/configSections/AdminUsageSection";
 import AdminStorageSharingSection from "@app/components/shared/config/configSections/AdminStorageSharingSection";
+import AdminFolderAccessSection from "@app/components/shared/config/configSections/AdminFolderAccessSection";
 import ApiKeys from "@app/components/shared/config/configSections/ApiKeys";
 import AccountSection from "@app/components/shared/config/configSections/AccountSection";
 import GeneralWithLoginLanding from "@app/components/shared/config/GeneralWithLoginLanding";
@@ -135,6 +136,14 @@ export const useConfigNavSections = (
           badge: t("toolPanel.alpha", "Alpha"),
           badgeColor: "orange",
         },
+        {
+          key: "adminFolderAccess",
+          label: t("settings.configuration.folderAccess", "Folder Access"),
+          icon: "folder-rounded",
+          component: <AdminFolderAccessSection />,
+          disabled: requiresLogin,
+          disabledTooltip: requiresLogin ? enableLoginTooltip : undefined,
+        },
         {
           key: "adminEndpoints",
           label: t("settings.configuration.endpoints", "Endpoints"),
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminFolderAccessSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminFolderAccessSection.tsx
new file mode 100644
index 0000000000..fad2782162
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminFolderAccessSection.tsx
@@ -0,0 +1,328 @@
+import { useCallback, useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+  Alert,
+  Code,
+  Group,
+  Loader,
+  Paper,
+  Stack,
+  Text,
+  TextInput,
+} from "@mantine/core";
+import { Button } from "@app/ui/Button";
+import LocalIcon from "@app/components/shared/LocalIcon";
+import { alert } from "@app/components/toast";
+import RestartConfirmationModal from "@app/components/shared/config/RestartConfirmationModal";
+import { useRestartServer } from "@app/components/shared/config/useRestartServer";
+import { useAdminSettings } from "@app/hooks/useAdminSettings";
+import PendingBadge from "@app/components/shared/config/PendingBadge";
+import { useLoginRequired } from "@app/hooks/useLoginRequired";
+import LoginRequiredBanner from "@app/components/shared/config/LoginRequiredBanner";
+import { SettingsStickyFooter } from "@app/components/shared/config/SettingsStickyFooter";
+import { useSettingsDirty } from "@app/hooks/useSettingsDirty";
+import apiClient from "@app/services/apiClient";
+
+interface FolderAccessSettingsData {
+  allowedFolderRoots?: string[];
+}
+
+interface ImpliedFolderRoot {
+  path: string;
+  reason: string;
+}
+
+export default function AdminFolderAccessSection() {
+  const { t } = useTranslation();
+  const { loginEnabled, validateLoginEnabled, getDisabledStyles } =
+    useLoginRequired();
+  const {
+    restartModalOpened,
+    showRestartModal,
+    closeRestartModal,
+    restartServer,
+  } = useRestartServer();
+
+  const {
+    settings,
+    setSettings,
+    loading,
+    saving,
+    fetchSettings,
+    saveSettings,
+    isFieldPending,
+  } = useAdminSettings<FolderAccessSettingsData>({ sectionName: "policies" });
+
+  const [newRoot, setNewRoot] = useState("");
+  const [impliedRoots, setImpliedRoots] = useState<ImpliedFolderRoot[]>([]);
+
+  useEffect(() => {
+    if (loginEnabled) {
+      fetchSettings();
+    }
+  }, [loginEnabled]);
+
+  useEffect(() => {
+    if (!loginEnabled) return;
+    apiClient
+      .get<ImpliedFolderRoot[]>(
+        "/api/v1/admin/settings/policies/implied-folder-roots",
+      )
+      .then((res) => setImpliedRoots(res.data ?? []))
+      .catch(() => setImpliedRoots([]));
+  }, [loginEnabled]);
+
+  const roots = settings.allowedFolderRoots ?? [];
+
+  const reasonLabel = (reason: string) => {
+    switch (reason) {
+      case "serverStorage":
+        return t(
+          "admin.settings.folderAccess.implied.serverStorage",
+          "Server file storage",
+        );
+      case "watchedFolder":
+        return t(
+          "admin.settings.folderAccess.implied.watchedFolder",
+          "Pipeline watched folder",
+        );
+      default:
+        return reason;
+    }
+  };
+
+  const { isDirty, resetToSnapshot, markSaved } = useSettingsDirty(
+    settings,
+    loading,
+  );
+
+  const setRoots = useCallback(
+    (next: string[]) => {
+      setSettings({ ...settings, allowedFolderRoots: next });
+    },
+    [settings, setSettings],
+  );
+
+  const addRoot = useCallback(() => {
+    const value = newRoot.trim();
+    if (!value) return;
+    if (roots.includes(value)) {
+      setNewRoot("");
+      return;
+    }
+    setRoots([...roots, value]);
+    setNewRoot("");
+  }, [newRoot, roots, setRoots]);
+
+  const removeRoot = useCallback(
+    (value: string) => {
+      setRoots(roots.filter((root) => root !== value));
+    },
+    [roots, setRoots],
+  );
+
+  const handleDiscard = useCallback(() => {
+    setSettings(resetToSnapshot());
+    setNewRoot("");
+  }, [resetToSnapshot, setSettings]);
+
+  const handleSave = async () => {
+    if (!validateLoginEnabled()) {
+      return;
+    }
+    try {
+      await saveSettings();
+      markSaved();
+      showRestartModal();
+    } catch (_error) {
+      alert({
+        alertType: "error",
+        title: t("admin.error", "Error"),
+        body: t("admin.settings.saveError", "Failed to save settings"),
+      });
+    }
+  };
+
+  if (loginEnabled && loading) {
+    return (
+      <Stack align="center" justify="center" h={200}>
+        <Loader size="lg" />
+      </Stack>
+    );
+  }
+
+  return (
+    <div className="settings-section-container">
+      <div className="settings-section-content">
+        <Stack gap="sm">
+          <LoginRequiredBanner show={!loginEnabled} />
+          <div>
+            <Group gap="xs" align="center">
+              <Text fw={600} size="lg">
+                {t("admin.settings.folderAccess.title", "Folder Access")}
+              </Text>
+              {isFieldPending("allowedFolderRoots") && (
+                <PendingBadge show={true} />
+              )}
+            </Group>
+            <Text size="sm" c="dimmed">
+              {t(
+                "admin.settings.folderAccess.description",
+                "Directories that folder sources and folder outputs are allowed to read from and write to. This is a security boundary: automations can never be pointed at a server path outside this list.",
+              )}
+            </Text>
+          </div>
+
+          <Alert variant="light" color="blue">
+            <Text size="xs">
+              {t(
+                "admin.settings.folderAccess.securityNote",
+                "Leave this empty to disable folder sources and outputs entirely. Stirling's own configuration directory is always off-limits, and folder access is always disabled in hosted (SaaS) mode.",
+              )}
+            </Text>
+          </Alert>
+
+          <Paper withBorder p="sm" radius="md">
+            <Stack gap="sm">
+              <div>
+                <Text fw={600} size="sm">
+                  {t(
+                    "admin.settings.folderAccess.roots.label",
+                    "Allowed folder roots",
+                  )}
+                </Text>
+                <Text size="xs" c="dimmed">
+                  {t(
+                    "admin.settings.folderAccess.roots.hint",
+                    "Enter absolute paths, for example /data/inbox.",
+                  )}
+                </Text>
+              </div>
+
+              {roots.length === 0 ? (
+                <Text size="sm" c="dimmed" fs="italic">
+                  {t(
+                    "admin.settings.folderAccess.roots.empty",
+                    "No folders allowed. Folder sources and outputs are currently disabled.",
+                  )}
+                </Text>
+              ) : (
+                <Stack gap="xs">
+                  {roots.map((root) => (
+                    <Group
+                      key={root}
+                      justify="space-between"
+                      wrap="nowrap"
+                      gap="xs"
+                    >
+                      <Code style={{ wordBreak: "break-all" }}>{root}</Code>
+                      <Button
+                        variant="tertiary"
+                        aria-label={t(
+                          "admin.settings.folderAccess.roots.remove",
+                          "Remove folder root",
+                        )}
+                        leftSection={
+                          <LocalIcon
+                            icon="close-rounded"
+                            width="1.1rem"
+                            height="1.1rem"
+                          />
+                        }
+                        onClick={() => removeRoot(root)}
+                        disabled={!loginEnabled}
+                        style={{ flexShrink: 0 }}
+                      />
+                    </Group>
+                  ))}
+                </Stack>
+              )}
+
+              <Group gap="xs" align="flex-end" wrap="nowrap">
+                <TextInput
+                  style={{ flex: 1 }}
+                  value={newRoot}
+                  onChange={(e) => setNewRoot(e.currentTarget.value)}
+                  onKeyDown={(e) => {
+                    if (e.key === "Enter") {
+                      e.preventDefault();
+                      addRoot();
+                    }
+                  }}
+                  placeholder={t(
+                    "admin.settings.folderAccess.roots.placeholder",
+                    "/data/inbox",
+                  )}
+                  disabled={!loginEnabled}
+                  styles={getDisabledStyles()}
+                />
+                <Button
+                  variant="secondary"
+                  onClick={addRoot}
+                  disabled={!loginEnabled || newRoot.trim().length === 0}
+                >
+                  {t("admin.settings.folderAccess.roots.add", "Add")}
+                </Button>
+              </Group>
+            </Stack>
+          </Paper>
+
+          {impliedRoots.length > 0 && (
+            <Paper withBorder p="sm" radius="md">
+              <Stack gap="sm">
+                <div>
+                  <Text fw={600} size="sm">
+                    {t(
+                      "admin.settings.folderAccess.implied.title",
+                      "Always allowed",
+                    )}
+                  </Text>
+                  <Text size="xs" c="dimmed">
+                    {t(
+                      "admin.settings.folderAccess.implied.description",
+                      "These Stirling-managed directories are always permitted and can't be changed here.",
+                    )}
+                  </Text>
+                </div>
+                <Stack gap="xs">
+                  {impliedRoots.map((root) => (
+                    <Group
+                      key={root.path}
+                      justify="space-between"
+                      wrap="nowrap"
+                      gap="xs"
+                      align="center"
+                    >
+                      <Code style={{ wordBreak: "break-all" }}>
+                        {root.path}
+                      </Code>
+                      <Group gap={6} wrap="nowrap" style={{ flexShrink: 0 }}>
+                        <Text size="xs" c="dimmed">
+                          {reasonLabel(root.reason)}
+                        </Text>
+                        <LocalIcon icon="lock" width="1rem" height="1rem" />
+                      </Group>
+                    </Group>
+                  ))}
+                </Stack>
+              </Stack>
+            </Paper>
+          )}
+
+          <RestartConfirmationModal
+            opened={restartModalOpened}
+            onClose={closeRestartModal}
+            onRestart={restartServer}
+          />
+        </Stack>
+      </div>
+      <SettingsStickyFooter
+        isDirty={isDirty}
+        saving={saving}
+        loginEnabled={loginEnabled}
+        onSave={handleSave}
+        onDiscard={handleDiscard}
+      />
+    </div>
+  );
+}
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminStorageSharingSection.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminStorageSharingSection.tsx
index 49f5064eb7..6ab2a0fef8 100644
--- a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminStorageSharingSection.tsx
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminStorageSharingSection.tsx
@@ -121,8 +121,8 @@ export default function AdminStorageSharingSection() {
       return;
     }
     try {
-      markSaved();
       await saveSettings();
+      markSaved();
       showRestartModal();
     } catch (_error) {
       alert({

From a1b1f974a033126bf7dd20332d9e54b350e935f5 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Thu, 23 Jul 2026 11:22:46 +0000
Subject: [PATCH 090/109] Show brand mark and Stirling name in processor
 sidebar (#7125)

# Description of Changes
Change logo in top left
<img width="872" height="160" alt="image"
src="https://github.com/user-attachments/assets/69f5366c-8640-41ca-9555-c5d30881678d"
/>

---

## Checklist

### General

- [ ] I have read the [Contribution
Guidelines](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/CONTRIBUTING.md)
- [ ] I have read the [Stirling-PDF Developer
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md)
(if applicable)
- [ ] I have read the [How to add new languages to
Stirling-PDF](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md)
(if applicable)
- [ ] I have performed a self-review of my own code
- [ ] My changes generate no new warnings

### Documentation

- [ ] I have updated relevant docs on [Stirling-PDF's doc
repo](https://github.com/Stirling-Tools/Stirling-Tools.github.io/blob/main/docs/)
(if functionality has heavily changed)
- [ ] I have read the section [Add New Translation
Tags](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/devGuide/HowToAddNewLanguage.md#add-new-translation-tags)
(for new translation tags only)

### Translations (if applicable)

- [ ] I ran
[`scripts/counter_translation.py`](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/docs/counter_translation.md)

### UI Changes (if applicable)

- [ ] Screenshots or videos demonstrating the UI changes are attached
(e.g., as comments or direct attachments in the PR)

### Testing (if applicable)

- [ ] I have run `task check` to verify linters, typechecks, and tests
pass
- [ ] I have tested my changes locally. Refer to the [Testing
Guide](https://github.com/Stirling-Tools/Stirling-PDF/blob/main/DeveloperGuide.md#7-testing)
for more details.
---
 .../brand/modern-logo/StirlingLogoBlackText.svg   |  1 +
 .../brand/modern-logo/StirlingLogoWhiteText.svg   |  1 +
 .../modern-logo/StirlingProcessorLogoNoText.svg   |  4 ++++
 frontend/editor/src/portal/components/Sidebar.css | 14 +++++++++++---
 frontend/editor/src/portal/components/Sidebar.tsx | 15 +++++++++++----
 5 files changed, 28 insertions(+), 7 deletions(-)
 create mode 100644 frontend/editor/src/core/assets/brand/modern-logo/StirlingLogoBlackText.svg
 create mode 100644 frontend/editor/src/core/assets/brand/modern-logo/StirlingLogoWhiteText.svg
 create mode 100644 frontend/editor/src/core/assets/brand/modern-logo/StirlingProcessorLogoNoText.svg

diff --git a/frontend/editor/src/core/assets/brand/modern-logo/StirlingLogoBlackText.svg b/frontend/editor/src/core/assets/brand/modern-logo/StirlingLogoBlackText.svg
new file mode 100644
index 0000000000..6b22c535a5
--- /dev/null
+++ b/frontend/editor/src/core/assets/brand/modern-logo/StirlingLogoBlackText.svg
@@ -0,0 +1 @@
+<svg width="75" height="26" viewBox="0 0 75 26" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.89479 22.2333C4.71702 22.2333 3.7059 22.0667 2.86146 21.7333C2.03924 21.4 1.4059 20.8111 0.96146 19.9667C0.517015 19.1222 0.294793 17.9333 0.294793 16.4V15.2333C0.983682 15.2333 1.66146 15.2333 2.32813 15.2333C2.99479 15.2333 3.66146 15.2333 4.32813 15.2333V16.7333C4.32813 17.5556 4.39479 18.1889 4.52813 18.6333C4.66146 19.0556 4.85035 19.3556 5.09479 19.5333C5.33924 19.6889 5.62813 19.7667 5.96146 19.7667C6.47257 19.7667 6.87257 19.5889 7.16146 19.2333C7.47257 18.8556 7.62813 18.1333 7.62813 17.0667C7.62813 16.2444 7.49479 15.6333 7.22813 15.2333C6.98368 14.8111 6.58368 14.4778 6.02813 14.2333C5.47257 13.9667 4.76146 13.6444 3.89479 13.2667C3.11702 12.9333 2.47257 12.5333 1.96146 12.0667C1.45035 11.6 1.07257 11.0111 0.828126 10.3C0.583682 9.58889 0.46146 8.72222 0.46146 7.7C0.46146 6.41111 0.628126 5.36667 0.96146 4.56667C1.31702 3.76667 1.89479 3.18889 2.69479 2.83333C3.51702 2.45556 4.61702 2.26667 5.99479 2.26667C7.77257 2.26667 9.12813 2.65556 10.0615 3.43333C11.017 4.18889 11.4948 5.33333 11.4948 6.86667V9.23333C10.8503 9.23333 10.2059 9.23333 9.56146 9.23333C8.93924 9.23333 8.29479 9.23333 7.62813 9.23333V8.03333C7.62813 7.03333 7.5059 6.33333 7.26146 5.93333C7.03924 5.53333 6.62813 5.33333 6.02813 5.33333C5.45035 5.33333 5.03924 5.51111 4.79479 5.86667C4.55035 6.22222 4.42813 6.8 4.42813 7.6C4.42813 8.33333 4.57257 8.91111 4.86146 9.33333C5.17257 9.73333 5.56146 10.0444 6.02813 10.2667C6.49479 10.4667 6.99479 10.6667 7.52813 10.8667C8.5059 11.2444 9.3059 11.6333 9.92813 12.0333C10.5503 12.4111 11.0059 12.9444 11.2948 13.6333C11.5837 14.3 11.7281 15.2667 11.7281 16.5333C11.7281 17.9556 11.4837 19.0889 10.9948 19.9333C10.5281 20.7556 9.85035 21.3444 8.96146 21.7C8.09479 22.0556 7.07257 22.2333 5.89479 22.2333ZM18.649 22.1C18.1378 22.1 17.6267 22.0556 17.1156 21.9667C16.6045 21.8778 16.149 21.7111 15.749 21.4667C15.349 21.2 15.0267 20.8333 14.7823 20.3667C14.5378 19.8778 14.4156 19.2333 14.4156 18.4333V7.73333H12.849V5.83333L14.749 5.5L15.2823 2.46667H18.2156V5.5H21.349V7.73333H18.2156V17.7667C18.2156 18.2333 18.3045 18.6556 18.4823 19.0333C18.6601 19.3889 19.0601 19.5667 19.6823 19.5667C19.9712 19.5667 20.3045 19.5556 20.6823 19.5333C21.0601 19.4889 21.2823 19.4667 21.349 19.4667V21.7667C21.2823 21.7667 20.9712 21.8222 20.4156 21.9333C19.8823 22.0444 19.2934 22.1 18.649 22.1ZM22.9938 22V5.5H26.7938V22H22.9938ZM24.8938 3.66667C24.4049 3.66667 23.9826 3.5 23.6271 3.16667C23.2715 2.81111 23.0938 2.4 23.0938 1.93333C23.0938 1.44444 23.2715 1.03333 23.6271 0.699999C23.9826 0.366666 24.4049 0.199999 24.8938 0.199999C25.3826 0.199999 25.8049 0.366666 26.1604 0.699999C26.5382 1.03333 26.7271 1.44444 26.7271 1.93333C26.7271 2.4 26.5382 2.81111 26.1604 3.16667C25.8049 3.5 25.3826 3.66667 24.8938 3.66667ZM29.3089 22V5.5H32.5422L32.8755 7.46667C33.0755 6.97778 33.3755 6.58889 33.7755 6.3C34.1755 5.98889 34.5977 5.77778 35.0422 5.66667C35.7755 5.35556 36.5422 5.27778 37.3422 5.43333V8.36667C37.2977 8.34444 37.12 8.32222 36.8089 8.3C36.52 8.25556 36.1866 8.25556 35.8089 8.3C35.4311 8.32222 35.1089 8.41111 34.8422 8.56667C34.2866 8.76667 33.8533 9.11111 33.5422 9.6C33.2533 10.0889 33.1089 10.6778 33.1089 11.3667V22H29.3089ZM38.6839 22V0.933333H42.4839V22H38.6839ZM44.999 22V5.5H48.799V22H44.999ZM46.899 3.66667C46.4101 3.66667 45.9878 3.5 45.6323 3.16667C45.2767 2.81111 45.099 2.4 45.099 1.93333C45.099 1.44444 45.2767 1.03333 45.6323 0.699999C45.9878 0.366666 46.4101 0.199999 46.899 0.199999C47.3878 0.199999 47.8101 0.366666 48.1656 0.699999C48.5434 1.03333 48.7323 1.44444 48.7323 1.93333C48.7323 2.4 48.5434 2.81111 48.1656 3.16667C47.8101 3.5 47.3878 3.66667 46.899 3.66667ZM51.3141 22V5.5H54.5474L54.8807 7.43333C55.0807 6.76667 55.4696 6.22222 56.0474 5.8C56.6474 5.37778 57.303 5.16667 58.0141 5.16667C59.0807 5.16667 59.8807 5.35556 60.4141 5.73333C60.9474 6.08889 61.303 6.6 61.4807 7.26667C61.6807 7.91111 61.7807 8.67778 61.7807 9.56667V22H57.9807V9.8C57.9807 9.53333 57.9696 9.28889 57.9474 9.06667C57.9252 8.82222 57.8585 8.61111 57.7474 8.43333C57.6585 8.25556 57.5252 8.12222 57.3474 8.03333C57.1696 7.92222 56.903 7.86667 56.5474 7.86667C56.2807 7.86667 56.0474 7.92222 55.8474 8.03333C55.6474 8.12222 55.4918 8.23333 55.3807 8.36667C55.2696 8.5 55.1807 8.62222 55.1141 8.73333V22H51.3141ZM68.976 25.9667C68.6649 25.9667 68.2872 25.9556 67.8427 25.9333C67.3983 25.9111 66.9538 25.8778 66.5094 25.8333C66.0872 25.7889 65.7205 25.7444 65.4094 25.7C65.1205 25.6778 64.9427 25.6556 64.876 25.6333V23.6C65.1649 23.6444 65.5983 23.6889 66.176 23.7333C66.7538 23.8 67.2427 23.8333 67.6427 23.8333C67.9983 23.8333 68.3316 23.8 68.6427 23.7333C68.976 23.6889 69.2649 23.5778 69.5094 23.4C69.776 23.2444 69.9872 23 70.1427 22.6667C70.2983 22.3556 70.376 21.9333 70.376 21.4V19.0333C70.2649 19.3 70.0983 19.6 69.876 19.9333C69.676 20.2444 69.376 20.5111 68.976 20.7333C68.576 20.9556 68.0094 21.0667 67.276 21.0667C66.7427 21.0667 66.2538 21.0111 65.8094 20.9C65.3872 20.7667 65.0205 20.5333 64.7094 20.2C64.4205 19.8444 64.1872 19.3444 64.0094 18.7C63.8316 18.0333 63.7427 17.1667 63.7427 16.1V9.36667C63.7427 7.96667 64.0316 6.92222 64.6094 6.23333C65.2094 5.52222 66.1094 5.16667 67.3094 5.16667C68.0205 5.16667 68.5872 5.25556 69.0094 5.43333C69.4538 5.61111 69.8094 5.86667 70.076 6.2C70.3427 6.51111 70.5538 6.87778 70.7094 7.3L70.2094 7.36667L70.776 5.5H74.176V19.5333C74.176 20.3333 74.0983 21.1222 73.9427 21.9C73.8094 22.6556 73.5649 23.3333 73.2094 23.9333C72.8538 24.5556 72.3316 25.0444 71.6427 25.4C70.976 25.7778 70.0872 25.9667 68.976 25.9667ZM68.9094 18.8C69.2872 18.8 69.576 18.7111 69.776 18.5333C69.9983 18.3333 70.1427 18.0667 70.2094 17.7333C70.2983 17.3778 70.3427 17.0111 70.3427 16.6333V8.46667C70.2983 8.35556 70.2205 8.24444 70.1094 8.13333C69.9983 8.02222 69.8427 7.92222 69.6427 7.83333C69.4649 7.74444 69.2094 7.7 68.876 7.7C68.4316 7.7 68.0983 7.83333 67.876 8.1C67.6538 8.34444 67.5427 8.81111 67.5427 9.5V17.1C67.5427 17.4778 67.5872 17.7889 67.676 18.0333C67.7649 18.2556 67.876 18.4222 68.0094 18.5333C68.1649 18.6444 68.3205 18.7222 68.476 18.7667C68.6316 18.7889 68.776 18.8 68.9094 18.8Z" fill="black"/></svg>
diff --git a/frontend/editor/src/core/assets/brand/modern-logo/StirlingLogoWhiteText.svg b/frontend/editor/src/core/assets/brand/modern-logo/StirlingLogoWhiteText.svg
new file mode 100644
index 0000000000..5cdd32f18d
--- /dev/null
+++ b/frontend/editor/src/core/assets/brand/modern-logo/StirlingLogoWhiteText.svg
@@ -0,0 +1 @@
+<svg width="75" height="26" viewBox="0 0 75 26" fill="none" xmlns="http://www.w3.org/2000/svg"><path d="M5.89479 22.2333C4.71702 22.2333 3.7059 22.0667 2.86146 21.7333C2.03924 21.4 1.4059 20.8111 0.96146 19.9667C0.517015 19.1222 0.294793 17.9333 0.294793 16.4V15.2333C0.983682 15.2333 1.66146 15.2333 2.32813 15.2333C2.99479 15.2333 3.66146 15.2333 4.32813 15.2333V16.7333C4.32813 17.5556 4.39479 18.1889 4.52813 18.6333C4.66146 19.0556 4.85035 19.3556 5.09479 19.5333C5.33924 19.6889 5.62813 19.7667 5.96146 19.7667C6.47257 19.7667 6.87257 19.5889 7.16146 19.2333C7.47257 18.8556 7.62813 18.1333 7.62813 17.0667C7.62813 16.2444 7.49479 15.6333 7.22813 15.2333C6.98368 14.8111 6.58368 14.4778 6.02813 14.2333C5.47257 13.9667 4.76146 13.6444 3.89479 13.2667C3.11702 12.9333 2.47257 12.5333 1.96146 12.0667C1.45035 11.6 1.07257 11.0111 0.828126 10.3C0.583682 9.58889 0.46146 8.72222 0.46146 7.7C0.46146 6.41111 0.628126 5.36667 0.96146 4.56667C1.31702 3.76667 1.89479 3.18889 2.69479 2.83333C3.51702 2.45556 4.61702 2.26667 5.99479 2.26667C7.77257 2.26667 9.12813 2.65556 10.0615 3.43333C11.017 4.18889 11.4948 5.33333 11.4948 6.86667V9.23333C10.8503 9.23333 10.2059 9.23333 9.56146 9.23333C8.93924 9.23333 8.29479 9.23333 7.62813 9.23333V8.03333C7.62813 7.03333 7.5059 6.33333 7.26146 5.93333C7.03924 5.53333 6.62813 5.33333 6.02813 5.33333C5.45035 5.33333 5.03924 5.51111 4.79479 5.86667C4.55035 6.22222 4.42813 6.8 4.42813 7.6C4.42813 8.33333 4.57257 8.91111 4.86146 9.33333C5.17257 9.73333 5.56146 10.0444 6.02813 10.2667C6.49479 10.4667 6.99479 10.6667 7.52813 10.8667C8.5059 11.2444 9.3059 11.6333 9.92813 12.0333C10.5503 12.4111 11.0059 12.9444 11.2948 13.6333C11.5837 14.3 11.7281 15.2667 11.7281 16.5333C11.7281 17.9556 11.4837 19.0889 10.9948 19.9333C10.5281 20.7556 9.85035 21.3444 8.96146 21.7C8.09479 22.0556 7.07257 22.2333 5.89479 22.2333ZM18.649 22.1C18.1378 22.1 17.6267 22.0556 17.1156 21.9667C16.6045 21.8778 16.149 21.7111 15.749 21.4667C15.349 21.2 15.0267 20.8333 14.7823 20.3667C14.5378 19.8778 14.4156 19.2333 14.4156 18.4333V7.73333H12.849V5.83333L14.749 5.5L15.2823 2.46667H18.2156V5.5H21.349V7.73333H18.2156V17.7667C18.2156 18.2333 18.3045 18.6556 18.4823 19.0333C18.6601 19.3889 19.0601 19.5667 19.6823 19.5667C19.9712 19.5667 20.3045 19.5556 20.6823 19.5333C21.0601 19.4889 21.2823 19.4667 21.349 19.4667V21.7667C21.2823 21.7667 20.9712 21.8222 20.4156 21.9333C19.8823 22.0444 19.2934 22.1 18.649 22.1ZM22.9938 22V5.5H26.7938V22H22.9938ZM24.8938 3.66667C24.4049 3.66667 23.9826 3.5 23.6271 3.16667C23.2715 2.81111 23.0938 2.4 23.0938 1.93333C23.0938 1.44444 23.2715 1.03333 23.6271 0.699999C23.9826 0.366666 24.4049 0.199999 24.8938 0.199999C25.3826 0.199999 25.8049 0.366666 26.1604 0.699999C26.5382 1.03333 26.7271 1.44444 26.7271 1.93333C26.7271 2.4 26.5382 2.81111 26.1604 3.16667C25.8049 3.5 25.3826 3.66667 24.8938 3.66667ZM29.3089 22V5.5H32.5422L32.8755 7.46667C33.0755 6.97778 33.3755 6.58889 33.7755 6.3C34.1755 5.98889 34.5977 5.77778 35.0422 5.66667C35.7755 5.35556 36.5422 5.27778 37.3422 5.43333V8.36667C37.2977 8.34444 37.12 8.32222 36.8089 8.3C36.52 8.25556 36.1866 8.25556 35.8089 8.3C35.4311 8.32222 35.1089 8.41111 34.8422 8.56667C34.2866 8.76667 33.8533 9.11111 33.5422 9.6C33.2533 10.0889 33.1089 10.6778 33.1089 11.3667V22H29.3089ZM38.6839 22V0.933333H42.4839V22H38.6839ZM44.999 22V5.5H48.799V22H44.999ZM46.899 3.66667C46.4101 3.66667 45.9878 3.5 45.6323 3.16667C45.2767 2.81111 45.099 2.4 45.099 1.93333C45.099 1.44444 45.2767 1.03333 45.6323 0.699999C45.9878 0.366666 46.4101 0.199999 46.899 0.199999C47.3878 0.199999 47.8101 0.366666 48.1656 0.699999C48.5434 1.03333 48.7323 1.44444 48.7323 1.93333C48.7323 2.4 48.5434 2.81111 48.1656 3.16667C47.8101 3.5 47.3878 3.66667 46.899 3.66667ZM51.3141 22V5.5H54.5474L54.8807 7.43333C55.0807 6.76667 55.4696 6.22222 56.0474 5.8C56.6474 5.37778 57.303 5.16667 58.0141 5.16667C59.0807 5.16667 59.8807 5.35556 60.4141 5.73333C60.9474 6.08889 61.303 6.6 61.4807 7.26667C61.6807 7.91111 61.7807 8.67778 61.7807 9.56667V22H57.9807V9.8C57.9807 9.53333 57.9696 9.28889 57.9474 9.06667C57.9252 8.82222 57.8585 8.61111 57.7474 8.43333C57.6585 8.25556 57.5252 8.12222 57.3474 8.03333C57.1696 7.92222 56.903 7.86667 56.5474 7.86667C56.2807 7.86667 56.0474 7.92222 55.8474 8.03333C55.6474 8.12222 55.4918 8.23333 55.3807 8.36667C55.2696 8.5 55.1807 8.62222 55.1141 8.73333V22H51.3141ZM68.976 25.9667C68.6649 25.9667 68.2872 25.9556 67.8427 25.9333C67.3983 25.9111 66.9538 25.8778 66.5094 25.8333C66.0872 25.7889 65.7205 25.7444 65.4094 25.7C65.1205 25.6778 64.9427 25.6556 64.876 25.6333V23.6C65.1649 23.6444 65.5983 23.6889 66.176 23.7333C66.7538 23.8 67.2427 23.8333 67.6427 23.8333C67.9983 23.8333 68.3316 23.8 68.6427 23.7333C68.976 23.6889 69.2649 23.5778 69.5094 23.4C69.776 23.2444 69.9872 23 70.1427 22.6667C70.2983 22.3556 70.376 21.9333 70.376 21.4V19.0333C70.2649 19.3 70.0983 19.6 69.876 19.9333C69.676 20.2444 69.376 20.5111 68.976 20.7333C68.576 20.9556 68.0094 21.0667 67.276 21.0667C66.7427 21.0667 66.2538 21.0111 65.8094 20.9C65.3872 20.7667 65.0205 20.5333 64.7094 20.2C64.4205 19.8444 64.1872 19.3444 64.0094 18.7C63.8316 18.0333 63.7427 17.1667 63.7427 16.1V9.36667C63.7427 7.96667 64.0316 6.92222 64.6094 6.23333C65.2094 5.52222 66.1094 5.16667 67.3094 5.16667C68.0205 5.16667 68.5872 5.25556 69.0094 5.43333C69.4538 5.61111 69.8094 5.86667 70.076 6.2C70.3427 6.51111 70.5538 6.87778 70.7094 7.3L70.2094 7.36667L70.776 5.5H74.176V19.5333C74.176 20.3333 74.0983 21.1222 73.9427 21.9C73.8094 22.6556 73.5649 23.3333 73.2094 23.9333C72.8538 24.5556 72.3316 25.0444 71.6427 25.4C70.976 25.7778 70.0872 25.9667 68.976 25.9667ZM68.9094 18.8C69.2872 18.8 69.576 18.7111 69.776 18.5333C69.9983 18.3333 70.1427 18.0667 70.2094 17.7333C70.2983 17.3778 70.3427 17.0111 70.3427 16.6333V8.46667C70.2983 8.35556 70.2205 8.24444 70.1094 8.13333C69.9983 8.02222 69.8427 7.92222 69.6427 7.83333C69.4649 7.74444 69.2094 7.7 68.876 7.7C68.4316 7.7 68.0983 7.83333 67.876 8.1C67.6538 8.34444 67.5427 8.81111 67.5427 9.5V17.1C67.5427 17.4778 67.5872 17.7889 67.676 18.0333C67.7649 18.2556 67.876 18.4222 68.0094 18.5333C68.1649 18.6444 68.3205 18.7222 68.476 18.7667C68.6316 18.7889 68.776 18.8 68.9094 18.8Z" fill="white"/></svg>
diff --git a/frontend/editor/src/core/assets/brand/modern-logo/StirlingProcessorLogoNoText.svg b/frontend/editor/src/core/assets/brand/modern-logo/StirlingProcessorLogoNoText.svg
new file mode 100644
index 0000000000..ac9fa92de5
--- /dev/null
+++ b/frontend/editor/src/core/assets/brand/modern-logo/StirlingProcessorLogoNoText.svg
@@ -0,0 +1,4 @@
+<svg width="22" height="22" viewBox="0 0 117 118" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M4.4266 58.4565L75.1855 0.000123003L75.1856 54.5919L4.4266 113.048L4.4266 58.4565Z" fill="#AD7373"/>
+<path d="M41.7248 62.4581L112.568 3.93241L112.568 58.5889L41.7248 117.115L41.7248 62.4581Z" fill="#8E3131"/>
+</svg>
diff --git a/frontend/editor/src/portal/components/Sidebar.css b/frontend/editor/src/portal/components/Sidebar.css
index c9dfa871ee..40e1fd25f5 100644
--- a/frontend/editor/src/portal/components/Sidebar.css
+++ b/frontend/editor/src/portal/components/Sidebar.css
@@ -54,12 +54,20 @@
   padding: 0 0.875rem;
   display: flex;
   align-items: center;
-  gap: 0.5rem;
+  gap: 0.4375rem;
   border-bottom: 1px solid var(--c-border-subtle);
 }
 
-/* Stirling Processor wordmark (theme-switched in Sidebar.tsx); matches the
-   editor's 22px wordmark so the two apps read as one brand. */
+/* Brand mark (parallelogram icon) leading the wordmark; same in both themes. */
+.portal-sidebar__mark {
+  height: 1.5rem;
+  width: auto;
+  display: block;
+  flex-shrink: 0;
+}
+
+/* Stirling wordmark (theme-switched in Sidebar.tsx); matches the editor's
+   22px wordmark so the two apps read as one brand. */
 .portal-sidebar__wordmark {
   height: 1.375rem;
   width: auto;
diff --git a/frontend/editor/src/portal/components/Sidebar.tsx b/frontend/editor/src/portal/components/Sidebar.tsx
index b4f5300d16..a6f2a97a01 100644
--- a/frontend/editor/src/portal/components/Sidebar.tsx
+++ b/frontend/editor/src/portal/components/Sidebar.tsx
@@ -8,8 +8,9 @@ import { useTheme } from "@portal/contexts/ThemeContext";
 import { useUI } from "@portal/contexts/UIContext";
 import { LinkAccountFooterItem } from "@portal/components/LinkAccountFooterItem";
 import { EDITOR_URL, EDITOR_IS_SAME_APP } from "@portal/auth/editorUrl";
-import wordmarkLight from "@app/assets/brand/modern-logo/StirlingProcessorLogoBlackText.svg";
-import wordmarkDark from "@app/assets/brand/modern-logo/StirlingProcessorLogoWhiteText.svg";
+import mark from "@app/assets/brand/modern-logo/StirlingProcessorLogoNoText.svg";
+import wordmarkLight from "@app/assets/brand/modern-logo/StirlingLogoBlackText.svg";
+import wordmarkDark from "@app/assets/brand/modern-logo/StirlingLogoWhiteText.svg";
 import { CloseIcon, SettingsIcon } from "@portal/components/icons";
 import {
   GROUP_PROCESSOR,
@@ -80,18 +81,24 @@ export function Sidebar() {
       inert={isMobile && !mobileNavOpen}
     >
       <div className="portal-sidebar__logo">
+        <img
+          className="portal-sidebar__mark"
+          src={mark}
+          alt=""
+          aria-hidden="true"
+        />
         {/* Both wordmarks render; CSS shows the right one per the actual color
             scheme (data-mantine-color-scheme), so it tracks the rendered theme
             rather than the portal's separate theme state. */}
         <img
           className="portal-sidebar__wordmark portal-sidebar__wordmark--light"
           src={wordmarkLight}
-          alt={t("portal.shell.sidebar.brandSuffix")}
+          alt="Stirling"
         />
         <img
           className="portal-sidebar__wordmark portal-sidebar__wordmark--dark"
           src={wordmarkDark}
-          alt={t("portal.shell.sidebar.brandSuffix")}
+          alt="Stirling"
         />
 
         <AppSwitch

From 54bf32485f2c600e384e9acc844290c0d4157228 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Thu, 23 Jul 2026 14:53:16 +0000
Subject: [PATCH 091/109] feat(portal): adopt TanStack Query with a shared
 per-resource query layer (#7135)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Why

The processor/portal loads slowly because every view fetches its data on
mount with no client-side cache — navigating away and back refetches
everything, and shared data (policies, sources, roster, fleet stats) is
fetched repeatedly. This adopts **TanStack Query** so the portal caches,
dedupes, and revalidates instead.

Follows the Users-page proof-of-concept (kept as the reference A/B
example behind a dev flag); DevTools before/after confirmed revisiting a
cached view now costs zero network calls.

## What

**Shared per-resource query layer** (`portal/queries/`) — the mechanism
for both in-view and cross-view sharing:
- `keys.ts` (flavor-agnostic queryKey factory), `adapters.ts`
(`toAsyncState` → the existing `AsyncState` shape, so view bodies barely
change)
- One **base hook per endpoint**; **derived hooks**
(`usePoliciesOverview`, `useProcessorFlow`, `useOnboardingProgress`)
compose them
- The bundle functions (`fetchPolicies`, `fetchProcessorFlow`,
`useOnboardingProgress`) are decomposed into base queries — otherwise
the caches wouldn't dedupe against each other

**Migrated:** Documents, Policies, Pipelines, Sources + all of Home's
fetching cards. Mutations use `invalidateQueries` (Policies' `version`
bump removed; Source/Pipeline builders invalidate-then-navigate;
ConnectionsTab + S3 picker share one cache).

**SaaS `/team/my` collapse:** `resolveTeam()` reads through the shared
cache (`ensureQueryData`), so roster + teams resolve it once (2→1), with
a direct-fetch fallback when no provider is mounted.

`QueryClientProvider` is mounted once at the portal root (`PortalApp`),
above the router, so the cache survives navigation.

## Impact on duplicate fetches

- **In-view:** Home `/policies` ×3, `/policies/runs` ×3, `/sources` ×2,
`/v1/editor/deployment` ×2 → **1× each** per mount
- **Cross-view:** Policies / Sources / Users / EditorAdmin /
Infrastructure reuse Home's warmed cache within `staleTime` (no refetch
on navigation)
- **SaaS Users:** `/team/my` 2× → **1×**

## Testing

- Portal typecheck + SaaS typecheck, ESLint (`--max-warnings=0`),
Prettier — all green
- **224 portal tests pass** (existing component tests wrapped in a
shared `QueryClient` test provider)
- New: `queries/sharing.test.tsx` (in-view: 3 consumers → 1 fetch each;
cross-view: remount → 0 refetch) and a `/team/my` collapse assertion in
`UsersReactQuery.test.tsx`

## Notes for reviewers

- Keys are intentionally flavor-agnostic (local vs SaaS routing lives
inside the api fns), so one key addresses whichever backend the flavor
build resolves.
- `staleTime` 30s / `gcTime` 5m defaults; tier-dependent resources key
on tier.
- Users view keeps its dev flag/legacy path deliberately as the
documented reference.
---
 frontend/editor/src/portal/PortalApp.tsx      |  37 ++---
 frontend/editor/src/portal/api/policies.ts    |  32 +++--
 .../editor/src/portal/api/processorFlow.ts    |  23 ++--
 .../portal/components/EditorStatusCard.tsx    |  13 +-
 .../src/portal/components/ProcessorFlow.tsx   |   9 +-
 .../components/billing/FreePdfEditorsCard.tsx |   5 +-
 .../components/infrastructure/AuditTab.tsx    |   7 +-
 .../policies/PolicySetupWizard.test.tsx       |   4 +-
 .../components/policies/PolicySetupWizard.tsx |   4 +-
 .../components/policies/storyFixtures.ts      |   2 +-
 .../src/portal/hooks/useAiEngineEnabled.ts    |  16 ++-
 .../src/portal/hooks/useOnboardingProgress.ts |  37 +++--
 .../src/portal/mocks/handlers/policies.ts     |   2 +-
 .../editor/src/portal/queries/adapters.ts     |  16 +++
 .../editor/src/portal/queries/documents.ts    |  16 +++
 .../src/portal/queries/infrastructure.ts      |  49 +++++++
 frontend/editor/src/portal/queries/keys.ts    |  33 +++++
 .../editor/src/portal/queries/pipelines.ts    |  15 +++
 .../editor/src/portal/queries/policies.ts     |  42 ++++++
 .../src/portal/queries/processorFlow.ts       |  30 +++++
 .../src/portal/queries/sharing.test.tsx       | 109 +++++++++++++++
 frontend/editor/src/portal/queries/sources.ts |  13 ++
 frontend/editor/src/portal/queries/users.ts   |  22 +++
 frontend/editor/src/portal/queryClient.ts     |  35 +++++
 .../src/portal/test/TestQueryProvider.tsx     |  29 ++++
 .../editor/src/portal/views/Documents.tsx     |   6 +-
 .../editor/src/portal/views/EditorAdmin.tsx   |  12 +-
 .../src/portal/views/PipelineBuilder.test.tsx |   4 +-
 .../src/portal/views/PipelineBuilder.tsx      |  37 +++--
 .../src/portal/views/Pipelines.test.tsx       |   4 +-
 .../editor/src/portal/views/Pipelines.tsx     |  11 +-
 frontend/editor/src/portal/views/Policies.tsx |  18 ++-
 .../src/portal/views/SourceBuilder.test.tsx   |   9 +-
 .../editor/src/portal/views/SourceBuilder.tsx |  10 ++
 .../editor/src/portal/views/Sources.test.tsx  |   4 +-
 frontend/editor/src/portal/views/Sources.tsx  |  11 +-
 .../src/portal/views/Users.caching.test.tsx   | 126 ++++++++++++++++++
 .../src/portal/views/Users.saas.test.tsx      |   6 +-
 frontend/editor/src/portal/views/Users.tsx    |  37 ++---
 .../src/portal/views/teamMyCache.saas.test.ts |  87 ++++++++++++
 frontend/editor/src/portal/views/usersData.ts |  63 +++++++++
 .../editor/src/saas/portal/usersBackend.ts    |  15 ++-
 frontend/package-lock.json                    |  27 ++++
 frontend/package.json                         |   1 +
 44 files changed, 908 insertions(+), 180 deletions(-)
 create mode 100644 frontend/editor/src/portal/queries/adapters.ts
 create mode 100644 frontend/editor/src/portal/queries/documents.ts
 create mode 100644 frontend/editor/src/portal/queries/infrastructure.ts
 create mode 100644 frontend/editor/src/portal/queries/keys.ts
 create mode 100644 frontend/editor/src/portal/queries/pipelines.ts
 create mode 100644 frontend/editor/src/portal/queries/policies.ts
 create mode 100644 frontend/editor/src/portal/queries/processorFlow.ts
 create mode 100644 frontend/editor/src/portal/queries/sharing.test.tsx
 create mode 100644 frontend/editor/src/portal/queries/sources.ts
 create mode 100644 frontend/editor/src/portal/queries/users.ts
 create mode 100644 frontend/editor/src/portal/queryClient.ts
 create mode 100644 frontend/editor/src/portal/test/TestQueryProvider.tsx
 create mode 100644 frontend/editor/src/portal/views/Users.caching.test.tsx
 create mode 100644 frontend/editor/src/portal/views/teamMyCache.saas.test.ts
 create mode 100644 frontend/editor/src/portal/views/usersData.ts

diff --git a/frontend/editor/src/portal/PortalApp.tsx b/frontend/editor/src/portal/PortalApp.tsx
index 1aa7da3535..27fc5652cb 100644
--- a/frontend/editor/src/portal/PortalApp.tsx
+++ b/frontend/editor/src/portal/PortalApp.tsx
@@ -1,9 +1,11 @@
-import { type ReactNode } from "react";
+import { useState, type ReactNode } from "react";
+import { QueryClientProvider } from "@tanstack/react-query";
 import { PortalAuthBoundary } from "@portal/auth/PortalAuthBoundary";
 import { ThemeProvider, useTheme } from "@portal/contexts/ThemeContext";
 import { SuiProvider } from "@portal/theme/SuiProvider";
 import { PortalProviders } from "@portal/PortalProviders";
 import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { createPortalQueryClient } from "@portal/queryClient";
 // Reset + typography, scoped to .portal-scope below.
 import "@portal/theme/base.css";
 
@@ -28,20 +30,25 @@ function ThemedSuiProvider({ children }: { children: ReactNode }) {
  * self-hosted mounts the account-link layer, SaaS does not.
  */
 export function PortalApp() {
+  // One client for the portal's lifetime. Sits above the router so its cache
+  // survives view navigation. Cheap and inert when no query hooks are mounted.
+  const [queryClient] = useState(createPortalQueryClient);
   return (
-    <ThemeProvider>
-      <ThemedSuiProvider>
-        {/* Scopes base.css to the portal so it doesn't restyle the host editor. */}
-        <div className="portal-scope">
-          {/* Tool registry is read by portal views (e.g. the policy setup
-              wizard); mount it above the per-flavor provider split. */}
-          <ToolRegistryProvider>
-            <PortalAuthBoundary>
-              <PortalProviders />
-            </PortalAuthBoundary>
-          </ToolRegistryProvider>
-        </div>
-      </ThemedSuiProvider>
-    </ThemeProvider>
+    <QueryClientProvider client={queryClient}>
+      <ThemeProvider>
+        <ThemedSuiProvider>
+          {/* Scopes base.css to the portal so it doesn't restyle the host editor. */}
+          <div className="portal-scope">
+            {/* Tool registry is read by portal views (e.g. the policy setup
+                wizard); mount it above the per-flavor provider split. */}
+            <ToolRegistryProvider>
+              <PortalAuthBoundary>
+                <PortalProviders />
+              </PortalAuthBoundary>
+            </ToolRegistryProvider>
+          </div>
+        </ThemedSuiProvider>
+      </ThemeProvider>
+    </QueryClientProvider>
   );
 }
diff --git a/frontend/editor/src/portal/api/policies.ts b/frontend/editor/src/portal/api/policies.ts
index fb3788dc76..6c122a3bc4 100644
--- a/frontend/editor/src/portal/api/policies.ts
+++ b/frontend/editor/src/portal/api/policies.ts
@@ -4,8 +4,8 @@
  * The portal calls the real Stirling policy API (`/api/v1/policies`);
  * Storybook and tests intercept the same calls with MSW handlers.
  *
- * `fetchPolicies()` assembles the decorated catalogue client-side from the
- * backend's flat `WirePolicy[]` + `PolicyRunView[]`, mirroring the same
+ * The flat `WirePolicy[]` + `PolicyRunView[]` responses are assembled into the
+ * decorated catalogue client-side by `assemblePolicies()`, mirroring the same
  * approach the editor uses for its own catalogue view.
  */
 
@@ -455,15 +455,27 @@ function decoratePolicy(
   };
 }
 
-/** GET /api/v1/policies + GET /api/v1/policies/runs → assembled catalogue. */
-export async function fetchPolicies(): Promise<PoliciesResponse> {
-  const [wirePolicies, runs] = await Promise.all([
-    apiClient.local.json<WirePolicy[]>("/api/v1/policies"),
-    apiClient.local
-      .json<PolicyRunView[]>("/api/v1/policies/runs")
-      .catch(() => [] as PolicyRunView[]),
-  ]);
+/** GET /api/v1/policies — the flat stored-policy records. */
+export function fetchPoliciesList(): Promise<WirePolicy[]> {
+  return apiClient.local.json<WirePolicy[]>("/api/v1/policies");
+}
 
+/** GET /api/v1/policies/runs — best-effort (empty on a backend without runs). */
+export function fetchPolicyRuns(): Promise<PolicyRunView[]> {
+  return apiClient.local
+    .json<PolicyRunView[]>("/api/v1/policies/runs")
+    .catch(() => [] as PolicyRunView[]);
+}
+
+/**
+ * Pure assembly of the decorated catalogue from the two raw responses. Split
+ * out so the React Query layer can fetch the list + runs as separate shared
+ * cache entries (deduped across Home + Policies) and assemble client-side.
+ */
+export function assemblePolicies(
+  wirePolicies: WirePolicy[],
+  runs: PolicyRunView[],
+): PoliciesResponse {
   const decodedByCategory = new Map<
     string,
     { decoded: PolicyDecodedState; isDefault: boolean }
diff --git a/frontend/editor/src/portal/api/processorFlow.ts b/frontend/editor/src/portal/api/processorFlow.ts
index 35adc9c89f..1ab2f72c62 100644
--- a/frontend/editor/src/portal/api/processorFlow.ts
+++ b/frontend/editor/src/portal/api/processorFlow.ts
@@ -1,8 +1,7 @@
 /** Assembles the home visualiser's sources → policies → outcomes from the real
  *  sources/policies/runs APIs. Counts are real; the flow motion is illustrative. */
 
-import { apiClient } from "@portal/api/http";
-import { fetchSources } from "@portal/api/sources";
+import type { SourcesResponse } from "@portal/api/sources";
 import { POLICY_CATEGORIES } from "@portal/api/policies";
 import { fromWirePolicy } from "@app/policies/codec";
 import type { PolicyRunView, WirePolicy } from "@app/policies/types";
@@ -123,16 +122,16 @@ function buildOutcomes(runs: PolicyRunView[]): FlowOutcome[] {
   ];
 }
 
-/** Assemble the full flow model from the three live portal surfaces. */
-export async function fetchProcessorFlow(): Promise<ProcessorFlow> {
-  const [sourcesResp, wirePolicies, runs] = await Promise.all([
-    fetchSources(),
-    apiClient.local.json<WirePolicy[]>("/api/v1/policies"),
-    apiClient.local
-      .json<PolicyRunView[]>("/api/v1/policies/runs")
-      .catch(() => [] as PolicyRunView[]),
-  ]);
-
+/**
+ * Pure assembly of the flow model from the three raw responses. Split out so
+ * the React Query layer composes it from the shared sources/policies/runs
+ * cache entries instead of re-fetching them (see useProcessorFlow).
+ */
+export function assembleProcessorFlow(
+  sourcesResp: SourcesResponse,
+  wirePolicies: WirePolicy[],
+  runs: PolicyRunView[],
+): ProcessorFlow {
   const sources: FlowSource[] = sourcesResp.sources.map((s) => ({
     id: s.id,
     name: s.name,
diff --git a/frontend/editor/src/portal/components/EditorStatusCard.tsx b/frontend/editor/src/portal/components/EditorStatusCard.tsx
index 1734d677c3..9726cc1009 100644
--- a/frontend/editor/src/portal/components/EditorStatusCard.tsx
+++ b/frontend/editor/src/portal/components/EditorStatusCard.tsx
@@ -4,12 +4,8 @@ import { useTranslation } from "react-i18next";
 import { Button, Skeleton } from "@app/ui";
 import { useTier } from "@portal/contexts/TierContext";
 import { useView } from "@portal/contexts/ViewContext";
-import { useAsync } from "@portal/hooks/useAsync";
-import {
-  fetchEditorDeployment,
-  type EditorDeploymentResponse,
-  type EditorInstance,
-} from "@portal/api/editorDeploy";
+import { useEditorDeployment } from "@portal/queries/infrastructure";
+import { type EditorInstance } from "@portal/api/editorDeploy";
 import {
   DownloadIcon,
   ExternalLinkIcon,
@@ -76,10 +72,7 @@ export function EditorStatusCard({ footer, hideChips }: EditorStatusCardProps) {
   const { tier } = useTier();
   const { setActiveView } = useView();
   const [installOpen, setInstallOpen] = useState(false);
-  const { data, loading } = useAsync<EditorDeploymentResponse>(
-    () => fetchEditorDeployment(tier),
-    [tier],
-  );
+  const { data, loading } = useEditorDeployment(tier);
 
   const view = useMemo(() => {
     if (!data) return null;
diff --git a/frontend/editor/src/portal/components/ProcessorFlow.tsx b/frontend/editor/src/portal/components/ProcessorFlow.tsx
index af9e318ba4..547ec21ca7 100644
--- a/frontend/editor/src/portal/components/ProcessorFlow.tsx
+++ b/frontend/editor/src/portal/components/ProcessorFlow.tsx
@@ -7,11 +7,8 @@ import {
   VIEW_PATHS,
   toPortalPath,
 } from "@portal/contexts/ViewContext";
-import { useAsync } from "@portal/hooks/useAsync";
-import {
-  fetchProcessorFlow,
-  type ProcessorFlow as ProcessorFlowModel,
-} from "@portal/api/processorFlow";
+import { useProcessorFlow } from "@portal/queries/processorFlow";
+import { type ProcessorFlow as ProcessorFlowModel } from "@portal/api/processorFlow";
 import {
   DEV_KEEP_FLOWING,
   DEV_SYNTH_RATE,
@@ -37,7 +34,7 @@ export function ProcessorFlow({ dataOverride }: ProcessorFlowProps = {}) {
   const { t } = useTranslation();
   const { setActiveView } = useView();
   const navigate = useNavigate();
-  const fetched = useAsync<ProcessorFlowModel>(() => fetchProcessorFlow(), []);
+  const fetched = useProcessorFlow();
   const data = dataOverride ?? fetched.data;
   const loading = dataOverride ? false : fetched.loading;
 
diff --git a/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx b/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx
index 76fa5a9109..25ef05ec9e 100644
--- a/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx
+++ b/frontend/editor/src/portal/components/billing/FreePdfEditorsCard.tsx
@@ -3,8 +3,7 @@ import { useTranslation } from "react-i18next";
 import { Button, Card, MetricCard, MetricStrip } from "@app/ui";
 import GroupsIcon from "@mui/icons-material/GroupsRounded";
 import PersonAddIcon from "@mui/icons-material/PersonAddAltRounded";
-import { useAsync } from "@portal/hooks/useAsync";
-import { fetchFleetStats } from "@portal/api/fleetStats";
+import { useFleetStats } from "@portal/queries/infrastructure";
 
 /**
  * "Free PDF Editors" team-fleet card. Editors-deployed / active-this-month /
@@ -22,7 +21,7 @@ function fmtMetric(value: number | null | undefined, loading: boolean): string {
 export function FreePdfEditorsCard() {
   const navigate = useNavigate();
   const { t } = useTranslation();
-  const { data, loading } = useAsync((signal) => fetchFleetStats(signal), []);
+  const { data, loading } = useFleetStats();
   return (
     <Card padding="loose">
       <div className="portal-billing__fleet-row">
diff --git a/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx b/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx
index b27d57995e..a415abf107 100644
--- a/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/AuditTab.tsx
@@ -12,13 +12,12 @@ import {
   type TableColumn,
 } from "@app/ui";
 import { useTier } from "@portal/contexts/TierContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
+import { useSectionFlags } from "@portal/hooks/useAsync";
+import { useAuditLog } from "@portal/queries/infrastructure";
 import { HttpError } from "@portal/api/http";
 import {
-  fetchAuditLog,
   type AuditCategory,
   type AuditEvent,
-  type AuditLogResponse,
 } from "@portal/api/infrastructure";
 import { AuditExportModal } from "@portal/components/infrastructure/AuditExportModal";
 import { SectionHeader } from "@portal/components/infrastructure/SectionHeader";
@@ -108,7 +107,7 @@ export function AuditTab() {
     },
   ];
 
-  const state = useAsync<AuditLogResponse>(() => fetchAuditLog(tier), [tier]);
+  const state = useAuditLog(tier);
   const { data, error } = state;
   const { isLoading, isEmpty } = useSectionFlags(state);
   // Backend returns 403 for scoped-out callers; show an access message, not an empty state.
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx
index 503811eeda..da253f9fcc 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.test.tsx
@@ -5,7 +5,7 @@ import {
   screen,
   waitFor,
 } from "@testing-library/react";
-import { MantineProvider } from "@mantine/core";
+import { PortalTestProviders } from "@portal/test/TestQueryProvider";
 import { PolicySetupWizard } from "@portal/components/policies/PolicySetupWizard";
 import {
   POLICY_CATEGORIES,
@@ -17,7 +17,7 @@ import {
 } from "@portal/api/policies";
 
 const render = (ui: Parameters<typeof baseRender>[0]) =>
-  baseRender(ui, { wrapper: MantineProvider });
+  baseRender(ui, { wrapper: PortalTestProviders });
 
 // Deterministic i18n: return the fallback when given, else the key. initReactI18next is stubbed
 // because the import graph pulls core/i18n.ts, which registers it as a plugin.
diff --git a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
index e56065ce48..39ef8246f9 100644
--- a/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicySetupWizard.tsx
@@ -31,7 +31,7 @@ import {
   type PolicyToolId,
   type PolicyToolStep,
 } from "@app/policies/operations";
-import { fetchSources } from "@portal/api/sources";
+import { useSources } from "@portal/queries/sources";
 import { fetchIntegrations } from "@portal/api/integrations";
 import { errorMessage } from "@portal/api/http";
 import { useAsync } from "@portal/hooks/useAsync";
@@ -271,7 +271,7 @@ function PolicySetupWizardBody({
     policy?.state.sources ?? ["editor"],
   );
 
-  const sourcesAsync = useAsync(() => fetchSources(), []);
+  const sourcesAsync = useSources();
   const availableSources = useMemo(() => {
     const backendSources = (sourcesAsync.data?.sources ?? []).filter(
       (s) => s.status !== "disabled",
diff --git a/frontend/editor/src/portal/components/policies/storyFixtures.ts b/frontend/editor/src/portal/components/policies/storyFixtures.ts
index 3cb061b9a7..0e92ade641 100644
--- a/frontend/editor/src/portal/components/policies/storyFixtures.ts
+++ b/frontend/editor/src/portal/components/policies/storyFixtures.ts
@@ -15,7 +15,7 @@ import { seedPolicies, seedPolicyRuns } from "@portal/mocks/policies";
 
 export { POLICY_CATEGORIES, POLICY_CONFIG };
 
-/** A decorated, active policy for a category, mirroring fetchPolicies() assembly. */
+/** A decorated, active policy for a category, mirroring assemblePolicies(). */
 export function decorateForStory(categoryId: string): DecoratedPolicy {
   const category = POLICY_CATEGORIES.find((c) => c.id === categoryId)!;
   const config = POLICY_CONFIG[categoryId];
diff --git a/frontend/editor/src/portal/hooks/useAiEngineEnabled.ts b/frontend/editor/src/portal/hooks/useAiEngineEnabled.ts
index 9fe76a19fa..ea6d14a0c1 100644
--- a/frontend/editor/src/portal/hooks/useAiEngineEnabled.ts
+++ b/frontend/editor/src/portal/hooks/useAiEngineEnabled.ts
@@ -2,8 +2,9 @@
 // setup: the card always shows but can't be enabled until the engine is on.
 // `loading` lets callers hold the decision rather than flash a locked card.
 
+import { useQuery } from "@tanstack/react-query";
 import { apiClient } from "@portal/api/http";
-import { useAsync } from "@portal/hooks/useAsync";
+import { qk } from "@portal/queries/keys";
 
 interface AppConfigShape {
   aiEngineEnabled?: boolean;
@@ -15,12 +16,13 @@ export interface AiEngineState {
 }
 
 export function useAiEngineEnabled(): AiEngineState {
-  const state = useAsync<AppConfigShape>(
-    () => apiClient.local.json<AppConfigShape>("/api/v1/config/app-config"),
-    [],
-  );
+  const query = useQuery({
+    queryKey: qk.appConfig(),
+    queryFn: () =>
+      apiClient.local.json<AppConfigShape>("/api/v1/config/app-config"),
+  });
   return {
-    enabled: Boolean(state.data?.aiEngineEnabled),
-    loading: state.loading && state.data === null,
+    enabled: Boolean(query.data?.aiEngineEnabled),
+    loading: query.isPending,
   };
 }
diff --git a/frontend/editor/src/portal/hooks/useOnboardingProgress.ts b/frontend/editor/src/portal/hooks/useOnboardingProgress.ts
index c46fa18fa0..0aacd87be7 100644
--- a/frontend/editor/src/portal/hooks/useOnboardingProgress.ts
+++ b/frontend/editor/src/portal/hooks/useOnboardingProgress.ts
@@ -1,18 +1,17 @@
 import { useTier } from "@portal/contexts/TierContext";
-import { useAsync } from "@portal/hooks/useAsync";
 import { useEditorInstalled } from "@portal/hooks/useEditorInstalled";
-import { fetchEditorDeployment } from "@portal/api/editorDeploy";
-import { fetchPolicies } from "@portal/api/policies";
-import { fetchUsers } from "@portal/api/users";
+import { useEditorDeployment } from "@portal/queries/infrastructure";
+import { usePoliciesOverview } from "@portal/queries/policies";
+import { useUsersRoster } from "@portal/queries/users";
 
 /**
- * Getting-started completion, derived live from the org's real state. Drives
- * both the per-step checks on the home hero's setup steps and the collapse to
- * the deployed-status header once every step is done.
+ * Getting-started completion, derived live from the org's real state, composed
+ * from the shared editor-deployment / policies / users queries.
  *
- * Each fetch is independently best-effort: an endpoint that isn't served yet
- * (e.g. editor-deployment on a bare backend) simply leaves its step incomplete
- * rather than breaking the card.
+ * Best-effort per source: a step reads `data ?? fallback` and query errors are
+ * never folded into `loading`, so an endpoint that isn't served yet (e.g.
+ * editor-deployment on a bare backend) leaves its step incomplete instead of
+ * breaking the card.
  */
 export interface OnboardingProgress {
   loading: boolean;
@@ -31,17 +30,13 @@ export interface OnboardingProgress {
 export function useOnboardingProgress(): OnboardingProgress {
   const { tier } = useTier();
   const editorInstalled = useEditorInstalled();
-  const { data, loading } = useAsync(
-    () =>
-      Promise.all([
-        fetchEditorDeployment(tier).catch(() => null),
-        fetchPolicies().catch(() => null),
-        fetchUsers(tier).catch(() => null),
-      ]),
-    [tier],
-  );
+  const deployQuery = useEditorDeployment(tier);
+  const policiesQuery = usePoliciesOverview();
+  const usersQuery = useUsersRoster(tier);
 
-  const [deploy, policies, users] = data ?? [null, null, null];
+  const deploy = deployQuery.data;
+  const policies = policiesQuery.data;
+  const users = usersQuery.data;
 
   const deployed = (deploy?.instances.length ?? 0) > 0;
   // Authoritative signal is a deployed instance; the user's own download/Done
@@ -56,7 +51,7 @@ export function useOnboardingProgress(): OnboardingProgress {
   const inviteDone = (users?.summary.totalMembers ?? 0) > 1;
 
   return {
-    loading,
+    loading: deployQuery.loading || policiesQuery.loading || usersQuery.loading,
     deployed,
     editorDone,
     policiesDone,
diff --git a/frontend/editor/src/portal/mocks/handlers/policies.ts b/frontend/editor/src/portal/mocks/handlers/policies.ts
index 16bc0933e6..1bfc435d4c 100644
--- a/frontend/editor/src/portal/mocks/handlers/policies.ts
+++ b/frontend/editor/src/portal/mocks/handlers/policies.ts
@@ -14,7 +14,7 @@ import type { PolicyRunView, WirePolicy } from "@app/policies/types";
  * - DELETE /api/v1/policies/:id → 204
  *
  * The decorated catalogue (summary, category grouping, stats) is assembled
- * client-side in api/policies.ts#fetchPolicies(), mirroring the real backend.
+ * client-side in api/policies.ts#assemblePolicies(), mirroring the real backend.
  */
 
 let store: WirePolicy[] = seedPolicies();
diff --git a/frontend/editor/src/portal/queries/adapters.ts b/frontend/editor/src/portal/queries/adapters.ts
new file mode 100644
index 0000000000..083e396bad
--- /dev/null
+++ b/frontend/editor/src/portal/queries/adapters.ts
@@ -0,0 +1,16 @@
+import type { UseQueryResult } from "@tanstack/react-query";
+import type { AsyncState } from "@portal/hooks/useAsync";
+
+/**
+ * Adapt a query result to the {@link AsyncState} shape the views already use
+ * (data/loading/error + useSectionFlags), so a hook swaps in with no render
+ * changes. `isPending` is false once data is cached, so a remount renders from
+ * cache instead of flashing a skeleton.
+ */
+export function toAsyncState<T>(query: UseQueryResult<T>): AsyncState<T> {
+  return {
+    data: query.data ?? null,
+    loading: query.isPending,
+    error: (query.error as Error | null) ?? null,
+  };
+}
diff --git a/frontend/editor/src/portal/queries/documents.ts b/frontend/editor/src/portal/queries/documents.ts
new file mode 100644
index 0000000000..ae1ec14cee
--- /dev/null
+++ b/frontend/editor/src/portal/queries/documents.ts
@@ -0,0 +1,16 @@
+import { useQuery } from "@tanstack/react-query";
+import { qk } from "@portal/queries/keys";
+import { toAsyncState } from "@portal/queries/adapters";
+import type { AsyncState } from "@portal/hooks/useAsync";
+import { fetchDocuments, type DocumentsResponse } from "@portal/api/documents";
+import type { Tier } from "@portal/contexts/TierContext";
+
+/** Base query: the documents review queue (tier-scoped). */
+export function useDocuments(tier: Tier): AsyncState<DocumentsResponse> {
+  return toAsyncState(
+    useQuery({
+      queryKey: qk.documents(tier),
+      queryFn: () => fetchDocuments(tier),
+    }),
+  );
+}
diff --git a/frontend/editor/src/portal/queries/infrastructure.ts b/frontend/editor/src/portal/queries/infrastructure.ts
new file mode 100644
index 0000000000..40e0e829cd
--- /dev/null
+++ b/frontend/editor/src/portal/queries/infrastructure.ts
@@ -0,0 +1,49 @@
+import { useQuery } from "@tanstack/react-query";
+import { qk } from "@portal/queries/keys";
+import { toAsyncState } from "@portal/queries/adapters";
+import type { AsyncState } from "@portal/hooks/useAsync";
+import { fetchFleetStats, type FleetStats } from "@portal/api/fleetStats";
+import {
+  fetchAuditLog,
+  type AuditLogResponse,
+} from "@portal/api/infrastructure";
+import {
+  fetchEditorDeployment,
+  type EditorDeploymentResponse,
+} from "@portal/api/editorDeploy";
+import type { Tier } from "@portal/contexts/TierContext";
+
+/** Base query: fleet processing stats (GET /api/v1/usage/fleet-stats). */
+export function useFleetStats(): AsyncState<FleetStats> {
+  return toAsyncState(
+    useQuery({
+      queryKey: qk.fleetStats(),
+      queryFn: ({ signal }) => fetchFleetStats(signal),
+    }),
+  );
+}
+
+/** Base query: recent audit-log activity (tier-scoped). */
+export function useAuditLog(tier: Tier): AsyncState<AuditLogResponse> {
+  return toAsyncState(
+    useQuery({
+      queryKey: qk.auditLog(tier),
+      queryFn: () => fetchAuditLog(tier),
+    }),
+  );
+}
+
+/** Base query: editor deployment health (tier-scoped). Shared by Home's hero /
+ *  status card, EditorAdmin, and onboarding. Best-effort — callers tolerate a
+ *  404 on a bare backend, so no retry. */
+export function useEditorDeployment(
+  tier: Tier,
+): AsyncState<EditorDeploymentResponse> {
+  return toAsyncState(
+    useQuery({
+      queryKey: qk.editorDeployment(tier),
+      queryFn: () => fetchEditorDeployment(tier),
+      retry: false,
+    }),
+  );
+}
diff --git a/frontend/editor/src/portal/queries/keys.ts b/frontend/editor/src/portal/queries/keys.ts
new file mode 100644
index 0000000000..d2c3fc601a
--- /dev/null
+++ b/frontend/editor/src/portal/queries/keys.ts
@@ -0,0 +1,33 @@
+import type { Tier } from "@portal/contexts/TierContext";
+
+/**
+ * The portal's TanStack Query keys, in one place. Convention:
+ * ["portal", <resource>, ...params].
+ *
+ * Keep keys flavor-agnostic — self-hosted-vs-SaaS routing lives in the api
+ * functions, not the key, so one key addresses whichever backend the build
+ * resolves. Include tier only for resources whose response varies by tier.
+ */
+export const qk = {
+  // Tier-independent
+  policiesList: () => ["portal", "policies", "list"] as const,
+  policyRuns: () => ["portal", "policies", "runs"] as const,
+  sources: () => ["portal", "sources"] as const,
+  pipelines: () => ["portal", "pipelines"] as const,
+  fleetStats: () => ["portal", "fleetStats"] as const,
+  appConfig: () => ["portal", "appConfig"] as const,
+
+  // Tier-dependent
+  documents: (tier: Tier) => ["portal", "documents", tier] as const,
+  auditLog: (tier: Tier) => ["portal", "auditLog", tier] as const,
+  editorDeployment: (tier: Tier) =>
+    ["portal", "editorDeployment", tier] as const,
+
+  // Users cluster (consumed by usersData.ts + Home onboarding)
+  usersRoster: (tier: Tier) => ["portal", "users", "roster", tier] as const,
+  usersGrants: (tier: Tier) => ["portal", "users", "grants", tier] as const,
+  usersTeams: (tier: Tier) => ["portal", "users", "teams", tier] as const,
+  usersAuthConfig: () => ["portal", "users", "authConfig"] as const,
+  /** SaaS-only shared team directory (/api/v1/team/my) — see the /team/my collapse. */
+  teamMy: () => ["portal", "team", "my"] as const,
+} as const;
diff --git a/frontend/editor/src/portal/queries/pipelines.ts b/frontend/editor/src/portal/queries/pipelines.ts
new file mode 100644
index 0000000000..58f67c0b4e
--- /dev/null
+++ b/frontend/editor/src/portal/queries/pipelines.ts
@@ -0,0 +1,15 @@
+import { useQuery } from "@tanstack/react-query";
+import { qk } from "@portal/queries/keys";
+import { toAsyncState } from "@portal/queries/adapters";
+import type { AsyncState } from "@portal/hooks/useAsync";
+import {
+  fetchPipelines,
+  type PipelinesOverviewResponse,
+} from "@portal/api/pipelines";
+
+/** Base query: the pipelines overview (GET /api/v1/policies/overview). */
+export function usePipelines(): AsyncState<PipelinesOverviewResponse> {
+  return toAsyncState(
+    useQuery({ queryKey: qk.pipelines(), queryFn: fetchPipelines }),
+  );
+}
diff --git a/frontend/editor/src/portal/queries/policies.ts b/frontend/editor/src/portal/queries/policies.ts
new file mode 100644
index 0000000000..51a8c0ff55
--- /dev/null
+++ b/frontend/editor/src/portal/queries/policies.ts
@@ -0,0 +1,42 @@
+import { useMemo } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { qk } from "@portal/queries/keys";
+import { toAsyncState } from "@portal/queries/adapters";
+import type { AsyncState } from "@portal/hooks/useAsync";
+import {
+  assemblePolicies,
+  fetchPoliciesList,
+  fetchPolicyRuns,
+  type PoliciesResponse,
+  type PolicyRunView,
+  type WirePolicy,
+} from "@portal/api/policies";
+
+/** Base query: the flat stored-policy records (GET /api/v1/policies). */
+export function usePoliciesList(): AsyncState<WirePolicy[]> {
+  return toAsyncState(
+    useQuery({ queryKey: qk.policiesList(), queryFn: fetchPoliciesList }),
+  );
+}
+
+/** Base query: policy run history (GET /api/v1/policies/runs). */
+export function usePolicyRuns(): AsyncState<PolicyRunView[]> {
+  return toAsyncState(
+    useQuery({ queryKey: qk.policyRuns(), queryFn: fetchPolicyRuns }),
+  );
+}
+
+/**
+ * The decorated catalogue Policies and Home both render, composed from the two
+ * shared base queries so /policies and /policies/runs are fetched once across
+ * all consumers.
+ */
+export function usePoliciesOverview(): AsyncState<PoliciesResponse> {
+  const list = usePoliciesList();
+  const runs = usePolicyRuns();
+  const data = useMemo(
+    () => (list.data ? assemblePolicies(list.data, runs.data ?? []) : null),
+    [list.data, runs.data],
+  );
+  return { data, loading: list.loading, error: list.error };
+}
diff --git a/frontend/editor/src/portal/queries/processorFlow.ts b/frontend/editor/src/portal/queries/processorFlow.ts
new file mode 100644
index 0000000000..5ac441436f
--- /dev/null
+++ b/frontend/editor/src/portal/queries/processorFlow.ts
@@ -0,0 +1,30 @@
+import { useMemo } from "react";
+import { usePoliciesList, usePolicyRuns } from "@portal/queries/policies";
+import { useSources } from "@portal/queries/sources";
+import type { AsyncState } from "@portal/hooks/useAsync";
+import {
+  assembleProcessorFlow,
+  type ProcessorFlow,
+} from "@portal/api/processorFlow";
+
+/**
+ * Home's sources → policies → outcomes visualiser, composed from the shared
+ * base queries so it reuses Home's cache entries instead of refetching them.
+ */
+export function useProcessorFlow(): AsyncState<ProcessorFlow> {
+  const sources = useSources();
+  const list = usePoliciesList();
+  const runs = usePolicyRuns();
+  const data = useMemo(
+    () =>
+      sources.data && list.data
+        ? assembleProcessorFlow(sources.data, list.data, runs.data ?? [])
+        : null,
+    [sources.data, list.data, runs.data],
+  );
+  return {
+    data,
+    loading: sources.loading || list.loading,
+    error: sources.error ?? list.error,
+  };
+}
diff --git a/frontend/editor/src/portal/queries/sharing.test.tsx b/frontend/editor/src/portal/queries/sharing.test.tsx
new file mode 100644
index 0000000000..5cfb9d1629
--- /dev/null
+++ b/frontend/editor/src/portal/queries/sharing.test.tsx
@@ -0,0 +1,109 @@
+import {
+  afterAll,
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+} from "vitest";
+import { render, waitFor } from "@testing-library/react";
+import { QueryClientProvider } from "@tanstack/react-query";
+import { setupServer } from "msw/node";
+import { http, HttpResponse } from "msw";
+import { createPortalQueryClient } from "@portal/queryClient";
+import { usePoliciesOverview } from "@portal/queries/policies";
+import { useProcessorFlow } from "@portal/queries/processorFlow";
+
+/**
+ * Proves the two sharing properties the migration is for, at the hook level:
+ *   - in-view: several consumers on one screen (Home renders the policies
+ *     overview AND the processor flow, which both need /policies + /runs)
+ *     trigger ONE fetch of each endpoint, not one per consumer.
+ *   - cross-view: navigating to another screen that needs the same data
+ *     (unmount + remount within staleTime) serves it from cache — no refetch.
+ */
+
+// Keep apiClient.local's transport hermetic (no real token / Supabase at import).
+vi.mock("@app/auth", () => ({
+  getStoredToken: () => null,
+  clearStoredToken: vi.fn(),
+}));
+vi.mock("@app/auth/supabase/supabaseClient", () => ({
+  getSupabaseClient: () => null,
+  configureSupabase: vi.fn(),
+}));
+
+const counts: Record<string, number> = {};
+const server = setupServer(
+  http.get("*/api/v1/policies", () => {
+    counts["/policies"] = (counts["/policies"] ?? 0) + 1;
+    return HttpResponse.json([]);
+  }),
+  http.get("*/api/v1/policies/runs", () => {
+    counts["/policies/runs"] = (counts["/policies/runs"] ?? 0) + 1;
+    return HttpResponse.json([]);
+  }),
+  http.get("*/api/v1/sources", () => {
+    counts["/sources"] = (counts["/sources"] ?? 0) + 1;
+    return HttpResponse.json({ sources: [] });
+  }),
+);
+
+beforeAll(() => server.listen({ onUnhandledRequest: "error" }));
+afterEach(() => server.resetHandlers());
+afterAll(() => server.close());
+beforeEach(() => {
+  for (const k of Object.keys(counts)) delete counts[k];
+});
+
+// Two Home consumers of the same base queries, rendered together.
+function HomeConsumers() {
+  usePoliciesOverview(); // e.g. onboarding progress
+  useProcessorFlow(); // the processor visualiser (also needs /sources)
+  return null;
+}
+// A Policies-view-style consumer of the same policies caches.
+function PoliciesConsumer() {
+  usePoliciesOverview();
+  return null;
+}
+
+describe("portal query sharing", () => {
+  it("in-view: multiple consumers of the same endpoints fetch each once", async () => {
+    const client = createPortalQueryClient();
+    render(
+      <QueryClientProvider client={client}>
+        <HomeConsumers />
+      </QueryClientProvider>,
+    );
+    await waitFor(() => expect(counts["/policies"]).toBe(1));
+    // Two consumers both needed /policies + /runs; /sources came from the flow.
+    expect(counts["/policies"]).toBe(1);
+    expect(counts["/policies/runs"]).toBe(1);
+    expect(counts["/sources"]).toBe(1);
+  });
+
+  it("cross-view: a later screen reusing the data refetches nothing", async () => {
+    const client = createPortalQueryClient();
+    const home = render(
+      <QueryClientProvider client={client}>
+        <HomeConsumers />
+      </QueryClientProvider>,
+    );
+    await waitFor(() => expect(counts["/policies"]).toBe(1));
+    home.unmount();
+
+    // Navigate to "Policies" (same client, within staleTime) — cache hit.
+    render(
+      <QueryClientProvider client={client}>
+        <PoliciesConsumer />
+      </QueryClientProvider>,
+    );
+    // Give any (unwanted) refetch a chance to fire, then assert it didn't.
+    await new Promise((r) => setTimeout(r, 50));
+    expect(counts["/policies"]).toBe(1);
+    expect(counts["/policies/runs"]).toBe(1);
+  });
+});
diff --git a/frontend/editor/src/portal/queries/sources.ts b/frontend/editor/src/portal/queries/sources.ts
new file mode 100644
index 0000000000..4d0c363fd9
--- /dev/null
+++ b/frontend/editor/src/portal/queries/sources.ts
@@ -0,0 +1,13 @@
+import { useQuery } from "@tanstack/react-query";
+import { qk } from "@portal/queries/keys";
+import { toAsyncState } from "@portal/queries/adapters";
+import type { AsyncState } from "@portal/hooks/useAsync";
+import { fetchSources, type SourcesResponse } from "@portal/api/sources";
+
+/** Base query: configured sources (GET /api/v1/sources). Shared by Sources,
+ *  Home's ProcessorFlow, the pipeline/policy builders' source pickers. */
+export function useSources(): AsyncState<SourcesResponse> {
+  return toAsyncState(
+    useQuery({ queryKey: qk.sources(), queryFn: fetchSources }),
+  );
+}
diff --git a/frontend/editor/src/portal/queries/users.ts b/frontend/editor/src/portal/queries/users.ts
new file mode 100644
index 0000000000..8f314d7fc0
--- /dev/null
+++ b/frontend/editor/src/portal/queries/users.ts
@@ -0,0 +1,22 @@
+import { useQuery } from "@tanstack/react-query";
+import { qk } from "@portal/queries/keys";
+import { toAsyncState } from "@portal/queries/adapters";
+import type { AsyncState } from "@portal/hooks/useAsync";
+import { usersBackend } from "@app/portal/usersBackend";
+import type { UsersResponse } from "@portal/api/users";
+import type { Tier } from "@portal/contexts/TierContext";
+
+/**
+ * Base query: the org roster (flavor-resolved via usersBackend). Keyed the same
+ * as the Users view's roster query (qk.usersRoster), so Home's onboarding read
+ * and the Users page share one cache entry — the roster is fetched once across
+ * both. Used by useOnboardingProgress.
+ */
+export function useUsersRoster(tier: Tier): AsyncState<UsersResponse> {
+  return toAsyncState(
+    useQuery({
+      queryKey: qk.usersRoster(tier),
+      queryFn: () => usersBackend.fetchUsers(tier),
+    }),
+  );
+}
diff --git a/frontend/editor/src/portal/queryClient.ts b/frontend/editor/src/portal/queryClient.ts
new file mode 100644
index 0000000000..85bd449b61
--- /dev/null
+++ b/frontend/editor/src/portal/queryClient.ts
@@ -0,0 +1,35 @@
+import { QueryClient } from "@tanstack/react-query";
+
+/**
+ * The portal's TanStack Query client, mounted once at the portal root
+ * (PortalApp) so its cache lives above the router — data survives navigating
+ * away and back. staleTime 30s: a return visit within 30s serves cache with no
+ * network call, then revalidates in the background. Focus refetch is off — admin
+ * screens don't need polling.
+ */
+let current: QueryClient | null = null;
+
+export function createPortalQueryClient(): QueryClient {
+  current = new QueryClient({
+    defaultOptions: {
+      queries: {
+        staleTime: 30_000,
+        gcTime: 5 * 60_000,
+        retry: 1,
+        refetchOnWindowFocus: false,
+      },
+    },
+  });
+  return current;
+}
+
+/**
+ * The client created by {@link createPortalQueryClient}, or null if none has
+ * been mounted yet. Lets a non-hook module (the SaaS usersBackend's resolveTeam)
+ * read/populate the shared cache via ensureQueryData when the portal is mounted,
+ * while still working — via a direct fetch — when it isn't (e.g. a unit test
+ * that exercises the adapter without the provider).
+ */
+export function tryGetPortalQueryClient(): QueryClient | null {
+  return current;
+}
diff --git a/frontend/editor/src/portal/test/TestQueryProvider.tsx b/frontend/editor/src/portal/test/TestQueryProvider.tsx
new file mode 100644
index 0000000000..d843d816d3
--- /dev/null
+++ b/frontend/editor/src/portal/test/TestQueryProvider.tsx
@@ -0,0 +1,29 @@
+import { useState, type ReactNode } from "react";
+import { MantineProvider } from "@mantine/core";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+
+/**
+ * Wraps a portal component under test in a fresh QueryClient (retries off for
+ * deterministic tests). Needed by any test that renders a component using the
+ * shared query hooks (portal/queries/*). Mirror of the QueryClientProvider the
+ * app mounts at PortalApp.
+ */
+export function TestQueryProvider({ children }: { children: ReactNode }) {
+  const [client] = useState(
+    () => new QueryClient({ defaultOptions: { queries: { retry: false } } }),
+  );
+  return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+}
+
+/**
+ * Combined provider for portal component tests: QueryClient + Mantine. Drop-in
+ * replacement for a bare `MantineProvider` test wrapper once a component (or a
+ * child) uses the shared query hooks.
+ */
+export function PortalTestProviders({ children }: { children: ReactNode }) {
+  return (
+    <TestQueryProvider>
+      <MantineProvider>{children}</MantineProvider>
+    </TestQueryProvider>
+  );
+}
diff --git a/frontend/editor/src/portal/views/Documents.tsx b/frontend/editor/src/portal/views/Documents.tsx
index c083071bcb..8854d4db7f 100644
--- a/frontend/editor/src/portal/views/Documents.tsx
+++ b/frontend/editor/src/portal/views/Documents.tsx
@@ -2,11 +2,9 @@ import type { TFunction } from "i18next";
 import { useTranslation } from "react-i18next";
 import { Button } from "@app/ui";
 import { useTier } from "@portal/contexts/TierContext";
-import { useAsync } from "@portal/hooks/useAsync";
+import { useDocuments } from "@portal/queries/documents";
 import {
-  fetchDocuments,
   DOCUMENT_STATUS_LABEL,
-  type DocumentsResponse,
   type ReviewDocument,
 } from "@portal/api/documents";
 import { ReviewQueue } from "@portal/components/documents/ReviewQueue";
@@ -66,7 +64,7 @@ function toCsv(docs: ReviewDocument[], t: TFunction): string {
 export function Documents() {
   const { t } = useTranslation();
   const { tier } = useTier();
-  const state = useAsync<DocumentsResponse>(() => fetchDocuments(tier), [tier]);
+  const state = useDocuments(tier);
   const documents = state.data?.documents ?? [];
 
   function exportCsv() {
diff --git a/frontend/editor/src/portal/views/EditorAdmin.tsx b/frontend/editor/src/portal/views/EditorAdmin.tsx
index e60efceea5..bd202a2bd3 100644
--- a/frontend/editor/src/portal/views/EditorAdmin.tsx
+++ b/frontend/editor/src/portal/views/EditorAdmin.tsx
@@ -2,11 +2,8 @@ import { useTranslation } from "react-i18next";
 import { Skeleton } from "@app/ui";
 import { useTier } from "@portal/contexts/TierContext";
 import { useView } from "@portal/contexts/ViewContext";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import {
-  fetchEditorDeployment,
-  type EditorDeploymentResponse,
-} from "@portal/api/editorDeploy";
+import { useSectionFlags } from "@portal/hooks/useAsync";
+import { useEditorDeployment } from "@portal/queries/infrastructure";
 import { DeploymentSummaryStrip } from "@portal/components/editor-admin/DeploymentSummaryStrip";
 import { DeploymentTargets } from "@portal/components/editor-admin/DeploymentTargets";
 import { PairingPanel } from "@portal/components/editor-admin/PairingPanel";
@@ -35,10 +32,7 @@ export function EditorAdmin() {
   const { t } = useTranslation();
   const { tier } = useTier();
   const { setActiveView } = useView();
-  const state = useAsync<EditorDeploymentResponse>(
-    () => fetchEditorDeployment(tier),
-    [tier],
-  );
+  const state = useEditorDeployment(tier);
   const { data } = state;
   const { isLoading } = useSectionFlags(state);
 
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
index 6f40b82764..2f7300422f 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
@@ -5,7 +5,7 @@ import {
   screen,
   waitFor,
 } from "@testing-library/react";
-import { MantineProvider } from "@mantine/core";
+import { PortalTestProviders } from "@portal/test/TestQueryProvider";
 import { MemoryRouter, Route, Routes } from "react-router-dom";
 import type { Policy, TriggerOutcome } from "@portal/api/pipelines";
 import type { ToolRegistryCatalog } from "@app/contexts/ToolRegistryContext";
@@ -15,7 +15,7 @@ import { PipelineBuilder } from "@portal/views/PipelineBuilder";
 const render = (
   ui: Parameters<typeof baseRender>[0],
   options?: Parameters<typeof baseRender>[1],
-) => baseRender(ui, { wrapper: MantineProvider, ...options });
+) => baseRender(ui, { wrapper: PortalTestProviders, ...options });
 
 // Deterministic i18n: keys returned verbatim.
 vi.mock("react-i18next", () => ({
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.tsx b/frontend/editor/src/portal/views/PipelineBuilder.tsx
index 66c5748e85..fc23ac1516 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.tsx
@@ -51,9 +51,12 @@ import {
 import { clearProcessedHistory } from "@portal/api/policies";
 import { availableOutputModes } from "@portal/components/pipelines/outputModes";
 import { S3ConnectionPicker } from "@portal/components/sources/S3ConnectionPicker";
-import { fetchSources, type SourceView } from "@portal/api/sources";
+import { type SourceView } from "@portal/api/sources";
+import { useSources } from "@portal/queries/sources";
 import { EDITOR_SOURCE_TYPE } from "@portal/components/sources/sourceTypes";
 import { useAsync } from "@portal/hooks/useAsync";
+import { useQueryClient } from "@tanstack/react-query";
+import { qk } from "@portal/queries/keys";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { humanizeOperation } from "@portal/components/pipelines/pipelineOperations";
 import { PipelineStepSettings } from "@portal/components/pipelines/PipelineStepSettings";
@@ -154,6 +157,16 @@ function parseOutput(output: OutputSpec | undefined): {
 export function PipelineBuilder() {
   const { t } = useTranslation();
   const navigate = useNavigate();
+  const queryClient = useQueryClient();
+  // Pipelines are stored as policies, so a save/delete must invalidate both the
+  // pipelines overview and the policies caches (Policies page + Home) before
+  // navigating back to the list.
+  const invalidatePipelines = () =>
+    Promise.all([
+      queryClient.invalidateQueries({ queryKey: qk.pipelines() }),
+      queryClient.invalidateQueries({ queryKey: qk.policiesList() }),
+      queryClient.invalidateQueries({ queryKey: qk.policyRuns() }),
+    ]);
   const { id } = useParams();
   const isEdit = Boolean(id);
   const { allTools } = useToolRegistry();
@@ -166,20 +179,20 @@ export function PipelineBuilder() {
     async () => (id ? await fetchPipeline(id) : null),
     [id],
   );
-  const sourcesState = useAsync<SourceView[]>(
-    // The editor is a built-in, client-driven source (it runs on editor upload, not as a pipeline
-    // input), so it's excluded from the sources a pipeline can pull from.
-    async () =>
-      (await fetchSources()).sources.filter(
-        (source) => source.type !== EDITOR_SOURCE_TYPE,
-      ),
-    [],
-  );
+  const sourcesState = useSources();
   const triggersState = useAsync<TriggerInfo[]>(
     async () => await fetchTriggers(),
     [],
   );
-  const availableSources = sourcesState.data ?? [];
+  // The editor is a built-in, client-driven source (it runs on editor upload,
+  // not as a pipeline input), so it's excluded from a pipeline's inputs.
+  const availableSources = useMemo<SourceView[]>(
+    () =>
+      (sourcesState.data?.sources ?? []).filter(
+        (source) => source.type !== EDITOR_SOURCE_TYPE,
+      ),
+    [sourcesState.data],
+  );
   const triggers = useMemo(
     () => triggersState.data ?? [],
     [triggersState.data],
@@ -450,6 +463,7 @@ export function PipelineBuilder() {
     };
     try {
       await savePipeline(policy);
+      await invalidatePipelines();
       navigate(destination);
     } catch (e) {
       setError(errorMessage(e));
@@ -560,6 +574,7 @@ export function PipelineBuilder() {
     setDeleting(true);
     try {
       await deletePipeline(id);
+      await invalidatePipelines();
       close();
     } catch (e) {
       setError(errorMessage(e));
diff --git a/frontend/editor/src/portal/views/Pipelines.test.tsx b/frontend/editor/src/portal/views/Pipelines.test.tsx
index ff54881c72..655abf62cb 100644
--- a/frontend/editor/src/portal/views/Pipelines.test.tsx
+++ b/frontend/editor/src/portal/views/Pipelines.test.tsx
@@ -4,7 +4,7 @@ import {
   render as baseRender,
   screen,
 } from "@testing-library/react";
-import { MantineProvider } from "@mantine/core";
+import { PortalTestProviders } from "@portal/test/TestQueryProvider";
 import { MemoryRouter, Route, Routes } from "react-router-dom";
 import type { PipelinesOverviewResponse } from "@portal/api/pipelines";
 import { Pipelines } from "@portal/views/Pipelines";
@@ -12,7 +12,7 @@ import { Pipelines } from "@portal/views/Pipelines";
 const render = (
   ui: Parameters<typeof baseRender>[0],
   options?: Parameters<typeof baseRender>[1],
-) => baseRender(ui, { wrapper: MantineProvider, ...options });
+) => baseRender(ui, { wrapper: PortalTestProviders, ...options });
 
 // Deterministic i18n: keys returned verbatim.
 vi.mock("react-i18next", () => ({
diff --git a/frontend/editor/src/portal/views/Pipelines.tsx b/frontend/editor/src/portal/views/Pipelines.tsx
index 4e9893dd03..b0321cfee1 100644
--- a/frontend/editor/src/portal/views/Pipelines.tsx
+++ b/frontend/editor/src/portal/views/Pipelines.tsx
@@ -2,12 +2,9 @@ import { useTranslation } from "react-i18next";
 import { useNavigate } from "react-router-dom";
 import AddRoundedIcon from "@mui/icons-material/AddRounded";
 import { Button, EmptyState, Skeleton } from "@app/ui";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
-import {
-  fetchPipelines,
-  type PipelinesOverviewResponse,
-  type PipelineView,
-} from "@portal/api/pipelines";
+import { useSectionFlags } from "@portal/hooks/useAsync";
+import { usePipelines } from "@portal/queries/pipelines";
+import { type PipelineView } from "@portal/api/pipelines";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { PipelinesIcon } from "@portal/components/icons";
 import { KpiStrip } from "@portal/components/pipelines/KpiStrip";
@@ -17,7 +14,7 @@ import "@portal/views/Pipelines.css";
 export function Pipelines() {
   const { t } = useTranslation();
   const navigate = useNavigate();
-  const state = useAsync<PipelinesOverviewResponse>(() => fetchPipelines(), []);
+  const state = usePipelines();
   const { data, loading } = state;
   const { isLoading } = useSectionFlags(state);
 
diff --git a/frontend/editor/src/portal/views/Policies.tsx b/frontend/editor/src/portal/views/Policies.tsx
index 2de9122e0e..5bdcd19a8f 100644
--- a/frontend/editor/src/portal/views/Policies.tsx
+++ b/frontend/editor/src/portal/views/Policies.tsx
@@ -1,22 +1,23 @@
 import { useCallback, useEffect, useState } from "react";
+import { useQueryClient } from "@tanstack/react-query";
 import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { Banner, Button, Skeleton } from "@app/ui";
 import { errorMessage } from "@portal/api/http";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
+import { useSectionFlags } from "@portal/hooks/useAsync";
 import {
   buildWireFromSetup,
   buildWireFromState,
   clearProcessedHistory,
   deletePolicy,
-  fetchPolicies,
   savePolicy,
   POLICY_CATEGORIES,
   POLICY_CONFIG,
   type CatalogueEntry,
-  type PoliciesResponse,
   type PolicySetupResult,
 } from "@portal/api/policies";
+import { usePoliciesOverview } from "@portal/queries/policies";
+import { qk } from "@portal/queries/keys";
 import { CatalogueSummary } from "@portal/components/policies/CatalogueSummary";
 import { PolicyCatalogueTable } from "@portal/components/policies/PolicyCatalogueTable";
 import { PolicyDetailPanel } from "@portal/components/policies/PolicyDetailPanel";
@@ -26,8 +27,8 @@ import "@portal/views/Policies.css";
 
 export function Policies() {
   const { t } = useTranslation();
-  const [version, setVersion] = useState(0);
-  const state = useAsync<PoliciesResponse>(() => fetchPolicies(), [version]);
+  const queryClient = useQueryClient();
+  const state = usePoliciesOverview();
   const { data, loading, error: fetchError } = state;
   const { isLoading } = useSectionFlags(state);
 
@@ -63,7 +64,12 @@ export function Policies() {
   );
 
   const catalogue = data?.catalogue ?? [];
-  const refetch = useCallback(() => setVersion((v) => v + 1), []);
+  // Invalidate the shared policies caches; because ProcessorFlow and onboarding
+  // read the SAME entries, this also live-refreshes Home.
+  const refetch = useCallback(() => {
+    queryClient.invalidateQueries({ queryKey: qk.policiesList() });
+    queryClient.invalidateQueries({ queryKey: qk.policyRuns() });
+  }, [queryClient]);
   // The catalogue cards are always shown (they're the "configure a policy" CTAs),
   // but the summary strip is pure stat boxes: hide it until at least one policy
   // is configured so a fresh workspace doesn't show a row of zeros.
diff --git a/frontend/editor/src/portal/views/SourceBuilder.test.tsx b/frontend/editor/src/portal/views/SourceBuilder.test.tsx
index 77186de7d8..fab14ff1ae 100644
--- a/frontend/editor/src/portal/views/SourceBuilder.test.tsx
+++ b/frontend/editor/src/portal/views/SourceBuilder.test.tsx
@@ -5,17 +5,18 @@ import {
   screen,
   waitFor,
 } from "@testing-library/react";
-import { MantineProvider } from "@mantine/core";
+import { PortalTestProviders } from "@portal/test/TestQueryProvider";
 import { MemoryRouter, Route, Routes } from "react-router-dom";
 import type { ReactNode } from "react";
 import { SourceBuilder } from "@portal/views/SourceBuilder";
 import { UIProvider } from "@portal/contexts/UIContext";
 
-// SourceBuilder reads useUI() to open settings, so wrap in its provider.
+// SourceBuilder reads useUI() (open settings) and useQueryClient (list
+// invalidation), so provide the query client + Mantine + the UI context.
 const Providers = ({ children }: { children: ReactNode }) => (
-  <MantineProvider>
+  <PortalTestProviders>
     <UIProvider>{children}</UIProvider>
-  </MantineProvider>
+  </PortalTestProviders>
 );
 
 const render = (ui: Parameters<typeof baseRender>[0]) =>
diff --git a/frontend/editor/src/portal/views/SourceBuilder.tsx b/frontend/editor/src/portal/views/SourceBuilder.tsx
index 4d6ff1af14..c38eb9f48d 100644
--- a/frontend/editor/src/portal/views/SourceBuilder.tsx
+++ b/frontend/editor/src/portal/views/SourceBuilder.tsx
@@ -23,6 +23,8 @@ import {
 } from "@portal/api/sources";
 import { useUI } from "@portal/contexts/UIContext";
 import { useAsync } from "@portal/hooks/useAsync";
+import { useQueryClient } from "@tanstack/react-query";
+import { qk } from "@portal/queries/keys";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { creatableSourceTypes } from "@portal/components/sources/creatableSourceTypes";
 import {
@@ -71,11 +73,17 @@ function optionsFor(
 export function SourceBuilder() {
   const { t } = useTranslation();
   const navigate = useNavigate();
+  const queryClient = useQueryClient();
   const { openSettings } = useUI();
   const { id } = useParams();
   const isEdit = Boolean(id);
   const listPath = toPortalPath(VIEW_PATHS.sources);
 
+  // The list is a shared cache entry (Sources view + Home's ProcessorFlow), so
+  // a create/delete here must invalidate it before we navigate back to it.
+  const invalidateSources = () =>
+    queryClient.invalidateQueries({ queryKey: qk.sources() });
+
   const sourceState = useAsync<Source | null>(
     async () => (id ? await fetchSource(id) : null),
     [id],
@@ -152,6 +160,7 @@ export function SourceBuilder() {
         options,
         enabled,
       });
+      await invalidateSources();
       if (!isEdit && type.type === WEBHOOK_SOURCE_TYPE) {
         const webhookId = String(saved.options?.webhookId ?? "");
         const secret = String(saved.options?.signingSecret ?? "");
@@ -177,6 +186,7 @@ export function SourceBuilder() {
     setDeleting(true);
     try {
       await deleteSource(id);
+      await invalidateSources();
       navigate(listPath);
     } catch (e) {
       setError(errorMessage(e));
diff --git a/frontend/editor/src/portal/views/Sources.test.tsx b/frontend/editor/src/portal/views/Sources.test.tsx
index e3b42356c0..f4a52b5665 100644
--- a/frontend/editor/src/portal/views/Sources.test.tsx
+++ b/frontend/editor/src/portal/views/Sources.test.tsx
@@ -4,13 +4,13 @@ import {
   render as baseRender,
   screen,
 } from "@testing-library/react";
-import { MantineProvider } from "@mantine/core";
+import { PortalTestProviders } from "@portal/test/TestQueryProvider";
 import { MemoryRouter, Route, Routes } from "react-router-dom";
 import type { SourcesResponse } from "@portal/api/sources";
 import { Sources } from "@portal/views/Sources";
 
 const render = (ui: Parameters<typeof baseRender>[0]) =>
-  baseRender(ui, { wrapper: MantineProvider });
+  baseRender(ui, { wrapper: PortalTestProviders });
 
 // Deterministic i18n: keys returned verbatim.
 vi.mock("react-i18next", () => ({
diff --git a/frontend/editor/src/portal/views/Sources.tsx b/frontend/editor/src/portal/views/Sources.tsx
index 385a0ab121..6013e00d79 100644
--- a/frontend/editor/src/portal/views/Sources.tsx
+++ b/frontend/editor/src/portal/views/Sources.tsx
@@ -2,13 +2,10 @@ import { useTranslation } from "react-i18next";
 import { useNavigate, useSearchParams } from "react-router-dom";
 import AddRoundedIcon from "@mui/icons-material/AddRounded";
 import { Button, EmptyState, Skeleton, Tabs } from "@app/ui";
-import { useAsync, useSectionFlags } from "@portal/hooks/useAsync";
+import { useSectionFlags } from "@portal/hooks/useAsync";
+import { useSources } from "@portal/queries/sources";
 import { SourcesIcon } from "@portal/components/icons";
-import {
-  fetchSources,
-  type SourcesResponse,
-  type SourceView,
-} from "@portal/api/sources";
+import { type SourceView } from "@portal/api/sources";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { KpiStrip } from "@portal/components/sources/KpiStrip";
 import { SourcesTable } from "@portal/components/sources/SourcesTable";
@@ -24,7 +21,7 @@ export function Sources() {
   const activeTab: SourcesTab =
     searchParams.get("tab") === "connections" ? "connections" : "sources";
 
-  const state = useAsync<SourcesResponse>(() => fetchSources(), []);
+  const state = useSources();
   const { data, loading } = state;
   const { isLoading } = useSectionFlags(state);
 
diff --git a/frontend/editor/src/portal/views/Users.caching.test.tsx b/frontend/editor/src/portal/views/Users.caching.test.tsx
new file mode 100644
index 0000000000..a43cd8a835
--- /dev/null
+++ b/frontend/editor/src/portal/views/Users.caching.test.tsx
@@ -0,0 +1,126 @@
+import {
+  afterAll,
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+} from "vitest";
+import { render, screen, type RenderResult } from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { MemoryRouter } from "react-router-dom";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { setupServer } from "msw/node";
+import {
+  teamSaasHandlers,
+  resetTeamSaasStore,
+} from "@portal/mocks/handlers/teamSaas";
+import { createPortalQueryClient } from "@portal/queryClient";
+import { qk } from "@portal/queries/keys";
+
+/**
+ * The migration's payoff, as assertions: revisiting the Users view serves the
+ * roster from cache with no refetch, and the SaaS roster + teams queries share
+ * one /team/my resolve. Same SaaS mocks as Users.saas.test.tsx.
+ */
+
+vi.mock("@app/auth", () => ({
+  getStoredToken: () => null,
+  clearStoredToken: vi.fn(),
+}));
+vi.mock("@app/auth/supabase/supabaseClient", () => ({
+  getSupabaseClient: () => null,
+  configureSupabase: vi.fn(),
+}));
+vi.mock("@portal/auth/saasSupabase", () => ({ ensureSaasSupabase: vi.fn() }));
+
+vi.mock("@app/portal/usersCapabilities", async () => ({
+  usersCapabilities: (await import("../../saas/portal/usersCapabilities"))
+    .usersCapabilities,
+}));
+vi.mock("@app/portal/usersBackend", async () => ({
+  usersBackend: (await import("../../saas/portal/usersBackend")).usersBackend,
+}));
+
+vi.mock("@portal/contexts/TierContext", () => ({
+  useTier: () => ({ tier: "pro" }),
+}));
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string, fallback?: string, opts?: Record<string, unknown>) => {
+      const base = fallback ?? key;
+      return opts
+        ? base.replace(/\{\{(\w+)\}\}/g, (_, k) => String(opts[k] ?? ""))
+        : base;
+    },
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+import { Users } from "@portal/views/Users";
+
+const server = setupServer(...teamSaasHandlers);
+
+let rosterFetches = 0;
+let teamMyFetches = 0;
+server.events.on("request:start", ({ request }) => {
+  const { pathname } = new URL(request.url);
+  if (pathname.endsWith("/members")) rosterFetches += 1;
+  if (pathname.endsWith("/team/my")) teamMyFetches += 1;
+});
+
+beforeAll(() => server.listen({ onUnhandledRequest: "error" }));
+afterEach(() => server.resetHandlers());
+afterAll(() => {
+  server.events.removeAllListeners();
+  server.close();
+});
+beforeEach(() => {
+  resetTeamSaasStore();
+  rosterFetches = 0;
+  teamMyFetches = 0;
+});
+
+function renderUsers(client: QueryClient): RenderResult {
+  return render(
+    <MantineProvider>
+      <QueryClientProvider client={client}>
+        <MemoryRouter>
+          <Users />
+        </MemoryRouter>
+      </QueryClientProvider>
+    </MantineProvider>,
+  );
+}
+
+describe("Users view caching", () => {
+  it("serves the roster from cache on remount (no refetch)", async () => {
+    // One client across both mounts — the real app keeps it at the portal root,
+    // above the router, for exactly this reason.
+    const client = createPortalQueryClient();
+
+    const first = renderUsers(client);
+    expect(await screen.findByText("leader@acme.com")).toBeInTheDocument();
+    expect(rosterFetches).toBe(1);
+    first.unmount();
+
+    // Remount (navigate away + back) within staleTime → straight from cache.
+    renderUsers(client);
+    expect(await screen.findByText("leader@acme.com")).toBeInTheDocument();
+    expect(rosterFetches).toBe(1);
+  });
+
+  it("collapses the SaaS /team/my call to one per mount", async () => {
+    const client = createPortalQueryClient();
+    renderUsers(client);
+    await screen.findByText("leader@acme.com");
+
+    // Roster + teams both resolve the team but share the cached qk.teamMy()
+    // entry, so /team/my is hit once, not twice.
+    expect(teamMyFetches).toBe(1);
+    expect(client.getQueryData(qk.teamMy())).toBeDefined();
+  });
+});
diff --git a/frontend/editor/src/portal/views/Users.saas.test.tsx b/frontend/editor/src/portal/views/Users.saas.test.tsx
index 7cc49c91dd..3b63171c5d 100644
--- a/frontend/editor/src/portal/views/Users.saas.test.tsx
+++ b/frontend/editor/src/portal/views/Users.saas.test.tsx
@@ -15,7 +15,7 @@ import {
   waitFor,
   within,
 } from "@testing-library/react";
-import { MantineProvider } from "@mantine/core";
+import { PortalTestProviders } from "@portal/test/TestQueryProvider";
 import { MemoryRouter } from "react-router-dom";
 import { setupServer } from "msw/node";
 import {
@@ -78,11 +78,11 @@ beforeEach(() => resetTeamSaasStore());
 
 function renderUsers() {
   return render(
-    <MantineProvider>
+    <PortalTestProviders>
       <MemoryRouter>
         <Users />
       </MemoryRouter>
-    </MantineProvider>,
+    </PortalTestProviders>,
   );
 }
 
diff --git a/frontend/editor/src/portal/views/Users.tsx b/frontend/editor/src/portal/views/Users.tsx
index e8a287e6f7..ad76894b06 100644
--- a/frontend/editor/src/portal/views/Users.tsx
+++ b/frontend/editor/src/portal/views/Users.tsx
@@ -2,28 +2,23 @@ import { useEffect, useMemo, useState } from "react";
 import { useSearchParams } from "react-router-dom";
 import { useTranslation } from "react-i18next";
 import { Button, EmptyState, Skeleton } from "@app/ui";
-import { useTier } from "@portal/contexts/TierContext";
-import { useAsync } from "@portal/hooks/useAsync";
 import {
   changeMemberRole,
   disableMemberMfa,
   setMemberSuspended,
   unlockMember,
-  type AdminAuthConfig,
   type Member,
   type PendingInvitation,
   type PortalAccessState,
   type RoleId,
-  type UsersResponse,
 } from "@portal/api/users";
 import { usersBackend } from "@app/portal/usersBackend";
 import {
   createGrant,
-  fetchGrants,
   revokeGrant,
   type ResourceGrant,
 } from "@portal/api/access";
-import { deleteTeam as apiDeleteTeam, type Team } from "@portal/api/teams";
+import { deleteTeam as apiDeleteTeam } from "@portal/api/teams";
 import { errorMessage } from "@portal/api/http";
 import { usersCapabilities as caps } from "@app/portal/usersCapabilities";
 import { UsersDirectory } from "@portal/components/users/UsersDirectory";
@@ -35,6 +30,7 @@ import { MoveToTeamModal } from "@portal/components/users/MoveToTeamModal";
 import { RenameTeamModal } from "@portal/components/users/RenameTeamModal";
 import { ConfirmModal } from "@portal/components/users/ConfirmModal";
 import type { TeamGroup } from "@portal/components/users/directory";
+import { useUsersData } from "@portal/views/usersData";
 
 interface Confirm {
   title: string;
@@ -44,28 +40,14 @@ interface Confirm {
   action: () => Promise<unknown>;
 }
 
+/**
+ * Users page: the org roster, teams, and portal-access management. Mutation
+ * handlers call `refresh` to invalidate the shared caches (see useUsersData).
+ */
 export function Users() {
   const { t } = useTranslation();
-  const { tier } = useTier();
-  const [refreshKey, setRefreshKey] = useState(0);
-
-  const usersState = useAsync<UsersResponse>(
-    () => usersBackend.fetchUsers(tier),
-    [tier, refreshKey],
-  );
-  // Grants are ADMIN-only; skip the fetch entirely on flavors that can't manage them.
-  const grantsState = useAsync<ResourceGrant[]>(
-    () => (caps.manageGrants ? fetchGrants("PORTAL") : Promise.resolve([])),
-    [tier, refreshKey],
-  );
-  const teamsState = useAsync<Team[]>(
-    () => usersBackend.fetchTeams(),
-    [tier, refreshKey],
-  );
-  const authState = useAsync<AdminAuthConfig>(
-    () => usersBackend.fetchAuthConfig(),
-    [],
-  );
+  const { usersState, grantsState, teamsState, authState, refresh } =
+    useUsersData();
 
   const [actionError, setActionError] = useState<string | null>(null);
   const [inviteOpen, setInviteOpen] = useState(false);
@@ -151,9 +133,8 @@ export function Users() {
       .catch((error) => setActionError(errorMessage(error)))
       // Refetch on success AND failure: a multi-step mutation (e.g. changeMemberRole)
       // has no rollback, so a mid-sequence failure must resync the roster to real state.
-      .finally(() => setRefreshKey((k) => k + 1));
+      .finally(() => refresh());
   }
-  const refresh = () => setRefreshKey((k) => k + 1);
 
   function changeRole(member: Member, role: RoleId) {
     run(() => changeMemberRole(member, role));
diff --git a/frontend/editor/src/portal/views/teamMyCache.saas.test.ts b/frontend/editor/src/portal/views/teamMyCache.saas.test.ts
new file mode 100644
index 0000000000..f18c70dd0a
--- /dev/null
+++ b/frontend/editor/src/portal/views/teamMyCache.saas.test.ts
@@ -0,0 +1,87 @@
+import {
+  afterAll,
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  vi,
+} from "vitest";
+import { setupServer } from "msw/node";
+import { http, HttpResponse } from "msw";
+import { createPortalQueryClient } from "@portal/queryClient";
+import { qk } from "@portal/queries/keys";
+import { usersBackend } from "@app/portal/usersBackend";
+
+/**
+ * The SaaS team resolution (/team/my) is read through the shared query cache so
+ * fetchUsers + fetchTeams dedupe to one request per mount. Regression guard for
+ * the bug where a rename/remove "did nothing": the cache must also honour
+ * invalidation, so a mutation's refresh() forces a re-resolve instead of
+ * serving the stale team. (Uses fetchQuery, not ensureQueryData — the latter
+ * returns cached data even when invalidated.)
+ */
+
+// Keep apiClient.local's transport hermetic (no real token at import).
+vi.mock("@app/auth", () => ({
+  getStoredToken: () => null,
+  clearStoredToken: vi.fn(),
+}));
+vi.mock("@app/auth/supabase/supabaseClient", () => ({
+  getSupabaseClient: () => null,
+  configureSupabase: vi.fn(),
+}));
+// The portal test project's @app points at proprietary; resolve the flavor seam
+// to the real SaaS backend (same approach as Users.saas.test).
+vi.mock("@app/portal/usersBackend", async () => ({
+  usersBackend: (await import("../../saas/portal/usersBackend")).usersBackend,
+}));
+
+let teamMyFetches = 0;
+let teamName = "Old name";
+const server = setupServer(
+  http.get("*/api/v1/team/my", () => {
+    teamMyFetches += 1;
+    return HttpResponse.json([
+      {
+        teamId: 1,
+        name: teamName,
+        teamType: "STANDARD",
+        isPersonal: false,
+        memberCount: 2,
+        seatCount: 5,
+        seatsUsed: 2,
+        maxSeats: 5,
+        isLeader: true,
+      },
+    ]);
+  }),
+);
+
+beforeAll(() => server.listen({ onUnhandledRequest: "error" }));
+afterEach(() => server.resetHandlers());
+afterAll(() => server.close());
+beforeEach(() => {
+  teamMyFetches = 0;
+  teamName = "Old name";
+});
+
+describe("SaaS /team/my resolution cache", () => {
+  it("dedupes within staleTime but re-resolves after invalidation", async () => {
+    const client = createPortalQueryClient();
+
+    // Two resolves within staleTime → one network call (the collapse).
+    expect((await usersBackend.fetchTeams())[0]?.name).toBe("Old name");
+    expect((await usersBackend.fetchTeams())[0]?.name).toBe("Old name");
+    expect(teamMyFetches).toBe(1);
+
+    // Server-side rename + what a Users mutation's refresh() does.
+    teamName = "New name";
+    await client.invalidateQueries({ queryKey: qk.teamMy() });
+
+    // Must refetch, not serve the stale cached team (the reported bug).
+    expect((await usersBackend.fetchTeams())[0]?.name).toBe("New name");
+    expect(teamMyFetches).toBe(2);
+  });
+});
diff --git a/frontend/editor/src/portal/views/usersData.ts b/frontend/editor/src/portal/views/usersData.ts
new file mode 100644
index 0000000000..d6e965d714
--- /dev/null
+++ b/frontend/editor/src/portal/views/usersData.ts
@@ -0,0 +1,63 @@
+import { useCallback } from "react";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { useTier } from "@portal/contexts/TierContext";
+import type { AsyncState } from "@portal/hooks/useAsync";
+import { toAsyncState } from "@portal/queries/adapters";
+import { qk } from "@portal/queries/keys";
+import { usersBackend } from "@app/portal/usersBackend";
+import { fetchGrants, type ResourceGrant } from "@portal/api/access";
+import { usersCapabilities as caps } from "@app/portal/usersCapabilities";
+import type { AdminAuthConfig, UsersResponse } from "@portal/api/users";
+import type { Team } from "@portal/api/teams";
+
+/** The four resources the Users page renders, plus a post-mutation refresh. */
+export interface UsersData {
+  usersState: AsyncState<UsersResponse>;
+  grantsState: AsyncState<ResourceGrant[]>;
+  teamsState: AsyncState<Team[]>;
+  authState: AsyncState<AdminAuthConfig>;
+  refresh: () => void;
+}
+
+// Grants are ADMIN-only; resolve empty on flavors that can't manage them.
+const fetchGrantsOrEmpty = (): Promise<ResourceGrant[]> =>
+  caps.manageGrants ? fetchGrants("PORTAL") : Promise.resolve([]);
+
+export function useUsersData(): UsersData {
+  const { tier } = useTier();
+  const queryClient = useQueryClient();
+
+  const usersQuery = useQuery({
+    queryKey: qk.usersRoster(tier),
+    queryFn: () => usersBackend.fetchUsers(tier),
+  });
+  const grantsQuery = useQuery({
+    queryKey: qk.usersGrants(tier),
+    queryFn: fetchGrantsOrEmpty,
+  });
+  const teamsQuery = useQuery({
+    queryKey: qk.usersTeams(tier),
+    queryFn: () => usersBackend.fetchTeams(),
+  });
+  const authQuery = useQuery({
+    queryKey: qk.usersAuthConfig(),
+    queryFn: () => usersBackend.fetchAuthConfig(),
+  });
+
+  // Auth config is deliberately not invalidated (it never changes via these
+  // mutations); teamMy is the shared SaaS entry roster + teams both derive from.
+  const refresh = useCallback(() => {
+    queryClient.invalidateQueries({ queryKey: qk.usersRoster(tier) });
+    queryClient.invalidateQueries({ queryKey: qk.usersGrants(tier) });
+    queryClient.invalidateQueries({ queryKey: qk.usersTeams(tier) });
+    queryClient.invalidateQueries({ queryKey: qk.teamMy() });
+  }, [queryClient, tier]);
+
+  return {
+    usersState: toAsyncState(usersQuery),
+    grantsState: toAsyncState(grantsQuery),
+    teamsState: toAsyncState(teamsQuery),
+    authState: toAsyncState(authQuery),
+    refresh,
+  };
+}
diff --git a/frontend/editor/src/saas/portal/usersBackend.ts b/frontend/editor/src/saas/portal/usersBackend.ts
index 9239810814..a4fbc03dfb 100644
--- a/frontend/editor/src/saas/portal/usersBackend.ts
+++ b/frontend/editor/src/saas/portal/usersBackend.ts
@@ -1,5 +1,7 @@
 import type { UsersBackend } from "@portal/api/usersBackend";
 import { apiClient } from "@portal/api/http";
+import { tryGetPortalQueryClient } from "@portal/queryClient";
+import { qk } from "@portal/queries/keys";
 import {
   ROLES,
   type AdminAuthConfig,
@@ -76,7 +78,18 @@ function isExpired(iso: string | undefined): boolean {
  * no teams at all.
  */
 async function resolveTeam(): Promise<TeamDetailsDTO | null> {
-  const teams = await apiClient.local.json<TeamDetailsDTO[]>("/api/v1/team/my");
+  const fetchMy = () =>
+    apiClient.local.json<TeamDetailsDTO[]>("/api/v1/team/my");
+  // fetchUsers and fetchTeams both resolve the team; share one /team/my via the
+  // query cache. fetchQuery (not ensureQueryData) so the shared entry honours
+  // both staleTime — two callers in one mount dedupe to a single request — AND
+  // invalidation: refresh() invalidates qk.teamMy(), so the next resolve after a
+  // rename/remove refetches instead of returning the stale team. Falls back to a
+  // direct fetch when no portal client is mounted (e.g. a unit test).
+  const client = tryGetPortalQueryClient();
+  const teams = client
+    ? await client.fetchQuery({ queryKey: qk.teamMy(), queryFn: fetchMy })
+    : await fetchMy();
   if (!teams || teams.length === 0) return null;
   return (
     teams.find((t) => t.isLeader && !t.isPersonal) ??
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index 2ddece68a0..f467cd4e47 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -50,6 +50,7 @@
         "@stripe/stripe-js": "^7.9.0",
         "@supabase/supabase-js": "^2.47.13",
         "@tailwindcss/postcss": "^4.1.13",
+        "@tanstack/react-query": "^5.101.4",
         "@tanstack/react-virtual": "^3.13.12",
         "@tauri-apps/api": "^2.10.1",
         "@tauri-apps/plugin-dialog": "2.7.0",
@@ -4525,6 +4526,32 @@
         "tailwindcss": "4.2.2"
       }
     },
+    "node_modules/@tanstack/query-core": {
+      "version": "5.101.4",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.101.4.tgz",
+      "integrity": "sha512-gNwcvOJcRbLWPOLG/2OBm+zM+Yv+MKsXKEOWC57USuZDEsI71hEErQsiEGx5wX9rzWWkfwM0fVSPoiIFSsxfiw==",
+      "license": "MIT",
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      }
+    },
+    "node_modules/@tanstack/react-query": {
+      "version": "5.101.4",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.101.4.tgz",
+      "integrity": "sha512-yRg2pfOCxIs4ZJW3XYYHU/WgtD04FHSnfHlpRT7h7pR77hwkdRG4wxbKe4aq6P0RvXUTBSQpQeadS1SUYUe+KA==",
+      "license": "MIT",
+      "dependencies": {
+        "@tanstack/query-core": "5.101.4"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/tannerlinsley"
+      },
+      "peerDependencies": {
+        "react": "^18 || ^19"
+      }
+    },
     "node_modules/@tanstack/react-virtual": {
       "version": "3.13.23",
       "resolved": "https://registry.npmjs.org/@tanstack/react-virtual/-/react-virtual-3.13.23.tgz",
diff --git a/frontend/package.json b/frontend/package.json
index e460f37e40..06059a3962 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -47,6 +47,7 @@
     "@stripe/stripe-js": "^7.9.0",
     "@supabase/supabase-js": "^2.47.13",
     "@tailwindcss/postcss": "^4.1.13",
+    "@tanstack/react-query": "^5.101.4",
     "@tanstack/react-virtual": "^3.13.12",
     "@tauri-apps/api": "^2.10.1",
     "@tauri-apps/plugin-dialog": "2.7.0",

From 4fbb2fe885cfcdddef0c3dfa8d20bcc82916872d Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Fri, 24 Jul 2026 10:37:10 +0100
Subject: [PATCH 092/109] Add PR Quiz skill (#7137)

# Description of Changes
Adds a Claude skill to quiz you about your PR, to help check that you
understand the code in the PR.

<img width="796" height="589" alt="image"
src="https://github.com/user-attachments/assets/0f520a99-9acf-4922-85fe-5f49f8f68823"
/>

<img width="811" height="621" alt="image"
src="https://github.com/user-attachments/assets/e440c775-d901-443b-a213-1cc4ee6303af"
/>
---
 .claude/skills/pr-quiz/SKILL.md | 137 ++++++++++++++++++++++++++++++++
 1 file changed, 137 insertions(+)
 create mode 100644 .claude/skills/pr-quiz/SKILL.md

diff --git a/.claude/skills/pr-quiz/SKILL.md b/.claude/skills/pr-quiz/SKILL.md
new file mode 100644
index 0000000000..89d2a43d51
--- /dev/null
+++ b/.claude/skills/pr-quiz/SKILL.md
@@ -0,0 +1,137 @@
+---
+name: pr-quiz
+description: >-
+  Quiz the PR author on their own branch before they request review, to prove they
+  actually understand the change - especially code an AI wrote for them. Scopes the
+  branch diff vs its base, reads the changed code, then asks graded questions about
+  what changed, why, how it works, what it could break, and which edge cases it must
+  handle. Presents all questions first, waits for the author's answers, then grades
+  each honestly against the real code (Correct / Partial / Incorrect with the true
+  answer and file:line), scores it, and gives a readiness verdict that names the
+  areas to re-study before asking humans to review. Use when asked to quiz me on my
+  PR/branch, "test my understanding before review", a self-check gate before opening
+  a PR, or before requesting reviewers. Administered as an interactive
+  multiple-choice quiz (clickable options) by default; pass --free-text for
+  written answers, --questions N to set count, --save to write a scorecard.
+argument-hint: "[branch-or-base-ref] [--questions N] [--free-text] [--save]"
+allowed-tools: Bash, Read, Grep, Glob, Write, AskUserQuestion
+---
+
+# PR Quiz
+
+Test whether the **author** genuinely understands their own branch before they ask
+other people to spend time reviewing it. This is a self-check gate: the point is to
+catch changes - often AI-written - that the author would not be able to explain or
+defend in review. Be a fair but honest examiner, not a pushover.
+
+`$ARGUMENTS` may name a base ref or branch to diff against; default is this branch
+vs where it forked from the main line. Flags:
+- `--questions N` - target N questions (else scale to diff size, see below).
+- `--free-text` - administer as a written numbered list instead of the default
+  interactive multiple-choice.
+- `--save` - also write a scorecard file after grading.
+
+## Integrity rules (read first - the whole skill depends on these)
+
+1. **Present every question before revealing any answer.** Ask, then wait. Never
+   show the answer key alongside the questions.
+2. **Do not give hints or the answer while the quiz is open.** If the author asks
+   "what's the answer?" or "is it X?" before committing, decline warmly and tell
+   them to give their best answer first - guessing is part of the signal.
+3. **Grade truthfully.** Vague, hand-wavy, or "the AI did it" non-answers are
+   Partial or Incorrect, not Correct. Do not inflate the score to be nice; a false
+   pass defeats the entire purpose.
+4. **Ground everything in code you actually read.** Every question and every model
+   answer must trace to a real line in the diff. Cite `path:line`. No trivia
+   ("how many lines?"), no invented behavior.
+5. **Credit real understanding.** If the author explains it correctly in their own
+   words, mark it Correct even if worded differently than your key.
+
+## Process
+
+### 1. Scope the change (silently)
+- Find the base. Prefer the fork point off the main line so the quiz covers only
+  this branch's work:
+  ```bash
+  git fetch -q origin 2>/dev/null; \
+  BASE=$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main); \
+  git diff --stat "$BASE"...HEAD
+  ```
+  If `$ARGUMENTS` names a ref, diff against that instead.
+- If the diff is empty, stop and say there's nothing to quiz on.
+- Read commit messages / PR description for the *stated* intent, but verify it
+  against the actual diff - a mismatch is itself a good question.
+
+### 2. Understand the code well enough to examine on it
+Read the full diff plus enough surrounding context and related files to answer
+every question you plan to ask. You cannot grade understanding you don't have.
+Note the non-obvious parts: the design decisions, the risky lines, the edge cases,
+the cross-file ripples, and anything that violates or upholds repo conventions
+(for this repo e.g. `@app/*` import layering, all file ops via FileContext,
+Jackson 3 / Spring Boot 4 APIs, engine typed-contract boundaries).
+
+### 3. Build the question set
+Scale count to the change unless `--questions N` is given:
+small (< ~50 changed lines) 3-4, medium 5-8, large 9-12. Cap at 12.
+Draw from these categories - weight toward the ones the diff actually exercises:
+- **Intent** - what problem this solves; why it was needed now.
+- **Mechanism** - how a specific non-trivial piece actually works ("walk me
+  through what `foo()` does when called with X").
+- **Decisions & alternatives** - why this approach over an obvious alternative;
+  what a reviewer would reasonably push back on.
+- **Blast radius** - what else this touches or could break; what you'd retest.
+- **Edge cases** - inputs/states the change must handle (null, empty, large,
+  concurrent, error paths).
+- **Conventions & correctness** - does it follow the repo's rules; is there a
+  latent bug the author should be able to spot.
+Prefer questions the author can only answer if they read and understood the code.
+Keep a private answer key with `path:line` for each - do **not** show it yet.
+
+### 4. Administer the quiz
+- **Default (multiple choice):** use the `AskUserQuestion` tool. Per question write
+  3-4 options where **every** option is independently plausible - each distractor a
+  real-but-wrong reading of the code, not filler. Two hard rules so the answer
+  can't be spotted by shape rather than knowledge:
+  - **Randomise the correct option's position** across questions - never default
+    it to first. Spread it roughly evenly over the slots.
+  - **Keep all options the same depth and length.** Do not describe the correct
+    one more fully than the distractors - a longer or more-detailed option is a
+    dead giveaway. Trim the right answer or flesh out the wrong ones until a
+    reader can't tell them apart by size.
+  The tool caps a call at 4 questions, so ask in batches of 4 - but run them as
+  one continuous flow: fire the next batch immediately after the previous
+  returns, with no narration ("Round 2 of 3") and no grading between batches.
+  The author always has an "Other" free-text escape, which is fine.
+- **`--free-text`:** present all questions in one numbered list, then say
+  "Answer in one reply; number your answers. I won't grade until you're done."
+  Wait for the author's answers.
+- Do not proceed to grading until every answer is in.
+
+### 5. Grade
+For each question, in order:
+- Verdict: **Correct** / **Partial** / **Incorrect**.
+- The model answer in one or two sentences, citing the real `path:line`.
+- One line on the gap when Partial/Incorrect - what they missed and where to look.
+Then a **Score** (e.g. 6/8, counting Partial as half) and a one-line summary of
+the pattern (e.g. "solid on intent, shaky on the error paths").
+
+### 6. Readiness verdict
+End with a clear call:
+- **Ready for review** - understanding is sound; note anything to mention to
+  reviewers proactively.
+- **Study first** - list the specific files/concepts to re-read before requesting
+  review, each as a clickable `path:line`. Be concrete: "re-read the null handling
+  in X before you send this out."
+Keep it honest - if they'd get grilled in review on something, say so now.
+
+### 7. If `--save`
+Write `pr-quiz/<branch>-scorecard.md`: the questions, their answers, your grades
+and model answers, the score, and the verdict. Don't commit it unless asked.
+
+## Principles
+- **The author is the examinee, not the collaborator.** During the quiz you withhold
+  answers; you're measuring them, not helping them pass.
+- **A failed quiz is a successful outcome** - it caught a gap before a human's time
+  was spent. Frame it that way, not as a scolding.
+- **True to the code.** Every question, answer, and grade traces to a line you read.
+- **Terse and direct** in chat - the questions and the verdict, minimal preamble.

From 831bd4fe94d7de4b0440629bb5da1344addfb8dd Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Fri, 24 Jul 2026 10:52:26 +0100
Subject: [PATCH 093/109] Remove depot.dev support from GitHub Actions
 workflows (#7148)

---
 .github/workflows/PR-Auto-Deploy-V2.yml       | 39 ++--------
 .../workflows/PR-Demo-Comment-with-react.yml  | 54 ++-----------
 .github/workflows/_runner-pick.yml            | 35 +--------
 .github/workflows/ai-engine.yml               |  2 -
 .github/workflows/backend-build.yml           |  8 +-
 .github/workflows/build-enterprise.yml        | 21 +-----
 .github/workflows/build.yml                   |  1 -
 .github/workflows/check-generated-models.yml  |  2 -
 .github/workflows/check-licence.yml           |  2 -
 .github/workflows/check-openapi.yml           |  8 +-
 .github/workflows/coverage-aggregate.yml      |  6 +-
 .github/workflows/db-migration-test.yml       |  8 +-
 .github/workflows/deploy-on-v2-commit.yml     | 53 ++-----------
 .github/workflows/docker-compose-tests.yml    | 13 +---
 .github/workflows/e2e-live.yml                | 12 +--
 .github/workflows/e2e-stubbed.yml             | 12 +--
 .../frontend-backend-licenses-update.yml      | 16 ++--
 .github/workflows/frontend-validation.yml     |  6 +-
 .github/workflows/multiOSReleases.yml         | 17 ++---
 .github/workflows/nightly.yml                 |  6 +-
 .github/workflows/swagger.yml                 |  8 +-
 .github/workflows/tauri-build.yml             |  1 -
 .github/workflows/test-build-docker.yml       | 75 ++-----------------
 .github/workflows/testdriver.yml              | 43 ++---------
 settings.gradle                               | 25 -------
 25 files changed, 59 insertions(+), 414 deletions(-)

diff --git a/.github/workflows/PR-Auto-Deploy-V2.yml b/.github/workflows/PR-Auto-Deploy-V2.yml
index 172d72ee5c..a19a616735 100644
--- a/.github/workflows/PR-Auto-Deploy-V2.yml
+++ b/.github/workflows/PR-Auto-Deploy-V2.yml
@@ -23,13 +23,9 @@ permissions:
   pull-requests: write
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   check-pr:
     if: (github.event_name == 'pull_request' && github.event.action != 'closed') || github.event_name == 'workflow_dispatch'
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     outputs:
       should_deploy: ${{ steps.decide.outputs.should_deploy }}
       is_fork: ${{ steps.resolve.outputs.is_fork }}
@@ -101,8 +97,8 @@ jobs:
           echo "allow_fork=${allow_fork:-false}" >> $GITHUB_OUTPUT
 
   deploy-v2-pr:
-    needs: [pick, check-pr]
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    needs: check-pr
+    runs-on: ubuntu-latest
     if: needs.check-pr.outputs.should_deploy == 'true' && (needs.check-pr.outputs.is_fork == 'false' || needs.check-pr.outputs.allow_fork == 'true')
     # Concurrency control - only one deployment per PR at a time
     concurrency:
@@ -112,10 +108,7 @@ jobs:
       contents: read
       issues: write
       pull-requests: write
-      id-token: write
     env:
-      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
       # Single source of truth for whether this preview embeds the admin portal:
       # drives the image build-arg and the deployment comment.
       BUILD_PORTAL: "true"
@@ -190,12 +183,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           fetch-depth: 0 # Fetch full history for commit hash detection
 
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
       - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Get version number
@@ -240,22 +228,8 @@ jobs:
             echo "Image needs to be built"
           fi
 
-      - name: Build and push V2 image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-image.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-${{ steps.commit-hash.outputs.app_short }}
-          build-args: |
-            VERSION_TAG=v2-alpha
-            BUILD_PORTAL=${{ env.BUILD_PORTAL }}
-          platforms: linux/amd64
-
-      - name: Build and push V2 image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-image.outputs.exists == 'false'
+      - name: Build and push V2 image
+        if: steps.check-image.outputs.exists == 'false'
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
@@ -474,8 +448,7 @@ jobs:
 
   cleanup-v2-deployment:
     if: github.event.action == 'closed'
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/PR-Demo-Comment-with-react.yml b/.github/workflows/PR-Demo-Comment-with-react.yml
index bde9061ab7..2b81b8c777 100644
--- a/.github/workflows/PR-Demo-Comment-with-react.yml
+++ b/.github/workflows/PR-Demo-Comment-with-react.yml
@@ -34,12 +34,8 @@ permissions:
   pull-requests: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   check-comment:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     permissions:
       issues: write
     if: |
@@ -179,15 +175,11 @@ jobs:
             }
 
   deploy-pr:
-    needs: [pick, check-comment]
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    needs: check-comment
+    runs-on: ubuntu-latest
     permissions:
       issues: write
       pull-requests: write
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
 
     steps:
       - name: Harden Runner
@@ -240,12 +232,7 @@ jobs:
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           STIRLING_PDF_DESKTOP_UI: false
 
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
       - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Login to Docker Hub
@@ -254,22 +241,7 @@ jobs:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
-      - name: Build and push PR-specific image (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:pr-${{ needs.check-comment.outputs.pr_number }}
-          build-args: |
-            VERSION_TAG=alpha
-            PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
-          platforms: linux/amd64
-
-      - name: Build and push PR-specific image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build and push PR-specific image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
@@ -283,19 +255,8 @@ jobs:
             PROTOTYPES_BUILD=${{ needs.check-comment.outputs.enable_prototypes }}
           platforms: linux/amd64
 
-      - name: Build and push engine image (Depot)
-        if: env.USE_DEPOT == 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: ./engine
-          file: ./engine/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:engine-pr-${{ needs.check-comment.outputs.pr_number }}
-          platforms: linux/amd64
-
-      - name: Build and push engine image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && needs.check-comment.outputs.enable_prototypes == 'true'
+      - name: Build and push engine image
+        if: needs.check-comment.outputs.enable_prototypes == 'true'
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ./engine
@@ -510,8 +471,7 @@ jobs:
 
   handle-label-commands:
     if: ${{ github.event.issue.pull_request != null }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/_runner-pick.yml b/.github/workflows/_runner-pick.yml
index 09959f3353..0f32d79b95 100644
--- a/.github/workflows/_runner-pick.yml
+++ b/.github/workflows/_runner-pick.yml
@@ -2,13 +2,8 @@ name: _runner-pick
 
 # Tiny reusable workflow that classifies the trigger as either a "fork PR
 # from an untrusted contributor" or a "trusted commit" so downstream jobs
-# can pick a runner class without each one duplicating the 200-char gate
-# expression in their own `runs-on:`.
-#
-# It also owns the single Depot kill-switch (use_depot). Depot is currently
-# disabled repo-wide; downstream jobs gate their Depot runner/build usage on
-# use_depot so nothing has to be deleted to turn Depot off. Flip DEPOT_ENABLED
-# in the decide step to switch Depot back on.
+# can trust-gate (skip secret-dependent jobs on forks) without each one
+# duplicating the gate expression.
 #
 # Caller pattern:
 #
@@ -18,15 +13,12 @@ name: _runner-pick
 #
 #     real-work:
 #       needs: pick
-#       runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-8' || 'ubuntu-latest' }}
+#       if: needs.pick.outputs.is_fork != 'true'
 #       steps: [...]
 #
 # Outputs:
 #   is_fork:   "true" when the trigger is a pull_request from a fork or an
-#              untrusted author_association, "false" otherwise. Use this for
-#              trust gating (skipping secret-dependent jobs on forks).
-#   use_depot: "true" when downstream jobs should use Depot runners/builders.
-#              Currently forced "false" (Depot disabled repo-wide).
+#              untrusted author_association, "false" otherwise.
 
 on:
   workflow_call:
@@ -34,9 +26,6 @@ on:
       is_fork:
         description: '"true" if the trigger is an untrusted fork PR.'
         value: ${{ jobs.pick.outputs.is_fork }}
-      use_depot:
-        description: '"true" when downstream jobs should use Depot. Currently forced off.'
-        value: ${{ jobs.pick.outputs.use_depot }}
 
 permissions:
   contents: read
@@ -47,7 +36,6 @@ jobs:
     timeout-minutes: 1
     outputs:
       is_fork: ${{ steps.decide.outputs.is_fork }}
-      use_depot: ${{ steps.decide.outputs.use_depot }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -63,12 +51,6 @@ jobs:
         run: |
           set -eu
 
-          # Depot kill-switch. Depot is disabled repo-wide: no job uses Depot
-          # runners or the Depot build actions while this is false. All the
-          # Depot wiring is left in place - set DEPOT_ENABLED=true to switch it
-          # back on (it then activates on trusted, non-fork triggers as before).
-          DEPOT_ENABLED=false
-
           if [ -z "${PR_NUMBER:-}" ]; then
             # Not a pull_request event at all (push, schedule, workflow_dispatch,
             # workflow_call from a non-PR trigger) -> trusted by default.
@@ -82,13 +64,4 @@ jobs:
             esac
           fi
 
-          # Depot only ever ran on trusted triggers, so gate it on both the
-          # kill-switch and is_fork.
-          if [ "${DEPOT_ENABLED}" = "true" ] && [ "${is_fork}" = "false" ]; then
-            use_depot=true
-          else
-            use_depot=false
-          fi
-
           echo "is_fork=${is_fork}" >> "$GITHUB_OUTPUT"
-          echo "use_depot=${use_depot}" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/ai-engine.yml b/.github/workflows/ai-engine.yml
index 58fe551c33..fbc9848eaf 100644
--- a/.github/workflows/ai-engine.yml
+++ b/.github/workflows/ai-engine.yml
@@ -18,8 +18,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml
index b06e94be38..28974a5ff6 100644
--- a/.github/workflows/backend-build.yml
+++ b/.github/workflows/backend-build.yml
@@ -19,14 +19,8 @@ permissions:
   pull-requests: write
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   build:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-8' || 'ubuntu-latest' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/build-enterprise.yml b/.github/workflows/build-enterprise.yml
index 5aab6529b4..8c06175a5d 100644
--- a/.github/workflows/build-enterprise.yml
+++ b/.github/workflows/build-enterprise.yml
@@ -15,23 +15,11 @@ name: Enterprise E2E (Playwright)
 
 on:
   workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
   push:
     branches: ["main"]
   schedule:
     - cron: "0 4 * * *"
   workflow_dispatch:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
 
 # No `concurrency:` block here on purpose. When this workflow is called via
 # workflow_call from build.yml, ${{ github.workflow }}/event_name/pr_number
@@ -50,17 +38,16 @@ jobs:
 
   playwright-e2e-enterprise:
     needs: pick
-    # Skip on fork PRs / untrusted authors: they have no PREMIUM_KEY_ENTERPRISE
-    # (nor DEPOT_TOKEN), so the suite can't boot premium and would fail. See the
-    # header comment. GitHub reports the skipped reusable workflow as success.
+    # Skip on fork PRs / untrusted authors: they have no PREMIUM_KEY_ENTERPRISE,
+    # so the suite can't boot premium and would fail. See the header comment.
+    # GitHub reports the skipped reusable workflow as success.
     if: needs.pick.outputs.is_fork != 'true'
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     timeout-minutes: 45
     env:
       PREMIUM_KEY: ${{ secrets.PREMIUM_KEY_ENTERPRISE }}
       PREMIUM_ENABLED: "true"
       SYSTEM_ENABLEANALYTICS: "false"
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5689afe532..7d4130f214 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -149,7 +149,6 @@ jobs:
     permissions:
       contents: read
       packages: read
-      id-token: write
     uses: ./.github/workflows/test-build-docker.yml
     secrets: inherit
     with:
diff --git a/.github/workflows/check-generated-models.yml b/.github/workflows/check-generated-models.yml
index 0d8f784b4a..eef119cd02 100644
--- a/.github/workflows/check-generated-models.yml
+++ b/.github/workflows/check-generated-models.yml
@@ -21,8 +21,6 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/check-licence.yml b/.github/workflows/check-licence.yml
index 027632b50b..9f6cfb39a0 100644
--- a/.github/workflows/check-licence.yml
+++ b/.github/workflows/check-licence.yml
@@ -11,8 +11,6 @@ permissions:
 jobs:
   check-licence:
     runs-on: ubuntu-latest
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/check-openapi.yml b/.github/workflows/check-openapi.yml
index c823a3d5d1..d853afa86f 100644
--- a/.github/workflows/check-openapi.yml
+++ b/.github/workflows/check-openapi.yml
@@ -10,14 +10,8 @@ permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   check-generate-openapi-docs:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/coverage-aggregate.yml b/.github/workflows/coverage-aggregate.yml
index b4d47fdc3e..bbed57db4d 100644
--- a/.github/workflows/coverage-aggregate.yml
+++ b/.github/workflows/coverage-aggregate.yml
@@ -29,12 +29,8 @@ permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   aggregate:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/db-migration-test.yml b/.github/workflows/db-migration-test.yml
index dfbde51e30..c6ebc481a7 100644
--- a/.github/workflows/db-migration-test.yml
+++ b/.github/workflows/db-migration-test.yml
@@ -12,15 +12,9 @@ permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   migration-test:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-8' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     timeout-minutes: 30
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/deploy-on-v2-commit.yml b/.github/workflows/deploy-on-v2-commit.yml
index a932581840..2dcbe2ae65 100644
--- a/.github/workflows/deploy-on-v2-commit.yml
+++ b/.github/workflows/deploy-on-v2-commit.yml
@@ -10,21 +10,11 @@ permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   deploy-v2-on-push:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     concurrency:
       group: deploy-v2-push-V2
       cancel-in-progress: true
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
 
     steps:
       - name: Harden Runner
@@ -35,12 +25,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
       - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Get commit hashes for frontend and backend
@@ -105,22 +90,8 @@ jobs:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
-      - name: Build and push frontend image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-frontend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/frontend/Dockerfile
-          push: true
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-${{ steps.commit-hashes.outputs.frontend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-frontend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push frontend image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-frontend.outputs.exists == 'false'
+      - name: Build and push frontend image
+        if: steps.check-frontend.outputs.exists == 'false'
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
@@ -134,22 +105,8 @@ jobs:
           build-args: VERSION_TAG=v2-alpha
           platforms: linux/amd64
 
-      - name: Build and push backend image (Depot)
-        if: env.USE_DEPOT == 'true' && steps.check-backend.outputs.exists == 'false'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/backend/Dockerfile
-          push: true
-          tags: |
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-${{ steps.commit-hashes.outputs.backend_short }}
-            ${{ secrets.DOCKER_HUB_USERNAME }}/test:v2-backend-latest
-          build-args: VERSION_TAG=v2-alpha
-          platforms: linux/amd64
-
-      - name: Build and push backend image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && steps.check-backend.outputs.exists == 'false'
+      - name: Build and push backend image
+        if: steps.check-backend.outputs.exists == 'false'
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
diff --git a/.github/workflows/docker-compose-tests.yml b/.github/workflows/docker-compose-tests.yml
index 92faaeefee..2db9e5cf72 100644
--- a/.github/workflows/docker-compose-tests.yml
+++ b/.github/workflows/docker-compose-tests.yml
@@ -11,28 +11,17 @@ on:
         required: false
         type: string
         default: "false"
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 4 because bench showed 16 was within noise of 4."
-        required: false
-        type: string
-        default: "4"
 
 permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   docker-compose-tests:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '4') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     permissions:
       actions: write
       contents: read
       checks: write
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
 
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index f2904220b9..3a1b4e3af1 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -5,23 +5,13 @@ name: Playwright E2E (live backend)
 # server.
 on:
   workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
 
 permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   playwright-e2e-live:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/e2e-stubbed.yml b/.github/workflows/e2e-stubbed.yml
index b16e538114..214a7188df 100644
--- a/.github/workflows/e2e-stubbed.yml
+++ b/.github/workflows/e2e-stubbed.yml
@@ -5,23 +5,13 @@ name: Playwright E2E (stubbed)
 # mocks API responses in the browser.
 on:
   workflow_call:
-    inputs:
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking. Tuned to 8 to match the other playwright workflows; bench showed flat scaling above 8."
-        required: false
-        type: string
-        default: "8"
 
 permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   playwright-e2e:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/frontend-backend-licenses-update.yml b/.github/workflows/frontend-backend-licenses-update.yml
index 4f7212495f..fcf6e18d0e 100644
--- a/.github/workflows/frontend-backend-licenses-update.yml
+++ b/.github/workflows/frontend-backend-licenses-update.yml
@@ -19,13 +19,9 @@ permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   files-changed:
     name: detect what files changed
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     timeout-minutes: 3
     outputs:
       licenses-frontend: ${{ steps.changes.outputs.licenses-frontend }}
@@ -48,8 +44,8 @@ jobs:
   generate-frontend-license-report:
     if: needs.files-changed.outputs.licenses-frontend == 'true'
     name: Generate Frontend License Report
-    needs: [pick, files-changed]
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    needs: files-changed
+    runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
@@ -321,15 +317,13 @@ jobs:
 
   generate-backend-license-report:
     if: needs.files-changed.outputs.licenses-backend == 'true'
-    needs: [pick, files-changed]
+    needs: files-changed
     name: Generate Backend License Report
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     permissions:
       contents: write
       pull-requests: write
       repository-projects: write # Required for enabling automerge
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/frontend-validation.yml b/.github/workflows/frontend-validation.yml
index ad689149db..a539a1b7b7 100644
--- a/.github/workflows/frontend-validation.yml
+++ b/.github/workflows/frontend-validation.yml
@@ -11,12 +11,8 @@ permissions:
   pull-requests: write
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   frontend-validation:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/multiOSReleases.yml b/.github/workflows/multiOSReleases.yml
index 69121e1a00..41ddeb7a13 100644
--- a/.github/workflows/multiOSReleases.yml
+++ b/.github/workflows/multiOSReleases.yml
@@ -36,13 +36,9 @@ permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   determine-matrix:
     if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
       version: ${{ steps.versionNumber.outputs.versionNumber }}
@@ -112,10 +108,8 @@ jobs:
           fi
 
   build-jars:
-    needs: [pick, determine-matrix]
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    needs: determine-matrix
+    runs-on: ubuntu-latest
     strategy:
       matrix:
         variant:
@@ -195,7 +189,6 @@ jobs:
       SM_API_KEY: ${{ secrets.SM_API_KEY }}
       WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
       RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -638,8 +631,8 @@ jobs:
           retention-days: 1
 
   collect-and-release:
-    needs: [pick, determine-matrix, build, build-jars]
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    needs: [determine-matrix, build, build-jars]
+    runs-on: ubuntu-latest
     permissions:
       contents: write
     steps:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index eca963c060..4047157a45 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -13,13 +13,9 @@ permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   playwright-all-browsers:
     name: Playwright (chromium + firefox + webkit)
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/swagger.yml b/.github/workflows/swagger.yml
index a546996302..90c5984693 100644
--- a/.github/workflows/swagger.yml
+++ b/.github/workflows/swagger.yml
@@ -22,15 +22,9 @@ permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   push:
     if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
-    env:
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml
index 62cd0667e6..c97ae4eaef 100644
--- a/.github/workflows/tauri-build.yml
+++ b/.github/workflows/tauri-build.yml
@@ -106,7 +106,6 @@ jobs:
       WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
       APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
       RELEASE_GPG_PRIVATE_KEY: ${{ secrets.RELEASE_GPG_PRIVATE_KEY }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
diff --git a/.github/workflows/test-build-docker.yml b/.github/workflows/test-build-docker.yml
index 0c86efd391..f8344da116 100644
--- a/.github/workflows/test-build-docker.yml
+++ b/.github/workflows/test-build-docker.yml
@@ -17,19 +17,11 @@ on:
         required: false
         type: string
         default: "false"
-      depot_cores:
-        description: "Depot runner vCPU count (used in runs-on). Override for benchmarking."
-        required: false
-        type: string
-        default: "8"
 
 permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   # TODO: extract a pre-matrix `prepare` job that runs once and produces
   # shared artifacts for the three matrix entries below to consume:
   #   1. `task backend:build` — currently runs 3× in parallel with
@@ -45,14 +37,7 @@ jobs:
   # spring-security=true matrix entry if `task backend:build` and
   # `task backend:build:ci` produce equivalent JARs (verify before wiring).
   test-build-docker-images:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') || 'ubuntu-latest' }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' && inputs.docker-base-changed != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
@@ -125,16 +110,10 @@ jobs:
           DISABLE_ADDITIONAL_FEATURES: true
           STIRLING_PDF_DESKTOP_UI: false
 
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
       - name: Set up QEMU
-        if: env.USE_DEPOT != 'true'
         uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
       - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
         id: buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
@@ -182,24 +161,10 @@ jobs:
             --tag stirling-pdf-embedded:pr-test \
             .
 
-      - name: Build ${{ matrix.docker-rev }} (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./${{ matrix.docker-rev }}
-          push: false
-          platforms: ${{ steps.build-params.outputs.platforms }}
-          build-args: |
-            BASE_IMAGE=${{ steps.build-params.outputs.base_image }}
-          provenance: true
-          sbom: true
-
-      # Fork PRs that did NOT change the base use the buildx container builder
+      # PRs that did NOT change the base use the buildx container builder
       # (multi-platform + gha cache) against the published base image.
-      - name: Build ${{ matrix.docker-rev }} (Docker fork fallback)
-        if: env.USE_DEPOT != 'true' && inputs.docker-base-changed != 'true'
+      - name: Build ${{ matrix.docker-rev }}
+        if: inputs.docker-base-changed != 'true'
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           builder: ${{ steps.buildx.outputs.name }}
@@ -227,14 +192,7 @@ jobs:
           if-no-files-found: warn
 
   test-build-unoserver-image:
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && format('depot-ubuntu-24.04-{0}', inputs.depot_cores || '8') || 'ubuntu-latest' }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' && inputs.docker-base-changed != 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -244,35 +202,14 @@ jobs:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
       - name: Set up QEMU
-        if: env.USE_DEPOT != 'true'
         uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
       - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
         id: buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
-      - name: Build docker/unoserver/Dockerfile (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/unoserver/Dockerfile
-          push: false
-          load: true
-          platforms: linux/amd64
-          tags: stirling-unoserver:pr-test
-          provenance: false
-          sbom: false
-
-      - name: Build docker/unoserver/Dockerfile (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build docker/unoserver/Dockerfile
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           builder: ${{ steps.buildx.outputs.name }}
diff --git a/.github/workflows/testdriver.yml b/.github/workflows/testdriver.yml
index fdeb964a8c..f86191656f 100644
--- a/.github/workflows/testdriver.yml
+++ b/.github/workflows/testdriver.yml
@@ -20,19 +20,9 @@ permissions:
   contents: read
 
 jobs:
-  pick:
-    uses: ./.github/workflows/_runner-pick.yml
-
   deploy:
     if: ${{ vars.CI_PROFILE != 'lite' }}
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
-    permissions:
-      contents: read
-      id-token: write
-    env:
-      USE_DEPOT: ${{ needs.pick.outputs.use_depot == 'true' }}
-      DEPOT_TOKEN: ${{ secrets.DEPOT_TOKEN }}
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -61,12 +51,7 @@ jobs:
           MAVEN_PUBLIC_URL: ${{ secrets.MAVEN_PUBLIC_URL }}
           DISABLE_ADDITIONAL_FEATURES: true
 
-      - name: Set up Depot CLI
-        if: env.USE_DEPOT == 'true'
-        uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1.0.0
-
       - name: Set up Docker Buildx
-        if: env.USE_DEPOT != 'true'
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
       - name: Get version number
@@ -81,20 +66,7 @@ jobs:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_API }}
 
-      - name: Build and push test image (Depot)
-        if: env.USE_DEPOT == 'true'
-        uses: depot/build-push-action@98e78adca7817480b8185f474a400b451d74e287 # v1.16.0
-        with:
-          project: ${{ vars.DEPOT_PROJECT_ID }}
-          context: .
-          file: ./docker/embedded/Dockerfile
-          push: true
-          tags: ${{ secrets.DOCKER_HUB_USERNAME }}/test:test-${{ github.sha }}
-          build-args: VERSION_TAG=${{ steps.versionNumber.outputs.versionNumber }}
-          platforms: linux/amd64
-
-      - name: Build and push test image (Docker fork fallback)
-        if: env.USE_DEPOT != 'true'
+      - name: Build and push test image
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
@@ -153,8 +125,7 @@ jobs:
   files-changed:
     if: always()
     name: detect what files changed
-    needs: pick
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    runs-on: ubuntu-latest
     timeout-minutes: 3
     outputs:
       frontend: ${{ steps.changes.outputs.frontend }}
@@ -174,8 +145,8 @@ jobs:
 
   test:
     if: needs.files-changed.outputs.frontend == 'true'
-    needs: [pick, deploy, files-changed]
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    needs: [deploy, files-changed]
+    runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
@@ -208,8 +179,8 @@ jobs:
           FORCE_COLOR: "3"
 
   cleanup:
-    needs: [pick, deploy, test]
-    runs-on: ${{ needs.pick.outputs.use_depot == 'true' && 'depot-ubuntu-24.04-4' || 'ubuntu-latest' }}
+    needs: [deploy, test]
+    runs-on: ubuntu-latest
     if: always()
 
     steps:
diff --git a/settings.gradle b/settings.gradle
index aa90b41375..85b1c45207 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -23,31 +23,6 @@ plugins {
     id 'org.gradle.toolchains.foojay-resolver-convention' version '1.0.0'
 }
 
-// Depot remote build cache. Disabled repo-wide via depotCacheEnabled below;
-// flip it back to true to re-enable. Even when enabled it silently no-ops
-// without DEPOT_TOKEN (local dev without depot login, and fork PRs where
-// GitHub hides secrets), so contributors build fine on local cache only.
-buildCache {
-    def depotCacheEnabled = false
-    def depotToken = System.getenv('DEPOT_TOKEN')
-    local {
-        enabled = true
-    }
-    if (depotCacheEnabled && depotToken) {
-        remote(HttpBuildCache) {
-            url = 'https://cache.depot.dev'
-            enabled = true
-            // Only CI runs push to the shared cache; dev laptops pull-only
-            // so a misconfigured local task can't poison everyone else.
-            push = System.getenv('CI') == 'true'
-            credentials {
-                username = ''
-                password = depotToken
-            }
-        }
-    }
-}
-
 rootProject.name = 'Stirling PDF'
 
 // Flavors: core | proprietary (default) | saas.

From 1681b5d2988b062e42d64bca72e102fb4078b781 Mon Sep 17 00:00:00 2001
From: Anthony Stirling <77850077+Frooodle@users.noreply.github.com>
Date: Fri, 24 Jul 2026 11:50:17 +0100
Subject: [PATCH 094/109] Source and connections changes to integrations
 (#7068)

---
 .../public/locales/en-US/translation.toml     |  89 ++-
 frontend/editor/scripts/lint/theme-lint.mjs   |   8 +-
 .../components/sidebarGroups.test.ts          |   1 +
 frontend/editor/src/portal/ViewRouter.tsx     |  10 +-
 .../src/portal/components/BrandMarks.tsx      | 451 ++++++++++++
 .../editor/src/portal/components/icons.tsx    |  11 +
 .../components/pipelines/ToolPicker.tsx       |   6 +-
 .../policies/PolicyExternalApiConfig.tsx      |  11 +-
 .../src/portal/components/sidebarGroups.tsx   |   4 +-
 .../components/sources/ConnectionForm.tsx     |   9 +-
 .../sources/ConnectionModal.test.tsx          |   6 +-
 .../components/sources/ConnectionPicker.tsx   |  34 +-
 .../sources/ConnectionTypePicker.tsx          |  13 +-
 .../sources/ConnectionsTab.test.tsx           |  85 ---
 .../components/sources/ConnectionsTab.tsx     | 223 ------
 .../sources/S3ConnectionPicker.test.tsx       |   7 +-
 .../components/sources/S3ConnectionPicker.tsx |   4 +
 .../portal/components/sources/SourceModal.css | 160 +++++
 .../sources/SourceModal.test.tsx}             | 148 ++--
 .../portal/components/sources/SourceModal.tsx | 659 ++++++++++++++++++
 .../components/sources/SourceTypeIcon.tsx     |  38 +-
 .../components/sources/SourcesTable.tsx       |   5 +-
 .../portal/components/sources/sourceTypes.ts  |  33 +-
 .../src/portal/contexts/ViewContext.tsx       |   3 +
 .../editor/src/portal/views/Integrations.css  | 358 ++++++++++
 .../src/portal/views/Integrations.test.tsx    | 150 ++++
 .../editor/src/portal/views/Integrations.tsx  | 520 ++++++++++++++
 .../src/portal/views/PipelineBuilder.css      |   4 +
 .../src/portal/views/PipelineBuilder.test.tsx |   7 +-
 .../editor/src/portal/views/SourceBuilder.css | 116 ---
 .../editor/src/portal/views/SourceBuilder.tsx | 501 -------------
 frontend/editor/src/portal/views/Sources.css  |  80 +--
 .../editor/src/portal/views/Sources.test.tsx  |  84 ++-
 frontend/editor/src/portal/views/Sources.tsx  | 131 ++--
 frontend/eslint.config.mjs                    |   6 +-
 35 files changed, 2734 insertions(+), 1241 deletions(-)
 create mode 100644 frontend/editor/src/portal/components/BrandMarks.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx
 delete mode 100644 frontend/editor/src/portal/components/sources/ConnectionsTab.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/SourceModal.css
 rename frontend/editor/src/portal/{views/SourceBuilder.test.tsx => components/sources/SourceModal.test.tsx} (62%)
 create mode 100644 frontend/editor/src/portal/components/sources/SourceModal.tsx
 create mode 100644 frontend/editor/src/portal/views/Integrations.css
 create mode 100644 frontend/editor/src/portal/views/Integrations.test.tsx
 create mode 100644 frontend/editor/src/portal/views/Integrations.tsx
 delete mode 100644 frontend/editor/src/portal/views/SourceBuilder.css
 delete mode 100644 frontend/editor/src/portal/views/SourceBuilder.tsx

diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 4c99d2a479..72099ba949 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -6523,12 +6523,8 @@ createTitleFor = "Connect {{name}}"
 delete = "Delete"
 edit = "Edit"
 editTitle = "Edit connection"
-subtitle = "Reusable credentials that sources, pipeline outputs and integration steps connect to."
 unsupportedType = "This connection type cannot be edited here."
 
-[portal.connections.actions]
-new = "New connection"
-
 [portal.connections.categories.advanced]
 description = "For a service we do not support yet."
 label = "Advanced"
@@ -6580,13 +6576,9 @@ label = "Username"
 helperText = "Paste the URL the service gave you. Only paths under it can be called."
 label = "Webhook URL"
 
-[portal.connections.empty]
-description = "Add a connection to reuse the same credentials across sources, pipeline outputs and integration steps."
-title = "No connections yet"
-
 [portal.connections.fields]
 name = "Connection name"
-namePlaceholder = "e.g. Claims bucket"
+namePlaceholder = "e.g. Production"
 
 [portal.connections.picker]
 cancel = "Cancel"
@@ -6601,11 +6593,6 @@ noResultsBody = "We do not support it yet - tell us about it and we will look at
 noResultsTitle = "Nothing matches \"{{query}}\""
 searchPlaceholder = "Search integrations - try \"sign\", \"ocr\" or a product name"
 
-[portal.connections.table]
-detail = "Details"
-name = "Name"
-type = "Type"
-
 [portal.connections.types.api]
 description = "Call any HTTP API from a policy. You choose the URL, authentication and payload."
 label = "Custom API"
@@ -7553,6 +7540,41 @@ models = "Models"
 security = "Security"
 storage = "Storage"
 
+[portal.integrations]
+addAnother = "Add another"
+availableHeading = "Available"
+comingSoonHeading = "Coming soon"
+connect = "Connect"
+connectedHeading = "Connected"
+connectionCount_one = "{{count}} connection"
+connectionCount_other = "{{count}} connections"
+customApi = "Custom API"
+searchPlaceholder = "Search integrations"
+subtitle = "Everything Stirling can talk to. Credentials are created once here, then referenced by sources, policies and pipelines."
+title = "Integrations"
+typedName = "{{tool}} name"
+
+[portal.integrations.filters]
+all = "All"
+audit = "Audit"
+connected = "Connected"
+notify = "Notify"
+security = "Security"
+signing = "Signing"
+storage = "Storage"
+
+[portal.integrations.status]
+connected = "Connected"
+
+[portal.integrations.table]
+integration = "Integration"
+worksWith = "Works with"
+
+[portal.integrations.worksWith]
+pipelines = "Pipelines"
+policies = "Policies"
+sources = "Sources"
+
 [portal.nav]
 agent-builder = "Agent Builder"
 components = "Components"
@@ -7561,6 +7583,7 @@ documents = "Documents"
 editor = "Editor"
 home = "Home"
 infrastructure = "Infrastructure"
+integrations = "Integrations"
 pipelines = "Pipelines"
 policies = "Policies"
 procurement = "Procurement"
@@ -8517,7 +8540,11 @@ connectSource = "Connect source"
 
 [portal.sources.builder]
 back = "Back to sources"
+backToTypes = "All source types"
 cancel = "Cancel"
+chooseHint = "Choose where documents come from. Greyed-out connectors are on the way."
+comingSoon = "Coming soon"
+comingSoonHeading = "Coming soon"
 create = "Create source"
 createTitle = "Connect a source"
 delete = "Delete"
@@ -8556,15 +8583,23 @@ source = "Source"
 status = "Status"
 usedBy = "Policies"
 
-[portal.sources.tabs]
-connections = "Connections"
-sources = "Sources"
+[portal.sources.types.box]
+description = "Pull documents from Box folders your team already shares."
+label = "Box"
+
+[portal.sources.types.dropbox]
+description = "Pull documents from a shared Dropbox folder."
+label = "Dropbox"
 
 [portal.sources.types.editor]
 description = "Documents your team has processed in the editor, across policy and AI runs."
 label = "Editor"
 noPolicies = "No policies run from the editor yet."
 
+[portal.sources.types.email]
+description = "Turn attachments sent to a dedicated mailbox into documents."
+label = "Email inbox"
+
 [portal.sources.types.folder]
 description = "Watch a directory on the server for new documents."
 label = "Folder"
@@ -8596,6 +8631,18 @@ label = "Folder depth"
 all = "Include subfolders"
 top = "Top level only"
 
+[portal.sources.types.googledrive]
+description = "Pull documents from shared Google Drive folders."
+label = "Google Drive"
+
+[portal.sources.types.network]
+description = "Watch an SMB network share for new documents."
+label = "Network drive"
+
+[portal.sources.types.onedrive]
+description = "Watch OneDrive folders for new documents."
+label = "OneDrive"
+
 [portal.sources.types.s3]
 description = "Pull documents from an Amazon S3 or S3-compatible bucket."
 label = "Amazon S3"
@@ -8617,6 +8664,14 @@ helperText = "Only objects whose keys start with this prefix are processed."
 label = "Key prefix"
 placeholder = "incoming/"
 
+[portal.sources.types.sftp]
+description = "Poll an SFTP drop folder for new documents."
+label = "SFTP"
+
+[portal.sources.types.sharepoint]
+description = "Pull documents from SharePoint document libraries."
+label = "SharePoint"
+
 [portal.sources.types.unknown]
 label = "Source"
 
diff --git a/frontend/editor/scripts/lint/theme-lint.mjs b/frontend/editor/scripts/lint/theme-lint.mjs
index 561fd5c1cc..71a9cf07e5 100644
--- a/frontend/editor/scripts/lint/theme-lint.mjs
+++ b/frontend/editor/scripts/lint/theme-lint.mjs
@@ -22,7 +22,6 @@ import { execSync } from "node:child_process";
 import { relative, resolve, join } from "node:path";
 
 const THEME = resolve(process.cwd(), "editor/src/core/theme");
-const PRIMITIVES = "editor/src/core/theme/primitives.css";
 
 // Fixed list of theme CSS files to check, so every read takes a constant path
 // (no directory-listing feeding into a file read). readdir is used only to fail
@@ -331,7 +330,10 @@ function check() {
 
   for (const name of THEME_FILES) {
     const rel = relative(process.cwd(), join(THEME, name));
-    const isPrimitives = rel === PRIMITIVES;
+    // Compare by basename, not the full relative path: on Windows `relative`
+    // yields backslashes, so a forward-slash path constant never matched and
+    // primitives.css was wrongly linted as a non-primitive file.
+    const isPrimitives = name === "primitives.css";
     const text = stripComments(readFileSync(join(THEME, name), "utf8"));
 
     for (const re of [HEX_RE, FUNC_RE]) {
@@ -622,7 +624,7 @@ const CODE_EXEMPT_PATH = [
   /\/viewer\/|Annotation|useViewerReadAloud|CommentsSidebar|\/constants\/search\.ts$|SignaturePreview/,
   /ColorPicker|ColorControl|WatchedFolderManagementModal|watchedFolderPresets|fileColors|unifiedBackground|folder\.ts$|policyFolders/,
   /OAuthButtons|oauthCallbackHtml/,
-  /mantineTheme|\/theme\.ts$|toolsTaxonomy|LayoutPreview|PageNumberPreview|CloudStorageIcons/,
+  /mantineTheme|\/theme\.ts$|toolsTaxonomy|LayoutPreview|PageNumberPreview|CloudStorageIcons|BrandMarks/,
   /\/onboarding\//,
   /addStamp|addWatermark|\/tooltips\//,
   /UpgradeBanner|AdminPlanSection/,
diff --git a/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts b/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts
index aaec0024f1..547f11351b 100644
--- a/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts
+++ b/frontend/editor/src/portal-saas/components/sidebarGroups.test.ts
@@ -19,6 +19,7 @@ describe("sidebarGroups (SaaS)", () => {
   it("inherits the platform group unchanged from base", () => {
     expect(GROUP_PLATFORM.map((e) => e.id)).toEqual([
       "users",
+      "integrations",
       "infrastructure",
       "usage",
       "docs",
diff --git a/frontend/editor/src/portal/ViewRouter.tsx b/frontend/editor/src/portal/ViewRouter.tsx
index 67b7c146a9..76adc1ad1d 100644
--- a/frontend/editor/src/portal/ViewRouter.tsx
+++ b/frontend/editor/src/portal/ViewRouter.tsx
@@ -6,7 +6,7 @@ import { Documents } from "@portal/views/Documents";
 import { Pipelines } from "@portal/views/Pipelines";
 import { PipelineBuilder } from "@portal/views/PipelineBuilder";
 import { Sources } from "@portal/views/Sources";
-import { SourceBuilder } from "@portal/views/SourceBuilder";
+import { Integrations } from "@portal/views/Integrations";
 import { Policies } from "@portal/views/Policies";
 import { EditorAdmin } from "@portal/views/EditorAdmin";
 import { Infrastructure } from "@portal/views/Infrastructure";
@@ -42,14 +42,18 @@ export function ViewRouter() {
         element={<PipelineBuilder />}
       />
       <Route path={rel(VIEW_PATHS.sources)} element={<Sources />} />
+      {/* Source create/edit is a modal on the list now; old deep links land there. */}
       <Route
         path={`${rel(VIEW_PATHS.sources)}/new`}
-        element={<SourceBuilder />}
+        element={
+          <Navigate to={`${toPortalPath(VIEW_PATHS.sources)}?new=1`} replace />
+        }
       />
       <Route
         path={`${rel(VIEW_PATHS.sources)}/:id`}
-        element={<SourceBuilder />}
+        element={<Navigate to={toPortalPath(VIEW_PATHS.sources)} replace />}
       />
+      <Route path={rel(VIEW_PATHS.integrations)} element={<Integrations />} />
       <Route path={rel(VIEW_PATHS.policies)} element={<Policies />} />
       <Route path={rel(VIEW_PATHS.documents)} element={<Documents />} />
       <Route path={rel(VIEW_PATHS.editor)} element={<EditorAdmin />} />
diff --git a/frontend/editor/src/portal/components/BrandMarks.tsx b/frontend/editor/src/portal/components/BrandMarks.tsx
new file mode 100644
index 0000000000..04f1d79e83
--- /dev/null
+++ b/frontend/editor/src/portal/components/BrandMarks.tsx
@@ -0,0 +1,451 @@
+import type { CSSProperties, ReactNode } from "react";
+import {
+  DropboxIcon,
+  GoogleDriveIcon,
+  OneDriveIcon,
+} from "@app/components/shared/CloudStorageIcons";
+
+/**
+ * Full-colour brand marks for the integrations catalogue and source connectors,
+ * drawn on a transparent 24x24 canvas (no tinted badge behind them). Vendors
+ * with a recognisable mark get their brand geometry and colours; self-hosted or
+ * generic entries render neutral currentColor strokes so they follow the theme.
+ * Path-exempt from theme-lint's code-colors gate (brand hexes are the point).
+ */
+
+interface MarkProps {
+  size?: number;
+  className?: string;
+  style?: CSSProperties;
+}
+
+function Fill({
+  size = 20,
+  className,
+  style,
+  children,
+  viewBox = "0 0 24 24",
+}: MarkProps & { children: ReactNode; viewBox?: string }) {
+  return (
+    <svg
+      viewBox={viewBox}
+      width={size}
+      height={size}
+      className={className}
+      style={style}
+      aria-hidden
+    >
+      {children}
+    </svg>
+  );
+}
+
+function Stroke({
+  size = 20,
+  className,
+  style,
+  children,
+}: MarkProps & { children: ReactNode }) {
+  return (
+    <svg
+      viewBox="0 0 24 24"
+      width={size}
+      height={size}
+      className={className}
+      style={style}
+      fill="none"
+      stroke="currentColor"
+      strokeWidth="1.7"
+      strokeLinecap="round"
+      strokeLinejoin="round"
+      aria-hidden
+    >
+      {children}
+    </svg>
+  );
+}
+
+/** Brand-coloured marks, keyed by connection-type/source-type id. */
+const BRAND: Record<string, (p: MarkProps) => ReactNode> = {
+  s3: (p) => (
+    <Fill {...p}>
+      <path
+        d="M5.2 4.5c0-1.2 3-2.1 6.8-2.1s6.8.9 6.8 2.1l-1.5 14.6c-.1 1.5-2.4 2.7-5.3 2.7s-5.2-1.2-5.3-2.7z"
+        fill="#E25444"
+      />
+      <ellipse cx="12" cy="4.5" rx="6.8" ry="2.1" fill="#F2B0AA" />
+      <ellipse cx="12" cy="4.7" rx="4.6" ry="1.2" fill="#B8352A" />
+    </Fill>
+  ),
+  sharepoint: (p) => (
+    <Fill {...p}>
+      <circle cx="10" cy="8.6" r="5.6" fill="#036C70" />
+      <circle cx="15.4" cy="13.4" r="4.9" fill="#1A9BA1" />
+      <circle cx="9.8" cy="17.2" r="4" fill="#37C6D0" />
+    </Fill>
+  ),
+  purview: (p) => (
+    <Fill {...p}>
+      <path d="M12 2.6 21.4 12 12 21.4 2.6 12z" fill="#1490DF" />
+      <path d="M12 2.6 21.4 12H12z" fill="#28A8EA" />
+      <path d="M12 12v9.4L2.6 12z" fill="#0F6CBD" />
+    </Fill>
+  ),
+  box: (p) => (
+    <Fill {...p}>
+      <rect x="2" y="2" width="20" height="20" rx="4.5" fill="#0061D5" />
+      <path
+        d="M8 6.5v11"
+        stroke="#fff"
+        strokeWidth="2.1"
+        strokeLinecap="round"
+      />
+      <circle
+        cx="12.6"
+        cy="13.3"
+        r="4.1"
+        fill="none"
+        stroke="#fff"
+        strokeWidth="2.1"
+      />
+    </Fill>
+  ),
+  slack: (p) => (
+    <Fill {...p}>
+      <rect x="9.6" y="2.2" width="3.4" height="8" rx="1.7" fill="#36C5F0" />
+      <circle cx="5.8" cy="8.5" r="1.7" fill="#36C5F0" />
+      <rect x="13.8" y="9.6" width="8" height="3.4" rx="1.7" fill="#2EB67D" />
+      <circle cx="15.5" cy="5.8" r="1.7" fill="#2EB67D" />
+      <rect x="11" y="13.8" width="3.4" height="8" rx="1.7" fill="#ECB22E" />
+      <circle cx="18.2" cy="15.5" r="1.7" fill="#ECB22E" />
+      <rect x="2.2" y="11" width="8" height="3.4" rx="1.7" fill="#E01E5A" />
+      <circle cx="8.5" cy="18.2" r="1.7" fill="#E01E5A" />
+    </Fill>
+  ),
+  teams: (p) => (
+    <Fill {...p}>
+      <rect x="2.5" y="2.5" width="19" height="19" rx="4.5" fill="#6264A7" />
+      <path
+        d="M7.2 9h7v2.2h-2.3v6.6h-2.4v-6.6H7.2z"
+        fill="#fff"
+        transform="translate(1.3 -0.4)"
+      />
+    </Fill>
+  ),
+  discord: (p) => (
+    <Fill {...p}>
+      <path
+        d="M5.6 5.6C7.6 4.6 9.8 4.1 12 4.1s4.4.5 6.4 1.5c1.5 3 2 6.1 1.6 9.4-1.5 1.6-3.4 2.7-5.3 3.2l-1.1-2.2h-3.2l-1.1 2.2c-1.9-.5-3.8-1.6-5.3-3.2-.4-3.3.1-6.4 1.6-9.4z"
+        fill="#5865F2"
+      />
+      <ellipse cx="9.2" cy="11.6" rx="1.35" ry="1.5" fill="#fff" />
+      <ellipse cx="14.8" cy="11.6" rx="1.35" ry="1.5" fill="#fff" />
+    </Fill>
+  ),
+  googlechat: (p) => (
+    <Fill {...p}>
+      <path
+        d="M4.5 2.5h13a2.5 2.5 0 0 1 2.5 2.5v16.5l-4.4-4H4.5A2.5 2.5 0 0 1 2 15V5a2.5 2.5 0 0 1 2.5-2.5z"
+        fill="#00AC47"
+      />
+      <path
+        d="M7 8.4h10M7 12.1h6.5"
+        stroke="#fff"
+        strokeWidth="1.8"
+        strokeLinecap="round"
+      />
+    </Fill>
+  ),
+  zapier: (p) => (
+    <Fill {...p}>
+      <g fill="#FF4F00">
+        <rect x="10.6" y="2.5" width="2.8" height="19" rx="1.4" />
+        <rect
+          x="10.6"
+          y="2.5"
+          width="2.8"
+          height="19"
+          rx="1.4"
+          transform="rotate(90 12 12)"
+        />
+        <rect
+          x="10.6"
+          y="2.5"
+          width="2.8"
+          height="19"
+          rx="1.4"
+          transform="rotate(45 12 12)"
+        />
+        <rect
+          x="10.6"
+          y="2.5"
+          width="2.8"
+          height="19"
+          rx="1.4"
+          transform="rotate(135 12 12)"
+        />
+      </g>
+      <circle cx="12" cy="12" r="2.6" fill="#FF4F00" />
+    </Fill>
+  ),
+  jira: (p) => (
+    <Fill {...p}>
+      <path
+        d="M12 2.4 17 7.4a1.6 1.6 0 0 1 0 2.3L12 14.6 7 9.7a1.6 1.6 0 0 1 0-2.3z"
+        fill="#2684FF"
+      />
+      <path
+        d="M12 9.4 17 14.3a1.6 1.6 0 0 1 0 2.3L12 21.6 7 16.6a1.6 1.6 0 0 1 0-2.3z"
+        fill="#0052CC"
+      />
+    </Fill>
+  ),
+  confluence: (p) => (
+    <Fill {...p}>
+      <path
+        d="M3 16.2c2.7-4.3 5.5-5.9 8.7-4.8 2.1.7 3.8 2.1 7.2 2.7l-1.6 4.4c-3.9-.7-5.9-2.2-7.6-2.8-1.7-.5-3.1.1-4.8 2.6z"
+        fill="#2684FF"
+      />
+      <path
+        d="M21 7.8c-2.7 4.3-5.5 5.9-8.7 4.8-2.1-.7-3.8-2.1-7.2-2.7l1.6-4.4c3.9.7 5.9 2.2 7.6 2.8 1.7.5 3.1-.1 4.8-2.6z"
+        fill="#0052CC"
+      />
+    </Fill>
+  ),
+  nextcloud: (p) => (
+    <Fill {...p}>
+      <g fill="none" stroke="#0082C9" strokeWidth="2">
+        <circle cx="4.9" cy="12" r="2.1" />
+        <circle cx="12" cy="12" r="3.4" />
+        <circle cx="19.1" cy="12" r="2.1" />
+      </g>
+    </Fill>
+  ),
+  splunk: (p) => (
+    <Fill {...p}>
+      <path d="M6 4.8 18.4 12 6 19.2v-3.4l7-3.8-7-3.8z" fill="#65A637" />
+    </Fill>
+  ),
+  elastic: (p) => (
+    <Fill {...p}>
+      <path
+        d="M4.6 9.3C6.8 5.6 10.9 3.7 15 4.5c2.9.6 5 2.4 5.8 4.8H4.6z"
+        fill="#FEC514"
+      />
+      <rect
+        x="3.4"
+        y="10.4"
+        width="17.2"
+        height="3.2"
+        rx="1.6"
+        fill="#00BFB3"
+      />
+      <path
+        d="M4.6 14.7h16.2c-.8 2.4-2.9 4.2-5.8 4.8-4.1.8-8.2-1.1-10.4-4.8z"
+        fill="#1BA9F5"
+      />
+    </Fill>
+  ),
+  sumologic: (p) => (
+    <Fill {...p}>
+      <rect x="2.5" y="2.5" width="19" height="19" rx="4.5" fill="#000099" />
+      <path
+        d="M6.5 9.5c1.8-1.4 3.7-1.4 5.5 0s3.7 1.4 5.5 0M6.5 14.5c1.8-1.4 3.7-1.4 5.5 0s3.7 1.4 5.5 0"
+        stroke="#fff"
+        strokeWidth="1.7"
+        strokeLinecap="round"
+        fill="none"
+      />
+    </Fill>
+  ),
+  sendgrid: (p) => (
+    <Fill {...p}>
+      <rect x="3" y="3" width="6" height="6" fill="#51A9E3" />
+      <rect x="9" y="3" width="6" height="6" fill="#1A82E2" />
+      <rect x="15" y="3" width="6" height="6" fill="#51A9E3" />
+      <rect x="3" y="9" width="6" height="6" fill="#1A82E2" />
+      <rect x="9" y="9" width="6" height="6" fill="#51A9E3" />
+      <rect x="15" y="9" width="6" height="6" fill="#1A82E2" />
+      <rect x="3" y="15" width="6" height="6" fill="#51A9E3" />
+      <rect x="9" y="15" width="6" height="6" fill="#1A82E2" />
+    </Fill>
+  ),
+  mailgun: (p) => (
+    <Fill {...p}>
+      <circle cx="12" cy="12" r="9.5" fill="#ED413E" />
+      <circle cx="12" cy="12" r="5.2" fill="#fff" />
+      <circle cx="12" cy="12" r="2.2" fill="#ED413E" />
+      <circle cx="17.8" cy="12" r="1.3" fill="#ED413E" />
+    </Fill>
+  ),
+  cloudmersive: (p) => (
+    <Fill {...p}>
+      <rect x="2.5" y="2.5" width="19" height="19" rx="4.5" fill="#D64541" />
+      <path
+        d="M15.8 8.6a4.9 4.9 0 1 0 0 6.8"
+        fill="none"
+        stroke="#fff"
+        strokeWidth="2.2"
+        strokeLinecap="round"
+      />
+    </Fill>
+  ),
+  cloudmersiveadvanced: (p) => (
+    <Fill {...p}>
+      <rect x="2.5" y="2.5" width="19" height="19" rx="4.5" fill="#B03A37" />
+      <path
+        d="M15.8 8.6a4.9 4.9 0 1 0 0 6.8"
+        fill="none"
+        stroke="#fff"
+        strokeWidth="2.2"
+        strokeLinecap="round"
+      />
+      <circle cx="16.9" cy="12" r="1.4" fill="#fff" />
+    </Fill>
+  ),
+  presidio: (p) => (
+    <Fill {...p}>
+      <rect x="2.5" y="2.5" width="19" height="19" rx="4.5" fill="#6B4EE6" />
+      <path
+        d="M12 6.2l4.6 2v3.2c0 3-1.9 5-4.6 6.1-2.7-1.1-4.6-3.1-4.6-6.1V8.2z"
+        fill="none"
+        stroke="#fff"
+        strokeWidth="1.7"
+        strokeLinejoin="round"
+      />
+      <circle cx="12" cy="11.2" r="1.1" fill="#fff" />
+    </Fill>
+  ),
+  clamav: (p) => (
+    <Fill {...p}>
+      <path
+        d="M12 2.8l7.2 3v5.1c0 4.5-3 7.6-7.2 9.3-4.2-1.7-7.2-4.8-7.2-9.3V5.8z"
+        fill="#3E8E9E"
+      />
+      <path
+        d="m8.9 11.7 2.2 2.2 4-4"
+        fill="none"
+        stroke="#fff"
+        strokeWidth="2"
+        strokeLinecap="round"
+        strokeLinejoin="round"
+      />
+    </Fill>
+  ),
+  consigno: (p) => (
+    <Fill {...p}>
+      <path
+        d="M16.1 3.3a2.35 2.35 0 0 1 3.3 3.3L8.2 17.8 3.6 19l1.2-4.6z"
+        fill="#1B2A4A"
+      />
+      <path
+        d="M12.5 20.4c2.4-1.3 4.2-1.3 6.6 0"
+        fill="none"
+        stroke="#C33E37"
+        strokeWidth="1.8"
+        strokeLinecap="round"
+      />
+    </Fill>
+  ),
+};
+
+/** Neutral currentColor strokes for generic / self-hosted / roadmap entries. */
+const NEUTRAL: Record<string, ReactNode> = {
+  folder: (
+    <path d="M3 7a2 2 0 0 1 2-2h4l2 2h6a2 2 0 0 1 2 2v7a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2z" />
+  ),
+  webhook: <polyline points="13 2 3 14 12 14 11 22 21 10 12 10 13 2" />,
+  editor: (
+    <>
+      <path d="M12 20h9" />
+      <path d="M16.5 3.5a2.12 2.12 0 0 1 3 3L7 19l-4 1 1-4z" />
+    </>
+  ),
+  api: (
+    <>
+      <path d="M8.5 4C6.5 4 6 5 6 6.5v2.3C6 10.4 5.4 11.2 4 11.5v1c1.4.3 2 1.1 2 2.7v2.3C6 19 6.5 20 8.5 20" />
+      <path d="M15.5 4c2 0 2.5 1 2.5 2.5v2.3c0 1.6.6 2.4 2 2.7v1c-1.4.3-2 1.1-2 2.7v2.3c0 1.5-.5 2.5-2.5 2.5" />
+    </>
+  ),
+  network: (
+    <>
+      <rect x="2.5" y="4.5" width="9" height="7" rx="1" />
+      <rect x="12.5" y="12.5" width="9" height="7" rx="1" />
+      <path d="M7 11.5V16h5.5" />
+    </>
+  ),
+  sftp: (
+    <>
+      <rect x="4" y="13" width="16" height="7" rx="1.5" />
+      <path d="M7.5 16.5h.01" />
+      <path d="M11 16.5h.01" />
+      <path d="M12 10V3.5" />
+      <path d="m8.5 6.5 3.5-3 3.5 3" />
+    </>
+  ),
+  email: (
+    <>
+      <path d="M21 12.5V18a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-5.5" />
+      <path d="M3 12.5h5l2 3h4l2-3h5" />
+      <path d="M12 3v6.5" />
+      <path d="m9 7 3 3 3-3" />
+    </>
+  ),
+  _default: (
+    <>
+      <path d="M9 7V3.5" />
+      <path d="M15 7V3.5" />
+      <path d="M6.5 7h11v3.5a5.5 5.5 0 0 1-11 0z" />
+      <path d="M12 16v4.5" />
+    </>
+  ),
+};
+
+/** One mark for any integration/source id; unknown ids get a neutral plug. */
+export function BrandMark({
+  id,
+  size = 20,
+  className,
+  style,
+}: MarkProps & { id: string }) {
+  if (id === "googledrive") {
+    return (
+      <GoogleDriveIcon
+        colored
+        width={size}
+        height={size}
+        className={className}
+        style={style}
+      />
+    );
+  }
+  if (id === "onedrive") {
+    return (
+      <OneDriveIcon
+        colored
+        width={size}
+        height={size}
+        className={className}
+        style={style}
+      />
+    );
+  }
+  if (id === "dropbox") {
+    return (
+      <DropboxIcon
+        colored
+        width={size}
+        height={size}
+        className={className}
+        style={style}
+      />
+    );
+  }
+  const brand = BRAND[id];
+  if (brand) return <>{brand({ size, className, style })}</>;
+  return (
+    <Stroke size={size} className={className} style={style}>
+      {NEUTRAL[id] ?? NEUTRAL._default}
+    </Stroke>
+  );
+}
diff --git a/frontend/editor/src/portal/components/icons.tsx b/frontend/editor/src/portal/components/icons.tsx
index ac0eb49142..5467995efc 100644
--- a/frontend/editor/src/portal/components/icons.tsx
+++ b/frontend/editor/src/portal/components/icons.tsx
@@ -289,3 +289,14 @@ export function ExternalLinkIcon(props: IconProps) {
     </Svg>
   );
 }
+
+export function IntegrationsIcon(props: IconProps) {
+  return (
+    <Svg {...props}>
+      <path d="M9 7V2.5" />
+      <path d="M15 7V2.5" />
+      <path d="M6.5 7h11v3.5a5.5 5.5 0 0 1-11 0z" />
+      <path d="M12 16v2a3 3 0 0 1-3 3H7" />
+    </Svg>
+  );
+}
diff --git a/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx b/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx
index 0c531a6874..99395a0ffe 100644
--- a/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx
+++ b/frontend/editor/src/portal/components/pipelines/ToolPicker.tsx
@@ -11,6 +11,7 @@ import {
   searchOperations,
   type StepOperation,
 } from "@portal/components/policies/stepOperations";
+import { BrandMark } from "@portal/components/BrandMarks";
 
 interface ToolPickerProps {
   tools: ExecutableTool[];
@@ -137,7 +138,10 @@ export function ToolPicker({
                     className="portal-pipelines__picker-icon"
                     aria-hidden="true"
                   >
-                    {t(op.labelKey).slice(0, 1)}
+                    <BrandMark
+                      id={op.custom ? "api" : op.connectionTypeId}
+                      size={17}
+                    />
                   </span>
                 }
               >
diff --git a/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx b/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx
index 9299f26071..76869bb77a 100644
--- a/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx
+++ b/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.tsx
@@ -9,6 +9,7 @@ import {
   CONNECTION_CATEGORIES,
   type ConnectionCategory,
 } from "@portal/components/sources/connectionTypes";
+import { BrandMark } from "@portal/components/BrandMarks";
 import {
   STEP_OPERATIONS,
   buildStepParameters,
@@ -262,11 +263,11 @@ function OperationGrid({
             }
             onClick={() => onPick(op)}
           >
-            <span
-              className={`portal-conn-picker__mark portal-conn-picker__mark--${op.category}`}
-              aria-hidden
-            >
-              {label.slice(0, 1)}
+            <span className="portal-conn-picker__mark" aria-hidden>
+              <BrandMark
+                id={op.custom ? "api" : op.connectionTypeId}
+                size={20}
+              />
             </span>
             <span className="portal-conn-picker__card-text">
               <span className="portal-conn-picker__card-name">{label}</span>
diff --git a/frontend/editor/src/portal/components/sidebarGroups.tsx b/frontend/editor/src/portal/components/sidebarGroups.tsx
index 7b461cb057..f56b54495a 100644
--- a/frontend/editor/src/portal/components/sidebarGroups.tsx
+++ b/frontend/editor/src/portal/components/sidebarGroups.tsx
@@ -4,6 +4,7 @@ import {
   HomeIcon,
   UsersIcon,
   SourcesIcon,
+  IntegrationsIcon,
   PoliciesIcon,
   PipelinesIcon,
   DocumentsIcon,
@@ -37,9 +38,10 @@ export const GROUP_PROCESSOR: NavEntry[] = [
   { id: "documents", icon: <DocumentsIcon /> },
 ];
 
-// The wider platform around the processor: people, infra, billing, docs.
+// The wider platform around the processor: people, connections, infra, billing, docs.
 export const GROUP_PLATFORM: NavEntry[] = [
   { id: "users", icon: <UsersIcon /> },
+  { id: "integrations", icon: <IntegrationsIcon /> },
   { id: "infrastructure", icon: <InfrastructureIcon /> },
   { id: "usage", icon: <UsageIcon /> },
   { id: "docs", icon: <DocsIcon /> },
diff --git a/frontend/editor/src/portal/components/sources/ConnectionForm.tsx b/frontend/editor/src/portal/components/sources/ConnectionForm.tsx
index a6cd42da89..79d6883bdb 100644
--- a/frontend/editor/src/portal/components/sources/ConnectionForm.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectionForm.tsx
@@ -31,7 +31,14 @@ export function ConnectionForm({
 
   return (
     <div className="portal-sources__connection-form">
-      <FormField label={t("portal.connections.fields.name")} required>
+      {/* "S3 storage name", "Jira name": the vendor is in the label, so the
+          field explains itself and the placeholder stays a neutral example. */}
+      <FormField
+        label={t("portal.integrations.typedName", {
+          tool: t(type.labelKey),
+        })}
+        required
+      >
         <Input
           value={values.name ?? ""}
           placeholder={t("portal.connections.fields.namePlaceholder")}
diff --git a/frontend/editor/src/portal/components/sources/ConnectionModal.test.tsx b/frontend/editor/src/portal/components/sources/ConnectionModal.test.tsx
index c1a152ab8d..4938b05b39 100644
--- a/frontend/editor/src/portal/components/sources/ConnectionModal.test.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectionModal.test.tsx
@@ -49,7 +49,7 @@ describe("ConnectionModal", () => {
       ),
     );
 
-    await fill("portal.connections.fields.name", "Corp Purview");
+    await fill("portal.integrations.typedName", "Corp Purview");
     await fill(
       "portal.connections.types.purview.fields.tenantId",
       "cb46c030-1825-4e81-a295-151c039dbf02",
@@ -82,7 +82,7 @@ describe("ConnectionModal", () => {
       ),
     );
 
-    await fill("portal.connections.fields.name", "Notarius");
+    await fill("portal.integrations.typedName", "Notarius");
     await fill(
       "portal.connections.types.consigno.fields.baseUrl",
       "https://acme.consignocloud.com/api/v1",
@@ -163,7 +163,7 @@ describe("ConnectionModal", () => {
     const save = screen.getByText("portal.connections.picker.save");
     expect(save.closest("button")).toBeDisabled();
 
-    await fill("portal.connections.fields.name", "Corp");
+    await fill("portal.integrations.typedName", "Corp");
     // Name alone is not enough: Purview needs a tenant id.
     expect(save.closest("button")).toBeDisabled();
   });
diff --git a/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx b/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx
index be54916726..9e7f4dc143 100644
--- a/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectionPicker.tsx
@@ -33,6 +33,13 @@ interface ConnectionPickerProps {
    * connection, which can point anywhere and so fits any API operation.
    */
   presetId?: string;
+  /**
+   * When the picker already sits inside a modal, stacking the shared connection
+   * modal on top reads badly. A host that can offer its own create surface (the
+   * source modal swaps to a connection stage) passes this; "New connection..."
+   * then delegates instead of opening the nested modal.
+   */
+  onCreateNew?: () => void;
 }
 
 export function ConnectionPicker({
@@ -41,6 +48,7 @@ export function ConnectionPicker({
   integrationType,
   createTypeId,
   presetId,
+  onCreateNew,
 }: ConnectionPickerProps) {
   const { t } = useTranslation();
   const [connections, setConnections] = useState<IntegrationConfig[] | null>(
@@ -85,19 +93,25 @@ export function ConnectionPicker({
         }))}
         onChange={(selected) => onChange(selected ?? "")}
       />
-      <Button variant="tertiary" size="sm" onClick={() => setModalOpen(true)}>
+      <Button
+        variant="tertiary"
+        size="sm"
+        onClick={() => (onCreateNew ? onCreateNew() : setModalOpen(true))}
+      >
         {t("portal.connections.picker.createNew")}
       </Button>
       {error && <Banner tone="danger" description={error} />}
-      <ConnectionModal
-        open={modalOpen}
-        fixedTypeId={createTypeId}
-        onClose={() => setModalOpen(false)}
-        onSaved={(created) => {
-          setConnections((list) => [...(list ?? []), created]);
-          onChange(String(created.id));
-        }}
-      />
+      {!onCreateNew && (
+        <ConnectionModal
+          open={modalOpen}
+          fixedTypeId={createTypeId}
+          onClose={() => setModalOpen(false)}
+          onSaved={(created) => {
+            setConnections((list) => [...(list ?? []), created]);
+            onChange(String(created.id));
+          }}
+        />
+      )}
     </div>
   );
 }
diff --git a/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx b/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx
index 7d1ea67fa9..b652626d96 100644
--- a/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx
+++ b/frontend/editor/src/portal/components/sources/ConnectionTypePicker.tsx
@@ -7,6 +7,7 @@ import {
   type ConnectionCategory,
   type CreatableConnectionType,
 } from "@portal/components/sources/connectionTypes";
+import { BrandMark } from "@portal/components/BrandMarks";
 
 /**
  * Choose what to connect to.
@@ -118,15 +119,9 @@ function Grid({
             }
             onClick={() => onPick(type)}
           >
-            {/* A monogram rather than a logo: no third-party assets to ship, licence or keep
-                current, and it still gives each card something to recognise at a glance. Tinted
-                by category so the colour still carries meaning while searching, when the section
-                headings that would otherwise group them are gone. */}
-            <span
-              className={`portal-conn-picker__mark portal-conn-picker__mark--${type.category}`}
-              aria-hidden
-            >
-              {label.slice(0, 1)}
+            {/* The vendor's real mark, full colour on the card surface. */}
+            <span className="portal-conn-picker__mark" aria-hidden>
+              <BrandMark id={type.id} size={20} />
             </span>
             <span className="portal-conn-picker__card-text">
               <span className="portal-conn-picker__card-name">{label}</span>
diff --git a/frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx b/frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx
deleted file mode 100644
index 157a674e5c..0000000000
--- a/frontend/editor/src/portal/components/sources/ConnectionsTab.test.tsx
+++ /dev/null
@@ -1,85 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import {
-  fireEvent,
-  render as baseRender,
-  screen,
-  waitFor,
-} from "@testing-library/react";
-import { MantineProvider } from "@mantine/core";
-import { HttpError } from "@portal/api/http";
-import { ConnectionsTab } from "@portal/components/sources/ConnectionsTab";
-import type { IntegrationConfig } from "@portal/api/integrations";
-
-const render = (ui: Parameters<typeof baseRender>[0]) =>
-  baseRender(ui, { wrapper: MantineProvider });
-
-vi.mock("react-i18next", () => ({
-  useTranslation: () => ({
-    t: (key: string) => key,
-    i18n: { changeLanguage: vi.fn() },
-  }),
-}));
-
-const fetchS3Connections = vi.fn();
-const deleteIntegration = vi.fn();
-vi.mock("@portal/api/integrations", () => ({
-  fetchIntegrations: () => fetchS3Connections(),
-  // Custom-API authoring is a server decision; these tests assert the default view.
-  fetchIntegrationCapabilities: () => Promise.resolve({ customApi: false }),
-  fetchS3Connections: () => fetchS3Connections(),
-  deleteIntegration: (id: number) => deleteIntegration(id),
-  createIntegration: vi.fn(),
-  updateIntegration: vi.fn(),
-}));
-
-const CONNECTION = {
-  id: 5,
-  integrationType: "S3",
-  name: "Claims bucket",
-  config: { bucket: "inbox", region: "us-east-1" },
-  canManage: true,
-} as unknown as IntegrationConfig;
-
-describe("ConnectionsTab", () => {
-  beforeEach(() => {
-    fetchS3Connections.mockReset();
-    deleteIntegration.mockReset();
-    deleteIntegration.mockResolvedValue(undefined);
-  });
-
-  it("shows the empty state when there are no connections", async () => {
-    fetchS3Connections.mockResolvedValue([]);
-    render(<ConnectionsTab />);
-    expect(
-      await screen.findByText("portal.connections.empty.title"),
-    ).toBeInTheDocument();
-  });
-
-  it("lists connections and deletes one", async () => {
-    fetchS3Connections.mockResolvedValueOnce([CONNECTION]);
-    fetchS3Connections.mockResolvedValueOnce([]);
-    render(<ConnectionsTab />);
-
-    expect(await screen.findByText("Claims bucket")).toBeInTheDocument();
-    fireEvent.click(screen.getByText("portal.connections.delete"));
-    await waitFor(() => expect(deleteIntegration).toHaveBeenCalledWith(5));
-  });
-
-  it("surfaces the 409 when deleting a connection still in use", async () => {
-    fetchS3Connections.mockResolvedValue([CONNECTION]);
-    deleteIntegration.mockRejectedValue(
-      new HttpError(409, "Conflict", {
-        detail: "Integration is in use by: source 'Claims intake'",
-      }),
-    );
-    render(<ConnectionsTab />);
-
-    await screen.findByText("Claims bucket");
-    fireEvent.click(screen.getByText("portal.connections.delete"));
-    expect(
-      await screen.findByText(
-        "Integration is in use by: source 'Claims intake'",
-      ),
-    ).toBeInTheDocument();
-  });
-});
diff --git a/frontend/editor/src/portal/components/sources/ConnectionsTab.tsx b/frontend/editor/src/portal/components/sources/ConnectionsTab.tsx
deleted file mode 100644
index c249afcbae..0000000000
--- a/frontend/editor/src/portal/components/sources/ConnectionsTab.tsx
+++ /dev/null
@@ -1,223 +0,0 @@
-import { useCallback, useEffect, useMemo, useState } from "react";
-import { useTranslation } from "react-i18next";
-import AddRoundedIcon from "@mui/icons-material/AddRounded";
-import {
-  Banner,
-  Button,
-  EmptyState,
-  Skeleton,
-  Table,
-  type TableColumn,
-} from "@app/ui";
-import { errorMessage } from "@portal/api/http";
-import {
-  deleteIntegration,
-  fetchIntegrationCapabilities,
-  fetchIntegrations,
-  type IntegrationCapabilities,
-  type IntegrationConfig,
-} from "@portal/api/integrations";
-import { SourcesIcon } from "@portal/components/icons";
-import { ConnectionModal } from "@portal/components/sources/ConnectionModal";
-import { connectionTypeOf } from "@portal/components/sources/connectionTypes";
-
-/**
- * The Connections tab of the Sources page: the stored connections that sources, pipeline outputs
- * and integration steps reference by id — S3, Purview, ConsignO, and admin-authored custom APIs.
- * Create/edit go through the shared {@link ConnectionModal}; deleting one the backend still
- * references returns a 409, surfaced inline.
- */
-export function ConnectionsTab() {
-  const { t } = useTranslation();
-  const [connections, setConnections] = useState<IntegrationConfig[] | null>(
-    null,
-  );
-  const [modalOpen, setModalOpen] = useState(false);
-  const [editing, setEditing] = useState<IntegrationConfig | null>(null);
-  const [busy, setBusy] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const [capabilities, setCapabilities] = useState<
-    IntegrationCapabilities | undefined
-  >(undefined);
-
-  const refresh = useCallback(async () => {
-    try {
-      setConnections(await fetchIntegrations());
-    } catch (e) {
-      setError(errorMessage(e));
-    }
-  }, []);
-
-  useEffect(() => {
-    void refresh();
-  }, [refresh]);
-
-  // What this caller may author. Left undefined on failure, which withholds the custom-API
-  // option rather than offering something the backend would refuse.
-  useEffect(() => {
-    fetchIntegrationCapabilities().then(setCapabilities, () => undefined);
-  }, []);
-
-  function openCreate() {
-    setEditing(null);
-    setModalOpen(true);
-  }
-
-  function openEdit(connection: IntegrationConfig) {
-    setEditing(connection);
-    setModalOpen(true);
-  }
-
-  async function remove(connection: IntegrationConfig) {
-    if (busy) return;
-    setBusy(true);
-    setError(null);
-    try {
-      await deleteIntegration(connection.id);
-      await refresh();
-    } catch (e) {
-      setError(errorMessage(e));
-    } finally {
-      setBusy(false);
-    }
-  }
-
-  const columns = useMemo<TableColumn<IntegrationConfig>[]>(
-    () => [
-      {
-        key: "name",
-        header: t("portal.connections.table.name"),
-        render: (c) => <strong>{c.name}</strong>,
-      },
-      {
-        key: "type",
-        header: t("portal.connections.table.type"),
-        render: (c) => {
-          const type = connectionTypeOf(c.integrationType, c.config);
-          return type ? t(type.labelKey) : c.integrationType;
-        },
-      },
-      {
-        key: "detail",
-        header: t("portal.connections.table.detail"),
-        render: (c) => (
-          <span className="portal-sources__connections-bucket">
-            {connectionDetail(c)}
-          </span>
-        ),
-      },
-      {
-        key: "actions",
-        header: "",
-        align: "right",
-        render: (c) =>
-          c.canManage ? (
-            <span className="portal-sources__connections-actions">
-              <Button
-                variant="tertiary"
-                size="sm"
-                disabled={busy}
-                onClick={() => openEdit(c)}
-              >
-                {t("portal.connections.edit")}
-              </Button>
-              <Button
-                variant="tertiary"
-                size="sm"
-                accent="danger"
-                disabled={busy}
-                onClick={() => void remove(c)}
-              >
-                {t("portal.connections.delete")}
-              </Button>
-            </span>
-          ) : null,
-      },
-    ],
-    // remove/openEdit are stable enough for this admin surface; busy gates them.
-    [t, busy],
-  );
-
-  const isLoading = connections === null;
-  const isEmpty = connections !== null && connections.length === 0;
-
-  return (
-    <section className="portal-sources__connections">
-      {/* The empty state carries its own heading and call to action, so the header row would
-          only double the button and the copy - show it once there are connections to head. */}
-      {!isEmpty && (
-        <div className="portal-sources__connections-head">
-          <p className="portal-sources__connections-sub">
-            {t("portal.connections.subtitle")}
-          </p>
-          <Button
-            onClick={openCreate}
-            leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
-          >
-            {t("portal.connections.actions.new")}
-          </Button>
-        </div>
-      )}
-
-      {error && <Banner tone="danger" description={error} />}
-
-      {isLoading && (
-        <div className="portal-sources__table-skeleton" aria-hidden>
-          {Array.from({ length: 3 }).map((_, i) => (
-            <Skeleton key={i} height="3rem" />
-          ))}
-        </div>
-      )}
-
-      {isEmpty && (
-        <EmptyState
-          icon={<SourcesIcon size={28} />}
-          title={t("portal.connections.empty.title")}
-          description={t("portal.connections.empty.description")}
-          actions={
-            <Button
-              onClick={openCreate}
-              leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
-            >
-              {t("portal.connections.actions.new")}
-            </Button>
-          }
-        />
-      )}
-
-      {connections !== null && connections.length > 0 && (
-        <Table<IntegrationConfig>
-          className="portal-sources__connections-table"
-          columns={columns}
-          rows={connections}
-          rowKey={(c) => String(c.id)}
-        />
-      )}
-
-      <ConnectionModal
-        open={modalOpen}
-        connection={editing}
-        capabilities={capabilities}
-        onClose={() => setModalOpen(false)}
-        onSaved={() => void refresh()}
-      />
-    </section>
-  );
-}
-
-/**
- * The one line that identifies a connection at a glance. Per type, because "bucket" means nothing
- * to a Purview tenant and a base URL means nothing to S3. Never a secret: config arrives masked,
- * but only non-secret keys are shown regardless.
- */
-function connectionDetail(connection: IntegrationConfig): string {
-  const config = connection.config ?? {};
-  switch (connection.integrationType) {
-    case "S3":
-      return String(config.bucket ?? "");
-    case "PURVIEW":
-      return String(config.tenantId ?? "");
-    default:
-      return String(config.baseUrl ?? "");
-  }
-}
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx
index 1eb7c64db6..faf253bd5b 100644
--- a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx
+++ b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.test.tsx
@@ -44,10 +44,9 @@ describe("S3ConnectionPicker", () => {
     fireEvent.click(
       await screen.findByText("portal.connections.picker.createNew"),
     );
-    fireEvent.change(
-      screen.getByLabelText(/portal\.connections\.fields\.name/),
-      { target: { value: "New bucket" } },
-    );
+    fireEvent.change(screen.getByLabelText(/portal\.integrations\.typedName/), {
+      target: { value: "New bucket" },
+    });
     fireEvent.change(
       screen.getByLabelText(
         /portal\.connections\.types\.s3\.fields\.bucket\.label/,
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx
index cc36aef29e..e8323e53a7 100644
--- a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx
+++ b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.tsx
@@ -7,11 +7,14 @@ import { ConnectionPicker } from "@portal/components/sources/ConnectionPicker";
 interface S3ConnectionPickerProps {
   value: string;
   onChange: (connectionId: string) => void;
+  /** Forwarded to {@link ConnectionPicker}: hosts inside a modal create in-place. */
+  onCreateNew?: () => void;
 }
 
 export function S3ConnectionPicker({
   value,
   onChange,
+  onCreateNew,
 }: S3ConnectionPickerProps) {
   return (
     <ConnectionPicker
@@ -19,6 +22,7 @@ export function S3ConnectionPicker({
       onChange={onChange}
       integrationType="S3"
       createTypeId="s3"
+      onCreateNew={onCreateNew}
     />
   );
 }
diff --git a/frontend/editor/src/portal/components/sources/SourceModal.css b/frontend/editor/src/portal/components/sources/SourceModal.css
new file mode 100644
index 0000000000..94ff215754
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/SourceModal.css
@@ -0,0 +1,160 @@
+.portal-source-modal__catalog {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+.portal-source-modal__hint {
+  margin: 0;
+  font-size: 0.8125rem;
+  color: var(--c-text-subtle);
+}
+
+.portal-source-modal__grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(13.5rem, 1fr));
+  gap: 0.5rem;
+}
+
+.portal-source-modal__soon-title {
+  margin: 0.5rem 0 0;
+  font-size: 0.75rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+  color: var(--c-text-muted);
+}
+
+/* Connector tile: real logo on the card surface, no tinted badge behind it. */
+.portal-source-modal__card {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.625rem;
+  padding: 0.625rem 0.75rem;
+  text-align: left;
+  cursor: pointer;
+  border: 1px solid var(--c-border);
+  border-radius: var(--radius-md);
+  background: var(--c-surface);
+  font: inherit;
+  color: inherit;
+  transition:
+    border-color var(--motion-fast),
+    background var(--motion-fast);
+}
+
+button.portal-source-modal__card:hover {
+  border-color: var(--c-border-strong);
+  background: var(--c-hover);
+}
+
+button.portal-source-modal__card:focus-visible {
+  border-color: var(--c-primary);
+  box-shadow: 0 0 0 2px var(--c-primary-tint);
+  outline: none;
+}
+
+.portal-source-modal__card--soon {
+  opacity: 0.55;
+  cursor: not-allowed;
+}
+
+.portal-source-modal__card-icon {
+  flex: none;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 1.5rem;
+  height: 1.5rem;
+  margin-top: 0.0625rem;
+}
+
+.portal-source-modal__card-text {
+  display: flex;
+  flex-direction: column;
+  gap: 0.125rem;
+  min-width: 0;
+}
+
+.portal-source-modal__card-name {
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--c-text);
+}
+
+.portal-source-modal__card-desc {
+  font-size: 0.75rem;
+  line-height: 1.4;
+  color: var(--c-text-subtle);
+}
+
+.portal-source-modal__soon-badge {
+  margin-left: 0.375rem;
+  padding: 0.0625rem 0.375rem;
+  border-radius: 999px;
+  border: 1px solid var(--c-border);
+  font-size: 0.625rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  color: var(--c-text-muted);
+  white-space: nowrap;
+}
+
+.portal-source-modal__form {
+  display: flex;
+  flex-direction: column;
+  gap: 0.875rem;
+}
+
+.portal-source-modal__loading {
+  display: flex;
+  justify-content: center;
+  padding: 2rem 0;
+}
+
+.portal-source-modal__back {
+  align-self: flex-start;
+}
+
+.portal-source-modal__type-summary {
+  display: flex;
+  align-items: center;
+  gap: 0.625rem;
+  padding: 0.625rem 0.75rem;
+  background: var(--c-surface-sunken);
+  border: 1px solid var(--c-border-subtle);
+  border-radius: var(--radius-md);
+}
+
+.portal-source-modal__muted {
+  margin: 0;
+  font-size: 0.8125rem;
+  color: var(--c-text-subtle);
+}
+
+.portal-source-modal__copy-row {
+  display: flex;
+  gap: 0.5rem;
+  align-items: center;
+}
+
+.portal-source-modal__copy-row > :first-child {
+  flex: 1 1 auto;
+  min-width: 0;
+}
+
+.portal-source-modal__footer {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  width: 100%;
+}
+
+.portal-source-modal__footer-actions {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  justify-content: flex-end;
+}
diff --git a/frontend/editor/src/portal/views/SourceBuilder.test.tsx b/frontend/editor/src/portal/components/sources/SourceModal.test.tsx
similarity index 62%
rename from frontend/editor/src/portal/views/SourceBuilder.test.tsx
rename to frontend/editor/src/portal/components/sources/SourceModal.test.tsx
index fab14ff1ae..ca037fde3d 100644
--- a/frontend/editor/src/portal/views/SourceBuilder.test.tsx
+++ b/frontend/editor/src/portal/components/sources/SourceModal.test.tsx
@@ -6,12 +6,11 @@ import {
   waitFor,
 } from "@testing-library/react";
 import { PortalTestProviders } from "@portal/test/TestQueryProvider";
-import { MemoryRouter, Route, Routes } from "react-router-dom";
 import type { ReactNode } from "react";
-import { SourceBuilder } from "@portal/views/SourceBuilder";
+import { SourceModal } from "@portal/components/sources/SourceModal";
 import { UIProvider } from "@portal/contexts/UIContext";
 
-// SourceBuilder reads useUI() (open settings) and useQueryClient (list
+// SourceModal reads useUI() (open settings) and useQueryClient (list
 // invalidation), so provide the query client + Mantine + the UI context.
 const Providers = ({ children }: { children: ReactNode }) => (
   <PortalTestProviders>
@@ -41,26 +40,29 @@ vi.mock("@portal/api/sources", () => ({
 }));
 
 const fetchS3Connections = vi.fn();
+const createIntegration = vi.fn();
 vi.mock("@portal/api/integrations", () => ({
   fetchIntegrations: () => Promise.resolve([]),
   fetchIntegrationCapabilities: () => Promise.resolve({ customApi: false }),
   fetchS3Connections: () => fetchS3Connections(),
-  createIntegration: vi.fn(),
+  createIntegration: (body: unknown) => createIntegration(body),
 }));
 
-function renderBuilder(initial: string) {
-  return render(
-    <MemoryRouter initialEntries={[initial]}>
-      <Routes>
-        <Route path="/processor/sources" element={<div>sources list</div>} />
-        <Route path="/processor/sources/new" element={<SourceBuilder />} />
-        <Route path="/processor/sources/:id" element={<SourceBuilder />} />
-      </Routes>
-    </MemoryRouter>,
+function renderModal(sourceId: string | null = null) {
+  const onClose = vi.fn();
+  const onSaved = vi.fn();
+  render(
+    <SourceModal
+      open
+      sourceId={sourceId}
+      onClose={onClose}
+      onSaved={onSaved}
+    />,
   );
+  return { onClose, onSaved };
 }
 
-describe("SourceBuilder", () => {
+describe("SourceModal", () => {
   beforeEach(() => {
     createSource.mockReset();
     createSource.mockResolvedValue({ id: "src-1" });
@@ -71,13 +73,16 @@ describe("SourceBuilder", () => {
     isFolderAccessDeniedError.mockReturnValue(false);
     fetchS3Connections.mockReset();
     fetchS3Connections.mockResolvedValue([]);
+    createIntegration.mockReset();
+    createIntegration.mockResolvedValue({ id: 77, name: "Fresh bucket" });
   });
 
-  it("creates a folder source and returns to the list", async () => {
-    renderBuilder("/processor/sources/new");
+  it("creates a folder source through the staged flow and closes", async () => {
+    const { onClose, onSaved } = renderModal();
 
-    // Folder is the first offered type; fill name + directory.
-    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+    // Stage 1: pick the folder connector, then fill name + directory.
+    fireEvent.click(screen.getByText("portal.sources.types.folder.label"));
+    fireEvent.change(screen.getByLabelText(/portal\.integrations\.typedName/), {
       target: { value: "Claims intake" },
     });
     fireEvent.change(
@@ -97,7 +102,8 @@ describe("SourceBuilder", () => {
         enabled: true,
       }),
     );
-    expect(await screen.findByText("sources list")).toBeInTheDocument();
+    await waitFor(() => expect(onSaved).toHaveBeenCalled());
+    expect(onClose).toHaveBeenCalled();
   });
 
   it("offers a Folder Access settings link when the folder is outside allowed roots", async () => {
@@ -105,9 +111,10 @@ describe("SourceBuilder", () => {
       new Error("outside the allowed folder roots"),
     );
     isFolderAccessDeniedError.mockReturnValue(true);
-    renderBuilder("/processor/sources/new");
+    renderModal();
 
-    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+    fireEvent.click(screen.getByText("portal.sources.types.folder.label"));
+    fireEvent.change(screen.getByLabelText(/portal\.integrations\.typedName/), {
       target: { value: "Claims intake" },
     });
     fireEvent.change(
@@ -129,9 +136,10 @@ describe("SourceBuilder", () => {
   it("shows a plain error banner (no settings link) for other save failures", async () => {
     createSource.mockRejectedValue(new Error("boom"));
     isFolderAccessDeniedError.mockReturnValue(false);
-    renderBuilder("/processor/sources/new");
+    renderModal();
 
-    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+    fireEvent.click(screen.getByText("portal.sources.types.folder.label"));
+    fireEvent.change(screen.getByLabelText(/portal\.integrations\.typedName/), {
       target: { value: "Claims intake" },
     });
     fireEvent.change(
@@ -149,13 +157,11 @@ describe("SourceBuilder", () => {
   });
 
   it("gates the s3 type on a chosen connection", async () => {
-    renderBuilder("/processor/sources/new");
-    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+    renderModal();
+    fireEvent.click(screen.getByText("portal.sources.types.s3.label"));
+    fireEvent.change(screen.getByLabelText(/portal\.integrations\.typedName/), {
       target: { value: "Bucket source" },
     });
-    // Switch to the S3 type: the connection field appears and Create stays
-    // disabled until a connection is chosen (connectionId is required).
-    fireEvent.click(screen.getByText("portal.sources.types.s3.label"));
     expect(
       await screen.findByText(
         "portal.sources.types.s3.fields.connection.label",
@@ -171,43 +177,87 @@ describe("SourceBuilder", () => {
       id: "wh-1",
       options: { webhookId: "whk_abc123", signingSecret: "whsec_topsecret" },
     });
-    renderBuilder("/processor/sources/new");
+    const { onClose } = renderModal();
 
-    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
+    fireEvent.click(screen.getByText("portal.sources.types.webhook.label"));
+    fireEvent.change(screen.getByLabelText(/portal\.integrations\.typedName/), {
       target: { value: "Partner uploads" },
     });
-    // Webhook's connection is optional (self-hosted local-disk), so a name is enough to create.
-    fireEvent.click(screen.getByText("portal.sources.types.webhook.label"));
     fireEvent.click(screen.getByText("portal.sources.builder.create"));
 
     await waitFor(() => expect(createSource).toHaveBeenCalledTimes(1));
-    expect(createSource).toHaveBeenCalledWith(
-      expect.objectContaining({ type: "webhook", name: "Partner uploads" }),
-    );
-
     expect(
       await screen.findByDisplayValue("whsec_topsecret"),
     ).toBeInTheDocument();
     expect(
       screen.getByDisplayValue(/\/api\/v1\/webhooks\/whk_abc123$/),
     ).toBeInTheDocument();
-    expect(screen.queryByText("sources list")).not.toBeInTheDocument();
+    expect(onClose).not.toHaveBeenCalled();
 
     fireEvent.click(
       screen.getByText("portal.sources.types.webhook.reveal.done"),
     );
-    expect(await screen.findByText("sources list")).toBeInTheDocument();
+    expect(onClose).toHaveBeenCalled();
   });
 
-  it("blocks create until required fields are filled", async () => {
-    renderBuilder("/processor/sources/new");
-    // Name given but directory (required) still blank -> Create disabled.
-    fireEvent.change(screen.getByLabelText(/portal\.sources\.wizard\.name/), {
-      target: { value: "Nameonly" },
+  it("creates an S3 connection in-place without stacking a second modal", async () => {
+    renderModal();
+    fireEvent.click(screen.getByText("portal.sources.types.s3.label"));
+    // "New connection..." swaps the stage instead of opening another modal.
+    fireEvent.click(
+      await screen.findByText("portal.connections.picker.createNew"),
+    );
+    expect(document.querySelectorAll('[role="dialog"]').length).toBe(1);
+
+    fireEvent.change(screen.getByLabelText(/portal\.integrations\.typedName/), {
+      target: { value: "Fresh bucket" },
     });
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.connections\.types\.s3\.fields\.bucket\.label/,
+      ),
+      { target: { value: "fresh-bucket" } },
+    );
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.connections\.types\.s3\.fields\.accessKeyId\.label/,
+      ),
+      { target: { value: "AKIA123" } },
+    );
+    fireEvent.change(
+      screen.getByLabelText(
+        /portal\.connections\.types\.s3\.fields\.secretAccessKey\.label/,
+      ),
+      { target: { value: "secret" } },
+    );
+    fireEvent.click(screen.getByText("portal.connections.picker.save"));
+
+    await waitFor(() => expect(createIntegration).toHaveBeenCalledTimes(1));
+    expect(createIntegration).toHaveBeenCalledWith(
+      expect.objectContaining({
+        integrationType: "S3",
+        name: "Fresh bucket",
+        scope: "TEAM",
+      }),
+    );
+    // Back on the source form with the new connection selected.
     expect(
-      screen.getByText("portal.sources.builder.create").closest("button"),
-    ).toBeDisabled();
+      await screen.findByText(
+        "portal.sources.types.s3.fields.connection.label",
+      ),
+    ).toBeInTheDocument();
+  });
+
+  it("lists coming-soon connectors as inert cards", () => {
+    renderModal();
+    fireEvent.click(screen.getByText("portal.sources.types.sharepoint.label"));
+    // Still on the type stage: no configure form appeared.
+    expect(
+      screen.queryByLabelText(/portal\.integrations\.typedName/),
+    ).not.toBeInTheDocument();
+    expect(
+      screen.getAllByText("portal.sources.builder.comingSoon").length,
+    ).toBeGreaterThan(1);
   });
 
   it("edits an existing source prefilled and saves with its id", async () => {
@@ -218,7 +268,7 @@ describe("SourceBuilder", () => {
       options: { directory: "/old", mode: "consume" },
       enabled: true,
     });
-    renderBuilder("/processor/sources/src-9");
+    renderModal("src-9");
 
     const directory = await screen.findByLabelText(
       /portal\.sources\.types\.folder\.fields\.directory\.label/,
@@ -236,7 +286,7 @@ describe("SourceBuilder", () => {
     );
   });
 
-  it("deletes an existing source after confirmation", async () => {
+  it("deletes an existing source after the inline confirm", async () => {
     fetchSource.mockResolvedValue({
       id: "src-9",
       name: "Existing",
@@ -244,12 +294,12 @@ describe("SourceBuilder", () => {
       options: { directory: "/old" },
       enabled: true,
     });
-    renderBuilder("/processor/sources/src-9");
+    const { onSaved } = renderModal("src-9");
 
     fireEvent.click(await screen.findByText("portal.sources.builder.delete"));
     fireEvent.click(await screen.findByText("portal.sources.delete.confirm"));
 
     await waitFor(() => expect(deleteSource).toHaveBeenCalledWith("src-9"));
-    expect(await screen.findByText("sources list")).toBeInTheDocument();
+    expect(onSaved).toHaveBeenCalled();
   });
 });
diff --git a/frontend/editor/src/portal/components/sources/SourceModal.tsx b/frontend/editor/src/portal/components/sources/SourceModal.tsx
new file mode 100644
index 0000000000..626c12b33a
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/SourceModal.tsx
@@ -0,0 +1,659 @@
+import { useEffect, useState } from "react";
+import { useTranslation } from "react-i18next";
+import ArrowBackRoundedIcon from "@mui/icons-material/ArrowBackRounded";
+import {
+  Banner,
+  Button,
+  Checkbox,
+  FormField,
+  Input,
+  Modal,
+  Select,
+  Spinner,
+} from "@app/ui";
+import { errorMessage } from "@portal/api/http";
+import {
+  createSource,
+  deleteSource,
+  fetchSource,
+  isFolderAccessDeniedError,
+  type Source,
+} from "@portal/api/sources";
+import { useUI } from "@portal/contexts/UIContext";
+import { useQueryClient } from "@tanstack/react-query";
+import { qk } from "@portal/queries/keys";
+import { creatableSourceTypes } from "@portal/components/sources/creatableSourceTypes";
+import {
+  COMING_SOON_SOURCE_TYPES,
+  CREATABLE_SOURCE_TYPES,
+  defaultOptions,
+  WEBHOOK_SOURCE_TYPE,
+  type CreatableSourceType,
+} from "@portal/components/sources/sourceTypes";
+import { BrandMark } from "@portal/components/BrandMarks";
+import { S3ConnectionPicker } from "@portal/components/sources/S3ConnectionPicker";
+import { ConnectionForm } from "@portal/components/sources/ConnectionForm";
+import {
+  CREATABLE_CONNECTION_TYPES,
+  buildConnectionConfig,
+  connectionFormValid,
+  emptyConnectionValues,
+} from "@portal/components/sources/connectionTypes";
+import { createIntegration } from "@portal/api/integrations";
+import "@portal/components/sources/SourceModal.css";
+
+function webhookUrl(webhookId: string): string {
+  return `${window.location.origin}/api/v1/webhooks/${webhookId}`;
+}
+
+const OFFERED_TYPES = creatableSourceTypes();
+
+/** A source's stored type resolved to its create-form metadata (edit falls back to any type). */
+function typeFor(type: string | undefined): CreatableSourceType {
+  return (
+    CREATABLE_SOURCE_TYPES.find((t) => t.type === type) ??
+    OFFERED_TYPES[0] ??
+    CREATABLE_SOURCE_TYPES[0]
+  );
+}
+
+/** Stored options coerced to form strings, defaulted from the type's fields. */
+function optionsFor(
+  type: CreatableSourceType,
+  options: Record<string, unknown> | undefined,
+): Record<string, string> {
+  const out = defaultOptions(type);
+  for (const [key, value] of Object.entries(options ?? {})) {
+    out[key] = value == null ? "" : String(value);
+  }
+  return out;
+}
+
+type Stage = "type" | "configure" | "reveal" | "delete" | "connection";
+
+/** The S3 catalogue entry, for creating a connection in-place (no stacked modal). */
+const S3_CONNECTION_TYPE = CREATABLE_CONNECTION_TYPES.find(
+  (entry) => entry.id === "s3",
+)!;
+
+interface SourceModalProps {
+  open: boolean;
+  /** When set, edit this source; otherwise create a new one. */
+  sourceId?: string | null;
+  onClose: () => void;
+  /**
+   * Fired after a save or delete. The shared sources query is invalidated here
+   * regardless, so hosts on the query layer need no handler.
+   */
+  onSaved?: () => void;
+}
+
+/**
+ * Create/edit a source, staged inside one modal: the connector catalogue first
+ * (including greyed-out coming-soon entries), then the configure form for the
+ * picked type; webhook creation swaps to a one-time secret reveal, and delete
+ * swaps to an inline confirm rather than stacking a second modal.
+ */
+export function SourceModal({
+  open,
+  sourceId,
+  onClose,
+  onSaved,
+}: SourceModalProps) {
+  const { t } = useTranslation();
+  const { openSettings } = useUI();
+  const queryClient = useQueryClient();
+  const isEdit = Boolean(sourceId);
+
+  // The list is a shared cache entry (Sources view + Home's ProcessorFlow), so
+  // a create/delete here must invalidate it before the host re-renders it.
+  const invalidateSources = () =>
+    queryClient.invalidateQueries({ queryKey: qk.sources() });
+
+  const [stage, setStage] = useState<Stage>("type");
+  const [type, setType] = useState<CreatableSourceType>(OFFERED_TYPES[0]);
+  const [name, setName] = useState("");
+  const [options, setOptions] = useState<Record<string, string>>(() =>
+    defaultOptions(OFFERED_TYPES[0]),
+  );
+  const [enabled, setEnabled] = useState(true);
+  const [loaded, setLoaded] = useState<Source | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [submitting, setSubmitting] = useState(false);
+  const [deleting, setDeleting] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  // A folder-outside-allowed-roots failure: the error banner offers a link to
+  // the Folder Access settings instead of leaving the admin at a dead end.
+  const [folderAccessDenied, setFolderAccessDenied] = useState(false);
+  const [reveal, setReveal] = useState<{
+    webhookId: string;
+    secret: string;
+  } | null>(null);
+  // In-place connection create (swaps the stage; never stacks a second modal).
+  const [connValues, setConnValues] = useState<Record<string, string>>(() =>
+    emptyConnectionValues(S3_CONNECTION_TYPE),
+  );
+  const [connField, setConnField] = useState("");
+  const [connSaving, setConnSaving] = useState(false);
+
+  // Seed on every open: fresh catalogue for create, fetched record for edit.
+  useEffect(() => {
+    if (!open) return;
+    setError(null);
+    setReveal(null);
+    setSubmitting(false);
+    setDeleting(false);
+    if (!sourceId) {
+      setStage("type");
+      setType(OFFERED_TYPES[0]);
+      setName("");
+      setOptions(defaultOptions(OFFERED_TYPES[0]));
+      setEnabled(true);
+      setLoaded(null);
+      return;
+    }
+    setStage("configure");
+    setLoading(true);
+    fetchSource(sourceId)
+      .then((source) => {
+        const resolved = typeFor(source.type);
+        setLoaded(source);
+        setType(resolved);
+        setName(source.name ?? "");
+        setOptions(optionsFor(resolved, source.options));
+        setEnabled(source.enabled ?? true);
+      })
+      .catch((e) => setError(errorMessage(e)))
+      .finally(() => setLoading(false));
+  }, [open, sourceId]);
+
+  function chooseType(next: CreatableSourceType) {
+    setType(next);
+    setOptions(defaultOptions(next));
+    setStage("configure");
+  }
+
+  function setOption(key: string, value: string) {
+    setOptions((current) => ({ ...current, [key]: value }));
+  }
+
+  const requiredComplete = type.fields.every(
+    (field) => !field.required || (options[field.key] ?? "").trim() !== "",
+  );
+  const canSave = name.trim() !== "" && requiredComplete && !submitting;
+
+  const editingWebhookId =
+    isEdit && loaded?.type === WEBHOOK_SOURCE_TYPE
+      ? String(loaded.options?.webhookId ?? "")
+      : "";
+
+  function finish() {
+    onSaved?.();
+    onClose();
+  }
+
+  function openConnectionStage(fieldKey: string) {
+    setConnValues(emptyConnectionValues(S3_CONNECTION_TYPE));
+    setConnField(fieldKey);
+    setError(null);
+    setStage("connection");
+  }
+
+  async function saveConnection() {
+    if (connSaving || !connectionFormValid(S3_CONNECTION_TYPE, connValues))
+      return;
+    setConnSaving(true);
+    setError(null);
+    try {
+      const created = await createIntegration({
+        integrationType: S3_CONNECTION_TYPE.integrationType,
+        name: connValues.name.trim(),
+        scope: "TEAM",
+        config: buildConnectionConfig(S3_CONNECTION_TYPE, connValues),
+      });
+      // Back to the source form with the fresh connection selected; the picker
+      // remounts and refetches, so the new name is in its list.
+      setOption(connField, String(created.id));
+      setStage("configure");
+    } catch (e) {
+      setError(errorMessage(e));
+    } finally {
+      setConnSaving(false);
+    }
+  }
+
+  async function save() {
+    if (!canSave) return;
+    setSubmitting(true);
+    setError(null);
+    setFolderAccessDenied(false);
+    try {
+      const saved = await createSource({
+        id: isEdit ? (sourceId ?? undefined) : undefined,
+        name: name.trim(),
+        type: type.type,
+        options,
+        enabled,
+      });
+      await invalidateSources();
+      if (!isEdit && type.type === WEBHOOK_SOURCE_TYPE) {
+        const webhookId = String(saved.options?.webhookId ?? "");
+        const secret = String(saved.options?.signingSecret ?? "");
+        if (webhookId && secret) {
+          setReveal({ webhookId, secret });
+          setStage("reveal");
+          setSubmitting(false);
+          return;
+        }
+      }
+      finish();
+    } catch (e) {
+      setError(errorMessage(e));
+      setFolderAccessDenied(isFolderAccessDeniedError(e));
+      setSubmitting(false);
+    }
+  }
+
+  async function confirmDelete() {
+    if (!sourceId || deleting) return;
+    setDeleting(true);
+    setError(null);
+    try {
+      await deleteSource(sourceId);
+      await invalidateSources();
+      finish();
+    } catch (e) {
+      setError(errorMessage(e));
+      setDeleting(false);
+    }
+  }
+
+  function copy(text: string) {
+    void navigator.clipboard?.writeText(text);
+  }
+
+  const title =
+    stage === "type"
+      ? t("portal.sources.builder.createTitle")
+      : stage === "connection"
+        ? t("portal.connections.createTitleFor", {
+            name: t(S3_CONNECTION_TYPE.labelKey),
+          })
+        : stage === "reveal"
+          ? t("portal.sources.types.webhook.reveal.title")
+          : stage === "delete"
+            ? t("portal.sources.delete.title")
+            : isEdit
+              ? name || t("portal.sources.builder.editTitle")
+              : t("portal.sources.builder.createTitle");
+
+  return (
+    <Modal
+      open={open}
+      onClose={stage === "reveal" ? finish : onClose}
+      width={stage === "type" ? "lg" : stage === "delete" ? "sm" : "md"}
+      title={title}
+      footer={
+        stage === "configure" ? (
+          <div className="portal-source-modal__footer">
+            <Checkbox
+              checked={enabled}
+              onChange={(e) => setEnabled(e.target.checked)}
+              label={t("portal.sources.builder.enabled")}
+            />
+            <span className="portal-source-modal__footer-actions">
+              {isEdit && (
+                <Button
+                  variant="tertiary"
+                  size="sm"
+                  accent="danger"
+                  disabled={submitting}
+                  onClick={() => setStage("delete")}
+                >
+                  {t("portal.sources.builder.delete")}
+                </Button>
+              )}
+              <Button
+                variant="tertiary"
+                size="sm"
+                disabled={submitting}
+                onClick={onClose}
+              >
+                {t("portal.sources.builder.cancel")}
+              </Button>
+              <Button
+                size="sm"
+                loading={submitting}
+                disabled={!canSave}
+                onClick={() => void save()}
+              >
+                {isEdit
+                  ? t("portal.sources.builder.save")
+                  : t("portal.sources.builder.create")}
+              </Button>
+            </span>
+          </div>
+        ) : stage === "connection" ? (
+          <div className="portal-source-modal__footer-actions">
+            <Button
+              variant="tertiary"
+              size="sm"
+              disabled={connSaving}
+              onClick={() => setStage("configure")}
+            >
+              {t("portal.connections.picker.cancel")}
+            </Button>
+            <Button
+              size="sm"
+              loading={connSaving}
+              disabled={!connectionFormValid(S3_CONNECTION_TYPE, connValues)}
+              onClick={() => void saveConnection()}
+            >
+              {t("portal.connections.picker.save")}
+            </Button>
+          </div>
+        ) : stage === "reveal" ? (
+          <div className="portal-source-modal__footer-actions">
+            <Button size="sm" onClick={finish}>
+              {t("portal.sources.types.webhook.reveal.done")}
+            </Button>
+          </div>
+        ) : stage === "delete" ? (
+          <div className="portal-source-modal__footer-actions">
+            <Button
+              variant="tertiary"
+              size="sm"
+              disabled={deleting}
+              onClick={() => setStage("configure")}
+            >
+              {t("portal.sources.delete.cancel")}
+            </Button>
+            <Button
+              size="sm"
+              accent="danger"
+              loading={deleting}
+              onClick={() => void confirmDelete()}
+            >
+              {t("portal.sources.delete.confirm")}
+            </Button>
+          </div>
+        ) : undefined
+      }
+    >
+      {stage === "type" && (
+        <div className="portal-source-modal__catalog">
+          <p className="portal-source-modal__hint">
+            {t("portal.sources.builder.chooseHint")}
+          </p>
+          <div
+            className="portal-source-modal__grid"
+            role="listbox"
+            aria-label={t("portal.sources.wizard.type")}
+          >
+            {OFFERED_TYPES.map((ct) => (
+              <button
+                key={ct.type}
+                type="button"
+                role="option"
+                aria-selected={false}
+                className="portal-source-modal__card"
+                onClick={() => chooseType(ct)}
+              >
+                <span className="portal-source-modal__card-icon" aria-hidden>
+                  <BrandMark id={ct.type} size={22} />
+                </span>
+                <span className="portal-source-modal__card-text">
+                  <span className="portal-source-modal__card-name">
+                    {t(ct.labelKey)}
+                  </span>
+                  <span className="portal-source-modal__card-desc">
+                    {t(ct.descriptionKey)}
+                  </span>
+                </span>
+              </button>
+            ))}
+          </div>
+
+          <h3 className="portal-source-modal__soon-title">
+            {t("portal.sources.builder.comingSoonHeading")}
+          </h3>
+          <div className="portal-source-modal__grid">
+            {COMING_SOON_SOURCE_TYPES.map((ct) => (
+              <div
+                key={ct.type}
+                className="portal-source-modal__card portal-source-modal__card--soon"
+                aria-disabled
+              >
+                <span className="portal-source-modal__card-icon" aria-hidden>
+                  <BrandMark id={ct.type} size={22} />
+                </span>
+                <span className="portal-source-modal__card-text">
+                  <span className="portal-source-modal__card-name">
+                    {t(ct.labelKey)}
+                    <span className="portal-source-modal__soon-badge">
+                      {t("portal.sources.builder.comingSoon")}
+                    </span>
+                  </span>
+                  <span className="portal-source-modal__card-desc">
+                    {t(ct.descriptionKey)}
+                  </span>
+                </span>
+              </div>
+            ))}
+          </div>
+        </div>
+      )}
+
+      {stage === "configure" && (
+        <div className="portal-source-modal__form">
+          {loading && (
+            <div className="portal-source-modal__loading">
+              <Spinner />
+            </div>
+          )}
+
+          {!loading && (
+            <>
+              {!isEdit && (
+                <Button
+                  variant="quiet"
+                  size="sm"
+                  className="portal-source-modal__back"
+                  leftSection={<ArrowBackRoundedIcon fontSize="inherit" />}
+                  onClick={() => setStage("type")}
+                >
+                  {t("portal.sources.builder.backToTypes")}
+                </Button>
+              )}
+
+              <div className="portal-source-modal__type-summary">
+                <BrandMark id={type.type} size={22} />
+                <span className="portal-source-modal__card-text">
+                  <span className="portal-source-modal__card-name">
+                    {t(type.labelKey)}
+                  </span>
+                  <span className="portal-source-modal__card-desc">
+                    {t(type.descriptionKey)}
+                  </span>
+                </span>
+              </div>
+
+              <FormField
+                label={t("portal.integrations.typedName", {
+                  tool: t(type.labelKey),
+                })}
+                required
+              >
+                <Input
+                  value={name}
+                  placeholder={t("portal.sources.wizard.namePlaceholder")}
+                  onChange={(e) => setName(e.target.value)}
+                />
+              </FormField>
+
+              {!isEdit && type.type === WEBHOOK_SOURCE_TYPE && (
+                <p className="portal-source-modal__muted">
+                  {t("portal.sources.types.webhook.createNote")}
+                </p>
+              )}
+
+              {type.fields.map((field) => (
+                <FormField
+                  key={field.key}
+                  label={t(field.labelKey)}
+                  helperText={
+                    field.helperTextKey ? t(field.helperTextKey) : undefined
+                  }
+                  required={field.required}
+                >
+                  {field.control === "s3Connection" ? (
+                    <S3ConnectionPicker
+                      value={options[field.key] ?? ""}
+                      onChange={(connectionId) =>
+                        setOption(field.key, connectionId)
+                      }
+                      onCreateNew={() => openConnectionStage(field.key)}
+                    />
+                  ) : field.control === "select" ? (
+                    <Select
+                      value={options[field.key] ?? ""}
+                      options={(field.options ?? []).map((o) => ({
+                        value: o.value,
+                        label: t(o.labelKey),
+                      }))}
+                      onChange={(value) => setOption(field.key, value ?? "")}
+                    />
+                  ) : (
+                    <Input
+                      type={
+                        field.control === "password" ? "password" : undefined
+                      }
+                      value={options[field.key] ?? ""}
+                      placeholder={
+                        field.placeholderKey
+                          ? t(field.placeholderKey)
+                          : undefined
+                      }
+                      onChange={(e) => setOption(field.key, e.target.value)}
+                    />
+                  )}
+                </FormField>
+              ))}
+
+              {editingWebhookId && (
+                <FormField
+                  label={t("portal.sources.types.webhook.detail.deliveryUrl")}
+                  helperText={t(
+                    "portal.sources.types.webhook.detail.secretNote",
+                  )}
+                >
+                  <div className="portal-source-modal__copy-row">
+                    <Input
+                      value={webhookUrl(editingWebhookId)}
+                      readOnly
+                      onFocus={(e) => e.currentTarget.select()}
+                    />
+                    <Button
+                      variant="tertiary"
+                      size="sm"
+                      onClick={() => copy(webhookUrl(editingWebhookId))}
+                    >
+                      {t("portal.sources.types.webhook.reveal.copy")}
+                    </Button>
+                  </div>
+                </FormField>
+              )}
+
+              {error &&
+                (folderAccessDenied ? (
+                  <Banner
+                    tone="danger"
+                    title={t("portal.sources.builder.folderAccess.title")}
+                    description={t(
+                      "portal.sources.builder.folderAccess.description",
+                    )}
+                    action={
+                      <Button
+                        variant="secondary"
+                        size="sm"
+                        onClick={() => openSettings("adminFolderAccess")}
+                      >
+                        {t("portal.sources.builder.folderAccess.openSettings")}
+                      </Button>
+                    }
+                  />
+                ) : (
+                  <Banner tone="danger" description={error} />
+                ))}
+            </>
+          )}
+        </div>
+      )}
+
+      {stage === "connection" && (
+        <div className="portal-source-modal__form">
+          <ConnectionForm
+            type={S3_CONNECTION_TYPE}
+            values={connValues}
+            onChange={setConnValues}
+          />
+          {error && <Banner tone="danger" description={error} />}
+        </div>
+      )}
+
+      {stage === "reveal" && reveal && (
+        <div className="portal-source-modal__form">
+          <Banner
+            tone="warning"
+            description={t("portal.sources.types.webhook.reveal.secretWarning")}
+          />
+          <FormField label={t("portal.sources.types.webhook.reveal.url")}>
+            <div className="portal-source-modal__copy-row">
+              <Input
+                value={webhookUrl(reveal.webhookId)}
+                readOnly
+                onFocus={(e) => e.currentTarget.select()}
+              />
+              <Button
+                variant="tertiary"
+                size="sm"
+                onClick={() => copy(webhookUrl(reveal.webhookId))}
+              >
+                {t("portal.sources.types.webhook.reveal.copy")}
+              </Button>
+            </div>
+          </FormField>
+          <FormField
+            label={t("portal.sources.types.webhook.reveal.secret")}
+            helperText={t("portal.sources.types.webhook.reveal.secretHelp")}
+          >
+            <div className="portal-source-modal__copy-row">
+              <Input
+                value={reveal.secret}
+                readOnly
+                onFocus={(e) => e.currentTarget.select()}
+              />
+              <Button
+                variant="tertiary"
+                size="sm"
+                onClick={() => copy(reveal.secret)}
+              >
+                {t("portal.sources.types.webhook.reveal.copy")}
+              </Button>
+            </div>
+          </FormField>
+          <p className="portal-source-modal__muted">
+            {t("portal.sources.types.webhook.reveal.usage")}
+          </p>
+        </div>
+      )}
+
+      {stage === "delete" && (
+        <div className="portal-source-modal__form">
+          <p>{t("portal.sources.delete.body", { name })}</p>
+          {error && <Banner tone="danger" description={error} />}
+        </div>
+      )}
+    </Modal>
+  );
+}
diff --git a/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx b/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx
index 5ccd70b860..b716f7ea59 100644
--- a/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx
+++ b/frontend/editor/src/portal/components/sources/SourceTypeIcon.tsx
@@ -1,35 +1,11 @@
+import { BrandMark } from "@portal/components/BrandMarks";
+
 /**
- * Stroke-SVG icons for source types, replacing the black Unicode glyphs
- * (⛁ ☁ ✏ ◇) that rendered off-style and mis-centred inside the type tiles and
- * table badges. Keyed by the backend source `type`; unknown types fall back to
- * a neutral document mark.
+ * Source-type mark for the sources table and pickers: the connector's real
+ * brand mark (full colour, no tinted plate), falling back to neutral
+ * currentColor glyphs for generic types. Keyed by the backend source `type`;
+ * unknown types get a neutral document/plug mark via BrandMark's fallback.
  */
-
-const PATHS: Record<string, string> = {
-  folder: "M3 7h6l2 2h10v9a1 1 0 01-1 1H4a1 1 0 01-1-1V7z",
-  s3: "M7 18a4 4 0 010-8 5 5 0 019.6-1.3A3.5 3.5 0 0117 18H7z",
-  webhook: "M13 2L3 14h9l-1 8 10-12h-9l1-8z",
-  editor: "M4 20h16M14 4l6 6-9 9H5v-6l9-9z",
-  _default:
-    "M14 3H7a1 1 0 00-1 1v16a1 1 0 001 1h10a1 1 0 001-1V7l-4-4zM14 3v4h4",
-};
-
 export function SourceTypeIcon({ type }: { type: string }) {
-  const d = PATHS[type] ?? PATHS._default;
-  return (
-    <svg
-      className="portal-sources__type-svg"
-      viewBox="0 0 24 24"
-      fill="none"
-      aria-hidden
-    >
-      <path
-        d={d}
-        stroke="currentColor"
-        strokeWidth="1.7"
-        strokeLinecap="round"
-        strokeLinejoin="round"
-      />
-    </svg>
-  );
+  return <BrandMark id={type} className="portal-sources__type-svg" />;
 }
diff --git a/frontend/editor/src/portal/components/sources/SourcesTable.tsx b/frontend/editor/src/portal/components/sources/SourcesTable.tsx
index ad0a17c81e..23017299a1 100644
--- a/frontend/editor/src/portal/components/sources/SourcesTable.tsx
+++ b/frontend/editor/src/portal/components/sources/SourcesTable.tsx
@@ -42,10 +42,7 @@ export function SourcesTable({ sources, onRowClick }: SourcesTableProps) {
           const isEditor = s.type === EDITOR_SOURCE_TYPE;
           return (
             <div className="portal-sources__name-cell">
-              <span
-                className={`portal-sources__type-dot portal-sources__type-dot--${meta.accent}`}
-                aria-hidden
-              >
+              <span className="portal-sources__type-dot" aria-hidden>
                 <SourceTypeIcon type={s.type} />
               </span>
               <div className="portal-sources__name-text">
diff --git a/frontend/editor/src/portal/components/sources/sourceTypes.ts b/frontend/editor/src/portal/components/sources/sourceTypes.ts
index 89d12c945b..e25490a2bf 100644
--- a/frontend/editor/src/portal/components/sources/sourceTypes.ts
+++ b/frontend/editor/src/portal/components/sources/sourceTypes.ts
@@ -11,7 +11,6 @@ import type { ChipAccent } from "@app/ui";
 
 export interface SourceTypeMeta {
   labelKey: string;
-  icon: string;
   accent: ChipAccent;
 }
 
@@ -28,29 +27,24 @@ export const WEBHOOK_SOURCE_TYPE = "webhook";
 const SOURCE_TYPE_META: Record<string, SourceTypeMeta> = {
   folder: {
     labelKey: "portal.sources.types.folder.label",
-    icon: "⛁",
     accent: "default",
   },
   editor: {
     labelKey: "portal.sources.types.editor.label",
-    icon: "✏",
     accent: "success",
   },
   s3: {
     labelKey: "portal.sources.types.s3.label",
-    icon: "☁",
     accent: "brand",
   },
   webhook: {
     labelKey: "portal.sources.types.webhook.label",
-    icon: "↯",
     accent: "warning",
   },
 };
 
 const UNKNOWN_TYPE_META: SourceTypeMeta = {
   labelKey: "portal.sources.types.unknown.label",
-  icon: "◇",
   accent: "neutral",
 };
 
@@ -196,6 +190,33 @@ export const CREATABLE_SOURCE_TYPES: CreatableSourceType[] = [
   },
 ];
 
+/** A source type on the roadmap: shown greyed out in the picker, not creatable. */
+export interface ComingSoonSourceType {
+  type: string;
+  labelKey: string;
+  descriptionKey: string;
+}
+
+/**
+ * Connectors we intend to support, listed so the picker answers "do you
+ * support X?" honestly instead of hiding the roadmap. Purely presentational -
+ * nothing here can be created and the backend never sees these type strings.
+ */
+export const COMING_SOON_SOURCE_TYPES: ComingSoonSourceType[] = [
+  "sharepoint",
+  "onedrive",
+  "googledrive",
+  "dropbox",
+  "box",
+  "network",
+  "sftp",
+  "email",
+].map((type) => ({
+  type,
+  labelKey: `portal.sources.types.${type}.label`,
+  descriptionKey: `portal.sources.types.${type}.description`,
+}));
+
 /** Default option values for a type's create form. */
 export function defaultOptions(
   type: CreatableSourceType,
diff --git a/frontend/editor/src/portal/contexts/ViewContext.tsx b/frontend/editor/src/portal/contexts/ViewContext.tsx
index db3a64ee40..be333f56d3 100644
--- a/frontend/editor/src/portal/contexts/ViewContext.tsx
+++ b/frontend/editor/src/portal/contexts/ViewContext.tsx
@@ -7,6 +7,7 @@ export type ViewId =
   | "editor"
   | "users"
   | "sources"
+  | "integrations"
   | "policies"
   | "pipelines"
   | "documents"
@@ -21,6 +22,7 @@ export const VIEW_LABELS: Record<ViewId, string> = {
   editor: "Editor",
   users: "Users",
   sources: "Sources",
+  integrations: "Integrations",
   policies: "Policies",
   pipelines: "Pipelines",
   documents: "Documents",
@@ -36,6 +38,7 @@ export const VIEW_PATHS: Record<ViewId, string> = {
   editor: "/editor",
   users: "/users",
   sources: "/sources",
+  integrations: "/integrations",
   policies: "/policies",
   pipelines: "/pipelines",
   documents: "/documents",
diff --git a/frontend/editor/src/portal/views/Integrations.css b/frontend/editor/src/portal/views/Integrations.css
new file mode 100644
index 0000000000..9d90d70b13
--- /dev/null
+++ b/frontend/editor/src/portal/views/Integrations.css
@@ -0,0 +1,358 @@
+.portal-integrations {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+  padding: 1.5rem;
+  max-width: 84rem;
+  margin: 0 auto;
+}
+
+.portal-integrations__head {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 1rem;
+  flex-wrap: wrap;
+}
+
+.portal-integrations__title {
+  margin: 0;
+  font-size: 1.375rem;
+  font-weight: 600;
+  color: var(--c-text);
+}
+
+.portal-integrations__sub {
+  margin: 0.25rem 0 0;
+  font-size: 0.875rem;
+  color: var(--c-text-subtle);
+}
+
+.portal-integrations__toolbar {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+}
+
+.portal-integrations__filters {
+  display: flex;
+  gap: 0.25rem;
+  flex-wrap: wrap;
+  align-items: center;
+  flex: 1 1 24rem;
+  min-width: 0;
+}
+
+.portal-integrations__filter {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.375rem;
+  padding: 0.3125rem 0.625rem;
+  border: none;
+  border-radius: 999px;
+  background: transparent;
+  font: inherit;
+  font-size: 0.8125rem;
+  font-weight: 500;
+  color: var(--c-text-muted);
+  cursor: pointer;
+}
+
+.portal-integrations__filter:hover {
+  background: var(--c-hover);
+  color: var(--c-text);
+}
+
+.portal-integrations__filter.is-active {
+  background: var(--c-primary-tint);
+  color: var(--c-primary);
+}
+
+.portal-integrations__filter-count {
+  padding: 0 0.375rem;
+  border-radius: 999px;
+  background: var(--c-surface-sunken);
+  font-size: 0.6875rem;
+  font-weight: 600;
+  color: var(--c-text-muted);
+}
+
+.portal-integrations__toolbar-side {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  margin-left: auto;
+}
+
+.portal-integrations__search {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.375rem;
+  padding: 0.3125rem 0.625rem;
+  border: 1px solid var(--c-border);
+  border-radius: var(--radius-md);
+  background: var(--c-surface);
+  color: var(--c-text-muted);
+  font-size: 1rem;
+}
+
+.portal-integrations__search input {
+  border: none;
+  outline: none;
+  background: transparent;
+  font: inherit;
+  font-size: 0.8125rem;
+  color: var(--c-text);
+  width: clamp(7rem, 14vw, 11rem);
+}
+
+.portal-integrations__skeleton {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+}
+
+/* One list, table-shaped: a shared 4-column grid so the connected, available
+   and coming-soon bands line up under the same headers. */
+.portal-integrations__table {
+  border: 1px solid var(--c-border);
+  border-radius: var(--radius-md);
+  background: var(--c-surface);
+  overflow: hidden;
+}
+
+.portal-integrations__cols,
+.portal-integrations__row {
+  display: grid;
+  grid-template-columns: minmax(16rem, 2.5fr) minmax(10rem, 1fr) 11rem;
+  gap: 0.75rem;
+  align-items: center;
+  padding: 0.625rem 1rem;
+}
+
+.portal-integrations__cols {
+  padding-top: 0.75rem;
+  padding-bottom: 0.5rem;
+  font-size: 0.6875rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--c-text-muted);
+  border-bottom: 1px solid var(--c-border-subtle);
+}
+
+.portal-integrations__section {
+  padding: 0.5rem 1rem 0.375rem;
+  font-size: 0.6875rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--c-text-muted);
+  background: var(--c-surface-sunken);
+  border-top: 1px solid var(--c-border-subtle);
+  border-bottom: 1px solid var(--c-border-subtle);
+}
+
+.portal-integrations__group + .portal-integrations__group,
+.portal-integrations__group + .portal-integrations__row,
+.portal-integrations__row + .portal-integrations__row,
+.portal-integrations__row + .portal-integrations__group {
+  border-top: 1px solid var(--c-border-subtle);
+}
+
+.portal-integrations__row {
+  width: 100%;
+  border: none;
+  background: transparent;
+  font: inherit;
+  color: inherit;
+  text-align: left;
+}
+
+button.portal-integrations__row {
+  cursor: pointer;
+}
+
+button.portal-integrations__row:hover {
+  background: var(--c-hover);
+}
+
+/* An open group keeps a light wash so its sub-rows visibly belong to it. */
+button.portal-integrations__row[aria-expanded="true"] {
+  background: var(--c-hover);
+}
+
+.portal-integrations__row--soon {
+  opacity: 0.55;
+}
+
+.portal-integrations__name {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  min-width: 0;
+}
+
+.portal-integrations__name svg {
+  flex: none;
+}
+
+.portal-integrations__name-text {
+  display: flex;
+  flex-direction: column;
+  gap: 0.0625rem;
+  min-width: 0;
+}
+
+.portal-integrations__label {
+  font-size: 0.875rem;
+  font-weight: 600;
+  color: var(--c-text);
+}
+
+.portal-integrations__detail {
+  font-size: 0.75rem;
+  color: var(--c-text-subtle);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.portal-integrations__chips {
+  display: flex;
+  gap: 0.25rem;
+  flex-wrap: wrap;
+}
+
+.portal-integrations__chip {
+  padding: 0.125rem 0.5rem;
+  border: 1px solid var(--c-border);
+  border-radius: 999px;
+  font-size: 0.6875rem;
+  font-weight: 500;
+  color: var(--c-text-muted);
+  background: var(--c-surface-sunken);
+  white-space: nowrap;
+}
+
+.portal-integrations__status {
+  display: flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 0.375rem;
+  font-size: 0.8125rem;
+  font-weight: 500;
+  color: var(--c-success);
+}
+
+.portal-integrations__status-dot {
+  width: 0.5rem;
+  height: 0.5rem;
+  border-radius: 999px;
+  background: var(--c-success);
+}
+
+.portal-integrations__chevron {
+  color: var(--c-text-muted);
+  transition: transform var(--motion-fast);
+}
+
+.portal-integrations__chevron.is-open {
+  transform: rotate(180deg);
+}
+
+/* Instance sub-rows: same surface as the table (the sunken grey belongs to the
+   section bands alone), tied to their group by an indented tree rail under the
+   brand mark rather than a full-width panel. */
+.portal-integrations__instances {
+  border-top: 1px solid var(--c-border-subtle);
+  background: var(--c-surface);
+}
+
+.portal-integrations__instance {
+  display: grid;
+  grid-template-columns: minmax(10rem, 1fr) minmax(10rem, 1.5fr) auto;
+  gap: 0.75rem;
+  align-items: center;
+  padding: 0.4375rem 1rem 0.4375rem 3.35rem;
+  position: relative;
+}
+
+.portal-integrations__instance::before {
+  content: "";
+  position: absolute;
+  left: 1.65rem;
+  top: 0;
+  bottom: 0;
+  width: 2px;
+  background: var(--c-border);
+}
+
+.portal-integrations__instance + .portal-integrations__instance {
+  border-top: 1px solid var(--c-border-subtle);
+}
+
+.portal-integrations__instance--add {
+  grid-template-columns: 1fr;
+  justify-items: start;
+  border-top: 1px solid var(--c-border-subtle);
+}
+
+/* The rail stops halfway on the closing row, like the last node of a tree. */
+.portal-integrations__instance--add::before {
+  bottom: 50%;
+}
+
+.portal-integrations__instance-name {
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--c-text);
+}
+
+.portal-integrations__instance-detail {
+  font-size: 0.75rem;
+  color: var(--c-text-muted);
+  overflow: hidden;
+  text-overflow: ellipsis;
+  white-space: nowrap;
+}
+
+.portal-integrations__instance-actions {
+  display: flex;
+  gap: 0.375rem;
+  justify-content: flex-end;
+}
+
+.portal-integrations__soon-badge {
+  padding: 0.0625rem 0.5rem;
+  border-radius: 999px;
+  border: 1px solid var(--c-border);
+  font-size: 0.625rem;
+  font-weight: 600;
+  text-transform: uppercase;
+  letter-spacing: 0.03em;
+  color: var(--c-text-muted);
+  white-space: nowrap;
+}
+
+/* Narrow screens: drop the works-with column, keep name + action. */
+@media (max-width: 56rem) {
+  .portal-integrations__cols,
+  .portal-integrations__row {
+    grid-template-columns: minmax(0, 1fr) auto;
+  }
+
+  .portal-integrations__chips {
+    display: none;
+  }
+
+  .portal-integrations__instance {
+    grid-template-columns: minmax(0, 1fr) auto;
+    padding-left: 1rem;
+  }
+
+  .portal-integrations__instance-detail {
+    display: none;
+  }
+}
diff --git a/frontend/editor/src/portal/views/Integrations.test.tsx b/frontend/editor/src/portal/views/Integrations.test.tsx
new file mode 100644
index 0000000000..c5e96d8666
--- /dev/null
+++ b/frontend/editor/src/portal/views/Integrations.test.tsx
@@ -0,0 +1,150 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  fireEvent,
+  render as baseRender,
+  screen,
+  waitFor,
+} from "@testing-library/react";
+import { MantineProvider } from "@mantine/core";
+import { HttpError } from "@portal/api/http";
+import { Integrations } from "@portal/views/Integrations";
+import type { IntegrationConfig } from "@portal/api/integrations";
+
+const render = (ui: Parameters<typeof baseRender>[0]) =>
+  baseRender(ui, { wrapper: MantineProvider });
+
+vi.mock("react-i18next", () => ({
+  useTranslation: () => ({
+    t: (key: string) => key,
+    i18n: { changeLanguage: vi.fn() },
+  }),
+}));
+
+const fetchIntegrations = vi.fn();
+const deleteIntegration = vi.fn();
+const capabilities = vi.fn();
+vi.mock("@portal/api/integrations", () => ({
+  fetchIntegrations: () => fetchIntegrations(),
+  fetchIntegrationCapabilities: () => capabilities(),
+  fetchS3Connections: () => Promise.resolve([]),
+  deleteIntegration: (id: number) => deleteIntegration(id),
+  createIntegration: vi.fn(),
+  updateIntegration: vi.fn(),
+}));
+
+const bucket = (id: number, name: string): IntegrationConfig =>
+  ({
+    id,
+    integrationType: "S3",
+    name,
+    config: { bucket: `${name}-bucket`, region: "us-east-1" },
+    canManage: true,
+  }) as unknown as IntegrationConfig;
+
+describe("Integrations view", () => {
+  beforeEach(() => {
+    fetchIntegrations.mockReset();
+    deleteIntegration.mockReset();
+    deleteIntegration.mockResolvedValue(undefined);
+    capabilities.mockReset();
+    capabilities.mockResolvedValue({ customApi: false });
+  });
+
+  it("lists the available catalogue with Connect actions when nothing is connected", async () => {
+    fetchIntegrations.mockResolvedValue([]);
+    render(<Integrations />);
+    expect(
+      await screen.findByText("portal.connections.types.s3.label"),
+    ).toBeInTheDocument();
+    expect(
+      screen.getByText("portal.connections.types.slack.label"),
+    ).toBeInTheDocument();
+    expect(
+      screen.getAllByText("portal.integrations.connect").length,
+    ).toBeGreaterThan(5);
+    // Roadmap source connectors are listed greyed, not connectable.
+    expect(
+      screen.getByText("portal.sources.types.sharepoint.label"),
+    ).toBeInTheDocument();
+  });
+
+  it("groups connections of the same type and expands to the instances", async () => {
+    fetchIntegrations.mockResolvedValue([
+      bucket(1, "Claims"),
+      bucket(2, "Archive"),
+    ]);
+    render(<Integrations />);
+
+    // One connected group row for S3 with the instance count, not two rows.
+    const group = await screen.findByText(
+      "portal.integrations.connectionCount",
+    );
+    expect(group).toBeInTheDocument();
+
+    fireEvent.click(screen.getByText("portal.connections.types.s3.label"));
+    expect(await screen.findByText("Claims")).toBeInTheDocument();
+    expect(screen.getByText("Archive")).toBeInTheDocument();
+    expect(
+      screen.getByText("portal.integrations.addAnother"),
+    ).toBeInTheDocument();
+    // The available band remains for the other, unconnected vendors.
+    expect(
+      screen.getByText(/portal\.integrations\.availableHeading/),
+    ).toBeInTheDocument();
+  });
+
+  it("deletes an instance from the expanded group", async () => {
+    fetchIntegrations.mockResolvedValueOnce([bucket(5, "Claims")]);
+    fetchIntegrations.mockResolvedValueOnce([]);
+    render(<Integrations />);
+
+    fireEvent.click(
+      await screen.findByText("portal.connections.types.s3.label"),
+    );
+    fireEvent.click(await screen.findByText("portal.connections.delete"));
+
+    await waitFor(() => expect(deleteIntegration).toHaveBeenCalledWith(5));
+  });
+
+  it("surfaces the 409 when deleting a connection still in use", async () => {
+    fetchIntegrations.mockResolvedValue([bucket(5, "Claims")]);
+    deleteIntegration.mockRejectedValue(
+      new HttpError(409, "Conflict", {
+        detail: "Integration is in use by: source 'Claims intake'",
+      }),
+    );
+    render(<Integrations />);
+
+    fireEvent.click(
+      await screen.findByText("portal.connections.types.s3.label"),
+    );
+    fireEvent.click(await screen.findByText("portal.connections.delete"));
+
+    expect(
+      await screen.findByText(
+        "Integration is in use by: source 'Claims intake'",
+      ),
+    ).toBeInTheDocument();
+  });
+
+  it("offers Custom API as a button and an available row when the server allows it", async () => {
+    capabilities.mockResolvedValue({ customApi: true });
+    fetchIntegrations.mockResolvedValue([]);
+    render(<Integrations />);
+    expect(
+      await screen.findByText("portal.integrations.customApi"),
+    ).toBeInTheDocument();
+    expect(
+      await screen.findByText("portal.connections.types.api.label"),
+    ).toBeInTheDocument();
+  });
+
+  it("keeps Custom API out of the catalogue when the server withholds it", async () => {
+    fetchIntegrations.mockResolvedValue([]);
+    render(<Integrations />);
+    await screen.findByText("portal.connections.types.s3.label");
+    expect(
+      screen.queryByText("portal.connections.types.api.label"),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/frontend/editor/src/portal/views/Integrations.tsx b/frontend/editor/src/portal/views/Integrations.tsx
new file mode 100644
index 0000000000..dad19e750c
--- /dev/null
+++ b/frontend/editor/src/portal/views/Integrations.tsx
@@ -0,0 +1,520 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { useTranslation } from "react-i18next";
+import AddRoundedIcon from "@mui/icons-material/AddRounded";
+import SearchRoundedIcon from "@mui/icons-material/SearchRounded";
+import ExpandMoreRoundedIcon from "@mui/icons-material/ExpandMoreRounded";
+import { Banner, Button, Skeleton } from "@app/ui";
+import { errorMessage } from "@portal/api/http";
+import {
+  deleteIntegration,
+  fetchIntegrationCapabilities,
+  fetchIntegrations,
+  type IntegrationCapabilities,
+  type IntegrationConfig,
+} from "@portal/api/integrations";
+import { BrandMark } from "@portal/components/BrandMarks";
+import { ConnectionModal } from "@portal/components/sources/ConnectionModal";
+import {
+  CONNECTION_CATEGORIES,
+  CREATABLE_CONNECTION_TYPES,
+  connectionTypeOf,
+  presetConnectionTypes,
+  type ConnectionCategory,
+  type CreatableConnectionType,
+} from "@portal/components/sources/connectionTypes";
+import { STEP_OPERATIONS } from "@portal/components/policies/stepOperations";
+import { COMING_SOON_SOURCE_TYPES } from "@portal/components/sources/sourceTypes";
+import "@portal/views/Integrations.css";
+
+/**
+ * The integrations catalogue: everything Stirling can talk to, in one place.
+ *
+ * Three bands in one list. Connected first — stored connections grouped by
+ * vendor, expandable when a vendor has several (two S3 buckets is normal, not
+ * an error), each instance editable and one click from "add another". Then
+ * Available — the supported vendors, each saying what it works with (sources,
+ * policies, pipelines) so it's obvious whether a vendor feeds documents in or
+ * receives them. Coming-soon source connectors close the list greyed out, so
+ * "do you support X?" is answered honestly instead of hidden.
+ *
+ * Setup itself stays in the shared {@link ConnectionModal}; every entry point
+ * here pins the vendor, so the modal opens straight on the right form.
+ */
+
+type Filter = "all" | "connected" | ConnectionCategory;
+type WorksWith = "sources" | "policies" | "pipelines";
+
+/** What a vendor plugs into, derived from the catalogues rather than declared. */
+function worksWith(type: CreatableConnectionType): WorksWith[] {
+  if (type.id === "s3") return ["sources", "pipelines"];
+  if (type.kind === "custom") return ["policies", "pipelines"];
+  const hasStep = STEP_OPERATIONS.some((op) => op.connectionTypeId === type.id);
+  // Catalogue operations surface in both the policy step and pipeline pickers.
+  return hasStep ? ["policies", "pipelines"] : ["policies"];
+}
+
+/** The one non-secret line that identifies a connection (bucket, tenant, URL). */
+function connectionDetail(connection: IntegrationConfig): string {
+  const config = connection.config ?? {};
+  switch (connection.integrationType) {
+    case "S3":
+      return String(config.bucket ?? "");
+    case "PURVIEW":
+      return String(config.tenantId ?? "");
+    default:
+      return String(config.baseUrl ?? "");
+  }
+}
+
+interface TypeGroup {
+  type: CreatableConnectionType;
+  connections: IntegrationConfig[];
+}
+
+export function Integrations() {
+  const { t } = useTranslation();
+  const [connections, setConnections] = useState<IntegrationConfig[] | null>(
+    null,
+  );
+  const [capabilities, setCapabilities] = useState<
+    IntegrationCapabilities | undefined
+  >(undefined);
+  const [filter, setFilter] = useState<Filter>("all");
+  const [query, setQuery] = useState("");
+  const [expanded, setExpanded] = useState<Set<string>>(new Set());
+  const [modal, setModal] = useState<{
+    open: boolean;
+    editing: IntegrationConfig | null;
+    fixedTypeId?: string;
+  }>({ open: false, editing: null });
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const refresh = useCallback(async () => {
+    try {
+      setConnections(await fetchIntegrations());
+    } catch (e) {
+      setError(errorMessage(e));
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+  }, [refresh]);
+
+  useEffect(() => {
+    fetchIntegrationCapabilities().then(setCapabilities, () => undefined);
+  }, []);
+
+  // The supported vendors, plus the free-form Custom API entry when the server
+  // allows this caller to author one (same gate as the header button).
+  const catalogue = useMemo(() => {
+    const presets = presetConnectionTypes();
+    if (!capabilities?.customApi) return presets;
+    const custom = CREATABLE_CONNECTION_TYPES.find((t) => t.kind === "custom");
+    return custom ? [...presets, custom] : presets;
+  }, [capabilities]);
+
+  // Stored connections grouped under their vendor. Unknown types (an MCP row,
+  // or a vendor this build no longer ships) group under the custom entry via
+  // connectionTypeOf's fallback so nothing stored ever disappears from view.
+  const groups = useMemo(() => {
+    const byType = new Map<string, TypeGroup>();
+    for (const connection of connections ?? []) {
+      const type = connectionTypeOf(
+        connection.integrationType,
+        connection.config,
+      );
+      if (!type) continue;
+      const group = byType.get(type.id) ?? { type, connections: [] };
+      group.connections.push(connection);
+      byType.set(type.id, group);
+    }
+    return byType;
+  }, [connections]);
+
+  const q = query.trim().toLowerCase();
+  const matches = useCallback(
+    (label: string, extra: string[] = []) =>
+      q === "" ||
+      [label, ...extra].join(" ").toLowerCase().includes(q) ||
+      q
+        .split(/\s+/)
+        .every((word) =>
+          [label, ...extra].join(" ").toLowerCase().includes(word),
+        ),
+    [q],
+  );
+
+  const connectedGroups = useMemo(
+    () =>
+      [...groups.values()].filter(
+        (group) =>
+          (filter === "all" ||
+            filter === "connected" ||
+            group.type.category === filter) &&
+          matches(t(group.type.labelKey), [
+            group.type.id,
+            ...group.connections.map((c) => c.name),
+          ]),
+      ),
+    [groups, filter, matches, t],
+  );
+
+  const availableTypes = useMemo(
+    () =>
+      catalogue.filter(
+        (type) =>
+          !groups.has(type.id) &&
+          filter !== "connected" &&
+          (filter === "all" || type.category === filter) &&
+          matches(t(type.labelKey), [type.id, ...(type.searchTerms ?? [])]),
+      ),
+    [catalogue, groups, filter, matches, t],
+  );
+
+  const comingSoon = useMemo(
+    () =>
+      (filter === "all" || filter === "storage"
+        ? COMING_SOON_SOURCE_TYPES
+        : []
+      ).filter((entry) => matches(t(entry.labelKey), [entry.type])),
+    [filter, matches, t],
+  );
+
+  // Filter chips: only categories that actually contain something.
+  const categoryCounts = useMemo(() => {
+    const counts = new Map<ConnectionCategory, number>();
+    for (const type of catalogue) {
+      counts.set(type.category, (counts.get(type.category) ?? 0) + 1);
+    }
+    return counts;
+  }, [catalogue]);
+
+  function toggleExpand(typeId: string) {
+    setExpanded((current) => {
+      const next = new Set(current);
+      if (next.has(typeId)) next.delete(typeId);
+      else next.add(typeId);
+      return next;
+    });
+  }
+
+  function openCreate(typeId: string) {
+    setModal({ open: true, editing: null, fixedTypeId: typeId });
+  }
+
+  function openEdit(connection: IntegrationConfig) {
+    setModal({ open: true, editing: connection });
+  }
+
+  async function remove(connection: IntegrationConfig) {
+    if (busy) return;
+    setBusy(true);
+    setError(null);
+    try {
+      await deleteIntegration(connection.id);
+      await refresh();
+    } catch (e) {
+      setError(errorMessage(e));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  const isLoading = connections === null;
+
+  const chip = (kind: WorksWith) => (
+    <span key={kind} className="portal-integrations__chip">
+      {t(`portal.integrations.worksWith.${kind}`)}
+    </span>
+  );
+
+  return (
+    <div className="portal-integrations">
+      <header className="portal-integrations__head">
+        <div>
+          <h1 className="portal-integrations__title">
+            {t("portal.integrations.title")}
+          </h1>
+          <p className="portal-integrations__sub">
+            {t("portal.integrations.subtitle")}
+          </p>
+        </div>
+        {capabilities?.customApi && (
+          <Button
+            onClick={() => openCreate("api")}
+            leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
+          >
+            {t("portal.integrations.customApi")}
+          </Button>
+        )}
+      </header>
+
+      <div className="portal-integrations__toolbar">
+        <div
+          className="portal-integrations__filters"
+          role="tablist"
+          aria-label={t("portal.integrations.title")}
+        >
+          <FilterChip
+            active={filter === "all"}
+            label={t("portal.integrations.filters.all")}
+            count={catalogue.length}
+            onClick={() => setFilter("all")}
+          />
+          <FilterChip
+            active={filter === "connected"}
+            label={t("portal.integrations.filters.connected")}
+            count={groups.size}
+            onClick={() => setFilter("connected")}
+          />
+          {CONNECTION_CATEGORIES.filter(
+            (category) =>
+              category !== "advanced" &&
+              (categoryCounts.get(category) ?? 0) > 0,
+          ).map((category) => (
+            <FilterChip
+              key={category}
+              active={filter === category}
+              label={t(`portal.integrations.filters.${category}`)}
+              count={categoryCounts.get(category) ?? 0}
+              onClick={() => setFilter(category)}
+            />
+          ))}
+        </div>
+        <div className="portal-integrations__toolbar-side">
+          <label className="portal-integrations__search">
+            <SearchRoundedIcon fontSize="inherit" />
+            <input
+              type="search"
+              value={query}
+              onChange={(e) => setQuery(e.target.value)}
+              placeholder={t("portal.integrations.searchPlaceholder")}
+              aria-label={t("portal.integrations.searchPlaceholder")}
+            />
+          </label>
+        </div>
+      </div>
+
+      {error && <Banner tone="danger" description={error} />}
+
+      {isLoading ? (
+        <div className="portal-integrations__skeleton" aria-hidden>
+          {Array.from({ length: 4 }).map((_, i) => (
+            <Skeleton key={i} height="3.25rem" />
+          ))}
+        </div>
+      ) : (
+        <div className="portal-integrations__table">
+          <div className="portal-integrations__cols" aria-hidden>
+            <span>{t("portal.integrations.table.integration")}</span>
+            <span>{t("portal.integrations.table.worksWith")}</span>
+            <span />
+          </div>
+
+          {connectedGroups.length > 0 && (
+            <div className="portal-integrations__section">
+              {t("portal.integrations.connectedHeading")} ·{" "}
+              {connectedGroups.length}
+            </div>
+          )}
+          {connectedGroups.map(({ type, connections: list }) => {
+            const open = expanded.has(type.id);
+            return (
+              <div key={type.id} className="portal-integrations__group">
+                <button
+                  type="button"
+                  className="portal-integrations__row portal-integrations__row--connected"
+                  aria-expanded={open}
+                  onClick={() => toggleExpand(type.id)}
+                >
+                  <span className="portal-integrations__name">
+                    <BrandMark id={type.id} size={22} />
+                    <span className="portal-integrations__name-text">
+                      <span className="portal-integrations__label">
+                        {t(type.labelKey)}
+                      </span>
+                      <span className="portal-integrations__detail">
+                        {list.length === 1
+                          ? list[0].name
+                          : t("portal.integrations.connectionCount", {
+                              count: list.length,
+                            })}
+                      </span>
+                    </span>
+                  </span>
+                  <span className="portal-integrations__chips">
+                    {worksWith(type).map(chip)}
+                  </span>
+                  <span className="portal-integrations__status">
+                    <span className="portal-integrations__status-dot" />
+                    {t("portal.integrations.status.connected")}
+                    <ExpandMoreRoundedIcon
+                      fontSize="inherit"
+                      className={
+                        "portal-integrations__chevron" +
+                        (open ? " is-open" : "")
+                      }
+                    />
+                  </span>
+                </button>
+                {open && (
+                  <div className="portal-integrations__instances">
+                    {list.map((connection) => (
+                      <div
+                        key={connection.id}
+                        className="portal-integrations__instance"
+                      >
+                        <span className="portal-integrations__instance-name">
+                          {connection.name}
+                        </span>
+                        <span className="portal-integrations__instance-detail">
+                          {connectionDetail(connection)}
+                        </span>
+                        {connection.canManage && (
+                          <span className="portal-integrations__instance-actions">
+                            <Button
+                              variant="tertiary"
+                              size="sm"
+                              disabled={busy}
+                              onClick={() => openEdit(connection)}
+                            >
+                              {t("portal.connections.edit")}
+                            </Button>
+                            <Button
+                              variant="tertiary"
+                              size="sm"
+                              accent="danger"
+                              disabled={busy}
+                              onClick={() => void remove(connection)}
+                            >
+                              {t("portal.connections.delete")}
+                            </Button>
+                          </span>
+                        )}
+                      </div>
+                    ))}
+                    <div className="portal-integrations__instance portal-integrations__instance--add">
+                      <Button
+                        variant="tertiary"
+                        size="sm"
+                        onClick={() => openCreate(type.id)}
+                        leftSection={
+                          <AddRoundedIcon style={{ fontSize: "1rem" }} />
+                        }
+                      >
+                        {t("portal.integrations.addAnother")}
+                      </Button>
+                    </div>
+                  </div>
+                )}
+              </div>
+            );
+          })}
+
+          {availableTypes.length > 0 && (
+            <div className="portal-integrations__section">
+              {t("portal.integrations.availableHeading")} ·{" "}
+              {availableTypes.length}
+            </div>
+          )}
+          {availableTypes.map((type) => (
+            <div key={type.id} className="portal-integrations__row">
+              <span className="portal-integrations__name">
+                <BrandMark id={type.id} size={22} />
+                <span className="portal-integrations__name-text">
+                  <span className="portal-integrations__label">
+                    {t(type.labelKey)}
+                  </span>
+                  <span className="portal-integrations__detail">
+                    {t(type.descriptionKey)}
+                  </span>
+                </span>
+              </span>
+              <span className="portal-integrations__chips">
+                {worksWith(type).map(chip)}
+              </span>
+              <span className="portal-integrations__status">
+                <Button
+                  variant="secondary"
+                  size="sm"
+                  onClick={() => openCreate(type.id)}
+                >
+                  {t("portal.integrations.connect")}
+                </Button>
+              </span>
+            </div>
+          ))}
+
+          {comingSoon.length > 0 && (
+            <div className="portal-integrations__section">
+              {t("portal.integrations.comingSoonHeading")} · {comingSoon.length}
+            </div>
+          )}
+          {comingSoon.map((entry) => (
+            <div
+              key={entry.type}
+              className="portal-integrations__row portal-integrations__row--soon"
+              aria-disabled
+            >
+              <span className="portal-integrations__name">
+                <BrandMark id={entry.type} size={22} />
+                <span className="portal-integrations__name-text">
+                  <span className="portal-integrations__label">
+                    {t(entry.labelKey)}
+                  </span>
+                  <span className="portal-integrations__detail">
+                    {t(entry.descriptionKey)}
+                  </span>
+                </span>
+              </span>
+              <span className="portal-integrations__chips">
+                {chip("sources")}
+              </span>
+              <span className="portal-integrations__status">
+                <span className="portal-integrations__soon-badge">
+                  {t("portal.sources.builder.comingSoon")}
+                </span>
+              </span>
+            </div>
+          ))}
+        </div>
+      )}
+
+      <ConnectionModal
+        open={modal.open}
+        connection={modal.editing}
+        fixedTypeId={modal.fixedTypeId}
+        capabilities={capabilities}
+        onClose={() => setModal({ open: false, editing: null })}
+        onSaved={() => void refresh()}
+      />
+    </div>
+  );
+}
+
+function FilterChip({
+  active,
+  label,
+  count,
+  onClick,
+}: {
+  active: boolean;
+  label: string;
+  count: number;
+  onClick: () => void;
+}) {
+  return (
+    <button
+      type="button"
+      role="tab"
+      aria-selected={active}
+      className={"portal-integrations__filter" + (active ? " is-active" : "")}
+      onClick={onClick}
+    >
+      {label}
+      <span className="portal-integrations__filter-count">{count}</span>
+    </button>
+  );
+}
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.css b/frontend/editor/src/portal/views/PipelineBuilder.css
index b56b199676..f96228d042 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.css
+++ b/frontend/editor/src/portal/views/PipelineBuilder.css
@@ -328,6 +328,10 @@
   font-size: 1.125rem;
 }
 
+.portal-pipelines__picker-icon svg {
+  display: block;
+}
+
 .portal-pipelines__picker-name {
   font-size: 0.8125rem;
 }
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
index 2f7300422f..fe88ad7917 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
@@ -211,10 +211,9 @@ describe("PipelineBuilder", () => {
     fireEvent.click(
       await screen.findByText("portal.connections.picker.createNew"),
     );
-    fireEvent.change(
-      screen.getByLabelText(/portal\.connections\.fields\.name/),
-      { target: { value: "Claims bucket" } },
-    );
+    fireEvent.change(screen.getByLabelText(/portal\.integrations\.typedName/), {
+      target: { value: "Claims bucket" },
+    });
     fireEvent.change(
       screen.getByLabelText(
         /portal\.connections\.types\.s3\.fields\.bucket\.label/,
diff --git a/frontend/editor/src/portal/views/SourceBuilder.css b/frontend/editor/src/portal/views/SourceBuilder.css
deleted file mode 100644
index ec6b9fe4a4..0000000000
--- a/frontend/editor/src/portal/views/SourceBuilder.css
+++ /dev/null
@@ -1,116 +0,0 @@
-.portal-source-builder {
-  display: flex;
-  flex-direction: column;
-  gap: 1.25rem;
-  padding: 1.5rem;
-  max-width: 84rem;
-  margin: 0 auto;
-}
-
-.portal-source-builder__loading {
-  display: flex;
-  justify-content: center;
-  padding: 4rem 0;
-}
-
-.portal-source-builder__head {
-  display: flex;
-  align-items: flex-start;
-  justify-content: space-between;
-  gap: 1rem;
-  flex-wrap: wrap;
-}
-
-.portal-source-builder__head-main {
-  display: flex;
-  flex-direction: column;
-  gap: 0.5rem;
-  align-items: flex-start;
-}
-
-.portal-source-builder__title {
-  font-size: 1.375rem;
-  font-weight: 600;
-  color: var(--c-text);
-  margin: 0;
-}
-
-.portal-source-builder__head-actions {
-  display: flex;
-  align-items: center;
-  gap: 0.625rem;
-}
-
-.portal-source-builder__body {
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-  max-width: 32rem;
-}
-
-.portal-source-builder__type-grid {
-  display: flex;
-  gap: 0.625rem;
-  flex-wrap: wrap;
-}
-
-.portal-source-builder__type-card {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  gap: 0.375rem;
-  min-width: 6rem;
-  padding: 0.875rem 1rem;
-  border: 1px solid var(--color-border-2);
-  border-radius: 0.5rem;
-}
-
-.portal-source-builder__type-card.is-selected {
-  border-color: var(--color-accent, var(--color-brand));
-  background: var(--c-hover);
-}
-
-.portal-source-builder__type-icon {
-  font-size: 1.5rem;
-  line-height: 1;
-}
-
-.portal-source-builder__type-name {
-  font-size: 0.8125rem;
-  font-weight: 500;
-}
-
-.portal-source-builder__delete-actions {
-  display: flex;
-  justify-content: flex-end;
-  gap: 0.5rem;
-}
-
-.portal-source-builder__copy-row {
-  display: flex;
-  gap: 0.5rem;
-  align-items: center;
-}
-
-.portal-source-builder__copy-row > :first-child {
-  flex: 1 1 auto;
-  min-width: 0;
-}
-
-.portal-source-builder__reveal {
-  display: flex;
-  flex-direction: column;
-  gap: 1rem;
-}
-
-.portal-source-builder__muted {
-  margin: 0;
-  font-size: 0.8125rem;
-  color: var(--color-text-4);
-}
-
-.portal-source-builder__type-description {
-  margin: 0;
-  font-size: 0.875rem;
-  color: var(--color-text-3);
-}
diff --git a/frontend/editor/src/portal/views/SourceBuilder.tsx b/frontend/editor/src/portal/views/SourceBuilder.tsx
deleted file mode 100644
index c38eb9f48d..0000000000
--- a/frontend/editor/src/portal/views/SourceBuilder.tsx
+++ /dev/null
@@ -1,501 +0,0 @@
-import { useEffect, useState } from "react";
-import { useNavigate, useParams } from "react-router-dom";
-import { useTranslation } from "react-i18next";
-import ArrowBackRoundedIcon from "@mui/icons-material/ArrowBackRounded";
-import DeleteOutlineRoundedIcon from "@mui/icons-material/DeleteOutlineRounded";
-import {
-  Banner,
-  Button,
-  Checkbox,
-  FormField,
-  Input,
-  Modal,
-  Select,
-  Spinner,
-} from "@app/ui";
-import { errorMessage } from "@portal/api/http";
-import {
-  createSource,
-  deleteSource,
-  fetchSource,
-  isFolderAccessDeniedError,
-  type Source,
-} from "@portal/api/sources";
-import { useUI } from "@portal/contexts/UIContext";
-import { useAsync } from "@portal/hooks/useAsync";
-import { useQueryClient } from "@tanstack/react-query";
-import { qk } from "@portal/queries/keys";
-import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
-import { creatableSourceTypes } from "@portal/components/sources/creatableSourceTypes";
-import {
-  CREATABLE_SOURCE_TYPES,
-  defaultOptions,
-  sourceTypeMeta,
-  WEBHOOK_SOURCE_TYPE,
-  type CreatableSourceType,
-} from "@portal/components/sources/sourceTypes";
-import { S3ConnectionPicker } from "@portal/components/sources/S3ConnectionPicker";
-import "@portal/views/SourceBuilder.css";
-
-function webhookUrl(webhookId: string): string {
-  return `${window.location.origin}/api/v1/webhooks/${webhookId}`;
-}
-
-const OFFERED_TYPES = creatableSourceTypes();
-
-/** A source's stored type resolved to its create-form metadata (edit falls back to any type). */
-function typeFor(type: string | undefined): CreatableSourceType {
-  return (
-    CREATABLE_SOURCE_TYPES.find((t) => t.type === type) ??
-    OFFERED_TYPES[0] ??
-    CREATABLE_SOURCE_TYPES[0]
-  );
-}
-
-/** Stored options coerced to form strings, defaulted from the type's fields. */
-function optionsFor(
-  type: CreatableSourceType,
-  options: Record<string, unknown> | undefined,
-): Record<string, string> {
-  const out = defaultOptions(type);
-  for (const [key, value] of Object.entries(options ?? {})) {
-    out[key] = value == null ? "" : String(value);
-  }
-  return out;
-}
-
-/**
- * Full-page create/edit for a source, mirroring the pipeline builder: new lands
- * on /sources/new (with a type picker), a row opens /sources/:id prefilled.
- * Save and delete navigate back to the Sources list. The virtual editor source
- * is never routed here (the list row is not a link).
- */
-export function SourceBuilder() {
-  const { t } = useTranslation();
-  const navigate = useNavigate();
-  const queryClient = useQueryClient();
-  const { openSettings } = useUI();
-  const { id } = useParams();
-  const isEdit = Boolean(id);
-  const listPath = toPortalPath(VIEW_PATHS.sources);
-
-  // The list is a shared cache entry (Sources view + Home's ProcessorFlow), so
-  // a create/delete here must invalidate it before we navigate back to it.
-  const invalidateSources = () =>
-    queryClient.invalidateQueries({ queryKey: qk.sources() });
-
-  const sourceState = useAsync<Source | null>(
-    async () => (id ? await fetchSource(id) : null),
-    [id],
-  );
-
-  const [type, setType] = useState<CreatableSourceType>(OFFERED_TYPES[0]);
-  const [name, setName] = useState("");
-  const [options, setOptions] = useState<Record<string, string>>(() =>
-    defaultOptions(OFFERED_TYPES[0]),
-  );
-  const [enabled, setEnabled] = useState(true);
-  const [seeded, setSeeded] = useState(false);
-  const [submitting, setSubmitting] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  // A folder-outside-allowed-roots failure: the error banner offers a link to
-  // the Folder Access settings instead of leaving the admin at a dead end.
-  const [folderAccessDenied, setFolderAccessDenied] = useState(false);
-  const [pendingDelete, setPendingDelete] = useState(false);
-  const [deleting, setDeleting] = useState(false);
-  const [reveal, setReveal] = useState<{
-    webhookId: string;
-    secret: string;
-  } | null>(null);
-
-  // Seed once: immediately for a new source, or after the record loads for edit.
-  useEffect(() => {
-    if (seeded) return;
-    if (isEdit && !sourceState.data) return;
-    const source = sourceState.data ?? undefined;
-    const resolved = typeFor(source?.type);
-    setType(resolved);
-    setName(source?.name ?? "");
-    setOptions(optionsFor(resolved, source?.options));
-    setEnabled(source?.enabled ?? true);
-    setSeeded(true);
-  }, [isEdit, sourceState.data, seeded]);
-
-  function chooseType(next: CreatableSourceType) {
-    setType(next);
-    setOptions(defaultOptions(next));
-  }
-
-  function setOption(key: string, value: string) {
-    setOptions((current) => ({ ...current, [key]: value }));
-  }
-
-  const requiredComplete = type.fields.every(
-    (field) => !field.required || (options[field.key] ?? "").trim() !== "",
-  );
-  const canSave = name.trim() !== "" && requiredComplete && !submitting;
-
-  const editingWebhookId =
-    isEdit && sourceState.data?.type === WEBHOOK_SOURCE_TYPE
-      ? String(sourceState.data.options?.webhookId ?? "")
-      : "";
-  const revealUrl = reveal ? webhookUrl(reveal.webhookId) : "";
-  const revealSecret = reveal ? reveal.secret : "";
-
-  function dismissReveal() {
-    setReveal(null);
-    navigate(listPath);
-  }
-
-  async function save() {
-    if (!canSave) return;
-    setSubmitting(true);
-    setError(null);
-    setFolderAccessDenied(false);
-    try {
-      const saved = await createSource({
-        id: isEdit ? id : undefined,
-        name: name.trim(),
-        type: type.type,
-        options,
-        enabled,
-      });
-      await invalidateSources();
-      if (!isEdit && type.type === WEBHOOK_SOURCE_TYPE) {
-        const webhookId = String(saved.options?.webhookId ?? "");
-        const secret = String(saved.options?.signingSecret ?? "");
-        if (webhookId && secret) {
-          setReveal({ webhookId, secret });
-          return;
-        }
-      }
-      navigate(listPath);
-    } catch (e) {
-      setError(errorMessage(e));
-      setFolderAccessDenied(isFolderAccessDeniedError(e));
-      setSubmitting(false);
-    }
-  }
-
-  function copy(text: string) {
-    void navigator.clipboard?.writeText(text);
-  }
-
-  async function confirmDelete() {
-    if (!id || deleting) return;
-    setDeleting(true);
-    try {
-      await deleteSource(id);
-      await invalidateSources();
-      navigate(listPath);
-    } catch (e) {
-      setError(errorMessage(e));
-      setDeleting(false);
-      setPendingDelete(false);
-    }
-  }
-
-  if (isEdit && sourceState.error) {
-    return (
-      <div className="portal-source-builder">
-        <Banner tone="danger" description={errorMessage(sourceState.error)} />
-        <Button variant="tertiary" onClick={() => navigate(listPath)}>
-          {t("portal.sources.builder.back")}
-        </Button>
-      </div>
-    );
-  }
-
-  if (isEdit && !seeded) {
-    return (
-      <div className="portal-source-builder__loading">
-        <Spinner />
-      </div>
-    );
-  }
-
-  return (
-    <div className="portal-source-builder">
-      <header className="portal-source-builder__head">
-        <div className="portal-source-builder__head-main">
-          <Button
-            variant="quiet"
-            size="sm"
-            onClick={() => navigate(listPath)}
-            leftSection={
-              <ArrowBackRoundedIcon style={{ fontSize: "1.125rem" }} />
-            }
-          >
-            {t("portal.sources.builder.back")}
-          </Button>
-          <h1 className="portal-source-builder__title">
-            {isEdit
-              ? name || t("portal.sources.builder.editTitle")
-              : t("portal.sources.builder.createTitle")}
-          </h1>
-        </div>
-        <div className="portal-source-builder__head-actions">
-          <Checkbox
-            checked={enabled}
-            onChange={(e) => setEnabled(e.target.checked)}
-            label={t("portal.sources.builder.enabled")}
-          />
-          {isEdit && (
-            <Button
-              variant="secondary"
-              size="sm"
-              accent="danger"
-              onClick={() => setPendingDelete(true)}
-              leftSection={
-                <DeleteOutlineRoundedIcon style={{ fontSize: "1.125rem" }} />
-              }
-            >
-              {t("portal.sources.builder.delete")}
-            </Button>
-          )}
-          <Button
-            variant="tertiary"
-            size="sm"
-            onClick={() => navigate(listPath)}
-          >
-            {t("portal.sources.builder.cancel")}
-          </Button>
-          <Button size="sm" disabled={!canSave} onClick={() => void save()}>
-            {isEdit
-              ? t("portal.sources.builder.save")
-              : t("portal.sources.builder.create")}
-          </Button>
-        </div>
-      </header>
-
-      <div className="portal-source-builder__body">
-        <FormField label={t("portal.sources.wizard.name")} required>
-          <Input
-            value={name}
-            placeholder={t("portal.sources.wizard.namePlaceholder")}
-            onChange={(e) => setName(e.target.value)}
-          />
-        </FormField>
-
-        {!isEdit && OFFERED_TYPES.length > 1 && (
-          <FormField label={t("portal.sources.wizard.type")}>
-            <div className="portal-source-builder__type-grid">
-              {OFFERED_TYPES.map((ct) => (
-                <Button
-                  key={ct.type}
-                  variant="tertiary"
-                  className={
-                    "portal-source-builder__type-card" +
-                    (type.type === ct.type ? " is-selected" : "")
-                  }
-                  onClick={() => chooseType(ct)}
-                >
-                  <span
-                    className="portal-source-builder__type-icon"
-                    aria-hidden
-                  >
-                    {sourceTypeMeta(ct.type).icon}
-                  </span>
-                  <span className="portal-source-builder__type-name">
-                    {t(ct.labelKey)}
-                  </span>
-                </Button>
-              ))}
-            </div>
-          </FormField>
-        )}
-
-        {!isEdit && (
-          <p className="portal-source-builder__type-description">
-            {t(type.descriptionKey)}
-          </p>
-        )}
-
-        {!isEdit && type.type === WEBHOOK_SOURCE_TYPE && (
-          <p className="portal-source-builder__muted">
-            {t("portal.sources.types.webhook.createNote")}
-          </p>
-        )}
-
-        {type.fields.map((field) => (
-          <FormField
-            key={field.key}
-            label={t(field.labelKey)}
-            helperText={
-              field.helperTextKey ? t(field.helperTextKey) : undefined
-            }
-            required={field.required}
-          >
-            {field.control === "s3Connection" ? (
-              <S3ConnectionPicker
-                value={options[field.key] ?? ""}
-                onChange={(connectionId) => setOption(field.key, connectionId)}
-              />
-            ) : field.control === "select" ? (
-              <Select
-                value={options[field.key] ?? ""}
-                options={(field.options ?? []).map((o) => ({
-                  value: o.value,
-                  label: t(o.labelKey),
-                }))}
-                onChange={(value) => setOption(field.key, value ?? "")}
-              />
-            ) : (
-              <Input
-                type={field.control === "password" ? "password" : undefined}
-                value={options[field.key] ?? ""}
-                placeholder={
-                  field.placeholderKey ? t(field.placeholderKey) : undefined
-                }
-                onChange={(e) => setOption(field.key, e.target.value)}
-              />
-            )}
-          </FormField>
-        ))}
-
-        {editingWebhookId && (
-          <FormField
-            label={t("portal.sources.types.webhook.detail.deliveryUrl")}
-            helperText={t("portal.sources.types.webhook.detail.secretNote")}
-          >
-            <div className="portal-source-builder__copy-row">
-              <Input
-                value={webhookUrl(editingWebhookId)}
-                readOnly
-                onFocus={(e) => e.currentTarget.select()}
-              />
-              <Button
-                variant="tertiary"
-                size="sm"
-                onClick={() => copy(webhookUrl(editingWebhookId))}
-              >
-                {t("portal.sources.types.webhook.reveal.copy")}
-              </Button>
-            </div>
-          </FormField>
-        )}
-
-        {error &&
-          (folderAccessDenied ? (
-            <Banner
-              tone="danger"
-              title={t(
-                "portal.sources.builder.folderAccess.title",
-                "This folder isn't allowed",
-              )}
-              description={t(
-                "portal.sources.builder.folderAccess.description",
-                "Folder automations can only use folders an administrator has allowed. Add it under Folder Access settings, then try again.",
-              )}
-              action={
-                <Button
-                  variant="secondary"
-                  size="sm"
-                  onClick={() => openSettings("adminFolderAccess")}
-                >
-                  {t(
-                    "portal.sources.builder.folderAccess.openSettings",
-                    "Folder Access settings",
-                  )}
-                </Button>
-              }
-            />
-          ) : (
-            <Banner tone="danger" description={error} />
-          ))}
-      </div>
-
-      <Modal
-        open={pendingDelete}
-        onClose={() => !deleting && setPendingDelete(false)}
-        width="sm"
-        title={t("portal.sources.delete.title")}
-        footer={
-          <div className="portal-source-builder__delete-actions">
-            <Button
-              variant="tertiary"
-              size="sm"
-              disabled={deleting}
-              onClick={() => setPendingDelete(false)}
-            >
-              {t("portal.sources.delete.cancel")}
-            </Button>
-            <Button
-              size="sm"
-              accent="danger"
-              loading={deleting}
-              onClick={() => void confirmDelete()}
-            >
-              {t("portal.sources.delete.confirm")}
-            </Button>
-          </div>
-        }
-      >
-        <p>{t("portal.sources.delete.body", { name })}</p>
-      </Modal>
-
-      <Modal
-        open={reveal !== null}
-        onClose={dismissReveal}
-        width="md"
-        title={t("portal.sources.types.webhook.reveal.title")}
-        footer={
-          <div className="portal-source-builder__delete-actions">
-            <Button size="sm" onClick={dismissReveal}>
-              {t("portal.sources.types.webhook.reveal.done")}
-            </Button>
-          </div>
-        }
-      >
-        {reveal && (
-          <div className="portal-source-builder__reveal">
-            <Banner
-              tone="warning"
-              description={t(
-                "portal.sources.types.webhook.reveal.secretWarning",
-              )}
-            />
-            <FormField label={t("portal.sources.types.webhook.reveal.url")}>
-              <div className="portal-source-builder__copy-row">
-                <Input
-                  value={revealUrl}
-                  readOnly
-                  onFocus={(e) => e.currentTarget.select()}
-                />
-                <Button
-                  variant="tertiary"
-                  size="sm"
-                  onClick={() => copy(revealUrl)}
-                >
-                  {t("portal.sources.types.webhook.reveal.copy")}
-                </Button>
-              </div>
-            </FormField>
-            <FormField
-              label={t("portal.sources.types.webhook.reveal.secret")}
-              helperText={t("portal.sources.types.webhook.reveal.secretHelp")}
-            >
-              <div className="portal-source-builder__copy-row">
-                <Input
-                  value={revealSecret}
-                  readOnly
-                  onFocus={(e) => e.currentTarget.select()}
-                />
-                <Button
-                  variant="tertiary"
-                  size="sm"
-                  onClick={() => copy(revealSecret)}
-                >
-                  {t("portal.sources.types.webhook.reveal.copy")}
-                </Button>
-              </div>
-            </FormField>
-            <p className="portal-source-builder__muted">
-              {t("portal.sources.types.webhook.reveal.usage")}
-            </p>
-          </div>
-        )}
-      </Modal>
-    </div>
-  );
-}
diff --git a/frontend/editor/src/portal/views/Sources.css b/frontend/editor/src/portal/views/Sources.css
index 0fd4646f17..5ca4064e65 100644
--- a/frontend/editor/src/portal/views/Sources.css
+++ b/frontend/editor/src/portal/views/Sources.css
@@ -61,6 +61,8 @@
   color: var(--c-text);
 }
 
+/* The connector's real mark, no tinted plate: the box only reserves space so
+   rows align; neutral (currentColor) marks read in the muted text tone. */
 .portal-sources__type-dot {
   display: inline-flex;
   align-items: center;
@@ -68,41 +70,8 @@
   width: 1.875rem;
   height: 1.875rem;
   flex-shrink: 0;
-  border-radius: var(--radius-md);
-  font-size: 0.875rem;
-  color: var(--dot-c, var(--c-text-subtle));
-  background: color-mix(
-    in srgb,
-    var(--dot-c, var(--c-text-subtle)) 14%,
-    transparent
-  );
-}
-
-/* Neutral keeps a plain muted surface rather than an accent tint. */
-.portal-sources__type-dot--neutral {
-  background: var(--c-surface-sunken);
   color: var(--c-text-subtle);
 }
-.portal-sources__type-dot--default {
-  --dot-c: var(--c-primary-hover);
-}
-.portal-sources__type-dot--premium {
-  --dot-c: var(--color-purple-dark);
-}
-.portal-sources__type-dot--success {
-  --dot-c: var(--color-green-dark);
-}
-.portal-sources__type-dot--warning {
-  --dot-c: var(--color-amber-dark);
-}
-/* Dark: subtle tint + bright icon; amber-light/amber-dark are too close to read. */
-[data-theme="dark"] .portal-sources__type-dot--warning {
-  background: color-mix(in srgb, var(--color-amber) 20%, transparent);
-  color: var(--color-amber);
-}
-.portal-sources__type-dot--danger {
-  --dot-c: var(--color-red-dark);
-}
 
 .portal-sources__muted {
   font-size: 0.8125rem;
@@ -453,10 +422,10 @@
   height: 1.6rem;
 }
 
-/* Sized to sit centred inside the 1.875rem table badge / picker dot. */
+/* Sized to sit centred inside the 1.875rem table cell / picker dot. */
 .portal-sources__type-svg {
-  width: 1.05rem;
-  height: 1.05rem;
+  width: 1.25rem;
+  height: 1.25rem;
   display: block;
 }
 
@@ -750,44 +719,19 @@
   border-style: dashed;
 }
 
+/* The vendor's real mark: full colour, no tinted plate behind it. Neutral
+   (currentColor) marks pick up the muted text tone instead. */
 .portal-conn-picker__mark {
   flex: none;
   display: grid;
   place-items: center;
-  width: 1.75rem;
-  height: 1.75rem;
-  border-radius: var(--radius-sm, 0.375rem);
-  background: color-mix(in srgb, var(--c-conn-accent) 14%, transparent);
-  color: var(--c-conn-accent);
-  font-size: 0.875rem;
-  font-weight: 600;
+  width: 1.5rem;
+  height: 1.5rem;
+  color: var(--c-text-subtle);
 }
 
-/* One hue per category. Muted on purpose - these sit 60-odd to a page, and saturated marks would
-   turn the grid into confetti. */
-.portal-conn-picker__mark--storage {
-  background: color-mix(in srgb, var(--c-conn-storage) 16%, transparent);
-  color: var(--c-conn-storage);
-}
-
-.portal-conn-picker__mark--signing {
-  background: color-mix(in srgb, var(--c-conn-signing) 18%, transparent);
-  color: var(--c-conn-signing);
-}
-
-.portal-conn-picker__mark--security {
-  background: color-mix(in srgb, var(--c-conn-accent) 16%, transparent);
-  color: var(--c-conn-accent);
-}
-
-.portal-conn-picker__mark--notify {
-  background: color-mix(in srgb, var(--c-conn-notify) 18%, transparent);
-  color: var(--c-conn-notify);
-}
-
-.portal-conn-picker__mark--advanced {
-  background: color-mix(in srgb, var(--c-conn-neutral) 16%, transparent);
-  color: var(--c-text-muted);
+.portal-conn-picker__mark svg {
+  display: block;
 }
 
 .portal-conn-picker__card-text {
diff --git a/frontend/editor/src/portal/views/Sources.test.tsx b/frontend/editor/src/portal/views/Sources.test.tsx
index f4a52b5665..d4d4b0137f 100644
--- a/frontend/editor/src/portal/views/Sources.test.tsx
+++ b/frontend/editor/src/portal/views/Sources.test.tsx
@@ -6,11 +6,21 @@ import {
 } from "@testing-library/react";
 import { PortalTestProviders } from "@portal/test/TestQueryProvider";
 import { MemoryRouter, Route, Routes } from "react-router-dom";
+import type { ReactNode } from "react";
 import type { SourcesResponse } from "@portal/api/sources";
 import { Sources } from "@portal/views/Sources";
+import { UIProvider } from "@portal/contexts/UIContext";
+
+// The view uses the shared query hooks and the embedded SourceModal reads
+// useUI(), so wrap the query client + Mantine + the UI context.
+const Providers = ({ children }: { children: ReactNode }) => (
+  <PortalTestProviders>
+    <UIProvider>{children}</UIProvider>
+  </PortalTestProviders>
+);
 
 const render = (ui: Parameters<typeof baseRender>[0]) =>
-  baseRender(ui, { wrapper: PortalTestProviders });
+  baseRender(ui, { wrapper: Providers });
 
 // Deterministic i18n: keys returned verbatim.
 vi.mock("react-i18next", () => ({
@@ -21,8 +31,13 @@ vi.mock("react-i18next", () => ({
 }));
 
 const fetchSources = vi.fn();
+const fetchSource = vi.fn();
 vi.mock("@portal/api/sources", () => ({
   fetchSources: () => fetchSources(),
+  fetchSource: (id: string) => fetchSource(id),
+  createSource: vi.fn(),
+  deleteSource: vi.fn(),
+  isFolderAccessDeniedError: () => false,
 }));
 
 const fetchS3Connections = vi.fn();
@@ -74,12 +89,8 @@ function renderView(initial = "/processor/sources") {
       <Routes>
         <Route path="/processor/sources" element={<Sources />} />
         <Route
-          path="/processor/sources/new"
-          element={<div>source builder: new</div>}
-        />
-        <Route
-          path="/processor/sources/:id"
-          element={<div>source builder: edit</div>}
+          path="/processor/integrations"
+          element={<div>integrations view</div>}
         />
       </Routes>
     </MemoryRouter>,
@@ -90,42 +101,61 @@ describe("Sources view", () => {
   beforeEach(() => {
     fetchSources.mockReset();
     fetchSources.mockResolvedValue(RESPONSE);
+    fetchSource.mockReset();
+    fetchSource.mockResolvedValue({
+      id: "src-1",
+      name: "Claims intake",
+      type: "folder",
+      options: { directory: "/in" },
+      enabled: true,
+    });
     fetchS3Connections.mockReset();
     fetchS3Connections.mockResolvedValue([]);
   });
 
-  it("opens a source's own page on row click", async () => {
+  it("opens the edit modal on row click", async () => {
     renderView();
     fireEvent.click(await screen.findByText("Claims intake"));
-    expect(await screen.findByText("source builder: edit")).toBeInTheDocument();
+    // The modal fetches the record and shows the configure form.
+    expect(
+      await screen.findByText("portal.sources.builder.save"),
+    ).toBeInTheDocument();
+    expect(fetchSource).toHaveBeenCalledWith("src-1");
   });
 
-  it("navigates to the create page from the connect button", async () => {
+  it("opens the create modal from the connect button", async () => {
     renderView();
     await screen.findByText("Claims intake");
-    fireEvent.click(screen.getByText("portal.sources.actions.connectSource"));
-    expect(await screen.findByText("source builder: new")).toBeInTheDocument();
+    fireEvent.click(
+      screen.getAllByText("portal.sources.actions.connectSource")[0],
+    );
+    // Stage 1 of the modal: the connector catalogue with coming-soon entries.
+    expect(
+      await screen.findByText("portal.sources.types.sharepoint.label"),
+    ).toBeInTheDocument();
   });
 
-  it("does not navigate when the virtual editor row is clicked", async () => {
+  it("opens the create modal on arrival with ?new=1", async () => {
+    renderView("/processor/sources?new=1");
+    expect(
+      await screen.findByText("portal.sources.types.sharepoint.label"),
+    ).toBeInTheDocument();
+  });
+
+  it("does not open the modal when the virtual editor row is clicked", async () => {
     renderView();
     fireEvent.click(
       await screen.findByText("portal.sources.types.editor.label"),
     );
-    // Still on the list: the builder stub never rendered.
-    expect(screen.queryByText("source builder: edit")).not.toBeInTheDocument();
-    expect(screen.getByText("Claims intake")).toBeInTheDocument();
+    expect(fetchSource).not.toHaveBeenCalled();
+    expect(
+      screen.queryByText("portal.sources.builder.save"),
+    ).not.toBeInTheDocument();
   });
 
-  it("shows the connections surface on the Connections tab", async () => {
-    renderView();
-    await screen.findByText("Claims intake");
-    fireEvent.click(screen.getByText("portal.sources.tabs.connections"));
-    // Empty connections list -> the connections empty state.
-    expect(
-      await screen.findByText("portal.connections.empty.title"),
-    ).toBeInTheDocument();
-    expect(fetchS3Connections).toHaveBeenCalled();
+  it("redirects the old connections tab to the integrations view", async () => {
+    renderView("/processor/sources?tab=connections");
+    expect(await screen.findByText("integrations view")).toBeInTheDocument();
   });
 
   it("hides the KPI strip and shows the empty state when only the editor exists", async () => {
@@ -137,8 +167,6 @@ describe("Sources view", () => {
     expect(
       await screen.findByText("portal.sources.empty.title"),
     ).toBeInTheDocument();
-    expect(
-      screen.queryByText("portal.sources.kpi.total"),
-    ).not.toBeInTheDocument();
+    expect(screen.queryByText("portal.sources.kpi.total")).toBeNull();
   });
 });
diff --git a/frontend/editor/src/portal/views/Sources.tsx b/frontend/editor/src/portal/views/Sources.tsx
index 6013e00d79..dd449e71c8 100644
--- a/frontend/editor/src/portal/views/Sources.tsx
+++ b/frontend/editor/src/portal/views/Sources.tsx
@@ -1,7 +1,8 @@
+import { useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
-import { useNavigate, useSearchParams } from "react-router-dom";
+import { Navigate, useSearchParams } from "react-router-dom";
 import AddRoundedIcon from "@mui/icons-material/AddRounded";
-import { Button, EmptyState, Skeleton, Tabs } from "@app/ui";
+import { Button, EmptyState, Skeleton } from "@app/ui";
 import { useSectionFlags } from "@portal/hooks/useAsync";
 import { useSources } from "@portal/queries/sources";
 import { SourcesIcon } from "@portal/components/icons";
@@ -9,37 +10,46 @@ import { type SourceView } from "@portal/api/sources";
 import { VIEW_PATHS, toPortalPath } from "@portal/contexts/ViewContext";
 import { KpiStrip } from "@portal/components/sources/KpiStrip";
 import { SourcesTable } from "@portal/components/sources/SourcesTable";
-import { ConnectionsTab } from "@portal/components/sources/ConnectionsTab";
+import { SourceModal } from "@portal/components/sources/SourceModal";
 import "@portal/views/Sources.css";
 
-type SourcesTab = "sources" | "connections";
-
 export function Sources() {
   const { t } = useTranslation();
-  const navigate = useNavigate();
   const [searchParams, setSearchParams] = useSearchParams();
-  const activeTab: SourcesTab =
-    searchParams.get("tab") === "connections" ? "connections" : "sources";
 
   const state = useSources();
   const { data, loading } = state;
   const { isLoading } = useSectionFlags(state);
 
+  // Create/edit live in a modal on this list; `?new=1` (old /sources/new deep
+  // links redirect here with it) opens the create flow on arrival.
+  const [modal, setModal] = useState<{
+    open: boolean;
+    sourceId: string | null;
+  }>({ open: false, sourceId: null });
+
+  useEffect(() => {
+    if (searchParams.get("new") !== "1") return;
+    setModal({ open: true, sourceId: null });
+    const next = new URLSearchParams(searchParams);
+    next.delete("new");
+    setSearchParams(next, { replace: true });
+  }, [searchParams, setSearchParams]);
+
   const sources = data?.sources ?? [];
+
   // The editor is a virtual row that's always present, so "empty" means no
   // configured sources beyond it. Gates the KPI strip and empty panel.
   const configuredCount = sources.filter((s) => s.type !== "editor").length;
   const showEmpty = !isLoading && configuredCount === 0;
 
-  const openCreate = () => navigate(`${toPortalPath(VIEW_PATHS.sources)}/new`);
+  const openCreate = () => setModal({ open: true, sourceId: null });
   const openSource = (source: SourceView) =>
-    navigate(`${toPortalPath(VIEW_PATHS.sources)}/${source.id}`);
+    setModal({ open: true, sourceId: source.id });
 
-  function selectTab(tab: SourcesTab) {
-    const next = new URLSearchParams(searchParams);
-    if (tab === "sources") next.delete("tab");
-    else next.set("tab", tab);
-    setSearchParams(next, { replace: true });
+  // The Connections tab moved to its own Integrations view.
+  if (searchParams.get("tab") === "connections") {
+    return <Navigate to={toPortalPath(VIEW_PATHS.integrations)} replace />;
   }
 
   return (
@@ -49,66 +59,51 @@ export function Sources() {
           <h1 className="portal-sources__title">{t("portal.sources.title")}</h1>
           <p className="portal-sources__sub">{t("portal.sources.subtitle")}</p>
         </div>
-        {activeTab === "sources" && (
-          <div className="portal-sources__actions">
+        <div className="portal-sources__actions">
+          <Button
+            onClick={openCreate}
+            leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
+          >
+            {t("portal.sources.actions.connectSource")}
+          </Button>
+        </div>
+      </header>
+
+      {!showEmpty && <KpiStrip data={data} loading={loading} />}
+
+      {isLoading && (
+        <div className="portal-sources__table-skeleton" aria-hidden>
+          {Array.from({ length: 5 }).map((_, i) => (
+            <Skeleton key={i} height="3rem" />
+          ))}
+        </div>
+      )}
+
+      {showEmpty && (
+        <EmptyState
+          icon={<SourcesIcon size={28} />}
+          title={t("portal.sources.empty.title")}
+          description={t("portal.sources.empty.description")}
+          actions={
             <Button
               onClick={openCreate}
               leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
             >
               {t("portal.sources.actions.connectSource")}
             </Button>
-          </div>
-        )}
-      </header>
-
-      <Tabs<SourcesTab>
-        variant="underline"
-        ariaLabel={t("portal.sources.title")}
-        activeKey={activeTab}
-        onChange={selectTab}
-        items={[
-          { key: "sources", label: t("portal.sources.tabs.sources") },
-          { key: "connections", label: t("portal.sources.tabs.connections") },
-        ]}
-      />
-
-      {activeTab === "connections" ? (
-        <ConnectionsTab />
-      ) : (
-        <>
-          {!showEmpty && <KpiStrip data={data} loading={loading} />}
-
-          {isLoading && (
-            <div className="portal-sources__table-skeleton" aria-hidden>
-              {Array.from({ length: 5 }).map((_, i) => (
-                <Skeleton key={i} height="3rem" />
-              ))}
-            </div>
-          )}
-
-          {showEmpty && (
-            <EmptyState
-              icon={<SourcesIcon size={28} />}
-              title={t("portal.sources.empty.title")}
-              description={t("portal.sources.empty.description")}
-              actions={
-                <Button
-                  onClick={openCreate}
-                  leftSection={
-                    <AddRoundedIcon style={{ fontSize: "1.125rem" }} />
-                  }
-                >
-                  {t("portal.sources.actions.connectSource")}
-                </Button>
-              }
-            />
-          )}
-
-          {!isLoading && sources.length > 0 && (
-            <SourcesTable sources={sources} onRowClick={openSource} />
-          )}
-        </>
+          }
+        />
       )}
+
+      {!isLoading && sources.length > 0 && (
+        <SourcesTable sources={sources} onRowClick={openSource} />
+      )}
+
+      <SourceModal
+        open={modal.open}
+        sourceId={modal.sourceId}
+        onClose={() => setModal({ open: false, sourceId: null })}
+      />
     </div>
   );
 }
diff --git a/frontend/eslint.config.mjs b/frontend/eslint.config.mjs
index 76daf03315..d2853d8f1e 100644
--- a/frontend/eslint.config.mjs
+++ b/frontend/eslint.config.mjs
@@ -269,11 +269,15 @@ export default defineConfig(
     },
   },
   // TEMPORARY (same rationale as procurement above): the connection/operation catalogues render
-  // bespoke preset tiles (tinted monogram + two-line text). Raw-<button> rule only; migrate later.
+  // bespoke preset tiles (brand mark + two-line text), and the integrations
+  // page adds the same tiles as full-width expandable rows plus filter chips.
+  // Raw-<button> rule only; migrate later.
   {
     files: [
       "editor/src/portal/components/sources/ConnectionTypePicker.tsx",
+      "editor/src/portal/components/sources/SourceModal.tsx",
       "editor/src/portal/components/policies/PolicyExternalApiConfig.tsx",
+      "editor/src/portal/views/Integrations.tsx",
     ],
     rules: {
       "no-restricted-syntax": ["error", ...mantineComponentImportRestrictions],

From 3813ca360ea0e146379c477c6d13b48f689773c6 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Fri, 24 Jul 2026 13:53:16 +0100
Subject: [PATCH 095/109] PAYG prepaid usage bundles (#7032)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Prepaid usage bundles

Teams on pay‑as‑you‑go can **buy a year of PDF processing up front, at a
discount** — *"12 months for the price of 10."* You pre‑buy a pool of
credits; they're spent **before** any metered billing and sit
**outside** the monthly spend limit; unused capacity expires after 12
months.

---

## What this PR delivers

**Buy → quote → invoice → pay (Stripe‑Quotes‑native).**
- A team lead sizes the pool in the calculator (persisted as a quote
row), which doubles as the quote page with a **"Download quote (PDF)"**
— the PDF is **Stripe's own rendered quote** (same mechanism procurement
uses), not an app‑generated document.
- **Finalise** turns the accepted quote into an invoice; the lead can
**download the invoice** or **pay online** (Stripe hosted invoice).
**Card and bank‑transfer / PO** are both supported (payment‑method
fork), on net terms.
- The billing page loads the in‑flight quote/invoice on open, so the CTA
resumes the right step (**View quote** / **Pay invoice to complete**)
and offers **Cancel purchase** (voids the invoice + quote and restarts).

**Prepaid is usable on its own — no subscription required.** The
entitlement gate honours a live prepaid pool in both cases:
- *Unsubscribed*: once the one‑time free grant is spent, a live pool
keeps the team **fully entitled** (all feature gates) rather than
degraded.
- *Subscribed*: a team **at/over its metered cap** but holding a live
pool stays fully entitled — prepaid draws are netted out of metered
spend, so the pool genuinely sits outside the cap.

Only when the free grant **and** the prepaid pool are both empty do
billable categories stop.

**Coordinated SaaS change (ships with this — `Stirling-PDF-SaaS` `v3`
branch):** the `invoice.paid` webhook credits the pool idempotently
(keyed on the invoice id) and settles the quote. Metered‑subscription
provisioning is best‑effort and **classified** — a permanent Stripe 4xx
(the single‑use hosted‑invoice card can't be attached) is a claimed
no‑op (HTTP 200, no retry) so Stripe doesn't redeliver forever; only
transient errors (5xx / connection / rate‑limit) retry. A failed credit
now retries rather than silently dropping a paid bundle.

### Flow

1. Lead sizes the pool and agrees to the terms → the browser sends team
+ capacity + consent, **never a price**.
2. A leader‑gated server function looks up the price and creates a
Stripe **quote** (line quantity = capacity).
3. Lead **finalises** → the quote becomes a Stripe **invoice**; download
it or pay online (card or bank transfer).
4. On `invoice.paid`, the webhook **credits the prepaid pool**
(idempotent) and settles the quote.
5. Usage then draws **free grant → prepaid pool → meter**; the pool is
usable with no subscription.

<img width="1280" height="920" alt="01-activation-fork"
src="https://github.com/user-attachments/assets/e8981dc7-809d-4fc5-bfde-71e619096b7b"
/>
<img width="1280" height="920" alt="02-calculator"
src="https://github.com/user-attachments/assets/81f6b886-1797-4c54-ba18-97d126be78e2"
/>
<img width="1120" height="600" alt="03-free-plan"
src="https://github.com/user-attachments/assets/c4057fde-d965-47dd-93e8-f2f0f612aa73"
/>
<img width="1105" height="1285" alt="04-subscribed-prepaid"
src="https://github.com/user-attachments/assets/9d1d0ef1-29d0-4bd4-9c17-ac5f68f88ca8"
/>


---

## In a follow‑up (not this PR)

1. **Authoritative price via an inline fixed‑amount coupon** *(in
progress in a separate PR).* Replace the percentage 12‑for‑10 coupon
with an edge‑function‑computed **`amount_off`** coupon: the invoice
shows a concrete "−$X.00" discount line, the total is deterministic (no
percentage‑rounding drift), and the persisted price becomes
**server‑authoritative**. Money‑mechanism change — needs validation
against the Stripe test env, so it warrants its own testable PR.
2. **Metered auto‑resume when the pool empties.** Save the paying card
at invoice time (`setup_future_usage`) for card payers → real
`charge_automatically`; a cardless `send_invoice` subscription for
bank‑transfer / PO. This makes the "processing continues at the metered
rate" promise true for everyone.
3. **Provisioning idempotency hardening** (SaaS repo). Idempotency key
on subscription creation + a conditional link RPC, so a webhook
redelivery or link‑RPC failure can't create duplicate or orphaned
subscriptions.
4. **Repo‑wide "credits" copy** across *all* of usage & billing (this PR
only makes its own additions consistent).

---

## Known edges (current state)

- **Cardless teams degrade when the pool empties.** An unsubscribed
bundle team that runs the pool dry hits DEGRADED (metered paused), not
automatic metered continuation — because no metered subscription gets
provisioned off a hosted‑invoice card. The consent copy states
processing "continues at the metered rate"; that promise is
intentionally **ahead of the mechanism** (follow‑up 2), and the 12‑month
term is the runway to deliver it. The prepaid capacity itself stays
fully usable in the meantime.
- **In‑app total vs charge can differ by ≤1¢** until follow‑up 1 lands.
The **shared approval document (the Stripe quote PDF) and the actual
invoice are already Stripe‑authoritative**; the persisted price shown
in‑app is still a front‑end estimate (percentage‑coupon rounding), so it
can differ from Stripe by a rounding cent. Resume‑time drift is fixed
(frozen to persisted); exact‑to‑the‑penny parity arrives with the
authoritative‑price follow‑up.
- **Provisioning idempotency is latent, not live.** The
duplicate/orphan‑subscription window only becomes reachable once
card‑linking (follow‑up 2) makes provisioning actually run; hardening is
tracked as follow‑up 3.
- **One job can overshoot the spend cap via a near‑empty pool.** A
subscribed team that has hit its metered cap but still holds a
*nearly‑exhausted* pool is let through (the pool overrides the cap
gate); if a job needs more than the pool has left, the pool drains to
zero and the **remainder meters**, so that single job's remainder can
bill just past the "never past your spend limit" ceiling. Bounded to one
job's overshoot and only at the pool's tail; the alternative — blocking
the job — would strand paid‑for capacity, so this is a deliberate trade.

---

## Testing

- **Java** — `EntitlementServiceTest` (18) incl.
unsubscribed‑live‑pool‑stays‑FULL,
subscribed‑over‑cap‑with‑pool‑stays‑FULL, and lazy‑read guards.
- **Frontend** — `useBundleFlowState` + `Usage` render tests; portal &
SaaS `tsc`; i18n audit; `lint:colors`; toml‑sort; prettier.
- **SaaS webhook** (`v3`) — Deno tests for terminal‑vs‑transient
provisioning classification (rate‑limit treated as retryable),
credit‑error‑retries, and an end‑to‑end no‑storm assertion on the
unusable‑card path.

*Preview:* the checkout runs in a Supabase function in
`Stirling-PDF-SaaS` (`v3`); a live V2 preview is linked in the
auto‑deploy comment below. Screenshots to be refreshed — the checkout
modal changed since the originals.
---
 .../software/saas/config/SaasJpaConfig.java   |    1 +
 .../saas/payg/api/PaygWalletController.java   |   33 +-
 .../saas/payg/api/WalletSnapshotResponse.java |   15 +-
 .../saas/payg/bundle/PrepaidBundle.java       |  105 ++
 .../payg/bundle/PrepaidBundleRepository.java  |   55 +
 .../payg/bundle/PrepaidBundleService.java     |  148 ++
 .../saas/payg/charge/JobChargeService.java    |   77 +-
 .../charge/SaasClassificationRunBiller.java   |    4 +-
 .../payg/entitlement/EntitlementService.java  |   58 +-
 .../saas/payg/policy/PricingPolicy.java       |   13 +
 .../saas/payg/shadow/PaygShadowCharge.java    |   14 +
 .../saas/config/SaasJpaConfigScanTest.java    |    5 +-
 .../payg/api/PaygWalletControllerTest.java    |    5 +-
 .../payg/api/WalletSnapshotResponseTest.java  |   12 +-
 .../payg/bundle/PrepaidBundleServiceTest.java |  172 ++
 .../payg/charge/JobChargeServiceTest.java     |   44 +-
 .../entitlement/EntitlementServiceTest.java   |  120 +-
 .../public/locales/en-US/translation.toml     |  156 +-
 .../shared/config/configSections/Payg.tsx     |  101 +-
 .../config/configSections/SpendCapControl.tsx |    4 +-
 .../config/configSections/UpgradeModal.css    |    7 +
 .../config/configSections/usageMeters.tsx     |   77 +-
 frontend/editor/src/cloud/hooks/useWallet.ts  |    6 +-
 .../editor/src/portal/billing/stripe.test.ts  |  292 +++-
 frontend/editor/src/portal/billing/stripe.ts  |  355 ++++-
 .../billing/ActivationChoiceModal.stories.tsx |   20 +
 .../billing/ActivationChoiceModal.tsx         |  119 ++
 .../billing/BundleCheckoutModal.stories.tsx   |   45 +
 .../billing/BundleCheckoutModal.tsx           | 1393 +++++++++++++++++
 .../components/billing/CardPlaceholder.tsx    |   34 +
 .../components/billing/FreePlanView.tsx       |   86 +-
 .../billing/PrepaidCapacityCard.tsx           |  109 ++
 .../components/billing/PrepayModalHeader.tsx  |   91 ++
 .../billing/StripeCheckoutModal.tsx           |  372 +++--
 .../billing/SubscribedPlanView.stories.tsx    |   18 +-
 .../components/billing/SubscribedPlanView.tsx |   20 +
 .../src/portal/components/billing/billing.css |  555 ++++++-
 .../components/billing/walletFixtures.ts      |   21 +
 .../portal/hooks/useBundleFlowState.test.tsx  |  107 ++
 .../src/portal/hooks/useBundleFlowState.ts    |   75 +
 .../src/proprietary/billing/format.test.ts    |  105 ++
 .../editor/src/proprietary/billing/format.ts  |  198 +++
 .../editor/src/proprietary/billing/index.ts   |   15 +
 .../editor/src/proprietary/billing/types.ts   |    8 +
 .../shared/FreeLimitReachedModal.test.tsx     |    4 +
 .../editor/src/saas/hooks/walletDevPreview.ts |    6 +
 46 files changed, 5027 insertions(+), 253 deletions(-)
 create mode 100644 app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundle.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundleRepository.java
 create mode 100644 app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundleService.java
 create mode 100644 app/saas/src/test/java/stirling/software/saas/payg/bundle/PrepaidBundleServiceTest.java
 create mode 100644 frontend/editor/src/portal/components/billing/ActivationChoiceModal.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/ActivationChoiceModal.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/BundleCheckoutModal.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/CardPlaceholder.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/PrepayModalHeader.tsx
 create mode 100644 frontend/editor/src/portal/hooks/useBundleFlowState.test.tsx
 create mode 100644 frontend/editor/src/portal/hooks/useBundleFlowState.ts
 create mode 100644 frontend/editor/src/proprietary/billing/format.test.ts

diff --git a/app/saas/src/main/java/stirling/software/saas/config/SaasJpaConfig.java b/app/saas/src/main/java/stirling/software/saas/config/SaasJpaConfig.java
index 53a5f34c15..cd991cc44e 100644
--- a/app/saas/src/main/java/stirling/software/saas/config/SaasJpaConfig.java
+++ b/app/saas/src/main/java/stirling/software/saas/config/SaasJpaConfig.java
@@ -19,6 +19,7 @@ import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
             "stirling.software.saas.billing.repository",
             "stirling.software.saas.ai.repository",
             "stirling.software.saas.payg.repository",
+            "stirling.software.saas.payg.bundle",
             "stirling.software.saas.procurement.repository"
         })
 @EntityScan({
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java b/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java
index 18da81ae2b..2ab19ad4cb 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java
@@ -41,6 +41,7 @@ import stirling.software.saas.payg.api.WalletSnapshotResponse.CategoryBreakdown;
 import stirling.software.saas.payg.api.WalletSnapshotResponse.MemberRow;
 import stirling.software.saas.payg.billing.TeamBillingContext;
 import stirling.software.saas.payg.billing.TeamBillingService;
+import stirling.software.saas.payg.bundle.PrepaidBundleService;
 import stirling.software.saas.payg.entitlement.EntitlementService;
 import stirling.software.saas.payg.entitlement.EntitlementSnapshot;
 import stirling.software.saas.payg.model.BillingCategory;
@@ -86,6 +87,8 @@ public class PaygWalletController {
     static final String STATUS_SUBSCRIBED = "subscribed";
     static final String ROLE_LEADER = "leader";
     static final String ROLE_MEMBER = "member";
+    static final String BILLING_MODE_PREPAID = "prepaid";
+    static final String BILLING_MODE_PAYG = "payg";
 
     /**
      * Placeholder ceiling for the team-less empty snapshot only (authenticated caller without a
@@ -104,6 +107,7 @@ public class PaygWalletController {
     private final WalletLedgerRepository ledgerRepo;
     private final PaygShadowChargeRepository shadowRepo;
     private final UserRepository userRepository;
+    private final PrepaidBundleService prepaidBundleService;
 
     public PaygWalletController(
             EntitlementService entitlementService,
@@ -113,7 +117,8 @@ public class PaygWalletController {
             WalletPolicyRepository policyRepo,
             WalletLedgerRepository ledgerRepo,
             PaygShadowChargeRepository shadowRepo,
-            UserRepository userRepository) {
+            UserRepository userRepository,
+            PrepaidBundleService prepaidBundleService) {
         this.entitlementService = Objects.requireNonNull(entitlementService, "entitlementService");
         this.billingService = Objects.requireNonNull(billingService, "billingService");
         this.memberRepo = Objects.requireNonNull(memberRepo, "memberRepo");
@@ -122,6 +127,8 @@ public class PaygWalletController {
         this.ledgerRepo = Objects.requireNonNull(ledgerRepo, "ledgerRepo");
         this.shadowRepo = Objects.requireNonNull(shadowRepo, "shadowRepo");
         this.userRepository = Objects.requireNonNull(userRepository, "userRepository");
+        this.prepaidBundleService =
+                Objects.requireNonNull(prepaidBundleService, "prepaidBundleService");
     }
 
     // ---------------------------------------------------------------------------------------
@@ -187,6 +194,18 @@ public class PaygWalletController {
                         ? buildMemberRows(teamId, snap.periodStart(), snap.periodEnd())
                         : List.of();
 
+        // Prepaid bundles, aggregated across the team's in-term pools. Drawn ahead of the meter and
+        // kept out of the spend cap, so they're a separate dimension from the metered spend above.
+        PrepaidBundleService.PrepaidSummary prepaid = prepaidBundleService.summarize(teamId);
+        long prepaidRemaining = prepaid == null ? 0L : prepaid.unitsRemaining();
+        long prepaidTotal = prepaid == null ? 0L : prepaid.unitsTotal();
+        String prepaidExpiresAt =
+                prepaid == null || prepaid.expiresAt() == null
+                        ? null
+                        : ISO_DATE.format(prepaid.expiresAt().toLocalDate());
+        // Prepaid while pools still have units to draw; once exhausted the meter is live again.
+        String billingMode = prepaidRemaining > 0 ? BILLING_MODE_PREPAID : BILLING_MODE_PAYG;
+
         WalletSnapshotResponse body =
                 new WalletSnapshotResponse(
                         teamId,
@@ -211,7 +230,11 @@ public class PaygWalletController {
                         breakdowns.docs(),
                         analytics.docsProcessed(),
                         analytics.uniquePdfs(),
-                        analytics.sizeMultiplierPdfs());
+                        analytics.sizeMultiplierPdfs(),
+                        prepaidRemaining,
+                        prepaidTotal,
+                        prepaidExpiresAt,
+                        billingMode);
         return ResponseEntity.ok(body);
     }
 
@@ -485,6 +508,10 @@ public class PaygWalletController {
                 new CategoryBreakdown(0, 0, 0),
                 0,
                 0,
-                0);
+                0,
+                0L,
+                0L,
+                null,
+                BILLING_MODE_PAYG);
     }
 }
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/api/WalletSnapshotResponse.java b/app/saas/src/main/java/stirling/software/saas/payg/api/WalletSnapshotResponse.java
index 8147bd030c..3d381ef165 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/api/WalletSnapshotResponse.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/api/WalletSnapshotResponse.java
@@ -79,7 +79,20 @@ public record WalletSnapshotResponse(
         CategoryBreakdown categoryDocs,
         int docsProcessedThisPeriod,
         int uniquePdfsThisPeriod,
-        int sizeMultiplierPdfsThisPeriod) {
+        int sizeMultiplierPdfsThisPeriod,
+        long prepaidUnitsRemaining,
+        long prepaidUnitsTotal,
+        String prepaidExpiresAt,
+        String billingMode) {
+
+    // Prepaid usage bundles, aggregated across the team's in-term pools (drawn ahead of the meter,
+    // outside the spend cap):
+    //   prepaidUnitsRemaining — Σ units left across active pools (0 when exhausted / none)
+    //   prepaidUnitsTotal     — Σ capacity of in-term pools (the "X of Y used" denominator; 0 = no
+    //                           bundle this term, so the FE hides the prepaid card)
+    //   prepaidExpiresAt      — soonest term end (ISO date) for the countdown; null when no bundle
+    //   billingMode           — "prepaid" while prepaid units remain, else "payg" (the meter is
+    // live)
 
     // The count dimension, kept distinct from units (which now scale with file size):
     //   categoryDocs                — per-category INPUT-file counts (parallel to
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundle.java b/app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundle.java
new file mode 100644
index 0000000000..e2dff403a7
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundle.java
@@ -0,0 +1,105 @@
+package stirling.software.saas.payg.bundle;
+
+import java.io.Serializable;
+import java.time.LocalDateTime;
+
+import org.hibernate.annotations.CreationTimestamp;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Index;
+import jakarta.persistence.Table;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/**
+ * A prepaid, expiring pool of PDF-process units bought up-front at a discount ("12 months for the
+ * price of 10"). Consumed after the team's free grant and before the meter (free -> prepaid ->
+ * metered); draws are booked to the {@code BOUGHT} ledger bucket, so a bundle never counts toward
+ * the spend cap or the Stripe meter.
+ *
+ * <p>Carries only capacity + term + the Stripe link. The one-time amount and currency live on the
+ * Stripe Checkout Session / PaymentIntent referenced by {@link #stripeRef}; how many units a PDF
+ * costs comes from the team's pricing policy at charge time, not from the bundle. Status is
+ * derived, never stored (see {@link #isDrawable}).
+ *
+ * <p>A team may hold several pools at once (top-ups); they are drawn FIFO by soonest {@link
+ * #expiresAt}. Unused units forfeit at expiry (no roll-over).
+ */
+@Entity
+@Table(
+        name = "payg_prepaid_bundle",
+        // Declared here for ddl-auto (fresh schemas) and to document intent. The authoritative creator
+        // in production is the Supabase CLI migration 20260720000000_payg_prepaid_bundle, which builds
+        // the partial forms (WHERE units_remaining > 0 / WHERE stripe_ref IS NOT NULL). Flyway was
+        // retired for SaaS (#7100), so there is no migration twin — names match the CLI migration.
+        indexes = {
+            // Hot-path FIFO draw lookup — findDrawableForUpdate runs a locked read on every billable
+            // charge past the free grant; without it that degrades to a locked scan as the table grows.
+            @Index(
+                    name = "idx_payg_prepaid_bundle_team_expiry",
+                    columnList = "team_id, expires_at"),
+            // One pool per Stripe payment — the idempotency guard so a redelivered invoice.paid can't
+            // credit the same purchase twice.
+            @Index(
+                    name = "uq_payg_prepaid_bundle_stripe_ref",
+                    columnList = "stripe_ref",
+                    unique = true),
+        })
+@NoArgsConstructor
+@Getter
+@Setter
+public class PrepaidBundle implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "bundle_id")
+    private Long id;
+
+    @Column(name = "team_id", nullable = false)
+    private Long teamId;
+
+    /** Capacity granted at purchase — the denominator of the "X of Y used" meter. */
+    @Column(name = "units_total", nullable = false)
+    private long unitsTotal;
+
+    /** Live balance; pessimistic-locked on draw. */
+    @Column(name = "units_remaining", nullable = false)
+    private long unitsRemaining;
+
+    @Column(name = "purchased_at", nullable = false)
+    private LocalDateTime purchasedAt;
+
+    /** {@code purchasedAt + 12 months}. Unused units forfeit after this instant. */
+    @Column(name = "expires_at", nullable = false)
+    private LocalDateTime expiresAt;
+
+    /**
+     * Stripe Checkout Session / PaymentIntent id for the one-time payment that created this pool.
+     * The amount + currency + receipt live on that object; a unique index makes the webhook credit
+     * idempotent. {@code null} only for pools seeded outside the purchase flow (tests/backfill).
+     */
+    @Column(name = "stripe_ref", length = 128)
+    private String stripeRef;
+
+    @CreationTimestamp
+    @Column(name = "created_at", nullable = false, updatable = false)
+    private LocalDateTime createdAt;
+
+    /** In-term (not yet expired) as of {@code now} — regardless of remaining balance. */
+    public boolean isInTerm(LocalDateTime now) {
+        return expiresAt.isAfter(now);
+    }
+
+    /** Has units left AND is still in term — i.e. a charge may draw from it. */
+    public boolean isDrawable(LocalDateTime now) {
+        return unitsRemaining > 0 && isInTerm(now);
+    }
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundleRepository.java b/app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundleRepository.java
new file mode 100644
index 0000000000..48d29517d6
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundleRepository.java
@@ -0,0 +1,55 @@
+package stirling.software.saas.payg.bundle;
+
+import java.time.LocalDateTime;
+import java.util.List;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Lock;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+
+import jakarta.persistence.LockModeType;
+
+@Repository
+public interface PrepaidBundleRepository extends JpaRepository<PrepaidBundle, Long> {
+
+    /**
+     * A team's still-drawable pools (units left, not expired), soonest-expiring first, locked for
+     * the draw transaction. Mirrors {@code PaygTeamExtensionsRepository.findByIdForUpdate}: the
+     * PESSIMISTIC_WRITE lock serialises concurrent charges for the same team so two jobs can't both
+     * draw the same remaining unit, keeping the per-job {@code bundle_units_consumed} split exact.
+     * Drawn FIFO — the caller depletes the earliest-expiring pool first so capacity is used before
+     * it lapses. Filters on {@code expires_at} so an expired pool is never drawn even if the expiry
+     * sweep hasn't run (lazy expiry).
+     */
+    @Lock(LockModeType.PESSIMISTIC_WRITE)
+    @Query(
+            "SELECT b FROM PrepaidBundle b WHERE b.teamId = :teamId AND b.unitsRemaining > 0"
+                    + " AND b.expiresAt > :now ORDER BY b.expiresAt ASC")
+    List<PrepaidBundle> findDrawableForUpdate(
+            @Param("teamId") Long teamId, @Param("now") LocalDateTime now);
+
+    /**
+     * A team's in-term pools (not yet expired), soonest-expiring first — read-only, for the wallet
+     * snapshot. Includes exhausted-but-in-term pools so the "X of Y used" meter keeps the right
+     * denominator for the current term. Small per team; the service aggregates in Java.
+     */
+    @Query(
+            "SELECT b FROM PrepaidBundle b WHERE b.teamId = :teamId AND b.expiresAt > :now"
+                    + " ORDER BY b.expiresAt ASC")
+    List<PrepaidBundle> findInTerm(@Param("teamId") Long teamId, @Param("now") LocalDateTime now);
+
+    /**
+     * A team's in-term pools (not yet expired), soonest-expiring first, locked — for the refund
+     * restore path. Unlike {@link #findDrawableForUpdate} this includes pools already drawn to zero
+     * (that's exactly where a just-drawn charge's units go back), capped at {@code units_total} by
+     * the caller.
+     */
+    @Lock(LockModeType.PESSIMISTIC_WRITE)
+    @Query(
+            "SELECT b FROM PrepaidBundle b WHERE b.teamId = :teamId AND b.expiresAt > :now"
+                    + " ORDER BY b.expiresAt ASC")
+    List<PrepaidBundle> findInTermForUpdate(
+            @Param("teamId") Long teamId, @Param("now") LocalDateTime now);
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundleService.java b/app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundleService.java
new file mode 100644
index 0000000000..1faefc8510
--- /dev/null
+++ b/app/saas/src/main/java/stirling/software/saas/payg/bundle/PrepaidBundleService.java
@@ -0,0 +1,148 @@
+package stirling.software.saas.payg.bundle;
+
+import java.time.LocalDateTime;
+import java.util.List;
+
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Draws down and restores prepaid unit pools ({@link PrepaidBundle}). Sits between the free grant
+ * and the meter in the charge pipeline (free → prepaid → metered): a charge first spends the team's
+ * free grant, then this service spends prepaid pools FIFO by soonest expiry, and only the remainder
+ * meters to Stripe / counts against the cap.
+ *
+ * <p>Methods participate in the caller's transaction (default REQUIRED propagation), so the draw's
+ * pessimistic write lock is held for the whole {@code openProcess} transaction — the same
+ * discipline as the free-grant deduction, so concurrent same-team charges can't both spend the last
+ * unit.
+ */
+@Service
+@Profile("saas")
+@RequiredArgsConstructor
+@Slf4j
+public class PrepaidBundleService {
+
+    private final PrepaidBundleRepository bundleRepository;
+
+    /**
+     * Spend up to {@code units} from the team's drawable pools, earliest-expiring first, returning
+     * how many were actually drawn (0..{@code units}). Pools past their term are skipped (lazy
+     * expiry — the {@code expires_at} filter means an expired pool is never drawn even before the
+     * expiry sweep runs). A partial draw is normal: the remainder meters.
+     */
+    @Transactional
+    public int draw(Long teamId, int units) {
+        if (teamId == null || units <= 0) {
+            return 0;
+        }
+        List<PrepaidBundle> pools =
+                bundleRepository.findDrawableForUpdate(teamId, LocalDateTime.now());
+        int remaining = units;
+        int drawn = 0;
+        for (PrepaidBundle pool : pools) {
+            if (remaining <= 0) {
+                break;
+            }
+            long take = Math.min(remaining, pool.getUnitsRemaining());
+            if (take <= 0) {
+                continue;
+            }
+            pool.setUnitsRemaining(pool.getUnitsRemaining() - take);
+            drawn += (int) take;
+            remaining -= (int) take;
+        }
+        if (drawn > 0) {
+            bundleRepository.saveAll(pools);
+        }
+        return drawn;
+    }
+
+    /**
+     * Return {@code units} to the team's in-term pools on a refund, earliest-expiring first,
+     * capping each pool at its original {@code units_total}. Best-effort: units that can't be
+     * placed (all in-term pools already at capacity, or every pool expired in the tiny window since
+     * the draw) are dropped with a debug log — first-step-failure refunds are effectively
+     * immediate, so in practice the drawn-from pools are still open and take the units straight
+     * back.
+     */
+    @Transactional
+    public int restore(Long teamId, int units) {
+        if (teamId == null || units <= 0) {
+            return 0;
+        }
+        List<PrepaidBundle> pools =
+                bundleRepository.findInTermForUpdate(teamId, LocalDateTime.now());
+        int remaining = units;
+        for (PrepaidBundle pool : pools) {
+            if (remaining <= 0) {
+                break;
+            }
+            long headroom = pool.getUnitsTotal() - pool.getUnitsRemaining();
+            if (headroom <= 0) {
+                continue;
+            }
+            long give = Math.min(remaining, headroom);
+            pool.setUnitsRemaining(pool.getUnitsRemaining() + give);
+            remaining -= (int) give;
+        }
+        int restored = units - remaining;
+        if (restored > 0) {
+            bundleRepository.saveAll(pools);
+        }
+        if (remaining > 0) {
+            log.debug(
+                    "restore: {} of {} prepaid units couldn't be placed for team {} (no in-term"
+                            + " headroom)",
+                    remaining,
+                    units,
+                    teamId);
+        }
+        return restored;
+    }
+
+    /**
+     * Aggregate a team's in-term pools for the wallet snapshot: total remaining + total capacity +
+     * soonest expiry. Includes exhausted-but-in-term pools so the "X of Y used" meter keeps the
+     * right denominator for the term. Returns {@code null} when the team has no in-term bundle.
+     */
+    @Transactional(readOnly = true)
+    public PrepaidSummary summarize(Long teamId) {
+        if (teamId == null) {
+            return null;
+        }
+        List<PrepaidBundle> pools = bundleRepository.findInTerm(teamId, LocalDateTime.now());
+        if (pools.isEmpty()) {
+            return null;
+        }
+        long remaining = 0L;
+        long total = 0L;
+        LocalDateTime soonest = null;
+        for (PrepaidBundle pool : pools) {
+            remaining += pool.getUnitsRemaining();
+            total += pool.getUnitsTotal();
+            if (soonest == null || pool.getExpiresAt().isBefore(soonest)) {
+                soonest = pool.getExpiresAt();
+            }
+        }
+        return new PrepaidSummary(remaining, total, soonest);
+    }
+
+    /**
+     * Total prepaid units a team can still draw right now (in-term pools only); 0 when it has none.
+     * The entitlement gate uses this so a team with a live prepaid pool stays entitled even without
+     * a metered subscription — paid-for capacity is usable on its own merit.
+     */
+    @Transactional(readOnly = true)
+    public long prepaidRemainingUnits(Long teamId) {
+        PrepaidSummary summary = summarize(teamId);
+        return summary == null ? 0L : summary.unitsRemaining();
+    }
+
+    /** Aggregated prepaid balance for a team's in-term pools. */
+    public record PrepaidSummary(long unitsRemaining, long unitsTotal, LocalDateTime expiresAt) {}
+}
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/charge/JobChargeService.java b/app/saas/src/main/java/stirling/software/saas/payg/charge/JobChargeService.java
index b71caddbee..2fc175f224 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/charge/JobChargeService.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/charge/JobChargeService.java
@@ -17,6 +17,7 @@ import org.springframework.web.multipart.MultipartFile;
 
 import lombok.extern.slf4j.Slf4j;
 
+import stirling.software.saas.payg.bundle.PrepaidBundleService;
 import stirling.software.saas.payg.docs.DocumentClassifier;
 import stirling.software.saas.payg.docs.DocumentMetrics;
 import stirling.software.saas.payg.job.JobContext;
@@ -68,6 +69,7 @@ public class JobChargeService {
     private final PaygTeamExtensionsRepository teamExtensionsRepository;
     private final PaygMeterReportingService meterReportingService;
     private final WalletLedgerRepository ledgerRepository;
+    private final PrepaidBundleService prepaidBundleService;
 
     public JobChargeService(
             JobService jobService,
@@ -77,7 +79,8 @@ public class JobChargeService {
             ProcessingJobRepository jobRepository,
             PaygTeamExtensionsRepository teamExtensionsRepository,
             PaygMeterReportingService meterReportingService,
-            WalletLedgerRepository ledgerRepository) {
+            WalletLedgerRepository ledgerRepository,
+            PrepaidBundleService prepaidBundleService) {
         this.jobService = Objects.requireNonNull(jobService, "jobService");
         this.policyService = Objects.requireNonNull(policyService, "policyService");
         this.classifier = Objects.requireNonNull(classifier, "classifier");
@@ -88,6 +91,8 @@ public class JobChargeService {
         this.meterReportingService =
                 Objects.requireNonNull(meterReportingService, "meterReportingService");
         this.ledgerRepository = Objects.requireNonNull(ledgerRepository, "ledgerRepository");
+        this.prepaidBundleService =
+                Objects.requireNonNull(prepaidBundleService, "prepaidBundleService");
     }
 
     /**
@@ -128,14 +133,20 @@ public class JobChargeService {
         job.setDocUnits(units);
 
         int freeUsed = consumeFreeGrant(ctx, units);
-        recordShadowRow(ctx, job.getId(), policy.getId(), units, freeUsed);
+        // Prepaid bundle is the tier between the free grant and the meter (free → prepaid →
+        // metered); draw only what the free grant didn't cover.
+        int bundleUsed = drawBundle(ctx, units - freeUsed);
+        recordShadowRow(ctx, job.getId(), policy.getId(), units, freeUsed, bundleUsed);
         // doc_count + fingerprint were set on the fresh job by JobService.openFresh; carry them
-        // onto the ledger DEBIT so usage analytics query one table.
+        // onto the ledger DEBIT so usage analytics query one table. Bundle-drawn units are netted
+        // out of the ledger amount so they never count against the spend cap (they're prepaid, not
+        // metered CYCLE spend).
         recordLedgerDebit(
                 ctx,
                 job.getId(),
                 policy.getId(),
                 units,
+                bundleUsed,
                 job.getDocCount(),
                 job.getDocumentFingerprint());
 
@@ -179,12 +190,14 @@ public class JobChargeService {
         ProcessingJob job = jobService.open(jobCtx, chargeUnits);
 
         int freeUsed = consumeFreeGrant(ctx, chargeUnits);
-        recordShadowRow(ctx, job.getId(), policy.getId(), chargeUnits, freeUsed);
+        int bundleUsed = drawBundle(ctx, chargeUnits - freeUsed);
+        recordShadowRow(ctx, job.getId(), policy.getId(), chargeUnits, freeUsed, bundleUsed);
         recordLedgerDebit(
                 ctx,
                 job.getId(),
                 policy.getId(),
                 chargeUnits,
+                bundleUsed,
                 job.getDocCount(),
                 job.getDocumentFingerprint());
 
@@ -223,6 +236,24 @@ public class JobChargeService {
         return freeUsed;
     }
 
+    /**
+     * Draw this job's prepaid portion from the team's bundles — the tier after the free grant and
+     * before the meter — returning the units taken (0..{@code units}). Same guard as {@link
+     * #consumeFreeGrant}; {@link PrepaidBundleService#draw} holds a pessimistic pool lock inside
+     * this {@code openProcess} transaction so concurrent same-team charges split the pools exactly.
+     * Any remainder is the metered paid portion.
+     */
+    private int drawBundle(ChargeContext ctx, int units) {
+        BillingCategory category = ctx.billingCategory();
+        if (category == null || category == BillingCategory.BYPASSED || ctx.ownerTeamId() == null) {
+            return 0;
+        }
+        if (units <= 0) {
+            return 0;
+        }
+        return prepaidBundleService.draw(ctx.ownerTeamId(), units);
+    }
+
     /**
      * The live spend record. Everything the customer-facing side reads — the wallet endpoint's
      * {@code spendUnitsThisPeriod}, the per-category breakdown ({@code wallet_category_summary}
@@ -237,18 +268,27 @@ public class JobChargeService {
             java.util.UUID jobId,
             Long policyId,
             int units,
+            int bundleUnitsConsumed,
             int docCount,
             String documentFingerprint) {
         BillingCategory category = ctx.billingCategory();
         if (category == null || category == BillingCategory.BYPASSED) {
             return;
         }
+        // Prepaid (bundle) units are netted out of the metered CYCLE spend, so the cap + the Stripe
+        // meter don't charge again for capacity already bought up front. (Free-grant units are NOT
+        // netted here — they still count toward CYCLE/cap; only the bundle split is removed.)
+        // doc_count stays the full count so the PDF is still counted once by usage analytics (which
+        // sum doc_count over DEBIT rows, bucket-agnostic). A fully-prepaid charge therefore writes
+        // a
+        // 0-unit DEBIT that still counts toward "PDFs processed".
+        int meteredUnits = units - bundleUnitsConsumed;
         WalletLedgerEntry entry = new WalletLedgerEntry();
         entry.setTeamId(ctx.ownerTeamId());
         entry.setActorUserId(ctx.ownerUserId());
         entry.setEntryType(LedgerEntryType.DEBIT);
         entry.setBucket(LedgerBucket.CYCLE);
-        entry.setAmountUnits(-units);
+        entry.setAmountUnits(-meteredUnits);
         entry.setReferenceType(ReferenceType.JOB);
         entry.setReferenceId(jobId.toString());
         entry.setPolicyId(policyId);
@@ -297,15 +337,17 @@ public class JobChargeService {
             java.util.UUID jobId,
             Long policyId,
             int units,
-            int freeUnitsConsumed) {
+            int freeUnitsConsumed,
+            int bundleUnitsConsumed) {
         PaygShadowCharge row = new PaygShadowCharge();
         row.setTeamId(ctx.ownerTeamId());
         row.setJobId(jobId);
         row.setPolicyId(policyId);
         row.setPaygUnits(units);
-        // Free-vs-paid split fixed at charge time: paid (metered) = paygUnits - freeUnitsConsumed,
-        // and a refund restores freeUnitsConsumed to the team's grant.
+        // Free/prepaid/paid split fixed at charge time: metered = paygUnits - freeUnitsConsumed -
+        // bundleUnitsConsumed. A refund restores each portion to its source (grant / pools).
         row.setFreeUnitsConsumed(freeUnitsConsumed);
+        row.setBundleUnitsConsumed(bundleUnitsConsumed);
         // No legacy comparison: the legacy credit engine has been removed, so diff stays at 0.
         row.setLegacyCreditsCharged(0);
         row.setDiffPct(0);
@@ -349,11 +391,15 @@ public class JobChargeService {
                 // on the CHARGED→REFUNDED transition) prevents double-credits on re-invocation.
                 BillingCategory category = row.getBillingCategory();
                 if (category != null && category != BillingCategory.BYPASSED) {
+                    int bundleConsumed =
+                            row.getBundleUnitsConsumed() == null ? 0 : row.getBundleUnitsConsumed();
                     WalletLedgerEntry refund = new WalletLedgerEntry();
                     refund.setTeamId(row.getTeamId());
                     refund.setEntryType(LedgerEntryType.REFUND);
                     refund.setBucket(LedgerBucket.CYCLE);
-                    refund.setAmountUnits(row.getPaygUnits());
+                    // Mirror the reduced DEBIT: prepaid units never entered the CYCLE spend, so the
+                    // compensating credit is the metered portion only (paygUnits − bundle).
+                    refund.setAmountUnits(row.getPaygUnits() - bundleConsumed);
                     refund.setReferenceType(ReferenceType.JOB);
                     refund.setReferenceId(jobId.toString());
                     refund.setPolicyId(row.getPolicyId());
@@ -367,6 +413,11 @@ public class JobChargeService {
                     if (freeConsumed > 0 && row.getTeamId() != null) {
                         teamExtensionsRepository.restoreFreeUnits(row.getTeamId(), freeConsumed);
                     }
+                    // Return the prepaid units this job drew to the team's pools (best-effort — see
+                    // PrepaidBundleService.restore).
+                    if (bundleConsumed > 0 && row.getTeamId() != null) {
+                        prepaidBundleService.restore(row.getTeamId(), bundleConsumed);
+                    }
                 }
             }
         }
@@ -506,10 +557,14 @@ public class JobChargeService {
         // free grant is app-side only (Stripe's Prices are plain per-unit, no free tier), so the
         // free units were already withheld when this row's free_units_consumed was set.
         int freeConsumed = row.getFreeUnitsConsumed() == null ? 0 : row.getFreeUnitsConsumed();
-        int paidUnits = units - freeConsumed;
+        int bundleConsumed =
+                row.getBundleUnitsConsumed() == null ? 0 : row.getBundleUnitsConsumed();
+        // Metered = units beyond BOTH the free grant and the prepaid bundle; only this hits Stripe.
+        int paidUnits = units - freeConsumed - bundleConsumed;
         if (paidUnits <= 0) {
             log.debug(
-                    "close({}): all {} units came from the free grant → no meter event",
+                    "close({}): all {} units covered by free grant + prepaid bundle → no meter"
+                            + " event",
                     jobId,
                     units);
             return;
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/charge/SaasClassificationRunBiller.java b/app/saas/src/main/java/stirling/software/saas/payg/charge/SaasClassificationRunBiller.java
index 79533fb102..a4536d6c23 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/charge/SaasClassificationRunBiller.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/charge/SaasClassificationRunBiller.java
@@ -17,8 +17,8 @@ import stirling.software.saas.payg.model.ProcessType;
 import stirling.software.saas.util.AuthenticationUtils;
 
 /**
- * Charges one PAYG unit per document as an AUTOMATION job, matching what a server-side
- * classify policy step bills.
+ * Charges one PAYG unit per document as an AUTOMATION job, matching what a server-side classify
+ * policy step bills.
  */
 @Component
 @Profile("saas")
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/entitlement/EntitlementService.java b/app/saas/src/main/java/stirling/software/saas/payg/entitlement/EntitlementService.java
index 397a714bfa..f2863a56d5 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/entitlement/EntitlementService.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/entitlement/EntitlementService.java
@@ -18,6 +18,7 @@ import lombok.extern.slf4j.Slf4j;
 
 import stirling.software.saas.payg.billing.TeamBillingContext;
 import stirling.software.saas.payg.billing.TeamBillingService;
+import stirling.software.saas.payg.bundle.PrepaidBundleService;
 import stirling.software.saas.payg.cap.CapEvaluator;
 import stirling.software.saas.payg.cap.CapEvaluator.Evaluation;
 import stirling.software.saas.payg.model.EntitlementState;
@@ -51,17 +52,21 @@ public class EntitlementService {
     private final TeamBillingService teamBillingService;
     private final WalletPolicyRepository walletPolicyRepository;
     private final WalletLedgerRepository ledgerRepository;
+    private final PrepaidBundleService prepaidBundleService;
 
     private final Cache<Long, EntitlementSnapshot> snapshotCache;
 
     public EntitlementService(
             TeamBillingService teamBillingService,
             WalletPolicyRepository walletPolicyRepository,
-            WalletLedgerRepository ledgerRepository) {
+            WalletLedgerRepository ledgerRepository,
+            PrepaidBundleService prepaidBundleService) {
         this.teamBillingService = Objects.requireNonNull(teamBillingService, "teamBillingService");
         this.walletPolicyRepository =
                 Objects.requireNonNull(walletPolicyRepository, "walletPolicyRepository");
         this.ledgerRepository = Objects.requireNonNull(ledgerRepository, "ledgerRepository");
+        this.prepaidBundleService =
+                Objects.requireNonNull(prepaidBundleService, "prepaidBundleService");
         this.snapshotCache =
                 Caffeine.newBuilder()
                         .maximumSize(CACHE_MAX_SIZE)
@@ -135,21 +140,45 @@ public class EntitlementService {
             long periodSpend = signedNet < 0 ? -signedNet : 0L;
             Long cap = billing.monthlyCapDocUnits();
             eval = CapEvaluator.evaluate(periodSpend, cap, warnAtPct, degradeAtPct, degradedSet);
+            // A live prepaid pool sits OUTSIDE the metered cap: bundle draws are netted out of
+            // period
+            // spend in JobChargeService, so they never count toward it. So a subscribed team that
+            // has
+            // hit its cap but still holds prepaid capacity stays fully entitled — the job draws
+            // from
+            // the pool, not the meter, and the cap is irrelevant while the pool has balance.
+            // Queried
+            // lazily (only when the cap would otherwise degrade) to keep the under-cap path off the
+            // prepaid table.
+            if (eval.state() == EntitlementState.DEGRADED
+                    && prepaidBundleService.prepaidRemainingUnits(teamId) > 0L) {
+                eval = fullyEntitledOnPrepaid();
+            }
             snapshotSpend = periodSpend;
             snapshotCap = cap;
         } else {
-            // Unsubscribed: gate on the one-time lifetime free grant. Exhausted (remaining ≤ 0, or
-            // no grant configured) → DEGRADED so billable categories hard-stop; otherwise evaluate
-            // the warn/degrade band on used-of-grant.
+            // Unsubscribed: gate on the one-time lifetime free grant, then on a prepaid pool. While
+            // the free grant has balance, evaluate the warn/degrade band on used-of-grant. Once the
+            // free grant is spent, a live prepaid pool keeps the team fully entitled — paid-for
+            // capacity is usable on its own merit, independent of any metered subscription (the
+            // pool
+            // is drawn in JobChargeService; only the metered remainder stays gated on the sub).
+            // Only
+            // when BOTH the free grant and prepaid are exhausted do billable categories hard-stop.
             long grant = billing.freeGrantUnits();
             long remaining = billing.freeRemainingUnits();
             long used = Math.max(0L, grant - remaining);
             if (remaining <= 0L) {
-                eval =
-                        new Evaluation(
-                                EntitlementState.DEGRADED,
-                                degradedSet,
-                                CapEvaluator.gatesFor(degradedSet));
+                long prepaidRemaining = prepaidBundleService.prepaidRemainingUnits(teamId);
+                if (prepaidRemaining > 0L) {
+                    eval = fullyEntitledOnPrepaid();
+                } else {
+                    eval =
+                            new Evaluation(
+                                    EntitlementState.DEGRADED,
+                                    degradedSet,
+                                    CapEvaluator.gatesFor(degradedSet));
+                }
             } else {
                 eval = CapEvaluator.evaluate(used, grant, warnAtPct, degradeAtPct, degradedSet);
             }
@@ -168,6 +197,17 @@ public class EntitlementService {
                 billing.subscribed());
     }
 
+    /**
+     * A team holding a live prepaid pool is fully entitled regardless of the free-grant or the
+     * monthly-cap gate: the pool is drawn in the charge pipeline and its units are netted out of
+     * metered spend, so it sits OUTSIDE both gates. All feature gates are on. Shared by the
+     * unsubscribed (grant-exhausted) and subscribed (over-cap) branches.
+     */
+    private static Evaluation fullyEntitledOnPrepaid() {
+        return new Evaluation(
+                EntitlementState.FULL, FeatureSet.FULL, CapEvaluator.gatesFor(FeatureSet.FULL));
+    }
+
     /**
      * Inclusive-start / exclusive-end window for the calendar-month period. Test seam — takes a
      * clock value so tests don't race the calendar boundary. The live snapshot window comes from
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/policy/PricingPolicy.java b/app/saas/src/main/java/stirling/software/saas/payg/policy/PricingPolicy.java
index 9581177369..d28b0fd09d 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/policy/PricingPolicy.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/policy/PricingPolicy.java
@@ -114,6 +114,19 @@ public class PricingPolicy implements Serializable {
     @Column(name = "stripe_price_id", nullable = false, length = 128)
     private Set<String> stripePriceIds = new HashSet<>();
 
+    /**
+     * One-time Stripe Price id for prepaid-bundle checkout — same {@code unit_amount} as the
+     * metered price (Stripe {@code currency_options} cover all currencies on one Price). Read by
+     * the create-payg-bundle-checkout edge fn via {@code payg_get_bundle_checkout_context}. Null =
+     * bundles not offered for this policy. Money lives in Stripe; this is just the handle.
+     */
+    @Column(name = "bundle_stripe_price_id", length = 128)
+    private String bundleStripePriceId;
+
+    /** Stripe coupon id applying the 12-for-10 prepaid discount. Null = bundles not offered. */
+    @Column(name = "bundle_coupon_id", length = 128)
+    private String bundleCouponId;
+
     /**
      * Exactly one row in the table has {@code is_default = true}; enforced by partial unique idx.
      */
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/shadow/PaygShadowCharge.java b/app/saas/src/main/java/stirling/software/saas/payg/shadow/PaygShadowCharge.java
index 57aea1a0e4..6a00ea6d18 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/shadow/PaygShadowCharge.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/shadow/PaygShadowCharge.java
@@ -67,6 +67,20 @@ public class PaygShadowCharge implements Serializable {
     @Column(name = "free_units_consumed", nullable = false)
     private Integer freeUnitsConsumed = 0;
 
+    /**
+     * How many of {@link #paygUnits} were drawn from prepaid bundles (the {@code BOUGHT} bucket) at
+     * charge time — the tier between the free grant and the meter. The paid (Stripe-metered)
+     * portion is {@code paygUnits - freeUnitsConsumed - bundleUnitsConsumed}; a refund restores
+     * this many units to the pool(s) they came from. {@code 0} for pre-bundle rows and jobs that
+     * drew none. The {@code columnDefinition} default keeps the ddl-auto ADD COLUMN safe on the
+     * populated table.
+     */
+    @Column(
+            name = "bundle_units_consumed",
+            nullable = false,
+            columnDefinition = "integer not null default 0")
+    private Integer bundleUnitsConsumed = 0;
+
     @Column(name = "legacy_credits_charged", nullable = false)
     private Integer legacyCreditsCharged;
 
diff --git a/app/saas/src/test/java/stirling/software/saas/config/SaasJpaConfigScanTest.java b/app/saas/src/test/java/stirling/software/saas/config/SaasJpaConfigScanTest.java
index faf7f561ec..1ec5d64214 100644
--- a/app/saas/src/test/java/stirling/software/saas/config/SaasJpaConfigScanTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/config/SaasJpaConfigScanTest.java
@@ -25,7 +25,10 @@ class SaasJpaConfigScanTest {
                     "stirling.software.saas.repository",
                     "stirling.software.saas.billing.repository",
                     "stirling.software.saas.ai.repository",
-                    "stirling.software.saas.payg.repository");
+                    "stirling.software.saas.payg.repository",
+                    // PrepaidBundleRepository lives in payg.bundle, not payg.repository — the repo
+                    // scan is leaf-level, not recursive.
+                    "stirling.software.saas.payg.bundle");
 
     private static final List<String> EXPECTED_ENTITY_PACKAGES =
             List.of(
diff --git a/app/saas/src/test/java/stirling/software/saas/payg/api/PaygWalletControllerTest.java b/app/saas/src/test/java/stirling/software/saas/payg/api/PaygWalletControllerTest.java
index 1625116af0..01e112a1c8 100644
--- a/app/saas/src/test/java/stirling/software/saas/payg/api/PaygWalletControllerTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/payg/api/PaygWalletControllerTest.java
@@ -39,6 +39,7 @@ import stirling.software.saas.payg.api.PaygWalletController.UpdateCapRequest;
 import stirling.software.saas.payg.api.WalletSnapshotResponse.MemberRow;
 import stirling.software.saas.payg.billing.TeamBillingContext;
 import stirling.software.saas.payg.billing.TeamBillingService;
+import stirling.software.saas.payg.bundle.PrepaidBundleService;
 import stirling.software.saas.payg.entitlement.EntitlementService;
 import stirling.software.saas.payg.entitlement.EntitlementSnapshot;
 import stirling.software.saas.payg.model.BillingCategory;
@@ -69,6 +70,7 @@ class PaygWalletControllerTest {
     @Mock private WalletLedgerRepository ledgerRepo;
     @Mock private PaygShadowChargeRepository shadowRepo;
     @Mock private UserRepository userRepository;
+    @Mock private PrepaidBundleService prepaidBundleService;
 
     private PaygWalletController controller;
 
@@ -83,7 +85,8 @@ class PaygWalletControllerTest {
                         policyRepo,
                         ledgerRepo,
                         shadowRepo,
-                        userRepository);
+                        userRepository,
+                        prepaidBundleService);
     }
 
     /**
diff --git a/app/saas/src/test/java/stirling/software/saas/payg/api/WalletSnapshotResponseTest.java b/app/saas/src/test/java/stirling/software/saas/payg/api/WalletSnapshotResponseTest.java
index e8547de268..55dfdb40e3 100644
--- a/app/saas/src/test/java/stirling/software/saas/payg/api/WalletSnapshotResponseTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/payg/api/WalletSnapshotResponseTest.java
@@ -39,7 +39,11 @@ class WalletSnapshotResponseTest {
                 /* categoryDocs= */ new CategoryBreakdown(3, 2, 1),
                 /* docsProcessedThisPeriod= */ 6,
                 /* uniquePdfsThisPeriod= */ 5,
-                /* sizeMultiplierPdfsThisPeriod= */ 2);
+                /* sizeMultiplierPdfsThisPeriod= */ 2,
+                /* prepaidUnitsRemaining= */ 40_000L,
+                /* prepaidUnitsTotal= */ 120_000L,
+                /* prepaidExpiresAt= */ "2027-06-01",
+                /* billingMode= */ "prepaid");
     }
 
     @Test
@@ -115,7 +119,11 @@ class WalletSnapshotResponseTest {
                         new CategoryBreakdown(0, 0, 0),
                         0,
                         0,
-                        0);
+                        0,
+                        0L,
+                        0L,
+                        null,
+                        "payg");
 
         assertThat(free.billableLimit()).isNull();
         assertThat(free.pricePerDocMinor()).isNull();
diff --git a/app/saas/src/test/java/stirling/software/saas/payg/bundle/PrepaidBundleServiceTest.java b/app/saas/src/test/java/stirling/software/saas/payg/bundle/PrepaidBundleServiceTest.java
new file mode 100644
index 0000000000..2c700fcd1b
--- /dev/null
+++ b/app/saas/src/test/java/stirling/software/saas/payg/bundle/PrepaidBundleServiceTest.java
@@ -0,0 +1,172 @@
+package stirling.software.saas.payg.bundle;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.time.LocalDateTime;
+import java.util.List;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mockito;
+
+import stirling.software.saas.payg.bundle.PrepaidBundleService.PrepaidSummary;
+
+/**
+ * Unit tests for the prepaid-bundle draw/restore/summarize money logic. The repository is mocked,
+ * so these pin the in-Java arithmetic (FIFO depletion, per-pool caps, best-effort restore,
+ * aggregation) — the FIFO-by-expiry ordering and the expiry/lock filters live in the repository
+ * JPQL and are covered separately by the query definitions, not here.
+ */
+class PrepaidBundleServiceTest {
+
+    private static final Long TEAM = 42L;
+    private static final LocalDateTime SOON = LocalDateTime.of(2026, 8, 1, 0, 0);
+    private static final LocalDateTime LATER = LocalDateTime.of(2026, 12, 1, 0, 0);
+
+    private PrepaidBundleRepository repo;
+    private PrepaidBundleService service;
+
+    @BeforeEach
+    void setUp() {
+        repo = Mockito.mock(PrepaidBundleRepository.class);
+        service = new PrepaidBundleService(repo);
+    }
+
+    private static PrepaidBundle pool(long total, long remaining, LocalDateTime expiresAt) {
+        PrepaidBundle b = new PrepaidBundle();
+        b.setTeamId(TEAM);
+        b.setUnitsTotal(total);
+        b.setUnitsRemaining(remaining);
+        b.setExpiresAt(expiresAt);
+        return b;
+    }
+
+    // ── draw ────────────────────────────────────────────────────────────────
+
+    @Test
+    void draw_nullTeamOrNonPositiveUnits_returnsZeroWithoutTouchingRepo() {
+        assertThat(service.draw(null, 100)).isZero();
+        assertThat(service.draw(TEAM, 0)).isZero();
+        assertThat(service.draw(TEAM, -5)).isZero();
+        verifyNoInteractions(repo);
+    }
+
+    @Test
+    void draw_partialFromSinglePool_leavesRemainder() {
+        PrepaidBundle p = pool(1000, 1000, SOON);
+        when(repo.findDrawableForUpdate(eq(TEAM), any())).thenReturn(List.of(p));
+
+        int drawn = service.draw(TEAM, 300);
+
+        assertThat(drawn).isEqualTo(300);
+        assertThat(p.getUnitsRemaining()).isEqualTo(700);
+        verify(repo).saveAll(List.of(p));
+    }
+
+    @Test
+    void draw_spansPoolsFifo_cappedAtEachPoolBalance() {
+        // Repo returns soonest-expiring first; the earlier pool is depleted before the later one.
+        PrepaidBundle first = pool(1000, 100, SOON);
+        PrepaidBundle second = pool(1000, 1000, LATER);
+        when(repo.findDrawableForUpdate(eq(TEAM), any())).thenReturn(List.of(first, second));
+
+        int drawn = service.draw(TEAM, 250);
+
+        assertThat(drawn).isEqualTo(250);
+        assertThat(first.getUnitsRemaining()).isZero(); // fully depleted first
+        assertThat(second.getUnitsRemaining()).isEqualTo(850); // 150 taken from the later pool
+    }
+
+    @Test
+    void draw_moreThanAvailable_drawsOnlyWhatExists() {
+        PrepaidBundle p = pool(1000, 120, SOON);
+        when(repo.findDrawableForUpdate(eq(TEAM), any())).thenReturn(List.of(p));
+
+        int drawn = service.draw(TEAM, 500);
+
+        assertThat(drawn).isEqualTo(120); // partial draw; the remainder meters
+        assertThat(p.getUnitsRemaining()).isZero();
+    }
+
+    @Test
+    void draw_noDrawablePools_returnsZeroAndDoesNotSave() {
+        when(repo.findDrawableForUpdate(eq(TEAM), any())).thenReturn(List.of());
+
+        assertThat(service.draw(TEAM, 100)).isZero();
+        verify(repo, never()).saveAll(any());
+    }
+
+    // ── restore ─────────────────────────────────────────────────────────────
+
+    @Test
+    void restore_capsEachPoolAtItsOriginalTotal() {
+        // Two in-term pools with headroom 60 then 200; restoring 100 fills the first, spills 40 to
+        // the
+        // second, and never exceeds units_total on either.
+        PrepaidBundle first = pool(1000, 940, SOON); // headroom 60
+        PrepaidBundle second = pool(1000, 800, LATER); // headroom 200
+        when(repo.findInTermForUpdate(eq(TEAM), any())).thenReturn(List.of(first, second));
+
+        int restored = service.restore(TEAM, 100);
+
+        assertThat(restored).isEqualTo(100);
+        assertThat(first.getUnitsRemaining()).isEqualTo(1000); // capped at total
+        assertThat(second.getUnitsRemaining()).isEqualTo(840);
+        verify(repo).saveAll(List.of(first, second));
+    }
+
+    @Test
+    void restore_dropsUnitsThatCannotBePlaced() {
+        // Only 60 headroom for a 100 restore → 60 restored, 40 dropped (best-effort).
+        PrepaidBundle p = pool(1000, 940, SOON);
+        when(repo.findInTermForUpdate(eq(TEAM), any())).thenReturn(List.of(p));
+
+        int restored = service.restore(TEAM, 100);
+
+        assertThat(restored).isEqualTo(60);
+        assertThat(p.getUnitsRemaining()).isEqualTo(1000);
+    }
+
+    @Test
+    void restore_nullTeamOrNonPositive_returnsZeroWithoutRepo() {
+        assertThat(service.restore(null, 10)).isZero();
+        assertThat(service.restore(TEAM, 0)).isZero();
+        verifyNoInteractions(repo);
+    }
+
+    // ── summarize / prepaidRemainingUnits ─────────────────────────────────────
+
+    @Test
+    void summarize_nullWhenNoInTermPools() {
+        when(repo.findInTerm(eq(TEAM), any())).thenReturn(List.of());
+        assertThat(service.summarize(TEAM)).isNull();
+    }
+
+    @Test
+    void summarize_sumsBalancesAndPicksSoonestExpiry() {
+        when(repo.findInTerm(eq(TEAM), any()))
+                .thenReturn(List.of(pool(1000, 250, LATER), pool(500, 500, SOON)));
+
+        PrepaidSummary summary = service.summarize(TEAM);
+
+        assertThat(summary.unitsRemaining()).isEqualTo(750);
+        assertThat(summary.unitsTotal()).isEqualTo(1500);
+        assertThat(summary.expiresAt()).isEqualTo(SOON); // earliest across pools
+    }
+
+    @Test
+    void prepaidRemainingUnits_delegatesToSummary_zeroWhenNone() {
+        when(repo.findInTerm(eq(TEAM), any())).thenReturn(List.of());
+        assertThat(service.prepaidRemainingUnits(TEAM)).isZero();
+
+        when(repo.findInTerm(eq(TEAM), any()))
+                .thenReturn(List.of(pool(1000, 400, SOON), pool(1000, 350, LATER)));
+        assertThat(service.prepaidRemainingUnits(TEAM)).isEqualTo(750);
+    }
+}
diff --git a/app/saas/src/test/java/stirling/software/saas/payg/charge/JobChargeServiceTest.java b/app/saas/src/test/java/stirling/software/saas/payg/charge/JobChargeServiceTest.java
index e669e1b5bd..43abfe24e1 100644
--- a/app/saas/src/test/java/stirling/software/saas/payg/charge/JobChargeServiceTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/payg/charge/JobChargeServiceTest.java
@@ -31,6 +31,7 @@ import org.springframework.transaction.support.TransactionSynchronization;
 import org.springframework.transaction.support.TransactionSynchronizationManager;
 import org.springframework.web.multipart.MultipartFile;
 
+import stirling.software.saas.payg.bundle.PrepaidBundleService;
 import stirling.software.saas.payg.docs.DocumentClassifier;
 import stirling.software.saas.payg.docs.DocumentMetrics;
 import stirling.software.saas.payg.job.JobContext;
@@ -70,6 +71,7 @@ class JobChargeServiceTest {
     private PaygTeamExtensionsRepository teamExtRepo;
     private PaygMeterReportingService meterReporter;
     private WalletLedgerRepository ledgerRepo;
+    private PrepaidBundleService prepaidBundleService;
     private JobChargeService service;
 
     @BeforeEach
@@ -82,6 +84,9 @@ class JobChargeServiceTest {
         teamExtRepo = Mockito.mock(PaygTeamExtensionsRepository.class);
         meterReporter = Mockito.mock(PaygMeterReportingService.class);
         ledgerRepo = Mockito.mock(WalletLedgerRepository.class);
+        // Defaults to draw()==0 (Mockito int default) → no prepaid consumed unless a test stubs it,
+        // so existing free/metered assertions are unaffected.
+        prepaidBundleService = Mockito.mock(PrepaidBundleService.class);
         // findByIdForUpdate defaults to Optional.empty() (Mockito) → no free grant consumed unless
         // a test stubs the sidecar row. The free split is decided at openProcess time now, not at
         // close, so the meter tests just set free_units_consumed on the shadow row directly.
@@ -94,7 +99,8 @@ class JobChargeServiceTest {
                         jobRepo,
                         teamExtRepo,
                         meterReporter,
-                        ledgerRepo);
+                        ledgerRepo,
+                        prepaidBundleService);
     }
 
     @AfterEach
@@ -202,6 +208,42 @@ class JobChargeServiceTest {
         assertThat(debit.getBillingCategory()).isEqualTo(BillingCategory.API);
     }
 
+    @Test
+    void openProcess_prepaidBundleDraw_netsBundleUnitsOutOfLedgerAndRecordsSplit(@TempDir Path tmp)
+            throws IOException {
+        // Bundle covers 3 of the 4 charged units. Only the metered remainder (1) lands in the
+        // ledger's CYCLE spend (so prepaid stays outside the cap + Stripe meter), while the shadow
+        // row freezes the split and doc_count is untouched (the PDF is still counted once).
+        PricingPolicy policy = stubPolicy(/*minCharge*/ 1, Map.of(JobSource.WEB, 10));
+        when(policyService.getEffectivePolicy(100L)).thenReturn(policy);
+        ProcessingJob newJob = openJob(UUID.randomUUID());
+        when(jobService.joinOrOpen(any(JobContext.class), anyList()))
+                .thenReturn(new JoinOrOpenResult(newJob, JoinOrOpenResult.Disposition.OPENED));
+        when(classifier.classify(any(MultipartFile.class), any(Path.class), eq(policy)))
+                .thenReturn(new DocumentMetrics(50, 1024L, "application/pdf", 4));
+        // No free grant (findByIdForUpdate defaults empty); prepaid pools cover 3 of the 4 units.
+        when(prepaidBundleService.draw(eq(100L), eq(4))).thenReturn(3);
+
+        JobInput in = jobInput(tmp, "in.pdf", "application/pdf");
+        service.openProcess(
+                new ChargeContext(
+                        42L, 100L, JobSource.WEB, ProcessType.SINGLE_TOOL, BillingCategory.API),
+                List.of(in));
+
+        ArgumentCaptor<PaygShadowCharge> shadowCaptor =
+                ArgumentCaptor.forClass(PaygShadowCharge.class);
+        verify(shadowRepo).save(shadowCaptor.capture());
+        assertThat(shadowCaptor.getValue().getPaygUnits()).isEqualTo(4);
+        assertThat(shadowCaptor.getValue().getBundleUnitsConsumed()).isEqualTo(3);
+
+        ArgumentCaptor<WalletLedgerEntry> ledgerCaptor =
+                ArgumentCaptor.forClass(WalletLedgerEntry.class);
+        verify(ledgerRepo).save(ledgerCaptor.capture());
+        // 4 charged − 3 prepaid = 1 metered unit, stored negative.
+        assertThat(ledgerCaptor.getValue().getAmountUnits()).isEqualTo(-1);
+        assertThat(ledgerCaptor.getValue().getBucket()).isEqualTo(LedgerBucket.CYCLE);
+    }
+
     @Test
     void openProcess_bypassedCategory_writesShadowRowButNoLedgerDebit(@TempDir Path tmp)
             throws IOException {
diff --git a/app/saas/src/test/java/stirling/software/saas/payg/entitlement/EntitlementServiceTest.java b/app/saas/src/test/java/stirling/software/saas/payg/entitlement/EntitlementServiceTest.java
index 430e1b7e0e..3079115c6e 100644
--- a/app/saas/src/test/java/stirling/software/saas/payg/entitlement/EntitlementServiceTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/payg/entitlement/EntitlementServiceTest.java
@@ -17,6 +17,7 @@ import org.mockito.Mockito;
 
 import stirling.software.saas.payg.billing.TeamBillingContext;
 import stirling.software.saas.payg.billing.TeamBillingService;
+import stirling.software.saas.payg.bundle.PrepaidBundleService;
 import stirling.software.saas.payg.model.EntitlementState;
 import stirling.software.saas.payg.model.FeatureGate;
 import stirling.software.saas.payg.model.FeatureSet;
@@ -47,6 +48,7 @@ class EntitlementServiceTest {
     private TeamBillingService billingService;
     private WalletPolicyRepository walletPolicyRepo;
     private WalletLedgerRepository ledgerRepo;
+    private PrepaidBundleService prepaidBundleService;
     private EntitlementService service;
 
     @BeforeEach
@@ -54,7 +56,10 @@ class EntitlementServiceTest {
         billingService = Mockito.mock(TeamBillingService.class);
         walletPolicyRepo = Mockito.mock(WalletPolicyRepository.class);
         ledgerRepo = Mockito.mock(WalletLedgerRepository.class);
-        service = new EntitlementService(billingService, walletPolicyRepo, ledgerRepo);
+        prepaidBundleService = Mockito.mock(PrepaidBundleService.class);
+        service =
+                new EntitlementService(
+                        billingService, walletPolicyRepo, ledgerRepo, prepaidBundleService);
     }
 
     @Test
@@ -122,10 +127,13 @@ class EntitlementServiceTest {
     }
 
     @Test
-    void exhaustedGrant_returnsDegradedWithMinimalGates() {
-        // Grant fully consumed (remaining 0) → billable categories hard-stop for an unsubscribed
-        // team. The displayed cap stays the grant size; spend reads as the full grant.
+    void exhaustedGrantAndNoPrepaid_returnsDegradedWithMinimalGates() {
+        // Grant fully consumed (remaining 0) AND no prepaid pool → billable categories hard-stop
+        // for
+        // an unsubscribed team. The displayed cap stays the grant size; spend reads as the full
+        // grant.
         stubBilling(42L, freeContext(100L, 0L));
+        when(prepaidBundleService.prepaidRemainingUnits(42L)).thenReturn(0L);
         when(walletPolicyRepo.findByTeamId(42L))
                 .thenReturn(Optional.of(walletPolicyThresholds(FeatureSet.MINIMAL)));
 
@@ -142,6 +150,110 @@ class EntitlementServiceTest {
                 .doesNotContain(FeatureGate.AUTOMATION, FeatureGate.AI_SUPPORT);
     }
 
+    @Test
+    void exhaustedGrantButLivePrepaidPool_staysFullyEntitled() {
+        // Free grant spent (remaining 0) but the team holds a paid prepaid pool → fully entitled,
+        // NOT degraded, even with no metered subscription. All gates (incl. AUTOMATION + AI) are
+        // on;
+        // the pool is drawn in the charge pipeline. This is the Phase-1 fix: paid-for usage is
+        // usable
+        // on its own merit rather than gated behind a subscription that may not have provisioned.
+        stubBilling(42L, freeContext(100L, 0L));
+        when(prepaidBundleService.prepaidRemainingUnits(42L)).thenReturn(480_000L);
+        when(walletPolicyRepo.findByTeamId(42L))
+                .thenReturn(Optional.of(walletPolicyThresholds(FeatureSet.MINIMAL)));
+
+        EntitlementSnapshot snap = service.getSnapshot(42L);
+
+        assertThat(snap.state()).isEqualTo(EntitlementState.FULL);
+        assertThat(snap.featureSet()).isEqualTo(FeatureSet.FULL);
+        assertThat(snap.enabledGates())
+                .containsExactlyInAnyOrder(
+                        FeatureGate.OFFSITE_PROCESSING,
+                        FeatureGate.AUTOMATION,
+                        FeatureGate.AI_SUPPORT,
+                        FeatureGate.CLIENT_SIDE);
+        assertThat(snap.subscribed()).isFalse();
+    }
+
+    @Test
+    void grantStillHasBalance_prepaidNotConsulted() {
+        // While the free grant has balance, the gate never queries prepaid (lazy — only checked
+        // when
+        // the grant is exhausted). Keeps the common free-tier path off the prepaid table.
+        stubBilling(42L, freeContext(500L, 400L));
+        when(walletPolicyRepo.findByTeamId(42L)).thenReturn(Optional.empty());
+
+        service.getSnapshot(42L);
+
+        Mockito.verifyNoInteractions(prepaidBundleService);
+    }
+
+    @Test
+    void subscribedOverCapButLivePrepaidPool_staysFullyEntitled() {
+        // Subscribed team at/over its metered cap but holding a live prepaid pool → fully entitled,
+        // NOT degraded. Prepaid sits outside the cap (its draws are netted out of metered spend in
+        // JobChargeService), so the job draws from the pool and the cap is irrelevant while it
+        // lasts.
+        stubBilling(42L, subscribedContext(1000L));
+        when(walletPolicyRepo.findByTeamId(42L))
+                .thenReturn(Optional.of(walletPolicyThresholds(FeatureSet.MINIMAL)));
+        // 1000 spent of a 1000 cap → 100% → cap gate degrades, but the pool overrides it.
+        when(ledgerRepo.sumPeriodNetBillable(eq(42L), any(), any())).thenReturn(-1000L);
+        when(prepaidBundleService.prepaidRemainingUnits(42L)).thenReturn(5000L);
+
+        EntitlementSnapshot snap = service.getSnapshot(42L);
+
+        assertThat(snap.state()).isEqualTo(EntitlementState.FULL);
+        assertThat(snap.featureSet()).isEqualTo(FeatureSet.FULL);
+        assertThat(snap.enabledGates())
+                .containsExactlyInAnyOrder(
+                        FeatureGate.OFFSITE_PROCESSING,
+                        FeatureGate.AUTOMATION,
+                        FeatureGate.AI_SUPPORT,
+                        FeatureGate.CLIENT_SIDE);
+        // Still a subscribed team; the cap figures are unchanged, only the entitlement is
+        // overridden.
+        assertThat(snap.subscribed()).isTrue();
+        assertThat(snap.periodCapUnits()).isEqualTo(1000L);
+        assertThat(snap.periodSpendUnits()).isEqualTo(1000L);
+    }
+
+    @Test
+    void subscribedOverCapNoPrepaid_returnsDegraded() {
+        // Subscribed, over cap, no pool → degraded as before (regression guard: the pool override
+        // must
+        // not open the gate for a team that has none).
+        stubBilling(42L, subscribedContext(1000L));
+        when(walletPolicyRepo.findByTeamId(42L))
+                .thenReturn(Optional.of(walletPolicyThresholds(FeatureSet.MINIMAL)));
+        when(ledgerRepo.sumPeriodNetBillable(eq(42L), any(), any())).thenReturn(-1000L);
+        when(prepaidBundleService.prepaidRemainingUnits(42L)).thenReturn(0L);
+
+        EntitlementSnapshot snap = service.getSnapshot(42L);
+
+        assertThat(snap.state()).isEqualTo(EntitlementState.DEGRADED);
+        assertThat(snap.featureSet()).isEqualTo(FeatureSet.MINIMAL);
+        assertThat(snap.enabledGates())
+                .containsExactlyInAnyOrder(FeatureGate.OFFSITE_PROCESSING, FeatureGate.CLIENT_SIDE);
+    }
+
+    @Test
+    void subscribedUnderCap_prepaidNotConsulted() {
+        // Under cap → FULL, so the prepaid pool is never queried (lazy — only when the cap gate
+        // would
+        // otherwise degrade). Keeps the common subscribed path off the prepaid table.
+        stubBilling(42L, subscribedContext(1000L));
+        when(walletPolicyRepo.findByTeamId(42L))
+                .thenReturn(Optional.of(walletPolicyThresholds(FeatureSet.MINIMAL)));
+        when(ledgerRepo.sumPeriodNetBillable(eq(42L), any(), any())).thenReturn(-250L);
+
+        EntitlementSnapshot snap = service.getSnapshot(42L);
+
+        assertThat(snap.state()).isEqualTo(EntitlementState.FULL);
+        Mockito.verifyNoInteractions(prepaidBundleService);
+    }
+
     @Test
     void grantInWarnBand_returnsWarnedButFullFeatureSet() {
         // grant 100, remaining 15 → used 85 = 85% (between warn 80 and degrade 100).
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 72099ba949..48677633c4 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -5511,8 +5511,8 @@ title = "Recent billable activity"
 [payg.cap]
 amount = "Cap amount"
 custom = "Custom"
-docsEstimate = "≈ {{docs}} processed PDFs / month"
-docsRate = "at {{rate}} / PDF"
+docsEstimate = "≈ {{docs}} credits / month"
+docsRate = "at {{rate}} / credit"
 noCapDesc = "Usage is billed without an upper limit. You can re-enable a cap at any time."
 noCapLabel = "No cap"
 noneShort = "No cap"
@@ -5612,6 +5612,28 @@ docs = "PDFs"
 subtitle = "Billable PDFs each teammate has processed this period."
 title = "Team member usage"
 
+[payg.prepaid]
+chip = "Prepaid year"
+
+[payg.prepaid.banner]
+exhausted = "Your prepaid capacity is used up; metered billing has resumed. Top up to keep the discount."
+expiring_one = "Your prepaid year ends in {{count}} day. Unused capacity expires — top up to start a fresh year."
+expiring_other = "Your prepaid year ends in {{count}} days. Unused capacity expires — top up to start a fresh year."
+low = "You're down to {{pct}}% of your prepaid capacity. Top up any time to keep processing uninterrupted."
+
+[payg.prepaid.card]
+subtitle = "Used before metered billing and outside your spend cap."
+title = "Prepaid capacity"
+
+[payg.prepaid.meter]
+capSuffix = "of {{total}} prepaid credits"
+expires = "Expires {{date}}"
+
+[payg.prepaid.state]
+exhausted = "Used up"
+healthy = "Plenty left"
+low = "Running low"
+
 [payg.role]
 leader = "Team owner"
 member = "Member"
@@ -6331,10 +6353,21 @@ typing = "Typing"
 loading = "Loading"
 redirectingToEditor = "Redirecting to the editor..."
 
+[portal.billing.activation]
+maybeLater = "Maybe later"
+title = "Switch on the Processor"
+
+[portal.billing.activation.payg]
+sub = "Set a monthly limit. Pay for what you run."
+title = "Pay as you go"
+
+[portal.billing.activation.prepay]
+badge = "2 months free"
+sub = "One invoice, card or bank transfer."
+title = "Prepay a year"
+
 [portal.billing.checkout]
 noClientSecret = "Edge function returned no client_secret."
-stepCount = "Step {{step}} of 2"
-subtitle = "Add a card to keep going past your free Editor-plan grant. Stripe handles the rest."
 title = "Add a payment method"
 
 [portal.billing.checkout.activationSlow]
@@ -6343,12 +6376,14 @@ close = "Close"
 title = "Almost there"
 
 [portal.billing.checkout.cap]
+amountAria = "Monthly spend limit"
 back = "Back"
 continue = "Continue to payment"
 error = "Couldn't set your spend limit"
-finePrint = "Invoices post on the 1st. Cancel anytime and revert to the Editor plan; your policies and history stay intact."
-note = "Processing pauses if you reach it. You're never billed past this, and you can change it any time."
-subtitle = "You're billed only for PDFs you process past your first 500 free, never for seats — so your ceiling is yours from day one."
+finePrint = "Invoices post monthly. Cancel anytime."
+noLimit = "No limit"
+note = "You're never billed past your limit. Processing just pauses."
+perMonth = "/ mo"
 title = "Set your spend limit"
 
 [portal.billing.checkout.card]
@@ -6364,6 +6399,10 @@ body = "Your payment went through. We're switching on metered processing across
 hint = "Please keep this window open."
 title = "Activating your Processor plan..."
 
+[portal.billing.checkout.pay]
+limit = "Monthly spend limit {{amount}}/mo. Processing pauses at the limit."
+limitNoCap = "No spend limit. Processing won't pause. Invoices post monthly."
+
 [portal.billing.enterpriseUpsell]
 cta = "Explore Enterprise"
 description = "Committed volume discounts, air-gapped deployment, custom MSA and security reviews, and 3rd-party distributor partnerships."
@@ -6385,10 +6424,12 @@ currentPlan = "Current plan"
 freeForever = "Free forever"
 noTeamResolved = "No team is resolved on your wallet yet — refresh and try again."
 ownerOnly = "Only the team owner can switch on the Processor plan."
+payInvoice = "Pay invoice to complete"
 planName = "Editor"
 ssoIncluded = "SSO included"
 switchOnProcessor = "Switch on the Processor →"
 unlimitedUsers = "Unlimited users"
+viewQuote = "View quote"
 
 [portal.billing.invoices]
 columnAmount = "Amount"
@@ -6448,6 +6489,105 @@ unit = "PDFs"
 unitsPending_one = "{{units}} meter unit pending sync from linked instances"
 unitsPending_other = "{{units}} meter units pending sync from linked instances"
 
+[portal.billing.prepaid]
+capSuffix = "of {{total}} prepaid credits"
+expires = "Expires {{date}}"
+eyebrow = "Prepaid capacity"
+note = "Used before metered billing and outside your spend limit."
+topUp = "Top up"
+
+[portal.billing.prepaid.buy]
+back = "Back"
+calcTitle = "Calculate your annual payment"
+cancel = "Cancel"
+cancelPurchase = "Cancel purchase"
+close = "Close"
+continueToPayment = "Continue to payment"
+finalise = "Finalise"
+invoiceErrorTitle = "Couldn't generate the invoice"
+loadingTitle = "Loading your quote"
+payTitle = "Pay for your year"
+step = "Step {{current}} of {{total}}"
+
+[portal.billing.prepaid.calc]
+change = "Change"
+deployRow = "Deployment"
+done = "Done"
+enterpriseHint = "This is enterprise scale. At this volume, enterprise rates beat any self-serve discount. Rate lock, terms, and a quote in minutes."
+governanceRow = "Governance"
+governanceValue = "{{label}} · {{count}} policies"
+handlesLabel = "Your Processor"
+handlesValue = "handles {{volume}} credits / mo"
+pipelinesLabel = "Pipelines"
+policiesMeta = "{{count}} policies"
+poolCaption = "One pool of {{credits}} credits for the year. Heavy months borrow from light ones."
+priceLabel = "Your year · 12 months for the price of 10"
+rateUnknown = "We'll show the exact price at checkout."
+savings = "You save {{amount}} · 2 months free."
+sizingRow = "Sizing"
+sizingValue = "{{label}} · {{desc}}"
+usersLabel = "Total users"
+
+[portal.billing.prepaid.consent]
+label = "I understand that when my prepaid capacity is used up or expires after 12 months, processing automatically continues at the standard metered pay-as-you-go rate (up to my spend limit) unless I cancel, and that I can cancel anytime from the billing portal."
+
+[portal.billing.prepaid.deploy]
+cloud = "Stirling Cloud"
+cloudDesc = "Managed by Stirling. Live in minutes."
+cloudValue = "Stirling Cloud · Managed"
+selfhost = "Self-hosted"
+selfhostDesc = "Runs on private infrastructure. Same rate."
+selfhostValue = "Self-hosted · Private infrastructure"
+
+[portal.billing.prepaid.offer]
+cta = "Review offer"
+subtitle = "Prepay a year of PDF processing and get two months free, used before metered billing, outside your spend limit."
+title = "Get 12 months for the price of 10"
+
+[portal.billing.prepaid.pay]
+accountName = "Account holder name"
+accountNamePlaceholder = "e.g. Jane Smith"
+companyName = "Company name (optional)"
+companyNamePlaceholder = "e.g. Acme Inc."
+downloadInvoice = "Download invoice"
+payOnline = "Pay online"
+poNumber = "PO number (optional)"
+poNumberPlaceholder = "e.g. PO-2026-0142"
+
+[portal.billing.prepaid.pipelines]
+advanced = "Advanced"
+advancedDesc = "Pipelines drive most of your processing."
+none = "None"
+noneDesc = "Not running pipelines yet. Turn them on any time."
+standard = "Standard"
+standardDesc = "A few pipelines re-process arriving PDFs."
+
+[portal.billing.prepaid.posture]
+essentials = "Essentials"
+essentialsDesc = "Classification, the default, plus Sharing"
+governed = "Governed"
+governedDesc = "Adds Security and Routing"
+regulated = "Regulated"
+regulatedDesc = "Every category, incl. Compliance, Retention, Ingestion"
+
+[portal.billing.prepaid.review]
+download = "Download quote (PDF)"
+downloading = "Preparing…"
+share = "share for approval"
+
+[portal.billing.prepaid.size]
+compact = "Compact"
+compactDesc = "Files under 25 MB, no data charges"
+heavy = "Heavy"
+heavyDesc = "Scanned or image-heavy, routinely 50 MB+"
+standard = "Standard"
+standardDesc = "Mostly small, some scans past 25 MB"
+
+[portal.billing.prepaid.state]
+exhausted = "Used up"
+healthy = "Plenty left"
+low = "Running low"
+
 [portal.billing.spendLimit]
 adjustLimit = "Adjust limit"
 cancel = "Cancel"
@@ -6457,7 +6597,7 @@ capSuffixWithDocs = "/ month · ≈ {{documents}} documents"
 displaySub = "You're only billed for what you process automatically — never past the ceiling."
 editTitle = "Set your monthly ceiling"
 eyebrow = "Spend limit"
-guardrailBody = "a hard ceiling — you're never billed past it. At the cap, metered processing pauses (unlimited PDF editing keeps working) until you raise it or the cycle resets. Nothing is lost."
+guardrailBody = "a hard ceiling; you're never billed past it. At the cap, metered processing pauses (unlimited PDF editing keeps working) until you raise it or the cycle resets. Nothing is lost."
 guardrailLabel = "Your guardrail:"
 noCap = "no cap"
 pctUsed = "{{pct}}% used"
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx
index 53f4b98486..7774b6bc72 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/Payg.tsx
@@ -16,7 +16,7 @@
  *     V1 — so it shows a real empty state, not fabricated rows
  */
 import React, { useState } from "react";
-import { Group, Stack, Text } from "@mantine/core";
+import { Alert, Badge, Group, Stack, Text } from "@mantine/core";
 import { Button } from "@app/ui/Button";
 import { useRenderCount } from "@app/hooks/useRenderCount";
 import OpenInNewIcon from "@mui/icons-material/OpenInNew";
@@ -27,6 +27,10 @@ import ExpandMoreIcon from "@mui/icons-material/ExpandMoreRounded";
 import BoltIcon from "@mui/icons-material/BoltRounded";
 import AllInclusiveIcon from "@mui/icons-material/AllInclusiveRounded";
 import { alert as showToast } from "@app/components/toast";
+import {
+  PrepaidCapacityMeterPanel,
+  prepaidSnapshotFromWallet,
+} from "@app/components/shared/config/configSections/usageMeters";
 // Relative (not @app/*) so the co-located CSS + sibling component resolve directly.
 // eslint-disable-next-line no-restricted-imports
 import "./Payg.css";
@@ -665,6 +669,59 @@ function StripePortalLink({
   );
 }
 
+// ─── Prepaid bundle ───────────────────────────────────────────────────────
+
+function daysUntil(iso: string | null): number | null {
+  if (!iso) return null;
+  const end = new Date(iso).getTime();
+  if (Number.isNaN(end)) return null;
+  return Math.ceil((end - Date.now()) / 86_400_000);
+}
+
+/**
+ * Contextual nudge when prepaid capacity is running low, exhausted, or its term
+ * is nearly up (the demo's "top up to keep processing" strip). Leader-only CTA —
+ * members can't buy. Returns null when nothing needs saying.
+ */
+function PrepaidBanner({
+  snap,
+}: {
+  snap: NonNullable<ReturnType<typeof prepaidSnapshotFromWallet>>;
+}) {
+  const { t } = useTranslation();
+  const pctLeft = snap.total > 0 ? (snap.remaining / snap.total) * 100 : 0;
+  const days = daysUntil(snap.expiresAt);
+  const exhausted = snap.remaining <= 0;
+  const low = !exhausted && pctLeft <= 20;
+  const expiringSoon = days != null && days >= 0 && days <= 30;
+  if (!exhausted && !low && !expiringSoon) return null;
+
+  const message = exhausted
+    ? t(
+        "payg.prepaid.banner.exhausted",
+        "Your prepaid capacity is used up — metered billing has resumed. Top up to keep the discount.",
+      )
+    : low
+      ? t(
+          "payg.prepaid.banner.low",
+          "You're down to {{pct}}% of your prepaid capacity. Top up any time to keep processing uninterrupted.",
+          { pct: Math.max(1, Math.round(pctLeft)) },
+        )
+      : t(
+          "payg.prepaid.banner.expiring",
+          "Your prepaid year ends in {{count}} days. Unused capacity expires — top up to start a fresh year.",
+          // This arm only renders when expiringSoon (days is a valid number); ?? 0 satisfies the
+          // count option's number type.
+          { count: days ?? 0 },
+        );
+
+  return (
+    <Alert color={exhausted ? "red" : "yellow"} variant="light">
+      <span>{message}</span>
+    </Alert>
+  );
+}
+
 // ─── Main component ───────────────────────────────────────────────────────
 
 const Payg: React.FC<PaygProps> = ({
@@ -676,6 +733,10 @@ const Payg: React.FC<PaygProps> = ({
   useRenderCount(role === "LEADER" ? "PaygLeader" : "PaygMember");
   const { t } = useTranslation();
   const isLeader = role === "LEADER";
+  const prepaid = prepaidSnapshotFromWallet(wallet);
+  // Read-only prepaid display. The buy/top-up flow lives on the portal Processor page (the
+  // create-payg-bundle-checkout edge fn is driven from there); this editor Plan page only shows an
+  // existing prepaid balance and is slated for removal on a separate branch.
 
   const fmt = (iso: string) =>
     new Date(iso).toLocaleDateString(undefined, {
@@ -686,6 +747,8 @@ const Payg: React.FC<PaygProps> = ({
   return (
     <div className="payg">
       <Stack gap="md">
+        {prepaid && <PrepaidBanner snap={prepaid} />}
+
         {/* The modal chrome already renders the section title ("Billing &
             usage"), so we lead with the descriptive subtitle + role pill. */}
         <div className="payg-planhead">
@@ -700,11 +763,18 @@ const Payg: React.FC<PaygProps> = ({
                 },
               )}
             </span>
-            <span className="payg-role-pill" data-leader={isLeader}>
-              {isLeader
-                ? t("payg.role.leader", "Team owner")
-                : t("payg.role.member", "Member")}
-            </span>
+            <Group gap="xs" wrap="nowrap">
+              {wallet.billingMode === "prepaid" && (
+                <Badge color="blue" variant="light" radius="sm">
+                  {t("payg.prepaid.chip", "Prepaid year")}
+                </Badge>
+              )}
+              <span className="payg-role-pill" data-leader={isLeader}>
+                {isLeader
+                  ? t("payg.role.leader", "Team owner")
+                  : t("payg.role.member", "Member")}
+              </span>
+            </Group>
           </div>
 
           <div className="payg-planhead__split">
@@ -751,6 +821,25 @@ const Payg: React.FC<PaygProps> = ({
 
         <UsageHero wallet={wallet} />
 
+        {prepaid && (
+          <div className="payg-card">
+            <Stack gap="sm">
+              <div>
+                <div className="payg-card__title">
+                  {t("payg.prepaid.card.title", "Prepaid capacity")}
+                </div>
+                <div className="payg-card__subtitle">
+                  {t(
+                    "payg.prepaid.card.subtitle",
+                    "Used before metered billing and outside your spend cap.",
+                  )}
+                </div>
+              </div>
+              <PrepaidCapacityMeterPanel snap={prepaid} />
+            </Stack>
+          </div>
+        )}
+
         {isLeader ? (
           <CapEditor
             capUsd={wallet.capUsd}
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.tsx
index 654691c2fc..d6b8b336f4 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/SpendCapControl.tsx
@@ -43,11 +43,11 @@ const SpendCapControl: React.FC<SpendCapControlProps> = ({
         noCap: t("payg.cap.noCapLabel", "No cap"),
         save: saveLabel ?? t("payg.cap.save", "Update cap"),
         docsEstimate: (docs) =>
-          t("payg.cap.docsEstimate", "≈ {{docs}} processed PDFs / month", {
+          t("payg.cap.docsEstimate", "≈ {{docs}} credits / month", {
             docs,
           }),
         docsRate: (rate) =>
-          t("payg.cap.docsRate", "at {{rate}} / PDF", { rate }),
+          t("payg.cap.docsRate", "at {{rate}} / credit", { rate }),
         noCapDesc: t(
           "payg.cap.noCapDesc",
           "Usage is billed without an upper limit. You can re-enable a cap at any time.",
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css b/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css
index 46df9ddee4..54f4113f8f 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/UpgradeModal.css
@@ -208,6 +208,13 @@
   margin: 0 0 14px;
   line-height: 1.45;
 }
+/* Field caption above a segmented control in the bundle calculator. */
+.upm-field-label {
+  font-size: 0.8rem;
+  font-weight: 600;
+  color: var(--upm-text);
+  margin-bottom: 6px;
+}
 
 /* Cap selection (presets + custom + no-cap + estimate) now lives in the shared
    SpendCapControl (SpendCapControl.css). The old upm-cap-* / upm-no-cap-toggle
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx
index 4c8804027c..cb6eb511c9 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx
@@ -7,7 +7,12 @@
 import { useMemo } from "react";
 import { useTranslation } from "react-i18next";
 import { useWallet, type Wallet } from "@app/hooks/useWallet";
-import { currencySymbol, MeterBar, meterState } from "@app/billing";
+import {
+  currencySymbol,
+  formatPeriodDate,
+  MeterBar,
+  meterState,
+} from "@app/billing";
 import "@app/components/shared/config/configSections/Payg.css";
 import "@app/components/shared/config/configSections/PaygFree.css";
 
@@ -139,3 +144,73 @@ export function SpendCapMeterPanel({ snap }: { snap: SpendCapSnapshot }) {
     />
   );
 }
+
+// ─── Prepaid bundle capacity meter ──────────────────────────────────────────
+
+export interface PrepaidSnapshot {
+  /** Prepaid units still available across the team's in-term pools. */
+  remaining: number;
+  /** Total capacity of in-term pools — the "X of Y" denominator. */
+  total: number;
+  /** ISO date the soonest pool expires; null when no bundle. */
+  expiresAt: string | null;
+}
+
+/**
+ * Derive the prepaid-capacity snapshot from a wallet. Returns null when the team
+ * holds no in-term bundle ({@code prepaidUnitsTotal === 0}) so callers can skip
+ * the card entirely rather than render an empty meter.
+ */
+export function prepaidSnapshotFromWallet(
+  wallet: Wallet | null,
+): PrepaidSnapshot | null {
+  if (!wallet || wallet.prepaidUnitsTotal <= 0) return null;
+  return {
+    remaining: wallet.prepaidUnitsRemaining,
+    total: wallet.prepaidUnitsTotal,
+    expiresAt: wallet.prepaidExpiresAt,
+  };
+}
+
+/**
+ * Prepaid capacity meter. The bar fills as the pool is drawn down ({@code used =
+ * total − remaining}), so it WARNs when the pool is running low and DEGRADEs once
+ * exhausted — same bands as the free/cap meters. Prepaid is consumed ahead of the
+ * meter and outside the spend cap, so it reads as its own dimension.
+ */
+export function PrepaidCapacityMeterPanel({ snap }: { snap: PrepaidSnapshot }) {
+  const { t } = useTranslation();
+  const used = Math.max(0, snap.total - snap.remaining);
+  const { state, pct } = meterState(used, snap.total);
+  const stateLabel =
+    state === "DEGRADED"
+      ? t("payg.prepaid.state.exhausted", "Used up")
+      : state === "WARNED"
+        ? t("payg.prepaid.state.low", "Running low")
+        : t("payg.prepaid.state.healthy", "Plenty left");
+
+  return (
+    <MeterBar
+      state={state}
+      pct={pct}
+      figure={snap.remaining.toLocaleString()}
+      capSuffix={t(
+        "payg.prepaid.meter.capSuffix",
+        "of {{total}} prepaid PDFs",
+        {
+          total: snap.total.toLocaleString(),
+        },
+      )}
+      statusLabel={stateLabel}
+      meta={
+        snap.expiresAt ? (
+          <span>
+            {t("payg.prepaid.meter.expires", "Expires {{date}}", {
+              date: formatPeriodDate(snap.expiresAt, { year: true }),
+            })}
+          </span>
+        ) : undefined
+      }
+    />
+  );
+}
diff --git a/frontend/editor/src/cloud/hooks/useWallet.ts b/frontend/editor/src/cloud/hooks/useWallet.ts
index 0641535946..ccef26a8bc 100644
--- a/frontend/editor/src/cloud/hooks/useWallet.ts
+++ b/frontend/editor/src/cloud/hooks/useWallet.ts
@@ -136,7 +136,11 @@ function reuseIfEqual(prev: Wallet | null, next: Wallet): Wallet {
     prev.spendUnitsThisPeriod !== next.spendUnitsThisPeriod ||
     prev.docsProcessedThisPeriod !== next.docsProcessedThisPeriod ||
     prev.uniquePdfsThisPeriod !== next.uniquePdfsThisPeriod ||
-    prev.sizeMultiplierPdfsThisPeriod !== next.sizeMultiplierPdfsThisPeriod
+    prev.sizeMultiplierPdfsThisPeriod !== next.sizeMultiplierPdfsThisPeriod ||
+    prev.billingMode !== next.billingMode ||
+    prev.prepaidUnitsRemaining !== next.prepaidUnitsRemaining ||
+    prev.prepaidUnitsTotal !== next.prepaidUnitsTotal ||
+    prev.prepaidExpiresAt !== next.prepaidExpiresAt
   ) {
     return next;
   }
diff --git a/frontend/editor/src/portal/billing/stripe.test.ts b/frontend/editor/src/portal/billing/stripe.test.ts
index 53a732fb63..5b6d97b9f9 100644
--- a/frontend/editor/src/portal/billing/stripe.test.ts
+++ b/frontend/editor/src/portal/billing/stripe.test.ts
@@ -5,9 +5,10 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
  * already-subscribed-redirect vs neither-secret-nor-url mapping, the mock flag,
  * unconfigured Supabase, and the portal-session path.
  */
-const { getClient, invoke } = vi.hoisted(() => ({
+const { getClient, invoke, rpc } = vi.hoisted(() => ({
   getClient: vi.fn(),
   invoke: vi.fn(),
+  rpc: vi.fn(),
 }));
 
 vi.mock("@portal/auth/saasSupabase", () => ({ ensureSaasSupabase: vi.fn() }));
@@ -17,16 +18,24 @@ vi.mock("@app/auth/supabase/supabaseClient", () => ({
 }));
 
 import {
+  acceptBundleStripeQuote,
+  cancelBundleQuote,
+  createBundleStripeQuote,
   createCheckoutSession,
   createPortalSession,
+  fetchBundleQuotePdf,
+  finalizeBundleInvoice,
+  getLatestBundleQuote,
   StripeFunctionError,
+  upsertBundleQuote,
 } from "@portal/billing/stripe";
 
 const req = { teamId: 1, successUrl: "s", cancelUrl: "c" } as const;
 
 beforeEach(() => {
   invoke.mockReset();
-  getClient.mockReset().mockReturnValue({ functions: { invoke } });
+  rpc.mockReset();
+  getClient.mockReset().mockReturnValue({ functions: { invoke }, rpc });
 });
 afterEach(() => vi.restoreAllMocks());
 
@@ -41,7 +50,6 @@ describe("createCheckoutSession", () => {
       clientSecret: "cs_123",
       redirectUrl: null,
       alreadySubscribed: false,
-      mock: false,
     });
   });
 
@@ -60,14 +68,6 @@ describe("createCheckoutSession", () => {
     expect(s.clientSecret).toBeNull();
   });
 
-  it("flags a mock client secret", async () => {
-    invoke.mockResolvedValue({
-      data: { success: true, client_secret: "cs_mock_abc" },
-      error: null,
-    });
-    expect((await createCheckoutSession(req)).mock).toBe(true);
-  });
-
   it("throws when success is false", async () => {
     invoke.mockResolvedValue({
       data: { success: false, error: "no team" },
@@ -91,6 +91,276 @@ describe("createCheckoutSession", () => {
   });
 });
 
+describe("createBundleStripeQuote", () => {
+  it("sends team_id + quote_id (+ po_number) and maps the Stripe quote handles", async () => {
+    invoke.mockResolvedValue({
+      data: {
+        success: true,
+        stripe_quote_id: "qt_1",
+        stripe_quote_number: "QT-0007",
+      },
+      error: null,
+    });
+    const q = await createBundleStripeQuote({
+      teamId: 1,
+      quoteId: 7,
+      poNumber: "PO-9",
+    });
+    expect(q).toEqual({ stripeQuoteId: "qt_1", stripeQuoteNumber: "QT-0007" });
+    const [name, opts] = invoke.mock.calls[0];
+    expect(name).toBe("create-payg-bundle-quote");
+    expect(opts.body).toMatchObject({
+      team_id: 1,
+      quote_id: 7,
+      po_number: "PO-9",
+    });
+  });
+
+  it("throws when the edge fn reports failure", async () => {
+    invoke.mockResolvedValue({
+      data: { success: false, error: "bundle_pricing_not_configured" },
+      error: null,
+    });
+    await expect(
+      createBundleStripeQuote({ teamId: 1, quoteId: 7 }),
+    ).rejects.toThrow(/bundle_pricing_not_configured/);
+  });
+});
+
+describe("acceptBundleStripeQuote", () => {
+  it("maps the invoice response and sends quote_id", async () => {
+    invoke.mockResolvedValue({
+      data: {
+        success: true,
+        invoice_id: "in_1",
+        hosted_invoice_url: "https://pay/in_1",
+        invoice_pdf: "https://pdf/in_1",
+        status: "open",
+      },
+      error: null,
+    });
+    const inv = await acceptBundleStripeQuote({ teamId: 1, quoteId: 7 });
+    expect(inv).toEqual({
+      invoiceId: "in_1",
+      hostedInvoiceUrl: "https://pay/in_1",
+      invoicePdf: "https://pdf/in_1",
+      status: "open",
+    });
+    const [name, opts] = invoke.mock.calls[0];
+    expect(name).toBe("accept-payg-bundle-quote");
+    expect(opts.body).toMatchObject({ team_id: 1, quote_id: 7 });
+  });
+
+  it("throws when the edge fn reports failure", async () => {
+    invoke.mockResolvedValue({
+      data: { success: false, error: "quote_not_issued" },
+      error: null,
+    });
+    await expect(
+      acceptBundleStripeQuote({ teamId: 1, quoteId: 7 }),
+    ).rejects.toThrow(/quote_not_issued/);
+  });
+});
+
+describe("cancelBundleQuote", () => {
+  it("sends team_id + quote_id and resolves on success", async () => {
+    invoke.mockResolvedValue({ data: { success: true }, error: null });
+    await cancelBundleQuote({ teamId: 1, quoteId: 7 });
+    const [name, opts] = invoke.mock.calls[0];
+    expect(name).toBe("cancel-payg-bundle-quote");
+    expect(opts.body).toMatchObject({ team_id: 1, quote_id: 7 });
+  });
+
+  it("throws when the edge fn reports failure (e.g. already paid)", async () => {
+    invoke.mockResolvedValue({
+      data: { success: false, error: "invoice_already_paid" },
+      error: null,
+    });
+    await expect(cancelBundleQuote({ teamId: 1, quoteId: 7 })).rejects.toThrow(
+      /invoice_already_paid/,
+    );
+  });
+});
+
+describe("fetchBundleQuotePdf", () => {
+  it("returns the PDF blob from the GET route", async () => {
+    const blob = new Blob(["%PDF"], { type: "application/pdf" });
+    invoke.mockResolvedValue({ data: blob, error: null });
+    const out = await fetchBundleQuotePdf(7);
+    expect(out).toBe(blob);
+    const [name, opts] = invoke.mock.calls[0];
+    expect(name).toBe("create-payg-bundle-quote?quote_id=7");
+    expect(opts.method).toBe("GET");
+  });
+
+  it("throws when the response is not a file", async () => {
+    invoke.mockResolvedValue({ data: { success: false }, error: null });
+    await expect(fetchBundleQuotePdf(7)).rejects.toBeInstanceOf(
+      StripeFunctionError,
+    );
+  });
+});
+
+describe("upsertBundleQuote", () => {
+  const quoteInput = {
+    teamId: 1,
+    users: 25,
+    posturePolicies: 4,
+    sizeMult: 1.2,
+    pipelineMult: 1,
+    provisionedMonthlyVolume: 10000,
+    poolCredits: 576000,
+    priceMinor: 480000,
+    currency: "usd",
+    consented: true,
+    eulaVersion: "2026-07-draft",
+  } as const;
+
+  it("maps the RPC row and sends p_* args (create — no p_quote_id)", async () => {
+    rpc.mockResolvedValue({
+      data: [
+        {
+          quote_id: 7,
+          status: "issued",
+          valid_until: "2026-08-16T00:00:00Z",
+        },
+      ],
+      error: null,
+    });
+    const q = await upsertBundleQuote(quoteInput);
+    expect(q).toEqual({
+      quoteId: 7,
+      status: "issued",
+      validUntil: "2026-08-16T00:00:00Z",
+    });
+    const [fn, args] = rpc.mock.calls[0];
+    expect(fn).toBe("payg_upsert_bundle_quote");
+    expect(args).toMatchObject({
+      p_team_id: 1,
+      p_posture_policies: 4,
+      p_size_mult: 1.2,
+      p_pipeline_mult: 1,
+      p_pool_credits: 576000,
+      p_users: 25,
+      p_price_minor: 480000,
+      p_currency: "usd",
+      p_consented: true,
+      p_eula_version: "2026-07-draft",
+    });
+    expect(args).not.toHaveProperty("p_quote_id");
+  });
+
+  it("passes p_quote_id when editing an existing quote", async () => {
+    rpc.mockResolvedValue({
+      data: [{ quote_id: 7, status: "issued", valid_until: "x" }],
+      error: null,
+    });
+    await upsertBundleQuote({ ...quoteInput, quoteId: 7 });
+    expect(rpc.mock.calls[0][1]).toMatchObject({ p_quote_id: 7 });
+  });
+
+  it("throws a StripeFunctionError (with code) on an RPC error", async () => {
+    rpc.mockResolvedValue({
+      data: null,
+      error: { message: "not a leader", code: "42501" },
+    });
+    const err = await upsertBundleQuote(quoteInput).catch((e: unknown) => e);
+    expect(err).toBeInstanceOf(StripeFunctionError);
+    expect((err as StripeFunctionError).code).toBe("42501");
+  });
+});
+
+describe("finalizeBundleInvoice", () => {
+  it("maps the invoice response and sends quote_id (+ optional po_number)", async () => {
+    invoke.mockResolvedValue({
+      data: {
+        success: true,
+        invoice_id: "in_1",
+        hosted_invoice_url: "https://pay/in_1",
+        invoice_pdf: "https://pdf/in_1",
+        status: "open",
+      },
+      error: null,
+    });
+    const inv = await finalizeBundleInvoice({
+      teamId: 1,
+      quoteId: 7,
+      poNumber: "PO-9",
+    });
+    expect(inv).toEqual({
+      invoiceId: "in_1",
+      hostedInvoiceUrl: "https://pay/in_1",
+      invoicePdf: "https://pdf/in_1",
+      status: "open",
+    });
+    const [name, opts] = invoke.mock.calls[0];
+    expect(name).toBe("finalize-payg-bundle-invoice");
+    expect(opts.body).toMatchObject({
+      team_id: 1,
+      quote_id: 7,
+      po_number: "PO-9",
+    });
+  });
+
+  it("throws when the edge fn reports failure", async () => {
+    invoke.mockResolvedValue({
+      data: { success: false, error: "quote_not_accepted" },
+      error: null,
+    });
+    await expect(
+      finalizeBundleInvoice({ teamId: 1, quoteId: 7 }),
+    ).rejects.toThrow(/quote_not_accepted/);
+  });
+});
+
+describe("getLatestBundleQuote", () => {
+  it("maps the latest open quote row (numeric size_mult coerced)", async () => {
+    rpc.mockResolvedValue({
+      data: [
+        {
+          quote_id: 7,
+          users: 25,
+          posture_policies: 4,
+          size_mult: "1.2",
+          pipeline_mult: 1,
+          pool_credits: 576000,
+          price_minor: 480000,
+          currency: "usd",
+          consented_at: "2026-07-17T00:00:00Z",
+          stripe_quote_id: "qt_1",
+          stripe_quote_number: "QT-0007",
+          stripe_ref: "in_1",
+          valid_until: "2026-08-16T00:00:00Z",
+        },
+      ],
+      error: null,
+    });
+    const q = await getLatestBundleQuote(1);
+    expect(q).toEqual({
+      quoteId: 7,
+      users: 25,
+      posturePolicies: 4,
+      sizeMult: 1.2,
+      pipelineMult: 1,
+      poolCredits: 576000,
+      priceMinor: 480000,
+      currency: "usd",
+      consentedAt: "2026-07-17T00:00:00Z",
+      stripeQuoteId: "qt_1",
+      stripeQuoteNumber: "QT-0007",
+      stripeRef: "in_1",
+      validUntil: "2026-08-16T00:00:00Z",
+    });
+    expect(rpc.mock.calls[0][0]).toBe("payg_get_latest_bundle_quote");
+    expect(rpc.mock.calls[0][1]).toEqual({ p_team_id: 1 });
+  });
+
+  it("returns null when the team has no open quote", async () => {
+    rpc.mockResolvedValue({ data: [], error: null });
+    expect(await getLatestBundleQuote(1)).toBeNull();
+  });
+});
+
 describe("createPortalSession", () => {
   it("returns the portal URL", async () => {
     invoke.mockResolvedValue({
diff --git a/frontend/editor/src/portal/billing/stripe.ts b/frontend/editor/src/portal/billing/stripe.ts
index 930ed3fef3..8b9690d3f6 100644
--- a/frontend/editor/src/portal/billing/stripe.ts
+++ b/frontend/editor/src/portal/billing/stripe.ts
@@ -1,3 +1,4 @@
+import type { Stripe } from "@stripe/stripe-js";
 import { getSupabaseClient } from "@app/auth/supabase/supabaseClient";
 import { ensureSaasSupabase } from "@portal/auth/saasSupabase";
 
@@ -53,7 +54,6 @@ interface CheckoutResponse {
   url?: string;
   portal_url?: string;
   already_subscribed?: boolean;
-  mock?: boolean;
   error?: string;
 }
 
@@ -87,6 +87,158 @@ async function invoke<T>(
   return data;
 }
 
+/** Call a SECURITY DEFINER public.* RPC with the admin's JWT (same client as {@link invoke}). */
+async function rpc<T>(fn: string, args: Record<string, unknown>): Promise<T> {
+  ensureSaasSupabase();
+  const supabase = getSupabaseClient();
+  if (!supabase) {
+    throw new StripeFunctionError(
+      "SaaS Supabase not configured — set VITE_SUPABASE_URL.",
+      "unconfigured",
+    );
+  }
+  const { data, error } = await supabase.rpc(fn, args);
+  if (error) {
+    throw new StripeFunctionError(
+      error.message ?? `RPC ${fn} failed`,
+      (error as { code?: string }).code,
+    );
+  }
+  return data as T;
+}
+
+/** Inputs to {@link upsertBundleQuote} — the sized config + computed figures. */
+export interface BundleQuoteInput {
+  teamId: number;
+  users: number;
+  posturePolicies: number;
+  sizeMult: number;
+  pipelineMult: number;
+  provisionedMonthlyVolume: number;
+  /** Size-folded run-credits = the Stripe line quantity when this quote is paid. */
+  poolCredits: number;
+  /** Discounted total in minor units; null when the per-run rate is unknown. */
+  priceMinor: number | null;
+  currency: string;
+  /** Affirmative consent to the prepaid→metered auto-transition (ARL/EULA §7.2). */
+  consented: boolean;
+  eulaVersion: string;
+  /** When set, edits that existing (unpaid) quote instead of creating a new one. */
+  quoteId?: number;
+}
+
+/** A persisted prepaid-bundle quote (proforma) — {@code payg_upsert_bundle_quote} result. */
+export interface BundleQuote {
+  quoteId: number;
+  status: string;
+  validUntil: string;
+}
+
+interface BundleQuoteRow {
+  quote_id: number;
+  status: string;
+  valid_until: string;
+}
+
+/**
+ * Create (or edit an unpaid) prepaid-bundle quote via {@code payg_upsert_bundle_quote}. LEADER-gated
+ * server-side. The quote persists the sized config + figures so the buyer can download a numbered
+ * proforma to share for approval and check out against it later; capacity is still credited only on
+ * payment (the webhook), never here.
+ */
+export async function upsertBundleQuote(
+  input: BundleQuoteInput,
+): Promise<BundleQuote> {
+  const rows = await rpc<BundleQuoteRow[]>("payg_upsert_bundle_quote", {
+    p_team_id: input.teamId,
+    p_posture_policies: input.posturePolicies,
+    p_size_mult: input.sizeMult,
+    p_pipeline_mult: input.pipelineMult,
+    p_pool_credits: input.poolCredits,
+    p_users: input.users,
+    p_provisioned_monthly_volume: input.provisionedMonthlyVolume,
+    p_price_minor: input.priceMinor,
+    p_currency: input.currency,
+    p_consented: input.consented,
+    p_eula_version: input.eulaVersion,
+    ...(input.quoteId != null ? { p_quote_id: input.quoteId } : {}),
+  });
+  const row = rows?.[0];
+  if (!row) {
+    throw new StripeFunctionError("payg_upsert_bundle_quote returned no row");
+  }
+  return {
+    quoteId: row.quote_id,
+    status: row.status,
+    validUntil: row.valid_until,
+  };
+}
+
+/** A team's latest open bundle quote — {@code payg_get_latest_bundle_quote} result, for resume. */
+export interface LatestBundleQuote {
+  quoteId: number;
+  users: number | null;
+  posturePolicies: number;
+  sizeMult: number;
+  pipelineMult: number;
+  poolCredits: number;
+  priceMinor: number | null;
+  currency: string | null;
+  consentedAt: string | null;
+  stripeQuoteId: string | null;
+  stripeQuoteNumber: string | null;
+  /** The generated invoice id, set once the quote is accepted — lets the modal resume to the pay step. */
+  stripeRef: string | null;
+  validUntil: string;
+}
+
+interface LatestBundleQuoteRow {
+  quote_id: number;
+  users: number | null;
+  posture_policies: number;
+  size_mult: number | string;
+  pipeline_mult: number;
+  pool_credits: number;
+  price_minor: number | null;
+  currency: string | null;
+  consented_at: string | null;
+  stripe_quote_id: string | null;
+  stripe_quote_number: string | null;
+  stripe_ref: string | null;
+  valid_until: string;
+}
+
+/**
+ * Fetch the team's most-recent OPEN (draft/issued, unexpired) bundle quote via
+ * {@code payg_get_latest_bundle_quote}, so the modal can resume it instead of minting a fresh Stripe
+ * quote on every reopen. Returns null when the team has none.
+ */
+export async function getLatestBundleQuote(
+  teamId: number,
+): Promise<LatestBundleQuote | null> {
+  const rows = await rpc<LatestBundleQuoteRow[]>(
+    "payg_get_latest_bundle_quote",
+    { p_team_id: teamId },
+  );
+  const row = rows?.[0];
+  if (!row) return null;
+  return {
+    quoteId: row.quote_id,
+    users: row.users,
+    posturePolicies: row.posture_policies,
+    sizeMult: Number(row.size_mult),
+    pipelineMult: row.pipeline_mult,
+    poolCredits: row.pool_credits,
+    priceMinor: row.price_minor,
+    currency: row.currency,
+    consentedAt: row.consented_at,
+    stripeQuoteId: row.stripe_quote_id,
+    stripeQuoteNumber: row.stripe_quote_number,
+    stripeRef: row.stripe_ref,
+    validUntil: row.valid_until,
+  };
+}
+
 /**
  * Result of {@link createCheckoutSession}. Exactly ONE of {@code clientSecret}
  * or {@code redirectUrl} is set: clientSecret drives embedded Stripe Checkout
@@ -97,7 +249,6 @@ export interface CheckoutSession {
   clientSecret: string | null;
   redirectUrl: string | null;
   alreadySubscribed: boolean;
-  mock: boolean;
 }
 
 /**
@@ -144,13 +295,207 @@ export async function createCheckoutSession(
     clientSecret,
     redirectUrl,
     alreadySubscribed,
-    mock: Boolean(res.mock) || clientSecret?.startsWith("cs_mock_") === true,
   };
 }
 
-/** {@code VITE_STRIPE_PUBLISHABLE_KEY} — the Stripe pk used by embedded Checkout. */
+/** Result of {@link createBundleStripeQuote} — the Stripe-issued quote handles. */
+export interface BundleStripeQuote {
+  stripeQuoteId: string;
+  stripeQuoteNumber: string | null;
+}
+
+interface BundleStripeQuoteRequest {
+  teamId: number;
+  /** The persisted quote row (from {@link upsertBundleQuote}) to turn into a Stripe quote. */
+  quoteId: number;
+  /** Optional PO number printed on the quote + carried to the eventual invoice. */
+  poNumber?: string;
+  /** Net terms for the eventual invoice; defaults to 30 on the server. */
+  daysUntilDue?: number;
+}
+
+interface BundleStripeQuoteResponse {
+  success?: boolean;
+  stripe_quote_id?: string;
+  stripe_quote_number?: string | null;
+  error?: string;
+}
+
+/**
+ * Create + finalize the Stripe QUOTE backing a persisted quote row, via {@code create-payg-bundle-quote}.
+ * The customer-facing quote number + PDF are Stripe's. On edit the server cancels the prior Stripe quote
+ * and issues a new one. Capacity is credited only when the accepted quote's invoice is PAID (the webhook).
+ */
+export async function createBundleStripeQuote(
+  req: BundleStripeQuoteRequest,
+): Promise<BundleStripeQuote> {
+  const res = await invoke<BundleStripeQuoteResponse>(
+    "create-payg-bundle-quote",
+    {
+      team_id: req.teamId,
+      quote_id: req.quoteId,
+      ...(req.poNumber ? { po_number: req.poNumber } : {}),
+      ...(req.daysUntilDue != null ? { days_until_due: req.daysUntilDue } : {}),
+    },
+  );
+  if (!res.success || !res.stripe_quote_id) {
+    throw new StripeFunctionError(
+      res.error ?? "create-payg-bundle-quote failed",
+    );
+  }
+  return {
+    stripeQuoteId: res.stripe_quote_id,
+    stripeQuoteNumber: res.stripe_quote_number ?? null,
+  };
+}
+
+/** A raised Stripe invoice — the {@code accept-payg-bundle-quote} result. */
+export interface BundleInvoice {
+  invoiceId: string;
+  /** Stripe-hosted page where the buyer pays / downloads the invoice. */
+  hostedInvoiceUrl: string | null;
+  invoicePdf: string | null;
+  status: string | null;
+}
+
+interface BundleInvoiceResponse {
+  success?: boolean;
+  invoice_id?: string;
+  hosted_invoice_url?: string | null;
+  invoice_pdf?: string | null;
+  status?: string | null;
+  error?: string;
+}
+
+/**
+ * Accept the Stripe quote for a persisted quote row, via {@code accept-payg-bundle-quote}. Acceptance
+ * generates the net-terms invoice as a DRAFT (auto_advance off) and returns the hosted URL; the
+ * payment step ({@link finalizeBundleInvoice}) stamps the recipient + PO and finalizes it. Payable by
+ * card on the hosted page, or by bank transfer / PO. Capacity is credited only on invoice.paid.
+ */
+export async function acceptBundleStripeQuote(req: {
+  teamId: number;
+  quoteId: number;
+}): Promise<BundleInvoice> {
+  const res = await invoke<BundleInvoiceResponse>("accept-payg-bundle-quote", {
+    team_id: req.teamId,
+    quote_id: req.quoteId,
+  });
+  if (!res.success || !res.invoice_id) {
+    throw new StripeFunctionError(
+      res.error ?? "accept-payg-bundle-quote failed",
+    );
+  }
+  return {
+    invoiceId: res.invoice_id,
+    hostedInvoiceUrl: res.hosted_invoice_url ?? null,
+    invoicePdf: res.invoice_pdf ?? null,
+    status: res.status ?? null,
+  };
+}
+
+/**
+ * Finalize the accepted bundle invoice (stamping an optional PO), via {@code finalize-payg-bundle-invoice}.
+ * Returns the hosted checkout URL + PDF. Called by both Download-invoice and Pay-online; idempotent
+ * server-side (an already-finalized invoice comes back as-is, PO locked).
+ */
+export async function finalizeBundleInvoice(req: {
+  teamId: number;
+  quoteId: number;
+  poNumber?: string;
+  /** Optional company — becomes the invoice bill-to name (no length cap). */
+  companyName?: string;
+  /** Required account-holder name — the bill-to when there's no company, else an "Account holder" field. */
+  accountName?: string;
+}): Promise<BundleInvoice> {
+  const res = await invoke<BundleInvoiceResponse>(
+    "finalize-payg-bundle-invoice",
+    {
+      team_id: req.teamId,
+      quote_id: req.quoteId,
+      ...(req.poNumber ? { po_number: req.poNumber } : {}),
+      ...(req.companyName ? { company_name: req.companyName } : {}),
+      ...(req.accountName ? { account_name: req.accountName } : {}),
+    },
+  );
+  if (!res.success || !res.invoice_id) {
+    throw new StripeFunctionError(
+      res.error ?? "finalize-payg-bundle-invoice failed",
+    );
+  }
+  return {
+    invoiceId: res.invoice_id,
+    hostedInvoiceUrl: res.hosted_invoice_url ?? null,
+    invoicePdf: res.invoice_pdf ?? null,
+    status: res.status ?? null,
+  };
+}
+
+/**
+ * Cancel an unpaid prepaid-bundle purchase via {@code cancel-payg-bundle-quote}: the edge fn voids the
+ * invoice (delete if draft, void if finalized), best-effort cancels the Stripe quote, and voids the quote
+ * row so the buyer can start over. Nothing was charged (capacity is credited on invoice.paid), so there's
+ * no refund. Throws a StripeFunctionError on failure (e.g. {@code invoice_already_paid}).
+ */
+export async function cancelBundleQuote(req: {
+  teamId: number;
+  quoteId: number;
+}): Promise<void> {
+  const res = await invoke<{ success?: boolean; error?: string }>(
+    "cancel-payg-bundle-quote",
+    { team_id: req.teamId, quote_id: req.quoteId },
+  );
+  if (!res.success) {
+    throw new StripeFunctionError(
+      res.error ?? "cancel-payg-bundle-quote failed",
+    );
+  }
+}
+
+/**
+ * Fetch the Stripe-rendered quote PDF for a persisted quote, via the {@code create-payg-bundle-quote}
+ * GET route (streams application/pdf). Returns a Blob the caller can object-URL for download.
+ */
+export async function fetchBundleQuotePdf(quoteId: number): Promise<Blob> {
+  ensureSaasSupabase();
+  const supabase = getSupabaseClient();
+  if (!supabase) {
+    throw new StripeFunctionError(
+      "SaaS Supabase not configured — set VITE_SUPABASE_URL.",
+      "unconfigured",
+    );
+  }
+  const { data, error } = await supabase.functions.invoke<Blob>(
+    `create-payg-bundle-quote?quote_id=${quoteId}`,
+    { method: "GET" },
+  );
+  if (error) {
+    throw new StripeFunctionError(error.message ?? "quote PDF fetch failed");
+  }
+  if (!(data instanceof Blob)) {
+    throw new StripeFunctionError("quote PDF response was not a file");
+  }
+  return data;
+}
+
+/**
+ * {@code VITE_STRIPE_PUBLISHABLE_KEY} — the Stripe pk used by embedded Checkout. Coalesces to "" when
+ * unset so the declared `string` return type is honest (Vite substitutes `undefined` for a missing
+ * env var); callers guard with a falsy check.
+ */
 export function getStripePublishableKey(): string {
-  return import.meta.env.VITE_STRIPE_PUBLISHABLE_KEY;
+  return import.meta.env.VITE_STRIPE_PUBLISHABLE_KEY ?? "";
+}
+
+// Process-wide memoized Stripe.js loader, shared by the embedded-checkout modals so the SDK promise
+// is created once rather than per-modal. loadStripe is dynamically imported so its chunk only loads
+// when a checkout modal reaches its payment step.
+let stripePromise: Promise<Stripe | null> | null = null;
+export function loadStripeOnce(pk: string): Promise<Stripe | null> {
+  if (stripePromise === null) {
+    stripePromise = import("@stripe/stripe-js").then((m) => m.loadStripe(pk));
+  }
+  return stripePromise;
 }
 
 /**
diff --git a/frontend/editor/src/portal/components/billing/ActivationChoiceModal.stories.tsx b/frontend/editor/src/portal/components/billing/ActivationChoiceModal.stories.tsx
new file mode 100644
index 0000000000..c76c5ef21b
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/ActivationChoiceModal.stories.tsx
@@ -0,0 +1,20 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ActivationChoiceModal } from "@portal/components/billing/ActivationChoiceModal";
+import "@portal/components/billing/billing.css";
+
+const meta: Meta<typeof ActivationChoiceModal> = {
+  title: "Portal/Billing/ActivationChoiceModal",
+  component: ActivationChoiceModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    open: true,
+    onClose: () => {},
+    onChoosePayg: () => {},
+    onChoosePrepay: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof ActivationChoiceModal>;
+
+/** The "turn on the Processor" fork — pay as you go vs prepay a year. */
+export const Default: Story = {};
diff --git a/frontend/editor/src/portal/components/billing/ActivationChoiceModal.tsx b/frontend/editor/src/portal/components/billing/ActivationChoiceModal.tsx
new file mode 100644
index 0000000000..3b110fe187
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/ActivationChoiceModal.tsx
@@ -0,0 +1,119 @@
+import { useTranslation } from "react-i18next";
+import { Button, Card, Modal } from "@app/ui";
+import { PrepayModalHeader } from "@portal/components/billing/PrepayModalHeader";
+
+/** A clickable door-card (Card-as-button, matching ComponentCard's a11y pattern). */
+function DoorCard({
+  accent,
+  title,
+  badge,
+  sub,
+  ariaLabel,
+  onClick,
+}: {
+  accent?: boolean;
+  title: string;
+  badge?: string;
+  sub: string;
+  ariaLabel: string;
+  onClick: () => void;
+}) {
+  return (
+    <Card
+      interactive
+      padding="default"
+      role="button"
+      tabIndex={0}
+      aria-label={ariaLabel}
+      className={
+        "portal-billing__door" + (accent ? " portal-billing__door--accent" : "")
+      }
+      onClick={onClick}
+      onKeyDown={(e) => {
+        if (e.key === "Enter" || e.key === " ") {
+          e.preventDefault();
+          onClick();
+        }
+      }}
+    >
+      <span className="portal-billing__door-head">
+        <span className="portal-billing__door-title">{title}</span>
+        {badge && <span className="portal-billing__door-badge">{badge}</span>}
+      </span>
+      <span className="portal-billing__door-sub">{sub}</span>
+    </Card>
+  );
+}
+
+/**
+ * The "turn on the Processor" fork (demo D97): a free team chooses how to pay
+ * before any card is entered. Two door-cards, matching the demo —
+ *
+ *   - Pay as you go → the metered subscription checkout (spend limit + card).
+ *   - Prepay a year → the discounted bundle (calculator + one-time payment); the
+ *     backend silently stands up the metered subscription off the saved card so
+ *     metering resumes when the pool empties, so no spend-limit step is needed.
+ *
+ * Same per-PDF rate on both paths — prepay just front-loads two free months.
+ */
+export function ActivationChoiceModal({
+  open,
+  onClose,
+  onChoosePayg,
+  onChoosePrepay,
+}: {
+  open: boolean;
+  onClose: () => void;
+  onChoosePayg: () => void;
+  onChoosePrepay: () => void;
+}) {
+  const { t } = useTranslation();
+  return (
+    <Modal
+      open={open}
+      onClose={onClose}
+      width="md"
+      className="portal-billing__bundle-modal"
+      ariaLabel={t(
+        "portal.billing.activation.title",
+        "Switch on the Processor",
+      )}
+    >
+      <PrepayModalHeader
+        step={1}
+        title={t("portal.billing.activation.title", "Switch on the Processor")}
+        onClose={onClose}
+      />
+      <div className="portal-billing__door-grid">
+        <DoorCard
+          title={t("portal.billing.activation.payg.title", "Pay as you go")}
+          sub={t(
+            "portal.billing.activation.payg.sub",
+            "Set a monthly limit. Pay for what you run.",
+          )}
+          ariaLabel={t("portal.billing.activation.payg.title", "Pay as you go")}
+          onClick={onChoosePayg}
+        />
+        <DoorCard
+          accent
+          title={t("portal.billing.activation.prepay.title", "Prepay a year")}
+          badge={t("portal.billing.activation.prepay.badge", "2 months free")}
+          sub={t(
+            "portal.billing.activation.prepay.sub",
+            "One invoice, card or bank transfer.",
+          )}
+          ariaLabel={t(
+            "portal.billing.activation.prepay.title",
+            "Prepay a year",
+          )}
+          onClick={onChoosePrepay}
+        />
+      </div>
+      <div className="portal-billing__door-later">
+        <Button variant="quiet" onClick={onClose}>
+          {t("portal.billing.activation.maybeLater", "Maybe later")}
+        </Button>
+      </div>
+    </Modal>
+  );
+}
diff --git a/frontend/editor/src/portal/components/billing/BundleCheckoutModal.stories.tsx b/frontend/editor/src/portal/components/billing/BundleCheckoutModal.stories.tsx
new file mode 100644
index 0000000000..07d1f2a000
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/BundleCheckoutModal.stories.tsx
@@ -0,0 +1,45 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { useState } from "react";
+import { Button } from "@app/ui";
+import { BundleCheckoutModal } from "@portal/components/billing/BundleCheckoutModal";
+import {
+  prepaidWallet,
+  subscribedWallet,
+} from "@portal/components/billing/walletFixtures";
+import "@portal/components/billing/billing.css";
+
+// Direct checkout: no quote round-trip. With no Stripe key in Storybook, the pay step falls back
+// to the mock card placeholder + "Complete purchase" button (no network), so no MSW handler needed.
+const meta: Meta<typeof BundleCheckoutModal> = {
+  title: "Portal/Billing/BundleCheckoutModal",
+  component: BundleCheckoutModal,
+  parameters: { layout: "fullscreen" },
+};
+export default meta;
+type Story = StoryObj<typeof BundleCheckoutModal>;
+
+/** Opens on mount so the calculator step is visible without interaction. */
+function OpenOnMount({ wallet }: { wallet: typeof subscribedWallet }) {
+  const [open, setOpen] = useState(true);
+  return (
+    <div style={{ padding: 24 }}>
+      <Button onClick={() => setOpen(true)}>Open</Button>
+      <BundleCheckoutModal
+        open={open}
+        wallet={wallet}
+        onClose={() => setOpen(false)}
+        onComplete={() => setOpen(false)}
+      />
+    </div>
+  );
+}
+
+/** First purchase — the "Get 12 months for the price of 10" calculator. */
+export const FirstPurchase: Story = {
+  render: () => <OpenOnMount wallet={subscribedWallet} />,
+};
+
+/** Topping up an existing bundle — same flow, "Top up prepaid capacity" title. */
+export const TopUp: Story = {
+  render: () => <OpenOnMount wallet={prepaidWallet} />,
+};
diff --git a/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx b/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx
new file mode 100644
index 0000000000..6bb442f6ed
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx
@@ -0,0 +1,1393 @@
+import { useEffect, useMemo, useRef, useState } from "react";
+import { useTranslation } from "react-i18next";
+import {
+  Banner,
+  Button,
+  Checkbox,
+  FormField,
+  Input,
+  Modal,
+  NumberInput,
+  Skeleton,
+} from "@app/ui";
+import {
+  BUNDLE_PIPELINE_TIERS,
+  BUNDLE_POLICY_POSTURES,
+  BUNDLE_SIZE_TIERS,
+  type BundleQuoteBreakdown,
+  computeBundleQuote,
+  formatMinor,
+} from "@app/billing";
+import type { Wallet } from "@portal/api/billing";
+import {
+  acceptBundleStripeQuote,
+  cancelBundleQuote,
+  createBundleStripeQuote,
+  fetchBundleQuotePdf,
+  finalizeBundleInvoice,
+  getLatestBundleQuote,
+  StripeFunctionError,
+  upsertBundleQuote,
+  type BundleInvoice,
+  type BundleQuote,
+  type BundleStripeQuote,
+  type LatestBundleQuote,
+} from "@portal/billing/stripe";
+import { PrepayModalHeader } from "@portal/components/billing/PrepayModalHeader";
+
+/**
+ * Prepaid-bundle purchase modal for the Processor billing page — "12 months for
+ * the price of 10". Three steps inside the shared portal {@link Modal}:
+ *
+ *   1. Size your year — buyers size the purchase in PEOPLE. Team size drives an
+ *      estimated volume (≈80 PDFs/user/mo), provisioned ~3× above expected; the
+ *      finer settings (governance posture, file size, pipelines) scale it up. All
+ *      local, via the shared {@code computeBundleQuote} brain.
+ *      The calculator is the quote page: it also carries a "Download quote (PDF)"
+ *      link, which (like Accept) mints the Stripe QUOTE lazily via
+ *      create-payg-bundle-quote — nothing is minted just by sizing.
+ *   2. Review + pay — the same quote receipt card (with "Download quote (PDF)") plus recipient details
+ *      + consent. "Finalise" accepts the quote and generates the net-terms invoice, then the step flips
+ *      to the finalized state (Download invoice / Pay online). Paying opens Stripe's hosted invoice;
+ *      capacity lands via the webhook on invoice.paid, never here. No separate confirmation screen.
+ *
+ * The pool is denominated in size-folded RUNS — the same currency the meter charges
+ * on consumption — so a flat per-run rate reproduces the marketing calculator's
+ * total. The run-based brain (policy-count posture, pipelines, 1¢/run, 10/12) lives
+ * in {@code @app/billing}, shared with the backend.
+ */
+
+/** Default team size the calculator opens on. */
+const DEFAULT_USERS = 25;
+
+/**
+ * EULA version the prepay consent is recorded against (ARL/EULA §7.2). Legal owns
+ * the final value + copy; placeholder until the terms are finalised. Sent to the
+ * checkout edge fn as proof of what was agreed, and recorded in the session metadata.
+ */
+const CONSENT_EULA_VERSION = "2026-07-draft";
+
+function policiesFor(id: string): number {
+  return (
+    BUNDLE_POLICY_POSTURES.find((p) => p.id === id)?.policies ??
+    BUNDLE_POLICY_POSTURES[0].policies
+  );
+}
+function sizeMultFor(id: string): number {
+  return BUNDLE_SIZE_TIERS.find((s) => s.id === id)?.mult ?? 1;
+}
+function pipelineMultFor(id: string): number {
+  return BUNDLE_PIPELINE_TIERS.find((p) => p.id === id)?.mult ?? 1;
+}
+
+// Reverse maps — resume a persisted quote (which stores the multipliers) back to the picker ids.
+function postureIdFor(policies: number): string {
+  return (
+    BUNDLE_POLICY_POSTURES.find((p) => p.policies === policies)?.id ??
+    BUNDLE_POLICY_POSTURES[0].id
+  );
+}
+function sizeIdFor(mult: number): string {
+  return (
+    BUNDLE_SIZE_TIERS.find((s) => Math.abs(s.mult - mult) < 0.001)?.id ??
+    BUNDLE_SIZE_TIERS[0].id
+  );
+}
+function pipelineIdFor(mult: number): string {
+  return (
+    BUNDLE_PIPELINE_TIERS.find((p) => p.mult === mult)?.id ??
+    BUNDLE_PIPELINE_TIERS[0].id
+  );
+}
+
+/**
+ * Pre-quote calculator progress, persisted per team so closing the modal / reloading doesn't lose the
+ * buyer's place. Once a real quote exists it's the source of truth (loaded server-side), so this is
+ * only the "still sizing, nothing minted yet" fallback.
+ */
+interface CalcSettings {
+  users: number;
+  postureId: string;
+  sizeId: string;
+  pipelineId: string;
+  poNumber: string;
+  companyName: string;
+  accountName: string;
+  consented: boolean;
+}
+function calcStorageKey(teamId: number): string {
+  return `payg-bundle-calc:${teamId}`;
+}
+function readCalcSettings(teamId: number): CalcSettings | null {
+  try {
+    const raw = sessionStorage.getItem(calcStorageKey(teamId));
+    if (!raw) return null;
+    // Untrusted sessionStorage — coerce rather than assert, so a stale or schema-drifted blob can't
+    // inject a wrong-typed `users` into the pricing arithmetic (the id fields are additionally
+    // laundered by the ...IdFor() lookups downstream, but we default them here too).
+    const p = JSON.parse(raw) as Partial<Record<keyof CalcSettings, unknown>>;
+    const users = Number(p.users);
+    return {
+      users: Number.isFinite(users) && users > 0 ? users : DEFAULT_USERS,
+      postureId: typeof p.postureId === "string" ? p.postureId : "governed",
+      sizeId: typeof p.sizeId === "string" ? p.sizeId : "standard",
+      pipelineId: typeof p.pipelineId === "string" ? p.pipelineId : "none",
+      poNumber: typeof p.poNumber === "string" ? p.poNumber : "",
+      companyName: typeof p.companyName === "string" ? p.companyName : "",
+      accountName: typeof p.accountName === "string" ? p.accountName : "",
+      consented: p.consented === true,
+    };
+  } catch {
+    return null;
+  }
+}
+function writeCalcSettings(teamId: number, s: CalcSettings): void {
+  try {
+    sessionStorage.setItem(calcStorageKey(teamId), JSON.stringify(s));
+  } catch {
+    // sessionStorage unavailable (private mode / quota) — progress just won't persist.
+  }
+}
+function clearCalcSettings(teamId: number): void {
+  try {
+    sessionStorage.removeItem(calcStorageKey(teamId));
+  } catch {
+    // ignore
+  }
+}
+
+/**
+ * Open a URL in a new tab, falling back to same-tab navigation. A popup blocker can null the
+ * {@code window.open} even from a click, and reliably does when the open follows an await (as the
+ * invoice-PDF download does) — the fallback guarantees the buyer still reaches the invoice / PDF.
+ * Returns true if a new tab opened, false if it fell back to navigating this tab away.
+ */
+function openUrl(url: string): boolean {
+  const win = window.open(url, "_blank", "noopener,noreferrer");
+  if (win) return true;
+  window.location.assign(url);
+  return false;
+}
+
+interface Props {
+  open: boolean;
+  onClose: () => void;
+  /** Drives teamId, per-run rate, currency, and top-up vs first-buy copy. */
+  wallet: Wallet;
+  /** Fired after a completed purchase so the parent can refetch the wallet. */
+  onComplete?: () => void;
+}
+
+type Phase = "calc" | "pay";
+
+export function BundleCheckoutModal({
+  open,
+  onClose,
+  wallet,
+  onComplete,
+}: Props) {
+  const { t } = useTranslation();
+  const teamId = wallet.teamId;
+  const currency = wallet.currency ?? "usd";
+  const pricePerDocMinor = wallet.pricePerDocMinor;
+
+  const [phase, setPhase] = useState<Phase>("calc");
+  const [users, setUsers] = useState(DEFAULT_USERS);
+  const [postureId, setPostureId] = useState<string>("governed");
+  const [sizeId, setSizeId] = useState<string>("standard");
+  const [pipelineId, setPipelineId] = useState<string>("none");
+  const [consented, setConsented] = useState(false);
+  // Optional PO reference — stamped on the Stripe quote and carried to its invoice.
+  const [poNumber, setPoNumber] = useState("");
+  // Invoice recipient: company is optional (becomes the bill-to name); the account-holder name is
+  // required and appears on the invoice. Both stamped at finalize alongside the PO.
+  const [companyName, setCompanyName] = useState("");
+  const [accountName, setAccountName] = useState("");
+  // The persisted quote id, reused across edits so we drive ONE quote row (rather than spawning a new
+  // one on every click). Null until first persisted (or when there's no SaaS backend).
+  const [quoteId, setQuoteId] = useState<number | null>(null);
+  // The Stripe quote — created LAZILY on the first Download/Accept, then reused. We deliberately do NOT
+  // mint a Stripe quote just for opening the review step (a buyer tweaking the calculator would
+  // otherwise leave a trail of dead quotes). Null until first minted, or when there's no SaaS backend.
+  const [stripeQuote, setStripeQuote] = useState<BundleStripeQuote | null>(
+    null,
+  );
+  // The config signature the current stripeQuote was minted for. Editing back to the calculator and
+  // returning reuses that quote UNLESS this changed — so we only re-mint when the sizing/PO actually
+  // differs, not on every trip through review.
+  const [stripeQuoteSig, setStripeQuoteSig] = useState<string | null>(null);
+  // The invoice generated when the quote is accepted (awaiting payment); null when simulated.
+  const [invoice, setInvoice] = useState<BundleInvoice | null>(null);
+  // On resume, the total the quote was persisted at (server value), frozen so the receipt shows what
+  // the buyer actually quoted rather than a figure recomputed from a since-changed rate. Paired with
+  // the pool size it was persisted at — once the buyer edits the sizing (pool changes) we drop back to
+  // the live estimate, since editing re-mints and re-persists anyway.
+  const [persistedPriceMinor, setPersistedPriceMinor] = useState<number | null>(
+    null,
+  );
+  const [persistedPoolCredits, setPersistedPoolCredits] = useState<
+    number | null
+  >(null);
+  // Accept / Download in-flight + last error, surfaced on the calculator (the quote page).
+  const [busy, setBusy] = useState(false);
+  const [pdfBusy, setPdfBusy] = useState(false);
+  const [actionError, setActionError] = useState<string | null>(null);
+  // True while the on-open resume is in flight, so we show a loader instead of flashing the calculator
+  // before it swaps to the resumed step (e.g. payment). `wasOpen` lets us flip it synchronously on the
+  // open transition (below) so even the first render is the loader, not the calculator.
+  const [resolving, setResolving] = useState(false);
+  const [wasOpen, setWasOpen] = useState(false);
+  // Guards the persist effect so it can't overwrite storage with defaults before hydration finishes.
+  const hydratedRef = useRef(false);
+
+  // On open: resume the team's latest OPEN quote if one exists (the server is the source of truth) —
+  // reopening then continues that quote rather than minting a new one. If there's no quote yet, restore
+  // pre-quote calculator progress from sessionStorage. On close: reset in-memory state (the server quote
+  // and the stored progress persist for next time).
+  useEffect(() => {
+    if (!open) {
+      hydratedRef.current = false;
+      setPhase("calc");
+      setUsers(DEFAULT_USERS);
+      setPostureId("governed");
+      setSizeId("standard");
+      setPipelineId("none");
+      setConsented(false);
+      setPoNumber("");
+      setCompanyName("");
+      setAccountName("");
+      setQuoteId(null);
+      setStripeQuote(null);
+      setStripeQuoteSig(null);
+      setInvoice(null);
+      setPersistedPriceMinor(null);
+      setPersistedPoolCredits(null);
+      setBusy(false);
+      setPdfBusy(false);
+      setActionError(null);
+      return;
+    }
+    if (teamId == null) {
+      hydratedRef.current = true;
+      return;
+    }
+    let cancelled = false;
+    (async () => {
+      let latest: LatestBundleQuote | null;
+      try {
+        latest = await getLatestBundleQuote(teamId);
+      } catch {
+        latest = null; // no backend / not a leader — fall through to local progress
+      }
+      if (cancelled) return;
+      const saved = readCalcSettings(teamId);
+      if (latest) {
+        // Resume the existing quote: restore its sizing + consent + id (landing on the calculator), and
+        // relink any already-minted Stripe quote so Download/Accept reuse it rather than minting anew.
+        setUsers(latest.users ?? DEFAULT_USERS);
+        setPostureId(postureIdFor(latest.posturePolicies));
+        setSizeId(sizeIdFor(latest.sizeMult));
+        setPipelineId(pipelineIdFor(latest.pipelineMult));
+        setConsented(latest.consentedAt != null);
+        setQuoteId(latest.quoteId);
+        setPersistedPriceMinor(latest.priceMinor);
+        setPersistedPoolCredits(latest.poolCredits);
+        if (saved?.poNumber) setPoNumber(saved.poNumber);
+        if (saved?.companyName) setCompanyName(saved.companyName);
+        if (saved?.accountName) setAccountName(saved.accountName);
+        if (latest.stripeQuoteId) {
+          setStripeQuote({
+            stripeQuoteId: latest.stripeQuoteId,
+            stripeQuoteNumber: latest.stripeQuoteNumber,
+          });
+          // Match the reuse signature so resuming doesn't immediately re-mint the Stripe quote.
+          setStripeQuoteSig(
+            `${latest.poolCredits}|${(saved?.poNumber ?? "").trim()}`,
+          );
+        }
+        // Already accepted (an invoice exists) → resume straight to the payment step rather than the
+        // calculator. acceptBundleStripeQuote is idempotent: with stripe_ref set it retrieves the
+        // existing draft invoice instead of re-accepting.
+        if (latest.stripeRef) {
+          try {
+            const inv = await acceptBundleStripeQuote({
+              teamId,
+              quoteId: latest.quoteId,
+            });
+            if (!cancelled) {
+              setInvoice(inv);
+              setPhase("pay");
+            }
+          } catch {
+            // Couldn't reload the invoice; leave the buyer on the calculator (Continue re-accepts).
+          }
+        }
+      } else if (saved) {
+        setUsers(saved.users);
+        setPostureId(saved.postureId);
+        setSizeId(saved.sizeId);
+        setPipelineId(saved.pipelineId);
+        setPoNumber(saved.poNumber);
+        setCompanyName(saved.companyName ?? "");
+        setAccountName(saved.accountName ?? "");
+        setConsented(saved.consented);
+      }
+      hydratedRef.current = true;
+      if (!cancelled) setResolving(false);
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [open, teamId]);
+
+  // Persist pre-quote calculator progress so close/reload keeps the buyer's place. Held until hydration
+  // completes so it can't clobber restored values.
+  useEffect(() => {
+    if (!open || teamId == null || !hydratedRef.current) return;
+    writeCalcSettings(teamId, {
+      users,
+      postureId,
+      sizeId,
+      pipelineId,
+      poNumber,
+      companyName,
+      accountName,
+      consented,
+    });
+  }, [
+    open,
+    teamId,
+    users,
+    postureId,
+    sizeId,
+    pipelineId,
+    poNumber,
+    companyName,
+    accountName,
+    consented,
+  ]);
+
+  const quote = useMemo(
+    () =>
+      computeBundleQuote({
+        users,
+        posturePolicies: policiesFor(postureId),
+        sizeMult: sizeMultFor(sizeId),
+        pipelineMult: pipelineMultFor(pipelineId),
+        ratePerRunMinor: pricePerDocMinor,
+      }),
+    [users, postureId, sizeId, pipelineId, pricePerDocMinor],
+  );
+
+  // The receipt shows the persisted (server) total on resume so it matches the quote the buyer
+  // created, not a figure recomputed from a since-changed rate — but only while the sizing is
+  // unchanged (same pool). Editing the calculator changes the pool and reverts to the live estimate.
+  // savings tracks whichever total is shown so the receipt stays internally consistent.
+  const receiptQuote = useMemo(() => {
+    if (
+      persistedPriceMinor == null ||
+      persistedPoolCredits !== quote.poolCredits
+    ) {
+      return quote;
+    }
+    return {
+      ...quote,
+      priceMinor: persistedPriceMinor,
+      savingsMinor:
+        quote.listMinor != null
+          ? quote.listMinor - persistedPriceMinor
+          : quote.savingsMinor,
+    };
+  }, [quote, persistedPriceMinor, persistedPoolCredits]);
+
+  // Flip the loader on synchronously the moment the modal opens (React's "adjust state during render"),
+  // so the resume runs behind a loader from the very first frame — the calculator never shows en route to
+  // a resumed payment step. The effect above clears it once the resume resolves.
+  if (open !== wasOpen) {
+    setWasOpen(open);
+    setResolving(open && teamId != null);
+  }
+
+  if (!open || teamId == null) return null;
+
+  // calc → pay only needs a valid pool; consent + the account-holder name are captured on the payment
+  // step, so they gate the commit (accept + finalize).
+  const canContinue = quote.poolCredits > 0 && !quote.overEnterprise;
+  const nameProvided = accountName.trim().length > 0;
+  // Once the invoice is issued, the recipient details + consent are already captured on it and the fields
+  // are locked, so on resume Pay/Download just re-open the existing invoice — don't re-gate on the (now
+  // read-only, possibly-unrestored) inputs, or the buttons would be permanently disabled.
+  const invoiceIssued = invoice != null && invoice.status !== "draft";
+  const canAccept =
+    canContinue && (invoiceIssued || (consented && nameProvided));
+
+  // Persist (create or edit) the quote row. Returns null when there's no SaaS backend
+  // (Storybook/preview) — the review step then runs in a simulated state.
+  async function ensureQuote(): Promise<BundleQuote | null> {
+    if (teamId == null || quote.poolCredits <= 0) return null;
+    try {
+      const q = await upsertBundleQuote({
+        teamId,
+        users,
+        posturePolicies: policiesFor(postureId),
+        sizeMult: sizeMultFor(sizeId),
+        pipelineMult: pipelineMultFor(pipelineId),
+        provisionedMonthlyVolume: quote.provisionedMonthlyVolume,
+        poolCredits: quote.poolCredits,
+        priceMinor: quote.priceMinor,
+        currency,
+        consented,
+        eulaVersion: CONSENT_EULA_VERSION,
+        quoteId: quoteId ?? undefined,
+      });
+      setQuoteId(q.quoteId);
+      return q;
+    } catch (e) {
+      if (e instanceof StripeFunctionError && e.code === "unconfigured") {
+        return null; // no backend (Storybook/preview) — the flow simulates
+      }
+      throw e; // surfaced by the review step's error banner
+    }
+  }
+
+  // Lazily create (or reuse) the Stripe quote. Called ONLY from Download / Accept — never just from
+  // sizing — so tweaking the calculator never mints throwaway Stripe quotes. Reused as long as the
+  // sizing/PO is unchanged (so a Download then Accept is one quote); a real change re-mints and the edge
+  // fn cancels the superseded Stripe quote. Null with no SaaS backend.
+  async function ensureStripeQuote(): Promise<{
+    quoteId: number;
+    stripeQuote: BundleStripeQuote;
+  } | null> {
+    if (teamId == null) return null;
+    const sig = `${quote.poolCredits}|${poNumber.trim()}`;
+    if (stripeQuote && stripeQuoteSig === sig && quoteId != null) {
+      return { quoteId, stripeQuote }; // unchanged since last mint — reuse, no new quote
+    }
+    const q = await ensureQuote();
+    if (!q) return null;
+    const sq = await createBundleStripeQuote({
+      teamId,
+      quoteId: q.quoteId,
+      poNumber: poNumber.trim() || undefined,
+    });
+    setStripeQuote(sq);
+    setStripeQuoteSig(sig);
+    return { quoteId: q.quoteId, stripeQuote: sq };
+  }
+
+  // Continue to payment: mint (or reuse) the Stripe quote and advance to the payment step. We deliberately
+  // do NOT accept here — acceptance is the commitment and requires consent, which is captured on the
+  // payment step. Deferring accept also lets the buyer go Back and re-size (accepting locks the quote).
+  // No SaaS backend (Storybook/preview) → ensureStripeQuote returns null and we advance simulated.
+  async function handleContinue() {
+    if (!canContinue || busy || pdfBusy || teamId == null) return;
+    setBusy(true);
+    setActionError(null);
+    try {
+      await ensureStripeQuote();
+      setPhase("pay");
+    } catch (e) {
+      if (e instanceof StripeFunctionError && e.code === "unconfigured") {
+        setPhase("pay");
+        return;
+      }
+      setActionError(e instanceof Error ? e.message : String(e)); // stays on calc
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  // Commit the purchase, shared by Download-invoice + Pay-online (both gated on consent in the UI):
+  // record the pay-step consent on the quote (accept 409s without it), ACCEPT the quote to generate the
+  // invoice, then finalize it (stamping any PO, which locks it). Idempotent server-side — a re-accept
+  // returns the existing invoice, an already-finalized invoice comes back as-is. Returns the current
+  // (simulated) invoice when there's no SaaS backend.
+  async function acceptAndFinalize(): Promise<BundleInvoice | null> {
+    if (teamId == null || quoteId == null) return invoice;
+    await ensureQuote(); // persists consented=true (pay-step state) so accept can verify it
+    await acceptBundleStripeQuote({ teamId, quoteId });
+    const inv = await finalizeBundleInvoice({
+      teamId,
+      quoteId,
+      poNumber: poNumber.trim() || undefined,
+      companyName: companyName.trim() || undefined,
+      accountName: accountName.trim() || undefined,
+    });
+    setInvoice(inv);
+    return inv;
+  }
+
+  async function downloadInvoice() {
+    if (busy || pdfBusy || (!invoiceIssued && (!consented || !nameProvided)))
+      return;
+    setPdfBusy(true);
+    setActionError(null);
+    try {
+      const inv = await acceptAndFinalize();
+      if (inv?.invoicePdf) {
+        openUrl(inv.invoicePdf);
+      }
+    } catch (e) {
+      if (e instanceof StripeFunctionError && e.code === "unconfigured") return;
+      setActionError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setPdfBusy(false);
+    }
+  }
+
+  // Finalise (pre-payment): record consent + accept + finalize the invoice. Stays on the payment step —
+  // the view then flips to the finalized state (Download invoice / Pay online). No hosted redirect yet.
+  async function handleFinalise() {
+    if (!canAccept || busy || pdfBusy) return;
+    setBusy(true);
+    setActionError(null);
+    try {
+      await acceptAndFinalize(); // sets invoice → invoiceIssued flips the view to the paid actions
+    } catch (e) {
+      if (e instanceof StripeFunctionError && e.code === "unconfigured") {
+        // No SaaS backend (Storybook/preview) — simulate a finalized invoice so the view still flips.
+        setInvoice({
+          invoiceId: "sim",
+          hostedInvoiceUrl: null,
+          invoicePdf: null,
+          status: "open",
+        });
+        return;
+      }
+      setActionError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  // Pay online (post-finalise): open the hosted invoice, then close + let the parent refresh/poll.
+  // Payment clears out of band (the invoice.paid webhook), so there's no in-modal confirmation step.
+  function payOnline() {
+    if (busy || pdfBusy) return;
+    if (teamId != null) clearCalcSettings(teamId);
+    // If the hosted invoice opened in a new tab, close the modal and let the parent poll; if a popup
+    // blocker forced same-tab navigation, openUrl is already taking us to Stripe — nothing left to do.
+    if (invoice?.hostedInvoiceUrl && !openUrl(invoice.hostedInvoiceUrl)) return;
+    onClose();
+    onComplete?.();
+  }
+
+  // Download the Stripe-rendered quote PDF. Mints the quote (if not already) — that's what makes the
+  // PDF exist — then streams it. No SaaS backend → nothing to download.
+  async function downloadPdf() {
+    if (busy || pdfBusy || quote.poolCredits <= 0) return;
+    setPdfBusy(true);
+    setActionError(null);
+    try {
+      const ensured = await ensureStripeQuote();
+      if (!ensured) return;
+      const blob = await fetchBundleQuotePdf(ensured.quoteId);
+      const url = URL.createObjectURL(blob);
+      const a = document.createElement("a");
+      a.href = url;
+      a.download = `${ensured.stripeQuote.stripeQuoteNumber ?? "stirling-quote"}.pdf`;
+      document.body.appendChild(a);
+      a.click();
+      a.remove();
+      URL.revokeObjectURL(url);
+    } catch (e) {
+      if (e instanceof StripeFunctionError && e.code === "unconfigured") return;
+      setActionError(e instanceof Error ? e.message : String(e));
+    } finally {
+      setPdfBusy(false);
+    }
+  }
+
+  // Cancel an unpaid, already-accepted purchase and start over. Once accepted, the Stripe quote is
+  // terminal (editing + re-continuing would hit quote_already_accepted), so "back" can't just re-open the
+  // calculator — we void the invoice + quote server-side, then drop the accepted linkage and return to the
+  // calculator. Sizing is kept so they can adjust and re-quote; consent must be given again.
+  async function cancelPurchase() {
+    if (teamId == null || quoteId == null || busy || pdfBusy) return;
+    setBusy(true);
+    setActionError(null);
+    try {
+      await cancelBundleQuote({ teamId, quoteId });
+    } catch (e) {
+      if (!(e instanceof StripeFunctionError && e.code === "unconfigured")) {
+        setActionError(e instanceof Error ? e.message : String(e)); // stays on the pay step
+        return;
+      }
+      // No SaaS backend (Storybook/preview) — nothing to void; fall through and reset locally.
+    } finally {
+      setBusy(false);
+    }
+    setInvoice(null);
+    setStripeQuote(null);
+    setStripeQuoteSig(null);
+    setQuoteId(null);
+    setConsented(false);
+    setPhase("calc");
+  }
+
+  const footer =
+    phase === "calc" ? (
+      <div className="portal-billing__checkout-cap-actions">
+        <Button variant="quiet" disabled={pdfBusy} onClick={onClose}>
+          {t("portal.billing.prepaid.buy.cancel", "Cancel")}
+        </Button>
+        <Button
+          accent="premium"
+          disabled={!canContinue || pdfBusy}
+          onClick={handleContinue}
+          rightSection={<span aria-hidden>›</span>}
+        >
+          {t(
+            "portal.billing.prepaid.buy.continueToPayment",
+            "Continue to payment",
+          )}
+        </Button>
+      </div>
+    ) : invoiceIssued ? (
+      // Finalized: the invoice exists. Cancel purchase voids + restarts; Pay online opens the hosted invoice.
+      <div className="portal-billing__checkout-cap-actions">
+        <Button
+          variant="quiet"
+          disabled={busy || pdfBusy}
+          onClick={cancelPurchase}
+        >
+          {t("portal.billing.prepaid.buy.cancelPurchase", "Cancel purchase")}
+        </Button>
+        <Button accent="premium" disabled={busy || pdfBusy} onClick={payOnline}>
+          {t("portal.billing.prepaid.pay.payOnline", "Pay online")}
+        </Button>
+      </div>
+    ) : (
+      // Pre-finalize: review the quote, then Finalise to issue the invoice (Back re-opens the calculator).
+      <div className="portal-billing__checkout-cap-actions">
+        <Button
+          variant="quiet"
+          disabled={busy || pdfBusy}
+          onClick={() => setPhase("calc")}
+        >
+          {t("portal.billing.prepaid.buy.back", "Back")}
+        </Button>
+        <Button
+          accent="premium"
+          disabled={!canAccept || busy || pdfBusy}
+          onClick={handleFinalise}
+        >
+          {t("portal.billing.prepaid.buy.finalise", "Finalise")}
+        </Button>
+      </div>
+    );
+
+  return (
+    <Modal
+      open={open}
+      onClose={onClose}
+      width="md"
+      className="portal-billing__bundle-modal portal-billing__checkout-modal--framed"
+      ariaLabel={t(
+        "portal.billing.prepaid.offer.title",
+        "Get 12 months for the price of 10",
+      )}
+      footer={resolving ? undefined : footer}
+    >
+      <PrepayModalHeader
+        step={resolving ? undefined : phase === "pay" ? 3 : 2}
+        title={
+          resolving
+            ? t("portal.billing.prepaid.buy.loadingTitle", "Loading your quote")
+            : phase === "pay"
+              ? t("portal.billing.prepaid.buy.payTitle", "Pay for your year")
+              : t(
+                  "portal.billing.prepaid.buy.calcTitle",
+                  "Calculate your annual payment",
+                )
+        }
+        onClose={onClose}
+      />
+      <div className="portal-billing__checkout-scroll">
+        {resolving && (
+          <div className="portal-billing__bundle-pay" aria-busy="true">
+            <Skeleton height="3rem" />
+            <Skeleton height="8rem" />
+            <Skeleton height="3rem" />
+          </div>
+        )}
+        {!resolving && phase === "calc" && (
+          <CalculatorStep
+            users={users}
+            setUsers={setUsers}
+            postureId={postureId}
+            setPostureId={setPostureId}
+            sizeId={sizeId}
+            setSizeId={setSizeId}
+            pipelineId={pipelineId}
+            setPipelineId={setPipelineId}
+            quote={receiptQuote}
+            currency={currency}
+            onDownload={downloadPdf}
+            downloading={pdfBusy}
+            actionError={actionError}
+          />
+        )}
+        {!resolving && phase === "pay" && (
+          <PaymentStep
+            quote={receiptQuote}
+            currency={currency}
+            onDownloadQuote={downloadPdf}
+            poNumber={poNumber}
+            setPoNumber={setPoNumber}
+            companyName={companyName}
+            setCompanyName={setCompanyName}
+            accountName={accountName}
+            setAccountName={setAccountName}
+            consented={consented}
+            setConsented={setConsented}
+            poLocked={invoiceIssued}
+            onDownloadInvoice={downloadInvoice}
+            downloading={pdfBusy}
+            actionError={actionError}
+          />
+        )}
+      </div>
+    </Modal>
+  );
+}
+
+// ─── Shared: the quote receipt card ──────────────────────────────────────────
+// The sized plan, its price + savings, the credit pool, and a shareable proforma download. Shown on both
+// the calculator step and the payment step (so the buyer can review + download the quote before/after
+// finalizing it).
+
+function QuoteReceipt({
+  quote,
+  currency,
+  onDownload,
+  downloading,
+}: {
+  quote: BundleQuoteBreakdown;
+  currency: string;
+  /** Mint-if-needed + stream the Stripe quote PDF. */
+  onDownload: () => void;
+  downloading: boolean;
+}) {
+  const { t } = useTranslation();
+  return (
+    <div className="portal-billing__bundle-receipt">
+      <div className="portal-billing__bundle-receipt-row portal-billing__bundle-receipt-row--head">
+        <span>
+          {t("portal.billing.prepaid.calc.handlesLabel", "Your Processor")}
+        </span>
+        <strong>
+          {t(
+            "portal.billing.prepaid.calc.handlesValue",
+            "handles {{volume}} credits / mo",
+            { volume: quote.provisionedMonthlyVolume.toLocaleString() },
+          )}
+        </strong>
+      </div>
+      {quote.priceMinor != null ? (
+        <>
+          <div className="portal-billing__bundle-receipt-row">
+            <span>
+              {t(
+                "portal.billing.prepaid.calc.priceLabel",
+                "Your year · 12 months for the price of 10",
+              )}
+            </span>
+            <strong className="portal-billing__bundle-receipt-price">
+              {formatMinor(quote.priceMinor, currency)}
+            </strong>
+          </div>
+          {quote.savingsMinor != null && quote.savingsMinor > 0 && (
+            <p className="portal-billing__bundle-savings">
+              {t(
+                "portal.billing.prepaid.calc.savings",
+                "You save {{amount}} · 2 months free.",
+                { amount: formatMinor(quote.savingsMinor, currency) },
+              )}
+            </p>
+          )}
+        </>
+      ) : (
+        <p className="portal-billing__bundle-savings">
+          {t(
+            "portal.billing.prepaid.calc.rateUnknown",
+            "We'll show the exact price at checkout.",
+          )}
+        </p>
+      )}
+      {quote.poolCredits > 0 && (
+        <p className="portal-billing__bundle-pool">
+          {t(
+            "portal.billing.prepaid.calc.poolCaption",
+            "One pool of {{credits}} credits for the year. Heavy months borrow from light ones.",
+            { credits: quote.poolCredits.toLocaleString() },
+          )}
+        </p>
+      )}
+      {quote.poolCredits > 0 && (
+        <div
+          role="button"
+          tabIndex={0}
+          aria-disabled={downloading}
+          className="portal-billing__bundle-download"
+          onClick={onDownload}
+          onKeyDown={(e) => {
+            if (e.key === "Enter" || e.key === " ") {
+              e.preventDefault();
+              onDownload();
+            }
+          }}
+        >
+          <svg
+            width="13"
+            height="13"
+            viewBox="0 0 24 24"
+            fill="none"
+            stroke="currentColor"
+            strokeWidth="2"
+            strokeLinecap="round"
+            strokeLinejoin="round"
+            aria-hidden
+          >
+            <path d="M12 3v12m0 0l-4-4m4 4l4-4M4 21h16" />
+          </svg>
+          {downloading
+            ? t("portal.billing.prepaid.review.downloading", "Preparing…")
+            : t(
+                "portal.billing.prepaid.review.download",
+                "Download quote (PDF)",
+              )}
+          {!downloading && (
+            <span className="portal-billing__bundle-download-share">
+              · {t("portal.billing.prepaid.review.share", "share for approval")}
+            </span>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
+
+// ─── Step 1: users-first calculator ──────────────────────────────────────────
+
+interface CalcProps {
+  users: number;
+  setUsers: (v: number) => void;
+  postureId: string;
+  setPostureId: (v: string) => void;
+  sizeId: string;
+  setSizeId: (v: string) => void;
+  pipelineId: string;
+  setPipelineId: (v: string) => void;
+  quote: BundleQuoteBreakdown;
+  currency: string;
+  /** Mint-if-needed + stream the Stripe quote PDF. */
+  onDownload: () => void;
+  /** PDF download in flight. */
+  downloading: boolean;
+  /** Last Download error, surfaced inline. */
+  actionError: string | null;
+}
+
+interface PickerCard {
+  id: string;
+  title: string;
+  meta?: string;
+  desc: string;
+}
+
+function CalculatorStep({
+  users,
+  setUsers,
+  postureId,
+  setPostureId,
+  sizeId,
+  setSizeId,
+  pipelineId,
+  setPipelineId,
+  quote,
+  currency,
+  onDownload,
+  downloading,
+  actionError,
+}: CalcProps) {
+  const { t } = useTranslation();
+  // Deployment is a display-only finer setting (same rate self-serve); expanded
+  // tracks which row's card picker is bloomed (demo: one open at a time).
+  const [deployId, setDeployId] = useState<string>("cloud");
+  const [expanded, setExpanded] = useState<string | null>(null);
+
+  const deployCards: PickerCard[] = [
+    {
+      id: "cloud",
+      title: t("portal.billing.prepaid.deploy.cloud", "Stirling Cloud"),
+      desc: t(
+        "portal.billing.prepaid.deploy.cloudDesc",
+        "Managed by Stirling. Live in minutes.",
+      ),
+    },
+    {
+      id: "selfhost",
+      title: t("portal.billing.prepaid.deploy.selfhost", "Self-hosted"),
+      desc: t(
+        "portal.billing.prepaid.deploy.selfhostDesc",
+        "Runs on private infrastructure. Same rate.",
+      ),
+    },
+  ];
+  const sizeCards: PickerCard[] = [
+    {
+      id: "compact",
+      title: t("portal.billing.prepaid.size.compact", "Compact"),
+      meta: "×1",
+      desc: t(
+        "portal.billing.prepaid.size.compactDesc",
+        "Files under 25 MB, no data charges",
+      ),
+    },
+    {
+      id: "standard",
+      title: t("portal.billing.prepaid.size.standard", "Standard"),
+      meta: "×1.2",
+      desc: t(
+        "portal.billing.prepaid.size.standardDesc",
+        "Mostly small, some scans past 25 MB",
+      ),
+    },
+    {
+      id: "heavy",
+      title: t("portal.billing.prepaid.size.heavy", "Heavy"),
+      meta: "×2",
+      desc: t(
+        "portal.billing.prepaid.size.heavyDesc",
+        "Scanned or image-heavy, routinely 50 MB+",
+      ),
+    },
+  ];
+  const postureCards: PickerCard[] = [
+    {
+      id: "essentials",
+      title: t("portal.billing.prepaid.posture.essentials", "Essentials"),
+      meta: t(
+        "portal.billing.prepaid.calc.policiesMeta",
+        "{{count}} policies",
+        {
+          count: 2,
+        },
+      ),
+      desc: t(
+        "portal.billing.prepaid.posture.essentialsDesc",
+        "Classification, the default, plus Sharing",
+      ),
+    },
+    {
+      id: "governed",
+      title: t("portal.billing.prepaid.posture.governed", "Governed"),
+      meta: t(
+        "portal.billing.prepaid.calc.policiesMeta",
+        "{{count}} policies",
+        {
+          count: 4,
+        },
+      ),
+      desc: t(
+        "portal.billing.prepaid.posture.governedDesc",
+        "Adds Security and Routing",
+      ),
+    },
+    {
+      id: "regulated",
+      title: t("portal.billing.prepaid.posture.regulated", "Regulated"),
+      meta: t(
+        "portal.billing.prepaid.calc.policiesMeta",
+        "{{count}} policies",
+        {
+          count: 7,
+        },
+      ),
+      desc: t(
+        "portal.billing.prepaid.posture.regulatedDesc",
+        "Every category, incl. Compliance, Retention, Ingestion",
+      ),
+    },
+  ];
+  const pipelineCards: PickerCard[] = [
+    {
+      id: "none",
+      title: t("portal.billing.prepaid.pipelines.none", "None"),
+      desc: t(
+        "portal.billing.prepaid.pipelines.noneDesc",
+        "Not running pipelines yet. Turn them on any time.",
+      ),
+    },
+    {
+      id: "standard",
+      title: t("portal.billing.prepaid.pipelines.standard", "Standard"),
+      desc: t(
+        "portal.billing.prepaid.pipelines.standardDesc",
+        "A few pipelines re-process arriving PDFs.",
+      ),
+    },
+    {
+      id: "advanced",
+      title: t("portal.billing.prepaid.pipelines.advanced", "Advanced"),
+      desc: t(
+        "portal.billing.prepaid.pipelines.advancedDesc",
+        "Pipelines drive most of your processing.",
+      ),
+    },
+  ];
+
+  const find = (cards: PickerCard[], id: string) =>
+    cards.find((c) => c.id === id) ?? cards[0];
+  const size = find(sizeCards, sizeId);
+  const posture = find(postureCards, postureId);
+  const pipeline = find(pipelineCards, pipelineId);
+  const policies =
+    BUNDLE_POLICY_POSTURES.find((p) => p.id === postureId)?.policies ?? 0;
+
+  const deployValue =
+    deployId === "cloud"
+      ? t(
+          "portal.billing.prepaid.deploy.cloudValue",
+          "Stirling Cloud · Managed",
+        )
+      : t(
+          "portal.billing.prepaid.deploy.selfhostValue",
+          "Self-hosted · Private infrastructure",
+        );
+  const sizeValue = t(
+    "portal.billing.prepaid.calc.sizingValue",
+    "{{label}} · {{desc}}",
+    { label: size.title, desc: size.desc },
+  );
+  const postureValue = t(
+    "portal.billing.prepaid.calc.governanceValue",
+    "{{label}} · {{count}} policies",
+    { label: posture.title, count: policies },
+  );
+
+  const rows = [
+    {
+      id: "deploy",
+      label: t("portal.billing.prepaid.calc.deployRow", "Deployment"),
+      value: deployValue,
+      cards: deployCards,
+      activeId: deployId,
+      onPick: setDeployId,
+    },
+    {
+      id: "size",
+      label: t("portal.billing.prepaid.calc.sizingRow", "Sizing"),
+      value: sizeValue,
+      cards: sizeCards,
+      activeId: sizeId,
+      onPick: setSizeId,
+    },
+    {
+      id: "posture",
+      label: t("portal.billing.prepaid.calc.governanceRow", "Governance"),
+      value: postureValue,
+      cards: postureCards,
+      activeId: postureId,
+      onPick: setPostureId,
+    },
+    {
+      id: "pipes",
+      label: t("portal.billing.prepaid.calc.pipelinesLabel", "Pipelines"),
+      value: pipeline.title,
+      cards: pipelineCards,
+      activeId: pipelineId,
+      onPick: setPipelineId,
+    },
+  ];
+
+  return (
+    <div className="portal-billing__bundle-calc">
+      {actionError && (
+        <Banner
+          tone="danger"
+          title={t(
+            "portal.billing.prepaid.buy.invoiceErrorTitle",
+            "Couldn't generate the invoice",
+          )}
+        >
+          {actionError}
+        </Banner>
+      )}
+      <div className="portal-billing__bundle-field">
+        <div className="portal-billing__bundle-field-label">
+          {t("portal.billing.prepaid.calc.usersLabel", "Total users")}
+        </div>
+        <div className="portal-billing__bundle-users">
+          <NumberInput
+            value={users}
+            onChange={(v) => setUsers(typeof v === "number" ? v : 0)}
+            min={0}
+            step={1}
+            allowNegative={false}
+            aria-label={t(
+              "portal.billing.prepaid.calc.usersLabel",
+              "Total users",
+            )}
+          />
+        </div>
+      </div>
+
+      {/* Finer settings as progressive-disclosure rows — a "Change" blooms the card picker. */}
+      <div className="portal-billing__bundle-rows">
+        {rows.map((row) => {
+          const open = expanded === row.id;
+          return (
+            <div key={row.id} className="portal-billing__bundle-row">
+              <div
+                role="button"
+                tabIndex={0}
+                className="portal-billing__bundle-row-head"
+                aria-expanded={open}
+                onClick={() => setExpanded(open ? null : row.id)}
+                onKeyDown={(e) => {
+                  if (e.key === "Enter" || e.key === " ") {
+                    e.preventDefault();
+                    setExpanded(open ? null : row.id);
+                  }
+                }}
+              >
+                <span className="portal-billing__bundle-row-label">
+                  {row.label}
+                </span>
+                <span className="portal-billing__bundle-row-value">
+                  {row.value}
+                  <span className="portal-billing__bundle-row-change">
+                    {open
+                      ? t("portal.billing.prepaid.calc.done", "Done")
+                      : t("portal.billing.prepaid.calc.change", "Change")}
+                  </span>
+                </span>
+              </div>
+              {open && (
+                <div className="portal-billing__bundle-row-body">
+                  <div className="portal-billing__bundle-cards">
+                    {row.cards.map((card) => {
+                      const active = card.id === row.activeId;
+                      const pick = () => {
+                        row.onPick(card.id);
+                        setExpanded(null);
+                      };
+                      return (
+                        <div
+                          key={card.id}
+                          role="button"
+                          tabIndex={0}
+                          aria-pressed={active}
+                          className={
+                            "portal-billing__bundle-card" +
+                            (active
+                              ? " portal-billing__bundle-card--active"
+                              : "")
+                          }
+                          onClick={pick}
+                          onKeyDown={(e) => {
+                            if (e.key === "Enter" || e.key === " ") {
+                              e.preventDefault();
+                              pick();
+                            }
+                          }}
+                        >
+                          <span className="portal-billing__bundle-card-head">
+                            <span className="portal-billing__bundle-card-title">
+                              {card.title}
+                            </span>
+                            {card.meta && (
+                              <span className="portal-billing__bundle-card-meta">
+                                {card.meta}
+                              </span>
+                            )}
+                          </span>
+                          <span className="portal-billing__bundle-card-desc">
+                            {card.desc}
+                          </span>
+                        </div>
+                      );
+                    })}
+                  </div>
+                </div>
+              )}
+            </div>
+          );
+        })}
+      </div>
+
+      {/* Receipt — the sized plan, its price, the credit pool, and a shareable proforma. */}
+      <QuoteReceipt
+        quote={quote}
+        currency={currency}
+        onDownload={onDownload}
+        downloading={downloading}
+      />
+
+      {quote.overEnterprise && (
+        <p className="portal-billing__bundle-savings">
+          {t(
+            "portal.billing.prepaid.calc.enterpriseHint",
+            "This is enterprise scale. At this volume, enterprise rates beat any self-serve discount. Rate lock, terms, and a quote in minutes.",
+          )}
+        </p>
+      )}
+    </div>
+  );
+}
+
+// ─── Step 2: pay for your year (quote already accepted → PO · download · pay) ──
+
+function PaymentStep({
+  quote,
+  currency,
+  onDownloadQuote,
+  poNumber,
+  setPoNumber,
+  companyName,
+  setCompanyName,
+  accountName,
+  setAccountName,
+  consented,
+  setConsented,
+  poLocked,
+  onDownloadInvoice,
+  downloading,
+  actionError,
+}: {
+  quote: BundleQuoteBreakdown;
+  currency: string;
+  /** Mint-if-needed + stream the Stripe quote PDF (the receipt card's download link). */
+  onDownloadQuote: () => void;
+  poNumber: string;
+  setPoNumber: (v: string) => void;
+  companyName: string;
+  setCompanyName: (v: string) => void;
+  accountName: string;
+  setAccountName: (v: string) => void;
+  consented: boolean;
+  setConsented: (v: boolean) => void;
+  /** True once the invoice is finalized (first Download/Pay) — recipient fields + consent lock. */
+  poLocked: boolean;
+  /** Finalize + open the invoice PDF. */
+  onDownloadInvoice: () => void;
+  downloading: boolean;
+  actionError: string | null;
+}) {
+  const { t } = useTranslation();
+  return (
+    <div className="portal-billing__bundle-pay">
+      {actionError && (
+        <Banner
+          tone="danger"
+          title={t(
+            "portal.billing.prepaid.buy.invoiceErrorTitle",
+            "Couldn't generate the invoice",
+          )}
+        >
+          {actionError}
+        </Banner>
+      )}
+      <QuoteReceipt
+        quote={quote}
+        currency={currency}
+        onDownload={onDownloadQuote}
+        downloading={downloading}
+      />
+      {/* Recipient + PO capture. Hidden once the invoice is issued: locked onto the invoice and we don't
+          hold the values to re-display, so empty disabled inputs would just read as broken. Company + PO
+          share a row to keep the step compact. */}
+      {!poLocked && (
+        <div className="portal-billing__bundle-fields">
+          <FormField
+            label={t(
+              "portal.billing.prepaid.pay.accountName",
+              "Account holder name",
+            )}
+            required
+          >
+            <Input
+              inputSize="sm"
+              value={accountName}
+              onChange={(e) => setAccountName(e.target.value)}
+              placeholder={t(
+                "portal.billing.prepaid.pay.accountNamePlaceholder",
+                "e.g. Jane Smith",
+              )}
+            />
+          </FormField>
+          <div className="portal-billing__bundle-field-row">
+            <FormField
+              label={t(
+                "portal.billing.prepaid.pay.companyName",
+                "Company name (optional)",
+              )}
+            >
+              <Input
+                inputSize="sm"
+                value={companyName}
+                onChange={(e) => setCompanyName(e.target.value)}
+                placeholder={t(
+                  "portal.billing.prepaid.pay.companyNamePlaceholder",
+                  "e.g. Acme Inc.",
+                )}
+              />
+            </FormField>
+            <FormField
+              label={t(
+                "portal.billing.prepaid.pay.poNumber",
+                "PO number (optional)",
+              )}
+            >
+              <Input
+                inputSize="sm"
+                value={poNumber}
+                onChange={(e) => setPoNumber(e.target.value)}
+                placeholder={t(
+                  "portal.billing.prepaid.pay.poNumberPlaceholder",
+                  "e.g. PO-2026-0142",
+                )}
+              />
+            </FormField>
+          </div>
+        </div>
+      )}
+      {/* Consent (pre-finalize only): acknowledges that once the prepaid pool is used up / expires,
+          metered pay-as-you-go continues (up to the spend limit) unless cancelled — no annual auto-renewal
+          is claimed, since the bundle isn't a subscription. Hidden once the invoice is issued: it's locked
+          and already recorded, so a disabled checkbox just adds noise. Legal owns the wording. */}
+      {!poLocked && (
+        <div className="portal-billing__bundle-consent">
+          <Checkbox
+            checked={consented}
+            onChange={(e) => setConsented(e.currentTarget.checked)}
+            label={t(
+              "portal.billing.prepaid.consent.label",
+              "I understand that when my prepaid capacity is used up or expires after 12 months, processing automatically continues at the standard metered pay-as-you-go rate (up to my spend limit) unless I cancel, and that I can cancel anytime from the billing portal.",
+            )}
+          />
+        </div>
+      )}
+      {/* Download invoice appears once the invoice is finalized (its PDF exists). Pre-finalize, the
+          receipt card's "Download quote (PDF)" is the shareable document. */}
+      {poLocked && (
+        <div className="portal-billing__bundle-foot-end">
+          <Button
+            variant="quiet"
+            disabled={downloading}
+            onClick={onDownloadInvoice}
+          >
+            {downloading
+              ? t("portal.billing.prepaid.review.downloading", "Preparing…")
+              : t(
+                  "portal.billing.prepaid.pay.downloadInvoice",
+                  "Download invoice",
+                )}
+          </Button>
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/billing/CardPlaceholder.tsx b/frontend/editor/src/portal/components/billing/CardPlaceholder.tsx
new file mode 100644
index 0000000000..af1cd78b1b
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/CardPlaceholder.tsx
@@ -0,0 +1,34 @@
+import { useTranslation } from "react-i18next";
+import { LockIcon } from "@portal/components/icons";
+
+/**
+ * Card-form stand-in shown on the checkout payment step when no Stripe publishable key is configured
+ * (Storybook / preview / mis-config), so the step still reads correctly without mounting Stripe.
+ * Shared by the subscription checkout and the prepaid-bundle checkout modals.
+ */
+export function CardPlaceholder() {
+  const { t } = useTranslation();
+  return (
+    <div className="portal-billing__card-placeholder">
+      <div className="portal-billing__card-placeholder-head">
+        <span>{t("portal.billing.checkout.card.label", "Card details")}</span>
+        <span className="portal-billing__card-placeholder-badge">Stripe</span>
+      </div>
+      <div className="portal-billing__card-placeholder-field">
+        <LockIcon size={13} />
+        <span>
+          {t(
+            "portal.billing.checkout.card.fields",
+            "Card number · MM / YY · CVC · ZIP",
+          )}
+        </span>
+      </div>
+      <p className="portal-billing__card-placeholder-note">
+        {t(
+          "portal.billing.checkout.card.note",
+          "Card details collected by Stripe. Stirling never stores PAN or CVC.",
+        )}
+      </p>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/billing/FreePlanView.tsx b/frontend/editor/src/portal/components/billing/FreePlanView.tsx
index a2027ff756..5b704f3860 100644
--- a/frontend/editor/src/portal/components/billing/FreePlanView.tsx
+++ b/frontend/editor/src/portal/components/billing/FreePlanView.tsx
@@ -8,6 +8,10 @@ import { WalletMeter } from "@portal/components/billing/WalletMeter";
 import { FreePdfEditorsCard } from "@portal/components/billing/FreePdfEditorsCard";
 import { EnterpriseUpsell } from "@portal/components/billing/EnterpriseUpsell";
 import { StripeCheckoutModal } from "@portal/components/billing/StripeCheckoutModal";
+import { ActivationChoiceModal } from "@portal/components/billing/ActivationChoiceModal";
+import { BundleCheckoutModal } from "@portal/components/billing/BundleCheckoutModal";
+import { PrepaidCapacityCard } from "@portal/components/billing/PrepaidCapacityCard";
+import { useBundleFlowState } from "@portal/hooks/useBundleFlowState";
 
 interface Props {
   wallet: Wallet;
@@ -32,7 +36,9 @@ function isSaasCurrency(c: string | null): c is SaasCurrency {
  */
 export function FreePlanView({ wallet, unsynced, onSubscribed }: Props) {
   const { t } = useTranslation();
-  const [modalOpen, setModalOpen] = useState(false);
+  // Activation fork (demo D97): choose → the metered checkout (payg) or the
+  // discounted bundle (prepay). Exactly one is open at a time.
+  const [step, setStep] = useState<"choose" | "payg" | "prepay" | null>(null);
   const [missingTeam, setMissingTeam] = useState<string | null>(null);
 
   const isLeader = wallet.role === "leader";
@@ -40,7 +46,12 @@ export function FreePlanView({ wallet, unsynced, onSubscribed }: Props) {
     ? wallet.currency
     : "usd";
 
-  function openCheckout() {
+  // Where this team sits in the prepaid-bundle flow, read on load so the CTA names
+  // the resume action rather than always restarting the fork. Leader + team gated
+  // (the RPC 403s otherwise). Refreshed when any activation modal closes.
+  const flow = useBundleFlowState(wallet.teamId, isLeader);
+
+  function requireTeam(): boolean {
     if (wallet.teamId == null) {
       setMissingTeam(
         t(
@@ -48,23 +59,44 @@ export function FreePlanView({ wallet, unsynced, onSubscribed }: Props) {
           "No team is resolved on your wallet yet — refresh and try again.",
         ),
       );
-      return;
+      return false;
     }
     setMissingTeam(null);
-    setModalOpen(true);
+    return true;
+  }
+
+  // No quote yet → open the pay-as-you-go vs prepay fork. A quote already in flight
+  // → skip the fork and reopen the bundle modal directly; its resume effect lands
+  // on the calculator (quote) or the payment step (invoice awaiting payment).
+  function openActivation() {
+    if (requireTeam()) setStep("choose");
+  }
+  function resumeBundle() {
+    if (requireTeam()) setStep("prepay");
+  }
+
+  // Closing any activation modal re-reads the flow state so the CTA reflects a
+  // freshly-minted quote / invoice without a full page reload.
+  function closeModals() {
+    setStep(null);
+    flow.refresh();
   }
 
   const switchOnAction = isLeader ? (
     <Button
       variant="primary"
       accent="premium"
-      onClick={openCheckout}
+      onClick={flow.status === "none" ? openActivation : resumeBundle}
       disabled={wallet.teamId == null}
     >
-      {t(
-        "portal.billing.freePlan.switchOnProcessor",
-        "Switch on the Processor →",
-      )}
+      {flow.status === "invoice"
+        ? t("portal.billing.freePlan.payInvoice", "Pay invoice to complete")
+        : flow.status === "quote"
+          ? t("portal.billing.freePlan.viewQuote", "View quote")
+          : t(
+              "portal.billing.freePlan.switchOnProcessor",
+              "Switch on the Processor →",
+            )}
     </Button>
   ) : null;
 
@@ -93,6 +125,15 @@ export function FreePlanView({ wallet, unsynced, onSubscribed }: Props) {
 
       <FreePdfEditorsCard />
 
+      {/* Prepaid capacity is usable independent of a metered subscription, so surface it here on the
+          free plan too (not just the subscribed dashboard) whenever the team holds a live pool. */}
+      {wallet.prepaidUnitsRemaining > 0 && (
+        <PrepaidCapacityCard
+          wallet={wallet}
+          onBuy={isLeader ? resumeBundle : undefined}
+        />
+      )}
+
       {/* Processor trial — meter with the inline upgrade CTA */}
       <WalletMeter
         wallet={wallet}
@@ -123,10 +164,17 @@ export function FreePlanView({ wallet, unsynced, onSubscribed }: Props) {
       {/* Volume discount / Enterprise */}
       <EnterpriseUpsell />
 
+      <ActivationChoiceModal
+        open={step === "choose"}
+        onClose={closeModals}
+        onChoosePayg={() => setStep("payg")}
+        onChoosePrepay={() => setStep("prepay")}
+      />
+
       {wallet.teamId != null && (
         <StripeCheckoutModal
-          open={modalOpen}
-          onClose={() => setModalOpen(false)}
+          open={step === "payg"}
+          onClose={closeModals}
           teamId={wallet.teamId}
           currency={currency}
           pricePerDocMinor={wallet.pricePerDocMinor}
@@ -134,6 +182,22 @@ export function FreePlanView({ wallet, unsynced, onSubscribed }: Props) {
           onComplete={() => onSubscribed?.() ?? Promise.resolve(false)}
         />
       )}
+
+      {/* Prepay reuses the bundle modal (free team → first-purchase copy, no cap
+          step). On completion the webhook credits the pool AND silently creates
+          the metered subscription off the saved card, so we poll like the payg
+          path to flip the wallet to subscribed. */}
+      {wallet.teamId != null && (
+        <BundleCheckoutModal
+          open={step === "prepay"}
+          onClose={closeModals}
+          wallet={wallet}
+          onComplete={() => {
+            closeModals();
+            void onSubscribed?.();
+          }}
+        />
+      )}
     </div>
   );
 }
diff --git a/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx b/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx
new file mode 100644
index 0000000000..038b8be6d5
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx
@@ -0,0 +1,109 @@
+import { useTranslation } from "react-i18next";
+import { Button, Card } from "@app/ui";
+import { formatPeriodDate, MeterBar, meterState } from "@app/billing";
+import type { Wallet } from "@portal/api/billing";
+
+/**
+ * Prepaid-bundle capacity for the subscribed Processor dashboard, and the entry
+ * point for buying it. Two faces, driven by whether the team holds a bundle:
+ *
+ *   - No bundle → a slim "Get 12 months for the price of 10" offer nudge with a
+ *     "Review offer" CTA (the demo's commit-nudge card), shown only when a buyer
+ *     ({@code onBuy}, leader) is present.
+ *   - Bundle held → the capacity meter (fills as the pool is drawn down, so it
+ *     warns as capacity runs low) plus a "Top up" action for the leader.
+ *
+ * Prepaid is consumed before metered billing and sits outside the spend limit, so
+ * it reads as its own dimension. Buying/topping up opens {@code BundleCheckoutModal}
+ * via {@code onBuy}; members (no {@code onBuy}) get the display-only meter.
+ */
+export function PrepaidCapacityCard({
+  wallet,
+  onBuy,
+}: {
+  wallet: Wallet;
+  /** Leader-only: opens the purchase/top-up modal. Omit for members. */
+  onBuy?: () => void;
+}) {
+  const { t } = useTranslation();
+
+  // No bundle yet — show the buy nudge (leader only), else nothing.
+  if (wallet.prepaidUnitsTotal <= 0) {
+    if (!onBuy) return null;
+    return (
+      <Card padding="loose" className="portal-billing__prepaid-offer">
+        <div>
+          <div className="portal-billing__section-title">
+            {t(
+              "portal.billing.prepaid.offer.title",
+              "Get 12 months for the price of 10",
+            )}
+          </div>
+          <p className="portal-billing__prepaid-offer-sub">
+            {t(
+              "portal.billing.prepaid.offer.subtitle",
+              "Prepay a year of PDF processing and get two months free — used before metered billing, outside your spend limit.",
+            )}
+          </p>
+        </div>
+        <Button variant="secondary" onClick={onBuy}>
+          {t("portal.billing.prepaid.offer.cta", "Review offer")}
+        </Button>
+      </Card>
+    );
+  }
+
+  const remaining = wallet.prepaidUnitsRemaining;
+  const total = wallet.prepaidUnitsTotal;
+  const used = Math.max(0, total - remaining);
+  const { state, pct } = meterState(used, total);
+  const stateLabel =
+    state === "DEGRADED"
+      ? t("portal.billing.prepaid.state.exhausted", "Used up")
+      : state === "WARNED"
+        ? t("portal.billing.prepaid.state.low", "Running low")
+        : t("portal.billing.prepaid.state.healthy", "Plenty left");
+
+  return (
+    <Card padding="loose">
+      <span className="portal-billing__eyebrow">
+        {t("portal.billing.prepaid.eyebrow", "Prepaid capacity")}
+      </span>
+      <MeterBar
+        state={state}
+        pct={pct}
+        figure={remaining.toLocaleString()}
+        capSuffix={t(
+          "portal.billing.prepaid.capSuffix",
+          "of {{total}} prepaid PDFs",
+          {
+            total: total.toLocaleString(),
+          },
+        )}
+        statusLabel={stateLabel}
+        meta={
+          wallet.prepaidExpiresAt ? (
+            <span>
+              {t("portal.billing.prepaid.expires", "Expires {{date}}", {
+                date: formatPeriodDate(wallet.prepaidExpiresAt, { year: true }),
+              })}
+            </span>
+          ) : undefined
+        }
+      />
+      <div className="portal-billing__prepaid-foot">
+        <p className="portal-billing__section-sub">
+          {t(
+            "portal.billing.prepaid.note",
+            "Used before metered billing and outside your spend limit.",
+          )}
+        </p>
+        {onBuy && (
+          <Button variant="secondary" size="sm" onClick={onBuy}>
+            {t("portal.billing.prepaid.topUp", "Top up")}
+          </Button>
+        )}
+      </div>
+    </Card>
+  );
+}
diff --git a/frontend/editor/src/portal/components/billing/PrepayModalHeader.tsx b/frontend/editor/src/portal/components/billing/PrepayModalHeader.tsx
new file mode 100644
index 0000000000..c099836ee4
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/PrepayModalHeader.tsx
@@ -0,0 +1,91 @@
+import { useTranslation } from "react-i18next";
+import { Button } from "@app/ui";
+// The trademarked Stirling wordmark — the font is baked into the SVG (no brand webfont is loaded), so
+// we render the same asset the portal nav uses rather than styled text. Theme-switched in CSS.
+import wordmarkLight from "@app/assets/brand/modern-logo/StirlingProcessorLogoBlackText.svg";
+import wordmarkDark from "@app/assets/brand/modern-logo/StirlingProcessorLogoWhiteText.svg";
+
+/**
+ * Shared header for the prepay-flow modals — the prepaid wizard (activation → calculator → pay, of 3)
+ * and the metered checkout (spend limit → payment, of 2): Stirling brand + "Step N of M" badge + close,
+ * an M-segment progress bar, and the step title. Pass {@code step=undefined} to hide the badge +
+ * progress (e.g. a terminal confirmation).
+ */
+export function PrepayModalHeader({
+  step,
+  total = 3,
+  title,
+  onClose,
+}: {
+  step?: number;
+  /** Total steps in this flow (3 for the prepaid wizard, 2 for the metered checkout). */
+  total?: number;
+  title: string;
+  onClose: () => void;
+}) {
+  const { t } = useTranslation();
+  const showSteps = step != null;
+  const filled = step ?? 0;
+  return (
+    <div className="portal-billing__bundle-head">
+      <div className="portal-billing__bundle-head-top">
+        <div className="portal-billing__bundle-brand">
+          <img
+            src={wordmarkLight}
+            alt="Stirling"
+            className="portal-billing__bundle-wordmark wordmark-light-only"
+          />
+          <img
+            src={wordmarkDark}
+            alt=""
+            aria-hidden
+            className="portal-billing__bundle-wordmark wordmark-dark-only"
+          />
+        </div>
+        <div className="portal-billing__bundle-head-right">
+          {showSteps && (
+            <span className="portal-billing__bundle-step">
+              {t(
+                "portal.billing.prepaid.buy.step",
+                "Step {{current}} of {{total}}",
+                { current: step, total },
+              )}
+            </span>
+          )}
+          <Button
+            variant="tertiary"
+            accent="neutral"
+            size="sm"
+            shape="circle"
+            onClick={onClose}
+            aria-label={t("portal.billing.prepaid.buy.close", "Close")}
+            leftSection={
+              <svg
+                viewBox="0 0 24 24"
+                width="16"
+                height="16"
+                fill="none"
+                stroke="currentColor"
+                strokeWidth={1.75}
+                strokeLinecap="round"
+                strokeLinejoin="round"
+                aria-hidden
+              >
+                <line x1="18" y1="6" x2="6" y2="18" />
+                <line x1="6" y1="6" x2="18" y2="18" />
+              </svg>
+            }
+          />
+        </div>
+      </div>
+      {showSteps && (
+        <div className="portal-billing__bundle-progress" aria-hidden>
+          <span className={filled >= 1 ? "is-filled" : ""} />
+          <span className={filled >= 2 ? "is-filled" : ""} />
+          {total >= 3 && <span className={filled >= 3 ? "is-filled" : ""} />}
+        </div>
+      )}
+      <div className="portal-billing__bundle-head-title">{title}</div>
+    </div>
+  );
+}
diff --git a/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx b/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
index 65d32ed8ea..c30a7d68b5 100644
--- a/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
+++ b/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
@@ -1,19 +1,24 @@
 import { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import { Banner, Button, Modal, Skeleton, Spinner } from "@app/ui";
-import { SpendCapControl } from "@app/billing";
+import {
+  currencySymbol,
+  docCapForMoney,
+  formatMinor,
+} from "@app/billing/format";
 import {
   EmbeddedCheckout,
   EmbeddedCheckoutProvider,
 } from "@stripe/react-stripe-js";
-import type { Stripe } from "@stripe/stripe-js";
 import { updateCap } from "@portal/api/billing";
 import {
   createCheckoutSession,
   getStripePublishableKey,
+  loadStripeOnce,
   type SaasCurrency,
 } from "@portal/billing/stripe";
-import { LockIcon } from "@portal/components/icons";
+import { CardPlaceholder } from "@portal/components/billing/CardPlaceholder";
+import { PrepayModalHeader } from "@portal/components/billing/PrepayModalHeader";
 
 interface Props {
   open: boolean;
@@ -29,10 +34,10 @@ interface Props {
   /** Optional billing email prefill (Stripe locks the field when set). */
   billingOwnerEmail?: string;
   /**
-   * Fired when Stripe (or the mock continue button) signals payment success.
-   * Runs the caller's activation flow (poll the wallet until the subscription
-   * webhook lands) and resolves {@code true} once subscribed, {@code false} if
-   * it's taking longer than the poll window.
+   * Fired when Stripe signals payment success. Runs the caller's activation flow
+   * (poll the wallet until the subscription webhook lands) and resolves {@code
+   * true} once subscribed, {@code false} if it's taking longer than the poll
+   * window.
    */
   onComplete: () => Promise<boolean>;
 }
@@ -51,29 +56,6 @@ const DEFAULT_CAP_USD = 100;
  * If the team is already subscribed the edge function short-circuits to a Stripe
  * Customer Portal URL; we open it in a new tab and close.
  */
-let stripePromise: Promise<Stripe | null> | null = null;
-function loadStripeOnce(pk: string): Promise<Stripe | null> {
-  if (stripePromise === null) {
-    stripePromise = import("@stripe/stripe-js").then((m) => m.loadStripe(pk));
-  }
-  return stripePromise;
-}
-
-/** Two-segment progress header: step 1 = spend limit, step 2 = payment. */
-function StepProgress({ step }: { step: 1 | 2 }) {
-  const { t } = useTranslation();
-  return (
-    <div className="portal-billing__checkout-progress">
-      <div className="portal-billing__checkout-steps" aria-hidden>
-        <span className="is-done" />
-        <span className={step >= 2 ? "is-done" : ""} />
-      </div>
-      <span className="portal-billing__checkout-stepcount">
-        {t("portal.billing.checkout.stepCount", "Step {{step}} of 2", { step })}
-      </span>
-    </div>
-  );
-}
 
 /** Payment done, waiting for the subscription webhook to activate the plan. */
 function CheckoutFinalizing() {
@@ -125,33 +107,114 @@ function CheckoutActivationSlow({ onClose }: { onClose: () => void }) {
 }
 
 /**
- * Placeholder for the card form when no Stripe publishable key is configured
- * (Storybook / preview / mis-config). Mirrors the real embedded form's framing
- * so the step reads correctly without mounting Stripe.
+ * Spend-limit picker for step 1: a primary editable amount ({@code $ 100 / mo}) with quick-pick chips
+ * below. The amount field is the main entry — always visible, defaulted, and typeable — and clicking a
+ * chip (or "No cap") just writes into it. Controlled via {@code capUsd}/{@code onChange}
+ * (null = no cap, a number = a monthly ceiling).
  */
-function CardPlaceholder() {
+function SpendLimitPicker({
+  capUsd,
+  onChange,
+  currency,
+  pricePerDocMinor,
+  presets,
+  disabled,
+}: {
+  capUsd: number | null;
+  onChange: (v: number | null) => void;
+  currency: SaasCurrency;
+  pricePerDocMinor?: number | null;
+  presets: readonly number[];
+  disabled?: boolean;
+}) {
   const { t } = useTranslation();
+  const sym = currencySymbol(currency);
+  const isNoCap = capUsd === null;
+  // Local mirror so partial typing isn't clobbered by the controlled value; resync when not focused
+  // (e.g. a chip sets the amount, or an initial cap loads in).
+  const [text, setText] = useState(capUsd != null ? String(capUsd) : "");
+  const [focused, setFocused] = useState(false);
+  useEffect(() => {
+    if (!focused) setText(capUsd != null ? String(capUsd) : "");
+  }, [capUsd, focused]);
+
+  const docs = docCapForMoney(capUsd, pricePerDocMinor);
+
+  const onInput = (raw: string) => {
+    const cleaned = raw.replace(/[^0-9]/g, "");
+    setText(cleaned);
+    onChange(cleaned === "" ? 0 : parseInt(cleaned, 10));
+  };
+
   return (
-    <div className="portal-billing__card-placeholder">
-      <div className="portal-billing__card-placeholder-head">
-        <span>{t("portal.billing.checkout.card.label", "Card details")}</span>
-        <span className="portal-billing__card-placeholder-badge">Stripe</span>
-      </div>
-      <div className="portal-billing__card-placeholder-field">
-        <LockIcon size={13} />
-        <span>
-          {t(
-            "portal.billing.checkout.card.fields",
-            "Card number · MM / YY · CVC · ZIP",
+    <div className="portal-billing__caplimit">
+      <div
+        className="portal-billing__caplimit-field"
+        data-nocap={isNoCap ? "true" : "false"}
+      >
+        <span className="portal-billing__caplimit-sym">{sym}</span>
+        <input
+          className="portal-billing__caplimit-input"
+          inputMode="numeric"
+          value={isNoCap ? "" : text}
+          placeholder={
+            isNoCap ? t("portal.billing.checkout.cap.noLimit", "No limit") : ""
+          }
+          aria-label={t(
+            "portal.billing.checkout.cap.amountAria",
+            "Monthly spend limit",
           )}
+          onChange={(e) => onInput(e.target.value)}
+          onFocus={() => setFocused(true)}
+          onBlur={() => setFocused(false)}
+          disabled={disabled}
+        />
+        <span className="portal-billing__caplimit-suffix">
+          {t("portal.billing.checkout.cap.perMonth", "/ mo")}
         </span>
       </div>
-      <p className="portal-billing__card-placeholder-note">
-        {t(
-          "portal.billing.checkout.card.note",
-          "Card details collected by Stripe. Stirling never stores PAN or CVC.",
-        )}
-      </p>
+
+      <div className="portal-billing__caplimit-chips">
+        {presets.map((p) => (
+          <Button
+            key={p}
+            type="button"
+            variant="quiet"
+            className="portal-billing__caplimit-chip"
+            data-selected={capUsd === p ? "true" : "false"}
+            onClick={() => onChange(p)}
+            disabled={disabled}
+          >
+            {sym}
+            {p.toLocaleString()}
+          </Button>
+        ))}
+        <Button
+          type="button"
+          variant="quiet"
+          className="portal-billing__caplimit-chip"
+          data-selected={isNoCap ? "true" : "false"}
+          onClick={() => onChange(null)}
+          disabled={disabled}
+        >
+          {t("payg.cap.noCapLabel", "No cap")}
+        </Button>
+      </div>
+
+      {docs != null && (
+        <div className="portal-billing__caplimit-estimate">
+          <span className="portal-billing__caplimit-estimate-main">
+            {t("payg.cap.docsEstimate", "≈ {{docs}} credits / month", {
+              docs: docs.toLocaleString(),
+            })}
+          </span>
+          <span className="portal-billing__caplimit-estimate-sub">
+            {t("payg.cap.docsRate", "at {{rate}} / credit", {
+              rate: formatMinor(pricePerDocMinor ?? 0, currency),
+            })}
+          </span>
+        </div>
+      )}
     </div>
   );
 }
@@ -294,30 +357,36 @@ export function StripeCheckoutModal({
     if (dismissable) onClose();
   };
 
-  const onCapStep = phase === "cap";
-  const title = onCapStep
-    ? t("portal.billing.checkout.cap.title", "Set your spend limit")
-    : t("portal.billing.checkout.title", "Add a payment method");
-  const subtitle = onCapStep
-    ? t(
-        "portal.billing.checkout.cap.subtitle",
-        "You're billed only for PDFs you process past your first 500 free, never for seats — so your ceiling is yours from day one.",
-      )
-    : t(
-        "portal.billing.checkout.subtitle",
-        "Add a card to keep going past your free Editor-plan grant. Stripe handles the rest.",
-      );
+  // The chosen cap, formatted for the payment-step recap (null = "No cap" was picked on step 1).
+  const capLabel =
+    capUsd != null
+      ? new Intl.NumberFormat(undefined, {
+          style: "currency",
+          currency: currency.toUpperCase(),
+          maximumFractionDigits: 0,
+        }).format(capUsd)
+      : null;
 
   return (
     <Modal
       open={open}
       onClose={handleClose}
-      width="xl"
-      className="portal-billing__checkout-modal"
+      /* Only the Stripe checkout step needs the room; every other step stays narrow. The checkout
+         step also gets a wider-than-xl cap so the embedded Stripe iframe clears its ~1000px
+         two-column threshold (below it, Stripe falls back to the single-column "portrait" layout). */
+      width={phase === "checkout" ? "xl" : "md"}
+      className={[
+        "portal-billing__checkout-modal",
+        phase === "cap" || phase === "checkout"
+          ? "portal-billing__checkout-modal--framed"
+          : "",
+        phase === "checkout" ? "portal-billing__checkout-modal--wide" : "",
+      ]
+        .filter(Boolean)
+        .join(" ")}
       disableBackdropClose={!dismissable}
       disableEscapeClose={!dismissable}
-      title={title}
-      subtitle={subtitle}
+      ariaLabel={t("portal.billing.checkout.cap.title", "Set your spend limit")}
     >
       {phase === "finalizing" && <CheckoutFinalizing />}
       {phase === "activationSlow" && (
@@ -326,80 +395,117 @@ export function StripeCheckoutModal({
 
       {phase === "cap" && (
         <div className="portal-billing__checkout-cap">
-          <StepProgress step={1} />
-          <SpendCapControl
-            capUsd={capUsd}
-            onChange={setCapUsd}
-            pricePerDocMinor={pricePerDocMinor}
-            currency={currency}
-            presets={CAP_PRESETS}
-            note={t(
-              "portal.billing.checkout.cap.note",
-              "Processing pauses if you reach it. You're never billed past this, and you can change it any time.",
+          <PrepayModalHeader
+            step={2}
+            total={3}
+            title={t(
+              "portal.billing.checkout.cap.title",
+              "Set your spend limit",
             )}
+            onClose={handleClose}
           />
-          <p className="portal-billing__checkout-finePrint">
-            {t(
-              "portal.billing.checkout.cap.finePrint",
-              "Invoices post on the 1st. Cancel anytime and revert to the Editor plan; your policies and history stay intact.",
-            )}
-          </p>
-          {capError && (
-            <Banner
-              tone="danger"
-              title={t(
-                "portal.billing.checkout.cap.error",
-                "Couldn't set your spend limit",
+          <div className="portal-billing__checkout-scroll">
+            <SpendLimitPicker
+              capUsd={capUsd}
+              onChange={setCapUsd}
+              pricePerDocMinor={pricePerDocMinor}
+              currency={currency}
+              presets={CAP_PRESETS}
+              disabled={capBusy}
+            />
+            <p className="portal-billing__checkout-finePrint">
+              {t(
+                "portal.billing.checkout.cap.note",
+                "You're never billed past your limit. Processing just pauses.",
               )}
-            >
-              {capError}
-            </Banner>
-          )}
-          <div className="portal-billing__checkout-cap-actions">
-            <Button variant="quiet" onClick={onClose} disabled={capBusy}>
-              {t("portal.billing.checkout.cap.back", "Back")}
-            </Button>
-            <Button
-              accent="premium"
-              loading={capBusy}
-              onClick={handleContinue}
-              rightSection={<span aria-hidden>›</span>}
-            >
-              {t("portal.billing.checkout.cap.continue", "Continue to payment")}
-            </Button>
+            </p>
+            <p className="portal-billing__checkout-finePrint">
+              {t(
+                "portal.billing.checkout.cap.finePrint",
+                "Invoices post monthly. Cancel anytime.",
+              )}
+            </p>
+            {capError && (
+              <Banner
+                tone="danger"
+                title={t(
+                  "portal.billing.checkout.cap.error",
+                  "Couldn't set your spend limit",
+                )}
+              >
+                {capError}
+              </Banner>
+            )}
+            <div className="portal-billing__checkout-cap-actions">
+              <Button variant="quiet" onClick={onClose} disabled={capBusy}>
+                {t("portal.billing.checkout.cap.back", "Back")}
+              </Button>
+              <Button
+                accent="premium"
+                loading={capBusy}
+                onClick={handleContinue}
+                rightSection={<span aria-hidden>›</span>}
+              >
+                {t(
+                  "portal.billing.checkout.cap.continue",
+                  "Continue to payment",
+                )}
+              </Button>
+            </div>
           </div>
         </div>
       )}
 
       {phase === "checkout" && (
         <div className="portal-billing__checkout-pay">
-          <StepProgress step={2} />
-          {!publishableKey && <CardPlaceholder />}
-          {publishableKey && error && (
-            <Banner
-              tone="danger"
-              title={t(
-                "portal.billing.checkout.error.title",
-                "Couldn't start checkout",
-              )}
-            >
-              {error}
-            </Banner>
-          )}
-          {publishableKey && loading && !error && (
-            <div className="portal-billing__skeleton" aria-hidden>
-              <Skeleton height="3rem" />
-              <Skeleton height="18rem" />
-            </div>
-          )}
-          {publishableKey && canRender && stripe && clientSecret && (
-            <EmbeddedCheckoutProvider
-              stripe={stripe}
-              options={{ clientSecret, onComplete: handleStripeComplete }}
-            >
-              <EmbeddedCheckout />
-            </EmbeddedCheckoutProvider>
-          )}
+          <PrepayModalHeader
+            step={3}
+            total={3}
+            title={t("portal.billing.checkout.title", "Add a payment method")}
+            onClose={handleClose}
+          />
+          <div className="portal-billing__checkout-scroll">
+            <p className="portal-billing__checkout-limit">
+              {capLabel
+                ? t(
+                    "portal.billing.checkout.pay.limit",
+                    "Monthly spend limit {{amount}}/mo. Processing pauses at the limit.",
+                    { amount: capLabel },
+                  )
+                : t(
+                    "portal.billing.checkout.pay.limitNoCap",
+                    "No spend limit. Processing won't pause. Invoices post monthly.",
+                  )}
+            </p>
+            {!publishableKey && <CardPlaceholder />}
+            {publishableKey && error && (
+              <Banner
+                tone="danger"
+                title={t(
+                  "portal.billing.checkout.error.title",
+                  "Couldn't start checkout",
+                )}
+              >
+                {error}
+              </Banner>
+            )}
+            {publishableKey && loading && !error && (
+              <div className="portal-billing__skeleton" aria-hidden>
+                <Skeleton height="3rem" />
+                <Skeleton height="18rem" />
+              </div>
+            )}
+            {publishableKey && canRender && stripe && clientSecret && (
+              <div className="portal-billing__checkout-embed">
+                <EmbeddedCheckoutProvider
+                  stripe={stripe}
+                  options={{ clientSecret, onComplete: handleStripeComplete }}
+                >
+                  <EmbeddedCheckout />
+                </EmbeddedCheckoutProvider>
+              </div>
+            )}
+          </div>
         </div>
       )}
     </Modal>
diff --git a/frontend/editor/src/portal/components/billing/SubscribedPlanView.stories.tsx b/frontend/editor/src/portal/components/billing/SubscribedPlanView.stories.tsx
index 4083c687f0..1b9c5cc2f8 100644
--- a/frontend/editor/src/portal/components/billing/SubscribedPlanView.stories.tsx
+++ b/frontend/editor/src/portal/components/billing/SubscribedPlanView.stories.tsx
@@ -1,7 +1,10 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { http, HttpResponse } from "msw";
 import { SubscribedPlanView } from "@portal/components/billing/SubscribedPlanView";
-import { subscribedWallet } from "@portal/components/billing/walletFixtures";
+import {
+  prepaidWallet,
+  subscribedWallet,
+} from "@portal/components/billing/walletFixtures";
 import "@portal/components/billing/billing.css";
 
 const card = http.get("*/api/v1/payg/payment-method", () =>
@@ -64,12 +67,18 @@ const invoices = http.get("*/api/v1/payg/invoices", () =>
 const meta: Meta<typeof SubscribedPlanView> = {
   title: "Portal/Billing/SubscribedPlanView",
   component: SubscribedPlanView,
-  parameters: { layout: "padded", msw: { handlers: [card, invoices] } },
+  parameters: {
+    layout: "padded",
+    msw: { handlers: [card, invoices] },
+  },
 };
 export default meta;
 type Story = StoryObj<typeof SubscribedPlanView>;
 
-/** The full Processor-plan dashboard — leader, within cap. */
+/**
+ * The full Processor-plan dashboard — leader, within cap, no prepaid bundle yet.
+ * Surfaces the "Get 12 months for the price of 10" prepay nudge ("Review offer").
+ */
 export const Leader: Story = { args: { wallet: subscribedWallet } };
 
 /** Approaching the cap — surfaces the over-cap warning banner + projection. */
@@ -83,3 +92,6 @@ export const ApproachingCap: Story = {
     },
   },
 };
+
+/** Drawing on a prepaid bundle — surfaces the capacity meter + a "Top up" action. */
+export const WithPrepaid: Story = { args: { wallet: prepaidWallet } };
diff --git a/frontend/editor/src/portal/components/billing/SubscribedPlanView.tsx b/frontend/editor/src/portal/components/billing/SubscribedPlanView.tsx
index 4d92eecf77..ba787a6ad6 100644
--- a/frontend/editor/src/portal/components/billing/SubscribedPlanView.tsx
+++ b/frontend/editor/src/portal/components/billing/SubscribedPlanView.tsx
@@ -7,6 +7,8 @@ import type { LocalUsage } from "@portal/api/link";
 import { useStripePortal } from "@portal/hooks/useStripePortal";
 import { FreePdfEditorsCard } from "@portal/components/billing/FreePdfEditorsCard";
 import { PdfsProcessedCard } from "@portal/components/billing/PdfsProcessedCard";
+import { PrepaidCapacityCard } from "@portal/components/billing/PrepaidCapacityCard";
+import { BundleCheckoutModal } from "@portal/components/billing/BundleCheckoutModal";
 import { SpendThisMonthCard } from "@portal/components/billing/SpendThisMonthCard";
 import { SpendLimitCard } from "@portal/components/billing/SpendLimitCard";
 import { PaymentMethodCard } from "@portal/components/billing/PaymentMethodCard";
@@ -40,9 +42,13 @@ export function SubscribedPlanView({
 }: Props) {
   const { t } = useTranslation();
   const [adjusting, setAdjusting] = useState(false);
+  const [bundleOpen, setBundleOpen] = useState(false);
   const portal = useStripePortal(wallet);
 
   const isLeader = wallet.role === "leader";
+  // Buying/topping up prepaid capacity is a commercial action — leader-only, and
+  // needs a resolved team to scope checkout.
+  const canBuyBundle = isLeader && wallet.teamId != null;
   const spent =
     wallet.estimatedBillMinor != null ? wallet.estimatedBillMinor / 100 : 0;
   const capActive = !wallet.noCap && wallet.capUsd != null;
@@ -100,6 +106,11 @@ export function SubscribedPlanView({
 
       <FreePdfEditorsCard />
 
+      <PrepaidCapacityCard
+        wallet={wallet}
+        onBuy={canBuyBundle ? () => setBundleOpen(true) : undefined}
+      />
+
       <PdfsProcessedCard wallet={wallet} unsynced={unsynced} />
 
       <div className="portal-billing__spend-row">
@@ -127,6 +138,15 @@ export function SubscribedPlanView({
           {portal.error}
         </Banner>
       )}
+
+      {canBuyBundle && (
+        <BundleCheckoutModal
+          open={bundleOpen}
+          onClose={() => setBundleOpen(false)}
+          wallet={wallet}
+          onComplete={onWalletChange}
+        />
+      )}
     </div>
   );
 }
diff --git a/frontend/editor/src/portal/components/billing/billing.css b/frontend/editor/src/portal/components/billing/billing.css
index 3ab25438db..cfcbf50697 100644
--- a/frontend/editor/src/portal/components/billing/billing.css
+++ b/frontend/editor/src/portal/components/billing/billing.css
@@ -129,16 +129,6 @@
   gap: 0.75rem;
 }
 
-/* Widen the checkout modal past the ~1000px iframe threshold where Stripe
-   Embedded Checkout flips from its single-column ("mobile") layout to the
-   two-column desktop one — matching the SaaS Plan page's UpgradeModal (1100px
-   cap → ~1056px iframe). Two-class selector so it beats .sui-modal--xl's
-   max-width regardless of stylesheet order. width:100% still shrinks it on
-   narrow viewports, where Stripe falls back to single column on its own. */
-.sui-modal.portal-billing__checkout-modal {
-  max-width: 1100px;
-}
-
 /* Post-checkout activation state, shown inside the checkout modal while the
    subscription webhook lands (and the "almost there" fallback if it lags). */
 .portal-billing__checkout-finalizing {
@@ -1048,38 +1038,50 @@
   color: var(--color-amber, var(--c-warning));
 }
 
-/* ── Checkout modal: 2-step (spend limit → payment) ──────────────────── */
+/* ── Checkout modal: spend-limit + payment steps ─────────────────────────
+   Framed layout: the PrepayModalHeader stays fixed and only the content below
+   it scrolls (not the whole modal). The phase fills the modal body as a flex
+   column — header (fixed) + a scroll region. */
+.portal-billing__checkout-modal--framed .sui-modal__body {
+  padding: 0;
+  overflow: hidden;
+  /* Flex column + min-height:0 so the body is bounded by the modal's max-height and its children's
+     flex sizing takes effect — otherwise the phase grows to full content height and nothing scrolls. */
+  display: flex;
+  flex-direction: column;
+  min-height: 0;
+}
+/* Checkout step only: wider than the xl preset so the embedded Stripe iframe clears its ~1000px
+   two-column threshold (otherwise it renders the narrow single-column "portrait" layout). Two-class
+   selector to beat .sui-modal--xl's max-width regardless of stylesheet order. */
+.sui-modal.portal-billing__checkout-modal--wide {
+  max-width: 1120px;
+}
+/* Let the Stripe embedded checkout fill the scroll region's full width (it's the widest thing here). */
+.portal-billing__checkout-embed {
+  width: 100%;
+}
 .portal-billing__checkout-cap,
 .portal-billing__checkout-pay {
+  display: flex;
+  flex-direction: column;
+  flex: 1 1 auto;
+  min-height: 0;
+}
+/* Header owns its padding now that the modal body's is removed; stays fixed at the top. */
+.portal-billing__checkout-modal--framed .portal-billing__bundle-head {
+  flex: 0 0 auto;
+  margin-bottom: 0;
+  padding: 1rem 1.125rem 0.875rem;
+}
+.portal-billing__checkout-scroll {
+  flex: 1 1 auto;
+  min-height: 0;
+  overflow-y: auto;
   display: flex;
   flex-direction: column;
   gap: 1rem;
-}
-
-.portal-billing__checkout-progress {
-  display: flex;
-  align-items: center;
-  gap: 0.75rem;
-}
-.portal-billing__checkout-steps {
-  display: flex;
-  gap: 0.375rem;
-  flex: 1;
-}
-.portal-billing__checkout-steps span {
-  height: 4px;
-  flex: 1;
-  border-radius: var(--radius-pill);
-  background: var(--c-border);
-}
-.portal-billing__checkout-steps span.is-done {
-  background: var(--c-primary);
-}
-.portal-billing__checkout-stepcount {
-  font-size: 0.75rem;
-  font-weight: 600;
-  color: var(--c-text-subtle);
-  white-space: nowrap;
+  padding: 0.25rem 1.125rem 1.125rem;
 }
 
 .portal-billing__checkout-finePrint {
@@ -1088,6 +1090,16 @@
   line-height: 1.55;
   color: var(--c-text-subtle);
 }
+
+/* Payment-step recap of the spend limit chosen on step 1 (the card form itself is Stripe's iframe). */
+.portal-billing__checkout-limit {
+  margin: 0;
+  padding: 0.625rem 0.875rem;
+  border: 1px solid var(--c-border-subtle);
+  border-radius: 8px;
+  font-size: 0.8125rem;
+  color: var(--c-text-subtle);
+}
 .portal-billing__checkout-cap-actions {
   display: flex;
   justify-content: space-between;
@@ -1095,6 +1107,91 @@
   margin-top: 0.25rem;
 }
 
+/* Amount-first spend-limit picker (step 1): the $ /mo field is the primary control; the quick chips
+   below just write into it. Flat estimate (no accent box) to match the demo. */
+.portal-billing__caplimit {
+  display: flex;
+  flex-direction: column;
+  gap: 0.875rem;
+}
+.portal-billing__caplimit-field {
+  display: flex;
+  align-items: baseline;
+  gap: 0.5rem;
+  padding: 0.75rem 1rem;
+  border: 1px solid var(--c-border);
+  border-radius: 10px;
+  background: var(--c-surface);
+}
+.portal-billing__caplimit-field:focus-within {
+  border-color: var(--c-primary);
+}
+.portal-billing__caplimit-sym {
+  font-size: 1.5rem;
+  font-weight: 700;
+  color: var(--c-text-subtle);
+}
+.portal-billing__caplimit-input {
+  flex: 1;
+  min-width: 0;
+  border: none;
+  outline: none;
+  background: transparent;
+  color: var(--c-text);
+  font-size: 1.5rem;
+  font-weight: 700;
+  font-variant-numeric: tabular-nums;
+}
+.portal-billing__caplimit-input::placeholder {
+  color: var(--c-text-subtle);
+  font-weight: 600;
+}
+.portal-billing__caplimit-suffix {
+  font-size: 0.9375rem;
+  color: var(--c-text-subtle);
+}
+.portal-billing__caplimit-chips {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 0.5rem;
+}
+.portal-billing__caplimit-chip {
+  height: 34px;
+  padding: 0 16px;
+  border-radius: 999px;
+  border: 1px solid var(--c-border);
+  background: var(--c-surface-sunken);
+  color: var(--c-text-muted);
+  font-size: 0.85rem;
+  font-weight: 600;
+  font-variant-numeric: tabular-nums;
+}
+.portal-billing__caplimit-chip:hover:not(:disabled) {
+  border-color: var(--c-text-subtle);
+  color: var(--c-text);
+}
+.portal-billing__caplimit-chip[data-selected="true"] {
+  background: color-mix(in srgb, var(--c-primary) 12%, transparent);
+  border-color: var(--c-primary);
+  color: var(--c-primary);
+}
+.portal-billing__caplimit-chip:disabled {
+  opacity: 0.45;
+}
+.portal-billing__caplimit-estimate {
+  display: flex;
+  flex-direction: column;
+  gap: 1px;
+}
+.portal-billing__caplimit-estimate-main {
+  font-size: 0.875rem;
+  color: var(--c-text-muted);
+}
+.portal-billing__caplimit-estimate-sub {
+  font-size: 0.75rem;
+  color: var(--c-text-subtle);
+}
+
 /* Card-form placeholder shown when Stripe isn't configured (Storybook / preview). */
 .portal-billing__card-placeholder {
   display: flex;
@@ -1141,3 +1238,387 @@
   line-height: 1.5;
   color: var(--c-text-subtle);
 }
+
+/* ── Prepaid bundle: buy nudge + top-up + purchase modal ───────────────────── */
+
+/* Slim commit-nudge card shown when the team holds no bundle: title/subtitle
+   left, "Review offer" CTA right. Mirrors the demo's prepay nudge. */
+.portal-billing__prepaid-offer {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  flex-wrap: wrap;
+}
+.portal-billing__prepaid-offer-sub {
+  margin: 0.25rem 0 0;
+  font-size: 0.875rem;
+  line-height: 1.5;
+  color: var(--c-text-subtle);
+  max-width: 46ch;
+}
+
+/* Meter card foot: the "used before metered billing" note + a leader Top-up. */
+.portal-billing__prepaid-foot {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 1rem;
+  margin-top: 0.75rem;
+}
+.portal-billing__prepaid-foot .portal-billing__section-sub {
+  margin: 0;
+}
+
+/* Purchase modal — calculator step. */
+.portal-billing__bundle-calc {
+  display: flex;
+  flex-direction: column;
+  gap: 1.25rem;
+}
+.portal-billing__bundle-fields {
+  display: flex;
+  flex-direction: column;
+  gap: 1rem;
+}
+.portal-billing__bundle-field-label {
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--c-text-muted);
+  margin-bottom: 0.375rem;
+}
+.portal-billing__bundle-field-hint {
+  margin: 0.375rem 0 0;
+  font-size: 0.75rem;
+  color: var(--c-text-subtle);
+  line-height: 1.4;
+}
+.portal-billing__bundle-summary {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  padding: 1rem 1.125rem;
+  border: 1px solid var(--c-border-subtle);
+  border-radius: var(--radius-md);
+  background: var(--color-bg-subtle);
+}
+.portal-billing__bundle-summary-row {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 1rem;
+  font-size: 0.9375rem;
+}
+.portal-billing__bundle-summary-row strong {
+  font-size: 1rem;
+}
+.portal-billing__bundle-savings {
+  margin: 0;
+  font-size: 0.75rem;
+  color: var(--c-text-subtle);
+}
+.portal-billing__bundle-pool {
+  margin: 0;
+  font-size: 0.75rem;
+  color: var(--c-text-subtle);
+  line-height: 1.45;
+}
+
+/* Users field — compact stepper box (demo D147: hugs its content). */
+.portal-billing__bundle-users {
+  max-width: 12rem;
+}
+
+/* Progressive-disclosure finer settings: summary rows that bloom a card picker. */
+.portal-billing__bundle-rows {
+  border: 1px solid var(--c-border-subtle);
+  border-radius: var(--radius-md);
+  overflow: hidden;
+}
+.portal-billing__bundle-row + .portal-billing__bundle-row {
+  border-top: 1px solid var(--c-border-subtle);
+}
+.portal-billing__bundle-row-head {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  width: 100%;
+  padding: 0.75rem 0.875rem;
+  border: none;
+  background: transparent;
+  cursor: pointer;
+  text-align: left;
+  font: inherit;
+}
+.portal-billing__bundle-row-label {
+  font-size: 0.75rem;
+  font-weight: 600;
+  color: var(--c-text-subtle);
+}
+.portal-billing__bundle-row-value {
+  display: inline-flex;
+  align-items: baseline;
+  gap: 0.625rem;
+  font-size: 0.8125rem;
+  font-weight: 600;
+  color: var(--c-text);
+  text-align: right;
+}
+.portal-billing__bundle-row-change {
+  font-size: 0.75rem;
+  font-weight: 600;
+  color: var(--c-primary);
+  flex-shrink: 0;
+}
+.portal-billing__bundle-row-body {
+  padding: 0 0.875rem 0.875rem;
+}
+
+/* Card pickers (deployment / sizing / governance / pipelines). */
+.portal-billing__bundle-cards {
+  display: flex;
+  gap: 0.625rem;
+  flex-wrap: wrap;
+}
+.portal-billing__bundle-card {
+  flex: 1;
+  min-width: 9.5rem;
+  padding: 0.75rem 0.875rem;
+  border: 1px solid var(--c-border);
+  border-radius: var(--radius-sm);
+  background: var(--c-surface);
+  cursor: pointer;
+  text-align: left;
+  font: inherit;
+}
+.portal-billing__bundle-card--active {
+  border-color: var(--c-primary);
+  box-shadow: inset 0 0 0 1px var(--c-primary);
+}
+.portal-billing__bundle-card-head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 0.5rem;
+}
+.portal-billing__bundle-card-title {
+  font-size: 0.8125rem;
+  font-weight: 700;
+  color: var(--c-text);
+}
+.portal-billing__bundle-card--active .portal-billing__bundle-card-title {
+  color: var(--c-primary);
+}
+.portal-billing__bundle-card-meta {
+  font-size: 0.6875rem;
+  font-weight: 600;
+  color: var(--c-text-subtle);
+  flex-shrink: 0;
+}
+.portal-billing__bundle-card--active .portal-billing__bundle-card-meta {
+  color: var(--c-primary);
+}
+.portal-billing__bundle-card-desc {
+  margin-top: 0.1875rem;
+  font-size: 0.7188rem;
+  line-height: 1.4;
+  color: var(--c-text-subtle);
+}
+
+/* Receipt card — "your Processor / your year / pool / download". */
+.portal-billing__bundle-receipt {
+  display: flex;
+  flex-direction: column;
+  gap: 0.5rem;
+  padding: 1rem 1.125rem;
+  border: 1px solid var(--c-border-subtle);
+  border-radius: var(--radius-md);
+  background: var(--color-bg-subtle);
+}
+.portal-billing__bundle-receipt-row {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 1rem;
+  font-size: 0.875rem;
+  color: var(--c-text-muted);
+}
+.portal-billing__bundle-receipt-row strong {
+  font-size: 0.9375rem;
+  color: var(--c-text);
+}
+/* First row reads as the header — bold both sides ("Your Processor / handles N credits / mo"). */
+.portal-billing__bundle-receipt-row--head span {
+  font-weight: 700;
+  color: var(--c-text);
+}
+.portal-billing__bundle-receipt-price {
+  color: var(--c-primary) !important;
+}
+.portal-billing__bundle-consent {
+  padding-top: 0.75rem;
+  border-top: 1px solid var(--c-border-subtle);
+}
+/* Recipient fields on the payment step, kept compact so the step fits without scrolling. */
+.portal-billing__bundle-fields {
+  display: flex;
+  flex-direction: column;
+  gap: 0.625rem;
+}
+/* Company name + PO number share a row. */
+.portal-billing__bundle-field-row {
+  display: flex;
+  gap: 0.625rem;
+}
+.portal-billing__bundle-field-row > * {
+  flex: 1 1 0;
+  min-width: 0;
+}
+/* Bundle modal header — brand · step badge · progress · step title. */
+.portal-billing__bundle-head {
+  display: flex;
+  flex-direction: column;
+  gap: 0.875rem;
+  margin-bottom: 1.25rem;
+}
+.portal-billing__bundle-head-top {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+}
+.portal-billing__bundle-brand {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-weight: 700;
+  font-size: 0.9375rem;
+  color: var(--c-text);
+}
+/* Trademarked wordmark SVG (theme-switched via .wordmark-light-only/.wordmark-dark-only). Height
+   matches the portal nav's 22px wordmark so the modal and app read as one brand. No `display` here —
+   the theme-switch utilities own visibility. */
+.portal-billing__bundle-wordmark {
+  height: 1.375rem;
+  width: auto;
+}
+.portal-billing__bundle-head-right {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+.portal-billing__bundle-step {
+  padding: 0.1875rem 0.625rem;
+  border: 1px solid var(--c-border-subtle);
+  border-radius: 999px;
+  font-size: 0.75rem;
+  font-weight: 600;
+  color: var(--c-text-subtle);
+  white-space: nowrap;
+}
+.portal-billing__bundle-progress {
+  display: flex;
+  gap: 0.375rem;
+}
+.portal-billing__bundle-progress > span {
+  flex: 1;
+  height: 4px;
+  border-radius: 999px;
+  background: var(--c-border-subtle);
+}
+.portal-billing__bundle-progress > span.is-filled {
+  background: var(--c-primary);
+}
+.portal-billing__bundle-head-title {
+  font-size: 1.25rem;
+  font-weight: 700;
+  color: var(--c-text);
+}
+
+/* Payment step: quote receipt + recipient fields + consent. */
+.portal-billing__bundle-pay {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+/* "Download quote (PDF) · share for approval" — a quiet link under the receipt. */
+.portal-billing__bundle-download {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4375rem;
+  margin-top: 0.25rem;
+  padding: 0.5rem 0 0;
+  border: none;
+  border-top: 1px solid var(--c-border-subtle);
+  background: none;
+  cursor: pointer;
+  font: inherit;
+  font-size: 0.75rem;
+  font-weight: 600;
+  color: var(--c-primary);
+  text-align: left;
+}
+.portal-billing__bundle-download-share {
+  color: var(--c-text-subtle);
+  font-weight: 400;
+}
+.portal-billing__bundle-foot-end {
+  display: flex;
+  justify-content: flex-end;
+  gap: 0.5rem;
+}
+
+/* Activation fork (demo D97): two "how do you want to pay?" door-cards. */
+.portal-billing__door-grid {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 12px;
+}
+/* "Maybe later" — a quiet dismiss under the door-cards, left-aligned. */
+.portal-billing__door-later {
+  display: flex;
+  justify-content: flex-start;
+  margin-top: 1rem;
+}
+@media (max-width: 560px) {
+  .portal-billing__door-grid {
+    grid-template-columns: 1fr;
+  }
+}
+.portal-billing__door {
+  display: flex;
+  flex-direction: column;
+  gap: 6px;
+  height: 100%;
+  text-align: left;
+  cursor: pointer;
+}
+.portal-billing__door--accent {
+  border-color: var(--c-primary);
+  background: var(--c-primary-subtle);
+}
+.portal-billing__door-head {
+  display: flex;
+  align-items: baseline;
+  justify-content: space-between;
+  gap: 8px;
+}
+.portal-billing__door-title {
+  font-size: 14px;
+  font-weight: 600;
+  color: var(--c-text);
+}
+.portal-billing__door-badge {
+  flex-shrink: 0;
+  font-size: 11px;
+  font-weight: 600;
+  color: var(--c-primary);
+  background: var(--c-surface);
+  padding: 2px 8px;
+  border-radius: 8px;
+}
+.portal-billing__door-sub {
+  font-size: 12.5px;
+  line-height: 1.5;
+  color: var(--c-text-subtle);
+}
diff --git a/frontend/editor/src/portal/components/billing/walletFixtures.ts b/frontend/editor/src/portal/components/billing/walletFixtures.ts
index cd754af3fc..a3dcc3c5a2 100644
--- a/frontend/editor/src/portal/components/billing/walletFixtures.ts
+++ b/frontend/editor/src/portal/components/billing/walletFixtures.ts
@@ -23,6 +23,10 @@ export const freeWallet: Wallet = {
   docsProcessedThisPeriod: 90,
   uniquePdfsThisPeriod: 84,
   sizeMultiplierPdfsThisPeriod: 12,
+  billingMode: "payg",
+  prepaidUnitsRemaining: 0,
+  prepaidUnitsTotal: 0,
+  prepaidExpiresAt: null,
   members: [],
   recent: [],
 };
@@ -50,6 +54,10 @@ export const subscribedWallet: Wallet = {
   docsProcessedThisPeriod: 1750,
   uniquePdfsThisPeriod: 1600,
   sizeMultiplierPdfsThisPeriod: 320,
+  billingMode: "payg",
+  prepaidUnitsRemaining: 0,
+  prepaidUnitsTotal: 0,
+  prepaidExpiresAt: null,
   members: [
     {
       userId: "u1",
@@ -66,3 +74,16 @@ export const subscribedWallet: Wallet = {
   ],
   recent: [],
 };
+
+/**
+ * Subscribed team currently drawing on a prepaid bundle — {@code billingMode:
+ * "prepaid"} with a mid-drawn pool (78k of 120k left) expiring in-term. Drives the
+ * prepaid-capacity card + the "Prepaid year" chip.
+ */
+export const prepaidWallet: Wallet = {
+  ...subscribedWallet,
+  billingMode: "prepaid",
+  prepaidUnitsRemaining: 78000,
+  prepaidUnitsTotal: 120000,
+  prepaidExpiresAt: "2027-03-01",
+};
diff --git a/frontend/editor/src/portal/hooks/useBundleFlowState.test.tsx b/frontend/editor/src/portal/hooks/useBundleFlowState.test.tsx
new file mode 100644
index 0000000000..159ac12f83
--- /dev/null
+++ b/frontend/editor/src/portal/hooks/useBundleFlowState.test.tsx
@@ -0,0 +1,107 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { act, render, waitFor } from "@testing-library/react";
+
+/**
+ * The billing page's CTA is driven entirely by this hook's derived status, so the
+ * quote → invoice → none classification (and the leader/team gate that keeps the
+ * RPC from firing) are what the guards below lock down.
+ */
+const { getLatestBundleQuote } = vi.hoisted(() => ({
+  getLatestBundleQuote: vi.fn(),
+}));
+vi.mock("@portal/billing/stripe", () => ({ getLatestBundleQuote }));
+
+import { useBundleFlowState } from "@portal/hooks/useBundleFlowState";
+import type { LatestBundleQuote } from "@portal/billing/stripe";
+
+const baseQuote: LatestBundleQuote = {
+  quoteId: 7,
+  users: 25,
+  posturePolicies: 4,
+  sizeMult: 1.2,
+  pipelineMult: 1,
+  poolCredits: 576000,
+  priceMinor: 480000,
+  currency: "usd",
+  consentedAt: null,
+  stripeQuoteId: "qt_1",
+  stripeQuoteNumber: "QT-0007",
+  stripeRef: null,
+  validUntil: "2026-08-16T00:00:00Z",
+};
+
+let latest: ReturnType<typeof useBundleFlowState>;
+function Probe({
+  teamId,
+  enabled,
+}: {
+  teamId: number | null;
+  enabled?: boolean;
+}) {
+  latest = useBundleFlowState(teamId, enabled);
+  return null;
+}
+
+beforeEach(() => {
+  getLatestBundleQuote.mockReset();
+});
+afterEach(() => vi.restoreAllMocks());
+
+describe("useBundleFlowState", () => {
+  it("classifies no open quote as 'none'", async () => {
+    getLatestBundleQuote.mockResolvedValue(null);
+    render(<Probe teamId={1} />);
+    await waitFor(() => expect(latest.loading).toBe(false));
+    expect(latest.status).toBe("none");
+    expect(latest.latest).toBeNull();
+    expect(getLatestBundleQuote).toHaveBeenCalledWith(1);
+  });
+
+  it("classifies an un-accepted quote as 'quote'", async () => {
+    getLatestBundleQuote.mockResolvedValue({ ...baseQuote, stripeRef: null });
+    render(<Probe teamId={1} />);
+    await waitFor(() => expect(latest.status).toBe("quote"));
+    expect(latest.latest?.quoteId).toBe(7);
+  });
+
+  it("classifies an accepted quote (invoice awaiting payment) as 'invoice'", async () => {
+    getLatestBundleQuote.mockResolvedValue({ ...baseQuote, stripeRef: "in_1" });
+    render(<Probe teamId={1} />);
+    await waitFor(() => expect(latest.status).toBe("invoice"));
+  });
+
+  it("stays 'none' and never reads the RPC when disabled", async () => {
+    render(<Probe teamId={1} enabled={false} />);
+    await waitFor(() => expect(latest.loading).toBe(false));
+    expect(latest.status).toBe("none");
+    expect(getLatestBundleQuote).not.toHaveBeenCalled();
+  });
+
+  it("stays 'none' and never reads the RPC without a team", async () => {
+    render(<Probe teamId={null} />);
+    await waitFor(() => expect(latest.loading).toBe(false));
+    expect(latest.status).toBe("none");
+    expect(getLatestBundleQuote).not.toHaveBeenCalled();
+  });
+
+  it("falls back to 'none' when the RPC rejects (no backend / not a leader)", async () => {
+    getLatestBundleQuote.mockRejectedValue(new Error("42501"));
+    render(<Probe teamId={1} />);
+    await waitFor(() => expect(latest.loading).toBe(false));
+    expect(latest.status).toBe("none");
+  });
+
+  it("re-reads on refresh() so a freshly-minted invoice flips the status", async () => {
+    getLatestBundleQuote.mockResolvedValueOnce(null);
+    render(<Probe teamId={1} />);
+    await waitFor(() => expect(latest.status).toBe("none"));
+
+    getLatestBundleQuote.mockResolvedValueOnce({
+      ...baseQuote,
+      stripeRef: "in_1",
+    });
+    act(() => latest.refresh());
+    await waitFor(() => expect(latest.status).toBe("invoice"));
+    expect(getLatestBundleQuote).toHaveBeenCalledTimes(2);
+  });
+});
diff --git a/frontend/editor/src/portal/hooks/useBundleFlowState.ts b/frontend/editor/src/portal/hooks/useBundleFlowState.ts
new file mode 100644
index 0000000000..0ded198c8b
--- /dev/null
+++ b/frontend/editor/src/portal/hooks/useBundleFlowState.ts
@@ -0,0 +1,75 @@
+import { useCallback, useEffect, useState } from "react";
+import {
+  getLatestBundleQuote,
+  type LatestBundleQuote,
+} from "@portal/billing/stripe";
+
+/**
+ * Where a team sits in the prepaid-bundle purchase:
+ *   - none    → no open quote; the buyer hasn't started (or the last one expired).
+ *   - quote   → an open quote exists but hasn't been accepted (no invoice yet).
+ *   - invoice → the quote is accepted and an invoice is awaiting payment.
+ */
+export type BundleFlowStatus = "none" | "quote" | "invoice";
+
+export interface BundleFlowState {
+  status: BundleFlowStatus;
+  /** The underlying quote row, or null when {@code status === "none"}. */
+  latest: LatestBundleQuote | null;
+  /** First load (or a refresh) is in flight. */
+  loading: boolean;
+  /** Re-read the latest quote — call after the checkout modal closes so the CTA reflects new state. */
+  refresh: () => void;
+}
+
+/**
+ * Page-level probe for the prepaid-bundle flow, so the billing page can render the
+ * right CTA on load — "View quote" once a quote exists, "Pay invoice to complete"
+ * once it's accepted — instead of always restarting the activation fork. The heavy
+ * hydration (sizing, re-accept) still lives in {@code BundleCheckoutModal}; this
+ * only classifies the latest quote so the entry point can name the resume action.
+ *
+ * Effectively leader-scoped: {@code payg_get_latest_bundle_quote} 403s for
+ * non-leaders, which (like an unconfigured backend) we treat as "none". Only
+ * meaningful for a free team — a paid invoice flips the team to subscribed. Pass
+ * {@code enabled: false} to skip the read entirely (non-leaders, no team).
+ */
+export function useBundleFlowState(
+  teamId: number | null | undefined,
+  enabled = true,
+): BundleFlowState {
+  const [latest, setLatest] = useState<LatestBundleQuote | null>(null);
+  const [loading, setLoading] = useState(false);
+  const [tick, setTick] = useState(0);
+  const refresh = useCallback(() => setTick((t) => t + 1), []);
+
+  useEffect(() => {
+    if (!enabled || teamId == null) {
+      setLatest(null);
+      setLoading(false);
+      return;
+    }
+    let cancelled = false;
+    setLoading(true);
+    getLatestBundleQuote(teamId)
+      .then((q) => {
+        if (!cancelled) setLatest(q);
+      })
+      .catch(() => {
+        // No backend / not a leader / transient — fall back to "none" rather than
+        // block the page. The modal is the source of truth once it opens.
+        if (!cancelled) setLatest(null);
+      })
+      .finally(() => {
+        if (!cancelled) setLoading(false);
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [teamId, enabled, tick]);
+
+  const status: BundleFlowStatus =
+    latest == null ? "none" : latest.stripeRef ? "invoice" : "quote";
+
+  return { status, latest, loading, refresh };
+}
diff --git a/frontend/editor/src/proprietary/billing/format.test.ts b/frontend/editor/src/proprietary/billing/format.test.ts
new file mode 100644
index 0000000000..314c606080
--- /dev/null
+++ b/frontend/editor/src/proprietary/billing/format.test.ts
@@ -0,0 +1,105 @@
+import { describe, it, expect } from "vitest";
+import {
+  estimateMonthlyVolumeFromUsers,
+  provisionMonthlyVolume,
+  bundlePoolCredits,
+  bundleListMinor,
+  bundlePriceMinor,
+  computeBundleQuote,
+} from "@app/billing";
+
+/**
+ * The run-based prepaid brain must mirror the marketing calculator (users → volume,
+ * ~3× provisioning, size-folded run pool, 12-for-10) so the buyer sees the number the
+ * server charges. The pool is the Stripe line quantity + the credited pool, in the
+ * same size-scaled runs the meter charges on consumption.
+ */
+describe("prepaid bundle brain", () => {
+  it("estimates monthly volume from users (× 80/user, clean step)", () => {
+    expect(estimateMonthlyVolumeFromUsers(25)).toBe(2000); // 25 × 80
+    expect(estimateMonthlyVolumeFromUsers(300)).toBe(24000); // ≥20k → 500 step
+    expect(estimateMonthlyVolumeFromUsers(0)).toBe(0);
+  });
+
+  it("provisions ~3× above expected, rounded up to a clean magnitude", () => {
+    expect(provisionMonthlyVolume(1000)).toBe(5000); // target 3000 → 5×1000
+    expect(provisionMonthlyVolume(2000)).toBe(10000); // target 6000 → 10×1000
+    expect(provisionMonthlyVolume(0)).toBe(0);
+  });
+
+  it("sizes the pool in size-folded runs (volume × policies × pipelines × size × 12)", () => {
+    // 10,000/mo × Governed(4 policies) × None(×1) × Standard(×1.2) × 12.
+    expect(bundlePoolCredits(10000, 4, 1, 1.2)).toBe(576_000);
+    // Size ×1 → 10,000 × 4 × 1 × 12.
+    expect(bundlePoolCredits(10000, 4, 1, 1.0)).toBe(480_000);
+    // Pipelines multiply runs like policies do.
+    expect(bundlePoolCredits(10000, 4, 2, 1.0)).toBe(960_000);
+  });
+
+  it("zeroes the pool for non-positive inputs", () => {
+    expect(bundlePoolCredits(0, 4, 1, 1.2)).toBe(0);
+    expect(bundlePoolCredits(10000, 0, 1, 1.2)).toBe(0);
+    expect(bundlePoolCredits(10000, 4, 0, 1.2)).toBe(0);
+  });
+
+  it("computes an end-to-end quote from users + finer settings", () => {
+    const q = computeBundleQuote({
+      users: 25,
+      posturePolicies: 4,
+      sizeMult: 1.2,
+      pipelineMult: 1,
+      ratePerRunMinor: 1,
+    });
+    expect(q.expectedMonthlyVolume).toBe(2000);
+    expect(q.provisionedMonthlyVolume).toBe(10000);
+    expect(q.poolCredits).toBe(576_000);
+    expect(q.listMinor).toBe(576_000); // 576k credits × 1¢
+    expect(q.priceMinor).toBe(480_000); // × 10/12
+    expect(q.savingsMinor).toBe(96_000);
+    expect(q.overEnterprise).toBe(false);
+  });
+
+  it("flags enterprise scale on EXPECTED (not provisioned) runs/yr over the ceiling", () => {
+    const q = computeBundleQuote({
+      users: 3000,
+      posturePolicies: 7,
+      sizeMult: 2.0,
+      pipelineMult: 10,
+      ratePerRunMinor: 1,
+    });
+    // expected 240k/mo × 7 × 10 × 12 ≫ 1M runs/yr.
+    expect(q.overEnterprise).toBe(true);
+  });
+
+  it("hides money when the rate is unknown", () => {
+    const q = computeBundleQuote({
+      users: 25,
+      posturePolicies: 4,
+      sizeMult: 1.2,
+      pipelineMult: 1,
+      ratePerRunMinor: null,
+    });
+    expect(q.poolCredits).toBe(576_000);
+    expect(q.listMinor).toBeNull();
+    expect(q.priceMinor).toBeNull();
+    expect(q.savingsMinor).toBeNull();
+  });
+
+  it("applies the 12-for-10 discount at the per-run rate", () => {
+    // 120k credits × 2 minor = 240,000 list; × 10/12 = 200,000 paid.
+    expect(bundleListMinor(120_000, 2)).toBe(240_000);
+    expect(bundlePriceMinor(120_000, 2)).toBe(200_000);
+  });
+
+  it("rounds sub-cent rates to the minor unit (HALF_UP)", () => {
+    // 100k × 0.5 = 50,000 list; × 10/12 = 41,666.67 → 41,667.
+    expect(bundleListMinor(100_000, 0.5)).toBe(50_000);
+    expect(bundlePriceMinor(100_000, 0.5)).toBe(41_667);
+  });
+
+  it("returns null money when the rate is unknown or non-positive", () => {
+    expect(bundleListMinor(120_000, null)).toBeNull();
+    expect(bundlePriceMinor(120_000, null)).toBeNull();
+    expect(bundlePriceMinor(120_000, 0)).toBeNull();
+  });
+});
diff --git a/frontend/editor/src/proprietary/billing/format.ts b/frontend/editor/src/proprietary/billing/format.ts
index 194a9bd686..2a5f406cc0 100644
--- a/frontend/editor/src/proprietary/billing/format.ts
+++ b/frontend/editor/src/proprietary/billing/format.ts
@@ -88,6 +88,204 @@ export function formatPeriodDate(
   }
 }
 
+// ─── Prepaid bundle pricing (run-based brain) ───────────────────────────────
+
+/**
+ * "12 months for the price of 10" — months granted vs paid. Mirrors the Stripe
+ * coupon (10/12 off), so the calculator's live estimate matches the amount charged.
+ */
+export const PREPAID_MONTHS_GRANTED = 12;
+export const PREPAID_MONTHS_PAID = 10;
+
+/**
+ * People-driven traffic estimate: one Stirling user runs ≈ this many PDFs a month
+ * (WBR telemetry). The self-serve prepay flow sizes the year from USERS and derives
+ * volume from this rate rather than asking the buyer to guess a PDF count.
+ */
+export const PDFS_PER_USER_MONTH = 80;
+
+/**
+ * Above this many EXPECTED runs/yr the self-serve prepay flow hands off to the
+ * enterprise quote — committed-volume pricing is negotiated, never self-served.
+ */
+export const BUNDLE_SELF_SERVE_RUN_CEILING_YR = 1_000_000;
+
+/**
+ * Governance posture as a policy-run count — the intensity fed to the pricing brain
+ * (a PDF through N policies is N runs). Replaces the retired ×1.4/2.4/4.0 posture
+ * multiplier: the policy count IS the multiplier now.
+ */
+export const BUNDLE_POLICY_POSTURES = [
+  { id: "essentials", policies: 2 },
+  { id: "governed", policies: 4 },
+  { id: "regulated", policies: 7 },
+] as const;
+
+/** File-size tier — the data multiplier folded into the pool (a bigger PDF draws more). */
+export const BUNDLE_SIZE_TIERS = [
+  { id: "compact", mult: 1.0 },
+  { id: "standard", mult: 1.2 },
+  { id: "heavy", mult: 2.0 },
+] as const;
+
+/** Pipeline intensity — pipelines multiply runs per PDF exactly like policies do. */
+export const BUNDLE_PIPELINE_TIERS = [
+  { id: "none", mult: 1 },
+  { id: "standard", mult: 2 },
+  { id: "advanced", mult: 10 },
+] as const;
+
+/**
+ * Estimated monthly people-driven PDF volume for a team of {@code users}
+ * ({@code users ×} {@link PDFS_PER_USER_MONTH}, rounded to a clean step); zero for a
+ * non-positive team size.
+ */
+export function estimateMonthlyVolumeFromUsers(users: number): number {
+  if (users <= 0) return 0;
+  const raw = users * PDFS_PER_USER_MONTH;
+  const step = raw >= 20000 ? 500 : 100;
+  return Math.max(step, Math.round(raw / step) * step);
+}
+
+/**
+ * Provisioned monthly PDF capacity for an {@code expectedMonthly} volume: ~3× above
+ * expected (buyers compare a plan to a stock, not a flow), rounded up to a clean
+ * 1/2/2.5/5/10 magnitude. Renewals re-size to observed usage, so generous
+ * provisioning stays fair.
+ */
+export function provisionMonthlyVolume(expectedMonthly: number): number {
+  if (expectedMonthly <= 0) return 0;
+  const target = expectedMonthly * 3;
+  const mag = Math.pow(10, Math.floor(Math.log10(target)));
+  const steps = [1, 2, 2.5, 5, 10];
+  for (const s of steps) if (s * mag >= target) return Math.round(s * mag);
+  return Math.round(10 * mag);
+}
+
+/**
+ * Prepaid pool size in run-credits for a provisioned monthly PDF volume at a given
+ * posture (policy runs/PDF), pipeline intensity, and file-size tier, over the term.
+ * The pool is denominated in the SAME size-scaled runs the meter charges on
+ * consumption, so buying and spending are one currency; each credit is the list run
+ * rate. Size folds in as extra credits.
+ */
+export function bundlePoolCredits(
+  provisionedMonthlyVolume: number,
+  posturePolicies: number,
+  pipelineMult: number,
+  sizeMult: number,
+  monthsGranted: number = PREPAID_MONTHS_GRANTED,
+): number {
+  if (
+    provisionedMonthlyVolume <= 0 ||
+    posturePolicies <= 0 ||
+    pipelineMult <= 0 ||
+    sizeMult <= 0
+  )
+    return 0;
+  const runsPerMonth =
+    provisionedMonthlyVolume * posturePolicies * pipelineMult;
+  return Math.round(runsPerMonth * sizeMult) * monthsGranted;
+}
+
+/** Undiscounted "worth" of a pool in minor units (units × rate); null when the rate is unknown. */
+export function bundleListMinor(
+  units: number,
+  ratePerUnitMinor: number | null | undefined,
+): number | null {
+  const rate =
+    ratePerUnitMinor != null && ratePerUnitMinor > 0 ? ratePerUnitMinor : null;
+  return rate != null ? Math.round(units * rate) : null;
+}
+
+/**
+ * Discounted price of a prepaid pool in minor units: units × rate × paid/granted.
+ * Mirror of the Stripe coupon. Null when the rate is unknown (the caller hides the
+ * figure and falls back to the server total).
+ */
+export function bundlePriceMinor(
+  units: number,
+  ratePerUnitMinor: number | null | undefined,
+  monthsPaid: number = PREPAID_MONTHS_PAID,
+  monthsGranted: number = PREPAID_MONTHS_GRANTED,
+): number | null {
+  const rate =
+    ratePerUnitMinor != null && ratePerUnitMinor > 0 ? ratePerUnitMinor : null;
+  return rate != null
+    ? Math.round((units * rate * monthsPaid) / monthsGranted)
+    : null;
+}
+
+/** Inputs to {@link computeBundleQuote} — team size + the finer-setting multipliers. */
+export interface BundleQuoteInput {
+  /** Team size — the primary sizing input; volume + pool derive from it. */
+  users: number;
+  /** Governance posture as a policy-run count (2 / 4 / 7). */
+  posturePolicies: number;
+  /** File-size tier multiplier (1.0 / 1.2 / 2.0). */
+  sizeMult: number;
+  /** Pipeline intensity multiplier (1 / 2 / 10). */
+  pipelineMult: number;
+  /** Per-run list rate in minor units; null when unresolved (price is hidden). */
+  ratePerRunMinor: number | null | undefined;
+}
+
+/** The derived breakdown {@link computeBundleQuote} returns. */
+export interface BundleQuoteBreakdown {
+  /** People-driven monthly volume estimated from users (pre-provisioning). */
+  expectedMonthlyVolume: number;
+  /** Provisioned monthly PDF capacity (~3× expected) — the "handles X/mo" headline. */
+  provisionedMonthlyVolume: number;
+  /** Size-folded runs the pool represents = Stripe line quantity + credited pool. */
+  poolCredits: number;
+  listMinor: number | null;
+  priceMinor: number | null;
+  savingsMinor: number | null;
+  /** EXPECTED runs/yr exceed the self-serve ceiling → route to the enterprise quote. */
+  overEnterprise: boolean;
+}
+
+/**
+ * The one self-serve prepay pricing brain: team size + finer settings → the pool,
+ * price, and enterprise-ladder flag. Volume is derived from users (never asked) and
+ * provisioned ~3× above expected; the pool is size-folded runs — the Stripe line
+ * quantity AND the credited pool, in the same currency the meter charges on
+ * consumption. Mirrors the marketing calculator so the buyer sees the number the
+ * server charges.
+ */
+export function computeBundleQuote(
+  input: BundleQuoteInput,
+): BundleQuoteBreakdown {
+  const { users, posturePolicies, sizeMult, pipelineMult, ratePerRunMinor } =
+    input;
+  const expectedMonthlyVolume = estimateMonthlyVolumeFromUsers(users);
+  const provisionedMonthlyVolume = provisionMonthlyVolume(
+    expectedMonthlyVolume,
+  );
+  const poolCredits = bundlePoolCredits(
+    provisionedMonthlyVolume,
+    posturePolicies,
+    pipelineMult,
+    sizeMult,
+  );
+  const listMinor = bundleListMinor(poolCredits, ratePerRunMinor);
+  const priceMinor = bundlePriceMinor(poolCredits, ratePerRunMinor);
+  const savingsMinor =
+    listMinor != null && priceMinor != null ? listMinor - priceMinor : null;
+  const expectedRunsYr =
+    Math.round(expectedMonthlyVolume * posturePolicies * pipelineMult) * 12;
+  const overEnterprise = expectedRunsYr > BUNDLE_SELF_SERVE_RUN_CEILING_YR;
+  return {
+    expectedMonthlyVolume,
+    provisionedMonthlyVolume,
+    poolCredits,
+    listMinor,
+    priceMinor,
+    savingsMinor,
+    overEnterprise,
+  };
+}
+
 export type MeterState = "FULL" | "WARNED" | "DEGRADED";
 
 /** Warn (≥80%) / degrade (≥100%) band for a usage meter; mirrors the BE thresholds. */
diff --git a/frontend/editor/src/proprietary/billing/index.ts b/frontend/editor/src/proprietary/billing/index.ts
index 228458ca9b..687adec541 100644
--- a/frontend/editor/src/proprietary/billing/index.ts
+++ b/frontend/editor/src/proprietary/billing/index.ts
@@ -14,6 +14,21 @@ export {
   docCapForMoney,
   formatPeriodDate,
   meterState,
+  PREPAID_MONTHS_GRANTED,
+  PREPAID_MONTHS_PAID,
+  PDFS_PER_USER_MONTH,
+  BUNDLE_SELF_SERVE_RUN_CEILING_YR,
+  BUNDLE_POLICY_POSTURES,
+  BUNDLE_SIZE_TIERS,
+  BUNDLE_PIPELINE_TIERS,
+  estimateMonthlyVolumeFromUsers,
+  provisionMonthlyVolume,
+  bundlePoolCredits,
+  bundleListMinor,
+  bundlePriceMinor,
+  computeBundleQuote,
+  type BundleQuoteInput,
+  type BundleQuoteBreakdown,
   type MeterState,
 } from "@app/billing/format";
 export { MeterBar } from "@app/billing/MeterBar";
diff --git a/frontend/editor/src/proprietary/billing/types.ts b/frontend/editor/src/proprietary/billing/types.ts
index 46fd228f73..1fd2fbea9c 100644
--- a/frontend/editor/src/proprietary/billing/types.ts
+++ b/frontend/editor/src/proprietary/billing/types.ts
@@ -76,6 +76,14 @@ export interface Wallet {
   uniquePdfsThisPeriod: number;
   /** Input files on charges where the size multiplier applied (units billed &gt; input files). */
   sizeMultiplierPdfsThisPeriod: number;
+  /** "prepaid" while prepaid-bundle units remain (drawn ahead of the meter), else "payg". */
+  billingMode: "prepaid" | "payg";
+  /** Prepaid units still available across the team's in-term bundles; 0 = none/exhausted. */
+  prepaidUnitsRemaining: number;
+  /** Total capacity of in-term prepaid bundles — the "X of Y used" denominator; 0 = no bundle. */
+  prepaidUnitsTotal: number;
+  /** Soonest bundle term-end (ISO yyyy-mm-dd) for the countdown; null when no bundle. */
+  prepaidExpiresAt: string | null;
   /** Populated for the leader view; empty for members / single-seat tenants. */
   members: WalletMember[];
   recent: WalletActivityRow[];
diff --git a/frontend/editor/src/saas/components/shared/FreeLimitReachedModal.test.tsx b/frontend/editor/src/saas/components/shared/FreeLimitReachedModal.test.tsx
index d70d807b25..1565f88d9a 100644
--- a/frontend/editor/src/saas/components/shared/FreeLimitReachedModal.test.tsx
+++ b/frontend/editor/src/saas/components/shared/FreeLimitReachedModal.test.tsx
@@ -31,6 +31,10 @@ const wallet: Wallet = {
   docsProcessedThisPeriod: 0,
   uniquePdfsThisPeriod: 0,
   sizeMultiplierPdfsThisPeriod: 0,
+  billingMode: "payg",
+  prepaidUnitsRemaining: 0,
+  prepaidUnitsTotal: 0,
+  prepaidExpiresAt: null,
   members: [],
   recent: [],
 };
diff --git a/frontend/editor/src/saas/hooks/walletDevPreview.ts b/frontend/editor/src/saas/hooks/walletDevPreview.ts
index 1529058f15..216e9fb536 100644
--- a/frontend/editor/src/saas/hooks/walletDevPreview.ts
+++ b/frontend/editor/src/saas/hooks/walletDevPreview.ts
@@ -72,6 +72,12 @@ function buildDevPreviewWallet(role: WalletRole): Wallet {
     docsProcessedThisPeriod: 50,
     uniquePdfsThisPeriod: 48,
     sizeMultiplierPdfsThisPeriod: 8,
+    // Illustrative prepaid bundle so the /dev/payg-preview route can design the
+    // prepaid-capacity card + banner (drawn ahead of the meter, outside the cap).
+    billingMode: "prepaid",
+    prepaidUnitsRemaining: 78_000,
+    prepaidUnitsTotal: 120_000,
+    prepaidExpiresAt: "2027-03-01",
     categoryDocs: { api: 18, ai: 14, automation: 18 },
     // Wave 1 backend (PR #6574) returns a per-category breakdown so the
     // hero panel can split AI / automation / API. Use realistic but

From a380a822342c4e399b200f40204edf705a00e906 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Mon, 27 Jul 2026 11:46:56 +0100
Subject: [PATCH 096/109] build: raise Gradle daemon heap to avoid intermittent
 CI OOM (#7151)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Problem

The `build (25, saas)` CI job intermittently fails with:

```
The Daemon will expire immediately since the JVM garbage collector is thrashing.
The currently configured max heap space is '512 MiB' and the configured max metaspace is '384 MiB'.
FAILURE: Build failed with an exception.
* What went wrong:
Gradle build daemon has been stopped: since the JVM garbage collector is thrashing
```

`gradle.properties` never set `org.gradle.jvmargs`, so the daemon runs
on Gradle's 512 MiB default heap. The larger builds — the `saas` flavor
in particular, which compiles core + proprietary + saas — exhaust it
under `org.gradle.parallel=true`, and the daemon dies mid-build. It's
flaky (passes on re-run), which makes it a recurring, noisy CI failure.

## Fix

```properties
org.gradle.jvmargs=-Xmx2g -XX:MaxMetaspaceSize=1g
```

2 GiB heap + 1 GiB metaspace gives comfortable headroom on GitHub-hosted
runners and typical dev machines, well clear of the thrash point.
One-line, repo-wide config change.

## Verification

- `./gradlew help` starts the daemon cleanly with the new args (no
malformed-arg failure).
- The real signal is CI: this branch's `build (25, saas)` should stop
OOM-ing.

Split out from #7048 (Plan & Usage) since it's unrelated build
infrastructure.
---
 gradle.properties | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/gradle.properties b/gradle.properties
index e99fbdc918..0e8306a444 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -1,3 +1,9 @@
+# Gradle daemon heap. The default (512 MiB) is exhausted by the larger builds
+# (notably the saas flavor) under parallel execution, causing intermittent
+# "JVM garbage collector is thrashing" daemon deaths in CI. 2 GiB heap + 1 GiB
+# metaspace gives comfortable headroom on CI runners and typical dev machines.
+org.gradle.jvmargs=-Xmx2g -XX:MaxMetaspaceSize=1g
+
 # Enables parallel execution of tasks, allowing multiple tasks to run simultaneously
 org.gradle.parallel=true
 

From ba404d3f903e82e446a57a50dcc86a219e8df2fb Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Tue, 28 Jul 2026 14:05:20 +0100
Subject: [PATCH 097/109] PAYG bundle: server-authoritative price (inline
 amount_off coupon) + #7032 review nits (#7156)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Follow-up to #7032. Makes the prepaid-bundle price
**server-authoritative** and removes the percent-coupon rounding drift,
by switching the 12-for-10 discount from a pre-made `percent_off` Stripe
coupon to an **edge-function-computed inline `amount_off` coupon**. Also
folds in Ethan's #7032 review nits.

This is a money-mechanism change, so it was verified against the Deno
tests and is ready for a V2-preview check before rollout.

## SaaS side — already on `v3` (purely additive)

The edge fn + migration were pushed **directly to `v3`** (commit
`4534ff1c1`), since the DB change is purely additive (a
backward-compatible function replacement — no table/column/data
changes):

- `create-payg-bundle-quote`: retrieves the Stripe Price for the bundle,
computes `subtotal = unit_amount x pool_credits` (falls back to
`round(unit_amount_decimal x pool_credits)`), `discount = round(subtotal
x 2 / 12)`, `total = subtotal - discount`; mints a single-use
fixed-amount coupon (`amount_off`, `duration: once`, `max_redemptions:
1`, `redeem_by = valid_until`) and applies it instead of the stored
percent coupon; persists `total` via `p_price_minor`.
- Migration `20260803000000_payg_bundle_quote_stripe_price_minor.sql`:
`payg_set_bundle_quote_stripe` gains `p_price_minor BIGINT DEFAULT NULL`
→ `price_minor = COALESCE(p_price_minor, price_minor)`.

**Deploy choreography (important):** the migration must apply **before**
the edge fn is deployed — the fn now calls the 4-arg
`payg_set_bundle_quote_stripe`. #7032's own Supabase migration is
already on `main`/`v3`.

## This PR (FE)

- **Server-authoritative price:** `bundlePriceMinor` now computes
`subtotal - round(subtotal x (granted-paid)/granted)` (round the
discount, then subtract) — identical to the edge fn — so the pre-mint
estimate matches the `amount_off` charged, and the persisted/frozen
total, to the penny (they previously diverged by a minor unit on
exact-half ties). Tie-case test added.

### Ethan's #7032 review nits

- **1** — comments in `ActivationChoiceModal` / `FreePlanView` no longer
assert the metered subscription is auto-provisioned off the saved card;
they describe it as a known, not-yet-wired follow-up.
- **2** — corrected the price-authority narrative (`stripe.ts`,
`BundleCheckoutModal`): the client-sent `p_price_minor` is a pre-mint
**display estimate only**; the edge fn overwrites `price_minor` with the
server total once the quote is minted. **Verified** the edge fn builds
the Stripe line from `bundle_price_id x pool_credits` with `amount_off`
from the retrieved Price — it never uses the client price.
- **4** — `ensureStripeQuote`'s reuse key now includes the
posture/size/pipeline ids (`buildStripeQuoteSig`), not just pool+PO, so
a same-pool sizing edit re-mints and re-persists instead of leaving
stale sizing on the row.
- **5** — `SpendLimitPicker`: a cleared field (maps to `0`) can no
longer proceed as a `$0` cap — the cap-step Continue is disabled and
`handleContinue` guards on it (empty = incomplete, distinct from the
explicit `null` "No limit").
- **6** — `"prepaid PDFs"` code fallbacks aligned to the `"prepaid
credits"` TOML (`usageMeters`, `PrepaidCapacityCard`).

## Testing

- SaaS Deno: **25/25** (coupon `amount_off == round(subtotal*2/12)`,
`p_price_minor == total` persisted, `unit_amount_decimal` fallback,
exact-half tie, zero-discount path, price/coupon failure paths).
- FE vitest: **50** billing/format tests pass; prettier + eslint clean;
tsc clean for all changed files.
- Pending: manual V2-preview check that the invoice shows a concrete
`-$X.00` discount line (labelled "12 months for the price of 10") equal
to the in-app total.

Closes the residual half of #7032 review finding #2 — once
merged/deployed, the in-app total, the persisted value, and the Stripe
invoice all agree.

---------

Co-authored-by: Reece Browne <74901996+reecebrowne@users.noreply.github.com>
---
 .../saas/payg/api/PaygWalletController.java   | 13 ++++-
 .../saas/payg/api/WalletSnapshotResponse.java |  8 ++-
 .../saas/payg/billing/TeamBillingService.java | 25 +++++++++
 .../saas/payg/policy/PricingPolicy.java       |  8 +--
 .../payg/api/WalletSnapshotResponseTest.java  |  7 ++-
 .../config/configSections/usageMeters.tsx     |  2 +-
 frontend/editor/src/cloud/hooks/useWallet.ts  |  1 +
 frontend/editor/src/portal/billing/stripe.ts  |  7 ++-
 .../billing/ActivationChoiceModal.tsx         |  9 ++--
 .../billing/BundleCheckoutModal.tsx           | 51 +++++++++++++++----
 .../components/billing/FreePlanView.tsx       |  8 +--
 .../billing/PrepaidCapacityCard.tsx           |  2 +-
 .../billing/StripeCheckoutModal.tsx           | 11 ++++
 .../components/billing/walletFixtures.ts      |  2 +
 .../src/proprietary/billing/format.test.ts    | 15 ++++--
 .../editor/src/proprietary/billing/format.ts  | 21 +++++---
 .../editor/src/proprietary/billing/types.ts   |  6 +++
 .../shared/FreeLimitReachedModal.test.tsx     |  1 +
 .../editor/src/saas/hooks/walletDevPreview.ts |  1 +
 19 files changed, 161 insertions(+), 37 deletions(-)

diff --git a/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java b/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java
index 2ab19ad4cb..0f18f13284 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/api/PaygWalletController.java
@@ -1,5 +1,6 @@
 package stirling.software.saas.payg.api;
 
+import java.math.BigDecimal;
 import java.time.LocalDateTime;
 import java.time.format.DateTimeFormatter;
 import java.util.ArrayList;
@@ -206,6 +207,12 @@ public class PaygWalletController {
         // Prepaid while pools still have units to draw; once exhausted the meter is live again.
         String billingMode = prepaidRemaining > 0 ? BILLING_MODE_PREPAID : BILLING_MODE_PAYG;
 
+        // Per-credit rate for the bundle calculator — the bundle:processor price, NOT the metered
+        // per-doc rate. Resolved in the team's currency (USD fallback), null when the price is
+        // unsynced.
+        BigDecimal bundleRatePerCreditMinor =
+                billingService.resolveBundleRatePerCreditMinor(billing.currency());
+
         WalletSnapshotResponse body =
                 new WalletSnapshotResponse(
                         teamId,
@@ -234,7 +241,8 @@ public class PaygWalletController {
                         prepaidRemaining,
                         prepaidTotal,
                         prepaidExpiresAt,
-                        billingMode);
+                        billingMode,
+                        bundleRatePerCreditMinor);
         return ResponseEntity.ok(body);
     }
 
@@ -512,6 +520,7 @@ public class PaygWalletController {
                 0L,
                 0L,
                 null,
-                BILLING_MODE_PAYG);
+                BILLING_MODE_PAYG,
+                null);
     }
 }
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/api/WalletSnapshotResponse.java b/app/saas/src/main/java/stirling/software/saas/payg/api/WalletSnapshotResponse.java
index 3d381ef165..8bf887a0ea 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/api/WalletSnapshotResponse.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/api/WalletSnapshotResponse.java
@@ -55,6 +55,11 @@ import java.util.List;
  * @param members leader-only roster of team members + their per-member sub-caps. Empty for member
  *     callers.
  * @param recent latest wallet-ledger entries (newest first) for the activity feed.
+ * @param bundleRatePerCreditMinor per-credit rate of the prepaid-bundle Stripe Price (lookup key
+ *     {@code bundle:processor}) in minor units of {@code currency} (may be fractional); {@code
+ *     null} when unresolved. The in-app bundle calculator multiplies its pool by this so its
+ *     estimate matches the checkout edge fn's charge. Distinct from {@code pricePerDocMinor} (the
+ *     metered per-document rate) — the two must not be conflated.
  */
 public record WalletSnapshotResponse(
         Long teamId,
@@ -83,7 +88,8 @@ public record WalletSnapshotResponse(
         long prepaidUnitsRemaining,
         long prepaidUnitsTotal,
         String prepaidExpiresAt,
-        String billingMode) {
+        String billingMode,
+        BigDecimal bundleRatePerCreditMinor) {
 
     // Prepaid usage bundles, aggregated across the team's in-term pools (drawn ahead of the meter,
     // outside the spend cap):
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/billing/TeamBillingService.java b/app/saas/src/main/java/stirling/software/saas/payg/billing/TeamBillingService.java
index 260efbd9ab..8bca25758a 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/billing/TeamBillingService.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/billing/TeamBillingService.java
@@ -68,6 +68,14 @@ public class TeamBillingService {
      */
     private static final String PAYG_LOOKUP_KEY = "plan:processor";
 
+    /**
+     * Stripe Price {@code lookup_key} for the prepaid-bundle price — the per-credit rate the bundle
+     * calculator prices its pool at. A DIFFERENT price from {@link #PAYG_LOOKUP_KEY} (the metered
+     * per-document rate); the two must not be conflated, or the in-app estimate diverges from the
+     * amount the checkout edge fn actually charges (which bills against this same price).
+     */
+    private static final String BUNDLE_LOOKUP_KEY = "bundle:processor";
+
     private final PaygTeamExtensionsRepository extensionsRepository;
     private final WalletPolicyRepository walletPolicyRepository;
     private final PricingPolicyService pricingPolicyService;
@@ -254,6 +262,23 @@ public class TeamBillingService {
                         .longValue());
     }
 
+    /**
+     * Per-credit rate of the prepaid-bundle Stripe Price (lookup key {@code bundle:processor}) in
+     * {@code currency} (USD fallback) — the rate the in-app bundle calculator multiplies its pool
+     * by, so its estimate matches the amount the checkout edge fn charges (which bills the pool
+     * against this same price). Distinct from the metered {@code perDocMinor}; a bundle credit is
+     * one size-scaled run, priced per {@code unit_amount} of the bundle price. {@code null} when
+     * the rate can't be resolved (stripe schema absent, price unsynced) — the calculator then hides
+     * the figure and defers to the server total.
+     */
+    public BigDecimal resolveBundleRatePerCreditMinor(String currency) {
+        return subscriptionDao
+                .findRateByLookupKey(
+                        BUNDLE_LOOKUP_KEY, currency != null ? currency : DISPLAY_CURRENCY)
+                .map(StripeSubscriptionDao.PriceRate::perDocMinor)
+                .orElse(null);
+    }
+
     /**
      * Inclusive-start / exclusive-end window for the calendar month — the monthly billing window
      * used when there's no Stripe subscription period to anchor on.
diff --git a/app/saas/src/main/java/stirling/software/saas/payg/policy/PricingPolicy.java b/app/saas/src/main/java/stirling/software/saas/payg/policy/PricingPolicy.java
index d28b0fd09d..c9cda11831 100644
--- a/app/saas/src/main/java/stirling/software/saas/payg/policy/PricingPolicy.java
+++ b/app/saas/src/main/java/stirling/software/saas/payg/policy/PricingPolicy.java
@@ -123,9 +123,11 @@ public class PricingPolicy implements Serializable {
     @Column(name = "bundle_stripe_price_id", length = 128)
     private String bundleStripePriceId;
 
-    /** Stripe coupon id applying the 12-for-10 prepaid discount. Null = bundles not offered. */
-    @Column(name = "bundle_coupon_id", length = 128)
-    private String bundleCouponId;
+    // No bundle_coupon_id field: the 12-for-10 discount is minted per-quote as an inline amount_off
+    // coupon by the create-payg-bundle-quote edge fn (computed from the bundle Price), so the
+    // pre-made percent coupon this policy used to carry is no longer consulted by anything. The
+    // column still exists (payg_get_bundle_pricing returns it) and is dropped in a later cleanup;
+    // ddl-auto=update never drops columns, so removing the mapping here is safe.
 
     /**
      * Exactly one row in the table has {@code is_default = true}; enforced by partial unique idx.
diff --git a/app/saas/src/test/java/stirling/software/saas/payg/api/WalletSnapshotResponseTest.java b/app/saas/src/test/java/stirling/software/saas/payg/api/WalletSnapshotResponseTest.java
index 55dfdb40e3..7960def2a9 100644
--- a/app/saas/src/test/java/stirling/software/saas/payg/api/WalletSnapshotResponseTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/payg/api/WalletSnapshotResponseTest.java
@@ -43,7 +43,8 @@ class WalletSnapshotResponseTest {
                 /* prepaidUnitsRemaining= */ 40_000L,
                 /* prepaidUnitsTotal= */ 120_000L,
                 /* prepaidExpiresAt= */ "2027-06-01",
-                /* billingMode= */ "prepaid");
+                /* billingMode= */ "prepaid",
+                /* bundleRatePerCreditMinor= */ new BigDecimal("1"));
     }
 
     @Test
@@ -123,10 +124,12 @@ class WalletSnapshotResponseTest {
                         0L,
                         0L,
                         null,
-                        "payg");
+                        "payg",
+                        null);
 
         assertThat(free.billableLimit()).isNull();
         assertThat(free.pricePerDocMinor()).isNull();
+        assertThat(free.bundleRatePerCreditMinor()).isNull();
         assertThat(free.currency()).isNull();
         assertThat(free.estimatedBillMinor()).isNull();
         assertThat(free.capUsd()).isNull();
diff --git a/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx b/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx
index cb6eb511c9..abfb0110ca 100644
--- a/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx
+++ b/frontend/editor/src/cloud/components/shared/config/configSections/usageMeters.tsx
@@ -196,7 +196,7 @@ export function PrepaidCapacityMeterPanel({ snap }: { snap: PrepaidSnapshot }) {
       figure={snap.remaining.toLocaleString()}
       capSuffix={t(
         "payg.prepaid.meter.capSuffix",
-        "of {{total}} prepaid PDFs",
+        "of {{total}} prepaid credits",
         {
           total: snap.total.toLocaleString(),
         },
diff --git a/frontend/editor/src/cloud/hooks/useWallet.ts b/frontend/editor/src/cloud/hooks/useWallet.ts
index ccef26a8bc..0a3f78b3ce 100644
--- a/frontend/editor/src/cloud/hooks/useWallet.ts
+++ b/frontend/editor/src/cloud/hooks/useWallet.ts
@@ -128,6 +128,7 @@ function reuseIfEqual(prev: Wallet | null, next: Wallet): Wallet {
     prev.freeAllowance !== next.freeAllowance ||
     prev.freeRemaining !== next.freeRemaining ||
     prev.pricePerDocMinor !== next.pricePerDocMinor ||
+    prev.bundleRatePerCreditMinor !== next.bundleRatePerCreditMinor ||
     prev.currency !== next.currency ||
     prev.estimatedBillMinor !== next.estimatedBillMinor ||
     prev.capUsd !== next.capUsd ||
diff --git a/frontend/editor/src/portal/billing/stripe.ts b/frontend/editor/src/portal/billing/stripe.ts
index 8b9690d3f6..9efcc9b0a1 100644
--- a/frontend/editor/src/portal/billing/stripe.ts
+++ b/frontend/editor/src/portal/billing/stripe.ts
@@ -117,7 +117,12 @@ export interface BundleQuoteInput {
   provisionedMonthlyVolume: number;
   /** Size-folded run-credits = the Stripe line quantity when this quote is paid. */
   poolCredits: number;
-  /** Discounted total in minor units; null when the per-run rate is unknown. */
+  /**
+   * Client-estimated discounted total in minor units, persisted for the pre-mint display only; null
+   * when the per-run rate is unknown. NOT authoritative: once the Stripe quote is minted,
+   * create-payg-bundle-quote overwrites the row's price_minor with the server-derived total
+   * (Price x qty - amount_off), and the Stripe quote/invoice amount is server-derived regardless.
+   */
   priceMinor: number | null;
   currency: string;
   /** Affirmative consent to the prepaid→metered auto-transition (ARL/EULA §7.2). */
diff --git a/frontend/editor/src/portal/components/billing/ActivationChoiceModal.tsx b/frontend/editor/src/portal/components/billing/ActivationChoiceModal.tsx
index 3b110fe187..0130751bea 100644
--- a/frontend/editor/src/portal/components/billing/ActivationChoiceModal.tsx
+++ b/frontend/editor/src/portal/components/billing/ActivationChoiceModal.tsx
@@ -50,11 +50,14 @@ function DoorCard({
  * before any card is entered. Two door-cards, matching the demo —
  *
  *   - Pay as you go → the metered subscription checkout (spend limit + card).
- *   - Prepay a year → the discounted bundle (calculator + one-time payment); the
- *     backend silently stands up the metered subscription off the saved card so
- *     metering resumes when the pool empties, so no spend-limit step is needed.
+ *   - Prepay a year → the discounted bundle (calculator + one-time payment); no
+ *     spend-limit step, since the buyer commits to a fixed pool up front.
  *
  * Same per-PDF rate on both paths — prepay just front-loads two free months.
+ *
+ * Note: auto-standing-up the metered subscription off the saved card so metering
+ * resumes once a prepaid pool empties is a known follow-up, NOT yet wired — a
+ * prepay-only team isn't metered past its pool today.
  */
 export function ActivationChoiceModal({
   open,
diff --git a/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx b/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx
index 6bb442f6ed..b5d0d58a3b 100644
--- a/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx
+++ b/frontend/editor/src/portal/components/billing/BundleCheckoutModal.tsx
@@ -100,6 +100,23 @@ function pipelineIdFor(mult: number): string {
   );
 }
 
+/**
+ * Reuse key for the minted Stripe quote. Includes the sizing MULTIPLIER ids alongside the pool + PO,
+ * not just the pool: different posture/size/pipeline combos can yield the same poolCredits (identical
+ * Stripe amount), and keying on the pool alone would skip the re-mint on such an edit and leave the
+ * persisted quote row with stale sizing fields. Keying on the ids re-mints (and re-persists) whenever
+ * the buyer actually changes the config.
+ */
+function buildStripeQuoteSig(
+  poolCredits: number,
+  postureId: string,
+  sizeId: string,
+  pipelineId: string,
+  poNumber: string,
+): string {
+  return `${poolCredits}|${postureId}|${sizeId}|${pipelineId}|${poNumber.trim()}`;
+}
+
 /**
  * Pre-quote calculator progress, persisted per team so closing the modal / reloading doesn't lose the
  * buyer's place. Once a real quote exists it's the source of truth (loaded server-side), so this is
@@ -189,7 +206,9 @@ export function BundleCheckoutModal({
   const { t } = useTranslation();
   const teamId = wallet.teamId;
   const currency = wallet.currency ?? "usd";
-  const pricePerDocMinor = wallet.pricePerDocMinor;
+  // The pool is priced per size-scaled RUN at the prepaid-bundle rate (bundle:processor), NOT the
+  // metered per-document rate — so the estimate matches the amount the checkout edge fn charges.
+  const ratePerRunMinor = wallet.bundleRatePerCreditMinor;
 
   const [phase, setPhase] = useState<Phase>("calc");
   const [users, setUsers] = useState(DEFAULT_USERS);
@@ -218,10 +237,12 @@ export function BundleCheckoutModal({
   const [stripeQuoteSig, setStripeQuoteSig] = useState<string | null>(null);
   // The invoice generated when the quote is accepted (awaiting payment); null when simulated.
   const [invoice, setInvoice] = useState<BundleInvoice | null>(null);
-  // On resume, the total the quote was persisted at (server value), frozen so the receipt shows what
-  // the buyer actually quoted rather than a figure recomputed from a since-changed rate. Paired with
-  // the pool size it was persisted at — once the buyer edits the sizing (pool changes) we drop back to
-  // the live estimate, since editing re-mints and re-persists anyway.
+  // On resume, the total the quote was persisted at, frozen so the receipt shows what the buyer
+  // actually quoted rather than a figure recomputed from a since-changed rate. Once the Stripe quote
+  // has been minted this is the server-derived total (create-payg-bundle-quote overwrites price_minor
+  // with Price x qty - amount_off); before that it's the client estimate persisted at upsert. Paired
+  // with the pool size it was persisted at — once the buyer edits the sizing (pool changes) we drop
+  // back to the live estimate, since editing re-mints and re-persists anyway.
   const [persistedPriceMinor, setPersistedPriceMinor] = useState<number | null>(
     null,
   );
@@ -302,7 +323,13 @@ export function BundleCheckoutModal({
           });
           // Match the reuse signature so resuming doesn't immediately re-mint the Stripe quote.
           setStripeQuoteSig(
-            `${latest.poolCredits}|${(saved?.poNumber ?? "").trim()}`,
+            buildStripeQuoteSig(
+              latest.poolCredits,
+              postureIdFor(latest.posturePolicies),
+              sizeIdFor(latest.sizeMult),
+              pipelineIdFor(latest.pipelineMult),
+              saved?.poNumber ?? "",
+            ),
           );
         }
         // Already accepted (an invoice exists) → resume straight to the payment step rather than the
@@ -374,9 +401,9 @@ export function BundleCheckoutModal({
         posturePolicies: policiesFor(postureId),
         sizeMult: sizeMultFor(sizeId),
         pipelineMult: pipelineMultFor(pipelineId),
-        ratePerRunMinor: pricePerDocMinor,
+        ratePerRunMinor,
       }),
-    [users, postureId, sizeId, pipelineId, pricePerDocMinor],
+    [users, postureId, sizeId, pipelineId, ratePerRunMinor],
   );
 
   // The receipt shows the persisted (server) total on resume so it matches the quote the buyer
@@ -459,7 +486,13 @@ export function BundleCheckoutModal({
     stripeQuote: BundleStripeQuote;
   } | null> {
     if (teamId == null) return null;
-    const sig = `${quote.poolCredits}|${poNumber.trim()}`;
+    const sig = buildStripeQuoteSig(
+      quote.poolCredits,
+      postureId,
+      sizeId,
+      pipelineId,
+      poNumber,
+    );
     if (stripeQuote && stripeQuoteSig === sig && quoteId != null) {
       return { quoteId, stripeQuote }; // unchanged since last mint — reuse, no new quote
     }
diff --git a/frontend/editor/src/portal/components/billing/FreePlanView.tsx b/frontend/editor/src/portal/components/billing/FreePlanView.tsx
index 5b704f3860..d3a1baf036 100644
--- a/frontend/editor/src/portal/components/billing/FreePlanView.tsx
+++ b/frontend/editor/src/portal/components/billing/FreePlanView.tsx
@@ -184,9 +184,11 @@ export function FreePlanView({ wallet, unsynced, onSubscribed }: Props) {
       )}
 
       {/* Prepay reuses the bundle modal (free team → first-purchase copy, no cap
-          step). On completion the webhook credits the pool AND silently creates
-          the metered subscription off the saved card, so we poll like the payg
-          path to flip the wallet to subscribed. */}
+          step). On completion the webhook credits the pool; we still poll onSubscribed
+          like the payg path, but flipping the wallet to subscribed depends on the
+          metered-subscription auto-provisioning off the saved card, a known follow-up
+          that's NOT yet wired — so for a prepay-only team this poll can just time out
+          until then. */}
       {wallet.teamId != null && (
         <BundleCheckoutModal
           open={step === "prepay"}
diff --git a/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx b/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx
index 038b8be6d5..b70fbb5a26 100644
--- a/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx
+++ b/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.tsx
@@ -75,7 +75,7 @@ export function PrepaidCapacityCard({
         figure={remaining.toLocaleString()}
         capSuffix={t(
           "portal.billing.prepaid.capSuffix",
-          "of {{total}} prepaid PDFs",
+          "of {{total}} prepaid credits",
           {
             total: total.toLocaleString(),
           },
diff --git a/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx b/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
index c30a7d68b5..4787c40b37 100644
--- a/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
+++ b/frontend/editor/src/portal/components/billing/StripeCheckoutModal.tsx
@@ -143,6 +143,8 @@ function SpendLimitPicker({
   const onInput = (raw: string) => {
     const cleaned = raw.replace(/[^0-9]/g, "");
     setText(cleaned);
+    // Empty maps to 0 — the "nothing entered yet" sentinel (distinct from the explicit null "No limit").
+    // The parent treats 0 as incomplete and blocks Continue, so a cleared field can't become a $0 cap.
     onChange(cleaned === "" ? 0 : parseInt(cleaned, 10));
   };
 
@@ -326,6 +328,10 @@ export function StripeCheckoutModal({
   // Apply the chosen ceiling, then advance to payment. Applying it up front keeps
   // "you're never billed past it" true from the first processed PDF.
   async function handleContinue() {
+    // Guard the empty-field sentinel: clearing the input maps to 0, which is neither a real cap nor the
+    // explicit "No limit" (null). Proceeding would set a $0 ceiling (processing immediately paused), so
+    // treat it as incomplete and stay put — the Continue button is disabled in this state too.
+    if (capUsd !== null && capUsd <= 0) return;
     setCapBusy(true);
     setCapError(null);
     try {
@@ -357,6 +363,10 @@ export function StripeCheckoutModal({
     if (dismissable) onClose();
   };
 
+  // Valid to continue when a positive cap is set OR "No limit" (null) was explicitly picked. A cleared
+  // field maps to 0 (incomplete) — block Continue rather than let it become an accidental $0 ceiling.
+  const capValid = capUsd === null || capUsd > 0;
+
   // The chosen cap, formatted for the payment-step recap (null = "No cap" was picked on step 1).
   const capLabel =
     capUsd != null
@@ -443,6 +453,7 @@ export function StripeCheckoutModal({
               <Button
                 accent="premium"
                 loading={capBusy}
+                disabled={!capValid}
                 onClick={handleContinue}
                 rightSection={<span aria-hidden>›</span>}
               >
diff --git a/frontend/editor/src/portal/components/billing/walletFixtures.ts b/frontend/editor/src/portal/components/billing/walletFixtures.ts
index a3dcc3c5a2..75ed0dd867 100644
--- a/frontend/editor/src/portal/components/billing/walletFixtures.ts
+++ b/frontend/editor/src/portal/components/billing/walletFixtures.ts
@@ -12,6 +12,7 @@ export const freeWallet: Wallet = {
   freeAllowance: 500,
   freeRemaining: 380,
   pricePerDocMinor: 2,
+  bundleRatePerCreditMinor: 1,
   currency: "usd",
   estimatedBillMinor: null,
   capUsd: null,
@@ -43,6 +44,7 @@ export const subscribedWallet: Wallet = {
   freeAllowance: 500,
   freeRemaining: 0,
   pricePerDocMinor: 2,
+  bundleRatePerCreditMinor: 1,
   currency: "usd",
   estimatedBillMinor: 4500,
   capUsd: 1000,
diff --git a/frontend/editor/src/proprietary/billing/format.test.ts b/frontend/editor/src/proprietary/billing/format.test.ts
index 314c606080..e7a5c1b029 100644
--- a/frontend/editor/src/proprietary/billing/format.test.ts
+++ b/frontend/editor/src/proprietary/billing/format.test.ts
@@ -54,7 +54,7 @@ describe("prepaid bundle brain", () => {
     expect(q.provisionedMonthlyVolume).toBe(10000);
     expect(q.poolCredits).toBe(576_000);
     expect(q.listMinor).toBe(576_000); // 576k credits × 1¢
-    expect(q.priceMinor).toBe(480_000); // × 10/12
+    expect(q.priceMinor).toBe(480_000); // 576,000 − round(576000×2/12)=96,000
     expect(q.savingsMinor).toBe(96_000);
     expect(q.overEnterprise).toBe(false);
   });
@@ -86,17 +86,26 @@ describe("prepaid bundle brain", () => {
   });
 
   it("applies the 12-for-10 discount at the per-run rate", () => {
-    // 120k credits × 2 minor = 240,000 list; × 10/12 = 200,000 paid.
+    // 120k credits × 2 minor = 240,000 list; minus round(240000×2/12)=40,000 = 200,000 paid.
     expect(bundleListMinor(120_000, 2)).toBe(240_000);
     expect(bundlePriceMinor(120_000, 2)).toBe(200_000);
   });
 
   it("rounds sub-cent rates to the minor unit (HALF_UP)", () => {
-    // 100k × 0.5 = 50,000 list; × 10/12 = 41,666.67 → 41,667.
+    // 100k × 0.5 = 50,000 list; minus round(50000×2/12)=round(8333.33)=8,333 = 41,667.
     expect(bundleListMinor(100_000, 0.5)).toBe(50_000);
     expect(bundlePriceMinor(100_000, 0.5)).toBe(41_667);
   });
 
+  it("rounds the discount then subtracts, matching the edge fn on exact-half ties", () => {
+    // The mechanism that kills the coupon-rounding drift: round the DISCOUNT and subtract it, not
+    // round the discounted price. On a tie the two differ by a minor unit.
+    // subtotal 3 → discount round(0.5)=1 → 2 (round(3×10/12)=round(2.5)=3 would drift).
+    expect(bundlePriceMinor(3, 1)).toBe(2);
+    // subtotal 9 → discount round(1.5)=2 → 7 (round(9×10/12)=round(7.5)=8 would drift).
+    expect(bundlePriceMinor(9, 1)).toBe(7);
+  });
+
   it("returns null money when the rate is unknown or non-positive", () => {
     expect(bundleListMinor(120_000, null)).toBeNull();
     expect(bundlePriceMinor(120_000, null)).toBeNull();
diff --git a/frontend/editor/src/proprietary/billing/format.ts b/frontend/editor/src/proprietary/billing/format.ts
index 2a5f406cc0..f91f98af44 100644
--- a/frontend/editor/src/proprietary/billing/format.ts
+++ b/frontend/editor/src/proprietary/billing/format.ts
@@ -199,9 +199,13 @@ export function bundleListMinor(
 }
 
 /**
- * Discounted price of a prepaid pool in minor units: units × rate × paid/granted.
- * Mirror of the Stripe coupon. Null when the rate is unknown (the caller hides the
- * figure and falls back to the server total).
+ * Discounted price of a prepaid pool in minor units: the list subtotal minus the
+ * rounded 12-for-10 discount. Computed the SAME way as the edge fn that mints the
+ * Stripe coupon (create-payg-bundle-quote: round the DISCOUNT, then subtract it —
+ * not round the discounted price), so this pre-mint estimate matches the amount_off
+ * Stripe charges, and the total persisted on the quote, to the penny. The two methods
+ * diverge by a minor unit on exact-half ties. Null when the rate is unknown (the
+ * caller hides the figure and falls back to the server total).
  */
 export function bundlePriceMinor(
   units: number,
@@ -209,11 +213,12 @@ export function bundlePriceMinor(
   monthsPaid: number = PREPAID_MONTHS_PAID,
   monthsGranted: number = PREPAID_MONTHS_GRANTED,
 ): number | null {
-  const rate =
-    ratePerUnitMinor != null && ratePerUnitMinor > 0 ? ratePerUnitMinor : null;
-  return rate != null
-    ? Math.round((units * rate * monthsPaid) / monthsGranted)
-    : null;
+  const subtotal = bundleListMinor(units, ratePerUnitMinor);
+  if (subtotal == null) return null;
+  const discount = Math.round(
+    (subtotal * (monthsGranted - monthsPaid)) / monthsGranted,
+  );
+  return subtotal - discount;
 }
 
 /** Inputs to {@link computeBundleQuote} — team size + the finer-setting multipliers. */
diff --git a/frontend/editor/src/proprietary/billing/types.ts b/frontend/editor/src/proprietary/billing/types.ts
index 1fd2fbea9c..27c7c3fbd4 100644
--- a/frontend/editor/src/proprietary/billing/types.ts
+++ b/frontend/editor/src/proprietary/billing/types.ts
@@ -50,6 +50,12 @@ export interface Wallet {
   freeRemaining: number;
   /** Paid per-document rate in minor units (may be fractional); null = unknown (render "unknown", never substitute). */
   pricePerDocMinor: number | null;
+  /**
+   * Per-credit rate of the prepaid-bundle Stripe Price ({@code bundle:processor}) in minor units;
+   * null when unresolved. What the bundle calculator prices its pool at so the estimate matches the
+   * checkout charge — distinct from {@link pricePerDocMinor} (the metered per-doc rate).
+   */
+  bundleRatePerCreditMinor: number | null;
   /** Lower-case ISO 4217; null when unknown. */
   currency: string | null;
   /** Estimated charges so far this period in minor units; null when the rate is unknown. The Stripe invoice is authoritative. */
diff --git a/frontend/editor/src/saas/components/shared/FreeLimitReachedModal.test.tsx b/frontend/editor/src/saas/components/shared/FreeLimitReachedModal.test.tsx
index 1565f88d9a..8a342b1297 100644
--- a/frontend/editor/src/saas/components/shared/FreeLimitReachedModal.test.tsx
+++ b/frontend/editor/src/saas/components/shared/FreeLimitReachedModal.test.tsx
@@ -20,6 +20,7 @@ const wallet: Wallet = {
   freeAllowance: 500,
   freeRemaining: 0,
   pricePerDocMinor: 2,
+  bundleRatePerCreditMinor: 1,
   currency: "usd",
   estimatedBillMinor: 0,
   capUsd: null,
diff --git a/frontend/editor/src/saas/hooks/walletDevPreview.ts b/frontend/editor/src/saas/hooks/walletDevPreview.ts
index 216e9fb536..1bce8eb2f8 100644
--- a/frontend/editor/src/saas/hooks/walletDevPreview.ts
+++ b/frontend/editor/src/saas/hooks/walletDevPreview.ts
@@ -61,6 +61,7 @@ function buildDevPreviewWallet(role: WalletRole): Wallet {
     // default policy's USD Price so the upgrade-flow cap estimate ("≈ N paid
     // PDFs/month") can render before subscribing. Mirror that here.
     pricePerDocMinor: 2,
+    bundleRatePerCreditMinor: 1,
     currency: "usd",
     estimatedBillMinor: subscribed ? 0 : null,
     capUsd: subscribed ? 25 : null,

From 22ec0947c908d7fe1815fbcd0f73305c908c8732 Mon Sep 17 00:00:00 2001
From: Reece Browne <74901996+reecebrowne@users.noreply.github.com>
Date: Tue, 28 Jul 2026 17:06:06 +0100
Subject: [PATCH 098/109] Storybook coverage: scan harness + stories (#7073)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Gets most of the app's components into Storybook and adds a scan that
runs every story in a real browser, so we have a base to build
accessibility testing on next.

- **~380 new stories**, taking story files from 144 to 526. Components
with a story:

  | Layer | Before | After |
  |---|---|---|
  | core | 41 / 309 (13%) | **183 / 309 (59%)** |
  | portal | 91 / 161 (57%) | **127 / 161 (79%)** |
  | proprietary | 1 / 105 (1%) | **39 / 105 (37%)** |
| cloud / desktop / saas / portal-saas / prototypes | 0 / 84 | 0 / 84
(unchanged) |
  | **Total** | **133 / 659 (20%)** | **349 / 659 (53%)** |

Both columns are counted the same way — every `.tsx` exporting a
component, so the denominator includes things that aren't really visual
units (contexts, providers, barrels). Excluding those it's 22% → 58%.
Either way it's reproducible from the tree rather than a number you have
to take on trust.

- **Scan harness** — the Storybook Vitest addon runs each story in
headless Chromium as a **render/smoke check** (a story must mount
without throwing). New task: `task frontend:storybook:test` (pass a
filter, e.g. `-- Button`). Separate Vitest config so it doesn't touch
the existing jsdom unit tests.

## Scope

- **Stories and Storybook config only, with one exception:** a one-line
fix to `ProviderCard`, which re-rendered forever whenever its optional
`settings` prop was omitted. Called out because it's the only component
source change here.
- The preview gains a `QueryClientProvider` (the portal app has one, so
stories reaching a query hook threw without it), and the scan task now
installs the browser it drives.
- **a11y is report-only** and **nothing runs the scan in CI yet** —
enforcing a11y and wiring it into CI is the follow-up, #7086.
- Components that can't render as an isolated unit are **not** included:
anything needing the full editor runtime (ToolWorkflow / FileManager /
AppConfig / a live PDF engine) or that's headless (providers, gates, API
bridges, config factories). Stories that only rendered by mounting the
whole `AppProviders` tree were dropped for the same reason — that isn't
isolation, and the tree's ErrorBoundary swallowed render failures so
those stories could never fail. A few that need assets the headless
browser can't serve are tagged `!test`, so they still show in the UI but
sit out the scan.

## Testing

Typecheck (all build variants), ESLint, Prettier and the unit suite
pass. Every story in the scanned set mounts without throwing.

## Notes for reviewers

- Stories use the `@app`/`@core`/`@portal`/`@proprietary` aliases (no
deep relative imports) and mock data-fetching components with MSW.
- Running the full suite in one go can flake on the Vite dep-optimizer;
scan in small batches (or by filter) for a stable local run.
---
 .taskfiles/frontend.yml                       |  16 ++
 frontend/.storybook/main.ts                   |   6 +-
 frontend/.storybook/preview.tsx               |  47 ++--
 frontend/.storybook/vitest.config.ts          |  62 +++++
 frontend/.storybook/vitest.setup.ts           |  10 +
 .../src/core/components/AppLayout.stories.tsx |  75 ++++++
 .../components/StorageStatsCard.stories.tsx   |  49 ++++
 .../shared/BaseAnnotationTool.stories.tsx     |  68 ++++++
 .../shared/ColorControl.stories.tsx           |  35 +++
 .../annotation/shared/ColorPicker.stories.tsx |  45 ++++
 .../shared/DrawingCanvas.stories.tsx          |  52 +++++
 .../shared/DrawingControls.stories.tsx        |  39 ++++
 .../shared/ImageUploader.stories.tsx          |  39 ++++
 .../shared/OpacityControl.stories.tsx         |  23 ++
 .../shared/PropertiesPopover.stories.tsx      |  35 +++
 .../shared/TextInputWithFont.stories.tsx      |  78 +++++++
 .../shared/WidthControl.stories.tsx           |  35 +++
 .../annotation/tools/DrawingTool.stories.tsx  |  50 ++++
 .../annotation/tools/ImageTool.stories.tsx    |  50 ++++
 .../fileEditor/FileEditorFileName.stories.tsx |  40 ++++
 .../CompactFileDetails.stories.tsx            |  68 ++++++
 .../fileManager/DragOverlay.stories.tsx       |  30 +++
 .../fileManager/FileDetails.stories.tsx       |  73 ++++++
 .../filesPage/DeleteFilesDialog.stories.tsx   |  58 +++++
 .../filesPage/DeleteFolderDialog.stories.tsx  |  39 ++++
 .../filesPage/FileDetailsPanel.stories.tsx    |  88 +++++++
 .../components/filesPage/FileGrid.stories.tsx | 114 +++++++++
 .../filesPage/FileOriginBadge.stories.tsx     |  35 +++
 .../FolderAppearancePicker.stories.tsx        |  46 ++++
 .../filesPage/FolderNameDialog.stories.tsx    |  31 +++
 .../filesPage/FolderThumbnail.stories.tsx     |  38 +++
 .../filesPage/FolderTreeSidebar.stories.tsx   |  51 ++++
 .../filesPage/MoveToFolderDialog.stories.tsx  |  86 +++++++
 .../OpenInNewWindowMenuItem.stories.tsx       |  29 +++
 .../filesPage/VersionHistoryModal.stories.tsx |  64 ++++++
 .../filesPage/VersionTimeline.stories.tsx     |  98 ++++++++
 .../OnboardingSlideShell.stories.tsx          |  79 +++++++
 .../onboarding/OnboardingStepper.stories.tsx  |  21 ++
 .../onboarding/OnboardingTour.stories.tsx     |  69 ++++++
 .../StaticOnboardingSlide.stories.tsx         | 105 +++++++++
 .../slides/AnalyticsChoiceSlide.stories.tsx   |  41 ++++
 .../AnimatedSlideBackground.stories.tsx       |  44 ++++
 .../slides/DesktopInstallTitle.stories.tsx    |  39 ++++
 .../slides/FirstLoginSlide.stories.tsx        |  47 ++++
 .../slides/PlanOverviewSlide.stories.tsx      |  60 +++++
 .../slides/ProcessorIntroSlide.stories.tsx    |  33 +++
 .../slides/SecurityCheckSlide.stories.tsx     |  46 ++++
 .../slides/ServerLicenseSlide.stories.tsx     |  64 ++++++
 .../slides/WelcomeSlide.stories.tsx           |  33 +++
 .../pageEditor/DragDropGrid.stories.tsx       | 112 +++++++++
 .../pageEditor/PageEditorControls.stories.tsx |  57 +++++
 .../AdvancedSelectionPanel.stories.tsx        |  40 ++++
 .../OperatorsSection.stories.tsx              |  23 ++
 .../SelectPages.stories.tsx                   |  43 ++++
 .../SelectedPagesDisplay.stories.tsx          |  34 +++
 .../shared/AllToolsNavButton.stories.tsx      |  63 +++++
 .../components/shared/AppSwitch.stories.tsx   |  35 +++
 .../shared/BulkShareModal.stories.tsx         |  75 ++++++
 .../BulkUploadToServerModal.stories.tsx       |  67 ++++++
 .../shared/ButtonToggle.stories.tsx           |  58 +++++
 .../shared/CloudStorageIcons.stories.tsx      |  33 +++
 .../shared/DropdownListWithFooter.stories.tsx |  86 +++++++
 .../shared/EditableSecretField.stories.tsx    |  61 +++++
 .../EncryptedPdfUnlockModal.stories.tsx       |  60 +++++
 .../shared/ErrorBoundary.stories.tsx          |  44 ++++
 .../components/shared/FileCard.stories.tsx    |  65 ++++++
 .../components/shared/FileDocIcon.stories.tsx |  35 +++
 .../shared/FileDropdownMenu.stories.tsx       |  49 ++++
 .../components/shared/FileGrid.stories.tsx    | 104 +++++++++
 .../shared/FilePickerModal.stories.tsx        |  37 +++
 .../components/shared/FilePreview.stories.tsx |  57 +++++
 .../shared/FileSelectorPicker.stories.tsx     |  48 ++++
 .../shared/FileUploadButton.stories.tsx       |  56 +++++
 .../shared/FirstLoginModal.stories.tsx        |  18 ++
 .../components/shared/FitText.stories.tsx     |  41 ++++
 .../core/components/shared/Footer.stories.tsx |  27 +++
 .../shared/HoverActionMenu.stories.tsx        |  76 ++++++
 .../components/shared/InfoBanner.stories.tsx  |  38 +++
 .../shared/LandingDocumentStack.stories.tsx   |  13 ++
 .../shared/LanguageSelector.stories.tsx       |  25 ++
 .../shared/LoadingFallback.stories.tsx        |  13 ++
 .../components/shared/LocalIcon.stories.tsx   |  32 +++
 .../shared/LoginAgreementModal.stories.tsx    |  18 ++
 .../shared/MobileUploadModal.stories.tsx      |  25 ++
 .../shared/MultiSelectControls.stories.tsx    |  34 +++
 .../shared/NavigationWarningModal.stories.tsx | 103 +++++++++
 .../shared/ObscuredOverlay.stories.tsx        |  49 ++++
 .../PageSelectionSyntaxHint.stories.tsx       |  35 +++
 .../shared/PolicyBadges.stories.tsx           |  44 ++++
 .../shared/PrivateContent.stories.tsx         |  24 ++
 .../shared/ShareFileModal.stories.tsx         |  63 +++++
 .../shared/ShareManagementModal.stories.tsx   |  66 ++++++
 .../shared/SkeletonLoader.stories.tsx         |  37 +++
 .../components/shared/ToolChain.stories.tsx   |  56 +++++
 .../components/shared/ToolIcon.stories.tsx    |  35 +++
 .../shared/ToolPanelHeader.stories.tsx        |  28 +++
 .../components/shared/UpdateModal.stories.tsx |  79 +++++++
 .../shared/UpdateStartupPopup.stories.tsx     |  63 +++++
 .../shared/UploadToServerModal.stories.tsx    |  62 +++++
 .../shared/UserSelector.stories.tsx           |  29 +++
 .../shared/ZipWarningModal.stories.tsx        |  30 +++
 .../config/LoginRequiredBanner.stories.tsx    |  22 ++
 .../shared/config/OverviewHeader.stories.tsx  |  12 +
 .../shared/config/PendingBadge.stories.tsx    |  29 +++
 .../RestartConfirmationModal.stories.tsx      |  26 +++
 .../config/SettingsSearchBar.stories.tsx      |  62 +++++
 .../config/SettingsStickyFooter.stories.tsx   |  34 +++
 .../configSections/GeneralSection.stories.tsx |  71 ++++++
 .../configSections/HelpSection.stories.tsx    |  25 ++
 .../configSections/HotkeysSection.stories.tsx |  40 ++++
 .../configSections/LegalSection.stories.tsx   |  74 ++++++
 .../configSections/Overview.stories.tsx       |  59 +++++
 .../configSections/ProviderCard.stories.tsx   |  80 +++++++
 .../config/configSections/ProviderCard.tsx    |   8 +-
 .../ThirdPartyLicensesSection.stories.tsx     |  18 ++
 .../filePreview/DocumentStack.stories.tsx     |  51 ++++
 .../filePreview/DocumentThumbnail.stories.tsx |  49 ++++
 .../filePreview/HoverOverlay.stories.tsx      |  31 +++
 .../filePreview/NavigationArrows.stories.tsx  |  34 +++
 .../QuickAccessButton.stories.tsx             |  46 ++++
 .../signing/CreateSessionFlow.stories.tsx     |  71 ++++++
 .../signing/SharedSigningLauncher.stories.tsx | 104 +++++++++
 ...ConfigureSignatureDefaultsStep.stories.tsx |  83 +++++++
 .../steps/ReviewSessionStep.stories.tsx       |  50 ++++
 .../steps/SelectDocumentStep.stories.tsx      |  34 +++
 .../steps/SelectParticipantsStep.stories.tsx  |  27 +++
 .../SliderWithInput.stories.tsx               |  46 ++++
 .../shared/tooltip/TooltipContent.stories.tsx |  63 +++++
 .../DrawSignatureCanvas.stories.tsx           |  38 +++
 .../SignatureTypeSelector.stories.tsx         |  37 +++
 .../TypeSignatureText.stories.tsx             |  61 +++++
 .../UploadSignatureImage.stories.tsx          |  36 +++
 .../toast/ToastRenderer.stories.tsx           | 102 ++++++++
 .../tools/ToolLoadingFallback.stories.tsx     |  20 ++
 .../tools/ToolPanelModePrompt.stories.tsx     |  51 ++++
 .../components/tools/ToolRenderer.stories.tsx |  55 +++++
 .../PageNumberPreview.stories.tsx             |  26 +++
 .../AddPasswordSettings.stories.tsx           |  70 ++++++
 .../tools/addStamp/StampPreview.stories.tsx   |  36 +++
 .../addStamp/StampSetupSettings.stories.tsx   |  70 ++++++
 ...AddWatermarkSingleStepSettings.stories.tsx |  87 +++++++
 .../WatermarkFormatting.stories.tsx           |  32 +++
 .../WatermarkImageFile.stories.tsx            |  72 ++++++
 .../WatermarkStyleSettings.stories.tsx        |  38 +++
 .../WatermarkTextStyle.stories.tsx            |  41 ++++
 .../WatermarkTypeSettings.stories.tsx         |  28 +++
 .../addWatermark/WatermarkWording.stories.tsx |  53 +++++
 .../AdjustContrastBasicSettings.stories.tsx   |  57 +++++
 .../AdjustContrastColorSettings.stories.tsx   |  57 +++++
 .../AdjustContrastPreview.stories.tsx         |  20 ++
 ...justContrastSingleStepSettings.stories.tsx |  60 +++++
 .../AdjustPageScaleSettings.stories.tsx       |  46 ++++
 .../autoRename/AutoRenameSettings.stories.tsx |  30 +++
 .../automate/AutomationCreation.stories.tsx   |  59 +++++
 .../AutomationImportModal.stories.tsx         |  31 +++
 .../tools/automate/IconSelector.stories.tsx   |  28 +++
 .../ToolConfigurationModal.stories.tsx        |  80 +++++++
 .../tools/automate/ToolList.stories.tsx       |  55 +++++
 .../tools/automate/ToolSelector.stories.tsx   |  31 +++
 .../BookletImpositionSettings.stories.tsx     |  42 ++++
 .../CertSignAutomationSettings.stories.tsx    |  59 +++++
 .../CertificateFilesSettings.stories.tsx      |  81 +++++++
 .../CertificateFormatSettings.stories.tsx     |  33 +++
 .../certSign/CertificateSelector.stories.tsx  |  82 +++++++
 .../CertificateTypeSettings.stories.tsx       |  82 +++++++
 .../HardwareCertificateSettings.stories.tsx   |  79 +++++++
 .../SignatureAppearanceSettings.stories.tsx   |  67 ++++++
 .../SignatureSettingsDisplay.stories.tsx      |  40 ++++
 .../SignatureSettingsInput.stories.tsx        |  59 +++++
 .../certSign/WetSignatureInput.stories.tsx    |  60 +++++
 .../modals/AddParticipantsFlow.stories.tsx    |  22 ++
 .../modals/CertificateConfigModal.stories.tsx |  26 +++
 .../modals/SelectSignatureModal.stories.tsx   |  18 ++
 .../panels/ParticipantListPanel.stories.tsx   |  63 +++++
 .../panels/SessionActionsPanel.stories.tsx    |  73 ++++++
 .../panels/SessionDetailPanel.stories.tsx     |  74 ++++++
 .../panels/SignControlsPanel.stories.tsx      |  51 ++++
 .../steps/AddSignaturesStep.stories.tsx       |  33 +++
 .../CertificateSelectionStep.stories.tsx      | 102 ++++++++
 .../steps/ReviewSignatureStep.stories.tsx     |  57 +++++
 .../steps/SignatureCreationStep.stories.tsx   |  53 +++++
 .../steps/SignaturePlacementStep.stories.tsx  |  53 +++++
 .../steps/AdvancedOptionsStep.stories.tsx     |  36 +++
 .../steps/CustomMetadataStep.stories.tsx      |  79 +++++++
 .../steps/DeleteAllStep.stories.tsx           |  53 +++++
 .../steps/DocumentDatesStep.stories.tsx       |  66 ++++++
 .../steps/StandardMetadataStep.stories.tsx    |  62 +++++
 .../ChangePermissionsSettings.stories.tsx     |  48 ++++
 .../compare/CompareDocumentPane.stories.tsx   |  75 ++++++
 .../CompareNavigationDropdown.stories.tsx     |  48 ++++
 .../ComparePixelWorkbenchView.stories.tsx     | 113 +++++++++
 .../compress/CompressSettings.stories.tsx     |  76 ++++++
 .../ConvertFromCbrSettings.stories.tsx        |  66 ++++++
 .../ConvertFromCbzSettings.stories.tsx        |  52 +++++
 .../ConvertFromEbookSettings.stories.tsx      |  42 ++++
 .../ConvertFromEmailSettings.stories.tsx      |  62 +++++
 .../ConvertFromImageSettings.stories.tsx      |  38 +++
 .../ConvertFromSvgSettings.stories.tsx        |  38 +++
 .../ConvertFromWebSettings.stories.tsx        |  38 +++
 .../convert/ConvertToCbrSettings.stories.tsx  |  52 +++++
 .../convert/ConvertToCbzSettings.stories.tsx  |  25 ++
 .../convert/ConvertToEpubSettings.stories.tsx |  54 +++++
 .../ConvertToImageSettings.stories.tsx        |  38 +++
 .../convert/ConvertToPdfaSettings.stories.tsx |  34 +++
 .../convert/ConvertToPdfxSettings.stories.tsx |  57 +++++
 .../convert/GroupedFormatDropdown.stories.tsx |  55 +++++
 .../tools/crop/CropAreaSelector.stories.tsx   |  83 +++++++
 .../crop/CropAutomationSettings.stories.tsx   |  59 +++++
 .../crop/CropCoordinateInputs.stories.tsx     |  63 +++++
 .../BookmarkEditor.stories.tsx                |  45 ++++
 .../EditTableOfContentsSettings.stories.tsx   |  69 ++++++
 ...itTableOfContentsWorkbenchView.stories.tsx |  86 +++++++
 .../ExtractImagesSettings.stories.tsx         |  60 +++++
 .../ExtractPagesSettings.stories.tsx          |  39 ++++
 .../tools/flatten/FlattenSettings.stories.tsx |  48 ++++
 .../fullscreen/DetailedToolItem.stories.tsx   | 103 +++++++++
 .../GetPdfInfoReportView.stories.tsx          | 112 +++++++++
 .../getPdfInfo/GetPdfInfoResults.stories.tsx  | 103 +++++++++
 .../sections/ComplianceSection.stories.tsx    |  59 +++++
 .../sections/KeyValueSection.stories.tsx      |  32 +++
 .../sections/OtherSection.stories.tsx         |  43 ++++
 .../sections/PerPageSection.stories.tsx       |  72 ++++++
 .../sections/SummarySection.stories.tsx       |  92 ++++++++
 .../TableOfContentsSection.stories.tsx        |  31 +++
 .../shared/KeyValueList.stories.tsx           |  28 +++
 .../shared/ScrollableCodeBlock.stories.tsx    |  38 +++
 .../shared/SectionBlock.stories.tsx           |  28 +++
 .../tools/merge/MergeFileSorter.stories.tsx   |  23 ++
 .../tools/merge/MergeSettings.stories.tsx     |  44 ++++
 .../tools/ocr/AdvancedOCRSettings.stories.tsx |  43 ++++
 .../tools/ocr/LanguagePicker.stories.tsx      |  63 +++++
 .../tools/ocr/OCRSettings.stories.tsx         |  43 ++++
 .../pageLayout/LayoutPreview.stories.tsx      |  44 ++++
 .../PageLayoutAdvancedSettings.stories.tsx    |  68 ++++++
 ...geLayoutMarginsBordersSettings.stories.tsx |  58 +++++
 .../pageLayout/PageLayoutPreview.stories.tsx  |  40 ++++
 .../pageLayout/PageLayoutSettings.stories.tsx |  61 +++++
 .../redact/RedactAdvancedSettings.stories.tsx |  40 ++++
 .../redact/RedactModeSelector.stories.tsx     |  54 +++++
 .../RedactSingleStepSettings.stories.tsx      |  78 +++++++
 .../redact/WordsToRedactInput.stories.tsx     |  47 ++++
 .../RemoveAnnotationsSettings.stories.tsx     |  12 +
 .../RemoveBlanksSettings.stories.tsx          |  41 ++++
 .../RemoveCertificateSignSettings.stories.tsx |  28 +++
 .../RemovePagesSettings.stories.tsx           |  44 ++++
 .../RemovePasswordSettings.stories.tsx        |  39 ++++
 .../ReorganizePagesSettings.stories.tsx       |  58 +++++
 .../tools/repair/RepairSettings.stories.tsx   |  25 ++
 .../ReplaceColorSettings.stories.tsx          |  35 +++
 .../RotateAutomationSettings.stories.tsx      |  46 ++++
 .../sanitize/SanitizeSettings.stories.tsx     |  40 ++++
 .../ScannerImageSplitSettings.stories.tsx     |  36 +++
 .../shared/ErrorNotification.stories.tsx      |  25 ++
 .../tools/shared/FileMetadata.stories.tsx     |  27 +++
 .../shared/NavigationControls.stories.tsx     |  36 +++
 .../tools/shared/NoToolsFound.stories.tsx     |  11 +
 .../shared/NumberInputWithUnit.stories.tsx    |  37 +++
 .../tools/shared/ResultsPreview.stories.tsx   |  46 ++++
 .../shared/SubcategoryHeader.stories.tsx      |  24 ++
 .../tools/shared/ToolStep.stories.tsx         |  36 +++
 .../tools/showJS/ShowJSView.stories.tsx       |  45 ++++
 .../tools/sign/PenSizeSelector.stories.tsx    |  36 +++
 .../sign/SavedSignaturesSection.stories.tsx   |  99 ++++++++
 .../SingleLargePageSettings.stories.tsx       |  27 +++
 .../split/SplitAutomationSettings.stories.tsx |  45 ++++
 .../tools/split/SplitSettings.stories.tsx     | 104 +++++++++
 .../TimestampPdfSettings.stories.tsx          |  26 +++
 .../tools/toolPicker/FavoriteStar.stories.tsx |  32 +++
 .../tools/toolPicker/ToolSearch.stories.tsx   |  82 +++++++
 .../UnlockPdfFormsSettings.stories.tsx        |  27 +++
 .../ValidateSignatureReportView.stories.tsx   | 140 +++++++++++
 .../ValidateSignatureSettings.stories.tsx     |  43 ++++
 .../reportView/FieldBlock.stories.tsx         |  21 ++
 .../reportView/FileSummaryHeader.stories.tsx  |  34 +++
 .../reportView/SignatureSection.stories.tsx   |  80 +++++++
 .../SignatureStatusBadge.stories.tsx          |  68 ++++++
 .../reportView/ThumbnailPreview.stories.tsx   |  29 +++
 .../viewer/AnnotationMenuButtons.stories.tsx  |  73 ++++++
 .../AnnotationSelectionMenu.stories.tsx       |  20 ++
 .../viewer/AnnotationTypeButtons.stories.tsx  |  69 ++++++
 .../viewer/CustomSearchLayer.stories.tsx      |  27 +++
 .../viewer/DocumentReadyWrapper.stories.tsx   |  35 +++
 .../components/viewer/LinkLayer.stories.tsx   |  22 ++
 .../viewer/LocalEmbedPDF.stories.tsx          |  39 ++++
 .../viewer/NonPdfViewer.stories.tsx           |  75 ++++++
 .../RedactionPendingTracker.stories.tsx       |  16 ++
 .../viewer/RedactionSelectionMenu.stories.tsx |  16 ++
 .../viewer/SearchInterface.stories.tsx        |  27 +++
 .../viewer/SignatureFieldOverlay.stories.tsx  |  22 ++
 .../SignaturePlacementOverlay.stories.tsx     |  94 ++++++++
 .../viewer/SignaturePreviewLayer.stories.tsx  |  63 +++++
 .../viewer/StampPlacementOverlay.stories.tsx  |  95 ++++++++
 .../viewer/TextSelectionMenu.stories.tsx      |  36 +++
 .../viewer/nonpdf/CsvViewer.stories.tsx       |  48 ++++
 .../viewer/nonpdf/HtmlViewer.stories.tsx      |  23 ++
 .../viewer/nonpdf/ImageViewer.stories.tsx     |  39 ++++
 .../viewer/nonpdf/JsonViewer.stories.tsx      |  47 ++++
 .../viewer/nonpdf/NonPdfBanner.stories.tsx    |  30 +++
 .../viewer/nonpdf/TextViewer.stories.tsx      |  53 +++++
 .../editor/src/core/ui/FilePicker.stories.tsx |  41 ++++
 .../components/AssistantButton.stories.tsx    |  32 +++
 .../portal/components/BrandMarks.stories.tsx  |  24 ++
 .../DownloadEditorModal.stories.tsx           |  14 ++
 .../components/ErrorBoundary.stories.tsx      |  43 ++++
 .../components/HomeGreeting.stories.tsx       |  12 +
 .../portal/components/HomeHero.stories.tsx    |  32 +++
 .../LinkAccountFooterItem.stories.tsx         |  21 ++
 .../portal/components/LoginScreen.stories.tsx |  12 +
 .../components/PortalChrome.stories.tsx       |  12 +
 .../account-link/AccountLinkPanel.stories.tsx |  72 ++++++
 .../account-link/LinkAccountModal.stories.tsx |  23 ++
 .../account-link/LinkGate.stories.tsx         |  24 --
 .../billing/CardPlaceholder.stories.tsx       |  14 ++
 .../billing/InvoicesList.stories.tsx          |  77 +++++++
 .../billing/PrepaidCapacityCard.stories.tsx   |  43 ++++
 .../billing/PrepayModalHeader.stories.tsx     |  30 +++
 .../infrastructure/AuditTab.stories.tsx       |  16 +-
 .../PipelineStepSettings.stories.tsx          |  76 ++++++
 .../pipelines/PipelinesTable.stories.tsx      |  43 ++++
 .../pipelines/ToolPicker.stories.tsx          |  70 ++++++
 .../ClassificationLabelsSection.stories.tsx   |  12 +
 .../PolicyExternalApiConfig.stories.tsx       |  66 ++++++
 .../policies/PolicyPurviewConfig.stories.tsx  |  46 ++++
 .../PolicyPurviewReadConfig.stories.tsx       |  32 +++
 .../procurement/CalendlyInline.stories.tsx    |  19 ++
 .../ProcurementAgreement.stories.tsx          |  92 ++++++++
 .../procurement/ProcurementBanner.stories.tsx |  79 +++++++
 .../procurement/ProcurementExtras.stories.tsx | 113 +++++++++
 .../procurement/ProcurementFlow.stories.tsx   | 143 ++++++++++++
 .../procurement/ProcurementStages.stories.tsx |  77 +++++++
 .../sources/ConnectionForm.stories.tsx        |  52 +++++
 .../sources/ConnectionModal.stories.tsx       |  51 ++++
 .../sources/ConnectionPicker.stories.tsx      |  55 +++++
 .../sources/ConnectionTypePicker.stories.tsx  |  28 +++
 .../sources/S3ConnectionPicker.stories.tsx    |  18 ++
 .../sources/SourceModal.stories.tsx           |  39 ++++
 .../sources/SourceTypeIcon.stories.tsx        |  27 +++
 .../users/PendingInvitations.stories.tsx      |  56 +++++
 .../src/portal/views/Integrations.stories.tsx |  28 +++
 .../portal/views/PipelineBuilder.stories.tsx  |  47 ++++
 .../proprietary/auth/ui/AuthShell.stories.tsx |  58 +++++
 .../auth/ui/EmailPasswordForm.stories.tsx     |  70 ++++++
 .../auth/ui/ErrorMessage.stories.tsx          |  32 +++
 .../auth/ui/SpringLoginForm.stories.tsx       |  99 ++++++++
 .../auth/ui/SupabaseLoginForm.stories.tsx     |  66 ++++++
 .../agents/StirlingLogoAnimated.stories.tsx   |  22 ++
 .../agents/StirlingLogoOutline.stories.tsx    |  22 ++
 .../policies/PolicyPiiField.stories.tsx       |  71 ++++++
 .../policies/PolicyRedactConfig.stories.tsx   |  70 ++++++
 .../PolicyWatermarkConfig.stories.tsx         |  38 +++
 .../ChangeUserPasswordModal.stories.tsx       |  36 +++
 .../shared/DividerWithText.stories.tsx        |  31 +++
 .../shared/ManageBillingButton.stories.tsx    |  23 ++
 .../shared/UpdateSeatsModal.stories.tsx       |  30 +++
 .../EnterpriseRequiredBanner.stories.tsx      |  24 ++
 .../GeneralWithLoginLanding.stories.tsx       |  74 ++++++
 .../shared/config/OverviewHeader.stories.tsx  |  49 ++++
 .../configSections/AccountSection.stories.tsx | 101 ++++++++
 .../AdminAiDocumentsSection.stories.tsx       |  98 ++++++++
 .../AdminAiGeneralSection.stories.tsx         |  82 +++++++
 .../AdminAiLimitsSection.stories.tsx          |  85 +++++++
 .../AdminAiModelsSection.stories.tsx          | 106 +++++++++
 .../AdminAuditSection.stories.tsx             | 100 ++++++++
 .../AdminFolderAccessSection.stories.tsx      |  95 ++++++++
 .../config/configSections/ApiKeys.stories.tsx |  55 +++++
 .../LoginAgreementEditor.stories.tsx          |  20 ++
 .../TeamDetailsSection.stories.tsx            |  98 ++++++++
 .../configSections/TeamsSection.stories.tsx   |  71 ++++++
 .../apiKeys/ApiKeySection.stories.tsx         |  31 +++
 .../apiKeys/RefreshModal.stories.tsx          |  25 ++
 .../audit/AuditChartsSection.stories.tsx      |  26 +++
 .../audit/AuditClearDataSection.stories.tsx   |  24 ++
 .../audit/AuditEventsTable.stories.tsx        |  29 +++
 .../audit/AuditExportSection.stories.tsx      |  32 +++
 .../audit/AuditFiltersForm.stories.tsx        |  68 ++++++
 .../audit/AuditStatsCards.stories.tsx         |  31 +++
 .../audit/AuditSystemStatus.stories.tsx       |  41 ++++
 .../plan/AvailablePlansSection.stories.tsx    |  80 +++++++
 .../plan/FeatureComparisonTable.stories.tsx   |  51 ++++
 .../configSections/plan/PlanCard.stories.tsx  | 130 +++++++++++
 .../usage/UsageAnalyticsChart.stories.tsx     |  28 +++
 .../usage/UsageAnalyticsTable.stories.tsx     |  32 +++
 .../stripeCheckout/StripeCheckout.stories.tsx |  58 +++++
 .../components/PriceDisplay.stories.tsx       |  47 ++++
 .../components/PricingBadge.stories.tsx       |  35 +++
 .../stages/EmailStage.stories.tsx             |  35 +++
 .../stages/ErrorStage.stories.tsx             |  27 +++
 .../stages/PaymentStage.stories.tsx           |  42 ++++
 .../stages/PlanSelectionStage.stories.tsx     | 103 +++++++++
 .../stages/SuccessStage.stories.tsx           |  47 ++++
 .../workflow/ParticipantView.stories.tsx      |  99 ++++++++
 frontend/package-lock.json                    | 217 ++++++++++++++++++
 frontend/package.json                         |   2 +
 frontend/vitest.config.ts                     |   7 +
 394 files changed, 19750 insertions(+), 46 deletions(-)
 create mode 100644 frontend/.storybook/vitest.config.ts
 create mode 100644 frontend/.storybook/vitest.setup.ts
 create mode 100644 frontend/editor/src/core/components/AppLayout.stories.tsx
 create mode 100644 frontend/editor/src/core/components/StorageStatsCard.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/shared/BaseAnnotationTool.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/shared/ColorControl.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/shared/ColorPicker.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/shared/DrawingCanvas.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/shared/DrawingControls.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/shared/ImageUploader.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/shared/OpacityControl.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/shared/PropertiesPopover.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/shared/TextInputWithFont.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/shared/WidthControl.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/tools/DrawingTool.stories.tsx
 create mode 100644 frontend/editor/src/core/components/annotation/tools/ImageTool.stories.tsx
 create mode 100644 frontend/editor/src/core/components/fileEditor/FileEditorFileName.stories.tsx
 create mode 100644 frontend/editor/src/core/components/fileManager/CompactFileDetails.stories.tsx
 create mode 100644 frontend/editor/src/core/components/fileManager/DragOverlay.stories.tsx
 create mode 100644 frontend/editor/src/core/components/fileManager/FileDetails.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/DeleteFilesDialog.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/DeleteFolderDialog.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/FileDetailsPanel.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/FileGrid.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/FileOriginBadge.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/FolderAppearancePicker.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/FolderNameDialog.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/FolderThumbnail.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/FolderTreeSidebar.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/MoveToFolderDialog.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/OpenInNewWindowMenuItem.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/VersionHistoryModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/filesPage/VersionTimeline.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/OnboardingSlideShell.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/OnboardingStepper.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/OnboardingTour.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/StaticOnboardingSlide.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/slides/AnalyticsChoiceSlide.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/slides/AnimatedSlideBackground.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/slides/PlanOverviewSlide.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/slides/ProcessorIntroSlide.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/slides/SecurityCheckSlide.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/slides/ServerLicenseSlide.stories.tsx
 create mode 100644 frontend/editor/src/core/components/onboarding/slides/WelcomeSlide.stories.tsx
 create mode 100644 frontend/editor/src/core/components/pageEditor/DragDropGrid.stories.tsx
 create mode 100644 frontend/editor/src/core/components/pageEditor/PageEditorControls.stories.tsx
 create mode 100644 frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/AdvancedSelectionPanel.stories.tsx
 create mode 100644 frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.stories.tsx
 create mode 100644 frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectedPagesDisplay.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/AllToolsNavButton.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/AppSwitch.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/BulkShareModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/BulkUploadToServerModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/ButtonToggle.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/CloudStorageIcons.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/DropdownListWithFooter.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/EditableSecretField.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/EncryptedPdfUnlockModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/ErrorBoundary.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/FileCard.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/FileDocIcon.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/FileDropdownMenu.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/FileGrid.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/FilePickerModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/FilePreview.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/FileSelectorPicker.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/FileUploadButton.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/FirstLoginModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/FitText.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/Footer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/HoverActionMenu.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/InfoBanner.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/LandingDocumentStack.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/LanguageSelector.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/LoadingFallback.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/LocalIcon.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/LoginAgreementModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/MobileUploadModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/MultiSelectControls.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/NavigationWarningModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/ObscuredOverlay.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/PageSelectionSyntaxHint.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/PolicyBadges.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/PrivateContent.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/ShareFileModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/ShareManagementModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/SkeletonLoader.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/ToolChain.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/ToolIcon.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/ToolPanelHeader.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/UpdateModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/UpdateStartupPopup.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/UploadToServerModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/UserSelector.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/ZipWarningModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/LoginRequiredBanner.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/OverviewHeader.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/PendingBadge.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/RestartConfirmationModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/SettingsSearchBar.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/SettingsStickyFooter.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/configSections/GeneralSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/configSections/HelpSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/configSections/LegalSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/configSections/Overview.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/configSections/ProviderCard.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/filePreview/DocumentStack.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/filePreview/DocumentThumbnail.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/filePreview/HoverOverlay.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/filePreview/NavigationArrows.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/quickAccessBar/QuickAccessButton.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/signing/CreateSessionFlow.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/signing/SharedSigningLauncher.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/signing/steps/ReviewSessionStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/signing/steps/SelectDocumentStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/signing/steps/SelectParticipantsStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/sliderWithInput/SliderWithInput.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/tooltip/TooltipContent.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/wetSignature/DrawSignatureCanvas.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/wetSignature/SignatureTypeSelector.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/wetSignature/TypeSignatureText.stories.tsx
 create mode 100644 frontend/editor/src/core/components/shared/wetSignature/UploadSignatureImage.stories.tsx
 create mode 100644 frontend/editor/src/core/components/toast/ToastRenderer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/ToolLoadingFallback.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/ToolPanelModePrompt.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/ToolRenderer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addPassword/AddPasswordSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addStamp/StampPreview.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addStamp/StampSetupSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addWatermark/AddWatermarkSingleStepSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addWatermark/WatermarkFormatting.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addWatermark/WatermarkImageFile.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addWatermark/WatermarkStyleSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addWatermark/WatermarkTextStyle.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addWatermark/WatermarkTypeSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/addWatermark/WatermarkWording.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastBasicSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastColorSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastPreview.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastSingleStepSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/adjustPageScale/AdjustPageScaleSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/autoRename/AutoRenameSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/automate/AutomationCreation.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/automate/AutomationImportModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/automate/IconSelector.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/automate/ToolConfigurationModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/automate/ToolList.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/automate/ToolSelector.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/bookletImposition/BookletImpositionSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/CertSignAutomationSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/CertificateFilesSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/CertificateFormatSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/CertificateSelector.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/HardwareCertificateSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/SignatureAppearanceSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/SignatureSettingsDisplay.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/SignatureSettingsInput.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/WetSignatureInput.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/modals/AddParticipantsFlow.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/modals/CertificateConfigModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/modals/SelectSignatureModal.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/panels/ParticipantListPanel.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/panels/SessionActionsPanel.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/panels/SessionDetailPanel.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/panels/SignControlsPanel.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/steps/AddSignaturesStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/steps/SignatureCreationStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/changeMetadata/steps/AdvancedOptionsStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/changeMetadata/steps/CustomMetadataStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/changeMetadata/steps/DeleteAllStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/changeMetadata/steps/DocumentDatesStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/changeMetadata/steps/StandardMetadataStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/changePermissions/ChangePermissionsSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/compare/CompareDocumentPane.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/compare/CompareNavigationDropdown.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/compare/ComparePixelWorkbenchView.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/compress/CompressSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertFromCbrSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertFromCbzSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertFromEbookSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertFromEmailSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertFromImageSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertFromSvgSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertFromWebSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertToCbrSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertToCbzSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertToEpubSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertToImageSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertToPdfaSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/ConvertToPdfxSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/crop/CropAreaSelector.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/crop/CropAutomationSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/crop/CropCoordinateInputs.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/extractImages/ExtractImagesSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/extractPages/ExtractPagesSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/flatten/FlattenSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/fullscreen/DetailedToolItem.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoReportView.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/sections/ComplianceSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/sections/KeyValueSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/sections/OtherSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/sections/PerPageSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/sections/SummarySection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/sections/TableOfContentsSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/shared/KeyValueList.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/shared/ScrollableCodeBlock.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/getPdfInfo/shared/SectionBlock.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/merge/MergeFileSorter.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/merge/MergeSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/ocr/AdvancedOCRSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/ocr/LanguagePicker.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/ocr/OCRSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/pageLayout/LayoutPreview.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/pageLayout/PageLayoutAdvancedSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/pageLayout/PageLayoutMarginsBordersSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/pageLayout/PageLayoutPreview.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/pageLayout/PageLayoutSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/redact/RedactAdvancedSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/redact/RedactModeSelector.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/redact/WordsToRedactInput.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/removeAnnotations/RemoveAnnotationsSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/removeBlanks/RemoveBlanksSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/removeCertificateSign/RemoveCertificateSignSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/removePages/RemovePagesSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/removePassword/RemovePasswordSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/reorganizePages/ReorganizePagesSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/repair/RepairSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/replaceColor/ReplaceColorSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/rotate/RotateAutomationSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/sanitize/SanitizeSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/scannerImageSplit/ScannerImageSplitSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/shared/ErrorNotification.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/shared/FileMetadata.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/shared/NavigationControls.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/shared/NoToolsFound.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/shared/NumberInputWithUnit.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/shared/ResultsPreview.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/shared/SubcategoryHeader.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/shared/ToolStep.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/showJS/ShowJSView.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/sign/PenSizeSelector.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/sign/SavedSignaturesSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/singleLargePage/SingleLargePageSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/split/SplitAutomationSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/split/SplitSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/timestampPdf/TimestampPdfSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/toolPicker/FavoriteStar.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/toolPicker/ToolSearch.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/unlockPdfForms/UnlockPdfFormsSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureReportView.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/validateSignature/reportView/FieldBlock.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/validateSignature/reportView/FileSummaryHeader.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/validateSignature/reportView/SignatureSection.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/validateSignature/reportView/SignatureStatusBadge.stories.tsx
 create mode 100644 frontend/editor/src/core/components/tools/validateSignature/reportView/ThumbnailPreview.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/AnnotationMenuButtons.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/AnnotationSelectionMenu.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/AnnotationTypeButtons.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/CustomSearchLayer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/DocumentReadyWrapper.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/LinkLayer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/LocalEmbedPDF.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/NonPdfViewer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/RedactionPendingTracker.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/RedactionSelectionMenu.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/SearchInterface.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/SignatureFieldOverlay.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/SignaturePlacementOverlay.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/SignaturePreviewLayer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/StampPlacementOverlay.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/TextSelectionMenu.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/nonpdf/CsvViewer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/nonpdf/HtmlViewer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/nonpdf/ImageViewer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/nonpdf/JsonViewer.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/nonpdf/NonPdfBanner.stories.tsx
 create mode 100644 frontend/editor/src/core/components/viewer/nonpdf/TextViewer.stories.tsx
 create mode 100644 frontend/editor/src/core/ui/FilePicker.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/AssistantButton.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/BrandMarks.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/DownloadEditorModal.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/ErrorBoundary.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/HomeGreeting.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/HomeHero.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/LinkAccountFooterItem.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/LoginScreen.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/PortalChrome.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/account-link/AccountLinkPanel.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/account-link/LinkAccountModal.stories.tsx
 delete mode 100644 frontend/editor/src/portal/components/account-link/LinkGate.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/CardPlaceholder.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/InvoicesList.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/PrepaidCapacityCard.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/billing/PrepayModalHeader.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/pipelines/PipelineStepSettings.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/pipelines/PipelinesTable.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/pipelines/ToolPicker.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/policies/ClassificationLabelsSection.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/policies/PolicyPurviewConfig.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/policies/PolicyPurviewReadConfig.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/CalendlyInline.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementAgreement.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementBanner.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementExtras.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementFlow.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/procurement/ProcurementStages.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionForm.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionModal.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionPicker.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/ConnectionTypePicker.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/S3ConnectionPicker.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/SourceModal.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/sources/SourceTypeIcon.stories.tsx
 create mode 100644 frontend/editor/src/portal/components/users/PendingInvitations.stories.tsx
 create mode 100644 frontend/editor/src/portal/views/Integrations.stories.tsx
 create mode 100644 frontend/editor/src/portal/views/PipelineBuilder.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/auth/ui/AuthShell.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/auth/ui/ErrorMessage.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/auth/ui/SpringLoginForm.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/auth/ui/SupabaseLoginForm.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/agents/StirlingLogoAnimated.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/agents/StirlingLogoOutline.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/policies/PolicyPiiField.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/policies/PolicyRedactConfig.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/policies/PolicyWatermarkConfig.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/ChangeUserPasswordModal.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/DividerWithText.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/ManageBillingButton.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/UpdateSeatsModal.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/EnterpriseRequiredBanner.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/GeneralWithLoginLanding.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/OverviewHeader.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AccountSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiDocumentsSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiGeneralSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiLimitsSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiModelsSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/AdminFolderAccessSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/ApiKeys.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/LoginAgreementEditor.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/RefreshModal.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditChartsSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditClearDataSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditEventsTable.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditStatsCards.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditSystemStatus.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/plan/FeatureComparisonTable.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsChart.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsTable.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/stripeCheckout/StripeCheckout.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/stripeCheckout/components/PriceDisplay.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/stripeCheckout/components/PricingBadge.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/ErrorStage.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PaymentStage.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.stories.tsx
 create mode 100644 frontend/editor/src/proprietary/components/workflow/ParticipantView.stories.tsx
 create mode 100644 frontend/vitest.config.ts

diff --git a/.taskfiles/frontend.yml b/.taskfiles/frontend.yml
index 7ac5300a15..3e608855f3 100644
--- a/.taskfiles/frontend.yml
+++ b/.taskfiles/frontend.yml
@@ -194,6 +194,22 @@ tasks:
     cmds:
       - npx storybook build {{.CLI_ARGS}}
 
+  storybook:browser:
+    internal: true
+    desc: "Install the Chromium build the story scan runs in"
+    run: once
+    deps: [install]
+    cmds:
+      - npx playwright install chromium
+
+  storybook:test:
+    desc: "Scan every story in real Chromium — each must mount without throwing"
+    deps: [install, storybook:browser]
+    cmds:
+      # Runs each story as a browser test. Pass a filter through, e.g.
+      #   task frontend:storybook:test -- Button
+      - npx vitest run --config .storybook/vitest.config.ts {{.CLI_ARGS}}
+
   # ============================================================
   # Code quality
   # ============================================================
diff --git a/frontend/.storybook/main.ts b/frontend/.storybook/main.ts
index be281b9ae3..c0436a3a82 100644
--- a/frontend/.storybook/main.ts
+++ b/frontend/.storybook/main.ts
@@ -15,7 +15,11 @@ const config: StorybookConfig = {
     "../editor/src/portal/**/*.mdx",
     "../editor/src/**/*.stories.@(ts|tsx)",
   ],
-  addons: ["@storybook/addon-themes", "@storybook/addon-a11y"],
+  addons: [
+    "@storybook/addon-themes",
+    "@storybook/addon-a11y",
+    "@storybook/addon-vitest",
+  ],
   framework: {
     name: "@storybook/react-vite",
     options: {},
diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index 339fe4f842..cd2e53153d 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -13,6 +13,7 @@ import { withThemeByDataAttribute } from "@storybook/addon-themes";
 // classic runtime needs it present even though it's not named in the JSX.
 void React;
 
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { TierProvider, type Tier } from "@portal/contexts/TierContext";
 import { LinkProvider, type LinkState } from "@portal/contexts/LinkContext";
 import { ThemeProvider, useTheme } from "@portal/contexts/ThemeContext";
@@ -86,6 +87,14 @@ if (!i18next.isInitialized) {
 // Start MSW once. Storybook runs in a browser so this uses the service worker.
 initialize({ onUnhandledRequest: "bypass" }, handlers);
 
+// PortalApp wraps the app in a QueryClientProvider, so any component reaching a
+// shared query hook throws "No QueryClient set" without one here. `retry: false`
+// matches the portal test providers: a story showing an error state should show
+// it immediately rather than sitting through backoff retries.
+const queryClient = new QueryClient({
+  defaultOptions: { queries: { retry: false } },
+});
+
 // Storybook-only: stub a SaaS session so apiClient.saas reads (invoices, payment
 // method, wallet) clear the session check and reach the MSW handlers instead of
 // failing with "No SaaS session". VITE_SUPABASE_URL/KEY are defined empty (see
@@ -194,24 +203,26 @@ const withProviders: Decorator = (Story, context) => {
   const colorScheme = context.globals.theme === "dark" ? "dark" : "light";
   return (
     <MemoryRouter initialEntries={["/"]}>
-      <ThemeProvider>
-        <SchemeSetup scheme={colorScheme} />
-        <ThemeBridge theme={colorScheme}>
-          <SuiProvider colorScheme={colorScheme}>
-            {/* LinkProvider must wrap TierProvider: TierContext derives its tier
-                from useLink() (matches App.tsx's nesting). */}
-            <LinkProvider key={linkState} initialState={linkState}>
-              <TierKey tier={tier}>
-                <UIProvider>
-                  <Suspense fallback={null}>
-                    <Story />
-                  </Suspense>
-                </UIProvider>
-              </TierKey>
-            </LinkProvider>
-          </SuiProvider>
-        </ThemeBridge>
-      </ThemeProvider>
+      <QueryClientProvider client={queryClient}>
+        <ThemeProvider>
+          <SchemeSetup scheme={colorScheme} />
+          <ThemeBridge theme={colorScheme}>
+            <SuiProvider colorScheme={colorScheme}>
+              {/* LinkProvider must wrap TierProvider: TierContext derives its tier
+                  from useLink() (matches App.tsx's nesting). */}
+              <LinkProvider key={linkState} initialState={linkState}>
+                <TierKey tier={tier}>
+                  <UIProvider>
+                    <Suspense fallback={null}>
+                      <Story />
+                    </Suspense>
+                  </UIProvider>
+                </TierKey>
+              </LinkProvider>
+            </SuiProvider>
+          </ThemeBridge>
+        </ThemeProvider>
+      </QueryClientProvider>
     </MemoryRouter>
   );
 };
diff --git a/frontend/.storybook/vitest.config.ts b/frontend/.storybook/vitest.config.ts
new file mode 100644
index 0000000000..9535f63a47
--- /dev/null
+++ b/frontend/.storybook/vitest.config.ts
@@ -0,0 +1,62 @@
+import { resolve } from "node:path";
+import { defineConfig } from "vitest/config";
+import { storybookTest } from "@storybook/addon-vitest/vitest-plugin";
+
+/**
+ * Dedicated Vitest config that turns every story into a browser test: it mounts
+ * the story in real Chromium as a render/smoke check (a story must mount without
+ * throwing). a11y is currently report-only (preview's `a11y.test: "todo"`) and is
+ * not yet enforced here — flipping it to pass/fail is a follow-up. Kept separate
+ * from editor/vitest.config.ts (the jsdom unit tests) so the two suites don't collide.
+ *
+ * The storybook test must live in a `test.projects[]` entry (not a flat config)
+ * so Vitest wires up the browser test runner correctly.
+ *
+ * Run with: npx vitest run --config .storybook/vitest.config.ts
+ */
+export default defineConfig({
+  optimizeDeps: {
+    // Pre-scan every story + the preview so Vite discovers the story set's large
+    // dep surface (embedpdf plugins, @mui icons, …) in one pass up front.
+    entries: ["editor/src/**/*.stories.@(ts|tsx)", ".storybook/preview.tsx"],
+    // `entries` alone does not catch deps reached only through a transformed
+    // JSX runtime import, so Vite optimizes them lazily mid-run and emits
+    // "optimized dependencies changed, reloading". That reload tears down the
+    // browser worker and whichever stories were mid-load fail with a bogus
+    // "Failed to fetch dynamically imported module" — a result that looks real.
+    // Naming them here keeps a run deterministic.
+    include: [
+      "react",
+      "react/jsx-runtime",
+      "react/jsx-dev-runtime",
+      "react-dom",
+      "react-dom/client",
+    ],
+  },
+  test: {
+    projects: [
+      {
+        extends: true,
+        // Reads .storybook/main.ts (stories glob + viteFinal aliases) so every
+        // discovered story becomes a test with the app's real module resolution.
+        plugins: [storybookTest({ configDir: resolve(__dirname) })],
+        test: {
+          name: "storybook",
+          // Mounting a story takes well over Vitest's 5s default on the heavier
+          // screens, and a story that trips the timeout is reported as a failure
+          // with no message — which reads like a crash. Give it room; a
+          // genuinely hung story still fails, just later.
+          testTimeout: 60_000,
+          hookTimeout: 60_000,
+          browser: {
+            enabled: true,
+            headless: true,
+            provider: "playwright",
+            instances: [{ browser: "chromium" }],
+          },
+          setupFiles: [resolve(__dirname, "vitest.setup.ts")],
+        },
+      },
+    ],
+  },
+});
diff --git a/frontend/.storybook/vitest.setup.ts b/frontend/.storybook/vitest.setup.ts
new file mode 100644
index 0000000000..6265c9bf54
--- /dev/null
+++ b/frontend/.storybook/vitest.setup.ts
@@ -0,0 +1,10 @@
+import { beforeAll } from "vitest";
+import { setProjectAnnotations } from "@storybook/react-vite";
+// eslint-disable-next-line no-restricted-imports -- Storybook-only: the sibling preview config has no @-alias.
+import * as projectAnnotations from "./preview";
+
+// Apply the same decorators/parameters/globals the Storybook UI uses (providers,
+// i18n, theme) so stories run under Vitest render identically to the browser.
+const project = setProjectAnnotations([projectAnnotations]);
+
+beforeAll(project.beforeAll);
diff --git a/frontend/editor/src/core/components/AppLayout.stories.tsx b/frontend/editor/src/core/components/AppLayout.stories.tsx
new file mode 100644
index 0000000000..4d7e6780cf
--- /dev/null
+++ b/frontend/editor/src/core/components/AppLayout.stories.tsx
@@ -0,0 +1,75 @@
+import { useEffect } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { AppLayout } from "@app/components/AppLayout";
+import { BannerProvider, useBanner } from "@app/contexts/BannerContext";
+import { NavigationProvider } from "@app/contexts/NavigationContext";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { InfoBanner } from "@app/components/shared/InfoBanner";
+
+const meta = {
+  title: "Components/AppLayout",
+  component: AppLayout,
+  parameters: { layout: "fullscreen" },
+  // AppLayout reads the active banner from BannerContext and renders
+  // NavigationWarningModal + LoginAgreementModal, which need the navigation
+  // guard (backed by the tool registry) mounted above them.
+  decorators: [
+    (Story) => (
+      <ToolRegistryProvider>
+        <NavigationProvider>
+          <BannerProvider>
+            <Story />
+          </BannerProvider>
+        </NavigationProvider>
+      </ToolRegistryProvider>
+    ),
+  ],
+} satisfies Meta<typeof AppLayout>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const sampleContent = (
+  <div style={{ padding: 24 }}>
+    <h1>Workbench</h1>
+    <p>Tool panels and file previews render in this area.</p>
+  </div>
+);
+
+export const Default: Story = {
+  args: {
+    children: sampleContent,
+  },
+};
+
+// Calls BannerContext's setBanner on mount so the story can exercise
+// AppLayout's height-adjustment behaviour (the child area shrinks to make
+// room for the banner) without adding a banner prop to AppLayout itself.
+function BannerSetter() {
+  const { setBanner } = useBanner();
+  useEffect(() => {
+    setBanner(
+      <InfoBanner
+        icon="info-rounded"
+        title="Heads up"
+        message="This workspace is running in offline mode."
+      />,
+    );
+    return () => setBanner(null);
+  }, [setBanner]);
+  return null;
+}
+
+export const WithBanner: Story = {
+  args: {
+    children: sampleContent,
+  },
+  decorators: [
+    (Story) => (
+      <>
+        <BannerSetter />
+        <Story />
+      </>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/StorageStatsCard.stories.tsx b/frontend/editor/src/core/components/StorageStatsCard.stories.tsx
new file mode 100644
index 0000000000..d8c61ec3b3
--- /dev/null
+++ b/frontend/editor/src/core/components/StorageStatsCard.stories.tsx
@@ -0,0 +1,49 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import StorageStatsCard from "@app/components/StorageStatsCard";
+import { StorageStats } from "@app/services/fileStorage";
+
+const storageStats: StorageStats = {
+  used: 128 * 1024 * 1024,
+  available: 512 * 1024 * 1024,
+  fileCount: 12,
+  quota: 512 * 1024 * 1024,
+};
+
+const meta = {
+  title: "Components/StorageStatsCard",
+  component: StorageStatsCard,
+  parameters: { layout: "padded" },
+  args: {
+    storageStats,
+    filesCount: 12,
+    onClearAll: () => {},
+    onReloadFiles: () => {},
+  },
+} satisfies Meta<typeof StorageStatsCard>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const NearingQuota: Story = {
+  args: {
+    storageStats: {
+      ...storageStats,
+      used: 460 * 1024 * 1024,
+      fileCount: 48,
+    },
+    filesCount: 48,
+  },
+};
+
+export const NoQuota: Story = {
+  args: {
+    storageStats: {
+      used: 32 * 1024 * 1024,
+      available: 0,
+      fileCount: 3,
+    },
+    filesCount: 3,
+  },
+};
diff --git a/frontend/editor/src/core/components/annotation/shared/BaseAnnotationTool.stories.tsx b/frontend/editor/src/core/components/annotation/shared/BaseAnnotationTool.stories.tsx
new file mode 100644
index 0000000000..9b896a62d4
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/shared/BaseAnnotationTool.stories.tsx
@@ -0,0 +1,68 @@
+import type { ReactNode } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { BaseAnnotationTool } from "@app/components/annotation/shared/BaseAnnotationTool";
+import { PDFAnnotationProvider } from "@app/components/annotation/providers/PDFAnnotationProvider";
+import { SignatureProvider } from "@app/contexts/SignatureContext";
+
+// BaseAnnotationTool reads usePDFAnnotation()/useSignature() for undo/redo and
+// placement wiring — stub both providers so the story can mount standalone.
+const StoryProviders = ({ children }: { children: ReactNode }) => (
+  <SignatureProvider>
+    <PDFAnnotationProvider
+      activateDrawMode={() => {}}
+      deactivateDrawMode={() => {}}
+      activateSignaturePlacementMode={() => {}}
+      activateDeleteMode={() => {}}
+      updateDrawSettings={() => {}}
+      undo={() => {}}
+      redo={() => {}}
+      storeImageData={() => {}}
+      getImageData={() => undefined}
+      isPlacementMode={false}
+      signatureConfig={null}
+      setSignatureConfig={() => {}}
+    >
+      {children}
+    </PDFAnnotationProvider>
+  </SignatureProvider>
+);
+
+// BaseAnnotationTool clones its child with tool-specific props (selectedColor,
+// signatureData, onSignatureDataChange, onColorSwatchClick, disabled) — a real
+// tool component absorbs these; a bare DOM element would just log prop warnings.
+const ToolContent = (_props: Record<string, unknown>) => (
+  <div>Tool content</div>
+);
+
+const meta = {
+  title: "Annotation/BaseAnnotationTool",
+  component: BaseAnnotationTool,
+  decorators: [
+    (Story) => (
+      <StoryProviders>
+        <Story />
+      </StoryProviders>
+    ),
+  ],
+} satisfies Meta<typeof BaseAnnotationTool>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    config: {
+      enableImageUpload: true,
+      showPlaceButton: true,
+      placeButtonText: "Place Image",
+    },
+    children: <ToolContent />,
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    ...Default.args,
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/annotation/shared/ColorControl.stories.tsx b/frontend/editor/src/core/components/annotation/shared/ColorControl.stories.tsx
new file mode 100644
index 0000000000..fff7ffc224
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/shared/ColorControl.stories.tsx
@@ -0,0 +1,35 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ColorControl } from "@app/components/annotation/shared/ColorControl";
+
+const meta: Meta<typeof ColorControl> = {
+  title: "Annotation/ColorControl",
+  component: ColorControl,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof ColorControl>;
+
+function ColorControlDemo({
+  initialColor = "#ff0000",
+  disabled,
+}: {
+  initialColor?: string;
+  disabled?: boolean;
+}) {
+  const [color, setColor] = useState(initialColor);
+  return (
+    <ColorControl
+      label="Colour"
+      value={color}
+      onChange={setColor}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <ColorControlDemo /> };
+
+export const Disabled: Story = {
+  render: () => <ColorControlDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/annotation/shared/ColorPicker.stories.tsx b/frontend/editor/src/core/components/annotation/shared/ColorPicker.stories.tsx
new file mode 100644
index 0000000000..1ffb5d76d2
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/shared/ColorPicker.stories.tsx
@@ -0,0 +1,45 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ColorPicker } from "@app/components/annotation/shared/ColorPicker";
+
+const meta = {
+  title: "Annotation/Shared/ColorPicker",
+  component: ColorPicker,
+  parameters: { layout: "fullscreen" },
+  args: {
+    isOpen: true,
+    onClose: () => {},
+    selectedColor: "#cc0000",
+    onColorChange: () => {},
+  },
+} satisfies Meta<typeof ColorPicker>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function ColorPickerDemo(
+  props: Partial<React.ComponentProps<typeof ColorPicker>>,
+) {
+  const [color, setColor] = useState(props.selectedColor ?? "#cc0000");
+  const [opacity, setOpacity] = useState(props.opacity ?? 100);
+  return (
+    <ColorPicker
+      isOpen
+      onClose={() => {}}
+      {...props}
+      selectedColor={color}
+      onColorChange={setColor}
+      opacity={opacity}
+      onOpacityChange={setOpacity}
+    />
+  );
+}
+
+/** The base modal: swatches + hex picker, no opacity slider. */
+export const Default: Story = {
+  render: () => <ColorPickerDemo />,
+};
+
+/** With the opacity slider shown, for tools that need translucent fills (e.g. highlight, watermark). */
+export const WithOpacity: Story = {
+  render: () => <ColorPickerDemo showOpacity />,
+};
diff --git a/frontend/editor/src/core/components/annotation/shared/DrawingCanvas.stories.tsx b/frontend/editor/src/core/components/annotation/shared/DrawingCanvas.stories.tsx
new file mode 100644
index 0000000000..ebdc7282ce
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/shared/DrawingCanvas.stories.tsx
@@ -0,0 +1,52 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { DrawingCanvas } from "@app/components/annotation/shared/DrawingCanvas";
+
+const meta = {
+  title: "Annotation/DrawingCanvas",
+  component: DrawingCanvas,
+  parameters: { layout: "padded" },
+  args: {
+    selectedColor: "#000000",
+    penSize: 3,
+    penSizeInput: "3",
+    onColorSwatchClick: () => {},
+    onPenSizeChange: () => {},
+    onPenSizeInputChange: () => {},
+    onSignatureDataChange: () => {},
+  },
+} satisfies Meta<typeof DrawingCanvas>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+function DrawingCanvasDemo(
+  props: Partial<React.ComponentProps<typeof DrawingCanvas>>,
+) {
+  const [penSize, setPenSize] = useState(3);
+  const [penSizeInput, setPenSizeInput] = useState("3");
+
+  return (
+    <DrawingCanvas
+      selectedColor="#000000"
+      penSize={penSize}
+      penSizeInput={penSizeInput}
+      onColorSwatchClick={() => {}}
+      onPenSizeChange={(size) => {
+        setPenSize(size);
+        setPenSizeInput(String(size));
+      }}
+      onPenSizeInputChange={setPenSizeInput}
+      onSignatureDataChange={() => {}}
+      {...props}
+    />
+  );
+}
+
+/** Empty canvas preview with the drawing modal closed. */
+export const Default: Story = { render: () => <DrawingCanvasDemo /> };
+
+/** Preview disabled — clicking the canvas should not open the modal. */
+export const Disabled: Story = {
+  render: () => <DrawingCanvasDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/annotation/shared/DrawingControls.stories.tsx b/frontend/editor/src/core/components/annotation/shared/DrawingControls.stories.tsx
new file mode 100644
index 0000000000..b847f9046e
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/shared/DrawingControls.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { DrawingControls } from "@app/components/annotation/shared/DrawingControls";
+
+const meta: Meta<typeof DrawingControls> = {
+  title: "Annotation/DrawingControls",
+  component: DrawingControls,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof DrawingControls>;
+
+export const Default: Story = {
+  args: {
+    onUndo: () => {},
+    onRedo: () => {},
+    onPlaceSignature: () => {},
+    hasSignatureData: true,
+    canUndo: true,
+    canRedo: true,
+  },
+};
+
+export const NoHistory: Story = {
+  args: {
+    onUndo: () => {},
+    onRedo: () => {},
+    onPlaceSignature: () => {},
+    hasSignatureData: false,
+    canUndo: false,
+    canRedo: false,
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    ...Default.args,
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/annotation/shared/ImageUploader.stories.tsx b/frontend/editor/src/core/components/annotation/shared/ImageUploader.stories.tsx
new file mode 100644
index 0000000000..f8500795ba
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/shared/ImageUploader.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ImageUploader } from "@app/components/annotation/shared/ImageUploader";
+
+const meta = {
+  title: "Annotation/Shared/ImageUploader",
+  component: ImageUploader,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ImageUploader>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    onImageChange: () => {},
+  },
+};
+
+export const WithLabelAndHint: Story = {
+  args: {
+    onImageChange: () => {},
+    label: "Signature image",
+    hint: "PNG, JPG, or SVG - transparent backgrounds work best",
+  },
+};
+
+export const WithBackgroundRemoval: Story = {
+  args: {
+    onImageChange: () => {},
+    allowBackgroundRemoval: true,
+    onProcessedImageData: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    onImageChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/annotation/shared/OpacityControl.stories.tsx b/frontend/editor/src/core/components/annotation/shared/OpacityControl.stories.tsx
new file mode 100644
index 0000000000..79bb3fddd8
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/shared/OpacityControl.stories.tsx
@@ -0,0 +1,23 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { OpacityControl } from "@app/components/annotation/shared/OpacityControl";
+
+const meta: Meta<typeof OpacityControl> = {
+  title: "Annotation/OpacityControl",
+  component: OpacityControl,
+};
+export default meta;
+type Story = StoryObj<typeof OpacityControl>;
+
+function OpacityControlDemo({ disabled }: { disabled?: boolean }) {
+  const [value, setValue] = useState(80);
+  return (
+    <OpacityControl value={value} onChange={setValue} disabled={disabled} />
+  );
+}
+
+export const Default: Story = { render: () => <OpacityControlDemo /> };
+
+export const Disabled: Story = {
+  render: () => <OpacityControlDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/annotation/shared/PropertiesPopover.stories.tsx b/frontend/editor/src/core/components/annotation/shared/PropertiesPopover.stories.tsx
new file mode 100644
index 0000000000..b8b37dd980
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/shared/PropertiesPopover.stories.tsx
@@ -0,0 +1,35 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PropertiesPopover } from "@app/components/annotation/shared/PropertiesPopover";
+
+const meta = {
+  title: "Annotation/Shared/PropertiesPopover",
+  component: PropertiesPopover,
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof PropertiesPopover>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Text: Story = {
+  args: {
+    annotationType: "text",
+    annotation: undefined,
+    onUpdate: () => {},
+  },
+};
+
+export const Shape: Story = {
+  args: {
+    annotationType: "shape",
+    annotation: undefined,
+    onUpdate: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    annotationType: "text",
+    annotation: undefined,
+    onUpdate: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.stories.tsx b/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.stories.tsx
new file mode 100644
index 0000000000..4390f1b62d
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/shared/TextInputWithFont.stories.tsx
@@ -0,0 +1,78 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { TextInputWithFont } from "@app/components/annotation/shared/TextInputWithFont";
+
+const meta = {
+  title: "Annotation/Shared/TextInputWithFont",
+  component: TextInputWithFont,
+  parameters: { layout: "padded" },
+  args: {
+    text: "Confidential",
+    onTextChange: () => {},
+    fontSize: 24,
+    onFontSizeChange: () => {},
+    fontFamily: "Helvetica",
+    onFontFamilyChange: () => {},
+    label: "Text",
+    placeholder: "Enter text",
+    fontLabel: "Font",
+    fontSizeLabel: "Size",
+    fontSizePlaceholder: "24",
+  },
+} satisfies Meta<typeof TextInputWithFont>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function TextInputWithFontDemo(
+  props: Partial<React.ComponentProps<typeof TextInputWithFont>>,
+) {
+  const [text, setText] = useState(props.text ?? "Confidential");
+  const [fontSize, setFontSize] = useState(props.fontSize ?? 24);
+  const [fontFamily, setFontFamily] = useState(props.fontFamily ?? "Helvetica");
+  const [textColor, setTextColor] = useState(props.textColor ?? "#000000");
+  const [textAlign, setTextAlign] = useState<"left" | "center" | "right">(
+    props.textAlign ?? "left",
+  );
+
+  return (
+    <TextInputWithFont
+      label="Text"
+      placeholder="Enter text"
+      fontLabel="Font"
+      fontSizeLabel="Size"
+      fontSizePlaceholder="24"
+      colorLabel="Colour"
+      {...props}
+      text={text}
+      onTextChange={setText}
+      fontSize={fontSize}
+      onFontSizeChange={setFontSize}
+      fontFamily={fontFamily}
+      onFontFamilyChange={setFontFamily}
+      textColor={textColor}
+      onTextColorChange={setTextColor}
+      textAlign={textAlign}
+      onTextAlignChange={setTextAlign}
+    />
+  );
+}
+
+/** Full control set: text, font, size, colour and alignment. */
+export const Default: Story = {
+  render: () => <TextInputWithFontDemo />,
+};
+
+/** Without the colour picker or alignment control, for tools that don't need them. */
+export const WithoutColorOrAlign: Story = {
+  render: () => (
+    <TextInputWithFontDemo
+      onTextColorChange={undefined}
+      onTextAlignChange={undefined}
+    />
+  ),
+};
+
+/** All fields disabled. */
+export const Disabled: Story = {
+  render: () => <TextInputWithFontDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/annotation/shared/WidthControl.stories.tsx b/frontend/editor/src/core/components/annotation/shared/WidthControl.stories.tsx
new file mode 100644
index 0000000000..46cc4980ad
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/shared/WidthControl.stories.tsx
@@ -0,0 +1,35 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { WidthControl } from "@app/components/annotation/shared/WidthControl";
+
+const meta: Meta<typeof WidthControl> = {
+  title: "Annotation/WidthControl",
+  component: WidthControl,
+};
+export default meta;
+type Story = StoryObj<typeof WidthControl>;
+
+function WidthControlDemo({
+  min = 1,
+  max = 12,
+  disabled,
+}: {
+  min?: number;
+  max?: number;
+  disabled?: boolean;
+}) {
+  const [value, setValue] = useState(Math.round((min + max) / 2));
+  return (
+    <WidthControl
+      value={value}
+      onChange={setValue}
+      min={min}
+      max={max}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <WidthControlDemo /> };
+
+export const Disabled: Story = { render: () => <WidthControlDemo disabled /> };
diff --git a/frontend/editor/src/core/components/annotation/tools/DrawingTool.stories.tsx b/frontend/editor/src/core/components/annotation/tools/DrawingTool.stories.tsx
new file mode 100644
index 0000000000..002d07663f
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/tools/DrawingTool.stories.tsx
@@ -0,0 +1,50 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { DrawingTool } from "@app/components/annotation/tools/DrawingTool";
+import { SignatureProvider } from "@app/contexts/SignatureContext";
+import { PDFAnnotationProvider } from "@app/components/annotation/providers/PDFAnnotationProvider";
+
+// DrawingTool renders BaseAnnotationTool, which reads both SignatureContext and
+// PDFAnnotationContext — neither is mounted by the shared preview, so stub both
+// here with no-op handlers.
+const meta = {
+  title: "Annotation/DrawingTool",
+  component: DrawingTool,
+  decorators: [
+    (Story) => (
+      <SignatureProvider>
+        <PDFAnnotationProvider
+          activateDrawMode={() => {}}
+          deactivateDrawMode={() => {}}
+          activateSignaturePlacementMode={() => {}}
+          activateDeleteMode={() => {}}
+          updateDrawSettings={() => {}}
+          undo={() => {}}
+          redo={() => {}}
+          storeImageData={() => {}}
+          getImageData={() => undefined}
+          isPlacementMode={false}
+          signatureConfig={null}
+          setSignatureConfig={() => {}}
+        >
+          <Story />
+        </PDFAnnotationProvider>
+      </SignatureProvider>
+    ),
+  ],
+} satisfies Meta<typeof DrawingTool>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    onDrawingChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    onDrawingChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/annotation/tools/ImageTool.stories.tsx b/frontend/editor/src/core/components/annotation/tools/ImageTool.stories.tsx
new file mode 100644
index 0000000000..ee0ae3ca24
--- /dev/null
+++ b/frontend/editor/src/core/components/annotation/tools/ImageTool.stories.tsx
@@ -0,0 +1,50 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ImageTool } from "@app/components/annotation/tools/ImageTool";
+import { SignatureProvider } from "@app/contexts/SignatureContext";
+import { PDFAnnotationProvider } from "@app/components/annotation/providers/PDFAnnotationProvider";
+
+// ImageTool renders BaseAnnotationTool, which reads both SignatureContext and
+// PDFAnnotationContext — neither is mounted by the shared preview, so stub both
+// here with no-op handlers.
+const meta = {
+  title: "Annotation/ImageTool",
+  component: ImageTool,
+  decorators: [
+    (Story) => (
+      <SignatureProvider>
+        <PDFAnnotationProvider
+          activateDrawMode={() => {}}
+          deactivateDrawMode={() => {}}
+          activateSignaturePlacementMode={() => {}}
+          activateDeleteMode={() => {}}
+          updateDrawSettings={() => {}}
+          undo={() => {}}
+          redo={() => {}}
+          storeImageData={() => {}}
+          getImageData={() => undefined}
+          isPlacementMode={false}
+          signatureConfig={null}
+          setSignatureConfig={() => {}}
+        >
+          <Story />
+        </PDFAnnotationProvider>
+      </SignatureProvider>
+    ),
+  ],
+} satisfies Meta<typeof ImageTool>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    onImageChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    onImageChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/fileEditor/FileEditorFileName.stories.tsx b/frontend/editor/src/core/components/fileEditor/FileEditorFileName.stories.tsx
new file mode 100644
index 0000000000..55645e9a0b
--- /dev/null
+++ b/frontend/editor/src/core/components/fileEditor/FileEditorFileName.stories.tsx
@@ -0,0 +1,40 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FileEditorFileName from "@app/components/fileEditor/FileEditorFileName";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const buildFileStub = (
+  overrides: Partial<StirlingFileStub> = {},
+): StirlingFileStub => ({
+  id: "file-1" as FileId,
+  name: "report.pdf",
+  type: "application/pdf",
+  size: 1024,
+  lastModified: 0,
+  isLeaf: true,
+  originalFileId: "file-1",
+  versionNumber: 1,
+  ...overrides,
+});
+
+const meta = {
+  title: "FileEditor/FileEditorFileName",
+  component: FileEditorFileName,
+} satisfies Meta<typeof FileEditorFileName>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    file: buildFileStub(),
+  },
+};
+
+export const LongFileName: Story = {
+  args: {
+    file: buildFileStub({
+      name: "annual-financial-report-quarter-four-2026-final-version.pdf",
+    }),
+    maxLength: 30,
+  },
+};
diff --git a/frontend/editor/src/core/components/fileManager/CompactFileDetails.stories.tsx b/frontend/editor/src/core/components/fileManager/CompactFileDetails.stories.tsx
new file mode 100644
index 0000000000..760b4b7781
--- /dev/null
+++ b/frontend/editor/src/core/components/fileManager/CompactFileDetails.stories.tsx
@@ -0,0 +1,68 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CompactFileDetails from "@app/components/fileManager/CompactFileDetails";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const buildFileStub = (
+  overrides: Partial<StirlingFileStub> = {},
+): StirlingFileStub => ({
+  id: "file-1" as FileId,
+  name: "report.pdf",
+  type: "application/pdf",
+  size: 1024 * 512,
+  lastModified: 0,
+  isLeaf: true,
+  originalFileId: "file-1",
+  versionNumber: 1,
+  ...overrides,
+});
+
+const meta = {
+  title: "FileManager/CompactFileDetails",
+  component: CompactFileDetails,
+  args: {
+    onPrevious: () => {},
+    onNext: () => {},
+    onOpenFiles: () => {},
+  },
+} satisfies Meta<typeof CompactFileDetails>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    currentFile: buildFileStub(),
+    thumbnail: null,
+    selectedFiles: [buildFileStub()],
+    currentFileIndex: 0,
+    numberOfFiles: 1,
+    isAnimating: false,
+  },
+};
+
+export const MultipleFiles: Story = {
+  args: {
+    currentFile: buildFileStub({ name: "invoice-final.pdf", versionNumber: 2 }),
+    thumbnail: null,
+    selectedFiles: [
+      buildFileStub({ id: "file-1" as FileId, name: "invoice-final.pdf" }),
+      buildFileStub({ id: "file-2" as FileId, name: "receipt.pdf" }),
+      buildFileStub({ id: "file-3" as FileId, name: "statement.pdf" }),
+    ],
+    currentFileIndex: 1,
+    numberOfFiles: 3,
+    isAnimating: false,
+  },
+};
+
+export const NoFileLoaded: Story = {
+  args: {
+    currentFile: null,
+    thumbnail: null,
+    selectedFiles: [],
+    currentFileIndex: 0,
+    numberOfFiles: 0,
+    isAnimating: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/fileManager/DragOverlay.stories.tsx b/frontend/editor/src/core/components/fileManager/DragOverlay.stories.tsx
new file mode 100644
index 0000000000..a047cd9e94
--- /dev/null
+++ b/frontend/editor/src/core/components/fileManager/DragOverlay.stories.tsx
@@ -0,0 +1,30 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import DragOverlay from "@app/components/fileManager/DragOverlay";
+
+const meta = {
+  title: "FileManager/DragOverlay",
+  component: DragOverlay,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof DragOverlay>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    isVisible: true,
+  },
+  decorators: [
+    (Story) => (
+      <div style={{ position: "relative", height: "20rem" }}>
+        <Story />
+      </div>
+    ),
+  ],
+};
+
+export const Hidden: Story = {
+  args: {
+    isVisible: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/fileManager/FileDetails.stories.tsx b/frontend/editor/src/core/components/fileManager/FileDetails.stories.tsx
new file mode 100644
index 0000000000..38ba423deb
--- /dev/null
+++ b/frontend/editor/src/core/components/fileManager/FileDetails.stories.tsx
@@ -0,0 +1,73 @@
+import type { ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FileDetails from "@app/components/fileManager/FileDetails";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import { FileManagerProvider } from "@app/contexts/FileManagerContext";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const mockFile: StirlingFileStub = {
+  id: "story-file-1" as FileId,
+  name: "quarterly-report.pdf",
+  type: "application/pdf",
+  size: 2_400_000,
+  lastModified: Date.now(),
+  isLeaf: true,
+  originalFileId: "story-file-1",
+  versionNumber: 1,
+  // Set so useIndexedDBThumbnail short-circuits on the stored thumbnail
+  // instead of trying to read file bytes out of IndexedDB.
+  thumbnailUrl:
+    "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='120' height='160'%3E%3Crect width='120' height='160' fill='%23e9ecef'/%3E%3C/svg%3E",
+};
+
+/**
+ * FileDetails reads from FileManagerContext, which itself needs FileContext
+ * (for useFileActions/useFileManagement) and IndexedDBContext (pulled in by
+ * FileContextProvider) further up the tree — neither is part of the shared
+ * preview decorators, so both are stood up here with static mock data.
+ */
+function withFileManager(activeFileIds: FileId[]) {
+  return (Story: () => ReactElement) => (
+    <FileContextProvider>
+      <FileManagerProvider
+        recentFiles={[mockFile]}
+        onRecentFilesSelected={() => {}}
+        onNewFilesSelect={() => {}}
+        onClose={() => {}}
+        isFileSupported={() => true}
+        isOpen
+        onFileRemove={() => {}}
+        modalHeight="600px"
+        refreshRecentFiles={async () => {}}
+        isLoading={false}
+        activeFileIds={activeFileIds}
+      >
+        <Story />
+      </FileManagerProvider>
+    </FileContextProvider>
+  );
+}
+
+const meta = {
+  title: "FileManager/FileDetails",
+  component: FileDetails,
+} satisfies Meta<typeof FileDetails>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  decorators: [withFileManager([mockFile.id])],
+};
+
+export const Empty: Story = {
+  decorators: [withFileManager([])],
+};
+
+export const Compact: Story = {
+  args: {
+    compact: true,
+  },
+  decorators: [withFileManager([mockFile.id])],
+};
diff --git a/frontend/editor/src/core/components/filesPage/DeleteFilesDialog.stories.tsx b/frontend/editor/src/core/components/filesPage/DeleteFilesDialog.stories.tsx
new file mode 100644
index 0000000000..db4a285fcc
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/DeleteFilesDialog.stories.tsx
@@ -0,0 +1,58 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { DeleteFilesDialog } from "@app/components/filesPage/DeleteFilesDialog";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const buildFileStub = (
+  overrides: Partial<StirlingFileStub> = {},
+): StirlingFileStub => ({
+  id: "file-1" as FileId,
+  name: "report.pdf",
+  type: "application/pdf",
+  size: 1024,
+  lastModified: 0,
+  isLeaf: true,
+  originalFileId: "file-1",
+  versionNumber: 1,
+  ...overrides,
+});
+
+const localFile = buildFileStub();
+const cloudOnlyFile = buildFileStub({
+  id: "server-1" as FileId,
+  name: "shared-invoice.pdf",
+  originalFileId: "server-1",
+  remoteStorageId: 42,
+  remoteOwnedByCurrentUser: true,
+});
+
+const meta = {
+  title: "FilesPage/DeleteFilesDialog",
+  component: DeleteFilesDialog,
+  args: {
+    opened: true,
+    onClose: () => {},
+    onConfirm: async () => {},
+  },
+} satisfies Meta<typeof DeleteFilesDialog>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    files: [localFile],
+  },
+};
+
+export const CloudOnly: Story = {
+  args: {
+    files: [cloudOnlyFile],
+  },
+};
+
+export const LocalAndCloudChoice: Story = {
+  args: {
+    files: [localFile, cloudOnlyFile],
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/DeleteFolderDialog.stories.tsx b/frontend/editor/src/core/components/filesPage/DeleteFolderDialog.stories.tsx
new file mode 100644
index 0000000000..891b72c58a
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/DeleteFolderDialog.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { DeleteFolderDialog } from "@app/components/filesPage/DeleteFolderDialog";
+import { createFolderId } from "@app/types/folder";
+
+const mockFolder = {
+  id: createFolderId(),
+  name: "Invoices",
+  parentFolderId: null,
+  createdAt: Date.now(),
+  updatedAt: Date.now(),
+};
+
+const meta = {
+  title: "FilesPage/DeleteFolderDialog",
+  component: DeleteFolderDialog,
+} satisfies Meta<typeof DeleteFolderDialog>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    opened: true,
+    folder: mockFolder,
+    fileCount: 0,
+    onClose: () => {},
+    onConfirm: () => {},
+  },
+};
+
+export const WithFiles: Story = {
+  args: {
+    opened: true,
+    folder: mockFolder,
+    fileCount: 12,
+    onClose: () => {},
+    onConfirm: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/FileDetailsPanel.stories.tsx b/frontend/editor/src/core/components/filesPage/FileDetailsPanel.stories.tsx
new file mode 100644
index 0000000000..883e2fa8ba
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/FileDetailsPanel.stories.tsx
@@ -0,0 +1,88 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { FileDetailsPanel } from "@app/components/filesPage/FileDetailsPanel";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+import type { FolderRecord } from "@app/types/folder";
+
+const buildFileStub = (
+  overrides: Partial<StirlingFileStub> = {},
+): StirlingFileStub => ({
+  id: "file-1" as FileId,
+  name: "report.pdf",
+  type: "application/pdf",
+  size: 245_760,
+  lastModified: Date.now(),
+  isLeaf: true,
+  originalFileId: "file-1" as FileId,
+  versionNumber: 1,
+  ...overrides,
+});
+
+const folder: FolderRecord = {
+  id: "folder-1" as FolderRecord["id"],
+  name: "Contracts",
+  parentFolderId: null,
+  createdAt: Date.now(),
+  updatedAt: Date.now(),
+};
+
+const meta = {
+  title: "FilesPage/FileDetailsPanel",
+  component: FileDetailsPanel,
+} satisfies Meta<typeof FileDetailsPanel>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const singleFile = buildFileStub();
+const fileMap = new Map<FileId, StirlingFileStub>([
+  [singleFile.id, singleFile],
+]);
+
+export const Default: Story = {
+  args: {
+    selectedFileIds: [singleFile.id],
+    fileMap,
+    currentFolder: null,
+    onClose: () => {},
+    onAddToWorkspace: () => {},
+    onMove: () => {},
+    onRemove: () => {},
+  },
+};
+
+export const InFolder: Story = {
+  args: {
+    ...Default.args,
+    currentFolder: folder,
+  },
+};
+
+export const MultiSelect: Story = {
+  args: (() => {
+    const fileA = buildFileStub({ id: "file-a" as FileId, name: "a.pdf" });
+    const fileB = buildFileStub({
+      id: "file-b" as FileId,
+      name: "b.pdf",
+      size: 102_400,
+    });
+    return {
+      selectedFileIds: [fileA.id, fileB.id],
+      fileMap: new Map<FileId, StirlingFileStub>([
+        [fileA.id, fileA],
+        [fileB.id, fileB],
+      ]),
+      currentFolder: null,
+      onClose: () => {},
+      onAddToWorkspace: () => {},
+      onMove: () => {},
+      onRemove: () => {},
+    };
+  })(),
+};
+
+export const LocalOnlyWithSaveToServer: Story = {
+  args: {
+    ...Default.args,
+    onSaveToServer: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/FileGrid.stories.tsx b/frontend/editor/src/core/components/filesPage/FileGrid.stories.tsx
new file mode 100644
index 0000000000..d1cb9f32b6
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/FileGrid.stories.tsx
@@ -0,0 +1,114 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { ReactElement } from "react";
+import {
+  FileGrid,
+  type FilesPageEntry,
+} from "@app/components/filesPage/FileGrid";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const buildFileStub = (
+  overrides: Partial<StirlingFileStub> = {},
+): StirlingFileStub => ({
+  id: "file-1" as FileId,
+  name: "report.pdf",
+  type: "application/pdf",
+  size: 1_240_000,
+  lastModified: Date.now(),
+  isLeaf: true,
+  originalFileId: "file-1",
+  versionNumber: 1,
+  // Set so useLazyThumbnail short-circuits on the stored thumbnail instead of
+  // trying to read file bytes out of IndexedDB.
+  thumbnailUrl:
+    "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='120' height='160'%3E%3Crect width='120' height='160' fill='%23e9ecef'/%3E%3C/svg%3E",
+  ...overrides,
+});
+
+const localFile = buildFileStub();
+const cloudFile = buildFileStub({
+  id: "file-2" as FileId,
+  name: "shared-invoice.pdf",
+  originalFileId: "file-2",
+  remoteStorageId: 42,
+  remoteOwnedByCurrentUser: true,
+});
+const spreadsheetFile = buildFileStub({
+  id: "file-3" as FileId,
+  name: "budget.xlsx",
+  type: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  originalFileId: "file-3",
+  thumbnailUrl: undefined,
+});
+
+const fileEntries: FilesPageEntry[] = [
+  { kind: "file", file: localFile },
+  { kind: "file", file: cloudFile },
+  { kind: "file", file: spreadsheetFile },
+];
+
+/**
+ * FileGrid renders file cards/rows via useLazyThumbnail, which reads
+ * IndexedDBContext + FileContext further up the tree - neither is part of
+ * the shared preview decorators, so FileContextProvider is stood up here.
+ * Folder entries are intentionally left out of these mocks: FolderCard /
+ * FolderRow call useFolders(), which needs a FolderProvider wired to
+ * IndexedDB/auth/app-config context this story doesn't stand up.
+ */
+function withFileContext(Story: () => ReactElement) {
+  return (
+    <FileContextProvider>
+      <Story />
+    </FileContextProvider>
+  );
+}
+
+const meta = {
+  title: "FilesPage/FileGrid",
+  component: FileGrid,
+  decorators: [withFileContext],
+  args: {
+    entries: fileEntries,
+    selectedFileIds: new Set<FileId>(),
+    viewMode: "grid",
+    onSelectFile: () => {},
+    onOpenFolder: () => {},
+    onOpenFile: () => {},
+    onMoveFiles: () => {},
+    onMoveFolder: () => {},
+    onRenameFolder: () => {},
+    onDeleteFolder: () => {},
+    onChangeFolderAppearance: () => {},
+    onRemoveFiles: () => {},
+    onPromptMoveFiles: () => {},
+  },
+} satisfies Meta<typeof FileGrid>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const ListMode: Story = {
+  args: {
+    viewMode: "list",
+  },
+};
+
+export const Loading: Story = {
+  args: {
+    entries: [],
+    loading: true,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    entries: [],
+    loading: false,
+    currentTab: "all",
+    onEmptyUpload: () => {},
+    onEmptyCreateFolder: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/FileOriginBadge.stories.tsx b/frontend/editor/src/core/components/filesPage/FileOriginBadge.stories.tsx
new file mode 100644
index 0000000000..2f3ede8857
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/FileOriginBadge.stories.tsx
@@ -0,0 +1,35 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { FileOriginBadge } from "@app/components/filesPage/FileOriginBadge";
+
+const meta: Meta<typeof FileOriginBadge> = {
+  title: "FilesPage/FileOriginBadge",
+  component: FileOriginBadge,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    origin: "local",
+  },
+};
+
+export const Cloud: Story = {
+  args: {
+    origin: "cloud",
+  },
+};
+
+export const SharedWithMe: Story = {
+  args: {
+    origin: "shared-with-me",
+  },
+};
+
+export const Compact: Story = {
+  args: {
+    origin: "cloud",
+    compact: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.stories.tsx b/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.stories.tsx
new file mode 100644
index 0000000000..4dc8cb3fd1
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/FolderAppearancePicker.stories.tsx
@@ -0,0 +1,46 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { fn } from "storybook/test";
+
+import { FolderAppearancePicker } from "@app/components/filesPage/FolderAppearancePicker";
+import { FolderRecord } from "@app/types/folder";
+
+const folder: FolderRecord = {
+  id: "folder-1" as FolderRecord["id"],
+  name: "Contracts",
+  parentFolderId: null,
+  color: "#3b82f6",
+  icon: "star",
+  createdAt: Date.now(),
+  updatedAt: Date.now(),
+};
+
+const meta = {
+  title: "FilesPage/FolderAppearancePicker",
+  component: FolderAppearancePicker,
+  parameters: { layout: "padded" },
+  args: {
+    folder,
+    onChange: fn(),
+  },
+} satisfies Meta<typeof FolderAppearancePicker>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const NoAppearanceSet: Story = {
+  args: {
+    folder: {
+      ...folder,
+      color: undefined,
+      icon: undefined,
+    },
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/FolderNameDialog.stories.tsx b/frontend/editor/src/core/components/filesPage/FolderNameDialog.stories.tsx
new file mode 100644
index 0000000000..e059cda62a
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/FolderNameDialog.stories.tsx
@@ -0,0 +1,31 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { FolderNameDialog } from "@app/components/filesPage/FolderNameDialog";
+
+const meta = {
+  title: "FilesPage/FolderNameDialog",
+  component: FolderNameDialog,
+} satisfies Meta<typeof FolderNameDialog>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    opened: true,
+    title: "New folder",
+    submitLabel: "Create",
+    onClose: () => {},
+    onSubmit: () => {},
+  },
+};
+
+export const Rename: Story = {
+  args: {
+    opened: true,
+    title: "Rename folder",
+    initialName: "Invoices 2026",
+    submitLabel: "Save",
+    onClose: () => {},
+    onSubmit: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/FolderThumbnail.stories.tsx b/frontend/editor/src/core/components/filesPage/FolderThumbnail.stories.tsx
new file mode 100644
index 0000000000..7208834119
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/FolderThumbnail.stories.tsx
@@ -0,0 +1,38 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { FolderThumbnail } from "@app/components/filesPage/FolderThumbnail";
+
+const meta = {
+  title: "FilesPage/FolderThumbnail",
+  component: FolderThumbnail,
+} satisfies Meta<typeof FolderThumbnail>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    color: "#6366f1",
+    fileCount: 12,
+  },
+};
+
+export const RowSize: Story = {
+  args: {
+    color: "#22c55e",
+    fileCount: 3,
+    size: "row",
+  },
+};
+
+export const WithIconGlyph: Story = {
+  args: {
+    color: "#f97316",
+    fileCount: 5,
+    iconGlyph: "📄",
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    size: "thumb",
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/FolderTreeSidebar.stories.tsx b/frontend/editor/src/core/components/filesPage/FolderTreeSidebar.stories.tsx
new file mode 100644
index 0000000000..e06bf42685
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/FolderTreeSidebar.stories.tsx
@@ -0,0 +1,51 @@
+import type React from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { FolderTreeSidebar } from "@app/components/filesPage/FolderTreeSidebar";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import { FolderProvider } from "@app/contexts/FolderContext";
+import { FilesPageProvider } from "@app/contexts/FilesPageContext";
+import { ROOT_FOLDER_ID } from "@app/types/folder";
+
+/**
+ * FolderTreeSidebar reads the folder tree and active tab from FolderContext /
+ * FilesPageContext, neither of which is part of the shared preview
+ * decorators. Both providers also pull in IndexedDBContext (via
+ * FileContextProvider) further up the tree, so all three are stood up here.
+ * No folders are seeded into IndexedDB, so the tree renders with just the
+ * pinned "All files" / "Local" rows - an accurate empty state.
+ */
+function withFolderContexts(Story: () => React.JSX.Element) {
+  return (
+    <FileContextProvider>
+      <FolderProvider>
+        <FilesPageProvider>
+          <Story />
+        </FilesPageProvider>
+      </FolderProvider>
+    </FileContextProvider>
+  );
+}
+
+const meta = {
+  title: "FilesPage/FolderTreeSidebar",
+  component: FolderTreeSidebar,
+  decorators: [withFolderContexts],
+  args: {
+    fileCounts: new Map([[ROOT_FOLDER_ID, 0]]),
+    onRequestNewFolder: () => {},
+    onRenameFolder: () => {},
+    onDeleteFolder: () => {},
+    onMoveFilesIntoFolder: async () => {},
+  },
+} satisfies Meta<typeof FolderTreeSidebar>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const WithFileCounts: Story = {
+  args: {
+    fileCounts: new Map([[ROOT_FOLDER_ID, 12]]),
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.stories.tsx b/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.stories.tsx
new file mode 100644
index 0000000000..d01a697f04
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/MoveToFolderDialog.stories.tsx
@@ -0,0 +1,86 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { MoveToFolderDialog } from "@app/components/filesPage/MoveToFolderDialog";
+import { createFolderId, FolderRecord } from "@app/types/folder";
+
+const workId = createFolderId();
+const invoicesId = createFolderId();
+const archivedId = createFolderId();
+
+const folders: FolderRecord[] = [
+  {
+    id: workId,
+    name: "Work",
+    parentFolderId: null,
+    color: "#3b82f6",
+    createdAt: Date.now(),
+    updatedAt: Date.now(),
+  },
+  {
+    id: invoicesId,
+    name: "Invoices",
+    parentFolderId: workId,
+    color: "#10b981",
+    createdAt: Date.now(),
+    updatedAt: Date.now(),
+  },
+  {
+    id: archivedId,
+    name: "Archived",
+    parentFolderId: null,
+    color: "#f59e0b",
+    createdAt: Date.now(),
+    updatedAt: Date.now(),
+  },
+];
+
+const meta = {
+  title: "FilesPage/MoveToFolderDialog",
+  component: MoveToFolderDialog,
+} satisfies Meta<typeof MoveToFolderDialog>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    opened: true,
+    onClose: () => {},
+    folders,
+    onConfirm: () => {},
+  },
+};
+
+export const WithDisabledDescendant: Story = {
+  args: {
+    opened: true,
+    onClose: () => {},
+    folders,
+    disabledFolderId: workId,
+    onConfirm: () => {},
+  },
+};
+
+export const WithCreateFolder: Story = {
+  args: {
+    opened: true,
+    onClose: () => {},
+    folders,
+    onConfirm: () => {},
+    onCreateFolder: async (name, parentFolderId) => ({
+      id: createFolderId(),
+      name,
+      parentFolderId,
+      createdAt: Date.now(),
+      updatedAt: Date.now(),
+    }),
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    opened: true,
+    onClose: () => {},
+    folders: [],
+    onConfirm: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/OpenInNewWindowMenuItem.stories.tsx b/frontend/editor/src/core/components/filesPage/OpenInNewWindowMenuItem.stories.tsx
new file mode 100644
index 0000000000..14ba0755b2
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/OpenInNewWindowMenuItem.stories.tsx
@@ -0,0 +1,29 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { OpenInNewWindowMenuItem } from "@app/components/filesPage/OpenInNewWindowMenuItem";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const mockFile: StirlingFileStub = {
+  id: "file-1" as FileId,
+  name: "document.pdf",
+  type: "application/pdf",
+  size: 12345,
+  lastModified: Date.now(),
+  isLeaf: true,
+  originalFileId: "file-1",
+  versionNumber: 1,
+};
+
+/** Core-flavor stub: renders nothing (desktop-only menu item). */
+const meta = {
+  title: "FilesPage/OpenInNewWindowMenuItem",
+  component: OpenInNewWindowMenuItem,
+} satisfies Meta<typeof OpenInNewWindowMenuItem>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    file: mockFile,
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/VersionHistoryModal.stories.tsx b/frontend/editor/src/core/components/filesPage/VersionHistoryModal.stories.tsx
new file mode 100644
index 0000000000..1d5ce95e13
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/VersionHistoryModal.stories.tsx
@@ -0,0 +1,64 @@
+import type { ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { VersionHistoryModal } from "@app/components/filesPage/VersionHistoryModal";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import { NavigationProvider } from "@app/contexts/NavigationContext";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const mockFile: StirlingFileStub = {
+  id: "file-3" as FileId,
+  name: "report-watermarked.pdf",
+  type: "application/pdf",
+  size: 110592,
+  lastModified: 0,
+  isLeaf: true,
+  originalFileId: "file-1" as FileId,
+  versionNumber: 3,
+};
+
+/**
+ * The modal loads its version chain from IndexedDB (empty in Storybook) and
+ * dispatches file/navigation actions on add-to-workspace and remove, so it
+ * needs FileContext (also supplies IndexedDBContext) and the tool-registry-
+ * backed NavigationContext mounted above it.
+ */
+function withProviders(Story: () => ReactElement) {
+  return (
+    <FileContextProvider>
+      <ToolRegistryProvider>
+        <NavigationProvider>
+          <Story />
+        </NavigationProvider>
+      </ToolRegistryProvider>
+    </FileContextProvider>
+  );
+}
+
+const meta = {
+  title: "FilesPage/VersionHistoryModal",
+  component: VersionHistoryModal,
+  decorators: [withProviders],
+  args: {
+    onClose: () => {},
+  },
+} satisfies Meta<typeof VersionHistoryModal>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** No prior versions exist in the (empty) storage, so the modal shows the empty state. */
+export const Default: Story = {
+  args: {
+    opened: true,
+    file: mockFile,
+  },
+};
+
+export const NoFileSelected: Story = {
+  args: {
+    opened: true,
+    file: null,
+  },
+};
diff --git a/frontend/editor/src/core/components/filesPage/VersionTimeline.stories.tsx b/frontend/editor/src/core/components/filesPage/VersionTimeline.stories.tsx
new file mode 100644
index 0000000000..c86f7d8124
--- /dev/null
+++ b/frontend/editor/src/core/components/filesPage/VersionTimeline.stories.tsx
@@ -0,0 +1,98 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { VersionTimeline } from "@app/components/filesPage/VersionTimeline";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId, ToolOperation } from "@app/types/file";
+
+const buildFileStub = (
+  overrides: Partial<StirlingFileStub> = {},
+): StirlingFileStub => ({
+  id: "file-1" as FileId,
+  name: "report.pdf",
+  type: "application/pdf",
+  size: 1024,
+  lastModified: 0,
+  isLeaf: true,
+  originalFileId: "file-1",
+  versionNumber: 1,
+  ...overrides,
+});
+
+const toolOp = (toolId: ToolOperation["toolId"]): ToolOperation => ({
+  toolId,
+  timestamp: 0,
+});
+
+const shortChain: StirlingFileStub[] = [
+  buildFileStub({
+    id: "file-1" as FileId,
+    name: "report.pdf",
+    size: 204800,
+    versionNumber: 1,
+  }),
+  buildFileStub({
+    id: "file-2" as FileId,
+    name: "report-compressed.pdf",
+    size: 102400,
+    versionNumber: 2,
+    parentFileId: "file-1" as FileId,
+    toolHistory: [toolOp("compress")],
+  }),
+  buildFileStub({
+    id: "file-3" as FileId,
+    name: "report-watermarked.pdf",
+    size: 110592,
+    versionNumber: 3,
+    parentFileId: "file-2" as FileId,
+    toolHistory: [toolOp("compress"), toolOp("watermark")],
+  }),
+];
+
+const longChain: StirlingFileStub[] = Array.from({ length: 9 }, (_, index) => {
+  const versionNumber = index + 1;
+  const toolHistory: ToolOperation[] =
+    versionNumber === 1
+      ? []
+      : [toolOp(versionNumber % 2 === 0 ? "compress" : "watermark")];
+  return buildFileStub({
+    id: `file-${versionNumber}` as FileId,
+    name: `report-v${versionNumber}.pdf`,
+    size: 100000 + versionNumber * 1024,
+    versionNumber,
+    parentFileId:
+      versionNumber > 1 ? (`file-${versionNumber - 1}` as FileId) : undefined,
+    toolHistory,
+  });
+});
+
+const meta = {
+  title: "FilesPage/VersionTimeline",
+  component: VersionTimeline,
+  args: {
+    onAddToWorkspace: () => {},
+    onRemove: () => {},
+  },
+} satisfies Meta<typeof VersionTimeline>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    chain: shortChain,
+    currentId: "file-3" as FileId,
+  },
+};
+
+export const NoHeader: Story = {
+  args: {
+    chain: shortChain,
+    currentId: "file-3" as FileId,
+    hideHeader: true,
+  },
+};
+
+export const LongChainCollapsed: Story = {
+  args: {
+    chain: longChain,
+    currentId: "file-9" as FileId,
+  },
+};
diff --git a/frontend/editor/src/core/components/onboarding/OnboardingSlideShell.stories.tsx b/frontend/editor/src/core/components/onboarding/OnboardingSlideShell.stories.tsx
new file mode 100644
index 0000000000..7878980f0b
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/OnboardingSlideShell.stories.tsx
@@ -0,0 +1,79 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+// The shared preview only loads the portal tokens; the shell reads the editor
+// theme tokens (--bg-surface, --onboarding-title, …), so load them here or the
+// card renders transparent over the dark overlay.
+import "@app/styles/theme.css";
+import OnboardingSlideShell, {
+  ShellHero,
+  type ShellButton,
+} from "@app/components/onboarding/OnboardingSlideShell";
+
+const meta = {
+  title: "Onboarding/Slide Shell",
+  component: OnboardingSlideShell,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof OnboardingSlideShell>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const BUTTONS: ShellButton[] = [
+  { key: "back", back: true, action: "back" },
+  { key: "skip", label: "Skip", action: "skip" },
+  { key: "next", label: "Next", primary: true, action: "next" },
+];
+
+/** A single standalone card — no step count, so no progress bar or pill. */
+export const Default: Story = {
+  args: {
+    hero: <ShellHero appIcon />,
+    slideKey: "default",
+    title: "Welcome to Stirling PDF",
+    body: "Everything you need to view, edit and manage your PDFs in one place.",
+    stepIndex: 0,
+    stepCount: 1,
+    buttons: [{ key: "next", label: "Next", primary: true, action: "next" }],
+    onAction: () => {},
+    onClose: () => {},
+  },
+};
+
+/** Mid-flow step: shows the step pill + progress bar, plus a back control. */
+export const SteppedWithBack: Story = {
+  args: {
+    hero: <ShellHero>2</ShellHero>,
+    slideKey: "stepped",
+    title: "Choose your role",
+    body: "This helps us tailor the tools you see first.",
+    stepIndex: 2,
+    stepCount: 5,
+    buttons: BUTTONS,
+    onAction: () => {},
+    onClose: () => {},
+  },
+};
+
+/** Dismiss (close button + escape-to-close) disabled — used for mandatory
+ * steps like a forced first-login password change. */
+export const NotDismissible: Story = {
+  args: {
+    hero: <ShellHero appIcon />,
+    slideKey: "mandatory",
+    title: "Set a new password",
+    body: "You're using the default password — choose a new one to continue.",
+    stepIndex: 0,
+    stepCount: 3,
+    buttons: [
+      {
+        key: "next",
+        label: "Continue",
+        primary: true,
+        action: "next",
+        disabled: true,
+      },
+    ],
+    onAction: () => {},
+    onClose: () => {},
+    allowDismiss: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/onboarding/OnboardingStepper.stories.tsx b/frontend/editor/src/core/components/onboarding/OnboardingStepper.stories.tsx
new file mode 100644
index 0000000000..7784d7dfdf
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/OnboardingStepper.stories.tsx
@@ -0,0 +1,21 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { OnboardingStepper } from "@app/components/onboarding/OnboardingStepper";
+
+const meta = {
+  title: "Onboarding/OnboardingStepper",
+  component: OnboardingStepper,
+  args: { totalSteps: 5, activeStep: 2 },
+  argTypes: {
+    totalSteps: { control: { type: "number", min: 1, max: 10 } },
+    activeStep: { control: { type: "number", min: 0, max: 9 } },
+  },
+} satisfies Meta<typeof OnboardingStepper>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = { args: { totalSteps: 5, activeStep: 2 } };
+
+export const FirstStep: Story = { args: { totalSteps: 5, activeStep: 0 } };
+
+export const LastStep: Story = { args: { totalSteps: 5, activeStep: 4 } };
diff --git a/frontend/editor/src/core/components/onboarding/OnboardingTour.stories.tsx b/frontend/editor/src/core/components/onboarding/OnboardingTour.stories.tsx
new file mode 100644
index 0000000000..d3dedcf848
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/OnboardingTour.stories.tsx
@@ -0,0 +1,69 @@
+import { useTranslation } from "react-i18next";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { StepType } from "@reactour/tour";
+import OnboardingTour from "@app/components/onboarding/OnboardingTour";
+import "@app/components/onboarding/OnboardingTour.css";
+
+/**
+ * Selectors go unused here since the target elements don't exist on the
+ * canvas, so reactour just centers the popover instead of anchoring to them.
+ */
+const SAMPLE_STEPS: StepType[] = [
+  {
+    selector: "body",
+    content: "Welcome to Stirling PDF! Let's take a quick look around.",
+  },
+  {
+    selector: "body",
+    content: "Here you can upload and manage your <strong>files</strong>.",
+  },
+  {
+    selector: "body",
+    content: "This is the tools panel where you apply operations to a PDF.",
+  },
+];
+
+function TourStage(props: {
+  tourType?: string;
+  isRTL?: boolean;
+  dimBackground?: boolean;
+}) {
+  const { t } = useTranslation();
+  return (
+    <OnboardingTour
+      tourSteps={SAMPLE_STEPS}
+      tourType={props.tourType ?? "welcome"}
+      isRTL={props.isRTL ?? false}
+      t={t}
+      isOpen={true}
+      onAdvance={({ setCurrentStep, currentStep, steps }) => {
+        const isLast = currentStep === (steps?.length ?? 0) - 1;
+        if (isLast) return;
+        setCurrentStep((prev) => prev + 1);
+      }}
+      onClose={({ setIsOpen }) => setIsOpen(false)}
+      dimBackground={props.dimBackground}
+    />
+  );
+}
+
+const meta = {
+  title: "Onboarding/OnboardingTour",
+  component: TourStage,
+} satisfies Meta<typeof TourStage>;
+
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Default tour, mask dimmed to 70% opacity. */
+export const Default: Story = { args: {} };
+
+/** Admin tour uses a dark mask class instead of the default dim mask. */
+export const AdminTour: Story = { args: { tourType: "admin" } };
+
+/** RTL layout swaps the "next" arrow direction. */
+export const RTL: Story = { args: { isRTL: true } };
+
+/** `dimBackground={false}` keeps the page fully visible behind the popover. */
+export const NoDim: Story = { args: { dimBackground: false } };
diff --git a/frontend/editor/src/core/components/onboarding/StaticOnboardingSlide.stories.tsx b/frontend/editor/src/core/components/onboarding/StaticOnboardingSlide.stories.tsx
new file mode 100644
index 0000000000..46aa79429f
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/StaticOnboardingSlide.stories.tsx
@@ -0,0 +1,105 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+// The shared preview only loads the portal tokens; the onboarding modal reads
+// the editor theme tokens (--bg-surface, --onboarding-title, …), so load them
+// here or the modal surface renders transparent over the dark overlay.
+import "@app/styles/theme.css";
+import StaticOnboardingSlide from "@app/components/onboarding/StaticOnboardingSlide";
+import { DEFAULT_RUNTIME_STATE } from "@app/components/onboarding/orchestrator/onboardingConfig";
+
+/**
+ * Renders the "interrupt" onboarding modals — slides shown outside the normal
+ * step flow (analytics consent, first-login password change, MFA setup, the
+ * external server-license notice) — each with dismissal disabled, since none
+ * of these can be skipped by the user.
+ */
+const meta = {
+  title: "Onboarding/Static Onboarding Slide",
+  component: StaticOnboardingSlide,
+  // Excluded from the automated (Vitest browser) test run: some slides fetch
+  // remote assets/endpoints (analytics, licensing) that aren't served in the
+  // headless scan, so they 404 and reject. Still renders in the Storybook UI
+  // for manual review.
+  tags: ["!test"],
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof StaticOnboardingSlide>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Opt-in analytics choice, shown once after first login. */
+export const AnalyticsChoice: Story = {
+  args: {
+    slideId: "analytics-choice",
+    runtimeState: DEFAULT_RUNTIME_STATE,
+    params: { analyticsError: null, analyticsLoading: false },
+    onSkip: () => {},
+    onAction: () => {},
+    allowDismiss: false,
+  },
+};
+
+/** Forced password change on first login with the default credentials. */
+export const FirstLogin: Story = {
+  args: {
+    slideId: "first-login",
+    runtimeState: {
+      ...DEFAULT_RUNTIME_STATE,
+      requiresPasswordChange: true,
+      firstLoginUsername: "admin",
+      usingDefaultCredentials: true,
+    },
+    params: {
+      firstLoginUsername: "admin",
+      onPasswordChanged: () => {},
+      usingDefaultCredentials: true,
+    },
+    onSkip: () => {},
+    onAction: () => {},
+    allowDismiss: false,
+  },
+};
+
+/** Two-factor setup, triggered when the account requires MFA. */
+export const MfaSetup: Story = {
+  args: {
+    slideId: "mfa-setup",
+    runtimeState: { ...DEFAULT_RUNTIME_STATE, requiresMfaSetup: true },
+    params: { onMfaSetupComplete: () => {} },
+    onSkip: () => {},
+    onAction: () => {},
+    allowDismiss: false,
+  },
+};
+
+/** External license notice — the back button is stripped via
+ * `transformButtons` since there's no prior slide to return to. */
+export const ServerLicenseNotice: Story = {
+  args: {
+    slideId: "server-license",
+    transformButtons: (buttons) =>
+      buttons.filter((btn) => btn.key !== "license-back"),
+    runtimeState: {
+      ...DEFAULT_RUNTIME_STATE,
+      licenseNotice: {
+        totalUsers: 12,
+        freeTierLimit: 5,
+        isOverLimit: true,
+        requiresLicense: true,
+      },
+    },
+    params: {
+      osOptions: [],
+      onDownloadUrlChange: () => {},
+      licenseNotice: {
+        totalUsers: 12,
+        freeTierLimit: 5,
+        isOverLimit: true,
+        requiresLicense: true,
+      },
+      loginEnabled: true,
+    },
+    onSkip: () => {},
+    onAction: () => {},
+    allowDismiss: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/onboarding/slides/AnalyticsChoiceSlide.stories.tsx b/frontend/editor/src/core/components/onboarding/slides/AnalyticsChoiceSlide.stories.tsx
new file mode 100644
index 0000000000..3a91079712
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/slides/AnalyticsChoiceSlide.stories.tsx
@@ -0,0 +1,41 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AnalyticsChoiceSlide from "@app/components/onboarding/slides/AnalyticsChoiceSlide";
+
+// AnalyticsChoiceSlide is a slide-content factory (returns a SlideConfig), not
+// a component, so wrap it to render its `body` the way the real onboarding
+// shell does.
+function AnalyticsChoiceSlideDemo({
+  analyticsError = null,
+}: {
+  analyticsError?: string | null;
+}) {
+  const slide = AnalyticsChoiceSlide({ analyticsError });
+
+  return (
+    <div
+      style={{
+        maxWidth: 420,
+        padding: 24,
+        borderRadius: 12,
+        background: `linear-gradient(135deg, ${slide.background.gradientStops[0]}, ${slide.background.gradientStops[1]})`,
+      }}
+    >
+      <h2 style={{ color: "#fff" }}>{slide.title}</h2>
+      {slide.body}
+    </div>
+  );
+}
+
+const meta = {
+  title: "Onboarding/AnalyticsChoiceSlide",
+  component: AnalyticsChoiceSlideDemo,
+} satisfies Meta<typeof AnalyticsChoiceSlideDemo>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = { args: {} };
+
+export const WithError: Story = {
+  args: { analyticsError: "Failed to save your analytics preference." },
+};
diff --git a/frontend/editor/src/core/components/onboarding/slides/AnimatedSlideBackground.stories.tsx b/frontend/editor/src/core/components/onboarding/slides/AnimatedSlideBackground.stories.tsx
new file mode 100644
index 0000000000..d436942893
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/slides/AnimatedSlideBackground.stories.tsx
@@ -0,0 +1,44 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AnimatedSlideBackground from "@app/components/onboarding/slides/AnimatedSlideBackground";
+import type { AnimatedCircleConfig } from "@app/types/types";
+
+const circles: AnimatedCircleConfig[] = [
+  {
+    size: 320,
+    color: "rgba(255, 255, 255, 0.4)",
+    position: "bottom-left",
+    blur: 40,
+  },
+  {
+    size: 220,
+    color: "rgba(255, 255, 255, 0.3)",
+    position: "top-right",
+    opacity: 0.6,
+    blur: 30,
+  },
+];
+
+const meta = {
+  title: "Onboarding/AnimatedSlideBackground",
+  component: AnimatedSlideBackground,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof AnimatedSlideBackground>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    gradientStops: ["#6E56CF", "#3B82F6"],
+    circles,
+    isActive: true,
+    slideKey: "welcome",
+  },
+};
+
+export const Inactive: Story = {
+  args: {
+    ...Default.args,
+    isActive: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.stories.tsx b/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.stories.tsx
new file mode 100644
index 0000000000..8618158336
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/slides/DesktopInstallTitle.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  DesktopInstallTitle,
+  type OSOption,
+} from "@app/components/onboarding/slides/DesktopInstallTitle";
+
+const OS_OPTIONS: OSOption[] = [
+  { label: "macOS (Apple Silicon)", url: "#mac-arm", value: "mac-arm" },
+  { label: "macOS (Intel)", url: "#mac-intel", value: "mac-intel" },
+  { label: "Windows", url: "#windows", value: "windows" },
+  { label: "Linux", url: "#linux", value: "linux" },
+];
+
+const meta = {
+  title: "Onboarding/Slides/DesktopInstallTitle",
+  component: DesktopInstallTitle,
+} satisfies Meta<typeof DesktopInstallTitle>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Multiple OS options: title plus a dropdown to switch the download target. */
+export const Default: Story = {
+  args: {
+    osLabel: "macOS (Apple Silicon)",
+    osUrl: "#mac-arm",
+    osOptions: OS_OPTIONS,
+    onDownloadUrlChange: () => {},
+  },
+};
+
+/** A single detected OS collapses to plain text — no dropdown affordance. */
+export const SingleOption: Story = {
+  args: {
+    osLabel: "Windows",
+    osUrl: "#windows",
+    osOptions: [{ label: "Windows", url: "#windows", value: "windows" }],
+    onDownloadUrlChange: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.stories.tsx b/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.stories.tsx
new file mode 100644
index 0000000000..14b9b4009b
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/slides/FirstLoginSlide.stories.tsx
@@ -0,0 +1,47 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FirstLoginSlide from "@app/components/onboarding/slides/FirstLoginSlide";
+
+// FirstLoginSlide is a slide-content factory (returns a SlideConfig), not a
+// component, so wrap it to render its `body` the way the real onboarding shell
+// does.
+function FirstLoginSlideDemo({
+  username = "admin",
+  usingDefaultCredentials = false,
+}: {
+  username?: string;
+  usingDefaultCredentials?: boolean;
+}) {
+  const slide = FirstLoginSlide({
+    username,
+    onPasswordChanged: () => {},
+    usingDefaultCredentials,
+  });
+
+  return (
+    <div
+      style={{
+        maxWidth: 420,
+        padding: 24,
+        borderRadius: 12,
+        background: `linear-gradient(135deg, ${slide.background.gradientStops[0]}, ${slide.background.gradientStops[1]})`,
+      }}
+    >
+      <h2 style={{ color: "#fff" }}>{slide.title}</h2>
+      {slide.body}
+    </div>
+  );
+}
+
+const meta = {
+  title: "Onboarding/FirstLoginSlide",
+  component: FirstLoginSlideDemo,
+} satisfies Meta<typeof FirstLoginSlideDemo>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = { args: { username: "admin" } };
+
+export const UsingDefaultCredentials: Story = {
+  args: { username: "admin", usingDefaultCredentials: true },
+};
diff --git a/frontend/editor/src/core/components/onboarding/slides/PlanOverviewSlide.stories.tsx b/frontend/editor/src/core/components/onboarding/slides/PlanOverviewSlide.stories.tsx
new file mode 100644
index 0000000000..2aafbaed68
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/slides/PlanOverviewSlide.stories.tsx
@@ -0,0 +1,60 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PlanOverviewSlide from "@app/components/onboarding/slides/PlanOverviewSlide";
+import type { LicenseNotice } from "@app/types/types";
+
+interface PlanOverviewStageProps {
+  isAdmin: boolean;
+  licenseNotice?: LicenseNotice;
+  loginEnabled?: boolean;
+}
+
+// PlanOverviewSlide returns a SlideConfig (title/body nodes plus background
+// config) rather than JSX, so this stage has to render those pieces itself.
+function PlanOverviewStage({
+  isAdmin,
+  licenseNotice,
+  loginEnabled,
+}: PlanOverviewStageProps) {
+  const slide = PlanOverviewSlide({ isAdmin, licenseNotice, loginEnabled });
+  return (
+    <div style={{ maxWidth: 480, padding: 24 }}>
+      <h2>{slide.title}</h2>
+      <div>{slide.body}</div>
+    </div>
+  );
+}
+
+const meta = {
+  title: "Onboarding/Slides/PlanOverviewSlide",
+  component: PlanOverviewStage,
+} satisfies Meta<typeof PlanOverviewStage>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Regular user overview — no admin controls, no free-tier notice. */
+export const Default: Story = {
+  args: { isAdmin: false },
+};
+
+/** Admin overview with login mode already enabled. */
+export const AdminLoginEnabled: Story = {
+  args: {
+    isAdmin: true,
+    loginEnabled: true,
+    licenseNotice: {
+      totalUsers: 3,
+      freeTierLimit: 5,
+      isOverLimit: false,
+      requiresLicense: false,
+    },
+  },
+};
+
+/** Admin overview before login mode is enabled — different body copy. */
+export const AdminLoginDisabled: Story = {
+  args: {
+    isAdmin: true,
+    loginEnabled: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/onboarding/slides/ProcessorIntroSlide.stories.tsx b/frontend/editor/src/core/components/onboarding/slides/ProcessorIntroSlide.stories.tsx
new file mode 100644
index 0000000000..b5e6ed4659
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/slides/ProcessorIntroSlide.stories.tsx
@@ -0,0 +1,33 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ProcessorIntroSlide from "@app/components/onboarding/slides/ProcessorIntroSlide";
+
+// ProcessorIntroSlide is a slide-content factory (returns a SlideConfig), not
+// a component, so wrap it to render its `title`/`body` the way the real
+// onboarding shell does.
+function ProcessorIntroSlideDemo() {
+  const slide = ProcessorIntroSlide();
+
+  return (
+    <div
+      style={{
+        maxWidth: 420,
+        padding: 24,
+        borderRadius: 12,
+        background: `linear-gradient(135deg, ${slide.background.gradientStops[0]}, ${slide.background.gradientStops[1]})`,
+      }}
+    >
+      <h2 style={{ color: "#fff" }}>{slide.title}</h2>
+      <div style={{ color: "#fff" }}>{slide.body}</div>
+    </div>
+  );
+}
+
+const meta = {
+  title: "Onboarding/ProcessorIntroSlide",
+  component: ProcessorIntroSlideDemo,
+} satisfies Meta<typeof ProcessorIntroSlideDemo>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = { args: {} };
diff --git a/frontend/editor/src/core/components/onboarding/slides/SecurityCheckSlide.stories.tsx b/frontend/editor/src/core/components/onboarding/slides/SecurityCheckSlide.stories.tsx
new file mode 100644
index 0000000000..73981e4bfb
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/slides/SecurityCheckSlide.stories.tsx
@@ -0,0 +1,46 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SecurityCheckSlide from "@app/components/onboarding/slides/SecurityCheckSlide";
+
+// SecurityCheckSlide is a slide-content factory (returns a SlideConfig), not a
+// component, so wrap it to render its `body` the way the real onboarding shell
+// does, with local state standing in for the modal's role selection state.
+function SecurityCheckSlideDemo({
+  initialRole = null,
+}: {
+  initialRole?: "admin" | "user" | null;
+}) {
+  const [selectedRole, setSelectedRole] = useState(initialRole);
+  const slide = SecurityCheckSlide({
+    selectedRole,
+    onRoleSelect: setSelectedRole,
+  });
+
+  return (
+    <div
+      style={{
+        maxWidth: 420,
+        padding: 24,
+        borderRadius: 12,
+        background: `linear-gradient(135deg, ${slide.background.gradientStops[0]}, ${slide.background.gradientStops[1]})`,
+      }}
+    >
+      <h2 style={{ color: "#fff" }}>{slide.title}</h2>
+      {slide.body}
+    </div>
+  );
+}
+
+const meta = {
+  title: "Onboarding/SecurityCheckSlide",
+  component: SecurityCheckSlideDemo,
+} satisfies Meta<typeof SecurityCheckSlideDemo>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = { args: {} };
+
+export const AdminSelected: Story = { args: { initialRole: "admin" } };
+
+export const UserSelected: Story = { args: { initialRole: "user" } };
diff --git a/frontend/editor/src/core/components/onboarding/slides/ServerLicenseSlide.stories.tsx b/frontend/editor/src/core/components/onboarding/slides/ServerLicenseSlide.stories.tsx
new file mode 100644
index 0000000000..fae21c8748
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/slides/ServerLicenseSlide.stories.tsx
@@ -0,0 +1,64 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ServerLicenseSlide from "@app/components/onboarding/slides/ServerLicenseSlide";
+import type { LicenseNotice } from "@app/types/types";
+
+interface ServerLicenseStageProps {
+  licenseNotice?: LicenseNotice;
+}
+
+// ServerLicenseSlide is a factory that returns a SlideConfig (title/body nodes
+// plus background config), not JSX itself, so this stage renders those pieces
+// directly to preview the slide in isolation.
+function ServerLicenseStage({ licenseNotice }: ServerLicenseStageProps) {
+  const slide = ServerLicenseSlide({ licenseNotice });
+  return (
+    <div
+      style={{
+        maxWidth: 480,
+        padding: 24,
+        borderRadius: 12,
+        background: `linear-gradient(135deg, ${slide.background.gradientStops[0]}, ${slide.background.gradientStops[1]})`,
+      }}
+    >
+      <h2 style={{ color: "#fff" }}>{slide.title}</h2>
+      <div style={{ color: "#fff" }}>{slide.body}</div>
+    </div>
+  );
+}
+
+const meta = {
+  title: "Onboarding/Slides/ServerLicenseSlide",
+  component: ServerLicenseStage,
+} satisfies Meta<typeof ServerLicenseStage>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Default free-tier notice — under the limit. */
+export const Default: Story = {
+  args: {},
+};
+
+/** Under the free-tier limit with a known user count. */
+export const UnderLimit: Story = {
+  args: {
+    licenseNotice: {
+      totalUsers: 3,
+      freeTierLimit: 5,
+      isOverLimit: false,
+      requiresLicense: false,
+    },
+  },
+};
+
+/** Over the free-tier limit — prompts to upgrade with a different gradient. */
+export const OverLimit: Story = {
+  args: {
+    licenseNotice: {
+      totalUsers: 12,
+      freeTierLimit: 5,
+      isOverLimit: true,
+      requiresLicense: true,
+    },
+  },
+};
diff --git a/frontend/editor/src/core/components/onboarding/slides/WelcomeSlide.stories.tsx b/frontend/editor/src/core/components/onboarding/slides/WelcomeSlide.stories.tsx
new file mode 100644
index 0000000000..f3ae1a76d4
--- /dev/null
+++ b/frontend/editor/src/core/components/onboarding/slides/WelcomeSlide.stories.tsx
@@ -0,0 +1,33 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import WelcomeSlide from "@app/components/onboarding/slides/WelcomeSlide";
+
+// WelcomeSlide is a slide-content factory (returns a SlideConfig), not
+// a component, so wrap it to render its `title`/`body` the way the real
+// onboarding shell does.
+function WelcomeSlideDemo() {
+  const slide = WelcomeSlide();
+
+  return (
+    <div
+      style={{
+        maxWidth: 420,
+        padding: 24,
+        borderRadius: 12,
+        background: `linear-gradient(135deg, ${slide.background.gradientStops[0]}, ${slide.background.gradientStops[1]})`,
+      }}
+    >
+      <h2 style={{ color: "#fff" }}>{slide.title}</h2>
+      <div style={{ color: "#fff" }}>{slide.body}</div>
+    </div>
+  );
+}
+
+const meta = {
+  title: "Onboarding/WelcomeSlide",
+  component: WelcomeSlideDemo,
+} satisfies Meta<typeof WelcomeSlideDemo>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = { args: {} };
diff --git a/frontend/editor/src/core/components/pageEditor/DragDropGrid.stories.tsx b/frontend/editor/src/core/components/pageEditor/DragDropGrid.stories.tsx
new file mode 100644
index 0000000000..be7616f1f9
--- /dev/null
+++ b/frontend/editor/src/core/components/pageEditor/DragDropGrid.stories.tsx
@@ -0,0 +1,112 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import DragDropGrid from "@app/components/pageEditor/DragDropGrid";
+
+interface MockGridItem {
+  id: string;
+  pageNumber?: number;
+  originalFileId?: string;
+}
+
+const buildItems = (count: number): MockGridItem[] =>
+  Array.from({ length: count }, (_, index) => ({
+    id: `page-${index + 1}`,
+    pageNumber: index + 1,
+    originalFileId: "file-1",
+  }));
+
+const renderItem = (
+  item: MockGridItem,
+  index: number,
+  refs: React.MutableRefObject<Map<string, HTMLDivElement>>,
+  boxSelectedIds: string[],
+  clearBoxSelection: () => void,
+  activeDragIds: string[],
+  justMoved: boolean,
+  dragHandleProps?: any,
+  zoomLevel?: number,
+) => {
+  const { ref: dndRef, ...restDragProps } = dragHandleProps ?? {};
+  const isBoxSelected = boxSelectedIds.includes(item.id);
+  const isDragging = activeDragIds.includes(item.id);
+
+  return (
+    <div
+      ref={(element: HTMLDivElement | null) => {
+        if (element) {
+          refs.current.set(item.id, element);
+        } else {
+          refs.current.delete(item.id);
+        }
+        dndRef?.(element);
+      }}
+      {...restDragProps}
+      onClick={clearBoxSelection}
+      style={{
+        width: `calc(10rem * ${zoomLevel ?? 1})`,
+        height: `calc(13rem * ${zoomLevel ?? 1})`,
+        display: "flex",
+        alignItems: "center",
+        justifyContent: "center",
+        borderRadius: "0.5rem",
+        border: isBoxSelected
+          ? "2px solid var(--mantine-color-blue-6)"
+          : "1px solid var(--mantine-color-gray-4)",
+        background: isDragging
+          ? "var(--mantine-color-gray-1)"
+          : "var(--mantine-color-body)",
+        opacity: justMoved ? 0.7 : 1,
+        cursor: "grab",
+      }}
+    >
+      Page {item.pageNumber ?? index + 1}
+    </div>
+  );
+};
+
+const noopReorder = () => {};
+
+const meta = {
+  title: "PageEditor/DragDropGrid",
+  component: DragDropGrid,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof DragDropGrid>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const ScrollDecorator = (StoryComponent: React.ComponentType) => (
+  <div
+    data-scrolling-container="true"
+    style={{ height: "40rem", overflow: "auto" }}
+  >
+    <StoryComponent />
+  </div>
+);
+
+export const Default: Story = {
+  args: {
+    items: buildItems(8),
+    onReorderPages: noopReorder,
+    renderItem,
+  },
+  decorators: [ScrollDecorator],
+};
+
+export const Empty: Story = {
+  args: {
+    items: [],
+    onReorderPages: noopReorder,
+    renderItem,
+  },
+  decorators: [ScrollDecorator],
+};
+
+export const Zoomed: Story = {
+  args: {
+    items: buildItems(6),
+    onReorderPages: noopReorder,
+    renderItem,
+    zoomLevel: 1.5,
+  },
+  decorators: [ScrollDecorator],
+};
diff --git a/frontend/editor/src/core/components/pageEditor/PageEditorControls.stories.tsx b/frontend/editor/src/core/components/pageEditor/PageEditorControls.stories.tsx
new file mode 100644
index 0000000000..5838a6c7d4
--- /dev/null
+++ b/frontend/editor/src/core/components/pageEditor/PageEditorControls.stories.tsx
@@ -0,0 +1,57 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PageEditorControls from "@app/components/pageEditor/PageEditorControls";
+
+const meta = {
+  title: "PageEditor/PageEditorControls",
+  component: PageEditorControls,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof PageEditorControls>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const baseArgs = {
+  onClosePdf: () => {},
+  onUndo: () => {},
+  onRedo: () => {},
+  canUndo: true,
+  canRedo: true,
+  onRotate: () => {},
+  onDelete: () => {},
+  onSplit: () => {},
+  onSplitAll: () => {},
+  onPageBreak: () => {},
+  onPageBreakAll: () => {},
+  onExportAll: () => {},
+  exportLoading: false,
+  selectionMode: true,
+  selectedPageIds: ["page-1", "page-2"],
+  displayDocument: {
+    pages: [
+      { id: "page-1", pageNumber: 1 },
+      { id: "page-2", pageNumber: 2 },
+      { id: "page-3", pageNumber: 3 },
+    ],
+  },
+  splitPositions: new Set<string>(),
+  totalPages: 3,
+};
+
+export const Default: Story = {
+  args: baseArgs,
+};
+
+export const NoSelection: Story = {
+  args: {
+    ...baseArgs,
+    selectedPageIds: [],
+    canUndo: false,
+    canRedo: false,
+  },
+};
+
+export const WithExistingSplits: Story = {
+  args: {
+    ...baseArgs,
+    splitPositions: new Set<string>(["page-1", "page-2"]),
+  },
+};
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/AdvancedSelectionPanel.stories.tsx b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/AdvancedSelectionPanel.stories.tsx
new file mode 100644
index 0000000000..5f3f1138d5
--- /dev/null
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/AdvancedSelectionPanel.stories.tsx
@@ -0,0 +1,40 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AdvancedSelectionPanel from "@app/components/pageEditor/bulkSelectionPanel/AdvancedSelectionPanel";
+
+const meta = {
+  title: "PageEditor/BulkSelectionPanel/AdvancedSelectionPanel",
+  component: AdvancedSelectionPanel,
+} satisfies Meta<typeof AdvancedSelectionPanel>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    csvInput: "",
+    setCsvInput: () => {},
+    onUpdatePagesFromCSV: () => {},
+    maxPages: 20,
+    advancedOpened: true,
+  },
+};
+
+export const WithExpression: Story = {
+  args: {
+    csvInput: "1-5, odd",
+    setCsvInput: () => {},
+    onUpdatePagesFromCSV: () => {},
+    maxPages: 20,
+    advancedOpened: true,
+  },
+};
+
+export const Closed: Story = {
+  args: {
+    csvInput: "",
+    setCsvInput: () => {},
+    onUpdatePagesFromCSV: () => {},
+    maxPages: 20,
+    advancedOpened: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.stories.tsx b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.stories.tsx
new file mode 100644
index 0000000000..b913dbbde5
--- /dev/null
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/OperatorsSection.stories.tsx
@@ -0,0 +1,23 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import OperatorsSection from "@app/components/pageEditor/bulkSelectionPanel/OperatorsSection";
+
+const meta = {
+  title: "PageEditor/BulkSelectionPanel/OperatorsSection",
+  component: OperatorsSection,
+} satisfies Meta<typeof OperatorsSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    csvInput: "1,2,3",
+    onInsertOperator: (op) => console.log("insert operator", op),
+  },
+};
+
+export const EmptyInput: Story = {
+  args: {
+    csvInput: "",
+    onInsertOperator: (op) => console.log("insert operator", op),
+  },
+};
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.stories.tsx b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.stories.tsx
new file mode 100644
index 0000000000..3f3ff93a94
--- /dev/null
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectPages.stories.tsx
@@ -0,0 +1,43 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SelectPages from "@app/components/pageEditor/bulkSelectionPanel/SelectPages";
+
+const meta = {
+  title: "PageEditor/SelectPages",
+  component: SelectPages,
+} satisfies Meta<typeof SelectPages>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    title: "Select pages",
+    placeholder: "Page number",
+    onApply: (value: number) => console.log("apply", value),
+    maxPages: 10,
+  },
+};
+
+export const WithValidation: Story = {
+  args: {
+    title: "Select pages",
+    placeholder: "Page number",
+    onApply: (value: number) => console.log("apply", value),
+    maxPages: 10,
+    validationFn: (value: number) =>
+      value > 10 ? "Page number exceeds document length" : null,
+  },
+};
+
+export const Range: Story = {
+  args: {
+    title: "Select page range",
+    placeholder: "Start page",
+    onApply: (value: number) => console.log("apply", value),
+    maxPages: 10,
+    isRange: true,
+    rangeEndValue: 5,
+    onRangeEndChange: (value: string | number) =>
+      console.log("range end", value),
+    rangeEndPlaceholder: "End page",
+  },
+};
diff --git a/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectedPagesDisplay.stories.tsx b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectedPagesDisplay.stories.tsx
new file mode 100644
index 0000000000..3b5d8421d1
--- /dev/null
+++ b/frontend/editor/src/core/components/pageEditor/bulkSelectionPanel/SelectedPagesDisplay.stories.tsx
@@ -0,0 +1,34 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SelectedPagesDisplay from "@app/components/pageEditor/bulkSelectionPanel/SelectedPagesDisplay";
+
+const displayDocument = {
+  pages: [
+    { id: "page-1", pageNumber: 1 },
+    { id: "page-2", pageNumber: 2 },
+    { id: "page-3", pageNumber: 3 },
+    { id: "page-4", pageNumber: 4 },
+  ],
+};
+
+const meta = {
+  title: "PageEditor/SelectedPagesDisplay",
+  component: SelectedPagesDisplay,
+} satisfies Meta<typeof SelectedPagesDisplay>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    selectedPageIds: ["page-1", "page-3"],
+    displayDocument,
+    syntaxError: null,
+  },
+};
+
+export const SyntaxError: Story = {
+  args: {
+    selectedPageIds: ["page-1", "page-3"],
+    displayDocument,
+    syntaxError: "Invalid page range: 1-abc",
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/AllToolsNavButton.stories.tsx b/frontend/editor/src/core/components/shared/AllToolsNavButton.stories.tsx
new file mode 100644
index 0000000000..a4912a750c
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/AllToolsNavButton.stories.tsx
@@ -0,0 +1,63 @@
+import { useState } from "react";
+import type { ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AllToolsNavButton from "@app/components/shared/AllToolsNavButton";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { NavigationProvider } from "@app/contexts/NavigationContext";
+import { ToolWorkflowProvider } from "@app/contexts/ToolWorkflowContext";
+
+/**
+ * The button reads/writes tool selection and panel state via ToolWorkflowContext,
+ * and derives the home link href from NavigationContext plus the tool registry —
+ * all four providers must be present for it to render.
+ */
+function withProviders(Story: () => ReactElement) {
+  return (
+    <PreferencesProvider>
+      <ToolRegistryProvider>
+        <NavigationProvider>
+          <ToolWorkflowProvider>
+            <Story />
+          </ToolWorkflowProvider>
+        </NavigationProvider>
+      </ToolRegistryProvider>
+    </PreferencesProvider>
+  );
+}
+
+const meta = {
+  title: "Shared/AllToolsNavButton",
+  component: AllToolsNavButton,
+  decorators: [withProviders],
+  args: {
+    activeButton: "tools",
+    setActiveButton: () => {},
+  },
+} satisfies Meta<typeof AllToolsNavButton>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Highlighted when it is the active quick-access button. */
+export const Default: Story = {
+  args: {
+    activeButton: "tools",
+    setActiveButton: () => {},
+  },
+};
+
+function InactiveDemo() {
+  const [activeButton, setActiveButton] = useState("home");
+  return (
+    <AllToolsNavButton
+      activeButton={activeButton}
+      setActiveButton={setActiveButton}
+    />
+  );
+}
+
+/** Not the active button — a different quick-access item is selected. */
+export const Inactive: Story = {
+  render: () => <InactiveDemo />,
+};
diff --git a/frontend/editor/src/core/components/shared/AppSwitch.stories.tsx b/frontend/editor/src/core/components/shared/AppSwitch.stories.tsx
new file mode 100644
index 0000000000..6d4449fe58
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/AppSwitch.stories.tsx
@@ -0,0 +1,35 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { AppSwitch } from "@app/components/shared/AppSwitch";
+
+/** The editor ⇄ processor app switcher rendered by both the editor and portal sidebars. */
+const meta: Meta<typeof AppSwitch> = {
+  title: "Shared/AppSwitch",
+  component: AppSwitch,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Editor: Story = {
+  args: {
+    current: "editor",
+    theme: "light",
+    onSwitch: () => {},
+  },
+};
+
+export const Processor: Story = {
+  args: {
+    current: "processor",
+    theme: "light",
+    onSwitch: () => {},
+  },
+};
+
+export const DarkTheme: Story = {
+  args: {
+    current: "editor",
+    theme: "dark",
+    onSwitch: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/BulkShareModal.stories.tsx b/frontend/editor/src/core/components/shared/BulkShareModal.stories.tsx
new file mode 100644
index 0000000000..cfa1f223ee
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/BulkShareModal.stories.tsx
@@ -0,0 +1,75 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { ReactElement } from "react";
+import BulkShareModal from "@app/components/shared/BulkShareModal";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const mockFiles: StirlingFileStub[] = [
+  {
+    id: "story-file-1" as FileId,
+    name: "quarterly-report.pdf",
+    type: "application/pdf",
+    size: 2_400_000,
+    lastModified: Date.now(),
+    isLeaf: true,
+    originalFileId: "story-file-1",
+    versionNumber: 1,
+  },
+  {
+    id: "story-file-2" as FileId,
+    name: "cover-letter.pdf",
+    type: "application/pdf",
+    size: 180_000,
+    lastModified: Date.now(),
+    isLeaf: true,
+    originalFileId: "story-file-2",
+    versionNumber: 1,
+  },
+];
+
+/**
+ * BulkShareModal reads useFileActions() from FileContext, which isn't part of
+ * the shared preview decorators, so it's provided here for every story.
+ * AppConfig (gating share links on `storageShareLinksEnabled`) is added
+ * per-story instead, since Default and LinksEnabled need different values.
+ */
+function withFileContext(Story: () => ReactElement) {
+  return (
+    <FileContextProvider>
+      <Story />
+    </FileContextProvider>
+  );
+}
+
+const meta = {
+  title: "Shared/BulkShareModal",
+  component: BulkShareModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    files: mockFiles,
+  },
+  decorators: [withFileContext],
+} satisfies Meta<typeof BulkShareModal>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Share links disabled by server config — default when no config is loaded. */
+export const Default: Story = {};
+
+/** Share links enabled — the role selector and "Generate Link" action are active. */
+export const LinksEnabled: Story = {
+  decorators: [
+    (Story) => (
+      <AppConfigProvider
+        initialConfig={{ storageShareLinksEnabled: true }}
+        autoFetch={false}
+      >
+        <Story />
+      </AppConfigProvider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/shared/BulkUploadToServerModal.stories.tsx b/frontend/editor/src/core/components/shared/BulkUploadToServerModal.stories.tsx
new file mode 100644
index 0000000000..0b800195f5
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/BulkUploadToServerModal.stories.tsx
@@ -0,0 +1,67 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { ReactElement } from "react";
+import BulkUploadToServerModal from "@app/components/shared/BulkUploadToServerModal";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const mockFiles: StirlingFileStub[] = [
+  {
+    id: "file-1" as FileId,
+    name: "quarterly-report.pdf",
+    type: "application/pdf",
+    size: 2_400_000,
+    lastModified: Date.now(),
+    isLeaf: true,
+    originalFileId: "file-1" as FileId,
+    versionNumber: 1,
+  },
+  {
+    id: "file-2" as FileId,
+    name: "invoice-march.pdf",
+    type: "application/pdf",
+    size: 512_000,
+    lastModified: Date.now(),
+    isLeaf: true,
+    originalFileId: "file-2" as FileId,
+    versionNumber: 1,
+  },
+];
+
+/**
+ * The modal dispatches updateStirlingFileStub on upload, so it needs
+ * FileContext (also supplies IndexedDBContext) mounted above it.
+ */
+function withProviders(Story: () => ReactElement) {
+  return (
+    <FileContextProvider>
+      <Story />
+    </FileContextProvider>
+  );
+}
+
+const meta = {
+  title: "Shared/BulkUploadToServerModal",
+  component: BulkUploadToServerModal,
+  decorators: [withProviders],
+  args: {
+    onClose: () => {},
+  },
+} satisfies Meta<typeof BulkUploadToServerModal>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    opened: true,
+    files: mockFiles,
+  },
+};
+
+export const SingleFile: Story = {
+  args: {
+    opened: true,
+    files: [mockFiles[0]],
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/ButtonToggle.stories.tsx b/frontend/editor/src/core/components/shared/ButtonToggle.stories.tsx
new file mode 100644
index 0000000000..88183305d3
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/ButtonToggle.stories.tsx
@@ -0,0 +1,58 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  ButtonToggle,
+  ButtonToggleOption,
+} from "@app/components/shared/ButtonToggle";
+
+const meta: Meta<typeof ButtonToggle> = {
+  title: "Shared/ButtonToggle",
+  component: ButtonToggle,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "24rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof ButtonToggle>;
+
+const options: ButtonToggleOption[] = [
+  {
+    value: "automatic",
+    label: "Automatic",
+    description: "Detect and redact automatically",
+  },
+  { value: "manual", label: "Manual", description: "Select regions yourself" },
+];
+
+function ToggleDemo({
+  disabled,
+  size,
+}: {
+  disabled?: boolean;
+  size?: "xs" | "sm" | "md" | "lg";
+}) {
+  const [value, setValue] = useState("automatic");
+  return (
+    <ButtonToggle
+      options={options}
+      value={value}
+      onChange={setValue}
+      disabled={disabled}
+      size={size}
+    />
+  );
+}
+
+/** Default toggle with two options, each carrying a label + description. */
+export const Default: Story = { render: () => <ToggleDemo /> };
+
+/** Disabled state — the selected segment must still be legible. */
+export const Disabled: Story = { render: () => <ToggleDemo disabled /> };
+
+/** Small size variant. */
+export const Small: Story = { render: () => <ToggleDemo size="sm" /> };
diff --git a/frontend/editor/src/core/components/shared/CloudStorageIcons.stories.tsx b/frontend/editor/src/core/components/shared/CloudStorageIcons.stories.tsx
new file mode 100644
index 0000000000..9d44784233
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/CloudStorageIcons.stories.tsx
@@ -0,0 +1,33 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  GoogleDriveIcon,
+  OneDriveIcon,
+  DropboxIcon,
+} from "@app/components/shared/CloudStorageIcons";
+
+/** Cloud storage brand icons with brand-color / muted current-color variants. */
+const meta: Meta<typeof GoogleDriveIcon> = {
+  title: "Shared/CloudStorageIcons",
+  component: GoogleDriveIcon,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const GoogleDrive: Story = {
+  args: { colored: true },
+};
+
+export const GoogleDriveMuted: Story = {
+  args: { colored: false },
+};
+
+export const OneDrive: Story = {
+  render: (args) => <OneDriveIcon {...args} />,
+  args: { colored: true },
+};
+
+export const Dropbox: Story = {
+  render: (args) => <DropboxIcon {...args} />,
+  args: { colored: true },
+};
diff --git a/frontend/editor/src/core/components/shared/DropdownListWithFooter.stories.tsx b/frontend/editor/src/core/components/shared/DropdownListWithFooter.stories.tsx
new file mode 100644
index 0000000000..c52f1c9298
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/DropdownListWithFooter.stories.tsx
@@ -0,0 +1,86 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Button } from "@mantine/core";
+import DropdownListWithFooter, {
+  DropdownItem,
+} from "@app/components/shared/DropdownListWithFooter";
+
+const meta: Meta<typeof DropdownListWithFooter> = {
+  title: "Shared/DropdownListWithFooter",
+  component: DropdownListWithFooter,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "22rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof DropdownListWithFooter>;
+
+const items: DropdownItem[] = [
+  { value: "single", name: "Single page" },
+  { value: "facing", name: "Facing pages" },
+  { value: "book", name: "Book view" },
+  { value: "continuous", name: "Continuous scroll", disabled: true },
+];
+
+function SingleSelectDemo() {
+  const [value, setValue] = useState("single");
+  return (
+    <DropdownListWithFooter
+      label="Page layout"
+      items={items}
+      value={value}
+      onChange={(v) => setValue(v as string)}
+    />
+  );
+}
+
+function MultiSelectDemo() {
+  const [value, setValue] = useState<string[]>(["single"]);
+  return (
+    <DropdownListWithFooter
+      label="Page layouts"
+      items={items}
+      value={value}
+      onChange={(v) => setValue(v as string[])}
+      multiSelect
+      searchable
+      footer={
+        <Button
+          size="xs"
+          variant="subtle"
+          fullWidth
+          onClick={() => setValue([])}
+        >
+          Clear selection
+        </Button>
+      }
+    />
+  );
+}
+
+/** Single-select dropdown with a disabled item. */
+export const Default: Story = { render: () => <SingleSelectDemo /> };
+
+/** Multi-select with search box and a footer action. */
+export const MultiSelectWithFooter: Story = {
+  render: () => <MultiSelectDemo />,
+};
+
+/** No items available — empty state message inside the dropdown. */
+export const Empty: Story = {
+  render: () => {
+    return (
+      <DropdownListWithFooter
+        label="Page layout"
+        items={[]}
+        value=""
+        onChange={() => {}}
+      />
+    );
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/EditableSecretField.stories.tsx b/frontend/editor/src/core/components/shared/EditableSecretField.stories.tsx
new file mode 100644
index 0000000000..b49fbd2806
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/EditableSecretField.stories.tsx
@@ -0,0 +1,61 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import EditableSecretField from "@app/components/shared/EditableSecretField";
+
+const meta: Meta<typeof EditableSecretField> = {
+  title: "Shared/EditableSecretField",
+  component: EditableSecretField,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "24rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof EditableSecretField>;
+
+function SecretFieldDemo({
+  initialValue = "",
+  ...rest
+}: {
+  initialValue?: string;
+  label?: string;
+  description?: string;
+  placeholder?: string;
+  disabled?: boolean;
+  error?: string;
+}) {
+  const [value, setValue] = useState(initialValue);
+  return (
+    <EditableSecretField
+      label="API key"
+      description="Used to authenticate requests to the third-party service."
+      value={value}
+      onChange={setValue}
+      {...rest}
+    />
+  );
+}
+
+/** Empty value: renders a normal password input. */
+export const Default: Story = {
+  render: () => <SecretFieldDemo />,
+};
+
+/** Backend returned a masked value (********): shows a read-only display + Edit button. */
+export const Masked: Story = {
+  render: () => <SecretFieldDemo initialValue="********" />,
+};
+
+/** Disabled state — the Edit button on a masked value must still read as inert. */
+export const MaskedDisabled: Story = {
+  render: () => <SecretFieldDemo initialValue="********" disabled />,
+};
+
+/** Validation error surfaced under the password input. */
+export const WithError: Story = {
+  render: () => <SecretFieldDemo error="Secret value is required." />,
+};
diff --git a/frontend/editor/src/core/components/shared/EncryptedPdfUnlockModal.stories.tsx b/frontend/editor/src/core/components/shared/EncryptedPdfUnlockModal.stories.tsx
new file mode 100644
index 0000000000..dd83b6eece
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/EncryptedPdfUnlockModal.stories.tsx
@@ -0,0 +1,60 @@
+import { useState, type ComponentProps } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import EncryptedPdfUnlockModal from "@app/components/shared/EncryptedPdfUnlockModal";
+
+const meta = {
+  title: "Shared/EncryptedPdfUnlockModal",
+  component: EncryptedPdfUnlockModal,
+  args: {
+    opened: true,
+    password: "",
+    isProcessing: false,
+    remainingCount: 0,
+    onPasswordChange: () => {},
+    onUnlock: () => {},
+    onUnlockAll: () => {},
+    onSkip: () => {},
+  },
+} satisfies Meta<typeof EncryptedPdfUnlockModal>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function UnlockDemo(
+  props: Partial<ComponentProps<typeof EncryptedPdfUnlockModal>>,
+) {
+  const [password, setPassword] = useState("");
+  return (
+    <EncryptedPdfUnlockModal
+      opened
+      fileName="contract-final.pdf"
+      password={password}
+      errorMessage={null}
+      isProcessing={false}
+      remainingCount={0}
+      onPasswordChange={setPassword}
+      onUnlock={() => {}}
+      onUnlockAll={() => {}}
+      onSkip={() => {}}
+      {...props}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <UnlockDemo /> };
+
+export const MultipleFilesRemaining: Story = {
+  render: () => <UnlockDemo remainingCount={2} />,
+};
+
+export const IncorrectPassword: Story = {
+  render: () => (
+    <UnlockDemo
+      password="wrong-password"
+      errorMessage="Incorrect password. Please try again."
+    />
+  ),
+};
+
+export const Processing: Story = {
+  render: () => <UnlockDemo password="secret" isProcessing />,
+};
diff --git a/frontend/editor/src/core/components/shared/ErrorBoundary.stories.tsx b/frontend/editor/src/core/components/shared/ErrorBoundary.stories.tsx
new file mode 100644
index 0000000000..22a5f06feb
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/ErrorBoundary.stories.tsx
@@ -0,0 +1,44 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Text } from "@mantine/core";
+import ErrorBoundary from "@app/components/shared/ErrorBoundary";
+
+const meta: Meta<typeof ErrorBoundary> = {
+  title: "Shared/ErrorBoundary",
+  component: ErrorBoundary,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof ErrorBoundary>;
+
+function ThrowingChild(): never {
+  throw new Error("Simulated render error for Storybook");
+}
+
+/** Normal path — children render untouched when nothing throws. */
+export const Default: Story = {
+  args: {
+    children: <Text>Protected content renders normally.</Text>,
+  },
+};
+
+/** A child throwing during render is caught, showing the default fallback with a retry button. */
+export const CaughtError: Story = {
+  args: {
+    children: <ThrowingChild />,
+  },
+};
+
+/** A custom fallback component receives the error and a retry callback. */
+export const CustomFallback: Story = {
+  args: {
+    children: <ThrowingChild />,
+    fallback: ({ error, retry }) => (
+      <Text c="red">
+        Custom fallback: {error?.message}
+        <button onClick={retry} style={{ marginLeft: 8 }}>
+          Retry
+        </button>
+      </Text>
+    ),
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/FileCard.stories.tsx b/frontend/editor/src/core/components/shared/FileCard.stories.tsx
new file mode 100644
index 0000000000..48edd5854e
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/FileCard.stories.tsx
@@ -0,0 +1,65 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FileCard from "@app/components/shared/FileCard";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import { StirlingFileStub, FileId } from "@app/types/fileContext";
+
+function makeFile(name: string, type = "application/pdf"): File {
+  return new File(["%PDF-1.4 storybook fixture"], name, {
+    type,
+    lastModified: Date.now(),
+  });
+}
+
+function makeStub(id: string): StirlingFileStub {
+  return {
+    id: id as FileId,
+    name: "Annual-Report-2026.pdf",
+    type: "application/pdf",
+    size: 245_760,
+    lastModified: Date.now(),
+    isLeaf: true,
+    originalFileId: id,
+    versionNumber: 1,
+  };
+}
+
+/** FileCard reads/writes files via FileContext + IndexedDB, so it needs a real provider tree. */
+const meta = {
+  title: "Shared/FileCard",
+  component: FileCard,
+  parameters: { layout: "padded" },
+  decorators: [
+    (Story) => (
+      <FileContextProvider>
+        <Story />
+      </FileContextProvider>
+    ),
+  ],
+} satisfies Meta<typeof FileCard>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    file: makeFile("Annual-Report-2026.pdf"),
+    fileStub: makeStub("story-file-1"),
+    onRemove: () => {},
+    onView: () => {},
+    onEdit: () => {},
+  },
+};
+
+export const Selected: Story = {
+  args: {
+    ...Default.args,
+    isSelected: true,
+    onSelect: () => {},
+  },
+};
+
+export const Unsupported: Story = {
+  args: {
+    ...Default.args,
+    isSupported: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/FileDocIcon.stories.tsx b/frontend/editor/src/core/components/shared/FileDocIcon.stories.tsx
new file mode 100644
index 0000000000..b42f7085a2
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/FileDocIcon.stories.tsx
@@ -0,0 +1,35 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { FileDocIcon } from "@app/components/shared/FileDocIcon";
+
+const meta = {
+  title: "Shared/FileDocIcon",
+  component: FileDocIcon,
+  parameters: { layout: "padded" },
+  args: { variant: "pdf" },
+} satisfies Meta<typeof FileDocIcon>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: { variant: "pdf" },
+};
+
+/** All file-type variants, each using its own default accent color. */
+export const AllVariants: Story = {
+  render: () => (
+    <div style={{ display: "flex", gap: "1.5rem", alignItems: "center" }}>
+      <FileDocIcon variant="pdf" />
+      <FileDocIcon variant="spreadsheet" />
+      <FileDocIcon variant="doc" />
+      <FileDocIcon variant="image" />
+      <FileDocIcon variant="archive" />
+      <FileDocIcon variant="code" />
+      <FileDocIcon variant="generic" />
+    </div>
+  ),
+};
+
+/** Explicit `color` overrides the variant's default accent. */
+export const CustomColor: Story = {
+  args: { variant: "pdf", color: "#e64980" },
+};
diff --git a/frontend/editor/src/core/components/shared/FileDropdownMenu.stories.tsx b/frontend/editor/src/core/components/shared/FileDropdownMenu.stories.tsx
new file mode 100644
index 0000000000..bb6b7d2670
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/FileDropdownMenu.stories.tsx
@@ -0,0 +1,49 @@
+import type { CSSProperties } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { FileDropdownMenu } from "@app/components/shared/FileDropdownMenu";
+
+const viewOptionStyle: CSSProperties = {
+  display: "flex",
+  alignItems: "center",
+  gap: "0.25rem",
+  padding: "0.25rem 0.5rem",
+};
+
+const activeFiles = [
+  { fileId: "file-1", name: "Contract-Draft-v1.pdf" },
+  { fileId: "file-2", name: "Invoice-2026-04.pdf", versionNumber: 2 },
+  { fileId: "file-3", name: "Scanned-Document-With-A-Very-Long-Name.pdf" },
+];
+
+const meta: Meta<typeof FileDropdownMenu> = {
+  title: "Shared/FileDropdownMenu",
+  component: FileDropdownMenu,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    displayName: "Contract-Draft-v1.pdf",
+    activeFiles,
+    currentFileIndex: 0,
+    viewOptionStyle,
+    onFileSelect: () => {},
+    onFileRemove: () => {},
+  },
+};
+
+export const Switching: Story = {
+  args: {
+    ...Default.args,
+    switchingTo: "viewer",
+  },
+};
+
+export const NoRemove: Story = {
+  args: {
+    ...Default.args,
+    onFileRemove: undefined,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/FileGrid.stories.tsx b/frontend/editor/src/core/components/shared/FileGrid.stories.tsx
new file mode 100644
index 0000000000..aea431852a
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/FileGrid.stories.tsx
@@ -0,0 +1,104 @@
+import type { ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FileGrid from "@app/components/shared/FileGrid";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+/**
+ * FileGrid renders FileCard entries, which call useFileThumbnail ->
+ * useIndexedDBThumbnail. That hook reads IndexedDBContext + FileContext,
+ * neither of which is part of the shared preview decorators, so
+ * FileContextProvider (which wraps IndexedDBProvider internally) is stood up
+ * here.
+ */
+function withFileContext(Story: () => ReactElement) {
+  return (
+    <FileContextProvider>
+      <Story />
+    </FileContextProvider>
+  );
+}
+
+const buildFile = (name: string, size: number, type: string): File => {
+  return new File([new Uint8Array(size)], name, {
+    type,
+    lastModified: Date.now(),
+  });
+};
+
+const buildRecord = (
+  id: string,
+  overrides: Partial<StirlingFileStub> = {},
+): StirlingFileStub => ({
+  id: id as FileId,
+  name: overrides.name ?? "report.pdf",
+  type: overrides.type ?? "application/pdf",
+  size: overrides.size ?? 1_240_000,
+  lastModified: overrides.lastModified ?? Date.now(),
+  isLeaf: true,
+  originalFileId: id,
+  versionNumber: 1,
+  // Set so useLazyThumbnail short-circuits on the stored thumbnail instead of
+  // trying to read file bytes out of IndexedDB.
+  thumbnailUrl:
+    "data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' width='120' height='160'%3E%3Crect width='120' height='160' fill='%23e9ecef'/%3E%3C/svg%3E",
+  ...overrides,
+});
+
+const files = [
+  {
+    file: buildFile("report.pdf", 1_240_000, "application/pdf"),
+    record: buildRecord("file-1", { name: "report.pdf" }),
+  },
+  {
+    file: buildFile("invoice.pdf", 540_000, "application/pdf"),
+    record: buildRecord("file-2", {
+      name: "invoice.pdf",
+      size: 540_000,
+    }),
+  },
+  {
+    file: buildFile(
+      "budget.xlsx",
+      82_000,
+      "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+    ),
+    record: buildRecord("file-3", {
+      name: "budget.xlsx",
+      type: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+      size: 82_000,
+      thumbnailUrl: undefined,
+    }),
+  },
+];
+
+const meta = {
+  title: "Shared/FileGrid",
+  component: FileGrid,
+  decorators: [withFileContext],
+  args: {
+    files,
+    onRemove: () => {},
+  },
+} satisfies Meta<typeof FileGrid>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const SearchAndSort: Story = {
+  args: {
+    showSearch: true,
+    showSort: true,
+    onDeleteAll: () => {},
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    files: [],
+    showSearch: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/FilePickerModal.stories.tsx b/frontend/editor/src/core/components/shared/FilePickerModal.stories.tsx
new file mode 100644
index 0000000000..51eac29632
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/FilePickerModal.stories.tsx
@@ -0,0 +1,37 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FilePickerModal from "@app/components/shared/FilePickerModal";
+
+const mockStoredFiles = [
+  { id: "file-1", name: "invoice.pdf", size: 245_000, thumbnail: null },
+  {
+    id: "file-2",
+    name: "contract-draft.pdf",
+    size: 1_240_000,
+    thumbnail: null,
+  },
+  { id: "file-3", name: "scanned-form.pdf", size: 3_400_000, thumbnail: null },
+];
+
+const meta = {
+  title: "Shared/FilePickerModal",
+  component: FilePickerModal,
+  parameters: { layout: "padded" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    onSelectFiles: () => {},
+    storedFiles: mockStoredFiles,
+  },
+} satisfies Meta<typeof FilePickerModal>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Storage populated with a few files available to pick from. */
+export const Default: Story = {};
+
+/** No files exist in storage yet — shows the empty-state message. */
+export const Empty: Story = {
+  args: {
+    storedFiles: [],
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/FilePreview.stories.tsx b/frontend/editor/src/core/components/shared/FilePreview.stories.tsx
new file mode 100644
index 0000000000..30e2fec884
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/FilePreview.stories.tsx
@@ -0,0 +1,57 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FilePreview from "@app/components/shared/FilePreview";
+import { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const mockFile: StirlingFileStub = {
+  id: "file-1" as FileId,
+  name: "annual-report.pdf",
+  type: "application/pdf",
+  size: 245_000,
+  lastModified: Date.now(),
+  isLeaf: true,
+  originalFileId: "file-1",
+  versionNumber: 1,
+};
+
+const meta = {
+  title: "Shared/FilePreview",
+  component: FilePreview,
+  parameters: { layout: "padded" },
+  decorators: [
+    (Story) => (
+      <div style={{ width: "12rem", height: "12rem" }}>
+        <Story />
+      </div>
+    ),
+  ],
+} satisfies Meta<typeof FilePreview>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    file: mockFile,
+    thumbnail: null,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    file: null,
+  },
+};
+
+export const WithNavigation: Story = {
+  args: {
+    file: mockFile,
+    thumbnail: null,
+    showStacking: true,
+    showHoverOverlay: true,
+    showNavigation: true,
+    totalFiles: 3,
+    onFileClick: () => {},
+    onPrevious: () => {},
+    onNext: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/FileSelectorPicker.stories.tsx b/frontend/editor/src/core/components/shared/FileSelectorPicker.stories.tsx
new file mode 100644
index 0000000000..3d01996b99
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/FileSelectorPicker.stories.tsx
@@ -0,0 +1,48 @@
+import type { ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { FileSelectorPicker } from "@app/components/shared/FileSelectorPicker";
+import { FileContextProvider } from "@app/contexts/FileContext";
+
+/**
+ * Reads from FileContext (workbench files) and IndexedDBContext (persisted
+ * saved files) further up the tree — neither is part of the shared preview
+ * decorators, so FileContextProvider (which also wraps IndexedDBProvider) is
+ * stood up here. The popover starts closed, so no IndexedDB read happens
+ * until a story interacts with it.
+ */
+function withFileContext(Story: () => ReactElement) {
+  return (
+    <FileContextProvider>
+      <div style={{ maxWidth: "16rem" }}>
+        <Story />
+      </div>
+    </FileContextProvider>
+  );
+}
+
+const meta = {
+  title: "Shared/FileSelectorPicker",
+  component: FileSelectorPicker,
+  parameters: { layout: "padded" },
+  args: {
+    onSelect: () => {},
+  },
+  decorators: [withFileContext],
+} satisfies Meta<typeof FileSelectorPicker>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const CustomPlaceholder: Story = {
+  args: {
+    placeholder: "Choose a comparison file",
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/FileUploadButton.stories.tsx b/frontend/editor/src/core/components/shared/FileUploadButton.stories.tsx
new file mode 100644
index 0000000000..d0411f1be9
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/FileUploadButton.stories.tsx
@@ -0,0 +1,56 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FileUploadButton from "@app/components/shared/FileUploadButton";
+
+const meta: Meta<typeof FileUploadButton> = {
+  title: "Shared/FileUploadButton",
+  component: FileUploadButton,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "22rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof FileUploadButton>;
+
+function UploadDemo({
+  initialFile,
+  ...rest
+}: {
+  initialFile?: File;
+  disabled?: boolean;
+  accept?: string;
+  placeholder?: string;
+}) {
+  const [file, setFile] = useState<File | undefined>(initialFile);
+  return (
+    <FileUploadButton
+      file={file}
+      onChange={(next) => setFile(next ?? undefined)}
+      {...rest}
+    />
+  );
+}
+
+/** No file chosen yet — shows the default "Choose File" placeholder. */
+export const Default: Story = { render: () => <UploadDemo /> };
+
+/** A file has already been selected — the button shows its name. */
+export const WithFileSelected: Story = {
+  render: () => (
+    <UploadDemo
+      initialFile={
+        new File(["dummy content"], "document.pdf", { type: "application/pdf" })
+      }
+    />
+  ),
+};
+
+/** Disabled state — should still be legible but non-interactive. */
+export const Disabled: Story = {
+  render: () => <UploadDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/shared/FirstLoginModal.stories.tsx b/frontend/editor/src/core/components/shared/FirstLoginModal.stories.tsx
new file mode 100644
index 0000000000..30941579f4
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/FirstLoginModal.stories.tsx
@@ -0,0 +1,18 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FirstLoginModal from "@app/components/shared/FirstLoginModal";
+
+const meta = {
+  title: "Shared/FirstLoginModal",
+  component: FirstLoginModal,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof FirstLoginModal>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    opened: true,
+    username: "jane.doe",
+    onPasswordChanged: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/FitText.stories.tsx b/frontend/editor/src/core/components/shared/FitText.stories.tsx
new file mode 100644
index 0000000000..63b93d0ed7
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/FitText.stories.tsx
@@ -0,0 +1,41 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FitText from "@app/components/shared/FitText";
+
+const meta: Meta<typeof FitText> = {
+  title: "Shared/FitText",
+  component: FitText,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "12rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Single-line text that shrinks its font size to fit the available width. */
+export const Default: Story = {
+  args: {
+    text: "Invoice_2026_Quarterly_Report.pdf",
+  },
+};
+
+/** Multi-line clamp with soft-break hints inserted after '/', '-' and '_'. */
+export const MultiLine: Story = {
+  args: {
+    text: "path/to/some-very/long_document/name_that_needs_multiple_lines.pdf",
+    lines: 3,
+  },
+};
+
+/** Explicit font size (rem) with a lower minimum shrink scale. */
+export const CustomFontSize: Story = {
+  args: {
+    text: "Custom Sized Label",
+    fontSize: 1.5,
+    minimumFontScale: 0.5,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/Footer.stories.tsx b/frontend/editor/src/core/components/shared/Footer.stories.tsx
new file mode 100644
index 0000000000..af1d4a5805
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/Footer.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import Footer from "@app/components/shared/Footer";
+
+const meta = {
+  title: "Shared/Footer",
+  component: Footer,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof Footer>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Defaults: no overrides supplied, only the always-present links render. */
+export const Default: Story = {
+  args: {},
+};
+
+/** All optional legal links populated, plus the cookie preferences button. */
+export const AllLinksAndCookieBanner: Story = {
+  args: {
+    privacyPolicy: "https://example.com/privacy",
+    termsAndConditions: "https://example.com/terms",
+    accessibilityStatement: "https://example.com/accessibility",
+    cookiePolicy: "https://example.com/cookies",
+    impressum: "https://example.com/impressum",
+    analyticsEnabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/HoverActionMenu.stories.tsx b/frontend/editor/src/core/components/shared/HoverActionMenu.stories.tsx
new file mode 100644
index 0000000000..dc391d0e9a
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/HoverActionMenu.stories.tsx
@@ -0,0 +1,76 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import HoverActionMenu, {
+  type HoverAction,
+} from "@app/components/shared/HoverActionMenu";
+import { iconMap } from "@app/components/tools/automate/iconMap";
+
+const { EditIcon, DeleteIcon, DownloadIcon } = iconMap;
+
+const actions: HoverAction[] = [
+  {
+    id: "edit",
+    icon: <EditIcon style={{ fontSize: 16 }} />,
+    label: "Edit",
+    onClick: () => {},
+  },
+  {
+    id: "download",
+    icon: <DownloadIcon style={{ fontSize: 16 }} />,
+    label: "Download",
+    onClick: () => {},
+  },
+  {
+    id: "delete",
+    icon: <DeleteIcon style={{ fontSize: 16 }} />,
+    label: "Delete",
+    onClick: () => {},
+    color: "var(--text-error)",
+  },
+];
+
+const meta: Meta<typeof HoverActionMenu> = {
+  title: "Shared/HoverActionMenu",
+  component: HoverActionMenu,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ position: "relative", width: "16rem", height: "4rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof HoverActionMenu>;
+
+/** Visible menu with the standard edit/download/delete action set. */
+export const Default: Story = {
+  args: {
+    show: true,
+    actions,
+  },
+};
+
+/** Hidden state (`show: false`) — menu stays mounted but faded/non-interactive. */
+export const Hidden: Story = {
+  args: {
+    show: false,
+    actions,
+  },
+};
+
+/** One action disabled with a custom tooltip explaining why. */
+export const WithDisabledAction: Story = {
+  args: {
+    show: true,
+    actions: [
+      actions[0],
+      actions[1],
+      {
+        ...actions[2],
+        disabled: true,
+        tooltip: "Deletion is restricted by policy",
+      },
+    ],
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/InfoBanner.stories.tsx b/frontend/editor/src/core/components/shared/InfoBanner.stories.tsx
new file mode 100644
index 0000000000..5fad071d05
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/InfoBanner.stories.tsx
@@ -0,0 +1,38 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { InfoBanner } from "@app/components/shared/InfoBanner";
+
+const meta = {
+  title: "Shared/InfoBanner",
+  component: InfoBanner,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof InfoBanner>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    icon: "info-rounded",
+    title: "Heads up",
+    message: "This document contains form fields that will be flattened.",
+  },
+};
+
+export const Warning: Story = {
+  args: {
+    tone: "warning",
+    icon: "warning-rounded",
+    title: "Action required",
+    message: "Some pages could not be processed and were skipped.",
+    buttonText: "Review",
+    onButtonClick: () => {},
+  },
+};
+
+export const Compact: Story = {
+  args: {
+    compact: true,
+    icon: "info-rounded",
+    message: "Autosave is enabled for this file.",
+    dismissible: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/LandingDocumentStack.stories.tsx b/frontend/editor/src/core/components/shared/LandingDocumentStack.stories.tsx
new file mode 100644
index 0000000000..e51e068ff9
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/LandingDocumentStack.stories.tsx
@@ -0,0 +1,13 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { LandingDocumentStack } from "@app/components/shared/LandingDocumentStack";
+
+/** Decorative stack only: window dots + grey bars — no props, no i18n. */
+const meta: Meta<typeof LandingDocumentStack> = {
+  title: "Shared/LandingDocumentStack",
+  component: LandingDocumentStack,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/core/components/shared/LanguageSelector.stories.tsx b/frontend/editor/src/core/components/shared/LanguageSelector.stories.tsx
new file mode 100644
index 0000000000..2ffcba96c1
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/LanguageSelector.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import LanguageSelector from "@app/components/shared/LanguageSelector";
+
+const meta = {
+  title: "Shared/LanguageSelector",
+  component: LanguageSelector,
+} satisfies Meta<typeof LanguageSelector>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Compact: Story = {
+  args: {
+    compact: true,
+    tooltip: "Change language",
+  },
+};
+
+export const TopStartPosition: Story = {
+  args: {
+    position: "top-start",
+    offset: 4,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/LoadingFallback.stories.tsx b/frontend/editor/src/core/components/shared/LoadingFallback.stories.tsx
new file mode 100644
index 0000000000..1ce948a671
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/LoadingFallback.stories.tsx
@@ -0,0 +1,13 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { LoadingFallback } from "@app/components/shared/LoadingFallback";
+
+/** Full-screen splash shown while i18next Suspense is loading translations. */
+const meta: Meta<typeof LoadingFallback> = {
+  title: "Shared/LoadingFallback",
+  component: LoadingFallback,
+  parameters: { layout: "fullscreen" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/core/components/shared/LocalIcon.stories.tsx b/frontend/editor/src/core/components/shared/LocalIcon.stories.tsx
new file mode 100644
index 0000000000..5f38ef168b
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/LocalIcon.stories.tsx
@@ -0,0 +1,32 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import LocalIcon from "@app/components/shared/LocalIcon";
+
+const meta: Meta<typeof LocalIcon> = {
+  title: "Shared/LocalIcon",
+  component: LocalIcon,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    icon: "description",
+    width: "2rem",
+    height: "2rem",
+  },
+};
+
+export const NumericSize: Story = {
+  args: {
+    icon: "download",
+    width: 32,
+  },
+};
+
+export const WithFullCollectionPrefix: Story = {
+  args: {
+    icon: "material-symbols:error-rounded",
+    width: "1.5rem",
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/LoginAgreementModal.stories.tsx b/frontend/editor/src/core/components/shared/LoginAgreementModal.stories.tsx
new file mode 100644
index 0000000000..d8b160692a
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/LoginAgreementModal.stories.tsx
@@ -0,0 +1,18 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import LoginAgreementModal from "@app/components/shared/LoginAgreementModal";
+
+/**
+ * Renders nothing by default: the modal only opens after fetching
+ * `/api/v1/config/login-disclaimer` and finding it enabled, which requires a
+ * live AppConfigProvider/backend. In Storybook (no providers configured) the
+ * config stays null, so the effect bails out and the component stays hidden.
+ */
+const meta: Meta<typeof LoginAgreementModal> = {
+  title: "Shared/LoginAgreementModal",
+  component: LoginAgreementModal,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/core/components/shared/MobileUploadModal.stories.tsx b/frontend/editor/src/core/components/shared/MobileUploadModal.stories.tsx
new file mode 100644
index 0000000000..58e7e86aa4
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/MobileUploadModal.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import MobileUploadModal from "@app/components/shared/MobileUploadModal";
+
+const meta: Meta<typeof MobileUploadModal> = {
+  title: "Shared/MobileUploadModal",
+  component: MobileUploadModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    onFilesReceived: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** QR code + instructions for scanning a file upload session from a phone. */
+export const Default: Story = {};
+
+/** Closed state — modal renders nothing visible. */
+export const Closed: Story = {
+  args: {
+    opened: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/MultiSelectControls.stories.tsx b/frontend/editor/src/core/components/shared/MultiSelectControls.stories.tsx
new file mode 100644
index 0000000000..cb8281399b
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/MultiSelectControls.stories.tsx
@@ -0,0 +1,34 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import MultiSelectControls from "@app/components/shared/MultiSelectControls";
+
+const meta: Meta<typeof MultiSelectControls> = {
+  title: "Shared/MultiSelectControls",
+  component: MultiSelectControls,
+  parameters: { layout: "padded" },
+  args: {
+    selectedCount: 3,
+    onClearSelection: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Only the always-present "Clear files" action, since none of the optional handlers are passed. */
+export const Default: Story = {};
+
+/** All optional actions supplied — every button in the group renders. */
+export const AllActions: Story = {
+  args: {
+    onAddToUpload: () => {},
+    onOpenInFileEditor: () => {},
+    onOpenInPageEditor: () => {},
+    onDeleteAll: () => {},
+  },
+};
+
+/** Renders nothing when no files are selected. */
+export const NoSelection: Story = {
+  args: {
+    selectedCount: 0,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/NavigationWarningModal.stories.tsx b/frontend/editor/src/core/components/shared/NavigationWarningModal.stories.tsx
new file mode 100644
index 0000000000..ac6636125e
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/NavigationWarningModal.stories.tsx
@@ -0,0 +1,103 @@
+import { useEffect, type ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import NavigationWarningModal from "@app/components/shared/NavigationWarningModal";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import {
+  NavigationProvider,
+  useNavigationGuard,
+  type NavigationWarningHandlers,
+} from "@app/contexts/NavigationContext";
+
+/**
+ * The modal renders nothing until NavigationContext has unsaved changes AND a
+ * pending navigation to warn about, so this drives both into place on mount —
+ * mirroring what a real editor does when it calls requestNavigation() while
+ * hasUnsavedChanges is true. It also registers any warning handlers the story
+ * supplies, since the modal only shows the "Apply & Leave"/"Export & Leave"
+ * buttons when a handler for them is present.
+ */
+function TriggerWarning({
+  children,
+  handlers,
+}: {
+  children: React.ReactNode;
+  handlers?: NavigationWarningHandlers;
+}) {
+  const {
+    hasUnsavedChanges,
+    setHasUnsavedChanges,
+    requestNavigation,
+    registerNavigationWarningHandlers,
+  } = useNavigationGuard();
+
+  useEffect(() => {
+    setHasUnsavedChanges(true);
+  }, [setHasUnsavedChanges]);
+
+  useEffect(() => {
+    if (handlers) {
+      registerNavigationWarningHandlers(handlers);
+    }
+  }, [handlers, registerNavigationWarningHandlers]);
+
+  useEffect(() => {
+    if (hasUnsavedChanges) {
+      requestNavigation(() => {});
+    }
+  }, [hasUnsavedChanges, requestNavigation]);
+
+  return <>{children}</>;
+}
+
+function withProviders(
+  Story: () => ReactElement,
+  context: { parameters: { navigationHandlers?: NavigationWarningHandlers } },
+) {
+  return (
+    <ToolRegistryProvider>
+      <NavigationProvider>
+        <TriggerWarning handlers={context.parameters.navigationHandlers}>
+          <Story />
+        </TriggerWarning>
+      </NavigationProvider>
+    </ToolRegistryProvider>
+  );
+}
+
+const meta = {
+  title: "Shared/NavigationWarningModal",
+  component: NavigationWarningModal,
+  decorators: [withProviders],
+} satisfies Meta<typeof NavigationWarningModal>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Unsaved changes plus a pending navigation trigger the confirmation dialog. */
+export const Default: Story = {};
+
+/**
+ * When the active tool registers an "apply and continue" handler (e.g. a
+ * pending edit that can be committed before leaving), the modal adds a third
+ * action alongside "Keep Working" and "Discard Changes".
+ */
+export const WithApplyAndContinue: Story = {
+  parameters: {
+    navigationHandlers: {
+      onApplyAndContinue: async () => {},
+    } satisfies NavigationWarningHandlers,
+  },
+};
+
+/**
+ * When the active tool registers an "export and continue" handler (e.g. a
+ * conversion tool that can export its result before leaving), the modal adds
+ * an "Export & Leave" action instead.
+ */
+export const WithExportAndContinue: Story = {
+  parameters: {
+    navigationHandlers: {
+      onExportAndContinue: async () => {},
+    } satisfies NavigationWarningHandlers,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/ObscuredOverlay.stories.tsx b/frontend/editor/src/core/components/shared/ObscuredOverlay.stories.tsx
new file mode 100644
index 0000000000..4b8d936cc5
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/ObscuredOverlay.stories.tsx
@@ -0,0 +1,49 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ObscuredOverlay from "@app/components/shared/ObscuredOverlay";
+
+const meta: Meta<typeof ObscuredOverlay> = {
+  title: "Shared/ObscuredOverlay",
+  component: ObscuredOverlay,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "22rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const Content = () => (
+  <div style={{ padding: "1rem", background: "var(--mantine-color-gray-1)" }}>
+    Underlying content that gets obscured.
+  </div>
+);
+
+export const Unobscured: Story = {
+  args: {
+    obscured: false,
+    children: <Content />,
+  },
+};
+
+export const Obscured: Story = {
+  args: {
+    obscured: true,
+    overlayMessage: "This feature requires an upgrade",
+    buttonText: "Upgrade",
+    onButtonClick: () => {},
+    children: <Content />,
+  },
+};
+
+export const RoundedCorners: Story = {
+  args: {
+    obscured: true,
+    overlayMessage: "Locked",
+    borderRadius: "0.5rem",
+    children: <Content />,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/PageSelectionSyntaxHint.stories.tsx b/frontend/editor/src/core/components/shared/PageSelectionSyntaxHint.stories.tsx
new file mode 100644
index 0000000000..e14d9dc030
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/PageSelectionSyntaxHint.stories.tsx
@@ -0,0 +1,35 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PageSelectionSyntaxHint from "@app/components/shared/PageSelectionSyntaxHint";
+
+const meta = {
+  title: "Shared/PageSelectionSyntaxHint",
+  component: PageSelectionSyntaxHint,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof PageSelectionSyntaxHint>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Valid syntax ("1-3,5") renders nothing — no hint shown. */
+export const Default: Story = {
+  args: {
+    input: "1-3,5",
+    maxPages: 10,
+  },
+};
+
+/** Malformed expression falls back to CSV parsing and shows the panel-style hint. */
+export const SyntaxError: Story = {
+  args: {
+    input: "abc",
+    maxPages: 10,
+  },
+};
+
+/** Same malformed input, compact variant used inline within a tool panel. */
+export const CompactSyntaxError: Story = {
+  args: {
+    input: "abc",
+    maxPages: 10,
+    variant: "compact",
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/PolicyBadges.stories.tsx b/frontend/editor/src/core/components/shared/PolicyBadges.stories.tsx
new file mode 100644
index 0000000000..81969bf615
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/PolicyBadges.stories.tsx
@@ -0,0 +1,44 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PolicyBadges } from "@app/components/shared/PolicyBadges";
+import type { FileItemPolicyRef } from "@app/components/shared/PolicyBadges";
+
+const mockPolicies: FileItemPolicyRef[] = [
+  { id: "policy-1", name: "Redact PII", accentColor: "#e03131", recent: true },
+  { id: "policy-2", name: "Sanitize", accentColor: "#2f9e44", recent: false },
+  { id: "policy-3", name: "Watermark", accentColor: "#4263eb", recent: false },
+];
+
+const meta = {
+  title: "Shared/PolicyBadges",
+  component: PolicyBadges,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof PolicyBadges>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    policies: mockPolicies,
+  },
+};
+
+export const Enforcing: Story = {
+  args: {
+    policies: [
+      {
+        id: "policy-1",
+        name: "Redact PII",
+        accentColor: "#e03131",
+        recent: false,
+        enforcing: true,
+      },
+      ...mockPolicies.slice(1),
+    ],
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    policies: [],
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/PrivateContent.stories.tsx b/frontend/editor/src/core/components/shared/PrivateContent.stories.tsx
new file mode 100644
index 0000000000..3103eb3962
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/PrivateContent.stories.tsx
@@ -0,0 +1,24 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PrivateContent } from "@app/components/shared/PrivateContent";
+
+/** Layout-invisible wrapper that tags sensitive content with 'ph-no-capture' to exclude it from analytics. */
+const meta: Meta<typeof PrivateContent> = {
+  title: "Shared/PrivateContent",
+  component: PrivateContent,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    children: "sensitive-filename.pdf",
+  },
+};
+
+export const WithCustomClassName: Story = {
+  args: {
+    children: "sensitive-filename.pdf",
+    className: "custom-class",
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/ShareFileModal.stories.tsx b/frontend/editor/src/core/components/shared/ShareFileModal.stories.tsx
new file mode 100644
index 0000000000..a616480d36
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/ShareFileModal.stories.tsx
@@ -0,0 +1,63 @@
+import type { ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ShareFileModal from "@app/components/shared/ShareFileModal";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const mockFile: StirlingFileStub = {
+  id: "story-file-1" as FileId,
+  name: "quarterly-report.pdf",
+  type: "application/pdf",
+  size: 2_400_000,
+  lastModified: Date.now(),
+  isLeaf: true,
+  originalFileId: "story-file-1",
+  versionNumber: 1,
+};
+
+/**
+ * ShareFileModal reads useFileActions() from FileContext (stood up here since
+ * it isn't part of the shared preview decorators) and useAppConfig() to gate
+ * share links on `storageShareLinksEnabled` — wrapped per-story to show both
+ * the disabled and enabled states.
+ */
+function withFileContext(Story: () => ReactElement) {
+  return (
+    <FileContextProvider>
+      <Story />
+    </FileContextProvider>
+  );
+}
+
+const meta = {
+  title: "Shared/ShareFileModal",
+  component: ShareFileModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    file: mockFile,
+  },
+  decorators: [withFileContext],
+} satisfies Meta<typeof ShareFileModal>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Share links disabled by server config — default when no config is loaded. */
+export const Default: Story = {};
+
+/** Share links enabled — the role selector and "Generate Link" action are active. */
+export const LinksEnabled: Story = {
+  decorators: [
+    (Story) => (
+      <AppConfigProvider
+        initialConfig={{ storageShareLinksEnabled: true }}
+        autoFetch={false}
+      >
+        <Story />
+      </AppConfigProvider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/shared/ShareManagementModal.stories.tsx b/frontend/editor/src/core/components/shared/ShareManagementModal.stories.tsx
new file mode 100644
index 0000000000..3fff68cbf3
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/ShareManagementModal.stories.tsx
@@ -0,0 +1,66 @@
+import type { ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ShareManagementModal from "@app/components/shared/ShareManagementModal";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const mockFile: StirlingFileStub = {
+  id: "story-file-1" as FileId,
+  name: "quarterly-report.pdf",
+  type: "application/pdf",
+  size: 2_400_000,
+  lastModified: Date.now(),
+  isLeaf: true,
+  originalFileId: "story-file-1",
+  versionNumber: 1,
+};
+
+/**
+ * ShareManagementModal reads useFileActions() from FileContext (stood up here
+ * since it isn't part of the shared preview decorators) and useAppConfig() to
+ * gate share links on `storageShareLinksEnabled` — wrapped per-story to show
+ * both the disabled and enabled states.
+ */
+function withFileContext(Story: () => ReactElement) {
+  return (
+    <FileContextProvider>
+      <Story />
+    </FileContextProvider>
+  );
+}
+
+const meta = {
+  title: "Shared/ShareManagementModal",
+  component: ShareManagementModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    file: mockFile,
+  },
+  decorators: [withFileContext],
+} satisfies Meta<typeof ShareManagementModal>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Share links disabled by server config — default when no config is loaded. */
+export const Default: Story = {};
+
+/** Share links enabled — the role selector, link generation and activity panel are active. */
+export const LinksEnabled: Story = {
+  decorators: [
+    (Story) => (
+      <AppConfigProvider
+        initialConfig={{
+          storageSharingEnabled: true,
+          storageShareLinksEnabled: true,
+        }}
+        autoFetch={false}
+      >
+        <Story />
+      </AppConfigProvider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/shared/SkeletonLoader.stories.tsx b/frontend/editor/src/core/components/shared/SkeletonLoader.stories.tsx
new file mode 100644
index 0000000000..50c754a3cf
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/SkeletonLoader.stories.tsx
@@ -0,0 +1,37 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SkeletonLoader from "@app/components/shared/SkeletonLoader";
+
+const meta: Meta<typeof SkeletonLoader> = {
+  title: "Shared/SkeletonLoader",
+  component: SkeletonLoader,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const PageGrid: Story = {
+  args: { type: "pageGrid", count: 4 },
+};
+
+export const FileGrid: Story = {
+  args: { type: "fileGrid", count: 4 },
+};
+
+export const Controls: Story = {
+  args: { type: "controls" },
+};
+
+export const Viewer: Story = {
+  args: { type: "viewer" },
+  decorators: [
+    (S) => (
+      <div style={{ height: "20rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+
+export const Block: Story = {
+  args: { type: "block", width: 120, height: 20 },
+};
diff --git a/frontend/editor/src/core/components/shared/ToolChain.stories.tsx b/frontend/editor/src/core/components/shared/ToolChain.stories.tsx
new file mode 100644
index 0000000000..b8ef29f9b5
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/ToolChain.stories.tsx
@@ -0,0 +1,56 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ToolChain from "@app/components/shared/ToolChain";
+import { ToolOperation } from "@app/types/file";
+
+function op(toolId: ToolOperation["toolId"], timestamp: number): ToolOperation {
+  return { toolId, timestamp };
+}
+
+const shortChain: ToolOperation[] = [op("watermark", 1), op("ocr", 2)];
+
+const longChain: ToolOperation[] = [
+  op("split", 1),
+  op("merge", 2),
+  op("watermark", 3),
+  op("ocr", 4),
+  op("rotate", 5),
+];
+
+const meta = {
+  title: "Shared/ToolChain",
+  component: ToolChain,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ToolChain>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Default text style, short chain (no truncation needed). */
+export const Default: Story = {
+  args: {
+    toolChain: shortChain,
+  },
+};
+
+/** Text style with a long chain — truncates to first → +N → last, with a tooltip for the full chain. */
+export const TextTruncated: Story = {
+  args: {
+    toolChain: longChain,
+    displayStyle: "text",
+  },
+};
+
+/** Badge style — shows up to 3 badges, with "..." + final badge and a tooltip when longer. */
+export const Badges: Story = {
+  args: {
+    toolChain: longChain,
+    displayStyle: "badges",
+  },
+};
+
+/** Compact style — collapses to a tool count once more than one tool is present. */
+export const Compact: Story = {
+  args: {
+    toolChain: longChain,
+    displayStyle: "compact",
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/ToolIcon.stories.tsx b/frontend/editor/src/core/components/shared/ToolIcon.stories.tsx
new file mode 100644
index 0000000000..8994f34157
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/ToolIcon.stories.tsx
@@ -0,0 +1,35 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { iconMap } from "@app/components/tools/automate/iconMap";
+import { ToolIcon } from "@app/components/shared/ToolIcon";
+
+const { PictureAsPdfIcon } = iconMap;
+
+const meta = {
+  title: "Shared/ToolIcon",
+  component: ToolIcon,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ToolIcon>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    icon: <PictureAsPdfIcon />,
+  },
+};
+
+/** Visually unavailable state, for tools the user can't run. */
+export const ReducedOpacity: Story = {
+  args: {
+    icon: <PictureAsPdfIcon />,
+    opacity: 0.25,
+  },
+};
+
+/** No right margin, for inline placement. */
+export const NoMargin: Story = {
+  args: {
+    icon: <PictureAsPdfIcon />,
+    marginRight: "0",
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/ToolPanelHeader.stories.tsx b/frontend/editor/src/core/components/shared/ToolPanelHeader.stories.tsx
new file mode 100644
index 0000000000..bfcaedba4f
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/ToolPanelHeader.stories.tsx
@@ -0,0 +1,28 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SettingsIcon from "@mui/icons-material/Settings";
+import { ToolPanelHeader } from "@app/components/shared/ToolPanelHeader";
+
+const meta: Meta<typeof ToolPanelHeader> = {
+  title: "Shared/ToolPanelHeader",
+  component: ToolPanelHeader,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    icon: <SettingsIcon sx={{ fontSize: 18 }} />,
+    title: "Split",
+  },
+};
+
+/** Trailing close button only renders when `onClose` is supplied. */
+export const WithCloseButton: Story = {
+  args: {
+    icon: <SettingsIcon sx={{ fontSize: 18 }} />,
+    title: "Split",
+    onClose: () => {},
+    closeLabel: "Close tool panel",
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/UpdateModal.stories.tsx b/frontend/editor/src/core/components/shared/UpdateModal.stories.tsx
new file mode 100644
index 0000000000..9d7626edbf
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/UpdateModal.stories.tsx
@@ -0,0 +1,79 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import UpdateModal from "@app/components/shared/UpdateModal";
+import type { UpdateSummary, MachineInfo } from "@app/services/updateService";
+
+const UPDATE_SUMMARY: UpdateSummary = {
+  latest_version: "2.5.0",
+  latest_stable_version: "2.5.0",
+  max_priority: "normal",
+  recommended_action: "This update contains important fixes and improvements.",
+  any_breaking: false,
+  migration_guides: [
+    {
+      version: "2.5.0",
+      notes: "Config file format changed for custom watermark presets.",
+      url: "https://docs.stirlingpdf.com/migration/2.5.0",
+    },
+  ],
+};
+
+const MACHINE_INFO: MachineInfo = {
+  machineType: "Client-win",
+  activeSecurity: false,
+  licenseType: "NORMAL",
+};
+
+const meta = {
+  title: "Shared/UpdateModal",
+  component: UpdateModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    currentVersion: "2.4.0",
+    updateSummary: UPDATE_SUMMARY,
+    machineInfo: MACHINE_INFO,
+    downloadSizeBytes: 235_000_000,
+  },
+} satisfies Meta<typeof UpdateModal>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Web/server build: no Tauri updater, so the footer offers a plain download link. */
+export const Default: Story = {};
+
+/** Desktop app: an update has finished installing and is waiting for a restart. */
+export const DesktopInstallReadyToRestart: Story = {
+  args: {
+    desktopInstall: {
+      state: "ready-to-restart",
+      progress: null,
+      errorMessage: null,
+      actions: {
+        startInstall: async () => true,
+        restartApp: async () => {},
+      },
+    },
+  },
+};
+
+/** Desktop app on a non-admin machine: install probe reported it can't write to
+ * the install directory, so Install Now is disabled and the docs alert shows. */
+export const DesktopInstallBlocked: Story = {
+  args: {
+    desktopInstall: {
+      state: "idle",
+      progress: null,
+      errorMessage: null,
+      actions: {
+        startInstall: async () => true,
+        restartApp: async () => {},
+      },
+      canInstall: {
+        canInstall: false,
+        reason: "Install directory is not writable without elevation.",
+      },
+    },
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/UpdateStartupPopup.stories.tsx b/frontend/editor/src/core/components/shared/UpdateStartupPopup.stories.tsx
new file mode 100644
index 0000000000..4abfdece22
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/UpdateStartupPopup.stories.tsx
@@ -0,0 +1,63 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { UpdateStartupPopup } from "@app/components/shared/UpdateStartupPopup";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+
+/**
+ * Startup update-check popup — renders null until an update is detected, so
+ * every story here shows an empty canvas. The stories exercise the gating
+ * logic (`isUpdatePopupAllowed`) rather than the (invisible) update-found UI,
+ * which additionally requires a real startup delay + network round trip.
+ */
+const meta = {
+  title: "Shared/UpdateStartupPopup",
+  component: UpdateStartupPopup,
+} satisfies Meta<typeof UpdateStartupPopup>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** No app config resolved yet — gate is closed, renders nothing. */
+export const Default: Story = {};
+
+/** Config resolved but `shouldShowUpdate` is false — gate stays closed. */
+export const UpdatesDisabled: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{
+          appVersion: "1.2.3",
+          shouldShowUpdate: false,
+        }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
+
+/**
+ * Gate is open (`shouldShowUpdate: true`), so the startup timer would fire and
+ * check for an update — but the modal itself only appears once that check
+ * resolves with a newer version, well after the 15s startup delay.
+ */
+export const UpdatesEnabled: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{
+          appVersion: "1.2.3",
+          shouldShowUpdate: true,
+          machineType: "docker",
+          activeSecurity: false,
+          license: "NORMAL",
+        }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/shared/UploadToServerModal.stories.tsx b/frontend/editor/src/core/components/shared/UploadToServerModal.stories.tsx
new file mode 100644
index 0000000000..50f1e9e0ad
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/UploadToServerModal.stories.tsx
@@ -0,0 +1,62 @@
+import type { ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import UploadToServerModal from "@app/components/shared/UploadToServerModal";
+import { FileContextProvider } from "@app/contexts/FileContext";
+import type { StirlingFileStub } from "@app/types/fileContext";
+import type { FileId } from "@app/types/file";
+
+const mockFile: StirlingFileStub = {
+  id: "file-1" as FileId,
+  name: "quarterly-report.pdf",
+  type: "application/pdf",
+  size: 2_400_000,
+  lastModified: Date.now(),
+  isLeaf: true,
+  originalFileId: "file-1" as FileId,
+  versionNumber: 1,
+};
+
+const mockUploadedFile: StirlingFileStub = {
+  ...mockFile,
+  id: "file-2" as FileId,
+  originalFileId: "file-2" as FileId,
+  remoteStorageId: 2,
+};
+
+/**
+ * The modal dispatches updateStirlingFileStub on upload, so it needs
+ * FileContext (also supplies IndexedDBContext) mounted above it.
+ */
+function withProviders(Story: () => ReactElement) {
+  return (
+    <FileContextProvider>
+      <Story />
+    </FileContextProvider>
+  );
+}
+
+const meta = {
+  title: "Shared/UploadToServerModal",
+  component: UploadToServerModal,
+  decorators: [withProviders],
+  args: {
+    onClose: () => {},
+  },
+} satisfies Meta<typeof UploadToServerModal>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    opened: true,
+    file: mockFile,
+  },
+};
+
+export const AlreadyUploaded: Story = {
+  args: {
+    opened: true,
+    file: mockUploadedFile,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/UserSelector.stories.tsx b/frontend/editor/src/core/components/shared/UserSelector.stories.tsx
new file mode 100644
index 0000000000..760eb0f5ee
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/UserSelector.stories.tsx
@@ -0,0 +1,29 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import UserSelector from "@app/components/shared/UserSelector";
+
+/**
+ * Fetches `/api/v1/user/users` on mount — unmocked here, so stories render
+ * whatever the fetch settles to (loader, then the "no users" empty state).
+ */
+const meta = {
+  title: "Shared/UserSelector",
+  component: UserSelector,
+  parameters: { layout: "padded" },
+  args: {
+    value: [],
+    onChange: () => {},
+  },
+} satisfies Meta<typeof UserSelector>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Disabled: Story = {
+  args: { disabled: true },
+};
+
+export const CustomPlaceholder: Story = {
+  args: { placeholder: "Add collaborators..." },
+};
diff --git a/frontend/editor/src/core/components/shared/ZipWarningModal.stories.tsx b/frontend/editor/src/core/components/shared/ZipWarningModal.stories.tsx
new file mode 100644
index 0000000000..4f43ee145c
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/ZipWarningModal.stories.tsx
@@ -0,0 +1,30 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ZipWarningModal from "@app/components/shared/ZipWarningModal";
+
+const meta: Meta<typeof ZipWarningModal> = {
+  title: "Shared/ZipWarningModal",
+  component: ZipWarningModal,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    opened: true,
+    fileCount: 42,
+    zipFileName: "large-archive.zip",
+    onConfirm: () => {},
+    onCancel: () => {},
+  },
+};
+
+export const SingleFile: Story = {
+  args: {
+    opened: true,
+    fileCount: 1,
+    zipFileName: "small-archive.zip",
+    onConfirm: () => {},
+    onCancel: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/config/LoginRequiredBanner.stories.tsx b/frontend/editor/src/core/components/shared/config/LoginRequiredBanner.stories.tsx
new file mode 100644
index 0000000000..7544729824
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/LoginRequiredBanner.stories.tsx
@@ -0,0 +1,22 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import LoginRequiredBanner from "@app/components/shared/config/LoginRequiredBanner";
+
+const meta = {
+  title: "Shared/Config/LoginRequiredBanner",
+  component: LoginRequiredBanner,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof LoginRequiredBanner>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    show: true,
+  },
+};
+
+export const Hidden: Story = {
+  args: {
+    show: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/config/OverviewHeader.stories.tsx b/frontend/editor/src/core/components/shared/config/OverviewHeader.stories.tsx
new file mode 100644
index 0000000000..0dc2b09db3
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/OverviewHeader.stories.tsx
@@ -0,0 +1,12 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { OverviewHeader } from "@app/components/shared/config/OverviewHeader";
+
+const meta = {
+  title: "Shared/Config/OverviewHeader",
+  component: OverviewHeader,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof OverviewHeader>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/core/components/shared/config/PendingBadge.stories.tsx b/frontend/editor/src/core/components/shared/config/PendingBadge.stories.tsx
new file mode 100644
index 0000000000..85df5f4243
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/PendingBadge.stories.tsx
@@ -0,0 +1,29 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PendingBadge from "@app/components/shared/config/PendingBadge";
+
+const meta = {
+  title: "Shared/Config/PendingBadge",
+  component: PendingBadge,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof PendingBadge>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    show: true,
+  },
+};
+
+export const Hidden: Story = {
+  args: {
+    show: false,
+  },
+};
+
+export const LargeSize: Story = {
+  args: {
+    show: true,
+    size: "lg",
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/config/RestartConfirmationModal.stories.tsx b/frontend/editor/src/core/components/shared/config/RestartConfirmationModal.stories.tsx
new file mode 100644
index 0000000000..d9f250da6e
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/RestartConfirmationModal.stories.tsx
@@ -0,0 +1,26 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RestartConfirmationModal from "@app/components/shared/config/RestartConfirmationModal";
+
+const meta = {
+  title: "Shared/Config/RestartConfirmationModal",
+  component: RestartConfirmationModal,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof RestartConfirmationModal>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    opened: true,
+    onClose: () => {},
+    onRestart: () => {},
+  },
+};
+
+export const Closed: Story = {
+  args: {
+    opened: false,
+    onClose: () => {},
+    onRestart: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/config/SettingsSearchBar.stories.tsx b/frontend/editor/src/core/components/shared/config/SettingsSearchBar.stories.tsx
new file mode 100644
index 0000000000..28d5a1c3e0
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/SettingsSearchBar.stories.tsx
@@ -0,0 +1,62 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SettingsSearchBar } from "@app/components/shared/config/SettingsSearchBar";
+import type { ConfigNavSection } from "@app/components/shared/config/configNavSections";
+
+const mockConfigNavSections: ConfigNavSection[] = [
+  {
+    title: "Preferences",
+    items: [
+      {
+        key: "general",
+        label: "General",
+        icon: "settings-rounded",
+        component: null,
+      },
+      {
+        key: "hotkeys",
+        label: "Keyboard Shortcuts",
+        icon: "keyboard-rounded",
+        component: null,
+      },
+    ],
+  },
+  {
+    title: "Workspace",
+    items: [
+      {
+        key: "people",
+        label: "People",
+        icon: "group-rounded",
+        component: null,
+      },
+      {
+        key: "teams",
+        label: "Teams",
+        icon: "groups-rounded",
+        component: null,
+        disabled: true,
+      },
+    ],
+  },
+];
+
+const meta = {
+  title: "Shared/Config/SettingsSearchBar",
+  component: SettingsSearchBar,
+  parameters: { layout: "padded" },
+  args: {
+    configNavSections: mockConfigNavSections,
+    onNavigate: async () => {},
+    isMobile: false,
+  },
+} satisfies Meta<typeof SettingsSearchBar>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Mobile: Story = {
+  args: {
+    isMobile: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/config/SettingsStickyFooter.stories.tsx b/frontend/editor/src/core/components/shared/config/SettingsStickyFooter.stories.tsx
new file mode 100644
index 0000000000..ae94dd7117
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/SettingsStickyFooter.stories.tsx
@@ -0,0 +1,34 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SettingsStickyFooter } from "@app/components/shared/config/SettingsStickyFooter";
+
+const meta = {
+  title: "Shared/Config/SettingsStickyFooter",
+  component: SettingsStickyFooter,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof SettingsStickyFooter>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    isDirty: true,
+    saving: false,
+    loginEnabled: true,
+    onSave: () => {},
+    onDiscard: () => {},
+  },
+};
+
+export const Saving: Story = {
+  args: {
+    ...Default.args,
+    saving: true,
+  },
+};
+
+export const Hidden: Story = {
+  args: {
+    ...Default.args,
+    isDirty: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.stories.tsx b/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.stories.tsx
new file mode 100644
index 0000000000..08047afb17
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/configSections/GeneralSection.stories.tsx
@@ -0,0 +1,71 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import GeneralSection from "@app/components/shared/config/configSections/GeneralSection";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { ThemeProvider } from "@app/components/shared/ThemeProvider";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+
+// Reads theme/tool-panel preferences via usePreferences()/useTheme() and server
+// config via useAppConfig() — none of which the Storybook preview's own provider
+// tree supplies (those are the portal contexts), so wrap here. AppConfigProvider
+// uses autoFetch off so stories render a fixed config instead of hitting the API.
+const meta = {
+  title: "Shared/Config/ConfigSections/GeneralSection",
+  component: GeneralSection,
+  parameters: { layout: "padded" },
+  decorators: [
+    (Story) => (
+      <PreferencesProvider>
+        <ThemeProvider>
+          <Story />
+        </ThemeProvider>
+      </PreferencesProvider>
+    ),
+  ],
+} satisfies Meta<typeof GeneralSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Login enabled, no backend version known yet — Software Updates section and admin banner stay hidden. */
+export const Default: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: true }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
+
+/** Backend version known — shows the Software Updates section with version info. */
+export const WithBackendVersion: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: true, appVersion: "1.2.3" }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
+
+/** Login disabled — the "For System Administrators" banner shows, prompting the env vars to enable it. */
+export const AdminBanner: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: false }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/shared/config/configSections/HelpSection.stories.tsx b/frontend/editor/src/core/components/shared/config/configSections/HelpSection.stories.tsx
new file mode 100644
index 0000000000..d7ad738458
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/configSections/HelpSection.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import HelpSection from "@app/components/shared/config/configSections/HelpSection";
+
+const meta = {
+  title: "Shared/Config/ConfigSections/HelpSection",
+  component: HelpSection,
+  parameters: { layout: "padded" },
+  args: {
+    onRequestClose: () => {},
+  },
+} satisfies Meta<typeof HelpSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    isAdmin: false,
+  },
+};
+
+export const Admin: Story = {
+  args: {
+    isAdmin: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.stories.tsx b/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.stories.tsx
new file mode 100644
index 0000000000..94420ad5cd
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/configSections/HotkeysSection.stories.tsx
@@ -0,0 +1,40 @@
+import type { ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import HotkeysSection from "@app/components/shared/config/configSections/HotkeysSection";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { NavigationProvider } from "@app/contexts/NavigationContext";
+import { ToolWorkflowProvider } from "@app/contexts/ToolWorkflowContext";
+import { HotkeyProvider } from "@app/contexts/HotkeyContext";
+
+/**
+ * HotkeyContext reads the tool registry and selection state off
+ * ToolWorkflowContext, so both providers must wrap the story.
+ */
+function withProviders(Story: () => ReactElement) {
+  return (
+    <PreferencesProvider>
+      <ToolRegistryProvider>
+        <NavigationProvider>
+          <ToolWorkflowProvider>
+            <HotkeyProvider>
+              <Story />
+            </HotkeyProvider>
+          </ToolWorkflowProvider>
+        </NavigationProvider>
+      </ToolRegistryProvider>
+    </PreferencesProvider>
+  );
+}
+
+const meta = {
+  title: "Shared/Config/ConfigSections/HotkeysSection",
+  component: HotkeysSection,
+  decorators: [withProviders],
+} satisfies Meta<typeof HotkeysSection>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Full tool list with default keyboard shortcuts assigned. */
+export const Default: Story = {};
diff --git a/frontend/editor/src/core/components/shared/config/configSections/LegalSection.stories.tsx b/frontend/editor/src/core/components/shared/config/configSections/LegalSection.stories.tsx
new file mode 100644
index 0000000000..6b0c958725
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/configSections/LegalSection.stories.tsx
@@ -0,0 +1,74 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import LegalSection from "@app/components/shared/config/configSections/LegalSection";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+
+// Reads legal document links and the analytics flag via useAppConfig() (the
+// preview's own provider tree doesn't supply this — that's the portal
+// context), so wrap here. AppConfigProvider uses autoFetch off so stories
+// render a fixed config instead of hitting the API.
+const meta = {
+  title: "Shared/Config/ConfigSections/LegalSection",
+  component: LegalSection,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof LegalSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** All optional legal documents configured, analytics disabled — no Cookie Preferences card. */
+export const Default: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{
+          enableAnalytics: false,
+          privacyPolicy: "https://example.com/privacy",
+          termsAndConditions: "https://example.com/terms",
+          accessibilityStatement: "https://example.com/accessibility",
+          cookiePolicy: "https://example.com/cookies",
+          impressum: "https://example.com/impressum",
+        }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
+
+/** Analytics enabled — adds the Cookie Preferences card with its "Manage" button. */
+export const WithAnalyticsEnabled: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{
+          enableAnalytics: true,
+          privacyPolicy: "https://example.com/privacy",
+          termsAndConditions: "https://example.com/terms",
+          accessibilityStatement: "https://example.com/accessibility",
+          cookiePolicy: "https://example.com/cookies",
+          impressum: "https://example.com/impressum",
+        }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
+
+/** No legal documents configured — only Privacy Policy and Terms show, using the stirling.com fallback links. */
+export const MinimalLinks: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableAnalytics: false }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/shared/config/configSections/Overview.stories.tsx b/frontend/editor/src/core/components/shared/config/configSections/Overview.stories.tsx
new file mode 100644
index 0000000000..9b04d088e9
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/configSections/Overview.stories.tsx
@@ -0,0 +1,59 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import Overview from "@app/components/shared/config/configSections/Overview";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+
+// Reads config via useAppConfig() — no props. Wrap in AppConfigProvider with
+// autoFetch off so stories render a fixed config instead of hitting the API.
+const meta = {
+  title: "Shared/Config/Overview",
+  component: Overview,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof Overview>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** No config resolved yet (default context state) — shows the loading spinner. */
+export const Default: Story = {};
+
+/** Config loaded — renders the basic/security/system/integration sections. */
+export const Loaded: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{
+          appNameNavbar: "Stirling PDF",
+          baseUrl: "https://stirlingpdf.example.com",
+          contextPath: "/",
+          serverPort: 8080,
+          enableLogin: true,
+          enableAlphaFunctionality: false,
+          enableAnalytics: true,
+          SSOAutoLogin: false,
+        }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
+
+/** Config resolved but carrying a server-reported warning. */
+export const WithWarning: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{
+          appNameNavbar: "Stirling PDF",
+          enableLogin: true,
+          error: "Failed to load some settings from disk; using defaults.",
+        }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.stories.tsx b/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.stories.tsx
new file mode 100644
index 0000000000..0d7a44c38f
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.stories.tsx
@@ -0,0 +1,80 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ProviderCard from "@app/components/shared/config/configSections/ProviderCard";
+import type { Provider } from "@app/components/shared/config/configSections/providerDefinitions";
+
+const mockProvider: Provider = {
+  id: "google",
+  name: "Google",
+  icon: "key-rounded",
+  type: "oauth2",
+  scope: "Sign-in authentication",
+  documentationUrl: "https://docs.stirlingpdf.com/Configuration/OAuth",
+  fields: [
+    {
+      key: "clientId",
+      type: "text",
+      label: "Client ID",
+      description: "The OAuth2 client ID from Google Cloud Console",
+      placeholder: "your-client-id.apps.googleusercontent.com",
+    },
+    {
+      key: "clientSecret",
+      type: "password",
+      label: "Client Secret",
+      description: "The OAuth2 client secret from Google Cloud Console",
+    },
+    {
+      key: "scopes",
+      type: "tags",
+      label: "Scopes",
+      description: "OAuth2 scopes to request",
+      defaultValue: ["email", "profile"],
+    },
+    {
+      key: "autoProvision",
+      type: "switch",
+      label: "Auto Provision Users",
+      description: "Automatically create accounts for new sign-ins",
+      defaultValue: false,
+    },
+  ],
+};
+
+const meta = {
+  title: "Shared/Config/ConfigSections/ProviderCard",
+  component: ProviderCard,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ProviderCard>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    provider: mockProvider,
+    isConfigured: false,
+  },
+};
+
+export const Configured: Story = {
+  args: {
+    provider: mockProvider,
+    isConfigured: true,
+    settings: {
+      clientId: "example-client-id.apps.googleusercontent.com",
+      scopes: ["email", "profile"],
+      autoProvision: true,
+    },
+  },
+};
+
+export const ReadOnly: Story = {
+  args: {
+    provider: mockProvider,
+    isConfigured: true,
+    readOnly: true,
+    settings: {
+      clientId: "example-client-id.apps.googleusercontent.com",
+      scopes: ["email", "profile"],
+    },
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.tsx b/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.tsx
index 93999ce438..c24178635c 100644
--- a/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.tsx
+++ b/frontend/editor/src/core/components/shared/config/configSections/ProviderCard.tsx
@@ -32,10 +32,16 @@ interface ProviderCardProps {
   readOnly?: boolean;
 }
 
+// Shared default so an omitted `settings` prop keeps the same identity across
+// renders. An inline `settings = {}` would allocate a new object every render,
+// and the sync effect below lists `settings` as a dependency — so it would
+// re-run and setState on every render, looping until React bails out.
+const NO_SETTINGS: Record<string, any> = {};
+
 export default function ProviderCard({
   provider,
   isConfigured,
-  settings = {},
+  settings = NO_SETTINGS,
   onSave,
   onDisconnect,
   onChange,
diff --git a/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.stories.tsx b/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.stories.tsx
new file mode 100644
index 0000000000..7d149b2b3b
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.stories.tsx
@@ -0,0 +1,18 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ThirdPartyLicensesSection, {
+  FrontendThirdPartyLicensesSection,
+} from "@app/components/shared/config/configSections/ThirdPartyLicensesSection";
+
+const meta = {
+  title: "Shared/Config/ConfigSections/ThirdPartyLicensesSection",
+  component: ThirdPartyLicensesSection,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ThirdPartyLicensesSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Frontend: Story = {
+  render: () => <FrontendThirdPartyLicensesSection />,
+};
diff --git a/frontend/editor/src/core/components/shared/filePreview/DocumentStack.stories.tsx b/frontend/editor/src/core/components/shared/filePreview/DocumentStack.stories.tsx
new file mode 100644
index 0000000000..f76bc47831
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/filePreview/DocumentStack.stories.tsx
@@ -0,0 +1,51 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Box } from "@mantine/core";
+import DocumentStack from "@app/components/shared/filePreview/DocumentStack";
+
+const meta = {
+  title: "Shared/FilePreview/DocumentStack",
+  component: DocumentStack,
+  parameters: { layout: "padded" },
+  decorators: [
+    (Story) => (
+      <Box style={{ width: 200, height: 260 }}>
+        <Story />
+      </Box>
+    ),
+  ],
+} satisfies Meta<typeof DocumentStack>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const previewContent = (
+  <Box
+    style={{
+      width: "100%",
+      height: "100%",
+      backgroundColor: "var(--mantine-color-body)",
+      border: "1px solid var(--mantine-color-gray-4)",
+    }}
+  />
+);
+
+export const SingleFile: Story = {
+  args: {
+    totalFiles: 1,
+    children: previewContent,
+  },
+};
+
+export const TwoFiles: Story = {
+  args: {
+    totalFiles: 2,
+    children: previewContent,
+  },
+};
+
+export const ManyFiles: Story = {
+  args: {
+    totalFiles: 5,
+    children: previewContent,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/filePreview/DocumentThumbnail.stories.tsx b/frontend/editor/src/core/components/shared/filePreview/DocumentThumbnail.stories.tsx
new file mode 100644
index 0000000000..d410c3af78
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/filePreview/DocumentThumbnail.stories.tsx
@@ -0,0 +1,49 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import DocumentThumbnail from "@app/components/shared/filePreview/DocumentThumbnail";
+
+const mockFile = new File(["dummy content"], "sample-report.pdf", {
+  type: "application/pdf",
+});
+
+const meta = {
+  title: "Shared/FilePreview/DocumentThumbnail",
+  component: DocumentThumbnail,
+  parameters: { layout: "padded" },
+  args: {
+    file: mockFile,
+  },
+  decorators: [
+    (Story) => (
+      <div style={{ width: 160, height: 200 }}>
+        <Story />
+      </div>
+    ),
+  ],
+} satisfies Meta<typeof DocumentThumbnail>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const WithThumbnail: Story = {
+  args: {
+    thumbnail:
+      "data:image/svg+xml;utf8," +
+      encodeURIComponent(
+        '<svg xmlns="http://www.w3.org/2000/svg" width="120" height="160"><rect width="120" height="160" fill="#e0e0e0"/></svg>',
+      ),
+  },
+};
+
+export const Encrypted: Story = {
+  args: {
+    isEncrypted: true,
+  },
+};
+
+export const Loading: Story = {
+  args: {
+    isLoading: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/filePreview/HoverOverlay.stories.tsx b/frontend/editor/src/core/components/shared/filePreview/HoverOverlay.stories.tsx
new file mode 100644
index 0000000000..560d129843
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/filePreview/HoverOverlay.stories.tsx
@@ -0,0 +1,31 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Box, Text } from "@mantine/core";
+import HoverOverlay from "@app/components/shared/filePreview/HoverOverlay";
+
+const meta = {
+  title: "Shared/FilePreview/HoverOverlay",
+  component: HoverOverlay,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof HoverOverlay>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    children: (
+      <Box
+        style={{
+          width: 160,
+          height: 200,
+          display: "flex",
+          alignItems: "center",
+          justifyContent: "center",
+          backgroundColor: "var(--mantine-color-gray-2)",
+          borderRadius: "0.25rem",
+        }}
+      >
+        <Text size="sm">Page thumbnail</Text>
+      </Box>
+    ),
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/filePreview/NavigationArrows.stories.tsx b/frontend/editor/src/core/components/shared/filePreview/NavigationArrows.stories.tsx
new file mode 100644
index 0000000000..76a6fbc99e
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/filePreview/NavigationArrows.stories.tsx
@@ -0,0 +1,34 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import NavigationArrows from "@app/components/shared/filePreview/NavigationArrows";
+
+const meta = {
+  title: "Shared/FilePreview/NavigationArrows",
+  component: NavigationArrows,
+  parameters: { layout: "padded" },
+  args: {
+    onPrevious: () => {},
+    onNext: () => {},
+  },
+  decorators: [
+    (Story) => (
+      <div style={{ position: "relative", width: "20rem", height: "12rem" }}>
+        <Story />
+      </div>
+    ),
+  ],
+} satisfies Meta<typeof NavigationArrows>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    children: <div>Page 1 of 5</div>,
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+    children: <div>Page 1 of 1</div>,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/quickAccessBar/QuickAccessButton.stories.tsx b/frontend/editor/src/core/components/shared/quickAccessBar/QuickAccessButton.stories.tsx
new file mode 100644
index 0000000000..cc984b007f
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/quickAccessBar/QuickAccessButton.stories.tsx
@@ -0,0 +1,46 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import HomeIcon from "@mui/icons-material/HomeRounded";
+import QuickAccessButton from "@app/components/shared/quickAccessBar/QuickAccessButton";
+
+const meta = {
+  title: "Shared/QuickAccessBar/QuickAccessButton",
+  component: QuickAccessButton,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ display: "flex", gap: "1rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+} satisfies Meta<typeof QuickAccessButton>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    icon: <HomeIcon sx={{ fontSize: "1.5rem" }} />,
+    label: "Home",
+    isActive: false,
+    ariaLabel: "Home",
+  },
+};
+
+export const Active: Story = {
+  args: {
+    icon: <HomeIcon sx={{ fontSize: "1.875rem" }} />,
+    label: "Home",
+    isActive: true,
+    ariaLabel: "Home",
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    icon: <HomeIcon sx={{ fontSize: "1.5rem" }} />,
+    label: "Home",
+    isActive: false,
+    ariaLabel: "Home",
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/signing/CreateSessionFlow.stories.tsx b/frontend/editor/src/core/components/shared/signing/CreateSessionFlow.stories.tsx
new file mode 100644
index 0000000000..9de692e597
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/signing/CreateSessionFlow.stories.tsx
@@ -0,0 +1,71 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { CreateSessionFlow } from "@app/components/shared/signing/CreateSessionFlow";
+import type { FileState } from "@app/types/file";
+
+const mockFile: FileState = {
+  name: "contract.pdf",
+  size: 245_760,
+};
+
+function CreateSessionFlowDemo({
+  initialFiles,
+}: {
+  initialFiles: FileState[];
+}) {
+  const [selectedUserIds, setSelectedUserIds] = useState<number[]>([]);
+  const [dueDate, setDueDate] = useState("");
+
+  return (
+    <CreateSessionFlow
+      selectedFiles={initialFiles}
+      selectedUserIds={selectedUserIds}
+      onSelectedUserIdsChange={setSelectedUserIds}
+      dueDate={dueDate}
+      onDueDateChange={setDueDate}
+      creating={false}
+      onSubmit={() => {}}
+    />
+  );
+}
+
+const meta = {
+  title: "Shared/Signing/CreateSessionFlow",
+  component: CreateSessionFlow,
+  parameters: { layout: "padded" },
+  args: {
+    selectedFiles: [mockFile],
+    selectedUserIds: [],
+    onSelectedUserIdsChange: () => {},
+    dueDate: "",
+    onDueDateChange: () => {},
+    creating: false,
+    onSubmit: () => {},
+  },
+} satisfies Meta<typeof CreateSessionFlow>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** A single file is selected, so step 1 shows its picker instead of the "no file" message. */
+export const Default: Story = {
+  render: () => <CreateSessionFlowDemo initialFiles={[mockFile]} />,
+};
+
+/** No file selected yet: step 1 shows the empty-state prompt instead of the document picker. */
+export const NoFileSelected: Story = {
+  render: () => <CreateSessionFlowDemo initialFiles={[]} />,
+};
+
+/** Session creation in flight: the review step's submit action is disabled. */
+export const Creating: Story = {
+  args: {
+    selectedFiles: [mockFile],
+    selectedUserIds: [1, 2],
+    onSelectedUserIdsChange: () => {},
+    dueDate: "2026-08-01",
+    onDueDateChange: () => {},
+    creating: true,
+    onSubmit: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/signing/SharedSigningLauncher.stories.tsx b/frontend/editor/src/core/components/shared/signing/SharedSigningLauncher.stories.tsx
new file mode 100644
index 0000000000..ae08d23771
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/signing/SharedSigningLauncher.stories.tsx
@@ -0,0 +1,104 @@
+import type React from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import SharedSigningLauncher from "@app/components/shared/signing/SharedSigningLauncher";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { NavigationProvider } from "@app/contexts/NavigationContext";
+import { ToolWorkflowProvider } from "@app/contexts/ToolWorkflowContext";
+import type { SignRequestSummary } from "@app/types/signingSession";
+
+/**
+ * SharedSigningLauncher reads server config via AppConfigContext (whether
+ * group signing is enabled) and tool selection via ToolWorkflowContext (the
+ * "Open shared signing" click target), so both must wrap it here.
+ */
+function withProviders(groupSigningEnabled: boolean) {
+  return function Decorator(Story: () => React.JSX.Element) {
+    return (
+      <AppConfigProvider
+        autoFetch={false}
+        initialConfig={{ storageGroupSigningEnabled: groupSigningEnabled }}
+      >
+        <PreferencesProvider>
+          <ToolRegistryProvider>
+            <NavigationProvider>
+              <ToolWorkflowProvider>
+                <Story />
+              </ToolWorkflowProvider>
+            </NavigationProvider>
+          </ToolRegistryProvider>
+        </PreferencesProvider>
+      </AppConfigProvider>
+    );
+  };
+}
+
+const meta = {
+  title: "Shared/Signing/SharedSigningLauncher",
+  component: SharedSigningLauncher,
+} satisfies Meta<typeof SharedSigningLauncher>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const noSignRequests: SignRequestSummary[] = [];
+
+const pendingSignRequests: SignRequestSummary[] = [
+  {
+    sessionId: "session-1",
+    documentName: "NDA-acme-corp.pdf",
+    ownerUsername: "alex",
+    createdAt: "2026-07-01T09:00:00Z",
+    dueDate: "2026-07-20T00:00:00Z",
+    myStatus: "PENDING",
+  },
+  {
+    sessionId: "session-2",
+    documentName: "vendor-agreement.pdf",
+    ownerUsername: "jordan",
+    createdAt: "2026-07-05T14:30:00Z",
+    dueDate: "2026-07-22T00:00:00Z",
+    myStatus: "VIEWED",
+  },
+];
+
+/** Group signing enabled, no sign requests awaiting the user's action. */
+export const Default: Story = {
+  decorators: [withProviders(true)],
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/security/cert-sign/sign-requests", () =>
+          HttpResponse.json(noSignRequests),
+        ),
+        http.get("/api/v1/security/cert-sign/sessions", () =>
+          HttpResponse.json([]),
+        ),
+      ],
+    },
+  },
+};
+
+/** Two sign requests awaiting this user — the count badge appears on the button. */
+export const PendingRequests: Story = {
+  decorators: [withProviders(true)],
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/security/cert-sign/sign-requests", () =>
+          HttpResponse.json(pendingSignRequests),
+        ),
+        http.get("/api/v1/security/cert-sign/sessions", () =>
+          HttpResponse.json([]),
+        ),
+      ],
+    },
+  },
+};
+
+/** Group signing disabled on the server — the component renders nothing. */
+export const Disabled: Story = {
+  decorators: [withProviders(false)],
+};
diff --git a/frontend/editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.stories.tsx b/frontend/editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.stories.tsx
new file mode 100644
index 0000000000..b33c1e37b5
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.stories.tsx
@@ -0,0 +1,83 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ConfigureSignatureDefaultsStep } from "@app/components/shared/signing/steps/ConfigureSignatureDefaultsStep";
+import { SignatureSettings } from "@app/components/tools/certSign/SignatureSettingsInput";
+
+const meta = {
+  title: "Shared/Signing/Steps/ConfigureSignatureDefaultsStep",
+  component: ConfigureSignatureDefaultsStep,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "28rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+  args: {
+    settings: {},
+    onSettingsChange: () => {},
+    onBack: () => {},
+    onNext: () => {},
+  },
+} satisfies Meta<typeof ConfigureSignatureDefaultsStep>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function ConfigureDefaultsDemo({
+  disabled,
+  initial,
+}: {
+  disabled?: boolean;
+  initial: SignatureSettings;
+}) {
+  const [settings, setSettings] = useState<SignatureSettings>(initial);
+  return (
+    <ConfigureSignatureDefaultsStep
+      settings={settings}
+      onSettingsChange={setSettings}
+      onBack={() => {}}
+      onNext={() => {}}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => (
+    <ConfigureDefaultsDemo
+      initial={{
+        showSignature: true,
+        pageNumber: 1,
+        reason: "Approval",
+        location: "London, UK",
+        showLogo: true,
+        includeSummaryPage: false,
+      }}
+    />
+  ),
+};
+
+export const InvisibleSignature: Story = {
+  render: () => (
+    <ConfigureDefaultsDemo
+      initial={{
+        showSignature: false,
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <ConfigureDefaultsDemo
+      disabled
+      initial={{
+        showSignature: true,
+        pageNumber: 2,
+        reason: "Review",
+        location: "Remote",
+      }}
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/shared/signing/steps/ReviewSessionStep.stories.tsx b/frontend/editor/src/core/components/shared/signing/steps/ReviewSessionStep.stories.tsx
new file mode 100644
index 0000000000..60cacfd9ea
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/signing/steps/ReviewSessionStep.stories.tsx
@@ -0,0 +1,50 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ReviewSessionStep } from "@app/components/shared/signing/steps/ReviewSessionStep";
+import type { FileState } from "@app/types/file";
+import type { SignatureSettings } from "@app/components/tools/certSign/SignatureSettingsInput";
+
+const selectedFile: FileState = {
+  name: "contract-agreement.pdf",
+  size: 2.4 * 1024 * 1024,
+};
+
+const signatureSettings: SignatureSettings = {
+  showSignature: true,
+  pageNumber: 1,
+  reason: "Approval of contract terms",
+  location: "London, UK",
+  showLogo: true,
+};
+
+const meta = {
+  title: "Shared/Signing/Steps/ReviewSessionStep",
+  component: ReviewSessionStep,
+  parameters: { layout: "padded" },
+  args: {
+    selectedFile,
+    participantCount: 3,
+    signatureSettings,
+    dueDate: "2026-08-01",
+    onDueDateChange: () => {},
+    onBack: () => {},
+    onSubmit: () => {},
+  },
+} satisfies Meta<typeof ReviewSessionStep>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const InvisibleSignature: Story = {
+  args: {
+    signatureSettings: {
+      showSignature: false,
+    },
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/signing/steps/SelectDocumentStep.stories.tsx b/frontend/editor/src/core/components/shared/signing/steps/SelectDocumentStep.stories.tsx
new file mode 100644
index 0000000000..f8fbfacc1d
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/signing/steps/SelectDocumentStep.stories.tsx
@@ -0,0 +1,34 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SelectDocumentStep } from "@app/components/shared/signing/steps/SelectDocumentStep";
+import type { FileState } from "@app/types/file";
+
+const meta = {
+  title: "Shared/Signing/SelectDocumentStep",
+  component: SelectDocumentStep,
+  parameters: { layout: "padded" },
+  args: {
+    selectedFiles: [] as FileState[],
+    onNext: () => {},
+  },
+} satisfies Meta<typeof SelectDocumentStep>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const mockFile: FileState = {
+  name: "contract-agreement.pdf",
+  size: 2.4 * 1024 * 1024,
+};
+
+export const NoFileSelected: Story = {};
+
+export const Default: Story = {
+  args: {
+    selectedFiles: [mockFile],
+  },
+};
+
+export const MultipleFilesSelected: Story = {
+  args: {
+    selectedFiles: [mockFile, { name: "addendum.pdf", size: 512 * 1024 }],
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/signing/steps/SelectParticipantsStep.stories.tsx b/frontend/editor/src/core/components/shared/signing/steps/SelectParticipantsStep.stories.tsx
new file mode 100644
index 0000000000..7e74abb11c
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/signing/steps/SelectParticipantsStep.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SelectParticipantsStep } from "@app/components/shared/signing/steps/SelectParticipantsStep";
+
+const meta = {
+  title: "Shared/Signing/Steps/SelectParticipantsStep",
+  component: SelectParticipantsStep,
+  parameters: { layout: "padded" },
+  args: {
+    selectedUserIds: [],
+    onSelectedUserIdsChange: () => {},
+    onBack: () => {},
+    onNext: () => {},
+  },
+} satisfies Meta<typeof SelectParticipantsStep>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const WithSelection: Story = {
+  args: { selectedUserIds: [1, 2] },
+};
+
+export const Disabled: Story = {
+  args: { disabled: true },
+};
diff --git a/frontend/editor/src/core/components/shared/sliderWithInput/SliderWithInput.stories.tsx b/frontend/editor/src/core/components/shared/sliderWithInput/SliderWithInput.stories.tsx
new file mode 100644
index 0000000000..78f1710e69
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/sliderWithInput/SliderWithInput.stories.tsx
@@ -0,0 +1,46 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SliderWithInput from "@app/components/shared/sliderWithInput/SliderWithInput";
+
+/** Reproduces the compression "Quality" slider used in tool settings panels. */
+const meta: Meta<typeof SliderWithInput> = {
+  title: "Shared/SliderWithInput",
+  component: SliderWithInput,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "22rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof SliderWithInput>;
+
+function SliderDemo({
+  disabled,
+  initial = 60,
+}: {
+  disabled?: boolean;
+  initial?: number;
+}) {
+  const [value, setValue] = useState(initial);
+  return (
+    <SliderWithInput
+      label="Quality"
+      value={value}
+      onChange={setValue}
+      disabled={disabled}
+      min={0}
+      max={100}
+      step={5}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <SliderDemo /> };
+
+export const Disabled: Story = {
+  render: () => <SliderDemo disabled initial={20} />,
+};
diff --git a/frontend/editor/src/core/components/shared/tooltip/TooltipContent.stories.tsx b/frontend/editor/src/core/components/shared/tooltip/TooltipContent.stories.tsx
new file mode 100644
index 0000000000..8f06789bac
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/tooltip/TooltipContent.stories.tsx
@@ -0,0 +1,63 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { TooltipContent } from "@app/components/shared/tooltip/TooltipContent";
+import type { TooltipTip } from "@app/types/tips";
+
+const meta = {
+  title: "Shared/Tooltip/TooltipContent",
+  component: TooltipContent,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "22rem", background: "var(--bg-surface)" }}>
+        <S />
+      </div>
+    ),
+  ],
+} satisfies Meta<typeof TooltipContent>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const singleTip: TooltipTip[] = [
+  {
+    title: "Tip",
+    description:
+      "Choose a page range before running the split to keep sections in order.",
+    bullets: [
+      "Ranges use commas, e.g. 1-3,5",
+      "Leave blank to include all pages",
+    ],
+  },
+];
+
+const multipleTips: TooltipTip[] = [
+  {
+    title: "Step 1",
+    description: "Select the pages you want to extract.",
+  },
+  {
+    title: "Step 2",
+    description: "Confirm the output order matches your expectations.",
+    bullets: ["Drag to reorder", "Remove any page with the trash icon"],
+  },
+];
+
+/** Plain text content with no structured tips. */
+export const Default: Story = {
+  args: {
+    content: "Drag and drop files here, or click to browse your computer.",
+  },
+};
+
+/** A single tip with a title, description, and bullet list. */
+export const SingleTip: Story = {
+  args: {
+    tips: singleTip,
+  },
+};
+
+/** Multiple tips rendered as separate sections, each with its own spacing. */
+export const MultipleTips: Story = {
+  args: {
+    tips: multipleTips,
+  },
+};
diff --git a/frontend/editor/src/core/components/shared/wetSignature/DrawSignatureCanvas.stories.tsx b/frontend/editor/src/core/components/shared/wetSignature/DrawSignatureCanvas.stories.tsx
new file mode 100644
index 0000000000..1a4d260d08
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/wetSignature/DrawSignatureCanvas.stories.tsx
@@ -0,0 +1,38 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { DrawSignatureCanvas } from "@app/components/shared/wetSignature/DrawSignatureCanvas";
+
+const meta = {
+  title: "Shared/WetSignature/DrawSignatureCanvas",
+  component: DrawSignatureCanvas,
+  parameters: { layout: "padded" },
+  args: {
+    signature: null,
+    onChange: () => {},
+  },
+} satisfies Meta<typeof DrawSignatureCanvas>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+function DrawSignatureCanvasDemo(
+  props: Partial<React.ComponentProps<typeof DrawSignatureCanvas>>,
+) {
+  const [signature, setSignature] = useState<string | null>(null);
+
+  return (
+    <DrawSignatureCanvas
+      signature={signature}
+      onChange={setSignature}
+      {...props}
+    />
+  );
+}
+
+/** Empty canvas ready for the user to draw a signature. */
+export const Default: Story = { render: () => <DrawSignatureCanvasDemo /> };
+
+/** Disabled state — drawing and clearing are both blocked. */
+export const Disabled: Story = {
+  render: () => <DrawSignatureCanvasDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/shared/wetSignature/SignatureTypeSelector.stories.tsx b/frontend/editor/src/core/components/shared/wetSignature/SignatureTypeSelector.stories.tsx
new file mode 100644
index 0000000000..0c6cf99dcf
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/wetSignature/SignatureTypeSelector.stories.tsx
@@ -0,0 +1,37 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  SignatureTypeSelector,
+  type SignatureType,
+} from "@app/components/shared/wetSignature/SignatureTypeSelector";
+
+const meta: Meta<typeof SignatureTypeSelector> = {
+  title: "Shared/WetSignature/SignatureTypeSelector",
+  component: SignatureTypeSelector,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof SignatureTypeSelector>;
+
+function SignatureTypeSelectorDemo({
+  initialValue = "draw",
+  disabled,
+}: {
+  initialValue?: SignatureType;
+  disabled?: boolean;
+}) {
+  const [value, setValue] = useState<SignatureType>(initialValue);
+  return (
+    <SignatureTypeSelector
+      value={value}
+      onChange={setValue}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <SignatureTypeSelectorDemo /> };
+
+export const Disabled: Story = {
+  render: () => <SignatureTypeSelectorDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/shared/wetSignature/TypeSignatureText.stories.tsx b/frontend/editor/src/core/components/shared/wetSignature/TypeSignatureText.stories.tsx
new file mode 100644
index 0000000000..b3996cbaa4
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/wetSignature/TypeSignatureText.stories.tsx
@@ -0,0 +1,61 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { TypeSignatureText } from "@app/components/shared/wetSignature/TypeSignatureText";
+
+const meta = {
+  title: "Shared/WetSignature/TypeSignatureText",
+  component: TypeSignatureText,
+  parameters: { layout: "padded" },
+  args: {
+    text: "Jane Doe",
+    fontFamily: "Arial",
+    fontSize: 40,
+    color: "#000000",
+    onTextChange: () => {},
+    onFontFamilyChange: () => {},
+    onFontSizeChange: () => {},
+    onColorChange: () => {},
+    onSignatureChange: () => {},
+  },
+} satisfies Meta<typeof TypeSignatureText>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function TypeSignatureTextDemo(
+  props: Partial<React.ComponentProps<typeof TypeSignatureText>>,
+) {
+  const [text, setText] = useState(props.text ?? "Jane Doe");
+  const [fontFamily, setFontFamily] = useState(props.fontFamily ?? "Arial");
+  const [fontSize, setFontSize] = useState(props.fontSize ?? 40);
+  const [color, setColor] = useState(props.color ?? "#000000");
+
+  return (
+    <TypeSignatureText
+      {...props}
+      text={text}
+      onTextChange={setText}
+      fontFamily={fontFamily}
+      onFontFamilyChange={setFontFamily}
+      fontSize={fontSize}
+      onFontSizeChange={setFontSize}
+      color={color}
+      onColorChange={setColor}
+      onSignatureChange={props.onSignatureChange ?? (() => {})}
+    />
+  );
+}
+
+/** Typed signature with text, font, size and colour controls plus a live preview. */
+export const Default: Story = {
+  render: () => <TypeSignatureTextDemo />,
+};
+
+/** No text entered yet, so the preview is hidden. */
+export const Empty: Story = {
+  render: () => <TypeSignatureTextDemo text="" />,
+};
+
+/** All controls disabled, e.g. while the signature is being submitted. */
+export const Disabled: Story = {
+  render: () => <TypeSignatureTextDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/shared/wetSignature/UploadSignatureImage.stories.tsx b/frontend/editor/src/core/components/shared/wetSignature/UploadSignatureImage.stories.tsx
new file mode 100644
index 0000000000..4612e37442
--- /dev/null
+++ b/frontend/editor/src/core/components/shared/wetSignature/UploadSignatureImage.stories.tsx
@@ -0,0 +1,36 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { UploadSignatureImage } from "@app/components/shared/wetSignature/UploadSignatureImage";
+
+const meta = {
+  title: "Shared/WetSignature/UploadSignatureImage",
+  component: UploadSignatureImage,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof UploadSignatureImage>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Empty: Story = {
+  args: {
+    signature: null,
+    onChange: () => {},
+  },
+};
+
+export const WithSignature: Story = {
+  args: {
+    signature:
+      "data:image/svg+xml;base64," +
+      btoa(
+        '<svg xmlns="http://www.w3.org/2000/svg" width="200" height="80"><text x="10" y="50" font-family="cursive" font-size="32">Jane Doe</text></svg>',
+      ),
+    onChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    signature: null,
+    onChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/toast/ToastRenderer.stories.tsx b/frontend/editor/src/core/components/toast/ToastRenderer.stories.tsx
new file mode 100644
index 0000000000..ffed473833
--- /dev/null
+++ b/frontend/editor/src/core/components/toast/ToastRenderer.stories.tsx
@@ -0,0 +1,102 @@
+import { useEffect } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ToastRenderer from "@app/components/toast/ToastRenderer";
+import { ToastProvider, useToast } from "@app/components/toast/ToastContext";
+import type { ToastOptions } from "@app/components/toast/types";
+
+// ToastRenderer takes no props — it renders whatever is in ToastContext. The
+// only way to exercise it is to seed toasts through the same provider/show()
+// API the app uses, then let the renderer subscribe to that context.
+function SeedToasts({
+  toasts,
+  children,
+}: {
+  toasts: ToastOptions[];
+  children: React.ReactNode;
+}) {
+  const { show } = useToast();
+  useEffect(() => {
+    toasts.forEach((toast) => show(toast));
+  }, []);
+  return <>{children}</>;
+}
+
+const meta = {
+  title: "Toast/ToastRenderer",
+  component: ToastRenderer,
+  parameters: { layout: "fullscreen" },
+  decorators: [
+    (Story) => (
+      <ToastProvider>
+        <Story />
+      </ToastProvider>
+    ),
+  ],
+} satisfies Meta<typeof ToastRenderer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  decorators: [
+    (Story) => (
+      <SeedToasts
+        toasts={[
+          {
+            title: "File saved",
+            body: "your-document.pdf was saved successfully.",
+            alertType: "success",
+          },
+          {
+            title: "Upload failed",
+            body: "Network error while uploading your-document.pdf. Please try again.",
+            alertType: "error",
+            isPersistentPopup: true,
+          },
+        ]}
+      >
+        <Story />
+      </SeedToasts>
+    ),
+  ],
+};
+
+export const WithProgress: Story = {
+  decorators: [
+    (Story) => (
+      <SeedToasts
+        toasts={[
+          {
+            title: "Compressing PDF...",
+            alertType: "neutral",
+            progressBarPercentage: 65,
+            isPersistentPopup: true,
+          },
+        ]}
+      >
+        <Story />
+      </SeedToasts>
+    ),
+  ],
+};
+
+export const WithActionButton: Story = {
+  decorators: [
+    (Story) => (
+      <SeedToasts
+        toasts={[
+          {
+            title: "New version available",
+            body: "Reload to get the latest features.",
+            alertType: "warning",
+            isPersistentPopup: true,
+            buttonText: "Reload",
+            buttonCallback: () => {},
+          },
+        ]}
+      >
+        <Story />
+      </SeedToasts>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/tools/ToolLoadingFallback.stories.tsx b/frontend/editor/src/core/components/tools/ToolLoadingFallback.stories.tsx
new file mode 100644
index 0000000000..4135be2c79
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/ToolLoadingFallback.stories.tsx
@@ -0,0 +1,20 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ToolLoadingFallback from "@app/components/tools/ToolLoadingFallback";
+
+const meta: Meta<typeof ToolLoadingFallback> = {
+  title: "Tools/ToolLoadingFallback",
+  component: ToolLoadingFallback,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {},
+};
+
+export const WithToolName: Story = {
+  args: {
+    toolName: "Merge PDF",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/ToolPanelModePrompt.stories.tsx b/frontend/editor/src/core/components/tools/ToolPanelModePrompt.stories.tsx
new file mode 100644
index 0000000000..2290784b00
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/ToolPanelModePrompt.stories.tsx
@@ -0,0 +1,51 @@
+import type { ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ToolPanelModePrompt from "@app/components/tools/ToolPanelModePrompt";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { NavigationProvider } from "@app/contexts/NavigationContext";
+import { ToolWorkflowProvider } from "@app/contexts/ToolWorkflowContext";
+
+/**
+ * ToolWorkflowProvider reads navigation and tool-registry state on mount, so
+ * NavigationProvider and ToolRegistryProvider must wrap it; PreferencesProvider
+ * backs the persisted tool-panel-mode choice.
+ */
+function withProviders(Story: () => ReactElement) {
+  return (
+    <PreferencesProvider>
+      <ToolRegistryProvider>
+        <NavigationProvider>
+          <ToolWorkflowProvider>
+            <Story />
+          </ToolWorkflowProvider>
+        </NavigationProvider>
+      </ToolRegistryProvider>
+    </PreferencesProvider>
+  );
+}
+
+const meta = {
+  title: "Tools/ToolPanelModePrompt",
+  component: ToolPanelModePrompt,
+  decorators: [withProviders],
+} satisfies Meta<typeof ToolPanelModePrompt>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Orchestrator controls visibility directly via `forceOpen`. */
+export const Default: Story = {
+  args: {
+    forceOpen: true,
+    onComplete: () => {},
+  },
+};
+
+/** Closed — nothing renders on top of the story canvas. */
+export const Closed: Story = {
+  args: {
+    forceOpen: false,
+    onComplete: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/ToolRenderer.stories.tsx b/frontend/editor/src/core/components/tools/ToolRenderer.stories.tsx
new file mode 100644
index 0000000000..fbca2dfc4f
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/ToolRenderer.stories.tsx
@@ -0,0 +1,55 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { ReactElement } from "react";
+import ToolRenderer from "@app/components/tools/ToolRenderer";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { NavigationProvider } from "@app/contexts/NavigationContext";
+import { ToolWorkflowProvider } from "@app/contexts/ToolWorkflowContext";
+
+/**
+ * ToolWorkflowContext reads the tool registry, preferences, and navigation
+ * state, so all three providers must be present above it for ToolRenderer
+ * to resolve a tool.
+ */
+function withProviders(Story: () => ReactElement) {
+  return (
+    <PreferencesProvider>
+      <ToolRegistryProvider>
+        <NavigationProvider>
+          <ToolWorkflowProvider>
+            <Story />
+          </ToolWorkflowProvider>
+        </NavigationProvider>
+      </ToolRegistryProvider>
+    </PreferencesProvider>
+  );
+}
+
+const meta = {
+  title: "Tools/ToolRenderer",
+  component: ToolRenderer,
+  decorators: [withProviders],
+} satisfies Meta<typeof ToolRenderer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** A registered tool with a component renders its lazy-loaded settings UI. */
+export const Default: Story = {
+  args: {
+    selectedToolKey: "compress",
+    onPreviewFile: () => {},
+    onComplete: () => {},
+    onError: () => {},
+  },
+};
+
+/** An unknown tool key falls back to the "Tool not found" message. */
+export const ToolNotFound: Story = {
+  args: {
+    selectedToolKey: "not-a-real-tool" as Story["args"]["selectedToolKey"],
+    onPreviewFile: () => {},
+    onComplete: () => {},
+    onError: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.stories.tsx b/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.stories.tsx
new file mode 100644
index 0000000000..c4dcc8a202
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addPageNumbers/PageNumberPreview.stories.tsx
@@ -0,0 +1,26 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PageNumberPreview from "@app/components/tools/addPageNumbers/PageNumberPreview";
+import { defaultParameters } from "@app/components/tools/addPageNumbers/useAddPageNumbersParameters";
+
+const meta = {
+  title: "Tools/AddPageNumbers/PageNumberPreview",
+  component: PageNumberPreview,
+} satisfies Meta<typeof PageNumberPreview>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const WithQuickGrid: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    showQuickGrid: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/addPassword/AddPasswordSettings.stories.tsx b/frontend/editor/src/core/components/tools/addPassword/AddPasswordSettings.stories.tsx
new file mode 100644
index 0000000000..be16c2037c
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addPassword/AddPasswordSettings.stories.tsx
@@ -0,0 +1,70 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AddPasswordSettings from "@app/components/tools/addPassword/AddPasswordSettings";
+import { AddPasswordParameters } from "@app/hooks/tools/addPassword/useAddPasswordParameters";
+
+const meta = {
+  title: "Tools/AddPassword/AddPasswordSettings",
+  component: AddPasswordSettings,
+  args: {
+    parameters: { password: "", ownerPassword: "", keyLength: 128 },
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof AddPasswordSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+// The component owns no state itself, so each story wraps it in a small
+// stateful shim to keep the password/key-length inputs interactive in the canvas.
+const AddPasswordSettingsDemo = (props: {
+  initialParameters: AddPasswordParameters;
+  disabled?: boolean;
+}) => {
+  const [parameters, setParameters] = useState<AddPasswordParameters>(
+    props.initialParameters,
+  );
+
+  return (
+    <AddPasswordSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={props.disabled}
+    />
+  );
+};
+
+export const Default: Story = {
+  render: () => (
+    <AddPasswordSettingsDemo
+      initialParameters={{ password: "", ownerPassword: "", keyLength: 128 }}
+    />
+  ),
+};
+
+export const Filled: Story = {
+  render: () => (
+    <AddPasswordSettingsDemo
+      initialParameters={{
+        password: "user-secret",
+        ownerPassword: "owner-secret",
+        keyLength: 256,
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <AddPasswordSettingsDemo
+      initialParameters={{
+        password: "user-secret",
+        ownerPassword: "owner-secret",
+        keyLength: 128,
+      }}
+      disabled
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/addStamp/StampPreview.stories.tsx b/frontend/editor/src/core/components/tools/addStamp/StampPreview.stories.tsx
new file mode 100644
index 0000000000..74a8c95690
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addStamp/StampPreview.stories.tsx
@@ -0,0 +1,36 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import StampPreview from "@app/components/tools/addStamp/StampPreview";
+import { defaultParameters } from "@app/components/tools/addStamp/useAddStampParameters";
+
+const meta = {
+  title: "Tools/AddStamp/StampPreview",
+  component: StampPreview,
+} satisfies Meta<typeof StampPreview>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const WithText: Story = {
+  args: {
+    parameters: {
+      ...defaultParameters,
+      stampText: "CONFIDENTIAL",
+    },
+    onParameterChange: () => {},
+  },
+};
+
+export const WithQuickGrid: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    showQuickGrid: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/addStamp/StampSetupSettings.stories.tsx b/frontend/editor/src/core/components/tools/addStamp/StampSetupSettings.stories.tsx
new file mode 100644
index 0000000000..b50df8c70f
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addStamp/StampSetupSettings.stories.tsx
@@ -0,0 +1,70 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import StampSetupSettings from "@app/components/tools/addStamp/StampSetupSettings";
+import {
+  AddStampParameters,
+  defaultParameters,
+} from "@app/components/tools/addStamp/useAddStampParameters";
+
+const meta = {
+  title: "Tools/AddStamp/StampSetupSettings",
+  component: StampSetupSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof StampSetupSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function Demo({
+  initialParameters = defaultParameters,
+  disabled,
+  filename,
+}: {
+  initialParameters?: AddStampParameters;
+  disabled?: boolean;
+  filename?: string;
+}) {
+  const [parameters, setParameters] =
+    useState<AddStampParameters>(initialParameters);
+
+  return (
+    <StampSetupSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+      filename={filename}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <Demo /> };
+
+export const TextStampWithPreview: Story = {
+  render: () => (
+    <Demo
+      initialParameters={{
+        ...defaultParameters,
+        stampText: "DRAFT - @date",
+      }}
+      filename="quarterly-report.pdf"
+    />
+  ),
+};
+
+export const ImageStamp: Story = {
+  render: () => (
+    <Demo
+      initialParameters={{
+        ...defaultParameters,
+        stampType: "image",
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = { render: () => <Demo disabled /> };
diff --git a/frontend/editor/src/core/components/tools/addWatermark/AddWatermarkSingleStepSettings.stories.tsx b/frontend/editor/src/core/components/tools/addWatermark/AddWatermarkSingleStepSettings.stories.tsx
new file mode 100644
index 0000000000..1476e951e5
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addWatermark/AddWatermarkSingleStepSettings.stories.tsx
@@ -0,0 +1,87 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AddWatermarkSingleStepSettings from "@app/components/tools/addWatermark/AddWatermarkSingleStepSettings";
+import {
+  AddWatermarkParameters,
+  defaultParameters,
+} from "@app/hooks/tools/addWatermark/useAddWatermarkParameters";
+
+const meta = {
+  title: "Tools/AddWatermark/AddWatermarkSingleStepSettings",
+  component: AddWatermarkSingleStepSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof AddWatermarkSingleStepSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function SettingsDemo({
+  initialParameters = defaultParameters,
+  disabled,
+  showFlatten,
+  textOnly,
+}: {
+  initialParameters?: AddWatermarkParameters;
+  disabled?: boolean;
+  showFlatten?: boolean;
+  textOnly?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<AddWatermarkParameters>(initialParameters);
+
+  return (
+    <AddWatermarkSingleStepSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+      showFlatten={showFlatten}
+      textOnly={textOnly}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <SettingsDemo />,
+};
+
+export const TextWatermark: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        watermarkType: "text",
+        watermarkText: "CONFIDENTIAL",
+      }}
+    />
+  ),
+};
+
+export const TextOnly: Story = {
+  render: () => (
+    <SettingsDemo
+      textOnly
+      initialParameters={{
+        ...defaultParameters,
+        watermarkText: "DRAFT",
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <SettingsDemo
+      disabled
+      initialParameters={{
+        ...defaultParameters,
+        watermarkType: "text",
+        watermarkText: "CONFIDENTIAL",
+      }}
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/addWatermark/WatermarkFormatting.stories.tsx b/frontend/editor/src/core/components/tools/addWatermark/WatermarkFormatting.stories.tsx
new file mode 100644
index 0000000000..6e9e099c5d
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addWatermark/WatermarkFormatting.stories.tsx
@@ -0,0 +1,32 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import WatermarkFormatting from "@app/components/tools/addWatermark/WatermarkFormatting";
+import { defaultParameters } from "@app/hooks/tools/addWatermark/useAddWatermarkParameters";
+
+const meta = {
+  title: "Tools/AddWatermark/WatermarkFormatting",
+  component: WatermarkFormatting,
+} satisfies Meta<typeof WatermarkFormatting>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: { ...defaultParameters, watermarkType: "text" },
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    ...Default.args,
+    disabled: true,
+  },
+};
+
+export const WithoutFlattenOption: Story = {
+  args: {
+    ...Default.args,
+    showFlatten: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/addWatermark/WatermarkImageFile.stories.tsx b/frontend/editor/src/core/components/tools/addWatermark/WatermarkImageFile.stories.tsx
new file mode 100644
index 0000000000..b5568e1779
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addWatermark/WatermarkImageFile.stories.tsx
@@ -0,0 +1,72 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import WatermarkImageFile from "@app/components/tools/addWatermark/WatermarkImageFile";
+import {
+  AddWatermarkParameters,
+  defaultParameters,
+} from "@app/hooks/tools/addWatermark/useAddWatermarkParameters";
+
+const meta = {
+  title: "Tools/AddWatermark/WatermarkImageFile",
+  component: WatermarkImageFile,
+  args: {
+    parameters: { ...defaultParameters, watermarkType: "image" },
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof WatermarkImageFile>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const makeImageFile = (name: string, sizeBytes: number): File =>
+  new File([new Uint8Array(sizeBytes)], name, { type: "image/png" });
+
+// The component owns no state itself, so each story wraps it in a small
+// stateful shim to keep the file picker interaction working in the canvas.
+const WatermarkImageFileDemo = (props: {
+  initialParameters: AddWatermarkParameters;
+  disabled?: boolean;
+}) => {
+  const [parameters, setParameters] = useState<AddWatermarkParameters>(
+    props.initialParameters,
+  );
+
+  return (
+    <WatermarkImageFile
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={props.disabled}
+    />
+  );
+};
+
+export const Default: Story = {
+  render: () => (
+    <WatermarkImageFileDemo
+      initialParameters={{ ...defaultParameters, watermarkType: "image" }}
+    />
+  ),
+};
+
+export const WithSelectedImage: Story = {
+  render: () => (
+    <WatermarkImageFileDemo
+      initialParameters={{
+        ...defaultParameters,
+        watermarkType: "image",
+        watermarkImage: makeImageFile("logo.png", 20_480),
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <WatermarkImageFileDemo
+      initialParameters={{ ...defaultParameters, watermarkType: "image" }}
+      disabled
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/addWatermark/WatermarkStyleSettings.stories.tsx b/frontend/editor/src/core/components/tools/addWatermark/WatermarkStyleSettings.stories.tsx
new file mode 100644
index 0000000000..316e377511
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addWatermark/WatermarkStyleSettings.stories.tsx
@@ -0,0 +1,38 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import WatermarkStyleSettings from "@app/components/tools/addWatermark/WatermarkStyleSettings";
+import {
+  AddWatermarkParameters,
+  defaultParameters,
+} from "@app/hooks/tools/addWatermark/useAddWatermarkParameters";
+
+const meta: Meta<typeof WatermarkStyleSettings> = {
+  title: "Tools/AddWatermark/WatermarkStyleSettings",
+  component: WatermarkStyleSettings,
+};
+export default meta;
+type Story = StoryObj<typeof WatermarkStyleSettings>;
+
+function WatermarkStyleSettingsDemo({ disabled }: { disabled?: boolean }) {
+  const [parameters, setParameters] = useState<AddWatermarkParameters>({
+    ...defaultParameters,
+    watermarkType: "text",
+    watermarkText: "CONFIDENTIAL",
+  });
+
+  return (
+    <WatermarkStyleSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <WatermarkStyleSettingsDemo /> };
+
+export const Disabled: Story = {
+  render: () => <WatermarkStyleSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/addWatermark/WatermarkTextStyle.stories.tsx b/frontend/editor/src/core/components/tools/addWatermark/WatermarkTextStyle.stories.tsx
new file mode 100644
index 0000000000..5bee6d393a
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addWatermark/WatermarkTextStyle.stories.tsx
@@ -0,0 +1,41 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import WatermarkTextStyle from "@app/components/tools/addWatermark/WatermarkTextStyle";
+import {
+  AddWatermarkParameters,
+  defaultParameters,
+} from "@app/hooks/tools/addWatermark/useAddWatermarkParameters";
+
+const meta: Meta<typeof WatermarkTextStyle> = {
+  title: "AddWatermark/WatermarkTextStyle",
+  component: WatermarkTextStyle,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof WatermarkTextStyle>;
+
+function WatermarkTextStyleDemo({
+  initialParameters = defaultParameters,
+  disabled,
+}: {
+  initialParameters?: AddWatermarkParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<AddWatermarkParameters>(initialParameters);
+  return (
+    <WatermarkTextStyle
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <WatermarkTextStyleDemo /> };
+
+export const Disabled: Story = {
+  render: () => <WatermarkTextStyleDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/addWatermark/WatermarkTypeSettings.stories.tsx b/frontend/editor/src/core/components/tools/addWatermark/WatermarkTypeSettings.stories.tsx
new file mode 100644
index 0000000000..9ce7f4ff4b
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addWatermark/WatermarkTypeSettings.stories.tsx
@@ -0,0 +1,28 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import WatermarkTypeSettings from "@app/components/tools/addWatermark/WatermarkTypeSettings";
+
+const meta: Meta<typeof WatermarkTypeSettings> = {
+  title: "Tools/AddWatermark/WatermarkTypeSettings",
+  component: WatermarkTypeSettings,
+};
+export default meta;
+type Story = StoryObj<typeof WatermarkTypeSettings>;
+
+function WatermarkTypeSettingsDemo({ disabled }: { disabled?: boolean }) {
+  const [watermarkType, setWatermarkType] = useState<"text" | "image">("text");
+
+  return (
+    <WatermarkTypeSettings
+      watermarkType={watermarkType}
+      onWatermarkTypeChange={setWatermarkType}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <WatermarkTypeSettingsDemo /> };
+
+export const Disabled: Story = {
+  render: () => <WatermarkTypeSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/addWatermark/WatermarkWording.stories.tsx b/frontend/editor/src/core/components/tools/addWatermark/WatermarkWording.stories.tsx
new file mode 100644
index 0000000000..c95c2f37f1
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/addWatermark/WatermarkWording.stories.tsx
@@ -0,0 +1,53 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import WatermarkWording from "@app/components/tools/addWatermark/WatermarkWording";
+import {
+  AddWatermarkParameters,
+  defaultParameters,
+} from "@app/hooks/tools/addWatermark/useAddWatermarkParameters";
+
+const meta: Meta<typeof WatermarkWording> = {
+  title: "AddWatermark/WatermarkWording",
+  component: WatermarkWording,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof WatermarkWording>;
+
+function WatermarkWordingDemo({
+  initialText = "",
+  disabled,
+}: {
+  initialText?: string;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] = useState<AddWatermarkParameters>({
+    ...defaultParameters,
+    watermarkText: initialText,
+  });
+
+  const handleParameterChange = <K extends keyof AddWatermarkParameters>(
+    key: K,
+    value: AddWatermarkParameters[K],
+  ) => {
+    setParameters((prev) => ({ ...prev, [key]: value }));
+  };
+
+  return (
+    <WatermarkWording
+      parameters={parameters}
+      onParameterChange={handleParameterChange}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <WatermarkWordingDemo /> };
+
+export const Filled: Story = {
+  render: () => <WatermarkWordingDemo initialText="CONFIDENTIAL" />,
+};
+
+export const Disabled: Story = {
+  render: () => <WatermarkWordingDemo initialText="CONFIDENTIAL" disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastBasicSettings.stories.tsx b/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastBasicSettings.stories.tsx
new file mode 100644
index 0000000000..c4b4ecef9b
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastBasicSettings.stories.tsx
@@ -0,0 +1,57 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AdjustContrastBasicSettings from "@app/components/tools/adjustContrast/AdjustContrastBasicSettings";
+import {
+  AdjustContrastParameters,
+  defaultParameters,
+} from "@app/hooks/tools/adjustContrast/useAdjustContrastParameters";
+
+const meta = {
+  title: "Tools/AdjustContrast/AdjustContrastBasicSettings",
+  component: AdjustContrastBasicSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof AdjustContrastBasicSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function Demo({
+  initialParameters = defaultParameters,
+  disabled,
+}: {
+  initialParameters?: AdjustContrastParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<AdjustContrastParameters>(initialParameters);
+
+  return (
+    <AdjustContrastBasicSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <Demo /> };
+
+export const Adjusted: Story = {
+  render: () => (
+    <Demo
+      initialParameters={{
+        ...defaultParameters,
+        contrast: 140,
+        brightness: 80,
+        saturation: 120,
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = { render: () => <Demo disabled /> };
diff --git a/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastColorSettings.stories.tsx b/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastColorSettings.stories.tsx
new file mode 100644
index 0000000000..13155ae524
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastColorSettings.stories.tsx
@@ -0,0 +1,57 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AdjustContrastColorSettings from "@app/components/tools/adjustContrast/AdjustContrastColorSettings";
+import {
+  AdjustContrastParameters,
+  defaultParameters,
+} from "@app/hooks/tools/adjustContrast/useAdjustContrastParameters";
+
+const meta = {
+  title: "Tools/AdjustContrast/AdjustContrastColorSettings",
+  component: AdjustContrastColorSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof AdjustContrastColorSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function Demo({
+  initialParameters = defaultParameters,
+  disabled,
+}: {
+  initialParameters?: AdjustContrastParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<AdjustContrastParameters>(initialParameters);
+
+  return (
+    <AdjustContrastColorSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <Demo /> };
+
+export const Adjusted: Story = {
+  render: () => (
+    <Demo
+      initialParameters={{
+        ...defaultParameters,
+        red: 140,
+        green: 80,
+        blue: 120,
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = { render: () => <Demo disabled /> };
diff --git a/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastPreview.stories.tsx b/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastPreview.stories.tsx
new file mode 100644
index 0000000000..e1d605188f
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastPreview.stories.tsx
@@ -0,0 +1,20 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AdjustContrastPreview from "@app/components/tools/adjustContrast/AdjustContrastPreview";
+import { defaultParameters } from "@app/hooks/tools/adjustContrast/useAdjustContrastParameters";
+
+const meta = {
+  title: "Tools/AdjustContrast/AdjustContrastPreview",
+  component: AdjustContrastPreview,
+} satisfies Meta<typeof AdjustContrastPreview>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+// No file selected yet: the component shows the obscured "select a PDF" state
+// without attempting any thumbnail generation, which needs a live PDF worker.
+export const Default: Story = {
+  args: {
+    file: null,
+    parameters: defaultParameters,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastSingleStepSettings.stories.tsx b/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastSingleStepSettings.stories.tsx
new file mode 100644
index 0000000000..6352b0fe15
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/adjustContrast/AdjustContrastSingleStepSettings.stories.tsx
@@ -0,0 +1,60 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AdjustContrastSingleStepSettings from "@app/components/tools/adjustContrast/AdjustContrastSingleStepSettings";
+import {
+  AdjustContrastParameters,
+  defaultParameters,
+} from "@app/hooks/tools/adjustContrast/useAdjustContrastParameters";
+
+const meta = {
+  title: "Tools/AdjustContrast/AdjustContrastSingleStepSettings",
+  component: AdjustContrastSingleStepSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof AdjustContrastSingleStepSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function Demo({
+  initialParameters = defaultParameters,
+  disabled,
+}: {
+  initialParameters?: AdjustContrastParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<AdjustContrastParameters>(initialParameters);
+
+  return (
+    <AdjustContrastSingleStepSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <Demo /> };
+
+export const Adjusted: Story = {
+  render: () => (
+    <Demo
+      initialParameters={{
+        ...defaultParameters,
+        contrast: 140,
+        brightness: 80,
+        saturation: 120,
+        red: 110,
+        green: 90,
+        blue: 105,
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = { render: () => <Demo disabled /> };
diff --git a/frontend/editor/src/core/components/tools/adjustPageScale/AdjustPageScaleSettings.stories.tsx b/frontend/editor/src/core/components/tools/adjustPageScale/AdjustPageScaleSettings.stories.tsx
new file mode 100644
index 0000000000..00d3aaba85
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/adjustPageScale/AdjustPageScaleSettings.stories.tsx
@@ -0,0 +1,46 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AdjustPageScaleSettings from "@app/components/tools/adjustPageScale/AdjustPageScaleSettings";
+import {
+  AdjustPageScaleParameters,
+  PageSize,
+} from "@app/hooks/tools/adjustPageScale/useAdjustPageScaleParameters";
+
+const meta = {
+  title: "Tools/AdjustPageScale/AdjustPageScaleSettings",
+  component: AdjustPageScaleSettings,
+} satisfies Meta<typeof AdjustPageScaleSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const defaultParameters: AdjustPageScaleParameters = {
+  scaleFactor: 1.0,
+  pageSize: PageSize.KEEP,
+  orientation: "PORTRAIT",
+};
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const CustomPageSize: Story = {
+  args: {
+    parameters: {
+      scaleFactor: 2.5,
+      pageSize: PageSize.A4,
+      orientation: "LANDSCAPE",
+    },
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/autoRename/AutoRenameSettings.stories.tsx b/frontend/editor/src/core/components/tools/autoRename/AutoRenameSettings.stories.tsx
new file mode 100644
index 0000000000..6e632564c1
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/autoRename/AutoRenameSettings.stories.tsx
@@ -0,0 +1,30 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AutoRenameSettings from "@app/components/tools/autoRename/AutoRenameSettings";
+import { AutoRenameParameters } from "@app/hooks/tools/autoRename/useAutoRenameParameters";
+
+const meta = {
+  title: "Tools/AutoRename/AutoRenameSettings",
+  component: AutoRenameSettings,
+} satisfies Meta<typeof AutoRenameSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const baseParameters: AutoRenameParameters = {
+  useFirstTextAsFallback: false,
+};
+
+export const Default: Story = {
+  args: {
+    parameters: baseParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: baseParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/automate/AutomationCreation.stories.tsx b/frontend/editor/src/core/components/tools/automate/AutomationCreation.stories.tsx
new file mode 100644
index 0000000000..8299f7222c
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/automate/AutomationCreation.stories.tsx
@@ -0,0 +1,59 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AutomationCreation from "@app/components/tools/automate/AutomationCreation";
+import { AutomationMode } from "@app/types/automation";
+import type { AutomationConfig } from "@app/types/automation";
+import type { ToolRegistry } from "@app/data/toolsTaxonomy";
+
+const emptyToolRegistry: Partial<ToolRegistry> = {};
+
+const existingAutomation: AutomationConfig = {
+  id: "automation-1",
+  name: "Weekly Cleanup",
+  description: "Compress and flatten incoming PDFs.",
+  icon: "CompressIcon",
+  operations: [
+    { operation: "compress", parameters: {} },
+    { operation: "flatten", parameters: {} },
+  ],
+  createdAt: new Date().toISOString(),
+  updatedAt: new Date().toISOString(),
+};
+
+const meta = {
+  title: "Tools/Automate/AutomationCreation",
+  component: AutomationCreation,
+} satisfies Meta<typeof AutomationCreation>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    mode: AutomationMode.CREATE,
+    onBack: () => {},
+    onComplete: () => {},
+    toolRegistry: emptyToolRegistry,
+  },
+};
+
+export const EditExisting: Story = {
+  args: {
+    mode: AutomationMode.EDIT,
+    existingAutomation,
+    onBack: () => {},
+    onComplete: () => {},
+    toolRegistry: emptyToolRegistry,
+  },
+};
+
+export const EmbeddedHideMetadata: Story = {
+  args: {
+    mode: AutomationMode.CREATE,
+    hideMetadata: true,
+    nameOverride: "Watched Folder Automation",
+    onBack: () => {},
+    onComplete: () => {},
+    onSaveFailed: () => {},
+    toolRegistry: emptyToolRegistry,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/automate/AutomationImportModal.stories.tsx b/frontend/editor/src/core/components/tools/automate/AutomationImportModal.stories.tsx
new file mode 100644
index 0000000000..b3fea378df
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/automate/AutomationImportModal.stories.tsx
@@ -0,0 +1,31 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AutomationImportModal from "@app/components/tools/automate/AutomationImportModal";
+import type { ToolRegistry } from "@app/data/toolsTaxonomy";
+
+const emptyToolRegistry: Partial<ToolRegistry> = {};
+
+const meta = {
+  title: "Tools/Automate/AutomationImportModal",
+  component: AutomationImportModal,
+} satisfies Meta<typeof AutomationImportModal>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    opened: true,
+    toolRegistry: emptyToolRegistry,
+    onCancel: () => {},
+    onImport: () => {},
+  },
+};
+
+export const Closed: Story = {
+  args: {
+    opened: false,
+    toolRegistry: emptyToolRegistry,
+    onCancel: () => {},
+    onImport: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/automate/IconSelector.stories.tsx b/frontend/editor/src/core/components/tools/automate/IconSelector.stories.tsx
new file mode 100644
index 0000000000..1a8fdadcd1
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/automate/IconSelector.stories.tsx
@@ -0,0 +1,28 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import IconSelector from "@app/components/tools/automate/IconSelector";
+
+const meta = {
+  title: "Automate/IconSelector",
+  component: IconSelector,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof IconSelector>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function IconSelectorDemo({ size }: { size?: "sm" | "md" | "lg" }) {
+  const [value, setValue] = useState("SettingsIcon");
+  return <IconSelector value={value} onChange={setValue} size={size} />;
+}
+
+export const Default: Story = {
+  render: () => <IconSelectorDemo />,
+};
+
+export const Medium: Story = {
+  render: () => <IconSelectorDemo size="md" />,
+};
+
+export const Large: Story = {
+  render: () => <IconSelectorDemo size="lg" />,
+};
diff --git a/frontend/editor/src/core/components/tools/automate/ToolConfigurationModal.stories.tsx b/frontend/editor/src/core/components/tools/automate/ToolConfigurationModal.stories.tsx
new file mode 100644
index 0000000000..81aa48e300
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/automate/ToolConfigurationModal.stories.tsx
@@ -0,0 +1,80 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { TextInput } from "@mantine/core";
+import ToolConfigurationModal from "@app/components/tools/automate/ToolConfigurationModal";
+import {
+  ToolRegistry,
+  ToolCategoryId,
+  SubcategoryId,
+} from "@app/data/toolsTaxonomy";
+import {
+  ToolAutomationSettingsProps,
+  ErasedToolParams,
+} from "@app/hooks/tools/shared/toolOperationTypes";
+
+const meta = {
+  title: "Tools/Automate/ToolConfigurationModal",
+  component: ToolConfigurationModal,
+} satisfies Meta<typeof ToolConfigurationModal>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Registry entry with no automationSettings: the modal falls back to a "no settings" message. */
+export const Default: Story = {
+  args: {
+    opened: true,
+    tool: {
+      id: "1",
+      operation: "autoRename",
+      name: "Auto Rename",
+    },
+    onSave: () => {},
+    onCancel: () => {},
+    toolRegistry: {},
+  },
+};
+
+function DemoSettings({
+  parameters,
+  onParameterChange,
+  disabled,
+}: ToolAutomationSettingsProps<ErasedToolParams>) {
+  return (
+    <TextInput
+      label="Prefix"
+      value={(parameters.prefix as string) ?? ""}
+      onChange={(event) =>
+        onParameterChange("prefix", event.currentTarget.value)
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+const registryWithSettings: Partial<ToolRegistry> = {
+  autoRename: {
+    icon: null,
+    name: "Auto Rename",
+    component: null,
+    description: "Automatically rename files.",
+    categoryId: ToolCategoryId.STANDARD_TOOLS,
+    subcategoryId: SubcategoryId.GENERAL,
+    automationSettings: DemoSettings,
+  },
+};
+
+/** Registry entry with a settings component: renders the tool's own configuration fields. */
+export const WithSettings: Story = {
+  args: {
+    opened: true,
+    tool: {
+      id: "1",
+      operation: "autoRename",
+      name: "Auto Rename",
+      parameters: { prefix: "invoice-" },
+    },
+    onSave: () => {},
+    onCancel: () => {},
+    toolRegistry: registryWithSettings,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/automate/ToolList.stories.tsx b/frontend/editor/src/core/components/tools/automate/ToolList.stories.tsx
new file mode 100644
index 0000000000..f9c83419c8
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/automate/ToolList.stories.tsx
@@ -0,0 +1,55 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ToolList from "@app/components/tools/automate/ToolList";
+import type { AutomationTool } from "@app/types/automation";
+import type { ToolRegistry } from "@app/data/toolsTaxonomy";
+
+// Kept empty: ToolSelector resolves `tool.operation` against this registry, and an
+// unmatched operation falls back to the search-input display rather than ToolButton
+// (which needs Hotkey/ToolWorkflow context this story doesn't mount).
+const emptyToolRegistry: Partial<ToolRegistry> = {};
+
+const configuredTools: AutomationTool[] = [
+  {
+    id: "step-1",
+    operation: "compress",
+    name: "Compress",
+    configured: true,
+    parameters: {},
+  },
+  {
+    id: "step-2",
+    operation: "flatten",
+    name: "Flatten",
+    configured: false,
+    parameters: {},
+  },
+];
+
+const meta = {
+  title: "Tools/Automate/ToolList",
+  component: ToolList,
+  args: {
+    toolRegistry: emptyToolRegistry,
+    onToolUpdate: () => {},
+    onToolRemove: () => {},
+    onToolConfigure: () => {},
+    onToolAdd: () => {},
+    getToolName: (operation: string) => operation,
+    getToolDefaultParameters: () => ({}),
+  },
+} satisfies Meta<typeof ToolList>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    tools: configuredTools,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    tools: [],
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/automate/ToolSelector.stories.tsx b/frontend/editor/src/core/components/tools/automate/ToolSelector.stories.tsx
new file mode 100644
index 0000000000..504fed0b1e
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/automate/ToolSelector.stories.tsx
@@ -0,0 +1,31 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ToolSelector from "@app/components/tools/automate/ToolSelector";
+import type { ToolRegistry } from "@app/data/toolsTaxonomy";
+
+// ToolSelector only mounts ToolButton once a tool is selected or the dropdown
+// is opened with matches, and ToolButton needs Hotkey/ToolWorkflow/AppConfig
+// context the shared preview doesn't mount. Leaving `selectedValue` unset and
+// the registry empty keeps the story on the closed search-input display.
+const emptyToolRegistry: Partial<ToolRegistry> = {};
+
+const meta = {
+  title: "Tools/Automate/ToolSelector",
+  component: ToolSelector,
+  args: {
+    onSelect: () => {},
+    toolRegistry: emptyToolRegistry,
+  },
+} satisfies Meta<typeof ToolSelector>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Closed search input, showing the default "Add a tool..." placeholder. */
+export const Default: Story = {};
+
+/** Custom placeholder text, e.g. when embedded in a different flow. */
+export const CustomPlaceholder: Story = {
+  args: {
+    placeholder: "Choose a step...",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/bookletImposition/BookletImpositionSettings.stories.tsx b/frontend/editor/src/core/components/tools/bookletImposition/BookletImpositionSettings.stories.tsx
new file mode 100644
index 0000000000..7d1dc55e4d
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/bookletImposition/BookletImpositionSettings.stories.tsx
@@ -0,0 +1,42 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import BookletImpositionSettings from "@app/components/tools/bookletImposition/BookletImpositionSettings";
+import {
+  BookletImpositionParameters,
+  defaultParameters,
+} from "@app/hooks/tools/bookletImposition/useBookletImpositionParameters";
+
+const meta = {
+  title: "Tools/BookletImposition/BookletImpositionSettings",
+  component: BookletImpositionSettings,
+} satisfies Meta<typeof BookletImpositionSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const manualDuplexParameters: BookletImpositionParameters = {
+  ...defaultParameters,
+  doubleSided: false,
+  duplexPass: "FIRST",
+};
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const ManualDuplex: Story = {
+  args: {
+    parameters: manualDuplexParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/CertSignAutomationSettings.stories.tsx b/frontend/editor/src/core/components/tools/certSign/CertSignAutomationSettings.stories.tsx
new file mode 100644
index 0000000000..449ca5bf6a
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/CertSignAutomationSettings.stories.tsx
@@ -0,0 +1,59 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CertSignAutomationSettings from "@app/components/tools/certSign/CertSignAutomationSettings";
+import {
+  CertSignParameters,
+  defaultParameters,
+} from "@app/hooks/tools/certSign/useCertSignParameters";
+
+const meta = {
+  title: "Tools/CertSign/CertSignAutomationSettings",
+  component: CertSignAutomationSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof CertSignAutomationSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function SettingsDemo({
+  initialParameters = defaultParameters,
+  disabled,
+}: {
+  initialParameters?: CertSignParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<CertSignParameters>(initialParameters);
+
+  return (
+    <CertSignAutomationSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <SettingsDemo />,
+};
+
+export const AutoSignMode: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        signMode: "AUTO",
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => <SettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/CertificateFilesSettings.stories.tsx b/frontend/editor/src/core/components/tools/certSign/CertificateFilesSettings.stories.tsx
new file mode 100644
index 0000000000..137fc8272a
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/CertificateFilesSettings.stories.tsx
@@ -0,0 +1,81 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CertificateFilesSettings from "@app/components/tools/certSign/CertificateFilesSettings";
+import {
+  CertSignParameters,
+  defaultParameters,
+} from "@app/hooks/tools/certSign/useCertSignParameters";
+
+const meta = {
+  title: "Tools/CertSign/CertificateFilesSettings",
+  component: CertificateFilesSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof CertificateFilesSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function SettingsDemo({
+  initialParameters = defaultParameters,
+  disabled,
+}: {
+  initialParameters?: CertSignParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<CertSignParameters>(initialParameters);
+
+  return (
+    <CertificateFilesSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{ ...defaultParameters, certType: "PEM" }}
+    />
+  ),
+};
+
+export const Pkcs12: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{ ...defaultParameters, certType: "PKCS12" }}
+    />
+  ),
+};
+
+export const Jks: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{ ...defaultParameters, certType: "JKS" }}
+    />
+  ),
+};
+
+export const AutoSignMode: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{ ...defaultParameters, signMode: "AUTO" }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{ ...defaultParameters, certType: "PEM" }}
+      disabled
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/CertificateFormatSettings.stories.tsx b/frontend/editor/src/core/components/tools/certSign/CertificateFormatSettings.stories.tsx
new file mode 100644
index 0000000000..02a30d6382
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/CertificateFormatSettings.stories.tsx
@@ -0,0 +1,33 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CertificateFormatSettings from "@app/components/tools/certSign/CertificateFormatSettings";
+import { defaultParameters } from "@app/hooks/tools/certSign/useCertSignParameters";
+
+const meta = {
+  title: "Tools/CertSign/CertificateFormatSettings",
+  component: CertificateFormatSettings,
+} satisfies Meta<typeof CertificateFormatSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const Selected: Story = {
+  args: {
+    parameters: { ...defaultParameters, certType: "PKCS12" },
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/CertificateSelector.stories.tsx b/frontend/editor/src/core/components/tools/certSign/CertificateSelector.stories.tsx
new file mode 100644
index 0000000000..8caa8726f5
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/CertificateSelector.stories.tsx
@@ -0,0 +1,82 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  CertificateSelector,
+  CertificateType,
+  UploadFormat,
+} from "@app/components/tools/certSign/CertificateSelector";
+
+const meta = {
+  title: "Tools/CertSign/CertificateSelector",
+  component: CertificateSelector,
+  parameters: { layout: "padded" },
+  args: {
+    certType: "UPLOAD",
+    onCertTypeChange: () => {},
+    uploadFormat: "PKCS12",
+    onUploadFormatChange: () => {},
+    p12File: null,
+    onP12FileChange: () => {},
+    privateKeyFile: null,
+    onPrivateKeyFileChange: () => {},
+    certFile: null,
+    onCertFileChange: () => {},
+    jksFile: null,
+    onJksFileChange: () => {},
+    password: "",
+    onPasswordChange: () => {},
+  },
+} satisfies Meta<typeof CertificateSelector>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function SelectorDemo({
+  initialCertType = "UPLOAD",
+  initialUploadFormat = "PKCS12",
+  disabled,
+}: {
+  initialCertType?: CertificateType;
+  initialUploadFormat?: UploadFormat;
+  disabled?: boolean;
+}) {
+  const [certType, setCertType] = useState<CertificateType>(initialCertType);
+  const [uploadFormat, setUploadFormat] =
+    useState<UploadFormat>(initialUploadFormat);
+  const [p12File, setP12File] = useState<File | null>(null);
+  const [privateKeyFile, setPrivateKeyFile] = useState<File | null>(null);
+  const [certFile, setCertFile] = useState<File | null>(null);
+  const [jksFile, setJksFile] = useState<File | null>(null);
+  const [password, setPassword] = useState("");
+
+  return (
+    <CertificateSelector
+      certType={certType}
+      onCertTypeChange={setCertType}
+      uploadFormat={uploadFormat}
+      onUploadFormatChange={setUploadFormat}
+      p12File={p12File}
+      onP12FileChange={setP12File}
+      privateKeyFile={privateKeyFile}
+      onPrivateKeyFileChange={setPrivateKeyFile}
+      certFile={certFile}
+      onCertFileChange={setCertFile}
+      jksFile={jksFile}
+      onJksFileChange={setJksFile}
+      password={password}
+      onPasswordChange={setPassword}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <SelectorDemo />,
+};
+
+export const PemFormat: Story = {
+  render: () => <SelectorDemo initialUploadFormat="PEM" />,
+};
+
+export const Disabled: Story = {
+  render: () => <SelectorDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.stories.tsx b/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.stories.tsx
new file mode 100644
index 0000000000..2ad8f660a0
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/CertificateTypeSettings.stories.tsx
@@ -0,0 +1,82 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CertificateTypeSettings from "@app/components/tools/certSign/CertificateTypeSettings";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import {
+  CertSignParameters,
+  defaultParameters,
+} from "@app/hooks/tools/certSign/useCertSignParameters";
+
+const meta = {
+  title: "Tools/CertSign/CertificateTypeSettings",
+  component: CertificateTypeSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof CertificateTypeSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function SettingsDemo({
+  initialParameters = defaultParameters,
+  disabled,
+  serverCertificateEnabled = false,
+  hardwareSigningAvailable = false,
+}: {
+  initialParameters?: CertSignParameters;
+  disabled?: boolean;
+  serverCertificateEnabled?: boolean;
+  hardwareSigningAvailable?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<CertSignParameters>(initialParameters);
+
+  return (
+    <AppConfigProvider
+      autoFetch={false}
+      initialConfig={{ serverCertificateEnabled, hardwareSigningAvailable }}
+    >
+      <CertificateTypeSettings
+        parameters={parameters}
+        onParameterChange={(key, value) =>
+          setParameters((prev) => ({ ...prev, [key]: value }))
+        }
+        disabled={disabled}
+      />
+    </AppConfigProvider>
+  );
+}
+
+/** No server certificate or hardware signing available — just the informational message. */
+export const Default: Story = {
+  render: () => <SettingsDemo />,
+};
+
+/** Server certificate and on-device signing both available alongside upload. */
+export const AllSourcesAvailable: Story = {
+  render: () => (
+    <SettingsDemo serverCertificateEnabled hardwareSigningAvailable />
+  ),
+};
+
+/** Server certificate selected as the active source. */
+export const ServerSelected: Story = {
+  render: () => (
+    <SettingsDemo
+      serverCertificateEnabled
+      hardwareSigningAvailable
+      initialParameters={{
+        ...defaultParameters,
+        signMode: "AUTO",
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <SettingsDemo disabled serverCertificateEnabled hardwareSigningAvailable />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/HardwareCertificateSettings.stories.tsx b/frontend/editor/src/core/components/tools/certSign/HardwareCertificateSettings.stories.tsx
new file mode 100644
index 0000000000..2e34f1e2a5
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/HardwareCertificateSettings.stories.tsx
@@ -0,0 +1,79 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import HardwareCertificateSettings from "@app/components/tools/certSign/HardwareCertificateSettings";
+import { CertSignParameters } from "@app/hooks/tools/certSign/useCertSignParameters";
+
+const baseParameters: CertSignParameters = {
+  signMode: "DEVICE",
+  certType: "WINDOWS_STORE",
+  password: "",
+  showSignature: false,
+  reason: "",
+  location: "",
+  name: "",
+  pageNumber: 1,
+  showLogo: true,
+};
+
+const meta = {
+  title: "Tools/CertSign/HardwareCertificateSettings",
+  component: HardwareCertificateSettings,
+  args: {
+    parameters: baseParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof HardwareCertificateSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+// The component owns no state itself, so each story wraps it in a small
+// stateful shim to keep the kind toggle / driver / PIN inputs interactive
+// in the canvas. Capability + certificate lookups hit the backend and are
+// expected to fail in Storybook - the component treats that as best-effort
+// and still renders the picker.
+const HardwareCertificateSettingsDemo = (props: {
+  initialParameters: CertSignParameters;
+  disabled?: boolean;
+}) => {
+  const [parameters, setParameters] = useState<CertSignParameters>(
+    props.initialParameters,
+  );
+
+  return (
+    <HardwareCertificateSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={props.disabled}
+    />
+  );
+};
+
+export const Default: Story = {
+  render: () => (
+    <HardwareCertificateSettingsDemo initialParameters={baseParameters} />
+  ),
+};
+
+export const Pkcs11: Story = {
+  render: () => (
+    <HardwareCertificateSettingsDemo
+      initialParameters={{
+        ...baseParameters,
+        certType: "PKCS11",
+        password: "1234",
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <HardwareCertificateSettingsDemo
+      initialParameters={baseParameters}
+      disabled
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/SignatureAppearanceSettings.stories.tsx b/frontend/editor/src/core/components/tools/certSign/SignatureAppearanceSettings.stories.tsx
new file mode 100644
index 0000000000..13c1e333f6
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/SignatureAppearanceSettings.stories.tsx
@@ -0,0 +1,67 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SignatureAppearanceSettings from "@app/components/tools/certSign/SignatureAppearanceSettings";
+import {
+  CertSignParameters,
+  defaultParameters,
+} from "@app/hooks/tools/certSign/useCertSignParameters";
+
+const meta = {
+  title: "Tools/CertSign/SignatureAppearanceSettings",
+  component: SignatureAppearanceSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof SignatureAppearanceSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function SettingsDemo({
+  initialParameters = defaultParameters,
+  disabled,
+}: {
+  initialParameters?: CertSignParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<CertSignParameters>(initialParameters);
+
+  return (
+    <SignatureAppearanceSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <SettingsDemo />,
+};
+
+export const VisibleSignature: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        showSignature: true,
+        reason: "Approved",
+        location: "Head Office",
+        name: "Jane Doe",
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <SettingsDemo
+      disabled
+      initialParameters={{ ...defaultParameters, showSignature: true }}
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/SignatureSettingsDisplay.stories.tsx b/frontend/editor/src/core/components/tools/certSign/SignatureSettingsDisplay.stories.tsx
new file mode 100644
index 0000000000..cd41aa7ca1
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/SignatureSettingsDisplay.stories.tsx
@@ -0,0 +1,40 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SignatureSettingsDisplay from "@app/components/tools/certSign/SignatureSettingsDisplay";
+
+const meta = {
+  title: "CertSign/SignatureSettingsDisplay",
+  component: SignatureSettingsDisplay,
+} satisfies Meta<typeof SignatureSettingsDisplay>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    showSignature: true,
+    pageNumber: 1,
+    reason: "Document approval",
+    location: "New York, USA",
+    showLogo: true,
+  },
+};
+
+export const Invisible: Story = {
+  args: {
+    showSignature: false,
+    pageNumber: null,
+    reason: null,
+    location: null,
+    showLogo: false,
+  },
+};
+
+export const MinimalDetails: Story = {
+  args: {
+    showSignature: true,
+    pageNumber: null,
+    reason: null,
+    location: null,
+    showLogo: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/SignatureSettingsInput.stories.tsx b/frontend/editor/src/core/components/tools/certSign/SignatureSettingsInput.stories.tsx
new file mode 100644
index 0000000000..87b4127647
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/SignatureSettingsInput.stories.tsx
@@ -0,0 +1,59 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SignatureSettingsInput, {
+  SignatureSettings,
+} from "@app/components/tools/certSign/SignatureSettingsInput";
+
+const meta = {
+  title: "Tools/CertSign/SignatureSettingsInput",
+  component: SignatureSettingsInput,
+  parameters: { layout: "padded" },
+  args: {
+    value: {},
+    onChange: () => {},
+  },
+} satisfies Meta<typeof SignatureSettingsInput>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function SettingsDemo({
+  initialValue = {},
+  disabled,
+}: {
+  initialValue?: SignatureSettings;
+  disabled?: boolean;
+}) {
+  const [value, setValue] = useState<SignatureSettings>(initialValue);
+
+  return (
+    <SignatureSettingsInput
+      value={value}
+      onChange={setValue}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <SettingsDemo />,
+};
+
+export const VisibleSignature: Story = {
+  render: () => (
+    <SettingsDemo
+      initialValue={{
+        showSignature: true,
+        reason: "Contract approval",
+        location: "London, UK",
+        pageNumber: 1,
+        showLogo: true,
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <SettingsDemo disabled initialValue={{ showSignature: true }} />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/WetSignatureInput.stories.tsx b/frontend/editor/src/core/components/tools/certSign/WetSignatureInput.stories.tsx
new file mode 100644
index 0000000000..12a1ef08fe
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/WetSignatureInput.stories.tsx
@@ -0,0 +1,60 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import WetSignatureInput from "@app/components/tools/certSign/WetSignatureInput";
+
+const meta = {
+  title: "Tools/CertSign/WetSignatureInput",
+  component: WetSignatureInput,
+  parameters: { layout: "padded" },
+  args: {
+    onSignatureDataChange: () => {},
+    onSignatureTypeChange: () => {},
+    onCertTypeChange: () => {},
+    onP12FileChange: () => {},
+    onPasswordChange: () => {},
+    certType: "USER_CERT",
+    p12File: null,
+    password: "",
+  },
+} satisfies Meta<typeof WetSignatureInput>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function WetSignatureInputDemo(
+  props: Partial<React.ComponentProps<typeof WetSignatureInput>>,
+) {
+  const [certType, setCertType] = useState<"SERVER" | "USER_CERT" | "UPLOAD">(
+    props.certType ?? "USER_CERT",
+  );
+  const [p12File, setP12File] = useState<File | null>(props.p12File ?? null);
+  const [password, setPassword] = useState(props.password ?? "");
+
+  return (
+    <WetSignatureInput
+      onSignatureDataChange={() => {}}
+      onSignatureTypeChange={() => {}}
+      onP12FileChange={setP12File}
+      onPasswordChange={setPassword}
+      {...props}
+      certType={certType}
+      onCertTypeChange={setCertType}
+      p12File={p12File}
+      password={password}
+    />
+  );
+}
+
+/** Default state: personal certificate selected, canvas signature type. */
+export const Default: Story = {
+  render: () => <WetSignatureInputDemo />,
+};
+
+/** Upload-certificate flow, revealing the P12 file and password fields. */
+export const UploadCertificate: Story = {
+  render: () => <WetSignatureInputDemo certType="UPLOAD" />,
+};
+
+/** All controls disabled. */
+export const Disabled: Story = {
+  render: () => <WetSignatureInputDemo disabled certType="UPLOAD" />,
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/modals/AddParticipantsFlow.stories.tsx b/frontend/editor/src/core/components/tools/certSign/modals/AddParticipantsFlow.stories.tsx
new file mode 100644
index 0000000000..316ad9d8b0
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/modals/AddParticipantsFlow.stories.tsx
@@ -0,0 +1,22 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { AddParticipantsFlow } from "@app/components/tools/certSign/modals/AddParticipantsFlow";
+
+const meta = {
+  title: "Tools/CertSign/Modals/AddParticipantsFlow",
+  component: AddParticipantsFlow,
+  parameters: { layout: "padded" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    onSubmit: async () => {},
+  },
+} satisfies Meta<typeof AddParticipantsFlow>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Closed: Story = {
+  args: { opened: false },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/modals/CertificateConfigModal.stories.tsx b/frontend/editor/src/core/components/tools/certSign/modals/CertificateConfigModal.stories.tsx
new file mode 100644
index 0000000000..2962196a74
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/modals/CertificateConfigModal.stories.tsx
@@ -0,0 +1,26 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { CertificateConfigModal } from "@app/components/tools/certSign/modals/CertificateConfigModal";
+
+const meta = {
+  title: "Tools/CertSign/Modals/CertificateConfigModal",
+  component: CertificateConfigModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    onSign: async () => {},
+    signatureCount: 1,
+  },
+} satisfies Meta<typeof CertificateConfigModal>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const MultipleSignatures: Story = {
+  args: { signatureCount: 3 },
+};
+
+export const Disabled: Story = {
+  args: { disabled: true },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/modals/SelectSignatureModal.stories.tsx b/frontend/editor/src/core/components/tools/certSign/modals/SelectSignatureModal.stories.tsx
new file mode 100644
index 0000000000..28f2948249
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/modals/SelectSignatureModal.stories.tsx
@@ -0,0 +1,18 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SelectSignatureModal } from "@app/components/tools/certSign/modals/SelectSignatureModal";
+
+const meta = {
+  title: "Tools/CertSign/Modals/SelectSignatureModal",
+  component: SelectSignatureModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    onSignatureSelected: () => {},
+    onCreateNew: () => {},
+  },
+} satisfies Meta<typeof SelectSignatureModal>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/core/components/tools/certSign/panels/ParticipantListPanel.stories.tsx b/frontend/editor/src/core/components/tools/certSign/panels/ParticipantListPanel.stories.tsx
new file mode 100644
index 0000000000..fc4df3c7c8
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/panels/ParticipantListPanel.stories.tsx
@@ -0,0 +1,63 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ParticipantListPanel } from "@app/components/tools/certSign/panels/ParticipantListPanel";
+import type { ParticipantInfo } from "@app/types/signingSession";
+
+const meta = {
+  title: "CertSign/ParticipantListPanel",
+  component: ParticipantListPanel,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ParticipantListPanel>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const participants: ParticipantInfo[] = [
+  {
+    id: 1,
+    userId: 101,
+    email: "alice@example.com",
+    name: "Alice Anderson",
+    status: "SIGNED",
+    lastUpdated: "2026-07-10T12:00:00Z",
+  },
+  {
+    id: 2,
+    userId: 102,
+    email: "bob@example.com",
+    name: "Bob Brown",
+    status: "PENDING",
+    lastUpdated: "2026-07-11T09:00:00Z",
+  },
+  {
+    id: 3,
+    userId: 103,
+    email: "carol@example.com",
+    name: "Carol Clark",
+    status: "DECLINED",
+    lastUpdated: "2026-07-12T15:30:00Z",
+  },
+];
+
+export const Default: Story = {
+  args: {
+    participants,
+    finalized: false,
+    onRemove: () => {},
+  },
+};
+
+export const Finalized: Story = {
+  args: {
+    participants,
+    finalized: true,
+    onRemove: () => {},
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    participants: [],
+    finalized: false,
+    onRemove: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/panels/SessionActionsPanel.stories.tsx b/frontend/editor/src/core/components/tools/certSign/panels/SessionActionsPanel.stories.tsx
new file mode 100644
index 0000000000..95575dab64
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/panels/SessionActionsPanel.stories.tsx
@@ -0,0 +1,73 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SessionActionsPanel } from "@app/components/tools/certSign/panels/SessionActionsPanel";
+import type { SessionDetail } from "@app/types/signingSession";
+
+const baseSession: SessionDetail = {
+  sessionId: "session-1",
+  documentName: "Contract.pdf",
+  ownerEmail: "owner@example.com",
+  message: "Please review and sign by end of week.",
+  dueDate: "2026-08-01",
+  createdAt: "2026-07-01T09:00:00Z",
+  updatedAt: "2026-07-10T09:00:00Z",
+  finalized: false,
+  participants: [
+    {
+      id: 1,
+      userId: 1,
+      email: "alice@example.com",
+      name: "Alice",
+      status: "SIGNED",
+      lastUpdated: "2026-07-05T09:00:00Z",
+    },
+    {
+      id: 2,
+      userId: 2,
+      email: "bob@example.com",
+      name: "Bob",
+      status: "PENDING",
+      lastUpdated: "2026-07-01T09:00:00Z",
+    },
+  ],
+};
+
+const meta = {
+  title: "Tools/CertSign/Panels/SessionActionsPanel",
+  component: SessionActionsPanel,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof SessionActionsPanel>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    session: baseSession,
+    onAddParticipants: () => {},
+    onFinalize: () => {},
+    onLoadSignedPdf: () => {},
+    finalizing: false,
+    loadingPdf: false,
+  },
+};
+
+export const AllSigned: Story = {
+  args: {
+    ...Default.args,
+    session: {
+      ...baseSession,
+      participants: baseSession.participants.map((p) => ({
+        ...p,
+        status: "SIGNED",
+      })),
+    },
+  },
+};
+
+export const Finalized: Story = {
+  args: {
+    ...Default.args,
+    session: { ...baseSession, finalized: true },
+    loadingPdf: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/panels/SessionDetailPanel.stories.tsx b/frontend/editor/src/core/components/tools/certSign/panels/SessionDetailPanel.stories.tsx
new file mode 100644
index 0000000000..fcc489a6b1
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/panels/SessionDetailPanel.stories.tsx
@@ -0,0 +1,74 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SessionDetailPanel } from "@app/components/tools/certSign/panels/SessionDetailPanel";
+import type { SigningDetailData } from "@app/hooks/signing/useSigningSessionController";
+import type { SessionDetail } from "@app/types/signingSession";
+
+const baseSession: SessionDetail = {
+  sessionId: "session-1",
+  documentName: "Employment-Contract.pdf",
+  ownerEmail: "owner@example.com",
+  message: "Please review and sign by the due date.",
+  dueDate: "2026-08-01T00:00:00Z",
+  createdAt: "2026-07-01T00:00:00Z",
+  updatedAt: "2026-07-10T00:00:00Z",
+  finalized: false,
+  participants: [
+    {
+      id: 1,
+      userId: 101,
+      email: "alice@example.com",
+      name: "Alice Johnson",
+      status: "SIGNED",
+      lastUpdated: "2026-07-05T00:00:00Z",
+    },
+    {
+      id: 2,
+      userId: 102,
+      email: "bob@example.com",
+      name: "Bob Smith",
+      status: "PENDING",
+      lastUpdated: "2026-07-01T00:00:00Z",
+    },
+  ],
+};
+
+function buildData(session: SessionDetail): SigningDetailData {
+  return {
+    session,
+    pdfFile: null,
+    onFinalize: async () => {},
+    onLoadSignedPdf: async () => {},
+    onAddParticipants: async () => {},
+    onRemoveParticipant: async () => {},
+    onDelete: async () => {},
+    onBack: () => {},
+    onRefresh: async () => {},
+  };
+}
+
+const meta = {
+  title: "CertSign/SessionDetailPanel",
+  component: SessionDetailPanel,
+} satisfies Meta<typeof SessionDetailPanel>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    data: buildData(baseSession),
+  },
+};
+
+export const Finalized: Story = {
+  args: {
+    data: buildData({
+      ...baseSession,
+      finalized: true,
+      participants: baseSession.participants.map((p) => ({
+        ...p,
+        status: "SIGNED",
+      })),
+    }),
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/panels/SignControlsPanel.stories.tsx b/frontend/editor/src/core/components/tools/certSign/panels/SignControlsPanel.stories.tsx
new file mode 100644
index 0000000000..2a1792b5c3
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/panels/SignControlsPanel.stories.tsx
@@ -0,0 +1,51 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SignControlsPanel from "@app/components/tools/certSign/panels/SignControlsPanel";
+import type { SignParameters } from "@app/hooks/tools/sign/useSignParameters";
+
+const meta = {
+  title: "CertSign/SignControlsPanel",
+  component: SignControlsPanel,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof SignControlsPanel>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const textSignatureConfig: SignParameters = {
+  signatureType: "text",
+  signerName: "Alice Anderson",
+  fontFamily: "Helvetica",
+  fontSize: 16,
+  textColor: "#000000",
+  signatureData: "Alice Anderson",
+};
+
+export const Default: Story = {
+  args: {
+    placementMode: false,
+    onPlacementModeChange: () => {},
+    onSignatureSelected: () => {},
+    onComplete: () => {},
+    canComplete: true,
+    signatureConfig: textSignatureConfig,
+    hasSelectedAnnotation: true,
+    onDeleteSelected: () => {},
+  },
+};
+
+export const PlacingNoSelection: Story = {
+  args: {
+    ...Default.args,
+    placementMode: true,
+    canComplete: false,
+    hasSelectedAnnotation: false,
+  },
+};
+
+export const NoSignatureChosen: Story = {
+  args: {
+    ...Default.args,
+    signatureConfig: { signatureType: "canvas" },
+    hasSelectedAnnotation: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/steps/AddSignaturesStep.stories.tsx b/frontend/editor/src/core/components/tools/certSign/steps/AddSignaturesStep.stories.tsx
new file mode 100644
index 0000000000..5da3dbd5ea
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/steps/AddSignaturesStep.stories.tsx
@@ -0,0 +1,33 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { AddSignaturesStep } from "@app/components/tools/certSign/steps/AddSignaturesStep";
+
+const meta = {
+  title: "Tools/CertSign/Steps/AddSignaturesStep",
+  component: AddSignaturesStep,
+} satisfies Meta<typeof AddSignaturesStep>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    onRequestPlacement: () => {},
+    placementMode: false,
+  },
+};
+
+export const PlacementMode: Story = {
+  args: {
+    onRequestPlacement: () => {},
+    onCancelPlacement: () => {},
+    placementMode: true,
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    onRequestPlacement: () => {},
+    placementMode: false,
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.stories.tsx b/frontend/editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.stories.tsx
new file mode 100644
index 0000000000..025ea7d574
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.stories.tsx
@@ -0,0 +1,102 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { CertificateSelectionStep } from "@app/components/tools/certSign/steps/CertificateSelectionStep";
+import {
+  CertificateType,
+  UploadFormat,
+} from "@app/components/tools/certSign/CertificateSelector";
+
+const meta = {
+  title: "Tools/CertSign/CertificateSelectionStep",
+  component: CertificateSelectionStep,
+  parameters: { layout: "padded" },
+  args: {
+    certType: "UPLOAD",
+    onCertTypeChange: () => {},
+    uploadFormat: "PKCS12",
+    onUploadFormatChange: () => {},
+    p12File: null,
+    onP12FileChange: () => {},
+    privateKeyFile: null,
+    onPrivateKeyFileChange: () => {},
+    certFile: null,
+    onCertFileChange: () => {},
+    jksFile: null,
+    onJksFileChange: () => {},
+    password: "",
+    onPasswordChange: () => {},
+    onBack: () => {},
+    onNext: () => {},
+  },
+} satisfies Meta<typeof CertificateSelectionStep>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function StepDemo({
+  initialCertType = "UPLOAD",
+  initialUploadFormat = "PKCS12",
+  withUploadedFile = false,
+  disabled,
+}: {
+  initialCertType?: CertificateType;
+  initialUploadFormat?: UploadFormat;
+  withUploadedFile?: boolean;
+  disabled?: boolean;
+}) {
+  const [certType, setCertType] = useState<CertificateType>(initialCertType);
+  const [uploadFormat, setUploadFormat] =
+    useState<UploadFormat>(initialUploadFormat);
+  const [p12File, setP12File] = useState<File | null>(
+    withUploadedFile
+      ? new File(["mock"], "certificate.p12", {
+          type: "application/x-pkcs12",
+        })
+      : null,
+  );
+  const [privateKeyFile, setPrivateKeyFile] = useState<File | null>(null);
+  const [certFile, setCertFile] = useState<File | null>(null);
+  const [jksFile, setJksFile] = useState<File | null>(null);
+  const [password, setPassword] = useState(withUploadedFile ? "secret" : "");
+
+  return (
+    <CertificateSelectionStep
+      certType={certType}
+      onCertTypeChange={setCertType}
+      uploadFormat={uploadFormat}
+      onUploadFormatChange={setUploadFormat}
+      p12File={p12File}
+      onP12FileChange={setP12File}
+      privateKeyFile={privateKeyFile}
+      onPrivateKeyFileChange={setPrivateKeyFile}
+      certFile={certFile}
+      onCertFileChange={setCertFile}
+      jksFile={jksFile}
+      onJksFileChange={setJksFile}
+      password={password}
+      onPasswordChange={setPassword}
+      onBack={() => {}}
+      onNext={() => {}}
+      disabled={disabled}
+    />
+  );
+}
+
+/** Upload flow with no file/password yet — "Continue" stays disabled. */
+export const Default: Story = {
+  render: () => <StepDemo />,
+};
+
+/** Upload flow with a certificate + password already provided — "Continue" is enabled. */
+export const UploadReady: Story = {
+  render: () => <StepDemo withUploadedFile />,
+};
+
+/** Pre-installed user certificate — always valid, no upload fields required. */
+export const UserCertificate: Story = {
+  render: () => <StepDemo initialCertType="USER_CERT" />,
+};
+
+/** Whole step disabled (e.g. while a request is in flight). */
+export const Disabled: Story = {
+  render: () => <StepDemo withUploadedFile disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.stories.tsx b/frontend/editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.stories.tsx
new file mode 100644
index 0000000000..76e920b0db
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.stories.tsx
@@ -0,0 +1,57 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ReviewSignatureStep } from "@app/components/tools/certSign/steps/ReviewSignatureStep";
+import type { SignRequestDetail } from "@app/types/signingSession";
+
+const signRequest: SignRequestDetail = {
+  sessionId: "session-1",
+  documentName: "Contract.pdf",
+  ownerUsername: "owner@example.com",
+  message: "Please sign the attached contract.",
+  dueDate: "2026-08-01T00:00:00Z",
+  createdAt: "2026-07-15T00:00:00Z",
+  myStatus: "VIEWED",
+  showSignature: true,
+  pageNumber: 1,
+  reason: "Contract approval",
+  location: "London, UK",
+};
+
+const meta = {
+  title: "CertSign/ReviewSignatureStep",
+  component: ReviewSignatureStep,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ReviewSignatureStep>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    signatureCount: 1,
+    certType: "USER_CERT",
+    uploadFormat: "PKCS12",
+    p12File: null,
+    signRequest,
+    onBack: () => {},
+    onSign: () => {},
+    onDecline: () => {},
+  },
+};
+
+export const MultipleSignatures: Story = {
+  args: {
+    ...Default.args,
+    signatureCount: 3,
+    certType: "SERVER",
+  },
+};
+
+export const UploadedCertificateDisabled: Story = {
+  args: {
+    ...Default.args,
+    certType: "UPLOAD",
+    uploadFormat: "PFX",
+    p12File: new File(["dummy"], "my-cert.pfx"),
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/steps/SignatureCreationStep.stories.tsx b/frontend/editor/src/core/components/tools/certSign/steps/SignatureCreationStep.stories.tsx
new file mode 100644
index 0000000000..c99f9a0fa9
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/steps/SignatureCreationStep.stories.tsx
@@ -0,0 +1,53 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SignatureCreationStep } from "@app/components/tools/certSign/steps/SignatureCreationStep";
+
+const meta = {
+  title: "CertSign/Steps/SignatureCreationStep",
+  component: SignatureCreationStep,
+} satisfies Meta<typeof SignatureCreationStep>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    signatureType: "draw",
+    onSignatureTypeChange: () => {},
+    signature: null,
+    onSignatureChange: () => {},
+    signatureText: "",
+    fontFamily: "Helvetica",
+    fontSize: 32,
+    textColor: "#000000",
+    onSignatureTextChange: () => {},
+    onFontFamilyChange: () => {},
+    onFontSizeChange: () => {},
+    onTextColorChange: () => {},
+    onNext: () => {},
+  },
+};
+
+export const WithSignature: Story = {
+  args: {
+    ...Default.args,
+    signature:
+      "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=",
+  },
+};
+
+export const TypeMode: Story = {
+  args: {
+    ...Default.args,
+    signatureType: "type",
+    signatureText: "Jane Doe",
+    signature:
+      "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=",
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    ...Default.args,
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.stories.tsx b/frontend/editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.stories.tsx
new file mode 100644
index 0000000000..685d06b89f
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.stories.tsx
@@ -0,0 +1,53 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SignaturePlacementStep } from "@app/components/tools/certSign/steps/SignaturePlacementStep";
+
+const meta = {
+  title: "Tools/CertSign/SignaturePlacementStep",
+  component: SignaturePlacementStep,
+} satisfies Meta<typeof SignaturePlacementStep>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    isPlaced: false,
+    placementInfo: null,
+    onBack: () => {},
+    onNext: () => {},
+    children: (
+      <div
+        style={{ background: "var(--mantine-color-gray-1)", height: "100%" }}
+      />
+    ),
+  },
+};
+
+export const Placed: Story = {
+  args: {
+    isPlaced: true,
+    placementInfo: { page: 2, x: 120, y: 340 },
+    onBack: () => {},
+    onNext: () => {},
+    children: (
+      <div
+        style={{ background: "var(--mantine-color-gray-1)", height: "100%" }}
+      />
+    ),
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    isPlaced: true,
+    placementInfo: { page: 1, x: 50, y: 50 },
+    onBack: () => {},
+    onNext: () => {},
+    disabled: true,
+    children: (
+      <div
+        style={{ background: "var(--mantine-color-gray-1)", height: "100%" }}
+      />
+    ),
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/changeMetadata/steps/AdvancedOptionsStep.stories.tsx b/frontend/editor/src/core/components/tools/changeMetadata/steps/AdvancedOptionsStep.stories.tsx
new file mode 100644
index 0000000000..ce15dd5922
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/changeMetadata/steps/AdvancedOptionsStep.stories.tsx
@@ -0,0 +1,36 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AdvancedOptionsStep from "@app/components/tools/changeMetadata/steps/AdvancedOptionsStep";
+import { defaultParameters } from "@app/hooks/tools/changeMetadata/useChangeMetadataParameters";
+import { TrappedStatus } from "@app/types/metadata";
+
+const meta = {
+  title: "Tools/ChangeMetadata/Steps/AdvancedOptionsStep",
+  component: AdvancedOptionsStep,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    addCustomMetadata: () => {},
+    removeCustomMetadata: () => {},
+    updateCustomMetadata: () => {},
+  },
+} satisfies Meta<typeof AdvancedOptionsStep>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const WithCustomMetadata: Story = {
+  args: {
+    parameters: {
+      ...defaultParameters,
+      trapped: TrappedStatus.TRUE,
+      customMetadata: [{ id: "1", key: "CustomField", value: "CustomValue" }],
+    },
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/changeMetadata/steps/CustomMetadataStep.stories.tsx b/frontend/editor/src/core/components/tools/changeMetadata/steps/CustomMetadataStep.stories.tsx
new file mode 100644
index 0000000000..4ba366f972
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/changeMetadata/steps/CustomMetadataStep.stories.tsx
@@ -0,0 +1,79 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CustomMetadataStep from "@app/components/tools/changeMetadata/steps/CustomMetadataStep";
+import {
+  ChangeMetadataParameters,
+  defaultParameters,
+  createCustomMetadataFunctions,
+} from "@app/hooks/tools/changeMetadata/useChangeMetadataParameters";
+import { CustomMetadataEntry } from "@app/types/metadata";
+
+const meta = {
+  title: "Tools/ChangeMetadata/CustomMetadataStep",
+  component: CustomMetadataStep,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    addCustomMetadata: () => {},
+    removeCustomMetadata: () => {},
+    updateCustomMetadata: () => {},
+  },
+} satisfies Meta<typeof CustomMetadataStep>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function CustomMetadataStepDemo({
+  disabled,
+  customMetadata = [],
+}: {
+  disabled?: boolean;
+  customMetadata?: CustomMetadataEntry[];
+}) {
+  const [parameters, setParameters] = useState<ChangeMetadataParameters>({
+    ...defaultParameters,
+    customMetadata,
+  });
+
+  const onParameterChange = <K extends keyof ChangeMetadataParameters>(
+    key: K,
+    value: ChangeMetadataParameters[K],
+  ) => setParameters((prev) => ({ ...prev, [key]: value }));
+
+  const { addCustomMetadata, removeCustomMetadata, updateCustomMetadata } =
+    createCustomMetadataFunctions(parameters, onParameterChange);
+
+  return (
+    <CustomMetadataStep
+      parameters={parameters}
+      onParameterChange={onParameterChange}
+      disabled={disabled}
+      addCustomMetadata={addCustomMetadata}
+      removeCustomMetadata={removeCustomMetadata}
+      updateCustomMetadata={updateCustomMetadata}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <CustomMetadataStepDemo />,
+};
+
+export const WithEntries: Story = {
+  render: () => (
+    <CustomMetadataStepDemo
+      customMetadata={[
+        { id: "custom1", key: "Department", value: "Finance" },
+        { id: "custom2", key: "Reviewed", value: "Yes" },
+      ]}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <CustomMetadataStepDemo
+      disabled
+      customMetadata={[{ id: "custom1", key: "Department", value: "Finance" }]}
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/changeMetadata/steps/DeleteAllStep.stories.tsx b/frontend/editor/src/core/components/tools/changeMetadata/steps/DeleteAllStep.stories.tsx
new file mode 100644
index 0000000000..d03e977157
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/changeMetadata/steps/DeleteAllStep.stories.tsx
@@ -0,0 +1,53 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import DeleteAllStep from "@app/components/tools/changeMetadata/steps/DeleteAllStep";
+import {
+  ChangeMetadataParameters,
+  defaultParameters,
+} from "@app/hooks/tools/changeMetadata/useChangeMetadataParameters";
+
+const meta = {
+  title: "Tools/ChangeMetadata/DeleteAllStep",
+  component: DeleteAllStep,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof DeleteAllStep>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function DeleteAllStepDemo({
+  disabled,
+  deleteAll = false,
+}: {
+  disabled?: boolean;
+  deleteAll?: boolean;
+}) {
+  const [parameters, setParameters] = useState<ChangeMetadataParameters>({
+    ...defaultParameters,
+    deleteAll,
+  });
+
+  return (
+    <DeleteAllStep
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <DeleteAllStepDemo />,
+};
+
+export const Checked: Story = {
+  render: () => <DeleteAllStepDemo deleteAll />,
+};
+
+export const Disabled: Story = {
+  render: () => <DeleteAllStepDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/changeMetadata/steps/DocumentDatesStep.stories.tsx b/frontend/editor/src/core/components/tools/changeMetadata/steps/DocumentDatesStep.stories.tsx
new file mode 100644
index 0000000000..d6b8de2337
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/changeMetadata/steps/DocumentDatesStep.stories.tsx
@@ -0,0 +1,66 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import DocumentDatesStep from "@app/components/tools/changeMetadata/steps/DocumentDatesStep";
+import {
+  ChangeMetadataParameters,
+  defaultParameters,
+} from "@app/hooks/tools/changeMetadata/useChangeMetadataParameters";
+
+const meta = {
+  title: "Tools/ChangeMetadata/DocumentDatesStep",
+  component: DocumentDatesStep,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof DocumentDatesStep>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function DocumentDatesStepDemo({
+  disabled,
+  creationDate = null,
+  modificationDate = null,
+}: {
+  disabled?: boolean;
+  creationDate?: Date | null;
+  modificationDate?: Date | null;
+}) {
+  const [parameters, setParameters] = useState<ChangeMetadataParameters>({
+    ...defaultParameters,
+    creationDate,
+    modificationDate,
+  });
+
+  return (
+    <DocumentDatesStep
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <DocumentDatesStepDemo />,
+};
+
+export const Filled: Story = {
+  render: () => (
+    <DocumentDatesStepDemo
+      creationDate={new Date("2024-01-15T09:30:00")}
+      modificationDate={new Date("2026-06-01T14:00:00")}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <DocumentDatesStepDemo
+      disabled
+      creationDate={new Date("2024-01-15T09:30:00")}
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/changeMetadata/steps/StandardMetadataStep.stories.tsx b/frontend/editor/src/core/components/tools/changeMetadata/steps/StandardMetadataStep.stories.tsx
new file mode 100644
index 0000000000..34dacc7d41
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/changeMetadata/steps/StandardMetadataStep.stories.tsx
@@ -0,0 +1,62 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import StandardMetadataStep from "@app/components/tools/changeMetadata/steps/StandardMetadataStep";
+import {
+  ChangeMetadataParameters,
+  defaultParameters,
+} from "@app/hooks/tools/changeMetadata/useChangeMetadataParameters";
+
+const meta = {
+  title: "Tools/ChangeMetadata/StandardMetadataStep",
+  component: StandardMetadataStep,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof StandardMetadataStep>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function StandardMetadataStepDemo({
+  disabled,
+  filled = false,
+}: {
+  disabled?: boolean;
+  filled?: boolean;
+}) {
+  const [parameters, setParameters] = useState<ChangeMetadataParameters>({
+    ...defaultParameters,
+    ...(filled
+      ? {
+          title: "Annual Report 2026",
+          author: "Jane Doe",
+          subject: "Financial Summary",
+          keywords: "finance, report, annual",
+          creator: "Stirling PDF",
+          producer: "Stirling PDF",
+        }
+      : {}),
+  });
+
+  return (
+    <StandardMetadataStep
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <StandardMetadataStepDemo />,
+};
+
+export const Filled: Story = {
+  render: () => <StandardMetadataStepDemo filled />,
+};
+
+export const Disabled: Story = {
+  render: () => <StandardMetadataStepDemo disabled filled />,
+};
diff --git a/frontend/editor/src/core/components/tools/changePermissions/ChangePermissionsSettings.stories.tsx b/frontend/editor/src/core/components/tools/changePermissions/ChangePermissionsSettings.stories.tsx
new file mode 100644
index 0000000000..8a05186886
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/changePermissions/ChangePermissionsSettings.stories.tsx
@@ -0,0 +1,48 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ChangePermissionsSettings from "@app/components/tools/changePermissions/ChangePermissionsSettings";
+import { ChangePermissionsParameters } from "@app/hooks/tools/changePermissions/useChangePermissionsParameters";
+
+const mockParameters: ChangePermissionsParameters = {
+  preventAssembly: false,
+  preventExtractContent: false,
+  preventExtractForAccessibility: false,
+  preventFillInForm: false,
+  preventModify: false,
+  preventModifyAnnotations: false,
+  preventPrinting: false,
+  preventPrintingFaithful: false,
+};
+
+const meta: Meta<typeof ChangePermissionsSettings> = {
+  title: "Tools/ChangePermissions/ChangePermissionsSettings",
+  component: ChangePermissionsSettings,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: mockParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const SomeRestricted: Story = {
+  args: {
+    parameters: {
+      ...mockParameters,
+      preventPrinting: true,
+      preventModify: true,
+    },
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: mockParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/compare/CompareDocumentPane.stories.tsx b/frontend/editor/src/core/components/tools/compare/CompareDocumentPane.stories.tsx
new file mode 100644
index 0000000000..09d27d5ad5
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/compare/CompareDocumentPane.stories.tsx
@@ -0,0 +1,75 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CompareDocumentPane from "@app/components/tools/compare/CompareDocumentPane";
+import type { PagePreview } from "@app/types/compare";
+
+// 1x1 transparent PNG so the pane's <img> resolves without a network request.
+const PLACEHOLDER_PAGE_IMAGE =
+  "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=";
+
+const buildPages = (count: number): PagePreview[] =>
+  Array.from({ length: count }, (_, index) => ({
+    pageNumber: index + 1,
+    width: 612,
+    height: 792,
+    rotation: 0,
+    url: PLACEHOLDER_PAGE_IMAGE,
+  }));
+
+const meta = {
+  title: "Tools/Compare/CompareDocumentPane",
+  component: CompareDocumentPane,
+  // Excluded from the automated (Vitest browser) test run: mounting several of
+  // these panes in one page exhausts the headless browser's memory and the page
+  // is dropped mid-run, which fails the whole file rather than this component.
+  // It still renders in the Storybook UI.
+  tags: ["!test"],
+  args: {
+    pane: "base",
+    layout: "side-by-side",
+    scrollRef: { current: null },
+    peerScrollRef: { current: null },
+    handleScrollSync: () => {},
+    handleWheelZoom: () => {},
+    handleWheelOverscroll: () => {},
+    onTouchStart: () => {},
+    onTouchMove: () => {},
+    onTouchEnd: () => {},
+    isPanMode: false,
+    zoom: 1,
+    title: "original-document.pdf",
+    changes: [
+      { value: "change-1", label: "Paragraph 1 change", pageNumber: 1 },
+      { value: "change-2", label: "Paragraph 2 change", pageNumber: 2 },
+    ],
+    onNavigateChange: () => {},
+    isLoading: false,
+    processingMessage: "Processing...",
+    pages: buildPages(2),
+    pairedPages: buildPages(2),
+    getRowHeightPx: () => 792,
+    wordHighlightMap: new Map(),
+    metaIndexToGroupId: new Map(),
+    documentLabel: "Original",
+    pageLabel: "Page",
+    altLabel: "Document page preview",
+  },
+} satisfies Meta<typeof CompareDocumentPane>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Loading: Story = {
+  args: {
+    isLoading: true,
+    pages: [],
+    pairedPages: [],
+  },
+};
+
+export const NoChanges: Story = {
+  args: {
+    changes: [],
+    dropdownPlaceholder: "No changes",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/compare/CompareNavigationDropdown.stories.tsx b/frontend/editor/src/core/components/tools/compare/CompareNavigationDropdown.stories.tsx
new file mode 100644
index 0000000000..0e8f59f40e
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/compare/CompareNavigationDropdown.stories.tsx
@@ -0,0 +1,48 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CompareNavigationDropdown from "@app/components/tools/compare/CompareNavigationDropdown";
+
+const meta = {
+  title: "Compare/CompareNavigationDropdown",
+  component: CompareNavigationDropdown,
+} satisfies Meta<typeof CompareNavigationDropdown>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const sampleChanges = [
+  {
+    value: "change-1",
+    label: "Introduction paragraph reworded",
+    pageNumber: 1,
+  },
+  { value: "change-2", label: "Budget table updated", pageNumber: 1 },
+  { value: "change-3", label: "New clause added", pageNumber: 2 },
+  { value: "change-4", label: "Signature date changed", pageNumber: 3 },
+];
+
+export const Default: Story = {
+  args: {
+    changes: sampleChanges,
+    placeholder: "Jump to change",
+    onNavigate: (value, pageNumber) => {
+      console.log("navigate", value, pageNumber);
+    },
+    renderedPageNumbers: new Set([1, 2, 3]),
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    changes: [],
+    placeholder: "Jump to change",
+    onNavigate: () => {},
+  },
+};
+
+export const RenderingInProgress: Story = {
+  args: {
+    changes: sampleChanges,
+    placeholder: "Jump to change",
+    onNavigate: () => {},
+    renderedPageNumbers: new Set([1]),
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/compare/ComparePixelWorkbenchView.stories.tsx b/frontend/editor/src/core/components/tools/compare/ComparePixelWorkbenchView.stories.tsx
new file mode 100644
index 0000000000..14d47c6761
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/compare/ComparePixelWorkbenchView.stories.tsx
@@ -0,0 +1,113 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ComparePixelWorkbenchView from "@app/components/tools/compare/ComparePixelWorkbenchView";
+import type { CompareResultPixelData } from "@app/types/compare";
+
+// A tiny transparent PNG data URI so the <img> elements have something valid to
+// load without reaching out to a real file or network resource.
+const PLACEHOLDER_IMAGE =
+  "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=";
+
+const baseResult: CompareResultPixelData = {
+  mode: "pixel",
+  base: { fileId: "base-file", fileName: "contract-v1.pdf" },
+  comparison: { fileId: "comparison-file", fileName: "contract-v2.pdf" },
+  pages: [
+    {
+      pageNumber: 1,
+      width: 612,
+      height: 792,
+      baseImageUrl: PLACEHOLDER_IMAGE,
+      comparisonImageUrl: PLACEHOLDER_IMAGE,
+      diffImageUrl: PLACEHOLDER_IMAGE,
+      diffPixels: 1200,
+      totalPixels: 484704,
+      diffRatio: 0.0025,
+      sizeMismatch: false,
+    },
+    {
+      pageNumber: 2,
+      width: 612,
+      height: 792,
+      baseImageUrl: PLACEHOLDER_IMAGE,
+      comparisonImageUrl: PLACEHOLDER_IMAGE,
+      diffImageUrl: PLACEHOLDER_IMAGE,
+      diffPixels: 0,
+      totalPixels: 484704,
+      diffRatio: 0,
+      sizeMismatch: false,
+    },
+    {
+      pageNumber: 3,
+      width: 612,
+      height: 792,
+      baseImageUrl: PLACEHOLDER_IMAGE,
+      comparisonImageUrl: PLACEHOLDER_IMAGE,
+      diffImageUrl: PLACEHOLDER_IMAGE,
+      diffPixels: 96940,
+      totalPixels: 484704,
+      diffRatio: 0.2,
+      sizeMismatch: true,
+      missingComparison: true,
+    },
+  ],
+  totals: {
+    diffPixels: 98140,
+    totalPixels: 1454112,
+    diffRatio: 0.0675,
+    pagesWithChanges: 2,
+    durationMs: 842,
+    processedAt: 1752300000000,
+  },
+  warnings: [],
+  settings: {
+    dpi: 150,
+    threshold: 10,
+  },
+};
+
+const meta = {
+  title: "Tools/Compare/ComparePixelWorkbenchView",
+  component: ComparePixelWorkbenchView,
+} satisfies Meta<typeof ComparePixelWorkbenchView>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    result: baseResult,
+  },
+};
+
+export const NoDifferences: Story = {
+  args: {
+    result: {
+      ...baseResult,
+      pages: baseResult.pages.map((page) => ({
+        ...page,
+        diffPixels: 0,
+        diffRatio: 0,
+        sizeMismatch: false,
+        missingBase: undefined,
+        missingComparison: undefined,
+      })),
+      totals: {
+        ...baseResult.totals,
+        diffPixels: 0,
+        diffRatio: 0,
+        pagesWithChanges: 0,
+      },
+    },
+  },
+};
+
+export const WithWarnings: Story = {
+  args: {
+    result: {
+      ...baseResult,
+      warnings: [
+        "Page 3 could not be rendered at the requested DPI and was downscaled.",
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/compress/CompressSettings.stories.tsx b/frontend/editor/src/core/components/tools/compress/CompressSettings.stories.tsx
new file mode 100644
index 0000000000..672f436e56
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/compress/CompressSettings.stories.tsx
@@ -0,0 +1,76 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CompressSettings from "@app/components/tools/compress/CompressSettings";
+import {
+  CompressParameters,
+  defaultParameters,
+} from "@app/hooks/tools/compress/useCompressParameters";
+
+const meta = {
+  title: "Tools/Compress/CompressSettings",
+  component: CompressSettings,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof CompressSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+// The component owns no state itself, so each story wraps it in a small
+// stateful shim to keep the sliders/inputs interactive in the canvas.
+const CompressSettingsDemo = (props: {
+  initialParameters: CompressParameters;
+  disabled?: boolean;
+}) => {
+  const [parameters, setParameters] = useState<CompressParameters>(
+    props.initialParameters,
+  );
+
+  return (
+    <CompressSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={props.disabled}
+    />
+  );
+};
+
+export const Default: Story = {
+  render: () => <CompressSettingsDemo initialParameters={defaultParameters} />,
+};
+
+export const FileSizeMethod: Story = {
+  render: () => (
+    <CompressSettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        compressionMethod: "filesize",
+        fileSizeValue: "5",
+        fileSizeUnit: "MB",
+      }}
+    />
+  ),
+};
+
+export const LineArtEnabled: Story = {
+  render: () => (
+    <CompressSettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        lineArt: true,
+        lineArtThreshold: 50,
+        lineArtEdgeLevel: 2,
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <CompressSettingsDemo initialParameters={defaultParameters} disabled />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertFromCbrSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertFromCbrSettings.stories.tsx
new file mode 100644
index 0000000000..0f9f386add
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertFromCbrSettings.stories.tsx
@@ -0,0 +1,66 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertFromCbrSettings from "@app/components/tools/convert/ConvertFromCbrSettings";
+import {
+  ConvertParameters,
+  defaultParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta = {
+  title: "Tools/Convert/ConvertFromCbrSettings",
+  component: ConvertFromCbrSettings,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof ConvertFromCbrSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+// The component owns no state itself, so each story wraps it in a small
+// stateful shim to keep the checkbox interactive in the canvas.
+const ConvertFromCbrSettingsDemo = (props: {
+  initialParameters: ConvertParameters;
+  disabled?: boolean;
+}) => {
+  const [parameters, setParameters] = useState<ConvertParameters>(
+    props.initialParameters,
+  );
+
+  return (
+    <ConvertFromCbrSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={props.disabled}
+    />
+  );
+};
+
+export const Default: Story = {
+  render: () => (
+    <ConvertFromCbrSettingsDemo initialParameters={defaultParameters} />
+  ),
+};
+
+export const OptimizeForEbookEnabled: Story = {
+  render: () => (
+    <ConvertFromCbrSettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        cbrOptions: { optimizeForEbook: true },
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <ConvertFromCbrSettingsDemo
+      initialParameters={defaultParameters}
+      disabled
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertFromCbzSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertFromCbzSettings.stories.tsx
new file mode 100644
index 0000000000..abec19fcc2
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertFromCbzSettings.stories.tsx
@@ -0,0 +1,52 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertFromCbzSettings from "@app/components/tools/convert/ConvertFromCbzSettings";
+import {
+  defaultParameters,
+  ConvertParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta = {
+  title: "Tools/ConvertFromCbzSettings",
+  component: ConvertFromCbzSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof ConvertFromCbzSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function CbzSettingsDemo({
+  disabled,
+  initialOptimize = false,
+}: {
+  disabled?: boolean;
+  initialOptimize?: boolean;
+}) {
+  const [parameters, setParameters] = useState<ConvertParameters>({
+    ...defaultParameters,
+    cbzOptions: { optimizeForEbook: initialOptimize },
+  });
+
+  return (
+    <ConvertFromCbzSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <CbzSettingsDemo /> };
+
+export const OptimizedForEbook: Story = {
+  render: () => <CbzSettingsDemo initialOptimize />,
+};
+
+export const Disabled: Story = {
+  render: () => <CbzSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertFromEbookSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertFromEbookSettings.stories.tsx
new file mode 100644
index 0000000000..e0eafa1835
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertFromEbookSettings.stories.tsx
@@ -0,0 +1,42 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertFromEbookSettings from "@app/components/tools/convert/ConvertFromEbookSettings";
+import {
+  ConvertParameters,
+  defaultParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta = {
+  title: "Tools/Convert/ConvertFromEbookSettings",
+  component: ConvertFromEbookSettings,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof ConvertFromEbookSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+function ConvertFromEbookSettingsDemo({ disabled }: { disabled?: boolean }) {
+  const [parameters, setParameters] =
+    useState<ConvertParameters>(defaultParameters);
+
+  return (
+    <ConvertFromEbookSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <ConvertFromEbookSettingsDemo />,
+};
+
+export const Disabled: Story = {
+  render: () => <ConvertFromEbookSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertFromEmailSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertFromEmailSettings.stories.tsx
new file mode 100644
index 0000000000..4e860948f9
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertFromEmailSettings.stories.tsx
@@ -0,0 +1,62 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertFromEmailSettings from "@app/components/tools/convert/ConvertFromEmailSettings";
+import {
+  ConvertParameters,
+  defaultParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta = {
+  title: "Tools/Convert/ConvertFromEmailSettings",
+  component: ConvertFromEmailSettings,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof ConvertFromEmailSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function ConvertFromEmailSettingsDemo(
+  props: Partial<React.ComponentProps<typeof ConvertFromEmailSettings>>,
+) {
+  const [parameters, setParameters] = useState<ConvertParameters>(
+    props.parameters ?? defaultParameters,
+  );
+
+  return (
+    <ConvertFromEmailSettings
+      disabled={false}
+      {...props}
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+    />
+  );
+}
+
+/** Default state: attachments included, so the max-size input is visible. */
+export const Default: Story = {
+  render: () => <ConvertFromEmailSettingsDemo />,
+};
+
+/** Attachments excluded, hiding the max-attachment-size input. */
+export const WithoutAttachments: Story = {
+  render: () => (
+    <ConvertFromEmailSettingsDemo
+      parameters={{
+        ...defaultParameters,
+        emailOptions: {
+          ...defaultParameters.emailOptions,
+          includeAttachments: false,
+        },
+      }}
+    />
+  ),
+};
+
+/** All controls disabled, e.g. while a conversion is running. */
+export const Disabled: Story = {
+  render: () => <ConvertFromEmailSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertFromImageSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertFromImageSettings.stories.tsx
new file mode 100644
index 0000000000..2392e13ec3
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertFromImageSettings.stories.tsx
@@ -0,0 +1,38 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertFromImageSettings from "@app/components/tools/convert/ConvertFromImageSettings";
+import {
+  ConvertParameters,
+  defaultParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta: Meta<typeof ConvertFromImageSettings> = {
+  title: "Tools/Convert/ConvertFromImageSettings",
+  component: ConvertFromImageSettings,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof ConvertFromImageSettings>;
+
+function ConvertFromImageSettingsDemo({ disabled }: { disabled?: boolean }) {
+  const [parameters, setParameters] =
+    useState<ConvertParameters>(defaultParameters);
+
+  return (
+    <ConvertFromImageSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <ConvertFromImageSettingsDemo />,
+};
+
+export const Disabled: Story = {
+  render: () => <ConvertFromImageSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertFromSvgSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertFromSvgSettings.stories.tsx
new file mode 100644
index 0000000000..8ca41ba2bb
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertFromSvgSettings.stories.tsx
@@ -0,0 +1,38 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertFromSvgSettings from "@app/components/tools/convert/ConvertFromSvgSettings";
+import {
+  ConvertParameters,
+  defaultParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta: Meta<typeof ConvertFromSvgSettings> = {
+  title: "Tools/Convert/ConvertFromSvgSettings",
+  component: ConvertFromSvgSettings,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof ConvertFromSvgSettings>;
+
+function ConvertFromSvgSettingsDemo({ disabled }: { disabled?: boolean }) {
+  const [parameters, setParameters] =
+    useState<ConvertParameters>(defaultParameters);
+
+  return (
+    <ConvertFromSvgSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <ConvertFromSvgSettingsDemo />,
+};
+
+export const Disabled: Story = {
+  render: () => <ConvertFromSvgSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertFromWebSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertFromWebSettings.stories.tsx
new file mode 100644
index 0000000000..ddc756f723
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertFromWebSettings.stories.tsx
@@ -0,0 +1,38 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertFromWebSettings from "@app/components/tools/convert/ConvertFromWebSettings";
+import {
+  ConvertParameters,
+  defaultParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta: Meta<typeof ConvertFromWebSettings> = {
+  title: "Tools/Convert/ConvertFromWebSettings",
+  component: ConvertFromWebSettings,
+};
+export default meta;
+type Story = StoryObj<typeof ConvertFromWebSettings>;
+
+function ConvertFromWebSettingsDemo({ disabled }: { disabled?: boolean }) {
+  const [parameters, setParameters] = useState<ConvertParameters>({
+    ...defaultParameters,
+    fromExtension: "html",
+    toExtension: "pdf",
+  });
+
+  return (
+    <ConvertFromWebSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <ConvertFromWebSettingsDemo /> };
+
+export const Disabled: Story = {
+  render: () => <ConvertFromWebSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertToCbrSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertToCbrSettings.stories.tsx
new file mode 100644
index 0000000000..3a202e95fa
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertToCbrSettings.stories.tsx
@@ -0,0 +1,52 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertToCbrSettings from "@app/components/tools/convert/ConvertToCbrSettings";
+import {
+  ConvertParameters,
+  defaultParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta = {
+  title: "Tools/Convert/ConvertToCbrSettings",
+  component: ConvertToCbrSettings,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof ConvertToCbrSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+// The component owns no state itself, so each story wraps it in a small
+// stateful shim to keep the DPI input interactive in the canvas.
+const ConvertToCbrSettingsDemo = (props: {
+  initialParameters: ConvertParameters;
+  disabled?: boolean;
+}) => {
+  const [parameters, setParameters] = useState<ConvertParameters>(
+    props.initialParameters,
+  );
+
+  return (
+    <ConvertToCbrSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={props.disabled}
+    />
+  );
+};
+
+export const Default: Story = {
+  render: () => (
+    <ConvertToCbrSettingsDemo initialParameters={defaultParameters} />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <ConvertToCbrSettingsDemo initialParameters={defaultParameters} disabled />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertToCbzSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertToCbzSettings.stories.tsx
new file mode 100644
index 0000000000..0d31069b86
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertToCbzSettings.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertToCbzSettings from "@app/components/tools/convert/ConvertToCbzSettings";
+import { defaultParameters } from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta = {
+  title: "Tools/Convert/ConvertToCbzSettings",
+  component: ConvertToCbzSettings,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ConvertToCbzSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    ...Default.args,
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertToEpubSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertToEpubSettings.stories.tsx
new file mode 100644
index 0000000000..c2087cf00f
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertToEpubSettings.stories.tsx
@@ -0,0 +1,54 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertToEpubSettings from "@app/components/tools/convert/ConvertToEpubSettings";
+import {
+  ConvertParameters,
+  defaultParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta: Meta<typeof ConvertToEpubSettings> = {
+  title: "Tools/Convert/ConvertToEpubSettings",
+  component: ConvertToEpubSettings,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof ConvertToEpubSettings>;
+
+function ConvertToEpubSettingsDemo({
+  toExtension = "epub",
+  disabled,
+}: {
+  toExtension?: string;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] = useState<ConvertParameters>({
+    ...defaultParameters,
+    fromExtension: "docx",
+    toExtension,
+  });
+
+  const handleParameterChange = <K extends keyof ConvertParameters>(
+    key: K,
+    value: ConvertParameters[K],
+  ) => {
+    setParameters((prev) => ({ ...prev, [key]: value }));
+  };
+
+  return (
+    <ConvertToEpubSettings
+      parameters={parameters}
+      onParameterChange={handleParameterChange}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <ConvertToEpubSettingsDemo /> };
+
+export const Azw3Output: Story = {
+  render: () => <ConvertToEpubSettingsDemo toExtension="azw3" />,
+};
+
+export const Disabled: Story = {
+  render: () => <ConvertToEpubSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertToImageSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertToImageSettings.stories.tsx
new file mode 100644
index 0000000000..242c0c631d
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertToImageSettings.stories.tsx
@@ -0,0 +1,38 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertToImageSettings from "@app/components/tools/convert/ConvertToImageSettings";
+import {
+  ConvertParameters,
+  defaultParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta: Meta<typeof ConvertToImageSettings> = {
+  title: "Tools/Convert/ConvertToImageSettings",
+  component: ConvertToImageSettings,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof ConvertToImageSettings>;
+
+function ConvertToImageSettingsDemo({ disabled }: { disabled?: boolean }) {
+  const [parameters, setParameters] =
+    useState<ConvertParameters>(defaultParameters);
+
+  return (
+    <ConvertToImageSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <ConvertToImageSettingsDemo />,
+};
+
+export const Disabled: Story = {
+  render: () => <ConvertToImageSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertToPdfaSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertToPdfaSettings.stories.tsx
new file mode 100644
index 0000000000..2bffbe1391
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertToPdfaSettings.stories.tsx
@@ -0,0 +1,34 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertToPdfaSettings from "@app/components/tools/convert/ConvertToPdfaSettings";
+import { defaultParameters } from "@app/hooks/tools/convert/useConvertParameters";
+
+const meta = {
+  title: "Tools/Convert/ConvertToPdfaSettings",
+  component: ConvertToPdfaSettings,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    selectedFiles: [],
+    disabled: false,
+  },
+} satisfies Meta<typeof ConvertToPdfaSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const StrictMode: Story = {
+  args: {
+    parameters: {
+      ...defaultParameters,
+      pdfaOptions: { outputFormat: "pdfa-1", strict: true },
+    },
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/convert/ConvertToPdfxSettings.stories.tsx b/frontend/editor/src/core/components/tools/convert/ConvertToPdfxSettings.stories.tsx
new file mode 100644
index 0000000000..30d59e42fb
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/ConvertToPdfxSettings.stories.tsx
@@ -0,0 +1,57 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ConvertToPdfxSettings from "@app/components/tools/convert/ConvertToPdfxSettings";
+import {
+  ConvertParameters,
+  defaultParameters,
+} from "@app/hooks/tools/convert/useConvertParameters";
+import { StirlingFile } from "@app/types/fileContext";
+
+const meta = {
+  title: "Tools/Convert/ConvertToPdfxSettings",
+  component: ConvertToPdfxSettings,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    selectedFiles: [],
+  },
+} satisfies Meta<typeof ConvertToPdfxSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+// The component renders no UI — it only reconciles the "outputFormat" field
+// on mount — so the shim just proves it mounts and updates parameters without
+// throwing.
+const ConvertToPdfxSettingsDemo = (props: {
+  initialParameters: ConvertParameters;
+  selectedFiles?: StirlingFile[];
+  disabled?: boolean;
+}) => {
+  const [parameters, setParameters] = useState<ConvertParameters>(
+    props.initialParameters,
+  );
+
+  return (
+    <ConvertToPdfxSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      selectedFiles={props.selectedFiles ?? []}
+      disabled={props.disabled}
+    />
+  );
+};
+
+export const Default: Story = {
+  render: () => (
+    <ConvertToPdfxSettingsDemo initialParameters={defaultParameters} />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <ConvertToPdfxSettingsDemo initialParameters={defaultParameters} disabled />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.stories.tsx b/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.stories.tsx
new file mode 100644
index 0000000000..4d1c029da0
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/convert/GroupedFormatDropdown.stories.tsx
@@ -0,0 +1,55 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import GroupedFormatDropdown from "@app/components/tools/convert/GroupedFormatDropdown";
+
+const documentOptions = [
+  { value: "pdf", label: "PDF", group: "Document" },
+  { value: "docx", label: "Word", group: "Document" },
+  { value: "odt", label: "OpenDocument", group: "Document" },
+  { value: "png", label: "PNG", group: "Image" },
+  { value: "jpg", label: "JPEG", group: "Image" },
+  { value: "epub", label: "EPUB", group: "Ebook", usesCloud: true },
+  { value: "mobi", label: "MOBI", group: "Ebook", usesCloud: true },
+  { value: "cbr", label: "CBR", group: "Comic", enabled: false },
+];
+
+const meta = {
+  title: "Tools/Convert/GroupedFormatDropdown",
+  component: GroupedFormatDropdown,
+  args: {
+    options: documentOptions,
+    onChange: () => {},
+  },
+} satisfies Meta<typeof GroupedFormatDropdown>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+// The component owns no state itself, so each story wraps it in a small
+// stateful shim to keep the selected format interactive in the canvas.
+const GroupedFormatDropdownDemo = (
+  props: Partial<React.ComponentProps<typeof GroupedFormatDropdown>>,
+) => {
+  const [value, setValue] = useState(props.value);
+
+  return (
+    <GroupedFormatDropdown
+      options={documentOptions}
+      {...props}
+      value={value}
+      onChange={setValue}
+    />
+  );
+};
+
+export const Default: Story = {
+  render: () => <GroupedFormatDropdownDemo />,
+};
+
+export const Selected: Story = {
+  render: () => <GroupedFormatDropdownDemo value="epub" />,
+};
+
+export const Disabled: Story = {
+  render: () => <GroupedFormatDropdownDemo value="pdf" disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/crop/CropAreaSelector.stories.tsx b/frontend/editor/src/core/components/tools/crop/CropAreaSelector.stories.tsx
new file mode 100644
index 0000000000..fbe30e65f5
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/crop/CropAreaSelector.stories.tsx
@@ -0,0 +1,83 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Box, MantineProvider } from "@mantine/core";
+import CropAreaSelector from "@app/components/tools/crop/CropAreaSelector";
+import { Rectangle, PDFBounds } from "@app/utils/cropCoordinates";
+import { mantineTheme } from "@app/theme/mantineTheme";
+
+// CropAreaSelector reads theme.other.crop (overlay/handle colors), which only
+// the core app's Mantine theme defines. Nesting it here supplies that value
+// without disturbing whatever theme wraps the story globally, since Mantine
+// merges nested providers with their parent.
+const pdfBounds: PDFBounds = {
+  actualWidth: 595.28,
+  actualHeight: 841.89,
+  thumbnailWidth: 300,
+  thumbnailHeight: 424,
+  offsetX: 0,
+  offsetY: 0,
+  scale: 300 / 595.28,
+};
+
+const meta = {
+  title: "Tools/Crop/CropAreaSelector",
+  component: CropAreaSelector,
+  parameters: { layout: "padded" },
+  // Every story below supplies its own `render`, which ignores these args, but
+  // Storybook's types still require `args` to satisfy CropAreaSelector's
+  // required props.
+  args: {
+    pdfBounds,
+    cropArea: { x: 50, y: 50, width: 300, height: 400 },
+    onCropAreaChange: () => {},
+    children: null,
+  },
+  decorators: [
+    (Story) => (
+      <MantineProvider theme={mantineTheme}>
+        <Story />
+      </MantineProvider>
+    ),
+  ],
+} satisfies Meta<typeof CropAreaSelector>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function Demo({
+  initialCropArea = { x: 50, y: 50, width: 300, height: 400 },
+  disabled,
+}: {
+  initialCropArea?: Rectangle;
+  disabled?: boolean;
+}) {
+  const [cropArea, setCropArea] = useState<Rectangle>(initialCropArea);
+
+  return (
+    <Box
+      style={{
+        position: "relative",
+        width: pdfBounds.thumbnailWidth,
+        height: pdfBounds.thumbnailHeight,
+      }}
+    >
+      <CropAreaSelector
+        pdfBounds={pdfBounds}
+        cropArea={cropArea}
+        onCropAreaChange={setCropArea}
+        disabled={disabled}
+      >
+        <Box
+          style={{
+            width: "100%",
+            height: "100%",
+            backgroundColor: "var(--mantine-color-gray-2)",
+          }}
+        />
+      </CropAreaSelector>
+    </Box>
+  );
+}
+
+export const Default: Story = { render: () => <Demo /> };
+
+export const Disabled: Story = { render: () => <Demo disabled /> };
diff --git a/frontend/editor/src/core/components/tools/crop/CropAutomationSettings.stories.tsx b/frontend/editor/src/core/components/tools/crop/CropAutomationSettings.stories.tsx
new file mode 100644
index 0000000000..dfb1aede62
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/crop/CropAutomationSettings.stories.tsx
@@ -0,0 +1,59 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CropAutomationSettings from "@app/components/tools/crop/CropAutomationSettings";
+import {
+  CropParameters,
+  defaultParameters,
+} from "@app/hooks/tools/crop/useCropParameters";
+
+const meta = {
+  title: "Tools/Crop/CropAutomationSettings",
+  component: CropAutomationSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof CropAutomationSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function SettingsDemo({
+  initialParameters = defaultParameters,
+  disabled,
+}: {
+  initialParameters?: CropParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<CropParameters>(initialParameters);
+
+  return (
+    <CropAutomationSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <SettingsDemo />,
+};
+
+export const CustomArea: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        cropArea: { x: 50, y: 50, width: 400, height: 600 },
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => <SettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/crop/CropCoordinateInputs.stories.tsx b/frontend/editor/src/core/components/tools/crop/CropCoordinateInputs.stories.tsx
new file mode 100644
index 0000000000..fbf034b7e7
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/crop/CropCoordinateInputs.stories.tsx
@@ -0,0 +1,63 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import CropCoordinateInputs from "@app/components/tools/crop/CropCoordinateInputs";
+import { Rectangle, PDFBounds } from "@app/utils/cropCoordinates";
+
+const meta = {
+  title: "Tools/Crop/CropCoordinateInputs",
+  component: CropCoordinateInputs,
+  parameters: { layout: "padded" },
+  args: {
+    cropArea: { x: 50, y: 50, width: 300, height: 400 },
+    onCoordinateChange: () => {},
+  },
+} satisfies Meta<typeof CropCoordinateInputs>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const pdfBounds: PDFBounds = {
+  actualWidth: 595.28,
+  actualHeight: 841.89,
+  thumbnailWidth: 300,
+  thumbnailHeight: 424,
+  offsetX: 0,
+  offsetY: 0,
+  scale: 300 / 595.28,
+};
+
+function Demo({
+  initialCropArea = { x: 50, y: 50, width: 300, height: 400 },
+  disabled,
+  showAutomationInfo,
+  withBounds = true,
+}: {
+  initialCropArea?: Rectangle;
+  disabled?: boolean;
+  showAutomationInfo?: boolean;
+  withBounds?: boolean;
+}) {
+  const [cropArea, setCropArea] = useState<Rectangle>(initialCropArea);
+
+  return (
+    <CropCoordinateInputs
+      cropArea={cropArea}
+      onCoordinateChange={(field, value) =>
+        setCropArea((prev) => ({
+          ...prev,
+          [field]: typeof value === "number" ? value : Number(value) || 0,
+        }))
+      }
+      disabled={disabled}
+      pdfBounds={withBounds ? pdfBounds : undefined}
+      showAutomationInfo={showAutomationInfo}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <Demo /> };
+
+export const AutomationInfo: Story = {
+  render: () => <Demo showAutomationInfo />,
+};
+
+export const Disabled: Story = { render: () => <Demo disabled /> };
diff --git a/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.stories.tsx b/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.stories.tsx
new file mode 100644
index 0000000000..945bd29745
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/editTableOfContents/BookmarkEditor.stories.tsx
@@ -0,0 +1,45 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import BookmarkEditor from "@app/components/tools/editTableOfContents/BookmarkEditor";
+import { createBookmarkNode } from "@app/utils/editTableOfContents";
+
+const meta = {
+  title: "Tools/EditTableOfContents/BookmarkEditor",
+  component: BookmarkEditor,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof BookmarkEditor>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    bookmarks: [
+      createBookmarkNode({
+        title: "Chapter 1: Introduction",
+        pageNumber: 1,
+        children: [
+          createBookmarkNode({
+            title: "Section 1.1: Background",
+            pageNumber: 2,
+          }),
+          createBookmarkNode({ title: "Section 1.2: Scope", pageNumber: 4 }),
+        ],
+      }),
+      createBookmarkNode({ title: "Chapter 2: Methodology", pageNumber: 8 }),
+    ],
+    onChange: () => {},
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    bookmarks: [],
+    onChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    ...Default.args,
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.stories.tsx b/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.stories.tsx
new file mode 100644
index 0000000000..a9daf70b4e
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.stories.tsx
@@ -0,0 +1,69 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import EditTableOfContentsSettings from "@app/components/tools/editTableOfContents/EditTableOfContentsSettings";
+import { BookmarkNode } from "@app/utils/editTableOfContents";
+
+const sampleBookmarks: BookmarkNode[] = [
+  {
+    id: "1",
+    title: "Chapter 1",
+    pageNumber: 1,
+    expanded: true,
+    children: [
+      {
+        id: "1.1",
+        title: "Section 1.1",
+        pageNumber: 2,
+        expanded: false,
+        children: [],
+      },
+    ],
+  },
+  {
+    id: "2",
+    title: "Chapter 2",
+    pageNumber: 5,
+    expanded: true,
+    children: [],
+  },
+];
+
+const meta = {
+  title: "Tools/EditTableOfContents/EditTableOfContentsSettings",
+  component: EditTableOfContentsSettings,
+  args: {
+    bookmarks: sampleBookmarks,
+    replaceExisting: true,
+    onReplaceExistingChange: () => {},
+    onSelectFiles: () => {},
+    onLoadFromPdf: () => {},
+    onImportJson: () => {},
+    onImportClipboard: () => {},
+    onExportJson: () => {},
+    onExportClipboard: () => {},
+    isLoading: false,
+    loadError: null,
+    canReadClipboard: true,
+    canWriteClipboard: true,
+    disabled: false,
+    selectedFileName: "document.pdf",
+  },
+} satisfies Meta<typeof EditTableOfContentsSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const NoFileSelected: Story = {
+  args: {
+    selectedFileName: undefined,
+    bookmarks: [],
+  },
+};
+
+export const LoadingWithError: Story = {
+  args: {
+    isLoading: true,
+    loadError: "Failed to read bookmarks from the selected PDF.",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.stories.tsx b/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.stories.tsx
new file mode 100644
index 0000000000..265d7c0786
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.stories.tsx
@@ -0,0 +1,86 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import EditTableOfContentsWorkbenchView, {
+  type EditTableOfContentsWorkbenchViewData,
+} from "@app/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView";
+import { createBookmarkNode } from "@app/utils/editTableOfContents";
+
+const meta = {
+  title: "Tools/EditTableOfContents/EditTableOfContentsWorkbenchView",
+  component: EditTableOfContentsWorkbenchView,
+} satisfies Meta<typeof EditTableOfContentsWorkbenchView>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const sampleFile = new File(["%PDF-1.4"], "annual-report.pdf", {
+  type: "application/pdf",
+});
+
+const sampleBookmarks = [
+  createBookmarkNode({
+    title: "Introduction",
+    pageNumber: 1,
+  }),
+  createBookmarkNode({
+    title: "Chapter 1: Overview",
+    pageNumber: 3,
+    children: [
+      createBookmarkNode({ title: "Background", pageNumber: 4 }),
+      createBookmarkNode({ title: "Scope", pageNumber: 6 }),
+    ],
+  }),
+  createBookmarkNode({
+    title: "Conclusion",
+    pageNumber: 20,
+  }),
+];
+
+const baseData: EditTableOfContentsWorkbenchViewData = {
+  bookmarks: sampleBookmarks,
+  selectedFileName: sampleFile.name,
+  disabled: false,
+  files: [sampleFile],
+  thumbnails: [undefined],
+  downloadUrl: null,
+  downloadFilename: null,
+  errorMessage: null,
+  isGeneratingThumbnails: false,
+  isExecuteDisabled: false,
+  isExecuting: false,
+  onClearError: () => {},
+  onBookmarksChange: () => {},
+  onExecute: () => {},
+  onUndo: () => {},
+  onFileClick: () => {},
+};
+
+export const Default: Story = {
+  args: {
+    data: baseData,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    data: null,
+  },
+};
+
+export const WithResults: Story = {
+  args: {
+    data: {
+      ...baseData,
+      downloadUrl: "blob:https://example.com/annual-report-toc.pdf",
+      downloadFilename: "annual-report-toc.pdf",
+    },
+  },
+};
+
+export const WithError: Story = {
+  args: {
+    data: {
+      ...baseData,
+      errorMessage: "Failed to apply the table of contents.",
+    },
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/extractImages/ExtractImagesSettings.stories.tsx b/frontend/editor/src/core/components/tools/extractImages/ExtractImagesSettings.stories.tsx
new file mode 100644
index 0000000000..e0f7c0a014
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/extractImages/ExtractImagesSettings.stories.tsx
@@ -0,0 +1,60 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ExtractImagesSettings from "@app/components/tools/extractImages/ExtractImagesSettings";
+import {
+  ExtractImagesParameters,
+  defaultParameters,
+} from "@app/hooks/tools/extractImages/useExtractImagesParameters";
+
+const meta = {
+  title: "Tools/ExtractImages/ExtractImagesSettings",
+  component: ExtractImagesSettings,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof ExtractImagesSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+// The component owns no state itself, so each story wraps it in a small
+// stateful shim to keep the dropdown interactive in the canvas.
+const ExtractImagesSettingsDemo = (props: {
+  initialParameters: ExtractImagesParameters;
+  disabled?: boolean;
+}) => {
+  const [parameters, setParameters] = useState<ExtractImagesParameters>(
+    props.initialParameters,
+  );
+
+  return (
+    <ExtractImagesSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={props.disabled}
+    />
+  );
+};
+
+export const Default: Story = {
+  render: () => (
+    <ExtractImagesSettingsDemo initialParameters={defaultParameters} />
+  ),
+};
+
+export const JpgFormat: Story = {
+  render: () => (
+    <ExtractImagesSettingsDemo
+      initialParameters={{ ...defaultParameters, format: "jpg" }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <ExtractImagesSettingsDemo initialParameters={defaultParameters} disabled />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/extractPages/ExtractPagesSettings.stories.tsx b/frontend/editor/src/core/components/tools/extractPages/ExtractPagesSettings.stories.tsx
new file mode 100644
index 0000000000..0ebf63c149
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/extractPages/ExtractPagesSettings.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ExtractPagesSettings from "@app/components/tools/extractPages/ExtractPagesSettings";
+import { ExtractPagesParameters } from "@app/hooks/tools/extractPages/useExtractPagesParameters";
+
+const meta = {
+  title: "Tools/ExtractPages/ExtractPagesSettings",
+  component: ExtractPagesSettings,
+} satisfies Meta<typeof ExtractPagesSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const buildParameters = (
+  overrides: Partial<ExtractPagesParameters> = {},
+): ExtractPagesParameters => ({
+  pageNumbers: "",
+  ...overrides,
+});
+
+export const Default: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+  },
+};
+
+export const Filled: Story = {
+  args: {
+    parameters: buildParameters({ pageNumbers: "1,3,5-8" }),
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: buildParameters({ pageNumbers: "1-10" }),
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/flatten/FlattenSettings.stories.tsx b/frontend/editor/src/core/components/tools/flatten/FlattenSettings.stories.tsx
new file mode 100644
index 0000000000..9f5e84b3b4
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/flatten/FlattenSettings.stories.tsx
@@ -0,0 +1,48 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FlattenSettings from "@app/components/tools/flatten/FlattenSettings";
+import { FlattenParameters } from "@app/hooks/tools/flatten/useFlattenParameters";
+
+const buildParameters = (
+  overrides: Partial<FlattenParameters> = {},
+): FlattenParameters => ({
+  flattenOnlyForms: false,
+  renderDpi: undefined,
+  ...overrides,
+});
+
+const meta = {
+  title: "Tools/Flatten/FlattenSettings",
+  component: FlattenSettings,
+} satisfies Meta<typeof FlattenSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+  },
+};
+
+export const FlattenOnlyForms: Story = {
+  args: {
+    parameters: buildParameters({ flattenOnlyForms: true }),
+    onParameterChange: () => {},
+  },
+};
+
+export const CustomRenderDpi: Story = {
+  args: {
+    parameters: buildParameters({ renderDpi: 300 }),
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/fullscreen/DetailedToolItem.stories.tsx b/frontend/editor/src/core/components/tools/fullscreen/DetailedToolItem.stories.tsx
new file mode 100644
index 0000000000..cd443e248a
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/fullscreen/DetailedToolItem.stories.tsx
@@ -0,0 +1,103 @@
+import type React from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import DetailedToolItem from "@app/components/tools/fullscreen/DetailedToolItem";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { NavigationProvider } from "@app/contexts/NavigationContext";
+import {
+  ToolWorkflowProvider,
+  useToolWorkflow,
+} from "@app/contexts/ToolWorkflowContext";
+import { HotkeyProvider } from "@app/contexts/HotkeyContext";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import type { ToolId } from "@app/types/toolId";
+import {
+  ToolCategoryId,
+  SubcategoryId,
+  type ToolRegistryEntry,
+} from "@app/data/toolsTaxonomy";
+
+// DetailedToolItem reads hotkeys/favourites/availability via useToolMeta, which
+// pulls from HotkeyContext, ToolWorkflowContext and AppConfigContext, so every
+// provider here must be present or those reads fail. AppConfigProvider uses
+// autoFetch={false} to skip the network fetch and render synchronously instead
+// of showing a loading state.
+function withProviders(Story: () => React.JSX.Element) {
+  return (
+    <PreferencesProvider>
+      <AppConfigProvider autoFetch={false}>
+        <ToolRegistryProvider>
+          <NavigationProvider>
+            <ToolWorkflowProvider>
+              <HotkeyProvider>
+                <Story />
+              </HotkeyProvider>
+            </ToolWorkflowProvider>
+          </NavigationProvider>
+        </ToolRegistryProvider>
+      </AppConfigProvider>
+    </PreferencesProvider>
+  );
+}
+
+// Pulls a real entry out of the same registry the component reads internally
+// (via useToolMeta), so the icon/description/availability match a real render.
+function ToolItemDemo({
+  toolId,
+  isSelected = false,
+}: {
+  toolId: ToolId;
+  isSelected?: boolean;
+}) {
+  const { toolRegistry } = useToolWorkflow();
+  const tool = toolRegistry[toolId];
+  if (!tool) return null;
+
+  return (
+    <DetailedToolItem
+      id={toolId}
+      tool={tool}
+      isSelected={isSelected}
+      onClick={() => {}}
+    />
+  );
+}
+
+// Meta-level args are inherited by every story below. The stories themselves
+// use `render` to swap in ToolItemDemo (which pulls a real registry entry),
+// so these values never actually reach DetailedToolItem — they only exist to
+// satisfy the required-props type on StoryAnnotations.
+const mockTool: ToolRegistryEntry = {
+  icon: null,
+  name: "Split",
+  component: null,
+  description: "Split a PDF into multiple files",
+  categoryId: ToolCategoryId.STANDARD_TOOLS,
+  subcategoryId: SubcategoryId.GENERAL,
+  automationSettings: null,
+};
+
+const meta = {
+  title: "Tools/Fullscreen/DetailedToolItem",
+  component: DetailedToolItem,
+  decorators: [withProviders],
+  args: {
+    id: "split",
+    tool: mockTool,
+    isSelected: false,
+    onClick: () => {},
+  },
+} satisfies Meta<typeof DetailedToolItem>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** An available tool rendered in its default, unselected state. */
+export const Default: Story = {
+  render: () => <ToolItemDemo toolId={"split" as ToolId} />,
+};
+
+/** The active tool in the panel — highlighted selected state. */
+export const Selected: Story = {
+  render: () => <ToolItemDemo toolId={"split" as ToolId} isSelected />,
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoReportView.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoReportView.stories.tsx
new file mode 100644
index 0000000000..08352aaab6
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoReportView.stories.tsx
@@ -0,0 +1,112 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import GetPdfInfoReportView from "@app/components/tools/getPdfInfo/GetPdfInfoReportView";
+import type { PdfInfoReportData } from "@app/types/getPdfInfo";
+
+const filledData: PdfInfoReportData = {
+  generatedAt: Date.now(),
+  entries: [
+    {
+      fileId: "file-1",
+      fileName: "annual-report.pdf",
+      fileSize: 245_760,
+      lastModified: Date.now(),
+      thumbnailUrl: null,
+      error: null,
+      data: {
+        Metadata: {
+          Title: "Annual Report 2025",
+          Author: "Stirling PDF",
+          Subject: "Financials",
+          Keywords: "annual, report, finance",
+          Creator: "Stirling PDF",
+          Producer: "Stirling PDF",
+          CreationDate: "2025-01-15T10:00:00Z",
+          ModificationDate: "2025-02-01T08:30:00Z",
+        },
+        BasicInfo: {
+          FileSizeInBytes: 245_760,
+          WordCount: 12_400,
+          ParagraphCount: 320,
+          CharacterCount: 78_000,
+          Compression: true,
+          CompressionType: "Flate",
+          Language: "en-US",
+          "Number of pages": 24,
+          TotalImages: 6,
+        },
+        DocumentInfo: {
+          "PDF version": "1.7",
+          Trapped: "False",
+          "Page Mode": "UseOutlines",
+        },
+        Encryption: {
+          IsEncrypted: false,
+        },
+        Permissions: {
+          Printing: "Allowed",
+          Modifying: "Not Allowed",
+          "Extracting Content": "Allowed",
+        },
+        Compliancy: {
+          "IsPDF/ACompliant": true,
+          "PDF/AConformanceLevel": "2B",
+        },
+        "Bookmarks/Outline/TOC": [
+          { Title: "Introduction" },
+          { Title: "Financial Summary" },
+          { Title: "Appendix" },
+        ],
+        Other: {
+          Attachments: [],
+          EmbeddedFiles: [],
+          JavaScript: [],
+        },
+        PerPageInfo: {
+          "Page 1": {
+            Rotation: 0,
+            "Page Orientation": "Portrait",
+          },
+        },
+        SummaryData: {
+          encrypted: false,
+          restrictedPermissions: ["Modifying"],
+          restrictedPermissionsCount: 1,
+          Compliance: [
+            {
+              Standard: "PDF/A",
+              Compliant: true,
+              Summary: "Fully compliant with PDF/A-2B.",
+            },
+          ],
+        },
+      },
+      summaryGeneratedAt: Date.now(),
+    },
+  ],
+};
+
+const emptyData: PdfInfoReportData = {
+  generatedAt: Date.now(),
+  entries: [],
+};
+
+const meta = {
+  title: "Tools/GetPdfInfo/GetPdfInfoReportView",
+  component: GetPdfInfoReportView,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof GetPdfInfoReportView>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    data: filledData,
+  },
+};
+
+export const NoData: Story = {
+  args: {
+    data: emptyData,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.stories.tsx
new file mode 100644
index 0000000000..92d8f82377
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.stories.tsx
@@ -0,0 +1,103 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import GetPdfInfoResults from "@app/components/tools/getPdfInfo/GetPdfInfoResults";
+import type { GetPdfInfoOperationHook } from "@app/hooks/tools/getPdfInfo/useGetPdfInfoOperation";
+import type { PdfInfoReportEntry } from "@app/types/getPdfInfo";
+
+const mockEntry: PdfInfoReportEntry = {
+  fileId: "file-1",
+  fileName: "sample.pdf",
+  fileSize: 245_760,
+  lastModified: Date.now(),
+  thumbnailUrl: null,
+  data: {},
+  error: null,
+  summaryGeneratedAt: Date.now(),
+};
+
+const baseOperation: GetPdfInfoOperationHook = {
+  files: [],
+  thumbnails: [],
+  isGeneratingThumbnails: false,
+  downloadUrl: null,
+  downloadFilename: "",
+  isLoading: false,
+  status: "",
+  errorMessage: null,
+  progress: null,
+  executeOperation: async () => {},
+  resetResults: () => {},
+  clearError: () => {},
+  cancelOperation: () => {},
+  undoOperation: async () => {},
+  results: [],
+};
+
+const meta = {
+  title: "Tools/GetPdfInfo/GetPdfInfoResults",
+  component: GetPdfInfoResults,
+} satisfies Meta<typeof GetPdfInfoResults>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    operation: {
+      ...baseOperation,
+      results: [mockEntry],
+      files: [
+        new File([JSON.stringify(mockEntry.data)], "response.json", {
+          type: "application/json",
+        }),
+      ],
+    },
+    isLoading: false,
+    errorMessage: null,
+  },
+};
+
+export const Loading: Story = {
+  args: {
+    operation: {
+      ...baseOperation,
+      results: [],
+    },
+    isLoading: true,
+    errorMessage: null,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    operation: {
+      ...baseOperation,
+      results: [],
+    },
+    isLoading: false,
+    errorMessage: null,
+  },
+};
+
+export const PartialError: Story = {
+  args: {
+    operation: {
+      ...baseOperation,
+      results: [
+        mockEntry,
+        {
+          ...mockEntry,
+          fileId: "file-2",
+          fileName: "broken.pdf",
+          error: "Could not read file",
+        },
+      ],
+      files: [
+        new File([JSON.stringify(mockEntry.data)], "response.json", {
+          type: "application/json",
+        }),
+      ],
+    },
+    isLoading: false,
+    errorMessage: "Some files could not be processed.",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/sections/ComplianceSection.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/sections/ComplianceSection.stories.tsx
new file mode 100644
index 0000000000..b2cb29b81d
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/sections/ComplianceSection.stories.tsx
@@ -0,0 +1,59 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ComplianceSection from "@app/components/tools/getPdfInfo/sections/ComplianceSection";
+
+const meta = {
+  title: "Tools/GetPdfInfo/ComplianceSection",
+  component: ComplianceSection,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ComplianceSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    anchorId: "compliance",
+    complianceSummary: [
+      {
+        Standard: "pdfa-2b",
+        Compliant: true,
+        Summary: "Document conforms to PDF/A-2B requirements",
+      },
+      {
+        Standard: "pdfua-1",
+        Compliant: false,
+        Summary:
+          "Document is missing required tagging structure for accessibility",
+      },
+    ],
+    legacyCompliance: {
+      "IsPDF/SECCompliant": true,
+    },
+  },
+};
+
+export const AllPassed: Story = {
+  args: {
+    anchorId: "compliance-passed",
+    complianceSummary: [
+      {
+        Standard: "pdfa-3b",
+        Compliant: true,
+        Summary: "Document conforms to PDF/A-3B requirements",
+      },
+      {
+        Standard: "pdfua-1",
+        Compliant: true,
+        Summary: "Document meets PDF/UA-1 accessibility requirements",
+      },
+    ],
+    legacyCompliance: null,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    anchorId: "compliance-empty",
+    complianceSummary: [],
+    legacyCompliance: null,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/sections/KeyValueSection.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/sections/KeyValueSection.stories.tsx
new file mode 100644
index 0000000000..75b2dd679d
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/sections/KeyValueSection.stories.tsx
@@ -0,0 +1,32 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import KeyValueSection from "@app/components/tools/getPdfInfo/sections/KeyValueSection";
+
+const meta = {
+  title: "Tools/GetPdfInfo/KeyValueSection",
+  component: KeyValueSection,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof KeyValueSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    title: "Document Info",
+    anchorId: "document-info",
+    obj: {
+      Title: "Sample Document",
+      Author: "Jane Doe",
+      Producer: "Stirling-PDF",
+      CreationDate: "2026-01-15",
+    },
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    title: "Custom Metadata",
+    anchorId: "custom-metadata",
+    obj: {},
+    emptyLabel: "No custom metadata found",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/sections/OtherSection.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/sections/OtherSection.stories.tsx
new file mode 100644
index 0000000000..f087e0e8f7
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/sections/OtherSection.stories.tsx
@@ -0,0 +1,43 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import OtherSection from "@app/components/tools/getPdfInfo/sections/OtherSection";
+import type { PdfOtherInfo } from "@app/types/getPdfInfo";
+
+const populatedOther: PdfOtherInfo = {
+  Attachments: [
+    { Name: "invoice.xlsx", Description: "Original invoice", FileSize: 24576 },
+  ],
+  EmbeddedFiles: [
+    {
+      Name: "font-data.bin",
+      FileSize: 10240,
+      MimeType: "application/octet-stream",
+      CreationDate: "2026-01-01",
+      ModificationDate: "2026-02-01",
+    },
+  ],
+  JavaScript: [{ "JS Name": "AutoPrint", "JS Script Length": 42 }],
+  Layers: [{ Name: "Watermark" }],
+  StructureTree: [{ Type: "Document" }],
+  XMPMetadata: "<x:xmpmeta>...</x:xmpmeta>",
+};
+
+const meta = {
+  title: "Tools/GetPdfInfo/Sections/OtherSection",
+  component: OtherSection,
+  parameters: { layout: "padded" },
+  args: {
+    anchorId: "other",
+    other: populatedOther,
+  },
+} satisfies Meta<typeof OtherSection>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Empty: Story = {
+  args: {
+    other: {},
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/sections/PerPageSection.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/sections/PerPageSection.stories.tsx
new file mode 100644
index 0000000000..3cf0bbc9d7
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/sections/PerPageSection.stories.tsx
@@ -0,0 +1,72 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PerPageSection from "@app/components/tools/getPdfInfo/sections/PerPageSection";
+import type { PdfPerPageInfo } from "@app/types/getPdfInfo";
+
+const perPage: PdfPerPageInfo = {
+  "Page 1": {
+    Size: {
+      "Width (px)": "612",
+      "Height (px)": "792",
+      "Width (in)": "8.5",
+      "Height (in)": "11",
+      "Standard Page": "Letter",
+    },
+    Rotation: 0,
+    "Page Orientation": "Portrait",
+    MediaBox: "[0.0, 0.0, 612.0, 792.0]",
+    CropBox: "[0.0, 0.0, 612.0, 792.0]",
+    "Text Characters Count": 1284,
+    Annotations: {
+      AnnotationsCount: 2,
+      SubtypeCount: 1,
+      ContentsCount: 1,
+    },
+    Images: [{ Name: "Im0", Width: 400, Height: 300, ColorSpace: "DeviceRGB" }],
+    Links: [{ URI: "https://stirlingpdf.com" }],
+    Fonts: [
+      { Name: "Helvetica", IsEmbedded: true, Subtype: "Type1" },
+      { Name: "Times-Roman", IsEmbedded: false, Subtype: "Type1" },
+    ],
+    XObjectCounts: { Image: 1, Form: 0, Other: 0 },
+    Multimedia: [],
+  },
+  "Page 2": {
+    Size: {
+      "Width (px)": "612",
+      "Height (px)": "792",
+      "Standard Page": "Letter",
+    },
+    Rotation: 90,
+    "Page Orientation": "Landscape",
+    MediaBox: "[0.0, 0.0, 612.0, 792.0]",
+    "Text Characters Count": 0,
+    Images: [],
+    Links: [],
+    Fonts: [],
+    Multimedia: [],
+  },
+};
+
+const meta = {
+  title: "GetPdfInfo/PerPageSection",
+  component: PerPageSection,
+  parameters: { layout: "padded" },
+  args: {
+    anchorId: "per-page-info",
+  },
+} satisfies Meta<typeof PerPageSection>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    perPage,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    perPage: null,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/sections/SummarySection.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/sections/SummarySection.stories.tsx
new file mode 100644
index 0000000000..464ef92491
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/sections/SummarySection.stories.tsx
@@ -0,0 +1,92 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SummarySection from "@app/components/tools/getPdfInfo/sections/SummarySection";
+import type { ParsedPdfSections } from "@app/types/getPdfInfo";
+
+const fullSections: ParsedPdfSections = {
+  basicInfo: {
+    "Number of pages": 12,
+    FileSizeInBytes: 245_760,
+    TotalImages: 4,
+    Language: "en-US",
+  },
+  documentInfo: {
+    "PDF version": "1.7",
+  },
+  metadata: {
+    Title: "Annual Report 2026",
+    Author: "Jane Doe",
+    CreationDate: "2026-01-10",
+    ModificationDate: "2026-02-01",
+  },
+  encryption: {
+    IsEncrypted: false,
+  },
+  permissions: {
+    Printing: "Allowed",
+    Modifying: "Allowed",
+    "Extracting Content": "Allowed",
+    "Document Assembly": "Allowed",
+  },
+  summaryData: {
+    restrictedPermissionsCount: 0,
+    Compliance: [
+      { Standard: "pdfa-2b", Compliant: true, Summary: "Passed" },
+      { Standard: "pdfua-1", Compliant: false, Summary: "Failed" },
+    ],
+  },
+  other: {
+    EmbeddedFiles: [],
+    JavaScript: [],
+    Layers: [],
+  },
+  perPage: {
+    "Page 1": {
+      Fonts: [
+        { Name: "Helvetica", IsEmbedded: true },
+        { Name: "Arial", IsEmbedded: false },
+      ],
+      Multimedia: [],
+    },
+  },
+  formFields: {},
+  toc: [],
+};
+
+const emptySections: ParsedPdfSections = {
+  basicInfo: {},
+  documentInfo: {},
+  metadata: {},
+  encryption: {},
+  permissions: {},
+  summaryData: {},
+  other: {},
+  perPage: {},
+  formFields: {},
+  toc: [],
+};
+
+const meta = {
+  title: "Tools/GetPdfInfo/SummarySection",
+  component: SummarySection,
+} satisfies Meta<typeof SummarySection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    sections: fullSections,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    sections: emptySections,
+  },
+};
+
+export const HiddenTitle: Story = {
+  args: {
+    sections: fullSections,
+    hideSectionTitle: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/sections/TableOfContentsSection.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/sections/TableOfContentsSection.stories.tsx
new file mode 100644
index 0000000000..9645e7d1ec
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/sections/TableOfContentsSection.stories.tsx
@@ -0,0 +1,31 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import TableOfContentsSection from "@app/components/tools/getPdfInfo/sections/TableOfContentsSection";
+import type { PdfTocEntry } from "@app/types/getPdfInfo";
+
+const tocArray: PdfTocEntry[] = [
+  { Title: "Chapter 1: Introduction" },
+  { Title: "Chapter 2: Getting Started" },
+  { Title: "Chapter 3: Advanced Topics" },
+];
+
+const meta = {
+  title: "Tools/GetPdfInfo/TableOfContentsSection",
+  component: TableOfContentsSection,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof TableOfContentsSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    anchorId: "table-of-contents",
+    tocArray,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    anchorId: "table-of-contents-empty",
+    tocArray: [],
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/shared/KeyValueList.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/shared/KeyValueList.stories.tsx
new file mode 100644
index 0000000000..6c3bed6e0f
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/shared/KeyValueList.stories.tsx
@@ -0,0 +1,28 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import KeyValueList from "@app/components/tools/getPdfInfo/shared/KeyValueList";
+
+const meta = {
+  title: "Tools/GetPdfInfo/KeyValueList",
+  component: KeyValueList,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof KeyValueList>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    obj: {
+      Title: "Sample Document",
+      Author: "Jane Doe",
+      Producer: "Stirling-PDF",
+      CreationDate: "2026-01-15",
+    },
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    obj: {},
+    emptyLabel: "No custom metadata found",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/shared/ScrollableCodeBlock.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/shared/ScrollableCodeBlock.stories.tsx
new file mode 100644
index 0000000000..30ff2ccb19
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/shared/ScrollableCodeBlock.stories.tsx
@@ -0,0 +1,38 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ScrollableCodeBlock from "@app/components/tools/getPdfInfo/shared/ScrollableCodeBlock";
+
+const meta = {
+  title: "Tools/GetPdfInfo/Shared/ScrollableCodeBlock",
+  component: ScrollableCodeBlock,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ScrollableCodeBlock>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    content: `<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
+<x:xmpmeta xmlns:x="adobe:ns:meta/">
+  <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">
+    <rdf:Description rdf:about="" xmlns:dc="http://purl.org/dc/elements/1.1/">
+      <dc:title>Sample Document</dc:title>
+      <dc:creator>Stirling PDF</dc:creator>
+    </rdf:Description>
+  </rdf:RDF>
+</x:xmpmeta>
+<?xpacket end="w"?>`,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    content: null,
+  },
+};
+
+export const CustomEmptyMessage: Story = {
+  args: {
+    content: undefined,
+    emptyMessage: "No structure tree found in this document",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/getPdfInfo/shared/SectionBlock.stories.tsx b/frontend/editor/src/core/components/tools/getPdfInfo/shared/SectionBlock.stories.tsx
new file mode 100644
index 0000000000..efd32402a9
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/getPdfInfo/shared/SectionBlock.stories.tsx
@@ -0,0 +1,28 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SectionBlock from "@app/components/tools/getPdfInfo/shared/SectionBlock";
+import KeyValueList from "@app/components/tools/getPdfInfo/shared/KeyValueList";
+
+const meta = {
+  title: "Tools/GetPdfInfo/Shared/SectionBlock",
+  component: SectionBlock,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof SectionBlock>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    title: "Document Info",
+    anchorId: "document-info",
+    children: (
+      <KeyValueList
+        obj={{
+          Title: "Sample Document",
+          Author: "Jane Doe",
+          "PDF version": "1.7",
+          "Number of pages": 12,
+        }}
+      />
+    ),
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/merge/MergeFileSorter.stories.tsx b/frontend/editor/src/core/components/tools/merge/MergeFileSorter.stories.tsx
new file mode 100644
index 0000000000..d919d3ef3a
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/merge/MergeFileSorter.stories.tsx
@@ -0,0 +1,23 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import MergeFileSorter from "@app/components/tools/merge/MergeFileSorter";
+
+const meta = {
+  title: "Tools/Merge/MergeFileSorter",
+  component: MergeFileSorter,
+} satisfies Meta<typeof MergeFileSorter>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    onSortFiles: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    onSortFiles: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/merge/MergeSettings.stories.tsx b/frontend/editor/src/core/components/tools/merge/MergeSettings.stories.tsx
new file mode 100644
index 0000000000..689e210612
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/merge/MergeSettings.stories.tsx
@@ -0,0 +1,44 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import MergeSettings from "@app/components/tools/merge/MergeSettings";
+import { MergeParameters } from "@app/hooks/tools/merge/useMergeParameters";
+
+const meta = {
+  title: "tools/merge/MergeSettings",
+  component: MergeSettings,
+  args: {
+    parameters: {
+      removeDigitalSignature: false,
+      generateTableOfContents: false,
+    },
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof MergeSettings>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function MergeSettingsDemo({ disabled }: { disabled?: boolean }) {
+  const [parameters, setParameters] = useState<MergeParameters>({
+    removeDigitalSignature: false,
+    generateTableOfContents: false,
+  });
+
+  return (
+    <MergeSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <MergeSettingsDemo />,
+};
+
+export const Disabled: Story = {
+  render: () => <MergeSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/ocr/AdvancedOCRSettings.stories.tsx b/frontend/editor/src/core/components/tools/ocr/AdvancedOCRSettings.stories.tsx
new file mode 100644
index 0000000000..863f730d7a
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/ocr/AdvancedOCRSettings.stories.tsx
@@ -0,0 +1,43 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AdvancedOCRSettings from "@app/components/tools/ocr/AdvancedOCRSettings";
+
+const meta = {
+  title: "Tools/Ocr/AdvancedOCRSettings",
+  component: AdvancedOCRSettings,
+} satisfies Meta<typeof AdvancedOCRSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    advancedOptions: [],
+    ocrRenderType: "hocr",
+    onParameterChange: () => {},
+  },
+};
+
+export const OptionsSelected: Story = {
+  args: {
+    advancedOptions: ["sidecar", "deskew"],
+    ocrRenderType: "hocr",
+    onParameterChange: () => {},
+  },
+};
+
+export const CompatibilityMode: Story = {
+  args: {
+    advancedOptions: [],
+    ocrRenderType: "sandwich",
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    advancedOptions: ["clean"],
+    ocrRenderType: "hocr",
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/ocr/LanguagePicker.stories.tsx b/frontend/editor/src/core/components/tools/ocr/LanguagePicker.stories.tsx
new file mode 100644
index 0000000000..3ca16b9aba
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/ocr/LanguagePicker.stories.tsx
@@ -0,0 +1,63 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import LanguagePicker from "@app/components/tools/ocr/LanguagePicker";
+
+const meta = {
+  title: "Tools/OCR/LanguagePicker",
+  component: LanguagePicker,
+  args: {
+    value: [],
+    onChange: () => {},
+  },
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/ui-data/ocr-pdf", () =>
+          HttpResponse.json({
+            languages: ["eng", "fra", "deu", "spa", "ita", "por"],
+          }),
+        ),
+      ],
+    },
+  },
+} satisfies Meta<typeof LanguagePicker>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Controlled wrapper so selecting/removing languages actually updates the picker. */
+function LanguagePickerDemo({
+  initialValue = [],
+  disabled,
+}: {
+  initialValue?: string[];
+  disabled?: boolean;
+}) {
+  const [value, setValue] = useState<string[]>(initialValue);
+  return (
+    <LanguagePicker
+      value={value}
+      onChange={setValue}
+      disabled={disabled}
+      // Auto-fill would otherwise select a language on mount based on the
+      // browser's locale, which would make this story non-deterministic.
+      autoFillFromBrowserLanguage={false}
+    />
+  );
+}
+
+/** No languages selected yet, backend list loaded via MSW. */
+export const Default: Story = {
+  render: () => <LanguagePickerDemo />,
+};
+
+/** One language already selected. */
+export const WithSelection: Story = {
+  render: () => <LanguagePickerDemo initialValue={["eng"]} />,
+};
+
+/** Disabled — e.g. while OCR is running elsewhere in the tool panel. */
+export const Disabled: Story = {
+  render: () => <LanguagePickerDemo initialValue={["eng"]} disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/ocr/OCRSettings.stories.tsx b/frontend/editor/src/core/components/tools/ocr/OCRSettings.stories.tsx
new file mode 100644
index 0000000000..8839cfda29
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/ocr/OCRSettings.stories.tsx
@@ -0,0 +1,43 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import OCRSettings from "@app/components/tools/ocr/OCRSettings";
+import { OCRParameters } from "@app/hooks/tools/ocr/useOCRParameters";
+
+const buildParameters = (
+  overrides: Partial<OCRParameters> = {},
+): OCRParameters => ({
+  languages: [],
+  ocrType: "skip-text",
+  ocrRenderType: "hocr",
+  additionalOptions: [],
+  ...overrides,
+});
+
+const meta = {
+  title: "Tools/OCR/OCRSettings",
+  component: OCRSettings,
+} satisfies Meta<typeof OCRSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+  },
+};
+
+export const LanguagesSelected: Story = {
+  args: {
+    parameters: buildParameters({ languages: ["eng", "fra"] }),
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/pageLayout/LayoutPreview.stories.tsx b/frontend/editor/src/core/components/tools/pageLayout/LayoutPreview.stories.tsx
new file mode 100644
index 0000000000..fdac5554d2
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/pageLayout/LayoutPreview.stories.tsx
@@ -0,0 +1,44 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import LayoutPreview from "@app/components/tools/pageLayout/LayoutPreview";
+import { defaultParameters } from "@app/hooks/tools/pageLayout/usePageLayoutParameters";
+
+const meta = {
+  title: "Tools/PageLayout/LayoutPreview",
+  component: LayoutPreview,
+} satisfies Meta<typeof LayoutPreview>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+  },
+};
+
+export const CustomGridLandscape: Story = {
+  args: {
+    parameters: {
+      ...defaultParameters,
+      mode: "CUSTOM",
+      rows: 2,
+      cols: 3,
+      orientation: "LANDSCAPE",
+      addBorder: true,
+    },
+  },
+};
+
+export const RightToLeftReading: Story = {
+  args: {
+    parameters: {
+      ...defaultParameters,
+      mode: "CUSTOM",
+      rows: 2,
+      cols: 2,
+      arrangement: "BY_ROWS",
+      readingDirection: "RTL",
+      addBorder: true,
+    },
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/pageLayout/PageLayoutAdvancedSettings.stories.tsx b/frontend/editor/src/core/components/tools/pageLayout/PageLayoutAdvancedSettings.stories.tsx
new file mode 100644
index 0000000000..712ca94741
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/pageLayout/PageLayoutAdvancedSettings.stories.tsx
@@ -0,0 +1,68 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PageLayoutAdvancedSettings from "@app/components/tools/pageLayout/PageLayoutAdvancedSettings";
+import {
+  PageLayoutParameters,
+  defaultParameters,
+} from "@app/hooks/tools/pageLayout/usePageLayoutParameters";
+
+const meta = {
+  title: "Tools/PageLayout/PageLayoutAdvancedSettings",
+  component: PageLayoutAdvancedSettings,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "22rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof PageLayoutAdvancedSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function AdvancedSettingsDemo({
+  disabled,
+  initialParameters,
+}: {
+  disabled?: boolean;
+  initialParameters?: PageLayoutParameters;
+}) {
+  const [parameters, setParameters] = useState<PageLayoutParameters>(
+    initialParameters ?? defaultParameters,
+  );
+  return (
+    <PageLayoutAdvancedSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <AdvancedSettingsDemo />,
+};
+
+export const Disabled: Story = {
+  render: () => <AdvancedSettingsDemo disabled />,
+};
+
+export const LandscapeRTL: Story = {
+  render: () => (
+    <AdvancedSettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        orientation: "LANDSCAPE",
+        arrangement: "BY_ROWS",
+        readingDirection: "RTL",
+      }}
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/pageLayout/PageLayoutMarginsBordersSettings.stories.tsx b/frontend/editor/src/core/components/tools/pageLayout/PageLayoutMarginsBordersSettings.stories.tsx
new file mode 100644
index 0000000000..67d9f06388
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/pageLayout/PageLayoutMarginsBordersSettings.stories.tsx
@@ -0,0 +1,58 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PageLayoutMarginsBordersSettings from "@app/components/tools/pageLayout/PageLayoutMarginsBordersSettings";
+import {
+  PageLayoutParameters,
+  defaultParameters,
+} from "@app/hooks/tools/pageLayout/usePageLayoutParameters";
+
+const meta = {
+  title: "Tools/PageLayout/PageLayoutMarginsBordersSettings",
+  component: PageLayoutMarginsBordersSettings,
+} satisfies Meta<typeof PageLayoutMarginsBordersSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const withMarginsParameters: PageLayoutParameters = {
+  ...defaultParameters,
+  topMargin: 20,
+  bottomMargin: 20,
+  leftMargin: 15,
+  rightMargin: 15,
+  innerMargin: 5,
+};
+
+const withBorderParameters: PageLayoutParameters = {
+  ...defaultParameters,
+  addBorder: true,
+  borderWidth: 2,
+};
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const WithMargins: Story = {
+  args: {
+    parameters: withMarginsParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const WithBorder: Story = {
+  args: {
+    parameters: withBorderParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/pageLayout/PageLayoutPreview.stories.tsx b/frontend/editor/src/core/components/tools/pageLayout/PageLayoutPreview.stories.tsx
new file mode 100644
index 0000000000..e3c2a66183
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/pageLayout/PageLayoutPreview.stories.tsx
@@ -0,0 +1,40 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PageLayoutPreview from "@app/components/tools/pageLayout/PageLayoutPreview";
+import { defaultParameters } from "@app/hooks/tools/pageLayout/usePageLayoutParameters";
+
+const meta = {
+  title: "Tools/PageLayout/PageLayoutPreview",
+  component: PageLayoutPreview,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof PageLayoutPreview>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+  },
+};
+
+export const CustomGridWithBorder: Story = {
+  args: {
+    parameters: {
+      ...defaultParameters,
+      mode: "CUSTOM",
+      rows: 2,
+      cols: 3,
+      addBorder: true,
+      borderWidth: 2,
+    },
+  },
+};
+
+export const Landscape: Story = {
+  args: {
+    parameters: {
+      ...defaultParameters,
+      orientation: "LANDSCAPE",
+      pagesPerSheet: 2,
+    },
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/pageLayout/PageLayoutSettings.stories.tsx b/frontend/editor/src/core/components/tools/pageLayout/PageLayoutSettings.stories.tsx
new file mode 100644
index 0000000000..4ed2a6219f
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/pageLayout/PageLayoutSettings.stories.tsx
@@ -0,0 +1,61 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PageLayoutSettings from "@app/components/tools/pageLayout/PageLayoutSettings";
+import {
+  PageLayoutParameters,
+  defaultParameters,
+} from "@app/hooks/tools/pageLayout/usePageLayoutParameters";
+
+const meta: Meta<typeof PageLayoutSettings> = {
+  title: "Tools/PageLayout/PageLayoutSettings",
+  component: PageLayoutSettings,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "22rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof PageLayoutSettings>;
+
+function SettingsDemo({
+  initial,
+  disabled,
+}: {
+  initial: PageLayoutParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] = useState(initial);
+
+  return (
+    <PageLayoutSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+/** Default mode: pages-per-sheet select plus its description banner. */
+export const Default: Story = {
+  render: () => <SettingsDemo initial={defaultParameters} />,
+};
+
+/** Custom mode: rows/columns number inputs instead of the sheet-count select. */
+export const CustomMode: Story = {
+  render: () => (
+    <SettingsDemo
+      initial={{ ...defaultParameters, mode: "CUSTOM", rows: 2, cols: 3 }}
+    />
+  ),
+};
+
+/** Disabled: all controls locked, e.g. while no file is selected. */
+export const Disabled: Story = {
+  render: () => <SettingsDemo initial={defaultParameters} disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/redact/RedactAdvancedSettings.stories.tsx b/frontend/editor/src/core/components/tools/redact/RedactAdvancedSettings.stories.tsx
new file mode 100644
index 0000000000..70c858cb65
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/redact/RedactAdvancedSettings.stories.tsx
@@ -0,0 +1,40 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RedactAdvancedSettings from "@app/components/tools/redact/RedactAdvancedSettings";
+import {
+  RedactParameters,
+  defaultParameters,
+} from "@app/hooks/tools/redact/useRedactParameters";
+
+const meta = {
+  title: "Tools/Redact/RedactAdvancedSettings",
+  component: RedactAdvancedSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof RedactAdvancedSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function AdvancedSettingsDemo({ disabled }: { disabled?: boolean }) {
+  const [parameters, setParameters] =
+    useState<RedactParameters>(defaultParameters);
+
+  return (
+    <RedactAdvancedSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <AdvancedSettingsDemo /> };
+
+export const Disabled: Story = {
+  render: () => <AdvancedSettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/redact/RedactModeSelector.stories.tsx b/frontend/editor/src/core/components/tools/redact/RedactModeSelector.stories.tsx
new file mode 100644
index 0000000000..03ca1abe12
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/redact/RedactModeSelector.stories.tsx
@@ -0,0 +1,54 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RedactModeSelector from "@app/components/tools/redact/RedactModeSelector";
+import type { RedactMode } from "@app/hooks/tools/redact/useRedactParameters";
+
+const meta = {
+  title: "Tools/Redact/RedactModeSelector",
+  component: RedactModeSelector,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "22rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+  args: {
+    mode: "automatic",
+    onModeChange: () => {},
+  },
+} satisfies Meta<typeof RedactModeSelector>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function ModeDemo({
+  disabled,
+  hasAnyFiles,
+}: {
+  disabled?: boolean;
+  hasAnyFiles?: boolean;
+}) {
+  const [mode, setMode] = useState<RedactMode>("automatic");
+  return (
+    <RedactModeSelector
+      mode={mode}
+      onModeChange={setMode}
+      disabled={disabled}
+      hasAnyFiles={hasAnyFiles}
+    />
+  );
+}
+
+/** Files present: both Automatic and Manual are selectable. */
+export const Default: Story = { render: () => <ModeDemo hasAnyFiles /> };
+
+/** No files uploaded yet: both options disabled with a tooltip on Automatic. */
+export const NoFiles: Story = {
+  render: () => <ModeDemo hasAnyFiles={false} />,
+};
+
+/** Selector disabled entirely (e.g. while an operation is running). */
+export const Disabled: Story = {
+  render: () => <ModeDemo hasAnyFiles disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.stories.tsx b/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.stories.tsx
new file mode 100644
index 0000000000..e34cc33924
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/redact/RedactSingleStepSettings.stories.tsx
@@ -0,0 +1,78 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RedactSingleStepSettings from "@app/components/tools/redact/RedactSingleStepSettings";
+import {
+  RedactParameters,
+  defaultParameters,
+} from "@app/hooks/tools/redact/useRedactParameters";
+
+const meta = {
+  title: "Tools/Redact/RedactSingleStepSettings",
+  component: RedactSingleStepSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof RedactSingleStepSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function SettingsDemo({
+  initialParameters = defaultParameters,
+  disabled,
+}: {
+  initialParameters?: RedactParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<RedactParameters>(initialParameters);
+
+  return (
+    <RedactSingleStepSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <SettingsDemo />,
+};
+
+export const AutomaticWithWords: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        wordsToRedact: ["Confidential", "SSN"],
+      }}
+    />
+  ),
+};
+
+export const ManualMode: Story = {
+  render: () => (
+    <SettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        mode: "manual",
+      }}
+    />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <SettingsDemo
+      disabled
+      initialParameters={{
+        ...defaultParameters,
+        wordsToRedact: ["Confidential"],
+      }}
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/redact/WordsToRedactInput.stories.tsx b/frontend/editor/src/core/components/tools/redact/WordsToRedactInput.stories.tsx
new file mode 100644
index 0000000000..ec6d2b8492
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/redact/WordsToRedactInput.stories.tsx
@@ -0,0 +1,47 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import WordsToRedactInput from "@app/components/tools/redact/WordsToRedactInput";
+
+const meta = {
+  title: "Tools/Redact/WordsToRedactInput",
+  component: WordsToRedactInput,
+  args: {
+    wordsToRedact: [],
+    onWordsChange: () => {},
+  },
+} satisfies Meta<typeof WordsToRedactInput>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function WordsToRedactInputDemo({
+  initialWords = [],
+  disabled,
+}: {
+  initialWords?: string[];
+  disabled?: boolean;
+}) {
+  const [words, setWords] = useState<string[]>(initialWords);
+  return (
+    <WordsToRedactInput
+      wordsToRedact={words}
+      onWordsChange={setWords}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = {
+  render: () => <WordsToRedactInputDemo />,
+};
+
+export const WithWords: Story = {
+  render: () => (
+    <WordsToRedactInputDemo initialWords={["Confidential", "Top-Secret"]} />
+  ),
+};
+
+export const Disabled: Story = {
+  render: () => (
+    <WordsToRedactInputDemo initialWords={["Confidential"]} disabled />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/removeAnnotations/RemoveAnnotationsSettings.stories.tsx b/frontend/editor/src/core/components/tools/removeAnnotations/RemoveAnnotationsSettings.stories.tsx
new file mode 100644
index 0000000000..d0461743ad
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/removeAnnotations/RemoveAnnotationsSettings.stories.tsx
@@ -0,0 +1,12 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RemoveAnnotationsSettings from "@app/components/tools/removeAnnotations/RemoveAnnotationsSettings";
+
+const meta = {
+  title: "Tools/RemoveAnnotations/RemoveAnnotationsSettings",
+  component: RemoveAnnotationsSettings,
+} satisfies Meta<typeof RemoveAnnotationsSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/core/components/tools/removeBlanks/RemoveBlanksSettings.stories.tsx b/frontend/editor/src/core/components/tools/removeBlanks/RemoveBlanksSettings.stories.tsx
new file mode 100644
index 0000000000..946dc5074b
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/removeBlanks/RemoveBlanksSettings.stories.tsx
@@ -0,0 +1,41 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RemoveBlanksSettings from "@app/components/tools/removeBlanks/RemoveBlanksSettings";
+import { RemoveBlanksParameters } from "@app/hooks/tools/removeBlanks/useRemoveBlanksParameters";
+
+const buildParameters = (
+  overrides: Partial<RemoveBlanksParameters> = {},
+): RemoveBlanksParameters => ({
+  threshold: 10,
+  whitePercent: 99.9,
+  includeBlankPages: false,
+  ...overrides,
+});
+
+const meta = {
+  title: "Tools/RemoveBlanks/RemoveBlanksSettings",
+  component: RemoveBlanksSettings,
+} satisfies Meta<typeof RemoveBlanksSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+  },
+};
+
+export const IncludeBlankPages: Story = {
+  args: {
+    parameters: buildParameters({ includeBlankPages: true }),
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/removeCertificateSign/RemoveCertificateSignSettings.stories.tsx b/frontend/editor/src/core/components/tools/removeCertificateSign/RemoveCertificateSignSettings.stories.tsx
new file mode 100644
index 0000000000..4af89e165f
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/removeCertificateSign/RemoveCertificateSignSettings.stories.tsx
@@ -0,0 +1,28 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RemoveCertificateSignSettings from "@app/components/tools/removeCertificateSign/RemoveCertificateSignSettings";
+import { RemoveCertificateSignParameters } from "@app/hooks/tools/removeCertificateSign/useRemoveCertificateSignParameters";
+
+const baseParameters: RemoveCertificateSignParameters = {};
+
+const meta = {
+  title: "Tools/RemoveCertificateSign/RemoveCertificateSignSettings",
+  component: RemoveCertificateSignSettings,
+} satisfies Meta<typeof RemoveCertificateSignSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: baseParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: baseParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/removePages/RemovePagesSettings.stories.tsx b/frontend/editor/src/core/components/tools/removePages/RemovePagesSettings.stories.tsx
new file mode 100644
index 0000000000..92db55641e
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/removePages/RemovePagesSettings.stories.tsx
@@ -0,0 +1,44 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RemovePagesSettings from "@app/components/tools/removePages/RemovePagesSettings";
+import { RemovePagesParameters } from "@app/hooks/tools/removePages/useRemovePagesParameters";
+
+const meta = {
+  title: "Tools/RemovePages/RemovePagesSettings",
+  component: RemovePagesSettings,
+} satisfies Meta<typeof RemovePagesSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const baseParameters: RemovePagesParameters = {
+  pageNumbers: "",
+};
+
+export const Default: Story = {
+  args: {
+    parameters: baseParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const FilledValid: Story = {
+  args: {
+    parameters: { pageNumbers: "1,3,5-8,10" },
+    onParameterChange: () => {},
+  },
+};
+
+export const InvalidInput: Story = {
+  args: {
+    parameters: { pageNumbers: "abc" },
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: baseParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/removePassword/RemovePasswordSettings.stories.tsx b/frontend/editor/src/core/components/tools/removePassword/RemovePasswordSettings.stories.tsx
new file mode 100644
index 0000000000..5997482e5d
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/removePassword/RemovePasswordSettings.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { fn } from "storybook/test";
+
+import RemovePasswordSettings from "@app/components/tools/removePassword/RemovePasswordSettings";
+import { RemovePasswordParameters } from "@app/hooks/tools/removePassword/useRemovePasswordParameters";
+
+const parameters: RemovePasswordParameters = {
+  password: "",
+};
+
+const meta = {
+  title: "Tools/RemovePassword/RemovePasswordSettings",
+  component: RemovePasswordSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters,
+    onParameterChange: fn(),
+  },
+} satisfies Meta<typeof RemovePasswordSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Filled: Story = {
+  args: {
+    parameters: {
+      ...parameters,
+      password: "correct-horse-battery-staple",
+    },
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/reorganizePages/ReorganizePagesSettings.stories.tsx b/frontend/editor/src/core/components/tools/reorganizePages/ReorganizePagesSettings.stories.tsx
new file mode 100644
index 0000000000..07586069b9
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/reorganizePages/ReorganizePagesSettings.stories.tsx
@@ -0,0 +1,58 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ReorganizePagesSettings from "@app/components/tools/reorganizePages/ReorganizePagesSettings";
+import {
+  defaultReorganizePagesParameters,
+  ReorganizePagesParameters,
+} from "@app/hooks/tools/reorganizePages/useReorganizePagesParameters";
+
+const meta: Meta<typeof ReorganizePagesSettings> = {
+  title: "Tools/ReorganizePages/ReorganizePagesSettings",
+  component: ReorganizePagesSettings,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "22rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof ReorganizePagesSettings>;
+
+function SettingsDemo({
+  initial,
+  disabled,
+}: {
+  initial?: Partial<ReorganizePagesParameters>;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] = useState<ReorganizePagesParameters>({
+    ...defaultReorganizePagesParameters,
+    ...initial,
+  });
+
+  return (
+    <ReorganizePagesSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+/** Custom order mode (default): the page order text input is shown. */
+export const Default: Story = { render: () => <SettingsDemo /> };
+
+/** A preset mode (e.g. reverse) that doesn't require a page order input. */
+export const PresetMode: Story = {
+  render: () => <SettingsDemo initial={{ customMode: "REVERSE_ORDER" }} />,
+};
+
+/** Disabled state, e.g. while no files are loaded or processing is in progress. */
+export const Disabled: Story = {
+  render: () => <SettingsDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/repair/RepairSettings.stories.tsx b/frontend/editor/src/core/components/tools/repair/RepairSettings.stories.tsx
new file mode 100644
index 0000000000..4111f5882b
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/repair/RepairSettings.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RepairSettings from "@app/components/tools/repair/RepairSettings";
+import { RepairParameters } from "@app/hooks/tools/repair/useRepairParameters";
+
+const parameters: RepairParameters = {};
+
+const meta = {
+  title: "Tools/Repair/RepairSettings",
+  component: RepairSettings,
+  args: {
+    parameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof RepairSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/replaceColor/ReplaceColorSettings.stories.tsx b/frontend/editor/src/core/components/tools/replaceColor/ReplaceColorSettings.stories.tsx
new file mode 100644
index 0000000000..ff11addc1e
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/replaceColor/ReplaceColorSettings.stories.tsx
@@ -0,0 +1,35 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ReplaceColorSettings from "@app/components/tools/replaceColor/ReplaceColorSettings";
+import {
+  ReplaceColorParameters,
+  defaultParameters,
+} from "@app/hooks/tools/replaceColor/useReplaceColorParameters";
+
+const meta = {
+  title: "Tools/ReplaceColor/ReplaceColorSettings",
+  component: ReplaceColorSettings,
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof ReplaceColorSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const CustomColor: Story = {
+  args: {
+    parameters: {
+      ...defaultParameters,
+      replaceAndInvertOption: "CUSTOM_COLOR",
+    } satisfies ReplaceColorParameters,
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/rotate/RotateAutomationSettings.stories.tsx b/frontend/editor/src/core/components/tools/rotate/RotateAutomationSettings.stories.tsx
new file mode 100644
index 0000000000..e967671741
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/rotate/RotateAutomationSettings.stories.tsx
@@ -0,0 +1,46 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RotateAutomationSettings from "@app/components/tools/rotate/RotateAutomationSettings";
+import { RotateParameters } from "@app/hooks/tools/rotate/useRotateParameters";
+
+const meta = {
+  title: "Tools/Rotate/RotateAutomationSettings",
+  component: RotateAutomationSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: { angle: 0 },
+    onParameterChange: () => {},
+  },
+} satisfies Meta<typeof RotateAutomationSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function RotateDemo({
+  disabled,
+  initialAngle = 0,
+}: {
+  disabled?: boolean;
+  initialAngle?: number;
+}) {
+  const [parameters, setParameters] = useState<RotateParameters>({
+    angle: initialAngle,
+  });
+
+  return (
+    <RotateAutomationSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <RotateDemo /> };
+
+export const Rotated90: Story = {
+  render: () => <RotateDemo initialAngle={90} />,
+};
+
+export const Disabled: Story = { render: () => <RotateDemo disabled /> };
diff --git a/frontend/editor/src/core/components/tools/sanitize/SanitizeSettings.stories.tsx b/frontend/editor/src/core/components/tools/sanitize/SanitizeSettings.stories.tsx
new file mode 100644
index 0000000000..c5463cbfc0
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/sanitize/SanitizeSettings.stories.tsx
@@ -0,0 +1,40 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SanitizeSettings from "@app/components/tools/sanitize/SanitizeSettings";
+import { defaultParameters } from "@app/hooks/tools/sanitize/useSanitizeParameters";
+
+const meta = {
+  title: "Tools/Sanitize/SanitizeSettings",
+  component: SanitizeSettings,
+} satisfies Meta<typeof SanitizeSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const AllSelected: Story = {
+  args: {
+    parameters: {
+      removeJavaScript: true,
+      removeEmbeddedFiles: true,
+      removeXMPMetadata: true,
+      removeMetadata: true,
+      removeLinks: true,
+      removeFonts: true,
+    },
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/scannerImageSplit/ScannerImageSplitSettings.stories.tsx b/frontend/editor/src/core/components/tools/scannerImageSplit/ScannerImageSplitSettings.stories.tsx
new file mode 100644
index 0000000000..05f4a41cf4
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/scannerImageSplit/ScannerImageSplitSettings.stories.tsx
@@ -0,0 +1,36 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ScannerImageSplitSettings from "@app/components/tools/scannerImageSplit/ScannerImageSplitSettings";
+import { ScannerImageSplitParameters } from "@app/hooks/tools/scannerImageSplit/useScannerImageSplitParameters";
+
+const buildParameters = (
+  overrides: Partial<ScannerImageSplitParameters> = {},
+): ScannerImageSplitParameters => ({
+  angle_threshold: 10,
+  tolerance: 30,
+  min_area: 10000,
+  min_contour_area: 500,
+  border_size: 1,
+  ...overrides,
+});
+
+const meta = {
+  title: "Tools/ScannerImageSplit/ScannerImageSplitSettings",
+  component: ScannerImageSplitSettings,
+} satisfies Meta<typeof ScannerImageSplitSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/shared/ErrorNotification.stories.tsx b/frontend/editor/src/core/components/tools/shared/ErrorNotification.stories.tsx
new file mode 100644
index 0000000000..81f6c658bc
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/shared/ErrorNotification.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ErrorNotification from "@app/components/tools/shared/ErrorNotification";
+
+const meta = {
+  title: "ToolsShared/ErrorNotification",
+  component: ErrorNotification,
+} satisfies Meta<typeof ErrorNotification>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    error: "Something went wrong while processing the file.",
+    onClose: () => {},
+  },
+};
+
+export const CustomTitle: Story = {
+  args: {
+    error: "The uploaded file could not be read.",
+    onClose: () => {},
+    title: "Upload failed",
+    color: "orange",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/shared/FileMetadata.stories.tsx b/frontend/editor/src/core/components/tools/shared/FileMetadata.stories.tsx
new file mode 100644
index 0000000000..750d751e6d
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/shared/FileMetadata.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FileMetadata from "@app/components/tools/shared/FileMetadata";
+
+const buildFile = (name = "report.pdf", type = "application/pdf"): File =>
+  new File(["%PDF-1.4 mock content"], name, {
+    type,
+    lastModified: new Date("2026-01-15T10:30:00Z").getTime(),
+  });
+
+const meta = {
+  title: "ToolsShared/FileMetadata",
+  component: FileMetadata,
+} satisfies Meta<typeof FileMetadata>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    file: buildFile(),
+  },
+};
+
+export const UnknownType: Story = {
+  args: {
+    file: buildFile("data.bin", ""),
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/shared/NavigationControls.stories.tsx b/frontend/editor/src/core/components/tools/shared/NavigationControls.stories.tsx
new file mode 100644
index 0000000000..e34b1cb329
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/shared/NavigationControls.stories.tsx
@@ -0,0 +1,36 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import NavigationControls from "@app/components/tools/shared/NavigationControls";
+
+const meta = {
+  title: "ToolsShared/NavigationControls",
+  component: NavigationControls,
+} satisfies Meta<typeof NavigationControls>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    currentIndex: 0,
+    totalFiles: 5,
+    onPrevious: () => {},
+    onNext: () => {},
+  },
+};
+
+export const LastFile: Story = {
+  args: {
+    currentIndex: 4,
+    totalFiles: 5,
+    onPrevious: () => {},
+    onNext: () => {},
+  },
+};
+
+export const SingleFile: Story = {
+  args: {
+    currentIndex: 0,
+    totalFiles: 1,
+    onPrevious: () => {},
+    onNext: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/shared/NoToolsFound.stories.tsx b/frontend/editor/src/core/components/tools/shared/NoToolsFound.stories.tsx
new file mode 100644
index 0000000000..6ac9f9a3b0
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/shared/NoToolsFound.stories.tsx
@@ -0,0 +1,11 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import NoToolsFound from "@app/components/tools/shared/NoToolsFound";
+
+const meta = {
+  title: "Tools/Shared/NoToolsFound",
+  component: NoToolsFound,
+} satisfies Meta<typeof NoToolsFound>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/core/components/tools/shared/NumberInputWithUnit.stories.tsx b/frontend/editor/src/core/components/tools/shared/NumberInputWithUnit.stories.tsx
new file mode 100644
index 0000000000..b6e1d8280f
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/shared/NumberInputWithUnit.stories.tsx
@@ -0,0 +1,37 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import NumberInputWithUnit from "@app/components/tools/shared/NumberInputWithUnit";
+
+const meta = {
+  title: "Tools/Shared/NumberInputWithUnit",
+  component: NumberInputWithUnit,
+} satisfies Meta<typeof NumberInputWithUnit>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    label: "Margin",
+    value: 10,
+    onChange: () => {},
+    unit: "px",
+  },
+};
+
+export const WithMinMax: Story = {
+  args: {
+    ...Default.args,
+    label: "Opacity",
+    value: 50,
+    unit: "%",
+    min: 0,
+    max: 100,
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    ...Default.args,
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/shared/ResultsPreview.stories.tsx b/frontend/editor/src/core/components/tools/shared/ResultsPreview.stories.tsx
new file mode 100644
index 0000000000..174a192613
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/shared/ResultsPreview.stories.tsx
@@ -0,0 +1,46 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ResultsPreview, {
+  ReviewFile,
+} from "@app/components/tools/shared/ResultsPreview";
+
+function makeFile(name: string, type: string, size: number): File {
+  return new File([new Uint8Array(size)], name, { type });
+}
+
+const files: ReviewFile[] = [
+  { file: makeFile("contract-final.pdf", "application/pdf", 245_760) },
+  { file: makeFile("scan-001.pdf", "application/pdf", 1_048_576) },
+  { file: makeFile("invoice-march.pdf", "application/pdf", 51_200) },
+];
+
+const meta = {
+  title: "Tools/Shared/ResultsPreview",
+  component: ResultsPreview,
+} satisfies Meta<typeof ResultsPreview>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    files,
+  },
+};
+
+export const SingleFile: Story = {
+  args: {
+    files: [files[0]],
+  },
+};
+
+export const Loading: Story = {
+  args: {
+    files: [],
+    isGeneratingThumbnails: true,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    files: [],
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/shared/SubcategoryHeader.stories.tsx b/frontend/editor/src/core/components/tools/shared/SubcategoryHeader.stories.tsx
new file mode 100644
index 0000000000..634841969a
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/shared/SubcategoryHeader.stories.tsx
@@ -0,0 +1,24 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SubcategoryHeader from "@app/components/tools/shared/SubcategoryHeader";
+
+const meta = {
+  title: "Tools/Shared/SubcategoryHeader",
+  component: SubcategoryHeader,
+} satisfies Meta<typeof SubcategoryHeader>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    label: "Page organization",
+  },
+};
+
+export const CustomSpacing: Story = {
+  args: {
+    label: "Security",
+    mt: "2rem",
+    mb: "1rem",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/shared/ToolStep.stories.tsx b/frontend/editor/src/core/components/tools/shared/ToolStep.stories.tsx
new file mode 100644
index 0000000000..e3c10425f0
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/shared/ToolStep.stories.tsx
@@ -0,0 +1,36 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Text } from "@mantine/core";
+import ToolStep from "@app/components/tools/shared/ToolStep";
+
+const meta = {
+  title: "Tools/Shared/ToolStep",
+  component: ToolStep,
+} satisfies Meta<typeof ToolStep>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    title: "Select pages",
+    children: <Text size="sm">Step content goes here.</Text>,
+  },
+};
+
+export const WithHelpTextAndNumber: Story = {
+  args: {
+    title: "Choose output format",
+    helpText: "Pick the format your converted file should use.",
+    showNumber: true,
+    _stepNumber: 2,
+    children: <Text size="sm">Step content goes here.</Text>,
+  },
+};
+
+export const Collapsed: Story = {
+  args: {
+    title: "Advanced settings",
+    isCollapsed: true,
+    onCollapsedClick: () => {},
+    children: <Text size="sm">Step content goes here.</Text>,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/showJS/ShowJSView.stories.tsx b/frontend/editor/src/core/components/tools/showJS/ShowJSView.stories.tsx
new file mode 100644
index 0000000000..fcb29ed009
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/showJS/ShowJSView.stories.tsx
@@ -0,0 +1,45 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ShowJSView from "@app/components/tools/showJS/ShowJSView";
+
+const SAMPLE_SCRIPT = `function greet(name) {
+  // say hello
+  if (!name) {
+    return "Hello, stranger!";
+  }
+  return "Hello, " + name + "!";
+}
+
+for (let i = 0; i < 3; i++) {
+  console.log(greet("World"));
+}
+`;
+
+const meta = {
+  title: "Tools/ShowJS/ShowJSView",
+  component: ShowJSView,
+} satisfies Meta<typeof ShowJSView>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    data: SAMPLE_SCRIPT,
+  },
+};
+
+export const WithDownload: Story = {
+  args: {
+    data: {
+      scriptText: SAMPLE_SCRIPT,
+      downloadUrl: "blob:mock-download-url",
+      downloadFilename: "extracted.js",
+    },
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    data: "",
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/sign/PenSizeSelector.stories.tsx b/frontend/editor/src/core/components/tools/sign/PenSizeSelector.stories.tsx
new file mode 100644
index 0000000000..658d4ebb6e
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/sign/PenSizeSelector.stories.tsx
@@ -0,0 +1,36 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PenSizeSelector from "@app/components/tools/sign/PenSizeSelector";
+
+const meta = {
+  title: "Tools/Sign/PenSizeSelector",
+  component: PenSizeSelector,
+  args: {
+    value: 5,
+    inputValue: "5",
+    onValueChange: () => {},
+    onInputChange: () => {},
+  },
+} satisfies Meta<typeof PenSizeSelector>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function PenSizeSelectorDemo({ disabled }: { disabled?: boolean }) {
+  const [value, setValue] = useState(5);
+  const [inputValue, setInputValue] = useState("5");
+  return (
+    <PenSizeSelector
+      value={value}
+      inputValue={inputValue}
+      onValueChange={setValue}
+      onInputChange={setInputValue}
+      disabled={disabled}
+    />
+  );
+}
+
+export const Default: Story = { render: () => <PenSizeSelectorDemo /> };
+
+export const Disabled: Story = {
+  render: () => <PenSizeSelectorDemo disabled />,
+};
diff --git a/frontend/editor/src/core/components/tools/sign/SavedSignaturesSection.stories.tsx b/frontend/editor/src/core/components/tools/sign/SavedSignaturesSection.stories.tsx
new file mode 100644
index 0000000000..9079bb08ab
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/sign/SavedSignaturesSection.stories.tsx
@@ -0,0 +1,99 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SavedSignaturesSection from "@app/components/tools/sign/SavedSignaturesSection";
+import type { SavedSignature } from "@app/hooks/tools/sign/useSavedSignatures";
+
+const mockSignatures: SavedSignature[] = [
+  {
+    id: "sig-1",
+    label: "My signature",
+    scope: "personal",
+    type: "text",
+    dataUrl: "",
+    signerName: "Jordan Lee",
+    fontFamily: "cursive",
+    fontSize: 32,
+    textColor: "#1a1a1a",
+    createdAt: Date.now(),
+    updatedAt: Date.now(),
+  },
+  {
+    id: "sig-2",
+    label: "Company stamp",
+    scope: "shared",
+    type: "image",
+    dataUrl:
+      "data:image/svg+xml;base64," +
+      btoa(
+        '<svg xmlns="http://www.w3.org/2000/svg" width="200" height="80"><rect width="200" height="80" fill="white"/><text x="10" y="45" font-size="20">Approved</text></svg>',
+      ),
+    createdAt: Date.now(),
+    updatedAt: Date.now(),
+  },
+  {
+    id: "sig-3",
+    label: "Quick draw",
+    scope: "localStorage",
+    type: "canvas",
+    dataUrl:
+      "data:image/svg+xml;base64," +
+      btoa(
+        '<svg xmlns="http://www.w3.org/2000/svg" width="200" height="80"><rect width="200" height="80" fill="white"/><path d="M10 60 Q 50 10 100 60 T 190 60" stroke="black" fill="none" stroke-width="3"/></svg>',
+      ),
+    createdAt: Date.now(),
+    updatedAt: Date.now(),
+  },
+];
+
+const meta = {
+  title: "Tools/Sign/SavedSignaturesSection",
+  component: SavedSignaturesSection,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof SavedSignaturesSection>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    signatures: mockSignatures,
+    isAtCapacity: false,
+    maxLimit: 5,
+    onUseSignature: () => {},
+    onDeleteSignature: () => {},
+    onRenameSignature: () => {},
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    signatures: [],
+    isAtCapacity: false,
+    maxLimit: 5,
+    onUseSignature: () => {},
+    onDeleteSignature: () => {},
+    onRenameSignature: () => {},
+  },
+};
+
+export const AtCapacity: Story = {
+  args: {
+    signatures: mockSignatures,
+    isAtCapacity: true,
+    maxLimit: 3,
+    onUseSignature: () => {},
+    onDeleteSignature: () => {},
+    onRenameSignature: () => {},
+  },
+};
+
+export const AdminWithSharedDelete: Story = {
+  args: {
+    signatures: mockSignatures,
+    isAtCapacity: false,
+    maxLimit: 5,
+    isAdmin: true,
+    onUseSignature: () => {},
+    onDeleteSignature: () => {},
+    onRenameSignature: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/singleLargePage/SingleLargePageSettings.stories.tsx b/frontend/editor/src/core/components/tools/singleLargePage/SingleLargePageSettings.stories.tsx
new file mode 100644
index 0000000000..9433f691af
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/singleLargePage/SingleLargePageSettings.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SingleLargePageSettings from "@app/components/tools/singleLargePage/SingleLargePageSettings";
+import type { SingleLargePageParameters } from "@app/hooks/tools/singleLargePage/useSingleLargePageParameters";
+
+const parameters: SingleLargePageParameters = {};
+
+const meta = {
+  title: "Tools/SingleLargePage/SingleLargePageSettings",
+  component: SingleLargePageSettings,
+} satisfies Meta<typeof SingleLargePageSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/split/SplitAutomationSettings.stories.tsx b/frontend/editor/src/core/components/tools/split/SplitAutomationSettings.stories.tsx
new file mode 100644
index 0000000000..a3b12a58e4
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/split/SplitAutomationSettings.stories.tsx
@@ -0,0 +1,45 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SplitAutomationSettings from "@app/components/tools/split/SplitAutomationSettings";
+import {
+  defaultParameters,
+  SplitParameters,
+} from "@app/hooks/tools/split/useSplitParameters";
+import { SPLIT_METHODS } from "@app/constants/splitConstants";
+
+const meta = {
+  title: "Tools/Split/SplitAutomationSettings",
+  component: SplitAutomationSettings,
+} satisfies Meta<typeof SplitAutomationSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const MethodSelected: Story = {
+  args: {
+    parameters: {
+      ...defaultParameters,
+      method: SPLIT_METHODS.BY_PAGES,
+      pages: "1,3,5",
+    } satisfies SplitParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: {
+      ...defaultParameters,
+      method: SPLIT_METHODS.BY_PAGES,
+      pages: "1,3,5",
+    } satisfies SplitParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/split/SplitSettings.stories.tsx b/frontend/editor/src/core/components/tools/split/SplitSettings.stories.tsx
new file mode 100644
index 0000000000..a3411db819
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/split/SplitSettings.stories.tsx
@@ -0,0 +1,104 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SplitSettings from "@app/components/tools/split/SplitSettings";
+import { SPLIT_METHODS } from "@app/constants/splitConstants";
+import {
+  defaultParameters,
+  SplitParameters,
+} from "@app/hooks/tools/split/useSplitParameters";
+
+const meta = {
+  title: "Tools/Split/SplitSettings",
+  component: SplitSettings,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "24rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+} satisfies Meta<typeof SplitSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+function SplitSettingsDemo({
+  initialParameters,
+  disabled,
+}: {
+  initialParameters: SplitParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<SplitParameters>(initialParameters);
+
+  return (
+    <SplitSettings
+      parameters={parameters}
+      onParameterChange={(key, value) =>
+        setParameters((prev) => ({ ...prev, [key]: value }))
+      }
+      disabled={disabled}
+    />
+  );
+}
+
+/** No method chosen yet — shows the "select a method first" placeholder. */
+export const NoMethodSelected: Story = {
+  render: () => <SplitSettingsDemo initialParameters={defaultParameters} />,
+};
+
+/** Split by pages: a single page-range text input. */
+export const ByPages: Story = {
+  render: () => (
+    <SplitSettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        method: SPLIT_METHODS.BY_PAGES,
+        pages: "1,3,5-10",
+      }}
+    />
+  ),
+};
+
+/** Split by sections: divisions, split mode, and merge checkbox. */
+export const BySections: Story = {
+  render: () => (
+    <SplitSettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        method: SPLIT_METHODS.BY_SECTIONS,
+      }}
+    />
+  ),
+};
+
+/** Split by poster print: page size + division factors + orientation. */
+export const ByPoster: Story = {
+  render: () => (
+    <SplitSettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        method: SPLIT_METHODS.BY_POSTER,
+      }}
+    />
+  ),
+};
+
+/** Disabled state: all inputs are non-interactive. */
+export const Disabled: Story = {
+  render: () => (
+    <SplitSettingsDemo
+      initialParameters={{
+        ...defaultParameters,
+        method: SPLIT_METHODS.BY_PAGES,
+        pages: "1,3,5-10",
+      }}
+      disabled
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/timestampPdf/TimestampPdfSettings.stories.tsx b/frontend/editor/src/core/components/tools/timestampPdf/TimestampPdfSettings.stories.tsx
new file mode 100644
index 0000000000..8a86d24755
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/timestampPdf/TimestampPdfSettings.stories.tsx
@@ -0,0 +1,26 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import TimestampPdfSettings from "@app/components/tools/timestampPdf/TimestampPdfSettings";
+import { defaultParameters } from "@app/hooks/tools/timestampPdf/useTimestampPdfParameters";
+
+const meta = {
+  title: "Tools/TimestampPdf/TimestampPdfSettings",
+  component: TimestampPdfSettings,
+} satisfies Meta<typeof TimestampPdfSettings>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/toolPicker/FavoriteStar.stories.tsx b/frontend/editor/src/core/components/tools/toolPicker/FavoriteStar.stories.tsx
new file mode 100644
index 0000000000..51e1d08e09
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/toolPicker/FavoriteStar.stories.tsx
@@ -0,0 +1,32 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FavoriteStar from "@app/components/tools/toolPicker/FavoriteStar";
+
+const meta = {
+  title: "Tools/ToolPicker/FavoriteStar",
+  component: FavoriteStar,
+  parameters: { layout: "centered" },
+  args: {
+    isFavorite: false,
+    onToggle: () => {},
+  },
+} satisfies Meta<typeof FavoriteStar>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Favorited: Story = {
+  args: {
+    isFavorite: true,
+  },
+};
+
+export const Sizes: Story = {
+  render: () => (
+    <div style={{ display: "flex", gap: 12, alignItems: "center" }}>
+      {(["xs", "sm", "md", "lg", "xl"] as const).map((size) => (
+        <FavoriteStar key={size} isFavorite onToggle={() => {}} size={size} />
+      ))}
+    </div>
+  ),
+};
diff --git a/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.stories.tsx b/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.stories.tsx
new file mode 100644
index 0000000000..c7dfd1b4eb
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/toolPicker/ToolSearch.stories.tsx
@@ -0,0 +1,82 @@
+import { useState, type ReactElement } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ToolSearch from "@app/components/tools/toolPicker/ToolSearch";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { NavigationProvider } from "@app/contexts/NavigationContext";
+import {
+  ToolWorkflowProvider,
+  useToolWorkflow,
+} from "@app/contexts/ToolWorkflowContext";
+
+// ToolSearchDemo below sources toolRegistry via useToolWorkflow(), so
+// ToolWorkflowProvider must be present — and it in turn needs
+// ToolRegistryProvider and NavigationProvider as ancestors to build a real registry.
+function withProviders(Story: () => ReactElement) {
+  return (
+    <PreferencesProvider>
+      <ToolRegistryProvider>
+        <NavigationProvider>
+          <ToolWorkflowProvider>
+            <Story />
+          </ToolWorkflowProvider>
+        </NavigationProvider>
+      </ToolRegistryProvider>
+    </PreferencesProvider>
+  );
+}
+
+function ToolSearchDemo({
+  mode = "filter",
+  initialValue = "",
+}: {
+  mode?: "filter" | "dropdown" | "unstyled";
+  initialValue?: string;
+}) {
+  const { toolRegistry } = useToolWorkflow();
+  const [value, setValue] = useState(initialValue);
+
+  return (
+    <ToolSearch
+      value={value}
+      onChange={setValue}
+      toolRegistry={toolRegistry}
+      mode={mode}
+      autoFocus={false}
+    />
+  );
+}
+
+const meta = {
+  title: "Tools/ToolPicker/ToolSearch",
+  component: ToolSearch,
+  decorators: [withProviders],
+  args: {
+    value: "",
+    onChange: () => {},
+    toolRegistry: {},
+    mode: "filter",
+  },
+} satisfies Meta<typeof ToolSearch>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Filter mode: plain input, no dropdown, used inline above a tool grid. */
+export const Default: Story = {
+  render: () => <ToolSearchDemo mode="filter" />,
+};
+
+/**
+ * Dropdown mode with a query pre-filled. The results panel itself only opens
+ * in response to a user typing (internal `dropdownOpen` state), so this
+ * renders the closed input — type in it to see the fuzzy-matched list.
+ */
+export const DropdownMode: Story = {
+  render: () => <ToolSearchDemo mode="dropdown" initialValue="merge" />,
+};
+
+/** Unstyled mode: bare input with no wrapping container, for embedding elsewhere. */
+export const Unstyled: Story = {
+  render: () => <ToolSearchDemo mode="unstyled" />,
+};
diff --git a/frontend/editor/src/core/components/tools/unlockPdfForms/UnlockPdfFormsSettings.stories.tsx b/frontend/editor/src/core/components/tools/unlockPdfForms/UnlockPdfFormsSettings.stories.tsx
new file mode 100644
index 0000000000..2e88b16eec
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/unlockPdfForms/UnlockPdfFormsSettings.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import UnlockPdfFormsSettings from "@app/components/tools/unlockPdfForms/UnlockPdfFormsSettings";
+import { UnlockPdfFormsParameters } from "@app/hooks/tools/unlockPdfForms/useUnlockPdfFormsParameters";
+
+const defaultParameters: UnlockPdfFormsParameters = {};
+
+const meta = {
+  title: "Tools/UnlockPdfForms/UnlockPdfFormsSettings",
+  component: UnlockPdfFormsSettings,
+} satisfies Meta<typeof UnlockPdfFormsSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: defaultParameters,
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureReportView.stories.tsx b/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureReportView.stories.tsx
new file mode 100644
index 0000000000..1203f3bee1
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureReportView.stories.tsx
@@ -0,0 +1,140 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ValidateSignatureReportView from "@app/components/tools/validateSignature/ValidateSignatureReportView";
+import type {
+  SignatureValidationReportData,
+  SignatureValidationSignature,
+} from "@app/types/validateSignature";
+
+const baseSignature: SignatureValidationSignature = {
+  id: "sig-1",
+  valid: true,
+  chainValid: true,
+  trustValid: true,
+  chainValidationError: null,
+  certPathLength: 2,
+  notExpired: true,
+  coversEntireDocument: true,
+  revocationChecked: true,
+  revocationStatus: "good",
+  validationTimeSource: "signing-time",
+  signerName: "Jane Doe",
+  signatureDate: "2026-05-12T10:30:00Z",
+  reason: "Approved",
+  location: "London, UK",
+  issuerDN: "CN=Example CA, O=Example Corp",
+  subjectDN: "CN=Jane Doe, O=Example Corp",
+  serialNumber: "1A2B3C4D5E",
+  validFrom: "2025-01-01T00:00:00Z",
+  validUntil: "2027-01-01T00:00:00Z",
+  signatureAlgorithm: "SHA256withRSA",
+  keySize: 2048,
+  version: "1",
+  keyUsages: ["digitalSignature", "nonRepudiation"],
+  selfSigned: false,
+  errorMessage: null,
+};
+
+const validData: SignatureValidationReportData = {
+  generatedAt: Date.parse("2026-05-12T11:00:00Z"),
+  entries: [
+    {
+      fileId: "file-1",
+      fileName: "contract.pdf",
+      fileSize: 245_760,
+      lastModified: Date.parse("2026-05-12T10:30:00Z"),
+      thumbnailUrl: null,
+      createdAtLabel: "12 May 2026",
+      signatures: [baseSignature],
+    },
+  ],
+};
+
+const multiSignatureData: SignatureValidationReportData = {
+  generatedAt: Date.parse("2026-05-12T11:00:00Z"),
+  entries: [
+    {
+      fileId: "file-1",
+      fileName: "agreement.pdf",
+      fileSize: 512_000,
+      lastModified: Date.parse("2026-05-12T10:30:00Z"),
+      thumbnailUrl: null,
+      createdAtLabel: "12 May 2026",
+      signatures: [
+        baseSignature,
+        {
+          ...baseSignature,
+          id: "sig-2",
+          signerName: "John Smith",
+          valid: false,
+          chainValid: false,
+          trustValid: false,
+          chainValidationError: "Certificate chain could not be verified",
+          errorMessage: "Untrusted certificate",
+        },
+      ],
+    },
+  ],
+};
+
+const noSignaturesData: SignatureValidationReportData = {
+  generatedAt: Date.parse("2026-05-12T11:00:00Z"),
+  entries: [
+    {
+      fileId: "file-2",
+      fileName: "unsigned-report.pdf",
+      fileSize: 128_000,
+      lastModified: Date.parse("2026-05-12T10:30:00Z"),
+      thumbnailUrl: null,
+      createdAtLabel: "12 May 2026",
+      signatures: [],
+    },
+  ],
+};
+
+const errorData: SignatureValidationReportData = {
+  generatedAt: Date.parse("2026-05-12T11:00:00Z"),
+  entries: [
+    {
+      fileId: "file-3",
+      fileName: "corrupted.pdf",
+      fileSize: 64_000,
+      lastModified: Date.parse("2026-05-12T10:30:00Z"),
+      thumbnailUrl: null,
+      createdAtLabel: "12 May 2026",
+      signatures: [],
+      error: "Unable to parse document signatures",
+    },
+  ],
+};
+
+const meta = {
+  title: "Tools/ValidateSignature/ValidateSignatureReportView",
+  component: ValidateSignatureReportView,
+  parameters: { layout: "padded" },
+  args: {
+    data: validData,
+  },
+} satisfies Meta<typeof ValidateSignatureReportView>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const MultipleSignatures: Story = {
+  args: {
+    data: multiSignatureData,
+  },
+};
+
+export const NoSignatures: Story = {
+  args: {
+    data: noSignaturesData,
+  },
+};
+
+export const Error: Story = {
+  args: {
+    data: errorData,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.stories.tsx b/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.stories.tsx
new file mode 100644
index 0000000000..3d8b1baa1e
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.stories.tsx
@@ -0,0 +1,43 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ValidateSignatureSettings from "@app/components/tools/validateSignature/ValidateSignatureSettings";
+import { ValidateSignatureParameters } from "@app/hooks/tools/validateSignature/useValidateSignatureParameters";
+
+const meta = {
+  title: "Tools/ValidateSignature/ValidateSignatureSettings",
+  component: ValidateSignatureSettings,
+} satisfies Meta<typeof ValidateSignatureSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const buildParameters = (
+  overrides: Partial<ValidateSignatureParameters> = {},
+): ValidateSignatureParameters => ({
+  certFile: null,
+  ...overrides,
+});
+
+export const Default: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+  },
+};
+
+export const WithCertFile: Story = {
+  args: {
+    parameters: buildParameters({
+      certFile: new File(["cert-data"], "trusted-root.crt", {
+        type: "application/x-x509-ca-cert",
+      }),
+    }),
+    onParameterChange: () => {},
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    parameters: buildParameters(),
+    onParameterChange: () => {},
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/validateSignature/reportView/FieldBlock.stories.tsx b/frontend/editor/src/core/components/tools/validateSignature/reportView/FieldBlock.stories.tsx
new file mode 100644
index 0000000000..499b76e393
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/validateSignature/reportView/FieldBlock.stories.tsx
@@ -0,0 +1,21 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FieldBlock from "@app/components/tools/validateSignature/reportView/FieldBlock";
+
+// FieldBlock is a plain function that returns a JSX element (called directly
+// as `FieldBlock(label, value)`), not a React component consumed via JSX
+// props, so every story renders it through a `render` override instead of
+// `args`.
+const meta = {
+  title: "Tools/ValidateSignature/ReportView/FieldBlock",
+} satisfies Meta;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  render: () => FieldBlock("Signer Name", "Jane Doe"),
+};
+
+export const EmptyValue: Story = {
+  render: () => FieldBlock("Reason", ""),
+};
diff --git a/frontend/editor/src/core/components/tools/validateSignature/reportView/FileSummaryHeader.stories.tsx b/frontend/editor/src/core/components/tools/validateSignature/reportView/FileSummaryHeader.stories.tsx
new file mode 100644
index 0000000000..066510a0ef
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/validateSignature/reportView/FileSummaryHeader.stories.tsx
@@ -0,0 +1,34 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FileSummaryHeader from "@app/components/tools/validateSignature/reportView/FileSummaryHeader";
+
+const meta = {
+  title: "Tools/ValidateSignature/ReportView/FileSummaryHeader",
+  component: FileSummaryHeader,
+  args: {
+    fileSize: 2_456_789,
+    createdAt: "2026-01-15T09:30:00Z",
+    totalSignatures: 2,
+    lastSignatureDate: "2026-03-04T14:12:00Z",
+  },
+} satisfies Meta<typeof FileSummaryHeader>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const NoSignatures: Story = {
+  args: {
+    totalSignatures: 0,
+    lastSignatureDate: null,
+  },
+};
+
+export const MissingMetadata: Story = {
+  args: {
+    fileSize: null,
+    createdAt: null,
+    totalSignatures: 1,
+    lastSignatureDate: null,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/validateSignature/reportView/SignatureSection.stories.tsx b/frontend/editor/src/core/components/tools/validateSignature/reportView/SignatureSection.stories.tsx
new file mode 100644
index 0000000000..7c8b8edc1f
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/validateSignature/reportView/SignatureSection.stories.tsx
@@ -0,0 +1,80 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SignatureSection from "@app/components/tools/validateSignature/reportView/SignatureSection";
+import type { SignatureValidationSignature } from "@app/types/validateSignature";
+
+const buildSignature = (
+  overrides: Partial<SignatureValidationSignature> = {},
+): SignatureValidationSignature => ({
+  id: "sig-1",
+  valid: true,
+  chainValid: true,
+  trustValid: true,
+  chainValidationError: null,
+  certPathLength: 2,
+  notExpired: true,
+  coversEntireDocument: true,
+  revocationChecked: true,
+  revocationStatus: "good",
+  validationTimeSource: "signing-time",
+  signerName: "Jane Doe",
+  signatureDate: "2026-06-01T10:00:00Z",
+  reason: "Approved",
+  location: "London, UK",
+  issuerDN: "CN=Example CA, O=Example Corp",
+  subjectDN: "CN=Jane Doe, O=Example Corp",
+  serialNumber: "0x4F2A9C",
+  validFrom: "2025-01-01T00:00:00Z",
+  validUntil: "2027-01-01T00:00:00Z",
+  signatureAlgorithm: "SHA256withRSA",
+  keySize: 2048,
+  version: "3",
+  keyUsages: ["digitalSignature", "nonRepudiation"],
+  selfSigned: false,
+  errorMessage: null,
+  ...overrides,
+});
+
+const meta = {
+  title: "Tools/ValidateSignature/SignatureSection",
+  component: SignatureSection,
+} satisfies Meta<typeof SignatureSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    signature: buildSignature(),
+    index: 0,
+  },
+};
+
+export const InvalidWithError: Story = {
+  args: {
+    signature: buildSignature({
+      valid: false,
+      chainValid: false,
+      trustValid: false,
+      notExpired: false,
+      errorMessage: "Certificate has expired",
+    }),
+    index: 1,
+  },
+};
+
+export const SelfSignedMinimalData: Story = {
+  args: {
+    signature: buildSignature({
+      signerName: "",
+      reason: "",
+      location: "",
+      issuerDN: "",
+      subjectDN: "",
+      serialNumber: "",
+      keySize: null,
+      version: "",
+      keyUsages: [],
+      selfSigned: true,
+    }),
+    index: 2,
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/validateSignature/reportView/SignatureStatusBadge.stories.tsx b/frontend/editor/src/core/components/tools/validateSignature/reportView/SignatureStatusBadge.stories.tsx
new file mode 100644
index 0000000000..aba78f9f2c
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/validateSignature/reportView/SignatureStatusBadge.stories.tsx
@@ -0,0 +1,68 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SignatureStatusBadge from "@app/components/tools/validateSignature/reportView/SignatureStatusBadge";
+import type { SignatureValidationSignature } from "@app/types/validateSignature";
+
+const baseSignature: SignatureValidationSignature = {
+  id: "sig-1",
+  valid: true,
+  chainValid: true,
+  trustValid: true,
+  chainValidationError: null,
+  certPathLength: 2,
+  notExpired: true,
+  coversEntireDocument: true,
+  revocationChecked: true,
+  revocationStatus: "good",
+  validationTimeSource: "signing-time",
+  signerName: "Jane Doe",
+  signatureDate: "2026-06-01T12:00:00Z",
+  reason: "Document approval",
+  location: "London, UK",
+  issuerDN: "CN=Stirling PDF CA",
+  subjectDN: "CN=Jane Doe",
+  serialNumber: "0123456789ABCDEF",
+  validFrom: "2025-01-01T00:00:00Z",
+  validUntil: "2027-01-01T00:00:00Z",
+  signatureAlgorithm: "SHA256withRSA",
+  keySize: 2048,
+  version: "2",
+  keyUsages: ["digitalSignature", "nonRepudiation"],
+  selfSigned: false,
+  errorMessage: null,
+};
+
+const meta = {
+  title: "Tools/ValidateSignature/SignatureStatusBadge",
+  component: SignatureStatusBadge,
+} satisfies Meta<typeof SignatureStatusBadge>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    signature: baseSignature,
+  },
+};
+
+export const UntrustedSigner: Story = {
+  args: {
+    signature: {
+      ...baseSignature,
+      id: "sig-2",
+      trustValid: false,
+      chainValid: false,
+      selfSigned: true,
+    },
+  },
+};
+
+export const Invalid: Story = {
+  args: {
+    signature: {
+      ...baseSignature,
+      id: "sig-3",
+      valid: false,
+      errorMessage: "Signature does not match document contents",
+    },
+  },
+};
diff --git a/frontend/editor/src/core/components/tools/validateSignature/reportView/ThumbnailPreview.stories.tsx b/frontend/editor/src/core/components/tools/validateSignature/reportView/ThumbnailPreview.stories.tsx
new file mode 100644
index 0000000000..feccc477d3
--- /dev/null
+++ b/frontend/editor/src/core/components/tools/validateSignature/reportView/ThumbnailPreview.stories.tsx
@@ -0,0 +1,29 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ThumbnailPreview from "@app/components/tools/validateSignature/reportView/ThumbnailPreview";
+
+const meta = {
+  title: "Tools/ValidateSignature/ReportView/ThumbnailPreview",
+  component: ThumbnailPreview,
+} satisfies Meta<typeof ThumbnailPreview>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const SAMPLE_THUMBNAIL =
+  "data:image/svg+xml;utf8," +
+  encodeURIComponent(
+    '<svg xmlns="http://www.w3.org/2000/svg" width="120" height="160"><rect width="120" height="160" fill="#f0f0f0"/></svg>',
+  );
+
+export const Default: Story = {
+  args: {
+    thumbnailUrl: SAMPLE_THUMBNAIL,
+    fileName: "signed-contract.pdf",
+  },
+};
+
+export const NoThumbnail: Story = {
+  args: {
+    thumbnailUrl: null,
+    fileName: "signed-contract.pdf",
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/AnnotationMenuButtons.stories.tsx b/frontend/editor/src/core/components/viewer/AnnotationMenuButtons.stories.tsx
new file mode 100644
index 0000000000..65f57faa9d
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/AnnotationMenuButtons.stories.tsx
@@ -0,0 +1,73 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  DeleteButton,
+  EditTextButton,
+  AttachCommentButton,
+  CommentButton,
+  LinkButton,
+} from "@app/components/viewer/AnnotationMenuButtons";
+
+// This module has no single default-exported component -- it's a set of small
+// action-icon buttons shared by the annotation menu. Document each separately.
+const meta: Meta = {
+  title: "Viewer/AnnotationMenuButtons",
+  parameters: { layout: "centered" },
+};
+export default meta;
+type Story = StoryObj;
+
+export const Delete: Story = {
+  render: () => <DeleteButton onDelete={() => {}} />,
+};
+
+export const EditText: Story = {
+  render: () => <EditTextButton onEdit={() => {}} />,
+};
+
+export const AttachCommentAdd: Story = {
+  render: () => (
+    <AttachCommentButton
+      isInSidebar={false}
+      onView={() => {}}
+      onAdd={() => {}}
+    />
+  ),
+};
+
+export const AttachCommentView: Story = {
+  render: () => (
+    <AttachCommentButton
+      isInSidebar={true}
+      onView={() => {}}
+      onAdd={() => {}}
+    />
+  ),
+};
+
+export const CommentEmpty: Story = {
+  render: () => <CommentButton hasContent={false} onClick={() => {}} />,
+};
+
+export const CommentWithContent: Story = {
+  render: () => <CommentButton hasContent={true} onClick={() => {}} />,
+};
+
+export const LinkAdd: Story = {
+  render: () => (
+    <LinkButton
+      firstLinkTarget={null}
+      onGoToLink={() => {}}
+      onAddLink={() => {}}
+    />
+  ),
+};
+
+export const LinkGoTo: Story = {
+  render: () => (
+    <LinkButton
+      firstLinkTarget={{ type: "uri", uri: "https://example.com" }}
+      onGoToLink={() => {}}
+      onAddLink={() => {}}
+    />
+  ),
+};
diff --git a/frontend/editor/src/core/components/viewer/AnnotationSelectionMenu.stories.tsx b/frontend/editor/src/core/components/viewer/AnnotationSelectionMenu.stories.tsx
new file mode 100644
index 0000000000..bd9d86f0c6
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/AnnotationSelectionMenu.stories.tsx
@@ -0,0 +1,20 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { AnnotationSelectionMenu } from "@app/components/viewer/AnnotationSelectionMenu";
+
+// AnnotationSelectionMenu reads the active document from ActiveDocumentContext, which
+// defaults to `null` outside of a live EmbedPDF document-manager session (not something the
+// shared preview can stub). With no active document it short-circuits and renders nothing,
+// so this story only exercises that no-active-document mount path without throwing.
+const meta = {
+  title: "Viewer/AnnotationSelectionMenu",
+  component: AnnotationSelectionMenu,
+} satisfies Meta<typeof AnnotationSelectionMenu>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    selected: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/AnnotationTypeButtons.stories.tsx b/frontend/editor/src/core/components/viewer/AnnotationTypeButtons.stories.tsx
new file mode 100644
index 0000000000..860f743a99
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/AnnotationTypeButtons.stories.tsx
@@ -0,0 +1,69 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { AnnotationTypeButtons } from "@app/components/viewer/AnnotationTypeButtons";
+
+const meta = {
+  title: "Viewer/AnnotationTypeButtons",
+  component: AnnotationTypeButtons,
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof AnnotationTypeButtons>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const baseArgs = {
+  annotation: undefined,
+  documentId: "doc-1",
+  pageIndex: 0,
+  annotationId: "annotation-1",
+  menuWidth: 260,
+  obj: undefined,
+  firstLinkTarget: null,
+  hasCommentContent: false,
+  isInSidebar: false,
+  currentColor: "#000000",
+  strokeColor: "#000000",
+  fillColor: "#0000ff",
+  backgroundColor: "#ffffff",
+  textColor: "#000000",
+  currentOpacity: 100,
+  currentWidth: 2,
+  onDelete: () => {},
+  onEdit: () => {},
+  onColorChange: () => {},
+  onOpacityChange: () => {},
+  onWidthChange: () => {},
+  onPropertiesUpdate: () => {},
+  onGoToLink: () => {},
+  onAddLink: () => {},
+  onAddToSidebar: () => {},
+  onViewComment: () => {},
+  onCommentColorChange: () => {},
+};
+
+export const TextMarkup: Story = {
+  args: {
+    ...baseArgs,
+    annotationType: "textMarkup",
+  },
+};
+
+export const Ink: Story = {
+  args: {
+    ...baseArgs,
+    annotationType: "ink",
+  },
+};
+
+export const Comment: Story = {
+  args: {
+    ...baseArgs,
+    annotationType: "comment",
+    hasCommentContent: true,
+  },
+};
+
+export const Shape: Story = {
+  args: {
+    ...baseArgs,
+    annotationType: "shape",
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/CustomSearchLayer.stories.tsx b/frontend/editor/src/core/components/viewer/CustomSearchLayer.stories.tsx
new file mode 100644
index 0000000000..940ceabb47
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/CustomSearchLayer.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { CustomSearchLayer } from "@app/components/viewer/CustomSearchLayer";
+
+// CustomSearchLayer reads its highlight rects from the EmbedPDF search plugin
+// context (useSearch/useDocumentState). Outside a mounted PDFContext.Provider
+// those hooks fall back to their default (empty) state, so the layer renders
+// nothing — this still exercises the component mounting without throwing.
+const meta = {
+  title: "Viewer/CustomSearchLayer",
+  component: CustomSearchLayer,
+} satisfies Meta<typeof CustomSearchLayer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    documentId: "doc-1",
+    pageIndex: 0,
+    scale: 1,
+    highlightColor: "rgba(255, 220, 0, 0.4)",
+    activeHighlightColor: "rgba(255, 140, 0, 0.6)",
+    opacity: 1,
+    padding: 2,
+    borderRadius: 4,
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/DocumentReadyWrapper.stories.tsx b/frontend/editor/src/core/components/viewer/DocumentReadyWrapper.stories.tsx
new file mode 100644
index 0000000000..cb0576dfb2
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/DocumentReadyWrapper.stories.tsx
@@ -0,0 +1,35 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Center, Text } from "@mantine/core";
+import { DocumentReadyWrapper } from "@app/components/viewer/DocumentReadyWrapper";
+
+/**
+ * Outside of a live `<EmbedPDF>` tree the document-manager plugin never
+ * finishes loading, so this always renders its `fallback` — the same state
+ * shown in the real viewer while the PDF engine is still initializing.
+ */
+const meta = {
+  title: "Viewer/DocumentReadyWrapper",
+  component: DocumentReadyWrapper,
+} satisfies Meta<typeof DocumentReadyWrapper>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    fallback: (
+      <Center h="10rem">
+        <Text c="dimmed" size="sm">
+          Loading document…
+        </Text>
+      </Center>
+    ),
+    children: (documentId: string) => <Text>Document ready: {documentId}</Text>,
+  },
+};
+
+export const NoFallback: Story = {
+  args: {
+    children: (documentId: string) => <Text>Document ready: {documentId}</Text>,
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/LinkLayer.stories.tsx b/frontend/editor/src/core/components/viewer/LinkLayer.stories.tsx
new file mode 100644
index 0000000000..376cdca0df
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/LinkLayer.stories.tsx
@@ -0,0 +1,22 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { LinkLayer } from "@app/components/viewer/LinkLayer";
+
+// LinkLayer reads its link annotations from EmbedPDF's react context
+// (useDocumentState/useScroll/useAnnotation). Outside of a live <EmbedPDF>
+// provider those hooks resolve to their documented empty defaults (no
+// annotations, scale 1), so the layer renders null — this still exercises
+// the component's mount path without needing a real PDF engine.
+const meta = {
+  title: "Viewer/LinkLayer",
+  component: LinkLayer,
+} satisfies Meta<typeof LinkLayer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    documentId: "storybook-doc",
+    pageIndex: 0,
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/LocalEmbedPDF.stories.tsx b/frontend/editor/src/core/components/viewer/LocalEmbedPDF.stories.tsx
new file mode 100644
index 0000000000..8880c58afa
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/LocalEmbedPDF.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { LocalEmbedPDF } from "@app/components/viewer/LocalEmbedPDF";
+
+const meta = {
+  title: "Viewer/LocalEmbedPDF",
+  component: LocalEmbedPDF,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof LocalEmbedPDF>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+// No file/url supplied — renders the "No PDF provided" empty state without
+// touching the pdfium engine or blob URL setup.
+export const Empty: Story = {
+  args: {},
+  decorators: [
+    (Story) => (
+      <div style={{ height: "40rem", width: "100%" }}>
+        <Story />
+      </div>
+    ),
+  ],
+};
+
+// A non-PDF file surfaces the "cannot preview" guard instead of attempting to
+// load the pdfium engine.
+export const UnsupportedFile: Story = {
+  args: {
+    file: new File(["not a pdf"], "notes.txt", { type: "text/plain" }),
+  },
+  decorators: [
+    (Story) => (
+      <div style={{ height: "40rem", width: "100%" }}>
+        <Story />
+      </div>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/viewer/NonPdfViewer.stories.tsx b/frontend/editor/src/core/components/viewer/NonPdfViewer.stories.tsx
new file mode 100644
index 0000000000..4f10d49303
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/NonPdfViewer.stories.tsx
@@ -0,0 +1,75 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { ReactElement } from "react";
+import { NonPdfViewer } from "@app/components/viewer/NonPdfViewer";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { NavigationProvider } from "@app/contexts/NavigationContext";
+import { ToolWorkflowProvider } from "@app/contexts/ToolWorkflowContext";
+
+/**
+ * NonPdfViewer reads tool availability (for the "Convert to PDF" action) via
+ * ToolWorkflowContext, which depends on the tool registry, preferences, and
+ * navigation providers being mounted above it.
+ */
+function withProviders(Story: () => ReactElement) {
+  return (
+    <PreferencesProvider>
+      <ToolRegistryProvider>
+        <NavigationProvider>
+          <ToolWorkflowProvider>
+            <Story />
+          </ToolWorkflowProvider>
+        </NavigationProvider>
+      </ToolRegistryProvider>
+    </PreferencesProvider>
+  );
+}
+
+function makeFile(name: string, type: string, contents: string): File {
+  return new File([contents], name, { type });
+}
+
+const meta = {
+  title: "Viewer/NonPdfViewer",
+  component: NonPdfViewer,
+  parameters: { layout: "fullscreen" },
+  decorators: [withProviders],
+} satisfies Meta<typeof NonPdfViewer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** CSV preview: parsed into a scrollable table. */
+export const Csv: Story = {
+  args: {
+    sidebarsVisible: true,
+    setSidebarsVisible: () => {},
+    file: makeFile(
+      "invoice.csv",
+      "text/csv",
+      "Item,Qty,Price\nWidget,3,9.99\nGadget,1,19.99\n",
+    ),
+  },
+};
+
+/** JSON preview: syntax-highlighted / pretty-printed. */
+export const Json: Story = {
+  args: {
+    sidebarsVisible: true,
+    setSidebarsVisible: () => {},
+    file: makeFile(
+      "config.json",
+      "application/json",
+      JSON.stringify({ name: "Stirling PDF", version: 1 }, null, 2),
+    ),
+  },
+};
+
+/** Unsupported file type: falls back to the "Preview not available" state. */
+export const Unsupported: Story = {
+  args: {
+    sidebarsVisible: true,
+    setSidebarsVisible: () => {},
+    file: makeFile("archive.zip", "application/zip", "binary-ish-content"),
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/RedactionPendingTracker.stories.tsx b/frontend/editor/src/core/components/viewer/RedactionPendingTracker.stories.tsx
new file mode 100644
index 0000000000..40062505f8
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/RedactionPendingTracker.stories.tsx
@@ -0,0 +1,16 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { RedactionPendingTracker } from "@app/components/viewer/RedactionPendingTracker";
+
+// RedactionPendingTracker reads the active document from ActiveDocumentContext, which
+// defaults to `null` outside of a live EmbedPDF document-manager session (not something the
+// shared preview can stub). With no active document it short-circuits and renders nothing,
+// so this story only exercises that no-active-document mount path without throwing.
+const meta = {
+  title: "Viewer/RedactionPendingTracker",
+  component: RedactionPendingTracker,
+} satisfies Meta<typeof RedactionPendingTracker>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/core/components/viewer/RedactionSelectionMenu.stories.tsx b/frontend/editor/src/core/components/viewer/RedactionSelectionMenu.stories.tsx
new file mode 100644
index 0000000000..af01665228
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/RedactionSelectionMenu.stories.tsx
@@ -0,0 +1,16 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { RedactionSelectionMenu } from "@app/components/viewer/RedactionSelectionMenu";
+
+// RedactionSelectionMenu renders only when there's an active document ID
+// (ActiveDocumentContext) and a selected redaction annotation from the live
+// EmbedPDF redaction plugin. Neither exists in Storybook, so the component's
+// own guard clause renders nothing here - that's its real empty state.
+const meta = {
+  title: "Viewer/RedactionSelectionMenu",
+  component: RedactionSelectionMenu,
+} satisfies Meta<typeof RedactionSelectionMenu>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/core/components/viewer/SearchInterface.stories.tsx b/frontend/editor/src/core/components/viewer/SearchInterface.stories.tsx
new file mode 100644
index 0000000000..1e1a255465
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/SearchInterface.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SearchInterface } from "@app/components/viewer/SearchInterface";
+
+// SearchInterface reads ViewerContext via useContext with optional chaining
+// throughout, so it renders fine without a ViewerProvider mounted — search
+// state simply resolves to its empty/no-results defaults.
+const meta = {
+  title: "Viewer/SearchInterface",
+  component: SearchInterface,
+} satisfies Meta<typeof SearchInterface>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    visible: true,
+    onClose: () => {},
+  },
+};
+
+export const Hidden: Story = {
+  args: {
+    visible: false,
+    onClose: () => {},
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/SignatureFieldOverlay.stories.tsx b/frontend/editor/src/core/components/viewer/SignatureFieldOverlay.stories.tsx
new file mode 100644
index 0000000000..5dc1e73380
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/SignatureFieldOverlay.stories.tsx
@@ -0,0 +1,22 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SignatureFieldOverlay from "@app/components/viewer/SignatureFieldOverlay";
+
+// With no pdfSource the overlay resolves zero fields and renders null — this
+// is the state it's mounted in until the host viewer has a document loaded.
+const meta = {
+  title: "Viewer/SignatureFieldOverlay",
+  component: SignatureFieldOverlay,
+} satisfies Meta<typeof SignatureFieldOverlay>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    pageIndex: 0,
+    pdfSource: null,
+    documentId: "doc-1",
+    pageWidth: 612,
+    pageHeight: 792,
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/SignaturePlacementOverlay.stories.tsx b/frontend/editor/src/core/components/viewer/SignaturePlacementOverlay.stories.tsx
new file mode 100644
index 0000000000..c6e4551333
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/SignaturePlacementOverlay.stories.tsx
@@ -0,0 +1,94 @@
+import { useEffect, useRef } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SignaturePlacementOverlay } from "@app/components/viewer/SignaturePlacementOverlay";
+import { SignatureProvider } from "@app/contexts/SignatureContext";
+import type { SignParameters } from "@app/hooks/tools/sign/useSignParameters";
+
+const textSignature: SignParameters = {
+  signatureType: "text",
+  signerName: "Jordan Blake",
+  fontFamily: "Helvetica",
+  fontSize: 32,
+  textColor: "#1e293b",
+  textAlign: "left",
+};
+
+// The overlay positions itself relative to containerRef and only paints once a
+// mousemove has been observed inside that element, so the harness supplies a
+// sized, positioned container and fires a synthetic mousemove after mount to
+// simulate the cursor already being over the page.
+function PlacementHarness({
+  signatureConfig,
+}: {
+  signatureConfig: SignParameters | null;
+}) {
+  const containerRef = useRef<HTMLDivElement | null>(null);
+
+  useEffect(() => {
+    const element = containerRef.current;
+    if (!element) return;
+    const rect = element.getBoundingClientRect();
+    element.dispatchEvent(
+      new MouseEvent("mousemove", {
+        clientX: rect.left + rect.width / 2,
+        clientY: rect.top + rect.height / 2,
+        bubbles: true,
+      }),
+    );
+  }, [signatureConfig]);
+
+  return (
+    <div
+      ref={containerRef}
+      style={{
+        position: "relative",
+        width: 480,
+        height: 320,
+        border: "1px dashed var(--mantine-color-gray-4)",
+        background: "var(--mantine-color-gray-0)",
+      }}
+    >
+      <SignaturePlacementOverlay
+        containerRef={containerRef}
+        isActive
+        signatureConfig={signatureConfig}
+      />
+    </div>
+  );
+}
+
+const noopContainerRef = { current: null };
+
+const meta = {
+  title: "Viewer/SignaturePlacementOverlay",
+  component: SignaturePlacementOverlay,
+  // SignaturePlacementOverlay reads useSignature() to report its preview size
+  // back up — that context isn't mounted by the shared preview, so stub it here.
+  decorators: [
+    (Story) => (
+      <SignatureProvider>
+        <Story />
+      </SignatureProvider>
+    ),
+  ],
+  // Stories below override render with PlacementHarness, but Storybook's types
+  // still require args to satisfy the component's required props.
+  args: {
+    containerRef: noopContainerRef,
+    isActive: true,
+    signatureConfig: textSignature,
+  },
+} satisfies Meta<typeof SignaturePlacementOverlay>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Cursor-following preview of a text signature over the page. */
+export const Default: Story = {
+  render: () => <PlacementHarness signatureConfig={textSignature} />,
+};
+
+/** No signature configured yet — the overlay renders nothing. */
+export const NoSignatureConfigured: Story = {
+  render: () => <PlacementHarness signatureConfig={null} />,
+};
diff --git a/frontend/editor/src/core/components/viewer/SignaturePreviewLayer.stories.tsx b/frontend/editor/src/core/components/viewer/SignaturePreviewLayer.stories.tsx
new file mode 100644
index 0000000000..a5580dd505
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/SignaturePreviewLayer.stories.tsx
@@ -0,0 +1,63 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SignaturePreviewLayer } from "@app/components/viewer/SignaturePreviewLayer";
+import type { SignaturePreview } from "@app/components/viewer/viewerTypes";
+
+// A 1x1 transparent PNG — enough to satisfy the <img> src without a real signature asset.
+const PLACEHOLDER_SIGNATURE_DATA =
+  "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=";
+
+const SAMPLE_PREVIEWS: SignaturePreview[] = [
+  {
+    id: "sig-1",
+    pageIndex: 0,
+    x: 0.2,
+    y: 0.6,
+    width: 0.25,
+    height: 0.1,
+    signatureData: PLACEHOLDER_SIGNATURE_DATA,
+    signatureType: "image",
+    participantName: "Jane Doe",
+  },
+];
+
+// SignaturePreviewLayer reads pause/resume from EmbedPDF's interaction-manager
+// react context (useInteractionManagerCapability). Outside a mounted PDFContext
+// provider that hook resolves to its documented empty default (no capability),
+// so drag/resize handlers no-op — this still exercises the component's mount
+// and render path without needing a real PDF engine.
+const meta = {
+  title: "Viewer/SignaturePreviewLayer",
+  component: SignaturePreviewLayer,
+} satisfies Meta<typeof SignaturePreviewLayer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    pageIndex: 0,
+    pageWidth: 600,
+    pageHeight: 800,
+    previews: SAMPLE_PREVIEWS,
+    readOnly: false,
+    placementMode: false,
+    onChange: () => {},
+  },
+};
+
+export const ReadOnly: Story = {
+  args: {
+    ...Default.args,
+    readOnly: true,
+  },
+};
+
+export const PlacementMode: Story = {
+  args: {
+    ...Default.args,
+    previews: [],
+    placementMode: true,
+    placementData: PLACEHOLDER_SIGNATURE_DATA,
+    placementType: "image",
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/StampPlacementOverlay.stories.tsx b/frontend/editor/src/core/components/viewer/StampPlacementOverlay.stories.tsx
new file mode 100644
index 0000000000..e2a7f64fc7
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/StampPlacementOverlay.stories.tsx
@@ -0,0 +1,95 @@
+import { createRef, useEffect, useRef } from "react";
+import type { Meta, StoryObj, Decorator } from "@storybook/react-vite";
+import { StampPlacementOverlay } from "@app/components/viewer/StampPlacementOverlay";
+import { SignatureProvider } from "@app/contexts/SignatureContext";
+import type { SignParameters } from "@app/hooks/tools/sign/useSignParameters";
+
+// StampPlacementOverlay reads/writes SignatureContext (useSignature, for
+// placementPreviewSize), which isn't mounted by the shared preview.
+const withProviders: Decorator = (Story) => (
+  <SignatureProvider>
+    <Story />
+  </SignatureProvider>
+);
+
+const textSignature: SignParameters = {
+  signatureType: "text",
+  signerName: "Jane Doe",
+  fontFamily: "Helvetica",
+  fontSize: 32,
+  textColor: "#1e3a5f",
+  textAlign: "left",
+};
+
+// StampPlacementOverlay tracks the mouse over containerRef and only renders a
+// preview once it has both a built signature image and a cursor position, so
+// the demo dispatches a synthetic mousemove after mount to show it in place.
+function StampPlacementOverlayDemo(
+  props: Partial<React.ComponentProps<typeof StampPlacementOverlay>>,
+) {
+  const containerRef = useRef<HTMLDivElement | null>(null);
+
+  useEffect(() => {
+    const element = containerRef.current;
+    if (!element) return;
+    const rect = element.getBoundingClientRect();
+    element.dispatchEvent(
+      new MouseEvent("mousemove", {
+        clientX: rect.left + rect.width / 2,
+        clientY: rect.top + rect.height / 2,
+        bubbles: true,
+      }),
+    );
+  }, []);
+
+  return (
+    <div
+      ref={containerRef}
+      style={{
+        position: "relative",
+        width: 400,
+        height: 500,
+        background: "#e0e0e0",
+      }}
+    >
+      <StampPlacementOverlay
+        containerRef={containerRef}
+        isActive
+        signatureConfig={textSignature}
+        {...props}
+      />
+    </div>
+  );
+}
+
+const meta = {
+  title: "Viewer/StampPlacementOverlay",
+  component: StampPlacementOverlay,
+  parameters: { layout: "padded" },
+  decorators: [withProviders],
+  // Actual rendering is handled by StampPlacementOverlayDemo's own containerRef;
+  // these are just placeholder values to satisfy the component's required props.
+  args: {
+    containerRef: createRef<HTMLElement | null>(),
+    isActive: true,
+    signatureConfig: textSignature,
+  },
+} satisfies Meta<typeof StampPlacementOverlay>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Active placement mode with a text signature preview following the cursor. */
+export const Default: Story = {
+  render: () => <StampPlacementOverlayDemo />,
+};
+
+/** Inactive placement mode — the overlay renders nothing (returns null). */
+export const Inactive: Story = {
+  render: () => <StampPlacementOverlayDemo isActive={false} />,
+};
+
+/** No signature configured yet — nothing to preview, so it renders nothing. */
+export const NoSignatureConfig: Story = {
+  render: () => <StampPlacementOverlayDemo signatureConfig={null} />,
+};
diff --git a/frontend/editor/src/core/components/viewer/TextSelectionMenu.stories.tsx b/frontend/editor/src/core/components/viewer/TextSelectionMenu.stories.tsx
new file mode 100644
index 0000000000..1321fe7ea8
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/TextSelectionMenu.stories.tsx
@@ -0,0 +1,36 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { SelectionSelectionMenuProps } from "@embedpdf/plugin-selection/react";
+import { TextSelectionMenu } from "@app/components/viewer/TextSelectionMenu";
+
+function baseProps(
+  overrides: Partial<SelectionSelectionMenuProps> = {},
+): SelectionSelectionMenuProps {
+  return {
+    rect: { origin: { x: 0, y: 0 }, size: { width: 120, height: 20 } },
+    menuWrapperProps: { style: {}, ref: () => {} },
+    selected: true,
+    placement: { suggestTop: true },
+    context: { type: "selection", pageIndex: 0 },
+    ...overrides,
+  };
+}
+
+const meta = {
+  title: "Viewer/TextSelectionMenu",
+  component: TextSelectionMenu,
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof TextSelectionMenu>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: baseProps(),
+};
+
+export const BelowSelection: Story = {
+  args: baseProps({ placement: { suggestTop: false } }),
+};
+
+export const NotSelected: Story = {
+  args: baseProps({ selected: false }),
+};
diff --git a/frontend/editor/src/core/components/viewer/nonpdf/CsvViewer.stories.tsx b/frontend/editor/src/core/components/viewer/nonpdf/CsvViewer.stories.tsx
new file mode 100644
index 0000000000..eb88d5f548
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/nonpdf/CsvViewer.stories.tsx
@@ -0,0 +1,48 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { CsvViewer } from "@app/components/viewer/nonpdf/CsvViewer";
+
+const buildCsvFile = (contents: string, name = "data.csv"): File =>
+  new File([contents], name, { type: "text/csv" });
+
+const SAMPLE_CSV = [
+  "Name,Age,City",
+  "Alice,30,New York",
+  "Bob,25,Los Angeles",
+  "Charlie,35,Chicago",
+].join("\n");
+
+const SAMPLE_TSV = [
+  "Name\tAge\tCity",
+  "Alice\t30\tNew York",
+  "Bob\t25\tLos Angeles",
+].join("\n");
+
+const meta = {
+  title: "Viewer/NonPdf/CsvViewer",
+  component: CsvViewer,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof CsvViewer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    file: buildCsvFile(SAMPLE_CSV),
+    isTsv: false,
+  },
+};
+
+export const Tsv: Story = {
+  args: {
+    file: buildCsvFile(SAMPLE_TSV, "data.tsv"),
+    isTsv: true,
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    file: buildCsvFile(""),
+    isTsv: false,
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/nonpdf/HtmlViewer.stories.tsx b/frontend/editor/src/core/components/viewer/nonpdf/HtmlViewer.stories.tsx
new file mode 100644
index 0000000000..173fc38903
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/nonpdf/HtmlViewer.stories.tsx
@@ -0,0 +1,23 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { HtmlViewer } from "@app/components/viewer/nonpdf/HtmlViewer";
+
+const sampleHtmlFile = new File(
+  ["<html><body><h1>Sample document</h1><p>Preview content.</p></body></html>"],
+  "sample.html",
+  { type: "text/html" },
+);
+
+const meta = {
+  title: "Viewer/Nonpdf/HtmlViewer",
+  component: HtmlViewer,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof HtmlViewer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    file: sampleHtmlFile,
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/nonpdf/ImageViewer.stories.tsx b/frontend/editor/src/core/components/viewer/nonpdf/ImageViewer.stories.tsx
new file mode 100644
index 0000000000..53d0329733
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/nonpdf/ImageViewer.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ImageViewer } from "@app/components/viewer/nonpdf/ImageViewer";
+
+// 2x2 red PNG, used so the component's URL.createObjectURL(file) has real image bytes to render.
+const PNG_BASE64 =
+  "iVBORw0KGgoAAAANSUhEUgAAAAIAAAACCAYAAABytg0kAAAAFUlEQVR42mNk+M9QDwAEZ" +
+  "AGvRy0PbwAAAABJRU5ErkJggg==";
+
+function makeImageFile(name: string): File {
+  const bytes = atob(PNG_BASE64);
+  const buffer = new Uint8Array(bytes.length);
+  for (let i = 0; i < bytes.length; i++) {
+    buffer[i] = bytes.charCodeAt(i);
+  }
+  return new File([buffer], name, { type: "image/png" });
+}
+
+const meta = {
+  title: "Viewer/NonPdf/ImageViewer",
+  component: ImageViewer,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof ImageViewer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    file: makeImageFile("sample.png"),
+    fileName: "sample.png",
+  },
+  decorators: [
+    (Story) => (
+      <div style={{ display: "flex", height: "24rem" }}>
+        <Story />
+      </div>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/core/components/viewer/nonpdf/JsonViewer.stories.tsx b/frontend/editor/src/core/components/viewer/nonpdf/JsonViewer.stories.tsx
new file mode 100644
index 0000000000..7261e24ad6
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/nonpdf/JsonViewer.stories.tsx
@@ -0,0 +1,47 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { JsonViewer } from "@app/components/viewer/nonpdf/JsonViewer";
+
+function jsonFile(name: string, contents: string) {
+  return new File([contents], name, { type: "application/json" });
+}
+
+const meta = {
+  title: "Viewer/NonPdf/JsonViewer",
+  component: JsonViewer,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof JsonViewer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    file: jsonFile(
+      "config.json",
+      JSON.stringify(
+        {
+          name: "Stirling PDF",
+          version: "2.0.0",
+          features: ["merge", "split", "compress"],
+          settings: { theme: "dark", locale: "en-US" },
+        },
+        null,
+        2,
+      ),
+    ),
+  },
+  decorators: [
+    (Story) => (
+      <div style={{ height: "24rem", display: "flex" }}>
+        <Story />
+      </div>
+    ),
+  ],
+};
+
+export const InvalidJson: Story = {
+  args: {
+    file: jsonFile("broken.json", "{ this is not valid json "),
+  },
+  decorators: Default.decorators,
+};
diff --git a/frontend/editor/src/core/components/viewer/nonpdf/NonPdfBanner.stories.tsx b/frontend/editor/src/core/components/viewer/nonpdf/NonPdfBanner.stories.tsx
new file mode 100644
index 0000000000..d37267484c
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/nonpdf/NonPdfBanner.stories.tsx
@@ -0,0 +1,30 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { NonPdfBanner } from "@app/components/viewer/nonpdf/NonPdfBanner";
+
+const meta = {
+  title: "Viewer/NonPdf/NonPdfBanner",
+  component: NonPdfBanner,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof NonPdfBanner>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    onConvertToPdf: () => {},
+  },
+  decorators: [
+    (Story) => (
+      <div style={{ position: "relative", height: "6rem" }}>
+        <Story />
+      </div>
+    ),
+  ],
+};
+
+export const Hidden: Story = {
+  args: {
+    onConvertToPdf: undefined,
+  },
+};
diff --git a/frontend/editor/src/core/components/viewer/nonpdf/TextViewer.stories.tsx b/frontend/editor/src/core/components/viewer/nonpdf/TextViewer.stories.tsx
new file mode 100644
index 0000000000..6b006b8327
--- /dev/null
+++ b/frontend/editor/src/core/components/viewer/nonpdf/TextViewer.stories.tsx
@@ -0,0 +1,53 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { TextViewer } from "@app/components/viewer/nonpdf/TextViewer";
+
+const meta = {
+  title: "Viewer/NonPdf/TextViewer",
+  component: TextViewer,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof TextViewer>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+const plainTextFile = new File(
+  [
+    Array.from(
+      { length: 20 },
+      (_, i) => `Line ${i + 1}: the quick brown fox jumps over the lazy dog.`,
+    ).join("\n"),
+  ],
+  "notes.txt",
+  { type: "text/plain" },
+);
+
+const markdownFile = new File(
+  [
+    [
+      "# Sample document",
+      "",
+      "This is a **markdown** file rendered by the text viewer.",
+      "",
+      "- item one",
+      "- item two",
+      "",
+      "> A blockquote for good measure.",
+    ].join("\n"),
+  ],
+  "README.md",
+  { type: "text/markdown" },
+);
+
+export const Default: Story = {
+  args: {
+    file: plainTextFile,
+    isMarkdown: false,
+  },
+};
+
+export const Markdown: Story = {
+  args: {
+    file: markdownFile,
+    isMarkdown: true,
+  },
+};
diff --git a/frontend/editor/src/core/ui/FilePicker.stories.tsx b/frontend/editor/src/core/ui/FilePicker.stories.tsx
new file mode 100644
index 0000000000..53fa1ef2a0
--- /dev/null
+++ b/frontend/editor/src/core/ui/FilePicker.stories.tsx
@@ -0,0 +1,41 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { FilePicker } from "@app/ui/FilePicker";
+
+const meta = {
+  title: "Primitives/FilePicker",
+  component: FilePicker,
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof FilePicker>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    onChange: () => {},
+    children: "Choose file",
+  },
+};
+
+export const AcceptPdf: Story = {
+  args: {
+    onChange: () => {},
+    accept: "application/pdf",
+    children: "Choose PDF",
+  },
+};
+
+export const Multiple: Story = {
+  args: {
+    onChange: () => {},
+    multiple: true,
+    children: "Choose files",
+  },
+};
+
+export const Disabled: Story = {
+  args: {
+    onChange: () => {},
+    disabled: true,
+    children: "Choose file",
+  },
+};
diff --git a/frontend/editor/src/portal/components/AssistantButton.stories.tsx b/frontend/editor/src/portal/components/AssistantButton.stories.tsx
new file mode 100644
index 0000000000..cb6c83c043
--- /dev/null
+++ b/frontend/editor/src/portal/components/AssistantButton.stories.tsx
@@ -0,0 +1,32 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { useEffect } from "react";
+import { AssistantButton } from "@portal/components/AssistantButton";
+import { useUI } from "@portal/contexts/UIContext";
+
+function ForceOpen() {
+  const { openAssistant } = useUI();
+  useEffect(() => {
+    openAssistant();
+  }, [openAssistant]);
+  return null;
+}
+
+const meta: Meta<typeof AssistantButton> = {
+  title: "Portal/Assistant/AssistantButton",
+  component: AssistantButton,
+};
+export default meta;
+type Story = StoryObj<typeof AssistantButton>;
+
+export const Closed: Story = {};
+
+export const Open: Story = {
+  decorators: [
+    (S) => (
+      <>
+        <ForceOpen />
+        <S />
+      </>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/portal/components/BrandMarks.stories.tsx b/frontend/editor/src/portal/components/BrandMarks.stories.tsx
new file mode 100644
index 0000000000..e25fde2b5d
--- /dev/null
+++ b/frontend/editor/src/portal/components/BrandMarks.stories.tsx
@@ -0,0 +1,24 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { BrandMark } from "@portal/components/BrandMarks";
+
+const meta = {
+  title: "Portal/BrandMarks",
+  component: BrandMark,
+  parameters: { layout: "padded" },
+  args: {
+    id: "s3",
+    size: 24,
+  },
+} satisfies Meta<typeof BrandMark>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const CloudProvider: Story = { args: { id: "googledrive" } };
+
+export const Neutral: Story = { args: { id: "sftp" } };
+
+export const UnknownFallback: Story = {
+  args: { id: "some-unrecognised-source" },
+};
diff --git a/frontend/editor/src/portal/components/DownloadEditorModal.stories.tsx b/frontend/editor/src/portal/components/DownloadEditorModal.stories.tsx
new file mode 100644
index 0000000000..6a9166c3b2
--- /dev/null
+++ b/frontend/editor/src/portal/components/DownloadEditorModal.stories.tsx
@@ -0,0 +1,14 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { DownloadEditorModal } from "@portal/components/DownloadEditorModal";
+
+const meta: Meta<typeof DownloadEditorModal> = {
+  title: "Portal/DownloadEditorModal",
+  component: DownloadEditorModal,
+  parameters: { layout: "fullscreen" },
+  args: { open: true, onClose: () => {} },
+};
+export default meta;
+type Story = StoryObj<typeof DownloadEditorModal>;
+
+/** Landing list of desktop + self-hosted install options. */
+export const Open: Story = {};
diff --git a/frontend/editor/src/portal/components/ErrorBoundary.stories.tsx b/frontend/editor/src/portal/components/ErrorBoundary.stories.tsx
new file mode 100644
index 0000000000..a680039046
--- /dev/null
+++ b/frontend/editor/src/portal/components/ErrorBoundary.stories.tsx
@@ -0,0 +1,43 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ErrorBoundary } from "@portal/components/ErrorBoundary";
+
+function Boom(): never {
+  throw new Error("kaboom");
+}
+
+const meta = {
+  title: "Portal/ErrorBoundary",
+  component: ErrorBoundary,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof ErrorBoundary>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** No error: children render straight through. */
+export const Default: Story = {
+  args: {
+    children: <div>Everything is fine.</div>,
+  },
+};
+
+/** A child throws during render; the boundary contains it with the default
+ *  fallback card instead of taking down the rest of the page. */
+export const CaughtError: Story = {
+  args: {
+    children: <Boom />,
+  },
+};
+
+/** A custom fallback receives the boundary's reset function so it can offer
+ *  its own retry affordance. */
+export const CustomFallback: Story = {
+  args: {
+    children: <Boom />,
+    fallback: (reset) => (
+      <div style={{ padding: "2rem" }}>
+        <p>Custom error UI.</p>
+        <button onClick={reset}>Try again</button>
+      </div>
+    ),
+  },
+};
diff --git a/frontend/editor/src/portal/components/HomeGreeting.stories.tsx b/frontend/editor/src/portal/components/HomeGreeting.stories.tsx
new file mode 100644
index 0000000000..e2cca6dbfb
--- /dev/null
+++ b/frontend/editor/src/portal/components/HomeGreeting.stories.tsx
@@ -0,0 +1,12 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { HomeGreeting } from "@portal/components/HomeGreeting";
+
+const meta = {
+  title: "Portal/Home/HomeGreeting",
+  component: HomeGreeting,
+} satisfies Meta<typeof HomeGreeting>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Time-of-day greeting + today's date, shown above the paid-tier home hero. */
+export const Default: Story = {};
diff --git a/frontend/editor/src/portal/components/HomeHero.stories.tsx b/frontend/editor/src/portal/components/HomeHero.stories.tsx
new file mode 100644
index 0000000000..dd1ea07c04
--- /dev/null
+++ b/frontend/editor/src/portal/components/HomeHero.stories.tsx
@@ -0,0 +1,32 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { HomeHero } from "@portal/components/HomeHero";
+
+const meta = {
+  title: "Portal/Home/HomeHero",
+  component: HomeHero,
+  parameters: { layout: "padded" },
+  decorators: [
+    (S) => (
+      <div style={{ maxWidth: "72rem" }}>
+        <S />
+      </div>
+    ),
+  ],
+} satisfies Meta<typeof HomeHero>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Pay-as-you-go tier: welcome header + setup checklist until onboarding completes. */
+export const Default: Story = {
+  args: { tier: "pro" },
+};
+
+/** Free tier renders the same welcome-header composition as pro. */
+export const FreeTier: Story = {
+  args: { tier: "free" },
+};
+
+/** Enterprise tier hides the status chips — the procurement deal hero owns the invite step. */
+export const EnterpriseTier: Story = {
+  args: { tier: "enterprise" },
+};
diff --git a/frontend/editor/src/portal/components/LinkAccountFooterItem.stories.tsx b/frontend/editor/src/portal/components/LinkAccountFooterItem.stories.tsx
new file mode 100644
index 0000000000..b65041164a
--- /dev/null
+++ b/frontend/editor/src/portal/components/LinkAccountFooterItem.stories.tsx
@@ -0,0 +1,21 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { LinkAccountFooterItem } from "@portal/components/LinkAccountFooterItem";
+
+const meta: Meta<typeof LinkAccountFooterItem> = {
+  title: "Portal/LinkAccountFooterItem",
+  component: LinkAccountFooterItem,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Unlinked org — the "Link Stirling account" CTA appears in the sidebar footer. */
+export const Unlinked: Story = {
+  globals: { linkState: "unlinked" },
+};
+
+/** Linked org — the CTA hides itself (renders nothing), since the state is
+ * already communicated elsewhere. */
+export const Linked: Story = {
+  globals: { linkState: "linked-subscribed" },
+};
diff --git a/frontend/editor/src/portal/components/LoginScreen.stories.tsx b/frontend/editor/src/portal/components/LoginScreen.stories.tsx
new file mode 100644
index 0000000000..63db811b71
--- /dev/null
+++ b/frontend/editor/src/portal/components/LoginScreen.stories.tsx
@@ -0,0 +1,12 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { LoginScreen } from "@portal/components/LoginScreen";
+
+const meta: Meta<typeof LoginScreen> = {
+  title: "Portal/LoginScreen",
+  component: LoginScreen,
+  parameters: { layout: "fullscreen" },
+};
+export default meta;
+type Story = StoryObj<typeof LoginScreen>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/portal/components/PortalChrome.stories.tsx b/frontend/editor/src/portal/components/PortalChrome.stories.tsx
new file mode 100644
index 0000000000..b491fee325
--- /dev/null
+++ b/frontend/editor/src/portal/components/PortalChrome.stories.tsx
@@ -0,0 +1,12 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PortalChrome } from "@portal/components/PortalChrome";
+
+const meta = {
+  title: "Portal/Shell/PortalChrome",
+  component: PortalChrome,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof PortalChrome>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/portal/components/account-link/AccountLinkPanel.stories.tsx b/frontend/editor/src/portal/components/account-link/AccountLinkPanel.stories.tsx
new file mode 100644
index 0000000000..99735e657f
--- /dev/null
+++ b/frontend/editor/src/portal/components/account-link/AccountLinkPanel.stories.tsx
@@ -0,0 +1,72 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import { AccountLinkProvider } from "@portal/contexts/AccountLinkContext";
+import { AccountLinkPanel } from "@portal/components/account-link/AccountLinkPanel";
+import { listInstances } from "@portal/mocks/link";
+import "@portal/views/AccountLink.css";
+
+// AccountLinkPanel reads the shared account-link instance from context (the
+// preview only supplies LinkProvider), so wrap it in AccountLinkProvider here.
+const meta: Meta<typeof AccountLinkPanel> = {
+  title: "Portal/AccountLink/AccountLinkPanel",
+  component: AccountLinkPanel,
+  parameters: { layout: "padded" },
+  decorators: [
+    (Story) => (
+      <AccountLinkProvider>
+        <Story />
+      </AccountLinkProvider>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof AccountLinkPanel>;
+
+/**
+ * The Settings account-link surface: the status badge (driven by the Link
+ * toolbar global), the LinkAccountCard for this instance, and — once linked —
+ * the team-wide linked-instances table.
+ */
+export const Default: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/account-link/status", () =>
+          HttpResponse.json({ linked: true, name: "prod-eu-gateway" }),
+        ),
+        http.get("*/api/v1/account-link/instances", () =>
+          HttpResponse.json(listInstances()),
+        ),
+      ],
+    },
+  },
+};
+
+/** Not linked — the instances table is hidden until this instance links its org. */
+export const NotLinked: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/account-link/status", () =>
+          HttpResponse.json({ linked: false, name: null }),
+        ),
+      ],
+    },
+  },
+};
+
+/** Linked, but the signed-in admin isn't the team owner — the instances table fails to load. */
+export const LoadForbidden: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/account-link/status", () =>
+          HttpResponse.json({ linked: true, name: "prod-eu-gateway" }),
+        ),
+        http.get("*/api/v1/account-link/instances", () =>
+          HttpResponse.json({ detail: "Forbidden" }, { status: 403 }),
+        ),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/account-link/LinkAccountModal.stories.tsx b/frontend/editor/src/portal/components/account-link/LinkAccountModal.stories.tsx
new file mode 100644
index 0000000000..8228e3b1bd
--- /dev/null
+++ b/frontend/editor/src/portal/components/account-link/LinkAccountModal.stories.tsx
@@ -0,0 +1,23 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { LinkAccountModal } from "@portal/components/account-link/LinkAccountModal";
+
+const meta: Meta<typeof LinkAccountModal> = {
+  title: "Portal/AccountLink/LinkAccountModal",
+  component: LinkAccountModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    open: true,
+    onClose: () => {},
+    onLinked: async () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof LinkAccountModal>;
+
+/** Default "link" mode — sign in to register this instance against a Stirling account. */
+export const Default: Story = {};
+
+/** "reauth" mode — an already-linked instance's session expired and needs a fresh sign-in. */
+export const Reauth: Story = {
+  args: { mode: "reauth" },
+};
diff --git a/frontend/editor/src/portal/components/account-link/LinkGate.stories.tsx b/frontend/editor/src/portal/components/account-link/LinkGate.stories.tsx
deleted file mode 100644
index 60d9a9962c..0000000000
--- a/frontend/editor/src/portal/components/account-link/LinkGate.stories.tsx
+++ /dev/null
@@ -1,24 +0,0 @@
-import type { Meta, StoryObj } from "@storybook/react-vite";
-import { Card } from "@app/ui";
-import { LinkGate } from "@portal/components/account-link/LinkGate";
-
-const meta: Meta<typeof LinkGate> = {
-  title: "Portal/AccountLink/LinkGate",
-  component: LinkGate,
-  parameters: { layout: "padded" },
-};
-export default meta;
-type Story = StoryObj<typeof LinkGate>;
-
-/**
- * Gating follows the Link toolbar global: "Unlinked" shows the lock prompt,
- * any linked state renders the feature.
- */
-export const Default: Story = {
-  args: {
-    feature: "AI extraction",
-    children: (
-      <Card padding="loose">A billable feature, unlocked once linked.</Card>
-    ),
-  },
-};
diff --git a/frontend/editor/src/portal/components/billing/CardPlaceholder.stories.tsx b/frontend/editor/src/portal/components/billing/CardPlaceholder.stories.tsx
new file mode 100644
index 0000000000..5d035007f9
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/CardPlaceholder.stories.tsx
@@ -0,0 +1,14 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { CardPlaceholder } from "@portal/components/billing/CardPlaceholder";
+import "@portal/components/billing/billing.css";
+
+const meta: Meta<typeof CardPlaceholder> = {
+  title: "Portal/Billing/CardPlaceholder",
+  component: CardPlaceholder,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof CardPlaceholder>;
+
+/** Stand-in card form shown when Stripe isn't mounted (no publishable key / preview). */
+export const Default: Story = {};
diff --git a/frontend/editor/src/portal/components/billing/InvoicesList.stories.tsx b/frontend/editor/src/portal/components/billing/InvoicesList.stories.tsx
new file mode 100644
index 0000000000..90aba9a4fe
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/InvoicesList.stories.tsx
@@ -0,0 +1,77 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import { InvoicesList } from "@portal/components/billing/InvoicesList";
+import type { Invoice } from "@portal/api/billing";
+import "@portal/components/billing/billing.css";
+
+const meta: Meta<typeof InvoicesList> = {
+  title: "Portal/Billing/InvoicesList",
+  component: InvoicesList,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof InvoicesList>;
+
+function invoice(overrides: Partial<Invoice> & { id: string }): Invoice {
+  return {
+    number: null,
+    status: "paid",
+    totalMinor: 4900,
+    currency: "usd",
+    createdAt: "2026-06-01T00:00:00Z",
+    periodStart: "2026-05-01T00:00:00Z",
+    periodEnd: "2026-06-01T00:00:00Z",
+    hostedInvoiceUrl: "https://invoice.stripe.com/i/mock",
+    invoicePdf: "https://invoice.stripe.com/i/mock/pdf",
+    description: "Stirling Processor Plan",
+    pdfsProcessed: 1204,
+    ...overrides,
+  };
+}
+
+const SEVEN_INVOICES: Invoice[] = Array.from({ length: 7 }, (_, i) =>
+  invoice({
+    id: `in_mock_${i}`,
+    number: `INV-${1000 + i}`,
+    status: i === 0 ? "open" : "paid",
+    createdAt: `2026-0${(i % 6) + 1}-01T00:00:00Z`,
+  }),
+);
+
+/** A handful of recent invoices — the common case. */
+export const Default: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("*/api/v1/payg/invoices", () =>
+          HttpResponse.json(SEVEN_INVOICES),
+        ),
+      ],
+    },
+  },
+};
+
+/** No invoices yet — free team or a subscription with no closed cycle. */
+export const Empty: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("*/api/v1/payg/invoices", () => HttpResponse.json([])),
+      ],
+    },
+  },
+};
+
+/** Fetch fails — the inline error message renders instead of the table. */
+export const LoadError: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get(
+          "*/api/v1/payg/invoices",
+          () => new HttpResponse(null, { status: 500 }),
+        ),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.stories.tsx b/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.stories.tsx
new file mode 100644
index 0000000000..a8a3d64d0d
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/PrepaidCapacityCard.stories.tsx
@@ -0,0 +1,43 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PrepaidCapacityCard } from "@portal/components/billing/PrepaidCapacityCard";
+import {
+  subscribedWallet,
+  prepaidWallet,
+} from "@portal/components/billing/walletFixtures";
+import "@portal/components/billing/billing.css";
+
+const meta: Meta<typeof PrepaidCapacityCard> = {
+  title: "Portal/Billing/PrepaidCapacityCard",
+  component: PrepaidCapacityCard,
+  parameters: { layout: "padded" },
+  args: {
+    wallet: subscribedWallet,
+    onBuy: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof PrepaidCapacityCard>;
+
+/** No bundle yet — the "12 months for the price of 10" offer nudge (leader view). */
+export const OfferNudge: Story = {
+  args: {
+    wallet: subscribedWallet,
+  },
+};
+
+/** Bundle held, plenty of capacity left — meter + "Top up" action (leader view). */
+export const BundleHealthy: Story = {
+  args: {
+    wallet: prepaidWallet,
+  },
+};
+
+/** Bundle nearly drawn down — meter crosses into the "Running low" band. */
+export const BundleLow: Story = {
+  args: {
+    wallet: {
+      ...prepaidWallet,
+      prepaidUnitsRemaining: 10_000,
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/billing/PrepayModalHeader.stories.tsx b/frontend/editor/src/portal/components/billing/PrepayModalHeader.stories.tsx
new file mode 100644
index 0000000000..d91d9f754e
--- /dev/null
+++ b/frontend/editor/src/portal/components/billing/PrepayModalHeader.stories.tsx
@@ -0,0 +1,30 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PrepayModalHeader } from "@portal/components/billing/PrepayModalHeader";
+import "@portal/components/billing/billing.css";
+
+const meta: Meta<typeof PrepayModalHeader> = {
+  title: "Portal/Billing/PrepayModalHeader",
+  component: PrepayModalHeader,
+  args: {
+    step: 1,
+    total: 3,
+    title: "Choose an amount",
+    onClose: () => console.log("close"),
+  },
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof PrepayModalHeader>;
+
+/** Prepaid wizard, step 1 of 3 — badge + 3-segment progress bar. */
+export const StepOfThree: Story = {};
+
+/** Metered checkout, step 2 of 2 — badge + 2-segment progress bar. */
+export const StepOfTwo: Story = {
+  args: { step: 2, total: 2, title: "Add a payment method" },
+};
+
+/** No step supplied — badge and progress bar are hidden (e.g. a terminal confirmation screen). */
+export const NoSteps: Story = {
+  args: { step: undefined, title: "You're all set" },
+};
diff --git a/frontend/editor/src/portal/components/infrastructure/AuditTab.stories.tsx b/frontend/editor/src/portal/components/infrastructure/AuditTab.stories.tsx
index 3bb2d6dc3c..3733b2aca9 100644
--- a/frontend/editor/src/portal/components/infrastructure/AuditTab.stories.tsx
+++ b/frontend/editor/src/portal/components/infrastructure/AuditTab.stories.tsx
@@ -42,7 +42,13 @@ export const Empty: Story = {
       handlers: [
         http.get("*/api/v1/proprietary/ui-data/infrastructure/audit-log", () =>
           HttpResponse.json({
-            summary: { totalEvents: 0, processing: 0, elevation: 0, config: 0 },
+            summary: {
+              totalEvents: 0,
+              policy: 0,
+              processing: 0,
+              elevation: 0,
+              config: 0,
+            },
             events: [],
             fullServer: true,
           }),
@@ -74,7 +80,13 @@ export const TeamLeadScoped: Story = {
       handlers: [
         http.get("*/api/v1/proprietary/ui-data/infrastructure/audit-log", () =>
           HttpResponse.json({
-            summary: { totalEvents: 4, processing: 2, elevation: 0, config: 1 },
+            summary: {
+              totalEvents: 4,
+              policy: 0,
+              processing: 2,
+              elevation: 0,
+              config: 1,
+            },
             events: [
               {
                 id: "9102",
diff --git a/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.stories.tsx b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.stories.tsx
new file mode 100644
index 0000000000..d2bd6bc6f2
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelineStepSettings.stories.tsx
@@ -0,0 +1,76 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { ToolRegistry } from "@app/data/toolsTaxonomy";
+import type { WorkingToolStep } from "@app/hooks/tools/shared/toolAutomation";
+import { PipelineStepSettings } from "@portal/components/pipelines/PipelineStepSettings";
+
+/** Stand-in for a tool's real automation settings UI. */
+function MockCompressSettings({
+  parameters,
+  onParameterChange,
+}: {
+  parameters: Record<string, unknown>;
+  onParameterChange: (key: string, value: unknown) => void;
+}) {
+  return (
+    <label>
+      Compression level
+      <input
+        type="number"
+        value={(parameters.level as number) ?? 5}
+        onChange={(e) => onParameterChange("level", Number(e.target.value))}
+      />
+    </label>
+  );
+}
+
+const editableStep = {
+  support: "editable",
+  toolId: "compress",
+  params: { level: 5 },
+} as unknown as WorkingToolStep;
+
+const noSettingsStep = {
+  support: "noSettings",
+  toolId: "flatten",
+  params: {},
+} as unknown as WorkingToolStep;
+
+const unsupportedStep = {
+  support: "unsupported",
+  toolId: "convert",
+  params: {},
+} as unknown as WorkingToolStep;
+
+const registry = {
+  compress: { automationSettings: MockCompressSettings },
+} as unknown as Partial<ToolRegistry>;
+
+const meta = {
+  title: "Portal/Pipelines/PipelineStepSettings",
+  component: PipelineStepSettings,
+  args: {
+    step: editableStep,
+    registry,
+    onChange: () => {},
+  },
+} satisfies Meta<typeof PipelineStepSettings>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** A tool with an editable settings UI, rendered via the tool's own component. */
+export const Editable: Story = {};
+
+/** A migrated tool with no configurable parameters — shows an informational note. */
+export const NoSettings: Story = {
+  args: {
+    step: noSettingsStep,
+  },
+};
+
+/** A tool not yet migrated to the automation mapper seam — shows a fallback warning. */
+export const Unsupported: Story = {
+  args: {
+    step: unsupportedStep,
+    registry: {},
+  },
+};
diff --git a/frontend/editor/src/portal/components/pipelines/PipelinesTable.stories.tsx b/frontend/editor/src/portal/components/pipelines/PipelinesTable.stories.tsx
new file mode 100644
index 0000000000..3f18b8e53f
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/PipelinesTable.stories.tsx
@@ -0,0 +1,43 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { PipelineView } from "@portal/api/pipelines";
+import { PipelinesTable } from "@portal/components/pipelines/PipelinesTable";
+
+const PIPELINES: PipelineView[] = [
+  {
+    id: "pipe-intake",
+    name: "Claims intake",
+    enabled: true,
+    status: "active",
+    trigger: "folder-watch",
+    sources: [{ id: "src-claims", name: "Claims intake" }],
+    steps: ["redact", "sanitize", "watermark"],
+    output: "folder",
+    owner: "jane@stirlingpdf.com",
+  },
+  {
+    id: "pipe-archive",
+    name: "Archive reprocess",
+    enabled: false,
+    status: "paused",
+    trigger: "manual",
+    sources: [],
+    steps: [],
+    output: "inline",
+    owner: "jane@stirlingpdf.com",
+  },
+];
+
+const meta: Meta<typeof PipelinesTable> = {
+  title: "Portal/Pipelines/PipelinesTable",
+  component: PipelinesTable,
+  parameters: { layout: "padded" },
+  args: { pipelines: PIPELINES, onRowClick: () => {} },
+};
+export default meta;
+type Story = StoryObj<typeof PipelinesTable>;
+
+export const Default: Story = {};
+
+export const Empty: Story = {
+  args: { pipelines: [] },
+};
diff --git a/frontend/editor/src/portal/components/pipelines/ToolPicker.stories.tsx b/frontend/editor/src/portal/components/pipelines/ToolPicker.stories.tsx
new file mode 100644
index 0000000000..3035a9b343
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/ToolPicker.stories.tsx
@@ -0,0 +1,70 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SubcategoryId } from "@app/data/toolsTaxonomy";
+import { type ExecutableTool } from "@app/hooks/tools/shared/toolAutomation";
+import { ToolPicker } from "@portal/components/pipelines/ToolPicker";
+
+const tools: ExecutableTool[] = [
+  {
+    toolId: "merge",
+    name: "Merge",
+    icon: "🧩",
+    subcategoryId: SubcategoryId.GENERAL,
+    endpoint: "/api/v1/general/merge-pdfs",
+    support: "noSettings",
+  },
+  {
+    toolId: "split",
+    name: "Split",
+    icon: "✂️",
+    subcategoryId: SubcategoryId.GENERAL,
+    endpoint: "/api/v1/general/split-pages",
+    support: "editable",
+  },
+  {
+    toolId: "watermark",
+    name: "Watermark",
+    icon: "💧",
+    subcategoryId: SubcategoryId.DOCUMENT_SECURITY,
+    endpoint: "/api/v1/security/add-watermark",
+    support: "editable",
+  },
+  {
+    toolId: "removePassword",
+    name: "Remove password",
+    icon: "🔓",
+    subcategoryId: SubcategoryId.DOCUMENT_SECURITY,
+    endpoint: "/api/v1/security/remove-password",
+    support: "editable",
+  },
+  {
+    toolId: "ocr",
+    name: "OCR",
+    icon: "🔍",
+    subcategoryId: SubcategoryId.EXTRACTION,
+    endpoint: "/api/v1/misc/ocr-pdf",
+    support: "editable",
+  },
+];
+
+const meta = {
+  title: "Portal/Pipelines/ToolPicker",
+  component: ToolPicker,
+  parameters: { layout: "padded" },
+  args: {
+    tools,
+    onPick: () => {},
+    onClose: () => {},
+  },
+} satisfies Meta<typeof ToolPicker>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Full tool list grouped by category, as offered when adding a pipeline step. */
+export const Default: Story = {};
+
+/** No tools match the registry (or the search filter), showing the empty state. */
+export const NoMatches: Story = {
+  args: {
+    tools: [],
+  },
+};
diff --git a/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.stories.tsx b/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.stories.tsx
new file mode 100644
index 0000000000..1586f9cc45
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/ClassificationLabelsSection.stories.tsx
@@ -0,0 +1,12 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ClassificationLabelsSection } from "@portal/components/policies/ClassificationLabelsSection";
+
+const meta: Meta<typeof ClassificationLabelsSection> = {
+  title: "Portal/Policies/ClassificationLabelsSection",
+  component: ClassificationLabelsSection,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof ClassificationLabelsSection>;
+
+export const Default: Story = {};
diff --git a/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.stories.tsx b/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.stories.tsx
new file mode 100644
index 0000000000..627be84936
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicyExternalApiConfig.stories.tsx
@@ -0,0 +1,66 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  PolicyExternalApiConfig,
+  type ExternalApiParams,
+} from "@portal/components/policies/PolicyExternalApiConfig";
+import {
+  buildStepParameters,
+  operationById,
+} from "@portal/components/policies/stepOperations";
+
+const meta: Meta<typeof PolicyExternalApiConfig> = {
+  title: "Portal/Policies/PolicyExternalApiConfig",
+  component: PolicyExternalApiConfig,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof PolicyExternalApiConfig>;
+
+const EMPTY_PARAMS: ExternalApiParams = {
+  connectionId: "",
+  path: "",
+  method: "",
+  bodyMode: "",
+  fileFieldName: "",
+  responseMode: "",
+  resultUrlPath: "",
+  resultUrlHeader: "",
+  responseSelect: "",
+  requireTrue: "",
+  fields: "",
+  headers: "",
+  bodyTemplate: "",
+  includeContext: "",
+  includeFile: "",
+  operationId: "",
+  operationValues: "",
+};
+
+/** Keeps the parameters in local state, exercising onChange like the real editor does. */
+function Controlled({ initial }: { initial: ExternalApiParams }) {
+  const [parameters, setParameters] = useState(initial);
+  return (
+    <PolicyExternalApiConfig parameters={parameters} onChange={setParameters} />
+  );
+}
+
+export const OperationPicker: Story = {
+  render: () => <Controlled initial={EMPTY_PARAMS} />,
+};
+
+const slackNotify = operationById("slackNotify")!;
+const slackParams = buildStepParameters(slackNotify, "1", {
+  message: "{{run.policyName}} processed {{document.filename}}",
+});
+
+export const NotifyConfigured: Story = {
+  render: () => <Controlled initial={slackParams} />,
+};
+
+const customApiCall = operationById("customApiCall")!;
+const customParams = buildStepParameters(customApiCall, "", {});
+
+export const CustomApiEscapeHatch: Story = {
+  render: () => <Controlled initial={customParams} />,
+};
diff --git a/frontend/editor/src/portal/components/policies/PolicyPurviewConfig.stories.tsx b/frontend/editor/src/portal/components/policies/PolicyPurviewConfig.stories.tsx
new file mode 100644
index 0000000000..fa1854415d
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicyPurviewConfig.stories.tsx
@@ -0,0 +1,46 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  PolicyPurviewConfig,
+  type PurviewLabelParams,
+} from "@portal/components/policies/PolicyPurviewConfig";
+
+const meta: Meta<typeof PolicyPurviewConfig> = {
+  title: "Portal/Policies/PolicyPurviewConfig",
+  component: PolicyPurviewConfig,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof PolicyPurviewConfig>;
+
+/** Renders the config and keeps its parameters in local state, exercising onChange. */
+function Controlled({ parameters }: { parameters: PurviewLabelParams }) {
+  const [value, setValue] = useState(parameters);
+  return <PolicyPurviewConfig parameters={value} onChange={setValue} />;
+}
+
+export const Empty: Story = {
+  render: () => (
+    <Controlled
+      parameters={{
+        connectionId: "",
+        labelId: "",
+        labelName: "",
+        method: "STANDARD",
+      }}
+    />
+  ),
+};
+
+export const Configured: Story = {
+  render: () => (
+    <Controlled
+      parameters={{
+        connectionId: "2",
+        labelId: "2096f6a2-d2f7-48be-b329-b73aaa526e5d",
+        labelName: "Confidential",
+        method: "PRIVILEGED",
+      }}
+    />
+  ),
+};
diff --git a/frontend/editor/src/portal/components/policies/PolicyPurviewReadConfig.stories.tsx b/frontend/editor/src/portal/components/policies/PolicyPurviewReadConfig.stories.tsx
new file mode 100644
index 0000000000..434fb5f7cb
--- /dev/null
+++ b/frontend/editor/src/portal/components/policies/PolicyPurviewReadConfig.stories.tsx
@@ -0,0 +1,32 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  PolicyPurviewReadConfig,
+  type PurviewReadParams,
+} from "@portal/components/policies/PolicyPurviewReadConfig";
+
+const meta: Meta<typeof PolicyPurviewReadConfig> = {
+  title: "Portal/Policies/PolicyPurviewReadConfig",
+  component: PolicyPurviewReadConfig,
+  parameters: { layout: "padded" },
+  args: {
+    parameters: { connectionId: "" },
+    onChange: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof PolicyPurviewReadConfig>;
+
+/** Renders the config and keeps its parameters in local state, exercising onChange. */
+function Controlled({ parameters }: { parameters: PurviewReadParams }) {
+  const [value, setValue] = useState(parameters);
+  return <PolicyPurviewReadConfig parameters={value} onChange={setValue} />;
+}
+
+export const Empty: Story = {
+  render: () => <Controlled parameters={{ connectionId: "" }} />,
+};
+
+export const ConnectionSelected: Story = {
+  render: () => <Controlled parameters={{ connectionId: "2" }} />,
+};
diff --git a/frontend/editor/src/portal/components/procurement/CalendlyInline.stories.tsx b/frontend/editor/src/portal/components/procurement/CalendlyInline.stories.tsx
new file mode 100644
index 0000000000..dd00672de2
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/CalendlyInline.stories.tsx
@@ -0,0 +1,19 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { CalendlyInline } from "@portal/components/procurement/CalendlyInline";
+import "@portal/views/Procurement.css";
+
+const meta: Meta<typeof CalendlyInline> = {
+  title: "Portal/Procurement/CalendlyInline",
+  component: CalendlyInline,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof CalendlyInline>;
+
+// Calendly's widget.js can't reach the network in Storybook, so this renders the
+// "unable to load" fallback link rather than the live embed.
+export const Default: Story = {};
+
+export const WithPrefilledEmail: Story = {
+  args: { email: "buyer@example.com" },
+};
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementAgreement.stories.tsx b/frontend/editor/src/portal/components/procurement/ProcurementAgreement.stories.tsx
new file mode 100644
index 0000000000..a6ca8dfcf5
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementAgreement.stories.tsx
@@ -0,0 +1,92 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ProcurementAgreement } from "@portal/components/procurement/ProcurementAgreement";
+import type { QuoteResult } from "@portal/api/procurement";
+import "@portal/views/Procurement.css";
+
+const quote: QuoteResult = {
+  quoteId: 488,
+  quoteNumber: "Q-2026-0488",
+  status: "sent",
+  currency: "USD",
+  annualNetMinor: 8_400_000,
+  tcvMinor: 25_200_000,
+  renewalAnnualNetMinor: 8_652_000,
+  cpiRatePct: 3,
+  lineItems: [
+    {
+      key: "platform",
+      label: "Platform subscription",
+      kind: "RECURRING",
+      amountMinor: 6_000_000,
+    },
+    {
+      key: "support",
+      label: "Premium support",
+      kind: "RECURRING",
+      amountMinor: 1_800_000,
+    },
+    {
+      key: "onboarding",
+      label: "Onboarding services",
+      kind: "ONE_TIME",
+      amountMinor: 500_000,
+    },
+    {
+      key: "loyalty",
+      label: "Multi-year loyalty discount",
+      kind: "DISCOUNT",
+      amountMinor: -300_000,
+    },
+    { key: "sso", label: "SSO / SCIM", kind: "INCLUDED", amountMinor: 0 },
+  ],
+  validUntil: "2026-08-15",
+  stripeQuoteId: "qt_1NWnd488",
+  invoiceUrl: null,
+  invoicePdf: null,
+  config: {
+    volume: 500,
+    users: 25,
+    intensity: 4,
+    sizeMult: 1.4,
+    deployment: "cloud",
+    termYears: 3,
+    serviceLevel: "standard",
+    indemnification: true,
+    training: false,
+    qbr: true,
+    businessName: "Northwind Logistics",
+  },
+};
+
+/**
+ * The final agreement (security) step: the combined Master Service Agreement + Order Form + EULA +
+ * DPA, gated behind an "I agree" checkbox before the buyer can accept the quote.
+ */
+const meta: Meta<typeof ProcurementAgreement> = {
+  title: "Portal/Procurement/ProcurementAgreement",
+  component: ProcurementAgreement,
+  parameters: { layout: "padded" },
+  args: {
+    quote,
+    busy: false,
+    downloading: false,
+    onAgree: () => {},
+    onDownload: () => {},
+    onEdit: () => {},
+  },
+};
+export default meta;
+
+type Story = StoryObj<typeof ProcurementAgreement>;
+
+export const Default: Story = {};
+
+// Agreeing: the primary CTA shows its loading state while the accept call is in flight.
+export const Agreeing: Story = {
+  args: { busy: true },
+};
+
+// Downloading: the secondary action shows its loading state instead.
+export const Downloading: Story = {
+  args: { downloading: true },
+};
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementBanner.stories.tsx b/frontend/editor/src/portal/components/procurement/ProcurementBanner.stories.tsx
new file mode 100644
index 0000000000..28e9d2f99a
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementBanner.stories.tsx
@@ -0,0 +1,79 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ProcurementBanner } from "@portal/components/procurement/ProcurementBanner";
+import type { ProcurementController } from "@portal/components/procurement/useProcurement";
+import type { ProcurementSnapshot } from "@portal/api/procurement";
+
+const snapshot: ProcurementSnapshot = {
+  dealId: 1,
+  stage: "trial",
+  deployment: "cloud",
+  seats: 250,
+  trialStartedAt: "2026-06-25T00:00:00Z",
+  trialEndsAt: "2026-07-09T00:00:00Z",
+  trialExtensionsUsed: 0,
+  licensed: false,
+  licenseKey: null,
+  latestQuote: null,
+};
+
+function makeController(
+  overrides: Partial<ProcurementController> = {},
+): ProcurementController {
+  return {
+    isLinked: true,
+    loading: false,
+    data: null,
+    started: false,
+    stage: undefined,
+    latest: null,
+    isIssued: false,
+    isDraft: true,
+    busy: false,
+    downloading: false,
+    downloadingLicense: false,
+    error: null,
+    setError: () => {},
+    open: false,
+    setOpen: () => {},
+    editing: false,
+    setEditing: () => {},
+    extra: null,
+    setExtra: () => {},
+    invoicePdf: null,
+    onStartTrial: () => {},
+    onConfirmSetup: () => {},
+    onExtendTrial: () => {},
+    onReset: () => {},
+    onGenerate: () => {},
+    onAgree: () => {},
+    onDownloadPdf: async () => {},
+    onDownloadOfflineLicense: async () => {},
+    ...overrides,
+  };
+}
+
+/** Deal-status hero once a deal is underway, otherwise the enterprise on-ramp. */
+const meta: Meta<typeof ProcurementBanner> = {
+  title: "Portal/Procurement/ProcurementBanner",
+  component: ProcurementBanner,
+  parameters: { layout: "padded" },
+};
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** No deal yet: the enterprise on-ramp upsell. */
+export const Upsell: Story = {
+  args: { controller: makeController() },
+};
+
+/** A deal is underway: the wired deal-status hero. */
+export const DealUnderway: Story = {
+  args: {
+    controller: makeController({
+      started: true,
+      data: snapshot,
+      stage: snapshot.stage,
+    }),
+  },
+};
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementExtras.stories.tsx b/frontend/editor/src/portal/components/procurement/ProcurementExtras.stories.tsx
new file mode 100644
index 0000000000..06361da844
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementExtras.stories.tsx
@@ -0,0 +1,113 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { ProcurementSnapshot } from "@portal/api/procurement";
+import {
+  LicenseModal,
+  ScheduleCallModal,
+  TrialSetupModal,
+  TrialManageModal,
+} from "@portal/components/procurement/ProcurementExtras";
+import "@portal/views/Procurement.css";
+
+/**
+ * The small centred dialogs that hang off the deal-status hero's quick actions: the licence key,
+ * schedule-a-call, trial setup, and trial management. Grouped in one story file since none is
+ * substantial enough to warrant its own.
+ */
+const meta: Meta = {
+  title: "Portal/Procurement/ProcurementExtras",
+  parameters: { layout: "fullscreen" },
+};
+export default meta;
+
+type Story = StoryObj;
+
+const SNAPSHOT: ProcurementSnapshot = {
+  dealId: 42,
+  stage: "trial",
+  deployment: "cloud",
+  seats: 12,
+  trialStartedAt: "2026-06-15T00:00:00Z",
+  trialEndsAt: "2026-07-29T00:00:00Z",
+  trialExtensionsUsed: 0,
+  licensed: false,
+  licenseKey: null,
+  latestQuote: null,
+};
+
+// Licence key with the offline add-on available.
+export const License: Story = {
+  render: () => (
+    <LicenseModal
+      open
+      onClose={() => {}}
+      licenseKey="MOCK-ENTERPRISE-KEY-0001"
+      offlineAvailable
+      downloadingLicense={false}
+      onDownloadOffline={() => {}}
+    />
+  ),
+};
+
+// Still on the trial licence: warns that the offline file must be re-downloaded once the
+// agreement is in place.
+export const LicenseTrial: Story = {
+  render: () => (
+    <LicenseModal
+      open
+      onClose={() => {}}
+      licenseKey="MOCK-TRIAL-KEY-0001"
+      offlineAvailable
+      downloadingLicense={false}
+      onDownloadOffline={() => {}}
+      trial
+    />
+  ),
+};
+
+// Calendly's widget.js can't reach the network in Storybook, so this renders the
+// "unable to load" fallback link rather than the live embed.
+export const ScheduleCall: Story = {
+  render: () => (
+    <ScheduleCallModal open onClose={() => {}} email="buyer@example.com" />
+  ),
+};
+
+// Deployment + seat count captured before the trial starts.
+export const TrialSetup: Story = {
+  render: () => (
+    <TrialSetupModal
+      open
+      onClose={() => {}}
+      busy={false}
+      onConfirm={() => {}}
+    />
+  ),
+};
+
+// Trial in progress with extensions still available.
+export const TrialManage: Story = {
+  render: () => (
+    <TrialManageModal
+      open
+      onClose={() => {}}
+      snapshot={SNAPSHOT}
+      busy={false}
+      onExtend={() => {}}
+      onCancel={() => {}}
+    />
+  ),
+};
+
+// Both extensions used: the extend action is disabled in favour of a "contact us" message.
+export const TrialManageMaxed: Story = {
+  render: () => (
+    <TrialManageModal
+      open
+      onClose={() => {}}
+      snapshot={{ ...SNAPSHOT, trialExtensionsUsed: 2 }}
+      busy={false}
+      onExtend={() => {}}
+      onCancel={() => {}}
+    />
+  ),
+};
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementFlow.stories.tsx b/frontend/editor/src/portal/components/procurement/ProcurementFlow.stories.tsx
new file mode 100644
index 0000000000..da5777f316
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementFlow.stories.tsx
@@ -0,0 +1,143 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ProcurementFlow } from "@portal/components/procurement/ProcurementFlow";
+import type { ProcurementController } from "@portal/components/procurement/useProcurement";
+import type { ProcurementSnapshot, QuoteResult } from "@portal/api/procurement";
+import "@portal/views/Procurement.css";
+
+const quote: QuoteResult = {
+  quoteId: 488,
+  quoteNumber: "Q-2026-0488",
+  status: "sent",
+  currency: "USD",
+  annualNetMinor: 8_400_000,
+  tcvMinor: 25_200_000,
+  renewalAnnualNetMinor: 8_652_000,
+  cpiRatePct: 3,
+  lineItems: [
+    {
+      key: "platform",
+      label: "Platform subscription",
+      kind: "RECURRING",
+      amountMinor: 6_000_000,
+    },
+    {
+      key: "support",
+      label: "Premium support",
+      kind: "RECURRING",
+      amountMinor: 1_800_000,
+    },
+  ],
+  validUntil: "2026-08-15",
+  stripeQuoteId: "qt_1NWnd488",
+  invoiceUrl: null,
+  invoicePdf: null,
+  config: {
+    volume: 500,
+    users: 25,
+    intensity: 4,
+    sizeMult: 1.4,
+    deployment: "cloud",
+    termYears: 3,
+    serviceLevel: "standard",
+    indemnification: true,
+    training: false,
+    qbr: true,
+    businessName: "Northwind Logistics",
+  },
+};
+
+const snapshot: ProcurementSnapshot = {
+  dealId: 42,
+  stage: "quote",
+  deployment: "cloud",
+  seats: 25,
+  trialStartedAt: "2026-05-01T00:00:00Z",
+  trialEndsAt: "2026-06-01T00:00:00Z",
+  trialExtensionsUsed: 0,
+  licensed: false,
+  licenseKey: null,
+  latestQuote: quote,
+};
+
+/** Builds a fully-populated controller so callers only need to override the fields a story cares about. */
+function makeController(
+  overrides: Partial<ProcurementController> = {},
+): ProcurementController {
+  return {
+    isLinked: true,
+    loading: false,
+    data: snapshot,
+    started: true,
+    stage: snapshot.stage ?? undefined,
+    latest: quote,
+    isIssued: true,
+    isDraft: false,
+    busy: false,
+    downloading: false,
+    downloadingLicense: false,
+    error: null,
+    setError: () => {},
+    open: true,
+    setOpen: () => {},
+    editing: false,
+    setEditing: () => {},
+    extra: null,
+    setExtra: () => {},
+    invoicePdf: null,
+    onStartTrial: () => {},
+    onConfirmSetup: () => {},
+    onExtendTrial: () => {},
+    onReset: () => {},
+    onGenerate: () => {},
+    onAgree: () => {},
+    onDownloadPdf: async () => {},
+    onDownloadOfflineLicense: async () => {},
+    ...overrides,
+  };
+}
+
+/**
+ * The procurement takeover flow: quote & agreement, payment, and live stages, driven by a
+ * plain ProcurementController object (no live backend needed to render each stage).
+ */
+const meta: Meta<typeof ProcurementFlow> = {
+  title: "Portal/Procurement/ProcurementFlow",
+  component: ProcurementFlow,
+  parameters: { layout: "fullscreen" },
+};
+export default meta;
+
+type Story = StoryObj<typeof ProcurementFlow>;
+
+// Quote issued and ready to agree to: the combined quote + agreement step.
+export const Default: Story = {
+  args: { controller: makeController() },
+};
+
+// No linked account yet: the modal shows the "link your account" empty state.
+export const Unlinked: Story = {
+  args: {
+    controller: makeController({
+      isLinked: false,
+      data: null,
+      started: false,
+      stage: undefined,
+      latest: null,
+      isIssued: false,
+      isDraft: true,
+    }),
+  },
+};
+
+// Snapshot still loading: the skeleton placeholder shows instead of a stage.
+export const Loading: Story = {
+  args: {
+    controller: makeController({
+      loading: true,
+      data: null,
+      started: false,
+      stage: undefined,
+      latest: null,
+    }),
+  },
+};
diff --git a/frontend/editor/src/portal/components/procurement/ProcurementStages.stories.tsx b/frontend/editor/src/portal/components/procurement/ProcurementStages.stories.tsx
new file mode 100644
index 0000000000..22cc7b2bc3
--- /dev/null
+++ b/frontend/editor/src/portal/components/procurement/ProcurementStages.stories.tsx
@@ -0,0 +1,77 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import {
+  PaymentStageCard,
+  LiveStageCard,
+  LicensePanel,
+} from "@portal/components/procurement/ProcurementStages";
+import "@portal/views/Procurement.css";
+
+/**
+ * The three small presentational pieces used inside the procurement takeover
+ * modal once a quote exists: the payment step, the live confirmation, and the
+ * licence panel shown alongside them. Grouped in one story file since none is
+ * substantial enough to warrant its own.
+ */
+const meta: Meta = {
+  title: "Portal/Procurement/ProcurementStages",
+  parameters: { layout: "padded" },
+};
+export default meta;
+
+type Story = StoryObj;
+
+// Subscription created: both invoice link and PDF download are offered.
+export const Payment: Story = {
+  render: () => (
+    <PaymentStageCard
+      invoiceUrl="https://billing.example.com/invoices/inv_123"
+      invoicePdf="https://billing.example.com/invoices/inv_123.pdf"
+    />
+  ),
+};
+
+// Invoice not yet issued: no action row renders.
+export const PaymentPending: Story = {
+  render: () => <PaymentStageCard invoiceUrl={null} invoicePdf={null} />,
+};
+
+// Deal is active: terminal confirmation card.
+export const Live: Story = {
+  render: () => <LiveStageCard />,
+};
+
+// Licence key with the offline add-on available.
+export const License: Story = {
+  render: () => (
+    <LicensePanel
+      licenseKey="MOCK-ENTERPRISE-KEY-0001"
+      offlineAvailable
+      downloadingLicense={false}
+      onDownloadOffline={() => {}}
+    />
+  ),
+};
+
+// Offline add-on not purchased: only the copy action is offered.
+export const LicenseOnlineOnly: Story = {
+  render: () => (
+    <LicensePanel
+      licenseKey="MOCK-ENTERPRISE-KEY-0001"
+      offlineAvailable={false}
+      downloadingLicense={false}
+      onDownloadOffline={() => {}}
+    />
+  ),
+};
+
+// Offline licence file is being generated.
+export const LicenseDownloading: Story = {
+  render: () => (
+    <LicensePanel
+      licenseKey="MOCK-ENTERPRISE-KEY-0001"
+      offlineAvailable
+      downloadingLicense
+      onDownloadOffline={() => {}}
+    />
+  ),
+};
diff --git a/frontend/editor/src/portal/components/sources/ConnectionForm.stories.tsx b/frontend/editor/src/portal/components/sources/ConnectionForm.stories.tsx
new file mode 100644
index 0000000000..c5a9e69cac
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionForm.stories.tsx
@@ -0,0 +1,52 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ConnectionForm } from "@portal/components/sources/ConnectionForm";
+import {
+  CREATABLE_CONNECTION_TYPES,
+  emptyConnectionValues,
+} from "@portal/components/sources/connectionTypes";
+
+const s3Type = CREATABLE_CONNECTION_TYPES.find((type) => type.id === "s3")!;
+const apiType = CREATABLE_CONNECTION_TYPES.find((type) => type.id === "api")!;
+const purviewType = CREATABLE_CONNECTION_TYPES.find(
+  (type) => type.id === "purview",
+)!;
+
+const meta = {
+  title: "Portal/Sources/ConnectionForm",
+  component: ConnectionForm,
+  parameters: { layout: "padded" },
+  args: {
+    type: s3Type,
+    values: emptyConnectionValues(s3Type),
+    onChange: () => {},
+  },
+} satisfies Meta<typeof ConnectionForm>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+// The custom API preset exercises `visibleWhen`: picking a select value reveals extra fields
+// (username/password for BASIC auth) that stay hidden for the other auth types.
+export const ConditionalFieldsRevealed: Story = {
+  args: {
+    type: apiType,
+    values: {
+      ...emptyConnectionValues(apiType),
+      name: "Internal API",
+      authType: "BASIC",
+    },
+  },
+};
+
+// A partially filled preset, showing helper text and required-field markers together.
+export const Filled: Story = {
+  args: {
+    type: purviewType,
+    values: {
+      ...emptyConnectionValues(purviewType),
+      name: "Purview",
+      tenantId: "00000000-0000-0000-0000-000000000000",
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/sources/ConnectionModal.stories.tsx b/frontend/editor/src/portal/components/sources/ConnectionModal.stories.tsx
new file mode 100644
index 0000000000..e901a1ec55
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionModal.stories.tsx
@@ -0,0 +1,51 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { IntegrationConfig } from "@portal/api/integrations";
+import { ConnectionModal } from "@portal/components/sources/ConnectionModal";
+
+const EDIT_CONNECTION: IntegrationConfig = {
+  id: 1,
+  integrationType: "S3",
+  name: "Claims intake bucket",
+  scope: "TEAM",
+  ownerUserId: null,
+  ownerTeamId: 1,
+  enabled: true,
+  locked: false,
+  defaultAccess: "EXPLICIT_ONLY",
+  config: {
+    bucket: "acme-claims-inbox",
+    region: "eu-west-2",
+    accessKeyId: "AKIAIOSFODNN7EXAMPLE",
+    secretAccessKey: "********",
+  },
+  canManage: true,
+  createdAt: "2026-07-02T09:12:00",
+  updatedAt: "2026-07-02T09:12:00",
+};
+
+const meta: Meta<typeof ConnectionModal> = {
+  title: "Portal/Sources/ConnectionModal",
+  component: ConnectionModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    open: true,
+    capabilities: { customApi: true },
+    onClose: () => {},
+    onSaved: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof ConnectionModal>;
+
+/** Creating a new connection starts on the type picker, grouped by category. */
+export const Picker: Story = {};
+
+/** A pinned slot (e.g. the S3 field on a source) skips the picker and goes straight to the form. */
+export const FixedType: Story = {
+  args: { fixedTypeId: "s3" },
+};
+
+/** Editing a stored connection reuses the form of the preset it was created from. */
+export const Edit: Story = {
+  args: { connection: EDIT_CONNECTION },
+};
diff --git a/frontend/editor/src/portal/components/sources/ConnectionPicker.stories.tsx b/frontend/editor/src/portal/components/sources/ConnectionPicker.stories.tsx
new file mode 100644
index 0000000000..712ec1f4f6
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionPicker.stories.tsx
@@ -0,0 +1,55 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import { ConnectionPicker } from "@portal/components/sources/ConnectionPicker";
+
+const meta: Meta<typeof ConnectionPicker> = {
+  title: "Portal/Sources/ConnectionPicker",
+  component: ConnectionPicker,
+  parameters: { layout: "padded" },
+  args: {
+    value: "",
+    onChange: () => {},
+    integrationType: "S3",
+    createTypeId: "s3",
+  },
+};
+export default meta;
+type Story = StoryObj<typeof ConnectionPicker>;
+
+/** Filtered to S3 connections; the global mock data has one bucket to pick. */
+export const Default: Story = {};
+
+/** A preset-scoped slot (e.g. a Jira step): only Jira connections and the free-form
+ * custom API connection are offered, since the latter can point anywhere. */
+export const PresetScoped: Story = {
+  args: {
+    integrationType: "API",
+    createTypeId: "api",
+    presetId: "jira",
+  },
+};
+
+/** Embedded inside a host modal (e.g. the source builder), which offers its own
+ * create surface instead of stacking the shared connection modal on top. */
+export const DelegatedCreate: Story = {
+  args: {
+    onCreateNew: () => {},
+  },
+};
+
+/** The connections list fails to load; the picker still renders empty with an
+ * inline error banner rather than blocking the field. */
+export const LoadError: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("*/api/v1/integrations", () =>
+          HttpResponse.json(
+            { detail: "Could not reach the backend" },
+            { status: 500 },
+          ),
+        ),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/components/sources/ConnectionTypePicker.stories.tsx b/frontend/editor/src/portal/components/sources/ConnectionTypePicker.stories.tsx
new file mode 100644
index 0000000000..9f7a87d62c
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/ConnectionTypePicker.stories.tsx
@@ -0,0 +1,28 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ConnectionTypePicker } from "@portal/components/sources/ConnectionTypePicker";
+import {
+  CREATABLE_CONNECTION_TYPES,
+  presetConnectionTypes,
+} from "@portal/components/sources/connectionTypes";
+
+const meta = {
+  title: "Portal/Sources/ConnectionTypePicker",
+  component: ConnectionTypePicker,
+  parameters: { layout: "padded" },
+  args: {
+    types: presetConnectionTypes(),
+    onPick: () => {},
+  },
+} satisfies Meta<typeof ConnectionTypePicker>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const IncludingCustomApi: Story = {
+  args: { types: CREATABLE_CONNECTION_TYPES },
+};
+
+export const NoResults: Story = {
+  args: { types: [] },
+};
diff --git a/frontend/editor/src/portal/components/sources/S3ConnectionPicker.stories.tsx b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.stories.tsx
new file mode 100644
index 0000000000..2cca577460
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/S3ConnectionPicker.stories.tsx
@@ -0,0 +1,18 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { S3ConnectionPicker } from "@portal/components/sources/S3ConnectionPicker";
+
+const meta = {
+  title: "Portal/Sources/S3ConnectionPicker",
+  component: S3ConnectionPicker,
+  parameters: { layout: "padded" },
+  args: {
+    value: "",
+    onChange: () => {},
+  },
+} satisfies Meta<typeof S3ConnectionPicker>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Selected: Story = { args: { value: "1" } };
diff --git a/frontend/editor/src/portal/components/sources/SourceModal.stories.tsx b/frontend/editor/src/portal/components/sources/SourceModal.stories.tsx
new file mode 100644
index 0000000000..b71d689442
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/SourceModal.stories.tsx
@@ -0,0 +1,39 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { SourceModal } from "@portal/components/sources/SourceModal";
+
+// SourceModal calls useQueryClient() to invalidate source queries after a save;
+// the global preview doesn't set up react-query, so provide a client here.
+const queryClient = new QueryClient();
+
+const meta: Meta<typeof SourceModal> = {
+  title: "Portal/Sources/SourceModal",
+  component: SourceModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    open: true,
+    onClose: () => {},
+  },
+  decorators: [
+    (Story) => (
+      <QueryClientProvider client={queryClient}>
+        <Story />
+      </QueryClientProvider>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof SourceModal>;
+
+/** No `sourceId`: the connector catalogue (including greyed-out coming-soon entries). */
+export const ChooseType: Story = {};
+
+/** A `folder` source: the configure stage, seeded from the mocked record. */
+export const EditFolder: Story = {
+  args: { sourceId: "src-claims" },
+};
+
+/** A `webhook` source: configure stage plus the delivery-URL row (secret stays masked). */
+export const EditWebhook: Story = {
+  args: { sourceId: "src-webhook" },
+};
diff --git a/frontend/editor/src/portal/components/sources/SourceTypeIcon.stories.tsx b/frontend/editor/src/portal/components/sources/SourceTypeIcon.stories.tsx
new file mode 100644
index 0000000000..ea136cb143
--- /dev/null
+++ b/frontend/editor/src/portal/components/sources/SourceTypeIcon.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SourceTypeIcon } from "@portal/components/sources/SourceTypeIcon";
+
+const meta: Meta<typeof SourceTypeIcon> = {
+  title: "Portal/Sources/SourceTypeIcon",
+  component: SourceTypeIcon,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof SourceTypeIcon>;
+
+export const Folder: Story = {
+  args: { type: "folder" },
+};
+
+export const S3: Story = {
+  args: { type: "s3" },
+};
+
+export const Editor: Story = {
+  args: { type: "editor" },
+};
+
+/** Unknown source types fall back to the neutral document glyph. */
+export const Unknown: Story = {
+  args: { type: "unrecognised" },
+};
diff --git a/frontend/editor/src/portal/components/users/PendingInvitations.stories.tsx b/frontend/editor/src/portal/components/users/PendingInvitations.stories.tsx
new file mode 100644
index 0000000000..fa5d44e8bd
--- /dev/null
+++ b/frontend/editor/src/portal/components/users/PendingInvitations.stories.tsx
@@ -0,0 +1,56 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PendingInvitations } from "@portal/components/users/PendingInvitations";
+import type { PendingInvitation } from "@portal/api/users";
+
+const INVITATIONS: PendingInvitation[] = [
+  {
+    id: 1,
+    email: "priya@stirlingpdf.com",
+    invitedBy: "tom@stirlingpdf.com",
+    expiresAt: new Date(Date.now() + 3 * 86400000).toISOString(),
+  },
+  {
+    id: 2,
+    email: "lars@stirlingpdf.com",
+    invitedBy: "dana@stirlingpdf.com",
+    expiresAt: new Date(Date.now() + 86400000).toISOString(),
+  },
+  {
+    id: 3,
+    email: "legal@meridian-partners.com",
+  },
+];
+
+const meta: Meta<typeof PendingInvitations> = {
+  title: "Portal/Users/PendingInvitations",
+  component: PendingInvitations,
+  parameters: { layout: "padded" },
+  args: {
+    invitations: INVITATIONS,
+    onCancel: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof PendingInvitations>;
+
+/** A mix of invites: one expiring today, one expiring soon, one with no expiry. */
+export const Default: Story = {};
+
+/** Single invite, expiring today. */
+export const ExpiresToday: Story = {
+  args: {
+    invitations: [
+      {
+        id: 1,
+        email: "priya@stirlingpdf.com",
+        invitedBy: "tom@stirlingpdf.com",
+        expiresAt: new Date(Date.now() + 3 * 3600000).toISOString(),
+      },
+    ],
+  },
+};
+
+/** No pending invites: header still renders with a zero count. */
+export const Empty: Story = {
+  args: { invitations: [] },
+};
diff --git a/frontend/editor/src/portal/views/Integrations.stories.tsx b/frontend/editor/src/portal/views/Integrations.stories.tsx
new file mode 100644
index 0000000000..f25c355c53
--- /dev/null
+++ b/frontend/editor/src/portal/views/Integrations.stories.tsx
@@ -0,0 +1,28 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import { Integrations } from "@portal/views/Integrations";
+
+const meta: Meta<typeof Integrations> = {
+  title: "Portal/Views/Integrations",
+  component: Integrations,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof Integrations>;
+
+/** Seeded mock data: connected vendors (expandable groups) plus the available catalogue. */
+export const Default: Story = {};
+
+/**
+ * No stored connections yet. Only the "Available" catalogue and coming-soon
+ * source connectors are left to show.
+ */
+export const NoConnections: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("*/api/v1/integrations", () => HttpResponse.json([])),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.stories.tsx b/frontend/editor/src/portal/views/PipelineBuilder.stories.tsx
new file mode 100644
index 0000000000..95d2987e52
--- /dev/null
+++ b/frontend/editor/src/portal/views/PipelineBuilder.stories.tsx
@@ -0,0 +1,47 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Route, Routes } from "react-router-dom";
+import { ToolRegistryProvider } from "@app/contexts/ToolRegistryProvider";
+import { PipelineBuilder } from "@portal/views/PipelineBuilder";
+
+/**
+ * Renders the builder at a specific path so its `:id` route param resolves the
+ * same way it does in the app, without nesting a second Router inside the
+ * preview's MemoryRouter.
+ */
+function withRoute(path: string) {
+  return function RouteDecorator(Story: () => React.ReactElement) {
+    return (
+      <Routes location={path}>
+        <Route path="/processor/pipelines/new" element={<Story />} />
+        <Route path="/processor/pipelines/:id" element={<Story />} />
+      </Routes>
+    );
+  };
+}
+
+const meta: Meta<typeof PipelineBuilder> = {
+  title: "Portal/Views/PipelineBuilder",
+  component: PipelineBuilder,
+  parameters: { layout: "padded" },
+  // The builder reads the tool registry (for step labels + settings UIs), so
+  // it needs this provider to render at all.
+  decorators: [
+    (Story) => (
+      <ToolRegistryProvider>
+        <Story />
+      </ToolRegistryProvider>
+    ),
+  ],
+};
+export default meta;
+type Story = StoryObj<typeof PipelineBuilder>;
+
+/** A new, unsaved pipeline: empty operation chain, no sources selected yet. */
+export const Default: Story = {
+  decorators: [withRoute("/processor/pipelines/new")],
+};
+
+/** Editing a seeded pipeline: pre-filled name, sources, trigger and steps. */
+export const Edit: Story = {
+  decorators: [withRoute("/processor/pipelines/plc-redaction")],
+};
diff --git a/frontend/editor/src/proprietary/auth/ui/AuthShell.stories.tsx b/frontend/editor/src/proprietary/auth/ui/AuthShell.stories.tsx
new file mode 100644
index 0000000000..b5abb76c96
--- /dev/null
+++ b/frontend/editor/src/proprietary/auth/ui/AuthShell.stories.tsx
@@ -0,0 +1,58 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { AuthShell } from "@app/auth/ui/AuthShell";
+
+/**
+ * The login card shell shared by the editor and the portal: a centered card
+ * that expands to two columns (form + right panel) on wide/tall viewports.
+ */
+const meta = {
+  title: "Auth/Auth Shell",
+  component: AuthShell,
+  parameters: { layout: "fullscreen" },
+} satisfies Meta<typeof AuthShell>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    children: (
+      <div>
+        <h2>Sign in</h2>
+        <p>Enter your credentials to continue.</p>
+      </div>
+    ),
+  },
+};
+
+export const WithRightPanel: Story = {
+  args: {
+    children: (
+      <div>
+        <div>
+          <h2>Sign in</h2>
+          <p>Enter your credentials to continue.</p>
+        </div>
+        <div style={{ padding: "2rem" }}>
+          <h3>Why Stirling PDF?</h3>
+          <p>Fast, secure, self-hostable PDF tooling.</p>
+        </div>
+      </div>
+    ),
+  },
+};
+
+export const WithFooter: Story = {
+  args: {
+    children: (
+      <div>
+        <h2>Sign in</h2>
+        <p>Enter your credentials to continue.</p>
+      </div>
+    ),
+    footer: (
+      <div style={{ padding: "0.5rem", textAlign: "center" }}>
+        © Stirling PDF
+      </div>
+    ),
+  },
+};
diff --git a/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.stories.tsx b/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.stories.tsx
new file mode 100644
index 0000000000..84e085725d
--- /dev/null
+++ b/frontend/editor/src/proprietary/auth/ui/EmailPasswordForm.stories.tsx
@@ -0,0 +1,70 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react";
+import EmailPasswordForm from "@app/auth/ui/EmailPasswordForm";
+import "@app/auth/ui/auth.css";
+
+/**
+ * The email/password/MFA fields shared by the login and signup auth forms
+ */
+const meta: Meta<typeof EmailPasswordForm> = {
+  title: "Auth/Email Password Form",
+  component: EmailPasswordForm,
+  parameters: { layout: "centered" },
+  render: (args) => {
+    const [email, setEmail] = useState(args.email);
+    const [password, setPassword] = useState(args.password);
+    const [mfaCode, setMfaCode] = useState(args.mfaCode ?? "");
+    return (
+      <div style={{ width: 320 }}>
+        <EmailPasswordForm
+          {...args}
+          email={email}
+          setEmail={setEmail}
+          password={password}
+          setPassword={setPassword}
+          mfaCode={mfaCode}
+          setMfaCode={setMfaCode}
+        />
+      </div>
+    );
+  },
+  args: {
+    email: "",
+    password: "",
+    setEmail: () => {},
+    setPassword: () => {},
+    onSubmit: () => {},
+    isSubmitting: false,
+    submitButtonText: "Sign in",
+  },
+};
+export default meta;
+type Story = StoryObj<typeof EmailPasswordForm>;
+
+export const Default: Story = {};
+
+export const WithMfa: Story = {
+  args: {
+    showMfaField: true,
+    requiresMfa: true,
+    email: "user@example.com",
+    password: "hunter2",
+  },
+};
+
+export const WithErrors: Story = {
+  args: {
+    fieldErrors: {
+      email: "Enter a valid email address.",
+      password: "Password is required.",
+    },
+  },
+};
+
+export const Submitting: Story = {
+  args: {
+    email: "user@example.com",
+    password: "hunter2",
+    isSubmitting: true,
+  },
+};
diff --git a/frontend/editor/src/proprietary/auth/ui/ErrorMessage.stories.tsx b/frontend/editor/src/proprietary/auth/ui/ErrorMessage.stories.tsx
new file mode 100644
index 0000000000..9647417990
--- /dev/null
+++ b/frontend/editor/src/proprietary/auth/ui/ErrorMessage.stories.tsx
@@ -0,0 +1,32 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import ErrorMessage from "@app/auth/ui/ErrorMessage";
+import "@app/auth/ui/auth.css";
+
+/**
+ * The inline error banner the auth forms render when a submission fails
+ */
+const meta: Meta<typeof ErrorMessage> = {
+  title: "Auth/Error Message",
+  component: ErrorMessage,
+  parameters: { layout: "centered" },
+  args: {
+    error: "Invalid email or password.",
+  },
+};
+export default meta;
+type Story = StoryObj<typeof ErrorMessage>;
+
+export const Default: Story = {};
+
+export const LongMessage: Story = {
+  args: {
+    error:
+      "We couldn't sign you in because your account has been temporarily locked after too many failed attempts. Please try again in a few minutes.",
+  },
+};
+
+export const Empty: Story = {
+  args: {
+    error: null,
+  },
+};
diff --git a/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.stories.tsx b/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.stories.tsx
new file mode 100644
index 0000000000..270c60c3aa
--- /dev/null
+++ b/frontend/editor/src/proprietary/auth/ui/SpringLoginForm.stories.tsx
@@ -0,0 +1,99 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import SpringLoginForm from "@app/auth/ui/SpringLoginForm";
+import type { SpringLoginState } from "@app/auth/ui/useSpringLogin";
+import loginHeader from "@app/assets/brand/modern-logo/LoginLightModeHeader.svg";
+import "@app/auth/ui/auth.css";
+
+/** Builds a mock useSpringLogin() state; stories override just the fields they need. */
+function mockState(
+  overrides: Partial<SpringLoginState> = {},
+): SpringLoginState {
+  return {
+    email: "",
+    setEmail: () => {},
+    password: "",
+    setPassword: () => {},
+    mfaCode: "",
+    setMfaCode: () => {},
+    requiresMfa: false,
+    error: null,
+    setError: () => {},
+    isSubmitting: false,
+    providers: [],
+    loginMethod: "all",
+    isUserPassAllowed: true,
+    hasProviders: false,
+    signInWithEmail: async () => {},
+    signInWithProvider: async () => {},
+    ...overrides,
+  };
+}
+
+/**
+ * The shared Spring login form body: logo, error, OAuth buttons, divider, and
+ * the email/password form. Rendered by both the editor and the portal inside
+ * their own auth shells.
+ */
+const meta = {
+  title: "Auth/Spring Login Form",
+  component: SpringLoginForm,
+  parameters: { layout: "centered" },
+  args: {
+    state: mockState(),
+    logoSrc: loginHeader,
+    logoAlt: "Stirling PDF",
+  },
+} satisfies Meta<typeof SpringLoginForm>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  render: (args) => (
+    <div style={{ width: 360 }}>
+      <SpringLoginForm {...args} />
+    </div>
+  ),
+};
+
+export const WithOAuthProviders: Story = {
+  args: {
+    state: mockState({
+      providers: ["google", "github"],
+      hasProviders: true,
+    }),
+  },
+  render: (args) => (
+    <div style={{ width: 360 }}>
+      <SpringLoginForm {...args} />
+    </div>
+  ),
+};
+
+export const WithError: Story = {
+  args: {
+    state: mockState({
+      email: "user@example.com",
+      error: "Invalid email or password.",
+    }),
+  },
+  render: (args) => (
+    <div style={{ width: 360 }}>
+      <SpringLoginForm {...args} />
+    </div>
+  ),
+};
+
+export const RequiresMfa: Story = {
+  args: {
+    state: mockState({
+      email: "user@example.com",
+      requiresMfa: true,
+    }),
+  },
+  render: (args) => (
+    <div style={{ width: 360 }}>
+      <SpringLoginForm {...args} />
+    </div>
+  ),
+};
diff --git a/frontend/editor/src/proprietary/auth/ui/SupabaseLoginForm.stories.tsx b/frontend/editor/src/proprietary/auth/ui/SupabaseLoginForm.stories.tsx
new file mode 100644
index 0000000000..9f24d2f971
--- /dev/null
+++ b/frontend/editor/src/proprietary/auth/ui/SupabaseLoginForm.stories.tsx
@@ -0,0 +1,66 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import SupabaseLoginForm from "@app/auth/ui/SupabaseLoginForm";
+import type { SupabaseLoginState } from "@app/auth/ui/useSupabaseLogin";
+import "@app/auth/ui/auth.css";
+
+/**
+ * Login form combining SSO buttons and email/password, driven by a
+ * {@link SupabaseLoginState} from useSupabaseLogin.
+ */
+const meta: Meta<typeof SupabaseLoginForm> = {
+  title: "Auth/Supabase Login Form",
+  component: SupabaseLoginForm,
+  parameters: { layout: "centered" },
+};
+export default meta;
+type Story = StoryObj<typeof SupabaseLoginForm>;
+
+function makeState(
+  overrides: Partial<SupabaseLoginState> = {},
+): SupabaseLoginState {
+  return {
+    email: "",
+    setEmail: () => {},
+    password: "",
+    setPassword: () => {},
+    error: null,
+    setError: () => {},
+    isSubmitting: false,
+    providers: ["google", "github"],
+    hasProviders: true,
+    signInWithEmail: async () => {},
+    signInWithProvider: async () => {},
+    ...overrides,
+  };
+}
+
+export const Default: Story = {
+  args: {
+    state: makeState(),
+  },
+};
+
+export const NoProviders: Story = {
+  args: {
+    state: makeState({ providers: [], hasProviders: false }),
+  },
+};
+
+export const WithError: Story = {
+  args: {
+    state: makeState({
+      email: "user@example.com",
+      error: "Invalid email or password.",
+    }),
+  },
+};
+
+export const Submitting: Story = {
+  args: {
+    state: makeState({
+      email: "user@example.com",
+      password: "hunter2",
+      isSubmitting: true,
+    }),
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/agents/StirlingLogoAnimated.stories.tsx b/frontend/editor/src/proprietary/components/agents/StirlingLogoAnimated.stories.tsx
new file mode 100644
index 0000000000..2355f88810
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/agents/StirlingLogoAnimated.stories.tsx
@@ -0,0 +1,22 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { StirlingLogoAnimated } from "@app/components/agents/StirlingLogoAnimated";
+
+/**
+ * Animated Stirling logo mark, used as a "thinking" indicator in the chat panel.
+ */
+const meta: Meta<typeof StirlingLogoAnimated> = {
+  title: "Agents/StirlingLogoAnimated",
+  component: StirlingLogoAnimated,
+  parameters: { layout: "padded" },
+  args: {
+    size: 20,
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Large: Story = {
+  args: { size: 64 },
+};
diff --git a/frontend/editor/src/proprietary/components/agents/StirlingLogoOutline.stories.tsx b/frontend/editor/src/proprietary/components/agents/StirlingLogoOutline.stories.tsx
new file mode 100644
index 0000000000..3192b69303
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/agents/StirlingLogoOutline.stories.tsx
@@ -0,0 +1,22 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { StirlingLogoOutline } from "@app/components/agents/StirlingLogoOutline";
+
+const meta = {
+  title: "Agents/StirlingLogoOutline",
+  component: StirlingLogoOutline,
+  parameters: { layout: "centered" },
+  args: {
+    size: 20,
+  },
+} satisfies Meta<typeof StirlingLogoOutline>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Large: Story = {
+  args: {
+    size: 64,
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyPiiField.stories.tsx b/frontend/editor/src/proprietary/components/policies/PolicyPiiField.stories.tsx
new file mode 100644
index 0000000000..12c764dd4f
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/policies/PolicyPiiField.stories.tsx
@@ -0,0 +1,71 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PolicyPiiField } from "@app/components/policies/PolicyPiiField";
+import { PII_PRESETS } from "@app/data/policyDefinitions";
+import type { RedactParameters } from "@app/hooks/tools/redact/useRedactParameters";
+
+const BASE_PARAMETERS: RedactParameters = {
+  mode: "automatic",
+  wordsToRedact: [],
+  useRegex: false,
+  wholeWordSearch: false,
+  redactColor: "#000000",
+  customPadding: 0.1,
+  convertPDFToImage: true,
+};
+
+// The field only owns the preset selection; the story holds parameters state
+// so selecting/clearing presets is live.
+function Harness({
+  initialParameters,
+  disabled,
+}: {
+  initialParameters: RedactParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<RedactParameters>(initialParameters);
+  return (
+    <div style={{ maxWidth: 360 }}>
+      <PolicyPiiField
+        parameters={parameters}
+        onChange={setParameters}
+        disabled={disabled}
+      />
+    </div>
+  );
+}
+
+const meta = {
+  title: "Policies/PolicyPiiField",
+  component: Harness,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof Harness>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** No presets selected yet. */
+export const Default: Story = {
+  args: {
+    initialParameters: BASE_PARAMETERS,
+  },
+};
+
+/** SSN and credit card presets pre-selected. */
+export const WithSelection: Story = {
+  args: {
+    initialParameters: {
+      ...BASE_PARAMETERS,
+      useRegex: true,
+      wordsToRedact: [PII_PRESETS[0].pattern, PII_PRESETS[1].pattern],
+    },
+  },
+};
+
+/** Disabled state. */
+export const Disabled: Story = {
+  args: {
+    initialParameters: BASE_PARAMETERS,
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyRedactConfig.stories.tsx b/frontend/editor/src/proprietary/components/policies/PolicyRedactConfig.stories.tsx
new file mode 100644
index 0000000000..2befe6971b
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/policies/PolicyRedactConfig.stories.tsx
@@ -0,0 +1,70 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PolicyRedactConfig } from "@app/components/policies/PolicyRedactConfig";
+import { PII_PRESETS } from "@app/data/policyDefinitions";
+import type { RedactParameters } from "@app/hooks/tools/redact/useRedactParameters";
+
+const BASE_PARAMETERS: RedactParameters = {
+  mode: "automatic",
+  wordsToRedact: [],
+  useRegex: true,
+  wholeWordSearch: false,
+  redactColor: "#000000",
+  customPadding: 0.1,
+  convertPDFToImage: true,
+};
+
+// onChange must be wired up for real, since the component normalises its
+// params via an onChange call on mount.
+function Harness({
+  initialParameters,
+  disabled,
+}: {
+  initialParameters: RedactParameters;
+  disabled?: boolean;
+}) {
+  const [parameters, setParameters] =
+    useState<RedactParameters>(initialParameters);
+  return (
+    <div style={{ maxWidth: 360 }}>
+      <PolicyRedactConfig
+        parameters={parameters}
+        onChange={setParameters}
+        disabled={disabled}
+      />
+    </div>
+  );
+}
+
+const meta = {
+  title: "Policies/PolicyRedactConfig",
+  component: Harness,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof Harness>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** No PII presets selected yet. */
+export const Default: Story = {
+  args: {
+    initialParameters: BASE_PARAMETERS,
+  },
+};
+
+/** SSN and credit card presets pre-selected. */
+export const WithSelection: Story = {
+  args: {
+    initialParameters: {
+      ...BASE_PARAMETERS,
+      wordsToRedact: [PII_PRESETS[0].pattern, PII_PRESETS[1].pattern],
+    },
+  },
+};
+
+/** Locked, e.g. when the policy step is view-only. */
+export const Disabled: Story = {
+  args: {
+    initialParameters: BASE_PARAMETERS,
+    disabled: true,
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/policies/PolicyWatermarkConfig.stories.tsx b/frontend/editor/src/proprietary/components/policies/PolicyWatermarkConfig.stories.tsx
new file mode 100644
index 0000000000..e990de30ea
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/policies/PolicyWatermarkConfig.stories.tsx
@@ -0,0 +1,38 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PolicyWatermarkConfig } from "@app/components/policies/PolicyWatermarkConfig";
+import {
+  defaultParameters,
+  type AddWatermarkParameters,
+} from "@app/hooks/tools/addWatermark/useAddWatermarkParameters";
+
+// The parent policy form owns the parameters; the story holds that state so edits are live.
+function Harness({ disabled }: { disabled?: boolean }) {
+  const [parameters, setParameters] =
+    useState<AddWatermarkParameters>(defaultParameters);
+  return (
+    <div style={{ maxWidth: 480 }}>
+      <PolicyWatermarkConfig
+        parameters={parameters}
+        onChange={setParameters}
+        disabled={disabled}
+      />
+    </div>
+  );
+}
+
+const meta: Meta<typeof Harness> = {
+  title: "Policies/PolicyWatermarkConfig",
+  component: Harness,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof Harness>;
+
+/** Text-only watermark settings for a policy, with flatten forced on. */
+export const Default: Story = {};
+
+/** All fields locked for read-only policy review. */
+export const Disabled: Story = {
+  args: { disabled: true },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/ChangeUserPasswordModal.stories.tsx b/frontend/editor/src/proprietary/components/shared/ChangeUserPasswordModal.stories.tsx
new file mode 100644
index 0000000000..613f8cacc7
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/ChangeUserPasswordModal.stories.tsx
@@ -0,0 +1,36 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ChangeUserPasswordModal from "@app/components/shared/ChangeUserPasswordModal";
+import type { User } from "@app/services/userManagementService";
+
+const USER: User = {
+  id: 1,
+  username: "alice@example.com",
+  roleName: "adminUserSettings.admin",
+  enabled: true,
+};
+
+const meta = {
+  title: "Shared/ChangeUserPasswordModal",
+  component: ChangeUserPasswordModal,
+  args: {
+    opened: true,
+    user: USER,
+    mailEnabled: true,
+    onClose: () => {},
+    onSuccess: () => {},
+  },
+} satisfies Meta<typeof ChangeUserPasswordModal>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** When SMTP notifications aren't configured, the email checkboxes are disabled. */
+export const MailDisabled: Story = {
+  args: { mailEnabled: false },
+};
+
+/** A username that isn't a valid email address also disables the email checkboxes. */
+export const NonEmailUsername: Story = {
+  args: { user: { ...USER, username: "alice" } },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/DividerWithText.stories.tsx b/frontend/editor/src/proprietary/components/shared/DividerWithText.stories.tsx
new file mode 100644
index 0000000000..fe677d26d6
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/DividerWithText.stories.tsx
@@ -0,0 +1,31 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import DividerWithText from "@app/components/shared/DividerWithText";
+
+/**
+ * Horizontal rule, optionally with a centered text label (e.g. "or").
+ */
+const meta = {
+  title: "Shared/DividerWithText",
+  component: DividerWithText,
+  parameters: { layout: "padded" },
+  args: {
+    text: "or",
+  },
+} satisfies Meta<typeof DividerWithText>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** With no `text`, renders a plain horizontal rule. */
+export const PlainRule: Story = {
+  args: { text: undefined },
+};
+
+export const Subcategory: Story = {
+  args: {
+    text: "Advanced options",
+    variant: "subcategory",
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/ManageBillingButton.stories.tsx b/frontend/editor/src/proprietary/components/shared/ManageBillingButton.stories.tsx
new file mode 100644
index 0000000000..f860767b43
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/ManageBillingButton.stories.tsx
@@ -0,0 +1,23 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { ManageBillingButton } from "@app/components/shared/ManageBillingButton";
+
+/**
+ * Button that opens the Stripe billing portal for the current license.
+ */
+const meta = {
+  title: "Shared/ManageBillingButton",
+  component: ManageBillingButton,
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof ManageBillingButton>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** Custom return URL to redirect back to once the billing portal session ends. */
+export const CustomReturnUrl: Story = {
+  args: {
+    returnUrl: "https://stirlingpdf.com/account",
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/UpdateSeatsModal.stories.tsx b/frontend/editor/src/proprietary/components/shared/UpdateSeatsModal.stories.tsx
new file mode 100644
index 0000000000..ec61584fa6
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/UpdateSeatsModal.stories.tsx
@@ -0,0 +1,30 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import UpdateSeatsModal from "@app/components/shared/UpdateSeatsModal";
+
+/**
+ * Modal for adjusting enterprise seat count, redirecting to the Stripe billing portal on confirm.
+ */
+const meta = {
+  title: "Shared/UpdateSeatsModal",
+  component: UpdateSeatsModal,
+  parameters: { layout: "fullscreen" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    currentSeats: 10,
+    minimumSeats: 5,
+  },
+} satisfies Meta<typeof UpdateSeatsModal>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** Minimum seats equal to current seats, e.g. a fully-utilized license. */
+export const AtMinimum: Story = {
+  args: {
+    currentSeats: 5,
+    minimumSeats: 5,
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/EnterpriseRequiredBanner.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/EnterpriseRequiredBanner.stories.tsx
new file mode 100644
index 0000000000..2ff341d6f9
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/EnterpriseRequiredBanner.stories.tsx
@@ -0,0 +1,24 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import EnterpriseRequiredBanner from "@app/components/shared/config/EnterpriseRequiredBanner";
+
+/**
+ * Banner explaining that an enterprise-only feature is running in demo mode.
+ */
+const meta: Meta<typeof EnterpriseRequiredBanner> = {
+  title: "Config/EnterpriseRequiredBanner",
+  component: EnterpriseRequiredBanner,
+  parameters: { layout: "padded" },
+  args: {
+    show: true,
+    featureName: "Audit Logs",
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** When `show` is false the banner renders nothing. */
+export const Hidden: Story = {
+  args: { show: false },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/GeneralWithLoginLanding.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/GeneralWithLoginLanding.stories.tsx
new file mode 100644
index 0000000000..2c8fb2aa3b
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/GeneralWithLoginLanding.stories.tsx
@@ -0,0 +1,74 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import GeneralWithLoginLanding from "@app/components/shared/config/GeneralWithLoginLanding";
+import { PreferencesProvider } from "@app/contexts/PreferencesContext";
+import { ThemeProvider } from "@app/components/shared/ThemeProvider";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+
+// Wraps GeneralSection, which reads theme/tool-panel preferences via
+// usePreferences()/useTheme() and server config via useAppConfig() — none of
+// which the Storybook preview's own provider tree supplies (those are the
+// portal contexts), so wrap here. AppConfigProvider uses autoFetch off so
+// stories render a fixed config instead of hitting the API. The login-landing
+// control itself stays hidden (loginLandingMode() defaults to non-"dynamic"
+// in this build), so only the General section is visible.
+const meta = {
+  title: "Config/GeneralWithLoginLanding",
+  component: GeneralWithLoginLanding,
+  parameters: { layout: "padded" },
+  decorators: [
+    (Story) => (
+      <PreferencesProvider>
+        <ThemeProvider>
+          <Story />
+        </ThemeProvider>
+      </PreferencesProvider>
+    ),
+  ],
+} satisfies Meta<typeof GeneralWithLoginLanding>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Login enabled, no backend version known yet — Software Updates section and admin banner stay hidden. */
+export const Default: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: true }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
+
+/** Backend version known — shows the Software Updates section with version info. */
+export const WithBackendVersion: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: true, appVersion: "1.2.3" }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
+
+/** Login disabled — the "For System Administrators" banner shows, prompting the env vars to enable it. */
+export const AdminBanner: Story = {
+  decorators: [
+    (StoryComponent) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: false }}
+      >
+        <StoryComponent />
+      </AppConfigProvider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/OverviewHeader.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/OverviewHeader.stories.tsx
new file mode 100644
index 0000000000..a5d57a1a73
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/OverviewHeader.stories.tsx
@@ -0,0 +1,49 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { OverviewHeader } from "@app/components/shared/config/OverviewHeader";
+import { AuthContext } from "@app/auth/context";
+import type { AuthContextValue } from "@app/auth/types";
+
+/**
+ * Header for the application configuration page: title, description, and
+ * (when signed in) the current user's email plus a log-out button.
+ */
+const meta: Meta<typeof OverviewHeader> = {
+  title: "Config/OverviewHeader",
+  component: OverviewHeader,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const signedInAuth: AuthContextValue = {
+  session: null,
+  user: {
+    id: "user-1",
+    email: "jane.doe@example.com",
+    username: "jane.doe",
+    role: "ROLE_USER",
+  },
+  displayName: "jane.doe",
+  isAnonymous: false,
+  isAdmin: false,
+  portalAccess: false,
+  role: "ROLE_USER",
+  loading: false,
+  error: null,
+  signOut: async () => {},
+  refreshSession: async () => {},
+};
+
+/** Signed out: no email line, no log-out button. */
+export const Default: Story = {};
+
+/** Signed in: shows the current user's email and a log-out button. */
+export const SignedIn: Story = {
+  decorators: [
+    (Story) => (
+      <AuthContext.Provider value={signedInAuth}>
+        <Story />
+      </AuthContext.Provider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AccountSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AccountSection.stories.tsx
new file mode 100644
index 0000000000..213df8951c
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AccountSection.stories.tsx
@@ -0,0 +1,101 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AccountSection from "@app/components/shared/config/configSections/AccountSection";
+import { AuthContext } from "@app/auth/context";
+import type { AuthContextValue } from "@app/auth/types";
+import { accountService } from "@app/services/accountService";
+
+/**
+ * Account settings panel shown inside the app config modal: password /
+ * username management and two-factor authentication setup.
+ */
+const meta: Meta<typeof AccountSection> = {
+  title: "Config/AccountSection",
+  component: AccountSection,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+// AccountSection gets its user from useAuth() and its MFA/account data from
+// accountService on mount rather than via props, so stories set those directly.
+const standardAuth: AuthContextValue = {
+  session: null,
+  user: {
+    id: "user-1",
+    email: "jane.doe@example.com",
+    username: "jane.doe",
+    role: "ROLE_USER",
+  },
+  displayName: "jane.doe",
+  isAnonymous: false,
+  isAdmin: false,
+  portalAccess: false,
+  role: "ROLE_USER",
+  loading: false,
+  error: null,
+  signOut: async () => {},
+  refreshSession: async () => {},
+};
+
+const ssoAuth: AuthContextValue = {
+  ...standardAuth,
+  user: {
+    ...standardAuth.user!,
+    email: "jane.doe@acme-corp.com",
+    authenticationType: "sso",
+  },
+};
+
+accountService.getAccountData = async () => ({
+  username: "jane.doe",
+  role: "ROLE_USER",
+  settings: "{}",
+  changeCredsFlag: false,
+  oAuth2Login: false,
+  saml2Login: false,
+  mfaEnabled: false,
+});
+
+/** Standard account with password/username management and 2FA available to enable. */
+export const Default: Story = {
+  decorators: [
+    (Story) => (
+      <AuthContext.Provider value={standardAuth}>
+        <Story />
+      </AuthContext.Provider>
+    ),
+  ],
+};
+
+/** Two-factor authentication already enabled: shows the disable action instead. */
+export const MfaEnabled: Story = {
+  decorators: [
+    (Story) => {
+      accountService.getAccountData = async () => ({
+        username: "jane.doe",
+        role: "ROLE_USER",
+        settings: "{}",
+        changeCredsFlag: false,
+        oAuth2Login: false,
+        saml2Login: false,
+        mfaEnabled: true,
+      });
+      return (
+        <AuthContext.Provider value={standardAuth}>
+          <Story />
+        </AuthContext.Provider>
+      );
+    },
+  ],
+};
+
+/** SSO-managed account: password/username changes and 2FA are hidden behind identity-provider notices. */
+export const SsoUser: Story = {
+  decorators: [
+    (Story) => (
+      <AuthContext.Provider value={ssoAuth}>
+        <Story />
+      </AuthContext.Provider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiDocumentsSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiDocumentsSection.stories.tsx
new file mode 100644
index 0000000000..c0ba0c34cb
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiDocumentsSection.stories.tsx
@@ -0,0 +1,98 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse, delay } from "msw";
+import AdminAiDocumentsSection from "@app/components/shared/config/configSections/AdminAiDocumentsSection";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import { UnsavedChangesProvider } from "@app/contexts/UnsavedChangesContext";
+import {
+  AiEngineApiResponse,
+  MASKED_SECRET,
+} from "@app/components/shared/config/configSections/aiEngineSettings";
+
+// AdminAiDocumentsSection takes no props: it fetches the shared aiEngine settings
+// blob via apiClient on mount and reads login state through useAppConfig(), so
+// each variant mocks the GET response and wraps in a fixed AppConfigProvider
+// (autoFetch off, so stories never hit the real API). It also tracks dirty state
+// through useSettingsDirty()/useUnsavedChanges(), which isn't part of Storybook's
+// global provider stack, so that needs wrapping here too or the hook throws.
+const baseSettings: AiEngineApiResponse = {
+  rag: {
+    embeddingProvider: "voyageai",
+    embeddingModel: "voyage-4",
+    embeddingApiKey: MASKED_SECRET,
+    topK: 5,
+    maxSearches: 3,
+  },
+};
+
+const handlerFor = (data: AiEngineApiResponse) =>
+  http.get("*/api/v1/admin/settings/section/aiEngine", () =>
+    HttpResponse.json(data),
+  );
+
+const meta = {
+  title: "Config/AdminAiDocumentsSection",
+  component: AdminAiDocumentsSection,
+  parameters: {
+    layout: "padded",
+    msw: {
+      handlers: [
+        handlerFor(baseSettings),
+        http.put("*/api/v1/admin/settings", () => HttpResponse.json({})),
+        http.put("*/api/v1/admin/settings/section/aiEngine", () =>
+          HttpResponse.json({}),
+        ),
+      ],
+    },
+  },
+  decorators: [
+    (Story) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: true }}
+      >
+        <UnsavedChangesProvider>
+          <Story />
+        </UnsavedChangesProvider>
+      </AppConfigProvider>
+    ),
+  ],
+} satisfies Meta<typeof AdminAiDocumentsSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** VoyageAI embeddings with a saved (masked) API key and default retrieval settings. */
+export const Default: Story = {};
+
+/** Ollama needs a base URL instead of an API key: the key field is hidden. */
+export const OllamaProvider: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        handlerFor({
+          rag: {
+            embeddingProvider: "ollama",
+            embeddingModel: "nomic-embed-text",
+            embeddingBaseUrl: "http://ollama:11434/v1",
+            topK: 5,
+            maxSearches: 3,
+          },
+        }),
+      ],
+    },
+  },
+};
+
+/** While the settings request is in flight, a centered loader replaces the form. */
+export const Loading: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("*/api/v1/admin/settings/section/aiEngine", async () => {
+          await delay("infinite");
+          return HttpResponse.json(baseSettings);
+        }),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiGeneralSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiGeneralSection.stories.tsx
new file mode 100644
index 0000000000..4061f52fd8
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiGeneralSection.stories.tsx
@@ -0,0 +1,82 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import AdminAiGeneralSection from "@app/components/shared/config/configSections/AdminAiGeneralSection";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import { UnsavedChangesProvider } from "@app/contexts/UnsavedChangesContext";
+import type { AiEngineApiResponse } from "@app/components/shared/config/configSections/aiEngineSettings";
+
+// AdminAiGeneralSection fetches the shared aiEngine settings blob on mount via
+// apiClient (no service seam to stub), so each variant supplies its own MSW
+// handler for GET .../admin/settings/section/aiEngine. Saves PUT back to the
+// same section plus the generic /admin/settings delta endpoint; the smoke
+// test never clicks Save, so those aren't stubbed here.
+const baseSettings: AiEngineApiResponse = {
+  enabled: true,
+  url: "http://stirling-pdf-engine:5001",
+  timeoutSeconds: 30,
+  longRunningTimeoutSeconds: 120,
+  streamTimeoutSeconds: 60,
+  features: {
+    chat: true,
+    documentQuestions: true,
+    createPdf: false,
+    mathAuditor: false,
+    pdfComment: false,
+    classify: true,
+  },
+};
+
+const handlerFor = (data: AiEngineApiResponse) =>
+  http.get("*/api/v1/admin/settings/section/aiEngine", () =>
+    HttpResponse.json(data),
+  );
+
+const meta = {
+  title: "Config/AdminAiGeneralSection",
+  component: AdminAiGeneralSection,
+  parameters: {
+    layout: "padded",
+    msw: { handlers: [handlerFor(baseSettings)] },
+  },
+  // useSettingsDirty() reads UnsavedChangesContext and the section reads login
+  // state via useAppConfig(), neither of which the global preview supplies.
+  decorators: [
+    (Story) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: true }}
+      >
+        <UnsavedChangesProvider>
+          <Story />
+        </UnsavedChangesProvider>
+      </AppConfigProvider>
+    ),
+  ],
+} satisfies Meta<typeof AdminAiGeneralSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** AI enabled, connected to an engine, with a mix of capabilities toggled on. */
+export const Default: Story = {};
+
+/** Master switch off: the URL, timeouts, and capability switches are all disabled. */
+export const Disabled: Story = {
+  parameters: {
+    msw: { handlers: [handlerFor({ ...baseSettings, enabled: false })] },
+  },
+};
+
+/** The engine URL was changed and saved but awaits a restart to take effect. */
+export const PendingRestart: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        handlerFor({
+          ...baseSettings,
+          _pending: { url: "http://stirling-pdf-engine:6001" },
+        }),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiLimitsSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiLimitsSection.stories.tsx
new file mode 100644
index 0000000000..3caae46a25
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiLimitsSection.stories.tsx
@@ -0,0 +1,85 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse, delay } from "msw";
+import AdminAiLimitsSection from "@app/components/shared/config/configSections/AdminAiLimitsSection";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import { UnsavedChangesProvider } from "@app/contexts/UnsavedChangesContext";
+import type { AiEngineApiResponse } from "@app/components/shared/config/configSections/aiEngineSettings";
+
+// AdminAiLimitsSection takes no props: it fetches the shared aiEngine settings
+// blob via apiClient on mount and reads login state through useAppConfig(), so
+// each variant mocks the GET response and wraps in a fixed AppConfigProvider
+// (autoFetch off, so stories never hit the real API).
+const baseSettings: AiEngineApiResponse = {
+  limits: {
+    maxPages: 50,
+    maxCharacters: 200000,
+    modelMaxConcurrency: 4,
+  },
+};
+
+const meta = {
+  title: "Config/AdminAiLimitsSection",
+  component: AdminAiLimitsSection,
+  parameters: {
+    layout: "padded",
+    msw: {
+      handlers: [
+        http.get("/api/v1/admin/settings/section/aiEngine", () =>
+          HttpResponse.json(baseSettings),
+        ),
+        http.put("/api/v1/admin/settings", () => HttpResponse.json({})),
+        http.put("/api/v1/admin/settings/section/aiEngine", () =>
+          HttpResponse.json({}),
+        ),
+      ],
+    },
+  },
+  decorators: [
+    (Story) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: true }}
+      >
+        <UnsavedChangesProvider>
+          <Story />
+        </UnsavedChangesProvider>
+      </AppConfigProvider>
+    ),
+  ],
+} satisfies Meta<typeof AdminAiLimitsSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Loaded limits with login enabled, so the sticky footer can appear once edited. */
+export const Default: Story = {};
+
+/** While the settings request is in flight, a centered loader replaces the form. */
+export const Loading: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/admin/settings/section/aiEngine", async () => {
+          await delay("infinite");
+          return HttpResponse.json(baseSettings);
+        }),
+      ],
+    },
+  },
+};
+
+/** A pending (restart-required) change on max pages shows the pending badge next to its label. */
+export const PendingChange: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.get("/api/v1/admin/settings/section/aiEngine", () =>
+          HttpResponse.json({
+            ...baseSettings,
+            _pending: { limits: { maxPages: 100 } },
+          } satisfies AiEngineApiResponse),
+        ),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiModelsSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiModelsSection.stories.tsx
new file mode 100644
index 0000000000..2a1a5f96eb
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAiModelsSection.stories.tsx
@@ -0,0 +1,106 @@
+import type React from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import AdminAiModelsSection from "@app/components/shared/config/configSections/AdminAiModelsSection";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import { UnsavedChangesProvider } from "@app/contexts/UnsavedChangesContext";
+import {
+  AiEngineApiResponse,
+  MASKED_SECRET,
+} from "@app/components/shared/config/configSections/aiEngineSettings";
+
+/**
+ * AdminAiModelsSection fetches its settings via apiClient on mount (through
+ * useAdminSettings) rather than taking props, so each story mocks the GET
+ * with MSW. It also reads useAppConfig()/useSettingsDirty(), which throw
+ * without their providers, so every story wraps in both.
+ */
+function withProviders(Story: () => React.JSX.Element) {
+  return (
+    <AppConfigProvider autoFetch={false} initialConfig={{ enableLogin: true }}>
+      <UnsavedChangesProvider>
+        <Story />
+      </UnsavedChangesProvider>
+    </AppConfigProvider>
+  );
+}
+
+function aiEngineHandler(response: AiEngineApiResponse) {
+  return http.get("/api/v1/admin/settings/section/aiEngine", () =>
+    HttpResponse.json(response),
+  );
+}
+
+const meta = {
+  title: "Config/AdminAiModelsSection",
+  component: AdminAiModelsSection,
+  parameters: { layout: "padded" },
+  decorators: [withProviders],
+} satisfies Meta<typeof AdminAiModelsSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Anthropic provider with a saved (masked) API key and no base URL field. */
+export const Default: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        aiEngineHandler({
+          models: {
+            provider: "anthropic",
+            smartModel: "claude-sonnet-5",
+            fastModel: "claude-haiku-4-5",
+            smartMaxTokens: 8192,
+            fastMaxTokens: 2048,
+            apiKey: MASKED_SECRET,
+          },
+        }),
+      ],
+    },
+  },
+};
+
+/** Ollama provider: no API key field, but a base URL input and an SSRF warning banner instead. */
+export const OllamaProvider: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        aiEngineHandler({
+          models: {
+            provider: "ollama",
+            smartModel: "llama3.1",
+            fastModel: "qwen2.5",
+            smartMaxTokens: 4096,
+            fastMaxTokens: 1024,
+            baseUrl: "http://ollama:11434/v1",
+          },
+        }),
+      ],
+    },
+  },
+};
+
+/** Some fields are pending a config-management rollout — each shows a PendingBadge next to its label. */
+export const PendingChanges: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        aiEngineHandler({
+          models: {
+            provider: "anthropic",
+            smartModel: "claude-sonnet-5",
+            fastModel: "claude-haiku-4-5",
+            smartMaxTokens: 8192,
+            fastMaxTokens: 2048,
+            apiKey: MASKED_SECRET,
+          },
+          _pending: {
+            models: {
+              smartModel: "claude-opus-4-8",
+            },
+          },
+        }),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.stories.tsx
new file mode 100644
index 0000000000..2959cbb033
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.stories.tsx
@@ -0,0 +1,100 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AdminAuditSection from "@app/components/shared/config/configSections/AdminAuditSection";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import auditService from "@app/services/auditService";
+
+// AdminAuditSection reads its config through useAppConfig()/useLoginRequired()
+// rather than taking props, so each variant wraps it in an AppConfigProvider
+// with a fixed initialConfig (autoFetch off, so stories never hit the API).
+// Without login enabled + an ENTERPRISE license the component falls back to
+// hardcoded demo data on its own; the "fully enabled" and "disabled" variants
+// below supply that config, which makes the component call
+// auditService.getSystemStatus() on mount, so each stubs that call directly
+// (the module exports a plain object, the seam the component itself calls
+// through) inside its own decorator so the two variants don't depend on
+// render order.
+const meta = {
+  title: "Config/AdminAuditSection",
+  component: AdminAuditSection,
+} satisfies Meta<typeof AdminAuditSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/**
+ * No login configured yet: falls back to demo data, shows the enterprise
+ * banner, and the dashboard tabs are disabled.
+ */
+export const Default: Story = {};
+
+/** Login is disabled entirely: both the login and enterprise banners show. */
+export const LoginDisabled: Story = {
+  decorators: [
+    (Story) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: false }}
+      >
+        <Story />
+      </AppConfigProvider>
+    ),
+  ],
+};
+
+/**
+ * Login enabled with an ENTERPRISE license: both banners are hidden, the
+ * dashboard tabs are active, and the fetched (mocked) status backs the page
+ * instead of the built-in demo data.
+ */
+export const Enabled: Story = {
+  decorators: [
+    (Story) => {
+      auditService.getSystemStatus = async () => ({
+        enabled: true,
+        level: "INFO",
+        retentionDays: 90,
+        totalEvents: 15234,
+        pdfMetadataEnabled: true,
+        captureFileHash: true,
+        capturePdfAuthor: true,
+        captureOperationResults: true,
+      });
+      return (
+        <AppConfigProvider
+          autoFetch={false}
+          bootstrapMode="non-blocking"
+          initialConfig={{ enableLogin: true, license: "ENTERPRISE" }}
+        >
+          <Story />
+        </AppConfigProvider>
+      );
+    },
+  ],
+};
+
+/** Audit logging itself is turned off server-side: shows the disabled notice instead of the tabs. */
+export const AuditLoggingDisabled: Story = {
+  decorators: [
+    (Story) => {
+      auditService.getSystemStatus = async () => ({
+        enabled: false,
+        level: "OFF",
+        retentionDays: 0,
+        totalEvents: 0,
+        pdfMetadataEnabled: false,
+        captureFileHash: false,
+        capturePdfAuthor: false,
+        captureOperationResults: false,
+      });
+      return (
+        <AppConfigProvider
+          autoFetch={false}
+          bootstrapMode="non-blocking"
+          initialConfig={{ enableLogin: true, license: "ENTERPRISE" }}
+        >
+          <Story />
+        </AppConfigProvider>
+      );
+    },
+  ],
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/AdminFolderAccessSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminFolderAccessSection.stories.tsx
new file mode 100644
index 0000000000..140445fe0e
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/AdminFolderAccessSection.stories.tsx
@@ -0,0 +1,95 @@
+import type React from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import AdminFolderAccessSection from "@app/components/shared/config/configSections/AdminFolderAccessSection";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+import { UnsavedChangesProvider } from "@app/contexts/UnsavedChangesContext";
+
+/**
+ * AdminFolderAccessSection fetches its settings via apiClient on mount (through
+ * useAdminSettings, plus its own implied-folder-roots request) rather than
+ * taking props, so each story mocks both GETs with MSW. It also reads
+ * useAppConfig()/useSettingsDirty(), which throw without their providers, so
+ * every story wraps in both.
+ */
+function withProviders(enableLogin: boolean) {
+  return function Decorator(Story: () => React.JSX.Element) {
+    return (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin }}
+      >
+        <UnsavedChangesProvider>
+          <Story />
+        </UnsavedChangesProvider>
+      </AppConfigProvider>
+    );
+  };
+}
+
+function impliedRootsHandler(
+  roots: { path: string; reason: string }[] = [
+    { path: "/srv/stirling/storage", reason: "serverStorage" },
+    { path: "/srv/stirling/watched/invoices", reason: "watchedFolder" },
+  ],
+) {
+  return http.get("/api/v1/admin/settings/policies/implied-folder-roots", () =>
+    HttpResponse.json(roots),
+  );
+}
+
+function allowedRootsHandler(allowedFolderRoots: string[]) {
+  return http.get("/api/v1/admin/settings/section/policies", () =>
+    HttpResponse.json({ allowedFolderRoots }),
+  );
+}
+
+const meta = {
+  title: "Config/AdminFolderAccessSection",
+  component: AdminFolderAccessSection,
+  parameters: {
+    layout: "padded",
+    msw: {
+      handlers: [
+        http.put("/api/v1/admin/settings/section/policies", () =>
+          HttpResponse.json({}),
+        ),
+      ],
+    },
+  },
+  decorators: [withProviders(true)],
+} satisfies Meta<typeof AdminFolderAccessSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** Two allowed folder roots configured, plus the always-allowed implied roots. */
+export const Default: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        allowedRootsHandler(["/data/inbox", "/data/exports"]),
+        impliedRootsHandler(),
+      ],
+    },
+  },
+};
+
+/** No folder roots configured yet: folder sources and outputs are disabled. */
+export const NoRootsConfigured: Story = {
+  parameters: {
+    msw: {
+      handlers: [allowedRootsHandler([]), impliedRootsHandler([])],
+    },
+  },
+};
+
+/** Login mode disabled: the section is read-only and shows the login-required banner. */
+export const LoginDisabled: Story = {
+  decorators: [withProviders(false)],
+  parameters: {
+    msw: {
+      handlers: [allowedRootsHandler([]), impliedRootsHandler([])],
+    },
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/ApiKeys.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/ApiKeys.stories.tsx
new file mode 100644
index 0000000000..3d7e113861
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/ApiKeys.stories.tsx
@@ -0,0 +1,55 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse, delay } from "msw";
+import ApiKeys from "@app/components/shared/config/configSections/ApiKeys";
+
+/**
+ * Config section showing the user's API key, with copy/refresh actions and
+ * links to the API docs. Fetches the key from the backend on mount, so the
+ * different visual states are driven by mocking `get-api-key` via MSW rather
+ * than props (the component takes none).
+ */
+const meta: Meta<typeof ApiKeys> = {
+  title: "Config/ConfigSections/ApiKeys",
+  component: ApiKeys,
+  parameters: {
+    layout: "padded",
+    msw: {
+      handlers: [
+        http.post("/api/v1/user/get-api-key", () =>
+          HttpResponse.json("demo-storybook-api-key-000000000000"),
+        ),
+      ],
+    },
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** While the key request is in flight, the card shows a skeleton placeholder. */
+export const Loading: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.post("/api/v1/user/get-api-key", async () => {
+          await delay("infinite");
+          return HttpResponse.json(null);
+        }),
+      ],
+    },
+  },
+};
+
+/** When the key request fails, an error banner with a retry link is shown. */
+export const LoadError: Story = {
+  parameters: {
+    msw: {
+      handlers: [
+        http.post("/api/v1/user/get-api-key", () =>
+          HttpResponse.json(null, { status: 500 }),
+        ),
+      ],
+    },
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/LoginAgreementEditor.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/LoginAgreementEditor.stories.tsx
new file mode 100644
index 0000000000..d60844a709
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/LoginAgreementEditor.stories.tsx
@@ -0,0 +1,20 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import LoginAgreementEditor from "@app/components/shared/config/configSections/LoginAgreementEditor";
+
+/**
+ * Per-language editor for the login agreement markdown shown on the login screen.
+ */
+const meta: Meta<typeof LoginAgreementEditor> = {
+  title: "Config/ConfigSections/LoginAgreementEditor",
+  component: LoginAgreementEditor,
+  parameters: { layout: "padded" },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** Inputs are locked while a parent action (e.g. saving elsewhere) is in progress. */
+export const Disabled: Story = {
+  args: { disabled: true },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.stories.tsx
new file mode 100644
index 0000000000..952de00331
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.stories.tsx
@@ -0,0 +1,98 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import TeamDetailsSection from "@app/components/shared/config/configSections/TeamDetailsSection";
+import { teamService } from "@app/services/teamService";
+import { userManagementService } from "@app/services/userManagementService";
+
+// TeamDetailsSection fetches through these services on mount rather than
+// taking data as props, so the story stubs the service methods directly
+// instead of passing mock data in.
+teamService.getTeamDetails = async () => ({
+  team: { id: 1, name: "Engineering" },
+  teamUsers: [
+    {
+      id: 1,
+      username: "alice",
+      email: "alice@example.com",
+      roleName: "adminUserSettings.admin",
+      rolesAsString: "ROLE_ADMIN",
+      enabled: true,
+    },
+    {
+      id: 2,
+      username: "bob",
+      email: "bob@example.com",
+      roleName: "adminUserSettings.user",
+      rolesAsString: "ROLE_USER",
+      enabled: true,
+    },
+    {
+      id: 3,
+      username: "carol",
+      roleName: "adminUserSettings.user",
+      rolesAsString: "ROLE_USER",
+      enabled: false,
+    },
+  ],
+  availableUsers: [
+    {
+      id: 4,
+      username: "dave",
+      roleName: "adminUserSettings.user",
+      rolesAsString: "ROLE_USER",
+      enabled: true,
+    },
+  ],
+  userLastRequest: { alice: Date.now() },
+});
+
+teamService.getTeams = async () => [
+  { id: 1, name: "Engineering" },
+  { id: 2, name: "Default" },
+];
+
+userManagementService.getUsers = async () => ({
+  users: [],
+  userSessions: {},
+  userLastRequest: {},
+  totalUsers: 4,
+  activeUsers: 3,
+  disabledUsers: 1,
+  maxAllowedUsers: 10,
+  availableSlots: 6,
+  grandfatheredUserCount: 0,
+  licenseMaxUsers: 10,
+  premiumEnabled: true,
+  mailEnabled: true,
+  lockedUsers: [],
+});
+
+const meta = {
+  title: "Config/TeamDetailsSection",
+  component: TeamDetailsSection,
+  parameters: { layout: "padded" },
+  args: {
+    teamId: 1,
+    onBack: () => {},
+  },
+} satisfies Meta<typeof TeamDetailsSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** A team with a mix of active and disabled members. */
+export const Default: Story = {};
+
+/** A team with no members yet shows the empty-state row. */
+export const Empty: Story = {
+  decorators: [
+    (Story) => {
+      teamService.getTeamDetails = async () => ({
+        team: { id: 2, name: "Design" },
+        teamUsers: [],
+        availableUsers: [],
+        userLastRequest: {},
+      });
+      return <Story />;
+    },
+  ],
+  args: { teamId: 2 },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.stories.tsx
new file mode 100644
index 0000000000..7f88ffca89
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/TeamsSection.stories.tsx
@@ -0,0 +1,71 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import TeamsSection from "@app/components/shared/config/configSections/TeamsSection";
+import { teamService } from "@app/services/teamService";
+import { AppConfigProvider } from "@app/contexts/AppConfigContext";
+
+// Fetches through teamService on mount rather than taking data as props, so
+// the story stubs it directly (the module exports a plain object, so this is
+// the same seam the component itself calls through).
+teamService.getTeams = async () => [
+  { id: 1, name: "Internal", userCount: 1 },
+  { id: 2, name: "Engineering", userCount: 8 },
+  { id: 3, name: "Marketing", userCount: 3 },
+  {
+    id: 4,
+    name: "Customer Success and Onboarding Specialists",
+    userCount: 5,
+  },
+];
+
+/**
+ * Admin panel for creating teams, renaming them, and moving members between
+ * them.
+ */
+const meta = {
+  title: "Config/ConfigSections/TeamsSection",
+  component: TeamsSection,
+  decorators: [
+    (Story) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: true }}
+      >
+        <Story />
+      </AppConfigProvider>
+    ),
+  ],
+} satisfies Meta<typeof TeamsSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+/** A handful of teams, including the non-deletable "Internal" system team. */
+export const Default: Story = {};
+
+/** No teams returned yet — shows the "no teams found" empty state row. */
+export const Empty: Story = {
+  decorators: [
+    (Story) => {
+      teamService.getTeams = async () => [];
+      return <Story />;
+    },
+  ],
+};
+
+/**
+ * Login disabled — falls back to hardcoded example teams and shows the
+ * login-required banner, with every row action disabled.
+ */
+export const LoginDisabled: Story = {
+  decorators: [
+    (Story) => (
+      <AppConfigProvider
+        autoFetch={false}
+        bootstrapMode="non-blocking"
+        initialConfig={{ enableLogin: false }}
+      >
+        <Story />
+      </AppConfigProvider>
+    ),
+  ],
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.stories.tsx
new file mode 100644
index 0000000000..cc11164ccd
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/ApiKeySection.stories.tsx
@@ -0,0 +1,31 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import ApiKeySection from "@app/components/shared/config/configSections/apiKeys/ApiKeySection";
+
+/**
+ * Card showing a public API key with copy and refresh actions.
+ */
+const meta: Meta<typeof ApiKeySection> = {
+  title: "Config/ApiKeySection",
+  component: ApiKeySection,
+  parameters: { layout: "padded" },
+  args: {
+    publicKey: "demo-publishable-key-xxxx",
+    copied: null,
+    onCopy: () => {},
+    onRefresh: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** After the copy button has been clicked, it shows a "Copied!" state. */
+export const Copied: Story = {
+  args: { copied: "public" },
+};
+
+/** The refresh button is disabled while a refresh is in progress. */
+export const Disabled: Story = {
+  args: { disabled: true },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/RefreshModal.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/RefreshModal.stories.tsx
new file mode 100644
index 0000000000..f23872a6ee
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/apiKeys/RefreshModal.stories.tsx
@@ -0,0 +1,25 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import RefreshModal from "@app/components/shared/config/configSections/apiKeys/RefreshModal";
+
+/**
+ * Confirmation modal shown before regenerating API keys, warning that
+ * existing keys will be invalidated.
+ */
+const meta: Meta<typeof RefreshModal> = {
+  title: "Config/ApiKeys/RefreshModal",
+  component: RefreshModal,
+  args: {
+    opened: true,
+    onClose: () => {},
+    onConfirm: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** When `opened` is false the modal renders nothing. */
+export const Closed: Story = {
+  args: { opened: false },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditChartsSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditChartsSection.stories.tsx
new file mode 100644
index 0000000000..299fb3ee2c
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditChartsSection.stories.tsx
@@ -0,0 +1,26 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AuditChartsSection from "@app/components/shared/config/configSections/audit/AuditChartsSection";
+
+/**
+ * Dashboard of audit-log charts (events over time, by type, by user).
+ * When `loginEnabled` is false it renders deterministic demo data instead
+ * of calling the audit API, which is what these stories rely on.
+ */
+const meta: Meta<typeof AuditChartsSection> = {
+  title: "Config/AuditChartsSection",
+  component: AuditChartsSection,
+  parameters: { layout: "padded" },
+  args: {
+    loginEnabled: false,
+    timePeriod: "week",
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** Day view of the same demo dataset. */
+export const DayPeriod: Story = {
+  args: { timePeriod: "day" },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditClearDataSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditClearDataSection.stories.tsx
new file mode 100644
index 0000000000..3bc860885d
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditClearDataSection.stories.tsx
@@ -0,0 +1,24 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AuditClearDataSection from "@app/components/shared/config/configSections/audit/AuditClearDataSection";
+
+/**
+ * Destructive action card for permanently clearing all audit logs, gated
+ * behind a randomly generated confirmation code the user must retype.
+ */
+const meta: Meta<typeof AuditClearDataSection> = {
+  title: "Config/Audit/AuditClearDataSection",
+  component: AuditClearDataSection,
+  parameters: { layout: "padded" },
+  args: {
+    loginEnabled: true,
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** When login is disabled, the delete action is disabled too. */
+export const LoginDisabled: Story = {
+  args: { loginEnabled: false },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditEventsTable.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditEventsTable.stories.tsx
new file mode 100644
index 0000000000..702610e7b9
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditEventsTable.stories.tsx
@@ -0,0 +1,29 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AuditEventsTable from "@app/components/shared/config/configSections/audit/AuditEventsTable";
+
+/**
+ * Table of audit events with sorting, an event-details modal, and pagination.
+ * When `loginEnabled` is false (auth disabled), it shows built-in sample
+ * events instead of calling the backend — used here to keep stories
+ * deterministic without a live API.
+ */
+const meta: Meta<typeof AuditEventsTable> = {
+  title: "Config/Audit/AuditEventsTable",
+  component: AuditEventsTable,
+  parameters: { layout: "padded" },
+  args: {
+    loginEnabled: false,
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** Adds the "Author" and "File Hash" columns when PDF metadata capture is enabled. */
+export const WithFileMetadataColumns: Story = {
+  args: {
+    captureFileHash: true,
+    capturePdfAuthor: true,
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.stories.tsx
new file mode 100644
index 0000000000..246e974a34
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.stories.tsx
@@ -0,0 +1,32 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AuditExportSection from "@app/components/shared/config/configSections/audit/AuditExportSection";
+
+const meta = {
+  title: "Config/AuditExportSection",
+  component: AuditExportSection,
+  parameters: { layout: "padded" },
+  args: {
+    loginEnabled: true,
+    captureFileHash: false,
+    capturePdfAuthor: false,
+    captureOperationResults: false,
+  },
+} satisfies Meta<typeof AuditExportSection>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** All optional PDF/file metadata fields enabled and selectable. */
+export const AllFieldsEnabled: Story = {
+  args: {
+    captureFileHash: true,
+    capturePdfAuthor: true,
+    captureOperationResults: true,
+  },
+};
+
+/** Without an active login, the format, fields, filters, and export button are all disabled. */
+export const LoginDisabled: Story = {
+  args: { loginEnabled: false },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.stories.tsx
new file mode 100644
index 0000000000..4ddee00974
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.stories.tsx
@@ -0,0 +1,68 @@
+import { useState } from "react";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AuditFiltersForm from "@app/components/shared/config/configSections/audit/AuditFiltersForm";
+import { AuditFilters } from "@app/services/auditService";
+
+/**
+ * Shared filter form for audit components: quick date presets, event type / user
+ * multi-selects, and start/end date pickers.
+ */
+const meta: Meta<typeof AuditFiltersForm> = {
+  title: "Config/Audit/AuditFiltersForm",
+  component: AuditFiltersForm,
+  parameters: { layout: "padded" },
+  args: {
+    eventTypes: ["LOGIN", "LOGOUT", "FILE_UPLOAD", "FILE_DOWNLOAD"],
+    users: ["alice", "bob", "carol"],
+    onFilterChange: () => {},
+    onClearFilters: () => {},
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {
+  args: {
+    filters: {},
+  },
+};
+
+/** With some filters already applied. */
+export const WithFiltersApplied: Story = {
+  args: {
+    filters: {
+      eventType: ["LOGIN"],
+      username: ["alice"],
+      startDate: "2026-07-01",
+      endDate: "2026-07-15",
+    },
+  },
+};
+
+/** All inputs disabled, e.g. while a request is in flight. */
+export const Disabled: Story = {
+  args: {
+    filters: {},
+    disabled: true,
+  },
+};
+
+/** Interactive: filter state updates live as the form is used. */
+export const Interactive: Story = {
+  render: (args) => {
+    function InteractiveForm() {
+      const [filters, setFilters] = useState<AuditFilters>({});
+      return (
+        <AuditFiltersForm
+          {...args}
+          filters={filters}
+          onFilterChange={(key, value) =>
+            setFilters((prev) => ({ ...prev, [key]: value }))
+          }
+          onClearFilters={() => setFilters({})}
+        />
+      );
+    }
+    return <InteractiveForm />;
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditStatsCards.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditStatsCards.stories.tsx
new file mode 100644
index 0000000000..01e8a66ea2
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditStatsCards.stories.tsx
@@ -0,0 +1,31 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AuditStatsCards from "@app/components/shared/config/configSections/audit/AuditStatsCards";
+
+/**
+ * Stat cards summarising audit log activity (events, success rate, active
+ * users, latency) for a given time period. With `loginEnabled={false}` it
+ * renders built-in demo data instead of calling the audit API.
+ */
+const meta: Meta<typeof AuditStatsCards> = {
+  title: "Config/Audit/AuditStatsCards",
+  component: AuditStatsCards,
+  parameters: { layout: "padded" },
+  args: {
+    loginEnabled: false,
+    timePeriod: "week",
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** Stats for a single day period. */
+export const Day: Story = {
+  args: { timePeriod: "day" },
+};
+
+/** Stats for a full month period. */
+export const Month: Story = {
+  args: { timePeriod: "month" },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditSystemStatus.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditSystemStatus.stories.tsx
new file mode 100644
index 0000000000..d7a93740d8
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/audit/AuditSystemStatus.stories.tsx
@@ -0,0 +1,41 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AuditSystemStatus from "@app/components/shared/config/configSections/audit/AuditSystemStatus";
+import type { AuditSystemStatus as AuditStatus } from "@app/services/auditService";
+
+const meta = {
+  title: "Config/Audit/AuditSystemStatus",
+  component: AuditSystemStatus,
+  parameters: { layout: "padded" },
+} satisfies Meta<typeof AuditSystemStatus>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+const baseStatus: AuditStatus = {
+  enabled: true,
+  level: "STANDARD",
+  retentionDays: 90,
+  totalEvents: 12483,
+  pdfMetadataEnabled: true,
+  captureFileHash: true,
+  capturePdfAuthor: true,
+  captureOperationResults: true,
+};
+
+export const Default: Story = {
+  args: {
+    status: baseStatus,
+  },
+};
+
+/** Audit logging disabled, and the opt-in fields not yet enabled in settings. */
+export const Disabled: Story = {
+  args: {
+    status: {
+      ...baseStatus,
+      enabled: false,
+      totalEvents: 0,
+      capturePdfAuthor: false,
+      captureFileHash: false,
+    },
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.stories.tsx
new file mode 100644
index 0000000000..4926f2c805
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.stories.tsx
@@ -0,0 +1,80 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import AvailablePlansSection from "@app/components/shared/config/configSections/plan/AvailablePlansSection";
+import type { PlanTier } from "@app/services/licenseService";
+
+const FEATURES = [
+  { name: "PDF conversion", included: true },
+  { name: "Digital signatures", included: true },
+  { name: "SSO", included: false },
+];
+
+const PLANS: PlanTier[] = [
+  {
+    id: "free",
+    name: "Free",
+    price: 0,
+    currency: "$",
+    period: "month",
+    features: FEATURES,
+    highlights: ["Core PDF tools", "Single user"],
+    lookupKey: "free",
+  },
+  {
+    id: "selfhosted:server:monthly",
+    name: "Server",
+    price: 29,
+    currency: "$",
+    period: "month",
+    popular: true,
+    features: FEATURES,
+    highlights: ["Everything in Free", "Team workspaces", "Priority support"],
+    lookupKey: "selfhosted:server:monthly",
+  },
+  {
+    id: "selfhosted:enterprise:monthly",
+    name: "Enterprise",
+    price: 99,
+    currency: "$",
+    period: "month",
+    seatPrice: 12,
+    requiresSeats: true,
+    features: FEATURES,
+    highlights: ["Everything in Server", "SSO", "Dedicated support"],
+    lookupKey: "selfhosted:enterprise:monthly",
+  },
+];
+
+const meta = {
+  title: "Config/Plan/AvailablePlansSection",
+  component: AvailablePlansSection,
+  parameters: { layout: "padded" },
+  args: {
+    plans: PLANS,
+    onUpgradeClick: () => {},
+  },
+} satisfies Meta<typeof AvailablePlansSection>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** Adds the currency selector shown when currency props are supplied. */
+export const WithCurrencySelector: Story = {
+  args: {
+    currency: "usd",
+    onCurrencyChange: () => {},
+    currencyOptions: [
+      { value: "usd", label: "USD ($)" },
+      { value: "eur", label: "EUR (€)" },
+      { value: "gbp", label: "GBP (£)" },
+    ],
+  },
+};
+
+/** Logged-out visitors see disabled upgrade/manage controls. */
+export const LoginDisabled: Story = {
+  args: {
+    loginEnabled: false,
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/FeatureComparisonTable.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/FeatureComparisonTable.stories.tsx
new file mode 100644
index 0000000000..bb346bdd6e
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/FeatureComparisonTable.stories.tsx
@@ -0,0 +1,51 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import FeatureComparisonTable from "@app/components/shared/config/configSections/plan/FeatureComparisonTable";
+import type { PlanFeature } from "@app/types/license";
+
+const features: PlanFeature[] = [
+  { name: "PDF merge & split", included: true },
+  { name: "OCR", included: true },
+  { name: "Custom watermarking", included: true },
+  { name: "Priority support", included: false },
+];
+
+const plans = [
+  {
+    name: "Free",
+    tier: "free",
+    features: features.map((f, i) => ({ ...f, included: i < 2 })),
+  },
+  {
+    name: "Server",
+    tier: "server",
+    popular: true,
+    features: features.map((f, i) => ({ ...f, included: i < 3 })),
+  },
+  {
+    name: "Enterprise",
+    tier: "enterprise",
+    features: features.map((f) => ({ ...f, included: true })),
+  },
+];
+
+/**
+ * Table comparing feature availability across plan tiers.
+ */
+const meta: Meta<typeof FeatureComparisonTable> = {
+  title: "Config/Plan/FeatureComparisonTable",
+  component: FeatureComparisonTable,
+  parameters: { layout: "padded" },
+  args: {
+    plans,
+    currentTier: "free",
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** When the current tier is enterprise, the "Popular" badge is suppressed on the Server plan. */
+export const CurrentTierEnterprise: Story = {
+  args: { currentTier: "enterprise" },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.stories.tsx
new file mode 100644
index 0000000000..742ad93910
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.stories.tsx
@@ -0,0 +1,130 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import PlanCard from "@app/components/shared/config/configSections/plan/PlanCard";
+import type { PlanTierGroup } from "@app/services/licenseService";
+
+const freePlanGroup: PlanTierGroup = {
+  tier: "free",
+  name: "Free",
+  monthly: {
+    id: "free",
+    name: "Free",
+    price: 0,
+    currency: "$",
+    period: "month",
+    features: [],
+    highlights: ["Basic PDF tools", "Community support"],
+    lookupKey: "selfhosted:free",
+  },
+  yearly: null,
+  features: [],
+  highlights: ["Basic PDF tools", "Community support"],
+  popular: false,
+};
+
+const serverPlanGroup: PlanTierGroup = {
+  tier: "server",
+  name: "Server",
+  monthly: {
+    id: "server-monthly",
+    name: "Server",
+    price: 29,
+    currency: "$",
+    period: "month",
+    features: [],
+    highlights: ["Unlimited users", "Priority support", "SSO"],
+    lookupKey: "selfhosted:server:monthly",
+  },
+  yearly: {
+    id: "server-yearly",
+    name: "Server",
+    price: 290,
+    currency: "$",
+    period: "year",
+    features: [],
+    highlights: ["Unlimited users", "Priority support", "SSO"],
+    lookupKey: "selfhosted:server:yearly",
+  },
+  features: [],
+  highlights: ["Unlimited users", "Priority support", "SSO"],
+  popular: true,
+};
+
+const enterprisePlanGroup: PlanTierGroup = {
+  tier: "enterprise",
+  name: "Enterprise",
+  monthly: {
+    id: "enterprise-monthly",
+    name: "Enterprise",
+    price: 0,
+    currency: "$",
+    period: "month",
+    seatPrice: 12,
+    requiresSeats: true,
+    features: [],
+    highlights: ["Dedicated support", "Custom SLAs", "Advanced security"],
+    lookupKey: "selfhosted:enterprise:monthly",
+  },
+  yearly: {
+    id: "enterprise-yearly",
+    name: "Enterprise",
+    price: 0,
+    currency: "$",
+    period: "year",
+    seatPrice: 120,
+    requiresSeats: true,
+    features: [],
+    highlights: ["Dedicated support", "Custom SLAs", "Advanced security"],
+    lookupKey: "selfhosted:enterprise:yearly",
+  },
+  features: [],
+  highlights: ["Dedicated support", "Custom SLAs", "Advanced security"],
+  popular: false,
+};
+
+const meta = {
+  title: "Config/Plan/PlanCard",
+  component: PlanCard,
+  parameters: { layout: "padded" },
+  args: {
+    planGroup: serverPlanGroup,
+    isCurrentTier: false,
+    isDowngrade: false,
+    onUpgradeClick: () => {},
+  },
+} satisfies Meta<typeof PlanCard>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** Free tier plan, shown as a permanently-included option. */
+export const FreePlan: Story = {
+  args: {
+    planGroup: freePlanGroup,
+  },
+};
+
+/** Enterprise tier, priced per-seat and blocked until the Server plan is active. */
+export const EnterprisePlan: Story = {
+  args: {
+    planGroup: enterprisePlanGroup,
+    currentTier: "free",
+  },
+};
+
+/** The plan the user already owns, showing the "Manage" action and seat count. */
+export const CurrentTier: Story = {
+  args: {
+    planGroup: serverPlanGroup,
+    isCurrentTier: true,
+    currentTier: "server",
+    currentLicenseInfo: {
+      licenseType: "SERVER",
+      enabled: true,
+      maxUsers: 25,
+      hasKey: true,
+    },
+    onManageClick: () => {},
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsChart.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsChart.stories.tsx
new file mode 100644
index 0000000000..e7fed1a275
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsChart.stories.tsx
@@ -0,0 +1,28 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import UsageAnalyticsChart from "@app/components/shared/config/configSections/usage/UsageAnalyticsChart";
+
+/**
+ * Bar chart summarising endpoint usage counts.
+ */
+const meta: Meta<typeof UsageAnalyticsChart> = {
+  title: "Config/Usage/UsageAnalyticsChart",
+  component: UsageAnalyticsChart,
+  parameters: { layout: "padded" },
+  args: {
+    data: [
+      { label: "/api/v1/pdf/merge", value: 482 },
+      { label: "/api/v1/pdf/split", value: 317 },
+      { label: "/api/v1/pdf/compress", value: 210 },
+      { label: "/api/v1/pdf/convert-to-pdf", value: 96 },
+    ],
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** No usage data yet available. */
+export const Empty: Story = {
+  args: { data: [] },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsTable.stories.tsx b/frontend/editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsTable.stories.tsx
new file mode 100644
index 0000000000..3d7d6e2e4f
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsTable.stories.tsx
@@ -0,0 +1,32 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import UsageAnalyticsTable from "@app/components/shared/config/configSections/usage/UsageAnalyticsTable";
+import type { EndpointStatistic } from "@app/services/usageAnalyticsService";
+
+const ENDPOINTS: EndpointStatistic[] = [
+  { endpoint: "/api/v1/general/merge-pdfs", visits: 1284, percentage: 34.12 },
+  {
+    endpoint: "/api/v1/security/remove-password",
+    visits: 842,
+    percentage: 22.36,
+  },
+  { endpoint: "/api/v1/convert/pdf-to-word", visits: 601, percentage: 15.97 },
+  { endpoint: "/api/v1/misc/compress-pdf", visits: 388, percentage: 10.31 },
+];
+
+const meta = {
+  title: "Config/Usage/UsageAnalyticsTable",
+  component: UsageAnalyticsTable,
+  parameters: { layout: "padded" },
+  args: {
+    data: ENDPOINTS,
+  },
+} satisfies Meta<typeof UsageAnalyticsTable>;
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+/** No usage recorded yet renders an empty-state row instead of the table body. */
+export const Empty: Story = {
+  args: { data: [] },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/StripeCheckout.stories.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/StripeCheckout.stories.tsx
new file mode 100644
index 0000000000..8d25b6b33e
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/StripeCheckout.stories.tsx
@@ -0,0 +1,58 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import StripeCheckout from "@app/components/shared/stripeCheckout/StripeCheckout";
+import type { PlanTierGroup } from "@app/services/licenseService";
+
+const PLAN_GROUP: PlanTierGroup = {
+  tier: "server",
+  name: "Server",
+  monthly: {
+    id: "server-monthly",
+    name: "Server Monthly",
+    price: 29,
+    currency: "usd",
+    period: "monthly",
+    features: [],
+    highlights: ["Unlimited documents", "Priority support"],
+    lookupKey: "selfhosted:server:monthly",
+  },
+  yearly: {
+    id: "server-yearly",
+    name: "Server Yearly",
+    price: 290,
+    currency: "usd",
+    period: "yearly",
+    features: [],
+    highlights: ["Unlimited documents", "Priority support", "2 months free"],
+    lookupKey: "selfhosted:server:yearly",
+  },
+  features: [],
+  highlights: ["Unlimited documents", "Priority support"],
+};
+
+/**
+ * The multi-stage Stripe checkout modal (email -> plan selection -> payment -> success/error).
+ */
+const meta: Meta<typeof StripeCheckout> = {
+  title: "StripeCheckout/StripeCheckout",
+  component: StripeCheckout,
+  parameters: { layout: "fullscreen" },
+  args: {
+    opened: true,
+    onClose: () => {},
+    planGroup: PLAN_GROUP,
+    minimumSeats: 1,
+  },
+};
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const HostedCheckoutSuccess: Story = {
+  args: {
+    hostedCheckoutSuccess: {
+      isUpgrade: false,
+      licenseKey: "STIRLING-XXXX-XXXX-XXXX",
+    },
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/components/PriceDisplay.stories.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/components/PriceDisplay.stories.tsx
new file mode 100644
index 0000000000..b69dc3d9bd
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/components/PriceDisplay.stories.tsx
@@ -0,0 +1,47 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PriceDisplay } from "@app/components/shared/stripeCheckout/components/PriceDisplay";
+
+/**
+ * Renders a plan's price, either a simple single price or an enterprise
+ * base/seat/total breakdown.
+ */
+const meta = {
+  title: "StripeCheckout/PriceDisplay",
+  component: PriceDisplay,
+  parameters: { layout: "centered" },
+} satisfies Meta<typeof PriceDisplay>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Simple: Story = {
+  args: {
+    mode: "simple",
+    price: 999,
+    currency: "usd",
+    period: "per month",
+  },
+};
+
+export const Enterprise: Story = {
+  args: {
+    mode: "enterprise",
+    basePrice: 4999,
+    seatPrice: 1500,
+    currency: "usd",
+    period: "month",
+  },
+};
+
+export const EnterpriseWithTotal: Story = {
+  args: {
+    mode: "enterprise",
+    basePrice: 4999,
+    seatPrice: 1500,
+    totalPrice: 19999,
+    currency: "usd",
+    period: "year",
+    seatCount: 10,
+    size: "lg",
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/components/PricingBadge.stories.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/components/PricingBadge.stories.tsx
new file mode 100644
index 0000000000..2b85605458
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/components/PricingBadge.stories.tsx
@@ -0,0 +1,35 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { PricingBadge } from "@app/components/shared/stripeCheckout/components/PricingBadge";
+
+/**
+ * The small badge overlaid on pricing plan cards (current plan, popular, savings).
+ */
+const meta = {
+  title: "StripeCheckout/PricingBadge",
+  component: PricingBadge,
+  parameters: { layout: "centered" },
+  args: {
+    type: "current",
+    label: "Current plan",
+  },
+} satisfies Meta<typeof PricingBadge>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Current: Story = {};
+
+export const Popular: Story = {
+  args: {
+    type: "popular",
+    label: "Most popular",
+  },
+};
+
+export const Savings: Story = {
+  args: {
+    type: "savings",
+    label: "Save 20%",
+    savingsPercent: 20,
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.stories.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.stories.tsx
new file mode 100644
index 0000000000..a428aca099
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.stories.tsx
@@ -0,0 +1,35 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { EmailStage } from "@app/components/shared/stripeCheckout/stages/EmailStage";
+
+/**
+ * The email-collection step of the Stripe checkout flow.
+ */
+const meta = {
+  title: "StripeCheckout/EmailStage",
+  component: EmailStage,
+  parameters: { layout: "centered" },
+  args: {
+    emailInput: "",
+    setEmailInput: () => {},
+    emailError: "",
+    onSubmit: () => {},
+  },
+} satisfies Meta<typeof EmailStage>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Filled: Story = {
+  args: {
+    emailInput: "jane@example.com",
+  },
+};
+
+export const WithError: Story = {
+  args: {
+    emailInput: "not-an-email",
+    emailError: "Please enter a valid email address",
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/ErrorStage.stories.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/ErrorStage.stories.tsx
new file mode 100644
index 0000000000..e0e7e082f8
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/ErrorStage.stories.tsx
@@ -0,0 +1,27 @@
+import type { Meta, StoryObj } from "@storybook/react";
+import { ErrorStage } from "@app/components/shared/stripeCheckout/stages/ErrorStage";
+
+/**
+ * The error state shown when a Stripe checkout attempt fails.
+ */
+const meta = {
+  title: "StripeCheckout/ErrorStage",
+  component: ErrorStage,
+  parameters: { layout: "centered" },
+  args: {
+    error: "Your card was declined. Please try a different payment method.",
+    onClose: () => {},
+  },
+} satisfies Meta<typeof ErrorStage>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const NetworkError: Story = {
+  args: {
+    error:
+      "We couldn't reach the payment provider. Please check your connection and try again.",
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PaymentStage.stories.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PaymentStage.stories.tsx
new file mode 100644
index 0000000000..8e928cfe3a
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PaymentStage.stories.tsx
@@ -0,0 +1,42 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PaymentStage } from "@app/components/shared/stripeCheckout/stages/PaymentStage";
+import type { PlanTier } from "@app/services/licenseService";
+
+const serverPlan: PlanTier = {
+  id: "server-monthly",
+  name: "Server",
+  price: 29,
+  currency: "£",
+  period: "month",
+  features: [],
+  highlights: [],
+  lookupKey: "selfhosted:server:monthly",
+};
+
+/**
+ * The payment step of the Stripe checkout flow. Renders a loading state while
+ * the checkout session is being prepared, then hands off to Stripe's
+ * embedded checkout once a client secret is available.
+ */
+const meta = {
+  title: "StripeCheckout/PaymentStage",
+  component: PaymentStage,
+  parameters: { layout: "centered" },
+  args: {
+    clientSecret: null,
+    selectedPlan: null,
+    onPaymentComplete: () => {},
+  },
+} satisfies Meta<typeof PaymentStage>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Redirecting: Story = {
+  args: {
+    clientSecret: "demo-client-secret-xxxx",
+    selectedPlan: serverPlan,
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.stories.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.stories.tsx
new file mode 100644
index 0000000000..c37e51ed53
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.stories.tsx
@@ -0,0 +1,103 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { PlanSelectionStage } from "@app/components/shared/stripeCheckout/stages/PlanSelectionStage";
+import { PlanTierGroup } from "@app/services/licenseService";
+
+/**
+ * The plan-selection step of the Stripe checkout flow, letting the user
+ * choose between monthly and yearly billing for the selected plan tier.
+ */
+const serverPlanGroup: PlanTierGroup = {
+  tier: "server",
+  name: "Server",
+  monthly: {
+    id: "server-monthly",
+    name: "Server",
+    price: 29,
+    currency: "£",
+    period: "month",
+    features: [],
+    highlights: [],
+    lookupKey: "selfhosted:server:monthly",
+  },
+  yearly: {
+    id: "server-yearly",
+    name: "Server",
+    price: 290,
+    currency: "£",
+    period: "year",
+    features: [],
+    highlights: [],
+    lookupKey: "selfhosted:server:yearly",
+  },
+  features: [],
+  highlights: [],
+};
+
+const enterprisePlanGroup: PlanTierGroup = {
+  tier: "enterprise",
+  name: "Enterprise",
+  monthly: {
+    id: "enterprise-monthly",
+    name: "Enterprise",
+    price: 499,
+    currency: "£",
+    period: "month",
+    features: [],
+    highlights: [],
+    seatPrice: 15,
+    requiresSeats: true,
+    lookupKey: "selfhosted:enterprise:monthly",
+  },
+  yearly: {
+    id: "enterprise-yearly",
+    name: "Enterprise",
+    price: 4999,
+    currency: "£",
+    period: "year",
+    features: [],
+    highlights: [],
+    seatPrice: 150,
+    requiresSeats: true,
+    lookupKey: "selfhosted:enterprise:yearly",
+  },
+  features: [],
+  highlights: [],
+};
+
+const meta = {
+  title: "StripeCheckout/PlanSelectionStage",
+  component: PlanSelectionStage,
+  args: {
+    planGroup: serverPlanGroup,
+    minimumSeats: 1,
+    savings: null,
+    onSelectPlan: () => {},
+  },
+} satisfies Meta<typeof PlanSelectionStage>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const WithSavings: Story = {
+  args: {
+    savings: {
+      amount: 58,
+      percent: 20,
+      currency: "£",
+    },
+  },
+};
+
+export const Enterprise: Story = {
+  args: {
+    planGroup: enterprisePlanGroup,
+    minimumSeats: 5,
+    savings: {
+      amount: 900,
+      percent: 15,
+      currency: "£",
+    },
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.stories.tsx b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.stories.tsx
new file mode 100644
index 0000000000..a02c9caa5c
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.stories.tsx
@@ -0,0 +1,47 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { SuccessStage } from "@app/components/shared/stripeCheckout/stages/SuccessStage";
+
+/**
+ * The success state shown after a Stripe checkout completes, including
+ * license key polling and reveal.
+ */
+const meta = {
+  title: "StripeCheckout/SuccessStage",
+  component: SuccessStage,
+  parameters: { layout: "centered" },
+  args: {
+    pollingStatus: "ready",
+    currentLicenseKey: null,
+    licenseKey: "STIRLING-XXXX-XXXX-XXXX-XXXX",
+    onClose: () => {},
+  },
+} satisfies Meta<typeof SuccessStage>;
+
+export default meta;
+type Story = StoryObj<typeof meta>;
+
+export const Default: Story = {};
+
+export const Polling: Story = {
+  args: {
+    pollingStatus: "polling",
+    currentLicenseKey: null,
+    licenseKey: null,
+  },
+};
+
+export const UpgradeComplete: Story = {
+  args: {
+    pollingStatus: "ready",
+    currentLicenseKey: "STIRLING-EXISTING-KEY",
+    licenseKey: null,
+  },
+};
+
+export const Timeout: Story = {
+  args: {
+    pollingStatus: "timeout",
+    currentLicenseKey: null,
+    licenseKey: null,
+  },
+};
diff --git a/frontend/editor/src/proprietary/components/workflow/ParticipantView.stories.tsx b/frontend/editor/src/proprietary/components/workflow/ParticipantView.stories.tsx
new file mode 100644
index 0000000000..0fdd4ab393
--- /dev/null
+++ b/frontend/editor/src/proprietary/components/workflow/ParticipantView.stories.tsx
@@ -0,0 +1,99 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { http, HttpResponse } from "msw";
+import ParticipantView from "@app/components/workflow/ParticipantView";
+import type {
+  ParticipantResponse,
+  WorkflowSessionResponse,
+} from "@app/services/workflowService";
+
+/**
+ * The signing hook (`useParticipantSession`) fires two GETs on mount —
+ * session + participant details — so every story mocks both via MSW rather
+ * than passing data through props (the component only accepts a `token`).
+ */
+function sessionHandlers(
+  session: WorkflowSessionResponse,
+  participant: ParticipantResponse,
+) {
+  return [
+    http.get("/api/v1/workflow/participant/session", () =>
+      HttpResponse.json(session),
+    ),
+    http.get("/api/v1/workflow/participant/details", () =>
+      HttpResponse.json(participant),
+    ),
+  ];
+}
+
+const baseSession: WorkflowSessionResponse = {
+  sessionId: "session-1",
+  ownerId: 1,
+  ownerUsername: "alex",
+  workflowType: "SIGNING",
+  documentName: "vendor-agreement.pdf",
+  message: "Please sign by end of week, thanks!",
+  dueDate: "2026-07-20T00:00:00Z",
+  status: "IN_PROGRESS",
+  finalized: false,
+  createdAt: "2026-07-10T09:00:00Z",
+  updatedAt: "2026-07-10T09:00:00Z",
+  participants: [],
+  hasProcessedFile: false,
+};
+
+const baseParticipant: ParticipantResponse = {
+  id: 1,
+  email: "jordan@example.com",
+  name: "Jordan",
+  status: "NOTIFIED",
+  shareToken: null,
+  accessRole: "EDITOR",
+  lastUpdated: "2026-07-10T09:00:00Z",
+  hasCompleted: false,
+  isExpired: false,
+};
+
+const meta = {
+  title: "Workflow/ParticipantView",
+  component: ParticipantView,
+  parameters: { layout: "padded" },
+  args: {
+    token: "story-participant-token",
+  },
+} satisfies Meta<typeof ParticipantView>;
+export default meta;
+
+type Story = StoryObj<typeof meta>;
+
+/** Awaiting signature: the certificate + signing form is shown. */
+export const Default: Story = {
+  parameters: {
+    msw: { handlers: sessionHandlers(baseSession, baseParticipant) },
+  },
+};
+
+/** Participant already signed: the form is replaced with a completion banner. */
+export const Completed: Story = {
+  parameters: {
+    msw: {
+      handlers: sessionHandlers(
+        { ...baseSession, status: "COMPLETED", finalized: true },
+        { ...baseParticipant, status: "SIGNED", hasCompleted: true },
+      ),
+    },
+  },
+};
+
+/** The participant's access window has passed: signing is blocked. */
+export const Expired: Story = {
+  parameters: {
+    msw: {
+      handlers: sessionHandlers(baseSession, {
+        ...baseParticipant,
+        status: "PENDING",
+        isExpired: true,
+        expiresAt: "2026-07-01T00:00:00Z",
+      }),
+    },
+  },
+};
diff --git a/frontend/package-lock.json b/frontend/package-lock.json
index f467cd4e47..86c998e997 100644
--- a/frontend/package-lock.json
+++ b/frontend/package-lock.json
@@ -94,6 +94,7 @@
         "@storybook/addon-a11y": "^9.1.20",
         "@storybook/addon-docs": "^9.1.20",
         "@storybook/addon-themes": "^9.1.20",
+        "@storybook/addon-vitest": "^9.1.20",
         "@storybook/react-vite": "^9.1.20",
         "@tauri-apps/cli": "^2.9.6",
         "@testing-library/dom": "^10.4.1",
@@ -112,6 +113,7 @@
         "@typescript-eslint/parser": "^8.61.1",
         "@typescript/native": "npm:typescript@^7.0.2",
         "@vitejs/plugin-react-swc": "^4.1.0",
+        "@vitest/browser": "^3.2.6",
         "@vitest/coverage-v8": "^3.2.4",
         "dotenv": "^16.4.7",
         "dpdm": "^3.14.0",
@@ -2962,6 +2964,13 @@
         "node": ">=18"
       }
     },
+    "node_modules/@polka/url": {
+      "version": "1.0.0-next.29",
+      "resolved": "https://registry.npmjs.org/@polka/url/-/url-1.0.0-next.29.tgz",
+      "integrity": "sha512-wwQAWhWSuHaag8c4q/KN/vCoeOJYshAIvMQwD4GpSb3OiZklFfvAgmj0VCBBImRpuF/aFgIRzllXlVX93Jevww==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@popperjs/core": {
       "version": "2.11.8",
       "resolved": "https://registry.npmjs.org/@popperjs/core/-/core-2.11.8.tgz",
@@ -3609,6 +3618,44 @@
         "storybook": "^9.1.20"
       }
     },
+    "node_modules/@storybook/addon-vitest": {
+      "version": "9.1.20",
+      "resolved": "https://registry.npmjs.org/@storybook/addon-vitest/-/addon-vitest-9.1.20.tgz",
+      "integrity": "sha512-6zN/qe9Z/7pklbUQJrnjwdTTqRG5PWy4Tyx1J90nwQq6yekj436S8/5NrvXaSns0zYNoZLsynh8nWZPweeu05w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@storybook/global": "^5.0.0",
+        "@storybook/icons": "^1.4.0",
+        "prompts": "^2.4.0",
+        "ts-dedent": "^2.2.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/storybook"
+      },
+      "peerDependencies": {
+        "@vitest/browser": "^3.0.0 || ^4.0.0",
+        "@vitest/browser-playwright": "^4.0.0",
+        "@vitest/runner": "^3.0.0 || ^4.0.0",
+        "storybook": "^9.1.20",
+        "vitest": "^3.0.0 || ^4.0.0"
+      },
+      "peerDependenciesMeta": {
+        "@vitest/browser": {
+          "optional": true
+        },
+        "@vitest/browser-playwright": {
+          "optional": true
+        },
+        "@vitest/runner": {
+          "optional": true
+        },
+        "vitest": {
+          "optional": true
+        }
+      }
+    },
     "node_modules/@storybook/builder-vite": {
       "version": "9.1.20",
       "resolved": "https://registry.npmjs.org/@storybook/builder-vite/-/builder-vite-9.1.20.tgz",
@@ -6200,6 +6247,110 @@
         "vite": "^4 || ^5 || ^6 || ^7 || ^8"
       }
     },
+    "node_modules/@vitest/browser": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/browser/-/browser-3.2.6.tgz",
+      "integrity": "sha512-CNjSynGBtAVOMTfQITv6Bc8da4/XTU1izorocbDStjUsynXcgx2FHVssh+10a8bKd/BxoqDdQtuSbYHfk302Wg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@testing-library/dom": "^10.4.0",
+        "@testing-library/user-event": "^14.6.1",
+        "@vitest/mocker": "3.2.6",
+        "@vitest/utils": "3.2.6",
+        "magic-string": "^0.30.17",
+        "sirv": "^3.0.1",
+        "tinyrainbow": "^2.0.0",
+        "ws": "^8.18.2"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "playwright": "*",
+        "vitest": "3.2.6",
+        "webdriverio": "^7.0.0 || ^8.0.0 || ^9.0.0"
+      },
+      "peerDependenciesMeta": {
+        "playwright": {
+          "optional": true
+        },
+        "safaridriver": {
+          "optional": true
+        },
+        "webdriverio": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/browser/node_modules/@vitest/mocker": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-3.2.6.tgz",
+      "integrity": "sha512-EZOrpDbkKotFAP7wPAQV1UIyoGOk4oX7ynWhBhLB7v+meMHbQhU16oPpIYGTTe4oFlhpryGpgpcZP/sin3hYuw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "3.2.6",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.17"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/browser/node_modules/@vitest/pretty-format": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-3.2.6.tgz",
+      "integrity": "sha512-lb7XXXzmm2h2ASzFnRvQpDo6onT1NmMJA3tkGTWiBFtRJ9lxGY3d3mm/Apt36gej2bkkOVLL/yTOtufDaFa/jA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/browser/node_modules/@vitest/spy": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-3.2.6.tgz",
+      "integrity": "sha512-oq6BbH68WzcWmwtBrU9nqLeaXTR4XwJF7FSLkKEZo4i6eoXcrxjcwSuTvWBIRUTC6VC72nXYunzqgZA+IKdtxg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyspy": "^4.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/browser/node_modules/@vitest/utils": {
+      "version": "3.2.6",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-3.2.6.tgz",
+      "integrity": "sha512-lI23nIs4bnT3T8NIoh+vFaz5s2/DdP0Jgt2jxwgWljvwn82cLJtyi/If+fjFyoLMGIOz0U/fKvWE0d4jsNQEfg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "3.2.6",
+        "loupe": "^3.1.4",
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
     "node_modules/@vitest/coverage-v8": {
       "version": "3.2.6",
       "resolved": "https://registry.npmjs.org/@vitest/coverage-v8/-/coverage-v8-3.2.6.tgz",
@@ -10724,6 +10875,16 @@
         "json-buffer": "3.0.1"
       }
     },
+    "node_modules/kleur": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/kleur/-/kleur-3.0.3.tgz",
+      "integrity": "sha512-eTIzlVOSUR+JxdDFepEYcBMtZ9Qqdef+rnzWdRZuMbOywu5tO2w2N7rqjoANZ5k9vywhL6Br1VRjUIgTQx4E8w==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/levn": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
@@ -12297,6 +12458,16 @@
         "ufo": "^1.6.3"
       }
     },
+    "node_modules/mrmime": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/mrmime/-/mrmime-2.0.1.tgz",
+      "integrity": "sha512-Y3wQdFg2Va6etvQ5I82yUhGdsKrcYox6p7FfL1LbK2J4V01F9TGlepTIhnK24t7koZibmg82KGglhA1XK5IsLQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=10"
+      }
+    },
     "node_modules/ms": {
       "version": "2.1.3",
       "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
@@ -13463,6 +13634,20 @@
         "node": ">=0.4.0"
       }
     },
+    "node_modules/prompts": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/prompts/-/prompts-2.4.2.tgz",
+      "integrity": "sha512-NxNv/kLguCA7p3jE8oL2aEBsrJWgAakBpgmgK6lpPWV+WuOmY6r2/zbAVnP+T8bQlA0nzHXSJSJW0Hq7ylaD2Q==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "kleur": "^3.0.3",
+        "sisteransi": "^1.0.5"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
     "node_modules/prop-types": {
       "version": "15.8.1",
       "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.8.1.tgz",
@@ -14822,6 +15007,28 @@
       "integrity": "sha512-m6UrgzFVUYawGBh1dUsWR5M2Clqic9RVXC/9f8ceNlv2IcO9j9J/z8UoCLPqtsPBFNzEpfR3xftohbfqDx8EQA==",
       "license": "MIT"
     },
+    "node_modules/sirv": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/sirv/-/sirv-3.0.2.tgz",
+      "integrity": "sha512-2wcC/oGxHis/BoHkkPwldgiPSYcpZK3JU28WoMVv55yHJgcZ8rlXvuG9iZggz+sU1d4bRgIGASwyWqjxu3FM0g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@polka/url": "^1.0.0-next.24",
+        "mrmime": "^2.0.0",
+        "totalist": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/sisteransi": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/sisteransi/-/sisteransi-1.0.5.tgz",
+      "integrity": "sha512-bLGGlR1QxBcynn2d5YmDX4MGjlZvy2MRBDRNHLJ8VI6l6+9FUiyTFNJ0IveOSP0bcXgVDPRcfGqA0pjaqUpfVg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/slash": {
       "version": "5.1.0",
       "resolved": "https://registry.npmjs.org/slash/-/slash-5.1.0.tgz",
@@ -16194,6 +16401,16 @@
         "node": ">=8.0"
       }
     },
+    "node_modules/totalist": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/totalist/-/totalist-3.0.1.tgz",
+      "integrity": "sha512-sf4i37nQ2LBx4m3wB74y+ubopq6W/dIzXg0FDGjsYnZHVa1Da8FH853wlL2gtUhg+xJXjfk3kUZS3BRoQeoQBQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
     "node_modules/tough-cookie": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.1.tgz",
diff --git a/frontend/package.json b/frontend/package.json
index 06059a3962..404366383a 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -116,6 +116,7 @@
     "@storybook/addon-a11y": "^9.1.20",
     "@storybook/addon-docs": "^9.1.20",
     "@storybook/addon-themes": "^9.1.20",
+    "@storybook/addon-vitest": "^9.1.20",
     "@storybook/react-vite": "^9.1.20",
     "@tauri-apps/cli": "^2.9.6",
     "@testing-library/dom": "^10.4.1",
@@ -134,6 +135,7 @@
     "@typescript-eslint/parser": "^8.61.1",
     "@typescript/native": "npm:typescript@^7.0.2",
     "@vitejs/plugin-react-swc": "^4.1.0",
+    "@vitest/browser": "^3.2.6",
     "@vitest/coverage-v8": "^3.2.4",
     "dotenv": "^16.4.7",
     "dpdm": "^3.14.0",
diff --git a/frontend/vitest.config.ts b/frontend/vitest.config.ts
new file mode 100644
index 0000000000..f9b138bc97
--- /dev/null
+++ b/frontend/vitest.config.ts
@@ -0,0 +1,7 @@
+// Root Vitest config so the Storybook addon-vitest Testing UI (and a bare
+// `vitest` run from frontend/) discovers the Storybook browser-test project.
+// The project definition lives in .storybook/vitest.config.ts; this re-exports
+// it from the conventional root location. The editor unit tests are separate
+// (editor/vitest.config.ts, run with `vitest --root editor`).
+// eslint-disable-next-line no-restricted-imports -- config re-export; no @-alias covers .storybook/
+export { default } from "./.storybook/vitest.config";

From af1acb68d5b15eae463bf99838e34e21639ed9ac Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 10:13:07 +0100
Subject: [PATCH 099/109] build(deps): bump actions/setup-python from 6.2.0 to
 7.0.0 (#7185)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [actions/setup-python](https://github.com/actions/setup-python)
from 6.2.0 to 7.0.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/setup-python/releases">actions/setup-python's
releases</a>.</em></p>
<blockquote>
<h2>v7.0.0</h2>
<h2>What's Changed</h2>
<h3>Enhancements</h3>
<ul>
<li>Migrate to ESM and upgrade dependencies by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1330">actions/setup-python#1330</a></li>
<li>Pin SHA commits and update docs with latest versions by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1338">actions/setup-python#1338</a></li>
<li>Remove the pip-install input by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1336">actions/setup-python#1336</a></li>
</ul>
<h3>Bug Fix</h3>
<ul>
<li>Fix to Classify stderr warning messages as warnings instead of
errors in annotations by <a
href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li>Validate and retry manifest fetch to prevent silent failures by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1332">actions/setup-python#1332</a></li>
</ul>
<h3>Dependency Upgrade</h3>
<ul>
<li>Bump certifi from 2020.6.20 to 2024.7.4 in
/<strong>tests</strong>/data by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1328">actions/setup-python#1328</a></li>
<li>Remove EOL Python versions and Bumps numpy text fixture by <a
href="https://github.com/priya-kinthali"><code>@​priya-kinthali</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1333">actions/setup-python#1333</a></li>
<li>Upgrade <code>@​actions/cache</code> to 6.2.0 by <a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/lmvysakh"><code>@​lmvysakh</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1335">actions/setup-python#1335</a></li>
<li><a
href="https://github.com/philip-gai"><code>@​philip-gai</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1337">actions/setup-python#1337</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6...v7.0.0">https://github.com/actions/setup-python/compare/v6...v7.0.0</a></p>
<h2>v6.3.0</h2>
<h2>What's Changed</h2>
<h3>Enhancement</h3>
<ul>
<li>Add RHEL support and include Linux distro in cache keys by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1323">actions/setup-python#1323</a></li>
<li>Fix pip cache error handling on Windows by <a
href="https://github.com/priyagupta108"><code>@​priyagupta108</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1040">actions/setup-python#1040</a></li>
</ul>
<h3>Dependency update</h3>
<ul>
<li>Upgrade minimatch from 3.1.2 to 3.1.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1281">actions/setup-python#1281</a></li>
<li>Upgrade actions dependencies by <a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a> in
<a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li>Upgrade <code>@​actions/cache</code> to 5.1.0, log cache write
denied by <a
href="https://github.com/jasongin"><code>@​jasongin</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li>Upgrade dependency versions and test workflow configuration by <a
href="https://github.com/HarithaVattikuti"><code>@​HarithaVattikuti</code></a>
in <a
href="https://redirect.github.com/actions/setup-python/pull/1322">actions/setup-python#1322</a></li>
</ul>
<h3>Documentation</h3>
<ul>
<li>Update advanced-usage.md by <a
href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/gowridurgad"><code>@​gowridurgad</code></a>
with <a href="https://github.com/Copilot"><code>@​Copilot</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1303">actions/setup-python#1303</a></li>
<li><a href="https://github.com/jasongin"><code>@​jasongin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/1324">actions/setup-python#1324</a></li>
<li><a href="https://github.com/Dunky-Z"><code>@​Dunky-Z</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/setup-python/pull/811">actions/setup-python#811</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0">https://github.com/actions/setup-python/compare/v6.2.0...v6.3.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/setup-python/commit/5fda3b95a4ea91299a34e894583c3862153e4b97"><code>5fda3b9</code></a>
Pin SHA commits and update docs with latest versions (<a
href="https://redirect.github.com/actions/setup-python/issues/1338">#1338</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/4ab7e95f05e168b4356aebde89dd84f59c283d8e"><code>4ab7e95</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/setup-python/issues/1337">#1337</a>
from actions/philip-gai/bump-actions-cache-6-2-0</li>
<li><a
href="https://github.com/actions/setup-python/commit/0f3a009f475dbea83c0371cd85d099690fee8c5c"><code>0f3a009</code></a>
Remove the pip-install input (<a
href="https://redirect.github.com/actions/setup-python/issues/1336">#1336</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/f8cf4291c8b8e273ddd26e569454615c7315d932"><code>f8cf429</code></a>
Migrate to ESM and upgrade dependencies (<a
href="https://redirect.github.com/actions/setup-python/issues/1330">#1330</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/54baeea5b34417d10a7479663a23cca53ea209b5"><code>54baeea</code></a>
Validate and retry manifest fetch to prevent silent failures (<a
href="https://redirect.github.com/actions/setup-python/issues/1332">#1332</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/c7092773a316760f4ecfe498e4af668a4dafeac5"><code>c709277</code></a>
Annotation code fix (<a
href="https://redirect.github.com/actions/setup-python/issues/1335">#1335</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/6849080452e69b330395e8a6d23cf90f56d76a1a"><code>6849080</code></a>
remove EOL Python versions and Bumps numpy text fixture (<a
href="https://redirect.github.com/actions/setup-python/issues/1333">#1333</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/0903b469fbf4441aadfe4f4b249dc5b1fba3a73e"><code>0903b46</code></a>
Bump certifi from 2020.6.20 to 2024.7.4 in /<strong>tests</strong>/data
(<a
href="https://redirect.github.com/actions/setup-python/issues/1328">#1328</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/ece7cb06caefa5fff74198d8649806c4678c61a1"><code>ece7cb0</code></a>
Fix pip cache error handling on Windows. (<a
href="https://redirect.github.com/actions/setup-python/issues/1040">#1040</a>)</li>
<li><a
href="https://github.com/actions/setup-python/commit/1d18d7af5f767c1259ede05a0a5bcc30f3dcf1cf"><code>1d18d7a</code></a>
Update advanced-usage.md (<a
href="https://redirect.github.com/actions/setup-python/issues/811">#811</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/setup-python/compare/a309ff8b426b58ec0e2a45f0f869d46889d02405...5fda3b95a4ea91299a34e894583c3862153e4b97">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/setup-python&package-manager=github_actions&previous-version=6.2.0&new-version=7.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/check_toml.yml           | 2 +-
 .github/workflows/coverage-aggregate.yml   | 2 +-
 .github/workflows/docker-compose-tests.yml | 2 +-
 .github/workflows/e2e-live.yml             | 4 ++--
 .github/workflows/frontend-validation.yml  | 2 +-
 .github/workflows/sync_files_v2.yml        | 2 +-
 6 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/check_toml.yml b/.github/workflows/check_toml.yml
index b7a277f873..279e57f95d 100644
--- a/.github/workflows/check_toml.yml
+++ b/.github/workflows/check_toml.yml
@@ -196,7 +196,7 @@ jobs:
             core.exportVariable("REFERENCE_FILE", referenceFilePath);
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/coverage-aggregate.yml b/.github/workflows/coverage-aggregate.yml
index bbed57db4d..42aa971971 100644
--- a/.github/workflows/coverage-aggregate.yml
+++ b/.github/workflows/coverage-aggregate.yml
@@ -62,7 +62,7 @@ jobs:
           cache-disabled: true
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/docker-compose-tests.yml b/.github/workflows/docker-compose-tests.yml
index 2db9e5cf72..68bc1722be 100644
--- a/.github/workflows/docker-compose-tests.yml
+++ b/.github/workflows/docker-compose-tests.yml
@@ -74,7 +74,7 @@ jobs:
           sudo chmod +x /usr/local/bin/docker-compose
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies
diff --git a/.github/workflows/e2e-live.yml b/.github/workflows/e2e-live.yml
index 3a1b4e3af1..a082f89bf5 100644
--- a/.github/workflows/e2e-live.yml
+++ b/.github/workflows/e2e-live.yml
@@ -84,7 +84,7 @@ jobs:
           fi
       - name: Set up Python for coverage summary
         if: always() && steps.live-coverage.outputs.report == 'true'
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: Install defusedxml for coverage summary
@@ -124,7 +124,7 @@ jobs:
         # a summary even on backend failure, as long as some Playwright
         # tests ran far enough to dump V8 coverage.
         if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/frontend-validation.yml b/.github/workflows/frontend-validation.yml
index a539a1b7b7..0e0a35a25e 100644
--- a/.github/workflows/frontend-validation.yml
+++ b/.github/workflows/frontend-validation.yml
@@ -117,7 +117,7 @@ jobs:
         run: task frontend:test:coverage
       - name: Set up Python for coverage summary
         if: always()
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: Install defusedxml for coverage summary
diff --git a/.github/workflows/sync_files_v2.yml b/.github/workflows/sync_files_v2.yml
index 357f5d5a87..656c636e48 100644
--- a/.github/workflows/sync_files_v2.yml
+++ b/.github/workflows/sync_files_v2.yml
@@ -52,7 +52,7 @@ jobs:
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
           cache: "pip" # caching pip dependencies

From dff3101ca7d2afd108efc8746564f31955dc4cdc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 10:13:22 +0100
Subject: [PATCH 100/109] build(deps): bump pillow from 12.2.0 to 12.3.0 in
 /engine in the uv group across 1 directory (#7119)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the uv group with 1 update in the /engine directory:
[pillow](https://github.com/python-pillow/Pillow).

Updates `pillow` from 12.2.0 to 12.3.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/python-pillow/Pillow/releases">pillow's
releases</a>.</em></p>
<blockquote>
<h2>12.3.0</h2>
<p><a
href="https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html">https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html</a></p>
<h2>Removals</h2>
<ul>
<li>Remove non-image ImageCms modes <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9697">#9697</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
</ul>
<h2>Documentation</h2>
<ul>
<li>Add release notes for SBOM and performance improvements <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Add security release notes <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9741">#9741</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Add release notes for Python 3.15 beta wheels <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9696">#9696</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>ImageFont can also be used with ImageText <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9597">#9597</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Additional guidelines for security reports <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9659">#9659</a>
[<a
href="https://github.com/wiredfool"><code>@​wiredfool</code></a>]</li>
<li>Fixed typo <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9636">#9636</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Added CVEs to 12.2.0 release notes <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9591">#9591</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Revise development support information in README <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9583">#9583</a>
[<a
href="https://github.com/aclark4life"><code>@​aclark4life</code></a>]</li>
<li>Add INCIDENT_RESPONSE.md <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9555">#9555</a>
[<a
href="https://github.com/aclark4life"><code>@​aclark4life</code></a>]</li>
<li>Add STRIDE threat model to security docs <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9562">#9562</a>
[<a
href="https://github.com/aclark4life"><code>@​aclark4life</code></a>]</li>
<li>Add CVEs to 12.2.0 release notes <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9556">#9556</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Update README with revised security policy <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9553">#9553</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Update security policy <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9552">#9552</a>
[<a
href="https://github.com/aclark4life"><code>@​aclark4life</code></a>]</li>
<li>Update macOS tested Python versions <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9534">#9534</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
</ul>
<h2>Dependencies</h2>
<ul>
<li>Update dependency harfbuzz to v14.2.1 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9720">#9720</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update dependency mypy to v2 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9653">#9653</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update dependency cibuildwheel to v4 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9665">#9665</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update github-actions <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9655">#9655</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update dependency libavif to v1.4.2 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9652">#9652</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update dependency lcms2 to v2.19.1 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9651">#9651</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update dependency check-jsonschema to v0.37.2 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9650">#9650</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update google/oss-fuzz digest to d872252 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9614">#9614</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update dependency lcms2 to v2.19 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9609">#9609</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update dependency libpng to v1.6.58 - autoclosed <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9608">#9608</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update dependency harfbuzz to v14 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9610">#9610</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update dependency mypy to v1.20.2 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9599">#9599</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update github-actions <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9611">#9611</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Update dependency cibuildwheel to v3.4.1 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9607">#9607</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
<li>Move dependency versions to single JSON and enable Renovate <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9559">#9559</a>
[<a href="https://github.com/hugovk"><code>@​hugovk</code></a>]</li>
<li>Updated raqm to 0.10.5 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9557">#9557</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Update dependency cibuildwheel to v3.4.0 <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9532">#9532</a>
[@<a href="https://github.com/apps/renovate">renovate[bot]</a>]</li>
</ul>
<h2>Testing</h2>
<ul>
<li>Remove matrix.os from benchmark <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9735">#9735</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Remove references to libavif patch <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9734">#9734</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
<li>Add benchmark tests <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9654">#9654</a>
[<a href="https://github.com/akx"><code>@​akx</code></a>]</li>
<li>Use reshape() instead of setting NumPy array shape directly <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9728">#9728</a>
[<a
href="https://github.com/radarhere"><code>@​radarhere</code></a>]</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d"><code>bb1d8e8</code></a>
12.3.0 version bump</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af"><code>e63fc48</code></a>
Add release notes for SBOM and performance improvements (<a
href="https://redirect.github.com/python-pillow/Pillow/issues/9747">#9747</a>)</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054"><code>13b701b</code></a>
Add release notes for <a
href="https://redirect.github.com/python-pillow/Pillow/issues/9679">#9679</a></li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364"><code>5564ca7</code></a>
List methods</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b"><code>a0920fd</code></a>
Speed up ImageChops operations (<a
href="https://redirect.github.com/python-pillow/Pillow/issues/9738">#9738</a>)</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc"><code>07e9a6c</code></a>
Speed up <code>Image.filter()</code> (<a
href="https://redirect.github.com/python-pillow/Pillow/issues/9736">#9736</a>)</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50"><code>a94578c</code></a>
Speed up <code>Image.getchannel()</code>, <code>Image.merge()</code>,
<code>Image.putalpha()</code> and `Image...</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb"><code>53e02c4</code></a>
Speed up <code>Image.fill()</code>, <code>Image.linear_gradient()</code>
and `Image.radial_gradient...</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6"><code>af03747</code></a>
Speed up <code>Image.resample()</code> (<a
href="https://redirect.github.com/python-pillow/Pillow/issues/9739">#9739</a>)</li>
<li><a
href="https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571"><code>5c9ca56</code></a>
Speed up <code>alpha_composite</code>, <code>matrix</code>,
<code>negative</code>, <code>quantize</code> (<a
href="https://redirect.github.com/python-pillow/Pillow/issues/9740">#9740</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/python-pillow/Pillow/compare/12.2.0...12.3.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pillow&package-manager=uv&previous-version=12.2.0&new-version=12.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/Stirling-Tools/Stirling-PDF/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 engine/uv.lock | 108 +++++++++++++++++++++++++------------------------
 1 file changed, 56 insertions(+), 52 deletions(-)

diff --git a/engine/uv.lock b/engine/uv.lock
index 5e9d166af0..258c38b3de 100644
--- a/engine/uv.lock
+++ b/engine/uv.lock
@@ -2059,60 +2059,64 @@ wheels = [
 
 [[package]]
 name = "pillow"
-version = "12.2.0"
+version = "12.3.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/8c/21/c2bcdd5906101a30244eaffc1b6e6ce71a31bd0742a01eb89e660ebfac2d/pillow-12.2.0.tar.gz", hash = "sha256:a830b1a40919539d07806aa58e1b114df53ddd43213d9c8b75847eee6c0182b5", size = 46987819, upload-time = "2026-04-01T14:46:17.687Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1c/3d/bb7fca845737cf9d7dbde16ed1843984665ff2e0a518f5db43e77ec540b9/pillow-12.3.0.tar.gz", hash = "sha256:3b8182a766685eaa002637e28b4ec8d6b18819a0c71f579bf0dbaa5830297cce", size = 47025035, upload-time = "2026-07-01T11:56:38.965Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/4a/01/53d10cf0dbad820a8db274d259a37ba50b88b24768ddccec07355382d5ad/pillow-12.2.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:8297651f5b5679c19968abefd6bb84d95fe30ef712eb1b2d9b2d31ca61267f4c", size = 4100837, upload-time = "2026-04-01T14:43:41.506Z" },
-    { url = "https://files.pythonhosted.org/packages/0f/98/f3a6657ecb698c937f6c76ee564882945f29b79bad496abcba0e84659ec5/pillow-12.2.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:50d8520da2a6ce0af445fa6d648c4273c3eeefbc32d7ce049f22e8b5c3daecc2", size = 4176528, upload-time = "2026-04-01T14:43:43.773Z" },
-    { url = "https://files.pythonhosted.org/packages/69/bc/8986948f05e3ea490b8442ea1c1d4d990b24a7e43d8a51b2c7d8b1dced36/pillow-12.2.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:766cef22385fa1091258ad7e6216792b156dc16d8d3fa607e7545b2b72061f1c", size = 3640401, upload-time = "2026-04-01T14:43:45.87Z" },
-    { url = "https://files.pythonhosted.org/packages/34/46/6c717baadcd62bc8ed51d238d521ab651eaa74838291bda1f86fe1f864c9/pillow-12.2.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:5d2fd0fa6b5d9d1de415060363433f28da8b1526c1c129020435e186794b3795", size = 5308094, upload-time = "2026-04-01T14:43:48.438Z" },
-    { url = "https://files.pythonhosted.org/packages/71/43/905a14a8b17fdb1ccb58d282454490662d2cb89a6bfec26af6d3520da5ec/pillow-12.2.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:56b25336f502b6ed02e889f4ece894a72612fe885889a6e8c4c80239ff6e5f5f", size = 4695402, upload-time = "2026-04-01T14:43:51.292Z" },
-    { url = "https://files.pythonhosted.org/packages/73/dd/42107efcb777b16fa0393317eac58f5b5cf30e8392e266e76e51cff28c3d/pillow-12.2.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f1c943e96e85df3d3478f7b691f229887e143f81fedab9b20205349ab04d73ed", size = 6280005, upload-time = "2026-04-01T14:43:54.242Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/68/b93e09e5e8549019e61acf49f65b1a8530765a7f812c77a7461bca7e4494/pillow-12.2.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:03f6fab9219220f041c74aeaa2939ff0062bd5c364ba9ce037197f4c6d498cd9", size = 8090669, upload-time = "2026-04-01T14:43:57.335Z" },
-    { url = "https://files.pythonhosted.org/packages/4b/6e/3ccb54ce8ec4ddd1accd2d89004308b7b0b21c4ac3d20fa70af4760a4330/pillow-12.2.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5cdfebd752ec52bf5bb4e35d9c64b40826bc5b40a13df7c3cda20a2c03a0f5ed", size = 6395194, upload-time = "2026-04-01T14:43:59.864Z" },
-    { url = "https://files.pythonhosted.org/packages/67/ee/21d4e8536afd1a328f01b359b4d3997b291ffd35a237c877b331c1c3b71c/pillow-12.2.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:eedf4b74eda2b5a4b2b2fb4c006d6295df3bf29e459e198c90ea48e130dc75c3", size = 7082423, upload-time = "2026-04-01T14:44:02.74Z" },
-    { url = "https://files.pythonhosted.org/packages/78/5f/e9f86ab0146464e8c133fe85df987ed9e77e08b29d8d35f9f9f4d6f917ba/pillow-12.2.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:00a2865911330191c0b818c59103b58a5e697cae67042366970a6b6f1b20b7f9", size = 6505667, upload-time = "2026-04-01T14:44:05.381Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/1e/409007f56a2fdce61584fd3acbc2bbc259857d555196cedcadc68c015c82/pillow-12.2.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:1e1757442ed87f4912397c6d35a0db6a7b52592156014706f17658ff58bbf795", size = 7208580, upload-time = "2026-04-01T14:44:08.39Z" },
-    { url = "https://files.pythonhosted.org/packages/23/c4/7349421080b12fb35414607b8871e9534546c128a11965fd4a7002ccfbee/pillow-12.2.0-cp313-cp313-win32.whl", hash = "sha256:144748b3af2d1b358d41286056d0003f47cb339b8c43a9ea42f5fea4d8c66b6e", size = 6375896, upload-time = "2026-04-01T14:44:11.197Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/82/8a3739a5e470b3c6cbb1d21d315800d8e16bff503d1f16b03a4ec3212786/pillow-12.2.0-cp313-cp313-win_amd64.whl", hash = "sha256:390ede346628ccc626e5730107cde16c42d3836b89662a115a921f28440e6a3b", size = 7081266, upload-time = "2026-04-01T14:44:13.947Z" },
-    { url = "https://files.pythonhosted.org/packages/c3/25/f968f618a062574294592f668218f8af564830ccebdd1fa6200f598e65c5/pillow-12.2.0-cp313-cp313-win_arm64.whl", hash = "sha256:8023abc91fba39036dbce14a7d6535632f99c0b857807cbbbf21ecc9f4717f06", size = 2463508, upload-time = "2026-04-01T14:44:16.312Z" },
-    { url = "https://files.pythonhosted.org/packages/4d/a4/b342930964e3cb4dce5038ae34b0eab4653334995336cd486c5a8c25a00c/pillow-12.2.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:042db20a421b9bafecc4b84a8b6e444686bd9d836c7fd24542db3e7df7baad9b", size = 5309927, upload-time = "2026-04-01T14:44:18.89Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/de/23198e0a65a9cf06123f5435a5d95cea62a635697f8f03d134d3f3a96151/pillow-12.2.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:dd025009355c926a84a612fecf58bb315a3f6814b17ead51a8e48d3823d9087f", size = 4698624, upload-time = "2026-04-01T14:44:21.115Z" },
-    { url = "https://files.pythonhosted.org/packages/01/a6/1265e977f17d93ea37aa28aa81bad4fa597933879fac2520d24e021c8da3/pillow-12.2.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:88ddbc66737e277852913bd1e07c150cc7bb124539f94c4e2df5344494e0a612", size = 6321252, upload-time = "2026-04-01T14:44:23.663Z" },
-    { url = "https://files.pythonhosted.org/packages/3c/83/5982eb4a285967baa70340320be9f88e57665a387e3a53a7f0db8231a0cd/pillow-12.2.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:d362d1878f00c142b7e1a16e6e5e780f02be8195123f164edf7eddd911eefe7c", size = 8126550, upload-time = "2026-04-01T14:44:26.772Z" },
-    { url = "https://files.pythonhosted.org/packages/4e/48/6ffc514adce69f6050d0753b1a18fd920fce8cac87620d5a31231b04bfc5/pillow-12.2.0-cp313-cp313t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2c727a6d53cb0018aadd8018c2b938376af27914a68a492f59dfcaca650d5eea", size = 6433114, upload-time = "2026-04-01T14:44:29.615Z" },
-    { url = "https://files.pythonhosted.org/packages/36/a3/f9a77144231fb8d40ee27107b4463e205fa4677e2ca2548e14da5cf18dce/pillow-12.2.0-cp313-cp313t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:efd8c21c98c5cc60653bcb311bef2ce0401642b7ce9d09e03a7da87c878289d4", size = 7115667, upload-time = "2026-04-01T14:44:32.773Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/fc/ac4ee3041e7d5a565e1c4fd72a113f03b6394cc72ab7089d27608f8aaccb/pillow-12.2.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9f08483a632889536b8139663db60f6724bfcb443c96f1b18855860d7d5c0fd4", size = 6538966, upload-time = "2026-04-01T14:44:35.252Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/a8/27fb307055087f3668f6d0a8ccb636e7431d56ed0750e07a60547b1e083e/pillow-12.2.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:dac8d77255a37e81a2efcbd1fc05f1c15ee82200e6c240d7e127e25e365c39ea", size = 7238241, upload-time = "2026-04-01T14:44:37.875Z" },
-    { url = "https://files.pythonhosted.org/packages/ad/4b/926ab182c07fccae9fcb120043464e1ff1564775ec8864f21a0ebce6ac25/pillow-12.2.0-cp313-cp313t-win32.whl", hash = "sha256:ee3120ae9dff32f121610bb08e4313be87e03efeadfc6c0d18f89127e24d0c24", size = 6379592, upload-time = "2026-04-01T14:44:40.336Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/c4/f9e476451a098181b30050cc4c9a3556b64c02cf6497ea421ac047e89e4b/pillow-12.2.0-cp313-cp313t-win_amd64.whl", hash = "sha256:325ca0528c6788d2a6c3d40e3568639398137346c3d6e66bb61db96b96511c98", size = 7085542, upload-time = "2026-04-01T14:44:43.251Z" },
-    { url = "https://files.pythonhosted.org/packages/00/a4/285f12aeacbe2d6dc36c407dfbbe9e96d4a80b0fb710a337f6d2ad978c75/pillow-12.2.0-cp313-cp313t-win_arm64.whl", hash = "sha256:2e5a76d03a6c6dcef67edabda7a52494afa4035021a79c8558e14af25313d453", size = 2465765, upload-time = "2026-04-01T14:44:45.996Z" },
-    { url = "https://files.pythonhosted.org/packages/bf/98/4595daa2365416a86cb0d495248a393dfc84e96d62ad080c8546256cb9c0/pillow-12.2.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:3adc9215e8be0448ed6e814966ecf3d9952f0ea40eb14e89a102b87f450660d8", size = 4100848, upload-time = "2026-04-01T14:44:48.48Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/79/40184d464cf89f6663e18dfcf7ca21aae2491fff1a16127681bf1fa9b8cf/pillow-12.2.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:6a9adfc6d24b10f89588096364cc726174118c62130c817c2837c60cf08a392b", size = 4176515, upload-time = "2026-04-01T14:44:51.353Z" },
-    { url = "https://files.pythonhosted.org/packages/b0/63/703f86fd4c422a9cf722833670f4f71418fb116b2853ff7da722ea43f184/pillow-12.2.0-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:6a6e67ea2e6feda684ed370f9a1c52e7a243631c025ba42149a2cc5934dec295", size = 3640159, upload-time = "2026-04-01T14:44:53.588Z" },
-    { url = "https://files.pythonhosted.org/packages/71/e0/fb22f797187d0be2270f83500aab851536101b254bfa1eae10795709d283/pillow-12.2.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:2bb4a8d594eacdfc59d9e5ad972aa8afdd48d584ffd5f13a937a664c3e7db0ed", size = 5312185, upload-time = "2026-04-01T14:44:56.039Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/8c/1a9e46228571de18f8e28f16fabdfc20212a5d019f3e3303452b3f0a580d/pillow-12.2.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:80b2da48193b2f33ed0c32c38140f9d3186583ce7d516526d462645fd98660ae", size = 4695386, upload-time = "2026-04-01T14:44:58.663Z" },
-    { url = "https://files.pythonhosted.org/packages/70/62/98f6b7f0c88b9addd0e87c217ded307b36be024d4ff8869a812b241d1345/pillow-12.2.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:22db17c68434de69d8ecfc2fe821569195c0c373b25cccb9cbdacf2c6e53c601", size = 6280384, upload-time = "2026-04-01T14:45:01.5Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/03/688747d2e91cfbe0e64f316cd2e8005698f76ada3130d0194664174fa5de/pillow-12.2.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:7b14cc0106cd9aecda615dd6903840a058b4700fcb817687d0ee4fc8b6e389be", size = 8091599, upload-time = "2026-04-01T14:45:04.5Z" },
-    { url = "https://files.pythonhosted.org/packages/f6/35/577e22b936fcdd66537329b33af0b4ccfefaeabd8aec04b266528cddb33c/pillow-12.2.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8cbeb542b2ebc6fcdacabf8aca8c1a97c9b3ad3927d46b8723f9d4f033288a0f", size = 6396021, upload-time = "2026-04-01T14:45:07.117Z" },
-    { url = "https://files.pythonhosted.org/packages/11/8d/d2532ad2a603ca2b93ad9f5135732124e57811d0168155852f37fbce2458/pillow-12.2.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4bfd07bc812fbd20395212969e41931001fd59eb55a60658b0e5710872e95286", size = 7083360, upload-time = "2026-04-01T14:45:09.763Z" },
-    { url = "https://files.pythonhosted.org/packages/5e/26/d325f9f56c7e039034897e7380e9cc202b1e368bfd04d4cbe6a441f02885/pillow-12.2.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:9aba9a17b623ef750a4d11b742cbafffeb48a869821252b30ee21b5e91392c50", size = 6507628, upload-time = "2026-04-01T14:45:12.378Z" },
-    { url = "https://files.pythonhosted.org/packages/5f/f7/769d5632ffb0988f1c5e7660b3e731e30f7f8ec4318e94d0a5d674eb65a4/pillow-12.2.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:deede7c263feb25dba4e82ea23058a235dcc2fe1f6021025dc71f2b618e26104", size = 7209321, upload-time = "2026-04-01T14:45:15.122Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/7a/c253e3c645cd47f1aceea6a8bacdba9991bf45bb7dfe927f7c893e89c93c/pillow-12.2.0-cp314-cp314-win32.whl", hash = "sha256:632ff19b2778e43162304d50da0181ce24ac5bb8180122cbe1bf4673428328c7", size = 6479723, upload-time = "2026-04-01T14:45:17.797Z" },
-    { url = "https://files.pythonhosted.org/packages/cd/8b/601e6566b957ca50e28725cb6c355c59c2c8609751efbecd980db44e0349/pillow-12.2.0-cp314-cp314-win_amd64.whl", hash = "sha256:4e6c62e9d237e9b65fac06857d511e90d8461a32adcc1b9065ea0c0fa3a28150", size = 7217400, upload-time = "2026-04-01T14:45:20.529Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/94/220e46c73065c3e2951bb91c11a1fb636c8c9ad427ac3ce7d7f3359b9b2f/pillow-12.2.0-cp314-cp314-win_arm64.whl", hash = "sha256:b1c1fbd8a5a1af3412a0810d060a78b5136ec0836c8a4ef9aa11807f2a22f4e1", size = 2554835, upload-time = "2026-04-01T14:45:23.162Z" },
-    { url = "https://files.pythonhosted.org/packages/b6/ab/1b426a3974cb0e7da5c29ccff4807871d48110933a57207b5a676cccc155/pillow-12.2.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:57850958fe9c751670e49b2cecf6294acc99e562531f4bd317fa5ddee2068463", size = 5314225, upload-time = "2026-04-01T14:45:25.637Z" },
-    { url = "https://files.pythonhosted.org/packages/19/1e/dce46f371be2438eecfee2a1960ee2a243bbe5e961890146d2dee1ff0f12/pillow-12.2.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:d5d38f1411c0ed9f97bcb49b7bd59b6b7c314e0e27420e34d99d844b9ce3b6f3", size = 4698541, upload-time = "2026-04-01T14:45:28.355Z" },
-    { url = "https://files.pythonhosted.org/packages/55/c3/7fbecf70adb3a0c33b77a300dc52e424dc22ad8cdc06557a2e49523b703d/pillow-12.2.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:5c0a9f29ca8e79f09de89293f82fc9b0270bb4af1d58bc98f540cc4aedf03166", size = 6322251, upload-time = "2026-04-01T14:45:30.924Z" },
-    { url = "https://files.pythonhosted.org/packages/1c/3c/7fbc17cfb7e4fe0ef1642e0abc17fc6c94c9f7a16be41498e12e2ba60408/pillow-12.2.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:1610dd6c61621ae1cf811bef44d77e149ce3f7b95afe66a4512f8c59f25d9ebe", size = 8127807, upload-time = "2026-04-01T14:45:33.908Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/c3/a8ae14d6defd2e448493ff512fae903b1e9bd40b72efb6ec55ce0048c8ce/pillow-12.2.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0a34329707af4f73cf1782a36cd2289c0368880654a2c11f027bcee9052d35dd", size = 6433935, upload-time = "2026-04-01T14:45:36.623Z" },
-    { url = "https://files.pythonhosted.org/packages/6e/32/2880fb3a074847ac159d8f902cb43278a61e85f681661e7419e6596803ed/pillow-12.2.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8e9c4f5b3c546fa3458a29ab22646c1c6c787ea8f5ef51300e5a60300736905e", size = 7116720, upload-time = "2026-04-01T14:45:39.258Z" },
-    { url = "https://files.pythonhosted.org/packages/46/87/495cc9c30e0129501643f24d320076f4cc54f718341df18cc70ec94c44e1/pillow-12.2.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:fb043ee2f06b41473269765c2feae53fc2e2fbf96e5e22ca94fb5ad677856f06", size = 6540498, upload-time = "2026-04-01T14:45:41.879Z" },
-    { url = "https://files.pythonhosted.org/packages/18/53/773f5edca692009d883a72211b60fdaf8871cbef075eaa9d577f0a2f989e/pillow-12.2.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:f278f034eb75b4e8a13a54a876cc4a5ab39173d2cdd93a638e1b467fc545ac43", size = 7239413, upload-time = "2026-04-01T14:45:44.705Z" },
-    { url = "https://files.pythonhosted.org/packages/c9/e4/4b64a97d71b2a83158134abbb2f5bd3f8a2ea691361282f010998f339ec7/pillow-12.2.0-cp314-cp314t-win32.whl", hash = "sha256:6bb77b2dcb06b20f9f4b4a8454caa581cd4dd0643a08bacf821216a16d9c8354", size = 6482084, upload-time = "2026-04-01T14:45:47.568Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/13/306d275efd3a3453f72114b7431c877d10b1154014c1ebbedd067770d629/pillow-12.2.0-cp314-cp314t-win_amd64.whl", hash = "sha256:6562ace0d3fb5f20ed7290f1f929cae41b25ae29528f2af1722966a0a02e2aa1", size = 7225152, upload-time = "2026-04-01T14:45:50.032Z" },
-    { url = "https://files.pythonhosted.org/packages/ff/6e/cf826fae916b8658848d7b9f38d88da6396895c676e8086fc0988073aaf8/pillow-12.2.0-cp314-cp314t-win_arm64.whl", hash = "sha256:aa88ccfe4e32d362816319ed727a004423aab09c5cea43c01a4b435643fa34eb", size = 2556579, upload-time = "2026-04-01T14:45:52.529Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/ac/31fb64e1e7efb5a4b50cd3d92049ba89ac6e4d8d3bb6a74e15048ca3353e/pillow-12.3.0-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:21900ce7ba264168cd50defae43cd75d25c833ad4ad6e73ffc5596d12e25ac89", size = 4161684, upload-time = "2026-07-01T11:54:25.934Z" },
+    { url = "https://files.pythonhosted.org/packages/87/b4/9805e23d2b4d77842b468513841fda254ee42f0289d25088340e4ff46e2d/pillow-12.3.0-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:4e8c2a84d977f50b9daed6eeaf3baef67d00d5d74d932288f02cb94518ee3ace", size = 4255487, upload-time = "2026-07-01T11:54:27.935Z" },
+    { url = "https://files.pythonhosted.org/packages/df/39/ecf519435a200c693fe053a6ee4d835b41cf963a4dfc2551c4e637cb2a71/pillow-12.3.0-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:ae26d61dfa7a47befdc7572b521024e8745f3d809bd95ca9505a7bba9ef849ec", size = 3696433, upload-time = "2026-07-01T11:54:29.813Z" },
+    { url = "https://files.pythonhosted.org/packages/42/92/2fc3ffad878ae8dd5469ec1bc8eb83b71f48e13efdf68f02709003982a32/pillow-12.3.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:7a743ff716f746fc19a9557f60dab1600d4613255f8a7aeb3cdde4db7eb15a66", size = 5345889, upload-time = "2026-07-01T11:54:31.97Z" },
+    { url = "https://files.pythonhosted.org/packages/10/76/8803c13605b763d33d156c4678fc77f8443389c0c51c8aef707bb02015f4/pillow-12.3.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:d69141514cc30b774ceea5e3ed3a6635c8d8a96edf664689b890f4089111fb35", size = 4780109, upload-time = "2026-07-01T11:54:34.026Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/01/e18aff37cb0b4aac47ac90f016d347a49aca667ef97f190b06ac2aabc928/pillow-12.3.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f7401aebd7f581d7f83a439d87d474999317ee099218e5ad25d125290990ba65", size = 6263736, upload-time = "2026-07-01T11:54:36.131Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/62/de5bdd77d935331f4f802edc11e4d82950f642caad6cb2f949837b8560e2/pillow-12.3.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0847a763afefb695bc912d7c131e7e0632d4edc1d8698f58ddabec8e46b8b6d3", size = 6937129, upload-time = "2026-07-01T11:54:38.216Z" },
+    { url = "https://files.pythonhosted.org/packages/70/4d/105627a13300c5e0df1d174230b32fd1273062c96f7745fd552b945d1e1d/pillow-12.3.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:571b9fcb07b97ef3a492028fb3d2dc0993ca23a06138b0315286566d29ef718a", size = 6339562, upload-time = "2026-07-01T11:54:40.354Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/1d/f13de01a553988ab895ba1c722e06cf3144d4f57656fd5b81b6d881f1179/pillow-12.3.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:756c768d0c9c2955feb7a56c37ea24aea2e369f8d36a88da270b6a9f19e62b5e", size = 7049439, upload-time = "2026-07-01T11:54:42.489Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/f9/066794cca041b969964f779ee5fa66a9498bbf34248ac39c5d7954e4198f/pillow-12.3.0-cp313-cp313-win32.whl", hash = "sha256:a876864214e136f0eb367788dbd7df045f4806801518e2cfe9e13229cfe06d8f", size = 6473287, upload-time = "2026-07-01T11:54:44.9Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/9b/7a58e61d62be561da3a356fe2384d4059a6345fc130e23ef1c36a5b81d24/pillow-12.3.0-cp313-cp313-win_amd64.whl", hash = "sha256:1cca606cd25738df4ed873d5ad46bbdb3d83b5cbca291f6b4ff13a4df6b0bbe8", size = 7239691, upload-time = "2026-07-01T11:54:47.141Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/b0/c4ed4f0ef8f8fa5ee8351537db6650bb8189f7e118842978dd6589065692/pillow-12.3.0-cp313-cp313-win_arm64.whl", hash = "sha256:b629de27fda84b42cde7edef0d85f13b958b47f6e9bbcbba9b673c562a89bd8b", size = 2568185, upload-time = "2026-07-01T11:54:49.137Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/01/001f65b68192f0228cc1dbbc8d2530ab5d58b61037ba0587f946fea607cd/pillow-12.3.0-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:9cf95fe4d0f84c82d282745d9bb08ad9f926efa00be4697e767b814ce40d4330", size = 4161736, upload-time = "2026-07-01T11:54:51.156Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/d2/0219746d0fd16fc8a84498e79452375be3797d3ce4044596ce565164b84f/pillow-12.3.0-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:8728f216dcdb6e6d555cf971cb34076139ad74b31fc2c14da4fafc741c5f6217", size = 4255435, upload-time = "2026-07-01T11:54:53.414Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/02/8d0bc62ef0302318c46ff2a512822d2610e81c7aa46c9b3abe6cbaca5ad0/pillow-12.3.0-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:a45650e8ce7fafffd731db8550230db6b0d306d181a90b67d3e6bca2f1990930", size = 3696262, upload-time = "2026-07-01T11:54:55.739Z" },
+    { url = "https://files.pythonhosted.org/packages/85/e2/73c77d218410b14f5f2d565e8a998d5317b7b9c75368d29985139f7a46f0/pillow-12.3.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:ba54cfebe86920a559a7c4d6b9050791c20513650a1952ebe3368c7dc70306f8", size = 5350344, upload-time = "2026-07-01T11:54:57.657Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/da/32c752228ae345f489e3a42499d817b6c3996da7e8a3bc7a04fc806b243b/pillow-12.3.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:e158cb00350dc278f3b91551101aa7d12415a66ebf2c91d8d5ac14e56ddd3ad0", size = 4780131, upload-time = "2026-07-01T11:54:59.713Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/9d/8b2c807dbef61a5197c047afe99823787eb66f63daf9fb2432f91d6f0462/pillow-12.3.0-cp314-cp314-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e9aeb04d6aef139de265b29683e119b638208f88cf73cdd1658aa07221165321", size = 6263757, upload-time = "2026-07-01T11:55:01.778Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/44/c85361f65dbe00eea8576ee467c768d25129989efb76e94f205e9ca9bb46/pillow-12.3.0-cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:251bf95b67017e27b13d82f5b326234ca62d70f9cf4c2b9032de2358a3b12c7b", size = 6936962, upload-time = "2026-07-01T11:55:03.93Z" },
+    { url = "https://files.pythonhosted.org/packages/18/7e/e483414b35800b86b6f08dbbc7803fb5cd52c4d6f897f47d53ea2c7e6f65/pillow-12.3.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:fe3cca2e4e8a592be0f269a1ca4835c25199d9f3ce815c8491048f785b0a0198", size = 6339171, upload-time = "2026-07-01T11:55:05.989Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/f4/68c491844841ede6bed70189546b3ee9731cf9f2cbad396faff5e1ccba45/pillow-12.3.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:23aceaa007d6172b02c277f0cd359c79492bbb14f7072b4ede9fbcaf20648130", size = 7048116, upload-time = "2026-07-01T11:55:08.131Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/34/77f3f793fed8efc7d243f21b33c5a3f0d1c97ee70346d3db855587e155ff/pillow-12.3.0-cp314-cp314-win32.whl", hash = "sha256:af8d94b0db561cf68b88a267c5c44b49e134f525d0dc2cb7ed413a66bc23559a", size = 6467209, upload-time = "2026-07-01T11:55:10.408Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/e0/492879f69d94f91f60fc8cd05ba03650e9520afebb2fb7aa12777d7c7f38/pillow-12.3.0-cp314-cp314-win_amd64.whl", hash = "sha256:fdafc9cce40277e0f7a0feabce0ee50dd2fa1800f3b38015e51296b5e814048d", size = 7237707, upload-time = "2026-07-01T11:55:12.745Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/ac/6b11f2875f1c2ac040d84e1bbf9cf22a88038f901ca1037898b280b38365/pillow-12.3.0-cp314-cp314-win_arm64.whl", hash = "sha256:e91206ee562682b51b98ef4b26a6ef48fd84e15fd4c4bc5ec768eb641d206838", size = 2565995, upload-time = "2026-07-01T11:55:14.736Z" },
+    { url = "https://files.pythonhosted.org/packages/52/69/c2208e56af9bfc1913afb24020297a691eb1d4ef688474c8a04913f65e04/pillow-12.3.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:164b31cd1a0490ab6efae01aa5df49da7061be0af1b30e035b6e9a1bfe34ee6e", size = 5352503, upload-time = "2026-07-01T11:55:17.076Z" },
+    { url = "https://files.pythonhosted.org/packages/07/70/e5686d753e898a45d778ff1718dba8516ead6ab6b95d85fc8c4b70650cf2/pillow-12.3.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:5afb51d599ea772b8365ae807ae557f18bccfe46ab261fd1c2a9ed700fc6eb17", size = 4782956, upload-time = "2026-07-01T11:55:19.448Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/37/25c6692f06927ee973ff18c8d9ee98ad0b4d84ee67a09610c2dd1447958e/pillow-12.3.0-cp314-cp314t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3edce1d53195db527e0191f84b71d02022de0540bf43a16ed734ed7537b07385", size = 6322855, upload-time = "2026-07-01T11:55:21.613Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/91/420637fcb8f1bc11029e403b4538e6694744428d8246118e45719f944556/pillow-12.3.0-cp314-cp314t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bf16ba1b4d0b6b7c8e534936632270cf70eb00dbe09005bc345b2677b726855c", size = 6989642, upload-time = "2026-07-01T11:55:24.006Z" },
+    { url = "https://files.pythonhosted.org/packages/10/08/b94d7811281ccf0d143a1cf768d1c49e1e54af63e7b708ab2ee3eb87face/pillow-12.3.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:24870b09b224f7ae3c39ed07d10e819d06f8720bc551847b1d623832b5b0e28d", size = 6391281, upload-time = "2026-07-01T11:55:26.252Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/87/24233f785f55474dc02ce3e739c5528a77e3a862e9333d1dd7a25cc31f70/pillow-12.3.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:30f2aa603c41533cc25c05acd0da21636e84a315768feb631c937177db558931", size = 7096716, upload-time = "2026-07-01T11:55:28.318Z" },
+    { url = "https://files.pythonhosted.org/packages/23/26/fcb2f6e37175b04f53570b59937867e2b80ee1685e744023153028fc14f9/pillow-12.3.0-cp314-cp314t-win32.whl", hash = "sha256:4b0a7fe987b14c31ebda6083f74f22b561fd3739bc0ac51e019622e3d72668c7", size = 6474125, upload-time = "2026-07-01T11:55:30.956Z" },
+    { url = "https://files.pythonhosted.org/packages/90/de/3634abee5f1c9e13c56787b7d5517b0ba8d6de51700b95578cf338349c9f/pillow-12.3.0-cp314-cp314t-win_amd64.whl", hash = "sha256:962864dc93511324d51ddbb5b9f8731bf71675b93ca612a07441896f4688fb8c", size = 7242939, upload-time = "2026-07-01T11:55:34.044Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/2a/fd13f8eb24de5714a6eb444a3d67e2842c6c576e159a43793adf23051351/pillow-12.3.0-cp314-cp314t-win_arm64.whl", hash = "sha256:0740a512dc522224c77d9aa5a8d70d8b7d73fb91f2c21125d8d025d3b8990e45", size = 2567506, upload-time = "2026-07-01T11:55:35.988Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/dc/8fdce34ec725a33c81c6ba122b904d6b9024e50ea9ac7bede62fab54506c/pillow-12.3.0-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:0feb2e9d6ad6c9e3c06effe9d00f3f1e618a6643273576b016f591e9315a7139", size = 4162063, upload-time = "2026-07-01T11:55:37.941Z" },
+    { url = "https://files.pythonhosted.org/packages/76/66/2044b9a63d3b84ff048228dfcb7cd9bf0df983e8470971bf7d4c57b693de/pillow-12.3.0-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:9e881fca225083806662a5c43d627d215f258ff43c890f831966c7d7ba9c7402", size = 4255549, upload-time = "2026-07-01T11:55:40.022Z" },
+    { url = "https://files.pythonhosted.org/packages/52/7e/1f67e6f4ece6b582ee4b539decbcc9f848dc245a93ed8cd7338bafef72f1/pillow-12.3.0-cp315-cp315-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:4998562bf62a445225f22e07c896bb04b35b1b1f2eb6d760584c9c51d7a5f78c", size = 3696331, upload-time = "2026-07-01T11:55:41.98Z" },
+    { url = "https://files.pythonhosted.org/packages/12/40/d306fc2c8e4d45d7f175c77edca7063be7b86fe7fe6e68f4353bf71d808c/pillow-12.3.0-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:dc624f6bc473dacdf7ef7eb8678d0d08edf15cd94fad6ae5c7d6cc67a4e4902f", size = 5350370, upload-time = "2026-07-01T11:55:44.028Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/44/668fb1437e8ce420f62d6106eb66e44a5971602a4d794615bdf79315d82d/pillow-12.3.0-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:71d6097b330eea8fd15097780c8e89cb1a8ce7838669f48c5bacd6f663dd4701", size = 4780147, upload-time = "2026-07-01T11:55:46.073Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/08/93fa2e70e30a2d81547e481b6ee2bb9522117221fb1e0ce4b5df70967677/pillow-12.3.0-cp315-cp315-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:28ce87c5ab450a9dd970b52e5aca5fe63ed432d18a2eaddd1979a00a1ba24ace", size = 6273659, upload-time = "2026-07-01T11:55:48.264Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/6d/043e96ff814fc31a33077e4cba86082167db520c93632afdf2042febbb0c/pillow-12.3.0-cp315-cp315-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6b02afb9b97f65fbca5f31db6a2a3ba21aa93030225f150fa3f249717e938fb4", size = 6947439, upload-time = "2026-07-01T11:55:50.503Z" },
+    { url = "https://files.pythonhosted.org/packages/af/92/ba71d2ee2ac0edf3fa33bd9d5ee9ee080da70b1766f3ca3934f9938ddac9/pillow-12.3.0-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:1182d52bc2d5e5d7d0949503aa7e36d12f42205dc287e4883f407b1988820d39", size = 6353577, upload-time = "2026-07-01T11:55:52.697Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/ce/e63064e2122923ff687c8ad792d0d736a7b3920a56a46982e81a7fdd25d6/pillow-12.3.0-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:e795b7eb908249c4e43c7c99fac7c2c75dab0c43566e37db472a355f63693d71", size = 7060394, upload-time = "2026-07-01T11:55:55.149Z" },
+    { url = "https://files.pythonhosted.org/packages/54/76/a09cc3ccc8d773a7283d34c38bec1708f9e3cc932093cbc4c5e71ac4060b/pillow-12.3.0-cp315-cp315-win32.whl", hash = "sha256:57b3d78c95ba9059768b10e28b813002261d3f3dfc55cc48b0c988f625175827", size = 6467375, upload-time = "2026-07-01T11:55:57.769Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/03/1846c49ba3b1d5550392a4bbd06d6fb4578e1cd91a803198b5c90f5f7d53/pillow-12.3.0-cp315-cp315-win_amd64.whl", hash = "sha256:fa4ecea169a355be7a3ade2c783e2ed12f0e40d2c5621cda8b3297faf7fbb9f5", size = 7237048, upload-time = "2026-07-01T11:55:59.975Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/bb/89f35dcc79610423f9f195504d7def7f0d1416a711541b42867e25fe3412/pillow-12.3.0-cp315-cp315-win_arm64.whl", hash = "sha256:877c3f311ff35410f690861c4409e7ccbf0cd2f878e50628a28e5a0bb689e658", size = 2566006, upload-time = "2026-07-01T11:56:02.143Z" },
+    { url = "https://files.pythonhosted.org/packages/30/88/707027ba09942dfa2c28759b5c222d769290a41c6d20ea60ec250801941f/pillow-12.3.0-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:e9871b1ffbfa9656b60aeee92ed5136a5742696006fa322b29ea3d8da0ecc9cf", size = 5352509, upload-time = "2026-07-01T11:56:04.2Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/6d/00352fa25332c2569cd387851f568cc5a4b75a9adbfb37ac4fbce4c02eec/pillow-12.3.0-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:53aa02d20d10c3d814d536aa4e5ac9b84ca0ff5a88377963b085ad6822f93e64", size = 4783167, upload-time = "2026-07-01T11:56:06.631Z" },
+    { url = "https://files.pythonhosted.org/packages/13/4f/9e049dfa21af7c22427275720e2490267ba8138120add5c4c574deb69782/pillow-12.3.0-cp315-cp315t-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:446c34dcc4324b084a53b705127dc15717b22c5e140ae0a3c38349d4efec071e", size = 6329237, upload-time = "2026-07-01T11:56:08.868Z" },
+    { url = "https://files.pythonhosted.org/packages/36/16/cf6eeaae8d0fce8dd390a33437cf68c5d5bd73834a2bc6e2f14efda0ab45/pillow-12.3.0-cp315-cp315t-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:cf1845d02ad822a369a49f2bb9345b1614744267682e7a03527dc3bf6eea1777", size = 6997047, upload-time = "2026-07-01T11:56:11.379Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/69/dbf769bdd55f48bf5733cac28edc6364ffaa072ec9ba336266e4fe66be55/pillow-12.3.0-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:186941b6aef820ad110fb01fb06eb925374dc3a21b17e37ec9a53b250c6fe2d1", size = 6400440, upload-time = "2026-07-01T11:56:13.908Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/e1/ffc9cfc2eea0d178da8018e18e959301ad9d6bc9f3edb7181e748a474b97/pillow-12.3.0-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:f13c32a3abd6079a66d9526e18dad9b6d280384d49d7c54040cd57b6424041d9", size = 7105895, upload-time = "2026-07-01T11:56:16.575Z" },
+    { url = "https://files.pythonhosted.org/packages/18/f0/a5595c1e8c3ae44b9828cb2f0fa8155e5095ef04d6327b8f61cf44a3df85/pillow-12.3.0-cp315-cp315t-win32.whl", hash = "sha256:1657923d2d45afb66526e5b933e5b3052e6bdea196c90d3abb2424e18c77dae8", size = 6474384, upload-time = "2026-07-01T11:56:18.855Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/04/62bcd9f844984c5938d3b05264a61d797a29d3e0812341a8204af70bbdee/pillow-12.3.0-cp315-cp315t-win_amd64.whl", hash = "sha256:8cd2f7bdda092d99c9fc2fb7391354f306d01443d22785d0cbfafa2e2c8bb418", size = 7243537, upload-time = "2026-07-01T11:56:21.214Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/68/1f3066acedf37673694a7141381d8f811ae97f30d34413d236abe7d489f1/pillow-12.3.0-cp315-cp315t-win_arm64.whl", hash = "sha256:06ff022112bc9cbf83b60f8e028d94ad87b60621706487e65f673de61610ab59", size = 2567491, upload-time = "2026-07-01T11:56:23.506Z" },
 ]
 
 [[package]]

From e05b7f12dadacc1aa545a57daca12043eff87d90 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 10:13:30 +0100
Subject: [PATCH 101/109] build(deps): bump madrapps/jacoco-report from 1.7.2
 to 1.8.0 (#6750)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[madrapps/jacoco-report](https://github.com/madrapps/jacoco-report) from
1.7.2 to 1.8.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/madrapps/jacoco-report/releases">madrapps/jacoco-report's
releases</a>.</em></p>
<blockquote>
<h2>v1.8.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Bump <code>@​tsconfig/node20</code> from 20.1.4 to 20.1.9 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/289">Madrapps/jacoco-report#289</a></li>
<li>Bump eslint-plugin-n from 17.15.1 to 18.0.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/290">Madrapps/jacoco-report#290</a></li>
<li>Bump webpack from 5.95.0 to 5.107.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/291">Madrapps/jacoco-report#291</a></li>
<li>Bump eslint-plugin-import from 2.31.0 to 2.32.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/292">Madrapps/jacoco-report#292</a></li>
<li>Bump picomatch from 2.3.1 to 2.3.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/301">Madrapps/jacoco-report#301</a></li>
<li>Bump brace-expansion by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/300">Madrapps/jacoco-report#300</a></li>
<li>Bump <code>@​eslint/eslintrc</code> from 3.1.0 to 3.3.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/295">Madrapps/jacoco-report#295</a></li>
<li>Bump flatted from 3.2.7 to 3.4.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/298">Madrapps/jacoco-report#298</a></li>
<li>Bump ts-jest from 29.2.5 to 29.4.11 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/296">Madrapps/jacoco-report#296</a></li>
<li>Bump eslint-plugin-jest from 28.8.3 to 29.15.2 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/297">Madrapps/jacoco-report#297</a></li>
<li>Bump typescript-eslint from 8.32.0 to 8.60.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/303">Madrapps/jacoco-report#303</a></li>
<li>Bump prettier from 3.3.3 to 3.8.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/306">Madrapps/jacoco-report#306</a></li>
<li>Bump <code>@​types/node</code> from 22.10.2 to 25.9.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/307">Madrapps/jacoco-report#307</a></li>
<li>Bump webpack-cli from 5.1.4 to 7.0.3 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/308">Madrapps/jacoco-report#308</a></li>
<li>Bump <code>@​octokit/plugin-paginate-rest</code> by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/311">Madrapps/jacoco-report#311</a></li>
<li>Bump <code>@​octokit/request</code> by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/312">Madrapps/jacoco-report#312</a></li>
<li>Bump octokit from 4.0.2 to 5.0.5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/309">Madrapps/jacoco-report#309</a></li>
<li>Bump globals from 15.14.0 to 17.6.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/317">Madrapps/jacoco-report#317</a></li>
<li>Bump <code>@​octokit/request-error</code> from 5.1.0 to 5.1.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/319">Madrapps/jacoco-report#319</a></li>
<li>Bump eslint-plugin-promise from 7.1.0 to 7.3.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/314">Madrapps/jacoco-report#314</a></li>
<li>Update dependencies - Node 24 by <a
href="https://github.com/thsaravana"><code>@​thsaravana</code></a> in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/320">Madrapps/jacoco-report#320</a></li>
<li>Release 1.8.0 by <a
href="https://github.com/thsaravana"><code>@​thsaravana</code></a> in <a
href="https://redirect.github.com/Madrapps/jacoco-report/pull/321">Madrapps/jacoco-report#321</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Madrapps/jacoco-report/compare/v1.7.2...v1.8.0">https://github.com/Madrapps/jacoco-report/compare/v1.7.2...v1.8.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Madrapps/jacoco-report/commit/e51ce1f46f7f8b5331593f935e59cbaf44b84920"><code>e51ce1f</code></a>
Release 1.8.0 (<a
href="https://redirect.github.com/madrapps/jacoco-report/issues/321">#321</a>)</li>
<li><a
href="https://github.com/Madrapps/jacoco-report/commit/6e277c5e84a92823f9f2bedb98bcfc654f853b5d"><code>6e277c5</code></a>
Update dependencies - Node 24 (<a
href="https://redirect.github.com/madrapps/jacoco-report/issues/320">#320</a>)</li>
<li><a
href="https://github.com/Madrapps/jacoco-report/commit/8cd82edaad1cb66dce2fff04423d033d155731aa"><code>8cd82ed</code></a>
Bump eslint-plugin-promise from 7.1.0 to 7.3.0 (<a
href="https://redirect.github.com/madrapps/jacoco-report/issues/314">#314</a>)</li>
<li><a
href="https://github.com/Madrapps/jacoco-report/commit/fe40aed5b33ed6a74a74baf1b971ae8902dd4c80"><code>fe40aed</code></a>
Bump <code>@​octokit/request-error</code> from 5.1.0 to 5.1.1 (<a
href="https://redirect.github.com/madrapps/jacoco-report/issues/319">#319</a>)</li>
<li><a
href="https://github.com/Madrapps/jacoco-report/commit/fcffed9b340a2cb027a7491558945cb355e1389b"><code>fcffed9</code></a>
Bump globals from 15.14.0 to 17.6.0 (<a
href="https://redirect.github.com/madrapps/jacoco-report/issues/317">#317</a>)</li>
<li><a
href="https://github.com/Madrapps/jacoco-report/commit/97271b3031bbbea3c5b1708491a31c42c306f27d"><code>97271b3</code></a>
Bump octokit from 4.0.2 to 5.0.5 (<a
href="https://redirect.github.com/madrapps/jacoco-report/issues/309">#309</a>)</li>
<li><a
href="https://github.com/Madrapps/jacoco-report/commit/775c401329b49ebb8d018ca14e863ef4523ffc5f"><code>775c401</code></a>
Bump <code>@​octokit/request</code> (<a
href="https://redirect.github.com/madrapps/jacoco-report/issues/312">#312</a>)</li>
<li><a
href="https://github.com/Madrapps/jacoco-report/commit/a4d5c6ab9c2794fd73f6e9511b18d3d9978c0a7b"><code>a4d5c6a</code></a>
Bump <code>@​octokit/plugin-paginate-rest</code> (<a
href="https://redirect.github.com/madrapps/jacoco-report/issues/311">#311</a>)</li>
<li><a
href="https://github.com/Madrapps/jacoco-report/commit/566870688b61542ffbf72a8a55b9f72b61c9212f"><code>5668706</code></a>
Bump webpack-cli from 5.1.4 to 7.0.3 (<a
href="https://redirect.github.com/madrapps/jacoco-report/issues/308">#308</a>)</li>
<li><a
href="https://github.com/Madrapps/jacoco-report/commit/7783a4ed10087d6b5dda9f32211ff2d2db9896fa"><code>7783a4e</code></a>
Bump <code>@​types/node</code> from 22.10.2 to 25.9.1 (<a
href="https://redirect.github.com/madrapps/jacoco-report/issues/307">#307</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/madrapps/jacoco-report/compare/50d3aff4548aa991e6753342d9ba291084e63848...e51ce1f46f7f8b5331593f935e59cbaf44b84920">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=madrapps/jacoco-report&package-manager=github_actions&previous-version=1.7.2&new-version=1.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

You can trigger a rebase of this PR by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

> **Note**
> Automatic rebases have been disabled on this pull request as it has
been open for over 30 days.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/backend-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/backend-build.yml b/.github/workflows/backend-build.yml
index 28974a5ff6..0479f91f0e 100644
--- a/.github/workflows/backend-build.yml
+++ b/.github/workflows/backend-build.yml
@@ -241,7 +241,7 @@ jobs:
         # so skip it for merge_group runs and workflow_dispatch.
         if: github.event_name == 'pull_request'
         id: jacoco
-        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848 # v1.7.2
+        uses: madrapps/jacoco-report@e51ce1f46f7f8b5331593f935e59cbaf44b84920 # v1.8.0
         with:
           paths: |
             ${{ github.workspace }}/**/build/reports/jacoco/test/jacocoTestReport.xml

From 66b80a80c0b5a4d9c0eed4a225428b1a62cba4c8 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Wed, 29 Jul 2026 10:31:47 +0100
Subject: [PATCH 102/109] fix(saas): personal teams must be allowed to share a
 name (new signups get no team) (#7180)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## The bug

Every SaaS signup after the very first one is created with `team_id =
NULL`, no team membership and no `home_team_id`. A brand-new account:

```
user_id | username               | team_id | authenticationtype | home_team_id | memberships
    952 | hedewot627@candaba.com | null    | web                | null         | null
```

Since #7070 derives Processor access from leading a team, these accounts
are silently redirected out of the Processor and back to the editor.

## Cause

`SaasTeamService.createPersonalTeam` names every personal team the
literal `"My Team"`, and `stirling_pdf.teams.name` was unique — so the
insert throws a duplicate-key error for the second account onwards. Team
creation is best-effort (caught, logged at WARN), so the account is
created anyway, permanently team-less.

Migration `20251211000000` had already dropped that constraint for
exactly this reason, but it dropped it **by name** while the entity
still declared `@Column(unique = true)`. With Flyway retired for `:saas`
(#7100), `ddl-auto=update` reconciles the schema — so Hibernate
re-created the constraint on the next boot under a generated name the
old `DROP` could never match.

The data bug predates #7070; that PR only made it visible.

## Changes

- **`Team.name` no longer unique.** `TeamController` already enforces
uniqueness for admin-created teams (`existsByNameIgnoreCase` on create
and rename, 409), so nothing user-facing changes. `findByName` is only
used for the `Default`/`Internal` system teams.
- **Existing team-less accounts recover on authentication.** Signup is
the only other place a team is assigned and nothing back-fills
`team_id`, so without this they stay locked out. Guests excluded by
design; healthy accounts short-circuit on a null check (`team` is
`EAGER`).
- **Tests:** team recovered, existing team untouched, guest stays
team-less.

## Deploy order

Needs `20260806000000_teams_name_drop_unique` (SaaS repo, `v3`) to drop
the constraint from the live schema — **deployed after this**, or
Hibernate re-adds it on the next boot.

## Verification

`:saas:compileJava`, `:proprietary:compileJava`, spotless on both, and
the `:saas` team/auth-filter tests (`TeamRecovery`: 3 tests, 0
failures).
---
 .../software/proprietary/model/Team.java      |  4 +-
 .../SupabaseAuthenticationFilter.java         | 24 +++++-
 .../SupabaseAuthenticationFilterMoreTest.java | 74 +++++++++++++++++++
 3 files changed, 100 insertions(+), 2 deletions(-)

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java b/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java
index 0009ee386e..a54959b0ff 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/model/Team.java
@@ -29,7 +29,9 @@ public class Team implements Serializable {
     @Column(name = "team_id")
     private Long id;
 
-    @Column(name = "name", unique = true, nullable = false)
+    // Not unique: SaaS personal teams all share the name "My Team". TeamController enforces
+    // uniqueness for admin-created teams.
+    @Column(name = "name", nullable = false)
     private String name;
 
     @OneToMany(mappedBy = "team", cascade = CascadeType.ALL, orphanRemoval = true)
diff --git a/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java b/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
index 890bc081a2..684e22a98f 100644
--- a/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
+++ b/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
@@ -239,7 +239,7 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
                         && !supabaseUser.isAnonymous()) {
                     user = upgradeAnonymousUser(user, supabaseUser, jwt);
                 }
-                return user;
+                return recoverMissingTeam(user);
             }
 
             return createUser(jwt, supabaseId, email, appMetadata);
@@ -406,6 +406,28 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
         return savedUser;
     }
 
+    /**
+     * Recover an account stranded without a team: signup is the only other place one is assigned,
+     * so a null team_id is otherwise permanent — and portal access derives from leading a team.
+     * Guests get none by design.
+     */
+    private User recoverMissingTeam(User user) {
+        if (user.getTeam() != null
+                || ANONYMOUS.toString().equalsIgnoreCase(user.getAuthenticationType())) {
+            return user;
+        }
+        try {
+            user.setTeam(saasTeamService.ensurePersonalTeam(user));
+            log.info("Assigned a personal team to user {} which had none", user.getId());
+        } catch (Exception e) {
+            log.warn(
+                    "Could not assign a personal team to user {}: {}",
+                    user.getId(),
+                    e.getMessage());
+        }
+        return user;
+    }
+
     private boolean apiKeyAuthenticated(HttpServletRequest request) throws AuthenticationException {
         Authentication existing = SecurityContextHolder.getContext().getAuthentication();
         if (existing != null && existing.isAuthenticated()) {
diff --git a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
index 87e100375f..3b8a0292c7 100644
--- a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
@@ -585,4 +585,78 @@ class SupabaseAuthenticationFilterMoreTest {
             verify(userService, times(1)).saveUser(any(User.class));
         }
     }
+
+    @Nested
+    @DisplayName("Team recovery for existing accounts")
+    class TeamRecovery {
+
+        private User existingWebUser(UUID supabaseId) {
+            User local = newUser("real@example.com");
+            local.setSupabaseId(supabaseId);
+            local.setAuthenticationType(AuthenticationType.WEB);
+            return local;
+        }
+
+        @Test
+        @DisplayName("an existing account with no team is given a personal team")
+        void assignsTeamWhenMissing() throws Exception {
+            UUID supabaseId = UUID.randomUUID();
+            when(jwtDecoder.decode("tok"))
+                    .thenReturn(fullJwt(supabaseId, "real@example.com", false, "email"));
+            when(supabaseUserService.getUser(supabaseId))
+                    .thenReturn(supabaseUser(supabaseId, "real@example.com", false));
+
+            User local = existingWebUser(supabaseId);
+            Team recovered = new Team();
+            when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.of(local));
+            when(saasTeamService.ensurePersonalTeam(local)).thenReturn(recovered);
+
+            bearer("tok");
+            filter.doFilter(request, response, chain);
+
+            verify(saasTeamService).ensurePersonalTeam(local);
+            assertThat(local.getTeam()).isSameAs(recovered);
+        }
+
+        @Test
+        @DisplayName("an account that already has a team is left alone")
+        void noOpWhenTeamPresent() throws Exception {
+            UUID supabaseId = UUID.randomUUID();
+            when(jwtDecoder.decode("tok"))
+                    .thenReturn(fullJwt(supabaseId, "real@example.com", false, "email"));
+            when(supabaseUserService.getUser(supabaseId))
+                    .thenReturn(supabaseUser(supabaseId, "real@example.com", false));
+
+            User local = existingWebUser(supabaseId);
+            Team existing = new Team();
+            local.setTeam(existing);
+            when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.of(local));
+
+            bearer("tok");
+            filter.doFilter(request, response, chain);
+
+            verify(saasTeamService, never()).ensurePersonalTeam(any(User.class));
+            assertThat(local.getTeam()).isSameAs(existing);
+        }
+
+        @Test
+        @DisplayName("a guest session is never given a team")
+        void guestStaysTeamless() throws Exception {
+            UUID supabaseId = UUID.randomUUID();
+            when(jwtDecoder.decode("tok")).thenReturn(fullJwt(supabaseId, null, true, "email"));
+            when(supabaseUserService.getUser(supabaseId))
+                    .thenReturn(supabaseUser(supabaseId, null, true));
+
+            User local = newUser("anon_guest");
+            local.setSupabaseId(supabaseId);
+            local.setAuthenticationType(AuthenticationType.ANONYMOUS);
+            when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.of(local));
+
+            bearer("tok");
+            filter.doFilter(request, response, chain);
+
+            verify(saasTeamService, never()).ensurePersonalTeam(any(User.class));
+            assertThat(local.getTeam()).isNull();
+        }
+    }
 }

From 999b5e5995b3e28a6511f47ce765998394437711 Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Wed, 29 Jul 2026 12:22:47 +0100
Subject: [PATCH 103/109] Add persistent outputs to Processor (#7071)

# Description of Changes
<img width="1270" height="487" alt="image"
src="https://github.com/user-attachments/assets/64894e2b-aab9-42ab-96c2-2c11ba427b52"
/>

Change policies to point towards a source for its output instead of a
dynamically defined output location for the pipeline. This allows for
easy reuse of outputs in different pipelines and makes it impossible to
break complex pipelines by accidentally updating the source but not the
output and vice versa. Also makes outputs a list to match the inputs, so
it's possible for a pipeline to output to multiple locations.

We should consider whether we want to continue calling these Sources
since they're now being used as both inputs and outputs, but that
decision is beyond the scope of this PR.

Also updates the existing S3 DB migration script and adds a new one to
migrate to the new schema. Neither of these scripts are possible with
SQL since it involves parsing and restructuring JSON. I've updated them
so that they only ever run once on startup and mark themselves as
completed.
---
 .../policy/controller/PolicyController.java   |  53 +++++--
 .../policy/engine/PolicyEngine.java           |  32 +++-
 .../policy/migration/CompletedMigration.java  |  40 +++++
 .../CompletedMigrationRepository.java         |   7 +
 .../policy/migration/CompletedMigrations.java |  18 +++
 .../InProcessCompletedMigrations.java         |  23 +++
 .../migration/JpaCompletedMigrations.java     |  38 +++++
 .../policy/model/PipelineDefinition.java      |  15 +-
 .../proprietary/policy/model/Policy.java      |  49 +++++-
 .../output/PolicyInlineOutputMigration.java   | 144 +++++++++++++++++
 .../policy/output/PolicyOutputResolver.java   |  53 +++++++
 .../overview/PolicyOverviewService.java       |  18 ++-
 .../s3/EmbeddedS3CredentialMigration.java     |  29 ++--
 .../proprietary/policy/source/Source.java     |  25 ++-
 .../policy/source/SourceController.java       |  11 +-
 .../policy/source/SourceOverviewService.java  |  12 +-
 .../policy/store/InProcessPolicyStore.java    |   1 +
 .../policy/store/JpaPolicyStore.java          |   1 +
 .../configuration/DatabaseConfig.java         |   2 +
 .../controller/PolicyControllerTest.java      |   6 +-
 .../policy/engine/PolicyEngineTest.java       |  88 ++++++++++-
 .../policy/engine/PolicyRunRegistryTest.java  |   3 +-
 .../PolicyInlineOutputMigrationTest.java      | 149 ++++++++++++++++++
 .../output/PolicyOutputResolverTest.java      |  73 +++++++++
 .../s3/EmbeddedS3CredentialMigrationTest.java |   7 +-
 .../public/locales/en-US/translation.toml     |  13 +-
 frontend/editor/src/portal/api/pipelines.ts   |  14 +-
 .../pipelines/DestinationPicker.tsx           |  62 ++++++++
 .../components/pipelines/outputModes.ts       |  10 +-
 .../src/portal/mocks/handlers/pipelines.ts    |  10 +-
 .../src/portal/views/PipelineBuilder.test.tsx | 117 +++++++-------
 .../src/portal/views/PipelineBuilder.tsx      | 147 ++++-------------
 .../services/policyPipeline.test.ts           |   2 +-
 .../proprietary/services/policyPipeline.ts    |   5 +-
 34 files changed, 1017 insertions(+), 260 deletions(-)
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigration.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigrationRepository.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigrations.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/InProcessCompletedMigrations.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/JpaCompletedMigrations.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/output/PolicyInlineOutputMigration.java
 create mode 100644 app/proprietary/src/main/java/stirling/software/proprietary/policy/output/PolicyOutputResolver.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/output/PolicyInlineOutputMigrationTest.java
 create mode 100644 app/proprietary/src/test/java/stirling/software/proprietary/policy/output/PolicyOutputResolverTest.java
 create mode 100644 frontend/editor/src/portal/components/pipelines/DestinationPicker.tsx

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
index 06172b8cbc..a34c392597 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/controller/PolicyController.java
@@ -68,6 +68,7 @@ import stirling.software.proprietary.policy.overview.PoliciesOverviewResponse;
 import stirling.software.proprietary.policy.overview.PolicyOverviewService;
 import stirling.software.proprietary.policy.progress.PolicyProgressListener;
 import stirling.software.proprietary.policy.source.EditorSource;
+import stirling.software.proprietary.policy.source.Source;
 import stirling.software.proprietary.policy.source.SourceAccessGuard;
 import stirling.software.proprietary.policy.source.SourceDocCounter;
 import stirling.software.proprietary.policy.source.SourceStore;
@@ -248,6 +249,7 @@ public class PolicyController {
         requirePolicyEditingAllowed();
         Policy owned = withStoredOutputSecrets(resolveOwnership(policy));
         requireAccessibleSources(owned);
+        requireAccessibleOutput(owned);
         try {
             policyValidator.validate(owned);
         } catch (IllegalArgumentException e) {
@@ -290,6 +292,40 @@ public class PolicyController {
         }
     }
 
+    /**
+     * A policy's output destination is a {@link Source} used as a write target: it must resolve to
+     * a source in the caller's team, so a client can neither reference a non-existent location nor
+     * reach across teams to write to another team's. The editor is virtual and has no writable
+     * location, so it can't be a destination. The config is then validated on this (request) thread
+     * so an S3 destination's connection is authorization-checked against the caller - the async
+     * delivery worker has no principal. A policy with no reference (inline / editor / one-off) has
+     * nothing to check.
+     */
+    private void requireAccessibleOutput(Policy policy) {
+        for (String outputId : policy.outputIds()) {
+            Source destination =
+                    sourceStore
+                            .get(outputId)
+                            .filter(sourceAccessGuard::canAccess)
+                            .orElseThrow(
+                                    () ->
+                                            new ResponseStatusException(
+                                                    HttpStatus.BAD_REQUEST,
+                                                    "Unknown or inaccessible output source: "
+                                                            + outputId));
+            if (EditorSource.TYPE.equals(destination.type())) {
+                throw new ResponseStatusException(
+                        HttpStatus.BAD_REQUEST,
+                        "The editor can't be used as an output destination");
+            }
+            try {
+                policyValidator.validateOutput(destination.toOutputSpec());
+            } catch (IllegalArgumentException e) {
+                throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());
+            }
+        }
+    }
+
     /**
      * Assign owner + owning team server-side. Create stamps the current user and their team; update
      * preserves the existing owner and team after verifying the policy belongs to the caller's team
@@ -323,6 +359,7 @@ public class PolicyController {
                 policy.sourceIds(),
                 policy.steps(),
                 policy.output(),
+                policy.outputIds(),
                 teamId);
     }
 
@@ -358,16 +395,7 @@ public class PolicyController {
     }
 
     private static Policy withOutput(Policy policy, OutputSpec output) {
-        return new Policy(
-                policy.id(),
-                policy.name(),
-                policy.owner(),
-                policy.enabled(),
-                policy.trigger(),
-                policy.sourceIds(),
-                policy.steps(),
-                output,
-                policy.teamId());
+        return policy.withOutput(output);
     }
 
     /**
@@ -573,8 +601,9 @@ public class PolicyController {
             // step dereferences its connection by id on a principal-less worker thread, so this
             // request thread is the only place that reference can be checked against the caller.
             policyValidator.validateSteps(definition.steps());
-            if (definition.output() != null) {
-                policyValidator.validateOutput(definition.output());
+            // Every destination is checked; an ad-hoc run with no destinations validates nothing.
+            for (OutputSpec output : definition.outputs()) {
+                policyValidator.validateOutput(output);
             }
         } catch (IllegalArgumentException e) {
             throw new ResponseStatusException(HttpStatus.BAD_REQUEST, e.getMessage());
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
index abdb69cb07..e6dce0ee7b 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/engine/PolicyEngine.java
@@ -37,6 +37,7 @@ import stirling.software.proprietary.policy.model.PolicyInputs;
 import stirling.software.proprietary.policy.model.PolicyRun;
 import stirling.software.proprietary.policy.model.WaitState;
 import stirling.software.proprietary.policy.output.OutputDelivery;
+import stirling.software.proprietary.policy.output.PolicyOutputResolver;
 import stirling.software.proprietary.policy.output.PolicyOutputSink;
 import stirling.software.proprietary.policy.progress.PolicyProgressListener;
 import stirling.software.proprietary.service.DownstreamEntitlementError;
@@ -72,6 +73,7 @@ public class PolicyEngine {
     private final FileStorage fileStorage;
     private final JobOwnershipService jobOwnershipService;
     private final List<PolicyOutputSink> outputSinks;
+    private final PolicyOutputResolver outputResolver;
     private final ResourceMonitor resourceMonitor;
     private final JobQueue jobQueue;
 
@@ -119,8 +121,14 @@ public class PolicyEngine {
         // the owner owns those outputs.
         String triggeringUser = currentActingPrincipal();
         String fileOwner = triggeringUser != null ? triggeringUser : policy.owner();
+        // Resolve the referenced output destinations live (like sourceIds), so a stored policy
+        // delivers to each of its saved Source destinations. Unreferenced policies fall back to
+        // their inline output.
+        PipelineDefinition definition =
+                new PipelineDefinition(
+                        policy.name(), policy.steps(), outputResolver.resolve(policy));
         return submitForPrincipal(
-                policy.owner(), fileOwner, policy.id(), policy.toDefinition(), inputs, listener);
+                policy.owner(), fileOwner, policy.id(), definition, inputs, listener);
     }
 
     private PolicyRunHandle submitForPrincipal(
@@ -212,13 +220,21 @@ public class PolicyEngine {
                 run.markRunning();
                 PolicyExecutionResult result =
                         stepExecutor.execute(run.getDefinition(), inputs, listener);
-                OutputSpec output = run.getDefinition().output();
-                List<ResultFile> outputs =
-                        sinkFor(output)
-                                .deliver(
-                                        new OutputDelivery(runId, run.getPolicyId()),
-                                        result.files(),
-                                        output);
+                // Deliver the run's files to every destination; no destinations means inline
+                // delivery (results stored/returned to the caller), preserving ad-hoc/AI behaviour.
+                List<OutputSpec> destinations = run.getDefinition().outputs();
+                if (destinations.isEmpty()) {
+                    destinations = List.of(OutputSpec.inline());
+                }
+                List<ResultFile> outputs = new ArrayList<>();
+                for (OutputSpec destination : destinations) {
+                    outputs.addAll(
+                            sinkFor(destination)
+                                    .deliver(
+                                            new OutputDelivery(runId, run.getPolicyId()),
+                                            result.files(),
+                                            destination));
+                }
                 taskManager.setMultipleFileResults(runId, outputs);
                 taskManager.setComplete(runId);
                 run.complete(outputs);
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigration.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigration.java
new file mode 100644
index 0000000000..9837cd4f45
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigration.java
@@ -0,0 +1,40 @@
+package stirling.software.proprietary.policy.migration;
+
+import java.io.Serializable;
+import java.time.Instant;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/**
+ * A one-time policy-subsystem migration that has finished, keyed by a stable migration id. Its
+ * presence lets a migration skip its (otherwise every-boot) scan once it has run, instead of
+ * re-scanning and finding nothing to do forever.
+ */
+@Entity
+@Table(name = "policy_completed_migrations")
+@NoArgsConstructor
+@Getter
+@Setter
+public class CompletedMigration implements Serializable {
+
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @Column(name = "id")
+    private String id;
+
+    @Column(name = "applied_at")
+    private Instant appliedAt;
+
+    public CompletedMigration(String id, Instant appliedAt) {
+        this.id = id;
+        this.appliedAt = appliedAt;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigrationRepository.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigrationRepository.java
new file mode 100644
index 0000000000..23dec902c5
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigrationRepository.java
@@ -0,0 +1,7 @@
+package stirling.software.proprietary.policy.migration;
+
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+@Repository
+public interface CompletedMigrationRepository extends JpaRepository<CompletedMigration, String> {}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigrations.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigrations.java
new file mode 100644
index 0000000000..f03defa92b
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/CompletedMigrations.java
@@ -0,0 +1,18 @@
+package stirling.software.proprietary.policy.migration;
+
+/**
+ * Tracks which one-time policy-subsystem migrations have finished, so a migration can skip its
+ * every-boot scan once done. {@link JpaCompletedMigrations} is the runtime bean; {@link
+ * InProcessCompletedMigrations} backs tests.
+ */
+public interface CompletedMigrations {
+
+    /** Whether the migration with this id has already been recorded as complete. */
+    boolean isDone(String id);
+
+    /**
+     * Record the migration as complete. Safe to call concurrently: a race on first boot leaves the
+     * marker recorded exactly once and never propagates a failure to the caller.
+     */
+    void markDone(String id);
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/InProcessCompletedMigrations.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/InProcessCompletedMigrations.java
new file mode 100644
index 0000000000..0744c85965
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/InProcessCompletedMigrations.java
@@ -0,0 +1,23 @@
+package stirling.software.proprietary.policy.migration;
+
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * In-memory {@link CompletedMigrations} for tests and any future no-database mode. {@link
+ * JpaCompletedMigrations} is the runtime bean.
+ */
+public class InProcessCompletedMigrations implements CompletedMigrations {
+
+    private final Set<String> done = ConcurrentHashMap.newKeySet();
+
+    @Override
+    public boolean isDone(String id) {
+        return done.contains(id);
+    }
+
+    @Override
+    public void markDone(String id) {
+        done.add(id);
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/JpaCompletedMigrations.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/JpaCompletedMigrations.java
new file mode 100644
index 0000000000..853e18be51
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/migration/JpaCompletedMigrations.java
@@ -0,0 +1,38 @@
+package stirling.software.proprietary.policy.migration;
+
+import java.time.Instant;
+
+import org.springframework.dao.DataIntegrityViolationException;
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+/**
+ * Durable {@link CompletedMigrations} backed by JPA; the runtime bean. {@code markDone} relies on
+ * the primary-key uniqueness of {@link CompletedMigration#getId()} to stay safe under a concurrent
+ * first boot: whichever node inserts first wins, and the loser's duplicate insert is swallowed
+ * rather than propagated, so it never disturbs the migration that called it.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class JpaCompletedMigrations implements CompletedMigrations {
+
+    private final CompletedMigrationRepository repository;
+
+    @Override
+    public boolean isDone(String id) {
+        return repository.existsById(id);
+    }
+
+    @Override
+    public void markDone(String id) {
+        try {
+            repository.save(new CompletedMigration(id, Instant.now()));
+        } catch (DataIntegrityViolationException alreadyRecorded) {
+            // A concurrent boot recorded the same marker first; the row exists, so we are done.
+            log.debug("Completion marker '{}' was already recorded concurrently", id);
+        }
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PipelineDefinition.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PipelineDefinition.java
index 146424b0fb..209756c67f 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PipelineDefinition.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/PipelineDefinition.java
@@ -3,13 +3,20 @@ package stirling.software.proprietary.policy.model;
 import java.util.List;
 
 /**
- * An ordered chain of tool steps plus an output destination; the unit the engine executes.
+ * An ordered chain of tool steps plus its output destinations; the unit the engine executes.
  *
- * <p>{@code output} may be null for callers that handle result files themselves (e.g. the AI
- * workflow, which builds its own response payload).
+ * <p>{@code outputs} may be empty for callers that handle result files themselves (e.g. the AI
+ * workflow, which builds its own response payload) - the engine then falls back to inline delivery.
+ * A run's files are delivered to every destination in the list.
  */
-public record PipelineDefinition(String name, List<PipelineStep> steps, OutputSpec output) {
+public record PipelineDefinition(String name, List<PipelineStep> steps, List<OutputSpec> outputs) {
     public PipelineDefinition {
         steps = steps == null ? List.of() : steps;
+        outputs = outputs == null ? List.of() : List.copyOf(outputs);
+    }
+
+    /** Convenience for the common single-destination (or inline) case. A null output is empty. */
+    public PipelineDefinition(String name, List<PipelineStep> steps, OutputSpec output) {
+        this(name, steps, output == null ? List.of() : List.of(output));
     }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/Policy.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/Policy.java
index 51dcc4ac0c..ae9fedc46a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/Policy.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/model/Policy.java
@@ -3,12 +3,14 @@ package stirling.software.proprietary.policy.model;
 import java.util.List;
 
 /**
- * A stored automation: ordered tool steps, input sources, and an output destination.
+ * A stored automation: ordered tool steps, input sources, and output destinations.
  *
  * <p>Always runnable on demand. An optional {@link TriggerConfig} fires it automatically; a {@code
  * null} trigger means manual-only. Trigger decides when; {@code sourceIds} reference the persisted
- * {@code Source} connections (resolved live at run time) that decide where files come from; a run
- * pulls from every referenced source.
+ * {@code Source} locations (resolved live at run time) files come from; a run pulls from every
+ * referenced source. {@code outputIds} reference the {@code Source} locations (resolved live) a
+ * run's files are delivered to - a run is delivered to every one; when empty the inline {@link
+ * #output} is used (results returned to the caller), the case for editor and one-off policies.
  */
 public record Policy(
         String id,
@@ -19,12 +21,32 @@ public record Policy(
         List<String> sourceIds,
         List<PipelineStep> steps,
         OutputSpec output,
+        List<String> outputIds,
         Long teamId) {
 
     public Policy {
         sourceIds = sourceIds == null ? List.of() : List.copyOf(sourceIds);
         steps = steps == null ? List.of() : steps;
         output = output == null ? OutputSpec.inline() : output;
+        outputIds = outputIds == null ? List.of() : List.copyOf(outputIds);
+    }
+
+    /**
+     * Without output references: the inline output is used as-is. Kept for the engine, migrations,
+     * and tests, and for editor/one-off policies that return results to the caller rather than a
+     * stored destination.
+     */
+    public Policy(
+            String id,
+            String name,
+            String owner,
+            boolean enabled,
+            TriggerConfig trigger,
+            List<String> sourceIds,
+            List<PipelineStep> steps,
+            OutputSpec output,
+            Long teamId) {
+        this(id, name, owner, enabled, trigger, sourceIds, steps, output, List.of(), teamId);
     }
 
     /**
@@ -40,7 +62,7 @@ public record Policy(
             List<String> sourceIds,
             List<PipelineStep> steps,
             OutputSpec output) {
-        this(id, name, owner, enabled, trigger, sourceIds, steps, output, null);
+        this(id, name, owner, enabled, trigger, sourceIds, steps, output, List.of(), null);
     }
 
     /** A policy with no configured sources (a generator, or files supplied directly to a run). */
@@ -52,10 +74,25 @@ public record Policy(
             TriggerConfig trigger,
             List<PipelineStep> steps,
             OutputSpec output) {
-        this(id, name, owner, enabled, trigger, List.of(), steps, output, null);
+        this(id, name, owner, enabled, trigger, List.of(), steps, output, List.of(), null);
     }
 
-    /** This policy's pipeline as the engine sees it. */
+    /** A copy with the inline output replaced (e.g. resolved for the engine, or migrated). */
+    public Policy withOutput(OutputSpec resolved) {
+        return new Policy(
+                id, name, owner, enabled, trigger, sourceIds, steps, resolved, outputIds, teamId);
+    }
+
+    /** A copy referencing the given saved output destinations. */
+    public Policy withOutputIds(List<String> newOutputIds) {
+        return new Policy(
+                id, name, owner, enabled, trigger, sourceIds, steps, output, newOutputIds, teamId);
+    }
+
+    /**
+     * This policy's pipeline as the engine sees it (inline output; destinations resolved
+     * elsewhere).
+     */
     public PipelineDefinition toDefinition() {
         return new PipelineDefinition(name, steps, output);
     }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/PolicyInlineOutputMigration.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/PolicyInlineOutputMigration.java
new file mode 100644
index 0000000000..a93b60d000
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/PolicyInlineOutputMigration.java
@@ -0,0 +1,144 @@
+package stirling.software.proprietary.policy.output;
+
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.springframework.boot.context.event.ApplicationReadyEvent;
+import org.springframework.context.event.EventListener;
+import org.springframework.core.annotation.Order;
+import org.springframework.stereotype.Component;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.policy.migration.CompletedMigrations;
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.store.PolicyStore;
+
+/**
+ * One-time, idempotent migration of policies' inline output destinations onto stored {@link Source}
+ * references: policies written before a destination was a saved location carry their folder/S3
+ * destination inline; this points each at a {@link Source} (reusing one at the same location, or
+ * creating it) so the destination becomes a managed location like any other source. Policies with
+ * an inline "return to caller" output have no location to store and are left as-is.
+ *
+ * <p>Idempotent by construction: a policy that already carries an {@code outputId} is skipped, so a
+ * sequential re-run finds nothing to do. Matches are keyed by the write-relevant config within a
+ * team, so an output to a folder/prefix an input source already covers links to that same source -
+ * unifying the "output of A is the input of B" case onto one location. A concurrent multi-node boot
+ * can at worst create a redundant (unreferenced) source row, never corrupt a policy.
+ */
+@Slf4j
+@Component
+@RequiredArgsConstructor
+public class PolicyInlineOutputMigration {
+
+    /** Completion-marker id: once recorded, later boots skip the scan entirely. */
+    private static final String MIGRATION_ID = "policy-inline-output";
+
+    // Destination types worth persisting as a location; "inline" has nothing to store.
+    private static final List<String> DESTINATION_TYPES = List.of("folder", "s3");
+    // The options that actually address a write destination, per type. Read-only options (e.g. a
+    // folder's consume mode) are excluded so an output matches an existing input source at the same
+    // place regardless of how that source reads.
+    private static final Map<String, List<String>> ADDRESS_OPTIONS =
+            Map.of("folder", List.of("directory"), "s3", List.of("connectionId", "prefix"));
+    // Field separator for the dedup key: a unit-separator control char that cannot appear in a
+    // directory/prefix/connection id, so distinct field sets can never collide.
+    private static final char DELIMITER = '\u001f';
+
+    private final PolicyStore policyStore;
+    private final SourceStore sourceStore;
+    private final CompletedMigrations completedMigrations;
+
+    // Runs after EmbeddedS3CredentialMigration (@Order(1)) so any legacy S3 output has already had
+    // its embedded credentials extracted into a connection; the Source created here then references
+    // that connection rather than copying credentials into source_json. Not wrapped in a single
+    // transaction: each store write is its own (idempotent) commit, so a crash mid-run just re-runs
+    // next boot, and the marker below is written only once the whole pass succeeds.
+    @Order(2)
+    @EventListener(ApplicationReadyEvent.class)
+    public void migrate() {
+        if (completedMigrations.isDone(MIGRATION_ID)) {
+            return;
+        }
+        Map<String, Source> byAddress = indexExistingSources();
+        int migrated = 0;
+        for (Policy policy : policyStore.all()) {
+            if (!policy.outputIds().isEmpty()) {
+                continue; // already references one or more locations
+            }
+            OutputSpec output = policy.output();
+            if (output == null || !DESTINATION_TYPES.contains(output.type())) {
+                continue; // inline / editor / no location to migrate
+            }
+            Source destination = destinationFor(policy, output, byAddress);
+            policyStore.save(policy.withOutputIds(List.of(destination.id())));
+            migrated++;
+        }
+        if (migrated > 0) {
+            log.info("Linked {} policy output(s) to stored source locations", migrated);
+        }
+        completedMigrations.markDone(MIGRATION_ID);
+    }
+
+    /** Reuses an existing team source at the same address, else creates a minimal one. */
+    private Source destinationFor(Policy policy, OutputSpec spec, Map<String, Source> byAddress) {
+        String key = addressKey(policy.teamId(), spec.type(), spec.options());
+        Source existing = byAddress.get(key);
+        if (existing != null) {
+            return existing;
+        }
+        Source created =
+                sourceStore.save(
+                        new Source(
+                                null,
+                                destinationName(spec),
+                                spec.type(),
+                                spec.options(),
+                                true,
+                                policy.owner(),
+                                policy.teamId()));
+        byAddress.put(key, created);
+        return created;
+    }
+
+    private Map<String, Source> indexExistingSources() {
+        Map<String, Source> byKey = new LinkedHashMap<>();
+        for (Source source : sourceStore.all()) {
+            if (!DESTINATION_TYPES.contains(source.type())) {
+                continue;
+            }
+            byKey.putIfAbsent(addressKey(source.teamId(), source.type(), source.options()), source);
+        }
+        return byKey;
+    }
+
+    private static String addressKey(Long teamId, String type, Map<String, Object> options) {
+        StringBuilder key = new StringBuilder();
+        key.append(teamId == null ? "" : teamId).append(DELIMITER);
+        key.append(type == null ? "" : type).append(DELIMITER);
+        for (String option : ADDRESS_OPTIONS.getOrDefault(type, List.of())) {
+            Object value = options.get(option);
+            key.append(value == null ? "" : value.toString()).append(DELIMITER);
+        }
+        return key.toString();
+    }
+
+    /** A readable default name derived from the destination; the user can rename it later. */
+    private static String destinationName(OutputSpec spec) {
+        if ("folder".equals(spec.type())) {
+            Object directory = spec.options().get("directory");
+            return directory == null ? "Folder" : "Folder: " + directory;
+        }
+        if ("s3".equals(spec.type())) {
+            Object prefix = spec.options().get("prefix");
+            return prefix == null || prefix.toString().isBlank() ? "S3 bucket" : "S3: " + prefix;
+        }
+        return spec.type();
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/PolicyOutputResolver.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/PolicyOutputResolver.java
new file mode 100644
index 0000000000..3e9d804683
--- /dev/null
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/output/PolicyOutputResolver.java
@@ -0,0 +1,53 @@
+package stirling.software.proprietary.policy.output;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.springframework.stereotype.Service;
+
+import lombok.RequiredArgsConstructor;
+import lombok.extern.slf4j.Slf4j;
+
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+
+/**
+ * Resolves a policy's effective output destinations at run time: each {@code outputId} references a
+ * {@link Source} used as a destination, looked up live (so editing a location updates every policy
+ * that writes to it), exactly as input {@code sourceIds} are resolved. A run is delivered to every
+ * resolved destination. A policy with no references keeps its inline output (results returned to
+ * the caller) - the case for editor and one-off policies. A reference that no longer resolves
+ * (location deleted out from under a live policy - normally blocked by the source delete guard) is
+ * skipped; if none resolve, delivery falls back to inline so the run still completes.
+ */
+@Slf4j
+@Service
+@RequiredArgsConstructor
+public class PolicyOutputResolver {
+
+    private final SourceStore sourceStore;
+
+    public List<OutputSpec> resolve(Policy policy) {
+        List<String> outputIds = policy.outputIds();
+        if (outputIds.isEmpty()) {
+            return List.of(policy.output());
+        }
+        List<OutputSpec> resolved = new ArrayList<>();
+        for (String outputId : outputIds) {
+            sourceStore
+                    .get(outputId)
+                    .map(Source::toOutputSpec)
+                    .ifPresentOrElse(
+                            resolved::add,
+                            () ->
+                                    log.warn(
+                                            "Policy {} references missing output source {}; skipping"
+                                                    + " that destination",
+                                            policy.id(),
+                                            outputId));
+        }
+        return resolved.isEmpty() ? List.of(policy.output()) : resolved;
+    }
+}
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java
index 117d78de40..c927ec199c 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/overview/PolicyOverviewService.java
@@ -4,6 +4,7 @@ import java.util.Comparator;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.stream.Collectors;
 
 import org.springframework.stereotype.Service;
 
@@ -75,10 +76,25 @@ public class PolicyOverviewService {
                 triggerSummary(policy.trigger()),
                 sources,
                 steps,
-                outputSummary(policy.output()),
+                outputSummary(policy, sourceNames),
                 policy.owner());
     }
 
+    /**
+     * A policy that delivers to sources shows those locations' display names, comma-joined (each
+     * falling back to its id if it's since been deleted or isn't visible); otherwise the inline
+     * output's type.
+     */
+    private static String outputSummary(Policy policy, Map<String, String> sourceNames) {
+        List<String> outputIds = policy.outputIds();
+        if (!outputIds.isEmpty()) {
+            return outputIds.stream()
+                    .map(id -> sourceNames.getOrDefault(id, id))
+                    .collect(Collectors.joining(", "));
+        }
+        return outputSummary(policy.output());
+    }
+
     /** A null trigger is a manual-only policy; otherwise the trigger's type keys the summary. */
     private static String triggerSummary(TriggerConfig trigger) {
         return trigger == null ? "manual" : trigger.type();
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
index e324cda525..bbbb9cb8b1 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigration.java
@@ -6,8 +6,8 @@ import java.util.Map;
 
 import org.springframework.boot.context.event.ApplicationReadyEvent;
 import org.springframework.context.event.EventListener;
+import org.springframework.core.annotation.Order;
 import org.springframework.stereotype.Component;
-import org.springframework.transaction.annotation.Transactional;
 
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -18,6 +18,7 @@ import stirling.software.proprietary.integration.model.IntegrationConfig;
 import stirling.software.proprietary.integration.model.IntegrationType;
 import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
 import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.policy.migration.CompletedMigrations;
 import stirling.software.proprietary.policy.model.OutputSpec;
 import stirling.software.proprietary.policy.model.Policy;
 import stirling.software.proprietary.policy.source.Source;
@@ -45,6 +46,9 @@ import tools.jackson.databind.ObjectMapper;
 @RequiredArgsConstructor
 public class EmbeddedS3CredentialMigration {
 
+    /** Completion-marker id: once recorded, later boots skip the scan entirely. */
+    private static final String MIGRATION_ID = "embedded-s3-credentials";
+
     private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
     private static final List<String> CONNECTION_OPTIONS =
             List.of("bucket", "region", "endpoint", "accessKeyId", "secretAccessKey");
@@ -56,10 +60,19 @@ public class EmbeddedS3CredentialMigration {
     private final PolicyStore policyStore;
     private final IntegrationConfigRepository connections;
     private final TeamRepository teamRepository;
+    private final CompletedMigrations completedMigrations;
 
+    // Must run before PolicyInlineOutputMigration: that migration copies a policy's inline output
+    // options into a Source, so embedded S3 credentials have to be extracted into a connection here
+    // first, or they would be copied verbatim (plaintext) into the new source row. Each rewrite is
+    // its own idempotent commit (dedup by credential key), so a crash mid-run just re-runs next
+    // boot; the completion marker below is written only once the whole pass succeeds.
+    @Order(1)
     @EventListener(ApplicationReadyEvent.class)
-    @Transactional
     public void migrate() {
+        if (completedMigrations.isDone(MIGRATION_ID)) {
+            return;
+        }
         Map<String, IntegrationConfig> byCredentialKey = indexExistingConnections();
         int migrated = 0;
         for (Source source : sourceStore.all()) {
@@ -89,6 +102,7 @@ public class EmbeddedS3CredentialMigration {
         if (migrated > 0) {
             log.info("Extracted embedded S3 credentials from {} row(s) into connections", migrated);
         }
+        completedMigrations.markDone(MIGRATION_ID);
     }
 
     private static boolean embedsCredentials(Map<String, Object> options) {
@@ -196,15 +210,6 @@ public class EmbeddedS3CredentialMigration {
     }
 
     private static Policy withOutput(Policy policy, OutputSpec output) {
-        return new Policy(
-                policy.id(),
-                policy.name(),
-                policy.owner(),
-                policy.enabled(),
-                policy.trigger(),
-                policy.sourceIds(),
-                policy.steps(),
-                output,
-                policy.teamId());
+        return policy.withOutput(output);
     }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/Source.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/Source.java
index ca80c1b46f..c064a33d9a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/Source.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/Source.java
@@ -3,14 +3,18 @@ package stirling.software.proprietary.policy.source;
 import java.util.Map;
 
 import stirling.software.proprietary.policy.model.InputSpec;
+import stirling.software.proprietary.policy.model.OutputSpec;
 
 /**
- * A persisted, reusable input connection: the instantiation of a source definition. Policies
- * reference sources by {@code id} rather than embedding their config, so one connection is
- * configured once and can feed many policies.
+ * A persisted, reusable storage location: the instantiation of a source definition. Policies
+ * reference sources by {@code id} rather than embedding their config, so one location is configured
+ * once and can be used by many policies - as an input (files come from it) and/or as an output (a
+ * run's files are delivered to it), which is how a folder or bucket can be both the output of one
+ * pipeline and the input of the next.
  *
- * <p>{@code type} keys an {@link stirling.software.proprietary.policy.input.InputSource} bean,
- * matching {@link InputSpec#type()}; {@code options} is that source's config. {@code owner} and
+ * <p>{@code type} keys an {@link stirling.software.proprietary.policy.input.InputSource} bean (and,
+ * for writable types, a {@link stirling.software.proprietary.policy.output.PolicyOutputSink}),
+ * matching {@link InputSpec#type()}; {@code options} is that location's config. {@code owner} and
  * {@code teamId} scope the source to a team, mirroring {@link
  * stirling.software.proprietary.policy.model.Policy}.
  */
@@ -27,8 +31,17 @@ public record Source(
         options = options == null ? Map.of() : options;
     }
 
-    /** The runtime form the policy engine resolves and runs against. */
+    /** The runtime form the policy engine resolves and reads inputs from. */
     public InputSpec toInputSpec() {
         return new InputSpec(type, options);
     }
+
+    /**
+     * The runtime form the policy engine delivers a run's outputs to, when this source is used as a
+     * policy's destination. Read-only options (e.g. a folder's consume mode) are simply ignored by
+     * the output sink.
+     */
+    public OutputSpec toOutputSpec() {
+        return new OutputSpec(type, options);
+    }
 }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
index 6539d9a34d..73622738f0 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceController.java
@@ -307,10 +307,17 @@ public class SourceController {
         }
     }
 
-    /** Names of the caller's visible policies that reference the given source. */
+    /**
+     * Names of the caller's visible policies that reference the given source - as an input ({@code
+     * sourceIds}) or as their output destination ({@code outputId}), so a location in use either
+     * way is protected from deletion.
+     */
     private List<String> referencingPolicyNames(String sourceId) {
         return policyAccessGuard.visibleFrom(policyStore).stream()
-                .filter(policy -> policy.sourceIds().contains(sourceId))
+                .filter(
+                        policy ->
+                                policy.sourceIds().contains(sourceId)
+                                        || policy.outputIds().contains(sourceId))
                 .map(Policy::name)
                 .toList();
     }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java
index 2c02b9f152..0f9df21440 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/source/SourceOverviewService.java
@@ -3,8 +3,10 @@ package stirling.software.proprietary.policy.source;
 import java.util.ArrayList;
 import java.util.Comparator;
 import java.util.HashMap;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 
 import org.springframework.stereotype.Service;
 
@@ -115,11 +117,17 @@ public class SourceOverviewService {
         return sources instanceof List<?> list && list.contains(EditorSource.ID);
     }
 
-    /** Policies referencing each source id, across the caller's visible policies. */
+    /**
+     * Policies referencing each source id, across the caller's visible policies. A source counts
+     * whether a policy reads from it ({@code sourceIds}) or writes to it ({@code outputId}); a
+     * policy that does both counts once.
+     */
     private static Map<String, List<Policy>> referencesBySource(List<Policy> policies) {
         Map<String, List<Policy>> bySource = new HashMap<>();
         for (Policy policy : policies) {
-            for (String sourceId : policy.sourceIds()) {
+            Set<String> referenced = new LinkedHashSet<>(policy.sourceIds());
+            referenced.addAll(policy.outputIds());
+            for (String sourceId : referenced) {
                 bySource.computeIfAbsent(sourceId, key -> new ArrayList<>()).add(policy);
             }
         }
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/InProcessPolicyStore.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/InProcessPolicyStore.java
index 685ddb21db..6498e7e28a 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/InProcessPolicyStore.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/InProcessPolicyStore.java
@@ -36,6 +36,7 @@ public class InProcessPolicyStore implements PolicyStore {
                         policy.sourceIds(),
                         policy.steps(),
                         policy.output(),
+                        policy.outputIds(),
                         policy.teamId());
         policies.put(id, stored);
         // Existing policy keeps its position; a new one appends to the end of its team's queue.
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java
index 41da23c734..1b598b88c1 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/store/JpaPolicyStore.java
@@ -44,6 +44,7 @@ public class JpaPolicyStore implements PolicyStore {
                         policy.sourceIds(),
                         policy.steps(),
                         policy.output(),
+                        policy.outputIds(),
                         policy.teamId());
 
         PolicyEntity entity = new PolicyEntity();
diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java b/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java
index a9c567885f..a5bb305e06 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/security/configuration/DatabaseConfig.java
@@ -34,6 +34,7 @@ import stirling.software.common.model.exception.UnsupportedProviderException;
             "stirling.software.proprietary.workflow.repository",
             "stirling.software.proprietary.policy.store",
             "stirling.software.proprietary.policy.source",
+            "stirling.software.proprietary.policy.migration",
             "stirling.software.proprietary.policy.ledger",
             "stirling.software.proprietary.accountlink",
             "stirling.software.proprietary.access.repository",
@@ -46,6 +47,7 @@ import stirling.software.common.model.exception.UnsupportedProviderException;
     "stirling.software.proprietary.workflow.model",
     "stirling.software.proprietary.policy.store",
     "stirling.software.proprietary.policy.source",
+    "stirling.software.proprietary.policy.migration",
     "stirling.software.proprietary.policy.ledger",
     "stirling.software.proprietary.accountlink",
     "stirling.software.proprietary.access.model",
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
index cf33de8656..351eecd581 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/controller/PolicyControllerTest.java
@@ -135,7 +135,7 @@ class PolicyControllerTest {
 
     private static PipelineDefinition definitionWithStep() {
         return new PipelineDefinition(
-                "pipe", List.of(new PipelineStep("/api/v1/misc/compress-pdf", null)), null);
+                "pipe", List.of(new PipelineStep("/api/v1/misc/compress-pdf", null)), List.of());
     }
 
     private static Policy policy(String id, Long teamId) {
@@ -190,7 +190,7 @@ class PolicyControllerTest {
         @Test
         @DisplayName("rejects a pipeline with no steps")
         void rejectsEmptyPipeline() {
-            PipelineDefinition empty = new PipelineDefinition("pipe", List.of(), null);
+            PipelineDefinition empty = new PipelineDefinition("pipe", List.of(), List.of());
 
             assertThatThrownBy(() -> controller.run(empty, new PolicyRunFiles()))
                     .isInstanceOf(ResponseStatusException.class)
@@ -241,7 +241,7 @@ class PolicyControllerTest {
         @Test
         @DisplayName("rejects a pipeline with no steps")
         void rejectsEmpty() {
-            PipelineDefinition empty = new PipelineDefinition("pipe", List.of(), null);
+            PipelineDefinition empty = new PipelineDefinition("pipe", List.of(), List.of());
 
             assertThatThrownBy(() -> controller.runStream(empty, new PolicyRunFiles()))
                     .isInstanceOf(ResponseStatusException.class);
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyEngineTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyEngineTest.java
index 78348fa5c4..e69f0f5476 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyEngineTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyEngineTest.java
@@ -15,8 +15,10 @@ import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
+import java.io.IOException;
 import java.io.InputStream;
 import java.nio.file.Path;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.CompletableFuture;
@@ -37,6 +39,7 @@ import org.springframework.http.ResponseEntity;
 import org.springframework.web.client.HttpClientErrorException;
 
 import stirling.software.common.model.ApplicationProperties;
+import stirling.software.common.model.job.ResultFile;
 import stirling.software.common.service.FileStorage;
 import stirling.software.common.service.FileStorage.StoredFile;
 import stirling.software.common.service.InternalApiClient;
@@ -55,7 +58,11 @@ import stirling.software.proprietary.policy.model.PolicyInputs;
 import stirling.software.proprietary.policy.model.PolicyRun;
 import stirling.software.proprietary.policy.model.PolicyRunStatus;
 import stirling.software.proprietary.policy.output.InlineOutputSink;
+import stirling.software.proprietary.policy.output.OutputDelivery;
+import stirling.software.proprietary.policy.output.PolicyOutputResolver;
+import stirling.software.proprietary.policy.output.PolicyOutputSink;
 import stirling.software.proprietary.policy.progress.PolicyProgressListener;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
 
 import tools.jackson.databind.json.JsonMapper;
 
@@ -81,6 +88,7 @@ class PolicyEngineTest {
 
     @TempDir Path tempDir;
 
+    private final RecordingSink recordingSink = new RecordingSink();
     private PolicyRunRegistry registry;
     private PolicyEngine engine;
 
@@ -98,6 +106,7 @@ class PolicyEngineTest {
                         JsonMapper.builder().build());
         registry = new PolicyRunRegistry(new ApplicationProperties());
         InlineOutputSink sink = new InlineOutputSink(fileStorage);
+        PolicyOutputResolver outputResolver = new PolicyOutputResolver(new InProcessSourceStore());
         engine =
                 new PolicyEngine(
                         executor,
@@ -105,7 +114,8 @@ class PolicyEngineTest {
                         registry,
                         fileStorage,
                         jobOwnershipService,
-                        List.of(sink),
+                        List.of(sink, recordingSink),
+                        outputResolver,
                         resourceMonitor,
                         jobQueue);
 
@@ -156,6 +166,36 @@ class PolicyEngineTest {
         verify(taskManager, atLeastOnce()).addNote(eq(runId), anyString());
     }
 
+    @Test
+    void deliversTheRunsFilesToEveryDestination() throws Exception {
+        when(toolMetadataService.isMultiInput(anyString())).thenReturn(false);
+        when(toolMetadataService.shouldUnpackZipResponse(anyString())).thenReturn(false);
+        stubEndpoint(COMPRESS, pdf("compressed", "out.pdf"));
+
+        // Two destinations of a recording sink; each fully reads the (shared) result file, so this
+        // also proves the result Resources are re-readable across more than one delivery.
+        PipelineDefinition definition =
+                new PipelineDefinition(
+                        "multi",
+                        List.of(new PipelineStep(COMPRESS, Map.of())),
+                        List.of(
+                                new OutputSpec("record", Map.of("dest", "a")),
+                                new OutputSpec("record", Map.of("dest", "b"))));
+
+        PolicyRun run =
+                engine.submit(
+                                definition,
+                                PolicyInputs.of(List.of(pdf("input", "input.pdf"))),
+                                PolicyProgressListener.NOOP)
+                        .completion()
+                        .get(10, TimeUnit.SECONDS);
+
+        assertEquals(PolicyRunStatus.COMPLETED, run.getStatus());
+        // One result file per destination, and each destination read the same output content.
+        assertEquals(2, run.getOutputs().size());
+        assertEquals(List.of("a:compressed", "b:compressed"), recordingSink.deliveries());
+    }
+
     @Test
     void submitFailsRunWhenAToolErrors() throws Exception {
         when(toolMetadataService.isMultiInput(ROTATE)).thenReturn(false);
@@ -385,4 +425,50 @@ class PolicyEngineTest {
             }
         };
     }
+
+    /**
+     * A test output sink (type "record") that fully reads each delivered file and records
+     * "{dest}:{content}" per file, so a test can assert the run was delivered to every destination.
+     */
+    private static final class RecordingSink implements PolicyOutputSink {
+
+        private final List<String> deliveries = new ArrayList<>();
+
+        List<String> deliveries() {
+            return deliveries;
+        }
+
+        @Override
+        public String type() {
+            return "record";
+        }
+
+        @Override
+        public boolean supports(OutputSpec spec) {
+            return spec != null && "record".equals(spec.type());
+        }
+
+        @Override
+        public List<ResultFile> deliver(
+                OutputDelivery delivery, List<Resource> outputs, OutputSpec spec)
+                throws IOException {
+            String dest = String.valueOf(spec.options().get("dest"));
+            List<ResultFile> results = new ArrayList<>();
+            for (Resource file : outputs) {
+                byte[] bytes;
+                try (InputStream is = file.getInputStream()) {
+                    bytes = is.readAllBytes();
+                }
+                deliveries.add(dest + ":" + new String(bytes));
+                results.add(
+                        ResultFile.builder()
+                                .fileId("rec-" + dest)
+                                .fileName(dest + "/" + file.getFilename())
+                                .contentType("application/pdf")
+                                .fileSize(bytes.length)
+                                .build());
+            }
+            return results;
+        }
+    }
 }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunRegistryTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunRegistryTest.java
index 1549ba62ac..0d1361c5d9 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunRegistryTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/engine/PolicyRunRegistryTest.java
@@ -95,7 +95,8 @@ class PolicyRunRegistryTest {
     }
 
     private PolicyRun register(String runId) {
-        PolicyRun run = new PolicyRun(runId, null, new PipelineDefinition(runId, List.of(), null));
+        PolicyRun run =
+                new PolicyRun(runId, null, new PipelineDefinition(runId, List.of(), List.of()));
         registry.register(run);
         return run;
     }
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/PolicyInlineOutputMigrationTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/PolicyInlineOutputMigrationTest.java
new file mode 100644
index 0000000000..082ca8cd42
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/PolicyInlineOutputMigrationTest.java
@@ -0,0 +1,149 @@
+package stirling.software.proprietary.policy.output;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+
+import stirling.software.proprietary.policy.migration.InProcessCompletedMigrations;
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.PipelineStep;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+import stirling.software.proprietary.policy.store.InProcessPolicyStore;
+import stirling.software.proprietary.policy.store.PolicyStore;
+
+/**
+ * Tests for {@link PolicyInlineOutputMigration}: policies carrying a folder/S3 destination inline
+ * are rewritten to reference a {@link Source} location by id; inline (return-to-caller) policies
+ * are left untouched; the pass is idempotent; two policies sharing a destination in one team share
+ * one source; and an output at a location an input source already covers reuses that source.
+ */
+class PolicyInlineOutputMigrationTest {
+
+    private final PolicyStore policyStore = new InProcessPolicyStore();
+    private final SourceStore sourceStore = new InProcessSourceStore();
+    private final PolicyInlineOutputMigration migration =
+            new PolicyInlineOutputMigration(
+                    policyStore, sourceStore, new InProcessCompletedMigrations());
+
+    @Test
+    void migratesAFolderPolicyToAStoredSource() {
+        Policy saved = policyStore.save(folderPolicy("Archive", "/out"));
+
+        migration.migrate();
+
+        Policy migrated = policyStore.get(saved.id()).orElseThrow();
+        assertEquals(1, migrated.outputIds().size());
+        Source destination = sourceStore.get(migrated.outputIds().get(0)).orElseThrow();
+        assertEquals("folder", destination.type());
+        assertEquals("/out", destination.options().get("directory"));
+    }
+
+    @Test
+    void leavesInlinePoliciesUntouched() {
+        Policy saved =
+                policyStore.save(
+                        new Policy(
+                                null,
+                                "Editor run",
+                                "owner",
+                                true,
+                                null,
+                                List.of(),
+                                List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
+                                OutputSpec.inline()));
+
+        migration.migrate();
+
+        assertTrue(policyStore.get(saved.id()).orElseThrow().outputIds().isEmpty());
+        assertTrue(sourceStore.all().isEmpty());
+    }
+
+    @Test
+    void isIdempotent() {
+        policyStore.save(folderPolicy("Archive", "/out"));
+
+        migration.migrate();
+        int afterFirst = sourceStore.all().size();
+        migration.migrate();
+
+        assertEquals(afterFirst, sourceStore.all().size());
+    }
+
+    @Test
+    void skipsTheScanOnceComplete() {
+        // First pass records the completion marker (even with nothing to migrate).
+        migration.migrate();
+
+        // A migratable folder policy created afterwards is left untouched: the marker means the
+        // migration never scans again, rather than re-scanning and finding it every boot.
+        Policy later = policyStore.save(folderPolicy("Late", "/late"));
+        migration.migrate();
+
+        assertTrue(policyStore.get(later.id()).orElseThrow().outputIds().isEmpty());
+        assertTrue(sourceStore.all().isEmpty());
+    }
+
+    @Test
+    void dedupesASharedDestinationWithinATeam() {
+        policyStore.save(teamFolderPolicy("A", "/shared", 7L));
+        policyStore.save(teamFolderPolicy("B", "/shared", 7L));
+
+        migration.migrate();
+
+        assertEquals(1, sourceStore.all().size());
+    }
+
+    @Test
+    void reusesAnExistingInputSourceAtTheSameLocation() {
+        // An input source already reads /shared (with consume mode); a policy that outputs there
+        // should link to that same source, not mint a duplicate.
+        Source existing =
+                sourceStore.save(
+                        new Source(
+                                null,
+                                "Shared",
+                                "folder",
+                                Map.of("directory", "/shared", "mode", "consume"),
+                                true,
+                                "owner",
+                                7L));
+        Policy saved = policyStore.save(teamFolderPolicy("Writer", "/shared", 7L));
+
+        migration.migrate();
+
+        assertEquals(1, sourceStore.all().size());
+        assertEquals(List.of(existing.id()), policyStore.get(saved.id()).orElseThrow().outputIds());
+    }
+
+    private static Policy folderPolicy(String name, String directory) {
+        return new Policy(
+                null,
+                name,
+                "owner",
+                true,
+                null,
+                List.of(),
+                List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
+                OutputSpec.folder(directory));
+    }
+
+    private static Policy teamFolderPolicy(String name, String directory, Long teamId) {
+        return new Policy(
+                null,
+                name,
+                "owner",
+                true,
+                null,
+                List.of(),
+                List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
+                OutputSpec.folder(directory),
+                teamId);
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/PolicyOutputResolverTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/PolicyOutputResolverTest.java
new file mode 100644
index 0000000000..d65c5b24f2
--- /dev/null
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/output/PolicyOutputResolverTest.java
@@ -0,0 +1,73 @@
+package stirling.software.proprietary.policy.output;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import java.util.List;
+import java.util.Map;
+
+import org.junit.jupiter.api.Test;
+
+import stirling.software.proprietary.policy.model.OutputSpec;
+import stirling.software.proprietary.policy.model.PipelineStep;
+import stirling.software.proprietary.policy.model.Policy;
+import stirling.software.proprietary.policy.source.InProcessSourceStore;
+import stirling.software.proprietary.policy.source.Source;
+import stirling.software.proprietary.policy.source.SourceStore;
+
+/**
+ * Tests for {@link PolicyOutputResolver}: a policy's {@code outputIds} resolve live to the stored
+ * sources used as destinations (one spec each), an unreferenced policy keeps its inline output, and
+ * a dangling reference falls back to inline delivery rather than failing the run.
+ */
+class PolicyOutputResolverTest {
+
+    private final SourceStore sourceStore = new InProcessSourceStore();
+    private final PolicyOutputResolver resolver = new PolicyOutputResolver(sourceStore);
+
+    @Test
+    void resolvesEachOutputIdToItsStoredSource() {
+        Source archive = sourceStore.save(folder("Archive", "/out"));
+        Source backup = sourceStore.save(folder("Backup", "/backup"));
+
+        List<OutputSpec> specs =
+                resolver.resolve(policy().withOutputIds(List.of(archive.id(), backup.id())));
+
+        assertEquals(2, specs.size());
+        assertEquals("/out", specs.get(0).options().get("directory"));
+        assertEquals("/backup", specs.get(1).options().get("directory"));
+    }
+
+    @Test
+    void anUnreferencedPolicyKeepsItsInlineOutput() {
+        List<OutputSpec> specs = resolver.resolve(policy());
+
+        assertEquals(1, specs.size());
+        assertEquals("inline", specs.get(0).type());
+    }
+
+    @Test
+    void whenNoReferencesResolveItFallsBackToInline() {
+        List<OutputSpec> specs =
+                resolver.resolve(policy().withOutputIds(List.of("does-not-exist")));
+
+        assertEquals(1, specs.size());
+        assertEquals("inline", specs.get(0).type());
+    }
+
+    private static Source folder(String name, String directory) {
+        return new Source(
+                null, name, "folder", Map.of("directory", directory), true, "owner", null);
+    }
+
+    private static Policy policy() {
+        return new Policy(
+                "p1",
+                "Pipeline",
+                "owner",
+                true,
+                null,
+                List.of(),
+                List.of(new PipelineStep("/api/v1/misc/compress-pdf", Map.of())),
+                OutputSpec.inline());
+    }
+}
diff --git a/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigrationTest.java b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigrationTest.java
index ff14d8cf81..a794ee104e 100644
--- a/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigrationTest.java
+++ b/app/proprietary/src/test/java/stirling/software/proprietary/policy/s3/EmbeddedS3CredentialMigrationTest.java
@@ -23,6 +23,7 @@ import stirling.software.proprietary.access.model.OwnerScope;
 import stirling.software.proprietary.integration.model.IntegrationConfig;
 import stirling.software.proprietary.integration.repository.IntegrationConfigRepository;
 import stirling.software.proprietary.model.Team;
+import stirling.software.proprietary.policy.migration.InProcessCompletedMigrations;
 import stirling.software.proprietary.policy.model.OutputSpec;
 import stirling.software.proprietary.policy.model.PipelineStep;
 import stirling.software.proprietary.policy.model.Policy;
@@ -49,7 +50,11 @@ class EmbeddedS3CredentialMigrationTest {
     void setUp() {
         migration =
                 new EmbeddedS3CredentialMigration(
-                        sourceStore, policyStore, connections, teamRepository);
+                        sourceStore,
+                        policyStore,
+                        connections,
+                        teamRepository,
+                        new InProcessCompletedMigrations());
         AtomicLong ids = new AtomicLong(100);
         // Lenient: the nothing-to-migrate cases never create a connection.
         lenient().when(connections.findAll()).thenReturn(List.of());
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 48677633c4..913cdf20a4 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -7771,20 +7771,16 @@ addTool = "Add tool"
 cancel = "Cancel"
 chainEmpty = "Add a tool to start building your pipeline."
 create = "Create pipeline"
-directory = "Output folder"
-directoryHelp = "Absolute path on the server. Must be within the configured allowed folders."
 editingUnsupported = "Displaying these tool params for editing is not supported yet."
 moveDown = "Move down"
 moveUp = "Move up"
 name = "Name"
 namePlaceholder = "e.g. Redaction sweep"
-noSources = "No sources connected yet. The pipeline can still run on files supplied to it directly."
 noToolSettings = "This tool has no configurable settings."
 operations_one = "Operation ({{count}})"
 operations_other = "Operations ({{count}})"
-output = "Output"
+output = "Destinations"
 removeStep = "Remove operation"
-s3PrefixHelp = "Outputs are uploaded under this key prefix."
 save = "Save changes"
 scheduleEvery = "Run every"
 sources = "Sources"
@@ -7819,11 +7815,6 @@ active = "Active"
 paused = "Paused"
 total = "Pipelines"
 
-[portal.pipelines.output]
-folder = "Write to folder"
-inline = "Return files"
-s3 = "Write to Amazon S3"
-
 [portal.pipelines.run]
 allProcessed_one = "Nothing to run: the source's {{count}} document has already been processed."
 allProcessed_other = "Nothing to run: all {{count}} documents in the sources have already been processed."
@@ -8704,7 +8695,7 @@ confirm = "Delete"
 title = "Delete source?"
 
 [portal.sources.empty]
-description = "Connect a folder (and, soon, cloud storage) so your policies have somewhere to pull documents from."
+description = "Connect a storage location so your policies have somewhere to pull data from."
 title = "No sources connected yet"
 
 [portal.sources.kpi]
diff --git a/frontend/editor/src/portal/api/pipelines.ts b/frontend/editor/src/portal/api/pipelines.ts
index e75711b912..2a4f25b79e 100644
--- a/frontend/editor/src/portal/api/pipelines.ts
+++ b/frontend/editor/src/portal/api/pipelines.ts
@@ -29,8 +29,8 @@ export interface OutputSpec {
   options: Record<string, unknown>;
 }
 
-/** The output destinations the pipeline builder can offer. */
-export type PipelineOutputMode = "inline" | "folder" | "s3";
+/** Source types that can be written to (used as a pipeline's output destination). */
+export type PipelineOutputMode = "folder" | "s3";
 
 /**
  * The stored policy record: the create/update body (`id` blank on create) and what
@@ -45,7 +45,17 @@ export interface Policy {
   trigger: TriggerConfig | null;
   sourceIds: string[];
   steps: PipelineStep[];
+  /**
+   * Inline output, used only when no destinations are referenced (editor/one-off runs that return
+   * results to the caller). Portal pipelines set {@link outputIds} instead.
+   */
   output: OutputSpec;
+  /**
+   * The saved Sources this policy delivers its output to (each a source used as a write target),
+   * resolved live at run time; a run is delivered to every one. Empty means the inline {@link
+   * output} is used.
+   */
+  outputIds: string[];
   teamId?: number | null;
 }
 
diff --git a/frontend/editor/src/portal/components/pipelines/DestinationPicker.tsx b/frontend/editor/src/portal/components/pipelines/DestinationPicker.tsx
new file mode 100644
index 0000000000..683c6301b4
--- /dev/null
+++ b/frontend/editor/src/portal/components/pipelines/DestinationPicker.tsx
@@ -0,0 +1,62 @@
+import { useTranslation } from "react-i18next";
+import AddRoundedIcon from "@mui/icons-material/AddRounded";
+import { Button, Checkbox } from "@app/ui";
+
+/**
+ * Picks the saved sources a pipeline delivers its output to. A destination is just
+ * a source used as a write target, and a pipeline may write to several, so this is
+ * a checklist over the same locations the builder loaded (filtered to writable
+ * types by the caller) - mirroring the input-sources checklist. Creating a new one
+ * is delegated to {@code onCreateNew} (the builder navigates to the source builder,
+ * prompting about unsaved edits first).
+ */
+interface DestinationOption {
+  id: string;
+  name: string;
+}
+
+interface DestinationPickerProps {
+  sources: DestinationOption[];
+  value: string[];
+  onChange: (outputIds: string[]) => void;
+  /** Leave the builder to create a new source location (navigate-away, like inputs). */
+  onCreateNew: () => void;
+}
+
+export function DestinationPicker({
+  sources,
+  value,
+  onChange,
+  onCreateNew,
+}: DestinationPickerProps) {
+  const { t } = useTranslation();
+
+  function toggle(id: string, checked: boolean) {
+    onChange(
+      checked ? [...value, id] : value.filter((existing) => existing !== id),
+    );
+  }
+
+  return (
+    <>
+      <div className="portal-pipelines__source-list">
+        {sources.map((source) => (
+          <Checkbox
+            key={source.id}
+            checked={value.includes(source.id)}
+            onChange={(e) => toggle(source.id, e.target.checked)}
+            label={source.name}
+          />
+        ))}
+      </div>
+      <Button
+        variant="tertiary"
+        size="sm"
+        onClick={onCreateNew}
+        leftSection={<AddRoundedIcon style={{ fontSize: "1.125rem" }} />}
+      >
+        {t("portal.sources.actions.connectSource")}
+      </Button>
+    </>
+  );
+}
diff --git a/frontend/editor/src/portal/components/pipelines/outputModes.ts b/frontend/editor/src/portal/components/pipelines/outputModes.ts
index a8e698c676..0d76cf122e 100644
--- a/frontend/editor/src/portal/components/pipelines/outputModes.ts
+++ b/frontend/editor/src/portal/components/pipelines/outputModes.ts
@@ -1,11 +1,11 @@
 import type { PipelineOutputMode } from "@portal/api/pipelines";
 
 /**
- * The output destinations the pipeline builder offers. An extension point:
- * deployments where a destination cannot work shadow this module and filter
- * the list (e.g. hosted deployments never write to the server's filesystem,
- * so folder outputs are not offered there).
+ * The source types that can be written to, i.e. offered as a pipeline's output destination. An
+ * extension point: deployments where a destination cannot work shadow this module and filter the
+ * list (e.g. hosted deployments never write to the server's filesystem, so folder destinations are
+ * not offered there and only S3 remains).
  */
 export function availableOutputModes(): PipelineOutputMode[] {
-  return ["inline", "folder", "s3"];
+  return ["folder", "s3"];
 }
diff --git a/frontend/editor/src/portal/mocks/handlers/pipelines.ts b/frontend/editor/src/portal/mocks/handlers/pipelines.ts
index 4c18da8b6e..fdfa22e4b5 100644
--- a/frontend/editor/src/portal/mocks/handlers/pipelines.ts
+++ b/frontend/editor/src/portal/mocks/handlers/pipelines.ts
@@ -53,6 +53,7 @@ function seedPipelines(): StoredPolicy[] {
         { operation: "/api/v1/security/sanitize-pdf", parameters: {} },
       ],
       output: { type: "inline", options: {} },
+      outputIds: ["src-archive", "src-contracts"],
     },
     {
       id: "plc-archive",
@@ -62,7 +63,8 @@ function seedPipelines(): StoredPolicy[] {
       trigger: null,
       sourceIds: ["src-contracts", "src-archive"],
       steps: [{ operation: "/api/v1/misc/compress-pdf", parameters: {} }],
-      output: { type: "folder", options: { directory: "/data/archive-out" } },
+      output: { type: "inline", options: {} },
+      outputIds: ["src-contracts"],
     },
     {
       id: "plc-onboarding",
@@ -76,6 +78,7 @@ function seedPipelines(): StoredPolicy[] {
         { operation: "/api/v1/misc/flatten", parameters: {} },
       ],
       output: { type: "inline", options: {} },
+      outputIds: [],
     },
   ];
 }
@@ -104,7 +107,10 @@ function toView(policy: StoredPolicy): PipelineView {
       name: SOURCE_NAMES[id] ?? id,
     })),
     steps: policy.steps.map((s) => s.operation),
-    output: policy.output?.type ?? "inline",
+    output:
+      policy.outputIds && policy.outputIds.length > 0
+        ? policy.outputIds.map((id) => SOURCE_NAMES[id] ?? id).join(", ")
+        : (policy.output?.type ?? "inline"),
     owner: policy.owner ?? "you@acme.com",
   };
 }
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
index fe88ad7917..9d3f60f54e 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.test.tsx
@@ -8,6 +8,7 @@ import {
 import { PortalTestProviders } from "@portal/test/TestQueryProvider";
 import { MemoryRouter, Route, Routes } from "react-router-dom";
 import type { Policy, TriggerOutcome } from "@portal/api/pipelines";
+import type { SourceView } from "@portal/api/sources";
 import type { ToolRegistryCatalog } from "@app/contexts/ToolRegistryContext";
 import type { ToolRegistryEntry } from "@app/data/toolsTaxonomy";
 import { PipelineBuilder } from "@portal/views/PipelineBuilder";
@@ -60,6 +61,22 @@ vi.mock("@portal/api/integrations", () => ({
   createIntegration: (...args: unknown[]) => createIntegration(...args),
 }));
 
+// The destination picker just selects saved sources; stub it to a button that
+// picks a fixed source, keeping this suite focused on the builder.
+vi.mock("@portal/components/pipelines/DestinationPicker", () => ({
+  DestinationPicker: ({
+    value,
+    onChange,
+  }: {
+    value: string[];
+    onChange: (ids: string[]) => void;
+  }) => (
+    <button type="button" onClick={() => onChange(["src-1"])}>
+      {value.length > 0 ? `output:${value.join(",")}` : "pick output"}
+    </button>
+  ),
+}));
+
 // One editable tool, Compress, so the picker and step settings have something to render.
 vi.mock("@app/contexts/ToolRegistryContext", () => {
   const compress = {
@@ -113,6 +130,20 @@ const POLICY: Policy = {
   sourceIds: [],
   steps: [],
   output: { type: "inline", options: {} },
+  outputIds: [],
+};
+
+const SOURCE: SourceView = {
+  id: "src-in",
+  name: "Claims intake",
+  type: "folder",
+  status: "active",
+  referenceCount: 0,
+  referencingPolicies: [],
+  config: [],
+  docsTotal: 0,
+  docs24h: 0,
+  docs30d: 0,
 };
 
 function outcome(overrides: Partial<TriggerOutcome>): TriggerOutcome {
@@ -152,7 +183,7 @@ describe("PipelineBuilder", () => {
     fetchSources.mockReset();
     fetchPipeline.mockResolvedValue(POLICY);
     fetchTriggers.mockResolvedValue([]);
-    fetchSources.mockResolvedValue({ kpis: [], sources: [] });
+    fetchSources.mockResolvedValue({ kpis: [], sources: [SOURCE] });
     savePipeline.mockResolvedValue({});
     deletePipeline.mockResolvedValue(undefined);
     triggerPipeline.mockResolvedValue(outcome({ runIds: ["run-1"] }));
@@ -175,6 +206,12 @@ describe("PipelineBuilder", () => {
     fireEvent.click(screen.getByRole("button", { name: /addTool/ }));
     fireEvent.click(await screen.findByText("Compress"));
 
+    // A pipeline must have at least one input source and one output destination.
+    fireEvent.click(
+      await screen.findByRole("checkbox", { name: "Claims intake" }),
+    );
+    fireEvent.click(screen.getByText("pick output"));
+
     fireEvent.click(screen.getByText("portal.pipelines.composer.create"));
 
     await waitFor(() => expect(savePipeline).toHaveBeenCalledTimes(1));
@@ -182,6 +219,8 @@ describe("PipelineBuilder", () => {
       expect.objectContaining({
         name: "Nightly compress",
         trigger: null,
+        sourceIds: ["src-in"],
+        outputIds: ["src-1"],
         steps: [
           expect.objectContaining({ operation: "/api/v1/misc/compress-pdf" }),
         ],
@@ -190,76 +229,30 @@ describe("PipelineBuilder", () => {
     expect(await screen.findByText("pipelines list")).toBeInTheDocument();
   });
 
-  it("saves an s3 output referencing an inline-created connection", async () => {
-    createIntegration.mockResolvedValue({ id: 12, name: "Claims bucket" });
+  it("requires at least one source and one destination before saving", async () => {
     renderBuilder("/processor/pipelines/new");
 
     fireEvent.change(await screen.findByRole("textbox"), {
-      target: { value: "Bucket to bucket" },
+      target: { value: "Needs both" },
     });
-    fireEvent.click(screen.getByLabelText("portal.pipelines.output.s3"));
+    const saveButton = () =>
+      screen.getByText("portal.pipelines.composer.create").closest("button");
 
-    // With s3 selected but no connection chosen, saving is blocked. The
-    // connection picker + prefix are inline (no modal), like the folder output.
-    expect(
-      screen.getByText("portal.pipelines.composer.create").closest("button"),
-    ).toBeDisabled();
+    // Name only: blocked (no source, no destination).
+    expect(saveButton()).toBeDisabled();
 
-    // No connections exist: create one inline from the picker. Target fields by
-    // label, not position - the picker's Mantine Select also carries an input
-    // role and would shift index-based queries.
+    // A source but still no destination: blocked.
     fireEvent.click(
-      await screen.findByText("portal.connections.picker.createNew"),
-    );
-    fireEvent.change(screen.getByLabelText(/portal\.integrations\.typedName/), {
-      target: { value: "Claims bucket" },
-    });
-    fireEvent.change(
-      screen.getByLabelText(
-        /portal\.connections\.types\.s3\.fields\.bucket\.label/,
-      ),
-      { target: { value: "claims-processed" } },
-    );
-    fireEvent.change(
-      screen.getByLabelText(
-        /portal\.connections\.types\.s3\.fields\.accessKeyId\.label/,
-      ),
-      { target: { value: "AKIAEXAMPLE" } },
-    );
-    fireEvent.change(
-      screen.getByLabelText(
-        /portal\.connections\.types\.s3\.fields\.secretAccessKey\.label/,
-      ),
-      { target: { value: "shh-secret" } },
-    );
-    fireEvent.click(screen.getByText("portal.connections.picker.save"));
-    await waitFor(() => expect(createIntegration).toHaveBeenCalledTimes(1));
-    // The connection modal closes once saved and the connection is selected.
-    await waitFor(() =>
-      expect(
-        screen.queryByText("portal.connections.picker.save"),
-      ).not.toBeInTheDocument(),
+      await screen.findByRole("checkbox", { name: "Claims intake" }),
     );
+    expect(saveButton()).toBeDisabled();
 
-    fireEvent.change(
-      screen.getByLabelText(
-        /portal\.sources\.types\.s3\.fields\.prefix\.label/,
-      ),
-      { target: { value: "processed/" } },
-    );
+    // Both chosen: allowed, and both are sent.
+    fireEvent.click(screen.getByText("pick output"));
     fireEvent.click(screen.getByText("portal.pipelines.composer.create"));
-
     await waitFor(() => expect(savePipeline).toHaveBeenCalledTimes(1));
     expect(savePipeline).toHaveBeenCalledWith(
-      expect.objectContaining({
-        output: {
-          type: "s3",
-          options: {
-            connectionId: "12",
-            prefix: "processed/",
-          },
-        },
-      }),
+      expect.objectContaining({ sourceIds: ["src-in"], outputIds: ["src-1"] }),
     );
   });
 
@@ -408,6 +401,12 @@ describe("PipelineBuilder", () => {
     );
     fireEvent.click(await screen.findByText("Ops alerts"));
 
+    // Saving needs at least one input source and one destination.
+    fireEvent.click(
+      await screen.findByRole("checkbox", { name: "Claims intake" }),
+    );
+    fireEvent.click(screen.getByText("pick output"));
+
     fireEvent.click(screen.getByText("portal.pipelines.composer.create"));
 
     await waitFor(() => expect(savePipeline).toHaveBeenCalledTimes(1));
diff --git a/frontend/editor/src/portal/views/PipelineBuilder.tsx b/frontend/editor/src/portal/views/PipelineBuilder.tsx
index fc23ac1516..0955049605 100644
--- a/frontend/editor/src/portal/views/PipelineBuilder.tsx
+++ b/frontend/editor/src/portal/views/PipelineBuilder.tsx
@@ -14,7 +14,6 @@ import {
   Button,
   Checkbox,
   EmptyState,
-  FormField,
   Input,
   Modal,
   RadioGroup,
@@ -40,17 +39,15 @@ import {
   fetchTriggers,
   savePipeline,
   triggerPipeline,
-  type OutputSpec,
   type Policy,
   type PolicyRunView,
-  type PipelineOutputMode,
   type TriggerConfig,
   type TriggerInfo,
   type TriggerOutcome,
 } from "@portal/api/pipelines";
 import { clearProcessedHistory } from "@portal/api/policies";
+import { DestinationPicker } from "@portal/components/pipelines/DestinationPicker";
 import { availableOutputModes } from "@portal/components/pipelines/outputModes";
-import { S3ConnectionPicker } from "@portal/components/sources/S3ConnectionPicker";
 import { type SourceView } from "@portal/api/sources";
 import { useSources } from "@portal/queries/sources";
 import { EDITOR_SOURCE_TYPE } from "@portal/components/sources/sourceTypes";
@@ -70,21 +67,6 @@ import {
 } from "@portal/components/pipelines/integrationStep";
 import "@portal/views/PipelineBuilder.css";
 
-type OutputMode = PipelineOutputMode;
-
-/** New pipelines (and specs of unoffered types) start on the first offered destination. */
-const DEFAULT_OUTPUT_MODE = availableOutputModes()[0];
-
-/** The s3 output's options: a stored connection reference plus the per-use prefix. */
-interface S3OutputOptions {
-  connectionId: string;
-  prefix: string;
-}
-
-const EMPTY_S3_OUTPUT: S3OutputOptions = {
-  connectionId: "",
-  prefix: "",
-};
 type ScheduleUnit = "MINUTES" | "HOURS" | "DAYS";
 
 const SCHEDULE_UNITS: ScheduleUnit[] = ["MINUTES", "HOURS", "DAYS"];
@@ -123,31 +105,6 @@ function parseTrigger(trigger: TriggerConfig | null): {
   return { triggerType: trigger.type, count: "1", unit: "HOURS" };
 }
 
-function parseOutput(output: OutputSpec | undefined): {
-  mode: OutputMode;
-  directory: string;
-  s3: S3OutputOptions;
-} {
-  if (output?.type === "folder") {
-    return {
-      mode: "folder",
-      directory: String(output.options?.directory ?? ""),
-      s3: EMPTY_S3_OUTPUT,
-    };
-  }
-  if (output?.type === "s3") {
-    return {
-      mode: "s3",
-      directory: "",
-      s3: {
-        connectionId: String(output.options?.connectionId ?? ""),
-        prefix: String(output.options?.prefix ?? ""),
-      },
-    };
-  }
-  return { mode: DEFAULT_OUTPUT_MODE, directory: "", s3: EMPTY_S3_OUTPUT };
-}
-
 /**
  * Full-page pipeline builder (route: /pipelines/new and /pipelines/:id). Pipeline-level settings
  * (sources, trigger, output) sit above the operation list; the operation list and the selected
@@ -193,6 +150,15 @@ export function PipelineBuilder() {
       ),
     [sourcesState.data],
   );
+  // A destination is a source used as a write target: only writable types (folder/S3, filtered per
+  // deployment) can be picked, and the virtual editor is already excluded from availableSources.
+  const writableSources = useMemo<SourceView[]>(
+    () =>
+      availableSources.filter((source) =>
+        (availableOutputModes() as string[]).includes(source.type),
+      ),
+    [availableSources],
+  );
   const triggers = useMemo(
     () => triggersState.data ?? [],
     [triggersState.data],
@@ -207,9 +173,7 @@ export function PipelineBuilder() {
   const [triggerType, setTriggerType] = useState<string>(MANUAL);
   const [scheduleCount, setScheduleCount] = useState("1");
   const [scheduleUnit, setScheduleUnit] = useState<ScheduleUnit>("HOURS");
-  const [outputMode, setOutputMode] = useState<OutputMode>(DEFAULT_OUTPUT_MODE);
-  const [outputDirectory, setOutputDirectory] = useState("");
-  const [outputS3, setOutputS3] = useState<S3OutputOptions>(EMPTY_S3_OUTPUT);
+  const [outputIds, setOutputIds] = useState<string[]>([]);
   const [submitting, setSubmitting] = useState(false);
   const [error, setError] = useState<string | null>(null);
   const [seeded, setSeeded] = useState(false);
@@ -234,7 +198,6 @@ export function PipelineBuilder() {
     if (isEdit && !policyState.data) return;
     const policy = policyState.data ?? undefined;
     const trigger = parseTrigger(policy?.trigger ?? null);
-    const output = parseOutput(policy?.output);
     setName(policy?.name ?? "");
     setEnabled(policy?.enabled ?? true);
     setSourceIds(policy?.sourceIds ?? []);
@@ -244,9 +207,7 @@ export function PipelineBuilder() {
     setTriggerType(trigger.triggerType);
     setScheduleCount(trigger.count);
     setScheduleUnit(trigger.unit);
-    setOutputMode(output.mode);
-    setOutputDirectory(output.directory);
-    setOutputS3(output.s3);
+    setOutputIds(policy?.outputIds ?? []);
     setSeeded(true);
   }, [isEdit, policyState.data, allTools, seeded]);
 
@@ -371,9 +332,7 @@ export function PipelineBuilder() {
     triggerType,
     scheduleCount,
     scheduleUnit,
-    outputMode,
-    outputDirectory,
-    outputS3,
+    outputIds: [...outputIds].sort(),
   });
   const baseline = useRef<string | null>(null);
   useEffect(() => {
@@ -383,12 +342,12 @@ export function PipelineBuilder() {
 
   const scheduleCountValid =
     triggerType !== "schedule" || Number(scheduleCount) > 0;
-  const s3OutputValid =
-    outputMode !== "s3" || outputS3.connectionId.trim() !== "";
-  const outputValid =
-    (outputMode !== "folder" || outputDirectory.trim() !== "") && s3OutputValid;
+  // A pipeline must have at least one input source and at least one output destination.
+  const sourceValid = sourceIds.length > 0;
+  const outputValid = outputIds.length > 0;
   const canSave =
     name.trim() !== "" &&
+    sourceValid &&
     scheduleCountValid &&
     outputValid &&
     !hasUploadSteps &&
@@ -436,8 +395,8 @@ export function PipelineBuilder() {
     else navigate(destination);
   }
 
-  // Jump to the Sources page with its create wizard open, for when the source you want to run
-  // this pipeline over doesn't exist yet.
+  // Jump to the source builder, for when the source you want to read from or write to doesn't
+  // exist yet. Inputs and the output destination are both saved sources, so both create one here.
   function goToSources() {
     attemptLeave(sourcesPath);
   }
@@ -446,12 +405,6 @@ export function PipelineBuilder() {
     if (!canSave) return;
     setSubmitting(true);
     setError(null);
-    const output: OutputSpec =
-      outputMode === "folder"
-        ? { type: "folder", options: { directory: outputDirectory.trim() } }
-        : outputMode === "s3"
-          ? { type: "s3", options: { ...outputS3 } }
-          : { type: "inline", options: {} };
     const policy: Policy = {
       id: policyState.data?.id ?? undefined,
       name: name.trim(),
@@ -459,7 +412,10 @@ export function PipelineBuilder() {
       trigger: buildTrigger(),
       sourceIds,
       steps: steps.map((step) => serializeToolStep(step, allTools)),
-      output,
+      // Destinations are the referenced saved sources; the inline output field is
+      // preserved as-is (e.g. an editor policy's membership metadata) or defaults to inline.
+      output: policyState.data?.output ?? { type: "inline", options: {} },
+      outputIds,
     };
     try {
       await savePipeline(policy);
@@ -716,10 +672,6 @@ export function PipelineBuilder() {
               <p className="portal-pipelines__muted">
                 {t("portal.pipelines.composer.sourcesLoading")}
               </p>
-            ) : availableSources.length === 0 ? (
-              <p className="portal-pipelines__muted">
-                {t("portal.pipelines.composer.noSources")}
-              </p>
             ) : (
               <div className="portal-pipelines__source-list">
                 {availableSources.map((source) => (
@@ -787,55 +739,12 @@ export function PipelineBuilder() {
             <span className="portal-pipelines__detail-heading">
               {t("portal.pipelines.composer.output")}
             </span>
-            <RadioGroup<OutputMode>
-              name="pipeline-output"
-              value={outputMode}
-              onChange={setOutputMode}
-              options={availableOutputModes().map((mode) => ({
-                value: mode,
-                label: t(`portal.pipelines.output.${mode}`),
-              }))}
+            <DestinationPicker
+              sources={writableSources}
+              value={outputIds}
+              onChange={setOutputIds}
+              onCreateNew={goToSources}
             />
-            {outputMode === "folder" && (
-              <FormField
-                label={t("portal.pipelines.composer.directory")}
-                helperText={t("portal.pipelines.composer.directoryHelp")}
-                required
-              >
-                <Input
-                  value={outputDirectory}
-                  placeholder="/data/processed"
-                  onChange={(e) => setOutputDirectory(e.target.value)}
-                />
-              </FormField>
-            )}
-            {outputMode === "s3" && (
-              <>
-                <FormField
-                  label={t("portal.sources.types.s3.fields.connection.label")}
-                  required
-                >
-                  <S3ConnectionPicker
-                    value={outputS3.connectionId}
-                    onChange={(connectionId) =>
-                      setOutputS3((s) => ({ ...s, connectionId }))
-                    }
-                  />
-                </FormField>
-                <FormField
-                  label={t("portal.sources.types.s3.fields.prefix.label")}
-                  helperText={t("portal.pipelines.composer.s3PrefixHelp")}
-                >
-                  <Input
-                    value={outputS3.prefix}
-                    placeholder="processed/"
-                    onChange={(e) =>
-                      setOutputS3((s) => ({ ...s, prefix: e.target.value }))
-                    }
-                  />
-                </FormField>
-              </>
-            )}
           </div>
         </div>
       </section>
diff --git a/frontend/editor/src/proprietary/services/policyPipeline.test.ts b/frontend/editor/src/proprietary/services/policyPipeline.test.ts
index e6017e99b1..776495c344 100644
--- a/frontend/editor/src/proprietary/services/policyPipeline.test.ts
+++ b/frontend/editor/src/proprietary/services/policyPipeline.test.ts
@@ -32,7 +32,7 @@ describe("buildPipelineDefinition", () => {
 
     expect(unresolved).toEqual([]);
     expect(definition.name).toBe("Secure Ingestion");
-    expect(definition.output).toEqual({ type: "inline", options: {} });
+    expect(definition.outputs).toEqual([{ type: "inline", options: {} }]);
     expect(definition.steps).toEqual([
       { operation: "/api/v1/misc/compress-pdf", parameters: {} },
       {
diff --git a/frontend/editor/src/proprietary/services/policyPipeline.ts b/frontend/editor/src/proprietary/services/policyPipeline.ts
index c04adb78b6..ed073b9b1c 100644
--- a/frontend/editor/src/proprietary/services/policyPipeline.ts
+++ b/frontend/editor/src/proprietary/services/policyPipeline.ts
@@ -32,7 +32,8 @@ export interface BackendOutputSpec {
 export interface BackendPipelineDefinition {
   name: string;
   steps: BackendPipelineStep[];
-  output: BackendOutputSpec;
+  /** Destinations a run's files are delivered to; a single inline entry for one-off/editor runs. */
+  outputs: BackendOutputSpec[];
 }
 
 /** How a stored policy is triggered ("manual" | "folder" | "schedule" | "s3"). */
@@ -191,7 +192,7 @@ export function buildPipelineDefinition(
     definition: {
       name: automation.name,
       steps,
-      output: { type: "inline", options: {} },
+      outputs: [{ type: "inline", options: {} }],
     },
     unresolved,
   };

From 8a5470dd019594c391e99e347712e61574ec731f Mon Sep 17 00:00:00 2001
From: Reece Browne <74901996+reecebrowne@users.noreply.github.com>
Date: Wed, 29 Jul 2026 12:28:24 +0100
Subject: [PATCH 104/109] Add an accessibility regression gate for Storybook
 (#7086)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Follow-up to #7073. Turns the story scan into an accessibility gate:
stories run axe in a real browser, and CI flags a change that adds a
**new** violation.

The app has plenty of existing a11y problems (mostly theme-level colour
contrast), so rather than block everything on those, they're recorded in
`.storybook/a11y-baseline.json` and grandfathered. The gate cares about
three things:

- a story breaking a rule it wasn't already breaking
- a story that fails to render at all
- a scan that didn't cover everything it was asked to

Starting point: 839 stories carry a known violation, 1058 story-rule
pairs.

## Where it runs

- **Pull requests** scan only the stories the branch touches — usually
seconds. A full sweep is ~30 minutes, too slow to sit in front of every
merge, and the `frontend` path filter is broad enough that unrelated
changes would pay for it.
- **Nightly** scans every story, so a violation introduced somewhere
other than the story itself — a shared component, a theme token — still
surfaces within a day.
- Both upload their scan reports as artifacts; the reports carry the
offending selector and help text, without which a red run can only be
understood by reproducing it locally.
- **Advisory to start with.** It is deliberately not in
`all-checks-passed`, so it reports without blocking. Worth promoting
once a few weeks of runs show the pass/fail is stable.

## Using it

- **Fixed some violations?** `task frontend:storybook:a11y:record`
re-records so the gate locks the improvement in.
- **Locally:** `task frontend:storybook:a11y:changed` for your branch,
`task frontend:storybook:a11y` for everything.
- **New component?** Its story is picked up automatically.

## Testing

- Every story — 526 files, ~1,450 stories — runs in a real browser with
no render failures, and the gate reports no regressions against the
baseline.
- Running the gate over a single changed story takes seconds, which is
the pull-request path.
- The gate's own behaviour is covered against synthetic scan reports: a
new rule fails, the same rule on more nodes does not, a crashed story
fails, an incomplete scan refuses to report, and re-recording refuses
while anything is crashing.
- Typecheck (all build variants), ESLint and Prettier pass.

## Notes for reviewers

Some of this PR is making the mechanism trustworthy rather than adding
features, so it's worth knowing what changed and why:

- Rule ids come from the axe docs URL in each violation, not a
hand-maintained list of rule names — the old list silently ignored 39 of
axe's 104 rules, including `object-alt`, `target-size` and the table
rules.
- The baseline records **which** rules a story breaks, not how many
nodes break them. Node counts drift between runs because stories fetch
asynchronously and axe samples whatever has rendered, which made
unrelated changes look like regressions. For the same reason the
baseline is the union of repeated scans, so a run can only be a subset
of it.
- A story that fails for a non-a11y reason used to yield no rule id and
was recorded as clean, which hid crashes and could mask real violations.
Those now fail, and re-recording refuses to run while any story is
crashing.
- The scan writes a manifest of every story file it intends to cover and
the check fails unless all of them reported, so a dropped batch can't
read as "no violations".
- Vite was pre-bundling the JSX runtime mid-run and reloading the page,
which crashed whichever stories were loading; those deps are now named
up front and the per-story timeout is above the 5s default.

Colour contrast dominates the baseline and is theme-level, tracked
separately from this.
---
 .github/config/.files.yaml             |    1 +
 .github/workflows/build.yml            |   11 +
 .github/workflows/frontend-a11y.yml    |   57 +
 .github/workflows/nightly.yml          |   40 +
 .taskfiles/frontend.yml                |   44 +-
 frontend/.gitignore                    |    1 +
 frontend/.storybook/a11y-baseline.json | 2622 ++++++++++++++++++++++++
 frontend/.storybook/a11y-check.mjs     |  202 ++
 frontend/.storybook/a11y-scan.sh       |   84 +
 frontend/.storybook/preview.tsx        |   10 +-
 frontend/.storybook/vitest.config.ts   |   20 +-
 frontend/.storybook/vitest.setup.ts    |   11 +-
 12 files changed, 3083 insertions(+), 20 deletions(-)
 create mode 100644 .github/workflows/frontend-a11y.yml
 create mode 100644 frontend/.storybook/a11y-baseline.json
 create mode 100644 frontend/.storybook/a11y-check.mjs
 create mode 100644 frontend/.storybook/a11y-scan.sh

diff --git a/.github/config/.files.yaml b/.github/config/.files.yaml
index 64454c5fe1..a9d4d3550e 100644
--- a/.github/config/.files.yaml
+++ b/.github/config/.files.yaml
@@ -84,6 +84,7 @@ frontend: &frontend
   - .taskfiles/frontend.yml
   - .taskfiles/e2e.yml
   - .github/workflows/frontend-validation.yml
+  - .github/workflows/frontend-a11y.yml
   - .github/workflows/e2e-stubbed.yml
   - .github/workflows/e2e-live.yml
 
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7d4130f214..c8275c023b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -99,6 +99,17 @@ jobs:
     uses: ./.github/workflows/frontend-validation.yml
     secrets: inherit
 
+  # Advisory: deliberately NOT in all-checks-passed. It reports on the stories a
+  # branch touches so a regression is visible in review, but a browser scan is
+  # too new here to block merges on. Promote it once its pass/fail proves stable.
+  frontend-a11y:
+    if: needs.files-changed.outputs.frontend == 'true'
+    needs: [files-changed]
+    permissions:
+      contents: read
+    uses: ./.github/workflows/frontend-a11y.yml
+    secrets: inherit
+
   playwright-e2e:
     if: needs.files-changed.outputs.frontend == 'true'
     needs: [files-changed]
diff --git a/.github/workflows/frontend-a11y.yml b/.github/workflows/frontend-a11y.yml
new file mode 100644
index 0000000000..d763447048
--- /dev/null
+++ b/.github/workflows/frontend-a11y.yml
@@ -0,0 +1,57 @@
+name: Frontend a11y regression gate
+
+# Reusable workflow called from build.yml when frontend sources change.
+#
+# Scans the stories this branch touches in real Chromium and runs axe against
+# each. Existing violations are grandfathered in .storybook/a11y-baseline.json;
+# the check fails on a NEW violation — a story breaking a rule it wasn't already
+# breaking — or on a story that fails to render at all.
+#
+# Only changed stories, because a full sweep is ~30 minutes: far too slow to sit
+# in front of every merge. The whole suite is scanned nightly instead
+# (nightly.yml), which catches anything a branch didn't touch.
+#
+# Advisory for now: this is not in build.yml's all-checks-passed list, so a
+# failure reports without blocking. Promote it once a few weeks of runs show the
+# pass/fail is stable.
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  frontend-a11y:
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # Need the base branch too, to diff against it.
+          fetch-depth: 0
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+      - name: Install Task
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+      - name: a11y gate (changed stories)
+        run: task frontend:storybook:a11y:changed -- origin/${{ github.base_ref || 'main' }}
+      - name: Upload scan reports
+        # The reports carry the offending selector and help text for each
+        # violation; without them a red run can only be understood by
+        # reproducing the whole scan locally.
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: a11y-scan-${{ github.run_id }}
+          path: frontend/.a11y-scan/
+          retention-days: 7
+          if-no-files-found: ignore
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 4047157a45..301a1fc8df 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -53,6 +53,46 @@ jobs:
           path: frontend/playwright-report/
           retention-days: 14
 
+  # Whole-suite accessibility sweep. Pull requests only scan the stories they
+  # touch (frontend-a11y.yml) because a full pass takes ~30 minutes; this covers
+  # everything else, so a violation introduced by a change somewhere other than
+  # the story itself — a shared component, a theme token — still surfaces within
+  # a day.
+  a11y-all-stories:
+    name: a11y (every story)
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install Task
+        uses: go-task/setup-task@01a4adf9db2d14c1de7a560f09170b6e0df736aa # v2.1.0
+
+      - name: a11y gate (every story)
+        run: task frontend:storybook:a11y
+
+      - name: Upload scan reports
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: a11y-scan-nightly-${{ github.run_id }}
+          path: frontend/.a11y-scan/
+          retention-days: 14
+          if-no-files-found: ignore
+
   # Builds all desktop platforms on a schedule so the Rust dependency cache is
   # written on main, where PR and merge-queue tauri builds can restore it.
   warm-tauri-cache:
diff --git a/.taskfiles/frontend.yml b/.taskfiles/frontend.yml
index 3e608855f3..1338aae8e1 100644
--- a/.taskfiles/frontend.yml
+++ b/.taskfiles/frontend.yml
@@ -203,13 +203,55 @@ tasks:
       - npx playwright install chromium
 
   storybook:test:
-    desc: "Scan every story in real Chromium — each must mount without throwing"
+    desc: "Scan every story in real Chromium: it must render and pass axe"
     deps: [install, storybook:browser]
     cmds:
       # Runs each story as a browser test. Pass a filter through, e.g.
       #   task frontend:storybook:test -- Button
       - npx vitest run --config .storybook/vitest.config.ts {{.CLI_ARGS}}
 
+  storybook:a11y:
+    desc: "a11y regression gate over every story: fail only on NEW axe violations"
+    deps: [install, storybook:browser]
+    cmds:
+      - bash .storybook/a11y-scan.sh
+      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
+
+  storybook:a11y:changed:
+    desc: "a11y gate over stories changed vs a base ref (default origin/main)"
+    summary: |
+      Scans only the stories this branch touches, which is what pull requests
+      run — a full scan takes ~30 minutes, far too long to sit in front of every
+      merge. The nightly job covers the rest of the suite.
+
+      Pass a base ref through CLI_ARGS, e.g.
+        task frontend:storybook:a11y:changed -- origin/release
+    deps: [install, storybook:browser]
+    vars:
+      BASE: '{{.CLI_ARGS | default "origin/main"}}'
+      # Stories touched by this branch, plus any not yet committed.
+      CHANGED:
+        sh: |
+          { git diff --name-only --diff-filter=d {{.CLI_ARGS | default "origin/main"}}...HEAD -- '*.stories.ts' '*.stories.tsx';
+            git diff --name-only --diff-filter=d -- '*.stories.ts' '*.stories.tsx';
+            git ls-files --others --exclude-standard -- '*.stories.ts' '*.stories.tsx'; } \
+          | sed 's|^frontend/||' | sort -u | tr '\n' ' '
+    cmds:
+      - cmd: |
+          if [ -z "{{.CHANGED}}" ]; then
+            echo "a11y: no story files changed vs {{.BASE}} — nothing to check"
+            exit 0
+          fi
+          bash .storybook/a11y-scan.sh {{.CHANGED}}
+          node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
+
+  storybook:a11y:record:
+    desc: "Re-record the a11y baseline (run after intentionally fixing/adding violations)"
+    deps: [install, storybook:browser]
+    cmds:
+      - bash .storybook/a11y-scan.sh
+      - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --record
+
   # ============================================================
   # Code quality
   # ============================================================
diff --git a/frontend/.gitignore b/frontend/.gitignore
index 0605e6e79f..c0c467073d 100644
--- a/frontend/.gitignore
+++ b/frontend/.gitignore
@@ -48,3 +48,4 @@ test-results
 /scripts/dev-update-test/.update-dist/
 /scripts/dev-update-test/screenshots/
 /editor/src-tauri/tauri.conf.dev-update.json
+.a11y-scan/
diff --git a/frontend/.storybook/a11y-baseline.json b/frontend/.storybook/a11y-baseline.json
new file mode 100644
index 0000000000..10fc530c77
--- /dev/null
+++ b/frontend/.storybook/a11y-baseline.json
@@ -0,0 +1,2622 @@
+{
+  "editor/src/core/components/StorageStatsCard.stories.tsx :: Default": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/StorageStatsCard.stories.tsx :: Nearing Quota": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/StorageStatsCard.stories.tsx :: No Quota": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/shared/ColorPicker.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/shared/ColorPicker.stories.tsx :: With Opacity": [
+    "aria-input-field-name",
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/shared/DrawingCanvas.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/shared/DrawingCanvas.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/shared/DrawingControls.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/shared/ImageUploader.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/shared/ImageUploader.stories.tsx :: With Background Removal": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/shared/ImageUploader.stories.tsx :: With Label And Hint": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/tools/DrawingTool.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/tools/DrawingTool.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/tools/ImageTool.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/annotation/tools/ImageTool.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/fileManager/CompactFileDetails.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/fileManager/CompactFileDetails.stories.tsx :: Multiple Files": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/fileManager/FileDetails.stories.tsx :: Compact": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/fileManager/FileDetails.stories.tsx :: Default": [
+    "color-contrast",
+    "scrollable-region-focusable"
+  ],
+  "editor/src/core/components/fileManager/FileDetails.stories.tsx :: Empty": [
+    "color-contrast",
+    "scrollable-region-focusable"
+  ],
+  "editor/src/core/components/filesPage/DeleteFilesDialog.stories.tsx :: Cloud Only": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/DeleteFilesDialog.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/DeleteFilesDialog.stories.tsx :: Local And Cloud Choice": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/DeleteFolderDialog.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/DeleteFolderDialog.stories.tsx :: With Files": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/FileDetailsPanel.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/FileDetailsPanel.stories.tsx :: In Folder": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/FileDetailsPanel.stories.tsx :: Local Only With Save To Server": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/FileDetailsPanel.stories.tsx :: Multi Select": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/FileGrid.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/FileGrid.stories.tsx :: List Mode": [
+    "aria-required-children"
+  ],
+  "editor/src/core/components/filesPage/FileOriginBadge.stories.tsx :: Cloud": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/FileOriginBadge.stories.tsx :: Shared With Me": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/FolderNameDialog.stories.tsx :: Default": [
+    "button-name"
+  ],
+  "editor/src/core/components/filesPage/FolderNameDialog.stories.tsx :: Rename": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/FolderThumbnail.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/MoveToFolderDialog.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/MoveToFolderDialog.stories.tsx :: Empty": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/MoveToFolderDialog.stories.tsx :: With Create Folder": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/MoveToFolderDialog.stories.tsx :: With Disabled Descendant": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/VersionHistoryModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/VersionHistoryModal.stories.tsx :: No File Selected": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/VersionTimeline.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/VersionTimeline.stories.tsx :: Long Chain Collapsed": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/filesPage/VersionTimeline.stories.tsx :: No Header": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Admin Overview Login Disabled": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Admin Overview Login Enabled": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Analytics Choice": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Analytics Choice Error": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Desktop Install": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: First Login": [
+    "aria-dialog-name"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: First Login Default Credentials": [
+    "aria-dialog-name"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Mfa Setup": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Security Check": [
+    "aria-dialog-name"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Server License": [
+    "aria-dialog-name"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Server License Over Limit": [
+    "aria-dialog-name"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Stepped Flow Example": [
+    "aria-dialog-name",
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Tour Overview": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingModalSlide.stories.tsx :: Welcome": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingSlideShell.stories.tsx :: Default": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/OnboardingSlideShell.stories.tsx :: Not Dismissible": [
+    "aria-dialog-name",
+    "aria-progressbar-name"
+  ],
+  "editor/src/core/components/onboarding/OnboardingSlideShell.stories.tsx :: Stepped With Back": [
+    "aria-dialog-name",
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/onboarding/slides/WelcomeSlide.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/pageEditor/bulkSelectionPanel/SelectedPagesDisplay.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/BulkShareModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/BulkShareModal.stories.tsx :: Links Enabled": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/BulkUploadToServerModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/BulkUploadToServerModal.stories.tsx :: Single File": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/ButtonToggle.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/ButtonToggle.stories.tsx :: Small": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/DropdownListWithFooter.stories.tsx :: Default": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/shared/DropdownListWithFooter.stories.tsx :: Empty": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/shared/DropdownListWithFooter.stories.tsx :: Multi Select With Footer": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/shared/EditableSecretField.stories.tsx :: Masked": [
+    "label"
+  ],
+  "editor/src/core/components/shared/EditableSecretField.stories.tsx :: Masked Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/shared/EditableSecretField.stories.tsx :: With Error": [
+    "color-contrast",
+    "label-title-only"
+  ],
+  "editor/src/core/components/shared/EncryptedPdfUnlockModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/EncryptedPdfUnlockModal.stories.tsx :: Incorrect Password": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/EncryptedPdfUnlockModal.stories.tsx :: Multiple Files Remaining": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/EncryptedPdfUnlockModal.stories.tsx :: Processing": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/ErrorBoundary.stories.tsx :: Caught Error": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/ErrorBoundary.stories.tsx :: Custom Fallback": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/FileCard.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/FileCard.stories.tsx :: Selected": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/FileCard.stories.tsx :: Unsupported": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/FileDropdownMenu.stories.tsx :: Default": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/shared/FileDropdownMenu.stories.tsx :: No Remove": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/shared/FileDropdownMenu.stories.tsx :: Switching": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/shared/FileGrid.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/FileGrid.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/FileGrid.stories.tsx :: Search And Sort": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/shared/FilePickerModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/shared/FilePickerModal.stories.tsx :: Empty": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/FileSelectorPicker.stories.tsx :: Custom Placeholder": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/FileSelectorPicker.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/FileSelectorPicker.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/Footer.stories.tsx :: All Links And Cookie Banner": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/Footer.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/InfoBanner.stories.tsx :: Warning": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/MobileUploadModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast",
+    "svg-img-alt"
+  ],
+  "editor/src/core/components/shared/MultiSelectControls.stories.tsx :: All Actions": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/NavigationWarningModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/NavigationWarningModal.stories.tsx :: With Apply And Continue": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/NavigationWarningModal.stories.tsx :: With Export And Continue": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/ShareFileModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/ShareFileModal.stories.tsx :: Links Enabled": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/ShareManagementModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/ShareManagementModal.stories.tsx :: Links Enabled": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/UpdateModal.stories.tsx :: Default": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/UpdateModal.stories.tsx :: Desktop Install Blocked": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/UpdateModal.stories.tsx :: Desktop Install Ready To Restart": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/UploadToServerModal.stories.tsx :: Already Uploaded": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/UploadToServerModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/UserSelector.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/ZipWarningModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/ZipWarningModal.stories.tsx :: Single File": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/LoginRequiredBanner.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/OverviewHeader.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/PendingBadge.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/PendingBadge.stories.tsx :: Large Size": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/RestartConfirmationModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/SettingsStickyFooter.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/SettingsStickyFooter.stories.tsx :: Saving": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/GeneralSection.stories.tsx :: Admin Banner": [
+    "label"
+  ],
+  "editor/src/core/components/shared/config/configSections/GeneralSection.stories.tsx :: Default": [
+    "label"
+  ],
+  "editor/src/core/components/shared/config/configSections/GeneralSection.stories.tsx :: With Backend Version": [
+    "label"
+  ],
+  "editor/src/core/components/shared/config/configSections/HelpSection.stories.tsx :: Admin": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/HelpSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/HotkeysSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/LegalSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/LegalSection.stories.tsx :: Minimal Links": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/LegalSection.stories.tsx :: With Analytics Enabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/Overview.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/Overview.stories.tsx :: Loaded": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/Overview.stories.tsx :: With Warning": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/ProviderCard.stories.tsx :: Configured": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/ProviderCard.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/ProviderCard.stories.tsx :: Read Only": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/config/configSections/ThirdPartyLicensesSection.stories.tsx :: Frontend": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/filePreview/DocumentThumbnail.stories.tsx :: Encrypted": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/filePreview/DocumentThumbnail.stories.tsx :: Loading": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/CreateSessionFlow.stories.tsx :: Creating": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/CreateSessionFlow.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/CreateSessionFlow.stories.tsx :: No File Selected": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/SharedSigningLauncher.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/SharedSigningLauncher.stories.tsx :: Pending Requests": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/ConfigureSignatureDefaultsStep.stories.tsx :: Invisible Signature": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/ReviewSessionStep.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/ReviewSessionStep.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/ReviewSessionStep.stories.tsx :: Invisible Signature": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/SelectDocumentStep.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/SelectDocumentStep.stories.tsx :: Multiple Files Selected": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/SelectDocumentStep.stories.tsx :: No File Selected": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/SelectParticipantsStep.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/SelectParticipantsStep.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/signing/steps/SelectParticipantsStep.stories.tsx :: With Selection": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/sliderWithInput/SliderWithInput.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "label"
+  ],
+  "editor/src/core/components/shared/sliderWithInput/SliderWithInput.stories.tsx :: Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/shared/wetSignature/DrawSignatureCanvas.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/wetSignature/DrawSignatureCanvas.stories.tsx :: Disabled": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/wetSignature/TypeSignatureText.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/wetSignature/TypeSignatureText.stories.tsx :: Disabled": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/wetSignature/TypeSignatureText.stories.tsx :: Empty": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/wetSignature/UploadSignatureImage.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/wetSignature/UploadSignatureImage.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/shared/wetSignature/UploadSignatureImage.stories.tsx :: With Signature": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/ToolLoadingFallback.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/ToolLoadingFallback.stories.tsx :: With Tool Name": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/ToolPanelModePrompt.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/ToolRenderer.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/addPageNumbers/PageNumberPreview.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/addPageNumbers/PageNumberPreview.stories.tsx :: With Quick Grid": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/addStamp/StampPreview.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/addStamp/StampPreview.stories.tsx :: With Quick Grid": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/addStamp/StampPreview.stories.tsx :: With Text": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/addStamp/StampSetupSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/addStamp/StampSetupSettings.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/addStamp/StampSetupSettings.stories.tsx :: Image Stamp": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/addStamp/StampSetupSettings.stories.tsx :: Text Stamp With Preview": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/addWatermark/AddWatermarkSingleStepSettings.stories.tsx :: Disabled": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/addWatermark/AddWatermarkSingleStepSettings.stories.tsx :: Text Only": [
+    "button-name",
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/addWatermark/AddWatermarkSingleStepSettings.stories.tsx :: Text Watermark": [
+    "button-name",
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/addWatermark/WatermarkFormatting.stories.tsx :: Default": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/addWatermark/WatermarkFormatting.stories.tsx :: Disabled": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/addWatermark/WatermarkFormatting.stories.tsx :: Without Flatten Option": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/addWatermark/WatermarkStyleSettings.stories.tsx :: Default": [
+    "label"
+  ],
+  "editor/src/core/components/tools/addWatermark/WatermarkStyleSettings.stories.tsx :: Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/tools/addWatermark/WatermarkTextStyle.stories.tsx :: Default": [
+    "button-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/addWatermark/WatermarkTextStyle.stories.tsx :: Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/tools/adjustContrast/AdjustContrastBasicSettings.stories.tsx :: Adjusted": [
+    "aria-input-field-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/adjustContrast/AdjustContrastBasicSettings.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/adjustContrast/AdjustContrastBasicSettings.stories.tsx :: Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/tools/adjustContrast/AdjustContrastColorSettings.stories.tsx :: Adjusted": [
+    "aria-input-field-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/adjustContrast/AdjustContrastColorSettings.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/adjustContrast/AdjustContrastColorSettings.stories.tsx :: Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/tools/adjustContrast/AdjustContrastSingleStepSettings.stories.tsx :: Adjusted": [
+    "aria-input-field-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/adjustContrast/AdjustContrastSingleStepSettings.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/adjustContrast/AdjustContrastSingleStepSettings.stories.tsx :: Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/tools/automate/AutomationCreation.stories.tsx :: Edit Existing": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/automate/AutomationImportModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/automate/ToolConfigurationModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/automate/ToolConfigurationModal.stories.tsx :: With Settings": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/bookletImposition/BookletImpositionSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/bookletImposition/BookletImpositionSettings.stories.tsx :: Manual Duplex": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/CertSignAutomationSettings.stories.tsx :: Auto Sign Mode": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/CertSignAutomationSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/CertificateFilesSettings.stories.tsx :: Auto Sign Mode": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/CertificateFormatSettings.stories.tsx :: Selected": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/CertificateSelector.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/CertificateSelector.stories.tsx :: Pem Format": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/CertificateTypeSettings.stories.tsx :: All Sources Available": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/CertificateTypeSettings.stories.tsx :: Server Selected": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/HardwareCertificateSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/SignatureAppearanceSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/SignatureAppearanceSettings.stories.tsx :: Visible Signature": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/SignatureSettingsDisplay.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/SignatureSettingsDisplay.stories.tsx :: Invisible": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/SignatureSettingsDisplay.stories.tsx :: Minimal Details": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/SignatureSettingsInput.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/SignatureSettingsInput.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/SignatureSettingsInput.stories.tsx :: Visible Signature": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/WetSignatureInput.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/WetSignatureInput.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/WetSignatureInput.stories.tsx :: Upload Certificate": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/modals/AddParticipantsFlow.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/modals/CertificateConfigModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/modals/CertificateConfigModal.stories.tsx :: Disabled": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/modals/CertificateConfigModal.stories.tsx :: Multiple Signatures": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/modals/SelectSignatureModal.stories.tsx :: Default": [
+    "button-name"
+  ],
+  "editor/src/core/components/tools/certSign/panels/ParticipantListPanel.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/panels/ParticipantListPanel.stories.tsx :: Finalized": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/panels/SessionActionsPanel.stories.tsx :: All Signed": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/panels/SessionActionsPanel.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/panels/SessionActionsPanel.stories.tsx :: Finalized": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/panels/SessionDetailPanel.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/panels/SessionDetailPanel.stories.tsx :: Finalized": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/panels/SignControlsPanel.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/panels/SignControlsPanel.stories.tsx :: No Signature Chosen": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/AddSignaturesStep.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/AddSignaturesStep.stories.tsx :: Disabled": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/AddSignaturesStep.stories.tsx :: Placement Mode": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.stories.tsx :: Upload Ready": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/CertificateSelectionStep.stories.tsx :: User Certificate": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.stories.tsx :: Multiple Signatures": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/ReviewSignatureStep.stories.tsx :: Uploaded Certificate Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/SignatureCreationStep.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/SignatureCreationStep.stories.tsx :: Disabled": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/SignatureCreationStep.stories.tsx :: Type Mode": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/SignatureCreationStep.stories.tsx :: With Signature": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/certSign/steps/SignaturePlacementStep.stories.tsx :: Placed": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/changeMetadata/steps/AdvancedOptionsStep.stories.tsx :: With Custom Metadata": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/changeMetadata/steps/CustomMetadataStep.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/changeMetadata/steps/CustomMetadataStep.stories.tsx :: With Entries": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/changeMetadata/steps/DocumentDatesStep.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/changeMetadata/steps/DocumentDatesStep.stories.tsx :: Filled": [
+    "button-name"
+  ],
+  "editor/src/core/components/tools/compare/CompareDocumentPane.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/compare/ComparePixelWorkbenchView.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/compare/ComparePixelWorkbenchView.stories.tsx :: No Differences": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/compare/ComparePixelWorkbenchView.stories.tsx :: With Warnings": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/compress/CompressSettings.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/compress/CompressSettings.stories.tsx :: Disabled": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/compress/CompressSettings.stories.tsx :: File Size Method": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/compress/CompressSettings.stories.tsx :: Line Art Enabled": [
+    "aria-input-field-name",
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/convert/ConvertFromEbookSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/convert/ConvertFromEbookSettings.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/convert/ConvertFromEmailSettings.stories.tsx :: Default": [
+    "label"
+  ],
+  "editor/src/core/components/tools/convert/ConvertFromEmailSettings.stories.tsx :: Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/tools/convert/ConvertFromImageSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/convert/ConvertFromSvgSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/convert/ConvertFromSvgSettings.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/convert/ConvertFromWebSettings.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/convert/ConvertFromWebSettings.stories.tsx :: Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/tools/convert/ConvertToEpubSettings.stories.tsx :: Azw 3 Output": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/convert/ConvertToEpubSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/convert/ConvertToEpubSettings.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/convert/ConvertToPdfaSettings.stories.tsx :: Default": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/convert/ConvertToPdfaSettings.stories.tsx :: Disabled": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/convert/ConvertToPdfaSettings.stories.tsx :: Strict Mode": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/convert/GroupedFormatDropdown.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/crop/CropAutomationSettings.stories.tsx :: Custom Area": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/crop/CropAutomationSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/crop/CropAutomationSettings.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/crop/CropCoordinateInputs.stories.tsx :: Automation Info": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/editTableOfContents/BookmarkEditor.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/editTableOfContents/BookmarkEditor.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/editTableOfContents/BookmarkEditor.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.stories.tsx :: Loading With Error": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/editTableOfContents/EditTableOfContentsSettings.stories.tsx :: No File Selected": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.stories.tsx :: With Error": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/editTableOfContents/EditTableOfContentsWorkbenchView.stories.tsx :: With Results": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/flatten/FlattenSettings.stories.tsx :: Custom Render Dpi": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/flatten/FlattenSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/flatten/FlattenSettings.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/flatten/FlattenSettings.stories.tsx :: Flatten Only Forms": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/fullscreen/DetailedToolItem.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/fullscreen/DetailedToolItem.stories.tsx :: Selected": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/GetPdfInfoReportView.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/GetPdfInfoReportView.stories.tsx :: No Data": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/GetPdfInfoResults.stories.tsx :: Partial Error": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/ComplianceSection.stories.tsx :: All Passed": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/ComplianceSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/ComplianceSection.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/KeyValueSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/KeyValueSection.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/OtherSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/OtherSection.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/PerPageSection.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/SummarySection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/SummarySection.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/SummarySection.stories.tsx :: Hidden Title": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/TableOfContentsSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/sections/TableOfContentsSection.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/shared/KeyValueList.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/shared/KeyValueList.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/shared/ScrollableCodeBlock.stories.tsx :: Custom Empty Message": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/shared/ScrollableCodeBlock.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/getPdfInfo/shared/SectionBlock.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/ocr/LanguagePicker.stories.tsx :: Default": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/tools/ocr/OCRSettings.stories.tsx :: Default": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/tools/redact/RedactAdvancedSettings.stories.tsx :: Default": [
+    "button-name"
+  ],
+  "editor/src/core/components/tools/redact/RedactSingleStepSettings.stories.tsx :: Automatic With Words": [
+    "button-name"
+  ],
+  "editor/src/core/components/tools/redact/RedactSingleStepSettings.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/redact/WordsToRedactInput.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/removeBlanks/RemoveBlanksSettings.stories.tsx :: Default": [
+    "aria-input-field-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/removeBlanks/RemoveBlanksSettings.stories.tsx :: Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/tools/removeBlanks/RemoveBlanksSettings.stories.tsx :: Include Blank Pages": [
+    "aria-input-field-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/removePages/RemovePagesSettings.stories.tsx :: Invalid Input": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/replaceColor/ReplaceColorSettings.stories.tsx :: Custom Color": [
+    "button-name",
+    "label"
+  ],
+  "editor/src/core/components/tools/replaceColor/ReplaceColorSettings.stories.tsx :: Default": [
+    "label"
+  ],
+  "editor/src/core/components/tools/replaceColor/ReplaceColorSettings.stories.tsx :: Disabled": [
+    "label"
+  ],
+  "editor/src/core/components/tools/sanitize/SanitizeSettings.stories.tsx :: All Selected": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/sanitize/SanitizeSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/sanitize/SanitizeSettings.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/scannerImageSplit/ScannerImageSplitSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/scannerImageSplit/ScannerImageSplitSettings.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/ErrorNotification.stories.tsx :: Custom Title": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/ErrorNotification.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/FileMetadata.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/FileMetadata.stories.tsx :: Unknown Type": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/NavigationControls.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/NavigationControls.stories.tsx :: Last File": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/NoToolsFound.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/NumberInputWithUnit.stories.tsx :: Default": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/shared/NumberInputWithUnit.stories.tsx :: Disabled": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/core/components/tools/shared/NumberInputWithUnit.stories.tsx :: With Min Max": [
+    "label"
+  ],
+  "editor/src/core/components/tools/shared/ResultsPreview.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/ResultsPreview.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/ResultsPreview.stories.tsx :: Loading": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/ResultsPreview.stories.tsx :: Single File": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/ToolStep.stories.tsx :: Collapsed": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/shared/ToolStep.stories.tsx :: With Help Text And Number": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/showJS/ShowJSView.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/showJS/ShowJSView.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/showJS/ShowJSView.stories.tsx :: With Download": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/sign/SavedSignaturesSection.stories.tsx :: Admin With Shared Delete": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/sign/SavedSignaturesSection.stories.tsx :: At Capacity": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/sign/SavedSignaturesSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/sign/SavedSignaturesSection.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/split/SplitSettings.stories.tsx :: By Poster": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/split/SplitSettings.stories.tsx :: By Sections": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/split/SplitSettings.stories.tsx :: No Method Selected": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/timestampPdf/TimestampPdfSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/timestampPdf/TimestampPdfSettings.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/toolPicker/FavoriteStar.stories.tsx :: Default": [
+    "aria-prohibited-attr"
+  ],
+  "editor/src/core/components/tools/toolPicker/FavoriteStar.stories.tsx :: Favorited": [
+    "aria-prohibited-attr"
+  ],
+  "editor/src/core/components/tools/toolPicker/FavoriteStar.stories.tsx :: Sizes": [
+    "aria-prohibited-attr"
+  ],
+  "editor/src/core/components/tools/validateSignature/ValidateSignatureReportView.stories.tsx :: Default": [
+    "aria-allowed-attr",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/ValidateSignatureReportView.stories.tsx :: Error": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/ValidateSignatureReportView.stories.tsx :: Multiple Signatures": [
+    "aria-allowed-attr",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/ValidateSignatureReportView.stories.tsx :: No Signatures": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/ValidateSignatureSettings.stories.tsx :: With Cert File": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/FieldBlock.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/FieldBlock.stories.tsx :: Empty Value": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/FileSummaryHeader.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/FileSummaryHeader.stories.tsx :: Missing Metadata": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/FileSummaryHeader.stories.tsx :: No Signatures": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/SignatureSection.stories.tsx :: Default": [
+    "aria-allowed-attr",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/SignatureSection.stories.tsx :: Invalid With Error": [
+    "aria-allowed-attr",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/SignatureSection.stories.tsx :: Self Signed Minimal Data": [
+    "aria-allowed-attr",
+    "color-contrast"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/SignatureStatusBadge.stories.tsx :: Default": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/SignatureStatusBadge.stories.tsx :: Invalid": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/tools/validateSignature/reportView/SignatureStatusBadge.stories.tsx :: Untrusted Signer": [
+    "aria-allowed-attr"
+  ],
+  "editor/src/core/components/viewer/DocumentReadyWrapper.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/LocalEmbedPDF.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/LocalEmbedPDF.stories.tsx :: Unsupported File": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/NonPdfViewer.stories.tsx :: Csv": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/NonPdfViewer.stories.tsx :: Unsupported": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/SearchInterface.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/SearchInterface.stories.tsx :: Hidden": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/nonpdf/CsvViewer.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/nonpdf/CsvViewer.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/nonpdf/CsvViewer.stories.tsx :: Tsv": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/nonpdf/HtmlViewer.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/nonpdf/JsonViewer.stories.tsx :: Invalid Json": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/nonpdf/NonPdfBanner.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/nonpdf/TextViewer.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/components/viewer/nonpdf/TextViewer.stories.tsx :: Markdown": [
+    "color-contrast"
+  ],
+  "editor/src/core/tokens/Tokens.stories.tsx :: Colours": ["color-contrast"],
+  "editor/src/core/ui/Banner.stories.tsx :: Playground": ["color-contrast"],
+  "editor/src/core/ui/Banner.stories.tsx :: Success": ["color-contrast"],
+  "editor/src/core/ui/Banner.stories.tsx :: Tone Matrix": ["color-contrast"],
+  "editor/src/core/ui/Banner.stories.tsx :: With Action": ["color-contrast"],
+  "editor/src/core/ui/Button.stories.tsx :: Accents": ["color-contrast"],
+  "editor/src/core/ui/Button.stories.tsx :: Disabled Dark": ["color-contrast"],
+  "editor/src/core/ui/Button.stories.tsx :: Loading": ["button-name"],
+  "editor/src/core/ui/Button.stories.tsx :: Padding": ["color-contrast"],
+  "editor/src/core/ui/Button.stories.tsx :: Playground": ["color-contrast"],
+  "editor/src/core/ui/Button.stories.tsx :: Shape": ["color-contrast"],
+  "editor/src/core/ui/Button.stories.tsx :: Sizes": ["color-contrast"],
+  "editor/src/core/ui/Button.stories.tsx :: Variants": ["color-contrast"],
+  "editor/src/core/ui/Button.stories.tsx :: With Icons": ["color-contrast"],
+  "editor/src/core/ui/ChatFABButton.stories.tsx :: Default": ["button-name"],
+  "editor/src/core/ui/ChatFABButton.stories.tsx :: Loading": ["button-name"],
+  "editor/src/core/ui/ChatFABButton.stories.tsx :: Tick": ["button-name"],
+  "editor/src/core/ui/ChatFABButton.stories.tsx :: Tick While Loading": [
+    "button-name"
+  ],
+  "editor/src/core/ui/ChatFABWindow.stories.tsx :: Open": ["color-contrast"],
+  "editor/src/core/ui/ChatFABWindow.stories.tsx :: Toggle": ["color-contrast"],
+  "editor/src/core/ui/Chip.stories.tsx :: Accents": ["color-contrast"],
+  "editor/src/core/ui/Chip.stories.tsx :: Dashed Add": ["nested-interactive"],
+  "editor/src/core/ui/Chip.stories.tsx :: In Context Op Chain": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/Chip.stories.tsx :: Playground": [
+    "color-contrast",
+    "nested-interactive"
+  ],
+  "editor/src/core/ui/CodeBlock.stories.tsx :: In Context Quickstart": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/CodeBlock.stories.tsx :: In Context Two Up Comparison": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/CodeBlock.stories.tsx :: Long Scrolling": [
+    "color-contrast",
+    "scrollable-region-focusable"
+  ],
+  "editor/src/core/ui/CodeBlock.stories.tsx :: Playground": ["color-contrast"],
+  "editor/src/core/ui/Drawer.stories.tsx :: Playground": [
+    "aria-allowed-role",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/Drawer.stories.tsx :: With Footer": [
+    "aria-allowed-role",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/EmptyState.stories.tsx :: With CT As": ["color-contrast"],
+  "editor/src/core/ui/FilePicker.stories.tsx :: Accept Pdf": ["color-contrast"],
+  "editor/src/core/ui/FilePicker.stories.tsx :: Default": ["color-contrast"],
+  "editor/src/core/ui/FilePicker.stories.tsx :: Multiple": ["color-contrast"],
+  "editor/src/core/ui/Forms.stories.tsx :: Checkbox Grid Of Categories": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/Forms.stories.tsx :: Full Form": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/Forms.stories.tsx :: Input Default": ["color-contrast"],
+  "editor/src/core/ui/Forms.stories.tsx :: Input Error": ["color-contrast"],
+  "editor/src/core/ui/Forms.stories.tsx :: Input With Icon": ["color-contrast"],
+  "editor/src/core/ui/Forms.stories.tsx :: Radio Group": ["color-contrast"],
+  "editor/src/core/ui/Forms.stories.tsx :: Radio Horizontal": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/Forms.stories.tsx :: Slider Confidence": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/Forms.stories.tsx :: Slider Retention": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/Inline.stories.tsx :: Default": ["color-contrast"],
+  "editor/src/core/ui/Inline.stories.tsx :: Space Between": ["color-contrast"],
+  "editor/src/core/ui/Inline.stories.tsx :: Wrap": ["color-contrast"],
+  "editor/src/core/ui/ListRow.stories.tsx :: In Card": ["color-contrast"],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Color Input Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Color Input Error": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Color Input Preselected": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Color Input Sm Size": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Multi Select Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Multi Select Error": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Multi Select Sm Size": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Multi Select With Values": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Number Input Decimal": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Number Input Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Number Input Error": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Number Input Sm Size": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Number Input With Unit": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Select Default": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Select Error": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Select Searchable": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Select Sm Size": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Slider Default": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Slider Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Slider No Label": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Slider With Marks": [
+    "aria-input-field-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MantineForms.stories.tsx :: Watermark Form": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MethodBadge.stories.tsx :: Default": ["color-contrast"],
+  "editor/src/core/ui/MethodBadge.stories.tsx :: In Row": ["color-contrast"],
+  "editor/src/core/ui/MethodBadge.stories.tsx :: Matrix": ["color-contrast"],
+  "editor/src/core/ui/MetricCard.stories.tsx :: Playground": ["color-contrast"],
+  "editor/src/core/ui/MetricCard.stories.tsx :: Pro Tier Strip": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/MetricStrip.stories.tsx :: Default": ["color-contrast"],
+  "editor/src/core/ui/NavItem.stories.tsx :: In Context Sidebar Group": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/PanelHeader.stories.tsx :: With Actions": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/ProgressBar.stories.tsx :: In Context Usage Meter": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/ProgressBar.stories.tsx :: Playground": [
+    "aria-progressbar-name"
+  ],
+  "editor/src/core/ui/ProgressBar.stories.tsx :: Threshold Ladder": [
+    "aria-progressbar-name"
+  ],
+  "editor/src/core/ui/SegmentedControl.stories.tsx :: Variants": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/SegmentedControl.stories.tsx :: With Icons": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/SettingsRow.stories.tsx :: List": ["label"],
+  "editor/src/core/ui/SettingsRow.stories.tsx :: Select Control": ["label"],
+  "editor/src/core/ui/SettingsRow.stories.tsx :: Toggle": ["label"],
+  "editor/src/core/ui/SettingsRow.stories.tsx :: With Description": ["label"],
+  "editor/src/core/ui/SettingsShell.stories.tsx :: Default": ["color-contrast"],
+  "editor/src/core/ui/StatTile.stories.tsx :: Tone Row": ["color-contrast"],
+  "editor/src/core/ui/StatusBadge.stories.tsx :: All Tones": ["color-contrast"],
+  "editor/src/core/ui/StatusBadge.stories.tsx :: Default": ["color-contrast"],
+  "editor/src/core/ui/StatusBadge.stories.tsx :: Live": ["color-contrast"],
+  "editor/src/core/ui/StatusBadge.stories.tsx :: Sizes": ["color-contrast"],
+  "editor/src/core/ui/StepIndicator.stories.tsx :: Small": [
+    "aria-progressbar-name"
+  ],
+  "editor/src/core/ui/StepIndicator.stories.tsx :: Step 1": [
+    "aria-progressbar-name"
+  ],
+  "editor/src/core/ui/StepIndicator.stories.tsx :: Step 2": [
+    "aria-progressbar-name"
+  ],
+  "editor/src/core/ui/StepIndicator.stories.tsx :: Step 3": [
+    "aria-progressbar-name"
+  ],
+  "editor/src/core/ui/Table.stories.tsx :: Basic": ["color-contrast"],
+  "editor/src/core/ui/Table.stories.tsx :: Interactive": ["color-contrast"],
+  "editor/src/core/ui/Tabs.stories.tsx :: In Context Document Verticals": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/Tabs.stories.tsx :: Playground": ["color-contrast"],
+  "editor/src/core/ui/Tabs.stories.tsx :: With Disabled Tab": [
+    "color-contrast"
+  ],
+  "editor/src/core/ui/Toast.stories.tsx :: Triggers": ["color-contrast"],
+  "editor/src/portal/components/AppShell.stories.tsx :: Mobile": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/AppShell.stories.tsx :: With Home View": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/AssistantPanel.stories.tsx :: Reply Fails": [
+    "aria-allowed-role"
+  ],
+  "editor/src/portal/components/AssistantPanel.stories.tsx :: Slow Reply": [
+    "aria-allowed-role"
+  ],
+  "editor/src/portal/components/AssistantPanel.stories.tsx :: Suggestions Only": [
+    "aria-allowed-role",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/ChatFABWidget.stories.tsx :: Closed": [
+    "aria-hidden-focus"
+  ],
+  "editor/src/portal/components/ChatFABWidget.stories.tsx :: Full Flow": [
+    "aria-hidden-focus",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/ChatFABWidget.stories.tsx :: Loading While Closed": [
+    "aria-hidden-focus"
+  ],
+  "editor/src/portal/components/ChatFABWidget.stories.tsx :: Unread Result": [
+    "aria-hidden-focus"
+  ],
+  "editor/src/portal/components/EditorStatusCard.stories.tsx :: Deployment Unavailable": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/EditorStatusCard.stories.tsx :: With Setup Checklist": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/ErrorBoundary.stories.tsx :: Caught Error": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/HomeHero.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/HomeHero.stories.tsx :: Free Tier": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/PortalChrome.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/ProcessorFlow.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/ProcessorFlow.stories.tsx :: Idle Empty": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/ProcessorFlow.stories.tsx :: Playground": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/SearchModal.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/SearchModal.stories.tsx :: Empty Catalogue": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/SetupChecklist.stories.tsx :: Almost Done": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/SetupChecklist.stories.tsx :: In Progress": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/SetupChecklist.stories.tsx :: Not Started": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/Sidebar.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/Sidebar.stories.tsx :: Enterprise Tier": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/Sidebar.stories.tsx :: Free Tier": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/WelcomeBanner.stories.tsx :: With Setup Checklist": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/account-link/AccountLinkPanel.stories.tsx :: Default": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/portal/components/account-link/AccountLinkPanel.stories.tsx :: Load Forbidden": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/account-link/AccountLinkPanel.stories.tsx :: Not Linked": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/account-link/LinkAccountCard.stories.tsx :: Error": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/account-link/LinkAccountCard.stories.tsx :: Linked": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/account-link/LinkAccountCard.stories.tsx :: Linking": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/account-link/LinkAccountCard.stories.tsx :: Not Linked": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/account-link/LinkAccountCard.stories.tsx :: Unconfigured": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/account-link/LinkedInstancesTable.stories.tsx :: Default": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/portal/components/billing/ActivationChoiceModal.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/BundleCheckoutModal.stories.tsx :: First Purchase": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/BundleCheckoutModal.stories.tsx :: Top Up": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/CardPlaceholder.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/FreePlanView.stories.tsx :: Leader": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/FreePlanView.stories.tsx :: Member": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/InvoicesList.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/PrepaidCapacityCard.stories.tsx :: Bundle Healthy": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/PrepaidCapacityCard.stories.tsx :: Bundle Low": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/SpendLimitCard.stories.tsx :: Approaching Cap": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/SpendLimitCard.stories.tsx :: Editing": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/SpendLimitCard.stories.tsx :: Within Cap": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/SpendThisMonthCard.stories.tsx :: With Free Remaining": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/StripeCheckoutModal.stories.tsx :: Set Cap": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/StripeCheckoutModal.stories.tsx :: Uncapped": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/SubscribedPlanView.stories.tsx :: Approaching Cap": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/SubscribedPlanView.stories.tsx :: Leader": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/SubscribedPlanView.stories.tsx :: With Prepaid": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/WalletMeter.stories.tsx :: Free Approaching Limit": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/WalletMeter.stories.tsx :: Free Limit Reached": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/billing/WalletMeter.stories.tsx :: Free Plenty Left": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/AuthenticationSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/ComponentsSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/DocsNav.stories.tsx :: Badged Leaf Active": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/DocsNav.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/DocsSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/DocsSection.stories.tsx :: Without Lead": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/EndpointReferenceSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/ErrorsSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/GettingStartedSection.stories.tsx :: Default": [
+    "color-contrast",
+    "heading-order"
+  ],
+  "editor/src/portal/components/docs/LangSnippet.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/LangSnippet.stories.tsx :: Single Language": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/PlaybooksSection.stories.tsx :: Default": [
+    "color-contrast",
+    "heading-order"
+  ],
+  "editor/src/portal/components/docs/RateLimitsSection.stories.tsx :: Enterprise": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/RateLimitsSection.stories.tsx :: Free": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/RateLimitsSection.stories.tsx :: Pro": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/docs/SdksSection.stories.tsx :: Default": [
+    "color-contrast",
+    "heading-order"
+  ],
+  "editor/src/portal/components/docs/SdksSection.stories.tsx :: Ga Only": [
+    "color-contrast",
+    "heading-order"
+  ],
+  "editor/src/portal/components/docs/SkillsSection.stories.tsx :: Default": [
+    "color-contrast",
+    "heading-order"
+  ],
+  "editor/src/portal/components/docs/WebhooksSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/DocumentAudit.stories.tsx :: Approved": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/DocumentAudit.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/DocumentDrawer.stories.tsx :: Default": [
+    "aria-allowed-role",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/DocumentDrawer.stories.tsx :: Sensitive": [
+    "aria-allowed-role",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/DocumentExtractions.stories.tsx :: Masked": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/ElevationBanner.stories.tsx :: Granted": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/ElevationBanner.stories.tsx :: Granted Four Eyes": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/ElevationBanner.stories.tsx :: Locked": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/ElevationBanner.stories.tsx :: Locked Four Eyes": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/ReviewQueue.stories.tsx :: Default": [
+    "aria-prohibited-attr",
+    "color-contrast",
+    "empty-table-header",
+    "nested-interactive"
+  ],
+  "editor/src/portal/components/documents/ReviewQueue.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/documents/ReviewQueueTable.stories.tsx :: Default": [
+    "aria-prohibited-attr",
+    "color-contrast",
+    "empty-table-header",
+    "nested-interactive"
+  ],
+  "editor/src/portal/components/documents/ReviewQueueTable.stories.tsx :: Empty": [
+    "empty-table-header"
+  ],
+  "editor/src/portal/components/documents/ReviewQueueTable.stories.tsx :: Needs Review": [
+    "color-contrast",
+    "empty-table-header",
+    "nested-interactive"
+  ],
+  "editor/src/portal/components/editor-admin/CredentialRotationCard.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/CredentialRotationCard.stories.tsx :: Recently Rotated": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/DeploymentSummaryStrip.stories.tsx :: Enterprise": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/DeploymentSummaryStrip.stories.tsx :: Pro": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/DeploymentTargets.stories.tsx :: Enterprise": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/DeploymentTargets.stories.tsx :: Free": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/DeploymentTargets.stories.tsx :: Pro": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/InstanceHealthTable.stories.tsx :: Enterprise": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/InstanceHealthTable.stories.tsx :: Pro": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/OfflineActivationCard.stories.tsx :: Locked": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/PairingPanel.stories.tsx :: Enterprise": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/editor-admin/PairingPanel.stories.tsx :: Pro": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/ApiKeyCard.stories.tsx :: Personal": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/ApiKeyCard.stories.tsx :: Revoked": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/ApiKeysTab.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/ApiKeysTab.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/ApiKeysTab.stories.tsx :: Loading": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/AuditExportModal.stories.tsx :: Export Fails": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/AuditExportModal.stories.tsx :: Open": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/AuditTab.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/AuditTab.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/AuditTab.stories.tsx :: Loading": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/AuditTab.stories.tsx :: Non Lead Forbidden": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/AuditTab.stories.tsx :: Team Lead Scoped": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/CreateKeyModal.stories.tsx :: Form": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/DeploymentsTab.stories.tsx :: Default": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/ModelsTab.stories.tsx :: Enterprise": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/ModelsTab.stories.tsx :: Free": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/ModelsTab.stories.tsx :: Pro": [
+    "aria-progressbar-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/SecurityTab.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/infrastructure/StorageTab.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/pipelines/PipelineStepSettings.stories.tsx :: No Settings": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/pipelines/PipelineStepSettings.stories.tsx :: Unsupported": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/pipelines/PipelinesTable.stories.tsx :: Default": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/portal/components/pipelines/PipelinesTable.stories.tsx :: Empty": [
+    "empty-table-header"
+  ],
+  "editor/src/portal/components/policies/PolicyCategoryCard.stories.tsx :: Coming Soon": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyCategoryCard.stories.tsx :: Configured": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyCategoryCard.stories.tsx :: Not Set Up": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyDetailPanel.stories.tsx :: Active": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyDetailPanel.stories.tsx :: Custom No Activity": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyDetailPanel.stories.tsx :: Paused": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyDetailPanel.stories.tsx :: With Flagged Items": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyExternalApiConfig.stories.tsx :: Custom Api Escape Hatch": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyExternalApiConfig.stories.tsx :: Notify Configured": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyFieldRow.stories.tsx :: Chips": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyFieldRow.stories.tsx :: Select": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyFieldRow.stories.tsx :: Text": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyPurviewConfig.stories.tsx :: Configured": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyPurviewConfig.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyPurviewReadConfig.stories.tsx :: Connection Selected": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicyPurviewReadConfig.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicySetupWizard.stories.tsx :: Classification": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/policies/PolicySetupWizard.stories.tsx :: Create": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/portal/components/policies/PolicySetupWizard.stories.tsx :: Edit": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/portal/components/procurement/DealJourney.stories.tsx :: At Trial": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DealJourney.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DealJourney.stories.tsx :: Live": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DealStatusHero.stories.tsx :: Agreement": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DealStatusHero.stories.tsx :: Live": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DealStatusHero.stories.tsx :: Payment": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DealStatusHero.stories.tsx :: Quote": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DealStatusHero.stories.tsx :: Trial": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DocRow.stories.tsx :: Complete": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DocRow.stories.tsx :: Download": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DocRow.stories.tsx :: Locked": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DocRow.stories.tsx :: Paid Addon": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DocRow.stories.tsx :: Sign Action": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DocumentLedger.stories.tsx :: At Trial": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/DocumentLedger.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/LockedState.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/ProcurementAgreement.stories.tsx :: Agreeing": [
+    "color-contrast",
+    "scrollable-region-focusable"
+  ],
+  "editor/src/portal/components/procurement/ProcurementAgreement.stories.tsx :: Default": [
+    "color-contrast",
+    "scrollable-region-focusable"
+  ],
+  "editor/src/portal/components/procurement/ProcurementAgreement.stories.tsx :: Downloading": [
+    "color-contrast",
+    "scrollable-region-focusable"
+  ],
+  "editor/src/portal/components/procurement/ProcurementBanner.stories.tsx :: Deal Underway": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/ProcurementBanner.stories.tsx :: Upsell": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/ProcurementExtras.stories.tsx :: License": [
+    "aria-dialog-name"
+  ],
+  "editor/src/portal/components/procurement/ProcurementExtras.stories.tsx :: License Trial": [
+    "aria-dialog-name"
+  ],
+  "editor/src/portal/components/procurement/ProcurementExtras.stories.tsx :: Schedule Call": [
+    "aria-dialog-name"
+  ],
+  "editor/src/portal/components/procurement/ProcurementExtras.stories.tsx :: Trial Manage": [
+    "aria-dialog-name"
+  ],
+  "editor/src/portal/components/procurement/ProcurementExtras.stories.tsx :: Trial Manage Maxed": [
+    "aria-dialog-name"
+  ],
+  "editor/src/portal/components/procurement/ProcurementExtras.stories.tsx :: Trial Setup": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/ProcurementFlow.stories.tsx :: Default": [
+    "color-contrast",
+    "scrollable-region-focusable"
+  ],
+  "editor/src/portal/components/procurement/ProcurementFlow.stories.tsx :: Unlinked": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/ProcurementHome.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/ProcurementStages.stories.tsx :: License": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/ProcurementStages.stories.tsx :: License Downloading": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/ProcurementStages.stories.tsx :: License Online Only": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/QuoteBuilder.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/procurement/StageStepper.stories.tsx :: Locked": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/sources/ConnectionForm.stories.tsx :: Conditional Fields Revealed": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/sources/ConnectionForm.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/sources/ConnectionForm.stories.tsx :: Filled": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/sources/ConnectionModal.stories.tsx :: Edit": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/sources/ConnectionModal.stories.tsx :: Fixed Type": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/sources/SourceModal.stories.tsx :: Edit Folder": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/sources/SourceModal.stories.tsx :: Edit Webhook": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/sources/SourcesTable.stories.tsx :: Default": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/portal/components/users/ConfirmModal.stories.tsx :: Danger": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/ConfirmModal.stories.tsx :: Neutral": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/InviteMemberModal.stories.tsx :: Create Account Form": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/InviteMemberModal.stories.tsx :: No Admin Role": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/InviteMemberModal.stories.tsx :: Open": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/InviteMemberModal.stories.tsx :: Scoped To Team": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/InviteMemberModal.stories.tsx :: Self Hosted Direct Create": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/InviteMemberModal.stories.tsx :: Self Hosted No Mail": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/MoveToTeamModal.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/NewTeamModal.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/PendingInvitations.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/PendingInvitations.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/PendingInvitations.stories.tsx :: Expires Today": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/RenameTeamModal.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/ResetPasswordModal.stories.tsx :: Default": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/portal/components/users/ResetPasswordModal.stories.tsx :: With Email": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/portal/components/users/UsersDirectory.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/UsersDirectory.stories.tsx :: Large Team": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/UsersDirectory.stories.tsx :: Member States": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/UsersDirectory.stories.tsx :: Org Only": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/UsersDirectory.stories.tsx :: Saas Team Leader": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/UsersDirectory.stories.tsx :: Single Team": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/UsersDirectory.stories.tsx :: Team Wide Processor": [
+    "color-contrast"
+  ],
+  "editor/src/portal/components/users/UsersDirectory.stories.tsx :: With Guests": [
+    "color-contrast"
+  ],
+  "editor/src/portal/data/Endpoints.stories.tsx :: By Vertical": [
+    "color-contrast"
+  ],
+  "editor/src/portal/data/Ops.stories.tsx :: Agents": ["color-contrast"],
+  "editor/src/portal/data/Ops.stories.tsx :: Library By Category": [
+    "color-contrast"
+  ],
+  "editor/src/portal/data/Ops.stories.tsx :: Pipeline Ops": ["color-contrast"],
+  "editor/src/portal/theme/MantineIntegration.stories.tsx :: Side By Side": [
+    "color-contrast"
+  ],
+  "editor/src/portal/views/DeveloperDocs.stories.tsx :: Default": [
+    "color-contrast",
+    "landmark-unique"
+  ],
+  "editor/src/portal/views/Documents.stories.tsx :: Default": [
+    "aria-prohibited-attr",
+    "color-contrast",
+    "empty-table-header",
+    "nested-interactive"
+  ],
+  "editor/src/portal/views/Documents.stories.tsx :: Empty": [
+    "aria-prohibited-attr",
+    "color-contrast",
+    "empty-table-header",
+    "nested-interactive"
+  ],
+  "editor/src/portal/views/Home.stories.tsx :: Enterprise Tier": [
+    "color-contrast",
+    "landmark-no-duplicate-banner",
+    "landmark-unique"
+  ],
+  "editor/src/portal/views/Home.stories.tsx :: Free Tier": ["color-contrast"],
+  "editor/src/portal/views/Home.stories.tsx :: Pro Tier": [
+    "color-contrast",
+    "landmark-no-duplicate-banner",
+    "landmark-unique"
+  ],
+  "editor/src/portal/views/Home.stories.tsx :: Subscribed In Procurement": [
+    "color-contrast",
+    "landmark-no-duplicate-banner",
+    "landmark-unique"
+  ],
+  "editor/src/portal/views/Integrations.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/views/Integrations.stories.tsx :: No Connections": [
+    "color-contrast"
+  ],
+  "editor/src/portal/views/PipelineBuilder.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/portal/views/Pipelines.stories.tsx :: Default": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/portal/views/Pipelines.stories.tsx :: Empty": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/portal/views/Policies.stories.tsx :: Default": ["color-contrast"],
+  "editor/src/portal/views/Policies.stories.tsx :: Empty": ["color-contrast"],
+  "editor/src/portal/views/Sources.stories.tsx :: Default": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/portal/views/Sources.stories.tsx :: Empty": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/proprietary/auth/ui/AuthScreens.stories.tsx :: Signup": [
+    "aria-hidden-focus"
+  ],
+  "editor/src/proprietary/auth/ui/EmailPasswordForm.stories.tsx :: With Errors": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/policies/PolicyPiiField.stories.tsx :: With Selection": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/policies/PolicyRedactConfig.stories.tsx :: With Selection": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/policies/PolicyWatermarkConfig.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/proprietary/components/policies/PolicyWatermarkConfig.stories.tsx :: Disabled": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/proprietary/components/shared/ChangeUserPasswordModal.stories.tsx :: Default": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/ChangeUserPasswordModal.stories.tsx :: Mail Disabled": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/ChangeUserPasswordModal.stories.tsx :: Non Email Username": [
+    "aria-dialog-name",
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/UpdateSeatsModal.stories.tsx :: At Minimum": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/UpdateSeatsModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/EnterpriseRequiredBanner.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/GeneralWithLoginLanding.stories.tsx :: Admin Banner": [
+    "label"
+  ],
+  "editor/src/proprietary/components/shared/config/GeneralWithLoginLanding.stories.tsx :: Default": [
+    "label"
+  ],
+  "editor/src/proprietary/components/shared/config/GeneralWithLoginLanding.stories.tsx :: With Backend Version": [
+    "label"
+  ],
+  "editor/src/proprietary/components/shared/config/OverviewHeader.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/OverviewHeader.stories.tsx :: Signed In": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AccountSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AccountSection.stories.tsx :: Mfa Enabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AccountSection.stories.tsx :: Sso User": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AdminAiDocumentsSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AdminAiGeneralSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AdminAiLimitsSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AdminAiModelsSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.stories.tsx :: Audit Logging Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.stories.tsx :: Enabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AdminAuditSection.stories.tsx :: Login Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AdminFolderAccessSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/AdminFolderAccessSection.stories.tsx :: Login Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/ApiKeys.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/ApiKeys.stories.tsx :: Load Error": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/ApiKeys.stories.tsx :: Loading": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/LoginAgreementEditor.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/LoginAgreementEditor.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.stories.tsx :: Default": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/TeamDetailsSection.stories.tsx :: Empty": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/TeamsSection.stories.tsx :: Default": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/TeamsSection.stories.tsx :: Empty": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/TeamsSection.stories.tsx :: Login Disabled": [
+    "color-contrast",
+    "empty-table-header"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/apiKeys/RefreshModal.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditClearDataSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditClearDataSection.stories.tsx :: Login Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditEventsTable.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditEventsTable.stories.tsx :: With File Metadata Columns": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.stories.tsx :: All Fields Enabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditExportSection.stories.tsx :: Login Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.stories.tsx :: Interactive": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditFiltersForm.stories.tsx :: With Filters Applied": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditStatsCards.stories.tsx :: Day": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditStatsCards.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditStatsCards.stories.tsx :: Month": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditSystemStatus.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/audit/AuditSystemStatus.stories.tsx :: Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.stories.tsx :: Login Disabled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/plan/AvailablePlansSection.stories.tsx :: With Currency Selector": [
+    "color-contrast",
+    "label"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.stories.tsx :: Current Tier": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.stories.tsx :: Enterprise Plan": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/plan/PlanCard.stories.tsx :: Free Plan": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsChart.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsChart.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsTable.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/config/configSections/usage/UsageAnalyticsTable.stories.tsx :: Empty": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/StripeCheckout.stories.tsx :: Default": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/StripeCheckout.stories.tsx :: Hosted Checkout Success": [
+    "button-name",
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/components/PriceDisplay.stories.tsx :: Enterprise": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/components/PriceDisplay.stories.tsx :: Enterprise With Total": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/components/PriceDisplay.stories.tsx :: Simple": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/components/PricingBadge.stories.tsx :: Current": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/components/PricingBadge.stories.tsx :: Popular": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/components/PricingBadge.stories.tsx :: Savings": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.stories.tsx :: Filled": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/EmailStage.stories.tsx :: With Error": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/ErrorStage.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/ErrorStage.stories.tsx :: Network Error": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/PaymentStage.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/PaymentStage.stories.tsx :: Redirecting": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.stories.tsx :: Enterprise": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/PlanSelectionStage.stories.tsx :: With Savings": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.stories.tsx :: Polling": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.stories.tsx :: Timeout": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/shared/stripeCheckout/stages/SuccessStage.stories.tsx :: Upgrade Complete": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/workflow/ParticipantView.stories.tsx :: Completed": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/workflow/ParticipantView.stories.tsx :: Default": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/components/workflow/ParticipantView.stories.tsx :: Expired": [
+    "color-contrast"
+  ],
+  "editor/src/proprietary/routes/login/OAuthButtons.stories.tsx :: Vertical": [
+    "image-redundant-alt"
+  ]
+}
diff --git a/frontend/.storybook/a11y-check.mjs b/frontend/.storybook/a11y-check.mjs
new file mode 100644
index 0000000000..7eef5e079e
--- /dev/null
+++ b/frontend/.storybook/a11y-check.mjs
@@ -0,0 +1,202 @@
+// a11y regression gate — baseline diff.
+//
+// Consumes the Storybook Vitest scan's JSON reporter output (one or more files
+// in --in) and compares each story's axe rule violations against
+// .storybook/a11y-baseline.json. Existing violations are grandfathered; the gate
+// fails when a story breaks a rule it wasn't already breaking, when a story
+// crashes, or when the scan didn't cover everything it was supposed to.
+//
+//   node a11y-check.mjs --in <dir> --manifest <file>           # diff (the gate)
+//   node a11y-check.mjs --in <dir> --manifest <file> --record   # (re)write baseline
+//   node a11y-check.mjs --in <dir> --merge                     # union into baseline
+//
+// Exit codes: 0 pass · 1 regression · 2 unusable scan (incomplete/no input).
+//
+// The baseline records WHICH rules a story breaks, not how many nodes break
+// them. Node counts drift between runs (stories fetch data asynchronously, so
+// axe sometimes samples the DOM before late content lands), which made a
+// count-based gate cry wolf on unrelated changes. Rule presence is stable, and
+// "story now breaks a rule it didn't before" is the regression worth blocking.
+//
+// Run from frontend/. Baseline path defaults next to this script.
+
+import { readFileSync, readdirSync, writeFileSync, existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { dirname, join } from "node:path";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const args = process.argv.slice(2);
+const opt = (n, d) => {
+  const i = args.indexOf(n);
+  const v = i >= 0 ? args[i + 1] : undefined;
+  // A flag given without a value is a mistake, not a request for the default.
+  if (i >= 0 && (v === undefined || v.startsWith("--"))) {
+    console.error(`a11y-check: ${n} requires a value`);
+    process.exit(2);
+  }
+  return v ?? d;
+};
+const record = args.includes("--record");
+const merge = args.includes("--merge");
+const inDir = opt("--in", ".a11y-scan");
+const manifestFile = opt("--manifest", "");
+const baselineFile = opt("--baseline", join(here, "a11y-baseline.json"));
+
+// Every axe violation block in the matcher's message ends with a link to the
+// rule's docs, e.g. .../rules/axe/4.11/color-contrast?application=axeAPI. That
+// URL is the only machine-stable rule id in the message — the human-readable
+// help text around it is free to change between addon and axe versions.
+const RULE_URL = /dequeuniversity\.com\/rules\/axe\/[\d.]+\/([a-z0-9-]+)/g;
+
+/** Reads every scan report in `dir`, keyed by "<storyFile> :: <storyName>". */
+function collect(dir) {
+  const rules = {}; // storyKey -> Set(ruleId)
+  const crashed = []; // storyKey[] — failed for a non-a11y reason
+  const seenFiles = new Set();
+  let scanned = 0;
+
+  for (const cf of readdirSync(dir).filter((f) => /\.json$/.test(f))) {
+    let report;
+    try {
+      report = JSON.parse(readFileSync(join(dir, cf), "utf8"));
+    } catch {
+      console.error(`a11y-check: unreadable scan report: ${cf}`);
+      process.exit(2);
+    }
+    for (const tf of report.testResults || []) {
+      const norm = tf.name.replace(/\\/g, "/");
+      const idx = norm.search(/editor\/src\//);
+      const file = idx >= 0 ? norm.slice(idx) : norm;
+      seenFiles.add(file);
+      for (const a of tf.assertionResults || []) {
+        scanned++;
+        if (a.status === "passed") continue;
+        const key = `${file} :: ${a.title || a.fullName || "?"}`;
+        const found = new Set();
+        for (const m of a.failureMessages || [])
+          for (const hit of m.matchAll(RULE_URL)) found.add(hit[1]);
+        if (found.size) {
+          rules[key] = rules[key] || new Set();
+          for (const id of found) rules[key].add(id);
+        } else {
+          // No rule link anywhere in the message: the story threw, timed out or
+          // otherwise failed. Silently dropping these is how a broken scan can
+          // look clean — and a crashed story reports no violations at all,
+          // which would also mask any it really has.
+          crashed.push(key);
+        }
+      }
+    }
+  }
+  return { rules, crashed, seenFiles, scanned };
+}
+
+if (!existsSync(inDir)) {
+  console.error(`a11y-check: scan dir not found: ${inDir}`);
+  process.exit(2);
+}
+const { rules, crashed, seenFiles, scanned } = collect(inDir);
+const observed = {};
+for (const [k, set] of Object.entries(rules)) observed[k] = [...set].sort();
+
+// Completeness: every story file the scan was asked to cover must appear in the
+// reports. A dropped batch (killed process, empty report) would otherwise read
+// as "those stories have no violations" and pass.
+if (manifestFile) {
+  if (!existsSync(manifestFile)) {
+    console.error(`a11y-check: manifest not found: ${manifestFile}`);
+    process.exit(2);
+  }
+  const expected = readFileSync(manifestFile, "utf8")
+    .split("\n")
+    .map((l) => l.trim().replace(/\\/g, "/"))
+    .filter(Boolean);
+  const missing = expected.filter((f) => !seenFiles.has(f));
+  if (missing.length) {
+    console.error(
+      `a11y-check: scan is incomplete — ${missing.length} of ${expected.length} story files produced no results:`,
+    );
+    missing.slice(0, 20).forEach((f) => console.error(`  ${f}`));
+    if (missing.length > 20)
+      console.error(`  … and ${missing.length - 20} more`);
+    console.error("Refusing to report on a partial scan.");
+    process.exit(2);
+  }
+}
+
+if (record || merge) {
+  const base =
+    merge && existsSync(baselineFile)
+      ? JSON.parse(readFileSync(baselineFile, "utf8"))
+      : {};
+  if (crashed.length) {
+    console.error(
+      `a11y-check: refusing to record — ${crashed.length} story(ies) failed for a non-a11y reason:`,
+    );
+    crashed.slice(0, 20).forEach((k) => console.error(`  ${k}`));
+    console.error("Fix those first; recording now would bake in blind spots.");
+    process.exit(2);
+  }
+  // Union, so a re-record can only widen what's grandfathered — it never drops
+  // a rule that a slower run happened to miss and then reports it as new.
+  for (const [k, list] of Object.entries(observed))
+    base[k] = [...new Set([...(base[k] || []), ...list])].sort();
+  const sorted = {};
+  for (const k of Object.keys(base).sort()) sorted[k] = base[k];
+  writeFileSync(baselineFile, JSON.stringify(sorted, null, 2) + "\n");
+  const pairs = Object.values(sorted).reduce((s, l) => s + l.length, 0);
+  console.log(
+    `baseline ${merge ? "merged" : "recorded"}: ${scanned} stories scanned, ` +
+      `${Object.keys(sorted).length} with violations, ${pairs} story-rule pairs.`,
+  );
+  process.exit(0);
+}
+
+if (!existsSync(baselineFile)) {
+  console.error("a11y-check: no baseline file:", baselineFile);
+  process.exit(2);
+}
+const baseline = JSON.parse(readFileSync(baselineFile, "utf8"));
+
+const regressions = [];
+for (const [key, list] of Object.entries(observed)) {
+  const base = baseline[key] || [];
+  for (const id of list)
+    if (!base.includes(id)) regressions.push(`NEW    ${key}  ${id}`);
+}
+// Stories that improved — reported so the baseline can be ratcheted down, never
+// a failure.
+const fixed = Object.keys(baseline).filter(
+  (k) => seenFiles.has(k.split(" :: ")[0]) && !observed[k],
+);
+
+const pairs = Object.values(observed).reduce((s, l) => s + l.length, 0);
+console.log(
+  `a11y scan: ${scanned} stories, ${Object.keys(observed).length} with violations, ` +
+    `${pairs} story-rule pairs (baselined).`,
+);
+
+if (crashed.length) {
+  console.error(`\n✖ ${crashed.length} story(ies) failed to render:`);
+  crashed.slice(0, 50).forEach((k) => console.error(`  ${k}`));
+  if (crashed.length > 50) console.error(`  … and ${crashed.length - 50} more`);
+}
+if (regressions.length) {
+  console.error(`\n✖ ${regressions.length} a11y regression(s) vs baseline:`);
+  regressions.slice(0, 100).forEach((r) => console.error(`  ${r}`));
+  if (regressions.length > 100)
+    console.error(`  … and ${regressions.length - 100} more`);
+  console.error(
+    "\nFix the new violation(s). If a story was renamed or moved its old " +
+      "baseline key no longer matches — re-record: task frontend:storybook:a11y:record",
+  );
+}
+if (crashed.length || regressions.length) process.exit(1);
+
+if (fixed.length)
+  console.log(
+    `✓ no a11y regressions. ${fixed.length} baselined story(ies) now clean — ` +
+      `re-record to lock that in: task frontend:storybook:a11y:record`,
+  );
+else console.log("✓ no a11y regressions vs baseline.");
+process.exit(0);
diff --git a/frontend/.storybook/a11y-scan.sh b/frontend/.storybook/a11y-scan.sh
new file mode 100644
index 0000000000..855a4449dc
--- /dev/null
+++ b/frontend/.storybook/a11y-scan.sh
@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# Run the Storybook Vitest scan in batches and emit one JSON report per batch
+# into .a11y-scan/, plus a manifest of every story file the run was supposed to
+# cover and a log of the raw output. Consumed by a11y-check.mjs, which fails if
+# any manifest entry produced no results. Run from frontend/.
+#
+#   a11y-scan.sh                 scan every story
+#   a11y-scan.sh <file> [file…]  scan only these story files
+#
+# Batching keeps each browser session small: a single run over the whole story
+# set holds one Chromium context open for the entire scan, so one crash in it
+# costs every story after that point.
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 1
+
+OUT=".a11y-scan"
+rm -rf "$OUT"
+mkdir -p "$OUT"
+MANIFEST="$OUT/manifest.txt"
+LOG="$OUT/scan.log"
+
+if [ "$#" -gt 0 ]; then
+  # Explicit list (the pull-request path passes just the stories a branch
+  # touched). Anything that no longer exists is dropped, so a deleted story
+  # doesn't fail the manifest check.
+  for f in "$@"; do [ -f "$f" ] && printf '%s\n' "$f"; done | sort -u >"$MANIFEST"
+else
+  # Tracked story files plus any not yet committed, so a new story can be
+  # checked before it is added to the index.
+  {
+    git ls-files 'editor/src/**/*.stories.ts' 'editor/src/**/*.stories.tsx'
+    git ls-files --others --exclude-standard 'editor/src/**/*.stories.ts' \
+      'editor/src/**/*.stories.tsx'
+  } | sort -u >"$MANIFEST"
+fi
+
+mapfile -t FILES <"$MANIFEST"
+TOTAL=${#FILES[@]}
+if [ "$TOTAL" -eq 0 ]; then
+  if [ "$#" -gt 0 ]; then
+    echo "a11y-scan: no existing story files in the given list — nothing to scan"
+    exit 0
+  fi
+  echo "a11y-scan: no story files found — check the glob" >&2
+  exit 2
+fi
+
+CHUNK=20
+NB=$(((TOTAL + CHUNK - 1) / CHUNK))
+echo "a11y-scan: $TOTAL story files, $NB batches of $CHUNK"
+
+failed=()
+i=0
+ci=0
+while [ "$i" -lt "$TOTAL" ]; do
+  ci=$((ci + 1))
+  batch=("${FILES[@]:i:CHUNK}")
+  i=$((i + CHUNK))
+  out="$OUT/chunk-$ci.json"
+  filters=()
+  for f in "${batch[@]}"; do filters+=("${f%.tsx}"); done
+  # The scan exits non-zero whenever a story has a violation — expected here, so
+  # the report is what matters, not the status. Output is teed to the log so a red
+  # CI run still has the offending selectors and help text to work from.
+  for attempt in 1 2; do
+    timeout 300 npx vitest run --config .storybook/vitest.config.ts \
+      --reporter=json --outputFile="$out" "${filters[@]}" >>"$LOG" 2>&1
+    [ -s "$out" ] && break
+    echo "a11y-scan: batch $ci produced no report (attempt $attempt)" >&2
+  done
+  if [ -s "$out" ]; then
+    echo "  batch $ci/$NB done"
+  else
+    failed+=("$ci")
+    echo "  batch $ci/$NB FAILED — no report" >&2
+  fi
+done
+
+echo "a11y-scan: $(ls "$OUT"/chunk-*.json 2>/dev/null | wc -l)/$NB batches produced reports"
+if [ ${#failed[@]} -gt 0 ]; then
+  echo "a11y-scan: ${#failed[@]} batch(es) produced no report: ${failed[*]}" >&2
+  echo "a11y-scan: see $LOG. Not reporting on a partial scan." >&2
+  exit 2
+fi
diff --git a/frontend/.storybook/preview.tsx b/frontend/.storybook/preview.tsx
index cd2e53153d..a5cc4161c4 100644
--- a/frontend/.storybook/preview.tsx
+++ b/frontend/.storybook/preview.tsx
@@ -242,12 +242,10 @@ const preview: Preview = {
       ],
     },
     a11y: {
-      // Run axe automatically against the story root; violations show in the
-      // Accessibility panel. `context` replaced `element` in addon-a11y 9.x.
-      context: "#storybook-root",
-      config: {},
-      options: {},
-      test: "todo",
+      // Run axe against the rendered story; `test: "error"` fails the scan on
+      // any violation. Context is left at the addon default (the document root)
+      // so it resolves under both the Storybook UI and the Vitest browser mount.
+      test: "error",
     },
   },
   globalTypes: {
diff --git a/frontend/.storybook/vitest.config.ts b/frontend/.storybook/vitest.config.ts
index 9535f63a47..8c0d0e81f2 100644
--- a/frontend/.storybook/vitest.config.ts
+++ b/frontend/.storybook/vitest.config.ts
@@ -4,10 +4,9 @@ import { storybookTest } from "@storybook/addon-vitest/vitest-plugin";
 
 /**
  * Dedicated Vitest config that turns every story into a browser test: it mounts
- * the story in real Chromium as a render/smoke check (a story must mount without
- * throwing). a11y is currently report-only (preview's `a11y.test: "todo"`) and is
- * not yet enforced here — flipping it to pass/fail is a follow-up. Kept separate
- * from editor/vitest.config.ts (the jsdom unit tests) so the two suites don't collide.
+ * the story in real Chromium and runs axe against it, so a story fails if it
+ * throws on mount or trips an accessibility rule. Kept separate from
+ * editor/vitest.config.ts (the jsdom unit tests) so the two suites don't collide.
  *
  * The storybook test must live in a `test.projects[]` entry (not a flat config)
  * so Vitest wires up the browser test runner correctly.
@@ -23,8 +22,8 @@ export default defineConfig({
     // JSX runtime import, so Vite optimizes them lazily mid-run and emits
     // "optimized dependencies changed, reloading". That reload tears down the
     // browser worker and whichever stories were mid-load fail with a bogus
-    // "Failed to fetch dynamically imported module" — a result that looks real.
-    // Naming them here keeps a run deterministic.
+    // "Failed to fetch dynamically imported module" — a scan that then looks
+    // like a real result. Naming them here keeps a run deterministic.
     include: [
       "react",
       "react/jsx-runtime",
@@ -42,10 +41,11 @@ export default defineConfig({
         plugins: [storybookTest({ configDir: resolve(__dirname) })],
         test: {
           name: "storybook",
-          // Mounting a story takes well over Vitest's 5s default on the heavier
-          // screens, and a story that trips the timeout is reported as a failure
-          // with no message — which reads like a crash. Give it room; a
-          // genuinely hung story still fails, just later.
+          // Mounting a story and running a full axe pass over it takes well
+          // over Vitest's 5s default on the heavier screens, and a story that
+          // trips the timeout is reported as a failure with no message — which
+          // reads like a crash and makes the run non-reproducible. Give it
+          // room; a genuinely hung story still fails, just later.
           testTimeout: 60_000,
           hookTimeout: 60_000,
           browser: {
diff --git a/frontend/.storybook/vitest.setup.ts b/frontend/.storybook/vitest.setup.ts
index 6265c9bf54..22fa4c027e 100644
--- a/frontend/.storybook/vitest.setup.ts
+++ b/frontend/.storybook/vitest.setup.ts
@@ -1,10 +1,15 @@
 import { beforeAll } from "vitest";
 import { setProjectAnnotations } from "@storybook/react-vite";
+import * as a11yAddonAnnotations from "@storybook/addon-a11y/preview";
 // eslint-disable-next-line no-restricted-imports -- Storybook-only: the sibling preview config has no @-alias.
 import * as projectAnnotations from "./preview";
 
-// Apply the same decorators/parameters/globals the Storybook UI uses (providers,
-// i18n, theme) so stories run under Vitest render identically to the browser.
-const project = setProjectAnnotations([projectAnnotations]);
+// Include addon-a11y's annotations so its axe checks run under Vitest, not only
+// in the Storybook UI panel. projectAnnotations supplies the same
+// decorators/parameters/globals (providers, i18n, theme) as the browser.
+const project = setProjectAnnotations([
+  a11yAddonAnnotations,
+  projectAnnotations,
+]);
 
 beforeAll(project.beforeAll);

From 4d207f0c3f326a6c54cbf7de54b94a4bfe39025d Mon Sep 17 00:00:00 2001
From: Reece Browne <74901996+reecebrowne@users.noreply.github.com>
Date: Wed, 29 Jul 2026 15:18:55 +0100
Subject: [PATCH 105/109] a11y job: scan stories when their component changes;
 fix cold-start false failures (#7191)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Two fixes to the pull-request a11y job (#7086 follow-up), both found on
its first day live.

### It now scans a component's stories when the component changes

The job picked its scan set from changed **story files** alone. But a
story renders the live component — editing `Button.tsx` changes what
every Button story shows without touching a story file, and the job
scanned nothing. That's the common way a11y regressions arrive, and it
was exactly the case the job missed.

The scan set now also includes stories whose **same-named sibling source
file changed**: edit `Button.tsx` or `Button.css` and
`Button.stories.tsx` is scanned. Changes that ripple further than a
component's own stories (shared UI, theme tokens) remain the nightly
sweep's job.

### It no longer fails on cold-start infrastructure noise

The job's first real run (#7163) flagged a story as "failed to render".
The story was fine — on a cold dependency cache (**every** CI run), Vite
discovered the preview's own dependency graph mid-run and reloaded the
page, killing whichever story happened to be loading with `Failed to
fetch dynamically imported module`. Reproduced on a cold cache, passes
on a warm one.

- The preview's deps are named in `optimizeDeps.include`, which removes
the mid-run reload (verified cold).
- A batch whose report contains crash-class failures (failures carrying
no axe rule) is retried once — a one-off infrastructure death passes the
retry, a story that genuinely can't render fails both attempts and is
still reported.

Also: the scan-report artifacts were never actually uploading — they
live in a dot-directory, which `upload-artifact` silently skips as
hidden by default. `include-hidden-files: true` fixes that for the PR
job and the nightly, so a red run finally has its evidence attached.

### The glue is Node now, so tasks work from any shell

Raised in review: the pipeline leaned on `bash`, `sed`, `grep`, `sort`
and `tr`. Task runs its commands in an embedded POSIX interpreter, but
those are external binaries it has to find on PATH — and a Windows dev
calling tasks from **PowerShell** has none of them (`sed`/`tr` missing
outright, `sort` resolves to Windows' own, and `bash` resolves to
*WSL's*). Confirmed broken by running the task from PowerShell before
the change.

The batch runner and affected-story detection are now small Node scripts
(`a11y-scan.mjs`, `a11y-changed.mjs`) — the repo already requires Node,
so one implementation serves PowerShell, git-bash and CI alike, instead
of maintaining `.sh`/`.ps1` twins.

## Testing

- Sibling detection: editing `Tabs.tsx` (component only) pulls
`Tabs.stories.tsx` into the scan set; editing a `.css` sibling does the
same; nothing unrelated leaks in.
- **From PowerShell**: `task frontend:storybook:a11y:changed`
early-exits cleanly with no changes, and with a component edit it
detects the sibling, runs the browser scan and passes the gate — same
result from git-bash.
- Cold cache end-to-end: cleared both Vite caches, ran the scan — no
re-optimize, no reload, stories fail only on their (baselined) axe
results.
- Crash classifier: 1 on a synthetic crash report, 0 on axe-only
failures, 0 on a real report — so the retry can't be triggered by
legitimate violations.
- Full scan + gate run green end-to-end; taskfile parses, workflows are
valid YAML, Prettier/ESLint pass.

#7163's red check needs no action from that PR's author — it should go
green on re-run once this lands.
---
 .github/workflows/frontend-a11y.yml  |   3 +
 .github/workflows/nightly.yml        |   3 +
 .taskfiles/frontend.yml              |  28 ++--
 frontend/.storybook/a11y-changed.mjs |  48 +++++++
 frontend/.storybook/a11y-scan.mjs    | 197 +++++++++++++++++++++++++++
 frontend/.storybook/a11y-scan.sh     |  84 ------------
 frontend/.storybook/vitest.config.ts |  26 +++-
 7 files changed, 285 insertions(+), 104 deletions(-)
 create mode 100644 frontend/.storybook/a11y-changed.mjs
 create mode 100644 frontend/.storybook/a11y-scan.mjs
 delete mode 100644 frontend/.storybook/a11y-scan.sh

diff --git a/.github/workflows/frontend-a11y.yml b/.github/workflows/frontend-a11y.yml
index d763447048..f4d3e3b93a 100644
--- a/.github/workflows/frontend-a11y.yml
+++ b/.github/workflows/frontend-a11y.yml
@@ -55,3 +55,6 @@ jobs:
           path: frontend/.a11y-scan/
           retention-days: 7
           if-no-files-found: ignore
+          # The reports live in a dot-directory, which upload-artifact treats as
+          # hidden and silently skips by default.
+          include-hidden-files: true
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 301a1fc8df..50346a6a39 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -92,6 +92,9 @@ jobs:
           path: frontend/.a11y-scan/
           retention-days: 14
           if-no-files-found: ignore
+          # The reports live in a dot-directory, which upload-artifact treats as
+          # hidden and silently skips by default.
+          include-hidden-files: true
 
   # Builds all desktop platforms on a schedule so the Rust dependency cache is
   # written on main, where PR and merge-queue tauri builds can restore it.
diff --git a/.taskfiles/frontend.yml b/.taskfiles/frontend.yml
index 1338aae8e1..8c32efc5e3 100644
--- a/.taskfiles/frontend.yml
+++ b/.taskfiles/frontend.yml
@@ -214,42 +214,42 @@ tasks:
     desc: "a11y regression gate over every story: fail only on NEW axe violations"
     deps: [install, storybook:browser]
     cmds:
-      - bash .storybook/a11y-scan.sh
+      - node .storybook/a11y-scan.mjs
       - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
 
   storybook:a11y:changed:
-    desc: "a11y gate over stories changed vs a base ref (default origin/main)"
+    desc: "a11y gate over the stories this branch affects (default base origin/main)"
     summary: |
-      Scans only the stories this branch touches, which is what pull requests
-      run — a full scan takes ~30 minutes, far too long to sit in front of every
-      merge. The nightly job covers the rest of the suite.
+      Scans the stories a branch affects, which is what pull requests run — a
+      full scan takes ~30 minutes, far too long to sit in front of every merge.
+      A story is affected if its file changed, or if a same-named sibling
+      source file changed (editing Button.tsx or Button.css re-scans
+      Button.stories.tsx — the story renders the live component, so a component
+      edit changes what the story shows without touching the story file).
+      Changes that ripple further than a component's own stories are covered by
+      the nightly full sweep.
 
       Pass a base ref through CLI_ARGS, e.g.
         task frontend:storybook:a11y:changed -- origin/release
     deps: [install, storybook:browser]
     vars:
       BASE: '{{.CLI_ARGS | default "origin/main"}}'
-      # Stories touched by this branch, plus any not yet committed.
       CHANGED:
-        sh: |
-          { git diff --name-only --diff-filter=d {{.CLI_ARGS | default "origin/main"}}...HEAD -- '*.stories.ts' '*.stories.tsx';
-            git diff --name-only --diff-filter=d -- '*.stories.ts' '*.stories.tsx';
-            git ls-files --others --exclude-standard -- '*.stories.ts' '*.stories.tsx'; } \
-          | sed 's|^frontend/||' | sort -u | tr '\n' ' '
+        sh: node .storybook/a11y-changed.mjs {{.CLI_ARGS | default "origin/main"}}
     cmds:
       - cmd: |
           if [ -z "{{.CHANGED}}" ]; then
-            echo "a11y: no story files changed vs {{.BASE}} — nothing to check"
+            echo "a11y: no story files affected vs {{.BASE}} — nothing to check"
             exit 0
           fi
-          bash .storybook/a11y-scan.sh {{.CHANGED}}
+          node .storybook/a11y-scan.mjs {{.CHANGED}}
           node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
 
   storybook:a11y:record:
     desc: "Re-record the a11y baseline (run after intentionally fixing/adding violations)"
     deps: [install, storybook:browser]
     cmds:
-      - bash .storybook/a11y-scan.sh
+      - node .storybook/a11y-scan.mjs
       - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --record
 
   # ============================================================
diff --git a/frontend/.storybook/a11y-changed.mjs b/frontend/.storybook/a11y-changed.mjs
new file mode 100644
index 0000000000..6aacf6274c
--- /dev/null
+++ b/frontend/.storybook/a11y-changed.mjs
@@ -0,0 +1,48 @@
+// Prints the story files a branch affects, one per line — the scan set for the
+// pull-request a11y gate. A story is affected if its file changed against the
+// base ref (or is uncommitted/untracked), or if a same-named sibling source
+// file changed: stories render the live component, so editing Button.tsx or
+// Button.css changes what Button.stories.tsx shows without touching it.
+//
+//   node a11y-changed.mjs [base-ref]     (default origin/main)
+//
+// Node rather than shell so the task works no matter what invokes it — Task's
+// embedded interpreter runs on Windows, but sed/grep/sort do not exist for
+// developers calling tasks from PowerShell.
+import { execFileSync } from "node:child_process";
+import { existsSync } from "node:fs";
+
+const base = process.argv[2] || "origin/main";
+
+const git = (...args) =>
+  execFileSync("git", args, { encoding: "utf8" })
+    .split("\n")
+    .map((l) => l.trim().replace(/^frontend\//, ""))
+    .filter(Boolean);
+
+const STORY = /\.stories\.tsx?$/;
+const TEST = /\.test\.tsx?$/;
+const SOURCE = /\.(ts|tsx|css)$/;
+
+// Committed changes vs the base, plus working-tree changes, plus untracked
+// files — so the gate covers exactly what the branch would merge and what a
+// developer is about to commit.
+const changed = [
+  ...git("diff", "--name-only", "--diff-filter=d", `${base}...HEAD`),
+  ...git("diff", "--name-only", "--diff-filter=d"),
+  ...git("ls-files", "--others", "--exclude-standard"),
+];
+
+const stories = new Set();
+for (const f of changed) {
+  if (STORY.test(f)) {
+    stories.add(f);
+    continue;
+  }
+  if (TEST.test(f) || !SOURCE.test(f)) continue;
+  const sibling = f.replace(SOURCE, "");
+  for (const s of [`${sibling}.stories.tsx`, `${sibling}.stories.ts`])
+    if (existsSync(s)) stories.add(s);
+}
+
+process.stdout.write([...stories].sort().join("\n"));
diff --git a/frontend/.storybook/a11y-scan.mjs b/frontend/.storybook/a11y-scan.mjs
new file mode 100644
index 0000000000..77aed79d70
--- /dev/null
+++ b/frontend/.storybook/a11y-scan.mjs
@@ -0,0 +1,197 @@
+// Runs the Storybook Vitest scan in batches and emits one JSON report per batch
+// into .a11y-scan/, plus a manifest of every story file the run was supposed to
+// cover and a log of the raw output. Consumed by a11y-check.mjs, which fails if
+// any manifest entry produced no results. Run from frontend/.
+//
+//   node a11y-scan.mjs                 scan every story
+//   node a11y-scan.mjs <file> [file…]  scan only these story files
+//
+// Batching keeps each browser session small: a single run over the whole story
+// set holds one Chromium context open for the entire scan, so one crash in it
+// costs every story after that point.
+//
+// Node rather than shell so the task works no matter what invokes it — Task's
+// embedded interpreter runs on Windows, but bash/sed/sort do not exist for
+// developers calling tasks from PowerShell.
+import { execFileSync, spawn } from "node:child_process";
+import {
+  existsSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { join } from "node:path";
+
+const OUT = ".a11y-scan";
+const CHUNK = 20;
+const BATCH_TIMEOUT_MS = 300_000;
+
+const git = (...args) =>
+  execFileSync("git", args, { encoding: "utf8" })
+    .split("\n")
+    .map((l) => l.trim())
+    .filter(Boolean);
+
+rmSync(OUT, { recursive: true, force: true });
+mkdirSync(OUT, { recursive: true });
+const manifestFile = join(OUT, "manifest.txt");
+const logFile = join(OUT, "scan.log");
+
+const args = process.argv.slice(2);
+let files;
+if (args.length > 0) {
+  // Explicit list (the pull-request path passes just the stories a branch
+  // affects). Anything that no longer exists is dropped, so a deleted story
+  // doesn't fail the manifest check.
+  files = [...new Set(args.filter((f) => existsSync(f)))].sort();
+  if (files.length === 0) {
+    console.log(
+      "a11y-scan: no existing story files in the given list — nothing to scan",
+    );
+    writeFileSync(manifestFile, "");
+    process.exit(0);
+  }
+} else {
+  // Tracked story files plus any not yet committed, so a new story can be
+  // checked before it is added to the index.
+  files = [
+    ...new Set([
+      ...git(
+        "ls-files",
+        "--",
+        "editor/src/**/*.stories.ts",
+        "editor/src/**/*.stories.tsx",
+      ),
+      ...git(
+        "ls-files",
+        "--others",
+        "--exclude-standard",
+        "--",
+        "editor/src/**/*.stories.ts",
+        "editor/src/**/*.stories.tsx",
+      ),
+    ]),
+  ].sort();
+  if (files.length === 0) {
+    console.error("a11y-scan: no story files found — check the glob");
+    process.exit(2);
+  }
+}
+writeFileSync(manifestFile, files.join("\n") + "\n");
+
+/** Failures carrying no axe rule — a throw, a timeout, a dropped browser page. */
+function crashCount(reportFile) {
+  try {
+    const report = JSON.parse(readFileSync(reportFile, "utf8"));
+    let crashes = 0;
+    for (const tf of report.testResults ?? [])
+      for (const a of tf.assertionResults ?? []) {
+        if (a.status === "passed") continue;
+        const msg = (a.failureMessages ?? []).join("\n");
+        if (!/dequeuniversity\.com\/rules\/axe\//.test(msg)) crashes++;
+      }
+    return crashes;
+  } catch {
+    return -1; // unreadable report counts as a failed attempt
+  }
+}
+
+/** Runs one vitest batch, tee'd to the log, killed (whole tree) on timeout. */
+function runBatch(filters, outputFile) {
+  return new Promise((resolve) => {
+    const cmd =
+      `npx vitest run --config .storybook/vitest.config.ts ` +
+      `--reporter=json --outputFile=${outputFile} ` +
+      filters.map((f) => `"${f}"`).join(" ");
+    const log = openSync(logFile, "a");
+    const child = spawn(cmd, {
+      shell: true,
+      detached: process.platform !== "win32",
+      stdio: ["ignore", log, log],
+    });
+    const timer = setTimeout(() => {
+      if (process.platform === "win32") {
+        try {
+          execFileSync("taskkill", ["/pid", String(child.pid), "/T", "/F"], {
+            stdio: "ignore",
+          });
+        } catch {
+          /* already gone */
+        }
+      } else {
+        try {
+          process.kill(-child.pid, "SIGKILL");
+        } catch {
+          /* already gone */
+        }
+      }
+    }, BATCH_TIMEOUT_MS);
+    child.on("exit", () => {
+      clearTimeout(timer);
+      resolve();
+    });
+  });
+}
+
+const hasReport = (f) => existsSync(f) && statSync(f).size > 0;
+
+const batches = [];
+for (let i = 0; i < files.length; i += CHUNK)
+  batches.push(files.slice(i, i + CHUNK));
+console.log(
+  `a11y-scan: ${files.length} story files, ${batches.length} batches of ${CHUNK}`,
+);
+
+const failed = [];
+for (let bi = 0; bi < batches.length; bi++) {
+  const n = bi + 1;
+  const out = join(OUT, `chunk-${n}.json`);
+  // The scan exits non-zero whenever a story has a violation — expected here,
+  // so the report is what matters, not the status.
+  //
+  // A batch is retried once when it produced no report, or when its report
+  // contains crash-class failures. A one-off infrastructure death — the
+  // browser page dropping, a Vite dep re-optimize reloading mid-run — passes
+  // on the retry; a story that genuinely cannot render fails both attempts.
+  const filters = batches[bi].map((f) => f.replace(/\.tsx$/, ""));
+  for (let attempt = 1; attempt <= 2; attempt++) {
+    await runBatch(filters, out);
+    if (!hasReport(out)) {
+      console.error(
+        `a11y-scan: batch ${n} produced no report (attempt ${attempt})`,
+      );
+      continue;
+    }
+    if (attempt === 1) {
+      const crashes = crashCount(out);
+      if (crashes !== 0) {
+        console.error(
+          `a11y-scan: batch ${n} has ${crashes} crash-class failure(s) — retrying once`,
+        );
+        rmSync(out, { force: true });
+        continue;
+      }
+    }
+    break;
+  }
+  if (hasReport(out)) console.log(`  batch ${n}/${batches.length} done`);
+  else {
+    failed.push(n);
+    console.error(`  batch ${n}/${batches.length} FAILED — no report`);
+  }
+}
+
+const present = batches.filter((_, i) =>
+  hasReport(join(OUT, `chunk-${i + 1}.json`)),
+).length;
+console.log(`a11y-scan: ${present}/${batches.length} batches produced reports`);
+if (failed.length > 0) {
+  console.error(
+    `a11y-scan: ${failed.length} batch(es) produced no report: ${failed.join(" ")}`,
+  );
+  console.error(`a11y-scan: see ${logFile}. Not reporting on a partial scan.`);
+  process.exit(2);
+}
diff --git a/frontend/.storybook/a11y-scan.sh b/frontend/.storybook/a11y-scan.sh
deleted file mode 100644
index 855a4449dc..0000000000
--- a/frontend/.storybook/a11y-scan.sh
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/usr/bin/env bash
-# Run the Storybook Vitest scan in batches and emit one JSON report per batch
-# into .a11y-scan/, plus a manifest of every story file the run was supposed to
-# cover and a log of the raw output. Consumed by a11y-check.mjs, which fails if
-# any manifest entry produced no results. Run from frontend/.
-#
-#   a11y-scan.sh                 scan every story
-#   a11y-scan.sh <file> [file…]  scan only these story files
-#
-# Batching keeps each browser session small: a single run over the whole story
-# set holds one Chromium context open for the entire scan, so one crash in it
-# costs every story after that point.
-set -uo pipefail
-cd "$(dirname "$0")/.." || exit 1
-
-OUT=".a11y-scan"
-rm -rf "$OUT"
-mkdir -p "$OUT"
-MANIFEST="$OUT/manifest.txt"
-LOG="$OUT/scan.log"
-
-if [ "$#" -gt 0 ]; then
-  # Explicit list (the pull-request path passes just the stories a branch
-  # touched). Anything that no longer exists is dropped, so a deleted story
-  # doesn't fail the manifest check.
-  for f in "$@"; do [ -f "$f" ] && printf '%s\n' "$f"; done | sort -u >"$MANIFEST"
-else
-  # Tracked story files plus any not yet committed, so a new story can be
-  # checked before it is added to the index.
-  {
-    git ls-files 'editor/src/**/*.stories.ts' 'editor/src/**/*.stories.tsx'
-    git ls-files --others --exclude-standard 'editor/src/**/*.stories.ts' \
-      'editor/src/**/*.stories.tsx'
-  } | sort -u >"$MANIFEST"
-fi
-
-mapfile -t FILES <"$MANIFEST"
-TOTAL=${#FILES[@]}
-if [ "$TOTAL" -eq 0 ]; then
-  if [ "$#" -gt 0 ]; then
-    echo "a11y-scan: no existing story files in the given list — nothing to scan"
-    exit 0
-  fi
-  echo "a11y-scan: no story files found — check the glob" >&2
-  exit 2
-fi
-
-CHUNK=20
-NB=$(((TOTAL + CHUNK - 1) / CHUNK))
-echo "a11y-scan: $TOTAL story files, $NB batches of $CHUNK"
-
-failed=()
-i=0
-ci=0
-while [ "$i" -lt "$TOTAL" ]; do
-  ci=$((ci + 1))
-  batch=("${FILES[@]:i:CHUNK}")
-  i=$((i + CHUNK))
-  out="$OUT/chunk-$ci.json"
-  filters=()
-  for f in "${batch[@]}"; do filters+=("${f%.tsx}"); done
-  # The scan exits non-zero whenever a story has a violation — expected here, so
-  # the report is what matters, not the status. Output is teed to the log so a red
-  # CI run still has the offending selectors and help text to work from.
-  for attempt in 1 2; do
-    timeout 300 npx vitest run --config .storybook/vitest.config.ts \
-      --reporter=json --outputFile="$out" "${filters[@]}" >>"$LOG" 2>&1
-    [ -s "$out" ] && break
-    echo "a11y-scan: batch $ci produced no report (attempt $attempt)" >&2
-  done
-  if [ -s "$out" ]; then
-    echo "  batch $ci/$NB done"
-  else
-    failed+=("$ci")
-    echo "  batch $ci/$NB FAILED — no report" >&2
-  fi
-done
-
-echo "a11y-scan: $(ls "$OUT"/chunk-*.json 2>/dev/null | wc -l)/$NB batches produced reports"
-if [ ${#failed[@]} -gt 0 ]; then
-  echo "a11y-scan: ${#failed[@]} batch(es) produced no report: ${failed[*]}" >&2
-  echo "a11y-scan: see $LOG. Not reporting on a partial scan." >&2
-  exit 2
-fi
diff --git a/frontend/.storybook/vitest.config.ts b/frontend/.storybook/vitest.config.ts
index 8c0d0e81f2..8519e50267 100644
--- a/frontend/.storybook/vitest.config.ts
+++ b/frontend/.storybook/vitest.config.ts
@@ -18,18 +18,32 @@ export default defineConfig({
     // Pre-scan every story + the preview so Vite discovers the story set's large
     // dep surface (embedpdf plugins, @mui icons, …) in one pass up front.
     entries: ["editor/src/**/*.stories.@(ts|tsx)", ".storybook/preview.tsx"],
-    // `entries` alone does not catch deps reached only through a transformed
-    // JSX runtime import, so Vite optimizes them lazily mid-run and emits
-    // "optimized dependencies changed, reloading". That reload tears down the
-    // browser worker and whichever stories were mid-load fail with a bogus
-    // "Failed to fetch dynamically imported module" — a scan that then looks
-    // like a real result. Naming them here keeps a run deterministic.
+    // `entries` alone does not catch deps reached through a transformed JSX
+    // runtime import, nor the preview's own dependency graph (the test plugin
+    // injects the preview in a way the entry scanner doesn't crawl). Vite then
+    // optimizes them lazily mid-run and emits "optimized dependencies changed,
+    // reloading" — the reload tears down the browser worker and whichever
+    // stories were mid-load fail with a bogus "Failed to fetch dynamically
+    // imported module" that reads like a real crash. Only a cold dep cache
+    // hits this, which is every CI run. Naming them keeps a run deterministic.
     include: [
       "react",
       "react/jsx-runtime",
       "react/jsx-dev-runtime",
       "react-dom",
       "react-dom/client",
+      "@storybook/react-vite",
+      "@storybook/addon-a11y/preview",
+      "@storybook/addon-themes",
+      "msw-storybook-addon",
+      "react-router-dom",
+      "@tanstack/react-query",
+      "i18next",
+      "react-i18next",
+      "smol-toml",
+      "@mantine/core",
+      "@supabase/supabase-js",
+      "axios",
     ],
   },
   test: {

From bbd4d2c3ac106321edcbf9c8df8ef9f45e2ae70f Mon Sep 17 00:00:00 2001
From: James Brunton <jbrunton96@gmail.com>
Date: Wed, 29 Jul 2026 15:33:34 +0100
Subject: [PATCH 106/109] Redesign toml sorting to speed up from ~40s to ~2s
 (#7192)

# Description of Changes
The `pre-commit` tool to sort the translations is really slow. It took
~40 seconds to run because it's using a parser which attempts to save
all of the formatting data from the Toml. Our translations toml is
pretty much entirely formatted anyway, so there's no point in trying to
preserve any of that data. The only thing we lose is 5 comments, none of
which are needed anyway and only appear in the US translation file. By
switching to Python stdlib `tomllib` reading and `tomli-w` for writing,
we can make the Toml formatting job take 2.11 seconds, where it used to
take 39.78s. The whole pre-commit job now takes 4.58 seconds.
---
 .taskfiles/pre-commit.yml                     |  4 +-
 .../public/locales/en-US/translation.toml     |  5 -
 scripts/pre-commit/pyproject.toml             |  2 +-
 scripts/pre-commit/sort_locale_toml.py        | 96 +++++++++++++++++++
 scripts/pre-commit/uv.lock                    | 24 ++---
 5 files changed, 105 insertions(+), 26 deletions(-)
 create mode 100644 scripts/pre-commit/sort_locale_toml.py

diff --git a/.taskfiles/pre-commit.yml b/.taskfiles/pre-commit.yml
index 136f852a5b..f2e488e815 100644
--- a/.taskfiles/pre-commit.yml
+++ b/.taskfiles/pre-commit.yml
@@ -73,7 +73,7 @@ tasks:
       - task: gitleaks
 
   install:
-    desc: "Install the pinned pre-commit Python tools (ruff, codespell, toml-sort)"
+    desc: "Install the pinned pre-commit Python tools"
     run: once
     cmds:
       - uv sync --project scripts/pre-commit --locked
@@ -112,7 +112,7 @@ tasks:
   toml-sort:
     deps: [install]
     cmds:
-      - uv run --project scripts/pre-commit --no-sync toml-sort --all --ignore-case {{if .FIX}}--in-place{{else}}--check{{end}} {{.LOCALE_TOML}}
+      - uv run --project scripts/pre-commit --no-sync python scripts/pre-commit/sort_locale_toml.py {{if .FIX}}--fix {{end}}{{.LOCALE_TOML}}
 
   whitespace:
     cmds:
diff --git a/frontend/editor/public/locales/en-US/translation.toml b/frontend/editor/public/locales/en-US/translation.toml
index 913cdf20a4..abbe1446ff 100644
--- a/frontend/editor/public/locales/en-US/translation.toml
+++ b/frontend/editor/public/locales/en-US/translation.toml
@@ -692,7 +692,6 @@ manualLinks = "Manual downloads: click the links and place the files into the te
 noLanguages = "No tessdata languages found in the configured directory."
 permissionNotice = "The tessdata path is not writable. Downloads will be opened in the browser; please save the .traineddata files manually into the tessdata folder."
 
-# AI engine admin settings (AI nav group)
 [admin.settings.ai.documents]
 description = "Configure the embedding model and retrieval settings used to answer questions over documents. Applied to the AI engine when saved."
 title = "Documents & RAG"
@@ -7320,7 +7319,6 @@ sectionsAriaLabel = "Infrastructure sections"
 subtitle = "Deployments, credentials, security posture, storage, and the audit trail for your Stirling workspace."
 title = "Infrastructure"
 
-# Fixed-enum label maps rendered via t(MAP[value]) in the infrastructure tabs.
 [portal.infrastructure.apiKeys]
 createKey = "Create key"
 heading = "API keys"
@@ -8415,13 +8413,10 @@ region = "State / region"
 regionPlaceholder = "California"
 running = "{{annual}} / yr · {{years}}-yr {{tcv}}"
 s1Sub = "Your team, and the PDFs you expect to run each year."
-# Step 1 — volume
 s1Title = "How much will you process?"
 s2Sub = "Longer terms discount the rate; your service level sets support."
-# Step 2 — commitment & service
 s2Title = "Commitment and service"
 s3Sub = "For the quote and the agreement it generates."
-# Step 3 — details
 s3Title = "Your details"
 serviceLevel = "Service level"
 size_compact = "Compact"
diff --git a/scripts/pre-commit/pyproject.toml b/scripts/pre-commit/pyproject.toml
index cd13b56f5e..9a730bdcb5 100644
--- a/scripts/pre-commit/pyproject.toml
+++ b/scripts/pre-commit/pyproject.toml
@@ -9,7 +9,7 @@ requires-python = ">=3.11"
 dependencies = [
     "ruff==0.15.14",
     "codespell==2.4.2",
-    "toml-sort==0.24.4",
+    "tomli-w==1.2.0",
 ]
 
 [tool.uv]
diff --git a/scripts/pre-commit/sort_locale_toml.py b/scripts/pre-commit/sort_locale_toml.py
new file mode 100644
index 0000000000..1515fe2cfe
--- /dev/null
+++ b/scripts/pre-commit/sort_locale_toml.py
@@ -0,0 +1,96 @@
+#!/usr/bin/env python3
+"""Key-sort the locale translation.toml files.
+
+python sort_locale_toml.py <pathspec>...         # check: report, exit 1 if unsorted
+python sort_locale_toml.py --fix <pathspec>...   # fix: rewrite in place
+"""
+
+from __future__ import annotations
+
+import subprocess
+import sys
+import tomllib
+from pathlib import Path
+
+import tomli_w
+
+
+class SortError(Exception):
+    """A file could not be sorted without risking its contents."""
+
+
+def ordered(table: dict[str, object]) -> dict[str, object]:
+    """Rebuild a table with its keys sorted, and sub-tables after its own keys."""
+    keys = {key: value for key, value in table.items() if not isinstance(value, dict)}
+    subtables = {key: value for key, value in table.items() if isinstance(value, dict)}
+    result: dict[str, object] = {key: keys[key] for key in sorted(keys, key=str.lower)}
+    for key in sorted(subtables, key=str.lower):
+        result[key] = ordered(subtables[key])
+    return result
+
+
+def tracked_files(path_specs: list[str]) -> list[str]:
+    result = subprocess.run(
+        ["git", "ls-files", "-z", *path_specs],
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    return [path for path in result.stdout.split("\0") if path]
+
+
+def sort_file(path: str, fix: bool) -> bool:
+    """Rewrite one file if `fix`; return whether it was not already sorted."""
+    text = Path(path).read_text(encoding="utf-8")
+    try:
+        original = tomllib.loads(text)
+    except tomllib.TOMLDecodeError as exc:
+        raise SortError(f"{path}: invalid TOML: {exc}") from exc
+
+    expected = tomli_w.dumps(ordered(original))
+    if expected == text:
+        return False
+
+    try:
+        reordered = tomllib.loads(expected)
+    except tomllib.TOMLDecodeError as exc:
+        raise SortError(
+            f"{path}: refusing to sort, the sorted output is not valid TOML: {exc}"
+        ) from exc
+    if reordered != original:
+        raise SortError(
+            f"{path}: refusing to sort, sorting would change the file's contents"
+        )
+
+    if fix:
+        Path(path).write_text(expected, encoding="utf-8")
+    return True
+
+
+def main() -> int:
+    args = sys.argv[1:]
+    fix = "--fix" in args
+    pathspecs = [a for a in args if a != "--fix"]
+
+    offenders: list[str] = []
+    errors: list[str] = []
+    for path in tracked_files(pathspecs):
+        try:
+            if sort_file(path, fix):
+                offenders.append(path)
+        except SortError as exc:
+            errors.append(str(exc))
+
+    for error in errors:
+        print(error, file=sys.stderr)
+    if offenders and not fix:
+        print(f"{len(offenders)} file(s) need TOML sorting:")
+        for path in offenders:
+            print(f"  {path}")
+    if offenders and fix:
+        print(f"Sorted TOML in {len(offenders)} file(s).")
+    return 1 if errors or (offenders and not fix) else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/scripts/pre-commit/uv.lock b/scripts/pre-commit/uv.lock
index b90593a6e8..2a3c8ee11d 100644
--- a/scripts/pre-commit/uv.lock
+++ b/scripts/pre-commit/uv.lock
@@ -43,33 +43,21 @@ source = { virtual = "." }
 dependencies = [
     { name = "codespell" },
     { name = "ruff" },
-    { name = "toml-sort" },
+    { name = "tomli-w" },
 ]
 
 [package.metadata]
 requires-dist = [
     { name = "codespell", specifier = "==2.4.2" },
     { name = "ruff", specifier = "==0.15.14" },
-    { name = "toml-sort", specifier = "==0.24.4" },
+    { name = "tomli-w", specifier = "==1.2.0" },
 ]
 
 [[package]]
-name = "toml-sort"
-version = "0.24.4"
+name = "tomli-w"
+version = "1.2.0"
 source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "tomlkit" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/47/c5/d6f650fdcf8e1f83096815fa67fb13a9a345b99da6015c60c4b7e4a8ea2b/toml_sort-0.24.4.tar.gz", hash = "sha256:429b69f5b98b7047a11380c80ecf0838556bdea1a8902d0be564961c48841423", size = 17793, upload-time = "2026-03-24T14:05:53.637Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/19/75/241269d1da26b624c0d5e110e8149093c759b7a286138f4efd61a60e75fe/tomli_w-1.2.0.tar.gz", hash = "sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021", size = 7184, upload-time = "2025-01-15T12:07:24.262Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/0f/5a/1f0e54df4eacf0f4d8f94ba50cf72be33d2a3f04babdfb1931bead48a0ab/toml_sort-0.24.4-py3-none-any.whl", hash = "sha256:125aa5fb94f33c542c6901040456145dd38f79bbb310b56b436a93057d30a739", size = 16577, upload-time = "2026-03-24T14:05:54.757Z" },
-]
-
-[[package]]
-name = "tomlkit"
-version = "0.15.0"
-source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/51/db/03eaf4331631ef6b27d6e3c9b68c54dc6f0d63d87201fed600cc409307fd/tomlkit-0.15.0.tar.gz", hash = "sha256:7d1a9ecba3086638211b13814ea79c90dd54dd11993564376f3aa92271f5c7a3", size = 161875, upload-time = "2026-05-10T07:38:22.245Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/6a/43/8bd850ee71a191bf072e31302c73a66be413fecdd98fdcd111ecbcce13ca/tomlkit-0.15.0-py3-none-any.whl", hash = "sha256:4dbc8f0fc024412b57ced8757ac7461305126a648ff8c2c807fcb8e133a78738", size = 41328, upload-time = "2026-05-10T07:38:23.517Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/18/c86eb8e0202e32dd3df50d43d7ff9854f8e0603945ff398974c1d91ac1ef/tomli_w-1.2.0-py3-none-any.whl", hash = "sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90", size = 6675, upload-time = "2025-01-15T12:07:22.074Z" },
 ]

From b4a264239c468c89ce9639bfd15e1743e38b3045 Mon Sep 17 00:00:00 2001
From: ConnorYoh <40631091+ConnorYoh@users.noreply.github.com>
Date: Wed, 29 Jul 2026 16:15:49 +0100
Subject: [PATCH 107/109] fix(saas): provision a new user and their personal
 team atomically (#7193)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

New SaaS accounts were landing with `team_id = null`. That state is
unrecoverable: portal access derives from leading a team, and signup is
the only place one is assigned.

Five things had to be fixed, all on the signup path. Only the last is a
behaviour change you'd notice.

### 1. Shared-PK entity was routed to `merge()`
`SaasUserExtensions` pre-sets its `@MapsId` id in the constructor, so
Spring Data's id-nullness check treated a brand-new row as existing and
`save()` failed with `AssertionFailure: null identifier`. Now implements
`Persistable` and decides on the creation timestamp — the idiom already
used by `ProcessedFileEntity` and `SourceDocCountEntity`.

This was the blocker. It threw on every signup, and because the failure
was swallowed (see 3) every new account was stranded.

### 2. User and team were committed separately
`createUser()` is annotated `@Transactional` but is called as
`this.createUser(...)`, and self-invocation bypasses the proxy — so the
annotation did nothing. `saveUser()` and `ensurePersonalTeam()` each
committed in their own transaction, leaving a window where a **committed
user was visible with `team_id = null`**. Parallel requests entering
that window each provisioned a team, producing duplicates (observed:
teams 160/161 and 162/163 for one user).

Both writes now happen in one transaction via
`SaasTeamService.saveUserWithPersonalTeam()`. The window is gone, so
there is nothing left to race over.

### 3. A failed team create was swallowed
The old code logged at WARN and committed the user anyway. It now
propagates: the shared transaction rolls the user back, the request
401s, and a retry starts clean. Nothing half-built is committed.

This is the deliberate trade — a transient failure now surfaces instead
of silently producing an account that can never reach the portal.

### 4. Per-request healing removed
`recoverMissingTeam` (added in #7180) ran on **every authenticated
request** whose user had no team, with no mutual exclusion. Under a
burst of parallel requests it was itself a source of concurrent
provisioning. Provisioning belongs to signup alone.

### 5. Policy seeding could not run
`@TransactionalEventListener(AFTER_COMMIT)` leaves the *completed*
transaction bound to the thread, so `JpaPolicyStore.save`'s
`@Transactional` joined it instead of opening a live one — and its `FOR
UPDATE` lock threw `TransactionRequiredException`. Now seeded in
`BEFORE_COMMIT`: the lock has a live transaction, rollback safety is
unchanged (a rolled-back team still leaves no policy), and it stays on a
single pooled connection.

## Verified

`:saas:test` green, both spotless gates green, on top of current `main`.

Manually on a live signup: **one** team per user, and the
concurrent-signup race resolves correctly through the pre-existing
unique-constraint catch (`users_supabase_auth_id_key` violation →
refetch the winner).

12 filter tests needed updating. Two of them asserted behaviour this PR
deliberately removes (`personalTeamFailureSwallowed`,
`assignsTeamWhenMissing`), so they were rewritten to assert the new
contract rather than re-stubbed into passing.

## Not in scope

- **Existing stranded accounts** are not repaired — with the healer
gone, nothing fixes them on the request path. They need a one-off
backfill or deletion.
- **A DB-level invariant.** A partial unique index
(`UNIQUE(created_by_user_id) WHERE is_personal`) would make duplicate
personal teams impossible rather than merely unreachable. Wanted, but it
is a Supabase migration in the SaaS repo, so it is deliberately
separate.
- **Per-request auth cost.** The filter still does two remote-Postgres
round-trips per authenticated request; a frontend request storm makes
that expensive. Being handled separately.
---
 .../DefaultClassificationPolicySeeder.java    |  7 +-
 .../saas/model/SaasUserExtensions.java        | 17 ++++-
 .../SupabaseAuthenticationFilter.java         | 68 ++++---------------
 .../saas/service/SaasTeamService.java         | 40 +++++++++++
 .../SupabaseAuthenticationFilterMoreTest.java | 58 ++++++++--------
 .../SupabaseAuthenticationFilterTest.java     | 19 +++---
 6 files changed, 112 insertions(+), 97 deletions(-)

diff --git a/app/proprietary/src/main/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeeder.java b/app/proprietary/src/main/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeeder.java
index aca6ae0e84..4150dc2f31 100644
--- a/app/proprietary/src/main/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeeder.java
+++ b/app/proprietary/src/main/java/stirling/software/proprietary/policy/seed/DefaultClassificationPolicySeeder.java
@@ -46,9 +46,10 @@ public class DefaultClassificationPolicySeeder {
                 .ifPresent(team -> seedIfMissing(team.getId(), team.getName()));
     }
 
-    // Any team created at runtime (admin-created, SaaS sign-ups); after the team's commit so a
-    // rolled-back team never leaves a policy behind.
-    @TransactionalEventListener(phase = TransactionPhase.AFTER_COMMIT)
+    // Any team created at runtime (admin-created, SaaS sign-ups). Seeds inside the team's own
+    // transaction: rollback still leaves no policy behind, and the store's pessimistic lock needs a
+    // live transaction, which AFTER_COMMIT cannot offer.
+    @TransactionalEventListener(phase = TransactionPhase.BEFORE_COMMIT)
     public void onTeamCreated(TeamCreatedEvent event) {
         seedIfMissing(event.teamId(), event.teamName());
     }
diff --git a/app/saas/src/main/java/stirling/software/saas/model/SaasUserExtensions.java b/app/saas/src/main/java/stirling/software/saas/model/SaasUserExtensions.java
index 036fdd27be..8d7dda1726 100644
--- a/app/saas/src/main/java/stirling/software/saas/model/SaasUserExtensions.java
+++ b/app/saas/src/main/java/stirling/software/saas/model/SaasUserExtensions.java
@@ -7,6 +7,7 @@ import org.hibernate.annotations.CreationTimestamp;
 import org.hibernate.annotations.OnDelete;
 import org.hibernate.annotations.OnDeleteAction;
 import org.hibernate.annotations.UpdateTimestamp;
+import org.springframework.data.domain.Persistable;
 
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
@@ -16,6 +17,7 @@ import jakarta.persistence.JoinColumn;
 import jakarta.persistence.MapsId;
 import jakarta.persistence.OneToOne;
 import jakarta.persistence.Table;
+import jakarta.persistence.Transient;
 
 import lombok.Getter;
 import lombok.NoArgsConstructor;
@@ -37,7 +39,7 @@ import stirling.software.proprietary.security.model.User;
 @NoArgsConstructor
 @Getter
 @Setter
-public class SaasUserExtensions implements Serializable {
+public class SaasUserExtensions implements Serializable, Persistable<Long> {
 
     private static final long serialVersionUID = 1L;
 
@@ -80,4 +82,17 @@ public class SaasUserExtensions implements Serializable {
     public boolean isMeteredBillingEnabled() {
         return Boolean.TRUE.equals(hasMeteredBillingEnabled);
     }
+
+    @Override
+    public Long getId() {
+        return userId;
+    }
+
+    // Decided on the timestamp, not the id: the constructor pre-sets the @MapsId id, so an
+    // id-based check would route a new row to merge() and fail with "null identifier".
+    @Override
+    @Transient
+    public boolean isNew() {
+        return createdAt == null;
+    }
 }
diff --git a/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java b/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
index 684e22a98f..a4b2366379 100644
--- a/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
+++ b/app/saas/src/main/java/stirling/software/saas/security/SupabaseAuthenticationFilter.java
@@ -239,7 +239,7 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
                         && !supabaseUser.isAnonymous()) {
                     user = upgradeAnonymousUser(user, supabaseUser, jwt);
                 }
-                return recoverMissingTeam(user);
+                return user;
             }
 
             return createUser(jwt, supabaseId, email, appMetadata);
@@ -271,10 +271,8 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
             user.setUsername(supabaseUser.getEmail());
         }
         try {
-            User saved = userService.saveUser(user);
             // Give the account its own team rather than the shared Default team.
-            saved.setTeam(saasTeamService.ensurePersonalTeam(saved));
-            return saved;
+            return saasTeamService.saveUserWithPersonalTeam(user);
         } catch (DataIntegrityViolationException e) {
             log.warn(
                     "Email collision upgrading anonymous user {} to {}: {}",
@@ -372,60 +370,22 @@ public class SupabaseAuthenticationFilter extends OncePerRequestFilter {
             throw new AuthenticationFailureException("Failed to create SupabaseUser", e);
         }
 
-        User savedUser;
-        boolean weCreatedThisUser = true;
+        // Guests get NO team: the editor is free and needs none. Everyone else is provisioned
+        // atomically, so a user visible to a parallel request always already has one.
         try {
-            savedUser = userService.saveUser(newUser);
+            return isAnonymous(jwt)
+                    ? userService.saveUser(newUser)
+                    : saasTeamService.saveUserWithPersonalTeam(newUser);
         } catch (DataIntegrityViolationException dup) {
             // Parallel filter won the race; fetch the winning row.
-            weCreatedThisUser = false;
-            savedUser =
-                    userService
-                            .findBySupabaseId(supabaseId)
-                            .orElseThrow(
-                                    () ->
-                                            new AuthenticationFailureException(
-                                                    "User creation conflict, but unable to find existing user",
-                                                    dup));
+            return userService
+                    .findBySupabaseId(supabaseId)
+                    .orElseThrow(
+                            () ->
+                                    new AuthenticationFailureException(
+                                            "User creation conflict, but unable to find existing user",
+                                            dup));
         }
-
-        // Only the DB-race winner runs first-time init; the losers skip it. Guests (anonymous
-        // sessions) get NO team: the editor is free and needs none, and automation requires a
-        // real account.
-        if (weCreatedThisUser && !isAnonymous(jwt)) {
-            try {
-                savedUser.setTeam(saasTeamService.ensurePersonalTeam(savedUser));
-            } catch (Exception e) {
-                log.warn(
-                        "Failed to create personal team for new user {} ({}): {}",
-                        LogRedactionUtils.redactSupabaseId(supabaseId),
-                        LogRedactionUtils.redactEmail(savedUser.getUsername()),
-                        e.getMessage());
-            }
-        }
-        return savedUser;
-    }
-
-    /**
-     * Recover an account stranded without a team: signup is the only other place one is assigned,
-     * so a null team_id is otherwise permanent — and portal access derives from leading a team.
-     * Guests get none by design.
-     */
-    private User recoverMissingTeam(User user) {
-        if (user.getTeam() != null
-                || ANONYMOUS.toString().equalsIgnoreCase(user.getAuthenticationType())) {
-            return user;
-        }
-        try {
-            user.setTeam(saasTeamService.ensurePersonalTeam(user));
-            log.info("Assigned a personal team to user {} which had none", user.getId());
-        } catch (Exception e) {
-            log.warn(
-                    "Could not assign a personal team to user {}: {}",
-                    user.getId(),
-                    e.getMessage());
-        }
-        return user;
     }
 
     private boolean apiKeyAuthenticated(HttpServletRequest request) throws AuthenticationException {
diff --git a/app/saas/src/main/java/stirling/software/saas/service/SaasTeamService.java b/app/saas/src/main/java/stirling/software/saas/service/SaasTeamService.java
index bda0602261..0038cca42a 100644
--- a/app/saas/src/main/java/stirling/software/saas/service/SaasTeamService.java
+++ b/app/saas/src/main/java/stirling/software/saas/service/SaasTeamService.java
@@ -53,6 +53,18 @@ public class SaasTeamService {
     public static final String DEFAULT_TEAM_NAME = "Default";
     public static final String INTERNAL_TEAM_NAME = "Internal";
 
+    /**
+     * Persist a user and their personal team atomically: an account with no team has no portal
+     * access and no way to acquire one, so a teamless user must never be committed. Constraint
+     * violations (the concurrent-signup race) propagate for the caller to resolve.
+     */
+    @Transactional
+    public User saveUserWithPersonalTeam(User user) {
+        User saved = userService.saveUser(user);
+        saved.setTeam(ensurePersonalTeam(saved));
+        return saved;
+    }
+
     /** Returns the user's personal team, creating one if they have none. Idempotent. */
     @Transactional
     public Team ensurePersonalTeam(User user) {
@@ -60,9 +72,37 @@ public class SaasTeamService {
         if (existing != null && saasTeamExtensionService.isPersonal(existing)) {
             return existing;
         }
+        // An empty users.team_id does not prove there is no personal team; adopt one the user
+        // already owns rather than minting a second.
+        Team owned = existingPersonalTeam(user);
+        if (owned != null) {
+            user.setTeam(owned);
+            userService.saveUser(user);
+            return owned;
+        }
         return createPersonalTeam(user);
     }
 
+    /**
+     * The personal team the user already owns — their recorded home, else a solo team they lead.
+     */
+    private Team existingPersonalTeam(User user) {
+        Long homeId = saasUserExtensionService.getHomeTeamId(user);
+        if (homeId != null) {
+            Team home = teamRepository.findById(homeId).orElse(null);
+            if (home != null) {
+                return home;
+            }
+        }
+        for (TeamMembership membership : membershipRepository.findByUserId(user.getId())) {
+            Team team = membership.getTeam();
+            if (membership.isLeader() && membershipRepository.countByTeamId(team.getId()) == 1) {
+                return team;
+            }
+        }
+        return null;
+    }
+
     /**
      * Create personal team for new user during signup or migrate existing user from Default team
      *
diff --git a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
index 3b8a0292c7..f6181dcebe 100644
--- a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterMoreTest.java
@@ -315,14 +315,13 @@ class SupabaseAuthenticationFilterMoreTest {
             local.setSupabaseId(supabaseId);
             local.setAuthenticationType(AuthenticationType.ANONYMOUS);
             when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.of(local));
-            when(userService.saveUser(any(User.class))).thenAnswer(inv -> inv.getArgument(0));
-            when(saasTeamService.ensurePersonalTeam(any(User.class))).thenReturn(new Team());
+            when(saasTeamService.saveUserWithPersonalTeam(any(User.class)))
+                    .thenAnswer(inv -> inv.getArgument(0));
 
             bearer("tok");
             filter.doFilter(request, response, chain);
 
-            verify(userService).saveUser(any(User.class));
-            verify(saasTeamService).ensurePersonalTeam(any(User.class));
+            verify(saasTeamService).saveUserWithPersonalTeam(any(User.class));
             assertThat(local.getEmail()).isEqualTo("real@example.com");
             assertThat(local.getUsername()).isEqualTo("real@example.com");
             assertThat(local.getAuthenticationType())
@@ -342,8 +341,8 @@ class SupabaseAuthenticationFilterMoreTest {
             local.setSupabaseId(supabaseId);
             local.setAuthenticationType(AuthenticationType.ANONYMOUS);
             when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.of(local));
-            when(userService.saveUser(any(User.class))).thenAnswer(inv -> inv.getArgument(0));
-            when(saasTeamService.ensurePersonalTeam(any(User.class))).thenReturn(new Team());
+            when(saasTeamService.saveUserWithPersonalTeam(any(User.class)))
+                    .thenAnswer(inv -> inv.getArgument(0));
 
             bearer("tok");
             filter.doFilter(request, response, chain);
@@ -365,7 +364,7 @@ class SupabaseAuthenticationFilterMoreTest {
             local.setSupabaseId(supabaseId);
             local.setAuthenticationType(AuthenticationType.ANONYMOUS);
             when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.of(local));
-            when(userService.saveUser(any(User.class)))
+            when(saasTeamService.saveUserWithPersonalTeam(any(User.class)))
                     .thenThrow(new DataIntegrityViolationException("email exists"));
 
             bearer("tok");
@@ -489,12 +488,13 @@ class SupabaseAuthenticationFilterMoreTest {
             org.mockito.Mockito.doThrow(new DataIntegrityViolationException("dup"))
                     .when(supabaseUserService)
                     .createSupabaseUser(eq(supabaseId), any(), eq(false));
-            when(userService.saveUser(any(User.class))).thenAnswer(inv -> inv.getArgument(0));
+            when(saasTeamService.saveUserWithPersonalTeam(any(User.class)))
+                    .thenAnswer(inv -> inv.getArgument(0));
 
             bearer("tok");
             filter.doFilter(request, response, chain);
 
-            verify(userService, times(1)).saveUser(any(User.class));
+            verify(saasTeamService, times(1)).saveUserWithPersonalTeam(any(User.class));
             assertThat(SecurityContextHolder.getContext().getAuthentication())
                     .isInstanceOf(EnhancedJwtAuthenticationToken.class);
         }
@@ -516,7 +516,7 @@ class SupabaseAuthenticationFilterMoreTest {
             filter.doFilter(request, response, chain);
 
             assertThat(response.getStatus()).isEqualTo(401);
-            verify(userService, never()).saveUser(any());
+            verify(saasTeamService, never()).saveUserWithPersonalTeam(any());
         }
 
         @Test
@@ -533,13 +533,13 @@ class SupabaseAuthenticationFilterMoreTest {
             when(userService.findBySupabaseId(supabaseId))
                     .thenReturn(Optional.empty())
                     .thenReturn(Optional.of(winner));
-            when(userService.saveUser(any(User.class)))
+            when(saasTeamService.saveUserWithPersonalTeam(any(User.class)))
                     .thenThrow(new DataIntegrityViolationException("dup user"));
 
             bearer("tok");
             filter.doFilter(request, response, chain);
 
-            // Race loser does not run first-time init (ensurePersonalTeam).
+            // The winner committed user and team together, so the loser just adopts its row.
             verify(saasTeamService, never()).ensurePersonalTeam(any());
             assertThat(SecurityContextHolder.getContext().getAuthentication())
                     .isInstanceOf(EnhancedJwtAuthenticationToken.class);
@@ -554,7 +554,7 @@ class SupabaseAuthenticationFilterMoreTest {
             when(supabaseUserService.getUser(supabaseId))
                     .thenReturn(supabaseUser(supabaseId, "lost@example.com", false));
             when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.empty());
-            when(userService.saveUser(any(User.class)))
+            when(saasTeamService.saveUserWithPersonalTeam(any(User.class)))
                     .thenThrow(new DataIntegrityViolationException("dup user"));
 
             bearer("tok");
@@ -564,31 +564,30 @@ class SupabaseAuthenticationFilterMoreTest {
         }
 
         @Test
-        @DisplayName("personal team creation failure for a new user is swallowed")
-        void personalTeamFailureSwallowed() throws Exception {
+        @DisplayName("personal team creation failure fails the request, it is not swallowed")
+        void personalTeamFailureFailsAuth() throws Exception {
             UUID supabaseId = UUID.randomUUID();
             Jwt jwt = fullJwt(supabaseId, "team@example.com", false, "email");
             when(jwtDecoder.decode("tok")).thenReturn(jwt);
             when(supabaseUserService.getUser(supabaseId))
                     .thenReturn(supabaseUser(supabaseId, "team@example.com", false));
             when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.empty());
-            when(userService.saveUser(any(User.class))).thenAnswer(inv -> inv.getArgument(0));
-            when(saasTeamService.ensurePersonalTeam(any(User.class)))
+            when(saasTeamService.saveUserWithPersonalTeam(any(User.class)))
                     .thenThrow(new IllegalStateException("team boom"));
 
             bearer("tok");
             filter.doFilter(request, response, chain);
 
-            // Auth still succeeds even though team creation failed.
-            assertThat(SecurityContextHolder.getContext().getAuthentication())
-                    .isInstanceOf(EnhancedJwtAuthenticationToken.class);
-            verify(userService, times(1)).saveUser(any(User.class));
+            // A teamless account has no portal access, so a failed provision must surface
+            // rather than admit a half-built user.
+            assertThat(response.getStatus()).isEqualTo(401);
+            assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
         }
     }
 
     @Nested
-    @DisplayName("Team recovery for existing accounts")
-    class TeamRecovery {
+    @DisplayName("Existing accounts are never re-provisioned on the request path")
+    class ExistingAccountProvisioning {
 
         private User existingWebUser(UUID supabaseId) {
             User local = newUser("real@example.com");
@@ -598,8 +597,8 @@ class SupabaseAuthenticationFilterMoreTest {
         }
 
         @Test
-        @DisplayName("an existing account with no team is given a personal team")
-        void assignsTeamWhenMissing() throws Exception {
+        @DisplayName("a teamless account is left alone, not healed on every request")
+        void teamlessAccountIsNotHealed() throws Exception {
             UUID supabaseId = UUID.randomUUID();
             when(jwtDecoder.decode("tok"))
                     .thenReturn(fullJwt(supabaseId, "real@example.com", false, "email"));
@@ -607,15 +606,16 @@ class SupabaseAuthenticationFilterMoreTest {
                     .thenReturn(supabaseUser(supabaseId, "real@example.com", false));
 
             User local = existingWebUser(supabaseId);
-            Team recovered = new Team();
             when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.of(local));
-            when(saasTeamService.ensurePersonalTeam(local)).thenReturn(recovered);
 
             bearer("tok");
             filter.doFilter(request, response, chain);
 
-            verify(saasTeamService).ensurePersonalTeam(local);
-            assertThat(local.getTeam()).isSameAs(recovered);
+            // Healing here would run per request with no mutual exclusion, so parallel
+            // requests would mint duplicate teams. Provisioning belongs to signup alone.
+            verify(saasTeamService, never()).ensurePersonalTeam(any(User.class));
+            verify(saasTeamService, never()).saveUserWithPersonalTeam(any(User.class));
+            assertThat(local.getTeam()).isNull();
         }
 
         @Test
diff --git a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterTest.java b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterTest.java
index 58cf2d72a0..d78be84189 100644
--- a/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterTest.java
+++ b/app/saas/src/test/java/stirling/software/saas/security/SupabaseAuthenticationFilterTest.java
@@ -168,7 +168,7 @@ class SupabaseAuthenticationFilterTest {
         when(supabaseUserService.getUser(supabaseId))
                 .thenReturn(supabaseUserMatching(supabaseId, "bob@example.com", false));
         when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.empty());
-        when(userService.saveUser(any())).thenAnswer(inv -> inv.getArgument(0));
+        when(saasTeamService.saveUserWithPersonalTeam(any())).thenAnswer(inv -> inv.getArgument(0));
 
         request.setRequestURI("/api/v1/something");
         request.setMethod("POST");
@@ -176,10 +176,9 @@ class SupabaseAuthenticationFilterTest {
 
         filter.doFilter(request, response, chain);
 
-        verify(userService, times(1)).saveUser(any(User.class));
         verify(supabaseUserService).createSupabaseUser(supabaseId, "bob@example.com", false);
-        // New users get their own personal team, never the shared Default team.
-        verify(saasTeamService).ensurePersonalTeam(any(User.class));
+        // Own personal team, never the shared Default team, written with the user.
+        verify(saasTeamService, times(1)).saveUserWithPersonalTeam(any(User.class));
         verify(teamService, never()).getOrCreateDefaultTeam();
         assertThat(SecurityContextHolder.getContext().getAuthentication())
                 .isInstanceOf(EnhancedJwtAuthenticationToken.class);
@@ -194,7 +193,7 @@ class SupabaseAuthenticationFilterTest {
         when(supabaseUserService.getUser(supabaseId))
                 .thenReturn(supabaseUserMatching(supabaseId, "carol@example.com", false));
         when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.empty());
-        when(userService.saveUser(any(User.class)))
+        when(saasTeamService.saveUserWithPersonalTeam(any(User.class)))
                 .thenAnswer(
                         inv -> {
                             User u = inv.getArgument(0);
@@ -210,7 +209,7 @@ class SupabaseAuthenticationFilterTest {
 
         filter.doFilter(request, response, chain);
 
-        verify(userService, times(1)).saveUser(any(User.class));
+        verify(saasTeamService, times(1)).saveUserWithPersonalTeam(any(User.class));
     }
 
     @Test
@@ -222,7 +221,7 @@ class SupabaseAuthenticationFilterTest {
         when(supabaseUserService.getUser(supabaseId))
                 .thenReturn(supabaseUserMatching(supabaseId, "dave@example.com", false));
         when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.empty());
-        when(userService.saveUser(any(User.class)))
+        when(saasTeamService.saveUserWithPersonalTeam(any(User.class)))
                 .thenAnswer(
                         inv -> {
                             User u = inv.getArgument(0);
@@ -238,7 +237,7 @@ class SupabaseAuthenticationFilterTest {
 
         filter.doFilter(request, response, chain);
 
-        verify(userService, times(1)).saveUser(any(User.class));
+        verify(saasTeamService, times(1)).saveUserWithPersonalTeam(any(User.class));
     }
 
     @Test
@@ -250,7 +249,7 @@ class SupabaseAuthenticationFilterTest {
         when(supabaseUserService.getUser(supabaseId))
                 .thenReturn(supabaseUserMatching(supabaseId, "eve@example.com", false));
         when(userService.findBySupabaseId(supabaseId)).thenReturn(Optional.empty());
-        when(userService.saveUser(any(User.class)))
+        when(saasTeamService.saveUserWithPersonalTeam(any(User.class)))
                 .thenAnswer(
                         inv -> {
                             User u = inv.getArgument(0);
@@ -266,7 +265,7 @@ class SupabaseAuthenticationFilterTest {
 
         filter.doFilter(request, response, chain);
 
-        verify(userService, times(1)).saveUser(any(User.class));
+        verify(saasTeamService, times(1)).saveUserWithPersonalTeam(any(User.class));
     }
 
     @Test

From 4dc0927104dc7943a6b8fc3f0c860194e16554a1 Mon Sep 17 00:00:00 2001
From: Reece Browne <74901996+reecebrowne@users.noreply.github.com>
Date: Wed, 29 Jul 2026 18:08:08 +0100
Subject: [PATCH 108/109] a11y job: emit the affected-story list on one line
 (#7196)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Fixes the a11y check failing with `permission denied` on any PR that
touches more than one story (currently hitting #7163).

The script that lists which stories to scan printed one path per line.
That list gets pasted into a shell command, so everything after the
first line fell out of the command — the shell treated the second path
as a command of its own and failed.

One-line fix: print the list on a single line.

## Testing

Changed two components and ran the task from both git-bash and
PowerShell — both stories scanned, check passes. #7163's red check
should go green on re-run once this is in.
---
 frontend/.storybook/a11y-changed.mjs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/frontend/.storybook/a11y-changed.mjs b/frontend/.storybook/a11y-changed.mjs
index 6aacf6274c..5ff7a9e633 100644
--- a/frontend/.storybook/a11y-changed.mjs
+++ b/frontend/.storybook/a11y-changed.mjs
@@ -45,4 +45,12 @@ for (const f of changed) {
     if (existsSync(s)) stories.add(s);
 }
 
-process.stdout.write([...stories].sort().join("\n"));
+// One line, each path quoted: the output is interpolated into a task command,
+// where a newline would end the command after the first story and an unquoted
+// space would split a path into two arguments.
+process.stdout.write(
+  [...stories]
+    .sort()
+    .map((s) => `"${s}"`)
+    .join(" "),
+);

From b35329c8f5e134d07c687fbc34de2e97154b5c35 Mon Sep 17 00:00:00 2001
From: Reece Browne <74901996+reecebrowne@users.noreply.github.com>
Date: Thu, 30 Jul 2026 09:13:41 +0100
Subject: [PATCH 109/109] a11y scan: generate required assets, and fail when a
 story file can't load (#7201)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## What

Two related bugs found while looking at why #7187's a11y check behaves
differently on CI than locally.

### 21 stories were never being scanned on CI

The scan tasks only depended on `install`, not `prepare`. On a fresh
checkout that means the generated icon set
(`editor/src/assets/material-symbols-icons.json`, gitignored) doesn't
exist, so every story that reaches `LocalIcon` fails to import:

```
Failed to resolve import "../../../assets/material-symbols-icons.json"
from "editor/src/core/components/shared/LocalIcon.tsx"
```

On CI that was four story files / 21 stories, every run. It works
locally only because our trees already have the file from a previous
build. The scan tasks now depend on `prepare`, like the `build:*` tasks
do.

### The gate reported those runs as clean

Worse than the missing stories: a file that fails to import produces a
**failed suite with no assertions**. Every check in `a11y-check.mjs`
reads assertions, so the file satisfied the manifest, contributed
nothing to compare, and the run printed `✓ no a11y regressions`.

An assertion-less failed suite now fails the gate and points at the scan
log for the underlying resolve error. `--record` refuses in the same
situation, so a baseline can't be written that quietly drops those
stories.

Also switched the affected-story emptiness test to single quotes, since
that list now carries its own per-path quoting (it was producing `[ -z
""a" "b"" ]`).

## Testing

- Deleted the generated asset to reproduce a fresh checkout: the gate
**fails** with the file named and the cause explained, where before it
printed `✓ no a11y regressions` and exited 0.
- With the `prepare` dependency the task regenerates the asset itself
and the previously-invisible files scan: 21 stories, 35 story-rule
pairs, all already baselined.
---
 .taskfiles/frontend.yml            | 14 ++++++------
 frontend/.storybook/a11y-check.mjs | 36 +++++++++++++++++++++++++++---
 2 files changed, 40 insertions(+), 10 deletions(-)

diff --git a/.taskfiles/frontend.yml b/.taskfiles/frontend.yml
index 8c32efc5e3..3c2113bf96 100644
--- a/.taskfiles/frontend.yml
+++ b/.taskfiles/frontend.yml
@@ -184,13 +184,13 @@ tasks:
 
   storybook:
     desc: "Start Storybook dev server"
-    deps: [install]
+    deps: [prepare]
     cmds:
       - npx storybook dev -p 6006 {{.CLI_ARGS}}
 
   storybook:build:
     desc: "Build static Storybook"
-    deps: [install]
+    deps: [prepare]
     cmds:
       - npx storybook build {{.CLI_ARGS}}
 
@@ -204,7 +204,7 @@ tasks:
 
   storybook:test:
     desc: "Scan every story in real Chromium: it must render and pass axe"
-    deps: [install, storybook:browser]
+    deps: [prepare, storybook:browser]
     cmds:
       # Runs each story as a browser test. Pass a filter through, e.g.
       #   task frontend:storybook:test -- Button
@@ -212,7 +212,7 @@ tasks:
 
   storybook:a11y:
     desc: "a11y regression gate over every story: fail only on NEW axe violations"
-    deps: [install, storybook:browser]
+    deps: [prepare, storybook:browser]
     cmds:
       - node .storybook/a11y-scan.mjs
       - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt
@@ -231,14 +231,14 @@ tasks:
 
       Pass a base ref through CLI_ARGS, e.g.
         task frontend:storybook:a11y:changed -- origin/release
-    deps: [install, storybook:browser]
+    deps: [prepare, storybook:browser]
     vars:
       BASE: '{{.CLI_ARGS | default "origin/main"}}'
       CHANGED:
         sh: node .storybook/a11y-changed.mjs {{.CLI_ARGS | default "origin/main"}}
     cmds:
       - cmd: |
-          if [ -z "{{.CHANGED}}" ]; then
+          if [ -z '{{.CHANGED}}' ]; then
             echo "a11y: no story files affected vs {{.BASE}} — nothing to check"
             exit 0
           fi
@@ -247,7 +247,7 @@ tasks:
 
   storybook:a11y:record:
     desc: "Re-record the a11y baseline (run after intentionally fixing/adding violations)"
-    deps: [install, storybook:browser]
+    deps: [prepare, storybook:browser]
     cmds:
       - node .storybook/a11y-scan.mjs
       - node .storybook/a11y-check.mjs --in .a11y-scan --manifest .a11y-scan/manifest.txt --record
diff --git a/frontend/.storybook/a11y-check.mjs b/frontend/.storybook/a11y-check.mjs
index 7eef5e079e..43092812ff 100644
--- a/frontend/.storybook/a11y-check.mjs
+++ b/frontend/.storybook/a11y-check.mjs
@@ -52,6 +52,7 @@ const RULE_URL = /dequeuniversity\.com\/rules\/axe\/[\d.]+\/([a-z0-9-]+)/g;
 function collect(dir) {
   const rules = {}; // storyKey -> Set(ruleId)
   const crashed = []; // storyKey[] — failed for a non-a11y reason
+  const unloadable = []; // storyFile[] — the file itself never ran
   const seenFiles = new Set();
   let scanned = 0;
 
@@ -68,6 +69,14 @@ function collect(dir) {
       const idx = norm.search(/editor\/src\//);
       const file = idx >= 0 ? norm.slice(idx) : norm;
       seenFiles.add(file);
+      // A story file that fails to import produces a failed suite with no
+      // assertions at all. Every other check here reads assertions, so such a
+      // file satisfies the manifest and contributes nothing — its stories go
+      // unscanned while the run still reports clean.
+      if ((tf.assertionResults || []).length === 0 && tf.status !== "passed") {
+        unloadable.push(file);
+        continue;
+      }
       for (const a of tf.assertionResults || []) {
         scanned++;
         if (a.status === "passed") continue;
@@ -88,14 +97,14 @@ function collect(dir) {
       }
     }
   }
-  return { rules, crashed, seenFiles, scanned };
+  return { rules, crashed, unloadable, seenFiles, scanned };
 }
 
 if (!existsSync(inDir)) {
   console.error(`a11y-check: scan dir not found: ${inDir}`);
   process.exit(2);
 }
-const { rules, crashed, seenFiles, scanned } = collect(inDir);
+const { rules, crashed, unloadable, seenFiles, scanned } = collect(inDir);
 const observed = {};
 for (const [k, set] of Object.entries(rules)) observed[k] = [...set].sort();
 
@@ -129,6 +138,14 @@ if (record || merge) {
     merge && existsSync(baselineFile)
       ? JSON.parse(readFileSync(baselineFile, "utf8"))
       : {};
+  if (unloadable.length) {
+    console.error(
+      `a11y-check: refusing to record — ${unloadable.length} story file(s) failed to load:`,
+    );
+    unloadable.slice(0, 20).forEach((f) => console.error(`  ${f}`));
+    console.error("Their stories never ran, so the baseline would lose them.");
+    process.exit(2);
+  }
   if (crashed.length) {
     console.error(
       `a11y-check: refusing to record — ${crashed.length} story(ies) failed for a non-a11y reason:`,
@@ -176,6 +193,19 @@ console.log(
     `${pairs} story-rule pairs (baselined).`,
 );
 
+if (unloadable.length) {
+  console.error(
+    `\n✖ ${unloadable.length} story file(s) failed to load, so their stories never ran:`,
+  );
+  unloadable.slice(0, 50).forEach((f) => console.error(`  ${f}`));
+  if (unloadable.length > 50)
+    console.error(`  … and ${unloadable.length - 50} more`);
+  console.error(
+    "\nA file that cannot be imported reports no violations at all. The resolve " +
+      "or transform error is in the scan log (.a11y-scan/scan.log, uploaded as a " +
+      "run artifact); a missing generated asset is the usual cause.",
+  );
+}
 if (crashed.length) {
   console.error(`\n✖ ${crashed.length} story(ies) failed to render:`);
   crashed.slice(0, 50).forEach((k) => console.error(`  ${k}`));
@@ -191,7 +221,7 @@ if (regressions.length) {
       "baseline key no longer matches — re-record: task frontend:storybook:a11y:record",
   );
 }
-if (crashed.length || regressions.length) process.exit(1);
+if (unloadable.length || crashed.length || regressions.length) process.exit(1);
 
 if (fixed.length)
   console.log(